diff --git a/.github/scripts/build_translation_cache.py b/.github/scripts/build_translation_cache.py
index 95825a29..b5797010 100644
--- a/.github/scripts/build_translation_cache.py
+++ b/.github/scripts/build_translation_cache.py
@@ -38,6 +38,18 @@ DEFAULT_CONTEXT = "Context: Technical message for Proxmox and IT. Translate:"
 # provider, then restore the exact source spelling afterwards. Keep longer
 # terms first so ``gasket`` cannot consume part of ``gasket-dkms``.
 PROTECTED_TECHNICAL_TERMS = (
+    # Product names, kept whole. Left to a translator, "Proxmox Backup Server"
+    # became "Proxmox Sicherungsserver" and "Serveur de sauvegarde Proxmox",
+    # and when a provider rightly handed it back unchanged the string was
+    # retried and then dropped as untranslated.
+    "Proxmox Backup Server",
+    "Proxmox Datacenter Manager",
+    "Proxmox Mail Gateway",
+    "Proxmox VE",
+    "ProxMenux Monitor",
+    "ProxMenux Optimizations",
+    "Secure Gateway",
+    "Tailscale",
     "google/gasket-driver",
     "feranick/gasket-driver",
     "libedgetpu1-std",
diff --git a/.github/scripts/build_web_docs_i18n.py b/.github/scripts/build_web_docs_i18n.py
index e0567c15..cf77fd5f 100644
--- a/.github/scripts/build_web_docs_i18n.py
+++ b/.github/scripts/build_web_docs_i18n.py
@@ -73,6 +73,24 @@ TECHNICAL_TERMS = (
     "DKMS",
     "SSH",
     "API",
+    "Flask",
+    "SQLite",
+    "Prometheus",
+    "Grafana",
+    "Uptime Kuma",
+    "PWA",
+    "Fail2Ban",
+    "Tailscale",
+    "JavaScript",
+    "TypeScript",
+    "Next.js",
+    "Coral",
+    "rclone",
+    "journald",
+    "gasket",
+    "apex",
+    "Alpine",
+    "OpenVINO",
 )
 
 PROTECTED_PATTERNS = (
@@ -88,9 +106,13 @@ PROTECTED_PATTERNS = (
     re.compile(r"(?<![A-Za-z0-9<])/(?:[A-Za-z0-9._~:@%+=-]+/)*[A-Za-z0-9._~:@%+=-]+"),
     re.compile(r"\b[A-Za-z0-9_.-]+\.(?:json|ya?ml|toml|conf|service|socket|sh|py|tsx?|jsx?|md)\b"),
     re.compile(r"(?<![\w.@])@[A-Za-z_][A-Za-z0-9_]*"),
+    # Identifiers and encoded delimiters remain literal even outside <code>.
+    re.compile(r"(?<![A-Za-z0-9_])_?[A-Za-z][A-Za-z0-9]*(?:_[A-Za-z0-9]+)+(?![A-Za-z0-9_])"),
+    re.compile(r"\b[A-Za-z0-9]*(?:[a-z][A-Z])[A-Za-z0-9]*\b"),
+    re.compile(r"&(?:[A-Za-z]+|#[0-9]+|#x[0-9A-Fa-f]+);"),
 )
 LITERAL_TAG_RE = re.compile(
-    r"<(code|kbd|pre)\b[^>]*>.*?</\1>",
+    r"<(code|codeNw|codeXs|kbd|pre)\b[^>]*>.*?</\1>",
     re.IGNORECASE | re.DOTALL,
 )
 
@@ -109,16 +131,23 @@ ANY_TAG_RE = re.compile(r"</?[A-Za-z][^<>]*>")
 BARE_SENTINELS = False
 PLACEHOLDER_RE = re.compile(r"\{[A-Za-z_][A-Za-z0-9_.-]*\}")
 NON_TRANSLATABLE_KEYS = {
+    "accent",
+    "categoryslug",
     "command",
     "code",
     "href",
     "icon",
+    "iconbg",
     "id",
+    "menucmd",
     "path",
     "route",
     "slug",
     "src",
     "url",
+    "color",
+    "tone",
+    "variant",
 }
 SOURCE_STATE_VERSION = 1
 
@@ -186,12 +215,34 @@ def should_copy(source: str, path: tuple[str | int, ...]) -> bool:
     if not source.strip() or not re.search(r"[A-Za-z]", source):
         return True
     last = str(path[-1]).lower() if path else ""
+    # These fields describe the surrounding snippet; they are prose, even
+    # though their names end in "Code".
+    if last in {"aftercode", "beforecode"}:
+        return False
+    # This UI breadcrumb is prose, rather than a filesystem path.
+    if last == "uipath" and "<strong>" in source:
+        return False
+    if last == "flow" and source in {"loader", "dedicated"}:
+        return True
+    # These exact values drive rendering/navigation; similarly named visible
+    # labels remain translatable.
+    if last == "branch" and source in {"main", "develop", "feature/*"}:
+        return True
+    if last == "kind" and source in {"internal", "external"}:
+        return True
+    if last == "key" and source in {"linux", "nas", "windows"}:
+        return True
     if last in NON_TRANSLATABLE_KEYS or any(
         last.endswith(suffix)
         for suffix in ("url", "href", "path", "command", "code", "icon")
     ):
         return True
-    if re.fullmatch(r"https?://\S+", source) or re.fullmatch(r"/[A-Za-z0-9_./:@%+=-]+", source):
+    if re.fullmatch(r"https?://\S+", source) or re.fullmatch(r"/\S+", source):
+        return True
+    # Standalone literal blocks contain examples, not prose. Separators between
+    # several blocks do not make their command/configuration contents translatable.
+    without_literals = LITERAL_TAG_RE.sub("", source)
+    if without_literals != source and not re.search(r"[A-Za-z]", ANY_TAG_RE.sub("", without_literals)):
         return True
     if re.fullmatch(r"[A-Z0-9_.:/+-]{2,}", source):
         return True
@@ -202,6 +253,15 @@ def leaf_token(path: tuple[str | int, ...]) -> str:
     return json.dumps(path, ensure_ascii=False, separators=(",", ":"))
 
 
+def literal_values_match(source: Any, target: Any) -> bool:
+    """Literal commands and rendering metadata must follow the source too."""
+    return all(
+        not should_copy(leaf.source, leaf.path)
+        or get_at_path(target, leaf.path) == leaf.source
+        for leaf in iter_leaves(source)
+    )
+
+
 def source_fingerprints(source: Any) -> dict[str, str]:
     return {
         leaf_token(leaf.path): hashlib.sha256(leaf.source.encode("utf-8")).hexdigest()[:20]
@@ -240,7 +300,7 @@ def protect_rich_tags(text: str) -> tuple[str, dict[str, str]]:
 
     def replace(match: re.Match[str]) -> str:
         original = match.group(1)
-        if original.lower() in {"code", "kbd", "pre"}:
+        if original.lower() in {"code", "codenw", "codexs", "kbd", "pre"}:
             return match.group(0)
         key = original.lower()
         internal = names.get(key)
@@ -329,11 +389,14 @@ def protect_text(text: str) -> tuple[str, dict[str, str]]:
 
 
 def restore_text(text: str, mapping: dict[str, str]) -> str:
-    missing = [token for token in mapping if token not in text]
+    # A local model may append a digit to a bare sentinel. A substring match
+    # would silently restore the prefix and leak the extra digit into prose.
+    patterns = {token: re.compile(re.escape(token) + r"(?![0-9])") for token in mapping}
+    missing = [token for token, pattern in patterns.items() if not pattern.search(text)]
     if missing:
         raise ValueError(f"translation provider changed protected token {missing[0]}")
     for token, original in mapping.items():
-        text = text.replace(token, original)
+        text = patterns[token].sub(lambda match: original, text)
     return text
 
 
@@ -347,6 +410,11 @@ def validate_contract(source: str, target: str) -> None:
         raise ValueError("literal code changed")
     if sorted(PLACEHOLDER_RE.findall(source)) != sorted(PLACEHOLDER_RE.findall(target)):
         raise ValueError("placeholder contract changed")
+    # Bare numeric protection markers once leaked a trailing zero just
+    # outside an otherwise intact code span. Literal/ICU checks cannot see it.
+    residue = re.compile(r'(?:</(?:code|codeNw|codeXs|pre|kbd)>|<strong>)(0+)(?=\s|[;:/<().,-]|$)')
+    if len(residue.findall(target)) > len(residue.findall(source)):
+        raise ValueError("unexpected numeric residue next to literal markup")
 
 
 def provider_function(args: argparse.Namespace) -> Callable[[str, str], str]:
@@ -822,7 +890,10 @@ def main() -> int:
             leaves = pending_leaves(source, target, queued_tokens)
             total_strings += len(iter_leaves(source))
             missing_strings += len(leaves)
-            schema_changed = not schema_matches(source, target)
+            schema_changed = (
+                not schema_matches(source, target)
+                or not literal_values_match(source, target)
+            )
             if leaves or schema_changed:
                 pending.append(
                     (
diff --git a/.github/scripts/check_terminal_catalogs.py b/.github/scripts/check_terminal_catalogs.py
new file mode 100644
index 00000000..ba5795da
--- /dev/null
+++ b/.github/scripts/check_terminal_catalogs.py
@@ -0,0 +1,77 @@
+#!/usr/bin/env python3
+"""Check active terminal translations offline, without generating any text.
+
+Validates formatting fields and literal commands/identifiers. Missing values
+can retain English fallback; --require-complete makes them errors. This does
+not establish the accuracy or fluency of the translated prose.
+"""
+from __future__ import annotations
+
+import argparse
+from pathlib import Path
+import re
+
+from build_translation_cache import (
+    DEFAULT_LANGUAGES, STRUCTURAL_LITERAL_RE, extract_catalog_texts,
+    extract_python_texts, extract_translate_texts,
+)
+from build_web_docs_i18n import read_json, validate_contract
+
+
+def active_sources(root: Path) -> list[str]:
+    # Match build-translation-cache.yml, including launchers outside scripts/.
+    extras = [root / name for name in ('menu', 'install_proxmenux.sh', 'install_proxmenux_beta.sh')]
+    texts = extract_translate_texts(root / 'scripts', extras)
+    texts += extract_translate_texts(root / 'oci/remote')
+    texts += extract_python_texts([root / 'scripts', root / 'oci/src', root / 'oci/remote'])
+    texts += extract_catalog_texts([root / 'oci/catalog'])
+    return sorted({text for text in texts if '$' not in text and '`' not in text})
+
+
+def validate_message(source: str, target: str, *, title_separator: bool = False) -> None:
+    validate_contract(source, target)
+    for match in STRUCTURAL_LITERAL_RE.finditer(source):
+        literal = match.group()
+        # A page title may replace its decorative separator with a dash.
+        # In command examples, a pipe remains a shell operator.
+        if title_separator and literal == '|':
+            continue
+        # DNS hostnames are case-insensitive. Paths, field names and command
+        # names are not, so do not case-fold those to hide a broken example.
+        is_hostname = re.fullmatch(r'[A-Za-z0-9.-]+\.(?:com|org|net|io)', literal)
+        if literal not in target and not (is_hostname and literal.casefold() in target.casefold()):
+            raise ValueError(f'literal command or identifier changed: {literal}')
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument('--root', type=Path, default=Path('.'))
+    parser.add_argument('--languages', default=','.join(DEFAULT_LANGUAGES))
+    parser.add_argument('--require-complete', action='store_true')
+    args = parser.parse_args()
+    root = args.root.resolve()
+    texts = active_sources(root)
+    errors = 0
+    for language in args.languages.split(','):
+        if language not in DEFAULT_LANGUAGES:
+            parser.error(f'Unsupported locale: {language}')
+        catalog = read_json(root / 'lang' / f'{language}.json') or {}
+        missing = 0
+        for source in texts:
+            target = catalog.get(source)
+            if not isinstance(target, str) or not target.strip():
+                missing += 1
+                continue
+            try:
+                validate_message(source, target)
+            except ValueError as error:
+                print(f'[{language}] {source!r}: {error}')
+                errors += 1
+        print(f'[{language}] active={len(texts)} missing={missing}')
+        if args.require_complete and missing:
+            errors += 1
+    return 1 if errors else 0
+
+
+if __name__ == '__main__':
+    raise SystemExit(main())
diff --git a/.github/scripts/check_web_docs_catalogs.py b/.github/scripts/check_web_docs_catalogs.py
new file mode 100644
index 00000000..422b39cb
--- /dev/null
+++ b/.github/scripts/check_web_docs_catalogs.py
@@ -0,0 +1,75 @@
+#!/usr/bin/env python3
+"""Check documentation translation structure and literal contracts offline.
+
+Missing locales/leaves are allowed by default because the website falls back
+to English. Use --require-complete when validating a catalog completion PR.
+This checks data integrity, not translation fluency or linguistic accuracy.
+"""
+from __future__ import annotations
+
+import argparse
+from pathlib import Path
+
+from build_web_docs_i18n import (
+    DEFAULT_LANGUAGES,
+    get_at_path,
+    iter_leaves,
+    literal_values_match,
+    read_json,
+    schema_matches,
+    source_files,
+)
+from check_terminal_catalogs import validate_message
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--messages-dir", type=Path, default=Path("web/messages"))
+    parser.add_argument("--languages", default=",".join(DEFAULT_LANGUAGES))
+    parser.add_argument("--require-complete", action="store_true")
+    args = parser.parse_args()
+    root = args.messages_dir.resolve()
+    files = source_files(root / "en", ".")
+    errors = 0
+    for language in args.languages.split(","):
+        language = language.strip()
+        if language not in DEFAULT_LANGUAGES:
+            parser.error(f"Unsupported locale: {language}")
+        missing = checked = present_files = 0
+        for file in files:
+            relative = file.relative_to(root / "en")
+            source = read_json(file)
+            target = read_json(root / language / relative)
+            if target is not None:
+                present_files += 1
+            if args.require_complete and not schema_matches(source, target):
+                print(f"[{language}] {relative}: source/target schema differs")
+                errors += 1
+            for leaf in iter_leaves(source):
+                localized = get_at_path(target, leaf.path)
+                if not isinstance(localized, str) or (leaf.source.strip() and not localized.strip()):
+                    missing += 1
+                    continue
+                try:
+                    validate_message(
+                        leaf.source, localized,
+                        title_separator=bool(
+                            leaf.path and leaf.path[0] == "meta"
+                            and leaf.path[-1] in ("title", "ogTitle", "twitterTitle")
+                        ),
+                    )
+                except ValueError as exc:
+                    print(f"[{language}] {relative}:{'.'.join(map(str, leaf.path))}: {exc}")
+                    errors += 1
+                checked += 1
+            if args.require_complete and not literal_values_match(source, target):
+                print(f"[{language}] {relative}: literal commands or rendering metadata differ")
+                errors += 1
+        print(f"[{language}] files={present_files}/{len(files)} strings={checked} missing={missing}")
+        if args.require_complete and missing:
+            errors += 1
+    return 1 if errors else 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/.github/scripts/run_offline_qualified.py b/.github/scripts/run_offline_qualified.py
index 9bd13abc..fe6c26d4 100644
--- a/.github/scripts/run_offline_qualified.py
+++ b/.github/scripts/run_offline_qualified.py
@@ -13,6 +13,7 @@ import sys
 import tempfile
 
 PYTHON_FILES = (
+    "AppImage/scripts/tests/test_native_app_discovery.py",
     "tests/test_audit_presentation.py",
     "tests/test_audit_safety_wording.py",
     "tests/test_audit_policy.py",
@@ -24,6 +25,7 @@ PYTHON_FILES = (
     "AppImage/scripts/tests/test_health_persistence_recurrence.py",
 )
 NODE_FILES = (
+    "tests/lxc_updates/test_native_app_discovery_ui.cjs",
     "tests/lxc_updates/test_docker_delegated_ui.cjs",
     "tests/test_audit_diagnostic_document.cjs",
     "tests/test_audit_policy.cjs",
diff --git a/.github/scripts/tests/test_build_web_docs_i18n.py b/.github/scripts/tests/test_build_web_docs_i18n.py
index ea2693ca..691a6639 100644
--- a/.github/scripts/tests/test_build_web_docs_i18n.py
+++ b/.github/scripts/tests/test_build_web_docs_i18n.py
@@ -60,6 +60,124 @@ class WebDocsI18nTests(unittest.TestCase):
         target = {"title": "Actualizaciones", "url": "https://example.com"}
         self.assertEqual(MODULE.pending_leaves(source, target), [])
 
+    def test_rendering_metadata_is_copied_but_visible_labels_are_translated(self):
+        for key, value in (("tone", "amber"), ("variant", "source"),
+                           ("accent", "border-blue-300 bg-blue-50"),
+                           ("iconBg", "bg-blue-100 text-blue-700"),
+                           ("color", "green")):
+            with self.subTest(key=key):
+                self.assertTrue(MODULE.should_copy(value, ("steps", 0, key)))
+                self.assertFalse(MODULE.should_copy(value, ("label",)))
+                self.assertEqual(MODULE.merge_tree({key: value}, {key: "translated"}, {}), {key: value})
+        self.assertFalse(MODULE.should_copy("Translation", ("type",)))
+        self.assertFalse(MODULE.should_copy("English", ("lang",)))
+        for value in ("loader", "dedicated"):
+            self.assertTrue(MODULE.should_copy(value, ("cards", 0, "flow")))
+            self.assertFalse(MODULE.should_copy(value, ("label",)))
+
+    def test_literal_only_examples_and_api_routes_are_not_translation_gaps(self):
+        for source in ("<code>apt update</code>",
+                       "<code>net0</code> / <code>net1</code>.",
+                       "/api/task-log/&lt;upid&gt;", "/api/vms/<vmid>/config"):
+            with self.subTest(source=source):
+                self.assertTrue(MODULE.should_copy(source, ("cell",)))
+        self.assertFalse(MODULE.should_copy("Run <code>apt update</code> first.", ("body",)))
+        self.assertFalse(MODULE.should_copy("After running the command, check its output.", ("afterCode",)))
+        self.assertFalse(MODULE.should_copy("Before running the command, read this.", ("beforeCode",)))
+        self.assertTrue(MODULE.should_copy("curl http://localhost:8008/api/health", ("curlCode",)))
+
+    def test_inline_identifiers_and_encoded_delimiters_round_trip(self):
+        source = "Set RS_SKIP_PATHS, call _rs_apply_hot and keep localStorage at &lt;host&gt;."
+        protected, mapping = MODULE.protect_text(source)
+        for literal in ("RS_SKIP_PATHS", "_rs_apply_hot", "localStorage", "&lt;", "&gt;"):
+            self.assertIn(literal, mapping.values())
+            self.assertNotIn(literal, protected)
+        self.assertEqual(MODULE.restore_text(protected, mapping), source)
+
+    def test_custom_code_spans_keep_commands_literal(self):
+        for tag in ("codeNw", "codeXs"):
+            source = f"Run <{tag}>pct config 100</{tag}>."
+            with self.subTest(tag=tag):
+                protected, mapping = MODULE.protect_rich_tags(source)
+                self.assertEqual(protected, source)
+                self.assertEqual(mapping, {})
+                with self.assertRaisesRegex(ValueError, "literal code changed"):
+                    MODULE.validate_contract(source, source.replace("config", "configuration"))
+                with self.assertRaisesRegex(ValueError, "numeric residue"):
+                    MODULE.validate_contract(source, source.replace(f"</{tag}>", f"</{tag}>0"))
+                self.assertTrue(MODULE.should_copy(f"<{tag}>pct config 100</{tag}>", ("example",)))
+
+    def test_navigation_identifiers_are_distinct_from_visible_labels(self):
+        values = {
+            "categorySlug": ["system", "network"],
+            "menuCmd": ["menu"],
+            "branch": ["main", "develop", "feature/*"],
+            "kind": ["internal", "external"],
+            "key": ["nas", "linux", "windows"],
+        }
+        for key, items in values.items():
+            for value in items:
+                with self.subTest(key=key, value=value):
+                    self.assertTrue(MODULE.should_copy(value, ("cards", 0, key)))
+                    self.assertFalse(MODULE.should_copy(value, ("label",)))
+        self.assertFalse(MODULE.should_copy("Translation", ("kind",)))
+        self.assertFalse(MODULE.should_copy("Storage", ("branch",)))
+
+    def test_ui_breadcrumb_is_prose_while_paths_remain_literal(self):
+        source = "In the UI: <strong>Datacenter → Backup → Retention</strong>:"
+        self.assertFalse(MODULE.should_copy(source, ("retention", "uiPath")))
+        self.assertTrue(MODULE.should_copy("/etc/pve/storage.cfg", ("uiPath",)))
+        self.assertTrue(MODULE.should_copy("/etc/pve/storage.cfg", ("configPath",)))
+
+    def test_bare_sentinel_with_added_digit_is_rejected(self):
+        with mock.patch.object(MODULE, "BARE_SENTINELS", True):
+            protected, mapping = MODULE.protect_text("ProxMenux collects metrics.")
+        token = next(iter(mapping))
+        with self.assertRaisesRegex(ValueError, "changed protected token"):
+            MODULE.restore_text(protected.replace(token, token + "0"), mapping)
+        self.assertEqual(MODULE.restore_text(protected, mapping), "ProxMenux collects metrics.")
+
+    def test_numeric_residue_outside_intact_literal_is_rejected(self):
+        examples = [
+            ('Run <code>pct config</code> first.', 'Spustite <code>pct config</code>0 najprv.'),
+            ('<strong><code>Restart=on-failure</code></strong> restarts the service.',
+             '<strong>0<code>Restart=on-failure</code></strong> reštartuje službu.'),
+        ]
+        for source, target in examples:
+            with self.subTest(source=source):
+                with self.assertRaisesRegex(ValueError, 'numeric residue'):
+                    MODULE.validate_contract(source, target)
+        MODULE.validate_contract('The result is <code>echo</code>0.',
+                                 'Výsledok je <code>echo</code>0.')
+
+    def test_product_and_kernel_module_names_are_protected(self):
+        source = "Flask uses SQLite and journald; rclone works with Coral, gasket, apex and Alpine."
+        protected, mapping = MODULE.protect_text(source)
+        for name in ("Flask", "SQLite", "journald", "rclone", "Coral", "gasket", "apex", "Alpine"):
+            self.assertIn(name, mapping.values())
+            self.assertNotIn(name, protected)
+        self.assertEqual(MODULE.restore_text(protected, mapping), source)
+
+    def test_literal_only_changes_sync_without_retranslating_human_prose(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            source = root / "messages/en/common.json"
+            target = root / "messages/de/common.json"
+            source.parent.mkdir(parents=True)
+            target.parent.mkdir(parents=True)
+            source.write_text(json.dumps({"title": "Updates", "code": "tool --version=2", "tone": "blue"}))
+            target.write_text(json.dumps({"title": "Aktualisierungen", "code": "tool --version=1", "tone": "blau"}))
+            provider = mock.Mock(side_effect=AssertionError("Existing prose must not be retranslated"))
+            self.assertEqual(self.run_generator(root, provider), 0)
+            self.assertEqual(json.loads(target.read_text()), {
+                "title": "Aktualisierungen", "code": "tool --version=2", "tone": "blue",
+            })
+            provider.assert_not_called()
+            before = target.stat().st_mtime_ns
+            self.assertEqual(self.run_generator(root, provider), 0)
+            self.assertEqual(target.stat().st_mtime_ns, before)
+            provider.assert_not_called()
+
     def test_changed_source_text_is_pending_even_with_existing_translation(self):
         source = {"title": "Updated installation guidance"}
         target = {"title": "Vorherige Installationsanleitung"}
diff --git a/.github/scripts/tests/test_command_descriptions.py b/.github/scripts/tests/test_command_descriptions.py
index 93186be9..f3b48675 100644
--- a/.github/scripts/tests/test_command_descriptions.py
+++ b/.github/scripts/tests/test_command_descriptions.py
@@ -80,177 +80,74 @@ class CommandDescriptionsTests(unittest.TestCase):
             self.assertEqual(catalog("sv")["terminal"]["commandDescriptions"][index],
                              FIXTURE["locales"]["sv"][index])
 
-    def test_workflow_default_catalogs_rerun_without_provider_or_writes(self):
+    def assert_completed_catalogs_are_stable(self, *, future_messages=None):
         workflow = (ROOT / ".github/workflows/build-i18n-messages.yml").read_text()
         languages = re.search(r'LANGS="\$\{LANGS:-(.*?)\}"', workflow).group(1)
         self.assertEqual(languages.split(","), list(MODULE.DEFAULT_LANGUAGES))
+        locales = ["en", *languages.split(",")]
+        shipped = {ROOT / f"AppImage/messages/{lang}/common.json": catalog(lang) for lang in locales}
+        original_bytes = {path: path.read_bytes() for path in shipped}
+
+        def strings(node, path=()):
+            # Independent traversal: every existing nonempty string, including
+            # explicit English and obsolete human keys, must survive completion.
+            if isinstance(node, str) and node:
+                yield path, node
+            elif isinstance(node, dict):
+                for key, value in node.items():
+                    yield from strings(value, (*path, key))
+            elif isinstance(node, list):
+                for index, value in enumerate(node):
+                    yield from strings(value, (*path, index))
+
         with tempfile.TemporaryDirectory() as directory:
-            root = Path(directory)
-            for lang in ["en", *languages.split(",")]:
-                path = root / lang / "common.json"
-                path.parent.mkdir()
-                shutil.copyfile(ROOT / f"AppImage/messages/{lang}/common.json", path)
-                # This steady-state fixture assumes generation already finished.
-                # Seed only intentional message additions; keep the
-                # recovered command arrays and the repo catalogs exact. Runtime
-                # missing-key fallback is covered by the JSX seam tests and by
-                # test_storage_messages.cjs and test_health_text.cjs.
-                if lang != "en":
-                    temporary = json.loads(path.read_text())
-                    for section, key in (
-                        ("archives", "emptyMessage"),
-                        ("archives", "formerJob"),
-                        ("archives", "formerJobTitle"),
-                        ("archives", "hiddenOtherNodes"),
-                        ("archives", "scopeAllNodes"),
-                        ("archives", "scopeAriaLabel"),
-                        ("archives", "scopeShowAll"),
-                        ("archives", "scopeThisNode"),
-                        ("destinations", "backupsKeptMessage"),
-                        ("destinations", "localAttachHelpMessage"),
-                    ):
-                        temporary["backup"][section].setdefault(
-                            key, catalog("en")["backup"][section][key])
-                    temporary["storage"].setdefault(
-                        "savedSmartData", catalog("en")["storage"]["savedSmartData"])
-                    report = temporary["storage"]["smartReport"]
-                    source_report = catalog("en")["storage"]["smartReport"]
-                    for key in ("passedAssessment", "noReallocatedSectorsReported",
-                                "passedMeaningTitle", "passedMeaning"):
-                        report.setdefault(key, source_report[key])
-                    for key in ("passedTitle", "passedText"):
-                        report["recommendations"].setdefault(
-                            key, source_report["recommendations"][key])
-                    # New health-popup messages deliberately use runtime English
-                    # fallback until each locale is translated. Model generator
-                    # steady state only in this disposable copy, as for thermal keys.
-                    for key in (
-                        'certificateExpired',
-                        'certificateExpiresDays',
-                        'certificateInconclusive',
-                        'cpuCheckFailed',
-                        'cpuHighSustained',
-                        'cpuSustained',
-                        'fail2banCheckUnavailable',
-                        'fail2banInactive',
-                        'failedLoginsWithinThreshold',
-                        'kernelPackagesMore',
-                        'kernelPveUpdates',
-                        'loginCheckUnavailable',
-                        'memoryCheckFailed',
-                        'memoryPressure',
-                        'noFailedLogins',
-                        'noSwapConfigured',
-                        'noTemperatureSensor',
-                        'nonRunningKernelUpdates',
-                        'pendingPackageUpdates',
-                        'pendingSecurityUpdates',
-                        'pendingSecurityUpdatesDays',
-                        'pendingSecurityUpdatesUnpatched',
-                        'pveVersionAvailable',
-                        'ramHighSustained',
-                        'ramSustained',
-                        'runningKernelUpdate',
-                        'securityCheckUnavailable',
-                        'sensorHighSamplesSpan',
-                        'swapRamPressure',
-                        'systemNotUpdatedMonths',
-                        'systemNotUpdatedYear',
-                        'temperatureElevated',
-                        'unknownDetail',
-                        'updatesAptError',
-                        'updatesAptTimeout',
-                        'updatesCheckUnavailable',
-                        'uptimeKernelAdvice',
-                        'uptimeUnavailable',
-                    ):
-                        temporary["healthStatus"]["details"].setdefault(
-                            key, catalog("en")["healthStatus"]["details"][key])
-                    # New thermal messages also await automatic translation.
-                    # Seed only these intentional additions in the temporary copy.
-                    for key in (
-                        "temperatureNoDisks", "temperatureNormal", "temperatureHighCount",
-                        "temperatureCriticalCount", "temperatureUnavailable",
-                        "temperatureIncomplete", "temperatureUnavailableCount",
-                    ):
-                        temporary["storage"].setdefault(key, catalog("en")["storage"][key])
-                    # Every shipped locale carries the temperature alert fallback
-                    # keys; the seed only guards a catalog that lacks them. The
-                    # runtime fallback is tested separately.
-                    source_fallback = catalog("en")["runtime"]["notifications"]["fallback"]
-                    fallback = temporary["runtime"]["notifications"]["fallback"]
-                    for key in ("temperatureAlertTitle", "temperatureAlertBody",
-                                "recordedReason", "recordedDetails"):
-                        fallback.setdefault(key, source_fallback[key])
-                    # Slovak remains the exact upstream catalog; model the
-                    # pending outcome-key generator additions in disposable
-                    # copies rather than modifying its curated values.
-                    if lang == 'sk':
-                        local = temporary['runtime']['notifications']
-                        source = catalog('en')['runtime']['notifications']
-                        for key, value in source['backup'].items():
-                            local.setdefault('backup', {}).setdefault(key, value)
-                        local['channels']['email']['status'].setdefault(
-                            'unconfirmed', source['channels']['email']['status']['unconfirmed'])
-                        local['channels']['email']['status'].setdefault(
-                            'completed_with_warnings', source['channels']['email']['status']['completed_with_warnings'])
-                    path.write_text(json.dumps(temporary, ensure_ascii=False))
-                # Model steady state after the bot fills these intentional new
-                # messages; keep repository locales and all other leaves intact.
-                if lang != "en":
-                    messages = json.loads(path.read_text())
-                    english = catalog("en")
-                    for section, key in (("encryption", "pbsHelp"),
-                                         ("keyfileActions", "pveKeyDescription")):
-                        messages["backup"][section].setdefault(key, english["backup"][section][key])
-                    for key in ("sshUserHelpMessage", "sshKeyHelpMessage", "sshKeySetupTitle",
-                                "sshKeySetupHelp", "sshAuthorizedKeyHelp"):
-                        messages["backup"]["destinations"].setdefault(
-                            key, english["backup"]["destinations"][key])
-                    messages["backup"]["actions"].setdefault(
-                        "prepareSshKey", english["backup"]["actions"]["prepareSshKey"])
-                    # New LXC observation labels intentionally ship only EN/SK.
-                    # Model the bot's future output in temporary catalogs, just
-                    # like the other pending keys above; never rewrite locales.
-                    messages["scriptTerminal"].setdefault("endOfInput", english["scriptTerminal"]["endOfInput"])
-                    messages["vmLxc"]["scheduled"].setdefault(
-                        "reasonStoppedContainer",
-                        english["vmLxc"]["scheduled"]["reasonStoppedContainer"],
-                    )
-                    messages["vmLxc"]["scheduled"].setdefault(
-                        "reasonStoppedContainerHistorical",
-                        english["vmLxc"]["scheduled"]["reasonStoppedContainerHistorical"],
-                    )
-                    messages["vmLxc"]["scheduled"].setdefault(
-                        "runSkippedStatus",
-                        english["vmLxc"]["scheduled"]["runSkippedStatus"],
-                    )
-                    for key in ("noShell", "enterFailed"):
-                        messages["lxcTerminal"]["errors"].setdefault(key, english["lxcTerminal"]["errors"][key])
-                    # The notification history panel texts await the bot as well.
-                    for key, value in english["settings"]["notifications"]["history"].items():
-                        messages["settings"]["notifications"].setdefault("history", {}).setdefault(key, value)
-                    for key in ("checkNow", "checkReadOnlyHelp", "checkCooldown",
-                                "checkStale", "checkStaleHelp", "checkBeforeUpdate",
-                                "startBeforeCheck", "notCheckedYet",
-                                "checkStillRunning", "refreshCheckHelp",
-                                "checkInProgress", "checkSystemPackages", "runCustomCommand",
-                                "installedVersionUnverified", "versionStatusUnknown"):
-                        messages["vmLxc"]["updates"].setdefault(
-                            key, english["vmLxc"]["updates"][key])
-                    for key in ("startPending", "shutdownPending", "rebootPending", "stopPending"):
-                        messages["vmLxc"]["actions"].setdefault(
-                            key, english["vmLxc"]["actions"][key])
-                    for key in ("osDockerScope", "dockerImageMethod", "unverifiedTargetsHelp"):
-                        messages["vmLxc"]["bulkUpdate"].setdefault(
-                            key, english["vmLxc"]["bulkUpdate"][key])
-                    messages["vmLxc"]["errors"].setdefault(
-                        "controlNotConfirmed", english["vmLxc"]["errors"]["controlNotConfirmed"])
-                    path.write_text(json.dumps(messages, ensure_ascii=False))
-            before = {p: p.read_bytes() for p in root.glob("*/common.json")}
+            root = Path(directory).resolve()
+            for path in shipped:
+                destination = root / path.parent.name / "common.json"
+                destination.parent.mkdir()
+                shutil.copyfile(path, destination)
+            if future_messages is not None:
+                source = json.loads((root / "en/common.json").read_text())
+                source["futureFeatureFixture"] = future_messages
+                (root / "en/common.json").write_text(json.dumps(source))
+
             argv = [str(SCRIPT), "--source", str(root / "en/common.json"),
                     "--messages-dir", str(root), "--languages", languages, "--sleep", "0"]
             output = io.StringIO()
+            # Establish steady state with the real generator and a deterministic
+            # offline provider. Translation happens only in disposable catalogs;
+            # adding an EN-only feature never needs a hand-maintained seed list.
+            with mock.patch.object(sys, "argv", argv), \
+                    mock.patch.object(MODULE, "translate_one", side_effect=lambda text, lang, *_: f"TEST {lang} {text}") as seed, \
+                    mock.patch.object(MODULE, "write_json", wraps=MODULE.write_json) as initial_writer, \
+                    redirect_stdout(output), redirect_stderr(output):
+                self.assertEqual(MODULE.main(), 0, output.getvalue())
+            self.assertNotRegex(output.getvalue(), r"(?m)^Completed with [0-9]+ translation failures")
+            self.assertTrue(all(call.args[0].is_relative_to(root) for call in initial_writer.call_args_list))
+            for path, original in shipped.items():
+                completed = json.loads((root / path.parent.name / "common.json").read_text())
+                for keys, value in strings(original):
+                    actual = completed
+                    for key in keys:
+                        actual = actual[key]
+                    self.assertEqual(actual, value, f"{path.parent.name}: {keys}")
+                # The recovered arrays remain exact, including frozen English.
+                if path.parent.name != "en":
+                    self.assertEqual(completed["terminal"]["commandDescriptions"],
+                                     FIXTURE["locales"].get(path.parent.name,
+                                         original["terminal"]["commandDescriptions"]))
+                if future_messages is not None and path.parent.name != "en":
+                    self.assertEqual(completed["futureFeatureFixture"], {
+                        "title": f"TEST {path.parent.name} Future feature {{count}}",
+                        "items": [f"TEST {path.parent.name} First item", {"label": f"TEST {path.parent.name} Second item"}],
+                        "enabled": False, "count": 2, "empty": [],
+                    })
+            if future_messages is not None:
+                self.assertGreaterEqual(seed.call_count, 3 * len(languages.split(",")))
+            before = {p: p.read_bytes() for p in root.glob("*/common.json")}
+            output = io.StringIO()
+            # Keep the original strict assertion: once completed, any provider
+            # call or catalog write is a regression. No production locale edits.
             with mock.patch.object(sys, "argv", argv), \
                     mock.patch.object(MODULE, "translate_one", side_effect=AssertionError("provider forbidden")) as provider, \
                     mock.patch.object(MODULE, "write_json", side_effect=AssertionError("writes forbidden")) as writer, \
@@ -262,6 +159,17 @@ class CommandDescriptionsTests(unittest.TestCase):
             self.assertEqual(before, {p: p.read_bytes() for p in before})
             for lang in languages.split(","):
                 self.assertIn(f"{lang}: nothing to translate", output.getvalue())
+        self.assertEqual(original_bytes, {path: path.read_bytes() for path in shipped})
+
+    def test_workflow_default_catalogs_rerun_without_provider_or_writes(self):
+        self.assert_completed_catalogs_are_stable()
+
+    def test_new_english_feature_preserves_curated_values_and_reruns_without_writes(self):
+        self.assert_completed_catalogs_are_stable(future_messages={
+            "title": "Future feature {count}",
+            "items": ["First item", {"label": "Second item"}],
+            "enabled": False, "count": 2, "empty": [],
+        })
 
     def test_actual_consumer_lookup_null_fallback_and_explicit_english(self):
         node = require_node()
diff --git a/.github/scripts/tests/test_documentation_markdown.py b/.github/scripts/tests/test_documentation_markdown.py
new file mode 100644
index 00000000..98255351
--- /dev/null
+++ b/.github/scripts/tests/test_documentation_markdown.py
@@ -0,0 +1,16 @@
+"""Keep the canonical conduct policy and its English website source in sync."""
+import json
+from pathlib import Path
+import unittest
+
+ROOT = Path(__file__).resolve().parents[3]
+
+
+class DocumentationMarkdownTests(unittest.TestCase):
+    def test_english_conduct_body_matches_canonical_policy(self):
+        source = json.loads((ROOT / 'web/messages/en/docs/about/code-of-conduct.json').read_text(encoding='utf-8'))
+        self.assertEqual(source['contentMarkdown'], (ROOT / 'CODE_OF_CONDUCT.md').read_text(encoding='utf-8'))
+
+
+if __name__ == '__main__':
+    unittest.main()
diff --git a/.github/scripts/tests/test_documentation_review_workflows.py b/.github/scripts/tests/test_documentation_review_workflows.py
new file mode 100644
index 00000000..49d8cd93
--- /dev/null
+++ b/.github/scripts/tests/test_documentation_review_workflows.py
@@ -0,0 +1,30 @@
+"""Keep machine generation explicit without losing automatic validation."""
+from pathlib import Path
+import unittest
+
+import yaml
+
+
+ROOT = Path(__file__).resolve().parents[3]
+
+
+class DocumentationReviewWorkflowTests(unittest.TestCase):
+    def workflow(self, name):
+        return yaml.load(
+            (ROOT / '.github/workflows' / name).read_text(encoding='utf-8'),
+            Loader=yaml.BaseLoader,
+        )
+
+    def test_generation_requires_explicit_dispatch(self):
+        triggers = self.workflow('build-web-docs-i18n.yml')['on']
+        self.assertEqual(set(triggers), {'workflow_dispatch'})
+
+    def test_website_changes_keep_automatic_offline_validation(self):
+        triggers = self.workflow('test-i18n.yml')['on']
+        for event in ('pull_request', 'push'):
+            with self.subTest(event=event):
+                self.assertIn('web/**', triggers[event]['paths'])
+
+
+if __name__ == '__main__':
+    unittest.main()
diff --git a/.github/scripts/tests/test_installer_languages.py b/.github/scripts/tests/test_installer_languages.py
new file mode 100644
index 00000000..0aa0ccef
--- /dev/null
+++ b/.github/scripts/tests/test_installer_languages.py
@@ -0,0 +1,30 @@
+"""Every shipped terminal language must be selectable during installation."""
+from pathlib import Path
+import re
+import sys
+import unittest
+
+SCRIPTS = Path(__file__).resolve().parents[1]
+ROOT = SCRIPTS.parents[1]
+sys.path.insert(0, str(SCRIPTS))
+from build_translation_cache import DEFAULT_LANGUAGES
+
+
+class InstallerLanguageTests(unittest.TestCase):
+    def test_both_installers_offer_every_shipped_language(self):
+        expected = {'en', *DEFAULT_LANGUAGES}
+        for name in ('install_proxmenux.sh', 'install_proxmenux_beta.sh'):
+            with self.subTest(installer=name):
+                source = (ROOT / name).read_text(encoding='utf-8')
+                function = re.search(r'^select_language\(\) \{(.*?)^\}', source, re.M | re.S)
+                self.assertIsNotNone(function, 'Missing installer language selector')
+                offered = re.findall(r'^\s*"([a-z]{2})"\s+"[^"]+"', function.group(1), re.M)
+                self.assertEqual(set(offered), expected)
+                self.assertEqual(len(offered), len(expected), 'Duplicate language option')
+                # English is the source text in the scripts, not a JSON catalog.
+                for language in set(offered) - {'en'}:
+                    self.assertTrue((ROOT / 'lang' / f'{language}.json').is_file(), language)
+
+
+if __name__ == '__main__':
+    unittest.main()
diff --git a/.github/scripts/tests/test_menu_search.py b/.github/scripts/tests/test_menu_search.py
index 2b867a90..72e0db8b 100644
--- a/.github/scripts/tests/test_menu_search.py
+++ b/.github/scripts/tests/test_menu_search.py
@@ -4,9 +4,13 @@ lives: the scripts it launches are the ones the menus launch."""
 
 import importlib.util
 import json
+import os
 from pathlib import Path
 import re
 import runpy
+import shlex
+import subprocess
+import tempfile
 import unittest
 
 ROOT = Path(__file__).resolve().parents[3]
@@ -42,11 +46,13 @@ class IndexTests(unittest.TestCase):
         self.assertEqual(unknown, [])
         self.assertEqual([item["menu"] for item in self.index if item["menu"] not in self.spanish], [])
 
-    def test_every_script_a_menu_launches_can_be_found(self):
+    def test_every_script_a_pve_menu_launches_can_be_found(self):
         indexed = {item["script"] for item in self.index}
         launched = set()
         for menu in sorted((SCRIPTS / "menus").glob("*.sh")):
-            if menu.name in ("main_menu.sh", "lxc_menu.sh"):
+            # PBS replaces the PVE main menu and does not use its search.
+            # The exclusive platform dispatch is executed in the test below.
+            if menu.name in ("main_menu.sh", "lxc_menu.sh", "pbs_menu.sh"):
                 continue
             launched |= set(re.findall(r'bash "\$LOCAL_SCRIPTS/([A-Za-z0-9_./-]+\.sh)"', menu.read_text()))
         launched -= {"menus/main_menu.sh"}
@@ -54,6 +60,27 @@ class IndexTests(unittest.TestCase):
         launched -= {"post_install/auto_post_install.sh", "utilities/proxmox_update.sh", "utilities/upgrade_pve8_to_pve9.sh"}
         self.assertEqual(sorted(launched - indexed), [])
 
+    def test_pbs_replaces_the_searchable_pve_menu(self):
+        menu = (SCRIPTS / "menus/main_menu.sh").read_text()
+        dispatch = menu[menu.rindex('source "$LOCAL_SCRIPTS/global/platform-functions.sh"'):]
+        with tempfile.TemporaryDirectory() as directory:
+            scripts = Path(directory)
+            (scripts / "global").mkdir()
+            (scripts / "menus").mkdir()
+            helper = scripts / "global/platform-functions.sh"
+            helper.write_text(
+                "source " + shlex.quote(str(SCRIPTS / "global/platform-functions.sh")) + "\n"
+                'pmx_platform_field() { printf "%s" "$TEST_PROXMENUX_PRODUCT"; }\n')
+            (scripts / "menus/pbs_menu.sh").write_text('printf "PBS menu\\n"\n')
+            harness = 'show_menu() { printf "PVE search menu\\n"; }\n' + dispatch
+            for product, expected in (("pve", "PVE search menu"), ("pbs", "PBS menu")):
+                with self.subTest(product=product):
+                    result = subprocess.run(["bash", "-e", "-c", harness], text=True, capture_output=True,
+                                            env={**os.environ, "LOCAL_SCRIPTS": str(scripts),
+                                                 "TEST_PROXMENUX_PRODUCT": product})
+                    self.assertEqual(result.returncode, 0, result.stderr)
+                    self.assertEqual(result.stdout.strip(), expected)
+
     def test_the_main_menu_offers_the_search_and_opens_what_it_hands_back(self):
         menu = (SCRIPTS / "menus/main_menu.sh").read_text()
         self.assertIn('search "$(translate "Search options and applications")"', menu)
diff --git a/.github/scripts/tests/test_oci_recovery_inventory_wording.py b/.github/scripts/tests/test_oci_recovery_inventory_wording.py
index 77e7afaa..338698ae 100644
--- a/.github/scripts/tests/test_oci_recovery_inventory_wording.py
+++ b/.github/scripts/tests/test_oci_recovery_inventory_wording.py
@@ -5,6 +5,7 @@ import json
 from pathlib import Path
 import re
 import runpy
+import subprocess
 import sys
 import tempfile
 from types import ModuleType, SimpleNamespace
@@ -52,7 +53,8 @@ class InventoryMessages(unittest.TestCase):
         state = ModuleType('oci_installation_state')
         state.parse_config = lambda raw: dict(line.split(': ', 1) for line in raw.decode().splitlines())
         scope = {'sys': SimpleNamespace(path=[]), 'source_text': lambda text: text or '',
-                 'translate': translate, 're': re}
+                 'translate': translate, 're': re, 'subprocess': subprocess,
+                 '_selected_configuration': remover.guest_config}
         summary = extracted(MENU, '_removal_summary', scope)
         with patch.dict(sys.modules, {'oci_instances': instances, 'oci_remove': remover,
                                       'oci_installation_state': state}):
diff --git a/.github/scripts/tests/test_oci_removal_firewall_wording.py b/.github/scripts/tests/test_oci_removal_firewall_wording.py
index bde90937..8041f923 100644
--- a/.github/scripts/tests/test_oci_removal_firewall_wording.py
+++ b/.github/scripts/tests/test_oci_removal_firewall_wording.py
@@ -56,7 +56,8 @@ class RemovalWordings(unittest.TestCase):
         state = ModuleType('oci_installation_state')
         state.parse_config = lambda raw: {}
         scope = {'sys': SimpleNamespace(path=[]), 'source_text': lambda value: value or '',
-                 'translate': translated or (lambda value: value), 're': re}
+                 'translate': translated or (lambda value: value), 're': re,
+                 '_selected_configuration': remover.guest_config, 'subprocess': subprocess}
         with patch.dict(sys.modules, {'oci_instances': instances, 'oci_remove': remover,
                                       'oci_installation_state': state}):
             return extract(MENU, '_removal_summary', scope)(Path('/inert'), 101)
@@ -87,7 +88,8 @@ class RemovalWordings(unittest.TestCase):
         with patch.dict(sys.modules, {'oci_instances': instances, 'oci_remove': remover,
                                       'oci_installation_state': state}):
             scope = {'sys': SimpleNamespace(path=[]), 'source_text': lambda value: value or '',
-                     'translate': lambda value: value, 're': re}
+                     'translate': lambda value: value, 're': re,
+                     '_selected_configuration': remover.guest_config, 'subprocess': subprocess}
             preview = extract(MENU, '_removal_summary', scope)(Path('/inert'), 102)
         self.assertIn(WHOLE, preview)
 
diff --git a/.github/scripts/tests/test_oci_selection_setup_wording.py b/.github/scripts/tests/test_oci_selection_setup_wording.py
index 9d35d7d5..7baa2ad5 100644
--- a/.github/scripts/tests/test_oci_selection_setup_wording.py
+++ b/.github/scripts/tests/test_oci_selection_setup_wording.py
@@ -42,13 +42,13 @@ class SelectionSetupWording(TestCase):
             shutil=SimpleNamespace(which=lambda _: '/fake/pct'), saved_inventory=lambda _: [],
             _clean_orphans=lambda project: None,
             recover_automatically=lambda project: None, offer_recovery=lambda project, ui: None,
-            carry_records=lambda project, **options: {},
+            carry_records=lambda project, **options: {}, _records_unread=lambda project: False,
             translate=lambda s: s)
         fn(Path('/fixture'), ui)
         ui.message.assert_called_once_with(EMPTY, 'OCI management')
         ui.choose.assert_not_called()
 
-    def _menu(self, inventories, selections):
+    def _menu(self, inventories, selections, unread=True):
         rows = iter(inventories)
         ui = SimpleNamespace(message=Mock(), choose=Mock(side_effect=selections))
         refresh = Mock(return_value={})
@@ -57,7 +57,8 @@ class SelectionSetupWording(TestCase):
             shutil=SimpleNamespace(which=lambda _: '/fake/pct'), saved_inventory=lambda _: next(rows),
             _clean_orphans=lambda project: None,
             recover_automatically=lambda project: None, offer_recovery=lambda project, ui: None,
-            carry_records=refresh, manage_instance=manage, menu_size=lambda: 10,
+            carry_records=refresh, _records_unread=lambda project: unread,
+            manage_instance=manage, menu_size=lambda: 10,
             STATUS_LABELS={}, translate=lambda s: s)
         fn(Path('/fixture'), ui)
         return ui, refresh, manage
@@ -67,7 +68,14 @@ class SelectionSetupWording(TestCase):
         ui, refresh, manage = self._menu([[row], [row]], ['101', None])
         self.assertEqual(ui.choose.call_count, 2)
         manage.assert_called_once()
-        refresh.assert_called_once_with(Path('/fixture'), mount_stopped=False, shown=True)
+        refresh.assert_called_once_with(Path('/fixture'), mount_stopped=False, shown=True,
+                                        heading='Manage installed OCI applications')
+
+    def test_the_list_opens_without_the_sync_notice_once_every_configuration_is_cached(self):
+        row = {'vmid': 101, 'title': 'Jellyfin', 'hostname': 'jellyfin', 'status': 'installed', 'image': 'jellyfin/jellyfin'}
+        _, refresh, _ = self._menu([[row]], [None], unread=False)
+        refresh.assert_called_once_with(Path('/fixture'), mount_stopped=False, shown=False,
+                                        heading='Manage installed OCI applications')
 
     def test_removing_the_last_application_returns_without_a_message(self):
         row = {'vmid': 101, 'title': 'Jellyfin', 'hostname': 'jellyfin', 'status': 'installed', 'image': 'jellyfin/jellyfin'}
diff --git a/.github/scripts/tests/test_oci_update_preservation_wording.py b/.github/scripts/tests/test_oci_update_preservation_wording.py
index 44146970..e3fdae92 100644
--- a/.github/scripts/tests/test_oci_update_preservation_wording.py
+++ b/.github/scripts/tests/test_oci_update_preservation_wording.py
@@ -3,6 +3,7 @@ import ast
 from contextlib import nullcontext
 import copy
 import json
+import os
 from pathlib import Path
 import re
 import runpy
@@ -129,7 +130,9 @@ class UpdateWording(unittest.TestCase):
         reconcile = ModuleType('oci_instance_reconcile')
         reconcile.propose = lambda *args: None
         scope = {'sys': SimpleNamespace(path=[], executable='python3'),
+                 'os': os, 'tempfile': tempfile, 'Path': Path,
                  'translate': lambda text: text, 'check_selected': lambda project, row: row,
+                 '_selected_configuration': lambda vmid: instances.command('pct', 'config', str(vmid)),
                  'images': SimpleNamespace(offer_removal=lambda *args: None),
                  'carry_records': lambda project, **options: {},
                  '_work_backup_ready': lambda project, ui, vmid: True,
diff --git a/.github/scripts/tests/test_terminal_catalogs.py b/.github/scripts/tests/test_terminal_catalogs.py
new file mode 100644
index 00000000..f74966cb
--- /dev/null
+++ b/.github/scripts/tests/test_terminal_catalogs.py
@@ -0,0 +1,82 @@
+"""Offline regressions for copyable commands and runtime format fields."""
+import importlib.util
+import json
+from pathlib import Path
+import subprocess
+import sys
+import tempfile
+import unittest
+
+SCRIPTS = Path(__file__).resolve().parents[1]
+ROOT = SCRIPTS.parents[1]
+sys.path.insert(0, str(SCRIPTS))
+SPEC = importlib.util.spec_from_file_location('check_terminal_catalogs', SCRIPTS / 'check_terminal_catalogs.py')
+MODULE = importlib.util.module_from_spec(SPEC)
+assert SPEC and SPEC.loader
+SPEC.loader.exec_module(MODULE)
+
+
+class TerminalCatalogsTests(unittest.TestCase):
+    def test_extractor_includes_launchers_remote_scripts_and_catalog_text(self):
+        fixtures = {
+            'menu': 'translate "Main launcher"',
+            'install_proxmenux.sh': 'translate "Stable installer"',
+            'install_proxmenux_beta.sh': 'translate "Beta installer"',
+            'scripts/check.sh': 'translate "Host shell script"',
+            'scripts/check.py': 'translate("Host Python script")',
+            'oci/src/check.py': 'N_("OCI Python script")',
+            'oci/remote/check.py': 'translate("Remote Python script")',
+            'oci/remote/check.sh': 'translate "Remote shell script"',
+            'oci/catalog/app.json': json.dumps({'catalog_ui': {'tagline': {'en_US': 'Application tagline'}}}),
+        }
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            for name, content in fixtures.items():
+                file = root / name
+                file.parent.mkdir(parents=True, exist_ok=True)
+                file.write_text(content, encoding='utf-8')
+            self.assertEqual(set(MODULE.active_sources(root)), {
+                'Main launcher', 'Stable installer', 'Beta installer',
+                'Host shell script', 'Host Python script', 'OCI Python script',
+                'Remote Python script', 'Remote shell script', 'Application tagline',
+            })
+
+    def test_runtime_format_field_cannot_be_translated(self):
+        source = 'Kimai has no default account. Enter the container with: pct enter {main_vmid}'
+        with self.assertRaisesRegex(ValueError, 'placeholder'):
+            MODULE.validate_message(source, 'Kimai nemá účet: pct enter {main vmid}')
+        MODULE.validate_message(source, 'Kimai nemá účet: pct enter {main_vmid}')
+
+    def test_copyable_command_and_environment_variable_are_literal(self):
+        examples = [
+            ('Example: pct config 110 | grep unprivileged', 'Ejemplo: configuración pct 110 | grep sin privilegios'),
+            ("Use 'pct restore' to recover the disks.", "Verwenden Sie 'pct restart', um die Datenträger wiederherzustellen."),
+            ('Invalid ALLOWED_HOSTS value', 'Valeur HÔTES INDÉSIRABLES'),
+        ]
+        for source, target in examples:
+            with self.subTest(source=source):
+                with self.assertRaisesRegex(ValueError, 'literal command or identifier'):
+                    MODULE.validate_message(source, target)
+        MODULE.validate_message('Example: pct config 110 | grep unprivileged',
+                                'Ejemplo: pct config 110 | grep unprivileged')
+
+    def test_dns_capitalization_does_not_relax_file_path_case(self):
+        MODULE.validate_message('Cannot reach download.proxmox.com.',
+                                'Download.proxmox.com ist nicht erreichbar.')
+        with self.assertRaisesRegex(ValueError, 'literal command or identifier'):
+            MODULE.validate_message('Check /etc/pve/storage.cfg', 'Prüfen Sie /etc/PVE/storage.cfg')
+
+    def test_shipped_active_catalogs_keep_literal_contracts(self):
+        result = subprocess.run(
+            [sys.executable, '-B', str(SCRIPTS / 'check_terminal_catalogs.py'),
+             '--root', str(ROOT), '--require-complete'],
+            capture_output=True, text=True, timeout=60,
+        )
+        self.assertEqual(result.returncode, 0, result.stdout + result.stderr)
+        for locale in MODULE.DEFAULT_LANGUAGES:
+            self.assertIn(f'[{locale}] active=', result.stdout)
+        self.assertNotIn('missing=1', result.stdout)
+
+
+if __name__ == '__main__':
+    unittest.main()
diff --git a/.github/scripts/tests/test_vm_backup_jobs_wiring.py b/.github/scripts/tests/test_vm_backup_jobs_wiring.py
index a8ecf4f5..930c82e3 100644
--- a/.github/scripts/tests/test_vm_backup_jobs_wiring.py
+++ b/.github/scripts/tests/test_vm_backup_jobs_wiring.py
@@ -15,7 +15,7 @@ class VmBackupJobsWiring(TestCase):
         source = ROUTES.read_text()
         routes = re.findall(r'@vm_backup_bp\.route\("([^"]+)", methods=\["(\w+)"\]\)\n@(\w+)\ndef (\w+)', source)
         self.assertEqual(len(routes), source.count('@vm_backup_bp.route('))
-        self.assertEqual(len(routes), 8)
+        self.assertEqual(len(routes), 10)
         for path, method, guard, name in routes:
             expected = 'require_auth' if method == 'GET' else 'require_admin_scope'
             self.assertEqual(guard, expected, f'{method} {path} ({name})')
diff --git a/.github/scripts/tests/test_web_docs_catalogs.py b/.github/scripts/tests/test_web_docs_catalogs.py
new file mode 100644
index 00000000..3d851425
--- /dev/null
+++ b/.github/scripts/tests/test_web_docs_catalogs.py
@@ -0,0 +1,94 @@
+"""Validate complete catalogs without rejecting intentional English fallback."""
+import json
+from pathlib import Path
+import subprocess
+import sys
+import tempfile
+import unittest
+
+
+SCRIPT = Path(__file__).resolve().parents[1] / "check_web_docs_catalogs.py"
+
+
+class WebDocsCatalogTests(unittest.TestCase):
+    def run_check(self, root, *options):
+        return subprocess.run(
+            [sys.executable, "-B", str(SCRIPT), "--messages-dir", str(root),
+             "--languages", "de", *options],
+            capture_output=True, text=True,
+        )
+
+    def write_catalog(self, root, locale, content):
+        file = root / locale / "common.json"
+        file.parent.mkdir(parents=True, exist_ok=True)
+        file.write_text(json.dumps(content), encoding="utf-8")
+
+    def test_partial_catalog_keeps_fallback_but_complete_mode_reports_gap(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            self.write_catalog(root, "en", {"title": "Updates", "body": "Check the host."})
+            self.write_catalog(root, "de", {"title": "Aktualisierungen"})
+            partial = self.run_check(root)
+            self.assertEqual(partial.returncode, 0, partial.stdout + partial.stderr)
+            self.assertIn("missing=1", partial.stdout)
+            complete = self.run_check(root, "--require-complete")
+            self.assertEqual(complete.returncode, 1, complete.stdout + complete.stderr)
+            self.assertIn("schema differs", complete.stdout)
+
+    def test_translated_code_is_rejected_in_both_modes(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            self.write_catalog(root, "en", {"body": "Run <code>apt update</code>."})
+            self.write_catalog(root, "de", {"body": "Führe <code>apt aktualisieren</code> aus."})
+            for options in ((), ("--require-complete",)):
+                with self.subTest(options=options):
+                    result = self.run_check(root, *options)
+                    self.assertEqual(result.returncode, 1, result.stdout + result.stderr)
+
+    def test_bare_commands_and_operators_are_not_prose(self):
+        examples = [
+            ("Restore with pct restore.", "Mit pct restart wiederherstellen."),
+            ("pveversion | grep pve-manager", "pveversion grep pve-manager"),
+            ("cd /opt/my-app && ./update.sh", "cd /opt/meine-app && ./update.sh"),
+        ]
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            for source, target in examples:
+                with self.subTest(source=source):
+                    self.write_catalog(root, "en", {"body": source})
+                    self.write_catalog(root, "de", {"body": target})
+                    result = self.run_check(root)
+                    self.assertEqual(result.returncode, 1, result.stdout + result.stderr)
+                    self.assertIn("literal command or identifier", result.stdout)
+
+    def test_title_separator_can_change_without_relaxing_body_pipes(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            self.write_catalog(root, "en", {"meta": {"title": "Storage | ProxMenux"}})
+            self.write_catalog(root, "de", {"meta": {"title": "Speicher — ProxMenux"}})
+            result = self.run_check(root, "--require-complete")
+            self.assertEqual(result.returncode, 0, result.stdout + result.stderr)
+            self.write_catalog(root, "en", {"meta": {"description": "pveversion | grep pve-manager"}})
+            self.write_catalog(root, "de", {"meta": {"description": "pveversion grep pve-manager"}})
+            result = self.run_check(root)
+            self.assertEqual(result.returncode, 1, result.stdout + result.stderr)
+
+    def test_shipped_web_catalogs_keep_literal_contracts(self):
+        messages = SCRIPT.parents[2] / "web" / "messages"
+        result = subprocess.run(
+            [sys.executable, "-B", str(SCRIPT), "--messages-dir", str(messages)],
+            capture_output=True, text=True, timeout=60,
+        )
+        self.assertEqual(result.returncode, 0, result.stdout + result.stderr)
+
+    def test_literal_metadata_is_required_but_labels_can_be_localized(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            self.write_catalog(root, "en", {"label": "Updates", "tone": "blue"})
+            self.write_catalog(root, "de", {"label": "Aktualisierungen", "tone": "blau"})
+            invalid = self.run_check(root, "--require-complete")
+            self.assertEqual(invalid.returncode, 1, invalid.stdout + invalid.stderr)
+            self.assertIn("rendering metadata differ", invalid.stdout)
+            self.write_catalog(root, "de", {"label": "Aktualisierungen", "tone": "blue"})
+            valid = self.run_check(root, "--require-complete")
+            self.assertEqual(valid.returncode, 0, valid.stdout + valid.stderr)
diff --git a/.github/scripts/tests/test_web_export_language.py b/.github/scripts/tests/test_web_export_language.py
new file mode 100644
index 00000000..143b0ccb
--- /dev/null
+++ b/.github/scripts/tests/test_web_export_language.py
@@ -0,0 +1,41 @@
+"""Exercise the static-export language repair on real HTML files."""
+from pathlib import Path
+import subprocess
+import tempfile
+import unittest
+
+from test_command_descriptions import require_node
+
+
+ROOT = Path(__file__).resolve().parents[3]
+SCRIPT = ROOT / "web/scripts/localize-export.mjs"
+
+
+class WebExportLanguageTests(unittest.TestCase):
+    def test_locales_nested_pages_preserved_content_and_idempotence(self):
+        node = require_node()
+        html = '<!doctype html><html lang="en" class="dark"><body><h1>Text</h1><script>const example=\'<html lang="en">\';</script></body></html>'
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            locales = ["en", "es", "de", "fr", "it", "pt", "sk", "sv"]
+            for locale in locales:
+                file = root / "out" / locale / "docs/monitor/index.html"
+                file.parent.mkdir(parents=True)
+                file.write_text(html)
+            for relative in ["out/index.html", "out/assets/index.html"]:
+                file = root / relative
+                file.parent.mkdir(parents=True, exist_ok=True)
+                file.write_text(html)
+            result = subprocess.run([node, str(SCRIPT)], cwd=root, capture_output=True, text=True)
+            self.assertEqual(result.returncode, 0, result.stderr)
+            self.assertIn("8 localized pages", result.stdout)
+            for locale in locales:
+                actual = (root / "out" / locale / "docs/monitor/index.html").read_text()
+                self.assertEqual(actual, html.replace('<html lang="en"', f'<html lang="{locale}"', 1))
+            for relative in ["out/index.html", "out/assets/index.html"]:
+                self.assertEqual((root / relative).read_text(), html)
+            tracked = root / "out/de/docs/monitor/index.html"
+            before = tracked.stat().st_mtime_ns
+            second = subprocess.run([node, str(SCRIPT)], cwd=root, capture_output=True, text=True)
+            self.assertEqual(second.returncode, 0, second.stderr)
+            self.assertEqual(tracked.stat().st_mtime_ns, before)
diff --git a/.github/workflows/build-web-docs-i18n.yml b/.github/workflows/build-web-docs-i18n.yml
index 6583f44f..a457b70b 100644
--- a/.github/workflows/build-web-docs-i18n.yml
+++ b/.github/workflows/build-web-docs-i18n.yml
@@ -1,14 +1,9 @@
 name: Build web documentation translations
 
 on:
-  push:
-    branches: [develop]
-    paths:
-      - 'web/messages/en/*.json'
-      - 'web/messages/en/**/*.json'
-      - '.github/scripts/build_web_docs_i18n.py'
-      - '.github/scripts/build_translation_cache.py'
-      - '.github/workflows/build-web-docs-i18n.yml'
+  # Source and locale corrections are reviewed together. An automatic run
+  # would treat the changed English fingerprints as stale translations and
+  # overwrite those reviewed locale strings with provider output.
   workflow_dispatch:
     inputs:
       languages:
diff --git a/.github/workflows/test-apprise-services.yml b/.github/workflows/test-apprise-services.yml
new file mode 100644
index 00000000..59df1fd0
--- /dev/null
+++ b/.github/workflows/test-apprise-services.yml
@@ -0,0 +1,50 @@
+name: Apprise Slack and Matrix
+
+on:
+  pull_request:
+    paths:
+      - '.github/workflows/test-apprise-services.yml'
+      - 'AppImage/scripts/notification_channels.py'
+      - 'AppImage/components/apprise-service-help.tsx'
+      - 'AppImage/components/notification-settings.tsx'
+      - 'tests/test_apprise_services.py'
+      - 'tests/test_apprise_service_help.cjs'
+  push:
+    branches: [main, develop]
+    paths:
+      - 'AppImage/scripts/notification_channels.py'
+      - 'AppImage/components/apprise-service-help.tsx'
+      - 'tests/test_apprise_services.py'
+      - 'tests/test_apprise_service_help.cjs'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  apprise-services:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    strategy:
+      matrix:
+        apprise: ['1.7.0', '2.0.1']
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+      - uses: actions/setup-node@v6
+        with:
+          node-version: '22.14.0'
+      - name: Install fixture dependencies
+        run: |
+          python -m pip install 'apprise==${{ matrix.apprise }}'
+          npm ci --prefix .github/ci/offline-node --ignore-scripts --no-audit --no-fund
+      - name: Test real provider plugins with mocked HTTP
+        run: python -B -m unittest discover -s tests -p test_apprise_services.py -v
+      - name: Render provider help and locale fallback
+        env:
+          NODE_PATH: ${{ github.workspace }}/.github/ci/offline-node/node_modules
+        run: node tests/test_apprise_service_help.cjs
diff --git a/.github/workflows/test-backup-storage-retention.yml b/.github/workflows/test-backup-storage-retention.yml
new file mode 100644
index 00000000..321a227e
--- /dev/null
+++ b/.github/workflows/test-backup-storage-retention.yml
@@ -0,0 +1,50 @@
+name: Backup storage retention
+
+on:
+  pull_request:
+    paths:
+      - '.github/workflows/test-backup-storage-retention.yml'
+      - 'AppImage/scripts/flask_vm_backup_routes.py'
+      - 'AppImage/components/backup-storage-retention.tsx'
+      - 'AppImage/components/backup-tab.tsx'
+      - 'AppImage/components/vm-backup-jobs.tsx'
+      - 'AppImage/lib/backup-retention.ts'
+      - 'tests/test_vm_backup_jobs_api.py'
+      - 'tests/test_backup_storage_retention.cjs'
+  push:
+    branches: [main, develop]
+    paths:
+      - 'AppImage/scripts/flask_vm_backup_routes.py'
+      - 'AppImage/components/backup-storage-retention.tsx'
+      - 'AppImage/lib/backup-retention.ts'
+      - 'tests/test_vm_backup_jobs_api.py'
+      - 'tests/test_backup_storage_retention.cjs'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  storage-retention:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+      - uses: actions/setup-node@v6
+        with:
+          node-version: '22.14.0'
+      - name: Install fixture dependencies
+        run: |
+          python -m pip install 'Flask==3.1.2'
+          npm ci --prefix .github/ci/offline-node --ignore-scripts --no-audit --no-fund
+      - name: Test native job and storage configuration APIs
+        run: python -B -m unittest discover -s tests -p test_vm_backup_jobs_api.py -v
+      - name: Test shared retention properties
+        env:
+          NODE_PATH: ${{ github.workspace }}/.github/ci/offline-node/node_modules
+        run: node tests/test_backup_storage_retention.cjs
diff --git a/.github/workflows/test-figurine.yml b/.github/workflows/test-figurine.yml
new file mode 100644
index 00000000..b379ce4b
--- /dev/null
+++ b/.github/workflows/test-figurine.yml
@@ -0,0 +1,73 @@
+name: Figurine installation
+
+on:
+  pull_request:
+    paths:
+      - '.github/workflows/test-figurine.yml'
+      - 'tests/test_figurine_installation.py'
+      - 'scripts/post_install/customizable_post_install.sh'
+      - 'AppImage/scripts/post_install_versions.py'
+      - 'AppImage/scripts/flask_proxmenux_routes.py'
+  push:
+    branches: [main, develop]
+    paths:
+      - '.github/workflows/test-figurine.yml'
+      - 'tests/test_figurine_installation.py'
+      - 'scripts/post_install/customizable_post_install.sh'
+      - 'AppImage/scripts/post_install_versions.py'
+      - 'AppImage/scripts/flask_proxmenux_routes.py'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  installer-and-release:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+      - name: Check shell syntax and isolated installer regressions
+        run: |
+          bash -n scripts/post_install/customizable_post_install.sh
+          python3 -B -m unittest discover -s tests -p test_figurine_installation.py -v
+      - name: Install ARM user-mode emulation for release smoke tests
+        run: |
+          sudo apt-get update -qq
+          sudo apt-get install -y --no-install-recommends qemu-user
+      - name: Verify and run the pinned AMD64, ARM64 and ARMv7 release binaries
+        env:
+          FIGURINE_VERSION: '2.1.1'
+        shell: bash
+        run: |
+          set -euo pipefail
+          scratch="$(mktemp -d)"
+          trap 'rm -rf "$scratch"' EXIT
+          while read -r arch sha; do
+            archive="figurine_linux_${arch}_v${FIGURINE_VERSION}.tar.gz"
+            target="$scratch/$arch"
+            mkdir -p "$target"
+            curl --fail --location --retry 3 --output "$target/$archive" \
+              "https://github.com/arsham/figurine/releases/download/v${FIGURINE_VERSION}/$archive"
+            printf '%s  %s\n' "$sha" "$target/$archive" | sha256sum --check
+            tar -xf "$target/$archive" -C "$target"
+            runner=()
+            case "$arch" in
+              arm64) runner=(qemu-aarch64) ;;
+              arm) runner=(qemu-arm) ;;
+            esac
+            "${runner[@]}" "$target/deploy/figurine" --version | tee "$target/version"
+            grep -F "figurine version v$FIGURINE_VERSION" "$target/version"
+            "${runner[@]}" "$target/deploy/figurine" -f "3d.flf" "ProxMenux-test" > "$target/banner"
+            test -s "$target/banner"
+            printf 'PASS: %s version and login banner\n' "$arch"
+          done <<'ASSETS'
+          amd64 f2b1c076942c94009d133df0f304a234a0994bf590b40f2927668324d578306a
+          arm64 611550ddb31a75437be3f8587bcdd029d0d890f4d820b7f494a2c6615fecba10
+          arm 429e66bded486d49f730c4a6559e728cd1e9a163a0f56a85867e2cbec010171d
+          ASSETS
diff --git a/.github/workflows/test-guest-backups.yml b/.github/workflows/test-guest-backups.yml
new file mode 100644
index 00000000..60da0353
--- /dev/null
+++ b/.github/workflows/test-guest-backups.yml
@@ -0,0 +1,54 @@
+name: Guest backup archives
+
+on:
+  pull_request:
+    paths:
+      - '.github/workflows/test-guest-backups.yml'
+      - 'AppImage/scripts/guest_backup_archives.py'
+      - 'AppImage/scripts/flask_server.py'
+      - 'AppImage/scripts/jwt_middleware.py'
+      - 'AppImage/scripts/build_appimage.sh'
+      - 'AppImage/components/guest-backup-list.tsx'
+      - 'AppImage/components/virtual-machines.tsx'
+      - 'AppImage/lib/guest-backup-archives.ts'
+      - 'AppImage/messages/**'
+      - 'tests/test_guest_backup_archives.*'
+  push:
+    branches: [main, develop]
+    paths:
+      - 'AppImage/scripts/guest_backup_archives.py'
+      - 'AppImage/scripts/flask_server.py'
+      - 'AppImage/scripts/jwt_middleware.py'
+      - 'AppImage/components/guest-backup-list.tsx'
+      - 'AppImage/components/virtual-machines.tsx'
+      - 'AppImage/lib/guest-backup-archives.ts'
+      - 'tests/test_guest_backup_archives.*'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  guest-backups:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+      - uses: actions/setup-node@v6
+        with:
+          node-version: '22.14.0'
+      - name: Install fixture dependencies
+        run: |
+          python -m pip install 'Flask==3.1.2'
+          npm ci --prefix .github/ci/offline-node --ignore-scripts --no-audit --no-fund
+      - name: Test native deletion, protection, authorization and cache invalidation
+        run: python -B -m unittest discover -s tests -p test_guest_backup_archives.py -v
+      - name: Test frontend deletion and completion handling
+        env:
+          NODE_PATH: ${{ github.workspace }}/.github/ci/offline-node/node_modules
+        run: node tests/test_guest_backup_archives.cjs
diff --git a/.github/workflows/test-i18n.yml b/.github/workflows/test-i18n.yml
index 3a2fc5f0..7f4dfb51 100644
--- a/.github/workflows/test-i18n.yml
+++ b/.github/workflows/test-i18n.yml
@@ -1,4 +1,4 @@
-name: Offline i18n tests
+name: Offline script regressions
 
 on:
   pull_request:
@@ -9,15 +9,20 @@ on:
       - 'AppImage/messages/**'
       - 'AppImage/lib/i18n/**'
       - 'AppImage/components/terminal-panel.tsx'
+      - 'web/**'
       - 'CONTRIBUTING.md'
       # Scheduler consumers and the offline extractor's .sh/.func inputs.
       - 'scripts/**/*.sh'
       - 'scripts/**/*.func'
       - 'scripts/**/*.py'
       - 'lang/*.json'
+      - 'menu'
+      - 'install_proxmenux.sh'
+      - 'install_proxmenux_beta.sh'
       - 'oci/src/**/*.py'
       - 'oci/catalog/**/*.json'
       - 'oci/remote/**/*.sh'
+      - 'oci/remote/**/*.py'
   push:
     branches: [main, develop]
     paths:
@@ -27,21 +32,28 @@ on:
       - 'AppImage/messages/**'
       - 'AppImage/lib/i18n/**'
       - 'AppImage/components/terminal-panel.tsx'
+      - 'web/**'
       - 'CONTRIBUTING.md'
       # Scheduler consumers and the offline extractor's .sh/.func inputs.
       - 'scripts/**/*.sh'
       - 'scripts/**/*.func'
       - 'scripts/**/*.py'
       - 'lang/*.json'
+      - 'menu'
+      - 'install_proxmenux.sh'
+      - 'install_proxmenux_beta.sh'
       - 'oci/src/**/*.py'
       - 'oci/catalog/**/*.json'
       - 'oci/remote/**/*.sh'
+      - 'oci/remote/**/*.py'
   workflow_dispatch:
 
 permissions:
   contents: read
 
 jobs:
+  # Preserve this check ID for existing branch protection rules. This suite
+  # includes menu, download and scheduler regressions as well as i18n tests.
   offline-i18n:
     runs-on: ubuntu-latest
     timeout-minutes: 5
@@ -61,7 +73,7 @@ jobs:
           test -x /usr/bin/jq
       - name: Install OCI wording test dependency
         run: python3 -m pip install 'PyYAML>=6,<7'
-      - name: Run complete offline script test suite
+      - name: Run offline i18n and script regressions
         env:
           PYTHONDONTWRITEBYTECODE: '1'
         run: python3 -m unittest discover -s .github/scripts/tests -v
diff --git a/.github/workflows/test-lvm-disk-policy.yml b/.github/workflows/test-lvm-disk-policy.yml
new file mode 100644
index 00000000..c7e9ea92
--- /dev/null
+++ b/.github/workflows/test-lvm-disk-policy.yml
@@ -0,0 +1,55 @@
+name: Disk policy and host monitor regressions
+
+on:
+  pull_request:
+    paths:
+      - '.github/workflows/test-lvm-disk-policy.yml'
+      - 'AppImage/scripts/lvm_device_scope.py'
+      - 'AppImage/scripts/disk_temperature_history.py'
+      - 'AppImage/scripts/flask_server.py'
+      - 'AppImage/scripts/health_monitor.py'
+      - 'AppImage/scripts/flask_notification_routes.py'
+      - 'AppImage/scripts/proxmox_storage_monitor.py'
+      - 'AppImage/scripts/build_appimage.sh'
+      - 'AppImage/scripts/tests/test_host_backup_node.py'
+      - 'AppImage/scripts/tests/test_proxmox_node_name.py'
+      - 'AppImage/scripts/tests/test_pve_notifications_cfg_writes.py'
+      - 'tests/test_lvm_disk_read_policy.py'
+  push:
+    branches: [main, develop]
+    paths:
+      - 'AppImage/scripts/lvm_device_scope.py'
+      - 'AppImage/scripts/disk_temperature_history.py'
+      - 'AppImage/scripts/flask_server.py'
+      - 'AppImage/scripts/health_monitor.py'
+      - 'AppImage/scripts/flask_notification_routes.py'
+      - 'AppImage/scripts/proxmox_storage_monitor.py'
+      - 'AppImage/scripts/build_appimage.sh'
+      - 'AppImage/scripts/tests/test_host_backup_node.py'
+      - 'AppImage/scripts/tests/test_proxmox_node_name.py'
+      - 'AppImage/scripts/tests/test_pve_notifications_cfg_writes.py'
+      - 'tests/test_lvm_disk_read_policy.py'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  disk-policy:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+      - name: Test automatic LVM readers with mocked inventory and policy
+        run: python -I -B -m unittest discover -s tests -p test_lvm_disk_read_policy.py -v
+      - name: Test backup node ownership and former jobs
+        run: python -I -B -m unittest discover -s AppImage/scripts/tests -p test_host_backup_node.py -v
+      - name: Test local node lookup without Proxmox API commands
+        run: python -I -B -m unittest discover -s AppImage/scripts/tests -p test_proxmox_node_name.py -v
+      - name: Test notification configuration writes against a cluster filesystem fixture
+        run: python -I -B -m unittest discover -s AppImage/scripts/tests -p test_pve_notifications_cfg_writes.py -v
diff --git a/.github/workflows/test-oci-registries.yml b/.github/workflows/test-oci-registries.yml
index 9612c0d3..a4f0b150 100644
--- a/.github/workflows/test-oci-registries.yml
+++ b/.github/workflows/test-oci-registries.yml
@@ -28,7 +28,55 @@ jobs:
           python-version: '3.13'
       - name: Install OCI test dependencies
         run: python3 -m pip install -r oci/requirements.txt
+      - name: Run OCI image reuse and resource edit regressions
+        env:
+          PYTHONDONTWRITEBYTECODE: '1'
+        run: |
+          python3 -m unittest discover -s oci/tests -p test_modify_image_reuse.py -v
+          python3 -m unittest discover -s oci/tests -p test_native_modify.py -v
+          python3 -m unittest discover -s oci/tests -p test_modify_review.py -v
+          python3 -m unittest discover -s oci/tests -p test_modify_review_transaction.py -v
+          python3 -m unittest discover -s oci/tests -p test_stage_release.py -v
+      - name: Run carried record, recovery and configuration cache regressions
+        env:
+          PYTHONDONTWRITEBYTECODE: '1'
+        run: |
+          python3 -m unittest discover -s oci/tests -p 'test_carried*.py' -v
+          python3 -m unittest discover -s oci/tests -p test_restore_recovery.py -v
+      - name: Run read-only volume preparation regressions
+        env:
+          PYTHONDONTWRITEBYTECODE: '1'
+        run: |
+          test -x /bin/bash
+          test -x /usr/bin/jq
+          python3 -m unittest discover -s oci/tests -p test_readonly_volume_preparation.py -v
       - name: Run offline registry account tests
         env:
           PYTHONDONTWRITEBYTECODE: '1'
         run: python3 -m unittest discover -s oci/tests -p 'test_registry_*.py' -v
+      - name: Run OCI Modify latency regressions
+        env:
+          PYTHONDONTWRITEBYTECODE: '1'
+        run: |
+          python3 -m unittest discover -s oci/tests -p test_modify_latency.py -v
+          python3 -m unittest discover -s oci/tests -p test_menu_performance.py -v
+          python3 -m unittest discover -s oci/tests -p test_dialog_escape.py -v
+          python3 -m unittest discover -s oci/tests -p test_work_backup.py -v
+          python3 -m unittest discover -s oci/tests -p test_recreation.py -v
+      - name: Run OCI modification menu regressions
+        env:
+          PYTHONDONTWRITEBYTECODE: '1'
+        run: |
+          python3 -m unittest discover -s oci/tests -p test_modify_menu.py -v
+          python3 -m unittest discover -s oci/tests -p test_manage_sync_notice.py -v
+          python3 -m unittest discover -s oci/tests -p test_recreation.py -v
+          python3 -m unittest discover -s oci/tests -p test_shared_directories.py -v
+          python3 -m unittest discover -s oci/tests -p 'test_wizard*.py' -v
+      - name: Run external OCI settings regressions
+        env:
+          PYTHONDONTWRITEBYTECODE: '1'
+        run: |
+          python3 -m unittest discover -s oci/tests -p 'test_external_tags.py' -v
+          python3 -m unittest discover -s oci/tests -p 'test_instance_reconcile.py' -v
+          python3 -m unittest discover -s oci/tests -p 'test_guessed_endpoint_healthcheck.py' -v
+          python3 -m unittest discover -s oci/tests -p 'test_runtime_home_*.py' -v
diff --git a/.github/workflows/test-offline-qualified.yml b/.github/workflows/test-offline-qualified.yml
index 29af7416..a562c6b3 100644
--- a/.github/workflows/test-offline-qualified.yml
+++ b/.github/workflows/test-offline-qualified.yml
@@ -12,6 +12,7 @@ on:
       - 'AppImage/package-lock.json'
       - 'AppImage/scripts/*.py'
       - 'AppImage/scripts/tests/test_health_persistence_recurrence.py'
+      - 'AppImage/scripts/tests/test_native_app_discovery.py'
       - 'AppImage/app/**'
       - 'AppImage/components/**'
       - 'AppImage/hooks/**'
@@ -32,6 +33,7 @@ on:
       - 'AppImage/package-lock.json'
       - 'AppImage/scripts/*.py'
       - 'AppImage/scripts/tests/test_health_persistence_recurrence.py'
+      - 'AppImage/scripts/tests/test_native_app_discovery.py'
       - 'AppImage/app/**'
       - 'AppImage/components/**'
       - 'AppImage/hooks/**'
@@ -56,7 +58,9 @@ jobs:
       - uses: actions/setup-python@v5
         with:
           python-version: '3.11'
-      - name: Run nine qualified Python files
+      - name: Install native discovery route fixture dependency
+        run: python3 -m pip install 'Flask>=3,<4'
+      - name: Run qualified Python files
         env:
           PYTHONDONTWRITEBYTECODE: '1'
         run: python3 -I -B .github/scripts/run_offline_qualified.py --lane python
@@ -82,7 +86,7 @@ jobs:
         run: |
           npm ci --prefix .github/ci/offline-node --legacy-peer-deps --ignore-scripts --no-audit --no-fund
           ln -s ../.github/ci/offline-node/node_modules AppImage/node_modules
-      - name: Run eleven qualified Node files
+      - name: Run qualified Node files
         env:
           NODE_PATH: ${{ github.workspace }}/AppImage/node_modules
           PYTHONDONTWRITEBYTECODE: '1'
diff --git a/.github/workflows/test-pbs.yml b/.github/workflows/test-pbs.yml
new file mode 100644
index 00000000..2dbc71b0
--- /dev/null
+++ b/.github/workflows/test-pbs.yml
@@ -0,0 +1,66 @@
+name: PBS support
+
+on:
+  pull_request:
+    paths:
+      - '.github/workflows/test-pbs.yml'
+      - 'AppImage/scripts/*pbs*.py'
+      - 'AppImage/scripts/tests/test_pbs.py'
+      - 'AppImage/scripts/health_monitor.py'
+      - 'AppImage/scripts/auth_manager.py'
+      - 'AppImage/scripts/build_appimage.sh'
+      - 'AppImage/components/pbs-*.tsx'
+      - 'AppImage/components/proxmox-dashboard.tsx'
+      - 'AppImage/tests/pbs-navigation.cjs'
+      - 'scripts/global/proxmox_platform.py'
+      - 'scripts/global/platform-functions.sh'
+      - 'scripts/global/repository-functions.sh'
+      - 'scripts/menus/pbs_menu.sh'
+      - 'scripts/utilities/pbs_update.sh'
+      - 'scripts/global/update-pbs.sh'
+      - 'scripts/menus/menu_post_install.sh'
+      - 'scripts/post_install/*.sh'
+  push:
+    branches: [main, develop]
+    paths:
+      - 'AppImage/scripts/*pbs*.py'
+      - 'scripts/global/proxmox_platform.py'
+      - '.github/workflows/test-pbs.yml'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  pbs:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    strategy:
+      fail-fast: false
+      matrix:
+        python: ['3.11', '3.13']
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python }}
+      - name: Install test dependencies
+        run: python -m pip install Flask PyJWT cryptography pyotp segno
+      - name: Platform, real TLS, APIs, health and AppImage packaging
+        run: |
+          python -B -m unittest discover -s AppImage/scripts/tests -p test_pbs.py -v
+          python -B -m unittest discover -s AppImage/scripts/tests -p test_auth_manager_ssl_reload.py -v
+          for script in scripts/global/platform-functions.sh scripts/global/repository-functions.sh scripts/menus/pbs_menu.sh scripts/utilities/pbs_update.sh scripts/menus/main_menu.sh scripts/post_install/auto_post_install.sh scripts/post_install/customizable_post_install.sh scripts/post_install/uninstall-tools.sh scripts/global/update-pbs.sh scripts/menus/menu_post_install.sh; do
+            bash -n "$script"
+          done
+      - uses: actions/setup-node@v6
+        if: matrix.python == '3.11'
+        with:
+          node-version: '22.14.0'
+      - name: Dashboard platform routing
+        if: matrix.python == '3.11'
+        run: |
+          npm ci --prefix .github/ci/offline-node --legacy-peer-deps --ignore-scripts --no-audit --no-fund
+          NODE_PATH="$PWD/.github/ci/offline-node/node_modules" node AppImage/tests/pbs-navigation.cjs
diff --git a/AppImage/components/apprise-service-help.tsx b/AppImage/components/apprise-service-help.tsx
new file mode 100644
index 00000000..de9d132b
--- /dev/null
+++ b/AppImage/components/apprise-service-help.tsx
@@ -0,0 +1,32 @@
+"use client"
+
+import { ExternalLink } from "lucide-react"
+import { useT } from "../lib/i18n/provider"
+
+// These are examples, never defaults: opening help must not replace a saved
+// destination or put placeholder credentials into the notification settings.
+export function AppriseServiceHelp() {
+  const t = useT()
+  return <details className="rounded-md border border-border bg-muted/20 p-2 text-xs">
+    <summary className="cursor-pointer font-medium">{t("settings.notifications.ui.appriseServiceHelp")}</summary>
+    <div className="grid gap-3 pt-3 sm:grid-cols-2">
+      <div className="space-y-1.5 min-w-0">
+        <h4 className="font-medium">Slack</h4>
+        <p className="text-muted-foreground">{t("settings.notifications.ui.appriseSlackSteps")}</p>
+        <code className="block break-all rounded bg-background p-2 text-[10px]">https://hooks.slack.com/services/TOKEN_A/TOKEN_B/TOKEN_C</code>
+        <a href="https://appriseit.com/services/slack/" target="_blank" rel="noopener noreferrer" className="inline-flex items-center gap-1 text-cyan-500 hover:underline">
+          {t("settings.notifications.ui.appriseSlackDocs")} <ExternalLink className="h-3 w-3" />
+        </a>
+      </div>
+      <div className="space-y-1.5 min-w-0">
+        <h4 className="font-medium">Matrix</h4>
+        <p className="text-muted-foreground">{t("settings.notifications.ui.appriseMatrixSteps")}</p>
+        <code className="block break-all rounded bg-background p-2 text-[10px]">matrixs://USER:PASSWORD@matrix.example.com/!ROOM_ID:matrix.example.com</code>
+        <a href="https://appriseit.com/services/matrix/" target="_blank" rel="noopener noreferrer" className="inline-flex items-center gap-1 text-cyan-500 hover:underline">
+          {t("settings.notifications.ui.appriseMatrixDocs")} <ExternalLink className="h-3 w-3" />
+        </a>
+      </div>
+    </div>
+    <p className="mt-3 text-muted-foreground">{t("settings.notifications.ui.appriseServiceFinish")}</p>
+  </details>
+}
diff --git a/AppImage/components/backup-storage-retention.tsx b/AppImage/components/backup-storage-retention.tsx
new file mode 100644
index 00000000..4d15c6a5
--- /dev/null
+++ b/AppImage/components/backup-storage-retention.tsx
@@ -0,0 +1,105 @@
+"use client"
+
+import { useState } from "react"
+import useSWR from "swr"
+import { HardDrive, Loader2, Pencil, RefreshCw } from "lucide-react"
+import { Card, CardContent, CardHeader, CardTitle } from "./ui/card"
+import { Badge } from "./ui/badge"
+import { Button } from "./ui/button"
+import { Checkbox } from "./ui/checkbox"
+import { Dialog, DialogContent, DialogDescription, DialogFooter, DialogHeader, DialogTitle } from "./ui/dialog"
+import { Input } from "./ui/input"
+import { Label } from "./ui/label"
+import { fetchApi } from "../lib/api-config"
+import { buildRetention, parseRetention, RETENTION } from "../lib/backup-retention"
+import { useT } from "../lib/i18n/provider"
+
+interface StorageRetention { id: string; type: string; prune_backups: string; digest: string }
+const fetcher = (url: string) => fetchApi<{ storages: StorageRetention[] }>(url)
+
+export function BackupStorageRetention() {
+  const t = useT()
+  const { data, error, mutate, isValidating } = useSWR("/api/vm-backup-storages", fetcher)
+  const [editing, setEditing] = useState<StorageRetention | null>(null)
+  const [fields, setFields] = useState<Record<string, string>>({})
+  const [keepAll, setKeepAll] = useState(false)
+  const [useDefault, setUseDefault] = useState(false)
+  const [busy, setBusy] = useState(false)
+  const [message, setMessage] = useState("")
+  const [saveError, setSaveError] = useState("")
+
+  function edit(storage: StorageRetention) {
+    const policy = parseRetention(storage.prune_backups)
+    setFields(policy.fields)
+    setKeepAll(policy.keepAll)
+    setUseDefault(!storage.prune_backups)
+    setSaveError("")
+    setMessage("")
+    setEditing(storage)
+  }
+
+  async function save() {
+    if (!editing || busy) return
+    const prune = useDefault ? "" : buildRetention(fields, keepAll)
+    if (!useDefault && !prune) return setSaveError(t("backup.storageRetention.choosePolicy"))
+    setBusy(true)
+    setSaveError("")
+    try {
+      await fetchApi(`/api/vm-backup-storages/${encodeURIComponent(editing.id)}`, {
+        method: "PUT", body: JSON.stringify({ digest: editing.digest, prune_backups: prune }),
+      })
+      setMessage(t("backup.storageRetention.saved"))
+      setEditing(null)
+      await mutate()
+    } catch (error) {
+      setSaveError(`${t("backup.storageRetention.saveFailed")} ${error instanceof Error ? error.message : ""}`)
+    } finally { setBusy(false) }
+  }
+
+  return <Card className="border-border bg-card/50">
+    <CardHeader className="pb-3 flex-row items-center justify-between gap-2">
+      <CardTitle className="text-base flex items-center gap-2"><HardDrive className="h-4 w-4" />{t("backup.storageRetention.title")}</CardTitle>
+      <Button variant="ghost" size="sm" disabled={isValidating} onClick={() => { void mutate().catch(() => {}) }}>
+        <RefreshCw className={`h-4 w-4 mr-2 ${isValidating ? "animate-spin" : ""}`} />{t("backup.storageRetention.refresh")}
+      </Button>
+    </CardHeader>
+    <CardContent className="space-y-3">
+      <p className="text-xs text-muted-foreground">{t("backup.storageRetention.description")}</p>
+      {message && <p role="status" className="text-xs text-emerald-500">{message}</p>}
+      {error ? <p role="alert" className="text-xs text-destructive">{t("backup.storageRetention.loadFailed")}</p> : !data ?
+        <Loader2 className="h-4 w-4 animate-spin" /> : !data.storages.length ?
+        <p className="text-xs text-muted-foreground">{t("backup.storageRetention.empty")}</p> :
+        data.storages.map(storage => <div key={storage.id} className="flex flex-wrap gap-2 items-center border rounded-lg p-3">
+          <span className="font-medium text-sm">{storage.id}</span><Badge variant="outline">{storage.type}</Badge>
+          <span className="text-xs font-mono text-muted-foreground break-all">{storage.prune_backups || t("backup.storageRetention.default")}</span>
+          <Button variant="outline" size="sm" className="ml-auto gap-1" onClick={() => edit(storage)} disabled={!storage.digest || busy}>
+            <Pencil className="h-3 w-3" />{t("backup.storageRetention.edit")}
+          </Button>
+        </div>)}
+    </CardContent>
+    <Dialog open={!!editing} onOpenChange={open => { if (!open && !busy) setEditing(null) }}>
+      <DialogContent className="bg-accent [&_input]:bg-background">
+        <DialogHeader><DialogTitle>{t("backup.storageRetention.editTitle", { storage: editing?.id ?? "" })}</DialogTitle>
+          <DialogDescription>{t("backup.storageRetention.effect")}</DialogDescription></DialogHeader>
+        <Label className="flex items-center gap-2"><Checkbox checked={useDefault} disabled={busy} onCheckedChange={checked => {
+          setUseDefault(checked === true)
+          if (checked) { setKeepAll(false); setFields({}) }
+        }} />{t("backup.storageRetention.useDefault")}</Label>
+        <Label className="flex items-center gap-2"><Checkbox checked={keepAll} disabled={useDefault || busy} onCheckedChange={checked => {
+          setKeepAll(checked === true)
+          if (checked) setFields({})
+        }} />{t("backup.storageRetention.keepAll")}</Label>
+        <div className="grid grid-cols-2 gap-3">
+          {RETENTION.map(key => <div key={key} className="space-y-1">
+            <Label htmlFor={`storage-retention-${key}`}>{t(`backup.retention.keep${key[0].toUpperCase()}${key.slice(1)}`)}</Label>
+            <Input id={`storage-retention-${key}`} type="number" min={1} max={99999} step={1} disabled={useDefault || keepAll || busy}
+              value={fields[key] ?? ""} onChange={event => setFields(previous => ({ ...previous, [key]: event.target.value }))} />
+          </div>)}
+        </div>
+        {saveError && <p role="alert" className="text-xs text-destructive break-words">{saveError}</p>}
+        <DialogFooter><Button variant="outline" disabled={busy} onClick={() => setEditing(null)}>{t("backup.storageRetention.cancel")}</Button>
+          <Button disabled={busy} onClick={save}>{busy && <Loader2 className="h-4 w-4 mr-2 animate-spin" />}{t("backup.storageRetention.save")}</Button></DialogFooter>
+      </DialogContent>
+    </Dialog>
+  </Card>
+}
diff --git a/AppImage/components/backup-tab.tsx b/AppImage/components/backup-tab.tsx
index ae62e19c..b97c6232 100644
--- a/AppImage/components/backup-tab.tsx
+++ b/AppImage/components/backup-tab.tsx
@@ -7,9 +7,11 @@ import { useState } from "react"
 import { DatabaseBackup } from "lucide-react"
 import { HostBackup } from "./host-backup"
 import { VmBackupJobs } from "./vm-backup-jobs"
+import { PBSPanel } from "./pbs-panel"
+import { BackupStorageRetention } from "./backup-storage-retention"
 import { useT } from "../lib/i18n/provider"
 
-type BackupView = "host" | "guests"
+type BackupView = "host" | "guests" | "pbs"
 
 export function BackupTab() {
   const t = useT()
@@ -29,7 +31,7 @@ export function BackupTab() {
             className="flex w-full rounded-lg border border-border bg-muted/40 p-1 gap-1
                        sm:inline-flex sm:w-auto"
           >
-            {(["host", "guests"] as const).map((key) => (
+            {(["host", "guests", "pbs"] as const).map((key) => (
               <button
                 key={key}
                 type="button"
@@ -41,7 +43,7 @@ export function BackupTab() {
                     : "text-muted-foreground hover:text-foreground hover:bg-background/60"
                 }`}
               >
-                {t(`backup.viewSwitch.${key}`)}
+                {key === "pbs" ? t("pbs.title") : t(`backup.viewSwitch.${key}`)}
               </button>
             ))}
           </div>
@@ -51,7 +53,8 @@ export function BackupTab() {
       <div className={view === "host" ? "" : "hidden"}>
         <HostBackup />
       </div>
-      {view === "guests" && <VmBackupJobs />}
+      {view === "guests" && <><VmBackupJobs /><BackupStorageRetention /></>}
+      {view === "pbs" && <PBSPanel />}
     </div>
   )
 }
diff --git a/AppImage/components/guest-backup-list.tsx b/AppImage/components/guest-backup-list.tsx
new file mode 100644
index 00000000..3f6878f7
--- /dev/null
+++ b/AppImage/components/guest-backup-list.tsx
@@ -0,0 +1,135 @@
+"use client"
+
+import { useEffect, useRef, useState } from "react"
+import { Archive, Clock, Loader2, LockKeyhole, RefreshCw, Trash2 } from "lucide-react"
+import { Badge } from "./ui/badge"
+import { Button } from "./ui/button"
+import { Checkbox } from "./ui/checkbox"
+import { Dialog, DialogContent, DialogDescription, DialogFooter, DialogHeader, DialogTitle } from "./ui/dialog"
+import { useT } from "@/lib/i18n/provider"
+import { deleteGuestBackups, type GuestBackup } from "../lib/guest-backup-archives"
+
+export function GuestBackupList({ vmid, backups, loading, onRefresh, storageColor }: {
+  vmid: number
+  backups: GuestBackup[]
+  loading: boolean
+  onRefresh: () => Promise<void>
+  storageColor?: (storage: string) => { bg: string; text: string; border: string }
+}) {
+  const t = useT()
+  const [selected, setSelected] = useState<string[]>([])
+  const [confirm, setConfirm] = useState(false)
+  const [busy, setBusy] = useState(false)
+  const [refreshing, setRefreshing] = useState(false)
+  const [message, setMessage] = useState("")
+  const [error, setError] = useState("")
+  const mounted = useRef(true)
+  useEffect(() => {
+    mounted.current = true
+    return () => { mounted.current = false }
+  }, [])
+  // A fresh list can remove a selection or reveal a newly protected archive.
+  useEffect(() => {
+    setSelected(previous => previous.filter(volid => backups.some(backup => backup.volid === volid && !backup.protected)))
+  }, [backups])
+
+  const chosen = backups.filter(backup => selected.includes(backup.volid) && !backup.protected)
+  const selectable = backups.filter(backup => !backup.protected)
+  const disabled = loading || busy || refreshing
+  const storageClass = (storage: string) => {
+    const color = storageColor?.(storage)
+    return color ? `${color.bg} ${color.text} ${color.border}` : ""
+  }
+
+  async function refresh() {
+    setRefreshing(true)
+    setError("")
+    try { await onRefresh() } catch { if (mounted.current) setError(t("vmLxc.backups.refreshFailed")) }
+    finally { if (mounted.current) setRefreshing(false) }
+  }
+
+  async function remove() {
+    if (!chosen.length || busy) return
+    setBusy(true)
+    setError("")
+    setMessage("")
+    try {
+      const results = await deleteGuestBackups(vmid, chosen)
+      if (!mounted.current) return
+      const deleted = results.filter(result => result.status === "deleted").length
+      const unconfirmed = results.length - deleted
+      setMessage(t("vmLxc.backups.deletedCount", { count: deleted }))
+      if (unconfirmed) setError(t("vmLxc.backups.unconfirmedCount", { count: unconfirmed }))
+      setSelected([])
+    } catch (error) {
+      if (mounted.current) setError(`${t("vmLxc.backups.deleteFailed")} ${error instanceof Error ? error.message : ""}`)
+    } finally {
+      // A timeout can hide a successful native task. Always bypass both caches.
+      try { await onRefresh() } catch { if (mounted.current) setError(t("vmLxc.backups.refreshFailed")) }
+      if (mounted.current) { setBusy(false); setConfirm(false) }
+    }
+  }
+
+  return <>
+    <div className="flex items-center justify-between gap-2 mb-3 shrink-0 flex-wrap">
+      <div className="flex items-center gap-2">
+        <span className="text-xs text-muted-foreground">{t("vmLxc.backups.available")}</span>
+        <Badge variant="secondary" className="text-xs h-5">{backups.length}</Badge>
+      </div>
+      <div className="flex items-center gap-2">
+        <Button size="sm" variant="ghost" className="h-7 text-xs gap-1" disabled={disabled} onClick={refresh}>
+          <RefreshCw className={`h-3 w-3 ${refreshing ? "animate-spin" : ""}`} />{t("vmLxc.backups.refresh")}
+        </Button>
+        <Button size="sm" variant="destructive" className="h-7 text-xs gap-1" disabled={disabled || !chosen.length} onClick={() => setConfirm(true)}>
+          {busy ? <Loader2 className="h-3 w-3 animate-spin" /> : <Trash2 className="h-3 w-3" />}
+          {t("vmLxc.backups.deleteSelected", { count: chosen.length })}
+        </Button>
+      </div>
+    </div>
+    {message && <p role="status" className="text-xs text-muted-foreground mb-2">{message}</p>}
+    {error && <p role="alert" className="text-xs text-destructive mb-2 break-words">{error}</p>}
+    {loading ? <div className="flex-1 flex items-center justify-center text-muted-foreground min-h-0">
+      <Loader2 className="h-4 w-4 animate-spin mr-2" /><span className="text-sm">{t("vmLxc.backups.loading")}</span>
+    </div> : backups.length === 0 ? <div className="flex-1 flex flex-col items-center justify-center text-muted-foreground min-h-0">
+      <Archive className="h-12 w-12 mb-3 opacity-30" /><span className="text-sm">{t("vmLxc.backups.empty")}</span>
+      <span className="text-xs mt-1">{t("vmLxc.backups.emptyHint")}</span>
+    </div> : <>
+      <label className="flex items-center gap-2 mb-3 text-xs text-muted-foreground">
+        <Checkbox checked={selectable.length > 0 && chosen.length === Math.min(20, selectable.length)} disabled={disabled || !selectable.length}
+          onCheckedChange={checked => setSelected(checked ? selectable.slice(0, 20).map(backup => backup.volid) : [])} />
+        {t("vmLxc.backups.selectHint")}
+      </label>
+      <div className="space-y-2 flex-1 overflow-y-auto min-h-0 pr-1 -mr-1">
+        {backups.map(backup => <label key={backup.volid} className="flex items-center gap-2 p-3 rounded-lg bg-muted/30 hover:bg-muted/50 transition-colors">
+          <Checkbox aria-label={`${t("vmLxc.backups.selectBackup")} ${backup.date} ${backup.storage}`} checked={selected.includes(backup.volid)}
+            disabled={disabled || !!backup.protected || (chosen.length >= 20 && !selected.includes(backup.volid))}
+            onCheckedChange={checked => setSelected(previous => checked ? [...previous, backup.volid] : previous.filter(id => id !== backup.volid))} />
+          <div className="w-2 h-2 rounded-full bg-green-500 shrink-0" />
+          <Clock className="h-4 w-4 text-muted-foreground shrink-0" />
+          <span className="text-sm min-w-0 truncate" title={backup.volid}>{backup.date}</span>
+          {backup.protected && <Badge variant="secondary" className="gap-1 text-xs"><LockKeyhole className="h-3 w-3" />{t("vmLxc.backups.protected")}</Badge>}
+          <Badge variant="outline" className={`text-xs ml-auto shrink-0 ${storageClass(backup.storage)}`}>{backup.storage}</Badge>
+          <Badge variant="outline" className="font-mono shrink-0">{backup.size_human}</Badge>
+        </label>)}
+      </div>
+    </>}
+    <Dialog open={confirm} onOpenChange={value => { if (!busy) setConfirm(value) }}>
+      <DialogContent onEscapeKeyDown={event => { if (busy) event.preventDefault() }} onPointerDownOutside={event => { if (busy) event.preventDefault() }}>
+        <DialogHeader>
+          <DialogTitle>{t("vmLxc.backups.confirmTitle", { count: chosen.length })}</DialogTitle>
+          <DialogDescription>{t("vmLxc.backups.confirmDescription", { vmid })}</DialogDescription>
+        </DialogHeader>
+        <ul className="max-h-48 overflow-auto text-xs space-y-2 break-all">
+          {chosen.map(backup => <li key={backup.volid}>{backup.volid}</li>)}
+        </ul>
+        {busy && <p role="status" className="text-sm text-muted-foreground">{t("vmLxc.backups.deleting")}</p>}
+        <DialogFooter>
+          <Button variant="outline" disabled={busy} onClick={() => setConfirm(false)}>{t("vmLxc.backups.cancel")}</Button>
+          <Button variant="destructive" disabled={busy || !chosen.length} onClick={remove}>
+            {busy && <Loader2 className="h-4 w-4 animate-spin mr-2" />}{t("vmLxc.backups.confirmDelete")}
+          </Button>
+        </DialogFooter>
+      </DialogContent>
+    </Dialog>
+  </>
+}
diff --git a/AppImage/components/health-status-modal.tsx b/AppImage/components/health-status-modal.tsx
index c8be541e..090a51fb 100644
--- a/AppImage/components/health-status-modal.tsx
+++ b/AppImage/components/health-status-modal.tsx
@@ -42,6 +42,7 @@ import {
 } from "lucide-react"
 import { ScriptTerminalModal } from "./script-terminal-modal"
 import { useT } from "@/lib/i18n/provider"
+import { useIsPbs } from "@/lib/use-platform"
 
 interface CategoryCheck {
   status: string
@@ -119,6 +120,7 @@ const CATEGORIES = [
 
 export function HealthStatusModal({ open, onOpenChange, getApiUrl }: HealthStatusModalProps) {
   const t = useT()
+  const isPbs = useIsPbs()
   const [loading, setLoading] = useState(true)
   const [healthData, setHealthData] = useState<HealthDetails | null>(null)
   const [dismissedItems, setDismissedItems] = useState<DismissedError[]>([])
@@ -460,6 +462,11 @@ export function HealthStatusModal({ open, onOpenChange, getApiUrl }: HealthStatu
     return originalStatus?.toUpperCase() || "UNKNOWN"
   }
 
+  // Checks the host reports as not applicable (guests on PBS) are not listed or counted.
+  const visibleCategories = CATEGORIES.filter(({ key }) =>
+    !(healthData?.details?.[key as keyof typeof healthData.details] as { not_applicable?: boolean } | undefined)?.not_applicable)
+  const categoryLabel = (key: string) => t(`healthStatus.categories.${isPbs && key === "services" ? "pbsServices" : key}`)
+
   const getHealthStats = () => {
     if (!healthData?.details) return { total: 0, healthy: 0, info: 0, warnings: 0, critical: 0, unknown: 0 }
 
@@ -469,7 +476,7 @@ export function HealthStatusModal({ open, onOpenChange, getApiUrl }: HealthStatu
     let critical = 0
     let unknown = 0
 
-    CATEGORIES.forEach(({ key }) => {
+    visibleCategories.forEach(({ key }) => {
       const categoryData = healthData.details[key as keyof typeof healthData.details]
       if (categoryData) {
         const effectiveStatus = getEffectiveStatus(key, categoryData.status)
@@ -481,7 +488,7 @@ export function HealthStatusModal({ open, onOpenChange, getApiUrl }: HealthStatu
       }
     })
 
-    return { total: CATEGORIES.length, healthy, info, warnings, critical, unknown }
+    return { total: visibleCategories.length, healthy, info, warnings, critical, unknown }
   }
 
   const stats = getHealthStats()
@@ -759,7 +766,7 @@ export function HealthStatusModal({ open, onOpenChange, getApiUrl }: HealthStatu
 
             {/* Category List */}
             <div className="space-y-2">
-              {CATEGORIES.map(({ key, Icon }) => {
+              {visibleCategories.map(({ key, Icon }) => {
                 const categoryData = healthData.details[key as keyof typeof healthData.details]
                 const originalStatus = categoryData?.status || "UNKNOWN"
                 const status = getEffectiveStatus(key, originalStatus)
@@ -784,7 +791,7 @@ export function HealthStatusModal({ open, onOpenChange, getApiUrl }: HealthStatu
                       </div>
                       <div className="flex-1 min-w-0 overflow-hidden">
                         <div className="flex items-center gap-1.5 sm:gap-2">
-                          <p className="font-medium text-xs sm:text-sm truncate">{t(`healthStatus.categories.${key}`)}</p>
+                          <p className="font-medium text-xs sm:text-sm truncate">{categoryLabel(key)}</p>
                           {hasChecks && (
                             <span className="text-[10px] text-muted-foreground shrink-0">
                               ({Object.values(checks).filter(c => c.installed !== false).length})
@@ -871,7 +878,7 @@ export function HealthStatusModal({ open, onOpenChange, getApiUrl }: HealthStatu
                 {filteredDismissed.map((item) => {
                   const catMeta = CATEGORIES.find(c => c.category === item.category || c.key === item.category)
                   const CatIcon = catMeta?.Icon || BellOff
-                  const catLabel = catMeta ? t(`healthStatus.categories.${catMeta.key}`) : item.category
+                  const catLabel = catMeta ? categoryLabel(catMeta.key) : item.category
                   const isPermanent = item.permanent || item.suppression_remaining_hours === -1
                   
                   return (
@@ -936,7 +943,7 @@ export function HealthStatusModal({ open, onOpenChange, getApiUrl }: HealthStatu
                         <div key={cs.key} className="flex items-center justify-between gap-2">
                           <div className="flex items-center gap-2 min-w-0">
                             <CatIcon className="h-3 w-3 sm:h-3.5 sm:w-3.5 text-blue-400/70 shrink-0" />
-                            <span className="text-[11px] sm:text-xs text-blue-400/80 truncate">{catMeta ? t(`healthStatus.categories.${catMeta.key}`) : cs.label}</span>
+                            <span className="text-[11px] sm:text-xs text-blue-400/80 truncate">{catMeta ? categoryLabel(catMeta.key) : cs.label}</span>
                           </div>
                           <Badge variant="outline" className="text-[9px] sm:text-[10px] border-blue-500/30 text-blue-400/80 bg-transparent shrink-0">
                             {durationLabel}
diff --git a/AppImage/components/lxc-app-panel.tsx b/AppImage/components/lxc-app-panel.tsx
index 59939f0b..22154ef6 100644
--- a/AppImage/components/lxc-app-panel.tsx
+++ b/AppImage/components/lxc-app-panel.tsx
@@ -19,7 +19,7 @@
  * Secure Gateway.
  */
 
-import { useCallback, useEffect, useMemo, useState } from "react"
+import { useCallback, useEffect, useMemo, useRef, useState } from "react"
 import {
   Loader2, Save, RefreshCw, Trash2, Package, ExternalLink,
   AlertTriangle, Info, PlusCircle, Pencil, ChevronDown, ChevronRight, EyeOff,
@@ -93,6 +93,7 @@ interface AppConfig {
   health_path?: string
   logo_url?: string
   helper_slug?: string
+  discovery_id?: string
   // Set when the application runs inside Docker: registered for its identity
   // and installed version, updated by the image it comes from.
   update_via?: string
@@ -121,7 +122,18 @@ interface PortDetail {
   logo_url: string
 }
 
+interface NativeDiscovery {
+  vmid: number
+  status: "not_scanned" | "complete" | "partial" | "error" | "busy"
+  stale: boolean
+  candidates: DetectedApp[]
+}
+
 interface DetectedApp {
+  discovery_id?: string
+  source?: "native_metadata"
+  installed_version?: string | null
+  evidence?: Array<{ kind: string; value: string }>
   slug: string
   name: string
   logo_url?: string | null
@@ -462,12 +474,37 @@ export function LxcAppPanel({ vmid, ctIp, onChange, managed, initialData, oci }:
   const [loading, setLoading] = useState(!seed)
   const [sidecar, setSidecar] = useState<SidecarResponse | null>(seed?.sidecar ?? null)
   const [suggestions, setSuggestions] = useState<Suggestions | null>(seed?.suggestions ?? null)
+  const [nativeDiscovery, setNativeDiscovery] = useState<NativeDiscovery | null>(null)
+  const nativeRequest = useRef(0)
+  const targetRef = useRef(vmid)
+  targetRef.current = vmid
+  const targetGeneration = useRef(0)
+  const previousTarget = useRef(vmid)
+  if (previousTarget.current !== vmid) {
+    previousTarget.current = vmid
+    targetGeneration.current += 1
+  }
+  useEffect(() => {
+    const generation = targetGeneration.current
+    const request = ++nativeRequest.current
+    setNativeDiscovery(null)
+    setEditing(null)
+    setDetectionNotice(null)
+    setSearchingApplications(false)
+    setSaving(false)
+    if (managed) return
+    fetchApi<NativeDiscovery>(`/api/vms/${vmid}/apps/native-discovery`).then(result => {
+      if (targetRef.current === vmid && targetGeneration.current === generation
+          && nativeRequest.current === request) setNativeDiscovery(result)
+    }).catch(() => { /* cached metadata is optional; never initiate a scan */ })
+    return () => { targetGeneration.current += 1 }
+  }, [vmid, managed])
   const [adguardSetupAvailable, setAdguardSetupAvailable] = useState(false)
   const [error, setError] = useState<string | null>(null)
   const [searchingApplications, setSearchingApplications] = useState(false)
   const [detectionNotice, setDetectionNotice] = useState<{ found: boolean; text: string } | null>(null)
   // Editor state
-  const [editing, setEditing] = useState<{ appId: string | null; draft: AppConfig } | null>(null)
+  const [editing, setEditing] = useState<{ appId: string | null; draft: AppConfig; targetVmid: number } | null>(null)
   const [binaryArgsInput, setBinaryArgsInput] = useState("")
   const [commandArgvInput, setCommandArgvInput] = useState("")
   const [saving, setSaving] = useState(false)
@@ -522,6 +559,8 @@ export function LxcAppPanel({ vmid, ctIp, onChange, managed, initialData, oci }:
     // `initialData` or the shared cache, the sidecar is already
     // populated and the user shouldn't see a flash of "Loading…"
     // while we revalidate.
+    const generation = targetGeneration.current
+    const isCurrent = () => targetRef.current === vmid && targetGeneration.current === generation
     if (!sidecar) setLoading(true)
     setError(null)
     try {
@@ -533,14 +572,14 @@ export function LxcAppPanel({ vmid, ctIp, onChange, managed, initialData, oci }:
       // the "Loading applications…" flash that used to show while a
       // second, racing fetch caught up.
       const bundle = await fetchLxcApps(vmid)
-      if (bundle) {
+      if (bundle && isCurrent()) {
         setSidecar(bundle.sidecar)
         setSuggestions(bundle.suggestions)
       }
     } catch (e: any) {
-      setError(e?.message || t("vmLxc.appEditor.loadFailed"))
+      if (isCurrent()) setError(e?.message || t("vmLxc.appEditor.loadFailed"))
     } finally {
-      setLoading(false)
+      if (isCurrent()) setLoading(false)
     }
     // eslint-disable-next-line react-hooks/exhaustive-deps
   }, [vmid, managed])
@@ -617,7 +656,7 @@ export function LxcAppPanel({ vmid, ctIp, onChange, managed, initialData, oci }:
     return msg
   }
 
-  const editorOpen = !!editing
+  const editorOpen = !!editing && editing.targetVmid === vmid
 
   // The picker catalog is only needed after the user opens the editor.
   useEffect(() => {
@@ -653,8 +692,8 @@ export function LxcAppPanel({ vmid, ctIp, onChange, managed, initialData, oci }:
   // (`extras[]` from the backend). Both use the same DetectedApp
   // shape so the empty state renders them uniformly.
   const detectedList: DetectedApp[] = useMemo(() => {
-    if (!suggestions) return []
-    const out: DetectedApp[] = []
+    const out: DetectedApp[] = [...(nativeDiscovery?.vmid === vmid ? nativeDiscovery.candidates : [])]
+    if (!suggestions) return out
     // A ProxMenux OCI install has no helper slug — nothing was installed by a
     // community script — so its template id identifies it instead.
     const primarySlug = suggestions.helper_slug || suggestions.oci_instance?.template_id
@@ -679,12 +718,12 @@ export function LxcAppPanel({ vmid, ctIp, onChange, managed, initialData, oci }:
       }
     }
     return out
-  }, [suggestions])
+  }, [suggestions, nativeDiscovery, vmid])
 
   // Registered slugs — used to filter the detection list down to
   // what the user hasn't already registered on this CT.
   const registeredSlugs = useMemo(
-    () => new Set(apps.map((a) => a.helper_slug).filter(Boolean) as string[]),
+    () => new Set(apps.flatMap((a) => [a.helper_slug, a.discovery_id]).filter(Boolean) as string[]),
     [apps],
   )
   // Dismissed slugs — persisted in the sidecar. Chips the user
@@ -750,14 +789,32 @@ export function LxcAppPanel({ vmid, ctIp, onChange, managed, initialData, oci }:
   }
 
   const searchInstalledApplications = async () => {
+    const generation = targetGeneration.current
+    const request = ++nativeRequest.current
+    const isCurrent = () => targetRef.current === vmid && targetGeneration.current === generation
+      && nativeRequest.current === request
     const before = new Set([...visibleDetected, ...visibleWorkloads].map((item) => item.slug))
     setSearchingApplications(true)
     setDetectionNotice(null)
     setError(null)
     try {
+      let native = await fetchApi<NativeDiscovery>(`/api/vms/${vmid}/apps/native-discovery`, {
+        method: "POST",
+      })
+      if (!isCurrent()) return
+      setNativeDiscovery(native)
+      if (native.status === "error" || native.status === "busy") {
+        setDetectionNotice({ found: false, text: t("vmLxc.appEditor.nativeScanFailed") })
+        return
+      }
       const result: Suggestions = await fetchApi(`/api/vms/${vmid}/apps/suggestions`, {
         method: "POST",
       })
+      if (!isCurrent()) return
+      // Recompose against the refreshed catalog without another native scan.
+      native = await fetchApi<NativeDiscovery>(`/api/vms/${vmid}/apps/native-discovery`)
+      if (!isCurrent()) return
+      setNativeDiscovery(native)
       setSuggestions(result)
       if (sidecar) setLxcAppsCached(vmid, sidecar, result)
 
@@ -765,11 +822,14 @@ export function LxcAppPanel({ vmid, ctIp, onChange, managed, initialData, oci }:
       if (result.helper_slug) detected.add(result.helper_slug)
       for (const item of result.extras || []) detected.add(item.slug)
       for (const item of result.docker_workloads || []) detected.add(item.slug)
+      for (const item of native.candidates) detected.add(item.slug)
       const visible = [...detected].filter(
         (slug) => !registeredSlugs.has(slug) && !dismissedSlugs.has(slug),
       )
       const newCount = visible.filter((slug) => !before.has(slug)).length
-      if (newCount === 1) {
+      if (native.status === "partial") {
+        setDetectionNotice({ found: visible.length > 0, text: t("vmLxc.appEditor.nativeScanPartial") })
+      } else if (newCount === 1) {
         setDetectionNotice({ found: true, text: t("vmLxc.appEditor.oneNewApplicationDetected") })
       } else if (newCount > 1) {
         setDetectionNotice({
@@ -785,9 +845,9 @@ export function LxcAppPanel({ vmid, ctIp, onChange, managed, initialData, oci }:
         })
       }
     } catch (e: any) {
-      setError(e?.message || t("vmLxc.appEditor.detectionFailed"))
+      if (isCurrent()) setError(e?.message || t("vmLxc.appEditor.detectionFailed"))
     } finally {
-      setSearchingApplications(false)
+      if (isCurrent()) setSearchingApplications(false)
     }
   }
 
@@ -804,6 +864,7 @@ export function LxcAppPanel({ vmid, ctIp, onChange, managed, initialData, oci }:
     existing?: AppEntry,
     opts?: { withTracking?: boolean, preset?: DetectedApp },
   ) => {
+    const generation = targetGeneration.current
     let seed: AppConfig
     if (existing) {
       seed = {
@@ -832,6 +893,7 @@ export function LxcAppPanel({ vmid, ctIp, onChange, managed, initialData, oci }:
         health_path: existing.health_path || "",
         logo_url: existing.logo_url || "",
         helper_slug: existing.helper_slug || "",
+        ...(existing.discovery_id ? { discovery_id: existing.discovery_id } : {}),
         // Preserved explicitly: saving replaces the whole record, so dropping
         // it here would silently un-delegate the app the first time someone
         // edits one of its ports.
@@ -862,7 +924,11 @@ export function LxcAppPanel({ vmid, ctIp, onChange, managed, initialData, oci }:
         const p = opts.preset
         seed.name = p.name
         seed.logo_url = p.logo_url || ""
-        seed.helper_slug = p.slug
+        if (p.discovery_id) {
+          seed.discovery_id = p.discovery_id
+          seed.update_method = "none"
+          seed.update_command = ""
+        } else seed.helper_slug = p.slug
         // Docker endpoints come from the real published host-port mappings
         // listed under Web links.  Do not pre-save a catalog default such as
         // 9000; the user explicitly chooses which workload links to add.
@@ -943,9 +1009,10 @@ export function LxcAppPanel({ vmid, ctIp, onChange, managed, initialData, oci }:
         setShowAdvanced(false)
       }
     }
+    if (targetRef.current !== vmid || targetGeneration.current !== generation) return
     setBinaryArgsInput((seed.binary_args || []).join(", "))
     setCommandArgvInput((seed.command_argv || []).join(", "))
-    setEditing({ appId: existing?.id || null, draft: seed })
+    setEditing({ appId: existing?.id || null, draft: seed, targetVmid: vmid })
     setDetectorTest(null)
     setError(null)
   }, [suggestions, vmid, sidecar, isOciAdguard, adguardSetupAvailable])
@@ -959,7 +1026,9 @@ export function LxcAppPanel({ vmid, ctIp, onChange, managed, initialData, oci }:
   }
 
   const save = async () => {
-    if (!editing) return
+    if (!editing || editing.targetVmid !== vmid || targetRef.current !== vmid) return
+    const generation = targetGeneration.current
+    const isCurrent = () => targetRef.current === vmid && targetGeneration.current === generation
     setSaving(true)
     setError(null)
     try {
@@ -973,6 +1042,7 @@ export function LxcAppPanel({ vmid, ctIp, onChange, managed, initialData, oci }:
         body: JSON.stringify(editing.draft),
       })
       if ((r as any).error) throw new Error((r as any).error)
+      if (!isCurrent()) return
       setSidecar(r)
       setLxcAppsCached(vmid, r, suggestions)
       setEditing(null)
@@ -980,9 +1050,9 @@ export function LxcAppPanel({ vmid, ctIp, onChange, managed, initialData, oci }:
       setCommandArgvInput("")
       onChange?.()
     } catch (e: any) {
-      setError(e?.message || t("vmLxc.appEditor.saveFailed"))
+      if (isCurrent()) setError(e?.message || t("vmLxc.appEditor.saveFailed"))
     } finally {
-      setSaving(false)
+      if (isCurrent()) setSaving(false)
     }
   }
 
@@ -1283,7 +1353,7 @@ export function LxcAppPanel({ vmid, ctIp, onChange, managed, initialData, oci }:
   }
 
   // ── Editor ─────────────────────────────────────────────────────
-  if (editing) {
+  if (editorOpen && editing) {
     const draft = editing.draft
     const method = draft.installed_via || ""
     const isPackaged = method === "dpkg" || method === "apk"
@@ -2452,6 +2522,24 @@ export function LxcAppPanel({ vmid, ctIp, onChange, managed, initialData, oci }:
                 ? t("vmLxc.appEditor.versionDetected", { version: d.tracking_suggestion.detected_version || "" })
                 : t("vmLxc.appEditor.detectedInContainer")}
             </div>
+            {d.source === "native_metadata" && (
+              <div className="text-xs text-muted-foreground mt-1 break-all">
+                <div>{d.installed_version
+                  ? t("vmLxc.appEditor.versionDetected", { version: d.installed_version })
+                  : t("vmLxc.appEditor.nativeVersionUnknown")}</div>
+                {(nativeDiscovery?.stale || nativeDiscovery?.status === "partial") && (
+                  <div className="text-amber-400">{t("vmLxc.appEditor.nativeEvidenceStale")}</div>
+                )}
+                {d.evidence?.map((e, index) => <div key={index}>
+                  {t(e.kind === "tcp_listener" ? "vmLxc.appEditor.nativeEvidencePort"
+                    : e.kind === "installation_file" ? "vmLxc.appEditor.nativeEvidenceFile"
+                    : e.kind === "process_executable" ? "vmLxc.appEditor.nativeEvidenceProcess"
+                    : e.kind === "working_directory" ? "vmLxc.appEditor.nativeEvidenceDirectory"
+                    : "vmLxc.appEditor.nativeEvidenceService")}: {e.value}
+                </div>)}
+                <div>{t("vmLxc.appEditor.nativeRegisterOnly")}</div>
+              </div>
+            )}
             {d.tracking_suggestion?.detector_source === "legacy_fallback" && (
               <div className="text-[10px] text-amber-400/90 mt-0.5">
                 {t("vmLxc.appEditor.legacyDetectorUsed")}
diff --git a/AppImage/components/monitor-switcher.tsx b/AppImage/components/monitor-switcher.tsx
new file mode 100644
index 00000000..0cd2d34b
--- /dev/null
+++ b/AppImage/components/monitor-switcher.tsx
@@ -0,0 +1,283 @@
+"use client"
+
+import { useEffect, useState } from "react"
+import useSWR, { mutate as refreshCache } from "swr"
+import { ArrowLeft, ChevronDown, DatabaseBackup, ExternalLink, Plus, Server, Trash2 } from "lucide-react"
+import { Button } from "./ui/button"
+import { Input } from "./ui/input"
+import { Label } from "./ui/label"
+import { Switch } from "./ui/switch"
+import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from "./ui/select"
+import { Dialog, DialogContent, DialogDescription, DialogHeader, DialogTitle } from "./ui/dialog"
+import {
+  DropdownMenu, DropdownMenuContent, DropdownMenuItem, DropdownMenuLabel, DropdownMenuSeparator, DropdownMenuTrigger,
+} from "./ui/dropdown-menu"
+import { fetchApi } from "../lib/api-config"
+import { useT } from "../lib/i18n/provider"
+
+interface MonitorLink {
+  key: string
+  name: string
+  product: "pve" | "pbs"
+  group: "cluster" | "standalone" | "pbs"
+  url: string | null
+  status: "online" | "offline" | "unknown"
+  native_url?: string | null
+  manual: boolean
+  hidden: boolean
+  custom_url: boolean
+}
+interface MonitorLinks { self: { name: string; product: string }; links: MonitorLink[] }
+
+const GROUPS = ["cluster", "standalone", "pbs"] as const
+const fetcher = (url: string) => fetchApi<MonitorLinks>(url)
+const ORIGIN_KEY = "proxmenux-came-from"
+
+interface Origin { url: string; name: string; product: "pve" | "pbs" }
+
+// The Monitor a jump came from, as the browser reached it. Only a bare http(s)
+// origin is accepted, and the parameters leave the address at once.
+function takeOrigin(): (Origin & { fresh?: boolean }) | null {
+  if (typeof window === "undefined") return null
+  const params = new URLSearchParams(window.location.search)
+  const from = params.get("pmx_from")
+  if (from !== null) {
+    const name = params.get("pmx_name") || ""
+    const product = params.get("pmx_product") === "pbs" ? "pbs" : "pve"
+    for (const key of ["pmx_from", "pmx_name", "pmx_product"]) params.delete(key)
+    const query = params.toString()
+    window.history.replaceState(null, "", window.location.pathname + (query ? `?${query}` : "") + window.location.hash)
+    try {
+      const parsed = new URL(from)
+      if (/^https?:$/.test(parsed.protocol) && parsed.origin === from && parsed.origin !== window.location.origin) {
+        const origin: Origin = { url: parsed.origin, name: (name || parsed.hostname).slice(0, 64), product }
+        try { sessionStorage.setItem(ORIGIN_KEY, JSON.stringify(origin)) } catch { /* private mode */ }
+        return { ...origin, fresh: true }
+      }
+    } catch { /* not an address */ }
+  }
+  try {
+    const stored = JSON.parse(sessionStorage.getItem(ORIGIN_KEY) || "null")
+    return stored && typeof stored.url === "string" && /^https?:\/\//.test(stored.url) ? stored : null
+  } catch { return null }
+}
+
+// Where a link leads: its Monitor, or the native PBS interface when no Monitor answers there.
+function destination(link: MonitorLink): { href: string; native: boolean } | null {
+  if (link.product === "pbs" && link.status !== "online" && link.native_url) return { href: link.native_url, native: true }
+  return link.url ? { href: link.url, native: false } : null
+}
+
+function ProductIcon({ product, className }: { product: string; className?: string }) {
+  return product === "pbs" ? <DatabaseBackup className={className} /> : <Server className={className} />
+}
+
+export function MonitorSwitcher({ nodeName, compact = false }: { nodeName: string; compact?: boolean }) {
+  const t = useT()
+  const [manageOpen, setManageOpen] = useState(false)
+  // The backend keeps the list ready, so the menu opens already filled.
+  const { data, error, isLoading } = useSWR<MonitorLinks>("/api/monitor-links", fetcher, { revalidateOnFocus: false, refreshInterval: 300000 })
+
+  const [origin, setOrigin] = useState<(Origin & { fresh?: boolean }) | null>(null)
+  const [offerOrigin, setOfferOrigin] = useState(false)
+  const [adding, setAdding] = useState(false)
+  const [addError, setAddError] = useState("")
+  useEffect(() => { setOrigin(takeOrigin()) }, [])
+  const originKnown = !!origin && !!data?.links.some(link => link.url === origin.url)
+  useEffect(() => {
+    // Offered once, right after arriving, when this Monitor has no way back yet.
+    if (origin?.fresh && data && !originKnown) setOfferOrigin(true)
+  }, [origin, data, originKnown])
+
+  // The address carries where the jump comes from, so the other Monitor can offer the way back.
+  const withOrigin = (href: string) => {
+    const params = new URLSearchParams({ pmx_from: window.location.origin, pmx_name: nodeName, pmx_product: data?.self.product === "pbs" ? "pbs" : "pve" })
+    return `${href}/?${params.toString()}`
+  }
+  const open = (href: string, newTab: boolean) => {
+    if (newTab) window.open(href, "_blank", "noopener,noreferrer")
+    else window.location.assign(href)
+  }
+  const go = (link: MonitorLink, newTab: boolean) => {
+    const target = destination(link)
+    if (!target) return
+    if (target.native) open(target.href, true)
+    else open(withOrigin(target.href), newTab)
+  }
+  const addOrigin = async () => {
+    if (!origin) return
+    setAdding(true); setAddError("")
+    try {
+      await fetchApi("/api/monitor-links", { method: "POST", body: JSON.stringify({ name: origin.name, url: origin.url, product: origin.product }) })
+      await refreshCache("/api/monitor-links")
+      setOfferOrigin(false)
+    } catch (err) {
+      setAddError(err instanceof Error ? err.message : t("monitorLinks.saveFailed"))
+    } finally { setAdding(false) }
+  }
+
+  return <div onClick={event => event.stopPropagation()}>
+    <DropdownMenu>
+      <DropdownMenuTrigger asChild>
+        <Button variant="outline" size="sm" className={`gap-2 border-border bg-transparent hover:bg-secondary ${compact ? "h-8 px-2.5 text-xs" : ""}`}>
+          <Server className={compact ? "h-3.5 w-3.5" : "h-4 w-4"} />
+          <span className="max-w-[12rem] truncate">{t("status.node", { node: nodeName })}</span>
+          <ChevronDown className="h-3.5 w-3.5 opacity-70" />
+        </Button>
+      </DropdownMenuTrigger>
+      <DropdownMenuContent align="end" className="w-72">
+        <DropdownMenuLabel className="text-xs font-medium text-muted-foreground">{t("monitorLinks.thisNode")}</DropdownMenuLabel>
+        <DropdownMenuItem disabled className="gap-2 opacity-100">
+          <span className="h-2 w-2 rounded-full bg-green-500" />
+          <ProductIcon product={data?.self.product || ""} className="h-4 w-4 text-muted-foreground" />
+          <span className="truncate font-medium">{nodeName}</span>
+        </DropdownMenuItem>
+        {origin && !originKnown && <DropdownMenuItem className="gap-2" onSelect={() => open(withOrigin(origin.url), false)}>
+          <ArrowLeft className="h-4 w-4 text-muted-foreground" />
+          <span className="min-w-0 flex-1 truncate">{t("monitorLinks.backTo", { name: origin.name })}</span>
+        </DropdownMenuItem>}
+        {isLoading && <p className="px-2 py-1.5 text-xs text-muted-foreground">{t("monitorLinks.checking")}</p>}
+        {error && <p className="px-2 py-1.5 text-xs text-amber-500">{t("monitorLinks.loadFailed")}</p>}
+        {data && data.links.length === 0 && <p className="px-2 py-1.5 text-xs text-muted-foreground">{t("monitorLinks.empty")}</p>}
+        {data && GROUPS.map(group => {
+          const rows = data.links.filter(link => link.group === group)
+          if (rows.length === 0) return null
+          return <div key={group}>
+            <DropdownMenuSeparator />
+            <DropdownMenuLabel className="text-xs font-medium text-muted-foreground">{t(`monitorLinks.groups.${group}`)}</DropdownMenuLabel>
+            {rows.map(link => {
+              const target = destination(link)
+              return <DropdownMenuItem key={link.key} disabled={!target} className="gap-2" onSelect={() => go(link, false)}>
+                <span className={`h-2 w-2 shrink-0 rounded-full ${link.status === "online" ? "bg-green-500" : "bg-gray-500"}`} />
+                <ProductIcon product={link.product} className="h-4 w-4 shrink-0 text-muted-foreground" />
+                <span className="min-w-0 flex-1 truncate">{link.name}</span>
+                {target?.native
+                  ? <span className="shrink-0 text-[11px] text-muted-foreground">{t("monitorLinks.pbsInterface")}</span>
+                  : link.status !== "online" && <span className="shrink-0 text-[11px] text-muted-foreground">{t("monitorLinks.noResponse")}</span>}
+                {target && <button type="button" aria-label={t("monitorLinks.openNewTab")} title={t("monitorLinks.openNewTab")}
+                  className="shrink-0 rounded p-0.5 text-muted-foreground hover:text-foreground"
+                  onClick={event => { event.preventDefault(); event.stopPropagation(); go(link, true) }}>
+                  <ExternalLink className="h-3.5 w-3.5" />
+                </button>}
+              </DropdownMenuItem>
+            })}
+          </div>
+        })}
+        <DropdownMenuSeparator />
+        <DropdownMenuItem className="gap-2" onSelect={() => setManageOpen(true)}>
+          <Plus className="h-4 w-4" />{t("monitorLinks.manage")}
+        </DropdownMenuItem>
+      </DropdownMenuContent>
+    </DropdownMenu>
+    {manageOpen && <ManageLinksDialog open={manageOpen} onOpenChange={setManageOpen} />}
+    {origin && <Dialog open={offerOrigin} onOpenChange={setOfferOrigin}>
+      <DialogContent className="max-w-md" onClick={event => event.stopPropagation()}>
+        <DialogHeader>
+          <DialogTitle>{t("monitorLinks.cameFromTitle")}</DialogTitle>
+          <DialogDescription>{t("monitorLinks.cameFromBody", { name: origin.name })}</DialogDescription>
+        </DialogHeader>
+        <p className="break-all rounded-md border border-border bg-muted/40 px-3 py-2 font-mono text-sm">{origin.url}</p>
+        {addError && <p role="alert" className="text-sm text-red-500">{addError}</p>}
+        <div className="flex justify-end gap-2">
+          <Button variant="outline" disabled={adding} onClick={() => setOfferOrigin(false)}>{t("monitorLinks.notNow")}</Button>
+          <Button disabled={adding} onClick={addOrigin}><Plus className="mr-2 h-4 w-4" />{t("monitorLinks.add")}</Button>
+        </div>
+      </DialogContent>
+    </Dialog>}
+  </div>
+}
+
+function ManageLinksDialog({ open, onOpenChange }: { open: boolean; onOpenChange: (open: boolean) => void }) {
+  const t = useT()
+  const { data, mutate } = useSWR<MonitorLinks>("/api/monitor-links?all=1", fetcher, { revalidateOnFocus: false })
+  const [form, setForm] = useState({ name: "", url: "", product: "pve" })
+  const [addresses, setAddresses] = useState<Record<string, string>>({})
+  const [busy, setBusy] = useState(false)
+  const [error, setError] = useState("")
+
+  const run = async (action: () => Promise<unknown>) => {
+    setBusy(true); setError("")
+    try {
+      await action()
+      await mutate()
+      await refreshCache("/api/monitor-links")
+    } catch (err) {
+      setError(err instanceof Error ? err.message : t("monitorLinks.saveFailed"))
+    } finally { setBusy(false) }
+  }
+  const send = (path: string, method: string, body?: unknown) =>
+    fetchApi(path, { method, ...(body === undefined ? {} : { body: JSON.stringify(body) }) })
+
+  return <Dialog open={open} onOpenChange={onOpenChange}>
+    <DialogContent className="max-w-2xl max-h-[85vh] overflow-y-auto" onClick={event => event.stopPropagation()}>
+      <DialogHeader>
+        <DialogTitle>{t("monitorLinks.dialogTitle")}</DialogTitle>
+        <DialogDescription>{t("monitorLinks.dialogDescription")}</DialogDescription>
+      </DialogHeader>
+
+      <div className="space-y-3 rounded-lg border border-border p-4">
+        <p className="text-sm font-medium">{t("monitorLinks.addTitle")}</p>
+        <div className="grid gap-3 sm:grid-cols-[1fr_1.5fr_auto]">
+          <div className="space-y-1.5">
+            <Label htmlFor="monitor-link-name">{t("monitorLinks.name")}</Label>
+            <Input id="monitor-link-name" value={form.name} disabled={busy} onChange={event => setForm({ ...form, name: event.target.value })} />
+          </div>
+          <div className="space-y-1.5">
+            <Label htmlFor="monitor-link-url">{t("monitorLinks.address")}</Label>
+            <Input id="monitor-link-url" value={form.url} disabled={busy} placeholder="https://192.168.1.20:8008"
+              onChange={event => setForm({ ...form, url: event.target.value })} />
+          </div>
+          <div className="space-y-1.5">
+            <Label htmlFor="monitor-link-product">{t("monitorLinks.type")}</Label>
+            <Select value={form.product} disabled={busy} onValueChange={product => setForm({ ...form, product })}>
+              <SelectTrigger id="monitor-link-product" className="w-full sm:w-56"><SelectValue /></SelectTrigger>
+              <SelectContent>
+                <SelectItem value="pve">Proxmox VE</SelectItem>
+                <SelectItem value="pbs">Proxmox Backup Server</SelectItem>
+              </SelectContent>
+            </Select>
+          </div>
+        </div>
+        <Button size="sm" disabled={busy || !form.url.trim()} onClick={() => run(async () => {
+          await send("/api/monitor-links", "POST", form)
+          setForm({ name: "", url: "", product: "pve" })
+        })}><Plus className="mr-2 h-4 w-4" />{t("monitorLinks.add")}</Button>
+      </div>
+
+      {error && <p role="alert" className="text-sm text-red-500">{error}</p>}
+
+      <div className="space-y-3">
+        {data?.links.length === 0 && <p className="text-sm text-muted-foreground">{t("monitorLinks.empty")}</p>}
+        {data?.links.map(link => {
+          const address = addresses[link.key] ?? (link.manual || link.custom_url ? link.url || "" : "")
+          return <div key={link.key} className={`space-y-2 rounded-lg border border-border p-3 ${link.hidden ? "opacity-60" : ""}`}>
+            <div className="flex items-center gap-2">
+              <ProductIcon product={link.product} className="h-4 w-4 text-muted-foreground" />
+              <span className="min-w-0 flex-1 truncate font-medium">{link.name}</span>
+              <span className="text-xs text-muted-foreground">{link.manual ? t("monitorLinks.added") : t("monitorLinks.detected")}</span>
+              {!link.manual && <label className="flex items-center gap-2 text-xs text-muted-foreground">
+                {t("monitorLinks.visible")}
+                <Switch checked={!link.hidden} disabled={busy} className="data-[state=checked]:bg-blue-600"
+                  onCheckedChange={checked => run(() => send(`/api/monitor-links/${encodeURIComponent(link.key)}`, "PATCH", { hidden: !checked }))} />
+              </label>}
+              {link.manual && <Button variant="ghost" size="sm" disabled={busy} aria-label={t("monitorLinks.remove")}
+                onClick={() => run(() => send(`/api/monitor-links/${encodeURIComponent(link.key)}`, "DELETE"))}>
+                <Trash2 className="h-4 w-4 text-red-500" />
+              </Button>}
+            </div>
+            <div className="flex gap-2">
+              <Input value={address} disabled={busy} aria-label={t("monitorLinks.address")}
+                placeholder={link.manual ? "" : `${t("monitorLinks.autoAddress")}${link.url ? `: ${link.url}` : ""}`}
+                onChange={event => setAddresses({ ...addresses, [link.key]: event.target.value })} />
+              <Button variant="outline" size="sm" className="h-10" disabled={busy || addresses[link.key] === undefined}
+                onClick={() => run(async () => {
+                  await send(`/api/monitor-links/${encodeURIComponent(link.key)}`, "PATCH", { url: addresses[link.key] })
+                  setAddresses(({ [link.key]: _, ...rest }) => rest)
+                })}>{t("monitorLinks.save")}</Button>
+            </div>
+          </div>
+        })}
+      </div>
+    </DialogContent>
+  </Dialog>
+}
diff --git a/AppImage/components/notification-settings.tsx b/AppImage/components/notification-settings.tsx
index ac9733f1..194d5574 100644
--- a/AppImage/components/notification-settings.tsx
+++ b/AppImage/components/notification-settings.tsx
@@ -1,5 +1,6 @@
 "use client"
 
+import { AppriseServiceHelp } from "./apprise-service-help"
 import { useState, useEffect, useCallback } from "react"
 import { useTheme } from "next-themes"
 import { Card, CardContent, CardDescription, CardHeader, CardTitle } from "./ui/card"
@@ -12,6 +13,7 @@ import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from ".
 import { Dialog, DialogContent, DialogHeader, DialogTitle, DialogDescription } from "./ui/dialog"
 import { fetchApi } from "../lib/api-config"
 import { useT } from "../lib/i18n/provider"
+import { useIsPbs } from "../lib/use-platform"
 import {
   Bell, BellOff, Send, CheckCircle2, XCircle, Loader2,
   AlertTriangle, Info, Settings2, Zap, Eye, EyeOff,
@@ -153,6 +155,8 @@ function validateGotifyUrl(url: string): { error?: string; warning?: string } {
 }
 
 const EVENT_CATEGORIES = ["vm_ct", "backup", "resources", "storage", "network", "security", "cluster", "services", "health", "updates", "hardware", "system", "other"].map(key => ({ key }))
+// Guests, vzdump backups and the cluster do not exist on Proxmox Backup Server.
+const PVE_ONLY_CATEGORIES = new Set(["vm_ct", "backup", "cluster"])
 
 const CHANNEL_TYPES = ["telegram", "gotify", "discord", "email", "pushover", "apprise"] as const
 
@@ -329,6 +333,7 @@ const DEFAULT_CONFIG: NotificationConfig = {
 
 export function NotificationSettings() {
   const t = useT()
+  const isPbs = useIsPbs()
   const { resolvedTheme } = useTheme()
   const [config, setConfig] = useState<NotificationConfig>(DEFAULT_CONFIG)
   const [status, setStatus] = useState<ServiceStatus | null>(null)
@@ -702,7 +707,7 @@ export function NotificationSettings() {
           <Label className="text-[11px] text-muted-foreground">{t("settings.notifications.ui.notificationCategories")}</Label>
         </div>
         <div className="space-y-2">
-          {EVENT_CATEGORIES.filter(cat => cat.key !== "other").map(cat => {
+          {EVENT_CATEGORIES.filter(cat => cat.key !== "other" && !(isPbs && PVE_ONLY_CATEGORIES.has(cat.key))).map(cat => {
             const isEnabled = overrides.categories[cat.key] ?? true
             const isExpanded = expandedCategories.has(`${chName}.${cat.key}`)
             // Hide the LXC update toggle when the user has disabled the
@@ -921,7 +926,7 @@ export function NotificationSettings() {
       const wasEnabled = originalConfig.enabled
       const isNowDisabled = !nextConfig.enabled
 
-      if (wasEnabled && isNowDisabled) {
+      if (wasEnabled && isNowDisabled && !isPbs) {
         try {
           await fetchApi("/api/notifications/proxmox/cleanup-webhook", { method: "POST" })
         } catch {
@@ -1216,8 +1221,10 @@ export function NotificationSettings() {
       setConfig(newConfig)
       setOriginalConfig(newConfig)
 
-      // 2) Auto-configure PVE webhook
-      try {
+      // 2) Auto-configure PVE webhook; PBS has no /etc/pve notifications
+      if (isPbs) {
+        setWebhookSetup({ status: "idle", fallback_commands: [], error: "" })
+      } else try {
         const setup = await fetchApi<{
           configured: boolean
           secret?: string
@@ -2061,6 +2068,7 @@ export function NotificationSettings() {
                     Enable toggle + Test button pattern as the other
                     channels. */}
                 <TabsContent value="apprise" className="space-y-3 pt-2">
+                  <AppriseServiceHelp />
                   <div className="flex items-center justify-between">
                     <div className="flex items-center gap-2">
                       <Label className="text-xs font-medium">{t("settings.notifications.ui.enableApprise")}</Label>
diff --git a/AppImage/components/pbs-datastore-usage.tsx b/AppImage/components/pbs-datastore-usage.tsx
new file mode 100644
index 00000000..944ba340
--- /dev/null
+++ b/AppImage/components/pbs-datastore-usage.tsx
@@ -0,0 +1,112 @@
+"use client"
+
+import { CalendarClock, Database } from "lucide-react"
+import { Badge } from "./ui/badge"
+import { Progress } from "./ui/progress"
+import { formatStorage } from "../lib/utils"
+import { useT } from "../lib/i18n/provider"
+
+export interface PBSDatastore {
+  name: string
+  path?: string
+  total?: number | null
+  used?: number | null
+  avail?: number | null
+  error?: string
+  "backend-type"?: string
+  "estimated-full-date"?: number
+  "gc-status"?: { upid?: string | null; "removed-bytes"?: number; "pending-bytes"?: number }
+}
+
+export function datastorePercent(store: PBSDatastore): number | null {
+  if (store.total == null || store.used == null || store.total <= 0) return null
+  return (store.used / store.total) * 100
+}
+
+// Same thresholds and colours as the PVE storage cards.
+export function usageTone(percent: number): { bar: string; text: string; used: string } {
+  if (percent > 90) return { bar: "[&>div]:bg-red-500", text: "text-red-500", used: "text-red-400" }
+  if (percent > 75) return { bar: "[&>div]:bg-yellow-500", text: "text-yellow-500", used: "text-yellow-400" }
+  return { bar: "[&>div]:bg-blue-500", text: "text-muted-foreground", used: "text-blue-400" }
+}
+
+const gib = (bytes: number) => formatStorage(bytes / 1024 ** 3)
+
+// A datastore without a readable capacity keeps its message: it is never shown as empty.
+export function DatastoreUsageRow({ store, compact = false }: { store: PBSDatastore; compact?: boolean }) {
+  const t = useT()
+  const percent = datastorePercent(store)
+  if (percent == null) {
+    return <div className="space-y-1">
+      <div className="flex items-center justify-between gap-2 text-sm">
+        <span className="font-medium text-foreground truncate">{store.name}</span>
+        <span className="text-xs text-muted-foreground">—</span>
+      </div>
+      <p className="text-xs text-amber-500">{store.error || t("pbs.capacityUnavailable")}</p>
+    </div>
+  }
+  const tone = usageTone(percent)
+  return <div className="space-y-1">
+    <div className="flex items-center justify-between gap-2 text-sm">
+      <span className="font-medium text-foreground truncate">{store.name}</span>
+      <span className={`text-xs font-semibold tabular-nums ${tone.text}`}>{percent.toFixed(1)}%</span>
+    </div>
+    <Progress value={percent} className={`${compact ? "h-1.5" : "h-2"} ${tone.bar}`} />
+    {!compact && <div className="flex justify-between text-xs text-muted-foreground tabular-nums">
+      <span>{gib(store.used!)} / {gib(store.total!)}</span>
+      <span>{t("pbs.free")}: <span className="font-semibold text-green-500">{gib(store.avail ?? store.total! - store.used!)}</span></span>
+    </div>}
+  </div>
+}
+
+// Same layout as the "Proxmox storage" cards of the PVE Monitor.
+export function PBSDatastoreCard({ store }: { store: PBSDatastore }) {
+  const t = useT()
+  const percent = datastorePercent(store)
+  const tone = percent == null ? null : usageTone(percent)
+  const fullDate = store["estimated-full-date"]
+  const type = store["backend-type"] || "datastore"
+  return <div className={`border rounded-lg p-4 ${store.error ? "border-red-500/50 bg-red-500/5" : ""}`}>
+    <div className="flex items-center justify-between gap-2 mb-3">
+      <div className="flex items-center gap-2 md:gap-3 min-w-0">
+        <Database className="h-5 w-5 text-muted-foreground flex-shrink-0" />
+        <h3 className="font-semibold text-base md:text-lg truncate">{store.name}</h3>
+        <Badge className="bg-blue-500/10 text-blue-400 border-blue-500/20">{type}</Badge>
+      </div>
+      <div className="flex items-center gap-2 flex-shrink-0">
+        <Badge className={store.error ? "bg-red-500/10 text-red-500 border-red-500/20" : "bg-green-500/10 text-green-500 border-green-500/20"}>
+          {store.error ? t("storage.status.error") : t("storage.status.active")}
+        </Badge>
+        {percent != null && <span className="text-sm font-medium">{percent.toFixed(2)}%</span>}
+      </div>
+    </div>
+    {percent != null && tone ? (
+      <div className="space-y-2">
+        <Progress value={percent} className={`h-2 ${tone.bar}`} />
+        <div className="grid grid-cols-3 gap-4 text-sm">
+          <div>
+            <p className="text-muted-foreground">{t("storage.total")}</p>
+            <p className="font-medium">{gib(store.total!)}</p>
+          </div>
+          <div>
+            <p className="text-muted-foreground">{t("storage.used")}</p>
+            <p className={`font-medium ${tone.used}`}>{gib(store.used!)}</p>
+          </div>
+          <div>
+            <p className="text-muted-foreground">{t("storage.available")}</p>
+            <p className="font-medium text-green-400">{gib(store.avail ?? store.total! - store.used!)}</p>
+          </div>
+        </div>
+      </div>
+    ) : (
+      <p className="text-sm text-muted-foreground">{store.error || t("storage.capacityNotReported")}</p>
+    )}
+    {(store.path || fullDate !== undefined) && <div className="mt-3 flex flex-wrap items-center gap-x-4 gap-y-1 text-xs text-muted-foreground">
+      {store.path && <span className="font-mono truncate" title={store.path}>{store.path}</span>}
+      {fullDate !== undefined && <span className="flex items-center">
+        <CalendarClock className="mr-1.5 h-3.5 w-3.5" />{t("pbs.estimatedFull")}:
+        <span className="ml-1 font-medium text-foreground">{fullDate > 0 ? new Date(fullDate * 1000).toLocaleDateString() : t("pbs.estimatedFullUnknown")}</span>
+      </span>}
+    </div>}
+  </div>
+}
diff --git a/AppImage/components/pbs-panel.tsx b/AppImage/components/pbs-panel.tsx
new file mode 100644
index 00000000..d71b30a9
--- /dev/null
+++ b/AppImage/components/pbs-panel.tsx
@@ -0,0 +1,247 @@
+"use client"
+
+import { useEffect, useState } from "react"
+import useSWR from "swr"
+import {
+  Activity, ArchiveRestore, Database, DatabaseBackup, Download, ListChecks,
+  RefreshCw, Scissors, Server, Settings2, ShieldCheck, Terminal, Trash2,
+} from "lucide-react"
+import { Card, CardContent, CardHeader, CardTitle } from "./ui/card"
+import { Badge } from "./ui/badge"
+import { Button } from "./ui/button"
+import { Input } from "./ui/input"
+import { Label } from "./ui/label"
+import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from "./ui/select"
+import { PBSDatastoreCard, type PBSDatastore } from "./pbs-datastore-usage"
+import { fetchApi } from "../lib/api-config"
+import { useT } from "../lib/i18n/provider"
+
+interface Connection { id: string; name: string; url: string; token_id: string; fingerprint: string; has_token: boolean }
+interface Connections { local_available: boolean; servers: Connection[] }
+interface Task { upid: string; worker_type?: string; worker_id?: string; starttime?: number; endtime?: number; status?: string }
+interface Job { id: string; store?: string; schedule?: string; "last-run-state"?: string }
+interface PBSStatus {
+  name: string; version: string | null; fetched_at: number; services: Record<string, string>;
+  datastores: PBSDatastore[] | null; tasks: Task[] | null;
+  sync: Job[] | null; verify: Job[] | null; prune: Job[] | null; errors: Record<string, string>;
+}
+
+const emptyForm = { id: "", name: "", url: "", token_id: "", fingerprint: "", token_secret: "" }
+const NEW_CONNECTION = "__new__"
+const badgeTone = {
+  ok: "bg-green-500/10 text-green-500 border-green-500/20",
+  warn: "bg-amber-500/10 text-amber-500 border-amber-500/20",
+  error: "bg-red-500/10 text-red-500 border-red-500/20",
+  running: "bg-blue-500/10 text-blue-500 border-blue-500/20",
+  muted: "bg-muted text-muted-foreground border-border",
+}
+
+const TASK_ICONS: Record<string, typeof Activity> = {
+  backup: DatabaseBackup, reader: ArchiveRestore, verify: ShieldCheck, verificationjob: ShieldCheck,
+  verify_group: ShieldCheck, verify_snapshot: ShieldCheck, prune: Scissors, prunejob: Scissors,
+  garbage_collection: Trash2, sync: RefreshCw, syncjob: RefreshCw, aptupdate: Download,
+  termproxy: Terminal, dircreate: Database, "create-datastore": Database,
+}
+
+// PBS reports "OK", "WARNINGS: n" or the error text; a task without one is still running.
+function taskState(task: Task): keyof typeof badgeTone {
+  if (!task.status) return task.endtime ? "muted" : "running"
+  if (task.status === "OK") return "ok"
+  if (task.status.startsWith("WARNINGS")) return "warn"
+  return "error"
+}
+
+function jobState(state?: string): keyof typeof badgeTone {
+  if (!state) return "muted"
+  if (state === "ok") return "ok"
+  if (state.toLowerCase().startsWith("warn")) return "warn"
+  return "error"
+}
+
+function formatDuration(seconds: number) {
+  if (!Number.isFinite(seconds) || seconds < 0) return "—"
+  if (seconds < 60) return `${Math.round(seconds)}s`
+  const minutes = Math.floor(seconds / 60)
+  if (minutes < 60) return `${minutes}m ${Math.round(seconds % 60)}s`
+  const hours = Math.floor(minutes / 60)
+  return hours < 24 ? `${hours}h ${minutes % 60}m` : `${Math.floor(hours / 24)}d ${hours % 24}h`
+}
+
+// `localOnly` is the PBS host's own Monitor: no connection picker, the
+// header Refresh already reloads the page data.
+export function PBSPanel({ localOnly = false }: { localOnly?: boolean } = {}) {
+  const t = useT()
+  const { data: connections, error: connectionError, mutate: reloadConnections } = useSWR<Connections>(
+    "/api/pbs/servers", url => fetchApi<Connections>(url), { revalidateOnFocus: false })
+  const [selected, setSelected] = useState("")
+  const [manage, setManage] = useState(false)
+  const [form, setForm] = useState(emptyForm)
+  const [busy, setBusy] = useState(false)
+  const [message, setMessage] = useState("")
+  const [error, setError] = useState("")
+  const { data, error: statusError, isLoading, mutate } = useSWR<PBSStatus>(
+    selected ? `/api/pbs/status?server=${encodeURIComponent(selected)}` : null,
+    url => fetchApi<PBSStatus>(url), { refreshInterval: 30000, revalidateOnFocus: false })
+
+  useEffect(() => {
+    if (!connections) return
+    if (selected === "local" && connections.local_available) return
+    if (connections.servers.some(row => row.id === selected)) return
+    setSelected(connections.local_available ? "local" : connections.servers[0]?.id || "")
+  }, [connections, selected])
+
+  const save = async () => {
+    setBusy(true); setError(""); setMessage("")
+    try {
+      const result = await fetchApi<{ id: string }>("/api/pbs/servers", { method: "POST", body: JSON.stringify({
+        ...form, id: form.id || undefined, token_secret: form.token_secret || undefined,
+      }) })
+      await reloadConnections()
+      setSelected(result.id)
+      setForm(emptyForm)
+      setMessage(t("pbs.saved"))
+    } catch (err) { setError(err instanceof Error ? err.message : t("pbs.saveFailed")) }
+    finally { setBusy(false) }
+  }
+
+  const remove = async () => {
+    if (!form.id || !window.confirm(t("pbs.removeConfirm"))) return
+    setBusy(true); setError(""); setMessage("")
+    try {
+      await fetchApi(`/api/pbs/servers/${encodeURIComponent(form.id)}`, { method: "DELETE" })
+      setForm(emptyForm)
+      await reloadConnections()
+    } catch (err) { setError(err instanceof Error ? err.message : t("pbs.saveFailed")) }
+    finally { setBusy(false) }
+  }
+  const now = Date.now() / 1000
+
+  return <div className="space-y-4 md:space-y-6">
+    {!localOnly && <div className="flex flex-wrap items-center gap-3">
+      <h2 className="flex items-center text-2xl font-semibold text-foreground"><Server className="mr-2 h-5 w-5" />{t("pbs.title")}</h2>
+      <Select value={selected || undefined} onValueChange={setSelected}>
+        <SelectTrigger aria-label={t("pbs.server")} className="w-full sm:ml-auto sm:w-56"><SelectValue placeholder={t("pbs.chooseServer")} /></SelectTrigger>
+        <SelectContent>
+          {connections?.local_available && <SelectItem value="local">{t("pbs.local")}</SelectItem>}
+          {connections?.servers.map(row => <SelectItem key={row.id} value={row.id}>{row.name}</SelectItem>)}
+        </SelectContent>
+      </Select>
+      <Button variant="outline" size="sm" disabled={isLoading || !selected} onClick={() => mutate()}>
+        <RefreshCw className={`mr-2 h-4 w-4 ${isLoading ? "animate-spin" : ""}`} />{t("pbs.refresh")}
+      </Button>
+      <Button variant="outline" size="sm" onClick={() => setManage(!manage)}>
+        <Settings2 className="mr-2 h-4 w-4" />{t("pbs.manage")}
+      </Button>
+    </div>}
+    {(connectionError || statusError) && <p role="alert" className="text-sm text-red-500">
+      {String((connectionError || statusError)?.message || t("pbs.loadFailed"))}</p>}
+    {isLoading && <p role="status" className="text-sm text-muted-foreground">{t("pbs.loading")}</p>}
+    {!selected && !connectionError && connections && <p className="text-sm text-muted-foreground">{t("pbs.noServer")}</p>}
+    {manage && !localOnly && <Card>
+      <CardHeader><CardTitle>{t("pbs.manage")}</CardTitle></CardHeader>
+      <CardContent className="space-y-4">
+        <p className="text-sm text-muted-foreground">{t("pbs.permissionsHelp")}</p>
+        <Select value={form.id || NEW_CONNECTION} onValueChange={value => {
+          const row = connections?.servers.find(item => item.id === value)
+          setForm(row ? { ...row, token_secret: "" } : emptyForm)
+        }}>
+          <SelectTrigger aria-label={t("pbs.editConnection")} className="w-full"><SelectValue /></SelectTrigger>
+          <SelectContent>
+            <SelectItem value={NEW_CONNECTION}>{t("pbs.add")}</SelectItem>
+            {connections?.servers.map(row => <SelectItem key={row.id} value={row.id}>{row.name}</SelectItem>)}
+          </SelectContent>
+        </Select>
+        <div className="grid gap-4 md:grid-cols-2">
+          {(["name", "url", "token_id", "token_secret", "fingerprint"] as const).map(field =>
+            <div key={field} className="space-y-2">
+              <Label htmlFor={`pbs-${field}`}>{t(`pbs.${field}`)}</Label>
+              <Input id={`pbs-${field}`} disabled={busy} type={field === "token_secret" ? "password" : field === "url" ? "url" : "text"}
+                autoComplete={field === "token_secret" ? "new-password" : "off"}
+                value={form[field]} onChange={event => setForm({ ...form, [field]: event.target.value })} />
+            </div>)}
+        </div>
+        <p className="text-xs text-muted-foreground">{t("pbs.tlsHelp")}</p>
+        {error && <p role="alert" className="text-sm text-red-500">{error}</p>}
+        {message && <p role="status" className="text-sm text-green-500">{message}</p>}
+        <div className="flex gap-2">
+          <Button disabled={busy} onClick={save}>{busy ? t("pbs.testing") : t("pbs.save")}</Button>
+          {form.id && <Button variant="destructive" disabled={busy} onClick={remove}>{t("pbs.remove")}</Button>}
+        </div>
+      </CardContent>
+    </Card>}
+    {data && <>
+      <div className="flex flex-wrap items-center gap-2 text-sm text-muted-foreground">
+        <span>{data.name} · PBS {data.version || "—"} · {t("pbs.sampled")} {new Date(data.fetched_at * 1000).toLocaleTimeString()}</span>
+        {Object.entries(data.services).map(([service, state]) =>
+          <Badge key={service} variant="outline" className={state === "active" ? badgeTone.ok : badgeTone.error}>{service}: {state}</Badge>)}
+      </div>
+      {Object.entries(data.errors).map(([section, detail]) => <p key={section} role="alert" className="text-sm text-amber-500">{t(`pbs.${section}`)}: {detail}</p>)}
+
+      <Card className="bg-card border-border">
+        <CardHeader><CardTitle className="flex items-center text-foreground"><Database className="mr-2 h-5 w-5" />{t("pbs.datastores")}</CardTitle></CardHeader>
+        <CardContent>
+          {data.datastores?.length === 0 && <p className="text-sm text-muted-foreground">{t("pbs.noDatastores")}</p>}
+          {data.datastores && data.datastores.length > 0 && <div className="space-y-4">
+            {data.datastores.map(store => <PBSDatastoreCard key={store.name} store={store} />)}
+          </div>}
+        </CardContent>
+      </Card>
+
+      <Card className="bg-card border-border">
+        <CardHeader><CardTitle className="flex items-center text-foreground"><Activity className="mr-2 h-5 w-5" />{t("pbs.tasks")}</CardTitle></CardHeader>
+        <CardContent>
+          {data.tasks?.length === 0 && <p className="text-sm text-muted-foreground">{t("pbs.noTasks")}</p>}
+          {data.tasks && data.tasks.length > 0 && <div className="overflow-x-auto"><table className="w-full text-sm">
+            <thead><tr className="border-b border-border text-left text-xs text-muted-foreground">
+              <th className="py-2 pr-3 font-medium">{t("pbs.task")}</th>
+              <th className="py-2 pr-3 font-medium">{t("pbs.started")}</th>
+              <th className="py-2 pr-3 font-medium">{t("pbs.duration")}</th>
+              <th className="py-2 font-medium">{t("pbs.status")}</th>
+            </tr></thead>
+            <tbody>{data.tasks.map(row => {
+              const Icon = TASK_ICONS[row.worker_type || ""] || Activity
+              const state = taskState(row)
+              const end = row.endtime ?? (state === "running" ? now : undefined)
+              return <tr key={row.upid} className="border-b border-border/60 last:border-0">
+                <td className="py-2 pr-3"><span className="flex items-center gap-2">
+                  <Icon className="h-4 w-4 shrink-0 text-muted-foreground" />
+                  <span className="text-foreground">{row.worker_type}</span>
+                  {row.worker_id && <span className="truncate text-muted-foreground">{row.worker_id}</span>}
+                </span></td>
+                <td className="whitespace-nowrap py-2 pr-3 tabular-nums text-muted-foreground">{row.starttime ? new Date(row.starttime * 1000).toLocaleString() : "—"}</td>
+                <td className="whitespace-nowrap py-2 pr-3 tabular-nums text-muted-foreground">{row.starttime && end ? formatDuration(end - row.starttime) : "—"}</td>
+                <td className="py-2"><Badge variant="outline" className={`${badgeTone[state]} max-w-[16rem] truncate`} title={row.status}>
+                  {state === "running" ? t("pbs.running") : row.status || "—"}
+                </Badge></td>
+              </tr>
+            })}</tbody>
+          </table></div>}
+        </CardContent>
+      </Card>
+
+      <Card className="bg-card border-border">
+        <CardHeader><CardTitle className="flex items-center text-foreground"><ListChecks className="mr-2 h-5 w-5" />{t("pbs.jobs")}</CardTitle></CardHeader>
+        <CardContent>
+          {(() => {
+            const jobs = (["sync", "verify", "prune"] as const).flatMap(kind => (data[kind] || []).map(row => ({ kind, row })))
+            if (jobs.length === 0) return <p className="text-sm text-muted-foreground">{t("pbs.noJobs")}</p>
+            return <div className="overflow-x-auto"><table className="w-full text-sm">
+              <thead><tr className="border-b border-border text-left text-xs text-muted-foreground">
+                <th className="py-2 pr-3 font-medium">{t("pbs.job")}</th>
+                <th className="py-2 pr-3 font-medium">{t("pbs.datastores")}</th>
+                <th className="py-2 pr-3 font-medium">{t("pbs.schedule")}</th>
+                <th className="py-2 font-medium">{t("pbs.status")}</th>
+              </tr></thead>
+              <tbody>{jobs.map(({ kind, row }) => <tr key={`${kind}-${row.id}`} className="border-b border-border/60 last:border-0">
+                <td className="py-2 pr-3"><span className="text-foreground">{t(`pbs.${kind}`)}</span> <span className="text-muted-foreground">· {row.id}</span></td>
+                <td className="py-2 pr-3 text-muted-foreground">{row.store || "—"}</td>
+                <td className="py-2 pr-3 font-mono text-xs text-muted-foreground">{row.schedule || "—"}</td>
+                <td className="py-2"><Badge variant="outline" className={badgeTone[jobState(row["last-run-state"])]}>{row["last-run-state"] || "—"}</Badge></td>
+              </tr>)}</tbody>
+            </table></div>
+          })()}
+        </CardContent>
+      </Card>
+    </>}
+  </div>
+}
diff --git a/AppImage/components/proxmox-dashboard.tsx b/AppImage/components/proxmox-dashboard.tsx
index c09ea165..4b426082 100644
--- a/AppImage/components/proxmox-dashboard.tsx
+++ b/AppImage/components/proxmox-dashboard.tsx
@@ -18,6 +18,8 @@ import { Security } from "./security"
 import { Profile } from "./profile"
 import { About } from "./about"
 import { BackupTab } from "./backup-tab"
+import { PBSPanel } from "./pbs-panel"
+import { MonitorSwitcher } from "./monitor-switcher"
 import { OnboardingCarousel } from "./onboarding-carousel"
 import { HealthStatusModal } from "./health-status-modal"
 import { ReleaseNotesModal, useVersionCheck } from "./release-notes-modal"
@@ -45,7 +47,9 @@ import {
   ClipboardCheck,
   Info,
   DatabaseBackup,
+  Database,
   ChevronDown,
+  Clock,
 } from "lucide-react"
 import Image from "next/image"
 import { ThemeToggle } from "./theme-toggle"
@@ -97,9 +101,34 @@ const _dashboardPrefetchFetcher = (url: string) => fetchApi(url)
 
 export function ProxmoxDashboard() {
   const t = useT()
-  useSWR("/api/apps/custom-links", _dashboardPrefetchFetcher, { revalidateOnFocus: false })
-  useSWR("/api/apps/categories",   _dashboardPrefetchFetcher, { revalidateOnFocus: false })
-  const { order: tabOrder } = useTabOrder()
+  const { data, error } = useSWR<{ product: string }>("/api/platform", url => fetchApi<{ product: string }>(url), { revalidateOnFocus: false })
+  if (!data && !error) return <p role="status" className="p-8">{t("app.loading")}</p>
+  if (data?.product === "pbs") return <PBSDashboard />
+  return <PVEDashboard />
+}
+
+function PVEDashboard() {
+  return <MonitorDashboard product="pve" />
+}
+
+function PBSDashboard() {
+  return <MonitorDashboard product="pbs" />
+}
+
+type Product = "pve" | "pbs"
+type TopTab = TabId | "datastores"
+
+// Proxmox Backup Server has no guests, apps or PVE storage: it keeps the
+// same header, health and administration with its own top-level sections.
+const PBS_TABS: TopTab[] = ["overview", "datastores", "terminal", "admin"]
+
+function MonitorDashboard({ product }: { product: Product }) {
+  const t = useT()
+  const isPbs = product === "pbs"
+  useSWR(isPbs ? null : "/api/apps/custom-links", _dashboardPrefetchFetcher, { revalidateOnFocus: false })
+  useSWR(isPbs ? null : "/api/apps/categories",   _dashboardPrefetchFetcher, { revalidateOnFocus: false })
+  const { order: userTabOrder } = useTabOrder()
+  const tabOrder: TopTab[] = isPbs ? PBS_TABS : userTabOrder
   const [systemStatus, setSystemStatus] = useState<SystemStatus>({
     status: "healthy",
     uptime: "Loading...",
@@ -117,8 +146,8 @@ export function ProxmoxDashboard() {
   // runs post-hydration; the tiny flash is acceptable and matches the
   // pattern next-themes uses for the same reason.
   useEffect(() => {
-    setActiveTab(firstActualTab())
-  }, [])
+    setActiveTab(isPbs ? "overview" : firstActualTab())
+  }, [isPbs])
   const [infoCount, setInfoCount] = useState(0)
   const [updateAvailable, setUpdateAvailable] = useState(false)
   const [showNavigation, setShowNavigation] = useState(true)
@@ -391,6 +420,7 @@ export function ProxmoxDashboard() {
   const getActiveTabLabel = () => {
     switch (activeTab) {
       case "overview":  return t("navigation.overview")
+      case "datastores": return t("pbs.datastores")
       case "apps":      return t("navigation.apps")
       case "vms":       return t("navigation.virtualMachines")
       case "storage":   return t("navigation.storage")
@@ -410,8 +440,9 @@ export function ProxmoxDashboard() {
 
   return (
     <div className="min-h-screen bg-background">
-      <OnboardingCarousel />
-      <ReleaseNotesModal open={showReleaseNotes} onClose={() => setShowReleaseNotes(false)} />
+      {/* Both describe the PVE Monitor. */}
+      {!isPbs && <OnboardingCarousel />}
+      {!isPbs && <ReleaseNotesModal open={showReleaseNotes} onClose={() => setShowReleaseNotes(false)} />}
 
       {!isServerConnected && (
         <div className="bg-red-500/10 border-b border-red-500/20 px-6 py-3">
@@ -464,22 +495,17 @@ export function ProxmoxDashboard() {
               </div>
               <div className="min-w-0">
                 <h1 className="text-lg md:text-xl font-semibold text-foreground truncate">{t("app.title")}</h1>
-                <p className="text-xs md:text-sm text-muted-foreground">{t("app.description")}</p>
+                <p className="text-xs md:text-sm text-muted-foreground">{t(isPbs ? "app.descriptionPbs" : "app.description")}</p>
                 <div className="lg:hidden flex items-center gap-1 text-xs text-muted-foreground mt-0.5">
-                  <Server className="h-3 w-3" />
-                  <span className="truncate">{t("status.node", { node: displayServerName })}</span>
+                  <Clock className="h-3 w-3" />
+                  <span className="truncate">{t("status.uptime", { uptime: displayUptime })}</span>
                 </div>
               </div>
             </div>
 
             {/* Desktop Actions */}
             <div className="hidden lg:flex items-center space-x-4">
-              <div className="flex items-center space-x-2">
-                <Server className="h-4 w-4 text-muted-foreground" />
-                <div className="text-sm">
-                  <div className="font-medium text-foreground">{t("status.node", { node: displayServerName })}</div>
-                </div>
-              </div>
+              <MonitorSwitcher nodeName={displayServerName} />
 
               <div className="flex items-center gap-2">
                 <Badge variant="outline" className={statusColor}>
@@ -580,9 +606,7 @@ export function ProxmoxDashboard() {
                 </Badge>
               )}
             </div>
-            <span className="text-xs text-muted-foreground whitespace-nowrap">
-              {t("status.uptime", { uptime: displayUptime })}
-            </span>
+            <MonitorSwitcher nodeName={displayServerName} compact />
           </div>
         </div>
       </header>
@@ -623,7 +647,7 @@ export function ProxmoxDashboard() {
                 { value: "audit",    label: t("navigation.audit"),      Icon: ClipboardCheck, default: false },
                 { value: "settings", label: t("navigation.settings"),   Icon: SettingsIcon, default: false },
                 { value: "about",    label: t("navigation.about"),      Icon: Info,        default: false },
-              ]
+              ].filter(item => !isPbs || item.value !== "audit")
               const activeNodeItem  = NODE_ITEMS.find(i => i.value === activeTab)
               const activeAdminItem = ADMIN_ITEMS.find(i => i.value === activeTab)
               const isNodeActive    = activeNodeItem !== undefined
@@ -689,9 +713,10 @@ export function ProxmoxDashboard() {
                   </DropdownMenuContent>
                 </DropdownMenu>
               )
-              const renderTop = (id: TabId) => {
+              const renderTop = (id: TopTab) => {
                 switch (id) {
                   case "overview": return renderDirect("overview", LayoutDashboard, t("navigation.overview"))
+                  case "datastores": return renderDirect("datastores", Database, t("pbs.datastores"))
                   case "apps":     return renderDirect("apps",     Grid3x3,         t("navigation.apps"))
                   case "vms":      return renderDirect("vms",      Boxes,           t("navigation.virtualMachines"))
                   case "backup":   return renderDirect("backup",   DatabaseBackup,  t("navigation.backup"))
@@ -701,7 +726,7 @@ export function ProxmoxDashboard() {
                 }
               }
               return (
-                <TabsList className="hidden lg:grid w-full grid-cols-7 bg-card border border-border">
+                <TabsList className={`hidden lg:grid w-full ${isPbs ? "grid-cols-4" : "grid-cols-7"} bg-card border border-border`}>
                   {tabOrder.map(renderTop)}
                 </TabsList>
               )
@@ -762,6 +787,7 @@ export function ProxmoxDashboard() {
                       {tabOrder.map((id): React.ReactNode => {
                         switch (id) {
                           case "overview": return btn("overview", LayoutDashboard, t("navigation.overview"))
+                          case "datastores": return btn("datastores", Database, t("pbs.datastores"))
                           case "apps":     return btn("apps",     Grid3x3,         t("navigation.apps"))
                           case "vms":      return btn("vms",      Boxes,           t("navigation.virtualMachines"))
                           case "backup":   return btn("backup",   DatabaseBackup,  t("navigation.backup"))
@@ -777,7 +803,7 @@ export function ProxmoxDashboard() {
                             <React.Fragment key="admin">
                               {btn("logs",     ScrollText,  t("navigation.systemLogs"))}
                               {btn("security", ShieldCheck, t("navigation.security"))}
-                              {btn("audit",    ClipboardCheck, t("navigation.audit"))}
+                              {!isPbs && btn("audit",    ClipboardCheck, t("navigation.audit"))}
                               {btn("settings", SettingsIcon, t("navigation.settings"))}
                               {btn("about",    Info,         t("navigation.about"))}
                             </React.Fragment>
@@ -811,9 +837,16 @@ export function ProxmoxDashboard() {
               5 s / 59 s refresh intervals keep the data fresh in the
               background — reopening the tab is instant. */}
           <TabsContent value="overview" forceMount className="space-y-4 md:space-y-6 mt-0 data-[state=inactive]:hidden">
-            <SystemOverview key={`overview-${componentKey}`} />
+            <SystemOverview key={`overview-${componentKey}`} product={product} />
           </TabsContent>
 
+          {isPbs && (
+            <TabsContent value="datastores" className="space-y-4 md:space-y-6 mt-0">
+              <PBSPanel key={`datastores-${componentKey}`} localOnly />
+            </TabsContent>
+          )}
+
+          {!isPbs && <>
           <TabsContent value="apps" className="space-y-4 md:space-y-6 mt-0">
             <AppsDashboard key={`apps-${componentKey}`} />
           </TabsContent>
@@ -839,11 +872,13 @@ export function ProxmoxDashboard() {
           <TabsContent value="hardware" className="space-y-4 md:space-y-6 mt-0">
             <Hardware key={`hardware-${componentKey}`} />
           </TabsContent>
+          </>}
 
           <TabsContent value="logs" className="space-y-4 md:space-y-6 mt-0">
             <SystemLogs key={`logs-${componentKey}`} />
           </TabsContent>
 
+          {!isPbs && <>
           <TabsContent value="audit" className="space-y-4 md:space-y-6 mt-0">
             <AuditReport key={`audit-${componentKey}`} />
           </TabsContent>
@@ -851,13 +886,14 @@ export function ProxmoxDashboard() {
           <TabsContent value="backup" className="space-y-4 md:space-y-6 mt-0">
             <BackupTab key={`backup-${componentKey}`} />
           </TabsContent>
+          </>}
 
           <TabsContent value="terminal" className="mt-0">
             <TerminalPanel key={`terminal-${componentKey}`} />
           </TabsContent>
 
           <TabsContent value="security" className="space-y-4 md:space-y-6 mt-0">
-            <Security key={`security-${componentKey}`} />
+            <Security key={`security-${componentKey}`} hostType={product} />
           </TabsContent>
 
           {/* Profile tab — not surfaced in the top tabs nav. The only
diff --git a/AppImage/components/security.tsx b/AppImage/components/security.tsx
index 35de9bba..9ad921ca 100644
--- a/AppImage/components/security.tsx
+++ b/AppImage/components/security.tsx
@@ -66,7 +66,7 @@ function validatePasswordStrength(pw: string, t: (key: string) => string): strin
   return null
 }
 
-export function Security() {
+export function Security({ hostType = "pve" }: { hostType?: "pve" | "pbs" } = {}) {
   const { language, t } = useI18n()
   const st = (key: string, params?: Record<string, string | number>) => t(`securityPage.${key}`, params)
   const interfaceTypeLabel = (type: string) =>
@@ -292,9 +292,11 @@ export function Security() {
     checkAuthStatus()
     loadApiTokens()
     loadSslStatus()
-    loadFirewallStatus()
-    loadNetworkInterfaces()
-    loadSecurityTools()
+    if (hostType === "pve") {
+      loadFirewallStatus()
+      loadNetworkInterfaces()
+      loadSecurityTools()
+    }
   }, [])
 
   const loadFirewallStatus = async () => {
@@ -2778,6 +2780,7 @@ ${(report.sections && report.sections.length > 0) ? `
       )}
 
       {/* ── Proxmox VE Security Group ── */}
+      {hostType === "pve" && <>
       <div className="flex items-center gap-3 mt-4">
         <h2 className="text-sm font-semibold uppercase tracking-wider text-orange-500">Proxmox VE</h2>
         <div className="flex-1 h-px bg-orange-500/20" />
@@ -4833,6 +4836,8 @@ ${(report.sections && report.sections.length > 0) ? `
         </div>
       )}
 
+      </>}
+
       <TwoFactorSetup
         open={show2FASetup}
         onClose={() => setShow2FASetup(false)}
diff --git a/AppImage/components/settings.tsx b/AppImage/components/settings.tsx
index a49968f6..37e3edc8 100644
--- a/AppImage/components/settings.tsx
+++ b/AppImage/components/settings.tsx
@@ -16,6 +16,7 @@ import { Input } from "./ui/input"
 import { getNetworkUnit } from "../lib/format-network"
 import { fetchApi } from "../lib/api-config"
 import { SUPPORTED_LANGUAGES, useI18n } from "../lib/i18n/provider"
+import { useIsPbs } from "../lib/use-platform"
 import type { LanguageCode } from "../lib/i18n/languages"
 import { NavTabOrderCard } from "./nav-tab-order-card"
 
@@ -312,6 +313,7 @@ interface NetworkInterface {
 
 export function Settings() {
   const { language, setLanguage, t } = useI18n()
+  const isPbs = useIsPbs()
   const tFallback = (key: string, fallback: string) => {
     const translated = t(key)
     return translated === key ? fallback : translated
@@ -1124,7 +1126,7 @@ export function Settings() {
       </Card>
 
       {/* Navigation Tab Order — user-orderable top-level tabs */}
-      <NavTabOrderCard />
+      {!isPbs && <NavTabOrderCard />}
 
       {/* Network Units Settings */}
       <Card>
@@ -1280,7 +1282,7 @@ export function Settings() {
               
               {/* Per-category rows */}
               <div className="divide-y divide-border/50">
-                {suppressionCategories.map((cat) => {
+                {suppressionCategories.filter(cat => !isPbs || healthCategoryKey(cat) !== "vms").map((cat) => {
                   const IconComp = CATEGORY_ICONS[cat.icon] || HeartPulse
                   const effectiveHours = getEffectiveHours(cat)
                   const isCustomMode = effectiveHours === -2 || (cat.key in customValues)
@@ -1288,7 +1290,8 @@ export function Settings() {
                   const isLong = effectiveHours >= 720 && effectiveHours !== -1 && effectiveHours !== -2
                   const hasChanged = cat.key in pendingChanges && pendingChanges[cat.key] !== cat.hours
                   const selectVal = isCustomMode ? "custom" : getSelectValue(effectiveHours, cat.key)
-                  const catLabel = tFallback(`settings.healthMonitor.categories.${healthCategoryKey(cat)}`, cat.label)
+                  const categoryKey = isPbs && healthCategoryKey(cat) === "services" ? "pbsServices" : healthCategoryKey(cat)
+                  const catLabel = tFallback(`settings.healthMonitor.categories.${categoryKey}`, cat.label)
                   
                   return (
                     <div key={cat.key}>
@@ -1496,6 +1499,7 @@ export function Settings() {
         </CardContent>
       </Card>
 
+      {!isPbs && <>
       {/* Remote Storage Exclusions */}
       <Card>
         <CardHeader>
@@ -1678,6 +1682,7 @@ export function Settings() {
           )}
         </CardContent>
       </Card>
+      </>}
 
       {/* Network Interface Exclusions */}
       <Card>
@@ -1875,6 +1880,7 @@ export function Settings() {
           is re-enabled). */}
       <LxcUpdateDetection />
 
+      {!isPbs && <>
       {/* GitHub API — optional authentication for app upstream checks. */}
       <Card>
         <CardHeader>
@@ -1981,15 +1987,16 @@ export function Settings() {
           )}
         </CardContent>
       </Card>
+      </>}
 
-      {/* Notification Settings */}
-      <NotificationSettings />
+      {/* Notification Settings (PVE only for now) */}
+      {!isPbs && <NotificationSettings />}
 
       {/* Issue #195: snippets storage selector. Only renders when more
           than one storage advertises content=snippets — on a typical
           standalone host with just `local` there's nothing to choose,
           so showing an empty selector would be noise. */}
-      {snippetsCandidates.length > 1 && (
+      {!isPbs && snippetsCandidates.length > 1 && (
         <Card>
           <CardHeader>
             <div className="flex items-center gap-2">
diff --git a/AppImage/components/system-overview.tsx b/AppImage/components/system-overview.tsx
index ab443d42..ecbeeef7 100644
--- a/AppImage/components/system-overview.tsx
+++ b/AppImage/components/system-overview.tsx
@@ -1,10 +1,12 @@
 "use client"
 
 import { useState, useEffect } from "react"
+import useSWR from "swr"
 import { Card, CardContent, CardHeader, CardTitle } from "./ui/card"
 import { Progress } from "./ui/progress"
 import { Badge } from "./ui/badge"
-import { Cpu, MemoryStick, Thermometer, Server, Zap, AlertCircle, HardDrive, Network, ChevronRight } from "lucide-react"
+import { Cpu, MemoryStick, Thermometer, Server, Zap, AlertCircle, HardDrive, Network, ChevronRight, Database } from "lucide-react"
+import { DatastoreUsageRow, type PBSDatastore } from "./pbs-datastore-usage"
 import { NodeMetricsCharts } from "./node-metrics-charts"
 import { NetworkTrafficChart } from "./network-traffic-chart"
 import { TemperatureDetailModal } from "./temperature-detail-modal"
@@ -185,9 +187,17 @@ const getUnitsSettings = (): "Bytes" | "Bits" => {
   return raw && raw.toLowerCase() === "bits" ? "Bits" : "Bytes"
 }
 
-export function SystemOverview() {
+export function SystemOverview({ product = "pve" }: { product?: "pve" | "pbs" } = {}) {
   const t = useT()
   const { language } = useI18n()
+  const isPbs = product === "pbs"
+  // On Proxmox Backup Server the datastores take the place of guests and PVE storage.
+  const { data: pbsStatus, error: pbsError } = useSWR<{ datastores: PBSDatastore[] | null }>(
+    isPbs ? "/api/pbs/status?server=local" : null,
+    (url: string) => fetchApi<{ datastores: PBSDatastore[] | null }>(url),
+    { refreshInterval: 60000, revalidateOnFocus: false },
+  )
+  const datastores = pbsStatus?.datastores ?? null
   const [systemData, setSystemData] = useState<SystemData | null>(null)
   const [vmData, setVmData] = useState<VMData[]>([])
   const [storageData, setStorageData] = useState<StorageData | null>(null)
@@ -212,8 +222,8 @@ export function SystemOverview() {
     const fetchAllData = async () => {
       const [systemResult, vmResult, storageResults, networkResult] = await Promise.all([
         fetchSystemData().finally(() => setLoadingStates((prev) => ({ ...prev, system: false }))),
-        fetchVMData().finally(() => setLoadingStates((prev) => ({ ...prev, vms: false }))),
-        Promise.all([fetchStorageData(), fetchProxmoxStorageData()]).finally(() =>
+        (isPbs ? Promise.resolve([]) : fetchVMData()).finally(() => setLoadingStates((prev) => ({ ...prev, vms: false }))),
+        Promise.all([fetchStorageData(), isPbs ? Promise.resolve(null) : fetchProxmoxStorageData()]).finally(() =>
           setLoadingStates((prev) => ({ ...prev, storage: false })),
         ),
         fetchNetworkData().finally(() => setLoadingStates((prev) => ({ ...prev, network: false }))),
@@ -248,12 +258,13 @@ export function SystemOverview() {
     }, 5000)
 
     const vmInterval = setInterval(async () => {
+      if (isPbs) return
       const data = await fetchVMData()
       setVmData(data)
     }, 59000)
 
     const storageInterval = setInterval(async () => {
-      const [storage, proxmoxStorage] = await Promise.all([fetchStorageData(), fetchProxmoxStorageData()])
+      const [storage, proxmoxStorage] = await Promise.all([fetchStorageData(), isPbs ? Promise.resolve(null) : fetchProxmoxStorageData()])
       if (storage) setStorageData(storage)
       if (proxmoxStorage) setProxmoxStorageData(proxmoxStorage)
     }, 59000)
@@ -278,7 +289,7 @@ export function SystemOverview() {
       clearInterval(networkInterval)
       window.removeEventListener("networkUnitChanged" as any, handleUnitChange)
     }
-  }, [t])
+  }, [t, isPbs])
 
   if (!hasAttemptedLoad || loadingStates.system) {
     return (
@@ -527,7 +538,46 @@ export function SystemOverview() {
           </CardContent>
         </Card>
 
-        {/* ── Active VM & LXC (preview restyle v2: pills mismo tamaño que "X running") ── */}
+        {isPbs ? (
+        <Card className="bg-card border-border">
+          <CardHeader className="flex flex-row items-center justify-between space-y-0 pb-2">
+            <CardTitle className="text-sm font-medium text-muted-foreground">{t("pbs.datastores")}</CardTitle>
+            <Database className="h-4 w-4 text-muted-foreground" />
+          </CardHeader>
+          <CardContent>
+            {!datastores && !pbsError ? (
+              <div className="space-y-2 animate-pulse">
+                <div className="h-10 bg-muted rounded w-20"></div>
+                <div className="h-5 bg-muted rounded w-32"></div>
+              </div>
+            ) : !datastores ? (
+              <p className="text-sm text-amber-500">{t("pbs.loadFailed")}</p>
+            ) : datastores.length === 0 ? (
+              <p className="text-sm text-muted-foreground">{t("pbs.noDatastores")}</p>
+            ) : (
+              <div className="space-y-3">
+                <div className="flex items-end justify-between">
+                  <span className="text-4xl font-bold leading-none text-foreground">{datastores.length}</span>
+                  {datastores.some(store => store.error) ? (
+                    <Badge variant="outline" className="bg-amber-500/10 text-amber-500 border-amber-500/20">
+                      {t("pbs.datastoresUnavailable", { count: datastores.filter(store => store.error).length })}
+                    </Badge>
+                  ) : (
+                    <Badge variant="outline" className="bg-green-500/10 text-green-500 border-green-500/20">
+                      {t("pbs.datastoresOnline")}
+                    </Badge>
+                  )}
+                </div>
+                {datastores.slice(0, 2).map(store => <DatastoreUsageRow key={store.name} store={store} compact />)}
+                {datastores.length > 2 && (
+                  <p className="text-xs text-muted-foreground">{t("pbs.moreDatastores", { count: datastores.length - 2 })}</p>
+                )}
+              </div>
+            )}
+          </CardContent>
+        </Card>
+        ) : (
+        /* ── Active VM & LXC (preview restyle v2: pills mismo tamaño que "X running") ── */
         <Card className="bg-card border-border">
           <CardHeader className="flex flex-row items-center justify-between space-y-0 pb-2">
             <CardTitle className="text-sm font-medium text-muted-foreground">{t("overview.activeVmLxc")}</CardTitle>
@@ -565,6 +615,7 @@ export function SystemOverview() {
             )}
           </CardContent>
         </Card>
+        )}
 
         <Card 
           className={`bg-card border-border ${systemData.temperature > 0 ? "cursor-pointer hover:bg-white/5 transition-colors" : ""}`}
@@ -708,7 +759,16 @@ export function SystemOverview() {
                   </div>
                 </div>
 
-                {vmLxcStorages && vmLxcStorages.length > 0 ? (
+                {isPbs ? (
+                  <div className="space-y-3">
+                    <div className="text-xs font-medium text-muted-foreground mb-2">{t("pbs.datastores")}</div>
+                    {!datastores ? (
+                      <div className="text-center py-4 text-muted-foreground text-sm">{pbsError ? t("pbs.loadFailed") : t("pbs.loading")}</div>
+                    ) : datastores.length === 0 ? (
+                      <div className="text-center py-4 text-muted-foreground text-sm">{t("pbs.noDatastores")}</div>
+                    ) : datastores.map(store => <DatastoreUsageRow key={store.name} store={store} />)}
+                  </div>
+                ) : vmLxcStorages && vmLxcStorages.length > 0 ? (
                   <div className="space-y-2 pb-3 border-b border-border">
                     <div className="text-xs font-medium text-muted-foreground mb-2">{t("overview.vmLxcStorage")}</div>
                     <div className="flex justify-between items-center">
@@ -744,7 +804,7 @@ export function SystemOverview() {
                   </div>
                 )}
 
-                {localStorage && (
+                {!isPbs && localStorage && (
                   <div className="space-y-2">
                     <div className="text-xs font-medium text-muted-foreground mb-2">{t("overview.localStorageSystem")}</div>
                     <div className="flex justify-between items-center">
@@ -899,7 +959,7 @@ export function SystemOverview() {
               <span className="text-foreground">{formatSystemUptime(systemData.uptime)}</span>
             </div>
             <div className="flex justify-between">
-              <span className="text-muted-foreground">{t("overview.proxmoxVersion")}</span>
+              <span className="text-muted-foreground">{t(isPbs ? "overview.pbsVersion" : "overview.proxmoxVersion")}</span>
               <span className="text-foreground">{systemData.proxmox_version || t("app.notAvailable")}</span>
             </div>
             <div className="flex justify-between">
diff --git a/AppImage/components/virtual-machines.tsx b/AppImage/components/virtual-machines.tsx
index 901655d4..a03b5685 100644
--- a/AppImage/components/virtual-machines.tsx
+++ b/AppImage/components/virtual-machines.tsx
@@ -11,7 +11,7 @@ import { Badge } from "./ui/badge"
 import { Progress } from "./ui/progress"
 import { Button } from "./ui/button"
 import { Dialog, DialogContent, DialogHeader, DialogTitle, DialogFooter, DialogDescription } from "./ui/dialog"
-import { Server, Play, Square, Cpu, MemoryStick, HardDrive, Network, Power, RotateCcw, StopCircle, Container, ChevronDown, ChevronUp, ChevronRight, Terminal, Archive, Plus, PlusCircle, Loader2, Clock, Database, Shield, Bell, FileText, Settings2, Activity, Package, RefreshCw, EthernetPort, ArrowUpCircle, Info, CheckCircle2, EyeOff, Eye, Trash2, Check, X, AlertTriangle, AlertCircle, Search, Pin, Tag as TagIcon } from 'lucide-react'
+import { Server, Play, Square, Cpu, MemoryStick, HardDrive, Network, Power, RotateCcw, StopCircle, Container, ChevronDown, ChevronUp, ChevronRight, Terminal, Archive, Plus, PlusCircle, Loader2, Database, Shield, FileText, Settings2, Activity, Package, RefreshCw, EthernetPort, ArrowUpCircle, Info, CheckCircle2, EyeOff, Eye, Trash2, Check, X, AlertTriangle, AlertCircle, Search, Pin, Tag as TagIcon } from 'lucide-react'
 import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from "./ui/select"
 import { Checkbox } from "./ui/checkbox"
 import { Switch } from "./ui/switch"
@@ -23,6 +23,8 @@ import { MetricsView } from "./metrics-dialog"
 import { LxcTerminalModal } from "./lxc-terminal-modal"
 import { ScriptTerminalModal } from "./script-terminal-modal"
 import { LxcAppPanel, ThemeAwareLogo, ociImageLabel } from "./lxc-app-panel"
+import { GuestBackupList } from "./guest-backup-list"
+import type { GuestBackup } from "../lib/guest-backup-archives"
 import { OciConsoleLogPanel } from "./oci-console-log-panel"
 import { AppUpdaterEditor, type AppUpdateMethod } from "./app-updater-editor"
 import { formatStorage } from "../lib/utils"
@@ -399,16 +401,7 @@ interface BackupStorage {
   avail_human?: string
 }
 
-interface VMBackup {
-  volid: string
-  storage: string
-  type: string
-  size: number
-  size_human: string
-  timestamp: number
-  date: string
-  notes?: string
-}
+type VMBackup = GuestBackup
 
 // Sprint 13.29: shape returned by /api/lxc/<vmid>/mount-points. Lives
 // next to VMBackup since both are LXC-modal data structures.
@@ -970,7 +963,6 @@ export function VirtualMachines() {
   const [showBackupModal, setShowBackupModal] = useState(false)
   const [backupMode, setBackupMode] = useState<string>("snapshot")
   const [backupProtected, setBackupProtected] = useState(false)
-  const [backupNotification, setBackupNotification] = useState<string>("auto")
   const [backupNotes, setBackupNotes] = useState<string>("{{guestname}}")
   const [backupPbsChangeMode, setBackupPbsChangeMode] = useState<string>("default")
   
@@ -1615,7 +1607,7 @@ export function VirtualMachines() {
     }
   }
 
-  const fetchVmBackups = async (vmid: number) => {
+  const fetchVmBackups = async (vmid: number, force = false) => {
     // Stale-while-revalidate with a 6-hour freshness gate.
     //
     // 1. If we already have backups (bulk hydration or a previous
@@ -1632,15 +1624,16 @@ export function VirtualMachines() {
     // 3. Loading spinner only on the true first load.
     const GATE_MS = 6 * 60 * 60 * 1000
     const seed = vmModalCacheRef.current.backups.get(vmid)
-    const isStale = !seed || (Date.now() - seed.fetchedAt) > GATE_MS
+    const isStale = force || !seed || (Date.now() - seed.fetchedAt) > GATE_MS
     if (!seed) setLoadingBackups(true)
     try {
       const url = isStale
         ? `/api/vms/${vmid}/backups?fresh=1`
         : `/api/vms/${vmid}/backups`
-      const response = await fetchApi<{ backups?: VMBackup[] }>(url)
+      const response = await fetchApi<{ backups?: VMBackup[]; error?: string }>(url)
+      if (response.error || !Array.isArray(response.backups)) throw new Error(response.error || "Backup inventory unavailable")
       if (response.backups) {
-        setVmBackups(response.backups)
+        if (selectedVMRef.current?.vmid === vmid) setVmBackups(response.backups)
         vmModalCacheRef.current.backups.set(vmid, { backups: response.backups, fetchedAt: Date.now() })
       }
     } catch (error) {
@@ -1648,9 +1641,10 @@ export function VirtualMachines() {
       // Only clear the visible list if we had nothing to show
       // in the first place — a transient network hiccup must not
       // wipe the stale-but-useful view the user is looking at.
-      if (!seed) setVmBackups([])
+      if (!seed && selectedVMRef.current?.vmid === vmid) setVmBackups([])
+      if (force) throw error
     } finally {
-      if (!seed) setLoadingBackups(false)
+      if (!seed && selectedVMRef.current?.vmid === vmid) setLoadingBackups(false)
     }
   }
 
@@ -1703,7 +1697,6 @@ export function VirtualMachines() {
     // Reset modal to defaults
     setBackupMode("snapshot")
     setBackupProtected(false)
-    setBackupNotification("auto")
     setBackupNotes("{{guestname}}")
     setBackupPbsChangeMode("default")
     // Auto-select first storage if none selected
@@ -1727,7 +1720,6 @@ export function VirtualMachines() {
           mode: backupMode,
           compress: "zstd",
           protected: backupProtected,
-          notification: backupNotification,
           notes: backupNotes,
           pbs_change_detection: backupPbsChangeMode
         }),
@@ -1884,40 +1876,6 @@ export function VirtualMachines() {
     setTerminalOpen(true)
   }
   
-const handleDownloadLogs = async (vmid: number, vmName: string) => {
-    try {
-      const data = await fetchApi(`/api/vms/${vmid}/logs`)
-
-      // Format logs as plain text
-      let logText = `=== ${t("vmLxc.logs.header", { name: vmName, vmid })} ===\n`
-      logText += `${t("vmLxc.logs.node")}: ${data.node}\n`
-      logText += `${t("vmLxc.logs.type")}: ${data.type}\n`
-      logText += `${t("vmLxc.logs.totalLines")}: ${data.log_lines}\n`
-      logText += `${t("vmLxc.logs.generated")}: ${new Date().toISOString()}\n`
-      logText += `\n${"=".repeat(80)}\n\n`
-
-      if (data.logs && Array.isArray(data.logs)) {
-        data.logs.forEach((log: any) => {
-          if (typeof log === "object" && log.t) {
-            logText += `${log.t}\n`
-          } else if (typeof log === "string") {
-            logText += `${log}\n`
-          }
-        })
-      }
-
-      const blob = new Blob([logText], { type: "text/plain" })
-      const url = URL.createObjectURL(blob)
-      const a = document.createElement("a")
-      a.href = url
-      a.download = `${vmName}-${vmid}-logs.txt`
-      a.click()
-      URL.revokeObjectURL(url)
-    } catch (error) {
-      console.error("Error downloading logs:", error)
-    }
-  }
-
   const getStatusColor = (status: string) => {
     switch (status) {
       case "running":
@@ -2868,8 +2826,7 @@ const handleDownloadLogs = async (vmid: number, vmName: string) => {
     onClick?: () => void,
   ) => {
     if (!uc) return null
-    const stale = uc.stale === true || (!!uc.last_check && isLxcUpdateStale(uc))
-    if (!stale && (!uc.available || !uc.count || uc.count <= 0)) return null
+    if (!uc.available || !uc.count || uc.count <= 0) return null
     const last = uc.last_check
       ? new Date(uc.last_check).toLocaleString()
       : "—"
@@ -2917,8 +2874,8 @@ const handleDownloadLogs = async (vmid: number, vmName: string) => {
             space — matters most on the LXC card row where uptime,
             IP and other chips compete for width. Count alone with
             the up-arrow reads unambiguously as "pending updates". */}
-        {stale ? <Clock className={iconSize} /> : <ArrowUpCircle className={iconSize} />}
-        {stale ? t("vmLxc.updates.checkStale") : uc.count}
+        <ArrowUpCircle className={iconSize} />
+        {uc.count}
         {/* Chevron only when the badge is wired up as a clickable
             shortcut — its absence on the dashboard card avoids
             implying interactivity where there isn't any (the whole
@@ -7460,7 +7417,7 @@ const handleDownloadLogs = async (vmid: number, vmName: string) => {
                 )}
 
                 {/* Backups Tab */}
-                {activeModalTab === "backups" && (
+                {activeModalTab === "backups" && selectedVM && (
                   /* Backups tab layout: the Card fills the whole tab
                      body so the backup list can scroll inside its
                      bordered card instead of leaving empty space
@@ -7495,48 +7452,17 @@ const handleDownloadLogs = async (vmid: number, vmName: string) => {
                         {/* Divider */}
                         <div className="border-t border-border/50 mb-4 shrink-0" />
 
-                        {/* Backup List */}
-                        <div className="flex items-center justify-between mb-3 shrink-0">
-                          <span className="text-xs text-muted-foreground">{t("vmLxc.backups.available")}</span>
-                          <Badge variant="secondary" className="text-xs h-5">{vmBackups.length}</Badge>
-                        </div>
-
-                        {loadingBackups ? (
-                          <div className="flex-1 flex items-center justify-center text-muted-foreground min-h-0">
-                            <Loader2 className="h-4 w-4 animate-spin mr-2" />
-                            <span className="text-sm">{t("vmLxc.backups.loading")}</span>
-                          </div>
-                        ) : vmBackups.length === 0 ? (
-                          <div className="flex-1 flex flex-col items-center justify-center text-muted-foreground min-h-0">
-                            <Archive className="h-12 w-12 mb-3 opacity-30" />
-                            <span className="text-sm">{t("vmLxc.backups.empty")}</span>
-                            <span className="text-xs mt-1">{t("vmLxc.backups.emptyHint")}</span>
-                          </div>
-                        ) : (
-                          <div className="space-y-2 flex-1 overflow-y-auto min-h-0 pr-1 -mr-1">
-                            {vmBackups.map((backup, index) => (
-                              <div 
-                                key={`backup-${backup.volid}-${index}`}
-                                className="flex items-center justify-between p-3 rounded-lg bg-muted/30 hover:bg-muted/50 transition-colors"
-                              >
-                                <div className="flex items-center gap-2 flex-1 min-w-0">
-                                  <div className="w-2 h-2 rounded-full bg-green-500 flex-shrink-0" />
-                                  <Clock className="h-4 w-4 text-muted-foreground flex-shrink-0" />
-                                  <span className="text-sm text-foreground">{backup.date}</span>
-                                  <Badge 
-                                    variant="outline" 
-                                    className={`text-xs ml-auto flex-shrink-0 ${getStorageColor(backup.storage).bg} ${getStorageColor(backup.storage).text} ${getStorageColor(backup.storage).border}`}
-                                  >
-                                    {backup.storage}
-                                  </Badge>
-                                </div>
-                                <Badge variant="outline" className="font-mono ml-2 flex-shrink-0">
-                                  {backup.size_human}
-                                </Badge>
-                              </div>
-                            ))}
-                          </div>
-                        )}
+                        <GuestBackupList
+                          key={selectedVM.vmid}
+                          vmid={selectedVM.vmid}
+                          backups={vmBackups}
+                          loading={loadingBackups}
+                          onRefresh={async () => {
+                            vmModalCacheRef.current.backups.delete(selectedVM.vmid)
+                            await fetchVmBackups(selectedVM.vmid, true)
+                          }}
+                          storageColor={getStorageColor}
+                        />
                       </CardContent>
                     </Card>
                   </div>
@@ -7889,25 +7815,6 @@ const handleDownloadLogs = async (vmid: number, vmName: string) => {
               </div>
             </div>
             
-            {/* Notification Row */}
-            <div className="space-y-2">
-                <Label className="text-sm flex items-center gap-1.5">
-                  <Bell className="h-3.5 w-3.5" />
-                  {t("vmLxc.backupModal.notification")}
-                </Label>
-              <Select value={backupNotification} onValueChange={setBackupNotification}>
-                <SelectTrigger className="bg-background">
-                  <SelectValue />
-                </SelectTrigger>
-                <SelectContent>
-                  <SelectItem value="auto">{t("vmLxc.backupModal.useGlobalSettings")}</SelectItem>
-                  <SelectItem value="always">{t("vmLxc.backupModal.alwaysNotify")}</SelectItem>
-                  <SelectItem value="failure">{t("vmLxc.backupModal.notifyOnFailure")}</SelectItem>
-                  <SelectItem value="never">{t("vmLxc.backupModal.neverNotify")}</SelectItem>
-                </SelectContent>
-              </Select>
-            </div>
-            
             {/* Protected Checkbox */}
             <div className="flex items-center space-x-2">
               <Checkbox 
diff --git a/AppImage/components/vm-backup-jobs.tsx b/AppImage/components/vm-backup-jobs.tsx
index b4054300..972c187d 100644
--- a/AppImage/components/vm-backup-jobs.tsx
+++ b/AppImage/components/vm-backup-jobs.tsx
@@ -21,6 +21,7 @@ import {
 import { fetchApi } from "../lib/api-config"
 import { cancelButtonClass } from "../lib/utils"
 import { useT } from "../lib/i18n/provider"
+import { RETENTION, parseRetention, buildRetention } from "../lib/backup-retention"
 
 interface VmBackupJob {
   id: string
@@ -70,24 +71,6 @@ const EMPTY_FORM: FormState = {
   mode: "snapshot", compress: "zstd", retention: {}, keepAll: false, notes: "{{guestname}}", attached: [],
 }
 
-// The limits a job can keep, in the order Proxmox lists them.
-const RETENTION = ["last", "hourly", "daily", "weekly", "monthly", "yearly"] as const
-
-const parseRetention = (prune: string) => {
-  const fields: Record<string, string> = {}
-  let keepAll = false
-  for (const part of prune.split(",")) {
-    const [key, value] = part.trim().split("=")
-    if (key === "keep-all") keepAll = value === "1"
-    else if (key?.startsWith("keep-") && Number(value) > 0) fields[key.slice(5)] = String(Number(value))
-  }
-  return { fields, keepAll }
-}
-
-const buildRetention = (fields: Record<string, string>, keepAll: boolean) => {
-  const parts = RETENTION.filter((key) => Number(fields[key]) > 0).map((key) => `keep-${key}=${Number(fields[key])}`)
-  return parts.length ? parts.join(",") : keepAll ? "keep-all=1" : ""
-}
 
 const isOn = (value: unknown) => value === 1 || value === true || value === "1"
 const jobEnabled = (job: VmBackupJob) => job.enabled === undefined || isOn(job.enabled)
diff --git a/AppImage/lib/backup-retention.ts b/AppImage/lib/backup-retention.ts
new file mode 100644
index 00000000..7caa7686
--- /dev/null
+++ b/AppImage/lib/backup-retention.ts
@@ -0,0 +1,18 @@
+// Native Proxmox retention properties, shared by storage and job editors.
+export const RETENTION = ["last", "hourly", "daily", "weekly", "monthly", "yearly"] as const
+
+export function parseRetention(prune: string) {
+  const fields: Record<string, string> = {}
+  let keepAll = false
+  for (const part of prune.split(",")) {
+    const [key, value] = part.trim().split("=")
+    if (key === "keep-all") keepAll = value === "1"
+    else if (key?.startsWith("keep-") && Number(value) > 0) fields[key.slice(5)] = String(Number(value))
+  }
+  return { fields, keepAll }
+}
+
+export function buildRetention(fields: Record<string, string>, keepAll: boolean) {
+  const parts = RETENTION.filter(key => Number(fields[key]) > 0).map(key => `keep-${key}=${Number(fields[key])}`)
+  return parts.length ? parts.join(",") : keepAll ? "keep-all=1" : ""
+}
diff --git a/AppImage/lib/guest-backup-archives.ts b/AppImage/lib/guest-backup-archives.ts
new file mode 100644
index 00000000..68dceb18
--- /dev/null
+++ b/AppImage/lib/guest-backup-archives.ts
@@ -0,0 +1,55 @@
+import { fetchApi } from './api-config'
+
+export interface GuestBackup {
+  volid: string
+  storage: string
+  type: string
+  size: number
+  size_human: string
+  timestamp: number
+  date: string
+  notes?: string
+  protected?: boolean
+}
+
+export interface BackupDeletionResult {
+  volid: string
+  status: 'deleted' | 'pending' | 'unconfirmed'
+  task?: string
+  error?: string
+}
+
+// Exposed separately so callers can invalidate their inventory even after a
+// lost POST response. Never retry the destructive request automatically.
+export async function deleteGuestBackups(vmid: number, backups: GuestBackup[]): Promise<BackupDeletionResult[]> {
+  const response = await fetchApi<{ results: BackupDeletionResult[] }>(`/api/vms/${vmid}/backups/delete`, {
+    method: 'POST',
+    body: JSON.stringify({ confirm: true, backups: backups.map(({ volid, storage }) => ({ volid, storage })) }),
+    // Up to 20 archives, checked first and then deleted four at a time.
+    signal: AbortSignal.timeout(300_000),
+  })
+  if (!Array.isArray(response.results) || response.results.length !== backups.length ||
+      response.results.some((result, index) => result.volid !== backups[index].volid ||
+        !['deleted', 'pending', 'unconfirmed'].includes(result.status))) throw new Error('deletionUnconfirmed')
+
+  return Promise.all(response.results.map(async result => {
+    if (result.status !== 'pending' || !result.task) return result
+    const deadline = Date.now() + 120_000
+    let failures = 0
+    while (Date.now() < deadline) {
+      await new Promise(resolve => setTimeout(resolve, 1500))
+      try {
+        const status = await fetchApi<BackupDeletionResult>(
+          `/api/vms/${vmid}/backups/delete-status?task=${encodeURIComponent(result.task!)}`,
+          { signal: AbortSignal.timeout(10_000) },
+        )
+        if (status.volid !== result.volid || !['deleted', 'pending', 'unconfirmed'].includes(status.status)) break
+        if (status.status !== 'pending') return status
+        failures = 0
+      } catch {
+        if (++failures >= 3) break
+      }
+    }
+    return { ...result, status: 'unconfirmed', error: 'deletionUnconfirmed' }
+  }))
+}
diff --git a/AppImage/lib/use-platform.ts b/AppImage/lib/use-platform.ts
new file mode 100644
index 00000000..cbb99cc6
--- /dev/null
+++ b/AppImage/lib/use-platform.ts
@@ -0,0 +1,8 @@
+import useSWR from "swr"
+import { fetchApi } from "./api-config"
+
+// Shares the dashboard's /api/platform request through the SWR cache.
+export function useIsPbs(): boolean {
+  const { data } = useSWR<{ product: string }>("/api/platform", (url: string) => fetchApi<{ product: string }>(url), { revalidateOnFocus: false })
+  return data?.product === "pbs"
+}
diff --git a/AppImage/messages/de/common.json b/AppImage/messages/de/common.json
index 8cffea48..78a78171 100644
--- a/AppImage/messages/de/common.json
+++ b/AppImage/messages/de/common.json
@@ -8,7 +8,8 @@
     "unknown": "Unbekannt",
     "notAvailable": "N/A",
     "serverOffline": "Server offline",
-    "supportProject": "Unterstützen Sie das Projekt und tragen Sie dazu bei"
+    "supportProject": "Unterstützen Sie das Projekt und tragen Sie dazu bei",
+    "descriptionPbs": "Proxmox Backup Server Dashboard"
   },
   "common": {
     "notAvailable": "N/A",
@@ -165,7 +166,8 @@
     },
     "runningCountOne": "{count} läuft",
     "runningCountFew": "{count} laufen",
-    "runningCountMany": "{count} laufen"
+    "runningCountMany": "{count} laufen",
+    "pbsVersion": "PBS-Version:"
   },
   "storage": {
     "loadingTitle": "Speicherdaten werden geladen...",
@@ -1110,7 +1112,21 @@
       "available": "Verfügbare Backups",
       "loading": "Backups werden geladen...",
       "empty": "Keine Backups gefunden",
-      "emptyHint": "Erstellen Sie Ihr erstes Backup über die Schaltfläche oben"
+      "emptyHint": "Erstellen Sie Ihr erstes Backup über die Schaltfläche oben",
+      "refresh": "Aktualisieren",
+      "refreshFailed": "Sicherungen konnten nicht aktualisiert werden. Aktualisieren Sie erneut, um ihren aktuellen Zustand zu bestätigen.",
+      "deleteSelected": "Ausgewählte löschen ({count})",
+      "deletedCount": "{count} Sicherung(en) gelöscht.",
+      "unconfirmedCount": "Die Löschung von {count} Sicherung(en) wurde nicht bestätigt. Aktualisieren Sie die Liste und prüfen Sie die Proxmox-Aufgaben, bevor Sie es erneut versuchen.",
+      "deleteFailed": "Die Löschung konnte nicht bestätigt werden. Aktualisieren Sie die Liste und prüfen Sie die Proxmox-Aufgaben, bevor Sie es erneut versuchen.",
+      "selectHint": "Ungeschützte Sicherungen auswählen (bis zu 20 pro Durchgang)",
+      "selectBackup": "Sicherung auswählen",
+      "protected": "Geschützt",
+      "confirmTitle": "{count} Sicherung(en) löschen?",
+      "confirmDescription": "Diese Sicherungsarchive für VM/CT {vmid} werden dauerhaft gelöscht. Geschützte Sicherungen sind ausgeschlossen. Der Gast wird dadurch nicht gelöscht.",
+      "deleting": "Warten, bis Proxmox die ausgewählten Archive gelöscht hat…",
+      "cancel": "Abbrechen",
+      "confirmDelete": "Sicherungen löschen"
     },
     "updatesPanel": {
       "pendingTitle": "Ausstehende Paketaktualisierungen",
@@ -1721,7 +1737,17 @@
       "portCategoryCustomPlaceholder": "Geben Sie eine Kategorie ein und drücken Sie Enter (Esc zum Abbrechen)",
       "portCustomUrlPlaceholder": "Benutzerdefinierte URL (z. B. https://vault.example.com) überschreibt IP:port",
       "stackMemberTitle": "Teil einer Multi-Container-Anwendung",
-      "stackMemberBody": "Dieser Container gehört zu einer Anwendung, deren Hauptcontainer {primary} ist. Die Anwendung, ihre Weblinks und ihre Version werden dort angezeigt."
+      "stackMemberBody": "Dieser Container gehört zu einer Anwendung, deren Hauptcontainer {primary} ist. Die Anwendung, ihre Weblinks und ihre Version werden dort angezeigt.",
+      "nativeEvidencePort": "Lauschender TCP-Port",
+      "nativeEvidenceFile": "Installierte Datei",
+      "nativeEvidenceProcess": "Laufende ausführbare Datei",
+      "nativeEvidenceDirectory": "Arbeitsverzeichnis",
+      "nativeEvidenceService": "Dienstdefinition",
+      "nativeScanFailed": "Die Anwendungssuche konnte nicht abgeschlossen werden. Frühere Ergebnisse sind möglicherweise veraltet; versuchen Sie es erneut.",
+      "nativeScanPartial": "Die Anwendungssuche ist unvollständig. Prüfen Sie die gefundenen Hinweise und versuchen Sie es erneut.",
+      "nativeVersionUnknown": "Installierte Version unbekannt",
+      "nativeEvidenceStale": "Die Hinweise sind möglicherweise veraltet oder unvollständig.",
+      "nativeRegisterOnly": "Bestätigen Sie die Registrierung im Editor. Eine bekannte Version wird als manueller Wert gespeichert; es wird kein Updater eingerichtet."
     },
     "statusFilter": {
       "ariaLabel": "Virtuelle Maschinen und Container filtern",
@@ -1817,7 +1843,8 @@
         "logs": "Systemprotokolle",
         "updates": "Systemaktualisierungen",
         "security": "Sicherheit & Zertifikate",
-        "temperature": "Temperatur"
+        "temperature": "Temperatur",
+        "pbsServices": "PBS Services"
       }
     },
     "remoteStorage": {
@@ -2078,7 +2105,7 @@
         "webhookUrl": "Webhook-URL",
         "enableEmail": "E-Mail aktivieren",
         "smtpHost": "SMTP-Host",
-        "port": "Hafen",
+        "port": "Port",
         "tlsMode": "TLS-Modus",
         "noTls": "Keine (Port 25)",
         "username": "Benutzername",
@@ -2111,7 +2138,13 @@
         "inactiveFooter": "Aktivieren Sie Benachrichtigungen, um System-, Gesundheits- und Sicherheitswarnungen über die konfigurierten Kanäle zu erhalten.",
         "notificationLanguage": "Benachrichtigungssprache",
         "selectNotificationLanguage": "Benachrichtigungssprache auswählen",
-        "notificationLanguageHint": "Wird für deterministische Laufzeitbenachrichtigungen verwendet, auch wenn KI deaktiviert ist."
+        "notificationLanguageHint": "Wird für deterministische Laufzeitbenachrichtigungen verwendet, auch wenn KI deaktiviert ist.",
+        "appriseServiceHelp": "Slack und Matrix einrichten",
+        "appriseSlackSteps": "Erstellen Sie in Ihrer Slack-App einen eingehenden Webhook für den Zielkanal und fügen Sie dessen vollständige HTTPS-URL in das Feld Apprise-URL ein. Eine Umwandlung ist nicht erforderlich.",
+        "appriseSlackDocs": "Slack-URL-Formate und Einrichtung",
+        "appriseMatrixSteps": "Verwenden Sie ein Benachrichtigungskonto, das in den Raum schreiben darf. Ersetzen Sie den Beispielbenutzer, das Passwort, den Homeserver und die vollständige Raum-ID; kodieren Sie Sonderzeichen in Zugangsdaten für URLs. Das Schema matrixs verwendet HTTPS. Informationen zur Unterstützung von Tokens, SSO und verschlüsselten Räumen in Ihrer installierten Apprise-Version finden Sie in der Dokumentation.",
+        "appriseMatrixDocs": "Matrix-URL-Formate und Einrichtung",
+        "appriseServiceFinish": "Aktivieren Sie Apprise, geben Sie Ihre URL ein, wählen Sie Benachrichtigungskategorien oder einzelne Ereignisse aus, speichern Sie und verwenden Sie anschließend Test senden. Diese Beispiele ändern Ihre gespeicherte URL nicht. Dieser Apprise-Kanal hat ein Ziel; verwenden Sie die Apprise-API für mehrere Dienste gleichzeitig."
       },
       "ai": {
         "title": "KI-Verbesserung",
@@ -2545,9 +2578,9 @@
     "twoFactor": {
       "title": "Zwei-Faktor-Authentifizierung",
       "hint": "Fügen Sie nach dem Passwort einen Einmalcode aus einer Authentifizierungs-App hinzu.",
-      "enable": "Aktivieren Sie 2FA",
+      "enable": "2FA aktivieren",
       "enabled": "2FA ist aktiviert.",
-      "disable": "Deaktivieren Sie 2FA",
+      "disable": "2FA deaktivieren",
       "disableTitle": "Deaktivieren Sie die Zwei-Faktor-Authentifizierung",
       "disableDescription": "Bestätigen Sie mit Ihrem Passwort und einem aktuellen 2FA-Code oder Backup-Code.",
       "codeOrBackup": "2FA-Code oder Backup-Code",
@@ -2690,7 +2723,7 @@
         "interfaceOptional": "Schnittstelle (optional)",
         "applyTo": "Gelten",
         "commentOptional": "Kommentar (optional)",
-        "port": "Hafen",
+        "port": "Port",
         "source": "Quelle",
         "level": "Ebene",
         "interface": "Schnittstelle",
@@ -2982,7 +3015,7 @@
       "needQrOrKey": "Ein QR-Code oder manueller Schlüssel aus diesem Setup.",
       "needBackupCodes": "Backup-Codes werden an einem sicheren Ort gespeichert.",
       "starting": "Beginnt...",
-      "startSetup": "Starten Sie die Einrichtung",
+      "startSetup": "Einrichtung starten",
       "scanTitle": "Scannen Sie den QR-Code",
       "scanDescription": "Öffnen Sie Ihre Authentifizierungs-App und scannen Sie diesen Code.",
       "qrCodeAlt": "2FA QR-Code",
@@ -4756,6 +4789,24 @@
       "thursday": "Donnerstag",
       "tuesday": "Dienstag",
       "wednesday": "Mittwoch"
+    },
+    "storageRetention": {
+      "title": "Aufbewahrung im Speicher",
+      "keepAll": "Alle Sicherungen behalten",
+      "description": "In Proxmox gespeicherte Standardaufbewahrung für Sicherungen. Sicherungsaufträge mit einer eigenen Richtlinie überschreiben diesen Standard.",
+      "refresh": "Aktualisieren",
+      "saved": "Aufbewahrungsrichtlinie des Speichers gespeichert. Es wurde keine Bereinigung ausgeführt.",
+      "choosePolicy": "Wählen Sie Alle behalten oder mindestens eine Aufbewahrungsanzahl größer als null.",
+      "saveFailed": "Aufbewahrungsrichtlinie des Speichers konnte nicht gespeichert werden. Aktualisieren Sie die Liste, falls die Konfiguration geändert wurde.",
+      "loadFailed": "Aufbewahrungsrichtlinie des Speichers konnte nicht geladen werden.",
+      "empty": "Keine Sicherungsspeicher gefunden.",
+      "default": "Proxmox-Standard",
+      "edit": "Bearbeiten",
+      "editTitle": "Aufbewahrung für {storage}",
+      "effect": "Gilt für zukünftige Sicherungsläufe, die diese Speicherrichtlinie übernehmen. Das Speichern löscht keine vorhandenen Sicherungen. Geschützte Sicherungen bleiben geschützt.",
+      "cancel": "Abbrechen",
+      "save": "Aufbewahrung speichern",
+      "useDefault": "Proxmox-Standard verwenden (keine Richtlinie für diesen Speicher)"
     }
   },
   "healthStatus": {
@@ -4786,7 +4837,8 @@
       "services": "PVE-Dienste",
       "logs": "Systemprotokolle",
       "updates": "Systemaktualisierungen",
-      "security": "Sicherheit & Zertifikate"
+      "security": "Sicherheit & Zertifikate",
+      "pbsServices": "PBS-Dienste"
     },
     "checks": {
       "cpu_usage": "CPU-Auslastung",
@@ -7230,5 +7282,99 @@
         "diagnosticsOmitted": "Weitere Diagnosezeilen oder Text ausgelassen: {count}. Originalbericht bleibt erhalten."
       }
     }
+  },
+  "pbs": {
+    "title": "Proxmox Backup Server",
+    "server": "PBS-Server",
+    "chooseServer": "PBS-Server auswählen",
+    "local": "Lokaler PBS",
+    "refresh": "Aktualisieren",
+    "manage": "PBS-Verbindungen verwalten",
+    "loadFailed": "PBS-Status konnte nicht geladen werden.",
+    "loading": "PBS-Daten werden geladen…",
+    "noServer": "Fügen Sie eine PBS-Verbindung hinzu, um Datenspeicher, Aufgaben und Zeitpläne anzuzeigen.",
+    "permissionsHelp": "Aktivieren Sie die Monitor-Authentifizierung, bevor Sie Zugangsdaten speichern. Verwenden Sie ein eigenes PBS-API-Token mit der Rolle Audit auf / sowohl für den Benutzer als auch für die Token-ACLs, jeweils mit Vererbung. Dieses Panel liest PBS-Daten ausschließlich.",
+    "editConnection": "Zu bearbeitende Verbindung",
+    "add": "Neue Verbindung hinzufügen",
+    "name": "Name",
+    "url": "HTTPS-URL (für den nativen PBS-Port :8007 angeben)",
+    "token_id": "API-Token-ID (user@realm!token)",
+    "token_secret": "API-Token-Geheimnis (leer lassen, um das gespeicherte Geheimnis beizubehalten)",
+    "fingerprint": "SHA256-Zertifikatfingerabdruck (optional)",
+    "tlsHelp": "Lassen Sie den Fingerabdruck für die normale Prüfung von Zertifizierungsstelle und Hostname leer. Kopieren Sie bei einem selbstsignierten Zertifikat dessen SHA256-Fingerabdruck aus der PBS-Konsole oder einem anderen vertrauenswürdigen Kanal. Der Fingerabdruck wird vor der Übermittlung von Zugangsdaten geprüft.",
+    "saved": "PBS-Verbindung geprüft und gespeichert.",
+    "saveFailed": "PBS-Verbindung konnte nicht gespeichert werden.",
+    "testing": "Verbindung wird geprüft…",
+    "save": "Prüfen und speichern",
+    "remove": "Verbindung entfernen",
+    "removeConfirm": "Diese gespeicherte PBS-Verbindung und ihr Token aus Monitor entfernen? PBS-Daten und -Aufträge bleiben unverändert.",
+    "sampled": "Erfasst am",
+    "datastores": "Datenspeicher",
+    "total": "Dateisystemkapazität",
+    "used": "Belegt",
+    "free": "Verfügbar",
+    "noDatastores": "Keine zugänglichen Datenspeicher. Prüfen Sie die Datenspeicherkonfiguration und die Berechtigungen des Benutzers und Tokens.",
+    "tasks": "Letzte Aufgaben",
+    "noTasks": "Es wurden keine aktuellen Aufgaben zurückgegeben.",
+    "task": "Aufgabe",
+    "started": "Gestartet",
+    "status": "Status",
+    "running": "Wird ausgeführt",
+    "jobs": "Wartungszeitpläne",
+    "job": "Auftrag",
+    "schedule": "Zeitplan",
+    "sync": "Synchronisierung",
+    "verify": "Verifizierung",
+    "prune": "Bereinigung",
+    "overview": "Übersicht",
+    "logs": "Systemprotokolle",
+    "terminal": "Terminal",
+    "security": "Sicherheit",
+    "logout": "Abmelden",
+    "navigation": "PBS-Navigation",
+    "cpu": "CPU",
+    "memory": "Arbeitsspeicher",
+    "uptime": "Betriebszeit",
+    "capacityUnavailable": "Kapazität nicht verfügbar.",
+    "datastoresUnavailable": "{count} nicht verfügbar",
+    "datastoresOnline": "Alle verfügbar",
+    "moreDatastores": "+{count} weitere Datenspeicher",
+    "estimatedFull": "Voraussichtlich voll",
+    "estimatedFullUnknown": "Noch nicht genügend Daten",
+    "duration": "Dauer",
+    "noJobs": "Es sind keine Synchronisierungs-, Überprüfungs- oder Löschzeitpläne konfiguriert."
+  },
+  "monitorLinks": {
+    "groups": {
+      "cluster": "Cluster",
+      "standalone": "Eigenständige Knoten",
+      "pbs": "Proxmox Backup Server"
+    },
+    "thisNode": "Dieser Knoten",
+    "checking": "Knoten werden überprüft…",
+    "loadFailed": "Die Knotenliste konnte nicht geladen werden.",
+    "empty": "Noch keine anderen Knoten. Fügen Sie einen hinzu, um seinen Monitor von hier aus zu öffnen.",
+    "noResponse": "Keine Antwort",
+    "pbsInterface": "PBS-Schnittstelle",
+    "openNewTab": "In einem neuen Tab öffnen",
+    "manage": "Knoten hinzufügen oder verwalten…",
+    "dialogTitle": "Verknüpfte Knoten",
+    "dialogDescription": "Clusterknoten und konfigurierte Proxmox Backup Server werden automatisch erkannt. Jeder Monitor behält seine eigene Anmeldung.",
+    "addTitle": "Einen Knoten hinzufügen",
+    "name": "Name",
+    "address": "Adresse überwachen",
+    "type": "Geben Sie ein",
+    "add": "Hinzufügen",
+    "save": "Speichern",
+    "remove": "Entfernen",
+    "visible": "Sichtbar",
+    "autoAddress": "Automatisch",
+    "detected": "Erkannt",
+    "added": "Hinzugefügt",
+    "saveFailed": "Die Knotenliste konnte nicht gespeichert werden.",
+    "backTo": "Zurück zu {name}",
+    "cameFromTitle": "Monitorknoten hinzufügen?",
+    "cameFromBody": "{name} zu den verknüpften Knoten dieses Monitors hinzufügen.",
+    "notNow": "Nicht jetzt"
   }
 }
diff --git a/AppImage/messages/en/common.json b/AppImage/messages/en/common.json
index 80c4830e..884db22e 100644
--- a/AppImage/messages/en/common.json
+++ b/AppImage/messages/en/common.json
@@ -1,7 +1,69 @@
 {
+  "pbs": {
+    "title": "Proxmox Backup Server",
+    "server": "PBS server",
+    "chooseServer": "Choose a PBS server",
+    "local": "Local PBS",
+    "refresh": "Refresh",
+    "manage": "Manage PBS connections",
+    "loadFailed": "Could not load PBS status.",
+    "loading": "Loading PBS data…",
+    "noServer": "Add a PBS connection to view datastores, tasks and schedules.",
+    "permissionsHelp": "Enable Monitor authentication before saving credentials. Use a dedicated PBS API token with the Audit role on / for both its user and token ACLs, with propagation. This panel only reads PBS data.",
+    "editConnection": "Connection to edit",
+    "add": "Add a new connection",
+    "name": "Name",
+    "url": "HTTPS URL (include :8007 for the native PBS port)",
+    "token_id": "API token ID (user@realm!token)",
+    "token_secret": "API token secret (leave empty to keep the stored secret)",
+    "fingerprint": "SHA256 certificate fingerprint (optional)",
+    "tlsHelp": "Leave the fingerprint empty for normal CA and hostname verification. For a self-signed certificate, copy its SHA256 fingerprint from the PBS console or another trusted channel. The pin is checked before sending credentials.",
+    "saved": "PBS connection verified and saved.",
+    "saveFailed": "Could not save the PBS connection.",
+    "testing": "Verifying connection…",
+    "save": "Verify and save",
+    "remove": "Remove connection",
+    "removeConfirm": "Remove this saved PBS connection and its token from Monitor? PBS data and jobs are unaffected.",
+    "sampled": "Sampled at",
+    "datastores": "Datastores",
+    "total": "Filesystem capacity",
+    "used": "Used",
+    "free": "Available",
+    "noDatastores": "No accessible datastores. Check datastore configuration and the user/token permissions.",
+    "tasks": "Recent tasks",
+    "noTasks": "No recent tasks were returned.",
+    "task": "Task",
+    "started": "Started",
+    "status": "Status",
+    "running": "Running",
+    "jobs": "Maintenance schedules",
+    "job": "Job",
+    "schedule": "Schedule",
+    "sync": "Sync",
+    "verify": "Verification",
+    "prune": "Prune",
+    "overview": "Overview",
+    "logs": "System logs",
+    "terminal": "Terminal",
+    "security": "Security",
+    "logout": "Log out",
+    "navigation": "PBS navigation",
+    "cpu": "CPU",
+    "memory": "Memory",
+    "uptime": "Uptime",
+    "capacityUnavailable": "Capacity not available.",
+    "datastoresUnavailable": "{count} unavailable",
+    "datastoresOnline": "All available",
+    "moreDatastores": "+{count} more datastores",
+    "estimatedFull": "Estimated full",
+    "estimatedFullUnknown": "Not enough data yet",
+    "duration": "Duration",
+    "noJobs": "No sync, verification or prune schedules are configured."
+  },
   "app": {
     "title": "ProxMenux Monitor",
     "description": "Proxmox System Dashboard",
+    "descriptionPbs": "Proxmox Backup Server Dashboard",
     "loading": "Loading...",
     "connecting": "Connecting to ProxMenux Monitor",
     "unknown": "Unknown",
@@ -142,6 +204,7 @@
       "dayMany": "{count} days"
     },
     "proxmoxVersion": "Proxmox Version:",
+    "pbsVersion": "PBS Version:",
     "kernel": "Kernel:",
     "availableUpdates": "Available Updates:",
     "packages": "packages",
@@ -1131,7 +1194,21 @@
       "available": "Available backups",
       "loading": "Loading backups...",
       "empty": "No backups found",
-      "emptyHint": "Create your first backup using the button above"
+      "emptyHint": "Create your first backup using the button above",
+      "refresh": "Refresh",
+      "refreshFailed": "Could not refresh backups. Refresh again to confirm their current state.",
+      "deleteSelected": "Delete selected ({count})",
+      "deletedCount": "{count} backup(s) deleted.",
+      "unconfirmedCount": "Deletion of {count} backup(s) was not confirmed. Refresh the list and check Proxmox Tasks before trying again.",
+      "deleteFailed": "Deletion could not be confirmed. Refresh the list and check Proxmox Tasks before trying again.",
+      "selectHint": "Select unprotected backups (up to 20 per batch)",
+      "selectBackup": "Select backup",
+      "protected": "Protected",
+      "confirmTitle": "Delete {count} backup(s)?",
+      "confirmDescription": "These backup archives for VM/CT {vmid} will be permanently deleted. Protected backups are excluded. This does not delete the guest.",
+      "deleting": "Waiting for Proxmox to finish deleting the selected archives…",
+      "cancel": "Cancel",
+      "confirmDelete": "Delete backups"
     },
     "updatesPanel": {
       "pendingTitle": "Pending package updates",
@@ -1663,6 +1740,16 @@
       "searchApplications": "Find applications",
       "searchingApplications": "Searching applications…",
       "noApplicationsDetected": "No applications were detected.",
+      "nativeEvidencePort": "Listening TCP port",
+      "nativeEvidenceFile": "Installed file",
+      "nativeEvidenceProcess": "Running executable",
+      "nativeEvidenceDirectory": "Working directory",
+      "nativeEvidenceService": "Service definition",
+      "nativeScanFailed": "Application search could not finish. Previous evidence may be outdated; try again.",
+      "nativeScanPartial": "Application search is incomplete. Review the available evidence and try again.",
+      "nativeVersionUnknown": "Installed version unknown",
+      "nativeEvidenceStale": "Evidence may be outdated or incomplete.",
+      "nativeRegisterOnly": "Confirm registration in the editor. A known version is a manual value; no updater is configured.",
       "noNewApplicationsDetected": "No new applications were detected.",
       "dockerDetectedWithWorkloads": "Docker detected with {count} containerised application(s)",
       "dockerWorkloadsHeading": "Running inside Docker",
@@ -1813,6 +1900,7 @@
         "network": "Network Interfaces",
         "vms": "VMs & Containers",
         "services": "PVE Services",
+        "pbsServices": "PBS Services",
         "logs": "System Logs",
         "updates": "System Updates",
         "security": "Security & Certificates",
@@ -2097,6 +2185,12 @@
         "pushoverCredentialsHint": "Create an application in Pushover and copy its API token and your user or group key.",
         "enableApprise": "Enable Apprise",
         "urlFormats": "+URL formats",
+        "appriseServiceHelp": "Slack and Matrix setup",
+        "appriseSlackSteps": "Create an Incoming Webhook in your Slack app for the target channel, then paste its complete HTTPS URL into Apprise URL. No conversion is needed.",
+        "appriseSlackDocs": "Slack URL formats and setup",
+        "appriseMatrixSteps": "Use a notification account that can post to the room. Replace the example user, password, homeserver and full room ID; URL-encode special characters in credentials. The matrixs scheme uses HTTPS. See the documentation for token, SSO and encrypted-room support in your installed Apprise version.",
+        "appriseMatrixDocs": "Matrix URL formats and setup",
+        "appriseServiceFinish": "Enable Apprise, enter your URL, choose the notification categories or individual events, save, then use Send Test. These examples do not change your saved URL. This Apprise channel has one destination; use Apprise API for several services at once.",
         "appriseUrl": "Apprise URL",
         "showUrl": "Show URL",
         "hideUrl": "Hide URL",
@@ -3941,6 +4035,24 @@
     }
   },
   "backup": {
+    "storageRetention": {
+      "useDefault": "Use the Proxmox default (no policy on this storage)",
+      "title": "Storage retention",
+      "keepAll": "Keep all backups",
+      "description": "Default backup retention stored in Proxmox. Backup jobs with an explicit policy override this default.",
+      "refresh": "Refresh",
+      "saved": "Storage retention saved. No pruning was run.",
+      "choosePolicy": "Choose Keep all or at least one positive retention count.",
+      "saveFailed": "Could not save storage retention. Refresh the list if the configuration changed.",
+      "loadFailed": "Could not load storage retention.",
+      "empty": "No backup storages found.",
+      "default": "Proxmox default",
+      "edit": "Edit",
+      "editTitle": "Retention for {storage}",
+      "effect": "Applies to future backup runs that inherit this storage policy. Saving does not delete existing backups. Protected backups remain protected.",
+      "cancel": "Cancel",
+      "save": "Save retention"
+    },
     "actions": {
       "addAnother": "Add another",
       "addPath": "Add path",
@@ -4783,6 +4895,7 @@
       "network": "Network interfaces",
       "vms": "VMs & containers",
       "services": "PVE services",
+      "pbsServices": "PBS services",
       "logs": "System logs",
       "updates": "System updates",
       "security": "Security & certificates"
@@ -6438,5 +6551,38 @@
       "cancel": "Cancel"
     }
   },
-  "runtime": {"notifications":{"templates":{"state_change":{"title":"{hostname}: {category} changed to {current}{entity_suffix}","body":"{category} status changed from {previous} to {current}.\n{reason}","label":"Health state changed"},"new_error":{"title":"{hostname}: New {severity} - {category}{entity_suffix}","body":"{reason}","label":"New health issue"},"error_resolved":{"title":"{hostname}: Resolved - {category}{entity_suffix}","body":"The {category} issue has been resolved.\n{reason}\n🚦 Previous severity: {original_severity}\n⏱️ Duration: {duration}","label":"Recovery notification"},"error_escalated":{"title":"{hostname}: Escalated to {severity} - {category}{entity_suffix}","body":"{reason}","label":"Health issue escalated"},"health_degraded":{"title":"{title_or_default}","body":"{reason}","label":"Health check degraded"},"lxc_updates_available":{"title":"{hostname}: {count} LXC(s) with package updates available","body":"📊 {count} LXC(s) with pending package updates (📦 {total_packages} total, 🔒 {security_count} security):\n\n{ct_list}","label":"LXC updates available (experimental)"},"lxc_update_applied":{"title":"{hostname}: LXC {ct_name} ({vmid}) update {result}","body":"{details}","label":"LXC update applied"},"oci_update_completed":{"title":"{hostname}: {app_name} updated","body":"{app_name} was updated to its new image and its data was kept.\nContainers: {containers}","label":"OCI application updated"},"oci_update_failed":{"title":"{hostname}: {app_name} update did not complete","body":"The update of {app_name} did not complete.\nReason: {reason}\nContainers: {containers}\nOpen Manage installed OCI applications to check its state.","label":"OCI application update failed"},"oci_recreate_completed":{"title":"{hostname}: {app_name} recreated","body":"{app_name} was recreated with its saved configuration and its data was kept.\nContainers: {containers}","label":"OCI application recreated"},"oci_recreate_failed":{"title":"{hostname}: {app_name} recreation did not complete","body":"The recreation of {app_name} did not complete.\nReason: {reason}\nContainers: {containers}\nOpen Manage installed OCI applications to check its state.","label":"OCI application recreation failed"},"oci_modify_completed":{"title":"{hostname}: {app_name} modified","body":"{app_name} was modified with its new options and its data was kept.\nContainers: {containers}","label":"OCI application modified"},"oci_modify_failed":{"title":"{hostname}: {app_name} modification did not complete","body":"The modification of {app_name} did not complete.\nReason: {reason}\nContainers: {containers}\nOpen Manage installed OCI applications to check its state.","label":"OCI application modification failed"},"oci_watchdog_restarted":{"title":"{hostname}: {app_name} restarted after it stopped","body":"{app_name} stopped on its own and the watchdog started it again.\nContainers: {containers}","label":"OCI application restarted by the watchdog"},"oci_watchdog_failed":{"title":"{hostname}: {app_name} could not be kept running","body":"The watchdog could not keep {app_name} running: it stopped again or did not start after several attempts, and it is left stopped.\nContainers: {containers}\nStart it by hand once the cause is solved; the watchdog then watches it again.","label":"OCI application left stopped by the watchdog"},"app_update_available":{"title":"{hostname}: {app_name} update available on CT {vmid}","body":"{app_name} on CT {vmid} ({ct_name}) has a new version:\n    {installed} → {latest}","label":"App update available"},"docker_stack_update_available":{"title":"{hostname}: Docker updates available on CT {vmid}","body":"Container {ct_name} (CT {vmid}) has {count} Docker update(s):\n{details}","label":"Docker updates available"},"vm_start":{"title":"{hostname}: VM {vmname} ({vmid}) started","body":"Virtual machine {vmname} (ID: {vmid}) is now running.","label":"VM started"},"vm_start_warning":{"title":"{hostname}: VM {vmname} ({vmid}) started with warnings","body":"Virtual machine {vmname} (ID: {vmid}) started successfully but has warnings.\nWarnings: {reason}","label":"VM started (warnings)"},"vm_stop":{"title":"{hostname}: VM {vmname} ({vmid}) stopped","body":"Virtual machine {vmname} (ID: {vmid}) has been stopped.","label":"VM stopped"},"vm_shutdown":{"title":"{hostname}: VM {vmname} ({vmid}) shut down","body":"Virtual machine {vmname} (ID: {vmid}) has been cleanly shut down.","label":"VM shutdown"},"vm_fail":{"title":"{hostname}: VM {vmname} ({vmid}) FAILED","body":"Virtual machine {vmname} (ID: {vmid}) has crashed or failed to start.\nReason: {reason}","label":"VM FAILED"},"vm_restart":{"title":"{hostname}: VM {vmname} ({vmid}) restarted","body":"Virtual machine {vmname} (ID: {vmid}) has been restarted.","label":"VM restarted"},"ct_start":{"title":"{hostname}: CT {vmname} ({vmid}) started","body":"Container {vmname} (ID: {vmid}) is now running.","label":"CT started"},"ct_start_warning":{"title":"{hostname}: CT {vmname} ({vmid}) started with warnings","body":"Container {vmname} (ID: {vmid}) started successfully but has warnings.\nWarnings: {reason}","label":"CT started (warnings)"},"ct_stop":{"title":"{hostname}: CT {vmname} ({vmid}) stopped","body":"Container {vmname} (ID: {vmid}) has been stopped.","label":"CT stopped"},"ct_shutdown":{"title":"{hostname}: CT {vmname} ({vmid}) shut down","body":"Container {vmname} (ID: {vmid}) has been cleanly shut down.","label":"CT shutdown"},"ct_restart":{"title":"{hostname}: CT {vmname} ({vmid}) restarted","body":"Container {vmname} (ID: {vmid}) has been restarted.","label":"CT restarted"},"ct_fail":{"title":"{hostname}: CT {vmname} ({vmid}) FAILED","body":"Container {vmname} (ID: {vmid}) has crashed or failed to start.\nReason: {reason}","label":"CT FAILED"},"migration_start":{"title":"{hostname}: Migration started — {vmname} ({vmid})","body":"Live migration of {vmname} (ID: {vmid}) to node {target_node} has started.","label":"Migration started"},"migration_complete":{"title":"{hostname}: Migration complete — {vmname} ({vmid})","body":"{vmname} (ID: {vmid}) successfully migrated to node {target_node}.","label":"Migration complete"},"migration_warning":{"title":"{hostname}: Migration complete with warnings — {vmname} ({vmid})","body":"{vmname} (ID: {vmid}) migrated to node {target_node} but encountered warnings.\nWarnings: {reason}","label":"Migration (warnings)"},"migration_fail":{"title":"{hostname}: Migration FAILED — {vmname} ({vmid})","body":"Migration of {vmname} (ID: {vmid}) to node {target_node} failed.\nReason: {reason}","label":"Migration FAILED"},"replication_fail":{"title":"{hostname}: Replication FAILED — {vmname} ({vmid})","body":"Replication of {vmname} (ID: {vmid}) failed.\nReason: {reason}","label":"Replication FAILED"},"replication_complete":{"title":"{hostname}: Replication complete — {vmname} ({vmid})","body":"Replication of {vmname} (ID: {vmid}) completed successfully.","label":"Replication complete"},"backup_start":{"title":"{hostname}: Backup started on {storage}","body":"Backup job started on storage {storage}.\n{reason}","label":"Backup started"},"backup_complete":{"title":"{hostname} → {storage}: Backup complete — {vmname} ({vmid})","body":"Backup of {vmname} (ID: {vmid}) completed successfully on {storage}.\nSize: {size}","label":"Backup complete"},"backup_warning":{"title":"{hostname} → {storage}: Backup complete with warnings — {vmname} ({vmid})","body":"Backup of {vmname} (ID: {vmid}) on {storage} completed but encountered warnings.\nWarnings: {reason}","label":"Backup (warnings)"},"backup_fail":{"title":"{hostname} → {storage}: Backup FAILED — {vmname} ({vmid})","body":"Backup of {vmname} (ID: {vmid}) failed on {storage}.\nReason: {reason}","label":"Backup FAILED"},"host_backup_start":{"title":"{hostname}: Host backup started → {backend_label}","body":"Job: {job_id}\nBackend: {backend_label}\nDestination: {destination}\nProfile: {profile_mode}","label":"Host backup started"},"host_backup_complete":{"title":"{hostname}: Host backup complete → {backend_label}","body":"Job: {job_id}\nBackend: {backend_label}\nDestination: {destination}\nData size: {data_size}\nArchive size: {archive_size}\nDuration: {duration}","label":"Host backup complete"},"host_backup_fail":{"title":"{hostname}: Host backup FAILED → {backend_label}","body":"Job: {job_id}\nBackend: {backend_label}\nDestination: {destination}\nDuration before failure: {duration}\nReason: {reason}\nLog: {log_file}","label":"Host backup FAILED"},"snapshot_complete":{"title":"{hostname}: Snapshot created — {vmname} ({vmid})","body":"Snapshot \"{snapshot_name}\" created for {vmname} (ID: {vmid}).","label":"Snapshot created"},"snapshot_fail":{"title":"{hostname}: Snapshot FAILED — {vmname} ({vmid})","body":"Snapshot creation for {vmname} (ID: {vmid}) failed.\nReason: {reason}","label":"Snapshot FAILED"},"cpu_high":{"title":"{hostname}: High CPU usage — {value}%","body":"CPU usage has reached {value}% on {cores} cores.\n{details}","label":"High CPU usage"},"ram_high":{"title":"{hostname}: High memory usage — {value}%","body":"Memory usage: {used} / {total} ({value}%).\n{details}","label":"High memory usage"},"temp_high":{"title":"{hostname}: High sensor temperature — {value}°C","body":"Sensor temperature has reached {value}°C (threshold: {threshold}°C).\n{details}","label":"High temperature"},"disk_space_low":{"title":"{hostname}: Low disk space on {mount}","body":"Filesystem {mount}: {used}% used ({available} available).\nFree up disk space to avoid service disruption.","label":"Low disk space"},"disk_io_error":{"title":"{hostname}: Disk failure detected — {device}","body":"I/O error or disk failure detected on device {device}.\n{reason}","label":"Disk failure / I/O error"},"storage_unavailable":{"title":"{hostname}: Storage unavailable — {storage_name}","body":"PVE storage \"{storage_name}\" (type: {storage_type}) is not accessible.\nReason: {reason}","label":"Storage unavailable"},"smart_test_complete":{"title":"{hostname}: SMART test completed — {device}","body":"SMART {test_type} test on /dev/{device} has completed.\nResult: {result}\nDuration: {duration}","label":"SMART test completed"},"smart_test_failed":{"title":"{hostname}: SMART test FAILED — {device}","body":"SMART {test_type} test on /dev/{device} has failed.\nResult: {result}\nReason: {reason}","label":"SMART test FAILED"},"gpu_mode_switch":{"title":"{hostname}: GPU mode changed to {new_mode}","body":"GPU passthrough mode has been switched.\nGPU: {gpu_name} ({gpu_pci})\nPrevious mode: {old_mode}\nNew mode: {new_mode}\n{details}","label":"GPU mode switched"},"gpu_passthrough_blocked":{"title":"{hostname}: {guest_type} {guest_id} blocked at startup","body":"PCIe passthrough guard prevented {guest_type} {guest_id} ({guest_name}) from starting.\nReason: {reason}\n{details}","label":"GPU passthrough blocked"},"pci_passthrough_conflict":{"title":"{hostname}: PCIe device conflict detected — {device_pci}","body":"A PCIe device is assigned to multiple guests.\nDevice: {device_pci}\nConflicting guests: {guest_list}\nAction required: Stop one of the guests or reassign the device.","label":"PCIe device conflict"},"load_high":{"title":"{hostname}: High system load — {value}","body":"System load average is {value} on {cores} cores.\n{details}","label":"High system load"},"network_down":{"title":"{hostname}: Network connectivity lost{entity_suffix}","body":"The node has lost network connectivity.\nReason: {reason}","label":"Network connectivity lost"},"network_latency":{"title":"{hostname}: High network latency — {value}ms","body":"Latency to gateway: {value}ms (threshold: {threshold}ms).\nThis may indicate network congestion or hardware issues.","label":"High network latency"},"auth_fail":{"title":"{hostname}: Authentication failure","body":"Failed login attempt detected.\nSource IP: {source_ip}\nUser: {username}\nService: {service}","label":"Authentication failure"},"ip_block":{"title":"{hostname}: IP blocked by Fail2Ban","body":"IP address {source_ip} has been banned.\nJail: {jail}\nFailed attempts: {failures}","label":"IP blocked by Fail2Ban"},"firewall_issue":{"title":"{hostname}: Firewall issue detected{entity_suffix}","body":"A firewall configuration issue has been detected.\nReason: {reason}","label":"Firewall issue detected"},"user_permission_change":{"title":"{hostname}: User permission changed","body":"User: {username}\nChange: {change_details}","label":"User permission changed"},"split_brain":{"title":"{hostname}: Cluster event reported","body":"A cluster event was reported:\n{reason}","label":"Cluster event"},"node_disconnect":{"title":"{hostname}: Node {node_name} disconnected","body":"Node {node_name} has disconnected from the cluster.","label":"Node disconnected"},"node_reconnect":{"title":"{hostname}: Node {node_name} reconnected","body":"Node {node_name} has rejoined the cluster successfully.","label":"Node reconnected"},"system_startup":{"title":"{hostname}: {reason}","body":"{summary}","label":"System startup report"},"system_shutdown":{"title":"{hostname}: System shutting down","body":"The node is shutting down.\n{reason}","label":"System shutting down"},"system_reboot":{"title":"{hostname}: System rebooting","body":"The node is rebooting.\n{reason}","label":"System rebooting"},"system_restore_completed":{"title":"{hostname}: Host restore finished","body":"Post-restore tasks completed in background.\n\nGuest configurations copied: {guests}\nBind-mount stub directories created: {stubs}\nStale node dirs removed: {stale_nodes}\nComponents reinstalled: {components}\nDuration: {duration}\n{warnings_block}","label":"Host restore completed"},"system_problem":{"title":"{hostname}: System problem detected{entity_suffix}","body":"A system-level problem has been detected.\nReason: {reason}","label":"System problem detected"},"service_fail":{"title":"{hostname}: Service failed — {service_name}","body":"System service \"{service_name}\" has failed.\nReason: {reason}","label":"Service failed"},"oom_kill":{"title":"{hostname}: OOM Kill — {process}","body":"Process \"{process}\" was killed by the Out-of-Memory manager.\n{reason}","label":"Out of memory kill"},"service_fail_batch":{"title":"{hostname}: {service_count} services failed{entity_suffix}","body":"{reason}","label":"Service fail batch"},"cron_output":{"title":"{hostname}: {pve_title}","body":"{reason}","label":"Cron job output (per-cron stdout via mail)"},"system_mail":{"title":"{hostname}: {pve_title}","body":"{reason}","label":"Smartd / mail bounces (PVE system mail)"},"apt_listchanges":{"title":"{hostname}: {pve_title}","body":"Upstream package information forwarded by Proxmox VE through apt-listchanges. The following text comes from the package maintainer and is not a ProxMenux recommendation.\n\n{reason}","label":"apt-listchanges package notices"},"webhook_test":{"title":"{hostname}: Webhook test received","body":"PVE webhook connectivity test successful.\n{reason}","label":"Webhook test"},"update_available":{"title":"{hostname}: Updates available","body":"Total updates: {total_count}\nSecurity: {security_count}\nProxmox: {pve_count}\nKernel: {kernel_count}\nImportant packages:\n{important_list}","label":"Updates available (legacy)"},"unknown_persistent":{"title":"{hostname}: Check unavailable - {category}{entity_suffix}","body":"Health check for {category} has been unavailable for 3+ cycles.\n{reason}","label":"Check unavailable"},"health_persistent":{"title":"{hostname}: {count} active health issue(s){entity_suffix}","body":"The following health issues remain unresolved:\n{issue_list}\n\nThis digest is sent once every 24 hours while issues persist.","label":"Active health issues (daily)"},"health_issue_new":{"title":"{hostname}: New health issue — {category}{entity_suffix}","body":"New {severity} issue detected in: {category}\nDetails: {reason}","label":"New health issue"},"health_issue_resolved":{"title":"{hostname}: Resolved - {category}{entity_suffix}","body":"{category} issue has been resolved.\n{reason}\nDuration: {duration}","label":"Health issue resolved"},"update_summary":{"title":"{hostname}: Updates available","body":"Total updates: {total_count}\nSecurity updates: {security_count}\nProxmox-related updates: {pve_count}\nKernel updates: {kernel_count}\nImportant packages:\n{important_list}","label":"Host package updates"},"pve_update":{"title":"{hostname}: Proxmox VE {new_version} available","body":"A new Proxmox VE release is available.\nCurrent: {current_version}\nNew: {new_version}\n{details}","label":"Proxmox VE update available"},"update_complete":{"title":"{hostname}: System update completed","body":"System packages have been successfully updated.\n{details}","label":"Host update completed"},"ai_model_migrated":{"title":"{hostname}: AI model updated","body":"The AI model for notifications has been automatically updated.\nProvider: {provider}\nPrevious model: {old_model}\nNew model: {new_model}\n\n{message}","label":"AI model auto-updated"},"proxmenux_update":{"title":"{hostname}: ProxMenux {new_version} available","body":"A new version of ProxMenux is available.\nCurrent: {current_version}\nNew: {new_version}","label":"ProxMenux update available"},"mount_stale":{"title":"{hostname}: stale remote mount {mount_target}","body":"Remote mount {mount_target} ({fstype}) from {mount_source} is stale{lxc_scope}.\nStat timed out or returned an error: {error}\n\nApps writing to this path will silently land on the underlying filesystem and may fill the disk. Remount or fix connectivity ASAP.","label":"Remote mount stale"},"mount_readonly":{"title":"{hostname}: remote mount {mount_target} is read-only","body":"Remote mount {mount_target} ({fstype}) from {mount_source} is mounted read-only{lxc_scope}. Writes will fail. If this was unintentional, remount with rw.","label":"Remote mount read-only"},"lxc_disk_low":{"title":"{hostname}: CT {vmid} rootfs at {usage_percent}%","body":"CT {vmid} ({name}) rootfs is at {usage_percent}% ({disk_bytes_human} / {maxdisk_bytes_human}).\n\nA full LXC rootfs prevents the container from booting cleanly. Either expand the rootfs (pct resize {vmid} rootfs +1G) or free space inside the container.","label":"LXC rootfs near full"},"vm_disk_low":{"title":"{hostname}: VM {vmid} filesystems at {usage_percent}%","body":"VM {vmid} ({name}) guest filesystems are at {usage_percent}% ({disk_bytes_human} / {maxdisk_bytes_human}).\n\nReported by the QEMU guest agent. Includes every persistent filesystem the guest mounts on a block device — virtual disks and PCI-passthrough drives alike. Free up space inside the guest or expand the affected storage before writes start to fail.","label":"VM filesystems near full"},"lxc_mount_low":{"title":"{hostname}: CT {vmid} mount {mount} at {usage_percent}%","body":"Mount {mount} inside CT {vmid} ({name}) is at {usage_percent}% used.\nFilesystem type: {fstype}\n\nA full mount inside a container often blocks the application silently — writes either fail or, worse, land on the rootfs and trigger the rootfs alert next. Free up space on the mount or expand it.","label":"LXC mount near full"},"pve_storage_full":{"title":"{hostname}: PVE storage {storage_name} at {usage_percent}%","body":"Proxmox storage \"{storage_name}\" (type: {storage_type}) is at {usage_percent}% used.\n\nOnce full, no new VM/CT can be provisioned and existing guests may fail to write. Move/delete unused volumes or expand the underlying pool/LV/RBD image.","label":"PVE storage near full"},"zfs_pool_full":{"title":"{hostname}: ZFS pool {pool_name} at {usage_percent}%","body":"ZFS pool \"{pool_name}\" is at {usage_percent}% capacity.\n\nZFS performance and write reliability degrade sharply above ~80% capacity (CoW needs free space for new blocks). Free up snapshots, prune old datasets, or add more vdevs to the pool.","label":"ZFS pool near full"},"post_install_update":{"title":"{hostname}: {count} ProxMenux optimization update(s) available","body":"{count} ProxMenux optimization update(s) available on this host.\n\n🛠️ Available versions:\n{tool_list}\n\n💡 Apply from:\n  • ProxMenux Monitor → Settings → ProxMenux Optimizations\n  • Or open the ProxMenux menu → Settings post-install Proxmox → \"Apply available updates\"","label":"ProxMenux optimization updates available"},"secure_gateway_update_available":{"title":"{hostname}: {app_name} update available{update_title_suffix}","body":"{app_name} (managed by ProxMenux) has 📦 {package_count} package update(s) pending in its container.\n{version_line}\n\n💡 Open ProxMenux Monitor > Security > Secure Gateway and click \"Update\" to apply.\n\n🗂️ Packages:\n{package_list}","label":"Secure Gateway update available"},"nvidia_driver_update_available":{"title":"{hostname}: NVIDIA driver update available — v{latest_version}","body":"A newer maintenance release is available for the installed NVIDIA driver branch.\n🔹 Currently installed: v{current_version}\n🟢 Latest available:    v{latest_version}\n\n{upgrade_reason}\n\n💡 To reinstall:\n  • From the ProxMenux post-install menu: {menu_label}\n\nReinstalling rebuilds the DKMS module against the running kernel and requires a reboot to load the new driver.","label":"NVIDIA driver update available"},"coral_driver_update_available":{"title":"{hostname}: Coral TPU driver update available — {latest_version}","body":"A newer {variant_label} is available.\n🔹 Currently installed: {current_version}\n🟢 Latest available:    {latest_version}\n\n{upgrade_reason}\n\n💡 To reinstall:\n  • From the ProxMenux post-install menu: {menu_label}\n\n{reboot_note}","label":"Coral TPU driver update available"},"burst_auth_fail":{"title":"{hostname}: +{count} more auth failures in {window}","body":"+{count} additional authentication failures detected in {window} ({total_count} total).\nSources: {entity_list}","label":"Auth failures burst"},"burst_ip_block":{"title":"{hostname}: Fail2Ban banned +{count} more IPs in {window}","body":"+{count} additional IPs banned by Fail2Ban in {window} ({total_count} total).\nIPs: {entity_list}","label":"IP block burst"},"burst_disk_io":{"title":"{hostname}: +{count} more disk I/O errors on {entity_list}","body":"+{count} additional I/O errors detected in {window} ({total_count} total).\nDevices: {entity_list}","label":"Disk I/O burst"},"burst_cluster":{"title":"{hostname}: Cluster flapping detected (+{count} more changes)","body":"Cluster state changed +{count} more times in {window} ({total_count} total).\nNodes: {entity_list}","label":"Cluster flapping burst"},"burst_service_fail":{"title":"{hostname}: +{count} more services failed in {window}","body":"+{count} additional service failures detected in {window} ({total_count} total).\nThis typically indicates a node reboot or PVE service restart.\n\nAdditional failures:\n{details}","label":"Service fail burst"},"burst_system":{"title":"{hostname}: +{count} more system problems in {window}","body":"+{count} additional system problems detected in {window} ({total_count} total).\n\nAdditional issues:\n{details}","label":"System problems burst"},"burst_generic":{"title":"{hostname}: +{count} more {event_type} events in {window}","body":"+{count} additional events of type {event_type} in {window} ({total_count} total).\n\nAdditional events:\n{details}","label":"Generic burst"},"kernel_warning":{"title":"{hostname}: Kernel diagnostic event detected","body":"The kernel recorded a diagnostic event: {kernel_details}","label":"Kernel warnings and diagnostic traces"}},"lxcUpdate":{"status":{"success":"succeeded","failure":"failed","partial":"completed partially","deferred":"deferred","skipped":"skipped"},"source":{"scheduled":"Scheduled","manual":"Manual"},"sourceLabel":"Source","targets":"Targets","osPending":"OS packages pending: {before} → {after}","osUnverified":"OS packages: update command executed; result not verified","applications":"Applications: {items}","applicationsUnverified":"Applications: updater executed; no tracked version change was observed","dockerEngineChange":"Docker Engine: {before} → {after}","dockerEngineVerified":"Docker Engine: verified at {version}","dockerEngineUnverified":"Docker Engine: update command executed; version not verified","dockerImagesPending":"Docker images pending: {before} → {after}","dockerImagesChanged":"Docker images changed: {images}","deferredTargets":"Deferred targets: {targets}","reason":"Reason: {reason}","restartRequired":"Restart required: {value}","yes":"yes","no":"no","verificationPending":"Verification pending until the container is running","verificationWarning":"Verification warning: {error}","duration":"Duration: {duration}"},"fallback":{"unknownTitle":"{hostname}: {event_type}","healthCheckDegraded":"Health check degraded","none":"none","temperatureAlertTitle":"{hostname}: Sensor temperature alert","temperatureAlertBody":"Temperature alert recorded without a complete measurement payload.","recordedReason":"Recorded reason: {reason}","recordedDetails":"Recorded details: {details}"},"fields":{"vmid":"VM/CT","name":"Name","device":"Device","sourceIp":"Source IP","node":"Node","category":"Category","service":"Service","jail":"Jail","user":"User","count":"Count","window":"Window","affected":"Affected"},"vzdump":{"size":"Size: {value}","duration":"Duration: {value}","file":"File","backups":"{count} backups","failed":"{count} failed","total":"Total: {value}","time":"Time: {value}"},"startup":{"issuesTitle":"{hostname}: System startup - {count} issue(s) detected","completeTitle":"{hostname}: System startup completed","operational":"All systems operational.","vmCountOne":"{count} VM","vmCountMany":"{count} VMs","ctCountOne":"{count} CT","ctCountMany":"{count} CTs","started":"✅ {counts} started","vmFailed":"❌ VM failed: {name} - {reason}","ctFailed":"❌ CT failed: {name} - {reason}","unknownError":"unknown error","storageUnavailable":"⚠️ Storage: {count} unavailable ({names})","servicesFailed":"⚠️ Services: {count} failed ({names})","duration":"⏱️ Startup completed in {minutes} min"},"appUpdates":{"singleTitle":"{hostname}: {app_name} update available on CT {vmid}","singleBody":"{app_name} on CT {vmid} ({ct_name}) has a new version:\n    {installed} → {latest}","emptyTitle":"{hostname}: Application updates available","emptyBody":"Application updates are available.","batchTitle":"{hostname}: {count} application updates available","batchLeadOneContainer":"{count} applications in {container_count} LXC container have a newer version:","batchLeadManyContainers":"{count} applications in {container_count} LXC containers have a newer version:","additional":"… {count} additional application(s)","app":"app","unknown":"unknown"},"healthDegraded":{"categories":{"cpu":"CPU usage and temperature","memory":"Memory and swap","storage":"Storage mounts and space","disks":"Disk I/O and errors","network":"Network interfaces","vms":"VMs and containers","services":"PVE services","logs":"System logs","updates":"System updates","security":"Security"},"severity":{"critical":"Critical","warning":"Warning"},"singleTitle":"{hostname}: {severity} health status – {category}","multipleTitle":"{hostname}: {count} health checks degraded","multipleLine":"• {severity}: {category}\n  {reason}","reasons":{"cpuSustained":"CPU is above {threshold}% for {duration}s."}},"digest":{"title":"{hostname}: 24h summary ({timestamp})","readFailed":"digest read failed: {error}","empty":"No INFO events buffered for this digest window.","lead":"{count} INFO events grouped by category:\n","more":"  • … and {count} more","footer":"(Critical/Warning events arrived at the time they happened, not in this digest.)","quietTitle":"{hostname}: {count} events buffered during Quiet Hours","groups":{"vm_ct":"VM a CT","backup":"Backup","resources":"Resources","storage":"Storage","network":"Network","security":"Security","cluster":"Cluster","services":"Services","health":"Health","updates":"Updates","hardware":"Hardware","system":"System","other":"Other"}},"test":{"title":"ProxMenux Test","welcome":"Welcome to ProxMenux Monitor!","verify":"This is a test message to verify your notification channel is working correctly.","configuration":"Channel configuration:","iconsEnabled":"Icons: enabled","iconsDisabled":"Icons: disabled","aiEnabled":"AI: enabled ({info})","aiDisabled":"AI: disabled","alerts":"You will receive alerts about system events, health status changes, and security incidents.","photoCaption":"You can use this image as the profile photo for your notification bot."},"channels":{"discord":{"category":"Category","host":"Host","severity":"Severity"},"email":{"report":"{group} Report","details":"Details","host":"Host","footer":"ProxMenux Notification Service","severity":{"critical":"Critical","warning":"Warning","info":"Information","ok":"Resolved","default":"Notice"},"groups":{"vm_ct":"Virtual Machine / Container","backup":"Backup & Snapshot","resources":"System Resources","storage":"Storage","network":"Network","security":"Security","cluster":"Cluster","services":"System Services","health":"Health Monitor","updates":"System Updates","system":"System","hardware":"Hardware","other":"System Notification"},"fields":{"vmCtId":"VM/CT ID","name":"Name","action":"Action","targetNode":"Target Node","reason":"Reason","storage":"Storage","status":"Status","size":"Size","duration":"Duration","snapshot":"Snapshot","metric":"Metric","currentValue":"Current Value","threshold":"Threshold","cpuCores":"CPU Cores","memory":"Memory","temperature":"Temperature","mountPoint":"Mount Point","usage":"Usage","available":"Available","device":"Device","severity":"Severity","storageName":"Storage Name","type":"Type","interface":"Interface","latency":"Latency","event":"Event","sourceIp":"Source IP","username":"Username","service":"Service","jail":"Jail","failures":"Failures","change":"Change","node":"Node","quorum":"Quorum","nodesAffected":"Nodes Affected","process":"Process","category":"Category","previousSeverity":"Previous Severity","activeIssues":"Active Issues","totalUpdates":"Total Updates","securityUpdates":"Security Updates","proxmoxUpdates":"Proxmox Updates","kernelUpdates":"Kernel Updates","importantPackages":"Important Packages","currentVersion":"Current Version","newVersion":"New Version"},"status":{"failed":"Failed","completed":"Completed","started":"Started","unconfirmed":"Unconfirmed","completed_with_warnings":"Completed with warnings"}}},"temperature":{"sampleSpan":"High samples span {duration}."},"backup":{"unconfirmedTitle":"{hostname}: Backup outcome unconfirmed","confirmedTitle":"{hostname}: Backup complete","confirmedBody":"Backup completed successfully.","errorTitle":"{hostname}: Backup error reported","errorBody":"The backup report contains an error.","unconfirmedBody":"The backup outcome is not confirmed.","warningTitle":"{hostname}: Backup completed with warnings","warningBody":"Backup completed with warnings.","diagnosticsOmitted":"Additional diagnostic lines or text omitted: {count}. Original report retained."}}}
+  "runtime": {"notifications":{"templates":{"state_change":{"title":"{hostname}: {category} changed to {current}{entity_suffix}","body":"{category} status changed from {previous} to {current}.\n{reason}","label":"Health state changed"},"new_error":{"title":"{hostname}: New {severity} - {category}{entity_suffix}","body":"{reason}","label":"New health issue"},"error_resolved":{"title":"{hostname}: Resolved - {category}{entity_suffix}","body":"The {category} issue has been resolved.\n{reason}\n🚦 Previous severity: {original_severity}\n⏱️ Duration: {duration}","label":"Recovery notification"},"error_escalated":{"title":"{hostname}: Escalated to {severity} - {category}{entity_suffix}","body":"{reason}","label":"Health issue escalated"},"health_degraded":{"title":"{title_or_default}","body":"{reason}","label":"Health check degraded"},"lxc_updates_available":{"title":"{hostname}: {count} LXC(s) with package updates available","body":"📊 {count} LXC(s) with pending package updates (📦 {total_packages} total, 🔒 {security_count} security):\n\n{ct_list}","label":"LXC updates available (experimental)"},"lxc_update_applied":{"title":"{hostname}: LXC {ct_name} ({vmid}) update {result}","body":"{details}","label":"LXC update applied"},"oci_update_completed":{"title":"{hostname}: {app_name} updated","body":"{app_name} was updated to its new image and its data was kept.\nContainers: {containers}","label":"OCI application updated"},"oci_update_failed":{"title":"{hostname}: {app_name} update did not complete","body":"The update of {app_name} did not complete.\nReason: {reason}\nContainers: {containers}\nOpen Manage installed OCI applications to check its state.","label":"OCI application update failed"},"oci_recreate_completed":{"title":"{hostname}: {app_name} recreated","body":"{app_name} was recreated with its saved configuration and its data was kept.\nContainers: {containers}","label":"OCI application recreated"},"oci_recreate_failed":{"title":"{hostname}: {app_name} recreation did not complete","body":"The recreation of {app_name} did not complete.\nReason: {reason}\nContainers: {containers}\nOpen Manage installed OCI applications to check its state.","label":"OCI application recreation failed"},"oci_modify_completed":{"title":"{hostname}: {app_name} modified","body":"{app_name} was modified with its new options and its data was kept.\nContainers: {containers}","label":"OCI application modified"},"oci_modify_failed":{"title":"{hostname}: {app_name} modification did not complete","body":"The modification of {app_name} did not complete.\nReason: {reason}\nContainers: {containers}\nOpen Manage installed OCI applications to check its state.","label":"OCI application modification failed"},"oci_watchdog_restarted":{"title":"{hostname}: {app_name} restarted after it stopped","body":"{app_name} stopped on its own and the watchdog started it again.\nContainers: {containers}","label":"OCI application restarted by the watchdog"},"oci_watchdog_failed":{"title":"{hostname}: {app_name} could not be kept running","body":"The watchdog could not keep {app_name} running: it stopped again or did not start after several attempts, and it is left stopped.\nContainers: {containers}\nStart it by hand once the cause is solved; the watchdog then watches it again.","label":"OCI application left stopped by the watchdog"},"app_update_available":{"title":"{hostname}: {app_name} update available on CT {vmid}","body":"{app_name} on CT {vmid} ({ct_name}) has a new version:\n    {installed} → {latest}","label":"App update available"},"docker_stack_update_available":{"title":"{hostname}: Docker updates available on CT {vmid}","body":"Container {ct_name} (CT {vmid}) has {count} Docker update(s):\n{details}","label":"Docker updates available"},"vm_start":{"title":"{hostname}: VM {vmname} ({vmid}) started","body":"Virtual machine {vmname} (ID: {vmid}) is now running.","label":"VM started"},"vm_start_warning":{"title":"{hostname}: VM {vmname} ({vmid}) started with warnings","body":"Virtual machine {vmname} (ID: {vmid}) started successfully but has warnings.\nWarnings: {reason}","label":"VM started (warnings)"},"vm_stop":{"title":"{hostname}: VM {vmname} ({vmid}) stopped","body":"Virtual machine {vmname} (ID: {vmid}) has been stopped.","label":"VM stopped"},"vm_shutdown":{"title":"{hostname}: VM {vmname} ({vmid}) shut down","body":"Virtual machine {vmname} (ID: {vmid}) has been cleanly shut down.","label":"VM shutdown"},"vm_fail":{"title":"{hostname}: VM {vmname} ({vmid}) FAILED","body":"Virtual machine {vmname} (ID: {vmid}) has crashed or failed to start.\nReason: {reason}","label":"VM FAILED"},"vm_restart":{"title":"{hostname}: VM {vmname} ({vmid}) restarted","body":"Virtual machine {vmname} (ID: {vmid}) has been restarted.","label":"VM restarted"},"ct_start":{"title":"{hostname}: CT {vmname} ({vmid}) started","body":"Container {vmname} (ID: {vmid}) is now running.","label":"CT started"},"ct_start_warning":{"title":"{hostname}: CT {vmname} ({vmid}) started with warnings","body":"Container {vmname} (ID: {vmid}) started successfully but has warnings.\nWarnings: {reason}","label":"CT started (warnings)"},"ct_stop":{"title":"{hostname}: CT {vmname} ({vmid}) stopped","body":"Container {vmname} (ID: {vmid}) has been stopped.","label":"CT stopped"},"ct_shutdown":{"title":"{hostname}: CT {vmname} ({vmid}) shut down","body":"Container {vmname} (ID: {vmid}) has been cleanly shut down.","label":"CT shutdown"},"ct_restart":{"title":"{hostname}: CT {vmname} ({vmid}) restarted","body":"Container {vmname} (ID: {vmid}) has been restarted.","label":"CT restarted"},"ct_fail":{"title":"{hostname}: CT {vmname} ({vmid}) FAILED","body":"Container {vmname} (ID: {vmid}) has crashed or failed to start.\nReason: {reason}","label":"CT FAILED"},"migration_start":{"title":"{hostname}: Migration started — {vmname} ({vmid})","body":"Live migration of {vmname} (ID: {vmid}) to node {target_node} has started.","label":"Migration started"},"migration_complete":{"title":"{hostname}: Migration complete — {vmname} ({vmid})","body":"{vmname} (ID: {vmid}) successfully migrated to node {target_node}.","label":"Migration complete"},"migration_warning":{"title":"{hostname}: Migration complete with warnings — {vmname} ({vmid})","body":"{vmname} (ID: {vmid}) migrated to node {target_node} but encountered warnings.\nWarnings: {reason}","label":"Migration (warnings)"},"migration_fail":{"title":"{hostname}: Migration FAILED — {vmname} ({vmid})","body":"Migration of {vmname} (ID: {vmid}) to node {target_node} failed.\nReason: {reason}","label":"Migration FAILED"},"replication_fail":{"title":"{hostname}: Replication FAILED — {vmname} ({vmid})","body":"Replication of {vmname} (ID: {vmid}) failed.\nReason: {reason}","label":"Replication FAILED"},"replication_complete":{"title":"{hostname}: Replication complete — {vmname} ({vmid})","body":"Replication of {vmname} (ID: {vmid}) completed successfully.","label":"Replication complete"},"backup_start":{"title":"{hostname}: Backup started on {storage}","body":"Backup job started on storage {storage}.\n{reason}","label":"Backup started"},"backup_complete":{"title":"{hostname} → {storage}: Backup complete — {vmname} ({vmid})","body":"Backup of {vmname} (ID: {vmid}) completed successfully on {storage}.\nSize: {size}","label":"Backup complete"},"backup_warning":{"title":"{hostname} → {storage}: Backup complete with warnings — {vmname} ({vmid})","body":"Backup of {vmname} (ID: {vmid}) on {storage} completed but encountered warnings.\nWarnings: {reason}","label":"Backup (warnings)"},"backup_fail":{"title":"{hostname} → {storage}: Backup FAILED — {vmname} ({vmid})","body":"Backup of {vmname} (ID: {vmid}) failed on {storage}.\nReason: {reason}","label":"Backup FAILED"},"host_backup_start":{"title":"{hostname}: Host backup started → {backend_label}","body":"Job: {job_id}\nBackend: {backend_label}\nDestination: {destination}\nProfile: {profile_mode}","label":"Host backup started"},"host_backup_complete":{"title":"{hostname}: Host backup complete → {backend_label}","body":"Job: {job_id}\nBackend: {backend_label}\nDestination: {destination}\nData size: {data_size}\nArchive size: {archive_size}\nDuration: {duration}","label":"Host backup complete"},"host_backup_fail":{"title":"{hostname}: Host backup FAILED → {backend_label}","body":"Job: {job_id}\nBackend: {backend_label}\nDestination: {destination}\nDuration before failure: {duration}\nReason: {reason}\nLog: {log_file}","label":"Host backup FAILED"},"snapshot_complete":{"title":"{hostname}: Snapshot created — {vmname} ({vmid})","body":"Snapshot \"{snapshot_name}\" created for {vmname} (ID: {vmid}).","label":"Snapshot created"},"snapshot_fail":{"title":"{hostname}: Snapshot FAILED — {vmname} ({vmid})","body":"Snapshot creation for {vmname} (ID: {vmid}) failed.\nReason: {reason}","label":"Snapshot FAILED"},"cpu_high":{"title":"{hostname}: High CPU usage — {value}%","body":"CPU usage has reached {value}% on {cores} cores.\n{details}","label":"High CPU usage"},"ram_high":{"title":"{hostname}: High memory usage — {value}%","body":"Memory usage: {used} / {total} ({value}%).\n{details}","label":"High memory usage"},"temp_high":{"title":"{hostname}: High sensor temperature — {value}°C","body":"Sensor temperature has reached {value}°C (threshold: {threshold}°C).\n{details}","label":"High temperature"},"disk_space_low":{"title":"{hostname}: Low disk space on {mount}","body":"Filesystem {mount}: {used}% used ({available} available).\nFree up disk space to avoid service disruption.","label":"Low disk space"},"disk_io_error":{"title":"{hostname}: Disk failure detected — {device}","body":"I/O error or disk failure detected on device {device}.\n{reason}","label":"Disk failure / I/O error"},"storage_unavailable":{"title":"{hostname}: Storage unavailable — {storage_name}","body":"PVE storage \"{storage_name}\" (type: {storage_type}) is not accessible.\nReason: {reason}","label":"Storage unavailable"},"smart_test_complete":{"title":"{hostname}: SMART test completed — {device}","body":"SMART {test_type} test on /dev/{device} has completed.\nResult: {result}\nDuration: {duration}","label":"SMART test completed"},"smart_test_failed":{"title":"{hostname}: SMART test FAILED — {device}","body":"SMART {test_type} test on /dev/{device} has failed.\nResult: {result}\nReason: {reason}","label":"SMART test FAILED"},"gpu_mode_switch":{"title":"{hostname}: GPU mode changed to {new_mode}","body":"GPU passthrough mode has been switched.\nGPU: {gpu_name} ({gpu_pci})\nPrevious mode: {old_mode}\nNew mode: {new_mode}\n{details}","label":"GPU mode switched"},"gpu_passthrough_blocked":{"title":"{hostname}: {guest_type} {guest_id} blocked at startup","body":"PCIe passthrough guard prevented {guest_type} {guest_id} ({guest_name}) from starting.\nReason: {reason}\n{details}","label":"GPU passthrough blocked"},"pci_passthrough_conflict":{"title":"{hostname}: PCIe device conflict detected — {device_pci}","body":"A PCIe device is assigned to multiple guests.\nDevice: {device_pci}\nConflicting guests: {guest_list}\nAction required: Stop one of the guests or reassign the device.","label":"PCIe device conflict"},"load_high":{"title":"{hostname}: High system load — {value}","body":"System load average is {value} on {cores} cores.\n{details}","label":"High system load"},"network_down":{"title":"{hostname}: Network connectivity lost{entity_suffix}","body":"The node has lost network connectivity.\nReason: {reason}","label":"Network connectivity lost"},"network_latency":{"title":"{hostname}: High network latency — {value}ms","body":"Latency to gateway: {value}ms (threshold: {threshold}ms).\nThis may indicate network congestion or hardware issues.","label":"High network latency"},"auth_fail":{"title":"{hostname}: Authentication failure","body":"Failed login attempt detected.\nSource IP: {source_ip}\nUser: {username}\nService: {service}","label":"Authentication failure"},"ip_block":{"title":"{hostname}: IP blocked by Fail2Ban","body":"IP address {source_ip} has been banned.\nJail: {jail}\nFailed attempts: {failures}","label":"IP blocked by Fail2Ban"},"firewall_issue":{"title":"{hostname}: Firewall issue detected{entity_suffix}","body":"A firewall configuration issue has been detected.\nReason: {reason}","label":"Firewall issue detected"},"user_permission_change":{"title":"{hostname}: User permission changed","body":"User: {username}\nChange: {change_details}","label":"User permission changed"},"split_brain":{"title":"{hostname}: Cluster event reported","body":"A cluster event was reported:\n{reason}","label":"Cluster event"},"node_disconnect":{"title":"{hostname}: Node {node_name} disconnected","body":"Node {node_name} has disconnected from the cluster.","label":"Node disconnected"},"node_reconnect":{"title":"{hostname}: Node {node_name} reconnected","body":"Node {node_name} has rejoined the cluster successfully.","label":"Node reconnected"},"system_startup":{"title":"{hostname}: {reason}","body":"{summary}","label":"System startup report"},"system_shutdown":{"title":"{hostname}: System shutting down","body":"The node is shutting down.\n{reason}","label":"System shutting down"},"system_reboot":{"title":"{hostname}: System rebooting","body":"The node is rebooting.\n{reason}","label":"System rebooting"},"system_restore_completed":{"title":"{hostname}: Host restore finished","body":"Post-restore tasks completed in background.\n\nGuest configurations copied: {guests}\nBind-mount stub directories created: {stubs}\nStale node dirs removed: {stale_nodes}\nComponents reinstalled: {components}\nDuration: {duration}\n{warnings_block}","label":"Host restore completed"},"system_problem":{"title":"{hostname}: System problem detected{entity_suffix}","body":"A system-level problem has been detected.\nReason: {reason}","label":"System problem detected"},"service_fail":{"title":"{hostname}: Service failed — {service_name}","body":"System service \"{service_name}\" has failed.\nReason: {reason}","label":"Service failed"},"oom_kill":{"title":"{hostname}: OOM Kill — {process}","body":"Process \"{process}\" was killed by the Out-of-Memory manager.\n{reason}","label":"Out of memory kill"},"service_fail_batch":{"title":"{hostname}: {service_count} services failed{entity_suffix}","body":"{reason}","label":"Service fail batch"},"cron_output":{"title":"{hostname}: {pve_title}","body":"{reason}","label":"Cron job output (per-cron stdout via mail)"},"system_mail":{"title":"{hostname}: {pve_title}","body":"{reason}","label":"Smartd / mail bounces (PVE system mail)"},"apt_listchanges":{"title":"{hostname}: {pve_title}","body":"Upstream package information forwarded by Proxmox VE through apt-listchanges. The following text comes from the package maintainer and is not a ProxMenux recommendation.\n\n{reason}","label":"apt-listchanges package notices"},"webhook_test":{"title":"{hostname}: Webhook test received","body":"PVE webhook connectivity test successful.\n{reason}","label":"Webhook test"},"update_available":{"title":"{hostname}: Updates available","body":"Total updates: {total_count}\nSecurity: {security_count}\nProxmox: {pve_count}\nKernel: {kernel_count}\nImportant packages:\n{important_list}","label":"Updates available (legacy)"},"unknown_persistent":{"title":"{hostname}: Check unavailable - {category}{entity_suffix}","body":"Health check for {category} has been unavailable for 3+ cycles.\n{reason}","label":"Check unavailable"},"health_persistent":{"title":"{hostname}: {count} active health issue(s){entity_suffix}","body":"The following health issues remain unresolved:\n{issue_list}\n\nThis digest is sent once every 24 hours while issues persist.","label":"Active health issues (daily)"},"health_issue_new":{"title":"{hostname}: New health issue — {category}{entity_suffix}","body":"New {severity} issue detected in: {category}\nDetails: {reason}","label":"New health issue"},"health_issue_resolved":{"title":"{hostname}: Resolved - {category}{entity_suffix}","body":"{category} issue has been resolved.\n{reason}\nDuration: {duration}","label":"Health issue resolved"},"update_summary":{"title":"{hostname}: Updates available","body":"Total updates: {total_count}\nSecurity updates: {security_count}\nProxmox-related updates: {pve_count}\nKernel updates: {kernel_count}\nImportant packages:\n{important_list}","label":"Host package updates"},"pve_update":{"title":"{hostname}: Proxmox VE {new_version} available","body":"A new Proxmox VE release is available.\nCurrent: {current_version}\nNew: {new_version}\n{details}","label":"Proxmox VE update available"},"update_complete":{"title":"{hostname}: System update completed","body":"System packages have been successfully updated.\n{details}","label":"Host update completed"},"ai_model_migrated":{"title":"{hostname}: AI model updated","body":"The AI model for notifications has been automatically updated.\nProvider: {provider}\nPrevious model: {old_model}\nNew model: {new_model}\n\n{message}","label":"AI model auto-updated"},"proxmenux_update":{"title":"{hostname}: ProxMenux {new_version} available","body":"A new version of ProxMenux is available.\nCurrent: {current_version}\nNew: {new_version}","label":"ProxMenux update available"},"mount_stale":{"title":"{hostname}: stale remote mount {mount_target}","body":"Remote mount {mount_target} ({fstype}) from {mount_source} is stale{lxc_scope}.\nStat timed out or returned an error: {error}\n\nApps writing to this path will silently land on the underlying filesystem and may fill the disk. Remount or fix connectivity ASAP.","label":"Remote mount stale"},"mount_readonly":{"title":"{hostname}: remote mount {mount_target} is read-only","body":"Remote mount {mount_target} ({fstype}) from {mount_source} is mounted read-only{lxc_scope}. Writes will fail. If this was unintentional, remount with rw.","label":"Remote mount read-only"},"lxc_disk_low":{"title":"{hostname}: CT {vmid} rootfs at {usage_percent}%","body":"CT {vmid} ({name}) rootfs is at {usage_percent}% ({disk_bytes_human} / {maxdisk_bytes_human}).\n\nA full LXC rootfs prevents the container from booting cleanly. Either expand the rootfs (pct resize {vmid} rootfs +1G) or free space inside the container.","label":"LXC rootfs near full"},"vm_disk_low":{"title":"{hostname}: VM {vmid} filesystems at {usage_percent}%","body":"VM {vmid} ({name}) guest filesystems are at {usage_percent}% ({disk_bytes_human} / {maxdisk_bytes_human}).\n\nReported by the QEMU guest agent. Includes every persistent filesystem the guest mounts on a block device — virtual disks and PCI-passthrough drives alike. Free up space inside the guest or expand the affected storage before writes start to fail.","label":"VM filesystems near full"},"lxc_mount_low":{"title":"{hostname}: CT {vmid} mount {mount} at {usage_percent}%","body":"Mount {mount} inside CT {vmid} ({name}) is at {usage_percent}% used.\nFilesystem type: {fstype}\n\nA full mount inside a container often blocks the application silently — writes either fail or, worse, land on the rootfs and trigger the rootfs alert next. Free up space on the mount or expand it.","label":"LXC mount near full"},"pve_storage_full":{"title":"{hostname}: PVE storage {storage_name} at {usage_percent}%","body":"Proxmox storage \"{storage_name}\" (type: {storage_type}) is at {usage_percent}% used.\n\nOnce full, no new VM/CT can be provisioned and existing guests may fail to write. Move/delete unused volumes or expand the underlying pool/LV/RBD image.","label":"PVE storage near full"},"zfs_pool_full":{"title":"{hostname}: ZFS pool {pool_name} at {usage_percent}%","body":"ZFS pool \"{pool_name}\" is at {usage_percent}% capacity.\n\nZFS performance and write reliability degrade sharply above ~80% capacity (CoW needs free space for new blocks). Free up snapshots, prune old datasets, or add more vdevs to the pool.","label":"ZFS pool near full"},"post_install_update":{"title":"{hostname}: {count} ProxMenux optimization update(s) available","body":"{count} ProxMenux optimization update(s) available on this host.\n\n🛠️ Available versions:\n{tool_list}\n\n💡 Apply from:\n  • ProxMenux Monitor → Settings → ProxMenux Optimizations\n  • Or open the ProxMenux menu → Settings post-install Proxmox → \"Apply available updates\"","label":"ProxMenux optimization updates available"},"secure_gateway_update_available":{"title":"{hostname}: {app_name} update available{update_title_suffix}","body":"{app_name} (managed by ProxMenux) has 📦 {package_count} package update(s) pending in its container.\n{version_line}\n\n💡 Open ProxMenux Monitor > Security > Secure Gateway and click \"Update\" to apply.\n\n🗂️ Packages:\n{package_list}","label":"Secure Gateway update available"},"nvidia_driver_update_available":{"title":"{hostname}: NVIDIA driver update available — v{latest_version}","body":"A newer maintenance release is available for the installed NVIDIA driver branch.\n🔹 Currently installed: v{current_version}\n🟢 Latest available:    v{latest_version}\n\n{upgrade_reason}\n\n💡 To reinstall:\n  • From the ProxMenux post-install menu: {menu_label}\n\nReinstalling rebuilds the DKMS module against the running kernel and requires a reboot to load the new driver.","label":"NVIDIA driver update available"},"coral_driver_update_available":{"title":"{hostname}: Coral TPU driver update available — {latest_version}","body":"A newer {variant_label} is available.\n🔹 Currently installed: {current_version}\n🟢 Latest available:    {latest_version}\n\n{upgrade_reason}\n\n💡 To reinstall:\n  • From the ProxMenux post-install menu: {menu_label}\n\n{reboot_note}","label":"Coral TPU driver update available"},"burst_auth_fail":{"title":"{hostname}: +{count} more auth failures in {window}","body":"+{count} additional authentication failures detected in {window} ({total_count} total).\nSources: {entity_list}","label":"Auth failures burst"},"burst_ip_block":{"title":"{hostname}: Fail2Ban banned +{count} more IPs in {window}","body":"+{count} additional IPs banned by Fail2Ban in {window} ({total_count} total).\nIPs: {entity_list}","label":"IP block burst"},"burst_disk_io":{"title":"{hostname}: +{count} more disk I/O errors on {entity_list}","body":"+{count} additional I/O errors detected in {window} ({total_count} total).\nDevices: {entity_list}","label":"Disk I/O burst"},"burst_cluster":{"title":"{hostname}: Cluster flapping detected (+{count} more changes)","body":"Cluster state changed +{count} more times in {window} ({total_count} total).\nNodes: {entity_list}","label":"Cluster flapping burst"},"burst_service_fail":{"title":"{hostname}: +{count} more services failed in {window}","body":"+{count} additional service failures detected in {window} ({total_count} total).\nThis typically indicates a node reboot or PVE service restart.\n\nAdditional failures:\n{details}","label":"Service fail burst"},"burst_system":{"title":"{hostname}: +{count} more system problems in {window}","body":"+{count} additional system problems detected in {window} ({total_count} total).\n\nAdditional issues:\n{details}","label":"System problems burst"},"burst_generic":{"title":"{hostname}: +{count} more {event_type} events in {window}","body":"+{count} additional events of type {event_type} in {window} ({total_count} total).\n\nAdditional events:\n{details}","label":"Generic burst"},"kernel_warning":{"title":"{hostname}: Kernel diagnostic event detected","body":"The kernel recorded a diagnostic event: {kernel_details}","label":"Kernel warnings and diagnostic traces"}},"lxcUpdate":{"status":{"success":"succeeded","failure":"failed","partial":"completed partially","deferred":"deferred","skipped":"skipped"},"source":{"scheduled":"Scheduled","manual":"Manual"},"sourceLabel":"Source","targets":"Targets","osPending":"OS packages pending: {before} → {after}","osUnverified":"OS packages: update command executed; result not verified","applications":"Applications: {items}","applicationsUnverified":"Applications: updater executed; no tracked version change was observed","dockerEngineChange":"Docker Engine: {before} → {after}","dockerEngineVerified":"Docker Engine: verified at {version}","dockerEngineUnverified":"Docker Engine: update command executed; version not verified","dockerImagesPending":"Docker images pending: {before} → {after}","dockerImagesChanged":"Docker images changed: {images}","deferredTargets":"Deferred targets: {targets}","reason":"Reason: {reason}","restartRequired":"Restart required: {value}","yes":"yes","no":"no","verificationPending":"Verification pending until the container is running","verificationWarning":"Verification warning: {error}","duration":"Duration: {duration}"},"fallback":{"unknownTitle":"{hostname}: {event_type}","healthCheckDegraded":"Health check degraded","none":"none","temperatureAlertTitle":"{hostname}: Sensor temperature alert","temperatureAlertBody":"Temperature alert recorded without a complete measurement payload.","recordedReason":"Recorded reason: {reason}","recordedDetails":"Recorded details: {details}"},"fields":{"vmid":"VM/CT","name":"Name","device":"Device","sourceIp":"Source IP","node":"Node","category":"Category","service":"Service","jail":"Jail","user":"User","count":"Count","window":"Window","affected":"Affected"},"vzdump":{"size":"Size: {value}","duration":"Duration: {value}","file":"File","backups":"{count} backups","failed":"{count} failed","total":"Total: {value}","time":"Time: {value}"},"startup":{"issuesTitle":"{hostname}: System startup - {count} issue(s) detected","completeTitle":"{hostname}: System startup completed","operational":"All systems operational.","vmCountOne":"{count} VM","vmCountMany":"{count} VMs","ctCountOne":"{count} CT","ctCountMany":"{count} CTs","started":"✅ {counts} started","vmFailed":"❌ VM failed: {name} - {reason}","ctFailed":"❌ CT failed: {name} - {reason}","unknownError":"unknown error","storageUnavailable":"⚠️ Storage: {count} unavailable ({names})","servicesFailed":"⚠️ Services: {count} failed ({names})","duration":"⏱️ Startup completed in {minutes} min"},"appUpdates":{"singleTitle":"{hostname}: {app_name} update available on CT {vmid}","singleBody":"{app_name} on CT {vmid} ({ct_name}) has a new version:\n    {installed} → {latest}","emptyTitle":"{hostname}: Application updates available","emptyBody":"Application updates are available.","batchTitle":"{hostname}: {count} application updates available","batchLeadOneContainer":"{count} applications in {container_count} LXC container have a newer version:","batchLeadManyContainers":"{count} applications in {container_count} LXC containers have a newer version:","additional":"… {count} additional application(s)","app":"app","unknown":"unknown"},"healthDegraded":{"categories":{"cpu":"CPU usage and temperature","memory":"Memory and swap","storage":"Storage mounts and space","disks":"Disk I/O and errors","network":"Network interfaces","vms":"VMs and containers","services":"PVE services","logs":"System logs","updates":"System updates","security":"Security"},"severity":{"critical":"Critical","warning":"Warning"},"singleTitle":"{hostname}: {severity} health status – {category}","multipleTitle":"{hostname}: {count} health checks degraded","multipleLine":"• {severity}: {category}\n  {reason}","reasons":{"cpuSustained":"CPU is above {threshold}% for {duration}s."}},"digest":{"title":"{hostname}: 24h summary ({timestamp})","readFailed":"digest read failed: {error}","empty":"No INFO events buffered for this digest window.","lead":"{count} INFO events grouped by category:\n","more":"  • … and {count} more","footer":"(Critical/Warning events arrived at the time they happened, not in this digest.)","quietTitle":"{hostname}: {count} events buffered during Quiet Hours","groups":{"vm_ct":"VM a CT","backup":"Backup","resources":"Resources","storage":"Storage","network":"Network","security":"Security","cluster":"Cluster","services":"Services","health":"Health","updates":"Updates","hardware":"Hardware","system":"System","other":"Other"}},"test":{"title":"ProxMenux Test","welcome":"Welcome to ProxMenux Monitor!","verify":"This is a test message to verify your notification channel is working correctly.","configuration":"Channel configuration:","iconsEnabled":"Icons: enabled","iconsDisabled":"Icons: disabled","aiEnabled":"AI: enabled ({info})","aiDisabled":"AI: disabled","alerts":"You will receive alerts about system events, health status changes, and security incidents.","photoCaption":"You can use this image as the profile photo for your notification bot."},"channels":{"discord":{"category":"Category","host":"Host","severity":"Severity"},"email":{"report":"{group} Report","details":"Details","host":"Host","footer":"ProxMenux Notification Service","severity":{"critical":"Critical","warning":"Warning","info":"Information","ok":"Resolved","default":"Notice"},"groups":{"vm_ct":"Virtual Machine / Container","backup":"Backup & Snapshot","resources":"System Resources","storage":"Storage","network":"Network","security":"Security","cluster":"Cluster","services":"System Services","health":"Health Monitor","updates":"System Updates","system":"System","hardware":"Hardware","other":"System Notification"},"fields":{"vmCtId":"VM/CT ID","name":"Name","action":"Action","targetNode":"Target Node","reason":"Reason","storage":"Storage","status":"Status","size":"Size","duration":"Duration","snapshot":"Snapshot","metric":"Metric","currentValue":"Current Value","threshold":"Threshold","cpuCores":"CPU Cores","memory":"Memory","temperature":"Temperature","mountPoint":"Mount Point","usage":"Usage","available":"Available","device":"Device","severity":"Severity","storageName":"Storage Name","type":"Type","interface":"Interface","latency":"Latency","event":"Event","sourceIp":"Source IP","username":"Username","service":"Service","jail":"Jail","failures":"Failures","change":"Change","node":"Node","quorum":"Quorum","nodesAffected":"Nodes Affected","process":"Process","category":"Category","previousSeverity":"Previous Severity","activeIssues":"Active Issues","totalUpdates":"Total Updates","securityUpdates":"Security Updates","proxmoxUpdates":"Proxmox Updates","kernelUpdates":"Kernel Updates","importantPackages":"Important Packages","currentVersion":"Current Version","newVersion":"New Version"},"status":{"failed":"Failed","completed":"Completed","started":"Started","unconfirmed":"Unconfirmed","completed_with_warnings":"Completed with warnings"}}},"temperature":{"sampleSpan":"High samples span {duration}."},"backup":{"unconfirmedTitle":"{hostname}: Backup outcome unconfirmed","confirmedTitle":"{hostname}: Backup complete","confirmedBody":"Backup completed successfully.","errorTitle":"{hostname}: Backup error reported","errorBody":"The backup report contains an error.","unconfirmedBody":"The backup outcome is not confirmed.","warningTitle":"{hostname}: Backup completed with warnings","warningBody":"Backup completed with warnings.","diagnosticsOmitted":"Additional diagnostic lines or text omitted: {count}. Original report retained."}}},
+  "monitorLinks": {
+    "thisNode": "This node",
+    "checking": "Checking nodes…",
+    "loadFailed": "Could not load the node list.",
+    "empty": "No other nodes yet. Add one to open its Monitor from here.",
+    "groups": {
+      "cluster": "Cluster",
+      "standalone": "Standalone nodes",
+      "pbs": "Proxmox Backup Server"
+    },
+    "noResponse": "No response",
+    "pbsInterface": "PBS interface",
+    "openNewTab": "Open in a new tab",
+    "manage": "Add or manage nodes…",
+    "dialogTitle": "Linked nodes",
+    "dialogDescription": "Cluster nodes and configured Proxmox Backup Servers are detected automatically. Each Monitor keeps its own sign-in.",
+    "addTitle": "Add a node",
+    "name": "Name",
+    "address": "Monitor address",
+    "type": "Type",
+    "add": "Add",
+    "save": "Save",
+    "remove": "Remove",
+    "visible": "Visible",
+    "autoAddress": "Automatic",
+    "detected": "Detected",
+    "added": "Added",
+    "saveFailed": "Could not save the node list.",
+    "backTo": "Back to {name}",
+    "cameFromTitle": "Add Monitor node?",
+    "cameFromBody": "Add {name} to the linked nodes of this Monitor.",
+    "notNow": "Not now"
+  }
 }
diff --git a/AppImage/messages/es/common.json b/AppImage/messages/es/common.json
index d887cf9d..b54cead2 100644
--- a/AppImage/messages/es/common.json
+++ b/AppImage/messages/es/common.json
@@ -1,8 +1,70 @@
 {
+  "pbs": {
+    "title": "Proxmox Backup Server",
+    "server": "Servidor PBS",
+    "chooseServer": "Selecciona un servidor PBS",
+    "local": "PBS local",
+    "refresh": "Actualizar",
+    "manage": "Gestionar conexiones PBS",
+    "loadFailed": "No se pudo consultar el estado de PBS.",
+    "loading": "Cargando datos de PBS…",
+    "noServer": "Añade una conexión PBS para ver datastores, tareas y programaciones.",
+    "permissionsHelp": "Activa la autenticación de Monitor antes de guardar credenciales. Usa un token API dedicado de PBS con el rol Audit en / para el usuario y el token, con propagación. Este panel solo consulta datos de PBS.",
+    "editConnection": "Conexión que deseas editar",
+    "add": "Añadir una conexión",
+    "name": "Nombre",
+    "url": "URL HTTPS (incluye :8007 para el puerto nativo de PBS)",
+    "token_id": "ID del token API (usuario@realm!token)",
+    "token_secret": "Secreto del token API (vacío para conservar el guardado)",
+    "fingerprint": "Huella SHA256 del certificado (opcional)",
+    "tlsHelp": "Deja la huella vacía para verificar la CA y el nombre del servidor. Si el certificado es autofirmado, copia su huella SHA256 desde la consola de PBS u otro canal fiable. Se verifica antes de enviar las credenciales.",
+    "saved": "Conexión PBS verificada y guardada.",
+    "saveFailed": "No se pudo guardar la conexión PBS.",
+    "testing": "Verificando conexión…",
+    "save": "Verificar y guardar",
+    "remove": "Eliminar conexión",
+    "removeConfirm": "¿Eliminar de Monitor esta conexión PBS y su token guardado? Los datos y las tareas de PBS no se modifican.",
+    "sampled": "Consulta realizada a las",
+    "datastores": "Datastores",
+    "total": "Capacidad del sistema de archivos",
+    "used": "Usado",
+    "free": "Disponible",
+    "noDatastores": "No hay datastores accesibles. Revisa su configuración y los permisos del usuario y del token.",
+    "tasks": "Tareas recientes",
+    "noTasks": "No se han devuelto tareas recientes.",
+    "task": "Tarea",
+    "started": "Inicio",
+    "status": "Estado",
+    "running": "En ejecución",
+    "jobs": "Programaciones de mantenimiento",
+    "job": "Tarea",
+    "schedule": "Programación",
+    "sync": "Sincronización",
+    "verify": "Verificación",
+    "prune": "Prune",
+    "overview": "Resumen",
+    "logs": "Registros del sistema",
+    "terminal": "Terminal",
+    "security": "Seguridad",
+    "logout": "Cerrar sesión",
+    "navigation": "Navegación de PBS",
+    "cpu": "CPU",
+    "memory": "Memoria",
+    "uptime": "Tiempo de actividad",
+    "capacityUnavailable": "Capacidad no disponible.",
+    "datastoresUnavailable": "{count} no disponibles",
+    "datastoresOnline": "Todos disponibles",
+    "moreDatastores": "+{count} datastores más",
+    "estimatedFull": "Lleno previsto",
+    "estimatedFullUnknown": "Aún no hay datos suficientes",
+    "duration": "Duración",
+    "noJobs": "No hay programaciones de sincronización, verificación ni prune."
+  },
   "_meta": "Community translation target. Copy keys from ../en/common.json and translate the values.",
   "app": {
     "title": "ProxMenux Monitor",
     "description": "Panel del sistema Proxmox",
+    "descriptionPbs": "Panel de Proxmox Backup Server",
     "loading": "Cargando...",
     "connecting": "Conexión al ProxMenux Monitor",
     "unknown": "Desconocido",
@@ -140,6 +202,7 @@
       "dayMany": "{count} días"
     },
     "proxmoxVersion": "Versión Proxmox:",
+    "pbsVersion": "Versión PBS:",
     "kernel": "Núcleo:",
     "availableUpdates": "Actualizaciones disponibles:",
     "packages": "paquetes",
@@ -607,7 +670,7 @@
         "controllerBusyTime": "Minutos totales que el controlador pasó procesando comandos de E/S. Los valores altos indican una carga de trabajo pesada y sostenida.",
         "errorLogEntries": "Número de entradas en el registro de información de errores. A menudo incluye artefactos benignos de autoevaluación; verifique con Errores de Medios.",
         "warningTempTime": "Total de minutos transcurridos por encima del umbral de temperatura de advertencia. Provoca una limitación del rendimiento. El cero es ideal.",
-        "criticalTempTime": "Minutos totales pasados ​​por encima del umbral de temperatura crítica. La unidad puede apagarse para evitar daños. Siempre debe ser cero.",
+        "criticalTempTime": "Minutos totales pasados por encima del umbral de temperatura crítica. La unidad puede apagarse para evitar daños. Siempre debe ser cero.",
         "warningCompositeTemperatureTime": "Minutos totales que la temperatura compuesta superó el umbral de advertencia.",
         "criticalCompositeTemperatureTime": "Minutos totales la temperatura compuesta superó el umbral crítico. Debe ser cero.",
         "thermalManagementT1TransCount": "Número de veces que la unidad entró en aceleración térmica ligera (T1). Indica problemas de enfriamiento.",
@@ -1110,7 +1173,21 @@
       "available": "Backups disponibles",
       "loading": "Cargando backups...",
       "empty": "No se encontraron backups",
-      "emptyHint": "Crea tu primer backup con el botón de arriba"
+      "emptyHint": "Crea tu primer backup con el botón de arriba",
+      "refresh": "Actualizar",
+      "refreshFailed": "No se pudieron actualizar los backups. Vuelve a actualizar para confirmar su estado actual.",
+      "deleteSelected": "Eliminar los seleccionados ({count})",
+      "deletedCount": "{count} backup(s) eliminado(s).",
+      "unconfirmedCount": "No se ha confirmado la eliminación de {count} backup(s). Actualiza la lista y comprueba las tareas de Proxmox antes de volver a intentarlo.",
+      "deleteFailed": "No se pudo confirmar la eliminación. Actualiza la lista y comprueba las tareas de Proxmox antes de volver a intentarlo.",
+      "selectHint": "Selecciona backups sin protección (hasta 20 por lote)",
+      "selectBackup": "Seleccionar backup",
+      "protected": "Protegido",
+      "confirmTitle": "¿Eliminar {count} backup(s)?",
+      "confirmDescription": "Los archivos de backup de la VM/CT {vmid} se eliminarán de forma permanente. Los backups protegidos quedan fuera. La VM o el contenedor no se eliminan.",
+      "deleting": "Esperando a que Proxmox termine de eliminar los archivos seleccionados…",
+      "cancel": "Cancelar",
+      "confirmDelete": "Eliminar backups"
     },
     "updatesPanel": {
       "pendingTitle": "Actualizaciones de paquetes pendientes",
@@ -1646,6 +1723,16 @@
       "searchApplications": "Buscar aplicaciones",
       "searchingApplications": "Buscando aplicaciones…",
       "noApplicationsDetected": "No se han detectado aplicaciones.",
+      "nativeEvidencePort": "Puerto TCP a la escucha",
+      "nativeEvidenceFile": "Archivo instalado",
+      "nativeEvidenceProcess": "Ejecutable en marcha",
+      "nativeEvidenceDirectory": "Directorio de trabajo",
+      "nativeEvidenceService": "Definición del servicio",
+      "nativeScanFailed": "La búsqueda de aplicaciones no ha podido terminar. Lo detectado antes puede estar desactualizado; vuelve a intentarlo.",
+      "nativeScanPartial": "La búsqueda de aplicaciones está incompleta. Revisa lo que se ha encontrado y vuelve a intentarlo.",
+      "nativeVersionUnknown": "Versión instalada desconocida",
+      "nativeEvidenceStale": "Lo detectado puede estar desactualizado o incompleto.",
+      "nativeRegisterOnly": "Confirma el registro en el editor. Una versión conocida se guarda como valor manual; no se configura ningún actualizador.",
       "noNewApplicationsDetected": "No se han detectado aplicaciones nuevas.",
       "oneNewApplicationDetected": "Se ha detectado una aplicación nueva.",
       "newApplicationsDetected": "Se han detectado {count} aplicaciones nuevas.",
@@ -1814,6 +1901,7 @@
         "network": "Interfaces de red",
         "vms": "Máquinas virtuales y contenedores",
         "services": "Servicios PVE",
+        "pbsServices": "Servicios PBS",
         "logs": "Registros del sistema",
         "updates": "Actualizaciones del sistema",
         "security": "Seguridad y certificados",
@@ -2111,7 +2199,13 @@
         "inactiveFooter": "Habilite notificaciones para recibir alertas del sistema, de salud y de seguridad a través de los canales configurados.",
         "notificationLanguage": "Idioma de notificación",
         "selectNotificationLanguage": "Seleccione el idioma de notificación",
-        "notificationLanguageHint": "Se utiliza para notificaciones deterministas en tiempo de ejecución incluso cuando la IA está deshabilitada."
+        "notificationLanguageHint": "Se utiliza para notificaciones deterministas en tiempo de ejecución incluso cuando la IA está deshabilitada.",
+        "appriseServiceHelp": "Configuración de Slack y Matrix",
+        "appriseSlackSteps": "Crea un webhook entrante en tu aplicación de Slack para el canal de destino y pega su URL HTTPS completa en URL de Apprise. No hace falta convertirla.",
+        "appriseSlackDocs": "Formatos de URL y configuración de Slack",
+        "appriseMatrixSteps": "Utiliza una cuenta de notificaciones que pueda publicar en la sala. Sustituye el usuario, la contraseña, el servidor de origen y el ID completo de la sala del ejemplo; codifica para URL los caracteres especiales de las credenciales. El esquema matrixs utiliza HTTPS. Consulta en la documentación la compatibilidad con tokens, SSO y salas cifradas de tu versión de Apprise.",
+        "appriseMatrixDocs": "Formatos de URL y configuración de Matrix",
+        "appriseServiceFinish": "Activa Apprise, introduce tu URL, elige las categorías de notificación o los eventos individuales, guarda y utiliza Enviar prueba. Estos ejemplos no cambian tu URL guardada. Este canal de Apprise tiene un único destino; utiliza la API de Apprise para varios servicios a la vez."
       },
       "ai": {
         "title": "mejora de la IA",
@@ -2579,7 +2673,7 @@
       "expires": "Vence",
       "selfSignedWarning": "Los certificados autofirmados pueden mostrar una advertencia en el navegador. Esto es normal para las configuraciones locales de Proxmox.",
       "configuring": "Configurando...",
-      "useProxmoxCertificate": "Utilice el certificado Proxmox",
+      "useProxmoxCertificate": "Usar certificado de Proxmox",
       "noProxmoxCertificate": "No se detectó ningún certificado Proxmox.",
       "useCustomCertificate": "Usar certificado personalizado",
       "customPaths": "Rutas de certificados personalizadas",
@@ -3566,8 +3660,8 @@
       "short": {
         "hour": "Pasada 1 hora",
         "day": "Pasadas 24h",
-        "week": "Pasados ​​los 7 días",
-        "month": "Pasados ​​los 30 días",
+        "week": "Pasados los 7 días",
+        "month": "Pasados los 30 días",
         "year": "Último 1 año"
       },
       "last": {
@@ -4756,6 +4850,24 @@
       "thursday": "Jueves",
       "tuesday": "Martes",
       "wednesday": "Miércoles"
+    },
+    "storageRetention": {
+      "useDefault": "Usar el valor por defecto de Proxmox (sin política en este almacenamiento)",
+      "title": "Retención del almacenamiento",
+      "keepAll": "Conservar todos los backups",
+      "description": "Retención por defecto de los backups, guardada en Proxmox. Las tareas de backup con su propia política tienen prioridad sobre ella.",
+      "refresh": "Actualizar",
+      "saved": "Retención guardada. No se ha purgado ningún backup.",
+      "choosePolicy": "Elige Conservar todos o al menos un número de retención mayor que cero.",
+      "saveFailed": "No se pudo guardar la retención del almacenamiento. Actualiza la lista si ha cambiado la configuración.",
+      "loadFailed": "No se pudo cargar la retención del almacenamiento.",
+      "empty": "No hay almacenamientos de backups.",
+      "default": "Valor por defecto de Proxmox",
+      "edit": "Editar",
+      "editTitle": "Retención de {storage}",
+      "effect": "Se aplica a los próximos backups que hereden la política de este almacenamiento. Guardar no elimina los backups existentes, y los protegidos siguen protegidos.",
+      "cancel": "Cancelar",
+      "save": "Guardar retención"
     }
   },
   "healthStatus": {
@@ -4783,7 +4895,8 @@
       "disks": "E/S de disco y errores",
       "network": "Interfaces de red",
       "vms": "Máquinas virtuales y contenedores",
-      "services": "servicios PVE",
+      "services": "Servicios PVE",
+      "pbsServices": "Servicios PBS",
       "logs": "Registros del sistema",
       "updates": "Actualizaciones del sistema",
       "security": "Seguridad y certificados"
@@ -7230,5 +7343,38 @@
         "diagnosticsOmitted": "Líneas o texto de diagnóstico omitidos: {count}. Se conserva el informe original."
       }
     }
+  },
+  "monitorLinks": {
+    "thisNode": "Este nodo",
+    "checking": "Comprobando nodos…",
+    "loadFailed": "No se pudo cargar la lista de nodos.",
+    "empty": "Aún no hay otros nodos. Añade uno para abrir su Monitor desde aquí.",
+    "groups": {
+      "cluster": "Clúster",
+      "standalone": "Nodos independientes",
+      "pbs": "Proxmox Backup Server"
+    },
+    "noResponse": "Sin respuesta",
+    "pbsInterface": "Interfaz de PBS",
+    "openNewTab": "Abrir en una pestaña nueva",
+    "manage": "Añadir o gestionar nodos…",
+    "dialogTitle": "Nodos enlazados",
+    "dialogDescription": "Los nodos del clúster y los Proxmox Backup Server configurados se detectan automáticamente. Cada Monitor mantiene su propio inicio de sesión.",
+    "addTitle": "Añadir un nodo",
+    "name": "Nombre",
+    "address": "Dirección del Monitor",
+    "type": "Tipo",
+    "add": "Añadir",
+    "save": "Guardar",
+    "remove": "Eliminar",
+    "visible": "Visible",
+    "autoAddress": "Automática",
+    "detected": "Detectado",
+    "added": "Añadido",
+    "saveFailed": "No se pudo guardar la lista de nodos.",
+    "backTo": "Volver a {name}",
+    "cameFromTitle": "¿Añadir nodo Monitor?",
+    "cameFromBody": "Añade {name} a los nodos enlazados de este Monitor.",
+    "notNow": "Ahora no"
   }
 }
diff --git a/AppImage/messages/fr/common.json b/AppImage/messages/fr/common.json
index e4f01173..7b08954f 100644
--- a/AppImage/messages/fr/common.json
+++ b/AppImage/messages/fr/common.json
@@ -8,7 +8,8 @@
     "unknown": "Inconnu",
     "notAvailable": "N/A",
     "serverOffline": "Serveur hors ligne",
-    "supportProject": "Soutenir et contribuer au projet"
+    "supportProject": "Soutenir et contribuer au projet",
+    "descriptionPbs": "Tableau de bord Proxmox Backup Server"
   },
   "common": {
     "notAvailable": "N/A",
@@ -165,7 +166,8 @@
     },
     "runningCountOne": "{count} en cours d'exécution",
     "runningCountFew": "{count} en cours d'exécution",
-    "runningCountMany": "{count} en cours d'exécution"
+    "runningCountMany": "{count} en cours d'exécution",
+    "pbsVersion": "Version PBS :"
   },
   "storage": {
     "loadingTitle": "Chargement des données de stockage...",
@@ -1110,7 +1112,21 @@
       "available": "Sauvegardes disponibles",
       "loading": "Chargement des sauvegardes...",
       "empty": "Aucune sauvegarde trouvée",
-      "emptyHint": "Créez votre première sauvegarde en utilisant le bouton ci-dessus"
+      "emptyHint": "Créez votre première sauvegarde en utilisant le bouton ci-dessus",
+      "refresh": "Actualiser",
+      "refreshFailed": "Impossible d'actualiser les sauvegardes. Actualisez à nouveau pour confirmer leur état actuel.",
+      "deleteSelected": "Supprimer la sélection ({count})",
+      "deletedCount": "{count} sauvegarde(s) supprimée(s).",
+      "unconfirmedCount": "La suppression de {count} sauvegarde(s) n'a pas été confirmée. Actualisez la liste et vérifiez les tâches Proxmox avant de réessayer.",
+      "deleteFailed": "La suppression n'a pas pu être confirmée. Actualisez la liste et vérifiez les tâches Proxmox avant de réessayer.",
+      "selectHint": "Sélectionnez les sauvegardes non protégées (jusqu'à 20 par lot)",
+      "selectBackup": "Sélectionner la sauvegarde",
+      "protected": "Protégée",
+      "confirmTitle": "Supprimer {count} sauvegarde(s) ?",
+      "confirmDescription": "Ces archives de sauvegarde de la VM/CT {vmid} seront définitivement supprimées. Les sauvegardes protégées sont exclues. Cela ne supprime pas l'invité.",
+      "deleting": "En attente de la fin de la suppression des archives sélectionnées par Proxmox…",
+      "cancel": "Annuler",
+      "confirmDelete": "Supprimer les sauvegardes"
     },
     "updatesPanel": {
       "pendingTitle": "Mises à jour des packages en attente",
@@ -1721,7 +1737,17 @@
       "portCategoryCustomPlaceholder": "Tapez une catégorie et appuyez sur Entrée (Esc pour annuler)",
       "portCustomUrlPlaceholder": "URL personnalisée (par exemple https://vault.example.com) — remplace IP:port",
       "stackMemberTitle": "Fait partie d'une application multi-conteneurs",
-      "stackMemberBody": "Ce conteneur fait partie d'une application dont le conteneur principal est {primary}. L'application, ses liens web et sa version y sont affichés."
+      "stackMemberBody": "Ce conteneur fait partie d'une application dont le conteneur principal est {primary}. L'application, ses liens web et sa version y sont affichés.",
+      "nativeEvidencePort": "Port TCP en écoute",
+      "nativeEvidenceFile": "Fichier installé",
+      "nativeEvidenceProcess": "Exécutable en cours d'exécution",
+      "nativeEvidenceDirectory": "Répertoire de travail",
+      "nativeEvidenceService": "Définition du service",
+      "nativeScanFailed": "La recherche d'applications n'a pas pu se terminer. Les résultats précédents peuvent être obsolètes ; réessayez.",
+      "nativeScanPartial": "La recherche d'applications est incomplète. Vérifiez les éléments trouvés et réessayez.",
+      "nativeVersionUnknown": "Version installée inconnue",
+      "nativeEvidenceStale": "Les éléments trouvés peuvent être obsolètes ou incomplets.",
+      "nativeRegisterOnly": "Confirmez l'enregistrement dans l'éditeur. Une version connue est enregistrée comme valeur manuelle ; aucun outil de mise à jour n'est configuré."
     },
     "statusFilter": {
       "ariaLabel": "Filtrer les machines virtuelles et les conteneurs",
@@ -1817,7 +1843,8 @@
         "logs": "Journaux système",
         "updates": "Mises à jour du système",
         "security": "Sécurité et certificats",
-        "temperature": "Température"
+        "temperature": "Température",
+        "pbsServices": "Services PBS"
       }
     },
     "remoteStorage": {
@@ -2111,7 +2138,13 @@
         "inactiveFooter": "Activez les notifications pour recevoir des alertes système, de santé et de sécurité via les canaux configurés.",
         "notificationLanguage": "Langue de notification",
         "selectNotificationLanguage": "Sélectionnez la langue de notification",
-        "notificationLanguageHint": "Utilisé pour les notifications d'exécution déterministes, même lorsque l'IA est désactivée."
+        "notificationLanguageHint": "Utilisé pour les notifications d'exécution déterministes, même lorsque l'IA est désactivée.",
+        "appriseServiceHelp": "Configuration de Slack et Matrix",
+        "appriseSlackSteps": "Créez un webhook entrant dans votre application Slack pour le canal cible, puis collez son URL HTTPS complète dans le champ URL Apprise. Aucune conversion n'est nécessaire.",
+        "appriseSlackDocs": "Formats d'URL et configuration de Slack",
+        "appriseMatrixSteps": "Utilisez un compte de notification autorisé à publier dans le salon. Remplacez l'utilisateur, le mot de passe, le serveur d'origine et l'identifiant complet du salon de l'exemple ; encodez les caractères spéciaux des identifiants pour les URL. Le schéma matrixs utilise HTTPS. Consultez la documentation pour la prise en charge des jetons, du SSO et des salons chiffrés dans votre version d'Apprise.",
+        "appriseMatrixDocs": "Formats d'URL et configuration de Matrix",
+        "appriseServiceFinish": "Activez Apprise, saisissez votre URL, choisissez les catégories de notification ou les événements individuels, enregistrez, puis utilisez Envoyer un test. Ces exemples ne modifient pas votre URL enregistrée. Ce canal Apprise possède une destination ; utilisez l'API Apprise pour plusieurs services à la fois."
       },
       "ai": {
         "title": "Amélioration de l'IA",
@@ -2980,7 +3013,7 @@
       "youWillNeed": "Vous aurez besoin de :",
       "needApp": "Une application d'authentification telle que Aegis, 1Password, Bitwarden ou Google Authenticator.",
       "needQrOrKey": "Un code QR ou une clé manuelle de cette configuration.",
-      "needBackupCodes": "Codes de sauvegarde enregistrés dans un endroit sûr.",
+      "needBackupCodes": "Codes de secours enregistrés dans un endroit sûr.",
       "starting": "Départ...",
       "startSetup": "Démarrer la configuration",
       "scanTitle": "Scannez le code QR",
@@ -2993,10 +3026,10 @@
       "verifying": "Vérification...",
       "verifyAndEnable": "Vérifier et activer",
       "enabledTitle": "2FA est activé.",
-      "enabledDescription": "Enregistrez les codes de sauvegarde avant de fermer cette fenêtre.",
-      "saveCodesTitle": "Enregistrez vos codes de sauvegarde",
+      "enabledDescription": "Enregistrez les codes de secours avant de fermer cette fenêtre.",
+      "saveCodesTitle": "Enregistrez vos codes de secours",
       "saveCodesDescription": "Chaque code peut être utilisé une fois si vous perdez l'accès à votre application d'authentification.",
-      "backupCodes": "Codes de sauvegarde",
+      "backupCodes": "Codes de secours",
       "copyAll": "Copier tout",
       "finish": "Finition"
     },
@@ -4756,6 +4789,24 @@
       "thursday": "Jeudi",
       "tuesday": "Mardi",
       "wednesday": "Mercredi"
+    },
+    "storageRetention": {
+      "title": "Rétention du stockage",
+      "keepAll": "Conserver toutes les sauvegardes",
+      "description": "Rétention par défaut des sauvegardes enregistrée dans Proxmox. Les tâches de sauvegarde avec une politique explicite remplacent cette valeur par défaut.",
+      "refresh": "Actualiser",
+      "saved": "Rétention du stockage enregistrée. Aucune purge n'a été exécutée.",
+      "choosePolicy": "Choisissez Tout conserver ou au moins un nombre de rétention supérieur à zéro.",
+      "saveFailed": "Impossible d'enregistrer la rétention du stockage. Actualisez la liste si la configuration a changé.",
+      "loadFailed": "Impossible de charger la rétention du stockage.",
+      "empty": "Aucun stockage de sauvegarde trouvé.",
+      "default": "Valeur par défaut de Proxmox",
+      "edit": "Modifier",
+      "editTitle": "Rétention de {storage}",
+      "effect": "S'applique aux futures sauvegardes qui héritent de cette politique de stockage. L'enregistrement ne supprime pas les sauvegardes existantes. Les sauvegardes protégées restent protégées.",
+      "cancel": "Annuler",
+      "save": "Enregistrer la rétention",
+      "useDefault": "Utiliser la valeur par défaut de Proxmox (aucune politique sur ce stockage)"
     }
   },
   "healthStatus": {
@@ -4786,7 +4837,8 @@
       "services": "Services PVE",
       "logs": "Journaux système",
       "updates": "Mises à jour du système",
-      "security": "Sécurité et certificats"
+      "security": "Sécurité et certificats",
+      "pbsServices": "services PBS"
     },
     "checks": {
       "cpu_usage": "Utilisation du processeur",
@@ -7230,5 +7282,99 @@
         "diagnosticsOmitted": "Lignes ou texte de diagnostic omis : {count}. Rapport original conservé."
       }
     }
+  },
+  "pbs": {
+    "title": "Proxmox Backup Server",
+    "server": "Serveur PBS",
+    "chooseServer": "Choisir un serveur PBS",
+    "local": "PBS local",
+    "refresh": "Actualiser",
+    "manage": "Gérer les connexions PBS",
+    "loadFailed": "Impossible de charger l'état de PBS.",
+    "loading": "Chargement des données PBS…",
+    "noServer": "Ajoutez une connexion PBS pour afficher les magasins de données, les tâches et les planifications.",
+    "permissionsHelp": "Activez l'authentification Monitor avant d'enregistrer des identifiants. Utilisez un jeton API PBS dédié avec le rôle Audit sur / pour les ACL de l'utilisateur et du jeton, avec propagation. Ce panneau accède aux données PBS uniquement en lecture.",
+    "editConnection": "Connexion à modifier",
+    "add": "Ajouter une connexion",
+    "name": "Nom",
+    "url": "URL HTTPS (inclure :8007 pour le port natif de PBS)",
+    "token_id": "Identifiant du jeton API (user@realm!token)",
+    "token_secret": "Secret du jeton API (laisser vide pour conserver le secret enregistré)",
+    "fingerprint": "Empreinte SHA256 du certificat (facultative)",
+    "tlsHelp": "Laissez l'empreinte vide pour la vérification habituelle de l'autorité de certification et du nom d'hôte. Pour un certificat autosigné, copiez son empreinte SHA256 depuis la console PBS ou un autre canal de confiance. L'empreinte est vérifiée avant l'envoi des identifiants.",
+    "saved": "Connexion PBS vérifiée et enregistrée.",
+    "saveFailed": "Impossible d'enregistrer la connexion PBS.",
+    "testing": "Vérification de la connexion…",
+    "save": "Vérifier et enregistrer",
+    "remove": "Supprimer la connexion",
+    "removeConfirm": "Supprimer de Monitor cette connexion PBS enregistrée et son jeton ? Les données et tâches PBS restent inchangées.",
+    "sampled": "Relevé effectué à",
+    "datastores": "Magasins de données",
+    "total": "Capacité du système de fichiers",
+    "used": "Utilisé",
+    "free": "Disponible",
+    "noDatastores": "Aucun magasin de données accessible. Vérifiez leur configuration et les permissions de l'utilisateur et du jeton.",
+    "tasks": "Tâches récentes",
+    "noTasks": "Aucune tâche récente n'a été renvoyée.",
+    "task": "Tâche",
+    "started": "Démarrée",
+    "status": "État",
+    "running": "En cours",
+    "jobs": "Planifications de maintenance",
+    "job": "Tâche planifiée",
+    "schedule": "Planification",
+    "sync": "Synchronisation",
+    "verify": "Vérification",
+    "prune": "Purge",
+    "overview": "Vue d'ensemble",
+    "logs": "Journaux système",
+    "terminal": "Terminal",
+    "security": "Sécurité",
+    "logout": "Se déconnecter",
+    "navigation": "Navigation PBS",
+    "cpu": "CPU",
+    "memory": "Mémoire",
+    "uptime": "Durée de fonctionnement",
+    "capacityUnavailable": "Capacité non disponible.",
+    "datastoresUnavailable": "{count} indisponible",
+    "datastoresOnline": "Tous disponibles",
+    "moreDatastores": "+{count} banques de données supplémentaires",
+    "estimatedFull": "Estimé complet",
+    "estimatedFullUnknown": "Pas encore assez de données",
+    "duration": "Durée",
+    "noJobs": "Aucune planification de synchronisation, de vérification ou d'élagage n'est configurée."
+  },
+  "monitorLinks": {
+    "groups": {
+      "cluster": "Cluster",
+      "standalone": "nœuds autonomes",
+      "pbs": "Proxmox Backup Server"
+    },
+    "thisNode": "Ce nœud",
+    "checking": "Vérification des nœuds…",
+    "loadFailed": "Impossible de charger la liste des nœuds.",
+    "empty": "Aucun autre nœud pour l'instant. Ajoutez-en un pour ouvrir son Monitor depuis ici.",
+    "noResponse": "Pas de réponse",
+    "pbsInterface": "interface PBS",
+    "openNewTab": "Ouvrir dans un nouvel onglet",
+    "manage": "Ajouter ou gérer des nœuds…",
+    "dialogTitle": "nœuds liés",
+    "dialogDescription": "Les nœuds du cluster et les Proxmox Backup Server configurés sont détectés automatiquement. Chaque Monitor conserve sa propre connexion.",
+    "addTitle": "ajouter un nœud",
+    "name": "Nom",
+    "address": "Adresse du moniteur",
+    "type": "Type",
+    "add": "Ajouter",
+    "save": "Enregistrer",
+    "remove": "Supprimer",
+    "visible": "Visible",
+    "autoAddress": "Automatique",
+    "detected": "Détecté",
+    "added": "ajouté",
+    "saveFailed": "Impossible d'enregistrer la liste des nœuds.",
+    "backTo": "Retour à {name}",
+    "cameFromTitle": "Ajouter un nœud Moniteur ?",
+    "cameFromBody": "Ajoutez {name} aux nœuds liés de ce moniteur.",
+    "notNow": "Pas maintenant"
   }
 }
diff --git a/AppImage/messages/it/common.json b/AppImage/messages/it/common.json
index 5c546c9d..b0c07368 100644
--- a/AppImage/messages/it/common.json
+++ b/AppImage/messages/it/common.json
@@ -8,7 +8,8 @@
     "unknown": "Sconosciuto",
     "notAvailable": "N/A",
     "serverOffline": "Server offline",
-    "supportProject": "Sostieni e contribuisci al progetto"
+    "supportProject": "Sostieni e contribuisci al progetto",
+    "descriptionPbs": "Dashboard di Proxmox Backup Server"
   },
   "common": {
     "notAvailable": "N/A",
@@ -165,7 +166,8 @@
     },
     "runningCountOne": "{count} in esecuzione",
     "runningCountFew": "{count} in esecuzione",
-    "runningCountMany": "{count} in esecuzione"
+    "runningCountMany": "{count} in esecuzione",
+    "pbsVersion": "Versione PBS:"
   },
   "storage": {
     "loadingTitle": "Caricamento dati storage...",
@@ -1110,7 +1112,21 @@
       "available": "Backup disponibili",
       "loading": "Caricamento backup...",
       "empty": "Nessun backup trovato",
-      "emptyHint": "Crea il primo backup con il pulsante in alto"
+      "emptyHint": "Crea il primo backup con il pulsante in alto",
+      "refresh": "Aggiorna",
+      "refreshFailed": "Impossibile aggiornare i backup. Aggiorna di nuovo per confermarne lo stato attuale.",
+      "deleteSelected": "Elimina selezionati ({count})",
+      "deletedCount": "{count} backup eliminati.",
+      "unconfirmedCount": "L'eliminazione di {count} backup non è stata confermata. Aggiorna l'elenco e controlla le attività di Proxmox prima di riprovare.",
+      "deleteFailed": "Impossibile confermare l'eliminazione. Aggiorna l'elenco e controlla le attività di Proxmox prima di riprovare.",
+      "selectHint": "Seleziona i backup non protetti (fino a 20 per gruppo)",
+      "selectBackup": "Seleziona backup",
+      "protected": "Protetto",
+      "confirmTitle": "Eliminare {count} backup?",
+      "confirmDescription": "Questi archivi di backup della VM/CT {vmid} verranno eliminati definitivamente. I backup protetti sono esclusi. Questo non elimina l'ospite.",
+      "deleting": "In attesa che Proxmox termini l'eliminazione degli archivi selezionati…",
+      "cancel": "Annulla",
+      "confirmDelete": "Elimina backup"
     },
     "updatesPanel": {
       "pendingTitle": "Aggiornamenti pacchetti in sospeso",
@@ -1721,7 +1737,17 @@
       "portCategoryCustomPlaceholder": "Digita una categoria e premi Enter (Esc per annullare)",
       "portCustomUrlPlaceholder": "URL personalizzato (ad es. https://vault.example.com) — sostituisce IP:port",
       "stackMemberTitle": "Parte di un'applicazione multi-container",
-      "stackMemberBody": "Questo container supporta un’applicazione il cui container principale è {primary}. L’applicazione, i suoi collegamenti web e la sua versione sono mostrati lì."
+      "stackMemberBody": "Questo container supporta un’applicazione il cui container principale è {primary}. L’applicazione, i suoi collegamenti web e la sua versione sono mostrati lì.",
+      "nativeEvidencePort": "Porta TCP in ascolto",
+      "nativeEvidenceFile": "File installato",
+      "nativeEvidenceProcess": "Eseguibile in esecuzione",
+      "nativeEvidenceDirectory": "Directory di lavoro",
+      "nativeEvidenceService": "Definizione del servizio",
+      "nativeScanFailed": "La ricerca delle applicazioni non è stata completata. I risultati precedenti potrebbero non essere aggiornati; riprova.",
+      "nativeScanPartial": "La ricerca delle applicazioni è incompleta. Controlla gli elementi trovati e riprova.",
+      "nativeVersionUnknown": "Versione installata sconosciuta",
+      "nativeEvidenceStale": "Gli elementi trovati potrebbero non essere aggiornati o essere incompleti.",
+      "nativeRegisterOnly": "Conferma la registrazione nell'editor. Una versione nota viene salvata come valore manuale; non viene configurato alcun aggiornamento automatico."
     },
     "statusFilter": {
       "ariaLabel": "Filtra macchine virtuali e container",
@@ -1817,7 +1843,8 @@
         "logs": "Log di sistema",
         "updates": "Aggiornamenti di sistema",
         "security": "Sicurezza e certificati",
-        "temperature": "Temperatura"
+        "temperature": "Temperatura",
+        "pbsServices": "Servizi PBS"
       }
     },
     "remoteStorage": {
@@ -2111,7 +2138,13 @@
         "inactiveFooter": "Abilita le notifiche per ricevere avvisi di sistema, integrità e sicurezza attraverso i canali configurati.",
         "notificationLanguage": "Lingua notifiche",
         "selectNotificationLanguage": "Seleziona lingua notifiche",
-        "notificationLanguageHint": "Usata per le notifiche runtime deterministiche anche quando l’IA è disabilitata."
+        "notificationLanguageHint": "Usata per le notifiche runtime deterministiche anche quando l’IA è disabilitata.",
+        "appriseServiceHelp": "Configurazione di Slack e Matrix",
+        "appriseSlackSteps": "Crea un webhook in ingresso nell'app Slack per il canale di destinazione, quindi incolla il suo URL HTTPS completo nel campo URL di Apprise. Non è necessaria alcuna conversione.",
+        "appriseSlackDocs": "Formati URL e configurazione di Slack",
+        "appriseMatrixSteps": "Usa un account di notifica autorizzato a pubblicare nella stanza. Sostituisci utente, password, homeserver e ID completo della stanza dell'esempio; codifica per URL i caratteri speciali nelle credenziali. Lo schema matrixs usa HTTPS. Consulta la documentazione per il supporto di token, SSO e stanze cifrate nella versione di Apprise installata.",
+        "appriseMatrixDocs": "Formati URL e configurazione di Matrix",
+        "appriseServiceFinish": "Abilita Apprise, inserisci il tuo URL, scegli le categorie di notifica o i singoli eventi, salva e poi usa Invia test. Questi esempi non modificano l'URL salvato. Questo canale Apprise ha una sola destinazione; usa l'API Apprise per più servizi contemporaneamente."
       },
       "ai": {
         "title": "Miglioramento con IA",
@@ -4756,6 +4789,24 @@
       "thursday": "Giovedì",
       "tuesday": "Martedì",
       "wednesday": "Mercoledì"
+    },
+    "storageRetention": {
+      "title": "Conservazione dell'archiviazione",
+      "keepAll": "Mantieni tutti i backup",
+      "description": "Conservazione predefinita dei backup salvata in Proxmox. Le attività di backup con una politica esplicita hanno la precedenza su questo valore.",
+      "refresh": "Aggiorna",
+      "saved": "Politica di conservazione dell'archiviazione salvata. Non è stata eseguita alcuna pulizia.",
+      "choosePolicy": "Scegli Mantieni tutti oppure almeno un numero di conservazione maggiore di zero.",
+      "saveFailed": "Impossibile salvare la politica di conservazione dell'archiviazione. Aggiorna l'elenco se la configurazione è cambiata.",
+      "loadFailed": "Impossibile caricare la politica di conservazione dell'archiviazione.",
+      "empty": "Nessuno spazio di archiviazione dei backup trovato.",
+      "default": "Valore predefinito di Proxmox",
+      "edit": "Modifica",
+      "editTitle": "Conservazione per {storage}",
+      "effect": "Si applica alle future esecuzioni dei backup che ereditano questa politica di archiviazione. Il salvataggio non elimina i backup esistenti. I backup protetti rimangono protetti.",
+      "cancel": "Annulla",
+      "save": "Salva conservazione",
+      "useDefault": "Usa l'impostazione predefinita di Proxmox (nessuna policy su questo storage)"
     }
   },
   "healthStatus": {
@@ -4786,7 +4837,8 @@
       "services": "Servizi PVE",
       "logs": "Log di sistema",
       "updates": "Aggiornamenti di sistema",
-      "security": "Sicurezza e certificati"
+      "security": "Sicurezza e certificati",
+      "pbsServices": "servizi PBS"
     },
     "checks": {
       "cpu_usage": "Utilizzo CPU",
@@ -7230,5 +7282,99 @@
         "diagnosticsOmitted": "Righe o testo diagnostico omessi: {count}. Il report originale è conservato."
       }
     }
+  },
+  "pbs": {
+    "title": "Proxmox Backup Server",
+    "server": "Server PBS",
+    "chooseServer": "Scegli un server PBS",
+    "local": "PBS locale",
+    "refresh": "Aggiorna",
+    "manage": "Gestisci le connessioni PBS",
+    "loadFailed": "Impossibile caricare lo stato di PBS.",
+    "loading": "Caricamento dei dati PBS…",
+    "noServer": "Aggiungi una connessione PBS per visualizzare datastore, attività e pianificazioni.",
+    "permissionsHelp": "Abilita l'autenticazione di Monitor prima di salvare le credenziali. Usa un token API PBS dedicato con il ruolo Audit su / sia nelle ACL dell'utente sia in quelle del token, con propagazione. Questo pannello legge soltanto i dati PBS.",
+    "editConnection": "Connessione da modificare",
+    "add": "Aggiungi una nuova connessione",
+    "name": "Nome",
+    "url": "URL HTTPS (includere :8007 per la porta nativa di PBS)",
+    "token_id": "ID del token API (user@realm!token)",
+    "token_secret": "Segreto del token API (lasciare vuoto per mantenere quello salvato)",
+    "fingerprint": "Impronta SHA256 del certificato (facoltativa)",
+    "tlsHelp": "Lascia vuota l'impronta per la normale verifica dell'autorità di certificazione e del nome host. Per un certificato autofirmato, copia la sua impronta SHA256 dalla console PBS o da un altro canale attendibile. L'impronta viene verificata prima dell'invio delle credenziali.",
+    "saved": "Connessione PBS verificata e salvata.",
+    "saveFailed": "Impossibile salvare la connessione PBS.",
+    "testing": "Verifica della connessione…",
+    "save": "Verifica e salva",
+    "remove": "Rimuovi connessione",
+    "removeConfirm": "Rimuovere da Monitor questa connessione PBS salvata e il suo token? I dati e le attività PBS non vengono modificati.",
+    "sampled": "Rilevato alle",
+    "datastores": "Datastore",
+    "total": "Capacità del filesystem",
+    "used": "Usato",
+    "free": "Disponibile",
+    "noDatastores": "Nessun datastore accessibile. Controlla la configurazione dei datastore e i permessi dell'utente e del token.",
+    "tasks": "Attività recenti",
+    "noTasks": "Non sono state restituite attività recenti.",
+    "task": "Attività",
+    "started": "Avviata",
+    "status": "Stato",
+    "running": "In esecuzione",
+    "jobs": "Pianificazioni di manutenzione",
+    "job": "Attività pianificata",
+    "schedule": "Pianificazione",
+    "sync": "Sincronizzazione",
+    "verify": "Verifica",
+    "prune": "Pulizia",
+    "overview": "Panoramica",
+    "logs": "Registri di sistema",
+    "terminal": "Terminale",
+    "security": "Sicurezza",
+    "logout": "Disconnetti",
+    "navigation": "Navigazione PBS",
+    "cpu": "CPU",
+    "memory": "Memoria",
+    "uptime": "Tempo di attività",
+    "capacityUnavailable": "Capacità non disponibile.",
+    "datastoresUnavailable": "{count} non disponibile",
+    "datastoresOnline": "Tutti disponibili",
+    "moreDatastores": "+{count} altri archivi dati",
+    "estimatedFull": "Pieno stimato",
+    "estimatedFullUnknown": "dati non ancora sufficienti",
+    "duration": "Durata",
+    "noJobs": "non è configurata alcuna pianificazione di sincronizzazione, verifica o eliminazione."
+  },
+  "monitorLinks": {
+    "groups": {
+      "cluster": "cluster",
+      "standalone": "nodi autonomi",
+      "pbs": "Proxmox Backup Server"
+    },
+    "thisNode": "questo nodo",
+    "checking": "Controllo dei nodi…",
+    "loadFailed": "impossibile caricare l'elenco dei nodi.",
+    "empty": "Ancora nessun altro nodo. Aggiungine uno per aprire il suo Monitor da qui.",
+    "noResponse": "Nessuna risposta",
+    "pbsInterface": "interfaccia PBS",
+    "openNewTab": "apri in una nuova scheda",
+    "manage": "aggiungi o gestisci nodi...",
+    "dialogTitle": "nodi collegati",
+    "dialogDescription": "I nodi del cluster e i Proxmox Backup Server configurati vengono rilevati automaticamente. Ogni Monitor mantiene il proprio accesso.",
+    "addTitle": "aggiungi un nodo",
+    "name": "Nome",
+    "address": "monitora l'indirizzo",
+    "type": "digita",
+    "add": "aggiungi",
+    "save": "salva",
+    "remove": "rimuovere",
+    "visible": "visibile",
+    "autoAddress": "automatico",
+    "detected": "rilevato",
+    "added": "aggiunto",
+    "saveFailed": "impossibile salvare l'elenco dei nodi.",
+    "backTo": "torna a {name}",
+    "cameFromTitle": "aggiungi il nodo Monitor?",
+    "cameFromBody": "aggiungi {name} ai nodi collegati di questo monitor.",
+    "notNow": "Non ora"
   }
 }
diff --git a/AppImage/messages/pt/common.json b/AppImage/messages/pt/common.json
index b6ca6c04..668600bd 100644
--- a/AppImage/messages/pt/common.json
+++ b/AppImage/messages/pt/common.json
@@ -8,7 +8,8 @@
     "unknown": "Desconhecido",
     "notAvailable": "N/D",
     "serverOffline": "Servidor off-line",
-    "supportProject": "Apoie e contribua para o projeto"
+    "supportProject": "Apoie e contribua para o projeto",
+    "descriptionPbs": "Painel do Proxmox Backup Server"
   },
   "common": {
     "notAvailable": "N/D",
@@ -165,7 +166,8 @@
     },
     "runningCountOne": "{count} em execução",
     "runningCountFew": "{count} em execução",
-    "runningCountMany": "{count} em execução"
+    "runningCountMany": "{count} em execução",
+    "pbsVersion": "Versão PBS:"
   },
   "storage": {
     "loadingTitle": "Carregando dados de armazenamento...",
@@ -353,7 +355,7 @@
       "downloadJson": "Baixar JSON",
       "delete": "Excluir",
       "confirmDelete": "Excluir este registro de teste?",
-      "note": "Os resultados dos testes são armazenados localmente e usados ​​para gerar relatórios SMART detalhados."
+      "note": "Os resultados dos testes são armazenados localmente e usados para gerar relatórios SMART detalhados."
     },
     "smartReport": {
       "title": "Relatório de saúde SMART",
@@ -595,8 +597,8 @@
         "availableSpare": "Porcentagem de blocos NAND sobressalentes restantes para substituição de blocos defeituosos. Um alerta é acionado abaixo do limite.",
         "availableSpareThreshold": "Mínimo definido pelo fabricante para peças sobressalentes disponíveis. Abaixo disso, a unidade sinaliza um aviso crítico.",
         "percentageUsed": "Impulsione a estimativa da resistência consumida com base nos ciclos de gravação reais versus nominais. 100% significa que o TBW avaliado foi atingido; a unidade pode continuar funcionando além disso.",
-        "mediaErrors": "Erros de leitura/gravação irrecuperáveis ​​no flash NAND. Qualquer valor diferente de zero indica dano celular permanente. Contagem crescente significa substituição em breve.",
-        "mediaIntegrityErrors": "Erros irrecuperáveis ​​detectados pelo controlador. Diferente de zero significa risco de corrupção de dados.",
+        "mediaErrors": "Erros de leitura/gravação irrecuperáveis no flash NAND. Qualquer valor diferente de zero indica dano celular permanente. Contagem crescente significa substituição em breve.",
+        "mediaIntegrityErrors": "Erros irrecuperáveis detectados pelo controlador. Diferente de zero significa risco de corrupção de dados.",
         "unsafeShutdowns": "Perdas de energia sem descarga ou desligamento adequado. Contagens muito altas correm o risco de corrupção de metadados e problemas de firmware.",
         "nvmePowerCycles": "Ciclos totais de ligar/desligar. A ciclagem frequente aumenta o desgaste do conector e do capacitor.",
         "nvmePowerOnHours": "Total de horas acumuladas em que o inversor esteve ligado desde a fabricação.",
@@ -624,7 +626,7 @@
         "reallocatedSectorCount": "Setores defeituosos substituídos por setores sobressalentes do pool de reserva. Uma contagem crescente significa degradação da unidade.",
         "retiredBlockCount": "Blocos NAND retirados devido a desgaste ou falha (SSD). Semelhante à contagem de setores realocados para HDDs.",
         "reallocatedEventCount": "Número de operações de remapeamento realizadas. Cada evento significa que um setor defeituoso foi substituído.",
-        "currentPendingSector": "Setores instáveis ​​esperando para serem remapeados na próxima gravação. Eles podem ser resolvidos ou serem realocados permanentemente.",
+        "currentPendingSector": "Setores instáveis esperando para serem remapeados na próxima gravação. Eles podem ser resolvidos ou serem realocados permanentemente.",
         "pendingSectors": "Setores esperando para serem remapeados. Eles podem ser resolvidos ou realocados.",
         "offlineUncorrectable": "Setores que falharam durante a verificação offline e não puderam ser corrigidos. Indica possível perda de dados.",
         "offlineUncorrectableSectorCount": "Setores incorrigíveis encontrados durante a verificação em segundo plano. Os dados sobre estes setores são perdidos.",
@@ -667,7 +669,7 @@
         "endToEndError": "Corrupção de dados detectada entre o cache do controlador e a interface do host. Deve ser sempre zero.",
         "endToEndErrorDetectionCount": "Número de erros de paridade no caminho de dados. Diferente de zero indica problemas no controlador.",
         "wearLevelingCount": "Média de ciclos de apagamento por bloco NAND (SSD). VALOR mais baixo significa mais desgaste consumido.",
-        "wearRangeDelta": "Diferença entre blocos mais usados ​​e menos usados ​​(SSD). Valores altos indicam desgaste irregular.",
+        "wearRangeDelta": "Diferença entre blocos mais usados e menos usados (SSD). Valores altos indicam desgaste irregular.",
         "mediaWearoutIndicator": "Estimativa de vida útil restante do SSD Intel. Começa em 100 e diminui para 0 conforme a resistência é consumida.",
         "ssdLifeLeft": "Porcentagem estimada de vida útil restante do SSD com base no desgaste da NAND.",
         "percentLifetimeRemain": "Porcentagem estimada de vida útil restante. 100 significa novo; 0 significa fim da vida útil nominal.",
@@ -744,7 +746,7 @@
         "nvmeWarningTitle": "Aviso crítico NVMe ativo (0x{value})",
         "nvmeWarningText": "O controlador NVMe gerou um alerta. Faça backup dos dados imediatamente e investigue mais a fundo.",
         "nvmeMediaTitle": "Erros de mídia NVMe detectados ({count})",
-        "nvmeMediaText": "Erros irrecuperáveis ​​de flash NAND indicam danos físicos. Faça backup dos dados e planeje a substituição.",
+        "nvmeMediaText": "Erros irrecuperáveis de flash NAND indicam danos físicos. Faça backup dos dados e planeje a substituição.",
         "unsafeTitle": "Contagem alta de desligamentos inseguros ({count})",
         "unsafeText": "Perdas frequentes de energia aumentam o risco de corrupção do firmware. Garanta energia estável ou use um UPS.",
         "seagateTitle": "Seagate Raw_Read_Error_Rate - Comportamento normal",
@@ -1084,7 +1086,7 @@
       "start": "Iniciar",
       "shutdown": "Desligar",
       "reboot": "Reiniciar",
-      "forceStop": "Forçar parada",
+      "forceStop": "Forçar paragem",
       "working": "Processando...",
       "startPending": "Iniciando...",
       "shutdownPending": "Desligando...",
@@ -1092,7 +1094,7 @@
       "stopPending": "Parando..."
     },
     "confirm": {
-      "forceStopTitle": "Forçar parada",
+      "forceStopTitle": "Forçar paragem",
       "rebootTitle": "Reinício",
       "forceStopDescription": "Isso ignora a sequência de desligamento do sistema operacional convidado e pode corromper bancos de dados ou sistemas de arquivos em execução. O convidado é morto imediatamente.",
       "rebootDescription": "Isso força uma reinicialização sem esperar que o sistema operacional convidado libere as gravações pendentes. Use um desligamento elegante quando possível.",
@@ -1110,7 +1112,21 @@
       "available": "Backups disponíveis",
       "loading": "Carregando backups...",
       "empty": "Nenhum backup encontrado",
-      "emptyHint": "Crie seu primeiro backup usando o botão acima"
+      "emptyHint": "Crie seu primeiro backup usando o botão acima",
+      "refresh": "Atualizar",
+      "refreshFailed": "Não foi possível atualizar as cópias de segurança. Atualize novamente para confirmar o seu estado atual.",
+      "deleteSelected": "Eliminar selecionadas ({count})",
+      "deletedCount": "{count} cópia(s) de segurança eliminada(s).",
+      "unconfirmedCount": "A eliminação de {count} cópia(s) de segurança não foi confirmada. Atualize a lista e verifique as tarefas do Proxmox antes de tentar novamente.",
+      "deleteFailed": "Não foi possível confirmar a eliminação. Atualize a lista e verifique as tarefas do Proxmox antes de tentar novamente.",
+      "selectHint": "Selecione cópias de segurança sem proteção (até 20 por lote)",
+      "selectBackup": "Selecionar cópia de segurança",
+      "protected": "Protegida",
+      "confirmTitle": "Eliminar {count} cópia(s) de segurança?",
+      "confirmDescription": "Estes arquivos de cópia de segurança da VM/CT {vmid} serão eliminados permanentemente. As cópias protegidas estão excluídas. Isto não elimina o convidado.",
+      "deleting": "À espera que o Proxmox termine de eliminar os arquivos selecionados…",
+      "cancel": "Cancelar",
+      "confirmDelete": "Eliminar cópias de segurança"
     },
     "updatesPanel": {
       "pendingTitle": "Atualizações de pacote pendentes",
@@ -1721,7 +1737,17 @@
       "portCategoryCustomPlaceholder": "Digite uma categoria e pressione Enter (Esc para cancelar)",
       "portCustomUrlPlaceholder": "URL personalizada (por exemplo, https://vault.example.com) — substitui IP:port",
       "stackMemberTitle": "Parte de um aplicativo multicontêiner",
-      "stackMemberBody": "Este contêiner faz parte de um aplicativo cujo contêiner principal é {primary}. O aplicativo, seus links da web e sua versão são mostrados lá."
+      "stackMemberBody": "Este contêiner faz parte de um aplicativo cujo contêiner principal é {primary}. O aplicativo, seus links da web e sua versão são mostrados lá.",
+      "nativeEvidencePort": "Porta TCP em escuta",
+      "nativeEvidenceFile": "Arquivo instalado",
+      "nativeEvidenceProcess": "Executável em execução",
+      "nativeEvidenceDirectory": "Diretório de trabalho",
+      "nativeEvidenceService": "Definição do serviço",
+      "nativeScanFailed": "A pesquisa de aplicativos não pôde ser concluída. Os resultados anteriores podem estar desatualizados; tente novamente.",
+      "nativeScanPartial": "A pesquisa de aplicativos está incompleta. Revise os itens encontrados e tente novamente.",
+      "nativeVersionUnknown": "Versão instalada desconhecida",
+      "nativeEvidenceStale": "Os itens encontrados podem estar desatualizados ou incompletos.",
+      "nativeRegisterOnly": "Confirme o registro no editor. Uma versão conhecida é salva como valor manual; nenhum atualizador é configurado."
     },
     "statusFilter": {
       "ariaLabel": "Filtrar máquinas virtuais e contêineres",
@@ -1771,7 +1797,7 @@
     },
     "healthMonitor": {
       "title": "Monitor de Saúde",
-      "description": "Configure por quanto tempo os alertas dispensados ​​permanecem ocultos para cada categoria. As alterações se aplicam a alertas ignorados existentes e futuros.",
+      "description": "Configure por quanto tempo os alertas dispensados permanecem ocultos para cada categoria. As alterações se aplicam a alertas ignorados existentes e futuros.",
       "category": "Categoria",
       "suppressionDuration": "Duração da Supressão",
       "hours": "Horas",
@@ -1781,7 +1807,7 @@
       "footerNote": "Essas configurações se aplicam quando você descarta um aviso do Health Monitor. Alertas críticos de temperatura da CPU sempre aparecem para proteger seu hardware.",
       "activeSuppressions": "Supressões Ativas",
       "activeSuppressionsDescription": "Alertas que você ocultou do Health Monitor. As demissões permanentes só podem ser revertidas aqui. A edição requer o Health Monitor",
-      "noActiveSuppressions": "Sem supressões ativas. Os alertas dispensados ​​do Health Monitor aparecerão aqui.",
+      "noActiveSuppressions": "Sem supressões ativas. Os alertas dispensados do Health Monitor aparecerão aqui.",
       "permanent": "Permanente",
       "daysRemaining": "{count}d restantes",
       "hoursRemaining": "{count}h restantes",
@@ -1817,7 +1843,8 @@
         "logs": "Registros do sistema",
         "updates": "Atualizações do sistema",
         "security": "Segurança e Certificados",
-        "temperature": "Temperatura"
+        "temperature": "Temperatura",
+        "pbsServices": "Serviços PBS"
       }
     },
     "remoteStorage": {
@@ -2081,8 +2108,8 @@
         "port": "Porta",
         "tlsMode": "Modo TLS",
         "noTls": "Nenhum (porta 25)",
-        "username": "Nome de usuário",
-        "password": "Senha",
+        "username": "Nome de utilizador",
+        "password": "Palavra-passe",
         "appPassword": "Senha do aplicativo",
         "fromAddress": "Do endereço",
         "toAddresses": "Para endereços (separados por vírgula)",
@@ -2111,7 +2138,13 @@
         "inactiveFooter": "Habilite notificações para receber alertas de sistema, integridade e segurança por meio dos canais configurados.",
         "notificationLanguage": "Idioma de notificação",
         "selectNotificationLanguage": "Selecione o idioma de notificação",
-        "notificationLanguageHint": "Usado para notificações determinísticas de tempo de execução, mesmo quando a IA está desabilitada."
+        "notificationLanguageHint": "Usado para notificações determinísticas de tempo de execução, mesmo quando a IA está desabilitada.",
+        "appriseServiceHelp": "Configuração do Slack e do Matrix",
+        "appriseSlackSteps": "Crie um webhook de entrada na sua aplicação Slack para o canal de destino e cole o seu URL HTTPS completo no campo URL do Apprise. Não é necessária qualquer conversão.",
+        "appriseSlackDocs": "Formatos de URL e configuração do Slack",
+        "appriseMatrixSteps": "Utilize uma conta de notificações que possa publicar na sala. Substitua o utilizador, a palavra-passe, o homeserver e o ID completo da sala do exemplo; codifique os caracteres especiais das credenciais para URL. O esquema matrixs usa HTTPS. Consulte a documentação sobre o suporte de tokens, SSO e salas cifradas na versão do Apprise instalada.",
+        "appriseMatrixDocs": "Formatos de URL e configuração do Matrix",
+        "appriseServiceFinish": "Ative o Apprise, introduza o seu URL, escolha as categorias de notificação ou os eventos individuais, guarde e utilize Enviar teste. Estes exemplos não alteram o URL guardado. Este canal do Apprise tem um destino; utilize a API do Apprise para vários serviços em simultâneo."
       },
       "ai": {
         "title": "Aprimoramento de IA",
@@ -2336,8 +2369,8 @@
   },
   "login": {
     "subtitle": "Faça login para acessar seu painel",
-    "username": "Nome de usuário",
-    "password": "Senha",
+    "username": "Nome de utilizador",
+    "password": "Palavra-passe",
     "usernamePlaceholder": "Digite seu nome de usuário",
     "passwordPlaceholder": "Digite sua senha",
     "rememberMe": "Lembrar",
@@ -2378,9 +2411,9 @@
     "skipFailed": "Falha ao ignorar a autenticação",
     "savePreferenceFailed": "Falha ao salvar preferência",
     "setupFailed": "Falha ao configurar a autenticação",
-    "username": "Nome de usuário",
+    "username": "Nome de utilizador",
     "usernamePlaceholder": "Digite o nome de usuário",
-    "password": "Senha",
+    "password": "Palavra-passe",
     "passwordPlaceholder": "Digite a senha",
     "confirmPassword": "Confirme sua senha",
     "confirmPasswordPlaceholder": "Confirme sua senha",
@@ -2523,9 +2556,9 @@
       "enableHint": "Adicione um nome de usuário e uma senha antes de expor este painel fora da sua rede privada.",
       "enable": "Habilitar autenticação",
       "setupTitle": "Criar login",
-      "username": "Nome de usuário",
+      "username": "Nome de utilizador",
       "usernamePlaceholder": "administrador",
-      "password": "Senha",
+      "password": "Palavra-passe",
       "passwordPlaceholder": "Digite a senha",
       "confirmPassword": "Confirme sua senha",
       "confirmPasswordPlaceholder": "Digite a senha novamente",
@@ -2545,7 +2578,7 @@
     "twoFactor": {
       "title": "Autenticação de dois fatores",
       "hint": "Adicione um código único de um aplicativo autenticador após a senha.",
-      "enable": "Habilitar 2FA",
+      "enable": "Ativar 2FA",
       "enabled": "2FA está habilitado.",
       "disable": "Desativar 2FA",
       "disableTitle": "Desative a autenticação de dois fatores",
@@ -3567,7 +3600,7 @@
         "hour": "Passada 1h",
         "day": "Passadas 24 horas",
         "week": "Passado 7 dias",
-        "month": "Passados ​​30 dias",
+        "month": "Passados 30 dias",
         "year": "Último 1 ano"
       },
       "last": {
@@ -4019,7 +4052,7 @@
     },
     "backends": {
       "borgDescription": "Repositório Borg para backups de host desduplicados.",
-      "borgDescriptionTimerOnly": "Os destinos Borg são usados ​​pelos temporizadores do Monitor, não pelos trabalhos PVE vzdump.",
+      "borgDescriptionTimerOnly": "Os destinos Borg são usados pelos temporizadores do Monitor, não pelos trabalhos PVE vzdump.",
       "borgShortDescription": "Repositório Borg desduplicado",
       "local": "Local",
       "localDescription": "Pasta neste host ou em uma unidade USB montada.",
@@ -4250,7 +4283,7 @@
       "onCalendarExpression": "Expressão OnCalendar",
       "ownerLabel": "Proprietário",
       "passphrase": "Senha",
-      "password": "Senha",
+      "password": "Palavra-passe",
       "pathLabel": "Caminho",
       "pbsRepository": "Repositório PBS",
       "profileLabel": "Perfil",
@@ -4283,7 +4316,7 @@
       "timeOfDay": "Hora do dia",
       "type": "Tipo",
       "used": "Usado",
-      "username": "Nome de usuário",
+      "username": "Nome de utilizador",
       "vmsLxcs": "VMs/LXCs",
       "when": "Quando",
       "whenLabel": "Quando",
@@ -4547,7 +4580,7 @@
       "customPickDescriptionMiddle": "através do",
       "destructiveTitle": "A restauração completa REMOVERÁ o seguinte (criado após o backup)",
       "noPathsMatch": "Nenhum caminho corresponde ao filtro.",
-      "noRestorablePaths": "Este backup não contém caminhos restauráveis ​​— apenas a restauração completa é significativa aqui.",
+      "noRestorablePaths": "Este backup não contém caminhos restauráveis — apenas a restauração completa é significativa aqui.",
       "olderThanTargetKernel": "é mais antigo que o kernel alvo",
       "operatorConfigDescription": "As seguintes configurações criadas pelo operador serão mescladas no destino automaticamente, sem alterar os padrões vinculados ao kernel. É executado na restauração completa e personalizada.",
       "operatorConfigTitle": "Configuração do operador reaplicada por meio de mesclagem independente de kernel",
@@ -4756,6 +4789,24 @@
       "thursday": "Quinta-feira",
       "tuesday": "Terça-feira",
       "wednesday": "Quarta-feira"
+    },
+    "storageRetention": {
+      "title": "Retenção do armazenamento",
+      "keepAll": "Manter todas as cópias de segurança",
+      "description": "Retenção predefinida de cópias de segurança guardada no Proxmox. As tarefas de cópia com uma política explícita substituem este valor predefinido.",
+      "refresh": "Atualizar",
+      "saved": "Retenção do armazenamento guardada. Não foi executada nenhuma limpeza.",
+      "choosePolicy": "Escolha Manter todas ou pelo menos uma quantidade de retenção superior a zero.",
+      "saveFailed": "Não foi possível guardar a retenção do armazenamento. Atualize a lista se a configuração tiver mudado.",
+      "loadFailed": "Não foi possível carregar a retenção do armazenamento.",
+      "empty": "Não foram encontrados armazenamentos de cópias de segurança.",
+      "default": "Predefinição do Proxmox",
+      "edit": "Editar",
+      "editTitle": "Retenção para {storage}",
+      "effect": "Aplica-se às futuras cópias de segurança que herdem esta política de armazenamento. Guardar não elimina as cópias existentes. As cópias protegidas permanecem protegidas.",
+      "cancel": "Cancelar",
+      "save": "Guardar retenção",
+      "useDefault": "Use o padrão Proxmox (nenhuma política neste armazenamento)"
     }
   },
   "healthStatus": {
@@ -4786,7 +4837,8 @@
       "services": "Serviços PVE",
       "logs": "Registros do sistema",
       "updates": "Atualizações do sistema",
-      "security": "Segurança e certificados"
+      "security": "Segurança e certificados",
+      "pbsServices": "serviços PBS"
     },
     "checks": {
       "cpu_usage": "Uso da CPU",
@@ -4912,7 +4964,7 @@
     },
     "noIssues": "Nenhum problema detectado",
     "updateNow": "Atualizar agora",
-    "dismissedItems": "Itens dispensados ​​({count})",
+    "dismissedItems": "Itens dispensados ({count})",
     "permanent": "Permanente",
     "dismissed": "Dispensado",
     "wasStatus": "era {status}",
@@ -4949,7 +5001,7 @@
       "hint": "PNG, JPEG, WebP ou GIF. Até 2 MB. Use uma imagem quadrada ou corte-a primeiro para obter o melhor resultado no cabeçalho."
     },
     "username": {
-      "label": "Nome de usuário",
+      "label": "Nome de utilizador",
       "help": "Este é o nome de login. Para alterá-lo, desative a autenticação e configure-a novamente em Segurança."
     },
     "displayName": {
@@ -7182,7 +7234,7 @@
             "latency": "Latência",
             "event": "Evento",
             "sourceIp": "IP de origem",
-            "username": "Nome de usuário",
+            "username": "Nome de utilizador",
             "service": "Serviço",
             "jail": "Jail",
             "failures": "Falhas",
@@ -7230,5 +7282,99 @@
         "diagnosticsOmitted": "Linhas ou texto de diagnóstico omitidos: {count}. Relatório original preservado."
       }
     }
+  },
+  "pbs": {
+    "title": "Proxmox Backup Server",
+    "server": "Servidor PBS",
+    "chooseServer": "Escolher um servidor PBS",
+    "local": "PBS local",
+    "refresh": "Atualizar",
+    "manage": "Gerir ligações PBS",
+    "loadFailed": "Não foi possível carregar o estado do PBS.",
+    "loading": "A carregar dados do PBS…",
+    "noServer": "Adicione uma ligação PBS para ver os armazenamentos de dados, tarefas e agendamentos.",
+    "permissionsHelp": "Ative a autenticação do Monitor antes de guardar credenciais. Utilize um token API PBS dedicado com a função Audit em / nas ACL do utilizador e do token, com propagação. Este painel apenas lê dados do PBS.",
+    "editConnection": "Ligação a editar",
+    "add": "Adicionar uma nova ligação",
+    "name": "Nome",
+    "url": "URL HTTPS (inclua :8007 para a porta nativa do PBS)",
+    "token_id": "ID do token API (user@realm!token)",
+    "token_secret": "Segredo do token API (deixe vazio para manter o segredo guardado)",
+    "fingerprint": "Impressão digital SHA256 do certificado (opcional)",
+    "tlsHelp": "Deixe a impressão digital vazia para a verificação normal da autoridade de certificação e do nome de anfitrião. Para um certificado autoassinado, copie a sua impressão digital SHA256 da consola PBS ou de outro canal de confiança. A impressão digital é verificada antes do envio de credenciais.",
+    "saved": "Ligação PBS verificada e guardada.",
+    "saveFailed": "Não foi possível guardar a ligação PBS.",
+    "testing": "A verificar a ligação…",
+    "save": "Verificar e guardar",
+    "remove": "Remover ligação",
+    "removeConfirm": "Remover do Monitor esta ligação PBS guardada e o respetivo token? Os dados e as tarefas PBS não são afetados.",
+    "sampled": "Recolhido em",
+    "datastores": "Armazenamentos de dados",
+    "total": "Capacidade do sistema de ficheiros",
+    "used": "Utilizado",
+    "free": "Disponível",
+    "noDatastores": "Nenhum armazenamento de dados acessível. Verifique a configuração e as permissões do utilizador e do token.",
+    "tasks": "Tarefas recentes",
+    "noTasks": "Não foram devolvidas tarefas recentes.",
+    "task": "Tarefa",
+    "started": "Iniciada",
+    "status": "Estado",
+    "running": "Em execução",
+    "jobs": "Agendamentos de manutenção",
+    "job": "Tarefa agendada",
+    "schedule": "Agendamento",
+    "sync": "Sincronização",
+    "verify": "Verificação",
+    "prune": "Limpeza",
+    "overview": "Visão geral",
+    "logs": "Registos do sistema",
+    "terminal": "Terminal",
+    "security": "Segurança",
+    "logout": "Terminar sessão",
+    "navigation": "Navegação PBS",
+    "cpu": "CPU",
+    "memory": "Memória",
+    "uptime": "Tempo de atividade",
+    "capacityUnavailable": "Capacidade não disponível.",
+    "datastoresUnavailable": "{count} indisponível",
+    "datastoresOnline": "Todos disponíveis",
+    "moreDatastores": "+{count} mais armazenamentos de dados",
+    "estimatedFull": "estimativa completa",
+    "estimatedFullUnknown": "Not enough data yet",
+    "duration": "Duração",
+    "noJobs": "nenhuma programação de sincronização, verificação ou remoção está configurada."
+  },
+  "monitorLinks": {
+    "groups": {
+      "cluster": "Cluster",
+      "standalone": "nós autônomos",
+      "pbs": "Proxmox Backup Server"
+    },
+    "thisNode": "Este nó",
+    "checking": "Verificando nós…",
+    "loadFailed": "não foi possível carregar a lista de nós.",
+    "empty": "Ainda não há outros nós. Adicione um para abrir o seu Monitor a partir daqui.",
+    "noResponse": "Sem resposta",
+    "pbsInterface": "interface PBS",
+    "openNewTab": "abrir em uma nova guia",
+    "manage": "Adicionar ou gerenciar nós…",
+    "dialogTitle": "nós vinculados",
+    "dialogDescription": "Os nós do cluster e os Proxmox Backup Server configurados são detectados automaticamente. Cada Monitor mantém o seu próprio login.",
+    "addTitle": "Adicionar um nó",
+    "name": "Nome",
+    "address": "endereço do monitor",
+    "type": "Tipo",
+    "add": "Adicionar",
+    "save": "Salvar",
+    "remove": "Remover",
+    "visible": "Visível",
+    "autoAddress": "Automático",
+    "detected": "Detectado",
+    "added": "Adicionado",
+    "saveFailed": "não foi possível salvar a lista de nós.",
+    "backTo": "Voltar para {name}",
+    "cameFromTitle": "Adicionar nó Monitor?",
+    "cameFromBody": "Adicione {name} aos nós vinculados deste Monitor.",
+    "notNow": "agora não"
   }
 }
diff --git a/AppImage/messages/sk/common.json b/AppImage/messages/sk/common.json
index c0443d05..f699d7dd 100644
--- a/AppImage/messages/sk/common.json
+++ b/AppImage/messages/sk/common.json
@@ -7,7 +7,8 @@
     "unknown": "Neznáme",
     "notAvailable": "Nedostupné",
     "serverOffline": "Server je offline",
-    "supportProject": "Podporte projekt alebo prispejte vlastnými úpravami"
+    "supportProject": "Podporte projekt alebo prispejte vlastnými úpravami",
+    "descriptionPbs": "Proxmox Backup Server Dashboard"
   },
   "common": {
     "notAvailable": "Nedostupné",
@@ -164,7 +165,8 @@
     "errors": {
       "serverUnavailableTitle": "Server Monitora nie je dostupný",
       "serverUnavailableDescription": "Nedá sa pripojiť k serveru Monitora. Skontrolujte, či služba beží, a skúste to znova."
-    }
+    },
+    "pbsVersion": "Verzia PBS:"
   },
   "storage": {
     "loadingTitle": "Načítavam úložiská...",
@@ -1131,7 +1133,21 @@
       "available": "Dostupné zálohy",
       "loading": "Načítavam zálohy...",
       "empty": "Nenašli sa žiadne zálohy",
-      "emptyHint": "Prvú zálohu vytvoríte tlačidlom vyššie"
+      "emptyHint": "Prvú zálohu vytvoríte tlačidlom vyššie",
+      "refresh": "Obnoviť",
+      "refreshFailed": "Nepodarilo sa obnoviť zálohy. Obnovte ich znova, aby ste potvrdili ich aktuálny stav.",
+      "deleteSelected": "Odstrániť vybrané ({count})",
+      "deletedCount": "Odstránené zálohy: {count}.",
+      "unconfirmedCount": "Odstránenie záloh ({count}) nebolo potvrdené. Pred ďalším pokusom obnovte zoznam a skontrolujte úlohy v Proxmoxe.",
+      "deleteFailed": "Odstránenie sa nepodarilo potvrdiť. Pred ďalším pokusom obnovte zoznam a skontrolujte úlohy v Proxmoxe.",
+      "selectHint": "Vyberte nechránené zálohy (najviac 20 v jednej dávke)",
+      "selectBackup": "Vybrať zálohu",
+      "protected": "Chránená",
+      "confirmTitle": "Odstrániť zálohy ({count})?",
+      "confirmDescription": "Tieto archívy záloh pre VM/CT {vmid} budú natrvalo odstránené. Chránené zálohy sú vylúčené. Hosť sa tým neodstráni.",
+      "deleting": "Čaká sa, kým Proxmox dokončí odstránenie vybraných archívov…",
+      "cancel": "Zrušiť",
+      "confirmDelete": "Odstrániť zálohy"
     },
     "updatesPanel": {
       "pendingTitle": "Čakajúce aktualizácie balíkov",
@@ -1668,6 +1684,16 @@
       "searchApplications": "Hľadať aplikácie",
       "searchingApplications": "Hľadajú sa aplikácie…",
       "noApplicationsDetected": "Neboli zistené žiadne aplikácie.",
+      "nativeEvidencePort": "Otvorený TCP port",
+      "nativeEvidenceFile": "Nainštalovaný súbor",
+      "nativeEvidenceProcess": "Spustený program",
+      "nativeEvidenceDirectory": "Pracovný priečinok",
+      "nativeEvidenceService": "Definícia služby",
+      "nativeScanFailed": "Vyhľadávanie aplikácií sa nepodarilo dokončiť. Predchádzajúce dôkazy môžu byť zastarané; skús to znova.",
+      "nativeScanPartial": "Vyhľadávanie aplikácií je neúplné. Skontroluj dostupné dôkazy a skús to znova.",
+      "nativeVersionUnknown": "Nainštalovaná verzia nie je známa",
+      "nativeEvidenceStale": "Dôkazy môžu byť zastarané alebo neúplné.",
+      "nativeRegisterOnly": "Registráciu potvrď v editore. Známa verzia je ručný údaj; aktualizátor nie je nastavený.",
       "noNewApplicationsDetected": "Neboli zistené žiadne nové aplikácie.",
       "oneNewApplicationDetected": "Bola zistená jedna nová aplikácia.",
       "newApplicationsDetected": "Boli zistené {count} nové aplikácie.",
@@ -1816,7 +1842,8 @@
         "logs": "Systémové záznamy",
         "updates": "Aktualizácie systému",
         "security": "Bezpečnosť a certifikáty",
-        "temperature": "Teplota"
+        "temperature": "Teplota",
+        "pbsServices": "Služby PBS"
       }
     },
     "remoteStorage": {
@@ -2110,7 +2137,13 @@
         "inactiveFooter": "Zapnite notifikácie a dostávajte upozornenia o systéme, stave a bezpečnosti cez nastavené kanály.",
         "notificationLanguage": "Jazyk notifikácií",
         "selectNotificationLanguage": "Vyberte jazyk notifikácií",
-        "notificationLanguageHint": "Používa sa pre spoľahlivé runtime notifikácie aj vtedy, keď je AI vypnutá."
+        "notificationLanguageHint": "Používa sa pre spoľahlivé runtime notifikácie aj vtedy, keď je AI vypnutá.",
+        "appriseServiceHelp": "Nastavenie Slack a Matrix",
+        "appriseSlackSteps": "V aplikácii Slack vytvorte prichádzajúci webhook pre cieľový kanál a vložte jeho úplnú HTTPS URL do poľa URL Apprise. Nie je potrebný žiadny prevod.",
+        "appriseSlackDocs": "Formáty URL a nastavenie Slack",
+        "appriseMatrixSteps": "Použite účet pre oznámenia, ktorý môže odosielať správy do miestnosti. Nahraďte vzorového používateľa, heslo, domovský server a úplné ID miestnosti; špeciálne znaky v prihlasovacích údajoch zakódujte pre URL. Schéma matrixs používa HTTPS. Podporu tokenov, SSO a šifrovaných miestností v nainštalovanej verzii Apprise nájdete v dokumentácii.",
+        "appriseMatrixDocs": "Formáty URL a nastavenie Matrix",
+        "appriseServiceFinish": "Povoľte Apprise, zadajte svoju URL, vyberte kategórie oznámení alebo jednotlivé udalosti, uložte a potom použite Odoslať test. Tieto príklady nemenia uloženú URL. Tento kanál Apprise má jeden cieľ; pre viac služieb naraz použite API Apprise."
       },
       "ai": {
         "title": "AI vylepšenie",
@@ -4755,6 +4788,24 @@
       "thursday": "štvrtok",
       "tuesday": "utorok",
       "wednesday": "streda"
+    },
+    "storageRetention": {
+      "title": "Uchovávanie záloh úložiska",
+      "keepAll": "Ponechať všetky zálohy",
+      "description": "Predvolená politika uchovávania záloh uložená v Proxmoxe. Zálohovacie úlohy s vlastnou politikou majú pred týmto predvoleným nastavením prednosť.",
+      "refresh": "Obnoviť",
+      "saved": "Politika uchovávania záloh úložiska bola uložená. Prerezávanie sa nevykonalo.",
+      "choosePolicy": "Vyberte Ponechať všetky alebo aspoň jeden počet uchovávaných záloh väčší ako nula.",
+      "saveFailed": "Nepodarilo sa uložiť politiku uchovávania záloh úložiska. Ak sa konfigurácia zmenila, obnovte zoznam.",
+      "loadFailed": "Nepodarilo sa načítať politiku uchovávania záloh úložiska.",
+      "empty": "Nenašli sa žiadne úložiská záloh.",
+      "default": "Predvolené nastavenie Proxmoxu",
+      "edit": "Upraviť",
+      "editTitle": "Uchovávanie záloh pre {storage}",
+      "effect": "Platí pre budúce zálohovania, ktoré preberajú túto politiku úložiska. Uložením sa existujúce zálohy neodstránia. Chránené zálohy zostanú chránené.",
+      "cancel": "Zrušiť",
+      "save": "Uložiť uchovávanie záloh",
+      "useDefault": "Použite predvolené nastavenie Proxmox (žiadne pravidlá pre toto úložisko)"
     }
   },
   "healthStatus": {
@@ -4785,7 +4836,8 @@
       "services": "Služby PVE",
       "logs": "Systémové záznamy",
       "updates": "Aktualizácie systému",
-      "security": "Bezpečnosť a certifikáty"
+      "security": "Bezpečnosť a certifikáty",
+      "pbsServices": "Služby PBS"
     },
     "checks": {
       "cpu_usage": "Využitie CPU",
@@ -7229,5 +7281,99 @@
         "diagnosticsOmitted": "Ďalšie diagnostické riadky alebo text vynechaný: {count}. Pôvodná správa sa zachovala."
       }
     }
+  },
+  "pbs": {
+    "title": "Proxmox Backup Server",
+    "server": "Server PBS",
+    "chooseServer": "Vybrať server PBS",
+    "local": "Miestny PBS",
+    "refresh": "Obnoviť",
+    "manage": "Spravovať pripojenia PBS",
+    "loadFailed": "Nepodarilo sa načítať stav PBS.",
+    "loading": "Načítavajú sa údaje PBS…",
+    "noServer": "Pridajte pripojenie PBS na zobrazenie dátových úložísk, úloh a plánov.",
+    "permissionsHelp": "Pred uložením prihlasovacích údajov povoľte overovanie v Monitore. Použite vyhradený API token PBS s rolou Audit na / v ACL používateľa aj tokenu, so zapnutým dedením. Tento panel údaje PBS iba číta.",
+    "editConnection": "Pripojenie na úpravu",
+    "add": "Pridať nové pripojenie",
+    "name": "Názov",
+    "url": "HTTPS URL (pre pôvodný port PBS uveďte :8007)",
+    "token_id": "ID API tokenu (user@realm!token)",
+    "token_secret": "Tajný kľúč API tokenu (ponechajte prázdne, ak chcete zachovať uložený kľúč)",
+    "fingerprint": "Odtlačok SHA256 certifikátu (voliteľný)",
+    "tlsHelp": "Pre bežné overenie certifikačnej autority a názvu hostiteľa ponechajte odtlačok prázdny. Pri certifikáte s vlastným podpisom skopírujte jeho odtlačok SHA256 z konzoly PBS alebo iného dôveryhodného kanála. Odtlačok sa kontroluje pred odoslaním prihlasovacích údajov.",
+    "saved": "Pripojenie PBS bolo overené a uložené.",
+    "saveFailed": "Nepodarilo sa uložiť pripojenie PBS.",
+    "testing": "Overuje sa pripojenie…",
+    "save": "Overiť a uložiť",
+    "remove": "Odstrániť pripojenie",
+    "removeConfirm": "Odstrániť z Monitora toto uložené pripojenie PBS a jeho token? Údaje a úlohy PBS zostanú nezmenené.",
+    "sampled": "Údaje získané",
+    "datastores": "Dátové úložiská",
+    "total": "Kapacita súborového systému",
+    "used": "Použité",
+    "free": "Dostupné",
+    "noDatastores": "Žiadne dostupné dátové úložiská. Skontrolujte konfiguráciu úložísk a oprávnenia používateľa a tokenu.",
+    "tasks": "Nedávne úlohy",
+    "noTasks": "Neboli vrátené žiadne nedávne úlohy.",
+    "task": "Úloha",
+    "started": "Spustené",
+    "status": "Stav",
+    "running": "Prebieha",
+    "jobs": "Plány údržby",
+    "job": "Plánovaná úloha",
+    "schedule": "Plán",
+    "sync": "Synchronizácia",
+    "verify": "Overenie",
+    "prune": "Prerezávanie",
+    "overview": "Prehľad",
+    "logs": "Systémové záznamy",
+    "terminal": "Terminál",
+    "security": "Zabezpečenie",
+    "logout": "Odhlásiť sa",
+    "navigation": "Navigácia PBS",
+    "cpu": "CPU",
+    "memory": "Pamäť",
+    "uptime": "Čas prevádzky",
+    "capacityUnavailable": "Kapacita nie je k dispozícii.",
+    "datastoresUnavailable": "{count} nie je k dispozícii",
+    "datastoresOnline": "Všetky dostupné",
+    "moreDatastores": "+{count} ďalších dátových úložísk",
+    "estimatedFull": "Odhadovaný plný",
+    "estimatedFullUnknown": "Zatiaľ nie je dostatok údajov",
+    "duration": "Trvanie",
+    "noJobs": "Nie sú nakonfigurované žiadne plány synchronizácie, overovania ani odstraňovania."
+  },
+  "monitorLinks": {
+    "groups": {
+      "cluster": "Cluster",
+      "standalone": "Samostatné uzly",
+      "pbs": "Proxmox Backup Server"
+    },
+    "thisNode": "Tento uzol",
+    "checking": "Kontrolujú sa uzly…",
+    "loadFailed": "Nepodarilo sa načítať zoznam uzlov.",
+    "empty": "Zatiaľ žiadne ďalšie uzly. Pridajte jeden, aby ste odtiaľto otvorili jeho Monitor.",
+    "noResponse": "Žiadna odpoveď",
+    "pbsInterface": "rozhranie PBS",
+    "openNewTab": "Otvoriť na novej karte",
+    "manage": "Pridať alebo spravovať uzly…",
+    "dialogTitle": "Prepojené uzly",
+    "dialogDescription": "Uzly klastra a nakonfigurované Proxmox Backup Server sa zisťujú automaticky. Každý Monitor má vlastné prihlásenie.",
+    "addTitle": "Pridať uzol",
+    "name": "Meno",
+    "address": "Adresa monitora",
+    "type": "Typ",
+    "add": "Pridať",
+    "save": "Uložiť",
+    "remove": "Odstrániť",
+    "visible": "Viditeľné",
+    "autoAddress": "Automaticky",
+    "detected": "Zistené",
+    "added": "Pridané",
+    "saveFailed": "Nepodarilo sa uložiť zoznam uzlov.",
+    "backTo": "Späť na {name}",
+    "cameFromTitle": "Pridať uzol monitora?",
+    "cameFromBody": "Pridajte {name} do prepojených uzlov tohto monitora.",
+    "notNow": "Teraz nie"
   }
 }
diff --git a/AppImage/messages/sv/common.json b/AppImage/messages/sv/common.json
index e82dc3ea..962de218 100644
--- a/AppImage/messages/sv/common.json
+++ b/AppImage/messages/sv/common.json
@@ -8,7 +8,8 @@
     "unknown": "Okänd",
     "notAvailable": "N/A",
     "serverOffline": "Servern är frånkopplad",
-    "supportProject": "Stöd projektet och bidra"
+    "supportProject": "Stöd projektet och bidra",
+    "descriptionPbs": "Proxmox Backup Server Dashboard"
   },
   "common": {
     "notAvailable": "N/A",
@@ -165,7 +166,8 @@
     },
     "runningCountOne": "{count} körs",
     "runningCountFew": "{count} körs",
-    "runningCountMany": "{count} körs"
+    "runningCountMany": "{count} körs",
+    "pbsVersion": "PBS-version:"
   },
   "storage": {
     "loadingTitle": "Laddar lagringsdata...",
@@ -1110,7 +1112,21 @@
       "available": "Tillgängliga säkerhetskopior",
       "loading": "Laddar säkerhetskopior...",
       "empty": "Inga säkerhetskopior hittades",
-      "emptyHint": "Skapa din första säkerhetskopia med knappen ovan"
+      "emptyHint": "Skapa din första säkerhetskopia med knappen ovan",
+      "refresh": "Uppdatera",
+      "refreshFailed": "Det gick inte att uppdatera säkerhetskopiorna. Uppdatera igen för att bekräfta deras aktuella tillstånd.",
+      "deleteSelected": "Ta bort markerade ({count})",
+      "deletedCount": "{count} säkerhetskopior har tagits bort.",
+      "unconfirmedCount": "Borttagning av {count} säkerhetskopior har inte bekräftats. Uppdatera listan och kontrollera Proxmox uppgifter innan du försöker igen.",
+      "deleteFailed": "Borttagningen kunde inte bekräftas. Uppdatera listan och kontrollera Proxmox uppgifter innan du försöker igen.",
+      "selectHint": "Välj oskyddade säkerhetskopior (upp till 20 per omgång)",
+      "selectBackup": "Välj säkerhetskopia",
+      "protected": "Skyddad",
+      "confirmTitle": "Ta bort {count} säkerhetskopior?",
+      "confirmDescription": "Dessa säkerhetskopieringsarkiv för VM/CT {vmid} kommer att tas bort permanent. Skyddade säkerhetskopior är undantagna. Detta tar inte bort gästen.",
+      "deleting": "Väntar på att Proxmox ska slutföra borttagningen av de valda arkiven…",
+      "cancel": "Avbryt",
+      "confirmDelete": "Ta bort säkerhetskopior"
     },
     "updatesPanel": {
       "pendingTitle": "Väntande paketuppdateringar",
@@ -1721,7 +1737,17 @@
       "portCategoryCustomPlaceholder": "Skriv en kategori och tryck på Enter (Esc för att avbryta)",
       "portCustomUrlPlaceholder": "Anpassad URL (t.ex. https://vault.example.com) - åsidosätter IP:port",
       "stackMemberTitle": "En del av en multicontainerapplikation",
-      "stackMemberBody": "Den här behållaren stöder en applikation vars huvudbehållare är {primary}. Applikationen, dess webblänkar och dess version visas där."
+      "stackMemberBody": "Den här behållaren stöder en applikation vars huvudbehållare är {primary}. Applikationen, dess webblänkar och dess version visas där.",
+      "nativeEvidencePort": "Lyssnande TCP-port",
+      "nativeEvidenceFile": "Installerad fil",
+      "nativeEvidenceProcess": "Körande programfil",
+      "nativeEvidenceDirectory": "Arbetskatalog",
+      "nativeEvidenceService": "Tjänstdefinition",
+      "nativeScanFailed": "Programsökningen kunde inte slutföras. Tidigare resultat kan vara inaktuella; försök igen.",
+      "nativeScanPartial": "Programsökningen är ofullständig. Granska det som hittades och försök igen.",
+      "nativeVersionUnknown": "Installerad version okänd",
+      "nativeEvidenceStale": "Det som hittades kan vara inaktuellt eller ofullständigt.",
+      "nativeRegisterOnly": "Bekräfta registreringen i redigeraren. En känd version sparas som ett manuellt värde; ingen uppdatering konfigureras."
     },
     "statusFilter": {
       "ariaLabel": "Filtrera virtuella maskiner och containrar",
@@ -1817,7 +1843,8 @@
         "logs": "Systemloggar",
         "updates": "Systemuppdateringar",
         "security": "Säkerhet och certifikat",
-        "temperature": "Temperatur"
+        "temperature": "Temperatur",
+        "pbsServices": "PBS Services"
       }
     },
     "remoteStorage": {
@@ -2078,7 +2105,7 @@
         "webhookUrl": "Webhook URL",
         "enableEmail": "Aktivera e-post",
         "smtpHost": "SMTP-värd",
-        "port": "Hamn",
+        "port": "Port",
         "tlsMode": "TLS-läge",
         "noTls": "Ingen (port 25)",
         "username": "Användarnamn",
@@ -2111,7 +2138,13 @@
         "inactiveFooter": "Aktivera aviseringar för att ta emot system-, hälso- och säkerhetsvarningar via de konfigurerade kanalerna.",
         "notificationLanguage": "Aviseringsspråk",
         "selectNotificationLanguage": "Välj språk för meddelanden",
-        "notificationLanguageHint": "Används för deterministiska körtidsmeddelanden även när AI är inaktiverat."
+        "notificationLanguageHint": "Används för deterministiska körtidsmeddelanden även när AI är inaktiverat.",
+        "appriseServiceHelp": "Konfiguration av Slack och Matrix",
+        "appriseSlackSteps": "Skapa en inkommande webhook i din Slack-app för målkanalen och klistra sedan in dess fullständiga HTTPS-URL i fältet Apprise-URL. Ingen omvandling behövs.",
+        "appriseSlackDocs": "URL-format och konfiguration för Slack",
+        "appriseMatrixSteps": "Använd ett aviseringskonto som får skicka meddelanden till rummet. Ersätt exemplets användare, lösenord, hemserver och fullständiga rums-ID; URL-koda specialtecken i inloggningsuppgifterna. Schemat matrixs använder HTTPS. Se dokumentationen för stöd för token, SSO och krypterade rum i din installerade Apprise-version.",
+        "appriseMatrixDocs": "URL-format och konfiguration för Matrix",
+        "appriseServiceFinish": "Aktivera Apprise, ange din URL, välj aviseringskategorier eller enskilda händelser, spara och använd sedan Skicka test. Dessa exempel ändrar inte din sparade URL. Denna Apprise-kanal har ett mål; använd Apprise-API för flera tjänster samtidigt."
       },
       "ai": {
         "title": "AI-förbättring",
@@ -2690,7 +2723,7 @@
         "interfaceOptional": "Gränssnitt (valfritt)",
         "applyTo": "Ansök till",
         "commentOptional": "Kommentar (valfritt)",
-        "port": "Hamn",
+        "port": "Port",
         "source": "Källa",
         "level": "Nivå",
         "interface": "Gränssnitt",
@@ -4756,6 +4789,24 @@
       "thursday": "torsdag",
       "tuesday": "tisdag",
       "wednesday": "onsdag"
+    },
+    "storageRetention": {
+      "title": "Lagringens bevarandepolicy",
+      "keepAll": "Behåll alla säkerhetskopior",
+      "description": "Standardpolicy för bevarande av säkerhetskopior, sparad i Proxmox. Säkerhetskopieringsjobb med en uttrycklig policy åsidosätter denna standard.",
+      "refresh": "Uppdatera",
+      "saved": "Lagringens bevarandepolicy har sparats. Ingen gallring har körts.",
+      "choosePolicy": "Välj Behåll alla eller minst ett bevarandeantal som är större än noll.",
+      "saveFailed": "Det gick inte att spara lagringens bevarandepolicy. Uppdatera listan om konfigurationen har ändrats.",
+      "loadFailed": "Det gick inte att läsa in lagringens bevarandepolicy.",
+      "empty": "Ingen lagring för säkerhetskopior hittades.",
+      "default": "Proxmox standard",
+      "edit": "Redigera",
+      "editTitle": "Bevarande för {storage}",
+      "effect": "Gäller framtida säkerhetskopieringar som ärver denna lagringspolicy. Att spara tar inte bort befintliga säkerhetskopior. Skyddade säkerhetskopior förblir skyddade.",
+      "cancel": "Avbryt",
+      "save": "Spara bevarandepolicy",
+      "useDefault": "Använd Proxmox-standard (ingen policy för denna lagring)"
     }
   },
   "healthStatus": {
@@ -4786,7 +4837,8 @@
       "services": "PVE-tjänster",
       "logs": "Systemloggar",
       "updates": "Systemuppdateringar",
-      "security": "Säkerhet & certifikat"
+      "security": "Säkerhet & certifikat",
+      "pbsServices": "PBS-tjänster"
     },
     "checks": {
       "cpu_usage": "CPU-användning",
@@ -7230,5 +7282,99 @@
         "diagnosticsOmitted": "Utelämnade diagnosrader eller text: {count}. Originalrapporten bevaras."
       }
     }
+  },
+  "pbs": {
+    "title": "Proxmox Backup Server",
+    "server": "PBS-server",
+    "chooseServer": "Välj en PBS-server",
+    "local": "Lokal PBS",
+    "refresh": "Uppdatera",
+    "manage": "Hantera PBS-anslutningar",
+    "loadFailed": "Det gick inte att läsa in PBS-status.",
+    "loading": "Läser in PBS-data…",
+    "noServer": "Lägg till en PBS-anslutning för att visa datalager, uppgifter och scheman.",
+    "permissionsHelp": "Aktivera Monitor-autentisering innan du sparar inloggningsuppgifter. Använd en särskild PBS-API-token med rollen Audit på / i både användarens och tokenens ACL, med nedärvning. Denna panel läser endast PBS-data.",
+    "editConnection": "Anslutning att redigera",
+    "add": "Lägg till en ny anslutning",
+    "name": "Namn",
+    "url": "HTTPS-URL (ta med :8007 för PBS ordinarie port)",
+    "token_id": "API-token-ID (user@realm!token)",
+    "token_secret": "API-tokenhemlighet (lämna tomt för att behålla den sparade hemligheten)",
+    "fingerprint": "Certifikatets SHA256-fingeravtryck (valfritt)",
+    "tlsHelp": "Lämna fingeravtrycket tomt för vanlig kontroll av certifikatutfärdare och värdnamn. För ett självsignerat certifikat kopierar du dess SHA256-fingeravtryck från PBS-konsolen eller en annan betrodd kanal. Fingeravtrycket kontrolleras innan inloggningsuppgifter skickas.",
+    "saved": "PBS-anslutningen har verifierats och sparats.",
+    "saveFailed": "Det gick inte att spara PBS-anslutningen.",
+    "testing": "Verifierar anslutningen…",
+    "save": "Verifiera och spara",
+    "remove": "Ta bort anslutningen",
+    "removeConfirm": "Ta bort denna sparade PBS-anslutning och dess token från Monitor? PBS-data och jobb påverkas inte.",
+    "sampled": "Avläst",
+    "datastores": "Datalager",
+    "total": "Filsystemets kapacitet",
+    "used": "Använt",
+    "free": "Tillgängligt",
+    "noDatastores": "Inga tillgängliga datalager. Kontrollera datalagrets konfiguration samt användarens och tokenens behörigheter.",
+    "tasks": "Senaste uppgifter",
+    "noTasks": "Inga senaste uppgifter returnerades.",
+    "task": "Uppgift",
+    "started": "Startad",
+    "status": "Status",
+    "running": "Körs",
+    "jobs": "Underhållsscheman",
+    "job": "Jobb",
+    "schedule": "Schema",
+    "sync": "Synkronisering",
+    "verify": "Verifiering",
+    "prune": "Gallring",
+    "overview": "Översikt",
+    "logs": "Systemloggar",
+    "terminal": "Terminal",
+    "security": "Säkerhet",
+    "logout": "Logga ut",
+    "navigation": "PBS-navigering",
+    "cpu": "CPU",
+    "memory": "Minne",
+    "uptime": "Drifttid",
+    "capacityUnavailable": "Kapacitet inte tillgänglig.",
+    "datastoresUnavailable": "{count} inte tillgänglig",
+    "datastoresOnline": "Alla tillgängliga",
+    "moreDatastores": "+{count} fler databutiker",
+    "estimatedFull": "Beräknad full",
+    "estimatedFullUnknown": "Inte tillräckligt med data ännu",
+    "duration": "Varaktighet",
+    "noJobs": "Inga synkroniserings-, verifierings- eller beskärningsscheman är konfigurerade."
+  },
+  "monitorLinks": {
+    "groups": {
+      "cluster": "Kluster",
+      "standalone": "Fristående noder",
+      "pbs": "Proxmox Backup Server"
+    },
+    "thisNode": "Denna nod",
+    "checking": "Kontrollerar noder...",
+    "loadFailed": "Kunde inte ladda nodlistan.",
+    "empty": "Inga andra noder än. Lägg till en för att öppna dess Monitor härifrån.",
+    "noResponse": "Inget svar",
+    "pbsInterface": "PBS-gränssnitt",
+    "openNewTab": "Öppna i en ny flik",
+    "manage": "Lägg till eller hantera noder...",
+    "dialogTitle": "Länkade noder",
+    "dialogDescription": "Klusternoder och konfigurerade Proxmox Backup Server identifieras automatiskt. Varje Monitor behåller sin egen inloggning.",
+    "addTitle": "Lägg till en nod",
+    "name": "Namn",
+    "address": "Övervaka adress",
+    "type": "Typ",
+    "add": "Lägg till",
+    "save": "Spara",
+    "remove": "Ta bort",
+    "visible": "Synlig",
+    "autoAddress": "Automatisk",
+    "detected": "Upptäckt",
+    "added": "Tillagd",
+    "saveFailed": "Kunde inte spara nodlistan.",
+    "backTo": "Tillbaka till {name}",
+    "cameFromTitle": "Lägg till monitornod?",
+    "cameFromBody": "Lägg till {name} till de länkade noderna på denna monitor.",
+    "notNow": "Inte nu"
   }
 }
diff --git a/AppImage/scripts/auth_manager.py b/AppImage/scripts/auth_manager.py
index dbfb96ae..c405fb5d 100644
--- a/AppImage/scripts/auth_manager.py
+++ b/AppImage/scripts/auth_manager.py
@@ -1115,6 +1115,9 @@ def _detect_proxmox_certificate_paths():
         return PROXMOX_CUSTOM_CERT_PATH, PROXMOX_CUSTOM_KEY_PATH
     if os.path.isfile(PROXMOX_CERT_PATH) and os.path.isfile(PROXMOX_KEY_PATH):
         return PROXMOX_CERT_PATH, PROXMOX_KEY_PATH
+    pbs_cert, pbs_key = "/etc/proxmox-backup/proxy.pem", "/etc/proxmox-backup/proxy.key"
+    if os.path.isfile(pbs_cert) and os.path.isfile(pbs_key):
+        return pbs_cert, pbs_key
     return "", ""
 
 
diff --git a/AppImage/scripts/build_appimage.sh b/AppImage/scripts/build_appimage.sh
index b0df1302..4bee9953 100755
--- a/AppImage/scripts/build_appimage.sh
+++ b/AppImage/scripts/build_appimage.sh
@@ -141,6 +141,7 @@ cp "$SCRIPT_DIR/oci_console_logs.py" "$APP_DIR/usr/bin/" 2>/dev/null || echo "
 cp "$SCRIPT_DIR/oci_instance_info.py" "$APP_DIR/usr/bin/" 2>/dev/null || echo "⚠️  oci_instance_info.py not found"
 cp "$SCRIPT_DIR/oci_operations.py" "$APP_DIR/usr/bin/" 2>/dev/null || echo "⚠️  oci_operations.py not found"
 cp "$SCRIPT_DIR/disk_temperature_history.py" "$APP_DIR/usr/bin/" 2>/dev/null || echo "⚠️  disk_temperature_history.py not found"
+cp "$SCRIPT_DIR/lvm_device_scope.py" "$APP_DIR/usr/bin/"
 cp "$SCRIPT_DIR/smartctl_resolver.py" "$APP_DIR/usr/bin/" 2>/dev/null || echo "⚠️  smartctl_resolver.py not found"
 cp "$SCRIPT_DIR/disk_identity.py" "$APP_DIR/usr/bin/" 2>/dev/null || echo "⚠️  disk_identity.py not found"
 cp "$SCRIPT_DIR/health_thresholds.py" "$APP_DIR/usr/bin/" 2>/dev/null || echo "⚠️  health_thresholds.py not found"
@@ -148,6 +149,7 @@ cp "$SCRIPT_DIR/managed_installs.py" "$APP_DIR/usr/bin/" 2>/dev/null || echo "
 cp "$SCRIPT_DIR/lxc_update_observation.py" "$APP_DIR/usr/bin/"
 cp "$SCRIPT_DIR/lxc_update_finalization.py" "$APP_DIR/usr/bin/"
 cp "$SCRIPT_DIR/lxc_check_job.py" "$APP_DIR/usr/bin/"
+cp "$SCRIPT_DIR/native_app_discovery.py" "$APP_DIR/usr/bin/"
 cp "$SCRIPT_DIR/lxc_apps.py" "$APP_DIR/usr/bin/" 2>/dev/null || echo "⚠️  lxc_apps.py not found"
 cp "$SCRIPT_DIR/custom_links.py" "$APP_DIR/usr/bin/" 2>/dev/null || echo "⚠️  custom_links.py not found"
 cp "$SCRIPT_DIR/recreate_docker_container.py" "$APP_DIR/usr/bin/" 2>/dev/null || echo "⚠️  recreate_docker_container.py not found"
@@ -160,6 +162,11 @@ cp "$SCRIPT_DIR/flask_terminal_routes.py" "$APP_DIR/usr/bin/" 2>/dev/null || ech
 cp "$SCRIPT_DIR/hardware_monitor.py" "$APP_DIR/usr/bin/" 2>/dev/null || echo "⚠️  hardware_monitor.py not found"
 cp "$SCRIPT_DIR/temperature_sensor_resolver.py" "$APP_DIR/usr/bin/" 2>/dev/null || echo "⚠️  temperature_sensor_resolver.py not found"
 cp "$SCRIPT_DIR/proxmox_storage_monitor.py" "$APP_DIR/usr/bin/" 2>/dev/null || echo "⚠️  proxmox_storage_monitor.py not found"
+cp "$SCRIPT_DIR/pbs_manager.py" "$APP_DIR/usr/bin/"
+cp "$SCRIPT_DIR/flask_pbs_routes.py" "$APP_DIR/usr/bin/"
+cp "$SCRIPT_DIR/monitor_links.py" "$APP_DIR/usr/bin/"
+cp "$SCRIPT_DIR/flask_monitor_links_routes.py" "$APP_DIR/usr/bin/"
+cp "$APPIMAGE_ROOT/../scripts/global/proxmox_platform.py" "$APP_DIR/usr/bin/"
 cp "$SCRIPT_DIR/flask_script_runner.py" "$APP_DIR/usr/bin/" 2>/dev/null || echo "⚠️  flask_script_runner.py not found"
 cp "$SCRIPT_DIR/security_manager.py" "$APP_DIR/usr/bin/" 2>/dev/null || echo "⚠️  security_manager.py not found"
 cp "$SCRIPT_DIR/flask_security_routes.py" "$APP_DIR/usr/bin/" 2>/dev/null || echo "⚠️  flask_security_routes.py not found"
@@ -181,6 +188,7 @@ done
 cp "$SCRIPT_DIR/oci_manager.py" "$APP_DIR/usr/bin/" 2>/dev/null || echo "⚠️  oci_manager.py not found"
 cp "$SCRIPT_DIR/flask_oci_routes.py" "$APP_DIR/usr/bin/" 2>/dev/null || echo "⚠️  flask_oci_routes.py not found"
 cp "$SCRIPT_DIR/flask_vm_backup_routes.py" "$APP_DIR/usr/bin/" 2>/dev/null || echo "⚠️  flask_vm_backup_routes.py not found"
+cp "$SCRIPT_DIR/guest_backup_archives.py" "$APP_DIR/usr/bin/"
 cp "$SCRIPT_DIR/flask_audit_routes.py" "$APP_DIR/usr/bin/" 2>/dev/null || echo "⚠️  flask_audit_routes.py not found"
 cp "$SCRIPT_DIR/audit_store.py" "$APP_DIR/usr/bin/" 2>/dev/null || echo "⚠️  audit_store.py not found"
 cp "$SCRIPT_DIR/audit_checks.py" "$APP_DIR/usr/bin/" 2>/dev/null || echo "⚠️  audit_checks.py not found"
diff --git a/AppImage/scripts/disk_temperature_history.py b/AppImage/scripts/disk_temperature_history.py
index baecafbd..2100c355 100644
--- a/AppImage/scripts/disk_temperature_history.py
+++ b/AppImage/scripts/disk_temperature_history.py
@@ -526,6 +526,16 @@ def disk_read_policy(disk_name: str, excluded: Optional[set] = None) -> str:
     return IDLE
 
 
+def settle_own_reads(disk_names) -> None:
+    """A reader that has just read these disks itself takes their counters as
+    the new baseline, so its own I/O never counts as activity."""
+    stats = _read_diskstats()
+    with _cache_lock:
+        for name in disk_names:
+            if name in _last_io and name in stats:
+                _last_io[name] = stats[name]
+
+
 def is_disk_idle(disk_name: str) -> bool:
     """True while the disk is being left alone for having no I/O."""
     ts = _idle_state.get(disk_name)
diff --git a/AppImage/scripts/flask_auth_routes.py b/AppImage/scripts/flask_auth_routes.py
index 328b66ba..9372f0db 100644
--- a/AppImage/scripts/flask_auth_routes.py
+++ b/AppImage/scripts/flask_auth_routes.py
@@ -560,10 +560,12 @@ def totp_setup():
     """Initialize TOTP setup for a user"""
     try:
         token = request.headers.get('Authorization', '').replace('Bearer ', '')
-        username = auth_manager.verify_token(token)
+        username, scope = auth_manager.verify_token_full(token)
         
         if not username:
             return jsonify({"success": False, "message": "Unauthorized"}), 401
+        if scope != 'full_admin':
+            return jsonify({"success": False, "message": "This action requires a full_admin token"}), 403
         
         success, secret, qr_code, backup_codes, message = auth_manager.setup_totp(username)
         
@@ -586,10 +588,12 @@ def totp_enable():
     """Enable TOTP after verification"""
     try:
         token = request.headers.get('Authorization', '').replace('Bearer ', '')
-        username = auth_manager.verify_token(token)
+        username, scope = auth_manager.verify_token_full(token)
         
         if not username:
             return jsonify({"success": False, "message": "Unauthorized"}), 401
+        if scope != 'full_admin':
+            return jsonify({"success": False, "message": "This action requires a full_admin token"}), 403
         
         data = request.json
         verification_token = data.get('token')
@@ -612,10 +616,12 @@ def totp_disable():
     """Disable TOTP (requires password confirmation)"""
     try:
         token = request.headers.get('Authorization', '').replace('Bearer ', '')
-        username = auth_manager.verify_token(token)
+        username, scope = auth_manager.verify_token_full(token)
         
         if not username:
             return jsonify({"success": False, "message": "Unauthorized"}), 401
+        if scope != 'full_admin':
+            return jsonify({"success": False, "message": "This action requires a full_admin token"}), 403
         
         data = request.json or {}
         password = data.get('password')
@@ -653,10 +659,12 @@ def generate_api_token():
         if not token:
             return jsonify({"success": False, "message": "Unauthorized. Please log in first."}), 401
         
-        username = auth_manager.verify_token(token)
+        username, scope = auth_manager.verify_token_full(token)
         
         if not username:
             return jsonify({"success": False, "message": "Invalid or expired session. Please log in again."}), 401
+        if scope != 'full_admin':
+            return jsonify({"success": False, "message": "This action requires a full_admin token"}), 403
         
         data = request.json
         password = data.get('password')
@@ -749,8 +757,11 @@ def revoke_api_token_route(token_id):
             return jsonify({"success": False, "message": "Authentication is not configured"}), 400
 
         token = request.headers.get('Authorization', '').replace('Bearer ', '')
-        if not token or not auth_manager.verify_token(token):
+        username, scope = auth_manager.verify_token_full(token) if token else (None, None)
+        if not username:
             return jsonify({"success": False, "message": "Unauthorized"}), 401
+        if scope != 'full_admin':
+            return jsonify({"success": False, "message": "This action requires a full_admin token"}), 403
 
         success, message = auth_manager.revoke_api_token(token_id)
 
diff --git a/AppImage/scripts/flask_monitor_links_routes.py b/AppImage/scripts/flask_monitor_links_routes.py
new file mode 100644
index 00000000..24c7d3ee
--- /dev/null
+++ b/AppImage/scripts/flask_monitor_links_routes.py
@@ -0,0 +1,58 @@
+"""Links between ProxMenux Monitors for the node selector in the header."""
+
+from flask import Blueprint, jsonify, request
+import monitor_links
+from jwt_middleware import require_auth, require_admin_scope
+
+monitor_links_bp = Blueprint("monitor_links", __name__)
+
+
+@monitor_links_bp.after_request
+def no_cache(response):
+    response.headers["Cache-Control"] = "no-store"
+    return response
+
+
+@monitor_links_bp.route("/api/monitor-links")
+@require_auth
+def list_links():
+    return jsonify(monitor_links.cached_links(include_hidden=request.args.get("all") == "1"))
+
+
+@monitor_links_bp.route("/api/monitor-links", methods=["POST"])
+@require_admin_scope
+def add_link():
+    try:
+        key = monitor_links.add_link(request.get_json(silent=True))
+        monitor_links.refresh()
+        return jsonify(success=True, key=key)
+    except monitor_links.LinkError as exc:
+        return jsonify(error=str(exc)), 400
+    except OSError:
+        return jsonify(error="Could not save the node list."), 500
+
+
+@monitor_links_bp.route("/api/monitor-links/<path:key>", methods=["PATCH"])
+@require_admin_scope
+def update_link(key):
+    try:
+        monitor_links.update_link(key, request.get_json(silent=True))
+        monitor_links.refresh()
+        return jsonify(success=True)
+    except monitor_links.LinkError as exc:
+        return jsonify(error=str(exc)), 400
+    except OSError:
+        return jsonify(error="Could not save the node list."), 500
+
+
+@monitor_links_bp.route("/api/monitor-links/<path:key>", methods=["DELETE"])
+@require_admin_scope
+def delete_link(key):
+    try:
+        monitor_links.delete_link(key)
+        monitor_links.refresh()
+        return jsonify(success=True)
+    except monitor_links.LinkError as exc:
+        return jsonify(error=str(exc)), 400
+    except OSError:
+        return jsonify(error="Could not save the node list."), 500
diff --git a/AppImage/scripts/flask_notification_routes.py b/AppImage/scripts/flask_notification_routes.py
index 2354141d..907ad3b6 100644
--- a/AppImage/scripts/flask_notification_routes.py
+++ b/AppImage/scripts/flask_notification_routes.py
@@ -1156,6 +1156,14 @@ def setup_pve_webhook_core() -> dict:
         'fallback_commands': [],
         'error': None,
     }
+    try:  # Proxmox Backup Server has no /etc/pve notification configuration
+        from pbs_manager import is_pbs_host
+        on_pbs = is_pbs_host()
+    except Exception:
+        on_pbs = False
+    if on_pbs:
+        result['not_applicable'] = True
+        return result
     
     try:
         if not _pve_cluster_fs_mounted():
@@ -1339,6 +1347,13 @@ def cleanup_pve_webhook_core() -> dict:
     Only removes blocks named 'proxmenux-webhook' / 'proxmenux-default'.
     """
     result = {'cleaned': False, 'error': None}
+    try:  # Proxmox Backup Server has no /etc/pve notification configuration
+        from pbs_manager import is_pbs_host
+        on_pbs = is_pbs_host()
+    except Exception:
+        on_pbs = False
+    if on_pbs:
+        return {'cleaned': True, 'error': None, 'not_applicable': True}
     
     try:
         if not _pve_cluster_fs_mounted():
diff --git a/AppImage/scripts/flask_pbs_routes.py b/AppImage/scripts/flask_pbs_routes.py
new file mode 100644
index 00000000..4e41936f
--- /dev/null
+++ b/AppImage/scripts/flask_pbs_routes.py
@@ -0,0 +1,71 @@
+"""Read-only PBS status and administrative connection management."""
+
+from flask import Blueprint, jsonify, request
+import auth_manager
+import pbs_manager as pbs
+from jwt_middleware import require_auth, require_admin_scope
+
+pbs_bp = Blueprint("pbs", __name__)
+
+
+@pbs_bp.after_request
+def no_cache(response):
+    response.headers["Cache-Control"] = "no-store"
+    return response
+
+
+@pbs_bp.route("/api/platform")
+@require_auth
+def platform():
+    return jsonify(pbs.get_platform())
+
+
+@pbs_bp.route("/api/pbs/servers")
+@require_auth
+def servers():
+    try:
+        return jsonify(servers=pbs.public_servers(), local_available=pbs.is_pbs_host())
+    except pbs.PBSError as exc:
+        return jsonify(error=str(exc)), 500
+
+
+def _protected_configuration():
+    local = auth_manager.load_auth_config()
+    return local.get("enabled") and not local.get("declined") and local.get("password_hash")
+
+
+@pbs_bp.route("/api/pbs/servers", methods=["POST"])
+@require_admin_scope
+def save_server():
+    if not _protected_configuration():
+        return jsonify(error="Enable local authentication before saving remote PBS credentials."), 409
+    try:
+        identifier = pbs.save_server(request.get_json(silent=True))
+        return jsonify(success=True, id=identifier, servers=pbs.public_servers())
+    except pbs.PBSError as exc:
+        return jsonify(error=str(exc)), 400
+    except OSError:
+        return jsonify(error="Could not save PBS connection."), 500
+
+
+@pbs_bp.route("/api/pbs/servers/<identifier>", methods=["DELETE"])
+@require_admin_scope
+def delete_server(identifier):
+    if not _protected_configuration():
+        return jsonify(error="Enable local authentication before changing PBS connections."), 409
+    try:
+        pbs.delete_server(identifier)
+        return jsonify(success=True)
+    except pbs.PBSError as exc:
+        return jsonify(error=str(exc)), 400
+    except OSError:
+        return jsonify(error="Could not remove PBS connection."), 500
+
+
+@pbs_bp.route("/api/pbs/status")
+@require_auth
+def status():
+    try:
+        return jsonify(pbs.get_status(request.args.get("server", "local")))
+    except pbs.PBSError as exc:
+        return jsonify(error=str(exc)), 502
diff --git a/AppImage/scripts/flask_proxmenux_routes.py b/AppImage/scripts/flask_proxmenux_routes.py
index 48da2fbe..a5fa8266 100644
--- a/AppImage/scripts/flask_proxmenux_routes.py
+++ b/AppImage/scripts/flask_proxmenux_routes.py
@@ -35,7 +35,7 @@ TOOL_METADATA = {
     'system_utils':         {'name': 'System Utilities',                       'function': 'install_system_utils',         'version': '1.0'},
     'network_optimization': {'name': 'Network Optimizations',                 'function': 'apply_network_optimizations',  'version': '1.0'},
     'bashrc_custom':        {'name': 'Bashrc Customization',                  'function': 'customize_bashrc',             'version': '1.0'},
-    'figurine':             {'name': 'Figurine',                              'function': 'configure_figurine',           'version': '1.0'},
+    'figurine':             {'name': 'Figurine',                              'function': 'configure_figurine',           'version': '1.2'},
     'fastfetch':            {'name': 'Fastfetch',                             'function': 'configure_fastfetch',          'version': '1.0'},
     'log2ram':              {'name': 'Log2ram (SSD Protection)',               'function': 'configure_log2ram',            'version': '1.0'},
     'zfs_autotrim':         {'name': 'ZFS Autotrim',                          'function': 'enable_zfs_autotrim',          'version': '1.0'},
diff --git a/AppImage/scripts/flask_server.py b/AppImage/scripts/flask_server.py
index ec9d029e..70cc4174 100644
--- a/AppImage/scripts/flask_server.py
+++ b/AppImage/scripts/flask_server.py
@@ -90,11 +90,16 @@ from flask_terminal_routes import (  # noqa: E402
 from flask_health_routes import health_bp  # noqa: E402
 from flask_auth_routes import auth_bp  # noqa: E402
 from flask_proxmenux_routes import proxmenux_bp  # noqa: E402
+from flask_pbs_routes import pbs_bp  # noqa: E402
+from flask_monitor_links_routes import monitor_links_bp  # noqa: E402
+from pbs_manager import get_platform, is_pbs_host  # noqa: E402
 from flask_security_routes import security_bp  # noqa: E402
 from flask_notification_routes import notification_bp  # noqa: E402
 from flask_oci_routes import oci_bp  # noqa: E402
 from flask_audit_routes import audit_bp  # noqa: E402
 from flask_vm_backup_routes import vm_backup_bp  # noqa: E402
+from guest_backup_archives import (BackupArchiveError, delete_guest_backups,
+                                   guest_backup_deletion_status)  # noqa: E402
 from notification_manager import notification_manager, resolve_notification_hostname  # noqa: E402
 import post_install_versions  # noqa: E402  — Sprint 12A: detect post-install function updates
 from jwt_middleware import require_auth, require_auth_or_ticket, require_admin_scope  # noqa: E402
@@ -193,6 +198,8 @@ post_install_versions.scan_at_startup()
 app.register_blueprint(auth_bp)
 app.register_blueprint(health_bp)
 app.register_blueprint(proxmenux_bp)
+app.register_blueprint(pbs_bp)
+app.register_blueprint(monitor_links_bp)
 app.register_blueprint(security_bp)
 app.register_blueprint(notification_bp)
 app.register_blueprint(oci_bp)
@@ -2271,6 +2278,8 @@ def _handle_guest_lifecycle(vmid: str, vm_type: str, action: str) -> None:
     # or stops; drop the cached IP so the next /api/vms poll re-reads
     # it via `lxc-info`. QEMU guests do not touch this cache.
     if guest_type == 'lxc':
+        import native_app_discovery
+        native_app_discovery.mark_stale(guest_id)
         _invalidate_lxc_ip(guest_id)
     if action in ('start', 'reboot'):
         if guest_type == 'lxc':
@@ -3474,6 +3483,8 @@ def get_coral_info():
 def get_proxmox_version():
     """Get Proxmox version if available. Cached for 6 hours."""
     global _system_info_cache
+    if is_pbs_host():
+        return get_platform().get('version')
     
     now = time.time()
     if _system_info_cache['proxmox_version'] is not None and \
@@ -4186,13 +4197,17 @@ def get_system_disks():
         pass
     
     try:
-        # 4. Check LVM physical volumes. `--devices` (added when a disk
-        # is parked) keeps pvs from scanning — and waking — standby HDDs.
+        # 4. Check LVM physical volumes. `--devices` keeps pvs off the disks
+        # that are excluded, idle or asleep.
+        dev_args = _lvm_device_args()
         result = subprocess.run(
-            ['pvs', *_lvm_device_args(), '--noheadings', '-o', 'pv_name,vg_name'],
+            ['pvs', *dev_args, '--noheadings', '-o', 'pv_name,vg_name'],
             capture_output=True, text=True, timeout=5
-        )
-        if result.returncode == 0:
+        ) if dev_args is not None else None
+        if result is not None:
+            from lvm_device_scope import settle_scan_reads
+            settle_scan_reads()
+        if result is not None and result.returncode == 0:
             for line in result.stdout.strip().split('\n'):
                 if line.strip():
                     parts = line.split()
@@ -4534,6 +4549,8 @@ def get_storage_info():
                         disk_info['used'] = round(partition_usage.used / (1024**3), 1)
                         disk_info['available'] = round(partition_usage.free / (1024**3), 1)
                         disk_info['usage_percent'] = round(partition_usage.percent, 1)
+                        disk_info['total_bytes'] = partition_usage.total
+                        disk_info['used_bytes'] = partition_usage.used
                         
                 except PermissionError:
                     continue
@@ -5002,42 +5019,10 @@ def _hdd_in_standby(disk_name: str) -> bool:
     return parked
 
 
-def _lvm_device_args() -> list:
-    """Build the `--devices` argument that keeps an LVM tool (pvs/lvs/
-    vgs) off parked disks.
-
-    LVM tools scan every block device by default, which spins up a
-    standby HDD (issue #232). When any rotational disk is asleep, hand
-    LVM an explicit list of every block node EXCEPT those belonging to a
-    parked disk, so it never opens the sleeping drives. Each partition
-    must be listed too — `--devices /dev/sda` alone does not cover a PV
-    on /dev/sda3. Returns [] when nothing is parked, so hosts without
-    standby disks keep the plain pvs/lvs/vgs call unchanged.
-    """
-    try:
-        r = subprocess.run(
-            ['lsblk', '-rno', 'NAME,TYPE,PKNAME'],
-            capture_output=True, text=True, timeout=5)
-        if r.returncode != 0:
-            return []
-        nodes = []
-        for line in r.stdout.strip().split('\n'):
-            parts = line.split()
-            if len(parts) < 2 or parts[1] not in ('disk', 'part'):
-                continue
-            name = parts[0]
-            base = name if parts[1] == 'disk' else (parts[2] if len(parts) > 2 else name)
-            nodes.append((name, base))
-        standby_bases = {
-            name for name, base in nodes
-            if name == base and _hdd_in_standby(name)
-        }
-        if not standby_bases:
-            return []
-        devices = [f'/dev/{name}' for name, base in nodes if base not in standby_bases]
-        return ['--devices', ','.join(devices)] if devices else []
-    except (subprocess.SubprocessError, OSError):
-        return []
+def _lvm_device_args():
+    """None means no automatic scan; [] permits LVM's normal scan."""
+    from lvm_device_scope import lvm_device_args
+    return lvm_device_args(_hdd_in_standby)
 
 
 def get_smart_data(disk_name):
@@ -9863,6 +9848,7 @@ def api_system():
             'cpu_cores': cpu_cores,
             'cpu_threads': cpu_threads,
             'proxmox_version': proxmox_version,
+            'platform': get_platform(),
             'kernel_version': kernel_version,
             'available_updates': available_updates
         })
@@ -12234,6 +12220,17 @@ def _get_node_metrics_payload(timeframe, max_age=_NODE_METRICS_TTL):
         lock.release()
 
 
+def _node_rrd_command(local_node, timeframe, cf=None):
+    """Node RRD query; Proxmox Backup Server keeps the same fields under its own API."""
+    if is_pbs_host():
+        return ['proxmox-backup-debug', 'api', 'get', '/nodes/localhost/rrd',
+                '--timeframe', timeframe, '--cf', cf or 'AVERAGE', '--output-format', 'json']
+    command = ['pvesh', 'get', f'/nodes/{local_node}/rrddata', '--timeframe', timeframe]
+    if cf:
+        command += ['--cf', cf]
+    return command + ['--output-format', 'json']
+
+
 def _compute_node_metrics_payload(timeframe: str) -> dict:
     """Fetch and shape one node RRD snapshot within a bounded query budget."""
     valid_timeframes = ('hour', 'day', 'week', 'month', 'year')
@@ -12257,8 +12254,7 @@ def _compute_node_metrics_payload(timeframe: str) -> dict:
 
     try:
         rrd_result = subprocess.run(
-            ['pvesh', 'get', f'/nodes/{local_node}/rrddata',
-             '--timeframe', timeframe, '--output-format', 'json'],
+            _node_rrd_command(local_node, timeframe),
             capture_output=True, text=True, timeout=_NODE_METRICS_TIMEOUT,
         )
     except subprocess.TimeoutExpired:
@@ -12352,9 +12348,7 @@ def _compute_node_metrics_payload(timeframe: str) -> dict:
             return None
         try:
             extra = subprocess.run(
-                ['pvesh', 'get', f'/nodes/{local_node}/rrddata',
-                 '--timeframe', timeframe, '--cf', cf,
-                 '--output-format', 'json'],
+                _node_rrd_command(local_node, timeframe, cf),
                 capture_output=True, text=True, timeout=remaining,
             )
             if extra.returncode == 0 and extra.stdout:
@@ -13103,7 +13097,6 @@ def api_create_backup(vmid):
         mode = data.get('mode', 'snapshot')  # snapshot, suspend, stop
         compress = data.get('compress', 'zstd')  # none, lzo, gzip, zstd
         protected = data.get('protected', False)  # True/False
-        notification = data.get('notification', 'auto')  # always, failure, never, auto
         notes = data.get('notes', '')  # Backup notes/description
         pbs_change_detection = data.get('pbs_change_detection', None)  # default, legacy, data (for PBS + LXC)
         
@@ -13303,6 +13296,32 @@ def api_create_backup(vmid):
     except Exception as e:
         return jsonify({'error': str(e)}), 500
 
+@app.route('/api/vms/<int:vmid>/backups/delete', methods=['POST'])
+@require_admin_scope
+def api_delete_vm_backups(vmid):
+    """Delete an explicitly confirmed selection, revalidated by Proxmox."""
+    try:
+        return jsonify(delete_guest_backups(vmid, request.get_json(silent=True)))
+    except BackupArchiveError as error:
+        return jsonify({'error': str(error)}), error.code
+    finally:
+        # Native deletion may have started even if the pvesh response was lost.
+        _vm_cache_invalidate(vmid, _vm_backups_cache)
+
+
+@app.route('/api/vms/<int:vmid>/backups/delete-status', methods=['GET'])
+@require_admin_scope
+def api_vm_backup_deletion_status(vmid):
+    """Only poll deletion tasks started here for this guest."""
+    try:
+        result = guest_backup_deletion_status(vmid, request.args.get('task'))
+        if result['status'] != 'pending':
+            _vm_cache_invalidate(vmid, _vm_backups_cache)
+        return jsonify(result)
+    except BackupArchiveError as error:
+        return jsonify({'error': str(error)}), error.code
+
+
 @app.route('/api/vms/<int:vmid>/backups', methods=['GET'])
 @require_auth
 def api_vm_backups(vmid):
@@ -13383,6 +13402,7 @@ def api_vm_backups(vmid):
                             'timestamp': ctime,
                             'date': datetime.fromtimestamp(ctime).strftime('%Y-%m-%d %H:%M') if ctime else '',
                             'notes': item.get('notes', ''),
+                            'protected': item.get('protected', False) not in (False, 0, '0', '', None),
                         })
                 except Exception:
                     pass
@@ -13595,6 +13615,19 @@ def get_task_log(upid):
         traceback.print_exc()
         return jsonify({'error': str(e)}), 500
 
+def _installed_proxmenux_version():
+    """Installed ProxMenux version; a beta install keeps beta_version.txt."""
+    for name in ('beta_version.txt', 'version.txt'):
+        try:
+            with open(f'/usr/local/share/proxmenux/{name}') as fh:
+                version = fh.read().strip()
+            if version:
+                return version
+        except OSError:
+            continue
+    return ''
+
+
 @app.route('/api/health', methods=['GET'])
 @require_auth
 def api_health():
@@ -13602,7 +13635,7 @@ def api_health():
     return jsonify({
         'status': 'healthy',
         'timestamp': datetime.now().isoformat(),
-        'version': '1.2.2'
+        'version': _installed_proxmenux_version()
     })
 
 # ─── User-configurable health thresholds ─────────────────────────────────────
@@ -14083,6 +14116,20 @@ def api_vm_apps_suggestions(vmid):
         return jsonify({'error': str(e)}), 500
 
 
+@app.route('/api/vms/<int:vmid>/apps/native-discovery', methods=['GET', 'POST'])
+@require_auth
+def api_vm_apps_native_discovery(vmid):
+    """Only the Find applications button requests POST. GET never probes."""
+    import native_app_discovery
+    import lxc_apps
+    result = (native_app_discovery.discover(vmid) if request.method == 'POST'
+              else native_app_discovery.cached(vmid))
+    suggestions = _vm_cache_get(_vm_app_suggestions_cache, vmid, _VM_APP_SUGGESTIONS_TTL) or {}
+    sidecar = lxc_apps.load_sidecar(vmid) or {}
+    return jsonify(native_app_discovery.filter_candidates(
+        result, suggestions, sidecar.get('apps') or []))
+
+
 @app.route('/api/vms/<int:vmid>/apps/adguard-setup', methods=['GET'])
 @require_auth
 def api_vm_apps_adguard_setup(vmid):
@@ -15014,11 +15061,11 @@ def api_prometheus():
             disk_name = disk.get('name', 'unknown')
             metrics.append(f'# HELP proxmox_disk_total_bytes Total disk space in bytes')
             metrics.append(f'# TYPE proxmox_disk_total_bytes gauge')
-            metrics.append(f'proxmox_disk_total_bytes{{node="{node}",disk="{disk_name}"}} {disk.get("total", 0)} {timestamp}')
+            metrics.append(f'proxmox_disk_total_bytes{{node="{node}",disk="{disk_name}"}} {disk.get("total_bytes", 0)} {timestamp}')
             
             metrics.append(f'# HELP proxmox_disk_used_bytes Used disk space in bytes')
             metrics.append(f'# TYPE proxmox_disk_used_bytes gauge')
-            metrics.append(f'proxmox_disk_used_bytes{{node="{node}",disk="{disk_name}"}} {disk.get("used", 0)} {timestamp}')
+            metrics.append(f'proxmox_disk_used_bytes{{node="{node}",disk="{disk_name}"}} {disk.get("used_bytes", 0)} {timestamp}')
             
             metrics.append(f'# HELP proxmox_disk_usage_percent Disk usage percentage')
             metrics.append(f'# TYPE proxmox_disk_usage_percent gauge')
@@ -23186,9 +23233,11 @@ if __name__ == '__main__':
             except Exception as e:
                 print(f"[ProxMenux] Disk temperature history init failed: {e}")
             try:
-                import managed_installs
-                managed_installs.detect_and_register()
-                print("[ProxMenux] Managed-installs registry initialised")
+                # A PBS host has no guests whose applications could be tracked.
+                if not is_pbs_host():
+                    import managed_installs
+                    managed_installs.detect_and_register()
+                    print("[ProxMenux] Managed-installs registry initialised")
             except Exception as e:
                 print(f"[ProxMenux] managed_installs init failed: {e}")
             # Docker inventories are derived runtime data and intentionally
@@ -23330,6 +23379,9 @@ if __name__ == '__main__':
     # the 24 h PollingCollector cycle. Runs in a daemon thread with
     # a delay so it doesn't block startup — notification_manager needs
     # a moment to bind channels before we emit.
+    # The guest services below read VMs and LXCs, which do not exist on a
+    # Proxmox Backup Server.
+    pve_host = not is_pbs_host()
     try:
         def _startup_emit_pending_app_updates():
             time.sleep(15)  # let channels bind + first metrics collect
@@ -23339,8 +23391,9 @@ if __name__ == '__main__':
             except Exception as e:
                 print(f"[ProxMenux] startup emit_all_pending_updates failed: {e}",
                       file=sys.stderr, flush=True)
-        threading.Thread(target=_startup_emit_pending_app_updates, daemon=True,
-                         name='app-updates-startup-emit').start()
+        if pve_host:
+            threading.Thread(target=_startup_emit_pending_app_updates, daemon=True,
+                             name='app-updates-startup-emit').start()
     except Exception as e:
         print(f"[ProxMenux] app-updates startup emitter failed to arm: {e}")
 
@@ -23352,6 +23405,13 @@ if __name__ == '__main__':
     except Exception as e:
         print(f"[ProxMenux] Node-metrics prewarmer failed to start: {e}")
 
+    # Linked Monitors for the header node selector, renewed every 5 minutes.
+    try:
+        import monitor_links
+        monitor_links.start_prewarmer()
+    except Exception as e:
+        print(f"[ProxMenux] Monitor links prewarmer failed to start: {e}")
+
     # ── VM/CT modal-cache prewarmer ──
     # Keeps _vm_details_cache / _vm_backups_cache / app snapshots /
     # _vm_schedule_cache warm from the backend so the "Loading
@@ -23359,9 +23419,10 @@ if __name__ == '__main__':
     # after the tab has been closed for minutes. The React-side
     # prefetcher only ran while the page was open.
     try:
-        vm_modal_thread = threading.Thread(target=_vm_modal_prewarmer_loop, daemon=True, name='vm-modal-prewarmer')
-        vm_modal_thread.start()
-        print("[ProxMenux] VM-modal prewarmer started (one-shot warm-up; caches refreshed by event invalidation only)")
+        if pve_host:
+            vm_modal_thread = threading.Thread(target=_vm_modal_prewarmer_loop, daemon=True, name='vm-modal-prewarmer')
+            vm_modal_thread.start()
+            print("[ProxMenux] VM-modal prewarmer started (one-shot warm-up; caches refreshed by event invalidation only)")
     except Exception as e:
         print(f"[ProxMenux] VM-modal prewarmer failed to start: {e}")
 
@@ -23385,8 +23446,9 @@ if __name__ == '__main__':
     # identical (backup, restart, /usr/bin/update + custom command
     # chain) between manual and scheduled invocations.
     try:
-        scheduler_thread = threading.Thread(target=_scheduler_loop, daemon=True)
-        scheduler_thread.start()
+        if pve_host:
+            scheduler_thread = threading.Thread(target=_scheduler_loop, daemon=True)
+            scheduler_thread.start()
     except Exception as e:
         print(f"[ProxMenux] LXC update scheduler failed to start: {e}")
 
diff --git a/AppImage/scripts/flask_vm_backup_routes.py b/AppImage/scripts/flask_vm_backup_routes.py
index be83d8f9..78e77919 100644
--- a/AppImage/scripts/flask_vm_backup_routes.py
+++ b/AppImage/scripts/flask_vm_backup_routes.py
@@ -16,6 +16,9 @@ Endpoints, all under /api/vm-backup-jobs:
   DELETE /<id>             delete a job (its backups are kept)
   POST   /<id>/toggle      enable / disable
   POST   /<id>/run         run it now, as a Proxmox task on each node
+
+Storage retention is read/edited under /api/vm-backup-storages. Saving a
+policy only changes the native storage configuration; it never runs pruning.
 """
 
 import json
@@ -229,6 +232,58 @@ def options():
     })
 
 
+@vm_backup_bp.route("/api/vm-backup-storages", methods=["GET"])
+@require_auth
+def backup_storage_retention():
+    ok, storages = _pvesh_json(["get", "/storage"])
+    if not ok or not isinstance(storages, list):
+        return _err(storages if not ok else "Invalid storage inventory", 502)
+    return jsonify({"storages": [
+        {"id": storage["storage"], "type": storage.get("type", ""),
+         "prune_backups": _flat(storage.get("prune-backups") or ""),
+         "digest": storage.get("digest", "")}
+        for storage in storages
+        if isinstance(storage, dict) and storage.get("storage")
+        and "backup" in (storage.get("content") or "").split(",")
+    ]})
+
+
+@vm_backup_bp.route("/api/vm-backup-storages/<storage_id>", methods=["PUT"])
+@require_admin_scope
+def update_backup_storage_retention(storage_id):
+    if not STORAGE_RE.fullmatch(storage_id):
+        return _err("Invalid storage")
+    data = request.get_json(silent=True)
+    if not isinstance(data, dict):
+        return _err("A retention policy and current configuration digest are required")
+    digest, prune = data.get("digest"), data.get("prune_backups")
+    if not isinstance(digest, str) or not re.fullmatch(r"[a-fA-F0-9]{40}", digest):
+        return _err("Refresh the storage list before editing its retention")
+    # An empty policy removes the storage setting, so the Proxmox default applies.
+    if not isinstance(prune, str) or (prune and not PRUNE_RE.fullmatch(prune)):
+        return _err("Invalid retention policy")
+    pairs = [part.split("=", 1) for part in prune.split(",")] if prune else []
+    keys = [key for key, _ in pairs]
+    if (len(keys) != len(set(keys)) or
+            ("keep-all" in keys and (len(keys) != 1 or pairs[0][1] != "1")) or
+            any(int(value) < 1 for _, value in pairs)):
+        return _err("Choose keep-all=1 or one or more positive retention counts")
+    # Check that this is still a backup storage, then let Proxmox check the
+    # digest under its storage lock. Other storage settings are never passed.
+    ok, storage = _pvesh_json(["get", f"/storage/{storage_id}"])
+    if not ok:
+        return _err(storage, 502)
+    if not isinstance(storage, dict) or "backup" not in (storage.get("content") or "").split(","):
+        return _err("This storage does not accept backups", 409)
+    if storage.get("digest") != digest:
+        return _err("Storage configuration changed; refresh before saving", 409)
+    change = ["--prune-backups", prune] if prune else ["--delete", "prune-backups"]
+    ok, out = _pvesh(["set", f"/storage/{storage_id}", "--digest", digest, *change])
+    if not ok:
+        return _err(out, 409)
+    return jsonify({"success": True})
+
+
 @vm_backup_bp.route("/api/vm-backup-jobs", methods=["POST"])
 @require_admin_scope
 def create_job():
diff --git a/AppImage/scripts/guest_backup_archives.py b/AppImage/scripts/guest_backup_archives.py
new file mode 100644
index 00000000..7458c631
--- /dev/null
+++ b/AppImage/scripts/guest_backup_archives.py
@@ -0,0 +1,172 @@
+# ==========================================================
+# ProxMenux Monitor - Guest backup archives
+# Author      : Jonatan
+# GitHub      : github.com/jcastro
+# Maintainer  : MacRimi
+# Copyright   : (c) 2026 MacRimi & contributors
+# License     : (GPL-3.0) (https://github.com/MacRimi/ProxMenux/blob/main/LICENSE)
+# Version     : 1.0
+# Last Updated: 16/10/2026
+# ==========================================================
+# Description:
+# Deletes explicitly selected VM/CT backups through the native Proxmox
+# storage API after a fresh inventory/protection check. Tracks native
+# deletion tasks so an accepted operation is not mistaken for completion.
+# No filesystem paths or cached inventory authorize deletion.
+# ==========================================================
+
+import json
+import re
+import socket
+import subprocess
+import threading
+import time
+from concurrent.futures import ThreadPoolExecutor
+
+
+MAX_SELECTION = 20
+REMOVED_RE = re.compile(r"Removed volume '[^'\n]+'")
+STORAGE_RE = re.compile(r"[A-Za-z0-9][A-Za-z0-9._-]{0,63}")
+NODE_RE = re.compile(r"[A-Za-z0-9][A-Za-z0-9-]{0,62}")
+_tasks = {}
+_lock = threading.Lock()
+
+
+class BackupArchiveError(Exception):
+    def __init__(self, message, code=400):
+        super().__init__(message)
+        self.code = code
+
+
+def _pvesh(args, timeout=20):
+    try:
+        result = subprocess.run(["pvesh", *args, "--output-format", "json"],
+                                capture_output=True, text=True, timeout=timeout)
+    except (OSError, subprocess.TimeoutExpired) as error:
+        raise BackupArchiveError("Proxmox command unavailable or timed out; outcome unconfirmed", 502) from error
+    if result.returncode:
+        raise BackupArchiveError((result.stderr or "Proxmox command failed").strip()[:1000], 502)
+    output = result.stdout.strip()
+    try:
+        # pvesh can print no bytes for the API's successful null result.
+        return json.loads(output or "null")
+    except (ValueError, TypeError) as error:
+        # With --delay, a deletion that ends in time prints the line of its
+        # task log instead of JSON. Only that exact line is accepted.
+        if args[0] == "delete" and REMOVED_RE.fullmatch(output):
+            return output
+        raise BackupArchiveError("Invalid Proxmox response; outcome unconfirmed", 502) from error
+
+
+def _node():
+    # Same local storage/node scope as the guest's existing backup list.
+    node = socket.gethostname().split(".")[0]
+    if not NODE_RE.fullmatch(node):
+        raise BackupArchiveError("Invalid local node name", 502)
+    return node
+
+
+def _selection(vmid, data):
+    if not 100 <= vmid <= 999999999:
+        raise BackupArchiveError("Invalid VM/CT ID")
+    if not isinstance(data, dict) or data.get("confirm") is not True:
+        raise BackupArchiveError("Explicit confirmation is required")
+    selected = data.get("backups")
+    if not isinstance(selected, list) or not 1 <= len(selected) <= MAX_SELECTION:
+        raise BackupArchiveError(f"Select between 1 and {MAX_SELECTION} backups")
+    seen = set()
+    for item in selected:
+        if not isinstance(item, dict):
+            raise BackupArchiveError("Invalid backup selection")
+        storage, volid = item.get("storage"), item.get("volid")
+        if not isinstance(storage, str) or not STORAGE_RE.fullmatch(storage):
+            raise BackupArchiveError("Invalid backup storage")
+        if (not isinstance(volid, str) or not volid.startswith(storage + ":")
+                or len(volid) > 512 or not re.fullmatch(r"[A-Za-z0-9_:./+@-]+", volid)
+                or any(part in ("", ".", "..") for part in volid.split(":", 1)[1].split("/"))):
+            raise BackupArchiveError("Invalid backup volume ID")
+        if volid in seen:
+            raise BackupArchiveError("Duplicate backup selection")
+        seen.add(volid)
+    return [{"storage": item["storage"], "volid": item["volid"]} for item in selected]
+
+
+def _protected(value):
+    # Fail closed for an unexpected protection value, including the text 'true'.
+    return value not in (None, False, 0, "0", "")
+
+
+def _remember_task(task, vmid, node, volid):
+    # These are server-returned task IDs, never arbitrary client paths.
+    if (not isinstance(task, str) or not task.startswith(f"UPID:{node}:")
+            or ":imgdel:" not in task or "/" in task or len(task) > 1024):
+        raise BackupArchiveError("Unexpected deletion task; outcome unconfirmed", 502)
+    with _lock:
+        now = time.monotonic()
+        expired = [key for key, entry in _tasks.items() if now - entry["created"] > 3600]
+        for key in expired:
+            del _tasks[key]
+        # Bound even failed/unpolled jobs; expiry does not cancel a PVE task.
+        if len(_tasks) >= 512:
+            del _tasks[min(_tasks, key=lambda key: _tasks[key]["created"])]
+        _tasks[task] = {"vmid": vmid, "node": node, "volid": volid, "created": now}
+
+
+def delete_guest_backups(vmid, data):
+    selected = _selection(vmid, data)
+    node = _node()
+    inventory = {}
+    # Preflight the entire batch before deleting anything. An unavailable
+    # storage or a protected/stale/cross-guest selection fails the whole batch.
+    for storage in sorted({item["storage"] for item in selected}):
+        entries = _pvesh(["get", f"/nodes/{node}/storage/{storage}/content",
+                          "--content", "backup", "--vmid", str(vmid)])
+        if not isinstance(entries, list):
+            raise BackupArchiveError("Invalid backup inventory", 502)
+        for entry in entries:
+            if (isinstance(entry, dict) and entry.get("content") == "backup"
+                    and isinstance(entry.get("volid"), str)):
+                inventory[(storage, entry.get("volid"))] = entry
+    for item in selected:
+        entry = inventory.get((item["storage"], item["volid"]))
+        if entry is None or str(entry.get("vmid")) != str(vmid):
+            raise BackupArchiveError("Backup no longer exists or does not belong to this VM/CT", 409)
+        if _protected(entry.get("protected")):
+            raise BackupArchiveError("Protected backups cannot be deleted", 409)
+
+    def remove(item):
+        try:
+            # Proxmox also enforces protection at deletion time. It removes
+            # associated notes/log files and returns null only after success.
+            task = _pvesh(["delete", f'/nodes/{node}/storage/{item["storage"]}/content/{item["volid"]}',
+                            "--delay", "1"])
+            if isinstance(task, str) and task.startswith("UPID:"):
+                _remember_task(task, vmid, node, item["volid"])
+                return {**item, "status": "pending", "task": task}
+            if task is None or task == f"Removed volume '{item['volid']}'":
+                return {**item, "status": "deleted"}
+            return {**item, "status": "unconfirmed", "error": "Invalid Proxmox response; outcome unconfirmed"}
+        except BackupArchiveError as error:
+            return {**item, "status": "unconfirmed", "error": str(error)}
+
+    with ThreadPoolExecutor(max_workers=min(4, len(selected)), thread_name_prefix="backup-delete") as pool:
+        results = list(pool.map(remove, selected))
+    return {"results": results}
+
+
+def guest_backup_deletion_status(vmid, task):
+    with _lock:
+        entry = _tasks.get(task) if isinstance(task, str) else None
+        if not entry or entry["vmid"] != vmid or time.monotonic() - entry["created"] > 3600:
+            raise BackupArchiveError("Deletion task unknown or expired; refresh the backup list", 409)
+        entry = entry.copy()
+    status = _pvesh(["get", f'/nodes/{entry["node"]}/tasks/{task}/status'])
+    if not isinstance(status, dict) or status.get("status") not in ("running", "stopped"):
+        raise BackupArchiveError("Invalid deletion task status", 502)
+    result = {"volid": entry["volid"], "status": "pending"}
+    if status["status"] == "stopped":
+        if status.get("exitstatus") == "OK":
+            result["status"] = "deleted"
+        else:
+            result.update(status="unconfirmed", error=status.get("exitstatus") or "Deletion outcome unconfirmed")
+    return result
diff --git a/AppImage/scripts/health_monitor.py b/AppImage/scripts/health_monitor.py
index 23b6d7f1..39473809 100644
--- a/AppImage/scripts/health_monitor.py
+++ b/AppImage/scripts/health_monitor.py
@@ -51,6 +51,7 @@ DEBUG_PERF = False
 # ─── Startup Grace Period ────────────────────────────────────────────────────
 # Import centralized startup grace management for consistent behavior
 import startup_grace
+from pbs_manager import get_platform, PBS_SERVICES
 
 def _is_startup_health_grace() -> bool:
     """Check if we're within the startup health grace period (5 min).
@@ -153,36 +154,10 @@ def _hdd_in_standby(disk_name: str) -> bool:
     return parked
 
 
-def _lvm_device_args() -> list:
-    """`--devices` list scoping pvs/lvs/vgs off parked disks so they
-    aren't spun up by the LVM scan (issue #232). Empty when nothing is
-    parked, so the plain command runs unchanged. Each partition is
-    listed too — a whole-disk path alone doesn't cover a PV on a
-    partition."""
-    try:
-        r = subprocess.run(
-            ['lsblk', '-rno', 'NAME,TYPE,PKNAME'],
-            capture_output=True, text=True, timeout=5)
-        if r.returncode != 0:
-            return []
-        nodes = []
-        for line in r.stdout.strip().split('\n'):
-            parts = line.split()
-            if len(parts) < 2 or parts[1] not in ('disk', 'part'):
-                continue
-            name = parts[0]
-            base = name if parts[1] == 'disk' else (parts[2] if len(parts) > 2 else name)
-            nodes.append((name, base))
-        standby_bases = {
-            name for name, base in nodes
-            if name == base and _hdd_in_standby(name)
-        }
-        if not standby_bases:
-            return []
-        devices = [f'/dev/{name}' for name, base in nodes if base not in standby_bases]
-        return ['--devices', ','.join(devices)] if devices else []
-    except Exception:
-        return []
+def _lvm_device_args():
+    """None means no automatic scan; [] permits LVM's normal scan."""
+    from lvm_device_scope import lvm_device_args
+    return lvm_device_args(_hdd_in_standby)
 
 
 def _is_disk_removable(disk_name: str) -> bool:
@@ -466,6 +441,7 @@ class HealthMonitor:
 
     def __init__(self):
         """Initialize health monitor with state tracking"""
+        self.platform_type = get_platform().get("product")
         self.state_history = defaultdict(list)
         self.last_check_times = {}
         self.cached_results = {}
@@ -919,9 +895,9 @@ class HealthMonitor:
         _perf_log("services", (time.time() - _t) * 1000)
         details['services'] = services_status
         if services_status['status'] == 'CRITICAL':
-            critical_issues.append(f"PVE Services: {services_status.get('reason', 'Service failure')}")
+            critical_issues.append(f"Proxmox Services: {services_status.get('reason', 'Service failure')}")
         elif services_status['status'] == 'WARNING':
-            warning_issues.append(f"PVE Services: {services_status.get('reason', 'Service issue')}")
+            warning_issues.append(f"Proxmox Services: {services_status.get('reason', 'Service issue')}")
         
         # Priority 1.5: Proxmox Storage Check (External Module)
         _t = time.time()
@@ -1661,7 +1637,7 @@ class HealthMonitor:
 
             mem_critical_samples = [
                 entry for entry in self.state_history[state_key]
-                if entry['mem_percent'] >= 90 and
+                if entry['mem_percent'] >= self.MEMORY_CRITICAL and
                 current_time - entry['time'] <= self.MEMORY_DURATION
             ]
 
@@ -1695,7 +1671,7 @@ class HealthMonitor:
                 oldest = min(s['time'] for s in mem_critical_samples)
                 actual_duration = int(current_time - oldest)
                 status = 'CRITICAL'
-                reason = f'RAM >90% sustained for {actual_duration}s'
+                reason = f'RAM >{self.MEMORY_CRITICAL}% sustained for {actual_duration}s'
             elif swap_critical >= 2:
                 status = 'CRITICAL'
                 reason = (f'Memory pressure: swap {swap_percent:.0f}% used '
@@ -1715,7 +1691,7 @@ class HealthMonitor:
             swap_total_gb = round(swap.total / (1024**3), 2)
 
             # Determine per-sub-check status
-            ram_status = 'CRITICAL' if mem_percent >= 90 and mem_critical_count >= MEM_CRITICAL_MIN_SAMPLES else ('WARNING' if mem_percent >= self.MEMORY_WARNING and mem_warning_count >= MEM_WARNING_MIN_SAMPLES else 'OK')
+            ram_status = 'CRITICAL' if mem_percent >= self.MEMORY_CRITICAL and mem_critical_count >= MEM_CRITICAL_MIN_SAMPLES else ('WARNING' if mem_percent >= self.MEMORY_WARNING and mem_warning_count >= MEM_WARNING_MIN_SAMPLES else 'OK')
             swap_status = 'CRITICAL' if swap_critical >= 2 else 'OK'
             
             result = {
@@ -2303,12 +2279,17 @@ class HealthMonitor:
 
             # `--devices` keeps lvs from scanning parked HDDs (issue #232).
             dev_args = _lvm_device_args()
+            if dev_args is None:
+                return {'status': 'INFO', 'skipped': True,
+                        'reason': 'Automatic LVM scan skipped by disk read policy or unavailable inventory'}
             result = subprocess.run(
                 ['lvs', *dev_args, '--noheadings', '--options', 'lv_name,vg_name,lv_attr'],
                 capture_output=True,
                 text=True,
                 timeout=3
             )
+            from lvm_device_scope import settle_scan_reads
+            settle_scan_reads()
             
             if result.returncode != 0:
                 return {'status': 'WARNING', 'reason': 'lvs command failed'}
@@ -2333,6 +2314,7 @@ class HealthMonitor:
                     text=True,
                     timeout=3
                 )
+                settle_scan_reads()
                 if vg_result.returncode == 0 and vg_result.stdout.strip():
                     return {'status': 'WARNING', 'reason': 'No active LVM volumes detected'}
                 else:
@@ -2347,6 +2329,8 @@ class HealthMonitor:
     # The new _check_proxmox_storage function handles this logic better.
     def _check_proxmox_storages(self) -> Dict[str, Any]:
         """Check Proxmox-specific storages (only report problems)"""
+        if getattr(self, "platform_type", "pve") == "pbs":
+            return {'status': 'OK', 'reason': 'Not applicable on PBS', 'checks': {}, 'not_applicable': True}
         storages = {}
         
         try:
@@ -3515,6 +3499,8 @@ class HealthMonitor:
         Optimized VM/CT check - detects qmp failures and startup errors from logs.
         Improved detection of container and VM errors from journalctl.
         """
+        if getattr(self, "platform_type", "pve") == "pbs":
+            return {'status': 'OK', 'reason': 'Not applicable on PBS', 'checks': {}, 'not_applicable': True}
         try:
             # First: auto-resolve any persisted VM/CT errors where the guest
             # is now running.  This clears stale "Failed to start" / QMP
@@ -3678,6 +3664,8 @@ class HealthMonitor:
         Check VMs/CTs with persistent error tracking.
         Errors persist until VM starts or 48h elapsed.
         """
+        if getattr(self, "platform_type", "pve") == "pbs":
+            return {'status': 'OK', 'reason': 'Not applicable on PBS', 'checks': {}, 'not_applicable': True}
         try:
             issues = []
             vm_details = {}
@@ -3919,8 +3907,18 @@ class HealthMonitor:
         """
         try:
             # Build service list: base PVE services + corosync if clustered
-            services_to_check = list(self.PVE_SERVICES)
-            is_cluster = os.path.exists('/etc/corosync/corosync.conf')
+            pbs_host = getattr(self, "platform_type", "pve") == "pbs"
+            service_prefix = "pbs" if pbs_host else "pve"
+            product_name = "PBS" if pbs_host else "PVE"
+            services_to_check = list(PBS_SERVICES) if pbs_host else list(self.PVE_SERVICES)
+            if pbs_host:
+                # Old Monitor versions incorrectly treated absent PVE services
+                # as PBS failures; remove only those known inapplicable errors.
+                for service in self.PVE_SERVICES:
+                    old_key = f'pve_service_{service}'
+                    if health_persistence.is_error_active(old_key):
+                        health_persistence.clear_error(old_key)
+            is_cluster = not pbs_host and os.path.exists('/etc/corosync/corosync.conf')
             if is_cluster and 'corosync' not in services_to_check:
                 services_to_check.append('corosync')
             
@@ -3952,14 +3950,14 @@ class HealthMonitor:
             # cleanup loop). Audit Tier 5 — Health stack.
             for svc in services_to_check:
                 if svc not in failed_services:
-                    error_key = f'pve_service_{svc}'
+                    error_key = f'{service_prefix}_service_{svc}'
                     if health_persistence.is_error_active(error_key):
                         health_persistence.clear_error(error_key)
             
             # Build checks dict with status per service
             checks = {}
             for svc in services_to_check:
-                error_key = f'pve_service_{svc}'
+                error_key = f'{service_prefix}_service_{svc}'
                 if svc in failed_services:
                     state = service_details.get(svc, 'inactive')
                     checks[svc] = {
@@ -3987,12 +3985,12 @@ class HealthMonitor:
                 # Record each failed service in persistence, respecting dismiss
                 active_failed = []
                 for svc in failed_services:
-                    error_key = f'pve_service_{svc}'
+                    error_key = f'{service_prefix}_service_{svc}'
                     rec_result = health_persistence.record_error(
                         error_key=error_key,
                         category='pve_services',
                         severity='CRITICAL',
-                        reason=f'PVE service {svc} is {service_details.get(svc, "inactive")}',
+                        reason=f'{product_name} service {svc} is {service_details.get(svc, "inactive")}',
                         details={'service': svc, 'state': service_details.get(svc, 'inactive')}
                     )
                     if rec_result and rec_result.get('type') == 'skipped_acknowledged':
@@ -5816,6 +5814,8 @@ class HealthMonitor:
         - No persistent errors are recorded
         This prevents false positives when NFS/PBS/remote storage is still mounting.
         """
+        if getattr(self, "platform_type", "pve") == "pbs":
+            return None
         if not PROXMOX_STORAGE_AVAILABLE:
             return None
         
@@ -6076,6 +6076,8 @@ class HealthMonitor:
             if status == 'stale':
                 checks[check_label] = {
                     'status': 'CRITICAL',
+                    'error_key': error_key,
+                    'dismissable': True,
                     'detail': f'{fstype} mount stale: {error or "unreachable"}',
                     'fstype': fstype,
                     'source': m.get('source', ''),
@@ -6105,6 +6107,8 @@ class HealthMonitor:
             elif status == 'readonly':
                 checks[check_label] = {
                     'status': 'WARNING',
+                    'error_key': error_key,
+                    'dismissable': True,
                     'detail': f'{fstype} mount unexpectedly read-only',
                     'fstype': fstype,
                     'source': m.get('source', ''),
@@ -6205,6 +6209,8 @@ class HealthMonitor:
         Notification cooldown is the standard 1h via the storage
         category, so a CT teetering at 96% won't spam the channel.
         """
+        if getattr(self, "platform_type", "pve") == "pbs":
+            return None
         # Cheap pre-check: bail out when there are no running LXCs. On
         # nodes without CTs, the previous version still paid ~860ms per
         # cycle for a `pvesh /cluster/resources` call that produced no
@@ -6365,6 +6371,8 @@ class HealthMonitor:
         path, so a slow / dead guest agent can't stretch the health
         cycle.
         """
+        if getattr(self, "platform_type", "pve") == "pbs":
+            return None
         try:
             import flask_server  # deferred — avoids circular import
             resources = flask_server.get_cached_pvesh_cluster_resources_vm() or []
@@ -6524,6 +6532,8 @@ class HealthMonitor:
         check (already covered) because those are usually large data
         mounts whose fill rate is driven by user content, not log spam.
         """
+        if getattr(self, "platform_type", "pve") == "pbs":
+            return None
         if not MOUNT_MONITOR_AVAILABLE:
             return None
         try:
@@ -6627,6 +6637,8 @@ class HealthMonitor:
         check via _check_filesystem. Re-alerting on the same condition
         through two channels just clutters the inbox.
         """
+        if getattr(self, "platform_type", "pve") == "pbs":
+            return None
         if not PROXMOX_STORAGE_AVAILABLE:
             return None
         try:
diff --git a/AppImage/scripts/jwt_middleware.py b/AppImage/scripts/jwt_middleware.py
index f78c063c..fb9b071f 100644
--- a/AppImage/scripts/jwt_middleware.py
+++ b/AppImage/scripts/jwt_middleware.py
@@ -8,6 +8,8 @@ from flask import request, jsonify, g
 from functools import wraps
 from auth_manager import load_auth_config, verify_token, verify_token_full
 
+_READ_METHODS = ('GET', 'HEAD', 'OPTIONS')
+
 
 def require_auth(f):
     """
@@ -64,12 +66,18 @@ def require_auth(f):
         token = parts[1]
         
         # Verify token
-        username = verify_token(token)
+        username, scope = verify_token_full(token)
         if not username:
             return jsonify({
                 "error": "Invalid or expired token",
                 "message": "Please log in again"
             }), 401
+
+        # read_only tokens may only read; any method that can change
+        # state needs full_admin.
+        if request.method not in _READ_METHODS and scope != 'full_admin':
+            return jsonify({"error": "Insufficient scope",
+                            "message": f"This action requires a full_admin token (your token: {scope})"}), 403
         
         # Token is valid, allow access
         return f(*args, **kwargs)
diff --git a/AppImage/scripts/lvm_device_scope.py b/AppImage/scripts/lvm_device_scope.py
new file mode 100644
index 00000000..43cf1896
--- /dev/null
+++ b/AppImage/scripts/lvm_device_scope.py
@@ -0,0 +1,116 @@
+# ==========================================================
+# ProxMenux Monitor - LVM disk read scope
+# Author      : Jonatan
+# GitHub      : github.com/jcastro
+# Maintainer  : MacRimi
+# Copyright   : (c) 2026 MacRimi & contributors
+# License     : (GPL-3.0) (https://github.com/MacRimi/ProxMenux/blob/main/LICENSE)
+# Version     : 1.0
+# Last Updated: 16/10/2026
+# ==========================================================
+# Description:
+# Applies the automatic disk-read policy to LVM metadata scans in both
+# Monitor readers. Excluded and idle disks receive no power-mode probe;
+# every device built on them is excluded too, and the scan's own reads
+# are not taken as activity. No eligible devices means no scan.
+# ==========================================================
+
+import json
+import re
+import subprocess
+import threading
+
+_NAME = re.compile(r"[A-Za-z0-9._+-]+")
+_scan_lock = threading.Lock()
+_scanned_disks = set()
+
+
+def _topology():
+    """Every block device by kernel name: its type, its parents and whether
+    it is an LVM physical volume. lsblk reads this from udev, not the disks.
+    A RAID or multipath device appears once per member."""
+    result = subprocess.run(["lsblk", "-J", "-l", "-o", "KNAME,TYPE,PKNAME,FSTYPE"],
+                            capture_output=True, text=True, timeout=5)
+    if result.returncode:
+        return None
+    types, parents, volumes = {}, {}, set()
+    for device in json.loads(result.stdout).get("blockdevices") or []:
+        name, parent = device.get("kname"), device.get("pkname")
+        if not isinstance(name, str) or not _NAME.fullmatch(name):
+            return None
+        types[name] = device.get("type")
+        parents.setdefault(name, set())
+        if parent is not None:
+            if not isinstance(parent, str) or not _NAME.fullmatch(parent):
+                return None
+            parents[name].add(parent)
+        if device.get("fstype") == "LVM2_member" and device.get("type") != "lvm":
+            volumes.add(name)
+    return types, parents, volumes
+
+
+def _disks_under(name, parents, seen=None):
+    """The disks a device is built on: itself, or its parents' disks."""
+    seen = seen if seen is not None else set()
+    if name in seen:
+        return set()
+    seen.add(name)
+    if not parents.get(name):
+        return {name}
+    found = set()
+    for parent in parents[name]:
+        found |= _disks_under(parent, parents, seen)
+    return found
+
+
+def lvm_device_args(standby_check):
+    """Return [] for an unrestricted scan, --devices args, or None to skip.
+
+    A failed inventory must never fall back to an unrestricted scan. None
+    is distinct from []: if every disk is excluded/idle/asleep, callers
+    must not start pvs/lvs/vgs at all.
+    """
+    try:
+        from disk_temperature_history import disk_read_policy, excluded_disk_names
+        topology = _topology()
+        if topology is None:
+            return None
+        types, parents, volumes = topology
+        disks = {name for name, kind in types.items() if kind == "disk"}
+        if not disks:
+            return None
+        excluded = excluded_disk_names()
+        blocked = set()
+        for disk in sorted(disks):
+            # Test policy first: even CHECK POWER MODE is forbidden for an
+            # excluded/idle disk. Some USB bridges do not honour -n standby.
+            if disk_read_policy(disk, excluded) != "read" or standby_check(disk):
+                blocked.add(disk)
+        allowed = sorted(f"/dev/{name}" for name in volumes if not (_disks_under(name, parents) & blocked))
+        with _scan_lock:
+            _scanned_disks.clear()
+            _scanned_disks.update(disks - blocked)
+        if not blocked:
+            return []
+        # An explicit list makes LVM open every device in it, so only the
+        # physical volumes are named: a RAID, multipath or encrypted volume
+        # built on a blocked disk would read that disk too and stays out.
+        if not allowed:
+            return None
+        return ["--devices", ",".join(allowed)]
+    except Exception:
+        # Unavailable exclusions, topology or policy are not permission to
+        # open devices that may have been deliberately excluded.
+        return None
+
+
+def settle_scan_reads():
+    """The LVM scan reads the disks it is allowed to. Those reads are its
+    own, so they must not make an unused disk look busy at the next check."""
+    try:
+        from disk_temperature_history import settle_own_reads
+        with _scan_lock:
+            disks = set(_scanned_disks)
+        settle_own_reads(disks)
+    except Exception:
+        pass
diff --git a/AppImage/scripts/lxc_apps.py b/AppImage/scripts/lxc_apps.py
index 494c9db5..4b6a5a2e 100644
--- a/AppImage/scripts/lxc_apps.py
+++ b/AppImage/scripts/lxc_apps.py
@@ -1179,6 +1179,13 @@ def validate_config(payload: dict) -> tuple[bool, Any]:
             return _err("logo_url must be an http(s) URL (max 512 chars)")
         conf["logo_url"] = logo
 
+    # Native discovery identity is separate from a curated helper/updater.
+    discovery_id = payload.get("discovery_id")
+    if discovery_id is not None:
+        if not isinstance(discovery_id, str) or not re.fullmatch(r"native-[0-9a-f]{24}", discovery_id):
+            return _err("invalid discovery_id")
+        conf["discovery_id"] = discovery_id
+
     # Optional helper_slug — set by the frontend when the user picks
     # an auto-detected app (primary or extra). Persisted so we can
     # filter the "also detected" chip list against apps already
diff --git a/AppImage/scripts/monitor_links.py b/AppImage/scripts/monitor_links.py
new file mode 100644
index 00000000..35ff58a2
--- /dev/null
+++ b/AppImage/scripts/monitor_links.py
@@ -0,0 +1,321 @@
+"""Other ProxMenux Monitors reachable from this one: cluster nodes, PBS servers
+and entries added by hand.
+
+Only links are kept here. No credential is stored or sent: the browser opens
+the other Monitor, which keeps its own sign-in.
+"""
+
+import ipaddress
+import json
+import os
+import re
+import secrets
+import socket
+import ssl
+import subprocess
+import threading
+import time
+import urllib.parse
+import urllib.request
+from concurrent.futures import ThreadPoolExecutor
+from pathlib import Path
+
+import pbs_manager
+
+LINKS_FILE = Path(os.environ.get("PROXMENUX_MONITOR_LINKS", "/usr/local/share/proxmenux/monitor_links.json"))
+SSL_CONFIG_FILE = Path(os.environ.get("PROXMENUX_SSL_CONFIG", "/etc/proxmenux/ssl_config.json"))
+STORAGE_CFG = Path("/etc/pve/storage.cfg")
+MONITOR_PORT = 8008
+PBS_UI_PORT = 8007
+PROBE_TIMEOUT = 3
+PROBE_TTL = 300
+MAX_MANUAL = 64
+PRODUCTS = ("pve", "pbs")
+
+_lock = threading.Lock()
+_probe_cache = {}
+_snapshot = {"at": 0.0, "data": None}
+_refresh_lock = threading.Lock()
+
+
+class LinkError(ValueError):
+    pass
+
+
+def _load():
+    try:
+        data = json.loads(LINKS_FILE.read_text())
+    except (OSError, ValueError):
+        return {"manual": [], "overrides": {}}
+    manual = data.get("manual") if isinstance(data.get("manual"), list) else []
+    overrides = data.get("overrides") if isinstance(data.get("overrides"), dict) else {}
+    return {"manual": [row for row in manual if isinstance(row, dict)], "overrides": overrides}
+
+
+def _save(data):
+    LINKS_FILE.parent.mkdir(parents=True, exist_ok=True)
+    temporary = LINKS_FILE.with_suffix(".tmp")
+    temporary.write_text(json.dumps(data, indent=2))
+    os.chmod(temporary, 0o600)
+    os.replace(temporary, LINKS_FILE)
+
+
+def normalize_url(value):
+    """Return the origin of an http(s) address, or raise LinkError."""
+    if not isinstance(value, str) or not value.strip():
+        raise LinkError("Enter the address of the Monitor.")
+    text = value.strip()
+    if "://" not in text:
+        text = "https://" + text
+    parsed = urllib.parse.urlsplit(text)
+    if parsed.scheme not in ("http", "https") or not parsed.hostname:
+        raise LinkError("The address must start with http:// or https:// and name a host.")
+    if parsed.username or parsed.password:
+        raise LinkError("The address must not contain a user or password.")
+    try:
+        port = parsed.port
+    except ValueError as exc:
+        raise LinkError("The port of the address is not valid.") from exc
+    host = parsed.hostname
+    if ":" in host:
+        host = f"[{host}]"
+    return f"{parsed.scheme}://{host}" + (f":{port}" if port else "")
+
+
+def _local_scheme():
+    try:
+        return "https" if json.loads(SSL_CONFIG_FILE.read_text()).get("enabled") else "http"
+    except (OSError, ValueError, AttributeError):
+        return "http"
+
+
+def _host_url(host, port, scheme=None):
+    if ":" in host and not host.startswith("["):
+        host = f"[{host}]"
+    return f"{scheme or _local_scheme()}://{host}:{port}"
+
+
+def _is_private(host):
+    """Only addresses in private ranges are probed without being asked to."""
+    try:
+        addresses = {info[4][0] for info in socket.getaddrinfo(host, None)}
+    except OSError:
+        return False
+    try:
+        return bool(addresses) and all(ipaddress.ip_address(a.split("%")[0]).is_private for a in addresses)
+    except ValueError:
+        return False
+
+
+def _cluster_nodes():
+    try:
+        result = subprocess.run(["pvesh", "get", "/cluster/status", "--output-format", "json"],
+                                capture_output=True, text=True, timeout=8)
+        rows = json.loads(result.stdout) if result.returncode == 0 else []
+    except (OSError, subprocess.SubprocessError, ValueError):
+        return []
+    nodes = []
+    for row in rows if isinstance(rows, list) else []:
+        if isinstance(row, dict) and row.get("type") == "node" and not row.get("local") and row.get("name") and row.get("ip"):
+            nodes.append({"key": f"cluster:{row['name']}", "name": str(row["name"]), "product": "pve",
+                          "group": "cluster", "host": str(row["ip"])})
+    return nodes
+
+
+def _storage_pbs():
+    try:
+        text = STORAGE_CFG.read_text()
+    except OSError:
+        return []
+    servers, current = [], None
+    for line in text.splitlines():
+        header = re.match(r"^(\w+):\s*(\S+)", line)
+        if header:
+            current = {"name": header.group(2), "port": PBS_UI_PORT} if header.group(1) == "pbs" else None
+            if current is not None:
+                servers.append(current)
+            continue
+        option = re.match(r"^\s+(server|port)\s+(\S+)", line)
+        if current is not None and option:
+            current[option.group(1)] = option.group(2)
+    return [row for row in servers if row.get("server")]
+
+
+def _pbs_servers():
+    found = {}
+    for row in _storage_pbs():
+        host = row["server"]
+        port = row.get("port") if str(row.get("port", "")).isdigit() else PBS_UI_PORT
+        found.setdefault(host, {"name": row["name"], "native_url": _host_url(host, port, "https")})
+    try:
+        for row in pbs_manager.public_servers():
+            host = urllib.parse.urlsplit(row.get("url", "")).hostname
+            if host:
+                found.setdefault(host, {"name": row.get("name") or host, "native_url": normalize_url(row["url"])})
+    except Exception:
+        pass
+    return [{"key": f"pbs:{host}", "name": info["name"], "product": "pbs", "group": "pbs",
+             "host": host, "native_url": info["native_url"]} for host, info in found.items()]
+
+
+def _probe(url):
+    """True when a ProxMenux Monitor answers at url; nothing is sent but the request."""
+    now = time.monotonic()
+    with _lock:
+        cached = _probe_cache.get(url)
+        if cached and cached[0] > now:
+            return cached[1]
+    context = ssl.create_default_context()
+    context.check_hostname = False
+    context.verify_mode = ssl.CERT_NONE  # liveness only: no credential or token is ever sent
+    online = False
+    try:
+        request = urllib.request.Request(url + "/api/auth/status", headers={"Accept": "application/json"})
+        with urllib.request.urlopen(request, timeout=PROBE_TIMEOUT, context=context) as response:
+            online = response.status == 200 and "auth_enabled" in json.loads(response.read(4096))
+    except Exception:
+        online = False
+    with _lock:
+        if len(_probe_cache) > 256:
+            _probe_cache.clear()
+        _probe_cache[url] = (now + PROBE_TTL, online)
+    return online
+
+
+def _resolve(entry, override):
+    """Pick the Monitor address and its state for one discovered or manual entry."""
+    if override.get("url"):
+        return override["url"], "online" if _probe(override["url"]) else "offline"
+    if entry.get("url"):
+        return entry["url"], "online" if _probe(entry["url"]) else "offline"
+    host = entry["host"]
+    if not _is_private(host):
+        return None, "unknown"
+    for scheme in (_local_scheme(), "https" if _local_scheme() == "http" else "http"):
+        url = _host_url(host, MONITOR_PORT, scheme)
+        if _probe(url):
+            return url, "online"
+    return _host_url(host, MONITOR_PORT), "offline"
+
+
+def list_links(include_hidden=False):
+    platform = pbs_manager.get_platform()
+    data = _load()
+    entries = []
+    if platform.get("product") != "pbs":
+        entries += _cluster_nodes() + _pbs_servers()
+    for row in data["manual"]:
+        entries.append({"key": f"manual:{row.get('id')}", "name": row.get("name") or row.get("url"),
+                        "product": row.get("product") if row.get("product") in PRODUCTS else "pve",
+                        "group": "pbs" if row.get("product") == "pbs" else "standalone",
+                        "url": row.get("url"), "manual": True})
+    visible = [e for e in entries if include_hidden or not data["overrides"].get(e["key"], {}).get("hidden")]
+    with ThreadPoolExecutor(max_workers=8) as executor:
+        resolved = list(executor.map(lambda e: _resolve(e, data["overrides"].get(e["key"], {})), visible))
+    links = []
+    for entry, (url, state) in zip(visible, resolved):
+        override = data["overrides"].get(entry["key"], {})
+        links.append({"key": entry["key"], "name": entry["name"], "product": entry["product"],
+                      "group": entry["group"], "url": url, "status": state,
+                      "native_url": entry.get("native_url"), "manual": bool(entry.get("manual")),
+                      "hidden": bool(override.get("hidden")), "custom_url": bool(override.get("url"))})
+    return {"self": {"name": platform.get("hostname") or socket.gethostname(), "product": platform.get("product")},
+            "links": links}
+
+
+def refresh():
+    """Recompute the list with fresh probes and keep it for the header."""
+    with _refresh_lock:
+        with _lock:
+            _probe_cache.clear()
+        data = list_links(include_hidden=True)
+        _snapshot.update(at=time.monotonic(), data=data)
+        return data
+
+
+def _refresh_quietly():
+    try:
+        refresh()
+    except Exception:
+        pass
+
+
+def cached_links(include_hidden=False):
+    """The last list at once; a stale one is renewed in the background."""
+    data = _snapshot["data"]
+    if data is None:
+        data = refresh()
+    elif time.monotonic() - _snapshot["at"] > PROBE_TTL and not _refresh_lock.locked():
+        threading.Thread(target=_refresh_quietly, daemon=True, name="monitor-links-refresh").start()
+    if include_hidden:
+        return data
+    return {**data, "links": [row for row in data["links"] if not row["hidden"]]}
+
+
+def start_prewarmer():
+    def loop():
+        time.sleep(10)
+        while True:
+            _refresh_quietly()
+            time.sleep(PROBE_TTL)
+    threading.Thread(target=loop, daemon=True, name="monitor-links-prewarmer").start()
+
+
+def add_link(payload):
+    if not isinstance(payload, dict):
+        raise LinkError("Invalid request.")
+    name = str(payload.get("name") or "").strip()[:64]
+    url = normalize_url(payload.get("url"))
+    product = payload.get("product") if payload.get("product") in PRODUCTS else "pve"
+    with _lock:
+        data = _load()
+        if len(data["manual"]) >= MAX_MANUAL:
+            raise LinkError(f"At most {MAX_MANUAL} nodes can be added.")
+        if any(row.get("url") == url for row in data["manual"]):
+            raise LinkError("This address is already in the list.")
+        identifier = secrets.token_hex(6)
+        data["manual"].append({"id": identifier, "name": name or urllib.parse.urlsplit(url).hostname,
+                               "url": url, "product": product})
+        _save(data)
+    return f"manual:{identifier}"
+
+
+def update_link(key, payload):
+    if not isinstance(payload, dict):
+        raise LinkError("Invalid request.")
+    with _lock:
+        data = _load()
+        if key.startswith("manual:"):
+            row = next((r for r in data["manual"] if f"manual:{r.get('id')}" == key), None)
+            if row is None:
+                raise LinkError("Node not found.")
+            if "name" in payload:
+                row["name"] = str(payload["name"] or "").strip()[:64] or row["name"]
+            if payload.get("url"):
+                row["url"] = normalize_url(payload["url"])
+            if payload.get("product") in PRODUCTS:
+                row["product"] = payload["product"]
+        elif re.fullmatch(r"(cluster|pbs):[\w.:\-\[\]]{1,253}", key):
+            override = data["overrides"].setdefault(key, {})
+            if "url" in payload:
+                if payload["url"]:
+                    override["url"] = normalize_url(payload["url"])
+                else:
+                    override.pop("url", None)
+            if "hidden" in payload:
+                override["hidden"] = bool(payload["hidden"])
+            if not override:
+                data["overrides"].pop(key, None)
+        else:
+            raise LinkError("Node not found.")
+        _save(data)
+
+
+def delete_link(key):
+    with _lock:
+        data = _load()
+        remaining = [r for r in data["manual"] if f"manual:{r.get('id')}" != key]
+        if len(remaining) == len(data["manual"]):
+            raise LinkError("Only nodes added by hand can be removed; detected ones can be hidden.")
+        data["manual"] = remaining
+        _save(data)
diff --git a/AppImage/scripts/native_app_discovery.py b/AppImage/scripts/native_app_discovery.py
new file mode 100644
index 00000000..3ba83ec5
--- /dev/null
+++ b/AppImage/scripts/native_app_discovery.py
@@ -0,0 +1,750 @@
+#!/usr/bin/env python3
+# ==========================================================
+# ProxMenux - A menu-driven script for Proxmox VE management
+# Author      : VAIO73
+# GitHub      : github.com/Vaso73
+# Maintainer  : MacRimi
+# Copyright   : (c) 2026 MacRimi & contributors
+# License     : (GPL-3.0) (https://github.com/MacRimi/ProxMenux/blob/main/LICENSE)
+# Version     : 1.0
+# Last Updated: 14/10/2026
+# ==========================================================
+# Description:
+# On-demand native LXC discovery from service and installation metadata.
+# Reads bounded data only; never executes discovered programs, starts guests,
+# registers applications or infers their update mechanism.
+# ==========================================================
+"""Separate from catalog detection: callers must explicitly request a scan."""
+
+import copy
+from contextlib import contextmanager
+import fcntl
+import hashlib
+import json
+import os
+from pathlib import Path
+import re
+import selectors
+import signal
+import stat
+import subprocess
+import threading
+import time
+
+TOTAL_SECONDS = 20
+PROBE_SECONDS = 3
+OUTPUT_BYTES = 64 * 1024
+MAX_RECORDS = 256
+MAX_CANDIDATES = 50
+CACHE_SECONDS = 300
+LOCAL_CONFIG = Path('/etc/pve/local/lxc')
+OCI_ROOT = Path('/usr/local/share/proxmenux/oci/instances')
+UPDATE_LOCK_ROOT = Path('/run/lock')
+_cache = {}
+_locks = {}
+_generations = {}
+_mutex = threading.Lock()
+_PATH = re.compile(r'/[A-Za-z0-9_.+/@-]{1,510}\Z')
+_NAME = re.compile(r'[A-Za-z0-9][A-Za-z0-9_.+@-]{0,63}\Z')
+_VERSION = re.compile(r'v?\d+(?:\.\d+){1,4}(?:[-+._][A-Za-z0-9.-]+)?\Z')
+_SYSTEM = {
+    'ssh', 'sshd', 'cron', 'crond', 'postfix', 'rsyslog', 'syslog', 'syslog-ng',
+    # Alpine/OpenRC system logging and service supervision are not apps.
+    'klogd', 'syslogd', 'openrc-user', 'runit', 'runsvdir', 'runsv', 'supervise-daemon',
+    'dbus', 'dbus-broker', 'systemd', 'udev', 'networking', 'network', 'networkmanager',
+    'dhcpcd', 'dhclient', 'chrony', 'chronyd', 'ntp', 'ntpd', 'openntpd', 'agetty',
+    'getty', 'login', 'polkit', 'polkitd', 'accounts-daemon', 'acpid', 'anacron',
+    'docker', 'containerd', 'containerd-shim', 'podman', 'qemu-guest-agent', 'rngd',
+    'auditd', 'logrotate', 'local', 'bootmisc', 'hostname', 'hwclock', 'modules', 'master',
+    'proxmox-boot-sync', 'pve-container', 'pve-firewall', 'pvefw-logger',
+    'pvedaemon', 'pvestatd', 'pveproxy', 'pvescheduler', 'spiceproxy', 'lxc',
+    'mount-ro', 'mdev', 'sysctl', 'sysfs', 'devfs', 'cgroups', 'rc', 'rcs', 'swap',
+    'sleep', 'true', 'false', 'echo', 'cat', 'head', 'tail', 'tee', 'logger',
+    'apt', 'apt-get', 'dpkg', 'dpkg-query', 'apk', 'unattended-upgrades',
+    'fstrim', 'fsck', 'fsckd', 'e2scrub', 'e2scrub-all', 'e2scrub-reap',
+    'irqbalance', 'smartd', 'smartmontools', 'rpcbind', 'nfs-common', 'nfs-server',
+    'rpc-statd', 'rpc-statd-notify', 'rpc-gssd', 'rpc-svcgssd', 'nftables', 'iptables',
+    'ip6tables', 'firewalld', 'ufw', 'resolvconf', 'wpa-supplicant', 'modemmanager',
+    'console-setup', 'keyboard-setup', 'plymouth', 'halt', 'reboot', 'shutdown',
+    'rc-local', 'ntpsec', 'networkd-dispatcher', 'busybox', 'atd', 'uuidd',
+    # Common packaged daemons are infrastructure, not a user-managed app.
+    'nginx', 'apache', 'apache2', 'httpd', 'lighttpd', 'haproxy', 'traefik',
+    'redis', 'redis-server', 'memcached', 'mysql', 'mysqld', 'mariadb', 'mariadbd',
+    'postgres', 'postgresql', 'mongod', 'mongodb', 'rabbitmq-server',
+    'elasticsearch', 'opensearch', 'fail2ban', 'named', 'bind9', 'dnsmasq',
+    'avahi-daemon', 'smbd', 'nmbd', 'samba', 'vsftpd', 'proftpd', 'cups', 'tor',
+}
+_RUNTIMES = re.compile(r'(?:python[0-9.]*|node(?:js)?|npm|pnpm|yarn|bun|sh|bash|dash|env|java|ruby|perl)\Z')
+_PACKAGE_ROOT_RUNTIMES = {'node', 'nodejs', 'npm', 'pnpm', 'yarn', 'bun'}
+_HELPER_ROLES = {
+    'backup', 'bootstrap', 'bridge', 'cleanup', 'housekeeping', 'maintenance',
+    'migrate', 'migration', 'restore', 'rotate', 'update', 'updater', 'upgrade',
+    'watch', 'watchdog', 'worker',
+}
+_HESTIA_NGINX = '/usr/local/hestia/nginx/sbin/hestia-nginx'
+_HESTIA_ROOT = '/usr/local/hestia'
+_HESTIA_PANEL_PORT = 8083
+
+
+class ProbeError(Exception):
+    """Safe error code only; guest output must never become an API error."""
+
+
+def bounded_run(argv, deadline):
+    """Cap combined stdout/stderr while reading, and kill/reap the process group."""
+    remaining = min(PROBE_SECONDS, deadline - time.monotonic())
+    if remaining <= 0:
+        raise ProbeError('deadline')
+    end = time.monotonic() + remaining
+    try:
+        proc = subprocess.Popen(argv, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
+                                start_new_session=True)
+    except OSError:
+        raise ProbeError('unavailable') from None
+    outputs = [bytearray(), bytearray()]
+    try:
+        with selectors.DefaultSelector() as poll:
+            for index, stream in enumerate((proc.stdout, proc.stderr)):
+                os.set_blocking(stream.fileno(), False)
+                poll.register(stream, selectors.EVENT_READ, index)
+            while poll.get_map():
+                wait = end - time.monotonic()
+                if wait <= 0:
+                    raise ProbeError('timeout')
+                for key, _ in poll.select(wait):
+                    block = os.read(key.fileobj.fileno(), 4096)
+                    if not block:
+                        poll.unregister(key.fileobj)
+                        continue
+                    if sum(map(len, outputs)) + len(block) > OUTPUT_BYTES:
+                        raise ProbeError('output_limit')
+                    outputs[key.data].extend(block)
+            try:
+                proc.wait(timeout=max(0.001, end - time.monotonic()))
+            except subprocess.TimeoutExpired:
+                raise ProbeError('timeout') from None
+        if proc.returncode:
+            raise ProbeError('read_failed')
+        return outputs[0].decode('utf-8', errors='strict')
+    except UnicodeError:
+        raise ProbeError('invalid_data') from None
+    finally:
+        # Also clean up descendants that outlive a successfully exited wrapper.
+        try:
+            os.killpg(proc.pid, signal.SIGKILL)
+        except ProcessLookupError:
+            pass
+        proc.wait()
+        proc.stdout.close()
+        proc.stderr.close()
+
+
+# These are fixed read-only scripts, not guest-supplied shell or init scripts.
+# awk emits only executable/script paths and WorkingDirectory, never arguments
+# or environment values. OpenRC files are parsed as data, never sourced.
+SERVICE_SCRIPT = r'''
+command -v awk >/dev/null && command -v head >/dev/null || exit 1
+n=0
+for dir in /etc/systemd/system /usr/lib/systemd/system /lib/systemd/system /etc/init.d; do
+  # With a merged /usr, /lib is /usr/lib: the same units must not count twice.
+  [ "$dir" = /lib/systemd/system ] && [ /lib/systemd/system -ef /usr/lib/systemd/system ] && continue
+  [ ! -d "$dir" ] || [ -r "$dir" ] || exit 1
+  for f in "$dir"/*; do
+    [ -f "$f" ] || continue
+    case "$dir:$f" in /etc/init.d:*) kind=openrc;; *:*.service) kind=systemd;; *) continue;; esac
+    n=$((n+1)); [ "$n" -le 256 ] || { printf 'LIMIT\n'; exit 0; }
+    [ -r "$f" ] || exit 1
+    content=$(timeout -s KILL 1 head -c 16385 "$f") || exit 1
+    [ "${#content}" -le 16384 ] || { printf 'LIMIT\n'; exit 0; }
+    printf '%s\n' "$content" | awk -v kind="$kind" -v file="$f" '
+      function clean(v) {gsub(/^[ \t]+|[ \t]+$/, "", v); gsub(/^["\047]|["\047]$/, "", v); return v}
+      /^ExecStart=/ {v=substr($0,11); sub(/^[-+!:@]+/, "", v); split(v,a,/[ \t]+/); exe=clean(a[1]); script=clean(a[2]); if(script !~ /^\//) script=""}
+      /^WorkingDirectory=/ {dir=clean(substr($0,18))}
+      /^command=/ {exe=clean(substr($0,9))}
+      /^directory=/ {dir=clean(substr($0,11))}
+      /^command_args=/ {v=clean(substr($0,14)); split(v,a,/[ \t]+/); script=clean(a[1]); if(script !~ /^\//) script=""}
+      END {printf "S\t%s\t%s\t%s\t%s\t%s\n", file, kind, exe, script, dir}'
+  done
+done
+printf 'END\n'
+'''
+PROCESS_SCRIPT = r'''
+command -v readlink >/dev/null && command -v head >/dev/null || exit 1
+n=0
+for dir in /proc/[0-9]*; do
+  [ -d "$dir" ] || continue
+  n=$((n+1)); [ "$n" -le "$1" ] || { printf 'LIMIT\n'; exit 0; }
+  # Never inspect Docker/OCI child workloads or read cmdline/environ.
+  [ -d "$dir" ] || continue
+  [ -r "$dir/cgroup" ] || exit 1
+  group=$(timeout -s KILL 1 head -c 8193 "$dir/cgroup") || exit 1
+  [ "${#group}" -le 8192 ] || { printf 'LIMIT\n'; exit 0; }
+  case "$group" in *docker*|*libpod*|*kubepods*|*containerd*) continue;; esac
+  # Kernel threads and vanished processes have no application executable.
+  [ -L "$dir/exe" ] || continue
+  exe=$(timeout -s KILL 1 readlink "$dir/exe") || continue
+  cwd=$(timeout -s KILL 1 readlink "$dir/cwd") || continue
+  printf 'P\t%s\t%s\t%s\n' "${dir##*/}" "$exe" "$cwd"
+done
+printf 'END\n'
+'''
+PORT_SCRIPT = r'''
+command -v awk >/dev/null || exit 1
+if command -v ss >/dev/null; then
+  (timeout -s KILL 1 ss -H -lntp || printf 'FAILED\n') | awk -v cap="$1" '
+    /^FAILED$/ {failed=1; exit}
+    NR > cap {limited=1; exit}
+    {port=$4; sub(/^.*:/,"",port); rest=$0
+     # More than one owner is ambiguous; never choose the first arbitrarily.
+     if (gsub(/pid=/,"pid=",rest)!=1) next
+     if (match(rest,/pid=[0-9]+/)) {pid=substr(rest,RSTART+4,RLENGTH-4); printf "L\t%s\t%s\n",pid,port}}
+    END {print failed ? "FAILED" : (limited ? "LIMIT" : "END")}'
+elif command -v netstat >/dev/null; then
+  (timeout -s KILL 1 netstat -lntp || printf 'FAILED\n') | awk -v cap="$1" '
+    /^FAILED$/ {failed=1; exit}
+    /^tcp/ {n++; if(n>cap) {limited=1; exit}; port=$4; sub(/^.*:/,"",port)
+      pid=$7; sub(/\/.*$/,"",pid); if(pid ~ /^[0-9]+$/) printf "L\t%s\t%s\n",pid,port}
+    END {print failed ? "FAILED" : (limited ? "LIMIT" : "END")}'
+else
+  # Without ss or netstat there is no listener evidence; a retry would not change it.
+  printf 'END\n'
+fi
+'''
+HESTIA_PANEL_SCRIPT = r'''
+# The generic process collector intentionally stops after a bounded number of
+# records and ignores shared listener ownership.  Hestia's master/worker pair
+# can therefore be outside that generic result.  This narrow fallback never
+# accepts a name alone: it requires Hestia's exact executable and its panel
+# listener on the fixed local port.
+[ -x /usr/local/hestia/nginx/sbin/hestia-nginx ] || { printf 'END\n'; exit 0; }
+command -v pgrep >/dev/null && command -v readlink >/dev/null && command -v ss >/dev/null && command -v head >/dev/null || exit 1
+n=0
+for pid in $(pgrep -x hestia-nginx 2>/dev/null | head -n 9); do
+  case "$pid" in *[!0-9]*|'') continue;; esac
+  n=$((n+1)); [ "$n" -le 8 ] || { printf 'LIMIT\n'; exit 0; }
+  exe=$(timeout -s KILL 1 readlink "/proc/$pid/exe") || continue
+  [ "$exe" = /usr/local/hestia/nginx/sbin/hestia-nginx ] || continue
+  cwd=$(timeout -s KILL 1 readlink "/proc/$pid/cwd") || continue
+  if timeout -s KILL 1 ss -H -lntp | awk -v pid="$pid" '
+    {port=$4; sub(/^.*:/,"",port)
+     if (port == 8083 && index($0, "pid=" pid ",")) found=1}
+    END {exit(found ? 0 : 1)}'; then
+    printf 'H\t%s\t%s\t%s\t8083\n' "$pid" "$exe" "$cwd"
+  fi
+done
+printf 'END\n'
+'''
+FOOTPRINT_SCRIPT = r'''
+[ -f "$1" ] && [ -r "$1" ] || exit 1
+printf 'FILE\n'
+if [ -f "$2/package.json" ]; then
+  [ -r "$2/package.json" ] || exit 1
+  timeout -s KILL 1 head -c 8192 "$2/package.json"
+fi
+'''
+MANIFEST_FOOTPRINT_SCRIPT = r'''
+command -v head >/dev/null && command -v readlink >/dev/null || exit 1
+# Resolve only the operator-owned working directory and its declared parent.
+# A release symlink may change the concrete version directory, but it must not
+# escape the bounded custom application root supplied by the host.
+workdir=$(timeout -s KILL 1 readlink -f "$1") || exit 1
+anchor=$(timeout -s KILL 1 readlink -f "$2") || exit 1
+parent=$(timeout -s KILL 1 readlink -f "$3") || exit 1
+case "$anchor" in "$parent"/*) ;; *) printf 'OUTSIDE\n'; exit 0;; esac
+case "$workdir" in "$anchor"|"$anchor"/*) ;; *) printf 'OUTSIDE\n'; exit 0;; esac
+for relative in package.json server/package.json; do
+  candidate="$workdir/$relative"
+  [ -f "$candidate" ] && [ -r "$candidate" ] || continue
+  resolved=$(timeout -s KILL 1 readlink -f "$candidate") || exit 1
+  case "$resolved" in "$workdir"/*) ;; *) printf 'OUTSIDE\n'; exit 0;; esac
+  printf 'MANIFEST\t%s\n' "$relative"
+  timeout -s KILL 1 head -c 8192 "$resolved"
+  exit 0
+done
+printf 'MISSING\n'
+'''
+
+
+def _path(value):
+    return bool(isinstance(value, str) and _PATH.fullmatch(value)
+                and '..' not in value.split('/'))
+
+
+def _system(name):
+    raw = name.lower().removesuffix('.service')
+    stem = raw.split('@')[0]
+    return (raw.startswith('user@') or stem in _SYSTEM
+            or (raw.startswith('php') and raw.endswith('-fpm'))
+            or stem.startswith((
+        'systemd-', 'dbus-', 'getty', 'containerd-', 'apt-', 'dpkg-', 'e2scrub',
+        'unattended-', 'ifup', 'ifdown', 'user@', 'btrfs-', 'lvm2-', 'lxc-')))
+
+
+def _helper(name):
+    """Reject service roles that support an application but are not one themselves."""
+    raw = name.lower().removesuffix('.service')
+    if raw.endswith('@'):
+        return True  # A systemd template is not a concrete running application.
+    return any(part in _HELPER_ROLES for part in re.split(r'[._-]+', raw) if part)
+
+
+def _hestia_panel_process(executable, ports):
+    """Recognize only Hestia's own bound control-panel process.
+
+    Hestia's generated init unit does not expose an ExecStart that the generic
+    service parser may treat as an application.  Its panel process and port are
+    stable, local runtime metadata, so this stays narrower than accepting
+    arbitrary vendor services or a generic web server.
+    """
+    return executable == _HESTIA_NGINX and _HESTIA_PANEL_PORT in ports
+
+
+def _custom(path):
+    if not _path(path):
+        return False
+    if path.startswith(('/opt/', '/srv/', '/usr/local/')):
+        return True
+    # Native apps commonly keep their runtime below /home/<service-user>/<app>.
+    # Do not accept a home directory itself: a second path component is required.
+    parts = path.split('/')
+    return len(parts) >= 4 and parts[1] == 'home' and bool(parts[2]) and bool(parts[3])
+
+
+def _manifest_bounds(executable, directory):
+    """Return a narrow, operator-owned boundary for a runtime manifest probe."""
+    try:
+        shared = os.path.commonpath((executable, directory))
+    except ValueError:
+        shared = ''
+    anchor = shared if _custom(shared) else directory
+    parts = anchor.split('/')
+    if anchor.startswith(('/opt/', '/srv/')):
+        parent = '/' + parts[1]
+    elif anchor.startswith('/usr/local/'):
+        parent = '/usr/local'
+    elif len(parts) >= 4 and parts[1] == 'home' and parts[2]:
+        parent = f'/home/{parts[2]}'
+    else:
+        return None
+    return anchor, parent
+
+
+def _manifest_footprint(record, run, deadline):
+    """Read one of two fixed Node manifest locations without following an escape."""
+    output = run(['pct', 'exec', str(record['vmid']), '--', 'timeout', '-s', 'KILL', '2',
+                  'sh', '-c', MANIFEST_FOOTPRINT_SCRIPT, 'discovery',
+                  record['root'], record['manifest_anchor'], record['manifest_parent']], deadline)
+    header, separator, metadata = output.partition('\n')
+    if header == 'MISSING':
+        if metadata:
+            raise ProbeError('invalid_data')
+        return None, None
+    if header == 'OUTSIDE':
+        if metadata:
+            raise ProbeError('invalid_data')
+        raise ProbeError('unsafe_manifest_root')
+    prefix = 'MANIFEST\t'
+    relative = header.removeprefix(prefix)
+    if not header.startswith(prefix) or relative not in ('package.json', 'server/package.json'):
+        raise ProbeError('invalid_data')
+    if not separator:
+        raise ProbeError('invalid_data')
+    candidate_record = dict(record)
+    candidate_record['path'] = str(Path(record['root']) / relative)
+    return candidate_record, 'FILE\n' + metadata
+
+
+def parse_records(text, kind):
+    lines = text.splitlines()
+    if not lines or lines[-1] not in ('END', 'LIMIT'):
+        raise ProbeError('incomplete')
+    if len(lines) - 1 > MAX_RECORDS:
+        raise ProbeError('metadata_limit')
+    records = []
+    seen_services = set()
+    for line in lines[:-1]:
+        parts = line.split('\t')
+        if kind == 'S' and len(parts) == 6 and parts[0] == 'S':
+            _, source, manager, exe, script, directory = parts
+            if not _path(source) or manager not in ('systemd', 'openrc'):
+                raise ProbeError('invalid_data')
+            service = Path(source).name.removesuffix('.service')
+            if service in seen_services:
+                continue  # /etc overrides vendor units; no duplicate installations.
+            seen_services.add(service)
+            if (not _NAME.fullmatch(service) or _system(service) or _helper(service)
+                    or not _path(exe)):
+                continue
+            runtime_name = Path(exe).name
+            runtime = bool(_RUNTIMES.fullmatch(runtime_name))
+            manifest_bounds = None
+            if runtime and not _path(script):
+                # A Node/npm wrapper may keep its entry point relative to an
+                # operator-owned working directory.  Only two fixed manifest
+                # locations can prove that root; no argv, environment, recursive
+                # search or guest-provided path is ever used.
+                if runtime_name not in _PACKAGE_ROOT_RUNTIMES or not _custom(directory):
+                    continue
+                install = str(Path(directory) / 'package.json')
+                manifest_bounds = _manifest_bounds(exe, directory)
+                if manifest_bounds is None:
+                    continue
+            else:
+                install = script if runtime else exe
+            if (not _path(install) or _system(Path(install).name)
+                    or install.startswith(('/usr/lib/systemd/', '/lib/systemd/',
+                                           '/usr/lib/udev/', '/lib/udev/', '/usr/lib/apt/'))):
+                continue
+            # /etc units are operator-owned.  Do not infer an application from an
+            # arbitrary packaged systemd unit: without a package-db probe it is
+            # impossible to distinguish vendor infrastructure from a user app.
+            if (manager == 'systemd'
+                    and source.startswith(('/usr/lib/systemd/system/', '/lib/systemd/system/'))
+                    and not _custom(install)):
+                continue
+            root = directory if _custom(directory) else str(Path(install).parent)
+            # Generic runtime without an absolute application script is ambiguous.
+            if runtime and not _custom(install):
+                continue
+            record = {'name': service, 'path': install, 'root': root,
+                      'service': source, 'manager': manager, 'executable': exe}
+            if manifest_bounds:
+                record['manifest_anchor'], record['manifest_parent'] = manifest_bounds
+            records.append(record)
+        elif kind == 'P' and len(parts) == 4 and parts[0] == 'P':
+            _, pid, exe, directory = parts
+            # A process rooted at / is normally too ambiguous for generic
+            # discovery, but it is valid process metadata for the exact Hestia
+            # panel signature below.  It never becomes a generic candidate.
+            if not pid.isdigit() or not _path(exe) or (directory != '/' and not _path(directory)):
+                continue
+            records.append({'pid': pid, 'executable': exe, 'root': directory})
+        elif kind == 'L' and len(parts) == 3 and parts[0] == 'L':
+            _, pid, port = parts
+            if pid.isdigit() and port.isdigit() and 0 < int(port) < 65536:
+                records.append({'pid': pid, 'port': int(port)})
+            else:
+                raise ProbeError('invalid_data')
+        elif kind == 'H' and len(parts) == 5 and parts[0] == 'H':
+            _, pid, exe, directory, port = parts
+            if (pid.isdigit() and exe == _HESTIA_NGINX
+                    and (directory == '/' or _path(directory))
+                    and port == str(_HESTIA_PANEL_PORT)):
+                records.append({'pid': pid, 'executable': exe, 'root': directory,
+                                'port': _HESTIA_PANEL_PORT})
+            else:
+                raise ProbeError('invalid_data')
+        else:
+            raise ProbeError('invalid_data')
+    return records, lines[-1] == 'LIMIT', len(lines) - 1
+
+
+def candidate(vmid, record, footprint):
+    if not footprint.startswith('FILE\n'):
+        raise ProbeError('invalid_data')
+    version, metadata_issue = None, None
+    metadata = footprint[5:].strip()
+    if metadata:
+        try:
+            manifest = json.loads(metadata)
+        except (ValueError, TypeError):
+            manifest = None
+        # Only the whitelisted version field leaves this function. Never retain
+        # manifest scripts, repository guesses, config or arbitrary extra fields.
+        if not isinstance(manifest, dict):
+            metadata_issue = 'invalid_metadata'
+            manifest = {}
+        value = manifest.get('version')
+        if (isinstance(value, str) and len(value) <= 64 and _VERSION.fullmatch(value)
+                and record['path'].startswith(record['root'].rstrip('/') + '/')):
+            version = value
+    identity = 'native-' + hashlib.sha256(
+        f'{int(vmid)}:{record["path"]}:{record["root"]}'.encode()).hexdigest()[:24]
+    evidence = [{'kind': 'installation_file', 'value': record['path']}]
+    if record.get('service'):
+        evidence.append({'kind': record['manager'], 'value': record['service']})
+    else:
+        evidence.extend([{'kind': 'process_executable', 'value': record['process']},
+                         {'kind': 'working_directory',
+                          'value': record.get('process_root', record['root'])}])
+    ports = sorted(set(record.get('listening_ports') or []))
+    # Hestia's control panel is a narrow, verified exception to generic port
+    # inference: its own executable serves the panel on fixed HTTPS port 8083.
+    # Keep this declaration on the exact runtime signature so an unrelated
+    # application merely listening on 8083 never receives an HTTPS guess.
+    hestia_panel = (record['name'] == 'Hestia'
+                    and record['path'] == _HESTIA_NGINX
+                    and record['root'] == _HESTIA_ROOT
+                    and _HESTIA_PANEL_PORT in ports)
+    evidence.extend({'kind': 'tcp_listener', 'value': str(port)} for port in ports)
+    return {'slug': identity, 'discovery_id': identity, 'source': 'native_metadata',
+            'name': record['name'], 'installed_version': version, 'evidence': evidence,
+            'installation_path': record['path'],
+            'default_ports': [_HESTIA_PANEL_PORT] if hestia_panel else [],
+            'listening_ports': ports,
+            **({'scheme': 'https'} if hestia_panel else {}),
+            'metadata_issue': metadata_issue,
+            'tracking_suggestion': ({'installed_via': 'manual', 'installed_version': version,
+                                     'detected_version': version, 'detector_verified': True}
+                                    if version else None)}
+
+
+def _guard(vmid, deadline, run):
+    # The local node path rejects QEMU, missing and remote CTs before pct exec.
+    path = LOCAL_CONFIG / f'{vmid}.conf'
+    if not path.is_file():
+        raise ProbeError('not_local_lxc')
+    # Presence, including a damaged/in-progress record, excludes generic probes.
+    try:
+        os.lstat(OCI_ROOT / str(vmid))
+    except FileNotFoundError:
+        pass
+    except OSError:
+        raise ProbeError('oci_unknown') from None
+    else:
+        raise ProbeError('managed_oci')
+    try:
+        with path.open('rb') as handle:
+            raw = handle.read(OUTPUT_BYTES + 1)
+        if len(raw) > OUTPUT_BYTES:
+            raise ProbeError('config_limit')
+        config = raw.decode('utf-8')
+    except (OSError, UnicodeError):
+        raise ProbeError('config_unavailable') from None
+    if re.search(r'^lock:', config, re.M):
+        raise ProbeError('guest_busy')
+    update_lock = UPDATE_LOCK_ROOT / f'proxmenux-lxc-update-{vmid}.lock'
+    try:
+        fd = os.open(update_lock, os.O_RDONLY | os.O_NOFOLLOW | os.O_NONBLOCK)
+        with os.fdopen(fd, 'rb') as handle:
+            info = os.fstat(handle.fileno())
+            if not stat.S_ISREG(info.st_mode):
+                raise ProbeError('lock_unavailable')
+            if info.st_size:
+                raise ProbeError('guest_busy')
+            try:
+                fcntl.flock(handle, fcntl.LOCK_SH | fcntl.LOCK_NB)
+            except BlockingIOError:
+                raise ProbeError('guest_busy') from None
+            finally:
+                fcntl.flock(handle, fcntl.LOCK_UN)
+    except FileNotFoundError:
+        pass
+    except OSError:
+        raise ProbeError('lock_unavailable') from None
+    if re.search(r'^ostype:\s*unmanaged\s*$', config, re.M):
+        raise ProbeError('unsupported_guest')
+    if not re.search(r'^ostype:\s*(?:debian|ubuntu|alpine|archlinux|centos|fedora|opensuse|gentoo)\s*$', config, re.M):
+        raise ProbeError('unsupported_guest')
+    status = run(['pct', 'status', str(vmid)], deadline).strip()
+    if status != 'status: running':
+        raise ProbeError('guest_stopped' if status == 'status: stopped' else 'status_unknown')
+
+
+@contextmanager
+def _scan_reservation(vmid):
+    """Exclude cooperating updates/control tasks for this bounded scan only.
+
+    Keep an empty lock inode after first use, as the update runner does.
+    Never truncate a pending control-task reservation or unlink its inode.
+    """
+    path = UPDATE_LOCK_ROOT / f'proxmenux-lxc-update-{vmid}.lock'
+    fd = None
+    try:
+        fd = os.open(path, os.O_RDWR | os.O_CREAT | os.O_NOFOLLOW | os.O_NONBLOCK, 0o600)
+        if not stat.S_ISREG(os.fstat(fd).st_mode):
+            raise ProbeError('lock_unavailable')
+        try:
+            fcntl.flock(fd, fcntl.LOCK_SH | fcntl.LOCK_NB)
+        except BlockingIOError:
+            raise ProbeError('guest_busy') from None
+        if os.fstat(fd).st_size:
+            raise ProbeError('guest_busy')
+        yield
+    except OSError:
+        raise ProbeError('lock_unavailable') from None
+    finally:
+        if fd is not None:
+            os.close(fd)
+
+
+def scan(vmid, run=bounded_run):
+    deadline = time.monotonic() + TOTAL_SECONDS
+    _guard(vmid, deadline, run)
+    with _scan_reservation(vmid):
+        result = _scan_metadata(vmid, deadline, run)
+        # External PVE lifecycle operations do not share our flock. Fail closed
+        # if the guest stopped, changed ownership or became locked meanwhile.
+        _guard(vmid, deadline, run)
+        return result
+
+
+def _scan_metadata(vmid, deadline, run):
+    records, issues, consumed, processes, listeners, hestia_panels = [], [], 0, [], [], []
+    for kind, script in (('S', SERVICE_SCRIPT), ('P', PROCESS_SCRIPT), ('L', PORT_SCRIPT)):
+        try:
+            if consumed >= MAX_RECORDS:
+                issues.append('metadata_limit')
+                break
+            parsed, limited, count = parse_records(run(
+                ['pct', 'exec', str(vmid), '--', 'timeout', '-s', 'KILL', '2',
+                 'sh', '-c', script, 'discovery', str(MAX_RECORDS - consumed)], deadline), kind)
+            if consumed + count > MAX_RECORDS:
+                issues.append('metadata_limit')
+                parsed = parsed[:MAX_RECORDS - consumed]
+            consumed = min(MAX_RECORDS, consumed + count)
+            # The entire collector, not each metadata source, has 256 records.
+            capacity = MAX_RECORDS - len(records)
+            if kind == 'S':
+                records.extend(parsed[:capacity])
+            elif kind == 'P':
+                processes = parsed[:capacity]
+            else:
+                listeners = parsed[:capacity]
+            if limited or len(parsed) > capacity:
+                issues.append('metadata_limit')
+        except ProbeError as exc:
+            issues.append(str(exc))
+    try:
+        # This is outside the generic record budget: it returns only an exact,
+        # fixed Hestia signature, not additional arbitrary process metadata.
+        hestia_panels, limited, _ = parse_records(run(
+            ['pct', 'exec', str(vmid), '--', 'timeout', '-s', 'KILL', '2',
+             'sh', '-c', HESTIA_PANEL_SCRIPT, 'discovery'], deadline), 'H')
+        if limited:
+            issues.append('metadata_limit')
+    except ProbeError as exc:
+        issues.append(str(exc))
+    for process in processes:
+        exe, directory = process['executable'], process['root']
+        related = [record for record in records if record['executable'] == exe and (
+            not _RUNTIMES.fullmatch(Path(exe).name) or record['root'] == directory)]
+        ports = [entry['port'] for entry in listeners if entry['pid'] == process['pid']]
+        if len(related) == 1:
+            related[0].setdefault('listening_ports', []).extend(ports)
+        elif not related and _hestia_panel_process(exe, ports):
+            records.append({'name': 'Hestia', 'path': exe, 'root': _HESTIA_ROOT,
+                            'process': exe, 'process_root': directory, 'executable': exe,
+                            'listening_ports': ports})
+        elif not related and (_custom(exe) and _custom(directory)
+                              and not _system(Path(exe).name)
+                              and not _helper(Path(exe).name)
+                              and not _RUNTIMES.fullmatch(Path(exe).name)
+                              and exe.startswith(directory.rstrip('/') + '/')
+                              and _NAME.fullmatch(Path(exe).name)):
+            records.append({'name': Path(exe).name, 'path': exe, 'root': directory,
+                            'process': exe, 'executable': exe, 'listening_ports': ports})
+    for panel in hestia_panels:
+        records.append({'name': 'Hestia', 'path': panel['executable'], 'root': _HESTIA_ROOT,
+                        'process': panel['executable'], 'process_root': panel['root'],
+                        'executable': panel['executable'],
+                        'listening_ports': [panel['port']]})
+    items, seen = [], set()
+    for record in records:
+        key = (record['path'], record['root'])
+        if key in seen:
+            continue
+        seen.add(key)
+        if len(items) >= MAX_CANDIDATES:
+            issues.append('candidate_limit')
+            break
+        try:
+            probe_record = dict(record)
+            probe_record['vmid'] = vmid
+            if 'manifest_anchor' in record:
+                probe_record, footprint = _manifest_footprint(probe_record, run, deadline)
+                if probe_record is None:
+                    continue
+            else:
+                footprint = run(['pct', 'exec', str(vmid), '--', 'timeout', '-s', 'KILL', '2',
+                                 'sh', '-c', FOOTPRINT_SCRIPT,
+                                 'discovery', record['path'], record['root']], deadline)
+            item = candidate(vmid, probe_record, footprint)
+            items.append(item)
+            if item['metadata_issue']:
+                issues.append(item['metadata_issue'])
+        except ProbeError as exc:
+            issues.append(str(exc))
+            if str(exc) == 'deadline':
+                break
+    return {'vmid': vmid, 'status': 'partial' if issues else 'complete',
+            'candidates': items, 'issues': sorted(set(issues)), 'stale': False,
+            'scanned_at': time.time()}
+
+
+def cached(vmid):
+    with _mutex:
+        value = copy.deepcopy(_cache.get(int(vmid)))
+    if value is None:
+        return {'vmid': int(vmid), 'status': 'not_scanned', 'candidates': [], 'stale': False}
+    if time.time() - value['scanned_at'] >= CACHE_SECONDS:
+        value['stale'] = True
+    return value
+
+
+def mark_stale(vmid):
+    """Lifecycle events retire freshness, never collect new guest metadata."""
+    with _mutex:
+        _generations[int(vmid)] = _generations.get(int(vmid), 0) + 1
+        if int(vmid) in _cache:
+            _cache[int(vmid)]['stale'] = True
+
+
+def discover(vmid):
+    vmid = int(vmid)
+    with _mutex:
+        lock = _locks.setdefault(vmid, threading.Lock())
+    if not lock.acquire(blocking=False):
+        return {**cached(vmid), 'status': 'busy', 'stale': True}
+    try:
+        with _mutex:
+            generation = _generations.get(vmid, 0)
+        try:
+            result = scan(vmid)
+        except ProbeError as exc:
+            result = {**cached(vmid), 'status': 'error', 'issues': [str(exc)], 'stale': True}
+            result.setdefault('scanned_at', time.time())
+        # Comparing the generation and publishing must be atomic with lifecycle
+        # invalidation, including the first scan when no cache exists yet.
+        with _mutex:
+            previous = copy.deepcopy(_cache.get(vmid))
+            if _generations.get(vmid, 0) != generation:
+                result = {**(previous or {'vmid': vmid, 'candidates': [],
+                                         'scanned_at': time.time()}),
+                          'status': 'error', 'issues': ['guest_changed'], 'stale': True}
+            elif result['status'] != 'complete' and previous and previous['candidates']:
+                # Partial output cannot prove that previously seen apps disappeared.
+                ids = {item['discovery_id'] for item in result['candidates']}
+                result['candidates'].extend(item for item in previous['candidates']
+                                            if item['discovery_id'] not in ids)
+                result['candidates'] = result['candidates'][:MAX_CANDIDATES]
+                result['stale'] = True
+            _cache[vmid] = copy.deepcopy(result)
+        return result
+    finally:
+        lock.release()
+
+
+def filter_candidates(result, suggestions, apps):
+    """Pure composition: never run catalog probes, load or write registries."""
+    known = [*apps, *(suggestions.get('extras') or []),
+             *(suggestions.get('docker_workloads') or [])]
+    if suggestions.get('helper_slug'):
+        known.append({'name': suggestions.get('name_suggestion'),
+                      'helper_slug': suggestions['helper_slug'],
+                      'tracking_suggestion': suggestions.get('tracking_suggestion')})
+    identities = {a.get('discovery_id') for a in known if a.get('discovery_id')}
+    names, paths = set(), set()
+    for app in known:
+        for field in ('name', 'slug', 'helper_slug', 'package'):
+            if app.get(field):
+                names.add(str(app[field]).casefold())
+        detector = app.get('tracking_suggestion') or app
+        for field in ('binary_path', 'file_path'):
+            if detector.get(field):
+                paths.add(detector[field])
+    items = [item for item in result['candidates']
+             if item['discovery_id'] not in identities
+             and item['name'].casefold() not in names
+             and item['installation_path'] not in paths]
+    return {**result, 'candidates': items}
diff --git a/AppImage/scripts/notification_channels.py b/AppImage/scripts/notification_channels.py
index c2bff230..ba9aaa4d 100644
--- a/AppImage/scripts/notification_channels.py
+++ b/AppImage/scripts/notification_channels.py
@@ -1564,7 +1564,7 @@ class AppriseChannel(NotificationChannel):
             return apprise_mod.NotifyType.FAILURE
         if sev == 'WARNING':
             return apprise_mod.NotifyType.WARNING
-        if sev == 'SUCCESS':
+        if sev in ('SUCCESS', 'OK'):
             return apprise_mod.NotifyType.SUCCESS
         return apprise_mod.NotifyType.INFO
 
diff --git a/AppImage/scripts/notification_events.py b/AppImage/scripts/notification_events.py
index cadfc136..2f71a2d4 100644
--- a/AppImage/scripts/notification_events.py
+++ b/AppImage/scripts/notification_events.py
@@ -3850,6 +3850,13 @@ class PollingCollector:
             return
         self._last_managed_check = now
 
+        try:
+            from pbs_manager import is_pbs_host
+            if is_pbs_host():
+                return  # a Proxmox Backup Server has no guests or integrations to track
+        except Exception:
+            pass
+
         try:
             import managed_installs
         except Exception:
diff --git a/AppImage/scripts/notification_templates.py b/AppImage/scripts/notification_templates.py
index b2751778..d0d87097 100644
--- a/AppImage/scripts/notification_templates.py
+++ b/AppImage/scripts/notification_templates.py
@@ -3335,6 +3335,7 @@ def _ai_cache_key(title, body, ai_config, detail_level, use_emojis):
         str(ai_config.get('ai_provider', '')), '\x1f',
         str(ai_config.get('ai_model', '')), '\x1f',
         str(ai_config.get('ai_language', '')), '\x1f',
+        str(ai_config.get('channel_type', '')).lower(), '\x1f',
         detail_level, '\x1f', '1' if use_emojis else '0',
     ]
     return _hash_ai_cache.sha256(''.join(parts).encode('utf-8', 'replace')).hexdigest()
@@ -3428,7 +3429,8 @@ def format_with_ai_full(title: str, body: str, severity: str,
         channel_type = ai_config.get('channel_type', '').lower()
         is_email = channel_type == 'email'
         
-        if is_email and detail_level == 'detailed' and body and len(body) > 50:
+        if (is_email and detail_level == 'detailed' and body and len(body) > 50
+                and result_body != body):
             # Only append if original has substantial content
             result_body += "\n\n" + "-" * 40 + "\n"
             result_body += "Original message:\n"
diff --git a/AppImage/scripts/pbs_manager.py b/AppImage/scripts/pbs_manager.py
new file mode 100644
index 00000000..83eedac8
--- /dev/null
+++ b/AppImage/scripts/pbs_manager.py
@@ -0,0 +1,288 @@
+"""Local PBS maintenance information and remote, read-only PBS monitoring."""
+
+from concurrent.futures import ThreadPoolExecutor
+import hashlib
+import hmac
+import http.client
+import importlib.util
+import json
+import os
+from pathlib import Path
+import re
+import secrets
+import shutil
+import ssl
+import subprocess
+import tempfile
+import threading
+import time
+from urllib.parse import urlsplit
+
+import auth_manager
+
+try:
+    from proxmox_platform import detect_platform
+except ModuleNotFoundError:
+    # Development checkout; AppImage bundles the canonical shared detector.
+    _path = Path(__file__).resolve().parents[2] / "scripts/global/proxmox_platform.py"
+    _spec = importlib.util.spec_from_file_location("proxmox_platform", _path)
+    _platform_module = importlib.util.module_from_spec(_spec)
+    _spec.loader.exec_module(_platform_module)
+    detect_platform = _platform_module.detect_platform
+
+_lock = threading.RLock()
+_platform_cache = (0, {})
+_status_cache = {}
+PBS_SERVICES = ("proxmox-backup", "proxmox-backup-proxy")
+MAX_RESPONSE = 4 * 1024 * 1024
+
+
+class PBSError(ValueError):
+    pass
+
+
+def get_platform():
+    global _platform_cache
+    with _lock:
+        if _platform_cache[0] <= time.monotonic():
+            _platform_cache = (time.monotonic() + 60, detect_platform())
+        return dict(_platform_cache[1])
+
+
+def is_pbs_host():
+    return get_platform().get("product") == "pbs"
+
+
+def _servers_path():
+    return auth_manager.CONFIG_DIR / "pbs_servers.json"
+
+
+def _load_servers():
+    try:
+        data = json.loads(_servers_path().read_text())
+        if not isinstance(data, list) or not all(isinstance(row, dict) for row in data):
+            raise ValueError()
+        return data
+    except FileNotFoundError:
+        return []
+    except (OSError, ValueError) as exc:
+        raise PBSError("Could not read the PBS server configuration.") from exc
+
+
+def _save_servers(servers):
+    auth_manager.ensure_config_dir()
+    descriptor, temporary = tempfile.mkstemp(prefix=".pbs-servers-", dir=auth_manager.CONFIG_DIR)
+    try:
+        with os.fdopen(descriptor, "w") as handle:
+            os.fchmod(handle.fileno(), 0o600)
+            json.dump(servers, handle, indent=2)
+        os.replace(temporary, _servers_path())
+    finally:
+        if os.path.exists(temporary):
+            os.unlink(temporary)
+    _status_cache.clear()
+
+
+def public_servers():
+    fields = ("id", "name", "url", "token_id", "fingerprint")
+    with _lock:
+        return [{**{key: row.get(key, "") for key in fields}, "has_token": bool(row.get("token_secret"))}
+                for row in _load_servers()]
+
+
+def _validate_server(data, previous=None):
+    if not isinstance(data, dict):
+        raise PBSError("Invalid PBS server configuration.")
+    previous = previous or {}
+    row = {field: data.get(field, previous.get(field, ""))
+           for field in ("name", "url", "token_id", "token_secret", "fingerprint")}
+    if any(not isinstance(value, str) or len(value) > 4096 for value in row.values()):
+        raise PBSError("Invalid PBS connection field.")
+    row["name"] = row["name"].strip()
+    row["url"] = row["url"].strip().rstrip("/")
+    try:
+        parts = urlsplit(row["url"])
+        parts.port
+        if (parts.scheme != "https" or not parts.hostname or parts.username or parts.password
+                or parts.query or parts.fragment):
+            raise ValueError()
+    except ValueError as exc:
+        raise PBSError("Use an HTTPS PBS URL without embedded credentials, query or fragment.") from exc
+    if not row["name"] or len(row["name"]) > 128:
+        raise PBSError("A server name of at most 128 characters is required.")
+    row["token_id"] = row["token_id"].strip()
+    if not re.fullmatch(r"[^\s:!]+@[^\s:!]+![^\s:!]+", row["token_id"]):
+        raise PBSError("Enter a PBS API token ID in user@realm!token format.")
+    if (not row["token_secret"] or not row["token_secret"].isascii()
+            or any(char.isspace() or ord(char) < 32 for char in row["token_secret"])):
+        raise PBSError("A valid API token secret is required.")
+    if not row["token_id"].isascii():
+        raise PBSError("Invalid API token ID.")
+    fingerprint = row["fingerprint"].strip().lower().replace(":", "")
+    if fingerprint and not re.fullmatch("[a-f0-9]{64}", fingerprint):
+        raise PBSError("The certificate fingerprint must be SHA256 (64 hex characters).")
+    row["fingerprint"] = fingerprint
+    return row
+
+
+def _remote_get(server, endpoint):
+    """Validate the TLS peer BEFORE transmitting the PBS token (no redirects)."""
+    parts = urlsplit(server["url"])
+    fingerprint = server.get("fingerprint")
+    if fingerprint:
+        context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
+        context.check_hostname = False
+        context.verify_mode = ssl.CERT_NONE  # Authenticated by the explicit pin below.
+    else:
+        context = ssl.create_default_context()
+    connection = http.client.HTTPSConnection(parts.hostname, parts.port or 443,
+                                              timeout=5, context=context)
+    try:
+        connection.connect()
+        if fingerprint:
+            actual = hashlib.sha256(connection.sock.getpeercert(binary_form=True)).hexdigest()
+            if not hmac.compare_digest(actual, fingerprint):
+                raise PBSError("PBS certificate fingerprint does not match. No credentials were sent.")
+        path = parts.path.rstrip("/") + "/api2/json" + endpoint
+        connection.request("GET", path, headers={
+            "Accept": "application/json",
+            "Authorization": "PBSAPIToken=" + server["token_id"] + ":" + server["token_secret"],
+        })
+        response = connection.getresponse()
+        content = response.read(MAX_RESPONSE + 1)
+        if response.status in (401, 403):
+            raise PBSError("PBS rejected the API token or its permissions. Check both the user and token ACLs.")
+        if response.status != 200 or len(content) > MAX_RESPONSE:
+            raise PBSError("PBS returned an invalid response. Redirects are not followed.")
+        document = json.loads(content)
+        if not isinstance(document, dict) or "data" not in document:
+            raise PBSError("PBS returned an invalid JSON document.")
+        return document["data"]
+    except PBSError:
+        raise
+    except (OSError, http.client.HTTPException, ValueError) as exc:
+        raise PBSError("Could not connect to PBS over verified HTTPS. Check the address, certificate and service.") from exc
+    finally:
+        connection.close()
+
+
+def save_server(data):
+    identifier = data.get("id") if isinstance(data, dict) else None
+    if identifier is not None and not re.fullmatch(r"[A-Za-z0-9_-]{1,64}", str(identifier)):
+        raise PBSError("Invalid PBS server ID.")
+    with _lock:
+        previous = next((row for row in _load_servers() if row["id"] == identifier), None)
+    row = _validate_server(data, previous)
+    # /version may be public; validate credentials on the protected status API.
+    usage = _remote_get(row, "/status/datastore-usage")
+    if not isinstance(usage, list):
+        raise PBSError("PBS returned an invalid datastore list.")
+    row.update(id=identifier or "pbs-" + secrets.token_hex(6), revision=secrets.token_hex(16))
+    with _lock:
+        servers = _load_servers()
+        if previous is None and len(servers) >= 32:
+            raise PBSError("At most 32 PBS connections may be configured.")
+        servers = [existing for existing in servers if existing["id"] != row["id"]]
+        _save_servers([*servers, row])
+    return row["id"]
+
+
+def delete_server(identifier):
+    with _lock:
+        servers = _load_servers()
+        remaining = [row for row in servers if row["id"] != identifier]
+        if len(remaining) == len(servers):
+            raise PBSError("PBS server not found.")
+        _save_servers(remaining)
+
+
+def _cli(*arguments):
+    try:
+        result = subprocess.run(["proxmox-backup-manager", *arguments, "--output-format", "json"],
+                                check=True, text=True, capture_output=True, timeout=8)
+        data = json.loads(result.stdout)
+        if not isinstance(data, list) or not all(isinstance(row, dict) for row in data):
+            raise ValueError()
+        return data
+    except (OSError, subprocess.SubprocessError, ValueError) as exc:
+        raise PBSError("Could not read PBS " + " ".join(arguments[:2]) + ". Check its service and permissions.") from exc
+
+
+def _local_datastores():
+    stores = _cli("datastore", "list")
+    result = []
+    for store in stores:
+        row = {"name": store.get("name"), "path": store.get("path"),
+               "maintenance_mode": store.get("maintenance-mode"), "total": None, "used": None, "avail": None}
+        path = store.get("path")
+        # A removable datastore directory may survive unmounting. Do not report
+        # its underlying root filesystem as the missing datastore's capacity.
+        inactive = store.get("backing-device") and not (path and os.path.ismount(path))
+        if not path or inactive or store.get("maintenance-mode"):
+            row["error"] = "Datastore is offline, in maintenance or has no mounted backing device."
+        else:
+            try:
+                capacity = shutil.disk_usage(path)
+                row.update(total=capacity.total, used=capacity.used, avail=capacity.free)
+            except OSError:
+                row["error"] = "Datastore filesystem is not available."
+        result.append(row)
+    return result
+
+
+def _local_services():
+    result = {}
+    for service in PBS_SERVICES:
+        try:
+            check = subprocess.run(["systemctl", "is-active", service], capture_output=True, text=True, timeout=3)
+            result[service] = check.stdout.strip() if check.returncode == 0 else "inactive"
+        except (OSError, subprocess.SubprocessError):
+            result[service] = "unknown"
+    return result
+
+
+def get_status(identifier):
+    with _lock:
+        cached = _status_cache.get(identifier)
+        if cached and cached[0] > time.monotonic():
+            return cached[1]
+    errors = {}
+    if identifier == "local":
+        if not is_pbs_host():
+            raise PBSError("The local host is not a PBS server.")
+        name, version = "Local PBS", get_platform().get("version")
+        services = _local_services()
+        operations = {"datastores": _local_datastores,
+                      "tasks": lambda: _cli("task", "list", "--all", "true", "--limit", "20"),
+                      "sync": lambda: _cli("sync-job", "list"),
+                      "verify": lambda: _cli("verify-job", "list"),
+                      "prune": lambda: _cli("prune-job", "list")}
+    else:
+        with _lock:
+            server = next((row for row in _load_servers() if row["id"] == identifier), None)
+        if not server:
+            raise PBSError("PBS server not found.")
+        metadata = _remote_get(server, "/version")
+        name, version = server["name"], metadata.get("version") if isinstance(metadata, dict) else None
+        services = {}
+        endpoints = {"datastores": "/status/datastore-usage", "tasks": "/nodes/localhost/tasks?limit=20",
+                     "sync": "/admin/sync", "verify": "/admin/verify", "prune": "/admin/prune"}
+        operations = {key: (lambda endpoint=path: _remote_get(server, endpoint)) for key, path in endpoints.items()}
+    result = {"server": identifier, "name": name, "version": version, "services": services,
+              "fetched_at": int(time.time()), "errors": errors}
+    with ThreadPoolExecutor(max_workers=5) as executor:
+        futures = {key: executor.submit(operation) for key, operation in operations.items()}
+        for key, future in futures.items():
+            try:
+                data = future.result()
+                if not isinstance(data, list) or not all(isinstance(row, dict) for row in data):
+                    raise PBSError("PBS returned an invalid list.")
+                result[key] = [{**row, "name": row.get("store", row.get("name"))} for row in data] if key == "datastores" else data
+            except PBSError as exc:
+                result[key] = None  # Unknown/forbidden is never presented as zero.
+                errors[key] = str(exc)
+    with _lock:
+        if len(_status_cache) >= 33:
+            _status_cache.clear()
+        _status_cache[identifier] = (time.monotonic() + 15, result)
+    return result
diff --git a/AppImage/scripts/tests/test_fwbr_udev_rule_order.py b/AppImage/scripts/tests/test_fwbr_udev_rule_order.py
index 70f61b5f..231fc61d 100644
--- a/AppImage/scripts/tests/test_fwbr_udev_rule_order.py
+++ b/AppImage/scripts/tests/test_fwbr_udev_rule_order.py
@@ -26,18 +26,18 @@ class FwbrUdevRuleOrderTests(unittest.TestCase):
     def test_auto_post_install_uses_late_rule_and_removes_legacy_rule(self):
         source = network_optimization_block(AUTO_POST_INSTALL)
         self.assertIn('local FUNC_VERSION="1.2"', source)
-        self.assertIn(f"rm -f /etc/udev/rules.d/{OLD_RULE}", source)
-        self.assertIn(f"cat > /etc/udev/rules.d/{NEW_RULE}", source)
+        self.assertIn(f"pmx_remove_file /etc/udev/rules.d/{OLD_RULE}", source)
+        self.assertIn(f"pmx_write_file /etc/udev/rules.d/{NEW_RULE}", source)
         self.assertIn(f"chmod 0644 /etc/udev/rules.d/{NEW_RULE}", source)
-        self.assertNotIn(f"cat > /etc/udev/rules.d/{OLD_RULE}", source)
+        self.assertNotIn(f"pmx_write_file /etc/udev/rules.d/{OLD_RULE}", source)
 
     def test_customizable_post_install_uses_late_rule_and_removes_legacy_rule(self):
         source = network_optimization_block(CUSTOM_POST_INSTALL)
         self.assertIn('local FUNC_VERSION="1.2"', source)
-        self.assertIn(f"rm -f /etc/udev/rules.d/{OLD_RULE}", source)
-        self.assertIn(f"cat > /etc/udev/rules.d/{NEW_RULE}", source)
+        self.assertIn(f"pmx_remove_file /etc/udev/rules.d/{OLD_RULE}", source)
+        self.assertIn(f"pmx_write_file /etc/udev/rules.d/{NEW_RULE}", source)
         self.assertIn(f"chmod 0644 /etc/udev/rules.d/{NEW_RULE}", source)
-        self.assertNotIn(f"cat > /etc/udev/rules.d/{OLD_RULE}", source)
+        self.assertNotIn(f"pmx_write_file /etc/udev/rules.d/{OLD_RULE}", source)
 
     def test_uninstall_removes_new_and_legacy_rule_names(self):
         source = UNINSTALL_TOOLS.read_text()
diff --git a/AppImage/scripts/tests/test_monitor_links.py b/AppImage/scripts/tests/test_monitor_links.py
new file mode 100644
index 00000000..48036393
--- /dev/null
+++ b/AppImage/scripts/tests/test_monitor_links.py
@@ -0,0 +1,150 @@
+import json
+from pathlib import Path
+import sys
+import tempfile
+from types import SimpleNamespace
+import unittest
+from unittest import mock
+
+ROOT = Path(__file__).resolve().parents[3]
+sys.path.insert(0, str(ROOT / "AppImage/scripts"))
+
+import monitor_links as links
+
+
+class MonitorLinksTests(unittest.TestCase):
+    def setUp(self):
+        temporary = tempfile.TemporaryDirectory()
+        self.addCleanup(temporary.cleanup)
+        self.root = Path(temporary.name)
+        storage = self.root / "storage.cfg"
+        storage.write_text("dir: local\n\tpath /var/lib/vz\n\npbs: Lab\n\tdatastore store1\n\tserver 10.0.0.49\n\n"
+                           "pbs: Cloud\n\tdatastore x\n\tserver pbs.example.com\n\tport 8443\n")
+        patches = [
+            mock.patch.object(links, "LINKS_FILE", self.root / "links.json"),
+            mock.patch.object(links, "SSL_CONFIG_FILE", self.root / "ssl.json"),
+            mock.patch.object(links, "STORAGE_CFG", storage),
+            mock.patch.object(links.pbs_manager, "get_platform", return_value={"product": "pve", "hostname": "amd"}),
+            mock.patch.object(links.pbs_manager, "public_servers", return_value=[]),
+        ]
+        for patch in patches:
+            patch.start()
+            self.addCleanup(patch.stop)
+        links._probe_cache.clear()
+        cluster = [{"type": "cluster", "name": "Casa"},
+                   {"type": "node", "name": "amd", "ip": "10.0.0.55", "local": 1},
+                   {"type": "node", "name": "constructor", "ip": "10.0.0.50", "local": 0}]
+        self.run_patch = mock.patch.object(links.subprocess, "run",
+                                           return_value=SimpleNamespace(returncode=0, stdout=json.dumps(cluster)))
+        self.run_patch.start()
+        self.addCleanup(self.run_patch.stop)
+
+    def test_normalize_url_keeps_only_the_origin_and_rejects_credentials(self):
+        self.assertEqual(links.normalize_url("192.168.0.49:8008/dashboard?x=1"), "https://192.168.0.49:8008")
+        self.assertEqual(links.normalize_url("http://pve.lan"), "http://pve.lan")
+        for bad in ("", "ftp://host", "https://user:pass@host", "https://host:99999", "javascript:alert(1)"):
+            with self.subTest(bad=bad), self.assertRaises(links.LinkError):
+                links.normalize_url(bad)
+
+    def test_discovers_other_cluster_nodes_and_pbs_without_the_local_node(self):
+        probed = []
+        with mock.patch.object(links, "_probe", side_effect=lambda url: probed.append(url) or url.endswith("10.0.0.50:8008")), \
+                mock.patch.object(links, "_is_private", side_effect=lambda host: host.startswith("10.")):
+            result = links.list_links()
+        by_key = {row["key"]: row for row in result["links"]}
+        self.assertEqual(result["self"]["name"], "amd")
+        self.assertNotIn("cluster:amd", by_key)
+        self.assertEqual(by_key["cluster:constructor"]["status"], "online")
+        self.assertEqual(by_key["pbs:10.0.0.49"]["native_url"], "https://10.0.0.49:8007")
+        self.assertEqual(by_key["pbs:10.0.0.49"]["status"], "offline")
+        # A public PBS is listed with its own interface but never probed unasked.
+        self.assertEqual(by_key["pbs:pbs.example.com"]["status"], "unknown")
+        self.assertEqual(by_key["pbs:pbs.example.com"]["native_url"], "https://pbs.example.com:8443")
+        self.assertFalse(any("example.com" in url for url in probed))
+
+    def test_pbs_host_lists_only_manual_entries(self):
+        links.pbs_manager.get_platform.return_value = {"product": "pbs", "hostname": "pbs-lab"}
+        links.add_link({"name": "amd", "url": "https://10.0.0.55:8008", "product": "pve"})
+        with mock.patch.object(links, "_probe", return_value=True):
+            result = links.list_links()
+        self.assertEqual([row["name"] for row in result["links"]], ["amd"])
+        self.links_run_not_called()
+
+    def links_run_not_called(self):
+        self.assertFalse(any(call.args and call.args[0][:1] == ["pvesh"] for call in links.subprocess.run.call_args_list))
+
+    def test_manual_entries_overrides_and_hidden_detected_nodes(self):
+        key = links.add_link({"name": "lab", "url": "10.0.0.46:8008", "product": "pve"})
+        with self.assertRaises(links.LinkError):
+            links.add_link({"url": "https://10.0.0.46:8008"})
+        links.update_link("cluster:constructor", {"url": "https://constructor.lan:8008"})
+        links.update_link("pbs:10.0.0.49", {"hidden": True})
+        with mock.patch.object(links, "_probe", return_value=False), \
+                mock.patch.object(links, "_is_private", return_value=True):
+            visible = {row["key"]: row for row in links.list_links()["links"]}
+            everything = {row["key"]: row for row in links.list_links(include_hidden=True)["links"]}
+        self.assertEqual(visible[key]["url"], "https://10.0.0.46:8008")
+        self.assertEqual(visible["cluster:constructor"]["url"], "https://constructor.lan:8008")
+        self.assertNotIn("pbs:10.0.0.49", visible)
+        self.assertTrue(everything["pbs:10.0.0.49"]["hidden"])
+        with self.assertRaises(links.LinkError):
+            links.delete_link("cluster:constructor")
+        links.delete_link(key)
+        self.assertEqual(json.loads((self.root / "links.json").read_text())["manual"], [])
+        self.assertEqual((self.root / "links.json").stat().st_mode & 0o777, 0o600)
+
+    def test_cached_list_is_served_without_new_probes_and_renewed_when_stale(self):
+        links._snapshot.update(at=0.0, data=None)
+        self.addCleanup(links._snapshot.update, at=0.0, data=None)
+        links.update_link("pbs:10.0.0.49", {"hidden": True})
+        with mock.patch.object(links, "_probe", return_value=True) as probe, \
+                mock.patch.object(links, "_is_private", return_value=True):
+            first = links.cached_links()
+            calls = probe.call_count
+            again = links.cached_links()
+            self.assertEqual(probe.call_count, calls)
+            self.assertEqual(first, again)
+            self.assertNotIn("pbs:10.0.0.49", [row["key"] for row in first["links"]])
+            self.assertIn("pbs:10.0.0.49", [row["key"] for row in links.cached_links(include_hidden=True)["links"]])
+            links._snapshot["at"] -= links.PROBE_TTL + 1
+            with mock.patch.object(links.threading, "Thread") as thread:
+                stale = links.cached_links()
+            self.assertEqual(stale, first)
+            thread.assert_called_once()
+
+    def test_unknown_keys_are_rejected(self):
+        for key in ("other:x", "cluster:../../etc", "manual:nope"):
+            with self.subTest(key=key), self.assertRaises(links.LinkError):
+                links.update_link(key, {"hidden": True})
+
+    def test_probe_sends_no_credentials_and_needs_a_monitor_answer(self):
+        seen = []
+
+        class Response:
+            status = 200
+
+            def __init__(self, body):
+                self.body = body
+
+            def read(self, _size):
+                return self.body
+
+            def __enter__(self):
+                return self
+
+            def __exit__(self, *_):
+                return False
+
+        def urlopen(request, timeout, context):
+            seen.append(request)
+            return Response(b'{"auth_enabled": true}' if "monitor" in request.full_url else b"<html>")
+
+        with mock.patch.object(links.urllib.request, "urlopen", side_effect=urlopen):
+            self.assertTrue(links._probe("https://monitor:8008"))
+            self.assertFalse(links._probe("https://other:8008"))
+        self.assertTrue(all(request.full_url.endswith("/api/auth/status") for request in seen))
+        self.assertTrue(all("Authorization" not in request.headers for request in seen))
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/AppImage/scripts/tests/test_native_app_discovery.py b/AppImage/scripts/tests/test_native_app_discovery.py
new file mode 100644
index 00000000..dc24424a
--- /dev/null
+++ b/AppImage/scripts/tests/test_native_app_discovery.py
@@ -0,0 +1,785 @@
+"""Host-independent discovery fixtures; no real pct, guest, auth or registry."""
+import ast
+import copy
+import fcntl
+from functools import wraps
+import json
+from pathlib import Path
+import subprocess
+import sys
+import tempfile
+import threading
+import time
+import unittest
+from unittest.mock import Mock, patch
+
+SCRIPTS = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(SCRIPTS))
+import native_app_discovery as native
+import lxc_apps
+
+
+def service(name='handmade', exe='/opt/handmade/server', directory='/opt/handmade', manager='systemd', script='', source=None):
+    path = source or ('/etc/systemd/system/' + name + '.service' if manager == 'systemd'
+                      else '/etc/init.d/' + name)
+    return '\t'.join(['S', path, manager, exe, script, directory]) + '\nEND\n'
+
+
+class DiscoveryFixtures(unittest.TestCase):
+    def setUp(self):
+        self.temp = tempfile.TemporaryDirectory()
+        self.addCleanup(self.temp.cleanup)
+        self.root = Path(self.temp.name)
+        self.config = self.root / 'lxc'
+        self.config.mkdir()
+        (self.config / '101.conf').write_text('ostype: debian\n')
+        self.oci = self.root / 'oci'
+        self.oci.mkdir()
+        for context in (patch.object(native, 'LOCAL_CONFIG', self.config),
+                        patch.object(native, 'OCI_ROOT', self.oci),
+                        patch.object(native, 'UPDATE_LOCK_ROOT', self.root)):
+            context.start()
+            self.addCleanup(context.stop)
+        native._cache.clear()
+        native._locks.clear()
+        native._generations.clear()
+        self.calls = []
+
+    def runner(self, services=None, processes='END\n', footprint='FILE\n', manifest=None,
+               status='status: running', ports='END\n', hestia_panels='END\n'):
+        def run(argv, deadline):
+            self.calls.append(argv)
+            self.assertLessEqual(deadline - time.monotonic(), native.TOTAL_SECONDS)
+            if argv[1] == 'status':
+                return status
+            self.assertEqual(argv[:6], ['pct', 'exec', '101', '--', 'timeout', '-s'])
+            self.assertEqual(argv[6:9], ['KILL', '2', 'sh'])
+            script = argv[10]
+            if script == native.SERVICE_SCRIPT:
+                return services if services is not None else service()
+            if script == native.PROCESS_SCRIPT:
+                return processes
+            if script == native.PORT_SCRIPT:
+                return ports
+            if script == native.HESTIA_PANEL_SCRIPT:
+                return hestia_panels
+            if script == native.MANIFEST_FOOTPRINT_SCRIPT:
+                if manifest is not None:
+                    return manifest
+                return 'MANIFEST\tpackage.json\n' + footprint.removeprefix('FILE\n')
+            if script == native.FOOTPRINT_SCRIPT:
+                return footprint
+            self.fail('Unexpected probe')
+        return run
+
+    def test_unknown_version_is_present_with_evidence_and_no_capabilities(self):
+        result = native.scan(101, self.runner())
+        self.assertEqual(result['status'], 'complete')
+        item, = result['candidates']
+        self.assertIsNone(item['installed_version'])
+        self.assertIsNone(item['tracking_suggestion'])
+        self.assertEqual(item['default_ports'], [])
+        self.assertEqual({e['kind'] for e in item['evidence']}, {'installation_file', 'systemd'})
+        for field in ('helper_slug', 'repo', 'update_command', 'binary_path', 'upstream_type'):
+            self.assertNotIn(field, item)
+
+    def test_openrc_node_script_known_version_is_manual_and_secret_free(self):
+        result = native.scan(101, self.runner(
+            service(exe='/usr/bin/node', script='/opt/handmade/server.js', manager='openrc'),
+            footprint='FILE\n' + json.dumps({'version': '1.2.3', 'scripts': {'start': 'SECRET'}, 'env': 'PASSWORD'})))
+        item, = result['candidates']
+        self.assertEqual(item['installed_version'], '1.2.3')
+        self.assertEqual(item['tracking_suggestion']['installed_via'], 'manual')
+        self.assertNotIn('SECRET', json.dumps(result))
+        self.assertNotIn('PASSWORD', json.dumps(result))
+        self.assertFalse(any('systemctl' in arg for call in self.calls for arg in call))
+
+    def test_inactive_service_and_packaged_application_are_not_hidden(self):
+        result = native.scan(101, self.runner(service(name='legit-app', exe='/usr/bin/legit-app', directory='')))
+        self.assertEqual(result['candidates'][0]['name'], 'legit-app')
+
+    def test_system_services_and_ambiguous_runtimes_have_zero_footprint_probes(self):
+        for name, exe in [('ssh', '/usr/sbin/sshd'), ('cron', '/usr/sbin/cron'),
+                          ('postfix', '/usr/lib/postfix/master'), ('rsyslog', '/usr/sbin/rsyslogd'),
+                          ('systemd-networkd', '/usr/lib/systemd/systemd-networkd'),
+                          ('ambiguous', '/usr/bin/python3')]:
+            self.calls.clear()
+            result = native.scan(101, self.runner(service(name=name, exe=exe)))
+            self.assertEqual(result['candidates'], [])
+            self.assertFalse(any(native.FOOTPRINT_SCRIPT in call for call in self.calls))
+
+    def test_common_system_daemons_and_vendor_units_have_zero_footprint_probes(self):
+        cases = [
+            ('nginx', '/usr/sbin/nginx', 'openrc', None),
+            ('apache2', '/usr/sbin/apache2', 'systemd', None),
+            ('redis-server', '/usr/bin/redis-server', 'systemd', None),
+            ('mariadb', '/usr/sbin/mariadbd', 'systemd', None),
+            ('postgresql', '/usr/lib/postgresql/16/bin/postgres', 'systemd', None),
+            ('php8.3-fpm', '/usr/sbin/php-fpm8.3', 'systemd', None),
+            ('vendor-daemon', '/usr/bin/vendor-daemon', 'systemd',
+             '/usr/lib/systemd/system/vendor-daemon.service'),
+        ]
+        for name, exe, manager, source in cases:
+            with self.subTest(name=name):
+                self.calls.clear()
+                result = native.scan(101, self.runner(
+                    service(name=name, exe=exe, manager=manager, source=source)))
+                self.assertEqual(result['candidates'], [])
+                self.assertFalse(any(native.FOOTPRINT_SCRIPT in call for call in self.calls))
+
+    def test_alpine_openrc_infrastructure_has_zero_footprint_probes(self):
+        # Actual Alpine 3.24.1 CT217 init metadata: klogd, user and runsvdir.
+        # The runsvdir definition can exist without /usr/bin/runsvdir installed;
+        # rejecting it must precede probing, not turn the scan into partial.
+        for name, executable in (
+            ('klogd', '/sbin/klogd'),
+            ('user', '/usr/libexec/rc/bin/openrc-user'),
+            ('runsvdir', '/usr/bin/runsvdir'),
+            ('renamed-system-service', '/usr/libexec/rc/bin/openrc-user'),
+        ):
+            with self.subTest(name=name):
+                self.calls.clear()
+                result = native.scan(101, self.runner(
+                    service(name=name, exe=executable, directory='', manager='openrc')))
+                self.assertEqual(result['status'], 'complete')
+                self.assertEqual(result['candidates'], [])
+                self.assertFalse(any(native.FOOTPRINT_SCRIPT in call for call in self.calls))
+
+    def test_helper_services_and_templates_have_zero_footprint_probes(self):
+        cases = [
+            ('netpulse-stable-update', '/bin/bash', '/opt/netpulse', '/opt/netpulse/stable-apply.sh'),
+            ('rent-tool-backup', '/bin/bash', '/home/app/rent-tool', '/home/app/rent-tool/scripts/backup-db.sh'),
+            ('keynest-update', '/bin/bash', '/opt/keynest', '/opt/keynest/keynest-update.sh'),
+            ('cortendesk-bootstrap-worker', '/bin/bash', '/opt/cortendesk', '/opt/cortendesk/bootstrap-worker.sh'),
+            ('cortendesk-source-worker', '/bin/bash', '/opt/cortendesk', '/opt/cortendesk/source-worker.sh'),
+            ('cortendesk-managed-password@', '/bin/bash', '/opt/cortendesk', '/opt/cortendesk/password-bridge.sh'),
+            ('miminails-watch', '/usr/local/bin/miminails-watch', '/usr/local/bin', ''),
+        ]
+        for name, exe, directory, script in cases:
+            with self.subTest(name=name):
+                self.calls.clear()
+                result = native.scan(101, self.runner(service(
+                    name=name, exe=exe, directory=directory, script=script)))
+                self.assertEqual(result['candidates'], [])
+                self.assertFalse(any(native.FOOTPRINT_SCRIPT in call for call in self.calls))
+
+    def test_hestia_panel_is_recognized_only_from_its_exact_runtime_and_port(self):
+        hestia = '/usr/local/hestia/nginx/sbin/hestia-nginx'
+        panel = f'H\t391\t{hestia}\t/\t8083\nEND\n'
+        result = native.scan(101, self.runner(
+            services='END\n', processes='LIMIT\n', ports='END\n', hestia_panels=panel))
+        item, = result['candidates']
+        self.assertEqual(item['name'], 'Hestia')
+        self.assertEqual(item['installation_path'], hestia)
+        self.assertEqual(item['listening_ports'], [8083])
+        self.assertEqual(item['default_ports'], [8083])
+        self.assertEqual(item['scheme'], 'https')
+        self.assertIn({'kind': 'working_directory', 'value': '/'}, item['evidence'])
+        self.assertIn('metadata_limit', result['issues'])
+
+        unrelated = native.candidate(101, {
+            'name': 'other-panel', 'path': '/opt/other-panel/server', 'root': '/opt/other-panel',
+            'process': '/opt/other-panel/server', 'listening_ports': [8083],
+        }, 'FILE\n')
+        self.assertEqual(unrelated['default_ports'], [])
+        self.assertNotIn('scheme', unrelated)
+
+        self.calls.clear()
+        result = native.scan(101, self.runner(
+            services='END\n', processes='LIMIT\n', ports='END\n'))
+        self.assertEqual(result['candidates'], [])
+        self.assertFalse(any(native.FOOTPRINT_SCRIPT in call for call in self.calls))
+
+        with self.assertRaises(native.ProbeError):
+            native.parse_records(f'H\t391\t{hestia}\t/\t8443\nEND\n', 'H')
+
+    def test_node_and_npm_wrappers_use_only_bounded_manifest_roots(self):
+        cases = [
+            ('keynest', '/usr/bin/node', '/opt/keynest'),
+            ('rent-tool', '/usr/local/bin/npm', '/home/app/rent-tool'),
+        ]
+        for name, exe, directory in cases:
+            with self.subTest(name=name):
+                self.calls.clear()
+                result = native.scan(101, self.runner(
+                    service(name=name, exe=exe, directory=directory),
+                    footprint='FILE\n{"version":"1.2.3"}'))
+                item, = result['candidates']
+                self.assertEqual(item['name'], name)
+                self.assertEqual(item['installation_path'], directory + '/package.json')
+                self.assertEqual(item['installed_version'], '1.2.3')
+                footprint_calls = [call for call in self.calls if native.MANIFEST_FOOTPRINT_SCRIPT in call]
+                self.assertEqual(len(footprint_calls), 1)
+                if directory.startswith('/home/'):
+                    parent = '/home/app'
+                else:
+                    parent = '/opt'
+                self.assertEqual(footprint_calls[0][-3:], [directory, directory, parent])
+
+        self.calls.clear()
+        result = native.scan(101, self.runner(service(
+            name='ambiguous-home-runtime', exe='/usr/bin/node', directory='/home/app')))
+        self.assertEqual(result['candidates'], [])
+        self.assertFalse(any(native.MANIFEST_FOOTPRINT_SCRIPT in call for call in self.calls))
+
+    def test_node_release_layout_uses_only_server_manifest_under_shared_root(self):
+        self.calls.clear()
+        result = native.scan(101, self.runner(
+            service(name='keynest', exe='/opt/keynest/node/bin/node', directory='/opt/keynest/current'),
+            manifest='MANIFEST\tserver/package.json\n{"version":"1.5.63"}'))
+        item, = result['candidates']
+        self.assertEqual(item['name'], 'keynest')
+        self.assertEqual(item['installation_path'], '/opt/keynest/current/server/package.json')
+        self.assertEqual(item['installed_version'], '1.5.63')
+        manifest_calls = [call for call in self.calls if native.MANIFEST_FOOTPRINT_SCRIPT in call]
+        self.assertEqual(len(manifest_calls), 1)
+        self.assertEqual(manifest_calls[0][-3:],
+                         ['/opt/keynest/current', '/opt/keynest', '/opt'])
+
+    def test_node_release_layout_rejects_manifest_outside_operator_root(self):
+        self.calls.clear()
+        result = native.scan(101, self.runner(
+            service(name='outside-root', exe='/opt/outside/node/bin/node', directory='/opt/outside/current'),
+            manifest='OUTSIDE\n'))
+        self.assertEqual(result['candidates'], [])
+        self.assertIn('unsafe_manifest_root', result['issues'])
+        self.assertFalse(any(native.FOOTPRINT_SCRIPT in call for call in self.calls))
+
+    def test_actual_manifest_probe_accepts_release_and_rejects_symlink_escape(self):
+        parent = self.root / 'opt'
+        anchor = parent / 'keynest'
+        release = anchor / 'releases' / 'v1.5.63'
+        manifest = release / 'server' / 'package.json'
+        manifest.parent.mkdir(parents=True)
+        manifest.write_text('{"version":"1.5.63"}')
+        current = anchor / 'current'
+        current.symlink_to(release)
+        output = native.bounded_run(
+            ['sh', '-c', native.MANIFEST_FOOTPRINT_SCRIPT, 'fixture',
+             str(current), str(anchor), str(parent)], time.monotonic() + 3)
+        self.assertEqual(output, 'MANIFEST\tserver/package.json\n{"version":"1.5.63"}')
+
+        outside = self.root / 'outside' / 'package.json'
+        outside.parent.mkdir()
+        outside.write_text('{"version":"not-readable"}')
+        manifest.unlink()
+        manifest.symlink_to(outside)
+        output = native.bounded_run(
+            ['sh', '-c', native.MANIFEST_FOOTPRINT_SCRIPT, 'fixture',
+             str(current), str(anchor), str(parent)], time.monotonic() + 3)
+        self.assertEqual(output, 'OUTSIDE\n')
+        self.assertNotIn('not-readable', output)
+
+    def test_node_wrapper_with_no_fixed_manifest_is_not_an_error_or_candidate(self):
+        self.calls.clear()
+        result = native.scan(101, self.runner(
+            service(name='missing-manifest', exe='/opt/missing/node/bin/node', directory='/opt/missing/current'),
+            manifest='MISSING\n'))
+        self.assertEqual(result['status'], 'complete')
+        self.assertEqual(result['candidates'], [])
+        self.assertFalse(any(native.FOOTPRINT_SCRIPT in call for call in self.calls))
+
+    def test_helper_process_fallback_has_zero_footprint_probes(self):
+        self.calls.clear()
+        result = native.scan(101, self.runner(
+            services='END\n', processes='P\t123\t/opt/cortendesk/run-worker\t/opt/cortendesk\nEND\n'))
+        self.assertEqual(result['candidates'], [])
+        self.assertFalse(any(native.FOOTPRINT_SCRIPT in call for call in self.calls))
+
+    def test_missing_remote_qemu_stopped_busy_oci_guards_precede_exec(self):
+        scenarios = ['missing', 'stopped', 'busy', 'oci', 'invalid-oci', 'unmanaged']
+        for scenario in scenarios:
+            with self.subTest(scenario=scenario):
+                (self.config / '101.conf').write_text('ostype: debian\n')
+                if scenario == 'missing':
+                    (self.config / '101.conf').unlink()
+                if scenario == 'busy':
+                    (self.config / '101.conf').write_text('lock: backup\n')
+                if scenario == 'unmanaged':
+                    (self.config / '101.conf').write_text('ostype: unmanaged\n')
+                if 'oci' in scenario:
+                    (self.oci / '101').mkdir(exist_ok=True)
+                    (self.oci / '101' / 'oci-compose.json').write_text('broken')
+                self.calls.clear()
+                with self.assertRaises(native.ProbeError):
+                    native.scan(101, self.runner(status='status: stopped' if scenario == 'stopped' else 'status: running'))
+                self.assertFalse(any(call[1] == 'exec' for call in self.calls))
+                if (self.oci / '101').exists():
+                    (self.oci / '101' / 'oci-compose.json').unlink()
+                    (self.oci / '101').rmdir()
+
+    def test_failure_and_partial_output_are_not_successful_empty_results(self):
+        for text in ('', 'malformed\nEND\n', 'S\tpartial', 'LIMIT\n'):
+            result = native.scan(101, self.runner(services=text))
+            self.assertEqual(result['status'], 'partial')
+        run = self.runner()
+        def failed(argv, deadline):
+            if argv[1] == 'exec':
+                raise native.ProbeError('read_failed')
+            return run(argv, deadline)
+        self.assertEqual(native.scan(101, failed)['status'], 'partial')
+
+    def test_optional_invalid_version_metadata_keeps_proven_candidate(self):
+        result = native.scan(101, self.runner(footprint='FILE\n{broken'))
+        self.assertEqual(result['status'], 'partial')
+        item, = result['candidates']
+        self.assertIsNone(item['installed_version'])
+        self.assertIsNone(item['tracking_suggestion'])
+
+    def test_working_directory_manifest_does_not_version_an_unrelated_executable(self):
+        result = native.scan(101, self.runner(service(exe='/opt/other/server'),
+                                             footprint='FILE\n{"version":"1.2.3"}'))
+        self.assertIsNone(result['candidates'][0]['installed_version'])
+
+    def test_path_injection_and_port_only_data_do_not_become_candidates(self):
+        for text in (service(exe='/opt/app/$(id)'), service(exe='/opt/../server'),
+                     service(name='app;id'), service(exe='/bin/sh')):
+            self.assertEqual(native.scan(101, self.runner(text))['candidates'], [])
+        with self.assertRaises(native.ProbeError):
+            native.parse_records('PORT\t8080\nEND\n', 'P')
+
+    def test_same_process_deduplicates_but_two_apps_using_node_do_not_merge(self):
+        services = service(exe='/usr/bin/node', script='/opt/handmade/server.js').removesuffix('END\n')
+        services += service(name='second', exe='/usr/bin/node', script='/opt/second/server.js', directory='/opt/second')
+        result = native.scan(101, self.runner(services))
+        self.assertEqual(len(result['candidates']), 2)
+        result = native.scan(101, self.runner(processes='P\t123\t/opt/handmade/server\t/opt/handmade\nEND\n'))
+        self.assertEqual(len(result['candidates']), 1)
+        other = native.candidate(102, native.parse_records(service(), 'S')[0][0], 'FILE\n')
+        self.assertNotEqual(other['discovery_id'], result['candidates'][0]['discovery_id'])
+
+    def test_record_and_candidate_caps(self):
+        too_many = 'P\t123\t/opt/a/app\t/opt/a\n' * 257 + 'END\n'
+        with self.assertRaises(native.ProbeError):
+            native.parse_records(too_many, 'P')
+        services = ''.join(service(name=f'app{i}', exe=f'/opt/app{i}/server', directory=f'/opt/app{i}').removesuffix('END\n') for i in range(51)) + 'END\n'
+        result = native.scan(101, self.runner(services))
+        self.assertEqual(len(result['candidates']), 50)
+        self.assertIn('candidate_limit', result['issues'])
+
+    def test_cached_ttl_never_runs_scan_and_error_preserves_last_known(self):
+        complete = native.scan(101, self.runner())
+        with patch.object(native, 'scan', return_value=complete) as scan:
+            native.discover(101)
+            for age, stale in ((299.9, False), (300, True), (300.1, True)):
+                with patch.object(native.time, 'time', return_value=complete['scanned_at'] + age):
+                    self.assertEqual(native.cached(101)['stale'], stale)
+            self.assertEqual(scan.call_count, 1)
+        with patch.object(native, 'scan', side_effect=native.ProbeError('timeout')):
+            result = native.discover(101)
+        self.assertEqual(result['candidates'], complete['candidates'])
+        self.assertEqual(native.cached(101)['status'], 'error')
+        self.assertTrue(native.cached(101)['stale'])
+        partial = {**complete, 'status': 'partial', 'candidates': [], 'issues': ['read_failed']}
+        with patch.object(native, 'scan', return_value=partial):
+            self.assertEqual(native.discover(101)['candidates'], complete['candidates'])
+        with patch.object(native, 'scan', return_value={**complete, 'candidates': []}):
+            self.assertEqual(native.discover(101)['candidates'], [])
+
+    def test_lifecycle_during_first_or_cached_scan_cannot_publish_fresh_result(self):
+        complete = native.scan(101, self.runner())
+        for prior in (None, complete):
+            with self.subTest(cached=prior is not None):
+                native._cache.clear()
+                if prior:
+                    native._cache[101] = copy.deepcopy(prior)
+                entered, release = threading.Event(), threading.Event()
+                results = []
+                def delayed(vmid):
+                    entered.set()
+                    if not release.wait(3):
+                        raise AssertionError('scan release timed out')
+                    return copy.deepcopy(complete)
+                with patch.object(native, 'scan', side_effect=delayed):
+                    worker = threading.Thread(target=lambda: results.append(native.discover(101)))
+                    worker.start()
+                    try:
+                        self.assertTrue(entered.wait(3))
+                        native.mark_stale(101)
+                    finally:
+                        release.set()
+                        worker.join(3)
+                self.assertFalse(worker.is_alive())
+                self.assertEqual(len(results), 1)
+                self.assertTrue(results[0]['stale'])
+                self.assertIn('guest_changed', results[0]['issues'])
+                self.assertEqual(results[0]['candidates'], prior['candidates'] if prior else [])
+                self.assertTrue(native.cached(101)['stale'])
+                with patch.object(native, 'scan', return_value=copy.deepcopy(complete)):
+                    self.assertFalse(native.discover(101)['stale'])
+        with patch.object(native, 'scan', side_effect=lambda vmid: (
+                native.mark_stale(102), copy.deepcopy(complete))[1]):
+            self.assertFalse(native.discover(101)['stale'])
+
+    def test_scan_excludes_later_updater_and_releases_lock_after_success_or_failure(self):
+        path = self.root / 'proxmenux-lxc-update-101.lock'
+        for fail in (False, True):
+            with self.subTest(fail=fail):
+                runner = self.runner()
+                probes = []
+                def checked(argv, deadline):
+                    if argv[1] == 'exec':
+                        attempt = subprocess.run(['flock', '-n', str(path), 'true'])
+                        self.assertEqual(attempt.returncode, 1)
+                        probes.append(argv)
+                        if fail:
+                            raise native.ProbeError('timeout')
+                    return runner(argv, deadline)
+                native.scan(101, checked)
+                self.assertTrue(probes)
+                self.assertEqual(subprocess.run(['flock', '-n', str(path), 'true']).returncode, 0)
+                self.assertEqual(path.read_bytes(), b'')
+
+    def test_pending_control_reservation_blocks_scan_without_touching_it(self):
+        path = self.root / 'proxmenux-lxc-update-101.lock'
+        original = b'{"task":"pending-control"}'
+        path.write_bytes(original)
+        with self.assertRaisesRegex(native.ProbeError, 'guest_busy'):
+            native.scan(101, self.runner())
+        self.assertFalse(any(call[1] == 'exec' for call in self.calls))
+        self.assertEqual(path.read_bytes(), original)
+
+    def test_guest_stop_during_scan_never_returns_complete(self):
+        runner = self.runner()
+        statuses = iter(['status: running', 'status: stopped'])
+        def stopped(argv, deadline):
+            return next(statuses) if argv[1] == 'status' else runner(argv, deadline)
+        with self.assertRaisesRegex(native.ProbeError, 'guest_stopped'):
+            native.scan(101, stopped)
+        self.assertTrue(all(call[1] == 'exec' for call in self.calls))
+
+    def test_scan_reservation_closes_race_after_guard_and_releases_after_exception(self):
+        import lxc_check_job
+        path = self.root / 'proxmenux-lxc-update-101.lock'
+        runner = self.runner()
+        handles = []
+        def starts_update(argv, deadline):
+            if argv[1] == 'status':
+                handles.append(lxc_check_job.acquire(101))
+            return runner(argv, deadline)
+        with patch.object(lxc_check_job, 'LOCK_DIR', self.root):
+            try:
+                with self.assertRaisesRegex(native.ProbeError, 'guest_busy'):
+                    native.scan(101, starts_update)
+                self.assertFalse(any(call[1] == 'exec' for call in self.calls))
+            finally:
+                for handle in handles:
+                    handle.close()
+            def crash(argv, deadline):
+                if argv[1] == 'exec':
+                    with self.assertRaises(BlockingIOError):
+                        lxc_check_job.acquire(101)
+                    # Another CT must remain available.
+                    lxc_check_job.acquire(102).close()
+                    raise RuntimeError('unexpected probe failure')
+                return runner(argv, deadline)
+            with self.assertRaisesRegex(RuntimeError, 'unexpected'):
+                native.scan(101, crash)
+            lxc_check_job.acquire(101).close()
+        self.assertEqual(path.read_bytes(), b'')
+
+    def test_failed_scan_releases_discovery_lock_and_keeps_prior_evidence(self):
+        complete = native.scan(101, self.runner())
+        native._cache[101] = copy.deepcopy(complete)
+        with patch.object(native, 'scan', side_effect=RuntimeError('unexpected')):
+            with self.assertRaises(RuntimeError):
+                native.discover(101)
+        self.assertFalse(native._locks[101].locked())
+        self.assertEqual(native.cached(101)['candidates'], complete['candidates'])
+
+    def test_invalid_lock_inode_and_unreadable_config_fail_before_any_probe(self):
+        import os
+        path = self.root / 'proxmenux-lxc-update-101.lock'
+        target = self.root / 'unrelated'
+        target.write_bytes(b'keep')
+        for kind in ('symlink', 'fifo', 'directory'):
+            with self.subTest(kind=kind):
+                if kind == 'symlink':
+                    path.symlink_to(target)
+                elif kind == 'fifo':
+                    os.mkfifo(path)
+                else:
+                    path.mkdir()
+                try:
+                    with self.assertRaisesRegex(native.ProbeError, 'lock_unavailable'):
+                        native.scan(101, self.runner())
+                    self.assertEqual(self.calls, [])
+                    self.assertEqual(target.read_bytes(), b'keep')
+                finally:
+                    path.rmdir() if kind == 'directory' else path.unlink()
+        with patch.object(Path, 'open', side_effect=PermissionError):
+            with self.assertRaisesRegex(native.ProbeError, 'config_unavailable'):
+                native.scan(101, self.runner())
+        self.assertEqual(self.calls, [])
+
+    def test_same_ct_busy_and_different_ct_cache_isolation(self):
+        lock = threading.Lock()
+        lock.acquire()
+        native._locks[101] = lock
+        with patch.object(native, 'scan') as scanner:
+            self.assertEqual(native.discover(101)['status'], 'busy')
+            scanner.assert_not_called()
+        self.assertEqual(native.cached(102)['status'], 'not_scanned')
+
+    def test_filter_registered_curated_and_docker_children_without_mutation(self):
+        result = native.scan(101, self.runner())
+        original = copy.deepcopy(result)
+        for suggestions, apps in (({}, [{'discovery_id': result['candidates'][0]['discovery_id']}]),
+                                   ({'extras': [{'name': 'Handmade'}]}, []),
+                                   ({'docker_workloads': [{'name': 'Handmade'}]}, []),
+                                   ({'helper_slug': 'handmade', 'name_suggestion': 'Handmade'}, [])):
+            self.assertEqual(native.filter_candidates(result, suggestions, apps)['candidates'], [])
+        self.assertEqual(result, original)
+
+    def test_actual_save_first_check_and_recheck_never_probe_or_configure_updater(self):
+        with patch.object(lxc_apps, '_APPS_DIR', str(self.root / 'apps')), \
+             patch.object(lxc_apps, '_pct_exec', side_effect=AssertionError('forbidden guest execution')) as execute, \
+             patch.object(lxc_apps, 'fetch_latest_upstream_details', side_effect=AssertionError('forbidden upstream')) as upstream:
+            for version in (None, '1.2.3'):
+                item = native.candidate(101, native.parse_records(service(), 'S')[0][0],
+                                        'FILE\n' + (json.dumps({'version': version}) if version else ''))
+                payload = {'name': item['name'], 'discovery_id': item['discovery_id'],
+                           'update_method': 'none', **(item['tracking_suggestion'] or {})}
+                ok, sidecar = lxc_apps.add_app(101, payload)
+                self.assertTrue(ok, sidecar)
+                app = sidecar['apps'][-1]
+                self.assertEqual(app['state']['installed_version'], version)
+                self.assertIsNone(app['state']['update_available'])
+                self.assertEqual(app['update_method'], 'none')
+                for field in ('helper_slug', 'update_command', 'repo', 'upstream_type'):
+                    self.assertNotIn(field, app)
+                lxc_apps.check_app(101, app['id'], force=True)
+            self.assertIsNone(lxc_apps.get_schedule(101))
+            self.assertIsNone(lxc_apps.get_bulk_update(101))
+            execute.assert_not_called()
+            upstream.assert_not_called()
+
+    def test_failed_save_has_no_first_check(self):
+        with patch.object(lxc_apps, '_write_sidecar', return_value=False), \
+             patch.object(lxc_apps, '_read_sidecar', return_value=None), \
+             patch.object(lxc_apps, 'check_app') as check:
+            self.assertFalse(lxc_apps.add_app(101, {'name': 'handmade'})[0])
+            check.assert_not_called()
+
+    def test_active_update_lock_blocks_all_guest_probes_without_writing(self):
+        path = self.root / 'proxmenux-lxc-update-101.lock'
+        path.write_bytes(b'unchanged')
+        with path.open('rb') as handle:
+            fcntl.flock(handle, fcntl.LOCK_EX)
+            with self.assertRaisesRegex(native.ProbeError, 'guest_busy'):
+                native.scan(101, self.runner())
+        self.assertEqual(path.read_bytes(), b'unchanged')
+        self.assertEqual(self.calls, [])
+
+    def test_actual_service_parser_reads_data_never_executes_or_sources_it(self):
+        for manager in ('systemd', 'openrc'):
+            directory = self.root / manager
+            directory.mkdir()
+            marker = self.root / ('forbidden-' + manager)
+            unit = directory / ('handmade.service' if manager == 'systemd' else 'handmade')
+            content = ('[Service]\nExecStart=/usr/bin/node /opt/handmade/server.js --password SECRET\nWorkingDirectory=/opt/handmade\n'
+                       if manager == 'systemd' else 'command="/usr/bin/node"\ncommand_args="/opt/handmade/server.js --password SECRET"\ndirectory="/opt/handmade"\n')
+            unit.write_text(content + '\ntouch ' + str(marker) + '\n')
+            script = native.SERVICE_SCRIPT.replace('/etc/systemd/system /usr/lib/systemd/system /lib/systemd/system /etc/init.d', str(directory))
+            # Substitute only fixture paths, not the collector/parser behavior.
+            if manager == 'openrc':
+                script = script.replace('/etc/init.d:*)', str(directory) + ':*)')
+            output = native.bounded_run(['sh', '-c', script], time.monotonic() + 3)
+            record, = native.parse_records(output, 'S')[0]
+            self.assertEqual(record['path'], '/opt/handmade/server.js')
+            self.assertNotIn('SECRET', output)
+            self.assertFalse(marker.exists())
+
+    def test_merged_usr_units_are_counted_once(self):
+        usr = self.root / 'usr-units'
+        usr.mkdir()
+        (usr / 'handmade.service').write_text('[Service]\nExecStart=/opt/handmade/server\n')
+        lib = self.root / 'lib-units'
+        lib.symlink_to(usr)
+        check = '[ "$dir" = /lib/systemd/system ] && [ /lib/systemd/system -ef /usr/lib/systemd/system ]'
+        self.assertIn(check, native.SERVICE_SCRIPT)
+        script = (native.SERVICE_SCRIPT
+                  .replace('/etc/systemd/system /usr/lib/systemd/system /lib/systemd/system /etc/init.d', f'{usr} {lib}')
+                  .replace(check, f'[ "$dir" = {lib} ] && [ {lib} -ef {usr} ]'))
+        output = native.bounded_run(['sh', '-c', script], time.monotonic() + 3)
+        self.assertEqual(output.count('handmade.service'), 1)
+
+    def test_a_guest_without_ss_or_netstat_has_no_listener_evidence(self):
+        bin_dir = self.root / 'no-tools'
+        bin_dir.mkdir()
+        (bin_dir / 'awk').symlink_to('/usr/bin/awk')
+        output = native.bounded_run(['sh', '-c', 'PATH=' + str(bin_dir) + '\n' + native.PORT_SCRIPT, 'fixture', '256'],
+                                    time.monotonic() + 3)
+        self.assertEqual(native.parse_records(output, 'L'), ([], False, 0))
+
+    def test_actual_process_parser_skips_docker_and_never_reads_environ_cmdline(self):
+        proc = self.root / 'proc'
+        proc.mkdir()
+        for pid, group in ((1, '0::/\n'), (2, '0::/docker/child\n')):
+            directory = proc / str(pid)
+            directory.mkdir()
+            (directory / 'cgroup').write_text(group)
+            (directory / 'exe').symlink_to('/opt/handmade/server')
+            (directory / 'cwd').symlink_to('/opt/handmade')
+            (directory / 'cmdline').write_text('SECRET')
+            (directory / 'environ').write_text('PASSWORD')
+        script = native.PROCESS_SCRIPT.replace('/proc/[0-9]*', str(proc) + '/[0-9]*')
+        output = native.bounded_run(['sh', '-c', script, 'fixture', '256'], time.monotonic() + 3)
+        self.assertEqual(output, 'P\t1\t/opt/handmade/server\t/opt/handmade\nEND\n')
+        self.assertNotIn('"$dir/cmdline"', native.PROCESS_SCRIPT)
+        self.assertNotIn('"$dir/environ"', native.PROCESS_SCRIPT)
+        self.assertNotIn('SECRET', output)
+
+    def test_ports_require_exact_process_ownership_and_do_not_infer_http(self):
+        process = 'P\t123\t/opt/handmade/server\t/opt/handmade\nEND\n'
+        result = native.scan(101, self.runner(processes=process, ports='L\t123\t8080\nL\t999\t9000\nEND\n'))
+        item, = result['candidates']
+        self.assertEqual(item['listening_ports'], [8080])
+        self.assertEqual(item['default_ports'], [], 'TCP listener does not prove HTTP')
+        result = native.scan(101, self.runner(ports='L\t123\t8080\nEND\n'))
+        self.assertEqual(result['candidates'][0]['listening_ports'], [])
+
+    def test_shared_runtime_ports_are_assigned_only_by_working_directory(self):
+        services = service(exe='/usr/bin/node', script='/opt/handmade/server.js').removesuffix('END\n')
+        services += service(name='second', exe='/usr/bin/node', script='/opt/second/server.js', directory='/opt/second')
+        process = 'P\t123\t/usr/bin/node\t/opt/second\nEND\n'
+        result = native.scan(101, self.runner(services, processes=process, ports='L\t123\t8080\nEND\n'))
+        self.assertEqual(result['candidates'][0]['listening_ports'], [])
+        self.assertEqual(result['candidates'][1]['listening_ports'], [8080])
+
+    def test_ss_and_alpine_netstat_parser_are_bounded_and_secret_free(self):
+        for tool, line in (('ss', 'LISTEN 0 128 0.0.0.0:8080 0.0.0.0:* users:(("SECRET",pid=123,fd=7))'),
+                           ('netstat', 'tcp 0 0 0.0.0.0:8080 0.0.0.0:* LISTEN 123/SECRET')):
+            bin_dir = self.root / tool
+            bin_dir.mkdir()
+            executable = bin_dir / tool
+            executable.write_text('#!/bin/sh\nprintf \'%s\\n\' \'' + line + '\'\n')
+            executable.chmod(0o755)
+            (bin_dir / 'awk').symlink_to('/usr/bin/awk')
+            (bin_dir / 'timeout').symlink_to('/usr/bin/timeout')
+            script = 'PATH=' + str(bin_dir) + '\n' + native.PORT_SCRIPT
+            output = native.bounded_run(['sh', '-c', script, 'fixture', '256'], time.monotonic() + 3)
+            self.assertEqual(output, 'L\t123\t8080\nEND\n')
+            self.assertNotIn('SECRET', output)
+            executable.write_text('#!/bin/sh\nexit 1\n')
+            output = native.bounded_run(['sh', '-c', script, 'fixture', '256'], time.monotonic() + 3)
+            with self.assertRaises(native.ProbeError):
+                native.parse_records(output, 'L')
+
+
+class BoundedRunner(unittest.TestCase):
+    def test_output_limit_is_enforced_during_read(self):
+        with self.assertRaisesRegex(native.ProbeError, 'output_limit'):
+            native.bounded_run([sys.executable, '-c', 'import os; os.write(2,b"x"*1000000)'], time.monotonic() + 3)
+
+    def test_pipe_holding_child_does_not_bypass_timeout(self):
+        start = time.monotonic()
+        with self.assertRaisesRegex(native.ProbeError, 'timeout'):
+            native.bounded_run([sys.executable, '-c', 'import os,time; os.fork(); time.sleep(10)'], start + .15)
+        self.assertLess(time.monotonic() - start, .8)
+
+    def test_failures_never_reveal_stderr_and_deadline_blocks_spawn(self):
+        with self.assertRaisesRegex(native.ProbeError, '^read_failed$'):
+            native.bounded_run([sys.executable, '-c', 'import sys; sys.stderr.write("SECRET"); sys.exit(1)'], time.monotonic() + 3)
+        with patch.object(native.subprocess, 'Popen') as launch:
+            with self.assertRaisesRegex(native.ProbeError, 'deadline'):
+                native.bounded_run(['forbidden'], time.monotonic() - 1)
+            launch.assert_not_called()
+
+
+class Routes(unittest.TestCase):
+    """Execute actual Flask route bodies; fixture auth, no server startup jobs."""
+    def setUp(self):
+        from flask import Flask, request, jsonify, g
+        self.app = Flask('native-fixture')
+        self.authorized = True
+        def require_auth(fn):
+            @wraps(fn)
+            def wrapped(*args, **kwargs):
+                if not self.authorized:
+                    return jsonify({'error': 'auth_required'}), 401
+                return fn(*args, **kwargs)
+            return wrapped
+        self.globals = {'app': self.app, 'request': request, 'jsonify': jsonify,
+                        'require_auth': require_auth, '_vm_app_suggestions_cache': {},
+                        '_VM_APP_SUGGESTIONS_TTL': 300,
+                        '_vm_cache_get': lambda cache, vmid, ttl: cache.get(vmid),
+                        '_vm_cache_put': lambda cache, vmid, value: cache.update({vmid: value}),
+                        '_pvesh_cache': {}, '_vm_disk_cache': {}, '_vm_schedule_cache': {}, '_vm_cache_invalidate': Mock(),
+                        '_invalidate_lxc_ip': Mock(), '_schedule_started_guest_refresh': Mock(),
+                        '_publish_guest_modal_cache_revision': Mock()}
+        tree = ast.parse((SCRIPTS / 'flask_server.py').read_text())
+        routes = [n for n in tree.body if isinstance(n, ast.FunctionDef) and n.name in (
+            'api_vm_apps_suggestions', 'api_vm_apps_native_discovery', 'api_vm_apps_add',
+            '_handle_guest_lifecycle')]
+        self.assertEqual(len(routes), 4)
+        exec(compile(ast.Module(body=routes, type_ignores=[]), str(SCRIPTS / 'flask_server.py'), 'exec'), self.globals)
+        self.client = self.app.test_client()
+
+    def test_explicit_post_only_get_and_existing_post_never_native_scan(self):
+        result = {'vmid': 101, 'status': 'complete', 'candidates': [], 'stale': False}
+        with patch.object(native, 'discover', return_value=result) as scan, \
+             patch.object(native, 'cached', return_value=result), \
+             patch.object(lxc_apps, 'get_suggestions', return_value={'extras': []}) as suggestions, \
+             patch.object(lxc_apps, 'load_sidecar', return_value={'apps': []}), \
+             patch.object(lxc_apps, '_write_sidecar') as write:
+            self.assertEqual(self.client.get('/api/vms/101/apps/native-discovery').status_code, 200)
+            self.client.get('/api/vms/101/apps/suggestions')
+            # OCI refresh and Find's existing catalog path retain their purpose.
+            self.client.post('/api/vms/101/apps/suggestions')
+            with self.app.test_request_context('/api/vms/101/apps/suggestions'):
+                from flask import g
+                g._internal_call = True
+                self.globals['_vm_app_suggestions_cache'].clear()
+                self.globals['api_vm_apps_suggestions'](101)
+            scan.assert_not_called()
+            self.client.post('/api/vms/101/apps/native-discovery')
+            scan.assert_called_once_with(101)
+            self.assertEqual(suggestions.call_count, 2)
+            write.assert_not_called()
+
+    def test_unauthorized_and_wrong_method_have_zero_scans(self):
+        with patch.object(native, 'discover') as scan, patch.object(lxc_apps, 'load_sidecar') as read:
+            self.authorized = False
+            self.assertEqual(self.client.post('/api/vms/101/apps/native-discovery').status_code, 401)
+            self.assertEqual(self.client.put('/api/vms/101/apps/native-discovery').status_code, 405)
+            scan.assert_not_called()
+            read.assert_not_called()
+
+    def test_actual_lifecycle_marks_last_known_stale_without_scanning(self):
+        native._cache[101] = {'vmid': 101, 'status': 'complete', 'stale': False,
+                              'candidates': [], 'scanned_at': time.time()}
+        with patch.object(native, 'discover') as scan, \
+             patch.object(lxc_apps, 'clear_schedule_reboot_required') as clear:
+            for action in ('start', 'reboot', 'stop'):
+                self.globals['_handle_guest_lifecycle']('101', 'lxc', action)
+                self.assertTrue(native.cached(101)['stale'])
+            scan.assert_not_called()
+            self.assertEqual(clear.call_count, 2)
+
+    def test_actual_repeated_prewarmer_has_zero_native_scans(self):
+        tree = ast.parse((SCRIPTS / 'flask_server.py').read_text())
+        warmer = next(node for node in tree.body if isinstance(node, ast.FunctionDef)
+                      and node.name == '_vm_modal_prewarmer_pass')
+        environment = dict(self.globals)
+        for name in ('_vm_details_cache', '_vm_backups_cache', '_vm_schedule_cache', '_vm_mounts_cache'):
+            environment[name] = {}
+        for name in ('_VM_DETAILS_TTL', '_VM_BACKUPS_TTL', '_VM_SCHEDULE_TTL', '_VM_MOUNTS_TTL'):
+            environment[name] = 300
+        for name in ('get_vm_config', 'api_vm_backups', 'api_vm_apps_schedule', 'api_lxc_mount_points'):
+            environment[name] = lambda vmid: None
+        environment.update({'get_cached_pvesh_cluster_resources_vm': lambda: [
+            {'vmid': 101, 'type': 'lxc', 'status': 'running'}], 'time': Mock(), 'sys': sys})
+        exec(compile(ast.Module(body=[warmer], type_ignores=[]), 'flask_server.py', 'exec'), environment)
+        with patch.object(native, 'discover') as scan, \
+             patch.object(lxc_apps, 'ensure_oci_registration'), \
+             patch.object(lxc_apps, 'load_sidecar', return_value={'apps': []}), \
+             patch.object(lxc_apps, 'get_suggestions', return_value={'extras': []}):
+            for _ in range(2):
+                environment['_vm_app_suggestions_cache'].clear()
+                self.assertEqual(environment['_vm_modal_prewarmer_pass'](), 1)
+            scan.assert_not_called()
+
+
+if __name__ == '__main__':
+    unittest.main()
diff --git a/AppImage/scripts/tests/test_pbs.py b/AppImage/scripts/tests/test_pbs.py
new file mode 100644
index 00000000..878debc7
--- /dev/null
+++ b/AppImage/scripts/tests/test_pbs.py
@@ -0,0 +1,289 @@
+"""PBS platform, HTTPS protocol, authorization and isolated AppImage regressions."""
+
+import ast
+from datetime import datetime, timedelta, timezone
+import hashlib
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+import ipaddress
+import json
+from pathlib import Path
+import shlex
+import ssl
+import subprocess
+import sys
+import tempfile
+import threading
+from types import SimpleNamespace
+import unittest
+from unittest import mock
+
+ROOT = Path(__file__).resolve().parents[3]
+sys.path.insert(0, str(ROOT / "AppImage/scripts"))
+
+from cryptography import x509
+from cryptography.hazmat.primitives import hashes, serialization
+from cryptography.hazmat.primitives.asymmetric import rsa
+from cryptography.x509.oid import NameOID
+from flask import Flask
+import jwt
+import auth_manager
+import pbs_manager as pbs
+from flask_pbs_routes import pbs_bp
+
+
+class PlatformTests(unittest.TestCase):
+    def test_supported_platforms_and_partial_dpkg_failure(self):
+        module = pbs.detect_platform.__globals__
+        with tempfile.TemporaryDirectory() as directory:
+            release = Path(directory) / "os-release"
+            for package, version, suite, product in (
+                ("pve-manager", "8.4.15", "bookworm", "pve"),
+                ("pve-manager", "9.2.1", "trixie", "pve"),
+                ("proxmox-backup-server", "3.4.0-1", "bookworm", "pbs"),
+                ("proxmox-backup-server", "4.2.5-1", "trixie", "pbs"),
+            ):
+                release.write_text(f'VERSION_CODENAME="{suite}"\n')
+                output = f"{package}\tinstall ok installed\t{version}\n"
+                with self.subTest(product=product, version=version), \
+                        mock.patch.dict(module, {"OS_RELEASE": release}), \
+                        mock.patch.object(subprocess, "run", return_value=SimpleNamespace(stdout=output, returncode=1)):
+                    detected = pbs.detect_platform()
+                self.assertEqual(detected["product"], product)
+                self.assertEqual(detected["version"], version)
+                self.assertTrue(detected["supported"])
+
+    def test_client_only_and_removed_server_are_not_pbs(self):
+        for output in ("proxmox-backup-client\tinstall ok installed\t4.2.5\n",
+                       "proxmox-backup-server\tdeinstall ok config-files\t4.2.5\n", ""):
+            with self.subTest(output=output), mock.patch.object(subprocess, "run", return_value=SimpleNamespace(stdout=output)):
+                self.assertEqual(pbs.detect_platform()["product"], "unknown")
+
+    def test_pbs_utilities_preserve_sources_and_never_call_pve_policy(self):
+        helper = ROOT / "scripts/global/repository-functions.sh"
+        for supported in (True, False):
+            harness = f'''
+source {shlex.quote(str(helper))}
+pmx_platform_field() {{ if [[ "$1" == product ]]; then echo pbs; else echo {str(supported).lower()}; fi; }}
+msg_info() {{ :; }}
+msg_error() {{ :; }}
+translate() {{ printf '%s' "$1"; }}
+pveversion() {{ echo 'FORBIDDEN: pveversion'; return 90; }}
+repository_policy() {{ echo 'FORBIDDEN: repository mutation'; return 90; }}
+apt-get() {{ echo 'FORBIDDEN: apt'; return 90; }}
+ensure_repositories
+'''
+            result = subprocess.run(["bash"], input=harness, text=True, capture_output=True)
+            self.assertNotIn("FORBIDDEN", result.stdout + result.stderr)
+            self.assertEqual(result.returncode, 0 if supported else 1)
+
+
+class PBSManagerTests(unittest.TestCase):
+    def setUp(self):
+        temporary = tempfile.TemporaryDirectory()
+        self.addCleanup(temporary.cleanup)
+        self.root = Path(temporary.name)
+        patch = mock.patch.multiple(auth_manager, CONFIG_DIR=self.root, AUTH_CONFIG_FILE=self.root / "auth.json")
+        patch.start(); self.addCleanup(patch.stop)
+        auth_manager.save_auth_config({"enabled": True, "username": "admin", "password_hash": "configured",
+                                       "jwt_secret": "s" * 48, "api_tokens": [], "revoked_tokens": []})
+        auth_manager._invalidate_revoked_cache()
+        pbs._status_cache.clear()
+        self.server = {"name": "Backup", "url": "https://pbs.test:8007", "token_id": "audit@pbs!monitor",
+                       "token_secret": "fixture-token-secret", "fingerprint": "a" * 64}
+        app = Flask(__name__); app.register_blueprint(pbs_bp)
+        self.client = app.test_client()
+        self.headers = {"Authorization": "Bearer " + auth_manager.generate_token("admin")}
+
+    def test_save_redacts_secret_and_probes_authenticated_endpoint(self):
+        with mock.patch.object(pbs, "_remote_get", return_value=[]) as request:
+            identifier = pbs.save_server(self.server)
+            request.assert_called_once()
+            self.assertEqual(request.call_args.args[1], "/status/datastore-usage")
+        self.assertEqual((self.root / "pbs_servers.json").stat().st_mode & 0o777, 0o600)
+        public = pbs.public_servers()
+        self.assertEqual(public[0]["id"], identifier)
+        self.assertNotIn("fixture-token-secret", json.dumps(public))
+        self.assertTrue(public[0]["has_token"])
+        with mock.patch.object(pbs, "_remote_get", return_value=[]):
+            pbs.save_server({"id": identifier, "name": "Renamed"})
+        self.assertEqual(pbs._load_servers()[0]["token_secret"], "fixture-token-secret")
+        pbs.delete_server(identifier)
+        self.assertEqual(pbs.public_servers(), [])
+
+    def test_failed_credentials_or_invalid_config_do_not_replace_saved_connection(self):
+        with mock.patch.object(pbs, "_remote_get", return_value=[]):
+            identifier = pbs.save_server(self.server)
+        original = (self.root / "pbs_servers.json").read_bytes()
+        with mock.patch.object(pbs, "_remote_get", side_effect=pbs.PBSError("Rejected token")):
+            with self.assertRaises(pbs.PBSError):
+                pbs.save_server({**self.server, "id": identifier, "token_secret": "wrong"})
+        for changes in ({"url": "http://pbs.test"}, {"url": "https://user:pass@pbs.test"},
+                        {"fingerprint": "bad-pin"}, {"token_id": "not-a-token"},
+                        {"token_secret": "line\nbreak"}):
+            with self.subTest(changes=changes), self.assertRaises(pbs.PBSError):
+                pbs.save_server({**self.server, **changes, "id": identifier})
+        self.assertEqual((self.root / "pbs_servers.json").read_bytes(), original)
+
+    def test_remote_partial_failure_is_unknown_instead_of_zero(self):
+        def remote(server, endpoint):
+            if endpoint == "/version": return {"version": "4.2.5"}
+            if endpoint == "/status/datastore-usage": return [{"store": "backup", "total": 100, "used": 30, "avail": 70}]
+            if endpoint == "/admin/verify": raise pbs.PBSError("Permission denied")
+            return []
+        with mock.patch.object(pbs, "_remote_get", side_effect=remote) as request:
+            identifier = pbs.save_server(self.server)
+            result = pbs.get_status(identifier)
+            count = request.call_count
+            self.assertEqual(pbs.get_status(identifier), result)
+            self.assertEqual(request.call_count, count)
+        self.assertEqual(result["datastores"][0]["name"], "backup")
+        self.assertIsNone(result["verify"])
+        self.assertIn("verify", result["errors"])
+
+    def test_unmounted_removable_datastore_has_no_fabricated_capacity(self):
+        with mock.patch.object(pbs, "_cli", return_value=[{"name": "removable", "path": "/not-mounted", "backing-device": "uuid"}]), \
+                mock.patch.object(pbs.os.path, "ismount", return_value=False), \
+                mock.patch.object(pbs.shutil, "disk_usage") as usage:
+            result = pbs._local_datastores()
+        usage.assert_not_called()
+        self.assertIsNone(result[0]["total"])
+        self.assertIn("error", result[0])
+
+    def test_local_status_reads_pbs_commands_and_filesystem_capacity(self):
+        def run(command, **kwargs):
+            self.assertNotIn("shell", kwargs)
+            self.assertEqual(command[0], "proxmox-backup-manager")
+            self.assertEqual(command[-2:], ["--output-format", "json"])
+            data = [{"name": "backup", "path": str(self.root)}] if command[1:3] == ["datastore", "list"] else []
+            return SimpleNamespace(stdout=json.dumps(data), returncode=0)
+        with mock.patch.object(pbs, "get_platform", return_value={"product": "pbs", "version": "4.2.5"}), \
+                mock.patch.object(pbs, "_local_services", return_value={key: "active" for key in pbs.PBS_SERVICES}), \
+                mock.patch.object(pbs.subprocess, "run", side_effect=run), \
+                mock.patch.object(pbs.shutil, "disk_usage", return_value=SimpleNamespace(total=100, used=30, free=70)):
+            result = pbs.get_status("local")
+        self.assertEqual(result["version"], "4.2.5")
+        self.assertEqual(result["errors"], {})
+        self.assertEqual(result["datastores"][0]["used"], 30)
+        self.assertEqual(set(result["services"]), set(pbs.PBS_SERVICES))
+
+    def test_connection_api_requires_full_admin_and_does_not_return_secret(self):
+        self.assertEqual(self.client.get("/api/pbs/servers").status_code, 401)
+        with mock.patch.object(pbs, "_remote_get", return_value=[]):
+            response = self.client.post("/api/pbs/servers", headers=self.headers, json=self.server)
+        self.assertEqual(response.status_code, 200)
+        self.assertNotIn("fixture-token-secret", response.text)
+        payload = jwt.decode(self.headers["Authorization"].split()[1], "s" * 48,
+                             algorithms=["HS256"], audience=auth_manager.JWT_AUDIENCE)
+        payload["scope"] = "read_only"
+        read_only = {"Authorization": "Bearer " + jwt.encode(payload, "s" * 48, algorithm="HS256")}
+        self.assertEqual(self.client.post("/api/pbs/servers", headers=read_only, json=self.server).status_code, 403)
+        self.assertEqual(self.client.get("/api/pbs/servers", headers=read_only).status_code, 200)
+        auth_manager.save_auth_config({"enabled": False})
+        self.assertEqual(self.client.post("/api/pbs/servers", json=self.server).status_code, 409)
+
+    def test_health_uses_pbs_services_and_skips_pve_only_checks(self):
+        source = ast.parse((ROOT / "AppImage/scripts/health_monitor.py").read_text())
+        names = ("_check_pve_services", "_check_vms_cts_optimized", "_check_vms_cts_with_persistence",
+                 "_check_proxmox_storages", "_check_proxmox_storage", "_check_lxc_disk_usage",
+                 "_check_vm_disk_usage", "_check_lxc_mount_capacity", "_check_pve_storage_capacity")
+        functions = [node for node in ast.walk(source) if isinstance(node, ast.FunctionDef) and node.name in names]
+        persistence = mock.Mock(); persistence.is_error_active.return_value = False
+        run = mock.Mock(return_value=SimpleNamespace(returncode=0, stdout="active\n"))
+        namespace = {"Dict": dict, "Any": object, "Optional": __import__('typing').Optional,
+                     "PBS_SERVICES": pbs.PBS_SERVICES, "health_persistence": persistence,
+                     "subprocess": SimpleNamespace(run=run), "os": __import__('os')}
+        exec(compile(ast.Module(body=functions, type_ignores=[]), '<health-pbs-test>', 'exec'), namespace)
+        instance = SimpleNamespace(platform_type="pbs", PVE_SERVICES=["pveproxy", "pvedaemon", "pvestatd", "pve-cluster"])
+        services = namespace["_check_pve_services"](instance)
+        self.assertEqual(services["status"], "OK")
+        self.assertEqual([call.args[0][2] for call in run.call_args_list], list(pbs.PBS_SERVICES))
+        for name in names[1:]:
+            result = namespace[name](instance)
+            self.assertTrue(result is None or result.get("not_applicable"))
+
+    def test_appimage_copies_and_imports_pbs_dependencies_outside_source_tree(self):
+        builder = (ROOT / "AppImage/scripts/build_appimage.sh").read_text()
+        modules = ("pbs_manager", "flask_pbs_routes", "auth_manager", "jwt_middleware")
+        copies = []
+        for name in modules:
+            matches = [line for line in builder.splitlines() if line.startswith(f'cp "$SCRIPT_DIR/{name}.py"')]
+            self.assertEqual(len(matches), 1, name)
+            copies.extend(matches)
+        copies.extend(line for line in builder.splitlines() if line.startswith('cp "$APPIMAGE_ROOT/../scripts/global/proxmox_platform.py"'))
+        self.assertEqual(len(copies), len(modules) + 1)
+        app = self.root / 'AppDir'; (app / 'usr/bin').mkdir(parents=True)
+        q = shlex.quote
+        shell = f'APP_DIR={q(str(app))}\nSCRIPT_DIR={q(str(ROOT / "AppImage/scripts"))}\nAPPIMAGE_ROOT={q(str(ROOT / "AppImage"))}\n' + '\n'.join(copies)
+        subprocess.run(['bash', '-e', '-c', shell], check=True)
+        code = f'import sys; sys.path.insert(0, {str(app / "usr/bin")!r}); import pbs_manager, flask_pbs_routes, proxmox_platform'
+        subprocess.run([sys.executable, '-I', '-B', '-c', code], cwd=self.root, check=True, capture_output=True)
+
+
+class TLSTests(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls):
+        cls.temporary = tempfile.TemporaryDirectory()
+        root = Path(cls.temporary.name)
+        key = rsa.generate_private_key(public_exponent=65537, key_size=2048)
+        subject = x509.Name([x509.NameAttribute(NameOID.COMMON_NAME, "localhost")])
+        certificate = (x509.CertificateBuilder().subject_name(subject).issuer_name(subject).public_key(key.public_key())
+                       .serial_number(x509.random_serial_number()).not_valid_before(datetime.now(timezone.utc) - timedelta(minutes=1))
+                       .not_valid_after(datetime.now(timezone.utc) + timedelta(hours=1))
+                       .add_extension(x509.SubjectAlternativeName([x509.IPAddress(ipaddress.ip_address("127.0.0.1"))]), critical=False)
+                       .sign(key, hashes.SHA256()))
+        cert_path, key_path = root / 'server.pem', root / 'server.key'
+        cert_path.write_bytes(certificate.public_bytes(serialization.Encoding.PEM))
+        key_path.write_bytes(key.private_bytes(serialization.Encoding.PEM, serialization.PrivateFormat.PKCS8, serialization.NoEncryption()))
+        cls.fingerprint = hashlib.sha256(certificate.public_bytes(serialization.Encoding.DER)).hexdigest()
+        cls.requests = []
+        cls.response_status = 200
+
+        class Handler(BaseHTTPRequestHandler):
+            def handle(self):
+                try:
+                    super().handle()
+                except ConnectionResetError:
+                    pass  # A rejected TLS pin closes before any HTTP request.
+
+            def do_GET(self):
+                cls.requests.append((self.path, self.headers.get("Authorization")))
+                body = json.dumps({"data": []}).encode()
+                self.send_response(cls.response_status)
+                self.send_header('Content-Length', str(len(body)))
+                self.end_headers(); self.wfile.write(body)
+
+            def log_message(self, *args): pass
+
+        cls.server = ThreadingHTTPServer(('127.0.0.1', 0), Handler)
+        context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER); context.load_cert_chain(cert_path, key_path)
+        cls.server.socket = context.wrap_socket(cls.server.socket, server_side=True)
+        cls.thread = threading.Thread(target=cls.server.serve_forever, daemon=True); cls.thread.start()
+
+    @classmethod
+    def tearDownClass(cls):
+        cls.server.shutdown(); cls.server.server_close(); cls.thread.join(timeout=5); cls.temporary.cleanup()
+
+    def setUp(self):
+        self.requests.clear(); type(self).response_status = 200
+        self.connection = {"url": f'https://127.0.0.1:{self.server.server_port}',
+                           "fingerprint": self.fingerprint, "token_id": "audit@pbs!monitor", "token_secret": "fake-secret"}
+
+    def test_real_tls_matching_pin_sends_correct_pbs_authorization(self):
+        self.assertEqual(pbs._remote_get(self.connection, '/status/datastore-usage'), [])
+        self.assertEqual(self.requests, [('/api2/json/status/datastore-usage', 'PBSAPIToken=audit@pbs!monitor:fake-secret')])
+
+    def test_bad_pin_and_untrusted_ca_send_no_http_credentials(self):
+        for fingerprint in ('0' * 64, ''):
+            with self.subTest(fingerprint=fingerprint), self.assertRaises(pbs.PBSError):
+                pbs._remote_get({**self.connection, "fingerprint": fingerprint}, '/status/datastore-usage')
+            self.assertEqual(self.requests, [])
+
+    def test_bad_credentials_and_redirects_are_rejected(self):
+        for status in (401, 403, 302):
+            type(self).response_status = status
+            with self.subTest(status=status), self.assertRaises(pbs.PBSError):
+                pbs._remote_get(self.connection, '/status/datastore-usage')
+
+
+if __name__ == '__main__':
+    unittest.main()
diff --git a/AppImage/scripts/tests/test_remote_mount_dismissal.py b/AppImage/scripts/tests/test_remote_mount_dismissal.py
new file mode 100644
index 00000000..c66ccf17
--- /dev/null
+++ b/AppImage/scripts/tests/test_remote_mount_dismissal.py
@@ -0,0 +1,67 @@
+"""Remote mount checks carry the key their dismissal is saved under."""
+import sys
+import unittest
+from pathlib import Path
+from types import ModuleType, SimpleNamespace
+from unittest.mock import patch
+
+SCRIPTS_DIR = Path(__file__).resolve().parents[1]
+if str(SCRIPTS_DIR) not in sys.path:
+    sys.path.insert(0, str(SCRIPTS_DIR))
+
+_health_persistence_module = ModuleType("health_persistence")
+_health_persistence_module.health_persistence = SimpleNamespace(cleanup_old_errors=lambda: None)
+_health_persistence_module.disk_base_name = lambda name: str(name).replace("/dev/", "")
+sys.modules.setdefault("health_persistence", _health_persistence_module)
+sys.modules.setdefault("psutil", ModuleType("psutil"))
+sys.modules.setdefault("flask_server", SimpleNamespace(
+    get_proxmox_node_name=lambda: "fixture",
+    get_cached_pvesh_cluster_resources_vm=lambda: [],
+    get_cached_vm_disk=lambda _vmid: None,
+))
+
+import health_monitor  # noqa: E402
+
+
+class _Persistence:
+    def __init__(self):
+        self.recorded = []
+
+    def record_error(self, **kwargs):
+        self.recorded.append(kwargs)
+
+    def get_active_errors(self, *args, **kwargs):
+        return []
+
+    def clear_error(self, key):
+        pass
+
+
+class RemoteMountDismissal(unittest.TestCase):
+    def check(self, host, lxc=()):
+        persistence = _Persistence()
+        mounts = SimpleNamespace(scan_remote_mounts=lambda force: list(host),
+                                 scan_lxc_mounts=lambda force: list(lxc))
+        with patch.object(health_monitor, "MOUNT_MONITOR_AVAILABLE", True), \
+                patch.object(health_monitor, "mount_monitor", mounts, create=True), \
+                patch.object(health_monitor, "health_persistence", persistence):
+            result = health_monitor.HealthMonitor._check_remote_mounts(SimpleNamespace())
+        return result, persistence
+
+    def test_stale_and_read_only_mounts_carry_their_saved_key(self):
+        result, persistence = self.check(
+            [{"target": "/mnt/pve/nas", "status": "stale", "fstype": "nfs4"},
+             {"target": "/mnt/share", "status": "ok", "fstype": "cifs"}],
+            [{"target": "/media", "status": "readonly", "fstype": "nfs4", "lxc_id": "120", "lxc_name": "app"}])
+        checks = result["checks"]
+        self.assertEqual(checks["/mnt/pve/nas"]["error_key"], "mount_stale_/mnt/pve/nas")
+        self.assertEqual(checks["CT 120 (app) /media"]["error_key"], "mount_readonly_ct120:/media")
+        self.assertTrue(checks["/mnt/pve/nas"]["dismissable"])
+        self.assertTrue(checks["CT 120 (app) /media"]["dismissable"])
+        self.assertNotIn("error_key", checks["/mnt/share"])
+        self.assertEqual({entry["error_key"] for entry in persistence.recorded},
+                         {"mount_stale_/mnt/pve/nas", "mount_readonly_ct120:/media"})
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/AppImage/tests/pbs-navigation.cjs b/AppImage/tests/pbs-navigation.cjs
new file mode 100644
index 00000000..418cc32b
--- /dev/null
+++ b/AppImage/tests/pbs-navigation.cjs
@@ -0,0 +1,69 @@
+const assert = require('node:assert/strict')
+const fs = require('node:fs')
+const path = require('node:path')
+const vm = require('node:vm')
+const ts = require('typescript')
+const source = fs.readFileSync(path.join(__dirname, '../components/proxmox-dashboard.tsx'), 'utf8')
+const tree = ts.createSourceFile('dashboard.tsx', source, ts.ScriptTarget.Latest, true, ts.ScriptKind.TSX)
+const wrapper = tree.statements.find(node => ts.isFunctionDeclaration(node) && node.name?.text === 'ProxmoxDashboard')
+assert.ok(wrapper, 'platform gate must remain separate from PVE hooks/prewarmers')
+const code = ts.transpileModule(ts.createPrinter().printNode(ts.EmitHint.Unspecified, wrapper, tree), {
+  compilerOptions: { module: ts.ModuleKind.CommonJS, jsx: ts.JsxEmit.ReactJSX },
+}).outputText
+const PBS = () => {}, PVE = () => {}
+for (const [data, error, expected] of [
+  [{ product: 'pbs' }, null, PBS], [{ product: 'pve' }, null, PVE],
+  [undefined, new Error('older API'), PVE], [undefined, null, 'p'],
+]) {
+  const sandbox = {
+    exports: {}, PBSDashboard: PBS, PVEDashboard: PVE,
+    useT: () => key => key, useSWR: () => ({ data, error }),
+    require: () => ({ jsx: (type, props) => ({ type, props }) }),
+  }
+  vm.runInNewContext(code, sandbox)
+  assert.equal(sandbox.exports.ProxmoxDashboard().type, expected)
+}
+console.log('PASS: PBS dashboard routing and loading gate do not mount PVE prewarmers')
+
+// The PVE Backup tab keeps native guest retention alongside jobs when adding
+// its PBS connection view. Exercise the shipped JSX for all three selections.
+const backupSource = fs.readFileSync(path.join(__dirname, '../components/backup-tab.tsx'), 'utf8')
+const backupTree = ts.createSourceFile('backup-tab.tsx', backupSource, ts.ScriptTarget.Latest, true, ts.ScriptKind.TSX)
+const backupTab = backupTree.statements.find(node => ts.isFunctionDeclaration(node) && node.name?.text === 'BackupTab')
+assert.ok(backupTab, 'Backup tab must keep a platform-specific view switch')
+const backupCode = ts.transpileModule(ts.createPrinter().printNode(ts.EmitHint.Unspecified, backupTab, backupTree), {
+  compilerOptions: { module: ts.ModuleKind.CommonJS, jsx: ts.JsxEmit.ReactJSX },
+}).outputText
+const HostBackup = () => {}, VmBackupJobs = () => {}, BackupStorageRetention = () => {}, PBSPanel = () => {}
+for (const [view, expected] of [
+  ['host', [HostBackup]], ['guests', [VmBackupJobs, BackupStorageRetention]], ['pbs', [PBSPanel]],
+]) {
+  const selected = []
+  const sandbox = {
+    exports: {}, HostBackup, VmBackupJobs, BackupStorageRetention, PBSPanel, DatabaseBackup: () => {},
+    useT: () => key => key, useState: () => [view, value => selected.push(value)],
+    require: () => ({ jsx: (type, props) => ({ type, props }), jsxs: (type, props) => ({ type, props }), Fragment: Symbol('Fragment') }),
+  }
+  vm.runInNewContext(backupCode, sandbox)
+  const visible = [], mountedHosts = [], buttons = []
+  const components = new Set([HostBackup, VmBackupJobs, BackupStorageRetention, PBSPanel])
+  function walk(node, hidden = false) {
+    if (Array.isArray(node)) { node.forEach(item => walk(item, hidden)); return }
+    if (!node || typeof node !== 'object') return
+    hidden ||= node.props?.className === 'hidden'
+    if (node.type === HostBackup) mountedHosts.push(node)
+    if (components.has(node.type) && !hidden) visible.push(node.type)
+    if (node.type === 'button') buttons.push(node)
+    walk(node.props?.children, hidden)
+  }
+  walk(sandbox.exports.BackupTab())
+  assert.deepEqual(visible, expected, `visible backup panels for ${view}`)
+  assert.equal(mountedHosts.length, 1, 'host backup progress must stay mounted across view changes')
+  assert.equal(buttons.length, 3)
+  assert.equal(buttons.filter(button => button.props['aria-pressed']).length, 1)
+  const pbsButton = buttons.find(button => button.props.children === 'pbs.title')
+  assert.ok(pbsButton, 'PBS navigation button must exist')
+  pbsButton.props.onClick()
+  assert.deepEqual(selected, ['pbs'])
+}
+console.log('PASS: host progress stays mounted, guest jobs and retention stay together, and PBS navigation remains separate')
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index aab13a74..6e645e4d 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -818,7 +818,7 @@ Note that the dev server has no Flask backend on the same host by default: the a
 
 ### Testing
 
-#### Offline i18n script tests
+#### Offline script regressions (including i18n)
 
 From the repository root, run the complete script suite:
 
@@ -836,6 +836,14 @@ It does not launch React or require `npm install`, `pip install`, a Proxmox host
 API keys, or a translation provider. Generator tests use isolated temporary
 catalogs and fake/forbidden providers; repository catalogs are not regenerated.
 
+The command-description recovery regression first completes disposable copies
+of the shipped catalogs with the real generator and a deterministic offline
+provider, then requires a second run to make zero provider calls and zero
+writes. It checks that all existing nonempty translations and the frozen
+command-description arrays survive unchanged. A synthetic EN-only feature tests
+new nested strings, arrays, placeholders and non-text values. New message keys
+do not need to be added to a test-specific translation seed list.
+
 Scheduler fixtures discover every shipped `lang/*.json` cache and run the actual
 `translate` lookup at both empty-job consumers for PBS and local archive backends.
 They accept English fallback for missing/empty entries; complete translations are
@@ -859,12 +867,17 @@ than silently skipping the consumer assertions. `.github/workflows/test-i18n.yml
 provisions Python and Node and runs this same command on relevant pull requests
 and main/develop pushes (or manually). It is separate from the translation
 publication workflow and has read-only repository permissions.
+Its Actions name is **Offline script regressions** because it also covers menus,
+downloads, scheduler behavior and other scripts. The `offline-i18n` check ID is
+retained for compatibility with existing branch protection rules; a failure of
+that check is not necessarily a translation failure. Read its failing test name
+and traceback before changing catalogs or translation-provider settings.
 
 #### Qualified offline `tests/` CI lanes
 
 `.github/workflows/test-offline-qualified.yml` runs **only** the explicitly listed
-nine Python files (including the inert active-notification payload fixture and
-the focused health recurrence tests) and eleven
+ten Python files (including the native discovery fixtures, the inert active-notification payload fixture and
+the focused health recurrence tests) and twelve
 Node files in `.github/scripts/run_offline_qualified.py`.
 The Python runner gives each test file a private temporary directory through
 `TMPDIR`. It removes that directory after the test file finishes.
@@ -887,7 +900,7 @@ dangling symlink) rather than overwrite or reuse it. In Bash:
 )
 ```
 
-Requires Python 3.11, Node 22.14, npm and Bash/coreutils for the bounded shell
+Requires Python 3.11, Flask 3.x for the native route fixtures, Node 22.14, npm and Bash/coreutils for the bounded shell
 fixtures. The separate lockfile installs only TypeScript, React, React DOM,
 Lucide icons and the locked scheduler dependency; it does not build the Monitor
 or run npm lifecycle scripts. `--legacy-peer-deps` admits the existing Lucide
diff --git a/docs/pbs.md b/docs/pbs.md
new file mode 100644
index 00000000..542f0472
--- /dev/null
+++ b/docs/pbs.md
@@ -0,0 +1,66 @@
+# Proxmox Backup Server support
+
+ProxMenux detects PBS from the installed **proxmox-backup-server** package.
+Installing proxmox-backup-client on PVE or another Debian system does not turn
+that host into PBS. Supported maintenance platforms are PBS 3/Debian 12 and
+PBS 4/Debian 13; PVE 8/9 detection remains separate. If both server products
+are co-installed, PVE takes precedence.
+
+## On a PBS host
+
+The main CLI opens a PBS menu with package/version information, datastores,
+recent tasks, the existing system-utility installer, settings and a PBS package
+update. Utility installation preserves the operator's APT sources instead of
+trying to find a PVE version or enabling PVE/Ceph repositories. Configure a
+working subscription or no-subscription PBS repository in PBS itself if APT
+reports an error.
+
+The update refreshes configured indexes, displays the simulated full-upgrade
+plan and requires confirmation before applying it. It does not run PVE repository
+cleanup, major-version migration, kernel cleanup or guest scripts. The automatic
+and customizable PVE post-install entry points reject PBS before adjustments.
+
+Monitor opens a PBS dashboard with CPU, RAM, uptime, local PBS status,
+datastores, recent tasks and maintenance schedules, plus logs, terminal and
+Monitor authentication/HTTPS settings. PVE guest prewarmers, firewall controls
+and guest-storage checks are not part of this dashboard. Health checks monitor
+proxmox-backup and proxmox-backup-proxy rather than reporting absent PVE daemons.
+Monitor can reuse the native PBS proxy.pem/proxy.key pair, including renewal.
+
+Local data is read with proxmox-backup-manager JSON commands. Datastore capacity
+is filesystem capacity, not the logical sum of backups; datastores sharing one
+filesystem can show the same capacity. An unmounted removable datastore or a
+failed check has unknown capacity, not zero/free space.
+
+## Monitor a remote PBS from PVE
+
+Open **Backup → Proxmox Backup Server → Manage PBS connections**. Enable local
+Monitor authentication first, then add a named HTTPS endpoint (for example
+https://pbs.example:8007), a dedicated API token ID (`user@pbs!monitor`) and its
+secret. Give both the user and token the PBS **Audit** role on `/`, with
+propagation, to view system tasks and datastore status. Token ACLs cannot exceed
+the user's effective permissions. A restricted token may show only its permitted
+data; denied sections are displayed as unavailable.
+
+Use a CA-trusted certificate or copy the certificate's SHA256 fingerprint from
+the PBS console/a trusted channel. With a pin, Monitor checks the peer certificate
+before sending the token. With no pin, the normal system CA and hostname checks
+apply. Connections go directly to the configured HTTPS endpoint and do not follow
+redirects. A reverse-proxy prefix is supported; omit the port for HTTPS 443 or
+include the native PBS port explicitly.
+
+Saving tests an authenticated datastore-status endpoint. Secrets are stored
+atomically with mode 0600 in `~/.config/proxmenux-monitor/pbs_servers.json`, never
+returned by the API, and retained when the edit form's secret is left empty.
+Connection changes require full administrator access; read-only Monitor API tokens
+can read monitoring data but cannot change connections. Removing a connection
+removes its saved credentials only. Monitoring does not start prune, garbage
+collection, verification or sync jobs and does not modify PBS backups.
+
+Status is cached for 15 seconds and the panel refreshes every 30 seconds. Task or
+schedule permission failures are shown independently, without hiding successful
+datastore data or presenting failed queries as empty healthy results.
+
+References: [PBS command syntax](https://pbs.proxmox.com/docs/command-syntax.html),
+[PBS API](https://pbs.proxmox.com/docs/api-viewer/index.html),
+[PBS users, tokens and ACLs](https://pbs.proxmox.com/docs/user-management.html).
diff --git a/install_proxmenux.sh b/install_proxmenux.sh
index e2aee65a..5d2975cd 100755
--- a/install_proxmenux.sh
+++ b/install_proxmenux.sh
@@ -21,7 +21,7 @@
 #     • whiptail (interactive terminal menus)
 #     • curl (downloads and connectivity checks)
 #     • jq (JSON parsing)
-#     • Python 3 + venv (for translation support)
+# - Installs pre-generated JSON language catalogs (no translation runtime).
 # - Creates the ProxMenux base directories and configuration files:
 #     • $BASE_DIR/config.json
 #     • $BASE_DIR/cache.json
@@ -396,7 +396,8 @@ select_language() {
         "de" "German" \
         "it" "Italian" \
         "pt" "Portuguese" \
-        "sk" "Slovenčina" 3>&1 1>&2 2>&3)
+        "sk" "Slovenčina" \
+        "sv" "Svenska" 3>&1 1>&2 2>&3)
     
     if [ -z "$LANGUAGE" ]; then
         msg_error "No language selected. Exiting."
diff --git a/install_proxmenux_beta.sh b/install_proxmenux_beta.sh
index 90022cd2..225b3502 100644
--- a/install_proxmenux_beta.sh
+++ b/install_proxmenux_beta.sh
@@ -594,7 +594,8 @@ select_language() {
         "de" "German" \
         "it" "Italian" \
         "pt" "Portuguese" \
-        "sk" "Slovenčina" 3>&1 1>&2 2>&3)
+        "sk" "Slovenčina" \
+        "sv" "Svenska" 3>&1 1>&2 2>&3)
 
     if [ -z "$LANGUAGE" ]; then
         msg_error "No language selected. Exiting."
diff --git a/lang/de.json b/lang/de.json
index 9c79eb57..e81d7622 100644
--- a/lang/de.json
+++ b/lang/de.json
@@ -37,6 +37,7 @@
   "/var/lib/vz/dump   (Proxmox default vzdump path)": "/var/lib/vz/dump (Proxmox-Standard-vzdump-Pfad)",
   "/var/lib/vz/dump   (Proxmox default)": "/var/lib/vz/dump (Proxmox-Standard)",
   "1777 = sticky bit + rwx for all. No shared group needed.": "1777 = Sticky Bit + RWX für alle. Keine gemeinsame Gruppe erforderlich.",
+  "====== PBS UPDATE COMPLETED ======": "====== PBS-UPDATE ABGESCHLOSSEN ======",
   "====== PVE UPDATE COMPLETED ======": "====== PVE-UPDATE ABGESCHLOSSEN ======",
   ">> Create a new backup job <<": ">> Einen neuen Sicherungsauftrag erstellen <<",
   ">> Save and return <<": ">> Speichern und zurück <<",
@@ -87,6 +88,7 @@
   "A multi-container application is not recreated: its containers are updated together.": "Eine Multi-Container-Anwendung wird nicht neu erstellt: Ihre Container werden zusammen aktualisiert.",
   "A new ProxMenux version is available:": "Eine neue ProxMenux-Version ist verfügbar:",
   "A new kernel is staged for the next boot:": "Ein neuer Kernel wird für den nächsten Start bereitgestellt:",
+  "A newer kernel is installed. Reboot before the next backup window to use it.": "Ein neuerer Kernel ist installiert. Starten Sie vor dem nächsten Backup-Fenster einen Neustart, um es zu verwenden.",
   "A newer version is available:": "Eine neuere Version ist verfügbar:",
   "A pending operation exists for": "Eine ausstehende operation existiert für",
   "A pending stack assembly already exists; it is not overwritten": "Eine ausstehende Stapelanordnung existiert bereits; sie wird nicht überschrieben",
@@ -169,6 +171,8 @@
   "APT language configuration updated": "APT-Sprachkonfiguration aktualisiert",
   "APT language downloads restored": "APT-Sprachdownloads wiederhergestellt",
   "APT package lists updated": "APT-Paketlisten aktualisiert",
+  "APT refresh failed. Check the PBS subscription and repositories in Administration > Repositories. Log:": "APT-Aktualisierung fehlgeschlagen. Überprüfen Sie das PBS-Abonnement und die Repositorys unter Administration > Repositorys. Protokoll:",
+  "APT refresh failed. Check the PBS subscription and repositories in the native PBS interface; no source was changed.": "APT-Aktualisierung fehlgeschlagen. Prüfen Sie das PBS-Abonnement und die Repositories in der nativen PBS-Oberfläche; es wurden keine Paketquellen geändert.",
   "APT update failed. Check repository access; NVIDIA installation stopped.": "APT-Update fehlgeschlagen. Überprüfen Sie den Repository-Zugriff. Die Installation von NVIDIA wurde gestoppt.",
   "Aborted": "Abgebrochen",
   "About to restore": "Wird gerade wiederhergestellt",
@@ -425,6 +429,7 @@
   "Apply": "Anwenden",
   "Apply AMD CPU fixes": "AMD-CPU-Korrekturen anwenden",
   "Apply Available Updates": "Verfügbare Updates anwenden",
+  "Apply PBS package upgrade": "PBS-Paketaktualisierung anwenden",
   "Apply and restart services:": "Dienste anwenden und neu starten:",
   "Apply available updates": "Verfügbare Updates anwenden",
   "Apply boot/initramfs changes": "Übernehmen Sie Boot-/Initramfs-Änderungen",
@@ -438,12 +443,15 @@
   "Apply options from the current catalog template? New required paths and settings may be requested. Review the resulting configuration before recreating the CT.": "Optionen aus der aktuellen Katalogvorlage anwenden? Es können neue erforderliche Pfade und Einstellungen angefordert werden. Überprüfen Sie die resultierende Konfiguration, bevor Sie CT neu erstellen.",
   "Apply read+write access for 'others' on the host directory?": "Lese- und Schreibzugriff für „Andere“ auf das Hostverzeichnis anwenden?",
   "Apply the options from the current catalog template? Your data and configuration are kept.": "Wenden Sie die Optionen aus der aktuellen Katalogvorlage an? Ihre Daten und Konfiguration werden gespeichert.",
+  "Apply the reviewed package upgrade now? Services may restart and packages listed for removal will be removed.": "Die geprüfte Paketaktualisierung jetzt anwenden? Dienste können neu starten und zur Entfernung aufgeführte Pakete werden entfernt.",
   "Apply these changes?": "Diese Änderungen anwenden?",
   "Applying AMD-specific fixes...": "Anwenden von AMD-spezifischen Korrekturen...",
+  "Applying CPU and RAM changes without rebuilding the container...": "CPU- und RAM-Änderungen werden ohne Neuerstellung des Containers angewendet...",
   "Applying Changes": "Anwenden von Änderungen",
   "Applying Controller/NVMe passthrough to VM": "Anwenden von Controller/NVMe-Passthrough auf die VM",
   "Applying balanced memory optimization settings...": "Ausgewogene Einstellungen zur Speicheroptimierung werden angewendet...",
   "Applying changes safely...": "Änderungen sicher anwenden...",
+  "Applying container settings without rebuilding the container...": "Containereinstellungen werden ohne Neuerstellung des Containers angewendet...",
   "Applying custom restore": "Benutzerdefinierte Wiederherstellung anwenden",
   "Applying default VM configuration": "Anwenden der Standard-VM-Konfiguration",
   "Applying host permissions for unprivileged LXC bind-mounts...": "Anwenden von Hostberechtigungen für nicht privilegierte LXC-Bind-Mounts ...",
@@ -535,6 +543,7 @@
   "Available Borg targets:": "Verfügbare Borg-Ziele:",
   "Available Disks on Host": "Verfügbare Festplatten auf dem Host",
   "Available ISO Images": "Verfügbare ISO-Images",
+  "Available PBS Version": "Verfügbare PBS-Version",
   "Available PBS repositories:": "Verfügbare PBS-Repositories:",
   "Available PVE Version": "Verfügbare PVE-Version",
   "Available Shares:": "Verfügbare Aktien:",
@@ -746,6 +755,7 @@
   "Cannot verify the reused disk:": "Kann die wiederverwendete Festplatte nicht überprüfen:",
   "Cannot write the image archive to {storage}. Check storage access and mount status.": "Das Bildarchiv kann nicht in {storage} geschrieben werden. Überprüfen Sie den Speicherzugriff und den Bereitstellungsstatus.",
   "Capabilities cannot be kept and all dropped at the same time": "Fähigkeiten können nicht gehalten werden und alle gleichzeitig fallen gelassen werden",
+  "Catalog options": "Katalogoptionen",
   "Category": "Kategorie",
   "Caution: Maximum mode generates more heat.": "Achtung: Im Maximalmodus entsteht mehr Wärme.",
   "Ceph check skipped by user flag (--ignore-ceph-check)": "Ceph-Prüfung durch Benutzerflag übersprungen (--ignore-ceph-check)",
@@ -880,6 +890,7 @@
   "Choose a schedule (systemd calendar-event syntax):": "Wählen Sie einen Zeitplan (systemd-Kalender-Ereignis-Syntax):",
   "Choose a script to execute:": "Wählen Sie ein auszuführendes Skript aus:",
   "Choose a server:": "Wählen Sie einen Server:",
+  "Choose a setting. Changes are applied only after the final review.": "Wähle eine Einstellung. Änderungen werden erst nach der abschließenden Prüfung angewendet.",
   "Choose a share to mount:": "Wählen Sie eine Freigabe zum Mounten aus:",
   "Choose a specific supported GPU or USB node": "Wählen Sie einen bestimmten unterstützten GPU- oder USB-Knoten aus",
   "Choose action for this controller/NVMe:": "Wählen Sie eine Aktion für diesen Controller/NVMe:",
@@ -960,6 +971,7 @@
   "Code-server is VS Code running on a remote server, accessible through the browser.": "Code-Server ist VS Code, der auf einem entfernten Server läuft und über den Browser zugänglich ist.",
   "CodeProject.AI Server": "CodeProject. AI Server",
   "Command": "Befehl",
+  "Command failed": "Befehl fehlgeschlagen",
   "Command override for an unknown service:": "Command Override für einen unbekannten Dienst:",
   "Commenting any residual Bookworm lines in *.list...": "Kommentieren aller verbleibenden Bookworm-Zeilen in *.list...",
   "Commenting legacy PVE 8 repository .list files (if any)...": "Kommentieren älterer PVE 8-Repository-.list-Dateien (falls vorhanden) ...",
@@ -1516,6 +1528,7 @@
   "Current NVIDIA inventory resolved: a refresh is required": "Aktuelles NVIDIA-Inventar behoben: ein Refresh ist required",
   "Current NVIDIA inventory resolved: no refresh is required": "Aktuelles NVIDIA-Inventar behoben: kein Refresh ist required",
   "Current Network Configuration": "Aktuelle Netzwerkkonfiguration",
+  "Current PBS Version": "Aktuelle PBS-Version",
   "Current PVE Version": "Aktuelle PVE-Version",
   "Current ProxMenux host scripts register remote shares as Proxmox storages using pvesm.": "Aktuelle ProxMenux-Hostskripte registrieren Remote-Freigaben mithilfe von pvesm als Proxmox-Speicher.",
   "Current ProxMenux version:": "Aktuelle ProxMenux-Version:",
@@ -1630,8 +1643,8 @@
   "Default Proxmox logo applied": "Standardmäßiges Proxmox-Logo angewendet",
   "Default is none (video-only passthrough). Use SPACE to toggle selections.": "Der Standardwert ist „Keine“ (nur Video-Passthrough). Verwenden Sie die LEERTASTE, um die Auswahl umzuschalten.",
   "Default journald configuration restored": "Standard-Journald-Konfiguration wiederhergestellt",
-  "Default location is /mnt/<name>. The share will be mounted here on the host with open permissions so an unprivileged LXC can bind-mount and write to it. For LXC access, bind-mount this path with the LXC Mount Manager.": "Der Standardspeicherort ist /mnt/<Name>. Die Freigabe wird hier auf dem Host mit offenen Berechtigungen gemountet, sodass ein unprivilegierter LXC sie binden, mounten und darauf schreiben kann. Für den LXC-Zugriff müssen Sie diesen Pfad mit dem LXC Mount Manager binden.",
-  "Default location is /mnt/<name>. The share will be mounted here on the host. Use this path in /etc/fstab. For LXC access, bind-mount this path with the LXC Mount Manager.": "Der Standardspeicherort ist /mnt/<Name>. Die Freigabe wird hier auf dem Host gemountet. Verwenden Sie diesen Pfad in /etc/fstab. Für den LXC-Zugriff müssen Sie diesen Pfad mit dem LXC Mount Manager binden.",
+  "Default location is /mnt/<name>. The share will be mounted here on the host with open permissions so an unprivileged LXC can bind-mount and write to it. For LXC access, bind-mount this path with the LXC Mount Manager.": "Der Standardspeicherort ist /mnt/<name>. Die Freigabe wird hier auf dem Host mit offenen Berechtigungen eingehängt, sodass ein unprivilegierter LXC sie per Bind-Mount einbinden und darauf schreiben kann. Verwenden Sie dafür den LXC Mount Manager.",
+  "Default location is /mnt/<name>. The share will be mounted here on the host. Use this path in /etc/fstab. For LXC access, bind-mount this path with the LXC Mount Manager.": "Der Standardspeicherort ist /mnt/<name>. Die Freigabe wird hier auf dem Host eingehängt. Verwenden Sie diesen Pfad in /etc/fstab. Für den Zugriff aus einem LXC binden Sie ihn mit dem LXC Mount Manager als Bind-Mount ein.",
   "Default login": "Standard-Login",
   "Default options": "Standardoptionen",
   "Default options read/write": "Standardoptionen Lesen/Schreiben",
@@ -1681,6 +1694,7 @@
   "Detected Coral hardware:": "Erkannte Coral-Hardware:",
   "Detected GPU(s):": "Erkannte GPU(s):",
   "Detected Intel CPU": "Intel-CPU erkannt",
+  "Detected Proxmox Backup Server": "Proxmox Backup Server erkannt",
   "Detected Proxmox VE": "Proxmox VE erkannt",
   "Detected Proxmox VE 8.x - Installing Ceph Squid for Debian": "Proxmox VE 8.x erkannt – Ceph Squid für Debian installieren",
   "Detected Proxmox VE 9.x - Installing Ceph Squid for Debian Trixie": "Proxmox VE 9.x erkannt – Ceph Squid für Debian Trixie installieren",
@@ -1762,6 +1776,9 @@
   "Disabling and stopping rpcbind service and socket...": "Rpcbind-Dienst und Socket deaktivieren und stoppen ...",
   "Disabling non-free firmware warnings...": "Warnungen zu nicht kostenloser Firmware werden deaktiviert...",
   "Disabling portmapper/rpcbind for security...": "Portmapper/rpcbind wird aus Sicherheitsgründen deaktiviert...",
+  "Discard changes": "Änderungen verwerfen",
+  "Discard unapplied changes?": "Noch nicht angewendete Änderungen verwerfen?",
+  "Discover NFS exports on a server": "NFS-Exporte eines Servers ermitteln",
   "Discover targets on portal:": "Entdecken Sie Ziele auf dem Portal:",
   "Discovering iSCSI targets...": "iSCSI-Ziele werden ermittelt...",
   "Discovery successful": "Entdeckung erfolgreich",
@@ -1841,6 +1858,7 @@
   "Do you want to proceed with the system update?": "Möchten Sie mit der Systemaktualisierung fortfahren?",
   "Do you want to proceed?": "Möchten Sie fortfahren?",
   "Do you want to reboot now?": "Möchten Sie jetzt neu starten?",
+  "Do you want to remove the Proxmox subscription banner from the Proxmox Backup Server web interface?": "Möchten Sie das Proxmox-Abonnementbanner von der Proxmox Backup Server-Weboberfläche entfernen?",
   "Do you want to remove the stale entry from vfio.conf and continue?": "Möchten Sie den veralteten Eintrag aus vfio.conf entfernen und fortfahren?",
   "Do you want to remove the stale entry from vfio.conf?": "Möchten Sie den veralteten Eintrag aus vfio.conf entfernen?",
   "Do you want to restart the network service now to apply changes?": "Möchten Sie den Netzwerkdienst jetzt neu starten, um die Änderungen zu übernehmen?",
@@ -2018,7 +2036,7 @@
   "Enter VM ID:": "Geben Sie die VM-ID ein:",
   "Enter VM/CT ID:": "Geben Sie die VM/CT-ID ein:",
   "Enter ZFS pool name for the selected disk:": "Geben Sie den ZFS-Poolnamen für die ausgewählte Festplatte ein:",
-  "Enter a name for the mount point (used as /mnt/<name>):": "Geben Sie einen Namen für den Mount-Punkt ein (verwendet als /mnt/<Name>):",
+  "Enter a name for the mount point (used as /mnt/<name>):": "Geben Sie einen Namen für den Mountpoint ein (wird als /mnt/<name> verwendet):",
   "Enter a name for the new virtual machine:": "Geben Sie einen Namen für die neue virtuelle Maschine ein:",
   "Enter a non-empty password or access token on a single line.": "Geben Sie in einer einzelnen Zeile ein nicht leeres Passwort oder Zugriffstoken ein.",
   "Enter a number, or write or paste a command:": "Geben Sie eine Zahl ein oder schreiben oder fügen Sie einen Befehl ein:",
@@ -2166,7 +2184,7 @@
   "Example: pct stop 110": "Beispiel: pct stop 110",
   "Example: pct stop 114": "Beispiel: pct stop 114",
   "Example: pvesm add nfs nfs-nas --server 192.168.1.50 --export /volume1/proxmox --content import,backup": "Beispiel: pvesm add nfs nfs-nas --server 192.168.1.50 --export /volume1/proxmox --content import,backup",
-  "Example: pvesm path local-lvm:vm-114-disk-0": "Beispiel: pvesm-Pfad local-lvm:vm-114-disk-0",
+  "Example: pvesm path local-lvm:vm-114-disk-0": "Beispiel: pvesm path local-lvm:vm-114-disk-0",
   "Example: sed -i '/^unprivileged: 1/d' /etc/pve/lxc/110.conf": "Beispiel: sed -i '/^unprivileged: 1/d' /etc/pve/lxc/110.conf",
   "Examples:": "Beispiele:",
   "Execute destructive rollback?": "Destruktives Rollback ausführen?",
@@ -2266,6 +2284,7 @@
   "Failed to clone log2ram repository. Check /tmp/log2ram_install.log": "Das Klonen des log2ram-Repositorys ist fehlgeschlagen. Überprüfen Sie /tmp/log2ram_install.log",
   "Failed to configure EFI disk": "Die EFI-Festplatte konnte nicht konfiguriert werden",
   "Failed to configure IOMMU automatically.": "IOMMU konnte nicht automatisch konfiguriert werden.",
+  "Failed to configure Proxmox Backup Server repositories": "Proxmox Backup Server-Repositorys konnten nicht konfiguriert werden",
   "Failed to configure Proxmox repositories": "Proxmox-Repositorys konnten nicht konfiguriert werden",
   "Failed to configure TPM device in VM": "Das TPM-Gerät konnte in der VM nicht konfiguriert werden",
   "Failed to configure repositories.": "Die Repositorys konnten nicht konfiguriert werden.",
@@ -2477,7 +2496,7 @@
   "For a consistent export, the VM should be stopped.": "Für einen konsistenten Export sollte die VM gestoppt werden.",
   "For any question, issue or bug report, please use the official repository": "Für Fragen, Probleme oder Fehlerberichte nutzen Sie bitte das offizielle Repository",
   "For dedicated GPUs, FLR is required by this policy to reduce VM": "Für dedizierte GPUs ist gemäß dieser Richtlinie FLR erforderlich, um VM zu reduzieren",
-  "For example: pct enter 101": "Beispiel: pct Geben Sie 101 ein",
+  "For example: pct enter 101": "Zum Beispiel: pct enter 101",
   "For guest shares add: --options guest": "Für Gastfreigaben hinzufügen: --options Guest",
   "For security reasons, the system cannot format it.": "Aus Sicherheitsgründen kann das System es nicht formatieren.",
   "For unprivileged containers, use instead:": "Verwenden Sie für nichtprivilegierte Container stattdessen:",
@@ -2889,8 +2908,8 @@
   "If notifications are enabled (Telegram/Discord/ntfy/...), you will receive a \"Host restore finished\" message when all background tasks complete.": "Wenn Benachrichtigungen aktiviert sind (Telegram/Discord/ntfy/...), erhalten Sie die Meldung „Host-Wiederherstellung abgeschlossen“, wenn alle Hintergrundaufgaben abgeschlossen sind.",
   "If passthrough fails on Windows: install RadeonResetBugFix.": "Wenn Passthrough unter Windows fehlschlägt: Installieren Sie RadeonResetBugFix.",
   "If path not accessible (ZFS/BTRFS):": "Wenn der Pfad nicht zugänglich ist (ZFS/BTRFS):",
-  "If pvesm path returned a DEVICE (LVM):": "Wenn der pvesm-Pfad ein GERÄT (LVM) zurückgegeben hat:",
-  "If pvesm path returned a DIRECTORY (ZFS/BTRFS):": "Wenn der pvesm-Pfad ein VERZEICHNIS (ZFS/BTRFS) zurückgegeben hat:",
+  "If pvesm path returned a DEVICE (LVM):": "Wenn pvesm path ein GERÄT (LVM) zurückgegeben hat:",
+  "If pvesm path returned a DIRECTORY (ZFS/BTRFS):": "Wenn pvesm path ein VERZEICHNIS (ZFS/BTRFS) zurückgegeben hat:",
   "If repositories error:": "Bei Repository-Fehler:",
   "If the container had already been changed, its previous native backup is restored. Shared host directories are not reverted. The disks of the failed attempt are removed when the cleanup succeeds.": "Wenn der Container bereits geändert wurde, wird sein vorheriges natives Backup wiederhergestellt. Freigegebene Hostverzeichnisse werden nicht zurückgesetzt. Die Festplatten des fehlgeschlagenen Versuchs werden entfernt, wenn die Bereinigung erfolgreich ist.",
   "If the host freezes, remove hostpci entries from": "Wenn der Host einfriert, entfernen Sie die Hostpci-Einträge aus",
@@ -2973,6 +2992,7 @@
   "Inaccessible device during VM startup": "Während des VM-Starts ist kein Zugriff auf das Gerät möglich",
   "Inactive": "Inaktiv",
   "Inactive (entry in fstab, not currently mounted)": "Inaktiv (Eintrag in fstab, derzeit nicht gemountet)",
+  "Include these changes in oci-compose?": "Diese Änderungen in oci-compose einschließen?",
   "Include these resources in oci-compose?": "Diese Ressourcen in oci-compose einschließen?",
   "Includes /etc/network (may drop SSH immediately)": "Enthält /etc/network (kann SSH sofort löschen)",
   "Includes /etc/zfs": "Enthält /etc/zfs",
@@ -3206,9 +3226,11 @@
   "Interrupted operation:": "Unterbrochene operation:",
   "Interrupted stack operation found": "Unterbrochener Stapel operation gefunden",
   "Invalid 'proxmox-ve' candidate (not 9.x or none). Please verify your repository configuration and network, then retry.": "Ungültiger „proxmox-ve“-Kandidat (nicht 9.x oder keiner). Bitte überprüfen Sie Ihre Repository-Konfiguration und Ihr Netzwerk und versuchen Sie es dann erneut.",
-  "Invalid ALLOWED_HOSTS value": "Wert für ungültig ALLOWED HOSTs",
+  "Invalid ALLOWED_HOSTS value": "Ungültiger Wert für ALLOWED_HOSTS",
   "Invalid Home Assistant OS check timeout": "Invalid Home Assistant OS Check Timeout",
   "Invalid ID": "Ungültige ID",
+  "Invalid IPv4 address": "Ungültige IPv4-Adresse",
+  "Invalid IPv4 gateway": "Ungültiges IPv4-Gateway",
   "Invalid Intel render path": "Ungültiger Intel-Renderpfad",
   "Invalid Jellyfin path:": "Ungültige Jellyfin-Strecke:",
   "Invalid MAC address:": "Ungültige MAC-Adresse:",
@@ -3241,6 +3263,7 @@
   "Invalid administrator email": "E-Mail des ungültigen Administrators",
   "Invalid administrator user name": "Ungültiger Administrator Benutzername",
   "Invalid base VMID": "Ungültige Basis VMID",
+  "Invalid bridge": "Ungültige Bridge",
   "Invalid check package:": "Ungültiges Kontrollpaket:",
   "Invalid configuration path:": "Ungültiger Konfigurationspfad:",
   "Invalid consume/export volumes": "Ungültige Verbrauchs-/Ausfuhrmengen",
@@ -3304,6 +3327,7 @@
   "Invalid remote name": "Name der ungültigen Fernbedienung",
   "Invalid remote path": "Ungültiger Fernpfad",
   "Invalid repair version:": "Ungültige Reparaturversion:",
+  "Invalid resource value": "Ungültiger Ressourcenwert",
   "Invalid resources": "Ungültige Mittel",
   "Invalid restored volume path": "Ungültiger wiederhergestellter Volumenpfad",
   "Invalid running state": "Invaliditätsstatus",
@@ -3322,6 +3346,7 @@
   "Invalid stack members": "Ungültige Stapelmitglieder",
   "Invalid stack name": "Name des ungültigen Stacks",
   "Invalid stack operation": "Ungültiger Stapel operation",
+  "Invalid storage": "Ungültiger Speicher",
   "Invalid storage ID. Use only letters, numbers, hyphens and underscores.": "Ungültige Speicher-ID. Verwenden Sie nur Buchstaben, Zahlen, Bindestriche und Unterstriche.",
   "Invalid storage name": "Ungültiger Speichername",
   "Invalid suite application": "Anwendung ungültiger Suiten",
@@ -3436,7 +3461,7 @@
   "Keyfile removed.": "Schlüsseldatei entfernt.",
   "Keyrings method failed; trying apt-key fallback": "Keyrings-Methode fehlgeschlagen; Ich versuche einen Apt-Key-Fallback",
   "KiCad - A Cross Platform and Open Source Electronics Design Automation Suite.": "KiCad - Eine Cross-Plattform und Open Source Electronics Design Automation Suite.",
-  "Kimai has no default account. Enter the container with: pct enter {main_vmid}": "Kimai hat kein Standardkonto. Geben Sie den Container ein mit: pct enter {main vmid}",
+  "Kimai has no default account. Enter the container with: pct enter {main_vmid}": "Kimai hat kein Standardkonto. Öffnen Sie eine Shell im Container mit: pct enter {main_vmid}",
   "Kimai is a professional grade time-tracking application, free and open-source.": "Kimai ist eine professionelle Time-Tracking-Anwendung, kostenlos und Open-Source.",
   "Kometa is a powerful tool designed to give you complete control over your media libraries. With Kometa, you can take your customization to the next level, with granular control over metadata, collections, overlays, and much more.": "Kometa ist ein leistungsstarkes Tool, das Ihnen die vollständige Kontrolle über Ihre Medienbibliotheken gibt. Mit Kometa können Sie Ihre Anpassung auf die nächste Ebene bringen, mit granularer Kontrolle über Metadaten, Sammlungen, Overlays und vielem mehr.",
   "Kometa reads its configuration from /config/config.yml and the container only ships /config/config.yml.template. Copy the template to config.yml, fill in the required Plex and TMDb connections, then restart the container.": "Kometa liest seine Konfiguration aus /config/config.yml und der Container liefert nur /config/config.yml.template. Kopieren Sie die Vorlage auf config.yml, füllen Sie die required Plex und TMDb-Verbindungen aus und starten Sie dann den Container neu.",
@@ -3507,7 +3532,7 @@
   "Limiting size and optimizing journald": "Begrenzung der Größe und Optimierung des Journals",
   "Limiting size and optimizing journald...": "Größe begrenzen und Journal optimieren...",
   "Limnoria A robust, full-featured, and user/programmer-friendly Python IRC bot, with many existing plugins. Successor of the well-known Supybot.": "Limnoria Ein robuster, voll ausgestatteter und benutzerfreundlicher Python IRC-Bot mit vielen vorhandenen Plugins. Nachfolger des bekannten Supybot.",
-  "Limnoria joins no IRC network until its configuration file exists. Create it with the setup wizard from the Proxmox host: pct exec <CTID> -- bash -c 'cd /config && limnoria-wizard'": "Limnoria schließt sich keinem IRC-Netzwerk an, bis seine Konfigurationsdatei existiert. Erstellen Sie es mit dem Setup-Assistenten aus dem Proxmox-Host: pct exec <CTID> - bash -c 'cd /config & & limnoria-Wizard'",
+  "Limnoria joins no IRC network until its configuration file exists. Create it with the setup wizard from the Proxmox host: pct exec <CTID> -- bash -c 'cd /config && limnoria-wizard'": "Limnoria verbindet sich erst mit einem IRC-Netzwerk, wenn die Konfigurationsdatei existiert. Erstellen Sie sie mit dem Einrichtungsassistenten auf dem Proxmox-Host: pct exec <CTID> -- bash -c 'cd /config && limnoria-wizard'",
   "Line to paste (single line, including \"command=...\" prefix):": "Einzufügende Zeile (einzelne Zeile, einschließlich „command=…“-Präfix):",
   "Linux Installation Options": "Linux-Installationsoptionen",
   "Linux/Mac path:": "Linux/Mac-Pfad:",
@@ -4153,6 +4178,7 @@
   "No active Proxmox storage accepts OCI template archives.": "Kein aktiver Proxmox-Speicher akzeptiert OCI-Vorlagenarchive.",
   "No active exports or showmount not available": "Keine aktiven Exporte oder Showmount nicht verfügbar",
   "No active session": "Keine aktive Sitzung",
+  "No active subscription and no usable PBS repository. Noninteractive mode cannot change APT sources; configure them in Administration > Repositories.": "Kein aktives Abonnement und kein verwendbares PBS-Repository. Im nicht interaktiven Modus können APT-Quellen nicht geändert werden. Konfigurieren Sie sie unter Administration > Repositorys.",
   "No active subscription and no usable PVE repository. Noninteractive mode cannot change APT sources; configure them in Node > Updates > Repositories.": "Kein aktives Abonnement und kein nutzbares PVE-Repository. Im nicht interaktiven Modus können APT-Quellen nicht geändert werden. Konfigurieren Sie sie unter Knoten > Updates > Repositorys.",
   "No additional GPU can be added.": "Es kann keine zusätzliche GPU hinzugefügt werden.",
   "No additional device needs to be added.": "Es muss kein zusätzliches Gerät hinzugefügt werden.",
@@ -4238,7 +4264,7 @@
   "No jobs": "Keine Jobs",
   "No language selected.": "Keine Sprache ausgewählt.",
   "No local disk storage configured.": "Kein lokaler Festplattenspeicher konfiguriert.",
-  "No main sources.list present (skipped)": "Keine Hauptquellenliste vorhanden (übersprungen)",
+  "No main sources.list present (skipped)": "Keine zentrale sources.list vorhanden (übersprungen)",
   "No matches for:": "Keine Treffer für:",
   "No matching PVE vzdump jobs were found for the PBS backend.": "Für das PBS-Backend wurden keine passenden PVE-vzdump-Jobs gefunden.",
   "No matching PVE vzdump jobs were found for the local archive backend.": "Für das lokale Archiv-Backend wurden keine passenden PVE-vzdump-Jobs gefunden.",
@@ -4257,6 +4283,7 @@
   "No password provided.": "Kein Passwort angegeben.",
   "No paths available": "Keine Pfade verfügbar",
   "No paths selected. Select at least one path.": "Keine Pfade ausgewählt. Wählen Sie mindestens einen Pfad aus.",
+  "No pending changes": "Keine ausstehenden Änderungen",
   "No pending paths to schedule for reboot.": "Keine ausstehenden Pfade zum Planen eines Neustarts.",
   "No permanent NFS mounts configured.": "Keine permanenten NFS-Mounts konfiguriert.",
   "No permanent Samba mounts configured.": "Keine permanenten Samba-Mounts konfiguriert.",
@@ -4398,6 +4425,7 @@
   "OVH RTM removed (Puppet artefacts may need manual cleanup)": "OVH RTM entfernt (Marionettenartefakte müssen möglicherweise manuell bereinigt werden)",
   "OVH server detected": "OVH-Server erkannt",
   "OVH server detection and RTM installation process completed": "OVH-Servererkennung und RTM-Installationsprozess abgeschlossen",
+  "Object detector": "Objekterkennung",
   "Object detector for Frigate": "Objektdetektor für Frigate",
   "Observer is not responding on port 4357": "Beobachter reagiert nicht auf Port 4357",
   "Obsidian is a note-taking app that lets you create, link, and organize your notes on your device, with hundreds of plugins and themes to customize your workflow. You can also publish your notes online, access them offline, and sync them securely with end-to-end encryption.": "Obsidian ist eine Notiz-App, mit der Sie Ihre Notizen auf Ihrem Gerät erstellen, verknüpfen und organisieren können, mit Hunderten von Plugins und Themes, um Ihren Workflow anzupassen. Sie können Ihre Notizen auch online veröffentlichen, offline darauf zugreifen und sie sicher mit einer End-to-End-Verschlüsselung synchronisieren.",
@@ -4523,11 +4551,17 @@
   "PBS backup error log": "PBS-Backup-Fehlerprotokoll",
   "PBS backup failed.": "PBS-Sicherung fehlgeschlagen.",
   "PBS certificate": "PBS-Zertifikat",
+  "PBS datastores": "PBS-Datenspeicher",
   "PBS encryption keyfile (show / replace / remove)": "PBS-Verschlüsselungsschlüsseldatei (anzeigen/ersetzen/entfernen)",
   "PBS encryption keyfile — detailed info": "PBS-Verschlüsselungsschlüsseldatei – detaillierte Informationen",
   "PBS extraction failed": "Die PBS-Extraktion ist fehlgeschlagen",
   "PBS host or IP address:": "PBS-Host oder IP-Adresse:",
+  "PBS package update": "PBS-Paketaktualisierung",
+  "PBS package upgrade completed. Check whether a reboot is required before your next backup window.": "PBS-Paketaktualisierung abgeschlossen. Prüfen Sie vor dem nächsten Sicherungszeitfenster, ob ein Neustart erforderlich ist.",
+  "PBS package upgrade failed. Review the APT output before retrying.": "PBS-Paketaktualisierung fehlgeschlagen. Prüfen Sie vor einem erneuten Versuch die APT-Ausgabe.",
   "PBS upload": "PBS-Upload",
+  "PBS version and packages": "PBS-Version und Pakete",
+  "PBS: using the configured APT repositories without changing sources.": "PBS: Die konfigurierten APT-Repositories werden verwendet, ohne die Paketquellen zu ändern.",
   "PCI Address": "PCI-Adresse",
   "PCI passthrough, TPM state, cloud-init configuration, Proxmox hooks": "PCI-Passthrough, TPM-Status, Cloud-Init-Konfiguration, Proxmox-Hooks",
   "PCI passthrough, TPM state, cloud-init, snapshots, Proxmox-specific hooks": "PCI-Passthrough, TPM-Status, Cloud-Init, Snapshots, Proxmox-spezifische Hooks",
@@ -4864,12 +4898,17 @@
   "Proxmology logo applied": "Proxmology-Logo angewendet",
   "Proxmox 9 system update allready": "Proxmox 9 Systemupdate bereits",
   "Proxmox APT repositories configured": "Proxmox APT-Repositorys konfiguriert",
+  "Proxmox Backup Server": "Proxmox Backup Server",
   "Proxmox Backup Server (PBS) destinations": "Proxmox Backup Server (PBS)-Ziele",
+  "Proxmox Backup Server APT repositories configured": "Proxmox Backup Server APT-Repositorys konfiguriert",
+  "Proxmox Backup Server Update": "Aktualisierung von Proxmox Backup Server",
+  "Proxmox Backup Server update completed.": "Aktualisierung von Proxmox Backup Server abgeschlossen.",
   "Proxmox CIFS Storage Status:": "Proxmox CIFS-Speicherstatus:",
   "Proxmox NFS Storage Status:": "Proxmox NFS-Speicherstatus:",
   "Proxmox System Update": "Proxmox-Systemupdate",
   "Proxmox Update": "Proxmox-Update",
   "Proxmox VE": "Proxmox VE",
+  "Proxmox VE 8 package upgrade failed. Review the APT output before retrying.": "Die Paketaktualisierung von Proxmox VE 8 ist fehlgeschlagen. Prüfen Sie die APT-Ausgabe, bevor Sie es erneut versuchen.",
   "Proxmox VE 8 system update completed successfully": "Proxmox VE 8 Systemupdate erfolgreich abgeschlossen",
   "Proxmox VE 8 to 9 Manual Upgrade Guide": "Manuelles Upgrade-Handbuch für Proxmox VE 8 auf 9",
   "Proxmox VE 9.x no-subscription repository created": "Proxmox VE 9.x No-Subscription-Repository erstellt",
@@ -4877,6 +4916,7 @@
   "Proxmox VE configuration completed.": "Proxmox VE-Konfiguration abgeschlossen.",
   "Proxmox VE safe update completed": "Sicheres Proxmox VE-Update abgeschlossen",
   "Proxmox auth logger service created and started": "Proxmox-Auth-Logger-Dienst erstellt und gestartet",
+  "Proxmox could not apply the container settings": "Proxmox konnte die Containereinstellungen nicht anwenden",
   "Proxmox enterprise repo might be missing or inaccessible. Trying to switch to no-subscription...": "Das Proxmox-Enterprise-Repository fehlt möglicherweise oder ist nicht zugänglich. Ich versuche, auf kein Abonnement umzustellen...",
   "Proxmox filter configured": "Proxmox-Filter konfiguriert",
   "Proxmox iSCSI Storage Status:": "Proxmox iSCSI-Speicherstatus:",
@@ -4993,6 +5033,7 @@
   "Rebuilding initramfs to apply nouveau blacklist before installation...": "Initramfs neu erstellen, um vor der Installation die Nouveau-Blacklist anzuwenden ...",
   "Rebuilding the container and recovering it from its backup are tested on the same image; the first update to a newer image is still to be observed.": "Die Neuerstellung des Containers und die Wiederherstellung aus seinem Backup werden auf demselben Image getestet. Das erste Update auf ein neueres Image steht noch aus.",
   "Recent": "Jüngste",
+  "Recent PBS tasks": "Letzte PBS-Aufgaben",
   "Recent Samba Servers": "Aktuelle Samba-Server",
   "Recent Samba server": "Aktueller Samba-Server",
   "Recent logs:": "Aktuelle Protokolle:",
@@ -5052,6 +5093,7 @@
   "Recreation completed. Data kept.": "Erholung abgeschlossen. Vorgehaltene Daten.",
   "Recreation prepared": "Erholung vorbereitet",
   "Refresh APT index and verify repositories:": "APT-Index aktualisieren und Repositorys überprüfen:",
+  "Refresh the configured APT repositories and review the PBS package upgrade? Repository files will be preserved.": "Die konfigurierten APT-Repositories aktualisieren und die PBS-Paketaktualisierung prüfen? Repository-Dateien bleiben erhalten.",
   "Refresh token of the connector, from the Twingate admin console": "Aktualisierungstoken des Connectors aus der Twingate-Verwaltungskonsole",
   "Refresh your browser (Ctrl+Shift+R) to see changes": "Aktualisieren Sie Ihren Browser (Strg+Umschalt+R), um die Änderungen anzuzeigen",
   "Refresh your browser to see changes (server restart may be required)": "Aktualisieren Sie Ihren Browser, um Änderungen zu sehen (möglicherweise ist ein Neustart des Servers erforderlich).",
@@ -5141,6 +5183,8 @@
   "Remove saved credentials": "Gespeicherte Anmeldeinformationen entfernen",
   "Remove subscription banner": "Abonnementbanner entfernen",
   "Remove the application? Its container disks are deleted, and only a backup can bring them back.": "Anwendung entfernen? Seine Containerfestplatten werden gelöscht und können nur durch ein Backup wiederhergestellt werden.",
+  "Remove the lock left on a VM by an interrupted task": "Die Sperre entfernen, die eine unterbrochene Aufgabe auf einer VM hinterlassen hat",
+  "Remove the lock left on a container by an interrupted task": "Die Sperre entfernen, die eine unterbrochene Aufgabe auf einem Container hinterlassen hat",
   "Remove the saved credentials for {registry}?\nRunning apps will keep working.": "Die gespeicherten Anmeldeinformationen für {registry} entfernen?\nLaufende Apps funktionieren weiterhin.",
   "Remove the unprivileged flag from configuration:": "Entfernen Sie das Unprivileged-Flag aus der Konfiguration:",
   "Remove unused packages and their config": "Entfernen Sie nicht verwendete Pakete und deren Konfiguration",
@@ -5222,6 +5266,7 @@
   "Repository helper unavailable. NVIDIA installation stopped.": "Repository-Helfer nicht verfügbar. Die Installation von NVIDIA wurde gestoppt.",
   "Repository policy returned an unexpected result.": "Die Repository-Richtlinie hat ein unerwartetes Ergebnis zurückgegeben.",
   "Repository ready.": "Repository bereit.",
+  "Repository sources changed, but APT package-list refresh failed. Operation stopped; sources were not rolled back. Inspect Administration > Repositories and retry apt-get update before continuing.": "Repository-Quellen geändert, aber die Aktualisierung der APT-Paketliste ist fehlgeschlagen. Betrieb gestoppt;Quellen wurden nicht zurückgesetzt. Überprüfen Sie „Administration > Repositorys“ und wiederholen Sie apt-get update, bevor Sie fortfahren.",
   "Repository sources changed, but APT package-list refresh failed. Operation stopped; sources were not rolled back. Inspect Node > Updates > Repositories and retry apt-get update before continuing.": "Die Repository-Quellen wurden geändert, aber die Aktualisierung der APT-Paketliste ist fehlgeschlagen. Vorgang gestoppt; die Quellen wurden nicht zurückgesetzt. Überprüfen Sie Knoten > Updates > Repositorys und wiederholen Sie apt-get update, bevor Sie fortfahren.",
   "Repository switch declined; no APT source changed.": "Repository-Wechsel abgelehnt; es wurde keine APT-Quelle geändert.",
   "Repository:": "Repository:",
@@ -5316,7 +5361,9 @@
   "Reverting ZFS ARC tuning...": "ZFS ARC-Tuning wird zurückgesetzt...",
   "Reverting pigz wrapper...": "Pigz-Wrapper wird zurückgesetzt...",
   "Reverting vzdump speed tuning...": "vzdump-Geschwindigkeitsoptimierung wird zurückgesetzt...",
+  "Review and apply": "Prüfen und anwenden",
   "Review external OCI changes": "Überprüfen Sie externe OCI-Änderungen",
+  "Review package upgrade": "Paketaktualisierung prüfen",
   "Review passthrough config files": "Überprüfen Sie die Passthrough-Konfigurationsdateien",
   "Review what will be removed": "Überprüfen Sie, was entfernt wird",
   "Rip DVD and Blu-ray media from a browser": "Rip DVD und Blu-ray Medien aus einem Browser",
@@ -5359,6 +5406,7 @@
   "Run the following inside the VM:": "Führen Sie Folgendes in der VM aus:",
   "Run the release-channel switch from an SSH session or the Proxmox host console with:": "Führen Sie den Release-Channel-Schalter von einer SSH-Sitzung oder der Proxmox-Hostkonsole aus mit:",
   "Run the update from an SSH session or the Proxmox host console with:": "Führen Sie das Update über eine SSH-Sitzung oder die Proxmox-Hostkonsole aus mit:",
+  "Run this operation as root.": "Führen Sie diesen Vorgang als root aus.",
   "Run upgrade checklist script:": "Führen Sie das Upgrade-Checklisten-Skript aus:",
   "Running": "Läuft",
   "Running Lynis security audit...": "Lynis-Sicherheitsaudit wird ausgeführt...",
@@ -5773,6 +5821,7 @@
   "ShareCoveX panel": "ShareCoveX-Panel",
   "Shared Directory Ready:": "Bereit für das freigegebene Verzeichnis:",
   "Shared Group": "Geteilte Gruppe",
+  "Shared directories": "Freigegebene Verzeichnisse",
   "Shared directory created:": "Gemeinsames Verzeichnis erstellt:",
   "Shared directory for consume and export": "Gemeinsames Verzeichnis für Konsum und Export",
   "Shared directory for copy/sync operations": "Gemeinsames Verzeichnis für Copy/Sync operations",
@@ -5802,6 +5851,7 @@
   "Should show pve-manager/9.x.x": "Sollte pve-manager/9.x.x anzeigen",
   "Shoutrrr addresses for the notifications (optional)": "Shoutrrr-Adressen für die Benachrichtigungen (optional)",
   "Show All Scripts": "Alle Skripte anzeigen",
+  "Show CT users and their UID/GID on the host": "CT-Benutzer und UID/GID auf dem Host anzeigen",
   "Show CT users in table format": "CT-Benutzer im Tabellenformat anzeigen",
   "Show Container Privilege Status": "Container-Berechtigungsstatus anzeigen",
   "Show DNS resolution status": "DNS-Auflösungsstatus anzeigen",
@@ -5963,6 +6013,7 @@
   "Start the VM to begin Windows installation from the mounted ISO.": "Starten Sie die VM, um die Windows-Installation von der gemounteten ISO aus zu starten.",
   "Start the applications once they are registered? Answer No if the original containers are still running on another host: both would use the same addresses.": "Die Anwendungen starten, sobald sie registriert sind? Antworten Sie mit „Nein“, wenn die ursprünglichen Container noch auf einem anderen Host laufen: Beide würden die gleichen Adressen verwenden.",
   "Start the converted container:": "Starten Sie den konvertierten Container:",
+  "Start the interactive Proxmox package upgrade": "Interaktive Paketaktualisierung von Proxmox starten",
   "Start the main system upgrade:": "Starten Sie das Hauptsystem-Upgrade:",
   "Start the stack with Proxmox": "Starten Sie den Stack mit Proxmox",
   "Start uploading to PBS — sets a recovery passphrase": "Hochladen auf PBS starten – legt eine Wiederherstellungspassphrase fest",
@@ -6242,6 +6293,7 @@
   "The Paperless persistent volumes need at least 8 GB": "Die papierlosen persistenten Volumes benötigen mindestens 8 GB",
   "The PostgreSQL volume needs at least 4 GB": "Das PostgreSQL-Volume benötigt mindestens 4 GB",
   "The PostgreSQL volume needs at least 8 GB": "Das PostgreSQL-Volume benötigt mindestens 8 GB",
+  "The Proxmox VE 8 update did not finish. The upgrade to Proxmox VE 9 was not started.": "Die Aktualisierung von Proxmox VE 8 wurde nicht abgeschlossen. Das Upgrade auf Proxmox VE 9 wurde nicht gestartet.",
   "The Proxmox archive keyring is missing; Ceph installation cannot continue safely": "Der Archivschlüsselbund Proxmox fehlt;Die Ceph-Installation kann nicht sicher fortgesetzt werden",
   "The Proxmox inventory and the local configurations differ": "Das Proxmox-Inventar und die lokalen Konfigurationen unterscheiden sich",
   "The ROCm image has no support for the AMD GPU of this host:": "Das ROCm-Image unterstützt die AMD-GPU dieses Hosts nicht:",
@@ -6312,6 +6364,7 @@
   "The build could not be checked beforehand; continuing without that check.": "Der Build konnte vorher nicht überprüft werden;ohne diese Prüfung weitermachen.",
   "The cached image does not match the current digest": "Das zwischengespeicherte Bild entspricht nicht dem aktuellen Digest",
   "The cached image is damaged; it will be downloaded again.": "Das zwischengespeicherte Bild ist beschädigt; es wird erneut heruntergeladen.",
+  "The changes need the application installer": "Die Änderungen erfordern das Installationsprogramm der Anwendung",
   "The character device does not exist:": "Das Zeichengerät existiert nicht:",
   "The command asks for a password that is not echoed. After creating the users, the web interface asks for a user name and a password.": "Der Befehl fragt nach einem Passwort, das nicht wiederholt wird. Nach dem Erstellen der Benutzer fragt die Weboberfläche nach einem Benutzernamen und einem Passwort.",
   "The command does not name an image": "Der Befehl benennt kein Bild",
@@ -6431,8 +6484,10 @@
   "The host bind source does not exist:": "Die Host-Bind-Quelle existiert nicht:",
   "The host bind source is not a regular file or directory:": "Die Host-Bind-Quelle ist keine reguläre Datei oder ein Verzeichnis:",
   "The host directory changed before it was mounted": "Das Host-Verzeichnis wurde geändert, bevor es gemountet wurde",
+  "The host directory does not exist": "Das Verzeichnis auf dem Host ist nicht vorhanden",
   "The host directory may not be accessible from an unprivileged container.": "Auf das Hostverzeichnis kann von einem unprivilegierten Container aus möglicherweise nicht zugegriffen werden.",
   "The host has no IPv4 address on the selected bridge": "Der Host hat keine IPv4-Adresse auf der ausgewählten Brücke",
+  "The host loses access to them. If the group includes a network or storage controller the host needs, cancel at the summary.": "Der Host verliert den Zugriff darauf. Wenn die Gruppe einen Netzwerk- oder Speichercontroller enthält, den der Host benötigt, brechen Sie in der Zusammenfassung ab.",
   "The host monitor does not see the real host memory": "Der Host-Monitor sieht den echten Host-Speicher nicht",
   "The host monitor does not share this host namespace:": "Der Host-Monitor teilt diesen Host-Namespace nicht:",
   "The host monitor include is unknown or differs from the saved record": "Das Host-Monitor-Include ist unbekannt oder weicht vom gespeicherten Datensatz ab",
@@ -6622,6 +6677,7 @@
   "The repair must preserve the image dependencies:": "Die Reparatur muss die Bildabhängigkeiten bewahren:",
   "The requested VMID block is already in use": "Der angeforderte VMID-Block wird bereits verwendet",
   "The requested machine learning GPU profile is not working; it is not replaced by CPU": "Das angeforderte Machine Learning-GPU-Profil funktioniert nicht; es wird nicht durch CPU ersetzt",
+  "The resource edit could not be fully rolled back. Open Manage again to review and import the current Proxmox settings.": "Die Ressourcenänderung konnte nicht vollständig rückgängig gemacht werden. Öffne die Verwaltung erneut, um die aktuellen Proxmox-Einstellungen zu prüfen und zu übernehmen.",
   "The restored service did not pass its health check": "Der wiederhergestellte Service bestand seinen Gesundheitscheck nicht",
   "The restored service stopped; the recovery is not confirmed": "Der wiederhergestellte Dienst wurde gestoppt; die Wiederherstellung wird nicht bestätigt",
   "The reviewed Tandoor stack does not require a privileged LXC.": "Der überprüfte Tandoor-Stack requi ist kein privilegierter LXC.",
@@ -6667,6 +6723,7 @@
   "The selected VM": "Die ausgewählte VM",
   "The selected VM is running.": "Die ausgewählte VM läuft.",
   "The selected base folder does not exist and could not be created:": "Der ausgewählte Basisordner existiert nicht und konnte nicht erstellt werden:",
+  "The selected bridge does not exist": "Die ausgewählte Bridge ist nicht vorhanden",
   "The selected bridge has no IPv4 subnet for the host-monitor firewall": "Die ausgewählte Bridge verfügt über kein IPv4-Subnetz für die Host-Monitor-Firewall",
   "The selected configuration needs to start the LXC during the installation": "Die ausgewählte Konfiguration muss den LXC während der Installation starten",
   "The selected container is unprivileged. A privileged container is required for direct device passthrough.": "Der ausgewählte Container ist nicht privilegiert. Für den direkten Geräte-Passthrough ist ein privilegierter Container erforderlich.",
@@ -6689,6 +6746,7 @@
   "The service builds its own image; only a published image can be installed": "Der Dienst erstellt ein eigenes Image; nur ein veröffentlichtes Image kann installiert werden",
   "The service declares no image:": "Der Dienst erklärt kein Bild:",
   "The setting has no final value:": "Die Einstellung hat keinen Endwert:",
+  "The settings could not be fully rolled back. Review the container and its saved modification before continuing.": "Die Einstellungen konnten nicht vollständig zurückgesetzt werden. Prüfe den Container und die gespeicherte Änderung, bevor du fortfährst.",
   "The share already exists in smb.conf:": "Die Freigabe existiert bereits in smb.conf:",
   "The shared destination is not a directory": "Das gemeinsame Ziel ist kein Verzeichnis",
   "The shared directory points to a protected host path": "Das Shared Directory zeigt auf einen geschützten Hostpfad",
@@ -6756,19 +6814,24 @@
   "These Proxmox resources were added outside ProxMenux:": "Diese Proxmox-Ressourcen wurden außerhalb von ProxMenux hinzugefügt:",
   "These VMIDs are not free:": "Diese VMIDs sind nicht kostenlos:",
   "These are the changes that will be made": "Dies sind die Änderungen, die vorgenommen werden",
+  "These changes were made in Proxmox outside ProxMenux:": "Diese Änderungen wurden in Proxmox außerhalb von ProxMenux vorgenommen:",
   "These container mount paths have an extension-like suffix:": "Diese Einhängepfade im Container haben eine Endung, die einer Dateierweiterung ähnelt:",
   "These containers were restored from a backup and this host has no record of their OCI application:": "Diese Container wurden aus einem Backup wiederhergestellt und dieser Host hat keinen Datensatz ihrer OCI-Anwendung:",
+  "These devices share the IOMMU group of the selected GPU and will be assigned to the VM with it:": "Diese Geräte teilen sich die IOMMU-Gruppe der ausgewählten GPU und werden zusammen mit ihr der VM zugewiesen:",
   "These host backups run with this job and expect its storage:": "Diese Host-Backups werden mit diesem Job ausgeführt und erwarten dessen Speicherung:",
   "These host backups run with this job and will stop running:": "Diese Host-Backups werden mit diesem Job ausgeführt und werden nicht mehr ausgeführt:",
   "These interface configurations will be removed": "Diese Schnittstellenkonfigurationen werden entfernt",
   "These manual changes cannot be adopted safely:": "Diese manuellen Änderungen können nicht sicher übernommen werden:",
   "These paths will not be restored live and will be extracted for manual recovery.": "Diese Pfade werden nicht live wiederhergestellt und zur manuellen Wiederherstellung extrahiert.",
+  "These settings require an application-specific adaptation. The image was not downloaded and the container was not recreated.": "Diese Einstellungen erfordern eine anwendungsspezifische Anpassung. Das Image wurde nicht heruntergeladen und der Container nicht neu erstellt.",
   "These values are asked during the installation:": "Diese Werte werden während der Installation abgefragt:",
   "They are described in the image documentation:": "Sie sind in der Dokumentation des Images beschrieben:",
   "They will be added to oci-compose before continuing. Unsupported or changed resources are not imported.": "Sie werden zu oci-compose hinzugefügt, bevor Sie fortfahren. Nicht unterstützte oder geänderte Ressourcen werden nicht importiert.",
+  "They will be saved in oci-compose before continuing.": "Sie werden in oci-compose gespeichert, bevor Sie fortfahren.",
   "This CIFS share is mounted with restrictive permissions.": "Diese CIFS-Freigabe wird mit restriktiven Berechtigungen gemountet.",
   "This GPU is considered incompatible with GPU passthrough to a VM in ProxMenux.": "Diese GPU gilt als inkompatibel mit GPU-Passthrough zu einer VM in ProxMenux.",
   "This NFS share is fully restricted — even the host root cannot write to it.": "Diese NFS-Freigabe ist vollständig eingeschränkt – selbst der Host-Root kann nicht darauf schreiben.",
+  "This Proxmox Backup Server has no active subscription, switch to the no-subscription repository? The inaccessible Enterprise PBS source will be disabled.": "Dieser Proxmox Backup Server hat kein aktives Abonnement. Zum Repository ohne Abonnement wechseln? Die nicht erreichbare Enterprise-PBS-Quelle wird deaktiviert.",
   "This VM requires extra installation steps, see install guide at:\nhttps://github.com/community-scripts/ProxmoxVE/discussions/144": "Für diese VM sind zusätzliche Installationsschritte erforderlich. Weitere Informationen finden Sie im Installationshandbuch unter:\nhttps://github.com/community-scripts/ProxmoxVE/discussions/144",
   "This account is for {registry}. Enter an image from that registry.": "Dieses Konto ist für {registry}. Geben Sie ein Bild aus dieser Registrierung ein.",
   "This action will:": "Diese Aktion wird:",
@@ -6830,10 +6893,13 @@
   "This may take several minutes...": "Dies kann einige Minuten dauern...",
   "This means Proxmox handles mount lifecycle natively (no manual /etc/fstab needed for NFS/CIFS host storages).": "Das bedeutet, dass Proxmox den Mount-Lebenszyklus nativ verwaltet (für NFS/CIFS-Hostspeicher ist kein manuelles /etc/fstab erforderlich).",
   "This means the credentials are incorrect.": "Dies bedeutet, dass die Anmeldeinformationen falsch sind.",
+  "This menu requires Proxmox Backup Server.": "Dieses Menü erfordert Proxmox Backup Server.",
   "This might indicate network connectivity issues.": "Dies könnte auf Probleme mit der Netzwerkverbindung hinweisen.",
   "This monitor uses a privileged LXC, shares processes and network with Proxmox and disables AppArmor in the CT. It uses the IP address and firewall of the host. A compromised image could affect the host; do not expose its web UI to the Internet.": "Dieser Monitor verwendet einen privilegierten LXC, teilt Prozesse und Netzwerke mit Proxmox und deaktiviert AppArmor im CT. Es verwendet die IP-Adresse und Firewall des Hosts. Ein kompromittiertes Bild könnte den Host beeinflussen; setzen Sie seine Web-Benutzeroberfläche nicht dem Internet aus.",
   "This only removes the schedule. Existing backup archives are NOT deleted.": "Dadurch wird nur der Zeitplan entfernt. Vorhandene Backup-Archive werden NICHT gelöscht.",
   "This operation may take several minutes and requires internet connectivity.": "Dieser Vorgang kann mehrere Minuten dauern und erfordert eine Internetverbindung.",
+  "This operation requires a Proxmox VE host. Use the PBS menu on Proxmox Backup Server.": "Dieser Vorgang erfordert einen Proxmox-VE-Host. Verwenden Sie auf Proxmox Backup Server das PBS-Menü.",
+  "This operation supports PBS 3 on Debian 12 and PBS 4 on Debian 13.": "Dieser Vorgang unterstützt PBS 3 unter Debian 12 und PBS 4 unter Debian 13.",
   "This package was installed by older versions of the ProxMenux Coral installer that placed the M.2 kernel driver on every system, including USB-only setups. It is not needed for Coral USB devices, which use libedgetpu1-std / libedgetpu1-max only.": "Dieses Paket wurde von älteren Versionen des ProxMenux Coral-Installationsprogramms installiert, das den M.2-Kernel-Treiber auf jedem System platzierte, einschließlich reiner USB-Setups. Es ist nicht für Coral USB-Geräte erforderlich, die nur libedgetpu1-std / libedgetpu1-max verwenden.",
   "This passphrase is the ONLY way to access encrypted Borg backups.": "Diese Passphrase ist die EINZIGE Möglichkeit, auf verschlüsselte Borg-Backups zuzugreifen.",
   "This path is already used as a mount point in this container.": "Dieser Pfad wird in diesem Container bereits als Mountpunkt verwendet.",
@@ -6849,6 +6915,7 @@
   "This script cannot be executed from the Proxmox web terminal.": "Dieses Skript kann nicht über das Proxmox-Webterminal ausgeführt werden.",
   "This script must be run as root.": "Dieses Skript muss als Root ausgeführt werden.",
   "This script must be run on a Proxmox host.": "Dieses Skript muss auf einem Proxmox-Host ausgeführt werden.",
+  "This script will apply the following optimizations and advanced adjustments to your Proxmox Backup Server": "Dieses Skript wendet die folgenden Optimierungen und erweiterten Anpassungen auf Ihren Proxmox Backup Server an",
   "This script will apply the following optimizations and advanced adjustments to your Proxmox VE server": "Dieses Skript wendet die folgenden Optimierungen und erweiterten Anpassungen auf Ihren Proxmox VE-Server an",
   "This script will update your Proxmox VE system with advanced options:": "Dieses Skript aktualisiert Ihr Proxmox VE-System mit erweiterten Optionen:",
   "This session is running in the Monitor terminal. Running it from here would cut the connection mid-install and leave the switch in a broken state.": "Diese Sitzung wird im Monitor-Terminal ausgeführt. Wenn Sie es von hier aus ausführen, wird die Verbindung während der Installation unterbrochen und der Switch bleibt in einem defekten Zustand.",
@@ -6935,7 +7002,7 @@
   "Transaction log:": "Transaktionsprotokoll:",
   "Translation files:": "Übersetzungsdateien:",
   "Transmission is designed for easy, powerful use. Transmission has the features you want from a BitTorrent client: encryption, a web interface, peer exchange, magnet links, DHT, µTP, UPnP and NAT-PMP port forwarding, webseed support, watch directories, tracker editing, global and per-torrent speed limits, and more.": "Transmission wurde für eine einfache und leistungsstarke Nutzung entwickelt. Transmission verfügt über die Funktionen, die Sie von einem BitTorrent-Client erwarten: Verschlüsselung, eine Web-Schnittstelle, Peer-Exchange, Magnet-Links, DHT, μTP, UPnP und NAT-PMP Port-Weiterleitung, Webseed-Unterstützung, Watch-Verzeichnisse, Tracker-Bearbeitung, globale und per-Torrent-Geschwindigkeitsbeschränkungen und mehr.",
-  "Tried pvesm path and manual detection methods": "Versuchte den Pvesm-Pfad und manuelle Erkennungsmethoden",
+  "Tried pvesm path and manual detection methods": "pvesm path und manuelle Erkennungsmethoden wurden versucht",
   "Trust this certificate and save it for scheduled backups?": "Diesem Zertifikat vertrauen und es für geplante Sicherungen speichern?",
   "Try Again": "Versuchen Sie es erneut",
   "Try a different search term.": "Versuchen Sie es mit einem anderen Suchbegriff.",
@@ -6980,6 +7047,7 @@
   "Unable to identify the root filesystem. Aborting.": "Das Root-Dateisystem konnte nicht identifiziert werden. Abbruch.",
   "Unable to resolve system ZFS pool disks. Aborting.": "System-Pool-Festplatten ZFS können nicht aufgelöst werden. Abbruch.",
   "Unable to resolve system disk topology. Aborting.": "Die Topologie der Systemfestplatte kann nicht aufgelöst werden. Abbruch.",
+  "Unapplied changes": "Noch nicht angewendete Änderungen",
   "Understand the security implications of privileged containers": "Verstehen Sie die Sicherheitsauswirkungen privilegierter Container",
   "Unexpected Proxmox inventory; recovery blocked": "Unerwartetes Proxmox-Inventar; Erholung blockiert",
   "Unexpected formatting directory in the new Valkey volume": "Unerwartetes Formatierungsverzeichnis im neuen Valkey-Volume",
@@ -7079,6 +7147,7 @@
   "Unsupported OCI-LXC AppArmor profile:": "Nicht unterstütztes OCI-LXC AppArmor-Profil:",
   "Unsupported OCI-LXC seccomp profile:": "Nicht unterstütztes OCI-LXC seccomp Profil:",
   "Unsupported Terminal": "Nicht unterstütztes Terminal",
+  "Unsupported architecture for Figurine:": "Nicht unterstützte Architektur für Figurine:",
   "Unsupported architecture:": "Nicht unterstützte Architektur:",
   "Unsupported backup compression": "Nicht unterstützte Backup-Komprimierung",
   "Unsupported credential pattern:": "Nicht unterstütztes credential-Muster:",
@@ -7094,6 +7163,7 @@
   "Unsupported mount type": "Typ der nicht unterstützten Halterung",
   "Unsupported mount type:": "Typ der nicht unterstützten Halterung:",
   "Unsupported native device type:": "Nicht unterstützter nativer Gerätetyp:",
+  "Unsupported network settings": "Nicht unterstützte Netzwerkeinstellungen",
   "Unsupported operation": "Nicht unterstützte operation",
   "Unsupported or unknown Proxmox version; no repository changed.": "Nicht unterstützte oder unbekannte Proxmox-Version; es wurde kein Repository geändert.",
   "Unsupported output format:": "Nicht unterstütztes Ausgabeformat:",
@@ -7121,6 +7191,7 @@
   "Update NVIDIA in LXC Containers": "Aktualisieren Sie NVIDIA in LXC-Containern",
   "Update OCI": "Aktualisierung OCI",
   "Update OCI stack": "Aktualisierung des OCI-Stacks",
+  "Update PBS using configured repositories": "PBS mit den konfigurierten Repositories aktualisieren",
   "Update PVE enterprise repository (Only if using enterprise):": "PVE-Enterprise-Repository aktualisieren (nur bei Verwendung von Enterprise):",
   "Update Proxmox VE Appliance Manager": "Proxmox VE Appliance Manager aktualisieren",
   "Update Proxmox package lists": "Proxmox-Paketlisten aktualisieren",
@@ -7173,6 +7244,7 @@
   "Upgrade assistant: Proxmox VE 8 → 9 (Trixie)": "Upgrade-Assistent: Proxmox VE 8 → 9 (Trixie)",
   "Upgrade canceled by user": "Upgrade vom Benutzer abgebrochen",
   "Upgrade one node at a time": "Aktualisieren Sie jeweils einen Knoten",
+  "Upgrade the system, offering the": "Aktualisieren Sie das System und bieten Sie das an",
   "Upgrade to Proxmox VE 9": "Upgrade auf Proxmox VE 9",
   "Upgrading NVIDIA utils (Arch)...": "NVIDIA-Dienstprogramme werden aktualisiert (Arch)...",
   "Upload an encrypted copy of the key to PBS so you can recover it on a reinstalled host with just a passphrase?": "Eine verschlüsselte Kopie des Schlüssels auf PBS hochladen, damit Sie ihn auf einem neu installierten Host mit nur einer Passphrase wiederherstellen können?",
@@ -7186,7 +7258,7 @@
   "Usage:": "Verwendung:",
   "Use \"Check test progress\" to see results.": "Verwenden Sie „Testfortschritt prüfen“, um die Ergebnisse anzuzeigen.",
   "Use 'Export to file' to save it and inspect manually.": "Verwenden Sie „In Datei exportieren“, um es zu speichern und manuell zu überprüfen.",
-  "Use 'pct restore' / 'qmrestore' to recover their disks from your VM backups.": "Verwenden Sie „pct restart“ / „qmrestore“, um ihre Festplatten aus Ihren VM-Backups wiederherzustellen.",
+  "Use 'pct restore' / 'qmrestore' to recover their disks from your VM backups.": "Verwenden Sie 'pct restore' / 'qmrestore', um die Datenträger aus den VM-Sicherungen wiederherzustellen.",
   "Use Custom backup and uncheck the conflicting path from the list": "Verwenden Sie die benutzerdefinierte Sicherung und deaktivieren Sie den in Konflikt stehenden Pfad aus der Liste",
   "Use Default Settings?": "Standardeinstellungen verwenden?",
   "Use Download first if you want to save a copy of the current key. Continue?": "Verwenden Sie zuerst „Herunterladen“, wenn Sie eine Kopie des aktuellen Schlüssels speichern möchten. Weitermachen?",
@@ -7610,6 +7682,7 @@
   "active VF(s)": "aktive VF(s)",
   "active VFs": "aktive VFs",
   "active Virtual Functions. Changing its driver binding would destroy every VF.": "aktive virtuelle Funktionen. Eine Änderung der Treiberbindung würde jedes VF zerstören.",
+  "added in Proxmox": "in Proxmox hinzugefügt",
   "after copy; source tree is incomplete.": "nach Kopie; Der Quellbaum ist unvollständig.",
   "after update.": "nach dem Update.",
   "all guests": "alle Gäste",
@@ -7930,8 +8003,8 @@
   "partition(s). Partition table preserved.": "Partition(en). Partitionstabelle bleibt erhalten.",
   "pasted Compose file": "Einfügen der Compose-Datei",
   "paths for next boot (/etc/pve, guests, drivers, ...)": "Pfade für den nächsten Start (/etc/pve, Gäste, Treiber, ...)",
-  "pct exec authorization failed": "PCT-Exec-Autorisierung fehlgeschlagen",
-  "pct push failed. Check log:": "PCT-Push fehlgeschlagen. Protokoll prüfen:",
+  "pct exec authorization failed": "Autorisierung für pct exec fehlgeschlagen",
+  "pct push failed. Check log:": "pct push fehlgeschlagen. Protokoll prüfen:",
   "pending (reboot required to enumerate full group)": "ausstehend (Neustart erforderlich, um die vollständige Gruppe aufzulisten)",
   "phpMyAdmin is installed with arbitrary server connections enabled: the login page has a Server field where the address of the MySQL or MariaDB server is entered, together with its user and password.": "phpMyAdmin wird mit aktivierten beliebigen Serververbindungen installiert: Die Anmeldeseite hat ein Serverfeld, in dem die Adresse des MySQL- oder MariaDB-Servers zusammen mit seinem Benutzer und seinem Passwort eingegeben wird.",
   "pigz configuration completed": "Pigz-Konfiguration abgeschlossen",
@@ -7954,8 +8027,8 @@
   "pvesm command not found. This should not happen on Proxmox.": "pvesm-Befehl nicht gefunden. Dies sollte auf Proxmox nicht passieren.",
   "pvesm not available.": "pvesm nicht verfügbar.",
   "pvesm not found.": "pvesm nicht gefunden.",
-  "pvesm path failed, trying manual detection...": "pvesm-Pfad fehlgeschlagen, manuelle Erkennung versucht ...",
-  "pvesm status failed": "pvesm-Status fehlgeschlagen",
+  "pvesm path failed, trying manual detection...": "pvesm path fehlgeschlagen, manuelle Erkennung wird versucht...",
+  "pvesm status failed": "pvesm status fehlgeschlagen",
   "pyLoad is a Free and Open Source download manager written in Python and designed to be extremely lightweight, easily extensible and fully manageable via web.": "pyLoad ist ein Free- und Open Source-Download-Manager, der in Python geschrieben ist und extrem leicht, leicht erweiterbar und vollständig über das Web zu verwalten ist.",
   "pyLoad web interface": "pyLoad Web Interface",
   "qBittorrent WebUI password (user: admin)": "qBittorrent WebUI Passwort (Benutzer: admin)",
@@ -7968,8 +8041,8 @@
   "qBittorrent: invalid login response or missing session cookie": "qBittorrent: ungültige Anmeldeantwort oder fehlendes Sitzungscookie",
   "raw USB disk — no filesystem (will be FORMATTED)": "Raw-USB-Festplatte – kein Dateisystem (wird FORMATTIERT)",
   "read-only": "Read-Only",
-  "reboot-quick alias added": "reboot-quick-Alias ​​hinzugefügt",
-  "reboot-quick alias is already configured": "reboot-quick Alias ​​ist bereits konfiguriert",
+  "reboot-quick alias added": "reboot-quick-Alias hinzugefügt",
+  "reboot-quick alias is already configured": "reboot-quick Alias ist bereits konfiguriert",
   "recognition": "Erkennung",
   "recognition only": "Nur Erkennung",
   "recommended": "empfohlen",
@@ -7977,6 +8050,7 @@
   "remapped users": "Benutzer neu zugeordnet",
   "remove the (now-empty) directory if possible": "Entfernen Sie nach Möglichkeit das (jetzt leere) Verzeichnis",
   "removed from Proxmox": "aus Proxmox entfernt",
+  "removed in Proxmox": "in Proxmox entfernt",
   "removed successfully from Proxmox.": "erfolgreich aus Proxmox entfernt.",
   "requires running the official installer, which restarts the Monitor service.": "erfordert die Ausführung des offiziellen Installationsprogramms, das den Monitor-Dienst neu startet.",
   "requires the package": "erfordert das Paket",
@@ -8013,8 +8087,8 @@
   "skipped (already exist)": "übersprungen (existiert bereits)",
   "smbclient command is not working properly.": "Der smbclient-Befehl funktioniert nicht ordnungsgemäß.",
   "smbclient command not found after installation.": "Der Befehl smbclient wurde nach der Installation nicht gefunden.",
-  "sources.list update skipped (no change)": "Aktualisierung der Quellenliste übersprungen (keine Änderung)",
-  "sources.list updated to Trixie": "Quellen. Liste auf Trixie aktualisiert",
+  "sources.list update skipped (no change)": "Aktualisierung von sources.list übersprungen (keine Änderung)",
+  "sources.list updated to Trixie": "sources.list auf Trixie aktualisiert",
   "ssh-keygen failed. Cannot create a new SSH key.": "ssh-keygen ist fehlgeschlagen. Es kann kein neuer SSH-Schlüssel erstellt werden.",
   "stale entry/entries for interfaces no longer present": "veralteter Eintrag/Einträge für Schnittstellen, die nicht mehr vorhanden sind",
   "standard performance": "Standardleistung",
@@ -8033,7 +8107,7 @@
   "switch_gpu_mode.sh was not found.": "switch_gpu_mode.sh wurde nicht gefunden.",
   "sysfs ROM dump failed — trying ACPI VFCT table...": "sysfs-ROM-Dump fehlgeschlagen – Versuch der ACPI-VFCT-Tabelle ...",
   "syslog-ng allows you to flexibly collect, parse, classify, rewrite and correlate logs from across your infrastructure and store or route them to log analysis tools.": "syslog-ng ermöglicht es Ihnen, Protokolle aus Ihrer gesamten Infrastruktur flexibel zu sammeln, zu analysieren, zu klassifizieren, neu zu schreiben und zu korrelieren und sie zu Protokollanalyse-Tools zu speichern oder zu leiten.",
-  "systemctl restart networking failed:": "systemctl-Neustart des Netzwerks fehlgeschlagen:",
+  "systemctl restart networking failed:": "systemctl restart networking fehlgeschlagen:",
   "systemd OnCalendar expression": "systemd OnCalendar-Ausdruck",
   "the API key was not generated on the first start": "Der API-Schlüssel wurde beim ersten Start nicht generiert",
   "the NVIDIA hook of the container is not available:": "der NVIDIA-Hook des Containers ist nicht verfügbar:",
@@ -8080,18 +8154,20 @@
   "using": "verwenden",
   "using direct path (not guaranteed to survive reboots).": "Verwenden des direkten Pfads (keine Garantie, dass Neustarts überlebt werden).",
   "vCPUs:": "vCPUs:",
+  "value changed in Proxmox": "Wert in Proxmox geändert",
   "vfio-pci IDs configured": "vfio-pci-IDs konfiguriert",
   "vfio-pci IDs in /etc/modprobe.d/vfio.conf": "vfio-pci-IDs in /etc/modprobe.d/vfio.conf",
   "video": "Video",
   "video + recognition": "Video + Erkennung",
   "video only": "nur Video",
   "vzdump backup speed optimization completed": "vzdump-Backup-Geschwindigkeitsoptimierung abgeschlossen",
-  "wallabag builds its links from the address given during the installation. If it does not match the address of the container, edit lxc.environment.runtime: SYMFONY__ENV__DOMAIN_NAME in /etc/pve/lxc/<CTID>.conf with the container stopped, and start it again.": "wallabag baut seine Links aus der während der Installation angegebenen Adresse auf. Wenn es nicht mit der Adresse des Containers übereinstimmt, bearbeiten Sie lxc.environment. Laufzeit: SYMFONY  ENV  DOMAIN NAME in /etc/pve/lxc/<CTID>.conf mit angehaltenem Container und erneut starten.",
+  "wallabag builds its links from the address given during the installation. If it does not match the address of the container, edit lxc.environment.runtime: SYMFONY__ENV__DOMAIN_NAME in /etc/pve/lxc/<CTID>.conf with the container stopped, and start it again.": "wallabag erzeugt seine Links aus der bei der Installation angegebenen Adresse. Passt diese nicht zur Container-Adresse, stoppen Sie den Container, bearbeiten Sie lxc.environment.runtime: SYMFONY__ENV__DOMAIN_NAME in /etc/pve/lxc/<CTID>.conf und starten Sie ihn erneut.",
   "wallabag listens on port 80 of the container and stores its data in SQLite.": "wallabag hört auf Port 80 des Containers und speichert seine Daten in SQLite.",
   "wallabag web interface": "wallabag Web-Schnittstelle",
   "was": "war",
   "was installed, but the kernel reports:": "wurde installiert, aber der Kernel meldet:",
   "when finished": "wenn fertig",
+  "when the server has no subscription (you will be asked)": "Wenn der Server kein Abonnement hat (Sie werden gefragt)",
   "will rebind the GPU to vfio-pci on the next reboot, breaking the driver that is about to be installed.": "Bindet die GPU beim nächsten Neustart erneut an vfio-pci, wodurch der zu installierende Treiber beschädigt wird.",
   "wipefs failed on": "Wipefs sind fehlgeschlagen",
   "with": "mit",
diff --git a/lang/es.json b/lang/es.json
index 61eb5d0f..76844983 100644
--- a/lang/es.json
+++ b/lang/es.json
@@ -37,6 +37,7 @@
   "/var/lib/vz/dump   (Proxmox default vzdump path)": "/var/lib/vz/dump   (ruta por defecto de vzdump)",
   "/var/lib/vz/dump   (Proxmox default)": "/var/lib/vz/dump   (por defecto en Proxmox)",
   "1777 = sticky bit + rwx for all. No shared group needed.": "1777 = sticky bit + rwx para todos. No se necesita un grupo compartido.",
+  "====== PBS UPDATE COMPLETED ======": "====== ACTUALIZACIÓN PBS COMPLETADA ======",
   "====== PVE UPDATE COMPLETED ======": "====== ACTUALIZACIÓN PVE COMPLETADA ======",
   ">> Create a new backup job <<": ">> Crear un trabajo de backup nuevo <<",
   ">> Save and return <<": ">> Guardar y volver <<",
@@ -86,6 +87,7 @@
   "A modern wiki and knowledge base for teams": "Una wiki y base de conocimiento moderna para equipos",
   "A new ProxMenux version is available:": "Una nueva versión de ProxMenux está disponible:",
   "A new kernel is staged for the next boot:": "Se prepara un nuevo kernel para el siguiente arranque:",
+  "A newer kernel is installed. Reboot before the next backup window to use it.": "Hay un kernel más reciente instalado. Reinicie antes de la próxima ventana de backups para usarlo.",
   "A newer version is available:": "Hay una versión más nueva disponible:",
   "A pending operation exists for": "Existe una operación pendiente",
   "A pending stack assembly already exists; it is not overwritten": "Ya existe un ensamblado de pila pendiente; no se sobrescribe",
@@ -168,6 +170,8 @@
   "APT language configuration updated": "Configuración del idioma APT actualizada",
   "APT language downloads restored": "Descargas del idioma APT restauradas",
   "APT package lists updated": "Listas de paquetes APT actualizadas",
+  "APT refresh failed. Check the PBS subscription and repositories in Administration > Repositories. Log:": "La actualización de APT ha fallado. Revise la suscripción y los repositorios de PBS en Administration > Repositories. Log:",
+  "APT refresh failed. Check the PBS subscription and repositories in the native PBS interface; no source was changed.": "No se pudieron actualizar los índices de APT. Comprueba la suscripción y los repositorios de PBS en su interfaz nativa; no se ha cambiado ninguna fuente.",
   "APT update failed. Check repository access; NVIDIA installation stopped.": "La actualización de APT ha fallado. Verifica el acceso a los repositorios; la instalación de NVIDIA se ha detenido.",
   "Aborted": "Abortado",
   "About to restore": "A punto de restaurar",
@@ -255,7 +259,7 @@
   "Add new PVE 9 enterprise repository (deb822 format) (Only if using enterprise):": "Agregue un nuevo repositorio empresarial PVE 9 (formato deb822) (solo si usa Enterprise):",
   "Add or change a device": "Agregar o cambiar un dispositivo",
   "Add or remove extra paths and devices": "Añadir o eliminar rutas y dispositivos extra",
-  "Add physical disk to VM via": "Agregue el disco físico a la VM mediante",
+  "Add physical disk to VM via": "Añadir un disco físico a la VM mediante",
   "Add share block in /etc/samba/smb.conf:": "Agregue el bloque para compartir en /etc/samba/smb.conf:",
   "Add unprivileged flag to container configuration:": "Agregar la opción de contenedor sin privilegios a su configuración:",
   "Add virtual disk": "Agregar disco virtual",
@@ -316,7 +320,7 @@
   "After confirming, you will be asked to choose the NVIDIA driver version to install.": "Después de confirmar, se le pedirá que elija la versión del controlador NVIDIA para instalar.",
   "After detailed analysis, no changes are needed.": "Después de un análisis detallado, no se necesitan cambios.",
   "After detailed analysis, no cleanup is needed.": "Después de un análisis detallado, no es necesaria ninguna limpieza.",
-  "After logging in, run: ip a to obtain the IP address.\nThen, enter that IP address in your web browser like this:\n  http://IP_ADDRESS\n\nThis will open the Umbral OS dashboard.": "Después de iniciar sesión, ejecute: ip a para obtener la dirección IP.\nLuego, ingrese esa dirección IP en su navegador web de esta manera:\n  http://DIRECCIÓN_IP\n\nEsto abrirá el panel de Umbral OS.",
+  "After logging in, run: ip a to obtain the IP address.\nThen, enter that IP address in your web browser like this:\n  http://IP_ADDRESS\n\nThis will open the Umbral OS dashboard.": "Después de iniciar sesión, ejecuta ip a para obtener la dirección IP.\nIntroduce esa dirección en el navegador de esta forma:\n  http://IP_ADDRESS\n\nSe abrirá el panel de Umbral OS.",
   "After pasting on the server, ensure the file is chmod 600 and owned by": "Después de pegarlo en el servidor, asegúrese de que el archivo sea chmod 600 y sea propiedad de",
   "After reboot the system will be fully accessible (SSH, web UI, login), but the following components will be reinstalled in BACKGROUND — until they finish, commands like nvidia-smi may not yet be available:": "Después de reiniciar, el sistema será completamente accesible (SSH, interfaz web e inicio de sesión), pero los siguientes componentes se reinstalarán EN SEGUNDO PLANO; hasta que finalicen, es posible que comandos como nvidia-smi aún no estén disponibles:",
   "After reboot, these components will reinstall in background:": "Después de reiniciar, estos componentes se reinstalarán en segundo plano:",
@@ -328,7 +332,7 @@
   "After this LXC → VM switch, reboot the host so the new binding state is applied cleanly.": "Después de este cambio LXC → VM, reinicie el host para que el nuevo estado de enlace se aplique limpiamente.",
   "Airsonic Advanced web interface": "Interfaz web de Airsonic Advanced",
   "Airsonic-advanced is a free, web-based media streamer, providing ubiquitious access to your music. Use it to share your music with friends, or to listen to your own music while at work. You can stream to multiple players simultaneously, for instance to one player in your kitchen and another in your living room.": "Airsonic-advanced es un servidor de streaming multimedia gratuito y basado en web que da acceso a tu música desde cualquier lugar. Úsalo para compartir tu música con amigos o para escuchar la tuya en el trabajo. Puede transmitir a varios reproductores a la vez, por ejemplo a uno en la cocina y a otro en el salón.",
-  "Aliases added to .bashrc": "Alias ​​agregados a .bashrc",
+  "Aliases added to .bashrc": "Alias agregados a .bashrc",
   "Alist Sync web interface": "Interfaz web de Alist Sync",
   "All": "Todos",
   "All Available Scripts": "Todos los scripts disponibles",
@@ -422,6 +426,7 @@
   "Apply": "Aplicar",
   "Apply AMD CPU fixes": "Aplicar correcciones para CPU AMD",
   "Apply Available Updates": "Aplicar actualizaciones disponibles",
+  "Apply PBS package upgrade": "Aplicar la actualización de paquetes de PBS",
   "Apply and restart services:": "Aplicar y reiniciar servicios:",
   "Apply available updates": "Aplicar actualizaciones disponibles",
   "Apply boot/initramfs changes": "Aplicar cambios de arranque/initramfs",
@@ -435,12 +440,15 @@
   "Apply options from the current catalog template? New required paths and settings may be requested. Review the resulting configuration before recreating the CT.": "¿Aplicar las opciones de la plantilla actual del catálogo? Puede que se pidan rutas y ajustes nuevos obligatorios. Revisa la configuración resultante antes de recrear el CT.",
   "Apply read+write access for 'others' on the host directory?": "¿Aplicar acceso de lectura+escritura para 'otros' en el directorio de host?",
   "Apply the options from the current catalog template? Your data and configuration are kept.": "¿Aplicar las opciones de la plantilla actual del catálogo? Sus datos y su configuración se mantienen.",
+  "Apply the reviewed package upgrade now? Services may restart and packages listed for removal will be removed.": "¿Aplicar ahora la actualización de paquetes revisada? Los servicios podrían reiniciarse y se eliminarán los paquetes indicados para su eliminación.",
   "Apply these changes?": "¿Aplicar estos cambios?",
   "Applying AMD-specific fixes...": "Aplicando correcciones específicas de AMD...",
+  "Applying CPU and RAM changes without rebuilding the container...": "Aplicando los cambios de CPU y RAM sin recrear el contenedor...",
   "Applying Changes": "Aplicando cambios",
   "Applying Controller/NVMe passthrough to VM": "Aplicando el passthrough de controlador/NVMe a la VM",
   "Applying balanced memory optimization settings...": "Aplicando configuraciones equilibradas de optimización de memoria...",
   "Applying changes safely...": "Aplicando cambios de forma segura...",
+  "Applying container settings without rebuilding the container...": "Aplicando los ajustes sin recrear el contenedor...",
   "Applying custom restore": "Aplicar restauración personalizada",
   "Applying default VM configuration": "Aplicar la configuración predeterminada de VM",
   "Applying host permissions for unprivileged LXC bind-mounts...": "Aplicando permisos de host para montajes de enlace LXC sin privilegios...",
@@ -533,6 +541,7 @@
   "Available Borg targets:": "Destinos Borg disponibles:",
   "Available Disks on Host": "Discos disponibles en el host",
   "Available ISO Images": "Imágenes ISO disponibles",
+  "Available PBS Version": "Versión PBS disponible",
   "Available PBS repositories:": "Repositorios de PBS disponibles:",
   "Available PVE Version": "Versión PVE disponible",
   "Available Shares:": "Recursos compartidos disponibles:",
@@ -560,7 +569,7 @@
   "Babybuddy is a buddy for babies! Helps caregivers track sleep, feedings, diaper changes, tummy time and more to learn about and predict baby's needs without (as much) guess work.": "¡Babybuddy es un compañero para bebés! Ayuda a quienes los cuidan a registrar el sueño, las tomas, los cambios de pañal, el tiempo boca abajo y más, para conocer y prever las necesidades del bebé sin (tantas) conjeturas.",
   "Back": "Volver",
   "Back to job list": "Volver a la lista de trabajos",
-  "Back to previous menu or Esc + Enter": "Volver al menú anterior o Esc + Enter",
+  "Back to previous menu or Esc + Enter": "Volver al menú anterior o Esc + Intro",
   "Backed up and cleared": "Guardado en backup y vaciado",
   "Backend": "Backend",
   "Backend:": "Parte trasera:",
@@ -745,6 +754,7 @@
   "Cannot verify the reused disk:": "No se puede verificar el disco reutilizado:",
   "Cannot write the image archive to {storage}. Check storage access and mount status.": "No se puede escribir el archivo de la imagen en {storage}. Comprueba el acceso al almacenamiento y que esté montado.",
   "Capabilities cannot be kept and all dropped at the same time": "No se pueden mantener las capacidades y todas se disminuyen al mismo tiempo",
+  "Catalog options": "Opciones del catálogo",
   "Category": "Categoría",
   "Caution: Maximum mode generates more heat.": "Precaución: el modo máximo genera más calor.",
   "Ceph check skipped by user flag (--ignore-ceph-check)": "Comprobación de Ceph omitida por el indicador del usuario (--ignore-ceph-check)",
@@ -776,7 +786,7 @@
   "Certificate provider: empty for Let's Encrypt, zerossl for ZeroSSL": "Proveedor de certificados: vacío para Let's Encrypt, zerossl para ZeroSSL",
   "Change GPU acceleration?": "¿Cambiar la aceleración de GPU?",
   "Change Language": "Cambiar idioma",
-  "Change Release Channel": "Cambiar canal de release",
+  "Change Release Channel": "Cambiar canal de versiones",
   "Change it after the first login.": "Cámbialo después del primer inicio de sesión.",
   "Change or add an environment variable?": "¿Cambiar o añadir una variable de entorno?",
   "Change the access network?": "¿Cambiar la red de acceso?",
@@ -788,7 +798,7 @@
   "Changes have been applied to the configuration file.": "Se han aplicado cambios al archivo de configuración.",
   "Changes prepared": "Cambios preparados",
   "Changes will apply after reboot.": "Los cambios se aplicarán después del reinicio.",
-  "Changing Release Channel": "Cambio de canal de release",
+  "Changing Release Channel": "Cambio de canal de versiones",
   "Changing between a privileged and an unprivileged container, or the host monitor mode, requires installing the application again": "Cambiar entre contenedor privilegiado y sin privilegios, o el modo de monitor del host, requiere instalar la aplicación de nuevo",
   "Changing the machine type on an existing installed VM is not safe: it changes the chipset and PCI slot layout, which typically prevents the guest OS from booting.": "Cambiar el tipo de máquina de una VM ya instalada no es seguro: cambia el chipset y la disposición de las ranuras PCI, lo que normalmente impide que arranque el sistema operativo de la VM.",
   "Changing the rootfs or its storage requires a separate migration": "Cambiar los rootfs o su almacenamiento requiere una migración separada",
@@ -797,20 +807,20 @@
   "Check": "Controlar",
   "Check BIOS/UEFI in Hardware > BIOS — must match what the original VM used": "Verifique BIOS/UEFI en Hardware > BIOS: debe coincidir con lo que usó la VM original",
   "Check Coral USB/M.2 detection": "Comprobar la detección de Coral USB/M.2",
-  "Check LXC GPU/TPU mapping": "Verifique el mapeo LXC GPU/TPU",
+  "Check LXC GPU/TPU mapping": "Comprobar el mapeo de GPU/TPU de los LXC",
   "Check NFS Status": "Verificar el estado de NFS",
-  "Check NVIDIA driver and devices": "Verifique el controlador y los dispositivos NVIDIA",
-  "Check Proxmox Web UI status": "Verifique el estado de la interfaz de usuario web de Proxmox",
+  "Check NVIDIA driver and devices": "Comprobar el controlador y los dispositivos NVIDIA",
+  "Check Proxmox Web UI status": "Comprobar el estado de la interfaz web de Proxmox",
   "Check Proxmox firewall status": "Comprobar el estado del cortafuegos de Proxmox",
   "Check Samba Status": "Verificar el estado de Samba",
   "Check VM disk/PCI slots": "Verifique el disco VM/ranuras PCI",
-  "Check VM passthrough settings": "Revise la configuración de passthrough de la VM",
+  "Check VM passthrough settings": "Revisar la configuración de passthrough de la VM",
   "Check access to an image": "Comprobar el acceso a una imagen",
   "Check connectivity with another host": "Verificar la conectividad con otro host",
   "Check container mount points": "Verifique los puntos de montaje del contenedor",
   "Check if container is unprivileged:": "Compruebe si el contenedor no tiene privilegios:",
-  "Check kernel params (IOMMU flags)": "Verifique los parámetros del kernel (indicadores IOMMU)",
-  "Check loaded GPU/TPU modules": "Verifique los módulos GPU/TPU cargados",
+  "Check kernel params (IOMMU flags)": "Comprobar los parámetros del kernel (opciones IOMMU)",
+  "Check loaded GPU/TPU modules": "Comprobar los módulos de GPU/TPU cargados",
   "Check log:": "Revise el log:",
   "Check resulting config:": "Verifique la configuración resultante:",
   "Check script not found": "Comprobar script no encontrado",
@@ -879,6 +889,7 @@
   "Choose a schedule (systemd calendar-event syntax):": "Elija una programación (sintaxis de eventos de calendario de systemd):",
   "Choose a script to execute:": "Elige un script para ejecutar:",
   "Choose a server:": "Elige un servidor:",
+  "Choose a setting. Changes are applied only after the final review.": "Elige qué configurar. Los cambios solo se aplican tras la revisión final.",
   "Choose a share to mount:": "Elige un recurso compartido para montar:",
   "Choose a specific supported GPU or USB node": "Elija un nodo concreto de GPU o USB compatible",
   "Choose action for this controller/NVMe:": "Elige la acción para este controlador/NVMe:",
@@ -908,7 +919,7 @@
   "Choose storage for the downloaded image.": "Elige el almacenamiento para la imagen descargada.",
   "Choose the driver version for Coral M.2:": "Elige la versión del controlador para Coral M.2:",
   "Choose the filesystem for the new partition:": "Elige el sistema de archivos para la nueva partición:",
-  "Choose the release channel to use:": "Elige el canal de release que quieres usar:",
+  "Choose the release channel to use:": "Elige el canal de versiones que quieres usar:",
   "Choose the storage for the EFI disk (4MB):": "Elija el almacenamiento para el disco EFI (4 MB):",
   "Choose the storage for the TPM disk (4MB):": "Elija el almacenamiento para el disco TPM (4 MB):",
   "Choose the storage for the loader disk:": "Elija el almacenamiento para el disco del cargador:",
@@ -959,6 +970,7 @@
   "Code-server is VS Code running on a remote server, accessible through the browser.": "Code-server es VS Code ejecutándose en un servidor remoto, accesible desde el navegador.",
   "CodeProject.AI Server": "CodeProject.AI Server",
   "Command": "Comando",
+  "Command failed": "El comando ha fallado",
   "Command override for an unknown service:": "Anulación de comando para un servicio desconocido:",
   "Commenting any residual Bookworm lines in *.list...": "Comentando cualquier línea residual de Bookworm en *.list...",
   "Commenting legacy PVE 8 repository .list files (if any)...": "Comentando archivos .list del repositorio PVE 8 heredado (si los hay)...",
@@ -1514,6 +1526,7 @@
   "Current NVIDIA inventory resolved: a refresh is required": "Actual inventario NVIDIA resuelto: un refresco es necesario",
   "Current NVIDIA inventory resolved: no refresh is required": "Inventario NVIDIA actual resuelto: ningún refresco es necesario",
   "Current Network Configuration": "Configuración de red actual",
+  "Current PBS Version": "Versión PBS actual",
   "Current PVE Version": "Versión PVE actual",
   "Current ProxMenux host scripts register remote shares as Proxmox storages using pvesm.": "Los scripts de host ProxMenux actuales registran recursos compartidos remotos como almacenamientos en Proxmox utilizando pvesm.",
   "Current ProxMenux version:": "Versión actual de ProxMenux:",
@@ -1628,8 +1641,8 @@
   "Default Proxmox logo applied": "Logotipo predeterminado de Proxmox aplicado",
   "Default is none (video-only passthrough). Use SPACE to toggle selections.": "Por defecto, ninguno (passthrough solo de vídeo). Use ESPACIO para marcar o desmarcar.",
   "Default journald configuration restored": "Configuración de diario predeterminada restaurada",
-  "Default location is /mnt/<name>. The share will be mounted here on the host with open permissions so an unprivileged LXC can bind-mount and write to it. For LXC access, bind-mount this path with the LXC Mount Manager.": "La ubicación predeterminada es /mnt/<nombre>. El recurso compartido se montará aquí en el host con permisos abiertos para que un LXC sin privilegios pueda vincularlo, montarlo y escribir en él. Para acceder a LXC, vincule esta ruta con LXC Mount Manager.",
-  "Default location is /mnt/<name>. The share will be mounted here on the host. Use this path in /etc/fstab. For LXC access, bind-mount this path with the LXC Mount Manager.": "La ubicación predeterminada es /mnt/<nombre>. El recurso compartido se montará aquí en el host. Utilice esta ruta en /etc/fstab. Para acceder a LXC, vincule esta ruta con LXC Mount Manager.",
+  "Default location is /mnt/<name>. The share will be mounted here on the host with open permissions so an unprivileged LXC can bind-mount and write to it. For LXC access, bind-mount this path with the LXC Mount Manager.": "La ubicación predeterminada es /mnt/<name>. El recurso compartido se montará aquí, en el host, con permisos abiertos para que un LXC sin privilegios pueda montarlo mediante un bind mount y escribir en él. Usa LXC Mount Manager para crear ese montaje en el LXC.",
+  "Default location is /mnt/<name>. The share will be mounted here on the host. Use this path in /etc/fstab. For LXC access, bind-mount this path with the LXC Mount Manager.": "La ubicación predeterminada es /mnt/<name>. El recurso compartido se montará aquí, en el host. Usa esta ruta en /etc/fstab. Para acceder desde un LXC, crea un bind mount de esta ruta con LXC Mount Manager.",
   "Default login": "Acceso predeterminado",
   "Default options": "Opciones predeterminadas",
   "Default options read/write": "Opciones predeterminadas lectura/escritura",
@@ -1641,8 +1654,8 @@
   "Delete Borg target": "Eliminar destino Borg",
   "Delete Export": "Eliminar Exportar",
   "Delete Share": "Eliminar Compartir",
-  "Delete a CT (irreversible). Use the correct <ctid>": "Eliminar un CT (irreversible). Utilice el <ctid> correcto",
-  "Delete a VM (irreversible). Use the correct <vmid>": "Eliminar una VM (irreversible). Utilice el <vmid> correcto",
+  "Delete a CT (irreversible). Use the correct <ctid>": "Eliminar un CT (irreversible). Usa el <ctid> correcto",
+  "Delete a VM (irreversible). Use the correct <vmid>": "Eliminar una VM (irreversible). Usa el <vmid> correcto",
   "Delete archive": "Eliminar archivo",
   "Delete backup job": "¿Eliminar el trabajo de backup",
   "Delete it?": "¿Eliminarla?",
@@ -1679,6 +1692,7 @@
   "Detected Coral hardware:": "Hardware Coral detectado:",
   "Detected GPU(s):": "GPU detectadas:",
   "Detected Intel CPU": "CPU Intel detectada",
+  "Detected Proxmox Backup Server": "Proxmox Backup Server detectado",
   "Detected Proxmox VE": "Proxmox VE detectado",
   "Detected Proxmox VE 8.x - Installing Ceph Squid for Debian": "Proxmox VE 8.x detectado: instalación de Ceph Squid para Debian",
   "Detected Proxmox VE 9.x - Installing Ceph Squid for Debian Trixie": "Detectado Proxmox VE 9.x - Instalación de Ceph Squid para Debian Trixie",
@@ -1760,6 +1774,9 @@
   "Disabling and stopping rpcbind service and socket...": "Deshabilitar y detener el servicio y el socket rpcbind...",
   "Disabling non-free firmware warnings...": "Deshabilitando las advertencias de firmware no libre...",
   "Disabling portmapper/rpcbind for security...": "Deshabilitando portmapper/rpcbind por seguridad...",
+  "Discard changes": "Descartar cambios",
+  "Discard unapplied changes?": "¿Descartar los cambios sin aplicar?",
+  "Discover NFS exports on a server": "Descubrir los exports NFS de un servidor",
   "Discover targets on portal:": "Detectar destinos en el portal:",
   "Discovering iSCSI targets...": "Descubriendo destinos iSCSI...",
   "Discovery successful": "Detección correcta",
@@ -1839,6 +1856,7 @@
   "Do you want to proceed with the system update?": "¿Quieres continuar con la actualización del sistema?",
   "Do you want to proceed?": "¿Quieres continuar?",
   "Do you want to reboot now?": "¿Quieres reiniciar ahora?",
+  "Do you want to remove the Proxmox subscription banner from the Proxmox Backup Server web interface?": "¿Desea eliminar el banner de suscripción de Proxmox de la interfaz web de Proxmox Backup Server?",
   "Do you want to remove the stale entry from vfio.conf and continue?": "¿Quiere eliminar la entrada obsoleta de vfio.conf y continuar?",
   "Do you want to remove the stale entry from vfio.conf?": "¿Quiere eliminar la entrada obsoleta de vfio.conf?",
   "Do you want to restart the network service now to apply changes?": "¿Quieres reiniciar el servicio de red ahora para aplicar los cambios?",
@@ -1953,7 +1971,7 @@
   "Enable": "Habilitar",
   "Enable / disable job timer": "Activar/desactivar el temporizador de copias",
   "Enable High Availability services": "Activar servicios de alta disponibilidad",
-  "Enable IOMMU in GRUB or ZFS boot": "Habilite IOMMU en el arranque GRUB o ZFS",
+  "Enable IOMMU in GRUB or ZFS boot": "Activar IOMMU en el arranque GRUB o ZFS",
   "Enable IOMMU support if not enabled": "Habilite la compatibilidad con IOMMU si no está habilitado",
   "Enable IOMMU, reboot the host, and try again.": "Habilite IOMMU, reinicie el host y vuelva a intentarlo.",
   "Enable Intel/AMD VA-API video acceleration": "Activar la aceleración de vídeo VA-API de Intel/AMD",
@@ -2002,30 +2020,30 @@
   "Ensuring proxmox.sources (PVE 9, no-subscription, deb822) is present...": "Garantizar que proxmox.sources (PVE 9, sin suscripción, deb822) esté presente...",
   "Ensuring pve-enterprise.sources (PVE 9, deb822) is present...": "Garantizar que pve-enterprise.sources (PVE 9, deb822) esté presente...",
   "Enter": "Ingresar",
-  "Enter CT ID:": "Ingrese el ID de CT:",
-  "Enter MSR register (e.g. 0x10):": "Ingrese el registro MSR (por ejemplo, 0x10):",
+  "Enter CT ID:": "Introduce el ID del CT:",
+  "Enter MSR register (e.g. 0x10):": "Introduce el registro MSR (por ejemplo, 0x10):",
   "Enter NFS export path (e.g., /mnt/shared):": "Ingrese la ruta de exportación NFS (por ejemplo, /mnt/shared):",
-  "Enter NFS server IP or hostname:": "Ingrese la IP o el nombre de host del servidor NFS:",
-  "Enter NVMe device (e.g., nvme0):": "Ingrese el dispositivo NVMe (por ejemplo, nvme0):",
-  "Enter PCI BDF (e.g. 0000:01:00.0):": "Ingrese PCI BDF (por ejemplo, 0000:01:00.0):",
+  "Enter NFS server IP or hostname:": "Introduce la IP o el nombre de host del servidor NFS:",
+  "Enter NVMe device (e.g., nvme0):": "Introduce el dispositivo NVMe (por ejemplo, nvme0):",
+  "Enter PCI BDF (e.g. 0000:01:00.0):": "Introduce el BDF PCI (por ejemplo, 0000:01:00.0):",
   "Enter PCI BDF (e.g. 0000:04:00.0):": "Ingrese PCI BDF (por ejemplo, 0000:04:00.0):",
   "Enter Path": "Ingresar ruta",
   "Enter Samba server IP:": "Ingrese la IP del servidor Samba:",
   "Enter Samba share name:": "Ingrese el nombre del recurso compartido de Samba:",
   "Enter Tailscale Auth Key": "Ingrese la clave de autenticación de Tailscale",
-  "Enter VM ID:": "Introduzca el ID de la máquina virtual:",
-  "Enter VM/CT ID:": "Introduzca el ID de VM/CT:",
+  "Enter VM ID:": "Introduce el ID de la VM:",
+  "Enter VM/CT ID:": "Introduce el ID de la VM o del CT:",
   "Enter ZFS pool name for the selected disk:": "Ingrese el nombre del grupo ZFS para el disco seleccionado:",
-  "Enter a name for the mount point (used as /mnt/<name>):": "Ingrese un nombre para el punto de montaje (usado como /mnt/<nombre>):",
+  "Enter a name for the mount point (used as /mnt/<name>):": "Introduce un nombre para el punto de montaje (se usará como /mnt/<name>):",
   "Enter a name for the new virtual machine:": "Ingrese un nombre para la nueva máquina virtual:",
   "Enter a non-empty password or access token on a single line.": "Escribe una contraseña o un token de acceso, en una sola línea.",
-  "Enter a number, or write or paste a command:": "Ingrese un número, o escriba o pegue un comando:",
+  "Enter a number, or write or paste a command:": "Introduce un número, o escribe o pega un comando:",
   "Enter a systemd calendar event, e.g.:": "Introduzca un evento de calendario de systemd, por ejemplo:",
   "Enter a usable IPv4 address with its prefix, for example": "Introduzca una dirección IPv4 usable con su prefijo, por ejemplo",
   "Enter a valid registry username.": "Escribe un usuario válido para el registro.",
-  "Enter backup file (.zst):": "Ingrese el archivo de backup (.zst):",
-  "Enter backup path (.tar.zst):": "Ingrese la ruta de backup (.tar.zst):",
-  "Enter backup path (.vma.zst):": "Ingrese la ruta de backup (.vma.zst):",
+  "Enter backup file (.zst):": "Introduce el archivo de backup (.zst):",
+  "Enter backup path (.tar.zst):": "Introduce la ruta del backup (.tar.zst):",
+  "Enter backup path (.vma.zst):": "Introduce la ruta del backup (.vma.zst):",
   "Enter base folder for temporary files and converter (default:": "Ingrese la carpeta base para archivos temporales y convertidor (predeterminado:",
   "Enter boot target (e.g. scsi0, sata0, ide0):": "Ingrese el destino de inicio (por ejemplo, scsi0, sata0, ide0):",
   "Enter content types (comma-separated):": "Introduzca los tipos de contenido (separados por comas):",
@@ -2038,30 +2056,30 @@
   "Enter custom pathr": "Ingrese una ruta personalizada",
   "Enter destination directory for exported file(s):": "Ingrese el directorio de destino para los archivos exportados:",
   "Enter destination path for ISO file": "Ingrese la ruta de destino para el archivo ISO",
-  "Enter destination path:": "Introduzca la ruta de destino:",
-  "Enter device (e.g., sda or nvme0):": "Ingrese el dispositivo (por ejemplo, sda o nvme0):",
+  "Enter destination path:": "Introduce la ruta de destino:",
+  "Enter device (e.g., sda or nvme0):": "Introduce el dispositivo (por ejemplo, sda o nvme0):",
   "Enter directory containing OVA/OVF files:": "Ingrese al directorio que contiene los archivos OVA/OVF:",
   "Enter directory path:": "Introduzca la ruta del directorio:",
-  "Enter disk image path:": "Ingrese la ruta de la imagen del disco:",
+  "Enter disk image path:": "Introduce la ruta de la imagen de disco:",
   "Enter disk or partition path (prefer /dev/disk/by-id/...):": "Ingrese la ruta del disco o la partición (prefiera /dev/disk/by-id/...):",
-  "Enter domain name:": "Introduzca el nombre de dominio:",
-  "Enter domain:": "Introduzca el dominio:",
+  "Enter domain name:": "Introduce el nombre de dominio:",
+  "Enter domain:": "Introduce el dominio:",
   "Enter filesystem (ext4/xfs/btrfs):": "Ingrese al sistema de archivos (ext4/xfs/btrfs):",
   "Enter folder name for /mnt:": "Ingrese el nombre de la carpeta para /mnt:",
-  "Enter full disk path as shown above (starting with /dev/disk/by-id/xxx...):": "Ingrese la ruta completa del disco como se muestra arriba (comenzando con /dev/disk/by-id/xxx...):",
+  "Enter full disk path as shown above (starting with /dev/disk/by-id/xxx...):": "Introduce la ruta completa del disco tal como aparece arriba (empieza por /dev/disk/by-id/xxx...):",
   "Enter full path for mount point:": "Ingrese la ruta completa para el punto de montaje:",
-  "Enter full path to the disk image (e.g., /var/lib/vz/images/xyz.img):": "Ingrese la ruta completa a la imagen del disco (por ejemplo, /var/lib/vz/images/xyz.img):",
-  "Enter full path to the input image (e.g., /var/lib/vz/images/disk.vmdk):": "Ingrese la ruta completa a la imagen de entrada (por ejemplo, /var/lib/vz/images/disk.vmdk):",
+  "Enter full path to the disk image (e.g., /var/lib/vz/images/xyz.img):": "Introduce la ruta completa de la imagen de disco (por ejemplo, /var/lib/vz/images/xyz.img):",
+  "Enter full path to the input image (e.g., /var/lib/vz/images/disk.vmdk):": "Introduce la ruta completa de la imagen de entrada (por ejemplo, /var/lib/vz/images/disk.vmdk):",
   "Enter full path:": "Ingrese la ruta completa:",
   "Enter host IP (e.g., 192.168.0.100):": "Ingrese la IP del host (por ejemplo, 192.168.0.100):",
-  "Enter host or IP:": "Ingrese el host o IP:",
-  "Enter hostpci slot (e.g. 0):": "Ingrese la ranura hostpci (por ejemplo, 0):",
+  "Enter host or IP:": "Introduce el host o la IP:",
+  "Enter hostpci slot (e.g. 0):": "Introduce el slot hostpci (por ejemplo, 0):",
   "Enter hostpci slot number (e.g. 0):": "Ingrese el número de ranura hostpci (por ejemplo, 0):",
   "Enter iSCSI target portal IP or hostname:": "Ingrese la IP o el nombre de host del portal de destino iSCSI:",
   "Enter image full path:": "Ingrese la ruta completa de la imagen:",
   "Enter imported disk reference (e.g. local-lvm:vm-100-disk-0):": "Ingrese la referencia del disco importado (por ejemplo, local-lvm:vm-100-disk-0):",
   "Enter interface (sata/scsi/virtio/ide):": "Ingrese a la interfaz (sata/scsi/virtio/ide):",
-  "Enter interface name (e.g. eth0):": "Ingrese el nombre de la interfaz (por ejemplo, eth0):",
+  "Enter interface name (e.g. eth0):": "Introduce el nombre de la interfaz (por ejemplo, eth0):",
   "Enter mount path on host:": "Ingrese la ruta de montaje en el host:",
   "Enter mount point in CT (e.g. /mnt/data):": "Ingrese el punto de montaje en CT (por ejemplo, /mnt/data):",
   "Enter mp slot number (e.g. 0):": "Ingrese el número de ranura mp (por ejemplo, 0):",
@@ -2073,26 +2091,26 @@
   "Enter password for": "Introduzca la contraseña para",
   "Enter password:": "Introduzca la contraseña:",
   "Enter path manually": "Ingrese la ruta manualmente",
-  "Enter path to analyze:": "Ingrese la ruta a analizar:",
+  "Enter path to analyze:": "Introduce la ruta que quieres analizar:",
   "Enter path:": "Introduzca la ruta:",
-  "Enter pool name to clear errors:": "Ingrese el nombre del grupo para borrar errores:",
-  "Enter pool name to export:": "Ingrese el nombre del grupo para exportar:",
-  "Enter pool name to import:": "Ingrese el nombre del grupo para importar:",
-  "Enter pool name:": "Introduzca el nombre del grupo:",
-  "Enter pool/dataset name:": "Ingrese el nombre del grupo/conjunto de datos:",
-  "Enter pool/dataset to destroy:": "Ingrese el grupo/conjunto de datos para destruir:",
-  "Enter pool/dataset to mount:": "Ingrese el grupo/conjunto de datos para montar:",
+  "Enter pool name to clear errors:": "Introduce el nombre del pool cuyos errores quieres borrar:",
+  "Enter pool name to export:": "Introduce el nombre del pool que quieres exportar:",
+  "Enter pool name to import:": "Introduce el nombre del pool que quieres importar:",
+  "Enter pool name:": "Introduce el nombre del pool:",
+  "Enter pool/dataset name:": "Introduce el nombre del pool o dataset:",
+  "Enter pool/dataset to destroy:": "Introduce el pool o dataset que quieres destruir:",
+  "Enter pool/dataset to mount:": "Introduce el pool o dataset que quieres montar:",
   "Enter search term (leave empty to show all scripts):": "Ingrese el término de búsqueda (déjelo vacío para mostrar todos los scripts):",
   "Enter server IP": "Ingrese la IP del servidor",
   "Enter server IP/hostname manually": "Ingrese la IP/nombre de host del servidor manualmente",
-  "Enter server IP:": "Ingrese la IP del servidor:",
+  "Enter server IP:": "Introduce la IP del servidor:",
   "Enter slot number (e.g. 0):": "Ingrese el número de ranura (por ejemplo, 0):",
   "Enter storage ID for Proxmox:": "Ingrese el ID de almacenamiento para Proxmox:",
-  "Enter storage ID:": "Ingrese el ID de almacenamiento:",
-  "Enter storage name:": "Introduzca el nombre del almacenamiento:",
+  "Enter storage ID:": "Introduce el ID del almacenamiento:",
+  "Enter storage name:": "Introduce el nombre del almacenamiento:",
   "Enter subnet (e.g., 192.168.0.0/24):": "Ingrese la subred (por ejemplo, 192.168.0.0/24):",
   "Enter target disk (e.g. /dev/sdX):": "Ingrese el disco de destino (por ejemplo, /dev/sdX):",
-  "Enter target storage name (e.g., local-lvm):": "Ingrese el nombre del almacenamiento de destino (por ejemplo, local-lvm):",
+  "Enter target storage name (e.g., local-lvm):": "Introduce el nombre del almacenamiento de destino (por ejemplo, local-lvm):",
   "Enter target storage:": "Ingrese el almacenamiento de destino:",
   "Enter the BORG REPOKEY passphrase for target:": "Ingrese la frase de contraseña de BORG REPOKEY para el destino:",
   "Enter the Samba username:": "Ingrese el nombre de usuario de Samba:",
@@ -2101,14 +2119,14 @@
   "Enter the full path to the directory containing disk images:": "Ingrese la ruta completa al directorio que contiene las imágenes del disco:",
   "Enter the full path to the host directory:": "Ingrese la ruta completa al directorio del host:",
   "Enter the full path to the host folder:": "Ingrese la ruta completa a la carpeta del host:",
-  "Enter the full path to the output image (e.g., /var/lib/vz/images/output.qcow2):": "Ingrese la ruta completa a la imagen de salida (por ejemplo, /var/lib/vz/images/output.qcow2):",
+  "Enter the full path to the output image (e.g., /var/lib/vz/images/output.qcow2):": "Introduce la ruta completa de la imagen de salida (por ejemplo, /var/lib/vz/images/output.qcow2):",
   "Enter the host mount path:": "Ingrese la ruta de montaje del host:",
   "Enter the iperf3 server IP or hostname:": "Ingrese la IP o el nombre de host del servidor iperf3:",
   "Enter the maximum size (in MB) to allocate for /var/log in RAM (e.g. 128, 256, 512):": "Ingrese el tamaño máximo (en MB) para asignar para /var/log en la RAM (por ejemplo, 128, 256, 512):",
   "Enter the mount point for the NFS export (e.g., /mnt/mynfs):": "Ingrese el punto de montaje para la exportación NFS (por ejemplo, /mnt/mynfs):",
   "Enter the mount point for the shared folder (e.g., /mnt/myshare):": "Ingrese el punto de montaje para la carpeta compartida (por ejemplo, /mnt/myshare):",
   "Enter the mount point inside the CT for": "Introduzca el punto de montaje dentro del CT para",
-  "Enter the number or type the interface name:": "Ingrese el número o escriba el nombre de la interfaz:",
+  "Enter the number or type the interface name:": "Introduce el número o escribe el nombre de la interfaz:",
   "Enter the password for Samba user:": "Ingrese la contraseña para el usuario de Samba:",
   "Enter the recovery passphrase set when the keyfile was created:": "Ingrese la frase de contraseña de recuperación establecida cuando se creó el archivo de claves:",
   "Enter the size in whole GB, for example": "Introduzca el tamaño en GB enteros, por ejemplo",
@@ -2159,11 +2177,11 @@
   "Example: cp /etc/pve/lxc/114.conf /etc/pve/lxc/114.conf.bak": "Ejemplo: cp /etc/pve/lxc/114.conf /etc/pve/lxc/114.conf.bak",
   "Example: daily or Mon..Fri 03:00": "Ejemplo: diario o lunes a viernes 03:00",
   "Example: mkdir -p /tmp/lxc_convert_114": "Ejemplo: mkdir -p /tmp/lxc_convert_114",
-  "Example: pct config 110 | grep unprivileged": "Ejemplo: configuración pct 110 | grep sin privilegios",
-  "Example: pct stop 110": "Ejemplo: parada pct 110",
-  "Example: pct stop 114": "Ejemplo: parada pct 114",
+  "Example: pct config 110 | grep unprivileged": "Ejemplo: pct config 110 | grep unprivileged",
+  "Example: pct stop 110": "Ejemplo: pct stop 110",
+  "Example: pct stop 114": "Ejemplo: pct stop 114",
   "Example: pvesm add nfs nfs-nas --server 192.168.1.50 --export /volume1/proxmox --content import,backup": "Ejemplo: pvesm add nfs nfs-nas --server 192.168.1.50 --export /volume1/proxmox --content import,backup",
-  "Example: pvesm path local-lvm:vm-114-disk-0": "Ejemplo: ruta pvesm local-lvm:vm-114-disk-0",
+  "Example: pvesm path local-lvm:vm-114-disk-0": "Ejemplo: pvesm path local-lvm:vm-114-disk-0",
   "Example: sed -i '/^unprivileged: 1/d' /etc/pve/lxc/110.conf": "Ejemplo: sed -i '/^sin privilegios: 1/d' /etc/pve/lxc/110.conf",
   "Examples:": "Ejemplos:",
   "Execute destructive rollback?": "¿Ejecutar el rollback destructivo?",
@@ -2263,6 +2281,7 @@
   "Failed to clone log2ram repository. Check /tmp/log2ram_install.log": "No se pudo clonar el repositorio log2ram. Compruebe /tmp/log2ram_install.log",
   "Failed to configure EFI disk": "No se pudo configurar el disco EFI",
   "Failed to configure IOMMU automatically.": "No se pudo configurar IOMMU automáticamente.",
+  "Failed to configure Proxmox Backup Server repositories": "No se han podido configurar los repositorios de Proxmox Backup Server",
   "Failed to configure Proxmox repositories": "No se pudieron configurar los repositorios de Proxmox",
   "Failed to configure TPM device in VM": "No se pudo configurar el dispositivo TPM en VM",
   "Failed to configure repositories.": "No se pudieron configurar los repositorios.",
@@ -2409,13 +2428,13 @@
   "Fastfetch installed successfully": "Fastfetch se instaló correctamente",
   "Fastfetch is not installed correctly.": "Fastfetch no está instalado correctamente.",
   "Fastfetch is not installed.": "Fastfetch no está instalado.",
-  "Fastfetch is not installed. Run: apt install fastfetch": "Fastfetch no está instalado. Ejecute: apt install fastfetch",
+  "Fastfetch is not installed. Run: apt install fastfetch": "Fastfetch no está instalado. Ejecuta: apt install fastfetch",
   "Fastfetch now displays: System optimised by: ProxMenux": "Fastfetch ahora muestra: Sistema optimizado por: ProxMenux",
   "Fastfetch removed from system": "Fastfetch eliminado del sistema",
   "Fastfetch will start automatically in the console": "Fastfetch se iniciará automáticamente en la consola",
   "Ferdium is a desktop app that helps you organize how you use your favourite apps by combining them into one application.": "Ferdium es una aplicación de escritorio que te ayuda a organizar el uso de tus aplicaciones favoritas reuniéndolas en una sola.",
   "Fetching NVIDIA driver versions supported by your GPU...": "Obteniendo versiones del controlador NVIDIA compatibles con su GPU...",
-  "Figurine installation and configuration completed successfully.": "La instalación y configuración deFigurine se completó con éxito.",
+  "Figurine installation and configuration completed successfully.": "La instalación y configuración de Figurine se completó correctamente.",
   "Figurine is not installed.": "Figurine no está instalado.",
   "Figurine removed from system": "Figurine desinstalado del sistema",
   "File bind mounts do not support spaces:": "Los bind mounts de archivo no admiten espacios:",
@@ -2474,7 +2493,7 @@
   "For a consistent export, the VM should be stopped.": "Para una exportación consistente, se debe detener la VM.",
   "For any question, issue or bug report, please use the official repository": "Para cualquier pregunta, problema o informe de error, utilice el repositorio oficial",
   "For dedicated GPUs, FLR is required by this policy to reduce VM": "Para GPU dedicadas, esta política requiere FLR para reducir la VM",
-  "For example: pct enter 101": "Por ejemplo: pct introduzca 101",
+  "For example: pct enter 101": "Por ejemplo: pct enter 101",
   "For guest shares add: --options guest": "Para recursos compartidos de invitado añada: --options guest",
   "For security reasons, the system cannot format it.": "Por razones de seguridad, el sistema no puede formatearlo.",
   "For unprivileged containers, use instead:": "Para contenedores sin privilegios, utilice en su lugar:",
@@ -2483,8 +2502,8 @@
   "Force NFSv3:": "Forzar NFSv3:",
   "Force NFSv4:": "Forzar NFSv4:",
   "Force stop VM now?": "¿Forzar la detención de VM ahora?",
-  "Force stop a container. Use the correct <ctid>": "Forzar la parada de un contenedor. Utilice el <ctid> correcto",
-  "Force stop a virtual machine. Use the correct <vmid>": "Forzar la detención de una máquina virtual. Utilice el <vmid> correcto",
+  "Force stop a container. Use the correct <ctid>": "Forzar la parada de un contenedor. Usa el <ctid> correcto",
+  "Force stop a virtual machine. Use the correct <vmid>": "Forzar la parada de una VM. Usa el <vmid> correcto",
   "Forcing removal...": "Forzando la eliminación...",
   "Format / Wipe Physical Disk (Safe)": "Formatear/borrar disco físico (seguro)",
   "Format Mode": "Modo de formato",
@@ -2970,6 +2989,7 @@
   "Inaccessible device during VM startup": "Dispositivo inaccesible durante el inicio de la VM",
   "Inactive": "Inactivo",
   "Inactive (entry in fstab, not currently mounted)": "Inactivo (entrada en fstab, no montado actualmente)",
+  "Include these changes in oci-compose?": "¿Incluir estos cambios en el oci-compose?",
   "Include these resources in oci-compose?": "¿Incorporar estos recursos al oci-compose?",
   "Includes /etc/network (may drop SSH immediately)": "Incluye /etc/network (puede eliminar SSH inmediatamente)",
   "Includes /etc/zfs": "Incluye /etc/zfs",
@@ -3206,6 +3226,8 @@
   "Invalid ALLOWED_HOSTS value": "Valor inválido ALLOWED_HOSTS",
   "Invalid Home Assistant OS check timeout": "Inválido Home Assistant OS check timeout",
   "Invalid ID": "ID no válida",
+  "Invalid IPv4 address": "Dirección IPv4 no válida",
+  "Invalid IPv4 gateway": "Puerta de enlace IPv4 no válida",
   "Invalid Intel render path": "Ruta de renderización Intel no válida",
   "Invalid Jellyfin path:": "Camino inválido Jellyfin:",
   "Invalid MAC address:": "Dirección MAC inválida:",
@@ -3238,6 +3260,7 @@
   "Invalid administrator email": "Correo electrónico del administrador inválido",
   "Invalid administrator user name": "Nombre del usuario del administrador inválido",
   "Invalid base VMID": "Base inválida VMID",
+  "Invalid bridge": "Puente no válido",
   "Invalid check package:": "Paquete de comprobación inválido:",
   "Invalid configuration path:": "Vía de configuración inválida:",
   "Invalid consume/export volumes": "Volumen de consumo/exportación inválidos",
@@ -3301,6 +3324,7 @@
   "Invalid remote name": "Nombre remoto inválido",
   "Invalid remote path": "Camino remoto inválido",
   "Invalid repair version:": "Versión de reparación inválida:",
+  "Invalid resource value": "Valor de recursos no válido",
   "Invalid resources": "Recursos inválidos",
   "Invalid restored volume path": "Camino de volumen restaurado inválido",
   "Invalid running state": "Estado de funcionamiento inválido",
@@ -3319,6 +3343,7 @@
   "Invalid stack members": "Miembros de pila no válidos",
   "Invalid stack name": "Nombre de pila no válido",
   "Invalid stack operation": "Operación de pila no válida",
+  "Invalid storage": "Almacenamiento no válido",
   "Invalid storage ID. Use only letters, numbers, hyphens and underscores.": "ID de almacenamiento no válido. Utilice únicamente letras, números, guiones y guiones bajos.",
   "Invalid storage name": "Nombre de almacenamiento no válido",
   "Invalid suite application": "Aplicación de suite inválida",
@@ -3590,7 +3615,7 @@
   "Lynis is a security auditing tool that performs comprehensive system scans including:": "Lynis es una herramienta de auditoría de seguridad que realiza análisis completos del sistema que incluyen:",
   "Lynis is currently installed.": "Lynis está instalado actualmente.",
   "Lynis is not installed on this system.": "Lynis no está instalado en este sistema.",
-  "Lynis is not installed. Run: apt install lynis": "Lynis no está instalado. Ejecute: apt install lynis",
+  "Lynis is not installed. Run: apt install lynis": "Lynis no está instalado. Ejecuta: apt install lynis",
   "Lynis is ready to use": "Lynis está listo para usar",
   "Lynis updated to version:": "Lynis actualizado a la versión:",
   "Lynis version:": "Versión Lynis:",
@@ -4148,6 +4173,7 @@
   "No active Proxmox storage accepts OCI template archives.": "Ningún almacenamiento activo de Proxmox acepta archivos de plantilla OCI.",
   "No active exports or showmount not available": "No hay exportaciones activas o showmount no disponible",
   "No active session": "Ninguna sesión activa",
+  "No active subscription and no usable PBS repository. Noninteractive mode cannot change APT sources; configure them in Administration > Repositories.": "No hay suscripción activa ni un repositorio de PBS utilizable. El modo no interactivo no puede cambiar las fuentes de APT; configúrelas en Administration > Repositories.",
   "No active subscription and no usable PVE repository. Noninteractive mode cannot change APT sources; configure them in Node > Updates > Repositories.": "No hay suscripción activa ni un repositorio de PVE utilizable. El modo no interactivo no puede cambiar las fuentes de APT; configúralas en Nodo > Actualizaciones > Repositorios.",
   "No additional GPU can be added.": "No se puede agregar ninguna GPU adicional.",
   "No additional device needs to be added.": "No es necesario agregar ningún dispositivo adicional.",
@@ -4252,6 +4278,7 @@
   "No password provided.": "No se proporcionó contraseña.",
   "No paths available": "No hay rutas disponibles",
   "No paths selected. Select at least one path.": "No hay rutas seleccionadas. Seleccione al menos una ruta.",
+  "No pending changes": "No hay cambios pendientes",
   "No pending paths to schedule for reboot.": "No hay rutas pendientes para programar el reinicio.",
   "No permanent NFS mounts configured.": "No se han configurado montajes NFS permanentes.",
   "No permanent Samba mounts configured.": "No hay montajes Samba permanentes configurados.",
@@ -4390,6 +4417,7 @@
   "OVH RTM removed (Puppet artefacts may need manual cleanup)": "OVH RTM eliminado (los artefactos de las marionetas pueden necesitar una limpieza manual)",
   "OVH server detected": "Servidor OVH detectado",
   "OVH server detection and RTM installation process completed": "Finalizado el proceso de detección del servidor OVH e instalación de RTM",
+  "Object detector": "Detector de objetos",
   "Object detector for Frigate": "Detector de objetos para Frigate",
   "Observer is not responding on port 4357": "El observador no responde en el puerto 4357",
   "Obsidian is a note-taking app that lets you create, link, and organize your notes on your device, with hundreds of plugins and themes to customize your workflow. You can also publish your notes online, access them offline, and sync them securely with end-to-end encryption.": "Obsidian es una aplicación de notas que te permite crear, enlazar y organizar tus notas en tu dispositivo, con cientos de plugins y temas para personalizar tu flujo de trabajo. También puedes publicar tus notas en línea, acceder a ellas sin conexión y sincronizarlas de forma segura con cifrado de extremo a extremo.",
@@ -4515,11 +4543,17 @@
   "PBS backup error log": "Log de errores de backup de PBS",
   "PBS backup failed.": "El backup de PBS falló.",
   "PBS certificate": "Certificado PBS",
+  "PBS datastores": "Datastores de PBS",
   "PBS encryption keyfile (show / replace / remove)": "Archivo de claves de cifrado PBS (mostrar/reemplazar/eliminar)",
   "PBS encryption keyfile — detailed info": "Archivo de claves de cifrado PBS: información detallada",
   "PBS extraction failed": "Error en la extracción de PBS",
   "PBS host or IP address:": "Host de PBS o dirección IP:",
+  "PBS package update": "Actualización de paquetes de PBS",
+  "PBS package upgrade completed. Check whether a reboot is required before your next backup window.": "Actualización de paquetes de PBS completada. Comprueba si hace falta reiniciar antes de la próxima ventana de backups.",
+  "PBS package upgrade failed. Review the APT output before retrying.": "La actualización de paquetes de PBS ha fallado. Revisa la salida de APT antes de volver a intentarlo.",
   "PBS upload": "Subida a PBS",
+  "PBS version and packages": "Versión y paquetes de PBS",
+  "PBS: using the configured APT repositories without changing sources.": "PBS: se utilizan los repositorios de APT configurados sin cambiar las fuentes.",
   "PCI Address": "Dirección PCI",
   "PCI passthrough, TPM state, cloud-init configuration, Proxmox hooks": "Passthrough PCI, estado de TPM, configuración de cloud-init, hooks de Proxmox",
   "PCI passthrough, TPM state, cloud-init, snapshots, Proxmox-specific hooks": "Passthrough PCI, estado de TPM, cloud-init, instantáneas, hooks específicos de Proxmox",
@@ -4753,9 +4787,9 @@
   "Preserving logs to /var/log.hdd before unmounting...": "Preservando logs en /var/log.hdd antes de desmontar...",
   "Press 'q' to exit": "Presione 'q' para salir",
   "Press Ctrl+C to stop the server and return to menu.": "Presione Ctrl+C para detener el servidor y regresar al menú.",
-  "Press ENTER to continue...": "Presione ENTER para continuar...",
-  "Press ENTER to return to the menu...": "Presione ENTER para regresar al menú...",
-  "Press ENTER to return...": "Presione ENTER para regresar...",
+  "Press ENTER to continue...": "Pulsa Intro para continuar...",
+  "Press ENTER to return to the menu...": "Pulsa Intro para volver al menú...",
+  "Press ENTER to return...": "Pulsa Intro para volver...",
   "Press Enter to close...": "Presione Entrar para cerrar...",
   "Press Enter to continue": "Presione Entrar para continuar",
   "Press Enter to continue...": "Presione Entrar para continuar...",
@@ -4855,12 +4889,17 @@
   "Proxmology logo applied": "Logotipo de Proxmology aplicado",
   "Proxmox 9 system update allready": "Actualización del sistema Proxmox 9 ya",
   "Proxmox APT repositories configured": "Repositorios Proxmox APT configurados",
+  "Proxmox Backup Server": "Proxmox Backup Server",
   "Proxmox Backup Server (PBS) destinations": "Destinos de Proxmox Backup Server (PBS)",
+  "Proxmox Backup Server APT repositories configured": "Repositorios APT de Proxmox Backup Server configurados",
+  "Proxmox Backup Server Update": "Actualización de Proxmox Backup Server",
+  "Proxmox Backup Server update completed.": "Actualización de Proxmox Backup Server completada.",
   "Proxmox CIFS Storage Status:": "Estado de almacenamiento CIFS de Proxmox:",
   "Proxmox NFS Storage Status:": "Estado de almacenamiento NFS de Proxmox:",
   "Proxmox System Update": "Actualización del sistema Proxmox",
   "Proxmox Update": "Actualización de Proxmox",
   "Proxmox VE": "Proxmox VE",
+  "Proxmox VE 8 package upgrade failed. Review the APT output before retrying.": "La actualización de paquetes de Proxmox VE 8 ha fallado. Revisa la salida de APT antes de volver a intentarlo.",
   "Proxmox VE 8 system update completed successfully": "La actualización del sistema Proxmox VE 8 se completó con éxito",
   "Proxmox VE 8 to 9 Manual Upgrade Guide": "Guía de actualización manual de Proxmox VE 8 a 9",
   "Proxmox VE 9.x no-subscription repository created": "Se creó el repositorio sin suscripción Proxmox VE 9.x",
@@ -4868,6 +4907,7 @@
   "Proxmox VE configuration completed.": "Configuración de Proxmox VE completada.",
   "Proxmox VE safe update completed": "Actualización segura de Proxmox VE completada",
   "Proxmox auth logger service created and started": "Servicio de registro de autenticación Proxmox creado e iniciado",
+  "Proxmox could not apply the container settings": "Proxmox no ha podido aplicar los ajustes del contenedor",
   "Proxmox enterprise repo might be missing or inaccessible. Trying to switch to no-subscription...": "Es posible que falte el repositorio empresarial de Proxmox o que no se pueda acceder a él. Intentando cambiar a sin suscripción...",
   "Proxmox filter configured": "Filtro Proxmox configurado",
   "Proxmox iSCSI Storage Status:": "Estado de almacenamiento Proxmox iSCSI:",
@@ -4984,6 +5024,7 @@
   "Rebuilding initramfs to apply nouveau blacklist before installation...": "Reconstruyendo initramfs para aplicar la lista negra de nouveau antes de la instalación...",
   "Rebuilding the container and recovering it from its backup are tested on the same image; the first update to a newer image is still to be observed.": "La reconstrucción del contenedor y su recuperación desde el backup están probadas con la misma imagen; la primera actualización a una imagen más nueva está aún por observar.",
   "Recent": "Reciente",
+  "Recent PBS tasks": "Tareas recientes de PBS",
   "Recent Samba Servers": "Servidores Samba recientes",
   "Recent Samba server": "Servidor Samba reciente",
   "Recent logs:": "Logs recientes:",
@@ -5036,6 +5077,7 @@
   "Recreating the container...": "Recreando el contenedor...",
   "Recreating the container:": "Recreando el contenedor:",
   "Refresh APT index and verify repositories:": "Actualizar el índice APT y verificar los repositorios:",
+  "Refresh the configured APT repositories and review the PBS package upgrade? Repository files will be preserved.": "¿Actualizar los índices de los repositorios de APT configurados y revisar la actualización de paquetes de PBS? Se conservarán los archivos de los repositorios.",
   "Refresh token of the connector, from the Twingate admin console": "Token de renovación del conector, de la consola de administración de Twingate",
   "Refresh your browser (Ctrl+Shift+R) to see changes": "Actualiza tu navegador (Ctrl+Shift+R) para ver los cambios",
   "Refresh your browser to see changes (server restart may be required)": "Actualice su navegador para ver los cambios (es posible que sea necesario reiniciar el servidor)",
@@ -5061,10 +5103,10 @@
   "Reinstalling": "Reinstalando",
   "Reinstalling core Proxmox packages...": "Reinstalando los paquetes principales de Proxmox...",
   "Relative CPU priority (cpuunits)": "Prioridad relativa de la CPU (cpuunits)",
-  "Release Channel": "Canal de release",
-  "Release channel set to Beta.": "Canal de release establecido en Beta.",
-  "Release channel set to Stable.": "Canal de release establecido en Estable.",
-  "Release channel:": "Canal de release:",
+  "Release Channel": "Canal de versiones",
+  "Release channel set to Beta.": "Canal de versiones establecido en Beta.",
+  "Release channel set to Stable.": "Canal de versiones establecido en Estable.",
+  "Release channel:": "Canal de versiones:",
   "Reload Proxmox firewall rules": "Recargar las reglas del cortafuegos de Proxmox",
   "Reload network configuration (ifupdown2)": "Recargar la configuración de red (ifupdown2)",
   "Remapped Users:": "Usuarios reasignados:",
@@ -5125,6 +5167,8 @@
   "Remove saved credentials": "Eliminar las credenciales guardadas",
   "Remove subscription banner": "Eliminar banner de suscripción",
   "Remove the application? Its container disks are deleted, and only a backup can bring them back.": "¿Eliminar la aplicación? Los discos de sus contenedores se eliminan y solo un backup puede recuperarlos.",
+  "Remove the lock left on a VM by an interrupted task": "Quitar el bloqueo que deja en una VM una tarea interrumpida",
+  "Remove the lock left on a container by an interrupted task": "Quitar el bloqueo que deja en un contenedor una tarea interrumpida",
   "Remove the saved credentials for {registry}?\nRunning apps will keep working.": "¿Eliminar las credenciales guardadas de {registry}?\nLas aplicaciones en marcha seguirán funcionando.",
   "Remove the unprivileged flag from configuration:": "Elimine el flag unprivileged de la configuración:",
   "Remove unused packages and their config": "Eliminar paquetes no utilizados y su configuración",
@@ -5194,7 +5238,7 @@
   "Replace": "Reemplazar",
   "Replace <container-id> with the actual ID.": "Reemplace <container-id> con el ID real.",
   "Replace <container-id> with your actual container ID": "Reemplace <container-id> con su ID de contenedor real",
-  "Replace <storage-identifier> with the value from step 4": "Reemplace <identificador-de-almacenamiento> con el valor del paso 4",
+  "Replace <storage-identifier> with the value from step 4": "Sustituye <storage-identifier> por el valor del paso 4",
   "Replace invalid port(s)": "Reemplazar puerto(s) no válido(s)",
   "Replace it?": "¿Reemplazarlo?",
   "Replace paths with your actual values from step 5": "Reemplace las rutas con sus valores reales del paso 5",
@@ -5206,6 +5250,7 @@
   "Repository helper unavailable. NVIDIA installation stopped.": "El asistente de repositorios no está disponible. La instalación de NVIDIA se ha detenido.",
   "Repository policy returned an unexpected result.": "La política de repositorios ha devuelto un resultado inesperado.",
   "Repository ready.": "Repositorio listo.",
+  "Repository sources changed, but APT package-list refresh failed. Operation stopped; sources were not rolled back. Inspect Administration > Repositories and retry apt-get update before continuing.": "Las fuentes de repositorio han cambiado, pero la actualización de la lista de paquetes de APT ha fallado. Operación detenida; las fuentes no se han revertido. Revise Administration > Repositories y vuelva a ejecutar apt-get update antes de continuar.",
   "Repository sources changed, but APT package-list refresh failed. Operation stopped; sources were not rolled back. Inspect Node > Updates > Repositories and retry apt-get update before continuing.": "Las fuentes de los repositorios han cambiado, pero la actualización de la lista de paquetes de APT ha fallado. La operación se ha detenido; las fuentes no se han revertido. Revisa Nodo > Actualizaciones > Repositorios y vuelve a ejecutar apt-get update antes de continuar.",
   "Repository switch declined; no APT source changed.": "Cambio de repositorio rechazado; no se ha modificado ninguna fuente de APT.",
   "Repository:": "Repositorio:",
@@ -5232,7 +5277,7 @@
   "Resources": "Recursos",
   "Restart Network": "Reiniciar la red",
   "Restart Network Service": "Reiniciar el servicio de red",
-  "Restart Web UI proxy": "Reinicie el proxy de la interfaz de usuario web",
+  "Restart Web UI proxy": "Reiniciar el proxy de la interfaz web",
   "Restart aMule automatically on a schedule (true or false)": "Reiniciar aMule automáticamente según una programación (true o false)",
   "Restart and enable Samba:": "Reinicie y habilite Samba:",
   "Restart container to activate mount?": "¿Reiniciar el contenedor para activar el montaje?",
@@ -5300,7 +5345,9 @@
   "Reverting ZFS ARC tuning...": "Revirtiendo el ajuste ZFS ARC...",
   "Reverting pigz wrapper...": "Revertir la envoltura de pigz...",
   "Reverting vzdump speed tuning...": "Revertir el ajuste de velocidad de vzdump...",
+  "Review and apply": "Revisar y aplicar",
   "Review external OCI changes": "Revisar cambios externos de OCI",
+  "Review package upgrade": "Revisar la actualización de paquetes",
   "Review passthrough config files": "Revisar los archivos de configuración de passthrough",
   "Review what will be removed": "Revisa lo que se eliminará",
   "Rip DVD and Blu-ray media from a browser": "Extrae DVD y Blu-ray desde un navegador",
@@ -5323,9 +5370,9 @@
   "Run GGUF LLMs locally with GPU acceleration": "Ejecuta LLM en formato GGUF en local con aceleración por GPU",
   "Run Now": "Ejecutar ahora",
   "Run PVE 8 to 9": "Ejecuta PVE 8 a 9",
-  "Run PVE 8 to 9 check": "Ejecute la verificación PVE 8 a 9",
+  "Run PVE 8 to 9 check": "Ejecutar la comprobación de PVE 8 a 9",
   "Run \\\"Install NVIDIA Drivers on Host\\\" first so the installer is cached.": "Primero ejecute \\\"Instalar controladores NVIDIA en el host\\\" para que el instalador se almacene en caché.",
-  "Run a full security audit": "Ejecute una auditoría de seguridad completa",
+  "Run a full security audit": "Ejecutar una auditoría de seguridad completa",
   "Run a job now": "Ejecute un trabajo ahora",
   "Run apt-get install -f to complete any pending package configurations": "Ejecutar apt-get install -f para completar las configuraciones de paquetes pendientes",
   "Run as root on the Proxmox node; the registry contains private data": "Ejecutar como root en el nodo Proxmox; el registro contiene datos privados",
@@ -5341,8 +5388,9 @@
   "Run now": "Ejecutar ahora",
   "Run security audit now": "Ejecute la auditoría de seguridad ahora",
   "Run the following inside the VM:": "Ejecute lo siguiente dentro de la VM:",
-  "Run the release-channel switch from an SSH session or the Proxmox host console with:": "Ejecute el cambio de canal de release desde una sesión SSH o la consola del host Proxmox con:",
+  "Run the release-channel switch from an SSH session or the Proxmox host console with:": "Ejecuta el cambio de canal de versiones desde una sesión SSH o la consola del host Proxmox con:",
   "Run the update from an SSH session or the Proxmox host console with:": "Ejecute la actualización desde una sesión SSH o la consola del host Proxmox con:",
+  "Run this operation as root.": "Ejecuta esta operación como root.",
   "Run upgrade checklist script:": "Ejecute el script de la lista de verificación de actualización:",
   "Running": "En ejecución",
   "Running Lynis security audit...": "Ejecutando auditoría de seguridad de Lynis...",
@@ -5535,7 +5583,7 @@
   "Select Virtual Machine": "Seleccionar máquina virtual",
   "Select a Custom Logo": "Seleccione un logotipo personalizado",
   "Select a VirtIO ISO to use:": "Seleccione una ISO de VirtIO para usar:",
-  "Select a category of useful commands:": "Seleccione una categoría de comandos útiles:",
+  "Select a category of useful commands:": "Elige una categoría de comandos útiles:",
   "Select a category or search for applications:": "Seleccione una categoría o busque aplicaciones:",
   "Select a category or search for scripts:": "Seleccione una categoría o busque scripts:",
   "Select a custom ISO to use:": "Seleccione una ISO personalizada para usar:",
@@ -5577,7 +5625,7 @@
   "Select conversion guide:": "Seleccione la guía de conversión:",
   "Select conversion option:": "Seleccione la opción de conversión:",
   "Select destination": "Seleccionar destino",
-  "Select disk interface type:": "Seleccione el tipo de interfaz de disco:",
+  "Select disk interface type:": "Elige el tipo de interfaz del disco:",
   "Select driver version": "Seleccione la versión del controlador",
   "Select export format:": "Seleccione el formato de exportación:",
   "Select export permissions:": "Seleccione permisos de exportación:",
@@ -5757,6 +5805,7 @@
   "ShareCoveX panel": "Panel de ShareCoveX",
   "Shared Directory Ready:": "Directorio compartido listo:",
   "Shared Group": "Grupo compartido",
+  "Shared directories": "Directorios compartidos",
   "Shared directory created:": "Directorio compartido creado:",
   "Shared directory for consume and export": "Directorio compartido para consumo y exportación",
   "Shared directory for copy/sync operations": "Directorio compartido para operaciones de copia/sincronización",
@@ -5786,6 +5835,7 @@
   "Should show pve-manager/9.x.x": "Debería mostrar pve-manager/9.x.x",
   "Shoutrrr addresses for the notifications (optional)": "Direcciones de Shoutrrr para las notificaciones (opcional)",
   "Show All Scripts": "Mostrar todos los scripts",
+  "Show CT users and their UID/GID on the host": "Ver usuarios del CT y su UID/GID en el host",
   "Show CT users in table format": "Mostrar usuarios de CT en formato de tabla",
   "Show Container Privilege Status": "Mostrar estado de privilegios de los contenedores",
   "Show DNS resolution status": "Mostrar estado de resolución DNS",
@@ -5799,14 +5849,14 @@
   "Show Proxmox version": "Mostrar versión de Proxmox",
   "Show Routing Table": "Mostrar tabla de enrutamiento",
   "Show UUID and filesystem type of block devices": "Mostrar UUID y tipo de sistema de archivos de dispositivos de bloque",
-  "Show VM configuration. Use the correct <vmid>": "Mostrar la configuración de la máquina virtual. Utilice el <vmid> correcto",
+  "Show VM configuration. Use the correct <vmid>": "Mostrar la configuración de la VM. Usa el <vmid> correcto",
   "Show Version Information": "Mostrar información de versión",
   "Show ZFS pool status": "Mostrar el estado del grupo ZFS",
   "Show active firewall rules (iptables)": "Mostrar las reglas activas del cortafuegos (iptables)",
   "Show all active mounts from the kernel": "Mostrar todos los montajes activos del kernel",
   "Show available Proxmox upgrades": "Mostrar actualizaciones de Proxmox disponibles",
   "Show configured network bridges": "Mostrar puentes de red configurados",
-  "Show container configuration. Use the correct <ctid>": "Mostrar la configuración del contenedor. Utilice el <ctid> correcto",
+  "Show container configuration. Use the correct <ctid>": "Mostrar la configuración del contenedor. Usa el <ctid> correcto",
   "Show detailed keyfile info": "Mostrar información detallada del archivo de claves",
   "Show disk usage by mount point": "Mostrar uso del disco por punto de montaje",
   "Show jobs and last run status": "Mostrar tareas y estado de la última ejecución",
@@ -5928,8 +5978,8 @@
   "Start VM": "Iniciar máquina virtual",
   "Start VM after creation": "Iniciar VM después de la creación",
   "Start VM after creation?": "¿Iniciar VM después de la creación?",
-  "Start a container. Use the correct <ctid>": "Inicie un contenedor. Utilice el <ctid> correcto",
-  "Start a virtual machine. Use the correct <vmid>": "Inicie una máquina virtual. Utilice el <vmid> correcto",
+  "Start a container. Use the correct <ctid>": "Iniciar un contenedor. Usa el <ctid> correcto",
+  "Start a virtual machine. Use the correct <vmid>": "Iniciar una VM. Usa el <vmid> correcto",
   "Start each LXC with Proxmox (no coordinated startup)": "Iniciar cada LXC con Proxmox (sin arranque coordinado)",
   "Start long self-test (hours)": "Iniciar autotest largo (horas)",
   "Start long test now?": "¿Iniciar una prueba larga ahora?",
@@ -5948,6 +5998,7 @@
   "Start the VM to begin Windows installation from the mounted ISO.": "Inicie la VM para comenzar la instalación de Windows desde la ISO montada.",
   "Start the applications once they are registered? Answer No if the original containers are still running on another host: both would use the same addresses.": "¿Iniciar las aplicaciones una vez registradas? Responde No si los contenedores originales siguen en marcha en otro host: los dos usarían las mismas direcciones.",
   "Start the converted container:": "Inicie el contenedor convertido:",
+  "Start the interactive Proxmox package upgrade": "Iniciar la actualización interactiva de paquetes de Proxmox",
   "Start the main system upgrade:": "Inicie la actualización principal del sistema:",
   "Start the stack with Proxmox": "Iniciar la pila con Proxmox",
   "Start uploading to PBS — sets a recovery passphrase": "Empezar a subir a PBS — establece una frase de contraseña de recuperación",
@@ -6227,6 +6278,7 @@
   "The Paperless persistent volumes need at least 8 GB": "Los volúmenes persistentes de Paperless necesitan al menos 8 GB",
   "The PostgreSQL volume needs at least 4 GB": "El volumen de PostgreSQL necesita al menos 4 GB",
   "The PostgreSQL volume needs at least 8 GB": "El volumen de PostgreSQL necesita al menos 8 GB",
+  "The Proxmox VE 8 update did not finish. The upgrade to Proxmox VE 9 was not started.": "La actualización de Proxmox VE 8 no ha terminado. No se ha iniciado la actualización a Proxmox VE 9.",
   "The Proxmox archive keyring is missing; Ceph installation cannot continue safely": "Falta el conjunto de claves de archivo Proxmox; La instalación de Ceph no puede continuar de forma segura",
   "The Proxmox inventory and the local configurations differ": "El inventario de Proxmox y las configuraciones locales difieren",
   "The ROCm image has no support for the AMD GPU of this host:": "La imagen de ROCm no tiene soporte para la GPU AMD de este host:",
@@ -6295,6 +6347,7 @@
   "The build could not be checked beforehand; continuing without that check.": "La compilación no se pudo comprobar de antemano; se continúa sin esa comprobación.",
   "The cached image does not match the current digest": "La imagen en caché no coincide con el digest actual",
   "The cached image is damaged; it will be downloaded again.": "La imagen en caché está dañada; se descargará de nuevo.",
+  "The changes need the application installer": "Los cambios requieren el instalador de la aplicación",
   "The character device does not exist:": "El dispositivo de carácter no existe:",
   "The command asks for a password that is not echoed. After creating the users, the web interface asks for a user name and a password.": "El comando pide una contraseña que no se muestra al escribirla. Tras crear los usuarios, la interfaz web pide un nombre de usuario y una contraseña.",
   "The command does not name an image": "El comando no nombra ninguna imagen",
@@ -6413,8 +6466,10 @@
   "The host bind source does not exist:": "La fuente de host bind no existe:",
   "The host bind source is not a regular file or directory:": "La fuente host bind no es un archivo o directorio regular:",
   "The host directory changed before it was mounted": "El directorio host cambió antes de montarlo",
+  "The host directory does not exist": "El directorio del host no existe",
   "The host directory may not be accessible from an unprivileged container.": "Es posible que no se pueda acceder al directorio del host desde un contenedor sin privilegios.",
   "The host has no IPv4 address on the selected bridge": "El host no tiene dirección IPv4 en el puente seleccionado",
+  "The host loses access to them. If the group includes a network or storage controller the host needs, cancel at the summary.": "El host pierde el acceso a ellos. Si el grupo incluye un controlador de red o de almacenamiento que el host necesita, cancela en el resumen.",
   "The host monitor does not see the real host memory": "El monitor host no ve la memoria real del host",
   "The host monitor does not share this host namespace:": "El monitor host no comparte este espacio de nombres de host:",
   "The host monitor include is unknown or differs from the saved record": "El include del monitor del host es desconocido o difiere del registro guardado",
@@ -6598,6 +6653,7 @@
   "The repair must preserve the image dependencies:": "La reparación debe preservar las dependencias de la imagen:",
   "The requested VMID block is already in use": "El bloque VMID solicitado ya está en uso",
   "The requested machine learning GPU profile is not working; it is not replaced by CPU": "El perfil de GPU solicitado para Machine learning no funciona; no se sustituye por CPU",
+  "The resource edit could not be fully rolled back. Open Manage again to review and import the current Proxmox settings.": "El cambio de recursos no se ha podido revertir por completo. Vuelve al menú de gestión para revisar e incorporar la configuración actual de Proxmox.",
   "The restored service did not pass its health check": "El servicio restaurado no superó su comprobación de estado",
   "The restored service stopped; the recovery is not confirmed": "El servicio restaurado se detuvo; la recuperación no se confirma",
   "The reviewed Tandoor stack does not require a privileged LXC.": "La pila de Tandoor revisada no necesita un LXC privilegiado.",
@@ -6643,6 +6699,7 @@
   "The selected VM": "La máquina virtual seleccionada",
   "The selected VM is running.": "La VM seleccionada se está ejecutando.",
   "The selected base folder does not exist and could not be created:": "La carpeta base seleccionada no existe y no se pudo crear:",
+  "The selected bridge does not exist": "El puente seleccionado no existe",
   "The selected bridge has no IPv4 subnet for the host-monitor firewall": "El bridge seleccionado no tiene subred IPv4 para el cortafuegos del monitor del host",
   "The selected configuration needs to start the LXC during the installation": "La configuración seleccionada debe iniciar el LXC durante la instalación",
   "The selected container is unprivileged. A privileged container is required for direct device passthrough.": "El contenedor seleccionado no tiene privilegios. Se requiere un contenedor privilegiado para el passthrough directo de dispositivos.",
@@ -6665,6 +6722,7 @@
   "The service builds its own image; only a published image can be installed": "El servicio construye su propia imagen; solo se puede instalar una imagen publicada",
   "The service declares no image:": "El servicio no declara imagen:",
   "The setting has no final value:": "El ajuste no tiene valor final:",
+  "The settings could not be fully rolled back. Review the container and its saved modification before continuing.": "No se han podido revertir todos los ajustes. Revisa el contenedor y la modificación guardada antes de continuar.",
   "The share already exists in smb.conf:": "El recurso compartido ya existe en smb.conf:",
   "The shared destination is not a directory": "El destino compartido no es un directorio",
   "The shared directory points to a protected host path": "El directorio compartido apunta a una ruta de host protegida",
@@ -6732,18 +6790,23 @@
   "These Proxmox resources were added outside ProxMenux:": "Se añadieron estos recursos en Proxmox fuera de ProxMenux:",
   "These VMIDs are not free:": "Estos VMID no están libres:",
   "These are the changes that will be made": "Estos son los cambios que se harán",
+  "These changes were made in Proxmox outside ProxMenux:": "Estos cambios se hicieron en Proxmox fuera de ProxMenux:",
   "These container mount paths have an extension-like suffix:": "Estas rutas de montaje del contenedor tienen un sufijo parecido a una extensión:",
   "These containers were restored from a backup and this host has no record of their OCI application:": "Estos contenedores se restauraron desde un backup y este host no tiene el registro de su aplicación OCI:",
+  "These devices share the IOMMU group of the selected GPU and will be assigned to the VM with it:": "Estos dispositivos comparten el grupo IOMMU de la GPU seleccionada y se asignarán a la VM junto con ella:",
   "These host backups run with this job and expect its storage:": "Estos backups del host se ejecutan con este trabajo y esperan su almacenamiento:",
   "These interface configurations will be removed": "Estas configuraciones de interfaz serán eliminadas",
   "These manual changes cannot be adopted safely:": "Estos cambios manuales no se pueden incorporar con seguridad:",
   "These paths will not be restored live and will be extracted for manual recovery.": "Estas rutas no se restaurarán en vivo y se extraerán para su recuperación manual.",
+  "These settings require an application-specific adaptation. The image was not downloaded and the container was not recreated.": "Estos ajustes requieren una adaptación específica de la aplicación. No se ha descargado la imagen ni se ha recreado el contenedor.",
   "These values are asked during the installation:": "Estos valores se preguntan durante la instalación:",
   "They are described in the image documentation:": "Están descritos en la documentación de la imagen:",
   "They will be added to oci-compose before continuing. Unsupported or changed resources are not imported.": "Se añadirán al oci-compose antes de continuar. No se importarán recursos incompatibles o modificados.",
+  "They will be saved in oci-compose before continuing.": "Se guardarán en el oci-compose antes de continuar.",
   "This CIFS share is mounted with restrictive permissions.": "Este recurso compartido CIFS está montado con permisos restrictivos.",
   "This GPU is considered incompatible with GPU passthrough to a VM in ProxMenux.": "Esta GPU se considera incompatible con el passthrough de GPU a una VM en ProxMenux.",
   "This NFS share is fully restricted — even the host root cannot write to it.": "Este recurso compartido NFS está completamente restringido: ni siquiera la raíz del host puede escribir en él.",
+  "This Proxmox Backup Server has no active subscription, switch to the no-subscription repository? The inaccessible Enterprise PBS source will be disabled.": "Este Proxmox Backup Server no tiene una suscripción activa, ¿cambiar al repositorio sin suscripción? Se deshabilitará la fuente Enterprise de PBS, que no es accesible.",
   "This VM requires extra installation steps, see install guide at:\nhttps://github.com/community-scripts/ProxmoxVE/discussions/144": "Esta máquina virtual requiere pasos de instalación adicionales; consulte la guía de instalación en:\nhttps://github.com/community-scripts/ProxmoxVE/discussions/144",
   "This account is for {registry}. Enter an image from that registry.": "Esta cuenta es de {registry}. Escribe una imagen de ese registro.",
   "This action will:": "Esta acción:",
@@ -6805,10 +6868,13 @@
   "This may take several minutes...": "Esto puede tardar varios minutos...",
   "This means Proxmox handles mount lifecycle natively (no manual /etc/fstab needed for NFS/CIFS host storages).": "Esto significa que Proxmox maneja el ciclo de vida del montaje de forma nativa (no se necesita /etc/fstab manual para almacenamientos de host NFS/CIFS).",
   "This means the credentials are incorrect.": "Esto significa que las credenciales son incorrectas.",
+  "This menu requires Proxmox Backup Server.": "Este menú requiere Proxmox Backup Server.",
   "This might indicate network connectivity issues.": "Esto podría indicar problemas de conectividad de red.",
   "This monitor uses a privileged LXC, shares processes and network with Proxmox and disables AppArmor in the CT. It uses the IP address and firewall of the host. A compromised image could affect the host; do not expose its web UI to the Internet.": "Este monitor utiliza un LXC privilegiado, comparte procesos y red con Proxmox y deshabilita AppArmor en el CT. Utiliza la dirección IP y el cortafuegos del host. Una imagen comprometida podría afectar al host; no exponga su interfaz de usuario web a Internet.",
   "This only removes the schedule. Existing backup archives are NOT deleted.": "Solo se elimina la programación. Los backups ya hechos NO se eliminan.",
   "This operation may take several minutes and requires internet connectivity.": "Esta operación puede tardar varios minutos y requiere conexión a Internet.",
+  "This operation requires a Proxmox VE host. Use the PBS menu on Proxmox Backup Server.": "Esta operación requiere un host de Proxmox VE. Utiliza el menú de PBS en Proxmox Backup Server.",
+  "This operation supports PBS 3 on Debian 12 and PBS 4 on Debian 13.": "Esta operación admite PBS 3 en Debian 12 y PBS 4 en Debian 13.",
   "This package was installed by older versions of the ProxMenux Coral installer that placed the M.2 kernel driver on every system, including USB-only setups. It is not needed for Coral USB devices, which use libedgetpu1-std / libedgetpu1-max only.": "Este paquete fue instalado por versiones antiguas del instalador de Coral de ProxMenux, que instalaban el controlador del kernel para Coral M.2 en todos los sistemas, incluidos aquellos que solo usaban Coral USB. No es necesario para los dispositivos Coral USB, que únicamente utilizan libedgetpu1-std o libedgetpu1-max.",
   "This passphrase is the ONLY way to access encrypted Borg backups.": "Esta frase de contraseña es la ÚNICA forma de acceder a los backups cifrados de Borg.",
   "This path is already used as a mount point in this container.": "Esta ruta ya se utiliza como punto de montaje en este contenedor.",
@@ -6816,7 +6882,7 @@
   "This process changes file ownership inside the container": "Este proceso cambia la propiedad del archivo dentro del contenedor",
   "This profile only supports directory bind mounts": "Este perfil solo admite bind mounts de directorio",
   "This profile requires a privileged LXC, which reduces isolation from the host.": "Este perfil requiere un LXC privilegiado, lo que reduce el aislamiento respecto al host.",
-  "This release channel is already active.": "Este canal de release ya está activo.",
+  "This release channel is already active.": "Este canal de versiones ya está activo.",
   "This removes the 'unprivileged: 1' line from the config": "Esto elimina la línea 'sin privilegios: 1' de la configuración",
   "This removes the storage from Proxmox. The iSCSI target is not affected.": "Esto elimina el almacenamiento de Proxmox. El destino iSCSI no se ve afectado.",
   "This replaces the currently installed keyfile.": "Esto reemplaza el archivo de claves instalado actualmente.",
@@ -6824,6 +6890,7 @@
   "This script cannot be executed from the Proxmox web terminal.": "Este script no se puede ejecutar desde la terminal web de Proxmox.",
   "This script must be run as root.": "Este script debe ejecutarse como root.",
   "This script must be run on a Proxmox host.": "Este script debe ejecutarse en un host Proxmox.",
+  "This script will apply the following optimizations and advanced adjustments to your Proxmox Backup Server": "Este script aplicará las siguientes optimizaciones y ajustes avanzados a su Proxmox Backup Server",
   "This script will apply the following optimizations and advanced adjustments to your Proxmox VE server": "Este script aplicará las siguientes optimizaciones y ajustes avanzados a su servidor Proxmox VE",
   "This script will update your Proxmox VE system with advanced options:": "Este script actualizará su sistema Proxmox VE con opciones avanzadas:",
   "This session is running in the Monitor terminal. Running it from here would cut the connection mid-install and leave the switch in a broken state.": "Esta sesión se ejecuta en el terminal del Monitor. Ejecutarlo desde aquí cortaría la conexión a mitad de la instalación y dejaría el cambio en un estado roto.",
@@ -6955,6 +7022,7 @@
   "Unable to identify the root filesystem. Aborting.": "No se pudo identificar el sistema de archivos raíz. Se cancela.",
   "Unable to resolve system ZFS pool disks. Aborting.": "No se pudieron resolver los discos del pool ZFS del sistema. Se cancela.",
   "Unable to resolve system disk topology. Aborting.": "No se pudo resolver la topología de discos del sistema. Se cancela.",
+  "Unapplied changes": "Cambios sin aplicar",
   "Understand the security implications of privileged containers": "Comprender las implicaciones de seguridad de los contenedores privilegiados",
   "Unexpected Proxmox inventory; recovery blocked": "Inventario Proxmox inesperado; recuperación bloqueada",
   "Unexpected formatting directory in the new Valkey volume": "Directorio de formato inesperado en el nuevo volumen Valkey",
@@ -7054,6 +7122,7 @@
   "Unsupported OCI-LXC AppArmor profile:": "Perfil OCI-LXC sin soporte:",
   "Unsupported OCI-LXC seccomp profile:": "Perfil sin soporte OCI-LXC seccomp:",
   "Unsupported Terminal": "Terminal no compatible",
+  "Unsupported architecture for Figurine:": "Arquitectura no compatible con Figurine:",
   "Unsupported architecture:": "Arquitectura sin soporte:",
   "Unsupported backup compression": "Compresión de backup sin soporte",
   "Unsupported credential pattern:": "Patrón credential sin soporte:",
@@ -7069,6 +7138,7 @@
   "Unsupported mount type": "Tipo de montaje no compatible",
   "Unsupported mount type:": "Tipo de montaje no compatible:",
   "Unsupported native device type:": "Tipo de dispositivo nativo sin soporte:",
+  "Unsupported network settings": "Ajustes de red no compatibles",
   "Unsupported operation": "Operación sin soporte",
   "Unsupported or unknown Proxmox version; no repository changed.": "Versión de Proxmox no compatible o desconocida; no se ha modificado ningún repositorio.",
   "Unsupported output format:": "Formato de salida no admitido:",
@@ -7094,6 +7164,7 @@
   "Update NVIDIA in LXC Containers": "Actualizar NVIDIA en contenedores LXC",
   "Update OCI": "Actualizar OCI",
   "Update OCI stack": "Actualizar la pila OCI",
+  "Update PBS using configured repositories": "Actualizar PBS con los repositorios configurados",
   "Update PVE enterprise repository (Only if using enterprise):": "Actualice el repositorio empresarial PVE (solo si usa Enterprise):",
   "Update Proxmox VE Appliance Manager": "Actualizar Proxmox VE Appliance Manager",
   "Update Proxmox package lists": "Actualizar las listas de paquetes de Proxmox",
@@ -7139,13 +7210,14 @@
   "Updating kernel panic configuration...": "Actualizando la configuración de pánico del kernel...",
   "Updating package lists...": "Actualizando listas de paquetes...",
   "Updating pve-enterprise.list (if present) to Trixie...": "Actualizando pve-enterprise.list (si está presente) a Trixie...",
-  "Updating release channel configuration...": "Actualizando la configuración del canal de release...",
+  "Updating release channel configuration...": "Actualizando la configuración del canal de versiones...",
   "Updating the copy of the record...": "Actualizando la copia del registro...",
   "Upgrade Ceph to compatible version": "Actualice Ceph a una versión compatible",
   "Upgrade PVE 8 to PVE 9": "Actualizar PVE 8 a PVE 9",
   "Upgrade assistant: Proxmox VE 8 → 9 (Trixie)": "Asistente de actualización: Proxmox VE 8 → 9 (Trixie)",
   "Upgrade canceled by user": "Actualización cancelada por el usuario",
   "Upgrade one node at a time": "Actualice un nodo a la vez",
+  "Upgrade the system, offering the": "Actualizar el sistema, ofreciendo el",
   "Upgrade to Proxmox VE 9": "Actualice a Proxmox VE 9",
   "Upgrading NVIDIA utils (Arch)...": "Actualizando las utilidades de NVIDIA (Arch)...",
   "Upload an encrypted copy of the key to PBS so you can recover it on a reinstalled host with just a passphrase?": "¿Cargar una copia cifrada de la clave a PBS para poder recuperarla en un host reinstalado con solo una frase de contraseña?",
@@ -7584,6 +7656,7 @@
   "active VF(s)": "FV activas",
   "active VFs": "FV activas",
   "active Virtual Functions. Changing its driver binding would destroy every VF.": "Funciones virtuales activas. Cambiar la vinculación del controlador destruiría todos los VF.",
+  "added in Proxmox": "añadida en Proxmox",
   "after copy; source tree is incomplete.": "después de la copia; El árbol fuente está incompleto.",
   "after update.": "después de la actualización.",
   "all guests": "todas las VM y CT",
@@ -7903,7 +7976,7 @@
   "partition(s). Partition table preserved.": "partición(es). Se conserva la tabla de particiones.",
   "pasted Compose file": "archivo Compose pegado",
   "paths for next boot (/etc/pve, guests, drivers, ...)": "rutas para el próximo arranque (/etc/pve, VM y CT, controladores, ...)",
-  "pct exec authorization failed": "error en la autorización ejecutiva de PCT",
+  "pct exec authorization failed": "Ha fallado la autorización de pct exec",
   "pct push failed. Check log:": "pct push falló. Revise el log:",
   "pending (reboot required to enumerate full group)": "pendiente (es necesario reiniciar para enumerar el grupo completo)",
   "phpMyAdmin is installed with arbitrary server connections enabled: the login page has a Server field where the address of the MySQL or MariaDB server is entered, together with its user and password.": "phpMyAdmin se instala con conexiones de servidor arbitrarias habilitadas: la página de inicio de sesión tiene un campo Server donde se introduce la dirección del servidor MySQL o MariaDB, junto con su usuario y contraseña.",
@@ -7927,8 +8000,8 @@
   "pvesm command not found. This should not happen on Proxmox.": "Comando pvesm no encontrado. Esto no debería suceder en Proxmox.",
   "pvesm not available.": "pvesm no disponible.",
   "pvesm not found.": "pvesm no encontrado.",
-  "pvesm path failed, trying manual detection...": "La ruta pvesm falló, intentando la detección manual...",
-  "pvesm status failed": "el estado de pvesm falló",
+  "pvesm path failed, trying manual detection...": "Ha fallado pvesm path; intentando la detección manual...",
+  "pvesm status failed": "Ha fallado pvesm status",
   "pyLoad is a Free and Open Source download manager written in Python and designed to be extremely lightweight, easily extensible and fully manageable via web.": "pyLoad es un gestor de descargas libre y de código abierto escrito en Python, diseñado para ser muy ligero, fácil de ampliar y totalmente gestionable por web.",
   "pyLoad web interface": "Interfaz web de pyLoad",
   "qBittorrent WebUI password (user: admin)": "contraseña de qBittorrent WebUI (usuario: admin)",
@@ -7950,6 +8023,7 @@
   "remapped users": "usuarios reasignados",
   "remove the (now-empty) directory if possible": "elimine el directorio (ahora vacío) si es posible",
   "removed from Proxmox": "eliminado de Proxmox",
+  "removed in Proxmox": "eliminada en Proxmox",
   "removed successfully from Proxmox.": "eliminado correctamente de Proxmox.",
   "requires running the official installer, which restarts the Monitor service.": "requiere ejecutar el instalador oficial, que reinicia el servicio del Monitor.",
   "requires the package": "requiere el paquete",
@@ -7987,7 +8061,7 @@
   "smbclient command is not working properly.": "El comando smbclient no funciona correctamente.",
   "smbclient command not found after installation.": "El comando smbclient no se encuentra después de la instalación.",
   "sources.list update skipped (no change)": "Actualización de sources.list omitida (sin cambios)",
-  "sources.list updated to Trixie": "fuentes.lista actualizada a Trixie",
+  "sources.list updated to Trixie": "sources.list actualizado a Trixie",
   "ssh-keygen failed. Cannot create a new SSH key.": "ssh-keygen falló. No se puede crear una nueva clave SSH.",
   "stale entry/entries for interfaces no longer present": "entrada(s) obsoleta(s) de interfaces que ya no existen",
   "standard performance": "rendimiento estándar",
@@ -8053,6 +8127,7 @@
   "using": "usando",
   "using direct path (not guaranteed to survive reboots).": "utilizando una ruta directa (no se garantiza que sobreviva a los reinicios).",
   "vCPUs:": "vCPU:",
+  "value changed in Proxmox": "valor cambiado en Proxmox",
   "vfio-pci IDs configured": "ID de vfio-pci configurados",
   "vfio-pci IDs in /etc/modprobe.d/vfio.conf": "ID de vfio-pci en /etc/modprobe.d/vfio.conf",
   "video": "vídeo",
@@ -8065,6 +8140,7 @@
   "was": "era",
   "was installed, but the kernel reports:": "se instaló, pero el kernel informa:",
   "when finished": "al terminar",
+  "when the server has no subscription (you will be asked)": "cuando el servidor no tiene suscripción (se le preguntará)",
   "will rebind the GPU to vfio-pci on the next reboot, breaking the driver that is about to be installed.": "volverá a vincular la GPU a vfio-pci en el próximo reinicio, rompiendo el controlador que está a punto de instalarse.",
   "wipefs failed on": "los borrados fallaron",
   "with": "con",
diff --git a/lang/fr.json b/lang/fr.json
index db69452c..40682cd3 100644
--- a/lang/fr.json
+++ b/lang/fr.json
@@ -37,6 +37,7 @@
   "/var/lib/vz/dump   (Proxmox default vzdump path)": "/var/lib/vz/dump (chemin vzdump par défaut de Proxmox)",
   "/var/lib/vz/dump   (Proxmox default)": "/var/lib/vz/dump (Proxmox par défaut)",
   "1777 = sticky bit + rwx for all. No shared group needed.": "1777 = bit collant + rwx pour tous. Aucun groupe partagé n’est nécessaire.",
+  "====== PBS UPDATE COMPLETED ======": "====== MISE À JOUR PBS TERMINÉE ======",
   "====== PVE UPDATE COMPLETED ======": "====== MISE À JOUR PVE TERMINÉE ======",
   ">> Create a new backup job <<": ">> Créer une nouvelle tâche de sauvegarde <<",
   ">> Save and return <<": ">> Enregistrer et retourner <<",
@@ -87,6 +88,7 @@
   "A multi-container application is not recreated: its containers are updated together.": "Une application multi-conteneurs n'est pas recréée : ses conteneurs sont mis à jour ensemble.",
   "A new ProxMenux version is available:": "Une nouvelle version de ProxMenux est disponible :",
   "A new kernel is staged for the next boot:": "Un nouveau noyau est préparé pour le prochain démarrage :",
+  "A newer kernel is installed. Reboot before the next backup window to use it.": "Un noyau plus récent est installé. Redémarrez avant la prochaine fenêtre de sauvegarde pour l'utiliser.",
   "A newer version is available:": "Une version plus récente est disponible :",
   "A pending operation exists for": "Un opera en attente existe pour",
   "A pending stack assembly already exists; it is not overwritten": "Une pile en attente existe déjà; elle n'est pas écrasée",
@@ -169,6 +171,8 @@
   "APT language configuration updated": "Configuration du langage APT mise à jour",
   "APT language downloads restored": "Téléchargements de langues APT restaurés",
   "APT package lists updated": "Listes de packages APT mises à jour",
+  "APT refresh failed. Check the PBS subscription and repositories in Administration > Repositories. Log:": "L’actualisation APT a échoué. Vérifiez l'abonnement PBS et les référentiels dans Administration > Référentiels. Enregistrer:",
+  "APT refresh failed. Check the PBS subscription and repositories in the native PBS interface; no source was changed.": "Échec de l'actualisation APT. Vérifiez l'abonnement et les dépôts de PBS dans son interface native ; aucune source n'a été modifiée.",
   "APT update failed. Check repository access; NVIDIA installation stopped.": "La mise à jour APT a échoué. Vérifiez l'accès au référentiel ; l'installation de NVIDIA s'est arrêtée.",
   "Aborted": "Avorté",
   "About to restore": "Sur le point de restaurer",
@@ -297,7 +301,7 @@
   "Address of the database server (mysql and pgsql only)": "Adresse du serveur de base de données (mysql et pgsql uniquement)",
   "Address of the oci-compose file": "Adresse du fichier oci-compose",
   "Address to reach Pydio Cells (https://domain or https://IP:8080)": "Adresse pour atteindre Pydio Cells (https://domaine ou https://IP:8080)",
-  "Address used to reach wallabag (http://IP or https://wallabag.example.com)": "Adresse utilisée pour atteindre wallabag (http://IP ou https://wallabag.exemple.com)",
+  "Address used to reach wallabag (http://IP or https://wallabag.example.com)": "Adresse d’accès à wallabag (http://IP ou https://wallabag.example.com)",
   "Addresses to update: ipv4, ipv6 or both (uses an external service)": "Adresses à mettre à jour: ipv4, ipv6 ou les deux (utilise un service externe)",
   "Adguardhome Sync web interface": "Interface web Adguardhome Sync",
   "Adguardhome-sync is a tool to synchronize AdGuardHome config to replica instances.": "Adguardhome-sync est un outil pour synchroniser la configuration AdGuardHome pour reproduire des instances.",
@@ -318,7 +322,7 @@
   "After confirming, you will be asked to choose the NVIDIA driver version to install.": "Après confirmation, il vous sera demandé de choisir la version du pilote NVIDIA à installer.",
   "After detailed analysis, no changes are needed.": "Après une analyse détaillée, aucune modification n’est nécessaire.",
   "After detailed analysis, no cleanup is needed.": "Après une analyse détaillée, aucun nettoyage n’est nécessaire.",
-  "After logging in, run: ip a to obtain the IP address.\nThen, enter that IP address in your web browser like this:\n  http://IP_ADDRESS\n\nThis will open the Umbral OS dashboard.": "Après vous être connecté, exécutez : ip a pour obtenir l'adresse IP.\nEnsuite, saisissez cette adresse IP dans votre navigateur Web comme ceci :\n  http://ADRESSE_IP\n\nCela ouvrira le tableau de bord Umbral OS.",
+  "After logging in, run: ip a to obtain the IP address.\nThen, enter that IP address in your web browser like this:\n  http://IP_ADDRESS\n\nThis will open the Umbral OS dashboard.": "Après la connexion, exécutez ip a pour obtenir l’adresse IP.\nSaisissez ensuite cette adresse dans votre navigateur sous cette forme :\n  http://IP_ADDRESS\n\nLe tableau de bord Umbral OS s’ouvrira.",
   "After pasting on the server, ensure the file is chmod 600 and owned by": "Après avoir collé sur le serveur, assurez-vous que le fichier est chmod 600 et appartient à",
   "After reboot the system will be fully accessible (SSH, web UI, login), but the following components will be reinstalled in BACKGROUND — until they finish, commands like nvidia-smi may not yet be available:": "Après le redémarrage, le système sera entièrement accessible (SSH, interface utilisateur Web, connexion), mais les composants suivants seront réinstallés en ARRIÈRE-PLAN — jusqu'à ce qu'ils soient terminés, des commandes comme nvidia-smi peuvent ne pas encore être disponibles :",
   "After reboot, these components will reinstall in background:": "Après le redémarrage, ces composants seront réinstallés en arrière-plan :",
@@ -330,7 +334,7 @@
   "After this LXC → VM switch, reboot the host so the new binding state is applied cleanly.": "Après ce commutateur LXC → VM, redémarrez l'hôte afin que le nouvel état de liaison soit appliqué proprement.",
   "Airsonic Advanced web interface": "Interface web Airsonic Advanced",
   "Airsonic-advanced is a free, web-based media streamer, providing ubiquitious access to your music. Use it to share your music with friends, or to listen to your own music while at work. You can stream to multiple players simultaneously, for instance to one player in your kitchen and another in your living room.": "Airsonic-Advanced est un flux multimédia gratuit, basé sur le web, offrant un accès ubiquitious à votre musique. Utilisez-le pour partager votre musique avec des amis, ou pour écouter votre propre musique au travail. Vous pouvez diffuser simultanément vers plusieurs joueurs, par exemple vers un joueur dans votre cuisine et un autre dans votre salon.",
-  "Aliases added to .bashrc": "Alias ​​ajoutés à .bashrc",
+  "Aliases added to .bashrc": "Alias ajoutés à .bashrc",
   "Alist Sync web interface": "Alist Interface web Sync",
   "All": "Tous",
   "All Available Scripts": "Tous les scripts disponibles",
@@ -425,6 +429,7 @@
   "Apply": "Appliquer",
   "Apply AMD CPU fixes": "appliquer les correctifs du processeur AMD",
   "Apply Available Updates": "Appliquer les mises à jour disponibles",
+  "Apply PBS package upgrade": "Appliquer la mise à niveau des paquets PBS",
   "Apply and restart services:": "Appliquer et redémarrer les services :",
   "Apply available updates": "appliquer les mises à jour disponibles",
   "Apply boot/initramfs changes": "Appliquer les modifications de démarrage/initramfs",
@@ -438,12 +443,15 @@
   "Apply options from the current catalog template? New required paths and settings may be requested. Review the resulting configuration before recreating the CT.": "appliquer les options du modèle de catalogue actuel ?De nouveaux chemins et paramètres requis peuvent être demandés. Passez en revue la configuration résultante avant de recréer le CT.",
   "Apply read+write access for 'others' on the host directory?": "Appliquer un accès en lecture et en écriture aux « autres » sur le répertoire hôte ?",
   "Apply the options from the current catalog template? Your data and configuration are kept.": "Appliquer les options du modèle de catalogue actuel? Vos données et configurations sont conservées.",
+  "Apply the reviewed package upgrade now? Services may restart and packages listed for removal will be removed.": "Appliquer maintenant la mise à niveau des paquets examinée ? Des services peuvent redémarrer et les paquets indiqués pour suppression seront supprimés.",
   "Apply these changes?": "Appliquer ces modifications ?",
   "Applying AMD-specific fixes...": "Application de correctifs spécifiques à AMD...",
+  "Applying CPU and RAM changes without rebuilding the container...": "Application des modifications de CPU et de RAM sans recréer le conteneur...",
   "Applying Changes": "Application des modifications",
   "Applying Controller/NVMe passthrough to VM": "Application du relais Controller/NVMe à la VM",
   "Applying balanced memory optimization settings...": "Application des paramètres d'optimisation de la mémoire équilibrée...",
   "Applying changes safely...": "Appliquer les modifications en toute sécurité...",
+  "Applying container settings without rebuilding the container...": "Application des paramètres sans recréer le conteneur...",
   "Applying custom restore": "Application d'une restauration personnalisée",
   "Applying default VM configuration": "Application de la configuration de VM par défaut",
   "Applying host permissions for unprivileged LXC bind-mounts...": "Application des autorisations d'hôte pour les montages de liaison LXC non privilégiés...",
@@ -535,6 +543,7 @@
   "Available Borg targets:": "Cibles Borg disponibles :",
   "Available Disks on Host": "Disques disponibles sur l'hôte",
   "Available ISO Images": "Images ISO disponibles",
+  "Available PBS Version": "version PBS disponible",
   "Available PBS repositories:": "Dépôts PBS disponibles :",
   "Available PVE Version": "Version PVE disponible",
   "Available Shares:": "Actions disponibles :",
@@ -746,6 +755,7 @@
   "Cannot verify the reused disk:": "Impossible de vérifier le disque réutilisé :",
   "Cannot write the image archive to {storage}. Check storage access and mount status.": "Impossible d'écrire l'archive d'images sur {storage}. Vérifiez l'accès au stockage et l'état du montage.",
   "Capabilities cannot be kept and all dropped at the same time": "Les capacités ne peuvent être conservées et toutes abandonnées en même temps",
+  "Catalog options": "Options du catalogue",
   "Category": "Catégorie",
   "Caution: Maximum mode generates more heat.": "Attention : le mode maximum génère plus de chaleur.",
   "Ceph check skipped by user flag (--ignore-ceph-check)": "Vérification Ceph ignorée par l'indicateur utilisateur (--ignore-ceph-check)",
@@ -880,6 +890,7 @@
   "Choose a schedule (systemd calendar-event syntax):": "Choisissez un calendrier (syntaxe d'événement de calendrier systemd) :",
   "Choose a script to execute:": "Choisissez un script à exécuter :",
   "Choose a server:": "Choisissez un serveur :",
+  "Choose a setting. Changes are applied only after the final review.": "Choisissez un réglage. Les modifications ne sont appliquées qu’après la vérification finale.",
   "Choose a share to mount:": "Choisissez un partage à monter :",
   "Choose a specific supported GPU or USB node": "Choisissez un GPU ou un nœud USB pris en charge spécifique",
   "Choose action for this controller/NVMe:": "Choisissez une action pour ce contrôleur/NVMe :",
@@ -960,6 +971,7 @@
   "Code-server is VS Code running on a remote server, accessible through the browser.": "Code-serveur est VS Code fonctionnant sur un serveur distant, accessible par le navigateur.",
   "CodeProject.AI Server": "CodeProject. AI Server",
   "Command": "Commande",
+  "Command failed": "Échec de la commande",
   "Command override for an unknown service:": "Dépassement de commande pour un service inconnu :",
   "Commenting any residual Bookworm lines in *.list...": "Commenter les lignes résiduelles de Bookworm dans *.list...",
   "Commenting legacy PVE 8 repository .list files (if any)...": "Commentaire des anciens fichiers .list du référentiel PVE 8 (le cas échéant)...",
@@ -1516,6 +1528,7 @@
   "Current NVIDIA inventory resolved: a refresh is required": "L'inventaire actuel de NVIDIA résolu: un rafraîchissement est required",
   "Current NVIDIA inventory resolved: no refresh is required": "L'inventaire actuel de NVIDIA résolu: aucun rafraîchissement n'est required",
   "Current Network Configuration": "Configuration réseau actuelle",
+  "Current PBS Version": "version actuelle de PBS",
   "Current PVE Version": "Version PVE actuelle",
   "Current ProxMenux host scripts register remote shares as Proxmox storages using pvesm.": "Les scripts hôtes ProxMenux actuels enregistrent les partages distants en tant que stockages Proxmox à l'aide de pvesm.",
   "Current ProxMenux version:": "Version actuelle de ProxMenux :",
@@ -1630,8 +1643,8 @@
   "Default Proxmox logo applied": "Logo Proxmox par défaut appliqué",
   "Default is none (video-only passthrough). Use SPACE to toggle selections.": "La valeur par défaut est aucune (passthrough vidéo uniquement). Utilisez ESPACE pour basculer les sélections.",
   "Default journald configuration restored": "Configuration journald par défaut restaurée",
-  "Default location is /mnt/<name>. The share will be mounted here on the host with open permissions so an unprivileged LXC can bind-mount and write to it. For LXC access, bind-mount this path with the LXC Mount Manager.": "L'emplacement par défaut est /mnt/<nom>. Le partage sera monté ici sur l'hôte avec des autorisations ouvertes afin qu'un LXC non privilégié puisse y effectuer un montage en liaison et y écrire. Pour l'accès LXC, montez en liaison ce chemin avec le gestionnaire de montage LXC.",
-  "Default location is /mnt/<name>. The share will be mounted here on the host. Use this path in /etc/fstab. For LXC access, bind-mount this path with the LXC Mount Manager.": "L'emplacement par défaut est /mnt/<nom>. Le partage sera monté ici sur l'hôte. Utilisez ce chemin dans /etc/fstab. Pour l'accès LXC, montez en liaison ce chemin avec le gestionnaire de montage LXC.",
+  "Default location is /mnt/<name>. The share will be mounted here on the host with open permissions so an unprivileged LXC can bind-mount and write to it. For LXC access, bind-mount this path with the LXC Mount Manager.": "L’emplacement par défaut est /mnt/<name>. Le partage sera monté ici sur l’hôte avec des permissions ouvertes, afin qu’un LXC non privilégié puisse le monter par liaison et y écrire. Utilisez LXC Mount Manager pour créer ce montage dans le LXC.",
+  "Default location is /mnt/<name>. The share will be mounted here on the host. Use this path in /etc/fstab. For LXC access, bind-mount this path with the LXC Mount Manager.": "L’emplacement par défaut est /mnt/<name>. Le partage sera monté ici sur l’hôte. Utilisez ce chemin dans /etc/fstab. Pour y accéder depuis un LXC, créez un montage lié de ce chemin avec LXC Mount Manager.",
   "Default login": "Connexion par défaut",
   "Default options": "Options par défaut",
   "Default options read/write": "Options par défaut lecture/écriture",
@@ -1681,6 +1694,7 @@
   "Detected Coral hardware:": "Matériel Coral détecté :",
   "Detected GPU(s):": "GPU(s) détecté(s) :",
   "Detected Intel CPU": "Processeur Intel détecté",
+  "Detected Proxmox Backup Server": "Proxmox Backup Server détecté",
   "Detected Proxmox VE": "Proxmox VE détecté",
   "Detected Proxmox VE 8.x - Installing Ceph Squid for Debian": "Proxmox VE 8.x détecté - Installation de Ceph Squid pour Debian",
   "Detected Proxmox VE 9.x - Installing Ceph Squid for Debian Trixie": "Proxmox VE 9.x détecté - Installation de Ceph Squid pour Debian Trixie",
@@ -1762,6 +1776,9 @@
   "Disabling and stopping rpcbind service and socket...": "Désactivation et arrêt du service et du socket rpcbind...",
   "Disabling non-free firmware warnings...": "Désactivation des avertissements du firmware non libre...",
   "Disabling portmapper/rpcbind for security...": "Désactivation de portmapper/rpcbind pour la sécurité...",
+  "Discard changes": "Abandonner les modifications",
+  "Discard unapplied changes?": "Abandonner les modifications non appliquées ?",
+  "Discover NFS exports on a server": "Découvrir les exports NFS d’un serveur",
   "Discover targets on portal:": "Découvrez les cibles sur le portail :",
   "Discovering iSCSI targets...": "Découverte des cibles iSCSI...",
   "Discovery successful": "Découverte réussie",
@@ -1841,6 +1858,7 @@
   "Do you want to proceed with the system update?": "Voulez-vous procéder à la mise à jour du système ?",
   "Do you want to proceed?": "Voulez-vous continuer ?",
   "Do you want to reboot now?": "Voulez-vous redémarrer maintenant ?",
+  "Do you want to remove the Proxmox subscription banner from the Proxmox Backup Server web interface?": "Voulez-vous supprimer la bannière d'abonnement Proxmox de l'interface web de Proxmox Backup Server ?",
   "Do you want to remove the stale entry from vfio.conf and continue?": "Voulez-vous supprimer l'entrée obsolète de vfio.conf et continuer ?",
   "Do you want to remove the stale entry from vfio.conf?": "Voulez-vous supprimer l'entrée obsolète de vfio.conf ?",
   "Do you want to restart the network service now to apply changes?": "Voulez-vous redémarrer le service réseau maintenant pour appliquer les modifications ?",
@@ -1903,7 +1921,7 @@
   "Dry run completed; the container and the mounts were not changed.": "Le parcours à sec est terminé; le conteneur et les supports n'ont pas été changés.",
   "DuckDNS subdomain without .duckdns.org (comma separated for several)": "DuckDNS sous-domaine sans .duckdns.org (comma séparé pour plusieurs)",
   "DuckDNS token from your account at duckdns.org": "Jeton DuckDNS de votre compte sur duckdns.org",
-  "DuckDNS updates the subdomain every 5 minutes. Without UPDATE_IP, DuckDNS itself detects the public IPv4 address of the request.": "DuckDNS met à jour le sous-domaine toutes les 5 minutes. Sans mise à jour, DuckDNS détecte lui-même l'adresse IPv4 publique de la requête.",
+  "DuckDNS updates the subdomain every 5 minutes. Without UPDATE_IP, DuckDNS itself detects the public IPv4 address of the request.": "DuckDNS met à jour le sous-domaine toutes les 5 minutes. Sans UPDATE_IP, DuckDNS détecte lui-même l’adresse IPv4 publique de la requête.",
   "DuckStation is a PS1 Emulator aiming for the best accuracy and game support.": "DuckStation est un émulateur PS1 visant le meilleur accuracy et le meilleur support de jeu.",
   "Duckdns is a free service which will point a DNS (sub domains of duckdns.org) to an IP of your choice. The service is completely free, and doesn't require reactivation or forum posts to maintain its existence.": "Duckdns est un service gratuit qui dirigera un DNS (sous-domaines de duckdns.org) vers une IP de votre choix. Le service est entièrement gratuit, et ne require réactivation ou forum posts pour maintenir son existence.",
   "Dumping AMD GPU ROM BIOS via sysfs...": "Vidage du BIOS ROM GPU AMD via sysfs...",
@@ -2162,11 +2180,11 @@
   "Example: cp /etc/pve/lxc/114.conf /etc/pve/lxc/114.conf.bak": "Exemple : cp /etc/pve/lxc/114.conf /etc/pve/lxc/114.conf.bak",
   "Example: daily or Mon..Fri 03:00": "Exemple : tous les jours ou du lundi au vendredi à 03h00",
   "Example: mkdir -p /tmp/lxc_convert_114": "Exemple : mkdir -p /tmp/lxc_convert_114",
-  "Example: pct config 110 | grep unprivileged": "Exemple : configuration PCT 110 | grep sans privilège",
-  "Example: pct stop 110": "Exemple : PCT stop 110",
-  "Example: pct stop 114": "Exemple : PCT arrêt 114",
+  "Example: pct config 110 | grep unprivileged": "Exemple : pct config 110 | grep unprivileged",
+  "Example: pct stop 110": "Exemple : pct stop 110",
+  "Example: pct stop 114": "Exemple : pct stop 114",
   "Example: pvesm add nfs nfs-nas --server 192.168.1.50 --export /volume1/proxmox --content import,backup": "Exemple : pvesm add nfs nfs-nas --server 192.168.1.50 --export /volume1/proxmox --content import,backup",
-  "Example: pvesm path local-lvm:vm-114-disk-0": "Exemple : chemin pvesm local-lvm:vm-114-disk-0",
+  "Example: pvesm path local-lvm:vm-114-disk-0": "Exemple : pvesm path local-lvm:vm-114-disk-0",
   "Example: sed -i '/^unprivileged: 1/d' /etc/pve/lxc/110.conf": "Exemple : sed -i '/^unprivileged : 1/d' /etc/pve/lxc/110.conf",
   "Examples:": "Exemples :",
   "Execute destructive rollback?": "Exécuter une restauration destructrice ?",
@@ -2266,6 +2284,7 @@
   "Failed to clone log2ram repository. Check /tmp/log2ram_install.log": "Échec du clonage du référentiel log2ram. Vérifiez /tmp/log2ram_install.log",
   "Failed to configure EFI disk": "Échec de la configuration du disque EFI",
   "Failed to configure IOMMU automatically.": "Échec de la configuration automatique d'IOMMU.",
+  "Failed to configure Proxmox Backup Server repositories": "Échec de la configuration des dépôts de Proxmox Backup Server",
   "Failed to configure Proxmox repositories": "Échec de la configuration des référentiels Proxmox",
   "Failed to configure TPM device in VM": "Échec de la configuration du périphérique TPM dans la VM",
   "Failed to configure repositories.": "Échec de la configuration des référentiels.",
@@ -2477,7 +2496,7 @@
   "For a consistent export, the VM should be stopped.": "Pour une exportation cohérente, la VM doit être arrêtée.",
   "For any question, issue or bug report, please use the official repository": "Pour toute question, problème ou rapport de bug, veuillez utiliser le référentiel officiel",
   "For dedicated GPUs, FLR is required by this policy to reduce VM": "Pour les GPU dédiés, FLR est requis par cette stratégie pour réduire les VM",
-  "For example: pct enter 101": "Par exemple : PCT, entrez 101",
+  "For example: pct enter 101": "Par exemple : pct enter 101",
   "For guest shares add: --options guest": "Pour les partages invités, ajoutez : --options invité",
   "For security reasons, the system cannot format it.": "Pour des raisons de sécurité, le système ne peut pas le formater.",
   "For unprivileged containers, use instead:": "Pour les conteneurs non privilégiés, utilisez plutôt :",
@@ -2802,7 +2821,7 @@
   "How do you want to add it?": "Comment veux-tu l’ajouter ?",
   "How do you want to authenticate this backup target?": "Comment souhaitez-vous authentifier cette cible de sauvegarde ?",
   "How do you want to select the": "Comment voulez-vous sélectionner le",
-  "How do you want to select the HOST folder to mount?": "Comment souhaitez-vous sélectionner le dossier HOST à ​​monter ?",
+  "How do you want to select the HOST folder to mount?": "Comment souhaitez-vous sélectionner le dossier HOST à monter ?",
   "How do you want to select the NFS server?": "Comment voulez-vous sélectionner le serveur NFS ?",
   "How do you want to select the Samba server?": "Comment voulez-vous sélectionner le serveur Samba ?",
   "How do you want to select the folder to export?": "Comment voulez-vous sélectionner le dossier à exporter ?",
@@ -2889,8 +2908,8 @@
   "If notifications are enabled (Telegram/Discord/ntfy/...), you will receive a \"Host restore finished\" message when all background tasks complete.": "Si les notifications sont activées (Telegram/Discord/ntfy/...), vous recevrez un message « Restauration de l'hôte terminée » lorsque toutes les tâches en arrière-plan seront terminées.",
   "If passthrough fails on Windows: install RadeonResetBugFix.": "Si le relais échoue sous Windows : installez RadeonResetBugFix.",
   "If path not accessible (ZFS/BTRFS):": "Si chemin non accessible (ZFS/BTRFS) :",
-  "If pvesm path returned a DEVICE (LVM):": "Si le chemin pvesm a renvoyé un DEVICE (LVM) :",
-  "If pvesm path returned a DIRECTORY (ZFS/BTRFS):": "Si le chemin pvesm renvoie un RÉPERTOIRE (ZFS/BTRFS) :",
+  "If pvesm path returned a DEVICE (LVM):": "Si pvesm path a renvoyé un PÉRIPHÉRIQUE (LVM) :",
+  "If pvesm path returned a DIRECTORY (ZFS/BTRFS):": "Si pvesm path a renvoyé un RÉPERTOIRE (ZFS/BTRFS) :",
   "If repositories error:": "Si erreur de référentiels :",
   "If the container had already been changed, its previous native backup is restored. Shared host directories are not reverted. The disks of the failed attempt are removed when the cleanup succeeds.": "Si le conteneur a déjà été modifié, sa sauvegarde native précédente est restaurée. Les répertoires hôtes partagés ne sont pas rétablis. Les disques de la tentative ayant échoué sont supprimés une fois le nettoyage réussi.",
   "If the host freezes, remove hostpci entries from": "Si l'hôte se bloque, supprimez les entrées hostpci de",
@@ -2973,6 +2992,7 @@
   "Inaccessible device during VM startup": "Périphérique inaccessible lors du démarrage de la VM",
   "Inactive": "Inactif",
   "Inactive (entry in fstab, not currently mounted)": "Inactif (entrée dans fstab, non monté actuellement)",
+  "Include these changes in oci-compose?": "Inclure ces modifications dans oci-compose ?",
   "Include these resources in oci-compose?": "inclure ces ressources dans oci-compose ?",
   "Includes /etc/network (may drop SSH immediately)": "Inclut /etc/network (peut supprimer SSH immédiatement)",
   "Includes /etc/zfs": "Inclut /etc/zfs",
@@ -3029,7 +3049,7 @@
   "Initiator IQN is authorised on the target": "L'IQN initiateur est autorisé sur la cible",
   "Initiator IQN:": "IQN initiateur :",
   "Inkscape is professional quality vector graphics software which runs on Linux, Mac OS X and Windows desktop computers.": "Inkscape est un logiciel graphique vectoriel de qualité professionnelle qui fonctionne sur les ordinateurs de bureau Linux, Mac OS X et Windows.",
-  "Inside the LXC, create the administrator: console kimai:user:create YOUR_USERNAME YOUR_EMAIL ROLE_SUPER_ADMIN": "À l'intérieur du LXC, créez l'administrateur: console kimai:utilisateur:créez VOTRE USERNAME VOTRE ROLE_SUPER_ADMIN",
+  "Inside the LXC, create the administrator: console kimai:user:create YOUR_USERNAME YOUR_EMAIL ROLE_SUPER_ADMIN": "Dans le LXC, créez l’administrateur : console kimai:user:create YOUR_USERNAME YOUR_EMAIL ROLE_SUPER_ADMIN",
   "Inspect disks before any action": "Inspecter les disques avant toute action",
   "Inspect host device nodes": "Inspecter les nœuds du périphérique hôte",
   "Inspect passthrough/kernel events": "Inspecter les événements de relais/noyau",
@@ -3206,9 +3226,11 @@
   "Interrupted operation:": "Interruption du opera:",
   "Interrupted stack operation found": "Pile interrompue operation trouvée",
   "Invalid 'proxmox-ve' candidate (not 9.x or none). Please verify your repository configuration and network, then retry.": "Candidat 'proxmox-ve' invalide (pas 9.x ou aucun). Veuillez vérifier la configuration et le réseau de votre référentiel, puis réessayez.",
-  "Invalid ALLOWED_HOSTS value": "Valeur  HÔTES INDÉSIRABLES",
+  "Invalid ALLOWED_HOSTS value": "Valeur ALLOWED_HOSTS invalide",
   "Invalid Home Assistant OS check timeout": "Non valide Home Assistant OS check timeout",
   "Invalid ID": "Pièce d'identité invalide",
+  "Invalid IPv4 address": "Adresse IPv4 non valide",
+  "Invalid IPv4 gateway": "Passerelle IPv4 non valide",
   "Invalid Intel render path": "Chemin de rendu Intel incorrect",
   "Invalid Jellyfin path:": "Chemin Jellyfin non valide:",
   "Invalid MAC address:": "Adresse MAC non valide:",
@@ -3241,6 +3263,7 @@
   "Invalid administrator email": "Courriel administrateur non valide",
   "Invalid administrator user name": "Nom d'utilisateur non valide",
   "Invalid base VMID": "VMID de base non valide",
+  "Invalid bridge": "Pont réseau non valide",
   "Invalid check package:": "Dossier de contrôle non valide:",
   "Invalid configuration path:": "Chemin de configuration non valide & #160;:",
   "Invalid consume/export volumes": "Volumes de consommation/d'exportation non valides",
@@ -3304,6 +3327,7 @@
   "Invalid remote name": "Nom distant non valide",
   "Invalid remote path": "Voie distante non valide",
   "Invalid repair version:": "Version de réparation non valide:",
+  "Invalid resource value": "Valeur de ressource non valide",
   "Invalid resources": "Ressources non valides",
   "Invalid restored volume path": "Voie de volume restaurée non valide",
   "Invalid running state": "État de fonctionnement non valide",
@@ -3322,6 +3346,7 @@
   "Invalid stack members": "Membres de pile non valides",
   "Invalid stack name": "Nom de la pile non valide",
   "Invalid stack operation": "Pile non valide operation",
+  "Invalid storage": "Stockage non valide",
   "Invalid storage ID. Use only letters, numbers, hyphens and underscores.": "ID de stockage invalide. Utilisez uniquement des lettres, des chiffres, des traits d'union et des traits de soulignement.",
   "Invalid storage name": "Nom de stockage invalide",
   "Invalid suite application": "Demande de suite non valide",
@@ -3436,7 +3461,7 @@
   "Keyfile removed.": "fichier clé supprimé.",
   "Keyrings method failed; trying apt-key fallback": "La méthode des porte-clés a échoué ; essayer la solution de secours apt-key",
   "KiCad - A Cross Platform and Open Source Electronics Design Automation Suite.": "KiCad - Une plateforme croisée et une suite d'automatisation de conception électronique ouverte.",
-  "Kimai has no default account. Enter the container with: pct enter {main_vmid}": "Kimai n'a pas de compte par défaut. Saisissez le conteneur avec : pct entre {main vmid}",
+  "Kimai has no default account. Enter the container with: pct enter {main_vmid}": "Kimai n’a pas de compte par défaut. Ouvrez un shell dans le conteneur avec : pct enter {main_vmid}",
   "Kimai is a professional grade time-tracking application, free and open-source.": "Kimai est une application professionnelle de suivi du temps, libre et open-source.",
   "Kometa is a powerful tool designed to give you complete control over your media libraries. With Kometa, you can take your customization to the next level, with granular control over metadata, collections, overlays, and much more.": "Kometa est un outil puissant conçu pour vous donner un contrôle complet sur vos bibliothèques multimédias. Avec Kometa, vous pouvez porter votre personnalisation au niveau suivant, avec un contrôle granulaire sur les métadonnées, les collections, les superpositions et bien plus encore.",
   "Kometa reads its configuration from /config/config.yml and the container only ships /config/config.yml.template. Copy the template to config.yml, fill in the required Plex and TMDb connections, then restart the container.": "Kometa lit sa configuration à partir de /config/config.yml et le conteneur ne livre que /config/config.yml.template. Copiez le modèle pour config.yml, remplissez les connexions required Plex et TMDb, puis redémarrez le conteneur.",
@@ -3488,7 +3513,7 @@
   "Leave empty to keep every backup (not recommended).": "Laissez vide pour conserver chaque sauvegarde (non recommandé).",
   "Leave empty to use the retention of the storage.": "Laisser vide pour utiliser la rétention du stockage.",
   "Legacy PVE 8 .list files commented or not present": "Fichiers .list hérités PVE 8 commentés ou non présents",
-  "Legacy ceph.list commented or not present": "Ceph.list hérité commenté ou non présent",
+  "Legacy ceph.list commented or not present": "Ancien fichier ceph.list commenté ou absent",
   "Legacy gasket-dkms cleanup could not be verified as complete.": "Impossible de confirmer que le nettoyage de l'ancien paquet gasket-dkms est terminé.",
   "Legacy gasket-dkms detected": "Ancien paquet gasket-dkms détecté",
   "Legacy network tools (e.g., ifconfig)": "Outils réseau hérités (par exemple, ifconfig)",
@@ -4153,6 +4178,7 @@
   "No active Proxmox storage accepts OCI template archives.": "Aucun stockage Proxmox actif n'accepte les archives de modèles OCI.",
   "No active exports or showmount not available": "Aucune exportation active ou showmount non disponible",
   "No active session": "Aucune session active",
+  "No active subscription and no usable PBS repository. Noninteractive mode cannot change APT sources; configure them in Administration > Repositories.": "Aucun abonnement actif et aucun référentiel PBS utilisable. Le mode non interactif ne peut pas modifier les sources APT ;configurez-les dans Administration > Dépôts.",
   "No active subscription and no usable PVE repository. Noninteractive mode cannot change APT sources; configure them in Node > Updates > Repositories.": "Aucun abonnement actif et aucun référentiel PVE utilisable. Le mode non interactif ne peut pas modifier les sources APT ; configurez-les dans Nœud > Mises à jour > Dépôts.",
   "No additional GPU can be added.": "Aucun GPU supplémentaire ne peut être ajouté.",
   "No additional device needs to be added.": "Aucun appareil supplémentaire ne doit être ajouté.",
@@ -4238,7 +4264,7 @@
   "No jobs": "Aucun emploi",
   "No language selected.": "Aucune langue sélectionnée.",
   "No local disk storage configured.": "Aucun stockage sur disque local configuré.",
-  "No main sources.list present (skipped)": "Aucune liste de sources principale présente (ignorée)",
+  "No main sources.list present (skipped)": "Aucun fichier sources.list principal présent (ignoré)",
   "No matches for:": "Aucune correspondance pour :",
   "No matching PVE vzdump jobs were found for the PBS backend.": "Aucune tâche vzdump PVE correspondante n'a été trouvée pour le backend PBS.",
   "No matching PVE vzdump jobs were found for the local archive backend.": "Aucune tâche vzdump PVE correspondante n'a été trouvée pour le backend d'archive local.",
@@ -4257,6 +4283,7 @@
   "No password provided.": "Aucun mot de passe fourni.",
   "No paths available": "Aucun chemin disponible",
   "No paths selected. Select at least one path.": "Aucun chemin sélectionné. Sélectionnez au moins un chemin.",
+  "No pending changes": "Aucune modification en attente",
   "No pending paths to schedule for reboot.": "Aucun chemin en attente pour planifier le redémarrage.",
   "No permanent NFS mounts configured.": "Aucun montage NFS permanent configuré.",
   "No permanent Samba mounts configured.": "Aucun montage Samba permanent configuré.",
@@ -4334,7 +4361,7 @@
   "Not all shared directories were verified": "Tous les répertoires partagés n'ont pas été vérifiés",
   "Not an OVH server, skipping RTM installation": "Pas un serveur OVH, sautant l'installation RTM",
   "Not currently mounted": "Non monté actuellement",
-  "Not currently mounted — skipping umount.": "Non monté actuellement – ​​ignorer umount.",
+  "Not currently mounted — skipping umount.": "Non monté actuellement – ignorer umount.",
   "Not declared": "Non déclaré",
   "Not enough free space for the backup": "Pas assez d'espace libre pour la sauvegarde",
   "Not enough free space on {storage}. Free some space or select another storage.": "Pas assez d’espace libre sur {storage}. Libérez de l'espace ou sélectionnez un autre stockage.",
@@ -4398,6 +4425,7 @@
   "OVH RTM removed (Puppet artefacts may need manual cleanup)": "OVH RTM supprimé (les artefacts de marionnettes peuvent nécessiter un nettoyage manuel)",
   "OVH server detected": "Serveur OVH détecté",
   "OVH server detection and RTM installation process completed": "Processus de détection du serveur OVH et d'installation de RTM terminé",
+  "Object detector": "Détecteur d’objets",
   "Object detector for Frigate": "Détecteur d'objets pour Frigate",
   "Observer is not responding on port 4357": "L'observateur ne répond pas au port 4357",
   "Obsidian is a note-taking app that lets you create, link, and organize your notes on your device, with hundreds of plugins and themes to customize your workflow. You can also publish your notes online, access them offline, and sync them securely with end-to-end encryption.": "Obsidian est une application de prise de notes qui vous permet de créer, de lier et d'organiser vos notes sur votre appareil, avec des centaines de plugins et de thèmes pour personnaliser votre workflow. Vous pouvez également publier vos notes en ligne, les accéder hors ligne et les synchroniser en toute sécurité avec le chiffrement de bout en bout.",
@@ -4523,11 +4551,17 @@
   "PBS backup error log": "Journal des erreurs de sauvegarde PBS",
   "PBS backup failed.": "La sauvegarde PBS a échoué.",
   "PBS certificate": "certificat PBS",
+  "PBS datastores": "Magasins de données PBS",
   "PBS encryption keyfile (show / replace / remove)": "fichier de clé de chiffrement PBS (afficher/remplacer/supprimer)",
   "PBS encryption keyfile — detailed info": "Fichier de clé de chiffrement PBS – informations détaillées",
   "PBS extraction failed": "L'extraction PBS a échoué",
   "PBS host or IP address:": "Hôte PBS ou adresse IP :",
+  "PBS package update": "Mise à jour des paquets PBS",
+  "PBS package upgrade completed. Check whether a reboot is required before your next backup window.": "Mise à niveau des paquets PBS terminée. Vérifiez si un redémarrage est nécessaire avant votre prochaine plage de sauvegarde.",
+  "PBS package upgrade failed. Review the APT output before retrying.": "Échec de la mise à niveau des paquets PBS. Consultez la sortie APT avant de réessayer.",
   "PBS upload": "Téléchargement PBS",
+  "PBS version and packages": "Version et paquets PBS",
+  "PBS: using the configured APT repositories without changing sources.": "PBS : utilisation des dépôts APT configurés sans modifier les sources.",
   "PCI Address": "Adresse PCI",
   "PCI passthrough, TPM state, cloud-init configuration, Proxmox hooks": "Passthrough PCI, état TPM, configuration cloud-init, hooks Proxmox",
   "PCI passthrough, TPM state, cloud-init, snapshots, Proxmox-specific hooks": "Passthrough PCI, état TPM, cloud-init, instantanés, hooks spécifiques à Proxmox",
@@ -4864,12 +4898,17 @@
   "Proxmology logo applied": "Logo Proxmologie appliqué",
   "Proxmox 9 system update allready": "La mise à jour du système Proxmox 9 est déjà terminée",
   "Proxmox APT repositories configured": "Dépôts Proxmox APT configurés",
+  "Proxmox Backup Server": "Proxmox Backup Server",
   "Proxmox Backup Server (PBS) destinations": "Destinations Proxmox Backup Server (PBS)",
+  "Proxmox Backup Server APT repositories configured": "Dépôts APT de Proxmox Backup Server configurés",
+  "Proxmox Backup Server Update": "Mise à jour de Proxmox Backup Server",
+  "Proxmox Backup Server update completed.": "Mise à jour de Proxmox Backup Server terminée.",
   "Proxmox CIFS Storage Status:": "État de stockage Proxmox CIFS :",
   "Proxmox NFS Storage Status:": "Statut de stockage Proxmox NFS :",
   "Proxmox System Update": "Mise à jour du système Proxmox",
   "Proxmox Update": "Mise à jour Proxmox",
   "Proxmox VE": "Proxmox VE",
+  "Proxmox VE 8 package upgrade failed. Review the APT output before retrying.": "La mise à jour des paquets de Proxmox VE 8 a échoué. Vérifiez la sortie d’APT avant de réessayer.",
   "Proxmox VE 8 system update completed successfully": "La mise à jour du système Proxmox VE 8 s'est terminée avec succès",
   "Proxmox VE 8 to 9 Manual Upgrade Guide": "Guide de mise à niveau manuelle Proxmox VE 8 vers 9",
   "Proxmox VE 9.x no-subscription repository created": "Création d'un référentiel sans abonnement Proxmox VE 9.x",
@@ -4877,6 +4916,7 @@
   "Proxmox VE configuration completed.": "Configuration de Proxmox VE terminée.",
   "Proxmox VE safe update completed": "Mise à jour sécurisée de Proxmox VE terminée",
   "Proxmox auth logger service created and started": "Service d'enregistrement d'authentification Proxmox créé et démarré",
+  "Proxmox could not apply the container settings": "Proxmox n’a pas pu appliquer les paramètres du conteneur",
   "Proxmox enterprise repo might be missing or inaccessible. Trying to switch to no-subscription...": "Le référentiel d'entreprise Proxmox peut être manquant ou inaccessible. J'essaie de passer au sans abonnement...",
   "Proxmox filter configured": "Filtre Proxmox configuré",
   "Proxmox iSCSI Storage Status:": "État du stockage Proxmox iSCSI :",
@@ -4993,6 +5033,7 @@
   "Rebuilding initramfs to apply nouveau blacklist before installation...": "Reconstruction d'initramfs pour appliquer la liste noire de nouveau avant l'installation...",
   "Rebuilding the container and recovering it from its backup are tested on the same image; the first update to a newer image is still to be observed.": "La reconstruction du conteneur et sa récupération à partir de sa sauvegarde sont testées sur la même image ; la première mise à jour vers une image plus récente reste à observer.",
   "Recent": "Récent",
+  "Recent PBS tasks": "Tâches PBS récentes",
   "Recent Samba Servers": "Serveurs Samba récents",
   "Recent Samba server": "Serveur Samba récent",
   "Recent logs:": "Journaux récents :",
@@ -5052,6 +5093,7 @@
   "Recreation completed. Data kept.": "Loisirs terminés. Données conservées.",
   "Recreation prepared": "Loisirs préparés",
   "Refresh APT index and verify repositories:": "Actualisez l'index APT et vérifiez les référentiels :",
+  "Refresh the configured APT repositories and review the PBS package upgrade? Repository files will be preserved.": "Actualiser les dépôts APT configurés et examiner la mise à niveau des paquets PBS ? Les fichiers des dépôts seront conservés.",
   "Refresh token of the connector, from the Twingate admin console": "Jeton d'actualisation du connecteur, depuis la console d'administration Twingate",
   "Refresh your browser (Ctrl+Shift+R) to see changes": "Actualisez votre navigateur (Ctrl+Shift+R) pour voir les modifications",
   "Refresh your browser to see changes (server restart may be required)": "Actualisez votre navigateur pour voir les modifications (un redémarrage du serveur peut être nécessaire)",
@@ -5141,6 +5183,8 @@
   "Remove saved credentials": "Supprimer les informations d'identification enregistrées",
   "Remove subscription banner": "Supprimer la bannière d'abonnement",
   "Remove the application? Its container disks are deleted, and only a backup can bring them back.": "Supprimer l'application ?Ses disques conteneurs sont supprimés et seule une sauvegarde peut les restaurer.",
+  "Remove the lock left on a VM by an interrupted task": "Supprimer le verrou laissé sur une VM par une tâche interrompue",
+  "Remove the lock left on a container by an interrupted task": "Supprimer le verrou laissé sur un conteneur par une tâche interrompue",
   "Remove the saved credentials for {registry}?\nRunning apps will keep working.": "Supprimer les informations d'identification enregistrées pour {registry} ?\nLes applications en cours d’exécution continueront de fonctionner.",
   "Remove the unprivileged flag from configuration:": "Supprimez l'indicateur sans privilèges de la configuration :",
   "Remove unused packages and their config": "Supprimer les packages inutilisés et leur configuration",
@@ -5222,6 +5266,7 @@
   "Repository helper unavailable. NVIDIA installation stopped.": "Assistant du référentiel indisponible. L'installation de NVIDIA s'est arrêtée.",
   "Repository policy returned an unexpected result.": "La stratégie du référentiel a renvoyé un résultat inattendu.",
   "Repository ready.": "Référentiel prêt.",
+  "Repository sources changed, but APT package-list refresh failed. Operation stopped; sources were not rolled back. Inspect Administration > Repositories and retry apt-get update before continuing.": "les sources du référentiel ont été modifiées, mais l'actualisation de la liste des packages APT a échoué. Opération arrêtée ;les sources n’ont pas été annulées. Inspectez Administration > Référentiels et réessayez apt-get update avant de continuer.",
   "Repository sources changed, but APT package-list refresh failed. Operation stopped; sources were not rolled back. Inspect Node > Updates > Repositories and retry apt-get update before continuing.": "Les sources du référentiel ont été modifiées, mais l'actualisation de la liste des paquets APT a échoué. Opération arrêtée ; les sources n'ont pas été restaurées. Vérifiez Nœud > Mises à jour > Dépôts et relancez apt-get update avant de continuer.",
   "Repository switch declined; no APT source changed.": "Le changement de référentiel a été refusé ; aucune source APT n'a été modifiée.",
   "Repository:": "Dépôt:",
@@ -5316,7 +5361,9 @@
   "Reverting ZFS ARC tuning...": "Annulation du réglage ZFS ARC...",
   "Reverting pigz wrapper...": "Rétablissement du wrapper pigz...",
   "Reverting vzdump speed tuning...": "Annulation du réglage de la vitesse de vzdump...",
+  "Review and apply": "Vérifier et appliquer",
   "Review external OCI changes": "Examiner les modifications externes de OCI",
+  "Review package upgrade": "Examiner la mise à niveau des paquets",
   "Review passthrough config files": "Examiner les fichiers de configuration relais",
   "Review what will be removed": "Vérifiez ce qui sera supprimé",
   "Rip DVD and Blu-ray media from a browser": "Rip DVD et Blu-ray médias à partir d'un navigateur",
@@ -5359,6 +5406,7 @@
   "Run the following inside the VM:": "Exécutez la commande suivante dans la VM :",
   "Run the release-channel switch from an SSH session or the Proxmox host console with:": "Exécutez le commutateur de canal de version à partir d'une session SSH ou de la console hôte Proxmox avec :",
   "Run the update from an SSH session or the Proxmox host console with:": "Exécutez la mise à jour depuis une session SSH ou la console hôte Proxmox avec :",
+  "Run this operation as root.": "Exécutez cette opération en tant que root.",
   "Run upgrade checklist script:": "Exécutez le script de liste de contrôle de mise à niveau :",
   "Running": "En cours d'exécution",
   "Running Lynis security audit...": "Exécution de l'audit de sécurité Lynis...",
@@ -5773,6 +5821,7 @@
   "ShareCoveX panel": "Panneau ShareCoveX",
   "Shared Directory Ready:": "Répertoire partagé prêt :",
   "Shared Group": "Groupe partagé",
+  "Shared directories": "Dossiers partagés",
   "Shared directory created:": "Répertoire partagé créé & #160;:",
   "Shared directory for consume and export": "Répertoire partagé pour la consommation et l'exportation",
   "Shared directory for copy/sync operations": "Répertoire partagé pour copier/sync operations",
@@ -5802,6 +5851,7 @@
   "Should show pve-manager/9.x.x": "Devrait afficher pve-manager/9.x.x",
   "Shoutrrr addresses for the notifications (optional)": "Adresses Shoutrrr pour les notifications (facultatif)",
   "Show All Scripts": "Afficher tous les scripts",
+  "Show CT users and their UID/GID on the host": "Utilisateurs du CT et leurs UID/GID sur l’hôte",
   "Show CT users in table format": "Afficher les utilisateurs CT sous forme de tableau",
   "Show Container Privilege Status": "Afficher l'état des privilèges du conteneur",
   "Show DNS resolution status": "Afficher l'état de la résolution DNS",
@@ -5963,6 +6013,7 @@
   "Start the VM to begin Windows installation from the mounted ISO.": "Démarrez la VM pour commencer l'installation de Windows à partir de l'ISO montée.",
   "Start the applications once they are registered? Answer No if the original containers are still running on another host: both would use the same addresses.": "Lancer les applications une fois enregistrées ? Répondez Non si les conteneurs d'origine s'exécutent toujours sur un autre hôte : les deux utiliseraient les mêmes adresses.",
   "Start the converted container:": "Démarrez le conteneur converti :",
+  "Start the interactive Proxmox package upgrade": "Lancer la mise à niveau interactive des paquets Proxmox",
   "Start the main system upgrade:": "Démarrez la mise à niveau principale du système :",
   "Start the stack with Proxmox": "Démarrer la pile avec Proxmox",
   "Start uploading to PBS — sets a recovery passphrase": "Commencer le téléchargement sur PBS – définit une phrase secrète de récupération",
@@ -6241,6 +6292,7 @@
   "The Paperless persistent volumes need at least 8 GB": "Les volumes persistants sans papier nécessitent au moins 8 Go",
   "The PostgreSQL volume needs at least 4 GB": "Le volume PostgreSQL nécessite au moins 4 Go",
   "The PostgreSQL volume needs at least 8 GB": "Le volume PostgreSQL nécessite au moins 8 Go",
+  "The Proxmox VE 8 update did not finish. The upgrade to Proxmox VE 9 was not started.": "La mise à jour de Proxmox VE 8 n’a pas abouti. La mise à niveau vers Proxmox VE 9 n’a pas été lancée.",
   "The Proxmox archive keyring is missing; Ceph installation cannot continue safely": "Le trousseau de clés d'archive Proxmox est manquant ;L'installation de Ceph ne peut pas continuer en toute sécurité",
   "The Proxmox inventory and the local configurations differ": "L'inventaire Proxmox et les configurations locales diffèrent",
   "The ROCm image has no support for the AMD GPU of this host:": "L'image ROCm ne prend pas en charge le GPU AMD de cet hôte :",
@@ -6311,6 +6363,7 @@
   "The build could not be checked beforehand; continuing without that check.": "La build n'a pas pu être vérifiée au préalable ;continuer sans cette vérification.",
   "The cached image does not match the current digest": "L'image mise en cache ne correspond pas au digest actuel",
   "The cached image is damaged; it will be downloaded again.": "L'image mise en cache est endommagée ; elle sera à nouveau téléchargée.",
+  "The changes need the application installer": "Ces modifications nécessitent le programme d’installation de l’application",
   "The character device does not exist:": "Le dispositif de caractère n'existe pas :",
   "The command asks for a password that is not echoed. After creating the users, the web interface asks for a user name and a password.": "La commande demande un mot de passe qui n'est pas repris. Après la création des utilisateurs, l'interface web demande un nom d'utilisateur et un mot de passe.",
   "The command does not name an image": "La commande ne nomme pas une image",
@@ -6430,8 +6483,10 @@
   "The host bind source does not exist:": "La source de liaison hôte n'existe pas:",
   "The host bind source is not a regular file or directory:": "La source de liaison hôte n'est pas un fichier ou un répertoire régulier :",
   "The host directory changed before it was mounted": "Le répertoire hôte a changé avant son montage",
+  "The host directory does not exist": "Le répertoire de l’hôte n’existe pas",
   "The host directory may not be accessible from an unprivileged container.": "Le répertoire hôte peut ne pas être accessible à partir d'un conteneur non privilégié.",
   "The host has no IPv4 address on the selected bridge": "L'hôte n'a pas d'adresse IPv4 sur le pont sélectionné",
+  "The host loses access to them. If the group includes a network or storage controller the host needs, cancel at the summary.": "L’hôte perd l’accès à ces périphériques. Si le groupe contient un contrôleur réseau ou de stockage dont l’hôte a besoin, annulez au résumé.",
   "The host monitor does not see the real host memory": "Le moniteur hôte ne voit pas la mémoire de l'hôte réel",
   "The host monitor does not share this host namespace:": "L'écran hôte ne partage pas cet espace de noms d'hôte :",
   "The host monitor include is unknown or differs from the saved record": "L'include du moniteur d'hôte est inconnu ou diffère de l'enregistrement sauvegardé",
@@ -6621,6 +6676,7 @@
   "The repair must preserve the image dependencies:": "La réparation doit préserver les dépendances de l'image:",
   "The requested VMID block is already in use": "Le bloc VMID demandé est déjà utilisé",
   "The requested machine learning GPU profile is not working; it is not replaced by CPU": "Le profil GPU d'apprentissage automatique demandé ne fonctionne pas; il n'est pas remplacé par CPU",
+  "The resource edit could not be fully rolled back. Open Manage again to review and import the current Proxmox settings.": "Impossible d’annuler entièrement la modification des ressources. Rouvrez le menu de gestion pour vérifier et importer les réglages actuels de Proxmox.",
   "The restored service did not pass its health check": "Le service restauré n'a pas réussi son bilan de santé",
   "The restored service stopped; the recovery is not confirmed": "Le service restauré s'est arrêté; la récupération n'est pas confirmée",
   "The reviewed Tandoor stack does not require a privileged LXC.": "La pile Tandoor revue ne require un LXC privilégié.",
@@ -6666,6 +6722,7 @@
   "The selected VM": "La VM sélectionnée",
   "The selected VM is running.": "La VM sélectionnée est en cours d'exécution.",
   "The selected base folder does not exist and could not be created:": "Le dossier de base sélectionné n'existe pas et n'a pas pu être créé :",
+  "The selected bridge does not exist": "Le pont réseau sélectionné n’existe pas",
   "The selected bridge has no IPv4 subnet for the host-monitor firewall": "Le pont sélectionné n'a pas de sous-réseau IPv4 pour le pare-feu du moniteur hôte",
   "The selected configuration needs to start the LXC during the installation": "La configuration sélectionnée doit démarrer le LXC pendant l'installation",
   "The selected container is unprivileged. A privileged container is required for direct device passthrough.": "Le conteneur sélectionné n'est pas privilégié. Un conteneur privilégié est requis pour le relais direct du périphérique.",
@@ -6688,6 +6745,7 @@
   "The service builds its own image; only a published image can be installed": "Le service construit sa propre image; seule une image publiée peut être installée",
   "The service declares no image:": "Le service ne déclare aucune image:",
   "The setting has no final value:": "Le réglage n'a pas de valeur finale:",
+  "The settings could not be fully rolled back. Review the container and its saved modification before continuing.": "Les paramètres n’ont pas pu être entièrement rétablis. Vérifiez le conteneur et la modification enregistrée avant de continuer.",
   "The share already exists in smb.conf:": "Le partage existe déjà dans smb.conf :",
   "The shared destination is not a directory": "La destination partagée n'est pas un répertoire",
   "The shared directory points to a protected host path": "Le répertoire partagé indique un chemin d'hôte protégé",
@@ -6755,19 +6813,24 @@
   "These Proxmox resources were added outside ProxMenux:": "Ces ressources Proxmox ont été ajoutées en dehors de ProxMenux :",
   "These VMIDs are not free:": "Ces VMID ne sont pas libres:",
   "These are the changes that will be made": "Ce sont les changements qui seront apportés",
+  "These changes were made in Proxmox outside ProxMenux:": "Ces modifications ont été apportées dans Proxmox en dehors de ProxMenux :",
   "These container mount paths have an extension-like suffix:": "Ces chemins de montage du conteneur ont un suffixe qui ressemble à une extension :",
   "These containers were restored from a backup and this host has no record of their OCI application:": "Ces conteneurs ont été restaurés à partir d'une sauvegarde et cet hôte n'a aucun enregistrement de leur application OCI :",
+  "These devices share the IOMMU group of the selected GPU and will be assigned to the VM with it:": "Ces périphériques partagent le groupe IOMMU du GPU sélectionné et seront attribués à la VM avec lui :",
   "These host backups run with this job and expect its storage:": "Ces sauvegardes d'hôte s'exécutent avec ce travail et attendent son stockage :",
   "These host backups run with this job and will stop running:": "Ces sauvegardes d'hôte s'exécutent avec ce travail et cesseront de s'exécuter :",
   "These interface configurations will be removed": "Ces configurations d'interface seront supprimées",
   "These manual changes cannot be adopted safely:": "Ces modifications manuelles ne peuvent pas être adoptées en toute sécurité :",
   "These paths will not be restored live and will be extracted for manual recovery.": "Ces chemins ne seront pas restaurés en direct et seront extraits pour une récupération manuelle.",
+  "These settings require an application-specific adaptation. The image was not downloaded and the container was not recreated.": "Ces paramètres nécessitent une adaptation propre à l’application. L’image n’a pas été téléchargée et le conteneur n’a pas été recréé.",
   "These values are asked during the installation:": "Ces valeurs sont demandées lors de l'installation:",
   "They are described in the image documentation:": "Ils sont décrits dans la documentation de l'image :",
   "They will be added to oci-compose before continuing. Unsupported or changed resources are not imported.": "Ils seront ajoutés à oci-compose avant de continuer. Les ressources non prises en charge ou modifiées ne sont pas importées.",
+  "They will be saved in oci-compose before continuing.": "Elles seront enregistrées dans oci-compose avant de continuer.",
   "This CIFS share is mounted with restrictive permissions.": "Ce partage CIFS est monté avec des autorisations restrictives.",
   "This GPU is considered incompatible with GPU passthrough to a VM in ProxMenux.": "Ce GPU est considéré comme incompatible avec le relais GPU vers une VM dans ProxMenux.",
   "This NFS share is fully restricted — even the host root cannot write to it.": "Ce partage NFS est entièrement restreint : même la racine de l'hôte ne peut pas y écrire.",
+  "This Proxmox Backup Server has no active subscription, switch to the no-subscription repository? The inaccessible Enterprise PBS source will be disabled.": "Ce Proxmox Backup Server n'a pas d'abonnement actif. Passer au dépôt sans abonnement ? La source Enterprise PBS inaccessible sera désactivée.",
   "This VM requires extra installation steps, see install guide at:\nhttps://github.com/community-scripts/ProxmoxVE/discussions/144": "Cette VM nécessite des étapes d'installation supplémentaires. Consultez le guide d'installation à l'adresse :\nhttps://github.com/community-scripts/ProxmoxVE/discussions/144",
   "This account is for {registry}. Enter an image from that registry.": "Ce compte concerne {registry}. Entrez une image de ce registre.",
   "This action will:": "Cette action va :",
@@ -6829,10 +6892,13 @@
   "This may take several minutes...": "Cela peut prendre plusieurs minutes...",
   "This means Proxmox handles mount lifecycle natively (no manual /etc/fstab needed for NFS/CIFS host storages).": "Cela signifie que Proxmox gère le cycle de vie du montage de manière native (aucun /etc/fstab manuel n'est nécessaire pour les stockages hôtes NFS/CIFS).",
   "This means the credentials are incorrect.": "Cela signifie que les informations d'identification sont incorrectes.",
+  "This menu requires Proxmox Backup Server.": "Ce menu nécessite Proxmox Backup Server.",
   "This might indicate network connectivity issues.": "Cela peut indiquer des problèmes de connectivité réseau.",
   "This monitor uses a privileged LXC, shares processes and network with Proxmox and disables AppArmor in the CT. It uses the IP address and firewall of the host. A compromised image could affect the host; do not expose its web UI to the Internet.": "Ce moniteur utilise un LXC privilégié, partage les processus et le réseau avec Proxmox et désactive AppArmor dans le CT. Il utilise l'adresse IP et le pare-feu de l'hôte. Une image compromise pourrait affecter l'hôte; ne pas exposer son interface utilisateur Web à Internet.",
   "This only removes the schedule. Existing backup archives are NOT deleted.": "Cela supprime uniquement le calendrier. Les archives de sauvegarde existantes ne sont PAS supprimées.",
   "This operation may take several minutes and requires internet connectivity.": "Cette opération peut prendre plusieurs minutes et nécessite une connexion Internet.",
+  "This operation requires a Proxmox VE host. Use the PBS menu on Proxmox Backup Server.": "Cette opération nécessite un hôte Proxmox VE. Utilisez le menu PBS sur Proxmox Backup Server.",
+  "This operation supports PBS 3 on Debian 12 and PBS 4 on Debian 13.": "Cette opération prend en charge PBS 3 sur Debian 12 et PBS 4 sur Debian 13.",
   "This package was installed by older versions of the ProxMenux Coral installer that placed the M.2 kernel driver on every system, including USB-only setups. It is not needed for Coral USB devices, which use libedgetpu1-std / libedgetpu1-max only.": "Ce package a été installé par les anciennes versions du programme d'installation de ProxMenux Coral qui plaçaient le pilote du noyau M.2 sur chaque système, y compris les configurations USB uniquement. Il n'est pas nécessaire pour les périphériques USB Coral, qui utilisent uniquement libedgetpu1-std / libedgetpu1-max.",
   "This passphrase is the ONLY way to access encrypted Borg backups.": "Cette phrase secrète est le SEUL moyen d'accéder aux sauvegardes Borg cryptées.",
   "This path is already used as a mount point in this container.": "Ce chemin est déjà utilisé comme point de montage dans ce conteneur.",
@@ -6848,6 +6914,7 @@
   "This script cannot be executed from the Proxmox web terminal.": "Ce script ne peut pas être exécuté depuis le terminal web Proxmox.",
   "This script must be run as root.": "Ce script doit être exécuté en tant que root.",
   "This script must be run on a Proxmox host.": "Ce script doit être exécuté sur un hôte Proxmox.",
+  "This script will apply the following optimizations and advanced adjustments to your Proxmox Backup Server": "Ce script appliquera les optimisations et réglages avancés suivants à votre Proxmox Backup Server",
   "This script will apply the following optimizations and advanced adjustments to your Proxmox VE server": "Ce script appliquera les optimisations et ajustements avancés suivants à votre serveur Proxmox VE",
   "This script will update your Proxmox VE system with advanced options:": "Ce script mettra à jour votre système Proxmox VE avec des options avancées :",
   "This session is running in the Monitor terminal. Running it from here would cut the connection mid-install and leave the switch in a broken state.": "Cette session est en cours d'exécution dans le terminal Monitor. L’exécuter à partir d’ici couperait la connexion en cours d’installation et laisserait le commutateur dans un état cassé.",
@@ -6934,7 +7001,7 @@
   "Transaction log:": "Registre des transactions & #160;:",
   "Translation files:": "Fichiers de traduction :",
   "Transmission is designed for easy, powerful use. Transmission has the features you want from a BitTorrent client: encryption, a web interface, peer exchange, magnet links, DHT, µTP, UPnP and NAT-PMP port forwarding, webseed support, watch directories, tracker editing, global and per-torrent speed limits, and more.": "Transmission est conçu pour une utilisation facile et puissante. Transmission possède les fonctionnalités que vous souhaitez d'un client BitTorrent : cryptage, interface web, échange entre pairs, liens magnétiques, DHT, μTP, UPnP et le transfert de port NAT-PMP, support de webseed, répertoires de veille, édition de tracker, limites de vitesse globales et per-torrent, et plus encore.",
-  "Tried pvesm path and manual detection methods": "Chemin pvesm essayé et méthodes de détection manuelle",
+  "Tried pvesm path and manual detection methods": "pvesm path et les méthodes de détection manuelle ont été essayés",
   "Trust this certificate and save it for scheduled backups?": "Faire confiance à ce certificat et l'enregistrer pour les sauvegardes planifiées ?",
   "Try Again": "Essayer à nouveau",
   "Try a different search term.": "Essayez un autre terme de recherche.",
@@ -6979,6 +7046,7 @@
   "Unable to identify the root filesystem. Aborting.": "Impossible d'identifier le système de fichiers racine. Avorter.",
   "Unable to resolve system ZFS pool disks. Aborting.": "Impossible de résoudre les disques du pool système ZFS.Avorter.",
   "Unable to resolve system disk topology. Aborting.": "Impossible de résoudre la topologie du disque système. Avorter.",
+  "Unapplied changes": "Modifications non appliquées",
   "Understand the security implications of privileged containers": "Comprendre les implications de sécurité des conteneurs privilégiés",
   "Unexpected Proxmox inventory; recovery blocked": "stocks imprévus Proxmox; récupération bloquée",
   "Unexpected formatting directory in the new Valkey volume": "Répertoire de formatage inattendu dans le nouveau volume Valkey",
@@ -7078,6 +7146,7 @@
   "Unsupported OCI-LXC AppArmor profile:": "Profil OCI-LXC AppArmor non soutenu :",
   "Unsupported OCI-LXC seccomp profile:": "Profil de seccomp OCI-LXC non pris en charge:",
   "Unsupported Terminal": "Terminal non pris en charge",
+  "Unsupported architecture for Figurine:": "Architecture non prise en charge pour Figurine :",
   "Unsupported architecture:": "Architecture non supportée :",
   "Unsupported backup compression": "compression de sauvegarde non prise en charge",
   "Unsupported credential pattern:": "Modèle credential non pris en charge:",
@@ -7093,6 +7162,7 @@
   "Unsupported mount type": "Type de montage non supporté",
   "Unsupported mount type:": "Type de montage non pris en charge:",
   "Unsupported native device type:": "Type de périphérique natif non pris en charge:",
+  "Unsupported network settings": "Paramètres réseau non pris en charge",
   "Unsupported operation": "operation non prise en charge",
   "Unsupported or unknown Proxmox version; no repository changed.": "Version Proxmox non prise en charge ou inconnue ; aucun référentiel n'a été modifié.",
   "Unsupported output format:": "Format de sortie non pris en charge :",
@@ -7120,6 +7190,7 @@
   "Update NVIDIA in LXC Containers": "Mettre à jour NVIDIA dans les conteneurs LXC",
   "Update OCI": "Mettre à jour OCI",
   "Update OCI stack": "Mettre à jour la pile OCI",
+  "Update PBS using configured repositories": "Mettre à jour PBS avec les dépôts configurés",
   "Update PVE enterprise repository (Only if using enterprise):": "Mettre à jour le référentiel d'entreprise PVE (uniquement si vous utilisez l'entreprise) :",
   "Update Proxmox VE Appliance Manager": "Mettre à jour le gestionnaire d'appliances Proxmox VE",
   "Update Proxmox package lists": "Mettre à jour les listes de packages Proxmox",
@@ -7172,6 +7243,7 @@
   "Upgrade assistant: Proxmox VE 8 → 9 (Trixie)": "Assistant de mise à niveau : Proxmox VE 8 → 9 (Trixie)",
   "Upgrade canceled by user": "Mise à niveau annulée par l'utilisateur",
   "Upgrade one node at a time": "Mettre à niveau un nœud à la fois",
+  "Upgrade the system, offering the": "mettre à niveau le système, en offrant le",
   "Upgrade to Proxmox VE 9": "Mise à niveau vers Proxmox VE 9",
   "Upgrading NVIDIA utils (Arch)...": "Mise à niveau des utilitaires NVIDIA (Arch)...",
   "Upload an encrypted copy of the key to PBS so you can recover it on a reinstalled host with just a passphrase?": "Télécharger une copie cryptée de la clé sur PBS afin de pouvoir la récupérer sur un hôte réinstallé avec juste une phrase secrète ?",
@@ -7185,7 +7257,7 @@
   "Usage:": "Utilisation :",
   "Use \"Check test progress\" to see results.": "Utilisez « Vérifier la progression du test » pour voir les résultats.",
   "Use 'Export to file' to save it and inspect manually.": "Utilisez « Exporter vers un fichier » pour l'enregistrer et l'inspecter manuellement.",
-  "Use 'pct restore' / 'qmrestore' to recover their disks from your VM backups.": "Utilisez « PCT Restore » / « qmrestore » pour récupérer leurs disques à partir des sauvegardes de votre VM.",
+  "Use 'pct restore' / 'qmrestore' to recover their disks from your VM backups.": "Utilisez 'pct restore' / 'qmrestore' pour récupérer leurs disques depuis les sauvegardes des VM.",
   "Use Custom backup and uncheck the conflicting path from the list": "Utilisez la sauvegarde personnalisée et décochez le chemin en conflit dans la liste",
   "Use Default Settings?": "Utiliser les paramètres par défaut ?",
   "Use Download first if you want to save a copy of the current key. Continue?": "utilisez d'abord Télécharger si vous souhaitez enregistrer une copie de la clé actuelle. Continuer?",
@@ -7609,6 +7681,7 @@
   "active VF(s)": "FV active(s)",
   "active VFs": "VF actives",
   "active Virtual Functions. Changing its driver binding would destroy every VF.": "Fonctions virtuelles actives. Changer la liaison de son pilote détruirait chaque VF.",
+  "added in Proxmox": "ajoutée dans Proxmox",
   "after copy; source tree is incomplete.": "après copie ; l'arborescence des sources est incomplète.",
   "after update.": "après mise à jour.",
   "all guests": "tous les invités",
@@ -7929,8 +8002,8 @@
   "partition(s). Partition table preserved.": "partition(s). Table de partition conservée.",
   "pasted Compose file": "fichier Compose collé",
   "paths for next boot (/etc/pve, guests, drivers, ...)": "chemins pour le prochain démarrage (/etc/pve, invités, pilotes, ...)",
-  "pct exec authorization failed": "échec de l'autorisation d'exécution PCT",
-  "pct push failed. Check log:": "La poussée PCT a échoué. Journal de vérification :",
+  "pct exec authorization failed": "Échec de l’autorisation pour pct exec",
+  "pct push failed. Check log:": "Échec de pct push. Consultez le journal :",
   "pending (reboot required to enumerate full group)": "en attente (redémarrage requis pour énumérer le groupe complet)",
   "phpMyAdmin is installed with arbitrary server connections enabled: the login page has a Server field where the address of the MySQL or MariaDB server is entered, together with its user and password.": "phpMyAdmin est installé avec des connexions de serveur arbitraires activées : la page de connexion a un champ Serveur où l'adresse du serveur MySQL ou MariaDB est saisie, ainsi que son utilisateur et son mot de passe.",
   "pigz configuration completed": "configuration pigz terminée",
@@ -7953,8 +8026,8 @@
   "pvesm command not found. This should not happen on Proxmox.": "Commande pvesm introuvable. Cela ne devrait pas arriver sur Proxmox.",
   "pvesm not available.": "pvesm non disponible.",
   "pvesm not found.": "pvesm introuvable.",
-  "pvesm path failed, trying manual detection...": "Échec du chemin pvesm, tentative de détection manuelle...",
-  "pvesm status failed": "le statut pvesm a échoué",
+  "pvesm path failed, trying manual detection...": "Échec de pvesm path, tentative de détection manuelle...",
+  "pvesm status failed": "Échec de pvesm status",
   "pyLoad is a Free and Open Source download manager written in Python and designed to be extremely lightweight, easily extensible and fully manageable via web.": "pyLoad est un gestionnaire de téléchargement gratuit et Open Source écrit en Python et conçu pour être extrêmement léger, facilement extensible et entièrement gérable via le web.",
   "pyLoad web interface": "PyLoad interface web",
   "qBittorrent WebUI password (user: admin)": "qBittorrent Mot de passe WebUI (utilisateur: admin)",
@@ -7976,6 +8049,7 @@
   "remapped users": "utilisateurs remappés",
   "remove the (now-empty) directory if possible": "supprimez le répertoire (maintenant vide) si possible",
   "removed from Proxmox": "supprimé de Proxmox",
+  "removed in Proxmox": "supprimée dans Proxmox",
   "removed successfully from Proxmox.": "supprimé avec succès de Proxmox.",
   "requires running the official installer, which restarts the Monitor service.": "nécessite l'exécution du programme d'installation officiel, qui redémarre le service Monitor.",
   "requires the package": "nécessite le paquet",
@@ -8032,7 +8106,7 @@
   "switch_gpu_mode.sh was not found.": "switch_gpu_mode.sh n'a pas été trouvé.",
   "sysfs ROM dump failed — trying ACPI VFCT table...": "Échec du vidage de la ROM sysfs - tentative de la table ACPI VFCT...",
   "syslog-ng allows you to flexibly collect, parse, classify, rewrite and correlate logs from across your infrastructure and store or route them to log analysis tools.": "syslog-ng vous permet de collecter, d'analyser, de classer, de réécrire et de corréler les logs de toute votre infrastructure et de les stocker ou de les acheminer vers des outils d'analyse de log.",
-  "systemctl restart networking failed:": "échec du redémarrage du réseau systemctl :",
+  "systemctl restart networking failed:": "Échec de systemctl restart networking :",
   "systemd OnCalendar expression": "expression systemd OnCalendar",
   "the API key was not generated on the first start": "la clé API n'a pas été générée au premier démarrage",
   "the NVIDIA hook of the container is not available:": "le hook NVIDIA du conteneur n'est pas disponible :",
@@ -8079,18 +8153,20 @@
   "using": "en utilisant",
   "using direct path (not guaranteed to survive reboots).": "en utilisant un chemin direct (il n'est pas garanti de survivre aux redémarrages).",
   "vCPUs:": "Processeurs virtuels :",
+  "value changed in Proxmox": "valeur modifiée dans Proxmox",
   "vfio-pci IDs configured": "ID vfio-pci configurés",
   "vfio-pci IDs in /etc/modprobe.d/vfio.conf": "ID vfio-pci dans /etc/modprobe.d/vfio.conf",
   "video": "vidéo",
   "video + recognition": "vidéo + reconnaissance",
   "video only": "vidéo uniquement",
   "vzdump backup speed optimization completed": "Optimisation de la vitesse de sauvegarde de vzdump terminée",
-  "wallabag builds its links from the address given during the installation. If it does not match the address of the container, edit lxc.environment.runtime: SYMFONY__ENV__DOMAIN_NAME in /etc/pve/lxc/<CTID>.conf with the container stopped, and start it again.": "wallabag construit ses liens à partir de l'adresse donnée pendant l'installation. S'il ne correspond pas à l'adresse du conteneur, modifier lxc.environnement. temps d'exécution: SYMFONY ENV DOMAIN NAME dans /etc/pve/lxc/<CTID>.conf avec le conteneur arrêté, et recommencer.",
+  "wallabag builds its links from the address given during the installation. If it does not match the address of the container, edit lxc.environment.runtime: SYMFONY__ENV__DOMAIN_NAME in /etc/pve/lxc/<CTID>.conf with the container stopped, and start it again.": "wallabag construit ses liens avec l’adresse indiquée à l’installation. Si elle ne correspond pas à celle du conteneur, arrêtez-le, modifiez lxc.environment.runtime: SYMFONY__ENV__DOMAIN_NAME dans /etc/pve/lxc/<CTID>.conf, puis redémarrez-le.",
   "wallabag listens on port 80 of the container and stores its data in SQLite.": "wallabag écoute sur le port 80 du conteneur et stocke ses données dans SQLite.",
   "wallabag web interface": "Interface web wallabag",
   "was": "était",
   "was installed, but the kernel reports:": "a été installé, mais le noyau rapporte :",
   "when finished": "à la fin",
+  "when the server has no subscription (you will be asked)": "lorsque le serveur n'a pas d'abonnement (il vous sera demandé)",
   "will rebind the GPU to vfio-pci on the next reboot, breaking the driver that is about to be installed.": "reliera le GPU à vfio-pci au prochain redémarrage, cassant ainsi le pilote qui est sur le point d'être installé.",
   "wipefs failed on": "les wipefs ont échoué",
   "with": "avec",
diff --git a/lang/it.json b/lang/it.json
index 9273f43c..b71db0f4 100644
--- a/lang/it.json
+++ b/lang/it.json
@@ -37,6 +37,7 @@
   "/var/lib/vz/dump   (Proxmox default vzdump path)": "/var/lib/vz/dump (percorso vzdump predefinito di Proxmox)",
   "/var/lib/vz/dump   (Proxmox default)": "/var/lib/vz/dump (predefinito di Proxmox)",
   "1777 = sticky bit + rwx for all. No shared group needed.": "1777 = sticky bit + rwx per tutti. Non è necessario alcun gruppo condiviso.",
+  "====== PBS UPDATE COMPLETED ======": "====== AGGIORNAMENTO PBS COMPLETATO ======",
   "====== PVE UPDATE COMPLETED ======": "====== AGGIORNAMENTO PVE COMPLETATO ======",
   ">> Create a new backup job <<": ">> Crea un nuovo job di backup <<",
   ">> Save and return <<": ">> Salva e torna indietro <<",
@@ -87,6 +88,7 @@
   "A multi-container application is not recreated: its containers are updated together.": "Un’applicazione con più container non viene ricreata: i suoi container vengono aggiornati insieme.",
   "A new ProxMenux version is available:": "È disponibile una nuova versione di ProxMenux:",
   "A new kernel is staged for the next boot:": "Un nuovo kernel è predisposto per il prossimo avvio:",
+  "A newer kernel is installed. Reboot before the next backup window to use it.": "è installato un kernel più recente. Riavviare prima della finestra di backup successiva per utilizzarlo.",
   "A newer version is available:": "È disponibile una versione più recente:",
   "A pending operation exists for": "Operazione in sospeso per il",
   "A pending stack assembly already exists; it is not overwritten": "Esiste già un assemblaggio dello stack in sospeso; non verrà sovrascritto",
@@ -169,6 +171,8 @@
   "APT language configuration updated": "Configurazione lingue APT aggiornata",
   "APT language downloads restored": "Download dei file lingua APT ripristinati",
   "APT package lists updated": "Elenchi pacchetti APT aggiornati",
+  "APT refresh failed. Check the PBS subscription and repositories in Administration > Repositories. Log:": "aggiornamento APT non riuscito. Controllare l'abbonamento e i repository PBS in Amministrazione > Repository. Tronco d'albero:",
+  "APT refresh failed. Check the PBS subscription and repositories in the native PBS interface; no source was changed.": "Aggiornamento degli indici APT non riuscito. Controlla l'abbonamento e i repository PBS nell'interfaccia nativa di PBS; nessuna sorgente è stata modificata.",
   "APT update failed. Check repository access; NVIDIA installation stopped.": "Aggiornamento APT non riuscito. Controlla l’accesso al repository; installazione NVIDIA interrotta.",
   "Aborted": "Interrotto",
   "About to restore": "Ripristino imminente di",
@@ -425,6 +429,7 @@
   "Apply": "Applica",
   "Apply AMD CPU fixes": "Applica correzioni CPU AMD",
   "Apply Available Updates": "Applica aggiornamenti disponibili",
+  "Apply PBS package upgrade": "Applica l'aggiornamento dei pacchetti PBS",
   "Apply and restart services:": "Applicare e riavviare i servizi:",
   "Apply available updates": "Applica aggiornamenti disponibili",
   "Apply boot/initramfs changes": "Applica modifiche boot/initramfs",
@@ -438,12 +443,15 @@
   "Apply options from the current catalog template? New required paths and settings may be requested. Review the resulting configuration before recreating the CT.": "Applicare le opzioni dal modello di catalogo corrente? Potrebbero essere richiesti nuovi percorsi e impostazioni obbligatori. Controlla la configurazione risultante prima di ricreare il CT.",
   "Apply read+write access for 'others' on the host directory?": "Applicare l'accesso in lettura+scrittura per \"altri\" nella directory host?",
   "Apply the options from the current catalog template? Your data and configuration are kept.": "Applicare le opzioni dal modello di catalogo corrente? I dati e la configurazione sono conservati.",
+  "Apply the reviewed package upgrade now? Services may restart and packages listed for removal will be removed.": "Applicare ora l'aggiornamento dei pacchetti esaminato? I servizi potrebbero riavviarsi e i pacchetti indicati per la rimozione verranno rimossi.",
   "Apply these changes?": "Applicare queste modifiche?",
   "Applying AMD-specific fixes...": "Applicazione delle correzioni specifiche AMD...",
+  "Applying CPU and RAM changes without rebuilding the container...": "Applicazione delle modifiche a CPU e RAM senza ricreare il container...",
   "Applying Changes": "Applicazione delle modifiche",
   "Applying Controller/NVMe passthrough to VM": "Applicazione del passthrough Controller/NVMe alla VM",
   "Applying balanced memory optimization settings...": "Applicazione delle impostazioni bilanciate di ottimizzazione della memoria...",
   "Applying changes safely...": "Applicazione sicura delle modifiche...",
+  "Applying container settings without rebuilding the container...": "Applicazione delle impostazioni senza ricreare il container...",
   "Applying custom restore": "Applicazione del ripristino personalizzato",
   "Applying default VM configuration": "Applicazione della configurazione predefinita della VM",
   "Applying host permissions for unprivileged LXC bind-mounts...": "Applicazione delle autorizzazioni sull’host per i bind mount dei container LXC non privilegiati...",
@@ -535,6 +543,7 @@
   "Available Borg targets:": "Destinazioni Borg disponibili:",
   "Available Disks on Host": "Dischi disponibili sull'host",
   "Available ISO Images": "Immagini ISO disponibili",
+  "Available PBS Version": "versione PBS disponibile",
   "Available PBS repositories:": "Repository PBS disponibili:",
   "Available PVE Version": "Versione PVE disponibile",
   "Available Shares:": "Condivisioni disponibili:",
@@ -746,6 +755,7 @@
   "Cannot verify the reused disk:": "Impossibile verificare il disco riutilizzato:",
   "Cannot write the image archive to {storage}. Check storage access and mount status.": "Impossibile scrivere l'archivio immagini su {storage}. Controlla l'accesso allo spazio di archiviazione e lo stato di montaggio.",
   "Capabilities cannot be kept and all dropped at the same time": "Non è possibile conservare alcune capability e rimuoverle tutte contemporaneamente",
+  "Catalog options": "Opzioni del catalogo",
   "Category": "Categoria",
   "Caution: Maximum mode generates more heat.": "Attenzione: la modalità massima genera più calore.",
   "Ceph check skipped by user flag (--ignore-ceph-check)": "Controllo Ceph saltato dal flag utente (--ignore-ceph-check)",
@@ -880,6 +890,7 @@
   "Choose a schedule (systemd calendar-event syntax):": "Scegli una pianificazione (sintassi calendar-event di systemd):",
   "Choose a script to execute:": "Scegli uno script da eseguire:",
   "Choose a server:": "Scegli un server:",
+  "Choose a setting. Changes are applied only after the final review.": "Scegli cosa configurare. Le modifiche vengono applicate solo dopo la verifica finale.",
   "Choose a share to mount:": "Scegli una condivisione da montare:",
   "Choose a specific supported GPU or USB node": "Scegli uno specifico nodo GPU o USB supportato",
   "Choose action for this controller/NVMe:": "Scegli l'azione per questo controller/NVMe:",
@@ -960,6 +971,7 @@
   "Code-server is VS Code running on a remote server, accessible through the browser.": "Code-server è VS Code in esecuzione su un server remoto, accessibile tramite il browser.",
   "CodeProject.AI Server": "CodeProject.AI Server",
   "Command": "Comando",
+  "Command failed": "Comando non riuscito",
   "Command override for an unknown service:": "Override del comando per un servizio sconosciuto:",
   "Commenting any residual Bookworm lines in *.list...": "Disattivazione tramite commento delle eventuali righe residue di Bookworm in *.list…",
   "Commenting legacy PVE 8 repository .list files (if any)...": "Commento dei file .list del repository PVE 8 legacy (se presenti)...",
@@ -1516,6 +1528,7 @@
   "Current NVIDIA inventory resolved: a refresh is required": "Inventario NVIDIA attuale acquisito: è necessario un aggiornamento",
   "Current NVIDIA inventory resolved: no refresh is required": "Inventario NVIDIA corrente acquisito: non serve aggiornarlo",
   "Current Network Configuration": "Configurazione di rete corrente",
+  "Current PBS Version": "versione attuale di PBS",
   "Current PVE Version": "Versione PVE attuale",
   "Current ProxMenux host scripts register remote shares as Proxmox storages using pvesm.": "Gli attuali script host ProxMenux registrano le condivisioni remote come storage Proxmox con pvesm.",
   "Current ProxMenux version:": "Versione attuale di ProxMenux:",
@@ -1681,6 +1694,7 @@
   "Detected Coral hardware:": "Hardware Coral rilevato:",
   "Detected GPU(s):": "GPU rilevate:",
   "Detected Intel CPU": "Rilevata CPU Intel",
+  "Detected Proxmox Backup Server": "Proxmox Backup Server rilevato",
   "Detected Proxmox VE": "Rilevato Proxmox VE",
   "Detected Proxmox VE 8.x - Installing Ceph Squid for Debian": "Rilevato Proxmox VE 8.x - Installazione di Ceph Squid per Debian",
   "Detected Proxmox VE 9.x - Installing Ceph Squid for Debian Trixie": "Rilevato Proxmox VE 9.x - Installazione di Ceph Squid per Debian Trixie",
@@ -1762,6 +1776,9 @@
   "Disabling and stopping rpcbind service and socket...": "Disabilitazione e arresto del servizio e del socket rpcbind...",
   "Disabling non-free firmware warnings...": "Disabilitazione degli avvisi sul firmware non libero...",
   "Disabling portmapper/rpcbind for security...": "Disabilitazione di portmapper/rpcbind per sicurezza...",
+  "Discard changes": "Scarta le modifiche",
+  "Discard unapplied changes?": "Scartare le modifiche non applicate?",
+  "Discover NFS exports on a server": "Individuare le esportazioni NFS di un server",
   "Discover targets on portal:": "Scopri target sul portale:",
   "Discovering iSCSI targets...": "Individuazione dei target iSCSI...",
   "Discovery successful": "Scoperta riuscita",
@@ -1841,6 +1858,7 @@
   "Do you want to proceed with the system update?": "Vuoi procedere con l'aggiornamento del sistema?",
   "Do you want to proceed?": "Vuoi procedere?",
   "Do you want to reboot now?": "Vuoi riavviare ora?",
+  "Do you want to remove the Proxmox subscription banner from the Proxmox Backup Server web interface?": "Vuoi rimuovere il banner dell'abbonamento Proxmox dall'interfaccia web di Proxmox Backup Server?",
   "Do you want to remove the stale entry from vfio.conf and continue?": "Vuoi rimuovere la voce obsoleta da vfio.conf e continuare?",
   "Do you want to remove the stale entry from vfio.conf?": "Vuoi rimuovere la voce obsoleta da vfio.conf?",
   "Do you want to restart the network service now to apply changes?": "Riavviare ora il servizio di rete per applicare le modifiche?",
@@ -2266,6 +2284,7 @@
   "Failed to clone log2ram repository. Check /tmp/log2ram_install.log": "Impossibile clonare il repository log2ram. Controlla /tmp/log2ram_install.log",
   "Failed to configure EFI disk": "Impossibile configurare il disco EFI",
   "Failed to configure IOMMU automatically.": "Impossibile configurare IOMMU automaticamente.",
+  "Failed to configure Proxmox Backup Server repositories": "Impossibile configurare i repository di Proxmox Backup Server",
   "Failed to configure Proxmox repositories": "Impossibile configurare i repository Proxmox",
   "Failed to configure TPM device in VM": "Impossibile configurare il dispositivo TPM nella VM",
   "Failed to configure repositories.": "Impossibile configurare i repository.",
@@ -2973,6 +2992,7 @@
   "Inaccessible device during VM startup": "Dispositivo inaccessibile durante l'avvio della VM",
   "Inactive": "Inattivo",
   "Inactive (entry in fstab, not currently mounted)": "Inattivo (presente in fstab, attualmente non montato)",
+  "Include these changes in oci-compose?": "Includere queste modifiche in oci-compose?",
   "Include these resources in oci-compose?": "Includere queste risorse in oci-compose?",
   "Includes /etc/network (may drop SSH immediately)": "Include /etc/network (potrebbe interrompere immediatamente la connessione SSH)",
   "Includes /etc/zfs": "Include /etc/zfs",
@@ -3209,6 +3229,8 @@
   "Invalid ALLOWED_HOSTS value": "Valore ALLOWED_HOSTS non valido",
   "Invalid Home Assistant OS check timeout": "Timeout controllo Home Assistant OS non valido",
   "Invalid ID": "ID non valido",
+  "Invalid IPv4 address": "Indirizzo IPv4 non valido",
+  "Invalid IPv4 gateway": "Gateway IPv4 non valido",
   "Invalid Intel render path": "Percorso di rendering Intel non valido",
   "Invalid Jellyfin path:": "Percorso Jellyfin non valido:",
   "Invalid MAC address:": "Indirizzo MAC non valido:",
@@ -3241,6 +3263,7 @@
   "Invalid administrator email": "Email amministratore non valida",
   "Invalid administrator user name": "Nome utente amministratore non valido",
   "Invalid base VMID": "VMID di base non valido",
+  "Invalid bridge": "Bridge non valido",
   "Invalid check package:": "Pacchetto controllo non valido:",
   "Invalid configuration path:": "Percorso configurazione non valido:",
   "Invalid consume/export volumes": "Volumi di acquisizione/esportazione non validi",
@@ -3304,6 +3327,7 @@
   "Invalid remote name": "Nome del remote non valido",
   "Invalid remote path": "Percorso remoto non valido",
   "Invalid repair version:": "Versione di riparazione non valida:",
+  "Invalid resource value": "Valore della risorsa non valido",
   "Invalid resources": "Risorse non valide",
   "Invalid restored volume path": "Percorso volume ripristinato non valido",
   "Invalid running state": "Stato di esecuzione non valido",
@@ -3322,6 +3346,7 @@
   "Invalid stack members": "Membri stack non validi",
   "Invalid stack name": "Nome stack non valido",
   "Invalid stack operation": "Operazione stack non valida",
+  "Invalid storage": "Archiviazione non valida",
   "Invalid storage ID. Use only letters, numbers, hyphens and underscores.": "ID storage non valido. Usa solo lettere, numeri, trattini e trattini bassi.",
   "Invalid storage name": "Nome storage non valido",
   "Invalid suite application": "Applicazione suite non valida",
@@ -4153,6 +4178,7 @@
   "No active Proxmox storage accepts OCI template archives.": "Nessuno spazio di archiviazione Proxmox attivo accetta archivi modello OCI.",
   "No active exports or showmount not available": "Nessuna esportazione attiva o showmount non disponibile",
   "No active session": "Nessuna sessione attiva",
+  "No active subscription and no usable PBS repository. Noninteractive mode cannot change APT sources; configure them in Administration > Repositories.": "nessun abbonamento attivo e nessun repository PBS utilizzabile. La modalità non interattiva non può modificare le origini APT;configurarli in Amministrazione > Repository.",
   "No active subscription and no usable PVE repository. Noninteractive mode cannot change APT sources; configure them in Node > Updates > Repositories.": "Nessun abbonamento attivo e nessun repository PVE utilizzabile. La modalità non interattiva non può modificare le origini APT; configurarle in Nodo > Aggiornamenti > Repository.",
   "No additional GPU can be added.": "Non è possibile aggiungere alcuna GPU aggiuntiva.",
   "No additional device needs to be added.": "Non è necessario aggiungere alcun dispositivo aggiuntivo.",
@@ -4257,6 +4283,7 @@
   "No password provided.": "Nessuna password fornita.",
   "No paths available": "Nessun percorso disponibile",
   "No paths selected. Select at least one path.": "Nessun percorso selezionato. Seleziona almeno un percorso.",
+  "No pending changes": "Nessuna modifica in sospeso",
   "No pending paths to schedule for reboot.": "Nessun percorso in sospeso da pianificare per il riavvio.",
   "No permanent NFS mounts configured.": "Nessun montaggio NFS permanente configurato.",
   "No permanent Samba mounts configured.": "Nessun montaggio Samba permanente configurato.",
@@ -4398,6 +4425,7 @@
   "OVH RTM removed (Puppet artefacts may need manual cleanup)": "OVH RTM rimosso (gli artefatti di Puppet potrebbero richiedere una pulizia manuale)",
   "OVH server detected": "Rilevato server OVH",
   "OVH server detection and RTM installation process completed": "Processo di rilevamento dei server OVH e installazione RTM completato",
+  "Object detector": "Rilevatore di oggetti",
   "Object detector for Frigate": "Rilevatore di oggetti per Frigate",
   "Observer is not responding on port 4357": "Observer non risponde sulla porta 4357",
   "Obsidian is a note-taking app that lets you create, link, and organize your notes on your device, with hundreds of plugins and themes to customize your workflow. You can also publish your notes online, access them offline, and sync them securely with end-to-end encryption.": "Obsidian è un’app per creare, collegare e organizzare le note sul tuo dispositivo, con centinaia di plugin e temi per personalizzare il flusso di lavoro. Puoi pubblicare le note online, consultarle offline e sincronizzarle in modo sicuro con crittografia end-to-end.",
@@ -4523,11 +4551,17 @@
   "PBS backup error log": "Registro errori backup PBS",
   "PBS backup failed.": "Backup PBS non riuscito.",
   "PBS certificate": "Certificato PBS",
+  "PBS datastores": "Datastore PBS",
   "PBS encryption keyfile (show / replace / remove)": "File chiave di crittografia PBS (mostra/sostituisci/rimuovi)",
   "PBS encryption keyfile — detailed info": "File chiave di crittografia PBS: dettagli",
   "PBS extraction failed": "Estrazione PBS non riuscita",
   "PBS host or IP address:": "Host PBS o indirizzo IP:",
+  "PBS package update": "Aggiornamento dei pacchetti PBS",
+  "PBS package upgrade completed. Check whether a reboot is required before your next backup window.": "Aggiornamento dei pacchetti PBS completato. Verifica se è necessario un riavvio prima della prossima finestra di backup.",
+  "PBS package upgrade failed. Review the APT output before retrying.": "Aggiornamento dei pacchetti PBS non riuscito. Esamina l'output di APT prima di riprovare.",
   "PBS upload": "Caricamento PBS",
+  "PBS version and packages": "Versione e pacchetti PBS",
+  "PBS: using the configured APT repositories without changing sources.": "PBS: vengono usati i repository APT configurati senza modificare le sorgenti.",
   "PCI Address": "Indirizzo PCI",
   "PCI passthrough, TPM state, cloud-init configuration, Proxmox hooks": "Passthrough PCI, stato TPM, configurazione cloud-init, hook Proxmox",
   "PCI passthrough, TPM state, cloud-init, snapshots, Proxmox-specific hooks": "Passthrough PCI, stato TPM, cloud-init, snapshot, hook specifici di Proxmox",
@@ -4864,12 +4898,17 @@
   "Proxmology logo applied": "Logo Proxmology applicato",
   "Proxmox 9 system update allready": "Il sistema è già aggiornato a Proxmox 9",
   "Proxmox APT repositories configured": "Repository APT Proxmox configurati",
+  "Proxmox Backup Server": "Proxmox Backup Server",
   "Proxmox Backup Server (PBS) destinations": "Destinazioni Proxmox Backup Server (PBS)",
+  "Proxmox Backup Server APT repositories configured": "Repository APT di Proxmox Backup Server configurati",
+  "Proxmox Backup Server Update": "Aggiornamento di Proxmox Backup Server",
+  "Proxmox Backup Server update completed.": "Aggiornamento di Proxmox Backup Server completato.",
   "Proxmox CIFS Storage Status:": "Stato storage CIFS Proxmox:",
   "Proxmox NFS Storage Status:": "Stato storage NFS Proxmox:",
   "Proxmox System Update": "Aggiornamento sistema Proxmox",
   "Proxmox Update": "Aggiornamento Proxmox",
   "Proxmox VE": "Proxmox VE",
+  "Proxmox VE 8 package upgrade failed. Review the APT output before retrying.": "L’aggiornamento dei pacchetti di Proxmox VE 8 non è riuscito. Controlla l’output di APT prima di riprovare.",
   "Proxmox VE 8 system update completed successfully": "Aggiornamento sistema Proxmox VE 8 completato",
   "Proxmox VE 8 to 9 Manual Upgrade Guide": "Guida aggiornamento manuale Proxmox VE da 8 a 9",
   "Proxmox VE 9.x no-subscription repository created": "Repository senza abbonamento Proxmox VE 9.x creato",
@@ -4877,6 +4916,7 @@
   "Proxmox VE configuration completed.": "Configurazione Proxmox VE completata.",
   "Proxmox VE safe update completed": "Aggiornamento sicuro di Proxmox VE completato",
   "Proxmox auth logger service created and started": "Servizio log autenticazione Proxmox creato e avviato",
+  "Proxmox could not apply the container settings": "Proxmox non è riuscito ad applicare le impostazioni del container",
   "Proxmox enterprise repo might be missing or inaccessible. Trying to switch to no-subscription...": "Il repository enterprise Proxmox potrebbe essere mancante o inaccessibile. Tentativo di passare al repository no-subscription...",
   "Proxmox filter configured": "Filtro Proxmox configurato",
   "Proxmox iSCSI Storage Status:": "Stato storage iSCSI Proxmox:",
@@ -4993,6 +5033,7 @@
   "Rebuilding initramfs to apply nouveau blacklist before installation...": "Ricostruzione di initramfs per applicare la blacklist di nouveau prima dell'installazione...",
   "Rebuilding the container and recovering it from its backup are tested on the same image; the first update to a newer image is still to be observed.": "La ricostruzione del container e il ripristino dal backup sono stati testati con la stessa immagine; il primo aggiornamento a un'immagine più recente resta da verificare.",
   "Recent": "Recente",
+  "Recent PBS tasks": "Attività PBS recenti",
   "Recent Samba Servers": "Server Samba recenti",
   "Recent Samba server": "Server Samba recente",
   "Recent logs:": "Registri recenti:",
@@ -5052,6 +5093,7 @@
   "Recreation completed. Data kept.": "Ricreazione completata. Dati conservati.",
   "Recreation prepared": "Ricreazione preparata",
   "Refresh APT index and verify repositories:": "Aggiorna l'indice APT e verifica i repository:",
+  "Refresh the configured APT repositories and review the PBS package upgrade? Repository files will be preserved.": "Aggiornare gli indici dei repository APT configurati ed esaminare l'aggiornamento dei pacchetti PBS? I file dei repository verranno conservati.",
   "Refresh token of the connector, from the Twingate admin console": "Token di refresh del connettore, dalla console di amministrazione Twingate",
   "Refresh your browser (Ctrl+Shift+R) to see changes": "Aggiorna il browser (Ctrl+Shift+R) per vedere le modifiche",
   "Refresh your browser to see changes (server restart may be required)": "Aggiorna il browser per vedere le modifiche (potrebbe essere necessario il riavvio del server)",
@@ -5141,6 +5183,8 @@
   "Remove saved credentials": "Rimuovi le credenziali salvate",
   "Remove subscription banner": "Rimuovi il banner di abbonamento",
   "Remove the application? Its container disks are deleted, and only a backup can bring them back.": "Rimuovere l’applicazione? I dischi dei suoi container vengono eliminati e solo un backup può ripristinarli.",
+  "Remove the lock left on a VM by an interrupted task": "Rimuovere il blocco lasciato su una VM da un’attività interrotta",
+  "Remove the lock left on a container by an interrupted task": "Rimuovere il blocco lasciato su un container da un’attività interrotta",
   "Remove the saved credentials for {registry}?\nRunning apps will keep working.": "Rimuovere le credenziali salvate per {registry}?\nLe app in esecuzione continueranno a funzionare.",
   "Remove the unprivileged flag from configuration:": "Rimuovi il flag unprivileged dalla configurazione:",
   "Remove unused packages and their config": "Rimuovi i pacchetti non utilizzati e la loro configurazione",
@@ -5222,6 +5266,7 @@
   "Repository helper unavailable. NVIDIA installation stopped.": "Funzione di gestione dei repository non disponibile. L’installazione di NVIDIA è stata interrotta.",
   "Repository policy returned an unexpected result.": "La policy del repository ha restituito un risultato imprevisto.",
   "Repository ready.": "Repository pronto.",
+  "Repository sources changed, but APT package-list refresh failed. Operation stopped; sources were not rolled back. Inspect Administration > Repositories and retry apt-get update before continuing.": "Le sorgenti dei repository sono cambiate, ma l'aggiornamento dell'elenco dei pacchetti APT non è riuscito. Operazione interrotta; le sorgenti non sono state ripristinate. Controlla Administration > Repositories e riesegui apt-get update prima di continuare.",
   "Repository sources changed, but APT package-list refresh failed. Operation stopped; sources were not rolled back. Inspect Node > Updates > Repositories and retry apt-get update before continuing.": "Le origini del repository sono cambiate, ma l'aggiornamento dell'elenco dei pacchetti APT non è riuscito. Operazione interrotta; le origini non sono state ripristinate. Controlla Nodo > Aggiornamenti > Repository e riprova apt-get update prima di continuare.",
   "Repository switch declined; no APT source changed.": "Cambio di repository rifiutato; nessuna origine APT è stata modificata.",
   "Repository:": "Repository:",
@@ -5316,7 +5361,9 @@
   "Reverting ZFS ARC tuning...": "Rimozione delle ottimizzazioni di ZFS ARC…",
   "Reverting pigz wrapper...": "Rimozione del wrapper pigz e ripristino della configurazione precedente...",
   "Reverting vzdump speed tuning...": "Rimozione ottimizzazioni velocità vzdump…",
+  "Review and apply": "Verifica e applica",
   "Review external OCI changes": "Esamina le modifiche OCI esterne",
+  "Review package upgrade": "Esamina l'aggiornamento dei pacchetti",
   "Review passthrough config files": "Esamina i file di configurazione passthrough",
   "Review what will be removed": "Controlla cosa verrà rimosso",
   "Rip DVD and Blu-ray media from a browser": "Estrai contenuti da DVD e Blu-ray tramite browser",
@@ -5359,6 +5406,7 @@
   "Run the following inside the VM:": "Esegui quanto segue nella VM:",
   "Run the release-channel switch from an SSH session or the Proxmox host console with:": "Esegui il cambio del canale di rilascio da una sessione SSH o dalla console dell’host Proxmox con:",
   "Run the update from an SSH session or the Proxmox host console with:": "Esegui l’aggiornamento da una sessione SSH o dalla console dell’host Proxmox con:",
+  "Run this operation as root.": "Esegui questa operazione come root.",
   "Run upgrade checklist script:": "Esegui lo script di controllo dell’aggiornamento:",
   "Running": "In esecuzione",
   "Running Lynis security audit...": "Esecuzione controllo di sicurezza Lynis...",
@@ -5773,6 +5821,7 @@
   "ShareCoveX panel": "Pannello ShareCoveX",
   "Shared Directory Ready:": "Directory condivisa pronta:",
   "Shared Group": "Gruppo condiviso",
+  "Shared directories": "Cartelle condivise",
   "Shared directory created:": "Directory condivisa creata:",
   "Shared directory for consume and export": "Directory condivisa per consume ed export",
   "Shared directory for copy/sync operations": "Directory condivisa per copia e sincronizzazione",
@@ -5802,6 +5851,7 @@
   "Should show pve-manager/9.x.x": "Dovrebbe mostrare pve-manager/9.x.x",
   "Shoutrrr addresses for the notifications (optional)": "Indirizzi Shoutrrr per le notifiche (facoltativi)",
   "Show All Scripts": "Mostra tutti gli script",
+  "Show CT users and their UID/GID on the host": "Utenti del CT e loro UID/GID sull’host",
   "Show CT users in table format": "Mostra utenti CT in tabella",
   "Show Container Privilege Status": "Mostra stato privilegi container",
   "Show DNS resolution status": "Mostra stato risoluzione DNS",
@@ -5963,6 +6013,7 @@
   "Start the VM to begin Windows installation from the mounted ISO.": "Avvia la VM per iniziare l’installazione di Windows dalla ISO montata.",
   "Start the applications once they are registered? Answer No if the original containers are still running on another host: both would use the same addresses.": "Avviare le applicazioni dopo la registrazione? Rispondi No se i container originali sono ancora in esecuzione su un altro host: entrambi userebbero gli stessi indirizzi.",
   "Start the converted container:": "Avvia il container convertito:",
+  "Start the interactive Proxmox package upgrade": "Avviare l’aggiornamento interattivo dei pacchetti Proxmox",
   "Start the main system upgrade:": "Avvia l’aggiornamento principale del sistema:",
   "Start the stack with Proxmox": "Avvia lo stack con Proxmox",
   "Start uploading to PBS — sets a recovery passphrase": "Avvia il caricamento su PBS — viene impostata una passphrase di ripristino",
@@ -6242,6 +6293,7 @@
   "The Paperless persistent volumes need at least 8 GB": "I volumi persistenti di Paperless richiedono almeno 8 GB",
   "The PostgreSQL volume needs at least 4 GB": "Il volume PostgreSQL richiede almeno 4 GB",
   "The PostgreSQL volume needs at least 8 GB": "Il volume PostgreSQL richiede almeno 8 GB",
+  "The Proxmox VE 8 update did not finish. The upgrade to Proxmox VE 9 was not started.": "L’aggiornamento di Proxmox VE 8 non è stato completato. L’aggiornamento a Proxmox VE 9 non è stato avviato.",
   "The Proxmox archive keyring is missing; Ceph installation cannot continue safely": "Manca il portachiavi dell’archivio Proxmox; l’installazione di Ceph non può continuare in sicurezza",
   "The Proxmox inventory and the local configurations differ": "L'inventario Proxmox e le configurazioni locali differiscono",
   "The ROCm image has no support for the AMD GPU of this host:": "L’immagine ROCm non supporta la GPU AMD di questo host:",
@@ -6312,6 +6364,7 @@
   "The build could not be checked beforehand; continuing without that check.": "Non è stato possibile verificare la build in anticipo; si prosegue senza tale verifica.",
   "The cached image does not match the current digest": "L'immagine nella cache non corrisponde al digest corrente",
   "The cached image is damaged; it will be downloaded again.": "L'immagine nella cache è danneggiata; verrà scaricata nuovamente.",
+  "The changes need the application installer": "Le modifiche richiedono il programma di installazione dell’applicazione",
   "The character device does not exist:": "Il dispositivo a caratteri non esiste:",
   "The command asks for a password that is not echoed. After creating the users, the web interface asks for a user name and a password.": "Il comando richiede una password non visualizzata durante la digitazione. Dopo la creazione degli utenti, l’interfaccia web richiede nome utente e password.",
   "The command does not name an image": "Il comando non specifica un’immagine",
@@ -6431,8 +6484,10 @@
   "The host bind source does not exist:": "La sorgente del bind mount sull’host non esiste:",
   "The host bind source is not a regular file or directory:": "La sorgente del bind mount sull'host non è un file regolare né una directory:",
   "The host directory changed before it was mounted": "La directory dell'host è cambiata prima del montaggio",
+  "The host directory does not exist": "La directory dell’host non esiste",
   "The host directory may not be accessible from an unprivileged container.": "La directory dell’host potrebbe non essere accessibile da un container non privilegiato.",
   "The host has no IPv4 address on the selected bridge": "L'host non ha un indirizzo IPv4 sul bridge selezionato",
+  "The host loses access to them. If the group includes a network or storage controller the host needs, cancel at the summary.": "L’host perde l’accesso a questi dispositivi. Se il gruppo include un controller di rete o di archiviazione necessario all’host, annulla nel riepilogo.",
   "The host monitor does not see the real host memory": "Il monitoraggio dell'host non rileva la memoria reale dell'host",
   "The host monitor does not share this host namespace:": "Il monitor dell'host non condivide questo namespace dell'host:",
   "The host monitor include is unknown or differs from the saved record": "L'include del monitor host è sconosciuto o diverso dal record salvato",
@@ -6622,6 +6677,7 @@
   "The repair must preserve the image dependencies:": "La riparazione deve conservare le dipendenze dell'immagine:",
   "The requested VMID block is already in use": "Il blocco di VMID richiesto è già in uso",
   "The requested machine learning GPU profile is not working; it is not replaced by CPU": "Il profilo GPU richiesto per il machine learning non funziona; non viene sostituito dalla CPU",
+  "The resource edit could not be fully rolled back. Open Manage again to review and import the current Proxmox settings.": "Non è stato possibile annullare completamente la modifica delle risorse. Riapri il menu di gestione per verificare e importare le impostazioni attuali di Proxmox.",
   "The restored service did not pass its health check": "Il servizio ripristinato non ha superato il controllo dello stato",
   "The restored service stopped; the recovery is not confirmed": "Il servizio ripristinato si è arrestato; il recupero non è confermato",
   "The reviewed Tandoor stack does not require a privileged LXC.": "Lo stack Tandoor esaminato non richiede un container LXC privilegiato.",
@@ -6667,6 +6723,7 @@
   "The selected VM": "La VM selezionata",
   "The selected VM is running.": "La VM selezionata è in esecuzione.",
   "The selected base folder does not exist and could not be created:": "La cartella di base selezionata non esiste e non è stato possibile crearla:",
+  "The selected bridge does not exist": "Il bridge selezionato non esiste",
   "The selected bridge has no IPv4 subnet for the host-monitor firewall": "Il bridge selezionato non ha una sottorete IPv4 per il firewall del monitoraggio dell’host",
   "The selected configuration needs to start the LXC during the installation": "La configurazione selezionata richiede l'avvio del container LXC durante l'installazione",
   "The selected container is unprivileged. A privileged container is required for direct device passthrough.": "Il container selezionato non è privilegiato. È richiesto un container privilegiato per il passthrough diretto del dispositivo.",
@@ -6689,6 +6746,7 @@
   "The service builds its own image; only a published image can be installed": "Il servizio crea la propria immagine; si possono installare solo immagini pubblicate",
   "The service declares no image:": "Il servizio non dichiara alcuna immagine:",
   "The setting has no final value:": "L'impostazione non ha un valore finale:",
+  "The settings could not be fully rolled back. Review the container and its saved modification before continuing.": "Non è stato possibile ripristinare tutte le impostazioni. Controlla il container e la modifica salvata prima di continuare.",
   "The share already exists in smb.conf:": "La condivisione esiste già in smb.conf:",
   "The shared destination is not a directory": "La destinazione condivisa non è una directory",
   "The shared directory points to a protected host path": "La directory condivisa punta a un percorso protetto dell'host",
@@ -6756,19 +6814,24 @@
   "These Proxmox resources were added outside ProxMenux:": "Queste risorse Proxmox sono state aggiunte fuori da ProxMenux:",
   "These VMIDs are not free:": "Questi VMID non sono disponibili:",
   "These are the changes that will be made": "Verranno apportate queste modifiche",
+  "These changes were made in Proxmox outside ProxMenux:": "Queste modifiche sono state apportate in Proxmox al di fuori di ProxMenux:",
   "These container mount paths have an extension-like suffix:": "Questi percorsi di mount del container hanno un suffisso simile a un'estensione:",
   "These containers were restored from a backup and this host has no record of their OCI application:": "Questi container sono stati ripristinati da un backup e questo host non ha il record della loro applicazione OCI:",
+  "These devices share the IOMMU group of the selected GPU and will be assigned to the VM with it:": "Questi dispositivi condividono il gruppo IOMMU della GPU selezionata e verranno assegnati alla VM insieme a essa:",
   "These host backups run with this job and expect its storage:": "Questi backup dell’host vengono eseguiti con questo job e richiedono il suo storage:",
   "These host backups run with this job and will stop running:": "Questi backup dell'host vengono eseguiti con questo lavoro e interromperanno l'esecuzione:",
   "These interface configurations will be removed": "Queste configurazioni dell'interfaccia verranno rimosse",
   "These manual changes cannot be adopted safely:": "Queste modifiche manuali non possono essere acquisite in modo sicuro:",
   "These paths will not be restored live and will be extracted for manual recovery.": "Questi percorsi non verranno ripristinati sul sistema in esecuzione e verranno estratti per il ripristino manuale.",
+  "These settings require an application-specific adaptation. The image was not downloaded and the container was not recreated.": "Queste impostazioni richiedono un adattamento specifico per l’applicazione. L’immagine non è stata scaricata e il container non è stato ricreato.",
   "These values are asked during the installation:": "Questi valori verranno richiesti durante l’installazione:",
   "They are described in the image documentation:": "Sono descritti nella documentazione dell'immagine:",
   "They will be added to oci-compose before continuing. Unsupported or changed resources are not imported.": "Se confermi e la verifica finale riesce, queste risorse verranno registrate in oci-compose prima di proseguire. Le risorse non supportate o modificate non vengono acquisite.",
+  "They will be saved in oci-compose before continuing.": "Verranno salvate in oci-compose prima di continuare.",
   "This CIFS share is mounted with restrictive permissions.": "Questa condivisione CIFS è montata con autorizzazioni restrittive.",
   "This GPU is considered incompatible with GPU passthrough to a VM in ProxMenux.": "Questa GPU è considerata incompatibile con il passthrough GPU a una VM in ProxMenux.",
   "This NFS share is fully restricted — even the host root cannot write to it.": "Questa condivisione NFS è completamente limitata: nemmeno l'utente root dell'host può scrivervi.",
+  "This Proxmox Backup Server has no active subscription, switch to the no-subscription repository? The inaccessible Enterprise PBS source will be disabled.": "Questo Proxmox Backup Server non ha un abbonamento attivo. Passare al repository senza abbonamento? La sorgente Enterprise PBS non accessibile verrà disattivata.",
   "This VM requires extra installation steps, see install guide at:\nhttps://github.com/community-scripts/ProxmoxVE/discussions/144": "Questa VM richiede ulteriori passaggi di installazione; vedere la guida:\nhttps://github.com/community-scripts/ProxmoxVE/discussions/144",
   "This account is for {registry}. Enter an image from that registry.": "Questo account è per {registry}. Inserisci un'immagine da quel registro.",
   "This action will:": "Questa azione:",
@@ -6830,10 +6893,13 @@
   "This may take several minutes...": "L'operazione potrebbe richiedere diversi minuti...",
   "This means Proxmox handles mount lifecycle natively (no manual /etc/fstab needed for NFS/CIFS host storages).": "Proxmox gestisce il montaggio nativamente (non occorre modificare manualmente /etc/fstab per gli storage host NFS/CIFS).",
   "This means the credentials are incorrect.": "Ciò significa che le credenziali non sono corrette.",
+  "This menu requires Proxmox Backup Server.": "Questo menu richiede Proxmox Backup Server.",
   "This might indicate network connectivity issues.": "Ciò potrebbe indicare problemi di connettività di rete.",
   "This monitor uses a privileged LXC, shares processes and network with Proxmox and disables AppArmor in the CT. It uses the IP address and firewall of the host. A compromised image could affect the host; do not expose its web UI to the Internet.": "Questo monitor usa un LXC privilegiato, condivide processi e rete con Proxmox e disabilita AppArmor nel CT. Usa IP e firewall dell’host. Un’immagine compromessa potrebbe compromettere l’host; non esporre l’interfaccia web a Internet.",
   "This only removes the schedule. Existing backup archives are NOT deleted.": "Viene rimossa solo la pianificazione. Gli archivi di backup esistenti NON vengono eliminati.",
   "This operation may take several minutes and requires internet connectivity.": "L’operazione può richiedere diversi minuti e necessita di connettività Internet.",
+  "This operation requires a Proxmox VE host. Use the PBS menu on Proxmox Backup Server.": "Questa operazione richiede un host Proxmox VE. Usa il menu PBS su Proxmox Backup Server.",
+  "This operation supports PBS 3 on Debian 12 and PBS 4 on Debian 13.": "Questa operazione supporta PBS 3 su Debian 12 e PBS 4 su Debian 13.",
   "This package was installed by older versions of the ProxMenux Coral installer that placed the M.2 kernel driver on every system, including USB-only setups. It is not needed for Coral USB devices, which use libedgetpu1-std / libedgetpu1-max only.": "Questo pacchetto è stato installato dalle versioni precedenti del programma di installazione ProxMenux Coral, che installavano il driver del kernel M.2 su ogni sistema, comprese le configurazioni solo USB. Non è necessario per i dispositivi USB Coral, che utilizzano solo libedgetpu1-std / libedgetpu1-max.",
   "This passphrase is the ONLY way to access encrypted Borg backups.": "Questa passphrase è l'UNICO modo per accedere ai backup Borg crittografati.",
   "This path is already used as a mount point in this container.": "Questo percorso è già utilizzato come punto di montaggio in questo container.",
@@ -6849,6 +6915,7 @@
   "This script cannot be executed from the Proxmox web terminal.": "Questo script non può essere eseguito dal terminale web Proxmox.",
   "This script must be run as root.": "Questo script deve essere eseguito come root.",
   "This script must be run on a Proxmox host.": "Questo script deve essere eseguito su un host Proxmox.",
+  "This script will apply the following optimizations and advanced adjustments to your Proxmox Backup Server": "Questo script applicherà le seguenti ottimizzazioni e regolazioni avanzate al tuo Proxmox Backup Server",
   "This script will apply the following optimizations and advanced adjustments to your Proxmox VE server": "Questo script applicherà le seguenti ottimizzazioni e regolazioni avanzate al server Proxmox VE",
   "This script will update your Proxmox VE system with advanced options:": "Questo script aggiornerà il sistema Proxmox VE con opzioni avanzate:",
   "This session is running in the Monitor terminal. Running it from here would cut the connection mid-install and leave the switch in a broken state.": "Questa sessione è in esecuzione nel terminale Monitor. Eseguirlo da qui interromperebbe la connessione a metà installazione e lascerebbe il cambio di canale incompleto.",
@@ -6980,6 +7047,7 @@
   "Unable to identify the root filesystem. Aborting.": "Impossibile identificare il filesystem root. Interruzione.",
   "Unable to resolve system ZFS pool disks. Aborting.": "Impossibile individuare i dischi del pool ZFS di sistema. Interruzione.",
   "Unable to resolve system disk topology. Aborting.": "Impossibile determinare la topologia del disco di sistema. Interruzione.",
+  "Unapplied changes": "Modifiche non applicate",
   "Understand the security implications of privileged containers": "Comprendere le implicazioni sulla sicurezza dei container privilegiati",
   "Unexpected Proxmox inventory; recovery blocked": "Inventario Proxmox inatteso; ripristino bloccato",
   "Unexpected formatting directory in the new Valkey volume": "Directory di formattazione imprevista nel nuovo volume Valkey",
@@ -7079,6 +7147,7 @@
   "Unsupported OCI-LXC AppArmor profile:": "Profilo OCI-LXC AppArmor non supportato:",
   "Unsupported OCI-LXC seccomp profile:": "Profilo seccomp OCI-LXC non supportato:",
   "Unsupported Terminal": "Terminale non supportato",
+  "Unsupported architecture for Figurine:": "Architettura non supportata da Figurine:",
   "Unsupported architecture:": "Architettura non supportata:",
   "Unsupported backup compression": "Compressione backup non supportata",
   "Unsupported credential pattern:": "Schema credenziali non supportato:",
@@ -7094,6 +7163,7 @@
   "Unsupported mount type": "Tipo mount non supportato",
   "Unsupported mount type:": "Tipo mount non supportato:",
   "Unsupported native device type:": "Tipo dispositivo nativo non supportato:",
+  "Unsupported network settings": "Impostazioni di rete non supportate",
   "Unsupported operation": "Operazione non supportata",
   "Unsupported or unknown Proxmox version; no repository changed.": "Versione Proxmox non supportata o sconosciuta; nessun repository è stato modificato.",
   "Unsupported output format:": "Formato output non supportato:",
@@ -7121,6 +7191,7 @@
   "Update NVIDIA in LXC Containers": "Aggiorna NVIDIA nei container LXC",
   "Update OCI": "Aggiorna OCI",
   "Update OCI stack": "Aggiorna stack OCI",
+  "Update PBS using configured repositories": "Aggiorna PBS usando i repository configurati",
   "Update PVE enterprise repository (Only if using enterprise):": "Aggiorna repository enterprise PVE (solo se si utilizza enterprise):",
   "Update Proxmox VE Appliance Manager": "Aggiorna Proxmox VE Appliance Manager",
   "Update Proxmox package lists": "Aggiorna elenchi pacchetti Proxmox",
@@ -7173,6 +7244,7 @@
   "Upgrade assistant: Proxmox VE 8 → 9 (Trixie)": "Assistente aggiornamento: Proxmox VE 8 → 9 (Trixie)",
   "Upgrade canceled by user": "Aggiornamento annullato dall'utente",
   "Upgrade one node at a time": "Aggiorna un nodo alla volta",
+  "Upgrade the system, offering the": "aggiorna il sistema, offrendo il",
   "Upgrade to Proxmox VE 9": "Aggiorna a Proxmox VE 9",
   "Upgrading NVIDIA utils (Arch)...": "Aggiornamento utilità NVIDIA (Arch)...",
   "Upload an encrypted copy of the key to PBS so you can recover it on a reinstalled host with just a passphrase?": "Caricare una copia crittografata della chiave su PBS per recuperarla su un host reinstallato con la sola passphrase?",
@@ -7610,6 +7682,7 @@
   "active VF(s)": "VF attive",
   "active VFs": "VF attive",
   "active Virtual Functions. Changing its driver binding would destroy every VF.": "funzioni virtuali attive. La modifica del collegamento del driver distruggerebbe ogni VF.",
+  "added in Proxmox": "aggiunta in Proxmox",
   "after copy; source tree is incomplete.": "dopo la copia; l'albero dei sorgenti è incompleto.",
   "after update.": "dopo l'aggiornamento.",
   "all guests": "tutti i guest",
@@ -7977,6 +8050,7 @@
   "remapped users": "utenti rimappati",
   "remove the (now-empty) directory if possible": "rimuovere la directory (ora vuota) se possibile",
   "removed from Proxmox": "rimosso da Proxmox",
+  "removed in Proxmox": "rimossa in Proxmox",
   "removed successfully from Proxmox.": "rimosso con successo da Proxmox.",
   "requires running the official installer, which restarts the Monitor service.": "richiede l'esecuzione del programma di installazione ufficiale, che riavvia il servizio Monitor.",
   "requires the package": "richiede il pacchetto",
@@ -8080,6 +8154,7 @@
   "using": "utilizzando",
   "using direct path (not guaranteed to survive reboots).": "utilizzando il percorso diretto (non è garantito che sopravviva ai riavvii).",
   "vCPUs:": "vCPU:",
+  "value changed in Proxmox": "valore modificato in Proxmox",
   "vfio-pci IDs configured": "ID vfio-pci configurati",
   "vfio-pci IDs in /etc/modprobe.d/vfio.conf": "ID vfio-pci in /etc/modprobe.d/vfio.conf",
   "video": "video",
@@ -8092,6 +8167,7 @@
   "was": "era",
   "was installed, but the kernel reports:": "è stato installato, ma il kernel segnala:",
   "when finished": "al termine",
+  "when the server has no subscription (you will be asked)": "quando il server non ha abbonamento (ti verrà chiesto)",
   "will rebind the GPU to vfio-pci on the next reboot, breaking the driver that is about to be installed.": "riassocerà la GPU a vfio-pci al prossimo riavvio, impedendo il funzionamento del driver che sta per essere installato.",
   "wipefs failed on": "wipefs non è riuscito su",
   "with": "con",
diff --git a/lang/pt.json b/lang/pt.json
index 508796a6..a0a14f5f 100644
--- a/lang/pt.json
+++ b/lang/pt.json
@@ -37,6 +37,7 @@
   "/var/lib/vz/dump   (Proxmox default vzdump path)": "/var/lib/vz/dump (caminho vzdump padrão do Proxmox)",
   "/var/lib/vz/dump   (Proxmox default)": "/var/lib/vz/dump (padrão Proxmox)",
   "1777 = sticky bit + rwx for all. No shared group needed.": "1777 = sticky bit + rwx para todos. Nenhum grupo compartilhado é necessário.",
+  "====== PBS UPDATE COMPLETED ======": "====== ATUALIZAÇÃO PBS CONCLUÍDA ======",
   "====== PVE UPDATE COMPLETED ======": "====== ATUALIZAÇÃO PVE CONCLUÍDA ======",
   ">> Create a new backup job <<": ">> Crie uma nova tarefa de backup <<",
   ">> Save and return <<": ">> Salvar e retornar <<",
@@ -87,6 +88,7 @@
   "A multi-container application is not recreated: its containers are updated together.": "Um aplicativo com vários contêineres não é recriado: seus contêineres são atualizados juntos.",
   "A new ProxMenux version is available:": "Uma nova versão do ProxMenux está disponível:",
   "A new kernel is staged for the next boot:": "Um novo kernel está preparado para a próxima inicialização:",
+  "A newer kernel is installed. Reboot before the next backup window to use it.": "Um kernel mais recente está instalado. Reinicie antes da próxima janela de backup para usá-lo.",
   "A newer version is available:": "Uma versão mais recente está disponível:",
   "A pending operation exists for": "Existe uma operation pendente para",
   "A pending stack assembly already exists; it is not overwritten": "Já existe um conjunto de pilha pendente; não é substituído",
@@ -136,7 +138,7 @@
   "ALL DATA ON": "TODOS OS DADOS EM",
   "ALL DATA ON THIS DISK WILL BE PERMANENTLY LOST!": "TODOS OS DADOS NESTE DISCO SERÃO PERMANENTEMENTE PERDIDOS!",
   "ALL Utilities": "TODOS os utilitários",
-  "ALLOWED_HOSTS cannot contain line breaks": "Allowed hosts não pode conter quebras de linha",
+  "ALLOWED_HOSTS cannot contain line breaks": "ALLOWED_HOSTS não pode conter quebras de linha",
   "AList initial login": "Login inicial do AList",
   "AMD (ROCm)": "AMD (ROCm)",
   "AMD (VA-API and ROCm detection)": "AMD (detecção VA-API e ROCm)",
@@ -169,6 +171,8 @@
   "APT language configuration updated": "Configuração de idioma APT atualizada",
   "APT language downloads restored": "Downloads de idiomas APT restaurados",
   "APT package lists updated": "Listas de pacotes APT atualizadas",
+  "APT refresh failed. Check the PBS subscription and repositories in Administration > Repositories. Log:": "falha na atualização do APT.Verifique a assinatura e os repositórios do PBS em Administração > Repositórios. Registro:",
+  "APT refresh failed. Check the PBS subscription and repositories in the native PBS interface; no source was changed.": "Falha ao atualizar os índices APT. Verifique a subscrição e os repositórios PBS na interface nativa do PBS; nenhuma fonte foi alterada.",
   "APT update failed. Check repository access; NVIDIA installation stopped.": "Falha na atualização do APT. Verifique o acesso ao repositório; a instalação do NVIDIA foi interrompida.",
   "Aborted": "Abortado",
   "About to restore": "Prestes a restaurar",
@@ -425,6 +429,7 @@
   "Apply": "Aplicar",
   "Apply AMD CPU fixes": "Aplicar correções de CPU AMD",
   "Apply Available Updates": "Aplicar atualizações disponíveis",
+  "Apply PBS package upgrade": "Aplicar a atualização de pacotes PBS",
   "Apply and restart services:": "Aplique e reinicie os serviços:",
   "Apply available updates": "Aplicar atualizações disponíveis",
   "Apply boot/initramfs changes": "Aplicar alterações de boot/initramfs",
@@ -438,12 +443,15 @@
   "Apply options from the current catalog template? New required paths and settings may be requested. Review the resulting configuration before recreating the CT.": "Aplicar opções do modelo de catálogo atual? Novos caminhos e configurações necessários podem ser solicitados. Revise a configuração resultante antes de recriar o CT.",
   "Apply read+write access for 'others' on the host directory?": "Aplicar acesso de leitura + gravação para 'outros' no diretório host?",
   "Apply the options from the current catalog template? Your data and configuration are kept.": "Aplicar as opções do modelo de catálogo atual? Seus dados e configuração são mantidos.",
+  "Apply the reviewed package upgrade now? Services may restart and packages listed for removal will be removed.": "Aplicar agora a atualização de pacotes revista? Os serviços podem reiniciar e os pacotes indicados para remoção serão removidos.",
   "Apply these changes?": "Aplicar essas alterações?",
   "Applying AMD-specific fixes...": "Aplicando correções específicas da AMD...",
+  "Applying CPU and RAM changes without rebuilding the container...": "A aplicar as alterações de CPU e RAM sem recriar o contentor...",
   "Applying Changes": "Aplicando alterações",
   "Applying Controller/NVMe passthrough to VM": "Aplicando passagem de controlador/NVMe à VM",
   "Applying balanced memory optimization settings...": "Aplicando configurações de otimização de memória balanceadas...",
   "Applying changes safely...": "Aplicando alterações com segurança...",
+  "Applying container settings without rebuilding the container...": "A aplicar as definições sem recriar o contentor...",
   "Applying custom restore": "Aplicando restauração personalizada",
   "Applying default VM configuration": "Aplicando configuração de VM padrão",
   "Applying host permissions for unprivileged LXC bind-mounts...": "Aplicando permissões de host para montagens de ligação LXC sem privilégios...",
@@ -535,6 +543,7 @@
   "Available Borg targets:": "Alvos Borg disponíveis:",
   "Available Disks on Host": "Discos disponíveis no host",
   "Available ISO Images": "Imagens ISO disponíveis",
+  "Available PBS Version": "versão PBS disponível",
   "Available PBS repositories:": "Repositórios PBS disponíveis:",
   "Available PVE Version": "Versão PVE disponível",
   "Available Shares:": "Ações disponíveis:",
@@ -746,6 +755,7 @@
   "Cannot verify the reused disk:": "Não foi possível verificar o disco reutilizado:",
   "Cannot write the image archive to {storage}. Check storage access and mount status.": "Não é possível gravar o arquivo de imagem em {storage}. Verifique o acesso ao armazenamento e o status de montagem.",
   "Capabilities cannot be kept and all dropped at the same time": "Capacidades não podem ser mantidas e todas retiradas ao mesmo tempo",
+  "Catalog options": "Opções do catálogo",
   "Category": "Categoria",
   "Caution: Maximum mode generates more heat.": "Cuidado: O modo máximo gera mais calor.",
   "Ceph check skipped by user flag (--ignore-ceph-check)": "Verificação do Ceph ignorada pelo sinalizador do usuário (--ignore-ceph-check)",
@@ -880,6 +890,7 @@
   "Choose a schedule (systemd calendar-event syntax):": "Escolha uma programação (sintaxe de evento de calendário do systemd):",
   "Choose a script to execute:": "Escolha um script para executar:",
   "Choose a server:": "Escolha um servidor:",
+  "Choose a setting. Changes are applied only after the final review.": "Escolha o que configurar. As alterações só são aplicadas após a revisão final.",
   "Choose a share to mount:": "Escolha um compartilhamento para montar:",
   "Choose a specific supported GPU or USB node": "Escolha um GPU ou nó USB específico compatível",
   "Choose action for this controller/NVMe:": "Escolha a ação para este controlador/NVMe:",
@@ -960,6 +971,7 @@
   "Code-server is VS Code running on a remote server, accessible through the browser.": "O servidor de código é VS Code em execução em um servidor remoto, acessível através do navegador.",
   "CodeProject.AI Server": "CodeProject. AI Server",
   "Command": "Comando",
+  "Command failed": "O comando falhou",
   "Command override for an unknown service:": "Sobreposição de comandos para um serviço desconhecido:",
   "Commenting any residual Bookworm lines in *.list...": "Comentando quaisquer linhas residuais do Bookworm em *.list...",
   "Commenting legacy PVE 8 repository .list files (if any)...": "Comentando arquivos .list do repositório PVE 8 legado (se houver)...",
@@ -1516,6 +1528,7 @@
   "Current NVIDIA inventory resolved: a refresh is required": "Inventário NVIDIA atual resolvido: uma atualização é required",
   "Current NVIDIA inventory resolved: no refresh is required": "Inventário NVIDIA atual resolvido: nenhuma atualização é required",
   "Current Network Configuration": "Configuração de rede atual",
+  "Current PBS Version": "versão atual do PBS",
   "Current PVE Version": "Versão atual do PVE",
   "Current ProxMenux host scripts register remote shares as Proxmox storages using pvesm.": "Os scripts atuais do host ProxMenux registram compartilhamentos remotos como armazenamentos Proxmox usando pvesm.",
   "Current ProxMenux version:": "Versão atual do ProxMenux:",
@@ -1630,8 +1643,8 @@
   "Default Proxmox logo applied": "Logotipo padrão do Proxmox aplicado",
   "Default is none (video-only passthrough). Use SPACE to toggle selections.": "O padrão é nenhum (passagem somente de vídeo). Use ESPAÇO para alternar as seleções.",
   "Default journald configuration restored": "Configuração padrão do diário restaurada",
-  "Default location is /mnt/<name>. The share will be mounted here on the host with open permissions so an unprivileged LXC can bind-mount and write to it. For LXC access, bind-mount this path with the LXC Mount Manager.": "O local padrão é /mnt/<nome>. O compartilhamento será montado aqui no host com permissões abertas para que um LXC sem privilégios possa montar e gravar nele. Para acesso LXC, monte este caminho com o LXC Mount Manager.",
-  "Default location is /mnt/<name>. The share will be mounted here on the host. Use this path in /etc/fstab. For LXC access, bind-mount this path with the LXC Mount Manager.": "O local padrão é /mnt/<nome>. O compartilhamento será montado aqui no host. Use este caminho em /etc/fstab. Para acesso LXC, monte este caminho com o LXC Mount Manager.",
+  "Default location is /mnt/<name>. The share will be mounted here on the host with open permissions so an unprivileged LXC can bind-mount and write to it. For LXC access, bind-mount this path with the LXC Mount Manager.": "A localização predefinida é /mnt/<name>. A partilha será montada aqui no host com permissões abertas, para que um LXC sem privilégios a possa montar por bind mount e nela escrever. Utilize o LXC Mount Manager para criar essa montagem no LXC.",
+  "Default location is /mnt/<name>. The share will be mounted here on the host. Use this path in /etc/fstab. For LXC access, bind-mount this path with the LXC Mount Manager.": "A localização predefinida é /mnt/<name>. A partilha será montada aqui no host. Utilize este caminho em /etc/fstab. Para aceder a partir de um LXC, crie um bind mount deste caminho com o LXC Mount Manager.",
   "Default login": "Utilizador por omissão",
   "Default options": "Opções padrão",
   "Default options read/write": "Opções padrão leitura/gravação",
@@ -1681,6 +1694,7 @@
   "Detected Coral hardware:": "Hardware Coral detectado:",
   "Detected GPU(s):": "GPU(s) detectada(s):",
   "Detected Intel CPU": "CPU Intel detectada",
+  "Detected Proxmox Backup Server": "Proxmox Backup Server detectado",
   "Detected Proxmox VE": "Proxmox VE detectado",
   "Detected Proxmox VE 8.x - Installing Ceph Squid for Debian": "Detectado Proxmox VE 8.x - Instalando Ceph Squid para Debian",
   "Detected Proxmox VE 9.x - Installing Ceph Squid for Debian Trixie": "Detectado Proxmox VE 9.x - Instalando Ceph Squid para Debian Trixie",
@@ -1762,6 +1776,9 @@
   "Disabling and stopping rpcbind service and socket...": "Desativando e parando o serviço e soquete rpcbind...",
   "Disabling non-free firmware warnings...": "Desativando avisos de firmware não-livre...",
   "Disabling portmapper/rpcbind for security...": "Desativando portmapper/rpcbind por segurança...",
+  "Discard changes": "Descartar alterações",
+  "Discard unapplied changes?": "Descartar as alterações por aplicar?",
+  "Discover NFS exports on a server": "Descobrir as exportações NFS de um servidor",
   "Discover targets on portal:": "Descubra alvos no portal:",
   "Discovering iSCSI targets...": "Descobrindo alvos iSCSI...",
   "Discovery successful": "Descoberta bem-sucedida",
@@ -1841,6 +1858,7 @@
   "Do you want to proceed with the system update?": "Deseja prosseguir com a atualização do sistema?",
   "Do you want to proceed?": "Você quer prosseguir?",
   "Do you want to reboot now?": "Você quer reiniciar agora?",
+  "Do you want to remove the Proxmox subscription banner from the Proxmox Backup Server web interface?": "Deseja remover o banner de assinatura do Proxmox da interface web do Proxmox Backup Server?",
   "Do you want to remove the stale entry from vfio.conf and continue?": "Deseja remover a entrada obsoleta do vfio.conf e continuar?",
   "Do you want to remove the stale entry from vfio.conf?": "Você deseja remover a entrada obsoleta do vfio.conf?",
   "Do you want to restart the network service now to apply changes?": "Deseja reiniciar o serviço de rede agora para aplicar as alterações?",
@@ -2018,7 +2036,7 @@
   "Enter VM ID:": "Insira o ID da VM:",
   "Enter VM/CT ID:": "Insira o ID da VM/CT:",
   "Enter ZFS pool name for the selected disk:": "Insira o nome do pool ZFS para o disco selecionado:",
-  "Enter a name for the mount point (used as /mnt/<name>):": "Insira um nome para o ponto de montagem (usado como /mnt/<nome>):",
+  "Enter a name for the mount point (used as /mnt/<name>):": "Introduza um nome para o ponto de montagem (será usado como /mnt/<name>):",
   "Enter a name for the new virtual machine:": "Insira um nome para a nova máquina virtual:",
   "Enter a non-empty password or access token on a single line.": "Insira uma senha ou token de acesso não vazio em uma única linha.",
   "Enter a number, or write or paste a command:": "Digite um número ou escreva ou cole um comando:",
@@ -2162,11 +2180,11 @@
   "Example: cp /etc/pve/lxc/114.conf /etc/pve/lxc/114.conf.bak": "Exemplo: cp /etc/pve/lxc/114.conf /etc/pve/lxc/114.conf.bak",
   "Example: daily or Mon..Fri 03:00": "Exemplo: diariamente ou Seg..Sex 03:00",
   "Example: mkdir -p /tmp/lxc_convert_114": "Exemplo: mkdir -p /tmp/lxc_convert_114",
-  "Example: pct config 110 | grep unprivileged": "Exemplo: configuração pct 110 | grep sem privilégios",
+  "Example: pct config 110 | grep unprivileged": "Exemplo: pct config 110 | grep unprivileged",
   "Example: pct stop 110": "Exemplo: pct stop 110",
-  "Example: pct stop 114": "Exemplo: parada pct 114",
+  "Example: pct stop 114": "Exemplo: pct stop 114",
   "Example: pvesm add nfs nfs-nas --server 192.168.1.50 --export /volume1/proxmox --content import,backup": "Exemplo: pvesm add nfs nfs-nas --server 192.168.1.50 --export /volume1/proxmox --content import,backup",
-  "Example: pvesm path local-lvm:vm-114-disk-0": "Exemplo: caminho pvesm local-lvm:vm-114-disk-0",
+  "Example: pvesm path local-lvm:vm-114-disk-0": "Exemplo: pvesm path local-lvm:vm-114-disk-0",
   "Example: sed -i '/^unprivileged: 1/d' /etc/pve/lxc/110.conf": "Exemplo: sed -i '/^unprivileged: 1/d' /etc/pve/lxc/110.conf",
   "Examples:": "Exemplos:",
   "Execute destructive rollback?": "Executar reversão destrutiva?",
@@ -2266,6 +2284,7 @@
   "Failed to clone log2ram repository. Check /tmp/log2ram_install.log": "Falha ao clonar o repositório log2ram. Verifique /tmp/log2ram_install.log",
   "Failed to configure EFI disk": "Falha ao configurar o disco EFI",
   "Failed to configure IOMMU automatically.": "Falha ao configurar o IOMMU automaticamente.",
+  "Failed to configure Proxmox Backup Server repositories": "Falha ao configurar os repositórios do Proxmox Backup Server",
   "Failed to configure Proxmox repositories": "Falha ao configurar repositórios Proxmox",
   "Failed to configure TPM device in VM": "Falha ao configurar o dispositivo TPM na VM",
   "Failed to configure repositories.": "Falha ao configurar repositórios.",
@@ -2477,7 +2496,7 @@
   "For a consistent export, the VM should be stopped.": "Para uma exportação consistente, a VM deve ser interrompida.",
   "For any question, issue or bug report, please use the official repository": "Para qualquer dúvida, problema ou relatório de bug, use o repositório oficial",
   "For dedicated GPUs, FLR is required by this policy to reduce VM": "Para GPUs dedicadas, o FLR é exigido por esta política para reduzir VM",
-  "For example: pct enter 101": "Por exemplo: pct digite 101",
+  "For example: pct enter 101": "Por exemplo: pct enter 101",
   "For guest shares add: --options guest": "Para compartilhamentos de convidados, adicione: --options guest",
   "For security reasons, the system cannot format it.": "Por motivos de segurança, o sistema não pode formatá-lo.",
   "For unprivileged containers, use instead:": "Para contêineres sem privilégios, use:",
@@ -2889,8 +2908,8 @@
   "If notifications are enabled (Telegram/Discord/ntfy/...), you will receive a \"Host restore finished\" message when all background tasks complete.": "Se as notificações estiverem habilitadas (Telegram/Discord/ntfy/...), você receberá uma mensagem \"Restauração do host concluída\" quando todas as tarefas em segundo plano forem concluídas.",
   "If passthrough fails on Windows: install RadeonResetBugFix.": "Se a passagem falhar no Windows: instale RadeonResetBugFix.",
   "If path not accessible (ZFS/BTRFS):": "Se o caminho não estiver acessível (ZFS/BTRFS):",
-  "If pvesm path returned a DEVICE (LVM):": "Se o caminho pvesm retornou um DEVICE (LVM):",
-  "If pvesm path returned a DIRECTORY (ZFS/BTRFS):": "Se o caminho pvesm retornou um DIRETÓRIO (ZFS/BTRFS):",
+  "If pvesm path returned a DEVICE (LVM):": "Se pvesm path devolveu um DISPOSITIVO (LVM):",
+  "If pvesm path returned a DIRECTORY (ZFS/BTRFS):": "Se pvesm path devolveu um DIRETÓRIO (ZFS/BTRFS):",
   "If repositories error:": "Se houver erro nos repositórios:",
   "If the container had already been changed, its previous native backup is restored. Shared host directories are not reverted. The disks of the failed attempt are removed when the cleanup succeeds.": "Se o contêiner já tiver sido alterado, seu backup nativo anterior será restaurado. Os diretórios de host compartilhados não são revertidos. Os discos da tentativa fracassada serão removidos quando a limpeza for bem-sucedida.",
   "If the host freezes, remove hostpci entries from": "Se o host congelar, remova as entradas hostpci de",
@@ -2973,6 +2992,7 @@
   "Inaccessible device during VM startup": "Dispositivo inacessível durante a inicialização da VM",
   "Inactive": "Inativo",
   "Inactive (entry in fstab, not currently mounted)": "Inativo (entrada no fstab, não montada no momento)",
+  "Include these changes in oci-compose?": "Incluir essas alterações no oci-compose?",
   "Include these resources in oci-compose?": "Incluir esses recursos no oci-compose?",
   "Includes /etc/network (may drop SSH immediately)": "Inclui /etc/network (pode descartar o SSH imediatamente)",
   "Includes /etc/zfs": "Inclui /etc/zfs",
@@ -3029,7 +3049,7 @@
   "Initiator IQN is authorised on the target": "O iniciador IQN está autorizado no alvo",
   "Initiator IQN:": "IQN do iniciador:",
   "Inkscape is professional quality vector graphics software which runs on Linux, Mac OS X and Windows desktop computers.": "Inkscape é um software gráfico vetorial de qualidade profissional que funciona em computadores desktop Linux, Mac OS X e Windows.",
-  "Inside the LXC, create the administrator: console kimai:user:create YOUR_USERNAME YOUR_EMAIL ROLE_SUPER_ADMIN": "Dentro do LXC, crie o administrador: console kimai:user:create Your USERNAME Your EMAIL ROLE_SUPER_ADMIN",
+  "Inside the LXC, create the administrator: console kimai:user:create YOUR_USERNAME YOUR_EMAIL ROLE_SUPER_ADMIN": "Dentro do LXC, crie o administrador: console kimai:user:create YOUR_USERNAME YOUR_EMAIL ROLE_SUPER_ADMIN",
   "Inspect disks before any action": "Inspecione os discos antes de qualquer ação",
   "Inspect host device nodes": "Inspecione os nós do dispositivo host",
   "Inspect passthrough/kernel events": "Inspecionar eventos de passagem/kernel",
@@ -3206,9 +3226,11 @@
   "Interrupted operation:": "operation interrompida:",
   "Interrupted stack operation found": "Pilha interrompida operation encontrada",
   "Invalid 'proxmox-ve' candidate (not 9.x or none). Please verify your repository configuration and network, then retry.": "Candidato 'proxmox-ve' inválido (não 9.x ou nenhum). Verifique a configuração e a rede do seu repositório e tente novamente.",
-  "Invalid ALLOWED_HOSTS value": "Valor Allowed hosts inválido",
+  "Invalid ALLOWED_HOSTS value": "Valor de ALLOWED_HOSTS inválido",
   "Invalid Home Assistant OS check timeout": "Tempo de verificação do sistema operacional Home Assistant inválido",
   "Invalid ID": "ID inválido",
+  "Invalid IPv4 address": "Endereço IPv4 inválido",
+  "Invalid IPv4 gateway": "Gateway IPv4 inválido",
   "Invalid Intel render path": "Caminho de renderização Intel inválido",
   "Invalid Jellyfin path:": "Caminho Jellyfin inválido:",
   "Invalid MAC address:": "Endereço MAC inválido:",
@@ -3241,6 +3263,7 @@
   "Invalid administrator email": "E- mail de administrador inválido",
   "Invalid administrator user name": "Nome de usuário do administrador inválido",
   "Invalid base VMID": "VMID base inválida",
+  "Invalid bridge": "Bridge inválida",
   "Invalid check package:": "Pacote de verificação inválido:",
   "Invalid configuration path:": "Caminho de configuração inválido:",
   "Invalid consume/export volumes": "Volumes de consumo/exportação inválidos",
@@ -3304,6 +3327,7 @@
   "Invalid remote name": "Nome remoto inválido",
   "Invalid remote path": "Caminho remoto inválido",
   "Invalid repair version:": "Versão de reparação inválida:",
+  "Invalid resource value": "Valor de recurso inválido",
   "Invalid resources": "Recursos inválidos",
   "Invalid restored volume path": "Caminho de volume restaurado inválido",
   "Invalid running state": "Estado de execução inválido",
@@ -3322,6 +3346,7 @@
   "Invalid stack members": "Membros inválidos da pilha",
   "Invalid stack name": "Nome da pilha inválido",
   "Invalid stack operation": "Pilha inválida operation",
+  "Invalid storage": "Armazenamento inválido",
   "Invalid storage ID. Use only letters, numbers, hyphens and underscores.": "ID de armazenamento inválido. Use apenas letras, números, hífens e sublinhados.",
   "Invalid storage name": "Nome de armazenamento inválido",
   "Invalid suite application": "Aplicativo de suite inválido",
@@ -3436,7 +3461,7 @@
   "Keyfile removed.": "arquivo-chave removido.",
   "Keyrings method failed; trying apt-key fallback": "O método dos chaveiros falhou; tentando substituto do apt-key",
   "KiCad - A Cross Platform and Open Source Electronics Design Automation Suite.": "KiCad - Uma plataforma cruzada e Open Source Electronics Design Automation Suite.",
-  "Kimai has no default account. Enter the container with: pct enter {main_vmid}": "Kimai não tem conta padrão. Digite o recipiente com: pct enter {main  vmid}",
+  "Kimai has no default account. Enter the container with: pct enter {main_vmid}": "O Kimai não tem uma conta predefinida. Aceda ao contentor com: pct enter {main_vmid}",
   "Kimai is a professional grade time-tracking application, free and open-source.": "Kimai é um aplicativo de rastreamento de tempo profissional, gratuito e de código aberto.",
   "Kometa is a powerful tool designed to give you complete control over your media libraries. With Kometa, you can take your customization to the next level, with granular control over metadata, collections, overlays, and much more.": "Kometa é uma ferramenta poderosa projetada para lhe dar controle completo sobre suas bibliotecas de mídia. Com o Kometa, você pode levar sua personalização para o próximo nível, com controle granular sobre metadados, coleções, sobreposições e muito mais.",
   "Kometa reads its configuration from /config/config.yml and the container only ships /config/config.yml.template. Copy the template to config.yml, fill in the required Plex and TMDb connections, then restart the container.": "Kometa lê a sua configuração a partir de /config/config.yml e o recipiente apenas navios /config/config.yml.template. Copie o modelo para config.yml, preencha o requi vermelho Plex e conexões TMDb, em seguida, reinicie o recipiente.",
@@ -3488,7 +3513,7 @@
   "Leave empty to keep every backup (not recommended).": "Deixe em branco para manter todos os backups (não recomendado).",
   "Leave empty to use the retention of the storage.": "Deixe em branco para usar a retenção do armazenamento.",
   "Legacy PVE 8 .list files commented or not present": "Arquivos .list PVE 8 legados comentados ou não presentes",
-  "Legacy ceph.list commented or not present": "Ceph.list legado comentado ou não presente",
+  "Legacy ceph.list commented or not present": "ceph.list antigo comentado ou inexistente",
   "Legacy gasket-dkms cleanup could not be verified as complete.": "Não foi possível confirmar a conclusão da limpeza do pacote gasket-dkms legado.",
   "Legacy gasket-dkms detected": "gasket-dkms legado detetado",
   "Legacy network tools (e.g., ifconfig)": "Ferramentas de rede legadas (por exemplo, ifconfig)",
@@ -4153,6 +4178,7 @@
   "No active Proxmox storage accepts OCI template archives.": "Nenhum armazenamento Proxmox ativo aceita arquivos de modelo OCI.",
   "No active exports or showmount not available": "Nenhuma exportação ativa ou showmount não disponível",
   "No active session": "Nenhuma sessão ativa",
+  "No active subscription and no usable PBS repository. Noninteractive mode cannot change APT sources; configure them in Administration > Repositories.": "Nenhuma assinatura ativa e nenhum repositório PBS utilizável. O modo não interativo não pode alterar fontes APT;configure-os em Administração > Repositórios.",
   "No active subscription and no usable PVE repository. Noninteractive mode cannot change APT sources; configure them in Node > Updates > Repositories.": "Nenhuma assinatura ativa e nenhum repositório PVE utilizável. O modo não interativo não pode alterar fontes APT; configure-as em Nó > Atualizações > Repositórios.",
   "No additional GPU can be added.": "Nenhuma GPU adicional pode ser adicionada.",
   "No additional device needs to be added.": "Nenhum dispositivo adicional precisa ser adicionado.",
@@ -4215,7 +4241,7 @@
   "No format-safe disks are available.": "Nenhum disco de formato seguro está disponível.",
   "No free ProxMenux private /24 network is available": "Nenhuma rede privada ProxMenux livre 24 está disponível",
   "No gasket DKMS registrations remain.": "Não restam registos DKMS de gasket.",
-  "No group creation required — uses world-writable sticky bit permissions.": "Não é necessária a criação de grupos — usa permissões de sticky bit graváveis ​​mundialmente.",
+  "No group creation required — uses world-writable sticky bit permissions.": "Não é necessária a criação de grupos — usa permissões de sticky bit graváveis mundialmente.",
   "No guest selected.": "Nenhum convidado selecionado.",
   "No host VFIO reconfiguration expected": "Nenhuma reconfiguração VFIO do host é esperada",
   "No host VFIO/native binding changes were required.": "Nenhuma alteração de ligação VFIO/nativa do host foi necessária.",
@@ -4238,7 +4264,7 @@
   "No jobs": "Sem empregos",
   "No language selected.": "Nenhum idioma selecionado.",
   "No local disk storage configured.": "Nenhum armazenamento em disco local configurado.",
-  "No main sources.list present (skipped)": "Nenhuma fonte principal.list presente (ignorada)",
+  "No main sources.list present (skipped)": "Não existe um sources.list principal (ignorado)",
   "No matches for:": "Nenhuma correspondência para:",
   "No matching PVE vzdump jobs were found for the PBS backend.": "Nenhum trabalho PVE vzdump correspondente foi encontrado para o backend do PBS.",
   "No matching PVE vzdump jobs were found for the local archive backend.": "Nenhum trabalho PVE vzdump correspondente foi encontrado para o back-end do arquivo local.",
@@ -4257,6 +4283,7 @@
   "No password provided.": "Nenhuma senha fornecida.",
   "No paths available": "Nenhum caminho disponível",
   "No paths selected. Select at least one path.": "Nenhum caminho selecionado. Selecione pelo menos um caminho.",
+  "No pending changes": "Sem alterações pendentes",
   "No pending paths to schedule for reboot.": "Não há caminhos pendentes para agendar a reinicialização.",
   "No permanent NFS mounts configured.": "Nenhuma montagem NFS permanente configurada.",
   "No permanent Samba mounts configured.": "Nenhuma montagem permanente do Samba configurada.",
@@ -4398,6 +4425,7 @@
   "OVH RTM removed (Puppet artefacts may need manual cleanup)": "OVH RTM removido (artefatos de marionetes podem precisar de limpeza manual)",
   "OVH server detected": "Servidor OVH detectado",
   "OVH server detection and RTM installation process completed": "Processo de detecção do servidor OVH e instalação RTM concluído",
+  "Object detector": "Detetor de objetos",
   "Object detector for Frigate": "Detector de objetos para Frigate",
   "Observer is not responding on port 4357": "Observador não está respondendo na porta 4357",
   "Obsidian is a note-taking app that lets you create, link, and organize your notes on your device, with hundreds of plugins and themes to customize your workflow. You can also publish your notes online, access them offline, and sync them securely with end-to-end encryption.": "Obsidian é um aplicativo de anotações que permite criar, vincular e organizar suas notas em seu dispositivo, com centenas de plugins e temas para personalizar seu fluxo de trabalho. Você também pode publicar suas notas online, acessá-las offline e sincronizá-las com segurança com criptografia de ponta a ponta.",
@@ -4432,7 +4460,7 @@
   "Only an installed standalone OCI instance can adopt external changes": "Somente uma instância OCI autônoma instalada pode adotar alterações externas",
   "Only backed-up Proxmox volumes can be adopted": "Somente volumes Proxmox com backup podem ser adotados",
   "Only convert to privileged if absolutely necessary for your use case.": "Converta para privilegiado apenas se for absolutamente necessário para o seu caso de uso.",
-  "Only fully free disks are shown (not system-used and not referenced by VM/LXC).": "Somente discos totalmente livres são mostrados (não usados ​​pelo sistema e não referenciados pelo VM/LXC).",
+  "Only fully free disks are shown (not system-used and not referenced by VM/LXC).": "Somente discos totalmente livres são mostrados (não usados pelo sistema e não referenciados pelo VM/LXC).",
   "Only if using enterprise subscription": "Somente se estiver usando assinatura corporativa",
   "Only if using no-subscription repository": "Somente se estiver usando repositório sem assinatura",
   "Only needed if you mounted the filesystem in step 6b": "Necessário apenas se você montou o sistema de arquivos na etapa 6b",
@@ -4523,11 +4551,17 @@
   "PBS backup error log": "Log de erros de backup do PBS",
   "PBS backup failed.": "Falha no backup do PBS.",
   "PBS certificate": "certificado PBS",
+  "PBS datastores": "Armazenamentos de dados PBS",
   "PBS encryption keyfile (show / replace / remove)": "arquivo-chave de criptografia PBS (mostrar/substituir/remover)",
   "PBS encryption keyfile — detailed info": "arquivo-chave de criptografia PBS – informações detalhadas",
   "PBS extraction failed": "Falha na extração de PBS",
   "PBS host or IP address:": "Host PBS ou endereço IP:",
+  "PBS package update": "Atualização de pacotes PBS",
+  "PBS package upgrade completed. Check whether a reboot is required before your next backup window.": "Atualização de pacotes PBS concluída. Verifique se é necessário reiniciar antes do próximo período de cópias de segurança.",
+  "PBS package upgrade failed. Review the APT output before retrying.": "A atualização de pacotes PBS falhou. Reveja a saída do APT antes de tentar novamente.",
   "PBS upload": "upload PBS",
+  "PBS version and packages": "Versão e pacotes PBS",
+  "PBS: using the configured APT repositories without changing sources.": "PBS: a usar os repositórios APT configurados sem alterar as fontes.",
   "PCI Address": "Endereço PCI",
   "PCI passthrough, TPM state, cloud-init configuration, Proxmox hooks": "Passagem PCI, estado TPM, configuração de inicialização em nuvem, ganchos Proxmox",
   "PCI passthrough, TPM state, cloud-init, snapshots, Proxmox-specific hooks": "Passagem PCI, estado TPM, inicialização em nuvem, snapshots, ganchos específicos do Proxmox",
@@ -4864,12 +4898,17 @@
   "Proxmology logo applied": "Logotipo da Proxmologia aplicado",
   "Proxmox 9 system update allready": "Atualização do sistema Proxmox 9 já",
   "Proxmox APT repositories configured": "repositórios Proxmox APT configurados",
+  "Proxmox Backup Server": "Proxmox Backup Server",
   "Proxmox Backup Server (PBS) destinations": "Destinos Proxmox Backup Server (PBS)",
+  "Proxmox Backup Server APT repositories configured": "Repositórios APT do Proxmox Backup Server configurados",
+  "Proxmox Backup Server Update": "Atualização do Proxmox Backup Server",
+  "Proxmox Backup Server update completed.": "Atualização do Proxmox Backup Server concluída.",
   "Proxmox CIFS Storage Status:": "Status de armazenamento CIFS do Proxmox:",
   "Proxmox NFS Storage Status:": "Status de armazenamento NFS do Proxmox:",
   "Proxmox System Update": "Atualização do sistema Proxmox",
   "Proxmox Update": "Atualização Proxmox",
   "Proxmox VE": "Proxmox VE",
+  "Proxmox VE 8 package upgrade failed. Review the APT output before retrying.": "A atualização de pacotes do Proxmox VE 8 falhou. Reveja a saída do APT antes de tentar novamente.",
   "Proxmox VE 8 system update completed successfully": "Atualização do sistema Proxmox VE 8 concluída com sucesso",
   "Proxmox VE 8 to 9 Manual Upgrade Guide": "Guia de atualização manual do Proxmox VE 8 a 9",
   "Proxmox VE 9.x no-subscription repository created": "Repositório sem assinatura Proxmox VE 9.x criado",
@@ -4877,6 +4916,7 @@
   "Proxmox VE configuration completed.": "Configuração do Proxmox VE concluída.",
   "Proxmox VE safe update completed": "Atualização segura do Proxmox VE concluída",
   "Proxmox auth logger service created and started": "Serviço de registrador de autenticação Proxmox criado e iniciado",
+  "Proxmox could not apply the container settings": "O Proxmox não conseguiu aplicar as definições do contentor",
   "Proxmox enterprise repo might be missing or inaccessible. Trying to switch to no-subscription...": "O repositório corporativo Proxmox pode estar ausente ou inacessível. Tentando mudar para sem assinatura...",
   "Proxmox filter configured": "Filtro Proxmox configurado",
   "Proxmox iSCSI Storage Status:": "Status de armazenamento iSCSI do Proxmox:",
@@ -4993,6 +5033,7 @@
   "Rebuilding initramfs to apply nouveau blacklist before installation...": "Reconstruindo o initramfs para aplicar a lista negra do nouveau antes da instalação...",
   "Rebuilding the container and recovering it from its backup are tested on the same image; the first update to a newer image is still to be observed.": "A reconstrução do contêiner e a recuperação do backup são testadas na mesma imagem; a primeira atualização para uma imagem mais recente ainda está para ser observada.",
   "Recent": "Recente",
+  "Recent PBS tasks": "Tarefas PBS recentes",
   "Recent Samba Servers": "Servidores Samba recentes",
   "Recent Samba server": "Servidor Samba recente",
   "Recent logs:": "Registros recentes:",
@@ -5052,6 +5093,7 @@
   "Recreation completed. Data kept.": "Recreação concluída. Dados guardados.",
   "Recreation prepared": "Recreação preparada",
   "Refresh APT index and verify repositories:": "Atualize o índice APT e verifique os repositórios:",
+  "Refresh the configured APT repositories and review the PBS package upgrade? Repository files will be preserved.": "Atualizar os índices dos repositórios APT configurados e rever a atualização de pacotes PBS? Os ficheiros dos repositórios serão preservados.",
   "Refresh token of the connector, from the Twingate admin console": "Token de atualização do conector, no console administrativo Twingate",
   "Refresh your browser (Ctrl+Shift+R) to see changes": "Atualize seu navegador (Ctrl+Shift+R) para ver as alterações",
   "Refresh your browser to see changes (server restart may be required)": "Atualize seu navegador para ver as alterações (pode ser necessário reiniciar o servidor)",
@@ -5141,6 +5183,8 @@
   "Remove saved credentials": "Remover credenciais salvas",
   "Remove subscription banner": "Remover banner de assinatura",
   "Remove the application? Its container disks are deleted, and only a backup can bring them back.": "Remover o aplicativo? Seus discos contêineres são excluídos e somente um backup pode recuperá-los.",
+  "Remove the lock left on a VM by an interrupted task": "Remover o bloqueio deixado numa VM por uma tarefa interrompida",
+  "Remove the lock left on a container by an interrupted task": "Remover o bloqueio deixado num contentor por uma tarefa interrompida",
   "Remove the saved credentials for {registry}?\nRunning apps will keep working.": "Remover as credenciais salvas para {registry}?\nOs aplicativos em execução continuarão funcionando.",
   "Remove the unprivileged flag from configuration:": "Remova o sinalizador sem privilégios da configuração:",
   "Remove unused packages and their config": "Remova pacotes não utilizados e suas configurações",
@@ -5222,6 +5266,7 @@
   "Repository helper unavailable. NVIDIA installation stopped.": "Auxiliar de repositório indisponível. A instalação do NVIDIA foi interrompida.",
   "Repository policy returned an unexpected result.": "A política do repositório retornou um resultado inesperado.",
   "Repository ready.": "Repositório pronto.",
+  "Repository sources changed, but APT package-list refresh failed. Operation stopped; sources were not rolled back. Inspect Administration > Repositories and retry apt-get update before continuing.": "as fontes do repositório foram alteradas, mas a atualização da lista de pacotes APT falhou. Operação interrompida;fontes não foram revertidas. Inspecione Administração > Repositórios e tente apt-get update novamente antes de continuar.",
   "Repository sources changed, but APT package-list refresh failed. Operation stopped; sources were not rolled back. Inspect Node > Updates > Repositories and retry apt-get update before continuing.": "As fontes do repositório foram alteradas, mas a atualização da lista de pacotes APT falhou. Operação interrompida; as fontes não foram revertidas. Verifique Nó > Atualizações > Repositórios e tente apt-get update novamente antes de continuar.",
   "Repository switch declined; no APT source changed.": "Troca de repositório recusada; nenhuma fonte APT foi alterada.",
   "Repository:": "Repositório:",
@@ -5316,7 +5361,9 @@
   "Reverting ZFS ARC tuning...": "Revertendo ajuste do ZFS ARC...",
   "Reverting pigz wrapper...": "Revertendo o wrapper pigz...",
   "Reverting vzdump speed tuning...": "Revertendo o ajuste de velocidade do vzdump...",
+  "Review and apply": "Rever e aplicar",
   "Review external OCI changes": "revisar alterações externas do OCI",
+  "Review package upgrade": "Rever a atualização de pacotes",
   "Review passthrough config files": "Revise os arquivos de configuração de passagem",
   "Review what will be removed": "Revise o que será removido",
   "Rip DVD and Blu-ray media from a browser": "Extrair mídia de DVD e Blu-ray de um navegador",
@@ -5359,6 +5406,7 @@
   "Run the following inside the VM:": "Execute o seguinte dentro da VM:",
   "Run the release-channel switch from an SSH session or the Proxmox host console with:": "execute a opção de canal de lançamento a partir de uma sessão SSH ou do console do host Proxmox com:",
   "Run the update from an SSH session or the Proxmox host console with:": "execute a atualização a partir de uma sessão SSH ou do console do host Proxmox com:",
+  "Run this operation as root.": "Execute esta operação como root.",
   "Run upgrade checklist script:": "Execute o script da lista de verificação de atualização:",
   "Running": "Correndo",
   "Running Lynis security audit...": "Executando auditoria de segurança do Lynis...",
@@ -5773,6 +5821,7 @@
   "ShareCoveX panel": "Painel ShareCoveX",
   "Shared Directory Ready:": "Diretório compartilhado pronto:",
   "Shared Group": "Grupo Compartilhado",
+  "Shared directories": "Diretórios partilhados",
   "Shared directory created:": "Directório partilhado criado:",
   "Shared directory for consume and export": "Diretório compartilhado para consumir e exportar",
   "Shared directory for copy/sync operations": "Diretório compartilhado para copiar/sincronizar operations",
@@ -5802,6 +5851,7 @@
   "Should show pve-manager/9.x.x": "Deve mostrar pve-manager/9.x.x",
   "Shoutrrr addresses for the notifications (optional)": "Endereços Shoutrrr para as notificações (opcional)",
   "Show All Scripts": "Mostrar todos os scripts",
+  "Show CT users and their UID/GID on the host": "Utilizadores do CT e UID/GID no host",
   "Show CT users in table format": "Mostrar usuários do CT em formato de tabela",
   "Show Container Privilege Status": "Mostrar status de privilégio do contêiner",
   "Show DNS resolution status": "Mostrar status de resolução DNS",
@@ -5963,6 +6013,7 @@
   "Start the VM to begin Windows installation from the mounted ISO.": "Inicie a VM para iniciar a instalação do Windows a partir do ISO montado.",
   "Start the applications once they are registered? Answer No if the original containers are still running on another host: both would use the same addresses.": "Iniciar os aplicativos assim que estiverem registrados? Responda Não se os contêineres originais ainda estiverem em execução em outro host: ambos usariam os mesmos endereços.",
   "Start the converted container:": "Inicie o contêiner convertido:",
+  "Start the interactive Proxmox package upgrade": "Iniciar a atualização interativa de pacotes do Proxmox",
   "Start the main system upgrade:": "Inicie a atualização principal do sistema:",
   "Start the stack with Proxmox": "Iniciar a pilha com Proxmox",
   "Start uploading to PBS — sets a recovery passphrase": "comece a enviar para o PBS – define uma senha de recuperação",
@@ -6242,6 +6293,7 @@
   "The Paperless persistent volumes need at least 8 GB": "Os volumes persistentes sem papel precisam de pelo menos 8 GB",
   "The PostgreSQL volume needs at least 4 GB": "O volume PostgreSQL precisa de pelo menos 4 GB",
   "The PostgreSQL volume needs at least 8 GB": "O volume PostgreSQL precisa de pelo menos 8 GB",
+  "The Proxmox VE 8 update did not finish. The upgrade to Proxmox VE 9 was not started.": "A atualização do Proxmox VE 8 não terminou. A atualização para o Proxmox VE 9 não foi iniciada.",
   "The Proxmox archive keyring is missing; Ceph installation cannot continue safely": "O chaveiro de arquivo Proxmox está faltando;A instalação do Ceph não pode continuar com segurança",
   "The Proxmox inventory and the local configurations differ": "O inventário Proxmox e as configurações locais diferem",
   "The ROCm image has no support for the AMD GPU of this host:": "A imagem ROCm não tem suporte para a GPU AMD deste host:",
@@ -6312,6 +6364,7 @@
   "The build could not be checked beforehand; continuing without that check.": "A compilação não pôde ser verificada antecipadamente;continuando sem essa verificação.",
   "The cached image does not match the current digest": "A imagem em cache não corresponde à digest atual",
   "The cached image is damaged; it will be downloaded again.": "A imagem em cache está danificada; será transferida novamente.",
+  "The changes need the application installer": "As alterações requerem o instalador da aplicação",
   "The character device does not exist:": "O dispositivo de caracteres não existe:",
   "The command asks for a password that is not echoed. After creating the users, the web interface asks for a user name and a password.": "O comando pede uma senha que não seja ecoada. Depois de criar os usuários, a interface web pede um nome de usuário e uma senha.",
   "The command does not name an image": "O comando não nomeia uma imagem",
@@ -6431,8 +6484,10 @@
   "The host bind source does not exist:": "O código de ligação da máquina não existe:",
   "The host bind source is not a regular file or directory:": "O código de ligação da máquina não é um ficheiro ou directório regular:",
   "The host directory changed before it was mounted": "A pasta da máquina mudou antes de ser montada",
+  "The host directory does not exist": "O diretório do anfitrião não existe",
   "The host directory may not be accessible from an unprivileged container.": "O diretório host pode não estar acessível a partir de um contêiner sem privilégios.",
   "The host has no IPv4 address on the selected bridge": "A máquina não tem endereço IPv4 na ponte seleccionada",
+  "The host loses access to them. If the group includes a network or storage controller the host needs, cancel at the summary.": "O host perde o acesso a eles. Se o grupo incluir um controlador de rede ou de armazenamento de que o host precisa, cancele no resumo.",
   "The host monitor does not see the real host memory": "O monitor da máquina não vê a memória verdadeira da máquina",
   "The host monitor does not share this host namespace:": "O monitor da máquina não compartilha este espaço de nomes da máquina:",
   "The host monitor include is unknown or differs from the saved record": "O include do monitor do host é desconhecido ou difere do registro salvo",
@@ -6622,6 +6677,7 @@
   "The repair must preserve the image dependencies:": "O reparo deve preservar as dependências da imagem:",
   "The requested VMID block is already in use": "O bloco VMID solicitado já está em uso",
   "The requested machine learning GPU profile is not working; it is not replaced by CPU": "O perfil de aprendizado de máquina solicitado GPU não está funcionando; não é substituído por CPU",
+  "The resource edit could not be fully rolled back. Open Manage again to review and import the current Proxmox settings.": "Não foi possível reverter totalmente a alteração dos recursos. Volte a abrir o menu de gestão para rever e importar as definições atuais do Proxmox.",
   "The restored service did not pass its health check": "O serviço restaurado não passou no seu exame de saúde",
   "The restored service stopped; the recovery is not confirmed": "O serviço restaurado parou; a recuperação não é confirmada",
   "The reviewed Tandoor stack does not require a privileged LXC.": "A pilha Tandoor revisada não require um LXC privilegiado.",
@@ -6667,6 +6723,7 @@
   "The selected VM": "A VM selecionada",
   "The selected VM is running.": "A VM selecionada está em execução.",
   "The selected base folder does not exist and could not be created:": "A pasta base selecionada não existe e não pôde ser criada:",
+  "The selected bridge does not exist": "A bridge selecionada não existe",
   "The selected bridge has no IPv4 subnet for the host-monitor firewall": "A ponte selecionada não possui sub-rede IPv4 para o firewall do monitor host",
   "The selected configuration needs to start the LXC during the installation": "A configuração selecionada precisa iniciar o LXC durante a instalação",
   "The selected container is unprivileged. A privileged container is required for direct device passthrough.": "O contêiner selecionado não tem privilégios. Um contêiner privilegiado é necessário para passagem direta do dispositivo.",
@@ -6689,6 +6746,7 @@
   "The service builds its own image; only a published image can be installed": "O serviço constrói sua própria imagem; somente uma imagem publicada pode ser instalada",
   "The service declares no image:": "O serviço não declara imagem:",
   "The setting has no final value:": "A configuração não tem valor final:",
+  "The settings could not be fully rolled back. Review the container and its saved modification before continuing.": "Não foi possível repor todas as definições. Reveja o contentor e a alteração guardada antes de continuar.",
   "The share already exists in smb.conf:": "O compartilhamento já existe em smb.conf:",
   "The shared destination is not a directory": "O destino compartilhado não é um diretório",
   "The shared directory points to a protected host path": "A pasta partilhada aponta para uma localização protegida da máquina",
@@ -6756,19 +6814,24 @@
   "These Proxmox resources were added outside ProxMenux:": "Estes recursos Proxmox foram adicionados fora do ProxMenux:",
   "These VMIDs are not free:": "Estes VMIDs não são gratuitos:",
   "These are the changes that will be made": "Estas são as mudanças que serão feitas",
+  "These changes were made in Proxmox outside ProxMenux:": "Essas alterações foram feitas no Proxmox fora do ProxMenux:",
   "These container mount paths have an extension-like suffix:": "Estes caminhos de montagem do contêiner têm um sufixo parecido com uma extensão:",
   "These containers were restored from a backup and this host has no record of their OCI application:": "Esses contêineres foram restaurados a partir de um backup e este host não possui registro de seu aplicativo OCI:",
+  "These devices share the IOMMU group of the selected GPU and will be assigned to the VM with it:": "Estes dispositivos partilham o grupo IOMMU da GPU selecionada e serão atribuídos à VM juntamente com ela:",
   "These host backups run with this job and expect its storage:": "Esses backups de host são executados com este trabalho e esperam seu armazenamento:",
   "These host backups run with this job and will stop running:": "Esses backups de host são executados com este trabalho e deixarão de ser executados:",
   "These interface configurations will be removed": "Essas configurações de interface serão removidas",
   "These manual changes cannot be adopted safely:": "Estas alterações manuais não podem ser adotadas com segurança:",
   "These paths will not be restored live and will be extracted for manual recovery.": "Esses caminhos não serão restaurados ao vivo e serão extraídos para recuperação manual.",
+  "These settings require an application-specific adaptation. The image was not downloaded and the container was not recreated.": "Estas definições requerem uma adaptação específica da aplicação. A imagem não foi transferida e o contentor não foi recriado.",
   "These values are asked during the installation:": "Estes valores são questionados durante a instalação:",
   "They are described in the image documentation:": "Estão descritos na documentação da imagem:",
   "They will be added to oci-compose before continuing. Unsupported or changed resources are not imported.": "Eles serão adicionados ao oci-compose antes de continuar. Recursos não suportados ou alterados não são importados.",
+  "They will be saved in oci-compose before continuing.": "Elas serão salvas no oci-compose antes de continuar.",
   "This CIFS share is mounted with restrictive permissions.": "Este compartilhamento CIFS é montado com permissões restritivas.",
   "This GPU is considered incompatible with GPU passthrough to a VM in ProxMenux.": "Esta GPU é considerada incompatível com a passagem de GPU para uma VM no ProxMenux.",
   "This NFS share is fully restricted — even the host root cannot write to it.": "Este compartilhamento NFS é totalmente restrito — até mesmo o host root não pode gravar nele.",
+  "This Proxmox Backup Server has no active subscription, switch to the no-subscription repository? The inaccessible Enterprise PBS source will be disabled.": "Este Proxmox Backup Server não tem assinatura ativa. Mudar para o repositório sem assinatura? A fonte Enterprise do PBS, inacessível, será desativada.",
   "This VM requires extra installation steps, see install guide at:\nhttps://github.com/community-scripts/ProxmoxVE/discussions/144": "Esta VM requer etapas extras de instalação. Consulte o guia de instalação em:\nhttps://github.com/community-scripts/ProxmoxVE/discussions/144",
   "This account is for {registry}. Enter an image from that registry.": "Esta conta é para {registry}. Insira uma imagem desse registro.",
   "This action will:": "Esta ação irá:",
@@ -6830,10 +6893,13 @@
   "This may take several minutes...": "Isso pode levar vários minutos...",
   "This means Proxmox handles mount lifecycle natively (no manual /etc/fstab needed for NFS/CIFS host storages).": "Isso significa que o Proxmox lida com o ciclo de vida da montagem nativamente (não é necessário /etc/fstab manual para armazenamentos de host NFS/CIFS).",
   "This means the credentials are incorrect.": "Isso significa que as credenciais estão incorretas.",
+  "This menu requires Proxmox Backup Server.": "Este menu requer Proxmox Backup Server.",
   "This might indicate network connectivity issues.": "Isso pode indicar problemas de conectividade de rede.",
   "This monitor uses a privileged LXC, shares processes and network with Proxmox and disables AppArmor in the CT. It uses the IP address and firewall of the host. A compromised image could affect the host; do not expose its web UI to the Internet.": "Este monitor usa um LXC privilegiado, compartilha processos e rede com Proxmox e desativa AppArmor no CT. Ele usa o endereço IP e firewall do host. Uma imagem comprometida poderia afetar o host; não expor sua interface web para a Internet.",
   "This only removes the schedule. Existing backup archives are NOT deleted.": "Isso apenas remove a programação. Os arquivos de backup existentes NÃO são excluídos.",
   "This operation may take several minutes and requires internet connectivity.": "Esta operação pode demorar vários minutos e requer conectividade com a Internet.",
+  "This operation requires a Proxmox VE host. Use the PBS menu on Proxmox Backup Server.": "Esta operação requer um anfitrião Proxmox VE. Utilize o menu PBS no Proxmox Backup Server.",
+  "This operation supports PBS 3 on Debian 12 and PBS 4 on Debian 13.": "Esta operação suporta PBS 3 em Debian 12 e PBS 4 em Debian 13.",
   "This package was installed by older versions of the ProxMenux Coral installer that placed the M.2 kernel driver on every system, including USB-only setups. It is not needed for Coral USB devices, which use libedgetpu1-std / libedgetpu1-max only.": "Este pacote foi instalado por versões mais antigas do instalador ProxMenux Coral que colocava o driver do kernel M.2 em todos os sistemas, incluindo configurações somente USB.Não é necessário para dispositivos Coral USB, que usam apenas libedgetpu1-std / libedgetpu1-max.",
   "This passphrase is the ONLY way to access encrypted Borg backups.": "Esta senha é a ÚNICA maneira de acessar backups criptografados do Borg.",
   "This path is already used as a mount point in this container.": "Este caminho já é usado como ponto de montagem neste contêiner.",
@@ -6849,6 +6915,7 @@
   "This script cannot be executed from the Proxmox web terminal.": "Este script não pode ser executado no terminal web Proxmox.",
   "This script must be run as root.": "Este script deve ser executado como root.",
   "This script must be run on a Proxmox host.": "Este script deve ser executado em um host Proxmox.",
+  "This script will apply the following optimizations and advanced adjustments to your Proxmox Backup Server": "Este script aplicará as seguintes otimizações e ajustes avançados ao seu Proxmox Backup Server",
   "This script will apply the following optimizations and advanced adjustments to your Proxmox VE server": "Este script aplicará as seguintes otimizações e ajustes avançados ao seu servidor Proxmox VE",
   "This script will update your Proxmox VE system with advanced options:": "Este script atualizará seu sistema Proxmox VE com opções avançadas:",
   "This session is running in the Monitor terminal. Running it from here would cut the connection mid-install and leave the switch in a broken state.": "Esta sessão está sendo executada no terminal Monitor. Executá-lo a partir daqui cortaria a conexão no meio da instalação e deixaria o switch quebrado.",
@@ -6935,7 +7002,7 @@
   "Transaction log:": "Registo de transacções:",
   "Translation files:": "Arquivos de tradução:",
   "Transmission is designed for easy, powerful use. Transmission has the features you want from a BitTorrent client: encryption, a web interface, peer exchange, magnet links, DHT, µTP, UPnP and NAT-PMP port forwarding, webseed support, watch directories, tracker editing, global and per-torrent speed limits, and more.": "Transmission é projetado para uso fácil e poderoso. Transmission tem os recursos que você deseja de um cliente BitTorrent: criptografia, uma interface web, troca de pares, links magnéticos, DHT, μTP, encaminhamento de portas UPnP e NAT-PMP, suporte a webseed, diretórios de relógio, edição de rastreadores, limites de velocidade globais e per-torrent, e muito mais.",
-  "Tried pvesm path and manual detection methods": "Tentei caminho pvesm e métodos de detecção manual",
+  "Tried pvesm path and manual detection methods": "Foram tentados pvesm path e os métodos de deteção manual",
   "Trust this certificate and save it for scheduled backups?": "Confiar neste certificado e salvá-lo para backups agendados?",
   "Try Again": "Tente novamente",
   "Try a different search term.": "Experimente um termo de pesquisa diferente.",
@@ -6980,6 +7047,7 @@
   "Unable to identify the root filesystem. Aborting.": "Não foi possível identificar o sistema de arquivos raiz. Abortando.",
   "Unable to resolve system ZFS pool disks. Aborting.": "Não foi possível resolver os discos do pool ZFS do sistema. Abortando.",
   "Unable to resolve system disk topology. Aborting.": "Não é possível resolver a topologia do disco do sistema. Abortando.",
+  "Unapplied changes": "Alterações por aplicar",
   "Understand the security implications of privileged containers": "Entenda as implicações de segurança de contêineres privilegiados",
   "Unexpected Proxmox inventory; recovery blocked": "Inesperado inventário Proxmox; recuperação bloqueada",
   "Unexpected formatting directory in the new Valkey volume": "Directório de formatação inesperado no novo volume Valkey",
@@ -7079,6 +7147,7 @@
   "Unsupported OCI-LXC AppArmor profile:": "Perfil do AppArmor OCI-LXC não suportado:",
   "Unsupported OCI-LXC seccomp profile:": "Perfil OCI-LXC seccomp não suportado:",
   "Unsupported Terminal": "Terminal não suportado",
+  "Unsupported architecture for Figurine:": "Arquitetura não suportada pelo Figurine:",
   "Unsupported architecture:": "Arquitetura não suportada:",
   "Unsupported backup compression": "Compressão de backup não suportada",
   "Unsupported credential pattern:": "Padrão credential não suportado:",
@@ -7094,6 +7163,7 @@
   "Unsupported mount type": "Tipo de montagem não suportado",
   "Unsupported mount type:": "Tipo de montagem não suportado:",
   "Unsupported native device type:": "Tipo de dispositivo nativo não suportado:",
+  "Unsupported network settings": "Definições de rede não suportadas",
   "Unsupported operation": "operation não suportado",
   "Unsupported or unknown Proxmox version; no repository changed.": "Versão Proxmox não suportada ou desconhecida; nenhum repositório foi alterado.",
   "Unsupported output format:": "Formato de saída não suportado:",
@@ -7121,6 +7191,7 @@
   "Update NVIDIA in LXC Containers": "Atualizar NVIDIA em contêineres LXC",
   "Update OCI": "Actualizar OCI",
   "Update OCI stack": "Actualizar a pilha OCI",
+  "Update PBS using configured repositories": "Atualizar PBS com os repositórios configurados",
   "Update PVE enterprise repository (Only if using enterprise):": "Atualize o repositório corporativo PVE (somente se estiver usando corporativo):",
   "Update Proxmox VE Appliance Manager": "Atualizar Proxmox VE Appliance Manager",
   "Update Proxmox package lists": "Atualizar listas de pacotes Proxmox",
@@ -7151,7 +7222,7 @@
   "Updates file is empty or unreadable.": "O arquivo de atualizações está vazio ou ilegível.",
   "Updating": "Actualização",
   "Updating APT package lists...": "Atualizando listas de pacotes APT...",
-  "Updating Debian Bookworm → Trixie in sources.list...": "Atualizando Debian Bookworm → Trixie em fontes.list...",
+  "Updating Debian Bookworm → Trixie in sources.list...": "A atualizar Debian Bookworm → Trixie em sources.list...",
   "Updating Figurine binary...": "Atualizando o binário da estatueta...",
   "Updating Lynis to the latest version...": "Atualizando Lynis para a versão mais recente...",
   "Updating PVE application manager...": "Atualizando o gerenciador de aplicativos PVE...",
@@ -7173,6 +7244,7 @@
   "Upgrade assistant: Proxmox VE 8 → 9 (Trixie)": "Assistente de atualização: Proxmox VE 8 → 9 (Trixie)",
   "Upgrade canceled by user": "Atualização cancelada pelo usuário",
   "Upgrade one node at a time": "Atualize um nó por vez",
+  "Upgrade the system, offering the": "Atualize o sistema, oferecendo o",
   "Upgrade to Proxmox VE 9": "Atualize para Proxmox VE 9",
   "Upgrading NVIDIA utils (Arch)...": "Atualizando utilitários NVIDIA (Arch)...",
   "Upload an encrypted copy of the key to PBS so you can recover it on a reinstalled host with just a passphrase?": "Carregar uma cópia criptografada da chave para o PBS para que você possa recuperá-la em um host reinstalado com apenas uma senha?",
@@ -7610,6 +7682,7 @@
   "active VF(s)": "FV ativa(s)",
   "active VFs": "FVs ativas",
   "active Virtual Functions. Changing its driver binding would destroy every VF.": "Funções virtuais ativas. Alterar a ligação do driver destruiria todos os VF.",
+  "added in Proxmox": "adicionada no Proxmox",
   "after copy; source tree is incomplete.": "após cópia; a árvore de origem está incompleta.",
   "after update.": "após a atualização.",
   "all guests": "todos os convidados",
@@ -7954,8 +8027,8 @@
   "pvesm command not found. This should not happen on Proxmox.": "Comando pvesm não encontrado. Isso não deveria acontecer no Proxmox.",
   "pvesm not available.": "pvesm não disponível.",
   "pvesm not found.": "pvesm não encontrado.",
-  "pvesm path failed, trying manual detection...": "caminho pvesm falhou, tentando detecção manual...",
-  "pvesm status failed": "status pvesm falhou",
+  "pvesm path failed, trying manual detection...": "O pvesm path falhou; a tentar a deteção manual...",
+  "pvesm status failed": "O pvesm status falhou",
   "pyLoad is a Free and Open Source download manager written in Python and designed to be extremely lightweight, easily extensible and fully manageable via web.": "pyLoad é um gerenciador de download livre e Open Source escrito em Python e projetado para ser extremamente leve, facilmente extensível e totalmente gerenciável via web.",
   "pyLoad web interface": "interface web pyLoad",
   "qBittorrent WebUI password (user: admin)": "Senha do WebUI do qBittorrent (utilizador: administrador)",
@@ -7977,6 +8050,7 @@
   "remapped users": "usuários remapeados",
   "remove the (now-empty) directory if possible": "remova o diretório (agora vazio), se possível",
   "removed from Proxmox": "removido do Proxmox",
+  "removed in Proxmox": "removida no Proxmox",
   "removed successfully from Proxmox.": "removido com sucesso do Proxmox.",
   "requires running the official installer, which restarts the Monitor service.": "requer a execução do instalador oficial, que reinicia o serviço Monitor.",
   "requires the package": "requer o pacote",
@@ -8014,7 +8088,7 @@
   "smbclient command is not working properly.": "O comando smbclient não está funcionando corretamente.",
   "smbclient command not found after installation.": "Comando smbclient não encontrado após a instalação.",
   "sources.list update skipped (no change)": "Atualização de sources.list ignorada (sem alteração)",
-  "sources.list updated to Trixie": "fontes.list atualizado para Trixie",
+  "sources.list updated to Trixie": "sources.list atualizado para Trixie",
   "ssh-keygen failed. Cannot create a new SSH key.": "ssh-keygen falhou. Não é possível criar uma nova chave SSH.",
   "stale entry/entries for interfaces no longer present": "entradas/entradas obsoletas para interfaces não estão mais presentes",
   "standard performance": "desempenho padrão",
@@ -8033,7 +8107,7 @@
   "switch_gpu_mode.sh was not found.": "switch_gpu_mode.sh não foi encontrado.",
   "sysfs ROM dump failed — trying ACPI VFCT table...": "Falha no despejo de ROM do sysfs - tentando tabela ACPI VFCT...",
   "syslog-ng allows you to flexibly collect, parse, classify, rewrite and correlate logs from across your infrastructure and store or route them to log analysis tools.": "o syslog-ng permite coletar, analisar, classificar, reescrever e correlacionar logs de toda sua infraestrutura e armazená-los ou roteá-los para ferramentas de análise de log.",
-  "systemctl restart networking failed:": "falha na reinicialização da rede do systemctl:",
+  "systemctl restart networking failed:": "O systemctl restart networking falhou:",
   "systemd OnCalendar expression": "Expressão Systemd OnCalendar",
   "the API key was not generated on the first start": "a tecla API não foi gerada no primeiro início",
   "the NVIDIA hook of the container is not available:": "o hook NVIDIA do contêiner não está disponível:",
@@ -8080,18 +8154,20 @@
   "using": "usando",
   "using direct path (not guaranteed to survive reboots).": "usando caminho direto (não é garantido que sobreviva às reinicializações).",
   "vCPUs:": "vCPUs:",
+  "value changed in Proxmox": "valor alterado no Proxmox",
   "vfio-pci IDs configured": "IDs vfio-pci configurados",
   "vfio-pci IDs in /etc/modprobe.d/vfio.conf": "IDs vfio-pci em /etc/modprobe.d/vfio.conf",
   "video": "vídeo",
   "video + recognition": "vídeo + reconhecimento",
   "video only": "apenas vídeo",
   "vzdump backup speed optimization completed": "otimização da velocidade de backup do vzdump concluída",
-  "wallabag builds its links from the address given during the installation. If it does not match the address of the container, edit lxc.environment.runtime: SYMFONY__ENV__DOMAIN_NAME in /etc/pve/lxc/<CTID>.conf with the container stopped, and start it again.": "wallabag constrói seus links a partir do endereço fornecido durante a instalação. Se não corresponder ao endereço do recipiente, edite lxc.environment. tempo de execução: SYMFONY  ENV  DOMAIN NAME em /etc/pve/lxc/<CTID>.conf com o recipiente parado, e inicie-o novamente.",
+  "wallabag builds its links from the address given during the installation. If it does not match the address of the container, edit lxc.environment.runtime: SYMFONY__ENV__DOMAIN_NAME in /etc/pve/lxc/<CTID>.conf with the container stopped, and start it again.": "O wallabag gera as ligações com o endereço indicado na instalação. Se não corresponder ao do contentor, pare-o, edite lxc.environment.runtime: SYMFONY__ENV__DOMAIN_NAME em /etc/pve/lxc/<CTID>.conf e volte a iniciá-lo.",
   "wallabag listens on port 80 of the container and stores its data in SQLite.": "wallabag escuta na porta 80 do recipiente e armazena seus dados em SQLite.",
   "wallabag web interface": "Interface Web wallabag",
   "was": "era",
   "was installed, but the kernel reports:": "foi instalado, mas o kernel informa:",
   "when finished": "quando terminado",
+  "when the server has no subscription (you will be asked)": "quando o servidor não tem assinatura (será solicitado)",
   "will rebind the GPU to vfio-pci on the next reboot, breaking the driver that is about to be installed.": "irá religar a GPU ao vfio-pci na próxima reinicialização, quebrando o driver que está prestes a ser instalado.",
   "wipefs failed on": "Wipefs falhou em",
   "with": "com",
diff --git a/lang/sk.json b/lang/sk.json
index f955bfc4..13346f9e 100644
--- a/lang/sk.json
+++ b/lang/sk.json
@@ -37,6 +37,7 @@
   "/var/lib/vz/dump   (Proxmox default vzdump path)": "/var/lib/vz/dump   (predvolená cesta Proxmox vzdump)",
   "/var/lib/vz/dump   (Proxmox default)": "/var/lib/vz/dump   (predvolené v Proxmoxe)",
   "1777 = sticky bit + rwx for all. No shared group needed.": "1777 = sticky bit + rwx pre všetkých. Zdieľaná skupina nie je potrebná.",
+  "====== PBS UPDATE COMPLETED ======": "====== AKTUALIZÁCIA PBS DOKONČENÁ ======",
   "====== PVE UPDATE COMPLETED ======": "====== AKTUALIZÁCIA PVE DOKONČENÁ ======",
   ">> Create a new backup job <<": ">> Vytvoriť novú úlohu zálohovania <<",
   ">> Save and return <<": ">> Uložiť a vrátiť <<",
@@ -87,6 +88,7 @@
   "A multi-container application is not recreated: its containers are updated together.": "Aplikácia s viacerými kontajnermi sa nevytvorí znova: jej kontajnery sa aktualizujú spoločne.",
   "A new ProxMenux version is available:": "Je dostupná nová verzia ProxMenux:",
   "A new kernel is staged for the next boot:": "Na najbližší štart je pripravený nový kernel:",
+  "A newer kernel is installed. Reboot before the next backup window to use it.": "Je nainštalované novšie jadro. Aby ste ho mohli použiť, reštartujte ho pred ďalším oknom zálohy.",
   "A newer version is available:": "Je dostupná novšia verzia:",
   "A pending operation exists for": "Čaká na operation existuje",
   "A pending stack assembly already exists; it is not overwritten": "Nevyriešená zostava stohov už existuje; nie je prepísaná",
@@ -136,7 +138,7 @@
   "ALL DATA ON": "VŠETKY DÁTA NA",
   "ALL DATA ON THIS DISK WILL BE PERMANENTLY LOST!": "VŠETKY DÁTA NA TOMTO DISKU BUDÚ NATRVALO STRATENÉ!",
   "ALL Utilities": "VŠETKY nástroje",
-  "ALLOWED_HOSTS cannot contain line breaks": "UDELENÉ HOSTS nemôžu obsahovať prestávky na čiare",
+  "ALLOWED_HOSTS cannot contain line breaks": "ALLOWED_HOSTS nesmie obsahovať zalomenia riadkov",
   "AList initial login": "AList začiatočné prihlásenie",
   "AMD (ROCm)": "AMD (ROCm)",
   "AMD (VA-API and ROCm detection)": "AMD (detekcia VA-API a ROCm)",
@@ -169,6 +171,8 @@
   "APT language configuration updated": "Nastavenie jazykov pre APT bolo aktualizované",
   "APT language downloads restored": "Sťahovanie jazykov cez APT bolo obnovené",
   "APT package lists updated": "Zoznamy APT balíkov aktualizované",
+  "APT refresh failed. Check the PBS subscription and repositories in Administration > Repositories. Log:": "Obnovenie APT zlyhalo. Skontrolujte predplatné a repozitáre PBS v časti Správa > Repozitáre. Denník:",
+  "APT refresh failed. Check the PBS subscription and repositories in the native PBS interface; no source was changed.": "Obnovenie indexov APT zlyhalo. Skontrolujte predplatné a repozitáre PBS v pôvodnom rozhraní PBS; žiadne zdroje sa nezmenili.",
   "APT update failed. Check repository access; NVIDIA installation stopped.": "Aktualizácia APT zlyhala. Skontrolujte prístup k úložisku; inštalácia NVIDIA sa zastavila.",
   "Aborted": "Zrušené",
   "About to restore": "Chystá sa obnova",
@@ -318,7 +322,7 @@
   "After confirming, you will be asked to choose the NVIDIA driver version to install.": "Po potvrdení si vyberiete verziu ovládača NVIDIA, ktorú chcete nainštalovať.",
   "After detailed analysis, no changes are needed.": "Po podrobnej analýze nie sú potrebné žiadne zmeny.",
   "After detailed analysis, no cleanup is needed.": "Po podrobnej analýze nie je potrebné žiadne čistenie.",
-  "After logging in, run: ip a to obtain the IP address.\nThen, enter that IP address in your web browser like this:\n  http://IP_ADDRESS\n\nThis will open the Umbral OS dashboard.": "Po prihlásení spustite príkaz: ip a, aby ste zistili IP adresu.\nPotom túto IP adresu zadajte do prehliadača takto:\n  http://IP_ADRESA\n\nOtvorí sa tým webové rozhranie Umbral OS.",
+  "After logging in, run: ip a to obtain the IP address.\nThen, enter that IP address in your web browser like this:\n  http://IP_ADDRESS\n\nThis will open the Umbral OS dashboard.": "Po prihlásení zistite IP adresu príkazom ip a.\nPotom ju zadajte do prehliadača v tomto tvare:\n  http://IP_ADDRESS\n\nOtvorí sa panel Umbral OS.",
   "After pasting on the server, ensure the file is chmod 600 and owned by": "Po vložení na serveri overte, že súbor má chmod 600 a vlastní ho",
   "After reboot the system will be fully accessible (SSH, web UI, login), but the following components will be reinstalled in BACKGROUND — until they finish, commands like nvidia-smi may not yet be available:": "Po reštarte bude systém plne dostupný (SSH, webové rozhranie, prihlásenie), ale tieto súčasti sa budú doinštalovávať NA POZADÍ - kým neskončia, príkazy ako nvidia-smi ešte nemusia byť dostupné:",
   "After reboot, these components will reinstall in background:": "Po reštarte sa tieto súčasti doinštalujú na pozadí:",
@@ -425,6 +429,7 @@
   "Apply": "Použiť",
   "Apply AMD CPU fixes": "Použiť opravy pre AMD procesory",
   "Apply Available Updates": "Nainštalovať dostupné aktualizácie",
+  "Apply PBS package upgrade": "Použiť aktualizáciu balíkov PBS",
   "Apply and restart services:": "Použiť zmeny a reštartovať služby:",
   "Apply available updates": "Nainštalovať dostupné aktualizácie",
   "Apply boot/initramfs changes": "Použiť zmeny boot/initramfs",
@@ -438,12 +443,15 @@
   "Apply options from the current catalog template? New required paths and settings may be requested. Review the resulting configuration before recreating the CT.": "Použiť možnosti z aktuálnej šablóny katalógu? Môžu sa vyžadovať nové požadované cesty a nastavenia. Pred opätovným vytvorením CT skontrolujte výslednú konfiguráciu.",
   "Apply read+write access for 'others' on the host directory?": "Nastaviť pre 'others' čítanie aj zápis na priečinku hosta?",
   "Apply the options from the current catalog template? Your data and configuration are kept.": "Aplikovať možnosti z aktuálnej katalógovej šablóny? Vaše dáta a konfigurácia sú uchovávané.",
+  "Apply the reviewed package upgrade now? Services may restart and packages listed for removal will be removed.": "Použiť teraz skontrolovanú aktualizáciu balíkov? Služby sa môžu reštartovať a balíky označené na odstránenie budú odstránené.",
   "Apply these changes?": "Použiť tieto zmeny?",
   "Applying AMD-specific fixes...": "Používam opravy špecifické pre AMD...",
+  "Applying CPU and RAM changes without rebuilding the container...": "Používajú sa zmeny CPU a RAM bez opätovného vytvorenia kontajnera...",
   "Applying Changes": "Používam zmeny",
   "Applying Controller/NVMe passthrough to VM": "Používam priame priradenie Controller/NVMe do VM",
   "Applying balanced memory optimization settings...": "Používam vyvážené nastavenia optimalizácie pamäte...",
   "Applying changes safely...": "Bezpečne používam zmeny...",
+  "Applying container settings without rebuilding the container...": "Aplikujú sa nastavenia bez opätovného vytvorenia kontajnera...",
   "Applying custom restore": "Používam vlastnú obnovu",
   "Applying default VM configuration": "Používam predvolené nastavenie VM",
   "Applying host permissions for unprivileged LXC bind-mounts...": "Nastavujem oprávnenia hosta pre LXC bind mounty v neprivilegovaných kontajneroch...",
@@ -535,6 +543,7 @@
   "Available Borg targets:": "Dostupné Borg ciele:",
   "Available Disks on Host": "Dostupné disky na hostovi",
   "Available ISO Images": "Dostupné ISO obrazy",
+  "Available PBS Version": "Dostupná verzia PBS",
   "Available PBS repositories:": "Dostupné PBS repozitáre:",
   "Available PVE Version": "Dostupná verzia PVE",
   "Available Shares:": "Dostupné zdieľania:",
@@ -746,6 +755,7 @@
   "Cannot verify the reused disk:": "Nie je možné overiť znovu použitý disk:",
   "Cannot write the image archive to {storage}. Check storage access and mount status.": "Nie je možné zapísať archív obrázkov do {storage}. Skontrolujte prístup k úložisku a stav pripojenia.",
   "Capabilities cannot be kept and all dropped at the same time": "Nie je možné udržať si schopnosti a zároveň ich znížiť.",
+  "Catalog options": "Možnosti katalógu",
   "Category": "Kategória",
   "Caution: Maximum mode generates more heat.": "Pozor: maximálny režim vytvára viac tepla.",
   "Ceph check skipped by user flag (--ignore-ceph-check)": "Kontrola Ceph preskočená používateľskou voľbou (--ignore-ceph-check)",
@@ -880,6 +890,7 @@
   "Choose a schedule (systemd calendar-event syntax):": "Vyberte plán (syntax systémového kalendára a udalosti):",
   "Choose a script to execute:": "Vyberte skript, ktorý sa má spustiť:",
   "Choose a server:": "Vyberte server:",
+  "Choose a setting. Changes are applied only after the final review.": "Vyberte nastavenie. Zmeny sa použijú až po záverečnej kontrole.",
   "Choose a share to mount:": "Vyberte zdieľanie na pripojenie:",
   "Choose a specific supported GPU or USB node": "Vyberte konkrétny podporovaný uzol GPU alebo USB",
   "Choose action for this controller/NVMe:": "Vyberte akciu pre tento Controller/NVMe:",
@@ -960,6 +971,7 @@
   "Code-server is VS Code running on a remote server, accessible through the browser.": "Kód server je VS kód beží na vzdialenom serveri, prístupný cez prehliadač.",
   "CodeProject.AI Server": "CodeProject. AI Server",
   "Command": "Príkaz",
+  "Command failed": "Príkaz zlyhal",
   "Command override for an unknown service:": "Prepísať príkaz pre neznámu službu:",
   "Commenting any residual Bookworm lines in *.list...": "Komentujem zostávajúce riadky Bookworm v *.list...",
   "Commenting legacy PVE 8 repository .list files (if any)...": "Komentujem staré .list súbory repozitárov PVE 8 (ak existujú)...",
@@ -1516,6 +1528,7 @@
   "Current NVIDIA inventory resolved: a refresh is required": "Aktuálne NVIDIA inventár vyriešený: obnovovanie je required",
   "Current NVIDIA inventory resolved: no refresh is required": "Aktuálne NVIDIA inventár vyriešený: žiadne obnovenie je required",
   "Current Network Configuration": "Aktuálne nastavenie siete",
+  "Current PBS Version": "Aktuálna verzia PBS",
   "Current PVE Version": "Aktuálna verzia PVE",
   "Current ProxMenux host scripts register remote shares as Proxmox storages using pvesm.": "Aktuálne host skripty ProxMenux registrujú vzdialené zdieľania ako úložiská Proxmoxu pomocou pvesm.",
   "Current ProxMenux version:": "Aktuálna verzia ProxMenux:",
@@ -1681,6 +1694,7 @@
   "Detected Coral hardware:": "Nájdený Coral hardvér:",
   "Detected GPU(s):": "Nájdené GPU:",
   "Detected Intel CPU": "Zistený Intel procesor",
+  "Detected Proxmox Backup Server": "Zistený Proxmox Backup Server",
   "Detected Proxmox VE": "Zistený Proxmox VE",
   "Detected Proxmox VE 8.x - Installing Ceph Squid for Debian": "Zistený Proxmox VE 8.x - inštalujem Ceph Squid pre Debian",
   "Detected Proxmox VE 9.x - Installing Ceph Squid for Debian Trixie": "Zistený Proxmox VE 9.x - inštalujem Ceph Squid pre Debian Trixie",
@@ -1762,6 +1776,9 @@
   "Disabling and stopping rpcbind service and socket...": "Zakázanie a zastavenie služby rpcbind a soketu...",
   "Disabling non-free firmware warnings...": "Vypínam upozornenia na non-free firmware...",
   "Disabling portmapper/rpcbind for security...": "Z bezpečnostných dôvodov vypínam portmapper/rpcbind...",
+  "Discard changes": "Zahodiť zmeny",
+  "Discard unapplied changes?": "Zahodiť nepoužité zmeny?",
+  "Discover NFS exports on a server": "Zistiť NFS exporty servera",
   "Discover targets on portal:": "Vyhľadať targety na portáli:",
   "Discovering iSCSI targets...": "Vyhľadávam iSCSI targety...",
   "Discovery successful": "Vyhľadanie bolo úspešné",
@@ -1841,6 +1858,7 @@
   "Do you want to proceed with the system update?": "Chcete pokračovať v aktualizácii systému?",
   "Do you want to proceed?": "Chcete pokračovať?",
   "Do you want to reboot now?": "Chcete reštartovať teraz?",
+  "Do you want to remove the Proxmox subscription banner from the Proxmox Backup Server web interface?": "Chcete odstrániť banner predplatného Proxmox z webového rozhrania Proxmox Backup Server?",
   "Do you want to remove the stale entry from vfio.conf and continue?": "Chcete odstrániť zastaraný záznam z vfio.conf a pokračovať?",
   "Do you want to remove the stale entry from vfio.conf?": "Chcete odstrániť zastaraný záznam z vfio.conf?",
   "Do you want to restart the network service now to apply changes?": "Chcete teraz reštartovať sieťovú službu, aby sa zmeny prejavili?",
@@ -2266,6 +2284,7 @@
   "Failed to clone log2ram repository. Check /tmp/log2ram_install.log": "Repozitár log2ram sa nepodarilo stiahnuť. Skontrolujte /tmp/log2ram_install.log",
   "Failed to configure EFI disk": "EFI disk sa nepodarilo nastaviť",
   "Failed to configure IOMMU automatically.": "IOMMU sa nepodarilo nastaviť automaticky.",
+  "Failed to configure Proxmox Backup Server repositories": "Repozitáre Proxmox Backup Server sa nepodarilo nastaviť",
   "Failed to configure Proxmox repositories": "Repozitáre Proxmoxu sa nepodarilo nastaviť",
   "Failed to configure TPM device in VM": "TPM zariadenie sa vo VM nepodarilo nastaviť",
   "Failed to configure repositories.": "Repozitáre sa nepodarilo nastaviť.",
@@ -2668,7 +2687,7 @@
   "HAOS One is a community image that runs Docker inside the container. The LXC stays unprivileged, but the inner AppArmor profiles may not be available. The first start downloads Home Assistant Core and its add-ons. If the check fails, the CT and /mnt/data are kept for diagnosis.": "HAOS One je obraz spoločenstva, ktorý prevádzkuje Docker vnútri kontajnera. LXC zostáva neprivilegovaný, ale vnútorné profily AppArmor nemusí byť k dispozícii. Prvý štart stiahne Home Assistant jadro a jeho doplnky. Ak kontrola zlyhá, CT a / mnt/ dáta sa uchovávajú na určenie diagnózy.",
   "HAOS One profile declined": "Profil HAOS One klesol",
   "HAOS One requires an unprivileged unmanaged LXC with nesting and keyctl, 2 cores, 2048 MB RAM, rootfs of at least 12 GB and /mnt/data of at least 16 GB on a container volume included in backups": "HAOS One requires an unprivileged unmanaged LXC with nestering and keyctl, 2 cores, 2048 MB RAM, rootfs najmenej 12 GB a /mnt/data najmenej 16 GB on a container volume included in backions",
-  "HTML5 Network Speed Test Server.": "HTML5 Network Speed ​​Test Server.",
+  "HTML5 Network Speed Test Server.": "HTML5 Network Speed Test Server.",
   "HTTP service check without a saved URL": "Kontrola služby HTTP bez uloženého URL",
   "Habridge emulates Philips Hue API to other home automation gateways such as an Amazon Echo/Dot Gen 1 (gen 2 has issues discovering ha-bridge) or other systems that support Philips Hue. The Bridge handles basic commands such as On, Off and brightness commands of the hue protocol. This bridge can control most devices that have a distinct API.": "Habridge napodobňuje Philipsa Spoločnosť Amazon tvrdí, že spoločnosť LuxOpCo by mala mať prístup k webovým stránkam spoločnosti LuxOpCo. Most riadi základné príkazy, ako je On, Off a jas príkazy protokolu odtieňov. Tento most môže ovládať väčšinu zariadení, ktoré majú odlišné API.",
   "HandBrake is an open-source tool, built by volunteers, for converting video from nearly any format to a selection of modern, widely supported codecs.": "HandBrake je open-source nástroj, postavený dobrovoľníkmi, pre konverziu video z takmer akéhokoľvek formátu na výber moderných, široko podporovaných kodekov.",
@@ -2973,6 +2992,7 @@
   "Inaccessible device during VM startup": "nedostupné zariadenie počas štartu VM",
   "Inactive": "Neaktívne",
   "Inactive (entry in fstab, not currently mounted)": "Neaktívne (záznam je vo fstab, ale teraz nie je pripojený)",
+  "Include these changes in oci-compose?": "Zahrnúť tieto zmeny do oci-compose?",
   "Include these resources in oci-compose?": "Zahrnúť tieto zdroje do oci-compose?",
   "Includes /etc/network (may drop SSH immediately)": "Obsahuje /etc/network (môže okamžite prerušiť SSH)",
   "Includes /etc/zfs": "Obsahuje /etc/zfs",
@@ -3029,7 +3049,7 @@
   "Initiator IQN is authorised on the target": "IQN iniciátora je na targete povolené",
   "Initiator IQN:": "IQN iniciátora:",
   "Inkscape is professional quality vector graphics software which runs on Linux, Mac OS X and Windows desktop computers.": "Inkscape je profesionálne kvalitný vektorový grafický softvér, ktorý beží na počítačoch Linux, Mac OS X a Windows.",
-  "Inside the LXC, create the administrator: console kimai:user:create YOUR_USERNAME YOUR_EMAIL ROLE_SUPER_ADMIN": "Vnútri LXC, vytvoriť administrátor: konzola kimai:používateľ:vytvorte VAŠE VYUŽITE VAŠE EMAIL ROLE_SUPER_ADMIN",
+  "Inside the LXC, create the administrator: console kimai:user:create YOUR_USERNAME YOUR_EMAIL ROLE_SUPER_ADMIN": "V LXC vytvorte správcu príkazom: console kimai:user:create YOUR_USERNAME YOUR_EMAIL ROLE_SUPER_ADMIN",
   "Inspect disks before any action": "Skontrolovať disky pred akoukoľvek akciou",
   "Inspect host device nodes": "Skontrolovať device nodes na hostovi",
   "Inspect passthrough/kernel events": "Skontrolovať passthrough/kernel udalosti",
@@ -3206,9 +3226,11 @@
   "Interrupted operation:": "Prerušená operation:",
   "Interrupted stack operation found": "Prerušený zásobník operation nájdený",
   "Invalid 'proxmox-ve' candidate (not 9.x or none). Please verify your repository configuration and network, then retry.": "Neplatný kandidát 'proxmox-ve' (nie je 9.x alebo chýba). Skontrolujte nastavenie repozitárov a sieť, potom skúste znova.",
-  "Invalid ALLOWED_HOSTS value": "Neplatná hodnota UDELENÁ HOSTS",
+  "Invalid ALLOWED_HOSTS value": "Neplatná hodnota ALLOWED_HOSTS",
   "Invalid Home Assistant OS check timeout": "Neplatný čas odhlásenia Home Assistant OS",
   "Invalid ID": "Neplatné ID",
+  "Invalid IPv4 address": "Neplatná adresa IPv4",
+  "Invalid IPv4 gateway": "Neplatná brána IPv4",
   "Invalid Intel render path": "Neplatná cesta k zobrazeniu informácií",
   "Invalid Jellyfin path:": "Neplatná cesta Jellyfin:",
   "Invalid MAC address:": "Neplatná adresa MAC:",
@@ -3241,6 +3263,7 @@
   "Invalid administrator email": "Neplatný administrátorský mail",
   "Invalid administrator user name": "Neplatné meno správcu",
   "Invalid base VMID": "Neplatná základňa VMID",
+  "Invalid bridge": "Neplatný sieťový most",
   "Invalid check package:": "Neplatný kontrolný balík:",
   "Invalid configuration path:": "Neplatná konfiguračná dráha:",
   "Invalid consume/export volumes": "Neplatné objemy spotreby/vývozu",
@@ -3304,6 +3327,7 @@
   "Invalid remote name": "Neplatné vzdialené meno",
   "Invalid remote path": "Neplatná vzdialená cesta",
   "Invalid repair version:": "Neplatná verzia opravy:",
+  "Invalid resource value": "Neplatná hodnota prostriedkov",
   "Invalid resources": "Neplatné zdroje",
   "Invalid restored volume path": "Neplatná cesta obnoveného objemu",
   "Invalid running state": "Neplatný jazdný stav",
@@ -3322,6 +3346,7 @@
   "Invalid stack members": "Neplatní členovia stohu",
   "Invalid stack name": "Neplatný názov stohu",
   "Invalid stack operation": "Neplatný zásobník operation",
+  "Invalid storage": "Neplatné úložisko",
   "Invalid storage ID. Use only letters, numbers, hyphens and underscores.": "Neplatné ID úložiska. Použite iba písmená, čísla, pomlčky a podčiarkovníky.",
   "Invalid storage name": "Neplatný názov úložiska",
   "Invalid suite application": "Neplatná aplikácia",
@@ -3436,7 +3461,7 @@
   "Keyfile removed.": "Keyfile odstránený.",
   "Keyrings method failed; trying apt-key fallback": "Metóda keyrings zlyhala; skúšam náhradný apt-key postup",
   "KiCad - A Cross Platform and Open Source Electronics Design Automation Suite.": "KiCad - Cross Platform a Open Source Electronics Design Automation Suite.",
-  "Kimai has no default account. Enter the container with: pct enter {main_vmid}": "Kimai nemá predvolený účet. Zadajte kontajner s: pct zadajte {main vmid}",
+  "Kimai has no default account. Enter the container with: pct enter {main_vmid}": "Kimai nemá predvolený účet. Do kontajnera vstúpite príkazom: pct enter {main_vmid}",
   "Kimai is a professional grade time-tracking application, free and open-source.": "Kimai je profesionálna časová aplikácia, zadarmo a open-source.",
   "Kometa is a powerful tool designed to give you complete control over your media libraries. With Kometa, you can take your customization to the next level, with granular control over metadata, collections, overlays, and much more.": "Kometa je výkonný nástroj navrhnutý tak, aby vám plnú kontrolu nad vaše mediálne knižnice. S Kometa, môžete vziať svoje prispôsobenie na ďalšiu úroveň, s granulovanou kontrolou nad metaúdaje, zbierky, prekrývanie, a oveľa viac.",
   "Kometa reads its configuration from /config/config.yml and the container only ships /config/config.yml.template. Copy the template to config.yml, fill in the required Plex and TMDb connections, then restart the container.": "Kometa číta svoju konfiguráciu z /config/config.yml a kontajner iba lode /config/config.yml.templát. Skopírujte šablónu pre config.yml, vyplňte required Plex a TMDb pripojenia, potom reštartujte kontajner.",
@@ -4153,6 +4178,7 @@
   "No active Proxmox storage accepts OCI template archives.": "Žiadne aktívne úložisko Proxmox neakceptuje archívy šablón OCI.",
   "No active exports or showmount not available": "Nie sú aktívne exporty alebo príkaz showmount nie je dostupný",
   "No active session": "Žiadna aktívna relácia",
+  "No active subscription and no usable PBS repository. Noninteractive mode cannot change APT sources; configure them in Administration > Repositories.": "Žiadne aktívne predplatné a žiadne použiteľné úložisko PBS.Neinteraktívny režim nemôže zmeniť zdroje APT;nakonfigurujte ich v Administrácia > Repozitáre.",
   "No active subscription and no usable PVE repository. Noninteractive mode cannot change APT sources; configure them in Node > Updates > Repositories.": "Žiadne aktívne predplatné a žiadne použiteľné úložisko PVE. Neinteraktívny režim nemôže zmeniť zdroje APT; nakonfigurujte ich v časti Uzol > Aktualizácie > Úložiská.",
   "No additional GPU can be added.": "Nie je možné pridať ďalšiu GPU.",
   "No additional device needs to be added.": "Netreba pridávať žiadne ďalšie zariadenie.",
@@ -4257,6 +4283,7 @@
   "No password provided.": "Nebolo zadané heslo.",
   "No paths available": "Nie sú dostupné žiadne cesty",
   "No paths selected. Select at least one path.": "Nie sú vybrané žiadne cesty. Vyberte aspoň jednu cestu.",
+  "No pending changes": "Žiadne čakajúce zmeny",
   "No pending paths to schedule for reboot.": "Nie sú žiadne čakajúce cesty, ktoré by sa mali naplánovať na reštart.",
   "No permanent NFS mounts configured.": "Nie sú nastavené žiadne trvalé NFS pripojenia.",
   "No permanent Samba mounts configured.": "Nie sú nastavené žiadne trvalé Samba pripojenia.",
@@ -4400,6 +4427,7 @@
   "OVH RTM removed (Puppet artefacts may need manual cleanup)": "OVH RTM bol odstránený (Puppet súbory môže byť potrebné vyčistiť ručne)",
   "OVH server detected": "Zistený OVH server",
   "OVH server detection and RTM installation process completed": "Kontrola OVH servera a inštalácia RTM sú dokončené",
+  "Object detector": "Detektor objektov",
   "Object detector for Frigate": "Detektor objektov pre Frigate",
   "Observer is not responding on port 4357": "Pozorovateľ nereaguje na prístav 4357",
   "Obsidian is a note-taking app that lets you create, link, and organize your notes on your device, with hundreds of plugins and themes to customize your workflow. You can also publish your notes online, access them offline, and sync them securely with end-to-end encryption.": "Obsidian je note-prijímajúce aplikácie, ktoré vám umožní vytvoriť, odkaz, a usporiadať poznámky na vašom zariadení, so stovkami pluginov a tém prispôsobiť svoje pracovné postupy. Môžete tiež zverejniť svoje poznámky on-line, prístup je offline, a synchronizovať ich bezpečne s end-to-end šifrovanie.",
@@ -4525,11 +4553,17 @@
   "PBS backup error log": "Záznam chyby zálohy do PBS",
   "PBS backup failed.": "Záloha do PBS zlyhala.",
   "PBS certificate": "PBS certifikát",
+  "PBS datastores": "Dátové úložiská PBS",
   "PBS encryption keyfile (show / replace / remove)": "Šifrovací keyfile pre PBS (zobraziť / nahradiť / odstrániť)",
   "PBS encryption keyfile — detailed info": "Šifrovací keyfile pre PBS - podrobnosti",
   "PBS extraction failed": "Rozbalenie z PBS zlyhalo",
   "PBS host or IP address:": "PBS host alebo IP adresa:",
+  "PBS package update": "Aktualizácia balíkov PBS",
+  "PBS package upgrade completed. Check whether a reboot is required before your next backup window.": "Aktualizácia balíkov PBS bola dokončená. Pred ďalším zálohovacím oknom skontrolujte, či je potrebný reštart.",
+  "PBS package upgrade failed. Review the APT output before retrying.": "Aktualizácia balíkov PBS zlyhala. Pred ďalším pokusom skontrolujte výstup APT.",
   "PBS upload": "Nahrávanie do PBS",
+  "PBS version and packages": "Verzia PBS a balíky",
+  "PBS: using the configured APT repositories without changing sources.": "PBS: používajú sa nakonfigurované repozitáre APT bez zmeny zdrojov.",
   "PCI Address": "PCI adresa",
   "PCI passthrough, TPM state, cloud-init configuration, Proxmox hooks": "PCI passthrough, stav TPM, cloud-init nastavenie, Proxmox hooky",
   "PCI passthrough, TPM state, cloud-init, snapshots, Proxmox-specific hooks": "PCI passthrough, stav TPM, cloud-init, snapshoty, Proxmox špecifické hooky",
@@ -4866,12 +4900,17 @@
   "Proxmology logo applied": "Logo Proxmology bolo použité",
   "Proxmox 9 system update allready": "Systém Proxmox 9 je už aktualizovaný",
   "Proxmox APT repositories configured": "APT repozitáre Proxmoxu sú nastavené",
+  "Proxmox Backup Server": "Proxmox Backup Server",
   "Proxmox Backup Server (PBS) destinations": "Ciele Proxmox Backup Servera (PBS)",
+  "Proxmox Backup Server APT repositories configured": "APT repozitáre Proxmox Backup Server sú nastavené",
+  "Proxmox Backup Server Update": "Aktualizácia Proxmox Backup Server",
+  "Proxmox Backup Server update completed.": "Aktualizácia Proxmox Backup Server bola dokončená.",
   "Proxmox CIFS Storage Status:": "Stav CIFS úložiska v Proxmoxe:",
   "Proxmox NFS Storage Status:": "Stav NFS úložiska v Proxmoxe:",
   "Proxmox System Update": "Aktualizácia systému Proxmox",
   "Proxmox Update": "Aktualizácia Proxmoxu",
   "Proxmox VE": "Proxmox VE",
+  "Proxmox VE 8 package upgrade failed. Review the APT output before retrying.": "Aktualizácia balíkov Proxmox VE 8 zlyhala. Pred ďalším pokusom skontrolujte výstup APT.",
   "Proxmox VE 8 system update completed successfully": "Aktualizácia systému Proxmox VE 8 bola úspešne dokončená",
   "Proxmox VE 8 to 9 Manual Upgrade Guide": "Ručný sprievodca aktualizáciou Proxmox VE 8 na 9",
   "Proxmox VE 9.x no-subscription repository created": "Proxmox VE 9.x no-subscription repozitár vytvorený",
@@ -4879,6 +4918,7 @@
   "Proxmox VE configuration completed.": "Nastavenie Proxmox VE je dokončené.",
   "Proxmox VE safe update completed": "Bezpečná aktualizácia Proxmox VE je dokončená",
   "Proxmox auth logger service created and started": "Služba na logovanie Proxmox prihlásení bola vytvorená a spustená",
+  "Proxmox could not apply the container settings": "Proxmox nedokázal použiť nastavenia kontajnera",
   "Proxmox enterprise repo might be missing or inaccessible. Trying to switch to no-subscription...": "Proxmox enterprise repozitár môže chýbať alebo byť nedostupný. Skúšam prepnúť na no-subscription...",
   "Proxmox filter configured": "Proxmox filter nastavený",
   "Proxmox iSCSI Storage Status:": "Stav iSCSI úložiska v Proxmoxe:",
@@ -4995,6 +5035,7 @@
   "Rebuilding initramfs to apply nouveau blacklist before installation...": "Znovu vytváram initramfs, aby sa blacklist nouveau použil ešte pred inštaláciou...",
   "Rebuilding the container and recovering it from its backup are tested on the same image; the first update to a newer image is still to be observed.": "Prebudovanie kontajnera a jeho obnovenie zo zálohy sa testuje na rovnakom obrázku; prvá aktualizácia na novší obrázok je ešte potrebné pozorovať.",
   "Recent": "Nedávne",
+  "Recent PBS tasks": "Nedávne úlohy PBS",
   "Recent Samba Servers": "Posledné Samba servery",
   "Recent Samba server": "Posledný Samba server",
   "Recent logs:": "Posledné záznamy:",
@@ -5054,6 +5095,7 @@
   "Recreation completed. Data kept.": "Rekreácia dokončená. Údaje uchovávané.",
   "Recreation prepared": "Pripravené rekreácie",
   "Refresh APT index and verify repositories:": "Obnovte APT index a overte repozitáre:",
+  "Refresh the configured APT repositories and review the PBS package upgrade? Repository files will be preserved.": "Obnoviť indexy nakonfigurovaných repozitárov APT a skontrolovať aktualizáciu balíkov PBS? Súbory repozitárov sa zachovajú.",
   "Refresh token of the connector, from the Twingate admin console": "Obnovovací token konektora z administrátorskej konzoly Twingate",
   "Refresh your browser (Ctrl+Shift+R) to see changes": "Obnovte prehliadač (Ctrl+Shift+R), aby ste videli zmeny",
   "Refresh your browser to see changes (server restart may be required)": "Obnovte stránku v prehliadači, aby ste videli zmeny (môže byť potrebný reštart servera)",
@@ -5143,6 +5185,8 @@
   "Remove saved credentials": "Odstráňte uložené poverenia",
   "Remove subscription banner": "Odstrániť hlásenie o predplatnom",
   "Remove the application? Its container disks are deleted, and only a backup can bring them back.": "Odstrániť aplikáciu? Jeho kontajnerové disky sa vymažú a iba záloha ich môže vrátiť späť.",
+  "Remove the lock left on a VM by an interrupted task": "Odstrániť zámok, ktorý na VM zanechala prerušená úloha",
+  "Remove the lock left on a container by an interrupted task": "Odstrániť zámok, ktorý na kontajneri zanechala prerušená úloha",
   "Remove the saved credentials for {registry}?\nRunning apps will keep working.": "Odstrániť uložené poverenia pre {registry}?\nSpustené aplikácie budú naďalej fungovať.",
   "Remove the unprivileged flag from configuration:": "Odstrániť príznak neprivilegovaného kontajnera z nastavenia:",
   "Remove unused packages and their config": "Odstrániť nepoužívané balíky aj ich nastavenia",
@@ -5224,6 +5268,7 @@
   "Repository helper unavailable. NVIDIA installation stopped.": "Pomocník úložiska nie je k dispozícii. Inštalácia NVIDIA sa zastavila.",
   "Repository policy returned an unexpected result.": "Politika úložiska vrátila neočakávaný výsledok.",
   "Repository ready.": "Repozitár je pripravený.",
+  "Repository sources changed, but APT package-list refresh failed. Operation stopped; sources were not rolled back. Inspect Administration > Repositories and retry apt-get update before continuing.": "Zdroje úložiska sa zmenili, ale obnovenie zoznamu balíkov APT zlyhalo. Prevádzka zastavená;zdroje neboli vrátené späť. Pred pokračovaním skontrolujte Administrácia > Repozitáre a zopakujte apt-get update.",
   "Repository sources changed, but APT package-list refresh failed. Operation stopped; sources were not rolled back. Inspect Node > Updates > Repositories and retry apt-get update before continuing.": "Zdroje úložiska sa zmenili, ale obnovenie zoznamu balíkov APT zlyhalo. Prevádzka zastavená; zdroje neboli vrátené späť. Pred pokračovaním skontrolujte Node > Updates > Repository a zopakujte apt-get update.",
   "Repository switch declined; no APT source changed.": "Prepnutie úložiska bolo odmietnuté; žiadny zdroj APT sa nezmenil.",
   "Repository:": "Repozitár:",
@@ -5318,7 +5363,9 @@
   "Reverting ZFS ARC tuning...": "Vraciam späť ladenie ZFS ARC...",
   "Reverting pigz wrapper...": "Vraciam späť wrapper pigz...",
   "Reverting vzdump speed tuning...": "Vraciam späť ladenie rýchlosti vzdump...",
+  "Review and apply": "Skontrolovať a použiť",
   "Review external OCI changes": "Skontrolujte externé zmeny OCI",
+  "Review package upgrade": "Skontrolovať aktualizáciu balíkov",
   "Review passthrough config files": "Skontrolovať konfiguračné súbory passthrough",
   "Review what will be removed": "Skontrolujte, čo sa odstráni",
   "Rip DVD and Blu-ray media from a browser": "Rip DVD a Blu-ray médiá z prehliadača",
@@ -5361,6 +5408,7 @@
   "Run the following inside the VM:": "Vo vnútri VM spustite:",
   "Run the release-channel switch from an SSH session or the Proxmox host console with:": "Prepnutie vetvy vydania spustite cez SSH alebo priamo z konzoly Proxmox servera pomocou:",
   "Run the update from an SSH session or the Proxmox host console with:": "Spustite aktualizáciu zo SSH relácie alebo z konzoly Proxmox hosta pomocou:",
+  "Run this operation as root.": "Túto operáciu spustite ako root.",
   "Run upgrade checklist script:": "Spustite kontrolný skript aktualizácie:",
   "Running": "Beží",
   "Running Lynis security audit...": "Spúšťam bezpečnostný audit Lynis...",
@@ -5775,6 +5823,7 @@
   "ShareCoveX panel": "Panel ShareCoveX",
   "Shared Directory Ready:": "Zdieľaný priečinok je pripravený:",
   "Shared Group": "Zdieľaná skupina",
+  "Shared directories": "Zdieľané priečinky",
   "Shared directory created:": "Vytvorený zdieľaný adresár:",
   "Shared directory for consume and export": "Zdieľaný adresár pre spotrebu a export",
   "Shared directory for copy/sync operations": "Zdieľaný adresár pre kopírovanie/sync operations",
@@ -5804,6 +5853,7 @@
   "Should show pve-manager/9.x.x": "Malo by sa zobraziť pve-manager/9.x.x",
   "Shoutrrr addresses for the notifications (optional)": "Adresy Shoutrrr pre upozornenia (voliteľné)",
   "Show All Scripts": "Zobraziť všetky skripty",
+  "Show CT users and their UID/GID on the host": "Používatelia CT a ich UID/GID na hostiteľovi",
   "Show CT users in table format": "Zobraziť používateľov CT v tabuľke",
   "Show Container Privilege Status": "Zobraziť stav oprávnení kontajnerov",
   "Show DNS resolution status": "Zobraziť stav DNS prekladu",
@@ -5965,6 +6015,7 @@
   "Start the VM to begin Windows installation from the mounted ISO.": "Spustite VM a začnite inštaláciu Windowsu z pripojeného ISO.",
   "Start the applications once they are registered? Answer No if the original containers are still running on another host: both would use the same addresses.": "Spustiť aplikácie po ich zaregistrovaní? Odpoveď Nie, ak pôvodné kontajnery stále bežia na inom hostiteľovi: oba by používali rovnaké adresy.",
   "Start the converted container:": "Spustiť prevedený kontajner:",
+  "Start the interactive Proxmox package upgrade": "Spustiť interaktívnu aktualizáciu balíkov Proxmoxu",
   "Start the main system upgrade:": "Spustite hlavnú aktualizáciu systému:",
   "Start the stack with Proxmox": "Spustiť zásobník s Proxmox",
   "Start uploading to PBS — sets a recovery passphrase": "Spustiť nahrávanie do PBS - nastaví obnovovaciu frázu",
@@ -6243,6 +6294,7 @@
   "The Paperless persistent volumes need at least 8 GB": "Trvalé objemy bez dokumentov potrebujú najmenej 8 GB",
   "The PostgreSQL volume needs at least 4 GB": "Objem PostgreSQL potrebuje najmenej 4 GB",
   "The PostgreSQL volume needs at least 8 GB": "Objem PostgreSQL potrebuje najmenej 8 GB",
+  "The Proxmox VE 8 update did not finish. The upgrade to Proxmox VE 9 was not started.": "Aktualizácia Proxmox VE 8 sa nedokončila. Prechod na Proxmox VE 9 sa nespustil.",
   "The Proxmox archive keyring is missing; Ceph installation cannot continue safely": "Chýba zväzok kľúčov archívu Proxmox;Inštalácia Ceph nemôže bezpečne pokračovať",
   "The Proxmox inventory and the local configurations differ": "Súpis Proxmox a miestne konfigurácie sa líšia",
   "The ROCm image has no support for the AMD GPU of this host:": "Obraz ROCm nemá podporu pre AMD GPU tohto hostiteľa:",
@@ -6313,6 +6365,7 @@
   "The build could not be checked beforehand; continuing without that check.": "Zostavenie nebolo možné vopred skontrolovať;pokračovanie bez tejto kontroly.",
   "The cached image does not match the current digest": "Comment",
   "The cached image is damaged; it will be downloaded again.": "Comment",
+  "The changes need the application installer": "Zmeny vyžadujú inštalačný program aplikácie",
   "The character device does not exist:": "Znakové zariadenie neexistuje:",
   "The command asks for a password that is not echoed. After creating the users, the web interface asks for a user name and a password.": "Príkaz vyžaduje heslo, ktoré nie je ozvene. Po vytvorení užívateľov, webové rozhranie žiada o užívateľské meno a heslo.",
   "The command does not name an image": "Príkaz nepomenuje obrázok",
@@ -6432,8 +6485,10 @@
   "The host bind source does not exist:": "Zdroj hostiteľskej väzby neexistuje:",
   "The host bind source is not a regular file or directory:": "Zdroj odkazu hostiteľa nie je bežný súbor alebo adresár:",
   "The host directory changed before it was mounted": "Adresár hostiteľa sa zmenil predtým, ako bol pripojený",
+  "The host directory does not exist": "Adresár na hostiteľovi neexistuje",
   "The host directory may not be accessible from an unprivileged container.": "Priečinok na hostovi nemusí byť dostupný z neprivilegovaného kontajnera.",
   "The host has no IPv4 address on the selected bridge": "Hostiteľ nemá IPv4 adresu na vybranom moste",
+  "The host loses access to them. If the group includes a network or storage controller the host needs, cancel at the summary.": "Hostiteľ k nim stratí prístup. Ak skupina obsahuje sieťový alebo úložný radič, ktorý hostiteľ potrebuje, zrušte to v súhrne.",
   "The host monitor does not see the real host memory": "Monitor hostiteľa nevidí skutočnú pamäť hostiteľa",
   "The host monitor does not share this host namespace:": "Monitor hostiteľa nezdieľa tento menový priestor hostiteľa:",
   "The host monitor include is unknown or differs from the saved record": "Include monitora hostiteľa je neznámy alebo sa líši od uloženého záznamu",
@@ -6623,6 +6678,7 @@
   "The repair must preserve the image dependencies:": "Oprava musí zachovať závislosť obrazu:",
   "The requested VMID block is already in use": "Požadovaný blok VMID sa už používa",
   "The requested machine learning GPU profile is not working; it is not replaced by CPU": "Požadovaný profil strojového učenia sa GPU nefunguje; nie je nahradený CPU",
+  "The resource edit could not be fully rolled back. Open Manage again to review and import the current Proxmox settings.": "Zmenu prostriedkov sa nepodarilo úplne vrátiť späť. Znova otvorte správu aplikácií, skontrolujte aktuálne nastavenia systému Proxmox a prevezmite ich.",
   "The restored service did not pass its health check": "Obnovená služba neprešla kontrolou stavu",
   "The restored service stopped; the recovery is not confirmed": "Obnovená služba sa zastavila; obnova sa nepotvrdila",
   "The reviewed Tandoor stack does not require a privileged LXC.": "Preskúmaný Tandoor stack require privilegovaný LXC.",
@@ -6668,6 +6724,7 @@
   "The selected VM": "Vybraná VM",
   "The selected VM is running.": "Vybraná VM beží.",
   "The selected base folder does not exist and could not be created:": "Vybraný základný priečinok neexistuje a nepodarilo sa ho vytvoriť:",
+  "The selected bridge does not exist": "Vybraný sieťový most neexistuje",
   "The selected bridge has no IPv4 subnet for the host-monitor firewall": "Vybraný bridge nemá IPv4 podsieť pre firewall monitora hostiteľa",
   "The selected configuration needs to start the LXC during the installation": "Vybraná konfigurácia musí spustiť LXC počas inštalácie",
   "The selected container is unprivileged. A privileged container is required for direct device passthrough.": "Vybraný kontajner je neprivilegovaný. Na priame priradenie zariadenia je potrebný privilegovaný kontajner.",
@@ -6690,6 +6747,7 @@
   "The service builds its own image; only a published image can be installed": "Služba buduje svoj vlastný obraz; môže byť nainštalovaný iba zverejnený obrázok",
   "The service declares no image:": "Služba neprehlasuje žiadny obrázok:",
   "The setting has no final value:": "Nastavenie nemá žiadnu konečnú hodnotu:",
+  "The settings could not be fully rolled back. Review the container and its saved modification before continuing.": "Nepodarilo sa vrátiť všetky nastavenia. Pred pokračovaním skontrolujte kontajner a uloženú zmenu.",
   "The share already exists in smb.conf:": "Zdieľanie už existuje v smb.conf:",
   "The shared destination is not a directory": "Zdieľaná destinácia nie je adresár",
   "The shared directory points to a protected host path": "Zdieľaný adresár ukazuje na chránenú cestu hostiteľa",
@@ -6757,19 +6815,24 @@
   "These Proxmox resources were added outside ProxMenux:": "Tieto zdroje Proxmox boli pridané mimo ProxMenux:",
   "These VMIDs are not free:": "Tieto VMID nie sú zadarmo:",
   "These are the changes that will be made": "Tieto zmeny sa vykonajú",
+  "These changes were made in Proxmox outside ProxMenux:": "Tieto zmeny boli vykonané v Proxmox mimo ProxMenux:",
   "These container mount paths have an extension-like suffix:": "Tieto cesty pripojenia v kontajneri majú príponu podobnú koncovke súboru:",
   "These containers were restored from a backup and this host has no record of their OCI application:": "Tieto kontajnery boli obnovené zo zálohy a tento hostiteľ nemá žiadny záznam o ich aplikácii OCI:",
+  "These devices share the IOMMU group of the selected GPU and will be assigned to the VM with it:": "Tieto zariadenia zdieľajú skupinu IOMMU vybranej GPU a priradia sa k VM spolu s ňou:",
   "These host backups run with this job and expect its storage:": "Tieto zálohy hostiteľa sa spúšťajú s touto úlohou a očakávajú jej uloženie:",
   "These host backups run with this job and will stop running:": "Tieto zálohy hostiteľa sa spúšťajú s touto úlohou a prestanú sa spúšťať:",
   "These interface configurations will be removed": "Tieto nastavenia rozhraní sa odstránia",
   "These manual changes cannot be adopted safely:": "Tieto manuálne zmeny nie je možné bezpečne prijať:",
   "These paths will not be restored live and will be extracted for manual recovery.": "Tieto cesty sa neobnovia za behu a rozbalia sa na ručnú obnovu.",
+  "These settings require an application-specific adaptation. The image was not downloaded and the container was not recreated.": "Tieto nastavenia vyžadujú úpravu špecifickú pre aplikáciu. Obraz sa nestiahol a kontajner sa nevytvoril znova.",
   "These values are asked during the installation:": "Tieto hodnoty sa požadujú počas inštalácie:",
   "They are described in the image documentation:": "Ich popis nájdete v dokumentácii image:",
   "They will be added to oci-compose before continuing. Unsupported or changed resources are not imported.": "Pred pokračovaním budú pridané do oci-compose. Nepodporované alebo zmenené zdroje sa neimportujú.",
+  "They will be saved in oci-compose before continuing.": "Pred pokračovaním budú uložené v oci-compose.",
   "This CIFS share is mounted with restrictive permissions.": "Toto CIFS zdieľanie je pripojené s obmedzujúcimi oprávneniami.",
   "This GPU is considered incompatible with GPU passthrough to a VM in ProxMenux.": "Táto GPU sa v ProxMenux považuje za nekompatibilnú s GPU passthrough do VM.",
   "This NFS share is fully restricted — even the host root cannot write to it.": "Toto NFS zdieľanie je úplne obmedzené - ani root na hostovi doň nevie zapisovať.",
+  "This Proxmox Backup Server has no active subscription, switch to the no-subscription repository? The inaccessible Enterprise PBS source will be disabled.": "Tento Proxmox Backup Server nemá aktívne predplatné. Prepnúť na repozitár bez predplatného? Nedostupný zdroj Enterprise PBS bude vypnutý.",
   "This VM requires extra installation steps, see install guide at:\nhttps://github.com/community-scripts/ProxmoxVE/discussions/144": "Táto VM vyžaduje ďalšie kroky inštalácie. Návod nájdete tu:\nhttps://github.com/community-scripts/ProxmoxVE/discussions/144",
   "This account is for {registry}. Enter an image from that registry.": "Tento účet je pre {registry}. Zadajte obrázok z tohto registra.",
   "This action will:": "Táto akcia vykoná:",
@@ -6831,10 +6894,13 @@
   "This may take several minutes...": "Môže to trvať niekoľko minút...",
   "This means Proxmox handles mount lifecycle natively (no manual /etc/fstab needed for NFS/CIFS host storages).": "To znamená, že Proxmox sa o pripojenie stará priamo; pre NFS/CIFS úložiská na hostovi netreba ručne upravovať /etc/fstab.",
   "This means the credentials are incorrect.": "To znamená, že prihlasovacie údaje nie sú správne.",
+  "This menu requires Proxmox Backup Server.": "Táto ponuka vyžaduje Proxmox Backup Server.",
   "This might indicate network connectivity issues.": "Môže to znamenať problém so sieťovým pripojením.",
   "This monitor uses a privileged LXC, shares processes and network with Proxmox and disables AppArmor in the CT. It uses the IP address and firewall of the host. A compromised image could affect the host; do not expose its web UI to the Internet.": "Tento monitor používa privilegovaný LXC, zdieľa procesy a sieť s Proxmox a vypne AppArmor v CT. Používa IP adresu a firewall hostiteľa. Kompromitovaný obraz by mohol mať vplyv na hostiteľa; nevystavujte svoje webové UI internetu.",
   "This only removes the schedule. Existing backup archives are NOT deleted.": "Týmto sa odstráni iba plán. Existujúce zálohy NEBUDÚ vymazané.",
   "This operation may take several minutes and requires internet connectivity.": "Táto operácia môže trvať niekoľko minút a vyžaduje pripojenie na internet.",
+  "This operation requires a Proxmox VE host. Use the PBS menu on Proxmox Backup Server.": "Táto operácia vyžaduje hostiteľa Proxmox VE. Na Proxmox Backup Serveri použite ponuku PBS.",
+  "This operation supports PBS 3 on Debian 12 and PBS 4 on Debian 13.": "Táto operácia podporuje PBS 3 na Debiane 12 a PBS 4 na Debiane 13.",
   "This package was installed by older versions of the ProxMenux Coral installer that placed the M.2 kernel driver on every system, including USB-only setups. It is not needed for Coral USB devices, which use libedgetpu1-std / libedgetpu1-max only.": "Tento balík bol nainštalovaný staršími verziami inštalačného programu ProxMenux Coral, ktorý umiestnil ovládač jadra M.2 na každý systém, vrátane nastavení iba cez USB.Nie je potrebný pre zariadenia Coral USB, ktoré používajú iba libedgetpu1-std / libedgetpu1-max.",
   "This passphrase is the ONLY way to access encrypted Borg backups.": "Táto fráza je JEDINÝ spôsob, ako sa dostať k šifrovaným Borg zálohám.",
   "This path is already used as a mount point in this container.": "Táto cesta už je v tomto kontajneri použitá ako mount point.",
@@ -6850,6 +6916,7 @@
   "This script cannot be executed from the Proxmox web terminal.": "Tento skript sa nedá spustiť z webového terminálu Proxmoxu.",
   "This script must be run as root.": "Tento skript musí byť spustený ako root.",
   "This script must be run on a Proxmox host.": "Tento skript musí byť spustený na Proxmox serveri.",
+  "This script will apply the following optimizations and advanced adjustments to your Proxmox Backup Server": "Tento skript použije nasledujúce optimalizácie a pokročilé úpravy na váš Proxmox Backup Server",
   "This script will apply the following optimizations and advanced adjustments to your Proxmox VE server": "Tento skript použije tieto optimalizácie a pokročilé úpravy na vašom serveri Proxmox VE",
   "This script will update your Proxmox VE system with advanced options:": "Tento skript aktualizuje váš Proxmox VE systém s pokročilými možnosťami:",
   "This session is running in the Monitor terminal. Running it from here would cut the connection mid-install and leave the switch in a broken state.": "Táto relácia beží v termináli Monitora. Ak by sa to spustilo odtiaľto, pripojenie sa počas inštalácie preruší a prepnutie môže zostať v zlom stave.",
@@ -6981,6 +7048,7 @@
   "Unable to identify the root filesystem. Aborting.": "Nepodarilo sa identifikovať koreňový súborový systém. Prerušuje sa.",
   "Unable to resolve system ZFS pool disks. Aborting.": "Nepodarilo sa vyriešiť systémové disky ZFS fondu. Prerušuje sa.",
   "Unable to resolve system disk topology. Aborting.": "Nepodarilo sa vyriešiť topológiu systémového disku. Prerušuje sa.",
+  "Unapplied changes": "Nepoužité zmeny",
   "Understand the security implications of privileged containers": "Uistite sa, že rozumiete bezpečnostným dôsledkom privilegovaných kontajnerov",
   "Unexpected Proxmox inventory; recovery blocked": "Neočakávaný inventár Proxmox; zablokovaná obnova",
   "Unexpected formatting directory in the new Valkey volume": "Neočakávaný formátovanie adresára v novom hlasitosti Valkey",
@@ -7080,6 +7148,7 @@
   "Unsupported OCI-LXC AppArmor profile:": "Nepodporovaný profil OCI-LXC AppArmor:",
   "Unsupported OCI-LXC seccomp profile:": "Nepodporovaný profil OCI-LXC seccomp:",
   "Unsupported Terminal": "Nepodporovaný terminál",
+  "Unsupported architecture for Figurine:": "Nepodporovaná architektúra pre Figurine:",
   "Unsupported architecture:": "Nepodporovaná architektúra:",
   "Unsupported backup compression": "Nepodporovaná kompresia zálohy",
   "Unsupported credential pattern:": "Nepodporovaný credential vzor:",
@@ -7095,6 +7164,7 @@
   "Unsupported mount type": "Nepodporovaný typ pripojenia",
   "Unsupported mount type:": "Nepodporovaný typ pripojenia:",
   "Unsupported native device type:": "Nepodporovaný natívne typ zariadenia:",
+  "Unsupported network settings": "Nepodporované sieťové nastavenia",
   "Unsupported operation": "Nepodporovaná operation",
   "Unsupported or unknown Proxmox version; no repository changed.": "Nepodporovaná alebo neznáma verzia Proxmox; žiadne úložisko sa nezmenilo.",
   "Unsupported output format:": "Nepodporovaný výstupný formát:",
@@ -7122,6 +7192,7 @@
   "Update NVIDIA in LXC Containers": "Aktualizovať NVIDIA v LXC kontajneroch",
   "Update OCI": "Aktualizovať OCI",
   "Update OCI stack": "Aktualizovať OCI stack",
+  "Update PBS using configured repositories": "Aktualizovať PBS pomocou nakonfigurovaných repozitárov",
   "Update PVE enterprise repository (Only if using enterprise):": "Aktualizujte PVE enterprise repozitár (iba ak používate enterprise):",
   "Update Proxmox VE Appliance Manager": "Aktualizovať správcu aplikácií Proxmox VE",
   "Update Proxmox package lists": "Aktualizovať zoznamy Proxmox balíkov",
@@ -7174,6 +7245,7 @@
   "Upgrade assistant: Proxmox VE 8 → 9 (Trixie)": "Asistent aktualizácie: Proxmox VE 8 → 9 (Trixie)",
   "Upgrade canceled by user": "Aktualizácia zrušená používateľom",
   "Upgrade one node at a time": "Aktualizujte vždy iba jeden uzol naraz",
+  "Upgrade the system, offering the": "Aktualizujte systém a ponúknite",
   "Upgrade to Proxmox VE 9": "Aktualizovať na Proxmox VE 9",
   "Upgrading NVIDIA utils (Arch)...": "Aktualizujem NVIDIA nástroje (Arch)...",
   "Upload an encrypted copy of the key to PBS so you can recover it on a reinstalled host with just a passphrase?": "Nahrať šifrovanú kópiu kľúča do PBS, aby ste ju vedeli obnoviť na preinštalovanom hostovi iba pomocou frázy?",
@@ -7611,6 +7683,7 @@
   "active VF(s)": "aktívne VF",
   "active VFs": "aktívnymi VF",
   "active Virtual Functions. Changing its driver binding would destroy every VF.": "aktívnymi Virtual Functions. Zmena naviazania ovládača by zrušila každú VF.",
+  "added in Proxmox": "pridané v Proxmox",
   "after copy; source tree is incomplete.": "po kopírovaní; zdrojový strom je neúplný.",
   "after update.": "po aktualizácii.",
   "all guests": "všetci hostia",
@@ -7978,6 +8051,7 @@
   "remapped users": "remapovanými používateľmi",
   "remove the (now-empty) directory if possible": "odstrániť teraz prázdny priečinok, ak to bude možné",
   "removed from Proxmox": "odstránené z Proxmoxu",
+  "removed in Proxmox": "odstránené v Proxmox",
   "removed successfully from Proxmox.": "úspešne odstránené z Proxmoxu.",
   "requires running the official installer, which restarts the Monitor service.": "vyžaduje spustenie oficiálneho inštalátora, ktorý reštartuje službu Monitor.",
   "requires the package": "vyžaduje balík",
@@ -8081,18 +8155,20 @@
   "using": "cez",
   "using direct path (not guaranteed to survive reboots).": "používa sa priama cesta (nie je zaručené, že prežije reštarty).",
   "vCPUs:": "vCPU:",
+  "value changed in Proxmox": "hodnota zmenená v Proxmox",
   "vfio-pci IDs configured": "vfio-pci ID nastavené",
   "vfio-pci IDs in /etc/modprobe.d/vfio.conf": "vfio-pci ID v /etc/modprobe.d/vfio.conf",
   "video": "video",
   "video + recognition": "video + rozpoznávanie",
   "video only": "iba video",
   "vzdump backup speed optimization completed": "Optimalizácia rýchlosti záloh vzdump je dokončená",
-  "wallabag builds its links from the address given during the installation. If it does not match the address of the container, edit lxc.environment.runtime: SYMFONY__ENV__DOMAIN_NAME in /etc/pve/lxc/<CTID>.conf with the container stopped, and start it again.": "wallabag buduje svoje odkazy z adresy uvedenej počas inštalácie. Ak nezodpovedá adrese kontajnera, upravte prostredie lxc. čas: SYMFONY  ENV  DOMAIN NAME in /etc/pve/lxc/ <CTID>.conf s kontajnerom zastavil, a začať znova.",
+  "wallabag builds its links from the address given during the installation. If it does not match the address of the container, edit lxc.environment.runtime: SYMFONY__ENV__DOMAIN_NAME in /etc/pve/lxc/<CTID>.conf with the container stopped, and start it again.": "wallabag vytvára odkazy z adresy zadanej pri inštalácii. Ak sa nezhoduje s adresou kontajnera, zastavte ho, upravte lxc.environment.runtime: SYMFONY__ENV__DOMAIN_NAME v /etc/pve/lxc/<CTID>.conf a znova ho spustite.",
   "wallabag listens on port 80 of the container and stores its data in SQLite.": "wallabag počúva port 80 kontajnera a ukladá svoje údaje v SQLite.",
   "wallabag web interface": "Webové rozhranie wallabag",
   "was": "bolo",
   "was installed, but the kernel reports:": "bol nainštalovaný, ale jadro hlási:",
   "when finished": "po dokončení",
+  "when the server has no subscription (you will be asked)": "keď server nemá predplatné (budete požiadaný)",
   "will rebind the GPU to vfio-pci on the next reboot, breaking the driver that is about to be installed.": "pri ďalšom reštarte znova naviaže GPU na vfio-pci, čím sa preruší ovládač, ktorý sa má nainštalovať.",
   "wipefs failed on": "wipefs zlyhalo na",
   "with": "za",
diff --git a/lang/sv.json b/lang/sv.json
index 5e2b5f83..9cffe5e4 100644
--- a/lang/sv.json
+++ b/lang/sv.json
@@ -37,6 +37,7 @@
   "/var/lib/vz/dump   (Proxmox default vzdump path)": "/var/lib/vz/dump (Proxmox standard vzdump sökväg)",
   "/var/lib/vz/dump   (Proxmox default)": "/var/lib/vz/dump (Proxmox standard)",
   "1777 = sticky bit + rwx for all. No shared group needed.": "1777 = sticky bit + rwx för alla. Ingen delad grupp behövs.",
+  "====== PBS UPDATE COMPLETED ======": "====== PBS UPPDATERING AVSLUTAD ======",
   "====== PVE UPDATE COMPLETED ======": "====== PVE UPPDATERING AVSLUTAD ======",
   ">> Create a new backup job <<": ">> Skapa ett nytt säkerhetskopieringsjobb <<",
   ">> Save and return <<": ">> Spara och returnera <<",
@@ -87,6 +88,7 @@
   "A multi-container application is not recreated: its containers are updated together.": "Ett program med flera behållare återskapas inte: dess behållare uppdateras tillsammans.",
   "A new ProxMenux version is available:": "En ny ProxMenux-version är tillgänglig:",
   "A new kernel is staged for the next boot:": "En ny kärna är iscensatt för nästa uppstart:",
+  "A newer kernel is installed. Reboot before the next backup window to use it.": "En nyare kärna är installerad. Starta om innan nästa säkerhetskopieringsfönster för att använda det.",
   "A newer version is available:": "En nyare version finns tillgänglig:",
   "A pending operation exists for": "En väntande operation finns för",
   "A pending stack assembly already exists; it is not overwritten": "En väntande stack församling existerar redan; den är inte överskriven",
@@ -169,6 +171,8 @@
   "APT language configuration updated": "APT-språkkonfigurationen uppdaterad",
   "APT language downloads restored": "APT-språknedladdningar återställda",
   "APT package lists updated": "APT-paketlistor uppdaterade",
+  "APT refresh failed. Check the PBS subscription and repositories in Administration > Repositories. Log:": "APT-uppdatering misslyckades. Kontrollera PBS-prenumerationen och arkiven i Administration > Repositories. Logga:",
+  "APT refresh failed. Check the PBS subscription and repositories in the native PBS interface; no source was changed.": "APT-uppdateringen misslyckades. Kontrollera PBS-prenumerationen och paketförråden i PBS eget gränssnitt; inga paketkällor ändrades.",
   "APT update failed. Check repository access; NVIDIA installation stopped.": "APT-uppdateringen misslyckades. Kontrollera åtkomsten till arkiven; NVIDIA-installationen stoppades.",
   "Aborted": "Avbruten",
   "About to restore": "På väg att återställa",
@@ -318,7 +322,7 @@
   "After confirming, you will be asked to choose the NVIDIA driver version to install.": "Efter bekräftelse kommer du att bli ombedd att välja NVIDIA-drivrutinsversionen att installera.",
   "After detailed analysis, no changes are needed.": "Efter detaljerad analys behövs inga ändringar.",
   "After detailed analysis, no cleanup is needed.": "Efter detaljerad analys behövs ingen rengöring.",
-  "After logging in, run: ip a to obtain the IP address.\nThen, enter that IP address in your web browser like this:\n  http://IP_ADDRESS\n\nThis will open the Umbral OS dashboard.": "När du har loggat in, kör: ip a för att få IP-adressen.\nAnge sedan den IP-adressen i din webbläsare så här:\n  http://IP_ADRESS\n\nDetta öppnar Umbral OS-instrumentpanelen.",
+  "After logging in, run: ip a to obtain the IP address.\nThen, enter that IP address in your web browser like this:\n  http://IP_ADDRESS\n\nThis will open the Umbral OS dashboard.": "Kör ip a efter inloggningen för att ta reda på IP-adressen.\nAnge sedan adressen i webbläsaren så här:\n  http://IP_ADDRESS\n\nDå öppnas instrumentpanelen för Umbral OS.",
   "After pasting on the server, ensure the file is chmod 600 and owned by": "Efter att ha klistrat in på servern, se till att filen är chmod 600 och ägs av",
   "After reboot the system will be fully accessible (SSH, web UI, login), but the following components will be reinstalled in BACKGROUND — until they finish, commands like nvidia-smi may not yet be available:": "Efter omstart kommer systemet att vara fullt tillgängligt (SSH, webbgränssnitt, inloggning), men följande komponenter kommer att installeras om i BAKGRUND - tills de är klara kanske kommandon som nvidia-smi inte är tillgängliga ännu:",
   "After reboot, these components will reinstall in background:": "Efter omstart kommer dessa komponenter att installeras om i bakgrunden:",
@@ -330,7 +334,7 @@
   "After this LXC → VM switch, reboot the host so the new binding state is applied cleanly.": "Efter denna LXC → VM-switch, starta om värden så att det nya bindningsläget tillämpas korrekt.",
   "Airsonic Advanced web interface": "Airsonic Advanced webbgränssnitt",
   "Airsonic-advanced is a free, web-based media streamer, providing ubiquitious access to your music. Use it to share your music with friends, or to listen to your own music while at work. You can stream to multiple players simultaneously, for instance to one player in your kitchen and another in your living room.": "Airsonic-advanced är en gratis, webbaserad media streamer, som ger ubiquitious tillgång till din musik. Använd den för att dela din musik med vänner, eller för att lyssna på din egen musik på jobbet. Du kan strömma till flera spelare samtidigt, till exempel till en spelare i ditt kök och en annan i ditt vardagsrum.",
-  "Aliases added to .bashrc": "Alias ​​har lagts till i .bashrc",
+  "Aliases added to .bashrc": "Alias har lagts till i .bashrc",
   "Alist Sync web interface": "Alist Sync webbgränssnitt",
   "All": "Alla",
   "All Available Scripts": "Alla tillgängliga skript",
@@ -425,6 +429,7 @@
   "Apply": "Tillämpas",
   "Apply AMD CPU fixes": "Tillämpa AMD CPU-fixar",
   "Apply Available Updates": "Tillämpa tillgängliga uppdateringar",
+  "Apply PBS package upgrade": "Tillämpa PBS-paketuppgraderingen",
   "Apply and restart services:": "Tillämpa och starta om tjänster:",
   "Apply available updates": "Tillämpa tillgängliga uppdateringar",
   "Apply boot/initramfs changes": "Tillämpa boot/initramfs ändringar",
@@ -438,12 +443,15 @@
   "Apply options from the current catalog template? New required paths and settings may be requested. Review the resulting configuration before recreating the CT.": "Vill du använda alternativ från den aktuella katalogmallen? Nya nödvändiga sökvägar och inställningar kan begäras. Granska den resulterande konfigurationen innan du återskapar CT.",
   "Apply read+write access for 'others' on the host directory?": "Tillämpa läs+skrivbehörighet för \"andra\" på värdkatalogen?",
   "Apply the options from the current catalog template? Your data and configuration are kept.": "Applicera alternativen från den aktuella katalogmallen? Din data och konfiguration hålls.",
+  "Apply the reviewed package upgrade now? Services may restart and packages listed for removal will be removed.": "Tillämpa den granskade paketuppgraderingen nu? Tjänster kan startas om och paket som anges för borttagning kommer att tas bort.",
   "Apply these changes?": "Tillämpa dessa ändringar?",
   "Applying AMD-specific fixes...": "Tillämpar AMD-specifika korrigeringar...",
+  "Applying CPU and RAM changes without rebuilding the container...": "Tillämpar ändringarna av CPU och RAM utan att återskapa containern...",
   "Applying Changes": "Tillämpa ändringar",
   "Applying Controller/NVMe passthrough to VM": "Tillämpar styrenhets-/NVMe-passthrough på VM",
   "Applying balanced memory optimization settings...": "Tillämpar inställningar för balanserad minnesoptimering...",
   "Applying changes safely...": "Tillämpar ändringar på ett säkert sätt...",
+  "Applying container settings without rebuilding the container...": "Tillämpar inställningarna utan att återskapa containern...",
   "Applying custom restore": "Använder anpassad återställning",
   "Applying default VM configuration": "Tillämpar standard VM-konfiguration",
   "Applying host permissions for unprivileged LXC bind-mounts...": "Tillämpar värdbehörigheter för oprivilegierade LXC bind-mounts...",
@@ -535,6 +543,7 @@
   "Available Borg targets:": "Tillgängliga Borg-mål:",
   "Available Disks on Host": "Tillgängliga diskar på värd",
   "Available ISO Images": "Tillgängliga ISO-bilder",
+  "Available PBS Version": "Tillgänglig PBS-version",
   "Available PBS repositories:": "Tillgängliga PBS-lager:",
   "Available PVE Version": "Tillgänglig PVE-version",
   "Available Shares:": "Tillgängliga andelar:",
@@ -746,6 +755,7 @@
   "Cannot verify the reused disk:": "Kan inte verifiera den återanvända disken:",
   "Cannot write the image archive to {storage}. Check storage access and mount status.": "Kan inte skriva bildarkivet till {storage}. Kontrollera lagringsåtkomst och monteringsstatus.",
   "Capabilities cannot be kept and all dropped at the same time": "Förmågor kan inte hållas och alla tappas samtidigt",
+  "Catalog options": "Katalogalternativ",
   "Category": "Kategori",
   "Caution: Maximum mode generates more heat.": "Varning: Maximalt läge genererar mer värme.",
   "Ceph check skipped by user flag (--ignore-ceph-check)": "Ceph-kontroll hoppas över av användarflaggan (--ignore-ceph-check)",
@@ -880,6 +890,7 @@
   "Choose a schedule (systemd calendar-event syntax):": "Välj ett schema (syntax för systemd kalenderhändelser):",
   "Choose a script to execute:": "Välj ett skript att köra:",
   "Choose a server:": "Välj en server:",
+  "Choose a setting. Changes are applied only after the final review.": "Välj en inställning. Ändringarna tillämpas först efter den slutliga granskningen.",
   "Choose a share to mount:": "Välj en resurs att montera:",
   "Choose a specific supported GPU or USB node": "Välj en specifik GPU- eller USB-nod som stöds",
   "Choose action for this controller/NVMe:": "Välj åtgärd för denna kontroller/NVMe:",
@@ -960,6 +971,7 @@
   "Code-server is VS Code running on a remote server, accessible through the browser.": "Kod-server är VS-kod som körs på en fjärrserver, tillgänglig via webbläsaren.",
   "CodeProject.AI Server": "CodeProject. AI Server",
   "Command": "Kommando",
+  "Command failed": "Kommandot misslyckades",
   "Command override for an unknown service:": "Kommando åsidosätter en okänd tjänst:",
   "Commenting any residual Bookworm lines in *.list...": "Kommenterar eventuella återstående Bookworm-rader i *.list...",
   "Commenting legacy PVE 8 repository .list files (if any)...": "Kommenterar äldre PVE 8-arkiv .list-filer (om några)...",
@@ -1516,6 +1528,7 @@
   "Current NVIDIA inventory resolved: a refresh is required": "Nuvarande NVIDIA inventering löst: en uppfriskning är required",
   "Current NVIDIA inventory resolved: no refresh is required": "Nuvarande NVIDIA inventering löst: ingen uppfriskning är required",
   "Current Network Configuration": "Aktuell nätverkskonfiguration",
+  "Current PBS Version": "Aktuell PBS-version",
   "Current PVE Version": "Aktuell PVE-version",
   "Current ProxMenux host scripts register remote shares as Proxmox storages using pvesm.": "Aktuella ProxMenux-värdskript registrerar fjärrresurser som Proxmox-lagringar med hjälp av pvesm.",
   "Current ProxMenux version:": "Aktuell ProxMenux-version:",
@@ -1630,8 +1643,8 @@
   "Default Proxmox logo applied": "Standard Proxmox-logotyp tillämpas",
   "Default is none (video-only passthrough). Use SPACE to toggle selections.": "Standard är ingen (endast videogenomströmning). Använd MELLANSLAG för att växla mellan val.",
   "Default journald configuration restored": "Standard journalkonfiguration återställd",
-  "Default location is /mnt/<name>. The share will be mounted here on the host with open permissions so an unprivileged LXC can bind-mount and write to it. For LXC access, bind-mount this path with the LXC Mount Manager.": "Standardplatsen är /mnt/<namn>. Delingen kommer att monteras här på värden med öppna behörigheter så att en oprivilegierad LXC kan bind-mounta och skriva till den. För LXC-åtkomst, bind-montera den här sökvägen med LXC Mount Manager.",
-  "Default location is /mnt/<name>. The share will be mounted here on the host. Use this path in /etc/fstab. For LXC access, bind-mount this path with the LXC Mount Manager.": "Standardplatsen är /mnt/<namn>. Delen kommer att monteras här på värden. Använd denna sökväg i /etc/fstab. För LXC-åtkomst, bind-montera den här sökvägen med LXC Mount Manager.",
+  "Default location is /mnt/<name>. The share will be mounted here on the host with open permissions so an unprivileged LXC can bind-mount and write to it. For LXC access, bind-mount this path with the LXC Mount Manager.": "Standardplatsen är /mnt/<name>. Den delade resursen monteras här på värden med öppna behörigheter, så att en oprivilegierad LXC-container kan bind-montera den och skriva till den. Använd LXC Mount Manager för att skapa monteringen i LXC-containern.",
+  "Default location is /mnt/<name>. The share will be mounted here on the host. Use this path in /etc/fstab. For LXC access, bind-mount this path with the LXC Mount Manager.": "Standardplatsen är /mnt/<name>. Den delade resursen monteras här på värden. Använd sökvägen i /etc/fstab. För åtkomst från en LXC-container, skapa en bind-montering av sökvägen med LXC Mount Manager.",
   "Default login": "Standard inloggning",
   "Default options": "Standardalternativ",
   "Default options read/write": "Standardalternativ läs/skriv",
@@ -1681,6 +1694,7 @@
   "Detected Coral hardware:": "Upptäckt Coral-hårdvara:",
   "Detected GPU(s):": "Upptäckta GPU:er:",
   "Detected Intel CPU": "Upptäckte Intel CPU",
+  "Detected Proxmox Backup Server": "Upptäckte Proxmox Backup Server",
   "Detected Proxmox VE": "Detekterade Proxmox VE",
   "Detected Proxmox VE 8.x - Installing Ceph Squid for Debian": "Upptäckte Proxmox VE 8.x - Installerar Ceph Squid för Debian",
   "Detected Proxmox VE 9.x - Installing Ceph Squid for Debian Trixie": "Upptäckte Proxmox VE 9.x - Installerar Ceph Squid för Debian Trixie",
@@ -1762,6 +1776,9 @@
   "Disabling and stopping rpcbind service and socket...": "Inaktivera och stoppa rpcbind-tjänsten och -socket...",
   "Disabling non-free firmware warnings...": "Inaktiverar icke-fri firmware-varningar...",
   "Disabling portmapper/rpcbind for security...": "Inaktiverar portmapper/rpcbind för säkerhet...",
+  "Discard changes": "Kasta ändringar",
+  "Discard unapplied changes?": "Kasta ändringar som inte har tillämpats?",
+  "Discover NFS exports on a server": "Hitta NFS-exporter på en server",
   "Discover targets on portal:": "Upptäck mål på portalen:",
   "Discovering iSCSI targets...": "Upptäcker iSCSI-mål...",
   "Discovery successful": "Upptäckten lyckades",
@@ -1841,6 +1858,7 @@
   "Do you want to proceed with the system update?": "Vill du fortsätta med systemuppdateringen?",
   "Do you want to proceed?": "Vill du fortsätta?",
   "Do you want to reboot now?": "Vill du starta om nu?",
+  "Do you want to remove the Proxmox subscription banner from the Proxmox Backup Server web interface?": "Vill du ta bort Proxmox-prenumerationsbannern från Proxmox Backup Server-webbgränssnittet?",
   "Do you want to remove the stale entry from vfio.conf and continue?": "Vill du ta bort den inaktuella posten från vfio.conf och fortsätta?",
   "Do you want to remove the stale entry from vfio.conf?": "Vill du ta bort den inaktuella posten från vfio.conf?",
   "Do you want to restart the network service now to apply changes?": "Vill du starta om nätverkstjänsten nu för att tillämpa ändringar?",
@@ -2018,7 +2036,7 @@
   "Enter VM ID:": "Ange VM ID:",
   "Enter VM/CT ID:": "Ange VM/CT ID:",
   "Enter ZFS pool name for the selected disk:": "Ange ZFS-poolnamn för den valda disken:",
-  "Enter a name for the mount point (used as /mnt/<name>):": "Ange ett namn för monteringspunkten (används som /mnt/<namn>):",
+  "Enter a name for the mount point (used as /mnt/<name>):": "Ange ett namn för monteringspunkten (används som /mnt/<name>):",
   "Enter a name for the new virtual machine:": "Ange ett namn för den nya virtuella maskinen:",
   "Enter a non-empty password or access token on a single line.": "Ange ett icke-tomt lösenord eller åtkomsttoken på en enda rad.",
   "Enter a number, or write or paste a command:": "Ange ett nummer, eller skriv eller klistra in ett kommando:",
@@ -2143,7 +2161,7 @@
   "Etherpad admin page": "Etherpad admin sida",
   "Every 12 hours": "Var 12:e timme",
   "Every 3 hours": "Var 3:e timme",
-  "Every 6 hours": "Var 6:e ​​timme",
+  "Every 6 hours": "Var 6:e timme",
   "Every fail2ban jail ships disabled. Enable the ones you need in /config/fail2ban/jail.local, taking the ready-made jails in /config/fail2ban/jail.d/ as reference, then restart the container.": "Varje fail2ban fängslade fartyg. Möjliggöra de du behöver i /config / fail2ban /jail.local, ta de färdiga fängelserna i /config / fail2ban /jail.d / som referens, sedan starta om behållaren.",
   "Every hour": "Varje timme",
   "Every member of the stack is back to its previous installation.": "Varje medlem av stacken är tillbaka till sin tidigare installation.",
@@ -2166,7 +2184,7 @@
   "Example: pct stop 110": "Exempel: pct stop 110",
   "Example: pct stop 114": "Exempel: pct stop 114",
   "Example: pvesm add nfs nfs-nas --server 192.168.1.50 --export /volume1/proxmox --content import,backup": "Exempel: pvesm add nfs nfs-nas --server 192.168.1.50 --export /volume1/proxmox --content import,säkerhetskopia",
-  "Example: pvesm path local-lvm:vm-114-disk-0": "Exempel: pvesm sökväg local-lvm:vm-114-disk-0",
+  "Example: pvesm path local-lvm:vm-114-disk-0": "Exempel: pvesm path local-lvm:vm-114-disk-0",
   "Example: sed -i '/^unprivileged: 1/d' /etc/pve/lxc/110.conf": "Exempel: sed -i '/^unprivileged: 1/d' /etc/pve/lxc/110.conf",
   "Examples:": "Exempel:",
   "Execute destructive rollback?": "Utföra destruktiv återställning?",
@@ -2266,6 +2284,7 @@
   "Failed to clone log2ram repository. Check /tmp/log2ram_install.log": "Det gick inte att klona log2ram-förrådet. Kontrollera /tmp/log2ram_install.log",
   "Failed to configure EFI disk": "Det gick inte att konfigurera EFI-disken",
   "Failed to configure IOMMU automatically.": "Det gick inte att konfigurera IOMMU automatiskt.",
+  "Failed to configure Proxmox Backup Server repositories": "Det gick inte att konfigurera Proxmox Backup Server-förråd",
   "Failed to configure Proxmox repositories": "Det gick inte att konfigurera Proxmox-förråd",
   "Failed to configure TPM device in VM": "Det gick inte att konfigurera TPM-enhet i virtuell dator",
   "Failed to configure repositories.": "Det gick inte att konfigurera förråd.",
@@ -2477,7 +2496,7 @@
   "For a consistent export, the VM should be stopped.": "För en konsekvent export bör den virtuella datorn stoppas.",
   "For any question, issue or bug report, please use the official repository": "För alla frågor, problem eller felrapporter, använd det officiella arkivet",
   "For dedicated GPUs, FLR is required by this policy to reduce VM": "För dedikerade GPU:er krävs FLR enligt denna policy för att minska virtuella datorer",
-  "For example: pct enter 101": "Till exempel: pct ange 101",
+  "For example: pct enter 101": "Till exempel: pct enter 101",
   "For guest shares add: --options guest": "För gästandelar lägg till: --options gäst",
   "For security reasons, the system cannot format it.": "Av säkerhetsskäl kan systemet inte formatera det.",
   "For unprivileged containers, use instead:": "För oprivilegierade behållare, använd istället:",
@@ -2668,7 +2687,7 @@
   "HAOS One is a community image that runs Docker inside the container. The LXC stays unprivileged, but the inner AppArmor profiles may not be available. The first start downloads Home Assistant Core and its add-ons. If the check fails, the CT and /mnt/data are kept for diagnosis.": "HAOS One är en gemenskapsbild som kör Docker inuti behållaren. LXC är oprivilegierad, men de inre AppArmor-profilerna kanske inte är tillgängliga. Den första starten hämtar Home Assistant Core och dess tillägg. Om kontrollen misslyckas, CT och /mnt / data hålls för diagnos.",
   "HAOS One profile declined": "HAOS One-profilen minskade",
   "HAOS One requires an unprivileged unmanaged LXC with nesting and keyctl, 2 cores, 2048 MB RAM, rootfs of at least 12 GB and /mnt/data of at least 16 GB on a container volume included in backups": "HAOS One requires en oprivilegierad ohanterad LXC med häckning och keyctl, 2 kärnor, 2048 MB RAM, rötter på minst 12 GB och /mnt / data på minst 16 GB på en behållarvolym som ingår i backups",
-  "HTML5 Network Speed Test Server.": "HTML5 Network Speed ​​Test Server.",
+  "HTML5 Network Speed Test Server.": "HTML5 Network Speed Test Server.",
   "HTTP service check without a saved URL": "HTTP service check utan sparad URL",
   "Habridge emulates Philips Hue API to other home automation gateways such as an Amazon Echo/Dot Gen 1 (gen 2 has issues discovering ha-bridge) or other systems that support Philips Hue. The Bridge handles basic commands such as On, Off and brightness commands of the hue protocol. This bridge can control most devices that have a distinct API.": "Habridge emulerar Philips Hue API till andra hemautomatiseringsgateways som Amazon Echo / Dot Gen 1 (gen 2 har problem med att upptäcka ha-bro) eller andra system som stöder Philips Hue. Bron hanterar grundläggande kommandon som On, Off och ljusstyrka kommandon av nyansprotokollet. Denna bro kan styra de flesta enheter som har ett tydligt API.",
   "HandBrake is an open-source tool, built by volunteers, for converting video from nearly any format to a selection of modern, widely supported codecs.": "HandBrake är ett open-source verktyg, byggt av volontärer, för att konvertera video från nästan alla format till ett urval av moderna, allmänt stödda codecs.",
@@ -2755,7 +2774,7 @@
   "Host backup attached to PVE job": "Värdsäkerhetskopia kopplad till PVE-jobb",
   "Host data is not restored by the backup; confirm it with --acknowledge-external-data": "Värddata återställs inte av säkerhetskopieringen; bekräfta den med --acknowledge-external-data",
   "Host device for /dev/kvm": "Värd enhet för /dev/kvm",
-  "Host device for /dev/net/tun": "Värd enhet för /dev/nett/tun",
+  "Host device for /dev/net/tun": "Enhet på värden för /dev/net/tun",
   "Host device for /dev/ttyUSB0": "Värd enhet för /dev/ttyUSB0",
   "Host device for /dev/video10": "Värd enhet för /dev/video10",
   "Host device for /dev/video11": "Värd enhet för /dev/video11",
@@ -2889,8 +2908,8 @@
   "If notifications are enabled (Telegram/Discord/ntfy/...), you will receive a \"Host restore finished\" message when all background tasks complete.": "Om aviseringar är aktiverade (Telegram/Discord/ntfy/...), kommer du att få meddelandet \"Värdåterställning avslutad\" när alla bakgrundsuppgifter är klara.",
   "If passthrough fails on Windows: install RadeonResetBugFix.": "Om passthrough misslyckas på Windows: installera RadeonResetBugFix.",
   "If path not accessible (ZFS/BTRFS):": "Om sökväg inte är tillgänglig (ZFS/BTRFS):",
-  "If pvesm path returned a DEVICE (LVM):": "Om pvesm-sökvägen returnerade en DEVICE (LVM):",
-  "If pvesm path returned a DIRECTORY (ZFS/BTRFS):": "Om pvesm-sökvägen returnerade en DIRECTORY (ZFS/BTRFS):",
+  "If pvesm path returned a DEVICE (LVM):": "Om pvesm path returnerade en ENHET (LVM):",
+  "If pvesm path returned a DIRECTORY (ZFS/BTRFS):": "Om pvesm path returnerade en KATALOG (ZFS/BTRFS):",
   "If repositories error:": "Om förrådsfel:",
   "If the container had already been changed, its previous native backup is restored. Shared host directories are not reverted. The disks of the failed attempt are removed when the cleanup succeeds.": "Om behållaren redan hade ändrats, återställs dess tidigare inbyggda säkerhetskopia. Delade värdkataloger återställs inte. Diskarna för det misslyckade försöket tas bort när rensningen lyckas.",
   "If the host freezes, remove hostpci entries from": "Om värden fryser, ta bort hostpci-poster från",
@@ -2973,6 +2992,7 @@
   "Inaccessible device during VM startup": "Otillgänglig enhet under VM-start",
   "Inactive": "Inaktiv",
   "Inactive (entry in fstab, not currently mounted)": "Inaktiv (post i fstab, inte för närvarande monterad)",
+  "Include these changes in oci-compose?": "Inkludera dessa ändringar i oci-compose?",
   "Include these resources in oci-compose?": "Inkludera dessa resurser i oci-compose?",
   "Includes /etc/network (may drop SSH immediately)": "Inkluderar /etc/network (kan släppa SSH omedelbart)",
   "Includes /etc/zfs": "Inkluderar /etc/zfs",
@@ -3029,7 +3049,7 @@
   "Initiator IQN is authorised on the target": "Initiator IQN är auktoriserad på målet",
   "Initiator IQN:": "Initiativtagare IQN:",
   "Inkscape is professional quality vector graphics software which runs on Linux, Mac OS X and Windows desktop computers.": "Inkscape är professionell kvalitet vektor grafik programvara som körs på Linux, Mac OS X och Windows stationära datorer.",
-  "Inside the LXC, create the administrator: console kimai:user:create YOUR_USERNAME YOUR_EMAIL ROLE_SUPER_ADMIN": "Inuti LXC, skapa administratören: konsol kimai:user: skapa ditt USERNAME YOUR_EMAIL ROLE_SUPER_ADMIN",
+  "Inside the LXC, create the administrator: console kimai:user:create YOUR_USERNAME YOUR_EMAIL ROLE_SUPER_ADMIN": "Skapa administratören inne i LXC-containern: console kimai:user:create YOUR_USERNAME YOUR_EMAIL ROLE_SUPER_ADMIN",
   "Inspect disks before any action": "Inspektera diskar innan någon åtgärd",
   "Inspect host device nodes": "Inspektera värdenhetsnoder",
   "Inspect passthrough/kernel events": "Inspektera passthrough/kärnhändelser",
@@ -3209,6 +3229,8 @@
   "Invalid ALLOWED_HOSTS value": "Invalid ALLOWED_HOSTS värde",
   "Invalid Home Assistant OS check timeout": "Ogiltig Home Assistant OS check timeout",
   "Invalid ID": "Ogiltigt ID",
+  "Invalid IPv4 address": "Ogiltig IPv4-adress",
+  "Invalid IPv4 gateway": "Ogiltig IPv4-gateway",
   "Invalid Intel render path": "Invalid Intel render bana",
   "Invalid Jellyfin path:": "Invalid Jellyfin väg:",
   "Invalid MAC address:": "Ogiltig MAC-adress:",
@@ -3241,6 +3263,7 @@
   "Invalid administrator email": "Invalid administratör e-post",
   "Invalid administrator user name": "Invalid administratör användarnamn",
   "Invalid base VMID": "Ogiltig bas VMID",
+  "Invalid bridge": "Ogiltig brygga",
   "Invalid check package:": "Ogiltigt checkpaket:",
   "Invalid configuration path:": "Ogiltig konfigurationsväg:",
   "Invalid consume/export volumes": "Ogiltiga konsum/exportvolymer",
@@ -3304,6 +3327,7 @@
   "Invalid remote name": "Ogiltigt fjärrnamn",
   "Invalid remote path": "Invalid fjärrväg",
   "Invalid repair version:": "Ogiltig reparationsversion:",
+  "Invalid resource value": "Ogiltigt resursvärde",
   "Invalid resources": "Ogiltiga resurser",
   "Invalid restored volume path": "Invalid återställd volymväg",
   "Invalid running state": "Ogiltig körstatus",
@@ -3322,6 +3346,7 @@
   "Invalid stack members": "Ogiltiga stackmedlemmar",
   "Invalid stack name": "Invalid stack namn",
   "Invalid stack operation": "Ogiltig stack operation",
+  "Invalid storage": "Ogiltig lagring",
   "Invalid storage ID. Use only letters, numbers, hyphens and underscores.": "Ogiltigt lagrings-ID. Använd endast bokstäver, siffror, bindestreck och understreck.",
   "Invalid storage name": "Ogiltigt lagringsnamn",
   "Invalid suite application": "Invalid suite applikation",
@@ -3436,7 +3461,7 @@
   "Keyfile removed.": "Nyckelfilen har tagits bort.",
   "Keyrings method failed; trying apt-key fallback": "Nyckelringsmetoden misslyckades; försöker apt-key fallback",
   "KiCad - A Cross Platform and Open Source Electronics Design Automation Suite.": "KiCad - En Cross Platform och Open Source Electronics Design Automation Suite.",
-  "Kimai has no default account. Enter the container with: pct enter {main_vmid}": "Kimai har inget standardkonto. Ange behållaren med: pct enter {main vmid}",
+  "Kimai has no default account. Enter the container with: pct enter {main_vmid}": "Kimai har inget standardkonto. Öppna ett skal i containern med: pct enter {main_vmid}",
   "Kimai is a professional grade time-tracking application, free and open-source.": "Kimai är en professionell tidsspårningsapplikation, fri och öppen källkod.",
   "Kometa is a powerful tool designed to give you complete control over your media libraries. With Kometa, you can take your customization to the next level, with granular control over metadata, collections, overlays, and much more.": "Kometa är ett kraftfullt verktyg för att ge dig fullständig kontroll över dina mediebibliotek. Med Kometa kan du ta din anpassning till nästa nivå, med granulär kontroll över metadata, samlingar, överlagringar och mycket mer.",
   "Kometa reads its configuration from /config/config.yml and the container only ships /config/config.yml.template. Copy the template to config.yml, fill in the required Plex and TMDb connections, then restart the container.": "Kometa läser sin konfiguration från /config/config.yml och behållaren endast fartyg /config/config.yml.template. Kopiera mallen till config.yml, fyll i required Plex och TMDb-anslutningar och starta sedan om behållaren.",
@@ -3507,7 +3532,7 @@
   "Limiting size and optimizing journald": "Begränsning av storlek och optimering av journal",
   "Limiting size and optimizing journald...": "Begränsar storlek och optimerar journal...",
   "Limnoria A robust, full-featured, and user/programmer-friendly Python IRC bot, with many existing plugins. Successor of the well-known Supybot.": "Limnoria En robust, fullfjädrad och användarvänlig Python IRC bot, med många befintliga plugins. Framgång för den välkända Supybot.",
-  "Limnoria joins no IRC network until its configuration file exists. Create it with the setup wizard from the Proxmox host: pct exec <CTID> -- bash -c 'cd /config && limnoria-wizard'": "Limnoria går med i inget IRC-nätverk tills dess konfigurationsfil finns. Skapa den med installationsguiden från Proxmox-värden: pct exec <CTID> - bash -c \"cd /config & & & & limnoria-wizard\"",
+  "Limnoria joins no IRC network until its configuration file exists. Create it with the setup wizard from the Proxmox host: pct exec <CTID> -- bash -c 'cd /config && limnoria-wizard'": "Limnoria ansluter inte till något IRC-nätverk förrän konfigurationsfilen finns. Skapa den med installationsguiden från Proxmox-värden: pct exec <CTID> -- bash -c 'cd /config && limnoria-wizard'",
   "Line to paste (single line, including \"command=...\" prefix):": "Rad att klistra in (en rad, inklusive \"command=...\" prefix):",
   "Linux Installation Options": "Linux installationsalternativ",
   "Linux/Mac path:": "Linux/Mac sökväg:",
@@ -4153,6 +4178,7 @@
   "No active Proxmox storage accepts OCI template archives.": "Ingen aktiv Proxmox-lagring accepterar OCI-mallarkiv.",
   "No active exports or showmount not available": "Inga aktiva exporter eller showmount är inte tillgängligt",
   "No active session": "Ingen aktiv session",
+  "No active subscription and no usable PBS repository. Noninteractive mode cannot change APT sources; configure them in Administration > Repositories.": "Inget aktivt abonnemang och inget användbart PBS-förråd. Icke-interaktivt läge kan inte ändra APT-källor;konfigurera dem i Administration > Repositories.",
   "No active subscription and no usable PVE repository. Noninteractive mode cannot change APT sources; configure them in Node > Updates > Repositories.": "Ingen aktiv prenumeration och inget användbart PVE-arkiv. Icke-interaktivt läge kan inte ändra APT-källor; konfigurera dem i Node > Updates > Repositories.",
   "No additional GPU can be added.": "Ingen ytterligare GPU kan läggas till.",
   "No additional device needs to be added.": "Ingen ytterligare enhet behöver läggas till.",
@@ -4257,6 +4283,7 @@
   "No password provided.": "Inget lösenord angett.",
   "No paths available": "Inga vägar tillgängliga",
   "No paths selected. Select at least one path.": "Inga sökvägar har valts. Välj minst en väg.",
+  "No pending changes": "Inga väntande ändringar",
   "No pending paths to schedule for reboot.": "Inga väntande sökvägar att schemalägga för omstart.",
   "No permanent NFS mounts configured.": "Inga permanenta NFS-monteringar har konfigurerats.",
   "No permanent Samba mounts configured.": "Inga permanenta Samba-fästen har konfigurerats.",
@@ -4398,6 +4425,7 @@
   "OVH RTM removed (Puppet artefacts may need manual cleanup)": "OVH RTM har tagits bort (Puppet artefakter kan behöva manuell rengöring)",
   "OVH server detected": "OVH-server upptäckt",
   "OVH server detection and RTM installation process completed": "OVH-serverdetektering och RTM-installation har slutförts",
+  "Object detector": "Objektdetektor",
   "Object detector for Frigate": "Objektdetektor för Frigate",
   "Observer is not responding on port 4357": "Observer svarar inte på port 4357",
   "Obsidian is a note-taking app that lets you create, link, and organize your notes on your device, with hundreds of plugins and themes to customize your workflow. You can also publish your notes online, access them offline, and sync them securely with end-to-end encryption.": "Obsidian är en noterande app som låter dig skapa, länka och organisera dina anteckningar på din enhet, med hundratals plugins och teman för att anpassa ditt arbetsflöde. Du kan också publicera dina anteckningar online, komma åt dem offline och synkronisera dem säkert med end-to-end-kryptering.",
@@ -4523,11 +4551,17 @@
   "PBS backup error log": "PBS säkerhetskopia fellogg",
   "PBS backup failed.": "PBS-säkerhetskopiering misslyckades.",
   "PBS certificate": "PBS-certifikat",
+  "PBS datastores": "PBS-datalager",
   "PBS encryption keyfile (show / replace / remove)": "PBS-krypteringsnyckelfil (visa / ersätt / ta bort)",
   "PBS encryption keyfile — detailed info": "PBS-krypteringsnyckelfil — detaljerad information",
   "PBS extraction failed": "PBS-extraktion misslyckades",
   "PBS host or IP address:": "PBS-värd eller IP-adress:",
+  "PBS package update": "PBS-paketuppdatering",
+  "PBS package upgrade completed. Check whether a reboot is required before your next backup window.": "PBS-paketuppgraderingen är klar. Kontrollera om en omstart behövs före nästa säkerhetskopieringsfönster.",
+  "PBS package upgrade failed. Review the APT output before retrying.": "PBS-paketuppgraderingen misslyckades. Granska APT-utdata innan du försöker igen.",
   "PBS upload": "PBS uppladdning",
+  "PBS version and packages": "PBS-version och paket",
+  "PBS: using the configured APT repositories without changing sources.": "PBS: använder de konfigurerade APT-paketförråden utan att ändra källor.",
   "PCI Address": "PCI-adress",
   "PCI passthrough, TPM state, cloud-init configuration, Proxmox hooks": "PCI-genomföring, TPM-tillstånd, cloud-init-konfiguration, Proxmox-krokar",
   "PCI passthrough, TPM state, cloud-init, snapshots, Proxmox-specific hooks": "PCI-genomföring, TPM-tillstånd, moln-init, ögonblicksbilder, Proxmox-specifika krokar",
@@ -4567,7 +4601,7 @@
   "Partition created:": "Partition skapad:",
   "Partition table wiped": "Skiljebord torkat",
   "Pass /dev/kvm to the LXC": "Pass /dev/kvm till LXC",
-  "Pass /dev/net/tun to the LXC": "Pass /dev/netto/tun till LXC",
+  "Pass /dev/net/tun to the LXC": "Ge LXC-containern åtkomst till /dev/net/tun",
   "Pass /dev/ttyUSB0 to the LXC": "Pass /dev/ttyUSB0 till LXC",
   "Pass /dev/video10 to the LXC": "Pass /dev/video10 till LXC",
   "Pass /dev/video11 to the LXC": "Pass /dev/video11 till LXC",
@@ -4864,12 +4898,17 @@
   "Proxmology logo applied": "Proxmology-logotyp applicerad",
   "Proxmox 9 system update allready": "Proxmox 9 systemuppdatering redan",
   "Proxmox APT repositories configured": "Proxmox APT-förråd konfigurerade",
+  "Proxmox Backup Server": "Proxmox Backup Server",
   "Proxmox Backup Server (PBS) destinations": "Destinationer för Proxmox Backup Server (PBS)",
+  "Proxmox Backup Server APT repositories configured": "Proxmox Backup Server APT-förråd konfigurerade",
+  "Proxmox Backup Server Update": "Proxmox Backup Server Uppdatering",
+  "Proxmox Backup Server update completed.": "Proxmox Backup Server-uppdatering slutförd.",
   "Proxmox CIFS Storage Status:": "Proxmox CIFS-lagringsstatus:",
   "Proxmox NFS Storage Status:": "Proxmox NFS-lagringsstatus:",
   "Proxmox System Update": "Proxmox systemuppdatering",
   "Proxmox Update": "Proxmox-uppdatering",
   "Proxmox VE": "Proxmox VE",
+  "Proxmox VE 8 package upgrade failed. Review the APT output before retrying.": "Paketuppgraderingen av Proxmox VE 8 misslyckades. Granska APT-utdata innan du försöker igen.",
   "Proxmox VE 8 system update completed successfully": "Systemuppdateringen av Proxmox VE 8 slutfördes framgångsrikt",
   "Proxmox VE 8 to 9 Manual Upgrade Guide": "Proxmox VE 8 till 9 Manuell uppgraderingsguide",
   "Proxmox VE 9.x no-subscription repository created": "Proxmox VE 9.x arkiv utan prenumeration skapat",
@@ -4877,6 +4916,7 @@
   "Proxmox VE configuration completed.": "Proxmox VE-konfigurationen slutförd.",
   "Proxmox VE safe update completed": "Proxmox VE säker uppdatering slutförd",
   "Proxmox auth logger service created and started": "Proxmox authlogger-tjänst skapad och startade",
+  "Proxmox could not apply the container settings": "Proxmox kunde inte tillämpa containerns inställningar",
   "Proxmox enterprise repo might be missing or inaccessible. Trying to switch to no-subscription...": "Proxmox företagsrepo kan saknas eller är otillgänglig. Försöker byta till ingen prenumeration...",
   "Proxmox filter configured": "Proxmox-filter konfigurerat",
   "Proxmox iSCSI Storage Status:": "Proxmox iSCSI-lagringsstatus:",
@@ -4993,6 +5033,7 @@
   "Rebuilding initramfs to apply nouveau blacklist before installation...": "Bygger om initramfs för att tillämpa nouveau blacklist före installation...",
   "Rebuilding the container and recovering it from its backup are tested on the same image; the first update to a newer image is still to be observed.": "Att bygga om behållaren och återställa den från dess säkerhetskopia testas på samma bild; den första uppdateringen av en nyare bild är fortfarande att observera.",
   "Recent": "Ny",
+  "Recent PBS tasks": "Senaste PBS-uppgifter",
   "Recent Samba Servers": "Senaste Samba-servrar",
   "Recent Samba server": "Senaste Samba-servern",
   "Recent logs:": "Senaste loggar:",
@@ -5052,6 +5093,7 @@
   "Recreation completed. Data kept.": "Recreation slutförd. Data hålls.",
   "Recreation prepared": "Rekreation förberedd",
   "Refresh APT index and verify repositories:": "Uppdatera APT-index och verifiera förråd:",
+  "Refresh the configured APT repositories and review the PBS package upgrade? Repository files will be preserved.": "Uppdatera de konfigurerade APT-paketförråden och granska PBS-paketuppgraderingen? Paketförrådens filer bevaras.",
   "Refresh token of the connector, from the Twingate admin console": "Uppdateringstoken för kontakten, från Twingate-administratörskonsolen",
   "Refresh your browser (Ctrl+Shift+R) to see changes": "Uppdatera din webbläsare (Ctrl+Skift+R) för att se ändringar",
   "Refresh your browser to see changes (server restart may be required)": "Uppdatera din webbläsare för att se ändringar (serverns omstart kan krävas)",
@@ -5141,6 +5183,8 @@
   "Remove saved credentials": "Ta bort sparade autentiseringsuppgifter",
   "Remove subscription banner": "Ta bort prenumerationsbanner",
   "Remove the application? Its container disks are deleted, and only a backup can bring them back.": "Vill du ta bort programmet? Dess containerdiskar raderas och endast en säkerhetskopia kan ta tillbaka dem.",
+  "Remove the lock left on a VM by an interrupted task": "Ta bort låset som en avbruten uppgift lämnat på en VM",
+  "Remove the lock left on a container by an interrupted task": "Ta bort låset som en avbruten uppgift lämnat på en container",
   "Remove the saved credentials for {registry}?\nRunning apps will keep working.": "Ta bort de sparade referenserna för {registry}?\nAppar som körs fortsätter att fungera.",
   "Remove the unprivileged flag from configuration:": "Ta bort den oprivilegierade flaggan från konfigurationen:",
   "Remove unused packages and their config": "Ta bort oanvända paket och deras konfiguration",
@@ -5210,7 +5254,7 @@
   "Replace": "Ersätta",
   "Replace <container-id> with the actual ID.": "Ersätt <container-id> med det faktiska ID:t.",
   "Replace <container-id> with your actual container ID": "Ersätt <container-id> med ditt faktiska container-ID",
-  "Replace <storage-identifier> with the value from step 4": "Ersätt <lagringsidentifierare> med värdet från steg 4",
+  "Replace <storage-identifier> with the value from step 4": "Ersätt <storage-identifier> med värdet från steg 4",
   "Replace invalid port(s)": "Ersätt ogiltiga port(ar)",
   "Replace it?": "Byt ut den?",
   "Replace paths with your actual values from step 5": "Ersätt sökvägar med dina faktiska värden från steg 5",
@@ -5222,6 +5266,7 @@
   "Repository helper unavailable. NVIDIA installation stopped.": "Arkivhjälparen är inte tillgänglig. NVIDIA-installationen stoppades.",
   "Repository policy returned an unexpected result.": "Arkivpolicyn gav ett oväntat resultat.",
   "Repository ready.": "Förvaret klart.",
+  "Repository sources changed, but APT package-list refresh failed. Operation stopped; sources were not rolled back. Inspect Administration > Repositories and retry apt-get update before continuing.": "Lagringskällorna har ändrats, men uppdateringen av APT-paketlistan misslyckades. Drift stoppad;källor rullades inte tillbaka. Inspektera Administration > Repositories och försök apt-get update igen innan du fortsätter.",
   "Repository sources changed, but APT package-list refresh failed. Operation stopped; sources were not rolled back. Inspect Node > Updates > Repositories and retry apt-get update before continuing.": "Arkivkällorna har ändrats, men uppdateringen av APT-paketlistan misslyckades. Åtgärden stoppades; källorna återställdes inte. Kontrollera Node > Updates > Repositories och försök apt-get update igen innan du fortsätter.",
   "Repository switch declined; no APT source changed.": "Arkivbytet avvisades; ingen APT-källa har ändrats.",
   "Repository:": "Förvar:",
@@ -5316,7 +5361,9 @@
   "Reverting ZFS ARC tuning...": "Återställer ZFS ARC-inställning...",
   "Reverting pigz wrapper...": "Återställer pigz-omslag...",
   "Reverting vzdump speed tuning...": "Återställer vzdump-hastighetsinställning...",
+  "Review and apply": "Granska och tillämpa",
   "Review external OCI changes": "Granska externa OCI ändringar",
+  "Review package upgrade": "Granska paketuppgraderingen",
   "Review passthrough config files": "Granska passthrough-konfigurationsfiler",
   "Review what will be removed": "Granska vad som kommer att tas bort",
   "Rip DVD and Blu-ray media from a browser": "Rip DVD och Blu-ray media från en webbläsare",
@@ -5359,6 +5406,7 @@
   "Run the following inside the VM:": "Kör följande inuti den virtuella datorn:",
   "Run the release-channel switch from an SSH session or the Proxmox host console with:": "Kör release-kanalväxeln från en SSH-session eller Proxmox-värdkonsolen med:",
   "Run the update from an SSH session or the Proxmox host console with:": "Kör uppdateringen från en SSH-session eller Proxmox-värdkonsolen med:",
+  "Run this operation as root.": "Kör denna åtgärd som root.",
   "Run upgrade checklist script:": "Kör skript för uppgraderingschecklista:",
   "Running": "Spring",
   "Running Lynis security audit...": "Kör Lynis säkerhetsgranskning...",
@@ -5773,6 +5821,7 @@
   "ShareCoveX panel": "ShareCoveX panel",
   "Shared Directory Ready:": "Redo för delad katalog:",
   "Shared Group": "Delad grupp",
+  "Shared directories": "Delade kataloger",
   "Shared directory created:": "Delad katalog skapad:",
   "Shared directory for consume and export": "Delad katalog för konsumering och export",
   "Shared directory for copy/sync operations": "Delad katalog för kopia/synkronisera operations",
@@ -5802,6 +5851,7 @@
   "Should show pve-manager/9.x.x": "Bör visa pve-manager/9.x.x",
   "Shoutrrr addresses for the notifications (optional)": "Shoutrrr-adresser för aviseringarna (valfritt)",
   "Show All Scripts": "Visa alla skript",
+  "Show CT users and their UID/GID on the host": "CT-användare och deras UID/GID på värden",
   "Show CT users in table format": "Visa CT-användare i tabellformat",
   "Show Container Privilege Status": "Visa status för containerprivilegier",
   "Show DNS resolution status": "Visa DNS-upplösningsstatus",
@@ -5963,6 +6013,7 @@
   "Start the VM to begin Windows installation from the mounted ISO.": "Starta den virtuella datorn för att påbörja Windows-installationen från den monterade ISO.",
   "Start the applications once they are registered? Answer No if the original containers are still running on another host: both would use the same addresses.": "Starta applikationerna när de är registrerade? Svara Nej om de ursprungliga behållarna fortfarande körs på en annan värd: båda skulle använda samma adresser.",
   "Start the converted container:": "Starta den konverterade behållaren:",
+  "Start the interactive Proxmox package upgrade": "Starta den interaktiva paketuppgraderingen av Proxmox",
   "Start the main system upgrade:": "Starta huvudsystemuppgraderingen:",
   "Start the stack with Proxmox": "Börja stapeln med Proxmox",
   "Start uploading to PBS — sets a recovery passphrase": "Börja ladda upp till PBS — ställer in en återställningslösenfras",
@@ -6242,6 +6293,7 @@
   "The Paperless persistent volumes need at least 8 GB": "De papperslösa ihållande volymerna behöver minst 8 GB",
   "The PostgreSQL volume needs at least 4 GB": "PostgreSQL-volymen behöver minst 4 GB",
   "The PostgreSQL volume needs at least 8 GB": "PostgreSQL-volymen behöver minst 8 GB",
+  "The Proxmox VE 8 update did not finish. The upgrade to Proxmox VE 9 was not started.": "Uppdateringen av Proxmox VE 8 slutfördes inte. Uppgraderingen till Proxmox VE 9 startades inte.",
   "The Proxmox archive keyring is missing; Ceph installation cannot continue safely": "Proxmox arkivnyckelringen saknas;Ceph-installationen kan inte fortsätta på ett säkert sätt",
   "The Proxmox inventory and the local configurations differ": "Proxmox-inventeringen och de lokala konfigurationerna skiljer sig åt",
   "The ROCm image has no support for the AMD GPU of this host:": "ROCm-avbilden har inget stöd för AMD GPU på denna värd:",
@@ -6312,6 +6364,7 @@
   "The build could not be checked beforehand; continuing without that check.": "Bygget kunde inte kontrolleras i förväg;fortsätter utan den kontrollen.",
   "The cached image does not match the current digest": "Den cachade bilden matchar inte den nuvarande smältningen",
   "The cached image is damaged; it will be downloaded again.": "Den cachade bilden är skadad; den kommer att laddas ner igen.",
+  "The changes need the application installer": "Ändringarna kräver programmets installationsverktyg",
   "The character device does not exist:": "Karaktärenheten existerar inte:",
   "The command asks for a password that is not echoed. After creating the users, the web interface asks for a user name and a password.": "Kommandot begär ett lösenord som inte echoed. Efter att ha skapat användarna ber webbgränssnittet om ett användarnamn och ett lösenord.",
   "The command does not name an image": "Kommandot heter inte en bild",
@@ -6431,8 +6484,10 @@
   "The host bind source does not exist:": "Värdbindningskällan finns inte:",
   "The host bind source is not a regular file or directory:": "Värdbindningskällan är inte en vanlig fil eller katalog:",
   "The host directory changed before it was mounted": "Värdkatalogen ändrades innan den monterades",
+  "The host directory does not exist": "Katalogen på värden finns inte",
   "The host directory may not be accessible from an unprivileged container.": "Värdkatalogen kanske inte är tillgänglig från en oprivilegierad behållare.",
   "The host has no IPv4 address on the selected bridge": "Värden har ingen IPv4-adress på den valda bron",
+  "The host loses access to them. If the group includes a network or storage controller the host needs, cancel at the summary.": "Värden förlorar åtkomsten till dem. Om gruppen innehåller en nätverks- eller lagringskontroller som värden behöver, avbryt i sammanfattningen.",
   "The host monitor does not see the real host memory": "Värdskärmen ser inte det verkliga värdminnet",
   "The host monitor does not share this host namespace:": "Värdskärmen delar inte detta värdnamnsutrymme:",
   "The host monitor include is unknown or differs from the saved record": "Värdövervakarens include är okänd eller skiljer sig från den sparade posten",
@@ -6622,6 +6677,7 @@
   "The repair must preserve the image dependencies:": "Reparationen måste bevara bildberoenden:",
   "The requested VMID block is already in use": "Det begärda VMID-blocket används redan",
   "The requested machine learning GPU profile is not working; it is not replaced by CPU": "Den begärda maskininlärningen GPU-profilen fungerar inte; den ersätts inte av CPU.",
+  "The resource edit could not be fully rolled back. Open Manage again to review and import the current Proxmox settings.": "Det gick inte att helt återställa resursändringen. Öppna hanteringsmenyn igen för att granska och importera de aktuella Proxmox-inställningarna.",
   "The restored service did not pass its health check": "Den återställda tjänsten passerade inte hälsokontrollen",
   "The restored service stopped; the recovery is not confirmed": "Den återställda tjänsten stannade; återhämtningen bekräftas inte",
   "The reviewed Tandoor stack does not require a privileged LXC.": "Den granskade Tandoor stack inte require en privilegierad LXC.",
@@ -6667,6 +6723,7 @@
   "The selected VM": "Den valda virtuella datorn",
   "The selected VM is running.": "Den valda virtuella datorn körs.",
   "The selected base folder does not exist and could not be created:": "Den valda basmappen finns inte och kunde inte skapas:",
+  "The selected bridge does not exist": "Den valda bryggan finns inte",
   "The selected bridge has no IPv4 subnet for the host-monitor firewall": "Den valda bryggan har inget IPv4-undernät för värd-monitorns brandvägg",
   "The selected configuration needs to start the LXC during the installation": "Den valda konfigurationen måste starta LXC under installationen",
   "The selected container is unprivileged. A privileged container is required for direct device passthrough.": "Den valda behållaren är oprivilegierad. En privilegierad behållare krävs för direkt enhetsgenomföring.",
@@ -6689,6 +6746,7 @@
   "The service builds its own image; only a published image can be installed": "Tjänsten bygger sin egen bild; endast en publicerad bild kan installeras.",
   "The service declares no image:": "Tjänsten förklarar ingen bild:",
   "The setting has no final value:": "Inställningen har inget slutvärde:",
+  "The settings could not be fully rolled back. Review the container and its saved modification before continuing.": "Det gick inte att återställa alla inställningar. Kontrollera containern och den sparade ändringen innan du fortsätter.",
   "The share already exists in smb.conf:": "Delningen finns redan i smb.conf:",
   "The shared destination is not a directory": "Den delade destinationen är inte en katalog",
   "The shared directory points to a protected host path": "Den delade katalogen pekar på en skyddad värdväg",
@@ -6756,19 +6814,24 @@
   "These Proxmox resources were added outside ProxMenux:": "Dessa Proxmox-resurser lades till utanför ProxMenux:",
   "These VMIDs are not free:": "Dessa VMID är inte gratis:",
   "These are the changes that will be made": "Det är dessa ändringar som kommer att göras",
+  "These changes were made in Proxmox outside ProxMenux:": "Dessa ändringar gjordes i Proxmox utanför ProxMenux:",
   "These container mount paths have an extension-like suffix:": "De här monteringssökvägarna i containern har ett suffix som liknar ett filtillägg:",
   "These containers were restored from a backup and this host has no record of their OCI application:": "Dessa behållare återställdes från en säkerhetskopia och denna värd har ingen post för deras OCI-applikation:",
+  "These devices share the IOMMU group of the selected GPU and will be assigned to the VM with it:": "Dessa enheter delar IOMMU-gruppen med den valda GPU:n och tilldelas till VM:en tillsammans med den:",
   "These host backups run with this job and expect its storage:": "Dessa värdsäkerhetskopior körs med det här jobbet och förväntar sig dess lagring:",
   "These host backups run with this job and will stop running:": "Dessa värdsäkerhetskopior körs med detta jobb och kommer att sluta köras:",
   "These interface configurations will be removed": "Dessa gränssnittskonfigurationer kommer att tas bort",
   "These manual changes cannot be adopted safely:": "Dessa manuella ändringar kan inte användas på ett säkert sätt:",
   "These paths will not be restored live and will be extracted for manual recovery.": "Dessa sökvägar kommer inte att återställas live och kommer att extraheras för manuell återställning.",
+  "These settings require an application-specific adaptation. The image was not downloaded and the container was not recreated.": "Dessa inställningar kräver en anpassning för just det här programmet. Avbildningen hämtades inte och containern återskapades inte.",
   "These values are asked during the installation:": "Dessa värden tillfrågas under installationen:",
   "They are described in the image documentation:": "De beskrivs i bilddokumentationen:",
   "They will be added to oci-compose before continuing. Unsupported or changed resources are not imported.": "De kommer att läggas till oci-compose innan du fortsätter. Resurser som inte stöds eller ändras importeras inte.",
+  "They will be saved in oci-compose before continuing.": "De kommer att sparas i oci-compose innan du fortsätter.",
   "This CIFS share is mounted with restrictive permissions.": "Denna CIFS-andel är monterad med restriktiva behörigheter.",
   "This GPU is considered incompatible with GPU passthrough to a VM in ProxMenux.": "Denna GPU anses vara inkompatibel med GPU-genomföring till en virtuell dator i ProxMenux.",
   "This NFS share is fully restricted — even the host root cannot write to it.": "Denna NFS-resurs är helt begränsad — även värdroten kan inte skriva till den.",
+  "This Proxmox Backup Server has no active subscription, switch to the no-subscription repository? The inaccessible Enterprise PBS source will be disabled.": "Denna Proxmox Backup Server har ingen aktiv prenumeration, byta till arkivet utan prenumeration? Den otillgängliga Enterprise PBS-källan kommer att inaktiveras.",
   "This VM requires extra installation steps, see install guide at:\nhttps://github.com/community-scripts/ProxmoxVE/discussions/144": "Denna virtuella dator kräver extra installationssteg, se installationsguiden på:\nhttps://github.com/community-scripts/ProxmoxVE/discussions/144",
   "This account is for {registry}. Enter an image from that registry.": "Detta konto är för {registry}. Ange en bild från det registret.",
   "This action will:": "Denna åtgärd kommer att:",
@@ -6830,10 +6893,13 @@
   "This may take several minutes...": "Detta kan ta flera minuter...",
   "This means Proxmox handles mount lifecycle natively (no manual /etc/fstab needed for NFS/CIFS host storages).": "Detta innebär att Proxmox hanterar monteringslivscykeln naturligt (ingen manuell /etc/fstab behövs för NFS/CIFS-värdlagringar).",
   "This means the credentials are incorrect.": "Det betyder att inloggningsuppgifterna är felaktiga.",
+  "This menu requires Proxmox Backup Server.": "Denna meny kräver Proxmox Backup Server.",
   "This might indicate network connectivity issues.": "Detta kan tyda på problem med nätverksanslutning.",
   "This monitor uses a privileged LXC, shares processes and network with Proxmox and disables AppArmor in the CT. It uses the IP address and firewall of the host. A compromised image could affect the host; do not expose its web UI to the Internet.": "Denna bildskärm använder en privilegierad LXC, delar processer och nätverk med Proxmox och inaktiverar AppArmor i CT. Den använder IP-adressen och brandväggen i värden. En kompromissad bild kan påverka värden; exponera inte sitt webb-UI på Internet.",
   "This only removes the schedule. Existing backup archives are NOT deleted.": "Detta tar bara bort schemat. Befintliga säkerhetskopieringsarkiv raderas INTE.",
   "This operation may take several minutes and requires internet connectivity.": "Denna operation kan ta flera minuter och kräver internetanslutning.",
+  "This operation requires a Proxmox VE host. Use the PBS menu on Proxmox Backup Server.": "Denna åtgärd kräver en Proxmox VE-värd. Använd PBS-menyn på Proxmox Backup Server.",
+  "This operation supports PBS 3 on Debian 12 and PBS 4 on Debian 13.": "Denna åtgärd stöder PBS 3 på Debian 12 och PBS 4 på Debian 13.",
   "This package was installed by older versions of the ProxMenux Coral installer that placed the M.2 kernel driver on every system, including USB-only setups. It is not needed for Coral USB devices, which use libedgetpu1-std / libedgetpu1-max only.": "Det här paketet installerades av äldre versioner av ProxMenux Coral-installationsprogrammet som placerade M.2-kärndrivrutinen på alla system, inklusive inställningar för endast USB.Det behövs inte för Coral USB-enheter, som endast använder libedgetpu1-std / libedgetpu1-max.",
   "This passphrase is the ONLY way to access encrypted Borg backups.": "Denna lösenfras är det ENDA sättet att komma åt krypterade Borg-säkerhetskopior.",
   "This path is already used as a mount point in this container.": "Den här sökvägen används redan som monteringspunkt i den här behållaren.",
@@ -6849,6 +6915,7 @@
   "This script cannot be executed from the Proxmox web terminal.": "Detta skript kan inte köras från Proxmox webbterminal.",
   "This script must be run as root.": "Detta skript måste köras som root.",
   "This script must be run on a Proxmox host.": "Detta skript måste köras på en Proxmox-värd.",
+  "This script will apply the following optimizations and advanced adjustments to your Proxmox Backup Server": "Detta skript kommer att tillämpa följande optimeringar och avancerade justeringar på din Proxmox Backup Server",
   "This script will apply the following optimizations and advanced adjustments to your Proxmox VE server": "Detta skript kommer att tillämpa följande optimeringar och avancerade justeringar på din Proxmox VE-server",
   "This script will update your Proxmox VE system with advanced options:": "Detta skript kommer att uppdatera ditt Proxmox VE-system med avancerade alternativ:",
   "This session is running in the Monitor terminal. Running it from here would cut the connection mid-install and leave the switch in a broken state.": "Den här sessionen körs i Monitor-terminalen. Om du kör den härifrån bryts anslutningen mitt under installationen och läget förblir felaktigt.",
@@ -6935,7 +7002,7 @@
   "Transaction log:": "Transaktionslogg:",
   "Translation files:": "Översättningsfiler:",
   "Transmission is designed for easy, powerful use. Transmission has the features you want from a BitTorrent client: encryption, a web interface, peer exchange, magnet links, DHT, µTP, UPnP and NAT-PMP port forwarding, webseed support, watch directories, tracker editing, global and per-torrent speed limits, and more.": "Transmission är utformad för enkel, kraftfull användning. Transmission har de funktioner du vill ha från en BitTorrent-klient: kryptering, ett webbgränssnitt, peer-utbyte, magnetlänkar, DHT, μTP, UPnP och NAT-PMP-port vidarebefordran, webseed support, watch kataloger, tracker redigering, globala och per-torrent hastighet gränser, och mer.",
-  "Tried pvesm path and manual detection methods": "Testade pvesm-väg och manuella detekteringsmetoder",
+  "Tried pvesm path and manual detection methods": "Har provat pvesm path och metoder för manuell identifiering",
   "Trust this certificate and save it for scheduled backups?": "Lita på det här certifikatet och spara det för schemalagda säkerhetskopieringar?",
   "Try Again": "Försök igen",
   "Try a different search term.": "Prova en annan sökterm.",
@@ -6980,6 +7047,7 @@
   "Unable to identify the root filesystem. Aborting.": "Det går inte att identifiera rotfilsystemet. Avbryter.",
   "Unable to resolve system ZFS pool disks. Aborting.": "Det går inte att lösa system ZFS pooldiskar. Avbryter.",
   "Unable to resolve system disk topology. Aborting.": "Det gick inte att lösa systemdisktopologin. Avbryter.",
+  "Unapplied changes": "Ändringar som inte har tillämpats",
   "Understand the security implications of privileged containers": "Förstå säkerhetskonsekvenserna av privilegierade containrar",
   "Unexpected Proxmox inventory; recovery blocked": "Oväntad Proxmox inventering; återhämtning blockerad",
   "Unexpected formatting directory in the new Valkey volume": "Oväntad formateringskatalog i den nya Valkey-volymen",
@@ -7079,6 +7147,7 @@
   "Unsupported OCI-LXC AppArmor profile:": "Ostödd OCI-LXC AppArmor-profil:",
   "Unsupported OCI-LXC seccomp profile:": "Unsupported OCI-LXC seccomp profil:",
   "Unsupported Terminal": "Terminal som inte stöds",
+  "Unsupported architecture for Figurine:": "Arkitekturen stöds inte av Figurine:",
   "Unsupported architecture:": "Ostödd arkitektur:",
   "Unsupported backup compression": "Unsupported backup komprimering",
   "Unsupported credential pattern:": "Unsupported credential mönster:",
@@ -7094,6 +7163,7 @@
   "Unsupported mount type": "Unsupported Mount Typ",
   "Unsupported mount type:": "Unsupported Mount Typ:",
   "Unsupported native device type:": "Inbyggd enhetstyp som inte stöds:",
+  "Unsupported network settings": "Nätverksinställningarna stöds inte",
   "Unsupported operation": "Unsupported operation",
   "Unsupported or unknown Proxmox version; no repository changed.": "Ostödd eller okänd version av Proxmox; inget arkiv har ändrats.",
   "Unsupported output format:": "Utdataformat som inte stöds:",
@@ -7121,6 +7191,7 @@
   "Update NVIDIA in LXC Containers": "Uppdatera NVIDIA i LXC-behållare",
   "Update OCI": "Uppdatering OCI",
   "Update OCI stack": "Uppdatera OCI stack",
+  "Update PBS using configured repositories": "Uppdatera PBS med de konfigurerade paketförråden",
   "Update PVE enterprise repository (Only if using enterprise):": "Uppdatera Proxmox VE:s företagsarkiv (endast om du använder företagsabonnemang):",
   "Update Proxmox VE Appliance Manager": "Uppdatera Proxmox VE Appliance Manager",
   "Update Proxmox package lists": "Uppdatera Proxmox-paketlistor",
@@ -7173,6 +7244,7 @@
   "Upgrade assistant: Proxmox VE 8 → 9 (Trixie)": "Uppgraderingsassistent: Proxmox VE 8 → 9 (Ttrixie)",
   "Upgrade canceled by user": "Uppgraderingen avbröts av användaren",
   "Upgrade one node at a time": "Uppgradera en nod i taget",
+  "Upgrade the system, offering the": "Uppgradera systemet och erbjuder",
   "Upgrade to Proxmox VE 9": "Uppgradera till Proxmox VE 9",
   "Upgrading NVIDIA utils (Arch)...": "Uppgraderar NVIDIA utils (Arch)...",
   "Upload an encrypted copy of the key to PBS so you can recover it on a reinstalled host with just a passphrase?": "Ladda upp en krypterad kopia av nyckeln till PBS så att du kan återställa den på en ominstallerad värd med bara en lösenfras?",
@@ -7610,6 +7682,7 @@
   "active VF(s)": "aktiva VF(s)",
   "active VFs": "aktiva VF:er",
   "active Virtual Functions. Changing its driver binding would destroy every VF.": "aktiva virtuella funktioner. Att ändra dess drivrutinsbindning skulle förstöra varje VF.",
+  "added in Proxmox": "lagt till i Proxmox",
   "after copy; source tree is incomplete.": "efter kopia; källträdet är ofullständigt.",
   "after update.": "efter uppdatering.",
   "all guests": "alla gäster",
@@ -7954,8 +8027,8 @@
   "pvesm command not found. This should not happen on Proxmox.": "pvesm-kommandot hittades inte. Detta bör inte hända på Proxmox.",
   "pvesm not available.": "pvesm inte tillgänglig.",
   "pvesm not found.": "pvesm hittades inte.",
-  "pvesm path failed, trying manual detection...": "pvesm sökväg misslyckades, försöker manuell upptäckt...",
-  "pvesm status failed": "pvesm-status misslyckades",
+  "pvesm path failed, trying manual detection...": "pvesm path misslyckades, försöker identifiera manuellt...",
+  "pvesm status failed": "pvesm status misslyckades",
   "pyLoad is a Free and Open Source download manager written in Python and designed to be extremely lightweight, easily extensible and fully manageable via web.": "pyLoad är en gratis och öppen källkod nedladdningshanterare skriven i Python och utformad för att vara extremt lätt, lättföränderlig och fullt hanterbar via webben.",
   "pyLoad web interface": "PyLoad webbgränssnitt",
   "qBittorrent WebUI password (user: admin)": "qBittorrent WebUI lösenord (användare: admin)",
@@ -7977,6 +8050,7 @@
   "remapped users": "ommappade användare",
   "remove the (now-empty) directory if possible": "ta bort den (nu tomma) katalogen om möjligt",
   "removed from Proxmox": "borttagen från Proxmox",
+  "removed in Proxmox": "borttagen i Proxmox",
   "removed successfully from Proxmox.": "har tagits bort från Proxmox.",
   "requires running the official installer, which restarts the Monitor service.": "kräver att det officiella installationsprogrammet körs, vilket startar om Monitor-tjänsten.",
   "requires the package": "kräver paketet",
@@ -8033,7 +8107,7 @@
   "switch_gpu_mode.sh was not found.": "switch_gpu_mode.sh hittades inte.",
   "sysfs ROM dump failed — trying ACPI VFCT table...": "sysfs ROM-dump misslyckades — försöker ACPI VFCT-tabell...",
   "syslog-ng allows you to flexibly collect, parse, classify, rewrite and correlate logs from across your infrastructure and store or route them to log analysis tools.": "syslog-ng låter dig flexibelt samla in, analysera, klassificera, skriva och korrelera loggar från hela din infrastruktur och lagra eller dirigera dem för att logga analysverktyg.",
-  "systemctl restart networking failed:": "systemctl omstart av nätverk misslyckades:",
+  "systemctl restart networking failed:": "systemctl restart networking misslyckades:",
   "systemd OnCalendar expression": "systemd OnCalendar-uttryck",
   "the API key was not generated on the first start": "API-nyckeln genererades inte i första början",
   "the NVIDIA hook of the container is not available:": "NVIDIA-hooken för behållaren är inte tillgänglig:",
@@ -8080,6 +8154,7 @@
   "using": "använder",
   "using direct path (not guaranteed to survive reboots).": "använder direkt sökväg (inte garanterat att överleva omstarter).",
   "vCPUs:": "vCPU:er:",
+  "value changed in Proxmox": "värde ändrat i Proxmox",
   "vfio-pci IDs configured": "vfio-pci ID:n konfigurerade",
   "vfio-pci IDs in /etc/modprobe.d/vfio.conf": "vfio-pci ID i /etc/modprobe.d/vfio.conf",
   "video": "video",
@@ -8092,6 +8167,7 @@
   "was": "var",
   "was installed, but the kernel reports:": "installerades, men kärnan rapporterar:",
   "when finished": "När den är färdig",
+  "when the server has no subscription (you will be asked)": "när servern inte har något abonnemang (du kommer att bli tillfrågad)",
   "will rebind the GPU to vfio-pci on the next reboot, breaking the driver that is about to be installed.": "kommer att binda om GPU:n till vfio-pci vid nästa omstart, vilket bryter drivrutinen som är på väg att installeras.",
   "wipefs failed on": "wipefs misslyckades",
   "with": "med",
diff --git a/oci/README.md b/oci/README.md
index bde5cfb3..a18414a4 100644
--- a/oci/README.md
+++ b/oci/README.md
@@ -142,7 +142,7 @@ An application made of several images is one entry of the catalog and one instal
 | Operation | What changes | What is kept |
 |---|---|---|
 | **Update** | The rootfs is replaced by the image the saved tag publishes today | Record, container disks, host directories, network and devices |
-| **Modify** | An editor opens with the current resources, network, paths and GPU; the container is rebuilt with the changes | The data of container disks and host directories |
+| **Modify** | Edit and confirm the configuration; supported native settings apply directly, while other changes use the existing recreation flow | Native edits keep the installed image and rootfs; both paths preserve persistent data |
 | **Recreate** (multi-container) | Every container is rebuilt from the image it was installed with | Data, network and devices |
 | **Watchdog** | Whether the application is started again when it stops on its own | Everything; only the choice is saved |
 | **Remove** | The LXC, or every container of the application, its disks and its record | Host directories, with their content |
@@ -159,6 +159,10 @@ Settings changed in Proxmox VE after the installation, such as memory, cores or
 
 A rolling tag is not an unattended update: the digest changes only through an explicit update.
 
+For standalone applications, CPU and RAM changes apply live. Supported network settings, environment overrides, directory mounts, additional managed volumes and native devices use a controlled stop/start when needed. Modify does not query the registry or download an image for these native edits, even if the cached archive has already been cleaned. Removing a managed mount detaches its disk without deleting its data; subsequent image updates park that unused disk and return it to the container. An optional retained backup does not force recreation.
+
+The native path checks the saved configuration and installation identity, keeps a private before/after journal, and restores the original settings if applying them or checking the restarted service fails. It refuses to overwrite concurrent edits. Changes that require installer adaptations, such as NVIDIA runtime changes, GPU permission/environment setup, file mounts, completion notes or a refreshed catalog template, use the existing validated recreation flow. The route is chosen before applying any settings, so one proposal is not partially applied by both paths. The recreation flow reuses a verified cached archive when it matches the resolved image; it downloads an image when a suitable archive is unavailable. Image changes and coordinated stack operations retain their separate update flow.
+
 ## From a Compose file or a docker run command to an oci-compose
 
 The converter reads a Compose file with one service. A `docker run` command and an image reference alone are first written as a Compose file and follow the same path, so the three produce the same kind of oci-compose.
diff --git a/oci/remote/install_oci.sh b/oci/remote/install_oci.sh
index 7d1d8e85..b3b100e6 100755
--- a/oci/remote/install_oci.sh
+++ b/oci/remote/install_oci.sh
@@ -359,13 +359,18 @@ cleanup_canonical_inputs() {
 # A derived check accepts any HTTP answer below 500: the application is up,
 # even when its first page is a redirect or asks for a login.
 healthcheck_probe() {
+  local code status=0
   if [[ ${HC_ANY_STATUS:-false} == true ]]; then
-    local code
-    code=$(curl "${CURL_ARGS[@]}" "$HC_URL" 2>/dev/null) || return 1
-    [[ $code =~ ^[1-4][0-9][0-9]$ ]]
+    code=$(curl "${CURL_ARGS[@]}" "$HC_URL" 2>/dev/null) || status=$?
+    (( status == 0 )) && [[ $code =~ ^[1-4][0-9][0-9]$ ]] && return 0
   else
-    curl "${CURL_ARGS[@]}" "$HC_URL" 2>/dev/null
+    curl "${CURL_ARGS[@]}" "$HC_URL" >/dev/null 2>&1 || status=$?
+    (( status == 0 )) && return 0
   fi
+  # A port taken from the compose file may serve a database or SSH: an answer
+  # in another protocol (HTTP/0.9, weird or empty reply, reset) means it is up.
+  [[ ${HC_ACCEPT_NON_HTTP:-false} == true ]] \
+    && (( status == 1 || status == 8 || status == 52 || status == 56 ))
 }
 
 cleanup_failed_install() {
@@ -1025,15 +1030,18 @@ apply_extra_hosts() {
 }
 
 # Settings an update gives back to the rebuilt container before it starts:
-# the LAN leg of a suite or stack member and its start order.
+# the LAN leg of a suite or stack member, its start order and current tags.
 apply_kept_settings() {
   local key value
   while IFS=$'\t' read -r key value; do
     [[ -n $key ]] || continue
-    [[ $key == net1 || $key == startup ]] \
+    [[ $key == net1 || $key == startup || $key == tags ]] \
       || die "$(translate "Unsupported kept setting:") $key"
-    oci_quiet pct set "$VMID" "--$key" "$value" \
-      || die "$(translate "Could not restore the container setting:") $key"
+    if [[ $key == tags && -z $value ]]; then
+      oci_quiet pct set "$VMID" --delete tags
+    else
+      oci_quiet pct set "$VMID" "--$key" "$value"
+    fi || die "$(translate "Could not restore the container setting:") $key"
   done < <(jq -r '.kept_proxmox_settings // {} | to_entries[] | [.key, .value] | @tsv' "$DEPLOYMENT_FILE")
 }
 
@@ -1091,7 +1099,7 @@ ensure_runtime_home() {
   passwd_file="${rootfs}/etc/passwd"
   mount_ct_rootfs
   if ! home=$(python3 "$OCI_RUNTIME_RESOLVER" --home "$passwd_file" "$uid" 2>>"${OCI_LOG:-/dev/stderr}"); then
-    oci_quiet pct unmount "$VMID" || true
+    oci_quiet pct unmount "$VMID" || die "$(translate "Could not unmount the container filesystem")"
     return 0
   fi
   oci_quiet pct unmount "$VMID" || die "$(translate "Could not unmount the container filesystem")"
@@ -1230,6 +1238,17 @@ apply_installer_profile() {
       fi
       [[ -d ${rootfs}${target} ]] \
         || { oci_log "The volume to prepare does not exist: $target"; failed=1; break; }
+      # A reused volume may intentionally be mounted read-only (for example,
+      # /run/secrets). Do not remove files or change ownership/mode on it.
+      # Use the most specific containing mount: an RW child can override RO.
+      if [[ $(jq -r --arg target "$target" '
+        [.mounts[]? | select(.container_path as $path |
+          $target == $path or ($target | startswith($path + "/")))]
+        | sort_by(.container_path | length) | last | .read_only // false' \
+        "$DEPLOYMENT_FILE") == true ]]; then
+        oci_log "Skipping preparation of read-only volume: $target"
+        continue
+      fi
       if [[ $remove_lost_found == true ]]; then
         rm -rf "${rootfs}${target}/lost+found" || { failed=1; break; }
       fi
@@ -2253,6 +2272,7 @@ if [[ $START_AFTER == 1 && $HAS_STARTUP_HEALTHCHECK == 1 ]]; then
   [[ -n $IP ]] || die "$(translate "The healthcheck cannot run without an IP address")"
   HC_URL="${HC_SCHEME}://${IP}:${HC_PORT}${HC_PATH}"
   HC_ANY_STATUS=$(jq -r '.accept_any_status // false' <<<"$STARTUP_HEALTHCHECK")
+  HC_ACCEPT_NON_HTTP=$(jq -r '.accept_non_http // false' <<<"$STARTUP_HEALTHCHECK")
   if [[ $HC_ANY_STATUS == true ]]; then
     CURL_ARGS=(-sS --noproxy '*' -o /dev/null -w '%{http_code}' --max-time "$HC_REQUEST_TIMEOUT")
   else
diff --git a/oci/remote/oci_carried_record.py b/oci/remote/oci_carried_record.py
index 725640dd..14375ef5 100644
--- a/oci/remote/oci_carried_record.py
+++ b/oci/remote/oci_carried_record.py
@@ -38,6 +38,8 @@ DIRECTORY = '.proxmenux'
 NAME = 'oci-record.json'
 KIND = 'proxmenux.oci-carried-record'
 STAMP = 'carried.sha256'
+CONFIG_CACHE = 'carried-config.json'
+LOCAL_CONFIGS = Path('/etc/pve/lxc')
 LIMIT = 16 * 1024 * 1024
 STACK_CONTRACT = '/etc/pve/priv/proxmenux-stack-{}.json'
 NVIDIA_HOOK = re.compile(r'/usr/local/lib/proxmenux/oci/nvidia-mount-([a-f0-9]{64})\.sh')
@@ -279,6 +281,47 @@ def read_stamp(path):
     return value if isinstance(value, dict) else {}
 
 
+def configuration(root, vmid, verify=False):
+    """Reuse pct's formatted output only while its local source is unchanged.
+
+    Opening Manage checks every carried copy. Starting a fresh pct process
+    for each unchanged guest dominates that check. The private host cache is
+    keyed by the complete native configuration, including notes, pending
+    changes and snapshot sections. Lifecycle verification always calls pct.
+    An unavailable source, invalid cache or concurrent edit falls back to pct.
+    """
+    source = LOCAL_CONFIGS / f'{int(vmid)}.conf'
+    cache = instances.location(root, vmid).parent / CONFIG_CACHE
+
+    def fingerprint():
+        try:
+            return sha(source.read_bytes())
+        except OSError:
+            return None
+
+    before = fingerprint()
+    if before is not None and not verify:
+        try:
+            if not cache.is_symlink() and cache.stat().st_size <= LIMIT:
+                value = json.loads(cache.read_text())
+                if (isinstance(value, dict) and value.get('schema_version') == 1
+                        and value.get('source_sha256') == before
+                        and isinstance(value.get('config'), str) and value['config']
+                        and fingerprint() == before):
+                    return value['config']
+        except (OSError, ValueError):
+            pass
+    result = _run('pct', 'config', str(vmid))
+    if result.returncode != 0:
+        return None
+    # Do not associate output from one revision with another revision's hash.
+    if before is not None and fingerprint() == before:
+        with contextlib.suppress(OSError, ValueError):
+            instances.write(cache, {'schema_version': 1, 'source_sha256': before,
+                                    'config': result.stdout})
+    return result.stdout
+
+
 def superseded(record, existing, stamp):
     """Whether the container carries a copy this host did not write, with a
     record that differs from the one of this host. That is a container that
@@ -308,10 +351,10 @@ def carry(root, vmid, mount_stopped=True, verify=False, adopted=False):
     if record.get('status') != 'installed' or record.get('pending_transaction') \
             or record.get('pending_stack_transaction'):
         return 'skipped'
-    result = _run('pct', 'config', str(vmid))
-    if result.returncode != 0 or instances.identity(result.stdout.encode()) != record['installation_id']:
+    config = configuration(root, vmid, verify)
+    if config is None or instances.identity(config.encode()) != record['installation_id']:
         return 'skipped'
-    value = bundle(record, result.stdout)
+    value = bundle(record, config)
     expected = digest(value)
     record_path = instances.location(root, vmid)
     path = record_path.parent / STAMP
@@ -340,7 +383,7 @@ def carry(root, vmid, mount_stopped=True, verify=False, adopted=False):
             else:
                 value['saved_at'] = datetime.datetime.now(datetime.timezone.utc).isoformat()
                 value['generation'] = uuid.uuid4().hex
-                write_copy(rootfs, value, mapped_root(result.stdout))
+                write_copy(rootfs, value, mapped_root(config))
                 stamp = {'generation': value['generation']}
                 outcome = 'carried'
         if outcome == 'stale':
diff --git a/oci/remote/oci_instance_reconcile.py b/oci/remote/oci_instance_reconcile.py
index 07291125..cd8632a7 100644
--- a/oci/remote/oci_instance_reconcile.py
+++ b/oci/remote/oci_instance_reconcile.py
@@ -9,6 +9,7 @@ import oci_instances as instances
 import oci_gpu_devices as gpu_devices
 import oci_host_mounts as host_mounts
 import oci_instance_transaction as transaction
+import oci_native_modify as native_modify
 from oci_installation_state import parse_config, sha
 from oci_ui import translate
 
@@ -88,6 +89,43 @@ def _device(key, value):
     return device
 
 
+ENVIRONMENT_KEYS = ('env', 'lxc.environment.runtime')
+
+
+def _environment(record, config):
+    """Variables changed in Proxmox since the last operation. Values are
+    applied but never listed: they may be passwords."""
+    before = native_modify.environment(record['observed']['config'].encode())
+    now = native_modify.environment(config)
+    defaults = {item.split('=', 1)[0] for item in record['observed']['image'].get('defaults', {}).get('Env', [])
+                if '=' in item}
+    removed = sorted(before.keys() - now.keys())
+    # An image default comes back with a new container; its absence cannot be kept.
+    if any(name in defaults for name in removed):
+        raise ValueError(f"{translate('These manual changes cannot be adopted safely:')} env")
+    changed = sorted(name for name in now if before.get(name) != now[name])
+    return {name: now[name] for name in changed}, removed
+
+
+def _adopt_environment(deployment, values, removed):
+    items = deployment.setdefault('environment', [])
+    details = []
+    for name, value in values.items():
+        matches = [item for item in items if item['name'] == name]
+        if len(matches) > 1:
+            raise ValueError(translate('Duplicate variable in the contract; review it before editing'))
+        if matches:
+            matches[0]['value'] = value
+            details.append(f"env {name}: {translate('value changed in Proxmox')}")
+        else:
+            items.append({'name': name, 'value': value, 'sensitive': True})
+            details.append(f"env {name}: {translate('added in Proxmox')}")
+    for name in removed:
+        items[:] = [item for item in items if item['name'] != name]
+        details.append(f"env {name}: {translate('removed in Proxmox')}")
+    return details
+
+
 def propose(record, config):
     if (record.get('status') != 'installed' or record.get('stack') or record.get('stack_member')
             or record.get('native_stack_intent') or record.get('deployment', {}).get('stack_managed')):
@@ -101,16 +139,20 @@ def propose(record, config):
     # was checked above, so a presentation-only change needs no adoption.
     if 'description' in changed:
         changed.remove('description')
+    environment = None
+    if any(key in ENVIRONMENT_KEYS for key in changed):
+        changed = [key for key in changed if key not in ENVIRONMENT_KEYS]
+        environment = _environment(record, config)
     new_keys = [key for key in changed if key not in before and re.fullmatch(r'(mp|dev)[0-9]+', key)]
     unsupported = [key for key in changed if key not in new_keys and key not in transaction.ADOPTABLE
                    and key not in transaction.KEPT_AS_IS]
     if unsupported:
         raise ValueError(f"{translate('These manual changes cannot be adopted safely:')} {', '.join(unsupported)}")
-    if not new_keys:
+    if not new_keys and environment is None:
         return None
     candidate = copy.deepcopy(record)
     deployment = candidate['deployment']
-    details = []
+    details = _adopt_environment(deployment, *environment) if environment else []
     for key in new_keys:
         if key.startswith('mp'):
             mount = _mount(key, current[key], record['vmid'])
@@ -122,8 +164,13 @@ def propose(record, config):
             deployment.setdefault('devices', []).append(device)
             kind = 'GPU' if gpu_devices.gpu_path(device['host_path']) else 'USB/Coral/NPU'
             details.append(f"{key}: {device['host_path']} ({kind})")
+    skipped = [*new_keys, *(ENVIRONMENT_KEYS if environment else ())]
     filtered = b'\n'.join(line for line in config.splitlines()
-                          if not any(line.startswith(key.encode() + b': ') for key in new_keys)) + b'\n'
+                          if not any(line.startswith(key.encode() + b': ') for key in skipped))
+    if environment:
+        filtered += b''.join(b'\n' + line for line in record['observed']['config'].encode().splitlines()
+                             if any(line.startswith(key.encode() + b': ') for key in ENVIRONMENT_KEYS))
+    filtered += b'\n'
     for key, value in transaction.external_changes(record, filtered).items():
         section, name = transaction.ADOPTABLE[key]
         target = deployment.setdefault(section, {}) if section else deployment
diff --git a/oci/remote/oci_instance_transaction.py b/oci/remote/oci_instance_transaction.py
index 59579967..cc36b0d0 100644
--- a/oci/remote/oci_instance_transaction.py
+++ b/oci/remote/oci_instance_transaction.py
@@ -320,6 +320,36 @@ def mounts(config):
     return result
 
 
+def unused_volumes(config):
+    return {key: value for key, value in parse_config(config).items()
+            if re.fullmatch(r'unused[0-9]+', key)}
+
+
+def move_retained_unused(state, to_stage):
+    """Unused disks are not in vzdump. Park and return them separately, using
+    PVE's volume reassignment API, never --delete (which frees an unused disk).
+    The journal's keys and both ownership markers also make retries safe."""
+    keys = set(state.get('retained_unused', {}))
+    if not keys:
+        return
+    vmid, stage = state['vmid'], state['stage']
+    guest_marker = state['record']['installation_id']
+    holder_marker = 'proxmenux-transaction=' + state['id']
+    source, target = (vmid, stage) if to_stage else (stage, vmid)
+    source_marker, target_marker = ((guest_marker, holder_marker) if to_stage
+                                    else (holder_marker, guest_marker))
+    for key in sorted(keys):
+        present = unused_volumes(owned(source, source_marker))
+        destination = unused_volumes(owned(target, target_marker))
+        if key not in present:
+            if key in destination:
+                continue  # Already reassigned before an interruption.
+            raise ValueError(translate('There are extra disks or bind mounts outside the journal; the rootfs is not replaced'))
+        if key in destination or (to_stage and present.keys() - keys):
+            raise ValueError(translate('There are extra disks or bind mounts outside the journal; the rootfs is not replaced'))
+        run('pct', 'move-volume', str(source), key, '--target-vmid', str(target), '--target-volume', key)
+
+
 def is_file_bind(mount, files=()):
     return mount['type'] == 'host-bind' and (mount['source'] in files or Path(mount['source']).is_file())
 
@@ -352,6 +382,22 @@ def profile_keys(deployment):
     return keys
 
 
+GUESSED_ENDPOINT = 'compose-first-tcp-port-fallback'
+# curl exit codes for a port that accepted the connection and answered in a
+# protocol other than HTTP: HTTP/0.9 refused, weird reply, empty reply, reset.
+NON_HTTP_ANSWER = (1, 8, 52, 56)
+
+
+def probe_http(args):
+    """Run one curl probe and return its output and exit code."""
+    log('$ ' + shlex.join(str(arg) for arg in args))
+    try:
+        result = subprocess.run(args, capture_output=True, timeout=60, close_fds=True)
+    except subprocess.TimeoutExpired:
+        return b'', -1
+    return result.stdout, result.returncode
+
+
 def effective_healthcheck(template):
     """The template's own health check or, when it has none, one derived from
     its web address: any HTTP answer below 500 means the application is up."""
@@ -367,9 +413,14 @@ def effective_healthcheck(template):
         path = str(endpoint.get('path') or '/')
         if (endpoint.get('scheme') in ('http', 'https') and str(endpoint.get('port', '')).isdigit()
                 and path.startswith('/') and not any(c.isspace() for c in path)):
-            return {'scheme': endpoint['scheme'], 'port': int(endpoint['port']), 'path': path,
-                    'timeout_seconds': 300, 'request_timeout_seconds': 10, 'stability_seconds': 4,
-                    'verify_tls': False, 'accept_any_status': True}
+            check = {'scheme': endpoint['scheme'], 'port': int(endpoint['port']), 'path': path,
+                     'timeout_seconds': 300, 'request_timeout_seconds': 10, 'stability_seconds': 4,
+                     'verify_tls': False, 'accept_any_status': True}
+            # A port taken from the compose file because the recipe names no
+            # web address may serve a database or SSH: any answer counts.
+            if endpoint.get('source') == GUESSED_ENDPOINT:
+                check['accept_non_http'] = True
+            return check
     # Without a web address, the new image must at least keep the container running.
     return {'type': 'running', 'timeout_seconds': 90, 'stability_seconds': 20}
 
@@ -415,10 +466,9 @@ def candidate_contract(record, operation, proposal=None):
     return with_default_healthcheck(result)
 
 
-# Resource settings edited in Proxmox that the new container keeps.
 # Proxmox settings the rebuilt container gets back exactly as they are: the
-# LAN leg ProxMenux adds to a suite or stack member, and the start order.
-KEPT_AS_IS = ('net1', 'startup')
+# LAN leg ProxMenux adds to a suite or stack member, the start order and tags.
+KEPT_AS_IS = ('net1', 'startup', 'tags')
 ADOPTABLE = {'memory': ('resources', 'memory_mb'), 'swap': ('resources', 'swap_mb'),
              'cores': ('resources', 'cores'), 'cpulimit': ('resources', 'cores'),
              'cpuunits': ('resources', 'cpu_units'), 'onboot': (None, 'onboot')}
@@ -453,7 +503,7 @@ def external_changes(record, config, adopt=True):
     return values
 
 
-def preflight(record, candidate, config, coordinated=None):
+def preflight(record, candidate, config, coordinated=None, in_place=False, baseline=True):
     deployment = record['deployment']
     desired = candidate['deployment']
     if coordinated and (record.get('native_stack_intent') or deployment.get('rootfs_adaptation_replay_required')):
@@ -462,7 +512,7 @@ def preflight(record, candidate, config, coordinated=None):
         raise ValueError(translate('Stack members are updated together with their stack'))
     if instances.identity(config) != record['installation_id']:
         raise ValueError(translate('The container identity changed; the container is not replaced'))
-    for key, value in external_changes(record, config, adopt=not coordinated).items():
+    for key, value in (external_changes(record, config, adopt=not coordinated) if baseline else {}).items():
         section, name = ADOPTABLE[key]
         recorded = deployment.get(section, {}) if section else deployment
         target = desired.setdefault(section, {}) if section else desired
@@ -491,7 +541,17 @@ def preflight(record, candidate, config, coordinated=None):
         runtime_keys.add('lxc.mount.entry')
     runtime_settings.check(config, deployment, record['vmid'])
     coordinated_keys = {'hookscript', *KEPT_AS_IS} if coordinated else set(KEPT_AS_IS)
-    if '[' in config.decode() or keys - BASIC - runtime_keys - coordinated_keys - {k for k in keys if re.fullmatch(r'(mp|dev)[0-9]+', k)}:
+    preserved_keys = {'nameserver', 'searchdomain', 'timezone', 'protection'} if in_place else set()
+    detached = unused_volumes(config)
+    if baseline and detached != unused_volumes(record['observed'].get('config', '').encode()):
+        raise ValueError(translate('The container disks do not match the saved record'))
+    used_volumes = {value.split(',', 1)[0] for key, value in cfg.items()
+                    if key == 'rootfs' or re.fullmatch(r'mp[0-9]+', key)}
+    if (len(set(detached.values())) != len(detached)
+            or any(not re.fullmatch(r'[A-Za-z0-9_.-]+:[^\s,]+', value) or value in used_volumes
+                   for value in detached.values())):
+        raise ValueError(translate('The container disks do not match the saved record'))
+    if '[' in config.decode() or keys - BASIC - runtime_keys - coordinated_keys - preserved_keys - {k for k in keys if re.fullmatch(r'(mp|dev|unused)[0-9]+', k)}:
         raise ValueError(translate('The container has advanced Proxmox settings outside the supported profile'))
     unprivileged = deployment.get('security', {}).get('unprivileged', True) is not False
     if (desired.get('security', {}).get('unprivileged', True) is not False) != unprivileged \
@@ -511,9 +571,10 @@ def preflight(record, candidate, config, coordinated=None):
             target = host_mounts.valid_path(mount['container_path'])
             if mount['type'] == 'host-bind' and mount['source'] in declared and mount.get('read_only'):
                 continue
-            if (any(target == p or target.startswith(p.rstrip('/') + '/')
-                           or p.startswith(target.rstrip('/') + '/') for p in paths)):
-                raise ValueError(translate('Mount paths must not overlap'))
+            other = next((p for p in paths if target == p or target.startswith(p.rstrip('/') + '/')
+                          or p.startswith(target.rstrip('/') + '/')), None)
+            if other:
+                raise ValueError(f"{translate('Mount paths must not overlap')}: {target} - {other}")
             if mount['type'] == 'managed-volume':
                 if mount.get('backup') is not True or not isinstance(mount.get('size_gb'), int) or mount['size_gb'] < 1:
                     raise ValueError(translate('Managed disks must have backup enabled and a valid size'))
@@ -532,7 +593,8 @@ def preflight(record, candidate, config, coordinated=None):
         raise ValueError(translate('Changing the rootfs or its storage requires a separate migration'))
     actual = mounts(config)
     gpu_devices.check(config, deployment)
-    gpu_devices.verify_baseline(record['observed'].get('gpu_devices', {}), deployment)
+    if baseline:
+        gpu_devices.verify_baseline(record['observed'].get('gpu_devices', {}), deployment)
     recorded_files = {m['source']: bool(m.get('read_only')) for m in deployment.get('mounts', []) if is_file_bind(m, files)}
     if files != recorded_files:
         raise ValueError(translate('A container mount has a source, backup or permission different from the saved record'))
@@ -547,7 +609,9 @@ def preflight(record, candidate, config, coordinated=None):
                 or mount.get('ro', '0') != ('1' if old[target].get('read_only') else '0')):
             raise ValueError(translate('A container mount has a source, backup or permission different from the saved record'))
     for target in old.keys() & new.keys():
-        if any(old[target].get(k) != new[target].get(k) for k in ('type', 'source', 'size_gb')):
+        directory_bind = old[target]['type'] == new[target]['type'] == 'host-bind'
+        fixed = ('type', 'size_gb') if directory_bind else ('type', 'source', 'size_gb')
+        if any(old[target].get(k) != new[target].get(k) for k in fixed):
             raise ValueError(translate('Changing the storage or size of a disk requires a migration; empty disks are not created'))
     protected = ('/bin', '/sbin', '/etc', '/usr', '/lib', '/lib64', '/proc', '/sys', '/dev', '/run')
     for target in new.keys() - old.keys():
@@ -734,11 +798,10 @@ def healthcheck(vmid, template):
                 args += ['-w', '%{http_code}']
             if not check.get('verify_tls', False):
                 args.append('-k')
-            try:
-                answer = run(*args, f'{scheme}://{ip}:{port}{path}')
-                ok = not any_status or re.fullmatch(rb'[1-4][0-9][0-9]', answer.strip()) is not None
-            except RuntimeError:
-                pass
+            answer, status = probe_http([*args, f'{scheme}://{ip}:{port}{path}'])
+            ok = status == 0 and (not any_status or re.fullmatch(rb'[1-4][0-9][0-9]', answer.strip()) is not None)
+            if not ok and check.get('accept_non_http') and status in NON_HTTP_ANSWER:
+                ok = True
         if ok:
             stable_since = stable_since or time.monotonic()
             if time.monotonic() - stable_since >= stability:
@@ -1041,6 +1104,7 @@ def apply(root, vmid, archive, operation, proposal=None, registry_digest=None, i
                                   for p, m in actual.items() if p in required and not m['volume'].startswith('/')])
     state = {'schema_version': 1, 'id': directory.name, 'vmid': vmid, 'operation': operation,
              'record': record, 'candidate_contract': candidate, 'before_config': before.decode(),
+             'retained_unused': unused_volumes(before),
              'original_description': description,
              'archive': str(archive), 'archive_sha256': filehash(archive),
              'registry_digest': registry_digest or image['manifest_digest'],
@@ -1051,6 +1115,9 @@ def apply(root, vmid, archive, operation, proposal=None, registry_digest=None, i
              'original_gpu_devices': original_gpu, 'desired_gpu_devices': desired_gpu,
              'was_running': run('pct', 'status', str(vmid)).strip() == b'status: running'}
     state['kept_config'] = {key: cfg[key] for key in KEPT_AS_IS if key in cfg}
+    # The installer adds default tags. Preserve an explicit absence too, so
+    # deleting all tags in Proxmox does not bring them back on the next update.
+    state['kept_config']['tags'] = cfg.get('tags', '')
     if not coordinated and state['kept_config']:
         # Applied by the installer before the new container starts, so the
         # application has its LAN leg from the first second.
@@ -1058,9 +1125,10 @@ def apply(root, vmid, archive, operation, proposal=None, registry_digest=None, i
     if coordinated:
         state['coordinated'] = coordinated
         state['preserved_stack_config'] = {key: cfg[key] for key in ('net1', 'startup', 'hookscript') if key in cfg}
+        state['preserved_stack_config']['tags'] = cfg.get('tags', '')
         if operation == 'update':
             state['preserved_stack_config'].update({key: cfg[key] for key in
-                ('net0', 'features', 'cmode', 'console', 'tty', 'cpuunits', 'tags') if key in cfg})
+                ('net0', 'features', 'cmode', 'console', 'tty', 'cpuunits') if key in cfg})
     checkpoint(journal, state, 'prepared')
     pending = copy.deepcopy(record)
     pending.update(status='updating', pending_transaction=str(journal), transaction_id=state['id'])
@@ -1114,6 +1182,7 @@ def apply(root, vmid, archive, operation, proposal=None, registry_digest=None, i
         else:
             owned(stage, 'proxmenux-transaction=' + state['id'])
             run('pct', 'move-volume', str(vmid), mount['key'], '--target-vmid', str(stage), '--target-volume', mount['key'])
+    move_retained_unused(state, to_stage=True)
     checkpoint(journal, state, 'data-parked')
     if show:
         msg_ok(translate('Data volumes protected'))
@@ -1123,8 +1192,8 @@ def apply(root, vmid, archive, operation, proposal=None, registry_digest=None, i
         msg_info(translate('Installing the new image...') if update else translate('Recreating the container...'))
     current = owned(vmid, record['installation_id'])
     expected = b''.join(line for line in before.splitlines(keepends=True)
-                        if not re.match(rb'mp[0-9]+: ', line))
-    if mounts(current) or current != expected:
+                        if not re.match(rb'(mp|unused)[0-9]+: ', line))
+    if mounts(current) or unused_volumes(current) or current != expected:
         raise ValueError(translate('A concurrent change was detected; the container is not removed'))
     host_mounts.verify_sources(original_sources)
     gpu_devices.verify(original_gpu)
@@ -1139,9 +1208,13 @@ def apply(root, vmid, archive, operation, proposal=None, registry_digest=None, i
     install_candidate(root, journal, state, progress)
     restore_description(vmid, state)
     restore_firewall(vmid, state)
+    move_retained_unused(state, to_stage=False)
     if coordinated:
         for key, value in state['preserved_stack_config'].items():
-            run('pct', 'set', str(vmid), '--' + key, value)
+            if key == 'tags' and not value:
+                run('pct', 'set', str(vmid), '--delete', 'tags')
+            else:
+                run('pct', 'set', str(vmid), '--' + key, value)
         check_runtime_mounts(run('pct', 'config', str(vmid)), candidate['deployment'])
         gpu_devices.check(run('pct', 'config', str(vmid)), candidate['deployment'])
         state['staged_config_sha256'] = sha(owned(vmid, record['installation_id']))
@@ -1273,6 +1346,9 @@ def complete_recovery(root, journal, state):
 
 def recover(root, journal):
     state = json.loads(journal.read_text())
+    if state.get('kind') == 'native-modify':
+        import oci_native_modify
+        return oci_native_modify.recover(root, journal)
     vmid = state['vmid']
     show = not state.get('coordinated')
     if show:
@@ -1335,8 +1411,9 @@ def recover(root, journal):
         stop(vmid)
         current = owned(vmid, record['installation_id'])
         gpu_devices.check_recovery_entries(current, state)
-        if any(re.fullmatch(r'unused[0-9]+', k) for k in parse_config(current)):
+        if unused_volumes(current).keys() - state.get('retained_unused', {}).keys():
             raise ValueError(translate('There are extra disks or bind mounts outside the journal; the rootfs is not replaced'))
+        move_retained_unused(state, to_stage=True)
         known_binds = {(m['source'], m['container_path'])
                        for plan in (state['record']['deployment'], state['candidate_contract']['deployment'])
                        for m in plan.get('mounts', []) if m['type'] == 'host-bind'}
@@ -1364,6 +1441,7 @@ def recover(root, journal):
     host_mounts.verify_sources(state.get('original_host_sources', {}))
     run('pct', 'restore', str(vmid), backup, '--force', '1', '--storage',
         state['record']['deployment']['rootfs']['storage'])
+    move_retained_unused(state, to_stage=False)
     state['restore_config_sha256'] = sha(owned(vmid, state['record']['installation_id']))
     checkpoint(journal, state, 'checking-recovery')
     if show:
diff --git a/oci/remote/oci_instances.py b/oci/remote/oci_instances.py
index f039b956..0f4d19ce 100644
--- a/oci/remote/oci_instances.py
+++ b/oci/remote/oci_instances.py
@@ -230,8 +230,9 @@ def identity(config):
     return match.group(1) if match else None
 
 
-def same_config_except_notes(record, config):
-    """Accept a presentation-only note edit, never a changed OCI identity or LXC setting."""
+def same_config_except_notes(record, config, ignore_tags=False):
+    """Accept a presentation-only note edit, never a changed OCI identity or LXC setting.
+    With `ignore_tags`, Proxmox tags may differ too: the operation keeps them as they are."""
     previous = record['observed']['config'].encode()
     expected = record['installation_id']
     if identity(previous) != expected or identity(config) != expected:
@@ -242,7 +243,8 @@ def same_config_except_notes(record, config):
         notes = [line for line in lines if line.startswith(b'description: ')]
         if len(notes) != 1:
             return None
-        return b''.join(line for line in lines if not line.startswith(b'description: '))
+        dropped = (b'description: ', b'tags: ') if ignore_tags else (b'description: ',)
+        return b''.join(line for line in lines if not line.startswith(dropped))
 
     original = without_notes(previous)
     return original is not None and original == without_notes(config)
diff --git a/oci/remote/oci_native_modify.py b/oci/remote/oci_native_modify.py
new file mode 100644
index 00000000..8cefa086
--- /dev/null
+++ b/oci/remote/oci_native_modify.py
@@ -0,0 +1,426 @@
+"""Edit an installed application's LXC configuration, retaining its rootfs/data.
+
+Runtime changes use a controlled stop/start, not pct destroy/create. Values,
+including secrets and NUL-separated environment, reach PVE over stdin only.
+"""
+import copy
+import hashlib
+import ipaddress
+import json
+from pathlib import Path
+import re
+import subprocess
+import uuid
+
+import oci_instances as instances
+import oci_instance_transaction as transaction
+import oci_resource_modify as resources
+import oci_gpu_devices as devices
+import oci_host_mounts as host_mounts
+from oci_installation_state import parse_config, sha
+from oci_ui import translate, msg_info, msg_ok, msg_warn
+
+PERL_UPDATE = r'''
+use strict; use warnings; use JSON::PP;
+use PVE::RPCEnvironment; use PVE::INotify; use PVE::API2::LXC::Config;
+PVE::RPCEnvironment->setup_default_cli_env();
+my $p = decode_json(do { local $/; <STDIN> });
+$p->{node} = PVE::INotify::nodename();
+PVE::API2::LXC::Config->update_vm($p);
+'''
+
+
+def environment(config):
+    result = {}
+    entries = []
+    for line in config.decode().splitlines():
+        if line.startswith('lxc.environment.runtime: '):
+            entries.append(line.split(': ', 1)[1])
+        elif line.startswith('env: '):
+            # pct config exposes PVE's public env property, whereas older
+            # observations and native files contain repeated runtime lines.
+            entries.extend(line.split(': ', 1)[1].split('\0'))
+    for entry in entries:
+        name, sep, value = entry.partition('=')
+        if not sep or name in result:
+            raise ValueError(translate('Duplicate variable in the contract; review it before editing'))
+        result[name] = value
+    return result
+
+
+def environment_values(items):
+    result = {}
+    for item in items:
+        name, value = item['name'], str(item['value'])
+        if (not re.fullmatch(r'[A-Za-z_][A-Za-z0-9_]*', name) or name in result
+                or any(ord(c) < 32 or ord(c) == 127 for c in value)):
+            raise ValueError(translate('The value contains an unsupported character'))
+        result[name] = value
+    return result
+
+
+def changes(record, candidate, config):
+    """Only unchanged recipes and native settings; adapters keep their installer."""
+    old = transaction.with_default_healthcheck(copy.deepcopy(record))
+    candidate = transaction.with_default_healthcheck(copy.deepcopy(candidate))
+    if (old['template'] != candidate['template'] or old['deployment'].get('host_monitor')
+            or any(k in record for k in ('stack', 'stack_member', 'native_stack_intent'))
+            or old['deployment'].get('stack_managed')):
+        return None
+    before, after = old['deployment'], candidate['deployment']
+    changed = {k for k in before.keys() | after.keys() if before.get(k) != after.get(k)}
+    allowed = {'resources', 'network', 'environment', 'devices', 'mounts', 'hardware_profile'}
+    if not changed or changed - allowed:
+        return None
+    resource_keys = {k for k in before.get('resources', {}).keys() | after.get('resources', {}).keys()
+                     if before.get('resources', {}).get(k) != after.get('resources', {}).get(k)}
+    if resource_keys - {'cores', 'memory_mb', 'swap_mb', 'cpu_units'}:
+        return None
+    if 'devices' in changed:
+        if any(d.get('kind', 'character-device') not in ('character-device', 'block-device')
+               or d.get('append_host_device_gid_to_environment')
+               for plan in (before, after) for d in plan.get('devices', [])):
+            return None
+        if before.get('device_permissions') or after.get('device_permissions'):
+            return None
+    if 'mounts' in changed:
+        if any(transaction.is_file_bind(m) for plan in (before, after) for m in plan.get('mounts', [])):
+            return None
+        if transaction.nested_mounts.without(config) != config:
+            # The installer also regenerates the recursive bind entries and
+            # hooks associated with these mounts.
+            return None
+        old_mounts = {m['container_path']: m for m in before.get('mounts', [])}
+        for mount in after.get('mounts', []):
+            original = old_mounts.get(mount['container_path'])
+            # Permission grants and installer-specific mount attributes need
+            # their normal installer, including when only their source changes.
+            if mount.get('grant_access'):
+                return None
+            if original:
+                fields = {k for k in original.keys() | mount.keys() if original.get(k) != mount.get(k)}
+                native_fields = {'read_only', 'backup', 'create_if_missing'}
+                if original['type'] == mount['type'] == 'host-bind':
+                    native_fields.add('source')
+                if fields - native_fields:
+                    return None
+    return changed
+
+
+def plan(record, candidate, config):
+    changed = changes(record, candidate, config)
+    if not changed:
+        return None
+    transaction.preflight(record, candidate, config, in_place=True)
+    old, new = record['deployment'], candidate['deployment']
+    cfg = parse_config(config)
+    values, delete = {}, []
+    if 'resources' in changed:
+        for key, native, minimum in (('cores', 'cpulimit' if 'cpulimit' in cfg and 'cores' not in cfg else 'cores', 1),
+                                     ('memory_mb', 'memory', 128), ('swap_mb', 'swap', 0), ('cpu_units', 'cpuunits', 1)):
+            value = new['resources'].get(key)
+            if old['resources'].get(key) == value:
+                continue
+            if value is None and key == 'cpu_units':
+                if native in cfg: delete.append(native)
+            elif isinstance(value, bool) or not isinstance(value, int) or value < minimum:
+                raise ValueError(translate('Invalid resource value'))
+            else:
+                values[native] = str(value)
+    if 'network' in changed:
+        network = new['network']
+        if set(network) - {'bridge', 'ipv4', 'gateway', 'firewall', 'host_managed', 'mac_address'}:
+            raise ValueError(translate('Unsupported network settings'))
+        if not re.fullmatch(r'[A-Za-z0-9_.:-]+', network['bridge']):
+            raise ValueError(translate('Invalid bridge'))
+        if not Path('/sys/class/net', network['bridge'], 'bridge').is_dir():
+            raise ValueError(translate('The selected bridge does not exist'))
+        address = network['ipv4']
+        if address not in ('dhcp', 'manual'):
+            if ipaddress.ip_interface(address).version != 4:
+                raise ValueError(translate('Invalid IPv4 address'))
+        gateway = network.get('gateway')
+        if gateway and ipaddress.ip_address(gateway).version != 4:
+            raise ValueError(translate('Invalid IPv4 gateway'))
+        fields = dict(p.split('=', 1) for p in cfg['net0'].split(',') if '=' in p)
+        fields.update(bridge=network['bridge'], ip=address)
+        if gateway: fields['gw'] = gateway
+        else: fields.pop('gw', None)
+        for key, native in (('firewall', 'firewall'), ('host_managed', 'host-managed')):
+            if old['network'].get(key) != network.get(key):
+                fields[native] = '1' if network.get(key) else '0'
+        if old['network'].get('mac_address') != network.get('mac_address'):
+            raise ValueError(translate('The MAC address of the container cannot be kept'))
+        values['net0'] = ','.join(k+'='+v for k, v in fields.items())
+    if 'environment' in changed:
+        env = environment(config)
+        previous = environment_values(old.get('environment', []))
+        wanted = environment_values(new.get('environment', []))
+        defaults = dict(item.split('=', 1) for item in record['observed']['image'].get('defaults', {}).get('Env', []) if '=' in item)
+        for name in previous.keys() - wanted.keys():
+            if name in defaults: env[name] = defaults[name]
+            else: env.pop(name, None)
+        env.update(wanted)
+        if env: values['env'] = '\0'.join(k+'='+v for k, v in env.items())
+        else: delete.append('env')
+    if 'devices' in changed:
+        inventory = devices.planned(new)
+        existing = {v['path']: k for k, v in ((k, dict(p.split('=', 1) for p in v.split(',')))
+                   for k, v in cfg.items() if re.fullmatch(r'dev[0-9]+', k))}
+        used = set(existing.values())
+        for path, key in existing.items():
+            if path not in inventory: delete.append(key)
+        for device in new.get('devices', []):
+            path = device['host_path']
+            key = existing.get(path)
+            if not key:
+                key = next('dev'+str(n) for n in range(256) if 'dev'+str(n) not in used)
+                used.add(key)
+            info = inventory[path]
+            mode = info['mode'] if device.get('mode') == 'preserve-host' else int(device.get('mode', '0660'), 8)
+            values[key] = (f"path={path},mode={mode:04o},uid={int(device.get('uid', 0))},"
+                           f"gid={info['gid'] if device['gid_strategy'] == 'host-device-gid' else 0},"
+                           f"deny-write={1 if device.get('deny_write') else 0}")
+    if 'mounts' in changed:
+        actual = transaction.mounts(config)
+        used = {m['key'] for m in actual.values()}
+        wanted = {m['container_path']: m for m in new.get('mounts', [])}
+        for target, mount in actual.items():
+            if target not in wanted: delete.append(mount['key'])
+        for target, mount in wanted.items():
+            if target in actual:
+                original = next(m for m in old['mounts'] if m['container_path'] == target)
+                if mount == original: continue
+                fields = dict(p.split('=', 1) for p in actual[target]['value'].split(',')[1:] if '=' in p)
+                source = actual[target]['volume']
+                if mount['type'] == 'host-bind':
+                    source = host_mounts.valid_path(mount['source'])
+                    if not Path(source).is_dir() and not mount.get('create_if_missing'):
+                        raise ValueError(translate('The host directory does not exist'))
+                fields.update(mp=target, backup='1' if mount['backup'] else '0',
+                              ro='1' if mount.get('read_only') else '0')
+                values[actual[target]['key']] = source+','+','.join(k+'='+v for k, v in fields.items())
+                continue
+            key = next('mp'+str(n) for n in range(256) if 'mp'+str(n) not in used)
+            used.add(key)
+            source = mount['source']
+            if mount['type'] == 'managed-volume':
+                if not re.fullmatch(r'[A-Za-z0-9_-]+', source):
+                    raise ValueError(translate('Invalid storage'))
+                source += ':'+str(mount['size_gb'])
+            else:
+                source = host_mounts.valid_path(source)
+                if not Path(source).is_dir():
+                    if not mount.get('create_if_missing'):
+                        raise ValueError(translate('The host directory does not exist'))
+            values[key] = (f"{source},mp={target},backup={1 if mount['backup'] else 0},"
+                           f"ro={1 if mount.get('read_only') else 0}")
+    return {'values': values, 'delete': delete, 'restart': bool(changed - {'resources'}),
+            'changed': sorted(changed)}
+
+
+def verify_values(config, operation):
+    """PVE may canonicalize property strings; compare their actual fields."""
+    cfg = parse_config(config)
+    for key, value in operation['values'].items():
+        if key == 'env':
+            if environment(config) != dict(item.split('=', 1) for item in value.split('\0')):
+                raise ValueError(translate('Proxmox could not apply the container settings'))
+        elif re.fullmatch(r'(mp|dev|net)[0-9]+', key):
+            if re.fullmatch(r'mp[0-9]+', key):
+                source = value.split(',', 1)[0]
+                actual_source = cfg.get(key, '').split(',', 1)[0]
+                allocating = re.fullmatch(r'[A-Za-z0-9_-]+:[0-9]+', source)
+                if (not allocating and actual_source != source) or (allocating and not actual_source.startswith(source.split(':')[0]+':')):
+                    raise ValueError(translate('Proxmox could not apply the container settings'))
+            desired = dict(p.split('=', 1) for p in value.split(',') if '=' in p)
+            actual = dict(p.split('=', 1) for p in cfg.get(key, '').split(',') if '=' in p)
+            defaults = {'uid': '0', 'gid': '0', 'deny-write': '0', 'ro': '0', 'backup': '0', 'mode': '0660', 'firewall': '0'}
+            def matches(k, v):
+                observed = actual.get(k, defaults.get(k))
+                if k == 'mode': return observed is not None and int(observed, 8) == int(v, 8)
+                return observed == v
+            if any(not matches(k, v) for k, v in desired.items()):
+                raise ValueError(translate('Proxmox could not apply the container settings'))
+        elif cfg.get(key) != value:
+            raise ValueError(translate('Proxmox could not apply the container settings'))
+    if any(key in cfg or (key == 'env' and environment(config)) for key in operation['delete']):
+        raise ValueError(translate('Proxmox could not apply the container settings'))
+
+
+def set_config(vmid, installation_id, expected, values, delete=()):
+    raw = (resources.CONFIG_DIR / f'{vmid}.conf').read_bytes()
+    if instances.command('pct', 'config', str(vmid)) != expected or instances.identity(expected) != installation_id:
+        raise ValueError(translate('The instance changed while it was being edited; open Modify again'))
+    payload = dict(values, vmid=vmid, digest=hashlib.sha1(raw).hexdigest())
+    if delete: payload['delete'] = ','.join(delete)
+    transaction.log('Applying native settings: '+', '.join(sorted(set(values) | set(delete))))
+    process = subprocess.run(['perl', '-e', PERL_UPDATE], input=json.dumps(payload).encode(),
+                             capture_output=True, timeout=120)
+    # API errors may include secret values. Only keep the exit status.
+    if process.returncode:
+        raise RuntimeError(translate('Proxmox could not apply the container settings'))
+
+
+def untouched(before, after, keys):
+    keys = set(keys)
+    if 'env' in keys: keys.add('lxc.environment.runtime')
+    def keep(config):
+        return b''.join(line for line in config.splitlines(keepends=True)
+                        if line.split(b':', 1)[0].decode() not in keys
+                        and not re.match(rb'unused[0-9]+:', line))
+    return keep(before) == keep(after)
+
+
+def restore_settings(root, record, before, now, operation):
+    vmid = record['vmid']
+    keys = set(operation['values']) | set(operation['delete'])
+    if operation['restart']: transaction.stop(vmid)
+    original = parse_config(before)
+    restore = {k: original[k] for k in keys if k in original and k != 'env'}
+    remove = [k for k in keys if k not in original and k != 'env' and k in parse_config(now)]
+    if 'env' in keys:
+        env = environment(before)
+        if env: restore['env'] = '\0'.join(k+'='+v for k, v in env.items())
+        elif environment(now): remove.append('env')
+    if restore or remove:
+        set_config(vmid, record['installation_id'], now, restore, remove)
+    restored_config = instances.command('pct', 'config', str(vmid))
+    verify_values(restored_config, {'values': restore, 'delete': remove})
+    if not untouched(before, restored_config, keys):
+        raise ValueError(translate('The instance changed while it was being edited; open Modify again'))
+    restored = copy.deepcopy(record)
+    obs = record['observed']
+    restored['observed'] = instances.observe(vmid, record['installation_id'],
+        obs['archive_path'], obs['resolved_registry_digest'], obs['image'])
+    if restored['observed']['config_sha256'] != sha(restored_config):
+        raise ValueError(translate('The instance changed while it was being edited; open Modify again'))
+    return restored
+
+
+def recover(root, journal):
+    """Recover through the normal Manage interrupted-operation menu."""
+    state = json.loads(journal.read_text())
+    record, operation = state['record'], state['operation_plan']
+    vmid = record['vmid']
+    current = instances.read(root, vmid)
+    if (state['kind'] != 'native-modify' or state['phase'] in ('committed', 'rolled-back')
+            or current.get('pending_transaction') != str(journal)
+            or current.get('transaction_id') != state['id']
+            or current['installation_id'] != record['installation_id']):
+        raise ValueError(translate('The record does not belong to this operation'))
+    before = state['config'].encode()
+    now = instances.command('pct', 'config', str(vmid))
+    keys = set(operation['values']) | set(operation['delete'])
+    if instances.identity(now) != record['installation_id'] or not untouched(before, now, keys):
+        raise ValueError(translate('The instance changed while it was being edited; open Modify again'))
+    if state.get('after_config'):
+        if now not in (before, state['after_config'].encode()):
+            raise ValueError(translate('The instance changed while it was being edited; open Modify again'))
+    elif now != before:
+        # A crash during the PVE API call is recoverable only when the full
+        # planned edit is present. Refuse unknown partial/concurrent changes.
+        verify_values(now, operation)
+    host_mounts.verify_sources(state.get('original_host_sources', {}))
+    tx_record = restore_settings(root, record, before, now, operation) if now != before else copy.deepcopy(record)
+    if state['was_running']:
+        if transaction.run('pct', 'status', str(vmid)).strip() != b'status: running':
+            transaction.run('pct', 'start', str(vmid))
+        transaction.healthcheck(vmid, record['template'])
+    instances.write(instances.location(root, vmid), tx_record)
+    state['phase'] = 'rolled-back'
+    instances.write(journal, state)
+    msg_ok(translate('Previous installation restored'))
+
+
+def apply(root, record, candidate, config, acknowledge_external_data=False):
+    operation = plan(record, candidate, config)
+    if not operation:
+        raise ValueError(translate('The changes need the application installer'))
+    original_sources, desired_sources = transaction.freeze_host_sources(
+        record, candidate, acknowledge_external_data)
+    vmid = record['vmid']
+    folder = instances.location(root, vmid).parent / 'modifications' / uuid.uuid4().hex
+    running = transaction.run('pct', 'status', str(vmid)).strip() == b'status: running'
+    journal = {'kind': 'native-modify', 'id': folder.name, 'vmid': vmid, 'operation': 'recreate',
+               'record': record, 'config': config.decode(), 'operation_plan': operation,
+               'phase': 'prepared', 'was_running': running, 'original_host_sources': original_sources}
+    instances.write(folder / 'before.json', journal)
+    transaction.open_log(folder)
+    transaction._run['journal'] = folder / 'before.json'
+    pending = copy.deepcopy(record)
+    pending.update(status='updating', transaction_id=folder.name, pending_transaction=str(folder / 'before.json'))
+    instances.write(instances.location(root, vmid), pending)
+    updated_config = None
+    changed = False
+    try:
+        if operation['restart'] and running:
+            transaction.stop(vmid)
+        # Do not accept a concurrent edit merely because the service stopped.
+        if instances.command('pct', 'config', str(vmid)) != config:
+            raise ValueError(translate('The instance changed while it was being edited; open Modify again'))
+        host_mounts.verify_sources(desired_sources)
+        for mount in candidate['deployment'].get('mounts', []):
+            if mount['type'] == 'host-bind' and mount.get('create_if_missing'):
+                Path(mount['source']).mkdir(parents=True, exist_ok=True)
+        host_mounts.verify_sources(original_sources)
+        # Capture newly-created directories before installing their mounts.
+        pinned = {p: host_mounts.validate_source(p) for p in desired_sources}
+        for path, previous in desired_sources.items():
+            if previous['exists'] and not host_mounts.same_source(previous, pinned[path]):
+                raise ValueError(translate('A shared source does not match its recorded identity'))
+        host_mounts.verify_sources(pinned)
+        msg_info(translate('Applying container settings without rebuilding the container...'))
+        if operation['values'] or operation['delete']:
+            changed = True  # API updates may partially succeed before an error.
+            set_config(vmid, record['installation_id'], config, operation['values'], operation['delete'])
+        updated_config = instances.command('pct', 'config', str(vmid))
+        verify_values(updated_config, operation)
+        keys = set(operation['values']) | set(operation['delete'])
+        if not untouched(config, updated_config, keys):
+            raise ValueError(translate('The instance changed while it was being edited; open Modify again'))
+        transaction.preflight(candidate, candidate, updated_config, in_place=True, baseline=False)
+        journal.update(phase='configured', after_config=updated_config.decode())
+        instances.write(folder / 'before.json', journal)
+        if operation['restart'] and running:
+            transaction.run('pct', 'start', str(vmid))
+            transaction.healthcheck(vmid, candidate['template'])
+        observed = record['observed']
+        fresh = instances.observe(vmid, record['installation_id'], observed['archive_path'],
+                                  observed['resolved_registry_digest'], observed['image'])
+        host_mounts.verify_observation(pinned, fresh)
+        if fresh['config_sha256'] != sha(updated_config):
+            raise ValueError(translate('The instance changed while it was being edited; open Modify again'))
+        result = copy.deepcopy(record)
+        result.update(deployment=copy.deepcopy(candidate['deployment']), observed=fresh)
+        instances.write(instances.location(root, vmid), result)
+        journal['phase'] = 'committed'
+        instances.write(folder / 'before.json', journal)
+    except BaseException:
+        try:
+            now = instances.command('pct', 'config', str(vmid))
+            keys = set(operation['values']) | set(operation['delete'])
+            if changed:
+                if not untouched(config, now, keys) or (updated_config is not None and now != updated_config):
+                    raise ValueError('Concurrent edit; rollback refused')
+                restored = restore_settings(root, record, config, now, operation)
+            else:
+                restored = copy.deepcopy(record)
+            if operation['restart'] and running:
+                if transaction.run('pct', 'status', str(vmid)).strip() != b'status: running':
+                    transaction.run('pct', 'start', str(vmid))
+                transaction.healthcheck(vmid, record['template'])
+            instances.write(instances.location(root, vmid), restored)
+            journal['phase'] = 'rolled-back'
+            instances.write(folder / 'before.json', journal)
+        except Exception as error:
+            transaction.log('native rollback failed: '+type(error).__name__)
+            msg_warn(translate('The settings could not be fully rolled back. Review the container and its saved modification before continuing.'))
+        raise
+    try:
+        import oci_carried_record
+        oci_carried_record.carry(root, vmid, mount_stopped=False)
+    except (OSError, ValueError, RuntimeError):
+        transaction.log('carried record will be refreshed on the next management entry')
+    msg_ok(translate('Changes applied. Data kept.'))
+    return folder
diff --git a/oci/remote/oci_resource_modify.py b/oci/remote/oci_resource_modify.py
new file mode 100644
index 00000000..9d4083cf
--- /dev/null
+++ b/oci/remote/oci_resource_modify.py
@@ -0,0 +1,118 @@
+"""Apply CPU/RAM-only proposals to the existing guest, without an image archive."""
+import copy
+import hashlib
+from pathlib import Path
+import uuid
+
+import oci_instances as instances
+import oci_instance_transaction as transaction
+from oci_installation_state import parse_config, sha
+from oci_ui import translate, msg_info, msg_ok, msg_warn
+
+CONFIG_DIR = Path('/etc/pve/lxc')
+
+
+def changes(record, candidate, config):
+    """Return a narrow native edit, or None when the normal installer is needed."""
+    if (any(key in record for key in ('stack', 'stack_member', 'native_stack_intent'))
+            or record['deployment'].get('stack_managed')
+            or instances.identity(config) != record['installation_id']):
+        return None
+    previous = transaction.with_default_healthcheck(copy.deepcopy(record))
+    candidate = transaction.with_default_healthcheck(copy.deepcopy(candidate))
+    old, new = previous['deployment'], candidate['deployment']
+    if previous['template'] != candidate['template'] or old.get('host_monitor'):
+        return None
+    if {k: v for k, v in old.items() if k != 'resources'} != {
+            k: v for k, v in new.items() if k != 'resources'}:
+        return None
+    original, desired = old.get('resources', {}), new.get('resources', {})
+    changed = {key for key in original.keys() | desired.keys() if original.get(key) != desired.get(key)}
+    if not changed or changed - {'cores', 'memory_mb'}:
+        return None
+    cfg = parse_config(config)
+    cpu = 'cpulimit' if 'cpulimit' in cfg and 'cores' not in cfg else 'cores'
+    parameters = {}
+    for key in sorted(changed):
+        value = desired.get(key)
+        if isinstance(value, bool) or not isinstance(value, int) or value < (128 if key == 'memory_mb' else 1):
+            return None
+        native = 'memory' if key == 'memory_mb' else cpu
+        if native not in cfg:
+            return None
+        parameters[native] = str(value)
+    return parameters
+
+
+def guarded_set(vmid, installation_id, expected, parameters):
+    # pct uses this SHA1 under its own configuration lock. Sample the native
+    # file before checking pct's view, so a concurrent edit cannot be accepted
+    # accidentally by taking a fresh digest after validation.
+    native = (CONFIG_DIR / f'{vmid}.conf').read_bytes()
+    current = instances.command('pct', 'config', str(vmid))
+    if current != expected or instances.identity(current) != installation_id:
+        raise ValueError(translate('The instance changed while it was being edited; open Modify again'))
+    command = ['pct', 'set', str(vmid), '--digest', hashlib.sha1(native).hexdigest()]
+    for key, value in sorted(parameters.items()):
+        command += ['--' + key, value]
+    transaction.run(*command)
+
+
+def expected_config(before, after, parameters):
+    def unrelated(config):
+        return b''.join(line for line in config.splitlines(keepends=True)
+                        if line.split(b':', 1)[0].decode() not in parameters)
+    new = parse_config(after)
+    return unrelated(before) == unrelated(after) and all(new.get(key) == value for key, value in parameters.items())
+
+
+def apply(root, record, candidate, config, parameters):
+    """The caller holds the instance lock and has checked image identity/preflight."""
+    if changes(record, candidate, config) != parameters:
+        raise ValueError(translate('The instance changed while it was being edited; open Modify again'))
+    if transaction.external_changes(record, config):
+        raise ValueError(translate('The instance changed while it was being edited; open Modify again'))
+    vmid = record['vmid']
+    directory = instances.location(root, vmid).parent / 'modifications' / uuid.uuid4().hex
+    instances.write(directory / 'before.json', {'record': record, 'config': config.decode()})
+    transaction.open_log(directory)
+    msg_info(translate('Applying CPU and RAM changes without rebuilding the container...'))
+    applied = False
+    after = None
+    try:
+        guarded_set(vmid, record['installation_id'], config, parameters)
+        applied = True
+        after = instances.command('pct', 'config', str(vmid))
+        if not expected_config(config, after, parameters):
+            raise ValueError(translate('The instance changed while it was being edited; open Modify again'))
+        observed = record['observed']
+        fresh = instances.observe(vmid, record['installation_id'], observed['archive_path'],
+                                  observed['resolved_registry_digest'], observed['image'])
+        if fresh['config_sha256'] != sha(after):
+            raise ValueError(translate('The instance changed while it was being edited; open Modify again'))
+        updated = copy.deepcopy(record)
+        updated.update(deployment=copy.deepcopy(candidate['deployment']), observed=fresh)
+        instances.write(instances.location(root, vmid), updated)
+    except Exception:
+        if applied:
+            try:
+                current = instances.command('pct', 'config', str(vmid))
+                if not expected_config(config, current, parameters):
+                    raise ValueError('Concurrent configuration change; resource rollback refused')
+                previous = parse_config(config)
+                guarded_set(vmid, record['installation_id'], current,
+                            {key: previous[key] for key in parameters})
+                instances.write(instances.location(root, vmid), record)
+            except Exception as error:
+                transaction.log(f'resource rollback: {type(error).__name__}')
+                msg_warn(translate('The resource edit could not be fully rolled back. Open Manage again to review and import the current Proxmox settings.'))
+        raise
+    # Updating the carried record is best effort here, as it is after other
+    # management operations. The normal menu also refreshes it on return.
+    try:
+        import oci_carried_record
+        oci_carried_record.carry(root, vmid, mount_stopped=False)
+    except (OSError, ValueError, RuntimeError):
+        transaction.log('carried record will be refreshed on the next management entry')
+    msg_ok(translate('Changes applied. Data kept.'))
+    return directory
diff --git a/oci/remote/oci_runtime.py b/oci/remote/oci_runtime.py
index ee3b9d56..3d842fd3 100644
--- a/oci/remote/oci_runtime.py
+++ b/oci/remote/oci_runtime.py
@@ -4,7 +4,9 @@
 from __future__ import annotations
 
 import json
+import os
 import shlex
+import stat
 import sys
 import tarfile
 from pathlib import Path
@@ -90,14 +92,39 @@ def effective_entrypoint(
 
 
 def home_directory(passwd_path: Path, uid: int) -> str | None:
-    """Return the safe home directory recorded for a container UID."""
-    for line in passwd_path.read_text(encoding="utf-8").splitlines():
+    """Read a regular image passwd file; only an absent UID defaults to /."""
+    if uid < 0:
+        return None
+    # The caller supplies <mounted rootfs>/etc/passwd. Pin etc so an image
+    # symlink or a rename during lookup cannot redirect the host-side read.
+    directory = os.open(passwd_path.parent, os.O_RDONLY | os.O_DIRECTORY | os.O_NOFOLLOW)
+    try:
+        if not stat.S_ISREG(os.stat(passwd_path.name, dir_fd=directory, follow_symlinks=False).st_mode):
+            return None
+        descriptor = os.open(
+            passwd_path.name, os.O_RDONLY | os.O_NOFOLLOW | os.O_NONBLOCK, dir_fd=directory,
+        )
+        try:
+            # Recheck the opened object, not its name; a FIFO replacement
+            # must neither block open() nor reach a read operation.
+            if not stat.S_ISREG(os.fstat(descriptor).st_mode):
+                return None
+            with os.fdopen(descriptor, encoding="utf-8", closefd=False) as stream:
+                content = stream.read()
+        finally:
+            os.close(descriptor)
+    finally:
+        os.close(directory)
+    for line in content.splitlines():
         fields = line.split(":")
-        if len(fields) < 7 or fields[2] != str(uid):
+        if len(fields) < 3 or fields[2] != str(uid):
             continue
+        if len(fields) != 7:
+            return None
         home = fields[5]
-        return home if home.startswith("/") else None
-    return None
+        safe = home.startswith("/") and not any(ord(char) < 32 or ord(char) == 127 for char in home)
+        return home if safe else None
+    return "/"
 
 
 def main() -> int:
diff --git a/oci/remote/oci_stack_native.py b/oci/remote/oci_stack_native.py
index b679ee74..2b564205 100644
--- a/oci/remote/oci_stack_native.py
+++ b/oci/remote/oci_stack_native.py
@@ -192,7 +192,7 @@ class NativeAdapter:
                 config = instances.command('pct', 'config', str(vmid))
                 if instances.identity(config) != record['installation_id']:
                     raise ValueError(translate('The identity of a member was replaced'))
-                if (not self.journal.exists() or not self.state().get('replacement_intent')) and not instances.same_config_except_notes(record, config):
+                if (not self.journal.exists() or not self.state().get('replacement_intent')) and not instances.same_config_except_notes(record, config, ignore_tags=True):
                     raise ValueError(translate('A member configuration changed during the preparation'))
             else:
                 if Path('/etc/pve/lxc/%s.conf' % vmid).exists():
diff --git a/oci/remote/oci_update_current.py b/oci/remote/oci_update_current.py
index bba91c04..f4f94038 100644
--- a/oci/remote/oci_update_current.py
+++ b/oci/remote/oci_update_current.py
@@ -8,6 +8,7 @@ import re
 import shlex
 import subprocess
 import sys
+import tarfile
 import tempfile
 
 import oci_instances as instances
@@ -56,7 +57,7 @@ def run_quiet(args, error, capture=False):
                 process.wait()
 
 
-def resolve_archive(desired, config, current=None, check=None, required_digest=None):
+def resolve_archive(desired, config, current=None, check=None, required_digest=None, local_archives=()):
     # Shared by individual and coordinated operations; no guest mutation here.
     # When the registry still serves the current digest nothing is downloaded.
     reference = desired['template']['container_contract']['image']['reference']
@@ -83,6 +84,27 @@ def resolve_archive(desired, config, current=None, check=None, required_digest=N
         return None, digest
     if check:
         check()
+    verifier = Path(__file__).with_name('verify_oci_archive.py')
+
+    def intact(path):
+        try:
+            run_quiet([sys.executable, str(verifier), str(path)],
+                      translate('The image did not pass the integrity check'))
+            return same_image(candidate, image_from_archive(str(path)))
+        except (RuntimeError, OSError, ValueError, KeyError, tarfile.TarError):
+            return False
+
+    # Initial installations and updates use different archive names. The
+    # instance record knows the actual archive; validate it before looking
+    # only for the deterministic update-cache name. Never delete a rejected
+    # recorded path: another instance may still refer to it.
+    for saved in local_archives:
+        path = Path(saved) if saved else None
+        if path and not path.is_symlink() and path.is_file():
+            msg_info(translate('Verifying the image integrity...'))
+            if intact(path):
+                msg_ok(translate('Using the verified image from the cache'))
+                return path, digest
     storage = desired['deployment']['template_storage']
     if not re.fullmatch(r'[A-Za-z0-9_-]+', storage):
         raise ValueError(translate('Invalid template storage'))
@@ -91,16 +113,6 @@ def resolve_archive(desired, config, current=None, check=None, required_digest=N
     archive.parent.mkdir(parents=True, exist_ok=True)
     if archive.is_symlink():
         raise ValueError(translate('Unsafe OCI archive path'))
-    verifier = Path(__file__).with_name('verify_oci_archive.py')
-
-    def intact(path):
-        try:
-            run_quiet([sys.executable, str(verifier), str(path)],
-                      translate('The image did not pass the integrity check'))
-        except RuntimeError:
-            return False
-        return same_image(candidate, image_from_archive(str(path)))
-
     if archive.exists():
         msg_info(translate('Verifying the image integrity...'))
         if intact(archive):
@@ -168,6 +180,16 @@ def application_name(record, vmid):
     return f'CT {vmid}'
 
 
+def backup_native_settings(vmid, storage):
+    """An optional retained backup does not require rebuilding the guest."""
+    if storage:
+        import oci_keep_backup
+        oci_keep_backup.validate(storage)
+        transaction.run('vzdump', str(vmid), '--storage', storage, '--mode', 'snapshot',
+                        '--compress', 'zstd', '--notes-template',
+                        'ProxMenux OCI: before modifying container settings')
+
+
 def update(vmid, acknowledge_external_data=False, proposal=None, keep_backup=None):
     operation = 'recreate' if proposal is not None else 'update'
     msg_info(translate('Checking the container before the update...') if operation == 'update'
@@ -179,11 +201,42 @@ def update(vmid, acknowledge_external_data=False, proposal=None, keep_backup=Non
         config = instances.command('pct', 'config', str(vmid))
         desired = transaction.candidate_contract(record, operation, proposal)
         changes = transaction.external_changes(record, config)
+        resource_changes = None
+        if operation == 'recreate' and not changes:
+            import oci_resource_modify
+            resource_changes = oci_resource_modify.changes(record, desired, config)
+        # CPU/RAM edits retain the installed image and all unrelated native
+        # settings. They do not implicitly update the application or depend
+        # on the registry and the narrower recreation profile.
+        if resource_changes:
+            msg_ok(translate('Container checked'))
+            import oci_operation_notice
+            with oci_operation_notice.operation([vmid], 'modify', application_name(record, vmid)):
+                backup_native_settings(vmid, keep_backup)
+                return oci_resource_modify.apply(instances.ROOT, record, desired, config, resource_changes)
+        if operation == 'recreate' and not changes:
+            import oci_native_modify
+            if oci_native_modify.changes(record, desired, config):
+                import oci_operation_notice
+                with oci_operation_notice.operation([vmid], 'modify', application_name(record, vmid)):
+                    # Validate the native plan before an optional full backup.
+                    oci_native_modify.plan(record, desired, config)
+                    backup_native_settings(vmid, keep_backup)
+                    return oci_native_modify.apply(instances.ROOT, record, desired, config,
+                                                   acknowledge_external_data=acknowledge_external_data)
+        # An unsupported native edit still uses the existing installer. Decide
+        # the route before changing anything; actual validation/API failures
+        # must not silently switch to a destructive fallback.
         transaction.preflight(record, desired, config)
         msg_ok(translate('Container checked'))
         current = record['observed']['image'] if operation == 'update' else None
-        archive, digest = resolve_archive(desired, config, current, lambda: work_backup.locate(
-            instances.location(instances.ROOT, vmid).parent / 'transactions' / 'check', [vmid], record, vmid))
+        check = lambda: work_backup.locate(
+            instances.location(instances.ROOT, vmid).parent / 'transactions' / 'check', [vmid], record, vmid)
+        if operation == 'recreate':
+            archive, digest = resolve_archive(desired, config, current, check,
+                local_archives=[record['observed'].get('archive_path')])
+        else:
+            archive, digest = resolve_archive(desired, config, current, check)
         if archive is None:
             msg_ok(translate('The image is already up to date; nothing was changed.'))
             return
@@ -207,6 +260,9 @@ def update(vmid, acknowledge_external_data=False, proposal=None, keep_backup=Non
             transaction.apply(instances.ROOT, vmid, archive, operation, proposal=proposal,
                               registry_digest=digest, acknowledge_external_data=acknowledge_external_data,
                               keep_backup=file_storage)
+    marker = os.environ.get('OCI_RECREATED_MARKER')
+    if marker:
+        Path(marker).touch()
 
 
 def main():
diff --git a/oci/remote/oci_work_backup.py b/oci/remote/oci_work_backup.py
index b37a2c26..251ffe71 100644
--- a/oci/remote/oci_work_backup.py
+++ b/oci/remote/oci_work_backup.py
@@ -192,21 +192,25 @@ def application(root, vmid):
     return primary_id, members or [vmid]
 
 
-def status(root, vmid):
+def status(root, vmid, only_needed=False):
     """What the menu needs to know before an operation: whether the backup
     fits on the system disk, the storage chosen earlier and the ones that
-    have room."""
+    have room. The menu can skip unused alternatives once a destination fits;
+    the default retains the complete status used by the maintenance CLI."""
     primary_id, vmids = application(root, vmid)
     record = instances.read(root, primary_id)
     default = instances.location(root, primary_id).parent
     needed, free = required(vmids), available(default)
     saved = (record.get('deployment') or {}).get(KEY)
-    path = storage_path(saved) if saved else None
+    fits = free >= needed
+    path = storage_path(saved) if saved and not (only_needed and fits) else None
     saved_free = available(path) if path is not None and path.is_dir() else None
-    return {'needed': needed, 'free': free, 'fits': free >= needed, 'saved': saved,
-            'saved_fits': saved_free is not None and saved_free >= needed,
+    saved_fits = saved_free is not None and saved_free >= needed
+    candidates = [] if only_needed and (fits or saved_fits) else file_storages()
+    return {'needed': needed, 'free': free, 'fits': fits, 'saved': saved,
+            'saved_fits': saved_fits,
             'candidates': [{'storage': item['storage'], 'free': item['free']}
-                           for item in file_storages() if item['free'] >= needed]}
+                           for item in candidates if item['free'] >= needed]}
 
 
 def choose(root, vmid, storage):
diff --git a/oci/src/proxmenux_oci/cli.py b/oci/src/proxmenux_oci/cli.py
index 9266f283..14dda6e2 100644
--- a/oci/src/proxmenux_oci/cli.py
+++ b/oci/src/proxmenux_oci/cli.py
@@ -578,8 +578,6 @@ def interactive(catalog: Catalog) -> int:
                           f"{translate('All applications')} ({len(applications)})")
             elif selection == "manage":
                 from .management import interactive_management
-                console.show_logo()
-                console.msg_title(translate("Manage installed OCI applications"))
                 interactive_management(PROJECT_ROOT, ui)
             elif selection == "registries":
                 from .registry_accounts import open_registry_accounts
diff --git a/oci/src/proxmenux_oci/installer.py b/oci/src/proxmenux_oci/installer.py
index a10f92c5..f8e88d43 100644
--- a/oci/src/proxmenux_oci/installer.py
+++ b/oci/src/proxmenux_oci/installer.py
@@ -1588,7 +1588,7 @@ def _run_remote_install(
             shutil.copy2(project_root / 'remote' / 'haos_healthcheck.py', temporary / 'haos_healthcheck.py')
             shutil.copy2(project_root / 'remote' / 'oci_installation_state.py', temporary / 'oci_installation_state.py')
             shutil.copy2(project_root / 'remote' / 'oci_instances.py', temporary / 'oci_instances.py')
-            for helper in ('oci_ui.sh', 'oci_ui.py', 'oci_description.py', 'oci_console.py', 'oci_native_stack.py', 'oci_native_stack.sh', 'oci_instance_transaction.py', 'oci_host_mounts.py', 'oci_nested_mounts.py', 'oci_runtime_settings.py', 'oci_gpu_devices.py', 'oci_accelerators.py', 'oci_nvidia_runtime.py', 'oci_nvidia_refresh.py', 'oci_nvidia_dynamic.py', 'oci_update_current.py', 'oci_stack_replay.py', 'oci_stack_plan.py', 'oci_stack_transaction.py', 'oci_stack_native.py', 'oci_image_cache.py', 'nvidia_lxc_mount_lab.sh', 'oci_nvidia_setup.sh', 'oci_immich_ml.sh', 'oci_rocm_check.py'):
+            for helper in ('oci_ui.sh', 'oci_ui.py', 'oci_description.py', 'oci_console.py', 'oci_native_stack.py', 'oci_native_stack.sh', 'oci_instance_transaction.py', 'oci_host_mounts.py', 'oci_nested_mounts.py', 'oci_runtime_settings.py', 'oci_gpu_devices.py', 'oci_accelerators.py', 'oci_nvidia_runtime.py', 'oci_nvidia_refresh.py', 'oci_nvidia_dynamic.py', 'oci_update_current.py', 'oci_resource_modify.py', 'oci_native_modify.py', 'oci_stack_replay.py', 'oci_stack_plan.py', 'oci_stack_transaction.py', 'oci_stack_native.py', 'oci_image_cache.py', 'nvidia_lxc_mount_lab.sh', 'oci_nvidia_setup.sh', 'oci_immich_ml.sh', 'oci_rocm_check.py'):
                 shutil.copy2(project_root / 'remote' / helper, temporary / helper)
             if deployment_kind == 'generic-multi-lxc-stack':
                 shutil.copy2(project_root / 'remote' / 'install_generic_stack.py', temporary / 'install_generic_stack.py')
@@ -1625,7 +1625,7 @@ def _run_remote_install(
             archive.add(project_root / 'remote' / 'haos_healthcheck.py', arcname='haos_healthcheck.py')
             archive.add(project_root / 'remote' / 'oci_installation_state.py', arcname='oci_installation_state.py')
             archive.add(project_root / 'remote' / 'oci_instances.py', arcname='oci_instances.py')
-            for helper in ('oci_ui.sh', 'oci_ui.py', 'oci_description.py', 'oci_console.py', 'oci_native_stack.py', 'oci_native_stack.sh', 'oci_instance_transaction.py', 'oci_host_mounts.py', 'oci_nested_mounts.py', 'oci_runtime_settings.py', 'oci_gpu_devices.py', 'oci_accelerators.py', 'oci_nvidia_runtime.py', 'oci_nvidia_refresh.py', 'oci_nvidia_dynamic.py', 'oci_update_current.py', 'oci_stack_replay.py', 'oci_stack_plan.py', 'oci_stack_transaction.py', 'oci_stack_native.py', 'oci_image_cache.py', 'nvidia_lxc_mount_lab.sh', 'oci_nvidia_setup.sh', 'oci_immich_ml.sh', 'oci_rocm_check.py'):
+            for helper in ('oci_ui.sh', 'oci_ui.py', 'oci_description.py', 'oci_console.py', 'oci_native_stack.py', 'oci_native_stack.sh', 'oci_instance_transaction.py', 'oci_host_mounts.py', 'oci_nested_mounts.py', 'oci_runtime_settings.py', 'oci_gpu_devices.py', 'oci_accelerators.py', 'oci_nvidia_runtime.py', 'oci_nvidia_refresh.py', 'oci_nvidia_dynamic.py', 'oci_update_current.py', 'oci_resource_modify.py', 'oci_native_modify.py', 'oci_stack_replay.py', 'oci_stack_plan.py', 'oci_stack_transaction.py', 'oci_stack_native.py', 'oci_image_cache.py', 'nvidia_lxc_mount_lab.sh', 'oci_nvidia_setup.sh', 'oci_immich_ml.sh', 'oci_rocm_check.py'):
                 archive.add(project_root / 'remote' / helper, arcname=helper)
             if deployment_kind == 'generic-multi-lxc-stack':
                 archive.add(project_root / 'remote' / 'install_generic_stack.py', arcname='install_generic_stack.py')
diff --git a/oci/src/proxmenux_oci/management.py b/oci/src/proxmenux_oci/management.py
index cbf8e041..2744032d 100644
--- a/oci/src/proxmenux_oci/management.py
+++ b/oci/src/proxmenux_oci/management.py
@@ -106,13 +106,32 @@ def _config_hostname(vmid):
     return ''
 
 
+def _selected_configuration(vmid):
+    """Reuse pct's output only while its complete native source is unchanged.
+
+    The forced carried-record verification has just fetched a fresh config.
+    Older installations without that source-keyed cache still query pct.
+    The lifecycle backend independently validates again before any mutation.
+    """
+    import oci_instances as instances
+    try:
+        import oci_carried_record
+        reader = getattr(oci_carried_record, 'configuration', None)
+        config = reader(instances.ROOT, vmid) if reader else None
+        if isinstance(config, str) and config:
+            return config.encode()
+    except (ImportError, OSError, ValueError, RuntimeError, subprocess.SubprocessError):
+        pass
+    return instances.command('pct', 'config', str(vmid))
+
+
 def check_selected(project, row):
     """Validate only the chosen container; lifecycle backends validate its stack."""
     sys.path.insert(0, str(project / 'remote'))
     import oci_instances as instances
     with instances.locked(instances.ROOT):
         record = instances.read(instances.ROOT, row['vmid'])
-        config = instances.command('pct', 'config', str(row['vmid']))
+        config = _selected_configuration(row['vmid'])
         marker = instances.identity(config)
         reason = 'matched' if marker == record['installation_id'] else 'identity-unconfirmed'
         return public_row(record, {'reason': reason})
@@ -132,7 +151,7 @@ def _run_lifecycle(command, title):
     return completed.returncode == 0
 
 
-def carry_records(project, mount_stopped=True, vmids=None, verify=False, shown=False):
+def carry_records(project, mount_stopped=True, vmids=None, verify=False, shown=False, heading=None):
     """Leave inside each container the copy of its record that a restore on
     another host needs. It is refreshed after every operation. Returns what
     was found for each container. Every installed application is looked at,
@@ -140,6 +159,9 @@ def carry_records(project, mount_stopped=True, vmids=None, verify=False, shown=F
     from . import console
     sys.path.insert(0, str(project / 'remote'))
     if shown:
+        if heading:
+            console.show_logo()
+            console.msg_title(heading)
         console.msg_info(translate('Updating the copy of the record...'))
     try:
         import oci_carried_record
@@ -234,6 +256,17 @@ def interactive_management(project, ui):
         ui.message(translate('OCI management could not be completed. Check the backend status; no additional cleanup has been authorized.'), translate('OCI management'))
 
 
+def _records_unread(project):
+    """Whether an installed application has no cached configuration yet; only
+    then does the first sync read every container and take a while."""
+    sys.path.insert(0, str(project / 'remote'))
+    import oci_carried_record as carried
+    return any(not (carried.instances.location(carried.instances.ROOT, row['vmid']).parent
+                    / carried.CONFIG_CACHE).exists()
+               for row in saved_inventory(project)
+               if row.get('status') == 'installed' and not row.get('pending'))
+
+
 def _clean_orphans(project):
     """Remove, silently, what is left of containers that exist on no node of the cluster."""
     sys.path.insert(0, str(project / 'remote'))
@@ -253,7 +286,8 @@ def _interactive_management(project, ui):
     _clean_orphans(project)
     recover_automatically(project)
     offer_recovery(project, ui)
-    carry_records(project, mount_stopped=False, shown=True)
+    carry_records(project, mount_stopped=False, shown=_records_unread(project),
+                  heading=translate('Manage installed OCI applications'))
     # After each operation the list is shown again. Every operation leaves
     # the copies of the records up to date, so they are not all refreshed again.
     first = True
@@ -313,7 +347,7 @@ def _work_backup_ready(project, ui, vmid):
     import oci_instances as instances
     import oci_work_backup
     try:
-        state = oci_work_backup.status(instances.ROOT, vmid)
+        state = oci_work_backup.status(instances.ROOT, vmid, only_needed=True)
     except (OSError, ValueError, KeyError, RuntimeError, subprocess.SubprocessError):
         # What cannot be measured here is told by the engine when it stops.
         return True
@@ -397,23 +431,22 @@ def manage_instance(project, ui, row, action=None, lifecycle_args=()):
             return _toggle_watchdog(project, ui, row['vmid'], watched)
         if action == 'remove':
             return _remove(project, ui, row['vmid'])
-        if not _work_backup_ready(project, ui, row['vmid']):
-            return False
         record = instances.read(instances.ROOT, row['vmid'])
         import oci_instance_reconcile as reconcile
         try:
-            current_config = instances.command('pct', 'config', str(row['vmid']))
+            current_config = _selected_configuration(row['vmid'])
             adoption = reconcile.propose(record, current_config)
         except (OSError, ValueError, RuntimeError) as error:
             ui.message(str(error), translate('Review external OCI changes'))
             return False
         if adoption:
             summary = '\n'.join(adoption['details'])
-            if not ui.review(
-                    f"{translate('These Proxmox resources were added outside ProxMenux:')}\n\n{summary}\n\n"
-                    + translate('They will be added to oci-compose before continuing. Unsupported or changed resources are not imported.'),
+            # Variables reordered in Proxmox change nothing that needs a decision.
+            if summary and not ui.review(
+                    f"{translate('These changes were made in Proxmox outside ProxMenux:')}\n\n{summary}\n\n"
+                    + translate('They will be saved in oci-compose before continuing.'),
                     translate('Review external OCI changes'),
-                    question=translate('Include these resources in oci-compose?'), default=False):
+                    question=translate('Include these changes in oci-compose?'), default=False):
                 return False
             try:
                 record = reconcile.commit(instances.ROOT, row['vmid'], adoption)
@@ -423,29 +456,16 @@ def manage_instance(project, ui, row, action=None, lifecycle_args=()):
         proposal = None
         if action == 'modify':
             from .recreation import edit_recreation
-            from .cli import _deployment_summary_text
-            from .ui import BacktrackUI, RestartWizard
-            wizard = BacktrackUI(ui)
-            try:
-                while True:
-                    try:
-                        proposal = edit_recreation(record, wizard)
-                        approved = wizard.review(_deployment_summary_text(proposal['candidate']['template'],
-                                                 proposal['candidate']['deployment']), translate('Modify OCI'),
-                                                 question=translate('Apply these changes?'), default=True)
-                        break
-                    except RestartWizard:
-                        wizard.restart()
-                    except ValueError as error:
-                        if not wizard.retry_last(error):
-                            raise
-            finally:
-                wizard.close()
-            if not approved:
+            proposal = edit_recreation(record, ui)
+            if proposal is None:
                 return False
         elif not ui.review(translate('If the image channel has a new version, the CT is stopped, backed up and verified, and replaced with the new image to update the container. If the update fails after the container was changed, the backup is restored. An update that stops halfway is recovered from the OCI management menu.'),
                            translate('Update OCI'), question=translate('Update now?'), default=True):
             return False
+        # Opening/cancelling a confirmation needs no disk or storage probes.
+        # Both accepted operations retain this check before the backend starts.
+        if not _work_backup_ready(project, ui, row['vmid']):
+            return False
         command = [sys.executable, str(project / 'remote/oci_update_current.py'), str(row['vmid']),
                    *lifecycle_args]
         # Host directories are configured by the user, who knows they are
@@ -453,15 +473,24 @@ def manage_instance(project, ui, row, action=None, lifecycle_args=()):
         if '--acknowledge-external-data' not in command:
             command.append('--acknowledge-external-data')
         title = translate('Modify OCI') if proposal else translate('Update OCI')
-        if proposal is None:
-            completed = _run_lifecycle(command, title)
-        else:
-            # Saved environment/secrets must never be passed on the command line.
-            with tempfile.NamedTemporaryFile(mode='w', suffix='.json') as file:
-                json.dump(proposal, file)
-                file.flush()
-                completed = _run_lifecycle(command + ['--proposal', file.name], title)
-        if completed and not getattr(ui, 'unattended', False):
+        # The downloaded image is only worth mentioning when a new container
+        # was created from it, not after a change applied to the running one.
+        with tempfile.TemporaryDirectory() as folder:
+            marker = Path(folder) / 'recreated'
+            os.environ['OCI_RECREATED_MARKER'] = str(marker)
+            try:
+                if proposal is None:
+                    completed = _run_lifecycle(command, title)
+                else:
+                    # Saved environment/secrets must never be passed on the command line.
+                    with tempfile.NamedTemporaryFile(mode='w', suffix='.json') as file:
+                        json.dump(proposal, file)
+                        file.flush()
+                        completed = _run_lifecycle(command + ['--proposal', file.name], title)
+            finally:
+                os.environ.pop('OCI_RECREATED_MARKER', None)
+            recreated = marker.exists()
+        if completed and recreated and not getattr(ui, 'unattended', False):
             images.offer_removal(ui, [row['vmid']])
         return completed
     action = ui.choose(translate('Interrupted operation'), [('status', translate('View status')),
@@ -495,7 +524,10 @@ def _removal_summary(project, vmid):
             record = instances.read(instances.ROOT, member)
         except (OSError, ValueError, KeyError):
             record = {}
-        config = oci_remove.guest_config(member)
+        try:
+            config = _selected_configuration(member)
+        except (OSError, RuntimeError, subprocess.SubprocessError):
+            config = None
         cfg = parse_config(config) if config else {}
         name = (cfg.get('hostname') or (record.get('stack_member') or {}).get('name')
                 or record.get('deployment', {}).get('hostname') or '')
diff --git a/oci/src/proxmenux_oci/recreation.py b/oci/src/proxmenux_oci/recreation.py
index d8ddf4b9..e1f3d897 100644
--- a/oci/src/proxmenux_oci/recreation.py
+++ b/oci/src/proxmenux_oci/recreation.py
@@ -4,7 +4,7 @@ import re
 from pathlib import Path, PurePosixPath
 
 from .i18n import translate
-from .ui import UserCancelled
+from .ui import BacktrackUI, RestartWizard, UserCancelled
 
 
 def positive_integer(ui, prompt, value, minimum=1):
@@ -30,13 +30,13 @@ def edit_network(deployment, ui):
     network.update(bridge=bridge, ipv4=ipv4, gateway=gateway)
 
 
-def edit_acceleration(candidate, ui):
+def edit_acceleration(candidate, ui, confirm=True):
     from .installer import configure_acceleration
     deployment = candidate['deployment']
     template = candidate.get('template', {})
     installer = template.get('proxmox', {}).get('installer_profile', {})
     hardware = installer.get('hardware_acceleration')
-    if not hardware or not ui.confirm(translate('Change GPU acceleration?'), False):
+    if not hardware or (confirm and not ui.confirm(translate('Change GPU acceleration?'), False)):
         return
     profiles = hardware.get('profiles', [])
     reference = template.get('container_contract', {}).get('image', {}).get('reference', '')
@@ -104,44 +104,143 @@ def edit_environment(deployment, ui):
             environment.append(item)
 
 
-def edit_recreation(record, ui):
-    candidate = copy.deepcopy(record)
-    refresh_template(candidate, ui)
+def modification_options(candidate):
+    """Only offer supported settings; never put environment values in the menu."""
     deployment = candidate['deployment']
     resources = deployment['resources']
-    resources['cores'] = positive_integer(ui, translate('Cores'), resources['cores'])
-    resources['memory_mb'] = positive_integer(ui, translate('RAM in MiB'), resources['memory_mb'], 128)
+    profile = candidate.get('template', {}).get('proxmox', {}).get('installer_profile', {})
+    network = deployment.get('network', {})
+    address = network.get('ipv4', 'dhcp')
+
+    def row(label, value):
+        return f"{label:<26} {value}"
+
+    options = [
+        ('cores', row(translate('CPU cores'), resources['cores'])),
+        ('memory', row(translate('RAM in MiB'), resources['memory_mb'])),
+        ('network', row(translate('Network'),
+                        f"{network.get('bridge', '-')} · {'DHCP' if address == 'dhcp' else address}")),
+        # Only the paths added by hand: the application's own volumes are not extra.
+        ('paths', row(translate('Extra paths'), sum(1 for m in deployment.get('mounts', []) if m.get('custom')))),
+    ]
+    if profile.get('shared_directories'):
+        options.append(('shares', translate('Shared directories')))
+    if profile.get('hardware_acceleration'):
+        hardware = profile['hardware_acceleration']
+        selected = next((p for p in hardware.get('profiles', [])
+                         if p['id'] == deployment.get('hardware_profile')), {})
+        options.append(('acceleration', row(translate('Acceleration'),
+                         translate(selected.get('label') or deployment.get('hardware_profile') or 'CPU'))))
+    if profile.get('object_detector'):
+        options.append(('detector', translate('Object detector')))
+    options += [
+        ('devices', row(translate('Devices'), len(deployment.get('devices', [])))),
+        ('environment', row(translate('Variables'), len(deployment.get('environment', [])))),
+        ('catalog', translate('Catalog options')),
+        ('apply', translate('Review and apply')),
+        ('discard', translate('Discard changes')),
+    ]
+    return options
+
+
+def edit_setting(candidate, ui, setting):
+    deployment = candidate['deployment']
     template = candidate.get('template', {})
-    if template.get('proxmox', {}).get('installer_profile', {}).get('shared_directories'):
+    profile = template.get('proxmox', {}).get('installer_profile', {})
+    if setting == 'cores':
+        resources = deployment['resources']
+        resources['cores'] = positive_integer(ui, translate('Cores'), resources['cores'])
+    elif setting == 'memory':
+        resources = deployment['resources']
+        resources['memory_mb'] = positive_integer(ui, translate('RAM in MiB'), resources['memory_mb'], 128)
+    elif setting == 'network':
+        edit_network(deployment, ui)
+    elif setting == 'shares':
         from .installer import ask_shared_directories
         deployment['mounts'] += ask_shared_directories(
             ui, template, deployment['mounts'], deployment['rootfs']['storage'], True, optional=True,
             unprivileged=deployment.get('security', {}).get('unprivileged', True))
-    from .custom_mounts import ask_custom_mounts
-    deployment['mounts'] = ask_custom_mounts(
-        ui, deployment['mounts'], deployment['rootfs']['storage'])
-    if ui.confirm(translate('Change the access network?'), False):
-        edit_network(deployment, ui)
-    edit_acceleration(candidate, ui)
-    from .installer import configure_detector
-    installer_profile = candidate.get('template', {}).get('proxmox', {}).get('installer_profile', {})
-    deployment['devices'], notes = configure_detector(installer_profile, deployment.get('devices', []), ui)
-    if notes:
-        deployment['completion_notes'] = notes
-    from .extra_devices import ask_extra_devices
-    reference = candidate.get('template', {}).get('container_contract', {}).get('image', {}).get('reference', '')
-    repository = reference.split('@')[0].rsplit(':', 1)[0]
-    deployment['devices'] = ask_extra_devices(
-        ui, deployment.get('devices', []), deployment.get('security', {}).get('unprivileged', True),
-        allow_coral=repository in ('ghcr.io/blakeblackshear/frigate', 'codeproject/ai-server', 'docker.io/codeproject/ai-server'))
-    from .extra_devices import device_permissions
-    deployment['device_permissions'] = device_permissions(
-        reference, deployment['devices'], deployment.get('device_permissions'))
-    edit_environment(deployment, ui)
-    proposal = {'operation': 'recreate', 'candidate': candidate}
-    if record.get('observed', {}).get('config_sha256'):
-        proposal['base_config_sha256'] = record['observed']['config_sha256']
-    return proposal
+    elif setting == 'paths':
+        from .custom_mounts import ask_custom_mounts
+        deployment['mounts'] = ask_custom_mounts(ui, deployment['mounts'], deployment['rootfs']['storage'])
+    elif setting == 'acceleration':
+        edit_acceleration(candidate, ui, confirm=False)
+    elif setting == 'detector':
+        from .installer import configure_detector
+        deployment['devices'], notes = configure_detector(profile, deployment.get('devices', []), ui)
+        if notes:
+            deployment['completion_notes'] = notes
+    elif setting == 'devices':
+        from .extra_devices import ask_extra_devices
+        reference = template.get('container_contract', {}).get('image', {}).get('reference', '')
+        repository = reference.split('@')[0].rsplit(':', 1)[0]
+        deployment['devices'] = ask_extra_devices(
+            ui, deployment.get('devices', []), deployment.get('security', {}).get('unprivileged', True),
+            allow_coral=repository in ('ghcr.io/blakeblackshear/frigate', 'codeproject/ai-server', 'docker.io/codeproject/ai-server'))
+    elif setting == 'environment':
+        edit_environment(deployment, ui)
+    elif setting == 'catalog':
+        refresh_template(candidate, ui)
+    else:
+        raise ValueError(setting)
+    if setting in ('acceleration', 'detector', 'devices'):
+        from .extra_devices import device_permissions
+        reference = candidate.get('template', {}).get('container_contract', {}).get('image', {}).get('reference', '')
+        permissions = device_permissions(reference, deployment.get('devices', []), deployment.get('device_permissions'))
+        if permissions is not None or 'device_permissions' in deployment:
+            deployment['device_permissions'] = permissions
+
+
+def edit_section(candidate, ui, setting):
+    """A cancelled or invalid section cannot leave a half-edited draft."""
+    wizard = BacktrackUI(ui)
+    try:
+        while True:
+            edited = copy.deepcopy(candidate)
+            try:
+                edit_setting(edited, wizard, setting)
+                return edited
+            except RestartWizard:
+                wizard.restart()
+            except UserCancelled:
+                return candidate
+            except ValueError as error:
+                if not wizard.retry_last(error):
+                    ui.message(str(error), translate('Modify OCI'))
+                    return candidate
+    finally:
+        wizard.close()
+
+
+def edit_recreation(record, ui):
+    """Keep a draft across independently editable settings; apply it once."""
+    from .cli import _deployment_summary_text
+    candidate = copy.deepcopy(record)
+    selected = 'cores'
+    while True:
+        pending = candidate != record
+        status = translate('Unapplied changes') if pending else translate('No pending changes')
+        text = (f"CT {record.get('vmid', '-')}: {candidate['deployment'].get('hostname', '')}\n"
+                f"{status}\n\n"
+                + translate('Choose a setting. Changes are applied only after the final review.'))
+        selected = ui.choose(text, modification_options(candidate), selected,
+                             title=translate('Modify OCI'), show_tags=False)
+        if selected is None or selected == 'discard':
+            if not pending or ui.confirm(translate('Discard unapplied changes?'), False):
+                return None
+            selected = 'apply'
+        elif selected == 'apply':
+            if not pending:
+                ui.message(translate('Nothing was changed.'), translate('Modify OCI'))
+                return None
+            if ui.review(_deployment_summary_text(candidate['template'], candidate['deployment']),
+                         translate('Modify OCI'), question=translate('Apply these changes?'), default=True):
+                proposal = {'operation': 'recreate', 'candidate': candidate}
+                if record.get('observed', {}).get('config_sha256'):
+                    proposal['base_config_sha256'] = record['observed']['config_sha256']
+                return proposal
+        else:
+            candidate = edit_section(candidate, ui, selected)
 
 
 def refresh_template(candidate, ui):
diff --git a/oci/src/proxmenux_oci/registry_accounts.py b/oci/src/proxmenux_oci/registry_accounts.py
index f500520c..2ad9791d 100644
--- a/oci/src/proxmenux_oci/registry_accounts.py
+++ b/oci/src/proxmenux_oci/registry_accounts.py
@@ -166,7 +166,7 @@ def registry_accounts_menu(ui, engine=ENGINE_ROOT, auth=None):
             return
         try:
             options = [('add', translate('Sign in to a registry'))]
-            options += [(f'account-{index}', f"{row['registry']:<28}  {row['account'] or row['method']}  [{translate('saved')}]")
+            options += [(f'account-{index}', f"{row['registry']:<28}  [{translate('saved')}]")
                         for index, row in enumerate(rows)]
             options += [('storage', translate('Credential storage and access'))]
             count = translate('{count} saved account.') if len(rows) == 1 else translate('{count} saved accounts.')
diff --git a/oci/src/proxmenux_oci/ui.py b/oci/src/proxmenux_oci/ui.py
index 8238d3c2..6ff5955f 100644
--- a/oci/src/proxmenux_oci/ui.py
+++ b/oci/src/proxmenux_oci/ui.py
@@ -221,6 +221,10 @@ class DialogUI:
 
     def _run(self, widget: list[str], title: str | None = None) -> subprocess.CompletedProcess[str]:
         environment = os.environ.copy()
+        # ncurses otherwise waits a full second to distinguish Escape from
+        # the prefix of a cursor/function key. Keep a short sequence window,
+        # while respecting an explicit terminal-specific setting.
+        environment.setdefault("ESCDELAY", "150")
         if environment.get("TERM", "").casefold() in {"", "dumb", "unknown"}:
             environment["TERM"] = "xterm-256color"
         # dialog draws on the terminal and writes the selection to stderr.
diff --git a/oci/tests/test_carried_config_cache.py b/oci/tests/test_carried_config_cache.py
new file mode 100644
index 00000000..026a3598
--- /dev/null
+++ b/oci/tests/test_carried_config_cache.py
@@ -0,0 +1,134 @@
+"""A fast Manage entry still detects config edits and verifies lifecycle work."""
+import contextlib
+import copy
+import json
+import os
+from pathlib import Path
+import sys
+import tempfile
+from types import SimpleNamespace
+import unittest
+from unittest.mock import patch
+
+ROOT = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(ROOT / 'remote'))
+import oci_carried_record as carried
+
+
+class CarriedConfigCacheTests(unittest.TestCase):
+    def setUp(self):
+        self.tmp = tempfile.TemporaryDirectory()
+        self.addCleanup(self.tmp.cleanup)
+        self.root = Path(self.tmp.name) / 'instances'
+        self.source = Path(self.tmp.name) / 'lxc'
+        self.source.mkdir()
+        self.config = self.source / '120.conf'
+        self.config.write_text('# proxmenux-instance=example\nunprivileged: 1\n')
+        (self.root / '120').mkdir(parents=True)
+        self.cache = self.root / '120' / carried.CONFIG_CACHE
+        self.patch = patch.object(carried, 'LOCAL_CONFIGS', self.source)
+        self.patch.start()
+        self.addCleanup(self.patch.stop)
+
+    def response(self, text='description: proxmenux-instance=example\nunprivileged: 1\n', status=0):
+        return SimpleNamespace(returncode=status, stdout=text)
+
+    def test_warm_reads_avoid_pct_and_cache_is_private(self):
+        with patch.object(carried, '_run', return_value=self.response()) as run:
+            first = carried.configuration(self.root, 120)
+            self.assertEqual(carried.configuration(self.root, 120), first)
+        run.assert_called_once_with('pct', 'config', '120')
+        self.assertEqual(self.cache.stat().st_mode & 0o777, 0o600)
+
+    def test_native_edits_invalidate_even_when_size_and_mtime_are_restored(self):
+        with patch.object(carried, '_run', side_effect=[self.response(), self.response('new')]) as run:
+            carried.configuration(self.root, 120)
+            info = self.config.stat()
+            self.config.write_text(self.config.read_text().replace('example', 'changed'))
+            os.utime(self.config, ns=(info.st_atime_ns, info.st_mtime_ns))
+            self.assertEqual(carried.configuration(self.root, 120), 'new')
+        self.assertEqual(run.call_count, 2)
+
+    def test_verify_forces_a_fresh_pct_read_with_a_warm_cache(self):
+        with patch.object(carried, '_run', side_effect=[self.response(), self.response('verified')]) as run:
+            carried.configuration(self.root, 120)
+            self.assertEqual(carried.configuration(self.root, 120, verify=True), 'verified')
+        self.assertEqual(run.call_count, 2)
+
+    def test_missing_native_source_never_uses_or_populates_a_cache(self):
+        self.config.unlink()
+        with patch.object(carried, '_run', return_value=self.response()) as run:
+            carried.configuration(self.root, 120)
+            carried.configuration(self.root, 120)
+        self.assertEqual(run.call_count, 2)
+        self.assertFalse(self.cache.exists())
+
+    def test_concurrent_edit_does_not_cache_output_for_the_wrong_revision(self):
+        def command(*args):
+            self.config.write_text('changed while pct was reading\n')
+            return self.response()
+        with patch.object(carried, '_run', side_effect=command):
+            carried.configuration(self.root, 120)
+        self.assertFalse(self.cache.exists())
+
+    def test_edit_during_cache_lookup_falls_back_to_pct(self):
+        with patch.object(carried, '_run', return_value=self.response()):
+            carried.configuration(self.root, 120)
+        read_text = Path.read_text
+        def edit_during_read(path, *args, **kwargs):
+            text = read_text(path, *args, **kwargs)
+            if path == self.cache:
+                self.config.write_text('changed while reading the cache\n')
+            return text
+        with patch.object(Path, 'read_text', edit_during_read), \
+                patch.object(carried, '_run', return_value=self.response('fresh')) as run:
+            self.assertEqual(carried.configuration(self.root, 120), 'fresh')
+        run.assert_called_once_with('pct', 'config', '120')
+
+    def test_corrupt_cache_and_pct_failure_are_not_accepted(self):
+        for text in ('not json', '[]', '{"schema_version": 999}'):
+            with self.subTest(cache=text):
+                self.cache.write_text(text)
+                with patch.object(carried, '_run', return_value=self.response(status=1)) as run:
+                    self.assertIsNone(carried.configuration(self.root, 120))
+                run.assert_called_once()
+                self.assertEqual(self.cache.read_text(), text)
+
+    def test_symlink_cache_does_not_read_or_replace_its_target(self):
+        target = Path(self.tmp.name) / 'outside'
+        target.write_text('private original')
+        self.cache.symlink_to(target)
+        with patch.object(carried, '_run', return_value=self.response()) as run:
+            self.assertEqual(carried.configuration(self.root, 120), self.response().stdout)
+        run.assert_called_once()
+        self.assertTrue(self.cache.is_symlink())
+        self.assertEqual(target.read_text(), 'private original')
+
+    def test_cached_config_still_detects_a_restored_container_record(self):
+        installation = '488ed3cb-1145-477a-b90f-c46777d69fb2'
+        record = {'schema_version': 1, 'vmid': 120, 'installation_id': installation,
+                  'status': 'installed', 'deployment': {'hostname': 'current'}}
+        carried.instances.write(carried.instances.location(self.root, 120), record)
+        native = f'description: proxmenux-instance={installation}\n'
+        with patch.object(carried, '_run', return_value=self.response(native)):
+            carried.configuration(self.root, 120)
+        rootfs = Path(self.tmp.name) / 'rootfs'
+        rootfs.mkdir()
+        previous = copy.deepcopy(record)
+        previous['deployment']['hostname'] = 'restored-snapshot'
+        carried.write_copy(rootfs, {'kind': carried.KIND, 'schema_version': 1,
+                                   'record': previous, 'generation': 'restored-generation'},
+                           (os.getuid(), os.getgid()))
+        stamp = self.root / '120' / carried.STAMP
+        stamp.write_text(json.dumps({'generation': 'host-generation'}))
+        with patch.object(carried, '_run', side_effect=AssertionError('cached config expected')), \
+                patch.object(carried, 'read_cluster', return_value=None), \
+                patch.object(carried, 'running_pid', return_value=123), \
+                patch.object(carried, 'container_root', return_value=contextlib.nullcontext(rootfs)):
+            self.assertEqual(carried.carry(self.root, 120, mount_stopped=False), 'stale')
+        self.assertFalse(carried.instances.location(self.root, 120).exists())
+        self.assertTrue((self.root / '120' / f'retired-{installation}.json').exists())
+
+
+if __name__ == '__main__':
+    unittest.main()
diff --git a/oci/tests/test_dialog_escape.py b/oci/tests/test_dialog_escape.py
new file mode 100644
index 00000000..f5063878
--- /dev/null
+++ b/oci/tests/test_dialog_escape.py
@@ -0,0 +1,34 @@
+"""Escape delay is scoped to dialog and preserves terminal-specific overrides."""
+import os
+from pathlib import Path
+import subprocess
+import sys
+import unittest
+from unittest.mock import patch
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[1] / 'src'))
+from proxmenux_oci.ui import DialogUI, UserCancelled
+
+
+class DialogEscapeTests(unittest.TestCase):
+    def test_escape_uses_short_delay_without_changing_parent_environment(self):
+        with patch.dict(os.environ, {'TERM': 'xterm'}, clear=True), \
+                patch('proxmenux_oci.ui.subprocess.run', return_value=subprocess.CompletedProcess([], 255, stderr='')) as run:
+            self.assertIsNone(DialogUI().choose('Menu', [('1', 'First')]))
+            self.assertEqual(run.call_args.kwargs['env']['ESCDELAY'], '150')
+            self.assertNotIn('ESCDELAY', os.environ)
+
+    def test_explicit_delay_is_preserved(self):
+        with patch.dict(os.environ, {'ESCDELAY': '900'}), \
+                patch('proxmenux_oci.ui.subprocess.run', return_value=subprocess.CompletedProcess([], 0, stderr='1')) as run:
+            self.assertEqual(DialogUI().choose('Menu', [('1', 'First')]), '1')
+            self.assertEqual(run.call_args.kwargs['env']['ESCDELAY'], '900')
+
+    def test_escape_in_search_input_keeps_cancellation_behavior(self):
+        with patch('proxmenux_oci.ui.subprocess.run', return_value=subprocess.CompletedProcess([], 255, stderr='')):
+            with self.assertRaises(UserCancelled):
+                DialogUI().ask('Search')
+
+
+if __name__ == '__main__':
+    unittest.main()
diff --git a/oci/tests/test_external_tags.py b/oci/tests/test_external_tags.py
new file mode 100644
index 00000000..0f09c5e3
--- /dev/null
+++ b/oci/tests/test_external_tags.py
@@ -0,0 +1,203 @@
+"""Proxmox tags can change without preventing OCI management or being lost."""
+import copy
+import io
+import json
+import os
+from pathlib import Path
+import re
+import shutil
+import subprocess
+import sys
+import tempfile
+import unittest
+from contextlib import redirect_stdout
+from unittest.mock import patch
+
+ROOT = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(ROOT / 'remote'))
+
+import oci_instance_reconcile as reconcile
+import oci_instance_transaction as transaction
+from oci_installation_state import sha
+
+MARKER = '11111111-1111-4111-8111-111111111111'
+BASE = (f'description: proxmenux-instance={MARKER}\n'
+        'rootfs: local-lvm:vm-200-disk-0,size=8G\n'
+        'unprivileged: 1\ncores: 2\nmemory: 512\n'
+        'net0: name=eth0,bridge=vmbr0,hwaddr=02:00:00:00:00:01,ip=dhcp\n'
+        'net1: name=eth1,bridge=vmbr1,ip=dhcp\nstartup: order=20\n').encode()
+
+
+def config(tags):
+    return BASE + (f'tags: {tags}\n'.encode() if tags is not None else b'')
+
+
+def record(tags='oci;proxmenux'):
+    before = config(tags)
+    return {
+        'schema_version': 1, 'vmid': 200, 'status': 'installed',
+        'installation_id': MARKER,
+        'template': {'id': 'test-app', 'container_contract': {'volumes': []}},
+        'deployment': {
+            'vmid': 200, 'rootfs': {'storage': 'local-lvm', 'size_gb': 8},
+            'network': {}, 'resources': {'cores': 2, 'memory_mb': 512},
+            'mounts': [], 'devices': [],
+        },
+        'observed': {
+            'config': before.decode(), 'config_sha256': sha(before),
+            'image': {'architecture': 'amd64', 'manifest_digest': 'sha256:old',
+                      'defaults': {'Volumes': {}}},
+        },
+    }
+
+
+class ExternalTagsTests(unittest.TestCase):
+    def test_adding_editing_reordering_and_removing_tags_need_no_adoption(self):
+        for old, new in ((None, 'homelab'), ('oci;proxmenux', 'homelab;oci;proxmenux'),
+                         ('oci;proxmenux', 'proxmenux;oci'), ('oci;proxmenux', None),
+                         ('oci;proxmenux', '')):
+            with self.subTest(old=old, new=new):
+                saved, current = record(old), config(new)
+                self.assertIsNone(reconcile.propose(saved, current))
+                self.assertEqual(transaction.external_changes(saved, current), {})
+
+    def test_tags_can_change_together_with_cpu_and_memory(self):
+        current = config('homelab').replace(b'cores: 2', b'cores: 4').replace(b'memory: 512', b'memory: 2048')
+        self.assertIsNone(reconcile.propose(record(), current))
+        self.assertEqual(transaction.external_changes(record(), current), {'cores': 4, 'memory': 2048})
+
+    def test_tag_changes_do_not_bypass_identity_or_network_checks(self):
+        for current in (config('homelab').replace(MARKER.encode(), b'22222222-2222-4222-8222-222222222222'),
+                        config('homelab').replace(b'bridge=vmbr0', b'bridge=vmbr2')):
+            with self.subTest(config=current):
+                with self.assertRaises(ValueError):
+                    reconcile.propose(record(), current)
+                with self.assertRaises(ValueError):
+                    transaction.external_changes(record(), current)
+
+    def test_new_volume_still_requires_adoption_when_tags_also_change(self):
+        saved = record()
+        current = config('homelab') + b'mp0: local-lvm:vm-200-disk-1,mp=/data,size=8G,backup=1\n'
+        with tempfile.TemporaryDirectory() as folder:
+            root = Path(folder)
+            path = root / '200/oci-compose.json'
+            path.parent.mkdir()
+            path.write_text(json.dumps(saved))
+            with patch.object(reconcile.instances, 'ROOT', root):
+                proposal = reconcile.propose(saved, current)
+            self.assertEqual(proposal['candidate']['deployment']['mounts'][0]['container_path'], '/data')
+            self.assertEqual(len(proposal['details']), 1)
+            self.assertEqual(json.loads(path.read_text()), saved)
+
+
+class Prepared(Exception):
+    """Stop a mocked transaction before it can stop or modify any container."""
+
+
+class TagReplayTests(unittest.TestCase):
+    def prepare(self, folder, tags, operation, coordinated=None):
+        current, saved = config(tags), record()
+        archive = folder / 'image.tar'
+        archive.write_bytes(b'fixture')
+        states = []
+
+        def checkpoint(_path, state, phase):
+            self.assertEqual(phase, 'prepared')
+            states.append(copy.deepcopy(state))
+            raise Prepared()
+
+        def command(*args):
+            if args[:2] == ('pct', 'config'):
+                return current
+            if args[:3] == ('pvesh', 'get', '/cluster/ha/resources'):
+                return b'[]'
+            if args[:2] == ('pct', 'status'):
+                return b'status: running'
+            self.fail(f'Unexpected host command: {args}')
+
+        proposal = {'operation': 'recreate', 'candidate': copy.deepcopy(saved)} if operation == 'recreate' else None
+        image = {'architecture': 'amd64', 'os': 'linux', 'manifest_digest': 'sha256:new', 'defaults': {}}
+        with (patch.object(transaction.instances, 'read', return_value=saved),
+              patch.object(transaction, 'run', side_effect=command),
+              patch.object(transaction, 'check_archive'),
+              patch.object(transaction, 'image_from_archive', return_value=image),
+              patch.object(transaction.work_backup, 'locate', side_effect=lambda directory, *_: directory),
+              patch.object(transaction, 'open_log'),
+              patch.object(transaction, 'checkpoint', side_effect=checkpoint),
+              redirect_stdout(io.StringIO()), self.assertRaises(Prepared)):
+            transaction.apply(folder, 200, archive, operation, proposal=proposal, coordinated=coordinated)
+        return states[0]
+
+    @unittest.skipUnless(shutil.which('bash') and shutil.which('jq'), 'bash and jq are needed')
+    def test_update_and_modify_replay_current_tags_including_no_tags(self):
+        installer = (ROOT / 'remote/install_oci.sh').read_text()
+        function = re.search(r'^apply_kept_settings\(\) \{\n.*?^\}\n', installer, re.M | re.S)
+        self.assertIsNotNone(function)
+        for operation in ('update', 'recreate'):
+            for tags in ('homelab;oci;proxmenux', 'oci', None, ''):
+                with self.subTest(operation=operation, tags=tags), tempfile.TemporaryDirectory() as name:
+                    folder = Path(name)
+                    state = self.prepare(folder, tags, operation)
+                    kept = state['runtime_deployment']['kept_proxmox_settings']
+                    deployment = folder / 'deployment.json'
+                    deployment.write_text(json.dumps({'kept_proxmox_settings': kept}))
+                    calls = folder / 'calls'
+                    script = '''
+pct() { printf '%s\\0' "$@" >> "$CALLS"; printf '\\n' >> "$CALLS"; }
+oci_quiet() { "$@"; }
+translate() { printf '%s' "$1"; }
+die() { printf '%s\\n' "$*" >&2; exit 1; }
+'''
+                    done = subprocess.run(['bash', '-euc', script + function.group(0) + '\napply_kept_settings'],
+                                          env=dict(os.environ, VMID='200', DEPLOYMENT_FILE=str(deployment), CALLS=str(calls)),
+                                          capture_output=True, text=True)
+                    self.assertEqual(done.returncode, 0, done.stderr)
+                    commands = [line.split(b'\0')[:-1] for line in calls.read_bytes().splitlines()]
+                    expected = [b'set', b'200', b'--tags', tags.encode()] if tags else [b'set', b'200', b'--delete', b'tags']
+                    self.assertIn(expected, commands)
+                    self.assertIn([b'set', b'200', b'--net1', b'name=eth1,bridge=vmbr1,ip=dhcp'], commands)
+                    self.assertIn([b'set', b'200', b'--startup', b'order=20'], commands)
+
+    def test_stack_operations_also_preserve_tags_and_their_absence(self):
+        for operation in ('update', 'recreate'):
+            for tags in ('homelab;oci', None, ''):
+                with self.subTest(operation=operation, tags=tags), tempfile.TemporaryDirectory() as name:
+                    state = self.prepare(Path(name), tags, operation, coordinated={'stack': 'test'})
+                    self.assertEqual(state['preserved_stack_config']['tags'], tags or '')
+
+    @unittest.skipUnless(shutil.which('bash') and shutil.which('jq'), 'bash and jq are needed')
+    def test_native_stack_check_accepts_tag_edits_and_nothing_else(self):
+        saved = record()
+        instances = transaction.instances
+        for new in ('homelab;oci;proxmenux', 'proxmenux;oci', '', None):
+            with self.subTest(new=new):
+                self.assertTrue(instances.same_config_except_notes(saved, config(new), ignore_tags=True))
+                self.assertFalse(instances.same_config_except_notes(saved, config(new)))
+        changed = config('homelab').replace(b'cores: 2', b'cores: 4')
+        self.assertFalse(instances.same_config_except_notes(saved, changed, ignore_tags=True))
+        other = config('homelab').replace(MARKER.encode(), b'22222222-2222-4222-8222-222222222222')
+        self.assertFalse(instances.same_config_except_notes(saved, other, ignore_tags=True))
+        source = (ROOT / 'remote/oci_stack_native.py').read_text()
+        self.assertIn('same_config_except_notes(record, config, ignore_tags=True)', source)
+
+    def test_installer_still_refuses_unsupported_kept_settings(self):
+        installer = (ROOT / 'remote/install_oci.sh').read_text()
+        function = re.search(r'^apply_kept_settings\(\) \{\n.*?^\}\n', installer, re.M | re.S).group(0)
+        with tempfile.TemporaryDirectory() as name:
+            deployment = Path(name) / 'deployment.json'
+            deployment.write_text(json.dumps({'kept_proxmox_settings': {'unprivileged': '0'}}))
+            script = '''
+oci_quiet() { echo 'must not run' >&2; exit 99; }
+translate() { printf '%s' "$1"; }
+die() { printf '%s\\n' "$*" >&2; exit 1; }
+'''
+            done = subprocess.run(['bash', '-euc', script + function + '\napply_kept_settings'],
+                                  env=dict(os.environ, VMID='200', DEPLOYMENT_FILE=str(deployment)),
+                                  capture_output=True, text=True)
+            self.assertEqual(done.returncode, 1)
+            self.assertIn('Unsupported kept setting: unprivileged', done.stderr)
+            self.assertNotIn('must not run', done.stderr)
+
+
+if __name__ == '__main__':
+    unittest.main()
diff --git a/oci/tests/test_guessed_endpoint_healthcheck.py b/oci/tests/test_guessed_endpoint_healthcheck.py
new file mode 100644
index 00000000..8ce9003f
--- /dev/null
+++ b/oci/tests/test_guessed_endpoint_healthcheck.py
@@ -0,0 +1,87 @@
+"""A web address guessed from the compose file may belong to a service that does
+not speak HTTP. Updates, Modify and recovery must accept its answer instead of
+waiting for an HTTP reply that never comes."""
+
+import os
+from pathlib import Path
+import subprocess
+import sys
+import tempfile
+import unittest
+from unittest.mock import patch
+
+ROOT = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(ROOT / 'remote'))
+
+import oci_instance_transaction as transaction
+
+INSTALLER = ROOT / 'remote/install_oci.sh'
+GUESSED = {'first_run': {'endpoints': [{'label': 'Web UI', 'scheme': 'http', 'port': 3306, 'path': '/',
+                                        'source': 'compose-first-tcp-port-fallback'}]}}
+DECLARED = {'first_run': {'endpoints': [{'label': 'Web UI', 'scheme': 'http', 'port': 8080, 'path': '/'}]}}
+
+
+def probe_function():
+    source = INSTALLER.read_text()
+    start = source.index('healthcheck_probe() {')
+    end = source.index('\n}\n', start) + 3
+    return source[start:end]
+
+
+class GuessedEndpointCheckTests(unittest.TestCase):
+    def test_only_a_guessed_endpoint_accepts_other_protocols(self):
+        self.assertTrue(transaction.effective_healthcheck(GUESSED)['accept_non_http'])
+        self.assertNotIn('accept_non_http', transaction.effective_healthcheck(DECLARED))
+
+    def run_probe(self, exit_code, code='000', accept_non_http='true', any_status='true'):
+        with tempfile.TemporaryDirectory() as directory:
+            fake = Path(directory) / 'curl'
+            fake.write_text(f'#!/bin/sh\nprintf %s {code}\nexit {exit_code}\n')
+            fake.chmod(0o755)
+            script = (probe_function() + '\nCURL_ARGS=()\nHC_URL=http://192.0.2.1:3306/\n'
+                      f'HC_ANY_STATUS={any_status}\nHC_ACCEPT_NON_HTTP={accept_non_http}\nhealthcheck_probe\n')
+            env = {**os.environ, 'PATH': f'{directory}:{os.environ["PATH"]}'}
+            return subprocess.run(['bash', '-c', script], env=env, capture_output=True).returncode
+
+    def test_installer_probe_accepts_a_non_http_answer_only_when_guessed(self):
+        for status in transaction.NON_HTTP_ANSWER:
+            with self.subTest(status=status):
+                self.assertEqual(self.run_probe(status), 0)
+                self.assertNotEqual(self.run_probe(status, accept_non_http='false'), 0)
+        # A closed port, a timeout or a server error still fail.
+        for status, code in ((7, '000'), (28, '000'), (0, '503')):
+            with self.subTest(status=status, code=code):
+                self.assertNotEqual(self.run_probe(status, code), 0)
+        self.assertEqual(self.run_probe(0, '200'), 0)
+        self.assertEqual(self.run_probe(0, any_status='false', accept_non_http='false'), 0)
+
+    def test_recovery_check_accepts_a_database_answer(self):
+        check = transaction.effective_healthcheck(GUESSED)
+        check.update(timeout_seconds=6, stability_seconds=0)
+        template = {'proxmox': {'installer_profile': {'startup_healthcheck': check}}}
+
+        def run(*args):
+            if args[:2] == ('pct', 'status'):
+                return b'status: running\n'
+            if args[:2] == ('pct', 'config'):
+                return b''
+            if args[0] == 'lxc-info':
+                return b'192.0.2.10\n'
+            raise AssertionError(args)
+
+        with patch.object(transaction, 'run', side_effect=run), \
+                patch.object(transaction, 'probe_http', return_value=(b'000', 1)), \
+                patch.object(transaction, 'log'):
+            self.assertEqual(transaction.healthcheck(113, template), 'http://192.0.2.10:3306/')
+        declared = transaction.effective_healthcheck(DECLARED)
+        declared.update(timeout_seconds=4, stability_seconds=0)
+        template = {'proxmox': {'installer_profile': {'startup_healthcheck': declared}}}
+        with patch.object(transaction, 'run', side_effect=run), \
+                patch.object(transaction, 'probe_http', return_value=(b'000', 1)), \
+                patch.object(transaction, 'log'), patch.object(transaction.time, 'sleep'):
+            with self.assertRaises(ValueError):
+                transaction.healthcheck(113, template)
+
+
+if __name__ == '__main__':
+    unittest.main()
diff --git a/oci/tests/test_instance_reconcile.py b/oci/tests/test_instance_reconcile.py
index b0fb25a1..59cd4a3e 100644
--- a/oci/tests/test_instance_reconcile.py
+++ b/oci/tests/test_instance_reconcile.py
@@ -1,4 +1,5 @@
 """Regression tests for explicit adoption of external OCI resources."""
+import copy
 import json
 from pathlib import Path
 import sys
@@ -155,5 +156,78 @@ class ProposalTests(unittest.TestCase):
             self.assertEqual(json.loads(history[0].read_text())['deployment']['mounts'], [])
 
 
+class EnvironmentAdoptionTests(unittest.TestCase):
+    marker = '11111111-1111-1111-1111-111111111111'
+
+    def record(self, env):
+        config = f'description: proxmenux-instance={self.marker}\nenv: {env}\n'.encode()
+        return {
+            'vmid': 200, 'status': 'installed', 'installation_id': self.marker,
+            'deployment': {'mounts': [], 'devices': [], 'environment': [
+                {'name': 'APP_PASSWORD', 'value': 'first-secret', 'sensitive': True}]},
+            'observed': {'config': config.decode(), 'config_sha256': sha(config),
+                         'archive_path': '/unused.tar', 'resolved_registry_digest': 'sha256:test',
+                         'image': {'manifest_digest': 'sha256:test', 'defaults': {'Env': ['PATH=/bin']}}},
+        }
+
+    def propose(self, record, env):
+        config = f'description: proxmenux-instance={self.marker}\nenv: {env}\n'.encode()
+        with (patch.object(reconcile.instances, 'ROOT', Path('/inert')),
+              patch.object(reconcile.instances, 'identity', return_value=self.marker),
+              patch.object(reconcile.instances, 'location', return_value=Path(__file__)),
+              patch.object(reconcile.gpu_devices, 'capture', return_value={}),
+              patch.object(reconcile.host_mounts, 'capture_sources', return_value={}),
+              patch.object(reconcile.transaction, 'preflight')):
+            return reconcile.propose(record, config)
+
+    def test_a_password_changed_in_proxmox_is_adopted_without_showing_it(self):
+        record = self.record('PATH=/bin\0APP_PASSWORD=first-secret')
+        proposal = self.propose(record, 'PATH=/bin\0APP_PASSWORD=my-own-secret\0TZ=Europe/Madrid')
+        environment = proposal['candidate']['deployment']['environment']
+        self.assertEqual(environment, [
+            {'name': 'APP_PASSWORD', 'value': 'my-own-secret', 'sensitive': True},
+            {'name': 'TZ', 'value': 'Europe/Madrid', 'sensitive': True}])
+        self.assertEqual(proposal['details'], ['env APP_PASSWORD: value changed in Proxmox',
+                                               'env TZ: added in Proxmox'])
+        self.assertNotIn('my-own-secret', str(proposal['details']))
+        self.assertEqual(record['deployment']['environment'][0]['value'], 'first-secret')
+
+    def test_reordered_variables_need_no_decision(self):
+        record = self.record('PATH=/bin\0APP_PASSWORD=first-secret')
+        proposal = self.propose(record, 'APP_PASSWORD=first-secret\0PATH=/bin')
+        self.assertEqual(proposal['details'], [])
+
+    def test_removing_an_image_default_is_refused(self):
+        record = self.record('PATH=/bin\0APP_PASSWORD=first-secret')
+        with self.assertRaisesRegex(ValueError, 'env'):
+            self.propose(record, 'APP_PASSWORD=first-secret')
+
+    def test_removing_a_saved_variable_removes_it_from_the_contract(self):
+        record = self.record('PATH=/bin\0APP_PASSWORD=first-secret')
+        proposal = self.propose(record, 'PATH=/bin')
+        self.assertEqual(proposal['candidate']['deployment']['environment'], [])
+        self.assertEqual(proposal['details'], ['env APP_PASSWORD: removed in Proxmox'])
+
+    def test_other_changes_next_to_the_variables_are_still_refused(self):
+        record = self.record('PATH=/bin')
+        config = (f'description: proxmenux-instance={self.marker}\nenv: PATH=/bin\0A=1\n'
+                  'net0: name=eth0,bridge=vmbr1\n').encode()
+        with (patch.object(reconcile.instances, 'identity', return_value=self.marker),
+              self.assertRaisesRegex(ValueError, 'net0')):
+            reconcile.propose(record, config)
+
+
+class OverlapMessageTests(unittest.TestCase):
+    def test_the_refusal_names_both_paths(self):
+        from test_modify_review import installation
+        saved, config = installation()
+        candidate = copy.deepcopy(saved)
+        volume = {'type': 'managed-volume', 'source': 'local-lvm', 'size_gb': 1, 'backup': True, 'read_only': False}
+        candidate['deployment']['mounts'] = [dict(volume, container_path='/source'),
+                                             dict(volume, container_path='/source/archivos')]
+        with self.assertRaisesRegex(ValueError, '/source/archivos - /source$'):
+            reconcile.transaction.preflight(saved, candidate, config)
+
+
 if __name__ == '__main__':
     unittest.main()
diff --git a/oci/tests/test_manage_sync_notice.py b/oci/tests/test_manage_sync_notice.py
new file mode 100644
index 00000000..ede909b5
--- /dev/null
+++ b/oci/tests/test_manage_sync_notice.py
@@ -0,0 +1,34 @@
+"""Opening Manage shows the sync notice only while some configuration is still unread."""
+from pathlib import Path
+import sys
+import tempfile
+import unittest
+from unittest.mock import patch
+
+ROOT = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(ROOT / 'src'))
+sys.path.insert(0, str(ROOT / 'remote'))
+
+from proxmenux_oci import management
+import oci_carried_record as carried
+
+
+class ManageSyncNoticeTests(unittest.TestCase):
+    def test_notice_only_while_an_installed_application_has_no_cache(self):
+        rows = [{'vmid': 101, 'status': 'installed', 'pending': False},
+                {'vmid': 102, 'status': 'installed', 'pending': True},
+                {'vmid': 103, 'status': 'failed', 'pending': False}]
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            with patch.object(carried.instances, 'ROOT', root), \
+                    patch.object(management, 'saved_inventory', return_value=rows):
+                self.assertTrue(management._records_unread(ROOT))
+                cache = carried.instances.location(root, 101).parent / carried.CONFIG_CACHE
+                cache.parent.mkdir(parents=True)
+                cache.write_text('{}')
+                # The pending and failed applications are never cached by the sync.
+                self.assertFalse(management._records_unread(ROOT))
+
+
+if __name__ == '__main__':
+    unittest.main()
diff --git a/oci/tests/test_menu_performance.py b/oci/tests/test_menu_performance.py
new file mode 100644
index 00000000..94981ceb
--- /dev/null
+++ b/oci/tests/test_menu_performance.py
@@ -0,0 +1,109 @@
+"""Menu speedups avoid unused probes, retaining confirmation and capacity checks."""
+from pathlib import Path
+import sys
+import tempfile
+import unittest
+from unittest.mock import Mock,patch
+ROOT=Path(__file__).resolve().parents[1]
+sys.path[:0]=[str(ROOT/'src'),str(ROOT/'remote')]
+from proxmenux_oci import management as menu
+import oci_instances as instances
+import oci_instance_reconcile as reconcile
+import oci_remove as remover
+import oci_work_backup as backup
+
+
+class UpdateEntryTests(unittest.TestCase):
+    def run_update(self,approved,ready):
+        events=[]
+        record={'status':'installed','vmid':110,'deployment':{},'template':{}}
+        row={'vmid':110,'reason':'matched','stack':False,'pending':False,'status':'installed'}
+        ui=Mock();ui.unattended=True
+        ui.review.side_effect=lambda *a,**kw:events.append('review') or approved
+        with patch.object(menu,'carry_records',return_value={}) as carry, \
+                patch.object(menu,'check_selected',return_value=row), \
+                patch.object(menu,'_selected_configuration',return_value=b'current config'), \
+                patch.object(instances,'read',return_value=record),patch.object(reconcile,'propose',return_value=None), \
+                patch.object(menu,'_work_backup_ready',side_effect=lambda *a:events.append('backup') or ready), \
+                patch.object(menu,'_run_lifecycle',side_effect=lambda *a:events.append('lifecycle') or True):
+            result=menu.manage_instance(ROOT,ui,row,action='update')
+        carry.assert_called_once_with(ROOT,vmids=[110],verify=True)
+        return result,events
+
+    def test_declining_update_does_not_probe_disks_or_storages(self):
+        result,events=self.run_update(False,False)
+        self.assertFalse(result);self.assertEqual(events,['review'])
+
+    def test_accepted_update_checks_backup_space_before_starting(self):
+        result,events=self.run_update(True,True)
+        self.assertTrue(result);self.assertEqual(events,['review','backup','lifecycle'])
+
+    def test_insufficient_space_still_prevents_the_update(self):
+        result,events=self.run_update(True,False)
+        self.assertFalse(result);self.assertEqual(events,['review','backup'])
+
+
+class BackupDestinationTests(unittest.TestCase):
+    def status(self,local_free,saved_free=None,only_needed=True):
+        with tempfile.TemporaryDirectory() as directory:
+            root=Path(directory);saved= root/'nas';saved.mkdir()
+            record={'deployment':{backup.KEY:'nas'}}
+            with patch.object(backup,'application',return_value=(110,[110,111])), \
+                    patch.object(instances,'read',return_value=record), \
+                    patch.object(backup,'required',return_value=100) as required, \
+                    patch.object(backup,'available',side_effect=lambda p:saved_free if Path(p)==saved else local_free), \
+                    patch.object(backup,'storage_path',return_value=saved if saved_free is not None else None) as path, \
+                    patch.object(backup,'file_storages',return_value=[{'storage':'enough','free':200},{'storage':'small','free':50}]) as alternatives:
+                result=backup.status(root,110,only_needed=only_needed)
+            required.assert_called_once_with([110,111])
+            return result,path.call_count,alternatives.call_count
+
+    def test_local_room_avoids_saved_storage_and_alternative_queries(self):
+        result,saved,alternatives=self.status(200,saved_free=1000)
+        self.assertTrue(result['fits']);self.assertEqual((saved,alternatives),(0,0))
+
+    def test_saved_destination_that_fits_avoids_alternative_queries(self):
+        result,saved,alternatives=self.status(50,saved_free=200)
+        self.assertTrue(result['saved_fits']);self.assertEqual((saved,alternatives),(1,0))
+
+    def test_when_neither_fits_all_available_destinations_are_checked(self):
+        result,saved,alternatives=self.status(50,saved_free=40)
+        self.assertFalse(result['fits']);self.assertFalse(result['saved_fits'])
+        self.assertEqual(result['candidates'],[{'storage':'enough','free':200}])
+        self.assertEqual(alternatives,1)
+
+    def test_missing_saved_storage_still_offers_alternatives(self):
+        result,saved,alternatives=self.status(50)
+        self.assertEqual(result['candidates'],[{'storage':'enough','free':200}])
+        self.assertEqual(alternatives,1)
+
+    def test_complete_status_keeps_legacy_fields_and_all_candidates(self):
+        result,saved,alternatives=self.status(200,saved_free=300,only_needed=False)
+        self.assertTrue(result['fits']);self.assertTrue(result['saved_fits'])
+        self.assertEqual((saved,alternatives),(1,1))
+        self.assertEqual(result['candidates'],[{'storage':'enough','free':200}])
+
+
+class RemovalPreviewTests(unittest.TestCase):
+    def preview(self,reader):
+        record={'vmid':110,'deployment':{},'template':{'catalog_ui':{'title':'Example'}}}
+        with patch.object(remover,'members_of',return_value=(110,record,[110])), \
+                patch.object(instances,'read',return_value=record), \
+                patch.object(menu,'_selected_configuration',side_effect=reader), \
+                patch.object(remover,'guest_config',side_effect=AssertionError('Duplicate pct process')), \
+                patch.object(remover,'host_directories',return_value=[]), \
+                patch.object(remover,'private_bridge',return_value=None):
+            return menu._removal_summary(ROOT,110)
+
+    def test_preview_reuses_verified_config_and_keeps_volume_and_host_path_details(self):
+        config=b'hostname: example\nrootfs: local:subvol-110-disk-0,size=8G\nmp0: /mnt/media,mp=/media,backup=0\n'
+        text=self.preview(lambda v:config)
+        self.assertIn('8G',text);self.assertIn('/mnt/media',text)
+        self.assertIn('not targeted for removal',text)
+
+    def test_missing_guest_can_still_be_reviewed_without_a_second_probe(self):
+        text=self.preview(lambda v:(_ for _ in ()).throw(RuntimeError('guest missing')))
+        self.assertIn('CT 110',text);self.assertIn('rootfs -',text)
+
+
+if __name__=='__main__':unittest.main()
diff --git a/oci/tests/test_modify_image_reuse.py b/oci/tests/test_modify_image_reuse.py
new file mode 100644
index 00000000..01d475c0
--- /dev/null
+++ b/oci/tests/test_modify_image_reuse.py
@@ -0,0 +1,338 @@
+"""Unchanged OCI images permit native resource edits or verified local reuse."""
+import copy
+import hashlib
+import json
+from pathlib import Path
+import re
+import stat
+import sys
+import tempfile
+import unittest
+from unittest.mock import Mock, patch
+
+ROOT = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(ROOT/'remote'))
+import oci_carried_record
+import oci_instances as instances
+import oci_resource_modify as resources
+import oci_update_current as update
+
+DIGEST = 'sha256:'+'a'*64
+NEW = 'sha256:'+'b'*64
+IDENTITY = '11111111-1111-4111-8111-111111111111'
+CONFIG = (f'arch: amd64\ncores: 2\ndescription: proxmenux-instance={IDENTITY}\n'
+          'memory: 512\nrootfs: local-zfs:subvol-115-disk-0,size=8G\n'
+          'lxc.environment.runtime: A=one\nlxc.environment.runtime: B=two\n').encode()
+
+
+def record():
+    return {'schema_version': 1, 'vmid': 115, 'installation_id': IDENTITY, 'status': 'installed',
+            'template': {'id': 'example-app', 'catalog_ui': {'title': 'Example'},
+                'container_contract': {'image': {'reference': 'example/app:latest'}},
+                'proxmox': {'installer_profile': {'startup_healthcheck': {'type': 'running'}}}},
+            'deployment': {'vmid': 115, 'hostname': 'example', 'template_storage': 'local',
+                'resources': {'cores': 2, 'memory_mb': 512, 'swap_mb': 512},
+                'network': {'bridge': 'vmbr0', 'ipv4': 'dhcp'}, 'mounts': [], 'devices': [],
+                'environment': [{'name': 'PASSWORD', 'value': 'private-test-value', 'sensitive': True}]},
+            'observed': {'config': CONFIG.decode(), 'config_sha256': resources.sha(CONFIG),
+                'image': {'manifest_digest': DIGEST, 'architecture': 'amd64', 'os': 'linux'},
+                'resolved_registry_digest': DIGEST, 'archive_path': '/missing/deleted-image.tar'}}
+
+
+class ResourceModifyTests(unittest.TestCase):
+    def setUp(self):
+        self.temp = tempfile.TemporaryDirectory()
+        self.addCleanup(self.temp.cleanup)
+        self.root = Path(self.temp.name)/'instances'
+        self.configs = Path(self.temp.name)/'configs'
+        self.configs.mkdir()
+        self.file = self.configs/'115.conf'
+        self.file.write_bytes(CONFIG)
+        self.saved = record()
+        self.candidate = copy.deepcopy(self.saved)
+        self.candidate['deployment']['resources'].update(cores=3, memory_mb=768)
+        self.params = {'cores': '3', 'memory': '768'}
+        instances.write(instances.location(self.root, 115), self.saved)
+        self.calls = []
+        self.native_failure = None
+        def run(*args):
+            self.calls.append(args)
+            self.assertEqual(args[:3], ('pct', 'set', '115'))
+            expected = args[args.index('--digest')+1]
+            self.assertEqual(expected, hashlib.sha1(self.file.read_bytes()).hexdigest())
+            if self.native_failure:
+                raise self.native_failure
+            text = self.file.read_text()
+            for index in range(5, len(args), 2):
+                text = re.sub(r'^'+args[index][2:]+r': .*$', args[index][2:]+': '+args[index+1], text, flags=re.M)
+            self.file.write_text(text)
+            return b''
+        def observe(*args):
+            result = copy.deepcopy(self.saved['observed'])
+            result.update(config=self.file.read_text(), config_sha256=resources.sha(self.file.read_bytes()))
+            return result
+        patches = [patch.object(resources, 'CONFIG_DIR', self.configs),
+            patch.object(instances, 'command', side_effect=lambda *args: self.file.read_bytes()),
+            patch.object(resources.transaction, 'run', side_effect=run),
+            patch.object(resources.transaction, 'open_log'), patch.object(resources.transaction, 'log'),
+            patch.object(instances, 'observe', side_effect=observe),
+            patch.object(oci_carried_record, 'carry', return_value='carried')]
+        for p in patches:
+            p.start()
+            self.addCleanup(p.stop)
+
+    def apply(self):
+        return resources.apply(self.root, self.saved, self.candidate, CONFIG, self.params)
+
+    def test_resource_only_change_needs_no_archive_and_preserves_every_other_field(self):
+        directory = self.apply()
+        after = instances.read(self.root, 115)
+        self.assertEqual(after['deployment']['resources'], {'cores': 3, 'memory_mb': 768, 'swap_mb': 512})
+        for key in ('network', 'mounts', 'devices', 'environment'):
+            self.assertEqual(after['deployment'][key], self.saved['deployment'][key])
+        self.assertEqual(after['observed']['image'], self.saved['observed']['image'])
+        self.assertEqual(after['observed']['archive_path'], '/missing/deleted-image.tar')
+        self.assertEqual(after['observed']['config_sha256'], resources.sha(self.file.read_bytes()))
+        self.assertNotIn('pending_transaction', after)
+        self.assertEqual(len(self.calls), 1)
+        self.assertEqual(stat.S_IMODE((directory/'before.json').stat().st_mode), 0o600)
+        self.assertEqual(json.loads((directory/'before.json').read_text())['record'], self.saved)
+        self.assertNotIn('private-test-value', str(self.calls))
+
+    def test_network_environment_template_and_extra_device_edits_use_the_normal_installer(self):
+        for mutate in (
+            lambda c: c['deployment']['network'].update(ipv4='192.0.2.2/24'),
+            lambda c: c['deployment']['environment'][0].update(value='changed'),
+            lambda c: c['template']['container_contract']['image'].update(reference='example/app:other'),
+            lambda c: c['deployment']['devices'].append({'host_path': '/dev/ttyACM0'}),
+            lambda c: c['deployment']['resources'].update(swap_mb=1024),
+        ):
+            candidate = copy.deepcopy(self.candidate)
+            mutate(candidate)
+            self.assertIsNone(resources.changes(self.saved, candidate, CONFIG))
+
+    def test_invalid_values_and_unchanged_proposal_do_not_use_the_native_path(self):
+        for value in (True, 0, -1, 64, 128.5, '768'):
+            candidate = copy.deepcopy(self.saved)
+            candidate['deployment']['resources']['memory_mb'] = value
+            self.assertIsNone(resources.changes(self.saved, candidate, CONFIG))
+        self.assertIsNone(resources.changes(self.saved, copy.deepcopy(self.saved), CONFIG))
+
+    def test_cpu_limit_profile_stays_a_cpu_limit(self):
+        config = CONFIG.replace(b'cores: 2', b'cpulimit: 2')
+        self.assertEqual(resources.changes(self.saved, self.candidate, config), {'cpulimit': '3', 'memory': '768'})
+
+    def test_native_failure_leaves_saved_record_and_config_unchanged(self):
+        self.native_failure = RuntimeError('native API rejected edit')
+        with self.assertRaisesRegex(RuntimeError, 'rejected'):
+            self.apply()
+        self.assertEqual(self.file.read_bytes(), CONFIG)
+        self.assertEqual(instances.read(self.root, 115), self.saved)
+
+    def test_observation_failure_rolls_back_resource_values(self):
+        with patch.object(instances, 'observe', side_effect=RuntimeError('observation failed')):
+            with self.assertRaisesRegex(RuntimeError, 'observation failed'):
+                self.apply()
+        self.assertEqual(self.file.read_bytes(), CONFIG)
+        self.assertEqual(instances.read(self.root, 115), self.saved)
+        self.assertEqual(len(self.calls), 2)
+
+    def test_record_write_failure_rolls_back_resources(self):
+        real_write = instances.write
+        failed = False
+        def write(path, value):
+            nonlocal failed
+            if Path(path) == instances.location(self.root, 115) and not failed:
+                failed = True
+                raise OSError('record could not be saved')
+            real_write(path, value)
+        with patch.object(instances, 'write', side_effect=write):
+            with self.assertRaisesRegex(OSError, 'could not be saved'):
+                self.apply()
+        self.assertEqual(self.file.read_bytes(), CONFIG)
+        self.assertEqual(instances.read(self.root, 115), self.saved)
+
+    def test_configuration_drift_is_rejected_before_native_set(self):
+        self.file.write_bytes(CONFIG.replace(b'memory: 512', b'memory: 1024'))
+        with self.assertRaisesRegex(ValueError, 'changed'):
+            self.apply()
+        self.assertEqual(self.calls, [])
+
+    def test_repeated_environment_entries_are_all_preserved_by_the_guard(self):
+        changed = CONFIG.replace(b'cores: 2', b'cores: 3').replace(b'memory: 512', b'memory: 768')
+        self.assertTrue(resources.expected_config(CONFIG, changed, self.params))
+        self.assertFalse(resources.expected_config(CONFIG, changed.replace(b'A=one', b'A=foreign'), self.params))
+
+    def test_cpu_change_preserves_homepage_dns_timezone_and_cpu_priority(self):
+        extra = b'nameserver: 10.0.1.1\ntimezone: Europe/Madrid\ncpuunits: 100\n'
+        config = CONFIG + extra
+        self.file.write_bytes(config)
+        self.saved['observed'].update(config=config.decode(), config_sha256=resources.sha(config))
+        self.saved['deployment']['resources']['cpu_units'] = 100
+        self.candidate = copy.deepcopy(self.saved)
+        self.candidate['deployment']['resources']['cores'] = 3
+        instances.write(instances.location(self.root,115),self.saved)
+        resources.apply(self.root,self.saved,self.candidate,config,{'cores':'3'})
+        self.assertEqual(self.file.read_bytes(), config.replace(b'cores: 2',b'cores: 3'))
+        self.assertEqual(instances.read(self.root,115)['deployment']['resources']['cpu_units'],100)
+
+    def test_a_concurrent_unrelated_change_is_not_overwritten_during_rollback(self):
+        def observe(*args):
+            self.file.write_bytes(self.file.read_bytes().replace(b'A=one', b'A=foreign'))
+            raise RuntimeError('concurrent edit')
+        with patch.object(instances, 'observe', side_effect=observe), patch.object(resources, 'msg_warn') as warn:
+            with self.assertRaisesRegex(RuntimeError, 'concurrent edit'):
+                self.apply()
+        self.assertIn(b'A=foreign', self.file.read_bytes())
+        self.assertEqual(len(self.calls), 1)
+        warn.assert_called_once()
+        self.assertEqual(instances.read(self.root, 115), self.saved)
+
+    def test_a_carried_record_error_does_not_undo_the_successful_edit(self):
+        with patch.object(oci_carried_record, 'carry', side_effect=RuntimeError('copy unavailable')):
+            self.apply()
+        self.assertEqual(instances.read(self.root, 115)['deployment']['resources']['memory_mb'], 768)
+        self.assertEqual(len(self.calls), 1)
+
+
+class CachedArchiveTests(unittest.TestCase):
+    def setUp(self):
+        self.temp = tempfile.TemporaryDirectory()
+        self.addCleanup(self.temp.cleanup)
+        self.path = Path(self.temp.name)/'original-installation.tar'
+        self.path.write_bytes(b'fixture verified by stub')
+        self.desired = record()
+        self.image = {'manifest_digest': DIGEST}
+        self.candidate = dict(self.image, registry_digest=DIGEST)
+
+    def resolve(self, paths, image=None):
+        def run(args, error, capture=False):
+            self.assertNotEqual(args[0], 'skopeo', 'No layers should be downloaded')
+            return json.dumps(self.candidate) if '-c' in args else b''
+        with patch.object(update, 'run_quiet', side_effect=run), \
+                patch.object(update, 'image_from_archive', return_value=image or self.image), \
+                patch.object(instances, 'command') as command:
+            result = update.resolve_archive(self.desired, b'arch: amd64\n', local_archives=paths)
+        command.assert_not_called()
+        return result
+
+    def test_original_installation_archive_is_reused_without_update_cache_lookup(self):
+        self.assertEqual(self.resolve([self.path]), (self.path, DIGEST))
+
+    def test_invalid_original_cache_is_kept_and_a_second_matching_archive_is_reused(self):
+        other = self.path.with_name('other.tar')
+        other.write_bytes(b'second fixture')
+        def image(path):
+            return {'manifest_digest': NEW if str(path) == str(self.path) else DIGEST}
+        with patch.object(update, 'run_quiet', side_effect=lambda args, *a, **kw: json.dumps(self.candidate) if '-c' in args else b''), \
+                patch.object(update, 'image_from_archive', side_effect=image), \
+                patch.object(instances, 'command') as command:
+            result = update.resolve_archive(self.desired, b'arch: amd64\n', local_archives=[self.path, other])
+        self.assertEqual(result, (other, DIGEST))
+        self.assertTrue(self.path.exists())
+        command.assert_not_called()
+
+    def test_a_new_digest_downloads_once_instead_of_using_an_old_archive(self):
+        candidate = {'manifest_digest': NEW, 'registry_digest': NEW}
+        cached = self.path.with_name('update.tar')
+        copies = []
+        def run(args, *a, **kwargs):
+            if '-c' in args:
+                return json.dumps(candidate)
+            if args[0] == 'skopeo':
+                copies.append(args)
+                Path(args[-1].removeprefix('oci-archive:')).write_bytes(b'new verified fixture')
+            return b''
+        def image(path):
+            return {'manifest_digest': DIGEST if str(path) == str(self.path) else NEW}
+        with patch.object(update, 'run_quiet', side_effect=run), \
+                patch.object(update, 'image_from_archive', side_effect=image), \
+                patch.object(instances, 'command', return_value=str(cached).encode()), \
+                patch.object(update.work_backup, 'available', return_value=1024**4), \
+                patch.object(update.transaction, 'log'):
+            result = update.resolve_archive(self.desired, b'arch: amd64\n', local_archives=[self.path])
+        self.assertEqual(result, (cached, NEW))
+        self.assertEqual(len(copies), 1)
+        self.assertIn('docker://example/app@'+NEW, copies[0])
+        self.assertEqual(self.path.read_bytes(), b'fixture verified by stub')
+
+    def test_a_broken_or_symlink_original_cache_does_not_hide_a_valid_update_cache(self):
+        cached = self.path.with_name('update.tar')
+        cached.write_bytes(b'valid update fixture')
+        link = self.path.with_name('link.tar')
+        link.symlink_to(self.path)
+        verified = []
+        def run(args, *a, **kwargs):
+            if '-c' in args:
+                return json.dumps(self.candidate)
+            self.assertNotEqual(args[0], 'skopeo')
+            verified.append(Path(args[-1]))
+            if Path(args[-1]) == self.path:
+                raise RuntimeError('corrupt archive')
+            return b''
+        with patch.object(update, 'run_quiet', side_effect=run), \
+                patch.object(update, 'image_from_archive', return_value=self.image), \
+                patch.object(instances, 'command', return_value=str(cached).encode()):
+            result = update.resolve_archive(self.desired, b'arch: amd64\n', local_archives=[link, self.path])
+        self.assertEqual(result, (cached, DIGEST))
+        self.assertNotIn(link, verified)
+        self.assertTrue(link.is_symlink())
+        self.assertTrue(self.path.exists())
+
+
+class UpdateRoutingTests(unittest.TestCase):
+    def run_update(self, new_image=False, resource_edit=True, reject_recreation=False):
+        saved = record()
+        candidate = copy.deepcopy(saved)
+        candidate['deployment']['resources']['memory_mb'] = 768
+        if not resource_edit:
+            candidate['deployment']['environment'][0]['value'] = 'changed'
+            candidate['template']['container_contract']['image']['reference'] = 'example/app:other'
+        proposal = {'operation': 'recreate', 'candidate': candidate}
+        import contextlib, oci_operation_notice
+        with patch.object(instances, 'locked', return_value=contextlib.nullcontext()), \
+                patch.object(instances, 'read', return_value=saved), \
+                patch.object(instances, 'command', return_value=CONFIG), \
+                patch.object(update.transaction, 'candidate_contract', return_value=candidate), \
+                patch.object(update.transaction, 'external_changes', return_value={}), \
+                patch.object(update.transaction, 'preflight', side_effect=ValueError('advanced Proxmox settings') if reject_recreation else None), \
+                patch.object(update, 'resolve_archive', return_value=(Path('/new.tar') if new_image or not resource_edit else None, NEW if new_image else DIGEST)) as resolve, \
+                patch.object(resources, 'apply') as apply_resources, \
+                patch.object(update.transaction, 'apply') as apply_image, \
+                patch.object(oci_operation_notice, 'operation', return_value=contextlib.nullcontext()):
+            update.update(115, proposal=proposal)
+        return resolve, apply_resources, apply_image
+
+    def test_unchanged_image_routes_cpu_ram_edits_to_the_existing_guest(self):
+        resolve, native, image = self.run_update()
+        resolve.assert_not_called()
+        native.assert_called_once()
+        image.assert_not_called()
+
+    def test_a_new_image_for_other_configuration_changes_uses_verified_recreation(self):
+        _resolve, native, image = self.run_update(new_image=True,resource_edit=False)
+        native.assert_not_called()
+        image.assert_called_once()
+
+    def test_cpu_edits_do_not_implicitly_upgrade_the_image(self):
+        resolve,native,image=self.run_update(new_image=True)
+        resolve.assert_not_called()
+        native.assert_called_once()
+        image.assert_not_called()
+
+    def test_homepage_resource_edit_does_not_run_the_recreation_preflight(self):
+        resolve,native,image=self.run_update(reject_recreation=True)
+        resolve.assert_not_called()
+        native.assert_called_once()
+        image.assert_not_called()
+
+    def test_other_modifications_offer_the_recorded_archive_to_the_resolver(self):
+        resolve, native, image = self.run_update(resource_edit=False)
+        self.assertIsNone(resolve.call_args.args[2])
+        self.assertEqual(resolve.call_args.kwargs['local_archives'], ['/missing/deleted-image.tar'])
+        native.assert_not_called()
+        image.assert_called_once()
+
+
+if __name__ == '__main__':
+    unittest.main()
diff --git a/oci/tests/test_modify_latency.py b/oci/tests/test_modify_latency.py
new file mode 100644
index 00000000..f08359a5
--- /dev/null
+++ b/oci/tests/test_modify_latency.py
@@ -0,0 +1,103 @@
+"""Opening Modify avoids backup probes while preserving operation safeguards."""
+from pathlib import Path
+import sys
+import unittest
+from unittest.mock import Mock,patch
+ROOT=Path(__file__).resolve().parents[1]
+sys.path[:0]=[str(ROOT/'src'),str(ROOT/'remote')]
+from proxmenux_oci import management as menu,recreation
+import oci_carried_record as carried
+import oci_instances as instances
+import oci_instance_reconcile as reconcile
+from proxmenux_oci.ui import UserCancelled
+
+
+def record():
+    return {'vmid': 115, 'installation_id': 'test-installation', 'status': 'installed',
+            'observed': {'config_sha256': 'native-config-fingerprint'},
+            'template': {'id': 'example-app', 'catalog_ui': {'title': 'Example'},
+                         'container_contract': {'image': {'reference': 'example/app:latest'}},
+                         'proxmox': {'installer_profile': {}}},
+            'deployment': {'vmid': 115, 'hostname': 'example', 'resources': {'cores': 2, 'memory_mb': 512},
+                           'network': {'bridge': 'vmbr0', 'ipv4': 'dhcp', 'gateway': None},
+                           'rootfs': {'storage': 'local-zfs', 'size_gb': 8}, 'mounts': [
+                               {'container_path': '/data', 'source': 'local-zfs',
+                                'type': 'managed-volume', 'size_gb': 8, 'backup': True}],
+                           'devices': [], 'security': {'unprivileged': True},
+                           'environment': [{'name': 'PASSWORD', 'value': 'private-test-secret',
+                                            'sensitive': True}]}}
+
+
+class SelectedConfigTests(unittest.TestCase):
+    def test_valid_source_keyed_cache_avoids_another_pct_process(self):
+        with patch.object(carried,'configuration',create=True,return_value='description: current\n') as reader, \
+                patch.object(instances,'command') as command:
+            self.assertEqual(menu._selected_configuration(115),b'description: current\n')
+        reader.assert_called_once_with(instances.ROOT,115)
+        command.assert_not_called()
+
+    def test_old_or_unavailable_cache_falls_back_to_pct(self):
+        for reader in (None,Mock(return_value=None),Mock(return_value={}),Mock(side_effect=OSError('cache unavailable'))):
+            with self.subTest(reader=reader),patch.object(carried,'configuration',reader,create=True), \
+                    patch.object(instances,'command',return_value=b'live config') as command:
+                self.assertEqual(menu._selected_configuration(115),b'live config')
+                command.assert_called_once_with('pct','config','115')
+
+    def test_identity_check_is_still_performed_on_the_selected_config(self):
+        r=record();r['installation_id']='11111111-1111-4111-8111-111111111111'
+        import contextlib
+        with patch.object(instances,'locked',return_value=contextlib.nullcontext()), \
+                patch.object(instances,'read',return_value=r), \
+                patch.object(menu,'_selected_configuration',return_value=b'description: another container\n'):
+            self.assertEqual(menu.check_selected(ROOT,{'vmid':115})['reason'],'identity-unconfirmed')
+
+
+class EditorLatencyTests(unittest.TestCase):
+    def run_editor(self,proposal=None,backup_ready=True,stale=False,adoption_error=False,approved=True,declined=False):
+        events=[];saved=record()
+        row={'vmid':115,'reason':'matched','stack':False,'pending':False,'status':'installed'}
+        def edit(*a,**kw):
+            events.append('editor')
+            if declined:return None
+            if proposal is None:raise UserCancelled()
+            return proposal
+        def backup(*a,**kw):events.append('backup');return backup_ready
+        ui=Mock();ui.unattended=True;ui.review.return_value=approved
+        with patch.object(menu,'carry_records',return_value={115:'stale'} if stale else {}) as verify, \
+                patch.object(menu,'check_selected',return_value=row), \
+                patch.object(menu,'_selected_configuration',return_value=b'current config'), \
+                patch.object(instances,'read',return_value=saved), \
+                patch.object(reconcile,'propose',side_effect=ValueError('external changes') if adoption_error else None,return_value=None), \
+                patch.object(recreation,'edit_recreation',side_effect=edit), \
+                patch.object(menu,'_work_backup_ready',side_effect=backup), \
+                patch.object(menu,'_run_lifecycle',side_effect=lambda *a:events.append('lifecycle') or True):
+            try:result=menu.manage_instance(ROOT,ui,row,action='modify')
+            except UserCancelled:result=False
+        verify.assert_called_once_with(ROOT,vmids=[115],verify=True)
+        return result,events
+
+    def test_open_and_cancel_has_no_backup_or_storage_probes(self):
+        result,events=self.run_editor()
+        self.assertFalse(result);self.assertEqual(events,['editor'])
+
+    def test_declining_the_review_has_no_backup_or_storage_probes(self):
+        # The review is part of the Modify menu: declining it and leaving the
+        # menu returns no proposal, so no probe or operation follows.
+        result,events=self.run_editor(declined=True)
+        self.assertFalse(result);self.assertEqual(events,['editor'])
+
+    def test_confirmed_edit_keeps_backup_check_before_the_lifecycle(self):
+        result,events=self.run_editor({'operation':'recreate','candidate':record()})
+        self.assertTrue(result);self.assertEqual(events,['editor','backup','lifecycle'])
+
+    def test_missing_backup_space_still_prevents_the_lifecycle(self):
+        result,events=self.run_editor({'operation':'recreate','candidate':record()},backup_ready=False)
+        self.assertFalse(result);self.assertEqual(events,['editor','backup'])
+
+    def test_restored_or_conflicting_instance_cannot_enter_editor(self):
+        for options in ({'stale':True},{'adoption_error':True}):
+            result,events=self.run_editor(**options)
+            self.assertFalse(result);self.assertEqual(events,[])
+
+
+if __name__=='__main__':unittest.main()
diff --git a/oci/tests/test_modify_menu.py b/oci/tests/test_modify_menu.py
new file mode 100644
index 00000000..0f80a0a7
--- /dev/null
+++ b/oci/tests/test_modify_menu.py
@@ -0,0 +1,223 @@
+"""Selective OCI edits stay in a draft until reviewed, then use one transaction."""
+import copy
+import json
+from pathlib import Path
+import stat
+import sys
+import unittest
+from unittest.mock import Mock, patch
+
+ROOT = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(ROOT / 'src'))
+sys.path.insert(0, str(ROOT / 'remote'))
+
+from proxmenux_oci import management, recreation
+from proxmenux_oci.ui import BackRequested, UserCancelled
+
+
+def record():
+    return {'vmid': 115, 'installation_id': 'test-installation', 'status': 'installed',
+            'observed': {'config_sha256': 'native-config-fingerprint'},
+            'template': {'id': 'example-app', 'catalog_ui': {'title': 'Example'},
+                         'container_contract': {'image': {'reference': 'example/app:latest'}},
+                         'proxmox': {'installer_profile': {}}},
+            'deployment': {'vmid': 115, 'hostname': 'example', 'resources': {'cores': 2, 'memory_mb': 512},
+                           'network': {'bridge': 'vmbr0', 'ipv4': 'dhcp', 'gateway': None},
+                           'rootfs': {'storage': 'local-zfs', 'size_gb': 8}, 'mounts': [
+                               {'container_path': '/data', 'source': 'local-zfs',
+                                'type': 'managed-volume', 'size_gb': 8, 'backup': True}],
+                           'devices': [], 'security': {'unprivileged': True},
+                           'environment': [{'name': 'PASSWORD', 'value': 'private-test-secret',
+                                            'sensitive': True}]}}
+
+
+class MenuUI:
+    def __init__(self, choices, answers=(), reviews=(True,), confirms=()):
+        self.choices, self.answers = iter(choices), iter(answers)
+        self.reviews, self.confirms = iter(reviews), iter(confirms)
+        self.events = []
+        self.back_enabled = False
+
+    def choose(self, text, options, default=None, **kwargs):
+        self.events.append(('menu', text, dict(options)))
+        value = next(self.choices)
+        if value is not None:
+            assert value in dict(options), value
+        return value
+
+    def ask(self, text, default=None, **kwargs):
+        self.events.append(('ask', text, default))
+        value = next(self.answers)
+        if isinstance(value, Exception):
+            raise value
+        return value
+
+    def confirm(self, text, default=False):
+        self.events.append(('confirm', text))
+        return next(self.confirms)
+
+    def review(self, text, *args, **kwargs):
+        self.events.append(('review', text))
+        return next(self.reviews)
+
+    def message(self, text, *args):
+        self.events.append(('message', text))
+
+
+@patch('proxmenux_oci.i18n.language', return_value='en')
+class ModifyMenuTests(unittest.TestCase):
+    def test_ram_only_does_not_ask_about_cpu_network_paths_devices_or_catalog(self, _language):
+        original = record()
+        saved = copy.deepcopy(original)
+        ui = MenuUI(['memory', 'apply'], ['768'])
+        with patch.object(recreation, 'refresh_template') as refresh:
+            result = recreation.edit_recreation(original, ui)
+        self.assertEqual(result['candidate']['deployment']['resources'], {'cores': 2, 'memory_mb': 768})
+        self.assertEqual([e[1] for e in ui.events if e[0] == 'ask'], ['RAM in MiB'])
+        self.assertEqual(result['base_config_sha256'], 'native-config-fingerprint')
+        self.assertEqual(original, saved)
+        refresh.assert_not_called()
+        self.assertFalse(ui.back_enabled)
+
+    def test_several_sections_and_revisits_keep_the_current_draft(self, _language):
+        ui = MenuUI(['memory', 'cores', 'memory', 'apply'], ['768', '3', '1024'])
+        result = recreation.edit_recreation(record(), ui)
+        self.assertEqual(result['candidate']['deployment']['resources'], {'cores': 3, 'memory_mb': 1024})
+        self.assertEqual([e[2] for e in ui.events if e[0] == 'ask'], ['512', '2', '768'])
+        self.assertEqual(sum(e[0] == 'review' for e in ui.events), 1)
+
+    def test_declining_review_returns_to_menu_without_losing_edits(self, _language):
+        ui = MenuUI(['cores', 'apply', 'memory', 'apply'], ['3', '768'], reviews=[False, True])
+        result = recreation.edit_recreation(record(), ui)
+        self.assertEqual(result['candidate']['deployment']['resources'], {'cores': 3, 'memory_mb': 768})
+        self.assertEqual(sum(e[0] == 'review' for e in ui.events), 2)
+
+    def test_unchanged_apply_does_not_propose_recreating_the_guest(self, _language):
+        ui = MenuUI(['memory', 'apply'], ['512'])
+        self.assertIsNone(recreation.edit_recreation(record(), ui))
+        self.assertFalse(any(e[0] == 'review' for e in ui.events))
+        self.assertIn(('message', 'Nothing was changed.'), ui.events)
+
+    def test_discard_leaves_the_saved_record_untouched(self, _language):
+        original = record()
+        saved = copy.deepcopy(original)
+        ui = MenuUI(['memory', 'discard'], ['768'], confirms=[True])
+        self.assertIsNone(recreation.edit_recreation(original, ui))
+        self.assertEqual(original, saved)
+        self.assertFalse(any(e[0] == 'review' for e in ui.events))
+
+    def test_declining_discard_preserves_the_draft(self, _language):
+        ui = MenuUI(['memory', None, 'apply'], ['768'], confirms=[False])
+        result = recreation.edit_recreation(record(), ui)
+        self.assertEqual(result['candidate']['deployment']['resources']['memory_mb'], 768)
+
+    def test_cancel_without_changes_asks_nothing_else(self, _language):
+        ui = MenuUI([None])
+        self.assertIsNone(recreation.edit_recreation(record(), ui))
+        self.assertEqual(len(ui.events), 1)
+
+    def test_invalid_ram_is_retried_without_restarting_other_sections(self, _language):
+        ui = MenuUI(['cores', 'memory', 'apply'], ['3', 'invalid', '64', '768'])
+        result = recreation.edit_recreation(record(), ui)
+        self.assertEqual(result['candidate']['deployment']['resources'], {'cores': 3, 'memory_mb': 768})
+        self.assertEqual(sum(e[0] == 'message' for e in ui.events), 2)
+        self.assertEqual(sum(e[:2] == ('ask', 'Cores') for e in ui.events), 1)
+
+    def test_back_from_first_field_returns_to_menu_and_keeps_other_edits(self, _language):
+        ui = MenuUI(['cores', 'memory', 'apply'], ['3', BackRequested()])
+        result = recreation.edit_recreation(record(), ui)
+        self.assertEqual(result['candidate']['deployment']['resources'], {'cores': 3, 'memory_mb': 512})
+        self.assertFalse(ui.back_enabled)
+
+    def test_cancelling_a_partly_edited_section_rolls_back_only_that_section(self, _language):
+        real_edit = recreation.edit_setting
+        def edit(candidate, ui, setting):
+            if setting == 'environment':
+                candidate['deployment']['environment'][0]['value'] = 'partial-value'
+                raise UserCancelled()
+            real_edit(candidate, ui, setting)
+        ui = MenuUI(['cores', 'environment', 'apply'], ['3'])
+        with patch.object(recreation, 'edit_setting', side_effect=edit):
+            result = recreation.edit_recreation(record(), ui)
+        self.assertEqual(result['candidate']['deployment']['resources']['cores'], 3)
+        self.assertEqual(result['candidate']['deployment']['environment'], record()['deployment']['environment'])
+
+    def test_menu_and_review_do_not_expose_a_saved_secret(self, _language):
+        ui = MenuUI(['cores', 'apply'], ['3'])
+        recreation.edit_recreation(record(), ui)
+        self.assertNotIn('private-test-secret', json.dumps(ui.events))
+
+    def test_extra_paths_counts_only_paths_added_by_hand(self, _language):
+        candidate = record()
+        self.assertTrue(dict(recreation.modification_options(candidate))['paths'].rstrip().endswith(' 0'))
+        candidate['deployment']['mounts'].append({'container_path': '/media-extra', 'type': 'host-bind',
+                                                  'source': '/mnt/media', 'custom': True})
+        self.assertTrue(dict(recreation.modification_options(candidate))['paths'].rstrip().endswith(' 1'))
+
+    def test_optional_categories_follow_the_application_profile(self, _language):
+        candidate = record()
+        options = dict(recreation.modification_options(candidate))
+        self.assertTrue({'cores', 'memory', 'network', 'paths', 'devices', 'environment', 'catalog', 'apply'} <= options.keys())
+        self.assertFalse({'shares', 'acceleration', 'detector'} & options.keys())
+        candidate['template']['proxmox']['installer_profile'] = {
+            'shared_directories': {'base_path': '/shares'}, 'object_detector': {'devices': []},
+            'hardware_acceleration': {'profiles': [{'id': 'intel', 'label': 'Intel GPU'}]}}
+        candidate['deployment']['hardware_profile'] = 'intel'
+        options = dict(recreation.modification_options(candidate))
+        self.assertTrue({'shares', 'acceleration', 'detector'} <= options.keys())
+        self.assertIn('Intel GPU', options['acceleration'])
+
+
+class ModifyDispatchTests(unittest.TestCase):
+    def call_manager(self, proposal, lifecycle, ui=None, offer=None):
+        import oci_instances
+        import oci_instance_reconcile
+        saved = record()
+        row = {'vmid': 115, 'reason': 'matched', 'stack': False, 'pending': False, 'status': 'installed'}
+        with patch.object(management.images, 'offer_removal', offer or Mock()), \
+                patch.object(management, 'carry_records', return_value={}), \
+                patch.object(management, 'check_selected', return_value=row), \
+                patch.object(management, '_work_backup_ready', return_value=True), \
+                patch.object(oci_instances, 'read', return_value=saved), \
+                patch.object(oci_instances, 'command', return_value='hostname: example'), \
+                patch.object(oci_instance_reconcile, 'propose', return_value=None), \
+                patch.object(recreation, 'edit_recreation', return_value=proposal), \
+                patch.object(management, '_run_lifecycle', side_effect=lifecycle):
+            return management.manage_instance(ROOT, ui or Mock(), row, action='modify')
+
+    def test_cancel_does_not_start_a_lifecycle_transaction(self):
+        lifecycle = Mock()
+        self.assertFalse(self.call_manager(None, lifecycle))
+        lifecycle.assert_not_called()
+
+    def test_apply_sends_one_private_proposal_to_the_existing_backend(self):
+        proposal = {'operation': 'recreate', 'candidate': record(), 'base_config_sha256': 'fingerprint'}
+        seen = []
+        def lifecycle(command, title):
+            path = Path(command[command.index('--proposal') + 1])
+            seen.append(json.loads(path.read_text()))
+            self.assertEqual(stat.S_IMODE(path.stat().st_mode), 0o600)
+            self.assertNotIn('private-test-secret', ' '.join(command))
+            self.assertIn('oci_update_current.py', command[1])
+            self.assertIn('--acknowledge-external-data', command)
+            return True
+        self.assertTrue(self.call_manager(proposal, lifecycle))
+        self.assertEqual(seen, [proposal])
+
+    def test_the_image_question_only_follows_a_recreated_container(self):
+        proposal = {'operation': 'recreate', 'candidate': record(), 'base_config_sha256': 'fingerprint'}
+        ui = Mock(unattended=False)
+        for recreated in (False, True):
+            with self.subTest(recreated=recreated):
+                def lifecycle(command, title):
+                    if recreated:
+                        Path(management.os.environ['OCI_RECREATED_MARKER']).touch()
+                    return True
+                offer = Mock()
+                self.assertTrue(self.call_manager(proposal, lifecycle, ui, offer))
+                self.assertEqual(offer.called, recreated)
+                self.assertNotIn('OCI_RECREATED_MARKER', management.os.environ)
+
+
+if __name__ == '__main__':
+    unittest.main()
diff --git a/oci/tests/test_modify_review.py b/oci/tests/test_modify_review.py
new file mode 100644
index 00000000..e9d4e41d
--- /dev/null
+++ b/oci/tests/test_modify_review.py
@@ -0,0 +1,219 @@
+"""Maintainer review: fallback, complete mount edits and retained unused disks."""
+import contextlib
+import copy
+from pathlib import Path
+import re
+import sys
+import tempfile
+import unittest
+from unittest.mock import patch
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[1]/'remote'))
+import oci_instances as instances
+import oci_instance_transaction as transaction
+import oci_native_modify as native
+import oci_update_current as update
+import oci_operation_notice
+from test_modify_image_reuse import record, CONFIG
+
+
+def installation():
+    result=record()
+    result['deployment'].update(rootfs={'storage':'local-zfs','size_gb':8}, onboot=True,
+                               security={'unprivileged':True})
+    result['observed']['image']['defaults']={}
+    config=CONFIG+b'unprivileged: 1\nonboot: 1\nnet0: name=eth0,bridge=vmbr0,ip=dhcp,hwaddr=AA:BB:CC:DD:EE:FF\n'
+    result['observed'].update(config=config.decode(), config_sha256=transaction.sha(config))
+    return result,config
+
+
+class FallbackTests(unittest.TestCase):
+    def test_all_installer_adaptations_fall_back_before_any_native_write(self):
+        saved,config=installation()
+        def nvidia(c):c['deployment']['devices']=[{'kind':'nvidia-runtime','host_path':'/dev/nvidia0'}]
+        def groups(c):c['deployment']['devices']=[{'host_path':'/dev/dri/renderD128','append_host_device_gid_to_environment':'GROUPS'}]
+        def permissions(c):
+            c['deployment']['devices']=[{'host_path':'/dev/dri/renderD128'}]
+            c['deployment']['device_permissions']={'uid':1000}
+        mutations=[nvidia,groups,permissions,
+            lambda c:c['deployment'].update(completion_notes=['Installer note']),
+            lambda c:c['deployment'].update(post_start_configurations=[{'id':'adapter'}]),
+            lambda c:c['template']['catalog_ui'].update(title='Refreshed catalog template'),
+            lambda c:c['deployment'].update(mounts=[{'type':'host-bind','source':'/host/file','container_path':'/config/file','backup':False,'size_gb':None}])]
+        for mutation in mutations:
+            with self.subTest(mutation=mutation),tempfile.TemporaryDirectory() as folder:
+                candidate=copy.deepcopy(saved);mutation(candidate)
+                root=Path(folder);instances.write(instances.location(root,115),saved)
+                with patch.object(instances,'ROOT',root),patch.object(instances,'locked',return_value=contextlib.nullcontext()), \
+                        patch.object(instances,'command',return_value=config), \
+                        patch.object(transaction,'external_changes',return_value={}),patch.object(transaction,'preflight'), \
+                        patch.object(transaction,'is_file_bind',side_effect=lambda m:m.get('source')=='/host/file'), \
+                        patch.object(native,'apply',side_effect=AssertionError('partial native apply')), \
+                        patch.object(update,'resolve_archive',return_value=(Path('/cached.tar'),'sha256:resolved')) as resolve, \
+                        patch.object(transaction,'apply') as recreate, \
+                        patch.object(oci_operation_notice,'operation',return_value=contextlib.nullcontext()):
+                    update.update(115,proposal={'operation':'recreate','candidate':candidate})
+                recreate.assert_called_once();resolve.assert_called_once()
+                self.assertEqual(resolve.call_args.kwargs['local_archives'],[saved['observed']['archive_path']])
+
+    def test_native_validation_failure_never_falls_back_to_recreation(self):
+        saved,config=installation();candidate=copy.deepcopy(saved)
+        candidate['deployment']['environment']=[{'name':'INVALID NAME','value':'value'}]
+        with tempfile.TemporaryDirectory() as folder:
+            root=Path(folder);instances.write(instances.location(root,115),saved)
+            with patch.object(instances,'ROOT',root),patch.object(instances,'locked',return_value=contextlib.nullcontext()), \
+                    patch.object(instances,'command',return_value=config), \
+                    patch.object(transaction,'preflight'),patch.object(transaction,'external_changes',return_value={}), \
+                    patch.object(transaction,'apply') as recreate,patch.object(update,'resolve_archive') as resolve, \
+                    patch.object(oci_operation_notice,'operation',return_value=contextlib.nullcontext()):
+                with self.assertRaises(ValueError):update.update(115,proposal={'operation':'recreate','candidate':candidate})
+            recreate.assert_not_called();resolve.assert_not_called()
+
+    def test_native_api_failure_never_falls_back_after_starting_the_edit(self):
+        saved,config=installation();candidate=copy.deepcopy(saved)
+        candidate['deployment']['environment']=[{'name':'VALID','value':'value'}]
+        with tempfile.TemporaryDirectory() as folder:
+            root=Path(folder);instances.write(instances.location(root,115),saved)
+            with patch.object(instances,'ROOT',root),patch.object(instances,'locked',return_value=contextlib.nullcontext()), \
+                    patch.object(instances,'command',return_value=config), \
+                    patch.object(transaction,'preflight'),patch.object(transaction,'external_changes',return_value={}), \
+                    patch.object(transaction,'apply') as recreate,patch.object(update,'resolve_archive') as resolve, \
+                    patch.object(native,'apply',side_effect=RuntimeError('native API failed')), \
+                    patch.object(oci_operation_notice,'operation',return_value=contextlib.nullcontext()):
+                with self.assertRaisesRegex(RuntimeError,'native API failed'):
+                    update.update(115,proposal={'operation':'recreate','candidate':candidate})
+            recreate.assert_not_called();resolve.assert_not_called()
+
+
+class MountTests(unittest.TestCase):
+    def setUp(self):
+        self.record,self.config=installation()
+        self.mount={'type':'host-bind','source':'/mnt/old','container_path':'/media',
+                    'size_gb':None,'backup':False,'read_only':False,'create_if_missing':False}
+        self.record['deployment']['mounts']=[self.mount]
+        self.config+=b'mp3: /mnt/old,mp=/media,backup=0,ro=0,replicate=0\n'
+        self.record['observed'].update(config=self.config.decode(),config_sha256=transaction.sha(self.config))
+        self.candidate=copy.deepcopy(self.record)
+
+    def test_existing_bind_source_and_flags_are_applied_with_other_options_preserved(self):
+        self.candidate['deployment']['mounts'][0].update(source='/mnt/new',read_only=True)
+        with patch.object(Path,'is_dir',return_value=True):
+            plan=native.plan(self.record,self.candidate,self.config)
+        self.assertEqual(plan['values'],{'mp3':'/mnt/new,mp=/media,backup=0,ro=1,replicate=0'})
+        self.assertTrue(plan['restart']);self.assertEqual(plan['delete'],[])
+
+    def test_missing_replacement_directory_is_rejected_unless_creation_was_requested(self):
+        self.candidate['deployment']['mounts'][0]['source']='/mnt/new'
+        with patch.object(Path,'is_dir',return_value=False):
+            with self.assertRaisesRegex(ValueError,'directory does not exist'):
+                native.plan(self.record,self.candidate,self.config)
+            self.candidate['deployment']['mounts'][0]['create_if_missing']=True
+            self.assertIn('/mnt/new,',native.plan(self.record,self.candidate,self.config)['values']['mp3'])
+
+    def test_verification_detects_a_source_that_was_not_applied(self):
+        operation={'values':{'mp3':'/mnt/new,mp=/media,backup=0,ro=0'},'delete':[]}
+        with self.assertRaisesRegex(ValueError,'could not apply'):native.verify_values(self.config,operation)
+        native.verify_values(self.config.replace(b'/mnt/old',b'/mnt/new'),operation)
+
+    def test_unknown_mount_options_and_permission_grants_use_installer(self):
+        for fields in ({'grant_access':True},{'mount_options':['noexec']},{'type':'managed-volume','source':'local-zfs','size_gb':2,'backup':True}):
+            candidate=copy.deepcopy(self.candidate);candidate['deployment']['mounts'][0].update(fields)
+            self.assertIsNone(native.changes(self.record,candidate,self.config))
+
+    def test_recursive_bind_adaptations_use_installer(self):
+        self.candidate['deployment']['mounts'][0]['read_only']=True
+        derived=b'lxc.mount.entry: /mnt/old media none rbind,rslave,create=dir 0 0\n'
+        self.assertIsNone(native.changes(self.record,self.candidate,self.config+derived))
+
+    def test_storage_and_disk_size_changes_keep_existing_migration_guard(self):
+        self.record['deployment']['mounts'][0].update(type='managed-volume',source='local-zfs',size_gb=1,backup=True)
+        self.config=self.config.replace(b'/mnt/old,mp=/media,backup=0',b'local-zfs:subvol-115-disk-1,mp=/media,backup=1')
+        self.record['observed']['config']=self.config.decode()
+        for fields in ({'size_gb':2},{'source':'other-storage'}):
+            candidate=copy.deepcopy(self.record);candidate['deployment']['mounts'][0].update(fields)
+            self.assertIsNone(native.changes(self.record,candidate,self.config))
+            with self.assertRaisesRegex(ValueError,'migration'):transaction.preflight(self.record,candidate,self.config)
+
+
+class DetachedPreflightTests(unittest.TestCase):
+    def test_removing_a_mount_then_updating_accepts_the_recorded_unused_disk(self):
+        saved,config=installation()
+        saved['deployment']['mounts']=[{'type':'managed-volume','source':'local-zfs','size_gb':1,
+            'container_path':'/extra','backup':True,'read_only':False}]
+        config+=b'mp4: local-zfs:subvol-115-disk-1,mp=/extra,backup=1,size=1G\n'
+        saved['observed']['config']=config.decode()
+        candidate=copy.deepcopy(saved);candidate['deployment']['mounts']=[]
+        self.assertEqual(native.plan(saved,candidate,config)['delete'],['mp4'])
+        detached=config.replace(b'mp4: local-zfs:subvol-115-disk-1,mp=/extra,backup=1,size=1G\n',b'unused0: local-zfs:subvol-115-disk-1\n')
+        candidate['observed'].update(config=detached.decode(),config_sha256=transaction.sha(detached))
+        cfg,_,_=transaction.preflight(candidate,copy.deepcopy(candidate),detached)
+        self.assertIn('unused0',cfg)
+
+    def test_unrecorded_detached_disks_are_not_adopted_silently(self):
+        saved,config=installation()
+        with self.assertRaisesRegex(ValueError,'disks do not match|discard those changes'):
+            transaction.preflight(saved,copy.deepcopy(saved),config+b'unused0: local-zfs:subvol-115-disk-1\n')
+
+    def test_invalid_duplicate_or_mounted_unused_disks_are_rejected(self):
+        for extra in (b'unused0: /etc/passwd\n',b'unused0: local-zfs:subvol-115-disk-0\n',
+                      b'unused0: local-zfs:subvol-115-disk-1\nunused1: local-zfs:subvol-115-disk-1\n'):
+            saved,config=installation();config+=extra;saved['observed']['config']=config.decode()
+            with self.assertRaisesRegex(ValueError,'disks do not match'):transaction.preflight(saved,copy.deepcopy(saved),config)
+
+
+class DetachedTransferTests(unittest.TestCase):
+    def setUp(self):
+        saved,config=installation()
+        self.configs={115:config+b'unused0: local-zfs:subvol-115-disk-1\nunused2: local-zfs:subvol-115-disk-2\n',
+                      900:b'description: proxmenux-transaction=test-tx\nrootfs: local-zfs:subvol-900-disk-0\n'}
+        self.state={'vmid':115,'stage':900,'id':'test-tx','record':saved,
+                    'retained_unused':transaction.unused_volumes(self.configs[115])}
+        self.calls=[]
+        def owned(vmid,marker):
+            self.assertIn(marker.encode(),self.configs[vmid]);return self.configs[vmid]
+        def run(*args):
+            self.calls.append(args);self.assertEqual(args[:2],('pct','move-volume'))
+            source,key,target=int(args[2]),args[3],int(args[5]);self.assertEqual(key,args[7])
+            line=next(line for line in self.configs[source].splitlines(keepends=True) if line.startswith((key+': ').encode()))
+            self.configs[source]=self.configs[source].replace(line,b'')
+            self.configs[target]+=line.replace(('subvol-'+str(source)+'-').encode(),('subvol-'+str(target)+'-').encode())
+        for p in (patch.object(transaction,'owned',side_effect=owned),patch.object(transaction,'run',side_effect=run)):
+            p.start();self.addCleanup(p.stop)
+
+    def test_unused_disks_are_parked_and_returned_without_freeing_any_volume(self):
+        transaction.move_retained_unused(self.state,True)
+        self.assertEqual(transaction.unused_volumes(self.configs[115]),{})
+        self.assertEqual(set(transaction.unused_volumes(self.configs[900])),{'unused0','unused2'})
+        transaction.move_retained_unused(self.state,False)
+        self.assertEqual(transaction.unused_volumes(self.configs[115]),self.state['retained_unused'])
+        self.assertEqual(transaction.unused_volumes(self.configs[900]),{})
+        self.assertEqual(len(self.calls),4)
+
+    def test_an_interrupted_transfer_can_be_retried_in_both_directions(self):
+        original=transaction.run.side_effect
+        def interrupt(*args):
+            original(*args);raise RuntimeError('interrupted after reassignment')
+        with patch.object(transaction,'run',side_effect=interrupt):
+            with self.assertRaises(RuntimeError):transaction.move_retained_unused(self.state,True)
+        transaction.move_retained_unused(self.state,True)
+        with patch.object(transaction,'run',side_effect=interrupt):
+            with self.assertRaises(RuntimeError):transaction.move_retained_unused(self.state,False)
+        transaction.move_retained_unused(self.state,False)
+        self.assertEqual(transaction.unused_volumes(self.configs[115]),self.state['retained_unused'])
+
+    def test_unrelated_unused_disks_are_not_moved(self):
+        self.configs[115]+=b'unused3: local-zfs:subvol-115-disk-3\n'
+        with self.assertRaises(ValueError):transaction.move_retained_unused(self.state,True)
+        self.assertEqual(self.calls,[])
+
+    def test_a_missing_disk_or_target_collision_blocks_the_transfer(self):
+        del self.state['retained_unused']['unused2']
+        self.configs[115]=self.configs[115].replace(b'unused2: local-zfs:subvol-115-disk-2\n',b'')
+        self.configs[900]+=b'unused0: local-zfs:subvol-900-disk-9\n'
+        with self.assertRaises(ValueError):transaction.move_retained_unused(self.state,True)
+        self.configs[115]=self.configs[115].replace(b'unused0: local-zfs:subvol-115-disk-1\n',b'')
+        self.configs[900]=self.configs[900].replace(b'unused0: local-zfs:subvol-900-disk-9\n',b'')
+        with self.assertRaises(ValueError):transaction.move_retained_unused(self.state,False)
+
+
+if __name__=='__main__':unittest.main()
diff --git a/oci/tests/test_modify_review_transaction.py b/oci/tests/test_modify_review_transaction.py
new file mode 100644
index 00000000..08bf79d3
--- /dev/null
+++ b/oci/tests/test_modify_review_transaction.py
@@ -0,0 +1,148 @@
+"""Exercise the actual update and recovery orchestration with a simulated PVE API.
+
+Unused volumes must leave the old CT before destroy/restore and return before
+validation/commit, including an interruption during volume reassignment.
+"""
+import copy
+import json
+from pathlib import Path
+import re
+import socket
+import sys
+import tempfile
+import unittest
+from unittest.mock import patch
+
+sys.path.insert(0,str(Path(__file__).resolve().parents[1]/'remote'))
+import oci_instances as instances
+import oci_instance_transaction as transaction
+from test_modify_review import installation
+from test_modify_image_reuse import NEW
+
+
+class UpdateRetainedDiskTests(unittest.TestCase):
+    def setUp(self):
+        temp=tempfile.TemporaryDirectory();self.addCleanup(temp.cleanup)
+        self.root=Path(temp.name)/'instances'
+        self.archive=Path(temp.name)/'image.tar';self.archive.write_bytes(b'verified fixture')
+        self.backup=Path(temp.name)/'backup.tar.zst';self.backup.write_bytes(b'verified backup')
+        self.saved,config=installation()
+        self.base_config=config
+        config+=b'unused0: local-zfs:subvol-115-disk-1\nunused2: local-zfs:subvol-115-disk-2\n'
+        self.saved['observed'].update(config=config.decode(),config_sha256=transaction.sha(config))
+        self.saved['observed']['archive_path']=str(self.archive)
+        self.image=copy.deepcopy(self.saved['observed']['image']);self.image['manifest_digest']=NEW
+        self.configs={115:config};self.commands=[];self.fail_install=False;self.interrupt_return=False
+        instances.write(instances.location(self.root,115),self.saved)
+        def config_line(vmid,key,value):
+            before=self.configs[vmid]
+            result=b''.join(line for line in before.splitlines(keepends=True) if not line.startswith((key+': ').encode()))
+            self.configs[vmid]=result+(key+': '+value+'\n').encode()
+        def run(*args):
+            self.commands.append(args)
+            if args[0]=='zstd':
+                self.assertEqual(args[1:],('-t',str(self.backup)))
+                return b''
+            if args[:2]==('pvesh','get'):
+                if args[2]=='/cluster/nextid':return b'900'
+                return json.dumps([{'vmid':vmid,'type':'lxc','node':socket.gethostname().split('.')[0]}
+                                   for vmid in self.configs]).encode() if args[2]=='/cluster/resources' else b'[]'
+            self.assertEqual(args[0],'pct',args)
+            action,vmid=args[1],int(args[2])
+            if action=='config':return self.configs[vmid]
+            if action=='status':return b'status: running'
+            if action in ('start','shutdown','stop'):return b''
+            if action=='create':
+                marker=args[args.index('--description')+1]
+                self.configs[vmid]=f'description: {marker}\nrootfs: local-zfs:subvol-{vmid}-disk-0\n'.encode()
+            elif action=='destroy':
+                self.assertFalse(transaction.unused_volumes(self.configs[vmid]),'would destroy retained data')
+                self.assertFalse(transaction.mounts(self.configs[vmid]),'would destroy attached data')
+                del self.configs[vmid]
+            elif action=='set':
+                for index in range(3,len(args),2):config_line(vmid,args[index][2:],args[index+1])
+            elif action=='move-volume':
+                key,target,target_key=args[3],int(args[5]),args[7]
+                volume=transaction.unused_volumes(self.configs[vmid])[key]
+                line=(key+': '+volume+'\n').encode()
+                self.configs[vmid]=self.configs[vmid].replace(line,b'')
+                volume=volume.replace('subvol-'+str(vmid)+'-','subvol-'+str(target)+'-')
+                config_line(target,target_key,volume)
+                if self.interrupt_return and target==115:
+                    self.interrupt_return=False
+                    raise RuntimeError('interrupted return after PVE reassignment')
+            elif action=='restore':
+                # vzdump does not contain detached disks; restore skips unusedN.
+                self.assertFalse(transaction.unused_volumes(self.configs.get(vmid,b'')))
+                self.configs[vmid]=self.base_config
+            else:self.fail('Unexpected PVE command: '+str(args))
+            return b''
+        def install(root,journal,state,progress=None):
+            if self.fail_install:raise RuntimeError('installer failed after old rootfs was removed')
+            self.configs[state['vmid']]=self.base_config
+        def observe(vmid,identity,archive,digest,image=None):
+            observed=copy.deepcopy(self.saved['observed'])
+            observed.update(config=self.configs[vmid].decode(),config_sha256=transaction.sha(self.configs[vmid]),
+                            image=copy.deepcopy(image or self.image),resolved_registry_digest=digest)
+            return observed
+        original_exists=Path.exists
+        def exists(path):
+            match=re.fullmatch(r'/etc/pve/lxc/([0-9]+)\.conf',str(path))
+            return int(match[1]) in self.configs if match else original_exists(path)
+        patches=[patch.object(transaction,'run',side_effect=run),patch.object(transaction,'open_log'),
+            patch.object(transaction,'log'),patch.object(transaction,'stop'),
+            patch.object(transaction,'check_archive'),patch.object(transaction,'image_from_archive',return_value=self.image),
+            patch.object(transaction,'verified_backup',return_value=self.backup),
+            patch.object(transaction,'install_candidate',side_effect=install),
+            patch.object(transaction,'healthcheck',return_value='running'),
+            patch.object(transaction,'candidate_host_sources',return_value={}),
+            patch.object(transaction,'prune_backups'),patch.object(transaction.image_cache,'prune',return_value=[]),
+            patch.object(transaction,'cleanup_restored_format_dirs'),patch.object(transaction.runtime_settings,'restore'),
+            patch.object(transaction.work_backup,'locate',side_effect=lambda directory,*a:directory),
+            patch.object(instances,'observe',side_effect=observe),patch.object(Path,'exists',exists)]
+        for p in patches:p.start();self.addCleanup(p.stop)
+        self.addCleanup(transaction._run.update,journal=None)
+
+    def apply(self,**kwargs):return transaction.apply(self.root,115,self.archive,'update',registry_digest=NEW,**kwargs)
+
+    def journal(self):return next(instances.location(self.root,115).parent.glob('transactions/*/transaction.json'))
+
+    def assert_retained(self):
+        self.assertEqual(transaction.unused_volumes(self.configs[115]),{
+            'unused0':'local-zfs:subvol-115-disk-1','unused2':'local-zfs:subvol-115-disk-2'})
+        self.assertNotIn(900,self.configs)
+        self.assertFalse(any(args[:2]==('pct','set') and '--delete' in args for args in self.commands))
+
+    def test_update_keeps_detached_disks_and_the_next_update_preflight_accepts_them(self):
+        self.apply();self.assert_retained()
+        saved=instances.read(self.root,115)
+        self.assertEqual(saved['status'],'installed')
+        self.assertEqual(saved['observed']['image']['manifest_digest'],NEW)
+        transaction.preflight(saved,copy.deepcopy(saved),self.configs[115])
+        self.assertEqual(json.loads(self.journal().read_text())['phase'],'committed')
+
+    def test_failed_install_restores_both_backup_and_detached_disks(self):
+        self.fail_install=True
+        with self.assertRaisesRegex(RuntimeError,'installer failed'):self.apply()
+        transaction.recover(self.root,self.journal())
+        self.assert_retained()
+        self.assertEqual(instances.read(self.root,115)['observed']['image'],self.saved['observed']['image'])
+        self.assertEqual(json.loads(self.journal().read_text())['phase'],'rolled-back')
+
+    def test_recovery_after_parking_data_returns_the_original_unused_disks(self):
+        with self.assertRaisesRegex(RuntimeError,'Lab interruption'):self.apply(interrupt_after='data-parked')
+        transaction.recover(self.root,self.journal());self.assert_retained()
+
+    def test_recovery_handles_an_interruption_while_returning_unused_disks(self):
+        self.interrupt_return=True
+        with self.assertRaisesRegex(RuntimeError,'interrupted return'):self.apply()
+        transaction.recover(self.root,self.journal());self.assert_retained()
+
+    def test_failed_runtime_check_recovers_disks_already_returned_to_the_candidate(self):
+        with patch.object(transaction.gpu_devices,'validate_runtime',side_effect=[RuntimeError('invalid runtime'), None]):
+            with self.assertRaisesRegex(RuntimeError,'invalid runtime'):self.apply()
+            transaction.recover(self.root,self.journal())
+        self.assert_retained()
+
+
+if __name__=='__main__':unittest.main()
diff --git a/oci/tests/test_native_modify.py b/oci/tests/test_native_modify.py
new file mode 100644
index 00000000..cf42493e
--- /dev/null
+++ b/oci/tests/test_native_modify.py
@@ -0,0 +1,262 @@
+"""Native runtime edits keep rootfs, defaults and secrets; failures roll back."""
+import contextlib
+import copy
+import json
+from pathlib import Path
+import re
+import subprocess
+import sys
+import tempfile
+import unittest
+from unittest.mock import patch, Mock
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[1]/'remote'))
+import oci_native_modify as native
+import oci_instances as instances
+import oci_update_current as update
+import oci_operation_notice
+from test_modify_image_reuse import record, CONFIG
+
+
+class NativePlanTests(unittest.TestCase):
+    def setUp(self):
+        self.record = record()
+        self.record['observed']['image']['defaults'] = {'Env': ['A=image-default']}
+        self.record['deployment']['environment'] = [{'name': 'A', 'value': 'one'}]
+        self.config = CONFIG+b'net0: name=eth0,bridge=vmbr0,ip=dhcp,hwaddr=AA:BB:CC:DD:EE:FF,tag=20,ip6=auto\n'
+        self.candidate = copy.deepcopy(self.record)
+        p = patch.object(native.transaction, 'preflight')
+        self.preflight = p.start(); self.addCleanup(p.stop)
+
+    def test_environment_preserves_image_defaults_and_other_runtime_values(self):
+        self.candidate['deployment']['environment'] = [{'name': 'SECRET', 'value': "a' $x \" ; = value", 'sensitive': True}]
+        result = native.plan(self.record, self.candidate, self.config)
+        env = dict(x.split('=', 1) for x in result['values']['env'].split('\0'))
+        self.assertEqual(env, {'A': 'image-default', 'B': 'two', 'SECRET': "a' $x \" ; = value"})
+        self.assertTrue(result['restart'])
+
+    def test_remove_environment_without_default_restores_image_environment(self):
+        self.record['observed']['image']['defaults'] = {}
+        self.candidate['deployment']['environment'] = []
+        self.assertEqual(native.plan(self.record, self.candidate, self.config)['values']['env'], 'B=two')
+
+    def test_public_pct_environment_and_native_lines_have_the_same_values(self):
+        raw=b'lxc.environment.runtime: A=one\nlxc.environment.runtime: B=two\n'
+        public=b'env: A=one\0B=two\n'
+        self.assertEqual(native.environment(raw),native.environment(public))
+        self.assertEqual(native.environment(public),{'A':'one','B':'two'})
+
+    def test_duplicate_invalid_and_control_character_values_are_refused(self):
+        for items in ([{'name':'X','value':'a'},{'name':'X','value':'b'}],
+                      [{'name':'X','value':'a\nb'}],[{'name':'BAD NAME','value':'a'}]):
+            self.candidate['deployment']['environment'] = items
+            with self.assertRaises(ValueError): native.plan(self.record, self.candidate, self.config)
+
+    def test_network_preserves_mac_vlan_ipv6_and_interface_identity(self):
+        self.candidate['deployment']['network'].update(ipv4='192.0.2.2/24', gateway='192.0.2.1')
+        with patch.object(Path, 'is_dir', return_value=True):
+            result = native.plan(self.record, self.candidate, self.config)
+        fields = dict(x.split('=',1) for x in result['values']['net0'].split(','))
+        self.assertEqual(fields['hwaddr'], 'AA:BB:CC:DD:EE:FF')
+        self.assertEqual(fields['tag'], '20'); self.assertEqual(fields['ip6'], 'auto')
+        self.assertEqual(fields['ip'], '192.0.2.2/24'); self.assertEqual(fields['gw'], '192.0.2.1')
+
+    def test_invalid_network_is_rejected_before_stopping(self):
+        for value in ('nonsense', '2001:db8::1/64'):
+            self.candidate['deployment']['network']['ipv4'] = value
+            with patch.object(Path, 'is_dir', return_value=True), self.assertRaises(ValueError):
+                native.plan(self.record,self.candidate,self.config)
+
+    def test_new_managed_disk_uses_native_allocation_and_existing_disk_is_untouched(self):
+        self.candidate['deployment']['mounts'] = [{'type':'managed-volume','container_path':'/extra',
+            'source':'local-zfs','size_gb':1,'backup':True,'read_only':False}]
+        result = native.plan(self.record,self.candidate,self.config)
+        self.assertEqual(result['values'], {'mp0':'local-zfs:1,mp=/extra,backup=1,ro=0'})
+        self.assertNotIn('rootfs', result['values'])
+
+    def test_removing_mount_detaches_it_without_freeing_its_volume(self):
+        mount={'type':'managed-volume','container_path':'/extra','source':'local-zfs','size_gb':1,'backup':True}
+        self.record['deployment']['mounts']=[mount]
+        result=native.plan(self.record,self.candidate,self.config+b'mp4: local-zfs:subvol-115-disk-1,mp=/extra,backup=1,size=1G\n')
+        self.assertEqual(result['delete'],['mp4'])
+
+    def test_image_or_installer_adapter_changes_do_not_take_native_path(self):
+        for key in ('image', 'adapter'):
+            candidate=copy.deepcopy(self.record)
+            if key=='image':candidate['template']['container_contract']['image']['reference']='new/image'
+            else:candidate['deployment']['post_start_configurations']=[{'id':'rootfs-adapter'}]
+            self.assertIsNone(native.changes(self.record,candidate,self.config))
+
+    def test_secrets_use_stdin_never_arguments_or_logs(self):
+        secret="super-secret with 'quotes' and $shell"
+        with tempfile.TemporaryDirectory() as directory:
+            root=Path(directory);(root/'115.conf').write_bytes(self.config)
+            with patch.object(native.resources,'CONFIG_DIR',root), \
+                    patch.object(instances,'command',return_value=self.config), \
+                    patch.object(native.transaction,'log') as log, \
+                    patch.object(native.subprocess,'run',return_value=Mock(returncode=0)) as run:
+                native.set_config(115,self.record['installation_id'],self.config,{'env':'SECRET='+secret+'\0B=two'})
+            self.assertNotIn(secret,str(run.call_args.args))
+            self.assertNotIn(secret,str(log.call_args_list))
+            self.assertIn(secret,json.loads(run.call_args.kwargs['input'])['env'])
+
+    def test_native_api_failure_does_not_echo_secret_stderr(self):
+        with tempfile.TemporaryDirectory() as directory:
+            root=Path(directory);(root/'115.conf').write_bytes(self.config)
+            with patch.object(native.resources,'CONFIG_DIR',root),patch.object(instances,'command',return_value=self.config), \
+                    patch.object(native.subprocess,'run',return_value=Mock(returncode=1,stderr=b'secret')):
+                with self.assertRaisesRegex(RuntimeError,'Proxmox could not apply') as error:
+                    native.set_config(115,self.record['installation_id'],self.config,{'env':'SECRET=secret'})
+            self.assertNotIn('secret',str(error.exception))
+
+    def test_verifies_all_environment_entries_and_native_values(self):
+        native.verify_values(CONFIG,{'values':{'env':'A=one\0B=two','cores':'2'},'delete':[]})
+        for values in ({'env':'A=wrong\0B=two'},{'cores':'3'}):
+            with self.assertRaises(ValueError):native.verify_values(CONFIG,{'values':values,'delete':[]})
+        with self.assertRaises(ValueError):native.verify_values(CONFIG,{'values':{},'delete':['env']})
+
+    def test_native_property_canonicalization_keeps_modes_and_default_flags(self):
+        cfg=CONFIG+b'dev0: path=/dev/fuse,mode=660\n'
+        native.verify_values(cfg,{'values':{'dev0':'path=/dev/fuse,mode=0660,uid=0,gid=0,deny-write=0'},'delete':[]})
+
+
+class NativeApplyTests(unittest.TestCase):
+    def setUp(self):
+        self.temp=tempfile.TemporaryDirectory();self.addCleanup(self.temp.cleanup)
+        self.root=Path(self.temp.name)
+        self.record=record();self.candidate=copy.deepcopy(self.record)
+        self.candidate['deployment']['environment']=[{'name':'A','value':'changed'}]
+        self.config=CONFIG
+        self.state={'config':CONFIG,'running':True}
+        self.commands=[]
+        def run(*args):
+            self.commands.append(args)
+            if args[:2]==('pct','status'):return b'status: running' if self.state['running'] else b'status: stopped'
+            if args[:2]==('pct','start'):self.state['running']=True
+            return b''
+        def stop(vmid):self.state['running']=False
+        def setter(vmid,identity,expected,values,delete=()):
+            self.assertEqual(expected,self.state['config'])
+            text=self.state['config'].decode()
+            if 'env' in values or 'env' in delete:
+                public='env: ' in text
+                text=''.join(x for x in text.splitlines(keepends=True) if not x.startswith(('lxc.environment.runtime: ','env: ')))
+                if public and values.get('env'):text+='env: '+values['env']+'\n'
+                else:
+                    for item in values.get('env','').split('\0'):
+                        if item:text+='lxc.environment.runtime: '+item+'\n'
+            self.state['config']=text.encode()
+        def observe(*args):
+            observed=copy.deepcopy(self.record['observed'])
+            observed.update(config=self.state['config'].decode(),config_sha256=native.sha(self.state['config']))
+            return observed
+        patches=[patch.object(native,'plan',return_value={'values':{'env':'A=changed\0B=two'},'delete':[],'restart':True,'changed':['environment']}),
+            patch.object(native,'set_config',side_effect=setter),patch.object(instances,'command',side_effect=lambda *a:self.state['config']),
+            patch.object(native.transaction,'run',side_effect=run),patch.object(native.transaction,'stop',side_effect=stop),
+            patch.object(native.transaction,'healthcheck'),patch.object(native.transaction,'preflight'),
+            patch.object(native.transaction,'freeze_host_sources',return_value=({},{})),
+            patch.object(native.transaction,'open_log'),patch.object(native.transaction,'log'),
+            patch.object(instances,'observe',side_effect=observe),patch('oci_carried_record.carry')]
+        for p in patches:p.start();self.addCleanup(p.stop)
+        instances.write(instances.location(self.root,115),self.record)
+
+    def apply(self):return native.apply(self.root,self.record,self.candidate,self.config)
+
+    def test_runtime_edit_restarts_existing_guest_and_keeps_rootfs_image_and_data(self):
+        folder=self.apply()
+        saved=instances.read(self.root,115)
+        self.assertEqual(saved['observed']['image'],self.record['observed']['image'])
+        self.assertIn(b'rootfs: local-zfs:subvol-115-disk-0',self.state['config'])
+        self.assertEqual(saved['deployment'],self.candidate['deployment'])
+        self.assertTrue(self.state['running'])
+        self.assertEqual(json.loads((folder/'before.json').read_text())['phase'],'committed')
+        self.assertFalse(any(c[:2] in (('pct','create'),('pct','destroy')) for c in self.commands))
+
+    def test_failed_healthcheck_rolls_back_and_starts_original_service(self):
+        with patch.object(native.transaction,'healthcheck',side_effect=[RuntimeError('not healthy'),None]):
+            with self.assertRaisesRegex(RuntimeError,'not healthy'):self.apply()
+        self.assertEqual(self.state['config'],CONFIG)
+        self.assertTrue(self.state['running'])
+        self.assertEqual(instances.read(self.root,115)['deployment'],self.record['deployment'])
+
+    def test_health_failure_restores_public_nul_separated_environment(self):
+        self.config=CONFIG.replace(b'lxc.environment.runtime: A=one\nlxc.environment.runtime: B=two\n',b'env: A=one\0B=two\n')
+        self.state['config']=self.config
+        self.record['observed'].update(config=self.config.decode(),config_sha256=native.sha(self.config))
+        instances.write(instances.location(self.root,115),self.record)
+        with patch.object(native.transaction,'healthcheck',side_effect=[RuntimeError('not healthy'),None]):
+            with self.assertRaises(RuntimeError):self.apply()
+        self.assertEqual(native.environment(self.state['config']),{'A':'one','B':'two'})
+        self.assertTrue(self.state['running'])
+
+    def test_stopped_guest_stays_stopped(self):
+        self.state['running']=False
+        self.apply()
+        self.assertFalse(self.state['running'])
+        self.assertNotIn(('pct','start','115'),self.commands)
+
+    def test_interrupted_edit_is_recovered_through_transaction_dispatch(self):
+        folder=self.apply()
+        path=folder/'before.json';state=json.loads(path.read_text());state['phase']='configured'
+        instances.write(path,state)
+        pending=copy.deepcopy(self.record)
+        pending.update(status='updating',transaction_id=folder.name,pending_transaction=str(path))
+        instances.write(instances.location(self.root,115),pending)
+        native.transaction.recover(self.root,path)
+        self.assertEqual(self.state['config'],CONFIG)
+        saved=instances.read(self.root,115)
+        self.assertEqual(saved['status'],'installed');self.assertNotIn('pending_transaction',saved)
+        self.assertEqual(json.loads(path.read_text())['phase'],'rolled-back')
+
+    def test_recovery_refuses_a_concurrent_environment_edit(self):
+        folder=self.apply();path=folder/'before.json';state=json.loads(path.read_text());state['phase']='configured'
+        instances.write(path,state)
+        pending=copy.deepcopy(self.record)
+        pending.update(status='updating',transaction_id=folder.name,pending_transaction=str(path))
+        instances.write(instances.location(self.root,115),pending)
+        self.state['config']=self.state['config'].replace(b'A=changed',b'A=concurrent')
+        with self.assertRaisesRegex(ValueError,'changed'):native.transaction.recover(self.root,path)
+        self.assertIn(b'A=concurrent',self.state['config'])
+
+    def test_concurrent_change_before_write_is_not_overwritten(self):
+        def stop(vmid):
+            self.state['running']=False
+            self.state['config']+=b'timezone: host\n'
+        with patch.object(native.transaction,'stop',side_effect=stop):
+            with self.assertRaisesRegex(ValueError,'changed'):self.apply()
+        self.assertIn(b'timezone: host',self.state['config'])
+        self.assertTrue(self.state['running'])
+
+    def test_router_does_not_resolve_download_or_recreate_for_environment_edit(self):
+        with patch.object(instances,'ROOT',self.root),patch.object(instances,'locked',return_value=contextlib.nullcontext()), \
+                patch.object(native.transaction,'external_changes',return_value={}), \
+                patch.object(update,'resolve_archive',side_effect=AssertionError('registry path')), \
+                patch.object(native.transaction,'apply',side_effect=AssertionError('recreation')), \
+                patch.object(oci_operation_notice,'operation',return_value=contextlib.nullcontext()):
+            update.update(115,proposal={'operation':'recreate','candidate':self.candidate})
+        self.assertEqual(instances.read(self.root,115)['deployment']['environment'],self.candidate['deployment']['environment'])
+
+    def test_unsupported_same_image_adaptation_uses_the_existing_recreation_flow(self):
+        self.candidate['deployment']['post_start_configurations']=[{'id':'unsupported-adapter'}]
+        with patch.object(instances,'ROOT',self.root),patch.object(instances,'locked',return_value=contextlib.nullcontext()), \
+                patch.object(native.transaction,'external_changes',return_value={}), \
+                patch.object(update,'resolve_archive',return_value=(Path('/verified.tar'),'sha256:test')) as resolve, \
+                patch.object(native.transaction,'apply') as recreate, \
+                patch.object(native,'apply',side_effect=AssertionError('partial native edit')), \
+                patch.object(oci_operation_notice,'operation',return_value=contextlib.nullcontext()):
+            update.update(115,proposal={'operation':'recreate','candidate':self.candidate})
+        resolve.assert_called_once()
+        recreate.assert_called_once()
+        self.assertEqual(recreate.call_args.args[3],'recreate')
+
+    def test_optional_backup_does_not_force_recreation(self):
+        with patch.object(instances,'ROOT',self.root),patch.object(instances,'locked',return_value=contextlib.nullcontext()), \
+                patch.object(native.transaction,'external_changes',return_value={}), \
+                patch.object(update,'resolve_archive',side_effect=AssertionError('registry path')), \
+                patch.object(update,'backup_native_settings') as backup, \
+                patch.object(oci_operation_notice,'operation',return_value=contextlib.nullcontext()):
+            update.update(115,proposal={'operation':'recreate','candidate':self.candidate},keep_backup='test-storage')
+        backup.assert_called_once_with(115,'test-storage')
+
+
+if __name__=='__main__':unittest.main()
diff --git a/oci/tests/test_readonly_volume_preparation.py b/oci/tests/test_readonly_volume_preparation.py
new file mode 100644
index 00000000..37f67011
--- /dev/null
+++ b/oci/tests/test_readonly_volume_preparation.py
@@ -0,0 +1,187 @@
+"""Run the installer's volume preparation loop against filesystem fixtures.
+
+Write doubles reject every mutation of the protected directory, including
+lost+found removal. Writable paths still run real rm/chmod; chown is recorded
+without requiring root. These tests never invoke Proxmox or touch a container.
+"""
+
+import json
+import os
+from pathlib import Path
+import subprocess
+import tempfile
+import unittest
+
+
+ROOT = Path(__file__).resolve().parents[1]
+INSTALLER = ROOT / "remote/install_oci.sh"
+
+
+def preparation_loop():
+    source = INSTALLER.read_text()
+    start = source.index("  if (( failed == 0 )) && [[ $(jq -r '.stack_managed")
+    end = source.index("\n  if (( failed == 0 && tls_count == 1 )); then", start)
+    return source[start:end]
+
+
+def preparation(target):
+    return {
+        "container_path": target,
+        "remove_lost_found": True,
+        "owner_strategy": "mapped-application-user",
+        "mode": "0750",
+    }
+
+
+class ReadOnlyVolumePreparationTests(unittest.TestCase):
+    def run_case(self, mounts, *, target="/run/secrets", read_only=True,
+                 preparations=None):
+        preparations = preparations if preparations is not None else [preparation(target)]
+        with tempfile.TemporaryDirectory() as directory:
+            fixture = Path(directory)
+            rootfs = fixture / "rootfs"
+            for item in preparations:
+                path = rootfs / item["container_path"].lstrip("/")
+                path.mkdir(parents=True, exist_ok=True)
+                (path / "lost+found").mkdir(exist_ok=True)
+            protected = rootfs / target.lstrip("/")
+            protected.mkdir(parents=True, exist_ok=True)
+            sentinel = protected / "sentinel"
+            sentinel.write_bytes(b"existing secret\n")
+            sentinel.chmod(0o600)
+            protected.chmod(0o700)
+            before = sentinel.stat()
+            template = {"proxmox": {"installer_profile": {
+                "volume_preparations": preparations,
+            }}}
+            (fixture / "template.json").write_text(json.dumps(template))
+            (fixture / "deployment.json").write_text(json.dumps({"mounts": mounts}))
+            script = r'''set -Eeuo pipefail
+rootfs="$FIXTURE/rootfs"
+TEMPLATE_FILE="$FIXTURE/template.json"
+DEPLOYMENT_FILE="$FIXTURE/deployment.json"
+HOST_BIND_UID=110001; HOST_BIND_GID=110001
+HOST_ROOT_UID=100000; HOST_ROOT_GID=100000
+failed=0; volumes_prepared=0
+oci_log() { printf 'log %s\n' "$*"; }
+write_op() {
+  local operation=$1
+  shift
+  local path=${!#}
+  printf 'WRITE %s %s\n' "$operation" "$path"
+  if [[ -n $PROTECTED && ( $path == "$PROTECTED" || $path == "$PROTECTED/"* ) ]]; then
+    printf 'Read-only file system\n' >&2
+    return 1
+  fi
+  case "$operation" in
+    rm|chmod) command "$operation" "$@" ;;
+    chown) return 0 ;;
+  esac
+}
+chown() { write_op chown "$@"; }
+chmod() { write_op chmod "$@"; }
+rm() { write_op rm "$@"; }
+''' + preparation_loop() + r'''
+printf 'failed=%s prepared=%s\n' "$failed" "$volumes_prepared"
+test "$failed" = 0
+'''
+            result = subprocess.run(
+                ["bash", "-c", script], capture_output=True, text=True,
+                env=dict(os.environ, FIXTURE=str(fixture),
+                         PROTECTED=str(protected) if read_only else ""),
+                timeout=15,
+            )
+            self.assertEqual(sentinel.read_bytes(), b"existing secret\n")
+            after = sentinel.stat()
+            self.assertEqual(
+                (before.st_ino, before.st_uid, before.st_gid, before.st_mode, before.st_mtime_ns),
+                (after.st_ino, after.st_uid, after.st_gid, after.st_mode, after.st_mtime_ns),
+            )
+            if read_only:
+                self.assertEqual(protected.stat().st_mode & 0o777, 0o700)
+                self.assertTrue((protected / "lost+found").is_dir())
+            elif "prepared=1" in result.stdout:
+                self.assertEqual(protected.stat().st_mode & 0o777, 0o750)
+                self.assertFalse((protected / "lost+found").exists())
+            return result
+
+    def assert_skipped(self, result):
+        self.assertEqual(result.returncode, 0, result.stderr + result.stdout)
+        self.assertNotIn("WRITE ", result.stdout)
+        self.assertIn("Skipping preparation of read-only volume", result.stdout)
+        self.assertIn("prepared=0", result.stdout)
+
+    def assert_prepared(self, result):
+        self.assertEqual(result.returncode, 0, result.stderr + result.stdout)
+        for operation in ("rm", "chown", "chmod"):
+            self.assertIn(f"WRITE {operation} ", result.stdout)
+        self.assertIn("prepared=1", result.stdout)
+
+    def test_read_only_managed_and_bind_volumes_receive_no_writes(self):
+        for mount_type in ("managed-volume", "host-bind"):
+            with self.subTest(mount_type=mount_type):
+                self.assert_skipped(self.run_case([
+                    {"container_path": "/run/secrets", "type": mount_type, "read_only": True},
+                ]))
+
+    def test_read_only_parent_protects_nested_preparation(self):
+        self.assert_skipped(self.run_case([
+            {"container_path": "/run", "read_only": True},
+        ]))
+
+    def test_writable_child_overrides_read_only_parent_regardless_of_order(self):
+        mounts = [
+            {"container_path": "/run", "read_only": True},
+            {"container_path": "/run/secrets", "read_only": False},
+        ]
+        for ordered in (mounts, mounts[::-1]):
+            with self.subTest(mounts=ordered):
+                self.assert_prepared(self.run_case(ordered, read_only=False))
+
+    def test_child_without_read_only_flag_overrides_read_only_parent(self):
+        self.assert_prepared(self.run_case([
+            {"container_path": "/run", "read_only": True},
+            {"container_path": "/run/secrets"},
+        ], read_only=False))
+
+    def test_read_only_child_overrides_writable_parent_regardless_of_order(self):
+        mounts = [
+            {"container_path": "/run/secrets", "read_only": True},
+            {"container_path": "/run", "read_only": False},
+        ]
+        for ordered in (mounts, mounts[::-1]):
+            with self.subTest(mounts=ordered):
+                self.assert_skipped(self.run_case(ordered))
+
+    def test_writable_volume_is_still_prepared(self):
+        self.assert_prepared(self.run_case([
+            {"container_path": "/data", "read_only": False},
+        ], target="/data", read_only=False))
+
+    def test_missing_read_only_flag_defaults_to_writable(self):
+        self.assert_prepared(self.run_case([
+            {"container_path": "/data"},
+        ], target="/data", read_only=False))
+
+    def test_unrelated_mount_with_similar_prefix_does_not_skip_preparation(self):
+        self.assert_prepared(self.run_case([
+            {"container_path": "/run/secret", "read_only": True},
+        ], read_only=False))
+
+    def test_directory_outside_mounts_is_still_prepared(self):
+        self.assert_prepared(self.run_case([], read_only=False))
+
+    def test_skipping_read_only_volume_does_not_skip_following_writable_volume(self):
+        result = self.run_case([
+            {"container_path": "/run/secrets", "read_only": True},
+            {"container_path": "/data", "read_only": False},
+        ], preparations=[preparation("/run/secrets"), preparation("/data")])
+        self.assert_prepared(result)
+        self.assertIn("Skipping preparation of read-only volume: /run/secrets", result.stdout)
+        for line in result.stdout.splitlines():
+            if line.startswith("WRITE "):
+                self.assertTrue(line.endswith("/data") or line.endswith("/data/lost+found"), line)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/oci/tests/test_runtime_home_contract.py b/oci/tests/test_runtime_home_contract.py
index c14e8e26..25e9ca9e 100644
--- a/oci/tests/test_runtime_home_contract.py
+++ b/oci/tests/test_runtime_home_contract.py
@@ -31,14 +31,14 @@ class RuntimeHomeResolutionTests(unittest.TestCase):
         )
         self.assertEqual(oci_runtime.home_directory(passwd, 1001), "/srv/app")
 
-    def test_unknown_or_unsafe_home_is_not_invented(self):
+    def test_unsafe_record_is_rejected_but_unknown_uid_defaults_to_root(self):
         passwd = self.passwd(
             "root:x:0:0:root:relative-home:/bin/sh\n"
             "app:x:1001:1001:App user::/sbin/nologin\n"
         )
         self.assertIsNone(oci_runtime.home_directory(passwd, 0))
         self.assertIsNone(oci_runtime.home_directory(passwd, 1001))
-        self.assertIsNone(oci_runtime.home_directory(passwd, 1234))
+        self.assertEqual(oci_runtime.home_directory(passwd, 1234), "/")
 
 
 class RuntimeHomeInstallerContractTests(unittest.TestCase):
diff --git a/oci/tests/test_runtime_home_hardening.py b/oci/tests/test_runtime_home_hardening.py
new file mode 100644
index 00000000..6418709d
--- /dev/null
+++ b/oci/tests/test_runtime_home_hardening.py
@@ -0,0 +1,260 @@
+"""Exercise HOME resolution without reading image symlinks or changing guests."""
+
+from contextlib import redirect_stderr, redirect_stdout
+import io
+import os
+from pathlib import Path
+import re
+import subprocess
+import sys
+import tempfile
+import unittest
+from unittest.mock import patch
+
+ROOT = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(ROOT / "remote"))
+import oci_runtime
+
+
+class HomeHardeningTests(unittest.TestCase):
+    def setUp(self):
+        temporary = tempfile.TemporaryDirectory()
+        self.addCleanup(temporary.cleanup)
+        self.root = Path(temporary.name)
+        (self.root / "etc").mkdir()
+        self.passwd = self.root / "etc/passwd"
+        self.passwd.write_text("root:x:0:0:root:/root:/bin/sh\n", encoding="utf-8")
+
+    def cli(self, uid="1234"):
+        output, error = io.StringIO(), io.StringIO()
+        with patch.object(sys, "argv", ["oci_runtime.py", "--home", str(self.passwd), uid]), \
+             redirect_stdout(output), redirect_stderr(error):
+            status = oci_runtime.main()
+        return status, output.getvalue(), error.getvalue()
+
+    def assert_rejected_without_read(self):
+        with patch.object(os, "fdopen", side_effect=AssertionError("unsafe file read")):
+            status, output, _ = self.cli()
+        self.assertEqual(status, 1)
+        self.assertEqual(output, "")
+
+    def test_unknown_uid_uses_root_only_after_reading_a_regular_database(self):
+        self.assertEqual(self.cli(), (0, "/\n", ""))
+
+    def test_empty_regular_database_uses_root(self):
+        self.passwd.write_text("")
+        self.assertEqual(self.cli(), (0, "/\n", ""))
+
+    def test_final_symlink_is_rejected_without_reading_its_target(self):
+        target = self.root / "outside"
+        target.write_text("app:x:1234:1234::/host-secret:/bin/sh\n")
+        self.passwd.unlink()
+        self.passwd.symlink_to(target)
+        self.assert_rejected_without_read()
+        self.assertEqual(target.read_text(), "app:x:1234:1234::/host-secret:/bin/sh\n")
+
+    def test_symlinked_etc_is_rejected_without_reading_its_target(self):
+        directory = self.root / "etc"
+        directory.rename(self.root / "outside-etc")
+        directory.symlink_to(self.root / "outside-etc", target_is_directory=True)
+        self.assert_rejected_without_read()
+        self.assertEqual(self.cli("0")[:2], (1, ""))
+
+    def test_pinned_etc_does_not_follow_a_later_directory_replacement(self):
+        original_open = os.open
+        outside = self.root / "outside"
+        outside.mkdir()
+        (outside / "passwd").write_text("root:x:0:0::/outside:/bin/sh\n")
+        replaced = []
+        def replace(path, flags, *args, **kwargs):
+            if str(path) == "passwd":
+                (self.root / "etc").rename(self.root / "original-etc")
+                (self.root / "etc").symlink_to(outside, target_is_directory=True)
+                replaced.append(True)
+            return original_open(path, flags, *args, **kwargs)
+        with patch.object(os, "open", side_effect=replace):
+            self.assertEqual(self.cli("0"), (0, "/root\n", ""))
+        self.assertEqual(replaced, [True])
+
+    def test_directory_is_rejected_without_reading(self):
+        self.passwd.unlink()
+        self.passwd.mkdir()
+        self.assert_rejected_without_read()
+
+    def test_fifo_is_rejected_without_reading_or_waiting_for_a_writer(self):
+        self.passwd.unlink()
+        os.mkfifo(self.passwd)
+        done = subprocess.run(
+            [sys.executable, "-B", str(ROOT / "remote/oci_runtime.py"), "--home", str(self.passwd), "0"],
+            capture_output=True, text=True, timeout=3,
+        )
+        self.assertEqual(done.returncode, 1)
+        self.assertEqual(done.stdout, "")
+        self.assert_rejected_without_read()
+
+    def test_missing_database_does_not_masquerade_as_unknown_uid(self):
+        self.passwd.unlink()
+        self.assert_rejected_without_read()
+
+    def test_permission_failure_does_not_masquerade_as_unknown_uid(self):
+        with patch.object(os, "open", side_effect=PermissionError("denied")):
+            self.assert_rejected_without_read()
+
+    def test_invalid_encoding_does_not_produce_a_fallback(self):
+        self.passwd.write_bytes(b"\xff\xfe")
+        status, output, _ = self.cli()
+        self.assertEqual((status, output), (1, ""))
+
+    def test_partial_matching_record_does_not_produce_a_fallback(self):
+        self.passwd.write_text("app:x:1234:1234\n")
+        self.assertEqual(self.cli()[:2], (1, ""))
+
+    def test_read_error_closes_both_descriptors_without_a_fallback(self):
+        descriptors = []
+        original_open = os.open
+        def opened(*args, **kwargs):
+            fd = original_open(*args, **kwargs)
+            descriptors.append(fd)
+            return fd
+        with patch.object(os, "open", side_effect=opened), \
+             patch.object(os, "fdopen", side_effect=OSError("read failed")):
+            self.assertEqual(self.cli()[:2], (1, ""))
+        self.assertEqual(len(descriptors), 2)
+        for fd in descriptors:
+            with self.assertRaises(OSError):
+                os.fstat(fd)
+
+    def test_matching_unsafe_home_is_not_replaced_with_root(self):
+        for value in ("", "relative", "/bad\tvalue", "/bad\x00value", "/bad\x7fvalue"):
+            with self.subTest(value=repr(value)):
+                self.passwd.write_text(f"app:x:1234:1234::{value}:/bin/sh\n")
+                self.assertEqual(self.cli()[:2], (1, ""))
+
+    def test_invalid_uid_does_not_open_the_database(self):
+        for uid in ("-1", "nobody"):
+            with self.subTest(uid=uid), patch.object(os, "open") as opened:
+                self.assertEqual(self.cli(uid)[:2], (1, ""))
+                opened.assert_not_called()
+
+    def test_symlink_replacement_between_check_and_open_is_not_read(self):
+        original_open = os.open
+        outside = self.root / "outside"
+        outside.write_text("app:x:1234:1234::/outside:/bin/sh\n")
+        def replace(path, flags, *args, **kwargs):
+            if str(path) == "passwd":
+                self.passwd.unlink()
+                self.passwd.symlink_to(outside)
+            return original_open(path, flags, *args, **kwargs)
+        with patch.object(os, "open", side_effect=replace):
+            self.assert_rejected_without_read()
+
+    def test_fifo_replacement_between_check_and_open_is_not_read(self):
+        original_open = os.open
+        def replace(path, flags, *args, **kwargs):
+            if str(path) == "passwd":
+                self.passwd.unlink()
+                os.mkfifo(self.passwd)
+            return original_open(path, flags, *args, **kwargs)
+        with patch.object(os, "open", side_effect=replace):
+            self.assert_rejected_without_read()
+
+
+class HomeInstallerExecutionTests(unittest.TestCase):
+    """Run the real shell HOME function and Python CLI with fake mount boundaries."""
+    def setUp(self):
+        temporary = tempfile.TemporaryDirectory()
+        self.addCleanup(temporary.cleanup)
+        self.root = Path(temporary.name)
+        (self.root / "etc").mkdir()
+        self.passwd = self.root / "etc/passwd"
+        self.passwd.write_text("root:x:0:0:root:/root:/bin/sh\napp:x:1001:1001::/srv/app:/bin/sh\n")
+        self.conf = self.root / "guest.conf"
+        self.trace = self.root / "trace"
+        self.source = (ROOT / "remote/install_oci.sh").read_text()
+
+    def run_home(self, config="unrelated: keep\n", unmount_status=0, mount_status=0):
+        self.conf.write_text(config)
+        self.trace.write_text("")
+        functions = []
+        for name in ("ensure_runtime_home", "set_runtime_environment"):
+            found = re.search(rf"^{name}\(\) \{{\n.*?^\}}\n", self.source, re.M | re.S)
+            self.assertIsNotNone(found, name)
+            functions.append(found.group(0))
+        script = r'''
+set -euo pipefail
+CONF=$1
+FIXTURE_ROOT=$2
+TRACE=$3
+OCI_RUNTIME_RESOLVER=$4
+PYTHON=$5
+UNMOUNT_STATUS=$6
+MOUNT_STATUS=$7
+OCI_LOG="$FIXTURE_ROOT/resolver.log"
+VMID=123456789
+translate() { printf '%s' "$1"; }
+die() { printf '%s\n' "$*" >&2; exit 1; }
+mount_ct_rootfs() {
+  printf 'mount\n' >> "$TRACE"
+  [ "$MOUNT_STATUS" = 0 ] || die 'mount failed'
+  rootfs=$FIXTURE_ROOT
+  passwd_file="$rootfs/etc/passwd"
+}
+oci_quiet() { printf '%s\n' "$*" >> "$TRACE"; return "$UNMOUNT_STATUS"; }
+python3() { printf 'resolve\n' >> "$TRACE"; command "$PYTHON" -B "$@"; }
+'''
+        done = subprocess.run(
+            ["bash", "-c", script + "\n".join(functions) + "\nensure_runtime_home\nprintf 'continued\\n'\n",
+             "bash", str(self.conf), str(self.root), str(self.trace), str(ROOT / "remote/oci_runtime.py"),
+             sys.executable, str(unmount_status), str(mount_status)],
+            capture_output=True, text=True, timeout=5,
+        )
+        return done, self.conf.read_text(), self.trace.read_text().splitlines()
+
+    def test_explicit_home_including_empty_never_mounts_or_resolves(self):
+        for home in ("/custom", ""):
+            config = f"unrelated: keep\nlxc.environment.runtime: HOME={home}\n"
+            done, after, trace = self.run_home(config)
+            self.assertEqual((done.returncode, after, trace), (0, config, []))
+
+    def test_default_and_effective_uid_write_the_resolved_home_after_unmount(self):
+        for uid, expected in ((None, "/root"), (1001, "/srv/app"), (9999, "/")):
+            config = "unrelated: keep\n" + (f"lxc.init.uid: {uid}\n" if uid is not None else "")
+            done, after, trace = self.run_home(config)
+            self.assertEqual(done.returncode, 0, done.stderr)
+            self.assertEqual(after, config + f"lxc.environment.runtime: HOME={expected}\n")
+            self.assertEqual(trace, ["mount", "resolve", "pct unmount 123456789"])
+
+    def test_invalid_uid_leaves_config_unchanged_without_mount(self):
+        config = "lxc.init.uid: not-a-uid\n"
+        done, after, trace = self.run_home(config)
+        self.assertEqual((done.returncode, after, trace), (0, config, []))
+
+    def test_rejected_input_unmounts_and_preserves_config(self):
+        self.passwd.unlink()
+        self.passwd.symlink_to(self.root / "missing")
+        config = "unrelated: keep\n"
+        done, after, trace = self.run_home(config)
+        self.assertEqual((done.returncode, after), (0, config))
+        self.assertEqual(trace, ["mount", "resolve", "pct unmount 123456789"])
+
+    def test_failed_unmount_stops_before_config_write_for_success_and_failure(self):
+        for valid in (True, False):
+            if not valid:
+                self.passwd.unlink()
+            config = "unrelated: keep\n"
+            done, after, trace = self.run_home(config, unmount_status=1)
+            self.assertNotEqual(done.returncode, 0)
+            self.assertEqual(after, config)
+            self.assertNotIn("continued", done.stdout)
+            self.assertEqual(trace, ["mount", "resolve", "pct unmount 123456789"])
+
+    def test_failed_mount_never_reads_or_writes(self):
+        config = "unrelated: keep\n"
+        done, after, trace = self.run_home(config, mount_status=1)
+        self.assertNotEqual(done.returncode, 0)
+        self.assertEqual(after, config)
+        self.assertEqual(trace, ["mount"])
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/oci/tests/test_shared_directories.py b/oci/tests/test_shared_directories.py
index d8204835..55545374 100644
--- a/oci/tests/test_shared_directories.py
+++ b/oci/tests/test_shared_directories.py
@@ -43,15 +43,18 @@ class ScriptedUI:
     def password(self, text, required=True):
         return self._answer(text, "")
 
-    def choose(self, text, options, default=None):
+    def choose(self, text, options, default=None, **_kwargs):
         return self._answer(text, default)
 
     def confirm(self, text, default=False):
         return self._answer(text, default)
 
-    def message(self, text):
+    def message(self, text, *_args):
         pass
 
+    def review(self, *_args, **_kwargs):
+        return True
+
 
 @patch("proxmenux_oci.i18n.language", return_value="en")
 @patch("proxmenux_oci.installer.host.storages", side_effect=storages)
@@ -223,14 +226,15 @@ class SharedDirectoriesTests(unittest.TestCase):
              patch("proxmenux_oci.recreation.edit_acceleration"), \
              patch("proxmenux_oci.recreation.edit_environment"):
             ui = ScriptedUI({"Add a directory to share": [True], NAME: ["photos"],
+                             "Choose a setting. Changes are applied only after the final review.": ["shares", "apply"],
                              "Where to store /shares/photos": ["host-bind"],
                              "Host path for /shares/photos": ["/tank/photos"]})
             proposal = edit_recreation(record, ui)
             mounts = [m["container_path"] for m in proposal["candidate"]["deployment"]["mounts"]]
             self.assertEqual(mounts, ["/config", "/shares/media", "/shares/photos"])
-            untouched = edit_recreation(record, ScriptedUI())
-            self.assertEqual([m["container_path"] for m in untouched["candidate"]["deployment"]["mounts"]],
-                             ["/config", "/shares/media"])
+            untouched = edit_recreation(record, ScriptedUI({
+                "Choose a setting. Changes are applied only after the final review.": ["discard"]}))
+            self.assertIsNone(untouched)
         self.assertEqual([m["container_path"] for m in plan["mounts"]], ["/config", "/shares/media"])
 
 
diff --git a/scripts/global/platform-functions.sh b/scripts/global/platform-functions.sh
new file mode 100644
index 00000000..7ca2b240
--- /dev/null
+++ b/scripts/global/platform-functions.sh
@@ -0,0 +1,18 @@
+#!/bin/bash
+# Canonical detection is shared with the Monitor; never infer PBS from a client package.
+pmx_platform_field() {
+    python3 "$(dirname "${BASH_SOURCE[0]}")/proxmox_platform.py" --field "$1"
+}
+
+pmx_is_pbs() {
+    [[ "$(pmx_platform_field product)" == pbs ]]
+}
+
+# Only a host known to be PBS is refused: if the package list cannot be read,
+# the PVE scripts keep working as they did before PBS support.
+pmx_require_pve() {
+    if pmx_is_pbs; then
+        msg_error "$(translate 'This operation requires a Proxmox VE host. Use the PBS menu on Proxmox Backup Server.')"
+        return 1
+    fi
+}
diff --git a/scripts/global/proxmox_platform.py b/scripts/global/proxmox_platform.py
new file mode 100644
index 00000000..f6744f43
--- /dev/null
+++ b/scripts/global/proxmox_platform.py
@@ -0,0 +1,56 @@
+"""Shared PVE/PBS platform detection for the menus and the Monitor (stdlib only)."""
+
+import argparse
+import json
+from pathlib import Path
+import re
+import subprocess
+
+OS_RELEASE = Path("/etc/os-release")
+SUPPORTED = {("pve", 8): "bookworm", ("pve", 9): "trixie",
+             ("pbs", 3): "bookworm", ("pbs", 4): "trixie"}
+
+
+def detect_platform():
+    codename = ""
+    try:
+        match = re.search(r'^VERSION_CODENAME=["\']?([a-z0-9-]+)', OS_RELEASE.read_text(), re.M)
+        codename = match.group(1) if match else ""
+    except OSError:
+        pass
+    installed = {}
+    try:
+        result = subprocess.run(
+            ["dpkg-query", "-W", "-f=${Package}\t${Status}\t${Version}\n",
+             "pve-manager", "proxmox-backup-server"], capture_output=True, text=True, timeout=5,
+        )
+        # dpkg returns nonzero if ONE requested package is missing; its other
+        # installed rows remain authoritative. A PBS client alone is not PBS.
+        for line in result.stdout.splitlines():
+            columns = line.split("\t")
+            if len(columns) == 3 and columns[1] == "install ok installed":
+                installed[columns[0]] = columns[2]
+    except (OSError, subprocess.TimeoutExpired):
+        pass
+    for package, product in (("pve-manager", "pve"), ("proxmox-backup-server", "pbs")):
+        version = installed.get(package, "")
+        match = re.fullmatch(r"(?:[0-9]+:)?([0-9]+)\.[0-9]+(?:\.[0-9]+)?(?:[-+~.a-zA-Z0-9]*)", version)
+        if match:
+            major = int(match.group(1))
+            return {"product": product, "version": version, "major": major,
+                    "codename": codename, "supported": SUPPORTED.get((product, major)) == codename}
+    return {"product": "unknown", "version": None, "major": None,
+            "codename": codename, "supported": False}
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--field", choices=("product", "version", "major", "codename", "supported"))
+    arguments = parser.parse_args()
+    data = detect_platform()
+    value = data.get(arguments.field) if arguments.field else data
+    print(value if isinstance(value, str) else json.dumps(value))
+
+
+if __name__ == "__main__":
+    main()
diff --git a/scripts/global/remove-banner-pve-v3.sh b/scripts/global/remove-banner-pve-v3.sh
index 4ddf7af2..92df1028 100644
--- a/scripts/global/remove-banner-pve-v3.sh
+++ b/scripts/global/remove-banner-pve-v3.sh
@@ -283,6 +283,10 @@ reload_services() {
     systemctl is-active --quiet pvedaemon 2>/dev/null && {
         systemctl reload pvedaemon 2>/dev/null || true
     }
+    # Proxmox Backup Server serves the same toolkit from its own proxy.
+    systemctl is-active --quiet proxmox-backup-proxy 2>/dev/null && {
+        systemctl reload proxmox-backup-proxy 2>/dev/null || systemctl restart proxmox-backup-proxy 2>/dev/null || true
+    }
 }
 
 main() {
@@ -316,9 +320,12 @@ EOFAPT
 # Main function to remove subscription banner
 remove_subscription_banner_v3() {
     local pve_version
-    pve_version=$(pveversion 2>/dev/null | grep -oP 'pve-manager/\K[0-9]+\.[0-9]+' | head -1 || echo "unknown")
-    
-    msg_info "$(translate "Detected Proxmox VE") ${pve_version} - $(translate "applying minimal banner patch")"
+    if command -v pveversion >/dev/null 2>&1; then
+        pve_version=$(pveversion 2>/dev/null | grep -oP 'pve-manager/\K[0-9]+\.[0-9]+' | head -1 || echo "unknown")
+        msg_info "$(translate "Detected Proxmox VE") ${pve_version} - $(translate "applying minimal banner patch")"
+    else
+        msg_info "$(translate "Detected Proxmox Backup Server") - $(translate "applying minimal banner patch")"
+    fi
     
 
     
diff --git a/scripts/global/repository-functions.sh b/scripts/global/repository-functions.sh
index 32dd8364..7a2f3b86 100644
--- a/scripts/global/repository-functions.sh
+++ b/scripts/global/repository-functions.sh
@@ -2,12 +2,21 @@
 # Shared repository policy for package-install and safe-update flows.
 # Proxmox's own repository API parses .list/.sources and edits individual
 # entries. No shell rewriting of operator-maintained APT files.
+source "$(dirname "${BASH_SOURCE[0]}")/platform-functions.sh"
 repository_policy() {
     python3 "$(dirname "${BASH_SOURCE[0]}")/repository_policy.py" "$@"
 }
 
 ensure_repositories() {
     local version suite decision refresh_status
+    if pmx_is_pbs; then
+        if [[ "$(pmx_platform_field supported)" != true ]]; then
+            msg_error "$(translate 'This operation supports PBS 3 on Debian 12 and PBS 4 on Debian 13.')"
+            return 1
+        fi
+        msg_info "$(translate 'PBS: using the configured APT repositories without changing sources.')"
+        return 0
+    fi
     version=$(pveversion 2>/dev/null | grep -oP 'pve-manager/\K[0-9]+' | head -1)
     case "$version" in
         8) suite=bookworm ;;
@@ -53,3 +62,48 @@ ensure_repositories() {
     fi
     return 0
 }
+
+# The no-subscription switch of a Proxmox Backup Server: the same policy and
+# API as on PVE, offered only when the host has no active subscription.
+ensure_pbs_repositories() {
+    local suite decision refresh_status
+    if [[ "$(pmx_platform_field supported)" != true ]]; then
+        msg_error "$(translate 'This operation supports PBS 3 on Debian 12 and PBS 4 on Debian 13.')"
+        return 1
+    fi
+    suite=$(pmx_platform_field codename)
+    decision=$(repository_policy plan "$suite" pbs) || return 1
+    case "$decision" in
+        preserve) return 0 ;;
+        offer) ;;
+        *) msg_error "$(translate 'Repository policy returned an unexpected result.')"; return 1 ;;
+    esac
+    if ! declare -F hybrid_yesno >/dev/null || { [[ ! -t 0 ]] && ! { declare -F is_web_mode >/dev/null && is_web_mode; }; }; then
+        msg_error "$(translate 'No active subscription and no usable PBS repository. Noninteractive mode cannot change APT sources; configure them in Administration > Repositories.')"
+        return 1
+    fi
+    if ! hybrid_yesno "$(translate 'Proxmox repository')" \
+        "$(translate 'This Proxmox Backup Server has no active subscription, switch to the no-subscription repository? The inaccessible Enterprise PBS source will be disabled.')" 14 90; then
+        msg_error "$(translate 'Repository switch declined; no APT source changed.')"
+        return 1
+    fi
+    decision=$(repository_policy apply "$suite" pbs) || return 1
+    [[ "$decision" == changed || "$decision" == preserve ]] || return 1
+    if [[ "$decision" == changed ]]; then
+        if declare -F pmx_record_execution >/dev/null; then
+            local journal_function="${PMX_JOURNAL_FUNCTION:-}" journal_version="${PMX_JOURNAL_VERSION:-}"
+            pmx_journal_context "ensure_pbs_repositories" "" "${PMX_JOURNAL_SOURCE:-}"
+            pmx_record_execution "Switch to the PBS no-subscription repository" \
+                "proxmox-backup-debug api set /nodes/localhost/apt/repositories --handle no-subscription"
+            PMX_JOURNAL_FUNCTION="$journal_function" PMX_JOURNAL_VERSION="$journal_version"
+        fi
+        if apt-get update; then
+            return 0
+        else
+            refresh_status=$?
+            msg_error "$(translate 'Repository sources changed, but APT package-list refresh failed. Operation stopped; sources were not rolled back. Inspect Administration > Repositories and retry apt-get update before continuing.')"
+            return "$refresh_status"
+        fi
+    fi
+    return 0
+}
diff --git a/scripts/global/repository_policy.py b/scripts/global/repository_policy.py
index 7e0dca70..95f40d68 100644
--- a/scripts/global/repository_policy.py
+++ b/scripts/global/repository_policy.py
@@ -1,5 +1,6 @@
 #!/usr/bin/env python3
-"""Proxmox repository policy via its own parsed APT repository API.
+"""Proxmox VE and Proxmox Backup Server repository policy via their own parsed APT
+repository API.
 
 Only `notfound` or `expired` permits an offered switch. Never print raw subscription or
 repository API responses: they can contain subscription keys or credentials.
@@ -12,6 +13,19 @@ import sys
 
 ENDPOINT = '/nodes/localhost/apt/repositories'
 PVE_CHANNELS = {'pve-enterprise', 'pve-no-subscription', 'pve-test', 'pvetest'}
+# Proxmox VE and Proxmox Backup Server share the repository API; each has its
+# own command line, channels and place in the web interface.
+PRODUCTS = {
+    'pve': {'api': ['pvesh'], 'name': 'Proxmox VE', 'short': 'PVE',
+            'channels': PVE_CHANNELS, 'enterprise': 'pve-enterprise', 'public': 'pve-no-subscription',
+            'test': {'pve-no-subscription', 'pve-test', 'pvetest'},
+            'ui': 'Node > Updates > Repositories', 'ceph': True},
+    'pbs': {'api': ['proxmox-backup-debug', 'api'], 'name': 'Proxmox Backup Server', 'short': 'PBS',
+            'channels': {'pbs-enterprise', 'pbs-no-subscription', 'pbs-test', 'pbstest'},
+            'enterprise': 'pbs-enterprise', 'public': 'pbs-no-subscription',
+            'test': {'pbs-no-subscription', 'pbs-test', 'pbstest'},
+            'ui': 'Administration > Repositories', 'ceph': False},
+}
 
 
 def run(args):
@@ -21,7 +35,16 @@ def run(args):
         raise ValueError(f'Unable to query or change Proxmox repository state ({args[0]}). Check the service and retry.') from exc
 
 
-def subscription_status():
+def subscription_status(product='pve'):
+    if product == 'pbs':
+        # Only the status field is read; the answer also carries the server ID.
+        try:
+            status = json.loads(run(['proxmox-backup-manager', 'subscription', 'get', '--output-format', 'json'])).get('status')
+        except (ValueError, AttributeError):
+            status = None
+        if status not in ('active', 'notfound', 'expired'):
+            raise ValueError('Subscription status is not unambiguously active, notfound or expired. Check proxmox-backup-manager subscription get locally; no repository changed.')
+        return status
     # pvesubscription's CLI get printer emits sorted "key: value" lines,
     # including a secret key and server ID. Only parse the exact status line.
     output = run(['pvesubscription', 'get'])
@@ -31,9 +54,10 @@ def subscription_status():
     return statuses[0]
 
 
-def repository_state(suite):
+def repository_state(suite, product='pve'):
+    p = PRODUCTS[product]
     try:
-        data = json.loads(run(['pvesh', 'get', ENDPOINT, '--output-format', 'json']))
+        data = json.loads(run([*p['api'], 'get', ENDPOINT, '--output-format', 'json']))
         if not isinstance(data, dict) or not isinstance(data['files'], list) or not isinstance(data['errors'], list) or not isinstance(data['digest'], str) or not isinstance(data['standard-repos'], list):
             raise ValueError()
         if data['errors']:
@@ -86,13 +110,14 @@ def repository_state(suite):
                 entries.append((file['path'], index, row))
         return data, entries
     except (KeyError, TypeError, ValueError, IndexError) as exc:
-        raise ValueError('Proxmox APT repository inventory is invalid or reports parse errors. Fix sources in Node > Updates > Repositories; no repository changed.') from exc
+        raise ValueError(f"Proxmox APT repository inventory is invalid or reports parse errors. Fix sources in {p['ui']}; no repository changed.") from exc
 
 
-def evaluate(suite, apply=False):
+def evaluate(suite, apply=False, product='pve'):
     if suite not in ('bookworm', 'trixie'):
         raise ValueError('Unsupported Proxmox suite; no repository changed.')
-    data, entries = repository_state(suite)
+    p = PRODUCTS[product]
+    data, entries = repository_state(suite, product)
     pve = []
     ceph = []
     debian = False
@@ -102,40 +127,40 @@ def evaluate(suite, apply=False):
         if not row['Enabled'] or 'deb' not in row['Types']:
             continue
         components = set(row['Components'])
-        if components & PVE_CHANNELS:
+        if components & p['channels']:
             if suite not in row['Suites']:
-                wrong_pve.append(f"{' '.join(sorted(components & PVE_CHANNELS))} in {path} (suite {' '.join(row['Suites'])})")
+                wrong_pve.append(f"{' '.join(sorted(components & p['channels']))} in {path} (suite {' '.join(row['Suites'])})")
             pve.append((path, index, row))
-        if 'main' in components and suite in row['Suites'] and not components & PVE_CHANNELS:
+        if 'main' in components and suite in row['Suites'] and not components & p['channels']:
             debian = True
-        if 'enterprise' in components and any('/ceph-' in uri for uri in row['URIs']):
+        if p['ceph'] and 'enterprise' in components and any('/ceph-' in uri for uri in row['URIs']):
             if suite not in row['Suites']:
                 wrong_ceph.append(f"{path} (suite {' '.join(row['Suites'])})")
             ceph.append((path, index, row))
     # Name the stale sources, never their URIs: those can carry credentials.
     if wrong_pve:
-        raise ValueError(f"This host runs Proxmox VE on {suite}, but these Proxmox VE repositories are for another suite: "
-                         f"{'; '.join(wrong_pve)}. Disable or remove them in Node > Updates > Repositories and run the update again; no repository changed.")
+        raise ValueError(f"This host runs {p['name']} on {suite}, but these {p['name']} repositories are for another suite: "
+                         f"{'; '.join(wrong_pve)}. Disable or remove them in {p['ui']} and run the update again; no repository changed.")
     if wrong_ceph:
         raise ValueError(f"This host runs Proxmox VE on {suite}, but these Enterprise Ceph repositories are for another suite: "
                          f"{'; '.join(wrong_ceph)}. Correct them in Node > Updates > Repositories before switching; no repository changed.")
 
-    if any(set(row['Components']) & {'pve-no-subscription', 'pve-test', 'pvetest'} for _, _, row in pve):
+    if any(set(row['Components']) & p['test'] for _, _, row in pve):
         return 'preserve'
     # Entitlement lookup is only needed when considering a switch. Existing
     # public/test channels are the operator's choice, even if lookup fails.
-    status = subscription_status()  # fail closed before any write
+    status = subscription_status(product)  # fail closed before any write
     if status == 'active':
         if not pve:
-            raise ValueError('Host has an active subscription but no active PVE repository. Configure its Enterprise source in Node > Updates > Repositories; no repository changed.')
+            raise ValueError(f"Host has an active subscription but no active {p['short']} repository. Configure its Enterprise source in {p['ui']}; no repository changed.")
         return 'preserve'
     if not debian:
         raise ValueError('No active Debian base repository for this suite; configure it in the Proxmox repository UI before continuing.')
-    # No active PVE source or only inaccessible Enterprise. A mixed stanza
+    # No active product source or only inaccessible Enterprise. A mixed stanza
     # cannot be disabled without also disabling an unrelated component.
-    disable = [item for item in pve if 'pve-enterprise' in item[2]['Components']] + ceph
+    disable = [item for item in pve if p['enterprise'] in item[2]['Components']] + ceph
     for _, _, row in disable:
-        expected = {'pve-enterprise'} if 'pve-enterprise' in row['Components'] else {'enterprise'}
+        expected = {p['enterprise']} if p['enterprise'] in row['Components'] else {'enterprise'}
         if set(row['Components']) != expected:
             raise ValueError('Enterprise shares an APT stanza with other components. Split it in the Proxmox repository UI; no repository changed.')
     handles = [r.get('handle') for r in data['standard-repos'] if r.get('handle') == 'no-subscription']
@@ -149,9 +174,9 @@ def evaluate(suite, apply=False):
     try:
         for path, index, original in disable:
             next(file for file in expected if file['path'] == path)['repositories'][index]['Enabled'] = False
-            run(['pvesh', 'create', ENDPOINT, '--path', path, '--index', str(index),
+            run([*p['api'], 'create', ENDPOINT, '--path', path, '--index', str(index),
                  '--enabled', '0', '--digest', data['digest']])
-            refreshed, current = repository_state(suite)
+            refreshed, current = repository_state(suite, product)
             # Per-file digests change when Proxmox serializes the disabled entry.
             inventory = lambda files: sorted(
                 ({key: value for key, value in file.items() if key != 'digest'} for file in files),
@@ -159,23 +184,25 @@ def evaluate(suite, apply=False):
             if inventory(refreshed['files']) != inventory(expected):
                 raise ValueError('Could not verify the expected repository inventory after Enterprise disable; possible concurrent edit. Inspect the Proxmox repository UI before retrying.')
             data = refreshed
-        run(['pvesh', 'set', ENDPOINT, '--handle', 'no-subscription', '--digest', data['digest']])
-        _, current = repository_state(suite)
+        run([*p['api'], 'set', ENDPOINT, '--handle', 'no-subscription', '--digest', data['digest']])
+        _, current = repository_state(suite, product)
         if not any(row['Enabled'] and 'deb' in row['Types'] and suite in row['Suites']
-                   and 'pve-no-subscription' in row['Components'] for _, _, row in current) \
+                   and p['public'] in row['Components'] for _, _, row in current) \
            or any(p == path and i == index and row['Enabled']
                   for path, index, _ in disable for p, i, row in current):
             raise ValueError('Could not verify the switched repositories; inspect the Proxmox repository UI before retrying.')
     except ValueError as exc:
-        raise ValueError('Could not complete or verify the repository switch; changes may be partial and repository state is unknown. Inspect Node > Updates > Repositories before retrying; no automatic rollback was attempted.') from exc
+        raise ValueError(f"Could not complete or verify the repository switch; changes may be partial and repository state is unknown. Inspect {p['ui']} before retrying; no automatic rollback was attempted.") from exc
     return 'changed'
 
 
 def main():
     try:
-        if len(sys.argv) != 3 or sys.argv[1] not in ('plan', 'apply'):
-            raise ValueError('Usage: repository_policy.py plan|apply bookworm|trixie')
-        print(evaluate(sys.argv[2], apply=sys.argv[1] == 'apply'))
+        if len(sys.argv) not in (3, 4) or sys.argv[1] not in ('plan', 'apply') \
+                or (len(sys.argv) == 4 and sys.argv[3] not in PRODUCTS):
+            raise ValueError('Usage: repository_policy.py plan|apply bookworm|trixie [pve|pbs]')
+        product = sys.argv[3] if len(sys.argv) == 4 else 'pve'
+        print(evaluate(sys.argv[2], apply=sys.argv[1] == 'apply', product=product))
     except ValueError as exc:
         print(str(exc), file=sys.stderr)
         return 1
diff --git a/scripts/global/update-pbs.sh b/scripts/global/update-pbs.sh
new file mode 100644
index 00000000..54574676
--- /dev/null
+++ b/scripts/global/update-pbs.sh
@@ -0,0 +1,188 @@
+#!/bin/bash
+# ==========================================================
+# Proxmox Backup Server Update Script (post-install flows)
+# ==========================================================
+
+LOCAL_SCRIPTS="/usr/local/share/proxmenux/scripts"
+BASE_DIR="/usr/local/share/proxmenux"
+UTILS_FILE="$BASE_DIR/utils.sh"
+APT_ENV="env DEBIAN_FRONTEND=noninteractive LC_ALL=C LANG=C"
+
+if [[ -f "$UTILS_FILE" ]]; then
+    source "$UTILS_FILE"
+fi
+if [[ -f "$LOCAL_SCRIPTS/global/pmx_journal.sh" ]]; then
+    source "$LOCAL_SCRIPTS/global/pmx_journal.sh"
+fi
+source "$LOCAL_SCRIPTS/global/common-functions.sh"
+source "$LOCAL_SCRIPTS/global/repository-functions.sh"
+
+load_language
+initialize_cache
+
+update_pbs() {
+    local FUNC_VERSION="1.0"
+    pmx_journal_context "update_pbs" "$FUNC_VERSION"
+
+    if ! pmx_is_pbs || [[ "$(pmx_platform_field supported)" != true ]]; then
+        msg_error "$(translate 'This operation supports PBS 3 on Debian 12 and PBS 4 on Debian 13.')"
+        return 1
+    fi
+
+    local start_time
+    start_time=$(date +%s)
+    local log_file="/var/log/proxmox-update-$(date +%Y%m%d-%H%M%S).log"
+    local screen_capture="/tmp/proxmenux_screen_capture_$$.txt"
+    local OS_CODENAME
+    OS_CODENAME=$(pmx_platform_field codename)
+
+    {
+        echo "=== ProxMenux — Proxmox Backup Server update ==="
+        echo "Started: $(date -Iseconds)"
+        echo "Host:    $(hostname)"
+        echo "Running: proxmox-backup-server $(dpkg-query -W -f='${Version}' proxmox-backup-server 2>/dev/null)"
+    } > "$log_file"
+
+    if ! ensure_pbs_repositories; then
+        msg_error "$(translate "Failed to configure Proxmox Backup Server repositories")"
+        rm -f "$screen_capture"
+        return 1
+    fi
+
+    local available_space
+    available_space=$(df /var/cache/apt/archives | awk 'NR==2 {print int($4/1024)}')
+    if [ "$available_space" -lt 1024 ]; then
+        msg_error "$(translate "Insufficient disk space. Available: ${available_space}MB")"
+        return 1
+    fi
+
+    local update_output update_exit_code
+    update_output=$(apt-get -o APT::Update::Error-Mode=any update 2>&1)
+    update_exit_code=$?
+    {
+        echo
+        echo "--- apt-get update (exit $update_exit_code) ---"
+        printf '%s\n' "$update_output"
+    } >> "$log_file"
+    if [ $update_exit_code -ne 0 ]; then
+        msg_error "$(translate "APT refresh failed. Check the PBS subscription and repositories in Administration > Repositories. Log:") $log_file"
+        return 1
+    fi
+    msg_ok "$(translate "Package lists updated successfully")" | tee -a "$screen_capture"
+
+    local current_version available_version
+    current_version=$(dpkg-query -W -f='${Version}' proxmox-backup-server 2>/dev/null)
+    available_version=$(apt-cache policy proxmox-backup-server 2>/dev/null | awk '/Candidate:/ {print $2; exit}')
+
+    local upgradable upgradable_raw upgradable_list security_updates
+    upgradable_raw=$($APT_ENV apt list --upgradable 2>/dev/null \
+        | sed '1d' \
+        | sed '/^\s*$/d')
+    upgradable=$(printf '%s' "$upgradable_raw" | grep -c . )
+    security_updates=$(printf '%s\n' "$upgradable_raw" | grep -ci '\-security')
+    upgradable_list=$(printf '%s\n' "$upgradable_raw" | pmx_format_upgradable)
+
+    {
+        echo
+        echo "--- Packages to upgrade ($upgradable) ---"
+        [ "$upgradable" -gt 0 ] && printf '%s\n' "$upgradable_list"
+    } >> "$log_file"
+
+    local menu_text
+    menu_text="$(translate "System Update Information")\n\n"
+    menu_text+="$(translate "Current PBS Version"): $current_version\n"
+    if [ -n "$available_version" ] && [ "$available_version" != "$current_version" ]; then
+        menu_text+="$(translate "Available PBS Version"): $available_version\n"
+    fi
+    menu_text+="\n$(translate "Package Updates Available"): $upgradable\n"
+    menu_text+="$(translate "Security Updates"): $security_updates\n\n"
+
+    if [ "$upgradable" -eq 0 ]; then
+        menu_text+="$(translate "System is already up to date")"
+        whiptail --title "$(translate "Update Status")" --msgbox "$menu_text" 15 70
+        clear
+        show_proxmenux_logo
+        msg_title "$(translate "$SCRIPT_TITLE")"
+        cat "$screen_capture"
+        msg_ok "$(translate "System is already up to date. No update needed.")"
+        echo -e "\nSystem is already up to date." >> "$log_file"
+        rm -f "$screen_capture"
+        return 0
+    fi
+
+    menu_text+="$(translate "Packages to be upgraded"):\n$upgradable_list\n\n"
+    menu_text+="$(translate "Do you want to proceed with the system update?")"
+    local proceed=0
+    whiptail --title "$(translate "Proxmox Backup Server Update")" --scrolltext --yesno "$menu_text" 24 78 || proceed=1
+
+    clear
+    show_proxmenux_logo
+    msg_title "$(translate "$SCRIPT_TITLE")"
+    cat "$screen_capture"
+
+    if [ $proceed -ne 0 ]; then
+        msg_info2 "$(translate "Update cancelled by user")"
+        rm -f "$screen_capture"
+        return 0
+    fi
+
+    pmx_record_execution "Upgrade Proxmox Backup Server packages" "apt -y -o Dpkg::Options::=--force-confdef -o Dpkg::Options::=--force-confold full-upgrade"
+    local dpkg_mark upgrade_exit_code
+    dpkg_mark=$(date '+%Y-%m-%d %H:%M:%S')
+    echo -e "\n--- apt full-upgrade ---" >> "$log_file"
+    DEBIAN_FRONTEND=noninteractive apt -y \
+        -o Dpkg::Options::='--force-confdef' \
+        -o Dpkg::Options::='--force-confold' \
+        full-upgrade 2> >(tee -a "$log_file" >&2)
+    upgrade_exit_code=$?
+    echo -e
+    {
+        echo
+        echo "--- Packages changed (exit $upgrade_exit_code) ---"
+        pmx_dpkg_changes_since "$dpkg_mark"
+    } >> "$log_file"
+
+    clear
+    show_proxmenux_logo
+    msg_title "$(translate "$SCRIPT_TITLE")"
+    cat "$screen_capture"
+    rm -f "$screen_capture"
+
+    if [ $upgrade_exit_code -ne 0 ]; then
+        msg_error "$(translate "System upgrade failed. Check log: $log_file")"
+        echo "Finished: $(date -Iseconds) — upgrade failed (exit $upgrade_exit_code)" >> "$log_file"
+        return 1
+    fi
+
+    pmx_record_execution "Remove unused packages" "apt-get -y autoremove"
+    apt-get -y autoremove > /dev/null 2>&1 || true
+    apt-get -y autoclean > /dev/null 2>&1 || true
+    msg_ok "$(translate "Cleanup finished")"
+
+    local end_time duration minutes seconds
+    end_time=$(date +%s)
+    duration=$((end_time - start_time))
+    minutes=$((duration / 60))
+    seconds=$((duration % 60))
+
+    echo -e "${TAB}${BGN}$(translate "====== PBS UPDATE COMPLETED ======")${CL}"
+    echo -e "${TAB}${GN}⏱️  $(translate "Duration")${CL}: ${BL}${minutes}m ${seconds}s${CL}"
+    echo -e "${TAB}${GN}📄 $(translate "Log file")${CL}: ${BL}$log_file${CL}"
+    echo -e "${TAB}${GN}📦 $(translate "Packages upgraded")${CL}: ${BL}$upgradable${CL}"
+    echo -e "${TAB}${GN}🗄️  $(translate "Proxmox Backup Server")${CL}: ${BL}$(dpkg-query -W -f='${Version}' proxmox-backup-server 2>/dev/null) (Debian $OS_CODENAME)${CL}"
+
+    {
+        echo
+        echo "Finished: $(date -Iseconds) — ${minutes}m ${seconds}s"
+        echo "Running: proxmox-backup-server $(dpkg-query -W -f='${Version}' proxmox-backup-server 2>/dev/null)"
+    } >> "$log_file"
+
+    if [ -f /var/run/reboot-required ] || [ "$(uname -r)" != "$(ls -1 /boot/vmlinuz-* 2>/dev/null | sed 's|/boot/vmlinuz-||' | sort -V | tail -1)" ]; then
+        msg_warn "$(translate "A newer kernel is installed. Reboot before the next backup window to use it.")"
+    fi
+    msg_ok "$(translate "Proxmox Backup Server update completed.")"
+}
+
+if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
+    update_pbs
+fi
diff --git a/scripts/global/update-pve8.sh b/scripts/global/update-pve8.sh
index 3db8cfd9..34f36267 100644
--- a/scripts/global/update-pve8.sh
+++ b/scripts/global/update-pve8.sh
@@ -188,7 +188,8 @@ EOF
         pmx_record_execution "Remove unused packages" "apt-get -y autoremove"
         apt-get -y autoremove > /dev/null 2>&1 || true
         apt-get -y autoclean > /dev/null 2>&1 || true
-        return 0
+        # Not an error, but the system was not updated.
+        return 3
     elif [[ $MENU_RESULT -eq 2 ]]; then
         msg_ok "$(translate "System is already up to date. No update needed.")"
         echo -e "\nSystem is already up to date." >> "$log_file"
@@ -280,6 +281,12 @@ EOF
         tput ed
         tput cnorm
         msg_ok "$(translate "System upgrade completed")"
+    else
+        tput rc
+        tput ed
+        tput cnorm
+        msg_error "$(translate "Proxmox VE 8 package upgrade failed. Review the APT output before retrying.")"
+        return 1
     fi
 
 
diff --git a/scripts/gpu_tpu/add_gpu_vm.sh b/scripts/gpu_tpu/add_gpu_vm.sh
index bbbb194a..655418b4 100644
--- a/scripts/gpu_tpu/add_gpu_vm.sh
+++ b/scripts/gpu_tpu/add_gpu_vm.sh
@@ -1121,6 +1121,7 @@ analyze_iommu_group() {
     local group_dir="/sys/kernel/iommu_groups/${IOMMU_GROUP}/devices"
     local display_lines=""
     local extra_devices=0
+    local other_slot_devices=0
 
     for dev_path in "${group_dir}/"*; do
         [[ -e "$dev_path" ]] || continue
@@ -1149,8 +1150,16 @@ analyze_iommu_group() {
         display_lines+="  • ${dev}  ${dev_name}  [${dev_driver}]\n"
 
         [[ "$dev" != "$pci_full" ]] && extra_devices=$((extra_devices + 1))
+        [[ "${dev%.*}" != "${pci_full%.*}" ]] && other_slot_devices=$((other_slot_devices + 1))
     done
 
+    if [[ $other_slot_devices -gt 0 ]]; then
+        local box_h=$(( 13 + ${#IOMMU_DEVICES[@]} ))
+        (( box_h > 24 )) && box_h=24
+        _pmx_msgbox "$(translate 'IOMMU Group') ${IOMMU_GROUP}" \
+            "\n$(translate 'These devices share the IOMMU group of the selected GPU and will be assigned to the VM with it:')\n\n${display_lines}\n$(translate 'The host loses access to them. If the group includes a network or storage controller the host needs, cancel at the summary.')" \
+            "$box_h" 82
+    fi
 }
 
 # Returns 0 if the BDF at $1 is a real PCI audio device (class 04xx).
diff --git a/scripts/gpu_tpu/nvidia_installer.sh b/scripts/gpu_tpu/nvidia_installer.sh
index 0a364451..d927f34a 100644
--- a/scripts/gpu_tpu/nvidia_installer.sh
+++ b/scripts/gpu_tpu/nvidia_installer.sh
@@ -203,8 +203,14 @@ detect_driver_status() {
       
       if [[ -n "$CURRENT_DRIVER_VERSION" ]]; then
         CURRENT_DRIVER_INSTALLED=true
-        # Register the installed driver version in components_status.json
-        update_component_status "nvidia_driver" "installed" "$CURRENT_DRIVER_VERSION" "gpu" '{"patched":false}'
+        # Register the installed driver version in components_status.json,
+        # keeping the patched flag while the recorded version is unchanged.
+        local patched_json='{"patched":false}'
+        if [[ "$(jq -r '.nvidia_driver.version // empty' "$COMPONENTS_STATUS_FILE" 2>/dev/null)" == "$CURRENT_DRIVER_VERSION" ]] \
+           && is_current_nvidia_patched; then
+          patched_json='{"patched":true}'
+        fi
+        update_component_status "nvidia_driver" "installed" "$CURRENT_DRIVER_VERSION" "gpu" "$patched_json"
       fi
     fi
   fi
diff --git a/scripts/help_info_menu.sh b/scripts/help_info_menu.sh
index 770400ca..2808a0cd 100644
--- a/scripts/help_info_menu.sh
+++ b/scripts/help_info_menu.sh
@@ -95,6 +95,7 @@ show_system_commands() {
         echo
         echo -en "${TAB}${BOLD}${YW}${HOLD}$(translate 'Enter a number, or write or paste a command: ') ${CL}"
         read -r user_input
+        cmd=""
 
         # Check for Esc key press
         if [[ "$user_input" == $'\x1b' ]]; then
@@ -184,17 +185,24 @@ show_vm_ct_commands() {
         echo -e " 8) ${GREEN}pct config <ctid>${NC}        - $(translate 'Show container configuration. Use the correct <ctid>')"
         echo -e " 9) ${GREEN}qm destroy <vmid>${NC}        - $(translate 'Delete a VM (irreversible). Use the correct <vmid>')"
         echo -e "10) ${GREEN}pct destroy <ctid>${NC}       - $(translate 'Delete a CT (irreversible). Use the correct <ctid>')"
-        echo -e "11) ${GN}[Only with menu] Show CT users for permission mapping${NC} - $(translate 'root and real users only')"
-        echo -e "12) ${GREEN}pct exec <ctid> -- getent passwd | column -t -s :${NC}  - $(translate 'Show CT users in table format')"
-        echo -e "13) ${GREEN}pct exec <ctid> -- ps aux --sort=-%mem | head${NC}      - $(translate 'Top memory processes in CT')"
-        echo -e "14) ${GREEN}cat /etc/pve/qemu-server/<vmid>.conf${NC}               - $(translate 'View raw VM configuration file')"
-        echo -e "15) ${GREEN}cat /etc/pve/lxc/<ctid>.conf${NC}                       - $(translate 'View raw CT configuration file')"
-        echo -e "16) ${GREEN}nano /etc/pve/qemu-server/<vmid>.conf${NC}              - $(translate 'Edit raw VM configuration file')"
-        echo -e "17) ${GREEN}nano /etc/pve/lxc/<ctid>.conf${NC}                      - $(translate 'Edit raw CT configuration file')"
+        echo -e "11) ${GREEN}qm unlock <vmid>${NC}         - $(translate 'Remove the lock left on a VM by an interrupted task')"
+        echo -e "12) ${GREEN}pct unlock <ctid>${NC}        - $(translate 'Remove the lock left on a container by an interrupted task')"
+        # Translated label: pad it so its description lines up with 14-19.
+        local users_label pad
+        users_label="$(translate 'Show CT users and their UID/GID on the host')"
+        pad=$((51 - ${#users_label})); (( pad < 1 )) && pad=1
+        echo -e "13) ${GN}${users_label}${NC}$(printf '%*s' "$pad" '')- $(translate 'root and real users only')"
+        echo -e "14) ${GREEN}pct exec <ctid> -- getent passwd | column -t -s :${NC}  - $(translate 'Show CT users in table format')"
+        echo -e "15) ${GREEN}pct exec <ctid> -- ps aux --sort=-%mem | head${NC}      - $(translate 'Top memory processes in CT')"
+        echo -e "16) ${GREEN}cat /etc/pve/qemu-server/<vmid>.conf${NC}               - $(translate 'View raw VM configuration file')"
+        echo -e "17) ${GREEN}cat /etc/pve/lxc/<ctid>.conf${NC}                       - $(translate 'View raw CT configuration file')"
+        echo -e "18) ${GREEN}nano /etc/pve/qemu-server/<vmid>.conf${NC}              - $(translate 'Edit raw VM configuration file')"
+        echo -e "19) ${GREEN}nano /etc/pve/lxc/<ctid>.conf${NC}                      - $(translate 'Edit raw CT configuration file')"
         echo -e " ${DEF}0) $(translate ' Back to previous menu or Esc + Enter')"
         echo
         echo -en "${TAB}${BOLD}${YW}${HOLD}$(translate 'Enter a number, or write or paste a command: ') ${CL}"
         read -r user_input
+        cmd=""
 
         # Check for Esc key press
         if [[ "$user_input" == $'\x1b' ]]; then
@@ -212,7 +220,9 @@ show_vm_ct_commands() {
             8) echo -en "${TAB}${BOLD}${YW}${HOLD}$(translate 'Enter CT ID: ')${CL}"; read -r id; cmd="pct config $id" ;;
             9) echo -en "${TAB}${BOLD}${YW}${HOLD}$(translate 'Enter VM ID: ')${CL}"; read -r id; cmd="qm destroy $id" ;;
             10) echo -en "${TAB}${BOLD}${YW}${HOLD}$(translate 'Enter CT ID: ')${CL}"; read -r id; cmd="pct destroy $id" ;;
-            11)
+            11) echo -en "${TAB}${BOLD}${YW}${HOLD}$(translate 'Enter VM ID: ')${CL}"; read -r id; cmd="qm unlock $id" ;;
+            12) echo -en "${TAB}${BOLD}${YW}${HOLD}$(translate 'Enter CT ID: ')${CL}"; read -r id; cmd="pct unlock $id" ;;
+            13)
                 echo -en "${TAB}${BOLD}${YW}${HOLD}$(translate 'Enter CT ID: ')${CL}"
                 read -r id
 
@@ -236,34 +246,34 @@ show_vm_ct_commands() {
                 done
                 ;;
 
-            12)
+            14)
                 echo -en "${TAB}${BOLD}${YW}${HOLD}$(translate 'Enter CT ID: ')${CL}"
                 read -r id
                 cmd="pct exec $id -- getent passwd | column -t -s :"
                 ;; 
 
-            13)
+            15)
 
                 echo -en "${TAB}${BOLD}${YW}${HOLD}$(translate 'Enter CT ID: ')${CL}"
                 read -r id
                 cmd="pct exec $id -- ps aux --sort=-%mem | head"
                 ;;
-            14)
+            16)
                 echo -en "${TAB}${BOLD}${YW}${HOLD}$(translate 'Enter VM ID: ')${CL}"
                 read -r id
                 cmd="cat /etc/pve/qemu-server/$id.conf"
                 ;;
-            15)
+            17)
                 echo -en "${TAB}${BOLD}${YW}${HOLD}$(translate 'Enter CT ID: ')${CL}"
                 read -r id
                 cmd="cat /etc/pve/lxc/$id.conf"
                 ;;
-            16)
+            18)
                 echo -en "${TAB}${BOLD}${YW}${HOLD}$(translate 'Enter VM ID: ')${CL}"
                 read -r id
                 cmd="nano /etc/pve/qemu-server/$id.conf"
                 ;;
-            17)
+            19)
                 echo -en "${TAB}${BOLD}${YW}${HOLD}$(translate 'Enter CT ID: ')${CL}"
                 read -r id
                 cmd="nano /etc/pve/lxc/$id.conf"
@@ -272,8 +282,10 @@ show_vm_ct_commands() {
             *) cmd="$user_input" ;;
         esac
 
-        echo -e "\n${GREEN}> $cmd${NC}\n"
-        bash -c "$cmd"
+        if [[ -n "$cmd" ]]; then
+            echo -e "\n${GREEN}> $cmd${NC}\n"
+            bash -c "$cmd"
+        fi
         echo
         msg_success "$(translate 'Press ENTER to continue...')"
         read -r tmp
@@ -308,7 +320,7 @@ show_storage_commands() {
         echo -e "16) ${GREEN}cat /etc/pve/storage.cfg${NC}    - $(translate 'Show Proxmox storage configuration')"
         echo -e "17) ${GREEN}pvesm status${NC}                - $(translate 'Show status of all storage pools')"
         echo -e "18) ${GREEN}pvesm list <storage>${NC}        - $(translate 'List content of specific storage')"
-        echo -e "19) ${GREEN}pvesm scan <storage>${NC}        - $(translate 'Scan storage for new content')"
+        echo -e "19) ${GREEN}pvesm scan nfs <server>${NC}     - $(translate 'Discover NFS exports on a server')"
         echo -e "20) ${GREEN}qm importdisk <vmid> <img> <storage>${NC}          - $(translate 'Import disk image to VM')"
         echo -e "21) ${GREEN}qm set <vmid> -<bus><index> <disk>${NC}            - $(translate 'Add physical disk to VM via') passthrough"
         echo -e "22) ${GREEN}qemu-img convert -O <format> <input> <output>${NC} - $(translate 'Convert disk image format')"
@@ -324,6 +336,7 @@ show_storage_commands() {
         echo
         echo -en "${TAB}${BOLD}${YW}${HOLD}$(translate 'Enter a number, or write or paste a command: ') ${CL}"
         read -r user_input
+        cmd=""
 
         # Esc key exit
         if [[ "$user_input" == $'\x1b' ]]; then
@@ -358,9 +371,9 @@ show_storage_commands() {
                 cmd="pvesm list $store"
                 ;;
             19)
-                echo -en "${TAB}${BOLD}${YW}${HOLD}$(translate 'Enter storage ID: ')${CL}"
-                read -r store
-                cmd="pvesm scan $store"
+                echo -en "${TAB}${BOLD}${YW}${HOLD}$(translate 'Enter NFS server IP or hostname:') ${CL}"
+                read -r server
+                cmd="pvesm scan nfs $server"
                 ;;
             20)
                 echo -en "${TAB}${BOLD}${YW}${HOLD}$(translate 'Enter VM ID: ')${CL}"
@@ -550,8 +563,10 @@ show_storage_commands() {
             *) cmd="$user_input" ;;
         esac
 
-        echo -e "\n${GREEN}> $cmd${NC}\n"
-        bash -c "$cmd"
+        if [[ -n "$cmd" ]]; then
+            echo -e "\n${GREEN}> $cmd${NC}\n"
+            bash -c "$cmd"
+        fi
         echo
         msg_success "$(translate 'Press ENTER to continue...')"
         read -r tmp
@@ -588,6 +603,7 @@ show_network_commands() {
         echo
         echo -en "${TAB}${BOLD}${YW}${HOLD}$(translate 'Enter a number, or write or paste a command: ') ${CL}"
         read -r user_input
+        cmd=""
 
         if [[ "$user_input" == $'\x1b' ]]; then
             break
@@ -630,8 +646,10 @@ show_network_commands() {
             *) cmd="$user_input" ;;
         esac
 
-        echo -e "\n${GREEN}> $cmd${NC}\n"
-        bash -c "$cmd"
+        if [[ -n "$cmd" ]]; then
+            echo -e "\n${GREEN}> $cmd${NC}\n"
+            bash -c "$cmd"
+        fi
         echo
         msg_success "$(translate 'Press ENTER to continue...')"
         read -r tmp
@@ -652,12 +670,13 @@ show_update_commands() {
         echo -e " 1) ${GREEN}apt update && apt upgrade -y${NC}   - $(translate 'Update and upgrade all system packages')"
         echo -e " 2) ${GREEN}apt dist-upgrade -y${NC}            - $(translate 'Full system upgrade, including dependencies')"
         echo -e " 3) ${GREEN}pveupdate${NC}                      - $(translate 'Update Proxmox package lists')"
-        echo -e " 4) ${GREEN}pveupgrade${NC}                     - $(translate 'Show available Proxmox upgrades')"
+        echo -e " 4) ${GREEN}pveupgrade${NC}                     - $(translate 'Start the interactive Proxmox package upgrade')"
         echo -e " 5) ${GREEN}apt autoremove --purge${NC}         - $(translate 'Remove unused packages and their config')"
         echo -e " ${DEF}0) $(translate ' Back to previous menu or Esc + Enter')"
         echo
         echo -en "${TAB}${BOLD}${YW}${HOLD}$(translate 'Enter a number, or write or paste a command: ') ${CL}"
         read -r user_input
+        cmd=""
 
         # Check for Esc key press
         if [[ "$user_input" == $'\x1b' ]]; then
@@ -674,8 +693,10 @@ show_update_commands() {
             *) cmd="$user_input" ;;
         esac
 
-        echo -e "\n${GREEN}> $cmd${NC}\n"
-        bash -c "$cmd"
+        if [[ -n "$cmd" ]]; then
+            echo -e "\n${GREEN}> $cmd${NC}\n"
+            bash -c "$cmd"
+        fi
         echo
         msg_success "$(translate 'Press ENTER to continue...')"
         read -r tmp
@@ -698,7 +719,7 @@ show_gpu_commands() {
         echo -e " 4) ${GREEN}dmesg -T | grep -Ei 'DMAR|IOMMU|vfio|pcie'${NC}     - $(translate 'Inspect passthrough/kernel events')"
         echo -e " 5) ${GREEN}find /sys/kernel/iommu_groups -type l${NC}          - $(translate 'List IOMMU group mapping')"
         echo -e " 6) ${GREEN}lsmod | grep -E 'vfio|nvidia|amdgpu|apex'${NC}      - $(translate 'Check loaded GPU/TPU modules')"
-        echo -e " 7) ${GREEN}grep -R \"vfio-pci|blacklist\" /etc/modprobe.d${NC} - $(translate 'Review passthrough config files')"
+        echo -e " 7) ${GREEN}grep -R \"vfio-pci|blacklist\" /etc/modprobe.d${NC}   - $(translate 'Review passthrough config files')"
         echo -e " 8) ${GREEN}nvidia-smi${NC}                                     - $(translate 'Check NVIDIA driver and devices')"
         echo -e " 9) ${GREEN}qm config <vmid> | grep 'hostpci|bios'${NC}         - [T] $(translate 'Check VM passthrough settings')"
         echo -e "10) ${GREEN}pct config <ctid> | grep 'dev|lxc.cgroup2'${NC}     - [T] $(translate 'Check LXC GPU/TPU mapping')"
@@ -713,6 +734,7 @@ show_gpu_commands() {
         echo
         echo -en "${TAB}${BOLD}${YW}${HOLD}$(translate 'Enter a number, or write or paste a command: ') ${CL}"
         read -r user_input
+        cmd=""
 
         if [[ "$user_input" == $'\x1b' ]]; then
             break
@@ -794,8 +816,10 @@ show_gpu_commands() {
             continue
         fi
 
-        echo -e "\n${GREEN}> $cmd${NC}\n"
-        bash -c "$cmd"
+        if [[ -n "$cmd" ]]; then
+            echo -e "\n${GREEN}> $cmd${NC}\n"
+            bash -c "$cmd"
+        fi
         echo
         msg_success "$(translate 'Press ENTER to continue...')"
         read -r tmp
@@ -830,6 +854,7 @@ show_zfs_commands() {
         echo
         echo -en "${TAB}${BOLD}${YW}${HOLD}$(translate 'Enter a number, or write or paste a command: ') ${CL}"
         read -r user_input
+        cmd=""
 
         # Detect ESC
         if [[ "$user_input" == $'\x1b' ]]; then
@@ -883,8 +908,10 @@ show_zfs_commands() {
             *) cmd="$user_input" ;;
         esac
 
-        echo -e "\n${GREEN}> $cmd${NC}\n"
-        bash -c "$cmd"
+        if [[ -n "$cmd" ]]; then
+            echo -e "\n${GREEN}> $cmd${NC}\n"
+            bash -c "$cmd"
+        fi
         echo
         msg_success "$(translate 'Press ENTER to continue...')"
         read -r tmp
@@ -916,6 +943,7 @@ show_backup_commands() {
         echo
         echo -en "${TAB}${BOLD}${YW}${HOLD}$(translate 'Enter a number, or write or paste a command: ') ${CL}"
         read -r user_input
+        cmd=""
 
         # Check for Esc key press
         if [[ "$user_input" == $'\x1b' ]]; then
@@ -967,8 +995,10 @@ show_backup_commands() {
             *) cmd="$user_input" ;;
         esac
 
-        echo -e "\n${GREEN}> $cmd${NC}\n"
-        bash -c "$cmd"
+        if [[ -n "$cmd" ]]; then
+            echo -e "\n${GREEN}> $cmd${NC}\n"
+            bash -c "$cmd"
+        fi
         echo
         msg_success "$(translate 'Press ENTER to continue...')"
         read -r tmp
@@ -1001,6 +1031,7 @@ show_tools_commands() {
         echo
         echo -en "${TAB}${BOLD}${YW}${HOLD}$(translate 'Enter a number, or write or paste a command: ') ${CL}"
         read -r user_input
+        cmd=""
 
         # Check for Esc key press
         if [[ "$user_input" == $'\x1b' ]]; then
@@ -1063,8 +1094,10 @@ show_tools_commands() {
             fi
         fi
 
-        echo -e "\n${GREEN}> $cmd${NC}\n"
-        bash -c "$cmd"
+        if [[ -n "$cmd" ]]; then
+            echo -e "\n${GREEN}> $cmd${NC}\n"
+            bash -c "$cmd"
+        fi
         echo
         msg_success "$(translate 'Press ENTER to continue...')"
         read -r tmp
diff --git a/scripts/menus/config_menu.sh b/scripts/menus/config_menu.sh
index 547b2244..ae9695e3 100644
--- a/scripts/menus/config_menu.sh
+++ b/scripts/menus/config_menu.sh
@@ -744,7 +744,7 @@ show_version_info() {
             fi
             local translated_status=$(translate "$status")
             case "$status" in
-                "installed"|"already_installed"|"created"|"already_exists"|"upgraded"|"updated")
+                "installed"|"already_installed"|"installed_from_github"|"created"|"already_exists"|"upgraded"|"updated")
                     info_message+="✓ $component: $translated_status\n"
                     ;;
                 *)
@@ -851,6 +851,9 @@ uninstall_proxmenu() {
         else
             pmx_edit_file /etc/motd '/This system is optimised by: ProxMenux/d'
         fi
+
+        # The change journal above writes under BASE_DIR again.
+        rm -rf "$BASE_DIR"
         
         echo "100" ; echo "Uninstallation complete!"
         sleep 1
diff --git a/scripts/menus/main_menu.sh b/scripts/menus/main_menu.sh
index fb3d806d..69e81bd3 100644
--- a/scripts/menus/main_menu.sh
+++ b/scripts/menus/main_menu.sh
@@ -128,4 +128,8 @@ show_menu() {
     done
 }
 
+source "$LOCAL_SCRIPTS/global/platform-functions.sh"
+if pmx_is_pbs; then
+    exec bash "$LOCAL_SCRIPTS/menus/pbs_menu.sh"
+fi
 show_menu
diff --git a/scripts/menus/menu_post_install.sh b/scripts/menus/menu_post_install.sh
index 447583e7..d4e63cda 100644
--- a/scripts/menus/menu_post_install.sh
+++ b/scripts/menus/menu_post_install.sh
@@ -28,6 +28,12 @@ fi
 load_language
 initialize_cache
 
+PMX_ON_PBS=false
+if [[ -f "$LOCAL_SCRIPTS/global/platform-functions.sh" ]]; then
+    source "$LOCAL_SCRIPTS/global/platform-functions.sh"
+    pmx_is_pbs && PMX_ON_PBS=true
+fi
+
 # ==========================================================
 confirm_and_run() {
     local name="$1"
@@ -55,8 +61,13 @@ confirm_automated_script() {
     local script_info=""
 
 
-    script_info+="$(translate "This script will apply the following optimizations and advanced adjustments to your Proxmox VE server"):\n\n"
-    script_info+="• $(translate "Configure") \Z4free repositories\Z0 $(translate "and upgrade the system (disables the enterprise repo)")\n"
+    if [[ "$PMX_ON_PBS" == true ]]; then
+        script_info+="$(translate "This script will apply the following optimizations and advanced adjustments to your Proxmox Backup Server"):\n\n"
+        script_info+="• $(translate "Upgrade the system, offering the") \Z4no-subscription repository\Z0 $(translate "when the server has no subscription (you will be asked)")\n"
+    else
+        script_info+="$(translate "This script will apply the following optimizations and advanced adjustments to your Proxmox VE server"):\n\n"
+        script_info+="• $(translate "Configure") \Z4free repositories\Z0 $(translate "and upgrade the system (disables the enterprise repo)")\n"
+    fi
     script_info+="• $(translate "Optionally remove") \Z4subscription banner\Z0 $(translate "from Proxmox web interface (you will be asked)")\n"
     script_info+="• $(translate "Optimize") \Z4memory\Z0, \Z4kernel\Z0, $(translate "and") \Z4network\Z0 $(translate "for better performance and stability")\n"
     script_info+="• $(translate "Install and configure") \Z4Log2RAM\Z0 $(translate "(only on SSD/NVMe) to protect your disk")\n"
@@ -229,6 +240,12 @@ declare -a COMMUNITY_SCRIPTS=(
     "Proxmox VE Post Install|Helper-Scripts|bash -c \"\$(wget -qLO - https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/tools/pve/post-pve-install.sh); msg_success \\\"\$(translate 'Press ENTER to continue...')\\\"; read -r _\""
     "Proxmox VE Microcode|Helper-Scripts|bash -c \"\$(wget -qLO - https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/tools/pve/microcode.sh); msg_success \\\"\$(translate 'Press ENTER to continue...')\\\"; read -r _\""
 )
+if [[ "$PMX_ON_PBS" == true ]]; then
+    COMMUNITY_SCRIPTS=(
+        "Proxmox Backup Server Post Install|Helper-Scripts|bash -c \"\$(wget -qLO - https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/tools/pve/post-pbs-install.sh); msg_success \\\"\$(translate 'Press ENTER to continue...')\\\"; read -r _\""
+        "Proxmox Backup Server Microcode|Helper-Scripts|bash -c \"\$(wget -qLO - https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/tools/pve/pbs-microcode.sh); msg_success \\\"\$(translate 'Press ENTER to continue...')\\\"; read -r _\""
+    )
+fi
 
 # ==========================================================
 
@@ -271,6 +288,12 @@ post_install_label() {
         "Proxmox VE Microcode")
             echo "Proxmox VE Microcode"
             ;;
+        "Proxmox Backup Server Post Install")
+            echo "Proxmox Backup Server Post Install"
+            ;;
+        "Proxmox Backup Server Microcode")
+            echo "Proxmox Backup Server Microcode"
+            ;;
         "Community Scripts")
             translate "Community Scripts"
             ;;
diff --git a/scripts/menus/pbs_menu.sh b/scripts/menus/pbs_menu.sh
new file mode 100644
index 00000000..99a8d76c
--- /dev/null
+++ b/scripts/menus/pbs_menu.sh
@@ -0,0 +1,55 @@
+#!/bin/bash
+# ==========================================================
+# ProxMenux - Proxmox Backup Server menu
+# ==========================================================
+# PBS exposes compatible host tools and its own post-install profile;
+# PVE guest optimizations stay in the PVE menu.
+# ==========================================================
+BASE_DIR="/usr/local/share/proxmenux"
+LOCAL_SCRIPTS="$BASE_DIR/scripts"
+source "$BASE_DIR/utils.sh"
+source "$LOCAL_SCRIPTS/global/platform-functions.sh"
+load_language
+initialize_cache
+
+if ! pmx_is_pbs; then
+    msg_error "$(translate 'This menu requires Proxmox Backup Server.')"
+    exit 1
+fi
+
+pbs_show() {
+    local title="$1" output
+    shift
+    output=$(mktemp)
+    if "$@" > "$output" 2>&1; then
+        dialog --backtitle "ProxMenux" --title "$title" --textbox "$output" 24 110
+    else
+        dialog --backtitle "ProxMenux" --title "$(translate 'Command failed')" --textbox "$output" 24 110
+    fi
+    rm -f "$output"
+}
+
+while true; do
+    choice=$(dialog --clear --backtitle "ProxMenux" --title "Proxmox Backup Server" \
+        --menu "$(translate 'Select an option:')" 19 75 9 \
+        1 "$(translate "Settings post-install Proxmox")" \
+        2 "$(translate 'PBS version and packages')" \
+        3 "$(translate 'PBS datastores')" \
+        4 "$(translate 'Recent PBS tasks')" \
+        5 "$(translate 'System Utilities Installer')" \
+        6 "$(translate 'Update PBS using configured repositories')" \
+        s "$(translate 'Settings')" \
+        0 "$(translate 'Exit')" 2>&1 >/dev/tty) || break
+    case "$choice" in
+        1) exec bash "$LOCAL_SCRIPTS/menus/menu_post_install.sh" ;;
+        2) pbs_show "$(translate 'PBS version and packages')" proxmox-backup-manager versions --verbose ;;
+        3) pbs_show "$(translate 'PBS datastores')" proxmox-backup-manager datastore list ;;
+        4) pbs_show "$(translate 'Recent PBS tasks')" proxmox-backup-manager task list --all true --limit 20 ;;
+        5) bash "$LOCAL_SCRIPTS/utilities/system_utils.sh" ;;
+        6) bash "$LOCAL_SCRIPTS/utilities/pbs_update.sh" ;;
+        s) exec bash "$LOCAL_SCRIPTS/menus/config_menu.sh" ;;
+        0) break ;;
+    esac
+done
+clear
+msg_ok "$(translate "Thank you for using ProxMenux. Goodbye!")"
diff --git a/scripts/post_install/auto_post_install.sh b/scripts/post_install/auto_post_install.sh
index a158942d..83f84a82 100644
--- a/scripts/post_install/auto_post_install.sh
+++ b/scripts/post_install/auto_post_install.sh
@@ -57,6 +57,16 @@ fi
 load_language
 initialize_cache
 
+if [[ -f "$LOCAL_SCRIPTS/global/platform-functions.sh" ]]; then
+    source "$LOCAL_SCRIPTS/global/platform-functions.sh"
+fi
+# Proxmox Backup Server runs the same host optimizations; repositories,
+# package upgrade and the subscription notice follow its own tooling.
+PMX_ON_PBS=false
+if declare -F pmx_is_pbs >/dev/null && pmx_is_pbs; then
+    PMX_ON_PBS=true
+fi
+
 # Global variables
 OS_CODENAME="$(grep "VERSION_CODENAME=" /etc/os-release | cut -d"=" -f 2 | xargs)"
 RAM_SIZE_GB=$(awk '/^MemTotal:/{print int($2/1024/1024)}' /proc/meminfo)
@@ -137,6 +147,10 @@ $(translate "Do you want to continue anyway?")" 13 70
 
 
 apt_upgrade() {
+    if [[ "$PMX_ON_PBS" == true ]]; then
+        bash "$LOCAL_SCRIPTS/global/update-pbs.sh"
+        return
+    fi
     local pve_version
     pve_version=$(pveversion 2>/dev/null | grep -oP 'pve-manager/\K[0-9]+' | head -1)
 
@@ -166,6 +180,20 @@ apt_upgrade() {
 remove_subscription_banner() {
     local FUNC_VERSION="1.0"
     # description: Patch the Proxmox web UI to suppress the subscription dialog and register a successful patch.
+    if [[ "$PMX_ON_PBS" == true ]]; then
+        stop_spinner
+        if ! whiptail --title "Proxmox Backup Server Subscription Banner Removal" \
+        --yesno "$(translate "Do you want to remove the Proxmox subscription banner from the Proxmox Backup Server web interface?")\n\n$(translate "Attention: Removing the subscription banner may cause issues in the web interface after a future update.")\n\n$(translate "If this happens, you can restore the backup from the 'Subscription Banner Removal' option in 'Uninstall optimizations'.")\n\n$(translate "Are you sure you want to continue?")" 14 75; then
+            msg_warn "Banner removal cancelled by user."
+            return 1
+        fi
+        if ! bash "$LOCAL_SCRIPTS/global/remove-banner-pve-v3.sh"; then
+            msg_error "$(translate "Subscription banner removal failed")"
+            return 1
+        fi
+        register_tool "subscription_banner" true "$FUNC_VERSION"
+        return 0
+    fi
     local pve_version
     pve_version=$(pveversion 2>/dev/null | grep -oP 'pve-manager/\K[0-9]+' | head -1)
 
@@ -220,6 +248,17 @@ setup_proxmox_repositories() {
 
     msg_info2 "$(translate "Configuring Proxmox APT repositories...")"
 
+    if [[ "$PMX_ON_PBS" == true ]]; then
+        if ! ensure_pbs_repositories; then
+            msg_error "$(translate "Failed to configure Proxmox Backup Server repositories")"
+            register_tool "proxmox_repos" false "$FUNC_VERSION"
+            return 1
+        fi
+        register_tool "proxmox_repos" true "$FUNC_VERSION"
+        msg_success "$(translate "Proxmox Backup Server APT repositories configured")"
+        return 0
+    fi
+
     if ! ensure_repositories; then
         msg_error "$(translate "Failed to configure Proxmox repositories")"
         register_tool "proxmox_repos" false "$FUNC_VERSION"
@@ -519,7 +558,7 @@ force_apt_ipv4() {
 # ==========================================================
 
 apply_network_optimizations() {
-  local FUNC_VERSION="1.1"
+  local FUNC_VERSION="1.2"
   pmx_journal_context "apply_network_optimizations" "$FUNC_VERSION"
   # description: Tune TCP buffers, somaxconn, IPv4 hardening and disable rp_filter on fw bridges (PVE 9 compatible).
   msg_info "$(translate "Optimizing network settings...")"
@@ -617,14 +656,16 @@ RemainAfterExit=yes
 WantedBy=multi-user.target
 EOF
 
-  pmx_write_file /etc/udev/rules.d/99-proxmenux-fwbr-tune.rules <<'EOF'
+  pmx_remove_file /etc/udev/rules.d/99-proxmenux-fwbr-tune.rules
+
+  pmx_write_file /etc/udev/rules.d/99-zz-proxmenux-fwbr-tune.rules <<'EOF'
 ACTION=="add", SUBSYSTEM=="net", KERNEL=="fwbr*", RUN+="/usr/local/sbin/proxmenux-fwbr-tune %k"
 ACTION=="add", SUBSYSTEM=="net", KERNEL=="fwln*", RUN+="/usr/local/sbin/proxmenux-fwbr-tune %k"
 ACTION=="add", SUBSYSTEM=="net", KERNEL=="fwpr*", RUN+="/usr/local/sbin/proxmenux-fwbr-tune %k"
 ACTION=="add", SUBSYSTEM=="net", KERNEL=="tap*",  RUN+="/usr/local/sbin/proxmenux-fwbr-tune %k"
 EOF
-  chmod 0644 /etc/udev/rules.d/99-proxmenux-fwbr-tune.rules
-  chown root:root /etc/udev/rules.d/99-proxmenux-fwbr-tune.rules
+  chmod 0644 /etc/udev/rules.d/99-zz-proxmenux-fwbr-tune.rules
+  chown root:root /etc/udev/rules.d/99-zz-proxmenux-fwbr-tune.rules
 
   systemctl daemon-reload >/dev/null 2>&1 || true
   udevadm control --reload-rules >/dev/null 2>&1 || true
diff --git a/scripts/post_install/customizable_post_install.sh b/scripts/post_install/customizable_post_install.sh
index 49ed0f3c..81601230 100644
--- a/scripts/post_install/customizable_post_install.sh
+++ b/scripts/post_install/customizable_post_install.sh
@@ -51,6 +51,16 @@ fi
 load_language
 initialize_cache
 
+if [[ -f "$LOCAL_SCRIPTS/global/platform-functions.sh" ]]; then
+    source "$LOCAL_SCRIPTS/global/platform-functions.sh"
+fi
+# On Proxmox Backup Server the menu lists only the options that apply to
+# it; repositories, upgrade and the subscription notice use its tooling.
+PMX_ON_PBS=false
+if declare -F pmx_is_pbs >/dev/null && pmx_is_pbs; then
+    PMX_ON_PBS=true
+fi
+
 # Load shared global functions
 if [[ -f "$LOCAL_SCRIPTS/global/common-functions.sh" ]]; then
     source "$LOCAL_SCRIPTS/global/common-functions.sh"
@@ -117,6 +127,17 @@ setup_proxmox_repositories() {
 
     msg_info2 "$(translate "Configuring Proxmox APT repositories...")"
 
+    if [[ "$PMX_ON_PBS" == true ]]; then
+        if ! ensure_pbs_repositories; then
+            msg_error "$(translate "Failed to configure Proxmox Backup Server repositories")"
+            register_tool "proxmox_repos" false "$FUNC_VERSION"
+            return 1
+        fi
+        register_tool "proxmox_repos" true "$FUNC_VERSION"
+        msg_success "$(translate "Proxmox Backup Server APT repositories configured")"
+        return 0
+    fi
+
     if ! ensure_repositories; then
         msg_error "$(translate "Failed to configure Proxmox repositories")"
         register_tool "proxmox_repos" false "$FUNC_VERSION"
@@ -243,6 +264,10 @@ EOF
 
 
 apt_upgrade() {
+    if [[ "$PMX_ON_PBS" == true ]]; then
+        bash "$LOCAL_SCRIPTS/global/update-pbs.sh"
+        return
+    fi
     local pve_version
     pve_version=$(pveversion 2>/dev/null | grep -oP 'pve-manager/\K[0-9]+' | head -1)
 
@@ -2371,6 +2396,14 @@ EOF
 remove_subscription_banner() {
     local FUNC_VERSION="1.0"
     # description: Patch the Proxmox web UI to suppress the "no valid subscription" dialog (PVE 8 + 9 variants supported).
+    if [[ "$PMX_ON_PBS" == true ]]; then
+        if ! bash "$LOCAL_SCRIPTS/global/remove-banner-pve-v3.sh"; then
+            msg_error "$(translate "Subscription banner removal failed")"
+            return 1
+        fi
+        register_tool "subscription_banner" true "$FUNC_VERSION"
+        return 0
+    fi
     local pve_version
     pve_version=$(pveversion 2>/dev/null | grep -oP 'pve-manager/\K[0-9]+' | head -1)
 
@@ -3034,15 +3067,27 @@ register_tool "fastfetch" true "$FUNC_VERSION"
 
 
 configure_figurine() {
-    local FUNC_VERSION="1.1"
+    local FUNC_VERSION="1.2"
     pmx_journal_context "configure_figurine" "$FUNC_VERSION"
     # description: Install Figurine (ASCII-art hostname banner) and wire it into the SSH login flow.
     msg_info2 "$(translate "Installing and configuring Figurine...")"
     # `FIGURINE_VERSION` env var allows pinning to a specific release;
     # default tracks the last tested upstream tag. Audit Tier 6 —
     # recursos remotos sin pinning de versión.
-    local version="${FIGURINE_VERSION:-2.0.0}"
-    local file="figurine_linux_amd64_v${version}.tar.gz"
+    local version="${FIGURINE_VERSION:-2.1.1}"
+    # Prefer the Debian userspace ABI; the upstream 32-bit ARM build requires ARMv7.
+    local arch
+    arch="$(dpkg --print-architecture 2>/dev/null || uname -m)"
+    case "$arch" in
+        amd64|x86_64) arch="amd64" ;;
+        arm64|aarch64) arch="arm64" ;;
+        armhf|armv7l|armv8l) arch="arm" ;;
+        *)
+            msg_error "$(translate "Unsupported architecture for Figurine:") $arch"
+            return 1
+            ;;
+    esac
+    local file="figurine_linux_${arch}_v${version}.tar.gz"
     local url="https://github.com/arsham/figurine/releases/download/v${version}/${file}"
     local temp_dir; temp_dir=$(mktemp -d)
     local install_dir="/usr/local/bin"
@@ -3126,8 +3171,11 @@ EOF
     }
 
 
-    ensure_aliases
-    msg_ok "$(translate "Aliases added to .bashrc")"
+    # The aliases call Proxmox VE tools.
+    if [[ "$PMX_ON_PBS" != true ]]; then
+        ensure_aliases
+        msg_ok "$(translate "Aliases added to .bashrc")"
+    fi
 
     msg_success "$(translate "Figurine installation and configuration completed successfully.")"
     register_tool "figurine" true "$FUNC_VERSION"
@@ -3532,7 +3580,8 @@ EOF
 SHELL=/bin/bash
 PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
 MAILTO=""
-*/5 * * * * root /usr/local/bin/log2ram-check.sh >/dev/null 2>&1
+# nice/ionice keep the check off the priority queue for scheduled tasks.
+3-59/10 * * * * root nice -n 19 ionice -c 3 /usr/local/bin/log2ram-check.sh >/dev/null 2>&1
 EOF
         chmod 0644 /etc/cron.d/log2ram-auto-sync
         chown root:root /etc/cron.d/log2ram-auto-sync
@@ -3976,6 +4025,19 @@ main_menu() {
     "Optional|Install and configure Log2RAM|LOG2RAM"
   )
 
+  if [[ "$PMX_ON_PBS" == true ]]; then
+    local -A pve_only=(
+      [GUESTAGENT]=1 [VFIO_IOMMU]=1 [OPENVSWITCH]=1 [VZDUMP]=1 [PVEAM]=1
+      [CEPH]=1 [ENABLE_HA]=1 [OVHRTM]=1 [PIGZ]=1
+    )
+    local pbs_options=() option_key
+    for option in "${options[@]}"; do
+      option_key="${option##*|}"
+      [[ -n "${pve_only[$option_key]:-}" ]] || pbs_options+=("$option")
+    done
+    options=("${pbs_options[@]}")
+  fi
+
   IFS=$'\n' sorted_options=($(for option in "${options[@]}"; do
     IFS='|' read -r category description function_name <<< "$option"
     printf "%d|%s|%s|%s\n" "${category_order[$category]:-999}" "$category" "$description" "$function_name"
diff --git a/scripts/post_install/uninstall-tools.sh b/scripts/post_install/uninstall-tools.sh
index 63b22fa1..91f90867 100644
--- a/scripts/post_install/uninstall-tools.sh
+++ b/scripts/post_install/uninstall-tools.sh
@@ -266,6 +266,12 @@ uninstall_subscription_banner() {
         fi
     fi
     
+    # Proxmox Backup Server ships the same widget toolkit without the PVE packages.
+    local -a ui_packages=(pve-manager proxmox-widget-toolkit libjs-extjs libpve-http-server-perl)
+    if [[ "$(dpkg-query -W -f='${Status}' proxmox-backup-server 2>/dev/null)" == "install ok installed" ]]; then
+        ui_packages=(proxmox-widget-toolkit libjs-extjs)
+    fi
+
     if [[ "$restored" == false ]]; then
         msg_info "$(translate "Performing complete package reinstallation...")"
         
@@ -274,7 +280,7 @@ uninstall_subscription_banner() {
         
         # Reinstall packages with force-confnew to restore original configs
         if apt-get --reinstall -o Dpkg::Options::="--force-confnew" install \
-            pve-manager proxmox-widget-toolkit libjs-extjs libpve-http-server-perl -y >/dev/null 2>&1; then
+            "${ui_packages[@]}" -y >/dev/null 2>&1; then
             msg_ok "$(translate "Reinstalled Proxmox packages successfully")"
             restored=true
         else
@@ -286,7 +292,7 @@ uninstall_subscription_banner() {
         
         # Second pass reinstallation to ensure everything is clean
         apt-get update >/dev/null 2>&1
-        apt-get --reinstall install proxmox-widget-toolkit pve-manager libjs-extjs libpve-http-server-perl -y >/dev/null 2>&1 || true
+        apt-get --reinstall install "${ui_packages[@]}" -y >/dev/null 2>&1 || true
     fi
     
     msg_info "$(translate "Cleaning cached files...")"
@@ -575,7 +581,7 @@ uninstall_system_limits() {
     # Remove systemd limits (restore defaults)
     for file in /etc/systemd/system.conf /etc/systemd/user.conf; do
         if [ -f "$file" ]; then
-            pmx_edit_file "$file" '/^DefaultLimitNOFILE=256000/d'
+            pmx_edit_file "$file" -e '/^DefaultLimitNOFILE=256000$/d' -e '/^DefaultLimitNOFILE=1048576$/d'
         fi
     done
     
@@ -588,7 +594,7 @@ uninstall_system_limits() {
     
     # Remove ulimit from profile
     if [ -f /root/.profile ]; then
-        pmx_edit_file /root/.profile '/ulimit -n 256000/d'
+        pmx_edit_file /root/.profile -e '/^ulimit -n 256000$/d' -e '/^ulimit -n 1048576$/d'
     fi
     
     # Reload sysctl
diff --git a/scripts/utilities/pbs_update.sh b/scripts/utilities/pbs_update.sh
new file mode 100644
index 00000000..608440b9
--- /dev/null
+++ b/scripts/utilities/pbs_update.sh
@@ -0,0 +1,41 @@
+#!/bin/bash
+# Use PBS's existing repositories; never run PVE repo, Ceph or major-upgrade scripts.
+BASE_DIR="/usr/local/share/proxmenux"
+LOCAL_SCRIPTS="$BASE_DIR/scripts"
+source "$BASE_DIR/utils.sh"
+source "$LOCAL_SCRIPTS/global/platform-functions.sh"
+load_language
+initialize_cache
+
+if ! pmx_is_pbs || [[ "$(pmx_platform_field supported)" != true ]]; then
+    msg_error "$(translate 'This operation supports PBS 3 on Debian 12 and PBS 4 on Debian 13.')"
+    exit 1
+fi
+[[ $EUID -eq 0 ]] || { msg_error "$(translate 'Run this operation as root.')"; exit 1; }
+dialog --backtitle "ProxMenux" --title "$(translate 'PBS package update')" \
+    --yesno "$(translate 'Refresh the configured APT repositories and review the PBS package upgrade? Repository files will be preserved.')" 10 80 || exit 0
+if ! apt-get -o APT::Update::Error-Mode=any update; then
+    msg_error "$(translate 'APT refresh failed. Check the PBS subscription and repositories in the native PBS interface; no source was changed.')"
+    msg_success "$(translate "Press Enter to continue...")"
+    read -r
+    exit 1
+fi
+plan=$(mktemp)
+trap 'rm -f "$plan"' EXIT
+if ! apt-get -s full-upgrade > "$plan" 2>&1; then
+    dialog --backtitle "ProxMenux" --title "$(translate 'Review package upgrade')" --textbox "$plan" 24 100
+    exit 1
+fi
+dialog --backtitle "ProxMenux" --title "$(translate 'Review package upgrade')" --textbox "$plan" 24 100
+dialog --backtitle "ProxMenux" --defaultno --title "$(translate 'Apply PBS package upgrade')" \
+    --yesno "$(translate 'Apply the reviewed package upgrade now? Services may restart and packages listed for removal will be removed.')" 11 80 || exit 0
+if apt-get -y full-upgrade; then
+    msg_ok "$(translate 'PBS package upgrade completed. Check whether a reboot is required before your next backup window.')"
+else
+    msg_error "$(translate 'PBS package upgrade failed. Review the APT output before retrying.')"
+    msg_success "$(translate "Press Enter to continue...")"
+    read -r
+    exit 1
+fi
+msg_success "$(translate "Press Enter to continue...")"
+read -r
diff --git a/scripts/utilities/proxmox-upgrade-pve8-to-pve9-manual-guide.sh b/scripts/utilities/proxmox-upgrade-pve8-to-pve9-manual-guide.sh
index 322f1bf7..eeb95d28 100644
--- a/scripts/utilities/proxmox-upgrade-pve8-to-pve9-manual-guide.sh
+++ b/scripts/utilities/proxmox-upgrade-pve8-to-pve9-manual-guide.sh
@@ -95,7 +95,7 @@ show_proxmox_upgrade_manual_guide() {
     show_command "2.1" \
         "${YW}$(translate "If this node runs hyper-converged Ceph: ensure Ceph is 19.x (Squid) BEFORE upgrading PVE.")${CL}\n\n" \
         "ceph --version" \
-        "$(translate "If not 19.x, upgrade Ceph (Reef→Squid) first per the official guide:") ${BL}https://pve.proxmox.com/wiki/Ceph_Squid${CL}" \
+        "$(translate "If not 19.x, upgrade Ceph (Reef→Squid) first per the official guide:") ${BL}https://pve.proxmox.com/wiki/Ceph_Reef_to_Squid${CL}" \
         "\n"
 
 
diff --git a/scripts/utilities/upgrade_pve8_to_pve9.sh b/scripts/utilities/upgrade_pve8_to_pve9.sh
index 2ba2bade..6c0c7e89 100644
--- a/scripts/utilities/upgrade_pve8_to_pve9.sh
+++ b/scripts/utilities/upgrade_pve8_to_pve9.sh
@@ -36,8 +36,8 @@
 #     broken repo config).
 #   - dist-upgrade with --force-confdef --force-confold in
 #     unattended mode; user-driven dpkg prompts in interactive mode.
-#   - Post-upgrade: installs grub-efi-amd64 on EFI hosts, restarts
-#     pve-manager, re-runs pve8to9 to surface residual issues.
+#   - Post-upgrade: installs grub-efi-amd64 on EFI hosts and
+#     re-runs pve8to9 to surface residual issues.
 #   - Reboot prompt at the end.
 #   - Full log written to /var/log/pve8-a-pve9-<timestamp>.log.
 # ==========================================================
@@ -117,7 +117,7 @@ ask_run_mode() {
         msg_ok "$(translate "Run mode: Unattended")"
         export DEBIAN_FRONTEND=noninteractive
         export APT_LISTCHANGES_FRONTEND=none
-        exit 0
+        return 0
     fi
 
 
@@ -625,7 +625,14 @@ apt_upgrade() {
         exit 1
 
     else
-        bash "$LOCAL_SCRIPTS/global/update-pve8.sh"
+        local update_rc=0
+        bash "$LOCAL_SCRIPTS/global/update-pve8.sh" || update_rc=$?
+        if [[ $update_rc -eq 3 ]]; then
+            exit 0
+        elif [[ $update_rc -ne 0 ]]; then
+            msg_error "$(translate "The Proxmox VE 8 update did not finish. The upgrade to Proxmox VE 9 was not started.")"
+            exit 1
+        fi
         hash -r
 
     fi
@@ -641,10 +648,6 @@ regenerate_pve_cache() {
   mkdir -p /var/lib/pve-manager
   chmod 755 /var/lib/pve-manager
   
-  systemctl restart pve-manager 2>/dev/null || true
-  
-  sleep 2
-  
   timeout 10 pvesh get /nodes/localhost/apt/update 2>/dev/null || true
   
   msg_ok "$(translate "PVE cache regenerated")"
@@ -1009,6 +1012,13 @@ else
     bash -lc "apt-get dist-upgrade"
 fi
 
+# pve-manager 9 ships pve-enterprise.sources during the upgrade.
+if [[ "$REPO_MODE" == "no-subscription" && -f /etc/apt/sources.list.d/pve-enterprise.sources ]] \
+   && ! grep -qi '^Enabled:[[:space:]]*\(false\|no\)' /etc/apt/sources.list.d/pve-enterprise.sources; then
+  disable_enterprise_repo_if_present
+  msg_ok "$(translate "Enterprise Proxmox repository disabled")"
+fi
+
 
 
 # ==========================================================
@@ -1029,7 +1039,7 @@ if [[ -d /sys/firmware/efi ]]; then
     run_step \
       "Installing grub-efi-amd64" \
       "grub-efi-amd64 installed or already present" \
-      "apt-get install grub-efi-amd64 >/dev/null 2>&1"
+      "apt-get install -y grub-efi-amd64 >/dev/null 2>&1"
   fi
 fi
 
diff --git a/scripts/utils.sh b/scripts/utils.sh
index 60255e40..1deb1dd6 100644
--- a/scripts/utils.sh
+++ b/scripts/utils.sh
@@ -271,6 +271,18 @@ translate() {
             echo "$cached"
             return
         fi
+        # The catalog stores texts trimmed; keep the caller's surrounding spaces.
+        local lead="${text%%[![:space:]]*}"
+        local core="${text#"$lead"}"
+        local trail="${core##*[![:space:]]}"
+        core="${core%"$trail"}"
+        if [ -n "$core" ] && [ "$core" != "$text" ]; then
+            cached=$(jq -r --arg text "$core" '.[$text] // .[($text | gsub("\\\\n"; "\n"))] // empty' "$lang_file" 2>/dev/null)
+            if [ -n "$cached" ]; then
+                echo "${lead}${cached}${trail}"
+                return
+            fi
+        fi
     fi
 
     echo "$text"
diff --git a/tests/lxc_updates/test_native_app_discovery_ui.cjs b/tests/lxc_updates/test_native_app_discovery_ui.cjs
new file mode 100644
index 00000000..2ffa802e
--- /dev/null
+++ b/tests/lxc_updates/test_native_app_discovery_ui.cjs
@@ -0,0 +1,199 @@
+// Execute the real panel, handlers and editor with inert hook/UI/API fixtures.
+// This is component interaction evidence, not browser or Proxmox acceptance.
+const assert = require('node:assert/strict')
+const fs = require('node:fs')
+const path = require('node:path')
+const vm = require('node:vm')
+const root = path.resolve(__dirname, '../../AppImage')
+const ts = require(path.join(root, 'node_modules/typescript'))
+const source = fs.readFileSync(path.join(root, 'components/lxc-app-panel.tsx'), 'utf8')
+const compiled = ts.transpileModule(source, {compilerOptions: {
+  module: ts.ModuleKind.CommonJS, target: ts.ScriptTarget.ES2020, jsx: ts.JsxEmit.ReactJSX,
+}, reportDiagnostics: true})
+assert.equal(compiled.diagnostics.length, 0)
+
+const flatten = node => !node || typeof node !== 'object' ? [] : [node, ...(
+  [node.props?.children].flat(Infinity).flatMap(flatten)
+)]
+const text = node => node == null || node === false ? '' : typeof node !== 'object'
+  ? String(node) : [node.props?.children].flat(Infinity).map(text).join(' ')
+const candidate = {
+  slug: 'native-' + 'a'.repeat(24), discovery_id: 'native-' + 'a'.repeat(24),
+  name: 'handmade', source: 'native_metadata', installed_version: null,
+  evidence: [{kind: 'installation_file', value: '/opt/handmade/server'}], default_ports: [],
+}
+
+function fixture({nativeCandidate = candidate} = {}) {
+  let cursor = 0, tree, props, effects = [], states = [], refs = [], effectStates = []
+  const calls = [], cachedWrites = []
+  let native = {vmid: 101, status: 'not_scanned', candidates: [], stale: false}
+  let holdScan, scanGate, holdSave, saveGate, scanStatus = 'complete'
+  let cacheGate, resolveCache, cachePending = false
+  const seed = {sidecar: {vmid: 101, apps: []}, suggestions: {extras: [], port_suggestions: []}}
+  const react = {
+    useState(initial) {
+      const index = cursor++
+      if (!(index in states)) states[index] = typeof initial === 'function' ? initial() : initial
+      return [states[index], value => {states[index] = typeof value === 'function' ? value(states[index]) : value}]
+    },
+    useRef(value) {const index = cursor++; return refs[index] ||= {current: value}},
+    useMemo(fn) {cursor++; return fn()}, useCallback(fn) {cursor++; return fn},
+    useEffect(fn, deps) {
+      const index = cursor++, prior = effectStates[index]
+      if (!prior || !deps || deps.some((value, i) => value !== prior.deps?.[i])) {
+        effects.push(() => {prior?.cleanup?.(); effectStates[index] = {deps, cleanup: fn()}})
+      }
+    },
+  }
+  const api = async (url, options = {}) => {
+    calls.push({url, ...options})
+    if (url.endsWith('/native-discovery')) {
+      if (options.method !== 'POST' && cachePending) {
+        cachePending = false
+        const oldSnapshot = structuredClone(native)
+        await cacheGate
+        return oldSnapshot
+      }
+      if (options.method === 'POST') {
+        if (scanGate) await scanGate
+        native = {...native, status: scanStatus, candidates: [nativeCandidate]}
+      }
+      return structuredClone(native)
+    }
+    if (url.endsWith('/apps/suggestions')) return seed.suggestions
+    if (url.endsWith('/apps') && options.method === 'POST') {
+      if (saveGate) await saveGate
+      return {vmid: Number(url.split('/')[3]), apps: [{id: 'saved', ...JSON.parse(options.body), state: {}}]}
+    }
+    if (url.endsWith('/adguard-setup')) return {available: false}
+    return []
+  }
+  const cache = {
+    getLxcAppsCached: () => null, fetchLxcApps: async () => seed,
+    subscribeLxcApps: () => () => {}, setLxcAppsCached: (...args) => cachedWrites.push(args),
+  }
+  const exports = {}
+  vm.runInNewContext(compiled.outputText, {exports, console, setTimeout, clearTimeout,
+    require: name => {
+      if (name === 'react') return react
+      if (name === 'react/jsx-runtime') return {jsx: (type, props) => ({type, props}), jsxs: (type, props) => ({type, props})}
+      if (name.includes('api-config')) return {fetchApi: api}
+      if (name.includes('lxc-apps-cache')) return cache
+      if (name.includes('i18n/provider')) return {useT: () => (key, values) => key + (values ? JSON.stringify(values) : '')}
+      if (name.includes('category-color')) return {useIsLightTheme: () => false, categoryChipStyle: () => ({})}
+      if (name.includes('category-label')) return {getCategoryLabel: value => value}
+      return new Proxy({}, {get: (_, key) => key})
+    },
+  })
+  function render(next = props || {vmid: 101, initialData: seed}) {
+    props = next; cursor = 0; effects = []
+    tree = exports.LxcAppPanel(props)
+    for (const effect of effects) effect()
+    return tree
+  }
+  const settle = async () => {for (let i = 0; i < 6; i++) await Promise.resolve(); render()}
+  const button = key => {
+    const match = flatten(tree).find(n => n.type === 'Button' && text(n).includes('vmLxc.appEditor.' + key))
+    assert.ok(match, 'Missing button ' + key)
+    return match
+  }
+  return {render, settle, calls, cachedWrites, button, tree: () => tree,
+    setNative: value => {native = value},
+    holdInitialCache: () => {cachePending = true; cacheGate = new Promise(resolve => {resolveCache = resolve})},
+    resolveInitialCache: () => resolveCache(),
+    setScanStatus: value => {scanStatus = value},
+    holdScan: () => {scanGate = new Promise(resolve => {holdScan = resolve})}, resolveScan: () => holdScan(),
+    holdSave: () => {saveGate = new Promise(resolve => {holdSave = resolve})}, resolveSave: () => holdSave(),
+  }
+}
+
+async function main() {
+  const f = fixture()
+  f.render(); await f.settle()
+  assert.equal(f.calls.filter(c => c.method === 'POST').length, 0, 'mount and cache reads never scan')
+  await f.button('searchApplications').props.onClick(); f.render()
+  assert.equal(f.calls.filter(c => c.url.endsWith('/native-discovery') && c.method === 'POST').length, 1)
+  assert.ok(text(f.tree()).includes('nativeVersionUnknown'), 'unknown version remains visible')
+  assert.ok(text(f.tree()).includes('/opt/handmade/server'))
+  await f.button('registerButton').props.onClick(); f.render()
+  assert.ok(text(f.tree()).includes('saveButton'), 'candidate opens actual editor')
+  f.button('cancelButton').props.onClick(); f.render()
+  assert.equal(f.calls.filter(c => /\/apps$/.test(c.url) && c.method === 'POST').length, 0, 'cancel never registers')
+  await f.button('registerButton').props.onClick(); f.render()
+  await f.button('saveButton').props.onClick(); f.render()
+  const saved = f.calls.find(c => /\/apps$/.test(c.url) && c.method === 'POST')
+  const payload = JSON.parse(saved.body)
+  assert.equal(saved.url, '/api/vms/101/apps')
+  assert.equal(payload.discovery_id, candidate.discovery_id)
+  assert.ok(!payload.helper_slug, 'native identity never becomes a helper')
+  assert.equal(payload.installed_via, '')
+  assert.equal(payload.update_method, 'none')
+  assert.equal(payload.update_command, '')
+  assert.equal(payload.repo, '')
+  assert.equal(payload.upstream_type, '')
+
+  const hestia = fixture({nativeCandidate: {
+    ...candidate, name: 'Hestia', default_ports: [8083], scheme: 'https',
+  }})
+  hestia.render(); await hestia.settle()
+  await hestia.button('searchApplications').props.onClick(); hestia.render()
+  await hestia.button('registerButton').props.onClick(); hestia.render()
+  await hestia.button('saveButton').props.onClick(); hestia.render()
+  const hestiaPayload = JSON.parse(hestia.calls.find(c => /\/apps$/.test(c.url) && c.method === 'POST').body)
+  assert.deepEqual(hestiaPayload.ports, [{port: 8083, scheme: 'https', web_path: ''}],
+    'a verified Hestia panel pre-fills only its fixed HTTPS endpoint')
+  const delayedCache = fixture()
+  delayedCache.holdInitialCache()
+  delayedCache.render(); await delayedCache.settle()
+  await delayedCache.button('searchApplications').props.onClick(); delayedCache.render()
+  assert.ok(text(delayedCache.tree()).includes('/opt/handmade/server'))
+  delayedCache.resolveInitialCache(); await delayedCache.settle()
+  assert.ok(text(delayedCache.tree()).includes('/opt/handmade/server'),
+    'a delayed initial cache read must not erase a completed explicit search')
+
+  const partial = fixture()
+  partial.render(); await partial.settle(); partial.setScanStatus('partial')
+  await partial.button('searchApplications').props.onClick(); partial.render()
+  assert.ok(text(partial.tree()).includes('nativeScanPartial'))
+  assert.ok(text(partial.tree()).includes('nativeEvidenceStale'))
+  const failed = fixture()
+  failed.render(); await failed.settle(); failed.setScanStatus('error')
+  await failed.button('searchApplications').props.onClick(); failed.render()
+  assert.ok(text(failed.tree()).includes('nativeScanFailed'))
+  assert.equal(failed.calls.filter(c => c.url.endsWith('/apps/suggestions') && c.method === 'POST').length, 0)
+
+  const editorSwitch = fixture()
+  editorSwitch.render(); await editorSwitch.settle()
+  await editorSwitch.button('searchApplications').props.onClick(); editorSwitch.render()
+  await editorSwitch.button('registerButton').props.onClick(); editorSwitch.render()
+  editorSwitch.render({vmid: 102})
+  assert.ok(!text(editorSwitch.tree()).includes('saveButton'), 'old editor must disappear in the very first render of another CT')
+
+  const late = fixture()
+  late.render(); await late.settle(); late.holdScan()
+  const scan = late.button('searchApplications').props.onClick()
+  late.render({vmid: 102}); await late.settle()
+  late.resolveScan(); await scan; late.render()
+  assert.ok(!text(late.tree()).includes('/opt/handmade/server'), 'late A scan cannot appear in B')
+  assert.equal(late.cachedWrites.length, 0)
+  assert.equal(late.calls.filter(c => c.url.endsWith('/apps/suggestions') && c.method === 'POST').length, 0)
+
+  const saveLate = fixture()
+  saveLate.render(); await saveLate.settle()
+  await saveLate.button('searchApplications').props.onClick(); saveLate.render()
+  await saveLate.button('registerButton').props.onClick(); saveLate.render()
+  saveLate.holdSave(); const saving = saveLate.button('saveButton').props.onClick()
+  const priorWrites = saveLate.cachedWrites.length
+  saveLate.render({vmid: 102}); await saveLate.settle()
+  saveLate.resolveSave(); await saving; saveLate.render()
+  assert.equal(saveLate.cachedWrites.length, priorWrites, 'late save response does not update new target')
+  assert.equal(saveLate.calls.filter(c => /\/vms\/102\/apps$/.test(c.url) && c.method === 'POST').length, 0)
+
+  const oci = fixture()
+  oci.render({vmid: 101, oci: {instance: true}, initialData: {sidecar: {apps: []}, suggestions: {oci_instance: {template_id: 'image-app'}, extras: []}}})
+  await oci.settle()
+  await oci.button('refreshData').props.onClick()
+  assert.equal(oci.calls.filter(c => c.url.endsWith('/native-discovery') && c.method === 'POST').length, 0, 'OCI refresh never native-scans')
+  console.log('PASS native discovery: real panel Find → editor → Cancel/Save, no automatic scan, safe payload, CT switching and OCI refresh (fixtures)')
+}
+main().catch(error => {console.error(error); process.exitCode = 1})
diff --git a/tests/lxc_updates/test_observed_state_ui.cjs b/tests/lxc_updates/test_observed_state_ui.cjs
index 7b659bed..4f2de690 100644
--- a/tests/lxc_updates/test_observed_state_ui.cjs
+++ b/tests/lxc_updates/test_observed_state_ui.cjs
@@ -162,8 +162,10 @@ assert.equal(ui.osStatus({ ...recent, available: false, count: 0 }).osUpdateStat
 assert.equal(ui.osStatus({ ...recent, error: "probe failed" }).osUpdateStatusKnown, false)
 assert.equal(ui.aggregate({ app_watches: [{ update_available: true, name: "App" }] }).last_check, null,
   "an app badge cannot invent an OS check timestamp")
-assert.equal(ui.badge(legacy).props.children[0].type, "Clock")
-assert.equal(ui.badge(legacy).props.children[1], "vmLxc.updates.checkStale")
+assert.equal(ui.badge(legacy).props.children[0].type, "Arrow",
+  "an old check keeps the same badge as a recent one")
+assert.equal(ui.badge(legacy).props.children[1], 51)
+assert.equal(ui.badge({ ...legacy, available: false, count: 0 }), null)
 assert.equal(ui.badge({ ...recent, available: true, count: 2 }).props.children[1], 2)
 assert.equal(ui.badge({ ...recent, available: false, count: 0 }), null)
 assert.equal(requests.length, 0)
diff --git a/tests/test_apprise_service_help.cjs b/tests/test_apprise_service_help.cjs
new file mode 100644
index 00000000..d2f0d131
--- /dev/null
+++ b/tests/test_apprise_service_help.cjs
@@ -0,0 +1,30 @@
+// Render the real help component; only its translation provider is replaced.
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const vm = require('node:vm');
+const ts = require('typescript');
+const React = require('react');
+const { renderToStaticMarkup } = require('react-dom/server');
+const source = fs.readFileSync('AppImage/components/apprise-service-help.tsx', 'utf8');
+const js = ts.transpileModule(source, { compilerOptions: { module: ts.ModuleKind.CommonJS, jsx: ts.JsxEmit.ReactJSX } }).outputText;
+const english = JSON.parse(fs.readFileSync('AppImage/messages/en/common.json'));
+function resolve(catalog, key) { return key.split('.').reduce((value, part) => value?.[part], catalog); }
+for (const locale of ['en', 'es', 'de', 'fr', 'it', 'pt', 'sk', 'sv', 'missing']) {
+  const catalog = locale === 'missing' ? {} : JSON.parse(fs.readFileSync(`AppImage/messages/${locale}/common.json`));
+  const context = { exports: {}, require: name => name === '../lib/i18n/provider' ? {
+    useT: () => key => resolve(catalog, key) ?? resolve(english, key),
+  } : require(name) };
+  vm.runInNewContext(js, context);
+  const html = renderToStaticMarkup(React.createElement(context.exports.AppriseServiceHelp));
+  assert.ok(html.includes('https://hooks.slack.com/services/TOKEN_A/TOKEN_B/TOKEN_C'));
+  assert.ok(html.includes('matrixs://USER:PASSWORD@matrix.example.com/!ROOM_ID:matrix.example.com'));
+  assert.ok(html.includes('https://appriseit.com/services/slack/'));
+  assert.ok(html.includes('https://appriseit.com/services/matrix/'));
+  assert.ok(!html.includes('settings.notifications.'), `${locale}: no unresolved labels`);
+}
+for (const [, key] of source.matchAll(/t\("([^"]+)"\)/g)) assert.ok(resolve(english, key), key);
+assert.ok(!source.includes('onChange') && !source.includes('fetch(') && !source.includes('updateChannel'));
+const settings = fs.readFileSync('AppImage/components/notification-settings.tsx', 'utf8');
+const section = settings.slice(settings.indexOf('<TabsContent value="apprise"'), settings.indexOf('</TabsContent>', settings.indexOf('<TabsContent value="apprise"')));
+for (const part of ['<AppriseServiceHelp />', 'renderChannelCategories("apprise")', 'handleTest("apprise")']) assert.ok(section.includes(part));
+console.log('PASS: real provider-help JSX, shipped locales and English fallback, no secret mutation, native category/test controls retained');
diff --git a/tests/test_apprise_services.py b/tests/test_apprise_services.py
new file mode 100644
index 00000000..fffb158e
--- /dev/null
+++ b/tests/test_apprise_services.py
@@ -0,0 +1,137 @@
+"""Real Apprise Slack/Matrix plugins with the HTTP boundary replaced.
+
+No provider account or network is used. These contracts run against both
+the minimum bundled Apprise version and the current tested version.
+"""
+import gc
+import json
+from pathlib import Path
+import sys
+import unittest
+from unittest.mock import patch
+from urllib.parse import urlparse
+
+import apprise
+import requests
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[1] / "AppImage/scripts"))
+from notification_channels import create_channel
+
+SLACK = "https://hooks.slack.com/services/T00000000/B00000000/fixturesecret1234567890"
+MATRIX = "matrixs://notify:fixture-password@matrix.example.test/!room:matrix.example.test"
+
+
+class AppriseServiceTests(unittest.TestCase):
+    def setUp(self):
+        self.calls = []
+        self.status = 200
+        self.transport = patch.object(requests.Session, "request", side_effect=self.http)
+        self.transport.start()
+        self.addCleanup(self.transport.stop)
+        self.sleep = patch("notification_channels.time.sleep")
+        self.sleep.start()
+        self.addCleanup(self.sleep.stop)
+        self.addCleanup(gc.collect)
+
+    def http(self, method, url, **kwargs):
+        self.calls.append((method, url, kwargs))
+        response = requests.Response()
+        response.status_code = self.status
+        response.url = url
+        response.reason = "OK" if self.status == 200 else "Rejected"
+        response._content_consumed = True
+        host, path = urlparse(url).hostname, urlparse(url).path
+        if host == "hooks.slack.com":
+            self.assertTrue(path.startswith("/services/"))
+            response._content = b"ok" if self.status == 200 else b"invalid_auth"
+        else:
+            self.assertEqual(host, "matrix.example.test", "no unexpected destinations")
+            if self.status != 200:
+                payload = {"errcode": "M_FORBIDDEN", "error": "Invalid credentials"}
+            elif path == "/.well-known/matrix/client":
+                payload = {"m.homeserver": {"base_url": "https://" + host}}
+            elif path.endswith("/login"):
+                payload = {"access_token": "fixture-token", "home_server": host, "user_id": "@notify:" + host}
+            elif path.endswith("/joined_rooms"):
+                payload = {"joined_rooms": ["!room:" + host]}
+            elif "/join/" in path:
+                payload = {"room_id": "!room:" + host}
+            elif "/send/" in path:
+                payload = {"event_id": "$fixture"}
+            elif path.endswith("/logout"):
+                payload = {}
+            elif path.endswith("/versions"):
+                payload = {"versions": ["v1.1"]}
+            else:
+                raise AssertionError("Unhandled Matrix request: " + path)
+            response._content = json.dumps(payload).encode()
+        return response
+
+    def send(self, url):
+        channel = create_channel("apprise", {"url": url})
+        self.assertIsNotNone(channel)
+        return channel.send("ProxMenux probe", "Controlled message", "WARNING")
+
+    def test_slack_accepts_the_native_webhook_without_conversion(self):
+        result = self.send(SLACK)
+        self.assertTrue(result["success"], result)
+        self.assertTrue(any(url == SLACK for _, url, _ in self.calls))
+        self.assertIn("Controlled message", str(self.calls))
+
+    def test_slack_apprise_scheme_uses_the_same_transport(self):
+        result = self.send(SLACK.replace("https://hooks.slack.com/services/", "slack://"))
+        self.assertTrue(result["success"], result)
+        self.assertTrue(any(url == SLACK for _, url, _ in self.calls))
+
+    def test_matrix_authenticates_and_delivers_to_the_full_room_id_over_https(self):
+        result = self.send(MATRIX)
+        self.assertTrue(result["success"], result)
+        sends = [(url, kwargs) for _, url, kwargs in self.calls if "/send/" in url]
+        self.assertTrue(sends, self.calls)
+        self.assertTrue(all(url.startswith("https://matrix.example.test/") for url, _ in sends))
+        self.assertTrue(all(kwargs.get("verify", True) for _, kwargs in sends))
+        self.assertIn("Controlled message", str(sends))
+        self.assertTrue(any(url.endswith("/login") for _, url, _ in self.calls))
+
+    def test_test_button_contract_uses_the_same_provider(self):
+        ok, error = create_channel("apprise", {"url": SLACK}).test()
+        self.assertTrue(ok, error)
+        self.assertTrue(self.calls)
+
+    def test_rejected_slack_webhook_is_not_reported_as_delivered(self):
+        self.status = 403
+        result = self.send(SLACK)
+        self.assertFalse(result["success"])
+        self.assertTrue(result["error"])
+
+    def test_invalid_matrix_credentials_are_not_reported_as_delivered(self):
+        self.status = 403
+        result = self.send(MATRIX)
+        self.assertFalse(result["success"])
+        self.assertFalse(any("/send/" in url for _, url, _ in self.calls))
+
+    def test_invalid_urls_and_missing_library_fail_before_any_request(self):
+        channel = create_channel("apprise", {"url": "not-a-url"})
+        self.assertFalse(channel.send("Probe", "Body")["success"])
+        channel = create_channel("apprise", {"url": SLACK})
+        with patch.object(channel, "_load_apprise", return_value=None):
+            self.assertFalse(channel.send("Probe", "Body")["success"])
+        self.assertEqual(self.calls, [])
+
+    def test_connection_failure_never_claims_delivery(self):
+        for url in (SLACK, MATRIX):
+            with patch.object(requests.Session, "request", side_effect=requests.ConnectionError("fixture connection failure")):
+                result = self.send(url)
+            self.assertFalse(result["success"])
+            self.assertTrue(result["error"])
+
+    def test_severity_mapping_keeps_native_notification_semantics(self):
+        channel = create_channel("apprise", {"url": SLACK})
+        for severity, expected in (("CRITICAL", apprise.NotifyType.FAILURE), ("WARNING", apprise.NotifyType.WARNING),
+                                   ("INFO", apprise.NotifyType.INFO), ("OK", apprise.NotifyType.SUCCESS),
+                                   ("SUCCESS", apprise.NotifyType.SUCCESS)):
+            self.assertEqual(channel._severity_to_notify_type(apprise, severity), expected)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/test_backup_storage_retention.cjs b/tests/test_backup_storage_retention.cjs
new file mode 100644
index 00000000..218be9fd
--- /dev/null
+++ b/tests/test_backup_storage_retention.cjs
@@ -0,0 +1,27 @@
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const vm = require('node:vm');
+const ts = require('typescript');
+const source = fs.readFileSync('AppImage/lib/backup-retention.ts', 'utf8');
+const context = { exports: {} };
+vm.runInNewContext(ts.transpileModule(source, { compilerOptions: { module: ts.ModuleKind.CommonJS } }).outputText, context);
+const { parseRetention, buildRetention } = context.exports;
+for (const policy of ['keep-all=1', 'keep-last=3', 'keep-last=3,keep-weekly=2', 'keep-hourly=24,keep-daily=7,keep-monthly=12,keep-yearly=2']) {
+  const { fields, keepAll } = parseRetention(policy);
+  assert.equal(buildRetention(fields, keepAll), policy);
+}
+assert.equal(buildRetention({}, false), '', 'empty policy remains explicit');
+assert.equal(buildRetention({}, true), 'keep-all=1');
+assert.equal(buildRetention({ daily: '3', hourly: '0', last: '' }, false), 'keep-daily=3');
+assert.equal(buildRetention({ last: '3' }, true), 'keep-last=3', 'existing job editor precedence preserved');
+const component = fs.readFileSync('AppImage/components/backup-storage-retention.tsx', 'utf8');
+const english = JSON.parse(fs.readFileSync('AppImage/messages/en/common.json')).backup.storageRetention;
+for (const [, key] of component.matchAll(/t\("backup\.storageRetention\.([A-Za-z]+)"/g)) {
+  assert.ok(typeof english[key] === 'string' && english[key], `translation: ${key}`);
+}
+assert.ok(component.includes('digest: editing.digest'));
+assert.ok(component.includes('method: "PUT"'));
+assert.ok(!component.includes('/prune'));
+assert.ok(fs.readFileSync('AppImage/components/vm-backup-jobs.tsx', 'utf8').includes('from "../lib/backup-retention"'));
+assert.ok(fs.readFileSync('AppImage/components/backup-tab.tsx', 'utf8').includes('<BackupStorageRetention />'));
+console.log('PASS: shared native retention properties, keep-all/count round trips, explicit empty policy, translations and digest wiring');
diff --git a/tests/test_figurine_installation.py b/tests/test_figurine_installation.py
new file mode 100644
index 00000000..2e7e7b36
--- /dev/null
+++ b/tests/test_figurine_installation.py
@@ -0,0 +1,204 @@
+"""Exercise the real Figurine installer with isolated files and no network/root access."""
+
+import ast
+import importlib.util
+import io
+from pathlib import Path
+import re
+import subprocess
+import tarfile
+import tempfile
+import unittest
+
+
+ROOT = Path(__file__).resolve().parents[1]
+SCRIPT = ROOT / "scripts/post_install/customizable_post_install.sh"
+FUNCTION = re.search(
+    r"^configure_figurine\(\) \{\n.*?^\}", SCRIPT.read_text(), re.M | re.S
+).group(0)
+VERSION = re.search(r'FIGURINE_VERSION:-([^}]+)', FUNCTION).group(1)
+FUNCTION_VERSION = re.search(r'local FUNC_VERSION="([^"]+)"', FUNCTION).group(1)
+
+
+class FigurineInstallation(unittest.TestCase):
+    def run_installer(self, arch="amd64", *, kernel="x86_64", dpkg_exit=0,
+                      release=None, download_exit=0, package="valid", existing=True):
+        with tempfile.TemporaryDirectory(prefix="figurine-test-") as directory:
+            root = Path(directory)
+            binary_dir = root / "bin"
+            profile_dir = root / "profile.d"
+            binary_dir.mkdir()
+            profile_dir.mkdir()
+            (root / "tmp").mkdir()
+            binary = binary_dir / "figurine"
+            profile = profile_dir / "figurine.sh"
+            bashrc = root / "bashrc"
+            if existing:
+                binary.write_text("previous binary\n")
+                binary.chmod(0o755)
+                profile.write_text("previous profile\n")
+                bashrc.write_text("# previous bashrc\n")
+            archive = root / "fixture.tar.gz"
+            payload = b"#!/bin/sh\nprintf 'fixture Figurine\\n'\n"
+            if package == "corrupt":
+                archive.write_bytes(b"invalid tarball")
+            else:
+                with tarfile.open(archive, "w:gz") as tar:
+                    name = "deploy/figurine" if package == "valid" else "README"
+                    member = tarfile.TarInfo(name)
+                    member.size = len(payload)
+                    tar.addfile(member, io.BytesIO(payload))
+
+            # Relocate every installer filesystem boundary, including its login script.
+            function = (FUNCTION.replace("/usr/local/bin", str(binary_dir))
+                        .replace("/etc/profile.d", str(profile_dir))
+                        .replace("/root/.bashrc", str(bashrc)))
+            harness = r'''
+translate() { printf '%s' "$1"; }
+msg_info2() { :; }
+msg_info() { :; }
+msg_ok() { :; }
+msg_success() { :; }
+msg_error() { printf '%s\n' "$*" >&2; }
+pmx_journal_context() { :; }
+pmx_write_file() { cat > "$1"; }
+pmx_append_file() { cat >> "$1"; }
+pmx_edit_file() { :; }
+chown() { :; }
+dpkg() {
+    [[ "$TEST_DPKG_EXIT" == 0 ]] || return "$TEST_DPKG_EXIT"
+    printf '%s\n' "$TEST_ARCH"
+}
+uname() { printf '%s\n' "$TEST_KERNEL"; }
+wget() {
+    [[ "$1" == -qO ]] || return 90
+    printf '%s\n' "$3" >> "$TEST_ROOT/downloads"
+    [[ "$TEST_DOWNLOAD_EXIT" == 0 ]] || return "$TEST_DOWNLOAD_EXIT"
+    cp "$TEST_ROOT/fixture.tar.gz" "$2"
+}
+register_tool() { printf '%s\n' "$*" > "$TEST_ROOT/registered"; }
+'''
+            harness += function + "\nconfigure_figurine\nexit \"$?\"\n"
+            environment = {
+                "PATH": f"{binary_dir}:/usr/bin:/bin",
+                "HOME": str(root),
+                "TMPDIR": str(root / "tmp"),
+                "LC_ALL": "C",
+                "TEST_ROOT": str(root),
+                "TEST_ARCH": arch,
+                "TEST_DPKG_EXIT": str(dpkg_exit),
+                "TEST_KERNEL": kernel,
+                "TEST_DOWNLOAD_EXIT": str(download_exit),
+            }
+            if release is not None:
+                environment["FIGURINE_VERSION"] = release
+            result = subprocess.run(
+                ["/bin/bash", "--noprofile", "--norc"], input=harness,
+                text=True, capture_output=True, env=environment, timeout=10,
+            )
+            return {
+                "result": result,
+                "binary": binary.read_bytes(),
+                "mode": binary.stat().st_mode & 0o777,
+                "profile": profile.read_text(),
+                "bashrc": bashrc.read_text(),
+                "downloads": (root / "downloads").read_text() if (root / "downloads").exists() else "",
+                "registered": (root / "registered").read_text() if (root / "registered").exists() else "",
+                "payload": payload,
+                "binary_path": str(binary),
+            }
+
+    def test_installs_release_matching_debian_userspace(self):
+        for arch, asset in (("amd64", "amd64"), ("arm64", "arm64"), ("armhf", "arm")):
+            with self.subTest(arch=arch):
+                state = self.run_installer(arch)
+                self.assertEqual(state["result"].returncode, 0, state["result"].stderr)
+                self.assertEqual(state["downloads"],
+                                 f"https://github.com/arsham/figurine/releases/download/v{VERSION}/"
+                                 f"figurine_linux_{asset}_v{VERSION}.tar.gz\n")
+                self.assertEqual(state["binary"], state["payload"])
+                self.assertEqual(state["mode"], 0o755)
+                self.assertIn(f'{state["binary_path"]} -f "3d.flf" $(hostname)', state["profile"])
+                self.assertEqual(state["registered"], f"figurine true {FUNCTION_VERSION}\n")
+
+    def test_falls_back_to_kernel_when_dpkg_is_unavailable(self):
+        for kernel, asset in (("x86_64", "amd64"), ("aarch64", "arm64"),
+                              ("armv7l", "arm"), ("armv8l", "arm")):
+            with self.subTest(kernel=kernel):
+                state = self.run_installer("", kernel=kernel, dpkg_exit=127)
+                self.assertEqual(state["result"].returncode, 0, state["result"].stderr)
+                self.assertIn(f"figurine_linux_{asset}_v{VERSION}.tar.gz", state["downloads"])
+
+    def test_userspace_takes_precedence_over_kernel(self):
+        state = self.run_installer("armhf", kernel="aarch64")
+        self.assertEqual(state["result"].returncode, 0, state["result"].stderr)
+        self.assertIn(f"figurine_linux_arm_v{VERSION}.tar.gz", state["downloads"])
+
+    def test_fresh_install_creates_binary_banner_and_aliases(self):
+        state = self.run_installer(existing=False)
+        self.assertEqual(state["result"].returncode, 0, state["result"].stderr)
+        self.assertEqual(state["binary"], state["payload"])
+        self.assertIn(' -f "3d.flf" $(hostname)', state["profile"])
+        self.assertIn("shopt -s expand_aliases", state["bashrc"])
+        self.assertIn("alias aptup='apt update && apt dist-upgrade'", state["bashrc"])
+        self.assertEqual(state["registered"], f"figurine true {FUNCTION_VERSION}\n")
+
+    def test_unsupported_architecture_fails_before_changes_or_download(self):
+        for arch in ("i386", "riscv64", "armel", "armv6l", "ppc64el", ""):
+            with self.subTest(arch=arch):
+                state = self.run_installer(arch)
+                self.assertNotEqual(state["result"].returncode, 0)
+                self.assertIn("Unsupported architecture for Figurine:", state["result"].stderr)
+                self.assertEqual(state["downloads"], "")
+                self.assert_preserved(state)
+                self.assertEqual(state["bashrc"], "# previous bashrc\n")
+
+    def assert_preserved(self, state):
+        self.assertEqual(state["binary"], b"previous binary\n")
+        self.assertEqual(state["profile"], "previous profile\n")
+        self.assertEqual(state["registered"], "")
+
+    def test_download_failure_preserves_previous_installation(self):
+        state = self.run_installer(download_exit=8)
+        self.assertNotEqual(state["result"].returncode, 0)
+        self.assertIn("Failed to download Figurine", state["result"].stderr)
+        self.assert_preserved(state)
+
+    def test_invalid_packages_preserve_previous_installation(self):
+        for package, error in (("corrupt", "Failed to extract package"),
+                               ("missing", "Binary not found in extracted content.")):
+            with self.subTest(package=package):
+                state = self.run_installer(package=package)
+                self.assertNotEqual(state["result"].returncode, 0)
+                self.assertIn(error, state["result"].stderr)
+                self.assert_preserved(state)
+
+    def test_release_override_is_preserved(self):
+        state = self.run_installer("arm64", release="2.1.0")
+        self.assertEqual(state["result"].returncode, 0, state["result"].stderr)
+        self.assertIn("/v2.1.0/figurine_linux_arm64_v2.1.0.tar.gz", state["downloads"])
+
+    def test_existing_installation_is_offered_the_update_once(self):
+        spec = importlib.util.spec_from_file_location(
+            "post_install_versions", ROOT / "AppImage/scripts/post_install_versions.py")
+        versions = importlib.util.module_from_spec(spec)
+        spec.loader.exec_module(versions)
+        metadata = versions.parse_post_install_script(SCRIPT)
+        installed = {"figurine": {"installed": True, "version": "1.1", "source": "custom"}}
+        updates = versions._detect_updates({}, metadata, installed)
+        self.assertEqual(len(updates), 1)
+        self.assertEqual(updates[0]["available_version"], FUNCTION_VERSION)
+        self.assertEqual(updates[0]["function"], "configure_figurine")
+        installed["figurine"]["version"] = FUNCTION_VERSION
+        self.assertEqual(versions._detect_updates({}, metadata, installed), [])
+
+        tree = ast.parse((ROOT / "AppImage/scripts/flask_proxmenux_routes.py").read_text())
+        fallback = next(ast.literal_eval(node.value) for node in tree.body
+                        if isinstance(node, ast.Assign)
+                        and any(isinstance(t, ast.Name) and t.id == "TOOL_METADATA"
+                                for t in node.targets))
+        self.assertEqual(fallback["figurine"]["version"], FUNCTION_VERSION)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/test_guest_backup_archives.cjs b/tests/test_guest_backup_archives.cjs
new file mode 100644
index 00000000..6544c9df
--- /dev/null
+++ b/tests/test_guest_backup_archives.cjs
@@ -0,0 +1,69 @@
+// Run the shipped deletion client with only its authenticated transport replaced.
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const vm = require('node:vm');
+const ts = require('typescript');
+const source = fs.readFileSync('AppImage/lib/guest-backup-archives.ts', 'utf8');
+const js = ts.transpileModule(source, { compilerOptions: { module: ts.ModuleKind.CommonJS, target: ts.ScriptTarget.ES2020 } }).outputText;
+const backup = { volid: 'local:backup/vzdump-lxc-100-fixture.tar.zst', storage: 'local' };
+
+async function run(responses) {
+  const calls = [];
+  const context = { exports: {}, AbortSignal, Date, setTimeout: callback => callback(), require: name => {
+    assert.equal(name, './api-config');
+    return { fetchApi: async (path, options) => {
+      calls.push({ path, options });
+      assert.ok(responses.length, `unexpected call: ${path}`);
+      const response = responses.shift();
+      if (response instanceof Error) throw response;
+      return response;
+    } };
+  } };
+  vm.runInNewContext(js, context);
+  let results, error;
+  try { results = JSON.parse(JSON.stringify(await context.exports.deleteGuestBackups(100, [backup]))); }
+  catch (caught) { error = caught; }
+  return { calls, results, error };
+}
+
+(async () => {
+  const success = await run([{ results: [{ volid: backup.volid, status: 'deleted' }] }]);
+  assert.equal(success.results[0].status, 'deleted');
+  assert.deepEqual(JSON.parse(success.calls[0].options.body), { confirm: true, backups: [backup] });
+  assert.equal(success.calls[0].options.method, 'POST');
+  assert.equal(success.calls.length, 1);
+  const task = 'UPID:pve1:01:02:03:imgdel:100:root@pam:';
+  const pending = { results: [{ volid: backup.volid, status: 'pending', task }] };
+  const completed = await run([pending, { volid: backup.volid, status: 'pending' }, { volid: backup.volid, status: 'deleted' }]);
+  assert.equal(completed.results[0].status, 'deleted');
+  assert.equal(completed.calls.length, 3);
+  assert.equal(completed.calls[1].path, `/api/vms/100/backups/delete-status?task=${encodeURIComponent(task)}`);
+  assert.equal(completed.calls.filter(call => call.options.method === 'POST').length, 1);
+  const failed = await run([pending, { volid: backup.volid, status: 'unconfirmed', error: 'protected' }]);
+  assert.equal(failed.results[0].status, 'unconfirmed');
+  const lostPost = await run([new Error('network failure')]);
+  assert.equal(lostPost.error.message, 'network failure');
+  assert.equal(lostPost.calls.length, 1, 'never retry destructive POST');
+  const lostStatus = await run([pending, new Error('timeout'), new Error('timeout'), new Error('timeout')]);
+  assert.equal(lostStatus.results[0].status, 'unconfirmed');
+  assert.equal(lostStatus.calls.length, 4, 'bounded read failures');
+  for (const response of [{ results: [] }, { results: [{ volid: 'other', status: 'deleted' }] },
+                           { results: [{ volid: backup.volid, status: 'accepted' }] }]) {
+    assert.equal((await run([response])).error.message, 'deletionUnconfirmed');
+  }
+  const foreignStatus = await run([pending, { volid: 'other', status: 'deleted' }]);
+  assert.equal(foreignStatus.results[0].status, 'unconfirmed');
+
+  const component = fs.readFileSync('AppImage/components/guest-backup-list.tsx', 'utf8');
+  const english = JSON.parse(fs.readFileSync('AppImage/messages/en/common.json')).vmLxc.backups;
+  for (const [, key] of component.matchAll(/t\("vmLxc\.backups\.([A-Za-z]+)"/g)) {
+    assert.ok(typeof english[key] === 'string' && english[key].length, `English translation: ${key}`);
+  }
+  assert.ok(component.includes('disabled={disabled || !!backup.protected'));
+  assert.ok(component.includes('!backup.protected'));
+  assert.ok(component.includes('DialogDescription'));
+  const parent = fs.readFileSync('AppImage/components/virtual-machines.tsx', 'utf8');
+  assert.ok(parent.includes('<GuestBackupList'));
+  assert.ok(parent.includes('await fetchVmBackups(selectedVM.vmid, true)'));
+  console.log('PASS: native task completion, partial/unconfirmed outcomes, lost responses, no destructive retries, translated UI and forced refresh');
+})().catch(error => { console.error(error); process.exitCode = 1; });
diff --git a/tests/test_guest_backup_archives.py b/tests/test_guest_backup_archives.py
new file mode 100644
index 00000000..f9ff6769
--- /dev/null
+++ b/tests/test_guest_backup_archives.py
@@ -0,0 +1,239 @@
+"""Guest archive deletion contract. No real Proxmox commands or backups."""
+
+import ast
+import copy
+import importlib.util
+import json
+from pathlib import Path
+import subprocess
+import sys
+import types
+import unittest
+from unittest.mock import Mock, patch
+
+from flask import Flask, jsonify, request
+
+ROOT = Path(__file__).resolve().parents[1]
+SCRIPTS = ROOT / "AppImage/scripts"
+sys.path.insert(0, str(SCRIPTS))
+import guest_backup_archives as archives
+
+VOLUME = "local:backup/vzdump-lxc-100-2026_10_16-12_00_00.tar.zst"
+OTHER = VOLUME.replace("12_00_00", "13_00_00")
+TASK = "UPID:pve1:00000001:00000002:00000003:imgdel:100:root@pam:"
+
+
+class DeletionTests(unittest.TestCase):
+    def setUp(self):
+        self.node = patch.object(archives, "_node", return_value="pve1")
+        self.node.start()
+        self.addCleanup(self.node.stop)
+        self.inventory = [{"volid": VOLUME, "vmid": 100, "content": "backup", "protected": False}]
+        self.calls = []
+        self.response = None
+        archives._tasks.clear()
+
+    def run_pvesh(self, args, **kwargs):
+        self.calls.append(args)
+        if args[0] == "get" and args[1].endswith("/content"):
+            return copy.deepcopy(self.inventory)
+        if args[0] == "delete":
+            if isinstance(self.response, Exception):
+                raise self.response
+            return self.response
+        return {"status": "stopped", "exitstatus": "OK"}
+
+    def delete(self, volumes=(VOLUME,), **kwargs):
+        data = {"confirm": True, "backups": [{"storage": v.split(":")[0], "volid": v} for v in volumes]}
+        data.update(kwargs)
+        with patch.object(archives, "_pvesh", side_effect=self.run_pvesh):
+            return archives.delete_guest_backups(100, data)
+
+    def test_success_uses_guest_filtered_native_inventory_and_delete(self):
+        self.assertEqual(self.delete()["results"], [{"storage": "local", "volid": VOLUME, "status": "deleted"}])
+        self.assertEqual(self.calls, [
+            ["get", "/nodes/pve1/storage/local/content", "--content", "backup", "--vmid", "100"],
+            ["delete", f"/nodes/pve1/storage/local/content/{VOLUME}", "--delay", "1"],
+        ])
+
+    def test_a_deletion_that_ends_within_the_delay_prints_its_log_and_counts_as_deleted(self):
+        # Real pvesh output on a directory storage: the task log, not JSON.
+        run = subprocess.CompletedProcess([], 0, stdout=f"Removed volume '{VOLUME}'\n", stderr="")
+        with patch.object(archives.subprocess, "run", return_value=run):
+            self.assertEqual(archives._pvesh(["delete", f"/nodes/pve1/storage/local/content/{VOLUME}", "--delay", "1"]),
+                             f"Removed volume '{VOLUME}'")
+        self.response = f"Removed volume '{VOLUME}'"
+        self.assertEqual(self.delete()["results"][0]["status"], "deleted")
+        self.response = "Removed volume 'local:backup/another-archive.tar.zst'"
+        self.assertEqual(self.delete()["results"][0]["status"], "unconfirmed")
+        with patch.object(archives.subprocess, "run", return_value=run), self.assertRaises(archives.BackupArchiveError):
+            archives._pvesh(["get", "/nodes/pve1/storage/local/content"])
+
+    def test_bad_payloads_and_paths_never_reach_proxmox(self):
+        payloads = [None, [], {}, {"confirm": 1}, {"confirm": True, "backups": []},
+                    {"confirm": True, "backups": [None]}, {"confirm": True, "backups": [VOLUME]},
+                    {"confirm": True, "backups": [{"storage": "local", "volid": VOLUME}] * 21}]
+        for volid in ("local:../etc/passwd", "local:backup/../x", "local:/etc/pve/storage.cfg", "local:backup//x",
+                      "local:backup/x%2fy", "local:backup/x\n--force", "local:backup/x;touch /tmp/x", "other:backup/x"):
+            payloads.append({"confirm": True, "backups": [{"storage": "local", "volid": volid}]})
+        for storage in ("../local", "-x", "local\n", 2, None):
+            payloads.append({"confirm": True, "backups": [{"storage": storage, "volid": VOLUME}]})
+        with patch.object(archives, "_pvesh") as run:
+            for data in payloads:
+                with self.subTest(data=data), self.assertRaises(archives.BackupArchiveError):
+                    archives.delete_guest_backups(100, data)
+            for vmid in (0, 99, 1000000000):
+                with self.assertRaises(archives.BackupArchiveError):
+                    archives.delete_guest_backups(vmid, {"confirm": True, "backups": [{"storage": "local", "volid": VOLUME}]})
+        run.assert_not_called()
+
+    def test_duplicate_selection_rejected_before_commands(self):
+        with self.assertRaises(archives.BackupArchiveError):
+            self.delete((VOLUME, VOLUME))
+        self.assertEqual(self.calls, [])
+
+    def test_newly_protected_archives_fail_the_whole_batch(self):
+        self.inventory.append({"volid": OTHER, "vmid": 100, "content": "backup", "protected": True})
+        for protection in (True, 1, "1", "true", "unexpected"):
+            self.inventory[-1]["protected"] = protection
+            with self.subTest(protection=protection), self.assertRaises(archives.BackupArchiveError) as error:
+                self.delete((VOLUME, OTHER))
+            self.assertEqual(error.exception.code, 409)
+        self.assertFalse(any(call[0] == "delete" for call in self.calls))
+
+    def test_missing_cross_guest_and_non_backup_volumes_are_never_deleted(self):
+        for entries in ([], [{"volid": VOLUME, "vmid": 101, "content": "backup"}],
+                        [{"volid": VOLUME, "content": "backup"}],
+                        [{"volid": VOLUME, "vmid": 100, "content": "images"}]):
+            self.inventory = entries
+            with self.subTest(entries=entries), self.assertRaises(archives.BackupArchiveError):
+                self.delete()
+        self.assertFalse(any(call[0] == "delete" for call in self.calls))
+
+    def test_storage_failure_prevents_every_delete(self):
+        def unavailable(args):
+            self.assertEqual(args[0], "get")
+            raise archives.BackupArchiveError("offline", 502)
+        with patch.object(archives, "_pvesh", side_effect=unavailable), self.assertRaises(archives.BackupArchiveError):
+            archives.delete_guest_backups(100, {"confirm": True, "backups": [
+                {"volid": VOLUME, "storage": "local"}, {"volid": "nas:backup/x", "storage": "nas"}]})
+
+    def test_partial_native_errors_remain_unconfirmed(self):
+        self.inventory.append({"volid": OTHER, "vmid": 100, "content": "backup"})
+        def native(args):
+            if args[0] == "delete" and OTHER in args[1]:
+                raise archives.BackupArchiveError("backup is protected", 502)
+            return self.run_pvesh(args)
+        with patch.object(archives, "_pvesh", side_effect=native):
+            result = archives.delete_guest_backups(100, {"confirm": True, "backups": [
+                {"volid": v, "storage": "local"} for v in (VOLUME, OTHER)]})
+        self.assertEqual([item["status"] for item in result["results"]], ["deleted", "unconfirmed"])
+        self.assertIn("protected", result["results"][1]["error"])
+
+    def test_native_task_is_not_a_success_until_exit_ok(self):
+        self.response = TASK
+        result = self.delete()["results"][0]
+        self.assertEqual(result["status"], "pending")
+        for native, expected in (({"status": "running"}, "pending"),
+                                 ({"status": "stopped", "exitstatus": "OK"}, "deleted"),
+                                 ({"status": "stopped", "exitstatus": "cannot delete protected backup"}, "unconfirmed"),
+                                 ({"status": "stopped"}, "unconfirmed")):
+            with patch.object(archives, "_pvesh", return_value=native) as run:
+                answer = archives.guest_backup_deletion_status(100, TASK)
+            self.assertEqual(answer["status"], expected)
+            run.assert_called_once_with(["get", f"/nodes/pve1/tasks/{TASK}/status"])
+
+    def test_poll_cannot_read_arbitrary_tasks_or_other_guests(self):
+        self.response = TASK
+        self.delete()
+        with patch.object(archives, "_pvesh") as run:
+            for vmid, task in ((101, TASK), (100, "../../status"), (100, None), (100, TASK + "x")):
+                with self.assertRaises(archives.BackupArchiveError):
+                    archives.guest_backup_deletion_status(vmid, task)
+            archives._tasks[TASK]["created"] -= 3601
+            with self.assertRaises(archives.BackupArchiveError):
+                archives.guest_backup_deletion_status(100, TASK)
+        run.assert_not_called()
+
+    def test_invalid_native_task_answers_never_claim_success(self):
+        for response in ("", {}, [TASK], TASK.replace("imgdel", "vzdump"), TASK.replace("pve1", "pve2")):
+            self.response = response
+            with self.subTest(response=response):
+                self.assertEqual(self.delete()["results"][0]["status"], "unconfirmed")
+
+    def test_pvesh_uses_argv_and_handles_failure_and_timeout(self):
+        with patch.object(archives.subprocess, "run", return_value=types.SimpleNamespace(returncode=0, stdout="null")) as run:
+            self.assertIsNone(archives._pvesh(["delete", "/native/path"]))
+        self.assertEqual(run.call_args.args[0], ["pvesh", "delete", "/native/path", "--output-format", "json"])
+        self.assertNotIn("shell", run.call_args.kwargs)
+        with patch.object(archives.subprocess, "run", return_value=types.SimpleNamespace(returncode=0, stdout="")):
+            self.assertIsNone(archives._pvesh(["delete", "/native/path"]))
+        for response in (types.SimpleNamespace(returncode=1, stderr="protected", stdout=""),
+                         types.SimpleNamespace(returncode=0, stdout="not JSON")):
+            with patch.object(archives.subprocess, "run", return_value=response), self.assertRaises(archives.BackupArchiveError):
+                archives._pvesh(["delete", "/native/path"])
+        for error in (FileNotFoundError(), subprocess.TimeoutExpired("pvesh", 20)):
+            with patch.object(archives.subprocess, "run", side_effect=error), self.assertRaises(archives.BackupArchiveError):
+                archives._pvesh(["delete", "/native/path"])
+
+
+class RouteTests(unittest.TestCase):
+    """Compile the real route bodies/decorators without starting host services."""
+    def setUp(self):
+        auth = types.ModuleType("auth_manager")
+        auth.load_auth_config = lambda: {"enabled": True}
+        auth.verify_token = lambda token: "tester" if token == "admin" else None
+        auth.verify_token_full = lambda token: ("tester", "full_admin" if token == "admin" else "read_only")
+        spec = importlib.util.spec_from_file_location("guest_backup_test_middleware", SCRIPTS / "jwt_middleware.py")
+        middleware = importlib.util.module_from_spec(spec)
+        with patch.dict(sys.modules, auth_manager=auth):
+            spec.loader.exec_module(middleware)
+        self.app = Flask(__name__)
+        self.service = Mock(return_value={"results": []})
+        self.status = Mock(return_value={"volid": VOLUME, "status": "deleted"})
+        self.invalidate = Mock()
+        self.namespace = {"app": self.app, "require_admin_scope": middleware.require_admin_scope,
+                          "request": request, "jsonify": jsonify, "BackupArchiveError": archives.BackupArchiveError,
+                          "delete_guest_backups": self.service, "guest_backup_deletion_status": self.status,
+                          "_vm_cache_invalidate": self.invalidate, "_vm_backups_cache": {}}
+        source = ast.parse((SCRIPTS / "flask_server.py").read_text())
+        wanted = {"api_delete_vm_backups", "api_vm_backup_deletion_status"}
+        routes = [node for node in source.body if isinstance(node, ast.FunctionDef) and node.name in wanted]
+        self.assertEqual(len(routes), 2)
+        exec(compile(ast.Module(body=routes, type_ignores=[]), "flask_server.py", "exec"), self.namespace)
+        self.client = self.app.test_client()
+
+    def test_both_routes_reject_unauthenticated_and_read_only_requests(self):
+        for headers, status in (({}, 401), ({"Authorization": "Bearer reader"}, 403)):
+            self.assertEqual(self.client.post("/api/vms/100/backups/delete", json={}, headers=headers).status_code, status)
+            self.assertEqual(self.client.get("/api/vms/100/backups/delete-status?task=x", headers=headers).status_code, status)
+        self.service.assert_not_called()
+        self.status.assert_not_called()
+        self.invalidate.assert_not_called()
+
+    def test_admin_route_passes_payload_and_invalidates_even_after_errors(self):
+        data = {"confirm": True, "backups": [{"storage": "local", "volid": VOLUME}]}
+        headers = {"Authorization": "Bearer admin"}
+        self.assertEqual(self.client.post("/api/vms/100/backups/delete", json=data, headers=headers).status_code, 200)
+        self.service.assert_called_once_with(100, data)
+        self.invalidate.assert_called_once_with(100, {})
+        self.service.side_effect = archives.BackupArchiveError("protected", 409)
+        self.assertEqual(self.client.post("/api/vms/100/backups/delete", json=data, headers=headers).status_code, 409)
+        self.assertEqual(self.invalidate.call_count, 2)
+
+    def test_poll_invalidates_only_after_completion(self):
+        headers = {"Authorization": "Bearer admin"}
+        self.status.return_value = {"status": "pending"}
+        self.client.get("/api/vms/100/backups/delete-status?task=x", headers=headers)
+        self.invalidate.assert_not_called()
+        self.status.return_value = {"status": "deleted"}
+        self.client.get("/api/vms/100/backups/delete-status?task=x", headers=headers)
+        self.status.assert_called_with(100, "x")
+        self.invalidate.assert_called_once_with(100, {})
+
+    def test_runtime_module_is_shipped(self):
+        self.assertIn('cp "$SCRIPT_DIR/guest_backup_archives.py" "$APP_DIR/usr/bin/"', (SCRIPTS / "build_appimage.sh").read_text())
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/test_lvm_disk_read_policy.py b/tests/test_lvm_disk_read_policy.py
new file mode 100644
index 00000000..30495950
--- /dev/null
+++ b/tests/test_lvm_disk_read_policy.py
@@ -0,0 +1,151 @@
+"""Automatic LVM readers must not bypass disk exclusions/idle policy."""
+import ast
+import json
+from pathlib import Path
+import subprocess
+import sys
+import types
+import unittest
+from unittest.mock import Mock, patch
+
+SCRIPTS = Path(__file__).resolve().parents[1] / "AppImage/scripts"
+sys.path.insert(0, str(SCRIPTS))
+import lvm_device_scope as scope
+
+def lsblk(*devices):
+    """lsblk -J -l output from (kname, type, pkname, fstype) rows."""
+    return json.dumps({"blockdevices": [dict(zip(("kname", "type", "pkname", "fstype"), row)) for row in devices]})
+
+
+INVENTORY = lsblk(("nvme0n1", "disk", None, None), ("nvme0n1p1", "part", "nvme0n1", "LVM2_member"),
+                  ("sda", "disk", None, None), ("sda1", "part", "sda", "LVM2_member"),
+                  ("sdb", "disk", None, None), ("sdb1", "part", "sdb", "LVM2_member"))
+
+
+class LvmScopeTests(unittest.TestCase):
+    def setUp(self):
+        self.policy = Mock(side_effect=lambda disk, excluded: "excluded" if disk in excluded else "read")
+        self.standby = Mock(return_value=False)
+        self.excluded = {"sda"}
+        self.disk_module = types.ModuleType("disk_temperature_history")
+        self.disk_module.disk_read_policy = self.policy
+        self.disk_module.excluded_disk_names = lambda: self.excluded
+        self.modules = patch.dict(sys.modules, disk_temperature_history=self.disk_module)
+        self.modules.start()
+        self.addCleanup(self.modules.stop)
+
+    def args(self, inventory=INVENTORY, code=0):
+        with patch.object(scope.subprocess, "run", return_value=types.SimpleNamespace(returncode=code, stdout=inventory)) as run:
+            args = scope.lvm_device_args(self.standby)
+        self.assertEqual(run.call_args.args[0], ["lsblk", "-J", "-l", "-o", "KNAME,TYPE,PKNAME,FSTYPE"])
+        return args
+
+    def test_excluded_disks_and_their_partitions_are_not_in_the_scan(self):
+        self.assertEqual(self.args(), ["--devices", "/dev/nvme0n1p1,/dev/sdb1"])
+        self.assertNotIn((("sda",), {}), self.standby.call_args_list)
+        self.assertEqual({call.args[0] for call in self.standby.call_args_list}, {"nvme0n1", "sdb"})
+
+    def test_idle_disks_receive_no_power_query(self):
+        self.excluded = set()
+        self.policy.side_effect = lambda disk, excluded: "idle" if disk == "sda" else "read"
+        self.assertNotIn("/dev/sda1", self.args()[1])
+        self.assertEqual({call.args[0] for call in self.standby.call_args_list}, {"nvme0n1", "sdb"})
+
+    def test_a_standby_disk_is_excluded_even_when_its_io_changed(self):
+        self.excluded = set()
+        self.standby.side_effect = lambda disk: disk == "sdb"
+        self.assertEqual(self.args(), ["--devices", "/dev/nvme0n1p1,/dev/sda1"])
+
+    def test_all_allowed_disks_keep_existing_scan_behaviour(self):
+        self.excluded = set()
+        self.assertEqual(self.args(), [])
+
+    def test_all_blocked_disks_skip_instead_of_falling_back_to_full_scan(self):
+        self.excluded = {"nvme0n1", "sda", "sdb"}
+        self.assertIsNone(self.args())
+        self.standby.assert_not_called()
+
+    def test_all_standby_disks_skip(self):
+        self.excluded = set()
+        self.standby.return_value = True
+        self.assertIsNone(self.args())
+
+    def test_bad_inventory_or_policy_never_authorizes_an_unrestricted_scan(self):
+        for inventory, code in (("", 0), (INVENTORY, 1), ("sda1 part sda", 0),
+                                (lsblk(("sda1", "part", "sda", None)), 0), (lsblk(("../sda", "disk", None, None)), 0)):
+            self.assertIsNone(self.args(inventory, code))
+        for error in (FileNotFoundError(), subprocess.TimeoutExpired("lsblk", 5)):
+            with patch.object(scope.subprocess, "run", side_effect=error):
+                self.assertIsNone(scope.lvm_device_args(self.standby))
+        self.policy.side_effect = RuntimeError("policy unavailable")
+        self.assertIsNone(self.args())
+
+
+    def test_raid_multipath_and_encrypted_devices_follow_their_disks(self):
+        inventory = lsblk(
+            ("sda", "disk", None, None), ("sda1", "part", "sda", "linux_raid_member"),
+            ("sdb", "disk", None, None), ("sdb1", "part", "sdb", "linux_raid_member"),
+            ("md0", "raid1", "sda1", "LVM2_member"), ("md0", "raid1", "sdb1", "LVM2_member"),
+            ("sdc", "disk", None, None), ("sdc1", "part", "sdc", "crypto_LUKS"),
+            ("dm-0", "crypt", "sdc1", "LVM2_member"), ("dm-1", "lvm", "dm-0", "ext4"),
+            ("sdd", "disk", None, None), ("sde", "disk", None, None),
+            ("dm-2", "mpath", "sdd", None), ("dm-2", "mpath", "sde", None), ("dm-3", "part", "dm-2", "LVM2_member"))
+        self.excluded = {"sdb"}
+        # md0 reads sdb as well, so it stays out; the LUKS volume and the
+        # multipath partition are built only on readable disks. Disks that
+        # hold no physical volume are never named, so LVM does not open them.
+        self.assertEqual(self.args(inventory), ["--devices", "/dev/dm-0,/dev/dm-3"])
+        self.excluded = set()
+        self.assertEqual(self.args(inventory), [])
+
+    def test_the_scan_settles_its_own_reads_on_the_disks_it_read(self):
+        self.excluded = {"sda"}
+        settled = Mock()
+        self.disk_module.settle_own_reads = settled
+        self.args()
+        scope.settle_scan_reads()
+        settled.assert_called_once_with({"nvme0n1", "sdb"})
+
+
+class LvmReaderTests(unittest.TestCase):
+    def extract(self, file, name, owner=None, namespace=None):
+        tree = ast.parse((SCRIPTS / file).read_text())
+        body = tree.body if owner is None else next(n.body for n in tree.body if isinstance(n, ast.ClassDef) and n.name == owner)
+        node = next(n for n in body if isinstance(n, ast.FunctionDef) and n.name == name)
+        namespace = dict(namespace or {})
+        exec(compile(ast.Module(body=[node], type_ignores=[]), file, "exec"), namespace)
+        return namespace[name]
+
+    def test_both_helpers_delegate_to_the_same_policy(self):
+        for file in ("flask_server.py", "health_monitor.py"):
+            standby = Mock()
+            function = self.extract(file, "_lvm_device_args", namespace={"_hdd_in_standby": standby})
+            with patch.object(scope, "lvm_device_args", return_value=None) as shared:
+                self.assertIsNone(function())
+            shared.assert_called_once_with(standby)
+
+    def test_health_skips_lvs_and_vgs_when_no_scan_is_permitted(self):
+        run = Mock(return_value=types.SimpleNamespace(returncode=0))
+        function = self.extract("health_monitor.py", "_check_lvm", "HealthMonitor", {
+            "Dict": dict, "Any": object, "subprocess": types.SimpleNamespace(run=run), "_lvm_device_args": lambda: None,
+        })
+        result = function(None)
+        self.assertEqual(result["status"], "INFO")
+        self.assertTrue(result["skipped"])
+        self.assertEqual([call.args[0] for call in run.call_args_list], [["which", "lvs"]])
+
+    def test_storage_skips_pvs_when_no_scan_is_permitted(self):
+        tree = ast.parse((SCRIPTS / "flask_server.py").read_text())
+        function = next(n for n in tree.body if isinstance(n, ast.FunctionDef) and n.name == "get_system_disks")
+        block = next(node for node in function.body if isinstance(node, ast.Try) and "'pvs'" in ast.unparse(node))
+        run = Mock(side_effect=AssertionError("pvs must not run"))
+        namespace = {"subprocess": types.SimpleNamespace(run=run), "_lvm_device_args": lambda: None}
+        exec(compile(ast.Module(body=[block], type_ignores=[]), "flask_server.py", "exec"), namespace)
+        run.assert_not_called()
+
+    def test_module_is_shipped(self):
+        self.assertIn('cp "$SCRIPT_DIR/lvm_device_scope.py" "$APP_DIR/usr/bin/"', (SCRIPTS / "build_appimage.sh").read_text())
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/test_repository_policy_pbs.py b/tests/test_repository_policy_pbs.py
new file mode 100644
index 00000000..e0a71d90
--- /dev/null
+++ b/tests/test_repository_policy_pbs.py
@@ -0,0 +1,103 @@
+"""Fixture-only PBS policy checks: never call host proxmox-backup-* tools or edit host APT sources."""
+import importlib.util
+import json
+from pathlib import Path
+import unittest
+from unittest.mock import patch
+
+ROOT = Path(__file__).resolve().parents[1]
+POLICY = ROOT / 'scripts/global/repository_policy.py'
+
+
+def repo(components, *, uri='https://enterprise.proxmox.com/debian/pbs', suite='trixie', enabled=True):
+    return {'Types': ['deb'], 'URIs': [uri], 'Suites': [suite],
+            'Components': components.split(), 'Enabled': enabled}
+
+
+class PBSRepositoryPolicyTest(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls):
+        spec = importlib.util.spec_from_file_location('repository_policy', POLICY)
+        cls.module = importlib.util.module_from_spec(spec)
+        spec.loader.exec_module(cls.module)
+
+    def setUp(self):
+        self.calls = []
+        self.status = 'notfound'
+        self.repositories = {
+            'files': [
+                {'path': '/etc/apt/sources.list.d/pbs-enterprise.sources', 'repositories': [repo('pbs-enterprise')]},
+                {'path': '/etc/apt/sources.list.d/debian.sources',
+                 'repositories': [repo('main contrib', uri='http://deb.debian.org/debian')]},
+            ],
+            'errors': [], 'digest': 'fixture-digest',
+            'standard-repos': [{'handle': 'enterprise'}, {'handle': 'no-subscription'}, {'handle': 'test'}],
+        }
+
+    def run_policy(self, apply=False):
+        def run(args):
+            self.calls.append(args)
+            if args[:3] == ['proxmox-backup-manager', 'subscription', 'get']:
+                return json.dumps({'status': self.status, 'serverid': 'FIXTURE-SECRET'})
+            self.assertEqual(args[:2], ['proxmox-backup-debug', 'api'])
+            action = args[2]
+            if action == 'get':
+                return json.dumps(self.repositories)
+            self.assertEqual(args[args.index('--digest') + 1], self.repositories['digest'])
+            if action == 'create':
+                path = args[args.index('--path') + 1]
+                index = int(args[args.index('--index') + 1])
+                next(f for f in self.repositories['files'] if f['path'] == path)['repositories'][index]['Enabled'] = False
+            elif action == 'set':
+                self.repositories['files'].append({'path': '/etc/apt/sources.list.d/proxmox.sources',
+                                                   'repositories': [repo('pbs-no-subscription', uri='http://download.proxmox.com/debian/pbs')]})
+            self.repositories['digest'] += '+'
+            return ''
+        with patch.object(self.module, 'run', side_effect=run):
+            return self.module.evaluate('trixie', apply=apply, product='pbs')
+
+    def writes(self):
+        return [c for c in self.calls if c[:2] == ['proxmox-backup-debug', 'api'] and c[2] in ('create', 'set')]
+
+    def test_fresh_pbs_offers_switch_without_writing(self):
+        self.assertEqual(self.run_policy(), 'offer')
+        self.assertEqual(self.writes(), [])
+        self.assertFalse(any(c[0] in ('pvesh', 'pvesubscription') for c in self.calls))
+
+    def test_consented_switch_disables_pbs_enterprise_then_adds_no_subscription(self):
+        self.assertEqual(self.run_policy(apply=True), 'changed')
+        writes = self.writes()
+        self.assertEqual([c[2] for c in writes], ['create', 'set'])
+        self.assertEqual(writes[0][writes[0].index('--path') + 1], '/etc/apt/sources.list.d/pbs-enterprise.sources')
+        self.assertEqual(writes[0][writes[0].index('--enabled') + 1], '0')
+        self.assertEqual(writes[1][writes[1].index('--handle') + 1], 'no-subscription')
+
+    def test_active_subscription_preserves_enterprise(self):
+        self.status = 'active'
+        self.assertEqual(self.run_policy(apply=True), 'preserve')
+        self.assertEqual(self.writes(), [])
+
+    def test_existing_no_subscription_is_preserved_without_lookup(self):
+        self.repositories['files'][0]['repositories'] = [repo('pbs-no-subscription')]
+        self.assertEqual(self.run_policy(apply=True), 'preserve')
+        self.assertFalse(any(c[0] == 'proxmox-backup-manager' for c in self.calls))
+
+    def test_unrecognized_subscription_status_cannot_mutate(self):
+        self.status = 'invalid'
+        with self.assertRaisesRegex(ValueError, 'proxmox-backup-manager'):
+            self.run_policy(apply=True)
+        self.assertEqual(self.writes(), [])
+
+    def test_pve_channels_do_not_count_as_pbs_sources(self):
+        self.repositories['files'][0]['repositories'] = [repo('pve-no-subscription')]
+        self.assertEqual(self.run_policy(), 'offer')
+
+    def test_wrong_suite_points_to_pbs_interface(self):
+        self.repositories['files'][0]['repositories'] = [repo('pbs-enterprise', suite='bookworm')]
+        with self.assertRaisesRegex(ValueError, 'Administration > Repositories'):
+            self.run_policy()
+        self.assertEqual(self.writes(), [])
+
+
+if __name__ == '__main__':
+    unittest.main()
diff --git a/tests/test_vm_backup_jobs_api.py b/tests/test_vm_backup_jobs_api.py
index cd7a2fda..b5e50396 100644
--- a/tests/test_vm_backup_jobs_api.py
+++ b/tests/test_vm_backup_jobs_api.py
@@ -1,5 +1,6 @@
 """VM/CT backup jobs API: what reaches pvesh, with pvesh itself replaced."""
 import importlib
+import importlib.util
 import json
 import sys
 import types
@@ -23,6 +24,34 @@ GUESTS = [{"vmid": 100, "name": "web", "type": "qemu", "node": "pve1"},
           {"vmid": 200, "name": "other", "type": "qemu", "node": "pve2"}]
 
 
+@unittest.skipIf(Flask is None, "Flask runtime required")
+class StorageRetentionAuthorizationTests(unittest.TestCase):
+    def test_real_authentication_guard_blocks_read_only_writes_before_pvesh(self):
+        scripts = Path(__file__).resolve().parents[1] / "AppImage/scripts"
+        auth = types.ModuleType("auth_manager")
+        auth.load_auth_config = lambda: {"enabled": True}
+        auth.verify_token = lambda token: "tester" if token in ("admin", "reader") else None
+        auth.verify_token_full = lambda token: ("tester", "full_admin" if token == "admin" else "read_only")
+        spec = importlib.util.spec_from_file_location("storage_retention_middleware", scripts / "jwt_middleware.py")
+        middleware = importlib.util.module_from_spec(spec)
+        with patch.dict(sys.modules, auth_manager=auth):
+            spec.loader.exec_module(middleware)
+        spec = importlib.util.spec_from_file_location("storage_retention_auth_routes", scripts / "flask_vm_backup_routes.py")
+        routes = importlib.util.module_from_spec(spec)
+        with patch.dict(sys.modules, jwt_middleware=middleware):
+            spec.loader.exec_module(routes)
+        app = Flask(__name__)
+        app.register_blueprint(routes.vm_backup_bp)
+        client = app.test_client()
+        data = {"digest": "a" * 40, "prune_backups": "keep-last=3"}
+        with patch.object(routes, "_pvesh") as run:
+            self.assertEqual(client.get("/api/vm-backup-storages").status_code, 401)
+            self.assertEqual(client.put("/api/vm-backup-storages/local", json=data).status_code, 401)
+            self.assertEqual(client.put("/api/vm-backup-storages/local", json=data,
+                                        headers={"Authorization": "Bearer reader"}).status_code, 403)
+        run.assert_not_called()
+
+
 @unittest.skipIf(Flask is None, "Flask runtime required")
 class VmBackupJobsApiTests(unittest.TestCase):
     def setUp(self):
@@ -73,9 +102,63 @@ class VmBackupJobsApiTests(unittest.TestCase):
 
     def test_reading_needs_a_session_and_changing_needs_an_administrator(self):
         guards = dict((name, kind) for kind, name in self.guards)
-        self.assertEqual({name for name, kind in guards.items() if kind == "auth"}, {"list_jobs", "options", "get_job"})
+        self.assertEqual({name for name, kind in guards.items() if kind == "auth"}, {"list_jobs", "options", "get_job", "backup_storage_retention"})
         self.assertEqual({name for name, kind in guards.items() if kind == "admin"},
-                         {"create_job", "update_job", "delete_job", "toggle_job", "run_job"})
+                         {"create_job", "update_job", "delete_job", "toggle_job", "run_job", "update_backup_storage_retention"})
+
+    def test_storage_retention_lists_only_backup_storages_and_no_secrets(self):
+        with patch.object(self.routes, "_pvesh_json", return_value=(True, [
+            {"storage": "local", "type": "dir", "content": "backup,iso", "digest": "a" * 40,
+             "prune-backups": {"keep-last": 3}, "password": "private"},
+            {"storage": "images", "type": "dir", "content": "images", "digest": "a" * 40},
+        ])):
+            answer = self.client.get("/api/vm-backup-storages").get_json()
+        self.assertEqual(answer, {"storages": [{"id": "local", "type": "dir", "digest": "a" * 40, "prune_backups": "keep-last=3"}]})
+
+    def storage_policy(self, prune="keep-last=3,keep-weekly=2", digest="a" * 40, current=None):
+        if current is None:
+            current = {"storage": "local", "content": "backup,iso", "digest": "a" * 40}
+        with patch.object(self.routes, "_pvesh_json", return_value=(True, current)), self.pvesh():
+            return self.client.put("/api/vm-backup-storages/local", json={"digest": digest, "prune_backups": prune})
+
+    def test_saving_native_storage_retention_never_runs_pruning_or_changes_other_properties(self):
+        response = self.storage_policy()
+        self.assertEqual(response.status_code, 200)
+        self.assertEqual(self.changes(), [["set", "/storage/local", "--digest", "a" * 40,
+                                          "--prune-backups", "keep-last=3,keep-weekly=2"]])
+        self.calls.clear()
+        self.assertEqual(self.storage_policy("keep-all=1").status_code, 200)
+        self.assertEqual(self.changes()[0][-1], "keep-all=1")
+
+    def test_an_empty_policy_returns_the_storage_to_the_proxmox_default(self):
+        self.assertEqual(self.storage_policy("").status_code, 200)
+        self.assertEqual(self.changes(), [["set", "/storage/local", "--digest", "a" * 40, "--delete", "prune-backups"]])
+
+    def test_invalid_storage_retention_is_rejected_before_commands(self):
+        invalid = [None, [], {}, {"digest": "a" * 40, "prune_backups": []}]
+        for prune in ("keep-last=3,keep-daily=0", "keep-last=-1", "keep-all=0", "keep-all=2", "keep-last=0", "keep-last=1,keep-last=2",
+                      "keep-all=1,keep-last=2", "keep-last=2 --delete path", "keep-last=1\n", "keep-other=1"):
+            invalid.append({"digest": "a" * 40, "prune_backups": prune})
+        invalid += [{"digest": "invalid", "prune_backups": "keep-last=1"}]
+        with patch.object(self.routes, "_pvesh") as run:
+            for data in invalid:
+                with self.subTest(data=data):
+                    self.assertEqual(self.client.put("/api/vm-backup-storages/local", json=data).status_code, 400)
+            self.assertEqual(self.client.put("/api/vm-backup-storages/-bad", json=invalid[-1]).status_code, 400)
+        run.assert_not_called()
+
+    def test_stale_storage_configuration_or_non_backup_storage_is_not_overwritten(self):
+        for current in ({"content": "backup", "digest": "b" * 40},
+                        {"content": "images", "digest": "a" * 40}):
+            self.assertEqual(self.storage_policy(current=current).status_code, 409)
+        self.assertEqual(self.changes(), [])
+
+    def test_native_storage_update_failure_is_visible(self):
+        with patch.object(self.routes, "_pvesh_json", return_value=(True, {"content": "backup", "digest": "a" * 40})), \
+                patch.object(self.routes, "_pvesh", return_value=(False, "configuration changed under lock")):
+            response = self.client.put("/api/vm-backup-storages/local", json={"digest": "a" * 40, "prune_backups": "keep-last=3"})
+        self.assertEqual(response.status_code, 409)
+        self.assertIn("changed", response.get_json()["error"])
 
     def test_the_list_gives_text_properties_and_the_host_backups_that_hang_from_a_job(self):
         with self.pvesh(), patch.object(self.routes, "_host_backups_attached",
diff --git a/web/CONTRIBUTING-TRANSLATIONS.md b/web/CONTRIBUTING-TRANSLATIONS.md
index ce9250cb..bd668edc 100644
--- a/web/CONTRIBUTING-TRANSLATIONS.md
+++ b/web/CONTRIBUTING-TRANSLATIONS.md
@@ -5,7 +5,12 @@ serves every published page under locale-prefixed URLs:
 
 - `/en/<path>` — English, the source of truth
 - `/es/<path>` — Spanish
+- `/de/<path>` — German
+- `/fr/<path>` — French
+- `/it/<path>` — Italian
+- `/pt/<path>` — Portuguese
 - `/sk/<path>` — Slovak, with English fallback where needed
+- `/sv/<path>` — Swedish
 
 We use [`next-intl`](https://next-intl.dev) for the i18n plumbing. Anyone
 can translate the docs without writing TypeScript: most of the work is
@@ -148,6 +153,18 @@ Example:
 
 ### 4. Test locally
 
+From the repository root, check the available catalogs without using a
+translation provider:
+
+```bash
+python3 .github/scripts/check_web_docs_catalogs.py
+```
+
+For a full locale-completion change, add `--require-complete` to also require
+every English file and leaf. This validates schema, placeholders, rich-text
+tags, literal code and rendering metadata; it does not replace linguistic
+review. Partial translations can continue to use the English fallback.
+
 ```bash
 cd web
 npm run dev
@@ -311,7 +328,10 @@ registers a renderer for them.
 If you want to add a language that isn't in the project yet:
 
 1. Create `messages/<locale>/common.json` and the page catalogs. The automated
-   builder can provide the initial baseline.
+   builder can provide the initial baseline when explicitly dispatched. It
+   does not run on merge: changing English and its translations together must
+   not trigger machine retranslation of the reviewed text. Offline validation
+   still runs automatically for website changes.
 2. Review the shared navigation and a representative set of documentation
    pages with a native speaker.
 3. Add the locale code to `routing.ts` only when the locale is ready to be
diff --git a/web/app/[locale]/docs/about/code-of-conduct/page.tsx b/web/app/[locale]/docs/about/code-of-conduct/page.tsx
index de18716b..53365824 100644
--- a/web/app/[locale]/docs/about/code-of-conduct/page.tsx
+++ b/web/app/[locale]/docs/about/code-of-conduct/page.tsx
@@ -24,23 +24,27 @@ export async function generateMetadata({ params }: { params: Promise<{ locale: s
   }
 }
 
-async function getCodeOfConductContent(notFoundMsg: string, loadFailedMsg: string) {
+async function getCodeOfConductContent(notFoundMsg: string, loadFailedMsg: string, translatedMarkdown?: string) {
   try {
     const codeOfConductPath = path.join(process.cwd(), "..", "CODE_OF_CONDUCT.md")
 
-    if (!fs.existsSync(codeOfConductPath)) {
+    if (!translatedMarkdown && !fs.existsSync(codeOfConductPath)) {
       console.error("CODE_OF_CONDUCT.md file not found.")
       return `<p class='text-red-600'>${notFoundMsg}</p>`
     }
 
-    const fileContents = fs.readFileSync(codeOfConductPath, "utf8")
+    const fileContents = translatedMarkdown || fs.readFileSync(codeOfConductPath, "utf8")
 
     const result = await remark()
       .use(gfm.default || gfm)
       .use(html)
       .process(fileContents)
 
-    return result.toString()
+    // Repository-relative policy links otherwise resolve under the docs URL.
+    return result.toString().replaceAll(
+      'href="./SECURITY.md"',
+      'href="https://github.com/MacRimi/ProxMenux/blob/main/SECURITY.md"',
+    )
   } catch (error) {
     console.error("Error reading the CODE_OF_CONDUCT.md file", error)
     return `<p class='text-red-600'>${loadFailedMsg}</p>`
@@ -71,7 +75,11 @@ export default async function CodeOfConductPage({ params }: { params: Promise<{
   const { locale } = await params
   setRequestLocale(locale)
   const t = await getTranslations({ locale, namespace: "docs.about.codeOfConduct" })
-  const codeOfConductContent = await getCodeOfConductContent(t("errors.notFound"), t("errors.loadFailed"))
+  const translatedMarkdown = t.has("contentMarkdown") ? t.raw("contentMarkdown") : undefined
+  const codeOfConductContent = await getCodeOfConductContent(
+    t("errors.notFound"), t("errors.loadFailed"),
+    typeof translatedMarkdown === "string" ? translatedMarkdown : undefined,
+  )
   const cleanedInlineCode = cleanInlineCode(codeOfConductContent)
   const parsedContent = wrapCodeBlocksWithCopyable(cleanedInlineCode)
 
diff --git a/web/app/[locale]/docs/hardware/gpu-vm-passthrough/page.tsx b/web/app/[locale]/docs/hardware/gpu-vm-passthrough/page.tsx
index f93b4470..959a01aa 100644
--- a/web/app/[locale]/docs/hardware/gpu-vm-passthrough/page.tsx
+++ b/web/app/[locale]/docs/hardware/gpu-vm-passthrough/page.tsx
@@ -149,96 +149,6 @@ export default async function GpuVmPassthroughPage({
       <h2 className="text-2xl font-semibold mt-10 mb-4 text-gray-900">{t("howRuns.heading")}</h2>
       <p className="mb-4 text-gray-800 leading-relaxed">{t("howRuns.body")}</p>
 
-      <pre className="bg-gray-100 text-gray-800 p-4 rounded-md overflow-x-auto text-sm my-4 border border-gray-200 leading-snug">
-{`┌─────────────────────────────────────────────┐
-│  PHASE 1 — Gather info, validate, confirm   │
-│  (nothing touched yet)                      │
-└──────────────────┬──────────────────────────┘
-                   ▼
-      ┌────────────┴────────────┐
-      ▼                         ▼
-  lspci detects             IOMMU enabled?
-  GPUs (Intel/AMD/           ├─ No → offer to add
-  NVIDIA)                    │      intel_iommu=on /
-      │                      │      amd_iommu=on
-      ▼                      └─ Yes → continue
-  User selects GPU
-      │
-      ▼
-  Pre-flight checks
-  ├─ Not in SR-IOV
-  ├─ Not D3cold (AMD)
-  ├─ Has FLR or equivalent reset
-  ├─ Not on the block-list (Intel Arc, Apollo Lake)
-  ├─ Warn if single-GPU host
-  └─ Resolve IOMMU group
-      │
-      ▼
-  User selects VM
-      │
-      ▼
-  VM is q35? ── No → abort
-      │
-     Yes
-      ▼
-  GPU already assigned elsewhere?
-      │
-      ├─ To LXC     → menu: keep + disable onboot
-      │               OR remove GPU lines + keep onboot
-      ├─ To other VM (running) → abort
-      ├─ To other VM (stopped) → menu: keep + disable onboot
-      │               OR remove GPU lines + keep onboot
-      │               (fast-path: already vfio-pci → no
-      │                host reconfig, no reboot needed)
-      └─ Free        → continue
-      │
-      ▼
-  Audio companion
-      ├─ Has .1 sibling?  (dGPU: NVIDIA/AMD HDMI)
-      │      → auto-include (never used by host)
-      └─ No .1 sibling?   (Intel iGPU, split audio)
-             → checklist of host audio controllers,
-               default = none (user opts in)
-      │
-      ▼
-  Show confirmation summary
-  (GPU + IOMMU siblings + audio + target VM)
-                   │
-     ┌─────── Cancel   OR   Confirm ────┐
-     ▼                                  ▼
- exit, nothing            ┌─────────────┴──────────────┐
- was changed              │  PHASE 2 — Apply changes   │
-                          └─────────────┬──────────────┘
-                                        ▼
-                          Host:
-                          ├─ /etc/modules (vfio_*)
-                          ├─ /etc/modprobe.d/vfio.conf (ids=... disable_vga=1)
-                          ├─ /etc/modprobe.d/blacklist.conf (vendor drivers only)
-                          ├─ kernel cmdline (IOMMU if missing)
-                          ├─ NVIDIA: per-BDF udev rule at
-                          │          10-proxmenux-vfio-bind.rules
-                          │          + BDF state at vfio-bind.bdfs
-                          │          (blacklist nvidia only when
-                          │           every NVIDIA GPU is in VFIO)
-                          ├─ AMD: dump ROM → vbios_<vendor>_<device>.bin
-                          └─ update-initramfs -u -k all
-                             + proxmox-boot-tool refresh
-
-                          VM config (qm set <vmid>):
-                          ├─ hostpci0 = GPU (x-vga=1 unless Intel iGPU)
-                          ├─ hostpci1..n = IOMMU group siblings
-                          ├─ hostpci<last> = audio function(s)
-                          ├─ vga = std
-                          └─ NVIDIA: cpu=host,hidden=1
-                                     args=... hv_vendor_id=NV43FIX
-                                        │
-                                        ▼
-                        ┌───────────────┴───────────────┐
-                        │  PHASE 3 — Summary + reboot   │
-                        └───────────────────────────────┘
-                        Show what changed. If host config
-                        touched → prompt reboot.`}
-      </pre>
 
       <h2 className="text-2xl font-semibold mt-10 mb-4 text-gray-900">{t("walkthrough.heading")}</h2>
 
@@ -394,18 +304,17 @@ args: -cpu 'host,+kvm_pv_unhalt,+kvm_pv_eoi,hv_vendor_id=NV43FIX,kvm=off'`}
       <h2 className="text-2xl font-semibold mt-10 mb-4 text-gray-900">{t("verification.heading")}</h2>
 
       <CopyableCode
-        code={`# After reboot, confirm the GPU is bound to vfio-pci (not to the vendor driver)
-lspci -nnk -d <vendor:device>
-# Expect: "Kernel driver in use: vfio-pci"
+        code={`# Replace PCI_ADDRESS and VMID with the actual values.
+# Verify the exact PCI address, especially with identical GPU models.
+lspci -nnk -s PCI_ADDRESS
+# Expected driver: vfio-pci
 
-# Start the VM and watch for successful binding
-qm start <vmid>
-journalctl -u qemu-server@<vmid>.service -f
-
-# Inside the guest, drivers install normally and the GPU works as if it were physical.
-# NVIDIA: verify with nvidia-smi inside the VM.
-# AMD:    verify with Windows Device Manager / DXDiag.
-# Intel:  verify display output / intel_gpu_top inside the VM.`}
+qm config VMID
+qm start VMID
+qm status VMID
+# Inspect the start task in Proxmox Tasks if startup fails.
+# Inside the guest, install a compatible GPU driver and test the application.
+# NVIDIA: nvidia-smi; AMD/Intel: the guest driver and application diagnostics.`}
         className="my-4"
       />
 
@@ -428,17 +337,14 @@ journalctl -u qemu-server@<vmid>.service -f
       </Callout>
 
       <CopyableCode
-        code={`# Rescue — remove passthrough
-# Remove hostpciN lines from the VM config
-sed -i '/^hostpci[0-9]*:/d' /etc/pve/qemu-server/<vmid>.conf
-
-# Unblacklist the host driver
-rm -f /etc/modprobe.d/blacklist.conf /etc/modprobe.d/vfio.conf
-# (if NVIDIA was involved)
-mv /etc/udev/rules.d/70-nvidia.rules.proxmenux-disabled /etc/udev/rules.d/70-nvidia.rules 2>/dev/null
-
-update-initramfs -u -k all
-reboot`}
+        code={`# Inspect from a recovered Proxmox host; replace the placeholders.
+qm config VMID
+lspci -nnk -s PCI_ADDRESS
+cat /etc/proxmenux/vfio-bind.bdfs 2>/dev/null
+# Review the affected PCI assignments and driver-binding configuration.
+# Do not remove entire shared blacklist.conf or vfio.conf files.
+# Use ProxMenux Switch GPU Mode to return a GPU to the host driver.
+# Review its affected guests and follow the indicated reboot procedure.`}
         className="my-4"
       />
 
@@ -449,26 +355,13 @@ reboot`}
       <h2 className="text-2xl font-semibold mt-10 mb-4 text-gray-900">{t("revert.heading")}</h2>
       <p className="mb-4 text-gray-800 leading-relaxed">{t("revert.intro")}</p>
       <CopyableCode
-        code={`# Remove hostpci lines from the VM
-qm set <vmid> --delete hostpci0
-# (repeat for hostpci1, hostpci2, ... if multiple were added)
-
-# ─── OPTIONAL — not required ──────────────────────────────────────
-# The steps above already free the VM from the GPU. The lines below
-# are only needed if you also want the host to use the GPU again
-# (e.g. for LXC sharing or host-side transcoding). Skip this block
-# if you simply want to stop passing the GPU to the VM.
-# ──────────────────────────────────────────────────────────────────
-
-# Release the GPU back to the host driver:
-rm -f /etc/modprobe.d/vfio.conf
-rm -f /etc/modprobe.d/blacklist.conf         # careful — this file may have other blacklists
-# NVIDIA only — re-enable the udev rule + drop the all-NVIDIA-in-VFIO blacklist (if present)
-mv /etc/udev/rules.d/70-nvidia.rules.proxmenux-disabled /etc/udev/rules.d/70-nvidia.rules 2>/dev/null
-rm -f /etc/modprobe.d/proxmenux-nvidia-vfio-blacklist.conf
-
-update-initramfs -u -k all
-reboot`}
+        code={`# Replace VMID. Inspect the actual assignment index first.
+qm config VMID
+# With the VM stopped, remove ONLY the intended entry (hostpci0 is an example).
+qm set VMID --delete hostpci0
+qm config VMID
+# Repeat only for the associated PCI entries you intend to remove.
+# This does not change the host's VFIO/native-driver binding.`}
         className="my-4"
       />
 
diff --git a/web/app/[locale]/docs/hardware/igpu-acceleration-lxc/page.tsx b/web/app/[locale]/docs/hardware/igpu-acceleration-lxc/page.tsx
index 1b4d6c20..7c30e930 100644
--- a/web/app/[locale]/docs/hardware/igpu-acceleration-lxc/page.tsx
+++ b/web/app/[locale]/docs/hardware/igpu-acceleration-lxc/page.tsx
@@ -146,88 +146,6 @@ export default async function AddGpuToLxcPage({
       <h2 className="text-2xl font-semibold mt-10 mb-4 text-gray-900">{t("howRuns.heading")}</h2>
       <p className="mb-4 text-gray-800 leading-relaxed">{t("howRuns.body")}</p>
 
-      <pre className="bg-gray-100 text-gray-800 p-4 rounded-md overflow-x-auto text-sm my-4 border border-gray-200 leading-snug">
-{`┌─────────────────────────────────────────────┐
-│  PHASE 1 — Detect, select, validate         │
-│  (nothing touched yet)                      │
-└──────────────────┬──────────────────────────┘
-                   ▼
-  lspci detects Intel / AMD / NVIDIA GPU(s)
-  (NVIDIA: also check nvidia module loaded +
-   nvidia-smi, capture host driver version)
-                   │
-                   ▼
-  User picks LXC container from the list
-                   │
-                   ▼
-  User selects which GPU(s) to add
-  (checklist; auto-selects if only one)
-                   │
-                   ▼
-  Pre-flight checks
-  ├─ Not in SR-IOV (VF / active PF) → block
-  ├─ Bound to vfio-pci? → offer Switch Mode, exit
-  └─ Already configured in this CT? → filter out
-      (skip duplicates, warn if partial)
-                   │
-     ┌─────── Cancel   OR   Confirm ────┐
-     ▼                                  ▼
- Exit, nothing       ┌──────────────────┴──────────────────┐
- was changed         │  PHASE 2 — Configure + install      │
-                     └──────────────────┬──────────────────┘
-                                        ▼
-                       Stop container (if running)
-                                        │
-                                        ▼
-                       Write LXC config (/etc/pve/lxc/<ctid>.conf):
-                       ├─ Intel / AMD iGPU:
-                       │    dev<N>: /dev/dri/card*   gid=video
-                       │    dev<N>: /dev/dri/renderD* gid=render
-                       ├─ AMD with ROCm (if /dev/kfd):
-                       │    dev<N>: /dev/kfd  gid=render
-                       └─ NVIDIA:
-                            dev<N>: /dev/nvidia0..N
-                            dev<N>: /dev/nvidiactl · nvidia-uvm*
-                            dev<N>: /dev/nvidia-modeset
-                            dev<N>: /dev/nvidia-caps/* (if exists)
-                                        │
-                                        ▼
-                       Install GPU guard hookscript
-                       (same one used by VM passthrough, if
-                        available — prevents conflicts on start/stop)
-                                        │
-                                        ▼
-                       Start container + wait for readiness
-                       (pct exec — true, up to ~30 s)
-                                        │
-                                        ▼
-                       Install userspace drivers inside CT
-                       (distro auto-detected)
-                       ├─ Intel  → apk/pacman/apt
-                       │           (intel-media-driver,
-                       │            libva-utils, opencl-icd)
-                       ├─ AMD    → Mesa VA drivers
-                       │           (mesa-va-drivers, libva)
-                       └─ NVIDIA →
-                          ├─ Alpine:  apk add nvidia-utils
-                          ├─ Arch:    pacman -S nvidia-utils
-                          └─ Debian/Ubuntu/others:
-                             host .run is pre-extracted, packed,
-                             pct push'd into the container, run
-                             with --no-kernel-modules --no-dkms
-                                        │
-                                        ▼
-                       Align GIDs in /etc/group inside CT
-                       (video=44, render=104 to match host)
-                                        │
-                                        ▼
-                       Restore container state
-                       (stop if it was stopped before)
-                                        │
-                                        ▼
-                       Show summary + nvidia-smi output
-                       (if NVIDIA) + log path`}
-      </pre>
 
       <h2 className="text-2xl font-semibold mt-10 mb-4 text-gray-900">{t("walkthrough.heading")}</h2>
 
diff --git a/web/app/[locale]/docs/hardware/install-coral-tpu-host/page.tsx b/web/app/[locale]/docs/hardware/install-coral-tpu-host/page.tsx
index 3267618c..229e1460 100644
--- a/web/app/[locale]/docs/hardware/install-coral-tpu-host/page.tsx
+++ b/web/app/[locale]/docs/hardware/install-coral-tpu-host/page.tsx
@@ -166,20 +166,6 @@ export default async function InstallCoralTPUHostPage({
       <h2 className="text-2xl font-semibold mt-10 mb-4 text-gray-900">{t("howRuns.heading")}</h2>
       <p className="mb-4 text-gray-800 leading-relaxed">{t("howRuns.body")}</p>
 
-      <pre className="bg-gray-100 text-gray-800 p-4 rounded-md overflow-x-auto text-sm my-4 border border-gray-200 leading-snug">
-{`Detect Coral hardware
-        │
-        ├─ PCIe / M.2 detected ──► build gasket + apex with DKMS
-        │                          └─ reboot recommended
-        │
-        ├─ USB detected ─────────► install libedgetpu runtime
-        │                          └─ no reboot required
-        │
-        └─ no PCIe / M.2 detected
-             ├─ no legacy gasket-dkms state ─► no PCIe changes
-             └─ legacy gasket-dkms state ────► offer optional cleanup
-                                                └─ USB runtime untouched`}
-      </pre>
 
       <h2 className="text-2xl font-semibold mt-10 mb-4 text-gray-900">{t("walkthrough.heading")}</h2>
 
@@ -362,6 +348,7 @@ rm -rf gasket-driver
 git clone --depth=1 https://github.com/feranick/gasket-driver.git
 
 # Stage under /usr/src for DKMS
+mkdir -p /usr/src/gasket-1.0
 cp -a /tmp/gasket-driver/src/. /usr/src/gasket-1.0/
 
 # Tell DKMS what it is
diff --git a/web/app/[locale]/docs/hardware/nvidia-host/page.tsx b/web/app/[locale]/docs/hardware/nvidia-host/page.tsx
index 62303d22..1dcd760f 100644
--- a/web/app/[locale]/docs/hardware/nvidia-host/page.tsx
+++ b/web/app/[locale]/docs/hardware/nvidia-host/page.tsx
@@ -138,102 +138,7 @@ export default async function NvidiaHostPage({
       <h2 className="text-2xl font-semibold mt-10 mb-4 text-gray-900">{t("howRuns.heading")}</h2>
       <p className="mb-4 text-gray-800 leading-relaxed">{t("howRuns.body")}</p>
 
-      <pre className="bg-gray-100 text-gray-800 p-4 rounded-md overflow-x-auto text-sm my-4 border border-gray-200 leading-snug">
-{`┌─────────────────────────────────────────────┐
-│  PHASE 1 — Detect, validate, pick version   │
-│  (nothing touched yet)                      │
-└──────────────────┬──────────────────────────┘
-                   ▼
-      ┌────────────┴────────────┐
-      ▼                         ▼
-  lspci detects             GPU bound to
-  NVIDIA GPU(s)             vfio-pci? ──→ Abort
-      │                         │        (remove VM
-      │                         No        passthrough first)
-      ▼
-  nvidia-smi: driver already installed?
-      │
-      ├─ No  → continue (fresh install)
-      └─ Yes → ask: Reinstall/Update  OR  Remove
-                     │
-                     ├─ Remove    → complete uninstall
-                     │               + reboot prompt
-                     └─ Reinstall → continue
-      │
-      ▼
-  Show install overview
-  (GPU list + current driver +
-   LXC containers with NVIDIA passthrough)
-      │
-      ▼
-  Kernel-compat filter:
-  ├─ Kernel 6.17+   → driver 580.82.07+
-  ├─ Kernel 6.8–16  → driver 550+
-  ├─ Kernel 6.2–7   → driver 535+
-  └─ Kernel 5.15+   → driver 470+
-      │
-      ▼
-  User picks version (or "Latest")
-                   │
-     ┌─────── Cancel   OR   Confirm ────┐
-     ▼                                  ▼
- Exit, nothing            ┌─────────────┴──────────────┐
- was changed              │  PHASE 2 — Install driver  │
-                          └─────────────┬──────────────┘
-                                        ▼
-                          Prepare host:
-                          ├─ Install pve-headers-$(uname -r)
-                          ├─ Install build-essential + dkms
-                          ├─ Blacklist nouveau + unload
-                          │  └ /etc/modprobe.d/nouveau-blacklist.conf
-                          ├─ Write modules-load config
-                          │  └ /etc/modules-load.d/nvidia-vfio.conf
-                          ├─ Stop/disable nvidia services
-                          └─ Unload residual nvidia modules
 
-                          If different version already present:
-                          └─ clean uninstall first (apt purge,
-                             remove DKMS entries)
-                                        │
-                                        ▼
-                          Download NVIDIA .run installer
-                          to /opt/nvidia (validate size +
-                          executable signature)
-                                        │
-                                        ▼
-                          Run installer with --dkms
-                          --disable-nouveau --no-nouveau-check
-                                        │
-                                        ▼
-                          Install udev rules
-                          └─ /etc/udev/rules.d/70-nvidia.rules
-                          + clone NVIDIA/nvidia-persistenced
-                                        │
-                                        ▼
-                          update-initramfs -u -k all
-                                        │
-                                        ▼
-                          nvidia-smi — verify driver loaded
-                                        │
-                        ┌───────────────┴───────────────┐
-                        │  PHASE 3 — Optional extras    │
-                        └───────────────┬───────────────┘
-                                        ▼
-                          LXC containers with NVIDIA?
-                          ├─ Yes → offer driver propagation
-                          │        (Alpine: apk · Arch: pacman ·
-                          │         Debian/others: extract .run)
-                          └─ No  → skip
-                                        │
-                                        ▼
-                          keylase/nvidia-patch (NVENC limit)?
-                          ├─ Yes → clone + apply
-                          └─ No  → skip
-                                        │
-                                        ▼
-                          Reboot prompt — required to finalize
-                          nouveau blacklist + load new module`}
-      </pre>
 
       <Steps>
         <Steps.Step title={t("walkthrough.detect.title")}>
@@ -282,7 +187,7 @@ export default async function NvidiaHostPage({
           <p className="mb-3 text-gray-800">{t.rich("walkthrough.download.body", { code })}</p>
           <CopyableCode
             code={`# What ProxMenux runs under the hood (you don't have to type this):
-sh NVIDIA-Linux-x86_64-<version>.run \\
+sh NVIDIA-Linux-x86_64-VERSION.run \\
   --no-questions \\
   --ui=none \\
   --disable-nouveau \\
diff --git a/web/app/[locale]/docs/hardware/switch-gpu-mode/page.tsx b/web/app/[locale]/docs/hardware/switch-gpu-mode/page.tsx
index 1ba82743..5da90cdb 100644
--- a/web/app/[locale]/docs/hardware/switch-gpu-mode/page.tsx
+++ b/web/app/[locale]/docs/hardware/switch-gpu-mode/page.tsx
@@ -336,29 +336,12 @@ export default async function SwitchGpuModePage({
         {t.rich("manual.intro", { strong, code })}
       </p>
       <CopyableCode
-        code={`# Drop the vendor:device from vfio.conf — keep other GPUs intact
-sed -i 's/10de:2204,//; s/,10de:2204//; s/=10de:2204 /=/' /etc/modprobe.d/vfio.conf
+        code={`# Inspect this example GPU; replace the ID with your card
+lspci -nnk -d 10de:2204
 
-# Remove the NVIDIA hard-blacklist and nouveau blacklist
-sed -i '/^blacklist nouveau$/d; /^blacklist nvidia$/d; /^blacklist nvidia_drm$/d; /^blacklist nvidia_modeset$/d; /^blacklist nvidia_uvm$/d; /^blacklist nvidiafb$/d' /etc/modprobe.d/blacklist.conf
-rm -f /etc/modprobe.d/nvidia-blacklist.conf
-
-# Re-enable NVIDIA udev rule + modules-load config (if disabled by VM-mode switch)
-[ -f /etc/udev/rules.d/70-nvidia.rules.proxmenux-disabled-vfio ] && \\
-  mv /etc/udev/rules.d/70-nvidia.rules.proxmenux-disabled-vfio \\
-     /etc/udev/rules.d/70-nvidia.rules
-[ -f /etc/modules-load.d/nvidia-vfio.conf.proxmenux-disabled-vfio ] && \\
-  mv /etc/modules-load.d/nvidia-vfio.conf.proxmenux-disabled-vfio \\
-     /etc/modules-load.d/nvidia-vfio.conf
-
-# Clean up the VM config — precise BDF regex, no substring collisions
-# (replace 0000:01:00 with your GPU's slot)
-sed -E -i '/^hostpci[0-9]+:[[:space:]]*(0000:)?01:00\\.[0-7]([,[:space:]]|$)/d' \\
-  /etc/pve/qemu-server/<vmid>.conf
-
-# Rebuild initramfs and reboot
-update-initramfs -u -k all
-reboot`}
+# Inspect the persistent per-BDF NVIDIA policy
+cat /etc/proxmenux/vfio-bind.bdfs
+cat /etc/udev/rules.d/10-proxmenux-vfio-bind.rules`}
         className="my-4"
       />
 
@@ -366,28 +349,12 @@ reboot`}
         {t.rich("manual.lxcToVm", { strong })}
       </p>
       <CopyableCode
-        code={`# Add the vendor:device to vfio.conf (create the line if missing)
-grep -q '^options vfio-pci ids=' /etc/modprobe.d/vfio.conf && \\
-  sed -i '/^options vfio-pci ids=/ s/$/,10de:2204/' /etc/modprobe.d/vfio.conf || \\
-  echo 'options vfio-pci ids=10de:2204 disable_vga=1' >> /etc/modprobe.d/vfio.conf
+        code={`# Replace this example PCI address with your selected GPU
+lspci -nnk -s 0000:01:00.0
+readlink /sys/bus/pci/devices/0000:01:00.0/iommu_group
 
-# Blacklist the native driver so vfio-pci can claim the card
-cat >> /etc/modprobe.d/blacklist.conf <<'EOF'
-blacklist nouveau
-blacklist nvidia
-blacklist nvidia_drm
-blacklist nvidia_modeset
-blacklist nvidia_uvm
-blacklist nvidiafb
-options nouveau modeset=0
-EOF
-
-# Make sure vfio-pci loads at boot
-grep -q '^vfio-pci$' /etc/modules || echo 'vfio-pci' >> /etc/modules
-
-# Rebuild initramfs and reboot
-update-initramfs -u -k all
-reboot`}
+# List all group members and review them before assignment
+find /sys/kernel/iommu_groups/ -type l | sort -V`}
         className="my-4"
       />
 
@@ -397,17 +364,13 @@ reboot`}
 
       <h2 className="text-2xl font-semibold mt-10 mb-4 text-gray-900">{t("verification.heading")}</h2>
       <CopyableCode
-        code={`# Confirm the GPU is bound to the driver you expect
-lspci -nnk -d <vendor:device>
-# Expected (LXC mode): "Kernel driver in use: nvidia" (or amdgpu, i915)
-# Expected (VM  mode): "Kernel driver in use: vfio-pci"
+        code={`# Inspect the selected PCI address (replace this example)
+lspci -nnk -s 0000:01:00.0
+# LXC mode: the supported native driver should own the card
+# VM mode: vfio-pci should own the card
 
-# LXC mode — is the host tool happy?
-nvidia-smi                 # if NVIDIA
-intel_gpu_top              # if Intel iGPU
-
-# VM mode — ready to be claimed by a VM start
-lsmod | grep vfio`}
+# NVIDIA userspace/module consistency check
+nvidia-smi`}
         className="my-4"
       />
 
@@ -421,9 +384,10 @@ lsmod | grep vfio`}
         {t.rich("troubleshoot.vmFailBody", { code, em })}
       </Callout>
       <CopyableCode
-        code={`# Delete every hostpci line for the GPU slot
-sed -E -i '/^hostpci[0-9]+:[[:space:]]*(0000:)?<slot>\\.[0-7]([,[:space:]]|$)/d' \\
-  /etc/pve/qemu-server/<vmid>.conf`}
+        code={`# Inspect the VM configuration; replace VMID with the numeric ID
+qm config VMID
+# With the VM stopped, remove only the obsolete PCI assignment
+# in the Proxmox Hardware panel, after identifying its hostpci entry`}
         className="my-4"
       />
 
diff --git a/web/app/[locale]/docs/post-install/optional/page.tsx b/web/app/[locale]/docs/post-install/optional/page.tsx
index 258b0b4e..5f1bc657 100644
--- a/web/app/[locale]/docs/post-install/optional/page.tsx
+++ b/web/app/[locale]/docs/post-install/optional/page.tsx
@@ -312,25 +312,31 @@ EOF
       <p className="text-lg mb-2">{t("figurine.automates")}</p>
       <CopyableCode
         code={`
-# Check for previous installation and remove if found
-if command -v figurine &> /dev/null; then
-  rm -f "/usr/local/bin/figurine"
-fi
-
 # Download and install Figurine
-version="2.0.0"
-file="figurine_linux_amd64_v\${version}.tar.gz"
+(
+set -e
+version="\${FIGURINE_VERSION:-2.1.1}"
+arch="$(dpkg --print-architecture 2>/dev/null || uname -m)"
+case "$arch" in
+  amd64|x86_64) arch="amd64" ;;
+  arm64|aarch64) arch="arm64" ;;
+  armhf|armv7l|armv8l) arch="arm" ;;
+  *) echo "Unsupported architecture for Figurine: $arch" >&2; exit 1 ;;
+esac
+file="figurine_linux_\${arch}_v\${version}.tar.gz"
 url="https://github.com/arsham/figurine/releases/download/v\${version}/\${file}"
-wget -qO "/tmp/\${file}" "\${url}"
-tar -xf "/tmp/\${file}" -C "/tmp"
-mv "/tmp/deploy/figurine" "/usr/local/bin/figurine"
-chmod +x "/usr/local/bin/figurine"
+temp_dir="$(mktemp -d)"
+trap 'rm -rf "$temp_dir"' EXIT
+wget -qO "\${temp_dir}/\${file}" "\${url}"
+tar -xf "\${temp_dir}/\${file}" -C "$temp_dir"
+install -m 0755 "\${temp_dir}/deploy/figurine" "/usr/local/bin/figurine"
 
 # Create welcome message script
 cat << 'EOF' > "/etc/profile.d/figurine.sh"
 /usr/local/bin/figurine -f "3d.flf" $(hostname)
 EOF
 chmod +x "/etc/profile.d/figurine.sh"
+)
   `}
       />
 
diff --git a/web/app/[locale]/docs/post-install/page.tsx b/web/app/[locale]/docs/post-install/page.tsx
index e4bc8304..89332b87 100644
--- a/web/app/[locale]/docs/post-install/page.tsx
+++ b/web/app/[locale]/docs/post-install/page.tsx
@@ -89,10 +89,12 @@ export default async function PostInstallPage({
     docs: { postInstall: {
       routes: Route[]
       related: { items: RelatedItem[] }
+      pbs?: { items: string[] }
     } }
   }
   const routes = messages.docs.postInstall.routes
   const relatedItems = messages.docs.postInstall.related.items
+  const pbsItems = messages.docs.postInstall.pbs?.items ?? []
 
   const code = (chunks: React.ReactNode) => <code>{chunks}</code>
   const strong = (chunks: React.ReactNode) => <strong>{chunks}</strong>
@@ -210,6 +212,14 @@ export default async function PostInstallPage({
         {t.rich("community.body", { em, code, a: communityAnchor, link: externalRepoLink })}
       </p>
 
+      <h2 className="text-2xl font-semibold mt-10 mb-4 text-gray-900">{t("pbs.heading")}</h2>
+      <p className="mb-4 text-gray-800 leading-relaxed">{t.rich("pbs.body", { strong })}</p>
+      <ul className="list-disc pl-6 mb-4 text-gray-800 leading-relaxed space-y-2">
+        {pbsItems.map((_, i) => (
+          <li key={i}>{t.rich(`pbs.items.${i}`, { strong, em })}</li>
+        ))}
+      </ul>
+
       <h2 className="text-2xl font-semibold mt-10 mb-4 text-gray-900">{t("related.heading")}</h2>
       <ul className="list-disc pl-6 text-gray-800 leading-relaxed space-y-1">
         {relatedItems.map((item) => (
diff --git a/web/app/[locale]/docs/post-install/storage/page.tsx b/web/app/[locale]/docs/post-install/storage/page.tsx
index 1e763441..61d629d1 100644
--- a/web/app/[locale]/docs/post-install/storage/page.tsx
+++ b/web/app/[locale]/docs/post-install/storage/page.tsx
@@ -282,8 +282,8 @@ done < /usr/local/share/proxmenux/zfs_autotrim_pools`}
 
       <h3 className="text-lg font-semibold mt-6 mb-2 text-gray-900">{t("vzdump.changedTitle")}</h3>
       <CopyableCode
-        code={`bwlimit: 0      # No bandwidth limit (was capped by default)
-ionice:  5      # Lower I/O priority (5 = best-effort class, lowest priority in that class)`}
+        code={`bwlimit: 0      # No bandwidth limit; replaces any configured global cap
+ionice:  5      # Best-effort level 5; higher priority than the default 7 where supported`}
         className="my-4"
       />
 
diff --git a/web/app/[locale]/docs/settings/show-version-information/page.tsx b/web/app/[locale]/docs/settings/show-version-information/page.tsx
index dde89e34..8eb72e43 100644
--- a/web/app/[locale]/docs/settings/show-version-information/page.tsx
+++ b/web/app/[locale]/docs/settings/show-version-information/page.tsx
@@ -85,10 +85,8 @@ export default async function ShowVersionInformationPage({
       </div>
 
       <h2 className="text-2xl font-semibold mt-10 mb-4 text-gray-900">{t("sampleHeading")}</h2>
-      <pre className="rounded-md bg-gray-100 p-4 overflow-x-auto text-xs font-mono text-gray-800 leading-relaxed border border-gray-200">{`Current ProxMenux version: 1.2.4
-
-Installation type:
-✓ Translation Version (Multi-language support)
+      <pre className="rounded-md bg-gray-100 p-4 overflow-x-auto text-xs font-mono text-gray-800 leading-relaxed border border-gray-200">{`Current ProxMenux version: VERSION
+Release channel: Stable (main branch)
 
 Installed components:
 ✓ post_install_settings: installed
@@ -103,28 +101,24 @@ ProxMenux files:
 ✓ utils.sh → /usr/local/share/proxmenux/utils.sh
 ✓ config.json → /usr/local/share/proxmenux/config.json
 ✓ version.txt → /usr/local/share/proxmenux/version.txt
-✓ cache.json → /usr/local/share/proxmenux/cache.json
-
-Virtual Environment:
-✓ Installed → /opt/googletrans-env
-✓ pip: Installed → /opt/googletrans-env/bin/pip
 
 Current language:
-es`}</pre>
+en
+✓ Translation files: /usr/local/share/proxmenux/lang/`}</pre>
 
       <h2 className="text-2xl font-semibold mt-10 mb-4 text-gray-900">{t("manualHeading")}</h2>
       <pre className="rounded-md bg-gray-100 p-4 overflow-x-auto text-xs font-mono text-gray-800 leading-relaxed border border-gray-200">{`# Version
 cat /usr/local/share/proxmenux/version.txt
 
-# Install type detection (replicates the script's logic)
-[[ -d /opt/googletrans-env ]] && echo "venv: yes" || echo "venv: no"
-jq -r '.language // "missing"' /usr/local/share/proxmenux/config.json
+# Release channel metadata and installed translation catalogs
+jq '{beta_program, install_branch}' /usr/local/share/proxmenux/config.json
+ls /usr/local/share/proxmenux/lang/*.json
 
 # All component statuses
 jq 'to_entries[] | "\\(.key): \\(.value)"' /usr/local/share/proxmenux/config.json
 
 # Current language
-jq -r '.language' /usr/local/share/proxmenux/config.json`}</pre>
+jq -r '.language // "en"' /usr/local/share/proxmenux/config.json`}</pre>
 
       <h2 className="text-2xl font-semibold mt-10 mb-4 text-gray-900">{t("troubleshoot.heading")}</h2>
 
diff --git a/web/app/[locale]/docs/utils/upgrade-pve8-pve9/page.tsx b/web/app/[locale]/docs/utils/upgrade-pve8-pve9/page.tsx
index c61e3837..d272b910 100644
--- a/web/app/[locale]/docs/utils/upgrade-pve8-pve9/page.tsx
+++ b/web/app/[locale]/docs/utils/upgrade-pve8-pve9/page.tsx
@@ -110,7 +110,7 @@ export default async function UpgradePve8Pve9Page({
   )
   const cephlink = (chunks: React.ReactNode) => (
     <a
-      href="https://pve.proxmox.com/wiki/Ceph_Squid"
+      href="https://pve.proxmox.com/wiki/Ceph_Reef_to_Squid"
       target="_blank"
       rel="noopener noreferrer"
       className="text-blue-700 hover:underline inline-flex items-center gap-1"
diff --git a/web/app/layout.tsx b/web/app/layout.tsx
index 22dcf74a..05cf6b82 100644
--- a/web/app/layout.tsx
+++ b/web/app/layout.tsx
@@ -8,13 +8,14 @@ const inter = Inter({ subsets: ["latin"] })
  * Minimal root layout — the localized layout under [locale]/ does the
  * real work (provider, navbar, etc.) but cannot own <html>/<body> tags
  * because Next.js requires those at the root level. Lang is set to the
- * default locale here and refined client-side from inside the locale
- * layout so the page still renders correctly with JS disabled (defaults
- * to English) and switches to the active locale once hydrated.
+ * default locale here; scripts/localize-export.mjs sets the exported
+ * document's language before search indexing, and LocaleHtmlSync keeps
+ * it in sync during client navigation. The root-only hydration suppression
+ * allows that intentional lang attribute change in the static export.
  */
 export default function RootLayout({ children }: { children: React.ReactNode }) {
   return (
-    <html lang="en" className="dark">
+    <html lang="en" className="dark" suppressHydrationWarning>
       <body className={`${inter.className} bg-background text-foreground antialiased`}>
         {children}
       </body>
diff --git a/web/components/language-switcher.tsx b/web/components/language-switcher.tsx
index aa084783..cede72da 100644
--- a/web/components/language-switcher.tsx
+++ b/web/components/language-switcher.tsx
@@ -29,7 +29,12 @@ export function LanguageSwitcher() {
   const labels: Record<string, string> = {
     en: t("en"),
     es: t("es"),
+    de: t("de"),
+    fr: t("fr"),
+    it: t("it"),
+    pt: t("pt"),
     sk: t("sk"),
+    sv: t("sv"),
   }
 
   return (
diff --git a/web/i18n/routing.ts b/web/i18n/routing.ts
index 41c0cfdc..ffc11c7f 100644
--- a/web/i18n/routing.ts
+++ b/web/i18n/routing.ts
@@ -19,7 +19,7 @@ import { defineRouting } from "next-intl/routing"
  *   `CONTRIBUTING-TRANSLATIONS.md`.
  */
 export const routing = defineRouting({
-  locales: ["en", "es", "sk"],
+  locales: ["en", "es", "de", "fr", "it", "pt", "sk", "sv"],
   defaultLocale: "en",
   localePrefix: "always",
 })
diff --git a/web/messages/de/common.json b/web/messages/de/common.json
new file mode 100644
index 00000000..c3aefb73
--- /dev/null
+++ b/web/messages/de/common.json
@@ -0,0 +1,254 @@
+{
+  "site": {
+    "name": "ProxMenux",
+    "tagline": "Interaktives Menü und Web-Dashboard für Proxmox VE"
+  },
+  "nav": {
+    "home": "Startseite",
+    "docs": "Dokumentation",
+    "documentation": "Dokumentation",
+    "guides": "Anleitungen",
+    "changelog": "Änderungsprotokoll",
+    "github": "GitHub",
+    "rss": "RSS",
+    "rssTitle": "RSS-Feed",
+    "menuOpen": "Menü öffnen"
+  },
+  "footer": {
+    "sponsorHeading": "Projekt unterstützen",
+    "sponsorBody": "Wenn Sie das Projekt unterstützen möchten.",
+    "sponsorAlt": "Auf Ko-fi unterstützen",
+    "connectHeading": "Community",
+    "connectBody": "Beteiligen Sie sich an den Community-Diskussionen auf GitHub, um Hilfe zu erhalten, Ideen auszutauschen und zum Projekt beizutragen. Jede Idee ist willkommen!",
+    "joinDiscussion": "An der Diskussion teilnehmen",
+    "copyrightPrefix": "ProxMenux, ein gemeinschaftliches Open-Source-Projekt von",
+    "copyrightSuffix": "."
+  },
+  "language": {
+    "switcher": "Sprache",
+    "en": "English",
+    "es": "Español",
+    "sk": "Slovenčina",
+    "de": "Deutsch",
+    "fr": "Français",
+    "it": "Italiano",
+    "pt": "Português",
+    "sv": "Svenska"
+  },
+  "resources": {
+    "documentation": {
+      "title": "Dokumentation",
+      "description": "Systembeschreibung und Benutzeranleitungen"
+    },
+    "changelog": {
+      "title": "Änderungsprotokoll",
+      "description": "Informationen zu den neuesten Aktualisierungen"
+    },
+    "guides": {
+      "title": "Anleitungen",
+      "description": "Schrittweise Anleitungen für häufige Aufgaben"
+    },
+    "github": {
+      "title": "GitHub-Repository",
+      "description": "Sehen Sie sich den Quellcode an."
+    }
+  },
+  "docSidebar": {
+    "documentation": "Dokumentation",
+    "items": {
+      "introduction": "Einführung",
+      "installation": "Installation",
+      "proxmenuxMonitor": "ProxMenux Monitor",
+      "monitorOverview": "Übersicht",
+      "architecture": "Architektur",
+      "accessAuth": "Zugriff und Authentifizierung",
+      "dashboard": "Dashboard",
+      "dashboardSystemOverview": "Registerkarte Systemübersicht",
+      "dashboardApps": "Registerkarte Apps",
+      "dashboardStorage": "Registerkarte Speicher",
+      "dashboardNetwork": "Registerkarte Netzwerk",
+      "dashboardVmsLxcs": "Registerkarte VMs und LXCs",
+      "dashboardVmsLxcsApp": "App",
+      "dashboardVmsLxcsUpdates": "Aktualisierungen",
+      "dashboardHardware": "Registerkarte Hardware",
+      "dashboardSystemLogs": "Registerkarte Systemprotokolle",
+      "dashboardTerminal": "Registerkarte Terminal",
+      "dashboardSecurity": "Registerkarte Sicherheit",
+      "dashboardSettings": "Registerkarte Einstellungen",
+      "healthMonitor": "Zustandsüberwachung",
+      "auditReport": "Prüfung und Berichte",
+      "auditReportOverview": "Übersicht",
+      "auditReportAssessment": "Bewertung und Inventar",
+      "auditReportPolicy": "Richtlinie",
+      "auditReportChanges": "Änderungen",
+      "auditReportReports": "Berichte und Vergleiche",
+      "auditReportScope": "Umfang und Garantien",
+      "notifications": "Benachrichtigungen",
+      "aiAssistant": "KI-Assistent",
+      "apiReference": "API-Referenz",
+      "integrations": "Integrationen",
+      "ociManager": "OCI manager Apps",
+      "ociOverview": "Übersicht",
+      "ociArchitecture": "So wird ein OCI-Image umgesetzt",
+      "ociCustomImage": "Image außerhalb des Katalogs",
+      "ociStorageNetwork": "Daten, Pfade und Netzwerk",
+      "ociHardware": "Geräte und Beschleunigung",
+      "ociStacks": "Anwendungen mit mehreren Containern",
+      "ociLifecycle": "Installieren, aktualisieren und ändern",
+      "ociMonitor": "In ProxMenux Monitor",
+      "proxmenuxScripts": "ProxMenux Scripts",
+      "postInstallScript": "Skript zur Nachinstallation",
+      "postInstallOverview": "Übersicht",
+      "postInstallAutomated": "Automatisch",
+      "postInstallCustomizable": "Anpassbar",
+      "postInstallBasicSettings": "Grundeinstellungen",
+      "postInstallSystem": "System",
+      "postInstallVirtualization": "Virtualisierung",
+      "postInstallNetwork": "Netzwerk",
+      "postInstallStorage": "Speicher",
+      "postInstallSecurity": "Sicherheit",
+      "postInstallCustomization": "Anpassung",
+      "postInstallMonitoring": "Überwachung",
+      "postInstallPerformance": "Leistung",
+      "postInstallOptional": "Optional",
+      "postInstallUpdates": "Verfügbare Aktualisierungen installieren",
+      "postInstallUninstall": "Optimierungen entfernen",
+      "gpusCoralTpu": "GPUs und Coral TPU",
+      "nvidiaHost": "NVIDIA-Treiber auf dem Host installieren",
+      "coralHost": "Coral TPU auf dem Host installieren",
+      "addGpuLxc": "GPU für einen LXC freigeben",
+      "addCoralLxc": "Coral TPU für einen LXC freigeben",
+      "addGpuVm": "GPU einer VM zuweisen (Passthrough)",
+      "switchGpuMode": "GPU-Modus wechseln (VM ↔ LXC)",
+      "createVm": "VM erstellen",
+      "createVmOverview": "Übersicht",
+      "createVmSystemNas": "NAS-Systeme",
+      "createVmSynology": "Synology-VM",
+      "createVmNasOthers": "Weitere NAS-Systeme",
+      "createVmSystemWindows": "Windows-Systeme",
+      "createVmSystemLinux": "Linux-Systeme",
+      "diskManager": "Datenträgerverwaltung",
+      "diskManagerOverview": "Übersicht",
+      "diskImportVm": "Datenträger in eine VM importieren",
+      "diskImportImageVm": "Datenträgerabbild in eine VM importieren",
+      "diskAddController": "Controller oder NVMe-Gerät zu einer VM hinzufügen",
+      "diskImportLxc": "Datenträger in einen LXC importieren",
+      "diskFormat": "Physischen Datenträger formatieren oder löschen",
+      "diskSmart": "SMART-Zustand und Datenträgertests",
+      "storageShareManager": "Speicher und Freigaben verwalten",
+      "storageShareOverview": "Übersicht",
+      "hostStorage": "Speicher in den Host einbinden",
+      "hostNfs": "NFS-Freigabe als Proxmox-Speicher hinzufügen",
+      "hostSamba": "Samba-Freigabe als Proxmox-Speicher hinzufügen",
+      "hostIscsi": "iSCSI-Ziel als Proxmox-Speicher hinzufügen",
+      "hostLocalDisk": "Lokalen Datenträger als Proxmox-Speicher hinzufügen",
+      "hostLocalShared": "Freigegebenes Verzeichnis auf dem Host anlegen",
+      "lxcMountPoints": "LXC-Mountpoints (Host ↔ CT)",
+      "lxcNetworkSharing": "Netzwerkfreigaben in LXC",
+      "lxcNfsClient": "NFS-Client in LXC",
+      "lxcSambaClient": "Samba-Client in LXC",
+      "lxcNfsServer": "NFS-Server in LXC",
+      "lxcSambaServer": "Samba-Server in LXC",
+      "network": "Netzwerk",
+      "networkOverview": "Übersicht",
+      "networkDiagnostics": "Diagnose",
+      "networkMonitoring": "Werkzeuge zur Echtzeitüberwachung",
+      "networkBridge": "Netzwerk-Bridges prüfen und reparieren",
+      "networkConfig": "Konfiguration prüfen und bereinigen",
+      "networkPersistent": "Dauerhafte Schnittstellennamen",
+      "networkBackup": "Schnittstellen sichern und neu starten",
+      "security": "Sicherheit",
+      "securityOverview": "Übersicht",
+      "securityFail2ban": "Fail2Ban",
+      "securityLynis": "Lynis",
+      "utilities": "Dienstprogramme",
+      "utilsOverview": "Übersicht",
+      "utilsUupDump": "ISO-Erstellung mit UUP Dump",
+      "utilsSystemUtils": "Systemwerkzeuge installieren",
+      "utilsSystemUpdate": "Proxmox-System aktualisieren",
+      "utilsUpgradePve": "Von PVE 8 auf PVE 9 aktualisieren",
+      "utilsExportVm": "VM als OVA/OVF exportieren",
+      "utilsImportVm": "VM aus OVA/OVF importieren",
+      "settingsProxmenux": "ProxMenux-Einstellungen",
+      "settingsOverview": "Übersicht",
+      "settingsMonitor": "ProxMenux Monitor",
+      "settingsBeta": "Release-Kanal wechseln",
+      "settingsVersion": "Versionsinformationen anzeigen",
+      "settingsUninstall": "ProxMenux deinstallieren",
+      "commandsReference": "Befehlsreferenz",
+      "commandsOverview": "Übersicht",
+      "commandsSystem": "Nützliche Systembefehle",
+      "commandsVmCt": "VMs und CTs verwalten",
+      "commandsStorage": "Speicher und Datenträger",
+      "commandsNetwork": "Netzwerkbefehle",
+      "commandsUpdates": "Aktualisierungen und Pakete",
+      "commandsGpu": "GPU-Passthrough",
+      "commandsZfs": "ZFS verwalten",
+      "commandsBackup": "Sichern und Wiederherstellen",
+      "commandsTools": "Systemwerkzeuge für die Befehlszeile",
+      "glossary": "Glossar",
+      "about": "Über das Projekt",
+      "aboutOverview": "Übersicht",
+      "aboutFaq": "FAQ",
+      "aboutContributors": "Mitwirkende",
+      "aboutContributing": "Mitwirken",
+      "aboutCodeOfConduct": "Verhaltenskodex",
+      "externalRepositories": "Externe Repositorys",
+      "backupRestore": "Sichern und Wiederherstellen",
+      "backupRestoreOverview": "Übersicht",
+      "backupRestoreHowItWorks": "Funktionsweise",
+      "backupRestoreDestinations": "Ziele",
+      "backupRestoreDestOverview": "Übersicht",
+      "backupRestoreDestLocal": "Lokales Archiv",
+      "backupRestoreDestPbs": "Proxmox Backup Server",
+      "backupRestoreDestBorg": "Borg",
+      "backupRestoreCreating": "Sicherungen erstellen",
+      "backupRestoreJobs": "Geplante Aufträge",
+      "backupRestoreRestoring": "Wiederherstellen",
+      "backupRestoreCrossKernel": "Wiederherstellung mit anderer Kernel-Version",
+      "backupRestoreGlossary": "Glossar"
+    }
+  },
+  "hero": {
+    "title": "ProxMenux",
+    "tagline": "Ein interaktives Menü und Web-Dashboard für Proxmox VE",
+    "description": "ProxMenux verbindet ein interaktives Menü mit einem Web-Dashboard für Proxmox VE. Führen Sie Befehle, Skripte und geführte Assistenten über das Terminalmenü aus oder verfolgen Sie Host-Zustand, Messwerte und Benachrichtigungen im Browser.",
+    "installButton": "Jetzt installieren",
+    "whatIsButton": "Was ist ProxMenux?",
+    "logoAlt": "ProxMenux-Logo"
+  },
+  "docNav": {
+    "previous": "Zurück",
+    "next": "Weiter"
+  },
+  "tocPanel": {
+    "onThisPage": "Auf dieser Seite"
+  },
+  "supportProject": {
+    "heading": "Unterstützen Sie das Projekt!",
+    "body": "Wenn Sie <strong>ProxMenux</strong> hilfreich finden, geben Sie dem Projekt eine ⭐ auf GitHub, damit auch andere darauf aufmerksam werden.",
+    "button": "Stern auf GitHub vergeben"
+  },
+  "rssLink": {
+    "heading": "Bleiben Sie auf dem Laufenden!",
+    "body": "Abonnieren Sie unseren RSS-Feed, um über neue Änderungen informiert zu werden.",
+    "copy": "Kopieren",
+    "copied": "Kopiert!",
+    "copyTitle": "RSS-URL kopieren",
+    "openFeed": "RSS-Feed öffnen",
+    "openTitle": "RSS-Feed öffnen"
+  },
+  "changelog": {
+    "pageTitle": "Änderungsprotokoll",
+    "meta": {
+      "title": "ProxMenux-Änderungsprotokoll",
+      "titleSuffix": "Versionshinweise",
+      "latest": "Aktuell",
+      "mostRecent": "Neueste Version",
+      "description": "Versionshinweise und Aktualisierungsverlauf für ProxMenux, das menügesteuerte Skript zur Verwaltung von Proxmox VE.",
+      "descriptionTail": "Neue Funktionen, Fehlerbehebungen, Sicherheitsupdates, Verbesserungen an ProxMenux Monitor, Kompatibilität mit KI-Anbietern, zusätzliche Absicherung beim GPU-Passthrough und mehr.",
+      "ogDescription": "Versionshinweise für ProxMenux.",
+      "ogTail": "Abonnieren Sie den RSS-Feed oder besuchen Sie diese Seite erneut, um neue Versionen zu finden."
+    }
+  }
+}
diff --git a/web/messages/de/docs/about/code-of-conduct.json b/web/messages/de/docs/about/code-of-conduct.json
new file mode 100644
index 00000000..4e79d0fe
--- /dev/null
+++ b/web/messages/de/docs/about/code-of-conduct.json
@@ -0,0 +1,13 @@
+{
+  "meta": {
+    "title": "Verhaltenskodex | ProxMenux-Dokumentation",
+    "description": "ProxMenux Verhaltenskodex und Best Practices für Mitwirkende, Tester und Nutzer.",
+    "ogTitle": "Verhaltenskodex | ProxMenux-Dokumentation",
+    "ogDescription": "Erwartungen an die Verantwortung für eingereichten Code, die Meldung von Sicherheitslücken und den Umfang von Pull Requests im ProxMenux-Projekt."
+  },
+  "errors": {
+    "notFound": "Fehler: Die Datei CODE_OF_CONDUCT.md wurde nicht gefunden.",
+    "loadFailed": "Fehler: Der Inhalt des Verhaltenskodex kann nicht geladen werden."
+  },
+  "contentMarkdown": "# 📝 Verhaltenskodex und bewährte Vorgehensweisen\n\nDieses Dokument legt die **Grundsätze und Richtlinien** für die Nutzung von **ProxMenux** fest. Es soll **Respekt, Zusammenarbeit und Sicherheit** bei der Entwicklung fördern.\n\n## 📌 1. Urheberangaben und Anerkennung\n\n- Werden **Skripte, Codeausschnitte oder Ideen** anderer Repositorys oder Entwickler verwendet, wird der ursprüngliche Urheber immer genannt.\n- Ein Kommentar im Code oder in der Dokumentation nennt die Quelle und verlinkt möglichst auf das ursprüngliche Repository.\n- Bei Code mit einer bestimmten **Lizenz** müssen deren Bedingungen eingehalten werden.\n\n### ✅ Beispiel für eine korrekte Quellenangabe im Code:\n\n```bash\n# Skript auf Grundlage der Arbeit von [Autor] unter [Repository-Link]\n```\n\n## 🔒 2. Sicherheit und Verantwortung für den Code\n\n- Der gesamte Code in diesem Repository folgt bewährten Vorgehensweisen für sichere Entwicklung.\n- Beiträge mit absichtlich eingebauten Schwachstellen oder unsicheren Vorgehensweisen sind nicht erlaubt.\n- Skripte dürfen niemals die Systemsicherheit oder Benutzerdaten gefährden.\n- Beiträge sollen vor der Implementierung auf Sicherheit und Stabilität geprüft werden.\n\n### ⚠️ Verantwortungsvolle Meldung von Sicherheitslücken\n\nEntdecken Sie eine Sicherheitslücke, melden Sie diese NICHT in öffentlichen Issues oder Foren.\n\nMelden Sie sie stattdessen vertraulich per E-Mail:\n\n📧 proxmenux@macrimi.pro\n\nWeitere Informationen zu Sicherheitslücken und deren Meldung finden Sie in unserer [Sicherheitsrichtlinie](./SECURITY.md).\n\n## 🤝 3. Regeln für die Community\n\nFür ein respektvolles und professionelles Umfeld müssen alle Benutzer diese Regeln beachten:\n\n- ✅ Bleiben Sie in Diskussionen respektvoll und konstruktiv.\n- ❌ Belästigung, Hassrede und beleidigendes Verhalten werden nicht toleriert.\n- ✅ Geben Sie Rückmeldungen sachlich und ohne persönliche Angriffe.\n- ❌ Verstöße können je nach Schwere zu Verwarnungen oder Ausschlüssen führen.\n\n##\n\nDieses Dokument fördert den ethischen Umgang mit Code, Sicherheitsbewusstsein und eine respektvolle Community.\n\n📢 Lassen Sie uns gemeinsam etwas Großartiges schaffen!\n"
+}
diff --git a/web/messages/de/docs/about/contributing.json b/web/messages/de/docs/about/contributing.json
new file mode 100644
index 00000000..7827e51f
--- /dev/null
+++ b/web/messages/de/docs/about/contributing.json
@@ -0,0 +1,293 @@
+{
+  "meta": {
+    "title": "Zu ProxMenux beitragen | ProxMenux-Dokumentation",
+    "description": "Zu ProxMenux beitragen: Branch-Modell (main / develop / feature/*), Pull-Request-Ablauf, Skript-Header mit Autorenangabe und optionalem Sponsoring-Link, zweiphasige UI-Richtlinie, Nachrichtenfunktionen und der Weg vom Feature-Branch zur stabilen Version.",
+    "ogTitle": "Zu ProxMenux beitragen",
+    "ogDescription": "Branch-Modell, Arbeitsablauf, Autorenangabe im Skript-Header und zweiphasige UI-Richtlinie für Mitwirkende."
+  },
+  "header": {
+    "title": "Zu ProxMenux beitragen",
+    "description": "ProxMenux ist offen für Community-Beiträge - neue Skripte, Fixes für bestehende, Dialogverbesserungen, Übersetzungen, Integrationen. Diese Seite ist die formale Tür: wie das Repository strukturiert ist, das Verzweigungsmodell und der Pull-Request-Workflow, der Skript-Header mit Autorzuweisung und optionalem Sponsor-Link und die Design-Konventionen, denen jeder Beitrag folgen muss.",
+    "section": "Über"
+  },
+  "twoPagesCallout": {
+    "title": "Zwei verwandte Seiten, ein Projekt",
+    "body": "Verwechseln Sie diese Seite nicht mit <contributorsLink>Mitwirkende</contributorsLink>, die bisherige Beiträge von Testern, Reviewern und Entwicklern würdigt. Diese Seite richtet sich an <em>Sie</em> als künftigen Mitwirkenden und erklärt, wie Sie einen Pull Request zur Aufnahme vorbereiten."
+  },
+  "branching": {
+    "heading": "Verzweigungsmodell",
+    "intro": "ProxMenux verwendet ein dreistufiges Verzweigungsmodell:",
+    "headerBranch": "Branch",
+    "headerPurpose": "Zweck",
+    "rows": [
+      {
+        "branch": "main",
+        "purposeRich": "Stabiler, produktionsreifer Code. Hier werden nur veröffentlichungsreife Änderungen aufgenommen. Diese Version erhalten Endnutzer bei einer normalen ProxMenux-Installation."
+      },
+      {
+        "branch": "develop",
+        "purposeRich": "Aktiver Entwicklungsbranch. Neue Arbeiten werden zuerst hier aufgenommen; dies ist der Beta-Kanal. Ist eine stabile Version bereit, wird sie von hier nach <code>main</code> übernommen."
+      },
+      {
+        "branch": "feature/*",
+        "purposeRich": "Kurzlebige Branchs pro Feature, Fix oder Verbesserung. Erstellt aus <code>develop</code>, nach Überprüfung über einen Pull Request wieder in <code>develop</code> zusammengeführt."
+      }
+    ],
+    "calloutTitle": "Was das für die Nutzer bedeutet",
+    "calloutBody": "Endbenutzer, die <code>main</code> verfolgen, erhalten getestete Releases. Benutzer, die die neuesten Funktionen frühzeitig wünschen - und gelegentliche raue Kanten nicht stören - können <code>develop</code> folgen. Neue Funktionen passieren immer zuerst <code>develop</code>; nichts erreicht <code>main</code>, ohne diesen Zyklus zu durchlaufen."
+  },
+  "workflow": {
+    "heading": "Pull Request Workflow",
+    "intro": "Von der Idee zum fusionierten Release in fünf Schritten:",
+    "step1Lead": "<strong>Erstellen Sie einen Feature Branch aus <code>develop</code></strong>:",
+    "step1Code": "git clone https://github.com/MacRimi/ProxMenux.git\ncd ProxMenux\ngit checkout develop\ngit pull origin develop\ngit checkout -b feature/your-feature-name",
+    "step1Trail": "Verwenden Sie einen beschreibenden Zweignamen: <code>feature/zfs-arc-tuning</code>, <code>feature/fix-iommu-detection</code>, <code>feature/add-tailscale-script</code>.",
+    "step2Lead": "<strong>Arbeiten Sie an Ihren Änderungen und schieben Sie den Branch: </strong>",
+    "step2Code": "# Make your changes, then:\ngit add scripts/...\ngit commit -m \"Add ZFS ARC tuning script\"\ngit push -u origin feature/your-feature-name",
+    "step3": "<strong>Öffnen Sie einen Pull Request für <code>develop</code></strong>, nicht für <code>main</code>. Prüfen Sie auf GitHub, dass der Basisbranch auf <code>develop</code> steht. Beschreiben Sie, was das Skript tut und ändert und auf welchen Proxmox-VE-Versionen es getestet wurde.",
+    "step4": "<strong>Nach der Prüfung werden Änderungen in <code>develop</code> zusammengeführt.</strong> Ein Maintainer prüft Codequalität, Header-Konventionen und die zweiphasige UI-Richtlinie. Falls Änderungen nötig sind, pushen Sie weitere Commits in denselben Branch; der PR aktualisiert sich automatisch.",
+    "step5": "<strong>Stabile Versionen werden von <code>develop</code> nach <code>main</code> übernommen.</strong> Bei der Veröffentlichung wird <code>main</code> per Fast-Forward auf <code>develop</code> gebracht und mit einem Tag versehen. Ihr Beitrag wird Teil der nächsten stabilen Version."
+  },
+  "scriptHeader": {
+    "heading": "Skript-Header — Metadaten und Beschreibung",
+    "intro": "Jedes Skript in ProxMenux wird mit zwei benachbarten Kommentarblöcken geöffnet, die zusammen den Header bilden. Sie sind <strong>beide erforderlich</strong> - zusammen lassen sie jeden Leser wissen, wer das Skript geschrieben hat und was es tut, alles ohne den Code selbst zu öffnen.",
+    "bullets": [
+      "<strong>Oberer Block: Metadaten.</strong> Autor, optionale GitHub-/Sponsoring-Links, Maintainer, Copyright, Lizenz, Version und Aktualisierungsdatum. Hier erfolgt auch die <em>Würdigung der Mitwirkenden</em>: Bei einem neuen Skript tragen Sie Ihren Namen und optional Links zur persönlichen GitHub-Seite und einem Unterstützungsprofil ein, etwa Ko-fi, GitHub Sponsors oder Buy Me a Coffee.",
+      "<strong>Unterer Block: Beschreibung.</strong> Ein kurzer Absatz in einfachem Englisch erklärt die Funktion. Nutzer lesen ihn <em>vor</em> dem Code. Er muss für sich allein Zweck, Hauptaktionen, betroffene Ressourcen und Voraussetzungen verständlich machen."
+    ],
+    "licenseCalloutTitle": "Die Lizenzlinie ist festgelegt — GPL-3.0",
+    "licenseCalloutBody": "ProxMenux wird unter der <strong>GNU General Public License v3.0</strong> veröffentlicht. Jedes Skript im Projekt wird unter derselben Lizenz ausgeliefert; die <code>License</code>-Zeile im Header ist immer die GPL-3.0-Referenz, die im folgenden Beispiel gezeigt wird - es ist keine Per-Script-Wahl. Indem Sie ein Skript beisteuern, erklären Sie sich damit einverstanden, es unter GPL-3.0 zu veröffentlichen, was bedeutet, dass jeder es lesen, ändern und weiterverteilen kann (einschließlich Änderungen), solange er es unter der gleichen Lizenz behält. Der vollständige Text befindet sich unter <licenseLink>MacRimi/ProxMenux/LICENSE</licenseLink>.",
+    "templateCode": "#!/bin/bash\n\n# ==========================================================\n# ProxMenux - A menu-driven script for Proxmox VE management\n# ==========================================================\n# Author      : Your Name\n# GitHub      : github.com/yourhandle\n# Sponsor     : ko-fi.com/yourhandle\n# Maintainer  : MacRimi\n# Copyright   : (c) 2026 MacRimi & contributors\n# License     : (GPL-3.0) (https://github.com/MacRimi/ProxMenux/blob/main/LICENSE)\n# Version     : 1.0\n# Last Updated: DD/MM/YYYY\n# ==========================================================\n# Description:\n# Short paragraph explaining what the script does.\n# Mention the main actions (e.g. \"creates a ZFS pool\",\n# \"configures IOMMU and reboots\", \"imports an ISO into a VM\"),\n# the resources it touches, and any prerequisites the user\n# should be aware of before running it.\n# ==========================================================",
+    "optionalNote": "Die Linien <code>GitHub</code> und <code>Sponsor</code> sind optional - lassen Sie sie aus, wenn Sie sie nicht veröffentlichen möchten. Alles andere ist erforderlich.",
+    "whyCalloutTitle": "Warum das wichtig ist",
+    "whyCalloutBody": "Open-Source-Beiträge sind freiwillige Arbeit. Name und optionaler Sponsoring-Link im Quellcode machen die Urheberschaft bei jedem Lesen sichtbar, statt sie hinter dem Projektnamen zu verbergen. Der Beschreibungsblock ist aus einem anderen Grund wichtig: Er ist der erste Anlaufpunkt künftiger Maintainer und neugieriger Nutzer. Eine klare Erklärung entscheidet oft darüber, ob sie einem Skript vertrauen oder es meiden."
+  },
+  "structure": {
+    "heading": "Projektstruktur",
+    "intro": "Wo jede Art von Skript im Repository lebt:",
+    "treeCode": "scripts/\n├── menus/              # Top-level menu scripts (entry points)\n├── storage/            # Disk, storage and passthrough scripts\n├── share/              # NFS, Samba, local share scripts\n├── vm/                 # VM creation and configuration scripts\n├── gpu_tpu/            # GPU / TPU passthrough scripts\n├── post_install/       # Post-install automation scripts\n├── backup_restore/     # Backup and restore scripts\n├── utilities/          # System utility scripts\n├── global/             # Shared helper libraries (sourced by other scripts)\n├── utils.sh            # Shared utility functions and message helpers\n└── help_info_menu.sh   # Interactive help and command reference",
+    "outro": "Jedes Skript lädt <code>utils.sh</code> beim Start per source, um Nachrichtenfunktionen, Spinner, Farbvariablen und Übersetzungssystem einzubinden. Gemeinsame Hilfsbibliotheken in <code>scripts/global/</code> werden ausdrücklich von den Skripten geladen, die sie benötigen."
+  },
+  "twoPhase": {
+    "heading": "Die zweiphasige UI Design Policy",
+    "intro": "Dies ist die wichtigste Konvention in ProxMenux und die PRs werden am häufigsten gebeten, sie zu beheben. Jedes Skript ist in <strong> genau zwei Phasen</strong> unterteilt:",
+    "headerPhase": "Phase",
+    "headerPurpose": "Zweck",
+    "headerScreen": "Bildschirmzustand",
+    "rows": [
+      {
+        "phaseRich": "<strong>Phase 1 — Auswahl</strong>",
+        "purposeRich": "Sammeln Sie jede Benutzerentscheidung. Führen Sie alle erforderlichen Vorbereitungsarbeiten durch (Sonden, Scans, Überprüfungen).",
+        "screenRich": "<code>dialog</code>-Overlays. Wenn eine Suche zwischen zwei Menüs länger als ein oder zwei Sekunden dauert, zeigen Sie einen <code>msg_info</code>-Spinner an, damit der Benutzer weiß, dass das Skript nicht eingefroren ist, und rufen Sie dann <code>stop_spinner</code> direkt vor dem nächsten Dialog auf."
+      },
+      {
+        "phaseRich": "<strong>Phase 2 — Ausführung</strong>",
+        "purposeRich": "Führen Sie jede Operation aus. Zeigen Sie den gesamten Fortschrittsverlauf an, der sich auf dem Bildschirm ansammelt.",
+        "screenRich": "Sichtbare <code>msg_info</code> / <code>msg_ok</code> Nachrichten; niemals <code>dialog</code>."
+      }
+    ],
+    "principle": "Das Prinzip: <strong>Sammeln Sie zuerst alles und führen Sie dann alles</strong> aus. Der Benutzer sieht ein sauberes dialoggesteuertes Menü (Phase 1), dann eine saubere Ausführungsansicht im Protokollstil (Phase 2). Kein Mischen — kein Dialog erscheint mitten in der Ausführung, kein Fortschrittsrauschen während der Auswahl.",
+    "phase1Heading": "Phase 1 — typisches Muster",
+    "phase1Code": "# Silent preparatory work between dialogs\nmsg_info \"$(translate \"Checking disk assignments...\")\"\nASSIGNED_TO=$(check_assignments \"$DISK\")\nstop_spinner   # ← clears line silently, result saved in variable\n\n# Next dialog can now use ASSIGNED_TO\nif [ -n \"$ASSIGNED_TO\" ]; then\n    dialog --yesno \"$(translate \"Disk already assigned. Continue?\")\" $UI_YESNO_H $UI_YESNO_W\nfi\n\n# Collect multiple decisions per item with parallel arrays\ndeclare -a DISK_LIST=()\ndeclare -a DISK_FORMAT_TYPES=()\ndeclare -a DISK_MOUNT_POINTS=()\nfor DISK in $SELECTED; do\n    msg_info \"$(translate \"Analyzing disk...\")\"\n    CURRENT_FS=$(lsblk -no FSTYPE \"$DISK\" | xargs)\n    stop_spinner\n\n    FORMAT=$(dialog --backtitle \"$BACKTITLE\" \\\n        --title \"$(translate \"Select Filesystem\")\" \\\n        --menu \"...\" $UI_SHORT_MENU_H $UI_SHORT_MENU_W $UI_SHORT_MENU_LIST_H \\\n        \"ext4\" \"...\" \"xfs\" \"...\" \"btrfs\" \"...\" \\\n        2>&1 >/dev/tty)\n    [ -z \"$FORMAT\" ] && continue\n\n    DISK_LIST+=(\"$DISK\")\n    DISK_FORMAT_TYPES+=(\"$FORMAT\")\ndone",
+    "phase1RulesIntro": "<strong>Regeln für Phase 1:</strong>",
+    "phase1Rules": [
+      "Läuft gerade ein <code>msg_info</code>-Spinner und soll ein Menü mit <code>dialog</code> oder <code>whiptail</code> geöffnet werden, rufen Sie zuerst <code>stop_spinner</code> auf. Der Spinner verträgt sich nicht mit deren Bildschirmüberlagerung. Ohne aktiven Spinner ist der Aufruf nicht nötig.",
+      "Verwenden Sie <code>show_proxmenux_logo</code> + <code>msg_title</code> + <code>msg_info</code>, um in Phase 1 einen längeren Vorgang sichtbar einzuordnen, etwa eine Prüfung ab fünf Sekunden. Die Funktion leert bereits den Bildschirm; rufen Sie davor nicht <code>clear</code> auf.",
+      "Rufen Sie <code>show_proxmenux_logo</code> nicht zwischen Dialogmenüs auf, in denen nichts angezeigt werden kann - das Löschen des Bildschirms für ein leeres Terminal ist nur visuelles Rauschen.",
+      "Speichern Sie alle Entscheidungen und Sondenergebnisse in Variablen oder parallelen Arrays. Die sichtbare Zusammenfassung erfolgt zu Beginn der Phase 2, nicht in Phase 1."
+    ],
+    "phase2Heading": "Phase 2 — typisches Muster",
+    "phase2Code": "# ── PHASE 2 — EXECUTION ─────────────────────────────\nshow_proxmenux_logo\nmsg_title \"$(translate \"My Script Title\")\"\n\n# Recap Phase 1 preparatory results — show what was already done\nmsg_ok \"$(translate \"CT $CTID selected.\")\"\nmsg_ok \"$(translate \"Repositories verified.\")\"\nmsg_ok \"$(translate \"Disks to process: ${#DISK_LIST[@]}\")\"\n\n# Now execute operations\nfor i in \"${!DISK_LIST[@]}\"; do\n    DISK=\"${DISK_LIST[$i]}\"\n    FORMAT=\"${DISK_FORMAT_TYPES[$i]}\"\n\n    msg_info \"$(translate \"Formatting\") $DISK $(translate \"as\") $FORMAT...\"\n    mkfs.\"$FORMAT\" \"$DISK\" >/dev/null 2>&1\n    msg_ok \"$(translate \"Formatted.\")\"\ndone\n\nmsg_ok \"$(translate \"Completed. ${#DISK_LIST[@]} disk(s) processed.\")\"\nmsg_success \"$(translate \"Press Enter to return to menu...\")\"\nread -r",
+    "phase2Rules": "<strong>Regeln für Phase 2:</strong> Beginnen Sie mit <code>show_proxmenux_logo + msg_title</code> und fassen Sie Phase 1 sofort in <code>msg_ok</code>-Zeilen zusammen. Rufen Sie <code>show_proxmenux_logo</code> nicht erneut auf, da dies den bisherigen Verlauf löscht. Verwenden Sie kein <code>dialog</code>; ist eine Entscheidung zur Laufzeit unvermeidbar, nutzen Sie <code>whiptail</code> wie im nächsten Abschnitt."
+  },
+  "dialogVsWhiptail": {
+    "headingRich": "Wann <code>dialog</code> vs <code>whiptail</code> zu verwenden",
+    "intro": "Beide Tools zeichnen Benutzeroberflächen im Textmodus, aber sie verhalten sich auf dem Bildschirm sehr unterschiedlich - und ProxMenux verwendet sie aus einem bestimmten Grund in zwei verschiedenen Phasen.",
+    "headerTool": "Werkzeug",
+    "headerWhen": "Wann man es benutzt",
+    "headerEffect": "Wirkung auf den Bildschirm",
+    "rows": [
+      {
+        "toolRich": "<strong><code>dialog</code></strong>",
+        "whenRich": "<strong>Immer in Phase 1.</strong> Jede interaktive Auswahl – Auswahl einer VM, einer Festplatte, eines Dateisystems, das eine Aktion bestätigt – verwendet <code>dialog</code>. Dies ist das Standard-UI-Tool von ProxMenux.",
+        "effectRich": "Übernimmt das Terminal: löscht den Bildschirm, zieht sein Overlay und bringt das Terminal beim Schließen in seinen vorherigen Zustand zurück. Fein in Phase 1, weil sich noch nichts Nützliches zeigt."
+      },
+      {
+        "toolRich": "<strong><code>whiptail</code></strong>",
+        "whenRich": "<strong>Nur in Phase 2, nur wenn unvermeidlich.</strong> Der typische Fall ist eine Neustartaufforderung am Ende der Ausführung. Greifen Sie nicht zu <code>whiptail</code>, um \"Weiter?\" mitten in der Ausführung zu fragen - diese Entscheidung hätte in Phase 1 getroffen werden sollen.",
+        "effectRich": "Leichteres Overlay, das den Terminalkontext <em>nicht</em> löscht. Der akkumulierte <code>msg_ok</code> / <code>msg_info</code>-Verlauf der Phase 2 bleibt hinter dem Dialogfeld sichtbar. Deshalb ist es die richtige Wahl, wenn der Fortschritt bereits auf dem Bildschirm zu sehen ist."
+      }
+    ],
+    "calloutTitle": "Warum die Trennung wichtig ist",
+    "calloutBody": "Wenn Sie <code>dialog</code> in der Mitte der Phase 2 anrufen, verschwindet jede <code>msg_ok</code>-Zeile, die der Benutzer beobachtet hat. Sie wischen den Audit-Trail. <code>whiptail</code> vermeidet das. Die Regel ist also nicht willkürlich - es geht darum, die Sicht des Benutzers auf das, was das Skript bisher getan hat, zu bewahren.",
+    "rebootHeading": "Neustartabfrage: das typische whiptail in Phase 2",
+    "rebootIntro": "Wenn ein Skript endet und ein Neustart erforderlich ist (z.B.) IOMMU aktiviert, Kernelparameter geändert), die Aufforderung am Ende der Phase 2 verwendet <code>whiptail</code>. Fügen Sie immer einen \"Nein\"-Zweig hinzu, der den Benutzer warnt, die betroffene Ressource nicht zu verwenden, bis er neu startet:",
+    "rebootCode": "if [[ \"$HOST_REBOOT_REQUIRED\" == \"yes\" ]]; then\n  echo \"\"\n  if whiptail --title \"$(translate \"Reboot Required\")\" --yesno \\\n    \"\\n$(translate \"A host reboot is required before starting the VM. Reboot now?\")\" \\\n    13 78; then\n      msg_warn \"$(translate \"Rebooting the system...\")\"\n      reboot\n  else\n      echo \"\"\n      msg_info2 \"$(translate \"Do not start the VM until the system has been rebooted.\")\"\n  fi\nfi\n\nmsg_success \"$(translate \"Press Enter to return to menu...\")\"\nread -r"
+  },
+  "messageFunctions": {
+    "heading": "Referenz der Nachrichtenfunktionen",
+    "intro": "Alle definiert in <code>utils.sh</code>. Verwenden Sie sie als Standard für jede benutzersichtliche Ausgabe - konsistente Visuals über Skripte hinweg ist der springende Punkt. Wenn Ihr Skript eine neue Funktion benötigt, die nicht zum vorhandenen Set passt (ein neuer Schweregrad, ein neuer Layout-Helfer usw.), schlagen Sie es in Ihrem Pull Request vor - es wird überprüft und zu <code>utils.sh</code> hinzugefügt, wenn es allgemein nützlich ist.",
+    "headerFunction": "Funktion",
+    "headerWhen": "Wann zu verwenden",
+    "headerSpinner": "Fortschrittsanzeige",
+    "rows": [
+      {
+        "function": "msg_info \"text\"",
+        "whenRich": "Operation in Arbeit.",
+        "spinner": "Startet"
+      },
+      {
+        "function": "stop_spinner",
+        "whenRich": "Ende der stillen Vorbereitungsarbeiten in Phase 1 — tötet Spinner, löscht die Linie.",
+        "spinner": "Stoppt"
+      },
+      {
+        "function": "msg_ok \"text\"",
+        "whenRich": "Vorgang erfolgreich. Auch für „Funktion aktiviert“ verwenden, wenn noch ein Neustart erforderlich ist.",
+        "spinner": "Stoppt"
+      },
+      {
+        "function": "msg_warn \"text\"",
+        "whenRich": "Tatsächliche Warnung oder gestörter Zustand.",
+        "spinner": "Stoppt"
+      },
+      {
+        "function": "msg_error \"text\"",
+        "whenRich": "Schwerwiegender Fehler.",
+        "spinner": "Stoppt"
+      },
+      {
+        "function": "msg_info2 \"text\"",
+        "whenRich": "Nicht blockierender Hinweis (türkisfarbene Infozeile).",
+        "spinner": "Stoppt"
+      },
+      {
+        "function": "msg_success \"text\"",
+        "whenRich": "Abschließende Aufforderung „Enter zum Zurückkehren“ am Ende von Phase 2.",
+        "spinner": "Stoppt"
+      },
+      {
+        "function": "msg_title \"text\"",
+        "whenRich": "Fetter Titel mit eingebautem Abstand. Wird zu Beginn der Phase 2 verwendet.",
+        "spinner": "—"
+      },
+      {
+        "function": "show_proxmenux_logo",
+        "whenRich": "Leert den Bildschirm und zeigt das Logo. Zu Beginn von Phase 2 <em>einmal</em> aufrufen.",
+        "spinner": "—"
+      }
+    ]
+  },
+  "dialogConventions": {
+    "heading": "Dialogkonventionen",
+    "bullets": [
+      "Geben Sie <code>--backtitle \"$BACKTITLE\"</code> immer an jeden <code>dialog</code>- und <code>whiptail</code>-Aufruf weiter. <code>$BACKTITLE</code> ist immer <code>\"ProxMenux\"</code> - einmal im Skript-Header gesetzt und nie außer Kraft gesetzt. Der Benutzer muss den Projektnamen immer als Framing-Kontext sehen, niemals den eigenen Titel des Skripts.",
+      "Verpacken Sie Titel und Nachrichten immer mit <code>$(translate \"...\")</code>.",
+      "Immer <code>dialog</code> Ausgabe mit <code>2&gt;&amp;1 &gt;/dev/tty</code> umleiten — die erfasste stdout wird die Auswahl des Benutzers, während der Dialog selbst auf das Terminal zieht.",
+      "Verwenden Sie die Standard-UI-Dimensionsvariablen (<code>$UI_MENU_H</code>, <code>$UI_MSG_W</code>, usw.) für eine konsistente Dimensionierung über Skripte hinweg.",
+      "Prüfen Sie immer auf leere oder abgebrochene Auswahlen und behandeln Sie diese sauber."
+    ],
+    "exampleIntro": "Vollständiges Beispiel — Erstellung eines VM-Auswahlmenüs und Bearbeitung der Stornierung:",
+    "exampleCode": "# 1) Build the list of VMs as alternating \"ID  NAME\" pairs.\n#    dialog --menu expects this exact shape: tag1 description1 tag2 description2 ...\nVM_LIST=\"\"\nfor vmid in $(qm list | awk 'NR>1 {print $1}'); do\n    vm_name=$(qm config \"$vmid\" | awk -F': ' '/^name:/ {print $2}')\n    VM_LIST=\"$VM_LIST $vmid \\\"$vm_name\\\"\"\ndone\n\n# 2) Show the dialog. Captured stdout is the user's selection (the VMID).\nVMID=$(eval \"dialog --backtitle \\\"\\$BACKTITLE\\\" \\\n    --title \\\"\\$(translate \\\"Select VM\\\")\\\" \\\n    --menu \\\"\\$(translate \\\"Choose a VM from the list:\\\")\\\" \\\n    \\$UI_MENU_H \\$UI_MENU_W \\$UI_MENU_LIST_H \\\n    $VM_LIST \\\n    2>&1 >/dev/tty\")\n\n# 3) Empty result means the user pressed Cancel or Esc — exit silently.\nif [ -z \"$VMID\" ]; then\n    exit 0\nfi\n\n# 4) Continue with the rest of Phase 1, knowing VMID is now set.\necho \"User selected VMID=$VMID\""
+  },
+  "translation": {
+    "heading": "Übersetzungspolitik",
+    "intro": "Alle vom Benutzer sichtbaren Zeichenfolgen müssen mit der <code>translate</code>-Funktion gewickelt sein. ProxMenux übersetzt sie automatisch in alle unterstützten Sprachen - Sie schreiben Englisch, der Benutzer liest seine Muttersprache.",
+    "code": "msg_ok \"$(translate \"Operation completed successfully.\")\"\nmsg_error \"$(translate \"Failed to start container\") $CTID.\"\ndialog --title \"$(translate \"Select Storage\")\" ...",
+    "bullets": [
+      "Schreibe Strings in Englisch – die Übersetzung wird automatisch vom Build bearbeitet.",
+      "Halten Sie Strings kurz. Vermeiden Sie das Einbetten von Variablen in lange Sätze, wenn möglich.",
+      "Variablennamen, Pfade oder technische Bezeichner <strong>nicht</strong>übersetzen."
+    ]
+  },
+  "variableStyle": {
+    "heading": "Variable und Stilkonventionen",
+    "bullets": [
+      "Verwenden Sie <code>UPPER_CASE</code> für Variablen auf Skriptebene.",
+      "Verwenden Sie <code>lower_case</code> für lokale Funktionsvariablen (mit <code>local</code> deklarieren).",
+      "Setzen Sie alle Variablenexpansionen in Anführungszeichen: <code>\"$VAR\"</code> statt <code>$VAR</code>.",
+      "Verwenden Sie <code>[[ ]]</code> für Konditionale, nicht <code>[ ]</code> (außer wenn POSIX erforderlich ist).",
+      "<code>show_proxmenux_logo</code> ist der geeignete Weg, um den Bildschirm zu löschen - er enthält das Clear und zeigt das Projektlogo, so dass der Benutzer immer einen visuellen Kontext hat. Rufen Sie es einmal zu Beginn der Phase 2 (und optional vor einem langen Phase 1-Spinnerblock) auf."
+    ],
+    "standardNamesIntro": "Standardvariablennamen im gesamten Projekt:",
+    "standardNamesCode": "CTID         # container ID\nVMID         # virtual machine ID\nDISK         # device path (e.g. /dev/sdb)\nPARTITION    # partition path (e.g. /dev/sdb1)\nSTORAGE      # Proxmox storage name\nMOUNT_POINT  # filesystem mount path",
+    "redirectHeading": "Umleitung der Werkzeugausgabe während der Phase 2",
+    "redirectIntro": "Phase 2 zeigt ein sauberes Protokoll der <code>msg_info → msg_ok</code>-Zeilen an, die sich auf dem Bildschirm ansammeln. Wenn ein Tool, das Sie aufrufen (apt, mkfs, qm, pct, dd, etc.), seine eigene Ausgabe in stdout/stderr schreibt, scrollt es an Ihren Nachrichten vorbei und unterbricht den visuellen Fluss - Sie haben ein chaotisches Terminal, in dem der Benutzer die eigenen Fortschrittslinien des Skripts nicht vom Rauschen des zugrunde liegenden Tools unterscheiden kann.",
+    "withoutRedirectIntro": "<strong>Ohne Umleitung</strong>: die Ausgabe für Nutzer, wenn zusätzliche Werkzeugausgaben nicht abgefangen werden.",
+    "withoutRedirectCode": "ℹ Installing kernel package...\nReading package lists... Done\nBuilding dependency tree... Done\nReading state information... Done\nThe following NEW packages will be installed:\n  proxmox-kernel-6.5\n0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded.\nNeed to get 12.5 MB of archives.\nAfter this operation, 47.2 MB of additional disk space will be used.\nGet:1 http://download.proxmox.com/debian/pve trixie/pve-no-subscription amd64 ...\n... [200+ more lines of dpkg output] ...\n✓ Kernel installed.",
+    "withRedirectIntro": "<strong>Mit Umleitung</strong>: dieselbe Aktion, wenn zusätzliche Ausgaben an anderer Stelle landen.",
+    "withRedirectCode": "ℹ Installing kernel package...\n✓ Kernel installed.\nℹ Configuring kernel command line...\n✓ Configured.\nℹ Refreshing boot loader...\n✓ Boot loader updated.",
+    "twoPatternsIntro": "Zwei Muster zur Auswahl:",
+    "discardLead": "<strong>Ausgabe verwerfen</strong>, wenn sie nicht benötigt wird: die einfachste und schnellste Variante.",
+    "discardCode": "DEBIAN_FRONTEND=noninteractive apt-get install -y \"$package\" >/dev/null 2>&1",
+    "logLead": "<strong>Ausgabe in eine Protokolldatei schreiben</strong>, wenn Sie sie später prüfen möchten, etwa zur Fehlersuche bei einer Installation oder um dpkg-Aktionen nachzuvollziehen. Dies ist das bevorzugte Muster für apt-Aufrufe:",
+    "logCode": "apt-get install -y \"$package\" >> \"$log_file\" 2>&1",
+    "referenceOutro": "<code>scripts/global/update-pve9_2.sh</code> dient als Referenz: Jeder <code>apt-get</code>-Aufruf schreibt in eine Protokolldatei. Nutzer sehen nur den Ablauf <code>msg_info → msg_ok</code>, während die Datei bei Fehlern genau zeigt, was apt getan hat."
+  },
+  "dosAndDonts": {
+    "heading": "Do's und Don'ts",
+    "doHeading": "✅ Empfohlen",
+    "doBullets": [
+      "<code>stop_spinner</code> vor einem <code>dialog</code> in Phase 1 nur dann, wenn ein <code>msg_info</code> Spinner gerade läuft.",
+      "Phase 2 beginnt mit <code>show_proxmenux_logo + msg_title + msg_ok</code> als Zusammenfassung der Ergebnisse von Phase 1.",
+      "Verwenden Sie <code>msg_ok</code> für erfolgreich aktivierte Funktionen – auch wenn ein Neustart erforderlich ist.",
+      "Verwenden Sie <code>whiptail</code> (nicht <code>dialog</code>) für jede Aufforderung nach der Ausführung, die in Phase 2 erscheinen muss.",
+      "Fügen Sie immer einen \"Nein\" -Zweig in Reboot-Dialoge ein, der den Benutzer warnt, die betroffene Ressource bis zum Neustart nicht zu starten.",
+      "Schützen Sie die reine VM-Logik, indem Sie <code>[[ -f \"/etc/pve/qemu-server/$'{'vmid'}'.conf\" ]]</code> überprüfen - Controller und NVMe PCIe können nicht zu LXC-Containern hinzugefügt werden.",
+      "Verwenden Sie <code>ensure_repositories</code> von <code>utils-install-functions.sh</code> anstelle von bedingungslosem <code>apt-get update</code>.",
+      "Verwenden Sie parallele Arrays in Phase 1, wenn jedes Element mehrere Dialoge benötigt."
+    ],
+    "dontHeading": "❌ Vermeiden",
+    "dontBullets": [
+      "Rufen Sie <code>dialog</code> an, während ein Spinner aktiv ist.",
+      "Überspringen Sie die Phase 1 Zusammenfassung zu Beginn der Phase 2.",
+      "Rufen Sie <code>show_proxmenux_logo</code> ein zweites Mal an - es löscht alles, was Phase 2 gedruckt hat.",
+      "Verwenden Sie <code>dialog</code> in Phase 2 (verwenden Sie <code>whiptail</code> für den seltenen unvermeidlichen Fall).",
+      "Verwenden Sie reine <code>clear</code>.",
+      "<code>msg_title</code> mit Leerzeilen aus <code>echo \"\"</code> umgeben; die Abstände sind bereits enthalten.",
+      "Verwenden Sie <code>msg_warn</code>, um eine erfolgreich aktivierte Funktion zu melden - das ist ein <code>msg_ok</code>.",
+      "Führen Sie bedingungslos <code>apt-get update</code> aus - verwenden Sie <code>ensure_repositories</code>."
+    ]
+  },
+  "submitting": {
+    "heading": "Einreichen Ihres Beitrags",
+    "steps": [
+      "Fork <code>MacRimi/ProxMenux</code> auf GitHub und klonen Sie Ihre Fork.",
+      "Erstellen Sie einen <code>feature/*</code>-Zweig aus <code>develop</code> (siehe <em>Branching-Modell</em> oben).",
+      "Befolgen Sie diese Anleitung für neue oder geänderte Skripte. Schreiben Sie den Header mit Ihrem Namen; fügen Sie die optionale Sponsorenzeile hinzu, wenn Sie möchten.",
+      "Testen Sie Ihr Skript auf einer echten Proxmox VE-Instanz - sowohl Phase 1 (jeder Dialogzweig) als auch Phase 2 (jede Operation ist erfolgreich und wird bei Fehlern sauber zurückgesetzt).",
+      "Öffnen Sie eine Pull Request <strong> gegen <code>develop</code></strong> mit einer klaren Beschreibung: was das Skript macht, was sich geändert hat, auf welcher Proxmox VE-Version es getestet wurde.",
+      "Stellen Sie sicher, dass Ihr Beitrag den <cocLink>Code of Conduct</cocLink> respektiert."
+    ],
+    "securityOutro": "Befolgen Sie bei sicherheitsrelevanten Problemen den Offenlegungsfluss in <securityLink>SECURITY.md</securityLink>, anstatt ein öffentliches Problem zu öffnen."
+  },
+  "whereNext": {
+    "heading": "Wohin als nächstes",
+    "items": [
+      {
+        "kind": "external",
+        "url": "https://github.com/MacRimi/ProxMenux/blob/main/CONTRIBUTING.md",
+        "label": "CONTRIBUTING.md (vollständige Anleitung)",
+        "tail": "— die Quelle der Wahrheit für jede Konvention, einschließlich der fortgeschrittenen Hardware-Muster."
+      },
+      {
+        "kind": "internal",
+        "href": "/docs/about/contributors",
+        "label": "Beitragende",
+        "tail": " — die Menschen, deren Arbeit ProxMenux-Versionen geprägt hat. Eine andere Seite als diese hier."
+      },
+      {
+        "kind": "internal",
+        "href": "/docs/about/code-of-conduct",
+        "label": "Verhaltenskodex",
+        "tail": "- die Standards, die jeder Mitwirkende zu befolgen bereit ist."
+      },
+      {
+        "kind": "external",
+        "url": "https://github.com/MacRimi/ProxMenux/discussions",
+        "label": "GitHub Discussions",
+        "tail": "Fragen Sie, bevor Sie bauen, ob Sie nicht sicher sind, ob eine Idee passt, oder um Mitarbeiter für ein größeres Feature zu finden."
+      }
+    ]
+  }
+}
diff --git a/web/messages/de/docs/about/contributors.json b/web/messages/de/docs/about/contributors.json
new file mode 100644
index 00000000..40718e21
--- /dev/null
+++ b/web/messages/de/docs/about/contributors.json
@@ -0,0 +1,38 @@
+{
+  "meta": {
+    "title": "Mitwirkende | ProxMenux-Dokumentation",
+    "description": "Anerkennung für die Menschen, die ProxMenux möglich machen: Tester, Reviewer und Entwickler, die jede Version mitgestalten.",
+    "ogTitle": "Mitwirkende | ProxMenux-Dokumentation",
+    "ogDescription": "Treffen Sie die Mitwirkenden hinter ProxMenux."
+  },
+  "header": {
+    "title": "Mitwirkende",
+    "description": "Das ProxMenux-Projekt wächst dank seiner Mitwirkenden. Diese Seite würdigt ihre Arbeit: Versionen vor der Veröffentlichung testen, Regressionen erkennen, PRs prüfen und die Entwicklung neuer Funktionen mitgestalten.",
+    "section": "Über"
+  },
+  "beyond": {
+    "title": "Weitere Mitwirkende",
+    "body": "Viele weitere Menschen helfen mit Fehlermeldungen, Funktionsideen in Discussions, Beta-Tests und Übersetzungen. Die vollständige Liste der Code-Mitwirkenden steht im <extlink>GitHub-Mitwirkendendiagramm</extlink>. Diese Seite hebt diejenigen hervor, die besonders aktiv ProxMenux-Versionen testen und prüfen."
+  },
+  "testers": {
+    "heading": "Tester & Reviewer",
+    "intro": "Diese Personen gehörten zu den ersten Mitwirkenden. Mit Tests, Fehlermeldungen und Verbesserungsvorschlägen halfen sie ProxMenux dabei, zu dem zu werden, was es heute ist.",
+    "roles": {
+      "testing": "Testen",
+      "testingReviewer": "Tests und Review"
+    },
+    "youtube": "YouTube"
+  },
+  "contribute": {
+    "heading": "Möchten Sie dazu beitragen?",
+    "intro": "Jeder Beitrag ist willkommen - Code, Testen, Design, Dokumentation oder einfach nur das Teilen Ihrer Ideen:",
+    "tester": "<strong>Tester</strong> — probieren Sie den <beta>Beta-Kanal</beta> aus und melden Sie vor der stabilen Veröffentlichung, was funktioniert und was nicht.",
+    "developer": "<strong>Entwickler</strong> — Bash, Next.js (TypeScript) und etwas Python für die virtuelle Übersetzungsumgebung (venv). PRs auf <gh>GitHub</gh> sind willkommen.",
+    "designer": "<strong>Designer</strong> — Verbesserungen der Benutzeroberfläche, Icons, Screenshots zur Dokumentation.",
+    "ideas": "<strong>Ideen</strong> — eröffnen Sie zuerst ein Thema in <disc>GitHub Discussions</disc>, bevor Sie einen Funktionswunsch als Issue einreichen."
+  },
+  "coc": {
+    "title": "Lesen Sie zuerst den Verhaltenskodex",
+    "body": "Lesen Sie vor dem Einreichen von Code oder Fehlermeldungen kurz den <coclink>Verhaltenskodex und die bewährten Vorgehensweisen</coclink>. Darin werden die Verantwortung für Code, die Meldung von Sicherheitslücken und der Umfang von PRs erläutert."
+  }
+}
diff --git a/web/messages/de/docs/about/faq.json b/web/messages/de/docs/about/faq.json
new file mode 100644
index 00000000..737e140c
--- /dev/null
+++ b/web/messages/de/docs/about/faq.json
@@ -0,0 +1,94 @@
+{
+  "meta": {
+    "title": "Häufige Fragen | ProxMenux-Dokumentation",
+    "description": "Häufige Fragen zu ProxMenux: Funktionsumfang, Installation, Kompatibilität ab PVE 8, Anpassung, Updates, Sicherheit, Produktionseinsatz, Systemdateien, Beiträge und Deinstallation.",
+    "ogTitle": "Häufige Fragen | ProxMenux-Dokumentation",
+    "ogDescription": "Häufige Fragen zu Installation, Kompatibilität, Sicherheit und Beiträgen zu ProxMenux."
+  },
+  "header": {
+    "title": "Häufig gestellte Fragen",
+    "description": "Häufige Fragen zu ProxMenux: Funktionsumfang, Zielgruppe, Installation, Updates, Deinstallation, Kompatibilität, Anpassung, Sicherheit und Beiträge. Fehlt Ihre Frage, sehen Sie in GitHub Discussions nach oder erstellen Sie ein Issue.",
+    "section": "Über"
+  },
+  "quickLinks": {
+    "title": "Schnelle Links",
+    "installationLabel": "Installation",
+    "installationSuffix": "— der One-Line-Installationsbefehl + Abhängigkeiten.",
+    "introductionLabel": "Einleitung",
+    "introductionSuffix": "— was ProxMenux tut, in 5 Minuten.",
+    "uninstallLabel": "Deinstallieren",
+    "uninstallSuffix": "— sauberes Entfernen.",
+    "issuesLabel": "GitHub Issues",
+    "discussionsLabel": "Diskussionen"
+  },
+  "q1": {
+    "question": "Was ist ProxMenux und wofür wird es verwendet?",
+    "p1Rich": "<strong>ProxMenux</strong> ist ein interaktives menügesteuertes Tool, das <strong>Proxmox VE</strong> für alle Benutzer unabhängig von ihrer technischen Erfahrung zugänglich macht. Es vereinfacht die Befehlsausführung und ermöglicht es Benutzern, Aktionen auf ihrem System durchzuführen, ohne dass fortgeschrittene Linux-Kenntnisse erforderlich sind.",
+    "p2": "Weniger erfahrene Benutzer können Befehle über übersichtliche Menüs ausführen und müssen seltener selbst im Terminal tippen. Erfahrenen Administratoren erspart ProxMenux Eingaben bei wiederkehrenden Aufgaben wie der Absicherung nach der Installation, GPU-Passthrough, OVF-VM-Importen und der Rotation von ZFS-Snapshots.",
+    "p3": "Proxmox VE ist weit verbreitet für:",
+    "items": [
+      "Virtualisierung auf Unternehmensebene",
+      "HomeLab und persönliche Cloud-Lösungen",
+      "Multimedia-Server, Automatisierung und mehr"
+    ]
+  },
+  "q2": {
+    "question": "Wie installiere ich ProxMenux?",
+    "p1Rich": "Folgen Sie der <installlink>Installationsanleitung</installlink>. Kurz zusammengefasst:",
+    "stableInstall": "bash -c \"$(wget -qLO - https://raw.githubusercontent.com/MacRimi/ProxMenux/main/install_proxmenux.sh)\"",
+    "p2": "Einmal installiert, starten Sie es einfach mit:",
+    "menuCmd": "menu"
+  },
+  "q3": {
+    "question": "Ist ProxMenux mit allen Proxmox-Versionen kompatibel?",
+    "bodyRich": "<strong>Nein — ProxMenux benötigt Proxmox VE 8 oder neuer.</strong> PVE 7 und ältere Versionen werden nicht unterstützt. Aktualisieren Sie PVE 7 zunächst nach der offiziellen Proxmox-Anleitung auf 8.x. Den anschließenden Wechsel von 8 auf 9 können Sie über <upgradelink>Werkzeuge → PVE 8 auf PVE 9 aktualisieren</upgradelink> in ProxMenux durchführen."
+  },
+  "q4": {
+    "question": "Kann ich ProxMenux anpassen?",
+    "p1Rich": "Lokale Änderungen an den Hauptskripten können beim Aktualisieren überschrieben werden. Bearbeiten Sie diese Dateien daher möglichst nicht direkt. Folgendes <em>können</em> Sie anpassen:",
+    "items": [
+      "Das Konsolenbanner über das <strong>FastFetch</strong> Tool in den Post-Install-Optionen.",
+      "Welche optionalen Komponenten installiert werden (Monitor, Fail2Ban, Lynis...) – wählen Sie während der Installation oder später über das entsprechende Menü aus."
+    ]
+  },
+  "q5": {
+    "question": "Wie aktualisiere ich ProxMenux?",
+    "p1Rich": "Wenn eine neue Version verfügbar ist, erkennt ProxMenux sie beim nächsten Aufruf von <code>menu</code> und bietet ein Update an. Stimmen Sie zu, werden die Dateien und die Konfiguration des Werkzeugs in der bestehenden Installation ersetzt. Ein manueller Download ist nicht nötig.",
+    "p2Rich": "Benutzer der stabilen Version erhalten stabile Updates, Beta-Benutzer die Beta-Updates. Sobald eine stabile Version erscheint, informiert die Beta beim nächsten Menüstart darüber und bietet den automatischen Wechsel an. Weitere Informationen finden Sie im <betalink>Beta-Programm</betalink>."
+  },
+  "q6": {
+    "question": "Wo kann ich Probleme melden?",
+    "p1Rich": "Melden Sie Fehler über <issueslink>GitHub Issues</issueslink>. Beschreiben Sie die Schritte zum Reproduzieren, den Fehlertext und gegebenenfalls die Monitor-Ausgabe von <code>journalctl -u proxmenux-monitor -n 50</code>.",
+    "p2Rich": "Bei <strong>Sicherheitsproblemen</strong>: <strong>Veröffentlichen Sie keine Details</strong>. Folgen Sie dem Verfahren zur verantwortungsvollen Meldung im <coclink>Verhaltenskodex und den bewährten Vorgehensweisen</coclink>."
+  },
+  "q7": {
+    "question": "Kann ich zu ProxMenux beitragen?",
+    "p1Rich": "<strong>Unbedingt.</strong> ProxMenux ist ein gemeinschaftliches Open-Source-Projekt. Beiträge sind als Code (Bash, Next.js/TypeScript und Python-Übersetzungswerkzeuge), Tests, Dokumentation, Design oder Ideen willkommen.",
+    "item1Rich": "Besprechen Sie Ideen in <discusslink>GitHub Discussions</discusslink>, bevor Sie eine Feature Request öffnen.",
+    "item2Rich": "Lesen Sie vor einem Pull Request den <coclink>Verhaltenskodex und die bewährten Vorgehensweisen</coclink>.",
+    "item3Rich": "Auf der <contriblink>Mitwirkendenseite</contriblink> finden Sie die aktuellen Tester und Reviewer."
+  },
+  "q8": {
+    "question": "Ändert ProxMenux kritische Systemdateien?",
+    "p1Rich": "<strong>Bei der Installation von ProxMenux werden folgende Komponenten hinzugefügt.</strong>",
+    "item1Rich": "Abhängigkeiten über apt: <code>dialog</code>, <code>curl</code>, <code>jq</code> und <code>git</code>. Die Übersetzungen verwenden vorgefertigte JSON-Kataloge. Der Installer legt auf dem Host keine virtuelle Python-Umgebung für Übersetzungen an.",
+    "item2Rich": "Der Skriptbaum bei <code>/usr/local/share/proxmenux/</code>.",
+    "item3Rich": "Das Startskript unter <code>/usr/local/bin/menu</code>.",
+    "item4Rich": "Optional: der systemd-Dienst von Monitor unter <code>proxmenux-monitor.service</code>.",
+    "p2Rich": "ProxMenux verändert die zentrale Proxmox-Konfiguration <em>nicht</em>, es sei denn, Sie fordern dies ausdrücklich über ein entsprechendes Menü an. Die Netzwerkreparatur bearbeitet beispielsweise <code>/etc/network/interfaces</code>, jedoch erst nach Ihrer Bestätigung und dem Anlegen einer Sicherung."
+  },
+  "q9": {
+    "question": "Ist es sicher, ProxMenux in der Produktion zu verwenden?",
+    "bodyRich": "<strong>Ja.</strong> Da ProxMenux die zentralen Proxmox-Dateien nur auf ausdrücklichen Wunsch verändert, kann es in Produktionsumgebungen eingesetzt werden. Testen Sie automatisierte Abläufe zunächst in einer kontrollierten Umgebung und erstellen Sie Sicherungen, bevor Sie destruktive Vorgänge ausführen, etwa das Upgrade von PVE 8 auf 9, das Formatieren eines Datenträgers oder das Löschen einer VM."
+  },
+  "q10": {
+    "question": "Wie deinstalliere ich ProxMenux?",
+    "p1Rich": "In ProxMenux: <strong>Einstellungen → ProxMenux deinstallieren</strong>. Die Deinstallation entfernt den Skriptbaum, das Startskript und den Monitor-Dienst sowie auf Wunsch ausgewählte Abhängigkeiten. <code>/root/.bashrc</code> und <code>/etc/motd</code> werden aus den von Post-Install angelegten Sicherungen wiederhergestellt, sofern diese vorhanden sind (andernfalls wird die ProxMenux-Zeile aus der MOTD entfernt).",
+    "p2Rich": "Die vollständige Anleitung finden Sie unter <uninstalllink>ProxMenux deinstallieren</uninstalllink>."
+  },
+  "q11": {
+    "question": "VirusTotal markiert die Installations-URL - ist es sicher?",
+    "p1Rich": "Der in Issue #162 gemeldete Treffer von <em>Chong Lua Dao</em> bei 1 von 95 Prüfungen wurde vom Maintainer als Fehlalarm eingestuft. Der Installer wird mit einem Befehl gestartet, der das Skript herunterlädt und ausführt (<code>bash -c \"$(wget -qLO - …)\"</code>) und kann <code>jq</code> aus dessen offizieller GitHub-Veröffentlichung herunterladen. Dieses <em>Verhalten</em> kann heuristische Scanner auslösen. Der damalige Bericht ist keine Bewertung aller künftigen Downloads.",
+    "p2Rich": "ProxMenux ist vollständig quelloffen. Sie können das Installationsskript Zeile für Zeile prüfen: <scriptlink>install_proxmenux.sh</scriptlink>. Weitere Hintergründe finden Sie in <issuelink>Issue #162</issuelink>."
+  }
+}
diff --git a/web/messages/de/docs/about/index.json b/web/messages/de/docs/about/index.json
new file mode 100644
index 00000000..335ab2d4
--- /dev/null
+++ b/web/messages/de/docs/about/index.json
@@ -0,0 +1,67 @@
+{
+  "meta": {
+    "title": "Über das Projekt | ProxMenux-Dokumentation",
+    "description": "Über ProxMenux: Projektziele, Mitwirkende, FAQ und Verhaltenskodex. Open-Source-Menümanagement-Tool für Proxmox VE 8+, erstellt und gepflegt von MacRimi mit einem kleinen Team von Testern und Mitwirkenden.",
+    "ogTitle": "Über das Projekt | ProxMenux-Dokumentation",
+    "ogDescription": "Über ProxMenux — ein menügesteuertes Open-Source-Werkzeug zur Verwaltung von Proxmox VE 8+."
+  },
+  "header": {
+    "title": "Über",
+    "description": "Projektinformationen, FAQ, Mitwirkende und Verhaltenskodex. ProxMenux ist ein Open-Source-Menümanagement-Tool für Proxmox VE 8+, das von MacRimi mit Hilfe eines kleinen Teams von Testern und Mitwirkenden entwickelt und gewartet wird.",
+    "section": "Über"
+  },
+  "callout": {
+    "title": "Open Source, von der Community getragen",
+    "body": "ProxMenux steht unter der GPL-3.0-Lizenz und wird öffentlich auf GitHub entwickelt. Jedes Skript lässt sich prüfen, jede Änderung nachvollziehen. Beiträge in Form von Fehlermeldungen, Ideen, Code und Tests sind willkommen."
+  },
+  "section": {
+    "heading": "In diesem Abschnitt",
+    "options": [
+      {
+        "icon": "HelpCircle",
+        "href": "/docs/about/faq",
+        "title": "FAQ",
+        "description": "Häufig gestellte Fragen: Was ist ProxMenux, Installation, Kompatibilität, Anpassung, Updates, Sicherheit, Produktionsnutzung, Deinstallation."
+      },
+      {
+        "icon": "Users",
+        "href": "/docs/about/contributors",
+        "title": "Mitwirkende",
+        "description": "Anerkennung für die Menschen, die ProxMenux möglich machen: Tester, Reviewer und Entwickler, die jede Version mitgestalten."
+      },
+      {
+        "icon": "ScrollText",
+        "href": "/docs/about/code-of-conduct",
+        "title": "Verhaltenskodex",
+        "description": "Projektwerte, Verantwortung für eingereichten Code und Beitragsrichtlinien. Pflichtlektüre vor dem Einreichen eines PR oder einer Fehlermeldung."
+      }
+    ]
+  },
+  "involved": {
+    "heading": "Beteiligen Sie sich",
+    "intro": "Drei Orte, um sich mit dem Projekt zu beschäftigen:",
+    "cards": [
+      {
+        "href": "https://github.com/MacRimi/ProxMenux/issues/new",
+        "title": "🐛 Einen Bug melden",
+        "description": "GitHub Issues — fügen Sie Protokolle und Schritte zum Nachstellen bei."
+      },
+      {
+        "href": "https://github.com/MacRimi/ProxMenux/discussions",
+        "title": "💡 Schlagen Sie ein Feature vor",
+        "description": "GitHub Discussions — teilen Sie Ideen, bevor Sie eine PR öffnen."
+      },
+      {
+        "href": "https://github.com/MacRimi/ProxMenux/pulls",
+        "title": "🔀 Einen PR einreichen",
+        "description": "GitHub Pull Requests – lesen Sie zuerst den Verhaltenskodex."
+      }
+    ]
+  },
+  "support": {
+    "heading": "Unterstützung des Projekts",
+    "introRich": "Wenn ProxMenux Ihnen Zeit spart, ist der einfachste Weg, anderen zu helfen, es zu entdecken, <starlink> dem Repo ein ⭐ auf GitHub</starlink> zu geben. Wenn Sie weiter gehen wollen:",
+    "kofiLabel": "Auf Ko-fi unterstützen",
+    "kofiOutro": "- kauft dem Betreuer einen Kaffee und hält die Entwicklung am Laufen."
+  }
+}
diff --git a/web/messages/de/docs/backup-restore/creating-backups.json b/web/messages/de/docs/backup-restore/creating-backups.json
new file mode 100644
index 00000000..b33b1a24
--- /dev/null
+++ b/web/messages/de/docs/backup-restore/creating-backups.json
@@ -0,0 +1,220 @@
+{
+  "meta": {
+    "title": "Backups erstellen – interaktiver Backup-Flow | ProxMenux",
+    "description": "Der interaktive Backup-Ablauf in ProxMenux: zwei Einstiegspunkte (das TUI-Menü von Scripts und die Weboberfläche von Monitor), drei Ziele, zwei Profilmodi, ein gemeinsamer Vorbereitungsschritt und ein Bestätigungsdialog. Beschrieben werden die Matrix mit sechs Optionen, das Standardprofil und das benutzerdefinierte Profil sowie die Schritte von der Auswahl eines Backups bis zum Speichern des Archivs am Ziel.",
+    "ogTitle": "ProxMenux Backup — Erstellen von Backups",
+    "ogDescription": "Der interaktive Backup-Flow mit drei Destinationen, zwei Profilen und einem gemeinsamen Staging-Schritt.",
+    "twitterTitle": "Backups erstellen | ProxMenux",
+    "twitterDescription": "Interaktiver Backup-Flow mit drei Zielen und zwei Profilmodi."
+  },
+  "header": {
+    "title": "Backups erstellen",
+    "description": "Der interaktive Backup-Ablauf: Wählen Sie ein Ziel und ein Profil, prüfen Sie die Zusammenfassung und verfolgen Sie, wie das Archiv gespeichert wird. Beide Einstiegspunkte verwenden dasselbe Backend und erzeugen identische Archive.",
+    "section": "Sicherung und Wiederherstellung"
+  },
+  "intro": {
+    "title": "Zwei Einstiegspunkte, identische Funktionalität",
+    "body": "Die TUI von Scripts und die Weboberfläche von Monitor bieten <strong>genau dieselben Funktionen</strong>. Jedes Backup — manuell oder geplant — durchläuft dieselbe Auswahlmatrix (drei Ziele × zwei Profile) und ruft pro Zelle dieselbe Backend-Funktion auf (<code>_bk_pbs</code>, <code>_bk_borg</code> oder <code>_bk_local</code>). Die über beide Einstiegspunkte erzeugten Archive sind nicht zu unterscheiden. Die Wahl ist Geschmackssache: Die TUI eignet sich für SSH und Skripte; Monitor bietet Mausbedienung sowie Ansichten für Benachrichtigungen und laufende Protokollausgaben."
+  },
+  "entryPoints": {
+    "heading": "Die beiden Eingangspunkte",
+    "rows": [
+      {
+        "entry": "ProxMenux Scripts (TUI)",
+        "path": "menu → Utilities → Host Config Backup",
+        "detail": "Dialogbasierter Flow, SSH-freundlich. Das Hauptmenü präsentiert die sechs Optionen direkt. Verwendet <code>backup_menu</code> in <code>backup_host.sh</code>."
+      },
+      {
+        "entry": "ProxMenux Monitor (Weboberfläche)",
+        "path": "Backups tab → Create backup",
+        "detail": "Assistentengestützter Ablauf. Dieselben sechs Optionen erscheinen als zweistufiges Formular (Ziel → Profil). Über die Flask-API werden dieselben Backend-Funktionen aufgerufen."
+      }
+    ]
+  },
+  "modes": {
+    "heading": "Manuelle vs. geplante Backups",
+    "body": "Backups können in zwei Modi erstellt werden: <strong>manuell</strong> (der interaktive Fluss, den diese Seite dokumentiert - der Benutzer wählt ein Ziel und ein Profil aus einem Menü aus und verfolgt das Speichern des Archivs) oder <strong>geplant</strong> (ein unbeaufsichtigter Job, der auf einem Cron-Timer läuft und die für den Job konfigurierte Aufbewahrung anwendet). Beide Modi unterstützen die gleichen drei Ziele und die gleichen zwei Profile, und beide sind von beiden Einstiegspunkten verfügbar - dem Scripts TUI-Menü und der Registerkarte Monitor-Backups. Geplante Jobs verwenden die gleichen Backend-Funktionen wie der manuelle Ablauf durch <code>run_scheduled_backup.sh</code>; die produzierten Archive sind nicht zu unterscheiden.",
+    "seeAlso": "Die Seite mit geplanten Aufträgen deckt den gesamten Ablauf ab, einschließlich der Art und Weise, wie Sie einen Auftrag erstellen, ihn an einen vorhandenen PVE vzdump-Timer anhängen und die Retentionswerte konfigurieren.",
+    "monitorAlt": "ProxMenux Monitor Backups Registerkarte zeigt den Neuen geplanten Backup-Dialog mit Ziel, Profil, Zeitplan und Aufbewahrungsfelder.",
+    "monitorCaption": "Geplantes Backup — ProxMenux Monitor. Derselbe Wizard-Dialog, der ein manuelles Backup erstellt, trägt die Zeitplan- und Aufbewahrungsfelder unten für den unbeaufsichtigten Pfad."
+  },
+  "matrix": {
+    "heading": "Die Matrix mit sechs Optionen",
+    "intro": "Die Auswahl bestimmt sowohl das ausgeführte Backend als auch die Strategie zur Pfadauswahl. Die zielspezifischen Seiten erläutern die Konfiguration jeder Zelle.",
+    "rows": [
+      {
+        "combo": "1",
+        "destination": "PBS",
+        "profile": "Standard",
+        "action": "Lädt das Standardprofil plus persistente Extras in ein konfiguriertes PBS-Repository hoch."
+      },
+      {
+        "combo": "2",
+        "destination": "Borg",
+        "profile": "Standard",
+        "action": "Erstellt ein Archiv mit dem Standardprofil plus persistenten Extras im ausgewählten Borg-Repository."
+      },
+      {
+        "combo": "3",
+        "destination": "Lokal",
+        "profile": "Standard",
+        "action": "Schreibt ein <code>.tar.zst</code>-Archiv mit dem Standardprofil plus persistenten Extras an das konfigurierte lokale Ziel."
+      },
+      {
+        "combo": "4",
+        "destination": "PBS",
+        "profile": "Benutzerdefiniert",
+        "action": "Öffnet vor dem PBS-Upload die Pfadauswahl; der Benutzer markiert die gewünschten Pfade und kann neue hinzufügen."
+      },
+      {
+        "combo": "5",
+        "destination": "Borg",
+        "profile": "Benutzerdefiniert",
+        "action": "Öffnet den Pfadwähler, bevor das Borg-Archiv erstellt wird."
+      },
+      {
+        "combo": "6",
+        "destination": "Lokal",
+        "profile": "Benutzerdefiniert",
+        "action": "Öffnet den Pfadwähler vor dem Schreiben des lokalen <code>.tar.zst</code>."
+      }
+    ]
+  },
+  "profiles": {
+    "heading": "Standardprofil und benutzerdefiniertes Profil",
+    "defaultTitle": "Standardprofil",
+    "defaultBody": "Das Standardprofil ist die kuratierte Liste aus <code>hb_default_profile_paths</code> (dokumentiert in <em>Funktionsweise</em> unter <em>Pfadkategorien</em>) sowie jeder Eintrag in der persistenten Extras-Datei <code>/usr/local/share/proxmenux/backup-extra-paths.txt</code>. Der Benutzer bestätigt die Ziel- und Verschlüsselungsoptionen und das Backup verläuft ohne weitere Pfadauswahl.",
+    "customTitle": "Benutzerdefiniertes Profil",
+    "customBody": "Das benutzerdefinierte Profil öffnet eine Checkliste mit allen Pfaden des Standardprofils (nicht markiert) und allen persistenten Extras (vormarkiert, mit dem Präfix <code>[+]</code>). Der Benutzer markiert die Pfade für diesen Durchlauf und kann über <em>Benutzerdefinierten Pfad hinzufügen</em> einen neuen absoluten Pfad ergänzen. Jeder dabei hinzugefügte Pfad wird in <code>backup-extra-paths.txt</code> gespeichert, damit künftige Backups ihn automatisch berücksichtigen. Das Abwählen eines persistenten Extras gilt nur für diesen Durchlauf und löscht es nicht aus der Datei — dafür gibt es außerhalb des Backup-Ablaufs die separate Aktion <em>Benutzerdefinierte Pfade verwalten</em>.",
+    "customPickerAlt": "Benutzerdefinierte Profil-Checkliste mit den Standard-Profilpfaden (nicht markiert) und persistenten Extras (vormarkiert mit einem [+]-Präfix) sowie Schaltflächen, um einen neuen Pfad hinzuzufügen oder die Auswahl zu bestätigen.",
+    "customPickerCaption": "Benutzerdefiniertes Profil — die Pfadauswahl. Die Pfade des Standardprofils sind nicht markiert; persistente Extras sind mit dem Präfix [+] vormarkiert. Der Benutzer markiert die Pfade für diesen Durchlauf.",
+    "manageCustomAlt": "Menü zur Verwaltung benutzerdefinierter Pfade mit der Liste persistenter Extras und Optionen zum Hinzufügen, Entfernen und Bearbeiten.",
+    "manageCustomCaption": "Benutzerdefinierte Pfade verwalten - der Einstiegspunkt, an dem persistente Extras hinzugefügt oder entfernt werden. Jeder hier aufgeführte Pfad wird automatisch in Backups im Standardmodus aufgenommen, ohne dass die benutzerdefinierte Pfadauswahl geöffnet werden muss."
+  },
+  "commonPipeline": {
+    "heading": "Was läuft unabhängig vom Ziel",
+    "intro": "Nachdem das Profil aufgelöst wurde, führt jedes Backend die gleiche Staging-Pipeline aus, bevor es in seinen eigenen Upload-Pfad divergiert. <code>hb_prepare_staging</code> stellt den Archivbaum in <code>/tmp/proxmenux-DESTINATION-stage.XXXXXX</code> zusammen und füllt jede der drei Nutzlasten aus.",
+    "steps": [
+      {
+        "step": "1",
+        "name": "rootfs zusammenstellen",
+        "detail": "Führt <code>rsync -a</code> für jeden ausgewählten Pfad in <code>staging_root/rootfs/</code> aus. Die pmxcfs-Datenbank bei <code>/var/lib/pve-cluster/config.db</code> wird separat über <code>sqlite3 .backup</code> erfasst, um einen konsistenten Snapshot zu erstellen, ohne den Cluster zu stoppen, und die <code>.db-wal</code> / <code>.db-shm</code> Sidecars sind vom rsync ausgeschlossen; Wenn <code>sqlite3</code> nicht verfügbar ist, wird stattdessen eine Datei <code>config.db.raw-fallback</code> abgelegt, die bei der Wiederherstellung während des Imports als Datenbank übernommen wird. Flüchtige Subpfade (Bash-Historie, Caches, Trash) sind von <code>/root/</code> ausgeschlossen. Pfade, die in der Quelle fehlen, werden in <code>metadata/missing_paths.txt</code> aufgezeichnet, ohne das Backup zu stoppen."
+      },
+      {
+        "step": "2",
+        "name": "Manifest erstellen",
+        "detail": "<code>build_manifest.sh</code> steuert die sechs Datensammler und schreibt <code>manifest.json</code> in das Hauptverzeichnis des Staging-Bereichs. Fällt ein Datensammler aus, erhält der betroffene Abschnitt einen dokumentierten leeren Standardwert; das Manifest bleibt gültig."
+      },
+      {
+        "step": "3",
+        "name": "Paketbestand",
+        "detail": "<code>apt-mark showmanual</code> wird wortwörtlich in <code>metadata/packages.manual.list</code> erfasst. Der Komponentenzustand befindet sich bereits innerhalb der wiederhergestellten Rootfs (<code>components_status.json</code>), da <code>/usr/local/share/proxmenux/</code> Teil des Standardprofils ist."
+      },
+      {
+        "step": "4",
+        "name": "Informationen zum Durchlauf",
+        "detail": "<code>metadata/run_info.env</code> zeichnet die Backup-Laufidentität (Hostname, Zeitstempel, Kernelversion) auf, die von der Kompatibilitätsprüfung der Wiederherstellung zur Bestimmung der kernübergreifenden Richtung verwendet wird."
+      },
+      {
+        "step": "5",
+        "name": "Mitteilung (Beginn)",
+        "detail": "<code>hb_notify_lifecycle \"start\"</code> wird ausgelöst. Sind im Monitor Benachrichtigungen konfiguriert, wird das Ereignis <em>Host-Backup gestartet</em> für den Benutzer ausgegeben. Ohne konfigurierte Kanäle erfolgt keine Benachrichtigung."
+      }
+    ]
+  },
+  "included": {
+    "heading": "Was reingeht und was draußen bleibt",
+    "intro": "Jeder Pfad im aufgelösten Profil (Standard + persistente Extras + Custom-Mode-Auswahl) wird mit <code>rsync -aAXH --numeric-ids</code> kopiert. Eine gemeinsame Ausschlussliste gilt für jeden Pfad, und zwei Verzeichnisse tragen zusätzliche pfadspezifische Ausschlüsse.",
+    "globalTitle": "Globale Ausschlüsse (auf jeden Pfad angewendet)",
+    "globalItems": [
+      "<code>images/</code> — Image Dumps.",
+      "<code>dump/</code> — Ausgaben von vzdump.",
+      "<code>tmp/</code> — temporäre Dateien.",
+      "<code>*.log</code> — Protokolldateien."
+    ],
+    "rootTitle": "<code>/root/</code> Ausschlüsse",
+    "rootBody": "<code>/root/</code> ist Teil des Standardprofils, sodass Benutzerskripte und Konfigurationen im Archiv landen. Flüchtige Subpfade werden fallen gelassen:",
+    "rootItems": [
+      "<code>.bash_history</code>",
+      "<code>.cache/</code>",
+      "<code>tmp/</code>",
+      "<code>.local/share/Trash/</code>"
+    ],
+    "proxmenuxTitle": "<code>/usr/local/share/proxmenux/</code> Ausschlüsse",
+    "proxmenuxBody": "Dieses Verzeichnis liefert nur Benutzerstatus - <code>components_status.json</code>, Einstellungen, Cache nach der Installation. Code, den das Ziel bereits von seiner eigenen ProxMenux-Installation haben wird, ist ausgeschlossen, so dass eine Wiederherstellung die aktuellen Binärdateien des Ziels nicht mit älteren überschreibt:",
+    "proxmenuxItems": [
+      "<code>restore-pending/</code>, <code>scripts/</code>, <code>web/</code>",
+      "<code>monitor-app/</code>, <code>monitor-app.*/</code>, <code>AppImage/</code>",
+      "<code>images/</code>, <code>json/</code>",
+      "<code>utils.sh</code>, <code>helpers_cache.json</code>",
+      "<code>ProxMenux-Monitor.AppImage*</code>, <code>install_proxmenux*.sh</code>"
+    ],
+    "notInProfileTitle": "Pfade außerhalb des Profils",
+    "notInProfileBody": "Alles, was nicht in <code>hb_default_profile_paths</code> aufgeführt ist und nicht als benutzerdefiniertes oder persistentes Extra hinzugefügt wurde, ist nicht Teil des Backups. Bemerkenswerte Beispiele:",
+    "notInProfileItems": [
+      "<strong>VM und LXC Festplatten</strong> — werden von <code>vzdump</code> behandelt, nicht von dieser Funktion. Gastkonfigurationsdateien unter <code>/etc/pve/nodes/*/qemu-server/*.conf</code> und <code>lxc/*.conf</code> werden erfasst (sie leben unter <code>/etc/pve</code>), so dass die Wiederherstellung das Inventar reproduziert; die Festplatten selbst werden von einem vorhandenen vzdump / PBS-Backup neu angehängt.",
+      "<strong><code>/boot</code> und <code>/boot/efi</code></strong> — Kernel-Binärdateien, Initramfs und die UEFI-ESP-Partition werden nach der Wiederherstellung durch die eigenen <code>update-initramfs</code>, <code>update-grub</code> oder <code>proxmox-boot-tool refresh</code> des Ziels regeneriert. Der Bootloader wird niemals wörtlich kopiert.",
+      "<strong>Kernel und Systemlaufzeit-Dateisysteme</strong> — <code>/proc</code>, <code>/sys</code>, <code>/dev</code> und <code>/run</code> sind Pseudo-Dateisysteme, die vom Kernel und von udev erzeugt werden; sie werden nirgendwo persistent.",
+      "<strong>Paket-Binärdateien unter <code>/usr/bin</code>, <code>/usr/lib</code>, <code>/lib</code>, <code>/sbin</code></strong> — vom APT des Ziels aus <code>packages.manual.list</code> neu installiert.",
+      "<strong><code>/var/log/</code>, <code>/var/tmp/</code>, <code>/var/cache/</code></strong> — Laufzeitzustand pro Host, nicht wiederhergestellt.",
+      "<strong><code>/home/USER</code></strong> — nicht im Standardprofil. Fügen Sie es als benutzerdefinierten Pfad hinzu, wenn ein System Heimverzeichnisse des Benutzers trägt, die eine Wiederherstellung überleben müssen."
+    ],
+    "customPathsTitle": "Wie benutzerdefinierte Pfade gehandhabt werden",
+    "customPathsBody": "Ein benutzerdefinierter Pfad, der im benutzerdefinierten Modus hinzugefügt wurde oder in <code>backup-extra-paths.txt</code> persistiert wurde, durchläuft dieselbe <code>rsync</code>-Pipeline wie Standardprofilpfade. Globale Ausschlüsse gelten. Wenn der benutzerdefinierte Pfad unter <code>/root/</code> oder <code>/usr/local/share/proxmenux/</code> liegt, gelten die oben genannten pfadspezifischen Ausschlüsse weiterhin. Jeder archivierte Pfad – standardmäßig oder benutzerdefiniert – wird in <code>metadata/paths_archived.txt</code> aufgezeichnet. Pfade, die in der Quelle nicht vorhanden sind, werden in <code>metadata/missing_paths.txt</code> aufgezeichnet, ohne das Backup zu stoppen."
+  },
+  "archiveStructure": {
+    "heading": "Archivstruktur",
+    "intro": "Das von jedem Backend erstellte Staging-Verzeichnis folgt unabhängig vom Ziel dem gleichen Layout. Das Tarball-, PBS <code>.pxar</code> oder Borg-Archiv speichert diesen Baum wortwörtlich.",
+    "tree": "backup-[timestamp]/\n├── manifest.json                  # structured host state (kernel_params, hardware, storage, guests, components, source_host)\n├── metadata/\n│   ├── packages.manual.list       # output of apt-mark showmanual\n│   ├── run_info.env               # hostname, timestamp, kernel version, pmxcfs method\n│   ├── paths_archived.txt         # exact list of paths that reached rootfs/\n│   └── missing_paths.txt          # paths from the profile absent on source\n└── rootfs/\n    ├── etc/                       # /etc/pve, /etc/network, /etc/systemd/network, /etc/ssh, /etc/apt, ...\n    ├── root/                      # /root without volatile subpaths\n    ├── usr/local/                 # /usr/local/bin, /usr/local/sbin, /usr/local/share/proxmenux (state only)\n    └── var/                       # /var/lib/pve-cluster (config.db via sqlite3 .backup), /var/spool/cron/crontabs"
+  },
+  "confirmation": {
+    "heading": "Bestätigungszusammenfassung",
+    "body": "Bevor das Backend etwas an das Ziel schreibt, zeigt ProxMenux einen zusammenfassenden Dialog mit dem Ziel, der Backup-ID oder dem Archivnamen, dem Verschlüsselungsstatus und der Liste der zu kopierenden Pfade an. Das Abbrechen hier bricht das Backup sauber ab - das Staging-Verzeichnis wird durch den <code>trap</code>-Hook entfernt, der auf der Backend-Funktion eingestellt ist, und keine Teildaten erreichen das Ziel."
+  },
+  "writing": {
+    "heading": "Schreiben an den Bestimmungsort",
+    "intro": "Sobald der Benutzer bestätigt, führt jedes Backend seinen eigenen Schreibschritt aus. Die Mechanik wird auf den Zielseiten behandelt; die gemeinsame Oberfläche ist das Protokoll, das Sidecar und die Abschlussbenachrichtigung.",
+    "rows": [
+      {
+        "topic": "Protokolldatei",
+        "detail": "Jedes Backend schreibt seine vollständige Ausgabe in <code>/tmp/proxmenux-DESTINATION-backup-YYYYMMDD_HHMMSS.log</code> und bietet bei Ausfall an, sie in einem scrollbaren Dialog zu öffnen. Der Protokollpfad wird in der Abschlusszusammenfassung nur dann gedruckt, wenn die Datei Inhalt hat."
+      },
+      {
+        "topic": "Begleitdatei (nur lokal)",
+        "detail": "<code>hb_write_archive_sidecar</code> legt einen <code>*.proxmenux.json</code> neben das lokale Archiv, so dass der Monitor ihn als ProxMenux-Host-Backup auch nach Umzügen oder Umbenennungen identifiziert."
+      },
+      {
+        "topic": "Benachrichtigung (Abschluss/Fehler)",
+        "detail": "<code>hb_notify_lifecycle \"complete\"</code> oder <code>\"fail\"</code> wird mit Dauer, Archivgröße und — bei Fehlern — der letzten nach einem Fehler aussehenden Protokollzeile ausgelöst."
+      }
+    ]
+  },
+  "finishedScreens": {
+    "heading": "Wie ein fertiges Backup aussieht",
+    "intro": "Das gleiche Abschlussereignis wird an beiden Einstiegspunkten angezeigt. Die TUI schreibt einen Zusammenfassungsblock in das Terminal; die Registerkarte Backups des Monitors zeigt den Ablauf in der Archivliste mit Größe, Dauer und Statusabzeichen an.",
+    "scriptsAlt": "ProxMenux Scripts TUI zeigt ein fertiges Host-Backup an - Ziel, Backup-ID, Snapshot-Pfad, Datengröße, Dauer und Verschlüsselungszustand.",
+    "scriptsCaption": "Abgeschlossenes Backup — ProxMenux Scripts (TUI). Der Vervollständigungsblock druckt das Ziel, die Backup-ID, den resultierenden Snapshot- oder Archivnamen, die Datengröße, die Dauer und den Verschlüsselungszustand.",
+    "monitorAlt": "Die Registerkarte ProxMenux Monitor Backups zeigt einen fertigen Host-Backup-Eintrag mit Größe, Dauer, Methodenabzeichen und Verschlüsselungsindikator.",
+    "monitorCaption": "Abgeschlossenes Backup — ProxMenux Monitor Backups Registerkarte. Das neue Backup erscheint in der Archivliste mit dem Zielmethode-Badge, der Größe, der Dauer und gegebenenfalls dem Verschlüsselungssperrindikator."
+  },
+  "whereNext": {
+    "heading": "Wohin Sie als nächstes gehen",
+    "items": [
+      {
+        "label": "Ziele",
+        "href": "/docs/backup-restore/destinations",
+        "tail": "— Konfigurationsdetails für Local, PBS und Borg."
+      },
+      {
+        "label": "Geplante Aufträge",
+        "href": "/docs/backup-restore/scheduled-jobs",
+        "tail": "- das gleiche Backup unbeaufsichtigt nach einem Zeitplan anstatt interaktiv auszuführen."
+      },
+      {
+        "label": "Wiederherstellung",
+        "href": "/docs/backup-restore/restoring",
+        "tail": "— der Fluss, der verbraucht, was diese Seite produziert."
+      }
+    ]
+  }
+}
diff --git a/web/messages/de/docs/backup-restore/cross-kernel.json b/web/messages/de/docs/backup-restore/cross-kernel.json
new file mode 100644
index 00000000..fb78e27e
--- /dev/null
+++ b/web/messages/de/docs/backup-restore/cross-kernel.json
@@ -0,0 +1,170 @@
+{
+  "meta": {
+    "title": "Wiederherstellung zwischen Kernel-Versionen — Richtungserkennung, Sicherheitsfilter und Ergänzung | ProxMenux",
+    "description": "Wie ProxMenux ein Host-Backup auf einem Ziel mit einer anderen Hauptkernelversion wiederherstellt. Dokumentiert, wie die Richtung der Fehlanpassung erkannt wird, den Safe-Subset-Filter, der bootkritische Pfade überspringt, wenn das Ziel einen neueren Kernel als das Backup ausführt, und die vierphasige Kernel-agnostische Hydratation, die Benutzertuning wie IOMMU, VFIO IDs und benutzerdefinierte Cmdline-Token erneut anwendet, ohne Kernel-gebundene Dateien wörtlich zu kopieren.",
+    "ogTitle": "ProxMenux Backup — kernübergreifende Wiederherstellung und Hydratation",
+    "ogDescription": "Wiederherstellung zwischen Kernel-Versionen mit Richtungserkennung, sicherer Pfadauswahl und kernelunabhängiger Ergänzung.",
+    "twitterTitle": "Cross-Kernel-Wiederherstellung | ProxMenux",
+    "twitterDescription": "Wie ProxMenux eine Wiederherstellung durchführt, wenn sich der Zielkernel vom Backup unterscheidet."
+  },
+  "header": {
+    "title": "Kernübergreifende Wiederherstellung",
+    "description": "Wie ProxMenux eine Wiederherstellung durchführt, wenn der Zielhost einen anderen Kernel als den im Backup aufgezeichneten ausführt - insbesondere wenn das Ziel einen neueren Kernel ausführt. Dokumentiert, wie der Unterschied erkannt wird, wie bootkritische Pfade, die das Ziel unterbrechen könnten, gefiltert werden und wie die eigene Konfiguration des Benutzers erneut angewendet wird, ohne Kernel-gebundene Dateien wörtlich zu kopieren.",
+    "section": "Sicherung und Wiederherstellung"
+  },
+  "intro": {
+    "title": "Jeder Kernelsprung wird anders gehandhabt",
+    "body": "Der Kernel eines Proxmox-Hosts wird durch eine Versionszeichenfolge wie <code>6.17.13-2-pve</code> identifiziert. Die ersten beiden Zahlen (<strong>6.17</strong> in diesem Beispiel) definieren die Hauptversion: Wenn sie sich ändern, sind einige Konfigurationsdateien, die für den vorherigen Kernel geschrieben wurden, möglicherweise nicht für den neuen gültig. Wenn die Wiederherstellung erkennt, dass das Backup und das Ziel unterschiedliche Hauptkernelversionen haben, verzweigt sich der Fluss basierend auf der Richtung des Sprungs - ob das Backup älter oder neuer als das Ziel ist - weil die beiden Fälle entgegengesetzte Fehlermodi haben. Backups, die neuer sind als das Ziel, stellen sauber wieder her, wie sie sind (bench-verifiziert über mehrere Kernelsprünge). Backups, die älter als das Ziel sind, benötigen einen Filter, um zu vermeiden, dass der Boot des Ziels mit einer Konfiguration unterbrochen wird, die für einen Kernel geschrieben wurde, der sich seitdem geändert hat."
+  },
+  "directionCheck": {
+    "heading": "Die Richtungskontrolle",
+    "intro": "Während der Kompatibilitätsprüfung vergleicht <code>hb_compat_check</code> den im Backup-Manifest aufgezeichneten Kernel mit dem aktuellen Kernel des Ziels (<code>uname -r</code>) und klassifiziert die Wiederherstellung in einen von drei Fällen, die in der internen Variable <code>HB_COMPAT_KERNEL_DIRECTION</code> gespeichert sind:",
+    "rows": [
+      {
+        "direction": "same",
+        "condition": "Die Hauptkernelversion stimmt zwischen Backup und Target überein.",
+        "behavior": "Der vollständige Restaurationsfluss läuft unverändert. Kein extra Filter, keine Hydratation, kein besonderer Hinweis in der UI."
+      },
+      {
+        "direction": "bk_newer",
+        "condition": "Der Backup-Kernel ist NEUER als der des Ziels (zum Beispiel: Das Backup wurde auf dem Kernel 7.0 erstellt und das Ziel führt den Kernel 6.17 aus).",
+        "behavior": "Der vollständige Wiederherstellungsfluss läuft unverändert, genau wie <code>same</code>. Es wird kein Filter angewendet. Empirisch verifiziert: Treiber werden automatisch gegen den Zielkernel neu installiert, IOMMU config wird sauber angewendet, VMs mit GPU-Durchgang kommen ohne Probleme auf."
+      },
+      {
+        "direction": "bk_older",
+        "condition": "Der Backup-Kernel ist älter als der des Ziels (zum Beispiel: Das Backup wurde auf dem Kernel 6.17 erstellt und das Ziel führt den Kernel 7.0 aus).",
+        "behavior": "Der Safe-Subset-Filter und die folgende vierphasige Hydratation werden aktiviert. Die Wiederherstellung geht weiter - das Ziel reproduziert die Quelle, aber bootkritische Dateien werden nicht wörtlich kopiert."
+      }
+    ]
+  },
+  "whyBkNewerIsSafe": {
+    "heading": "Warum ein Backup mit einem neueren Kernel als das Ziel unverändert wiederherstellt",
+    "body": "Wenn die Wiederherstellung gegen ein Ziel mit einem <em>älteren</em>-Kernel als dem im Backup aufgezeichneten läuft, ist jeder Mechanismus, von dem die Wiederherstellung abhängt, unabhängig von der Kernelversion. GPU-Treiberinstallateure und andere PCI-Geräteinstallateure erkennen den laufenden Kernel mit <code>uname -r</code> und kompilieren DKMS mit dem, was das Ziel hat. Die APT-Paketinstallation zieht Binärdateien, die für die Verteilung des Ziels erstellt wurden. IOMMU-Cmdline-Token wie <code>intel_iommu=on</code> sind in den wichtigsten Kernelversionen stabil. Das Backup trägt Pfade, die unter einem neueren Kernel geschrieben wurden, aber diese Pfade (Module Blacklists, GRUB Defaults, Initramfs Config) sind immer noch gültige Syntax auf dem älteren - Kernel ignorieren Token, die sie nicht erkennen, anstatt zu scheitern. Dieser Fall entspricht in der Praxis einer Wiederherstellung des gleichen Kerns, und ProxMenux behandelt ihn als solchen."
+  },
+  "safeSubsetFilter": {
+    "heading": "Der Safe-Subset-Filter (nur wenn der Zielkernel neuer ist)",
+    "intro": "Wenn der Zielkernel neuer ist als das Backup, fügt die Kompatibilitätsprüfung 16 bootkritische Pfade von <code>hb_unsafe_paths_cross_version</code> zu <code>RS_SKIP_PATHS</code> hinzu. Diese Pfade sind von der Wiederherstellung ausgeschlossen, da das Schreiben einer Version von ihnen aus einem älteren Kernel über ein Ziel mit einem neueren Kernelpanik in Bench-Tests verursacht hat. Die Pfade umfassen fünf Kategorien:",
+    "categoryRows": [
+      {
+        "category": "Bootloader",
+        "paths": "<code>/etc/default/grub</code>, <code>/etc/kernel</code>",
+        "reason": "GRUB-Standards, die an die vorherige Kernel-Order gebunden sind, und proxmox-boot-tool-Status (cmdline, ESP-UUIDs, Hooks), der auf Pfade und Identifikatoren aus der älteren Installation verweist."
+      },
+      {
+        "category": "Kernelmodule und Bootartefakte",
+        "paths": "<code>/etc/modules-load.d</code>, <code>/etc/modprobe.d</code>, <code>/etc/initramfs-tools</code>",
+        "reason": "Autoload-Listen, die möglicherweise auf Module verweisen, die zwischen Kernel-Majors umbenannt wurden, Moduloptionen, die möglicherweise nicht gelten, Initramfs-Hooks, die für den älteren Kernel geschrieben wurden."
+      },
+      {
+        "category": "Storage Stack und Filesystem Identität",
+        "paths": "<code>/etc/fstab</code>, <code>/etc/multipath</code>, <code>/etc/iscsi</code>, <code>/etc/udev/rules.d</code>, <code>/etc/zfs</code>",
+        "reason": "UUIDs, die in dieser Installation möglicherweise nicht vorhanden sind, Multipath-Treiber, die zwischen Kerneln wechseln, iSCSI-Parameter, die sich entwickeln, udev-Regeln, die an nicht vorhandene Subsysteme binden können, ZFS-Zustand (<code>zpool.cache</code> + <code>hostid</code>), der den Pool als fremd sperren kann."
+      },
+      {
+        "category": "APT-Quellen",
+        "paths": "<code>/etc/apt</code>",
+        "reason": "APT-Source-Suiten können beim nächsten Upgrade ein Downgrade kritischer Pakete auslösen."
+      },
+      {
+        "category": "systemd",
+        "paths": "<code>/etc/systemd/system</code>, <code>/etc/systemd/journald.conf</code>, <code>/etc/systemd/logind.conf</code>, <code>/etc/systemd/system.conf</code>, <code>/etc/systemd/user.conf</code>",
+        "reason": "Unit overrides und .wants, die an den älteren systemd Major gebunden sind; Konfigurationsschlüssel, die möglicherweise nicht auf einem neueren systemd analysiert werden."
+      }
+    ],
+    "outroBody": "Der Filter läuft VOR dem Bestätigungsdialog, so dass der Benutzer die genaue Liste der Pfade sieht, die nach dem Grund kategorisiert übersprungen werden. Die Wiederherstellung geht weiter - alles andere (VM-/LXC-Konfiguration, Netzwerk, /etc/pve, Benutzer, cron, ProxMenux-Zustand, Pakete, Treiber, /root) wird normal wiederhergestellt."
+  },
+  "hydration": {
+    "heading": "Kern-agnostische Hydratation",
+    "intro": "Der Filter überspringt bootkritische Dateien; die Ergänzung übernimmt ausgewählte Benutzereinstellungen wie IOMMU-Parameter, VFIO-IDs, eigenes <code>GRUB_TIMEOUT</code> und nvidia-Sperrlisten. Sie läuft bei neuerem Zielkernel. Cmdline-Schlüssel des Ziels bleiben erhalten und fehlende Module werden ergänzt. Freigegebene GRUB-Werte und Benutzerdateien können abweichende Zielinhalte ersetzen. Gleiche Eingaben sind bei Wiederholung idempotent.",
+    "phaseRows": [
+      {
+        "phase": "1a — GRUB-Trasse",
+        "detail": "Für Hosts mit GRUB (ext4/lvm-Installationen). <code>_rs_hyd_grub</code> führt jedes Token aus dem <code>manifest.kernel_params.cmdline_extra</code> des Backups in das <code>GRUB_CMDLINE_LINUX_DEFAULT</code> des Ziels ein und überspringt Token, deren Schlüssel das Ziel bereits trägt. Dann werden die <code>GRUB_*</code>-Schlüssel auf der weißen Liste (<code>GRUB_TIMEOUT</code>, <code>GRUB_TIMEOUT_STYLE</code>, <code>GRUB_DEFAULT</code>, <code>GRUB_TERMINAL</code>, <code>GRUB_DISABLE_OS_PROBER</code>, <code>GRUB_SERIAL_COMMAND</code>, <code>GRUB_GFXMODE</code>, <code>GRUB_GFXPAYLOAD_LINUX</code>) aus dem <code>/etc/default/grub</code> des Backups zusammengeführt, wenn sie sich von denen des Ziels unterscheiden."
+      },
+      {
+        "phase": "1b — systemd-boot / ZFS",
+        "detail": "Für Hosts mit systemd-Boot (normalerweise ZFS-on-root). <code>_rs_hyd_kernel_cmdline</code> verschmilzt Benutzer-Token von <code>cmdline_extra</code> in <code>/etc/kernel/cmdline</code> des Ziels, wobei die eigene <code>root=</code>, <code>boot=</code> und <code>rootflags=</code> Boilerplate des Ziels intakt bleibt."
+      },
+      {
+        "phase": "2 — /etc/modules-Merge",
+        "detail": "<code>_rs_hyd_modules</code> fügt Module aus <code>manifest.kernel_params.modules_loaded_at_boot</code> hinzu, die sich in der Whitelist befinden (<code>vfio</code>, <code>vfio_pci</code>, <code>vfio_iommu_type1</code>, <code>vfio_virqfd</code>, <code>kvm</code>, <code>kvm_intel</code>, <code>kvm_amd</code>, <code>nvidia</code>, <code>nvidia_drm</code>, <code>nvidia_modeset</code>, <code>nvidia_uvm</code>, <code>i915</code>, <code>xe</code>) UND nicht bereits im <code>/etc/modules</code> des Ziels vorhanden sind."
+      },
+      {
+        "phase": "3 — Kopie von Dateien auf der weißen Liste",
+        "detail": "<code>_rs_hyd_files</code> kopiert vom Benutzer verfasste Dateien von den Staging-Rootfs zum Live-Ziel, wenn sich der Inhalt unterscheidet. Whitelist umfasst VFIO/nvidia / Blacklist-Dateien unter <code>/etc/modprobe.d</code>, <code>/etc/modules-load.d</code> und die ProxMenux VFIO Binderegel + nvidia udev Regeln unter <code>/etc/udev/rules.d</code>. Distro-eigene Dateien (<code>pve-blacklist.conf</code>, <code>mdadm.conf</code>, <code>nvme.conf</code>) werden absichtlich ausgeschlossen - ihre Inhalte entwickeln sich zwischen den Releases."
+      },
+      {
+        "phase": "4 — Neubildung nach dem Booten erzwingen",
+        "detail": "Die vier Phasen schreiben direkt an das Live-Ziel außerhalb der normalen Wiederherstellungspipeline. Damit die zusammengeführten Token/Module/Dateien beim nächsten Booten wirksam werden, breitet sich <code>HB_HYDRATION_APPLIED=1</code> durch <code>plan.env</code> bis <code>apply_pending_restore.sh</code> aus, was <code>NEEDS_INITRAMFS=1</code> und <code>NEEDS_GRUB=1</code> unabhängig davon erzwingt, was in der Anwendungsliste war. Der Post-Boot-Dispatcher regeneriert dann Initramfs und aktualisiert den Bootloader."
+      }
+    ]
+  },
+  "planCommit": {
+    "heading": "Plan vs Commit - der Benutzer sieht zuerst eine Vorschau",
+    "body": "Die Hydratation läuft in zwei Modi. Vor dem Bestätigungsdialog führt ProxMenux <code>_rs_apply_bk_older_hydration</code> im <code>plan</code>-Modus aus: Es berechnet genau, was zusammengeführt werden würde, füllt <code>RS_HYDRATION_SUMMARY</code> mit einem grünen Block, der jede Aktion auflistet, und gibt ohne zu schreiben zurück. Der Bestätigungsdialog zeigt den grünen Block neben der gelben Liste der durch den Sicherheitsfilter übersprungenen Pfade an, sodass der Benutzer VORAB sieht, was automatisch erneut angewendet wird. Nachdem der Benutzer bestätigt hat, führt ProxMenux den gleichen Helfer im <code>commit</code>-Modus erneut aus - gleiche Phasen, gleiche Logik, aber dieses Mal schreibt jede Phase an das Live-Ziel. Das Abbrechen des Bestätigungsdialogs lässt das Ziel unberührt."
+  },
+  "flowDiagram": {
+    "heading": "Der Flow, wenn der Zielkernel neuer ist als das Backup",
+    "intro": "Die Schritte, die hinzugefügt werden, wenn der Zielkernel neuer ist, befinden sich innerhalb des normalen Wiederherstellungsflusses. Alles andere - heißes Aufbringen, ausstehende Vorbereitung, Paketinstallation, Post-Boot-Dispatcher - läuft identisch mit einer Wiederherstellung mit dem gleichen Kern.",
+    "diagram": "  ┌────────────────────────────────────────────────────────────┐\n  │ hb_compat_check                                             │\n  │   HB_COMPAT_KERNEL_DIRECTION = bk_older                     │\n  └───────────────────────────┬────────────────────────────────┘\n                              │\n                              ▼\n  ┌────────────────────────────────────────────────────────────┐\n  │ Add 16 boot-critical paths to RS_SKIP_PATHS                 │\n  │   /etc/default/grub, /etc/kernel, /etc/modules-load.d, ...  │\n  └───────────────────────────┬────────────────────────────────┘\n                              │\n                              ▼\n  ┌────────────────────────────────────────────────────────────┐\n  │ _rs_apply_bk_older_hydration \"plan\"                         │\n  │   Compute what would be merged                              │\n  │   Populate RS_HYDRATION_SUMMARY (green block)               │\n  │   No writes                                                 │\n  └───────────────────────────┬────────────────────────────────┘\n                              │\n                              ▼\n  ┌────────────────────────────────────────────────────────────┐\n  │ Confirmation dialog                                         │\n  │   Amber: paths skipped by safe-subset filter                │\n  │   Green: tokens/files reapplied by hydration                │\n  │   User accepts or cancels                                   │\n  └───────────────────────────┬────────────────────────────────┘\n                              │ (accepted)\n                              ▼\n  ┌────────────────────────────────────────────────────────────┐\n  │ _rs_apply_bk_older_hydration \"commit\"                       │\n  │   Phase 1a/1b: merge cmdline tokens + GRUB keys             │\n  │   Phase 2: append modules to /etc/modules                   │\n  │   Phase 3: copy whitelisted vfio/nvidia files               │\n  │   Set HB_HYDRATION_APPLIED=1                                │\n  └───────────────────────────┬────────────────────────────────┘\n                              │\n                              ▼\n  ┌────────────────────────────────────────────────────────────┐\n  │ Rest of the restore runs normally                           │\n  │   _rs_apply hot (skips RS_SKIP_PATHS)                       │\n  │   _rs_prepare_pending_restore (writes plan.env with         │\n  │     HB_HYDRATION_APPLIED=1)                                 │\n  │   packages.manual.list install                              │\n  │   Reboot                                                    │\n  │   apply_pending_restore.sh (forces NEEDS_INITRAMFS=1,       │\n  │     NEEDS_GRUB=1 because of the hydration flag)             │\n  │   apply_cluster_postboot.sh                                 │\n  │     update-initramfs -u -k all                              │\n  │     update-grub / proxmox-boot-tool refresh                 │\n  │     component --auto-reinstall                              │\n  └────────────────────────────────────────────────────────────┘"
+  },
+  "concreteExamples": {
+    "heading": "Konkrete Beispiele",
+    "intro": "Der Hydratationspass ist nicht abstrakt - er erzeugt beobachtbare, korrekte Ergebnisse für gängige Szenarien. Zwei Beispiele, die Hydratation automatisch handhaben:",
+    "rows": [
+      {
+        "scenario": "GPU-Durchgang (VFIO)",
+        "detail": "Quelle hatte <code>intel_iommu=on iommu=pt</code> in der cmdline, <code>vfio</code>/<code>vfio_pci</code>/<code>vfio_iommu_type1</code> in <code>/etc/modules</code>, ein <code>/etc/modprobe.d/vfio.conf</code> mit <code>options vfio-pci ids=10de:2216</code> und ein <code>/etc/modprobe.d/blacklist-nvidia.conf</code>. Hydration führt die Cmdline-Token in die GRUB- oder Kernel-Cmdline des Ziels ein, fügt die vfio-Module an <code>/etc/modules</code> an und kopiert die beiden vom Benutzer verfassten Modprobe-Dateien. Beim nächsten Booten ist IOMMU aktiv, VFIO-Module laden, der GPU ist an vfio-pci gebunden und der VM hat Passthrough-Funktionen."
+      },
+      {
+        "scenario": "Custom GRUB-Standards",
+        "detail": "Quelle hatte <code>GRUB_TIMEOUT=1</code> und <code>GRUB_DISABLE_OS_PROBER=true</code>. Hydration liest beide Schlüssel aus dem <code>/etc/default/grub</code> des Backups und sieht, dass sie sich von den Standardeinstellungen der Neuinstallation unterscheiden, und schreibt diese beiden Zeilen in der Zieldatei um (alles andere, einschließlich <code>GRUB_DISTRIBUTOR</code>, bleibt unberührt)."
+      }
+    ]
+  },
+  "callout": {
+    "warningTitle": "Was bei neuerem Zielkernel nicht erneut angewendet wird",
+    "warningBody": "Hydration wendet nur die Konfiguration ProxMenux an, von der bekannt ist, dass sie in Kernelversionen sicher ist: IOMMU-Token, VFIO-IDs, GRUB-Schlüssel auf der weißen Liste und Module aus einer festen Liste (<code>vfio*</code>, <code>nvidia*</code>, <code>i915</code>, <code>xe</code>, <code>kvm*</code>). Alles außerhalb dieses Sets - benutzerdefinierte Initramfs-Hooks unter <code>/etc/initramfs-tools/hooks/</code>, nicht auf der weißen Liste stehende Dateien unter <code>/etc/modprobe.d/</code>, vom Benutzer verfasste systemd-Unit-Overrides - bleibt ausgeschlossen. Der Grund dafür ist konkret: Diese Dateien können Kernel-interne Schnittstellen (Modul-APIs, <code>/sys</code>-Layout, <code>udev</code>-Hooks) aufrufen, die zwischen den Hauptversionen wechseln, und ihre wörtliche Anwendung auf den neueren Kernel kann das Booten des Ziels verhindern. Wenn eine exakte Reproduktion der Bootkette erforderlich ist, muss die Wiederherstellung auf einem Host mit der gleichen Hauptkernelversion wie das Backup ausgeführt werden."
+  },
+  "codeReference": {
+    "heading": "Wo die Mechanismen leben",
+    "intro": "Für Entwickler, die das Cross-Kernel-Verhalten verfolgen oder erweitern möchten:",
+    "rows": [
+      {
+        "component": "Richtungserkennung",
+        "location": "<code>hb_compat_check</code> in <code>lib_host_backup_common.sh</code>. Setzt <code>HB_COMPAT_KERNEL_DIRECTION</code>."
+      },
+      {
+        "component": "Liste sicherer Teilstrecken",
+        "location": "<code>hb_unsafe_paths_cross_version</code> in <code>lib_host_backup_common.sh</code>. Sendet <code>path\\treason</code>-Linien aus, die sowohl vom CLI-Filter als auch vom Web-Endpunkt <code>/api/host-backups/restore/prepare</code> verwendet werden."
+      },
+      {
+        "component": "Hydratationsphasen",
+        "location": "<code>_rs_hyd_grub</code>, <code>_rs_hyd_kernel_cmdline</code>, <code>_rs_hyd_modules</code>, <code>_rs_hyd_files</code> in <code>backup_host.sh</code>. Orchestriert von <code>_rs_apply_bk_older_hydration</code>."
+      },
+      {
+        "component": "Neubildung nach dem Booten erzwingen",
+        "location": "<code>apply_pending_restore.sh</code> liest <code>HB_HYDRATION_APPLIED</code> von <code>plan.env</code> und zwingt <code>NEEDS_INITRAMFS=1</code>/<code>NEEDS_GRUB=1</code>."
+      },
+      {
+        "component": "Web Preview",
+        "location": "<code>/api/host-backups/restore/prepare</code> in <code>flask_server.py</code>. Lädt die Hilfsbibliothek, führt <code>_rs_apply_bk_older_hydration</code> im Planmodus aus und gibt die Aktionen an den Webmodal zurück."
+      }
+    ]
+  },
+  "whereNext": {
+    "heading": "Wohin Sie als nächstes gehen",
+    "items": [
+      {
+        "label": "Wiederherstellung",
+        "href": "/docs/backup-restore/restoring",
+        "tail": "— die vollständige Wiederherstellungspipeline der Mechanismen dieser Seite."
+      },
+      {
+        "label": "Wie es funktioniert",
+        "href": "/docs/backup-restore/how-it-works",
+        "tail": " — Manifest und Erfassungsroutinen, die den von der Ergänzung gelesenen Block <code>kernel_params</code> erzeugen."
+      }
+    ]
+  }
+}
diff --git a/web/messages/de/docs/backup-restore/destinations/borg.json b/web/messages/de/docs/backup-restore/destinations/borg.json
new file mode 100644
index 00000000..1f4fea6f
--- /dev/null
+++ b/web/messages/de/docs/backup-restore/destinations/borg.json
@@ -0,0 +1,234 @@
+{
+  "meta": {
+    "title": "Borg-Ziel — Repository-Typen, SSH-Authentifizierung, Verschlüsselung | ProxMenux",
+    "description": "Das Borg-Ziel speichert ProxMenux-Host-Backups in einem Borg-Repository: lokal, auf einem eingehängten externen Datenträger oder auf einem per SSH erreichbaren Server. Beschrieben werden die Suche nach der ausführbaren borg-Datei, die vier anfänglichen SSH-Schlüsseloptionen, repokey-Verschlüsselung, gespeicherte Ziele und Aufbewahrungsregeln je geplantem Auftrag.",
+    "ogTitle": "ProxMenux Backup — Zielort Borg",
+    "ogDescription": "So speichert ProxMenux Host-Backups in Borg-Repositories mit SSH-Authentifizierung und repokey-Verschlüsselung.",
+    "twitterTitle": "Borg Backup Ziel | ProxMenux",
+    "twitterDescription": "Lokale, USB- und SSH-gestützte Borg-Repositories für Host-Backups."
+  },
+  "header": {
+    "title": "Borg",
+    "description": "Das Borg-Ziel schreibt Host-Backups in ein Borg-Repository. Es werden drei Repository-Typen unterstützt: lokaler Dateisystempfad, eingehängte externe Festplatte oder Remote-Server über SSH. Chunk-Level-Deduplizierung über alle Archive im Repository und optionale Repokey-Verschlüsselung.",
+    "section": "Sicherung und Wiederherstellung"
+  },
+  "aboutBorg": {
+    "heading": "Was Borg ist",
+    "body": "Borg (auch BorgBackup geschrieben) ist ein Open-Source-Deduplizierungs-Backup-Tool, das von der Borg Backup-Community verwaltet wird. Es speichert jedes Archiv als eine Reihe von Blöcken variabler Länge in einem Repository; Blöcke werden über Archive hinweg geteilt, so dass das erneute Sichern unveränderter Daten nahezu Null Speicherkosten verursacht. Borg ist nicht an Proxmox gebunden - es ist ein universelles Backup-Tool, das in vielen Umgebungen verwendet wird. ProxMenux verwendet es als eines der drei Ziele für Host-Backups; jeder auf dieser Seite beschriebene Borg-spezifische Mechanismus (Repository-Typen, borg-serve über SSH, Repokey-Verschlüsselung, prune) ist Standard-Borg-Verhalten."
+  },
+  "intro": {
+    "title": "Chunk-basierte Deduplizierung mit lokalen oder SSH-servierten Repositorys",
+    "body": "Ein Borg-Repository speichert Brocken, die in jedem enthaltenen Archiv geteilt werden, so dass das erneute Sichern einer unveränderten Datei nichts Neues überträgt und speichert. ProxMenux ruft <code>borg create</code> zum Backup-Zeitpunkt und <code>borg extract</code> zum Wiederherstellungszeitpunkt gegen ein Repository auf. Das Repository kann auf demselben Dateisystem wie die Quelle, auf einer montierten externen Festplatte oder auf einem Remote-Host, auf den über SSH zugegriffen wird, leben."
+  },
+  "binarySourcing": {
+    "heading": "Die ausführbare borg-Datei",
+    "intro": "Borg ist keine Basisabhängigkeit des ProxMenux-Installationsprogramms. Wenn ein Backup ausgeführt wird, löst <code>hb_ensure_borg</code> die Binärdatei in der Reihenfolge aus vier Quellen auf und gibt die erste zurück, die funktioniert:",
+    "rows": [
+      {
+        "priority": "1",
+        "source": "Systemweites <code>borg</code>",
+        "detail": "Wenn der Host bereits <code>borg</code> über APT installiert hat (<code>which borg</code> löst auf), wird diese Binärdatei verwendet."
+      },
+      {
+        "priority": "2",
+        "source": "State-Dir-Cache",
+        "detail": "<code>/usr/local/share/proxmenux/borg</code> — aus einem früheren GitHub-Download auf diesem Host aufbewahrt."
+      },
+      {
+        "priority": "3",
+        "source": "AppImage-Paket des Monitors",
+        "detail": "<code>/usr/local/share/proxmenux/monitor-app/usr/bin/borg</code> — der AppImage bündelt einen signierten borg-linux64. Dies ist der offline-sichere Pfad: Ein Host ohne Internet hat immer noch einen funktionierenden <code>borg</code>."
+      },
+      {
+        "priority": "4",
+        "source": "GitHub Download",
+        "detail": "<code>wget</code> gegen die angepinnte <code>borg-linux64</code>-URL unter <code>github.com/borgbackup/borg/releases/</code>, verifiziert gegen eine Konstante SHA-256 in <code>lib_host_backup_common.sh</code> (<code>HB_BORG_LINUX64_SHA256</code>). Bei Checksummenfehlanpassung wird die Binärdatei verworfen und das Backup abgebrochen. Die heruntergeladene Datei wird im State Dir zwischengespeichert, so dass nachfolgende Backups den Pfad 2 verwenden."
+      }
+    ]
+  },
+  "repoTypes": {
+    "heading": "Repository-Typen",
+    "intro": "Der Repository-Typ wird ausgewählt, wenn ein Ziel hinzugefügt wird. Jeder Typ löst sich in einer anderen Repository-URL auf, die Borg versteht.",
+    "rows": [
+      {
+        "type": "remote",
+        "url": "ssh://USER@HOST/RPATH",
+        "detail": "Repository lebt auf einem Remote-Server, auf dem <code>borg serve</code> ausgeführt wird. Erfordert eine SSH-Verbindung zu diesem Server."
+      },
+      {
+        "type": "usb",
+        "url": "/mnt/MOUNTPOINT/borgbackup",
+        "detail": "Repository lebt auf einer montierten externen Festplatte (normalerweise USB). Die Mount wird über <code>hb_prompt_mounted_path</code> aufgelöst, das USB-Partitionen nach Bedarf erkennt, einhängt oder formatiert."
+      },
+      {
+        "type": "local",
+        "url": "/backup/borgbackup (any absolute path)",
+        "detail": "Repository lebt in einem lokalen Verzeichnis. Bedeutsam nur, wenn sich das Zielverzeichnis auf einer separaten physischen Festplatte befindet – ein Repository auf derselben Festplatte wie die Quelle schützt vor Operatorfehlern, aber nicht vor Festplattenausfällen."
+      }
+    ]
+  },
+  "serverSetup": {
+    "heading": "Vorbereitung des Borg-Servers (Serverseite)",
+    "intro": "Der Repository-Typ <code>remote</code> setzt einen funktionierenden, per SSH erreichbaren Borg-Server voraus. ProxMenux richtet den Server nicht selbst ein; es autorisiert nur einen Schlüssel für ein vorhandenes Konto. Dieser Abschnitt beschreibt, was der Server vor der Verbindung benötigt.",
+    "hostChoicesTitle": "Wo der Server leben kann",
+    "hostChoicesBody": "Jeder Linux-Host mit SSH-Zugang ist qualifiziert. Gemeinsame Setups:",
+    "hostChoicesItems": [
+      "Eine dedizierte NAS- oder Backup-Box (Debian, Ubuntu, TrueNAS SCALE mit einer Shell).",
+      "Ein LXC Container in einem Proxmox Knoten. Kleiner Footprint, isoliert vom Host, der die Backups ausführt.",
+      "Ein anderer Proxmox-Host im selben LAN oder ein VM, der über SSH erreichbar ist."
+    ],
+    "lxcWarningTitle": "LXC als Borg-Server",
+    "lxcWarningBody": "Läuft der Borg-Server in einem LXC, benötigt generate-auto zur Schlüsselinstallation ein Konto, das SSH-Passwortanmeldung erlaubt. Ist diese nicht verfügbar, verwenden Sie die manuelle Installation oder generate-pct über den PVE-Host.",
+    "requirementsTitle": "Anforderungen an den Server",
+    "requirementsRows": [
+      {
+        "requirement": "Ausführbare borg-Datei unter <code>/usr/bin/borg</code>",
+        "detail": "Die Zeile <code>command=\"/usr/bin/borg serve ...\"</code>, die ProxMenux in <code>authorized_keys</code> einträgt, verwendet diesen festen Pfad. APT (<code>apt install borgbackup</code>) installiert das Programm dort. Für eine separat installierte Binärdatei ist ein symbolischer Link unter <code>/usr/bin/borg</code> nötig."
+      },
+      {
+        "requirement": "Ein dediziertes Benutzerkonto (normalerweise <code>borg</code>)",
+        "detail": "Besitzt das Repository-Verzeichnis und empfängt eingehende SSH-Verbindungen. Benötigt keinen sudo- oder shell-zugriff - die authorized_keys-linie deaktiviert interaktive shells sowieso."
+      },
+      {
+        "requirement": "Ein beschreibbares Repository Verzeichnis",
+        "detail": "Der vom Betreiber angegebene Pfad ProxMenux (z. B. <code>/backup/borgbackup</code>) muss auf dem Server vorhanden sein und im Besitz des borg-Benutzers sein."
+      },
+      {
+        "requirement": "SSH Daemon akzeptiert den Borg-Benutzer",
+        "detail": "<code>PubkeyAuthentication yes</code> (Standard). Die Passwort-Authentifizierung wird nur für den One-Shot <em>generate-auto</em>-Flow benötigt – nachdem der Schlüssel installiert wurde, kann der Server das Passwort auth vollständig deaktivieren."
+      }
+    ],
+    "minimalSetupTitle": "Minimale Server-Einrichtung",
+    "minimalSetupBody": "Auf einem Debian- oder Ubuntu-Borg-Server besteht eine Arbeitsbasislinie aus vier Befehlen als root:",
+    "minimalSetupCmd": "apt install borgbackup\nuseradd -m -d /home/borg -s /bin/bash borg\nmkdir -p /backup/borgbackup\nchown borg:borg /backup/borgbackup",
+    "minimalSetupNote": "Sind Server und SSH-Passwortanmeldung vorbereitet, installiert <code>generate-auto</code> den Schlüssel über ein Konto mit Schreibzugriff auf die authorized_keys-Datei des borg-Benutzers. Spätere Backups verwenden diesen auf <code>borg serve</code> am konfigurierten Pfad beschränkten Schlüssel. Ohne Passwortanmeldung wird er manuell oder über den PVE-Host installiert."
+  },
+  "sshAuth": {
+    "heading": "SSH-Authentifizierung (Clientseite)",
+    "intro": "Remote-Borg-Repositories sind über SSH zugänglich. Die Verbindung läuft vom ProxMenux-Host zu einem Benutzerkonto auf dem Borg-Server, auf dem <code>borg serve</code> ausgeführt wird. Dieser Benutzer heißt normalerweise <code>borg</code>, NICHT der Admin / Root-Benutzer des Servers - die Befehlszeile borg-serve sperrt die Verbindung zu diesem spezifischen Repository-Pfad (siehe die wichtigsten Strategien unten).",
+    "strategiesTitle": "SSH-Schlüsselstrategien",
+    "strategiesIntro": "Beim Hinzufügen eines entfernten Ziels fragt ProxMenux nach SSH-Benutzer, Host, Port und entferntem Pfad und bietet vier Anmeldeoptionen. Wird die Passwortanmeldung abgewiesen, steht zusätzlich generate-pct zur Wahl. Die Modi sind unten beschrieben:",
+    "strategyRows": [
+      {
+        "mode": "generate-auto",
+        "label": "Empfohlen",
+        "detail": "ProxMenux erzeugt oder verwendet ein ed25519-Schlüsselpaar unter <code>~/.ssh/borg_proxmenux_HOST_ed25519</code>. Mit <code>sshpass</code> prüft es die Anmeldung und installiert den öffentlichen Schlüssel in <code>~borg/.ssh/authorized_keys</code>. Das Passwort gehört zu einem Konto mit Schreibzugriff auf diese Datei, meist root oder borg. Es wird nur bei der Einrichtung verwendet und nicht gespeichert."
+      },
+      {
+        "mode": "generate-manual",
+        "label": "Kein Admin-Passwort auf diesem Host",
+        "detail": "ProxMenux generiert das Keypair wie oben, zeigt aber die vollständige <code>authorized_keys</code>-Zeile an, die der Betreiber manuell in den Server einfügen kann. Das Admin-Passwort verlässt niemals den ProxMenux-Host, weil es nie angefordert wird."
+      },
+      {
+        "mode": "generate-pct",
+        "label": "Borg Server ist ein PVE LXC",
+        "detail": "Der Borg-Server läuft innerhalb eines LXC auf einem PVE-Knoten. ProxMenux autorisiert den Schlüssel über <code>pct exec</code> vom PVE-Host - root auf dem PVE-Host schreibt in den <code>~borg/.ssh/authorized_keys</code> des LXC, ohne dass SSH selbst in den LXC benötigt wird."
+      },
+      {
+        "mode": "existing",
+        "label": "Verwenden Sie einen vorhandenen Schlüssel",
+        "detail": "ProxMenux scannt <code>/root/.ssh/</code> und <code>$HOME/.ssh/</code> nach Parseable ed25519/RSA Private Keys und listet diese auf. Der Bediener wählt einen oder durchsucht manuell einen nicht standardmäßigen Pfad."
+      },
+      {
+        "mode": "none",
+        "label": "Standard SSH-Konfiguration",
+        "detail": "Kein benutzerdefinierter Schlüssel - Borg stützt sich auf die standardmäßige SSH-Konfiguration des Hosts (normalerweise <code>~/.ssh/id_rsa</code> oder ein SSH-Agent)."
+      }
+    ],
+    "restrictTitle": "Die authorized_keys Linie",
+    "restrictBody": "Für jeden erzeugten Schlüssel beschränkt die von ProxMenux auf dem Server eingetragene <code>authorized_keys</code>-Zeile den Zugriff auf den folgenden borg-serve-Aufruf für den konfigurierten Repository-Pfad:",
+    "restrictLine": "command=\"/usr/bin/borg serve --restrict-to-path RPATH\",restrict PUBKEY",
+    "restrictNote": "Der <code>command=</code> zwingt jede SSH-Sitzung mit diesem Schlüssel, nur den Befehl borg-serve auszuführen; <code>restrict</code> deaktiviert die Portweiterleitung, die Agentenweiterleitung, die X11-Weiterleitung und die PTY-Zuweisung. Der Schlüssel kann nicht verwendet werden, um eine interaktive Shell auf dem Server zu öffnen oder auf einen anderen Repository-Pfad zuzugreifen, selbst wenn das Konto über breitere Privilegien verfügt."
+  },
+  "savedTargets": {
+    "heading": "Gespeicherte Ziele",
+    "intro": "Ein gespeichertes Ziel hält die Repository-Konfiguration unter einem verständlichen Namen fest, damit die Angaben nicht erneut eingegeben werden müssen. Dateien im ProxMenux-Zustandsverzeichnis:",
+    "rows": [
+      {
+        "file": "borg-targets.txt",
+        "content": "Eine Zeile je Ziel: <code>NAME|REPO|SSH_KEY_PATH|ENCRYPT_MODE</code>. <code>hb_collect_borg_configs</code> liest sie ein, um das Zielauswahlmenü zu füllen."
+      },
+      {
+        "file": "borg-pass-NAME.txt",
+        "content": "Passphrase des oben mit NAME benannten Ziels (<code>chmod 600</code>). Nur bei gewählter repokey-Verschlüsselung vorhanden."
+      }
+    ],
+    "outro": "Das Speichern des Ziels ist optional. Bei Ablehnung wird keine benannte Zielkonfiguration gespeichert; ein erzeugter SSH-Schlüssel wird jedoch nicht entfernt. Bei repokey-Verschlüsselung ohne gespeichertes Ziel legt ProxMenux die Passphrase weiterhin in der älteren Datei borg-pass.txt ab."
+  },
+  "encryption": {
+    "heading": "Verschlüsselung",
+    "body": "Repositories werden mit einem Verschlüsselungsmodus über <code>hb_borg_init_if_needed</code> initialisiert: das moderne <code>borg repo-create -e MODE</code>, wenn verfügbar, oder das alte <code>borg init --encryption=MODE</code>. ProxMenux zeigt zwei Modi: <code>repokey</code> (Standard) und <code>none</code>. Im <code>repokey</code>-Modus speichert Borg den Verschlüsselungsschlüssel im Repository selbst; der Zugriff erfordert eine Passphrase, die ProxMenux zweimal mit Übereinstimmungsvalidierung anfordert und für gespeicherte Ziele unter <code>borg-pass-NAME.txt</code> speichert, sonst in der oben beschriebenen älteren Datei. Ein obligatorischer Bestätigungsdialog wird angezeigt, nachdem die Passphrase gespeichert wurde: Die Passphrase ist die einzige Möglichkeit, auf die verschlüsselten Archive zuzugreifen, und wenn sie verloren geht, ist jedes Archiv im Repository nicht wiederherstellbar."
+  },
+  "runtimeEnv": {
+    "heading": "Laufzeitumgebung",
+    "intro": "ProxMenux exportiert die folgenden Umgebungsvariablen, bevor <code>borg</code> aufgerufen wird. Sie konfigurieren die Verbindung und entsperren das Repository, ohne Geheimnisse in die Kommandozeile einzubetten.",
+    "rows": [
+      {
+        "var": "BORG_RSH",
+        "value": "ssh -i SSH_KEY_PATH -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new [-p PORT]",
+        "purpose": "Remote-Shell-Befehl für Borg-Repositories über SSH. Ein gewählter Schlüssel ergänzt die Identitätsoptionen. Wird ein Ziel erstmals mit einem abweichenden Port hinzugefügt, ergänzt ProxMenux zusätzlich -p PORT; gespeicherte Ziele, geplante Aufträge und der Monitor verwenden stattdessen den Port aus der ssh://-URL. Ohne eigenen Schlüssel und bei einem neuen Ziel mit Standardport bleibt die Variable ungesetzt; Borg nutzt dann die SSH-Vorgaben des Hosts."
+      },
+      {
+        "var": "BORG_PASSPHRASE",
+        "value": "(Passphrase von borg-pass-NAME.txt)",
+        "purpose": "Entsperrt den Repokey. Setzen Sie nur, wenn das Ziel <code>repokey</code>-Verschlüsselung verwendet. Erscheint nie in der Prozessargumentenliste."
+      },
+      {
+        "var": "BORG_ENCRYPT_MODE",
+        "value": "repokey | none",
+        "purpose": "Wird von <code>hb_borg_init_if_needed</code> bei der Initialisierung eines noch nicht vorhandenen Repositorys verwendet. Ignoriert von <code>borg create</code> auf bestehenden Repositories."
+      },
+      {
+        "var": "BORG_RELOCATED_REPO_ACCESS_IS_OK",
+        "value": "yes",
+        "purpose": "Unterdrückt die interaktive Eingabeaufforderung, die Borg aufruft, wenn die Repository-URL von der URL abweicht, von der sie ursprünglich erreicht wurde (üblich nach einem Rename für einen Mount-Point oder SSH-Host, der über eine neue Adresse erreichbar ist)."
+      },
+      {
+        "var": "BORG_UNKNOWN_UNENCRYPTED_REPO_ACCESS_IS_OK",
+        "value": "yes",
+        "purpose": "Unterdrückt die interaktive Eingabeaufforderung, die Borg beim ersten Zugriff auf ein unverschlüsseltes Repository von einem neuen Client aus erstellt."
+      }
+    ]
+  },
+  "archiveFormat": {
+    "heading": "Bezeichnung und Aufbewahrung des Archivs",
+    "intro": "Jedes Backup erstellt ein neues Archiv im Repository.",
+    "namePattern": "hostcfg-HOSTNAME-YYYYMMDD_HHMMSS",
+    "retentionBody": "Für geplante Aufträge führt <code>run_scheduled_backup.sh</code> <code>borg prune</code> nach jedem erfolgreichen Backup mit den für den Auftrag konfigurierten Retentionswerten (<code>--keep-last</code>, <code>--keep-daily</code>, <code>--keep-weekly</code>) gegen das Repository aus. Interaktive Backups beschneiden nicht."
+  },
+  "restoreAccess": {
+    "heading": "Abruf auf der Wiederherstellungsseite",
+    "body": "Die Wiederherstellung listet Archive mit <code>borg list REPO</code> auf und entpackt das gewählte Archiv mit <code>borg extract REPO::ARCHIVE-NAME</code> in ein Vorbereitungsverzeichnis. <code>_rs_check_layout</code> übergibt dieses an den normalen Wiederherstellungsablauf. Dieselben Befehle funktionieren auch manuell außerhalb von ProxMenux. Der entpackte Verzeichnisbaum entspricht der in <em>So funktioniert es</em> beschriebenen Struktur aus drei Datenblöcken."
+  },
+  "references": {
+    "heading": "Referenzen",
+    "intro": "Offizielle Borg-Dokumentation zu den Komponenten, auf die ProxMenux aufbaut.",
+    "items": [
+      {
+        "label": "Borg-Dokumentation",
+        "href": "https://borgbackup.readthedocs.io/",
+        "tail": "— Haupteinstiegspunkt für Konzepte, Bereitstellung, Schnellstart und jeden Befehl."
+      },
+      {
+        "label": "borg create",
+        "href": "https://borgbackup.readthedocs.io/en/stable/usage/create.html",
+        "tail": " — der Befehl, den ProxMenux für jedes Backup aufruft, mit allen unterstützten Optionen."
+      },
+      {
+        "label": "Datenspeicherverschlüsselung",
+        "href": "https://borgbackup.readthedocs.io/en/stable/usage/init.html#encryption-mode",
+        "tail": "- die Verschlüsselungsmodi, die Borg unterstützt, einschließlich Repokey, den ProxMenux standardmäßig verwendet."
+      },
+      {
+        "label": "borg serve und Bereitstellung über SSH",
+        "href": "https://borgbackup.readthedocs.io/en/stable/deployment/central-backup-server.html",
+        "tail": " - wie man einen zentralen Borg-Server einrichtet, auf den über SSH zugegriffen wird, einschließlich des borg-serve-Befehls und des restrict-to-path-Flags ProxMenux schreibt in authorized_keys."
+      },
+      {
+        "label": "borg prune",
+        "href": "https://borgbackup.readthedocs.io/en/stable/usage/prune.html",
+        "tail": "— das Retentionsmodell hinter --keep-last / --keep-daily / --keep-weekly, das ProxMenux pro geplantem Auftrag anwendet."
+      }
+    ]
+  }
+}
diff --git a/web/messages/de/docs/backup-restore/destinations/index.json b/web/messages/de/docs/backup-restore/destinations/index.json
new file mode 100644
index 00000000..1654efab
--- /dev/null
+++ b/web/messages/de/docs/backup-restore/destinations/index.json
@@ -0,0 +1,110 @@
+{
+  "meta": {
+    "title": "Backup-Ziele — Lokal, Proxmox Backup Server, Borg | ProxMenux",
+    "description": "Drei Storage-Backends erhalten die gleiche ProxMenux Backup-Nutzlast: ein lokales .tar.zst-Archiv auf jedem beschreibbaren Dateisystem, ein PBS-Backup in einem Proxmox Backup Server-Datenspeicher oder ein Borg-Archiv in einem lokalen oder entfernten Borg-Repository. Jedes Backend hat seine eigenen Kompressions-, Deduplizierungs-, Verschlüsselungs- und Netzwerkeigenschaften.",
+    "ogTitle": "ProxMenux Backup-Ziele",
+    "ogDescription": "Local, Proxmox Backup Server und Borg – drei Storage-Backends für die gleiche Host-Backup-Nutzlast.",
+    "twitterTitle": "ProxMenux Backup Ziele | ProxMenux",
+    "twitterDescription": "Lokales Archiv, Proxmox Backup Server und Borg Backends für Host-Backups."
+  },
+  "header": {
+    "title": "Ziele",
+    "description": "Drei Storage Backends, die von ProxMenux Backup unterstützt werden: lokales Archiv, Proxmox Backup Server (empfohlen) und Borg. Jeder erhält das gleiche Drei-Nutzlast-Archiv; sie unterscheiden sich in Speicherformat, Deduplizierung, Verschlüsselungsmodell und Netzwerkanforderungen.",
+    "section": "Sicherung und Wiederherstellung"
+  },
+  "intro": {
+    "title": "Gleiche Nutzlast, drei Backends",
+    "body": "Jedes Backup erzeugt die gleichen drei Nutzlasten (Rootfs, Manifest, Anwendungen). Was sich zwischen Zielen ändert, ist, wie diese Nutzlasten gespeichert werden und wie der Betreiber sie für eine Wiederherstellung abruft. Jedes Backend wird als separate Funktion in <code>backup_host.sh</code> - <code>_bk_local</code>, <code>_bk_pbs</code>, <code>_bk_borg</code> - implementiert, aber alle drei haben den gleichen Staging-Schritt (<code>hb_prepare_staging</code>) und den gleichen Wiederherstellungscodepfad. Die Wahl des Ziels betrifft nur das Schreiben und den Abruf; es ändert nicht, was eine Wiederherstellung tut oder wie sie das Archiv verbraucht."
+  },
+  "comparison": {
+    "heading": "Merkmalsvergleich",
+    "intro": "Die folgende Tabelle listet die konkreten Unterschiede zwischen den drei Backends auf, wie sie sich heute in ProxMenux verhalten. Alle Werte beschreiben das beobachtete Verhalten des Backends selbst, nicht redaktionelle Empfehlungen.",
+    "rows": [
+      {
+        "feature": "Speicherformat",
+        "local": "Einzelne <code>.tar.zst</code>-Datei (oder <code>.tar.gz</code>, wenn <code>zstd</code> fehlt).",
+        "pbs": "PBS Backup (<code>.pxar</code> Chunks im Datenspeicher).",
+        "borg": "Borg-Archiv in einem Borg-Repository (Segmentdateien)."
+      },
+      {
+        "feature": "Kompression",
+        "local": "zstd (Standardstufe) über <code>tar --zstd</code>. gzip Fallback.",
+        "pbs": "Von proxmox-backup-client verwaltet. ProxMenux überschreibt die Kompressionseinstellungen nicht.",
+        "borg": "In Borg integrierte Kompression. ProxMenux ruft borg create auf, ohne die Kompressionseinstellungen zu überschreiben."
+      },
+      {
+        "feature": "Deduplizierung",
+        "local": "Keine. Jedes Backup ist ein vollständiges unabhängiges Archiv.",
+        "pbs": "Vollständige Chunk-Level-Deduplizierung über alle Backups im Datenspeicher.",
+        "borg": "Vollständige Chunk-Level-Deduplizierung über alle Archive im Repository."
+      },
+      {
+        "feature": "Verschlüsselung im Ruhezustand",
+        "local": "Keine (Verlässt sich auf den Schutz auf Dateisystemebene).",
+        "pbs": "Optionale clientseitige Keyfile-Verschlüsselung. Recovery-Blob als separate Backup-Gruppe hochgeladen, wenn aktiviert.",
+        "borg": "Optionale Repokey-Verschlüsselung (Schlüssel im Repo gespeichert, durch eine Passphrase freigeschaltet)."
+      },
+      {
+        "feature": "Aufbewahrung / Bereinigung",
+        "local": "Wird pro geplantem Auftrag über <code>KEEP_LAST</code> angewendet. Alte Archive werden zusammen mit ihren Begleitdateien und Ausführungsprotokollen gelöscht. Interaktive Backups führen keine Bereinigung aus.",
+        "pbs": "Angewendet pro geplanten Auftrag über <code>proxmox-backup-client prune --keep-last / --keep-daily / --keep-weekly</code>. Interaktive Backups führen keine Bereinigung aus.",
+        "borg": "Angewendet pro geplanten Auftrag über <code>borg prune --keep-last / --keep-daily / --keep-weekly</code>. Interaktive Backups führen keine Bereinigung aus."
+      },
+      {
+        "feature": "Netzwerk",
+        "local": "Keine. Schreibt auf einen lokalen Einhängepunkt (normalerweise eine interne Festplatte oder ein USB-Laufwerk).",
+        "pbs": "TCP auf den PBS-Server (Standardport 8007). Erfordert PBS Anmeldeinformationen + Fingerabdruck.",
+        "borg": "Lokaler Dateisystempfad oder SSH Tunnel zu einem entfernten Borg-Host."
+      },
+      {
+        "feature": "Abhängigkeiten",
+        "local": "<code>tar</code>, <code>zstd</code> (standardmäßig auf Proxmox vorhanden).",
+        "pbs": "<code>proxmox-backup-client</code> Paket (gebündelt mit Proxmox VE 8+).",
+        "borg": "<code>borg</code> binär. Automatische Bereitstellung durch ProxMenux aus dem Monitor AppImage-Bundle, wenn es fehlt."
+      },
+      {
+        "feature": "Zugriff für die Wiederherstellung",
+        "local": "Jeder Host mit tar+zstd kann das Archiv extrahieren. Keine PBS/Borg erforderlich.",
+        "pbs": "Erfordert <code>proxmox-backup-client</code> + PBS Anmeldeinformationen + die Schlüsseldatei (falls verschlüsselt).",
+        "borg": "Erfordert <code>borg</code> + den Repository-Pfad + die Passphrase (falls verschlüsselt)."
+      }
+    ],
+    "captionCode": "feature",
+    "captionLocal": "Lokal",
+    "captionPbs": "Proxmox Backup Server (empfohlen)",
+    "captionBorg": "Borg"
+  },
+  "sameArchive": {
+    "heading": "Das Archivlayout ändert sich nicht mit dem Ziel",
+    "body": "Innerhalb eines der drei Ziele ist das gleiche <code>rootfs/</code> + <code>metadata/</code> + <code>manifest.json</code> Layout vorhanden, das in <em>Funktionsweise</em> beschrieben wird. Ein aus einem lokalen Archiv extrahierter <code>.tar.zst</code>, ein aus PBS wiederhergestellter <code>.pxar</code> und ein mit <code>borg extract</code> extrahiertes Borg-Archiv ergeben alle einen identischen Verzeichnisbaum. Der Wiederherstellungscodepfad (<code>_rs_check_layout</code>, <code>_rs_apply</code>, <code>_rs_prepare_pending_restore</code>) liest die gleichen drei Nutzlasten, ohne zu wissen, von welchem Ziel sie kamen."
+  },
+  "extractStandalone": {
+    "heading": "Extrahieren eines Backups außerhalb von ProxMenux",
+    "intro": "Jedes der drei Archivformate kann mit Standardtools gelesen werden, ohne dass ProxMenux auf dem Lesehost installiert ist. Die folgenden Befehle erzeugen den gleichen Verzeichnisbaum, den eine Wiederherstellung intern verbraucht.",
+    "localCmd": "# From a local .tar.zst archive:\ntar --zstd -xf hostcfg-HOST-TIMESTAMP.tar.zst\n\n# From a .tar.gz fallback:\ntar -xzf hostcfg-HOST-TIMESTAMP.tar.gz",
+    "pbsCmd": "# From a PBS backup (requires proxmox-backup-client):\nproxmox-backup-client restore \\\n    --repository USER@REALM@HOST:DATASTORE \\\n    host/hostcfg-HOST/BACKUP-TIME \\\n    hostcfg.pxar /tmp/hostcfg\n\n# Add --keyfile KEY-PATH when the backup is encrypted.",
+    "borgCmd": "# Aus einem Borg-Archiv (benötigt borg und bei verschlüsselten Repositories die Passphrase):\nborg extract REPO-PATH::ARCHIVE-NAME\n\n# Bei einem über SSH erreichbaren entfernten Repository:\nborg extract ssh://USER@HOST:PORT/REPO-PATH::ARCHIVE-NAME",
+    "note": "Der extrahierte Baum kann dann manuell inspiziert oder einer manuellen Wiederherstellung zugeführt werden. Sehen Sie sich die einzelnen Zielseiten für den genauen Abruffluss an, den ProxMenux unter der Haube verwendet."
+  },
+  "whereNext": {
+    "heading": "Details je Ziel",
+    "intro": "Jedes Ziel hat eine eigene Seite, die den Konfigurationsfluss, das On-Disk-Format und den von der Wiederherstellung verwendeten Abrufbefehl abdeckt.",
+    "items": [
+      {
+        "label": "Lokales Archiv",
+        "href": "/docs/backup-restore/destinations/local",
+        "tail": " — Vorkonfiguration eines lokalen Ziels, Einhängen von USB-Laufwerken, Schutz vor dem Einschließen des Archivs in sich selbst und die JSON-Begleitdatei zur Erkennung im Monitor."
+      },
+      {
+        "label": "Proxmox Backup Server (empfohlen)",
+        "href": "/docs/backup-restore/destinations/pbs",
+        "tail": "Datenspeicherauswahl, Anmeldeinformationen und Fingerabdruck, Verschlüsselungs-Keyfile-Lebenszyklus, Recovery-Passphrase, Hochladen des Recovery-Blobs zu PBS für die Wiederherstellung mit frischer Installation."
+      },
+      {
+        "label": "Borg",
+        "href": "/docs/backup-restore/destinations/borg",
+        "tail": " — lokale und über SSH erreichbare Repositories, Bezugsquellen der Borg-Binärdatei (System / Cache / Monitor-AppImage-Bundle / GitHub-Download), Repository-Initialisierung, Umgang mit Passphrasen und SSH-Schlüssel für entfernte Repositories."
+      }
+    ]
+  }
+}
diff --git a/web/messages/de/docs/backup-restore/destinations/local.json b/web/messages/de/docs/backup-restore/destinations/local.json
new file mode 100644
index 00000000..eff0a73d
--- /dev/null
+++ b/web/messages/de/docs/backup-restore/destinations/local.json
@@ -0,0 +1,75 @@
+{
+  "meta": {
+    "title": "Lokales Archivziel — tar.zst auf einem Dateisystem oder USB-Laufwerk | ProxMenux",
+    "description": "Das lokale Sicherungsziel schreibt ein einzelnes .tar.zst-Archiv in ein beliebiges beschreibbares Verzeichnis: auf eine interne Festplatte, einen Proxmox-Mountpoint, eine NFS-Freigabe oder ein USB-Laufwerk. Diese Seite beschreibt die Einrichtung, das Erkennen und Einbinden von USB-Laufwerken, den Schutz vor dem Speichern des Archivs in einem selbst gesicherten Pfad und die zugehörige JSON-Datei zur Identifizierung der Sicherung.",
+    "ogTitle": "ProxMenux Backup — Ziel des lokalen Archivs",
+    "ogDescription": "Wie ProxMenux lokale Backups als .tar.zst-Archive schreibt und wie man das Zielverzeichnis oder das USB-Laufwerk konfiguriert.",
+    "twitterTitle": "Lokales Backup-Ziel | ProxMenux",
+    "twitterDescription": "Wie ProxMenux lokale Backups als .tar.zst-Archive auf ein Dateisystem oder USB-Laufwerk schreibt."
+  },
+  "header": {
+    "title": "Lokales Archiv",
+    "description": "Das lokale Sicherungsziel schreibt ein einzelnes komprimiertes tar-Archiv in ein beliebiges beschreibbares Verzeichnis auf dem Host: auf eine interne Festplatte, einen NFS- oder SMB-Mount oder ein USB-Laufwerk.",
+    "section": "Sicherung und Wiederherstellung"
+  },
+  "intro": {
+    "title": "Eine Datei, in sich geschlossen",
+    "body": "Ein lokales Backup erzeugt eine einzelne <code>hostcfg-HOST-TIMESTAMP.tar.zst</code>-Datei (oder <code>.tar.gz</code>, wenn <code>zstd</code> fehlt). Die Datei enthält den gesamten Archivbaum <code>manifest.json</code>, <code>metadata/</code> und <code>rootfs/</code> und kann auf jedem Proxmox-Host mit dem ProxMenux-Wiederherstellungsfluss wiederhergestellt oder manuell mit <code>tar --zstd -xf</code> auf jedem Linux-System extrahiert werden. Kein Server, kein Repository init, keine externe Abhängigkeit. Dies ist das Ziel mit dem kürzesten Wiederherstellungspfad, wenn weder PBS noch Borg verfügbar sind."
+  },
+  "targetConfig": {
+    "heading": "Konfiguration des Zielverzeichnisses",
+    "intro": "Das lokale Ziel ist ein <strong>einziges dauerhaft gespeichertes Zielverzeichnis</strong> – keine Liste. ProxMenux speichert die Auswahl des Betreibers bei <code>/usr/local/share/proxmenux/local-target.conf</code> und liest sie bei jedem Backup. Wenn kein Ziel konfiguriert wurde, wird der Standard-<code>HB_LOCAL_TARGET_DEFAULT = /var/lib/vz/dump</code> verwendet (das gleiche Verzeichnis, das Proxmox für seine eigenen <code>vzdump</code>-Ausgänge verwendet). Das Ziel wird unter <em>Backup-Ziele konfigurieren → Lokale Ziele</em> konfiguriert:",
+    "options": [
+      "<strong>Standard verwenden (<code>/var/lib/vz/dump</code>).</strong> Der lokale Proxmox-Speicher. Bei jeder Proxmox-Installation vorhanden; das Archiv befindet sich neben den vzdump-Ausgaben und wird automatisch von der Registerkarte Backups des Monitors aufgenommen.",
+      "<strong>Benutzerdefinierten Pfad eingeben.</strong> Jeder absolute Dateisystempfad kann verwendet werden: ein NFS-Mount, eine über <code>fstab</code> eingebundene SMB-Freigabe, ein eigenes ZFS-Dataset oder eine zweite interne Festplatte. ProxMenux prüft vor dem Speichern, ob der Pfad existiert und ein Verzeichnis ist.",
+      "<strong>Wählen Sie ein USB-Laufwerk.</strong> Öffnet das USB-Untermenü (unten), das Wechselgeräte erkennt und ein Gerät montieren oder formatieren kann."
+    ]
+  },
+  "usbFlow": {
+    "heading": "USB-Laufwerkerkennung und -montage",
+    "intro": "Das USB-Untermenü listet Partitionen auf Wechselgeräten auf, die von <code>lsblk</code> gemeldet werden. Jede Partition wird mit ihrer Größe, Dateisystem-Beschriftung und aktuellem Zustand dargestellt. Der Zustand bestimmt die Aktion, die ProxMenux anbietet.",
+    "statesTitle": "Die drei Gerätezustände",
+    "stateRows": [
+      {
+        "state": "eingehängt",
+        "shown": "Größe · Etikett · [fstype] · → /mount/point",
+        "action": "Die Partition ist bereits irgendwo montiert. Bei der Auswahl wird der aktuelle Einhängepunkt als lokales Ziel gespeichert. Es wird kein neuer Mount ausgeführt."
+      },
+      {
+        "state": "nicht montiert",
+        "shown": "Größe · Etikett · [fstype] · (nicht montiert — wird montiert)",
+        "action": "Ein Dateisystem ist vorhanden, aber nicht montiert. Bei Bestätigung führt ProxMenux <code>hb_mount_usb_partition</code> aus: erstellt <code>/mnt/backup-LABEL</code> (oder einen UUID-basierten Pfad, wenn kein Label vorhanden ist), mountet die Partition und speichert den Einhängepunkt als lokales Ziel."
+      },
+      {
+        "state": "leer",
+        "shown": "Größe · unformatierter USB-Datenträger — kein Dateisystem (wird FORMATIERT)",
+        "action": "Das Gerät hat kein Dateisystem. Dieser destruktive Vorgang ist durch zwei Bestätigungen geschützt. Zuerst erklärt ein Ja/Nein-Dialog, dass der Datenträger gelöscht wird. Anschließend muss der Benutzer in einem Eingabefeld <strong>den exakten Gerätepfad eingeben</strong> (z. B. <code>/dev/sdb</code>), bevor ProxMenux eine neue GPT mit ext4-Partition erstellt und diese einhängt."
+      }
+    ],
+    "notMountedFallback": "Wenn kein USB-Gerät erkannt wird, fällt das Untermenü auf eine einfache Eingabebox zurück. Der Bediener kann einen beliebigen Einhängepunktpfad eingeben; wenn der Pfad kein registrierter Einhängepunkt ist, warnt ein Bestätigungsdialog, bevor er fortfährt."
+  },
+  "safetyCheck": {
+    "heading": "Sicherheitsprüfung — Ziel innerhalb eines gesicherten Pfads",
+    "body": "Vor dem Schreiben des Archivs überprüft <code>_bk_local</code>, dass das Zielverzeichnis <strong>nicht</strong> ein Unterpfad eines zu sichernden Verzeichnisses ist. Ein häufiger Fehler wäre das Hinzufügen von <code>/root</code> zum Profil und die Auswahl von <code>/root/backups</code> als Ziel – das Archiv würde sich dann selbst einschließen und entweder ein beschädigtes Archiv erzeugen oder unbegrenzt wachsen, bis die Festplatte voll ist. Die Prüfung löst beide Pfade mit <code>readlink -m</code> auf, vergleicht sie und bricht bei einem Konflikt die Sicherung mit einem Dialogfeld ab, das den in Konflikt stehenden Pfad benennt und drei Möglichkeiten zur Lösung auflistet: Wählen Sie ein Ziel außerhalb des in Konflikt stehenden Pfads, entfernen Sie den benutzerdefinierten Eintrag, der das Ziel enthält, oder deaktivieren Sie den in Konflikt stehenden Pfad für diesen Lauf im benutzerdefinierten Modus."
+  },
+  "archiveFormat": {
+    "heading": "Archivformat und Komprimierung",
+    "intro": "Der Ausgabedateiname bettet den Quellhostnamen und den Backup-Zeitstempel ein, so dass ein Verzeichnis mit mehreren Archiven chronologisch sortiert und jede Datei sich selbst identifiziert.",
+    "namePattern": "hostcfg-HOSTNAME-YYYYMMDD_HHMMSS.tar.zst",
+    "compressionTitle": "Kompression",
+    "compressionBody": "Der primäre Pfad verwendet <code>tar --zstd -cf</code> - eine Single-Command-Pipeline, die auf dem Standardniveau von zstd komprimiert wird. Wenn <code>zstd</code> nicht in der Quelle vorhanden ist (selten bei Proxmox, aber bei minimalen Installationen möglich), fällt ProxMenux auf <code>gzip</code> zurück. Im Fallback-Pfad wird, wenn <code>pv</code> verfügbar ist, ein Fortschrittsbalken zur Pipeline hinzugefügt, so dass der Betreiber die Archivgröße in Echtzeit wachsen sieht; ohne <code>pv</code> wird <code>tar -czf</code> still verwendet.",
+    "sourceTitle": "Was geht ins Archiv",
+    "sourceBody": "Der tar-Befehl wird mit <code>-C \"$staging_root\" .</code> aufgerufen und archiviert dadurch das <strong>gesamte Staging-Hauptverzeichnis</strong>: <code>rootfs/</code>, <code>metadata/</code> und <code>manifest.json</code>. Alle drei Datenblöcke liegen nebeneinander auf der obersten Ebene des tar-Archivs. Beim Entpacken entsteht genau der Baum, den der Wiederherstellungscode verwendet."
+  },
+  "sidecar": {
+    "heading": "Die JSON-Begleitdatei",
+    "intro": "Jedes erfolgreiche lokale Backup erzeugt eine Begleitdatei: <code>HOSTNAME-TIMESTAMP.tar.zst.proxmenux.json</code>, geschrieben neben dem Archiv von <code>hb_write_archive_sidecar</code>. Diese kleine JSON-Datei ermöglicht es dem ProxMenux Monitor, das Archiv als ProxMenux-Host-Backup zu identifizieren, auch wenn es später an anderer Stelle verschoben, umbenannt oder archiviert wird.",
+    "contentTitle": "Inhalt der Begleitdatei",
+    "contentBody": "Das Sidecar speichert die Schemaversion, ob das Backup von einem interaktiven Lauf oder einem geplanten Job (<code>kind</code>) stammt, die Job-ID für geplante Läufe, den verwendeten Profilmodus (<code>default</code> oder <code>custom</code>), den Quellhostnamen, den ursprünglichen Archivbasisnamen, einen ISO-8601-Erstellungszeitstempel und die Archivgröße in Bytes.",
+    "whyBody": "Die Registerkarte Backups des Monitors scannt konfigurierte lokale Verzeichnisse für <code>*.proxmenux.json</code>-Begleitdateien - nicht für <code>*.tar.zst</code>-Dateien -, da ein <code>.tar.zst</code> ohne Sidecar möglicherweise überhaupt kein ProxMenux-Backup ist. Der Scan ist schnell (JSON-Dateien sind winzig) und die Paarung ist stabil bei Umbenennungen des Archivs, solange das Sidecar entsprechend umbenannt wird."
+  },
+  "restoreAccess": {
+    "heading": "Wiederherstellen aus einem lokalen Archiv",
+    "body": "Der ProxMenux-Wiederherstellungsfluss entdeckt lokale Archive, indem er das konfigurierte lokale Ziel nach Begleitdateien durchsucht und in der Archivliste anzeigt. Die Auswahl eines Archivs löst <code>_rs_check_layout</code> aus, der den Tarball in ein Staging-Verzeichnis extrahiert und das Layout mit drei Nutzlasten bestätigt, bevor er fortfährt. Für die manuelle Extraktion außerhalb von ProxMenux liefert <code>tar --zstd -xf hostcfg-HOSTNAME-TIMESTAMP.tar.zst -C /tmp/hostcfg</code> den gleichen Baum, den der Wiederherstellungscode verbraucht."
+  }
+}
diff --git a/web/messages/de/docs/backup-restore/destinations/pbs.json b/web/messages/de/docs/backup-restore/destinations/pbs.json
new file mode 100644
index 00000000..2beffaef
--- /dev/null
+++ b/web/messages/de/docs/backup-restore/destinations/pbs.json
@@ -0,0 +1,113 @@
+{
+  "meta": {
+    "title": "Proxmox Backup Server Zielort — Repository, Verschlüsselung, Wiederherstellung | ProxMenux",
+    "description": "Das PBS-Ziel speichert ProxMenux-Host-Backups als PBS-Backups. Beschrieben werden die Repository-Erkennung aus /etc/pve/storage.cfg, die manuelle PBS-Konfiguration, der .pxar-Upload, die clientseitige Verschlüsselung mit einer Schlüsseldatei samt optionaler passphrasengeschützter Sicherungskopie sowie die Schlüsselwiederherstellung aus mehreren Quellen auf einem neu installierten Host.",
+    "ogTitle": "ProxMenux Backup — Bestimmungsort Proxmox Backup Server",
+    "ogDescription": "So speichert ProxMenux Host-Backups auf Proxmox Backup Server mit clientseitiger Schlüsseldateiverschlüsselung und einer hinterlegten Wiederherstellungskopie.",
+    "twitterTitle": "PBS Backup Ziel | ProxMenux",
+    "twitterDescription": "Proxmox Backup Server als Ziel mit Schlüsseldateiverschlüsselung und passphrasengeschützter Wiederherstellungskopie."
+  },
+  "header": {
+    "title": "Proxmox Backup Server",
+    "description": "Das PBS-Ziel lädt das gesamte Vorbereitungsverzeichnis als ein einzelnes .pxar-Backup in einen Proxmox-Backup-Server-Datenspeicher hoch. Optional wird es clientseitig mit einer Schlüsseldatei verschlüsselt; zusätzlich kann neben jedem Backup eine passphrasengeschützte Wiederherstellungskopie der Schlüsseldatei hinterlegt werden.",
+    "section": "Sicherung und Wiederherstellung"
+  },
+  "recommendedBadge": "Empfohlenes Ziel",
+  "aboutPbs": {
+    "heading": "Was Proxmox Backup Server ist",
+    "body": "Proxmox Backup Server (PBS) ist das eigene Backup-Server-Produkt von Proxmox, das von dem gleichen Team entwickelt und gewartet wird, das auch Proxmox VE entwickelt hat. Es ist ein dedizierter Backup-Server, der entwickelt wurde, um Backups von Proxmox VE-Hosts (VMs, LXCs und - über <code>proxmox-backup-client</code> - beliebige Host-Verzeichnisse) mit chunkbasierter Deduplizierung, clientseitiger Verschlüsselung und serverseitig angewendeten Aufbewahrungsrichtlinien zu erhalten. ProxMenux verwendet PBS als eines der drei Ziele für Host-Backups; jeder auf dieser Seite beschriebene PBS-spezifische Mechanismus (Backup-Gruppen, <code>.pxar</code>-Archive, <code>--backup-id</code>, Keyfile-Verschlüsselung) ist Standard-PBS-Verhalten."
+  },
+  "intro": {
+    "title": "Ein Backup pro Lauf, Chunk-Level-Dedup",
+    "body": "Ein PBS-Backup erzeugt einen einzelnen Backup-Eintrag im Datenspeicher, der unter der Backup-ID <code>host/hostcfg-HOSTNAME/BACKUP-TIME</code> gruppiert ist. Die Nutzlast ist ein <code>.pxar</code>-Archiv, das das gleiche dreiblockige Layout enthält, das in <em>How it works</em> beschrieben ist. PBS dedupliziert auf der Chunk-Ebene über alle Backups im Datenspeicher, so dass nachfolgende Backups desselben Hosts nur die geänderten Chunks übertragen und speichern. Die Retention wird von ProxMenux selbst für geplante Aufträge angewendet — <code>run_scheduled_backup.sh</code> führt <code>proxmox-backup-client prune</code> mit <code>--keep-last</code> / <code>--keep-daily</code> / <code>--keep-weekly</code> nach jedem erfolgreichen Lauf mit den für den Auftrag konfigurierten Werten aus."
+  },
+  "repoSelection": {
+    "heading": "Repository-Auswahl",
+    "intro": "ProxMenux entdeckt PBS-Repositories aus zwei Quellen in jedem Backup. Der Bediener wählt einen aus einem einheitlichen Menü aus; die Auswahl bestimmt <code>HB_PBS_REPOSITORY</code>, <code>HB_PBS_SECRET</code> und <code>HB_PBS_FINGERPRINT</code> für den Lauf.",
+    "sourceRows": [
+      {
+        "source": "Proxmox storage.cfg (automatisch erkannt)",
+        "path": "/etc/pve/storage.cfg + /etc/pve/priv/storage/NAME.pw",
+        "content": "Jede <code>pbs:</code> Strophe in der eigenen Speicherkonfiguration von Proxmox wird automatisch abgeholt. Server, Datenspeicher, Benutzername und Fingerabdruck stammen aus der Strophe. Das Passwort wird aus dem eigenen Anmeldeverzeichnis von Proxmox gelesen. Auf der ProxMenux-Seite ist kein erneuter Eintrag erforderlich – das Repository ist verfügbar, sobald es in Proxmox konfiguriert ist."
+      },
+      {
+        "source": "ProxMenux manuelle Konfiguration",
+        "path": "/usr/local/share/proxmenux/pbs-manual-configs.txt + pbs-pass-NAME.txt + pbs-fingerprint-NAME.txt",
+        "content": "Zusätzlich von <em> Backup-Ziele konfigurieren → PBS Ziele → PBS</em> hinzufügen. Prompts für einen Namen, Benutzernamen (<code>root@pam</code> oder <code>user@pbs!token</code>), Host oder IP, Datenspeicher und Passwort. Das Passwort wird bei leeren Eingaben erneut angezeigt - ein leeres Speichern würde ansonsten still bleiben und jedes nachfolgende Backup würde mit einem undurchsichtigen Authentifizierungsfehler fehlschlagen. Dieser Pfad wird verwendet, wenn das Ziel PBS nicht als Proxmox-Speicher registriert ist."
+      }
+    ],
+    "menuTitle": "Auswahlmenü",
+    "menuBody": "Beide Quellen werden in einem einzigen Menü angezeigt, wobei jede Zeile mit ihrem Ursprung markiert ist (<code>[proxmox]</code> oder <code>[manual]</code>). Einträge, deren Passwort nicht aufgelöst werden konnte, werden mit einer <code>⚠ no password</code>-Warnung versehen – die Auswahl einer löst einen erneuten Passworteintrag aus, bevor das Backup startet. Der Fingerabdruck wird über die <code>PBS_FINGERPRINT</code>-Umgebungsvariable an <code>proxmox-backup-client</code> übergeben; bei Abwesenheit fordert der Client den Betreiber auf, das Serverzertifikat beim ersten Backup interaktiv zu akzeptieren."
+  },
+  "backupCommand": {
+    "heading": "Der Backup-Befehl",
+    "intro": "Der Upload erfolgt mit einem einzigen Aufruf von <code>proxmox-backup-client backup</code>. ProxMenux übergibt Passwort, Verschlüsselungspasswort und Fingerabdruck mit <code>env</code> als Umgebungsvariablen an den Client.",
+    "cmd": "env \\\n    PBS_PASSWORD=\"$HB_PBS_SECRET\" \\\n    PBS_ENCRYPTION_PASSWORD=\"$HB_PBS_ENC_PASS\" \\\n    PBS_FINGERPRINT=\"$HB_PBS_FINGERPRINT\" \\\n    proxmox-backup-client backup \\\n        hostcfg.pxar:$staging_root \\\n        --repository USER@REALM@HOST:DATASTORE \\\n        --backup-type host \\\n        --backup-id  hostcfg-HOSTNAME \\\n        --backup-time BACKUP-EPOCH \\\n        [--keyfile /usr/local/share/proxmenux/pbs-key.conf]",
+    "backupIdTitle": "Backup-ID-Bezeichnung",
+    "backupIdBody": "Die Standard-Backup-ID ist <code>hostcfg-HOSTNAME</code>. Vor dem Upload wird sie bestätigt oder bearbeitet. Zeichen außerhalb von <code>[A-Za-z0-9_-]</code> sowie abschließende Bindestriche werden entfernt. Die Wiederverwendung derselben ID bei weiteren Läufen ist beabsichtigt: PBS behandelt die ID als <em>Gruppe</em>. Jedes weitere Backup erscheint als neuer Eintrag in dieser Gruppe und nutzt die Deduplizierung mit früheren Backups.",
+    "pxarTitle": "Warum die Quelle die vollständige Staging-Wurzel ist",
+    "pxarBody": "Die <code>.pxar</code>-Quelle ist die gesamte <code>staging_root</code> - <code>rootfs/</code>, <code>metadata/</code> und <code>manifest.json</code> zusammen. Frühere Versionen bestanden <code>$staging_root/rootfs</code> als Quelle; Das ließ <code>metadata/</code> aus dem Archiv und die Kompatibilitätsprüfung der Wiederherstellung hatte nichts zu lesen, was selbst bei Wiederherstellungen des gleichen Hosts zu Cross-Host-Warnungen führte. Alte Backups, die mit der Rootfs-only-Quelle erstellt wurden, werden immer noch korrekt über den <code>_rs_check_layout</code>-Fall-3-Zweig wiederhergestellt, der einen flachen <code>etc/var/root/usr</code>-Baum zurück in eine <code>rootfs/</code>-Hierarchie wickelt."
+  },
+  "encryption": {
+    "heading": "Clientseitige Verschlüsselung",
+    "glossaryHint": "Dieser Abschnitt verwendet die Begriffe <em>Schlüsseldatei</em>, <em>Passphrase</em> und <em>Wiederherstellungshülle</em>. Das <glosarioLink>Glossar</glosarioLink> erklärt die Unterschiede mit einem Satz pro Begriff.",
+    "intro": "Die clientseitige PBS-Verschlüsselung mit einer Schlüsseldatei verschlüsselt die Blöcke vor dem Upload auf dem Quellhost. In ProxMenux ist die Verschlüsselung optional. Wird sie aktiviert, entscheidet der Betreiber bei der Einrichtung ausdrücklich mit Ja oder Nein, ob zusätzlich eine passphrasengeschützte Wiederherstellungskopie der Schlüsseldatei auf PBS hinterlegt wird; diese Wahl lässt sich später im Monitor ändern. Die Schlüsseldatei selbst liegt immer unter dem kanonischen Pfad <code>/usr/local/share/proxmenux/pbs-key.conf</code> und wird für alle weiteren verschlüsselten Backups ohne erneute Nachfrage verwendet.",
+    "keyfileTitle": "Einrichten der Keyfile",
+    "keyfileBody": "Der Verschlüsselungsdialog erscheint beim ersten verschlüsselten Backup des Hosts. Zunächst wird gefragt, ob das Backup verschlüsselt werden soll: <em>Nein</em> fährt ohne Verschlüsselung fort, <em>Ja</em> führt zum zweiten Schritt. Dieser hängt davon ab, ob bereits eine Schlüsseldatei unter <code>/usr/local/share/proxmenux/pbs-key.conf</code> installiert ist. Falls ja, wird sie ohne Nachfrage wiederverwendet und das Backup fortgesetzt; auch spätere Backups fragen nicht erneut. Andernfalls bietet ein Menü zwei Möglichkeiten. <em>Neue Schlüsseldatei erzeugen</em> führt <code>proxmox-backup-client key create --kdf none</code> aus. <em>Vorhandene Schlüsseldatei verwenden</em> erkennt eine von PVE verwaltete Datei automatisch: Ist das gewählte PBS-Repository in Proxmox mit einem Verschlüsselungsschlüssel unter <code>/etc/pve/priv/storage/&lt;NAME&gt;.enc</code> registriert, wird diese Datei ohne Nachfrage an den kanonischen ProxMenux-Pfad kopiert. Gibt es keine passende PVE-Datei, wird nach dem absoluten Pfad gefragt, unter dem der Betreiber die Schlüsseldatei bereits auf diesem Host abgelegt hat. In beiden Fällen liegt sie danach am kanonischen Pfad mit <code>chmod 600</code>.",
+    "modesTitle": "Schlüsseldatei je Host oder gemeinsam nutzen",
+    "modesIntro": "Beide Betriebsmodelle werden unterstützt und keines wird durchgesetzt - die Wahl liegt beim Betreiber, je nachdem, wie seine Flotte organisiert ist.",
+    "modesPerHostTitle": "Eigene Schlüsseldatei je Host (Standard)",
+    "modesPerHostBody": "Jeder Host generiert seine eigene Schlüsseldatei, wenn er zum ersten Mal die PBS-Verschlüsselung aktiviert. Die Isolation ist maximal: Durch die Kompromittierung der Schlüsseldatei eines Hosts werden die Backups anderer Hosts nicht offengelegt. Empfohlen für Produktionsflotten und für Umgebungen, in denen Hosts unterschiedliche Eigentümer oder Compliance-Grenzen haben.",
+    "modesSharedTitle": "Gemeinsame Keyfile (Import auf jedem Host)",
+    "modesSharedBody": "Eine Hauptschlüsseldatei wird einmal generiert und auf jedem Host über die Option <em>Vorhandene Schlüsseldatei verwenden</em> installiert. Die Verwaltung ist einfacher: Ein einziges Geheimnis muss geschützt werden, und jeder Host kann die Archive jedes anderen entschlüsseln (nützlich für Konsolidierung, hostübergreifende Wiederherstellungsübungen oder zentralisierte Backup-Verifizierung). Der Nachteil besteht darin, dass ein Leck der gemeinsam genutzten Schlüsseldatei jeden Host auf einmal offenlegt. Empfohlen für Homelabs und Flotten, bei denen alle Hosts denselben Eigentümer und dieselbe Vertrauensgrenze haben.",
+    "recoveryTitle": "Schlüssel auf PBS hinterlegen — der Betreiber entscheidet",
+    "recoveryBody": "Direkt nach Auswahl der Schlüsseldatei fragt ProxMenux ausdrücklich <em>Schlüssel auf PBS hochladen?</em> und bietet zwei Antworten. <strong>Erst wenn der Betreiber Ja wählt, wird ein Wiederherstellungsartefakt auf PBS hochgeladen.</strong> Vorgabe ist <em>Nein, nur lokal behalten</em>: Die Schlüsseldatei bleibt am kanonischen lokalen Pfad, ProxMenux lädt kein Wiederherstellungsartefakt auf PBS hoch und der Betreiber sorgt selbst für eine externe Kopie. Die Schaltfläche <em>Schlüsseldatei herunterladen</em> in der PBS-Zielzeile des Monitors stellt sie bei Bedarf bereit. Bei <em>Ja, hochladen</em> wird zweimal eine Wiederherstellungspassphrase abgefragt und auf Übereinstimmung geprüft. ProxMenux schützt die Schlüsseldatei damit mittels AES-256-CBC und PBKDF2 (600.000 Iterationen, zufälliges Salt) und erzeugt <code>pbs-key.recovery.enc</code>. Jedes weitere verschlüsselte Backup lädt diese Hülle als zugehörige Backup-Gruppe auf PBS hoch. Dabei werden weder die Passphrase noch die Schlüsseldatei im Klartext an PBS gesendet. Die Entscheidung lässt sich jederzeit im Monitor ändern: Der Schalter in der PBS-Zielzeile wählt Ja oder Nein und übernimmt je nach Zustand sofort Upload starten, Upload stoppen oder Passphrase aktualisieren.",
+    "blobUploadTitle": "Gepaarte Backup-Gruppe auf PBS",
+    "blobUploadBody1": "Ist die Hinterlegung auf <em>Ja, hochladen</em> gesetzt, lädt ProxMenux nach jedem verschlüsselten Backup die Wiederherstellungshülle als zweite, zugehörige Backup-Gruppe auf PBS hoch. Sie heißt wie die Host-Gruppe, ergänzt um <code>-keyrecovery</code>. Beide Gruppen stehen in der Datenspeicherliste nebeneinander: eine für Host-Backups, eine für Wiederherstellungshüllen. <strong>Die Hülle verlässt den Host niemals im Klartext</strong>: Noch vor der Übertragung verschlüsselt der Host sie mit AES-256-CBC und PBKDF2 (<code>openssl enc -aes-256-cbc -pbkdf2 -iter 600000 -salt</code>). PBS erhält ausschließlich die bereits verschlüsselte Hülle.",
+    "envelopeSecurityTitle": "Ist das Hochladen der keyrecovery-Datei in PBS ein Sicherheitsrisiko?",
+    "envelopeSecurityBody": "Die keyrecovery-datei ist verschlüsselt in transit und in ruhe. Die Wiederherstellungspassphrase verlässt den Host nie: Verschlüsselung geschieht lokal vor dem Upload, und PBS sieht immer nur das bereits verschlüsselte Ergebnis. Ein PBS-Administrator - oder jeder, der Zugriff auf den Datenspeicher hat - kann die KeyRecovery-Datei herunterladen, aber ohne die Wiederherstellungspassphrase können sie die Keyfile nicht lesen: Es ist undurchsichtiger Geheimtext. Das Rekonstruieren der Keyfile erfordert beide Teile gleichzeitig, die KeyRecovery-Datei und die Passphrase, und nur der Operator hält beide.",
+    "blobUploadConstraintTitle": "Warum zwei Gruppen statt einer einzigen verschlüsselten",
+    "blobUploadConstraintBody": "Ein einzelner Aufruf von <code>proxmox-backup-client backup</code> verschlüsselt entweder alle enthaltenen Archive mit derselben Schlüsseldatei oder keines davon. Das Host-Backup muss mit der Host-Schlüsseldatei verschlüsselt werden. Die Wiederherstellungshülle darf aber nicht im selben Upload liegen, sonst würde sie mit genau der Schlüsseldatei verschlüsselt, die sie enthält. Auf einem neu installierten Host ließe sie sich nicht öffnen: Zum Entschlüsseln der Schlüsseldatei wäre diese selbst nötig. Deshalb werden die beiden Artefakte unabhängig hochgeladen und erscheinen als zwei Gruppen. Der PBS-Client verschlüsselt das Host-Backup mit der Schlüsseldatei; ProxMenux verschlüsselt die Wiederherstellungshülle vor dem Upload mit der Passphrase. Zwei verschiedene Verschlüsselungsschichten schützen zwei unterschiedliche Inhalte.",
+    "blobUploadImageAlt": "PBS Benutzeroberfläche zeigt die Backup-Gruppen hostcfg-HOSTNAME und hostcfg-HOSTNAME-keyrecovery angrenzend im Datenspeicher.",
+    "blobUploadImageCaption": "PBS UI — die gepaarten Backup-Gruppen. Die Hauptgruppe hält die Host-Backups; die -keyrecovery-Gruppe hält die passphrase-verpackte Schlüsseldatei.",
+    "recoverTitle": "Wiederherstellung auf einem neu installierten Host",
+    "recoverBody": "Fehlt die lokale Schlüsseldatei am kanonischen Pfad, etwa nach einer Neuinstallation oder ausdrücklichem Löschen, versucht die Wiederherstellung drei Quellen der Reihe nach und stoppt bei der ersten brauchbaren Schlüsseldatei. Erstens wird eine zum gewählten PBS-Repository passende, von PVE verwaltete Datei unter <code>/etc/pve/priv/storage/&lt;NAME&gt;.enc</code> ohne Nachfrage an den kanonischen Pfad kopiert. Zweitens wird, falls auf PBS eine Gruppe <code>-keyrecovery</code> vorhanden ist, deren neuester Snapshot heruntergeladen und die Wiederherstellungspassphrase zum Entschlüsseln abgefragt. Funktioniert beides nicht oder lehnt der Betreiber die Optionen ab, fragt der dritte Schritt nach dem absoluten Pfad der Schlüsseldatei auf diesem Host und kopiert sie an den kanonischen Pfad. Der Monitor bietet denselben Importablauf im Backup-Detaildialog. Oben erscheint ein gelbes Feld, wenn Wiederherstellen, Herunterladen oder Inhalt anzeigen eine nicht installierte Schlüsseldatei benötigen. Ist eine Datei installiert, passt aber nicht zum Backup, meldet PBS <code>wrong key — manifest's key XX does not match provided key YY</code>. Dieselben drei Aktionen zeigen dann ein strukturiertes gelbes Feld mit dem erforderlichen Manifest-Fingerabdruck an, damit der Betreiber die passende Schlüsseldatei für dieses Backup erkennen und importieren kann.",
+    "monitorManagementTitle": "Schlüsseldatei im Monitor verwalten",
+    "monitorManagementBody": "Der Monitor zeigt die Schlüsseldatei-Steuerung direkt in jeder PBS-Zielzeile der Backup-Konfigurationsseite. Es gibt drei Aktionen: <em>Herunterladen</em> exportiert die aktuelle Datei in den Browser des Betreibers; <em>Hochladen</em> ersetzt die installierte Datei durch eine bereitgestellte Datei, wobei die bisherige erst nach erfolgreicher Installation der neuen am kanonischen Pfad überschrieben wird; <em>Löschen</em> entfernt die Datei vom Host. Daneben befindet sich die Steuerung der Wiederherstellungskopie: eine Ja/Nein-Auswahl für <em>Schlüssel auf PBS hochladen?</em>, bei Ja ein Passphrase-Feld und eine passende Übernehmen-Schaltfläche mit <em>Upload starten</em>, <em>Upload stoppen</em> oder <em>Passphrase aktualisieren</em>. Jede Aktion nutzt dieselben Flask-Endpunkte wie die Terminaloberfläche. Die Wirkung auf Dateien und den PBS-Zustand ist deshalb bei beiden Oberflächen identisch."
+  },
+  "restoreAccess": {
+    "heading": "Abruf auf der Wiederherstellungsseite",
+    "body": "Der Wiederherstellungsfluss erkennt ProxMenux Host-Backups auf PBS, indem er Backup-Gruppen unter dem konfigurierten Repository auflistet und nach Backup-ID-Muster filtert. Die Registerkarte Backups des Monitors stellt dieselbe Liste dar. Durch das Auswählen eines Backups wird <code>proxmox-backup-client restore</code> mit demselben Repository + Passwort + Fingerabdruck (und <code>--keyfile</code>, als das Backup verschlüsselt wurde) ausgelöst, wodurch das <code>.pxar</code> in ein Staging-Verzeichnis extrahiert wird, das <code>_rs_check_layout</code> dann der Standardwiederherstellungspipeline zuführt. Für das manuelle Abrufen außerhalb von ProxMenux extrahiert derselbe Befehl das Archiv auf einen beliebigen Pfad - der resultierende Baum kann inspiziert oder einer handgesteuerten Wiederherstellung zugeführt werden."
+  },
+  "references": {
+    "heading": "Referenzen",
+    "intro": "Offizielle Dokumentation von Proxmox Backup Server zu den Komponenten, auf die ProxMenux aufbaut.",
+    "items": [
+      {
+        "label": "Proxmox Backup Server Dokumentation",
+        "href": "https://pbs.proxmox.com/docs/",
+        "tail": "— Haupteinstiegspunkt für Installation, Verwaltung, Speicherung, Benutzer und Rollen."
+      },
+      {
+        "label": "proxmox-backup-client",
+        "href": "https://pbs.proxmox.com/docs/backup-client.html",
+        "tail": " — das Befehlszeilenwerkzeug, das ProxMenux für jedes Backup und jede Wiederherstellung aufruft. Beschreibt Backup-IDs, Backup-Typen, Archive, Repository-Syntax und Umgebungsvariablen."
+      },
+      {
+        "label": "Clientseitige Verschlüsselung",
+        "href": "https://pbs.proxmox.com/docs/backup-client.html#encryption",
+        "tail": " — Erzeugung der Schlüsseldatei, --kdf-Modi und das Verschlüsselungsmodell, das ProxMenux um eine passphrasengeschützte Wiederherstellungskopie erweitert."
+      },
+      {
+        "label": "Datenspeicherverwaltung",
+        "href": "https://pbs.proxmox.com/docs/storage.html",
+        "tail": "Erstellen und Verwalten der Datenspeicher, die Host-Backups erhalten, einschließlich Chunk-Store-Layout und Berechtigungen."
+      },
+      {
+        "label": "Aufbewahrungsregeln und Garbage Collection",
+        "href": "https://pbs.proxmox.com/docs/maintenance.html#pruning",
+        "tail": " — das Aufbewahrungsmodell hinter --keep-last / --keep-daily / --keep-weekly, das ProxMenux je geplantem Auftrag anwendet, sowie die Freigabe ungenutzter Blöcke durch PBS nach der Bereinigung."
+      }
+    ]
+  }
+}
diff --git a/web/messages/de/docs/backup-restore/glossary.json b/web/messages/de/docs/backup-restore/glossary.json
new file mode 100644
index 00000000..32a4be40
--- /dev/null
+++ b/web/messages/de/docs/backup-restore/glossary.json
@@ -0,0 +1,230 @@
+{
+  "meta": {
+    "title": "Glossar - Backup & Restore | ProxMenux",
+    "description": "Begriffe des ProxMenux-Sicherungs- und Wiederherstellungssystems: Verschlüsselung, Schlüsseldatei, Passphrase, Wiederherstellungsumschlag, PBS, Chunks, rootfs, Manifest, Ausführungsprozess und Ergänzung zwischen Kernel-Versionen.",
+    "ogTitle": "Backup & Restore Glossar | ProxMenux",
+    "ogDescription": "Klare Definitionen für das Vokabular, das in der ProxMenux-Backup- und Wiederherstellungsdokumentation verwendet wird.",
+    "twitterTitle": "Backup & Restore Glossar | ProxMenux",
+    "twitterDescription": "Passphrase, Keyfile, Recovery-Umschlag, Rootfs, Manifest, PBS, Brocken — alle an einer Stelle definiert."
+  },
+  "header": {
+    "title": "Glossar",
+    "description": "Begriffe, die in der Backup- und Wiederherstellungsdokumentation mit ihrer Definition verwendet werden.",
+    "section": "Sicherung und Wiederherstellung"
+  },
+  "intro": {
+    "body": "Begriffe werden nach Themen gruppiert. Jeder Eintrag gibt den Begriff und eine kurze Definition."
+  },
+  "groups": [
+    {
+      "title": "Verschlüsselung und Key Recovery",
+      "intro": "Vokabular für den PBS-Verschlüsselungsblock. Es beinhaltet zwei verschiedene Geheimnisse: eine binäre Schlüsseldatei und eine geschriebene Passphrase.",
+      "entries": [
+        {
+          "id": "passphrase-recuperacion",
+          "term": "Wiederherstellungspassphrase",
+          "def": "Textkennwort, das der Benutzer auswählt, um den <a href=\"#sobre-recuperacion\">Wiederherstellungsumschlag </a> zu schützen. Es wird zweimal mit einer Übereinstimmungsprüfung aufgefordert und wird nur verwendet, um den Umschlag zu verschlüsseln und zu entschlüsseln, wenn die Schlüsseldatei jemals wiederhergestellt werden muss. <strong>Es ist nicht die Passphrase, die die Schlüsseldatei selbst entsperrt</strong> und wird niemals an PBS gesendet. Während eines normalen Backups verlässt es niemals den Host."
+        },
+        {
+          "id": "clave-cifrado",
+          "term": "Keyfile (Verschlüsselungsschlüssel)",
+          "def": "Schlüsseldatei, mit der proxmox-backup-client die <a href=\"#chunk\">Chunks</a> vor dem Hochladen zu PBS verschlüsselt. Ohne passenden Schlüssel sind verschlüsselte Daten nicht lesbar. ProxMenux speichert sie unter <code>/usr/local/share/proxmenux/pbs-key.conf</code> mit Modus <code>600</code>. Schützen Sie sie; der <a href=\"#sobre-recuperacion\">Wiederherstellungsumschlag</a> dient ihrer Wiederherstellung bei Verlust."
+        },
+        {
+          "id": "contrasena-keyfile",
+          "term": "Keyfile Passphrase (KDF Passphrase)",
+          "def": "Optionale Passphrase, die die Keyfile selbst tragen kann, im Unterschied zur <a href=\"#passphrase-recuperacion\">Recovery Passphrase</a>. Es existiert nur, wenn die Keyfile mit <code>--kdf scrypt</code> erstellt wurde (normalerweise eine importierte Keyfile). Ohne sie kann die Keyfile nicht für die Verwendung entsperrt werden. ProxMenux behält es in verschlüsselter Form auf dem Host, so dass geplante Backups ohne interaktive Eingabeaufforderung ausgeführt werden können."
+        },
+        {
+          "id": "sobre-recuperacion",
+          "term": "Wiederherstellungsumschlag",
+          "def": "Das <a href=\"#clave-cifrado\">keyfile</a> ist in eine zusätzliche Schicht eingewickelt: Es ist mit der <a href=\"#passphrase-recuperacion\">Wiederherstellungspassphrase</a> unter Verwendung von <a href=\"#aes-256-cbc\">AES-256-CBC</a> und <a href=\"#pbkdf2\">PBKDF2</a> verschlüsselt, bevor es den Host verlässt. Es wird auf PBS als <code>-keyrecovery</code>-Gruppe hochgeladen. Ohne die Passphrase ist der Umschlag undurchsichtig: Wenn Sie ihn von PBS herunterladen, wird die Schlüsseldatei nicht angezeigt."
+        },
+        {
+          "id": "cifrado-cliente",
+          "term": "Clientseitige Verschlüsselung",
+          "def": "Verschlüsselungsmodell, bei dem Daten auf dem Quellhost verschlüsselt werden, bevor sie hochgeladen werden. PBS empfängt und speichert immer nur Geheimtext; nicht einmal ein PBS-Administrator mit Datenspeicherzugriff kann ihn ohne die Schlüsseldatei lesen. ProxMenux baut auf diesem Modell auf und fügt den <a href=\"#sobre-recuperacion\">Wiederherstellungsumschlag</a> hinzu."
+        },
+        {
+          "id": "kdf-none",
+          "term": "--kdf none",
+          "def": "Option auf <code>proxmox-backup-client key create</code>, die eine Schlüsseldatei ohne angehängte Passphrase erzeugt. Die Keyfile kann direkt ohne Aufforderung verwendet werden, was für geplante Aufträge, die unbeaufsichtigt ausgeführt werden, unerlässlich ist. Dies ist, was ProxMenux standardmäßig verwendet, wenn eine neue Keyfile erzeugt wird."
+        },
+        {
+          "id": "kdf-scrypt",
+          "term": "--kdf scrypt",
+          "def": "Option auf <code>proxmox-backup-client key create</code>, die eine Schlüsseldatei erzeugt, die durch eine <a href=\"#contrasena-keyfile\">keyfile-Passphrase</a> geschützt ist. Jede Verwendung der Keyfile erfordert das Entsperren mit dieser Passphrase. ProxMenux akzeptiert diese Art von Keyfile beim Import und speichert die Passphrase verschlüsselt, so dass geplante Backups immer noch unbeaufsichtigt ausgeführt werden können."
+        },
+        {
+          "id": "aes-256-cbc",
+          "term": "AES-256-CBC",
+          "def": "Standardsymmetrische Chiffre. ProxMenux verwendet es (über <code>openssl enc -aes-256-cbc</code>), um die <a href=\"#clave-cifrado\">Schlüsseldatei</a> mit der <a href=\"#passphrase-recuperacion\">Wiederherstellungspassphrase</a> zu wickeln und die <a href=\"#sobre-recuperacion\">Umschlag</a> zu produzieren."
+        },
+        {
+          "id": "pbkdf2",
+          "term": "PBKDF2",
+          "def": "Kryptografische Funktion, die eine vom Menschen typisierte Passphrase in einen für die Verschlüsselung geeigneten binären Schlüssel verwandelt. Es verlangsamt Brute-Force-Versuche, indem es viele Iterationen anwendet. ProxMenux verwendet es mit 600 000 Iterationen und einem Zufallssalz bei der Verschlüsselung des Recovery-Umschlags."
+        }
+      ]
+    },
+    {
+      "title": "Backup-Struktur",
+      "intro": "Begriffe, die beschreiben, was sich in einem Backup befindet, unabhängig vom Zielort.",
+      "entries": [
+        {
+          "id": "rootfs",
+          "term": "rootfs / Root-Dateisystem",
+          "def": "Dateibasierte Kopie des Dateisystems des Quellhosts, erstellt mit <code>rsync</code> nach dem <a href=\"#perfil-defecto\">Standardprofil</a> und zusätzlichen <a href=\"#rutas-personalizadas\">eigenen Pfaden</a>. Kein vollständiges Datenträgerabbild: Kopiert werden nur Pfade mit Konfiguration oder Zustand, die Proxmox nicht selbst wiederherstellen kann."
+        },
+        {
+          "id": "manifiesto",
+          "term": "Manifest (manifest.json)",
+          "def": "Strukturiertes JSON-Dokument zur Beschreibung des Quell-Hosts zum Backup-Zeitpunkt: Hardware, Storage, Kernel, ProxMenux-installierte Komponenten und Inventar von VMs und LXCs. Es wird von sechs unabhängigen Erfassungsroutinen produziert. Der Wiederherstellungsfluss verwendet ihn, um Quelle und Ziel zu vergleichen."
+        },
+        {
+          "id": "staging",
+          "term": "Stagingverzeichnis",
+          "def": "Temporäres Verzeichnis, in dem ProxMenux die drei Blöcke (rootfs, Metadaten und Manifest) zusammenstellt, bevor sie verpackt und zum Zielort hochgeladen werden. Es wird automatisch entfernt, wenn das Backup beendet ist, auch bei Abbruch."
+        },
+        {
+          "id": "perfil-defecto",
+          "term": "Standardprofil",
+          "def": "Kuratierte Reihe von Pfaden, die ProxMenux standardmäßig in jedem Backup kopiert. Umfasst PVE-Konfiguration, Netzwerk, SSH, Kernel, apt, ProxMenux Tools und mehr. Es ist im Code definiert und auf der Seite <em>Wie es funktioniert</em> dokumentiert."
+        },
+        {
+          "id": "rutas-personalizadas",
+          "term": "Benutzerdefinierte Pfade",
+          "def": "Zusätzliche Pfade, die der Benutzer zusätzlich zum <a href=\"#perfil-defecto\">default-Profil</a> hinzufügt. Entweder persistent (gespeichert in <code>backup-extra-paths.txt</code>) oder per Run (im Custom-Modus ausgewählt)."
+        }
+      ]
+    },
+    {
+      "title": "Ziele und Speicher",
+      "intro": "Begriffe, die an den Ort gebunden sind, an dem das Backup landet - PBS-Server, lokales Archiv oder Borg-Repository - und wie PBS die Daten organisiert.",
+      "entries": [
+        {
+          "id": "repositorio-pbs",
+          "term": "PBS-Repository",
+          "def": "Kombination von Proxmox Backup Server + <a href=\"#datastore\">datastore</a> + Benutzer, der das Backup erhält. Identifiziert durch den String <code>user@realm@host:datastore</code>. Ein einzelner PBS-Server kann mehrere Repositories hosten."
+        },
+        {
+          "id": "datastore",
+          "term": "Datenspeicher",
+          "def": "Konkreter Datenspeicher auf einem PBS-Server für Sicherungen und ihre Chunks. Er liegt auf einem Dateisystem des PBS-Servers und besitzt eigene Berechtigungen und Richtlinien."
+        },
+        {
+          "id": "chunk",
+          "term": "Chunk/Chunk-Deduplizierung",
+          "def": "PBS teilt jedes Backup in Blöcke variabler Größe auf, identifiziert jedes Stück durch seinen Hash und speichert jedes Stück nur einmal, auch wenn es in vielen verschiedenen Backups erscheint. Dies bedeutet, dass aufeinanderfolgende Backups desselben Hosts - oder über ähnliche Hosts - sehr wenig zusätzlichen Speicherplatz benötigen."
+        },
+        {
+          "id": "fingerprint",
+          "term": "Fingerabdruck",
+          "def": "Kryptografischer Fingerabdruck des PBS-Servers TLS Zertifikat. Der Client kann überprüfen, ob er mit dem vorgesehenen Server spricht, ohne sich auf eine öffentliche Zertifizierungsstelle zu verlassen. ProxMenux leitet sie über die Umgebungsvariable <code>PBS_FINGERPRINT</code> an <code>proxmox-backup-client</code> weiter."
+        },
+        {
+          "id": "grupo-copia",
+          "term": "Backup-Gruppe",
+          "def": "Logischer Container innerhalb von PBS, unter dem sich aufeinanderfolgende Backups desselben Assets ansammeln. Jedes neue Backup teilt die Deduplizierung mit früheren in derselben Gruppe. ProxMenux verwendet zwei Gruppen pro Host, wenn die Verschlüsselung aktiviert ist: eine für das Host-Backup und eine mit einem <code>-keyrecovery</code>-Suffix für den <a href=\"#sobre-recuperacion\">Wiederherstellungsumschlag</a>."
+        },
+        {
+          "id": "backup-id",
+          "term": "Backup-ID",
+          "def": "Name der <a href=\"#grupo-copia\">backup-Gruppe</a>. ProxMenux ist standardmäßig <code>hostcfg-HOSTNAME</code> und lässt den Benutzer es vor dem Hochladen bearbeiten; nicht unterstützte Zeichen werden automatisch entfernt."
+        },
+        {
+          "id": "pxar",
+          "term": ".pxar",
+          "def": "PBS-natives Archivformat für Verzeichnisse. Es verhält sich wie ein für die Chunk-Deduplizierung optimierter tar-Archiv: Anstatt eine undurchsichtige Datei zu speichern, zerlegt PBS seinen Inhalt in wiederverwendbare Chunks."
+        }
+      ]
+    },
+    {
+      "title": "Ausführung und Terminplanung",
+      "intro": "Begriffe, die vom ProxMenux-Planed-Jobs-System verwendet werden.",
+      "entries": [
+        {
+          "id": "runner",
+          "term": "Ausführungsprozess",
+          "def": "Das <code>run_scheduled_backup.sh</code>-Script, das ein geplantes Backup ausführt. Es liest die Job-Konfiguration, startet das passende Backend (Local, PBS oder Borg), wendet nach Erfolg die Aufbewahrungsregeln an und sendet die konfigurierten Benachrichtigungen."
+        },
+        {
+          "id": "trabajo-programado",
+          "term": "Geplanter Auftrag",
+          "def": "Beharrliche Konfiguration eines wiederkehrenden Backups. Behält Ziel, Anmeldeinformationen, Verschlüsselung, Zeitplan und Aufbewahrung. Lebt bei <code>/var/lib/proxmenux/backup-jobs/&lt;id&gt;.env</code>."
+        },
+        {
+          "id": "modo-adjunto",
+          "term": "Anhängemodus",
+          "def": "Auftrag ohne eigenen Timer. Ein job-end-Hook von PVE-<code>vzdump</code> startet ihn nach Gastsicherungen bei passendem Zielspeicher. Der gewählte Elternauftrag liefert Speicher und Aufbewahrung, die bei jedem Lauf erneut aus dem Elternauftrag gelesen wird; der Hook vergleicht aber Speicher statt Auftrags-ID. Auch andere Aufgaben desselben Speichers können ihn auslösen. Nur Local und PBS."
+        },
+        {
+          "id": "timer-systemd",
+          "term": "Systemd Timer",
+          "def": "Standard-systemd-Mechanismus, der einen Befehl in einem Kalender auslöst. ProxMenux erstellt einen Timer pro <em>unabhängigem</em> geplanten Job; <a href=\"#modo-adjunto\">attach-mode</a> Jobs verwenden keinen Timer, sie laufen über den PVE-Skript-Hook."
+        },
+        {
+          "id": "retencion",
+          "term": "Aufbewahrung (keep-last, keep-daily…)",
+          "def": "Richtlinie, die entscheidet, welche älteren Backups aufbewahrt und welche beschnitten werden sollen. Definiert pro Auftrag mit Parametern wie <code>keep-last</code>, <code>keep-daily</code>, <code>keep-weekly</code>, <code>keep-monthly</code>. Wird vom Ausführungsprozess nach jedem erfolgreichen Backup angewendet."
+        }
+      ]
+    },
+    {
+      "title": "Wiederherstellen",
+      "intro": "Terme aus dem Wiederherstellungsfluss.",
+      "entries": [
+        {
+          "id": "restauracion-universal",
+          "term": "Universale Wiederherstellung",
+          "def": "Der ProxMenux-Wiederherstellungsfluss extrahiert nicht nur das Dateisystem: Er liest das Manifest, um Unterschiede zwischen Quelle und Ziel zu erkennen, reproduziert die Systemkonfiguration und führt die Installateure für die ProxMenux-verwalteten Komponenten erneut aus. Ziel ist es, den Quellhost zu reproduzieren, nicht nur das Archiv."
+        },
+        {
+          "id": "hidratacion",
+          "term": "Ergänzung zwischen Kernel-Versionen (Hydration)",
+          "def": "Wiederherstellungsschritt, der die eigene Quellkonfiguration (IOMMU-Parameter, VFIO-Geräte-IDs, eigene Anpassungen und GRUB-Schlüssel) in die frische Boot-Konfiguration des Ziels übernimmt, ohne kernelgebundene Quelldateien unverändert zu kopieren. Läuft, wenn der Zielkernel neuer als der der Sicherung ist."
+        },
+        {
+          "id": "cross-kernel",
+          "term": "Kernübergreifende Wiederherstellung",
+          "def": "Wiederherstellung, bei der der Zielkernel vom Quellkernel abweicht und meist neuer ist. Der <a href=\"#hidratacion\">Ergänzungsschritt</a> verhindert die Übernahme von Dateien, die mit dem Zielkernel inkompatibel sind."
+        },
+        {
+          "id": "instalador-postboot",
+          "term": "Installateur nach dem Booten",
+          "def": "Komponenten, die nach dem ersten Booten des wiederhergestellten Hosts neu installiert wurden (NVIDIA-Treiber, Coral TPU-Treiber, AMD GPU-Tools, Intel GPU-Tools). Jeder Installer läuft gegen den Kernel des Ziels, so dass der wiederhergestellte Host nicht davon abhängt, ob der Kernel der Quelle vorhanden ist."
+        },
+        {
+          "id": "compatibility-check",
+          "term": "Kompatibilitätsprüfung",
+          "def": "Vergleich zwischen dem Quellenmanifest und dem Zustand des Ziels, den ProxMenux zu Beginn der Wiederherstellung durchführt. Es entscheidet, welche Teile wortwörtlich kopiert werden, welche Hydratation benötigen und welche von einem Installateur neu erstellt werden."
+        },
+        {
+          "id": "equipo-recien-instalado",
+          "term": "Frische Installation",
+          "def": "Host nur von Grund auf neu installiert, ohne lokale <a href=\"#clave-cifrado\">Schlüsseldatei</a>. Um ein verschlüsseltes Backup wiederherzustellen, muss zunächst die Schlüsseldatei aus der <a href=\"#sobre-recuperacion\">Wiederherstellungsumschlag</a>, die auf PBS gespeichert ist, mit der <a href=\"#passphrase-recuperacion\">Wiederherstellungspassphrase</a> wiederhergestellt werden."
+        }
+      ]
+    }
+  ],
+  "whereNext": {
+    "heading": "Wo als nächstes",
+    "items": [
+      {
+        "label": "Wie es funktioniert",
+        "href": "/docs/backup-restore/how-it-works",
+        "tail": "- wo das Rootfs-, Manifest- und Anwendungsinventar in ein Backup passt."
+      },
+      {
+        "label": "Proxmox-Backup-Server-Ziel",
+        "href": "/docs/backup-restore/destinations/pbs",
+        "tail": "- wobei clientseitige Verschlüsselung, Keyfile, Recovery-Passphrase und Envelope ausführlich dokumentiert sind."
+      },
+      {
+        "label": "Wiederherstellung",
+        "href": "/docs/backup-restore/restoring",
+        "tail": " — Wiederherstellungsablauf und Verwendung des Manifests."
+      }
+    ]
+  }
+}
diff --git a/web/messages/de/docs/backup-restore/how-it-works.json b/web/messages/de/docs/backup-restore/how-it-works.json
new file mode 100644
index 00000000..6a8320b1
--- /dev/null
+++ b/web/messages/de/docs/backup-restore/how-it-works.json
@@ -0,0 +1,205 @@
+{
+  "meta": {
+    "title": "Wie ProxMenux Backup intern funktioniert – Rootfs, Manifest, Anwendungen",
+    "description": "Detaillierte Aufschlüsselung dessen, was ein ProxMenux-Backup enthält: die Rootfs, die von rsync des Standardpfadprofils erzeugt werden, das strukturierte Manifest, das von sechs unabhängigen Sammlern erstellt wird, und das Anwendungsinventar, das die automatische Neuinstallation von Paketen und Komponenten nach einer Wiederherstellung steuert.",
+    "ogTitle": "Wie ProxMenux Backup intern funktioniert",
+    "ogDescription": "Die drei Nutzlasten eines ProxMenux-Backups wurden erklärt: Rootfs, Manifest und Anwendungen.",
+    "twitterTitle": "Wie ProxMenux Backup funktioniert | ProxMenux",
+    "twitterDescription": "Die drei Nutzlasten eines ProxMenux-Backups und wie die Wiederherstellung den Quellhost von ihnen reproduziert."
+  },
+  "header": {
+    "title": "Wie es funktioniert",
+    "description": "Die interne Aufschlüsselung eines ProxMenux-Backups - Dateisystem, Manifest und Anwendungsinventar - und wie die Wiederherstellung alle drei verbraucht, um den Quellhost auf einem Ziel zu reproduzieren, das möglicherweise nicht den gleichen Kernel teilt.",
+    "section": "Sicherung und Wiederherstellung"
+  },
+  "intro": {
+    "title": "Ein Archiv, drei Nutzlasten",
+    "body": "Jedes Backup erzeugt drei klar getrennte Datenblöcke unter einem gemeinsamen Vorbereitungsverzeichnis. Das hochgeladene Archiv (lokales <code>.tar.zst</code>, PBS-Backup oder Borg-Archiv) enthält genau diese Struktur. Die Wiederherstellung nutzt alle drei: <strong>Das Manifest</strong> wird vor Änderungen ausgewertet, um Abweichungen zu erkennen und Ausschlüsse festzulegen; <strong>rootfs</strong> liefert die Konfigurationsdateien, die direkt oder nach einem Neustart angewendet werden; <strong>das Anwendungsinventar</strong> steuert die Paketinstallation und die Neuinstallation der Komponenten nach dem Start. Jeder Block lässt sich unabhängig untersuchen oder entpacken."
+  },
+  "layout": {
+    "heading": "Archivlayout",
+    "intro": "Jedes Archiv folgt dem gleichen Baumlayout, unabhängig vom Zielort. Das <code>metadata/</code>-Unterverzeichnis enthält die strukturierten Nutzlasten; das <code>rootfs/</code>-Unterverzeichnis enthält die Dateisystemkopie.",
+    "treeCaption": "Das beim Backup angelegte Vorbereitungsverzeichnis. Alle Ziele erhalten denselben Verzeichnisbaum in ihrem nativen Format: tar bei lokalen Zielen, PBS-Blöcke bei PBS und Borg-Segmente bei Borg.",
+    "tree": "backup-[timestamp]/\n├── manifest.json                  # structured host state\n├── metadata/\n│   ├── packages.manual.list       # apt-mark showmanual\n│   ├── run_info.env               # backup run identity + kernel version + pmxcfs method\n│   ├── paths_archived.txt         # exact list of paths that reached rootfs/\n│   └── missing_paths.txt          # paths from the profile absent on source\n└── rootfs/\n    ├── etc/                       # /etc/pve, /etc/network, /etc/systemd/network, /etc/ssh, …\n    ├── root/                      # /root (with volatile subdirs excluded)\n    ├── usr/local/                 # /usr/local/bin, /usr/local/share/proxmenux, …\n    └── var/                       # /var/lib/pve-cluster (config.db via sqlite3 .backup), /var/spool/cron/…"
+  },
+  "rootfs": {
+    "heading": "Die Rootfs Nutzlast",
+    "intro": "Der Verzeichnisbaum <code>rootfs/</code> ist eine <strong>einfache Dateisystemkopie</strong>, die <code>rsync</code> vom Quellhost erstellt. Er enthält ein ausgewähltes <strong>Standardprofil</strong> der für eine Proxmox-Wiederherstellung wichtigen Pfade sowie <strong>eigene Pfade</strong>, die der Benutzer zum Backup-Auftrag oder zur interaktiven Sitzung hinzufügt. Die Auswahl ist bewusst eng: nur Pfade, die <em>Konfiguration enthalten</em> oder <em>Zustand speichern, den Proxmox nicht selbst wiederherstellen kann</em>.",
+    "defaultProfileTitle": "Das Standardprofil",
+    "defaultProfileBody": "Das Standardprofil wird durch <code>hb_default_profile_paths</code> in <code>lib_host_backup_common.sh</code> definiert. Es umfasst acht feste Kategorien und bei Bedarf den ZFS-Zustand, die zusammen einen funktionierenden Proxmox-Host beschreiben:",
+    "categoriesTitle": "Pfadkategorien",
+    "categoryRows": [
+      {
+        "category": "PVE-Kern",
+        "paths": "/etc/pve, /var/lib/pve-cluster, /etc/vzdump.conf",
+        "why": "Cluster-Dateisysteminhalte und vzdump-Standards. Die pmxcfs-Datenbank (<code>config.db</code>) wird als konsistenter Snapshot über <code>sqlite3 .backup</code> erfasst, ohne den Cluster zu stoppen, und die <code>.db-wal</code> / <code>.db-shm</code> Sidecars sind vom rsync ausgeschlossen. Wenn <code>sqlite3</code> nicht verfügbar ist, wird stattdessen <code>config.db.raw-fallback</code> erstellt und bei der Wiederherstellung automatisch als Datenbank übernommen."
+      },
+      {
+        "category": "Host-Identität und Netzwerk",
+        "paths": "/etc/hostname, /etc/hosts, /etc/timezone, /etc/resolv.conf, /etc/network, /etc/systemd/network",
+        "why": "Alles, was der Host für den Netzwerkstart mit derselben Identität benötigt. Die <code>.link</code>-Dateien unter <code>/etc/systemd/network</code> ordnen Netzwerkkartennamen ihren MAC-Adressen zu, damit Neuinstallationen und Hardwareänderungen die Schnittstellen nicht umbenennen."
+      },
+      {
+        "category": "Zugriff und Authentifizierung",
+        "paths": "/etc/ssh, /etc/sudoers, /etc/sudoers.d, /etc/pam.d, /etc/security",
+        "why": "SSH Schlüssel, Sudo Regeln und PAM Konfiguration. Wenn Sie diese verlieren, wird der Benutzer aus dem wiederhergestellten Host ausgeschlossen."
+      },
+      {
+        "category": "Kernel und Boot",
+        "paths": "/etc/default/grub, /etc/kernel, /etc/modules, /etc/modules-load.d, /etc/modprobe.d, /etc/sysctl.conf, /etc/sysctl.d, /etc/udev/rules.d, /etc/fstab, /etc/iscsi, /etc/multipath",
+        "why": "IOMMU-Token, Modul-Blacklists, VFIO-Geräte-IDs, Mount-Tabelle, Storage-Stack-Konfiguration."
+      },
+      {
+        "category": "Shell und Gebietsschema",
+        "paths": "/etc/environment, /etc/bash.bashrc, /etc/inputrc, /etc/profile, /etc/profile.d, /etc/locale.gen, /etc/locale.conf",
+        "why": "Systemweite Shell-Einrichtung, Umgebungsvariablen und Konfiguration der Gebietsschema-Erzeugung."
+      },
+      {
+        "category": "Paketverwaltung und cron",
+        "paths": "/etc/apt, /etc/cron.d, /etc/cron.{daily,hourly,weekly,monthly}, /etc/cron.allow, /etc/cron.deny, /var/spool/cron/crontabs",
+        "why": "APT-Quellen für konsistente Paketauflösung, geplante Aufgaben, die vom Benutzer definiert werden."
+      },
+      {
+        "category": "ProxMenux Zustand & Werkzeuge",
+        "paths": "/etc/proxmenux, /etc/systemd/system, /etc/log2ram.conf, /etc/logrotate.conf, /etc/logrotate.d, /etc/lm-sensors, /etc/sensors3.conf, /etc/fail2ban, /etc/snmp, /etc/postfix, /etc/wireguard, /etc/openvpn, /etc/grafana, /etc/influxdb, /etc/prometheus, /etc/telegraf, /etc/zabbix",
+        "why": "Optionale, aber übliche Proxmox-Werkzeuge. Fehlende Pfade werden in <code>metadata/missing_paths.txt</code> vermerkt, ohne das Backup zu stoppen."
+      },
+      {
+        "category": "ProxMenux Binärdateien und root",
+        "paths": "/usr/local/bin, /usr/local/sbin, /usr/local/share/proxmenux, /var/lib/proxmenux, /root (ausgenommen flüchtige Subdir)",
+        "why": "ProxMenux-installierte Binärdateien und Konfiguration pro Benutzer unter <code>/root</code>. Flüchtige Pfade (<code>.bash_history</code>, <code>.cache/</code>, <code>tmp/</code>, <code>.local/share/Trash/</code>) sind von der Kopie ausgeschlossen. <code>/var/lib/proxmenux</code> hält die geplanten Backup-Jobs und den Host-Status, der von ProxMenux beibehalten wird; das Wiederherstellungsstaging, die Rollback-Kopien und die Post-Restore-Marker sind ausgeschlossen, da sie zu dem Host gehören, der eine Wiederherstellung ausführt."
+      },
+      {
+        "category": "ZFS-Zustand (bedingter Zustand)",
+        "paths": "/etc/zfs",
+        "why": "Nur enthalten, wenn der Quellhost ZFS ausführt. Enthält <code>zpool.cache</code> und <code>hostid</code>."
+      }
+    ],
+    "customTitle": "Erweiterung des Profils mit benutzerdefinierten Pfaden",
+    "customBody": "Neben dem Standardprofil bietet ProxMenux zwei Möglichkeiten, zusätzliche Pfade in ein Backup aufzunehmen. Sie komponieren ohne Konflikte und gelten beide für interaktive Backups und geplante Jobs.",
+    "customExtrasTitle": "1. Persistente Extras (Pro-Host-Datei)",
+    "customExtrasBody": "Eine Textdatei bei <code>/usr/local/share/proxmenux/backup-extra-paths.txt</code> enthält eine Liste absoluter Pfade, die der Benutzer auf diesem Host als \"immer einschließen\" markiert hat. Wenn ein Backup im <strong>Default</strong>-Modus ausgeführt wird, fügt ProxMenux diese Pfade automatisch an das Standardprofil an, ohne zu fragen. Die Datei wird von der Benutzeroberfläche aus bearbeitet - keine manuelle Bearbeitung erforderlich - und bleibt bei Neustarts und Updates bestehen. Ein absoluter Pfad pro Zeile; <code>#</code>-Kommentare sind zulässig.",
+    "customModeTitle": "2. Benutzerdefinierter Modus (per Lauf)",
+    "customModeBody": "Das Starten eines Backups im <strong>Custom</strong>-Modus ersetzt die automatische Anwendung des Standardprofils durch eine Checkliste, die jeden Pfad anzeigt: die Standardprofileinträge und die persistenten Extras (vorangestellt mit <code>[+]</code> und bereits ausgewählt). Der Benutzer aktiviert oder deaktiviert Einträge für diesen bestimmten Lauf und kann auch <em>Eigenen Pfad hinzufügen</em> drücken, um einen neuen Pfad einzugeben - der dann für zukünftige Backups auf der Extras-Datei verbleibt.",
+    "customMissingTitle": "Aus der Quelle fehlende Pfade",
+    "customMissingBody": "Jeder Pfad aus dem Profil (Standard oder hinzugefügt), der auf dem Quellhost nicht vorhanden ist, wird in <code>metadata/missing_paths.txt</code> im Archiv aufgezeichnet. Das Backup schlägt nicht fehl und stoppt nicht – der Benutzer sieht am Ende eine Zusammenfassung der archivierten Pfade und fehlenden Pfade. In der Praxis geschieht dies bei optionalen Werkzeugpfaden wie <code>/etc/wireguard</code> oder <code>/etc/prometheus</code>, wenn diese Werkzeuge nicht installiert sind."
+  },
+  "manifest": {
+    "heading": "Der Manifest-Datenblock",
+    "intro": "<code>manifest.json</code> ist ein strukturiertes JSON-Dokument, das den Quellhost zum Zeitpunkt des Backups beschreibt. Es wird von <strong>sechs unabhängigen Erfassungsskripten</strong> orchestriert von <code>build_manifest.sh</code> produziert. Jeder Kollektor ist schreibgeschützt, erzeugt ein gut definiertes JSON-Fragment und fällt bei einem Ausfall auf einen sicheren leeren Standard zurück - das Manifest ist immer noch verwendbar, wenn ein Abschnitt unvollständig ist.",
+    "orchestratorCaption": "Die sechs Sammler verfassen das Manifest. Jeder Kollektor läuft in seinem eigenen Subprozess; ein Fehler in einem fällt auf einen dokumentierten sicheren Standard zurück und warnt, bricht aber das Backup nicht ab.",
+    "collectorRows": [
+      {
+        "collector": "collect_source_host.sh",
+        "produces": "source_host",
+        "content": "Hostname, PVE-Version (<code>pveversion</code>), PBS-Version, wenn der Host die Backup-Server-Rolle ausführt, Kernel (<code>uname -r</code>), Boot-Modus (efi/bios), Root-Dateisystemtyp, CPU-Modell + Architektur, Speicher in KB."
+      },
+      {
+        "collector": "collect_hardware.sh",
+        "produces": "hardware_inventory",
+        "content": "GPUs (mit Hersteller- und ProxMenux-Installationsprogramm), TPUs (Coral USB + M.2 mit <code>lsusb</code>/<code>lspci</code>-Erkennung), NICs (mit MAC-, PCI-Slot- und Bridge-Mitgliedschaft), drahtlose Geräte. GPU-Einträge tragen eine <code>passthrough_eligible</code>-Heuristik."
+      },
+      {
+        "collector": "collect_storage.sh",
+        "produces": "storage_inventory",
+        "content": "ZFS-Pools (mit Pooltyp + Mitglieds-Festplatten, die nach <code>/dev/disk/by-id/*</code>, <code>/dev/disk/by-partuuid/*</code> oder rohen <code>/dev/sdX</code>-Pfaden aufgelöst wurden, je nachdem, wie jeder Pool ursprünglich erstellt wurde), LVM-Volumengruppen + dünne Pools, physische Festplatten mit SMART-Fähigkeit, PVE <code>storage.cfg</code>-Einträge, externe Mounts."
+      },
+      {
+        "collector": "collect_kernel.sh",
+        "produces": "kernel_params",
+        "content": "Vom Betreiber hinzugefügte Parameter aus <code>/proc/cmdline</code>, ohne übliche Standardwerte wie <code>BOOT_IMAGE=</code>, <code>root=</code>, <code>ro/rw</code>, <code>quiet</code> und <code>splash</code>; beim Start geladene Module aus <code>/etc/modules</code>; sowie Pfade der Dateien <code>/etc/modprobe.d/*.conf</code> mit tatsächlichen Direktiven (<code>options</code>, <code>blacklist</code>, <code>install</code>, <code>alias</code>, <code>softdep</code>)."
+      },
+      {
+        "collector": "collect_proxmenux_state.sh",
+        "produces": "proxmenux_installed_components",
+        "content": "Lesen Sie <code>/usr/local/share/proxmenux/managed_installs.json</code> (Registrierung von allem, was ProxMenux installiert hat) und <code>installed_tools.json</code>. Jeder Eintrag behält den Installationspfad (<code>menu_script</code>) bei, so dass die Wiederherstellung genau den gleichen Installationsfluss auslösen kann."
+      },
+      {
+        "collector": "collect_guests.sh",
+        "produces": "vms_lxcs_at_backup",
+        "content": "Zählt VMs (<code>qm list</code>) und LXCs (<code>pct list</code>) auf, die zum Backup-Zeitpunkt vorhanden sind — VMID, Name, aktueller Status. Nur das Inventar: Die eigentlichen Gästedaten liegen in der Verantwortung von <code>vzdump</code> / PBS."
+      }
+    ],
+    "schemaTitle": "Validierung des Schemas",
+    "schemaBody": "Das Manifest bestätigt gegen <code>scripts/backup_restore/schema/manifest.schema.json</code>. Das Ausführen von <code>build_manifest.sh --validate</code> löst eine Python-seitige JSON-Schemavalidierung aus (erfordert <code>python3</code> + <code>jsonschema</code>). Wenn das Modul nicht vorhanden ist, wird die Überprüfung still übersprungen - die Validierung ist in erster Linie eine Entwicklerhilfe, keine Laufzeitabhängigkeit."
+  },
+  "applications": {
+    "heading": "Das Anwendungsinventar",
+    "intro": "Zwei Inventare erfassen die zusätzlich zu den Proxmox-VE-Basispaketen installierte Software: die Paketliste unter <code>metadata/</code> und das Komponentenverzeichnis im rootfs, beide unten beschrieben. Die Wiederherstellung installiert die Benutzersoftware je nach ursprünglichem Installationsweg mit APT oder den ProxMenux-Installationsskripten neu.",
+    "packagesTitle": "packages.manual.list",
+    "packagesBody": "Eine alphabetisch sortierte Textliste aus <code>apt-mark showmanual</code> mit allen auf dem Quellhost <em>ausdrücklich installierten</em> APT-Paketen. Als Abhängigkeiten des Proxmox-VE-Basissystems installierte Pakete fehlen darin; APT auf dem Ziel zieht sie selbst nach. Bei der Wiederherstellung liest <code>_rs_run_complete_extras</code> die Liste und wendet einen dreistufigen <em>Filter gegen Kaskadenentfernung</em> an: <code>dpkg -s</code> erkennt bereits installierte Pakete, für Bibliotheken werden vorhandene andere Hauptversionen erkannt und <code>apt-get install --simulate</code> prüft das Risiko von Folgeentfernungen. Danach folgt <code>apt-get install -y</code>.",
+    "componentsTitle": "components_status.json (Teil des rootfs)",
+    "componentsBody": "Ein JSON-Verzeichnis unter <code>/usr/local/share/proxmenux/</code> erfasst jede von ProxMenux installierte Komponente mit ihrem genauen Zustand: Version und ProxMenux-spezifische Merkmale (bei NVIDIA der boolesche Wert <code>patched</code>, bei Coral die DKMS-Version). Die Datei liegt im rootfs und nicht unter <code>metadata/</code>, weil sie <em>erst gelesen wird, nachdem</em> das rootfs auf das Ziel kopiert wurde. Der nach dem Start ausgeführte Dispatcher (<code>apply_cluster_postboot.sh</code>) geht alle Einträge durch und ruft den <code>--auto-reinstall</code>-Hook der jeweiligen Komponente auf. Dieser liest den gespeicherten Zustand und stellt die Installation für den aktuellen Kernel des Zielsystems wieder her.",
+    "componentInstallersTitle": "Installationsskripte für Komponenten",
+    "componentInstallersBody": "Vier ProxMenux-Installateure stellen derzeit einen <code>--auto-reinstall</code>-Einstiegspunkt frei:",
+    "installerRows": [
+      {
+        "component": "nvidia_driver",
+        "installer": "gpu_tpu/nvidia_installer.sh",
+        "action": "Lesen Sie <code>version</code> + <code>patched</code>. Downloads der exakt gleichen NVIDIA-Runfile, baut DKMS-Module gegen den Kernel des Ziels und wendet den ProxMenux-Patch erneut an, wenn die Quelle ihn hatte."
+      },
+      {
+        "component": "coral_driver",
+        "installer": "gpu_tpu/install_coral.sh",
+        "action": "Lesen Sie die Coral Driver Version. Kompiliert das DKMS-Modul gegen den Kernel des Ziels."
+      },
+      {
+        "component": "amdgpu_top",
+        "installer": "gpu_tpu/amd_gpu_tools.sh",
+        "action": "Lesen Sie die aufgezeichnete Version. Laden Sie die genaue <code>.deb</code> aus dem GitHub-Release erneut herunter."
+      },
+      {
+        "component": "intel_gpu_tools",
+        "installer": "gpu_tpu/intel_gpu_tools.sh",
+        "action": "APT installiert das Paket. Idempotent, wenn bereits vorhanden von <code>packages.manual.list</code>."
+      }
+    ]
+  },
+  "restoreFlow": {
+    "heading": "Wie die Wiederherstellung die drei Nutzlasten verbraucht",
+    "intro": "Die Wiederherstellung ist eine sechsstufige Pipeline. Jede Stufe liest eine bestimmte Untergruppe des Archivs und aktualisiert den Zielhost. Keine Stufe erfordert, dass der Quellhost erreichbar ist - das Archiv ist vollständig in sich geschlossen.",
+    "stagesCaption": "Stufe 1 wertet das Manifest aus und legt fest, was geändert werden darf. Stufe 2 kopiert rootfs-Pfade, die auf dem laufenden System angewendet werden können. Stufe 3 bereitet riskante Pfade für den nächsten Start vor. Stufe 3b importiert ZFS-Datenpools ohne Root-Dateisystem, deren Datenträger vollständig vorhanden sind. Stufe 4 installiert Pakete. Stufe 5 installiert nach dem Neustart Komponenten für den Kernel des Ziels neu.",
+    "stageRows": [
+      {
+        "stage": "1",
+        "name": "Kompatibilitätsprüfung",
+        "reads": "manifest.json",
+        "action": "Läuft <code>hb_compat_check</code> aus. Vergleicht Quelle und Zielhardware (NICs, Storage IDs), PVE-Version und Hauptkernel-Version. Setzt <code>HB_COMPAT_KERNEL_DIRECTION</code> (<code>same</code>, <code>bk_newer</code> oder <code>bk_older</code>) ein und füllt <code>RS_SKIP_PATHS</code> mit Hardware-Drift- und Cross-Kernel-Ausschlüssen."
+      },
+      {
+        "stage": "2",
+        "name": "Anwenden im laufenden Betrieb",
+        "reads": "rootfs/ (nur sichere Pfade)",
+        "action": "<code>_rs_apply … hot</code> kopiert <code>hb_classify_path</code>=<code>hot</code>-Einträge direkt auf das Live-Ziel. Alles, was unter <code>/etc/pve</code>, <code>/etc/network</code> oder als <em>reboot</em>/<em>dangerous</em> klassifiziert ist, wird verschoben."
+      },
+      {
+        "stage": "3",
+        "name": "Ausstehende Vorbereitung",
+        "reads": "rootfs/ (Reboot + gefährliche Pfade)",
+        "action": "<code>_rs_prepare_pending_restore</code> bereitet riskante Pfade unter <code>/var/lib/proxmenux/pending-restore/</code> vor, schreibt <code>plan.env</code>, <code>apply-on-boot.list</code> und <code>rs-skip-paths.txt</code> und aktiviert <code>proxmenux-restore-onboot.service</code> für den nächsten Start."
+      },
+      {
+        "stage": "3b",
+        "name": "Import von Datenpools",
+        "reads": "manifest.storage_inventory + ZFS-Zustand des Ziels",
+        "action": "<code>_rs_import_data_pools</code> importiert jeden Nicht-Root-ZFS-Pool, dessen vollständiger Satz von Festplatten auf dem Ziel vorhanden ist. Pools mit einem fremden Hostid werden mit <code>zpool import -f</code> getestet. Pools, denen eine Festplatte fehlt, werden mit einer Warnung übersprungen. Das Ergebnis pro Pool wird in <code>/var/log/proxmenux/restore-datapools-&lt;timestamp&gt;.log</code> aufgezeichnet."
+      },
+      {
+        "stage": "4",
+        "name": "Paketinstallation",
+        "reads": "metadata/packages.manual.list",
+        "action": "<code>_rs_run_complete_extras</code> führt den kaskadensicheren Filter aus und ruft <code>apt-get install -y</code> mit der Paketliste auf. Die volle Ausgabe geht an <code>/var/log/proxmenux/restore-apt-*.log</code>."
+      },
+      {
+        "stage": "5",
+        "name": "Postboot",
+        "reads": "rootfs (bereits angewendet) + components_status.json",
+        "action": "Nach dem Neustart spielt <code>apply_pending_restore.sh</code> die zurückgestellten Pfade ab und <code>apply_cluster_postboot.sh</code> läuft <code>update-initramfs</code>, <code>update-grub</code> (oder <code>proxmox-boot-tool refresh</code>) und iteriert über <code>components_status.json</code> und feuert den <code>--auto-reinstall</code>-Hook jeder Komponente."
+      }
+    ]
+  },
+  "whyItWorks": {
+    "heading": "Warum der Drei-Payload-Split verwendet wird",
+    "body": "Die Aufteilung richtet sich nach dem <strong>Lebenszyklus</strong> der Daten. Dateisysteminhalte werden mit <code>rsync</code> übertragen: schnell, nachvollziehbar und atomar je Datei. Der vor Änderungen auszuwertende Konfigurationszustand liegt als <strong>strukturiertes JSON</strong> vor: unabhängig lesbar, per Schema versionierbar und maschinell mit dem Zielzustand vergleichbar. Neu zu installierende Software wird als <strong>Inventar</strong> mit Namen und Versionen erfasst. Der Paketmanager des Ziels und die ProxMenux-Installationsskripte wählen die passenden Binärdateien. Jeder Datenblock erfüllt seine eigene Aufgabe. Zusammen ermöglichen sie eine auf konsistente Wiederherstellung ausgerichtete, fehlertolerante Verarbeitung: Bei beschädigtem Manifest bleibt rootfs wiederherstellbar; ein fehlendes Paket verhindert die Komponenteninstallation nicht; scheitert ein Komponenteninstallationsskript an einem Eintrag, wird der nächste trotzdem bearbeitet."
+  }
+}
diff --git a/web/messages/de/docs/backup-restore/index.json b/web/messages/de/docs/backup-restore/index.json
new file mode 100644
index 00000000..fa7bac95
--- /dev/null
+++ b/web/messages/de/docs/backup-restore/index.json
@@ -0,0 +1,93 @@
+{
+  "meta": {
+    "title": "ProxMenux Sichern und Wiederherstellen – Übersicht | Vollständige Hostsicherung und -wiederherstellung für Proxmox VE",
+    "description": "ProxMenux Backup & Restore erfasst den vollständigen Zustand eines Proxmox-Hosts – Dateisystem, strukturiertes Konfigurationsmanifest und installierte Pakete/Komponenten – und reproduziert ihn auf demselben oder einem anderen Host. Das Backup und die Wiederherstellung sind in sich geschlossen: keine externen Abhängigkeiten und Kernel-übergreifende Wiederherstellungen werden durch einen richtungsbewussten Safe-Subset-Filter und eine Kernel-agnostische Hydratation unterstützt.",
+    "ogTitle": "ProxMenux Sicherung und Wiederherstellung – Übersicht",
+    "ogDescription": "Vollständige Hostsicherung und -wiederherstellung für Proxmox VE mit strukturiertem Manifest, Paketliste und Neuinstallationsprogrammen für Komponenten.",
+    "twitterTitle": "ProxMenux Sichern und Wiederherstellen | ProxMenux",
+    "twitterDescription": "Vollständige Hostsicherung und -wiederherstellung für Proxmox VE mit strukturiertem Manifest, Paketliste und Komponenten-Neuinstallationsprogrammen."
+  },
+  "header": {
+    "title": "Sichern und Wiederherstellen",
+    "description": "Vollständige Hostsicherung und -wiederherstellung für Proxmox VE. Erfasst Dateisystem, Konfiguration und installierte Komponenten in einem einzigen Archiv und reproduziert den Host auf derselben oder einer anderen Proxmox-Installation ohne externe Abhängigkeiten.",
+    "section": "Sichern und Wiederherstellen"
+  },
+  "intro": {
+    "title": "Was es ist, in einem Absatz",
+    "body": "Eine ProxMenux-Sicherung erfasst den vollständigen Zustand eines Proxmox-Hosts: <strong>das Dateisystem</strong> mit den relevanten Verzeichnissen unter <code>/etc</code>, <code>/root</code> und <code>/var/lib/pve-cluster</code> sowie optionalen eigenen Pfaden; <strong>ein strukturiertes Manifest</strong> im JSON-Format mit erkannter Hardware, Kernel-Parametern, Netzwerkkonfiguration, ZFS-Zustand, Benutzern und Cron-Einträgen; und <strong>ein Anwendungsinventar</strong> mit allen von APT als manuell installiert markierten Paketen und den von ProxMenux installierten Komponenten samt exakten Versionen. Alle drei unterstützten Ziele – lokales Archiv, Proxmox Backup Server (empfohlen) und Borg – erhalten denselben eigenständigen Datenbestand. Mit jedem davon lässt sich der Zielhost wiederherstellen, ohne dass der Quellhost während der Wiederherstellung erreichbar sein muss."
+  },
+  "video": {
+    "heading": "Videoanleitung",
+    "intro": "Beobachten Sie Backup & Restore lieber in Aktion, bevor Sie es konfigurieren? Diese exemplarische Vorgehensweise umfasst eine vollständige End-to-End-Demo der Funktion in ProxMenux.",
+    "title": "ProxMenux – Anleitung zum Sichern und Wiederherstellen",
+    "caption": "Externes Video auf YouTube. Spielt im erweiterten Datenschutzmodus (keine Cookies, bis Sie auf „Play“ drücken)."
+  },
+  "whatItIsNot": {
+    "heading": "Was es nicht ist",
+    "intro": "Dieser Abschnitt beschreibt Sicherung und Wiederherstellung <strong>auf Host-Ebene</strong>: die Proxmox-Installation selbst, nicht die darauf ausgeführten Anwendungen und Gastsysteme.",
+    "items": [
+      "<strong>Dies ist kein Sicherungswerkzeug für VMs oder CTs.</strong> Gastfestplatten und RAM-Zustand werden nicht erfasst; dafür ist <code>vzdump</code> zuständig. Die <strong>Konfigurationsdateien</strong> der Gäste (<code>/etc/pve/nodes/&lt;node&gt;/qemu-server/*.conf</code> und <code>lxc/*.conf</code>) werden <strong>jedoch</strong> gesichert. Nach der Wiederherstellung erscheint das Gastinventar erneut, und die Festplatten können aus einer vorhandenen PBS- oder lokalen Sicherung wiederhergestellt und zugeordnet werden.",
+      "<strong>Dies ist kein clusterweiter Vorgang.</strong> Jeder Knoten sichert sich selbst. Die Clusterzugehörigkeit wird mit <code>/etc/pve</code> erfasst, sodass ein wiederhergestellter Knoten erneut aufgenommen werden kann. Die Wiederherstellung eines ganzen Clusters erfordert jedoch die Abstimmung zwischen den einzelnen Knoten.",
+      "<strong>Dies ist kein vollständiges Festplattenabbild.</strong> Kernel-Binärdateien, initramfs und Boot-Partition werden nicht gesichert. Bei der Wiederherstellung nutzt ProxMenux die Boot-Dateien des Zielhosts, die mit <code>update-initramfs</code> und dem Bootloader-Werkzeug automatisch neu erzeugt werden, und installiert passende Treiber für den dort laufenden Kernel."
+    ]
+  },
+  "threePillars": {
+    "heading": "Die drei Säulen eines Backups",
+    "intro": "Ein ProxMenux-Archiv ist um drei in sich geschlossene Nutzdaten herum strukturiert. Bei der Wiederherstellung werden alle drei zusammen verwendet, um den Quellhost auf einem Ziel zu reproduzieren, auf dem möglicherweise nicht einmal derselbe Kernel installiert ist.",
+    "diagramCaption": "Jedes Backup versendet unabhängig vom Ziel dieselben drei Payloads. Die Wiederherstellung verbraucht alle drei: rootfs zum Ablegen von Dateien, Manifest zum Erkennen von Abweichungen und Kernel-übergreifenden Unterschieden und Anwendungsinventar zum Neuinstallieren von Paketen und Komponenten im eigenen Kernel des Ziels.",
+    "pillar1Label": "Dateisystem",
+    "pillar1Detail": "rootfs/\n(rsync von /etc,\n/etc/systemd/network,\n/root sowie ein\nsqlite3-Snapshot\nvon /var/lib/pve-cluster,\n+ optionale Pfade)",
+    "pillar2Label": "Manifest",
+    "pillar2Detail": "manifest.json\n(Hardware, Kernel-\nParameter, Netzwerk,\nZFS, Benutzer, Cron,\nZFS-Pools, Speicher)",
+    "pillar3Label": "Anwendungen",
+    "pillar3Detail": "packages.manual.list\n+ components_status.json\n(manuelle APT-Pakete + ProxMenux-\nInstaller mit Versionen)"
+  },
+  "restoreIsUniversal": {
+    "heading": "Die Wiederherstellung reproduziert den Quellhost, nicht das Archiv",
+    "body": "Beim Wiederherstellen eines ProxMenux-Backups wird nicht nur das Dateisystem extrahiert. Der Wiederherstellungsfluss liest das Manifest, um Abweichungen zwischen der Quelle und dem Ziel zu erkennen (Hardwareunterschiede, NIC-Umbenennungen, Kernelversion, ZFS-Pool-Identität), spielt das Dateisystem erneut ab und löst dann das richtige Komponenteninstallationsprogramm für jeden Dienst aus, der auf der Quelle installiert wurde (NVIDIA-Treiber, Coral TPU, AMD GPU-Tools, Intel-GPU-Tools). Jedes Installationsprogramm wird für den aktuellen Kernel des <strong>Ziels</strong> ausgeführt, sodass der wiederhergestellte Host nicht davon abhängt, dass der Kernel der Quelle vorhanden ist. Wenn der Kernel des Ziels neuer ist als der des Backups, führt ein Kernel-unabhängiger <strong>Hydration</strong>-Durchgang die eigene Optimierung des Benutzers (IOMMU-Tokens, VFIO-Geräte-IDs, benutzerdefinierte Sonderanpassungen, GRUB-Schlüssel) in die neue Startkonfiguration des Ziels ein, ohne Kernel-gebundene Dateien wörtlich zu kopieren."
+  },
+  "twoInterfaces": {
+    "heading": "Zwei Schnittstellen, ein Backend",
+    "intro": "Alle Schritte der Sicherung und Wiederherstellung sind über zwei Oberflächen erreichbar. Beide rufen dieselbe Shell-Bibliothek auf, erstellen identische Archive und verwenden dasselbe Auftragsverzeichnis.",
+    "cliLabel": "ProxMenux Scripts (TUI)",
+    "cliDetail": "Menü → Dienstprogramme →\nHost-Sicherung/Wiederherstellung\n\nDialogbasierter Ablauf,\nSSH-freundlich, skriptfähig\nzur unbeaufsichtigten Nutzung.",
+    "webLabel": "ProxMenux Monitor (Web UI)",
+    "webDetail": "Registerkarte Backups in der\nWeboberfläche von Monitor.\n\nWiederherstellung mit einem Klick,\nlaufende Protokollanzeige, integriert\nmit Benachrichtigungen und der\nAnzeige von Rollback-Differenzen."
+  },
+  "whereNext": {
+    "heading": "Wohin geht es von hier aus?",
+    "intro": "Jeder Unterabschnitt unten behandelt einen Aspekt des Arbeitsablaufs ausführlich. Beginnen Sie mit <em>Wie es funktioniert</em>, wenn das Ziel darin besteht, zu verstehen, was das Archiv enthält und warum. Wechseln Sie zu <em>Ziele</em>, um das Ziel für die Kopie zu konfigurieren. Lesen Sie <em>Wiederherstellung</em> und <em>Cross-Kernel-Wiederherstellung</em> für die Wiederherstellungsseite.",
+    "items": [
+      {
+        "label": "So funktioniert es",
+        "href": "/docs/backup-restore/how-it-works",
+        "tail": "– die drei Payloads (rootfs, Manifest, Anwendungen) im Detail, mit den Collectors, die sie erzeugen, und dem Format jeder Datei."
+      },
+      {
+        "label": "Ziele",
+        "href": "/docs/backup-restore/destinations",
+        "tail": "– Vergleich von lokal, Proxmox Backup Server (empfohlen) und Borg und wie man sie jeweils konfiguriert."
+      },
+      {
+        "label": "Backups erstellen",
+        "href": "/docs/backup-restore/creating-backups",
+        "tail": "– einmalige Sicherungen, das Standardpfadprofil, Hinzufügen benutzerdefinierter Pfade, Verschlüsselung für PBS."
+      },
+      {
+        "label": "Geplante Jobs",
+        "href": "/docs/backup-restore/scheduled-jobs",
+        "tail": "– neue Jobs im Vergleich zum Anhängen an einen vorhandenen PVE-vzdump-Job, Planungsformate, das Jobdetail-Modal."
+      },
+      {
+        "label": "Wiederherstellen",
+        "href": "/docs/backup-restore/restoring",
+        "tail": "– die drei Aktionen für ein Archiv (Anzeigen, Herunterladen, Wiederherstellen), vollständige vs. benutzerdefinierte Wiederherstellung, der Post-Boot-Dispatcher und warum die letzten zehn Minuten wichtig sind."
+      },
+      {
+        "label": "Kernelübergreifende Wiederherstellung",
+        "href": "/docs/backup-restore/cross-kernel",
+        "tail": " — vom Versionswechsel abhängiges Verhalten bei unterschiedlichen Quell- und Zielkerneln, der Filter für eine sichere Teilmenge und die vier Hydratationsphasen."
+      }
+    ]
+  }
+}
diff --git a/web/messages/de/docs/backup-restore/restoring.json b/web/messages/de/docs/backup-restore/restoring.json
new file mode 100644
index 00000000..0804b2dd
--- /dev/null
+++ b/web/messages/de/docs/backup-restore/restoring.json
@@ -0,0 +1,282 @@
+{
+  "meta": {
+    "title": "Wiederherstellen eines Backups – vollständige und benutzerdefinierte Abläufe | ProxMenux",
+    "description": "Der komplette Wiederherstellungsworkflow. Dokumentiert die drei Aktionen, die für jedes Backup verfügbar sind (Ansicht, Download, Wiederherstellung), die Kompatibilitätsprüfung und ihre Ergebnisse, die vollständigen und benutzerdefinierten Wiederherstellungsmodi, die Pfadklassifizierung, die entscheidet, was live gilt und was auf den nächsten Start wartet, den On-Boot-Dispatcher und den Post-Boot-Komponentenneuinstallationspass.",
+    "ogTitle": "ProxMenux Backup — Wiederherstellung",
+    "ogDescription": "Vollständige und benutzerdefinierte Wiederherstellungsflüsse mit Kompatibilitätsprüfung, Pfadklassifizierung, On-Boot-Dispatcher und Post-Boot-Neuinstallation.",
+    "twitterTitle": "Wiederherstellen eines Backups | ProxMenux",
+    "twitterDescription": "Wie ein ProxMenux-Host-Backup wieder in einen funktionierenden Proxmox-Host umgewandelt wird."
+  },
+  "header": {
+    "title": "Wiederherstellen eines Backups",
+    "description": "Der vollständige Wiederherstellungsworkflow: vom Auswählen eines Archivs bis zum Arbeitshost. Dokumentiert die Kompatibilitätsprüfung, die beiden Wiederherstellungsmodi, den On-Boot-Dispatcher, den Post-Boot-Reinstallationspass und die Mechanismen, die Cross-Host- und Cross-Kernel-Wiederherstellungen vorhersehbar machen.",
+    "section": "Sicherung und Wiederherstellung"
+  },
+  "intro": {
+    "title": "Die Wiederherstellung reproduziert die Quelle, nicht nur die Dateien",
+    "body": "Ein ProxMenux-Backup wiederherzustellen umfasst mehr als das Entpacken von Dateien. Vor Änderungen wertet die Wiederherstellung das Manifest aus, erkennt Unterschiede zwischen Quelle und Ziel, schließt möglicherweise startgefährdende Pfade aus und passt Benutzereinstellungen an, die nicht unverändert kopiert werden können. Nach dem erforderlichen Neustart versucht sie, die erfassten unterstützten Komponenten (NVIDIA-Treiber, Coral-TPU und GPU-Werkzeuge) für den laufenden Zielkernel neu zu installieren. Ein ausgewähltes Archiv steuert Kompatibilitätsprüfung, Pfadklassifizierung und die Arbeiten beim und nach dem Start. Prüfen Sie die Komponentenergebnisse und Protokolle."
+  },
+  "threeActions": {
+    "heading": "Drei Aktionen auf einem Backup",
+    "intro": "Durch Auswählen eines Backups aus der Liste wird ein Menü mit drei Aktionen geöffnet.",
+    "actionRows": [
+      {
+        "action": "Ansicht",
+        "detail": "Öffnet eine schreibgeschützte Ansicht des Archivs: manifest.json-Inhalte (Quellhostname, PVE-Version, Kernel, Hardware, installierte Komponenten), die Liste der Pfade innerhalb von <code>rootfs/</code> und ein Vergleich dessen, was sich auf dem aktuellen Host ändern würde, wenn das Backup angewendet würde."
+      },
+      {
+        "action": "Herunterladen",
+        "detail": "Exportiert das Archiv als tragbare <code>.tar.zst</code>-Datei (tar komprimiert mit zstd). Es kann auf jedem Linux-System mit <code>tar --zstd -xf FILE.tar.zst</code> extrahiert werden, oder auf macOS / Windows mit jedem Tool, das zstd unterstützt (7-Zip, PeaZip, Keka ...). Der extrahierte Baum enthält <code>manifest.json</code>, <code>metadata/</code> und <code>rootfs/</code> - genau das gleiche Layout, das die Wiederherstellung verbraucht. Nützlich für die Offline-Inspektion oder für die Wiederherstellung auf einem Host ohne Zugriff auf das ursprüngliche Ziel (PBS, Borg)."
+      },
+      {
+        "action": "Wiederherstellen",
+        "detail": "Der Schreibpfad. Extrahiert das Archiv in ein Staging-Verzeichnis, führt die Kompatibilitätsprüfung aus und präsentiert den Moduswähler (Full oder Custom)."
+      }
+    ]
+  },
+  "compatibilityCheck": {
+    "heading": "Die Vereinbarkeitsprüfung",
+    "intro": "Bevor eine Datei geschrieben wird, vergleicht <code>hb_compat_check</code> den im Manifest beschriebenen Zustand mit dem Zielhost. Der Check läuft schreibgeschützt und erzeugt vier unabhängige Ausgänge, die den Rest der Wiederherstellung steuern.",
+    "outputRows": [
+      {
+        "output": "Kernel-Richtungskennzeichen",
+        "detail": "<code>HB_COMPAT_KERNEL_DIRECTION</code> — eines von <code>same</code>, <code>bk_newer</code> oder <code>bk_older</code>. Vergleicht die Hauptkernelversion des Backups mit der des Ziels. Steuert den Cross-Kernel-Safe-Subset-Filter (feuert nur auf <code>bk_older</code>) und den Hydratationspass, der auf der Cross-Kernel-Seite dokumentiert ist."
+      },
+      {
+        "output": "Liste der Skip Paths",
+        "detail": "<code>RS_SKIP_PATHS</code> - jeder Pfad, den die Wiederherstellung NICHT anwenden darf. Bevölkert durch zwei Mechanismen: Hardware-Drift (fehlende NIC, fehlende Speicher-ID, ausländischer ZFS-Pool) und - wenn die Richtung <code>bk_older</code> ist - die kernübergreifende Liste der unsicheren Pfade."
+      },
+      {
+        "output": "NIC-Remapplan",
+        "detail": "Wenn ein NIC auf dem Ziel den gleichen MAC wie auf der Quelle, aber einen anderen Namen hat (typischerweise nach einem Motherboard-Swap), registriert die Kompatibilitätsprüfung einen Umbenennungsplan (<code>HB_NIC_REMAP</code>), der <code>/etc/network/interfaces</code> während der Wiederherstellung umschreibt."
+      },
+      {
+        "output": "Rollback-Plan",
+        "detail": "Berechnet durch <code>compute_rollback_plan.sh</code>. Listet VMs, LXCs und Komponenten auf, die auf dem Ziel, aber nicht im Backup vorhanden sind. Im Bestätigungsdialog kann das Entfernen zusätzlicher Gäste vor dem Neustart gewählt werden. Komponenten müssen manuell entfernt werden; auch das Löschen von Gästen kann scheitern. Eine exakte Übereinstimmung wird daher nicht garantiert."
+      }
+    ],
+    "reportBody": "Der Check sendet auch einen strukturierten Bericht (<code>HB_COMPAT_RESULTS</code>) aus, der als PASS / INFO / WARN / FAIL kategorisiert ist. WARN- und FAIL-Einträge tauchen im Pre-Restore-Bereich auf; die Wiederherstellung weigert sich, nur dann fortzufahren, wenn ein FAIL vorhanden ist, den der Benutzer nicht durch Klicken auf Weiter beheben kann."
+  },
+  "twoModes": {
+    "heading": "Vollständige Wiederherstellung vs Custom Wiederherstellung",
+    "intro": "Nach der Kompatibilitätsprüfung erscheint die Modusauswahl. Sie bestimmt, <em>was</em> angewendet wird und nicht, <em>wie</em>: Beide Modi verwenden denselben Ablauf.",
+    "modeRows": [
+      {
+        "mode": "Vollständige Wiederherstellung",
+        "detail": "Wendet jeden Pfad im Archiv an, der die Drift- und Kreuzkernfilter überlebt. Führt auch die Paketinstallation und den automatischen Komponentenneuinstallationspass aus. Dies ist der Standard und die empfohlene Wahl - das Ziel ist es, die Quelle zu reproduzieren, nicht Stücke auszuwählen."
+      },
+      {
+        "mode": "Benutzerdefinierte Wiederherstellung",
+        "detail": "Öffnet eine Checkliste, die jeden Pfad zeigt, den das Archiv führt. Der Benutzer tickt eine Teilmenge. Durch den Kreuzkernfilter blockierte Pfade erscheinen ausgegraut und können nicht ausgewählt werden. Paketinstallation und automatische Neuinstallation von Komponenten werden standardmäßig im benutzerdefinierten Modus übersprungen - der Benutzer signalisiert, dass er eine teilweise Anwendung und keine vollständige Reproduktion wünscht."
+      }
+    ]
+  },
+  "pathClassification": {
+    "heading": "Wie Pfade klassifiziert werden",
+    "intro": "Jeder für die Wiederherstellung ausgewählte Pfad wird von <code>hb_classify_path</code> in eine von drei Kategorien eingestuft. Die Kategorie bestimmt, wann der Pfad auf das System angewendet wird und warum.",
+    "rows": [
+      {
+        "class": "hot",
+        "detail": "Pfade angewendet <strong>sofort</strong> auf das laufende System. Der Dienst, der sie verbraucht, nimmt die Änderung selbst oder beim nächsten Neuladen auf - kein Neustart erforderlich. Dies ist der Hauptteil eines Backups: <code>/etc/ssh</code>, <code>/etc/apt</code>, <code>/etc/cron.*</code>, <code>/root</code>, <code>/usr/local/bin</code>, allgemeine Servicekonfigurationsdateien usw."
+      },
+      {
+        "class": "reboot",
+        "detail": "Pfade, die dieser Ablauf für den <strong>nächsten Start</strong> zurückstellt, statt sie <strong>sofort</strong> anzuwenden. Sie betreffen die Startkonfiguration: Die Bootloader-Erzeugung liest <code>/etc/default/grub</code>, das Einhängen nutzt <code>/etc/fstab</code> und das Laden von Modulen <code>/etc/modules</code>. Nach dem Neustart werden die vorgemerkten Dateien angewendet und die nötigen Startartefakte neu erzeugt. Beispiele: <code>/etc/default/grub</code>, <code>/etc/kernel</code>, <code>/etc/modules</code>, <code>/etc/fstab</code>, <code>/etc/zfs</code>, <code>/etc/modprobe.d</code>."
+      },
+      {
+        "class": "dangerous",
+        "detail": "Pfade, die <strong>NICHT im laufenden System angewendet werden</strong>: Ein Schreibzugriff zur Laufzeit könnte den Zustand beschädigen oder die aktive Verbindung trennen. Sie werden vorgemerkt: <code>/etc/network</code> wird früh beim nächsten Start geschrieben, bevor das Netzwerk startet, und <code>/etc/pve</code> schreibt der Post-Boot-Dispatcher, sobald das Cluster-Dateisystem bereit ist. Beispiele: <code>/etc/pve</code> (pmxcfs ist ein aktiver FUSE-Mount mit laufender Clusterkonfiguration), <code>/var/lib/pve-cluster</code> (aktive Clusterdaten, nur zur manuellen Wiederherstellung im Wiederherstellungsverzeichnis abgelegt), <code>/etc/network</code> (könnte die für die SSH-Verbindung genutzte Schnittstelle neu konfigurieren und die Sitzung trennen)."
+      }
+    ]
+  },
+  "fullFlow": {
+    "heading": "Der vollständige Wiederherstellungsworkflow",
+    "intro": "Die komplette Pipeline von der Archivauswahl bis zu einem funktionierenden wiederhergestellten Host. Jede Stufe füttert die nächste; der von früheren Stufen geschriebene Zustand wird von späteren verbraucht.",
+    "diagram": "┌─────────────────────────────────────────────────────────────────┐\n│  Archive → staging_root/                                        │\n│    manifest.json   metadata/   rootfs/                          │\n└──────────────────────────────┬──────────────────────────────────┘\n                               │\n                               ▼\n   ┌─────────────────────────────────────────────────────────┐\n   │  1. hb_compat_check                                     │\n   │     · hardware drift → RS_SKIP_PATHS                    │\n   │     · kernel direction → same / bk_newer / bk_older     │\n   │     · NIC remap plan                                    │\n   │     · hydration plan (bk_older only)                    │\n   │     · rollback plan                                     │\n   └──────────────────────────────┬──────────────────────────┘\n                                  │\n                                  ▼\n   ┌─────────────────────────────────────────────────────────┐\n   │  2. Confirmation dialog                                 │\n   │     Shows: hot count, pending count, drift, hydration,  │\n   │     NIC remap, cross-kernel note, reinstalls preview    │\n   └──────────────────────────────┬──────────────────────────┘\n                                  │ (accepted)\n                                  ▼\n   ┌─────────────────────────────────────────────────────────┐\n   │  3. Apply hot paths → LIVE                              │\n   │     _rs_apply rsyncs each hot path                      │\n   │     from staging_root/rootfs to /                       │\n   │     (skips paths in RS_SKIP_PATHS)                      │\n   └──────────────────────────────┬──────────────────────────┘\n                                  │\n                                  ▼\n   ┌─────────────────────────────────────────────────────────┐\n   │  4. _rs_prepare_pending_restore                         │\n   │     /var/lib/proxmenux/pending-restore/                 │\n   │       ├── apply-on-boot.list                            │\n   │       ├── plan.env                                      │\n   │       ├── rs-skip-paths.txt                             │\n   │       └── rootfs/ (deferred paths)                      │\n   │     Enable proxmenux-restore-onboot.service             │\n   └──────────────────────────────┬──────────────────────────┘\n                                  │\n                                  ▼\n   ┌─────────────────────────────────────────────────────────┐\n   │  4b. _rs_import_data_pools                              │\n   │      Imports non-root ZFS pools whose disks are all     │\n   │      present; retries with -f on foreign hostid;        │\n   │      skips with a warning when disks are missing.       │\n   │      Log: /var/log/proxmenux/restore-datapools-*.log    │\n   └──────────────────────────────┬──────────────────────────┘\n                                  │\n                                  ▼\n   ┌─────────────────────────────────────────────────────────┐\n   │  5. _rs_run_complete_extras                             │\n   │     packages.manual.list                                │\n   │       → cascade-safe filter                             │\n   │       → apt-get install                                 │\n   └──────────────────────────────┬──────────────────────────┘\n                                  │\n                                  ▼\n   ┌─────────────────────────────────────────────────────────┐\n   │  6. REBOOT                                              │\n   └──────────────────────────────┬──────────────────────────┘\n                                  │\n                                  ▼\n   ┌─────────────────────────────────────────────────────────┐\n   │  7. apply_pending_restore.sh (on early boot)            │\n   │     Reads plan.env                                      │\n   │     Applies apply-on-boot.list (filtered)               │\n   │     Installs the postboot systemd unit                  │\n   └──────────────────────────────┬──────────────────────────┘\n                                  │\n                                  ▼\n   ┌─────────────────────────────────────────────────────────┐\n   │  8. apply_cluster_postboot.sh (~10 minutes)             │\n   │     Runs after pve-cluster is up                        │\n   │     · Applies /etc/pve entries to pmxcfs                │\n   │     · update-initramfs -u -k all                        │\n   │     · update-grub / proxmox-boot-tool refresh           │\n   │     · component --auto-reinstall (nvidia, coral, ...)   │\n   │     · Boot sanity check                                 │\n   │     · Notification: \"Host restore finished\"             │\n   └─────────────────────────────────────────────────────────┘"
+  },
+  "pendingMachinery": {
+    "heading": "Die Mechanik der vorgemerkten Wiederherstellung",
+    "intro": "Pfade, die als <code>reboot</code> oder <code>dangerous</code> klassifiziert sind, und Hydratationsschreiben, werden für den nächsten Boot inszeniert, anstatt live angewendet zu werden. Dies geschieht durch einen kleinen, in sich geschlossenen Satz von Dateien unter <code>/var/lib/proxmenux/pending-restore/</code>:",
+    "rows": [
+      {
+        "file": "apply-on-boot.list",
+        "content": "Ein relativer Pfad je Zeile: die genauen Pfade, die <code>apply_pending_restore.sh</code> aus dem vorbereiteten rootfs anwendet. Diese Datei zeigt, was beim nächsten Start geändert wird."
+      },
+      {
+        "file": "plan.env",
+        "content": "Umgebungsvariablen, die über das On-Boot-Skript bezogen werden: Wiederherstellungs-ID, Kompatibilitätskennzeichen (<code>HB_COMPAT_CROSS_VERSION</code>, <code>HB_COMPAT_KERNEL_DIRECTION</code>, <code>HB_HYDRATION_APPLIED</code>), Rollback-Opt-in-Flag, Clusteroptionen."
+      },
+      {
+        "file": "rs-skip-paths.txt",
+        "content": "Die endgültige <code>RS_SKIP_PATHS</code>-Liste blieb bestehen, so dass <code>apply_pending_restore.sh</code> nach dem Neustart die gleichen Ausschlüsse anwendet, die während des interaktiven Schritts berechnet wurden. Verhindert, dass driftbeeinflusste oder kernübergreifend unsichere Pfade beim Booten wiederhergestellt werden."
+      },
+      {
+        "file": "rootfs/",
+        "content": "Die inszenierten Dateien selbst - die genauen Bytes, die festgelegt werden. Behielt auf dem gleichen Dateisystem wie <code>/</code>, so dass der On-Boot rsync schnell ist und nicht davon abhängt, dass externer Speicher beim Booten noch erreichbar ist."
+      }
+    ],
+    "unitBody": "Die systemd-Einheit <code>proxmenux-restore-onboot.service</code> wird am Ende des interaktiven Schritts aktiviert. Der einmalige Dienst startet früh beim nächsten Boot, ruft <code>apply_pending_restore.sh</code> auf und deaktiviert sich anschließend. Die Bedingung <code>ConditionPathExists=/var/lib/proxmenux/pending-restore/state</code> sorgt dafür, dass er bei Starts ohne vorgemerkte Wiederherstellung nichts ausführt."
+  },
+  "postbootDispatcher": {
+    "heading": "Der Postboot-Dispatcher — apply_cluster_postboot.sh",
+    "intro": "Wo der interaktive Schritt endet und wo die eigentliche Host-Reproduktion stattfindet. <code>apply_cluster_postboot.sh</code> wird als zweites One-Shot-systemd-Dienst (<code>proxmenux-apply-cluster-postboot.service</code>) installiert, dessen <code>After=</code>/<code>Wants=</code>-Ziele sicherstellen, dass es nur nach dem Ausführen von Pve-Cluster und Netzwerk-Online ausgeführt wird. Hier landen die host-visiblen Wiederherstellungsaktionen.",
+    "tasks": [
+      {
+        "task": "Anwendung von /etc/pve",
+        "detail": "<code>/etc/pve</code> ist ein Live-Pmxcfs FUSE-Mount - es kann nicht beim frühen Booten geschrieben werden. Der Dispatcher kopiert Dateien von den ausstehenden Rootfs in das Live-<code>/etc/pve</code>, sobald das Cluster-Dateisystem aktiviert ist, eine Datei nach der anderen, ohne den pve-Cluster neu zu starten. Das erfasste <code>/var/lib/pve-cluster/config.db</code> aus dem Backup (oder das geförderte <code>config.db.raw-fallback</code>) wird mit dem <code>systemctl stop pve-cluster</code> → Atomdateikopie → <code>systemctl start pve-cluster</code> Muster materialisiert, so dass pmxcfs den wiederhergestellten Zustand auf dem Weg zurück nach oben erneut liest."
+      },
+      {
+        "task": "Rebuild Initramfs und Bootloader",
+        "detail": "Führt <code>update-initramfs -u -k all</code> über jeden installierten Kernel aus, dann entweder <code>update-grub</code> (GRUB-Installationen) oder <code>proxmox-boot-tool refresh</code> (systemd-Boot / ZFS-Installationen). Überspringt, wenn der interaktive Schritt feststellte, dass sich nichts an den Pfaden geändert hat, die sich auf diese Werkzeuge auswirken."
+      },
+      {
+        "task": "Auto-Reinstallation der Komponente",
+        "detail": "Liest die wiederhergestellte <code>components_status.json</code> und durchläuft die unterstützten Installationsskripte (nvidia_driver, coral_driver, amdgpu_top, intel_gpu_tools). Jedes ausgewählte Skript läuft mit <code>--auto-reinstall</code>, liest den erfassten Zustand und installiert für die Zielumgebung neu, einschließlich nötiger Kernelmodule. Dies erfolgt nach dem Neustart, damit der dann laufende Zielkernel verwendet wird. Einzelfehler werden protokolliert und stoppen die nächste Komponente nicht."
+      },
+      {
+        "task": "Prüfung der Startkonfiguration",
+        "detail": "Bevor Sie die Abschlussbenachrichtigung starten, überprüfen Sie, ob <code>proxmox-boot-tool status</code> ein konfiguriertes ESP anzeigt, jedes <code>/boot/vmlinuz-*</code> ein passendes <code>/lib/modules/&lt;ver&gt;</code>-Verzeichnis hat und <code>/vmlinuz</code> auflöst. Jede inkonsistenz wird in der benachrichtigung aufgetaucht, anstatt versteckt zu werden."
+      },
+      {
+        "task": "Abschlussmeldung",
+        "detail": "Sendet das <code>Host restore finished</code>-Event über <code>hb_notify_lifecycle</code>. Enthält die Gesamtdauer, die Anzahl der angewandten Pfade, gegebenenfalls Warnungen vor der Sanitätsprüfung und einen Link zum Protokoll bei <code>/var/log/proxmenux/proxmenux-cluster-postboot-*.log</code>. Wenn Benachrichtigungen nicht konfiguriert sind, ist das Ereignis still – das Protokoll zeichnet immer noch alles auf."
+      }
+    ]
+  },
+  "liveProgress": {
+    "heading": "Live-Fortschritt auf der Registerkarte Backups des Monitors",
+    "body": "Nach dem Neustart wird auf der Registerkarte Backups von ProxMenux Monitor eine Live-Post-Restore-Karte angezeigt, die den Status von <code>proxmenux-apply-cluster-postboot.service</code> während der Ausführung widerspiegelt. Die Karte wird von <code>/var/lib/proxmenux/restore-state.json</code> gesteuert, die der Dispatcher bei jedem Meilenstein aktualisiert (Cluster-Konfiguration anwenden, Initramfs neu erstellen, Bootloader aktualisieren, pro Komponente neu installieren, Boot-Sanity-Check, finalisieren).",
+    "fields": [
+      {
+        "name": "Statusabzeichen",
+        "detail": "Einer der Zustände <em>Wiederherstellung läuft</em>, <em>Wiederherstellung abgeschlossen</em> oder <em>Wiederherstellung fehlgeschlagen</em>. Die Karte fragt die Statusdatei während der Ausführung alle 2 Sekunden und danach alle 30 Sekunden ab."
+      },
+      {
+        "name": "Fortschrittsbalken + Schrittzähler",
+        "detail": "Zeigt <code>N/M steps</code> mit dem Label des aktuellen Schritts an. Während die Wiederherstellung ausgeführt wird, wird eine <em>geschätzte Zeit</em> aus abgeschlossenen Schritten und verstrichener Zeit abgeleitet."
+      },
+      {
+        "name": "Komponentenliste",
+        "detail": "Eine Zeile pro Treiber wird neu installiert (NVIDIA, Intel GPU tools, AMD tools, Coral TPU) mit <code>installing</code> / <code>ok</code> / <code>failed</code> plus einem Link zum Pro-Komponenten-Log bei <code>/var/log/proxmenux/component-*.log</code>."
+      },
+      {
+        "name": "Import von Datenpools",
+        "detail": "Der Block <code>data_pools_import</code> zeigt fünf farbige Zeilen: <em>Importiert</em>, <em>Erzwungen</em> (mit <code>-f</code> wegen fremdem hostid), <em>Unvollständig übersprungen</em> (nur einige Datenträger vorhanden), <em>Fehlend übersprungen</em> (keine Datenträger vorhanden) und <em>Fehlgeschlagen</em>. Der Zustand liegt in <code>/var/lib/proxmenux/restore-state.json</code>, das vollständige Laufprotokoll in <code>/var/log/proxmenux/restore-datapools-&lt;timestamp&gt;.log</code>."
+      },
+      {
+        "name": "Warnungen zur Boot-Sicherheit",
+        "detail": "Der Dispatcher prüft auf fehlende <code>/lib/modules/&lt;kernel&gt;</code>, fehlende ESP-Konfiguration und baumelnde <code>/vmlinuz</code>-Symlinks. Jede Warnung taucht hier als farbiges Banner auf."
+      },
+      {
+        "name": "Rollback-Delta",
+        "detail": "Listen Sie VMs, LXCs und Komponenten auf, die auf dem Ziel vorhanden sind, aber nicht im wiederhergestellten Backup waren - die gleichen Einträge tauchten im destruktiven Rollback-Dialog vor der Wiederherstellung auf. Jede Zeile trägt den manuellen Bereinigungsbefehl."
+      },
+      {
+        "name": "Letzte Protokollzeilen",
+        "detail": "Die letzten 600-Zeilen von <code>proxmenux-cluster-postboot-&lt;ts&gt;.log</code>, mit einem <em>Nur Probleme</em> Filter, der nur Zeilen hält, die mit <code>error</code>, <code>warning</code>, <code>failed</code>, <code>✗</code> oder <code>traceback</code> übereinstimmen."
+      }
+    ],
+    "dismissBody": "Ist die Wiederherstellung <em>abgeschlossen</em> oder <em>fehlgeschlagen</em>, klappt Ausblenden die Karte zu. Die Statusdatei bleibt erhalten; Verlauf öffnet sie und frühere Wiederherstellungen erneut. Die letzten 20 Läufe liegen unter <code>/var/lib/proxmenux/restore-history/</code>.",
+    "imageAlt": "Detaildialog des Wiederherstellungsfortschritts im ProxMenux Monitor während einer laufenden Wiederherstellung: blaues Statuszeichen, aktueller Schritt „Initramfs neu erstellen“, geschätzte Restzeit, teilweise gefüllter Fortschrittsbalken und aktuelle Protokollzeilen.",
+    "imageCaption": "Die Details modal, während der Post-Boot-Dispatcher noch läuft - Abzeichen, aktueller Schritt, verbleibende Zeit und Live-Log-Tail.",
+    "detailsImageAlt": "Die gleichen Details modal, nachdem die Wiederherstellung abgeschlossen ist, mit dem grünen Wiederherstellungsabzeichen, der Gesamtlaufdauer (0m53s), einem vollständig gefüllten 6 / 6-Fortschrittsbalken, dem leeren Rollback-Delta und dem archivierten Postboot-Protokoll.",
+    "detailsImageCaption": "Das gleiche Modal, wenn der Lauf beendet ist - Abzeichen, Gesamtdauer, gefüllter Fortschrittsbalken und das archivierte Postboot-Protokoll."
+  },
+  "postbootExample": {
+    "heading": "Wie der Post-Boot auf der Konsole aussieht",
+    "body": "Auf der physischen Host-Konsole endet ein erfolgreich beendeter Dispatcher-Prozess mit <code>[ OK ] Finished proxmenux-apply-cluster-postboot.service</code>, oft neben den <code>OK</code>-Meldungen für <code>multi-user.target</code> und <code>graphical.target</code>. Dies markiert das Prozessende. Einzelne Komponentenfehler oder Startwarnungen können trotzdem vorliegen. Prüfen Sie daher Komponentenstatus und Protokolle im Monitor, bevor Sie den Host als vollständig wiederhergestellt betrachten.",
+    "imageAlt": "Physische Proxmox-Konsole mit '[ OK ] Finished proxmenux-apply-cluster-postboot.service - ProxMenux Apply Cluster Configs (post-boot).', gefolgt von OK für multi-user.target und graphical.target; darüber die Host-Anmeldeaufforderung.",
+    "imageCaption": "Physische Konsole nach Prozessende. 'Finished proxmenux-apply-cluster-postboot.service' markiert den Abschluss, den auch 'Host restore finished' im Monitor meldet. Komponentenergebnisse und Warnungen müssen weiterhin geprüft werden."
+  },
+  "tenMinutes": {
+    "heading": "Warum die letzten zehn Minuten wichtig sind",
+    "intro": "Der Neustart selbst dauert Sekunden, aber der Post-Boot-Dispatcher verbringt etwa zehn Minuten damit, die Wiederherstellung abzuschließen. Während dieses Fensters ist der Host erreichbar und die Anmeldung funktioniert, aber einige Dienste (hauptsächlich von GPU-Treibern abhängige) sind noch nicht verfügbar. Zeitaufschlüsselung für einen typischen Proxmox-Host mit NVIDIA + Coral installiert:",
+    "rows": [
+      {
+        "stage": "Boot + pve-Cluster bereit",
+        "time": "~30 s",
+        "detail": "Standard Proxmox Boot. SSH, Web-UI und Login sind am Ende dieser Phase verfügbar."
+      },
+      {
+        "stage": "/etc/pve auf pmxcfs anwenden",
+        "time": "~10 s",
+        "detail": "Schnell – kleine Konfigurationsdateien, die nacheinander in das Live-Cluster-Dateisystem kopiert wurden."
+      },
+      {
+        "stage": "Initramfs über Kernel hinweg neu aufbauen",
+        "time": "3–5 min",
+        "detail": "<code>update-initramfs -u -k all</code> stellt pro installiertem Kernel ein Initramfs-Image wieder her. Masse des Wartens."
+      },
+      {
+        "stage": "Neuaufbau der Bootloader-Konfiguration",
+        "time": "10–30 s",
+        "detail": "<code>update-grub</code> oder <code>proxmox-boot-tool refresh</code>. Schnell sogar auf ZFS."
+      },
+      {
+        "stage": "NVIDIA-Treiber neu installieren (falls zutreffend)",
+        "time": "5–10 min",
+        "detail": "Laden Sie die aufgezeichnete Treiberversion herunter, kompilieren Sie die DKMS-Module mit dem aktuellen Kernel und wenden Sie den ProxMenux-Patch an, wenn die Quelle ihn hatte. Längste Einzelaufgabe."
+      },
+      {
+        "stage": "Neuinstallation von Coral und anderen Komponenten",
+        "time": "3–5 min",
+        "detail": "DKMS-Kompilierung für Coral, apt install für intel-gpu-tools und .deb-Download mit Installation für amdgpu_top."
+      },
+      {
+        "stage": "Startprüfung und Benachrichtigung",
+        "time": "~2 s",
+        "detail": "Geringer Aufwand. Die Benachrichtigung meldet dem Benutzer unmittelbar den Abschluss des Laufs."
+      }
+    ],
+    "outroBody": "Während dieser Zeit können nach der Anmeldung Werkzeuge fehlen (<code>nvidia-smi</code> nicht gefunden, <code>coral</code> nicht erkannt), weil die Neuinstallation im Hintergrund läuft. Die Abschlussmeldung markiert ihr Ende. Prüfen Sie Komponentenergebnisse, Warnungen und Protokolle auf einzelne Fehler."
+  },
+  "destructiveRollback": {
+    "heading": "Der optionale destruktive Rollback",
+    "body": "Die Wiederherstellung ist standardmäßig additiv: Zusätzliche VMs, LXCs und Komponenten bleiben erhalten. Bei Unterschieden bietet der Dialog <em>Destruktiven Rollback ausführen?</em> mit Nein als Vorgabe an. Zustimmung ruft vor dem Neustart <code>_rs_execute_rollback</code> auf, um die aufgelisteten zusätzlichen VMs und LXCs zu löschen. Komponenten werden zur manuellen Deinstallation markiert, da automatische Deinstallation nicht implementiert ist. Fehler beim Löschen von Gästen werden gemeldet; die Verarbeitung läuft weiter. Eine exakte Übereinstimmung mit dem Backup wird nicht garantiert. Prüfen Sie vor dieser destruktiven Wahl Namen und VMIDs/CTIDs."
+  },
+  "logs": {
+    "heading": "Speicherorte der Protokolle",
+    "rows": [
+      {
+        "log": "/var/log/proxmenux/restore-YYYYMMDD_HHMMSS.log",
+        "detail": "Vom interaktiven Schritt geschrieben. Enthält Kompatibilitätsergebnisse, Filter für Abweichungen, Anpassungsplan, Ausgabe der direkten Anwendung und Vorbereitung vorgemerkter Änderungen sowie Paketinstallation."
+      },
+      {
+        "log": "/var/log/proxmenux/apply-pending-YYYYMMDD_HHMMSS.log",
+        "detail": "Von <code>apply_pending_restore.sh</code> beim frühen Start geschrieben. Enthält das Einlesen von plan.env, das Abarbeiten von apply-on-boot und die Pfadausschlüsse."
+      },
+      {
+        "log": "/var/log/proxmenux/proxmenux-cluster-postboot-YYYYMMDD_HHMMSS.log",
+        "detail": "Geschrieben von <code>apply_cluster_postboot.sh</code>. Enthält: pve-cluster apply, Initramfs und Bootloader-Ausgabe, Ausgabe pro Komponente Installateur, Sanity-Check, Benachrichtigung Nutzlast."
+      },
+      {
+        "log": "/var/log/proxmenux/component-<name>-YYYYMMDD_HHMMSS.log",
+        "detail": "Ein Protokoll pro Komponenteninstallationsprogramm (nvidia, coral usw.), das im Post-Boot-Durchlauf ausgeführt wurde. Nützlich, wenn die Neuinstallation einer bestimmten Komponente fehlgeschlagen ist und der Benutzer die eigene Ausgabe des Tools benötigt."
+      },
+      {
+        "log": "/var/log/proxmenux/restore-datapools-YYYYMMDD_HHMMSS.log",
+        "detail": "Geschrieben von <code>_rs_import_data_pools</code>. Enthält: Aufzählung von Nicht-Root-Pools aus dem Manifest, Pro-Pool-Ergebnis (sauber importiert, mit <code>-f</code> für ausländische Hostids importiert, aufgrund fehlender Festplatten übersprungen oder fehlgeschlagen) und die Rohausgabe jedes <code>zpool import</code>-Aufrufs."
+      }
+    ]
+  },
+  "whereNext": {
+    "heading": "Wohin Sie als nächstes gehen",
+    "items": [
+      {
+        "label": "Kernübergreifende Wiederherstellung",
+        "href": "/docs/backup-restore/cross-kernel",
+        "tail": "- der richtungsbewusste Safe-Subset-Filter und der Hydratationspass, der aufgerufen wird, wenn sich der Zielkernel vom Backup unterscheidet."
+      },
+      {
+        "label": "Wie es funktioniert",
+        "href": "/docs/backup-restore/how-it-works",
+        "tail": "- das Archivlayout, Manifest und Anwendungsinventar, das die Wiederherstellung verbraucht."
+      },
+      {
+        "label": "Geplante Aufträge",
+        "href": "/docs/backup-restore/scheduled-jobs",
+        "tail": "— der unbeaufsichtigte Fluss, der die Archive produziert, die diese Seite verbraucht."
+      }
+    ]
+  }
+}
diff --git a/web/messages/de/docs/backup-restore/scheduled-jobs.json b/web/messages/de/docs/backup-restore/scheduled-jobs.json
new file mode 100644
index 00000000..dbe92ef5
--- /dev/null
+++ b/web/messages/de/docs/backup-restore/scheduled-jobs.json
@@ -0,0 +1,152 @@
+{
+  "meta": {
+    "title": "Geplante Aufträge — Timer, Attachment-Modus, Retention | ProxMenux",
+    "description": "Geplante ProxMenux Host-Backup-Jobs. Zwei Erstellungsmodi (eigener systemd-Timer oder Attachment zu einem vorhandenen PVE vzdump-Job), Retentionswerte, die pro Job über proxmox-backup-client/borg/local prune angewendet werden, Storage-Layout unter /var/lib/proxmenux/backup-jobs und das Runner-Script, das Archive erzeugt, die mit dem interaktiven Fluss identisch sind.",
+    "ogTitle": "ProxMenux Backup — geplante Aufträge",
+    "ogDescription": "Unbeaufsichtigte geplante Host-Backups mit Attachment-Modus, Retention und den gleichen drei Zielen wie der interaktive Fluss.",
+    "twitterTitle": "Geplante Jobs | ProxMenux",
+    "twitterDescription": "Unbeaufsichtigte geplante Host-Backup-Jobs mit Attach-Modus und Retention."
+  },
+  "header": {
+    "title": "Geplante Aufträge",
+    "description": "Unbeaufsichtigte Host-Backup-Jobs. Zwei Erstellungsmodelle: ein neuer unabhängiger Job mit einem eigenen Zeitplan oder ein Job, der an eine bestehende PVE vzdump-Aufgabe angehängt ist, die den Zeitplan und die Aufbewahrung dieser Aufgabe erbt. Beide produzieren Archive, die mit dem interaktiven Fluss identisch sind.",
+    "section": "Sicherung und Wiederherstellung"
+  },
+  "intro": {
+    "title": "Die beiden planmäßigen Job-Modelle",
+    "body": "Ein geplanter Job kann nach einem von zwei Modellen erstellt werden:",
+    "modelsList": [
+      "<strong>Neuer unabhängiger job</strong> — ProxMenux definiert den Jobplan selbst mit einem eigenen systemd-Timer, unabhängig von anderen Aufgaben auf dem Host. Kompatibel mit allen drei Destinationen: Local, PBS und Borg.",
+      "<strong>An eine bestehende PVE vzdump-Task anhängen</strong> – der Job hat keinen eigenen Zeitplan; er wird automatisch ausgeführt, wenn die übergeordnete PVE vzdump-Task, die bereits die VMs und LXCs auf diesem Host sichert, ausgelöst wird. Erbt den Zeitplan und die Beibehaltung von der übergeordneten Aufgabe. Kompatibel mit Local und PBS (Borg wird nicht unterstützt, da PVE keinen nativen Scheduler für Borg hat)."
+    ]
+  },
+  "attachBadge": {
+    "title": "Attach-Modus — empfohlen, wenn bereits eine PVE vzdump-Task existiert",
+    "body": "Wenn bereits ein PVE-vzdump-Auftrag für die VMs und LXCs dieses Knotens eingerichtet ist, wird das angehängte Host-Backup nach dem Gast-Backup im <strong>selben Sicherungszyklus</strong> ausgeführt. Bei der Wiederherstellung stammen die Gastkonfigurationen aus dem Host-Backup (unter <code>/etc/pve</code>) und die Gastfestplatten aus den vzdump-Backups dieses Zyklus. Dies erleichtert eine koordinierte Wiederherstellung des gesamten Knotens, ist aber kein atomarer Snapshot: Änderungen während des Zyklus können Unterschiede zwischen Hostkonfiguration und Gastfestplattenzustand hinterlassen."
+  },
+  "frequencyBadge": {
+    "title": "Empfohlene Häufigkeit",
+    "body": "Um die Kompatibilität zwischen einem Host-Backup und seiner zukünftigen Wiederherstellung zu maximieren, führen Sie häufig Host-Backups aus. Je näher das Backup dem aktuellen Zustand des Hosts ist, desto weniger Konfigurations-, Paket- und Komponentendrift muss die Wiederherstellung in Einklang bringen."
+  },
+  "modes": {
+    "heading": "Die beiden Modi",
+    "rows": [
+      {
+        "mode": "Neuer geplanter Auftrag",
+        "backends": "Lokal, PBS, Borg",
+        "schedule": "Eigener <code>OnCalendar</code>-Ausdruck (systemd-Kalendersyntax, z. B. <code>daily</code> oder <code>Mon..Fri 03:00</code>).",
+        "retention": "Separat abgefragt: <code>keep-last</code>, <code>keep-hourly</code>, <code>keep-daily</code>, <code>keep-weekly</code>, <code>keep-monthly</code>, <code>keep-yearly</code>. Wird vom Ausführungsskript nach jedem erfolgreichen Backup angewendet."
+      },
+      {
+        "mode": "Anhängen an einen PVE vzdump Job",
+        "backends": "Lokal, PBS (Borg hat keinen PVE-seitigen Scheduler)",
+        "schedule": "Vererbt vom Eltern-PVE-Job. Auf der ProxMenux-Seite ist kein systemd-Timer installiert.",
+        "retention": "Aus der <code>prune-backups</code>-Konfiguration des übergeordneten Auftrags übernommen (über <code>hb_pve_prune_to_keep_env</code> eins zu eins den <code>KEEP_*</code>-Variablen des Ausführungsskripts zugeordnet)."
+      }
+    ]
+  },
+  "attachDetail": {
+    "heading": "Wie Attach Mode funktioniert",
+    "intro": "PVE speichert <code>vzdump</code>-Aufträge in <code>/etc/pve/jobs.cfg</code> — einen Abschnitt pro Auftrag mit dem Speicherziel für VM- und LXC-Backups. Der Attach-Modus erfordert ein von ProxMenux unterstütztes Backend (Lokal oder PBS). Das Host-Backup wird nach Abschluss des Gast-Backups über den job-end-Hook ausgeführt.",
+    "steps": [
+      {
+        "step": "1",
+        "detail": "Während der Auftragserstellung listet ProxMenux kompatible übergeordnete PVE-Aufgaben über <code>hb_pve_list_vzdump_jobs_for_backend</code> auf. Der Benutzer wählt einen aus."
+      },
+      {
+        "step": "2",
+        "detail": "Der <code>.env</code> des Jobs wird mit <code>PVE_PARENT_JOB</code>, <code>PVE_STORAGE</code> und den geerbten <code>KEEP_*</code>-Werten geschrieben; es wird kein systemd-Timer erstellt."
+      },
+      {
+        "step": "3",
+        "detail": "<code>hb_install_vzdump_hook</code> registriert einen Skript-Hook in <code>/etc/vzdump.conf</code>. In der job-end-Phase jedes vzdump-Auftrags vergleicht er den übergebenen <code>$STOREID</code> mit <code>PVE_STORAGE</code> aller aktivierten angehängten Aufträge und startet das Ausführungsskript bei Übereinstimmung. Der Abgleich erfolgt nach Speicher, nicht nach der ID des gewählten übergeordneten Auftrags."
+      },
+      {
+        "step": "4",
+        "detail": "Das Archiv landet im selben Speicher, den die vzdump-Dumps gerade geschrieben haben: <code>path/dump/</code> für Local oder das PBS-Repository, das auf dem PVE-Speichereintrag konfiguriert ist."
+      }
+    ],
+    "outroBody": "Der Attach-Modus hat keinen eigenen Timer. Das Deaktivieren oder Löschen des gewählten übergeordneten PVE-Auftrags stoppt dessen Auslösung; andere vzdump-Aufträge mit demselben Speicher können das Host-Backup weiterhin auslösen. Deaktivieren oder löschen Sie den ProxMenux-Auftrag selbst, um dies zu verhindern. Beim Deaktivieren bleibt der Eintrag auf der Festplatte und kann später erneut aktiviert oder angehängt werden."
+  },
+  "storageLayout": {
+    "heading": "Dateien, die einen Job ausmachen",
+    "intro": "Jeder geplante Job wird vollständig durch drei oder vier Dateien auf der Festplatte beschrieben. Das Lesen gibt die vollständige Konfiguration des Jobs, ohne sich auf die Benutzeroberfläche zu verlassen.",
+    "rows": [
+      {
+        "path": "/var/lib/proxmenux/backup-jobs/JOB_ID.env",
+        "content": "Backend, Backup-ID oder Ziel, Zeitplan (Neuer Auftrag) oder übergeordneter PVE-Auftrag (Attach-Modus), Aktivierungsstatus, Aufbewahrungswerte <code>KEEP_*</code> und Verweise auf Zugangsdaten."
+      },
+      {
+        "path": "/var/lib/proxmenux/backup-jobs/JOB_ID.paths",
+        "content": "Ein absoluter Pfad pro Zeile - die eingefrorene Auswahl wurde zum Zeitpunkt der Joberstellung aus dem Profil aufgelöst. Das Bearbeiten der Datei führt den Job mit der neuen Auswahl beim nächsten Auslösen des Timers erneut aus."
+      },
+      {
+        "path": "/etc/systemd/system/proxmenux-backup-JOB_ID.timer + .service",
+        "content": "Nur neuer Modus. Der Dienst ruft <code>run_scheduled_backup.sh JOB_ID</code> auf. Der Timer plant es mit <code>Persistent=true</code> (verpasste Ausführungen werden beim nächsten Boot nachgeholt) und einem kleinen <code>RandomizedDelaySec=120</code>, um die Last zu verteilen, wenn mehrere Jobs den gleichen OnCalendar-Ausdruck teilen."
+      },
+      {
+        "path": "/etc/vzdump.conf script-hook",
+        "content": "Nur Attach-Modus. Einmal durch <code>hb_install_vzdump_hook</code> installiert; vergleicht <code>PVE_STORAGE</code> jedes angehängten Auftrags mit <code>$STOREID</code>, das PVE dem Hook-Skript übergibt."
+      }
+    ]
+  },
+  "runner": {
+    "heading": "Was beim Start eines Auftrags geschieht",
+    "intro": "Jeder Job - ob New-Model oder Attachment - führt die gleiche dreistufige Sequenz aus:",
+    "steps": [
+      "<strong>Backup vorbereiten.</strong> Liest die Job-Konfiguration (Ziel, Profil, Pfade) und stellt den Archivbaum genau so zusammen, wie es der interaktive Fluss tut. Das Ergebnis ist das gleiche Archiv, das ein manuelles Backup mit diesen Einstellungen erzeugen würde.",
+      "<strong>An das Ziel schreiben.</strong> Überträgt oder schreibt das Archiv in das konfigurierte Ziel – eine lokale <code>.tar.zst</code>-Datei, ein PBS-Backup oder ein Borg-Archiv – mit genau den gleichen Tools und Anmeldeinformationen, die ein manuelles Backup für dasselbe Ziel verwenden würde.",
+      "<strong>Aufbewahrungsregeln anwenden.</strong> Entfernt alte Backups vom Zielort, wobei die Anzahl der <code>keep-last</code> / <code>keep-daily</code> / <code>keep-weekly</code> für den Auftrag konfiguriert bleibt. Das Beschneiden wird vom Zielort selbst durchgeführt: PBS wendet seine eigene Aufbewahrung an, Borg führt <code>borg prune</code> aus und bei Lokal löscht ProxMenux die Dateien, die außerhalb des <code>keep-last</code>-Fensters liegen."
+    ]
+  },
+  "management": {
+    "heading": "Aufträge verwalten",
+    "intro": "Das Scheduler-Menü (Scripts TUI) und die Registerkarte Monitor Backups zeigen die gleichen Aktionen bei jedem Job.",
+    "rows": [
+      {
+        "action": "Jetzt ausführen",
+        "detail": "Ruft das Ausführungsskript sofort auf und umgeht Timer bzw. vzdump-Hook. Damit lässt sich die Auftragskonfiguration prüfen, ohne auf die nächste geplante Ausführung zu warten."
+      },
+      {
+        "action": "Aktivieren/Deaktivieren",
+        "detail": "Neuer Modus: <code>systemctl enable/disable --now</code> der Timer. Attach-Modus: Dreht das <code>ENABLED</code>-Flag im Job Env um — das Hook-Skript berücksichtigt es beim nächsten PVE-Aufruf."
+      },
+      {
+        "action": "Bearbeiten",
+        "detail": "Öffnet Ziel, Zeitplan, Profil und Aufbewahrungsaufforderungen neu und schreibt die Jobdateien neu. Bewahrt die Job ID auf."
+      },
+      {
+        "action": "Löschen",
+        "detail": "Entfernt die Job env, Pfaddatei, systemd Timer + Service (Neuer Modus) und deaktiviert die Hakenbindung (Attach-Modus). Berührt keine Archive bereits am Zielort."
+      },
+      {
+        "action": "Protokoll anzeigen",
+        "detail": "Zeigt laufend an: <code>/var/log/proxmenux/backup-jobs/JOB_ID-YYYYMMDD_HHMMSS.log</code> – eine Protokolldatei pro Lauf. Der Runner gibt außerdem eine kompakte Statuszeile an journald unter dem Dienst systemd aus."
+      }
+    ]
+  },
+  "notifications": {
+    "heading": "Benachrichtigungen",
+    "body": "Jeder geplante Lauf feuert die gleichen <code>hb_notify_lifecycle</code>-Ereignisse ab wie der interaktive Fluss (<code>start</code>, <code>complete</code>, <code>fail</code>). Wenn Benachrichtigungskanäle im Monitor konfiguriert sind, tauchen unbeaufsichtigte Jobs auf die gleiche Weise wie manuelle Backups auf - ein Benutzer muss das Protokoll nicht überprüfen, um zu wissen, ob ein Job erfolgreich war."
+  },
+  "whereNext": {
+    "heading": "Wohin Sie als nächstes gehen",
+    "items": [
+      {
+        "label": "Backups erstellen",
+        "href": "/docs/backup-restore/creating-backups",
+        "tail": "- der interaktive Fluss, der das Backend mit dem Scheduler teilt."
+      },
+      {
+        "label": "Ziele",
+        "href": "/docs/backup-restore/destinations",
+        "tail": "Per-Backend-Konfiguration, die sowohl vom interaktiven Flow als auch vom Scheduler verwendet wird."
+      },
+      {
+        "label": "Wiederherstellung",
+        "href": "/docs/backup-restore/restoring",
+        "tail": " — der Ablauf zur Wiederherstellung der von den Aufträgen erzeugten Backups."
+      }
+    ]
+  }
+}
diff --git a/web/messages/de/docs/create-vm/index.json b/web/messages/de/docs/create-vm/index.json
new file mode 100644
index 00000000..6b7a4a98
--- /dev/null
+++ b/web/messages/de/docs/create-vm/index.json
@@ -0,0 +1,175 @@
+{
+  "meta": {
+    "title": "VMs auf Proxmox VE erstellen: Synology, Windows, Linux und NAS-Assistenten | ProxMenux",
+    "description": "Erstellen und konfigurieren Sie VMs auf Proxmox VE mit ProxMenux. Assistenten für NAS-Systeme (Synology DSM, TrueNAS, OpenMediaVault, XigmaNAS usw.), Windows, Linux-Distributionen und ein externer macOS-Installer. Sinnvolle Voreinstellungen für Hardware, Speicher und Netzwerk.",
+    "ogTitle": "VMs auf Proxmox VE erstellen: Assistenten für Synology, Windows, Linux und NAS",
+    "ogDescription": "ProxMenux-Assistenten für VMs mit Synology DSM, TrueNAS, OMV, XigmaNAS, Windows und Linux auf Proxmox VE.",
+    "ogImageAlt": "ProxMenux-Menü „VM erstellen“",
+    "twitterTitle": "Erstellen von VMs auf Proxmox VE | ProxMenux",
+    "twitterDescription": "Assistenten für VMs mit Synology, TrueNAS, OMV, XigmaNAS, Windows und Linux auf Proxmox VE."
+  },
+  "header": {
+    "title": "VM erstellen",
+    "description": "ProxMenux gruppiert die VM-Erstellung zu einem interaktiven Dispatcher. Wählen Sie die Betriebssystemfamilie und der passende Wizard übernimmt ISO-Auswahl, CPU, RAM, BIOS, Netzwerk, Speicher und - optional - GPU Passthrough.",
+    "section": "Virtuelle Maschinen"
+  },
+  "intro": {
+    "title": "Wofür dieses Menü ist",
+    "body": "Das Menü „VM erstellen“ verzweigt zu mehreren Assistenten. Es fragt nach der Betriebssystemfamilie und lädt ISO-Auswahl und Konfigurator. Der Standardablauf nutzt sinnvolle ProxMenux-Voreinstellungen; der erweiterte Ablauf zeigt alle verfügbaren Optionen vor der Erstellung."
+  },
+  "opening": {
+    "heading": "Öffnen des Menüs",
+    "body": "Wählen Sie im ProxMenux-Hauptmenü <strong>VM erstellen</strong>. Es erscheint:",
+    "imageAlt": "Menü zur VM-Erstellung mit drei ProxMenux-Optionen (NAS/Windows/Linux) und Community Scripts darunter (macOS/Andere)"
+  },
+  "families": {
+    "heading": "Drei OS-Familien",
+    "intro": "Die drei ProxMenux-Einträge oben im Menü teilen sich die gleiche zugrunde liegende Engine und den gleichen Post-ISO-Flow - sie leiten nur zu verschiedenen ISO-Selektoren und wenden Standardwerte an, die auf jede Familie abgestimmt sind. Wählen Sie diejenige, die zu dem Gast passt, den Sie installieren möchten.",
+    "routes": [
+      {
+        "key": "nas",
+        "title": "NAS-System",
+        "icon": "HardDrive",
+        "href": "/docs/create-vm/system-nas",
+        "accent": "border-emerald-300 bg-emerald-50",
+        "iconBg": "bg-emerald-100 text-emerald-700",
+        "description": "Acht NAS-Betriebssysteme als eigene VMs. Die meisten nutzen den automatischen ISO-Ablauf; Synology DSM verwendet den spezialisierten Loader-Assistenten.",
+        "bullets": [
+          "Synology DSM (Arc / RR / Alpine RedPill M-shell Loader)",
+          "TrueNAS SCALE und CORE (ZFS)",
+          "OpenMediaVault (Debian-basiert)",
+          "XigmaNAS (FreeBSD ZFS)",
+          "Rockstor (openSUSE / Btrfs), ZimaOS, FygoOS"
+        ]
+      },
+      {
+        "key": "windows",
+        "title": "Windows-System",
+        "icon": "MonitorCog",
+        "href": "/docs/create-vm/system-windows",
+        "accent": "border-blue-300 bg-blue-50",
+        "iconBg": "bg-blue-100 text-blue-700",
+        "description": "Windows 10, 11 und Server-Editionen mit Windows-freundlichen Standardeinstellungen (q35 + OVMF + TPM 2.0) und VirtIO Treiber vormontiert.",
+        "bullets": [
+          "UUP Dump für aktuelle ISOs",
+          "Oder lokale ISO von /var/lib/vz/template/iso",
+          "TPM 2.0 automatisch hinzugefügt",
+          "VirtIO Treiber ISO angehängt an ide3",
+          "Gastagent-Kanal aktiviert"
+        ]
+      },
+      {
+        "key": "linux",
+        "title": "Linux-System",
+        "icon": "Laptop",
+        "href": "/docs/create-vm/system-linux",
+        "accent": "border-amber-300 bg-amber-50",
+        "iconBg": "bg-amber-100 text-amber-700",
+        "description": "Kuratierter Katalog offizieller Linux-ISOs, die automatisch aus dem Upstream heruntergeladen werden, sowie ein lokaler ISO-Picker für alles andere.",
+        "bullets": [
+          "Ubuntu (Desktop / Server, 20.04–25.10)",
+          "Debian (Desktop / Netinst, 11–13)",
+          "Fedora, Arch, Rocky, Mint, openSUSE",
+          "Alpine, Kali, Manjaro",
+          "Lokaler ISO Pfad für benutzerdefinierte Images"
+        ]
+      }
+    ]
+  },
+  "community": {
+    "title": "Community-Scripts (nicht hier dokumentiert)",
+    "intro": "Die beiden Einträge unter dem <em>Community Scripts</em>-Separator führen Code aus, der <strong>nicht Teil von ProxMenux</strong> ist, so dass sie absichtlich außerhalb dieser Dokumentation bleiben:",
+    "macosRich": "<strong>macOS-System</strong>: führt den externen Installer <osxLink>OSX-PROXMOX</osxLink> aus. Er klont das Originalrepository, bereitet den Host vor und <strong>startet ihn nach Abschluss automatisch neu</strong>. Beachten Sie die Dokumentation dieses Projekts.",
+    "othersRich": "<strong>System Sonstige (Linux-basiert)</strong> lädt eine kuratierte Liste von Linux-basierten Installateuren der Community (Home-Server-Betriebssysteme, Router-/Firewall-Appliances usw.). Jedes Community-Script wird außerhalb von ProxMenux gepflegt."
+  },
+  "afterPick": {
+    "heading": "Was passiert, nachdem Sie ein OS ausgewählt haben",
+    "intro": "Sobald die ISO ausgewählt ist, nimmt der Dispatcher den gleichen Weg unabhängig von der OS-Familie:",
+    "items": [
+      "<strong>Standard oder Erweitert.</strong> Bestätigen Sie die ProxMenux-Vorgaben oder öffnen Sie den vollständigen Konfigurator für CPU-Modell und Kerne, RAM, BIOS/UEFI, Netzwerkkartenmodell und Maschinentyp.",
+      "<strong>Speicherplan.</strong> Kombinieren Sie virtuelle Laufwerke, importierte Laufwerke und PCI-Passthrough-Geräte wie ganze Controller oder NVMe in derselben VM.",
+      "<strong>Optionales GPU-Passthrough.</strong> Wird eine geeignete GPU erkannt, bietet ProxMenux nach der VM-Erstellung den GPU-Assistenten an. Ein Neustart kann erforderlich sein.",
+      "<strong>VM-Erstellung.</strong> Die VM wird erstellt, getaggt und mit einer formatierten HTML-Beschreibung für schnellen Zugriff in der Proxmox-Oberfläche versehen."
+    ],
+    "tipTitle": "Bevorzugt Advanced für VMs, die Sie behalten möchten",
+    "tipBody": "Default Presets funktionieren gut für schnelle Tests. Für einen VM, den Sie behalten möchten, können Sie mit dem Advanced-Pfad den richtigen BIOS (SeaBIOS vs OVMF/UEFI), den Maschinentyp (<code>i440fx</code> vs <code>q35</code>) und den Festplattencontroller (VirtIO SCSI single vs SATA) im Voraus auswählen - diese müssen später schmerzhaft geändert werden."
+  },
+  "scripts": {
+    "heading": "Involvierte Skripte",
+    "intro": "Der Einstieg lädt mehrere gemeinsame Komponentenskripte per source, für die es keine eigene Dokumentationsseite gibt. Sie sind hier als Referenz aufgelistet. Jede Unterseite verlinkt das Hauptskript ihres Ablaufs.",
+    "headerScript": "Skript",
+    "headerRole": "Rolle",
+    "rows": [
+      {
+        "path": "menus/create_vm_menu.sh",
+        "role": "Einstieg und Weiterleitung."
+      },
+      {
+        "path": "vm/select_nas_iso.sh",
+        "role": "ISO/Appliance Selektor für NAS-Systeme (Synology, TrueNAS, OMV, Rockstor, XigmaNAS, ZimaOS, FygoOS)."
+      },
+      {
+        "path": "vm/select_windows_iso.sh",
+        "role": "Windows ISO Selector. Delegierte an den UUP Dump Builder, wenn nötig."
+      },
+      {
+        "path": "vm/select_linux_iso.sh",
+        "role": "Linux ISO-Selektor für den Linux-Flow (Mainstream-Distributionen)."
+      },
+      {
+        "path": "vm/synology.sh",
+        "role": "Synology DSM-Flow: holt Loader und DSM-Bild und bereitet das VM-Profil vor."
+      },
+      {
+        "path": "vm/zimaos.sh",
+        "role": "ZimaOS flow: lädt das Image herunter und verbindet es mit der VM-Definition."
+      },
+      {
+        "path": "vm/vm_configurator.sh",
+        "role": "Standard vs Advanced Wizard: CPU Modell/Kerne, RAM, BIOS, NIC, Maschinentyp."
+      },
+      {
+        "path": "vm/disk_selector.sh",
+        "role": "Speicherplan: virtuelle Festplatte, Festplattenimport oder Controller/NVMe Passthrough."
+      },
+      {
+        "path": "vm/vm_creator.sh",
+        "role": "Endgültige VM-Erstellung: wendet die Konfiguration an, fügt Speicher an, schreibt die HTML-Beschreibung."
+      },
+      {
+        "path": "vm/guest_agent_config.sh",
+        "role": "Optionaler QEMU Guest Agent Setup Hook, der von mehreren Flows verwendet wird."
+      }
+    ]
+  },
+  "related": {
+    "heading": "Verwandte Themen",
+    "items": [
+      {
+        "href": "/docs/disk-manager",
+        "label": "Festplattenmanager",
+        "tail": "Anfügen vorhandener physischer Festplatten oder Importieren von Festplattenabbildern in VMs."
+      },
+      {
+        "href": "/docs/utils/UUp-Dump-ISO-Creator",
+        "label": "UUP-Dump-ISO-Erstellung",
+        "tail": "— erzeugen Sie Windows-Installations-ISOs, die als Boot-Medien verwendet werden können."
+      },
+      {
+        "href": "/docs/utils/import-vm",
+        "label": "VM von OVA / OVF importieren",
+        "tail": "— vorgefertigte VMs von VMware / VirtualBox / ProxMenux-Exporten einbringen."
+      },
+      {
+        "href": "/docs/hardware/gpu-vm-passthrough",
+        "label": "GPU zu VM hinzufügen (Passthrough)",
+        "tail": "- einen GPU in einen frisch erstellten VM zu übergeben."
+      },
+      {
+        "href": "/docs/help-info/vm-ct-commands",
+        "label": "VM und CT Verwaltungsbefehle",
+        "tail": "— qm-Referenz für die CLI-Seite."
+      }
+    ]
+  }
+}
diff --git a/web/messages/de/docs/create-vm/synology.json b/web/messages/de/docs/create-vm/synology.json
new file mode 100644
index 00000000..2c169b84
--- /dev/null
+++ b/web/messages/de/docs/create-vm/synology.json
@@ -0,0 +1,453 @@
+{
+  "title": "Skript zum Erstellen einer Synology-VM",
+  "stepLabel": "Schritt",
+  "intro": {
+    "heading": "Einleitung",
+    "intro": "ProxMenux bietet ein automatisiertes Skript, das eine virtuelle Maschine (VM) erstellt und konfiguriert, um Synology DSM (DiskStation Manager) auf Proxmox VE zu installieren. Dieses Skript vereinfacht den Prozess, indem es einen der verfügbaren Loader zum VM-Boot herunterlädt und hinzufügt und Ihnen die Option zwischen vier verschiedenen Optionen bietet:",
+    "loaders": [
+      {
+        "name": "AuxXxilium Arc",
+        "url": "https://github.com/AuxXxilium/arc",
+        "extra": ""
+      },
+      {
+        "name": "RedPill RR",
+        "url": "https://github.com/RROrg/rr",
+        "extra": ""
+      },
+      {
+        "name": "Alpine RedPill M-shell (TinyCore-Projekt)",
+        "url": "https://github.com/PeterSuh-Q3/tinycore-redpill",
+        "extra": ""
+      }
+    ],
+    "customLoader": "Benutzerdefinierter Loader - Option zur Verwendung eines benutzerdefinierten Loaders, wenn Sie es vorziehen, Ihre eigene Konfiguration zu ändern oder zu erstellen",
+    "simplifiesIntro": "Das Skript vereinfacht den VM-Erstellungsprozess durch die folgenden Optionen:",
+    "simplifies": [
+      "Auswahl der Standard- oder erweiterten Konfiguration",
+      "Konfiguration von CPU, RAM, BIOS und Maschinentyp",
+      "Virtuelles Laufwerk oder Passthrough eines physischen Laufwerks"
+    ]
+  },
+  "config": {
+    "heading": "Standard- und erweiterte Konfiguration",
+    "intro": "Das Skript bietet zwei Konfigurationsmodi:",
+    "defaultHeading": "Standardkonfiguration",
+    "defaultIntro": "Wenn Sie die Standardkonfiguration auswählen, wendet das Skript automatisch die folgenden Werte an:",
+    "headerParam": "Parameter",
+    "headerValue": "Standardwert",
+    "defaultRows": [
+      {
+        "param": "Maschinentyp",
+        "value": "q35"
+      },
+      {
+        "param": "BIOS-Typ",
+        "value": "OVMF (UEFI)"
+      },
+      {
+        "param": "CPU-Typ",
+        "value": "Host"
+      },
+      {
+        "param": "Anzahl der Kerne",
+        "value": "2"
+      },
+      {
+        "param": "RAM-Größe",
+        "value": "4096 MB"
+      },
+      {
+        "param": "Brücke",
+        "value": "vmbr0"
+      },
+      {
+        "param": "MAC-Adresse",
+        "value": "Automatisch generiert"
+      },
+      {
+        "param": "VM nach Abschluss starten",
+        "value": "Nein"
+      }
+    ],
+    "defaultOutro": "Wenn Sie die Konfiguration anpassen möchten, wählen Sie die Option Erweiterte Einstellungen im Menü aus.",
+    "advancedHeading": "Erweiterte Konfiguration",
+    "advancedIntro": "Wenn Sie die erweiterte Konfiguration auswählen, können Sie mit dem Skript jeden Parameter anpassen:",
+    "headerOptions": "Optionen",
+    "advancedRows": [
+      {
+        "param": "Maschinentyp",
+        "options": "q35 oder i440fx"
+      },
+      {
+        "param": "BIOS-Typ",
+        "options": "OVMF (UEFI) oder SeaBIOS (Legacy)"
+      },
+      {
+        "param": "CPU-Typ",
+        "options": "Host oder KVM64"
+      },
+      {
+        "param": "Anzahl der Kerne",
+        "options": "Anzahl CPU-Kerne"
+      },
+      {
+        "param": "RAM-Größe",
+        "options": "Der VM zugewiesene Speichermenge"
+      },
+      {
+        "param": "Brücke",
+        "options": "Netzwerkbrücke für die Verbindung"
+      },
+      {
+        "param": "MAC-Adresse",
+        "options": "Eigene MAC-Adresse"
+      },
+      {
+        "param": "VLAN",
+        "options": "VLAN-Tag (falls verwendet)"
+      },
+      {
+        "param": "MTU",
+        "options": "Maximale Übertragungseinheit"
+      }
+    ]
+  },
+  "diskSelection": {
+    "heading": "Auswahl der Datenträger",
+    "intro": "Im Speicherplan können Sie virtuelle und physische Laufwerke sowie PCI-Controller oder NVMe-Geräte hinzufügen. Die Laufwerksoptionen werden unten erläutert.",
+    "virtualHeading": "Virtuelle Festplatte",
+    "virtualItems": [
+      "Das Skript listet die in Proxmox verfügbaren Speicheroptionen auf",
+      "Der Benutzer wählt die Festplatte und Größe in GB",
+      "Virtuelle Laufwerke werden als <strong>SATA</strong> zugewiesen (sata0, sata1 usw.). Virtuelle und physische Datenlaufwerke teilen die sechs SATA-Anschlüsse 0–5; der Loader nutzt einen eigenen IDE-Anschluss."
+    ],
+    "physicalHeading": "Passthrough eines physischen Laufwerks",
+    "physicalItems": [
+      "Das Skript erkennt alle verfügbaren physischen Festplatten",
+      "Der Benutzer wählt die physische Festplatte oder die Festplatten aus, die er verwenden möchte.",
+      "Physische Laufwerke werden als <strong>SATA</strong>-Geräte zugewiesen. Sie teilen die sechs SATA-Anschlüsse 0–5 mit virtuellen Datenlaufwerken; es gibt kein zusätzliches Kontingent von sechs physischen Laufwerken."
+    ]
+  },
+  "loaderInstall": {
+    "heading": "Loader installieren",
+    "intro1": "Das Skript lädt und extrahiert den Loader automatisch aus dem Repository des Entwicklers. Wenn der Download fehlschlägt, zeigt das Skript eine Fehlermeldung an.",
+    "intro2Rich": "<strong>AuxXxilium Arc</strong>, <strong>RedPill RR</strong> und <strong>Alpine RedPill M-shell</strong> werden automatisch heruntergeladen und entpackt.",
+    "customRich": "Für <strong>Custom Loader</strong> sucht das Skript nach Dateien in <code>/var/lib/vz/template/iso</code>. Wenn mehrere Dateien gefunden werden, werden Sie aufgefordert, die gewünschte Datei auszuwählen.",
+    "uploadIntro": "Sie können benutzerdefinierte Loader über die lokalen Speicheroptionen hochladen:",
+    "imageAlt": "Custom Loader hinzufügen",
+    "imageCaption": "Custom Loader hinzufügen"
+  },
+  "vmCreation": {
+    "heading": "VM erstellen",
+    "intro": "Sobald der Loader heruntergeladen wurde, erstellt das Skript den VM mit den folgenden Befehlen:",
+    "items": [
+      "<code>qm create</code> – Erstellt die virtuelle Maschine mit den konfigurierten Parametern",
+      "<code>qm importdisk</code> importiert das Loader-Abbild in den Proxmox-Speicher. Danach weist das Skript es der VM aus Kompatibilitätsgründen als ide0 zu.",
+      "<code>qm set</code> – Zuweisung von Konfigurationswerten wie CPU, RAM und Speicher",
+      "<code>qm set VMID --boot order=ide0</code> legt den Loader als Bootgerät fest. Ersetzen Sie VMID durch die VM-ID."
+    ]
+  },
+  "stepGuide": {
+    "heading": "Schrittweise Anleitung zur Loader-Konfiguration",
+    "intro": "Jeder Loader hat eigene Menüs und Konfigurationsmethoden. Die sechs Schritte unten erklären den gemeinsamen Ablauf; bei Abweichungen folgen Sie den aktuellen Loader-Anweisungen. Die M-shell-Bilder zeigen eine ältere TinyCore-Oberfläche, während das aktuelle Skript Alpine RedPill M-shell herunterlädt.",
+    "selectorHeading": "Wählen Sie Ihren Loadertyp:",
+    "loaderButtons": {
+      "arc": "Arc Loader",
+      "rr": "RR Loader",
+      "tinycore": "TinyCore Loader"
+    }
+  },
+  "steps": [
+    {
+      "id": "step1",
+      "title": "Starten Sie die VM und öffnen Sie das Hauptmenü",
+      "intro": "Sobald der VM erstellt wurde, starten Sie ihn. Beim ersten Booten des VM greifen Sie auf das Hauptmenü des Loaders zu, um das DSM-Modell auszuwählen und zu konfigurieren, das Sie erstellen möchten. Sobald der Loader erstellt wurde, wird dieser Schritt übersprungen, es sei denn, Sie erzwingen manuell eine Rekonfiguration vom Bootmonitor. Alle Loader haben auch die Möglichkeit, den Loader über ein Webinterface zu konfigurieren.",
+      "loaders": {
+        "arc": [
+          {
+            "htmlBefore": "<strong>Web-Schnittstelle</strong>, Um auf die Web-Schnittstelle zuzugreifen, öffnen Sie einfach einen Webbrowser und geben Sie die IP-Adresse ein, die in der Konsolenausgabe des VM angezeigt wird. Zum Beispiel in unserem Fall: http://192.169.0.32.",
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/arc/arc_1_0_1.png",
+            "alt": "Arc-Loader-Weboberfläche",
+            "caption": "Arc-Loader-Weboberfläche"
+          },
+          {
+            "htmlBefore": "<strong>Terminaloberfläche</strong>: Öffnen Sie sie direkt in der VM-Konsole.",
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/arc/arc_1_1_1.png",
+            "alt": "Arc-Loader-Terminaloberfläche",
+            "caption": "Arc-Loader-Terminaloberfläche"
+          }
+        ],
+        "rr": [
+          {
+            "htmlBefore": "<strong>Web-Schnittstelle</strong>, um auf die Web-Schnittstelle zuzugreifen, öffnen Sie einfach einen Webbrowser und geben Sie die IP-Adresse ein, die in der Konsolenausgabe des VM angezeigt wird, gefolgt von Port <strong>7681</strong>. Zum Beispiel in unserem Fall: <code>http://192.169.0.33:7681</code>.",
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/rr/rr_2_0_2.png",
+            "alt": "RR Befehlsbeispiel",
+            "caption": "RR-Loader-Weboberfläche"
+          },
+          {
+            "htmlBefore": "<strong>Terminaloberfläche</strong>: Geben Sie in der VM-Konsole <strong>menu.sh</strong> ein, um sie zu öffnen.",
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/rr/rr_2_1_1.png",
+            "alt": "Oberfläche von RR Loader",
+            "caption": "RR-Loader-Terminaloberfläche"
+          }
+        ],
+        "tinycore": [
+          {
+            "htmlBefore": "<strong>Web-Schnittstelle</strong>, um auf die Web-Schnittstelle zuzugreifen, öffnen Sie einfach einen Webbrowser und geben Sie die IP-Adresse ein, die in der Konsolenausgabe des VM angezeigt wird, gefolgt von Port <strong>7681</strong>. Zum Beispiel in unserem Fall: <code>http://192.169.0.35:7681</code>.",
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/tinycore/tinycore_3_0_1.png",
+            "alt": "TinyCore-Loader-Oberfläche",
+            "caption": "TinyCore-Loader-Weboberfläche"
+          },
+          {
+            "htmlBefore": "<strong>Terminaloberfläche</strong>: Öffnen Sie sie direkt in der VM-Konsole. Achten Sie auf Aufforderungen, eine Taste zum Fortfahren zu drücken oder die Sprache zu ändern.",
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/tinycore/tinycore_3_1_1.png",
+            "alt": "TinyCore-Loader-Oberfläche",
+            "caption": "Terminaloberfläche von TinyCore Loader"
+          }
+        ]
+      }
+    },
+    {
+      "id": "step2",
+      "title": "Modell auswählen",
+      "intro": "Wählen Sie nach dem Laden des Menüs das Synology DSM-Modell aus, das Sie installieren möchten. Abhängig vom Loader müssen Sie manchmal die Optionen erweitern, um mehr Modelle zu sehen.",
+      "outro": "In unserem Beispiel wählen wir das SA6400-Modell.",
+      "loaders": {
+        "arc": [
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/arc/arc_1_2_1.png",
+            "alt": "Arc Model Auswahl",
+            "caption": "Arc Model Auswahl"
+          }
+        ],
+        "rr": [
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/rr/rr_2_2_1.png",
+            "alt": "RR Modellauswahl",
+            "caption": "RR Modellauswahl"
+          }
+        ],
+        "tinycore": [
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/tinycore/tinycore_3_2_1.png",
+            "alt": "TinyCore Modellauswahl",
+            "caption": "TinyCore Modellauswahl"
+          }
+        ]
+      }
+    },
+    {
+      "id": "step3",
+      "title": "Wählen Sie DSM-Version",
+      "intro": "Nachdem Sie das Modell ausgewählt haben, müssen Sie die DSM-Version auswählen, die Sie installieren möchten.",
+      "loaders": {
+        "arc": [
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/arc/arc_1_3_1.png",
+            "alt": "Versionsauswahl in Arc – Schritt 1",
+            "caption": "Versionsauswahl in Arc – Schritt 1"
+          },
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/arc/arc_1_3_2.png",
+            "alt": "Versionsauswahl in Arc – Schritt 2",
+            "caption": "Versionsauswahl in Arc – Schritt 2"
+          }
+        ],
+        "rr": [
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/rr/rr_2_3_1.png",
+            "alt": "RR Versionsauswahl - Schritt 1",
+            "caption": "RR Versionsauswahl - Schritt 1"
+          },
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/rr/rr_2_3_2.png",
+            "alt": "RR Versionsauswahl - Schritt 2",
+            "caption": "RR Versionsauswahl - Schritt 2"
+          },
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/rr/rr_2_3_3.png",
+            "alt": "RR Versionsauswahl - Schritt 3",
+            "caption": "RR Versionsauswahl - Schritt 3"
+          }
+        ],
+        "tinycore": [
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/tinycore/tinycore_3_3_1.png",
+            "alt": "TinyCore Versionsauswahl - Schritt 1",
+            "caption": "TinyCore Versionsauswahl - Schritt 1"
+          },
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/tinycore/tinycore_3_3_2.png",
+            "alt": "TinyCore Versionsauswahl - Schritt 2",
+            "caption": "TinyCore Versionsauswahl - Schritt 2"
+          }
+        ]
+      }
+    },
+    {
+      "id": "step4",
+      "title": "Addons auswählen",
+      "intro": "Mit diesem Schritt können Sie dem Loader zusätzliche Funktionen oder benutzerdefinierte Konfigurationen hinzufügen.",
+      "loaders": {
+        "arc": [
+          {
+            "htmlBefore": "<strong>Arc</strong> bietet Ihnen die Möglichkeit, die Einstellungen automatisch zu konfigurieren oder manuell anzupassen. Wenn die automatische Konfiguration ausgewählt ist, beginnt der Loader mit der Anwendung der erforderlichen Einstellungen und startet automatisch neu, sobald der Prozess abgeschlossen ist.",
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/arc/arc_1_4_1.png",
+            "alt": "Arc Auto Konfiguration",
+            "caption": "Arc Auto Konfiguration"
+          },
+          {
+            "htmlBefore": "Wenn wir uns dafür entscheiden, den automatischen Modus nicht zu verwenden, betreten wir das Menü, um verschiedene Optionen zu konfigurieren, die für den Loader erforderlich sind:",
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/arc/arc_1_4_2.png",
+            "alt": "Arc Manual Konfiguration",
+            "caption": "Arc Manual Konfiguration"
+          },
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/arc/arc_1_4_3.png",
+            "alt": "Arc SN/Mac Konfiguration",
+            "caption": "Arc SN/Mac Konfiguration"
+          },
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/arc/arc_1_4_4.png",
+            "alt": "Arc Sata Portmap",
+            "caption": "Arc Sata Portmap (verwenden Sie die empfohlene Option)"
+          },
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/arc/arc_1_4_5.png",
+            "alt": "Arc Addons Auswahl",
+            "caption": "Arc Addons Auswahl"
+          }
+        ],
+        "rr": [
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/rr/rr_2_4_1.png",
+            "alt": "RR Addon Schritt 1",
+            "caption": "RR Addon Schritt 1"
+          },
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/rr/rr_2_4_2.png",
+            "alt": "RR Addon Schritt 2",
+            "caption": "RR-Addon – Schritt 2: Zum Hinzufügen von Addons klicken."
+          },
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/rr/rr_2_4_3.png",
+            "alt": "RR Addon Schritt 3",
+            "caption": "RR Addon Schritt 3 - Wählen Sie das gewünschte aus, indem Sie darauf klicken. Wenn Sie mehr hinzufügen möchten, wiederholen Sie den Vorgang aus den Bildern 2.4.2 und 2.4.3."
+          }
+        ],
+        "tinycore": [
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/tinycore/tinycore_3_4_1.png",
+            "alt": "TinyCore SN Konfiguration",
+            "caption": "TinyCore SN Konfiguration"
+          },
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/tinycore/tinycore_3_4_2.png",
+            "alt": "TinyCore Zufallsoption",
+            "caption": "TinyCore-Zufallsoption – die zufällige Auswahl wird empfohlen."
+          },
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/tinycore/tinycore_3_4_3.png",
+            "alt": "TinyCore MAC Konfiguration",
+            "caption": "TinyCore MAC Konfiguration"
+          },
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/tinycore/tinycore_3_4_4.png",
+            "alt": "TinyCore VM MAC",
+            "caption": "TinyCore VM MAC - Wählen Sie den MAC Ihres VM oder einen zufälligen MAC"
+          }
+        ]
+      }
+    },
+    {
+      "id": "step5",
+      "title": "Bauen Sie den Loader",
+      "intro": "Sobald Sie das Modell, die DSM-Version und die Addons ausgewählt haben, erstellen Sie den Loader. Dieser Vorgang kann je nach Loader und ausgewählter Konfiguration einige Minuten dauern. Um zu starten, wählen Sie die Option \"Build the Loader\".",
+      "loaders": {
+        "arc": [
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/arc/arc_1_5_1.png",
+            "alt": "Loader in Arc erstellen",
+            "caption": "Loader in Arc erstellen"
+          }
+        ],
+        "rr": [
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/rr/rr_2_5_1.png",
+            "alt": "Loader in RR erstellen",
+            "caption": "Loader in RR erstellen"
+          }
+        ],
+        "tinycore": [
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/tinycore/tinycore_3_5_1.png",
+            "alt": "Loader in TinyCore erstellen",
+            "caption": "Loader in TinyCore erstellen"
+          }
+        ]
+      }
+    },
+    {
+      "id": "step6",
+      "title": "Loader starten",
+      "intro": "Sobald der Loader gebaut wurde, werden Sie zum Booten aufgefordert. Der VM wird mit der von Ihnen erstellten Konfiguration neu gestartet und die DSM-Installation gestartet.",
+      "loaders": {
+        "arc": [
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/arc/arc_1_6_1.png",
+            "alt": "Loader in Arc starten",
+            "caption": "Loader in Arc starten"
+          }
+        ],
+        "rr": [
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/rr/rr_2_6_1.png",
+            "alt": "Loader in RR starten",
+            "caption": "Loader in RR starten"
+          }
+        ],
+        "tinycore": [
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/tinycore/tinycore_3_6_1.png",
+            "alt": "Loader in TinyCore starten",
+            "caption": "Loader in TinyCore starten"
+          }
+        ]
+      }
+    }
+  ],
+  "dsmInstall": {
+    "heading": "Starten der DSM Installation",
+    "intro": "Sobald der Loader gebootet ist, können Sie Ihr Synology-Gerät finden, indem Sie:",
+    "afterCode": "Folgen Sie den Anweisungen auf dem Bildschirm, um die DSM-Installation abzuschließen.",
+    "setupAlt": "DSM-Einrichtung",
+    "setupCaption": "DSM-Einrichtungsbildschirm",
+    "patience": "Bitte haben Sie Geduld - der Prozess kann einige Minuten dauern. Der prozentuale Fortschritt wird automatisch aktualisiert, wenn das Setup fortschreitet. Ein Countdown beginnt, sobald die Installation kurz vor dem Abschluss steht.",
+    "finishAlt": "Installation abgeschlossen",
+    "finishCaption": "Installation abgeschlossen"
+  },
+  "tips": {
+    "heading": "Tipps",
+    "introItem": "Beachten Sie, dass sich die verfügbaren Optionen je nach Loaderversion und Entwicklerupdates ändern können. Wenn während des Loader-Erstellungsprozesses Probleme auftreten, lesen Sie die Loader-Dokumentation:",
+    "docLinks": [
+      {
+        "label": "Arc-Dokumentation",
+        "url": "https://github.com/AuxXxilium/arc"
+      },
+      {
+        "label": "RR Dokumentation",
+        "url": "https://github.com/RROrg/rr"
+      },
+      {
+        "label": "TinyCore Dokumentation",
+        "url": "https://github.com/PeterSuh-Q3/tinycore-redpill"
+      }
+    ],
+    "olderModels": "Einige ältere DSM-Modelle können Probleme beim Erkennen von Festplatten oder der Netzwerkkarte haben. Es wird empfohlen, neuere Modelle zu verwenden.",
+    "updateLabel": "Aktualisieren:",
+    "updateBody": "Einige Loader bieten die Möglichkeit, den Loader direkt aus dem Menü zu aktualisieren.",
+    "importantLabel": "Wichtig:",
+    "importantBody": "ProxMenux bietet keine Unterstützung für die verschiedenen Loader."
+  }
+}
diff --git a/web/messages/de/docs/create-vm/system-linux.json b/web/messages/de/docs/create-vm/system-linux.json
new file mode 100644
index 00000000..0c25299f
--- /dev/null
+++ b/web/messages/de/docs/create-vm/system-linux.json
@@ -0,0 +1,292 @@
+{
+  "meta": {
+    "title": "VM erstellen: Linux-System | ProxMenux-Dokumentation",
+    "description": "Erstellen Sie Linux-VMs auf Proxmox VE mit ProxMenux. Beschreibt den ausgewählten Katalog offizieller ISO-Abbilder (Ubuntu, Debian, Fedora, Arch, Rocky, Mint, openSUSE, Alpine, Kali, Manjaro), den gemeinsamen Speicherplan, optionales GPU-Passthrough und Tipps nach der Installation.",
+    "ogTitle": "VM erstellen: Linux-System | ProxMenux-Dokumentation",
+    "ogDescription": "Erstellen Sie Linux-VMs auf Proxmox VE mit ProxMenux. Kuratierter ISO-Katalog, einheitlicher Speicherplan, optionaler GPU-Durchlauf und Tipps nach der Installation.",
+    "ogImageAlt": "ProxMenux Linux VM Menü"
+  },
+  "header": {
+    "title": "VM erstellen: Linux-System",
+    "description": "Erstellen Sie eine Linux-VM auf Proxmox VE. ProxMenux bietet einen ausgewählten Katalog offizieller Linux-ISOs zum Herunterladen und eine Auswahl lokaler ISOs. Alle Wege führen durch den gemeinsamen VM-Assistenten, den Speicherplan und den optionalen GPU-Passthrough-Assistenten.",
+    "section": "Virtuelle Maschinen"
+  },
+  "intro": {
+    "title": "Was dieses Skript macht",
+    "body": "Wählt eine offizielle Linux-ISO zum automatischen Herunterladen oder eine bereits hochgeladene lokale ISO. Danach führt der gemeinsame Assistent durch CPU, RAM und BIOS, den Speicherplan, optionales GPU-Passthrough und die VM-Erstellung."
+  },
+  "image": {
+    "alt": "ProxMenux Linux Installationsoptionen",
+    "caption": "Linux Installationsoptionen"
+  },
+  "config": {
+    "heading": "Standard- oder erweiterte Konfiguration",
+    "intro": "Nachdem die ISO ausgewählt wurde, fragt ProxMenux, ob das Standardprofil VM verwendet oder der erweiterte Wizard geöffnet werden soll.",
+    "defaultHeading": "Standardkonfiguration",
+    "headerParam": "Parameter",
+    "headerValue": "Standardwert",
+    "defaultRows": [
+      {
+        "param": "Maschinentyp",
+        "valueRich": "<code>q35</code>"
+      },
+      {
+        "param": "BIOS",
+        "value": "OVMF (UEFI)"
+      },
+      {
+        "param": "CPU-Typ",
+        "value": "Host"
+      },
+      {
+        "param": "Kerne",
+        "value": "2"
+      },
+      {
+        "param": "RAM",
+        "value": "4096 MB"
+      },
+      {
+        "param": "Brücke",
+        "valueRich": "<code>vmbr0</code>"
+      },
+      {
+        "param": "MAC-Adresse",
+        "value": "Autogeneriert"
+      },
+      {
+        "param": "Nach Abschluss starten",
+        "value": "Nein"
+      }
+    ],
+    "advancedHeading": "Erweiterte Konfiguration",
+    "advancedIntro": "Der erweiterte Wizard stellt jeden Parameter einzeln dar:",
+    "headerOptions": "Optionen",
+    "advancedRows": [
+      {
+        "param": "Maschinentyp",
+        "optionsRich": "<code>q35</code> oder <code>i440fx</code>"
+      },
+      {
+        "param": "BIOS",
+        "options": "OVMF (UEFI) oder SeaBIOS (Legacy)"
+      },
+      {
+        "param": "CPU-Typ",
+        "options": "Host, KVM64 und weitere aufgeführte CPU-Modelle"
+      },
+      {
+        "param": "Kerne",
+        "options": "Anzahl CPU-Kerne"
+      },
+      {
+        "param": "RAM",
+        "options": "Speicher zugewiesen VM"
+      },
+      {
+        "param": "Brücke",
+        "options": "Netzbrücke"
+      },
+      {
+        "param": "MAC-Adresse",
+        "options": "Eigene MAC-Adresse"
+      },
+      {
+        "param": "VLAN",
+        "options": "VLAN-Tag (fakultativ)"
+      },
+      {
+        "param": "MTU",
+        "options": "MTU-Größe"
+      }
+    ]
+  },
+  "storagePlan": {
+    "heading": "Speicherplan",
+    "body": "Nach CPU / RAM öffnet ProxMenux das <strong>Storage Plan</strong>-Menü, in dem Sie virtuelle Festplatten, importierte Festplatten und PCI-Durchgangsgeräte im selben VM kombinieren können, indem Sie Elemente einzeln hinzufügen und beenden, wenn Sie fertig sind.",
+    "virtualDiskTitle": "a. Virtuelle Festplatte hinzufügen",
+    "virtualDiskItems": [
+      "Listet die auf dem Host verfügbaren Proxmox-Speicher auf.",
+      "Sie wählen den Zielspeicher und die Größe in GB aus.",
+      "Das Laufwerk nutzt den gewählten Bus: SCSI (Standard), SATA, VirtIO oder IDE. SATA hat sechs Anschlüsse von 0 bis 5: <code>sata0</code>, <code>sata1</code>, …."
+    ],
+    "importDiskTitle": "b. Physisches Laufwerk hinzufügen",
+    "importDiskItems": [
+      "Erkennt physische Festplatten, die sicher importiert werden können (System und geschützte Festplatten sind verborgen).",
+      "Sie wählen eine oder mehrere Festplatten über eine Checkliste aus.",
+      "Importierte Laufwerke nutzen den gewählten Bus und werden über <code>qm set</code> zugewiesen."
+    ],
+    "pciTitle": "c. Controller oder NVMe hinzufügen (PCI-Passthrough)",
+    "pciItems": [
+      "Erkennt SATA-/SAS-HBAs und NVMe-Geräte und ermöglicht die Zuweisung eines <em>ganzen Controllers</em> an die VM. IOMMU muss aktiv sein; das Skript bietet die Aktivierung und bei Bedarf einen Neustart an.",
+      "Ein Bestätigungsschritt warnt vor einem kontrollerweiten Risiko (die gesamte Karte, einschließlich jeder Festplatte, verlässt den Host).",
+      "PCI-Geräte werden mit Befehlen wie <code>qm set VMID --hostpci0 PCI_ADDRESS,pcie=1</code> zugewiesen. Ersetzen Sie VMID und PCI_ADDRESS durch VM-ID und PCI-Adresse und verwenden Sie für jedes Gerät einen freien hostpci-Index."
+    ],
+    "resetTitle": "Zurücksetzen und abschließen",
+    "resetBody": "Das Menü bietet <strong>r</strong> zum Zurücksetzen und Neubeginnen sowie <strong>d</strong> zum Abschließen und Fortfahren. Ein leerer Plan kann nicht abgeschlossen werden."
+  },
+  "gpu": {
+    "heading": "Optionaler GPU-Durchgang",
+    "body": "Nach dem Speicherplan bietet ProxMenux bei einer geeigneten GPU den Passthrough-Assistenten an. Siehe <gpuLink>GPU zu einer VM hinzufügen (Passthrough)</gpuLink>. Ein Host-Neustart kann erforderlich sein."
+  },
+  "autoFeatures": {
+    "heading": "Automatische VM-Funktionen",
+    "efiTitle": "EFI-Laufwerk",
+    "efiBody": "Wenn OVMF (UEFI) ausgewählt ist, erstellt ProxMenux eine 4 MB EFI-Systemplatte auf dem von Ihnen ausgewählten Speicher, sodass die Firmware einen Platz zum Speichern ihrer Variablen hat.",
+    "isoTitle": "ISO-Anschluss",
+    "isoBody": "Die Installation ISO ist als CD-ROM an <code>ide2</code> angebracht, bereit für den ersten Boot.",
+    "guestTitle": "QEMU Gastagent",
+    "guestBody": "Der Gastagentenkanal ist in der VM-Konfiguration aktiviert. Sie müssen den Agenten immer noch im Gast installieren - siehe unten."
+  },
+  "installOptions": {
+    "heading": "Linux Installationsoptionen",
+    "officialHeading": "Offizielle ISO (traditionelle Installation)",
+    "officialBody": "ProxMenux bietet eine ausgewählte Liste offizieller Linux-ISOs. Wählen Sie eine aus; das Skript lädt sie direkt vom Spiegelserver der Distribution nach <code>/var/lib/vz/template/iso</code> und bindet sie in die VM ein.",
+    "officialImageAlt": "Auswahl der Linux-Distribution",
+    "officialImageCaption": "Auswahl der Linux-Distribution",
+    "localHeading": "Lokale ISO-Datei",
+    "localBody": "Verwendet eine Linux-ISO, die bereits unter <code>/var/lib/vz/template/iso</code> liegt. Das Skript listet alle gefundenen <code>*.iso</code>-Dateien zur Auswahl auf.",
+    "localImageAlt": "Lokales ISO-Auswahlmenü",
+    "localImageCaption": "Lokales ISO-Auswahlmenü",
+    "distros": [
+      {
+        "name": "Ubuntu",
+        "variants": [
+          "25.10 Desktop",
+          "24.04 Desktop",
+          "22.04 Desktop",
+          "20.04 Desktop",
+          "25.10 Server",
+          "24.04 Server",
+          "22.04 Server",
+          "20.04 Server"
+        ]
+      },
+      {
+        "name": "Debian",
+        "variants": [
+          "13 Desktop",
+          "12 Desktop",
+          "11 Desktop",
+          "13 Netinst",
+          "12 Netinst",
+          "11 Netinst"
+        ]
+      },
+      {
+        "name": "Fedora",
+        "variants": [
+          "Workstation 42"
+        ]
+      },
+      {
+        "name": "Arch Linux",
+        "variants": [
+          "neueste Version"
+        ]
+      },
+      {
+        "name": "Rocky Linux",
+        "variants": [
+          "9"
+        ]
+      },
+      {
+        "name": "Linux Mint",
+        "variants": [
+          "22.1 Cinnamon"
+        ]
+      },
+      {
+        "name": "openSUSE",
+        "variants": [
+          "Leap 15.6"
+        ]
+      },
+      {
+        "name": "Alpine Linux",
+        "variants": [
+          "3.21"
+        ]
+      },
+      {
+        "name": "Kali Linux",
+        "variants": [
+          "2026.1"
+        ]
+      },
+      {
+        "name": "Manjaro",
+        "variants": [
+          "25.0 GNOME"
+        ]
+      }
+    ]
+  },
+  "endToEnd": {
+    "heading": "Was das Skript Ende-zu-Ende macht",
+    "items": [
+      "Erhält die Linux ISO (offizieller Download oder lokale Datei).",
+      "Wendet die Standard- oder erweiterte CPU / RAM / BIOS / Maschinentypkonfiguration an.",
+      "Öffnet den Speicherplan und verbindet die ausgewählten virtuellen Festplatten, importierten Festplatten und PCI-Geräte.",
+      "Erstellt die EFI-Festplatte, wenn UEFI ausgewählt ist.",
+      "Montiert die Linux ISO auf <code>ide2</code>.",
+      "Legt die Bootreihenfolge fest: zuerst Laufwerk, dann ISO.",
+      "Aktiviert den QEMU Guest Agent Kanal.",
+      "Optional läuft der GPU Passthrough-Assistent.",
+      "Generiert eine stilisierte HTML-Beschreibung, die dem VM beigefügt ist.",
+      "Startet die VM, wenn Sie dies gewählt haben."
+    ]
+  },
+  "postInstall": {
+    "heading": "Tipps nach der Installation",
+    "guestAgentHeading": "Installieren Sie den QEMU Guest Agent in der VM",
+    "guestAgentBody": "ProxMenux aktiviert den Gastagentenkanal in der VM-Konfiguration; den Agenten selbst müssen Sie im Gast installieren. Er unterstützt kontrolliertes Herunterfahren und das Einfrieren von Dateisystemen während Backups, um die Datenkonsistenz zu verbessern.",
+    "debian": "Debian / Ubuntu",
+    "fedora": "Fedora / Rocky / RHEL",
+    "arch": "Arch Linux",
+    "opensuse": "openSUSE",
+    "virtioHeading": "VirtIO-Unterstützung in Linux",
+    "virtioBody": "Moderne Linux-Distributionen enthalten normalerweise VirtIO-Treiber für Laufwerke und Netzwerk. Wählen Sie <code>virtio</code> für VirtIO-Blockgeräte oder <code>scsi</code> mit dem konfigurierten VirtIO-SCSI-Controller; der Netzwerkadapter nutzt ebenfalls <code>virtio</code>. Prüfen Sie die Treiberunterstützung bei älteren Installern.",
+    "virtioWarnTitle": "Sehr alte Distributionen",
+    "virtioWarnBody": "Sehr alte Installer können die benötigten VirtIO-Treiber nicht enthalten. Verwenden Sie dann einen emulierten SATA-/SCSI-Controller oder stellen Sie passende Treiber bereit.",
+    "trimHeading": "TRIM / discard bei SSD-Speicher aktivieren",
+    "trimBody": "Liegt die VM auf SSD-basiertem Proxmox-Speicher und wurde das Laufwerk mit dem Flag <code>discard</code> zugewiesen, können Sie TRIM-Befehle aus dem Gast weiterleiten. Zwei Möglichkeiten:",
+    "trimItems": [
+      "Führen Sie <code>fstrim -av</code> regelmäßig aus (oder aktivieren Sie die <code>fstrim.timer</code>-Einheit in systemd-Distributionen).",
+      "Oder mounten Sie Dateisysteme mit der Option <code>discard</code> in <code>/etc/fstab</code>."
+    ],
+    "balloonHeading": "Dynamische Speicherzuweisung (Ballooning)",
+    "balloonBody": "Moderne Linux-Kernel enthalten normalerweise den Treiber <code>virtio_balloon</code>. Mit aktiviertem Balloon-Gerät kann Proxmox Speicherstatistiken erfassen. Dynamische Rückgewinnung setzt zudem einen Mindestwert unterhalb des konfigurierten Maximums voraus; gleiche Werte ergeben eine feste Speicherzuweisung."
+  },
+  "related": {
+    "heading": "Verwandte Themen",
+    "items": [
+      {
+        "href": "/docs/disk-manager/import-disk-image-vm",
+        "label": "Disk-Image in VM importieren",
+        "tail": " — ein vorhandenes Linux-Abbild im Format .qcow2 / .img / .raw einer neuen VM zuweisen."
+      },
+      {
+        "href": "/docs/utils/import-vm",
+        "label": "VM von OVA / OVF importieren",
+        "tail": " — eine aus VMware / VirtualBox / Proxmox exportierte Linux-VM importieren."
+      },
+      {
+        "href": "/docs/hardware/gpu-vm-passthrough",
+        "label": "GPU zu VM hinzufügen (Passthrough)",
+        "tail": "- für Linux-VMs, die GPU-Beschleunigung benötigen."
+      },
+      {
+        "href": "/docs/help-info/vm-ct-commands",
+        "label": "VM und CT Verwaltungsbefehle",
+        "tail": "— qm CLI Referenz."
+      },
+      {
+        "href": "/docs/create-vm",
+        "label": "Übersicht zur VM-Erstellung",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/de/docs/create-vm/system-nas/index.json b/web/messages/de/docs/create-vm/system-nas/index.json
new file mode 100644
index 00000000..5111b5c4
--- /dev/null
+++ b/web/messages/de/docs/create-vm/system-nas/index.json
@@ -0,0 +1,147 @@
+{
+  "meta": {
+    "title": "VM erstellen: System NAS | ProxMenux Dokumentation",
+    "description": "Erstellen Sie virtuelle NAS-Maschinen auf Proxmox VE mit ProxMenux. Unterstützt Synology DSM (Loader), TrueNAS SCALE / CORE, OpenMediaVault, XigmaNAS, Rockstor, ZimaOS und FygoOS. Umbrel OS ist über ein Community-Script verfügbar.",
+    "ogTitle": "VM erstellen: System NAS | ProxMenux Dokumentation",
+    "ogDescription": "Erstellen Sie virtuelle NAS-Maschinen auf Proxmox VE mit ProxMenux. Unterstützt Synology DSM (Loader), TrueNAS SCALE / CORE, OpenMediaVault, XigmaNAS, Rockstor, ZimaOS und FygoOS.",
+    "ogImageAlt": "ProxMenux System NAS Menü"
+  },
+  "header": {
+    "title": "VM erstellen: System NAS",
+    "description": "ProxMenux unterstützt acht NAS-Betriebssysteme als dedizierte VMs sowie einen optionalen Umbrel OS-Pfad über ein Community-Skript. Die meisten Systeme teilen sich den gleichen Auto-ISO-Flow; Synology DSM verwendet einen spezialisierten Loader-Assistenten.",
+    "section": "Virtuelle Maschinen"
+  },
+  "intro": {
+    "title": "Wie der NAS-Selektor funktioniert",
+    "body": "Im allgemeinen ISO-Ablauf versucht die NAS-Auswahl, die neueste stabile Version vom Projektspiegel zu ermitteln, und nutzt bei Bedarf eine Ersatzversion. Nach dem ISO-Download öffnet sich der gemeinsame Konfigurator für CPU, RAM, Laufwerke und Netzwerk. Synology DSM und ZimaOS verwenden eigene Installationsabläufe."
+  },
+  "image": {
+    "alt": "ProxMenux System NAS-Selektor",
+    "caption": "System-NAS-Auswahl"
+  },
+  "flowBadges": {
+    "loader": "Loader-Ablauf",
+    "auto-iso": "Automatischer ISO-Ablauf",
+    "dedicated": "Dediziertes Skript"
+  },
+  "labels": {
+    "base": "Basis",
+    "fileSystem": "Dateisystem",
+    "viewDetails": "Details anzeigen"
+  },
+  "supported": {
+    "heading": "Unterstützte NAS-Systeme",
+    "cards": [
+      {
+        "name": "Synology DSM",
+        "tagline": "DiskStation Manager mit dem ARC / RR-Loader. Erfordert die Konfiguration des Loaders vor dem ersten Booten.",
+        "icon": "HardDrive",
+        "base": "Linux (Custom)",
+        "fileSystem": "Btrfs, ext4",
+        "href": "/docs/create-vm/system-nas/synology",
+        "flow": "loader"
+      },
+      {
+        "name": "TrueNAS SCALE",
+        "tagline": "Debian-basiertes TrueNAS mit Docker-Apps in aktuellen Versionen und ZFS als primärem Dateisystem. Ältere SCALE-Versionen nutzten Kubernetes.",
+        "icon": "Database",
+        "base": "Debian Linux",
+        "fileSystem": "ZFS",
+        "href": "/docs/create-vm/system-nas/system-nas-others#truenas-scale",
+        "flow": "auto-iso"
+      },
+      {
+        "name": "TrueNAS CORE",
+        "tagline": "FreeBSD-basiertes TrueNAS mit Schwerpunkt ZFS-Speicher. Jails und Plugins in CORE 13.3 sind veraltet und werden nicht unterstützt.",
+        "icon": "Database",
+        "base": "FreeBSD",
+        "fileSystem": "ZFS",
+        "href": "/docs/create-vm/system-nas/system-nas-others#truenas-core",
+        "flow": "auto-iso"
+      },
+      {
+        "name": "OpenMediaVault",
+        "tagline": "Schlankes Debian-basiertes NAS mit modularer Plugin-Architektur. Gut für ältere Hardware.",
+        "icon": "Server",
+        "base": "Debian Linux",
+        "fileSystem": "ext4, XFS, Btrfs",
+        "href": "/docs/create-vm/system-nas/system-nas-others#openmediavault",
+        "flow": "auto-iso"
+      },
+      {
+        "name": "XigmaNAS",
+        "tagline": "FreeBSD-basierte NAS - der ursprüngliche Nachfolger von FreeNAS, konzentriert auf ZFS und Einfachheit.",
+        "icon": "Database",
+        "base": "FreeBSD",
+        "fileSystem": "ZFS, UFS",
+        "href": "/docs/create-vm/system-nas/system-nas-others#xigmanas",
+        "flow": "auto-iso"
+      },
+      {
+        "name": "Rockstor",
+        "tagline": "openSUSE-basierte NAS rund um Btrfs. Rock-ons (Docker Apps) erweitern die Funktionalität.",
+        "icon": "HardDrive",
+        "base": "openSUSE Leap",
+        "fileSystem": "Btrfs",
+        "href": "/docs/create-vm/system-nas/system-nas-others#rockstor",
+        "flow": "auto-iso"
+      },
+      {
+        "name": "ZimaOS",
+        "tagline": "Schlankes NAS-Betriebssystem für Medien, Docker-Apps und Hausautomation. Verwendet einen eigenen Installer.",
+        "icon": "MonitorIcon",
+        "base": "Buildroot (aus CasaOS hervorgegangen)",
+        "fileSystem": "ext4",
+        "href": "/docs/create-vm/system-nas/system-nas-others#zimaos",
+        "flow": "dedicated"
+      },
+      {
+        "name": "FygoOS",
+        "tagline": "Internationale Ausgabe von fnOS: ein Debian-basiertes NAS mit Speichervolumen, Apps und Medien-Streaming, das über seine Web-Schnittstelle und die Fygo-Apps verwaltet wird.",
+        "icon": "Server",
+        "base": "Debian Linux",
+        "fileSystem": "Btrfs, ext4",
+        "href": "/docs/create-vm/system-nas/system-nas-others#fygoos",
+        "flow": "auto-iso"
+      }
+    ]
+  },
+  "umbrel": {
+    "title": "Gemeinschaftsoption: Umbrel OS",
+    "bodyRich": "Der neunte NAS-Menüeintrag ist <strong>Umbrel OS</strong>. Er startet einen außerhalb von ProxMenux gepflegten <umbrelLink>community-scripts-Installer</umbrelLink> und ist hier nicht dokumentiert. Der Installer übernimmt den gesamten Ablauf und zeigt am Ende die Standardzugangsdaten an."
+  },
+  "zfsMem": {
+    "title": "Faustregel für den ZFS-Arbeitsspeicher",
+    "bodyRich": "Weisen Sie TrueNAS für den Grundbetrieb mindestens <strong>8 GB RAM</strong> zu, bei höherer Last mehr. ZFS nutzt RAM für den ARC-Cache; eine allgemeine Leistungsgrenze bei 8 GB gibt es aber nicht für jedes ZFS-NAS. Beachten Sie die Anforderungen der Distribution sowie Laufwerke, Dienste und Apps. Schlanke OMV- oder Rockstor-Systeme können weniger benötigen."
+  },
+  "related": {
+    "heading": "Verwandte Themen",
+    "items": [
+      {
+        "href": "/docs/create-vm/system-nas/synology",
+        "label": "Synology-VM",
+        "tail": "— dediziertes Installationsprogramm für Synology DSM (Xpenology) auf Proxmox."
+      },
+      {
+        "href": "/docs/create-vm/system-nas/system-nas-others",
+        "label": "Sonstige System-NAS",
+        "tail": "TrueNAS, OpenMediaVault, Rockstor, XigmaNAS, FygoOS und ähnliches."
+      },
+      {
+        "href": "/docs/disk-manager/import-disk-vm",
+        "label": "Datenträger in VM importieren",
+        "tail": "- reale physische Festplatten an den NAS VM übergeben (empfohlen über virtuelle Festplatten für die Produktion)."
+      },
+      {
+        "href": "/docs/help-info/zfs-commands",
+        "label": "ZFS Verwaltungsbefehle",
+        "tail": "— nützlich, wenn Ihre NAS-Distribution ZFS darunter verwendet."
+      },
+      {
+        "href": "/docs/create-vm",
+        "label": "Übersicht zur VM-Erstellung",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/de/docs/create-vm/system-nas/synology.json b/web/messages/de/docs/create-vm/system-nas/synology.json
new file mode 100644
index 00000000..46c60c81
--- /dev/null
+++ b/web/messages/de/docs/create-vm/system-nas/synology.json
@@ -0,0 +1,400 @@
+{
+  "meta": {
+    "title": "VM erstellen: Synology DSM | ProxMenux-Dokumentation",
+    "description": "Erstellen Sie eine Synology-DSM-VM auf Proxmox VE. ProxMenux lädt den gewählten Loader (Arc, RR, Alpine RedPill M-shell oder ein eigenes Abbild), importiert ihn als Bootlaufwerk der VM und konfiguriert CPU, RAM und Speicher mit dem Standard- oder erweiterten Assistenten.",
+    "ogTitle": "VM erstellen: Synology DSM | ProxMenux-Dokumentation",
+    "ogDescription": "Erstellen Sie eine Synology DSM virtuelle Maschine auf Proxmox VE mit ProxMenux."
+  },
+  "header": {
+    "title": "VM erstellen: Synology DSM",
+    "description": "Erstellen Sie eine Synology-DSM-VM auf Proxmox VE. ProxMenux lädt den gewählten Loader (Arc, RR, Alpine RedPill M-shell oder ein eigenes Abbild), importiert ihn als Bootlaufwerk der VM und konfiguriert CPU, RAM und Speicher mit dem Standard- oder erweiterten Assistenten.",
+    "section": "Virtuelle Maschinen · NAS"
+  },
+  "loaderLabels": {
+    "arc": "Arc Loader",
+    "rr": "RR Loader",
+    "tinycore": "TinyCore Loader"
+  },
+  "whatThisDoes": {
+    "title": "Was das macht",
+    "bodyRich": "ProxMenux automatisiert die VM-Vorbereitung für Synology DSM: Es lädt einen unterstützten Loader, importiert ihn als IDE-Bootlaufwerk in eine neue VM und übernimmt die gewählten CPU-, RAM-, Netzwerk- und Speichereinstellungen. Loader-Erstellung, DSM-Modellwahl und DSM-Installation erfolgen <strong>innerhalb der VM</strong> über die Web- oder Terminaloberfläche des Loaders. Die Community pflegt diese sich häufig ändernden Schritte; diese Seite bietet eine Ausgangsbasis."
+  },
+  "supportedLoaders": {
+    "heading": "Unterstützte Loader",
+    "intro": "Mit dem Skript können Sie zwischen vier Loader-Quellen wählen:",
+    "loaders": [
+      {
+        "name": "AuxXxilium Arc",
+        "url": "https://github.com/AuxXxilium/arc"
+      },
+      {
+        "name": "RedPill RR",
+        "url": "https://github.com/RROrg/rr"
+      },
+      {
+        "name": "Alpine RedPill M-shell (TinyCore-Projekt)",
+        "url": "https://github.com/PeterSuh-Q3/tinycore-redpill"
+      }
+    ],
+    "customRich": "<strong>Custom Loader</strong> – legen Sie Ihr eigenes Loader-Image in <code>/var/lib/vz/template/iso</code> und das Skript wird es abholen."
+  },
+  "config": {
+    "heading": "Standard- oder erweiterte Konfiguration",
+    "intro": "Wenn Sie das Skript ausführen, wird gefragt, ob Sie das ProxMenux-Standardprofil VM verwenden oder den erweiterten Assistenten öffnen möchten. Standardwerte sind auf DSM abgestimmt und funktionieren für die meisten Installationen.",
+    "defaultHeading": "Standardkonfiguration",
+    "headerParam": "Parameter",
+    "headerValue": "Standardwert",
+    "defaultRowsRich": [
+      {
+        "param": "Maschinentyp",
+        "valueRich": "<code>q35</code>"
+      },
+      {
+        "param": "BIOS",
+        "valueRich": "OVMF (UEFI)"
+      },
+      {
+        "param": "CPU-Typ",
+        "valueRich": "Host"
+      },
+      {
+        "param": "Kerne",
+        "valueRich": "2"
+      },
+      {
+        "param": "RAM",
+        "valueRich": "4096 MB"
+      },
+      {
+        "param": "Brücke",
+        "valueRich": "<code>vmbr0</code>"
+      },
+      {
+        "param": "MAC-Adresse",
+        "valueRich": "Autogeneriert"
+      },
+      {
+        "param": "Nach Abschluss starten",
+        "valueRich": "Nein"
+      }
+    ],
+    "advancedHeading": "Erweiterte Konfiguration",
+    "advancedIntro": "Der erweiterte Assistent zeigt jede Einstellung einzeln. Sie können die folgenden Werte ändern:",
+    "headerOptions": "Optionen",
+    "advancedRowsRich": [
+      {
+        "param": "Maschinentyp",
+        "optionsRich": "<code>q35</code> oder <code>i440fx</code>"
+      },
+      {
+        "param": "BIOS",
+        "optionsRich": "OVMF (UEFI) oder SeaBIOS (Legacy)"
+      },
+      {
+        "param": "CPU-Typ",
+        "optionsRich": "Host oder KVM64"
+      },
+      {
+        "param": "Kerne",
+        "optionsRich": "Anzahl CPU-Kerne"
+      },
+      {
+        "param": "RAM",
+        "optionsRich": "Der VM zugewiesener Speicher"
+      },
+      {
+        "param": "Brücke",
+        "optionsRich": "Netzbrücke"
+      },
+      {
+        "param": "MAC-Adresse",
+        "optionsRich": "Eigene MAC-Adresse"
+      },
+      {
+        "param": "VLAN",
+        "optionsRich": "VLAN-Tag (fakultativ)"
+      },
+      {
+        "param": "MTU",
+        "optionsRich": "MTU-Größe"
+      }
+    ]
+  },
+  "storagePlan": {
+    "heading": "Speicherplan",
+    "introRich": "Nach CPU und RAM öffnet ProxMenux das Menü <strong>Speicherplan</strong>. Dort können Sie virtuelle und importierte Laufwerke sowie PCI-Passthrough-Geräte in derselben VM <strong>kombinieren</strong>. Fügen Sie die Elemente einzeln hinzu und schließen Sie den Plan danach ab.",
+    "virtualHeading": "a. Virtuelle Festplatte hinzufügen",
+    "virtualItemsRich": [
+      "Listet die auf dem Host verfügbaren Proxmox-Speicher auf.",
+      "Sie wählen den Zielspeicher und die Größe in GB aus.",
+      "Das Laufwerk wird als SATA zugewiesen (<code>sata0</code>, <code>sata1</code>, …). Virtuelle und physische Datenlaufwerke teilen sich die sechs SATA-Anschlüsse 0–5."
+    ],
+    "importHeading": "b. Physisches Laufwerk hinzufügen",
+    "importItemsRich": [
+      "Erkennt physische Festplatten, die sicher importiert werden können (System und geschützte Festplatten sind verborgen).",
+      "Sie wählen eine oder mehrere Festplatten über eine Checkliste aus.",
+      "Importierte Festplatten werden als SATA über <code>qm set</code> angehängt."
+    ],
+    "pciHeading": "c. Controller oder NVMe hinzufügen (PCI-Passthrough)",
+    "pciItemsRich": [
+      "Erkennt SATA-/SAS-HBAs und NVMe-Geräte und ermöglicht die Zuweisung eines <em>ganzen Controllers</em> an die VM. IOMMU muss aktiv sein; das Skript bietet die Aktivierung und bei Bedarf einen Neustart an.",
+      "Ein Bestätigungsschritt warnt vor einem kontrollerweiten Risiko (die gesamte Karte, einschließlich jeder Festplatte, verlässt den Host).",
+      "PCI-Geräte werden mit Befehlen wie <code>qm set VMID --hostpci0 PCI_ADDRESS,pcie=1</code> zugewiesen. Ersetzen Sie VMID und PCI_ADDRESS durch VM-ID und PCI-Adresse und verwenden Sie für jedes Gerät einen freien hostpci-Index."
+    ],
+    "resetCalloutTitle": "Zurücksetzen und abschließen",
+    "resetCalloutBodyRich": "Das Menü bietet <strong>r</strong> zum Zurücksetzen der Auswahl und <strong>d</strong> zum Abschließen und Fortfahren. Ein leerer Plan ist nicht zulässig; Synology benötigt mindestens ein Laufwerk für DSM."
+  },
+  "gpu": {
+    "heading": "Optionaler GPU-Durchgang",
+    "bodyRich": "Nach dem Speicherplan fragt das Skript bei einer geeigneten GPU nach deren Zuweisung an die VM. Siehe <link>GPU zu einer VM hinzufügen (Passthrough)</link>. Ein Host-Neustart kann erforderlich sein."
+  },
+  "loaderInstall": {
+    "heading": "Loader installieren",
+    "intro1Rich": "<strong>Arc</strong>, <strong>RR</strong> und <strong>Alpine RedPill M-shell</strong> werden automatisch aus ihren ursprünglichen GitHub-Repositories heruntergeladen und entpackt. Schlägt der Download fehl, bricht das Skript mit einer klaren Meldung ab.",
+    "intro2Rich": "Für die Option <strong>Custom Loader</strong> scannt das Skript <code>/var/lib/vz/template/iso</code>. Wenn mehr als ein Kandidat gefunden wird, werden Sie aufgefordert, den gewünschten auszuwählen.",
+    "uploadIntro": "Sie können benutzerdefinierte Loader aus dem lokalen Proxmox-Speicher hochladen:",
+    "imageAlt": "Custom Loader hinzufügen",
+    "imageCaption": "Custom Loader hinzufügen"
+  },
+  "vmCreation": {
+    "heading": "VM-Erstellung – ausgeführte Skriptbefehle",
+    "introRich": "Sobald Sie den Loader bestätigt haben, führt ProxMenux das Äquivalent dieser <code>qm</code>-Befehle aus:",
+    "itemsRich": [
+      "<code>qm create</code> — erstellt die VM mit den gewählten CPU-, RAM-, BIOS- und Maschineneinstellungen.",
+      "<code>qm importdisk</code> importiert das Loader-Abbild in den Proxmox-Speicher. Danach weist das Skript es der VM als <strong>IDE</strong>-Laufwerk an ide0 zu.",
+      "<code>qm set VMID --sata0 DISK_REFERENCE</code> weist ein geplantes Datenlaufwerk zu. Ersetzen Sie VMID und DISK_REFERENCE durch VM-ID und Laufwerksreferenz; nutzen Sie einen freien SATA-Index 0–5. Der Netzwerkadapter wird mit qm create konfiguriert.",
+      "<code>qm set VMID --hostpci0 PCI_ADDRESS,pcie=1</code> weist einen gewählten PCI-Controller oder ein NVMe-Gerät zu. Ersetzen Sie VMID und PCI_ADDRESS durch VM-ID und PCI-Adresse und nutzen Sie einen freien hostpci-Index pro Gerät.",
+      "<code>qm set VMID --boot order=ide0</code> legt den Loader als Bootgerät fest. Ersetzen Sie VMID durch die VM-ID."
+    ]
+  },
+  "stepByStep": {
+    "heading": "Schrittweise Loader-Konfiguration",
+    "intro": "Die sechs gemeinsamen Schritte sind: VM starten, Modell, DSM-Version und Addons wählen, Loader erstellen und starten. Menüs und Optionen ändern sich je nach Version. Die M-shell-Bilder zeigen eine ältere TinyCore-Oberfläche; das aktuelle Skript lädt Alpine RedPill M-shell. Folgen Sie dessen aktuellen Anweisungen.",
+    "warnCalloutTitle": "Die Loader werden nicht von ProxMenux gepflegt",
+    "warnCalloutBody": "Arc, RR und Alpine RedPill M-shell sind Community-Projekte mit eigener Release-Kadenz. Wenn ein Schritt anders aussieht als die Screenshots unten, hat der Loader wahrscheinlich aktualisiert - überprüfen Sie die eigene Dokumentation des Loaders (Links unten auf dieser Seite)."
+  },
+  "stepBadge": "Schritt",
+  "step1": {
+    "title": "Starten Sie die VM und öffnen Sie das Hauptmenü",
+    "intro": "Starten Sie die erstellte VM. Beim ersten Start öffnet sich die Loader-Konfiguration, in der Sie das DSM-Modell auswählen und erstellen. Spätere Starts überspringen diesen Schritt, sofern Sie keine neue Konfiguration im Bootmenü erzwingen. Alle drei Loader bieten Terminal- und Weboberflächen.",
+    "arc": {
+      "webRich": "<strong>Web-Schnittstelle.</strong> Öffnen Sie einen Browser und gehen Sie zu der in der VM-Konsole gezeigten IP (in unserem Beispiel: <code>http://192.168.0.32</code>).",
+      "webAlt": "Arc-Loader-Weboberfläche",
+      "webCaption": "Arc-Loader-Weboberfläche",
+      "termRich": "<strong>Terminaloberfläche</strong>: Öffnen Sie sie direkt in der VM-Konsole.",
+      "termAlt": "Arc-Loader-Terminaloberfläche",
+      "termCaption": "Arc-Loader-Terminaloberfläche"
+    },
+    "rr": {
+      "webRich": "<strong>Web-Schnittstelle.</strong> Öffnen Sie einen Browser und gehen Sie zu der IP, die in der VM-Konsole angezeigt wird, gefolgt von Port <strong>7681</strong> (Beispiel: <code>http://192.168.0.33:7681</code>).",
+      "webAlt": "RR-Loader-Weboberfläche",
+      "webCaption": "RR-Loader-Weboberfläche",
+      "termRich": "<strong>Terminaloberfläche.</strong> Geben Sie in der VM-Konsole <code>menu.sh</code> ein, um sie zu öffnen.",
+      "termAlt": "RR-Loader-Terminaloberfläche",
+      "termCaption": "RR-Loader-Terminaloberfläche"
+    },
+    "tinycore": {
+      "webRich": "<strong>Web-Schnittstelle.</strong> Öffnen Sie einen Browser und gehen Sie zu der IP, die in der VM-Konsole angezeigt wird, gefolgt von Port <strong>7681</strong> (Beispiel: <code>http://192.168.0.35:7681</code>).",
+      "webAlt": "TinyCore Loader-Web-Schnittstelle",
+      "webCaption": "TinyCore Loader-Web-Schnittstelle",
+      "termRich": "<strong>Terminaloberfläche</strong>: Öffnen Sie sie direkt in der VM-Konsole. Achten Sie auf Aufforderungen, eine Taste zum Fortfahren zu drücken oder die Sprache zu ändern.",
+      "termAlt": "Terminaloberfläche von TinyCore Loader",
+      "termCaption": "Terminaloberfläche von TinyCore Loader"
+    }
+  },
+  "step2": {
+    "title": "Modell auswählen",
+    "introRich": "Wählen Sie das Synology DSM-Modell aus, das Sie installieren möchten. Abhängig vom Loader müssen Sie möglicherweise die Optionen erweitern, um die vollständige Liste zu sehen. In den folgenden Screenshots verwenden wir das Modell <strong>SA6400</strong> als Beispiel.",
+    "arc": {
+      "alt": "Modellauswahl in Arc",
+      "caption": "Modellauswahl in Arc"
+    },
+    "rr": {
+      "alt": "Auswahl des RR-Modells",
+      "caption": "Auswahl des RR-Modells"
+    },
+    "tinycore": {
+      "alt": "TinyCore Modellauswahl",
+      "caption": "TinyCore Modellauswahl"
+    }
+  },
+  "step3": {
+    "title": "Wählen Sie DSM-Version",
+    "intro": "Nachdem Sie das Modell ausgewählt haben, wählen Sie die zu installierende DSM-Version aus.",
+    "arc": [
+      {
+        "alt": "Versionsauswahl in Arc – Schritt 1",
+        "caption": "Versionsauswahl in Arc – Schritt 1"
+      },
+      {
+        "alt": "Versionsauswahl in Arc – Schritt 2",
+        "caption": "Versionsauswahl in Arc – Schritt 2"
+      }
+    ],
+    "rr": [
+      {
+        "alt": "RR Versionsauswahl - Schritt 1",
+        "caption": "RR Versionsauswahl - Schritt 1"
+      },
+      {
+        "alt": "RR Versionsauswahl - Schritt 2",
+        "caption": "RR Versionsauswahl - Schritt 2"
+      },
+      {
+        "alt": "RR Versionsauswahl - Schritt 3",
+        "caption": "RR Versionsauswahl - Schritt 3"
+      }
+    ],
+    "tinycore": [
+      {
+        "alt": "TinyCore Versionsauswahl - Schritt 1",
+        "caption": "TinyCore Versionsauswahl - Schritt 1"
+      },
+      {
+        "alt": "TinyCore Versionsauswahl - Schritt 2",
+        "caption": "TinyCore Versionsauswahl - Schritt 2"
+      }
+    ]
+  },
+  "step4": {
+    "title": "Addons auswählen",
+    "intro": "Mit diesem Schritt können Sie dem Loader zusätzliche Funktionen oder benutzerdefinierte Konfiguration hinzufügen.",
+    "arc": {
+      "autoRich": "<strong>Arc</strong> bietet einen automatischen Modus (empfohlen) und einen manuellen Modus. Im automatischen Modus wendet der Loader sinnvolle Standardwerte an und startet selbstständig neu, wenn er fertig ist.",
+      "autoAlt": "Arc Auto Konfiguration",
+      "autoCaption": "Arc Auto Konfiguration",
+      "manualRich": "Wenn Sie manuell auswählen, gehen Sie eine nach der anderen durch die Optionen:",
+      "manualAlt": "Manuelle Konfiguration in Arc",
+      "manualCaption": "Manuelle Konfiguration in Arc",
+      "snMacAlt": "Arc SN/MAC",
+      "snMacCaption": "Arc SN / MAC-Konfiguration",
+      "portmapAlt": "Arc SATA portmap",
+      "portmapCaption": "Arc SATA Portmap (verwenden Sie die empfohlene Option)",
+      "addonsAlt": "Arc-Addons",
+      "addonsCaption": "Arc Addons Auswahl"
+    },
+    "rr": [
+      {
+        "alt": "RR-Addon — Schritt 1",
+        "caption": "RR-Addon — Schritt 1"
+      },
+      {
+        "alt": "RR-Addon — Schritt 2",
+        "caption": "RR-Addon — Schritt 2: Drücken Sie, um ein Addon hinzuzufügen"
+      },
+      {
+        "alt": "RR-Addon — Schritt 3",
+        "caption": "RR-Addon - Schritt 3: Klicken Sie auf das gewünschte Addon. Wiederholen Sie die beiden vorherigen Screenshots, um mehr hinzuzufügen."
+      }
+    ],
+    "tinycore": [
+      {
+        "alt": "TinyCore SN-Konfiguration",
+        "caption": "TinyCore SN-Konfiguration"
+      },
+      {
+        "alt": "TinyCore Zufallsoption",
+        "caption": "TinyCore Zufallsoption (empfohlen)"
+      },
+      {
+        "alt": "TinyCore MAC Konfiguration",
+        "caption": "TinyCore MAC Konfiguration"
+      },
+      {
+        "alt": "TinyCore VM MAC",
+        "caption": "TinyCore — Wählen Sie den MAC des VM oder einen zufälligen"
+      }
+    ]
+  },
+  "step5": {
+    "title": "Bauen Sie den Loader",
+    "introRich": "Wenn das Modell, die DSM-Version und die Addons ausgewählt sind, wählen Sie <strong>Build the Loader</strong>. Dies kann je nach Loader und den ausgewählten Optionen einige Minuten dauern.",
+    "arc": {
+      "alt": "Loader in Arc erstellen",
+      "caption": "Loader in Arc erstellen"
+    },
+    "rr": {
+      "alt": "Loader in RR erstellen",
+      "caption": "Loader in RR erstellen"
+    },
+    "tinycore": {
+      "alt": "Loader in TinyCore erstellen",
+      "caption": "Loader in TinyCore erstellen"
+    }
+  },
+  "step6": {
+    "title": "Loader starten",
+    "intro": "Sobald der Loader erstellt ist, startet der VM mit der von Ihnen erstellten Konfiguration neu und die DSM-Installation beginnt.",
+    "arc": {
+      "alt": "Loader in Arc starten",
+      "caption": "Loader in Arc starten"
+    },
+    "rr": {
+      "alt": "Loader in RR starten",
+      "caption": "Loader in RR starten"
+    },
+    "tinycore": {
+      "alt": "Loader in TinyCore starten",
+      "caption": "Loader in TinyCore starten"
+    }
+  },
+  "dsmInstall": {
+    "heading": "Starten der DSM-Installation",
+    "intro": "Nach dem Loader-Start finden Sie Ihre DSM-VM, indem Sie Folgendes öffnen:",
+    "afterCode": "Folgen Sie den Anweisungen auf dem Bildschirm, um die DSM-Installation abzuschließen.",
+    "setupAlt": "DSM-Einrichtung",
+    "setupCaption": "DSM-Einrichtungsbildschirm",
+    "patience": "Seien Sie geduldig - der Prozess kann mehrere Minuten dauern. Fortschritt wird automatisch aktualisiert und ein Countdown wird angezeigt, wenn sich die Installation dem Abschluss nähert.",
+    "finishAlt": "Installation abgeschlossen",
+    "finishCaption": "Installation abgeschlossen"
+  },
+  "tips": {
+    "heading": "Tipps",
+    "recentTitle": "Verwenden Sie aktuelle DSM-Modelle",
+    "recentBody": "Einige ältere DSM-Modelle haben Schwierigkeiten, Festplatten oder die Netzwerkkarte zu erkennen. Bevorzugt aktuelle Modelle (z.B. SA6400) für ein reibungsloseres First-Boot-Erlebnis.",
+    "updateTitle": "Aktualisieren des Loaders",
+    "updateBody": "Einige Loader bieten die Möglichkeit, sich direkt aus ihrem Konfigurationsmenü zu aktualisieren - Sie müssen den VM nicht zerstören und neu erstellen.",
+    "warnTitle": "ProxMenux unterstützt die Loader nicht",
+    "warnBody": "ProxMenux automatisiert die VM-Seite. Loader-Probleme (Modell nicht gefunden, Add-on nicht installiert, DSM weigert sich zu booten) sind hier außerhalb des Umfangs - verwenden Sie den eigenen Issue-Tracker und die Dokumentation jedes Loaders.",
+    "docsHeading": "Loader-Dokumentation",
+    "docLinks": [
+      {
+        "label": "Arc-Dokumentation",
+        "url": "https://github.com/AuxXxilium/arc"
+      },
+      {
+        "label": "RR-Dokumentation",
+        "url": "https://github.com/RROrg/rr"
+      },
+      {
+        "label": "TinyCore Dokumentation",
+        "url": "https://github.com/PeterSuh-Q3/tinycore-redpill"
+      }
+    ]
+  },
+  "related": {
+    "heading": "Verwandte Themen",
+    "itemsRich": [
+      {
+        "href": "/docs/create-vm/system-nas",
+        "label": "Übersicht über System NAS",
+        "tail": "— Vergleich von Synology vs TrueNAS / OMV / Rockstor / XigmaNAS."
+      },
+      {
+        "href": "/docs/create-vm/system-nas/system-nas-others",
+        "label": "Sonstige System-NAS",
+        "tail": " — andere NAS-Distributionen als Synology."
+      },
+      {
+        "href": "/docs/disk-manager/import-disk-vm",
+        "label": "Datenträger in VM importieren",
+        "tail": "- Reale Festplatten an Synology VM übergeben (empfohlen für die Speicherleistung)."
+      },
+      {
+        "href": "/docs/create-vm",
+        "label": "Übersicht zur VM-Erstellung",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/de/docs/create-vm/system-nas/system-nas-others.json b/web/messages/de/docs/create-vm/system-nas/system-nas-others.json
new file mode 100644
index 00000000..c7ee363a
--- /dev/null
+++ b/web/messages/de/docs/create-vm/system-nas/system-nas-others.json
@@ -0,0 +1,312 @@
+{
+  "meta": {
+    "title": "VM erstellen: Andere NAS-Systeme | ProxMenux Dokumentation",
+    "description": "Erstellen Sie TrueNAS SCALE, TrueNAS CORE, OpenMediaVault, XigmaNAS, Rockstor, ZimaOS und FygoOS virtuelle Maschinen auf Proxmox VE mit ProxMenux. Deckt die Standard- / erweiterte Konfiguration, den neuen Speicherplan, den optionalen GPU-Durchgang und die empfohlenen Spezifikationen pro System ab.",
+    "ogTitle": "VM erstellen: Andere NAS-Systeme | ProxMenux Dokumentation",
+    "ogDescription": "Erstellen Sie TrueNAS SCALE / CORE, OpenMediaVault, XigmaNAS, Rockstor, ZimaOS und FygoOS VMs auf Proxmox VE mit ProxMenux.",
+    "ogImageAlt": "ProxMenux NAS-Selektor"
+  },
+  "header": {
+    "title": "VM erstellen: Andere NAS-Systeme",
+    "description": "ProxMenux erstellt eine installationsbereite VM für TrueNAS SCALE, TrueNAS CORE, OpenMediaVault, XigmaNAS, Rockstor, ZimaOS und FygoOS. Diese Seite beschreibt den gemeinsamen Ablauf mit Standard- und erweiterten Einstellungen, Speicherplan und optionalem GPU-Passthrough sowie Hinweise und Ressourcenempfehlungen pro System.",
+    "section": "Virtuelle Maschinen · NAS"
+  },
+  "intro": {
+    "title": "Wie diese Systeme entstehen",
+    "bodyRich": "Alle sieben Systeme teilen sich den gleichen ProxMenux-Assistenten. Der NAS-Selektor wählt den passenden Installer aus (erkennt automatisch die neueste stabile Version für TrueNAS, OMV, XigmaNAS, Rockstor und FygoOS) und übergibt dann den generischen VM-Konfigurator und den Speicherplan. ZimaOS verwendet ein eigenes Installationsskript (<code>vm/zimaos.sh</code>), folgt jedoch der gleichen CPU/RAM/Speicherung/optional-GPU-Sequenz."
+  },
+  "config": {
+    "heading": "Standard- oder erweiterte Konfiguration",
+    "intro": "Wenn ein NAS ausgewählt ist, fragt ProxMenux, ob das standardmäßige VM-Profil verwendet oder der erweiterte Wizard geöffnet werden soll. Die Standardeinstellungen sind auf NAS-Workloads abgestimmt - mehr RAM als ein einfaches Linux VM, da ZFS-basierte Systeme es für den ARC-Cache benötigen.",
+    "defaultHeading": "Standardkonfiguration",
+    "headerParam": "Parameter",
+    "headerValue": "Standardwert",
+    "defaultRowsRich": [
+      {
+        "param": "Maschinentyp",
+        "valueRich": "<code>q35</code>"
+      },
+      {
+        "param": "BIOS",
+        "valueRich": "OVMF (UEFI)<note> — SeaBIOS für OpenMediaVault</note>"
+      },
+      {
+        "param": "CPU-Typ",
+        "valueRich": "Host"
+      },
+      {
+        "param": "Kerne",
+        "valueRich": "2"
+      },
+      {
+        "param": "RAM",
+        "valueRich": "8192 MB<note> — 4096 MB für ZimaOS</note>"
+      },
+      {
+        "param": "Brücke",
+        "valueRich": "<code>vmbr0</code>"
+      },
+      {
+        "param": "MAC-Adresse",
+        "valueRich": "Autogeneriert"
+      },
+      {
+        "param": "Nach Abschluss starten",
+        "valueRich": "Nein"
+      }
+    ],
+    "advancedHeading": "Erweiterte Konfiguration",
+    "advancedIntro": "Der erweiterte Wizard stellt jeden Parameter einzeln dar:",
+    "headerOptions": "Optionen",
+    "advancedRowsRich": [
+      {
+        "param": "Maschinentyp",
+        "optionsRich": "<code>q35</code> oder <code>i440fx</code>"
+      },
+      {
+        "param": "BIOS",
+        "optionsRich": "OVMF (UEFI) oder SeaBIOS (Legacy)"
+      },
+      {
+        "param": "CPU-Typ",
+        "optionsRich": "Host, KVM64 und weitere aufgeführte CPU-Modelle (ZimaOS: Host oder KVM64)"
+      },
+      {
+        "param": "Kerne",
+        "optionsRich": "Anzahl CPU-Kerne"
+      },
+      {
+        "param": "RAM",
+        "optionsRich": "Speicher zugewiesen VM"
+      },
+      {
+        "param": "Brücke",
+        "optionsRich": "Netzbrücke"
+      },
+      {
+        "param": "MAC-Adresse",
+        "optionsRich": "Eigene MAC-Adresse"
+      },
+      {
+        "param": "VLAN",
+        "optionsRich": "VLAN-Tag (fakultativ)"
+      },
+      {
+        "param": "MTU",
+        "optionsRich": "MTU-Größe"
+      }
+    ],
+    "zfsCalloutTitle": "ZFS und RAM",
+    "zfsCalloutBody": "TrueNAS SCALE/CORE und XigmaNAS nutzen ZFS, dessen ARC-Cache von RAM profitiert. TrueNAS benötigt mindestens 8 GB für den Grundbetrieb; 16 GB oder mehr helfen bei anspruchsvollen Diensten und Apps. Bemessen Sie die VM nach Distribution und Last; 8 GB sind kein allgemeines ZFS-Minimum. Schlanke OMV-, Rockstor- oder ZimaOS-Systeme können weniger benötigen."
+  },
+  "storagePlan": {
+    "heading": "Speicherplan",
+    "intro": "Nach CPU / RAM öffnet ProxMenux das Speicherplanmenü, in dem Sie virtuelle Festplatten, importierte Festplatten und PCI-Durchlaufgeräte im selben VM kombinieren können, indem Sie Elemente einzeln hinzufügen und beenden, wenn Sie fertig sind.",
+    "virtualHeading": "a. Virtuelle Festplatte hinzufügen",
+    "virtualItemsRich": [
+      "Listen Sie die auf dem Host verfügbaren Proxmox-Speichervolumen auf.",
+      "Sie wählen den Zielspeicher und die Größe in GB aus.",
+      "Das Laufwerk nutzt den gewählten Bus: SCSI (Standard), SATA, VirtIO oder IDE (ZimaOS: SCSI oder SATA). SATA hat sechs Anschlüsse von 0 bis 5: <code>sata0</code>, <code>sata1</code>, …."
+    ],
+    "importHeading": "b. Physisches Laufwerk hinzufügen",
+    "importItemsRich": [
+      "Erkennt physische Festplatten, die sicher importiert werden können (System und geschützte Festplatten sind verborgen).",
+      "Sie wählen eine oder mehrere Festplatten über eine Checkliste aus.",
+      "Importierte Laufwerke nutzen den gewählten Bus und werden über <code>qm set</code> zugewiesen."
+    ],
+    "pciHeading": "c. Controller oder NVMe hinzufügen (PCI-Passthrough)",
+    "pciItemsRich": [
+      "Erkennt SATA-/SAS-HBAs und NVMe-Geräte und ermöglicht die Zuweisung eines <em>ganzen Controllers</em> an die VM. IOMMU muss aktiv sein; das Skript bietet die Aktivierung und bei Bedarf einen Neustart an.",
+      "Ein Bestätigungsschritt warnt vor einem kontrollerweiten Risiko (die gesamte Karte, einschließlich jeder Festplatte, verlässt den Host).",
+      "PCI-Geräte werden mit Befehlen wie <code>qm set VMID --hostpci0 PCI_ADDRESS,pcie=1</code> zugewiesen. Ersetzen Sie VMID und PCI_ADDRESS durch VM-ID und PCI-Adresse und verwenden Sie für jedes Gerät einen freien hostpci-Index."
+    ],
+    "resetCalloutTitle": "Zurücksetzen und abschließen",
+    "resetCalloutBodyRich": "Das Menü bietet <strong>r</strong> zum Zurücksetzen und Neubeginnen sowie <strong>d</strong> zum Abschließen und Fortfahren. Ein leerer Plan kann nicht abgeschlossen werden."
+  },
+  "gpu": {
+    "heading": "Optionaler GPU-Durchgang",
+    "bodyRich": "Nach dem Speicherplan bietet ProxMenux bei einer geeigneten GPU den Passthrough-Assistenten an. Siehe <link>GPU zu einer VM hinzufügen (Passthrough)</link>. Ein Host-Neustart kann erforderlich sein."
+  },
+  "autoFeatures": {
+    "heading": "Automatische VM-Funktionen",
+    "efiTitle": "EFI-Laufwerk",
+    "efiBody": "Bei OVMF (UEFI) erstellt ProxMenux automatisch ein 4-MB-EFI-Laufwerk auf dem gewählten Speicher, mit einem zum Speichertyp passenden Format, etwa raw bei Verzeichnisspeicher.",
+    "isoTitle": "ISO-Anschluss",
+    "isoBodyRich": "Die Installations-ISO wird heruntergeladen (falls erforderlich) und als CD-ROM an <code>ide2</code> angehängt, bereit zum ersten Booten.",
+    "guestTitle": "QEMU Gastagent",
+    "guestBody": "Der Gastagentenkanal ist in der VM-Konfiguration aktiviert. Sie müssen den Agenten immer noch im Gast installieren, nachdem das NAS-Betriebssystem aktiviert ist."
+  },
+  "endToEnd": {
+    "heading": "Was das Skript Ende-zu-Ende macht",
+    "itemsRich": [
+      "Erkennt und lädt die neueste stabile ISO herunter (oder verwendet die Fallback-Version, wenn der Upstream nicht erreichbar ist).",
+      "Wendet den standardmäßigen oder erweiterten CPU / RAM / BIOS / Maschinentyp an.",
+      "Öffnet den Speicherplan und verbindet die ausgewählten virtuellen Festplatten, importierten Festplatten und PCI-Geräte.",
+      "Erstellt eine EFI-Disk, wenn UEFI ausgewählt ist.",
+      "Befestigt die Installation ISO auf <code>ide2</code>.",
+      "Legt die Bootreihenfolge fest: zuerst Laufwerk, dann ISO.",
+      "Aktiviert den QEMU Guest Agent Kanal.",
+      "Optional läuft der GPU Passthrough-Assistent.",
+      "Generiert eine stilisierte HTML-Beschreibung, die dem VM beigefügt ist.",
+      "Startet den VM, wenn Sie sich dafür entschieden haben."
+    ]
+  },
+  "perSystem": {
+    "heading": "Systembezogene Anmerkungen",
+    "shellLabel": "Shell-Schnittstelle",
+    "webLabel": "Webschnittstelle"
+  },
+  "systems": {
+    "truenasScale": {
+      "id": "truenas-scale",
+      "title": "TrueNAS SCALE",
+      "icon": "Database",
+      "officialName": "TrueNAS SCALE",
+      "officialUrl": "https://www.truenas.com/truenas-scale/",
+      "description": "Debian-basiertes TrueNAS mit Docker-Apps in aktuellen Versionen, Linux KVM und ZFS als primärem Dateisystem. Ältere SCALE-Versionen nutzten Kubernetes. Es verbindet ZFS-Speicher mit einem Container-Ökosystem.",
+      "specs": [
+        "Empfohlene Schnittstelle: SATA oder SCSI (beide unterstützen Discard/Trim)",
+        "RAM: 8 GB (16 GB+ für echte Workloads empfohlen)",
+        "Mindestens CPU Kerne: 2 (4+ empfohlen)",
+        "UEFI (OVMF) Boot empfohlen",
+        "VirtIO Netzwerkadapter für besten Durchsatz"
+      ],
+      "shellImg": "/vm/truenas/truenas-scale-shell.png",
+      "webImg": "/vm/truenas/truenas-scale-web.png",
+      "shellAlt": "TrueNAS SCALE Shell-Schnittstelle",
+      "webAlt": "TrueNAS SCALE Web-Schnittstelle"
+    },
+    "truenasCore": {
+      "id": "truenas-core",
+      "title": "TrueNAS CORE",
+      "icon": "Database",
+      "officialName": "TrueNAS CORE",
+      "officialUrl": "https://www.truenas.com/truenas-core/",
+      "description": "FreeBSD-basiertes TrueNAS, früher FreeNAS, mit Schwerpunkt ZFS. Jails, Plugins und Virtualisierung in CORE 13.3 sind veraltet und nicht unterstützt; die Entwicklung konzentriert sich auf Linux-basierte Ausgaben.",
+      "specs": [
+        "Empfohlenes Interface: SATA",
+        "RAM: 8 GB (16 GB+ empfohlen)",
+        "Mindestens CPU Kerne: 2 (4+ empfohlen)",
+        "UEFI (OVMF) Boot empfohlen",
+        "VirtIO Netzwerkadapter für besten Durchsatz"
+      ],
+      "shellImg": "/vm/truenas/truenas-core-shell.png",
+      "webImg": "/vm/truenas/truenas-core-web.png",
+      "shellAlt": "TrueNAS CORE Shell-Schnittstelle",
+      "webAlt": "TrueNAS-CORE-Weboberfläche"
+    },
+    "openmediavault": {
+      "id": "openmediavault",
+      "title": "OpenMediaVault",
+      "icon": "Server",
+      "officialName": "openmediavault.org",
+      "officialUrl": "https://www.openmediavault.org",
+      "description": "Debian-basiertes NAS mit modularen Plugins. Ressourcenschonend und gut für bescheidene Hardware geeignet, wenn ZFS nicht benötigt wird.",
+      "specs": [
+        "Empfohlene Schnittstelle: SATA oder VirtIO",
+        "RAM: 2 GB (4 GB+ empfohlen)",
+        "Mindestens CPU Kerne: 1 (2+ empfohlen)",
+        "BIOS: ProxMenux standardmäßig auf SeaBIOS für OMV (bei Bedarf in Advanced überschreiben)",
+        "VirtIO Netzwerkadapter für besten Durchsatz"
+      ],
+      "shellImg": "/vm/openmediavault/openmediavault-shell.png",
+      "webImg": "/vm/openmediavault/openmediavault-web.png",
+      "shellAlt": "OpenMediaVault Shell-Schnittstelle",
+      "webAlt": "OpenMediaVault Web-Schnittstelle"
+    },
+    "xigmanas": {
+      "id": "xigmanas",
+      "title": "XigmaNAS",
+      "icon": "Database",
+      "officialName": "xigmanas.com",
+      "officialUrl": "https://www.xigmanas.com",
+      "description": "FreeBSD-basierte NAS – die direkte Fortsetzung der ursprünglichen FreeNAS-Codebasis (0.7). Konzentriert auf ZFS und Einfachheit, mit einem leichteren Footprint als TrueNAS.",
+      "specs": [
+        "Empfohlene Schnittstelle: SATA oder SCSI",
+        "RAM: 4 GB (8 GB+ empfohlen für ZFS)",
+        "Mindestens CPU Kerne: 2",
+        "UEFI (OVMF) Boot empfohlen",
+        "VirtIO Netzwerkadapter für besten Durchsatz"
+      ]
+    },
+    "rockstor": {
+      "id": "rockstor",
+      "title": "Rockstor",
+      "icon": "HardDrive",
+      "officialName": "rockstor.com",
+      "officialUrl": "https://rockstor.com",
+      "description": "openSUSE Leap-basierte NAS rund um Btrfs. Snapshots, Subvolumes und das Rock-ons App Framework (Docker) für Medien, Filesharing und Backup.",
+      "specs": [
+        "Empfohlene Schnittstelle: SATA oder VirtIO",
+        "RAM: 2 GB (4 GB+ empfohlen)",
+        "Mindestens CPU Kerne: 2",
+        "UEFI (OVMF) Boot empfohlen",
+        "VirtIO Netzwerkadapter für besten Durchsatz"
+      ],
+      "shellImg": "/vm/rockstor/rockstor-shell.png",
+      "webImg": "/vm/rockstor/rockstor-web.png",
+      "shellAlt": "Rockstor Shell-Schnittstelle",
+      "webAlt": "Rockstor Web-Schnittstelle"
+    },
+    "zimaos": {
+      "id": "zimaos",
+      "title": "ZimaOS",
+      "icon": "MonitorIcon",
+      "officialName": "zimaspace.com",
+      "officialUrl": "https://www.zimaspace.com/zimaos",
+      "description": "Schlankes NAS-/Home-Server-System auf Buildroot-Basis, aus CasaOS hervorgegangen, für Medien, Docker-Apps und Hausautomation. Der eigene ProxMenux-Installer (vm/zimaos.sh) lädt ein vorgefertigtes Image und bietet CPU-, RAM- und Speicherkonfiguration.",
+      "specs": [
+        "Empfohlene Schnittstelle: SATA oder VirtIO",
+        "Standard RAM: 4 GB (genug für Medien / selbst gehostete Apps)",
+        "Mindestens CPU Kerne: 2",
+        "UEFI-Start (OVMF)",
+        "VirtIO Netzwerkadapter für besten Durchsatz"
+      ]
+    },
+    "fygoos": {
+      "id": "fygoos",
+      "title": "FygoOS",
+      "icon": "Server",
+      "officialName": "fygonas.com",
+      "officialUrl": "https://fygonas.com",
+      "description": "Internationale Ausgabe des Debian-basierten fnOS. ProxMenux lädt die neueste Installer-ISO von fygonas.com und bindet sie in die VM ein. Das System belegt ein Laufwerk; der übrige Platz kann App- und Dateivolumes aufnehmen. Nach der Installation zeigt die Konsole die Webadresse auf Port 5666 (Port 80 leitet dorthin um). Öffnen Sie sie, um das Gerät zu benennen und das Administratorkonto anzulegen.",
+      "specs": [
+        "Systemdiskette: FygoOS schlägt eine 64 GB Systempartition vor, die in einer VM kleiner sein kann",
+        "Installation: Graphical Install oder Rescuing Install, falls der grafische Modus scheitert",
+        "UEFI (OVMF) booten ohne Secure Boot Keys, wie es der Installer benötigt",
+        "Netzwerk: Ethernet mit DHCP standardmäßig",
+        "VirtIO Netzwerkadapter für besten Durchsatz"
+      ]
+    }
+  },
+  "related": {
+    "heading": "Verwandte Themen",
+    "itemsRich": [
+      {
+        "href": "/docs/create-vm/system-nas",
+        "label": "Übersicht über System NAS",
+        "tail": "Schneller Vergleich aller NAS-Optionen."
+      },
+      {
+        "href": "/docs/create-vm/system-nas/synology",
+        "label": "Synology-VM",
+        "tail": "- für den Synology DSM (Xpenology) Flow."
+      },
+      {
+        "href": "/docs/disk-manager/import-disk-vm",
+        "label": "Datenträger in VM importieren",
+        "tail": "- empfohlen für NAS-Anwendungsfälle (echte Festplatten > virtuelle Festplatten)."
+      },
+      {
+        "href": "/docs/help-info/zfs-commands",
+        "label": "ZFS Verwaltungsbefehle",
+        "tail": "— wenn Sie TrueNAS oder eine andere ZFS-unterstützte Distribution auswählen."
+      },
+      {
+        "href": "/docs/create-vm",
+        "label": "Übersicht zur VM-Erstellung",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/de/docs/create-vm/system-windows.json b/web/messages/de/docs/create-vm/system-windows.json
new file mode 100644
index 00000000..6fed57f7
--- /dev/null
+++ b/web/messages/de/docs/create-vm/system-windows.json
@@ -0,0 +1,259 @@
+{
+  "meta": {
+    "title": "VM erstellen: Windows-System | ProxMenux-Dokumentation",
+    "description": "Erstellen und konfigurieren Sie virtuelle Windows-Maschinen auf Proxmox VE mit ProxMenux. Enthält UUP Dump ISO- und lokale ISO-Pfade, Standard / erweiterte Konfiguration, den einheitlichen Speicherplan, optionalen GPU-Passthrough, TPM 2.0-Setup und VirtIO-Treiberinstallation.",
+    "ogTitle": "VM erstellen: Windows-System | ProxMenux-Dokumentation",
+    "ogDescription": "Erstellen Sie Windows-VMs auf Proxmox VE mit ProxMenux: UUP Dump oder lokale ISO, gemeinsamer Speicherplan, optionales GPU-Passthrough, TPM 2.0 und VirtIO-Treiber.",
+    "ogImageAlt": "ProxMenux Windows VM Menü"
+  },
+  "header": {
+    "title": "VM erstellen: Windows-System",
+    "description": "Erstellen Sie eine Windows-VM auf Proxmox VE. ProxMenux führt durch ISO-Auswahl (UUP Dump oder lokal), CPU, RAM, Maschinentyp, gemeinsamen Speicherplan, optionales GPU-Passthrough, TPM 2.0 und die Installation der VirtIO-Treiber.",
+    "section": "Virtuelle Maschinen"
+  },
+  "intro": {
+    "title": "Was dieses Skript macht",
+    "body": "Der Windows-Ablauf fragt nach der ISO-Quelle: UUP Dump oder eine lokale Kopie unter <code>/var/lib/vz/template/iso</code>. Danach startet der gemeinsame VM-Assistent mit Windows-Vorgaben: <code>q35</code>, OVMF und TPM 2.0. Die VirtIO-Treiber-ISO wird als zweites CD-ROM eingebunden; die VM ist damit bereit für den Windows-Installer."
+  },
+  "image": {
+    "alt": "ProxMenux Windows Installationsoptionen",
+    "caption": "Windows-Installationsoptionen"
+  },
+  "config": {
+    "heading": "Standard- oder erweiterte Konfiguration",
+    "intro": "Nachdem die ISO ausgewählt wurde, fragt ProxMenux, ob das Standardprofil VM verwendet oder der erweiterte Wizard geöffnet werden soll. Das Standardprofil ist auf moderne Windows Desktop- und Server-Editionen abgestimmt.",
+    "defaultHeading": "Standardkonfiguration",
+    "headerParam": "Parameter",
+    "headerValue": "Standardwert",
+    "defaultRows": [
+      {
+        "param": "Maschinentyp",
+        "valueRich": "<code>q35</code>"
+      },
+      {
+        "param": "BIOS",
+        "value": "OVMF (UEFI)"
+      },
+      {
+        "param": "CPU-Typ",
+        "value": "Host"
+      },
+      {
+        "param": "Kerne",
+        "value": "4"
+      },
+      {
+        "param": "RAM",
+        "value": "8192 MB"
+      },
+      {
+        "param": "Brücke",
+        "valueRich": "<code>vmbr0</code>"
+      },
+      {
+        "param": "MAC-Adresse",
+        "value": "Autogeneriert"
+      },
+      {
+        "param": "TPM",
+        "value": "Aktiviert (v2.0)"
+      },
+      {
+        "param": "Nach Abschluss starten",
+        "value": "Nein"
+      }
+    ],
+    "advancedHeading": "Erweiterte Konfiguration",
+    "advancedIntro": "Der erweiterte Assistent zeigt jede Einstellung einzeln:",
+    "headerOptions": "Optionen",
+    "advancedRows": [
+      {
+        "param": "Maschinentyp",
+        "optionsRich": "<code>q35</code> oder <code>i440fx</code>"
+      },
+      {
+        "param": "BIOS",
+        "options": "OVMF (UEFI) oder SeaBIOS (Legacy)"
+      },
+      {
+        "param": "CPU-Typ",
+        "options": "Host, KVM64 und weitere aufgeführte CPU-Modelle"
+      },
+      {
+        "param": "Kerne",
+        "options": "Anzahl CPU-Kerne"
+      },
+      {
+        "param": "RAM",
+        "options": "Der VM zugewiesener Speicher"
+      },
+      {
+        "param": "Brücke",
+        "options": "Netzbrücke"
+      },
+      {
+        "param": "MAC-Adresse",
+        "options": "Eigene MAC-Adresse"
+      },
+      {
+        "param": "VLAN",
+        "options": "VLAN-Tag (fakultativ)"
+      },
+      {
+        "param": "MTU",
+        "options": "MTU-Größe"
+      },
+      {
+        "param": "TPM",
+        "options": "TPM 2.0 wird für Windows automatisch hinzugefügt; der Assistent hat dafür keinen Schalter."
+      }
+    ],
+    "tpmWarnTitle": "TPM-Anforderungen hängen von der Windows-Ausgabe ab",
+    "tpmWarnBody": "Windows 11 benötigt normalerweise TPM 2.0. Windows Server 2022 benötigt es für bestimmte Sicherheitsfunktionen, nicht für jede Installation. ProxMenux fügt für Windows ein virtuelles TPM hinzu; der erweiterte Assistent bietet dafür keinen Schalter."
+  },
+  "storagePlan": {
+    "heading": "Speicherplan",
+    "body": "Nach CPU / RAM öffnet ProxMenux das <strong>Storage Plan</strong>-Menü, in dem Sie virtuelle Festplatten, importierte Festplatten und PCI-Durchgangsgeräte im selben VM kombinieren können, indem Sie Elemente einzeln hinzufügen und beenden, wenn Sie fertig sind.",
+    "virtualDiskTitle": "a. Virtuelle Festplatte hinzufügen",
+    "virtualDiskItems": [
+      "Listet die auf dem Host verfügbaren Proxmox-Speicher auf.",
+      "Sie wählen den Zielspeicher und die Größe in GB aus.",
+      "Das Laufwerk nutzt den gewählten Bus: SCSI (Standard), SATA, VirtIO oder IDE. SATA hat sechs Anschlüsse von 0 bis 5: <code>sata0</code>, <code>sata1</code>, …."
+    ],
+    "importDiskTitle": "b. Physisches Laufwerk hinzufügen",
+    "importDiskItems": [
+      "Erkennt physische Festplatten, die sicher importiert werden können (System und geschützte Festplatten sind verborgen).",
+      "Sie wählen eine oder mehrere Festplatten über eine Checkliste aus.",
+      "Importierte Laufwerke nutzen den gewählten Bus und werden über <code>qm set</code> zugewiesen."
+    ],
+    "pciTitle": "c. Controller oder NVMe hinzufügen (PCI-Passthrough)",
+    "pciItems": [
+      "Erkennt SATA-/SAS-HBAs und NVMe-Geräte und ermöglicht die Zuweisung eines <em>ganzen Controllers</em> an die VM. IOMMU muss aktiv sein; das Skript bietet die Aktivierung und bei Bedarf einen Neustart an.",
+      "Ein Bestätigungsschritt warnt vor einem kontrollerweiten Risiko (die gesamte Karte, einschließlich jeder Festplatte, verlässt den Host).",
+      "PCI-Geräte werden mit Befehlen wie <code>qm set VMID --hostpci0 PCI_ADDRESS,pcie=1</code> zugewiesen. Ersetzen Sie VMID und PCI_ADDRESS durch VM-ID und PCI-Adresse und verwenden Sie für jedes Gerät einen freien hostpci-Index."
+    ],
+    "resetTitle": "Zurücksetzen und abschließen",
+    "resetBody": "Das Menü bietet <strong>r</strong> zum Zurücksetzen und Neubeginnen sowie <strong>d</strong> zum Abschließen und Fortfahren. Ein leerer Plan kann nicht abgeschlossen werden."
+  },
+  "gpu": {
+    "heading": "Optionaler GPU-Durchgang",
+    "body": "Nach dem Speicherplan bietet ProxMenux bei einer geeigneten GPU den Passthrough-Assistenten an. Siehe <gpuLink>GPU zu einer VM hinzufügen (Passthrough)</gpuLink>. Ein Host-Neustart kann erforderlich sein."
+  },
+  "autoFeatures": {
+    "heading": "Automatische VM-Funktionen",
+    "efiTitle": "EFI-Laufwerk",
+    "efiBody": "Wenn OVMF (UEFI) ausgewählt ist, erstellt ProxMenux eine 4 MB EFI-Systemplatte auf dem Speicher, den Sie auswählen, und fügt sie an die VM an, so dass die UEFI-Firmware einen Platz zum Speichern ihrer Variablen hat.",
+    "tpmTitle": "TPM 2.0",
+    "tpmBody": "ProxMenux fügt Windows-VMs ein virtuelles TPM 2.0 hinzu. Es erfüllt die TPM-Anforderung von Windows 11 und ermöglicht TPM-abhängige Funktionen in Windows Server.",
+    "isoTitle": "ISO-Anschluss",
+    "isoBody": "Die Installations-ISO wird an <code>ide2</code> eingebunden. Die VirtIO-Treiber-ISO wird bei Bedarf heruntergeladen und an <code>ide3</code> eingebunden, bereit für <em>Treiber laden</em>.",
+    "guestTitle": "QEMU Gastagent",
+    "guestBody": "Der Gastagentenkanal ist in der VM-Konfiguration aktiviert. Der Agent selbst wird in Windows installiert, indem <code>virtio-win-guest-tools.exe</code> nach der Einrichtung ausgeführt wird."
+  },
+  "installOptions": {
+    "heading": "Windows-Installationsoptionen",
+    "intro": "ProxMenux bietet zwei Methoden, um die Windows-Installationsmedien zu erhalten:",
+    "uupTitle": "UUP-Dump-ISO-Erstellung",
+    "uupLogoAlt": "UUP Dump Logo",
+    "uupBody": "Das <strong>UUP Dump ISO Creator</strong>-Skript ist ein ProxMenux-Dienstprogramm, das eine Windows ISO im laufenden Betrieb von Microsofts Windows Update-Servern erstellt. Es zieht saubere, offizielle Installationsdateien (einschließlich Insider Preview Builds).",
+    "uupItems": [
+      "Zugriff auf die neuesten Windows Builds.",
+      "Unterstützt Insider Preview Versionen.",
+      "Saubere, offizielle Microsoft Installationsdateien.",
+      "Automatische ISO Erstellung und Montage im VM.",
+      "Unterstützt Home, Pro und Enterprise Editionen."
+    ],
+    "uupLearnMore": "Erfahren Sie mehr über UUP Dump ISO Creator",
+    "localTitle": "Installieren mit lokaler ISO",
+    "localBody": "Verwendet eine Windows-ISO, die Sie bereits in den lokalen Speicher des Hosts hochgeladen haben (<code>/var/lib/vz/template/iso</code>). Das Skript listet jede Nicht-VirtIO ISO auf, die es findet, und lässt Sie eine auswählen.",
+    "localImageAlt": "Lokales ISO-Auswahlmenü",
+    "localImageCaption": "Lokales ISO-Auswahlmenü"
+  },
+  "endToEnd": {
+    "heading": "Was das Skript Ende-zu-Ende macht",
+    "items": [
+      "Bezieht die Windows-ISO aus UUP Dump oder einer lokalen Kopie.",
+      "Wendet die Standard- oder erweiterte CPU / RAM / BIOS / Maschinentypkonfiguration an.",
+      "Öffnet den Speicherplan und verbindet die ausgewählten virtuellen Festplatten, importierten Festplatten und PCI-Geräte.",
+      "Erstellt bei UEFI-Installationen das EFI-Laufwerk und weist das TPM-2.0-Gerät zu.",
+      "Befestigt die Windows ISO auf <code>ide2</code>.",
+      "Lädt die VirtIO-Treiber-ISO herunter und bindet sie an <code>ide3</code> ein.",
+      "Legt die Bootreihenfolge fest: zuerst Laufwerk, dann ISO.",
+      "Aktiviert den QEMU Guest Agent Kanal.",
+      "Optional läuft der GPU Passthrough-Assistent.",
+      "Generiert eine stilisierte HTML-Beschreibung, die dem VM beigefügt ist.",
+      "Startet die VM, wenn Sie dies gewählt haben."
+    ]
+  },
+  "virtio": {
+    "heading": "VirtIO Treiber während der Installation",
+    "body": "Der VM-Ersteller nutzt standardmäßig SCSI-Laufwerke mit VirtIO-SCSI-Controller und einen VirtIO-Netzwerkadapter. Eine normale Windows-ISO kann deren Treiber von der an <code>ide3</code> eingebundenen VirtIO-ISO benötigen. SATA-Laufwerke funktionieren meist mit Windows-eigenen Treibern; SATA ändert den VirtIO-Netzwerkadapter nicht.",
+    "warnTitle": "VirtIO-Netzwerktreiber laden, wenn Windows kein Netzwerk hat",
+    "warnBody": "Die VM nutzt einen VirtIO-Netzwerkadapter (<code>virtio</code>). Enthält Windows dessen Treiber nicht, laden Sie ihn während der Installation für den Netzwerkzugriff. Sonst können Aktivierung und Windows Update beim ersten Start fehlen.",
+    "stepLabel": "Schritt",
+    "steps": [
+      {
+        "title": "Zugriff auf den Bildschirm \"Wo möchten Sie Windows installieren?\"",
+        "body": "Wenn während der Windows-Einrichtung keine Festplatten angezeigt werden, ist der Speichertreiber für Ihre ausgewählte Schnittstelle (SCSI oder VirtIO) noch nicht geladen. Laden Sie es manuell von der montierten VirtIO ISO.",
+        "img": "/vm/windows/virtio-step-1.png",
+        "caption": "Windows-Setup ohne Festplatten angezeigt"
+      },
+      {
+        "title": "Klicken Sie auf „Treiber laden“",
+        "bodyRich": "Klicken Sie auf <strong>Treiber laden</strong>, durchsuchen Sie die eingebundene VirtIO-ISO und wählen Sie den Speichertreiber für die gewählte Laufwerksschnittstelle.",
+        "img": "/vm/windows/virtio-step-2.png",
+        "caption": "Klicken Sie auf Load Driver, um den VirtIO ISO zu durchsuchen"
+      },
+      {
+        "title": "Durchsuchen des richtigen Treiberordners",
+        "bodyRich": "Wählen Sie auf der VirtIO-ISO <code>vioscsi</code> für den VirtIO-SCSI-Controller oder <code>viostor</code> für VirtIO-Blockgeräte. Wählen Sie danach den Unterordner für Windows-Version und Architektur.",
+        "img": "/vm/windows/virtio-step-3.png",
+        "caption": "Durchsuchen des entsprechenden Treiberordners"
+      },
+      {
+        "title": "Wählen Sie den Treiber",
+        "bodyRich": "Windows listet die verfügbaren Treiber auf. Wählen Sie diejenige, die zu Ihrem Setup passt (normalerweise <strong>Red Hat VirtIO SCSI-Controller</strong>) und klicken Sie auf <strong>Next</strong>.",
+        "img": "/vm/windows/virtio-step-4.png",
+        "caption": "Wählen Sie den VirtIO-Treiber aus, der zu Ihrer Festplattenschnittstelle passt"
+      },
+      {
+        "title": "(Optional) Installieren Sie den Netzwerktreiber",
+        "bodyRich": "Wenn Sie auch VirtIO als Netzwerkschnittstelle ausgewählt haben, laden Sie den Netzwerktreiber aus dem <code>NetKVM</code>-Ordner derselben ISO und wählen Sie den Unterordner für Ihre Windows-Version aus. Ohne diesen Schritt installiert Windows ohne Internetzugang.",
+        "img": "/vm/windows/virtio-step-5.png",
+        "caption": "Laden Sie den VirtIO-Netzwerktreiber, um das Internet während der Installation zu aktivieren"
+      }
+    ],
+    "tipTitle": "Nach der Installation: virtio-win-guest-tools.exe ausführen",
+    "tipBody": "Öffnen Sie nach der Windows-Installation die VirtIO-ISO im Datei-Explorer und starten Sie <code>virtio-win-guest-tools.exe</code>. Es installiert die übrigen Treiber für Netzwerk, Anzeige, Eingabe und Ballooning sowie den QEMU Guest Agent in einem Durchgang."
+  },
+  "related": {
+    "heading": "Verwandte Themen",
+    "items": [
+      {
+        "href": "/docs/utils/UUp-Dump-ISO-Creator",
+        "label": "UUP-Dump-ISO-Erstellung",
+        "tail": " — aktuelle Windows-Installations-ISOs auf dem Proxmox-Host erstellen."
+      },
+      {
+        "href": "/docs/disk-manager/import-disk-image-vm",
+        "label": "Disk-Image in VM importieren",
+        "tail": " — ein vorhandenes Windows-Disk-Image (.vmdk, .qcow2, .img oder .raw) in eine bestehende VM importieren; .vhdx vorher in ein unterstütztes Format konvertieren."
+      },
+      {
+        "href": "/docs/hardware/gpu-vm-passthrough",
+        "label": "GPU zu VM hinzufügen (Passthrough)",
+        "tail": "- für Windows VMs mit hardwarebeschleunigtem GPU."
+      },
+      {
+        "href": "/docs/help-info/vm-ct-commands",
+        "label": "VM und CT Verwaltungsbefehle",
+        "tail": "— qm CLI Referenz."
+      },
+      {
+        "href": "/docs/create-vm",
+        "label": "Übersicht zur VM-Erstellung",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/de/docs/disk-manager/add-controller-nvme-vm.json b/web/messages/de/docs/disk-manager/add-controller-nvme-vm.json
new file mode 100644
index 00000000..5a9deee2
--- /dev/null
+++ b/web/messages/de/docs/disk-manager/add-controller-nvme-vm.json
@@ -0,0 +1,128 @@
+{
+  "meta": {
+    "title": "Hinzufügen von Controller oder NVMe zu VM | ProxMenux Dokumentation",
+    "description": "PCI-Passthrough eines Speichercontrollers (SATA-/SAS-HBA) oder NVMe-Geräts an eine Proxmox-VM mit ProxMenux. Das Werkzeug aktiviert IOMMU, erkennt Konflikte und richtet die Zuweisung mit qm set --hostpci ein.",
+    "ogTitle": "Hinzufügen von Controller oder NVMe zu VM | ProxMenux Dokumentation",
+    "ogDescription": "Weisen Sie einer Proxmox-VM einen vollständigen SATA-/SAS-HBA oder ein NVMe-Gerät zu. ProxMenux übernimmt IOMMU, Konflikterkennung und die hostpci-Zuweisung."
+  },
+  "header": {
+    "title": "Controller oder NVMe zu VM hinzufügen",
+    "description": "Weisen Sie einer Proxmox-VM einen vollständigen SATA-/SAS-Host-Bus-Adapter (HBA) oder ein NVMe-Gerät per PCI-Passthrough zu. ProxMenux prüft IOMMU und aktiviert es mit Ihrer Zustimmung, ermittelt geeignete Geräte, schließt Konflikte aus und trägt die Zuweisung mit qm set --hostpci ein.",
+    "section": "Datenträgerverwaltung · VM"
+  },
+  "intro": {
+    "title": "Was dies tut (und nicht tut)",
+    "body": "Dies ist <strong>Passthrough auf Geräteebene</strong>: Die PCIe-Karte wird der Kontrolle des Host-Kernels entzogen und an <code>vfio-pci</code> gebunden. Die VM sieht den Controller selbst statt einzeln durchgereichter Laufwerke und lädt ihren eigenen Treiber für dieses Modell. Alle am Controller angeschlossenen Laufwerke folgen automatisch, mit nativen SMART-Daten, vollständigen Firmware-Funktionen und ohne Proxmox-Zwischenschicht."
+  },
+  "howRuns": {
+    "heading": "Wie das Skript läuft",
+    "body": "Der Fluss hat zwei Phasen mit klarer Trennung zwischen \"Sammeln von Informationen, Überprüfen von IOMMU und Auflisten von Kandidaten\" und \"Tatsächliches Anbringen des PCI-Geräts\". Bis zur endgültigen Bestätigung wird nichts an die VM-Konfiguration geschrieben."
+  },
+  "iommu": {
+    "heading": "IOMMU-Gruppen - warum die gesamte Karte auf einmal geht",
+    "body": "Die Isolationsgrenze für PCI-Passthrough ist die <strong>IOMMU-Gruppe</strong>, die kleinste von der IOMMU der CPU isolierbare Einheit. Geräte derselben Gruppe lassen sich nicht voneinander isolieren. Teilt ein SATA-Controller die Gruppe mit einem USB-Controller, muss für SATA-Passthrough möglicherweise auch USB vom Host gelöst werden, oder Passthrough ist nicht möglich. Dabei werden nicht automatisch alle Geräte der Gruppe der VM zugewiesen.",
+    "outro": "ProxMenux zeigt die IOMMU-Gruppe neben jedem Gerät und warnt Sie, wenn eine Gruppe mehr als nur den gewünschten Controller trägt. Sie können weiterhin fortfahren, wenn die zusätzlichen Geräte in der Gruppe akzeptabel sind (z. B. alle Festplattencontroller) oder zurückgehen, wenn dies nicht der Fall ist."
+  },
+  "prereqs": {
+    "heading": "Voraussetzungen",
+    "items": [
+      "<strong>CPU und Mainboard unterstützen</strong> VT-d (Intel) oder AMD-Vi, und die Funktion ist in der Firmware (BIOS/UEFI) aktiviert. ProxMenux kann die Kernelkonfiguration aktivieren, aber keine Firmware-Einstellung umschalten.",
+      "Die Ziel-VM ist vor dem Anschließen von PCI-Geräten <strong>ausgeschaltet</strong>.",
+      "Der Controller/NVMe <strong> ist nicht derjenige, der das Proxmox Root-Dateisystem</strong> hält. Das Skript verbirgt alles, was vom Host verwendet wird.",
+      "Das Gastbetriebssystem hat Treiber für das Controllermodell. Linux unterstützt nahezu jeden HBA ab Werk; unter Windows muss der Herstellertreiber <em>vor</em> dem Start mit angeschlossenem Controller installiert sein."
+    ],
+    "warnTitle": "Live Migration ist nicht möglich",
+    "warnBody": "Ein VM mit PCI-Durchgang ist an den Knoten gebunden, der die Karte physisch hält. Live-Migration über Knoten wird fehlschlagen. Planen Sie Backups / Replikation entsprechend."
+  },
+  "steps": {
+    "heading": "Schritt für Schritt",
+    "stepLabel": "Schritt",
+    "list": [
+      {
+        "title": "Ziel-VM auswählen",
+        "bodyRich": "ProxMenux liest <code>qm list</code> und zeigt alle VMs an. Wählen Sie die VM, die den Controller erhalten soll.",
+        "img": "/disk/nvme-passthrough/vm-selection.png",
+        "alt": "VM Auswahldialog",
+        "caption": "VM Auswahldialog"
+      },
+      {
+        "title": "IOMMU-Prüfung",
+        "bodyRich": "Wenn IOMMU auf der Kernel-Cmdline nicht aktiviert ist, bietet ProxMenux an, sie zu aktivieren. Es bearbeitet <code>/etc/kernel/cmdline</code> (für systemd-Boot) oder <code>/etc/default/grub</code> (für GRUB) und fügt den richtigen Parameter für Ihren CPU hinzu:",
+        "items": [
+          "<code>intel_iommu=on</code> für Intel CPUs.",
+          "<code>amd_iommu=on</code> für AMD CPUs."
+        ],
+        "outro": "Nach dieser Änderung ist ein Neustart erforderlich. Das Skript bietet einen Neustart jetzt oder später an; Passthrough kann erst fortgesetzt werden, wenn die neue Kernel-Kommandozeile aktiv ist.",
+        "img": "/disk/nvme-passthrough/iommu-warning.png",
+        "alt": "Dialog „IOMMU erforderlich“",
+        "caption": "IOMMU Erforderlich — Angebot zum Aktivieren und Neustarten"
+      },
+      {
+        "title": "Geräteaufzählung",
+        "body": "ProxMenux listet jeden Speichercontroller (SATA / SAS HBA) und jedes NVMe-Gerät auf dem PCI-Bus auf. Für jedes Gerät zeigt es:",
+        "items": [
+          "PCI-Adresse (<code>00:17.0</code>, <code>01:00.0</code>, ...).",
+          "Hersteller- und Gerätebeschreibung.",
+          "IOMMU-Gruppe - und eine ⚠ Warnung, wenn die Gruppe mit anderen, nicht verwandten Geräten geteilt wird.",
+          "Die aktuell am Controller angeschlossenen Laufwerke, damit Sie wissen, welche zur VM wechseln."
+        ],
+        "img": "/disk/nvme-passthrough/device-list.png",
+        "alt": "Controller / NVMe Geräteaufzählung",
+        "caption": "Controller / NVMe Geräteaufzählung mit IOMMU Gruppeninfo"
+      },
+      {
+        "title": "Konflikterkennung",
+        "bodyRich": "Das Skript sperrt eindeutig unsichere Geräte: bereits einer anderen VM über <code>hostpci</code> zugewiesene Geräte, vom Host verwendete Geräte wie den Root-Laufwerkscontroller sowie Geräte in IOMMU-Gruppen, deren andere Mitglieder nicht sicher erkannt werden können. Geeignete Geräte stehen zur Auswahl.",
+        "img": "/disk/nvme-passthrough/conflict-warning.png",
+        "alt": "Konflikterkennungswarnung",
+        "caption": "Konflikterkennung: Gerät mit Angabe des Grundes gesperrt"
+      },
+      {
+        "title": "Zuweisen und abschließen",
+        "bodyRich": "Für jedes gewählte Gerät führt ProxMenux <code>qm set &lt;VMID&gt; --hostpciN &lt;pci-addr&gt;,pcie=1</code> aus und verwendet den nächsten freien <code>hostpci</code>-Slot. Wurde IOMMU in dieser Sitzung aktiviert, wird vor dem Start der VM an den erforderlichen Neustart erinnert.",
+        "img": "/disk/nvme-passthrough/assignment.png",
+        "alt": "Zusammenfassung der Zuweisung",
+        "caption": "Zusammenfassung der Zuweisung: belegte hostpciN-Slots und zugewiesene PCI-Adressen"
+      }
+    ]
+  },
+  "manual": {
+    "heading": "Manuelles Äquivalent"
+  },
+  "troubleshoot": {
+    "heading": "Fehlerbehebung",
+    "noGroupsTitle": "IOMMU aktiviert, aber keine Gruppen unter /sys/kernel/iommu_groups/",
+    "noGroupsBody": "Ein Neustart ist erforderlich, damit die Kernel-Cmdline wirksam wird. Wenn die Gruppen nach dem Neustart immer noch fehlen, ist VT-d / AMD-Vi wahrscheinlich in der Firmware deaktiviert - überprüfen Sie das BIOS / UEFI-Setup.",
+    "busyTitle": "VM startet nicht: \"hostpciN: device busy\"",
+    "busyBody": "Ein anderer Prozess hält das PCI-Gerät noch belegt. Häufige Ursachen sind eine abgestürzte VM, die es nicht freigegeben hat, oder der Host-Kernel, der es beim letzten Start wieder übernommen hat. Prüfen Sie mit <code>lspci -nnk -s &lt;addr&gt;</code> den gebundenen Treiber; es sollte <code>vfio-pci</code> sein. Ein vollständiger Neustart des Hosts behebt dies meist.",
+    "noDisksTitle": "Gast sieht den Controller, aber nicht die Festplatten",
+    "noDisksBody": "Im Gast fehlt der Treiber für das Controllermodell. Unter Linux tritt dies selten auf, unter Windows hingegen schon. Installieren Sie den Herstellertreiber, etwa von LSI/Broadcom für ältere SAS-HBAs, solange die Karte nicht zugewiesen ist, und starten Sie dann mit zugewiesener Karte neu.",
+    "sharedTitle": "Die IOMMU-Gruppe enthält ein nicht zugehöriges Gerät",
+    "sharedBody": "Möglichkeiten: (a) die Karte in einen anderen PCIe-Slot setzen, um ihre Gruppe zu ändern, (b) <em>ACS override</em> im Kernel aktivieren, um Gruppen aufzuteilen (Sicherheitskompromiss, vor der Anwendung recherchieren), oder (c) eine andere Karte in einer besser isolierten Gruppe wählen."
+  },
+  "related": {
+    "heading": "Verwandte Themen",
+    "items": [
+      {
+        "href": "/docs/disk-manager/import-disk-vm",
+        "label": "Datenträger in VM importieren",
+        "tail": "Alternatives Modell: Befestigen Sie eine physische Festplatte über Proxmox ohne vollständigen PCIe-Durchgang."
+      },
+      {
+        "href": "/docs/hardware/gpu-vm-passthrough",
+        "label": "GPU zu VM hinzufügen (Passthrough)",
+        "tail": "- gleiche IOMMU / VFIO-Konzepte, die auf einen GPU angewendet wurden."
+      },
+      {
+        "href": "/docs/help-info/gpu-commands",
+        "label": "GPU Durchgangsbefehle",
+        "tail": "IOMMU-Verifizierungsbefehle gelten auch für den Controller / NVMe-Durchgang."
+      },
+      {
+        "href": "/docs/disk-manager",
+        "label": "Übersicht Disk Manager",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/de/docs/disk-manager/format-disk.json b/web/messages/de/docs/disk-manager/format-disk.json
new file mode 100644
index 00000000..24c14381
--- /dev/null
+++ b/web/messages/de/docs/disk-manager/format-disk.json
@@ -0,0 +1,142 @@
+{
+  "meta": {
+    "title": "Physischen Datenträger formatieren oder löschen | ProxMenux-Dokumentation",
+    "description": "Physische Datenträger auf Proxmox VE mit ProxMenux löschen und formatieren. Vier Betriebsarten, strenge Sicherheitsfilter gegen Systemlaufwerke, eingehängte oder verwendete Laufwerke und doppelte Bestätigung mit Eingabe des vollständigen Pfads.",
+    "ogTitle": "Physischen Datenträger formatieren oder löschen | ProxMenux-Dokumentation",
+    "ogDescription": "Physische Datenträger auf Proxmox löschen oder formatieren. Sicherheitsfilter, vier Betriebsarten und doppelte Bestätigung."
+  },
+  "header": {
+    "title": "Physischen Datenträger formatieren / löschen",
+    "description": "Wischen oder formatieren Sie sicher eine physische Festplatte auf dem Proxmox-Host. ProxMenux zeigt nur Festplatten an, die völlig frei sind (keine Systemnutzung, keine Gastreferenz, keine Mounts) und erzwingt eine doppelte Bestätigung - ja / nein plus Eingabe des vollständigen Festplattenpfads -, bevor Daten zerstört werden.",
+    "section": "Disk Manager · Dienstprogramme"
+  },
+  "danger": {
+    "title": "Zerstörendes Werkzeug",
+    "body": "Jede Operation hier schreibt auf die Festplatte. Es gibt kein Rückgängigmachen. ProxMenux wendet strenge Sicherheitsfilter und Bestätigungen an, aber die Verantwortung für die Auswahl der richtigen Festplatte liegt bei Ihnen. Lesen Sie den Festplattenpfad zweimal laut aus, bevor Sie ihn eingeben."
+  },
+  "howRuns": {
+    "heading": "Wie das Skript läuft",
+    "body": "Der Ablauf hat zwei Phasen mit einer dreifachen Sicherheitsprüfung dazwischen. In Phase 1 werden Laufwerksauswahl, Betriebsart und Dateisystemdetails erfasst. Geschrieben wird erst, wenn Phase 2 unmittelbar vor der Ausführung eine abschließende erneute Prüfung bestanden hat."
+  },
+  "visibility": {
+    "heading": "Sichtbarkeitsregeln",
+    "intro": "Bevor das Menü überhaupt erscheint, filtert ProxMenux die Festplattenliste. Es werden nur Kandidaten gezeigt, die nachweislich sicher sind:",
+    "items": [
+      "<strong>Angezeigt</strong> werden Laufwerke, die <em>nicht</em> vom Host genutzt werden (Root-Pool, Swap, eingehängte Dateisysteme, aktives ZFS/LVM/RAID) und <em>nicht</em> in einer VM-/LXC-Konfiguration referenziert sind, unabhängig vom Betriebszustand des Gasts.",
+      "<strong>Ausgeblendet</strong>: Host- und Systemlaufwerke.",
+      "<strong>Ausgeblendet</strong>: in VM-/LXC-Konfigurationen referenzierte Laufwerke."
+    ],
+    "safetyTitle": "Sicherheit bei Bestätigung und Ausführung",
+    "safetyItems": [
+      "Bei Laufwerken mit veralteten oder aktiven Metadaten erscheinen detaillierte Warnungen <em>vor</em> der Bestätigung.",
+      "Von einer <strong>laufenden</strong> VM genutzte Laufwerke werden bei der Bestätigung <strong>vollständig gesperrt</strong>.",
+      "Laufwerke mit eingehängten Partitionen werden bei der Ausführung <strong>vollständig gesperrt</strong>. Unmittelbar vor dem Schreiben erfolgt eine neue Prüfung.",
+      "Zwei Bestätigungen sind immer erforderlich: ein <em>Ja/Nein</em>-Dialog und die exakte Eingabe des vollständigen Laufwerkspfads."
+    ]
+  },
+  "modes": {
+    "heading": "Betriebsarten",
+    "intro": "Nachdem Sie eine Festplatte ausgewählt haben, wählen Sie einen von vier Modi. Sie unterscheiden sich darin, was sie zerstören und was sie zurücklassen.",
+    "headerMode": "Modus",
+    "headerPart": "Partitionstabelle",
+    "headerData": "Daten",
+    "headerUseCase": "Anwendungsfall",
+    "rows": [
+      {
+        "mode": "1. Alles löschen",
+        "part": "Zerstört",
+        "data": "Signaturen gelöscht",
+        "useCase": "Entfernt die Partitionstabelle sowie Dateisystem- und RAID-Metadaten, überschreibt die ersten und letzten 16 MiB mit Nullen und führt bei Laufwerken mit Discard-Unterstützung ein TRIM über den gesamten Datenträger aus. Die übrigen Daten werden nicht überschrieben und können auf HDDs noch wiederherstellbar sein; dies ist kein sicheres Löschen."
+      },
+      {
+        "mode": "2. FS-Etiketten entfernen",
+        "part": "Erhalten",
+        "data": "Erhalten",
+        "useCase": "Entfernt alte ZFS-/LVM-/RAID-Signaturen, damit das Laufwerk nicht mehr automatisch eingebunden wird. Nutzdaten werden nicht flächig überschrieben, können durch das Entfernen der Signaturen aber unzugänglich werden."
+      },
+      {
+        "mode": "3. Daten mit Nullen überschreiben",
+        "part": "Erhalten",
+        "data": "Zerstört (mit Nullen überschrieben)",
+        "useCase": "Bestehende Partitionen mit Nullen überschreiben und die Partitionstabelle erhalten. Nicht zugewiesener Speicher und SSD-Reservebereiche sind nicht erfasst; dies garantiert keine vollständige Gerätesanitisierung."
+      },
+      {
+        "mode": "4. Vollformat",
+        "part": "Neue GPT",
+        "data": "Zerstört",
+        "useCase": "Einsatzbereites Laufwerk mit einer neuen Partition und einem neuen Dateisystem."
+      }
+    ],
+    "fullFormatOutro": "<strong>Vollständiges Formatieren</strong> führt zu zwei weiteren Dialogen:",
+    "fullFormatItems": [
+      "<strong>Dateisystem</strong>: <code>ext4</code>, <code>xfs</code>, <code>exfat</code> (portabel) oder <code>btrfs</code>. Fehlen Werkzeuge wie <code>mkfs.btrfs</code>, wird mit einer klaren Meldung abgebrochen.",
+      "<strong>Label</strong> — optionales Dateisystem-Etikett zur Identifizierung."
+    ]
+  },
+  "steps": {
+    "heading": "Schritt für Schritt",
+    "stepLabel": "Schritt",
+    "list": [
+      {
+        "title": "Freies Laufwerk wählen",
+        "body": "ProxMenux listet jede Festplatte auf, die die oben genannten Sichtbarkeitsfilter passiert. Festplatten mit ⚠-Markern tragen veraltete Metadaten und werden mit den Details angezeigt, damit Sie wissen, was Sie überschreiben möchten."
+      },
+      {
+        "title": "Wählen Sie einen Betriebsmodus",
+        "bodyRich": "Wählen Sie gemäß obiger Tabelle <strong>Alles löschen</strong>, <strong>FS-Etiketten entfernen</strong>, <strong>Daten mit Nullen überschreiben</strong> oder <strong>Vollständiges Formatieren</strong>."
+      },
+      {
+        "title": "(Nur Vollformat) Dateisystem und Label auswählen",
+        "body": "ext4 / xfs / exfat / btrfs, plus ein optionales Etikett."
+      },
+      {
+        "title": "Zweimal bestätigen",
+        "bodyRich": "ProxMenux zeigt eine Zusammenfassung der geplanten Aktion. Sie bestätigen im Ja/Nein-Dialog und <strong>geben den vollständigen Laufwerkspfad</strong> exakt wie angezeigt ein, etwa <code>/dev/sdc</code>. Jede andere Eingabe bricht ab."
+      },
+      {
+        "title": "Revalidierung und Ausführung",
+        "body": "Kurz vor dem Schreiben überprüft das Skript den Festplattenzustand erneut. Wurde zwischenzeitlich eine Partition gemountet oder ein VM gestartet, wird die Ausführung abgebrochen. Ansonsten läuft die gewählte Operation und eine Zusammenfassung wird am Ende gedruckt."
+      }
+    ]
+  },
+  "manual": {
+    "heading": "Manuelle Äquivalente",
+    "body": "Wenn Sie es vorziehen, die entsprechenden Befehle von Hand auszuführen:"
+  },
+  "troubleshoot": {
+    "notListedTitle": "Disk nicht im Menü aufgeführt",
+    "notListedBody": "Das Laufwerk wurde aus Sicherheitsgründen ausgeblendet. Häufige Gründe: Es ist eingehängt, auch unter <code>/mnt/tmp</code>, aktives Mitglied von ZFS/LVM/RAID, in einer VM-/LXC-Konfiguration referenziert oder das Proxmox-Root-Laufwerk. Prüfen Sie auf dem Host <code>lsblk -f</code> und <code>cat /proc/mdstat</code>, um den Grund zu ermitteln.",
+    "busyTitle": "\"Disk may be busy\" / Unmount fehlgeschlagen",
+    "busyBody": "Etwas hält immer noch eine offene Datei auf einer Partition dieser Festplatte - meistens ein Container oder eine Shell, deren cwd sich in einem Mountpoint befindet. Identifizieren Sie es mit <code>lsof | grep /dev/sdX</code> oder <code>fuser -vm /dev/sdX1</code>, stoppen Sie es und führen Sie das Tool erneut aus."
+  },
+  "related": {
+    "heading": "Verwandte Themen",
+    "items": [
+      {
+        "href": "/docs/disk-manager/smart-disk-test",
+        "label": "SMART-Festplattenstatus und -test",
+        "tail": "Überprüfen Sie eine Festplatte vor / nach dem Wischen, um zu bestätigen, dass sie gesund ist."
+      },
+      {
+        "href": "/docs/disk-manager/import-disk-vm",
+        "label": "Datenträger in VM importieren",
+        "tail": "Übergeben Sie eine frisch formatierte Festplatte an eine VM."
+      },
+      {
+        "href": "/docs/storage-share/host-local-disk",
+        "label": "Lokale Festplatte als Proxmox-Speicher hinzufügen",
+        "tail": "Registrieren Sie eine gelöschte Festplatte als Proxmox-Speicherpool."
+      },
+      {
+        "href": "/docs/help-info/storage-commands",
+        "label": "Speicher- und Festplattenbefehle",
+        "tail": " — Referenz für lsblk, blkid und parted."
+      },
+      {
+        "href": "/docs/disk-manager",
+        "label": "Übersicht Disk Manager",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/de/docs/disk-manager/import-disk-image-vm.json b/web/messages/de/docs/disk-manager/import-disk-image-vm.json
new file mode 100644
index 00000000..a1d2cb83
--- /dev/null
+++ b/web/messages/de/docs/disk-manager/import-disk-image-vm.json
@@ -0,0 +1,110 @@
+{
+  "meta": {
+    "title": "Datenträgerbild in VM importieren | ProxMenux Dokumentation",
+    "description": "Importieren Sie eine Disk-Image-Datei (.img / .qcow2 / .vmdk / .raw) mit ProxMenux in ein vorhandenes Proxmox VM. Per-Image-Schnittstelle, SSD-Emulation und bootfähiges Flag, mit qm importdisk unter der Haube.",
+    "ogTitle": "Datenträgerbild in VM importieren | ProxMenux Dokumentation",
+    "ogDescription": "Importieren Sie .img / .qcow2 / .vmdk / .raw Disk-Images in einen vorhandenen VM mit ProxMenux. Verwendet qm importdisk unter der Haube."
+  },
+  "header": {
+    "title": "Disk-Image in VM importieren",
+    "description": "Importieren Sie eine Disk-Image-Datei (.img, .qcow2, .vmdk oder .raw) in eine vorhandene Proxmox VM. ProxMenux sammelt jede Entscheidung im Voraus - Ziel VM, Proxmox-Speicher, Quellverzeichnis, Schnittstelle, SSD-Emulation, Boot-Order - und führt dann qm importdisk für jedes ausgewählte Image aus.",
+    "section": "Datenträgerverwaltung · VM"
+  },
+  "intro": {
+    "title": "Was das macht",
+    "body": "Anders als <em>Datenträger in VM importieren</em>, das ein physisches Laufwerk direkt zuweist, verwendet dieser Ablauf eine <strong>Datei</strong> auf dem Host, etwa einen Export eines anderen Hypervisors, ein heruntergeladenes Cloud-Image oder ein aus einer Sicherung extrahiertes Image. Sie wird in ein Proxmox-VM-Laufwerk auf dem gewählten Speicher umgewandelt. Die Originaldatei bleibt erhalten: ProxMenux kopiert sie, statt sie zu verschieben."
+  },
+  "howRuns": {
+    "heading": "Wie das Skript läuft",
+    "body": "Der Ablauf hat zwei Phasen. Phase 1 erfasst über Dialoge vorab alle Entscheidungen: VM, Speicher, Quellverzeichnis, Images und Optionen je Image. Phase 2 führt <code>qm importdisk</code> für jedes ausgewählte Image aus. Vor Beginn von Phase 2 wird weder etwas kopiert noch die VM-Konfiguration verändert."
+  },
+  "prereqs": {
+    "heading": "Voraussetzungen",
+    "items": [
+      "Mindestens eine VM ist auf dem Host definiert. Die Ziel-VM sollte <strong>ausgeschaltet</strong> sein.",
+      "Mindestens eine Disk-Image-Datei in einem unterstützten Format liegt im Quellverzeichnis. Unterstützt werden <code>.img</code>, <code>.qcow2</code>, <code>.vmdk</code> und <code>.raw</code>.",
+      "Genug freien Speicherplatz auf dem Ziel-Proxmox-Speicher, um jede importierte Festplatte zu halten.",
+      "ProxMenux sucht standardmäßig nach Images in <code>/var/lib/vz/template/iso</code>. Sie können es auf jedes andere Verzeichnis auf dem Host verweisen, wenn es gefragt wird."
+    ]
+  },
+  "steps": {
+    "heading": "Schritt für Schritt",
+    "stepLabel": "Schritt",
+    "list": [
+      {
+        "title": "Ziel-VM auswählen",
+        "bodyRich": "ProxMenux liest <code>qm list</code> und zeigt jeden VM an. Wählen Sie diejenige aus, die die importierten Festplatten erhält."
+      },
+      {
+        "title": "Wählen Sie den Proxmox-Speicher",
+        "bodyRich": "Die Liste enthält jeden Speicher, für den der Inhaltstyp <code>images</code> aktiviert ist. Wenn es nur einen Kandidaten gibt, wird er automatisch ausgewählt und der Dialog wird übersprungen."
+      },
+      {
+        "title": "Wählen Sie das Quellverzeichnis",
+        "bodyRich": "Wählen Sie das Standardverzeichnis (<code>/var/lib/vz/template/iso</code>) oder geben Sie einen benutzerdefinierten Pfad ein - in der Regel, wo Sie das Image heruntergeladen / hochgeladen haben. Das Skript lehnt Pfade ab, die nicht existieren."
+      },
+      {
+        "title": "Wählen Sie ein oder mehrere Images",
+        "bodyRich": "Das Verzeichnis wird nach <code>.img</code> / <code>.qcow2</code> / <code>.vmdk</code> / <code>.raw</code> Dateien gescannt. Sie können mehrere gleichzeitig auswählen; jede wird im nächsten Schritt die Per-Bild-Optionen durchlaufen."
+      },
+      {
+        "title": "Per-Image Optionen",
+        "intro": "Für jedes ausgewählte Image fragt ProxMenux:",
+        "items": [
+          "<strong>Interface</strong> — <code>scsi</code> (Standard), <code>virtio</code>, <code>sata</code> oder <code>ide</code>. Passt dazu, wie der Gast die Festplatte sehen wird.",
+          "<strong>SSD-Emulation</strong>: nur für Nicht-VirtIO-Schnittstellen verfügbar. Fügt <code>ssd=1</code> hinzu, damit der Gast das Laufwerk als SSD erkennt. Discard/TRIM muss separat konfiguriert werden.",
+          "<strong>Bootfähig</strong>: Bei Ja nimmt ProxMenux das Laufwerk als primäres Startgerät in die Bootreihenfolge der VM auf."
+        ]
+      },
+      {
+        "title": "Importieren und zuweisen",
+        "bodyRich": "ProxMenux führt <code>qm importdisk</code> für jedes Image aus (Konvertierung des Formats im laufenden Betrieb, wo dies erforderlich ist), fügt die resultierende Festplatte mit den von Ihnen gewählten Optionen an den nächsten freien Slot (<code>scsiN</code>, <code>sataN</code>, ...) an und aktualisiert - wenn Sie eine Festplatte als bootfähig markiert haben - die Boot-Order. Fortschritt zeigt sich im Terminal."
+      }
+    ]
+  },
+  "manual": {
+    "heading": "Manuelles Äquivalent",
+    "body": "Ein einzelnes Image lässt sich mit drei <code>qm</code>-Befehlen importieren:",
+    "warnTitle": "Konvertierung des Disk-Image-Formats",
+    "warnBody": "Wenn der Zielspeicher das Quellformat nativ nicht halten kann (z. B. LVM-Speicher <code>.qcow2</code>), konvertiert <code>qm importdisk</code> das Image transparent. Dies kann mehrere Minuten für Multi-GB-Bilder dauern; planen Sie entsprechend und unterbrechen Sie das Skript nicht."
+  },
+  "troubleshoot": {
+    "heading": "Fehlerbehebung",
+    "noImagesTitle": "\"Keine kompatiblen Disk Images gefunden\"",
+    "noImagesBody": "Das Skript fand keine Datei mit <code>.img</code>, <code>.qcow2</code>, <code>.vmdk</code> oder <code>.raw</code>. Prüfen Sie die Erweiterung einschließlich Groß-/Kleinschreibung, ob die Datei direkt im gewählten Verzeichnis liegt (Unterverzeichnisse werden nicht durchsucht) und ob root sie lesen darf.",
+    "slowTitle": "Import ist langsam",
+    "slowBody": "Konvertierungen zwischen VMDK, QCOW2 und raw können durch CPU und E/A begrenzt sein. Die Importgeschwindigkeit hängt von Quelllesezugriffen, Zielschreibzugriffen und nötiger Dekomprimierung ab. Bevorzugen Sie nach Möglichkeit raw- oder qcow2-Quellen.",
+    "uefiTitle": "Importiertes Laufwerk startet in der UEFI-Shell",
+    "uefiBody": "Das Image wurde für Legacy (SeaBIOS) gebaut, aber der VM verwendet OVMF (oder umgekehrt). Wechseln Sie entweder den VM BIOS in Proxmox, um das Image abzugleichen, oder bauen Sie das Image vor dem Importieren im richtigen Modus neu auf."
+  },
+  "related": {
+    "heading": "Verwandte Themen",
+    "items": [
+      {
+        "href": "/docs/disk-manager/import-disk-vm",
+        "label": "Datenträger in VM importieren",
+        "tail": " — derselbe Ablauf für physische Laufwerke (Passthrough)."
+      },
+      {
+        "href": "/docs/utils/import-vm",
+        "label": "VM von OVA / OVF importieren",
+        "tail": "- wenn Sie ein vollständiges VM-Paket haben, nicht nur ein Festplattenimage."
+      },
+      {
+        "href": "/docs/utils/UUp-Dump-ISO-Creator",
+        "label": "UUP-Dump-ISO-Erstellung",
+        "tail": "- Generieren Sie eine Windows ISO, wenn Sie eine für eine neue Installation benötigen."
+      },
+      {
+        "href": "/docs/help-info/storage-commands",
+        "label": "Speicher- und Festplattenbefehle",
+        "tail": " — Referenz für qm importdisk und qemu-img convert."
+      },
+      {
+        "href": "/docs/disk-manager",
+        "label": "Übersicht Disk Manager",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/de/docs/disk-manager/import-disk-lxc.json b/web/messages/de/docs/disk-manager/import-disk-lxc.json
new file mode 100644
index 00000000..7d8235f2
--- /dev/null
+++ b/web/messages/de/docs/disk-manager/import-disk-lxc.json
@@ -0,0 +1,115 @@
+{
+  "meta": {
+    "title": "Datenträger zu LXC importieren | ProxMenux Dokumentation",
+    "description": "Befestigen Sie eine physische Festplatte an einen vorhandenen LXC-Container auf Proxmox VE mit ProxMenux. Behandelt Dateisystemerkennung / -formatierung, Einhängepunkt, unprivilegierte → privilegierte Konvertierung und persistente Gerätepfade.",
+    "ogTitle": "Datenträger zu LXC importieren | ProxMenux Dokumentation",
+    "ogDescription": "Befestigen Sie eine physische Festplatte an einen vorhandenen LXC-Container. Behandelt Dateisystem, Mount Point und unprivilegierte → privilegierte Konvertierung."
+  },
+  "header": {
+    "title": "Datenträger in LXC importieren",
+    "description": "Fügen Sie eine physische Festplatte an einen vorhandenen LXC-Container auf dem Proxmox-Host an. ProxMenux erkennt freie Festplatten, formatiert sie optional mit einem unterstützten Dateisystem und verkabelt die Partition mit persistenten Gerätepfaden an einen Einhängepunkt im Container.",
+    "section": "Datenträgerverwaltung · LXC"
+  },
+  "intro": {
+    "title": "VM-Passthrough und LXC-Passthrough",
+    "body": "LXC-Passthrough stellt hier <strong>kein rohes Blockgerät</strong> bereit. Der Container erhält einen <em>Einhängepunkt</em>, also ein Verzeichnis auf der gewählten Host-Partition. Anders als bei einer VM nutzt der Gast den Host-Kernel; das Dateisystem (ext4/xfs/btrfs) wird daher vom Proxmox-Host gelesen, verwaltet und dem Container zugänglich gemacht."
+  },
+  "howRuns": {
+    "heading": "Wie das Skript läuft",
+    "body": "Der Fluss hat zwei Phasen mit klarer Trennung zwischen \"Sammeln von Informationen und Entscheidungen\" und \"tatsächliches Ändern der Containerkonfiguration\". Bis zur endgültigen Bestätigung wird nichts in den CT eingebaut.",
+    "summary": "ProxMenux blendet das Root-Laufwerk, eingehängte Laufwerke und bereits in VM-/LXC-Konfigurationen referenzierte Laufwerke aus. Aktive ZFS-/LVM-/RAID-Mitglieder werden ausgeblendet; alte Signaturen werden mit ⚠ markiert, damit Sie sie vor dem Formatieren löschen können."
+  },
+  "prereqs": {
+    "heading": "Voraussetzungen",
+    "items": [
+      "Mindestens ein LXC-Container, der auf dem Host definiert ist.",
+      "Der Container ist <strong>privilegiert</strong>, oder Sie nehmen das Konvertierungsangebot des Skripts an.",
+      "Mindestens eine physische Festplatte, die vom Host oder einem anderen Gast nicht verwendet wird."
+    ],
+    "warnTitle": "Privilegierter Container erforderlich",
+    "warnBody": "Dieses Skript benötigt für die direkte Laufwerkszuweisung einen <strong>privilegierten</strong> Container. Bei <code>unprivileged: 1</code> bietet es an, <code>/etc/pve/lxc/&lt;CTID&gt;.conf</code> direkt zu ändern. Das ändert das Sicherheitsmodell, ordnet vorhandene Dateieigentümer aber nicht neu zu. Sichern Sie den Container und prüfen Sie die Eigentümer vor der Zustimmung, oder erstellen Sie ihn privilegiert neu."
+  },
+  "steps": {
+    "heading": "Schritt für Schritt",
+    "stepLabel": "Schritt",
+    "list": [
+      {
+        "title": "Wählen Sie den Zielcontainer",
+        "img": "/disk/select-container.png",
+        "caption": "Auswahlmenü für Container",
+        "bodyRich": "ProxMenux listet jeden LXC-Container auf dem Host auf (<code>pct list</code>). Wählen Sie diejenige, die die Festplatte erhalten wird. Wenn der Container nicht privilegiert ist, wird Ihnen angeboten, ihn jetzt umzuwandeln."
+      },
+      {
+        "title": "Wählen Sie die physische Festplatte",
+        "img": "/disk/disk-selection-ct.png",
+        "caption": "Freie Festplatten auf dem Host erkannt (mit ⚠ Labels für veraltete Metadaten)",
+        "bodyRich": "Nur sichere Kandidaten werden angezeigt. Anders als bei VMs weist dieses Skript <strong>ein Laufwerk pro Durchlauf</strong> zu. Führen Sie es für jedes weitere Laufwerk erneut aus."
+      },
+      {
+        "title": "Formatieren oder wiederverwenden",
+        "intro": "Das Skript überprüft die Festplatte:",
+        "items": [
+          "Wenn es bereits ein unterstütztes Dateisystem (ext4 / xfs / btrfs) trägt, können Sie es so wiederverwenden, wie es ist (bestehende Dateien bleiben erhalten).",
+          "Wenn es kein unterstütztes Dateisystem hat, wird Ihnen angeboten, es zu formatieren. Wählen Sie ext4 / xfs / btrfs."
+        ]
+      },
+      {
+        "title": "Wählen Sie den Mount Point",
+        "bodyRich": "Geben Sie den Pfad ein, unter dem der Container das Laufwerk sehen soll, etwa <code>/mnt/data</code> oder <code>/mnt/disk_passthrough</code>. Dies ist der Pfad <em>innerhalb</em> des Containers; der Host sieht die Partition bereits unter <code>/dev/disk/by-id/…</code>."
+      },
+      {
+        "title": "Zuweisen und prüfen",
+        "img": "/disk/assignment-ct.png",
+        "caption": "Zuordnung zu CT",
+        "bodyRich": "ProxMenux fügt der Containerkonfiguration einen neuen <code>mpN:</code>-Eintrag hinzu, überspringt belegte Indizes und liest die Konfiguration zur Bestätigung erneut. Bei laufendem Container wird die Einhängung sofort angewendet, andernfalls beim nächsten Start.",
+        "extraImg": "/disk/result-point.png",
+        "extraAlt": "Mount Point erfolgreich erstellt",
+        "extraCaption": "Einhängepunkt erstellt und geprüft"
+      }
+    ]
+  },
+  "manual": {
+    "heading": "Manuelles Äquivalent",
+    "body": "Das Skript wickelt <code>pct set</code> ab. Ein direkter Aufruf für eine einzelne Festplatte sieht so aus:"
+  },
+  "important": {
+    "heading": "Wichtige Überlegungen",
+    "items": [
+      "<strong>Ein Laufwerk pro Durchlauf</strong>. Führen Sie das Skript für jedes weitere Laufwerk erneut aus.",
+      "Hängen Sie <strong>nicht</strong> dieselbe Partition an mehrere Container an, die sie gleichzeitig bereitstellen könnten – gleichzeitige Schreibvorgänge beschädigen das Dateisystem.",
+      "<strong>Alte Metadaten</strong> (RAID / ZFS / LVM-Signaturen) müssen manuell gelöscht werden, bevor Sie das Skript formatieren lassen, andernfalls weigert sich <code>mkfs</code> zu überschreiben. Verwenden Sie dafür das <wipeLink>Format / Wipe Physical Disk</wipeLink> Tool."
+    ]
+  },
+  "troubleshoot": {
+    "heading": "Fehlerbehebung",
+    "unprivTitle": "\"Kann nicht mit einem unprivilegierten Container fortfahren\"",
+    "unprivBody": "Sie haben die Konvertierung abgelehnt; das Skript wurde daher ohne Änderungen beendet. Um fortzufahren, führen Sie es erneut aus und stimmen zu: Das Skript stoppt den Container, sichert seine Konfiguration in <code>/etc/pve/lxc/&lt;CTID&gt;.conf.bak</code> und ersetzt <code>unprivileged: 1</code> durch <code>unprivileged: 0</code>. Diese Änderung allein wandelt die UID-/GID-Eigentümer vorhandener Dateien nicht um; sichern Sie den Container daher vorher und passen Sie die Eigentümer an. Alternativ stellen Sie ihn privilegiert wieder her oder erstellen ihn neu.",
+    "permsTitle": "Berechtigungen im Container sind falsch",
+    "permsBody": "Beim Einhängen in einen privilegierten Container bleiben vorhandene Dateieigentümer erhalten; ein neues Dateisystem gehört häufig <code>root:root</code>. Läuft der Dienst unter einem anderen Benutzer, etwa <code>www-data</code> für Nextcloud, prüfen Sie dessen UID/GID und passen Sie die nötigen Dateien mit <code>chown</code>/<code>chmod</code> an. Dies verändert auch den zugrunde liegenden Datenträger."
+  },
+  "related": {
+    "heading": "Verwandte Themen",
+    "items": [
+      {
+        "href": "/docs/disk-manager/import-disk-vm",
+        "label": "Datenträger in VM importieren",
+        "tail": " — entsprechender Ablauf für VMs."
+      },
+      {
+        "href": "/docs/storage-share/lxc-mount-points",
+        "label": "LXC-Einhängepunkte (Host ↔ CT)",
+        "tail": "- Hostverzeichnisse mit einem CT teilen, anstatt eine ganze Festplatte anzuhängen."
+      },
+      {
+        "href": "/docs/help-info/vm-ct-commands",
+        "label": "VM und CT Verwaltungsbefehle",
+        "tail": "- pct config / push / pull Referenz."
+      },
+      {
+        "href": "/docs/disk-manager",
+        "label": "Übersicht Disk Manager",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/de/docs/disk-manager/import-disk-vm.json b/web/messages/de/docs/disk-manager/import-disk-vm.json
new file mode 100644
index 00000000..4ae57b22
--- /dev/null
+++ b/web/messages/de/docs/disk-manager/import-disk-vm.json
@@ -0,0 +1,113 @@
+{
+  "meta": {
+    "title": "Datenträger zu VM importieren | ProxMenux Dokumentation",
+    "description": "Befestigen Sie eine physische Festplatte an eine vorhandene Proxmox VM mit ProxMenux. Sichere Festplattenerkennung (ausgenommen System, montiert, in Gebrauch, ZFS/RAID/LVM), persistente /dev/disk/by-id-Pfade und SATA / SCSI / VirtIO / IDE-Schnittstellen.",
+    "ogTitle": "Datenträger zu VM importieren | ProxMenux Dokumentation",
+    "ogDescription": "Befestigen Sie eine physische Festplatte an eine vorhandene Proxmox VM. Verwendet persistente /dev/disk/by-id-Pfade und unterstützt SATA / SCSI / VirtIO / IDE."
+  },
+  "header": {
+    "title": "Datenträger in VM importieren",
+    "description": "Weisen Sie einer vorhandenen VM ein physisches Laufwerk des Proxmox-Hosts zu. ProxMenux erkennt freie Laufwerke, lässt Sie Ziel-VM und Bustyp (SATA/SCSI/VirtIO/IDE) wählen und verwendet persistente /dev/disk/by-id-Pfade. So bleibt die Zuordnung bei Neustarts und geänderter Gerätereihenfolge bestehen.",
+    "section": "Datenträgerverwaltung · VM"
+  },
+  "intro": {
+    "title": "Was das macht",
+    "body": "Ein physisches Laufwerk wird als Backend einer virtuellen Laufwerksschnittstelle zugewiesen. Der Gast erhält nicht automatisch native SMART-Daten oder Funktionen des physischen Controllers; dafür ist Controller-PCI-Passthrough geeignet. Das Laufwerk wird, falls vorhanden, über seinen Pfad <code>/dev/disk/by-id/…</code> zugewiesen, sodass eine geänderte Gerätereihenfolge beim Start die Zuordnung nicht unterbricht; andernfalls wird <code>/dev/sdX</code> verwendet."
+  },
+  "howRuns": {
+    "heading": "Wie das Skript läuft",
+    "body": "Der Fluss hat zwei Phasen mit klarer Trennung zwischen \"Sammeln von Informationen und Entscheidungen\" und \"tatsächliches Anbringen von Festplatten am VM\". Bis zur endgültigen Bestätigung bleibt die VM-Konfiguration unberührt.",
+    "summary": "ProxMenux blendet unsichere Kandidaten aus: Root-Laufwerk, auf dem Host eingehängte Laufwerke, aktive ZFS-/LVM-/RAID-Mitglieder und bereits in VM-/LXC-Konfigurationen referenzierte Laufwerke. Laufwerke mit <em>alten</em>, nicht mehr verwendeten ZFS-/RAID-/LVM-Metadaten erscheinen mit ⚠, werden aber nicht gesperrt."
+  },
+  "prereqs": {
+    "heading": "Voraussetzungen",
+    "items": [
+      "Mindestens ein VM, der auf dem Host definiert ist (das Skript wird direkt an <code>qm list</code> gesendet).",
+      "Die <strong>Ziel-VM ist ausgeschaltet</strong>. Läuft sie, bricht das Skript mit einer Meldung ab; das Hinzufügen im laufenden Betrieb ist nicht Teil dieses Ablaufs.",
+      "Mindestens eine physische Festplatte auf dem Host, die nicht vom Host oder einem anderen Gast verwendet wird."
+    ]
+  },
+  "steps": {
+    "heading": "Schritt für Schritt",
+    "stepLabel": "Schritt",
+    "list": [
+      {
+        "title": "Ziel-VM auswählen",
+        "bodyRich": "ProxMenux listet alle VMs auf dem Host über <code>qm list</code> auf. Wählen Sie die VM für das Laufwerk. Läuft sie, bricht das Skript ab und fordert Sie auf, sie zuerst herunterzufahren."
+      },
+      {
+        "title": "Wählen Sie die physische Festplatte(n) zum Anbringen",
+        "img": "/disk/disk-selection.png",
+        "caption": "Freie Festplatten auf dem Host erkannt (mit ⚠ Labels für veraltete Metadaten)",
+        "body": "Das Skript scannt jede Host-Disk und zeigt nur diejenigen an, die sicher angehängt werden können. Mit der Checkliste können Sie eine oder mehrere auf einmal auswählen. Disks mit alten ZFS / LVM / RAID-Signaturen werden immer noch angezeigt, gekennzeichnet mit ⚠, so dass Sie wissen, dass sie ein Wischen benötigen, bevor der Gast sie formatieren kann."
+      },
+      {
+        "title": "Wählen Sie die Bus-Schnittstelle",
+        "img": "/disk/disk-assigment.png",
+        "caption": "Auswahl der Busschnittstellen",
+        "intro": "Wählen Sie aus, wie der Gast die Festplatte sehen soll:",
+        "items": [
+          "<strong>SCSI</strong> – moderner Standard für Linux und Windows mit installierten VirtIO-SCSI-Treibern.",
+          "<strong>SATA</strong> — breite Kompatibilität, funktioniert out of the box auf praktisch jedem Gast.",
+          "<strong>VirtIO</strong>: effizientes paravirtualisiertes Blockgerät; benötigt Gasttreiber.",
+          "<strong>IDE</strong>: für ältere Gäste ohne einen der oben genannten Treiber."
+        ]
+      },
+      {
+        "title": "Zuweisen und prüfen",
+        "bodyRich": "ProxMenux verbindet jede ausgewählte Festplatte mit dem besten <code>/dev/disk/by-id/</code>-Pfad, überspringt Slot-Indizes, die bereits in der VM-Konfiguration verwendet werden (<code>scsi0</code>, <code>sata0</code>, ...) und liest die Konfiguration erneut, um die Zuordnung zu bestätigen. Am Ende wird eine Zusammenfassung gedruckt."
+      }
+    ]
+  },
+  "manual": {
+    "heading": "Manuelles Äquivalent",
+    "body": "Das Skript ist ein Wrapper um <code>qm set</code>. Der genaue Befehl für eine einzelne Festplatte sieht so aus:",
+    "migrationTitle": "Live Migration ist nicht möglich",
+    "migrationBody": "Eine VM mit einem direkt zugewiesenen physischen Laufwerk ist <strong>an den Host gebunden, der dieses bereitstellt</strong>. Ein anderer Knoten hat normalerweise weder denselben Pfad <code>/dev/disk/by-id/…</code> noch dessen Daten. Sichern und übertragen Sie diese separat oder verwenden Sie verwaltete virtuelle Laufwerke auf gemeinsamem oder unterstützt repliziertem Speicher. Gehen Sie nicht davon aus, dass Proxmox-Speicherreplikation dieses Gerät umfasst.",
+    "shareTitle": "Teilen Sie keine physische Festplatte zwischen VMs",
+    "shareBody": "Wenn Sie dieselbe physische Festplatte gleichzeitig an zwei VMs anbringen, werden die Daten beim nächsten Schreiben beschädigt. ProxMenux erkennt diese Situation und blockiert sie, aber wenn Sie das Skript umgehen (direktes <code>qm set</code>), stellen Sie sicher, dass nur ein Gast jemals die Festplatte mountet."
+  },
+  "troubleshoot": {
+    "heading": "Fehlerbehebung",
+    "noDisksTitle": "\"Für diesen VM sind keine Festplatten verfügbar\"",
+    "noDisksIntro": "Das Skript fand Festplatten, aber jeder Kandidat wurde herausgefiltert. Häufige Gründe:",
+    "noDisksItems": [
+      "Jede verbleibende Festplatte wird bereits in der Konfiguration des Ziels VM referenziert.",
+      "Jede verbleibende Festplatte wird auf dem Host montiert oder ist Teil eines aktiven ZFS / LVM / RAID.",
+      "Der Host hat nur die Root Disk installiert."
+    ],
+    "noDisksOutro": "Führen Sie <code>lsblk -f</code> auf dem Host aus, um den Status jeder Festplatte zu überprüfen.",
+    "noVisibleTitle": "VM sieht die Festplatte nach dem Booten nicht",
+    "noVisibleBody": "Bei <strong>SCSI</strong> oder <strong>VirtIO</strong> benötigt der Gast den passenden Treiber. Linux bringt ihn im Kernel mit; unter Windows installieren Sie ihn von der VirtIO-ISO (siehe <winLink>VM erstellen: Windows</winLink>). SATA auf der Hardware-Registerkarte der VM ist ein schneller Test, ob das Laufwerk zugewiesen ist."
+  },
+  "related": {
+    "heading": "Verwandte Themen",
+    "items": [
+      {
+        "href": "/docs/disk-manager/import-disk-image-vm",
+        "label": "Disk-Image in VM importieren",
+        "tail": " — derselbe Ablauf für Disk-Image-Dateien (qcow2 / vmdk / raw / img)."
+      },
+      {
+        "href": "/docs/disk-manager/import-disk-lxc",
+        "label": "Datenträger in LXC importieren",
+        "tail": " — entsprechender Ablauf für LXC-Container."
+      },
+      {
+        "href": "/docs/disk-manager/add-controller-nvme-vm",
+        "label": "Controller oder NVMe zu VM hinzufügen",
+        "tail": "- wenn Sie einen vollständigen PCIe / NVMe-Durchgang anstelle eines Festplattenanschlusses benötigen."
+      },
+      {
+        "href": "/docs/help-info/storage-commands",
+        "label": "Speicher- und Festplattenbefehle",
+        "tail": "qm importdisk und zugehörige Shell-Referenz."
+      },
+      {
+        "href": "/docs/disk-manager",
+        "label": "Übersicht Disk Manager",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/de/docs/disk-manager/index.json b/web/messages/de/docs/disk-manager/index.json
new file mode 100644
index 00000000..d75fab7d
--- /dev/null
+++ b/web/messages/de/docs/disk-manager/index.json
@@ -0,0 +1,135 @@
+{
+  "meta": {
+    "title": "Proxmox-Datenträgerverwaltung: VM/LXC-Zuweisung, SMART-Tests, Löschen | ProxMenux",
+    "description": "Verwalten Sie physische Laufwerke auf einem Proxmox-VE-Host mit ProxMenux: Laufwerke VMs oder LXC zuweisen (qm set scsi/sata/virtio, pct mp), img-/qcow2-/vmdk-/raw-Images importieren, ganze HBAs oder NVMe-Controller durchreichen, Laufwerke mit Sicherheitsprüfungen löschen und SMART-Selbsttests ausführen.",
+    "ogTitle": "Proxmox-Datenträgerverwaltung: VM/LXC-Zuweisung, SMART-Tests, Löschen",
+    "ogDescription": "Laufwerke VMs/LXC zuweisen, Images importieren, Controller per PCI durchreichen, Laufwerke sicher bedienen und SMART-Tests auf Proxmox VE ausführen.",
+    "twitterTitle": "Proxmox-Datenträgerverwaltung | ProxMenux",
+    "twitterDescription": "Laufwerke VMs/LXC zuweisen, Images importieren, PCI-Passthrough, Löschen mit Sicherheitsprüfungen und SMART-Tests."
+  },
+  "header": {
+    "title": "Festplattenmanager",
+    "description": "Das Menü Datenträgerverwaltung bündelt ProxMenux-Werkzeuge für physische Laufwerke auf einem Proxmox-Host: Zuweisung an VMs und LXC, Import von Disk-Images, Passthrough ganzer Controller oder NVMe-Geräte, Löschen mit Sicherheitsprüfungen und SMART-Tests.",
+    "section": "Festplattenmanager"
+  },
+  "intro": {
+    "title": "Wofür dieses Menü ist",
+    "body": "Diese Werkzeuge arbeiten mit <strong>für den Proxmox-Host sichtbaren physischen Laufwerken und dort gespeicherten Image-Dateien</strong>. Es gibt drei Gruppen: <strong>VM</strong> (Laufwerke zuweisen oder Images importieren), <strong>LXC</strong> (Laufwerke an Container anbinden) und <strong>Dienstprogramme</strong> (Formatierung und SMART-Status). Zuweisung und Löschen blenden Systemlaufwerke und belegte Laufwerke aus oder sperren sie; SMART-Prüfungen können sie ohne Löschen untersuchen."
+  },
+  "opening": {
+    "heading": "Öffnen des Menüs",
+    "body": "Wählen Sie im Hauptmenü von ProxMenux <strong>Disk Manager</strong>. Sie werden sehen:",
+    "imageAlt": "Disk Manager Menü mit VM, LXC und Utilities Blöcken"
+  },
+  "groups": {
+    "heading": "Drei Werkzeuggruppen",
+    "intro": "Das Disk Manager-Menü ist in drei Gruppen unterteilt: <strong>VM</strong>, <strong>LXC</strong> und <strong>Utilities</strong>. Klicken Sie auf eine Karte, um direkt zu den Werkzeugen in dieser Gruppe zu springen.",
+    "vmTitle": "VM",
+    "vmBody": "Tools, die auf vorhandenen virtuellen Maschinen arbeiten. Der VM muss ausgeschaltet werden; ProxMenux validiert dies, bevor er die Konfiguration berührt.",
+    "vmItems": [
+      "Datenträger in VM importieren",
+      "Disk-Image in VM importieren",
+      "Controller oder NVMe zu VM hinzufügen"
+    ],
+    "lxcTitle": "LXC",
+    "lxcBody": "Werkzeuge für bestehende LXC-Container. Dieses Skript benötigt einen privilegierten Container und bietet bei Bedarf die Änderung der Einstellung an. Lesen Sie zuerst die Hinweise zur Konvertierung und zu Dateieigentümern auf der Werkzeugseite.",
+    "lxcItems": [
+      "Datenträger in LXC importieren"
+    ],
+    "utilitiesTitle": "Dienstprogramme",
+    "utilitiesBody": "Hostseitige Tools, die auf den Festplatten selbst arbeiten, unabhängig von VM oder Containern.",
+    "utilitiesItems": [
+      "Physischen Datenträger formatieren / löschen",
+      "SMART-Festplattenstatus und -test"
+    ]
+  },
+  "vm": {
+    "heading": "VM",
+    "intro": "Tools, die auf vorhandenen virtuellen Maschinen arbeiten. Der VM muss ausgeschaltet werden; ProxMenux validiert dies, bevor er die Konfiguration berührt.",
+    "options": [
+      {
+        "icon": "HardDrive",
+        "href": "/docs/disk-manager/import-disk-vm",
+        "title": "Datenträger in VM importieren",
+        "description": "Befestigen Sie eine nicht zugewiesene physische Festplatte an eine vorhandene VM. Unterstützt SATA / SCSI / VirtIO / IDE, verwendet persistente /dev/disk/by-id-Pfade."
+      },
+      {
+        "icon": "FileDown",
+        "href": "/docs/disk-manager/import-disk-image-vm",
+        "title": "Disk-Image in VM importieren",
+        "description": "Importieren Sie Disk-Image-Dateien (.img / .qcow2 / .vmdk / .raw) in eine vorhandene VM. Zweiphasiger Ablauf mit qm importdisk im Hintergrund."
+      },
+      {
+        "icon": "Cpu",
+        "href": "/docs/disk-manager/add-controller-nvme-vm",
+        "title": "Controller oder NVMe zu VM hinzufügen",
+        "description": "PCI-Durchgang eines ganzen SATA / SAS HBA- oder NVMe-Geräts zu einem VM. Behandelt IOMMU Enablement und Konflikterkennung."
+      }
+    ]
+  },
+  "lxc": {
+    "heading": "LXC",
+    "intro": "Werkzeuge für bestehende LXC-Container. Dieses Skript benötigt einen privilegierten Container und bietet bei Bedarf die Änderung der Einstellung an. Lesen Sie zuerst die Hinweise zur Konvertierung und zu Dateieigentümern auf der Werkzeugseite.",
+    "options": [
+      {
+        "icon": "Boxes",
+        "href": "/docs/disk-manager/import-disk-lxc",
+        "title": "Datenträger in LXC importieren",
+        "description": "Befestigen Sie eine nicht zugewiesene physische Festplatte an einem vorhandenen LXC-Container als Montagepunkt. Behandelt Dateisystemerkennung / Format und privilegierte Konvertierung."
+      }
+    ]
+  },
+  "utilities": {
+    "heading": "Dienstprogramme",
+    "intro": "Hostseitige Tools, die auf den Festplatten selbst arbeiten, unabhängig von VM oder Containern.",
+    "options": [
+      {
+        "icon": "Eraser",
+        "href": "/docs/disk-manager/format-disk",
+        "title": "Physische Festplatte formatieren/löschen (sicher)",
+        "description": "Laufwerke mit strengen Sicherheitskontrollen löschen: Nur vollständig freie Laufwerke werden angezeigt, und eine doppelte Bestätigung ist immer erforderlich."
+      },
+      {
+        "icon": "Activity",
+        "href": "/docs/disk-manager/smart-disk-test",
+        "title": "SMART-Festplattenstatus und -test",
+        "description": "Führen Sie SMART Gesundheitschecks und kurze / lange Selbsttests auf SATA-, SAS- und NVMe-Laufwerken durch. Exportiert JSON für den Monitor."
+      }
+    ]
+  },
+  "safety": {
+    "title": "Sicherheitsregeln für Laufwerkszuweisung und Löschen",
+    "intro": "Zuweisungs- und Löschvorgänge filtern Geräte aus, die den Host gefährden könnten:",
+    "items": [
+      "Das <strong>Systemlaufwerk</strong> sowie Root-Pool, Swap und aktive ZFS-/LVM-/RAID-Mitglieder bleiben ausgeblendet.",
+      "Auf dem Host <strong>eingehängte</strong> Laufwerke werden ausgeblendet oder bei der Ausführung gesperrt.",
+      "Datenträger <strong>, auf die mit einem laufenden VM oder LXC</strong> verwiesen wird, können nicht neu zugewiesen oder gelöscht werden.",
+      "Operationen, die den Host-Status ändern können (IOMMU enable, Wipe) erfordern eine explizite Bestätigung."
+    ]
+  },
+  "related": {
+    "heading": "Verwandte Themen",
+    "items": [
+      {
+        "href": "/docs/storage-share",
+        "label": "Speicher- und Freigabemanager",
+        "tail": "- registrieren Sie den Speicher in Proxmox selbst (NFS / Samba / iSCSI / local) und teilen Sie Ordner zwischen Host und CTs."
+      },
+      {
+        "href": "/docs/help-info/storage-commands",
+        "label": "Speicher- und Festplattenbefehle",
+        "tail": "— Blockgeräte, LVM, pvesm, SMART Referenz."
+      },
+      {
+        "href": "/docs/help-info/zfs-commands",
+        "label": "ZFS Verwaltungsbefehle",
+        "tail": "— für ZFS-Pools und Datensätze."
+      },
+      {
+        "href": "/docs/hardware/gpu-vm-passthrough",
+        "label": "GPU zu VM hinzufügen (Passthrough)",
+        "tail": "- die gleichen IOMMU / VFIO-Konzepte für GPUs."
+      }
+    ]
+  }
+}
diff --git a/web/messages/de/docs/disk-manager/smart-disk-test.json b/web/messages/de/docs/disk-manager/smart-disk-test.json
new file mode 100644
index 00000000..93c20841
--- /dev/null
+++ b/web/messages/de/docs/disk-manager/smart-disk-test.json
@@ -0,0 +1,146 @@
+{
+  "meta": {
+    "title": "SMART-Laufwerksstatus und Tests | ProxMenux-Dokumentation",
+    "description": "Führen Sie SMART-Gesundheitsprüfungen und Festplattentests auf Proxmox VE mit ProxMenux aus. Unterstützt SATA / SAS (smartmontools) und NVMe (nvme-cli). Kurze und lange Selbsttests, JSON Export für ProxMenux Monitor Integration.",
+    "ogTitle": "SMART-Laufwerksstatus und Tests | ProxMenux-Dokumentation",
+    "ogDescription": "SMART Gesundheitschecks und Selbsttests für SATA / SAS und NVMe Laufwerke auf Proxmox. JSON Export für den Monitor."
+  },
+  "header": {
+    "title": "SMART-Festplattenstatus und -test",
+    "description": "Lesen Sie SMART-Daten und lösen Sie Selbsttests auf den physischen Festplatten aus, die an den Proxmox-Host angeschlossen sind. ProxMenux installiert automatisch Smartmontools für SATA / SAS und nvme-cli für NVMe, führt die Aktion innerhalb der Laufwerk-Firmware aus (lange Tests überleben Terminalschluss) und exportiert JSON-Ergebnisse für den ProxMenux Monitor.",
+    "section": "Disk Manager · Dienstprogramme"
+  },
+  "intro": {
+    "title": "Wofür das ist",
+    "body": "SMART (Self-Monitoring, Analysis and Reporting Technology) ermöglicht es dem Laufwerk selbst, seinen Zustand zu melden und Selbsttests durchzuführen. Dieses Tool stellt diese Daten frei, ohne dass Sie sich die richtige <code>smartctl</code>/<code>nvme</code>-Aufrufung merken müssen, und behält die Ausgabe als JSON, so dass der Monitor Trends im Laufe der Zeit zeichnen kann."
+  },
+  "howRuns": {
+    "heading": "Wie das Skript läuft",
+    "body": "Alle Aktionen hier sind zerstörungsfrei - SMART liest die Laufwerk-Firmware-Zähler, und Selbsttests werden innerhalb des Laufwerks selbst in die Warteschlange gestellt. Es ist keine Phasentrennung erforderlich. Der Ablauf ist: Abhängigkeitsprüfung → Festplattenauswahl → Aktionsauswahl → Werkzeugaufruf (smartctl oder nvme-cli abhängig vom Festplattenbus) → gedruckte Ausgabe plus JSON Export für den Monitor."
+  },
+  "deps": {
+    "heading": "Abhängigkeiten",
+    "body": "Das Tool installiert automatisch, was es beim ersten Durchlauf benötigt. SATA / SAS-Laufwerke verlassen sich auf <code>smartmontools</code>; NVMe-Laufwerke verlassen sich auf <code>nvme-cli</code>. Beide:"
+  },
+  "actions": {
+    "heading": "Verfügbare Maßnahmen",
+    "headerAction": "Aktion",
+    "headerWhat": "Was gelesen oder ausgeführt wird",
+    "headerDur": "Dauer",
+    "rows": [
+      {
+        "action": "Schneller Gesundheitszustand",
+        "whatRich": "Insgesamt PASSED/FAILED + Schlüsselattribute.<br /><code>smartctl -H</code> + <code>-A</code> (SATA/SAS) oder <code>nvme smart-log</code> (NVMe).",
+        "dur": "Sofort"
+      },
+      {
+        "action": "Vollständiger Bericht",
+        "whatRich": "Vollständige SMART-Daten, scrollbar. <code>smartctl -x</code> für SATA/SAS oder <code>nvme smart-log</code> + <code>id-ctrl</code> für NVMe.",
+        "dur": "Sofort"
+      },
+      {
+        "action": "Kurztest",
+        "what": "Grundlegende Oberfläche und elektrische Überprüfung, in der Warteschlange innerhalb der Firmware des Laufwerks.",
+        "dur": "~2 Minuten"
+      },
+      {
+        "action": "Lange Prüfung",
+        "what": "Vollständiger Scan der gesamten Oberfläche. Läuft auf der Laufwerk-Hardware - bleibt bestehen, auch wenn Sie das Terminal schließen.",
+        "dur": "Stunden (abhängig von der Laufwerksgröße)"
+      },
+      {
+        "action": "Testfortschritt prüfen",
+        "what": "Status des aktiven oder letzten Selbsttests.",
+        "dur": "Sofort"
+      }
+    ],
+    "tipTitle": "Lange Tests laufen nach dem Schließen des Terminals weiter",
+    "tipBody": "Ein langer Test läuft <em>im Laufwerk</em> und benötigt keinen weiterlaufenden ProxMenux-Prozess. Schließen Sie das Terminal und verwenden Sie später <strong>Testfortschritt prüfen</strong>. Ein Host-Neustart, Controller-Reset oder Stromausfall kann den Test und die Ergebniserfassung unterbrechen; eine automatische Fortsetzung ist nicht garantiert."
+  },
+  "json": {
+    "heading": "JSON Export für den Monitor",
+    "intro": "Status-, Kurztest- und Fortschrittsaktionen schreiben eine JSON-Datei mit Zeitstempel nach <code>/usr/local/share/proxmenux/smart/&lt;disk&gt;/</code>; Langtestergebnisse werden im Hintergrund erfasst. Der vollständige Bericht wird nur angezeigt. Die Struktur ist:",
+    "outro": "ProxMenux Monitor liest diese Dateien zur Darstellung von Zustandstrends je Laufwerk. Beim Erreichen der Aufbewahrungsgrenze werden alte Dateien automatisch entfernt."
+  },
+  "steps": {
+    "heading": "Schritt für Schritt",
+    "stepLabel": "Schritt",
+    "list": [
+      {
+        "title": "Laufwerk auswählen",
+        "body": "ProxMenux listet jede physische Festplatte auf dem Host mit ihrem Modell und ihrer Größe auf. Im Gegensatz zum Format-Tool wird diese Liste nicht durch die Sicherheit gefiltert - das Lesen von SMART ist eine zerstörungsfreie Operation.",
+        "img": "/disk/smart/disk-selection.png",
+        "alt": "SMART Plattenauswahlmenü",
+        "caption": "SMART Plattenauswahlmenü"
+      },
+      {
+        "title": "Wählen Sie eine Aktion",
+        "body": "Wählen Sie schnellen Status, vollständigen Bericht, Kurztest, Langtest oder Testfortschritt. Das Menü bleibt nach jeder Aktion offen, sodass Sie mehrere Abfragen desselben Laufwerks ausführen können.",
+        "img": "/disk/smart/action-menu.png",
+        "alt": "SMART Aktionsmenü",
+        "caption": "SMART Aktionsmenü (5 Aktionen + Abbruch)"
+      },
+      {
+        "title": "(Nur langer Test) Hintergrundausführung bestätigen",
+        "body": "ProxMenux weist darauf hin, dass der Test nach dem Schließen des Terminals weiterläuft, und zeigt den Speicherort der JSON-Ergebnisse. Bestätigen Sie, um den Test zu starten.",
+        "img": "/disk/smart/long-test-warning.png",
+        "alt": "Dialog über lange Testbestätigung",
+        "caption": "Lange Testbestätigung – läuft im Hintergrund, Ergebnis wird in JSON gespeichert"
+      },
+      {
+        "title": "Prüfergebnisse",
+        "bodyRich": "Status-, Test- und Fortschrittsausgaben erscheinen im Terminal; <strong>Vollständiger Bericht</strong> öffnet sich in einem scrollbaren Dialog. JSON wird für die oben genannten Aktionen exportiert, nicht für den vollständigen Bericht. Verwenden Sie bei Langtests später <strong>Testfortschritt prüfen</strong> für dasselbe Laufwerk.",
+        "img": "/disk/smart/quick-status.png",
+        "alt": "Schnelle Ausgabe des Gesundheitszustands",
+        "caption": "Schnelle Ausgabe des Gesundheitszustands (SATA — smartctl -H + -A)"
+      }
+    ]
+  },
+  "manual": {
+    "heading": "Manuelle Äquivalente",
+    "nvmeWarnTitle": "NVMe Selbsttests sind Laufwerk-Firmware abhängig",
+    "nvmeWarnBody": "Nicht jedes NVMe-Laufwerk unterstützt den kurzen / langen Selbsttestbefehl. Wenn ein Laufwerk den Test ablehnt, sind das SMART-Protokoll und die ID-Controllerdaten (<code>nvme smart-log</code> + <code>id-ctrl</code>) immer noch das zuverlässigste Gesundheitssignal."
+  },
+  "troubleshoot": {
+    "heading": "Fehlerbehebung",
+    "noSmartTitle": "\"Konnte SMART-Daten aus /dev/sdX nicht lesen\"",
+    "noSmartBody": "Die Festplatte befindet sich wahrscheinlich hinter einem RAID / SAS-Controller, der SMART nicht durchläuft. Versuchen Sie mit Megaraid-basierten Karten <code>smartctl -d megaraid,N /dev/sdX</code>. Für HBAs im IT-Modus funktioniert der direkte Aufruf.",
+    "longTitle": "Langer Test nie abgeschlossen",
+    "longBody": "Der Test läuft in der Laufwerksfirmware; hohe E/A-Last kann ihn verzögern. Nutzen Sie eine ruhige Zeit, etwa nachts. Bei SATA zeigt <code>smartctl -c</code> den verbleibenden Prozentsatz, bei SAS <code>smartctl -l selftest</code>; das Selbsttestprotokoll zeigt Abschlussstatus und gegebenenfalls fehlerhafte LBAs. Lesefehler müssen untersucht werden; langsamer Fortschritt allein beweist keinen defekten Sektor."
+  },
+  "related": {
+    "heading": "Verwandte Themen",
+    "items": [
+      {
+        "href": "/docs/disk-manager/format-disk",
+        "label": "Physischen Datenträger formatieren / löschen",
+        "tail": "Wiederverwendung einer Festplatte, nachdem bestätigt wurde, dass sie gesund ist."
+      },
+      {
+        "href": "/docs/help-info/storage-commands",
+        "label": "Speicher- und Laufwerksbefehle → SMART-Laufwerksstatus",
+        "tail": "Referenz smartctl/nvme."
+      },
+      {
+        "href": "/docs/help-info/zfs-commands",
+        "label": "ZFS Verwaltungsbefehle",
+        "tail": " — zpool scrub prüft ZFS-Datenprüfsummen und ergänzt SMART-Hardwaretests."
+      },
+      {
+        "href": "/docs/monitor/dashboard/storage",
+        "label": "ProxMenux Monitor — Speicherregister",
+        "tail": " — Laufwerksdetailansicht mit den hier exportierten JSON-Daten: vollständige SMART-Tabelle, Verlauf und PDF-Bericht."
+      },
+      {
+        "href": "/docs/monitor/dashboard/hardware",
+        "label": "ProxMenux Monitor — Register Hardware",
+        "tail": "Speicherzusammenfassung mit Modell, Kapazität und ausgehandelter Verbindungsgeschwindigkeit (aktuell vs. maximal auf NVMe)."
+      },
+      {
+        "href": "/docs/disk-manager",
+        "label": "Übersicht Disk Manager",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/de/docs/external-repositories.json b/web/messages/de/docs/external-repositories.json
new file mode 100644
index 00000000..25801ecf
--- /dev/null
+++ b/web/messages/de/docs/external-repositories.json
@@ -0,0 +1,58 @@
+{
+  "meta": {
+    "title": "Externe Repositorys | ProxMenux-Dokumentation",
+    "description": "ProxMenux bindet ausgewählte externe Skript-Repositorys wie community-scripts und ZimaOS als Alternativen in einigen Menüs ein. Jedes Skript ist mit seiner Quelle gekennzeichnet. Fehlerberichte gehören an den ursprünglichen Maintainer.",
+    "ogTitle": "Externe Repositorys | ProxMenux-Dokumentation",
+    "ogDescription": "Externe Skript-Repositorys, die als Alternativen in ProxMenux-Menüs eingebunden sind."
+  },
+  "header": {
+    "title": "Externe Repositorys",
+    "description": "ProxMenux bindet ausgewählte externe Skript-Repositorys als Alternativen in einige Menübereiche ein. Die Skripte stammen aus vertrauenswürdigen Drittquellen und werden im Menü klar mit ihrer Herkunft gekennzeichnet.",
+    "section": "Externe Repositorys"
+  },
+  "practice": {
+    "title": "Was das in der Praxis bedeutet",
+    "body": "Verwendet eine Menüoption ein externes Skript statt eigenen ProxMenux-Codes, nennt das Menü ausdrücklich dessen Herkunft und Repository. ProxMenux startet diese Skripte, verändert sie aber nicht. Für Fehler in ihrem Verhalten ist der Maintainer des jeweiligen Repositorys zuständig."
+  },
+  "integrated": {
+    "heading": "Derzeit eingebunden",
+    "usedInLabel": "Verwendung in:",
+    "items": [
+      {
+        "name": "community-scripts / ProxmoxVE",
+        "url": "https://community-scripts.github.io/ProxmoxVE/",
+        "description": "Führt die Arbeit von ttecks Helper Scripts fort. Umfangreicher Katalog von Skripten zur Bereitstellung von LXCs wie Home Assistant, Plex oder Frigate, VMs, Erweiterungen und PVE-Anpassungen in einem Durchgang.",
+        "usedIn": "Helper-Scripts-Starter und Netzwerk (Korrektur des NIC-Offloadings für Intel e1000e)"
+      }
+    ]
+  },
+  "attribution": {
+    "heading": "Urheberangaben und Anerkennung",
+    "items": [
+      "Die ursprünglichen Autoren werden stets im Menü und auf der Dokumentationsseite zum jeweiligen Skript genannt.",
+      "Ein Link zum Quell-Repository erscheint sowohl vor dem Skriptstart als auch auf der zugehörigen Dokumentationsseite.",
+      "Unterstützen Sie die Entwickler dieser externen Projekte mit einem ⭐, durch Sponsoring oder mit aussagekräftigen Fehlerberichten."
+    ]
+  },
+  "report": {
+    "title": "Wo Sie Probleme mit externen Skripten melden können",
+    "body": "Funktioniert ein externes Skript nicht wie erwartet, <strong>melden Sie das direkt im jeweiligen Repository</strong>, nicht bei ProxMenux. ProxMenux lädt das Skript herunter und führt es unverändert aus. Der ursprüngliche Maintainer kann den Fehler einordnen und beheben. ProxMenux-Issues sind für Probleme mit dem Starter oder der Einbindung des Skripts gedacht."
+  },
+  "suggest": {
+    "heading": "Vorschläge für neue externe Repositorys",
+    "intro": "Haben Sie ein Skript oder Repository gefunden, das gut in ein ProxMenux-Menü passt? Schlagen Sie es vor über:",
+    "discussionTitle": "💬 Diskussion eröffnen",
+    "discussionBody": "Ideal für Ideen: Holen Sie Rückmeldungen aus der Community ein, bevor daraus eine Funktionsanfrage wird.",
+    "issueTitle": "🐛 Issue eröffnen",
+    "issueBody": "Für konkrete Funktionsanfragen mit klar abgegrenztem Umfang."
+  },
+  "candidate": {
+    "title": "Was macht einen guten Integrationskandidaten aus",
+    "items": [
+      "Quelloffen und aktiv betreut.",
+      "Idempotent: kann sicher mehrfach ausgeführt werden.",
+      "Verändert die zentrale Proxmox-Konfiguration nicht unbemerkt.",
+      "Löst ein Problem, das ProxMenux noch nicht abdeckt, und vermeidet so doppelte Funktionen."
+    ]
+  }
+}
diff --git a/web/messages/de/docs/glossary.json b/web/messages/de/docs/glossary.json
new file mode 100644
index 00000000..6d3ca65d
--- /dev/null
+++ b/web/messages/de/docs/glossary.json
@@ -0,0 +1,677 @@
+{
+  "meta": {
+    "title": "Glossar | ProxMenux-Dokumentation",
+    "description": "Definitionen der Begriffe aus der ProxMenux-Dokumentation zu Proxmox, Speicher, Netzwerken und Virtualisierung.",
+    "ogTitle": "Glossar | ProxMenux-Dokumentation",
+    "ogDescription": "Schnellreferenz für die technischen Begriffe, die in der ProxMenux-Dokumentation verwendet werden."
+  },
+  "header": {
+    "title": "Glossar",
+    "description": "Kurze Definitionen der Begriffe aus ProxMenux und zur Funktionsweise von Proxmox.",
+    "section": "Glossar"
+  },
+  "callout": {
+    "title": "Wie man diese Seite benutzt",
+    "bodyRich": "Jeder Eintrag enthält eine Kategorie und eine kurze Definition. <em>Siehe auch</em> führt zur passenden Dokumentation. Mit der A–Z-Navigation springen Sie direkt zu einem Buchstaben."
+  },
+  "jumpHeading": "Zu einem Buchstaben springen",
+  "seeAlsoLabel": "Siehe auch:",
+  "aliasesLabel": "auch:",
+  "missingCallout": {
+    "title": "Ein Begriff fehlt?",
+    "leadRich": "Fehlt ein Begriff, erstellen Sie ein Issue oder einen PR auf <ext>GitHub</ext>. Das Glossar steht in <code>web/messages/en/docs/glossary.json</code>, ergänzt durch die jeweiligen Sprachkataloge."
+  },
+  "entries": [
+    {
+      "term": "ACS",
+      "aliases": [
+        "Access Control Services",
+        "ACS-Override"
+      ],
+      "category": "Virtualisierung",
+      "definitionRich": "PCIe-Zugriffskontrollen zur Isolierung des Geräteverkehrs. IOMMU-Gruppen hängen von Hardware und Topologie ab. Der Kernel-Patch <em>ACS override</em> kann die von Linux gemeldeten Gruppen aufteilen, schafft aber keine Hardware-Isolierung; die Zuweisung an getrennte VMs birgt ein Sicherheitsrisiko.",
+      "seeAlso": [
+        {
+          "label": "Controller oder NVMe zu VM hinzufügen",
+          "href": "/docs/disk-manager/add-controller-nvme-vm"
+        }
+      ]
+    },
+    {
+      "term": "ARC",
+      "aliases": [
+        "Adaptive Replacement Cache"
+      ],
+      "category": "Speicher",
+      "definitionRich": "ZFS-Lesecache im RAM des Hosts für kürzlich und häufig verwendete Datenblöcke. Das Standardlimit hängt von Proxmox-Version und Installationseinstellungen ab. ProxMenux bietet bei der Nachinstallation eine Option zur Begrenzung.",
+      "seeAlso": [
+        {
+          "label": "Nachinstallation: Speicher",
+          "href": "/docs/post-install/storage"
+        },
+        {
+          "label": "ZFS-Befehle",
+          "href": "/docs/help-info/zfs-commands"
+        }
+      ]
+    },
+    {
+      "term": "Bind-Mount",
+      "category": "Linux",
+      "definitionRich": "Linux-Funktion, die einen Teil des Dateisystems unter einem weiteren Pfad zugänglich macht. ProxMenux nutzt Bind-Mounts, um Host-Verzeichnisse über <code>pct set -mpN</code> in LXC-Container einzubinden.",
+      "seeAlso": [
+        {
+          "label": "LXC-Einhängepunkte",
+          "href": "/docs/storage-share/lxc-mount-points"
+        }
+      ]
+    },
+    {
+      "term": "Netzwerk-Bond",
+      "aliases": [
+        "Bündelung von Netzwerkschnittstellen",
+        "Link-Aggregation"
+      ],
+      "category": "Netzwerk",
+      "definitionRich": "Bündelt mehrere physische Netzwerkschnittstellen zu einer logischen Schnittstelle für Redundanz (active-backup), höheren Gesamtdurchsatz (LACP / 802.3ad) oder beides. Konfiguration in <code>/etc/network/interfaces</code>."
+    },
+    {
+      "term": "Brücke",
+      "aliases": [
+        "vmbrX",
+        "vmbr0",
+        "Linux Bridge"
+      ],
+      "category": "Netzwerk",
+      "definitionRich": "Virtueller Layer-2-Switch auf dem Host. <code>vmbr0</code> verbindet Gäste üblicherweise mit dem physischen Netzwerk. Weitere Bridges (<code>vmbr1</code>, <code>vmbr2</code>...) können Gastnetze je nach physischen Verbindungen und Konfiguration trennen.",
+      "seeAlso": [
+        {
+          "label": "Brückenanalyse und geführte Reparatur",
+          "href": "/docs/network/bridge-analysis"
+        }
+      ]
+    },
+    {
+      "term": "Ceph",
+      "category": "Speicher",
+      "definitionRich": "Verteilter Speicher für hyperkonvergente Proxmox-Cluster. OSDs (Object Storage Daemons) bilden die Grundlage für Objekt-, Block- und Dateispeicher. Die erforderliche Ceph-Version hängt von Proxmox-Version und Upgrade-Pfad ab; beachten Sie die passende Upgrade-Anleitung.",
+      "seeAlso": [
+        {
+          "label": "Aktualisieren Sie PVE 8 auf PVE 9",
+          "href": "/docs/utils/upgrade-pve8-pve9"
+        }
+      ]
+    },
+    {
+      "term": "CT",
+      "aliases": [
+        "Container",
+        "LXC-Container"
+      ],
+      "category": "Proxmox",
+      "definitionRich": "Proxmox-Kurzbezeichnung für einen LXC-Container. Seine numerische CTID verweist auf <code>/etc/pve/lxc/&lt;CTID&gt;.conf</code>. Siehe auch <strong>LXC</strong>.",
+      "seeAlso": [
+        {
+          "label": "VMs und Container verwalten",
+          "href": "/docs/help-info/vm-ct-commands"
+        }
+      ]
+    },
+    {
+      "term": "deb822",
+      "category": "Linux",
+      "definitionRich": "Modernes Format für APT-Paketquellen: <code>.sources</code>-Dateien mit strukturierten Blöcken und den Feldern Types, URIs, Suites, Components und Signed-By. Ersetzt das einzeilige <code>.list</code>-Format; Standard ab PVE 9 / Debian Trixie.",
+      "seeAlso": [
+        {
+          "label": "Aktualisieren Sie PVE 8 auf PVE 9",
+          "href": "/docs/utils/upgrade-pve8-pve9"
+        }
+      ]
+    },
+    {
+      "term": "dGPU",
+      "aliases": [
+        "Dedizierte GPU"
+      ],
+      "category": "Virtualisierung",
+      "definitionRich": "Separate Grafikkarte, meist über PCIe angebunden, im Gegensatz zu einer <strong>iGPU</strong>. Sie kann per VFIO einer VM zugewiesen oder über Gerätedateien und den Host-Treiber von mehreren LXC-Containern genutzt werden, sofern Hardware und Anwendungen dies unterstützen.",
+      "seeAlso": [
+        {
+          "label": "GPU an VM durchreichen",
+          "href": "/docs/hardware/gpu-vm-passthrough"
+        }
+      ]
+    },
+    {
+      "term": "Dialog",
+      "category": "Linux",
+      "definitionRich": "Auf ncurses basierendes Werkzeug für Menüs, Eingabeaufforderungen und Fortschrittsbalken im Terminal. Die Menüs von ProxMenux verwenden dialog."
+    },
+    {
+      "term": "DKMS",
+      "aliases": [
+        "Unterstützung von dynamischen Kernmodulen"
+      ],
+      "category": "Linux",
+      "definitionRich": "Framework zum Neubauen registrierter externer Kernelmodule wie NVIDIA oder ZFS bei Kerneländerungen. Erfolgreiche Builds benötigen kompatiblen Modulquellcode und passende Kernel-Header.",
+      "seeAlso": [
+        {
+          "label": "Installieren Coral TPU (Host)",
+          "href": "/docs/hardware/install-coral-tpu-host"
+        }
+      ]
+    },
+    {
+      "term": "Fail2Ban",
+      "category": "Linux",
+      "definitionRich": "Dienst, der Protokolle auf wiederholte Anmeldefehler überwacht und die betreffenden IP-Adressen über die Firewall sperrt. ProxMenux liefert vorkonfigurierte Jails für SSH, die Proxmox-Oberfläche und Monitor.",
+      "seeAlso": [
+        {
+          "label": "Fail2Ban",
+          "href": "/docs/security/fail2ban"
+        }
+      ]
+    },
+    {
+      "term": "Fastfetch",
+      "category": "Linux",
+      "definitionRich": "Systeminformationswerkzeug mit ASCII-Grafik beim Anmelden an der Shell. Ersetzt <code>neofetch</code> und kann bei der ProxMenux-Nachinstallation optional aktiviert werden.",
+      "seeAlso": [
+        {
+          "label": "Nach der Installation: Optionales",
+          "href": "/docs/post-install/optional"
+        }
+      ]
+    },
+    {
+      "term": "GRUB",
+      "aliases": [
+        "GRand Unified Bootloader"
+      ],
+      "category": "Linux",
+      "definitionRich": "Bootloader für GRUB-basierte Linux-Installationen. Konfiguration in <code>/etc/default/grub</code> und <code>/boot/grub/</code>; Änderungen mit <code>update-grub</code> übernehmen. Proxmox kann auch systemd-boot verwenden; prüfen Sie vor Änderungen an Kernelparametern den aktiven Bootloader.",
+      "seeAlso": [
+        {
+          "label": "GPU Durchgangsbefehle",
+          "href": "/docs/help-info/gpu-commands"
+        }
+      ]
+    },
+    {
+      "term": "iGPU",
+      "aliases": [
+        "Integrierte GPU"
+      ],
+      "category": "Virtualisierung",
+      "definitionRich": "Im CPU-Paket integrierter Grafikprozessor, etwa Intel UHD / Iris oder Radeon in Ryzen-APUs. Wird häufig über <code>/dev/dri</code> von mehreren LXC-Containern genutzt, statt exklusiv an eine VM durchgereicht zu werden.",
+      "seeAlso": [
+        {
+          "label": "GPU zu LXC hinzufügen",
+          "href": "/docs/hardware/igpu-acceleration-lxc"
+        }
+      ]
+    },
+    {
+      "term": "ifupdown / ifupdown2",
+      "category": "Netzwerk",
+      "definitionRich": "Klassische Debian-Netzwerkkonfiguration über <code>/etc/network/interfaces</code>. Proxmox verwendet standardmäßig die neu entwickelte Variante <code>ifupdown2</code>, die laufende Konfigurationen mit <code>ifreload -a</code> neu laden kann."
+    },
+    {
+      "term": "initramfs",
+      "category": "Linux",
+      "definitionRich": "Anfängliches RAM-Dateisystem für den Start, bevor das eigentliche Root-Dateisystem eingehängt ist. Enthält früh benötigte Treiber. Nach Änderungen an VFIO, IOMMU oder Speichertreibern mit <code>update-initramfs -u -k all</code> neu erstellen."
+    },
+    {
+      "term": "IOMMU",
+      "aliases": [
+        "Eingangs-/Ausgangsspeicherverwaltungseinheit",
+        "VT-d",
+        "AMD-Vi"
+      ],
+      "category": "Virtualisierung",
+      "definitionRich": "Hardware-Funktion (Intel VT-d / AMD-Vi) für PCIe-Passthrough an VMs. Im Firmware-Setup aktivieren und die Kernel-Unterstützung prüfen. Je nach Plattform und Kernelvorgaben können Parameter wie <code>intel_iommu=on</code> oder <code>amd_iommu=on</code> erforderlich sein.",
+      "seeAlso": [
+        {
+          "label": "Post-Install: Virtualisierung",
+          "href": "/docs/post-install/virtualization"
+        },
+        {
+          "label": "GPU an VM durchreichen",
+          "href": "/docs/hardware/gpu-vm-passthrough"
+        }
+      ]
+    },
+    {
+      "term": "IOMMU-Gruppe",
+      "category": "Virtualisierung",
+      "definitionRich": "Gerätegruppe als kleinste IOMMU-Isolationseinheit. Geräte innerhalb einer Gruppe sind nicht unbedingt gegeneinander isoliert; prüfen Sie vor VFIO-Zuweisungen alle Mitglieder. Auflisten mit <code>find /sys/kernel/iommu_groups/ -type l | sort -V</code>."
+    },
+    {
+      "term": "iSCSI",
+      "aliases": [
+        "Internet SCSI"
+      ],
+      "category": "Speicher",
+      "definitionRich": "Protokoll für Blockspeicher über IP: Ein entferntes Laufwerk erscheint als lokales SCSI-Gerät. In Proxmox mit <code>pvesm add iscsi</code> einbinden.",
+      "seeAlso": [
+        {
+          "label": "Hinzufügen von iSCSI-Ziel als Proxmox-Speicher",
+          "href": "/docs/storage-share/host-iscsi"
+        }
+      ]
+    },
+    {
+      "term": "KVM",
+      "aliases": [
+        "Kernel-basierte virtuelle Maschine"
+      ],
+      "category": "Virtualisierung",
+      "definitionRich": "Linux-Kernelmodul, das den Host zum Hypervisor macht. Zusammen mit <strong>QEMU</strong> für die Geräteemulation bildet es die Grundlage der Proxmox-VMs."
+    },
+    {
+      "term": "LVM",
+      "aliases": [
+        "Logical Volume Manager"
+      ],
+      "category": "Speicher",
+      "definitionRich": "Linux-Volumeverwaltung mit Volume Groups (VG) aus physischem Speicher und darin liegenden Logical Volumes (LV). LVM-basierte Proxmox-Installationen nutzen häufig LVM-thin für Gastlaufwerke; andere Speicherarten sind möglich. Werkzeuge: <code>pvs</code>, <code>vgs</code> und <code>lvs</code>.",
+      "seeAlso": [
+        {
+          "label": "Befehle für Speicher und Datenträger",
+          "href": "/docs/help-info/storage-commands"
+        }
+      ]
+    },
+    {
+      "term": "LXC",
+      "aliases": [
+        "Linux Containers"
+      ],
+      "category": "Linux",
+      "definitionRich": "Virtualisierung auf Betriebssystemebene: Isolierte Benutzerumgebungen teilen den Host-Kernel. Üblicherweise weniger Overhead als VMs, jedoch mit anderer Isolationsgrenze. Proxmox verwaltet LXC-Container über <code>pct</code>.",
+      "seeAlso": [
+        {
+          "label": "VMs und Container verwalten",
+          "href": "/docs/help-info/vm-ct-commands"
+        }
+      ]
+    },
+    {
+      "term": "Lynis",
+      "category": "Linux",
+      "definitionRich": "Open-Source-Sicherheitsprüfer von CISOfy. Analysiert den Host und liefert einen Härtungswert sowie konkrete Verbesserungsvorschläge. ProxMenux installiert die aktuelle Version aus dem ursprünglichen GitHub-Repository statt des älteren Debian-Pakets.",
+      "seeAlso": [
+        {
+          "label": "Lynis",
+          "href": "/docs/security/lynis"
+        }
+      ]
+    },
+    {
+      "term": "MAC-Adresse",
+      "aliases": [
+        "Hardware-Adresse"
+      ],
+      "category": "Netzwerk",
+      "definitionRich": "Meist 48-Bit-Kennung einer Ethernet-Schnittstelle, durch Hardware oder Software vergeben. ProxMenux ordnet unter <em>Persistente Netzwerknamen</em> MAC-Adressen feste Namen (<code>eno1</code>, <code>enp3s0</code>) zu, damit diese nach einer PCI-Neunummerierung gleich bleiben.",
+      "seeAlso": [
+        {
+          "label": "Persistente Schnittstellennamen",
+          "href": "/docs/network/persistent-names"
+        }
+      ]
+    },
+    {
+      "term": "MOTD",
+      "aliases": [
+        "Botschaft des Tages"
+      ],
+      "category": "Linux",
+      "definitionRich": "Text nach der SSH-Anmeldung, gespeichert in <code>/etc/motd</code>. ProxMenux kann bei der Nachinstallation ein Banner hinzufügen; der Deinstaller stellt die vorherige Datei wieder her, falls eine Sicherung existiert."
+    },
+    {
+      "term": "NFS",
+      "aliases": [
+        "Netzwerkdateisystem"
+      ],
+      "category": "Speicher",
+      "definitionRich": "Aus Unix stammendes Protokoll zur Dateifreigabe im Netzwerk. In Proxmox mit <code>pvesm add nfs</code> als Speicher einbinden; ProxMenux bietet außerdem eigene Abläufe für NFS-Clients und -Server in LXC.",
+      "seeAlso": [
+        {
+          "label": "Speicher- und Freigabemanager",
+          "href": "/docs/storage-share"
+        }
+      ]
+    },
+    {
+      "term": "nftables / iptables",
+      "category": "Netzwerk",
+      "definitionRich": "Linux-Firewallwerkzeuge. <code>nftables</code> ist das moderne Framework; <code>iptables</code> unterstützt klassische oder nft-kompatible Backends. Das klassische <code>pve-firewall</code> verwendet iptables, das alternative proxmox-firewall hingegen nftables.",
+      "seeAlso": [
+        {
+          "label": "Netzbefehle",
+          "href": "/docs/help-info/network-commands"
+        }
+      ]
+    },
+    {
+      "term": "nouveau",
+      "category": "Linux",
+      "definitionRich": "Offener NVIDIA-Grafiktreiber im Linux-Kernel. Beim Installieren des proprietären NVIDIA-Treibers verhindern Sie, dass nouveau dieselbe GPU belegt, üblicherweise durch Blacklisting und Neubauen des initramfs.",
+      "seeAlso": [
+        {
+          "label": "NVIDIA Installationsleitfaden",
+          "href": "/guides/nvidia"
+        }
+      ]
+    },
+    {
+      "term": "No-Subscription-Repository",
+      "category": "Proxmox",
+      "definitionRich": "Proxmox-Paketquelle ohne Enterprise-Abonnement. Pakete werden weniger umfassend validiert als im Enterprise-Repository, das Proxmox für den Produktivbetrieb empfiehlt. ProxMenux bietet die Repository-Konfiguration bei der Nachinstallation.",
+      "seeAlso": [
+        {
+          "label": "Post-Install: Grundeinstellungen",
+          "href": "/docs/post-install/basic-settings"
+        }
+      ]
+    },
+    {
+      "term": "OVA / OVF",
+      "aliases": [
+        "Open Virtualization Format"
+      ],
+      "category": "Virtualisierung",
+      "definitionRich": "DMTF-Formate zum Verpacken portabler VMs. <strong>OVA</strong> bündelt die Dateien in einem TAR-Archiv; <strong>OVF</strong> beschreibt die VM in XML mit zugehörigen Laufwerksdateien, häufig VMDK. Importmöglichkeiten hängen vom Zielhypervisor und der Konfiguration ab.",
+      "seeAlso": [
+        {
+          "label": "VM nach OVA / OVF exportieren",
+          "href": "/docs/utils/export-vm"
+        },
+        {
+          "label": "VM von OVA / OVF importieren",
+          "href": "/docs/utils/import-vm"
+        }
+      ]
+    },
+    {
+      "term": "OVMF",
+      "aliases": [
+        "UEFI Firmware",
+        "Open Virtual Machine Firmware"
+      ],
+      "category": "Virtualisierung",
+      "definitionRich": "UEFI-Firmware für VMs, auswählbar mit <code>qm set &lt;vmid&gt; -bios ovmf</code>. Für UEFI-Gäste, etwa Windows 11 und Secure-Boot-Konfigurationen. <code>efidisk0</code> speichert EFI-Variablen dauerhaft; viele andere Gäste können weiterhin klassisches BIOS nutzen.",
+      "seeAlso": [
+        {
+          "label": "GPU an VM durchreichen",
+          "href": "/docs/hardware/gpu-vm-passthrough"
+        }
+      ]
+    },
+    {
+      "term": "PBS",
+      "aliases": [
+        "Proxmox Backup Server"
+      ],
+      "category": "Proxmox",
+      "definitionRich": "Eigenständiges Proxmox-Sicherungsprodukt mit inkrementeller Übertragung, Deduplizierung und optionaler clientseitiger Verschlüsselung für VMs und CTs. Als vzdump-Ziel nutzbar; ein separater Backupserver ist Sicherungen auf dem geschützten Host vorzuziehen."
+    },
+    {
+      "term": "pct",
+      "category": "Proxmox",
+      "definitionRich": "Kommandozeilenwerkzeug für LXC-Container in Proxmox: <code>pct list / start / stop / shutdown / config / enter / exec / push / pull / destroy</code>.",
+      "seeAlso": [
+        {
+          "label": "VMs und Container verwalten",
+          "href": "/docs/help-info/vm-ct-commands"
+        }
+      ]
+    },
+    {
+      "term": "pmxcfs",
+      "aliases": [
+        "Proxmox Cluster Filesystem"
+      ],
+      "category": "Proxmox",
+      "definitionRich": "FUSE-basiertes virtuelles Dateisystem unter <code>/etc/pve/</code>. Repliziert Konfigurationsänderungen zwischen den Clusterknoten; Änderungen in <code>/etc/pve/</code> werden automatisch verteilt."
+    },
+    {
+      "term": "pveam",
+      "aliases": [
+        "Proxmox-VE-Appliance-Verwaltung"
+      ],
+      "category": "Proxmox",
+      "definitionRich": "Werkzeug für den lokalen CT-Vorlagenkatalog. <code>pveam update</code> aktualisiert den Index; <code>pveam available</code> listet Vorlagen auf und <code>pveam download &lt;storage&gt; &lt;template&gt;</code> lädt eine herunter."
+    },
+    {
+      "term": "pveproxy",
+      "category": "Proxmox",
+      "definitionRich": "HTTPS-Dienst für Proxmox-Weboberfläche und Webterminal auf Port 8006. Wird bei Hauptversions-Upgrades neu gestartet; deshalb verweigert ProxMenux das Upgrade PVE 8 → 9 im Webterminal."
+    },
+    {
+      "term": "pvesm",
+      "aliases": [
+        "Proxmox-Speicherverwaltung"
+      ],
+      "category": "Proxmox",
+      "definitionRich": "CLI-Tool zur Verwaltung von Proxmox-Speicher. <code>pvesm status</code> zeigt alle konfigurierten Speicher an; <code>pvesm add &lt;type&gt;</code> registriert neue (NFS, Samba, iSCSI, dir, ZFS, LVM, ...).",
+      "seeAlso": [
+        {
+          "label": "Befehle für Speicher und Datenträger",
+          "href": "/docs/help-info/storage-commands"
+        }
+      ]
+    },
+    {
+      "term": "Privilegierter Container",
+      "category": "Linux",
+      "definitionRich": "LXC-Container, dessen root-Benutzer <em>auf Host-UID 0 abgebildet wird</em>; Namespaces und weitere Einschränkungen gelten weiterhin. Weniger isoliert als unprivilegierte Container. GPU-, USB- und Samba-Zugriff benötigen diesen Modus nicht grundsätzlich; Berechtigungen und UID-Zuordnungen sind entscheidend."
+    },
+    {
+      "term": "ProxMenux Monitor",
+      "category": "ProxMenux",
+      "definitionRich": "Optionales Web-Dashboard für ProxMenux. Zeigt aktuelle Host-Statistiken zu CPU, RAM, Datenträgern und Netzwerk sowie eine VM-/LXC-Übersicht; Anmeldung mit 2FA über TCP-Port <code>8008</code>.",
+      "seeAlso": [
+        {
+          "label": "ProxMenux Monitor",
+          "href": "/docs/settings/proxmenux-monitor"
+        }
+      ]
+    },
+    {
+      "term": "qcow2",
+      "aliases": [
+        "QEMU Copy-On-Write v2"
+      ],
+      "category": "Speicher",
+      "definitionRich": "VM-Laufwerksformat, häufig auf Verzeichnisspeichern genutzt. Unterstützt bedarfsgerechte Speicherbelegung, Snapshots und Copy-on-Write. Konvertieren mit <code>qemu-img convert -O qcow2 ...</code>."
+    },
+    {
+      "term": "qm",
+      "aliases": [
+        "QEMU-Verwaltung"
+      ],
+      "category": "Proxmox",
+      "definitionRich": "Kommandozeilenwerkzeug für VMs in Proxmox: <code>qm list / start / stop / shutdown / config / set / destroy / importdisk / migrate</code>. Entspricht <code>pct</code> für Container.",
+      "seeAlso": [
+        {
+          "label": "VMs und Container verwalten",
+          "href": "/docs/help-info/vm-ct-commands"
+        }
+      ]
+    },
+    {
+      "term": "Q35",
+      "category": "Virtualisierung",
+      "definitionRich": "QEMU-Maschinentyp mit emuliertem Intel-Q35-Chipsatz und PCIe-Unterstützung. Gegenüber i440FX für PCIe-Passthrough und moderne Gäste empfohlen. Einstellen mit <code>qm set &lt;vmid&gt; -machine q35</code>."
+    },
+    {
+      "term": "QEMU",
+      "category": "Virtualisierung",
+      "definitionRich": "Freier Maschinenemulator und Virtualisierer. Proxmox kombiniert ihn mit KVM, um VMs mit nahezu nativer Leistung auszuführen."
+    },
+    {
+      "term": "rclone",
+      "category": "Linux",
+      "definitionRich": "Kommandozeilenwerkzeug für zahlreiche Cloudspeicher wie Google Drive, Dropbox, OneDrive, Mega und S3. Die Cloud-Backup-Anleitung nutzt es, um entfernten Speicher als Verzeichnis für vzdump-Archive einzuhängen.",
+      "seeAlso": [
+        {
+          "label": "Sicherungen in persönlichem Cloud-Speicher",
+          "href": "/guides/backup_cloud"
+        }
+      ]
+    },
+    {
+      "term": "Samba / SMB / CIFS",
+      "category": "Speicher",
+      "definitionRich": "Microsoft-Protokollfamilie für Dateifreigaben. <strong>SMB</strong> ist das Protokoll, <strong>Samba</strong> die freie Linux-Implementierung und <strong>CIFS</strong> ein älterer SMB-Dialekt. In Proxmox mit <code>pvesm add cifs</code> einbinden.",
+      "seeAlso": [
+        {
+          "label": "Speicher- und Freigabemanager",
+          "href": "/docs/storage-share"
+        }
+      ]
+    },
+    {
+      "term": "SeaBIOS",
+      "category": "Virtualisierung",
+      "definitionRich": "Freie Implementierung eines klassischen BIOS für QEMU. Standardfirmware neuer VMs, sofern nicht OVMF gewählt wird. Geeignet für ältere Systeme und Linux-Installationen ohne UEFI-Anforderung."
+    },
+    {
+      "term": "smartctl / SMART",
+      "aliases": [
+        "Self-Monitoring, Analysis and Reporting Technology"
+      ],
+      "category": "Speicher",
+      "definitionRich": "In Laufwerke integrierte Diagnose für Zustand, Fehlerzähler und Selbsttests. Das Kommandozeilenwerkzeug ist <code>smartctl</code> aus <code>smartmontools</code>; <code>nvme-cli</code> ergänzt NVMe-spezifische Befehle.",
+      "seeAlso": [
+        {
+          "label": "SMART-Festplattenstatus und -test",
+          "href": "/docs/disk-manager/smart-disk-test"
+        },
+        {
+          "label": "Speicherbefehle → SMART Abschnitt",
+          "href": "/docs/help-info/storage-commands"
+        }
+      ]
+    },
+    {
+      "term": "systemd / systemctl / journalctl",
+      "category": "Linux",
+      "definitionRich": "Init-System von Debian / Proxmox. <code>systemctl</code> verwaltet Dienste: starten, stoppen, aktivieren und Status anzeigen. <code>journalctl</code> liest das binäre Journal von <code>systemd-journald</code>."
+    },
+    {
+      "term": "sysctl",
+      "category": "Linux",
+      "definitionRich": "Werkzeug zum Lesen und Ändern von Kernelparametern. Dauerhafte Einstellungen stehen üblicherweise in <code>/etc/sysctl.d/*.conf</code>; die Unterstützung für <code>/etc/sysctl.conf</code> hängt vom Ladedienst ab. ProxMenux bietet bei der Nachinstallation ein sysctl-Profil.",
+      "seeAlso": [
+        {
+          "label": "Post-Install: Netzwerk",
+          "href": "/docs/post-install/network"
+        }
+      ]
+    },
+    {
+      "term": "trixie",
+      "category": "Linux",
+      "definitionRich": "Codename für Debian 13, die OS-Basis für Proxmox VE 9. Vorgänger: <em>bookworm</em> (Debian 12 / PVE 8).",
+      "seeAlso": [
+        {
+          "label": "Aktualisieren Sie PVE 8 auf PVE 9",
+          "href": "/docs/utils/upgrade-pve8-pve9"
+        }
+      ]
+    },
+    {
+      "term": "udev",
+      "category": "Linux",
+      "definitionRich": "Linux-Geräteverwaltung. Reagiert auf Hardware-Ereignisse und erstellt oder entfernt Einträge unter <code>/dev</code>. Regeln in <code>/etc/udev/rules.d/</code> können Schnittstellennamen an MAC-Adressen binden, NVIDIA-Gerätedateien beim Laden des Treibers erstellen und weitere Aufgaben übernehmen."
+    },
+    {
+      "term": "UID / GID idmap",
+      "aliases": [
+        "UID-Schaltung"
+      ],
+      "category": "Linux",
+      "definitionRich": "Bei der Standardzuordnung <strong>unprivilegierter</strong> LXC-Container sind Host-UIDs und -GIDs um <code>+100000</code> verschoben: Container-UID 0 entspricht Host-UID 100000, UID 1000 entspricht 101000. Eigene Zuordnungen können abweichen; Dateieigentümer auf Bind-Mounts müssen dazu passen.",
+      "seeAlso": [
+        {
+          "label": "LXC-Einhängepunkte",
+          "href": "/docs/storage-share/lxc-mount-points"
+        }
+      ]
+    },
+    {
+      "term": "Unprivilegierter Container",
+      "category": "Linux",
+      "definitionRich": "LXC-Container, dessen root auf eine unprivilegierte Host-UID abgebildet wird, normalerweise 100000. Das begrenzt Host-Rechte bei gemeinsamem Kernel. Hardwarezugriff bleibt mit passenden Geräteberechtigungen und Zuordnungen möglich; privilegierter Betrieb ist nicht grundsätzlich nötig."
+    },
+    {
+      "term": "VFIO",
+      "aliases": [
+        "Virtuelle Funktion I/O"
+      ],
+      "category": "Virtualisierung",
+      "definitionRich": "Linux-Kernel-Framework für sichere Gerätetreiber im Userspace, genutzt beim direkten Durchreichen von PCIe-Geräten an VMs. Beteiligt sind <code>vfio</code>, <code>vfio_iommu_type1</code> und <code>vfio_pci</code>; Konfiguration in <code>/etc/modprobe.d/vfio.conf</code>.",
+      "seeAlso": [
+        {
+          "label": "Post-Install: Virtualisierung",
+          "href": "/docs/post-install/virtualization"
+        }
+      ]
+    },
+    {
+      "term": "VirtIO",
+      "category": "Virtualisierung",
+      "definitionRich": "Paravirtualisierte Treiber für Netzwerk, Speicher, Memory-Ballooning und GPU. Vermeiden den Aufwand emulierter älterer Hardware wie e1000 oder IDE. Der Gast benötigt passende Treiber: in Linux enthalten, für Windows als separate ISO verfügbar."
+    },
+    {
+      "term": "VLAN",
+      "aliases": [
+        "Virtuelles LAN"
+      ],
+      "category": "Netzwerk",
+      "definitionRich": "802.1Q-Tags zur Aufteilung eines physischen Netzwerks in mehrere logische Netze. Pro Bridge oder Netzwerkschnittstelle in <code>/etc/network/interfaces</code> konfigurierbar."
+    },
+    {
+      "term": "VM",
+      "aliases": [
+        "Virtuelle Maschine"
+      ],
+      "category": "Proxmox",
+      "definitionRich": "Von Proxmox mit QEMU/KVM verwaltete virtuelle Maschine mit eigenem Gast-Kernel. Ihre numerische VMID entspricht <code>/etc/pve/qemu-server/&lt;VMID&gt;.conf</code>. Üblicherweise mehr Overhead als LXC, mit getrennter Kernel-Isolationsgrenze.",
+      "seeAlso": [
+        {
+          "label": "VMs und Container verwalten",
+          "href": "/docs/help-info/vm-ct-commands"
+        }
+      ]
+    },
+    {
+      "term": "vzdump",
+      "category": "Proxmox",
+      "definitionRich": "Proxmox-Sicherungswerkzeug für VMs und CTs. Dateiarchive sind <strong>nicht inkrementell</strong>; PBS-Ziele unterstützen inkrementelle Übertragungen. Aufträge legen Modus (snapshot / suspend / stop), Kompression (etwa zstd, gzip oder lzo), Aufbewahrung und Benachrichtigungen fest.",
+      "seeAlso": [
+        {
+          "label": "Befehle für Sicherung und Wiederherstellung",
+          "href": "/docs/help-info/backup-commands"
+        }
+      ]
+    },
+    {
+      "term": "ZFS",
+      "aliases": [
+        "Zettabyte File System"
+      ],
+      "category": "Speicher",
+      "definitionRich": "Dateisystem und Volumeverwaltung mit Snapshots, Send/Receive-Replikation, Prüfsummen und Kompression. Beschädigte Daten können mit einer gültigen redundanten Kopie repariert werden. Der Lesecache <strong>ARC</strong> nutzt RAM und lässt sich begrenzen.",
+      "seeAlso": [
+        {
+          "label": "Befehle zur ZFS-Verwaltung",
+          "href": "/docs/help-info/zfs-commands"
+        }
+      ]
+    }
+  ]
+}
diff --git a/web/messages/de/docs/hardware/coral-tpu-lxc.json b/web/messages/de/docs/hardware/coral-tpu-lxc.json
new file mode 100644
index 00000000..8ee10b68
--- /dev/null
+++ b/web/messages/de/docs/hardware/coral-tpu-lxc.json
@@ -0,0 +1,120 @@
+{
+  "meta": {
+    "title": "Coral TPU zu LXC hinzufügen | ProxMenux-Dokumentation",
+    "description": "Google Coral TPU per USB oder M.2 / PCIe in einem Proxmox-LXC nutzen. ProxMenux konfiguriert Geräte, Berechtigungen und Einhängepunkte, startet den Container und installiert die Edge-TPU-Laufzeit auf unterstützten Distributionen."
+  },
+  "header": {
+    "title": "Coral TPU zu LXC hinzufügen",
+    "description": "Coral USB Accelerator oder M.2 / Mini-PCIe in einem LXC nutzen. ProxMenux übernimmt Container-Konfiguration und Edge-TPU-Laufzeit. Diese Option betrifft nur die TPU; für Quick Sync, VA-API oder NVENC führen Sie zusätzlich GPU zu LXC hinzufügen aus.",
+    "section": "Hardware: GPUs und Coral-TPU"
+  },
+  "intro": {
+    "title": "Funktionsweise",
+    "body": "Schreibt die Konfiguration für <strong>USB Accelerator</strong>, <strong>M.2 / PCIe Coral</strong> oder beide in <code>/etc/pve/lxc/&lt;ctid&gt;.conf</code>. Startet den Container und installiert Googles <code>libedgetpu</code>-Laufzeit. GPU-Zugriff wird getrennt über <lxcGpuLink>GPU zu LXC hinzufügen</lxcGpuLink> eingerichtet."
+  },
+  "whenUse": {
+    "heading": "Anwendungsfälle",
+    "body": "Für <frigateLink>Frigate</frigateLink> oder andere kompatible Linux-Erkennungssoftware im LXC. Coral übernimmt unterstützte ML-Inferenz statt der CPU. Die Leistung hängt von Modell und Hardware ab; Videodekodierung und weitere Aufgaben benötigen weiterhin Ressourcen."
+  },
+  "prereqs": {
+    "title": "Vorbereitung",
+    "drivers": "<strong>Das Coral-Gerät auf dem Host vorbereiten</strong>. M.2 / PCIe benötigt den geladenen Host-Treiber, USB den Gerätezugriff mit passenden Berechtigungen. Siehe <hostLink>Coral TPU auf dem Host installieren</hostLink>. Das Skript installiert die Anwendungslaufzeit in Debian/Ubuntu-Containern; andere Distributionen müssen sie separat bereitstellen.",
+    "driversCheck": "ls /dev/apex_* 2>/dev/null ; lsusb | grep -E '1a6e:089a|18d1:9302'",
+    "container": "<strong>Vorhandener LXC-Container</strong>, vorzugsweise auf Basis von <strong>Debian / Ubuntu</strong>: Die Installation nutzt <code>apt-get</code>. <strong>Container anderer Distributionen</strong> können den <strong>reinen Passthrough-Modus</strong> nutzen, der die APT-Installation von <code>libedgetpu</code> überspringt. Geeignet, wenn die Anwendung die Laufzeit bereits mitbringt, etwa das Frigate-Docker-Image.",
+    "downtime": "<strong>Kurze Ausfallzeit einplanen</strong>. Das Skript stoppt den Container für die Konfiguration und startet ihn zur Laufzeitinstallation. Für diese Änderungen ist kein Host-Neustart nötig."
+  },
+  "hostPrep": {
+    "title": "Host muss zuerst vorbereitet werden",
+    "body": "M.2 / PCIe benötigt <code>gasket</code>/<code>apex</code> auf dem Host und einen funktionierenden Geräteknoten. USB benötigt das angeschlossene Gerät und Berechtigungen; die App muss nicht auf dem Host laufen. <code>libedgetpu</code> muss am Ausführungsort der App vorhanden sein. Reihenfolge: <strong>Host vorbereiten → LXC-Gerätezugriff → App einrichten</strong>."
+  },
+  "running": {
+    "heading": "Skript ausführen",
+    "body": "Öffnen Sie in ProxMenux <strong>Hardware: GPUs und Coral-TPU → Coral TPU zu LXC hinzufügen</strong>.",
+    "imageAlt": "Menüpunkt Coral TPU zu LXC hinzufügen im Hardware-Menü"
+  },
+  "howRuns": {
+    "heading": "Ablauf des Skripts",
+    "body": "Wählen Sie den Container. Das Skript richtet USB-Zugriff auch ohne angeschlossene USB-Coral ein und ergänzt M.2 / PCIe bei erkannter Hardware."
+  },
+  "walkthrough": {
+    "heading": "Schritt für Schritt",
+    "pick": {
+      "title": "LXC-Container auswählen",
+      "body": "Die Auswahl zeigt geeignete Container aus <code>pct list</code>; OCI-Container werden ausgeblendet und über Apps im OCI-Manager verwaltet. Wählen Sie einen laufenden oder gestoppten Container. Das Skript stoppt ihn bei Bedarf, konfiguriert ihn und startet die Laufzeitinstallation."
+    },
+    "gpuHint": {
+      "title": "Optionaler Hinweis zum GPU-Zugriff",
+      "body": "Wird eine GPU erkannt, die für diesen Container nicht konfiguriert ist, empfiehlt ein Dialog <lxcGpuLink>GPU zu LXC hinzufügen</lxcGpuLink> für die Hardware-Videodekodierung, etwa Quick Sync, VA-API oder NVENC. Er fragt, ob nur mit Coral fortgefahren werden soll: Ja setzt die TPU-Einrichtung fort, Nein beendet den Ablauf, damit Sie zuerst die GPU konfigurieren können."
+    },
+    "usb": {
+      "title": "USB-Zugriff im LXC konfigurieren",
+      "body": "Erstellt auf dem Host eine udev-Regel für <code>/dev/coral</code> und bindet den <strong>gesamten</strong> Baum <code>/dev/bus/usb</code> in den Container ein. Diese Konfiguration wird auch ohne angeschlossene USB-Coral geschrieben und stellt mehr als nur dieses Gerät bereit.",
+      "whyTitle": "Warum /dev/bus/usb statt /dev/coral?",
+      "whyBody": "Der USB-Pfad, etwa <code>/dev/bus/usb/001/005</code>, ändert sich beim Umstecken. Ältere Versionen banden den Link <code>/dev/coral</code> ein und konnten dadurch einen veralteten Pfad behalten. Der gesamte USB-Baum macht den aktuellen Geräteknoten sichtbar. Die Anwendung muss es gegebenenfalls erneut öffnen."
+    },
+    "pcie": {
+      "title": "M.2-/PCIe-Zugriff im LXC konfigurieren",
+      "body1": "Bei erkannter M.2-/PCIe-Coral und vorhandenem <code>/dev/apex_0</code> nutzt das Skript die Proxmox-API <code>dev</code> für cgroup2-Berechtigungen in privilegierten und unprivilegierten LXC:",
+      "body2": "Wenn nach <hostLink>Coral auf dem Host installieren</hostLink> kein <code>/dev/apex_0</code> vorhanden ist, schreibt das Skript einen Bind-Mount mit <code>create=file</code> und, nur wenn die Apex-Major-Nummer in <code>/proc/devices</code> aufgeführt ist, eine klassische cgroup2-Regel. Keines von beiden erzeugt ein funktionsfähiges Gerät:",
+      "rebootTitle": "Starten Sie den Host zuerst neu, wenn Sie gerade Coral-Treiber installiert haben",
+      "rebootBody": "Der Ersatz-Mount lädt den Host-Treiber <code>apex</code> nicht. Laden Sie ihn oder starten Sie nach der Installation neu und prüfen Sie das Gerät. Führen Sie das Skript danach erneut für den modernen Geräteeintrag aus und starten Sie den Container neu."
+    },
+    "drivers": {
+      "title": "LXC starten und Coral-Laufzeit installieren",
+      "body": "Startet den Container und wartet bis zu 15 Sekunden auf den Status running. Anschließend führt es den Installer über <code>pct exec</code> im Container aus. Dieser:",
+      "items": [
+        "Führt <code>apt-get update</code> aus.",
+        "Installiert die Voraussetzungen für das Coral-Repository: <code>gnupg</code>, <code>curl</code>, <code>ca-certificates</code>.",
+        "Importiert Googles Coral GPG-Schlüssel in <code>/etc/apt/keyrings/coral-edgetpu.gpg</code> (moderner Pfad, wie er vom Host-Installationsprogramm verwendet wird) und fügt das <code>coral-edgetpu-stable</code> APT-Repository mit <code>signed-by=</code> hinzu.",
+        "Installiert standardmäßig <code>libedgetpu1-std</code>. Bei erkannter M.2-Coral stehen <code>libedgetpu1-std</code> und <code>libedgetpu1-max</code> zur Wahl. Die Paketauswahl richtet die Erkennung in der Anwendung nicht automatisch ein."
+      ],
+      "noIgpuTitle": "Warum werden hier keine iGPU-Treiber installiert?",
+      "noIgpuBody": "Früher installierte es zusätzlich <code>va-driver-all</code>, <code>intel-opencl-icd</code> und weitere Intel-Pakete für Quick Sync neben Coral. Das führte zu verwirrenden Fehlern bei reiner Coral-Nutzung. Die iGPU richtet nun <lxcGpuLink>GPU zu LXC hinzufügen</lxcGpuLink> ein; führen Sie dies für Hardware-Videodekodierung zuerst aus.",
+      "debianTitle": "Andere Distributionen: nur Gerätezugriff",
+      "debianBody": "Nutzt <code>apt-get</code> unter Debian/Ubuntu. Bei <strong>Alpine, Arch, RHEL oder SUSE</strong>, erkannt über <code>/etc/os-release</code>, stehen <em>nur Gerätezugriff einrichten</em> und <em>abbrechen</em> zur Wahl. Ersteres schreibt <code>/etc/pve/lxc/&lt;ctid&gt;.conf</code>, ohne <code>libedgetpu</code> zu installieren. Bringt die App die Laufzeit mit, wie Frigate Docker, genügt dieser Modus. Sonst installieren Sie <code>libedgetpu</code> nach <coralLink>Googles offizieller Anleitung</coralLink>."
+    },
+    "summary": {
+      "title": "Zusammenfassung",
+      "body": "Am Ende zeigt eine Checkliste Coral USB und M.2 mit ✓ oder ⚠ je nach Hardware-Erkennung. Der Container läuft weiter, damit Sie Frigate, CodeProject.AI oder Ihre Anwendung konfigurieren können."
+    }
+  },
+  "manual": {
+    "heading": "Manuelle Vorgehensweise",
+    "body": "Wenn Sie genau sehen möchten, was in die LXC-Konfiguration geht, oder es von Hand anwenden:",
+    "usbHeading": "USB Coral",
+    "pcieHeading": "M.2 / PCIe Coral",
+    "runtimeHeading": "Im Container: Coral-Laufzeit"
+  },
+  "verification": {
+    "heading": "Überprüfung",
+    "body": "Öffnen Sie eine Shell im Container und prüfen Sie, ob Coral sichtbar ist:"
+  },
+  "troubleshoot": {
+    "heading": "Fehlerbehebung",
+    "apexTitle": "LXC gestartet, aber /dev/apex_0 fehlt",
+    "apexBody": "Prüfen Sie zuerst den Host-Treiber: <code>lsmod | grep apex</code>. Falls nicht geladen, versuchen Sie <code>modprobe apex</code> oder starten nach der Treiberinstallation neu. Sobald <code>/dev/apex_0</code> auf dem Host existiert, prüfen Sie den LXC-Geräteeintrag (führen Sie das Skript erneut aus, wenn nur die Ersatzeinträge geschrieben wurden) und starten den Container mit <code>pct stop &lt;ctid&gt; &amp;&amp; pct start &lt;ctid&gt;</code> neu.",
+    "replugTitle": "USB-Coral verschwindet nach Anschluss an einen anderen Port",
+    "replugBody": "Prüfen Sie, ob der LXC <code>/dev/bus/usb</code> statt des Links <code>/dev/coral</code> einbindet. Die Konfiguration sollte <code>lxc.mount.entry: /dev/bus/usb dev/bus/usb ...</code> enthalten und nicht direkt von <code>/dev/coral</code> abhängen. Führen Sie bei alten Konfigurationen das Skript erneut aus.",
+    "alpineTitle": "Alpine / Arch / RHEL / SUSE: Laufzeit nicht installiert",
+    "alpineBody": "Im <em>reinen Passthrough-Modus</em> wird das Gerät konfiguriert, aber <code>libedgetpu</code> nicht installiert. Nutzen Sie ein kompatibles Community-Paket oder bauen Sie aus dem Quellcode; prüfen Sie vor Befehlen wie Alpines <code>apk add</code> die Paketverfügbarkeit. Frigate kann die Laufzeit mitbringen. Bei Docker im LXC zusätzlich M.2 mit <code>--device /dev/apex_0:/dev/apex_0</code> durchreichen oder den USB-Baum in Docker einbinden; der LXC-Mount allein reicht nicht.",
+    "frigateTitle": "Frigate meldet „Coral EdgeTPU detected but not available“",
+    "frigateBody": "Prüfen Sie Laufzeit, Gerätesichtbarkeit und Lese-/Schreibrechte des tatsächlichen App-Prozesses. Bei USB Berechtigungen und gegebenenfalls <code>plugdev</code>-Mitgliedschaft prüfen. Bei M.2 <code>/dev/apex_0</code> mit <code>ls -l /dev/apex_0</code> prüfen. Ein Name wie <code>apex</code> in <code>/etc/group</code> genügt nicht: Numerische GIDs und LXC-Zuordnungen müssen stimmen. Prüfen Sie auch eine Belegung durch andere Prozesse; wechseln Sie nicht zuerst in den privilegierten Modus.",
+    "logsTitle": "Überprüfen Sie sowohl Host- als auch Containerprotokolle",
+    "logsBody": "Auf dem Host Gerätemeldungen mit <code>journalctl -k | grep -i -e apex -e gasket -e usb</code> prüfen. Im LXC die App-Protokolle lesen; bei verschachteltem Docker <code>docker logs &lt;container&gt;</code> nutzen. Ursachen können Berechtigungen, fehlende Laufzeit, USB-Verbindung oder ein anderer TPU-Prozess sein."
+  },
+  "related": {
+    "heading": "Verwandte Themen",
+    "items": [
+      {
+        "label": "Coral TPU auf dem Host installieren",
+        "href": "/docs/hardware/install-coral-tpu-host",
+        "tail": " — Voraussetzung für M.2-/PCIe-Coral-Karten vor der Nutzung im CT."
+      },
+      {
+        "label": "GPU zu LXC hinzufügen",
+        "href": "/docs/hardware/igpu-acceleration-lxc",
+        "tail": " — GPU-Zugriff, der bei Frigate häufig mit Coral kombiniert wird."
+      }
+    ]
+  }
+}
diff --git a/web/messages/de/docs/hardware/gpu-vm-passthrough.json b/web/messages/de/docs/hardware/gpu-vm-passthrough.json
new file mode 100644
index 00000000..fc378283
--- /dev/null
+++ b/web/messages/de/docs/hardware/gpu-vm-passthrough.json
@@ -0,0 +1,178 @@
+{
+  "meta": {
+    "title": "GPU zu VM hinzufügen | ProxMenux-Dokumentation",
+    "description": "Physische GPU einer Proxmox-VM zuweisen. ProxMenux prüft IOMMU, konfiguriert VFIO und VM-Geräte und erkennt Konflikte mit anderen VMs oder LXC."
+  },
+  "header": {
+    "title": "GPU zu VM hinzufügen (Passthrough)",
+    "description": "Erkennt Intel-, AMD- oder NVIDIA-GPUs und bereitet direkten VM-Zugriff vor. Prüft IOMMU und zugehörige Geräte, konfiguriert VFIO und VM und wendet Kompatibilitätsregeln an. Alle betroffenen Geräte prüfen.",
+    "section": "Hardware: GPUs und Coral-TPU"
+  },
+  "intro": {
+    "title": "Funktionsweise",
+    "body": "Automatisiert Host- und <code>hostpci</code>-Schritte der <pveLink>Proxmox-PCI-Passthrough-Dokumentation</pveLink>. Prüft Zuweisungen in <em>anderen</em> Gästen und bietet Konfliktlösungen. Garantiert keine Unterstützung jeder GPU, Resetmethode oder jedes Gasttreibers."
+  },
+  "who": {
+    "heading": "Für wen ist das?",
+    "body": "Für direkten GPU-Zugriff einer <strong>virtuellen Maschine</strong> über VFIO. Solange die GPU an VFIO gebunden ist, kann der Host-Treiber sie auch bei gestoppter VM nicht nutzen. Für <em>LXC</em>-Freigabe siehe <lxcLink>GPU zu LXC hinzufügen</lxcLink>."
+  },
+  "prereqs": {
+    "title": "Vorbereitung",
+    "gpu": "Physisch installierte <strong>kompatible GPU</strong>. Das Skript erkennt Intel, AMD und NVIDIA mit <code>lspci</code>.",
+    "gpuCheck": "lspci | grep -iE 'VGA|3D|Display'",
+    "iommu": "<strong>IOMMU-Unterstützung</strong> in Hardware und gegebenenfalls Firmware nötig (Intel VT-d oder AMD-Vi). Prüft das laufende System und kann Linux-Bootparameter setzen; ändert kein BIOS/UEFI und beweist bei inaktivem IOMMU keinen Firmwarefehler.",
+    "q35": "Dieser Assistent verlangt <strong>q35</strong> und lehnt <code>i440fx</code> ab. Maschinentyp und BIOS/UEFI-Firmware sind getrennte Einstellungen. Chipsetwechsel bestehender VMs muss geplant werden und erfolgt nicht automatisch.",
+    "q35Check": "qm config VMID | grep machine",
+    "moreGpus": "<strong>Zweite GPU oder alternativen Zugang</strong> über SSH, IPMI oder seriell vorbereiten. Die Haupt-GPU-Zuweisung kann die lokale Anzeige abschalten. Bei <em>NVIDIA</em> kann eine Karte außerhalb der betroffenen IOMMU-Gruppe auf dem Host bleiben.",
+    "nvidiaInstalled": "Nach <nvidiaLink>NVIDIA-Treiberinstallation auf dem Host</nvidiaLink> werden ausgewählte Funktionen für <code>vfio-pci</code> statt <code>nvidia</code> reserviert. Das Modul <code>nvidia</code> kann für <strong>andere</strong> Karten außerhalb der betroffenen IOMMU-Gruppe verfügbar bleiben. Mit <code>nvidia-smi</code> prüfen."
+  },
+  "pickOne": {
+    "title": "Exklusive VM-Zuweisung oder LXC-Freigabe",
+    "body": "Ein GPU, der an <code>vfio-pci</code> für den VM-Durchgang gebunden ist, kann nicht gleichzeitig vom Host oder einem LXC verwendet werden. Wenn Sie zwei GPUs haben, können Sie jedem Pfad eine widmen. Wenn Sie nur eine haben, wählen Sie:",
+    "vmItem": "<strong>VM:</strong> direkter, exklusiver Zugriff für diese VM.",
+    "lxcItem": "<strong>LXC (<lxcLink>GPU zu LXC hinzufügen</lxcLink>):</strong> teilt das Gerät über den nativen Treiber mit Host und anderen Containern."
+  },
+  "running": {
+    "heading": "Installationsprogramm ausführen",
+    "body": "Öffnen Sie ProxMenux und wählen Sie <strong>Hardware: GPUs und Coral-TPU → GPU zu VM hinzufügen</strong>.",
+    "imageAlt": "Menüeintrag zum Hinzufügen einer GPU zur VM"
+  },
+  "howRuns": {
+    "heading": "Ablauf des Skripts",
+    "body": "Erkennung und Auswahl gehen den Hauptänderungen voraus; eine Zusammenfassung bestätigt den Plan. IOMMU-Aktivierung hat zuvor eine eigene Bestätigung und kann bereits Bootdateien ändern. Spätere Audiobereinigung kann ebenfalls eine Auswahl verlangen."
+  },
+  "walkthrough": {
+    "heading": "Schritt für Schritt",
+    "detect": {
+      "title": "GPUs erkennen und IOMMU überprüfen",
+      "body": "Betrachtet IOMMU nur dann als aktiv, wenn der laufende Kernel <code>intel_iommu=on</code> oder <code>amd_iommu=on</code> hat und IOMMU-Gruppen existieren. Ist der Parameter bereits für den nächsten Start gespeichert, wird im Modus „Neustart ausstehend“ fortgefahren; andernfalls kann ein separat bestätigter Schritt ihn mit <code>iommu=pt</code> ergänzen. Die Heuristik für die Bootdatei nutzt <code>/etc/kernel/cmdline</code>, wenn dort ein ZFS-Root-Marker wie <code>root=ZFS=</code> vorhanden ist, sonst <code>/etc/default/grub</code>. Diese Heuristik ist kein Nachweis des tatsächlichen Bootloaders. Neu konfiguriertes IOMMU wird nach dem Neustart aktiv; prüfen Sie danach die tatsächlichen Gruppen.",
+      "tipTitle": "Nachinstallation bereits eingerichtet?",
+      "tipBody": "Bei bereits konfiguriertem und aktivem <postLink>VFIO-IOMMU-Support</postLink> besteht die Prüfung. Eine Einstellung für den nächsten Start allein beweist keinen aktiven Zustand.",
+      "imageAlt": "Liste der erkannten GPUs mit Hersteller- und PCI-Adresse"
+    },
+    "preflight": {
+      "title": "GPU auswählen und Vorabprüfungen ausführen",
+      "intro": "Sobald Sie den GPU ausgewählt haben, führt das Skript eine Reihe von Überprüfungen aus, die jeden weiteren Fortschritt blockieren können:",
+      "items": [
+        "<strong>SR-IOV-Prüfung.</strong> Verweigert VFs und PFs mit aktiven VFs, da dieser Ablauf vollständige Geräte statt SR-IOV einrichtet. SR-IOV auf unterstützter Hardware separat konfigurieren.",
+        "<strong>Nur eine GPU.</strong> Die lokale Konsole kann durch VFIO ihre Ausgabe verlieren. Zuvor SSH- oder Webzugriff von einem anderen Rechner prüfen.",
+        "<strong>AMD-Reset-Richtlinie.</strong> Liest <code>/sys/bus/pci/devices/&lt;pci&gt;/reset_method</code>. APU oder dedizierte Karte ohne FLR wird <em>durch die Assistentenrichtlinie blockiert</em>; unbekannter Untertyp ohne FLR verlangt Bestätigung. Dies beweist keine generelle technische Unmöglichkeit.",
+        "<strong>D3cold-Zustand.</strong> AMD-Karten mit gemeldetem <code>D3cold</code> werden wegen möglicher Aktivierungsfehler blockiert. Stromversorgung und Firmware prüfen.",
+        "<strong>Analyse der IOMMU-Gruppe.</strong> Liest <code>/sys/kernel/iommu_groups/</code> und nimmt <em>alle Nicht-Brücken-Geräte</em> in den VM-Plan auf, möglicherweise auch Netzwerk- oder Speichercontroller. Enthält die Gruppe Geräte aus einem anderen Slot, listet das Skript sie vor der Zusammenfassung auf; prüfen Sie, dass der Host keines davon benötigt. Steht der IOMMU-Neustart noch aus, sind die tatsächlichen Gruppen nicht verfügbar und der Plan enthält zunächst nur die gewählte GPU-Funktion; prüfen Sie die Isolation nach dem Neustart."
+      ],
+      "audioIntro": "<strong>Zugehöriges Audio.</strong> Zwei Fälle je nach Controllerposition:",
+      "audioDgpu": "<strong>Dedizierte GPU:</strong> HDMI-Audio liegt oft auf Funktion <code>.1</code> desselben PCI-Slots und wird bei Erkennung aufgenommen. Nutzt der Host es bisher, verliert er durch die VM-Reservierung den Zugriff.",
+      "audioIgpu": "<strong>Ohne Audiofunktion <code>.1</code>:</strong> kann Audio auf einem anderen Gerät wie <code>00:1f.3</code> liegen. Controller mit Treibern wie <code>snd_hda_intel</code> werden gelistet. Standardmäßig <strong>keiner</strong> ausgewählt; nur benötigte wählen."
+    },
+    "pickVm": {
+      "title": "Ziel-VM auswählen",
+      "body": "VM aus der Liste wählen. Der Assistent verlangt q35 und verwendet vorhandene GPU-Einträge soweit möglich weiter. BIOS/UEFI ist eine separate Einstellung, kein Maschinentyp. Chipset und Bootmodus werden nicht automatisch geändert.",
+      "imageAlt": "VM-Auswahl nach Name, ID und Status"
+    },
+    "switchMode": {
+      "title": "Vorhandene Zuweisungen behandeln",
+      "intro": "Das Skript scannt jede VM-Konfiguration und jede LXC-Konfiguration auf dem Host, der nach dem von Ihnen ausgewählten GPU sucht. Drei mögliche Ergebnisse:",
+      "items": [
+        "<strong>GPU verfügbar.</strong> Fortfahren ohne alte Zuweisung zu entfernen.",
+        "<strong>Anderer VM zugewiesen.</strong> Quell-VM zuerst stoppen. Entweder <em>Einträge behalten und Autostart deaktivieren</em> oder <em>Einträge entfernen und Autostart behalten</em>. Bei bestehendem <code>vfio-pci</code> ohne nötige Hoständerungen kann VM→VM ohne Host-Neustart erfolgen.",
+        "<strong>Von LXC genutzte GPU.</strong> Bei normalen Containern wählen Sie <em>GPU-Konfiguration behalten und Autostart deaktivieren</em> oder <em>GPU-Gerätekonfiguration entfernen und Autostart behalten</em>. Das Entfernen löscht die <code>devN</code>-Einträge und bei AMD/Intel auch alte <code>/dev/dri</code>-Regeln <code>lxc.mount.entry</code> und <code>lxc.cgroup2.devices.allow</code>. OCI-Container behalten ihre Konfiguration und werden mit deaktiviertem Autostart gestoppt; entfernen Sie ihre GPU über OCI manager Apps. Die Konflikterkennung erfolgt nach GPU-Gerätefamilie und kann weitere Karten dieser Familie erfassen."
+      ],
+      "imageAlt": "Dialogangebot zum Entfernen des GPU aus einem LXC, bevor es dem VM zugewiesen wird",
+      "smartTitle": "Zugehöriges Audio beim Entfernen prüfen",
+      "smartBody": "Danach kann eine Liste <strong>möglicherweise nicht mehr benötigter Audiogeräte</strong> erscheinen. Weiter benötigte abwählen. Beispielsweise bleibt <code>02:00.1</code>, während <code>00:1f.3</code> zur Entfernung angeboten wird. Die Auswahl bestimmt die Entfernung; keine universelle Audio-/Bildzuordnung ist garantiert."
+    },
+    "audioPick": {
+      "title": "Ohne .1-Audio benötigte Controller auswählen",
+      "body": "Dies gilt nur für Intel iGPU und ähnliche Split-Audio-Setups. Eine Checkliste zeigt jeden PCI-Audiocontroller auf dem Host (mit Ausnahme eines bereits in der IOMMU-Gruppe von GPU) mit seinem aktuellen Treiber. Wählen Sie die gewünschten aus - oder keine, wenn der VM kein Audio von der Host-Hardware benötigt.",
+      "imageAlt": "Checklistendialog mit jedem Host-PCI-Audiocontroller (BDF + Treiber), wenn der GPU kein .1-Geschwister-Audio hat",
+      "warnTitle": "Kein vom Host benötigtes Audio auswählen",
+      "warnBody": "Audiozuweisung kann dem Host den Zugriff nehmen; derselbe Controller kann nicht gleichzeitig einer anderen laufenden VM gehören. Unnötiges Audio nicht wählen und Zuweisungen prüfen. Der Konsolenpiep kommt nicht zwingend von PCI-Audio."
+    },
+    "summary": {
+      "title": "Überprüfung der Bestätigungszusammenfassung",
+      "body": "Prüfen Sie den endgültigen Host- und VM-Plan und brechen Sie bei Fehlern ab. Er zeigt die IOMMU-Gruppe und die Anzahl ihrer Geräte; Mitglieder aus einem anderen Slot werden im vorherigen Schritt aufgelistet. Der Abbruch verhindert die Hauptänderungen, macht aber eine zuvor separat bestätigte Änderung der IOMMU-Bootkonfiguration nicht rückgängig.",
+      "imageAlt": "Übersicht geplanter Änderungen an Host und VM"
+    },
+    "hostApply": {
+      "title": "Host Änderungen werden angewendet",
+      "intro": "Die Anwendung ändert Host und VM. Zugehörige Audiobereinigung kann weiterhin eine Auswahl verlangen. Mögliche Hoständerungen:",
+      "items": [
+        "<code>/etc/modules</code> — fügt <code>vfio</code>, <code>vfio_iommu_type1</code>, <code>vfio_pci</code> hinzu (plus <code>vfio_virqfd</code> auf Kernen &lt; 6.2).",
+        "<code>/etc/modprobe.d/vfio.conf</code> — AMD/Intel: <code>options vfio-pci ids=&lt;vendor:device,...&gt; disable_vga=1</code>. NVIDIA: <code>softdep nvidia pre: vfio-pci</code> (<code>_drm</code>/<code>_modeset</code>/<code>_uvm</code>); die eigentliche Bindung erfolgt pro BDF. AMD ergänzt die Ladereihenfolge <code>softdep</code>: <code>vfio-pci</code> → <code>radeon</code>/<code>amdgpu</code>.",
+        "Schreibt <code>/etc/modprobe.d/iommu_unsafe_interrupts.conf</code> und <code>kvm.conf</code> mit <code>allow_unsafe_interrupts=1</code> und <code>ignore_msrs=1</code>. Kompatibilitätseinstellungen des Skripts, keine allgemeinen Windows/macOS-Anforderungen; unsichere Interrupts schwächen den Interrupt-Remapping-Schutz.",
+        "<code>/etc/modprobe.d/blacklist.conf</code>: NVIDIA — <code>nouveau</code>/<code>lbm-nouveau</code>; AMD — <code>radeon</code> + <code>amdgpu</code>; Intel — <code>i915</code>. Diese herstellerweiten Regeln können andere Karten mit demselben Treiber betreffen. Das Modul <code>nvidia</code> wird <strong>nur</strong> über <code>/etc/modprobe.d/proxmenux-nvidia-vfio-blacklist.conf</code> blockiert, wenn <em>alle</em> NVIDIA-Karten für VFIO erfasst sind.",
+        "<code>/etc/udev/rules.d/10-proxmenux-vfio-bind.rules</code> + <code>/etc/proxmenux/vfio-bind.bdfs</code> — <strong>Nur NVIDIA.</strong> Setzt <code>ATTR'{'driver_override'}'=\"vfio-pci\"</code> bei PCI ADD für erfasste BDFs einschließlich betroffener IOMMU-Gruppenfunktionen. Außerhalb kann <code>nvidia</code> erhalten bleiben. BDF-Regeln teilen keine Hardware-IOMMU-Gruppe.",
+        "<strong>Nur AMD.</strong> Versucht, das ROM aus <code>/sys/bus/pci/.../rom</code> oder ACPI VFCT nach <code>/usr/share/kvm/vbios_&lt;vendor&gt;_&lt;device&gt;.bin</code> zu sichern. Bei Erfolg nutzt die VM <code>romfile=</code>. Ein gültiger Dump garantiert keine erfolgreiche GPU-Initialisierung.",
+        "<strong>Nur NVIDIA.</strong> Stoppt und deaktiviert <code>nvidia-persistenced</code>, <code>nvidia-powerd</code>, <code>nvidia-fabricmanager</code> nur, wenn alle NVIDIA-Karten VFIO zugeordnet sind. Im Mischbetrieb bleiben Dienste und <code>nvidia</code> für native Karten erhalten.",
+        "<code>update-initramfs -u -k all</code> — läuft nur, wenn einer der oben genannten tatsächlich geändert."
+      ]
+    },
+    "vmApply": {
+      "title": "VM config wird über qm set angewendet",
+      "body": "Die VM-Konfiguration bei <code>/etc/pve/qemu-server/&lt;vmid&gt;.conf</code> wird über <code>qm set</code> aktualisiert (nie direkt über <code>sed</code>):",
+      "after1": "Setzt <code>x-vga=1</code> für AMD und NVIDIA, <strong>nicht</strong> Intel. Dies ist die Skriptrichtlinie und kein Beleg, dass jeder Intel-iGPU Firmware fehlt oder das Flag immer Hänger verursacht.",
+      "after2": "Zusätzliche <code>hostpciN</code>-Leitungen werden angehängt, wenn die IOMMU-Gruppe des GPU andere Geräte enthält, die Sie zusammen übergeben müssen."
+    },
+    "reboot": {
+      "title": "Bei erforderlicher Hoständerung neu starten",
+      "body": "Neustarthinweise bei Boot- oder Treiberänderungen befolgen und aktive GPU-Bindung vor VM-Start prüfen. Gespeicherte Konfiguration beweist keine aktive Anwendung. VM→VM mit korrektem VFIO kann ohne Host-Neustart erfolgen.",
+      "imageAlt": "Zusammenfassungsbildschirm zeigt, was geändert wurde, gefolgt von einer Neustartaufforderung"
+    }
+  },
+  "vendors": {
+    "heading": "Herstellerspezifische Hinweise",
+    "nvidiaHeading": "NVIDIA",
+    "nvidiaBody": "Behält einen älteren <em>Code-43</em>-Workaround: <code>hidden=1</code>, ID <code>NV43FIX</code> in <code>args</code> und <code>kvm=off</code>. Kein allgemeines Erfordernis aktueller GeForce-Treiber: NVIDIA aktivierte Windows-VM-Passthrough ab R465. Der Fehler kann andere Ursachen haben; Kombination prüfen.",
+    "nvidiaMultiHeading": "Multi-GPU NVIDIA Unterstützung",
+    "nvidiaMultiBody": "Gemischte NVIDIA-Nutzung <strong>pro BDF</strong>. Erfasst Funktionen für <code>vfio-pci</code> nach Adresse statt nur <code>vendor:device</code>. Außerhalb betroffener Gruppen kann <code>nvidia</code> bleiben; mit <code>nvidia-smi</code> prüfen. Karten derselben Gruppe werden dadurch nicht isoliert.",
+    "amdHeading": "AMD",
+    "amdBody": "Manche AMD-GPUs lassen sich nach VM-Stopp nicht zurücksetzen. Der Assistent prüft gemeldete Fähigkeiten, nicht alle realen Zyklen. <vendorResetLink>vendor-reset</vendorResetLink> unterstützt begrenzte Geräte, kompatible Kernel und frühes Laden; wird nicht installiert. <em>RadeonResetBugFix</em> unter Windows ist ebenfalls hardwareabhängig, keine allgemeine Lösung.",
+    "intelHeading": "Intel iGPU",
+    "intelBody": "Vollständiges Intel-iGPU-Passthrough und SR-IOV sind getrennte Abläufe. Dieser Assistent reserviert das Gerät für eine VM ohne <code>x-vga=1</code>. <sriovLink>i915-sriov-dkms</sriovLink> verlangt unterstützte Hardware/Kernel; „UHD 630+“ ist keine Kompatibilitätsregel. Alternativen Host-Zugang planen."
+  },
+  "verification": {
+    "heading": "Überprüfung"
+  },
+  "troubleshoot": {
+    "heading": "Fehlerbehebung",
+    "code43Title": "Code 43 in Windows (NVIDIA)",
+    "code43Body": "Code 43 beweist keinen KVM-Versteckfehler. <code>qm config VMID | grep -E \"cpu|args\"</code> mit echter VMID prüfen, ebenso <code>hidden=1</code> und <code>hv_vendor_id=NV43FIX</code>. Auch Gasttreiber, Firmware und Zuweisung prüfen. Erneutes Ausführen kann bei vorhandener Zuweisung sofort enden.",
+    "amdResetTitle": "AMD GPU funktioniert einmal, schlägt beim Neustart von VM fehl",
+    "amdResetBody": "Resetfehler sind eine mögliche Ursache. Host-Neustart oder Aus-/Einschalten kann vorübergehend helfen. Unterstützung und frühes Laden von <code>vendor-reset</code> prüfen; <code>softdep amdgpu pre: vendor-reset</code> allein garantiert kein Laden vor VFIO. Auch <em>RadeonResetBugFix</em> unter Windows benötigt kompatible Hardware.",
+    "stuckBootTitle": "VM hängengebliebenes Booten / GPU nicht erkannt",
+    "stuckBootBody": "Reale Adresse mit <code>lspci -nnk -s PCI_ADDRESS</code> prüfen; erwartet <code>Kernel driver in use: vfio-pci</code>. PCI_ADDRESS ersetzen. Bei nativem Treiber Bindungspolitik prüfen, nicht nur <code>/etc/modprobe.d/blacklist.conf</code>; NVIDIA nutzt BDF-Status. <code>dmesg | grep vfio</code> lesen. Nach Korrektur <code>update-initramfs -u -k all</code> und Neustartplan befolgen.",
+    "darkTitle": "Host-Konsole wird nach dem Neustart dunkel und ich kann SSH nicht in",
+    "darkBody": "Schwarzes Bild bedeutet nicht, dass der Host ausgefallen ist. Bei SSH-Ausfall Netzwerk und Controller in der IOMMU-Gruppe prüfen. Über IPMI, seriell oder Rettungsumgebung zugreifen; <code>/etc/pve/qemu-server/&lt;vmid&gt;.conf</code> prüfen und nur relevante Zuweisungen/Bindungen zurücknehmen. Keine fremde Konfiguration löschen.",
+    "logTitle": "Überprüfen Sie das Installationsprotokoll",
+    "logBody": "Jeder Durchlauf schreibt <code>/tmp/add_gpu_vm.log</code>. Bei Hilfsanfragen beifügen."
+  },
+  "revert": {
+    "heading": "Änderungen manuell zurücknehmen",
+    "intro": "VM stoppen und nur relevante PCI-Zuweisungen unter Hardware oder mit dem gezeigten Index entfernen. Das gibt die GPU noch nicht dem nativen Host-Treiber zurück. Dafür GPU-Modus wechseln verwenden und betroffene Gäste vor Bestätigung prüfen."
+  },
+  "related": {
+    "heading": "Verwandte Themen",
+    "items": [
+      {
+        "label": "Installieren Sie NVIDIA Treiber (Host)",
+        "href": "/docs/hardware/nvidia-host",
+        "tail": " — Host-Treiber für nativ verbleibende Karten vorbereiten; eine VFIO-GPU kann ihn nicht gleichzeitig nutzen."
+      },
+      {
+        "label": "GPU zu LXC hinzufügen",
+        "href": "/docs/hardware/igpu-acceleration-lxc",
+        "tail": "Alternatives Modell: Teilen Sie den GPU mit mehreren Containern, anstatt ihn einem VM zu widmen."
+      },
+      {
+        "label": "GPU-Modus wechseln (VM ↔ LXC)",
+        "href": "/docs/hardware/switch-gpu-mode",
+        "tail": " — dieselbe GPU zwischen Freigabe und exklusiver Zuweisung wechseln."
+      },
+      {
+        "label": "GPU Durchgangsbefehle",
+        "href": "/docs/help-info/gpu-commands",
+        "tail": " — lspci, IOMMU-Prüfung und Referenz zu qm set hostpci."
+      }
+    ]
+  }
+}
diff --git a/web/messages/de/docs/hardware/igpu-acceleration-lxc.json b/web/messages/de/docs/hardware/igpu-acceleration-lxc.json
new file mode 100644
index 00000000..0f7d0b61
--- /dev/null
+++ b/web/messages/de/docs/hardware/igpu-acceleration-lxc.json
@@ -0,0 +1,185 @@
+{
+  "meta": {
+    "title": "GPU zu LXC hinzufügen | ProxMenux-Dokumentation",
+    "description": "Intel-, AMD- oder NVIDIA-GPU mit LXC teilen. ProxMenux richtet Geräte, Gruppen und Bibliotheken passend zur Distribution ein; die App muss Beschleunigung unterstützen und entsprechend eingerichtet sein."
+  },
+  "header": {
+    "title": "GPU zu LXC hinzufügen",
+    "description": "GPU-Zugriff über Host-Geräteknoten mit LXC teilen. Der Treiber bleibt auf dem Host; Anwendungen brauchen kompatible Bibliotheken und eigene Einstellungen.",
+    "section": "Hardware: GPUs und Coral-TPU"
+  },
+  "intro": {
+    "title": "Funktionsweise",
+    "body": "Fügt <code>dev&lt;N&gt;</code>-Einträge zu <code>/etc/pve/lxc/&lt;ctid&gt;.conf</code> für passende <code>/dev/dri/*</code>-, <code>/dev/kfd</code>- oder <code>/dev/nvidia*</code>-Knoten hinzu. Startet den Container, installiert Userspace-Pakete für dessen Distribution und gleicht bei Intel/AMD die Gruppen <code>video</code> und <code>render</code> ab. Die Anwendungsbeschleunigung erfordert weiterhin kompatible Hardware, Bibliotheken und App-Einstellungen."
+  },
+  "compare": {
+    "heading": "LXC-Freigabe und VM-Passthrough im Vergleich",
+    "intro": "LXC teilt den Kernel und kann die GPU zwischen Host und Containern <em>teilen</em>. Bei <vmLink>vollständigem VM-Passthrough</vmLink> gehört das Gerät exklusiv zur VM und steht dem Host-Treiber nicht zur Verfügung.",
+    "headerFeature": "Merkmal",
+    "headerLxc": "LXC (diese Seite)",
+    "headerVm": "VM",
+    "rows": [
+      {
+        "feature": "Kann der Host die GPU weiter nutzen?",
+        "lxc": "Ja",
+        "vm": "Nein — ausschließlich für VM"
+      },
+      {
+        "feature": "Mehrere Container teilen sich einen GPU?",
+        "lxc": "Ja",
+        "vm": "Nein"
+      },
+      {
+        "feature": "Benötigt IOMMU / VFIO auf dem Host?",
+        "lxc": "Nein",
+        "vm": "Ja"
+      },
+      {
+        "feature": "Reboot erforderlich?",
+        "lxc": "Normalerweise nein (neustarten Sie einfach den CT)",
+        "vm": "Bei Änderungen am Host-Treiber oder IOMMU; nicht bei jeder Zuweisung"
+      },
+      {
+        "feature": "Gastbetriebssysteme",
+        "lxc": "Nur Linux (LXC ist nur Linux)",
+        "vm": "Unterstütztes Gastsystem mit kompatiblem GPU-Treiber"
+      }
+    ]
+  },
+  "prereqs": {
+    "title": "Vorbereitung",
+    "gpu": "<strong>GPU auf dem Host</strong> von Intel, AMD oder NVIDIA, erkannt mit <code>lspci</code>.",
+    "gpuCheck": "lspci | grep -iE 'VGA|3D|Display'",
+    "vfio": "<strong>Die GPU darf nicht an vfio-pci gebunden sein.</strong> Sie benötigt den nativen Host-Treiber. Bei VM-Zuweisung bietet das Skript <switchLink>GPU-Modus wechseln</switchLink> an.",
+    "nvidia": "<strong>Für NVIDIA:</strong> zuerst den Host-Treiber installieren. Die Containerbibliotheken müssen zur Version passen. Siehe <nvidiaLink>NVIDIA-Treiber auf dem Host installieren</nvidiaLink>.",
+    "nvidiaCheck": "nvidia-smi",
+    "container": "<strong>Vorhandener LXC-Container.</strong> Das Skript erstellt keinen. Beide Modi werden unterstützt; <strong>privilegiert</strong> ist nicht grundsätzlich nötig. Geräteeinträge und numerische App-Gruppenrechte müssen passen."
+  },
+  "unpriv": {
+    "title": "Unterstützt privilegierte und unprivilegierte Container",
+    "body": "Das Skript schreibt <code>dev&lt;N&gt;</code>-Einträge in die LXC-Konfiguration und richtet auf unprivilegierten Containern die <code>video</code>- und <code>render</code>-GIDs zwischen Host und Container so aus, dass die GPU-Geräteknoten von innen erreichbar sind, ohne dass Sie <code>lxc.idmap</code> von Hand bearbeiten müssen."
+  },
+  "running": {
+    "heading": "Installationsprogramm ausführen",
+    "body": "Öffnen Sie ProxMenux und wählen Sie <strong>Hardware: GPUs und Coral-TPU → GPU zu LXC hinzufügen</strong>.",
+    "imageAlt": "Menüeintrag zum Hinzufügen einer GPU zu LXC"
+  },
+  "howRuns": {
+    "heading": "Ablauf des Skripts",
+    "body": "Container und GPU-Familien auswählen und Prüfungen durchlaufen. Danach wird der Container ohne weitere Abschlussbestätigung gestoppt und geändert. Optionale VFIO-Bereinigung wird separat bestätigt und kann den Host vorher ändern."
+  },
+  "walkthrough": {
+    "heading": "Schritt für Schritt",
+    "detect": {
+      "title": "Host-GPUs erkennen",
+      "body": "Sucht GPU-Controller mit <code>lspci</code>. Prüft für NVIDIA das Modul <code>nvidia</code> und <code>nvidia-smi</code>; die erkannte Version bestimmt den <code>.run</code>-Installer für den Container.",
+      "tipTitle": "NVIDIA nicht bereit?",
+      "tipBody": "Wenn Modul oder NVIDIA-Funktion auf dem Host fehlen, zuerst <nvidiaLink>NVIDIA-Treiber auf dem Host installieren</nvidiaLink> und den Treiber prüfen."
+    },
+    "pickCt": {
+      "title": "LXC-Container auswählen",
+      "body": "Listet geeignete LXC-Container mit ID und Name; OCI-Container sind ausgeschlossen und nutzen für Geräte OCI manager Apps. Der Container wird gestoppt, falls er läuft, zur Treiberinstallation gestartet und normalerweise in seinen ursprünglichen Zustand (laufend/gestoppt) zurückversetzt.",
+      "imageAlt": "Auswahl eines vorhandenen LXC-Containers"
+    },
+    "selectGpu": {
+      "title": "GPU-Familien auswählen",
+      "body": "Die Liste wählt Herstellerfamilien, kein isoliertes PCI-Gerät. Intel/AMD fügen die vorgesehenen DRI-Knoten hinzu; NVIDIA seine verfügbaren Geräteknoten, möglicherweise für mehrere Karten. Eine einzelne Familie wird automatisch gewählt. Ergebnis besonders bei mehreren GPUs prüfen.",
+      "imageAlt": "Liste erkannter GPU-Familien mit Name und PCI-Adresse"
+    },
+    "preflight": {
+      "title": "Vorabprüfungen",
+      "imageAlt": "Angebot zum Moduswechsel einer an vfio-pci gebundenen GPU",
+      "intro": "Drei Prüfungen können den Ablauf stoppen oder umleiten:",
+      "items": [
+        "<strong>SR-IOV-Prüfung.</strong> Der Assistent blockiert eine VF oder PF mit aktiven VFs. Das liegt an seiner breiten Geräteauswahl und ist kein generelles LXC-Verbot. Solche Geräte separat konfigurieren.",
+        "<strong>An vfio-pci gebunden.</strong> Der native Treiber kann keine <code>/dev/dri/*</code>- oder <code>/dev/nvidia*</code>-Geräte anlegen. <switchLink>GPU-Modus wechseln</switchLink> wird angeboten; Neustarthinweise befolgen und erneut starten.",
+        "<strong>Bereits eingerichtet.</strong> Sind alle Geräte vorhanden, beendet das Skript sich ohne Bibliotheks-Neuinstallation. Fehlende ausgewählte Familien werden weiter bearbeitet."
+      ]
+    },
+    "applyConfig": {
+      "title": "Anwenden der LXC-Konfigurationsänderungen",
+      "body1": "Stoppt den Container, falls er läuft, und bearbeitet <code>/etc/pve/lxc/&lt;ctid&gt;.conf</code>. Nummerierte <code>dev&lt;N&gt;</code>-Einträge enthalten die Host-GID von <code>video</code> oder <code>render</code>. Vorhandene <code>lxc.mount.entry</code>-Bind-Zeilen für <code>/dev/dri</code> werden durch <code>dev:</code>-Einträge ersetzt; prüfen Sie die resultierende Konfiguration und die Rechte.",
+      "body2": "Beispiel nach Intel + NVIDIA auf demselben Container:"
+    },
+    "installDrivers": {
+      "title": "Starten Sie den Container und installieren Sie Treiber im Inneren",
+      "body": "Startet den Container und wartet bis zu etwa 30 Sekunden auf <code>pct exec</code>. Erkennt die Distribution aus <code>/etc/os-release</code> und installiert passende Pakete.",
+      "headerDistro": "Distribution",
+      "headerInt": "Intel / AMD",
+      "headerNvidia": "NVIDIA",
+      "rows": [
+        {
+          "distro": "Alpine",
+          "intel": "apk add mesa-va-gallium intel-media-driver libva-utils",
+          "nvidia": "apk add nvidia-utils"
+        },
+        {
+          "distro": "Arch / Manjaro",
+          "intel": "pacman -Sy intel-media-driver mesa libva-utils",
+          "nvidia": "pacman -Sy nvidia-utils"
+        }
+      ],
+      "debianDistro": "Debian / Ubuntu / andere",
+      "debianIntel": "apt-get install va-driver-all intel-opencl-icd vainfo",
+      "debianNvidia": "<code>.run</code> auf dem Host entpacken → <code>pct push</code> → mit <code>--no-kernel-modules --no-dkms</code> installieren.",
+      "whyTitle": "Warum Debian den NVIDIA-.run-Installer nutzt",
+      "whyBody": "Repository-Pakete passen möglicherweise nicht zum Host. Bibliotheken <strong>müssen zum geladenen Host-Modul passen</strong>, etwa für <code>nvidia-smi</code>. Debian/glibc nutzt den zwischengespeicherten <code>.run</code>-Installer der Host-Version, entpackt und archiviert ihn auf dem Host, überträgt mit <code>pct push</code> und installiert mit <code>--no-kernel-modules --no-dkms</code>. Alpine und Arch nutzen Repository-Pakete; Versionen prüfen."
+    },
+    "alignGids": {
+      "title": "GIDs ausrichten und Zustand wiederherstellen",
+      "body1": "Liest bei Intel/AMD die Host-GIDs von <code>video</code> und <code>render</code>, wobei 44/104 nur als Ersatzwerte dienen, und passt dann <code>/etc/group</code> im Container entsprechend an; reine NVIDIA-Durchläufe überspringen diesen Schritt. Einträge wie <code>video:44</code> und <code>render:104</code> sind Beispiele, keine universellen IDs. Prüfen Sie die App-Mitgliedschaft und die wirksamen Geräterechte.",
+      "body2": "Bei normalem Abschluss wird ein ursprünglich gestoppter Container erneut gestoppt; ein laufender bleibt aktiv. Bei Start- oder Installationsfehlern Endzustand und Protokoll prüfen."
+    }
+  },
+  "vendors": {
+    "heading": "Herstellerspezifische Hinweise",
+    "intelHeading": "Intel iGPU",
+    "intelBody": "Intel-Medienbeschleunigung, einschließlich <em>Quick Sync</em>, hängt von GPU-Generation, Codecs und App-Einstellungen ab. Das Skript teilt diejenigen von <code>/dev/dri/card0</code>, <code>card1</code>, <code>renderD128</code> und <code>renderD129</code>, die vorhanden sind; andere Knotennummern werden nicht hinzugefügt. Der Host muss sie bereits über seinen nativen Treiber bereitstellen, etwa <code>i915</code>.",
+    "amdHeading": "AMD",
+    "amdBody": "AMD nutzt DRI für Mesa/VA-API. Vorhandenes <code>/dev/kfd</code> wird ebenfalls geteilt. ROCm/OpenCL benötigt unterstützte Hardware und passende Bibliotheken; die Gerätefreigabe installiert keinen vollständigen ROCm-Stack.",
+    "nvidiaHeading": "NVIDIA",
+    "nvidiaBody": "Teilt verfügbare <code>/dev/nvidia*</code>-Geräte. <strong>Passende Treiberversionen</strong> sind für <code>nvidia-smi</code> entscheidend. Debian/glibc nutzt den <code>.run</code>-Installer der Host-Version, Alpine/Arch Repository-Pakete. Unter 2048 MiB konfiguriertem RAM bietet der Debian-Pfad eine vorübergehende Erhöhung mit Wiederherstellung; benötigt außerdem 1500 MiB freien Plattenplatz.",
+    "updateTitle": "Nach Host-NVIDIA-Update Containerbibliotheken prüfen",
+    "updateBody": "Alte Bibliotheken können in <code>nvidia-smi</code> Versionsfehler verursachen. Der <nvidiaLink>NVIDIA-Host-Installer</nvidiaLink> bietet Containerupdates. Erneutes Hinzufügen kann bei vorhandenen Geräten sofort enden und garantiert kein Bibliotheksupdate. Versionen prüfen und passende Pakete oder Userspace-Installation aktualisieren."
+  },
+  "verification": {
+    "heading": "Überprüfung",
+    "body": "Im Container prüfen, ob die GPU sichtbar und nutzbar ist."
+  },
+  "troubleshoot": {
+    "heading": "Fehlerbehebung",
+    "mismatchTitle": "nvidia-smi: Failed to initialize NVML: Driver/library version mismatch",
+    "mismatchBody": "Bibliotheken passen nicht zum geladenen Host-Modul. Versionen prüfen und Container-Userspace aktualisieren. Der zwischengespeicherte <code>.run</code>-Installer gilt für Debian/glibc; bei vorhandenen Geräteeinträgen kann das Hinzufügen vorher enden.",
+    "denyTitle": "Genehmigung verweigert auf /dev/dri/renderD128 im Container",
+    "denyBody": "Geräteeintrag und numerische Rechte der Gruppe <code>render</code> prüfen; App-Benutzer muss zu <code>render</code> gehören. Falls verfügbar, mit <code>usermod -aG render &lt;user&gt;</code> zu <code>render</code> hinzufügen; Platzhalter durch Kontonamen ersetzen. Sitzung neu starten. Privilegmoduswechsel ist keine allgemeine Lösung.",
+    "vainfoTitle": "vainfo sagt: VA-API Version 1.xx; konnte nicht initialisiert werden",
+    "vainfoBody": "Gerätezugriff und VA-API-Treiber prüfen. Paketnamen hängen von der Distribution ab: etwa <code>intel-media-driver</code> für unterstützte neuere Intel-GPUs, <code>i965-va-driver</code> für ältere und <code>mesa-va-drivers</code> für AMD. Die Meldung allein beweist kein fehlendes Paket.",
+    "logTitle": "Installationsprotokoll",
+    "logBody": "Jeder Durchlauf schreibt <code>/tmp/add_gpu_lxc.log</code> auf dem Host. Bei Hilfsanfragen beifügen."
+  },
+  "related": {
+    "heading": "Verwandte Themen",
+    "items": [
+      {
+        "label": "Installieren Sie NVIDIA Treiber (Host)",
+        "href": "/docs/hardware/nvidia-host",
+        "tail": " — Host-Treiber vor der NVIDIA-Freigabe installieren."
+      },
+      {
+        "label": "GPU zu VM hinzufügen (Passthrough)",
+        "href": "/docs/hardware/gpu-vm-passthrough",
+        "tail": " — Alternative für eine exklusiv zugewiesene VM-GPU."
+      },
+      {
+        "label": "GPU-Modus wechseln (VM ↔ LXC)",
+        "href": "/docs/hardware/switch-gpu-mode",
+        "tail": " — GPU zwischen LXC-Freigabe und VM-Zuweisung wechseln."
+      },
+      {
+        "label": "GPU Durchgangsbefehle",
+        "href": "/docs/help-info/gpu-commands",
+        "tail": "Schnellreferenz für verwandte Shell-Befehle."
+      }
+    ]
+  }
+}
diff --git a/web/messages/de/docs/hardware/install-coral-tpu-host.json b/web/messages/de/docs/hardware/install-coral-tpu-host.json
new file mode 100644
index 00000000..850b06ea
--- /dev/null
+++ b/web/messages/de/docs/hardware/install-coral-tpu-host.json
@@ -0,0 +1,203 @@
+{
+  "meta": {
+    "title": "Coral TPU auf dem Host installieren | ProxMenux-Dokumentation",
+    "description": "Installiert Coral-Komponenten auf Proxmox VE nach erkannter Hardware: gasket/apex mit DKMS für M.2 / Mini-PCIe und libedgetpu1-std für USB. Bei beiden Gerätetypen werden beide Abläufe ausgeführt."
+  },
+  "header": {
+    "title": "Coral TPU auf dem Host installieren",
+    "description": "Proxmox-Host für Coral und spätere LXC-Nutzung vorbereiten. Erkennt M.2 / Mini-PCIe, USB oder beide und führt passende Abläufe aus: DKMS-Module für PCIe und Google-Edge-TPU-Laufzeit für USB.",
+    "section": "Hardware: GPUs und Coral-TPU"
+  },
+  "intro": {
+    "title": "Funktionsweise",
+    "body": "Ein <strong>gemeinsamer Installer mit Hardware-Erkennung</strong>. PCIe nutzt <code>gasket</code> und <code>apex</code> mit DKMS; spätere Builds brauchen kompatible Quellen und Headers. USB nutzt <code>libedgetpu1-std</code>. Bei beiden Gerätetypen laufen beide Pfade. Die USB-Laufzeit gehört zum Ausführungsort der App; für reine LXC-Nutzung ist sie auf dem Host nicht grundsätzlich nötig."
+  },
+  "which": {
+    "heading": "Welche Coral habe ich?",
+    "body": "PCIe- und USB-Modelle unterscheiden sich in Bauform und Anforderungen. Das Skript unterstützt beide; identifizieren Sie Ihr Gerät vor dem Start.",
+    "headerForm": "Formfaktor",
+    "headerDetect": "Detektion",
+    "headerInstall": "Art der Installation",
+    "headerReboot": "Neu starten?",
+    "pcieForm": "M.2 / Mini-PCIe",
+    "pcieFormSub": "(M.2-Karten gibt es mit einer oder zwei Edge TPUs)",
+    "pcieDetect": "PCI-Herstellerkennung <code>1ac1</code>",
+    "pcieInstall": "Kernel-Modul (gasket + apex) über DKMS",
+    "pcieReboot": "Ja",
+    "usbForm": "USB-Beschleuniger",
+    "usbFormSub": "(kleiner Kunststoff-Dongle)",
+    "usbDetect": "USB <code>1a6e:089a</code> (unprogrammiert) / <code>18d1:9302</code> (programmiert)",
+    "usbInstall": "Userspace-Laufzeit <code>libedgetpu1-std</code> aus Googles APT-Repository",
+    "usbReboot": "Nein"
+  },
+  "prereqs": {
+    "title": "Vorbereitung",
+    "coral": "<strong>Angeschlossene Coral TPU</strong> (M.2, Mini-PCIe oder USB) für die Installation. Ohne erkannte Hardware kann das Skript vorhandene Komponenten bereinigen oder entfernen, installiert aber keinen neuen Hardwarepfad.",
+    "coralCheck": "lspci -d 1ac1: ; lsusb | grep -E '1a6e:089a|18d1:9302'",
+    "internet": "<strong>Internetzugang</strong> auf dem Host zum Klonen des PCIe-Treibers von GitHub oder zum Herunterladen von <code>libedgetpu1-std</code> aus Googles APT-Repository für USB.",
+    "headers": "<strong>Über APT verfügbare Kernel-Header</strong>: <code>proxmox-headers-$(uname -r)</code>. Nur für PCIe/M.2 nötig; das Skript installiert sie.",
+    "reboot": "<strong>Neustart für PCIe einplanen</strong>. Das Skript versucht, die gebauten Module zu laden; ein Neustart prüft auch das automatische Laden."
+  },
+  "hostPrepTip": {
+    "title": "Dies bereitet nur den Host vor",
+    "body": "Bereitet den Host für den <em>Gerätezugriff</em> vor; Anwendungen werden weder eingerichtet noch getestet. Um Coral etwa mit Frigate zu <em>nutzen</em>, folgen Sie <lxcLink>Coral TPU zu einem LXC hinzufügen</lxcLink>."
+  },
+  "running": {
+    "heading": "Installationsprogramm ausführen",
+    "body": "Öffnen Sie ProxMenux auf dem Host und wählen Sie <strong>Hardware: GPUs und Coral-TPU → Coral TPU auf dem Host installieren/aktualisieren</strong>.",
+    "imageAlt": "Menüeintrag zur Installation oder Aktualisierung von Coral TPU auf dem Host"
+  },
+  "howRuns": {
+    "heading": "Ablauf des Skripts",
+    "body": "Zuerst werden Hardware und Installationsplan ermittelt. Die Installation erfordert eine Bestätigung."
+  },
+  "walkthrough": {
+    "heading": "Schritt für Schritt",
+    "detect": {
+      "title": "Hardwareerkennung",
+      "body": "Sucht in <code>/sys/bus/pci/devices/*/vendor</code> nach Hersteller <code>0x1ac1</code> und erkennt USB-Geräte mit <code>lsusb</code>. Es gibt <strong>zwei</strong> USB-IDs, abhängig vom Firmwarezustand:",
+      "items": [
+        "<code>1a6e:089a</code> — Global Unichip, <em>unprogrammiert</em>, bevor die Laufzeit die Firmware lädt.",
+        "<code>18d1:9302</code> — Google, <em>programmiert</em>, nach dem Laden der Firmware."
+      ],
+      "outro": "Ohne erkannte Coral und vorhandene Installation endet das Skript mit einem Hinweis. Vorhandene Komponenten können weiterhin das Bereinigungs- oder Entfernungsmenü auslösen."
+    },
+    "prompt": {
+      "title": "Installationsbestätigung",
+      "body": "Vor der Installation zeigt ein Dialog Geräte und geplante Komponenten. Abbrechen überspringt die Installation. Die optionale Altbereinigung hat zuvor eine eigene Bestätigung.",
+      "imageAlt": "Übersicht erkannter Coral-Geräte und Installationsschritte"
+    },
+    "pcie": {
+      "title": "PCIe: Kernelmodule gasket und apex über DKMS",
+      "body": "Läuft nur bei erkannter PCIe-/M.2-Coral. Die Module werden für den aktuell laufenden Host-Kernel gebaut.",
+      "items": [
+        "<strong>Bereinigung.</strong> Ein vorhandenes <code>gasket-dkms</code>-Paket wird vor dem Neubau entfernt; befindet es sich in einem fehlerhaften Paketstatus, erzwingt das Skript dessen Entfernung und Purge.",
+        "<strong>Build-Abhängigkeiten:</strong> <code>git</code>, <code>dkms</code>, <code>build-essential</code>, <code>proxmox-headers-$(uname -r)</code>."
+      ],
+      "cloneIntro": "<strong>Treiberquellen klonen.</strong> Bevorzugt <feranickLink>feranick/gasket-driver</feranickLink>, ersatzweise <googleLink>google/gasket-driver</googleLink>. Ein erfolgreicher Build setzt Kernelkompatibilität voraus. Die Google-Quellen erhalten folgende versionsabhängige Patches:",
+      "kernelPatches": [
+        "Ab Kernel 6.5 ersetzt der Fallback-Patch <code>no_llseek</code> durch <code>noop_llseek</code>.",
+        "Ab Kernel 6.13: Argument von <code>MODULE_IMPORT_NS(DMA_BUF)</code> in ein Zeichenkettenliteral umwandeln."
+      ],
+      "afterItems": [
+        "<strong>Quellen nach <code>/usr/src/gasket-1.0/</code> kopieren,</strong> <code>dkms.conf</code> erzeugen und mit <code>dkms add</code> registrieren.",
+        "<strong>Bauen und installieren:</strong> <code>dkms build</code>, danach <code>dkms install</code>. Bei Fehlern zeigt das Skript die letzten 50 Zeilen von <code>make.log</code>, sofern vorhanden.",
+        "<strong>Gruppe <code>apex</code> und udev-Regeln erstellen</strong> (<code>/etc/udev/rules.d/99-coral-apex.rules</code>), um <code>/dev/apex_*</code> der Gruppe zuzuordnen.",
+        "<strong>Module zu laden versuchen:</strong> <code>modprobe gasket</code> und <code>modprobe apex</code>."
+      ],
+      "imageAlt": "DKMS-Build und Laden der gasket/apex-Module"
+    },
+    "usb": {
+      "title": "USB: Edge-TPU-Laufzeit von Google",
+      "body": "Läuft nur, wenn ein USB-Beschleuniger erkannt wurde. Viel einfacher:",
+      "items": [
+        "<strong>Googles GPG-Schlüssel hinzufügen</strong>: <code>/etc/apt/keyrings/coral-edgetpu.gpg</code>.",
+        "<strong>APT-Repository hinzufügen</strong> in <code>/etc/apt/sources.list.d/coral-edgetpu.list</code>; <code>signed-by=</code> beschränkt die Prüfung auf dessen Schlüsselbund. Dies ist einzeilige .list-Syntax, keine deb822-.sources-Syntax.",
+        "<strong><code>libedgetpu1-std</code> installieren</strong>, die Edge-TPU-Laufzeit mit Standardleistung.",
+        "<strong>udev neu laden</strong> und die Paketregeln auf das USB-Gerät anwenden."
+      ],
+      "stdTitle": "Warum libedgetpu1-std und nicht libedgetpu1-max?",
+      "stdBody": "Das Paket <code>max</code> aktiviert den maximal unterstützten Takt mit höherer Leistung, Stromaufnahme und Wärme. Vor dem Wechsel Kühlung und Betriebsbedingungen prüfen. Die Pakete schließen sich gegenseitig aus; wechseln mit <code>apt install libedgetpu1-max</code>."
+    },
+    "reboot": {
+      "title": "Optionaler Neustart nach PCIe-Installation",
+      "body": "Nach PCIe wird ein Neustart angeboten. <code>modprobe</code> wurde versucht; prüfen Sie geladene Module und <code>/dev/apex_0</code> mit Gruppe <code>apex</code>. Ein geplanter Neustart prüft automatisches Laden. Bei reiner USB-Installation wird kein Host-Neustart angeboten.",
+      "imageAlt": "Zusammenfassung und Neustartangebot nach PCIe-Installation"
+    }
+  },
+  "legacyCleanup": {
+    "heading": "Altes gasket-dkms auf reinen USB-Hosts bereinigen",
+    "intro": "Wenn <strong>keine PCIe-/M.2-Coral erkannt wird</strong>, aber eine alte <code>gasket-dkms</code>-Installation existiert, wird eine optionale Bereinigung angeboten. Sie erfordert eine Bestätigung.",
+    "items": [
+      "Bei erkannter PCIe-/M.2-Coral wird stattdessen der normale DKMS-Neubau verwendet; diese Bereinigung wird nicht angeboten.",
+      "Entfernt <code>gasket-dkms</code>, alte gasket-DKMS-Einträge und Quellen und repariert ausstehende <code>dpkg</code>-/APT-Vorgänge.",
+      "Die USB-Pakete <code>libedgetpu1-std</code> und <code>libedgetpu1-max</code> bleiben erhalten, sodass die USB-Coral ihre Laufzeit behält.",
+      "Das Skript überprüft, ob das Legacy-Paket verschwunden ist und dass das Paketmanagement gesund ist, bevor der Erfolg gemeldet wird."
+    ],
+    "warningTitle": "Bestätigen Sie zuerst die Hardware",
+    "warningBody": "Wenn eine erwartete PCIe-/M.2-Coral fehlt, Bereinigung abbrechen und Karte, Steckplatz sowie Firmware prüfen."
+  },
+  "reinstallUninstall": {
+    "heading": "Neuinstallieren oder Deinstallieren",
+    "intro": "Bei erkannter PCIe-Installation mit <code>gasket-dkms</code>, USB mit <code>libedgetpu1-std</code>/<code>libedgetpu1-max</code> oder beiden erscheint ein Aktionsmenü.",
+    "imageAlt": "Menü zum Neuinstallieren, Aktualisieren oder Entfernen von Coral",
+    "imageCaption": "Das Menü erscheint bei vorhandenen Komponenten: gasket-DKMS-Eintrag, Paket <code>libedgetpu1-*</code> oder Geräte <code>/dev/apex_*</code>.",
+    "reinstallHeading": "Neuinstallation / Update",
+    "reinstallBody": "Führt die normale Installation aus: Neubau nach Kernelwechsel oder Aktualisierung von <code>libedgetpu1-*</code> aus Googles Repository. Bereinigt zuvor alten DKMS-Status, damit ein fehlgeschlagener Versuch den Build nicht blockiert.",
+    "uninstallHeading": "Deinstallieren – Was entfernt wird",
+    "uninstallIntro": "Erfordert eine Bestätigung. LXC-Apps mit <code>/dev/apex_*</code> können während der Entfernung oder nach dem nächsten Neustart den Zugriff verlieren. Ablauf:",
+    "uninstallItems": [
+      "Versucht, <code>apex</code> und <code>gasket</code> zu entladen; aktive Nutzung kann dies verhindern.",
+      "Entfernt jeden DKMS-registrierten <code>gasket/&lt;version&gt;</code>-Eintrag, damit die Module nicht bei der nächsten Kernel-Installation zurückkommen.",
+      "Entfernt <code>gasket-dkms</code>, <code>libedgetpu1-std</code> und <code>libedgetpu1-max</code> vollständig und führt <code>apt-get autoremove --purge</code> aus.",
+      "Löscht <code>/etc/udev/rules.d/99-coral-apex.rules</code> und stellt die Standardgruppe in <code>60-gasket-dkms.rules</code> wieder her, falls vorhanden.",
+      "Prüft die zusätzlichen Mitglieder von <code>apex</code>. <strong>Bei leerer Liste</strong> wird die Gruppe zu entfernen versucht, sonst bleibt <code>apex</code> mit Mitgliederhinweis erhalten. Benutzer mit dieser primären Gruppe werden nicht vollständig geprüft.",
+      "Entfernt die Repository-Liste <code>/etc/apt/sources.list.d/coral-edgetpu.list</code>, die alte <code>coral-cloud.list</code> und alte Schlüsselbunde namens <code>coral-edgetpu-archive-keyring.gpg</code>. Der aktuelle Schlüsselbund unter <code>/etc/apt/keyrings/coral-edgetpu.gpg</code> wird durch diesen Ablauf nicht entfernt.",
+      "Bietet einen Neustart <strong>nur bei zuvor installiertem PCIe-Pfad</strong> an, um noch aktive Module zu entladen. Reine USB-Entfernung braucht keinen Neustart."
+    ],
+    "lxcWarnTitle": "LXC Container mit apex Passthrough",
+    "lxcWarnBody": "Das Entfernen der Host-Komponenten kann den LXC-Gerätezugriff unterbrechen. Wartung einplanen, wenn kompatible Anwendungen wie Frigate diese Coral benötigen."
+  },
+  "updates": {
+    "heading": "Update-Benachrichtigungen",
+    "intro": "ProxMenux erfasst installierte Coral-Komponenten und prüft PCIe/M.2 und USB getrennt. Sind beide vorhanden, nutzt jede Variante ihre eigene Versionsquelle:",
+    "headerVariant": "Variante",
+    "headerTracked": "Erfasste Version",
+    "headerUpstream": "Versionsquelle",
+    "pcieVariant": "PCIe / M.2",
+    "pcieTracked": "Zuerst das nach erfolgreicher Installation erfasste Release-Tag, dann die Version eines intakten <code>gasket-dkms</code>-Pakets, ersatzweise die DKMS-Modulversion. Diese allein gibt den Patchstand des Forks nicht an.",
+    "pcieUpstream": "Neuestes GitHub-Tag von <code>feranick/gasket-driver</code>; sieben Tage Cache und Vergleich der Buildnummer.",
+    "usbVariant": "USB",
+    "usbTracked": "<code>libedgetpu1-std</code> oder <code>libedgetpu1-max</code> apt Version",
+    "usbUpstream": "Lokaler <code>apt-cache policy</code>-Kandidat (Google Coral apt repo)",
+    "outro": "Bei einer neueren Version sendet Monitor <code>coral_driver_update_available</code> über aktivierte Kanäle. Der Hinweis führt zum Installer: <strong>Neu installieren / aktualisieren</strong> auswählen.",
+    "antiTitle": "Keine wiederholten Hinweise",
+    "antiBody": "Ein Hinweis je Variante bei neuer verfügbarer Version. Keine Wiederholung bei jeder täglichen Prüfung; erst eine weitere Version löst den nächsten Hinweis aus.",
+    "rebootTitle": "PCIe-Updates: Neustart einplanen",
+    "rebootBody": "Ein neu gebautes PCIe-Modul muss geladen werden; ein geplanter Neustart prüft auch automatisches Laden. Das USB-Bibliotheksupdate braucht keinen Host-Neustart, aber Anwendungen mit der alten Bibliothek müssen gegebenenfalls neu starten."
+  },
+  "manual": {
+    "heading": "Manuelle Vorgehensweise",
+    "intro": "Diese Befehle zeigen die wichtigsten Schritte beider Pfade zum Nachlesen oder manuellen Ausführen.",
+    "pcieHeading": "PCIe / M.2 (gasket + apex über DKMS)",
+    "usbHeading": "USB (libedgetpu-Laufzeit)"
+  },
+  "verification": {
+    "heading": "Überprüfung",
+    "pcieHeading": "PCIe / M.2",
+    "usbHeading": "USB"
+  },
+  "troubleshoot": {
+    "heading": "Fehlerbehebung",
+    "dkmsFailTitle": "DKMS-Build schlägt nach Kernelupdate fehl",
+    "dkmsFailBody": "Fehlende Header sind eine mögliche Ursache. <code>proxmox-headers-$(uname -r)</code> mit <code>dpkg -l proxmox-headers-$(uname -r)</code> prüfen und gegebenenfalls installieren. Im Buildprotokoll nach Quellcode-/Kernelproblemen suchen. Erneutes Ausführen ruft <code>cleanup_broken_gasket_dkms</code> auf, garantiert aber keine Kernelkompatibilität.",
+    "apexMissTitle": "/dev/apex_0 fehlt nach dem Neustart",
+    "apexMissBody": "PCIe-Erkennung und Modul für den laufenden Kernel prüfen. <code>modprobe apex</code> versuchen und <code>dmesg | grep -iE \"apex|gasket\"</code> prüfen. Build-, Lade- oder Steckplatz-/Firmwareprobleme können das Gerät verhindern.",
+    "lxcMissTitle": "Host sieht /dev/apex_0, LXC jedoch nicht",
+    "lxcMissBody": "Ein sichtbarer Geräteknoten beweist noch keine Funktion. Erst Host-Zugriff, dann LXC-Mount, cgroup-Regeln und numerische UID/GID-Rechte prüfen. Siehe <lxcLink>Coral TPU zu einem LXC hinzufügen</lxcLink>.",
+    "usbUnreachTitle": "USB Accelerator erkannt, aber Frigate / TFLite kann es nicht erreichen",
+    "usbUnreachBody": "Regeln von <code>libedgetpu1-std</code> und Rechte mit <code>ls -l /dev/bus/usb/*/*</code> prüfen. Gemappte App-Benutzer/-Gruppen brauchen Lese-/Schreibzugriff; root als Eigentümer allein ist kein Fehler. Nach Regeländerungen <code>udevadm control --reload-rules &amp;&amp; udevadm trigger</code> ausführen und bei Bedarf neu verbinden.",
+    "logTitle": "Installationsprotokoll",
+    "logBody": "Jeder Lauf schreibt <code>/tmp/coral_install.log</code>. Bei DKMS-Fehlern werden, sofern vorhanden, die letzten 50 Zeilen von <code>/var/lib/dkms/gasket/1.0/build/make.log</code> ergänzt. Das Protokoll bei Supportanfragen beifügen."
+  },
+  "related": {
+    "heading": "Verwandte Themen",
+    "items": [
+      {
+        "label": "Coral TPU zu LXC hinzufügen",
+        "href": "/docs/hardware/coral-tpu-lxc",
+        "tail": " — Coral vom Host einem Container mit kompatibler App bereitstellen."
+      },
+      {
+        "label": "Installieren Sie NVIDIA Treiber (Host)",
+        "href": "/docs/hardware/nvidia-host",
+        "tail": "— die gleiche Idee für NVIDIA GPUs."
+      },
+      {
+        "label": "ProxMenux Monitor — Register Hardware",
+        "href": "/docs/monitor/dashboard/hardware",
+        "tail": " — das Coral-Fenster zeigt Treiber, Module, Geräte und Laufzeitstatus sowie Temperatur bei vorhandenem unterstütztem Sensor."
+      }
+    ]
+  }
+}
diff --git a/web/messages/de/docs/hardware/nvidia-host.json b/web/messages/de/docs/hardware/nvidia-host.json
new file mode 100644
index 00000000..ee022e92
--- /dev/null
+++ b/web/messages/de/docs/hardware/nvidia-host.json
@@ -0,0 +1,175 @@
+{
+  "meta": {
+    "title": "NVIDIA auf dem Host installieren | ProxMenux-Dokumentation",
+    "description": "Proprietäre NVIDIA-Treiber mit ProxMenux auf Proxmox VE installieren: GPU-Filterung, Build- und DKMS-Prüfungen, Persistenzdienst, optionaler NVENC-Patch und Bibliotheksaktualisierung in LXC."
+  },
+  "header": {
+    "title": "NVIDIA-Treiber auf dem Host installieren",
+    "description": "NVIDIA auf dem Proxmox-VE-Host installieren. Filtert gepflegte Zweige nach GPU-PCI-ID, prüft den Build, nutzt DKMS, verwaltet nouveau und installiert den Persistenzdienst. Kann außerdem Bibliotheken in LXC mit NVIDIA-Zugriff aktualisieren.",
+    "section": "Hardware: GPUs und Coral-TPU"
+  },
+  "intro": {
+    "title": "Funktionsweise",
+    "body": "ProxMenux erkennt die GPU und bietet gepflegte NVIDIA-Zweige an, die ihre PCI-ID aufführen. Es sperrt <code>nouveau</code>, lädt den offiziellen <code>.run</code>-Installer, nutzt DKMS, installiert <code>nvidia-persistenced</code>, udev-Regeln und das NVIDIA Container Toolkit und bietet einen optionalen NVENC-Patch an. Build-Prüfungen beziehen sich auf den laufenden Kernel; erfolgreiche Kompilierung garantiert nicht, dass jede App funktioniert. Vorhandenen NVIDIA-LXC wird eine Aktualisierung der Userspace-Bibliotheken angeboten, versionsgleich außer unter Arch."
+  },
+  "who": {
+    "heading": "Für wen ist das?",
+    "body": "Für GPU-beschleunigte Video- oder Rechenanwendungen wie Plex, Jellyfin, Frigate, Immich oder Stable Diffusion <strong>in LXC</strong> zuerst den NVIDIA-Treiber auf dem Proxmox-<em>Host</em> installieren. Die direkte Zuweisung an eine <strong>VM</strong> nutzt den separaten VFIO-Ablauf."
+  },
+  "prereqs": {
+    "title": "Vorbereitung",
+    "gpu": "<strong>Eine NVIDIA-GPU</strong> im Host. Sie wird automatisch erkannt; AMD und Intel werden hier nicht verwaltet.",
+    "gpuCheck": "lspci | grep -i nvidia",
+    "notVm": "Die GPU <strong>darf nicht per VFIO für eine VM reserviert sein</strong>. Der Installer verweigert diesen Fall, um die Zuweisung nicht zu beeinträchtigen.",
+    "internet": "Internetzugang auf dem Host. Der Installer lädt den Treiber von <code>download.nvidia.com</code> herunter und klont optional <code>nvidia-persistenced</code> und <code>nvidia-patch</code> von GitHub.",
+    "space": "Platz in <code>/opt/nvidia</code> für <code>.run</code> und RAM für die Kompilierung einplanen. Der Nicht-Arch-LXC-Pfad prüft auf 1500 MiB freien Platz und kann bei geringerem RAM eine temporäre Erhöhung auf 2048 MiB anfragen; danach wird das alte Limit wiederhergestellt. Host-Neustart einplanen."
+  },
+  "vmWarn": {
+    "title": "GPU für VM reserviert? Hier stoppen",
+    "body": "Ist ein NVIDIA-Gerät an <code>vfio-pci</code> gebunden, beendet sich der Installer auch bei gestoppter VM. Eine Reservierung bedeutet nicht zwingend aktive VM-Nutzung. Planen Sie die Rückkehr zum Host-Treiber und entfernen Sie alte VM-/VFIO-Zuweisungen vor Neustart und Installation."
+  },
+  "running": {
+    "heading": "Ausführen des Installateurs",
+    "body": "Öffnen Sie <strong>Hardware Graphics → NVIDIA GPU Driver Installer</strong> in ProxMenux. Das Menü hängt davon ab, ob bereits ein Treiber aktiv ist.",
+    "imageAlt": "Hardware-Menü mit markiertem NVIDIA-Installer"
+  },
+  "howRuns": {
+    "heading": "Ablauf des Skripts",
+    "body": "Erkennt Geräte, wählt eine Version und installiert. Vor der Übersicht kann eine separat bestätigte VFIO-Bereinigung erfolgen. Repository-/Header-Vorbereitung und Download gehen dem Treiberaustausch voraus; nicht alle Änderungen beginnen erst nach einer einzigen Abschlussbestätigung."
+  },
+  "walkthrough": {
+    "detect": {
+      "title": "GPU Erkennung und Übersicht",
+      "body1": "Zeigt NVIDIA-Grafikcontroller, Treiberstatus oder <em>„Kein NVIDIA-Treiber installiert“</em> sowie LXC mit konfiguriertem NVIDIA-Zugriff und deren Treiberversion.",
+      "body2": "GPU sowie Host-/Container-Versionen prüfen. Bei unerwarteter Auswahl in der Übersicht abbrechen; eine zuvor separat bestätigte VFIO-Bereinigung wurde bereits angewendet.",
+      "imageAlt": "Installationsübersicht mit GPUs, Treiberstatus und NVIDIA-LXC"
+    },
+    "version": {
+      "title": "Wählen Sie die Treiberversion",
+      "body1": "Filtert Versionen von <code>nvidia.com</code>, die <strong>die GPU-PCI-ID in der Liste unterstützter Chips enthalten</strong>, und sortiert Beta-/Entwicklerversionen heuristisch aus. <em>&lt;Version&gt; — Empfohlen</em> bevorzugt den neuesten Stand des installierten Zweigs, danach den Production Branch und zuletzt die höchste unterstützte Versionsnummer.",
+      "body2": "Ist der Treiber als mit keylase gepatcht erfasst, beschränkt die Auswahl sich auf die NVENC-Patch-Tabelle. <em>Neu installieren / aktualisieren</em> enthält weiterhin Bestätigungen und Patch-Abfragen; Ergebnis prüfen.",
+      "whyTitle": "Wie die Kernel-Kompatibilität validiert wird",
+      "whyBody": "Filtert nach gepflegten Zweigen und GPU-PCI-Unterstützung statt einer festen Kernel-/Treiber-Matrix. Ein Vorab-Build prüft den laufenden Kernel. Bestätigtes Scheitern führt zur Auswahl zurück; ein nicht verfügbarer Vorabtest kann nur warnen und fortfahren. Abschließende Installation und Laufzeitprüfung bleiben nötig.",
+      "imageAlt": "Auswahl GPU-kompatibler Zweige mit Empfehlung oben"
+    },
+    "uninstall": {
+      "title": "Vorhandenen Treiber vor Neuinstallation entfernen",
+      "body": "Nach Download und Prüfung des gewählten Installers wird der vorhandene Treiber entfernt. Stoppt NVIDIA-Dienste, entlädt Module, entfernt DKMS-Einträge und bereinigt <code>nvidia-*</code> / <code>libnvidia-*</code> / <code>cuda-*</code>. Gilt auch bei bestätigter Neuinstallation derselben Version."
+    },
+    "prepare": {
+      "title": "System vorbereiten",
+      "body": "Während der Vorbereitung führt das Skript Folgendes aus:",
+      "items": [
+        "Prüft Paketquellen vor Entfernung oder Installation. Ohne Abonnement und mit ausschließlich Enterprise-Repository fragt es nach dem Wechsel zu no-subscription; bei Ablehnung stoppt die Installation.",
+        "Installiert <code>pve-headers-$(uname -r)</code> (oder <code>proxmox-headers-$(uname -r)</code>), <code>build-essential</code> und <code>dkms</code>.",
+        "Erstellt die von ProxMenux verwaltete Datei <code>/etc/modprobe.d/proxmenux-nouveau-blacklist.conf</code> mit <code>blacklist nouveau</code> und <code>options nouveau modeset=0</code>. Erfasst eine zusätzlich eingefügte Zeile in <code>blacklist.conf</code> und versucht, nouveau zu entladen.",
+        "Schreibt <code>/etc/modules-load.d/nvidia-vfio.conf</code> mit <code>nvidia</code> und <code>nvidia_uvm</code>, so dass die Module beim Booten früh geladen werden."
+      ]
+    },
+    "download": {
+      "title": "Download und Ausführen des NVIDIA-Installationsprogramms",
+      "body": "Lädt <code>NVIDIA-Linux-x86_64-&lt;version&gt;.run</code> nach <code>/opt/nvidia</code> und prüft Dateigröße und ausführbaren Dateityp. Das ist keine kryptografische Signaturprüfung. Registriert DKMS für Neubauten bei Kerneländerungen; kompatibler Quellcode und Kernel bleiben nötig.",
+      "imageAlt": "Download-Fortschritt und DKMS-Build des NVIDIA-Installers"
+    },
+    "persist": {
+      "title": "Persistenzdienst und Udev-Regeln",
+      "body": "Installiert <persistLink>nvidia-persistenced</persistLink> und schreibt <code>/etc/udev/rules.d/70-nvidia.rules</code> zur Erstellung von <code>/dev/nvidia*</code> beim Start. Das hilft, LXC-Zugriffe vor Bereitstellung der Gerätedateien zu vermeiden."
+    },
+    "nvenc": {
+      "title": "Optional: NVENC-Patch anwenden",
+      "body": "NVENC-Sitzungsgrenzen hängen von GPU und Treiber ab. <patchLink>keylase/nvidia-patch</patchLink> kann die Treibergrenze für unterstützte Versionen entfernen. Wählen Sie <strong>Ja</strong>, wenn Sie diese Encoding-Änderung benötigen und Ihre Version unterstützt wird. Dekodierung und Hardwarekapazität werden dadurch nicht verbessert.",
+      "supportTitle": "Patch-Unterstützung prüfen",
+      "supportBody": "Exakte Version in der <patchTableLink>Patch-Tabelle</patchTableLink> prüfen. Fehlt sie, den Treiber ungepatcht nutzen oder eine andere gepflegte Version wählen, die GPU, Kernel und Patch unterstützt; nicht allein nach Nähe in der Liste auswählen."
+    },
+    "propagate": {
+      "title": "Optional: NVIDIA-Bibliotheken in LXC aktualisieren",
+      "body1": "Bietet passende Treiberbibliotheken für erkannte LXC an. Sie und das Host-Modul <strong>müssen übereinstimmende Versionen haben</strong>; andernfalls kann <code>nvidia-smi</code> „version mismatch“ melden.",
+      "body2": "Debian / Ubuntu und andere glibc-Container erhalten den entpackten <code>.run</code>-Installer mit <code>--no-kernel-modules --no-dkms --no-install-compat32-libs</code>; RAM kann vorübergehend auf 2 GiB erhöht und danach zurückgesetzt werden. <strong>Arch, Manjaro und EndeavourOS</strong> nutzen <code>pacman -Syu nvidia-utils</code> aus ihren Paketquellen, ohne Bindung an die Host-Version: Ergebnis prüfen. <strong>Alpine</strong> erhält entpackte <code>.run</code>-Dateien per <code>pct push</code>, installiert <code>gcompat</code> und <code>binutils</code> mit <code>apk</code> und erstellt SONAME-Links per <code>readelf</code>. Funktion prüfen; die Kompatibilitätsschicht garantiert nicht alle Bibliotheken auf musl.",
+      "imageAlt": "Dialog mit NVIDIA-LXC und Versionen zur Bestätigung des Updates"
+    },
+    "reboot": {
+      "title": "Neustart",
+      "body": "Nach der Treiberinstallation erstellt das Skript <code>initramfs</code> für alle Kernel neu; sein letzter Schritt bietet einen Neustart an. <strong>Diesen Neustart einplanen</strong>, um die dauerhafte Modul- und nouveau-Konfiguration bei einem frischen Start zu prüfen, auch wenn der neue Treiber vor dem Neustart bereits antwortet."
+    }
+  },
+  "reinstallUninstall": {
+    "heading": "Neuinstallieren oder Deinstallieren",
+    "intro": "Sind <code>nvidia</code> geladen und eine Version über <code>nvidia-smi</code> verfügbar, erscheint ein Aktionsmenü. Das erkennt einen aktiven Treiber; installierte Dateien können auch ohne geladenes Modul vorhanden sein.",
+    "imageAlt": "Das Aktionsmenü NVIDIA wird angeboten, wenn ein Treiber bereits installiert ist – zwei Möglichkeiten: Treiber neu installieren / aktualisieren oder den Treiber NVIDIA vollständig deinstallieren",
+    "imageCaption": "Das Aktionsmenü erscheint nur, wenn ein NVIDIA-Treiber derzeit auf dem Host aktiv ist.",
+    "reinstallHeading": "Neuinstallation / Update",
+    "reinstallBody": "Wählt eine Version, bereitet Paketquellen/Headers vor, lädt herunter und prüft den Build vor dem Treiberaustausch. Ermöglicht Updates innerhalb eines gepflegten Zweigs oder einen unterstützten Zweigwechsel. Danach erscheinen erneut Abfragen zu LXC-Bibliotheken und NVENC-Patch.",
+    "uninstallHeading": "Deinstallieren – Was entfernt wird",
+    "uninstallIntro": "Nach einer Ja/Nein-Bestätigung werden folgende Komponenten entfernt:",
+    "uninstallItems": [
+      "Stoppt und deaktiviert <code>nvidia-persistenced</code> und <code>nvidia-powerd</code>, versucht, <code>nvidia_uvm</code>, <code>nvidia_drm</code>, <code>nvidia_modeset</code> und <code>nvidia</code> zu entladen, und führt dann <code>nvidia-uninstall --silent</code> für die <code>.run</code>-Installation aus. Von NVIDIA abhängige LXC-Workloads sind betroffen; aktive Clients können das Entladen verhindern.",
+      "Führt <code>apt purge</code> auf <code>nvidia-*</code>, <code>libnvidia-*</code>, <code>cuda-*</code> und <code>libcudnn*</code> aus, entfernt den DKMS-Quellbaum sowie die Ordner <code>nvidia-persistenced</code> und <code>nvidia-patch</code> unter <code>/opt/nvidia</code>.",
+      "Entfernt die Module-Load Config (<code>/etc/modules-load.d/nvidia-vfio.conf</code>) und die Nouveau Blacklist-Einträge von ProxMenux. Legacy zweizeilige ProxMenux-Blacklist-Dateien werden migriert und entfernt; modifizierte oder nicht verwandte Administratordateien bleiben erhalten.",
+      "Entfernt <code>/etc/udev/rules.d/70-nvidia.rules</code> und setzt den NVENC-Status im verwalteten Installationsverzeichnis auf <em>removed</em>; es gibt keine separate Statusdatei.",
+      "Erstellt <code>initramfs</code> für alle Kernel neu, führt passend zur Bootkonfiguration <code>proxmox-boot-tool refresh</code> aus und fragt nach einem Neustart."
+    ],
+    "lxcWarnTitle": "LXC mit NVIDIA-Zugriff",
+    "lxcWarnBody": "Das Entfernen des Host-Treibers unterbricht NVIDIA-abhängige LXC-Anwendungen, auch wenn ihre Bibliotheken installiert bleiben. Wartungszeit für Frigate, Plex, Jellyfin, Ollama und andere GPU-Apps einplanen."
+  },
+  "updates": {
+    "heading": "Update-Benachrichtigungen",
+    "body": "Der installierte NVIDIA-Treiber wird im Verzeichnis der von ProxMenux verwalteten Installationen erfasst. Beim Start und alle 24 Stunden vergleicht der Monitor die unter <code>download.nvidia.com/XFree86/Linux-x86_64/</code> verfügbaren Versionen mit der von <code>nvidia-smi</code> gemeldeten Version. Er benachrichtigt nur, wenn im installierten Versionszweig ein neueres Wartungsrelease verfügbar ist.",
+    "kindsHeading": "Update-Meldung",
+    "kindsItems": [
+      "<strong>Wartungsupdate im gleichen Zweig.</strong> Beispiel: installiert 580.65.06 → verfügbar 580.105.08. Monitor leitet daraus keine Kernel-Kompatibilität anderer Zweige ab."
+    ],
+    "antiTitle": "Wiederholte Meldungen vermeiden",
+    "antiBody": "Eine Meldung pro neuer Version statt bei jeder täglichen Prüfung. Ohne neuere Version im installierten Zweig bleibt die Meldung aus.",
+    "applyTitle": "Anwendung der Aktualisierung",
+    "applyBody": "Monitor meldet Updates ohne automatische Installation. Im Installer <strong>Neu installieren / aktualisieren</strong> und eine unterstützte Version wählen, dann Build und Installation abschließen. Der Ablauf endet mit einer Neustartabfrage; Neustart einplanen und danach Host sowie LXC-Bibliotheken prüfen."
+  },
+  "verify": {
+    "heading": "Installation überprüfen",
+    "intro": "Nach dem Host-Neustart per SSH oder Proxmox-Shell anmelden und ausführen:",
+    "after": "GPU und erwartete Treiberversion prüfen. Prozesse können bereits erscheinen, wenn Host-Dienste oder automatisch gestartete Container die GPU nutzen. Danach den Persistenzdienst prüfen:",
+    "imageAlt": "Ausgabe von nvidia-smi auf dem Host mit der erkannten GPU und der installierten Treiberversion"
+  },
+  "troubleshoot": {
+    "heading": "Fehlerbehebung",
+    "smiFailTitle": "nvidia-smi meldet „NVIDIA-SMI has failed“",
+    "smiFailBody": "Mögliche Ursachen sind <strong>nouveau</strong>, <strong>fehlende oder unpassende Kernel-Header</strong>, inkompatibler Treiberquellcode oder andere Ladefehler. <code>lsmod | grep nouveau</code>, <code>dmesg | grep -i nvidia</code> und Installer-/DKMS-Protokolle prüfen. Bei fehlerhafter nouveau-Regel zuerst <code>/etc/modprobe.d/proxmenux-nouveau-blacklist.conf</code> prüfen, dann <code>update-initramfs -u -k all</code> und Neustart. Nicht jeder Buildfehler betrifft Headers.",
+    "lxcMissTitle": "LXC Container kann GPU nach dem Host-Update nicht sehen",
+    "lxcMissBody": "Vor Neuinstallation Host-Geräte, LXC-Berechtigungen und Bibliotheksversion prüfen. Bei Versionskonflikten passende Userspace-Treiber über den unterstützten Distributionsweg installieren; auf glibc mit <code>--no-kernel-modules</code>. Bibliotheksinstallation repariert keine fehlenden Mounts oder Berechtigungen.",
+    "logTitle": "Überprüfen Sie das Installationsprotokoll",
+    "logBody": "Die Installation protokolliert in <code>/tmp/nvidia_install.log</code>. Bei Fehlern Download, DKMS-Build und Dienste prüfen. Fügen Sie das Protokoll dem GitHub-Fehlerbericht bei."
+  },
+  "manualSteps": {
+    "heading": "Suchen Sie die manuellen Schritte?",
+    "body": "Unter <guideLink>Anleitungen → NVIDIA</guideLink> stehen manuelle Grundlagen mit <code>wget</code> und <code>./NVIDIA-Linux-...run</code>. Sie erklären Komponenten, bilden den Installer aber nicht exakt ab. Der gepflegte ProxMenux-Ablauf bietet GPU-Filterung, Build-Prüfung, LXC-Updates und VFIO-Prüfungen."
+  },
+  "related": {
+    "heading": "Verwandte Themen",
+    "items": [
+      {
+        "label": "GPU zu VM hinzufügen (Passthrough)",
+        "href": "/docs/hardware/gpu-vm-passthrough",
+        "tail": " — NVIDIA direkt per VFIO einer VM zuweisen."
+      },
+      {
+        "label": "GPU zu LXC hinzufügen",
+        "href": "/docs/hardware/igpu-acceleration-lxc",
+        "tail": " — NVIDIA mit einem oder mehreren Containern teilen."
+      },
+      {
+        "label": "GPU-Modus wechseln (VM ↔ LXC)",
+        "href": "/docs/hardware/switch-gpu-mode",
+        "tail": " — zwischen VM-Passthrough und gemeinsamer LXC-Nutzung wechseln."
+      },
+      {
+        "label": "ProxMenux Monitor — Register Hardware",
+        "href": "/docs/monitor/dashboard/hardware",
+        "tail": " — GPU-Dialog zum Öffnen dieses Installers und zur Live-Überwachung."
+      },
+      {
+        "label": "Befehle für GPU-Passthrough",
+        "href": "/docs/help-info/gpu-commands",
+        "tail": "— lspci / dmesg / IOMMU / nvidia-smi-Referenz."
+      }
+    ]
+  }
+}
diff --git a/web/messages/de/docs/hardware/switch-gpu-mode.json b/web/messages/de/docs/hardware/switch-gpu-mode.json
new file mode 100644
index 00000000..d0ee5780
--- /dev/null
+++ b/web/messages/de/docs/hardware/switch-gpu-mode.json
@@ -0,0 +1,172 @@
+{
+  "meta": {
+    "title": "GPU-Modus wechseln (VM ↔ LXC) | ProxMenux-Dokumentation",
+    "description": "GPU zwischen VFIO für VMs und nativem Treiber für LXC umschalten. ProxMenux erkennt den Treiber, fragt nach dem Umgang mit betroffenen Gästen, entfernt zugehörige Audiozuweisungen und erstellt bei Host-Konfigurationsänderungen initramfs neu."
+  },
+  "header": {
+    "title": "GPU-Modus wechseln (VM ↔ LXC)",
+    "description": "Zugewiesene GPU zwischen VM-Passthrough und LXC-Nutzung umschalten. ProxMenux verwaltet Treiberbindung, VFIO, Module und initramfs und fragt nach dem Umgang mit betroffenen Gästen. Prüfen Sie die Auswahl und nach dem Neustart die Konfiguration.",
+    "section": "Hardware: GPUs und Coral-TPU"
+  },
+  "intro": {
+    "title": "Funktionsweise",
+    "body": "Mit <code>vfio-pci</code> ist die GPU für eine VM reserviert. Mit nativem Treiber <em>(i915 / amdgpu / nvidia)</em> können Host und LXC sie teilen. <strong>GPU-Modus wechseln</strong> verwaltet <code>vfio.conf</code>, Treibersperren und Gastzuweisungen und meldet verbleibende Verweise."
+  },
+  "graphics": {
+    "lxcTitle": "Bereit für LXC-Container",
+    "lxcDesc": "Nativer Treiber aktiv",
+    "vmTitle": "Bereit für VM-Passthrough",
+    "vmDesc": "VFIO-PCI-Treiber aktiv"
+  },
+  "when": {
+    "heading": "Wann sollte ich das verwenden?",
+    "intro": "Verwenden Sie dies, wenn die GPU <strong>bereits zugewiesen</strong> ist und anders genutzt werden soll:",
+    "headerSituation": "Lage",
+    "headerUse": "Nutzen Sie diese Seite?",
+    "rows": [
+      {
+        "situation": "GPU frei und noch nie zugewiesen: einer VM zuweisen.",
+        "useRich": "Nein — <vmLink>GPU zu VM hinzufügen</vmLink> verwenden"
+      },
+      {
+        "situation": "GPU frei und noch nie zugewiesen: einem LXC zuweisen.",
+        "useRich": "Nein — <lxcLink>GPU zu LXC hinzufügen</lxcLink> verwenden"
+      },
+      {
+        "situationRich": "Die GPU ist einer VM über <code>vfio-pci</code> zugewiesen; ich möchte sie stattdessen in einem LXC nutzen.",
+        "useRich": "<strong>Ja — diese Seite.</strong>"
+      },
+      {
+        "situation": "Die GPU wird mit einem LXC geteilt; ich möchte sie exklusiv einer VM zuweisen.",
+        "useRich": "<strong>Ja — diese Seite.</strong>"
+      },
+      {
+        "situation": "Ich möchte alle Gastzuweisungen dieser GPU entfernen.",
+        "use": "Der LXC-Modus gibt die GPU an den Host-Treiber zurück; die VM-Konfliktrichtlinie kann hostpci-Einträge entfernen, LXC-Geräteeinträge müssen jedoch separat entfernt werden. Die GPU bleibt dabei an einen Treiber gebunden."
+      }
+    ]
+  },
+  "prereqs": {
+    "title": "Vorbereitung",
+    "assigned": "<strong>Bereits zugewiesene GPU</strong> in einer VM über VFIO oder in einem LXC. Für die erste Zuweisung GPU zu VM / LXC hinzufügen verwenden.",
+    "iommu": "<strong>IOMMU muss auf dem Host aktiv sein</strong> beim Wechsel <em>in</em> den VM-Modus. Firmware-Einstellungen und Kernel-Unterstützung sind beide entscheidend. Fehlt <code>intel_iommu=on</code> oder <code>amd_iommu=on</code> im laufenden Kernel, fügt das Skript es mit <code>iommu=pt</code> zu <code>/etc/kernel/cmdline</code> (ZFS-Root-Marker) oder <code>/etc/default/grub</code> hinzu und führt dann <code>proxmox-boot-tool refresh</code> oder <code>update-grub</code> aus. Prüfen Sie eventuelle Warnungen und starten Sie bei Aufforderung neu.",
+    "iommuCheck": "dmesg | grep -i 'IOMMU enabled' | head -1",
+    "reboot": "<strong>Neustart einplanen.</strong> Dauerhafte Treiber- und Bootänderungen können ein neues initramfs und einen Neustart erfordern. Das Skript fragt am Ende danach.",
+    "knowList": "<strong>Betroffene VMs und LXC kennen.</strong> Das Skript erkennt Verweise und fragt nach dem Umgang mit jedem Gast; eine bekannte Liste erleichtert die Prüfung."
+  },
+  "blocklist": {
+    "title": "Nicht alle GPUs können sicher an einen VM übergeben werden",
+    "body": "Das Skript sperrt den VM-Modus für die Geräte-IDs <code>8086:5a84</code> und <code>8086:5a85</code> gemäß seiner Kompatibilitätsrichtlinie. Passt eine gewählte GPU, bricht es den Wechsel in den VM-Modus ab und kehrt zur GPU-Auswahl zurück oder beendet sich, wenn es die einzige GPU ist. Diese Sperrliste verhindert nicht den Wechsel <em>in</em> den LXC-Modus; andere Prüfungen können weiterhin gelten."
+  },
+  "running": {
+    "heading": "Skript ausführen",
+    "body": "Öffnen Sie <strong>Hardware: GPUs und Coral-TPU → GPU-Modus wechseln (VM ↔ LXC)</strong> in ProxMenux.",
+    "imageAlt": "Menüpunkt GPU-Modus wechseln (VM ↔ LXC) im Hardware-Menü"
+  },
+  "howRuns": {
+    "heading": "Ablauf des Skripts",
+    "body": "GPU-Auswahl und Richtung werden vor dem Hauptwechsel geprüft. Eine separate Bereinigung veralteter VFIO-Einträge kann schon vorher fragen; betroffene Gäste haben eigene Konfliktdialoge. Jede Bestätigung lesen: Nicht alle Änderungen sind durch eine einzige Abschlussbestätigung abgedeckt."
+  },
+  "walkthrough": {
+    "heading": "Schritt für Schritt",
+    "detect": {
+      "title": "GPUs und aktuellen Treiber erkennen",
+      "body": "Erfasst VGA-, 3D- und Display-Controller des Hosts und prüft <code>/sys/bus/pci/devices/*/driver</code>. Zeigt Name, PCI-Adresse und aktuellen Treiber jeder GPU zur Erkennung des Modus.",
+      "imageAlt": "GPU Checkliste mit jedem erkannten GPU mit seinem aktuellen Treiber (vfio-pci / nvidia / amdgpu / i915) und PCI-Slot"
+    },
+    "pickGpu": {
+      "title": "GPUs zum Umschalten auswählen",
+      "body": "Eine GPU wird automatisch gewählt. Bei mehreren können Sie mehrere markieren, sofern alle im <em>gleichen</em> Modus sind. Bei gemischten Modi müssen Sie die Auswahl eingrenzen.",
+      "tipTitle": "Mehrere GPUs gemeinsam umschalten",
+      "tipBody": "Beispiel: drei NVIDIA-GPUs in den VM-Modus schalten, danach die iGPU in den LXC-Modus zurückgeben. Zwei Durchläufe mit jeweils gemeinsamem Ziel statt einzelner Aufrufe pro Karte."
+    },
+    "direction": {
+      "title": "Überprüfung der vorgeschlagenen Richtung",
+      "intro": "Basierend auf dem aktuellen Modus schlägt das Skript das Gegenteil als Ziel vor:",
+      "items": [
+        "<strong>VM → LXC:</strong> Entfernt die Bindung an <code>vfio-pci</code>, damit der native Treiber (<code>nvidia</code>, <code>amdgpu</code>, <code>i915</code>) die GPU nutzen kann. Bei NVIDIA werden die betreffenden BDF-Einträge aus <code>/etc/udev/rules.d/10-proxmenux-vfio-bind.rules</code> für den nächsten Start entfernt.",
+        "<strong>LXC → VM:</strong> bereitet die Bindung an <code>vfio-pci</code> vor. AMD / Intel sperren den nativen Treiber und nutzen <code>options vfio-pci ids=…</code>. Bei NVIDIA wird <code>nvidia</code> nur dann global gesperrt, wenn jede NVIDIA-GPU des Hosts in VFIO ist; andernfalls setzen Regeln pro BDF <code>driver_override=vfio-pci</code> für die Geräte der betroffenen IOMMU-Gruppen, und NVIDIA-GPUs außerhalb dieser Gruppen behalten <code>nvidia</code>. Prüfen Sie vor dem Wechsel alle Gruppenmitglieder."
+      ],
+      "outro": "Bestätigen Sie die Richtung oder brechen Sie ab."
+    },
+    "conflict": {
+      "title": "Umgang mit betroffenen VMs und LXC",
+      "body": "Prüft <code>/etc/pve/lxc/*.conf</code> auf Geräteverweise nach Treiberfamilie und <code>/etc/pve/qemu-server/*.conf</code> auf PCI-Zuweisungen. Die LXC-Erkennung ordnet nicht jede Karte exakt per BDF zu. Prüfen Sie die erkannten Gäste und wählen Sie den Umgang mit jedem:",
+      "headerPolicy": "Richtlinie",
+      "headerEffect": "Wirkung",
+      "headerWhen": "Wann zu wählen",
+      "keepPolicy": "Konfiguration behalten, Autostart deaktivieren",
+      "keepEffect": "<code>pct set CTID -onboot 0</code> oder <code>qm set VMID -onboot 0</code>. Die GPU-Einträge bleiben erhalten.",
+      "keepWhen": "Wenn der Gast nach Rückkehr zum ursprünglichen GPU-Modus wieder genutzt werden soll. Konservative Standardwahl.",
+      "removePolicy": "GPU aus config entfernen",
+      "removeEffect": "Entfernt die erkannten <code>hostpci</code>- / <code>dev</code>-Einträge und unterstützte ältere Verweise.",
+      "removeWhen": "Wenn der Gast ohne GPU arbeiten soll. Zuerst App-Einstellungen prüfen: CPU-Ersatzbetrieb hängt von der Anwendung ab; das Entfernen des Geräts konfiguriert sie nicht automatisch um.",
+      "imageAlt": "Dialog zum Umgang mit betroffenen VMs oder LXC"
+    },
+    "audio": {
+      "title": "Zugehörige Audiozuweisungen beim Verlassen des VM-Modus entfernen",
+      "body1": "Viele dedizierte NVIDIA-/AMD-GPUs bieten HDMI-Audio als Funktion <code>.1</code> desselben Slots; weitere Audiogeräte können zugewiesen sein. Nach Entfernen der GPU können veraltete Audioeinträge vom Typ <code>hostpci</code> bleiben. Prüfen Sie, welche Zuweisungen erhalten bleiben sollen.",
+      "body2": "Erkennt die Audio-BDF-Adressen und zeigt eine Auswahlliste zum Entfernen. Zugehörige Vendor:Device-IDs werden nur aus <code>/etc/modprobe.d/vfio.conf</code> entfernt, wenn keine andere VM sie nutzt."
+    },
+    "apply": {
+      "title": "Änderungen an Host und Gästen anwenden",
+      "body": "Sobald Sie bestätigen, schreibt das Skript die hostseitigen Änderungen - <code>vfio.conf</code>, Blacklist, Module und (für NVIDIA) die Per-BDF-Udev-Regel bei <code>/etc/udev/rules.d/10-proxmenux-vfio-bind.rules</code> plus den BDF-Status bei <code>/etc/proxmenux/vfio-bind.bdfs</code>. Es wendet auch die gewählte Konfliktpolitik auf jeden betroffenen VM/LXC an. Wenn sich die Host-Konfiguration tatsächlich geändert hat, läuft <code>update-initramfs -u -k all</code> gefolgt von <code>proxmox-boot-tool refresh</code>; ansonsten werden beide übersprungen."
+    },
+    "reboot": {
+      "title": "Neustart",
+      "body": "Starten Sie den Host neu, um die neue dauerhafte Bindung anzuwenden. Sie können dies verschieben, müssen aber vor dem Start des Zielgasts den aktiven Treiber prüfen: Bis zum Neustart kann noch der vorherige aktiv sein.",
+      "imageAlt": "Zusammenfassungsdialog, der auflistet, was sich geändert hat, gefolgt von der Neustartaufforderung"
+    }
+  },
+  "manual": {
+    "heading": "Manuelle Prüfung",
+    "intro": "Prüfen Sie vor <strong>VM → LXC</strong> Treiber und BDF-Richtlinie. Das NVIDIA-Beispiel nutzt <code>10de:2204</code>; passen Sie es an Ihre Karte an. Die Befehle lesen den Zustand; das Skript verwaltet außerdem Gäste und IOMMU-Gruppenmitglieder.",
+    "lxcToVm": "Vor <strong>LXC → VM</strong> PCI-Adresse und IOMMU-Gruppe prüfen. Ersetzen Sie die Beispieladresse und prüfen Sie vor der Zuweisung alle Gruppenmitglieder.",
+    "oneVmTitle": "Eine physische VFIO-GPU kann nur eine VM gleichzeitig nutzen",
+    "oneVmBody": "Das Setzen mehrerer <code>hostpci</code>-Einträge mit demselben PCI-Slot in zwei VMs ist eine gültige Konfiguration, aber nur eine der VMs kann mit dem GPU beginnen - die zweite wird fehlschlagen. Beim ProxMenux-Konfliktpolitikschritt geht es genau darum, diese Falle zu vermeiden."
+  },
+  "verification": {
+    "heading": "Überprüfung nach dem Neustart"
+  },
+  "troubleshoot": {
+    "heading": "Fehlerbehebung",
+    "stillVfioTitle": "GPU zeigt immer noch vfio-pci nach dem Umschalten auf LXC Modus",
+    "stillVfioBody": "Ein geladenes VFIO-Modul zeigt nicht, welcher Treiber diese GPU besitzt. Kartenbindung sowie Abschluss von <code>update-initramfs</code> und Neustart prüfen. <code>lsmod | grep vfio</code> listet nur Module. Bei AMD / Intel <code>vfio.conf</code> prüfen; bei NVIDIA <code>/etc/proxmenux/vfio-bind.bdfs</code> und <code>/etc/udev/rules.d/10-proxmenux-vfio-bind.rules</code>. Alte Richtlinien vor <code>update-initramfs -u -k all</code> und Neustart korrigieren.",
+    "vmFailTitle": "VM startet nach Wechsel der GPU in den LXC-Modus nicht",
+    "vmFailBody": "Prüfen Sie verbliebene veraltete <code>hostpci</code>-Verweise. Die Richtlinie <em>GPU aus Konfiguration entfernen</em> kann sie beim geplanten Wechsel entfernen. Prüfen Sie vor erneutem Skriptaufruf die Richtung, um den Modus nicht versehentlich umzukehren. Alternativ die alte Zuweisung in Proxmox bei gestoppter VM entfernen.",
+    "smiFailTitle": "nvidia-smi meldet „Driver/library version mismatch“ nach Rückkehr zu LXC",
+    "smiFailBody": "Vergleichen Sie das geladene NVIDIA-Modul mit installierten Bibliotheken, auch in LXC. Versionen zuerst abgleichen: Ein Neustart lädt das installierte Modul, repariert aber keine unpassenden Pakete. Neuladen mit <code>modprobe -r nvidia</code> und <code>modprobe nvidia</code> erfordert gestoppte GPU-Clients und kann bei genutzten abhängigen Modulen scheitern.",
+    "logTitle": "Ausführungsprotokoll",
+    "logBody": "Jeder Aufruf schreibt in <code>/tmp/proxmenux_gpu_switch_mode.log</code> auf dem Host. Fügen Sie das Protokoll Ihrer GitHub-Hilfeanfrage bei."
+  },
+  "related": {
+    "heading": "Verwandte Themen",
+    "items": [
+      {
+        "label": "GPU zu VM hinzufügen (Passthrough)",
+        "href": "/docs/hardware/gpu-vm-passthrough",
+        "tail": " — erstmalige Einrichtung des VM-Modus."
+      },
+      {
+        "label": "GPU zu LXC hinzufügen",
+        "href": "/docs/hardware/igpu-acceleration-lxc",
+        "tail": " — erstmalige Einrichtung des LXC-Modus."
+      },
+      {
+        "label": "Installieren Sie NVIDIA Treiber (Host)",
+        "href": "/docs/hardware/nvidia-host",
+        "tail": "— erforderlich für den LXC-Modus auf NVIDIA-GPUs."
+      },
+      {
+        "label": "ProxMenux Monitor — Register Hardware",
+        "href": "/docs/monitor/dashboard/hardware",
+        "tail": " — Bereich Grafikkarten mit aktuellem Modus und Umschaltfunktion."
+      },
+      {
+        "label": "Befehle für GPU-Passthrough",
+        "href": "/docs/help-info/gpu-commands",
+        "tail": " — kurze Befehlsreferenz."
+      }
+    ]
+  }
+}
diff --git a/web/messages/de/docs/help-info/backup-commands.json b/web/messages/de/docs/help-info/backup-commands.json
new file mode 100644
index 00000000..a9005c12
--- /dev/null
+++ b/web/messages/de/docs/help-info/backup-commands.json
@@ -0,0 +1,235 @@
+{
+  "meta": {
+    "title": "Proxmox-Sicherungsbefehle — vzdump, qmrestore, pct restore | ProxMenux",
+    "description": "Referenz der Sicherungs- und Wiederherstellungsbefehle von Proxmox VE: vzdump für VMs und LXC-Container, qmrestore für VMs, pct restore für Container, geplante Sicherungen in /etc/pve/jobs.cfg, Hook-Skripte und auszuschließende Pfade.",
+    "ogTitle": "Proxmox-Sicherungsbefehle — vzdump, qmrestore, pct restore",
+    "ogDescription": "Referenz der Befehle vzdump, qmrestore und pct restore zum Sichern und Wiederherstellen von Proxmox VMs und LXC Containern.",
+    "twitterTitle": "Proxmox Backup Befehle | ProxMenux",
+    "twitterDescription": "vzdump, qmrestore und pct restore Befehle zum Sichern und Wiederherstellen von Proxmox VMs und Containern."
+  },
+  "header": {
+    "title": "Sicherung und Wiederherstellung",
+    "description": "Kuratierte Referenz der Befehle vzdump, qmrestore und pct restore für Proxmox Backup-Workflows. Enthält Planung, erweiterte Optionen wie Hook-Skripte / Ausschlusspfade / I / O-Priorität und Backup-Dateiverwaltung.",
+    "section": "Hilfe und Informationen"
+  },
+  "intro": {
+    "title": "Drei Backup-Modi",
+    "body": "Bei VMs ist <strong>snapshot</strong> eine Live-Sicherung ohne Speicher-Snapshot-Anforderung. <strong>suspend</strong> pausiert die VM davor und verbessert die Konsistenz nicht unbedingt. <strong>stop</strong> fährt sie zunächst herunter; eine zuvor laufende VM kann nach Beginn der Sicherung weiterlaufen. Bei LXC ist es anders: snapshot benötigt Snapshot-fähigen Speicher, suspend nutzt zwei rsync-Durchläufe, und stop hält den Container während der gesamten Sicherung an."
+  },
+  "commandGroups": [
+    {
+      "title": "VM-Sicherung",
+      "commands": [
+        {
+          "command": "vzdump <vmid>",
+          "description": "Erstellen Sie ein Backup eines bestimmten VM/CT"
+        },
+        {
+          "command": "vzdump <vmid> --storage <storage>",
+          "description": "VM auf einen bestimmten Speicher sichern"
+        },
+        {
+          "command": "vzdump <vmid> --mode snapshot",
+          "description": "Snapshot-Backup erstellen (für VMs)"
+        },
+        {
+          "command": "vzdump <vmid> --mode suspend",
+          "description": "VM vor der Live-Sicherung pausieren, veralteter suspend-Modus"
+        },
+        {
+          "command": "vzdump <vmid> --mode stop",
+          "description": "VM vor dem Start der Sicherung herunterfahren"
+        },
+        {
+          "command": "vzdump --all",
+          "description": "Backup aller VMs und Container"
+        },
+        {
+          "command": "vzdump --all --exclude <vmid1>,<vmid2>",
+          "description": "Backup aller außer spezifizierten VMs"
+        }
+      ]
+    },
+    {
+      "title": "Backup-Optionen",
+      "commands": [
+        {
+          "command": "vzdump <vmid> --compress zstd",
+          "description": "Verwenden Sie zstd Kompression für Backup"
+        },
+        {
+          "command": "vzdump <vmid> --compress gzip --pigz <threads>",
+          "description": "Verwenden Sie pigz mit mehreren Threads"
+        },
+        {
+          "command": "vzdump <vmid> --storage <storage> --notes-template <text>",
+          "description": "Notizen zum Backup hinzufügen"
+        },
+        {
+          "command": "vzdump <vmid> --mailto <email>",
+          "description": "Senden Sie Benachrichtigung E-Mail"
+        },
+        {
+          "command": "vzdump <vmid> --prune-backups keep-last=<n>",
+          "description": "Halten Sie nur n Backups pro VM"
+        },
+        {
+          "command": "vzdump <vmid> --stdexcludes 0",
+          "description": "Keine temporären Dateien ausschließen"
+        },
+        {
+          "command": "vzdump <vmid> --quiet 1",
+          "description": "Ausgabemeldungen unterdrücken"
+        }
+      ]
+    },
+    {
+      "title": "Backups wiederherstellen",
+      "commands": [
+        {
+          "command": "qmrestore <backup-file> <vmid>",
+          "description": "VM aus dem Backup wiederherstellen"
+        },
+        {
+          "command": "qmrestore <backup-file> <vmid> --storage <storage>",
+          "description": "Wiederherstellen zu einem bestimmten Speicher"
+        },
+        {
+          "command": "qmrestore <backup-file> <vmid> --unique",
+          "description": "VM mit neu erzeugten zufälligen MAC-Adressen wiederherstellen"
+        },
+        {
+          "command": "pct restore <vmid> <backup-file>",
+          "description": "Container aus dem Backup wiederherstellen"
+        },
+        {
+          "command": "pct restore <vmid> <backup-file> --storage <storage>",
+          "description": "Container auf einen bestimmten Speicher wiederherstellen"
+        },
+        {
+          "command": "pct restore <vmid> <backup-file> --rootfs <storage>:<size-GiB>",
+          "description": "Mit Root-Disk auf dem gewählten Speicher und in der gewählten Größe wiederherstellen"
+        },
+        {
+          "command": "pct restore <vmid> <backup-file> --unprivileged 1",
+          "description": "Wiederherstellen als unprivilegierte CT"
+        }
+      ]
+    },
+    {
+      "title": "Sicherungsverwaltung",
+      "commands": [
+        {
+          "command": "ls -la /var/lib/vz/dump/",
+          "description": "Backups am Standardstandort auflisten"
+        },
+        {
+          "command": "find /var/lib/vz/dump/ -name \"*.vma*\"",
+          "description": "VM Backups finden"
+        },
+        {
+          "command": "find /var/lib/vz/dump/ -name \"*.tar*\"",
+          "description": "Container-Backups finden"
+        },
+        {
+          "command": "pvesm list <storage> --content backup",
+          "description": "Backups im spezifischen Speicher auflisten"
+        },
+        {
+          "command": "rm /var/lib/vz/dump/<backup-file>",
+          "description": "Löschen einer Backup-Datei"
+        },
+        {
+          "command": "cat /etc/vzdump.conf",
+          "description": "Backup Konfiguration anzeigen"
+        }
+      ]
+    },
+    {
+      "title": "Geplante Backups",
+      "commands": [
+        {
+          "command": "cat /etc/pve/jobs.cfg",
+          "description": "Backup-Zeitplan anzeigen"
+        },
+        {
+          "command": "nano /etc/vzdump.conf",
+          "description": "Backup-Konfiguration bearbeiten"
+        },
+        {
+          "command": "systemctl list-timers",
+          "description": "systemd-Timer auflisten"
+        },
+        {
+          "command": "systemctl status cron",
+          "description": "Status des cron-Dienstes prüfen"
+        },
+        {
+          "command": "pvenode task list --typefilter vzdump",
+          "description": "Abgeschlossene Sicherungsaufgaben auflisten"
+        },
+        {
+          "command": "pvenode task log <upid>",
+          "description": "Protokoll einer Sicherungsaufgabe anhand der UPID anzeigen"
+        }
+      ]
+    },
+    {
+      "title": "Fortgeschrittene Operationen",
+      "commands": [
+        {
+          "command": "qmrestore <backup> <vmid> --force",
+          "description": "Wiederherstellung erzwingen und vorhandene VM überschreiben"
+        },
+        {
+          "command": "vzdump <vmid> --dumpdir <directory>",
+          "description": "Benutzerdefiniertes Backup-Verzeichnis angeben"
+        },
+        {
+          "command": "vzdump <vmid> --script <script>",
+          "description": "Hook-Script während des Backups ausführen"
+        },
+        {
+          "command": "vzdump <vmid> --exclude-path <path>",
+          "description": "Bestimmte Pfade aus dem Backup ausschließen"
+        },
+        {
+          "command": "vzdump <vmid> --ionice <priority>",
+          "description": "I/O-Priorität für Backup-Prozess festlegen"
+        },
+        {
+          "command": "vzdump <vmid> --lockwait <minutes>",
+          "description": "Warten auf Sperre"
+        },
+        {
+          "command": "qm importdisk <vmid> <disk-image> <storage>",
+          "description": "Eine Datenträgerabbilddatei (zum Beispiel raw, qcow2 oder vmdk) als unbenutzten Datenträger importieren, kein vzdump-Sicherungsarchiv"
+        }
+      ]
+    }
+  ],
+  "testRestores": {
+    "title": "Wiederherstellung testen",
+    "bodyRich": "Stellen Sie regelmäßig eine Sicherung mit <code>qmrestore --unique</code> auf einer freien Test-VMID wieder her. Starten Sie die VM in einem isolierten Testnetz und prüfen Sie den Inhalt. unique erzeugt neue MAC-Adressen, ändert aber keine statischen IPs oder Anwendungseinstellungen. Testen Sie Container entsprechend mit <code>pct restore</code>."
+  },
+  "related": {
+    "heading": "Verwandte Themen",
+    "items": [
+      {
+        "href": "/docs/help-info/vm-ct-commands",
+        "label": "VM- und CT-Verwaltung",
+        "tail": " — qm- und pct-Befehle für den Lebenszyklus der Gäste."
+      },
+      {
+        "href": "/docs/help-info/storage-commands",
+        "label": "Speicher und Datenträger",
+        "tail": "- pvesm Storage Management."
+      },
+      {
+        "href": "/docs/help-info",
+        "label": "Übersicht über Hilfe und Informationen",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/de/docs/help-info/gpu-commands.json b/web/messages/de/docs/help-info/gpu-commands.json
new file mode 100644
index 00000000..dbe8d3f8
--- /dev/null
+++ b/web/messages/de/docs/help-info/gpu-commands.json
@@ -0,0 +1,162 @@
+{
+  "meta": {
+    "title": "Proxmox-Befehle für GPU-Passthrough — lspci, VFIO, IOMMU, qm set hostpci | ProxMenux",
+    "description": "Referenz für GPU-Passthrough auf Proxmox VE: Geräteidentifikation mit lspci, VFIO-Module, IOMMU-Gruppen (intel_iommu / amd_iommu), GRUB- und initramfs-Updates, qm set hostpci0 sowie die Einrichtung von NVIDIA-, AMD- und Intel-GPUs.",
+    "ogTitle": "Proxmox-Befehle für GPU-Passthrough — lspci, VFIO, IOMMU, qm set hostpci",
+    "ogDescription": "Referenz zur Prüfung und Einrichtung von GPU-Passthrough auf Proxmox VE: PCI-Geräte, VFIO-Module, IOMMU-Gruppen, Kernel-Startparameter und qm set hostpci.",
+    "twitterTitle": "Proxmox-Befehle für GPU-Passthrough | ProxMenux",
+    "twitterDescription": "PCI-Geräte prüfen, VFIO und IOMMU konfigurieren und GPUs an VMs unter Proxmox VE durchreichen."
+  },
+  "header": {
+    "title": "GPU-Passthrough",
+    "description": "Referenz für GPU-/TPU-Passthrough auf Proxmox: Geräteidentifikation (lspci), Einrichtung der VFIO-Module, IOMMU-Prüfung, initramfs-/GRUB-Updates und Konfiguration je VM (qm set hostpci, machine q35, bios ovmf).",
+    "section": "Hilfe und Informationen"
+  },
+  "intro": {
+    "title": "IOMMU muss in BIOS / UEFI aktiviert sein",
+    "body": "Aktivieren Sie IOMMU zuerst in der Firmware: Suchen Sie im BIOS/UEFI nach <em>VT-d</em>, <em>AMD-Vi</em> oder <em>IOMMU</em>. Unter Linux ist es bei AMD und bei Intel mit Proxmox-Kerneln ab 6.8 standardmäßig aktiv. Ältere Intel-Kernel benötigen gegebenenfalls <code>intel_iommu=on</code>. Die optionale Einstellung <code>iommu=pt</code> steuert den IOMMU-Passthrough-Modus und erfordert kein pauschales Abschalten des Host-Framebuffers."
+  },
+  "commandGroups": [
+    {
+      "title": "Geräteidentifikation",
+      "commands": [
+        {
+          "command": "lspci -nn | grep -i nvidia",
+          "description": "Liste NVIDIA PCI-Geräte"
+        },
+        {
+          "command": "lspci -nn | grep -i vga",
+          "description": "Liste aller VGA-kompatiblen Geräte"
+        },
+        {
+          "command": "lspci -nn | grep -i amd",
+          "description": "Liste der AMD PCI-Geräte"
+        },
+        {
+          "command": "lspci -nnk | grep -A3 VGA",
+          "description": "VGA-Geräte mit Kerneltreibern auflisten"
+        },
+        {
+          "command": "lspci -v -s <PCI_ID>",
+          "description": "Detaillierte Informationen für ein bestimmtes PCI-Gerät anzeigen"
+        }
+      ]
+    },
+    {
+      "title": "VFIO Konfiguration",
+      "commands": [
+        {
+          "command": "dmesg | grep -i vfio",
+          "description": "VFIO-Modulmeldungen prüfen"
+        },
+        {
+          "command": "cat /etc/modprobe.d/vfio.conf",
+          "description": "VFIO-Passthrough-Konfiguration prüfen"
+        },
+        {
+          "command": "ls -la /etc/modprobe.d/",
+          "description": "Liste aller Modprobe-Konfigurationsdateien"
+        },
+        {
+          "command": "cat /etc/modules",
+          "description": "Beim Start geladene Module anzeigen"
+        },
+        {
+          "command": "lsmod | grep vfio",
+          "description": "Überprüfen Sie, ob VFIO-Module geladen sind"
+        }
+      ]
+    },
+    {
+      "title": "IOMMU Konfiguration",
+      "commands": [
+        {
+          "command": "cat /etc/default/grub",
+          "description": "GRUB Optionen für IOMMU überprüfen"
+        },
+        {
+          "command": "update-grub",
+          "description": "GRUB-Änderungen anwenden"
+        },
+        {
+          "command": "dmesg | grep -i iommu",
+          "description": "IOMMU-Nachrichten im Kernelprotokoll überprüfen"
+        },
+        {
+          "command": "dmesg | grep -e DMAR -e IOMMU",
+          "description": "DMAR und IOMMU Nachrichten überprüfen"
+        },
+        {
+          "command": "find /sys/kernel/iommu_groups/ -type l | sort -V",
+          "description": "Liste der IOMMU-Gruppen"
+        }
+      ]
+    },
+    {
+      "title": "Systemaktualisierungen",
+      "commands": [
+        {
+          "command": "update-initramfs -u",
+          "description": "Initramfs-Änderungen anwenden (VFIO)"
+        },
+        {
+          "command": "update-initramfs -u -k all",
+          "description": "Aktualisieren Sie Initramfs für alle Kernel"
+        },
+        {
+          "command": "cat /proc/cmdline",
+          "description": "Aktuelle Kernel-Boot-Parameter anzeigen"
+        }
+      ]
+    },
+    {
+      "title": "VM Konfiguration",
+      "commands": [
+        {
+          "command": "qm config <vmid> | grep hostpci",
+          "description": "PCI-Durchgangskonfiguration für eine VM anzeigen"
+        },
+        {
+          "command": "qm set <vmid> -hostpci0 <PCI_ID>,pcie=1,x-vga=1",
+          "description": "GPU-Passthrough zu einer VM hinzufügen"
+        },
+        {
+          "command": "cat /etc/pve/qemu-server/<vmid>.conf",
+          "description": "VM-Konfigurationsdatei anzeigen"
+        },
+        {
+          "command": "qm set <vmid> -machine q35",
+          "description": "Setzen Sie VM auf den Q35-Chipsatz (empfohlen für den Durchgang)"
+        },
+        {
+          "command": "qm set <vmid> -bios ovmf",
+          "description": "VM auf UEFI/OVMF einstellen, empfohlen bei UEFI-fähigem GPU-ROM"
+        }
+      ]
+    }
+  ],
+  "afterChangesTip": {
+    "title": "Nach dem Wechsel von GRUB- oder Modprobe-Konfigurationen",
+    "bodyRich": "Auf Hosts mit GRUB übernehmen Sie Startparameter mit <code>update-grub</code>. Aktualisieren Sie Moduländerungen mit <code>update-initramfs -u -k all</code> und starten Sie neu. Andere Bootloader benötigen ihr eigenes Verfahren. Prüfen Sie mit <code>cat /proc/cmdline</code> die Kernelparameter, mit <code>dmesg | grep -i iommu</code> die IOMMU-Initialisierung und mit <code>find /sys/kernel/iommu_groups/ -type l | sort -V</code> die vorhandenen Gruppen."
+  },
+  "related": {
+    "heading": "Verwandte Themen",
+    "items": [
+      {
+        "href": "/docs/hardware/gpu-vm-passthrough",
+        "label": "GPU zu VM hinzufügen (Passthrough)",
+        "tail": "- interaktiver ProxMenux-Flow."
+      },
+      {
+        "href": "/docs/hardware/igpu-acceleration-lxc",
+        "label": "GPU zu LXC hinzufügen",
+        "tail": " — Zugriff auf die GPU-Geräte des Hosts mit einem LXC-Container teilen."
+      },
+      {
+        "href": "/docs/help-info",
+        "label": "Übersicht über Hilfe und Informationen",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/de/docs/help-info/index.json b/web/messages/de/docs/help-info/index.json
new file mode 100644
index 00000000..3918fae5
--- /dev/null
+++ b/web/messages/de/docs/help-info/index.json
@@ -0,0 +1,87 @@
+{
+  "meta": {
+    "title": "Proxmox-Befehlsreferenz — qm, pct, vzdump, zpool, pveversion | ProxMenux",
+    "description": "Ausgewählte wichtige Proxmox-VE- und Linux-Befehle nach Themen: Systemprüfung, VM- und LXC-Verwaltung (qm / pct), Speicher und Datenträger, Netzwerk, Updates, GPU-Passthrough, ZFS, Sicherung und Wiederherstellung sowie CLI-Werkzeuge für den Alltag.",
+    "ogTitle": "Proxmox-Befehlsreferenz — qm, pct, vzdump, zpool",
+    "ogDescription": "Ausgewählte hilfreiche Proxmox-VE- und Linux-Befehle nach Themen: System, VM/CT, Speicher, Netzwerk, Updates, GPU-Passthrough, ZFS, Sicherungen und CLI-Werkzeuge.",
+    "twitterTitle": "Proxmox-Befehlsreferenz | ProxMenux",
+    "twitterDescription": "Ausgewählte hilfreiche Proxmox-VE- und Linux-Befehle nach Themen."
+  },
+  "header": {
+    "title": "Hilfe und Informationen",
+    "description": "Ausgewählte nützliche Linux- und Proxmox-VE-Befehle nach Themen. Die neun Kategorien reichen von einer kurzen pveversion-Abfrage bis zu mehrzeiligen Abläufen mit zfs send/receive. Die Sammlung ergänzt die GPU-, Datenträger- und Freigabebereiche von ProxMenux als zentrale Referenz.",
+    "section": "Hilfe und Informationen"
+  },
+  "intro": {
+    "title": "Was das ist",
+    "body": "Ein nach Themen geordneter Katalog der Befehle für den Alltag auf einem Proxmox-Host. In ProxMenux können Sie einen Befehl direkt über seine Nummer starten oder einen eigenen an der Eingabeaufforderung einfügen. Auf dieser Website steht jede Kategorie als Tabelle zum Kopieren bereit."
+  },
+  "opening": {
+    "heading": "Öffnen des Menüs",
+    "body": "Im Hauptmenü von ProxMenux drücken Sie <kbd>h</kbd>. Sie werden sehen:",
+    "imageAlt": "Hilfe- und Infomenü mit 9-Befehlskategorien"
+  },
+  "categories": {
+    "heading": "Die neun Kategorien",
+    "options": [
+      {
+        "icon": "Terminal",
+        "href": "/docs/help-info/system-commands",
+        "title": "Nützliche Systembefehle",
+        "description": "pveversion, uptime, free, journalctl, hostnamectl, Informationen zum aktuellen Benutzer, lynis-Audit und fastfetch."
+      },
+      {
+        "icon": "Cpu",
+        "href": "/docs/help-info/vm-ct-commands",
+        "title": "VM- und CT-Verwaltung",
+        "description": "qm list / config / start / stop / migrate, pct list / config / enter, Snapshots und Klonen."
+      },
+      {
+        "icon": "HardDrive",
+        "href": "/docs/help-info/storage-commands",
+        "title": "Speicher und Datenträger",
+        "description": "lsblk, blkid, smartctl, Informationen zu Mounts, pvesm status und LVM-Befehle."
+      },
+      {
+        "icon": "Network",
+        "href": "/docs/help-info/network-commands",
+        "title": "Netzwerkbefehle",
+        "description": "ip / ss / nmcli, Prüfung von Netzwerkbrücken, ping / traceroute, DNS-Abfragen und fail2ban-client."
+      },
+      {
+        "icon": "Package",
+        "href": "/docs/help-info/update-commands",
+        "title": "Updates und Pakete",
+        "description": "apt update / dist-upgrade, apt-cache policy, dpkg-Abfragen und Prüfung der Repository-Dateien."
+      },
+      {
+        "icon": "Cpu",
+        "href": "/docs/help-info/gpu-commands",
+        "title": "GPU-Passthrough",
+        "description": "Prüfungen mit lspci / dmesg, Kontrolle der IOMMU-Aktivierung, Bindung an vfio-pci und GPU-Nutzung auf dem Host."
+      },
+      {
+        "icon": "Database",
+        "href": "/docs/help-info/zfs-commands",
+        "title": "ZFS-Verwaltung",
+        "description": "zpool / zfs für Status, Datasets, Snapshots, send/receive, ARC-Anpassung und TRIM."
+      },
+      {
+        "icon": "Archive",
+        "href": "/docs/help-info/backup-commands",
+        "title": "Sicherung und Wiederherstellung",
+        "description": "vzdump, qmrestore / pct restore, Hilfswerkzeuge für Proxmox Backup Server und Snapshot-Vorgänge."
+      },
+      {
+        "icon": "Wrench",
+        "href": "/docs/help-info/tools-commands",
+        "title": "System-CLI-Tools",
+        "description": "tmux, screen, htop / btop, ncdu, jq, dig, lsof, watch — Administrationswerkzeuge für den Alltag."
+      }
+    ]
+  },
+  "tip": {
+    "title": "Durchsuchbar aus der globalen Suche",
+    "body": "Jeder Befehl auf diesen Seiten wird durch die Dokumentationssuche indiziert. Wenn Sie sich an ein Flag oder Fragment erinnern, aber nicht, auf welcher Seite es sich befindet, klicken Sie auf die Suchleiste oben - Sie landen direkt auf dem richtigen Eintrag."
+  }
+}
diff --git a/web/messages/de/docs/help-info/network-commands.json b/web/messages/de/docs/help-info/network-commands.json
new file mode 100644
index 00000000..9e81c0ec
--- /dev/null
+++ b/web/messages/de/docs/help-info/network-commands.json
@@ -0,0 +1,174 @@
+{
+  "meta": {
+    "title": "Proxmox-Netzwerkbefehle — ip, ping, ss, pve-firewall, iptables | ProxMenux",
+    "description": "Referenz für die Netzwerkkonfiguration auf Proxmox-VE-Hosts: ip / ip link / ip addr, ping, traceroute, mtr, ss, ethtool, dig und nslookup sowie pve-firewall, iptables und nftables für Paketfilter. Prüfung von Netzwerkbrücken, Bonds und VLANs.",
+    "ogTitle": "Proxmox-Netzwerkbefehle — ip, ping, ss, pve-firewall, iptables",
+    "ogDescription": "Netzwerkbefehle für Proxmox VE: Schnittstellenprüfung, Verbindungstests, Überwachung, Firewall (pve-firewall, iptables, nftables) und DNS-Abfragen.",
+    "twitterTitle": "Proxmox-Netzwerkbefehle | ProxMenux",
+    "twitterDescription": "Netzwerkinspektion, Test, Konfiguration und Firewall-Befehle für Proxmox VE."
+  },
+  "header": {
+    "title": "Netzwerkbefehle",
+    "description": "Ausgewählte Befehle für das Proxmox-Hostnetzwerk: Schnittstelleninformationen, Verbindungstests, Konfiguration, Verkehrsüberwachung und Firewall-Verwaltung. Enthält ip / ss / nmcli / ethtool / tcpdump / pve-firewall.",
+    "section": "Hilfe und Informationen"
+  },
+  "intro": {
+    "title": "Schneller Überblick über die Schnittstellen",
+    "body": "<code>ip a</code> zeigt jede Schnittstelle mit ihren IP-Adressen und ihrer MAC-Adresse. <code>ip r</code> zeigt die Routingtabelle. Zusammen beantworten sie in Sekunden die meisten Fragen dazu, ob eine Schnittstelle richtig konfiguriert ist."
+  },
+  "commandGroups": [
+    {
+      "title": "Netzinformationen",
+      "commands": [
+        {
+          "command": "ip a",
+          "description": "Netzwerkschnittstellen und IPs anzeigen"
+        },
+        {
+          "command": "ip r",
+          "description": "Routing-Tabelle anzeigen"
+        },
+        {
+          "command": "ip -s link",
+          "description": "Verkehrsstatistiken pro Schnittstelle anzeigen"
+        },
+        {
+          "command": "brctl show",
+          "description": "Konfigurierte Netzwerkbrücken anzeigen"
+        },
+        {
+          "command": "cat /etc/network/interfaces",
+          "description": "Rohe Netzwerkkonfiguration anzeigen"
+        }
+      ]
+    },
+    {
+      "title": "Netzwerktests",
+      "commands": [
+        {
+          "command": "ping <host>",
+          "description": "Überprüfen Sie die Konnektivität mit einem anderen Host"
+        },
+        {
+          "command": "traceroute <host>",
+          "description": "Route zu einem Host verfolgen"
+        },
+        {
+          "command": "mtr <host>",
+          "description": "Ping und Traceroute in Echtzeit kombinieren"
+        },
+        {
+          "command": "dig <domain>",
+          "description": "DNS-Suche nach einer Domain"
+        },
+        {
+          "command": "nslookup <domain>",
+          "description": "Alternative DNS-Abfrage"
+        }
+      ]
+    },
+    {
+      "title": "Netzwerkkonfiguration",
+      "commands": [
+        {
+          "command": "ifreload -a",
+          "description": "Netzwerkkonfiguration neu laden (ifupdown2)"
+        },
+        {
+          "command": "ethtool <iface>",
+          "description": "Informationen zum Ethernet-Gerät anzeigen"
+        },
+        {
+          "command": "resolvectl status",
+          "description": "DNS-Auflösungsstatus anzeigen"
+        },
+        {
+          "command": "nmcli device show",
+          "description": "Netzwerkgerätedetails anzeigen (wenn NetworkManager verwendet wird)"
+        },
+        {
+          "command": "ip link set <iface> up",
+          "description": "Netzwerkschnittstelle aktivieren"
+        },
+        {
+          "command": "ip link set <iface> down",
+          "description": "Netzwerkschnittstelle deaktivieren"
+        }
+      ]
+    },
+    {
+      "title": "Netzüberwachung",
+      "commands": [
+        {
+          "command": "ss -tuln",
+          "description": "Abhörports anzeigen (TCP/UDP)"
+        },
+        {
+          "command": "netstat -tuln",
+          "description": "Alternative Anzeige der lauschenden Ports"
+        },
+        {
+          "command": "lsof -i",
+          "description": "Liste offener Netzwerkdateien und Verbindungen"
+        },
+        {
+          "command": "tcpdump -i <iface>",
+          "description": "Pakete auf dem Interface erfassen"
+        },
+        {
+          "command": "iftop -i <iface>",
+          "description": "Überwachen der Bandbreitennutzung an der Schnittstelle"
+        }
+      ]
+    },
+    {
+      "title": "Firewall-Verwaltung",
+      "commands": [
+        {
+          "command": "iptables -L -n -v",
+          "description": "Aktive Firewall-Regeln anzeigen (iptables)"
+        },
+        {
+          "command": "nft list ruleset",
+          "description": "Nftables-Regeln anzeigen"
+        },
+        {
+          "command": "pve-firewall status",
+          "description": "Überprüfen Sie den Proxmox-Firewall-Status"
+        },
+        {
+          "command": "pve-firewall compile",
+          "description": "Firewall-Regeln für alle Knoten kompilieren"
+        },
+        {
+          "command": "pve-firewall reload",
+          "description": "Laden Sie die Proxmox-Firewallregeln neu"
+        }
+      ]
+    }
+  ],
+  "iptablesTip": {
+    "title": "iptables vs nftables",
+    "bodyRich": "Der klassische Dienst <code>pve-firewall</code> erzeugt iptables-Regeln. Der alternative Dienst proxmox-firewall verwendet <strong>nftables</strong>. Prüfen Sie das iptables-Backend mit <code>iptables -L -n -v</code> und das nftables-Backend mit <code>nft list ruleset</code>. Verwenden Sie die Werkzeuge des aktiven Backends; die Listen sind nicht austauschbar."
+  },
+  "related": {
+    "heading": "Verwandte Themen",
+    "items": [
+      {
+        "href": "/docs/network",
+        "label": "Netzwerkmanagement",
+        "tail": "— ProxMenux interaktive Netzwerktools (Brückenanalyse, persistente Namen, Überwachung)."
+      },
+      {
+        "href": "/docs/help-info/tools-commands",
+        "label": "System-CLI-Tools",
+        "tail": " — weitere Werkzeuge zur Netzwerküberwachung."
+      },
+      {
+        "href": "/docs/help-info",
+        "label": "Übersicht über Hilfe und Informationen",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/de/docs/help-info/storage-commands.json b/web/messages/de/docs/help-info/storage-commands.json
new file mode 100644
index 00000000..531b4360
--- /dev/null
+++ b/web/messages/de/docs/help-info/storage-commands.json
@@ -0,0 +1,232 @@
+{
+  "meta": {
+    "title": "Proxmox-Befehle für Speicher und Datenträger — lsblk, LVM, pvesm, qm importdisk | ProxMenux",
+    "description": "Speicher- und Datenträgerbefehle auf Proxmox VE: lsblk, blkid, parted, lvdisplay, vgdisplay, pvs, mount, df, du, ncdu, pvesm status sowie qm importdisk und qemu-img convert für VM-Datenträger.",
+    "ogTitle": "Proxmox-Befehle für Speicher und Datenträger — lsblk, LVM, pvesm, qm importdisk",
+    "ogDescription": "Referenz von Speicher- und Festplattenbefehlen auf Proxmox VE — Festplatteninspektion, LVM, Mounts, Proxmox Storage Management, VM Festplattenimport und Bildkonvertierung.",
+    "twitterTitle": "Proxmox Speicherbefehle | ProxMenux",
+    "twitterDescription": "Festplatteninspektion, Mount-Info, LVM-Verwaltung, Proxmox-Speicher und VM-Festplattenimport- / -konvertierungsbefehle."
+  },
+  "header": {
+    "title": "Speicher und Datenträger",
+    "description": "Kuratierte Referenz für die Speicherinspektion auf Proxmox-Hosts: Blockgeräte, Partitionen, Mounts, LVM-Volumes, Proxmox-Speicherkonfiguration und einige VM-Festplattenoperationen (importdisk, qemu-img convert).",
+    "section": "Hilfe und Informationen"
+  },
+  "intro": {
+    "title": "Schneller Überblick über die Datenträger",
+    "body": "<code>lsblk</code> zeigt Blockgeräte und Partitionen als Baum. Prüfen Sie dauerhafte Kennungen mit <code>ls -lh /dev/disk/by-id/</code>: Sie bleiben für denselben Datenträger normalerweise über Neustarts und geänderte Gerätereihenfolgen hinweg stabil. Ein Plattentausch oder eine andere Identitätsdarstellung durch den Controller kann den by-id-Pfad ändern."
+  },
+  "commandGroups": [
+    {
+      "title": "Laufwerksinformationen",
+      "commands": [
+        {
+          "command": "lsblk",
+          "description": "Blockgeräte und Partitionen auflisten"
+        },
+        {
+          "command": "fdisk -l",
+          "description": "Listen Sie Festplatten mit detaillierten Informationen auf"
+        },
+        {
+          "command": "blkid",
+          "description": "UUID und Dateisystemtyp von Blockgeräten anzeigen"
+        },
+        {
+          "command": "ls -lh /dev/disk/by-id/",
+          "description": "Listen Sie persistente Festplattenkennungen auf"
+        },
+        {
+          "command": "parted -l",
+          "description": "Detailliertes Partitionslayout mit GPT-Informationen"
+        }
+      ]
+    },
+    {
+      "title": "Speichernutzung",
+      "commands": [
+        {
+          "command": "df -h",
+          "description": "Festplattennutzung nach Einhängepunkt anzeigen"
+        },
+        {
+          "command": "du -sh /path",
+          "description": "Größe eines Verzeichnisses anzeigen"
+        },
+        {
+          "command": "mount | grep ^/dev",
+          "description": "Gemountete Speichergeräte anzeigen"
+        },
+        {
+          "command": "cat /proc/mounts",
+          "description": "Zeigt alle aktiven Mounts vom Kernel an"
+        }
+      ]
+    },
+    {
+      "title": "LVM-Verwaltung",
+      "commands": [
+        {
+          "command": "pvdisplay",
+          "description": "Physische Volumes (LVM) anzeigen"
+        },
+        {
+          "command": "vgdisplay",
+          "description": "Volumengruppen anzeigen (LVM)"
+        },
+        {
+          "command": "lvdisplay",
+          "description": "Logische Volumes (LVM) anzeigen"
+        },
+        {
+          "command": "pvs",
+          "description": "Übersichtliche Ausgabe physischer Datenträger"
+        },
+        {
+          "command": "vgs",
+          "description": "Übersichtliche Ausgabe von Volumengruppen"
+        },
+        {
+          "command": "lvs",
+          "description": "Übersichtliche Ausgabe logischer Volumes"
+        }
+      ]
+    },
+    {
+      "title": "Proxmox-Speicher",
+      "commands": [
+        {
+          "command": "cat /etc/pve/storage.cfg",
+          "description": "Proxmox-Speicherkonfiguration anzeigen"
+        },
+        {
+          "command": "pvesm status",
+          "description": "Status aller Speicherpools anzeigen"
+        },
+        {
+          "command": "pvesm status --enabled 1",
+          "description": "Aktivierte konfigurierte Speicher auflisten"
+        },
+        {
+          "command": "pvesm list <storage>",
+          "description": "Listen Sie den Inhalt eines bestimmten Speichers auf"
+        },
+        {
+          "command": "pvesm scan nfs <server>",
+          "description": "NFS-Exporte eines Servers ermitteln"
+        }
+      ]
+    },
+    {
+      "title": "Plattenaktionen",
+      "commands": [
+        {
+          "command": "qm importdisk <vmid> <image_path> <storage>",
+          "description": "Disk-Image als ungenutzten VM-Datenträger importieren und anschließend gesondert anschließen"
+        },
+        {
+          "command": "qm set <vmid> -<bus><index> <disk_path>",
+          "description": "Weisen Sie die physische Festplatte VM zu (Durchgangsmodus)"
+        },
+        {
+          "command": "qemu-img convert -O <format> <input> <output>",
+          "description": "Format eines nicht aktiv verwendeten Disk-Images konvertieren"
+        }
+      ]
+    },
+    {
+      "title": "SMART-Zustand der Datenträger",
+      "commands": [
+        {
+          "command": "smartctl --scan",
+          "description": "Liste SMART-fähige Geräte auf dem Host"
+        },
+        {
+          "command": "smartctl -i /dev/<disk>",
+          "description": "Grundlegende Geräteinformationen: Modell, Firmware und Seriennummer"
+        },
+        {
+          "command": "smartctl -H /dev/<disk>",
+          "description": "Schneller Gesundheitscheck — insgesamt PASSED / FAILED"
+        },
+        {
+          "command": "smartctl -A /dev/<disk>",
+          "description": "Nur SMART-Attribute (Rohwerte, Schwellenwerte)"
+        },
+        {
+          "command": "smartctl -a /dev/<disk>",
+          "description": "Vollständige SMART-Informationen — Informationen + Attribute + Selbsttestprotokoll"
+        },
+        {
+          "command": "smartctl -t short /dev/<disk>",
+          "description": "Starten Sie einen kurzen Selbsttest (~2 Minuten, läuft im Hintergrund)"
+        },
+        {
+          "command": "smartctl -t long /dev/<disk>",
+          "description": "Starten Sie einen langen Selbsttest (Stunden, läuft im Hintergrund)"
+        },
+        {
+          "command": "smartctl -l selftest /dev/<disk>",
+          "description": "Selbsttestprotokoll anzeigen (Ergebnisse vergangener Tests)"
+        },
+        {
+          "command": "smartctl -X /dev/<disk>",
+          "description": "Abbruch des laufenden Selbsttests"
+        }
+      ]
+    },
+    {
+      "title": "NVMe-Datenträgerzustand",
+      "commands": [
+        {
+          "command": "nvme list",
+          "description": "Liste NVMe-Geräte, die für den Kernel sichtbar sind"
+        },
+        {
+          "command": "nvme smart-log /dev/<nvme>",
+          "description": "NVMe-spezifisches SMART-Log (Temperatur, Verschleiß, Fehler)"
+        },
+        {
+          "command": "nvme id-ctrl /dev/<nvme>",
+          "description": "Controller-Info (Modell, Firmware, Fähigkeiten)"
+        },
+        {
+          "command": "nvme error-log /dev/<nvme>",
+          "description": "Letzte NVMe-Fehlerprotokolleinträge"
+        }
+      ]
+    }
+  ],
+  "lvmTip": {
+    "title": "LVM kurze vs lange Befehle",
+    "bodyRich": "Beide Formen stehen zur Verfügung. <code>pvs</code> / <code>vgs</code> / <code>lvs</code> erzeugen kompakte Tabellen mit je einer Zeile pro physischem Volume, Volumengruppe beziehungsweise logischem Volume. <code>pvdisplay</code> / <code>vgdisplay</code> / <code>lvdisplay</code> liefern ausführlichere mehrzeilige Angaben. Für alltägliche Prüfungen sind die kurzen Formen praktisch."
+  },
+  "smartInfo": {
+    "title": "SMART für SATA/SAS im Vergleich zu NVMe",
+    "bodyRich": "<strong>SATA-/SAS-Datenträger einschließlich SSDs</strong> lassen sich mit <code>smartctl</code> aus <code>smartmontools</code> prüfen, das standardmäßig in Proxmox installiert ist. Geben Sie das Gerät an, etwa <code>/dev/sda</code> oder <code>/dev/sdb</code>. <strong>NVMe-Datenträger</strong> verwenden ein anderes natives Protokoll. Auch <code>smartctl</code> unterstützt sie. <code>nvme</code> aus <code>nvme-cli</code> bietet spezielle Abfragen für Controller, Namespaces und den NVMe-Zustand. Installieren Sie es bei Bedarf mit <code>apt install nvme-cli</code>."
+  },
+  "selfTestWarn": {
+    "title": "Selbsttests laufen im Hintergrund",
+    "bodyRich": "Auf unterstützten Laufwerken starten <code>smartctl -t short /dev/&lt;disk&gt;</code> und <code>smartctl -t long /dev/&lt;disk&gt;</code> Hintergrundtests und kehren sofort zurück. Prüfen Sie den Fortschritt mit <code>smartctl -a /dev/&lt;disk&gt;</code> anhand von \"Self-test routine in progress\" oder lesen Sie nach Abschluss <code>smartctl -l selftest /dev/&lt;disk&gt;</code>. Kurze Tests dauern oft etwa zwei Minuten, lange Tests mitunter Stunden. Das Laufwerk bleibt nutzbar, die I/O-Leistung kann jedoch sinken."
+  },
+  "related": {
+    "heading": "Verwandte Themen",
+    "items": [
+      {
+        "href": "/docs/help-info/zfs-commands",
+        "label": "ZFS-Verwaltung",
+        "tail": "- zpool / zfs-Befehle für ZFS-gestützten Speicher."
+      },
+      {
+        "href": "/docs/disk-manager",
+        "label": "Festplattenmanager",
+        "tail": " — interaktive ProxMenux-Abläufe für Datenträgerdurchreichung, Import, Formatierung und SMART."
+      },
+      {
+        "href": "/docs/help-info",
+        "label": "Übersicht über Hilfe und Informationen",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/de/docs/help-info/system-commands.json b/web/messages/de/docs/help-info/system-commands.json
new file mode 100644
index 00000000..0f44f49e
--- /dev/null
+++ b/web/messages/de/docs/help-info/system-commands.json
@@ -0,0 +1,158 @@
+{
+  "meta": {
+    "title": "Proxmox-VE-Systembefehle — pveversion, uptime, journalctl, systemctl | ProxMenux",
+    "description": "Proxmox-VE- und Linux-Systembefehle für Versionen, Betriebszeit, Speicher, Dienste, Protokolle und Benutzer sowie Audit- und Übersichtswerkzeuge. Enthält einen Dienstneustart; nicht alle Beispiele sind reine Lesezugriffe.",
+    "ogTitle": "Proxmox-VE-Systembefehle — pveversion, uptime, journalctl, systemctl",
+    "ogDescription": "Proxmox-VE- und Linux-Systembefehle für Version, Betriebszeit, Dienste, Protokolle und Benutzerinformationen, einschließlich Dienstverwaltung und Audit-Werkzeugen.",
+    "twitterTitle": "Proxmox VE Systembefehle | ProxMenux",
+    "twitterDescription": "Wesentliche Systeminspektionsbefehle für Proxmox VE — Version, Status, Dienste, Protokolle, Benutzerinformationen."
+  },
+  "header": {
+    "title": "Nützliche Systembefehle",
+    "description": "Befehle zur Prüfung des Proxmox-Hosts: Version, Kernel, Betriebszeit, Speicher, Status der Weboberfläche, aktuelle Protokolle und angemeldete Benutzer sowie Audit- und Übersichtswerkzeuge. Die meisten lesen den Zustand aus. systemctl restart pveproxy startet jedoch den Web-Proxy neu, und Audit-Werkzeuge können Berichte und Protokolle schreiben.",
+    "section": "Hilfe und Informationen"
+  },
+  "intro": {
+    "title": "Was das ist",
+    "body": "Dieselbe nummerierte Liste wie unter <em>Nützliche Systembefehle</em> in ProxMenux. Kopieren Sie einen Befehl über die Schaltfläche oder schlagen Sie die genaue Option nach."
+  },
+  "commandGroups": [
+    {
+      "title": "Systeminformationen",
+      "commands": [
+        {
+          "command": "pveversion",
+          "description": "Proxmox-Version anzeigen"
+        },
+        {
+          "command": "pveversion -v",
+          "description": "Detaillierte Informationen zur Proxmox-Version"
+        },
+        {
+          "command": "hostnamectl",
+          "description": "System-Hostname und Kernel-Informationen"
+        },
+        {
+          "command": "uname -a",
+          "description": "Kernel- und Architekturinformationen"
+        },
+        {
+          "command": "cat /etc/os-release",
+          "description": "Details zur Betriebssystemversion"
+        }
+      ]
+    },
+    {
+      "title": "Systemstatus",
+      "commands": [
+        {
+          "command": "uptime",
+          "description": "Betriebszeit des Systems"
+        },
+        {
+          "command": "uptime -p",
+          "description": "Betriebszeit in gut lesbarem Format"
+        },
+        {
+          "command": "free -h",
+          "description": "RAM- und Swap-Nutzung"
+        },
+        {
+          "command": "who -b",
+          "description": "Letzte Systemstartzeit"
+        },
+        {
+          "command": "last -x | grep shutdown",
+          "description": "Frühere Abschaltungen"
+        }
+      ]
+    },
+    {
+      "title": "Dienstverwaltung",
+      "commands": [
+        {
+          "command": "systemctl status pveproxy",
+          "description": "Überprüfen Sie den Status der Proxmox-Web-Benutzeroberfläche"
+        },
+        {
+          "command": "systemctl restart pveproxy",
+          "description": "Starten Sie den Web-UI-Proxy neu"
+        },
+        {
+          "command": "journalctl -xe",
+          "description": "Systemfehler und Protokolle"
+        },
+        {
+          "command": "dmesg -T | tail -n 50",
+          "description": "Letzte 50 Kernel-Protokollzeilen"
+        }
+      ]
+    },
+    {
+      "title": "Benutzerinformationen",
+      "commands": [
+        {
+          "command": "whoami",
+          "description": "Aktueller Benutzer"
+        },
+        {
+          "command": "id",
+          "description": "Aktuelle Benutzer-UID, GID und Gruppen"
+        },
+        {
+          "command": "who",
+          "description": "Angemeldete Benutzer"
+        },
+        {
+          "command": "w",
+          "description": "Benutzeraktivität und Betriebszeit"
+        },
+        {
+          "command": "uptime && w",
+          "description": "Betriebszeit und wer angemeldet ist"
+        },
+        {
+          "command": "cut -d: -f1,3,4 /etc/passwd",
+          "description": "Alle Benutzer mit UID und GID"
+        },
+        {
+          "command": "getent passwd | column -t -s :",
+          "description": "Lesbare Benutzertabelle (UID, Shell usw.)"
+        }
+      ]
+    },
+    {
+      "title": "Werkzeuge für Prüfungen und Zusammenfassungen",
+      "commands": [
+        {
+          "command": "lynis audit system",
+          "description": "Führen Sie ein vollständiges Systemsicherheitsaudit durch"
+        },
+        {
+          "command": "fastfetch",
+          "description": "Systemzusammenfassung im ASCII-Format anzeigen"
+        }
+      ]
+    }
+  ],
+  "related": {
+    "heading": "Verwandte Themen",
+    "items": [
+      {
+        "href": "/docs/help-info/update-commands",
+        "label": "Updates und Pakete",
+        "tail": " — apt- und PVE-Upgrade-Befehle."
+      },
+      {
+        "href": "/docs/help-info/tools-commands",
+        "label": "System-CLI-Tools",
+        "tail": " — htop, btop, ncdu und ähnliche Werkzeuge."
+      },
+      {
+        "href": "/docs/help-info",
+        "label": "Übersicht über Hilfe und Informationen",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/de/docs/help-info/tools-commands.json b/web/messages/de/docs/help-info/tools-commands.json
new file mode 100644
index 00000000..9d5865c4
--- /dev/null
+++ b/web/messages/de/docs/help-info/tools-commands.json
@@ -0,0 +1,276 @@
+{
+  "meta": {
+    "title": "Linux-CLI-Werkzeuge für Proxmox — htop, iftop, journalctl, rsync, tmux | ProxMenux",
+    "description": "Linux-CLI-Werkzeuge für die tägliche Proxmox-VE-Verwaltung: Überwachung (htop, atop, glances, iotop), Netzwerk (iftop, nmap, mtr, ss), Dateien und Text (find, grep, journalctl), Leistung (iostat, perf, strace), Sicherheit (fail2ban, lynis, lsof) und Fernverwaltung (ssh, rsync, tmux).",
+    "ogTitle": "Linux-CLI-Werkzeuge für Proxmox — htop, iftop, journalctl, rsync, tmux",
+    "ogDescription": "CLI-Tools für die Proxmox VE-Verwaltung, gruppiert nach Zweck: Überwachung, Netzwerk, Datei/Text, Leistung, Sicherheit und Remote-Admin.",
+    "twitterTitle": "Linux-CLI-Werkzeuge für Proxmox | ProxMenux",
+    "twitterDescription": "CLI-Werkzeuge für die tägliche Proxmox-VE-Verwaltung, nach Zweck gruppiert."
+  },
+  "header": {
+    "title": "System-CLI-Tools",
+    "description": "CLI-Werkzeuge für die tägliche Proxmox-Hostverwaltung nach Zweck: Überwachung, Netzwerk, Dateien und Text, Leistungsanalyse, Sicherheit, Fernverwaltung und Systemkonfiguration.",
+    "section": "Hilfe und Informationen"
+  },
+  "intro": {
+    "title": "Die meisten werden nach der Installation eingerichtet",
+    "body": "Wenn Sie das ProxMenux-Skript nach der Installation mit der Standardauswahl ausgeführt haben, sind die meisten Werkzeuge bereits vorhanden. Fehlende Werkzeuge bietet der <utilsLink>Installer für Systemwerkzeuge</utilsLink> in vordefinierten Gruppen an, etwa Basis, Entwicklung, Netzwerk und Analyse."
+  },
+  "commandGroups": [
+    {
+      "title": "Systemüberwachung",
+      "commands": [
+        {
+          "command": "htop",
+          "description": "Interaktive Prozessanzeige mit CPU/Speichernutzung"
+        },
+        {
+          "command": "top",
+          "description": "Linux-Prozesse in Echtzeit anzeigen"
+        },
+        {
+          "command": "atop",
+          "description": "Fortschrittlicher System- und Prozessmonitor"
+        },
+        {
+          "command": "glances",
+          "description": "Systemüberwachungstool mit Webinterface"
+        },
+        {
+          "command": "nmon",
+          "description": "Leistungsüberwachungsinstrument"
+        },
+        {
+          "command": "iotop",
+          "description": "Datenträger-I/O der Prozesse überwachen"
+        },
+        {
+          "command": "vmstat 1",
+          "description": "Virtuelle Speicherstatistiken jede Sekunde melden"
+        }
+      ]
+    },
+    {
+      "title": "Netzwerk-Tools",
+      "commands": [
+        {
+          "command": "iftop",
+          "description": "Anzeige der Bandbreitennutzung auf einer Schnittstelle"
+        },
+        {
+          "command": "nmap <host>",
+          "description": "Netzwerkexploration und Sicherheitsscanning"
+        },
+        {
+          "command": "tcpdump -i <interface>",
+          "description": "Netzwerkverkehr mitschneiden"
+        },
+        {
+          "command": "netstat -tuln",
+          "description": "Netzwerkverbindungen anzeigen"
+        },
+        {
+          "command": "ss -tuln",
+          "description": "Ein weiteres Dienstprogramm zur Untersuchung von Sockets"
+        },
+        {
+          "command": "mtr <host>",
+          "description": "Netzwerkdiagnose-Tool kombiniert Ping und Traceroute"
+        },
+        {
+          "command": "iperf3 -s",
+          "description": "Führen Sie iperf-Server für Bandbreitentests aus"
+        }
+      ]
+    },
+    {
+      "title": "Datei- und Texttools",
+      "commands": [
+        {
+          "command": "find / -name <filename>",
+          "description": "Dateien nach Namen finden"
+        },
+        {
+          "command": "grep -r 'pattern' /path",
+          "description": "Suche nach Mustern in Dateien"
+        },
+        {
+          "command": "sed -i 's/old/new/g' file",
+          "description": "Text in Dateien ersetzen"
+        },
+        {
+          "command": "awk '{print $1}' file",
+          "description": "Textverarbeitungswerkzeug"
+        },
+        {
+          "command": "tail -f /var/log/syslog",
+          "description": "Log-Datei in Echtzeit verfolgen"
+        },
+        {
+          "command": "less /var/log/messages",
+          "description": "Datei ansehen mit Paginierung"
+        },
+        {
+          "command": "journalctl -f",
+          "description": "Folgen Sie systemd Journal Logs"
+        }
+      ]
+    },
+    {
+      "title": "Leistungsanalyse",
+      "commands": [
+        {
+          "command": "iostat -x 1",
+          "description": "CPU- und I/O-Statistiken ausgeben"
+        },
+        {
+          "command": "mpstat -P ALL 1",
+          "description": "CPU-Auslastung ausgeben"
+        },
+        {
+          "command": "perf top",
+          "description": "Systemprofilierungstool"
+        },
+        {
+          "command": "strace <command>",
+          "description": "Systemaufrufe und Signale verfolgen"
+        },
+        {
+          "command": "lsof",
+          "description": "Offene Dateien auflisten"
+        },
+        {
+          "command": "pstree",
+          "description": "Prozessbaum anzeigen"
+        },
+        {
+          "command": "slabtop",
+          "description": "Anzeige von Kernel-Slab-Cache-Informationen"
+        }
+      ]
+    },
+    {
+      "title": "Sicherheits-Tools",
+      "commands": [
+        {
+          "command": "fail2ban-client status",
+          "description": "Fail2Ban-Status anzeigen"
+        },
+        {
+          "command": "chage -l <username>",
+          "description": "Passwortverfallsinformationen anzeigen"
+        },
+        {
+          "command": "lastlog",
+          "description": "Letztes Login aller Benutzer anzeigen"
+        },
+        {
+          "command": "last",
+          "description": "Liste der zuletzt angemeldeten Benutzer"
+        },
+        {
+          "command": "w",
+          "description": "Zeigen Sie, wer angemeldet ist und was sie tun"
+        },
+        {
+          "command": "lynis audit system",
+          "description": "Sicherheitsaudit-Tool"
+        },
+        {
+          "command": "openssl s_client -connect host:port",
+          "description": "SSL/TLS-Verbindungen testen"
+        }
+      ]
+    },
+    {
+      "title": "Fernverwaltung",
+      "commands": [
+        {
+          "command": "ssh <user>@<host>",
+          "description": "Sichere Shell-Verbindung"
+        },
+        {
+          "command": "scp <file> <user>@<host>:<path>",
+          "description": "Dateien sicher kopieren"
+        },
+        {
+          "command": "rsync -avz <src> <dest>",
+          "description": "Dateien/Ordner synchronisieren"
+        },
+        {
+          "command": "screen",
+          "description": "Terminal-Multiplexer"
+        },
+        {
+          "command": "tmux",
+          "description": "Alternativer Terminal-Multiplexer"
+        },
+        {
+          "command": "ssh-keygen -t rsa -b 4096",
+          "description": "SSH-Schlüsselpaar erzeugen"
+        },
+        {
+          "command": "ssh-copy-id <user>@<host>",
+          "description": "Kopieren des SSH-Schlüssels zum Server"
+        }
+      ]
+    },
+    {
+      "title": "Systemkonfiguration",
+      "commands": [
+        {
+          "command": "systemctl status <service>",
+          "description": "Dienststatus prüfen"
+        },
+        {
+          "command": "journalctl -u <service>",
+          "description": "Dienstprotokolle anzeigen"
+        },
+        {
+          "command": "timedatectl",
+          "description": "Systemzeit und -datum verwalten"
+        },
+        {
+          "command": "hostnamectl",
+          "description": "Hostnamen verwalten"
+        },
+        {
+          "command": "localectl",
+          "description": "Gebietsschema und Tastatur des Systems verwalten"
+        },
+        {
+          "command": "update-alternatives --config <name>",
+          "description": "Systemalternativen konfigurieren"
+        },
+        {
+          "command": "dpkg-reconfigure <package>",
+          "description": "Rekonfigurieren eines installierten Pakets"
+        }
+      ]
+    }
+  ],
+  "tmuxTip": {
+    "title": "Verwenden Sie tmux / screen für lang laufende Befehle",
+    "bodyRich": "Führen Sie lange Aufgaben wie Sicherungen, größere Upgrades oder rsync-Übertragungen in <code>tmux</code> oder <code>screen</code> aus, damit ein SSH-Abbruch die Terminalsitzung nicht beendet. Verbinden Sie sich für eine tmux-Sitzung wieder mit demselben Host und Benutzer und führen Sie <code>tmux attach</code> aus. Screen-Sitzungen haben einen eigenen Befehl zum Wiederverbinden."
+  },
+  "related": {
+    "heading": "Verwandte Themen",
+    "items": [
+      {
+        "href": "/docs/utils/system-utils",
+        "label": "Installationsprogramm für Systemdienstprogramme",
+        "tail": " — fehlende Werkzeuge installieren."
+      },
+      {
+        "href": "/docs/help-info/system-commands",
+        "label": "Nützliche Systembefehle",
+        "tail": " — Proxmox-spezifische Befehle zur Systemprüfung."
+      },
+      {
+        "href": "/docs/help-info",
+        "label": "Übersicht über Hilfe und Informationen",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/de/docs/help-info/update-commands.json b/web/messages/de/docs/help-info/update-commands.json
new file mode 100644
index 00000000..f9997483
--- /dev/null
+++ b/web/messages/de/docs/help-info/update-commands.json
@@ -0,0 +1,170 @@
+{
+  "meta": {
+    "title": "Proxmox-Befehle für Updates und Pakete — apt, pveupgrade, dpkg | ProxMenux",
+    "description": "Update- und Paketbefehle für Proxmox VE: apt update, apt upgrade, apt dist-upgrade, pveupgrade, dpkg -l, Abfragen zu Paketen und Repository-Konfiguration in /etc/apt/sources.list.d/.",
+    "ogTitle": "Proxmox-Befehle für Updates und Pakete — apt, pveupgrade, dpkg",
+    "ogDescription": "Befehle apt, pveupgrade und dpkg, um Proxmox VE auf dem neuesten Stand zu halten — Systemupgrades, Paketverwaltung, Repository-Konfiguration.",
+    "twitterTitle": "Proxmox-Update-Befehle | ProxMenux",
+    "twitterDescription": "Befehle mit apt und pveupgrade zur Verwaltung von Updates und Paketen auf Proxmox-VE-Hosts."
+  },
+  "header": {
+    "title": "Updates und Pakete",
+    "description": "Ausgewählte Befehle mit apt und für Proxmox-Upgrades: Systemupdates, Installation, Entfernung und vollständige Bereinigung von Paketen, Paketabfragen mit apt-cache policy und dpkg -l sowie Prüfung der Repository-Konfiguration.",
+    "section": "Hilfe und Informationen"
+  },
+  "intro": {
+    "title": "Aktualisieren Sie den Index immer zuerst",
+    "body": "<code>apt update</code> aktualisiert den lokalen Paketindex aus den konfigurierten Repositorys. Ohne diesen Schritt kann <code>apt install</code> veraltete Versionen verwenden oder mit „Unable to locate package“ scheitern."
+  },
+  "commandGroups": [
+    {
+      "title": "Systemaktualisierungen",
+      "commands": [
+        {
+          "command": "apt update && apt upgrade -y",
+          "description": "Paketlisten aktualisieren und installierte Pakete aktualisieren (apt upgrade)"
+        },
+        {
+          "command": "apt dist-upgrade -y",
+          "description": "Vollständiges System-Upgrade, einschließlich Abhängigkeiten"
+        },
+        {
+          "command": "apt update",
+          "description": "Nur Paketlisten aktualisieren"
+        },
+        {
+          "command": "apt upgrade",
+          "description": "Nur Pakete aktualisieren (interaktiv)"
+        },
+        {
+          "command": "apt full-upgrade",
+          "description": "Pakete mit Auflösung von Abhängigkeiten aktualisieren (interaktiv)"
+        }
+      ]
+    },
+    {
+      "title": "Proxmox-Aktualisierungen",
+      "commands": [
+        {
+          "command": "pveupdate",
+          "description": "Proxmox-Paketlisten aktualisieren"
+        },
+        {
+          "command": "pveupgrade",
+          "description": "Interaktives Proxmox-Paketupgrade starten"
+        },
+        {
+          "command": "pve8to9 --full",
+          "description": "Bereitschaft für das Upgrade von PVE 8 auf 9 prüfen, ohne es durchzuführen"
+        },
+        {
+          "command": "ceph versions",
+          "description": "Ceph-Daemon-Versionen vor der Planung eines Ceph-Upgrades anzeigen"
+        }
+      ]
+    },
+    {
+      "title": "Paketverwaltung",
+      "commands": [
+        {
+          "command": "apt autoremove --purge",
+          "description": "Entfernen Sie nicht verwendete Pakete und deren Konfiguration"
+        },
+        {
+          "command": "apt clean",
+          "description": "Löschen Sie das lokale Repository der abgerufenen Paketdateien"
+        },
+        {
+          "command": "apt autoclean",
+          "description": "Löschen Sie nur veraltete Paketdateien"
+        },
+        {
+          "command": "apt install <package>",
+          "description": "Installieren Sie ein bestimmtes Paket"
+        },
+        {
+          "command": "apt remove <package>",
+          "description": "Paket entfernen"
+        },
+        {
+          "command": "apt purge <package>",
+          "description": "Entfernen eines Pakets und seiner Konfigurationsdateien"
+        }
+      ]
+    },
+    {
+      "title": "Paketinformationen",
+      "commands": [
+        {
+          "command": "apt list --installed",
+          "description": "Liste aller installierten Pakete"
+        },
+        {
+          "command": "apt search <keyword>",
+          "description": "Pakete nach Keyword suchen"
+        },
+        {
+          "command": "apt show <package>",
+          "description": "Detaillierte Informationen zu einem Paket anzeigen"
+        },
+        {
+          "command": "dpkg -l",
+          "description": "Liste aller installierten Pakete (alternative)"
+        },
+        {
+          "command": "dpkg -l | grep <keyword>",
+          "description": "Installierte Pakete nach Keyword suchen"
+        },
+        {
+          "command": "apt-cache policy <package>",
+          "description": "Paketversionen und Prioritäten anzeigen"
+        }
+      ]
+    },
+    {
+      "title": "Repository-Verwaltung",
+      "commands": [
+        {
+          "command": "cat /etc/apt/sources.list",
+          "description": "Haupt-APT-Repository-Quellen anzeigen"
+        },
+        {
+          "command": "ls -la /etc/apt/sources.list.d/",
+          "description": "Liste zusätzlicher Repository-Quelldateien"
+        },
+        {
+          "command": "cat /etc/apt/sources.list.d/pve-enterprise.list",
+          "description": "Proxmox-Enterprise-Repository-Konfiguration in der .list-Datei von PVE 8 anzeigen"
+        },
+        {
+          "command": "apt-key list",
+          "description": "Veraltete Repository-Signaturschlüssel auflisten, sofern apt-key verfügbar ist"
+        }
+      ]
+    }
+  ],
+  "backupWarn": {
+    "title": "Machen Sie ein Backup vor größeren Upgrades",
+    "bodyRich": "Für reguläre Updates empfiehlt Proxmox <code>apt update &amp;&amp; apt full-upgrade</code>. Prüfen Sie die vorgeschlagenen Paketänderungen vor der Bestätigung. Für <strong>Upgrades auf eine neue Hauptversion</strong> (PVE 8 → 9) verwenden Sie den ProxMenux-Ablauf <upgradeLink>PVE 8 auf PVE 9 aktualisieren</upgradeLink>. Er ergänzt Vorabprüfungen, Repository-Migration und anschließende Validierung. Erstellen Sie zuvor eine Sicherung."
+  },
+  "related": {
+    "heading": "Verwandte Themen",
+    "items": [
+      {
+        "href": "/docs/utils/system-update",
+        "label": "Proxmox System Update (interaktiv)",
+        "tail": "- Wrapper, der all dies mit einem Bestätigungsdialog, einem automatischen DKMS-Wiederaufbau von ProxMenux-verwalteten Treibern bei der Installation eines neuen Kernels und einer Neustartaufforderung erledigt. Ebenfalls startbar über die Schaltfläche Jetzt aktualisieren des ProxMenux Monitor-Dashboards."
+      },
+      {
+        "href": "/docs/utils/upgrade-pve8-pve9",
+        "label": "Aktualisieren Sie PVE 8 auf PVE 9",
+        "tail": "- für Major-Version-Upgrades."
+      },
+      {
+        "href": "/docs/help-info",
+        "label": "Übersicht über Hilfe und Informationen",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/de/docs/help-info/vm-ct-commands.json b/web/messages/de/docs/help-info/vm-ct-commands.json
new file mode 100644
index 00000000..8d47196b
--- /dev/null
+++ b/web/messages/de/docs/help-info/vm-ct-commands.json
@@ -0,0 +1,182 @@
+{
+  "meta": {
+    "title": "Proxmox-Befehle qm und pct — VM- und LXC-Verwaltung | ProxMenux",
+    "description": "Proxmox-VE-Befehle qm und pct für VMs und LXC-Container: list, config, start, stop, shutdown, reboot, destroy, clone, migrate, snapshot und resize sowie pct exec / enter / push / pull für Container.",
+    "ogTitle": "Proxmox-Befehle qm und pct — VM- und LXC-Verwaltung",
+    "ogDescription": "Referenz der Befehle Proxmox VE qm und pct — Verwalten von virtuellen Maschinen und LXC-Containern aus dem CLI: Starten, Stoppen, Konfigurieren, Snapshot, Migration, Klonen, Zerstören.",
+    "twitterTitle": "Proxmox-Befehle qm / pct | ProxMenux",
+    "twitterDescription": "Kuratierte qm / pct-Befehle zur Verwaltung virtueller Maschinen und LXC-Container in Proxmox VE."
+  },
+  "header": {
+    "title": "VM- und CT-Verwaltung",
+    "description": "Ausgewählte Befehle mit qm für VMs und pct für LXC-Container: Auflistung, Lebenszyklus (start / stop / shutdown / destroy), Konfigurationsprüfung und Container-Aktionen mit exec, enter, push und pull.",
+    "section": "Hilfe und Informationen"
+  },
+  "intro": {
+    "title": "Finden Sie zuerst eine VMID oder CTID",
+    "body": "Fast jeder Befehl benötigt eine numerische ID. Verwenden Sie <code>qm list</code> für VMs und <code>pct list</code> für Container. Ersetzen Sie <code>&lt;vmid&gt;</code> / <code>&lt;ctid&gt;</code> in den Snippets durch die tatsächliche ID, bevor Sie ausführen."
+  },
+  "commandGroups": [
+    {
+      "title": "Auflistung und Informationen",
+      "commands": [
+        {
+          "command": "qm list",
+          "description": "Listen Sie alle virtuellen Maschinen auf"
+        },
+        {
+          "command": "pct list",
+          "description": "Alle LXC Container auflisten"
+        },
+        {
+          "command": "qm config <vmid>",
+          "description": "VM-Konfiguration über den Parser von qm anzeigen"
+        },
+        {
+          "command": "pct config <ctid>",
+          "description": "Containerkonfiguration über den Parser von pct anzeigen"
+        }
+      ]
+    },
+    {
+      "title": "Konfigurationsdateien (raw)",
+      "commands": [
+        {
+          "command": "cat /etc/pve/qemu-server/<vmid>.conf",
+          "description": "Rohe VM-Konfigurationsdatei anzeigen"
+        },
+        {
+          "command": "cat /etc/pve/lxc/<ctid>.conf",
+          "description": "Rohe CT-Konfigurationsdatei anzeigen"
+        },
+        {
+          "command": "nano /etc/pve/qemu-server/<vmid>.conf",
+          "description": "Bearbeiten der VM-Konfigurationsdatei (nano)"
+        },
+        {
+          "command": "nano /etc/pve/lxc/<ctid>.conf",
+          "description": "Bearbeiten der CT-Konfigurationsdatei (nano)"
+        },
+        {
+          "command": "vi /etc/pve/qemu-server/<vmid>.conf",
+          "description": "Bearbeiten der VM-Rohkonfigurationsdatei (vi)"
+        },
+        {
+          "command": "vi /etc/pve/lxc/<ctid>.conf",
+          "description": "Bearbeiten der CT-Rohkonfigurationsdatei (vi)"
+        }
+      ]
+    },
+    {
+      "title": "VM-Verwaltung",
+      "commands": [
+        {
+          "command": "qm start <vmid>",
+          "description": "Starten Sie eine virtuelle Maschine. Verwenden Sie die richtige <vmid>"
+        },
+        {
+          "command": "qm stop <vmid>",
+          "description": "Erzwingen Sie das Stoppen einer virtuellen Maschine. Verwenden Sie die richtige <vmid>"
+        },
+        {
+          "command": "qm shutdown <vmid>",
+          "description": "Virtuelle Maschine geordnet herunterfahren"
+        },
+        {
+          "command": "qm reset <vmid>",
+          "description": "Zurücksetzen einer virtuellen Maschine (Hard Reboot)"
+        },
+        {
+          "command": "qm suspend <vmid>",
+          "description": "Virtuelle Maschine pausieren"
+        },
+        {
+          "command": "qm resume <vmid>",
+          "description": "Wiederaufnahme einer suspendierten virtuellen Maschine"
+        },
+        {
+          "command": "qm destroy <vmid>",
+          "description": "Eine VM löschen (unwiderruflich). Verwenden Sie die richtige <vmid>"
+        }
+      ]
+    },
+    {
+      "title": "Containermanagement",
+      "commands": [
+        {
+          "command": "pct start <ctid>",
+          "description": "Starten Sie einen Container. Verwenden Sie die richtige <ctid>"
+        },
+        {
+          "command": "pct stop <ctid>",
+          "description": "Stoppen eines Containers erzwingen. Verwenden Sie die richtige <ctid>"
+        },
+        {
+          "command": "pct shutdown <ctid>",
+          "description": "Container geordnet herunterfahren"
+        },
+        {
+          "command": "pct reboot <ctid>",
+          "description": "Neustart eines Containers"
+        },
+        {
+          "command": "pct destroy <ctid>",
+          "description": "Eine CT löschen (irreversibel). Verwenden Sie die richtige <ctid>"
+        }
+      ]
+    },
+    {
+      "title": "Containerbetrieb",
+      "commands": [
+        {
+          "command": "pct exec <ctid> -- getent passwd | column -t -s :",
+          "description": "CT-Benutzer im Tabellenformat anzeigen"
+        },
+        {
+          "command": "pct exec <ctid> -- ps aux --sort=-%mem | head",
+          "description": "Prozesse mit dem höchsten Speicherverbrauch im CT"
+        },
+        {
+          "command": "pct enter <ctid>",
+          "description": "Shell des Containers öffnen"
+        },
+        {
+          "command": "pct push <ctid> <source> <dest>",
+          "description": "Kopieren der Datei vom Host zum Container"
+        },
+        {
+          "command": "pct pull <ctid> <source> <dest>",
+          "description": "Kopieren der Datei vom Container zum Host"
+        }
+      ]
+    }
+  ],
+  "destroyWarn": {
+    "title": "Zerstörung ist irreversibel",
+    "bodyRich": "<code>qm destroy</code> und <code>pct destroy</code> entfernen die Gastkonfiguration und ihre verwalteten Datenträger-Volumes. Externe oder per Bind-Mount eingebundene Daten werden dadurch nicht zwangsläufig gelöscht. Die CLI fragt standardmäßig nicht nach. Sichern Sie benötigte Daten vorher; siehe <backupLink>Sicherung und Wiederherstellung</backupLink>."
+  },
+  "qmConfigTip": {
+    "title": "qm config im Vergleich zur direkten Bearbeitung der .conf-Datei",
+    "bodyRich": "<code>qm config &lt;vmid&gt;</code> und <code>pct config &lt;ctid&gt;</code> zeigen die Konfiguration über Proxmox-Parser an. Verwenden Sie für normale Änderungen <code>qm set</code> oder den entsprechenden pct-Befehl. Direkte Änderungen an <code>/etc/pve/qemu-server/&lt;vmid&gt;.conf</code> oder <code>/etc/pve/lxc/&lt;ctid&gt;.conf</code> umgehen Validierung und Sperren der Verwaltungsbefehle; die Datei muss weiterhin lesbar bleiben. Stoppen Sie den Gast und sichern Sie die Datei vor manuellen Reparaturen. <code>pmxcfs</code> synchronisiert die Konfiguration zwischen Clusterknoten, nicht die Datenträgerinhalte der Gäste."
+  },
+  "related": {
+    "heading": "Verwandte Themen",
+    "items": [
+      {
+        "href": "/docs/help-info/backup-commands",
+        "label": "Sicherung und Wiederherstellung",
+        "tail": " — vzdump und qmrestore / pct restore."
+      },
+      {
+        "href": "/docs/help-info/storage-commands",
+        "label": "Speicher und Datenträger",
+        "tail": " — qm importdisk und Datenträgerverwaltung."
+      },
+      {
+        "href": "/docs/help-info",
+        "label": "Übersicht über Hilfe und Informationen",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/de/docs/help-info/zfs-commands.json b/web/messages/de/docs/help-info/zfs-commands.json
new file mode 100644
index 00000000..35540ad0
--- /dev/null
+++ b/web/messages/de/docs/help-info/zfs-commands.json
@@ -0,0 +1,227 @@
+{
+  "meta": {
+    "title": "ZFS-Befehle auf Proxmox — zpool, zfs snapshot, send/receive, scrub | ProxMenux",
+    "description": "ZFS-Verwaltungsbefehle auf Proxmox VE: zpool create / status / history, zfs list / get / set, Snapshots, clone, zfs send und receive, scrub, clear, replace, zpool iostat und ARC-Übersicht.",
+    "ogTitle": "ZFS-Befehle auf Proxmox — zpool, zfs snapshot, send/receive, scrub",
+    "ogDescription": "Referenz der Befehle zpool und zfs auf Proxmox VE — Pools, Datensätze, Snapshots, Replikation, Wartung.",
+    "twitterTitle": "ZFS-Befehle auf Proxmox | ProxMenux",
+    "twitterDescription": "zpool und zfs Befehle für Proxmox VE: Pools, Datensätze, Snapshots, Replikation, Wartung."
+  },
+  "header": {
+    "title": "ZFS-Verwaltung",
+    "description": "Ausgewählte zpool- und zfs-Befehle: Poolprüfung, Erstellen, Lesen, Ändern und Löschen von Datasets, Snapshots, clone und inkrementelles oder rekursives send/receive, Wartung mit scrub / clear / replace sowie I/O-Statistiken und ARC-Übersicht.",
+    "section": "Hilfe und Informationen"
+  },
+  "intro": {
+    "title": "Zwei Kommandofamilien",
+    "body": "<code>zpool *</code> verwaltet die Speicherpools (physische Schicht – Festplatten, vdevs, Redundanz). <code>zfs *</code> verwaltet die Datensätze und Snapshots, die sich in diesen Pools befinden (logische Schicht – Dateisysteme, Volumes, Snapshots, Eigenschaften)."
+  },
+  "commandGroups": [
+    {
+      "title": "Poolinformationen",
+      "commands": [
+        {
+          "command": "zpool list",
+          "description": "Alle ZFS Pools auflisten"
+        },
+        {
+          "command": "zpool status",
+          "description": "Detaillierter Poolstatus und Gesundheit anzeigen"
+        },
+        {
+          "command": "zpool status -v",
+          "description": "Ausführlichen Poolstatus mit Fehlern anzeigen"
+        },
+        {
+          "command": "zpool history",
+          "description": "Befehlshistorie für alle Pools anzeigen"
+        },
+        {
+          "command": "zpool history <pool>",
+          "description": "Befehlshistorie für bestimmten Pool anzeigen"
+        },
+        {
+          "command": "zpool get all <pool>",
+          "description": "Alle Eigenschaften eines Pools anzeigen"
+        }
+      ]
+    },
+    {
+      "title": "Datensatzverwaltung",
+      "commands": [
+        {
+          "command": "zfs list",
+          "description": "Alle ZFS-Datensätze auflisten"
+        },
+        {
+          "command": "zfs list -r <pool>",
+          "description": "Alle Datensätze in einem Pool rekursiv auflisten"
+        },
+        {
+          "command": "zfs create <pool>/<dataset>",
+          "description": "Erstellen eines neuen Datensatzes"
+        },
+        {
+          "command": "zfs destroy <pool>/<dataset>",
+          "description": "Zerstören Sie einen Datensatz"
+        },
+        {
+          "command": "zfs rename <pool>/<dataset> <pool>/<new-name>",
+          "description": "Umbenennen eines Datasets"
+        },
+        {
+          "command": "zfs get all <pool>/<dataset>",
+          "description": "Alle Eigenschaften eines Datasets anzeigen"
+        },
+        {
+          "command": "zfs set compression=on <pool>/<dataset>",
+          "description": "Komprimierung in einem Dataset ermöglichen"
+        }
+      ]
+    },
+    {
+      "title": "Snapshot-Verwaltung",
+      "commands": [
+        {
+          "command": "zfs list -t snapshot",
+          "description": "Alle Snapshots auflisten"
+        },
+        {
+          "command": "zfs list -t snapshot -r <pool>",
+          "description": "Liste alle Snapshots in einem Pool"
+        },
+        {
+          "command": "zfs snapshot <pool>/<dataset>@<snapshot-name>",
+          "description": "Erstellen Sie einen Snapshot"
+        },
+        {
+          "command": "zfs destroy <pool>/<dataset>@<snapshot-name>",
+          "description": "Löschen eines Snapshots"
+        },
+        {
+          "command": "zfs rollback <pool>/<dataset>@<snapshot-name>",
+          "description": "Rollback zu einem Snapshot"
+        },
+        {
+          "command": "zfs hold <tag> <pool>/<dataset>@<snapshot-name>",
+          "description": "Snapshot mit einem Hold vor dem Löschen schützen"
+        },
+        {
+          "command": "zfs release <tag> <pool>/<dataset>@<snapshot-name>",
+          "description": "Hold-Schutz eines Snapshots aufheben"
+        }
+      ]
+    },
+    {
+      "title": "Klonen und Send/Receive",
+      "commands": [
+        {
+          "command": "zfs clone <pool>/<dataset>@<snapshot> <pool>/<clone-name>",
+          "description": "Erstellen Sie einen Klon aus einem Snapshot"
+        },
+        {
+          "command": "zfs send <pool>/<dataset>@<snapshot> > backup.zfs",
+          "description": "Schnappschuss an eine Datei senden"
+        },
+        {
+          "command": "zfs receive <pool>/<dataset> < backup.zfs",
+          "description": "Erhalten Sie einen Snapshot aus einer Datei"
+        },
+        {
+          "command": "zfs send -i <pool>/<dataset>@<snap1> <pool>/<dataset>@<snap2> > incr.zfs",
+          "description": "Senden Sie inkrementellen Snapshot"
+        },
+        {
+          "command": "zfs send -R <pool>/<dataset>@<snapshot> > full-recursive.zfs",
+          "description": "Rekursive Snapshots senden"
+        }
+      ]
+    },
+    {
+      "title": "Wartung und Reparatur",
+      "commands": [
+        {
+          "command": "zpool scrub <pool>",
+          "description": "Scrub-Prüfung eines Pools starten"
+        },
+        {
+          "command": "zpool scrub -s <pool>",
+          "description": "Laufenden Scrub stoppen"
+        },
+        {
+          "command": "zpool clear <pool>",
+          "description": "Fehlerzähler eines Pools zurücksetzen"
+        },
+        {
+          "command": "zpool clear <pool> <device>",
+          "description": "Fehlerzähler eines bestimmten Geräts zurücksetzen"
+        },
+        {
+          "command": "zpool replace <pool> <old-device> <new-device>",
+          "description": "Ein ausgefallenes Gerät ersetzen"
+        },
+        {
+          "command": "zpool offline <pool> <device>",
+          "description": "Nehmen Sie ein Gerät offline"
+        },
+        {
+          "command": "zpool online <pool> <device>",
+          "description": "Bringen Sie ein Gerät online"
+        }
+      ]
+    },
+    {
+      "title": "Leistung und Überwachung",
+      "commands": [
+        {
+          "command": "zpool iostat",
+          "description": "I/O-Statistiken für Pools anzeigen"
+        },
+        {
+          "command": "zpool iostat -v",
+          "description": "Detaillierte I/O-Statistiken anzeigen"
+        },
+        {
+          "command": "zpool iostat 5",
+          "description": "I/O Statistiken alle 5 Sekunden anzeigen"
+        },
+        {
+          "command": "arc_summary",
+          "description": "ARC-Statistik anzeigen (falls installiert)"
+        },
+        {
+          "command": "zfs get compressratio <pool>/<dataset>",
+          "description": "Komprimierungsverhältnis anzeigen"
+        },
+        {
+          "command": "zfs get used,available,referenced <pool>/<dataset>",
+          "description": "Speicherplatznutzung anzeigen"
+        }
+      ]
+    }
+  ],
+  "bestPractices": {
+    "title": "Best Practices für den Betrieb",
+    "bodyRich": "Planen Sie regelmäßig <code>zpool scrub</code> zur Prüfsummenprüfung ein und kontrollieren Sie das Ergebnis. Halten Sie Kapazität frei: Die Auswirkungen eines fast vollen Pools hängen von Last und Aufbau ab. Verwenden Sie <code>zpool replace</code> für ausgefallene Geräte und das Verfahren für den jeweiligen vdev-Typ. Detach + add ist kein gleichwertiger Austausch und kann die Topologie verändern oder Redundanz aufheben."
+  },
+  "related": {
+    "heading": "Verwandte Themen",
+    "items": [
+      {
+        "href": "/docs/help-info/storage-commands",
+        "label": "Speicher und Datenträger",
+        "tail": " — allgemeine Blockgeräte- und LVM-Befehle."
+      },
+      {
+        "href": "/docs/help-info/backup-commands",
+        "label": "Sicherung und Wiederherstellung",
+        "tail": " — vzdump, qmrestore."
+      },
+      {
+        "href": "/docs/help-info",
+        "label": "Übersicht über Hilfe und Informationen",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/de/docs/installation.json b/web/messages/de/docs/installation.json
new file mode 100644
index 00000000..e8f31748
--- /dev/null
+++ b/web/messages/de/docs/installation.json
@@ -0,0 +1,93 @@
+{
+  "meta": {
+    "title": "ProxMenux installieren | ProxMenux-Dokumentation",
+    "description": "Installieren Sie ProxMenux mit einem Befehl auf Proxmox-VE-Hosts ab Version 8. Enthält vorgefertigte JSON-Kataloge für acht Sprachen: Englisch, Spanisch, Französisch, Deutsch, Italienisch, Portugiesisch, Slowakisch und Schwedisch. Wählen Sie die Sprache bei der Installation oder ändern Sie sie später unter Einstellungen. Ein Beta-Kanal bietet frühzeitigen Zugriff auf neue Funktionen.",
+    "ogTitle": "ProxMenux installieren | ProxMenux-Dokumentation",
+    "ogDescription": "Installieren Sie ProxMenux auf Proxmox VE 8+ in einem Befehl. Stabile und Beta-Kanäle verfügbar."
+  },
+  "header": {
+    "title": "Installation von ProxMenux",
+    "description": "Der Installer wird mit einem Befehl auf einem Proxmox-VE-Host ab Version 8 gestartet. Er installiert die nötigen Abhängigkeiten, lädt die Skripte herunter, richtet den Menüstarter ein und fragt beim ersten Durchlauf nach der Sprache. Zwei Kanäle stehen bereit: stabil (Standard) und Beta.",
+    "section": "Installation"
+  },
+  "stable": {
+    "heading": "Installieren",
+    "intro": "Führen Sie dies im Terminal Ihres Proxmox-Hosts aus:",
+    "code": "bash -c \"$(wget -qLO - https://raw.githubusercontent.com/MacRimi/ProxMenux/main/install_proxmenux.sh)\""
+  },
+  "during": {
+    "heading": "Während der Installation",
+    "intro": "ProxMenux installiert und konfiguriert automatisch die benötigten Abhängigkeiten:",
+    "tablePackage": "Paket",
+    "tablePurpose": "Zweck",
+    "rows": [
+      {
+        "package": "dialog",
+        "purpose": "Interaktive Terminalmenüs"
+      },
+      {
+        "package": "curl",
+        "purpose": "Downloads und Konnektivitätsprüfungen"
+      },
+      {
+        "package": "jq",
+        "purpose": "JSON-Verarbeitung"
+      },
+      {
+        "package": "git",
+        "purpose": "Klonen und Aktualisieren von Repositorys"
+      }
+    ],
+    "outro": "Der Installer lädt außerdem den Skriptbaum nach <code>/usr/local/share/proxmenux/</code> und erstellt das Startskript unter <code>/usr/local/bin/menu</code>. Das Web-Dashboard <strong>ProxMenux Monitor</strong> wird als <code>proxmenux-monitor.service</code> registriert.",
+    "imageAlt": "ProxMenux Installation im Gange"
+  },
+  "first": {
+    "heading": "Erster Start",
+    "intro": "Führen Sie nach der Installation Folgendes aus:",
+    "code": "menu",
+    "outro": "ProxMenux öffnet das Hauptmenü. Von dort können Sie alle auf dieser Website beschriebenen Abläufe starten. Auf einem frisch installierten Proxmox-Host ist <postlink>Nach der Installation</postlink> ein guter Ausgangspunkt."
+  },
+  "beta": {
+    "heading": "Beta-Kanal",
+    "calloutTitle": "Was ist das Beta-Programm?",
+    "calloutBody": "Möchten Sie neue Funktionen vor der offiziellen Veröffentlichung testen und die endgültige Version mitgestalten? Das Beta-Programm von ProxMenux bietet frühzeitigen Zugriff auf Neuerungen einschließlich aktueller Monitor-Builds aus dem Zweig <code>develop</code>. Beta-Versionen können Fehler oder unvollständige Funktionen enthalten. Ihre Rückmeldungen helfen, diese vor der stabilen Veröffentlichung zu beheben.",
+    "intro": "Installieren Sie die Beta-Version anstelle der stabilen mit:",
+    "code": "bash -c \"$(wget -qLO - https://raw.githubusercontent.com/MacRimi/ProxMenux/develop/install_proxmenux_beta.sh)\"",
+    "outro": "Die Beta ist freiwillig und muss ausdrücklich über den Beta-Installer installiert werden. Sobald eine stabile Version erscheint, informiert ProxMenux beim nächsten Start von <code>menu</code> und bietet den automatischen Wechsel an. Zum vorzeitigen Ausstieg wählen Sie unter Einstellungen <betalink>Beta-Programm deaktivieren</betalink>."
+  },
+  "updating": {
+    "heading": "Aktualisierung",
+    "body": "ProxMenux verwaltet seine Updates selbst. Ist eine neue Version verfügbar, bietet der nächste Aufruf von <code>menu</code> das Update an. Bei Zustimmung werden die Dateien und Einstellungen des Werkzeugs in der bestehenden Installation ersetzt. Ein manueller Download ist nicht nötig. Stabile Installationen erhalten stabile Updates, Beta-Installationen Beta-Updates sowie den oben beschriebenen Wechselhinweis. Die Anzeige hängt davon ab, wo <code>menu</code> läuft: Über SSH oder die Proxmox-Konsole erscheint ein Ja/Nein-Dialog; bei Zustimmung wird sofort aktualisiert. Im WebSocket-Terminal von ProxMenux Monitor erscheint stattdessen eine Information, weil dieses Terminal während des Updates unterbrochen würde. Sie zeigt den einzeiligen Installer (<code>bash -c \"$(wget -qLO - https://raw.githubusercontent.com/MacRimi/ProxMenux/main/install_proxmenux.sh)\"</code> für stabil oder die entsprechende URL von <code>install_proxmenux_beta.sh</code> für Beta), den Sie über SSH oder die Konsole ausführen sollen."
+  },
+  "uninstall": {
+    "heading": "Deinstallation",
+    "body": "In ProxMenux: <strong>Einstellungen → ProxMenux deinstallieren</strong>. Die Deinstallation entfernt den Skriptbaum, das Startskript und den Monitor-Dienst sowie auf Wunsch ausgewählte Abhängigkeiten. <code>/root/.bashrc</code> und <code>/etc/motd</code> werden aus den von Post-Install angelegten Sicherungen wiederhergestellt, sofern diese vorhanden sind (andernfalls wird die ProxMenux-Zeile aus der MOTD entfernt). Vollständige Anleitung: <uninstalllink>ProxMenux deinstallieren</uninstalllink>."
+  },
+  "troubleshoot": {
+    "heading": "Fehlerbehebung",
+    "virustotalTitle": "VirusTotal markiert die Installations-URL",
+    "virustotalBody": "Der in Issue #162 gemeldete Treffer von <em>Chong Lua Dao</em> bei 1 von 95 Prüfungen wurde vom Maintainer als Fehlalarm eingestuft. Der Installer wird mit einem Befehl gestartet, der das Skript herunterlädt und ausführt (<code>bash -c \"$(wget -qLO - …)\"</code>) und kann <code>jq</code> aus dessen offizieller GitHub-Veröffentlichung herunterladen. Dieses <em>Verhalten</em> kann heuristische Scanner auslösen. Der damalige Bericht ist keine Bewertung aller künftigen Downloads. Der Installer ist quelloffen und überprüfbar. Weitere Hintergründe in <issuelink>Issue #162</issuelink>.",
+    "aptTitle": "Installation schlägt mit apt-Fehlern fehl",
+    "aptBody": "Meist fehlt ein Proxmox-Repository oder ist falsch konfiguriert. Der Installer bezieht Abhängigkeiten über apt; fehlerhafte Repository-Einstellungen lassen apt scheitern. Das kommt etwa bei noch nicht aktualisierten Minimalinstallationen von Proxmox 8 vor. Führen Sie zuerst <code>apt-get update</code> manuell aus, beheben Sie alle Fehler und starten Sie den Installer erneut.",
+    "menuTitle": "`menu: command not found` nach der Installation",
+    "menuBody": "Das Startskript liegt unter <code>/usr/local/bin/menu</code>. Prüfen Sie dies mit <code>ls -lh /usr/local/bin/menu</code>. Fehlt es, wurde die Installation vorzeitig beendet; starten Sie den Installer erneut. Existiert es, wird aber nicht gefunden, fehlt <code>/usr/local/bin</code> in PATH. Korrigieren Sie PATH oder starten Sie direkt <code>/usr/local/bin/menu</code>.",
+    "stuckTitle": "Die Installation hängt oder geht nicht voran",
+    "stuckBody": "Wenn eine Installation, Neuinstallation oder Aktualisierung wegen eines Verbindungsproblems hängen bleibt, brechen Sie mit <strong>Ctrl + C</strong> ab und starten Sie den Installer manuell erneut.",
+    "otherTitle": "Weitere Probleme",
+    "otherBody": "Prüfen Sie <issueslink>GitHub Issues</issueslink> auf bekannte Probleme oder eröffnen Sie ein neues Issue mit den relevanten Protokollen. Bei Monitor-Problemen in der Beta fügen Sie die Ausgabe von <code>journalctl -u proxmenux-monitor -n 50</code> bei."
+  },
+  "next": {
+    "heading": "Was kommt als nächstes",
+    "postInstall": "<postlink>Skript nach der Installation</postlink> — Anpassungen und Absicherung eines frisch installierten Proxmox-Hosts.",
+    "introduction": "<introlink>Einführung</introlink> — vollständiger Überblick über die Funktionen.",
+    "monitor": "<monitorlink>ProxMenux Monitor</monitorlink> — Web-Dashboard für den Host (automatisch neben dem Menü installiert)."
+  },
+  "requirements": {
+    "heading": "Anforderungen und bewährte Verfahren",
+    "reqTitle": "Anforderungen",
+    "reqBody": "Proxmox VE <strong>8.x oder neuer</strong>. PVE 7 und ältere Versionen werden nicht unterstützt. Der Host benötigt Internetzugang für Skripte, Abhängigkeiten und die AppImage von ProxMenux Monitor. Führen Sie den Installer als <strong>root</strong> auf dem Proxmox-Host aus.",
+    "inspectTitle": "Überprüfen Sie immer Skripte, die Sie aus dem Internet ausführen",
+    "inspectReview": "<sourcelink>Prüfen Sie den Quellcode des Installers</sourcelink>, bevor Sie ihn ausführen.",
+    "inspectCoc": "Alle ausführbaren Links entsprechen dem <coclink>ProxMenux-Verhaltenskodex</coclink>."
+  }
+}
diff --git a/web/messages/de/docs/introduction.json b/web/messages/de/docs/introduction.json
new file mode 100644
index 00000000..73af0b8f
--- /dev/null
+++ b/web/messages/de/docs/introduction.json
@@ -0,0 +1,206 @@
+{
+  "meta": {
+    "title": "ProxMenux — Proxmox VE über Menüs verwalten | Open Source",
+    "description": "Open-Source-Werkzeug zur menügesteuerten Verwaltung von Proxmox VE. ProxMenux vereint zwei Komponenten: eine CLI/TUI für Anpassungen nach der Installation, VMs und LXC-Container, GPU- und Coral-TPU-Durchreichung, Datenträger, Speicher und Netzwerk sowie ein selbst gehostetes Webdashboard mit proaktiver Zustandsüberwachung, Benachrichtigungen per Telegram, Discord oder E-Mail, KI-gestützter Umformulierung und REST-API.",
+    "ogTitle": "ProxMenux — Proxmox VE über Menüs verwalten",
+    "ogDescription": "Open-Source-CLI/TUI und Webdashboard für Proxmox VE: Anpassungen nach der Installation, VMs, GPUs, Datenträger, Netzwerk, Speicher und Sicherheit. Dazu ein separater Monitor mit Zustandsprüfungen, Benachrichtigungen, KI-Umformulierung und REST-API.",
+    "twitterTitle": "ProxMenux — Proxmox VE über Menüs verwalten",
+    "twitterDescription": "Open-Source-CLI/TUI und Webdashboard für Proxmox VE. Zustandsüberwachung, Benachrichtigungen, KI-Umformulierung und REST-API."
+  },
+  "header": {
+    "title": "Einleitung",
+    "description": "ProxMenux ist ein menügesteuertes Open-Source-Werkzeug für Proxmox VE. Zwei Komponenten bilden das Projekt: eine CLI/TUI für häufige Aufgaben rund um Host, VMs, Container, Speicher, Netzwerk und Sicherheit sowie ein selbst gehostetes Webdashboard mit proaktiver Zustandsüberwachung, Benachrichtigungen, optionaler KI-Umformulierung und REST-API.",
+    "section": "Einleitung"
+  },
+  "hero": {
+    "tagline": "<strong>Ein Menü für alle Abläufe.</strong> Aufgaben, für die Sie sonst das Wiki, zwei Forenthreads und eine kopierte Befehlsfolge brauchen, stehen als nummerierte Menüoption bereit und lassen sich in Sekunden starten.",
+    "audience": "Für <em>neue</em> Proxmox-Nutzer mit bewusst gewählten, sicheren Voreinstellungen und <em>erfahrene</em> Administratoren, die Routineaufgaben mit weniger Tastatureingaben erledigen möchten. Kostenlos und quelloffen, mit einer aktiven Community auf <github>GitHub</github>."
+  },
+  "twoProducts": {
+    "heading": "Zwei Produkte, ein Projekt",
+    "intro": "ProxMenux umfasst zwei Komponenten im selben Quellbaum. Der Installer installiert beide auf dem Host: Scripts stellt die Terminaloberfläche bereit, Monitor das Webdashboard:",
+    "scripts": {
+      "title": "ProxMenux Scripts",
+      "body": "Die ursprüngliche CLI/TUI, die Sie mit <code>menu</code> starten. Neun Funktionsbereiche für Optimierungen nach der Installation, VMs und LXC-Container, GPU- und Coral-TPU-Durchreichung, Datenträger, Speicher, Netzwerk, Sicherheit und Hilfsprogramme sowie eine sorgfältig zusammengestellte Befehlsreferenz. Läuft in lokalen Terminals, per SSH und im Webterminal."
+    },
+    "monitor": {
+      "title": "ProxMenux Monitor",
+      "body": "Selbst gehostetes Webdashboard als AppImage. Hostmetriken in Echtzeit, proaktive Zustandsüberwachung, Benachrichtigungen, optionale KI-Umformulierung mit sechs Anbietern, integriertes Webterminal und REST-API. Aktivierung im Scripts-Menü unter Einstellungen → ProxMenux Monitor."
+    },
+    "calloutTitle": "Was ProxMenux verwaltet",
+    "calloutIntro": "Drei Schichten, die alle aus dem gleichen Projekt erreichbar sind:",
+    "layers": [
+      "<strong>Der Proxmox-Host</strong> — Paketquellen, Pakete, Netzwerk, ZFS, Ceph, Kernel und Überwachung.",
+      "<strong>Virtuelle Maschinen (VMs)</strong> — Erstellen, GPU-Durchreichung, OVA-/OVF-Import und -Export sowie Durchreichen von Datenträgern.",
+      "<strong>LXC-Container</strong> — Erstellen, Einhängepunkte, GPU-/TPU-Durchreichung sowie NFS-/Samba-Clients und -Server."
+    ]
+  },
+  "scriptsSection": {
+    "heading": "ProxMenux Scripts - was Sie bekommen",
+    "intro": "Neun Funktionsbereiche mit jeweils eigenem Menü innerhalb von <code>menu</code> und einer Detailseite in der Dokumentation. Klicken Sie auf eine beliebige Karte, um direkt zur Übersicht dieses Abschnitts zu springen.",
+    "items": [
+      {
+        "title": "Nach der Installation",
+        "description": "Optimierungen für frisch installierte Proxmox-Systeme: Paketquellen, Kernel, Zeitsynchronisierung, grundlegende Sicherheit und Leistung, mit rückgängig zu machenden Optionen.",
+        "icon": "Server",
+        "href": "/docs/post-install"
+      },
+      {
+        "title": "GPUs und Coral TPU",
+        "description": "NVIDIA-, Intel-iGPU-, AMD- und Coral-TPU-Durchreichung an VMs und LXC-Container, mit Umschaltung zwischen VM- und LXC-Modus.",
+        "icon": "Cpu",
+        "href": "/docs/hardware/nvidia-host"
+      },
+      {
+        "title": "VM erstellen",
+        "description": "Assistenten für NAS-Systeme, Windows und Linux mit sinnvollen Voreinstellungen für Hardware, Speicher und Netzwerk.",
+        "icon": "Server",
+        "href": "/docs/create-vm"
+      },
+      {
+        "title": "Festplattenmanager",
+        "description": "Physische Datenträger für VMs und LXC einbinden, formatieren und löschen, SMART-Tests ausführen sowie qcow2-, vmdk- und vdi-Abbilder importieren — alles über ein Menü.",
+        "icon": "HardDrive",
+        "href": "/docs/disk-manager"
+      },
+      {
+        "title": "Speicher und Freigaben",
+        "description": "NFS-, Samba-/CIFS-, iSCSI- und lokalen Speicher in Proxmox registrieren und Ordner zwischen Host und LXC-Containern über Bind-Mounts oder Netzwerkprotokolle freigeben.",
+        "icon": "Boxes",
+        "href": "/docs/storage-share"
+      },
+      {
+        "title": "Netzwerk",
+        "description": "Diagnose ohne Änderungen, Abläufe mit Analyse und anschließenden Vorschlägen sowie geführte Reparaturen an /etc/network/interfaces. Vor Änderungen werden Sicherungen erstellt.",
+        "icon": "Network",
+        "href": "/docs/network"
+      },
+      {
+        "title": "Sicherheit",
+        "description": "Fail2Ban zum Schutz von SSH und Weboberflächen vor Einbruchsversuchen sowie Lynis für Sicherheitsprüfungen — Installation und Verwaltung mit sinnvollen Voreinstellungen.",
+        "icon": "Shield",
+        "href": "/docs/security"
+      },
+      {
+        "title": "Dienstprogramme",
+        "description": "Windows-ISOs mit UUP Dump erstellen, CLI-Werkzeuge installieren, geführte Systemupdates und das Upgrade von PVE 8 auf 9 durchführen sowie VMs im OVA-/OVF-Format exportieren und importieren.",
+        "icon": "Wrench",
+        "href": "/docs/utils"
+      },
+      {
+        "title": "Befehlsreferenz",
+        "description": "Eine ausgewählte Sammlung von Linux- und Proxmox-Befehlen nach Themen: System, VM/CT mit qm und pct, Speicher, Netzwerk, ZFS, GPU-Durchreichung, Sicherungen und CLI-Werkzeuge für den Alltag.",
+        "icon": "BookOpen",
+        "href": "/docs/help-info"
+      }
+    ]
+  },
+  "monitorSection": {
+    "heading": "ProxMenux Monitor - was Sie bekommen",
+    "intro": "Das Webdashboard wird direkt auf dem Proxmox-Host über TCP-Port 8008 bereitgestellt. Klicken Sie auf eine Karte, um die jeweilige Dokumentationsseite zu öffnen, oder lesen Sie zuerst die <link>Monitor-Übersicht</link>.",
+    "items": [
+      {
+        "title": "Zustandsüberwachung",
+        "description": "Alle fünf Minuten werden zehn Kategorien geprüft: CPU, Arbeitsspeicher, Speicher, Datenträger/SMART, Netzwerk, VMs, Dienste, Protokolle, Updates und Sicherheit. Mit Schweregraden und Unterdrückung je Kategorie.",
+        "icon": "Activity",
+        "href": "/docs/monitor/health-monitor"
+      },
+      {
+        "title": "Benachrichtigungen",
+        "description": "Telegram, Discord, E-Mail, Gotify, Pushover und Apprise für mehrere Kanäle — mit Vermeidung von Duplikaten, Mindestabständen, Bündelung gleichzeitiger Meldungen, Ruhezeiten und vollständigem Verlauf.",
+        "icon": "Bell",
+        "href": "/docs/monitor/notifications"
+      },
+      {
+        "title": "KI-Assistent",
+        "description": "Optionale Umformulierung von Benachrichtigungen in verständliche Sprache. Sechs Anbieter: OpenAI, Anthropic Claude, Google Gemini, Groq, OpenRouter und lokales Ollama. Dreizehn Sprachen in der Sprachauswahl der KI.",
+        "icon": "Sparkles",
+        "href": "/docs/monitor/ai-assistant"
+      },
+      {
+        "title": "Webterminal",
+        "description": "Interaktive Shell auf dem Proxmox-Host im Browser sowie ein separates ProxMenux-Scripts-Terminal, das das Menü in der Weboberfläche ausführt.",
+        "icon": "Terminal",
+        "href": "/docs/monitor/dashboard/terminal"
+      },
+      {
+        "title": "REST API",
+        "description": "HTTP-Endpunkte für System, Zustand, Speicher/SMART, Netzwerk, VMs, Benachrichtigungen und Sicherheit — nutzbar für Homepage, Home Assistant, Prometheus und eigene Skripte.",
+        "icon": "Code2",
+        "href": "/docs/monitor/api"
+      },
+      {
+        "title": "Integrationen",
+        "description": "Nativer Proxmox-VE-Webhook, Metrikabruf durch Prometheus, Prüfungen mit Uptime Kuma, Widgets für Homepage, Home Assistant und Glance, n8n-/Zapier-Abläufe und Tailscale Secure Gateway.",
+        "icon": "Plug",
+        "href": "/docs/monitor/integrations"
+      }
+    ]
+  },
+  "installPaths": {
+    "heading": "Installationsvarianten",
+    "intro": "Beide Installer installieren Scripts und Monitor. Scripts verwendet vorab erstellte JSON-Kataloge in acht Sprachen ohne Online-Übersetzung. Sie wählen den stabilen oder den Beta-Kanal; Monitor wird als AppImage verteilt und aus seiner entpackten Laufzeitumgebung gestartet:",
+    "headerPath": "Install path",
+    "headerBundles": "Enthaltene Komponenten",
+    "headerWhen": "Wann geeignet",
+    "rows": [
+      {
+        "pathRich": "<strong>Scripts: stabil</strong>",
+        "bundles": "CLI/TUI mit vorab erstellten JSON-Übersetzungen in acht Sprachen, ohne Übersetzungs-venv oder Online-Übersetzungsdienst.",
+        "when": "Regulärer Einsatz mit dem stabilen Veröffentlichungskanal."
+      },
+      {
+        "pathRich": "<strong>Scripts: Beta</strong>",
+        "bundles": "Dieselbe mehrsprachige Oberfläche aus dem develop-Zweig, um kommende Änderungen zu testen.",
+        "when": "Frühzeitiges Testen neuer Funktionen mit höherem Fehlerrisiko."
+      },
+      {
+        "pathRich": "<strong>Monitor</strong>",
+        "bundles": "Eigenständiges AppImage mit Webdashboard auf TCP-Port 8008. Der Installer entpackt die Laufzeitumgebung und verwaltet den Dienst; Monitor lässt sich über die Einstellungen steuern.",
+        "when": "Wenn Sie den Host über ein Webdashboard auf Handy, Tablet oder im Browser überwachen möchten."
+      }
+    ],
+    "outro": "Detaillierte Installationsbefehle und Voraussetzungen stehen auf der <link>Installationsseite</link>."
+  },
+  "warnSource": {
+    "title": "Prüfen Sie Skripte aus dem Internet vor der Ausführung",
+    "body": "ProxMenux ist quelloffen. Sie können jedes Skript auf GitHub prüfen. Lesen Sie vor dem Ausführen des Installationsbefehls den Quellcode. Tun Sie das auch bei anderen Automatisierungswerkzeugen.",
+    "sourceLabel": "ProxMenux Quelle ansehen",
+    "cocLabel": "Verhaltenskodex"
+  },
+  "next": {
+    "heading": "Nächste Schritte",
+    "items": [
+      {
+        "lead": "<strong>Neu bei ProxMenux?</strong> ",
+        "linkHref": "/docs/installation",
+        "linkLabel": "Mit einem Befehl installieren",
+        "tailRich": " und starten Sie <code>menu</code>."
+      },
+      {
+        "lead": "<strong>Proxmox gerade installiert?</strong> Beginnen Sie mit dem ",
+        "linkHref": "/docs/post-install",
+        "linkLabel": "Post-Install-Skript",
+        "tail": "."
+      },
+      {
+        "lead": "<strong>Möchten Sie ein Webdashboard?</strong> ",
+        "linkHref": "/docs/monitor",
+        "linkLabel": "ProxMenux Monitor",
+        "tail": " wird in der Dokumentation vorgestellt: Funktionen, Aufbau und Absicherung."
+      },
+      {
+        "lead": "<strong>Suchen Sie einen bestimmten Befehl?</strong> Die ",
+        "linkHref": "/docs/help-info",
+        "linkLabel": "Befehlsreferenz",
+        "tail": " bietet eine nach Themen geordnete Auswahl mit Kopierschaltflächen."
+      },
+      {
+        "lead": "<strong>Möchten Sie ausführlichere Anleitungen?</strong> Der ",
+        "linkHref": "/guides",
+        "linkLabel": "Anleitungsbereich",
+        "tail": " behandelt Coral TPU, NVIDIA-Durchreichung, Kodi in LXC und weitere Themen."
+      }
+    ]
+  }
+}
diff --git a/web/messages/de/docs/network/backup-restore.json b/web/messages/de/docs/network/backup-restore.json
new file mode 100644
index 00000000..fc81f50a
--- /dev/null
+++ b/web/messages/de/docs/network/backup-restore.json
@@ -0,0 +1,110 @@
+{
+  "meta": {
+    "title": "Schnittstellen sichern und neu starten | ProxMenux-Dokumentation",
+    "description": "Manuelle Schnappschüsse erstellen und unter /var/backups/proxmenux/ gespeicherte Backups von /etc/network/interfaces durchsuchen und wiederherstellen. Mit bestätigtem Neustart des Netzwerkdienstes und Schnellansicht der aktuellen Konfiguration.",
+    "ogTitle": "Schnittstellen sichern und neu starten | ProxMenux-Dokumentation",
+    "ogDescription": "Snapshot und Wiederherstellung der Proxmox-Netzwerkkonfiguration; Neustart des Netzwerkdienstes mit Bestätigung."
+  },
+  "header": {
+    "title": "Schnittstellen sichern und neu starten",
+    "description": "Vier Werkzeuge für /etc/network/interfaces: einen manuellen Schnappschuss erstellen, die aktuelle Konfiguration anzeigen, ein früheres Backup mit optionaler Vorschau wiederherstellen und den Netzwerkdienst nach ausdrücklicher Zustimmung neu starten. Sie verwenden dasselbe Backup-Verzeichnis wie die geführten Reparaturen.",
+    "section": "Netzwerk"
+  },
+  "intro": {
+    "title": "Was das macht",
+    "body": "Verwaltet das gleiche Backup-Verzeichnis, das von den geführten Reparaturflüssen verwendet wird (<code>/var/backups/proxmenux/</code>). Sie können vor jeder manuellen Änderung eine zusätzliche Momentaufnahme machen, alle vorhandenen Backups durchsuchen und zu einem von ihnen zurückkehren - immer mit einem neuen Pre-Restore-Backup, das automatisch als zweites Sicherheitsnetz übernommen wird."
+  },
+  "shared": {
+    "heading": "Das gemeinsame Backup-Verzeichnis",
+    "intro": "Jedes Backup im Netzwerkmenü landet an der gleichen Stelle:",
+    "outro": "Dateinamen werden mit einem Zeitstempel versehen, nach Datum sortiert und nie überschrieben. Das Verzeichnis wird bei der ersten Verwendung erstellt."
+  },
+  "show": {
+    "heading": "Netzwerkkonfigurationsdatei anzeigen",
+    "body": "Gibt <code>/etc/network/interfaces</code> unverändert im Terminal aus. Schreibgeschützt. Nützlich zur Kontrolle vor einem Backup oder nach einer Wiederherstellung. Es gibt kein separates Werkzeug zum Vergleich mit dem vorherigen Backup; die aktuelle Datei direkt zu prüfen ist daher am einfachsten."
+  },
+  "create": {
+    "heading": "Netzwerk-Backup erstellen",
+    "body": "Kopiert den aktuellen <code>/etc/network/interfaces</code> mit einem neuen Zeitstempel in das Backup-Verzeichnis. Das ist es — keine Analyse, keine Aufforderungen, nur eine Momentaufnahme.",
+    "whenTitle": "Wann Sie ein manuelles Backup durchführen sollten",
+    "whenBody": "Vor der manuellen Bearbeitung von <code>/etc/network/interfaces</code>, vor der Installation eines Pakets, das den Netzwerkstack ändern kann (z. B. NetworkManager, Open vSwitch), oder vor Hardwareänderungen. Geführte Reparaturen erstellen bereits automatisch einen Schnappschuss — diese Option ist für <em>manuelle</em> Eingriffe."
+  },
+  "restore": {
+    "heading": "Netzwerksicherung wiederherstellen",
+    "intro": "Listet alle Backups in <code>/var/backups/proxmenux/</code> vom neuesten zum ältesten auf und führt durch eine abgesicherte Wiederherstellung:",
+    "steps": [
+      {
+        "title": "1. Wählen Sie ein Backup",
+        "body": "Ein Menü listet jedes Backup nach seinem Zeitstempel auf. Wenn keine Backups vorhanden sind, wird der Flow mit einer klaren Nachricht beendet.",
+        "tone": "blue"
+      },
+      {
+        "title": "2. Optionale Vorschau",
+        "body": "Bietet an, das ausgewählte Backup in einer scrollbaren Ansicht zu öffnen, bevor Sie es festlegen. Standardmäßig ja – überspringen Sie es nicht auf einem entfernten Host.",
+        "tone": "blue"
+      },
+      {
+        "title": "3. Backup vor der Wiederherstellung",
+        "body": "Erstellt vor dem Überschreiben von <code>/etc/network/interfaces</code> ein <strong>weiteres</strong> Backup des aktuellen Zustands. Eine Wiederherstellung ist selbst ein destruktiver Vorgang. Mit dem neuen Schnappschuss können Sie zurückkehren, falls das gewählte Backup falsch war.",
+        "tone": "amber"
+      },
+      {
+        "title": "4. Anwenden der Wiederherstellung",
+        "body": "Kopiert das ausgewählte Backup über <code>/etc/network/interfaces</code>. Die Dateiänderung ist auf der Festplatte; der Live-Kernel-Zustand spiegelt immer noch die vorherige Konfiguration wider.",
+        "tone": "amber"
+      },
+      {
+        "title": "5. Optionaler Neustart",
+        "body": "Fragt, ob <code>systemctl restart networking</code> jetzt ausgeführt werden soll. Lehnen Sie ab, um die Änderung auf den nächsten Neustart zu verschieben.",
+        "tone": "emerald"
+      }
+    ],
+    "autoBackupTitle": "Jede Wiederherstellung erstellt automatisch ein eigenes Backup",
+    "autoBackupBody": "Die Auswahl von <em>Netzwerksicherung wiederherstellen</em> erstellt immer einen neuen Schnappschuss der <em>aktuellen</em> Konfiguration, bevor sie überschrieben wird. Falls Sie das falsche Backup wiederherstellen, enthält die neueste Datei in <code>/var/backups/proxmenux/</code> den vorherigen Zustand."
+  },
+  "restart": {
+    "heading": "Starten Sie den Netzwerkdienst neu",
+    "body": "Führt nach einer Ja/Nein-Bestätigung <code>systemctl restart networking</code> aus. Meldet das Ergebnis mit <code>msg_ok</code> / <code>msg_error</code>. Die meisten Abläufe in diesem Menü bieten am Ende selbst einen Neustart an. Diese Option dient zum Neustart nach manueller Bearbeitung oder wenn Sie den zuvor angebotenen Neustart abgelehnt haben.",
+    "warnTitle": "Kurze Trennung garantiert; dauerhafte Trennung möglich",
+    "warnBody": "Ein Neustart von <code>networking</code> deaktiviert alle in <code>/etc/network/interfaces</code> deklarierten Schnittstellen und wendet ihre Konfiguration erneut an. SSH-Sitzungen über diese Schnittstellen brechen ab. Ist die neue Konfiguration ungültig, kehrt das Netzwerk nicht zurück. Nur ausführen, wenn:",
+    "warnItems": [
+      "Sie Konsolen-/IPMI-/iKVM-Zugriff bereithalten, <em>oder</em>",
+      "Sie sich direkt neben dem Rechner befinden, <em>oder</em>",
+      "Sie haben gerade erfolgreich zu einer bekannten guten Konfiguration zurückgerollt und wollen sie anwenden."
+    ]
+  },
+  "manualRollback": {
+    "heading": "Manuelles Rollback von einer Konsole",
+    "intro": "Wenn Sie das Menü nicht erreichen können (kein SSH, Dialogabsturz, ...), aber eine Konsole erreichen können, besteht das Rollback aus zwei Befehlen:",
+    "outro": "Das ist <em>dieselbe</em> Operation wie im Menü, nur von Hand eingegeben. Startet <code>networking</code> weiterhin nicht, prüfen Sie <code>journalctl -u networking -b</code> auf den zugrunde liegenden Syntax- oder Treiberfehler."
+  },
+  "troubleshoot": {
+    "heading": "Fehlerbehebung",
+    "noneTitle": "„Keine Backups gefunden“ bei der Wiederherstellung",
+    "noneBody": "Das Verzeichnis <code>/var/backups/proxmenux/</code> existiert nicht oder enthält keine <code>interfaces_backup_*</code>-Dateien. Führen Sie <em>Netzwerk-Backup erstellen</em> mindestens einmal aus oder starten Sie eine geführte Reparatur, die automatisch ein Backup erstellt. Prüfen Sie mit <code>ls /var/backups/proxmenux/</code>.",
+    "unreachTitle": "Der Netzwerkneustart gelingt, aber der Host ist weiterhin nicht erreichbar",
+    "unreachBody": "Entweder ist die neue Konfiguration falsch oder die beim Neustart angewendete Konfiguration weist Ihre Verwaltungs-IP nicht zu. Setzen Sie sie über die Konsole zurück (siehe oben). Nutzen Sie danach <bridgeLink>Brückenanalyse</bridgeLink> und <configLink>Konfigurationsanalyse</configLink>, um den Fehler vor einem erneuten Anwenden zu verstehen.",
+    "emptyTitle": "Die Wiederherstellungsvorschau zeigt eine leere Datei",
+    "emptyBody": "Die Backup-Datei ist leer (0 Bytes). Das passiert, wenn ein Kopiervorgang bei einem früheren Durchlauf unbemerkt fehlgeschlagen ist. Wählen Sie ein älteres Backup oder führen Sie <em>Netzwerk-Backup erstellen</em> jetzt erneut aus, wenn die aktuelle Konfiguration funktioniert."
+  },
+  "related": {
+    "heading": "Verwandte Themen",
+    "items": [
+      {
+        "label": "Brückenanalyse und geführte Reparatur",
+        "href": "/docs/network/bridge-analysis",
+        "tail": " — der häufigste Grund, warum hier ein Backup erstellt wird."
+      },
+      {
+        "label": "Konfigurationsanalyse und geführte Bereinigung",
+        "href": "/docs/network/config-analysis",
+        "tailRich": "— schreibt auch automatisch an <code>/var/backups/proxmenux/</code>."
+      },
+      {
+        "label": "Diagnose",
+        "href": "/docs/network/diagnostics",
+        "tail": "- Überprüfen Sie den Live-Zustand nach einer Wiederherstellung."
+      }
+    ]
+  }
+}
diff --git a/web/messages/de/docs/network/bridge-analysis.json b/web/messages/de/docs/network/bridge-analysis.json
new file mode 100644
index 00000000..00d03038
--- /dev/null
+++ b/web/messages/de/docs/network/bridge-analysis.json
@@ -0,0 +1,132 @@
+{
+  "meta": {
+    "title": "Brückenanalyse & geführte Reparatur | ProxMenux Dokumentation",
+    "description": "Erkennt vmbrX-Bridges mit fehlenden oder ungültigen physischen Ports (typisch nach PCI-Reenumeration), meldet diese mit vorgeschlagenen Shell-Befehlen und bietet eine 5-schrittgesteuerte Reparatur mit obligatorischem Backup.",
+    "ogTitle": "Brückenanalyse & geführte Reparatur | ProxMenux Dokumentation",
+    "ogDescription": "Proxmox-Bridge-Ports nach Hardwareänderungen prüfen und reparieren, mit geführtem Ablauf und sicherer Rückkehr zur vorherigen Konfiguration."
+  },
+  "header": {
+    "title": "Brückenanalyse und geführte Reparatur",
+    "description": "Prüft jede in /etc/network/interfaces deklarierte vmbrX-Bridge und ob ihre physischen Ports tatsächlich existieren. Fehlende Ports können schrittweise repariert werden. Die Analyse ist schreibgeschützt; die Reparatur erfordert Zustimmung, zeigt eine Vorschau und erstellt ein Backup.",
+    "section": "Netzwerk"
+  },
+  "intro": {
+    "title": "Was das macht",
+    "body": "Liest jede Bridge in <code>/etc/network/interfaces</code>, prüft ihre Zeile <code>bridge-ports</code> und ob jeder deklarierte Port, etwa <code>enp3s0</code>, auf dem Host existiert. Fehlt ein Port, schlägt das Werkzeug einen Ersatz vor und wendet die Änderung nach ausdrücklicher Zustimmung mit dem Ablauf <strong>sichern, Vorschau anzeigen, anwenden, überprüfen</strong> an."
+  },
+  "when": {
+    "heading": "Wenn Sie das brauchen",
+    "intro": "Linux weist vorhersehbare Schnittstellennamen aus PCI-Topologie und Slot-Reihenfolge zu. Mehrere Ereignisse mischen sie und lassen <code>/etc/network/interfaces</code> auf Namen verweisen, die nicht mehr existieren:",
+    "items": [
+      "Hinzufügen oder Entfernen einer PCIe-Karte (ein NIC, ein GPU, ein HBA, ein NVMe-Träger).",
+      "Verschieben einer vorhandenen Karte in einen anderen PCIe-Slot.",
+      "BIOS / UEFI Updates, die PCI-Geräte erneut aufzählen.",
+      "Migration der Boot-Disk auf andere Hardware."
+    ],
+    "outro": "Nach dem nächsten Start versucht die Bridge, einen nicht mehr vorhandenen Port einzubinden. Sie lässt sich nicht aktivieren und der Host verliert seine Netzwerkverbindung. <link>Persistente Schnittstellennamen</link> verhindern eine Wiederholung. Falls Sie bereits ausgesperrt sind, beschreibt diese Seite den Wiederherstellungsweg."
+  },
+  "bigPicture": {
+    "heading": "Überblick",
+    "diagram1": {
+      "arrowLabel": "Stufe 1",
+      "nodes": {
+        "sourceLabel": "/etc/network/interfaces",
+        "sourceDetail": "auto vmbr0\niface vmbr0 inet static\n  bridge-ports enp3s0",
+        "bridgeLabel": "Analysieren (schreibgeschützt)",
+        "bridgeDetail": "ip link show enp3s0\n→ nicht vorhanden",
+        "targetLabel": "Bericht + Vorschlag",
+        "targetDetail": "❌ enp3s0: NICHT GEFUNDEN\nErsetzen mit: eno1\n(noch keine Änderungen)"
+      }
+    },
+    "diagram2": {
+      "arrowLabel": "mit Backup anwenden",
+      "nodes": {
+        "sourceLabel": "Geführte Reparatur",
+        "sourceDetail": "1. Backup\n2. Aktuelle Konfiguration anzeigen\n3. Änderungsvorschau\n4. Anwenden\n5. Überprüfen",
+        "targetLabel": "/etc/network/interfaces (neu)",
+        "targetDetail": "auto vmbr0\niface vmbr0 inet static\n  bridge-ports eno1"
+      }
+    }
+  },
+  "step1": {
+    "heading": "Schritt 1: Analyse (schreibgeschützt)",
+    "intro": "Nach Auswahl von <strong>Brückenkonfiguration analysieren</strong> bricht das Werkzeug sofort ab, falls der Host nicht den klassischen Debian-/Proxmox-Stack nutzt. Andernfalls prüft es jede Bridge und meldet:",
+    "items": [
+      "Brückenname, aktueller Status (UP / DOWN), zugewiesene IP.",
+      "Jeder deklarierte Port und ob er derzeit existiert (<code>ip link show &lt;port&gt;</code>).",
+      "Für jeden ungültigen Port: ein vorgeschlagener Ersatz (die erste verfügbare physische Schnittstelle) sowie der genaue Befehl <code>sed</code>, um ihn manuell anzuwenden.",
+      "Brücken ohne <code>bridge-ports</code> und verwaiste <code>auto</code>-Einträge (kein passender <code>iface</code>-Block)."
+    ],
+    "readonlyTitle": "Garantie einer schreibgeschützten Analyse",
+    "readonlyBody": "Bis zu diesem Punkt hat das Skript keinen einzigen Änderungsbefehl ausgeführt. Sie können die Analyse offen lassen, die vorgeschlagenen <code>sed</code>-Befehle kopieren und sie manuell anwenden, wenn Sie möchten - oder die nächste Aufforderung akzeptieren, um in die geführte Reparatur einzusteigen."
+  },
+  "step2": {
+    "heading": "Schritt 2: geführte Reparatur (5 Schritte)",
+    "intro": "Wird nur gestartet, wenn Sie der Aufforderung am Ende der Analyse zustimmen. Jeder Schritt zeigt die geplante Aktion und bittet vor dem Fortfahren um Bestätigung.",
+    "steps": [
+      {
+        "title": "1. Sicherheitssicherung",
+        "body": "Kopiert <code>/etc/network/interfaces</code> in <code>/var/backups/proxmenux/interfaces_backup_&lt;TIMESTAMP&gt;</code>. Der genaue Sicherungspfad wird vor der Kopie und danach mit dem Rollback-Befehl angezeigt.",
+        "tone": "blue"
+      },
+      {
+        "title": "2. Überprüfung der aktuellen Konfiguration",
+        "body": "Öffnet das Live <code>/etc/network/interfaces</code> in einem scrollbaren Dialog, so dass Sie genau sehen können, was geändert werden soll.",
+        "tone": "blue"
+      },
+      {
+        "title": "3. Vorgeschlagene Änderungen anzeigen",
+        "body": "Listet genau die betroffenen Bridges und geplanten Portersetzungen auf. Falls inzwischen kein Reparaturbedarf mehr besteht, weil der Port zwischenzeitlich wieder aufgetaucht ist, endet der Ablauf mit <em>„Keine Änderungen erforderlich.“</em>",
+        "tone": "blue"
+      },
+      {
+        "title": "4. Änderungen anwenden",
+        "body": "Für jede betroffene Brücke läuft <code>sed -i \"/iface $bridge/,/bridge-ports/ s/bridge-ports.*/bridge-ports $new_ports/\"</code> gegen <code>/etc/network/interfaces</code>. Wenn für eine Brücke kein gültiger Ersatz verfügbar war, wird die Substitution übersprungen und in Schritt 5 gemeldet.",
+        "tone": "amber"
+      },
+      {
+        "title": "5. Überprüfung",
+        "body": "Liest die Datei erneut und bestätigt, dass der neue Port jeder Bridge existiert. Gibt den Befehl zum Zurücksetzen aus (<code>cp &lt;backup&gt; /etc/network/interfaces</code>). Bietet abschließend <strong>Netzwerk neu starten</strong> an — stimmen Sie nur zu, wenn ein Konsolenzugang als Ersatz bereitsteht.",
+        "tone": "emerald"
+      }
+    ],
+    "restartTitle": "Netzwerkneustart ≠ risikoloses Rückgängigmachen",
+    "restartBody": "Die Reparatur wird auf den Datenträger geschrieben, unabhängig davon, ob Sie den Dienst neu starten. <code>systemctl restart networking</code> wendet die Änderung <em>jetzt</em> an und kann Ihre SSH-Sitzung unterbrechen, wenn der neue Port falsch ist. Lehnen Sie ab, wird die Änderung dennoch beim nächsten Systemstart wirksam. Prüfen Sie daher die neue Konfiguration oder setzen Sie sie mit dem angezeigten Befehl zurück."
+  },
+  "edits": {
+    "heading": "Was wird bearbeitet (genau)",
+    "body": "Nur die Zeile <code>bridge-ports</code> jeder betroffenen Bridge. Andere Direktiven (<code>address</code>, <code>netmask</code>, <code>gateway</code>, <code>bridge-stp</code>, …) bleiben unverändert. Das Skript erstellt oder entfernt in diesem Ablauf keine <code>iface</code>-Blöcke — dafür ist <link>Konfigurationsanalyse &amp; Bereinigung</link> zuständig."
+  },
+  "troubleshoot": {
+    "heading": "Fehlerbehebung",
+    "unsupportedTitle": "Die Analyse bricht mit „Nicht unterstützter Netzwerkstack“ ab",
+    "unsupportedBody": "Der Host läuft netplan, systemd-networkd oder NetworkManager. Das Tool unterstützt nur <code>/etc/network/interfaces</code>. Schalten Sie den Host zuerst auf den klassischen Stack oder bearbeiten Sie die Konfiguration mit dem nativen Tooling des Managers (z.B. <code>netplan apply</code>).",
+    "noSuggestTitle": "Kein Vorschlag wird für einen ungültigen Port gedruckt",
+    "noSuggestBody": "Der Host hat null freie physische Schnittstellen (alles befindet sich entweder bereits in einer anderen Brücke oder existiert nicht). Die Analyse greift auf <code>bridge-ports none</code> zurück, so dass die Brücke zumindest ohne Port auftauchen kann. Fügen Sie eine NIC hinzu oder migrieren Sie Ports zwischen Brücken manuell, bevor Sie erneut ausführen.",
+    "stillDownTitle": "Die Reparatur ist abgeschlossen, aber die Brücke ist noch DOWN",
+    "stillDownBody": "<code>sed</code> hat die Datei aktualisiert, aber <code>systemctl restart networking</code> wurde abgelehnt. Führen Sie den Befehl nach Prüfung der neuen Konfiguration manuell aus oder starten Sie das System neu. Wurde der Neustart angenommen und bleibt die Bridge DOWN, prüfen Sie mit <code>ip link show</code>, ob der neue Port existiert, und suchen Sie mit <code>journalctl -u networking</code> nach der Ursache: nicht eingestecktes Kabel, nicht ausgehandelte Verbindung oder ein Port, der schon zu einer anderen Bridge gehört.",
+    "lostSshTitle": "Ich habe den SSH-Zugang direkt nach dem Neustart des Netzwerks verloren",
+    "lostSshIntro": "Verwenden Sie Konsole / IPMI / iKVM, um den Host zu erreichen. Wiederherstellen des Backups:",
+    "lostSshOutro": "Führen Sie dann die Analyse erneut von der Konsole aus aus, um herauszufinden, warum der Vorschlag nicht funktioniert hat (normalerweise: Der Ersatzanschluss ist nicht wirklich angeschlossen)."
+  },
+  "related": {
+    "heading": "Verwandte Themen",
+    "items": [
+      {
+        "label": "Persistente Schnittstellennamen",
+        "href": "/docs/network/persistent-names",
+        "tail": " — bindet Namen an MAC-Adressen, damit dieses Szenario nicht erneut auftritt."
+      },
+      {
+        "label": "Konfigurationsanalyse und geführte Bereinigung",
+        "href": "/docs/network/config-analysis",
+        "tailRich": "— für verwaiste <code>iface</code>-Blöcke (die andere Hälfte des gleichen Problems)."
+      },
+      {
+        "label": "Schnittstellen sichern und neu starten",
+        "href": "/docs/network/backup-restore",
+        "tail": "- manuelle Snapshots und der Wiederherstellungsbrowser."
+      }
+    ]
+  }
+}
diff --git a/web/messages/de/docs/network/config-analysis.json b/web/messages/de/docs/network/config-analysis.json
new file mode 100644
index 00000000..138b6c24
--- /dev/null
+++ b/web/messages/de/docs/network/config-analysis.json
@@ -0,0 +1,122 @@
+{
+  "meta": {
+    "title": "Konfigurationsanalyse und geführte Bereinigung | ProxMenux-Dokumentation",
+    "description": "Erkennt iface-Blöcke in /etc/network/interfaces, die auf physische NICs verweisen, die nicht mehr auf dem Host vorhanden sind. Meldet sie und bietet eine 5-schrittgesteuerte Entfernung mit obligatorischem Backup und einer Blockvorschau.",
+    "ogTitle": "Konfigurationsanalyse und geführte Bereinigung | ProxMenux-Dokumentation",
+    "ogDescription": "Finden und entfernen Sie verwaiste Schnittstellenblöcke, die durch Hardwareänderungen zurückgelassen wurden, mit vollständiger Vorschau und Rollback."
+  },
+  "header": {
+    "title": "Konfigurationsanalyse und geführte Bereinigung",
+    "description": "Untersucht jeden iface-Block in /etc/network/interfaces und prüft, ob die zugehörige physische Netzwerkkarte noch vorhanden ist. Meldet nach Hardwareänderungen verbliebene verwaiste Blöcke und bietet eine geführte Entfernung mit Backup, Vorschau und Bestätigung für jeden Block.",
+    "section": "Netzwerk"
+  },
+  "intro": {
+    "title": "Was das macht",
+    "body": "Identifiziert <code>iface</code>-Deklarationen, deren unterstützende NIC nicht mehr auf dem Host vorhanden ist (typisch nach dem Ersetzen oder Entfernen einer Netzwerkkarte). Anschließend wird eine geführte Bereinigung angeboten, bei der <em>nur</em> die verwaisten Blöcke entfernt werden, mit einer Sicherung, einer Vorschau pro Abschnitt und einer expliziten endgültigen Bestätigung."
+  },
+  "differs": {
+    "heading": "Wie es sich von der Brückenanalyse unterscheidet",
+    "headerAspect": "Aspekt",
+    "headerBridge": "Brückenanalyse",
+    "headerConfig": "Konfigurationsanalyse",
+    "rows": [
+      {
+        "aspect": "Untersucht",
+        "bridge": "Brücken (<code>vmbrX</code>) und ihre <code>bridge-ports</code>-Linie",
+        "config": "Jeder <code>iface</code>-Block (ausgenommen Loopback, Bridges, Bonds)"
+      },
+      {
+        "aspect": "Erkennt",
+        "bridge": "Brücken, die auf einen nicht vorhandenen Port verweisen",
+        "config": "Standalone-Schnittstellenblöcke für NICs, die nicht existieren"
+      },
+      {
+        "aspect": "Reparaturmaßnahmen",
+        "bridge": "Ersetzt den Portnamen in <code>bridge-ports</code>",
+        "config": "Entfernen Sie den gesamten <code>iface</code>-Block"
+      },
+      {
+        "aspect": "Ausgenommen sind",
+        "bridge": "Nichts – jede Brücke wird analysiert",
+        "config": "Bridges (<code>vmbrX</code>) und Bonds (<code>bondX</code>) bleiben immer erhalten, da sie virtuell sind und beim Start vorübergehend fehlen können"
+      }
+    ],
+    "outro": "In der Praxis führen Sie oft beide Werkzeuge in dieser Reihenfolge aus: zuerst <strong>Konfigurationsanalyse</strong>, um verwaiste Blöcke zu entfernen, dann <link>Brückenanalyse</link>, um Bridges, die auf die entfernte Schnittstelle verwiesen, neu zuzuordnen."
+  },
+  "step1": {
+    "heading": "Schritt 1: Analyse (schreibgeschützt)",
+    "intro": "Bricht sofort ab, wenn der Host nicht den klassischen Netzwerkstack nutzt. Andernfalls werden alle konfigurierten Schnittstellen außer Loopback mit ihrem Status aufgelistet:",
+    "virtTitle": "Virtuelle Schnittstellen sind geschützt",
+    "virtBody": "Bridges (<code>vmbrX</code>) und Bonds (<code>bondX</code>) sind virtuelle Konstrukte. Sie können zum Zeitpunkt der Prüfung durchaus fehlen, etwa eine Bridge ohne Ports. Daher schlägt die Analyse nur die Entfernung physischer Netzwerkkarten vor, niemals die dieser virtuellen Schnittstellen."
+  },
+  "step2": {
+    "heading": "Schritt 2: geführte Bereinigung (5 Schritte)",
+    "intro": "Wird nur gestartet, wenn Sie der Aufforderung am Ende der Analyse zustimmen. Jeder Schritt muss bestätigt werden; bei Abbruch wird ohne Schreiben beendet.",
+    "steps": [
+      {
+        "title": "1. Sicherheitssicherung",
+        "body": "Kopiert <code>/etc/network/interfaces</code> nach <code>/var/backups/proxmenux/interfaces_backup_&lt;TIMESTAMP&gt;</code>. Der Pfad wird vorher und nachher angezeigt.",
+        "tone": "blue"
+      },
+      {
+        "title": "2. Bestätigen Sie die Entfernungsliste",
+        "body": "Listet genau die zu entfernenden physischen Schnittstellenblöcke auf. Sind die Netzwerkkarten zwischen Analyse und Bereinigung wieder aufgetaucht, etwa nach erneutem Einsetzen einer Karte, endet der Ablauf mit <em>„Keine Bereinigung erforderlich.“</em>",
+        "tone": "blue"
+      },
+      {
+        "title": "3. Vorschau der genauen Block(s)",
+        "body": "Öffnet eine scrollbare Ansicht jedes <code>iface</code>-Blocks, der gelöscht werden würde, exakt wie in der Datei. Hier können Sie etwa einen wichtigen <code>up</code>-Hook erkennen, den Sie behalten möchten.",
+        "tone": "blue"
+      },
+      {
+        "title": "4. Entfernung anwenden",
+        "body": "Für jede verwaiste Schnittstelle läuft <code>sed -i \"/^iface $iface/,/^$/d\" /etc/network/interfaces</code>. Das löscht von der passenden <code>iface</code>-Zeile bis zur nächsten leeren Zeile.",
+        "tone": "amber"
+      },
+      {
+        "title": "5. Überprüfung",
+        "body": "Liest die Datei erneut, listet auf, was entfernt wurde, und überprüft die verbleibenden Schnittstellen erneut. Gibt den Rollback-Befehl aus. Führt <strong>nicht</strong> einen automatischen Neustart des Netzwerks durch. Das Entfernen eines nicht verwendeten Blocks kann sicher beim nächsten Neustart angewendet werden und vermeidet eine Beeinträchtigung des Live-Status.",
+        "tone": "emerald"
+      }
+    ],
+    "noRestartTitle": "Startet das Netzwerk nicht automatisch neu",
+    "noRestartBody": "Im Gegensatz zur Brückenreparatur bietet der Bereinigungsfluss keinen Neustart des Dienstes. Das Entfernen eines unbenutzten Schnittstellenblocks hat keine unmittelbaren Auswirkungen auf die laufende Konfiguration, so dass ein Neustart unnötig ist und ein unnötiges Verbindungsrisiko darstellt. Die Änderung wird beim nächsten manuellen <code>systemctl restart networking</code> oder beim nächsten Neustart wirksam."
+  },
+  "caveats": {
+    "heading": "Wichtige Vorbehalte",
+    "boundaryTitle": "Die Blockgrenze ist die erste leere Linie",
+    "boundaryBody": "Das <code>sed</code>-Muster löscht von <code>iface &lt;name&gt;</code> bis zur nächsten leeren Zeile. Fehlt in <code>/etc/network/interfaces</code> eine Leerzeile zwischen Blöcken, was nach manueller Bearbeitung möglich ist, kann auch der nächste Block gelöscht werden. Deshalb ist <strong>Schritt 3 obligatorisch</strong>: Prüfen Sie die Vorschau vor der Bestätigung.",
+    "tandemTitle": "Ein Waisen-Iface, das von einer Brücke verwendet wird, wird hier erkannt, nicht in der Brückenanalyse",
+    "tandemBody": "Wenn <code>vmbr0</code> <code>bridge-ports enp3s0</code> deklariert und <code>enp3s0</code> einen eigenen Block <code>iface enp3s0 inet manual</code> hat, bleibt nach der Entfernung von <code>enp3s0</code> eine ungültige Referenz in <code>vmbr0</code>. Führen Sie danach die <link>Brückenanalyse</link> aus, um den Bridge-Port neu zuzuordnen oder zu entfernen. Beide Abläufe sind für die gemeinsame Verwendung ausgelegt."
+  },
+  "troubleshoot": {
+    "heading": "Fehlerbehebung",
+    "notFoundTitle": "Die Analyse zeigt mein neues NIC als \"NICHT GEFUNDEN\"",
+    "notFoundBody": "Der Kernel sieht das Gerät unter einem anderen Namen als in der Datei. Führen Sie <code>ip link show</code> aus, um den tatsächlichen Namen zu erhalten. Dies ist genau der Fall, wenn <link>Persistente Schnittstellennamen</link> das Problem verhindern würden.",
+    "tooMuchTitle": "Die Bereinigung hat zu viel entfernt (einen Block, den ich behalten wollte)",
+    "tooMuchBody": "Wiederherstellen aus dem in Schritt 5 gedruckten Backup:",
+    "tooMuchOutro": "Bearbeiten Sie die Datei von Hand, um eine klare leere Linie zwischen den Blöcken hinzuzufügen, bevor Sie die Bereinigung erneut ausführen, oder entfernen Sie den problematischen Block manuell.",
+    "bridgeBreakTitle": "Eine Brücke funktioniert nach dem Aufräumen nicht mehr",
+    "bridgeBreakBody": "Die Bridge war auf einen Port angewiesen, dessen <code>iface</code>-Block gerade entfernt wurde. Führen Sie die <link>Brückenanalyse</link> aus; der Vorschlag ordnet der Bridge eine vorhandene physische Schnittstelle zu."
+  },
+  "related": {
+    "heading": "Verwandte Themen",
+    "items": [
+      {
+        "label": "Brückenanalyse und geführte Reparatur",
+        "href": "/docs/network/bridge-analysis",
+        "tail": " — der natürliche nächste Schritt nach einer Bereinigung."
+      },
+      {
+        "label": "Persistente Schnittstellennamen",
+        "href": "/docs/network/persistent-names",
+        "tail": " — verhindert, dass sich nach jeder Hardwareänderung verwaiste Blöcke ansammeln."
+      },
+      {
+        "label": "Schnittstellen sichern und neu starten",
+        "href": "/docs/network/backup-restore",
+        "tail": "- manuelle Snapshots und der Wiederherstellungsbrowser."
+      }
+    ]
+  }
+}
diff --git a/web/messages/de/docs/network/diagnostics.json b/web/messages/de/docs/network/diagnostics.json
new file mode 100644
index 00000000..3aca50e3
--- /dev/null
+++ b/web/messages/de/docs/network/diagnostics.json
@@ -0,0 +1,94 @@
+{
+  "meta": {
+    "title": "Diagnose | ProxMenux Dokumentation",
+    "description": "Drei einmalige, schreibgeschützte Diagnoseprüfungen: Routingtabelle anzeigen, Konnektivität testen und erweiterte Diagnose. Reine Prüfung — schreibt nie in /etc/network/interfaces und führt nie ändernde Befehle aus, mit einer ausdrücklichen Ausnahme: Wird NetworkManager erkannt, kann er nach Ihrer Zustimmung vollständig entfernt werden.",
+    "ogTitle": "Diagnose | ProxMenux Dokumentation",
+    "ogDescription": "Schreibgeschützte Netzwerkdiagnose für den Proxmox-Host: Routing, Erreichbarkeit und erweiterte Statistiken."
+  },
+  "header": {
+    "title": "Diagnose",
+    "description": "Drei einmalige, schreibgeschützte Prüfungen des aktuellen Netzwerkzustands: Routingtabelle, Konnektivitätstest und erweiterte Statistiken. Keine schreibt in /etc/network/interfaces — jederzeit sicher nutzbar, auch über SSH. Für interaktive Echtzeitüberwachung siehe Überwachungswerkzeuge für Echtzeitdaten.",
+    "section": "Netzwerk"
+  },
+  "intro": {
+    "title": "Was das macht",
+    "body": "Berichtet über Routing, Erreichbarkeit und zusammengefasste Statistiken, <strong>ohne etwas zu ändern</strong>. Damit können Sie den ordnungsgemäßen Netzwerkbetrieb bestätigen oder doppelte IP-Adressen erkennen. Für die kontinuierliche Verkehrsbeobachtung siehe <monitoringLink>Überwachungswerkzeuge für Echtzeitdaten</monitoringLink>; zur Anzeige der unverarbeiteten Konfigurationsdatei siehe <backupLink>Schnittstellen sichern und neu starten</backupLink>."
+  },
+  "routing": {
+    "heading": "Routing-Tabelle anzeigen",
+    "body": "Listet alle aktuell vom Kernel verwendeten Routen auf (<code>ip route show</code>) und hebt das Standard-Gateway hervor. Damit lässt sich prüfen, ob Internetverkehr die erwartete Schnittstelle verwendet und keine veralteten Routen Vorrang haben."
+  },
+  "connectivity": {
+    "heading": "Konnektivität testen",
+    "intro": "Sendet zwei ICMP-Sonden nacheinander an drei Ziele und meldet jede einzelne. Führt dann eine <code>nslookup google.com</code> aus, um die DNS-Auflösung unabhängig von ICMP zu überprüfen.",
+    "headerTest": "Test",
+    "headerTarget": "Ziel",
+    "headerConfirms": "Was es bestätigt",
+    "rows": [
+      {
+        "test": "Google DNS",
+        "target": "8.8.8.8",
+        "confirms": "Externe Erreichbarkeit über bekannte Anycast IP"
+      },
+      {
+        "test": "Cloudflare DNS",
+        "target": "1.1.1.1",
+        "confirms": "Unabhängige zweite Meinung, wenn Google ICMP blockiert"
+      },
+      {
+        "test": "Gateway",
+        "target": "(Standardroute)",
+        "confirms": "L2/L3-Verbindung zum lokalen Router"
+      },
+      {
+        "test": "DNS-Auflösung",
+        "target": "google.com",
+        "confirms": "Der DNS-Server ist erreichbar und antwortet"
+      }
+    ],
+    "readingTitle": "Lesen des Ergebnisses",
+    "readingBody": "Wenn der Gateway-Test besteht, aber die öffentlichen DNS-Ziele fehlschlagen, haben Sie lokale Konnektivität, aber kein Internet - überprüfen Sie den Upstream des Gateways. Wenn die DNS-Auflösung fehlschlägt, Pings zu <code>8.8.8.8</code> jedoch erfolgreich sind, ist das Problem der Resolver, nicht das Netzwerk: Überprüfen Sie <code>/etc/resolv.conf</code>."
+  },
+  "advanced": {
+    "heading": "Erweiterte Diagnose",
+    "intro": "Fasst netzwerkweite Statistiken zusammen und prüft auf häufige Probleme. Meldet die Anzahl aktiver Verbindungen, lauschende Ports und die Gesamtzahl der Schnittstellen und weist ausdrücklich auf zwei problematische Konstellationen hin:",
+    "items": [
+      "<strong>NetworkManager läuft auf einem Proxmox-Host.</strong> NetworkManager und Proxmox’ <code>ifupdown</code> stehen im Konflikt: Beide versuchen, Schnittstellen zu verwalten, sodass Bridges ständig ihren Zustand wechseln oder nicht aktiviert werden. Wird NetworkManager erkannt, bietet das Werkzeug an, ihn interaktiv zu stoppen, zu deaktivieren und vollständig zu entfernen (dies ist die <em>einzige</em> Diagnose, die das System ändern kann, und nur nach ausdrücklicher Zustimmung).",
+      "<strong>Doppelte IP-Adressen auf verschiedenen Schnittstellen.</strong> Zwei Schnittstellen mit derselben IPv4-Adresse verursachen sporadische Verbindungsprobleme, die innerhalb der VM äußerst schwer zu untersuchen sind. Erkannt über <code>ip -4 addr show | sort | uniq -d</code>."
+    ],
+    "nmTitle": "Die NetworkManager-Eingabeaufforderung ist hier die einzige Änderungsaktion",
+    "nmBody": "Alle anderen Prüfungen in der erweiterten Diagnose sind schreibgeschützt. Die Entfernung von NetworkManager erfordert eine Ja/Nein-Bestätigung und führt <code>systemctl stop / disable</code> + <code>apt-get purge -y network-manager</code> aus. Wenn Sie ablehnen, ändert sich nichts."
+  },
+  "troubleshoot": {
+    "heading": "Fehlerbehebung",
+    "gwTitle": "Konnektivität testen meldet einen Gatewayfehler, aber der Host hat Internetzugriff",
+    "gwBody": "Einige Router reagieren nicht auf ICMP von ihrer internen Schnittstelle aus, selbst wenn sie den Datenverkehr gerne weiterleiten. Testen Sie mit <code>traceroute 8.8.8.8</code> von einer Konsole aus: Wenn der zweite Hop Ihr ISP ist und der öffentliche DNS-Test bestanden ist, ist das Gateway trotz des fehlgeschlagenen Pings in Ordnung.",
+    "dupTitle": "Die erweiterte Diagnose meldet weiterhin doppelte IP-Adressen, obwohl ich eine entfernt habe",
+    "dupBody": "Der Check betrachtet den Live-Kernel-Status, nicht die Config-Datei. Führen Sie <code>ip -4 addr show</code> aus, um zu bestätigen; wenn das Duplikat noch vorhanden ist, hält es immer noch eine Schnittstelle. Verwenden Sie <code>ip addr del &lt;IP&gt;/&lt;mask&gt; dev &lt;iface&gt;</code>, um es aus dem Live-Zustand zu entfernen, und bearbeiten Sie dann <code>/etc/network/interfaces</code>, wenn es auch persistent ist."
+  },
+  "related": {
+    "heading": "Verwandte Themen",
+    "items": [
+      {
+        "label": "Überwachungswerkzeuge für Echtzeitdaten",
+        "href": "/docs/network/monitoring",
+        "tail": "— interaktive iftop / iptraf-ng / iperf3 Launcher."
+      },
+      {
+        "label": "Brückenanalyse und geführte Reparatur",
+        "href": "/docs/network/bridge-analysis",
+        "tail": " — wenn einem vmbrX der physische Port fehlt."
+      },
+      {
+        "label": "Konfigurationsanalyse und geführte Bereinigung",
+        "href": "/docs/network/config-analysis",
+        "tail": " — wenn eine alte Netzwerkkarte noch deklariert, aber nicht mehr vorhanden ist."
+      },
+      {
+        "label": "Schnittstellen sichern und neu starten",
+        "href": "/docs/network/backup-restore",
+        "tail": " — um vor jeder Änderung einen Schnappschuss der Konfiguration zu erstellen."
+      }
+    ]
+  }
+}
diff --git a/web/messages/de/docs/network/index.json b/web/messages/de/docs/network/index.json
new file mode 100644
index 00000000..f9900748
--- /dev/null
+++ b/web/messages/de/docs/network/index.json
@@ -0,0 +1,107 @@
+{
+  "meta": {
+    "title": "Proxmox-Netzwerkverwaltung — Bridges, Bonds, Diagnose, Reparatur | ProxMenux",
+    "description": "Schreibgeschützte Diagnose, Analysen mit anschließenden Vorschlägen und geführte Reparaturen für den Debian-/Proxmox-Netzwerkstack (/etc/network/interfaces). Prüfen Sie Bridges und Bonds, starten Sie Live-Überwachungswerkzeuge, vergeben Sie dauerhafte Schnittstellennamen, erstellen Sie Backups und starten Sie das Netzwerk sicher neu — mit obligatorischen Backups und schrittweiser Vorschau.",
+    "ogTitle": "Proxmox-Netzwerkverwaltung — Bridges, Bonds, Diagnose, Reparatur",
+    "ogDescription": "Diagnose, Analyse und geführte Reparaturen für den Proxmox-Netzwerkstack mit obligatorischen Backups und Schritt-für-Schritt-Vorschau.",
+    "twitterTitle": "Proxmox-Netzwerkverwaltung | ProxMenux",
+    "twitterDescription": "Brücken, Bonds, Diagnosen und geführte Reparaturen für den Proxmox-Netzwerkstack mit obligatorischen Backups."
+  },
+  "header": {
+    "title": "Netzwerkmanagement",
+    "description": "Schreibgeschützte Diagnose, Analyseberichte mit anschließenden Vorschlägen und geführte Reparaturen für den klassischen Debian-/Proxmox-Netzwerkstack. Jeder destruktive Vorgang erstellt zuerst ein Backup und zeigt die genauen Änderungen vor der Anwendung an.",
+    "section": "Netzwerk"
+  },
+  "intro": {
+    "title": "Wozu dieses Menü dient",
+    "body": "Prüfen, diagnostizieren und reparieren Sie bei Bedarf die Netzwerkkonfiguration des Proxmox-Hosts, ohne den Fernzugriff zu verlieren. Die Werkzeuge folgen einem Prinzip: <strong>zuerst lesen, dann Vorschläge machen und Änderungen nur mit ausdrücklicher Zustimmung und einer Sicherheitskopie anwenden</strong>. Es gibt keine Schaltfläche „Alles automatisch reparieren“."
+  },
+  "openingMenu": {
+    "heading": "Öffnen des Menüs",
+    "intro": "Wählen Sie im Hauptmenü von ProxMenux <strong>Netzwerk</strong>. Folgendes wird angezeigt:",
+    "imageAlt": "Menü Netzwerkmanagement mit Diagnose, Überwachung, Analyse, Reparatur, persistenten Namen und Backup-Optionen"
+  },
+  "safety": {
+    "heading": "Das Sicherheitsmodell",
+    "body": "Das Bearbeiten der Netzwerkkonfiguration auf einem entfernten Proxmox-Host ist eine der einfachsten Möglichkeiten, sich auszusperren. ProxMenux behandelt jede Aktion entsprechend. Die Werkzeuge fallen in drei Verhaltensstufen - wählen Sie die Karte, die Ihrer Absicht entspricht:"
+  },
+  "tiers": {
+    "readOnly": {
+      "title": "Schreibgeschützt",
+      "body": "Reine Inspektion. Kann das System unter keinen Umständen ändern.",
+      "items": [
+        "Routingtabelle, Konnektivitätstests, fortgeschrittene Statistiken",
+        "Verkehrsüberwachung in Echtzeit (iftop, iptraf-ng)",
+        "Bandbreitentest (iperf3)"
+      ]
+    },
+    "analyze": {
+      "title": "Analysieren, dann vorschlagen",
+      "body": "Erkennt Probleme, druckt einen Bericht mit vorgeschlagenen Shell-Befehlen und stoppt. Sie entscheiden, ob Sie anschließend in die geführte Reparatur eintreten möchten.",
+      "items": [
+        "Brückenkonfigurationsanalyse",
+        "Netzwerkkonfigurationsanalyse"
+      ]
+    },
+    "apply": {
+      "title": "Mit Backup anwenden",
+      "body": "Ändert das System. Erstellt immer zuerst ein Backup der betroffenen Datei mit Zeitstempel und zeigt vor dem Schreiben eine Vorschau an.",
+      "items": [
+        "Persistente Schnittstellennamen (.link-Dateien)",
+        "Manuelles Backup, Wiederherstellung und Neustart des Dienstes"
+      ]
+    }
+  },
+  "classicTitle": "Nur klassischer Stack",
+  "classicBody": "Jede Analyse- und Reparaturfunktion prüft den aktiven Netzwerkmanager, bevor sie etwas ändert. Wenn der Host <strong>netplan</strong>, <strong>systemd-networkd</strong> oder <strong>NetworkManager</strong> verwendet, bricht das Werkzeug sofort mit einer klaren Meldung ab — das Menü unterstützt nur den klassischen Debian-/Proxmox-Stack unter <code>/etc/network/interfaces</code>. Das ist beabsichtigt: Eine netplan-Datei nach Regeln für <code>ifupdown</code> zu bearbeiten, würde die Konfiguration unbemerkt beschädigen.",
+  "backups": {
+    "heading": "Wo Backups gespeichert werden",
+    "intro": "Jede geführte Reparatur, Wiederherstellung oder manuelle Sicherung schreibt eine zeitgestempelte Kopie von <code>/etc/network/interfaces</code> auf <code>/var/backups/proxmenux/</code>:",
+    "rollbackIntro": "So rollen Sie manuell von einer Konsole zurück:"
+  },
+  "readOnlySection": {
+    "heading": "Schreibgeschützte Prüfung",
+    "body": "Der Ausgangspunkt, wenn etwas nicht stimmt. Reine Prüfung — schreibt nie in <code>/etc/network/interfaces</code> und führt nie einen ändernden Befehl aus (mit einer ausdrücklichen Ausnahme: Wird NetworkManager erkannt, kann er nach Ihrer Zustimmung vollständig entfernt werden). Jederzeit sicher über SSH nutzbar.",
+    "options": [
+      {
+        "title": "Diagnose",
+        "description": "Drei einmalige, schreibgeschützte Prüfungen: Routingtabelle anzeigen, Konnektivität testen und erweiterte Diagnose. Reine Prüfung — schreibt nie in das System."
+      },
+      {
+        "title": "Überwachungswerkzeuge für Echtzeitdaten",
+        "description": "Drei interaktive Launcher: iftop (Echtzeitbandbreite pro Hostpaar), iptraf-ng (Multi-Mode-Traffic-Monitor) und iperf3 (Bandbreitentest, Server / Client-Modus)."
+      }
+    ]
+  },
+  "analyzeSection": {
+    "heading": "Analysieren, dann vorschlagen",
+    "body": "Wenn eine Prüfung oder ein tatsächlicher Ausfall auf ein Konfigurationsproblem hinweist, kommen diese Werkzeuge zum Einsatz. Jedes untersucht den relevanten Teil von <code>/etc/network/interfaces</code>, gibt einen detaillierten Bericht mit dem genauen Shell-Befehl zur Behebung jedes Befunds aus und <strong>stoppt</strong>. Wenn Sie anschließend die optionale geführte Reparatur annehmen, wird vor jeder Änderung eine Sicherung erstellt und die Änderung vor dem Schreiben angezeigt.",
+    "options": [
+      {
+        "title": "Brückenanalyse und geführte Reparatur",
+        "description": "Erkennt vmbrX-Bridges mit fehlenden oder ungültigen Ports, etwa nach einer neuen PCI-Gerätenummerierung. Zeigt zuerst einen Bericht an und repariert nur, wenn Sie dem geführten Ablauf mit 5 Schritten zustimmen."
+      },
+      {
+        "title": "Konfigurationsanalyse und geführte Bereinigung",
+        "description": "Findet in /etc/network/interfaces deklarierte physische Schnittstellen, die nicht mehr existieren (Waisenkonfigurationen, die durch Hardwareänderungen zurückgelassen wurden). Meldet sie und bietet eine geführte Entfernung an."
+      }
+    ]
+  },
+  "applySection": {
+    "heading": "Mit Backup anwenden",
+    "body": "Diese Werkzeuge schreiben bestimmungsgemäß auf den Datenträger. Jedes erstellt vorher ein Backup der betroffenen Datei mit Zeitstempel. Destruktive Optionen wie Wiederherstellen und Neustarten erfordern eine ausdrückliche Ja/Nein-Bestätigung. <em>Persistente Schnittstellennamen</em> werden erst beim nächsten Neustart wirksam, sodass die Einrichtung auch auf einem entfernten Host sicher geplant werden kann.",
+    "options": [
+      {
+        "title": "Persistente Schnittstellennamen",
+        "description": "Bindet Schnittstellennamen (eno1, enp3s0, …) über systemd-.link-Dateien an MAC-Adressen. Die Namen bleiben bei PCI-Steckplatzwechseln, Kernel-Upgrades und beim Hinzufügen oder Entfernen anderer Netzwerkkarten erhalten."
+      },
+      {
+        "title": "Schnittstellen sichern und neu starten",
+        "description": "Manueller Snapshot von /etc/network/interfaces, Durchsuchen und Wiederherstellen früherer Backups, Anzeigen der Live-Konfiguration und Neustart des Netzwerkdienstes bei Bedarf."
+      }
+    ]
+  },
+  "consoleTitle": "Konsolenzugriff bereithalten",
+  "consoleSubTitle": "Vor jeder Reparatur auf einem entfernten Host",
+  "consoleBody": "Wenn Sie über SSH verbunden sind und nur einen Zugangsweg zum Host haben, halten Sie vor Netzwerkänderungen einen Ersatzweg bereit: eine physische Konsole, IPMI oder iKVM oder einen anderen Rechner im selben LAN. Die geführten Reparaturen sind sicher und bieten immer einen Befehl zum Zurücksetzen. Eine falsch konfigurierte Bridge oder eine unterbrochene Verbindung kann Sie dennoch aussperren, bis Sie die Konsole erreichen."
+}
diff --git a/web/messages/de/docs/network/monitoring.json b/web/messages/de/docs/network/monitoring.json
new file mode 100644
index 00000000..908aee12
--- /dev/null
+++ b/web/messages/de/docs/network/monitoring.json
@@ -0,0 +1,136 @@
+{
+  "meta": {
+    "title": "Überwachungswerkzeuge für Echtzeitdaten | ProxMenux-Dokumentation",
+    "description": "Drei interaktive Netzwerküberwachungsstarter: iftop (Echtzeitbandbreite pro Hostpaar), iptraf-ng (Multi-Mode-Traffic-Monitor) und iperf3 (Bandbreitentest, Server / Client-Modus). Jeder wird bei der ersten Verwendung installiert.",
+    "ogTitle": "Überwachungswerkzeuge für Echtzeitdaten | ProxMenux-Dokumentation",
+    "ogDescription": "Interaktive Netzwerküberwachung und Bandbreitentests für den Proxmox-Host: iftop, iptraf-ng, iperf3."
+  },
+  "header": {
+    "title": "Überwachungswerkzeuge für Echtzeitdaten",
+    "description": "Drei interaktive Starter zur Echtzeit-Netzwerkbeobachtung und Bandbreitenmessung: iftop, iptraf-ng und iperf3. Jedes Werkzeug wird beim ersten Gebrauch automatisch über apt installiert, läuft im Vordergrund und wird mit der angegebenen Taste beendet. Sie ändern die Netzwerkkonfiguration des Hosts nicht; iperf3 erzeugt Testverkehr.",
+    "section": "Netzwerk"
+  },
+  "intro": {
+    "title": "Was das macht",
+    "body": "Drei interaktive Monitoring-Tools, jedes hinter seinem eigenen Menüeintrag. Beim ersten Start eines Pakets wird das Paket lautlos über <code>apt-get</code> installiert. Nachfolgende Starts beginnen sofort. Keines dieser Tools ändert die Host-Netzwerkkonfiguration."
+  },
+  "when": {
+    "heading": "Welches Werkzeug Sie wann verwenden",
+    "headerQuestion": "Fragestellung",
+    "headerUse": "Verwenden",
+    "rows": [
+      {
+        "question": "Wer lastet die Verbindung <em>gerade jetzt</em> aus?",
+        "use": "iftop"
+      },
+      {
+        "question": "Welche Protokollaufschlüsselung / Paketgrößen / TCP-Flows fließen?",
+        "use": "iptraf-ng"
+      },
+      {
+        "question": "Wie viel Bandbreite ist tatsächlich zwischen zwei Hosts verfügbar?",
+        "use": "iperf3"
+      }
+    ]
+  },
+  "iftop": {
+    "heading": "Netzwerknutzung in Echtzeit (iftop)",
+    "body": "Bandbreite pro Hostpaar (Quelle ↔ Ziel) in Echtzeit — wie <code>top</code> für Netzwerkverkehr. Zeigt die größten Datenströme oben an, mit gleitenden Durchschnitten über 2/10/40 Sekunden. Das beste Werkzeug für die Frage <em>„Warum ist mein Uplink ausgelastet?“</em>.",
+    "exit": "<strong>Beenden:</strong> Drücken Sie <kbd>q</kbd>. ProxMenux zeigt vor dem Start einen Erinnerungsdialog.",
+    "keysTitle": "Nützliche Tasten in iftop",
+    "keysBody": "<kbd>n</kbd> DNS-Auflösung umschalten, <kbd>p</kbd> Portnummern anzeigen, <kbd>P</kbd> Anzeige pausieren, <kbd>t</kbd> Zeilenrichtung umschalten (gesendet / empfangen / beides), <kbd>1</kbd>/<kbd>2</kbd>/<kbd>3</kbd> nach dem Durchschnitt über 2 s / 10 s / 40 s sortieren. Vollständige Liste unter <code>man iftop</code>."
+  },
+  "iptraf": {
+    "heading": "Netzwerküberwachungstool (iptraf-ng)",
+    "intro": "Ein menügesteuerter Verkehrsmonitor mit mehreren Modi. iftop beantwortet <em>„wer“</em>, iptraf-ng beantwortet <em>„was“</em>: Byte-/Paketzähler pro Protokoll, Verfolgung des TCP-Verbindungszustands, Paketgrößenhistogramme und LAN-Aktivität pro Station.",
+    "menuIntro": "Beim Start erhalten Sie ein Menü mit fünf Optionen:",
+    "headerMode": "Modus",
+    "headerUseFor": "Verwenden Sie es für",
+    "rows": [
+      {
+        "mode": "IP traffic monitor",
+        "useFor": "Live TCP / UDP/ICMP / Other-IP-Flow-Liste mit Byte-Zählern und Verbindungszustand"
+      },
+      {
+        "mode": "General interface stats",
+        "useFor": "Aggregierte IPv4/IPv6/TCP/UDP/ICMP/Nicht-IP-Paketzahl pro NIC"
+      },
+      {
+        "mode": "Detailed interface stats",
+        "useFor": "Gleiche wie oben, aber für eine Schnittstelle, mit Paketgröße und -rate Details"
+      },
+      {
+        "mode": "Statistical breakdowns",
+        "useFor": "Histogramm der Paketgrößenverteilung nach TCP / UDP Port"
+      },
+      {
+        "mode": "LAN station monitor",
+        "useFor": "Per-MAC-Verkehrsstatistiken für die lokale Broadcast-Domain"
+      }
+    ],
+    "exit": "<strong>Beenden:</strong> Drücken Sie in einer beliebigen Ansicht <kbd>x</kbd> oder im Hauptmenü <kbd>Q</kbd>. ProxMenux zeigt vor dem Start einen Erinnerungsdialog.",
+    "logTitle": "Erfasste Daten in einer Datei protokollieren",
+    "logBody": "Jeder Modus bietet an, erfasste Statistiken unter <code>/var/log/iptraf-ng/</code> zu protokollieren. Nützlich zur Aufzeichnung einer Verkehrsspitze: Lassen Sie das Werkzeug laufen, protokollieren Sie in eine Datei und prüfen Sie diese später, statt die Live-Anzeige mitlesen zu müssen."
+  },
+  "iperf3": {
+    "heading": "Bandbreitentest (iperf3)",
+    "intro1": "Misst den tatsächlichen TCP-Durchsatz zwischen zwei Hosts. Anders als iftop / iptraf-ng, die vorhandenen Verkehr beobachten, erzeugt iperf3 künstlichen Verkehr für einen Belastungstest der Verbindung. Unverzichtbar für Fragen wie <em>„Erreicht mein 10-GbE-Link wirklich 10 GbE?“</em> oder <em>„Liegt der Engpass an der Netzwerkkarte, am Switch oder am Speicher?“</em>.",
+    "intro2": "iperf3 ist ein <strong>Werkzeug für zwei Hosts</strong>: Eine Seite läuft als Server und lauscht auf TCP-Port 5201, die andere als Client, der sich verbindet, Daten sendet und die Rate ausgibt. Der ProxMenux-Starter fragt nach dem gewünschten Modus:",
+    "headerMode": "Modus",
+    "headerBehaviour": "Verhalten",
+    "headerCli": "Entsprechender CLI-Befehl",
+    "rows": [
+      {
+        "mode": "Server",
+        "behaviour": "Lauscht auf TCP-Port 5201 und gibt für jeden eingehenden Test Ergebnisse aus. Beenden mit Ctrl+C.",
+        "cli": "iperf3 -s"
+      },
+      {
+        "mode": "Client",
+        "behaviour": "Fragt nach der Server-IP / Hostname, verbindet, führt einen Standard-10-Sekunden-Test aus und druckt den Bericht aus.",
+        "cli": "iperf3 -c <target>"
+      }
+    ],
+    "workflowIntro": "Typischer Workflow zum Testen einer 10 GbE-Verbindung zwischen zwei Proxmox-Hosts:",
+    "workflow": [
+      "Öffnen Sie auf Host A das Netzwerkmenü → <em>Bandbreitentest (iperf3)</em> → wählen Sie <strong>Server</strong>.",
+      "Öffnen Sie auf Host B den gleichen Menüeintrag → Wählen Sie <strong>Client</strong> → Geben Sie die IP von Host A ein.",
+      "Warten Sie 10 Sekunden. Vergleichen Sie die gemeldete Rate mit dem theoretischen Maximum des Links."
+    ],
+    "sample": "Beispiel für die Client-Ausgabe:",
+    "flagsTitle": "Nützliche manuelle Flags (aus einer Shell ausgeführt)",
+    "flagsBody": "<code>-t 60</code> längerer Test (60 s statt 10 s), <code>-P 4</code> 4 parallele Datenströme (lastet schneller aus), <code>-R</code> umgekehrte Richtung (Server → Client), <code>-u -b 100M</code> UDP-Test mit 100 Mbit/s (für Jitter- und Paketverlustmessungen), <code>-p 5202</code> anderer Port (mehrere parallele Tests). Vollständige Liste unter <code>man iperf3</code>.",
+    "firewallTitle": "Öffnen Sie den Firewall-Port auf dem Server",
+    "firewallBody": "Der Server hört standardmäßig auf TCP <strong>5201</strong>. Wenn Sie den Server in einem Proxmox-Host mit einer strengen Firewall (Datacenter oder Host-Level) betreiben, erlauben Sie für die Dauer des Tests eingehende TCP 5201 von der IP des Clients und schließen Sie ihn erneut. Gleiches gilt für <code>nftables</code> / <code>iptables</code> auf bloßen Hosts."
+  },
+  "install": {
+    "heading": "Erster Start installiert das Paket",
+    "body": "Alle drei Starter prüfen, ob das Programm vorhanden ist, und führen bei Bedarf <code>apt-get update -qq &amp;&amp; apt-get install -y &lt;pkg&gt;</code> aus. Die Installation erfolgt ohne Ausgabe: Das Menü kann beim ersten Mal 10–30 Sekunden lang eingefroren wirken. Spätere Starts erfolgen sofort."
+  },
+  "troubleshoot": {
+    "heading": "Fehlerbehebung",
+    "hangTitle": "Die Installation hängt beim ersten Start endlos",
+    "hangBody": "Der Host hat kein Internet oder die Apt-Repos sind nicht erreichbar. Brechen Sie mit <kbd>Ctrl</kbd>+<kbd>C</kbd> ab, führen Sie <code>apt-get update</code> manuell aus, um den tatsächlichen Fehler anzuzeigen (DNS, Repo-Signatur, Proxy …), und kehren Sie dann zum Menü zurück.",
+    "refusedTitle": "iperf3-Client: „unable to connect to server: Connection refused“",
+    "refusedBody": "Entweder läuft der Server nicht oder seine Firewall blockiert TCP 5201. Prüfen Sie auf dem Server mit <code>ss -tlnp | grep 5201</code>, ob iperf3 lauscht. Lauscht es, aber der Client kann sich weiterhin nicht verbinden, prüfen Sie die Firewalls auf dem Weg zwischen beiden Hosts.",
+    "slowTitle": "iperf3 meldet deutlich weniger als die erwartete Verbindungsgeschwindigkeit",
+    "slowBody": "Häufige Ursachen nach Wahrscheinlichkeit: (1) Die CPU eines Hosts begrenzt den Durchsatz — versuchen Sie <code>iperf3 -c &lt;target&gt; -P 4</code> zur Nutzung mehrerer Kerne; (2) der Weg enthält eine langsamere Verbindung, etwa einen Gigabit-Switch zwischen zwei 10-GbE-Karten; (3) unterschiedliche MTU — prüfen Sie <code>ip link show</code> an beiden Enden; (4) deaktiviertes NIC-Offloading — siehe Community-Skript <em>Disable NIC Offloading</em> bei einer Intel-e1000e-Karte.",
+    "noTrafficTitle": "iftop / iptraf-ng zeigt keinen Traffic für einen beschäftigten Host an",
+    "noTrafficBody": "Die Standarderfassung erfolgt auf der ersten erkannten Schnittstelle. Geben Sie die richtige explizit aus der Shell an: <code>iftop -i vmbr0</code> oder <code>iptraf-ng -i vmbr0</code>. Der Menüstarter verwendet den Standard; für nicht standardmäßige Schnittstellen, laufen Sie von einer Konsole aus."
+  },
+  "related": {
+    "heading": "Verwandte Themen",
+    "items": [
+      {
+        "label": "Diagnose",
+        "href": "/docs/network/diagnostics",
+        "tail": " — die einmaligen, schreibgeschützten Prüfungen (Routing, Konnektivität, erweiterte Statistiken)."
+      },
+      {
+        "label": "Brückenanalyse und geführte Reparatur",
+        "href": "/docs/network/bridge-analysis",
+        "tail": "Wenn die Überwachung zeigt, dass eine Schnittstelle oder Brücke nicht das tut, was sie sollte."
+      }
+    ]
+  }
+}
diff --git a/web/messages/de/docs/network/persistent-names.json b/web/messages/de/docs/network/persistent-names.json
new file mode 100644
index 00000000..4c79b075
--- /dev/null
+++ b/web/messages/de/docs/network/persistent-names.json
@@ -0,0 +1,130 @@
+{
+  "meta": {
+    "title": "Persistente Schnittstellennamen | ProxMenux-Dokumentation",
+    "description": "Binden Sie Proxmox-Schnittstellennamen (eno1, enp3s0, …) über systemd-.link-Dateien an MAC-Adressen, damit sie bei neuer PCI-Nummerierung, Kernel-Upgrades und beim Hinzufügen oder Entfernen anderer Netzwerkkarten erhalten bleiben.",
+    "ogTitle": "Persistente Schnittstellennamen | ProxMenux-Dokumentation",
+    "ogDescription": "Verhindern Sie, dass sich Proxmox-Schnittstellennamen bei Hardwareänderungen ändern. Verwendet systemd-.link-Dateien mit Zuordnung über die MAC-Adresse."
+  },
+  "header": {
+    "title": "Persistente Schnittstellennamen",
+    "description": "Erstellt pro physischer Netzwerkkarte eine systemd-.link-Datei, die den vom Kernel vergebenen Namen an die MAC-Adresse der Karte bindet. Nach der Anwendung beim nächsten Neustart bleiben die Schnittstellennamen beim Hinzufügen, Entfernen oder Umstecken von PCIe-Karten stabil.",
+    "section": "Netzwerk"
+  },
+  "intro": {
+    "title": "Was das macht",
+    "body": "Schreibt für jede physische Netzwerkkarte des Hosts eine kleine Datei unter <code>/etc/systemd/network/10-&lt;iface&gt;.link</code> mit der Regel: <em>„Das Gerät mit dieser MAC-Adresse muss immer diesen Namen tragen.“</em> systemd-udevd wendet die Regel bei jedem Start an, bevor <code>ifupdown</code> die Datei <code>/etc/network/interfaces</code> liest."
+  },
+  "problem": {
+    "heading": "Das Problem, das dies löst",
+    "intro": "Linux leitet Standard-Schnittstellennamen aus der PCI-Topologie ab — <code>eno1</code> = onboard, <code>enp3s0</code> = die Karte in PCI-Bus 3, Steckplatz 0 usw. Das Namensschema ist deterministisch, <em>solange die Hardwareanordnung gleich bleibt</em>. Ändert sich die Anordnung, verschieben sich die Namen:",
+    "items": [
+      "Fügen Sie einen GPU vor einem vorhandenen NIC hinzu → die NIC-Busnummer kann sich ändern → Namensänderungen.",
+      "Bewegen Sie eine Karte in einen anderen PCIe-Slot → Namensänderungen.",
+      "BIOS / UEFI-Update, das Geräte erneut auflistet → Namen können sich ändern.",
+      "Ersetzen Sie eine fehlerhafte Karte durch das gleiche Modell in einem anderen Slot → Namensänderungen."
+    ],
+    "outro": "Nach einer solchen Änderung verweist <code>/etc/network/interfaces</code> weiterhin auf den <em>alten</em> Namen. Die Bridge lässt sich nicht aktivieren und der Host verliert die Netzwerkverbindung. Persistente Namen verhindern, dass dieses Szenario erneut auftritt."
+  },
+  "howWorks": {
+    "heading": "Wie es funktioniert",
+    "arrowLabel": "je NIC",
+    "nodes": {
+      "detectLabel": "Physische NIC erkennen",
+      "detectDetail": "ls /sys/class/net/\nvmbr / bond / docker / veth /\nwireguard … ausschließen",
+      "readLabel": "Jede MAC-Adresse lesen",
+      "readDetail": "cat /sys/class/net/\n  '<'iface'>'/address",
+      "writeLabel": ".link-Datei schreiben",
+      "writeDetail": "/etc/systemd/network/\n  10-'<'iface'>'.link"
+    },
+    "minimalIntro": "Jede generierte Datei ist absichtlich minimal:",
+    "minimalOutro": "Beim Start erkennt systemd-udevd das Gerät anhand der MAC-Adresse und weist den gewünschten Namen zu, <em>bevor</em> andere Komponenten wie ifupdown oder die Standardbenennung des Kernels darauf zugreifen. Das Dateipräfix <code>10-</code> sorgt dafür, dass diese Regeln früh und vor der Standarddatei <code>99-default.link</code> geladen werden."
+  },
+  "scope": {
+    "heading": "Was geschrieben wird, was übersprungen wird",
+    "headerType": "Typ",
+    "headerBehaviour": "Verhalten",
+    "headerWhy": "Warum",
+    "rows": [
+      {
+        "type": "Onboard-/PCIe-Netzwerkkarte",
+        "behaviour": "<code>.link</code> Datei geschrieben",
+        "why": "Unterstützt durch ein echtes PCI-Gerät - der Fall, für den das Tool geeignet ist"
+      },
+      {
+        "type": "Wi-Fi (phy80211)",
+        "behaviour": "<code>.link</code> Datei geschrieben",
+        "why": "Hat einen echten MAC und profitiert von Namensstabilität"
+      },
+      {
+        "type": "Brücken (vmbrX)",
+        "behaviour": "Übersprungen",
+        "why": "Virtuell; Name kommt von <code>/etc/network/interfaces</code>"
+      },
+      {
+        "type": "Bonds (bondX)",
+        "behaviour": "Übersprungen",
+        "why": "Virtuell; Bondname wird von ifupdown festgelegt"
+      },
+      {
+        "type": "veth / docker0 / br-XXXX",
+        "behaviour": "Übersprungen",
+        "why": "Erstellt auf Anfrage von Docker / LXC - keine persistente Hardware"
+      },
+      {
+        "type": "tap / fwpr / fwln",
+        "behaviour": "Übersprungen",
+        "why": "Erstellt auf Anfrage von Proxmox per VM/CT"
+      },
+      {
+        "type": "WireGuard / Cilium / Tailscale",
+        "behaviour": "Übersprungen",
+        "why": "Software-Schnittstellen, die von eigenen Daemons verwaltet werden"
+      }
+    ]
+  },
+  "safety": {
+    "heading": "Sicherheitsnetz: Frühere .link-Dateien werden gesichert",
+    "intro": "Wenn <code>/etc/systemd/network/</code> bereits <code>.link</code>-Dateien enthält (aus einem früheren Lauf oder anderen Tools), werden diese in ein Backup-Verzeichnis mit Zeitstempel kopiert, bevor die neuen generiert werden:",
+    "outro": "Zum Zurückrollen: Kopieren Sie die Dateien aus dem Backup-Verzeichnis zurück und starten Sie neu.",
+    "rebootTitle": "Effekt beim nächsten Neustart, nicht sofort",
+    "rebootBody": "Änderungen an <code>.link</code>-Dateien gelten nur beim Booten, wenn udev Geräte erneut auflistet. Das Tool meldet <em>\"Änderungen gelten nach dem Neustart\"</em> aus diesem Grund. Das Umbenennen einer Schnittstelle ist riskant und wird nicht versucht: Ein aktiver <code>vmbr0</code> mit Mitgliedern müsste atomar neu konfiguriert werden, weshalb die Operation auf den nächsten sauberen Boot verschoben wird."
+  },
+  "afterReboot": {
+    "heading": "Nach dem Reboot",
+    "intro": "Sobald die Namen angeheftet sind, ist der Workflow für zukünftige Hardwareänderungen einfach:",
+    "items": [
+      "Ausschalten, Hardware ändern (Karte hinzufügen, in einen anderen Steckplatz umstecken, …), starten.",
+      "Jedes NIC behält seinen vorherigen Namen, weil sein MAC mit einer <code>.link</code>-Datei übereinstimmt.",
+      "Wenn ein NIC ersetzt wird (anderer MAC), erhält er einen Standard-Kernelnamen (<code>enp&lt;bus&gt;s&lt;slot&gt;</code>); Führen Sie dieses Menü erneut aus, um einen <code>.link</code>-Eintrag für den MAC der neuen Karte hinzuzufügen."
+    ]
+  },
+  "troubleshoot": {
+    "heading": "Fehlerbehebung",
+    "emptyTitle": "\"Keine physischen Schnittstellen gefunden\" nach dem Ausführen des Tools",
+    "emptyBody": "Der Kernel erkennt auf dem Host keine auf PCI oder phy80211 basierenden Schnittstellen. Prüfen Sie mit <code>ls -l /sys/class/net/</code> — jeder Eintrag sollte entweder einen <code>device</code>-Symlink (PCI) oder einen <code>phy80211</code>-Eintrag (WLAN) haben. Fehlt bei einer echten Netzwerkkarte beides, ist der Treiber nicht geladen.",
+    "noChangeTitle": "Nach dem Neustart änderten sich die Namen nicht wie erwartet",
+    "noChangeBody": "Überprüfen Sie, ob die Datei vorhanden und gut geformt ist: <code>cat /etc/systemd/network/10-&lt;iface&gt;.link</code>. Dann überprüfen Sie udev logs: <code>journalctl -u systemd-udevd -b | grep -i link</code>. Eine häufige Ursache ist ein veralteter <code>net.ifnames=0</code>-Kernelparameter, der die vorhersagbare Benennung vollständig deaktiviert - entfernen Sie ihn aus <code>/etc/default/grub</code>, führen Sie <code>update-grub</code> aus, Neustart.",
+    "undoTitle": "Ich möchte persistente Benennung rückgängig machen",
+    "undoBody": "Löschen Sie entweder die <code>.link</code>-Dateien (<code>rm /etc/systemd/network/10-*.link</code>) oder stellen Sie sie aus dem beim vorherigen Durchlauf erstellten Backup-Verzeichnis wieder her. Starten Sie neu, um die Änderung anzuwenden."
+  },
+  "related": {
+    "heading": "Verwandte Themen",
+    "items": [
+      {
+        "label": "Brückenanalyse und geführte Reparatur",
+        "href": "/docs/network/bridge-analysis",
+        "tailRich": " — der Wiederherstellungsweg, wenn sich die Namen <em>bereits</em> geändert haben."
+      },
+      {
+        "label": "Konfigurationsanalyse und geführte Bereinigung",
+        "href": "/docs/network/config-analysis",
+        "tail": "- um verwaiste Blöcke zu entfernen, die durch Namensverschiebungen zurückgelassen wurden."
+      },
+      {
+        "label": "Diagnose",
+        "href": "/docs/network/diagnostics",
+        "tailRich": " — bestätigen Sie die neuen Namen nach dem Neustart mit <em>Routingtabelle anzeigen</em>."
+      }
+    ]
+  }
+}
diff --git a/web/messages/de/docs/oci-manager/architecture.json b/web/messages/de/docs/oci-manager/architecture.json
new file mode 100644
index 00000000..63cb18c1
--- /dev/null
+++ b/web/messages/de/docs/oci-manager/architecture.json
@@ -0,0 +1,171 @@
+{
+  "meta": {
+    "title": "So wird ein OCI-Image umgesetzt | ProxMenux",
+    "description": "Vom Image-Repository und der Compose-Datei über eine überprüfbare Vorlage und einen Bereitstellungsplan zu einem nativen LXC unter Proxmox VE – ohne Docker im Container."
+  },
+  "header": {
+    "title": "So wird ein OCI-Image umgesetzt",
+    "description": "Vom Image-Repository und der Compose-Datei über eine überprüfbare Vorlage und einen Bereitstellungsplan zu einem nativen LXC, ohne Docker darin zu installieren.",
+    "section": "OCI manager Apps"
+  },
+  "sections": [
+    {
+      "id": "pipeline",
+      "title": "Der Umsetzungsablauf",
+      "blocks": [
+        {
+          "mermaid": {
+            "chartCode": "flowchart LR\n A[\"{{repo}}\"] --> B[\"Compose + README\"]\n B --> C[\"{{converter}}\"]\n C --> D[\"{{template}}\"]\n D --> E{\"{{blockers}}\"}\n E -- \"{{no}}\" --> F[\"{{review}}\"]\n F --> D\n E -- \"{{yes}}\" --> G[\"{{plan}}\"]\n G --> H[\"pct create\"]\n H --> I[\"{{lxc}}\"]",
+            "labels": {
+              "repo": "Image-Repository",
+              "converter": "Konverter",
+              "template": "JSON-Vorlage",
+              "blockers": "Keine Hindernisse?",
+              "no": "Nein",
+              "yes": "Ja",
+              "review": "Prüfung / Overlay",
+              "plan": "Bereitstellungsplan",
+              "lxc": "Nativer LXC"
+            }
+          }
+        },
+        {
+          "p": "Der Konverter liest das vom Projekt veröffentlichte Image und die Compose-Datei und erzeugt eine JSON-Vorlage. Lassen sich Anforderungen noch nicht umsetzen und verhindern dadurch die Installation, wird die Vorlage vor der Veröffentlichung im Katalog geprüft. Eine Datei mit geprüften Anpassungen, das Overlay, löst diese Hindernisse. Nur Vorlagen ohne verbleibende Hindernisse werden zur Installation angeboten."
+        }
+      ]
+    },
+    {
+      "id": "template",
+      "title": "Was die Vorlage bewahrt",
+      "blocks": [
+        {
+          "cards": {
+            "items": [
+              {
+                "icon": "archive",
+                "title": "Image-Identität",
+                "body": "Repository, fortlaufend aktualisiertes Tag, Architektur, ermittelter Digest und Quellrevision."
+              },
+              {
+                "icon": "braces",
+                "title": "Container-Vertrag",
+                "body": "Entrypoint, Cmd, Umgebung, Benutzer, Arbeitsverzeichnis, Stoppsignal, Ports und Volumes."
+              },
+              {
+                "icon": "layers",
+                "title": "Umsetzung für Proxmox VE",
+                "body": "Ressourcen, Sicherheit, Mountpoints, Geräte, sysctls und Zustandsprüfungen sowie die jeweils nötigen Anpassungen mit ihrer Begründung."
+              },
+              {
+                "icon": "shield",
+                "title": "Kompatibilität",
+                "body": "Unterstützte Schlüssel, noch nicht umgesetzte Anforderungen, die die Installation verhindern, und der Status jeder Validierung."
+              }
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "sources",
+      "title": "OCI liefert den Prozess, Compose die Umgebung",
+      "blocks": [
+        {
+          "table": {
+            "headers": [
+              "Quelle",
+              "Beispiel",
+              "Natives Ergebnis"
+            ],
+            "rows": [
+              [
+                "OCI-Metadaten",
+                "<code>Entrypoint</code>, <code>Cmd</code>, <code>User</code>",
+                "Proxmox VE importiert sie beim Erstellen des CT"
+              ],
+              [
+                "Docker Compose",
+                "<code>environment</code>, <code>volumes</code>, <code>devices</code>",
+                "LXC-Umgebungseinträge, <code>mpN</code> und <code>devN</code>"
+              ],
+              [
+                "ProxMenux-Profil",
+                "GPU, Zustandsprüfung, Zugangsdaten",
+                "Rückfragen und geprüfte Anpassungen"
+              ],
+              [
+                "Benutzer",
+                "VMID, Speicher, Netzwerk",
+                "Der Instanzvertrag"
+              ]
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "install",
+      "title": "Was während der Installation passiert",
+      "blocks": [
+        {
+          "steps": {
+            "items": [
+              {
+                "title": "Referenz auflösen",
+                "body": "Die Registry wird abgefragt, die Architektur des Hosts ausgewählt und der konkrete Digest festgehalten, auf den das fortlaufend aktualisierte Tag verweist."
+              },
+              {
+                "title": "Herunterladen und prüfen",
+                "body": "Skopeo lädt das Image als OCI-Archiv herunter. Bevor etwas erstellt wird, wird jede Schicht anhand ihres Digests geprüft und entpackt. Ist der Download beschädigt, wird er einmal wiederholt, bevor die Installation abbricht."
+              },
+              {
+                "title": "Dateisystem erstellen",
+                "body": "<code>pct create</code> erstellt das rootfs aus dem Archiv und übernimmt die offiziellen Prozessmetadaten des Images."
+              },
+              {
+                "title": "Ressourcen anbinden",
+                "body": "Die deklarierten Volumes, Netzwerkeinstellungen, Umgebung, Geräte und Sicherheitsprofile werden eingebunden."
+              },
+              {
+                "title": "Konsole",
+                "body": "Die Konsolenausgabe des Containers wird auf dem Host gespeichert. Die Proxmox-VE-Konsole öffnet eine Shell, sofern das Image eine enthält."
+              },
+              {
+                "title": "Prüfen",
+                "body": "Beim ersten Start wird gewartet, bis der Container eine Adresse hat und der Dienst antwortet. Schlägt dies fehl, wird die Installation nicht als erfolgreich gemeldet."
+              },
+              {
+                "title": "Konfiguration erfassen",
+                "body": "Die tatsächlich verwendete Konfiguration wird im Instanzvertrag gespeichert, den Aktualisierungen und Neuerstellungen verwenden."
+              }
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "example",
+      "title": "Beispiel: ein Image mit /config und /downloads",
+      "intro": "Eine typische Compose-Definition und die daraus erzeugte Proxmox-VE-Konfiguration. Die von der Anwendung erwarteten Pfade bleiben unverändert.",
+      "blocks": [
+        {
+          "codeGrid": {
+            "items": [
+              {
+                "title": "Docker Compose",
+                "code": "image: lscr.io/linuxserver/example:latest\nenvironment:\n  - PUID=1000\n  - PGID=1000\nvolumes:\n  - config:/config\n  - /srv/downloads:/downloads\nports:\n  - 8080:8080"
+              },
+              {
+                "title": "/etc/pve/lxc/VMID.conf (Auszug)",
+                "code": "entrypoint: /init\nmp0: local-lvm:vm-VMID-disk-1,mp=/config,backup=1,size=8G\nmp1: /srv/downloads,mp=/downloads\nnet0: name=eth0,bridge=vmbr0,ip=dhcp,type=veth\nlxc.environment.runtime: PUID=1000\nlxc.environment.runtime: PGID=1000"
+              }
+            ]
+          }
+        },
+        {
+          "p": "<code>mp0</code> ist ein zweiter Datenträger des Containers, der im gewählten Speicher <code>vm-VMID-disk-N</code> heißt. Er wird unter <code>/config</code> eingehängt und mit <code>backup=1</code> in die Containersicherung aufgenommen. <code>mp1</code> erstellt keinen Datenträger, sondern bindet das Host-Verzeichnis <code>/srv/downloads</code> unter <code>/downloads</code> im LXC ein. Port 8080 wird nicht weitergeleitet: Der LXC hat eine eigene Adresse, unter der der Dienst antwortet."
+        }
+      ]
+    }
+  ]
+}
diff --git a/web/messages/de/docs/oci-manager/custom-image.json b/web/messages/de/docs/oci-manager/custom-image.json
new file mode 100644
index 00000000..225e88dd
--- /dev/null
+++ b/web/messages/de/docs/oci-manager/custom-image.json
@@ -0,0 +1,278 @@
+{
+  "meta": {
+    "title": "Image außerhalb des Katalogs installieren | ProxMenux",
+    "description": "Übernehmen Sie ein OCI-Image aus einer Compose-Datei, einer URL, einem docker run-Befehl oder einer Image-Referenz und prüfen Sie vor der Installation, welche Konfiguration ProxMenux umsetzen kann."
+  },
+  "header": {
+    "title": "Image außerhalb des Katalogs installieren",
+    "description": "Ein eigenes Image wird anhand seiner Compose-Datei, eines docker run-Befehls oder allein seiner Referenz für LXC umgesetzt. Das Ergebnis wird zur Prüfung angezeigt, bevor ein LXC erstellt wird.",
+    "section": "OCI manager Apps"
+  },
+  "sections": [
+    {
+      "id": "intro",
+      "blocks": [
+        {
+          "calloutInfo": {
+            "title": "Derselbe Konverter und Installer",
+            "body": "Die Option <strong>Image außerhalb des Katalogs installieren</strong> nutzt denselben Konverter und Installer wie die Katalogvorlagen. Der Unterschied: Der Vertrag wird erst in diesem Moment aus der angegebenen Definition erzeugt und vor dem Erstellen eines LXC validiert."
+          }
+        }
+      ]
+    },
+    {
+      "id": "sources",
+      "title": "Wie das Image beschrieben wird",
+      "intro": "Die erste Ansicht fragt, wie das Image beschrieben ist. Vier Möglichkeiten liefern eine Definition, die umgesetzt wird. Eine fünfte verwendet nur den Image-Namen. Drei weitere lesen eine bereits geschriebene oci-compose-Datei.",
+      "blocks": [
+        {
+          "table": {
+            "headers": [
+              "Option",
+              "Was eingelesen wird"
+            ],
+            "rows": [
+              [
+                "Compose-Datei im Terminal einfügen",
+                "Fügen Sie den YAML-Inhalt im Terminal ein und schließen Sie mit Ctrl+D ab."
+              ],
+              [
+                "Compose-Datei auf diesem Host lesen",
+                "Ein Pfad auf dem Knoten, standardmäßig <code>/root/docker-compose.yml</code>. Die Datei muss existieren und darf höchstens 256 KiB groß sein."
+              ],
+              [
+                "Compose-Datei von einer Adresse herunterladen",
+                "Eine <code>http://</code>- oder <code>https://</code>-Adresse, die den unverarbeiteten YAML-Inhalt bereitstellt. Es werden höchstens 256 KiB heruntergeladen."
+              ],
+              [
+                "docker run-Befehl im Terminal einfügen",
+                "Der vom Projekt veröffentlichte Befehl. Ports, Umgebung, Volumes, Geräte, Capabilities, Benutzer, gemeinsam genutzter Speicher und die weiteren unterstützten Optionen werden umgesetzt."
+              ],
+              [
+                "Nur die Image-Referenz, ohne Compose-Datei",
+                "Eine Referenz wie <code>ghcr.io/user/application:latest</code>. Die Registry wird abgefragt und die OCI-Metadaten des Images werden übernommen."
+              ],
+              [
+                "oci-compose im Terminal einfügen",
+                "Fügen Sie den JSON-Inhalt im Terminal ein und schließen Sie mit Ctrl+D ab. Er wird nicht konvertiert, sondern geprüft und so installiert, wie er geschrieben ist."
+              ],
+              [
+                "oci-compose-Datei auf diesem Host lesen",
+                "Eine JSON-Datei auf dem Knoten, standardmäßig <code>/root/oci-compose.json</code>, mit höchstens 2 MiB."
+              ],
+              [
+                "oci-compose von einer Adresse herunterladen",
+                "Eine <code>http://</code>- oder <code>https://</code>-Adresse, die die JSON-Datei bereitstellt. Es werden höchstens 2 MiB heruntergeladen."
+              ]
+            ]
+          }
+        },
+        {
+          "figure": {
+            "src": "/oci-manager/custom-source-menu.png",
+            "alt": "Menü zur Auswahl der Beschreibung eines Images außerhalb des Katalogs",
+            "caption": "Möglichkeiten zur Beschreibung eines Images außerhalb des Katalogs."
+          }
+        }
+      ]
+    },
+    {
+      "id": "reference-only",
+      "title": "Was die Image-Referenz allein liefert",
+      "intro": "Das Image enthält seine Prozessmetadaten, aber nicht die gesamte Umgebung, die eine Compose-Datei gewöhnlich ergänzt.",
+      "blocks": [
+        {
+          "table": {
+            "headers": [
+              "Aus dem Image gelesen",
+              "Nicht im Image enthalten",
+              "Folge"
+            ],
+            "rows": [
+              [
+                "<code>Entrypoint</code>, <code>Cmd</code>, <code>User</code>, <code>WorkingDir</code> und die enthaltene Umgebung",
+                "Variablen, die nur in der Dokumentation stehen",
+                "Werden bei der Installation oder über Ändern ergänzt"
+              ],
+              [
+                "Vom Image deklarierte Volumes",
+                "Host-Verzeichnisse, die nur in der Compose-Datei angegeben sind",
+                "Weitere Pfade werden vor der Installation ergänzt"
+              ],
+              [
+                "<code>EXPOSE</code>-Ports",
+                "URL, Protokoll oder funktionale Zustandsprüfung",
+                "Port und Prüfverfahren des Dienstes werden bestätigt"
+              ],
+              [
+                "Architekturen und Digest in der Registry",
+                "Geräte, Privilegien oder externe Abhängigkeiten",
+                "Ohne eine entsprechende Anforderung in der Definition werden sie nicht aktiviert"
+              ]
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "review",
+      "title": "Vor der Installation prüfen",
+      "intro": "Nach dem Umsetzen der Definition zeigt ProxMenux seine Interpretation, bevor VMID, Ressourcen oder Speicher abgefragt werden.",
+      "blocks": [
+        {
+          "steps": {
+            "items": [
+              {
+                "title": "Analysieren",
+                "body": "Dienste, Image, Ports, Pfade, Umgebung, Geräte, Sicherheit und Zustandsprüfung werden eingelesen."
+              },
+              {
+                "title": "Registry abfragen",
+                "body": "Das Image muss in seiner Registry vorhanden sein; die veröffentlichten Architekturen werden aufgelistet. Bei einer privaten Registry wird das dafür gespeicherte Konto verwendet."
+              },
+              {
+                "title": "Nicht angewendete Optionen auflisten",
+                "body": "Labels, Docker-Netzwerke, Swarm-Einstellungen und andere Schlüssel ohne Wirkung in einem LXC werden aufgelistet."
+              },
+              {
+                "title": "Optionen ohne sichere Entsprechung blockieren",
+                "body": "Schlüssel ohne sichere Entsprechung erscheinen unter <strong>Nicht umsetzbare Optionen</strong>; die Installation wird dann nicht fortgesetzt. Nichts wird stillschweigend verworfen."
+              },
+              {
+                "title": "Geheime Werte abfragen",
+                "body": "Variablen, deren Namen auf Passwort, Token oder Schlüssel hinweisen, werden bei der Installation als sensible Werte abgefragt."
+              }
+            ]
+          }
+        },
+        {
+          "figure": {
+            "src": "/oci-manager/custom-review.png",
+            "alt": "Zusammenfassung der Interpretation einer Compose-Datei durch ProxMenux",
+            "caption": "Zusammenfassung, die vor der Abfrage von VMID und Ressourcen erscheint."
+          }
+        },
+        {
+          "p": "Nach Bestätigung der Zusammenfassung folgt derselbe Ablauf wie im Katalog: Name, Standard- oder erweiterter Modus, VMID, CPU, Arbeitsspeicher, Netzwerk, Start mit dem Knoten, persistente und zusätzliche Pfade, kompatible Geräte und abschließende Zusammenfassung."
+        }
+      ]
+    },
+    {
+      "id": "examples",
+      "title": "Eingabebeispiele",
+      "blocks": [
+        {
+          "codeGrid": {
+            "items": [
+              {
+                "title": "Compose",
+                "code": "services:\n  app:\n    image: ghcr.io/example/app:latest\n    ports:\n      - \"8080:8080\"\n    volumes:\n      - ./config:/config\n      - /srv/media:/media\n    environment:\n      TZ: Europe/Madrid"
+              },
+              {
+                "title": "docker run",
+                "code": "docker run -d \\\n  --name app \\\n  -p 8080:8080 \\\n  -e TZ=Europe/Madrid \\\n  -v app-config:/config \\\n  -v /srv/media:/media \\\n  ghcr.io/example/app:latest"
+              }
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "oci-compose",
+      "title": "Eine von Hand geschriebene oci-compose-Datei",
+      "intro": "oci-compose ist die JSON-Datei, aus der eine Anwendung installiert wird. Der Katalog enthält eine solche Datei pro Anwendung. Dasselbe Format kann von Hand geschrieben und über diese Option installiert werden.",
+      "blocks": [
+        {
+          "p": "Bei einer handgeschriebenen Datei legt der Autor Image, Ports, Variablen, Volumes und Installationsfragen fest. ProxMenux ergänzt den Rest beim Einlesen. Das Format kann Dinge ausdrücken, die Compose nicht enthält: Fragetexte, bei der Installation erzeugte Passwörter, GPU-Profile, Eigentümer einzelner Volumes, die Prüfung des ersten Starts und abschließend angezeigte Zugangsdaten."
+        },
+        {
+          "steps": {
+            "items": [
+              {
+                "title": "Prüfen",
+                "body": "Dateien mit Fehlern werden nicht installiert. Jeder Fehler nennt das betroffene Feld. Bei ungültigem JSON werden Zeile und Spalte angegeben."
+              },
+              {
+                "title": "Überprüfen",
+                "body": "Eine gültige Datei zeigt, was sie installiert: Image, Webadresse, Ports, persistente Pfade, abgefragte Variablen und geschriebene Dateien."
+              },
+              {
+                "title": "Installieren",
+                "body": "Die Installation erfolgt wie bei jeder Kataloganwendung mit Standard- oder erweiterten Einstellungen."
+              }
+            ]
+          }
+        },
+        {
+          "calloutWarning": {
+            "title": "Eine Datei, die Privilegien festlegt",
+            "body": "oci-compose legt fest, was im Container eingehängt wird und mit welchen Privilegien. Die Prüfung zeigt dies vor der Installation. Installieren Sie nur Dateien aus vertrauenswürdigen Quellen."
+          }
+        },
+        {
+          "p": "Die <readmeLink>README der OCI-Engine</readmeLink> beschreibt das Format Block für Block und enthält zwei vollständige Beispiele. Auch ein Installationsdatensatz kann so eingelesen werden: Verwendet wird nur die ursprüngliche Vorlage, keine der damaligen Antworten."
+        }
+      ]
+    },
+    {
+      "id": "private-registries",
+      "title": "Images aus privaten Registries",
+      "intro": "Ein Image aus einer privaten Registry, etwa ein privates GitHub-Paket oder ein privates Docker-Hub-Repository, wird mit einem in ProxMenux gespeicherten Konto gelesen.",
+      "blocks": [
+        {
+          "steps": {
+            "items": [
+              {
+                "title": "Die Registry verweigert den Image-Zugriff",
+                "body": "Meldet die Registry, dass ein Konto benötigt wird, bietet die Prüfung eine Anmeldung an und liest das Image danach erneut."
+              },
+              {
+                "title": "Anmelden",
+                "body": "Benutzername und Passwort oder Zugriffstoken mit Download-Berechtigung. Die Registry prüft sie; gespeichert werden sie nur bei erfolgreicher Anmeldung."
+              },
+              {
+                "title": "Installieren und aktuell halten",
+                "body": "Dieses Konto wird beim Herunterladen während der Installation und ebenso für Aktualisieren, Ändern, Neuerstellen, Watchdog und die Update-Prüfung des Monitors verwendet – auf jedem Cluster-Knoten."
+              }
+            ]
+          }
+        },
+        {
+          "p": "<strong>Registry-Konten</strong> im Hauptmenü von OCI manager Apps zeigt gespeicherte Konten nach Registry und Benutzer, niemals ihre geheimen Zugangsdaten. Pro Konto können Images geprüft, heruntergeladen oder installiert sowie Zugangsdaten aktualisiert oder entfernt werden."
+        },
+        {
+          "list": {
+            "items": [
+              "GitHub (<code>ghcr.io</code>): Als Benutzer dient das GitHub-Konto, als Passwort ein persönliches Zugriffstoken mit <code>read:packages</code>-Berechtigung.",
+              "Docker Hub (<code>docker.io</code>): Als Benutzer dient das Docker-Hub-Konto, als Passwort ein Zugriffstoken mit Leseberechtigung.",
+              "Andere Registries, auch mit eigenem Port wie <code>registry.example.com:5000</code>: Benutzername und Passwort oder Token dieser Registry."
+            ]
+          }
+        },
+        {
+          "calloutInfo": {
+            "title": "Wo die Konten gespeichert werden",
+            "body": "Unter <code>/etc/pve/priv/proxmenux/registry-auth.json</code>, nur für root lesbar, im selben Ordner wie die Speicherpasswörter von Proxmox. <code>/etc/pve</code> wird von allen Cluster-Knoten gemeinsam genutzt. Ein auf einem Knoten hinzugefügtes Konto gilt daher auf allen. Die Host-Sicherung enthält die Datei; die Deinstallation von ProxMenux entfernt sie auf allen Knoten."
+          }
+        }
+      ]
+    },
+    {
+      "id": "limits",
+      "title": "Nicht installierbare Definitionen",
+      "blocks": [
+        {
+          "list": {
+            "items": [
+              "Ein Dockerfile ohne veröffentlichtes Image: Das Image muss zuerst gebaut und in einer OCI-Registry veröffentlicht werden.",
+              "Eine Compose-Datei mit mehreren Diensten: Diese Option installiert jeweils einen Dienst in einem Container, auch wenn mehrere Dienste dasselbe Image verwenden.",
+              "<code>configs</code>, externe Geheimnisse oder Geräteformate, die sich nicht eindeutig umsetzen lassen.",
+              "Shell-Ersetzungen wie <code>$(command)</code>: Stattdessen muss der resultierende Wert angegeben werden.",
+              "Nicht erkannte <code>docker run</code>-Optionen und <code>--env-file</code>: Verwenden Sie stattdessen eine Compose-Datei mit expliziten Werten."
+            ]
+          }
+        }
+      ]
+    }
+  ]
+}
diff --git a/web/messages/de/docs/oci-manager/hardware.json b/web/messages/de/docs/oci-manager/hardware.json
new file mode 100644
index 00000000..6f07b1aa
--- /dev/null
+++ b/web/messages/de/docs/oci-manager/hardware.json
@@ -0,0 +1,392 @@
+{
+  "meta": {
+    "title": "Geräte und Beschleunigung | ProxMenux",
+    "description": "Wie OCI manager Apps GPU, NVIDIA, Coral, USB, FUSE und weitere Geräte als geprüfte native Proxmox-VE-Ressourcen für einen OCI-Container bereitstellt."
+  },
+  "header": {
+    "title": "Geräte und Beschleunigung",
+    "description": "GPU, NVIDIA, Coral, USB, FUSE und Blockgeräte werden validierte native Proxmox VE-Ressourcen des Containers.",
+    "section": "OCI manager Apps"
+  },
+  "sections": [
+    {
+      "id": "principle",
+      "title": "Das Gerät, das die Anwendung benötigt, nicht der gesamte Host",
+      "blocks": [
+        {
+          "p": "Ein in der Compose-Datei oder im Anwendungsprofil angefordertes Gerät wird als konkreter <code>devN</code>-Eintrag oder LXC-Mount eingerichtet. Das Anfordern einer GPU, eines USB-Geräts oder eines Coral-Beschleunigers macht den Container nicht privilegiert."
+        },
+        {
+          "flow": {
+            "nodes": [
+              {
+                "label": "Host-Inventar",
+                "detail": "/dev/dri/renderD128\nGID 993 · Intel"
+              },
+              {
+                "label": "ProxMenux",
+                "detail": "Hersteller und\nBerechtigungen geprüft"
+              },
+              {
+                "label": "LXC",
+                "detail": "dasselbe Gerät\neffektive GID"
+              }
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "origin",
+      "title": "Woher die Geräteanforderung kommt",
+      "blocks": [
+        {
+          "table": {
+            "headers": [
+              "Quelle",
+              "Was gelesen wird",
+              "Was der Installateur macht"
+            ],
+            "rows": [
+              [
+                "Docker Compose",
+                "<code>devices</code>, <code>group_add</code>, <code>deploy.resources</code> und NVIDIA Anforderungen",
+                "Jede Anforderung wird zu einer Geräteanforderung, die zur Überprüfung angezeigt wird"
+              ],
+              [
+                "Katalogprofil",
+                "Die tatsächliche GPU-, Coral-, OpenCL-, USB- oder FUSE-Unterstützung der Anwendung",
+                "Es werden nur die für dieses Image validierten Optionen angeboten"
+              ],
+              [
+                "Bildmetadaten und Dokumentation",
+                "VA-API, Selkies, LinuxServer Mods oder die NVIDIA Laufzeit",
+                "Die dokumentierten Variablen und die Vorbereitung werden hinzugefügt"
+              ],
+              [
+                "Auswahl der Nutzer",
+                "Nur CPU, Intel/AMD, OpenCL, NVIDIA oder ein optionales Gerät",
+                "Die Auswahl wird im Instanzvertrag gespeichert"
+              ]
+            ]
+          }
+        },
+        {
+          "calloutWarning": {
+            "title": "Erkannte Geräte werden nicht automatisch eingebunden",
+            "body": "Der Host wird inventarisiert, aber nur Geräte, die in der Compose-Datei oder in einem kompatiblen Profil deklariert sind, werden angeboten und angehängt. Ein GPU, USB-Dongle oder Coral auf dem Host ist nicht jedem LXC ausgesetzt."
+          }
+        }
+      ]
+    },
+    {
+      "id": "identify",
+      "title": "Wie das Host-Gerät identifiziert wird",
+      "intro": "Bevor der LXC geändert wird, wird das Gerät auf dem Host gelesen und mit dem gewählten Profil verglichen.",
+      "blocks": [
+        {
+          "table": {
+            "headers": [
+              "Typ",
+              "Identität",
+              "Validierung"
+            ],
+            "rows": [
+              [
+                "Intel/AMD DRM",
+                "<code>/dev/dri/renderD*</code> und <code>/sys/class/drm/NODE/device/vendor</code>",
+                "Ein Zeichengerät mit dem Anbieter <code>0x8086</code> (Intel) oder <code>0x1002</code> (AMD)"
+              ],
+              [
+                "AMD OpenCL",
+                "Der Render-Knoten plus <code>/dev/kfd</code>, wenn das Profil es benötigt",
+                "Existenz, Typ, Anbieter, Berechtigungen und deklarierte Kompatibilität"
+              ],
+              [
+                "AMD ROCm",
+                "Der Renderknoten, <code>/dev/kfd</code> und die Generation, die der Compute-Treiber in <code>/sys/class/kfd/kfd/topology/nodes/*/properties</code> meldet",
+                "Eine GPU-Generation, für die das ROCm-Image der Anwendung passende Rechenkernel enthält — die dort genannten RDNA2-GPUs und neuere — wird unverändert angeboten. Andere GPUs dieser Familien, etwa Radeon 680M und 780M, werden als experimentell angeboten und nie vorausgewählt: ROCm unterstützt sie nicht offiziell, die Anwendung meldet sie als Generation ihrer Familie (<code>HSA_OVERRIDE_GFX_VERSION</code>), und vor dem Download des größeren Images ist eine Bestätigung erforderlich. Ältere GPUs, etwa die integrierte Grafik eines Ryzen 5000U, werden nicht angeboten; Immich führt die Erkennung weiter auf der CPU aus."
+              ],
+              [
+                "NVIDIA",
+                "<code>nvidia-smi</code> und <code>nvidia-container-cli</code>",
+                "GPU, UUID, PCI-Bus, Treiberversion, Toolkit, <code>/dev/nvidia*</code>-Knoten, Binärdateien und Bibliotheken"
+              ],
+              [
+                "Coral PCIe/M.2",
+                "<code>/dev/apex_N</code> und sein Link in <code>/sys/dev/char/MAJOR:MINOR</code>",
+                "Zeichengeräteknoten, Major-/Minor-Nummern, Eigentümer, GID und Berechtigungen"
+              ],
+              [
+                "USB und serielle",
+                "<code>/dev/ttyUSB*</code>, <code>/dev/ttyACM*</code> oder <code>/dev/bus/usb/BBB/DDD</code>",
+                "Zeichenknoten; für USB auch Anbieter, Produkt und Seriennummer, wenn sysfs sie veröffentlicht"
+              ],
+              [
+                "KVM, TUN, FUSE, Video und generische SCSI",
+                "<code>/dev/kvm</code>, <code>/dev/net/tun</code>, <code>/dev/fuse</code>, <code>/dev/videoN</code> oder <code>/dev/sgN</code>",
+                "Unterstützter Pfad, Knotentyp und effektive Berechtigungen"
+              ],
+              [
+                "Optisches Laufwerk",
+                "<code>/dev/srN</code>",
+                "Ein Blockgerät"
+              ]
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "install",
+      "title": "Was passiert während der Installation",
+      "blocks": [
+        {
+          "steps": {
+            "items": [
+              {
+                "title": "Das Template bietet seine Profile",
+                "body": "Nur CPU, Intel/AMD VA-API, AMD OpenCL, Intel OpenCL oder NVIDIA. Die Optionen gehören zum Image, nicht zu einem gemeinsamen Menü."
+              },
+              {
+                "title": "Ein Profil wird gewählt",
+                "body": "Es definiert die Geräteknoten, die Umgebung, die Mods oder die Laufzeit, die die Anwendung benötigt."
+              },
+              {
+                "title": "Ein Pfad wird vorgeschlagen",
+                "body": "Für DRM <code>/dev/dri/renderD128</code>, das auf einem Host mit mehreren Renderknoten geändert werden kann. Für USB oder seriell wird der konkrete Knoten ausgewählt."
+              },
+              {
+                "title": "Validierung",
+                "body": "Existenz, Typ, erlaubter Anbieter, Berechtigungen und GID werden überprüft. Eine Abweichung stoppt die Operation."
+              },
+              {
+                "title": "Der Vertrag ist geschrieben",
+                "body": "Pfad, Modus, GID, Schreibzugriff und Profil werden für Updates und Neuerstellungen aufgezeichnet."
+              },
+              {
+                "title": "Einbinden und testen",
+                "body": "<code>pct set</code> fügt den <code>devN</code>-Eintrag hinzu und der Zugriff wird dann im LXC überprüft. LinuxServer-Images werden auch als Benutzer <code>abc</code> überprüft."
+              }
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "config",
+      "title": "Wie es in der LXC-Konfiguration erscheint",
+      "intro": "Beispiele: <code>dev0</code> und <code>dev1</code> sind die freien Slots, die Proxmox VE zuweist, und <code>renderD128</code>, <code>apex_0</code> und die GID hängen von der Hardware des Knotens ab.",
+      "blocks": [
+        {
+          "codeGrid": {
+            "items": [
+              {
+                "title": "Intel/AMD VA-API",
+                "code": "dev0: path=/dev/dri/renderD128,mode=0660,gid=993,deny-write=0"
+              },
+              {
+                "title": "Coral PCIe/M.2",
+                "code": "dev0: path=/dev/apex_0,mode=0660,gid=GID,deny-write=0"
+              },
+              {
+                "title": "Ein spezifisches USB-Gerät",
+                "code": "dev0: path=/dev/bus/usb/003/004,mode=0660,gid=GID,deny-write=0"
+              },
+              {
+                "title": "AMD OpenCL",
+                "code": "dev0: path=/dev/dri/renderD128,mode=0660,gid=GID,deny-write=0\ndev1: path=/dev/kfd,mode=0660,gid=GID,deny-write=0"
+              }
+            ]
+          }
+        },
+        {
+          "p": "Die GID wird mit <code>stat</code> auf dem Host gelesen und in den <code>devN</code>-Eintrag geschrieben; es wird nicht angenommen, dass die Gruppen <code>render</code> und <code>video</code> eine feste Nummer haben. Das Gerät behält den gleichen <code>/dev</code>-Pfad innerhalb des LXC, wo die anwendungseigenen Mechanismen danach suchen."
+        }
+      ]
+    },
+    {
+      "id": "profiles",
+      "title": "Profile, die ein Image bieten kann",
+      "blocks": [
+        {
+          "table": {
+            "headers": [
+              "Profil",
+              "Umsetzung",
+              "Angeboten, wenn"
+            ],
+            "rows": [
+              [
+                "Intel/AMD VA-API",
+                "<code>/dev/dri</code> Renderknoten",
+                "Die Anwendung unterstützt Videobeschleunigung"
+              ],
+              [
+                "OpenCL",
+                "Renderknoten, <code>/dev/kfd</code> bei Bedarf und der offizielle Mod",
+                "Das Image oder Profil dokumentiert es"
+              ],
+              [
+                "NVIDIA",
+                "Treibergeräte und Bibliotheken des Hosts",
+                "Der Host hat einen funktionierenden Treiber und das NVIDIA Container Toolkit"
+              ],
+              [
+                "Coral",
+                "<code>/dev/apex_0</code> oder USB-Bus",
+                "Das Profil erklärt Coral-Unterstützung (Frigate)"
+              ],
+              [
+                "USB, seriell, FUSE",
+                "Ein einzelnes Gerät, ein validierter Baum oder eine LXC-Funktion",
+                "Der Vertrag verlangt es"
+              ]
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "nvidia",
+      "title": "NVIDIA",
+      "blocks": [
+        {
+          "calloutWarning": {
+            "title": "Voraussetzung auf dem Knoten: NVIDIA Container Toolkit",
+            "body": "Ein funktionierender Treiber auf Proxmox VE reicht nicht aus, um einem OCI-Image eine NVIDIA-GPU zu geben. OCI Manager Apps verwendet <code>nvidia-container-cli</code> aus dem NVIDIA Container Toolkit, um die Geräte zu identifizieren und die Binärdateien und Bibliotheken zu erhalten, die dem geladenen Treiber entsprechen."
+          }
+        },
+        {
+          "p": "<nvidiaLink>ProxMenux NVIDIA installer</nvidiaLink> installiert das NVIDIA Container Toolkit aus dem offiziellen NVIDIA-Repository zusammen mit dem Treiber. Es überprüft seine vier Pakete, validiert <code>nvidia-container-cli</code> und zeichnet das Ergebnis im Change Journal von <auditLink>Audit & Report</auditLink> auf."
+        },
+        {
+          "p": "Diese beiden Befehle auf dem Host zeigen an, ob der Treiber und das Toolkit verfügbar sind:"
+        },
+        {
+          "shell": {
+            "code": "nvidia-smi -L\nnvidia-container-cli --version"
+          }
+        },
+        {
+          "p": "Auf einem Host, auf dem der Treiber auf andere Weise installiert wurde, wird das Toolkit aus dem offiziellen stabilen Repository installiert:"
+        },
+        {
+          "shell": {
+            "code": "apt-get update\napt-get install -y --no-install-recommends ca-certificates curl gnupg2\n\ncurl -fsSL https://nvidia.github.io/libnvidia-container/gpgkey \\\n  | gpg --dearmor -o /usr/share/keyrings/nvidia-container-toolkit-keyring.gpg\n\ncurl -s -L https://nvidia.github.io/libnvidia-container/stable/deb/nvidia-container-toolkit.list \\\n  | sed 's#deb https://#deb [signed-by=/usr/share/keyrings/nvidia-container-toolkit-keyring.gpg] https://#g' \\\n  > /etc/apt/sources.list.d/nvidia-container-toolkit.list\n\napt-get update\napt-get install -y nvidia-container-toolkit libnvidia-container-tools"
+          }
+        },
+        {
+          "p": "Das von OCI manager Apps verwendete Inventar stammt aus der Ausgabe von:"
+        },
+        {
+          "shell": {
+            "code": "nvidia-container-cli list --device all --libraries --binaries --firmwares --ipcs"
+          }
+        },
+        {
+          "calloutInfo": {
+            "title": "Docker Laufzeitkonfiguration ist nicht beteiligt",
+            "body": "Die Container sind native LXCs ohne Docker-Daemon. Daher spielt <code>nvidia-ctk runtime configure --runtime=docker</code> keine Rolle: ProxMenux fragt <code>nvidia-container-cli</code> direkt ab und trägt Geräte und Mounts in die LXC-Konfiguration ein. Die aktuellen Befehle und unterstützten Plattformen stehen in der <toolkitLink>Installationsanleitung zum NVIDIA Container Toolkit</toolkitLink>."
+          }
+        },
+        {
+          "cards": {
+            "items": [
+              {
+                "icon": "cpu",
+                "title": "Inventar aus dem Treiber",
+                "body": "<code>nvidia-container-cli</code> listet Geräteknoten, Binärdateien, Firmware und Bibliotheken des installierten Treibers auf."
+              },
+              {
+                "icon": "refresh",
+                "title": "Keine feste Version",
+                "body": "Die Vorlage nennt keine Bibliotheksdateien. Das Profil wird vom aktuellen Host generiert."
+              },
+              {
+                "icon": "shield",
+                "title": "Nur lesbare Mounts",
+                "body": "Die Hostbibliotheken werden schreibgeschützt montiert, anstatt in den Container kopiert zu werden."
+              },
+              {
+                "icon": "hardDrive",
+                "title": "Treiberänderungen",
+                "body": "Nach einem Treiberwechsel wird das Inventar erneut generiert, bevor die betroffenen LXCs starten."
+              }
+            ]
+          }
+        },
+        {
+          "code": {
+            "title": "NVIDIA Ergebnis (vereinfacht)",
+            "code": "devN: path=/dev/nvidia0,...\ndevN: path=/dev/nvidiactl,...\ndevN: path=/dev/nvidia-uvm,...\nlxc.mount.entry: HOST_LIBRARY CONTAINER_LIBRARY none ro,bind,create=file 0 0"
+          }
+        },
+        {
+          "p": "Nur <code>/dev/nvidia0</code> zu übergeben ist nicht genug. Die Benutzerraumkomponenten des geladenen Treibers werden schreibgeschützt montiert, und <code>nvidia-smi</code> läuft dann innerhalb des LXC, um GPU, UUID, PCI-Bus und Version mit dem Host-Inventar zu vergleichen."
+        }
+      ]
+    },
+    {
+      "id": "usb",
+      "title": "USB, serielle und USB Coral",
+      "blocks": [
+        {
+          "calloutWarning": {
+            "title": "USB-Nummerierung kann sich ändern",
+            "body": "Ein Pfad wie <code>/dev/bus/usb/003/004</code> kann sich ändern, wenn das Gerät wieder angeschlossen wird oder der Host neu gestartet wird. Das Profil zeichnet Anbieter, Produkt und Seriennummer auf, wenn sie verfügbar sind, aber eine neue Busadresse wird nicht automatisch neu zugeordnet."
+          }
+        },
+        {
+          "p": "Ein Peripheriegerät wird durch seinen konkreten Knoten angegeben: <code>/dev/ttyUSB0</code>, <code>/dev/ttyACM0</code>, <code>/dev/apex_0</code> oder <code>/dev/bus/usb/BBB/DDD</code>. Die Weitergabe des gesamten <code>/dev</code> wird nicht akzeptiert. Coral wird nur Anwendungen angeboten, deren Profil es deklariert."
+        }
+      ]
+    },
+    {
+      "id": "trees",
+      "title": "Gerätebäume und LXC-Funktionen",
+      "blocks": [
+        {
+          "table": {
+            "headers": [
+              "Anforderung",
+              "Umsetzung",
+              "Umfang"
+            ],
+            "rows": [
+              [
+                "<code>/dev/dvb</code>, <code>/dev/snd</code> oder <code>/dev/bus/usb</code>",
+                "Jeder Zeichenknoten des Baumes erhält seinen eigenen <code>devN</code>-Eintrag mit dem Host-Modus und GID",
+                "Nur der angeforderte Baum, nicht der Rest von <code>/dev</code>"
+              ],
+              [
+                "<code>/dev/fuse</code>",
+                "Der Knoten und, wenn das Profil es benötigt, die <code>fuse=1</code>-Funktion",
+                "FUSE allein veröffentlicht keine Mounts für andere LXCs"
+              ],
+              [
+                "<code>/dev/net/tun</code>",
+                "Ein <code>devN</code>-Eintrag auf demselben Pfad innerhalb des LXC",
+                "Die VPN- oder Netzwerkkonfiguration bleibt in der Anwendung"
+              ],
+              [
+                "<code>/dev/kvm</code>",
+                "Ein validierter <code>devN</code>-Eintrag",
+                "Angeboten nur, wenn der Vertrag es verlangt"
+              ]
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "security",
+      "title": "Bestätigungen nach Risikograd",
+      "blocks": [
+        {
+          "p": "Konkrete Geräte, optionale Privilegien, erforderliche Privilegien, AppArmor- oder seccomp-Entspannung und der Zugriff auf den Host-PID-Namespace werden als separate Fälle behandelt, nicht unter einem generischen privilegierten Label. Jede Option mit einem Risiko wird während der Installation erklärt und bestätigt."
+        }
+      ]
+    }
+  ]
+}
diff --git a/web/messages/de/docs/oci-manager/index.json b/web/messages/de/docs/oci-manager/index.json
new file mode 100644
index 00000000..c46433f7
--- /dev/null
+++ b/web/messages/de/docs/oci-manager/index.json
@@ -0,0 +1,213 @@
+{
+  "meta": {
+    "title": "OCI manager Apps | ProxMenux",
+    "description": "Führen Sie offizielle OCI-Images als native LXC-Container unter Proxmox VE aus – mit persistenten Daten, Gerätezugriff, Anwendungen aus mehreren Containern und transaktionalen Aktualisierungen."
+  },
+  "header": {
+    "title": "OCI manager Apps",
+    "description": "Offizielle OCI-Images laufen als native LXC-Container unter Proxmox VE. Das vom Maintainer veröffentlichte Image bleibt unverändert; ProxMenux bildet die Umgebung nach, die Docker Compose dafür eingerichtet hätte.",
+    "section": "OCI manager Apps"
+  },
+  "sections": [
+    {
+      "id": "model",
+      "blocks": [
+        {
+          "calloutInfo": {
+            "title": "Ein OCI-Image, ein nativer LXC",
+            "body": "In den Containern läuft keine Docker Engine. Proxmox VE importiert das Dateisystem und die OCI-Metadaten des Images. Die Anwendung wird zum Hauptprozess eines nativen LXC und lässt sich mit denselben Werkzeugen verwalten wie andere Container auf dem Knoten."
+          }
+        },
+        {
+          "flow": {
+            "nodes": [
+              {
+                "label": "Quelle",
+                "detail": "OCI-Image\nCompose und Dokumentation"
+              },
+              {
+                "label": "ProxMenux",
+                "detail": "JSON-Vertrag\nValidierung und Planung"
+              },
+              {
+                "label": "Proxmox VE",
+                "detail": "Nativer LXC\nVolumes und Geräte"
+              }
+            ],
+            "caption": "Die Anwendung wird nicht neu gebaut. Ihre Umgebung wird deklarativ beschrieben und nachgebildet."
+          }
+        }
+      ]
+    },
+    {
+      "id": "where",
+      "title": "Wo Sie es finden",
+      "intro": "Öffnen Sie auf dem Proxmox-Knoten als root den Eintrag <strong>OCI manager Apps (Technology Preview)</strong> im ProxMenux-Hauptmenü. Die erste Ansicht bietet:",
+      "blocks": [
+        {
+          "list": {
+            "items": [
+              "<strong>Anwendungen suchen</strong> – den gesamten Katalog nach Namen durchsuchen.",
+              "<strong>Alle Anwendungen</strong> – den vollständigen Katalog samt Anzahl der Anwendungen anzeigen.",
+              "<strong>Installierte OCI-Anwendungen verwalten</strong> – vorhandene Installationen aktualisieren, ändern, entfernen oder wiederherstellen.",
+              "<strong>Registry-Konten</strong> – Konten zum Installieren und Aktualisieren von Images aus privaten Registries verwalten.",
+              "<strong>Image außerhalb des Katalogs installieren</strong> – eine Compose-Datei, einen <code>docker run</code>-Befehl oder eine Image-Referenz übernehmen und anpassen.",
+              "Die Kategorien des Katalogs, jeweils mit der Anzahl ihrer Anwendungen."
+            ]
+          }
+        },
+        {
+          "figure": {
+            "src": "/oci-manager/main-menu.png",
+            "alt": "Hauptansicht von OCI manager Apps mit Suche, Gesamtkatalog, Anwendungsverwaltung, eigenen Images und Katalogkategorien.",
+            "caption": "Hauptansicht von OCI manager Apps."
+          }
+        },
+        {
+          "p": "Nach der Auswahl einer Anwendung sehen Sie deren Beschreibung, das verwendete Image und zwei Installationsarten. <strong>Mit Standardeinstellungen installieren</strong> fragt nur die grundlegenden Entscheidungen ab: Speicher, Datenablage, Adresse und Start. <strong>Mit erweiterten Einstellungen installieren</strong> führt nacheinander durch alle Optionen: VMID und Ressourcen, Speicher für jeden Pfad, Netzwerk-Bridge und Geräte."
+        },
+        {
+          "p": "Tatsächlich getestete Anwendungen zeigen in dieser Ansicht <strong>Geprüft</strong> und sind in den Listen mit ✓ gekennzeichnet. Das gilt für Tests im ProxMenux-Labor ebenso wie für Tests durch die Community."
+        }
+      ]
+    },
+    {
+      "id": "beta",
+      "title": "Warum es als Technology Preview gekennzeichnet ist",
+      "blocks": [
+        {
+          "p": "OCI manager Apps verwendet die Bezeichnung <strong>Technology Preview</strong>, die Proxmox VE den aus OCI-Images erstellten Anwendungscontainern zuweist. Deren Unterstützung wurde mit Proxmox VE 9.1 eingeführt. Die Bezeichnung betrifft die zugrunde liegende Proxmox-Technik, nicht die ProxMenux-Engine: Das Verhalten dieser Container kann sich zwischen Proxmox-VE-Versionen noch ändern. Die Kennzeichnung bleibt bestehen, bis Proxmox VE diese Unterstützung als stabil einstuft."
+        },
+        {
+          "p": "Die Funktionen von OCI manager Apps werden im ProxMenux-Labor getestet: Installation, Aktualisierung, Änderung, Neuerstellung, Sicherung, Wiederherstellung, Migration und Watchdog. Jede Anwendung wird separat geprüft. Tatsächlich getestete Anwendungen tragen die Kennzeichnung <strong>Geprüft</strong> und ein ✓ in den Listen."
+        }
+      ]
+    },
+    {
+      "id": "translation",
+      "title": "Wie Docker Anforderungen beschreibt und OCI manager Apps sie umsetzt",
+      "blocks": [
+        {
+          "table": {
+            "headers": [
+              "Anforderung",
+              "Darstellung in Docker",
+              "Umsetzung durch OCI manager Apps"
+            ],
+            "rows": [
+              [
+                "Anwendung ausführen",
+                "<code>image</code>, <code>entrypoint</code>, <code>command</code>",
+                "OCI-rootfs und Hauptprozess des LXC"
+              ],
+              [
+                "Konfiguration erhalten",
+                "<code>volumes: /config</code>",
+                "Ein persistentes <code>mpN</code>-Volume, das in die Sicherung aufgenommen wird, oder ein Verzeichnis auf dem Host."
+              ],
+              [
+                "Dienst bereitstellen",
+                "<code>ports</code>",
+                "Eine eigene Adresse für den LXC und die Zugriffs-URL des Dienstes."
+              ],
+              [
+                "Hardware verwenden",
+                "<code>devices</code>, <code>group_add</code>",
+                "<code>devN</code>-Einträge mit der tatsächlich verwendeten Gruppen-ID (GID) des Hosts und einem validierten Profil."
+              ],
+              [
+                "Abhängigkeiten verbinden",
+                "<code>networks</code>, <code>depends_on</code>",
+                "Eine private Netzwerk-Bridge, feste Adressen, Startreihenfolge und Zustandsprüfungen."
+              ],
+              [
+                "Aktualisieren",
+                "Mit <code>pull</code> herunterladen und neu erstellen",
+                "Ein neues rootfs mit demselben Persistenzvertrag."
+              ]
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "kept",
+      "title": "Was erhalten bleibt und was sich ändert",
+      "blocks": [
+        {
+          "cards": {
+            "items": [
+              {
+                "icon": "archive",
+                "title": "Bleibt erhalten",
+                "body": "Das offizielle Image, seine internen Pfade, seine Umgebung, sein Startprozess und seine Nutzungsdokumentation."
+              },
+              {
+                "icon": "boxes",
+                "title": "Wird angepasst",
+                "body": "Die Laufzeitumgebung: Netzwerk, Persistenz, Geräte, Berechtigungen und Abhängigkeiten werden mit den nativen LXC-Funktionen von Proxmox VE umgesetzt."
+              },
+              {
+                "icon": "shield",
+                "title": "Ohne Entsprechung",
+                "body": "Eine Compose-Option ohne sichere Entsprechung wird als Installationshindernis aufgeführt. Vorlagen mit solchen Hindernissen werden nicht zur Installation angeboten. Sensible Optionen müssen während der Installation bestätigt werden."
+              },
+              {
+                "icon": "refresh",
+                "title": "Wird gespeichert",
+                "body": "Image-Digest, Ressourcen, Pfade, Netzwerk, Geräte und Zugehörigkeit zu einem Stack werden im Instanzvertrag gespeichert. Aktualisierungen und Neuerstellungen bilden diesen Vertrag wieder ab."
+              }
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "pages",
+      "title": "Seiten in diesem Abschnitt",
+      "blocks": [
+        {
+          "next": {
+            "items": [
+              {
+                "label": "So wird ein OCI-Image umgesetzt",
+                "href": "/docs/oci-manager/architecture",
+                "tail": "Vom Image und seiner Compose-Datei zu einem nativen LXC."
+              },
+              {
+                "label": "Image außerhalb des Katalogs installieren",
+                "href": "/docs/oci-manager/custom-image",
+                "tail": "Compose-Datei, docker run oder eine Image-Referenz."
+              },
+              {
+                "label": "Daten, Pfade und Netzwerk",
+                "href": "/docs/oci-manager/storage-network",
+                "tail": "Container-Volumes, Host-Verzeichnisse, rclone-Mounts und Adressen."
+              },
+              {
+                "label": "Geräte und Beschleunigung",
+                "href": "/docs/oci-manager/hardware",
+                "tail": "GPU, NVIDIA, Coral, USB und weitere Geräte."
+              },
+              {
+                "label": "Anwendungen mit mehreren Containern",
+                "href": "/docs/oci-manager/stacks",
+                "tail": "Anwendung, Datenbank und Cache als koordinierte LXCs."
+              },
+              {
+                "label": "Installieren, aktualisieren und ändern",
+                "href": "/docs/oci-manager/lifecycle",
+                "tail": "Der Instanzvertrag und seine Vorgänge."
+              },
+              {
+                "label": "In ProxMenux Monitor",
+                "href": "/docs/oci-manager/monitor",
+                "tail": "Versionen, Aktualisierungen, Konsolenausgabe und Terminal."
+              }
+            ]
+          }
+        }
+      ]
+    }
+  ]
+}
diff --git a/web/messages/de/docs/oci-manager/lifecycle.json b/web/messages/de/docs/oci-manager/lifecycle.json
new file mode 100644
index 00000000..7fb24421
--- /dev/null
+++ b/web/messages/de/docs/oci-manager/lifecycle.json
@@ -0,0 +1,499 @@
+{
+  "meta": {
+    "title": "Installieren, Aktualisieren und Ändern | ProxMenux",
+    "description": "Der Instanzvertrag eines OCI-Containers und die darauf beruhenden Vorgänge: Aktualisieren, Ändern, Entfernen, Fortsetzen eines unterbrochenen Vorgangs und Wiederherstellen des Betriebs nach einer Wiederherstellung auf diesem oder einem anderen Host."
+  },
+  "header": {
+    "title": "Installation, Aktualisierung und Änderung",
+    "description": "Jede Instanz behält einen reproduzierbaren Vertrag, sodass ihr rootfs ersetzt werden kann, ohne Konfiguration oder persistente Daten zu verlieren.",
+    "section": "OCI manager Apps"
+  },
+  "sections": [
+    {
+      "id": "contract",
+      "title": "Der Instanzvertrag",
+      "blocks": [
+        {
+          "p": "Nach einer Installation wird die effektive Konfiguration in <code>/usr/local/share/proxmenux/oci/instances/VMID/oci-compose.json</code> gespeichert. Es ist keine Kopie der ursprünglichen Compose-Datei: Es ist der reproduzierbare Vertrag des LXC, der auf diesem Host existiert."
+        },
+        {
+          "code": {
+            "code": "instances/\n└── 105/\n    └── oci-compose.json\n        ├── image and resolved digest\n        ├── resources and network\n        ├── environment (secrets protected)\n        ├── container disks and host directories\n        ├── hardware profile and devices\n        ├── console log and terminal mode\n        └── stack membership and lifecycle"
+          }
+        },
+        {
+          "p": "Eine Kopie des Vertrags liegt im Container unter <code>/.proxmenux/oci-record.json</code> und ist nur für dessen Benutzer root lesbar. Eine Containersicherung enthält daher immer den zu diesem Zeitpunkt gültigen Vertrag. Eine zweite Kopie liegt unter <code>/etc/pve/priv/proxmenux/oci</code>; dieses Verzeichnis ist auf allen Clusterknoten verfügbar und nur für root des Hosts lesbar. Beide Kopien werden nach jeder Installation, Aktualisierung und Änderung geschrieben."
+        }
+      ]
+    },
+    {
+      "id": "manage",
+      "title": "Verwalten installierter OCI-Anwendungen",
+      "intro": "Diese Option auf dem Hauptbildschirm listet die registrierten Instanzen mit ihrer Anwendung und ihrem Image auf. Vor jeder Aktion wird jede Instanz mit ihrem Vertrag abgeglichen; ein CT, der nicht mehr zu seinem Datensatz passt, wird weder geändert noch gelöscht. Dieselbe Aktualisierungsfunktion und derselbe Editor stehen auf der Registerkarte Aktualisierungen von <monitorLink>ProxMenux Monitor</monitorLink> bereit.",
+      "blocks": [
+        {
+          "table": {
+            "headers": [
+              "Option",
+              "Was sich ändert",
+              "Was erhalten bleibt"
+            ],
+            "rows": [
+              [
+                "Aktualisieren Sie das Image mit der gespeicherten Konfiguration",
+                "Das rootfs wird durch das Image ersetzt, das der gespeicherte Kanal aktuell bereitstellt",
+                "Vertrag, Containerplatten, Hostverzeichnisse, Netzwerk und Geräte"
+              ],
+              [
+                "Ändern: Ressourcen, Netzwerk, Pfade und GPU bearbeiten",
+                "Der Editor öffnet sich mit dem aktuellen Vertrag; der CT wird mit den Änderungen neu erstellt",
+                "Die Daten von Container-Disks und Host-Verzeichnissen"
+              ],
+              [
+                "Watchdog: Neustart der Anwendung, wenn sie abstürzt",
+                "Ob die Anwendung nach einem selbstständigen Beenden erneut gestartet wird. Es wird nichts neu erstellt",
+                "Die gesamte Installation; nur die Wahl ist im Vertrag gespeichert"
+              ],
+              [
+                "Entfernen: Löschen Sie die Anwendung und ihre Container",
+                "Der LXC oder jedes Mitglied eines Stacks und seine Verträge werden gelöscht",
+                "Host-Verzeichnisse mit ihren Inhalten"
+              ]
+            ]
+          }
+        },
+        {
+          "p": "Für eine Anwendung mit mehreren Containern bietet das Menü <strong>Alle Container der Anwendung aktualisieren</strong>, <strong>Zusätzliche Pfade und Geräte ändern</strong>, <strong>Alle Container mit ihrer gespeicherten Konfiguration neu erstellen</strong>, den Watchdog und die Entfernung. Ändern fügt die zusätzlichen Pfade und Geräte des Anwendungscontainers hinzu oder entfernt sie, ohne etwas neu zu erstellen. Bei Immich lässt sich damit auch ändern, womit die Erkennung ausgeführt wird. Neu erstellen erstellt jeden Container anhand des ursprünglich installierten Images neu, ohne nach einem neueren zu suchen."
+        },
+        {
+          "figure": {
+            "src": "/oci-manager/manage-menu.png",
+            "alt": "Liste der installierten OCI-Anwendungen und der Optionen zum Aktualisieren, Ändern und Entfernen",
+            "caption": "Verwalten Sie installierte OCI-Anwendungen."
+          }
+        }
+      ]
+    },
+    {
+      "id": "update",
+      "title": "Transaktionsaktualisierung",
+      "blocks": [
+        {
+          "mermaid": {
+            "chartCode": "sequenceDiagram\n participant U as {{user}}\n participant P as ProxMenux\n participant R as {{registry}}\n participant X as Proxmox VE\n U->>P: {{update}}\n P->>R: {{resolve}}\n R-->>P: digest\n P->>P: {{verify}}\n P->>X: {{backup}}\n P->>X: {{import}}\n P->>X: {{reapply}}\n X-->>P: healthcheck\n alt {{healthy}}\n  P-->>U: {{commit}}\n else {{failure}}\n  P->>X: Rollback\n  P-->>U: {{restored}}\n end",
+            "labels": {
+              "user": "Benutzer",
+              "registry": "OCI-Register",
+              "update": "Instanz aktualisieren",
+              "resolve": "Tag auflösen",
+              "verify": "Archiv prüfen und Vorabprüfungen durchführen",
+              "backup": "Stoppen und sichern Sie den CT",
+              "import": "Neues rootfs importieren",
+              "reapply": "Den Vertrag erneut anwenden",
+              "healthy": "in Ordnung",
+              "failure": "Ausfall",
+              "commit": "Vertrag mit dem neuen Digest veröffentlicht",
+              "restored": "Frühere Instanz wiederhergestellt"
+            }
+          }
+        },
+        {
+          "list": {
+            "items": [
+              "Wenn die Registry weiterhin den installierten Digest bedient, wird nichts heruntergeladen und die Instanz nicht berührt.",
+              "Das neue Image wird Schicht für Schicht verifiziert, bevor der CT stoppt. Ein Download, der beschädigt ankommt, wird ein zweites Mal abgerufen; ein bereits zwischengespeichertes Image, das den Check nicht besteht, wird erneut heruntergeladen.",
+              "Nach der Installation in Proxmox VE geänderte Einstellungen (Arbeitsspeicher, Swap, Kerne, CPU-Limit, CPU-Priorität, Start mit dem Knoten) bleiben erhalten und werden in den neuen Vertrag übernommen.",
+              "Die LAN-Schnittstelle, die die Arr-Suite und Multi-Container-Anwendungen hinzufügen (<code>net1</code>) und die Startreihenfolge (<code>startup</code>) werden an den neuen Container zurückgegeben.",
+              "Jeder andere Unterschied zwischen dem CT und seinem Vertrag stoppt das Update, bevor der CT gestoppt wird."
+            ]
+          }
+        },
+        {
+          "flow": {
+            "nodes": [
+              {
+                "label": "Vorher",
+                "detail": "rootfs A\n/config mp0\n/media Hostverzeichnis"
+              },
+              {
+                "label": "Aktualisierung",
+                "detail": "ersetzt nur\ndas rootfs"
+              },
+              {
+                "label": "Nachher",
+                "detail": "rootfs B\n/config mp0\n/media Hostverzeichnis"
+              }
+            ]
+          }
+        },
+        {
+          "p": "Bevor etwas gestoppt wird, prüft der Vorgang, ob ausreichend Platz für die Sicherung vorhanden ist: die belegten Daten der zu sichernden Volumes plus eine Reserve. Die Sicherung wird neben dem Anwendungsdatensatz auf dem Systemlaufwerk des Hosts gespeichert. Reicht der Platz dort nicht aus, fragt das Menü nach einem anderen Host-Speicher, der Sicherungen unterstützt. Dort wird die Sicherung erstellt und nach Abschluss des Vorgangs gelöscht. Die Auswahl wird für diese Anwendung auch für geplante Aktualisierungen gespeichert. Hat kein Speicher ausreichend Platz, wird der Vorgang abgelehnt und die Anwendung bleibt unverändert. Der Platzbedarf des neuen Images wird vor dem Herunterladen ebenso geprüft."
+        }
+      ]
+    },
+    {
+      "id": "recovery",
+      "title": "Wiederherstellung eines unterbrochenen Vorgangs",
+      "intro": "Ein Update und eine Änderung verwenden eine persistente Transaktion. Wenn der Prozess, das Terminal oder der Knoten nach dem Stoppen des CT unterbrochen wird, wird die Operation nicht als abgeschlossen angesehen.",
+      "blocks": [
+        {
+          "steps": {
+            "items": [
+              {
+                "title": "Ausstehender Marker",
+                "body": "Beim Öffnen von „Installierte OCI-Anwendungen verwalten“ zeigt der gespeicherte Zustand, dass der Ersatz nie veröffentlicht wurde."
+              },
+              {
+                "title": "Status anzeigen",
+                "body": "Zeigt die Phase an, die erreicht wurde, ohne Container oder Daten zu ändern."
+              },
+              {
+                "title": "Wiederherstellen der vorherigen Installation",
+                "body": "Stellt die vor dem Ersatz erstellte und geprüfte native Sicherung sowie den vorherigen Vertrag wieder her."
+              },
+              {
+                "title": "Stacks als Einheit",
+                "body": "Für eine Multi-Container-Anwendung wird jedes Mitglied aus dem gleichen Transaktionspunkt wiederhergestellt, nicht nur das ausgewählte."
+              }
+            ]
+          }
+        },
+        {
+          "calloutWarning": {
+            "title": "Host-Verzeichnisse liegen außerhalb des Rollbacks",
+            "body": "Die Sicherung umfasst das rootfs und die darin eingeschlossenen Containerlaufwerke. Ein Hostverzeichnis wird nicht zurückgesetzt, da andere LXCs dessen Daten verwenden können."
+          }
+        }
+      ]
+    },
+    {
+      "id": "watchdog",
+      "title": "Watchdog: Neustart einer Anwendung, die stoppt",
+      "intro": "Proxmox hat keine Neustartrichtlinie: Wenn der Prozess eines Anwendungscontainers endet, bleibt der Container gestoppt. Mit dem Watchdog wird eine Anwendung, die von selbst aufhört, erneut gestartet. Es tut für eine OCI-Anwendung, was <code>restart: unless-stopped</code> in einer Compose-Datei tut.",
+      "blocks": [
+        {
+          "table": {
+            "headers": [
+              "Was passiert",
+              "Mit aktiviertem Watchdog"
+            ],
+            "rows": [
+              [
+                "Die Anwendung stürzt ab oder ihr Prozess endet",
+                "Der Container wird innerhalb von Sekunden wieder gestartet"
+              ],
+              [
+                "Es wird von Proxmox, vom Monitor oder mit <code>pct</code> gestoppt oder heruntergefahren",
+                "Er bleibt gestoppt, bis ihn jemand startet"
+              ],
+              [
+                "Ein Backup, eine Migration oder eine ProxMenux-Operation arbeitet daran",
+                "Nichts wird getan, bis das endet"
+              ],
+              [
+                "Er war beim Start des Hosts bereits gestoppt",
+                "Er bleibt gestoppt; dafür ist <strong>Mit Proxmox starten</strong> zuständig"
+              ],
+              [
+                "Es stoppt direkt nach dem Start",
+                "Bei einer Anwendung, die Sekunden nach dem Start wieder stoppt oder gar nicht startet, werden fünf Startversuche unternommen. Dazwischen liegen Wartezeiten von 30 Sekunden, 1, 2 und 5 Minuten. Danach bleibt sie gestoppt und eine Benachrichtigung wird gesendet"
+              ]
+            ]
+          }
+        },
+        {
+          "p": "Das Installationsprogramm fragt in beiden Installationsmodi danach und schlägt den im Anwendungsrezept angegebenen Wert vor. Später lässt sich die Einstellung unter <strong>Installierte OCI-Anwendungen verwalten</strong> oder mit dem Schalter <strong>Watchdog</strong> des Containers in <monitorLink>ProxMenux Monitor</monitorLink> ändern. Sie gilt für alle Container einer Anwendung mit mehreren Containern. Ein einziger Host-Dienst, <code>proxmenux-oci-watchdog.service</code>, überwacht alle Anwendungen, für die dies aktiviert wurde; seine Installation erscheint auf der Registerkarte Änderungen von Audit & Report."
+        },
+        {
+          "calloutInfo": {
+            "title": "Was der Host nicht sagen kann",
+            "body": "Der Exit-Code der Anwendung erreicht den Host nicht. Daher sind ein reguläres Beenden und ein Absturz nicht unterscheidbar; in beiden Fällen wird neu gestartet, wie bei <code>always</code> und <code>unless-stopped</code> in Docker. Ein außerhalb von Proxmox mit <code>lxc-stop</code> oder <code>systemctl</code> angeforderter Stopp hinterlässt keinen Stopp-Task und wird als selbstständiges Beenden gewertet."
+          }
+        }
+      ]
+    },
+    {
+      "id": "restore",
+      "title": "Backup, Wiederherstellung und ein weiterer Host",
+      "intro": "Eine mit vzdump oder Proxmox Backup Server erstellte Sicherung enthält den Container, die für die Sicherung ausgewählten Containerlaufwerke und die Kopie seines Vertrags. Was die Installation auf dem Host speichert, ist nicht darin enthalten. <strong>Installierte OCI-Anwendungen verwalten</strong> erkennt Container, die auf einem Host ohne ihren Vertrag wiederhergestellt wurden, etwa nach einer Proxmox-Neuinstallation oder auf einem anderen Host, und bietet ihre erneute Registrierung an.",
+      "blocks": [
+        {
+          "steps": {
+            "items": [
+              {
+                "title": "Wiederherstellen der Container in Proxmox",
+                "body": "Vom Sicherungsspeicher, mit der ursprünglichen ID oder einer beliebigen freien ID. Bei einer Anwendung mit mehreren Containern werden alle ihre Container benötigt."
+              },
+              {
+                "title": "Installierte OCI-Anwendungen verwalten öffnen",
+                "body": "Die wiederhergestellten Container werden aufgelistet und die Wiederherstellung ihrer Registrierung wird angeboten. Die Schaltfläche <strong>Wiederherstellen</strong> auf der Registerkarte Aktualisierungen von <monitorLink>ProxMenux Monitor</monitorLink> öffnet denselben Vorgang."
+              },
+              {
+                "title": "Überprüfen Sie vor dem Wechsel",
+                "body": "Die Wiederherstellung überprüft, ob der Host alles hat, was jede Anwendung benötigt. Eine Anwendung, die nicht als Ganzes wiederhergestellt werden kann, bleibt so, wie sie gefunden wurde, mit dem Grund."
+              },
+              {
+                "title": "Registrieren und starten",
+                "body": "Der Vertrag wird auf diesem Host registriert und was die Installation darauf aufbewahrt, wird erneut geschrieben. Das Starten der Anwendungen ist eine separate Frage, die mit Nein beantwortet wird, wenn die ursprünglichen Container noch auf einem anderen Host ausgeführt werden."
+              }
+            ]
+          }
+        },
+        {
+          "figure": {
+            "src": "/oci-manager/restore-offer.png",
+            "alt": "Dialog, der die wiederhergestellten Container auflistet und anbietet, sie wiederherzustellen",
+            "caption": "Die beim Öffnen von „Installierte OCI-Anwendungen verwalten“ angebotene Wiederherstellung."
+          }
+        },
+        {
+          "table": {
+            "headers": [
+              "Was der Host behalten hat",
+              "Nach der Wiederherstellung"
+            ],
+            "rows": [
+              [
+                "Instanzvertrag",
+                "Wird aus der Kopie im Container registriert und mit der von Proxmox wiederhergestellten Konfiguration abgeglichen"
+              ],
+              [
+                "Privates Netzwerk einer Multicontainer-Anwendung",
+                "Wird mit derselben Bridge und demselben Subnetz neu erstellt; die festen Adressen der Container ändern sich nicht"
+              ],
+              [
+                "Startreihenfolge einer Anwendung mit mehreren Containern",
+                "Das Abhängigkeits-Hookscript und sein Vertrag werden wieder installiert; Snippets sind auf dem <code>local</code>-Speicher aktiviert, wenn kein Speicher sie akzeptiert"
+              ],
+              [
+                "Netzwerk sysctls und Host-Monitor-Datei",
+                "Nochmals geschrieben in <code>/etc/pve/proxmenux</code>"
+              ],
+              [
+                "NVIDIA Laufzeit",
+                "Der Hook eines unprivilegierten Containers wird erneut installiert. Ein privilegierter Container erhält die Treiberdateien dieses Hosts statt der Dateien seines ursprünglichen Hosts"
+              ],
+              [
+                "Rclone mount",
+                "Das Hookscript und die Programme, die das Mount veröffentlichen, werden erneut geschrieben, mit den gleichen Ansichten auf dem Host"
+              ],
+              [
+                "Host-Firewallregel eines Host-Monitors",
+                "Wird erneut abgefragt, für seinen Web-Port und das Subnetz der Bridge auf diesem Host"
+              ],
+              [
+                "<code>lost+found</code> jeder wiederhergestellten Festplatte",
+                "Wird entfernt, wenn es leer ist; bei einer Wiederherstellung wird es angelegt, und manche Anwendungen starten nicht, wenn es in ihrem Datenverzeichnis liegt"
+              ],
+              [
+                "Disks auf einem anderen Speicher wiederhergestellt",
+                "Der Vertrag wird auf den Speicher aktualisiert, auf dem sie sich jetzt befinden"
+              ]
+            ]
+          }
+        },
+        {
+          "p": "Ein mit einer anderen ID wiederhergestellter Container behält seine Anwendung. Der Vertrag, sein Konsolenprotokoll, seine Netzwerk-sysctls, das Hookscript einer Rclone-Einhängung und die Startreihenfolge einer Anwendung mit mehreren Containern werden mit den IDs registriert, die die Container auf diesem Host haben."
+        },
+        {
+          "table": {
+            "headers": [
+              "Was eine Wiederherstellung verhindert",
+              "Was zu tun ist"
+            ],
+            "rows": [
+              [
+                "Ein Container einer Multicontainer-Anwendung fehlt",
+                "Stellen Sie es auch wieder her; Die Anwendung wird als Ganzes wiederhergestellt"
+              ],
+              [
+                "Das private Subnetz wird bereits auf diesem Host verwendet",
+                "Die Wiederherstellung wird abgebrochen und nichts wird geändert: Die Adressen der Container sind fixiert und werden nicht in ein anderes Subnetz verschoben"
+              ],
+              [
+                "Ein Hostverzeichnis existiert nicht",
+                "Mounten oder erstellen Sie es mit seinen Daten; ein Backup des Containers enthält keine Hostverzeichnisse"
+              ],
+              [
+                "Ein Gerät existiert nicht auf diesem Host",
+                "Verbinden Sie es oder entfernen Sie es aus dem Container in Proxmox"
+              ],
+              [
+                "Eine Anwendung mit NVIDIA auf einem Host ohne Treiber",
+                "Installieren Sie den NVIDIA-Treiber und das Container Toolkit"
+              ],
+              [
+                "Das Backup wurde erstellt, bevor die Kopie des Vertrages existierte",
+                "Der Container bleibt als gewöhnlicher LXC und wird nicht wieder angeboten"
+              ]
+            ]
+          }
+        },
+        {
+          "calloutInfo": {
+            "title": "Ein Container, der zurückkommt",
+            "body": "Ein Container, der von einem älteren Backup wiederhergestellt, zu einem Snapshot zurückgerollt oder von einem anderen Knoten zurückgegeben wurde, trägt den Vertrag des Zustands, in dem er sich befindet. Wenn es für eine Operation ausgewählt wird und sein Vertrag von dem dieses Hosts abweicht, startet die Operation nicht und der Container wird zur Wiederherstellung angeboten."
+          }
+        },
+        {
+          "figure": {
+            "src": "/oci-manager/restore-result.png",
+            "alt": "Ergebnis der Wiederherstellung mit privatem Netzwerk, Startreihenfolge und registrierten Containern",
+            "caption": "Das Ergebnis einer Wiederherstellung, Schritt für Schritt."
+          }
+        }
+      ]
+    },
+    {
+      "id": "remove",
+      "title": "Entfernen einer OCI-Anwendung",
+      "blocks": [
+        {
+          "p": "Vor der Bestätigung wird eine Zusammenfassung aus der tatsächlichen Konfiguration erstellt: die zu entfernenden Container, die damit gelöschten Daten, das freigegebene private Netzwerk und die erhaltenen Hostverzeichnisse. Die Bestätigung steht standardmäßig auf <strong>Nein</strong>, da die Daten gelöschter Laufwerke anschließend nicht wiederhergestellt werden können."
+        },
+        {
+          "table": {
+            "headers": [
+              "Ressource",
+              "Beim Entfernen",
+              "Grund"
+            ],
+            "rows": [
+              [
+                "rootfs und Container-Festplatten",
+                "Gelöscht",
+                "Sie gehören nur zum Container"
+              ],
+              [
+                "Hostverzeichnis",
+                "Bleibt mit seinem Inhalt erhalten",
+                "Andere Anwendungen können es verwenden"
+              ],
+              [
+                "Host-Dateien des Containers",
+                "Gelöscht",
+                "Sein Konsolenprotokoll, Netzwerk-Sysctls, Rclone Mount Hookscript und seine Registrierung in der App-Registerkarte von ProxMenux Monitor dienen keinem anderen Container"
+              ],
+              [
+                "Von mehreren Installationen gemeinsam genutzte Dateien",
+                "Gelöscht mit der letzten Installation, die sie verwendet",
+                "Die Host-Monitor-Datei und das Dependency-Hookscript von Multi-Container-Anwendungen"
+              ],
+              [
+                "Instanzvertrag",
+                "Nach erfolgreicher Entfernung gelöscht",
+                "Kein CT ist mehr damit verbunden"
+              ],
+              [
+                "Private Bridge eines Stacks",
+                "Mit dem Stack freigegeben",
+                "Es sind keine Mitglieder mehr zu verbinden"
+              ],
+              [
+                "Von der Arr-Suite gemeinsam genutztes Netzwerk",
+                "Wird beim Entfernen der letzten Anwendung der Suite freigegeben",
+                "Jede Anwendung der Suite ist unabhängig und wird einzeln entfernt"
+              ],
+              [
+                "Ein einzelnes Mitglied eines Stapels",
+                "Wird nicht einzeln entfernt",
+                "Die gesamte Anwendung wird entfernt, so dass kein Stapel unvollständig bleibt"
+              ],
+              [
+                "Ein Container auf einem anderen Knoten des Clusters",
+                "Nicht entfernt",
+                "Seine Datensatz- und Hostdateien befinden sich auf dem Knoten, auf dem es installiert wurde: Es wird dort entfernt, nachdem es zurück migriert wurde."
+              ]
+            ]
+          }
+        },
+        {
+          "figure": {
+            "src": "/oci-manager/remove-summary.png",
+            "alt": "Zusammenfassung zum Entfernen mit den betroffenen Containern, Daten und Hostverzeichnissen",
+            "caption": "Die Entfernungszusammenfassung, aufgebaut aus der realen Konfiguration."
+          }
+        }
+      ]
+    },
+    {
+      "id": "archives",
+      "title": "Heruntergeladene Images und Speicherplatz auf dem Host",
+      "blocks": [
+        {
+          "p": "Das OCI-Archiv dient zum Erstellen des rootfs; der laufende CT liest es nicht. Nach einer Installation oder Aktualisierung werden die dabei heruntergeladenen Archive mit ihrer Größe aufgelistet und zur Löschung angeboten. Ihre Löschung gibt Speicherplatz frei, ohne den Container oder seine Daten zu beeinträchtigen."
+        },
+        {
+          "calloutInfo": {
+            "title": "Updates benötigen das Archiv nicht",
+            "body": "Ohne Archiv löst ein Update den gespeicherten Kanal auf und lädt den neuen Digest herunter. Mit ihm wird ein Archiv nur dann wiederverwendet, wenn seine Referenz und Integrität mit dem übereinstimmen, was angefordert wird."
+          }
+        }
+      ]
+    },
+    {
+      "id": "registry",
+      "title": "Einträge und Bereinigung",
+      "blocks": [
+        {
+          "p": "Beim Öffnen von <strong>Installierte OCI-Anwendungen verwalten</strong> werden zuerst Reste von Containern entfernt, die auf keinem Clusterknoten mehr existieren: der als Verlauf aufbewahrte Datensatz eines über die Proxmox-Oberfläche gelöschten Containers sowie Host-Dateien, die bei einer Entfernung zurückblieben. Ein Datensatz mit einem unterbrochenen Vorgang bleibt erhalten, da seine Sicherung noch benötigt werden könnte. Volumes und Hostverzeichnisse werden niemals aufgrund bloßer Schlussfolgerungen gelöscht."
+        }
+      ]
+    },
+    {
+      "id": "cluster",
+      "title": "In einem Cluster: Migration und hohe Verfügbarkeit",
+      "intro": "Ein OCI-Container ist ein gewöhnlicher Proxmox-LXC: Er kann wie jeder andere migriert oder von HA verwaltet werden, mit denselben Einschränkungen. Alles, was er zum Starten benötigt, wird dort gespeichert, wo jeder Clusterknoten darauf zugreifen kann.",
+      "blocks": [
+        {
+          "table": {
+            "headers": [
+              "Teil",
+              "Auf einem anderen Knoten des Clusters"
+            ],
+            "rows": [
+              [
+                "Konsolenlogbuch",
+                "Der Container erstellt <code>/var/log/proxmenux/oci</code> vor dem Start auf dem jeweiligen ausführenden Knoten. Jeder Knoten behält das Protokoll der von ihm ausgeführten Starts."
+              ],
+              [
+                "Netzwerk sysctls und Host-Monitor",
+                "Werden in <code>/etc/pve/proxmenux</code> gespeichert, das alle Clusterknoten gemeinsam nutzen, sodass ein migrierter Container sie findet."
+              ],
+              [
+                "Containerfestplatten",
+                "Proxmox verschiebt sie mit dem Container. Für HA müssen ihre Daten auf dem Zielknoten verfügbar sein, über gemeinsamen Speicher oder eine unterstützte Replikationskonfiguration."
+              ],
+              [
+                "Host-Verzeichnisse und Geräte",
+                "Die gleichen Regeln wie bei jedem LXC: Ein Host-Verzeichnis muss auf dem Zielknoten vorhanden sein und als gemeinsam genutzt markiert werden, und ein GPU, Coral oder NPU muss dort vorhanden sein."
+              ],
+              [
+                "ProxMenux-Datensatz",
+                "Der Vertrag bleibt auf dem Knoten, auf dem die Anwendung installiert wurde; alle Knoten lesen die Kopie unter <code>/etc/pve/priv/proxmenux/oci</code>. Eine migrierte Anwendung mit einem einzelnen Container wird auf dem Zielknoten registriert, sobald <strong>Installierte OCI-Anwendungen verwalten</strong> geöffnet oder eine Aktion für sie gestartet wird. Eine Anwendung mit mehreren Containern wird dort zur Wiederherstellung angeboten, da ihr privates Netzwerk auf diesem Knoten erstellt werden muss."
+              ]
+            ]
+          }
+        },
+        {
+          "calloutWarning": {
+            "title": "Nicht für hohe Verfügbarkeit",
+            "body": "Eine Multicontainer-Anwendung erreicht ihre Mitglieder über eine private Brücke des Knotens, auf dem sie installiert wurde, so dass ihre Mitglieder auf diesem Knoten bleiben. Ein Hostmonitor, z. B. Glances im Hostmodus oder Netdata, überwacht den Knoten, auf dem er ausgeführt wird; das Bewegen würde einen anderen Knoten überwachen."
+          }
+        },
+        {
+          "p": "Ein Backup, das außerhalb des Clusters wiederhergestellt wird, erhält die Dateien von <code>/etc/pve/proxmenux</code>, die der Container verwendet, wenn die Anwendung wiederhergestellt wird."
+        }
+      ]
+    },
+    {
+      "id": "channel",
+      "title": "Ein Rolling Tag ist kein unbeaufsichtigtes Update",
+      "blocks": [
+        {
+          "p": "Der Katalog installiert das vom Maintainer veröffentlichte Rolling-Tag. Der tatsächliche Digest wird aufgelöst und aufgezeichnet und nur durch eine explizite Aktualisierung mit Vorabprüfung und Rollback geändert. <monitorLink>ProxMenux Monitor</monitorLink> vergleicht den installierten Digest mit dem von der Registry veröffentlichten Digest und zeigt und meldet, wenn ein neues Image verfügbar ist."
+        }
+      ]
+    }
+  ]
+}
diff --git a/web/messages/de/docs/oci-manager/monitor.json b/web/messages/de/docs/oci-manager/monitor.json
new file mode 100644
index 00000000..9f02cd8b
--- /dev/null
+++ b/web/messages/de/docs/oci-manager/monitor.json
@@ -0,0 +1,213 @@
+{
+  "meta": {
+    "title": "OCI Container in ProxMenux Monitor | ProxMenux",
+    "description": "Was ProxMenux Monitor für einen mit OCI manager Apps installierten Container zeigt: Anwendungs- und Image-Versionen, neue Images, Konsolenausgabe und Proxmox-VE-Terminal."
+  },
+  "header": {
+    "title": "In ProxMenux Monitor",
+    "description": "Ein mit OCI manager Apps installierter Container erscheint wie jeder andere LXC unter VMs & LXCs. Sein Detaildialog liest den Installationsdatensatz: Anwendungs- und Image-Versionen, neue Images, Konsolenausgabe und Terminal.",
+    "section": "OCI manager Apps"
+  },
+  "sections": [
+    {
+      "id": "intro",
+      "blocks": [
+        {
+          "calloutInfo": {
+            "title": "Die Aufzeichnung ist die Quelle",
+            "body": "OCI manager Apps kennt die installierte Anwendung und ihre Herkunft. Der Monitor liest diesen Installationsdatensatz, statt die Anwendung im Container zu untersuchen. Diese Informationen stehen deshalb sowohl bei laufendem als auch bei gestopptem Container zur Verfügung."
+          }
+        },
+        {
+          "table": {
+            "headers": [
+              "Tab.",
+              "Was ändert sich für einen OCI Container"
+            ],
+            "rows": [
+              [
+                "Status",
+                "Ein <strong>Watchdog</strong> Switch unter Start beim Booten: Die Anwendung wird wieder gestartet, wenn sie von selbst stoppt"
+              ],
+              [
+                "App",
+                "Die Anwendung wird aus dem Datensatz identifiziert und Updates werden nach Image verfolgt"
+              ],
+              [
+                "Aktualisierungen",
+                "Das Image wird aktualisiert oder die Anwendung geändert, mit dem gleichen Ablauf wie das OCI-Menü"
+              ],
+              [
+                "Mounts",
+                "Containerfestplatten und Hostverzeichnisse mit ihrer Belegung"
+              ],
+              [
+                "Protokolle",
+                "Nur für OCI-Container: die Konsolenausgabe der Anwendung"
+              ]
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "app",
+      "title": "App",
+      "intro": "Die Registerkarte <appLink>App</appLink> bietet die installierte Anwendung als Erkennung mit dem Namen, dem Logo, dem Port und dem Schema des Datensatzes. Die Registrierung öffnet den Editor mit der Methode <strong>OCI-Image (installiert von ProxMenux)</strong>, die keine Konfiguration benötigt.",
+      "blocks": [
+        {
+          "cards": {
+            "items": [
+              {
+                "icon": "boxes",
+                "title": "Anwendung",
+                "body": "Die Version der Anwendung im Image, gelesen aus dem Image selbst: seine Umgebung oder seine <code>org.opencontainers.image.version</code> Label. Es ist informativ."
+              },
+              {
+                "icon": "archive",
+                "title": "Image",
+                "body": "Das Build-Datum und der Digest des installierten Images. Das Update wird hier entschieden: Der installierte Digest wird mit dem verglichen, den die Registry heute für dasselbe Tag veröffentlicht."
+              }
+            ]
+          }
+        },
+        {
+          "list": {
+            "items": [
+              "Wenn die Registry einen neuen Digest veröffentlicht, zeigt die Karte <strong>Neues Image</strong> mit seinem Datum und Digest an, auch wenn sich die Anwendungsversion im Inneren nicht geändert hat: Ein Neuaufbau auf einer aktualisierten Basis ist ein Update.",
+              "Wenn die Digests übereinstimmen, liest die Karte <strong>Version</strong>.",
+              "Die Karte verlinkt auf das Repository des Images: das GitHub-Projekt oder die Docker-Hub-Seite für ein offizielles Image.",
+              "Der Zugangslink verwendet die LAN-Adresse des Containers, auch für das Hauptmitglied einer Multicontainer-Anwendung, die eine zweite Adresse in ihrem privaten Netzwerk hat.",
+              "Die Schaltfläche <strong>Daten aktualisieren</strong> liest den Datensatz und die Registry erneut. Die Optionen zum Suchen oder Registrieren weiterer Anwendungen werden nicht angeboten: Der Container enthält genau die Anwendung seines Datensatzes."
+            ]
+          }
+        },
+        {
+          "figure": {
+            "src": "/oci-manager/monitor-app-tab.png",
+            "alt": "App-Tab eines OCI-Containers mit Anwendungsversion, Image und Repository-Link",
+            "caption": "Registerkarte App eines mit OCI manager Apps installierten Containers."
+          }
+        },
+        {
+          "p": "Der Check läuft einmal täglich mit den Update-Checks des Monitors und <strong>Daten aktualisieren</strong> führt ihn sofort aus. Ein neues Image wird als Benachrichtigung über die in <notificationsLink>Benachrichtigungen</notificationsLink> konfigurierten Kanäle gesendet. Das Update wird über den Tab Updates angewendet."
+        }
+      ]
+    },
+    {
+      "id": "updates",
+      "title": "Aktualisierungen",
+      "intro": "Bei einem mit OCI manager Apps installierten Container zeigt die Registerkarte Updates die Anwendung mit ihrem installierten Image und gegebenenfalls dem neuen Image aus der Registry, im selben Format wie andere Anwendungen. Die Paket- und Anwendungs-Updater eines gewöhnlichen LXC werden nicht angeboten.",
+      "blocks": [
+        {
+          "table": {
+            "headers": [
+              "Schaltfläche",
+              "Was es öffnet"
+            ],
+            "rows": [
+              [
+                "Aktualisierung",
+                "Die Aktualisierung aus <lifecycleLink>Installierte OCI-Anwendungen verwalten</lifecycleLink> für diesen Container im Monitor-Terminal. Sie kann mit oder ohne neues Image ausgeführt werden; ohne neues Image wird nichts verändert. Bei einer Multicontainer-Anwendung werden alle Mitglieder aktualisiert."
+              ],
+              [
+                "Ändern",
+                "Der Editor der Anwendung (Ressourcen, Netzwerk, Pfade und GPU). In einer Multicontainer-Anwendung werden die zusätzlichen Pfade und Geräte des Anwendungscontainers hinzugefügt oder entfernt und in Immich wird geändert, was die Erkennung ausführt."
+              ],
+              [
+                "Wiederherstellen",
+                "Ersetzt Update, wenn eine Operation auf dem Container unterbrochen wurde, und öffnet seine Wiederherstellung."
+              ],
+              [
+                "Wiederherstellen (wiederhergestellter Container)",
+                "Wird für einen aus einem Backup wiederhergestellten Container ohne Vertrag auf diesem Host unter <strong>Wiederhergestellte OCI-Anwendung</strong> angezeigt. Öffnet die <lifecycleLink>Wiederherstellung</lifecycleLink> im Monitor-Terminal; Aktualisieren und Ändern erscheinen nach der Registrierung."
+              ]
+            ]
+          }
+        },
+        {
+          "p": "Externe Änderungen, Hostverzeichnisse und Multicontainer-Anwendungen werden wie im OCI-Menü behandelt. In einer Multicontainer-Anwendung erscheinen die Buttons und die Optionen nur auf dem Hauptcontainer; die anderen Mitglieder zeigen ihr Image, eine Notiz, dass sie vom Hauptcontainer aktualisiert werden, und eine Schaltfläche, die es öffnet. Wenn das Terminal schließt, werden das Image, der Datensatz und die Mounts erneut gelesen."
+        },
+        {
+          "table": {
+            "headers": [
+              "Option",
+              "Verhalten"
+            ],
+            "rows": [
+              [
+                "Das vor dem Update erstellte Backup behalten",
+                "Jedes Update sichert den Container, um ihn wiederherzustellen, wenn das Update fehlschlägt. Mit dieser Option wird dasselbe Backup im ausgewählten Speicher gespeichert und erscheint unter den Backups des CT; auf Proxmox Backup Server wird vor dem Update ein Backup geschrieben."
+              ],
+              [
+                "Geplante Updates",
+                "Das Image wird zum gewählten Zeitpunkt nur aktualisiert, wenn die Registry ein neues veröffentlicht, und optional nur, wenn es 1, 3, 7 oder 14 Tage alt ist. Ein Container mit Änderungen außerhalb von ProxMenux wird übersprungen und gemeldet."
+              ]
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "logs",
+      "title": "Protokolle",
+      "intro": "Die Registerkarte Logs erscheint nur bei mit OCI manager Apps installierten Containern, zwischen Mounts und Backups. Sie zeigt Standardausgabe und Standardfehler des Hauptprozesses des Images, entsprechend der Ausgabe von <code>docker logs</code> bei Docker-Containern.",
+      "blocks": [
+        {
+          "list": {
+            "items": [
+              "Die Ausgabe wird auf dem Host in <code>/var/log/proxmenux/oci/VMID.console.log</code> (Modus 0600) vom ersten Start und über Neustarts gehalten, so dass sie mit gestopptem Container gelesen werden kann.",
+              "Die Datei wird bei 10 MB gedreht und behält drei komprimierte Kopien (<code>/etc/logrotate.d/proxmenux-oci</code>).",
+              "Jeder Start des Containers wird in der Ausgabe markiert. Die Registerkarte zeigt die Ausgabe seit dem letzten Start standardmäßig; <strong>Vollständiger Verlauf</strong> zeigt auch die vorherigen.",
+              "Wenn die Anwendung entfernt wird, wird ihre Ausgabe mit ihr entfernt.",
+              "Die letzten 100-, 500- oder 1000-Zeilen werden gezeigt. Während der Container läuft, werden neue Zeilen live verfolgt; das Scrollen nach oben pausiert das Folgen und <strong>Follow</strong> nimmt es wieder auf.",
+              "Ein Filter zeigt nur die Zeilen an, die einen Text enthalten, und <strong>Herunterladen</strong> speichert die geladenen Zeilen.",
+              "Farbcodes werden entfernt und eine Zeile, die eine Fortschrittsleiste neu zeichnet, wird in ihrem endgültigen Zustand angezeigt.",
+              "Die Registerkarte liest die Datei bei jedem Öffnen; es wird nicht zwischengespeichert."
+            ]
+          }
+        },
+        {
+          "calloutInfo": {
+            "title": "Zugangsdaten beim ersten Start",
+            "body": "Images, die ein generiertes Passwort beim ersten Start ausdrucken, lassen es in dieser Ausgabe, wie <code>docker logs</code>. Der Installateur liest es von dort aus, um es in seiner Zusammenfassung zu zeigen."
+          }
+        },
+        {
+          "figure": {
+            "src": "/oci-manager/monitor-logs-tab.png",
+            "alt": "Logs Tab mit dem Konsolenausgang eines OCI-Containers, dem Zeilenwähler, dem Filter und der Follow-Taste",
+            "caption": "Konsolenausgabe eines OCI-Containers."
+          }
+        }
+      ]
+    },
+    {
+      "id": "terminal",
+      "title": "Proxmox VE Konsole",
+      "blocks": [
+        {
+          "p": "Ein OCI-Image startet seinen eigenen Prozess als PID 1 und keinen Anmeldedienst. Die übliche LXC-Konsole würde deshalb ein Terminal ohne antwortenden Login-Prozess öffnen. Mit OCI manager Apps installierte Container erhalten <code>cmode: shell</code>: Die Proxmox-VE-Konsole öffnet über <code>lxc-attach</code> eine Shell, entsprechend <code>docker exec</code>. Die laufende Anwendung bleibt dabei unverändert."
+        },
+        {
+          "list": {
+            "items": [
+              "Die Shell ist diejenige, die <code>/etc/passwd</code> dem Root im Image gibt. Ein Image, dessen Root keine Shell hat oder keine ausliefert, behält die Standardkonsole.",
+              "Die Shell ist root im Container, ohne Passwort. Wer es öffnen kann, wird durch die <code>VM.Console</code>-Berechtigung von Proxmox VE entschieden.",
+              "Das Terminal des Monitors betritt den Container mit <code>pct enter</code>, was auf die gleiche Weise funktioniert."
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "mounts",
+      "title": "Mounts",
+      "blocks": [
+        {
+          "p": "Die Registerkarte <mountsLink>Mounts</mountsLink> listet die Festplatten und Hostverzeichnisse des Containers auf. Die Belegung einer Containerfestplatte auf Blockspeicher wie LVM-thin wird aus deren Dateisystem gelesen, das nur im Container eingehängt ist."
+        }
+      ]
+    }
+  ]
+}
diff --git a/web/messages/de/docs/oci-manager/stacks.json b/web/messages/de/docs/oci-manager/stacks.json
new file mode 100644
index 00000000..9a00532a
--- /dev/null
+++ b/web/messages/de/docs/oci-manager/stacks.json
@@ -0,0 +1,404 @@
+{
+  "meta": {
+    "title": "Multicontainer-Anwendungen | ProxMenux",
+    "description": "Wie OCI manager Apps eine Anwendung mit Datenbank und Cache als koordinierte native LXCs umsetzt: Planung, privates Netzwerk, Abhängigkeits-Hook, Validierung und transaktionale Aktualisierungen."
+  },
+  "header": {
+    "title": "Anwendungen mit mehreren Containern",
+    "description": "Eine Anwendung mit Datenbank, Cache und anderen Diensten wird zu mehreren koordinierten nativen LXCs, die als eine installiert und aktualisiert werden.",
+    "section": "OCI manager Apps"
+  },
+  "sections": [
+    {
+      "id": "intro",
+      "blocks": [
+        {
+          "calloutInfo": {
+            "title": "Eine Anwendung für den Benutzer, mehrere LXCs für Proxmox VE",
+            "body": "Eine Multicontainer-Definition ist ein Eintrag des Katalogs. Der Installer erstellt einen nativen LXC pro Dienst und behält seine Abhängigkeiten explizit. Immich, Nextcloud, Paperless-ngx und Tandoor werden auf diese Weise installiert."
+          }
+        },
+        {
+          "mermaid": {
+            "chartCode": "flowchart LR\n C[\"Docker Compose\"] --> O[\"{{plan}}\"]\n O --> A[\"{{app}}<br/>{{appNet}}\"]\n O --> D[\"{{db}}<br/>{{private}}\"]\n O --> R[\"{{cache}}<br/>{{private}}\"]\n V1[(\"config\")] --> A\n V2[(\"database\")] --> D\n V3[(\"cache\")] --> R\n D --> A\n R --> A",
+            "labels": {
+              "plan": "Stack-Plan",
+              "app": "Anwendungs-LXC",
+              "appNet": "LAN + privat",
+              "db": "PostgreSQL LXC",
+              "cache": "Valkey LXC",
+              "private": "privat"
+            }
+          }
+        }
+      ]
+    },
+    {
+      "id": "plan",
+      "title": "1. Der Plan, bevor ein Container existiert",
+      "blocks": [
+        {
+          "p": "Es wird kein LXC erstellt, während die Compose-Definition interpretiert wird. Ein vollständiger Plan steht an erster Stelle, mit jedem Mitglied, Image, VMID, Netzwerk, Pfad, Geheimnis, Ordnung und Gesundheitscheck. Wenn der Plan nicht konsistent ist, wird die Installation nicht gestartet."
+        },
+        {
+          "table": {
+            "headers": [
+              "Planelement",
+              "Inhalt",
+              "Vor dem Erstellen geprüft"
+            ],
+            "rows": [
+              [
+                "Mitglieder",
+                "Hauptanwendung, Datenbank, Cache, maschinelles Lernen und andere Abhängigkeiten",
+                "Einzigartige VMIDs, bekannte Rollen und genau ein Hauptmitglied"
+              ],
+              [
+                "Images",
+                "Rollende Referenz, Architektur und aufgelöster Digest jedes Dienstes",
+                "Alle existieren, unterstützen die Architektur und bestehen die OCI-Integritätsprüfung"
+              ],
+              [
+                "Netzwerk",
+                "Private Bridge, Subnetz, eine feste Adresse pro Dienst und LAN-Zugang für das Hauptmitglied",
+                "Keine Kollision mit vorhandenen Brücken oder Subnetzen und keine wiederholte Adresse"
+              ],
+              [
+                "Persistenz",
+                "Container-Disks, Host-Verzeichnisse, Besitzer und Backup",
+                "Keine überlappenden Pfade, Speicher verfügbar und deklarierte Berechtigungen"
+              ],
+              [
+                "Geheimnisse",
+                "Datenbankpasswort, Anwendungsschlüssel und erste Anmeldeinformationen",
+                "Einmal generiert und nur an die Mitglieder gegeben, die sie verwenden"
+              ],
+              [
+                "Lebenszyklus",
+                "Start-Order, Stop-Order und Gesundheitscheck pro Mitglied",
+                "Die Hauptanwendung startet zuletzt und stoppt zuerst"
+              ]
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "create",
+      "title": "2. Erstellung, Mitglied für Mitglied",
+      "blocks": [
+        {
+          "steps": {
+            "items": [
+              {
+                "title": "Reservieren Sie jeden VMID",
+                "body": "Das Proxmox-VE-Inventar und das Instanzverzeichnis werden geprüft. Ein vorhandener CT wird nicht übernommen; ein Vertrag, der noch zu einer anderen Instanz gehört, wird nicht wiederverwendet."
+              },
+              {
+                "title": "Jedes Image vorbereiten",
+                "body": "Alle Images werden aufgelöst, heruntergeladen und verifiziert, bevor der erste Container erstellt wird."
+              },
+              {
+                "title": "Erstellen Sie alle Rootfs",
+                "body": "Die offiziellen OCI-Metadaten werden importiert und die ProxMenux-Instanzidentität und die Mitgliedsrolle hinzugefügt."
+              },
+              {
+                "title": "Privates Netzwerk",
+                "body": "Eine Brücke und ein Subnetz werden erstellt und jedes Mitglied erhält seine feste Adresse; nur das Hauptmitglied erhält auch die LAN-Schnittstelle."
+              },
+              {
+                "title": "Persistenz",
+                "body": "Jede Datenbank und Konfiguration erhält eine eigene Containerplatte; nur Daten, die freigegeben werden sollen, verwenden Hostverzeichnisse."
+              },
+              {
+                "title": "Umgebung",
+                "body": "Interne Endpunkte, Shared Secrets und Servicevariablen werden geschrieben. Die Anwendung erreicht ihre Abhängigkeiten an ihren reservierten Privatadressen."
+              },
+              {
+                "title": "Aufzeichnung",
+                "body": "Jedes Mitglied zeichnet seine native Konfiguration, die Rootfs-Änderungen, die Updates reproduzieren müssen, und seine Beziehung zum Stack auf."
+              }
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "checks",
+      "title": "3. Starten und Überprüfen Sie jeden Container",
+      "intro": "Ein erstellter LXC bedeutet noch keinen betriebsbereiten Dienst. Die Abhängigkeiten starten der Reihe nach und durchlaufen jeweils eine dienstspezifische Prüfung.",
+      "blocks": [
+        {
+          "table": {
+            "headers": [
+              "Dienst",
+              "Überprüfung",
+              "Was es zeigt"
+            ],
+            "rows": [
+              [
+                "PostgreSQL",
+                "<code>pg_isready</code> im CT mit erwartetem Host, Benutzer und Datenbank",
+                "Der Server akzeptiert Verbindungen für die konfigurierte Datenbank"
+              ],
+              [
+                "Redis / Valkey",
+                "<code>redis-cli</code> oder <code>valkey-cli</code> <code>PING</code> gegen seine Privatadresse",
+                "Der Broker hört zu und antwortet"
+              ],
+              [
+                "Immich Maschinelles Lernen",
+                "HTTP <code>GET /ping</code>, plus eine Überprüfung der ausgewählten GPU-Laufzeit",
+                "Der Service antwortet und die angeforderte Beschleunigung ist nicht auf CPU zurückgefallen"
+              ],
+              [
+                "Nextcloud",
+                "<code>GET /status.php</code> mit <code>installed=true</code>, <code>maintenance=false</code> und <code>needsDbUpgrade=false</code>",
+                "Initialisierung ohne anstehende Migration beendet"
+              ],
+              [
+                "Paperless-ngx / Tandoor",
+                "HTTP über die LAN-Adresse und den realen Port des Dienstes",
+                "Das Frontend und seine Abhängigkeiten stellen die Anwendung bereit"
+              ],
+              [
+                "Hauptanwendung",
+                "Der Endpunkt seines Templates, zum Beispiel <code>/api/server/ping</code> in Immich",
+                "Der gesamte Stapel arbeitet durch die Anwendung, die die Abhängigkeiten verwendet"
+              ]
+            ]
+          }
+        },
+        {
+          "calloutWarning": {
+            "title": "Laufend bedeutet nicht funktionsfähig",
+            "body": "Der laufende Zustand sagt nur, dass der LXC-Prozess existiert. Wenn der Dienst eine bessere Prüfung bietet, wird eine Exec- oder HTTP-Prüfung mit einem Timeout verwendet. Wenn ein Mitglied stoppt oder seine Prüfung nicht besteht, wird der Stapel nicht als installiert deklariert."
+          }
+        }
+      ]
+    },
+    {
+      "id": "hook",
+      "title": "4. Der Abhängigkeits-Hook",
+      "blocks": [
+        {
+          "p": "Der Haken wird nur auf den Hauptcontainer eines abhängigen Stapels gesetzt. Proxmox VE behält das Skript als Snippet und führt es als <code>hookscript</code> dieses CT aus. Das Stack-Rezept ist nicht im Skript geschrieben: Es befindet sich in einem separaten privaten Vertrag."
+        },
+        {
+          "codeGrid": {
+            "items": [
+              {
+                "title": "Hauptkonfiguration CT",
+                "code": "hookscript: local:snippets/proxmenux-stack-dependencies.sh"
+              },
+              {
+                "title": "Privatvertrag (Beispiel)",
+                "code": "/etc/pve/priv/proxmenux-stack-VMID.json\n{\n  \"schema\": 1,\n  \"stack\": \"immich\",\n  \"dependencies\": [\n    {\"vmid\": 107, \"label\": \"PostgreSQL\", \"healthcheck\": {...}},\n    {\"vmid\": 108, \"label\": \"Valkey\", \"healthcheck\": {...}},\n    {\"vmid\": 106, \"label\": \"Machine Learning\", \"healthcheck\": {...}}\n  ]\n}"
+              }
+            ]
+          }
+        },
+        {
+          "snippet": {
+            "summary": "Vollständige Quelle von proxmenux-stack-dependencies.sh",
+            "pathCode": "local:snippets/proxmenux-stack-dependencies.sh",
+            "snippetCode": "stackDependencyHook"
+          }
+        },
+        {
+          "p": "Das Skript ist für jeden Stack gleich. VMIDs, Namen, Prüftypen und Timeouts stammen aus dem privaten Vertrag <code>/etc/pve/priv/proxmenux-stack-VMID.json</code> jedes Stacks."
+        },
+        {
+          "steps": {
+            "items": [
+              {
+                "title": "Proxmox VE ruft pre-start auf",
+                "body": "Bevor der Haupt-CT startet, läuft der Hook mit seinem VMID und der Lebenszyklusphase."
+              },
+              {
+                "title": "Eine Sperre pro Stack",
+                "body": "<code>flock</code> auf <code>/run/lock/proxmenux-stack-VMID.lock</code> verhindert zwei Startsequenzen gleichzeitig."
+              },
+              {
+                "title": "Der Vertrag wird gelesen und validiert",
+                "body": "Ein bekanntes Schema, numerische Abhängigkeiten, Labels, ein exec, http oder Running Check und ein positives Timeout sind erforderlich."
+              },
+              {
+                "title": "Abhängigkeiten in der Reihenfolge",
+                "body": "Jeder CT muss vorhanden sein; ein gestoppter wird gestartet und ein bereits laufender wird nicht neu gestartet."
+              },
+              {
+                "title": "Auf Betriebsbereitschaft warten",
+                "body": "Der Check läuft alle zwei Sekunden, und der CT wird ebenfalls bestätigt, dass er noch läuft."
+              },
+              {
+                "title": "Der Haupt-CT startet",
+                "body": "Wenn jede Abhängigkeit bereit ist, endet der Vorstart und Proxmox VE startet die Anwendung."
+              }
+            ]
+          }
+        },
+        {
+          "calloutInfo": {
+            "title": "Der Haken stoppt Abhängigkeiten nicht",
+            "body": "Die Post-Start-, Pre-Stop- und Post-Stop-Phasen tun nichts. Das Stoppen des Haupt-CT lässt PostgreSQL, Redis, Valkey oder Machine Learning laufen. Der Hook ordnet den Start an; er verwandelt nicht mehrere LXCs in einen Prozess."
+          }
+        },
+        {
+          "table": {
+            "headers": [
+              "Typ",
+              "Beispiel",
+              "Spätere Starts"
+            ],
+            "rows": [
+              [
+                "Abhängiger Stapel",
+                "Immich, Nextcloud, Anwendung mit PostgreSQL",
+                "Der Haken des Haupt-CT startet die Abhängigkeiten und wartet auf sie"
+              ],
+              [
+                "Anwendungssuite",
+                "Arr Suite",
+                "Kein Hauptmitglied: jeder LXC folgt seinem eigenen <code>onboot</code>"
+              ],
+              [
+                "Einzelne Anwendung",
+                "Jellyfin",
+                "Proxmox VE startet diesen LXC direkt"
+              ]
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "stack-checks",
+      "title": "5. Kontrollen am Stapel als Ganzes",
+      "blocks": [
+        {
+          "list": {
+            "items": [
+              "Jede VMID existiert, ist einzigartig und behält die erwartete Instanzidentität.",
+              "Jeder Vertrag gehört zum selben Stack, behält seine Rolle und seine aufgezeichnete native Konfiguration.",
+              "Das Hauptmitglied ist das letzte in <code>start_order</code> und das erste in <code>stop_order</code>.",
+              "Es fehlt keine Member-, Volume- oder Rootfs-Adaption.",
+              "Der Haken zeigt auf das offizielle Snippet, sein Inhalt ist unverändert und sein Vertrag entspricht dem Stapelrezept.",
+              "Die beobachteten Images und Digests stimmen mit den vorbereiteten OCI-Archiven überein.",
+              "Geräte, GPU-Profile, Mounts, Geheimnisse und Endpunkte stimmen immer noch mit den Verträgen überein.",
+              "Nachdem alle Abhängigkeiten ihre Prüfung bestanden haben, prüft der Endpunkt der Hauptanwendung die Integration zwischen den Mitgliedern."
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "manage",
+      "title": "Verwalten eines installierten Stapels",
+      "intro": "Unter <strong>Installierte OCI-Anwendungen verwalten</strong> führt jedes Mitglied zum gesamten Stack. Das Menü bietet <strong>Alle Container der Anwendung aktualisieren</strong>, <strong>Zusätzliche Pfade und Geräte ändern</strong>, <strong>Alle Container mit ihrer gespeicherten Konfiguration neu erstellen</strong> und <strong>Entfernen: Anwendung und Container löschen</strong>. Die Neuerstellung baut jeden Container anhand des gespeicherten Digests aus seinem ursprünglichen Image neu auf, ohne nach einem neueren zu suchen. Sie verwendet dieselben Schritte wie ein Update und wird für aktualisierbare Stacks angeboten.",
+      "blocks": [
+        {
+          "steps": {
+            "items": [
+              {
+                "title": "Jedes Mitglied",
+                "body": "Der Vertrag des Mitglieds nennt die Haupt-VMID und die vollständige Liste der Mitglieder."
+              },
+              {
+                "title": "Der Stapel ist reproduzierbar",
+                "body": "Identitäten, Verträge, Hook, Anpassungen und eine koordinierte Wiederholung für dieses Rezept werden validiert."
+              },
+              {
+                "title": "Images zuerst",
+                "body": "Die Anwendung wird nicht gestoppt, bis jeder Digest gelöst, heruntergeladen und verifiziert wurde."
+              },
+              {
+                "title": "Stoppen und sichern Sie das Set",
+                "body": "Verifizierte native Backups werden mit gestopptem Stack übernommen, sodass Anwendung und Datenbanken zum selben Zeitpunkt gehören."
+              },
+              {
+                "title": "Aktualisieren und überprüfen Sie jedes Mitglied",
+                "body": "Anpassung, Netzwerk, Mounts, Geheimnisse und Geräte werden vor dem Gesundheitscheck jedes Mitglieds erneut angewendet."
+              },
+              {
+                "title": "Alles veröffentlichen oder wiederherstellen",
+                "body": "Die neuen Verträge werden nur veröffentlicht, wenn jedes Mitglied besteht. Wenn einer scheitert, wird jedes Mitglied wiederhergestellt."
+              }
+            ]
+          }
+        },
+        {
+          "table": {
+            "headers": [
+              "Ändern",
+              "Was sich ändert",
+              "Was erhalten bleibt"
+            ],
+            "rows": [
+              [
+                "Extra Pfade und Geräte",
+                "Sie werden dem Anwendungscontainer hinzugefügt oder daraus entfernt, der neu gestartet wird. Es wird nichts neu erstellt",
+                "Die Daten der Anwendung, ihrer Datenbank und der anderen Container"
+              ],
+              [
+                "Was die Erkennung ausführt (Immich)",
+                "Der Machine Learning Container nimmt das Image und die Geräte des CPU oder eines GPU des Hosts auf. Die gesamte Anwendung wird gestoppt und aktualisiert, wie in einem Update",
+                "Der Modell-Cache, die Bibliothek und die Datenbank. Wenn etwas fehlschlägt, werden die vorherigen Container und die vorherige Auswahl wiederhergestellt"
+              ]
+            ]
+          }
+        },
+        {
+          "calloutWarning": {
+            "title": "Ein Stack ohne koordinierte Wiederholung wird nicht aktualisiert",
+            "body": "Wenn die Vorbereitung eines Stapels nicht reproduziert werden kann, wird die Aktualisierung abgelehnt, bevor der Stapel gestoppt wird. Die Anwendung läuft so, wie sie ist."
+          }
+        }
+      ]
+    },
+    {
+      "id": "failure",
+      "title": "6. Wenn etwas versagt",
+      "blocks": [
+        {
+          "p": "Während einer Installation stoppt und entfernt ein Fehler die unvollständigen Container, die die Operation erstellt hat, und die private Bridge, wenn die Operation sie erstellt hat. Ein Stack wird nicht als gültig veröffentlicht, bis die gesamte Sequenz beendet ist."
+        },
+        {
+          "p": "Ein Update ist transaktional: Alle Images werden zuerst vorbereitet, dann stoppt der Stapel, jedes Mitglied wird gesichert und das Backup verifiziert, und nur dann werden alle Rootfs ersetzt. Mitglieder beginnen eins nach dem anderen mit ihrem Gesundheitscheck; Wenn einer fehlschlägt, wird jedes Mitglied aus dem gleichen Backup-Satz wiederhergestellt, so dass die Datenbank und die Anwendung niemals zu verschiedenen Momenten gehören."
+        },
+        {
+          "mermaid": {
+            "chartCode": "flowchart LR\n P[\"{{prepare}}\"] --> S[\"{{stop}}\"]\n S --> B[\"{{backup}}\"]\n B --> R[\"{{replace}}\"]\n R --> H{\"{{healthy}}\"}\n H -- \"{{yes}}\" --> C[\"{{commit}}\"]\n H -- \"{{no}}\" --> X[\"{{rollback}}\"]",
+            "labels": {
+              "prepare": "Jedes Image vorbereiten",
+              "stop": "Stop, Hauptelement zuerst",
+              "backup": "Verifiziertes Backup jedes CT",
+              "replace": "rootfs ersetzen",
+              "healthy": "Alle funktionsfähig?",
+              "yes": "Ja",
+              "no": "Nein",
+              "commit": "Verträge veröffentlichen",
+              "rollback": "Jedes Mitglied wiederherstellen"
+            }
+          }
+        }
+      ]
+    },
+    {
+      "id": "not-assumed",
+      "title": "Was ein Stack nicht beinhaltet",
+      "blocks": [
+        {
+          "list": {
+            "items": [
+              "Eine in einem Fluss installierte Suite, wie die Arr-Suite, ist kein abhängiger Stapel: Ihre Container haben keine Startreihenfolge zwischen ihnen.",
+              "Das private Netzwerk ersetzt nicht die Authentifizierung, TLS oder die Konfiguration jeder Anwendung.",
+              "Das Backup eines LXC enthält nicht die Brücke, den Haken oder die Verträge des Rests des Stapels.",
+              "Prowlarr, Sonarr oder Radarr erhalten von ProxMenux keine Indexer, Profile oder Anbieter."
+            ]
+          }
+        }
+      ]
+    }
+  ]
+}
diff --git a/web/messages/de/docs/oci-manager/storage-network.json b/web/messages/de/docs/oci-manager/storage-network.json
new file mode 100644
index 00000000..181d3bf3
--- /dev/null
+++ b/web/messages/de/docs/oci-manager/storage-network.json
@@ -0,0 +1,305 @@
+{
+  "meta": {
+    "title": "Daten, Pfade und Netzwerk | ProxMenux",
+    "description": "So bewahrt OCI manager Apps die Daten eines OCI-Containers: Container-Datenträger, Host-Verzeichnisse, rclone-Mounts, Adressen und private Netzwerke."
+  },
+  "header": {
+    "title": "Daten, Pfade und Netzwerk",
+    "description": "Was im rootfs liegt, was beim Ersetzen erhalten bleibt, wie Container Daten gemeinsam nutzen und wie jeder Container seine Adresse erhält.",
+    "section": "OCI manager Apps"
+  },
+  "sections": [
+    {
+      "id": "intro",
+      "blocks": [
+        {
+          "calloutInfo": {
+            "title": "Persistenz wird vor dem Erstellen des LXC festgelegt",
+            "body": "Vor dem Erstellen des Containers werden die vom Image und seiner Compose-Datei deklarierten Volumes ausgelesen. Jeder Pfad, der eine Aktualisierung überstehen muss, erhält einen vom rootfs unabhängigen Mountpoint. Das rootfs enthält damit nur die zum Image gehörenden Dateien und kann ersetzt werden."
+          }
+        }
+      ]
+    },
+    {
+      "id": "questions",
+      "title": "Was der Installer abfragt",
+      "intro": "Die Vorlage gibt die von der Anwendung benötigten Pfade vor. Jeder wird auf einem Container-Datenträger oder in einem Host-Verzeichnis abgelegt. Vor der Zusammenfassung können weitere Pfade ergänzt werden.",
+      "blocks": [
+        {
+          "steps": {
+            "items": [
+              {
+                "title": "Benötigte Pfade",
+                "body": "<code>/config</code>, <code>/data</code>, Bibliotheken, Downloads und alle von der Anwendung deklarierten Volumes werden aufgelistet."
+              },
+              {
+                "title": "Speicherort",
+                "body": "Jeder Pfad wird auf einem Container-Datenträger oder in einem vorhandenen Host-Verzeichnis abgelegt."
+              },
+              {
+                "title": "Speicher und Größe",
+                "body": "Ein Container-Datenträger wird mit der angegebenen Größe auf einem Proxmox-VE-Speicher erstellt. Die Standardinstallation verwendet <code>local-lvm</code>. Die erweiterte Installation fragt für jeden Pfad zuerst den Speicher und dann die Größe ab; vorgeschlagen wird der Speicher des rootfs. Der Datenträger erscheint als <code>vm-VMID-disk-N</code> und wird als <code>mpN</code> eingebunden."
+              },
+              {
+                "title": "Host-Verzeichnis",
+                "body": "Das Host-Verzeichnis wird über seinen Pfad angegeben. Existiert es noch nicht, wird es angelegt und dem Host-Benutzer zugeordnet, auf den der Container-Benutzer abgebildet wird."
+              },
+              {
+                "title": "Weitere Pfade",
+                "body": "Vor der Installation können weitere Zuordnungen von Host-Pfad oder Volume zu einem Pfad im Container ergänzt werden."
+              },
+              {
+                "title": "Zusammenfassung",
+                "body": "Vor dem Erstellen des CT wird die vollständige Pfadzuordnung angezeigt und im Instanzvertrag gespeichert."
+              }
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "options",
+      "title": "Die beiden persistenten Speicherorte",
+      "blocks": [
+        {
+          "table": {
+            "headers": [
+              "Eigenschaft",
+              "Container-Datenträger",
+              "Host-Verzeichnis"
+            ],
+            "rows": [
+              [
+                "In der Konfiguration",
+                "<code>mpN: STORAGE:vm-VMID-disk-N,mp=/config,backup=1,size=16G</code>",
+                "<code>mpN: /mnt/oci-shared/media,mp=/data/media</code>"
+              ],
+              [
+                "Containersicherung (vzdump)",
+                "Mit <code>backup=1</code> enthalten",
+                "Nicht enthalten"
+              ],
+              [
+                "Größe",
+                "Festgelegt; durch Vergrößern des Mountpoints erweiterbar",
+                "Der freie Platz im Dateisystem oder Dataset des Hosts"
+              ],
+              [
+                "Andere Container",
+                "Nur vom zugehörigen Container eingebunden",
+                "Dasselbe Verzeichnis kann in mehrere Container eingebunden werden"
+              ],
+              [
+                "Snapshots und Wiederherstellung",
+                "Von Proxmox VE zusammen mit dem CT verwaltet",
+                "Im Speicher des Hosts verwaltet"
+              ],
+              [
+                "Beim Entfernen der Anwendung",
+                "Wird mit dem Container gelöscht",
+                "Bleibt mit seinem Inhalt erhalten"
+              ],
+              [
+                "Beim Verschieben des CT auf einen anderen Knoten",
+                "Wird mit dem CT verschoben",
+                "Derselbe Pfad muss auf dem anderen Knoten vorhanden sein"
+              ]
+            ]
+          }
+        },
+        {
+          "p": "Das rootfs ist den Binärdateien und dem Inhalt des Images vorbehalten. Eine Aktualisierung oder Neuerstellung ersetzt es, ohne eine der beiden Arten von Mountpoints anzutasten."
+        }
+      ]
+    },
+    {
+      "id": "example",
+      "title": "Beispiel: ein Container mit beiden Speicherorten",
+      "blocks": [
+        {
+          "code": {
+            "title": "Jellyfin als CT 151 auf local-lvm installiert (Auszug)",
+            "code": "rootfs: local-lvm:vm-151-disk-0,size=8G\n# Container disk, part of the CT backup\nmp0: local-lvm:vm-151-disk-1,mp=/config,backup=1,size=16G\n\n# Host directory, outside the CT backup\nmp1: /mnt/oci-shared/media,mp=/data/media"
+          }
+        },
+        {
+          "p": "Eine Aktualisierung oder Neuerstellung ersetzt nur das rootfs: <code>mp0</code> bewahrt Benutzer, Bibliotheken und Einstellungen, während <code>mp1</code> weiterhin dieselben Medien bereitstellt. Die Wiederherstellung der CT-Sicherung stellt <code>/config</code> wieder her. Das Medienverzeichnis wird bei Bedarf aus der Sicherung des Host-Speichers wiederhergestellt."
+        },
+        {
+          "flow": {
+            "nodes": [
+              {
+                "label": "Vertrag",
+                "detail": "/config"
+              },
+              {
+                "label": "Speicherort",
+                "detail": "Container-Datenträger\noder Host-Verzeichnis"
+              },
+              {
+                "label": "LXC",
+                "detail": "Für die Anwendung\nimmer /config"
+              }
+            ],
+            "caption": "Die Anwendung sieht den vom Image vorgegebenen Pfad. Nur der Speicherort ändert sich."
+          }
+        }
+      ]
+    },
+    {
+      "id": "shared",
+      "title": "Ein Host-Verzeichnis, mehrere Container",
+      "blocks": [
+        {
+          "mermaid": {
+            "chartCode": "flowchart TB\n H[\"{{host}}<br/>/mnt/oci-shared/media\"]\n H --> Q[\"qBittorrent<br/>/data\"]\n H --> J[\"Jellyfin<br/>/data\"]\n H --> R[\"Radarr / Sonarr<br/>/data\"]\n Q -. \"{{config}}\" .-> QV[(\"/config mpN\")]\n J -. \"{{config}}\" .-> JV[(\"/config mpN\")]\n R -. \"{{config}}\" .-> RV[(\"/config mpN\")]",
+            "labels": {
+              "host": "Host-Verzeichnis",
+              "config": "Eigene Konfiguration"
+            }
+          }
+        },
+        {
+          "p": "Jeder Container speichert seine Konfiguration auf einem eigenen Datenträger. Bibliothek oder Downloads liegen in einem gemeinsamen Host-Verzeichnis, das in allen Containern unter demselben internen Pfad eingebunden wird. So ist der Pfad, in den eine Anwendung schreibt, derselbe, aus dem eine andere liest."
+        }
+      ]
+    },
+    {
+      "id": "rclone",
+      "title": "Cloud-Speicher über die rclone-Anwendung",
+      "intro": "Der rclone-Eintrag im Katalog bietet neben der Installation auch <strong>Mount in einem vorhandenen rclone-OCI-Container aktivieren</strong>. Dabei wird ein bereits in der rclone-Weboberfläche angelegtes und autorisiertes Remote eingehängt und auf dem Host bereitgestellt. Andere Container können es als Host-Verzeichnis nutzen.",
+      "blocks": [
+        {
+          "steps": {
+            "items": [
+              {
+                "title": "Container und Remote",
+                "body": "Die VMID des rclone-Containers, der genaue Name des Remotes und optional ein Pfad darin."
+              },
+              {
+                "title": "Mount-Name und Cache",
+                "body": "Der Name des Mounts und der VFS-Cache-Modus: <code>off</code>, <code>minimal</code>, <code>writes</code> oder <code>full</code> (Standard)."
+              },
+              {
+                "title": "Bereitgestellte Ansichten",
+                "body": "Ein gemeinsames Stammverzeichnis, standardmäßig <code>/mnt/oci-shared</code>, enthält eine Ansicht mit Lese- und Schreibzugriff unter <code>/mnt/oci-shared/remotes/NAME</code> sowie eine schreibgeschützte Ansicht unter <code>/mnt/oci-shared/remotes-ro/NAME</code>."
+              },
+              {
+                "title": "Aktivierung",
+                "body": "Nach der Bestätigung wird der CT gestoppt. Sein Startbefehl und ein Proxmox-VE-Hookscript werden eingerichtet, dann wird er wieder gestartet. Der Vorgang wartet, bis beide Ansichten auf dem Host eingehängt sind."
+              }
+            ]
+          }
+        },
+        {
+          "calloutInfo": {
+            "title": "Wenn der Mount nicht zustande kommt",
+            "body": "Die vorherige Container-Konfiguration wird wiederhergestellt und der Container erneut gestartet. Eine fehlgeschlagene Aktivierung lässt rclone damit im bisherigen Zustand."
+          }
+        }
+      ]
+    },
+    {
+      "id": "network",
+      "title": "Adressen und Netzwerke",
+      "intro": "Eine einzelne Anwendung benötigt eine Adresse. Eine Anwendung aus mehreren Containern braucht zusätzlich ein stabiles Netzwerk zwischen ihren Mitgliedern.",
+      "blocks": [
+        {
+          "cards": {
+            "items": [
+              {
+                "icon": "network",
+                "title": "Anwendung mit einem Container",
+                "body": "Gewählt werden die Netzwerk-Bridge sowie DHCP oder eine feste Adresse im CIDR-Format. Der LXC hat eine eigene Adresse, und die Zusammenfassung zeigt die vollständigen Dienst-URLs."
+              },
+              {
+                "icon": "waypoints",
+                "title": "Anwendung mit mehreren Containern",
+                "body": "Ein freies Subnetz wird ermittelt und eine dauerhafte private Bridge erstellt. Jedes Mitglied – Anwendung, Datenbank und Cache – erhält dort eine feste Adresse."
+              }
+            ]
+          }
+        },
+        {
+          "flow": {
+            "nodes": [
+              {
+                "label": "LAN",
+                "detail": "Erreichbare Adresse\nnur für den Hauptdienst"
+              },
+              {
+                "label": "Haupt-LXC",
+                "detail": "Web / API\nLAN + privates Netzwerk"
+              },
+              {
+                "label": "Privates Netzwerk",
+                "detail": "PostgreSQL · Valkey · ML\nfeste Adressen"
+              }
+            ],
+            "caption": "Abhängigkeiten kommunizieren über das private Netzwerk und haben keine Adresse im LAN."
+          }
+        },
+        {
+          "p": "Der Stack-Vertrag speichert Bridge, Subnetz, Adressen und Beziehungen zwischen den Diensten. Bei einer Aktualisierung der Anwendung wird dieselbe Topologie für alle Mitglieder wiederverwendet. ProxMenux Monitor öffnet den Hauptcontainer über seine LAN-Adresse, nicht über seine Adresse im privaten Netzwerk."
+        }
+      ]
+    },
+    {
+      "id": "ownership",
+      "title": "Datei- und Verzeichnisbesitz",
+      "blocks": [
+        {
+          "list": {
+            "items": [
+              "Neue Verzeichnisse werden mit der UID und GID angelegt, auf die der unprivilegierte LXC abgebildet wird.",
+              "Bei vorhandenen Verzeichnissen wird der Eigentümer nicht rekursiv geändert.",
+              "Sockets, Systemdateien und sensible Pfade werden nicht als allgemeine Host-Verzeichnisse angeboten."
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "backup",
+      "title": "Was eine Containersicherung enthält",
+      "blocks": [
+        {
+          "table": {
+            "headers": [
+              "Bestandteil",
+              "In der vzdump-Sicherung des CT",
+              "Aufbewahrungsort"
+            ],
+            "rows": [
+              [
+                "OCI-rootfs",
+                "Ja",
+                "In der CT-Sicherung; außerdem aus Image und Vertrag neu erstellbar"
+              ],
+              [
+                "Container-Datenträger mit <code>backup=1</code>",
+                "Ja",
+                "Die CT-Sicherung"
+              ],
+              [
+                "Host-Verzeichnis",
+                "Nein",
+                "Die Sicherung des Host-Speichers"
+              ],
+              [
+                "Instanzvertrag",
+                "Ja, die im CT mitgeführte Kopie",
+                "<code>/.proxmenux/oci-record.json</code> im CT; weitere Host- und Cluster-Kopien werden separat gespeichert"
+              ],
+              [
+                "Anwendung mit mehreren Containern",
+                "Jedes Mitglied in einer eigenen Sicherung",
+                "Die Sicherungen aller Mitglieder sowie der Stack-Vertrag und seine Netzwerk-Bridge auf dem Host"
+              ]
+            ]
+          }
+        }
+      ]
+    }
+  ]
+}
diff --git a/web/messages/de/docs/post-install/automated.json b/web/messages/de/docs/post-install/automated.json
new file mode 100644
index 00000000..fc4ab3fb
--- /dev/null
+++ b/web/messages/de/docs/post-install/automated.json
@@ -0,0 +1,172 @@
+{
+  "meta": {
+    "title": "Automatisiertes Nachinstallationsskript | ProxMenux Dokumentation",
+    "description": "Das automatisierte Nachinstallationsskript von ProxMenux führt 14 festgelegte, hardwareabhängige Optimierungen auf einem neuen Proxmox-VE-Host aus. Es gibt keine Funktionsauswahlliste; Systemaktualisierung, Bannerentfernung, manche Log2RAM-Installationen und Neustart können jedoch eine Bestätigung verlangen. Rückgängig zu machende Konfigurationsänderungen werden erfasst.",
+    "ogTitle": "Automatisiertes Nachinstallationsskript | ProxMenux Dokumentation",
+    "ogDescription": "14 festgelegte, hardwareabhängige Optimierungen für einen neuen Proxmox-VE-Host, mit Bestätigungen für einige Aktionen und Erfassung rückgängig zu machender Änderungen."
+  },
+  "header": {
+    "title": "Automatisiertes Post-Install-Skript",
+    "description": "ProxMenux führt 14 festgelegte Basisoptimierungen ohne Funktionsauswahlliste aus. Einige Aktionen verlangen eine Bestätigung. Rückgängig zu machende Konfigurationsänderungen werden für Optimierungen deinstallieren erfasst; Paket-Upgrades werden nicht als reversibel beschrieben.",
+    "section": "Post-Installation · Automatisiert"
+  },
+  "intro": {
+    "title": "Wann automatisiert ausgewählt werden soll",
+    "body": "Führen Sie dies auf einem frisch installierten Proxmox-Host aus, wenn Sie eine sinnvolle Basislinie wünschen, ohne Entscheidungen treffen zu müssen. Das Skript ist idempotent – ​​es ist sicher, es zweimal auszuführen, es wendet lediglich dieselben Konfigurationen erneut an. Opt-in-Funktionen (Fastfetch, IOMMU, Ceph Repo, HA, AMD-Fixes…) sind absichtlich <strong>nicht</strong> Teil dieses Pfades; Wählen Sie sie bei Bedarf unter <link>Anpassbar</link> aus."
+  },
+  "applies": {
+    "heading": "Was das Skript anwendet",
+    "intro": "Die Optimierungen werden genau in dieser Reihenfolge angewendet. Die Spalte <em>Kategorie</em> verlinkt auf die ausführliche Dokumentation jeder Änderung in der anpassbaren Nachinstallation.",
+    "headerNum": "#",
+    "headerTool": "Werkzeug",
+    "headerWhat": "Was es tut",
+    "headerCategory": "Kategorie"
+  },
+  "optimizations": [
+    {
+      "tool": "APT-Repositorys + vollständiges Upgrade",
+      "what": "Deaktiviert die Enterprise-Quellen pve-enterprise.sources und ceph.sources, erstellt eine passende No-Subscription-Quelle für den Debian-Codenamen des Hosts und führt apt update && apt full-upgrade -y aus (offizieller Proxmox-Upgrade-Befehl).",
+      "category": "Grundeinstellungen",
+      "categorySlug": "basic-settings"
+    },
+    {
+      "tool": "Subskriptionsbanner entfernen",
+      "what": "Passt die Weboberfläche an, um den Hinweis „Kein gültiges Abonnement“ auszublenden. Fragt vorher nach Bestätigung; über Optimierungen deinstallieren rückgängig zu machen.",
+      "category": "Anpassung",
+      "categorySlug": "customization"
+    },
+    {
+      "tool": "IPv4 erzwingen",
+      "what": "Schreibt /etc/apt/apt.conf.d/99-force-ipv4, damit apt nur IPv4 nutzt und instabile IPv6-Verbindungen zu Spiegelservern umgeht.",
+      "category": "Netzwerk",
+      "categorySlug": "network"
+    },
+    {
+      "tool": "Sprachpakete überspringen",
+      "what": "Schreibt /etc/apt/apt.conf.d/99-disable-translations, um übersetzte Paketbeschreibungsindizes nicht mehr herunterzuladen und die Datenmenge bei apt-Updates zu verringern.",
+      "category": "Grundeinstellungen",
+      "categorySlug": "basic-settings"
+    },
+    {
+      "tool": "Erhöhung der Systemgrenzen",
+      "what": "Erhöht inotify-Überwachungen, nofile/nproc-Grenzen, Kernel-Schlüsselbundgrenzen und fs.file-max über sysctl.d, limits.d, pam und systemd — ausreichend für Hosts mit vielen Containern.",
+      "category": "System",
+      "categorySlug": "system"
+    },
+    {
+      "tool": "Speicherabstimmung",
+      "what": "Setzt vm.swappiness=10, ausgewogene Anteile noch nicht geschriebener Speicherseiten, vm.max_map_count=262144 und bei Unterstützung proaktive Speicherkompaktierung. Die Overcommit-Richtlinie des Kernels bleibt auf dem Proxmox-Standard.",
+      "category": "System",
+      "categorySlug": "system"
+    },
+    {
+      "tool": "Verhalten bei Kernel-Panik",
+      "what": "Konfiguriert den Host so, dass er 10 Sekunden nach einer Panik / oops / Hardlockup neu startet, anstatt auf unbestimmte Zeit einzufrieren.",
+      "category": "System",
+      "categorySlug": "system"
+    },
+    {
+      "tool": "Netzwerk-Stack abstimmen",
+      "what": "TCP Buffer Sizing, IPv4-Härtung (redirects off, rp_filter=2, martian log off), lokaler Portbereich 1024-65535, TCP MTU-Probing, RFC 1337, plus ein Helfer bei /usr/local/sbin/proxmenux-fwbr-tune, der mit einer oneshot systemd-Einheit und einer udev-Regel verdrahtet ist, so dass rp_filter=0 / log_martians=0 jedes Mal wieder auf fwbr*/fwln*/fwpr*/tap*-Schnittstellen angewendet werden, wenn Proxmox sie bei VM Start / Stop, Neustart oder Live-Migration neu erstellt.",
+      "category": "Netzwerk",
+      "categorySlug": "network"
+    },
+    {
+      "tool": "Bashrc-Anpassung (root)",
+      "what": "Farbige PS1, gebräuchliche Aliase (l/la/ll/ls/grep), Zeitstempel-Historie und Bash-Completion-Sourcing, alles in einem PMX_CORE_BASHRC eingezäunten Block, so dass es leicht zu entfernen ist.",
+      "category": "Anpassung",
+      "categorySlug": "customization"
+    },
+    {
+      "tool": "Log2RAM (SSD-bewusst, auto)",
+      "what": "Reduziert SSD-/NVMe-Verschleiß durch Verschieben von /var/log in eine tmpfs-RAM-Disk mit regelmäßiger Synchronisierung auf Datenträger. Installation aus dem Upstream-Projekt bei SSD oder NVMe als Systemplatte. Die Größe richtet sich nach dem Host-RAM (128M / 256M / 512M). Ein Schutz leert alte Journale ab 80% Belegung und kürzt stark wachsende Logs ab 92% vor dem Schreiben. Regelmäßige Synchronisierung wird geplant und journald an den verfügbaren Platz angepasst. Details unter <link>Log2RAM</link>.",
+      "category": "Speicher",
+      "categorySlug": "storage"
+    },
+    {
+      "tool": "ZFS Autotrim (nur SSD)",
+      "what": "Aktiviert zpool autotrim=on in jedem ZFS-Pool, dessen vdevs alle SSD/NVMe mit TRIM-Unterstützung sind (überprüft /sys/block/[dev]/queue/rotational und discard_granularity). Pools, die von HDDs unterstützt werden, werden automatisch übersprungen. Nur Pools, die tatsächlich von ProxMenux geändert wurden, werden zur Deinstallation aufgezeichnet - Pools, die Sie manuell autotrimieren, werden in Ruhe gelassen.",
+      "category": "Speicher",
+      "categorySlug": "storage"
+    },
+    {
+      "tool": "Journald Größenbeschränkungen",
+      "what": "Erzwingt dauerhaften Speicher, begrenzt SystemMaxUse=64M / RuntimeMaxUse=60M und aktiviert Komprimierung sowie Info-Protokollierung für Monitor. Wird bei aktivem Log2RAM automatisch übersprungen, da dieses die Anpassung selbst übernimmt.",
+      "category": "System",
+      "categorySlug": "system"
+    },
+    {
+      "tool": "Logrotate abstimmen",
+      "what": "Setzt global daily und danach size 10M, behält 7 Rotationen und aktiviert Komprimierung sowie copytruncate. Das spätere Größenkriterium hat Vorrang; einzelne Logregeln können es überschreiben. Für Log2RAM geeignet, die Häufigkeit hängt aber von Regeln und Timer ab.",
+      "category": "System",
+      "categorySlug": "system"
+    },
+    {
+      "tool": "Persistente Schnittstellennamen",
+      "what": "Schreibt einen <code>/etc/systemd/network/10-proxmenux-&lt;iface&gt;.link</code> pro physischem NIC (jeder beginnt mit einem 'Managed by ProxMenux'-Header), der den MAC an den aktuellen Namen anheftet, so dass <code>eth0</code> / <code>enp…</code> Namen über Neustarts und neue NIC-Ergänzungen stabil bleiben.",
+      "category": "Netzwerk",
+      "categorySlug": "network"
+    }
+  ],
+  "hardwareTitle": "Hardwareabhängige Standardwerte",
+  "hardwareBody": "Das Skript liest die Host-Hardware vor dem Anwenden von Einstellungen. Log2RAM ist standardmäßig nur auf SSD / NVMe Root-Festplatten installiert (es wird aufgefordert, wenn die Erkennung etwas anderes sagt). Die Ramdisk-Größe von Log2RAM wird aus der Gesamt-RAM (<code>≤ 8 GB → 128M</code>, <code>≤ 16 GB → 256M</code>, <code>'>' 16 GB → 512M</code>) ausgewählt. Die Journald-Limits werden an die Ramdisk-Größe angepasst, wenn Log2RAM aktiv ist, um ein Ausfüllen zu vermeiden.",
+  "upgrade": {
+    "heading": "Paketlisten und System aktualisieren",
+    "intro": "Der erste Schritt der automatisierten Nachinstallation ist das Proxmox-Upgrade. Für einen laufenden Host innerhalb derselben Hauptversion empfiehlt Proxmox selbst:",
+    "after": "Diese Zeile ist der offizielle Befehl für aktuelle Proxmox-Versionen. Das automatisierte Skript führt <strong>genau</strong> das aus und ergänzt Repository-Bereinigung und Nacharbeiten gemäß Upgrade-Anleitung — dieselben Schritte wie das separate Werkzeug <link>Proxmox-Systemaktualisierung</link>:",
+    "items": [
+      "Deaktiviert die Enterprise-Quellen <code>pve-enterprise.sources</code> / <code>ceph.sources</code>, entfernt alte Repository-Dateien und erstellt eine saubere No-Subscription-Quelle für den Codenamen des Hosts.",
+      "Führt das Upgrade nicht interaktiv mit <code>DEBIAN_FRONTEND=noninteractive</code> und <code>--force-confdef --force-confold</code> aus. Angepasste Konfigurationsdateien bleiben erhalten, auch wenn sie sich im Upstream geändert haben.",
+      "Installiert wichtige Proxmox-Pakete, wenn sie fehlen (<code>zfsutils-linux</code>, <code>proxmox-backup-restore-image</code>, <code>chrony</code>).",
+      "LVM Metadaten-Sanitätsprüfung, <code>apt-get autoremove -y</code> + <code>apt-get autoclean -y</code> und eine Neustartaufforderung nur, wenn der Kernel tatsächlich geändert wurde."
+    ],
+    "sameTitle": "Gleicher Updater, zwei Einstiegspunkte",
+    "sameBody": "Das automatisierte Paket und das eigenständige <link>Proxmox System Update</link>-Dienstprogramm teilen sich die gleichen zugrunde liegenden Skripte (<code>update-pve8.sh</code> / <code>update-pve9_2.sh</code>). Verwenden Sie das Dienstprogramm selbst, wenn Sie nur den Host aktualisieren möchten, ohne den Rest der Optimierungen anzuwenden."
+  },
+  "endResult": {
+    "heading": "Erwartetes Endergebnis",
+    "body": "Am Ende sehen Sie eine Erfolgsmeldung mit Ausgaben der einzelnen Schritte und eine Neustartfrage, da einige Kerneleinstellungen einen Neustart benötigen. Sie können den Neustart verschieben; die Einstellungen gelten beim nächsten Start.",
+    "imageAlt": "Automatisiertes Nachinstallationsskript — abschließende Terminalausgabe mit erfolgreich angewendeten Optimierungen"
+  },
+  "notDoes": {
+    "heading": "Was dieses Skript nicht tut",
+    "items": [
+      "Automatische Zeitzonenerkennung (im Quellskript auskommentiert; bei Bedarf die anpassbare Nachinstallation verwenden).",
+      "Portmapper / rpcbind deaktivieren (siehe <secLink>Sicherheit</secLink>).",
+      "IOMMU / VFIO aktivieren (siehe <virtLink>Virtualisierung</virtLink>).",
+      "Fastfetch / Figurine / Ceph-Repository / HA / AMD-CPU-Korrekturen installieren (siehe <optLink>Optional</optLink>).",
+      "pigz installieren oder ZFS ARC abstimmen (siehe <perfLink>Leistung</perfLink> / <storLink>Speicher</storLink>)."
+    ]
+  },
+  "xshokTitle": "xshok-proxmox-Erkennung",
+  "xshokBody": "Wenn der Host zuvor das <code>xshok-proxmox</code>-Skript ausgeführt hat, erkennt ProxMenux die Markierungsdatei und warnt Sie, bevor Sie fortfahren. Einige Tweaks können sich überschneiden. Das Begleitskript ist veraltet - wenn Sie sich entscheiden, trotzdem fortzufahren, überprüfen Sie <link>die Übersicht</link> für den Kontext.",
+  "revert": {
+    "heading": "Rückgängig machen",
+    "body": "Jedes Werkzeug der Tabelle wird in <code>/usr/local/share/proxmenux/installed_tools.json</code> erfasst. Unter <link>Optimierungen deinstallieren</link> können Sie einzelne Änderungen zurücksetzen. Sicherungen geänderter Konfigurationsdateien liegen mit der Endung <code>.bak</code> neben den Originalen."
+  },
+  "related": {
+    "heading": "Verwandte Themen",
+    "items": [
+      {
+        "label": "Anpassbare Nachinstallation",
+        "href": "/docs/post-install/customizable",
+        "tail": " — wählen Sie im selben Katalog genau die gewünschten Funktionen."
+      },
+      {
+        "label": "Optimierungen deinstallieren",
+        "href": "/docs/post-install/uninstall",
+        "tail": " — einzelne hier angewendete Änderungen rückgängig machen."
+      },
+      {
+        "label": "Nützliche Systembefehle",
+        "href": "/docs/help-info/system-commands",
+        "tail": " — Änderungen überprüfen (uptime, free, journalctl usw.)."
+      },
+      {
+        "label": "Übersicht Post-Install",
+        "href": "/docs/post-install",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/de/docs/post-install/basic-settings.json b/web/messages/de/docs/post-install/basic-settings.json
new file mode 100644
index 00000000..2d6605e0
--- /dev/null
+++ b/web/messages/de/docs/post-install/basic-settings.json
@@ -0,0 +1,240 @@
+{
+  "meta": {
+    "title": "Post-Install: Grundeinstellungen | ProxMenux Dokumentation",
+    "description": "Grundlegende Optionen nach der Installation: Wechseln Sie zu kostenlosen Proxmox-Repositories und Upgraden, erkennen Sie automatisch die Zeitzone und aktivieren Sie NTP, überspringen Sie APT-Sprachdownloads und wählen Sie aus 25 gängigen System-Dienstprogrammen zur Installation."
+  },
+  "header": {
+    "title": "Post-Install: Grundeinstellungen",
+    "section": "Einstellungen nach der Installation von Proxmox"
+  },
+  "intro": {
+    "title": "Was diese Kategorie abdeckt",
+    "body": "Fünf Grundlagen für einen neuen Proxmox-Host: auf Community-Repositories ohne Abonnement umstellen, das System vollständig aktualisieren, Zeitzone und NTP automatisch konfigurieren, APT-Sprachdownloads zur Einsparung von Bandbreite und Speicherplatz abschalten und aus 25 gängigen Systemwerkzeugen wählen."
+  },
+  "upgrade": {
+    "heading": "Paketlisten und System aktualisieren",
+    "intro": "Stellt APT auf das kostenlose Repository <em>pve-no-subscription</em> statt des abonnementpflichtigen Enterprise-Repositorys um und aktualisiert das gesamte System. Die Schritte hängen von der Proxmox-VE-Hauptversion ab; ProxMenux erkennt sie und startet das passende Skript.",
+    "headerVersion": "PVE-Version",
+    "headerScript": "Versionsabhängiges Startskript",
+    "headerCodename": "Debian-Codename",
+    "rows": [
+      {
+        "version": "9.x",
+        "script": "update-pve9_2.sh",
+        "codename": "trixie"
+      },
+      {
+        "version": "8.x",
+        "script": "update-pve8.sh",
+        "codename": "bookworm"
+      }
+    ],
+    "officialTitle": "Die offizielle Proxmox Empfehlung",
+    "officialBody": "Die offizielle Proxmox-Anleitung empfiehlt diese genaue Reihenfolge:",
+    "officialOutro": "Das ist der übliche Befehl für Updates innerhalb der installierten Proxmox-VE-Hauptversion. Prüfen Sie die Repositories und vorgeschlagenen Paketänderungen, <em>bevor</em> Sie fortfahren. Ein Hauptversionswechsel erfordert das offizielle Migrationsverfahren.",
+    "doesTitle": "Was die ProxMenux-Option tut - verifiziert gegen das Skript",
+    "doesIntro": "Das ProxMenux-Update wickelt die oben genannten exakten apt-Befehle ab und fügt eine Reihe von Pre-/Post-Schritten hinzu, die Sie sich sonst von Hand merken müssten. Jedes Element unten ist, was das Dispatcher-Skript tatsächlich tut (siehe <link>Proxmox System Update</link> für die vollständige Aufschlüsselung):",
+    "doesItems": [
+      "<strong>Zuerst die Repositories bereinigen.</strong> Deaktiviert die Enterprise-Quellen <code>pve-enterprise.sources</code> / <code>ceph.sources</code>, entfernt alte Repository-Dateien früherer PVE-Versionen und erstellt eine saubere <code>proxmox.sources</code> für den kostenlosen Kanal <em>pve-no-subscription</em>, passend zum Debian-Codenamen: trixie für PVE 9, bookworm für PVE 8.",
+      "<strong>Debian-Repositories neu schreiben</strong> mit main / updates / security und <code>non-free-firmware</code>, damit die Firmwarewarnung beim Upgrade entfällt.",
+      "<strong>Führt das offizielle Upgrade aus.</strong> <code>apt-get update</code> gefolgt von <code>apt full-upgrade -y</code> (PVE 9) oder <code>apt dist-upgrade -y</code> (PVE 8), jeweils nicht interaktiv mit <code>--force-confdef --force-confold</code>, um angepasste Konfigurationsdateien zu erhalten.",
+      "<strong>Installiert fehlende wichtige Pakete:</strong> <code>zfsutils-linux</code>, <code>proxmox-backup-restore-image</code>, <code>chrony</code>.",
+      "<strong>LVM-Metadaten prüfen.</strong> Sucht nach VMs mit Festplatten-Passthrough, die veraltete Physical-Volume-Header auf Rohdatenträger geschrieben haben könnten. Warnt bei Auffälligkeiten, ohne sie automatisch zu beheben.",
+      "<strong>Bereinigt danach:</strong> <code>apt-get autoremove -y</code> + <code>apt-get autoclean -y</code>, dann Neustartabfrage bei Kernel-Update oder vorhandener Datei <code>/var/run/reboot-required</code>."
+    ],
+    "shortTitle": "Kurz gesagt",
+    "shortBody": "Die Option führt das empfohlene <code>apt update && apt full-upgrade -y</code> aus, ergänzt die im offiziellen Leitfaden genannte Repository- und Nachbereitung und fragt am Ende nach dem Neustart. Siehe <link>Proxmox-Systemupdate</link> mit vollständigem Ablaufdiagramm — derselbe Updater ist als eigenständiges Werkzeug im Hauptmenü verfügbar.",
+    "subTitle": "Nicht auf einen abonnierten Host anwenden",
+    "subBody": "Wenn Sie ein Proxmox-Abonnement haben und Enterprise-Repositories behalten möchten, überspringen Sie diese Option. Sie deaktiviert Enterprise und stellt auf den Community-Kanal um. Paketupgrade und Repository-Umschreibung lassen sich unter Optimierungen deinstallieren nicht zurücksetzen. Einen späteren Kanalwechsel müssen Sie gezielt über die Repository-Konfiguration vornehmen.",
+    "safetyTitle": "Sicherheitsüberprüfung nach der Aktualisierung",
+    "safetyBody": "Nach dem Upgrade prüft das Skript auf Festplatten mit veralteten PV-Metadaten (Physical Volume) - ein Edge Case, der auftreten kann, wenn ein VM mit Festplattendurchgang LVM-Header auf eine Rohplatte kritzelt. Wenn etwas Verdächtiges gefunden wird, sehen Sie eine Warnung, die <code>pvs</code> zur Inspektion vorschlägt. Es wird nicht automatisch gehandelt."
+  },
+  "time": {
+    "heading": "Zeit automatisch synchronisieren",
+    "intro": "Erkennt die öffentliche IP des Servers über <code>dig myip.opendns.com @resolver1.opendns.com</code>, fragt dann <code>ipapi.co/'{'ip'}'/timezone</code>, um die passende IANA-Zeitzone nachzuschlagen, und wendet sie mit <code>timedatectl set-timezone</code> an. Endlich ermöglicht NTP mit <code>timedatectl set-ntp true</code>.",
+    "depTitle": "Abhängig von zwei externen Diensten",
+    "depBody": "Der Lookup basiert darauf, dass OpenDNS und <code>ipapi.co</code> erreichbar sind und ihre Antworten korrekt sind. Wenn Sie Proxmox hinter einem VPN oder einem VLAN ausführen, das aus einer anderen Region austritt, ist die automatisch erkannte Zeitzone möglicherweise falsch. In diesem Fall überspringen Sie diese Option und legen Sie die Zeitzone von Hand fest:",
+    "revertTitle": "Reversibel aus dem Menü Deinstallieren",
+    "revertBody": "<link>Optimierungen deinstallieren</link> setzt die Zeitzone auf UTC zurück, eine sichere Vorgabe. NTP bleibt aktiv; die Uhr synchronisiert sich weiter und zeigt UTC, bis Sie eine andere Zeitzone einstellen."
+  },
+  "languages": {
+    "heading": "Das Herunterladen zusätzlicher Sprachen überspringen",
+    "intro": "Bei <code>apt update</code> kann APT übersetzte Paketbeschreibungen zusätzlich zu den Hauptmetadaten herunterladen. Die Option deaktiviert diese Downloads zur Einsparung von Bandbreite und Speicherplatz. Zuvor <strong>stellt ProxMenux sicher, dass die Locale des Hosts generiert ist</strong>: Es liest <code>/etc/default/locale</code> oder <code>/etc/environment</code>, ergänzt <code>/etc/locale.gen</code> bei Bedarf und führt <code>locale-gen</code> aus. Die Shell-Locale bleibt erhalten.",
+    "writtenTitle": "Was geschrieben wird",
+    "revertTitle": "Reversibel aus dem Menü Deinstallieren",
+    "revertBody": "Das Löschen von <code>/etc/apt/apt.conf.d/99-disable-translations</code> (manuell oder aus dem Menü Deinstallieren) stellt das Standardverhalten wieder her und APT lädt Sprachdateien erneut herunter."
+  },
+  "utilities": {
+    "heading": "Allgemeine Systemdienstprogramme installieren",
+    "intro": "Öffnet eine gruppierte Auswahlliste mit <strong>25 ausgewählten Werkzeugen</strong>. Wählen und bestätigen Sie; ProxMenux installiert sie über <code>apt</code>, überprüft das Ergebnis und zeigt eine Zusammenfassung.",
+    "imageAlt": "Auswahldialog für ProxMenux-Systemwerkzeuge: Leertaste zum Auswählen, Eingabetaste zum Bestätigen",
+    "reuseTitle": "Die gleiche Liste wird an anderer Stelle wiederverwendet",
+    "reuseBody": "Der Katalog mit 25 Werkzeugen ist zentral definiert: <code>PROXMENUX_UTILS</code> in <code>scripts/global/utils-install-functions.sh</code>. Unter <em>Dienstprogramme und Werkzeuge → Systemwerkzeuge</em> finden Sie dieselbe Liste für spätere Installationen ohne erneuten Nachinstallationslauf.",
+    "listTitle": "Was ist in der Liste",
+    "groups": [
+      {
+        "group": "Systemüberwachung",
+        "items": [
+          {
+            "pkg": "htop",
+            "desc": "Interaktiver Prozess-Viewer"
+          },
+          {
+            "pkg": "btop",
+            "desc": "Moderner Ressourcenmonitor (CPU, RAM, Festplatten, Netz, Prozesse)"
+          },
+          {
+            "pkg": "s-tui",
+            "desc": "Terminaloberfläche für CPU-Belastungstests und Überwachung"
+          },
+          {
+            "pkg": "iftop",
+            "desc": "Live-Bandbreitennutzung pro Verbindung"
+          },
+          {
+            "pkg": "iotop",
+            "desc": "Datenträger-I/O pro Prozess"
+          },
+          {
+            "pkg": "iptraf-ng",
+            "desc": "Interaktiver IP-LAN-Monitor"
+          }
+        ]
+      },
+      {
+        "group": "Netzwerk",
+        "items": [
+          {
+            "pkg": "iperf3",
+            "desc": "Messen Sie die maximal erreichbare Bandbreite zwischen Hosts"
+          },
+          {
+            "pkg": "net-tools",
+            "desc": "Legacy-Tools (ifconfig, netstat, route). Immer noch praktisch für schnelle Überprüfungen."
+          },
+          {
+            "pkg": "ipset",
+            "desc": "Verwalten Sie große IP-Sets im Kernel – nützlich mit iptables/nftables-Regeln."
+          }
+        ]
+      },
+      {
+        "group": "Download und Archiv",
+        "items": [
+          {
+            "pkg": "axel",
+            "desc": "Leichter paralleler Download-Beschleuniger"
+          },
+          {
+            "pkg": "aria2",
+            "desc": "Multi-Source-/Multi-Protokoll-Downloader (HTTP, FTP, BitTorrent, Metalink)"
+          },
+          {
+            "pkg": "unzip",
+            "desc": "ZIP-Archive extrahieren"
+          },
+          {
+            "pkg": "zip",
+            "desc": "ZIP-Archive erstellen"
+          },
+          {
+            "pkg": "cabextract",
+            "desc": "Extrahieren von Microsoft CAB-Archiven (bei der Arbeit mit Windows ISOs praktisch)"
+          },
+          {
+            "pkg": "wimtools",
+            "desc": "Windows-WIM-Abbilder bearbeiten (extrahieren, aufteilen, einbinden, anwenden)"
+          },
+          {
+            "pkg": "genisoimage",
+            "desc": "ISO-9660-Abbilder aus einem Verzeichnis erstellen"
+          }
+        ]
+      },
+      {
+        "group": "Text und Dateien",
+        "items": [
+          {
+            "pkg": "dos2unix",
+            "desc": "CRLF-Zeilenenden (Windows) in LF-Zeilenenden (Unix) umwandeln"
+          },
+          {
+            "pkg": "grc",
+            "desc": "Färbt Ausgaben von ping, traceroute, dig, tail usw. mit Syntaxhervorhebung ein"
+          },
+          {
+            "pkg": "plocate",
+            "desc": "Schnelle Dateisuche (indexiert). Führen Sie `updatedb` nach der Installation aus, um den Index zu erstellen."
+          }
+        ]
+      },
+      {
+        "group": "Remote und Sessions",
+        "items": [
+          {
+            "pkg": "sshpass",
+            "desc": "Nicht interaktive SSH-Passwortauthentifizierung (für Skripte, nicht für den täglichen Gebrauch)"
+          },
+          {
+            "pkg": "tmux",
+            "desc": "Terminal-Multiplexer: Sitzungen abkoppeln, Fenster teilen und Sitzungen bei Verbindungsabbrüchen erhalten"
+          }
+        ]
+      },
+      {
+        "group": "Hardware und Low-Level",
+        "items": [
+          {
+            "pkg": "msr-tools",
+            "desc": "CPU modellspezifische Register lesen/schreiben (rdmsr, wrmsr)"
+          },
+          {
+            "pkg": "intel-gpu-tools",
+            "desc": "Intel GPU Diagnoseprogramme einschließlich `intel_gpu_top`"
+          }
+        ]
+      },
+      {
+        "group": "Virtualisierung",
+        "items": [
+          {
+            "pkg": "libguestfs-tools",
+            "desc": "VM-Festplattenabbilder untersuchen und ändern (virt-ls, virt-cat, guestmount…)"
+          },
+          {
+            "pkg": "chntpw",
+            "desc": "Bearbeiten von Windows SAM - nützlich für die Passwortwiederherstellung auf Windows VMs, die Sie erben"
+          }
+        ]
+      }
+    ],
+    "actionTitle": "Einige davon in Aktion",
+    "noBulkTitle": "Nur von ProxMenux installierte Werkzeuge werden entfernt",
+    "noBulkBody": "ProxMenux erfasst nur ausgewählte Pakete, die noch nicht installiert waren. Optimierungen deinstallieren entfernt diese Pakete vollständig und lässt zuvor vorhandene Pakete bestehen. Für APT-Upgrades gibt es kein sicheres atomares Zurückrollen: Das Entfernen der Werkzeuge macht das System-Upgrade nicht rückgängig."
+  },
+  "related": {
+    "heading": "Verwandte Themen",
+    "items": [
+      {
+        "label": "Proxmox-Systemupdate",
+        "href": "/docs/utils/system-update",
+        "tail": " — Führt den Zyklus apt update + dist-upgrade bei Bedarf erneut aus."
+      },
+      {
+        "label": "Installationsprogramm für Systemdienstprogramme",
+        "href": "/docs/utils/system-utils",
+        "tail": "— Installation (oder Neuinstallation) von Dienstprogrammen einzeln nach der Nachinstallation."
+      },
+      {
+        "label": "Befehle für Updates und Pakete",
+        "href": "/docs/help-info/update-commands",
+        "tail": " — APT-Referenz für die Shell."
+      },
+      {
+        "label": "Anpassbare Nachinstallation",
+        "href": "/docs/post-install/customizable",
+        "tail": " — zurück zum übergeordneten Menü."
+      }
+    ]
+  }
+}
diff --git a/web/messages/de/docs/post-install/customizable.json b/web/messages/de/docs/post-install/customizable.json
new file mode 100644
index 00000000..95cb063b
--- /dev/null
+++ b/web/messages/de/docs/post-install/customizable.json
@@ -0,0 +1,106 @@
+{
+  "meta": {
+    "title": "Anpassbares Post-Install-Script | ProxMenux Dokumentation",
+    "description": "Wählen Sie genau die Optimierungen aus, die ProxMenux auf Ihrem Proxmox-VE-Host anwenden soll. 10 Kategorien, etwa 35 einzelne Werkzeuge und eine Auswahl mit Kontrollkästchen. Enthält alle Funktionen des automatischen Skripts plus ausdrücklich wählbare Optionen wie IOMMU, Fastfetch, Figurine, Ceph, HA und AMD-Korrekturen.",
+    "ogTitle": "Anpassbares Post-Install-Script | ProxMenux Dokumentation",
+    "ogDescription": "10 Kategorien, ~35 individuelle Optimierungen. Wählen Sie genau das aus, was Sie auf einem Proxmox VE-Host wünschen. Reversible Veränderungen werden verfolgt."
+  },
+  "header": {
+    "title": "Anpassbares Post-Install-Script",
+    "description": "Wählen Sie genau die Optimierungen für Ihren Proxmox-VE-Host. ProxMenux gruppiert etwa 35 Werkzeuge in 10 Kategorien in einem gemeinsamen Auswahldialog. Dieselbe Grundlage wie Automatisch, aber mit voller Kontrolle über die angewendeten Änderungen.",
+    "section": "Post-Installation · Anpassbar"
+  },
+  "intro": {
+    "title": "Wann Sie Anpassbar wählen sollten",
+    "body": "Wählen Sie diesen Weg, wenn Sie die gewünschten oder unerwünschten Anpassungen bereits kennen. Eine nach Kategorien gruppierte Auswahlliste erlaubt das Vorwählen, Abwählen und Kombinieren von Optimierungen. Einträge können später erneut angewendet werden. Reversible Konfigurationsänderungen werden für <link>Optimierungen deinstallieren</link> erfasst; Paket-Upgrades gelten nicht als reversibel."
+  },
+  "compare": {
+    "heading": "Vergleich mit Automatisch",
+    "body": "Anpassbar umfasst das gesamte <link>automatische Skript</link>: dieselben 14 Basisoptimierungen plus zahlreiche ausdrücklich wählbare Optionen, die Automatisch absichtlich auslässt. Diese sind nur für bestimmte Hardware (AMD-Korrekturen), Hostinganbieter (OVH RTM) oder Arbeitslasten nützlich (IOMMU/VFIO, Ceph-Repository, Hochverfügbarkeit, Fastfetch, Figurine, ZFS-ARC-Anpassung, pigz, automatische ZFS-Snapshots, vzdump-Geschwindigkeitsgrenzen, Open vSwitch, TCP BBR …)."
+  },
+  "categoriesSection": {
+    "heading": "Die 10 Kategorien",
+    "body": "Das anpassbare Skript gruppiert die Optimierungen in 10 Kategorien in einem gemeinsamen Auswahldialog. Jede Kategorie hat eine eigene Dokumentationsseite. Öffnen Sie eine Karte für die Begründung, Vorgaben und Prüfschritte jeder Option."
+  },
+  "categories": [
+    {
+      "name": "Grundeinstellungen",
+      "description": "APT-Quellen bereinigen, das offizielle Proxmox-Upgrade ausführen und Zeitzone, Gebietsschema sowie häufig benötigte Werkzeuge einrichten. Die Grundlage aller anderen Gruppen."
+    },
+    {
+      "name": "System",
+      "description": "Optimieren Sie das Protokollsubsystem und die Kernel-Grenzwerte für einen Host, der viele VMs und Container enthält. Behandelt journald, Logrotate, Sysctl (Speicher, Dateibeschränkungen), Kernel-Panic-Verhalten und schnelle Neustarts."
+    },
+    {
+      "name": "Virtualisierung",
+      "description": "Bereitet den Host auf erweiterte Virtualisierung vor. Installiert den passenden Gastagenten, wenn Proxmox selbst in einer unterstützten VM läuft, und aktiviert IOMMU/VFIO für die PCI-Durchreichung von GPUs, Controllern und TPUs."
+    },
+    {
+      "name": "Netzwerk",
+      "description": "Härtet und optimiert den Netzwerkstack des Hosts. Erzwingt IPv4 für APT, wendet sysctl-Härtung und TCP-Pufferanpassungen an, bietet Open vSwitch, TCP BBR und TCP Fast Open und bindet persistente Schnittstellennamen an MAC-Adressen."
+    },
+    {
+      "name": "Speicher",
+      "description": "Richten Sie die gängigen Speicher-Subsysteme von Proxmox ein: ZFS ARC Sizing, ZFS auto-snapshot, ZFS autotrim für SSD/NVMe Pools und vzdump Geschwindigkeitsbegrenzungen, um eine Sättigung der Festplatte bei Backups zu vermeiden."
+    },
+    {
+      "name": "Sicherheit",
+      "description": "Verringert die standardmäßig offene Angriffsfläche. Deaktiviert die RPC-Dienste portmapper/rpcbind, die Proxmox nicht benötigt, aber lauschen lässt."
+    },
+    {
+      "name": "Anpassung",
+      "description": "Ändern Sie das visuelle und Shell-Erlebnis des Hosts: Farben und Aliase in bashrc, MOTD-Banner und Entfernen des Abonnementbescheids in der Web-Benutzeroberfläche."
+    },
+    {
+      "name": "Überwachung",
+      "description": "Integriert den Host in OVH Real-Time Monitoring. Installiert RTM nur, wenn ProxMenux einen OVH-Server erkennt; auf anderen Hosts ändert die Option nichts."
+    },
+    {
+      "name": "Leistung",
+      "description": "Beschleunigen Sie Kompressionsvorgänge (Backups, Transfers), indem Sie gzip durch sein paralleles Gegenstück pigz ersetzen."
+    },
+    {
+      "name": "Fakultativ",
+      "description": "Nischenstücke, die nicht jeder Host braucht: AMD CPU Fixes, Fastfetch-Banner, Figurine 3D-Hostname, Indexaktualisierung des PVE Appliance Managers, Ceph Repository, High Availability Services, Log2RAM zur Reduzierung des SSD-Verschleisses und ein ZRAM-Swap-Profil."
+    }
+  ],
+  "mixTip": {
+    "title": "Automatisch und Anpassbar kombinieren",
+    "body": "Ein übliches Vorgehen: zuerst <strong>Automatisch</strong> für sinnvolle Grundeinstellungen, dann <strong>Anpassbar</strong> öffnen und nur benötigte Zusatzwerkzeuge wählen, etwa IOMMU für GPU-Passthrough. Änderungen werden unabhängig erfasst; Deinstallieren zeigt alle angewendeten Einträge unabhängig vom verwendeten Weg."
+  },
+  "related": {
+    "heading": "Verwandte Themen",
+    "items": [
+      {
+        "label": "Automatische Nachinstallation",
+        "href": "/docs/post-install/automated",
+        "tail": " — sinnvolle Vorgaben ohne Rückfragen anwenden."
+      },
+      {
+        "label": "Optimierungen deinstallieren",
+        "href": "/docs/post-install/uninstall",
+        "tail": " — jede Auswahl sauber rückgängig machen."
+      },
+      {
+        "label": "Grundeinstellungen",
+        "href": "/docs/post-install/basic-settings",
+        "tail": "— Repos, Zeit, Sprache, Dienstprogramme."
+      },
+      {
+        "label": "Virtualisierung",
+        "href": "/docs/post-install/virtualization",
+        "tail": "— IOMMU + VFIO für Passthrough."
+      },
+      {
+        "label": "Sicherheit",
+        "href": "/docs/post-install/security",
+        "tailRich": " · <storageLink>Speicher</storageLink> · <networkLink>Netzwerk</networkLink> · <customLink>Anpassung</customLink> — weitere Kategorien."
+      },
+      {
+        "label": "Übersicht nach der Installation",
+        "href": "/docs/post-install",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/de/docs/post-install/customization.json b/web/messages/de/docs/post-install/customization.json
new file mode 100644
index 00000000..5fd29394
--- /dev/null
+++ b/web/messages/de/docs/post-install/customization.json
@@ -0,0 +1,74 @@
+{
+  "meta": {
+    "title": "Nach der Installation: Anpassung | ProxMenux-Dokumentation",
+    "description": "Anpassungen im anpassbaren ProxMenux-Skript nach der Installation: farbige Bash-Eingabeaufforderung mit nützlichen Aliasen, ProxMenux-Banner in der MOTD und Entfernung des Abonnementhinweises aus der Proxmox-Weboberfläche."
+  },
+  "header": {
+    "title": "Nach der Installation: Anpassung",
+    "description": "Optische und praktische Anpassungen für den Proxmox-Host. Sie machen die Shell angenehmer und blenden den Abonnementhinweis in der Weboberfläche aus. Bashrc, MOTD und Abonnementbanner werden erfasst und lassen sich über Deinstallieren zurücksetzen.",
+    "section": "Einstellungen nach der Installation von Proxmox"
+  },
+  "intro": {
+    "title": "Was diese Kategorie abdeckt",
+    "body": "Drei kleine, unabhängige Optionen: eine <strong>farbige Bash-Eingabeaufforderung mit Aliasen</strong> für die root-Shell, ein einzeiliges <strong>MOTD-Banner</strong> bei SSH-Anmeldung und Entfernung des <strong>Popups „Kein gültiges Abonnement“</strong>, das Proxmox bei jeder Web-Anmeldung zeigt."
+  },
+  "bashrc": {
+    "heading": "bashrc anpassen",
+    "intro": "Injiziert einen kuratierten Block in <code>/root/.bashrc</code> mit einer farbigen Eingabeaufforderung, Zeitstempel-Historie, Standard-<code>ls</code>/<code>grep</code>-Aliasen und einem <code>source</code> für die Bash-Vervollständigung. Macht das Arbeiten über SSH spürbar angenehmer und macht deutlich, auf welchem Host Sie sich befinden, wenn Sie viele Tabs geöffnet haben.",
+    "writesTitle": "Was ProxMenux zu .bashrc hinzufügt",
+    "writesOutro": "Der Block wird durch die <code>PMX_CORE_BASHRC</code>-Marker begrenzt. Das Ausführen des Skripts ersetzt den vorherigen Block, anstatt ihn zu duplizieren. Die ursprüngliche <code>.bashrc</code> wird einmal auf <code>/root/.bashrc.bak</code> gesichert, und eine <code>source /root/.bashrc</code>-Zeile wird an <code>/root/.bash_profile</code> angehängt, so dass die Aufforderung auch für Login-Shells gilt (z. B. nach <code>su -</code>).",
+    "rootTitle": "Gilt nur für root",
+    "rootBody": "Die Anpassung zielt auf die Shell des Root-Kontos ab. Andere Benutzer, die Sie auf dem Host erstellen, behalten ihre eigenen Standardeinstellungen. Wenn Sie Proxmox ausschließlich über die Web-Benutzeroberfläche verwalten und niemals die Shell verwenden, ist diese Option reine Ästhetik und Sie können sie überspringen."
+  },
+  "motd": {
+    "heading": "Richten Sie ein benutzerdefiniertes MOTD-Banner ein",
+    "intro": "Stellt <em>\"This system is optimised by: ProxMenux\"</em> an den Anfang von <code>/etc/motd</code>, der Nachricht nach erfolgreicher SSH-Anmeldung oberhalb der Shell-Eingabeaufforderung und vor den <code>update-motd</code>-Skripten. Harmlos und rein informativ — als schnelle sichtbare Bestätigung, dass ProxMenux auf diesem Host angewendet wurde.",
+    "writesTitle": "Was ProxMenux schreibt",
+    "writesOutro": "Bei der ersten Anwendung erfasst ProxMenux, ob <code>/etc/motd</code> existierte und speichert seinen ursprünglichen Inhalt unter <code>/usr/local/share/proxmenux</code>. Die Operation ist idempotent: Wenn die Markierungslinie bereits vorhanden ist, wird nichts hinzugefügt. Ältere Anlagen mit einem vorhandenen <code>/etc/motd.bak</code> werden in den gleichen reversiblen Zustand migriert."
+  },
+  "banner": {
+    "heading": "Abonnementbanner entfernen",
+    "intro": "Entfernt den Dialog <em>„Sie haben kein gültiges Abonnement für diesen Server“</em>, der bei jeder Anmeldung ohne Enterprise-Abonnement in der Proxmox-Weboberfläche erscheint. ProxMenux berücksichtigt die Version und startet das passende Skript für die unterschiedlichen UI-Pakete der Hauptversionen.",
+    "versionTitle": "Skriptauswahl nach Version",
+    "versionItems": [
+      "<strong>PVE 9.x</strong> führt <code>remove-banner-pve-v3.sh</code> aus (patcht sowohl die Desktop-<code>proxmoxlib.js</code> als auch die neue Yew-basierte mobile Benutzeroberfläche).",
+      "<strong>PVE 8.x</strong> führt <code>remove-banner-pve8.sh</code> aus (nur auf dem Desktop)."
+    ],
+    "versionOutro": "Vor dem Patchen sichert ProxMenux die ursprünglichen JS/Template-Dateien mit einem Zeitstempel auf <code>/usr/local/share/proxmenux/backups/</code>. Der Deinstallationsfluss verwendet diese Backups, um die Originaldateien wiederherzustellen, und greift auf die Neuinstallation der Proxmox-Benutzeroberflächenpakete zurück, wenn das Backup fehlt oder beschädigt ist.",
+    "breakTitle": "Kann nach Proxmox Updates brechen",
+    "breakBody": "Proxmox-UI-Updates überschreiben regelmäßig <code>proxmoxlib.js</code>, wodurch der Hinweis zurückkehren kann. Sie können die Option danach erneut anwenden oder den Hinweis bis dahin hinnehmen. ProxMenux installiert außerdem einen APT-Hook zum automatischen erneuten Patchen bei Paket-Upgrades. Unter <link>Optimierungen deinstallieren</link> erfahren Sie, wie dieser Hook entfernt wird.",
+    "legalTitle": "Rechtliche Anmerkung (immer wiederholenswert)",
+    "legalBody": "Diese Option blendet nur den UI-Hinweis aus. Sie gewährt <strong>keinen</strong> Enterprise-Support oder Zugriff auf das Enterprise-Repository und ändert die Softwarelizenz nicht. Proxmox VE wird unter GNU AGPLv3 veröffentlicht. Ein Abonnement unterstützt das Projekt und ermöglicht den Enterprise-Updatekanal. Wählen Sie eine passende Supportstufe für Ihre Umgebung."
+  },
+  "verify": {
+    "heading": "Verifizierung",
+    "intro": "Nach Anwendung aller drei:",
+    "reversibleTitle": "Alle drei Anpassungsänderungen werden verfolgt",
+    "reversibleBody": "<link>Optimierungen deinstallieren</link> stellt <code>/root/.bashrc</code> wieder her, gibt MOTD zu seinem genauen Pre-ProxMenux-Inhalt zurück (oder entfernt die Datei, wenn sie vorher nicht existierte) und stellt die gepatchten UI-Dateien aus dem Backup wieder her oder installiert die betroffenen Proxmox-Pakete bei Bedarf neu."
+  },
+  "related": {
+    "heading": "Verwandte Themen",
+    "items": [
+      {
+        "label": "Fakultativ",
+        "href": "/docs/post-install/optional",
+        "tail": " — Fastfetch und Figurine, weitere visuelle Anpassungen."
+      },
+      {
+        "label": "Versionsinformationen anzeigen",
+        "href": "/docs/settings/show-version-information",
+        "tail": " — bestätigt, dass die Anpassungen als installiert erfasst sind."
+      },
+      {
+        "label": "Optimierungen deinstallieren",
+        "href": "/docs/post-install/uninstall",
+        "tail": " — bashrc, motd und Abonnementhinweis zurücksetzen."
+      },
+      {
+        "label": "Anpassbare Nachinstallation",
+        "href": "/docs/post-install/customizable",
+        "tail": " — zurück zum übergeordneten Menü."
+      }
+    ]
+  }
+}
diff --git a/web/messages/de/docs/post-install/index.json b/web/messages/de/docs/post-install/index.json
new file mode 100644
index 00000000..badbeab7
--- /dev/null
+++ b/web/messages/de/docs/post-install/index.json
@@ -0,0 +1,106 @@
+{
+  "meta": {
+    "title": "Proxmox VE Post-Install-Script — Automatisiert und anpassbar | ProxMenux",
+    "description": "Überblick über die ProxMenux-Skripte nach der Installation von Proxmox VE. Das automatische Skript wendet sinnvolle Vorgaben ohne Rückfragen an. Mit dem anpassbaren Skript wählen Sie gezielt aus 10 Kategorien. Unter Optimierungen deinstallieren können unterstützte reversible Änderungen zurückgesetzt werden.",
+    "ogTitle": "Proxmox VE Post-Install-Script — Automatisiert und anpassbar",
+    "ogDescription": "Übliche Proxmox VE-Postinstallationsoptimierungen in 10-Kategorien anwenden - automatisiert oder à la carte mit reversiblen Optionen.",
+    "twitterTitle": "Proxmox VE Post-Install-Script | ProxMenux",
+    "twitterDescription": "Automatisierte und anpassbare Nachinstallationsoptimierungen für Proxmox VE – mit reversiblen Optionen."
+  },
+  "header": {
+    "title": "Post-Install Skripte",
+    "description": "Konfigurieren Sie einen neuen Proxmox VE-Host mit den ProxMenux-Optimierungen nach der Installation. Wenden Sie die Baseline automatisch an, wählen Sie einzelne Optionen aus, aktualisieren Sie installierte Funktionen oder stellen Sie unterstützte reversible Änderungen wieder her. Paket-Upgrades werden nicht als reversibel dargestellt.",
+    "section": "Einstellungen nach der Installation von Proxmox"
+  },
+  "intro": {
+    "title": "Wozu dieses Menü dient",
+    "body": "Direkt nach der Installation von Proxmox VE machen Dutzende kleine Änderungen den Host schneller und leichter wartbar: Repositories ohne Abonnement, sinnvolle journald-Limits und TCP-Puffer, SSD-schonende Protokollspeicherung, bashrc-Verbesserungen und mehr. ProxMenux automatisiert sie und erfasst die unterstützten reversiblen Konfigurationsänderungen."
+  },
+  "openingMenu": {
+    "heading": "Öffnen des Menüs",
+    "body": "Wählen Sie im Hauptmenü von ProxMenux <strong>Einstellungen nach der Installation von Proxmox</strong>. Folgendes wird angezeigt:",
+    "imageAlt": "Menü für Skripte nach der Installation: Automatisch, Anpassbar, der bedingte Eintrag Verfügbare Updates anwenden (nur bei ausstehenden Updates) und Deinstallieren, gefolgt von Community-Skripten"
+  },
+  "threeWays": {
+    "heading": "Vier Möglichkeiten, Optimierungen anzuwenden",
+    "body": "Die vier ProxMenux-Einträge nutzen denselben Code und dasselbe Register installierter Werkzeuge, bieten aber unterschiedliche Kontrolle. <em>Verfügbare Updates anwenden</em> erscheint nur, wenn für mindestens eine installierte Optimierung eine neuere Version auf dem Datenträger liegt als die registrierte. Direkt nach der Einrichtung bleibt der Eintrag verborgen."
+  },
+  "routes": [
+    {
+      "title": "Automatisch",
+      "description": "Eine sorgfältig ausgewählte Gruppe von 14 sicheren, stets nützlichen Optimierungen, die nacheinander ohne Rückfragen angewendet werden. Eine gute Vorgabe für die meisten Benutzer.",
+      "bullets": [
+        "Repositories ohne Abonnement + Systemupgrade",
+        "Speicher, Kernel, Netzwerk-Tuning",
+        "Log2RAM (automatisch auf SSD/NVMe erkannt)",
+        "Journald + Logrotate-Größenbeschränkungen",
+        "Persistente Schnittstellennamen"
+      ]
+    },
+    {
+      "title": "Anpassbar",
+      "description": "Etwa 35 einzelne Optimierungen in 10 Kategorien. Sie wählen genau aus, welche angewendet werden. Dieselbe Grundlage wie Automatisch, aber mit voller Kontrolle.",
+      "bullets": [
+        "Auswahllisten pro Kategorie",
+        "Enthält alle Funktionen von Automatisch plus ausdrücklich auswählbare Optionen (IOMMU, Fastfetch, Figurine, Ceph, HA, AMD-Korrekturen …)",
+        "Beliebig oft ausführbar — die Änderungen sind idempotent"
+      ]
+    },
+    {
+      "title": "Verfügbare Updates anwenden",
+      "description": "Liegt eine Nachinstallationsoptimierung (Log2Ram, Speichereinstellungen, Logrotate …) auf dem Datenträger in einer neueren Version vor als der auf dem Host erfassten, zeigt dieser Menüpunkt nur die betroffenen Optimierungen an. Er führt die jeweilige Funktion erneut aus und aktualisiert den gespeicherten Versionsstand. Alles andere bleibt unverändert.",
+      "bullets": [
+        "Jede Optimierung einzeln auswählen (nur geänderte)",
+        "Dieselbe Auswahl ist im Monitor-Dashboard verfügbar",
+        "Eine gemeinsame Benachrichtigung, wenn neue Updates verfügbar werden"
+      ]
+    },
+    {
+      "title": "Optimierungen deinstallieren",
+      "description": "Unterstützte rückgängig machbare Änderungen werden in einer JSON-Datei erfasst und mit einer Wiederherstellungsfunktion verknüpft. Aktionen ohne sichere Rückkehrmöglichkeit, etwa ein vollständiges Paketupgrade, sind bewusst ausgeschlossen.",
+      "bullets": [
+        "Erkennt zuvor angewendete Optimierungen automatisch",
+        "Wählt für jeden Eintrag den passenden Rückweg: aus einem vorhandenen .bak-Backup wiederherstellen, den sysctl.d-Konfigurationsausschnitt löschen, wenn keine Sicherung nötig war, oder das unveränderte Originalpaket mit --force-confnew neu installieren (z. B. beim Abonnementbanner)",
+        "Neustartabfrage bei Bedarf (VFIO, persistente Namen usw.)"
+      ]
+    }
+  ],
+  "whichTitle": "Welches sollten Sie wählen?",
+  "whichBody": "Bei einer neuen Proxmox-Installation mit sinnvollen Grundeinstellungen ohne Entscheidungen: <autoLink><strong>Automatisch</strong></autoLink>. Wenn Sie die gewünschten oder unerwünschten Anpassungen schon kennen: <customLink><strong>Anpassbar</strong></customLink>. Für eine bereits angewendete Optimierung, deren neuere Version auf dem Datenträger liegt: <updatesLink><strong>Verfügbare Updates anwenden</strong></updatesLink>. Zum sauberen Zurücksetzen früherer Änderungen: <uninstallLink><strong>Optimierungen deinstallieren</strong></uninstallLink>. Sie können kombinieren: zuerst Automatisch, dann unter Anpassbar Optionen wie Fastfetch oder IOMMU hinzufügen und später einzelne Einträge zurücksetzen.",
+  "mixing": {
+    "heading": "Mischen mit anderen Post-Installation-Scripts",
+    "stackTitle": "Stapeln Sie nicht mehrere Post-Installationsskripte",
+    "stackBody": "Das Ausführen mehrerer Post-Installationsskripte auf demselben Host kann doppelte Konfigurationsdateien, widersprüchliche sysctl-Einträge oder, schlimmer noch, defekte Netzwerke nach dem Neustart verursachen. Wenn Sie das <strong>Helper-Scripts Post Install</strong> bereits angewendet haben, können sich einige ProxMenux-Optimierungen mit dem bereits konfigurierten überschneiden. Bleiben Sie bei einem Post-Installations-Tool pro Host.",
+    "xshokTitle": "xshok-proxmox: veraltet",
+    "xshokBody": "Frühere Versionen von ProxMenux verwies auf <a>xshok-proxmox</a> als Begleitwerkzeug nach der Installation. Dieses Projekt ist jetzt veraltet und wird nicht mehr von ProxMenux angeboten. Wenn ein früherer Lauf von xshok-proxmox Markierungen auf dem Host hinterlassen hat, erkennt ProxMenux sie immer noch und wird Sie warnen - aber es ist nicht etwas, das Sie heute neben ProxMenux installieren sollten."
+  },
+  "community": {
+    "heading": "Gemeinschaftsskripte",
+    "body": "Das Menü bietet zwei Drittanbieterskripte aus dem Projekt <a>community-scripts</a>: <em>Proxmox VE Post Install</em> und <em>Proxmox VE Microcode</em>. Die Wrapper laden die Originalskripte mit <code>wget | bash</code> herunter und führen sie aus. ProxMenux pflegt sie nicht. Lesen Sie vor der Ausführung <link>Externe Repositories</link> für Details und Hinweise zur Vertrauenswürdigkeit."
+  },
+  "related": {
+    "heading": "Verwandte Themen",
+    "items": [
+      {
+        "label": "Proxmox-Systemupdate",
+        "href": "/docs/utils/system-update",
+        "tail": " — hält den Host nach der Ersteinrichtung aktuell."
+      },
+      {
+        "label": "Sicherheit",
+        "href": "/docs/security",
+        "tail": "- Fail2Ban + Lynis oben auf der Nachinstallationshärtung."
+      },
+      {
+        "label": "Versionsinformationen anzeigen",
+        "href": "/docs/settings/show-version-information",
+        "tail": " — zeigt, welche Komponenten nach der Installation als installiert erfasst sind."
+      },
+      {
+        "label": "Befehle für Updates und Pakete",
+        "href": "/docs/help-info/update-commands",
+        "tail": " — Referenz für apt / pveupgrade."
+      }
+    ]
+  }
+}
diff --git a/web/messages/de/docs/post-install/monitoring.json b/web/messages/de/docs/post-install/monitoring.json
new file mode 100644
index 00000000..c8e67925
--- /dev/null
+++ b/web/messages/de/docs/post-install/monitoring.json
@@ -0,0 +1,56 @@
+{
+  "meta": {
+    "title": "Nach der Installation: Überwachung | ProxMenux-Dokumentation",
+    "description": "Überwachungsoptionen im ProxMenux anpassbaren Post-Installationsskript. Derzeit eine einzige Option: OVH Real-Time Monitoring (RTM) installieren, das nur aktiviert wird, wenn der Host als OVH-Server erkannt wird."
+  },
+  "header": {
+    "title": "Nach der Installation: Überwachung",
+    "description": "Überwachungsoptionen im anpassbaren Skript nach der Installation. Diese kleine, anbieterspezifische Kategorie installiert den OVH-Real-Time-Monitoring-Agenten auf dedizierten OVH-Servern und tut auf anderen Hosts nichts.",
+    "section": "Einstellungen nach der Installation von Proxmox"
+  },
+  "intro": {
+    "title": "Zweckgebundener enger Anwendungsbereich",
+    "body": "Die Überwachung nach der Installation beschränkt sich auf <strong>einen anbieterspezifischen Agenten</strong>. Allgemeine Überwachung mit Prometheus, Grafana oder node_exporter gehört nicht dazu, da Entscheidungen über einen separaten Host, Datenaufbewahrung und Alarmziele nicht in einen Ein-Klick-Schritt passen. Der mitgelieferte ProxMenux Monitor erfüllt den Großteil dieser Aufgabe ohne externen Agenten."
+  },
+  "ovh": {
+    "heading": "Installation von OVH Real-Time Monitoring (RTM)",
+    "intro": "Wenn Ihr Proxmox-Host ein dedizierter Server ist, der von <a>OVHcloud</a> gemietet wird, können Sie RTM aktivieren, um Hardware-Telemetrie (CPU-Temperatur, PSU-Status, Festplatte SMART, RAID-Controller-Zustand usw.) dem OVH-Bedienfeld auszusetzen. Dies ist der gleiche Agent, den OVH für seine eigene \"Server Monitoring\" -Funktion verwendet.",
+    "decisionsTitle": "Wie ProxMenux entscheidet",
+    "decisionsItems": [
+      "Ermittelt die öffentliche IP-Adresse des Hosts mit <code>curl ipinfo.io/ip</code>.",
+      "Sucht den besitzenden ISP mit einer <code>whois</code>-Abfrage zu <code>v4.whois.cymru.com</code> nach.",
+      "Wenn das Ergebnis OVH nennt, lädt es <code>last-public-ovh-infra-yak.snap.mirrors.ovh.net/yak/archives/apply.sh</code> herunter und leitet es mit dem Puppet-Manifest für RTM v2 an <code>bash</code> weiter.",
+      "Wenn im Ergebnis OVH <em>nicht</em> erwähnt wird, ist nichts installiert. Die Option ist eine No-Op."
+    ],
+    "remoteTitle": "Remote-Skript per Pipe an bash übergeben",
+    "remoteBody": "Die Installation läuft <code>wget -qO - https://…apply.sh | bash</code>. Wenn der OVH-Spiegel jemals kompromittiert wird, wird das Skript als root auf Ihrem Host ausgeführt. Bevor Sie diese Option aktivieren, entscheiden Sie, ob Sie der Spiegelkette von OVH mehr vertrauen als der Überwachung, die Sie erhalten. Für die meisten Heimlabor- oder Nicht-OVH-Benutzer sollte diese Option einfach ausgeschaltet bleiben.",
+    "noOpTitle": "Nur aktivieren, wenn der Host tatsächlich bei OVH ist",
+    "noOpBody": "Die Option ist ein No-Op auf Nicht-OVH-Servern, so dass das Ankreuzen auf einem Heimlabor Proxmox nichts kaputt macht. Auf einem Nicht-OVH-Host druckt das Skript <em>\"Kein OVH-Server, überspringt die RTM-Installation\"</em> und verlässt es sauber; es werden keine Pakete installiert.",
+    "runsTitle": "Was ProxMenux ausführt",
+    "verifyTitle": "Verifizierung",
+    "verifyBody": "Auf einem echten OVH-Host sollten Sie nach einem Neustart das <a>RTM-Dashboard</a> in Ihrem OVH-Manager sehen, das mit Live-Daten für den Host gefüllt ist. Auf der Proxmox-Seite ist der RTM-Sammler ein systemd-Service - überprüfen Sie es direkt:",
+    "troubleTitle": "Fehlerbehebung",
+    "revertTitle": "RTM über das Menü Deinstallieren entfernen",
+    "revertBody": "Ist RTM als installiert registriert, bietet Optimierungen deinstallieren einen Eintrag für OVH Real-Time Monitoring. Er führt <code>apt-get purge -y ''ovh-rtm*'' ''rtm'' ''rtm-*''</code> aus, löscht /etc/rtm und markiert RTM als deinstalliert. Puppet-Reste müssen eventuell manuell bereinigt werden; prüfen Sie RTM-spezifische Manifeste unter <code>/etc/puppet/</code>. Auf einem Nicht-OVH-Host wurden keine RTM-Pakete installiert, daher ist nichts zu entfernen."
+  },
+  "related": {
+    "heading": "Verwandte Themen",
+    "items": [
+      {
+        "label": "ProxMenux Monitor",
+        "href": "/docs/settings/proxmenux-monitor",
+        "tail": "- lokales Web-Dashboard für den Host (funktioniert bei jedem Anbieter, nicht nur OVH)."
+      },
+      {
+        "label": "Nützliche Systembefehle",
+        "href": "/docs/help-info/system-commands",
+        "tail": "– Referenz zur Überwachung des lokalen Hosts."
+      },
+      {
+        "label": "Anpassbare Nachinstallation",
+        "href": "/docs/post-install/customizable",
+        "tail": " — zurück zum übergeordneten Menü."
+      }
+    ]
+  }
+}
diff --git a/web/messages/de/docs/post-install/network.json b/web/messages/de/docs/post-install/network.json
new file mode 100644
index 00000000..f07772a3
--- /dev/null
+++ b/web/messages/de/docs/post-install/network.json
@@ -0,0 +1,128 @@
+{
+  "meta": {
+    "title": "Post-Install: Netzwerk | ProxMenux Dokumentation",
+    "description": "Netzwerkoptionen im anpassbaren Nachinstallationsskript von ProxMenux: APT über IPv4 erzwingen, ein abgestimmtes sysctl-Profil anwenden, Open vSwitch installieren, TCP BBR + Fast Open aktivieren und Schnittstellennamen an MAC-Adressen binden."
+  },
+  "header": {
+    "title": "Post-Install: Netzwerk",
+    "section": "Einstellungen nach der Installation von Proxmox"
+  },
+  "intro": {
+    "title": "Was diese Kategorie abdeckt",
+    "body": "Fünf unabhängige Netzwerkoptionen: Zwei sind einfach (<strong>APT über IPv4</strong>, <strong>Open vSwitch installieren</strong>), zwei passen das TCP-Verhalten an (<strong>Netzwerk-sysctl-Profil</strong>, <strong>BBR + Fast Open</strong>). Eine behebt ein häufiges Betriebsproblem: <strong>Schnittstellennamen fest zuweisen</strong>, damit eine neue Netzwerkkarte oder ein BIOS-Update <code>enp3s0</code> nicht in <code>enp4s0</code> umbenennt und Ihre Bridges unterbricht."
+  },
+  "ipv4": {
+    "heading": "Erzwingen Sie, dass APT IPv4 verwendet",
+    "intro": "Schreibt <code>Acquire::ForceIPv4 \"true\";</code> in <code>/etc/apt/apt.conf.d/99-force-ipv4</code>. APT weigert sich dann, IPv6 für Paketdownloads zu verwenden, auch wenn der Host über IPv6-Konnektivität verfügt.",
+    "tipTitle": "Wer profitiert",
+    "tipBody": "Hilfreich bei instabilen oder gegenüber IPv4 langsameren IPv6-Verbindungen oder wenn der Debian-/Proxmox-Spiegel gelegentlich über IPv6 ausfällt. Auf Hosts ohne IPv6 unproblematisch. In einem funktionierenden Dual-Stack-Netz sorgt es für vorhersehbares Verhalten: apt überrascht Sie nicht mit einer IPv6-Zeitüberschreitung."
+  },
+  "sysctl": {
+    "heading": "Netzwerkoptimierungen anwenden",
+    "intro": "Schreibt ein abgestimmtes sysctl-Profil nach <code>/etc/sysctl.d/99-network.conf</code>. Es umfasst Socket-Puffer des Kernels, ICMP-Härtung, grundlegenden Schutz vor Adressfälschung und TCP-Puffergrößen für einen Hypervisor mit vielen gleichzeitigen Datenströmen.",
+    "tunedTitle": "Was angepasst wird",
+    "headerArea": "Thema",
+    "headerSettings": "Schlüsseleinstellungen",
+    "rows": [
+      {
+        "area": "Socket-Puffer des Kernels",
+        "settings": "<code>netdev_max_backlog=8192</code>, <code>rmem_max=16M</code>, <code>wmem_max=16M</code>, <code>somaxconn=8192</code>"
+      },
+      {
+        "area": "ICMP-Härtung",
+        "settings": "<code>icmp_echo_ignore_broadcasts=1</code>, <code>icmp_ignore_bogus_error_responses=1</code>"
+      },
+      {
+        "area": "Routing-Sicherheit",
+        "settings": "<code>accept_redirects=0</code>, <code>accept_source_route=0</code>, <code>secure_redirects=0</code>, <code>send_redirects=0</code>, <code>log_martians=0</code>"
+      },
+      {
+        "area": "Rückwärtspfadfilter",
+        "settings": "<code>rp_filter=2</code> (lockerer Modus, siehe Hinweis unten)"
+      },
+      {
+        "area": "TCP",
+        "settings": "<code>tcp_mtu_probing=1</code>, <code>tcp_rfc1337=1</code>, <code>tcp_sack=1</code>, <code>tcp_rmem=8K/87K/16M</code>, <code>tcp_wmem=8K/64K/16M</code>"
+      },
+      {
+        "area": "Ports",
+        "settings": "<code>ip_local_port_range=1024 65535</code> (Bereich kurzlebiger Ports)"
+      },
+      {
+        "area": "Unix-Sockets",
+        "settings": "<code>net.unix.max_dgram_qlen=4096</code>"
+      }
+    ],
+    "sourceOutro": "Es fügt auch <code>source /etc/network/interfaces.d/*</code> zu <code>/etc/network/interfaces</code> hinzu, wenn nicht bereits vorhanden - Standardpraxis, so dass Sie modulare Schnittstellensnippets ablegen können, ohne die Hauptdatei zu bearbeiten.",
+    "fwbrTitle": "Automatisches Tuning von virtuellen Firewall Bridges",
+    "fwbrBody": "Zusätzlich zum sysctl-Profil installiert ProxMenux das Hilfsskript <code>/usr/local/sbin/proxmenux-fwbr-tune</code>. Es setzt <code>rp_filter=0</code> und <code>log_martians=0</code> für die Schnittstellen <code>fwbr*</code> / <code>fwln*</code> / <code>fwpr*</code> / <code>tap*</code>, die Proxmox für VMs und Container erstellt. Die einmalig ausgeführte Unit <code>proxmenux-fwbr-tune.service</code> ruft es beim Booten auf, die Regel <code>/etc/udev/rules.d/99-zz-proxmenux-fwbr-tune.rules</code> bei jedem <code>net add</code>-Ereignis mit diesen Präfixen. So werden auch bei VM-Start/-Stopp, Neustart und Live-Migration neu erstellte Schnittstellen erfasst. Direkt nach der Installation verarbeitet das Skript zudem alle bereits vorhandenen Schnittstellen.",
+    "rpFilterTitle": "Warum rp_filter=2 (lose) statt 1 (streng)",
+    "rpFilterBody": "Strenge Rückwärtspfadfilterung verwirft Pakete, deren Quelladresse über eine <em>andere</em> Schnittstelle erreichbar wäre. Das ist ein sinnvoller Standard für Clients, kann aber auf einem Proxmox-Host Probleme verursachen: VM-Verkehr kommt häufig über eine Bridge an und geht bei asymmetrischem Routing über einen Uplink hinaus. <code>rp_filter=2</code> (locker) verwirft nur Pakete mit tatsächlich nicht erreichbaren Quelladressen. Der Kompromiss: etwas geringere Erkennung lokaler IP-Adressfälschung, dafür ein funktionierendes VM-Netz."
+  },
+  "ovs": {
+    "heading": "Open vSwitch installieren",
+    "intro": "Installiert <code>openvswitch-switch</code> + <code>openvswitch-common</code>. Damit steht OVS als Alternative zu den standardmäßigen Linux-Bridges von Proxmox bereit. Die Installation allein ändert keine Netzwerkkonfiguration; vorhandene <code>vmbrX</code>-Bridges funktionieren weiter. Wenn Sie eine neue Bridge <em>erstellen</em>, können Sie OVS im Typ-Auswahlmenü der Proxmox-Oberfläche wählen.",
+    "tipTitle": "Wenn OVS Sinn macht",
+    "tipBody": "Ziehen Sie OVS in Betracht, wenn Sie <strong>VLAN-Trunking mit nicht zusammenhängenden VLAN-IDs</strong>, <strong>LACP mit LLDP in bestimmten Modi</strong>, <strong>feingranulare Programmierung von Datenflüssen</strong> (OpenFlow) oder die Zusammenarbeit mit SDN-Controllern benötigen. Für ein Heimlabor mit wenigen VLANs und einem LACP-Uplink sind Linux-Bridges + <code>vmbrX.VID</code> einfacher und gut geeignet.",
+    "revertTitle": "Reversibel aus dem Menü Deinstallieren",
+    "revertBody": "OVS wird erfasst. <link>Optimierungen deinstallieren</link> führt <code>apt purge</code> für <code>openvswitch-switch</code> und <code>openvswitch-common</code> aus. Migrieren Sie OVS-Bridges <em>vor</em> der Deinstallation zu Linux-Bridges, sonst verlieren die VMs darauf beim nächsten Start die Netzwerkanbindung. Manuelles Äquivalent:"
+  },
+  "bbr": {
+    "heading": "TCP BBR + TCP Fast Open aktivieren",
+    "intro": "Schreibt zwei sysctl-Dateien und lädt sie neu. BBR ersetzt CUBIC durch Googles bandbreitenbasierten Überlastungsalgorithmus, der Verbindungen mit hoher Kapazität und Latenz sowie verlustbehaftete Verbindungen besser verarbeitet. TCP Fast Open (TFO) spart bei wiederholten TCP-Verbindungen einen Umlauf, indem bereits der SYN Daten mitführt.",
+    "verifyTitle": "Verifizierung",
+    "impactTitle": "Die Wirkung hängt von der Arbeitslast ab",
+    "impactBody": "BBR ist bei hoher Latenz oder Paketverlust besonders hilfreich (kontinentübergreifende Replikation, VPN-Tunnel, mobile Clients). Im LAN zwischen zwei Rechnern am selben Switch liegt der Unterschied oft innerhalb der Messschwankungen. TFO hilft besonders bei kurzen, wiederholten HTTP-Verbindungen.",
+    "revertTitle": "Reversibel aus dem Menü Deinstallieren",
+    "revertBody": "BBR/TFO werden erfasst. <link>Optimierungen deinstallieren</link> entfernt die zwei sysctl-Dateien (<code>/etc/sysctl.d/99-kernel-bbr.conf</code> und <code>99-tcp-fastopen.conf</code>) und lädt die übrige Konfiguration neu. Das Löschen setzt aktive Kernelwerte nicht automatisch zurück. Standards wie <code>cubic</code> und <code>tcp_fastopen=1</code> gelten nach einem Neustart, sofern keine andere Konfiguration sie überschreibt. Manuelles Äquivalent:"
+  },
+  "names": {
+    "heading": "Schnittstellennamen (persistent)",
+    "intro": "Durchläuft alle physischen Netzwerkkarten des Hosts (überspringt Loopback, Docker-veths, Bridges, TAP-Geräte, Bonds, Cilium, ZeroTier und WireGuard). Für jede schreibt es eine systemd-<code>.link</code>-Datei, die den aktuellen Namen an die aktuelle MAC-Adresse bindet. Damit hat die MAC-Zuordnung Vorrang vor der Namenslogik des Kernels.",
+    "whyTitle": "Warum das wichtig ist",
+    "whyItems": [
+      "Das Hinzufügen oder Entfernen von PCIe-Geräten kann die Busnummerierung verschieben und <code>enp3s0</code> in <code>enp4s0</code> verwandeln. Wenn Ihr <code>/etc/network/interfaces</code> auf den alten Namen verweist, verschwindet die Brücke beim Neustart.",
+      "BIOS / Firmware-Updates ändern manchmal, wie Geräte aufgezählt werden, mit dem gleichen Effekt.",
+      "Das Hilfsskript schreibt <code>.link</code>-Dateien für physische Netzwerkkarten, auch für Bond-Ports, mit der MAC, die sysfs gerade meldet; bei Bond-Ports kann das die gemeinsame MAC des Bonds sein, prüfen Sie ihre Namen daher nach einem Neustart. Virtuelle Schnittstellen wie LXC-veth-Geräte und die Bond-Geräte selbst werden übersprungen. Namenskonflikte virtueller <code>hotplug</code>-NICs behebt es nicht."
+    ],
+    "writtenTitle": "Was geschrieben wird",
+    "writtenIntro": "Eine Datei pro physischem NIC, bei <code>/etc/systemd/network/10-proxmenux-&lt;iface&gt;.link</code>. Jede Datei beginnt mit dem Header <code># Managed by ProxMenux — do not edit</code>, so dass ProxMenux seine eigenen Dateien von benutzer- oder paketgebundenen <code>.link</code>-Dateien unterscheiden kann.",
+    "writtenOutro": "<code>.link</code>-Dateien anderer Pakete oder des Benutzers bleiben erhalten; nur Dateien mit ProxMenux-Header werden verwaltet. Bei erneutem Ausführen gleicht die Funktion ihren Bestand ab: Sie liest <code>MACAddress=</code> aus jeder <code>10-proxmenux-*.link</code> und entfernt Dateien, deren MAC unter <code>/sys/class/net/</code> nicht mehr vorkommt. Dateien älterer ProxMenux-Versionen im Format <code>10-&lt;iface&gt;.link</code> werden beim ersten Lauf automatisch migriert.",
+    "pveTitle": "PVE 9 vs PVE 8",
+    "pveBody": "Das Skript nutzt systemd-<code>.link</code>-Dateien für feste Namen. Auf Proxmox VE 9 lädt es danach zusätzlich udev-Regeln neu, damit eine bereits festgelegte NIC, die erneut angeschlossen oder erkannt wird, ihre Regel ohne Neustart übernimmt. Prüfen Sie vorhandene Schnittstellen nach einem Neustart auf PVE 8 und PVE 9. Der Host bleibt bei <code>ifupdown2</code>. In beiden Fällen setzt das Skript das Neustart-Flag, damit die anpassbare Nachinstallation danach fragt.",
+    "reviewTitle": "Überprüfen Sie zuerst bestehende /etc/network/interfaces",
+    "reviewBody": "Verweist die ältere Konfiguration in <code>/etc/network/interfaces</code> auf automatisch vom Kernel erzeugte NIC-Namen, ist das Festschreiben der <em>aktuellen</em> Namen sinnvoll. Haben Sie die Konfiguration bereits manuell an bestimmte Namen angepasst, prüfen Sie vor dem Neustart sorgfältig, ob die festen Namen mit der interfaces-Datei übereinstimmen.",
+    "revertTitle": "Reversibel aus dem Menü Deinstallieren",
+    "revertBody": "<link>Optimierungen deinstallieren</link> löscht nur <code>10-proxmenux-*.link</code>-Dateien mit ProxMenux-Header aus <code>/etc/systemd/network/</code>. Jede vom Benutzer oder anderen Paketen hinzugefügte <code>.link</code>-Datei bleibt erhalten. Beim nächsten Neustart gilt wieder das Standard-Namensverhalten von systemd."
+  },
+  "related": {
+    "heading": "Verwandte Themen",
+    "items": [
+      {
+        "label": "Netzwerkmanagement",
+        "href": "/docs/network",
+        "tail": " — Diagnose, Bridge-Analyse und geführte Reparaturen."
+      },
+      {
+        "label": "Persistente Schnittstellennamen",
+        "href": "/docs/network/persistent-names",
+        "tail": " — dieselbe Funktion später als eigener Menüpunkt; verwenden Sie eine der beiden Möglichkeiten."
+      },
+      {
+        "label": "Referenz der Netzwerkbefehle",
+        "href": "/docs/help-info/network-commands",
+        "tail": " — ip, ss, ethtool, sysctl."
+      },
+      {
+        "label": "Optimierungen deinstallieren",
+        "href": "/docs/post-install/uninstall",
+        "tail": " — diese Netzwerkänderungen rückgängig machen."
+      },
+      {
+        "label": "Anpassbare Nachinstallation",
+        "href": "/docs/post-install/customizable",
+        "tail": " — zurück zum übergeordneten Menü."
+      }
+    ]
+  }
+}
diff --git a/web/messages/de/docs/post-install/optional.json b/web/messages/de/docs/post-install/optional.json
new file mode 100644
index 00000000..ea729e99
--- /dev/null
+++ b/web/messages/de/docs/post-install/optional.json
@@ -0,0 +1,177 @@
+{
+  "meta": {
+    "title": "ProxMenux Post-Install: Optionale Einstellungen",
+    "description": "Anleitung zu optionalen Einstellungen im ProxMenux-Skript nach der Installation für zusätzliche Proxmox VE-Funktionen und -Optimierungen.",
+    "ogTitle": "ProxMenux Post-Install: Optionale Einstellungen",
+    "ogDescription": "Anleitung zu optionalen Einstellungen im ProxMenux-Skript nach der Installation für zusätzliche Proxmox VE-Funktionen und -Optimierungen.",
+    "ogImageAlt": "ProxMenux Optionale Einstellungen nach der Installation"
+  },
+  "title": "Optionale Einstellungen",
+  "intro": "Die Kategorie <strong>Optionale Einstellungen</strong> bietet zusätzliche Funktionen und Optimierungen für Ihre Proxmox-VE-Installation. Sie sind nicht unbedingt erforderlich, können aber in bestimmten Situationen die Fähigkeiten des Systems erweitern.",
+  "available": "Verfügbare optionale Funktionen",
+  "stepLabel": "Schritt",
+  "ceph": {
+    "title": "Aktuelle Ceph Unterstützung hinzufügen",
+    "intro": "Diese Option installiert die neueste Ceph-Speichersystemunterstützung für Proxmox VE. Ceph ist ein verteiltes Speichersystem, das hohe Leistung, Zuverlässigkeit und Skalierbarkeit bietet.",
+    "doesIntro": "Was sie tut:",
+    "doesItems": [
+      "Fügt das Ceph-Repository zu Ihrem System hinzu",
+      "Paketlisten aktualisieren",
+      "Installiert Ceph-Pakete mit dem Befehl 'pveceph install'",
+      "Überprüft die Installation"
+    ],
+    "howUse": "Verwendung: Nach der Installation können Sie den Ceph-Speicher mit der Proxmox VE-Weboberfläche oder den Befehlszeilentools konfigurieren und verwalten.",
+    "automates": "Diese Anpassung automatisiert die folgenden Befehle:"
+  },
+  "amd": {
+    "title": "AMD-CPU-Korrekturen anwenden",
+    "intro": "Diese Option wendet spezifische Korrekturen für AMD EPYC und Ryzen CPUs an, um die Stabilität und Kompatibilität zu verbessern.",
+    "doesIntro": "Was sie tut:",
+    "doesItems": [
+      "Erkennen, ob ein AMD EPYC oder Ryzen CPU vorhanden ist",
+      "Wendet den Kernelparameter 'idle=nomwait' an, um zufällige Abstürze zu verhindern (über /etc/kernel/cmdline auf systemd-Boot-Hosts oder /etc/default/grub auf GRUB-Hosts — mit einem .bak des Originals)",
+      "Konfiguriert KVM, um bestimmte MSRs (Model Specific Registers) für eine bessere Windows-Gastkompatibilität zu ignorieren"
+    ],
+    "howUse": "Verwendung: Diese Fixes werden automatisch angewendet und erfordern einen Systemneustart.",
+    "automates": "Diese Anpassung automatisiert die folgenden Befehle:"
+  },
+  "ha": {
+    "title": "Hochverfügbarkeitsdienste ermöglichen",
+    "intro": "Diese Option ermöglicht High Availability (HA)-Dienste in Proxmox VE und ermöglicht ein automatisches Failover von VMs und Containern im Falle eines Knotenausfalls.",
+    "doesIntro": "Was sie tut:",
+    "doesItems": [
+      "Aktiviert und startet den Dienst pve-ha-lrm (Local Resource Manager)",
+      "Aktiviert und startet den pve-ha-crm (Cluster Resource Manager) Service",
+      "Aktiviert und startet den corosync-Dienst für die Clusterkommunikation"
+    ],
+    "howUse": "Verwendung: Nach Aktivierung dieser Dienste können Sie HA-Gruppen und -Ressourcen in der Proxmox VE-Weboberfläche konfigurieren.",
+    "automates": "Diese Anpassung automatisiert die folgenden Befehle:"
+  },
+  "pveam": {
+    "title": "Proxmox VE Appliance Manager aktualisieren",
+    "intro": "Aktualisiert den lokalen Index der Containervorlagen, den <code>pveam</code> in der Proxmox-Oberfläche bereitstellt. So ist die Liste der verfügbaren Softwarevorlagen beim nächsten Erstellen eines LXC aktuell.",
+    "doesIntro": "Was sie tut:",
+    "doesItems": [
+      "Führt <code>pveam update</code> gegen die Proxmox-Spiegelserver aus, um den aktuellen Katalog der Softwarevorlagen abzurufen",
+      "Füllt die Liste der Softwarevorlagen in der Weboberfläche beim Erstellen eines Containers"
+    ],
+    "howUse": "Verwendung: Einmal ausführen, wenn die Vorlagenliste in der Oberfläche veraltet wirkt oder Sie den Spiegelserver gewechselt haben. Es lädt nur den Katalogindex herunter, nicht die Vorlagen selbst.",
+    "automates": "Diese Anpassung automatisiert den folgenden Befehl:"
+  },
+  "fastfetch": {
+    "title": "Installieren und Konfigurieren von Fastfetch",
+    "intro": "Diese Option installiert und konfiguriert leise Fastfetch, ein Systeminformationstool, das Systemspezifikationen und ein benutzerdefiniertes Logo beim Login anzeigt.",
+    "doesLabel": "Was sie tut:",
+    "doesItems": [
+      "Lädt und installiert die neueste Fastfetch-Version ohne zusätzliche Rückfragen",
+      "Ermöglicht Ihnen die Auswahl eines benutzerdefinierten Logos (<strong>ProxMenux, Proxmox, Helper-Scripts, Home-Labs-Club, Proxmology</strong> oder ein benutzerdefiniertes).",
+      "Konfiguriert Fastfetch zur Anzeige von <em>\"System optimiert durch ProxMenux\"</em>",
+      "Richtet Fastfetch so ein, dass es automatisch bei der Konsolenanmeldung ausgeführt wird"
+    ],
+    "importantLabel": "Wichtig:",
+    "importantBody": "Wenn Sie sich über SSH mit Proxmox verbinden, sollten Sie das <strong>Proxmox</strong>-Logo auswählen oder ein benutzerdefiniertes mit <code>jp2a</code> oder <code>img2txt</code> erstellen. Die anderen Logos werden mit <code>chafa</code> generiert und werden in einer Standard-SSH-Sitzung möglicherweise nicht korrekt angezeigt.",
+    "customLabel": "Eigene Logos:",
+    "customBody1": "Um ein benutzerdefiniertes Logo zu verwenden, legen Sie Ihre ASCII-Kunsttextdatei in: <code>/usr/local/share/fastfetch/logos/</code>",
+    "customBody2": "Sie können benutzerdefinierte Logos mit Tools wie <code>chafa</code>, <code>jp2a</code> oder <code>img2txt</code> erstellen.",
+    "customBody3": "Für beste Ergebnisse:",
+    "customItems": [
+      "Halten Sie die Logohöhe auf 35-Linien oder weniger, um Proportionen beizubehalten und in das Terminal zu passen",
+      "Verwenden Sie <code>chafa</code> für Farblogos (in SSH-Sitzungen möglicherweise nicht korrekt angezeigt)",
+      "Verwenden Sie <code>jp2a</code> oder <code>img2txt</code> für SSH-kompatible Logos"
+    ],
+    "examplesLabel": "Beispiel Logos:",
+    "logos": [
+      {
+        "name": "ProxMenux",
+        "alt": "ProxMenux-Logo",
+        "src": "https://macrimi.github.io/ProxMenux/fastfetch/proxmenux.png"
+      },
+      {
+        "name": "Proxmox",
+        "alt": "Proxmox-Logo",
+        "src": "https://macrimi.github.io/ProxMenux/fastfetch/proxmox.png"
+      },
+      {
+        "name": "JC Channel",
+        "alt": "JC-Channel-Logo",
+        "src": "/fastfetch/jc-channel.png"
+      },
+      {
+        "name": "Helper-Scripts",
+        "alt": "Helper-Scripts-Logo",
+        "src": "https://macrimi.github.io/ProxMenux/fastfetch/helper-scripts.png"
+      },
+      {
+        "name": "Home-Labs-Club",
+        "alt": "Home-Labs-Club-Logo",
+        "src": "https://macrimi.github.io/ProxMenux/fastfetch/home-labs-club.png"
+      },
+      {
+        "name": "Proxmology",
+        "alt": "Proxmology-Logo",
+        "src": "https://macrimi.github.io/ProxMenux/fastfetch/proxmology.png"
+      }
+    ],
+    "automates": "Diese Anpassung automatisiert die folgenden Befehle:"
+  },
+  "figurine": {
+    "title": "Installieren und Konfigurieren von Figurine",
+    "intro": "Diese Option installiert und konfiguriert Figurine, ein Tool, das stilvolle ASCII-Textbanner für Ihr Terminal erstellt und Ihren Hostnamen in einem optisch ansprechenden 3D-Format anzeigt.",
+    "doesLabel": "Was sie tut:",
+    "doesItems": [
+      "Lädt Figurine v2.1.1 von GitHub herunter und installiert die passende Version für die Host-Architektur (AMD64, ARM64 oder ARMv7)",
+      "Erstellen Sie eine Begrüßungsnachricht, die Ihren Hostnamen in 3D ASCII-Kunst anzeigt, wenn Sie sich anmelden",
+      "Aktualisiert eine vorhandene Figurine-Programmdatei erst nach erfolgreichem Download und Entpacken",
+      "Richtet die Willkommensnachricht so ein, dass sie automatisch beim Login ausgeführt wird"
+    ],
+    "practicalLabel": "Praktische Verwendung:",
+    "practicalBody": "Beim Verwalten mehrerer Proxmox-Knoten in einem Cluster bietet Figurine eine sofortige visuelle Anzeige, an welchem Knoten Sie gerade angemeldet sind. Dies verhindert versehentliche Befehle auf dem falschen Knoten und verbessert Ihren Workflow bei der Verwaltung mehrerer Server.",
+    "exampleLabel": "Beispielausgabe:",
+    "imageAlt": "Figurine Beispielausgabe",
+    "automates": "Diese Anpassung automatisiert den folgenden Prozess:",
+    "outro": "Nach der Installation wird Ihr Hostname bei jeder Anmeldung in 3D ASCII-Kunst angezeigt, wodurch sofort klar wird, an welchem Proxmox-Knoten Sie arbeiten."
+  },
+  "log2ram": {
+    "title": "Log2RAM installieren (SSD/NVMe Verschleißreduzierung)",
+    "intro": "Log2RAM bindet <code>/var/log</code> als tmpfs-RAM-Disk ein und synchronisiert regelmäßig auf den Datenträger. Das Puffern häufiger journald-Schreibvorgänge im RAM kann SSD-Verschleiß und Datenträger-I/O verringern. Synchronisierung und sauberes Herunterfahren sichern die Logs; bei abruptem Stromausfall können Einträge seit der letzten Synchronisierung verloren gehen.",
+    "upstreamLabel": "Vorgelagertes Projekt:",
+    "upstreamUrl": "https://github.com/azlux/log2ram",
+    "upstreamLinkLabel": "azlux/log2ram auf GitHub",
+    "doesLabel": "Was ProxMenux tut:",
+    "doesItems": [
+      "Erkennt anhand von <code>/sys/block/&lt;dev&gt;/queue/rotational</code>, ob die Systemplatte SSD/NVMe ist. Bei einer rotierenden Festplatte fragt die automatisierte Variante vor der Installation nach.",
+      "Klont das Originalprojekt (<code>azlux/log2ram</code>) nach <code>/tmp/log2ram</code> und passt <code>install.sh</code> an: <code>rsync -aAXv</code> wird durch <code>rsync -aXv --no-acls</code> ersetzt. Dadurch wird der Fehler <em>set_acl: Operation not supported</em> mit Exitcode 23 vermieden, der beim Verschieben von /var/log auf Dateisystemen ohne ACL-Unterstützung auftreten kann. Die systemd-Unit <code>log2ram</code> wird nach Installation aktiviert.",
+      "Größe der Ramdisk auf Basis des Hosts RAM: <code>≤ 8 GB → 128M</code>, <code>≤ 16 GB → 256M</code>, <code>&gt; 16 GB → 512M</code>. Schreibt den Wert in <code>SIZE=</code> in <code>/etc/log2ram.conf</code>.",
+      "Plant eine regelmäßige Datenträgersynchronisierung über <code>/etc/cron.d/log2ram</code>: alle 1 / 3 / 6 Stunden entsprechend derselben RAM-Stufe.",
+      "Installiert den Schutz <code>/usr/local/bin/log2ram-check.sh</code>, der über <code>/etc/cron.d/log2ram-auto-sync</code> alle 10 Minuten läuft. Bei 80% Belegung von <code>/var/log</code> bereinigt er journald. Bei 92% führt er zunächst <code>logrotate -f /etc/logrotate.d/proxmox-backup-api</code> aus, falls die Datei existiert: Die PBS-API-Logs sind oft der größte Platzverbraucher auf einem PBS-Host. Danach kürzt er <code>pveproxy access/error</code> und <code>pveam.log</code> vor der Synchronisierung. <code>log2ram write</code> allein kopiert tmpfs auf Disk, verkleinert es aber nicht. Der Schutz hilft gegen PVE-Ausfälle mit <em>No space left on device</em> durch unkontrolliertes Logwachstum.",
+      "Erkennt den Dienst <code>proxmox-backup-server</code> auf dem Host. Falls vorhanden, erstellt es <code>/etc/logrotate.d/proxmox-backup-api</code> (20 MB × 3 Rotationen) und <code>/etc/cron.hourly/proxmox-backup-logrotate</code>, damit die häufig stark wachsenden PBS-API-Logs auch zwischen Log2RAM-Synchronisierungen begrenzt werden. Ohne PBS erfolgt keine Änderung.",
+      "Stellt systemd-journald-Grenzwerte (<code>SystemMaxUse</code>, <code>RuntimeMaxUse</code>) so ein, dass sie in die Ramdisk passen, so dass ein einzelner Burst sie nicht füllen kann.",
+      "Wird in <code>installed_tools.json</code> erfasst und kann über Optimierungen deinstallieren rückgängig gemacht werden."
+    ],
+    "howUseLabel": "Wie zu verwenden:",
+    "howUseBody": "Die automatisierte Variante installiert Log2RAM unbeaufsichtigt bei erkanntem SSD-/NVMe-Systemlaufwerk. Die anpassbare Variante fragt nach Größe, Intervall und Auto-Sync-Schutz. Die Abfrage nennt derzeit 90%, das erzeugte Skript nutzt jedoch 80% für Bereinigung und 92% für die oben beschriebene intensive Bereinigung.",
+    "verifyLabel": "Überprüfen und Verwalten aus der Shell:",
+    "verifyCode": "# Service state and configured timers\nsystemctl status log2ram\nsystemctl list-timers log2ram*\n\n# Current ramdisk usage — /var/log IS the tmpfs itself\ndf -h /var/log\n\n# Force a sync now (tmpfs → disk); does NOT shrink the tmpfs\nlog2ram write\n\n# Trigger the auto-sync guard on demand (vacuum + sync when usage is high)\n/usr/local/bin/log2ram-check.sh\n\n# Current config: SIZE, mail settings, path\ncat /etc/log2ram.conf\n\n# ProxMenux-specific cron jobs\ncat /etc/cron.d/log2ram /etc/cron.d/log2ram-auto-sync\n\n# Recent Log2RAM activity\njournalctl -u log2ram -n 50 --no-pager"
+  },
+  "zram": {
+    "title": "ZRAM-Swap-Profil aktivieren",
+    "intro": "Erstellt das komprimierte Swap-Gerät <code>/dev/zram0</code> im RAM mit <code>systemd-zram-generator</code>. Ausgelagerte Speicherseiten werden mit zstd komprimiert und im RAM gehalten, bevor Swap auf dem Datenträger genutzt wird.",
+    "doesLabel": "Was sie tut:",
+    "doesItems": [
+      "Installiert <code>systemd-zram-generator</code>, wenn es fehlt, und zeichnet auf, ob ProxMenux es installiert hat.",
+      "Schreibt <code>/etc/systemd/zram-generator.conf.d/90-proxmenux.conf</code>: ein <code>zram0</code>-Gerät mit einem Zehntel des Host-RAMs, zstd-Komprimierung (<code>zstd(level=9)</code> mit systemd-zram-generator ab 1.2.0) und Swap-Priorität 32767.",
+      "Mit dieser Priorität füllt der Kernel zuerst ZRAM. Ein vorhandener Swap auf der Festplatte behält seine eigene Priorität und nimmt die Seiten, die nicht mehr in ZRAM passen.",
+      "Sucht vor Änderungen nach einer anderen ZRAM-Konfiguration: aktivem zram-Swap, zram-Eintrag in <code>/etc/fstab</code>, systemd-Unit oder anderer Generatordatei. Wird eine gefunden, bricht die Option ab und lässt sie unverändert.",
+      "Startet <code>dev-zram0.swap</code> und überprüft, ob das aktive Gerät mit dem Profil übereinstimmt. Wenn nicht, wird der vorherige Zustand wiederhergestellt.",
+      "Wird in <code>installed_tools.json</code> erfasst und kann über Optimierungen deinstallieren rückgängig gemacht werden."
+    ],
+    "howUseLabel": "Wie zu verwenden:",
+    "howUseBody": "Diese Option gibt es nur in der anpassbaren Variante; die automatisierte wendet sie nicht an. Das Gerät wird bei jedem Start neu erstellt. Solange es aktiv ist, zeigt die Karte „Arbeitsspeicher“ in ProxMenux Monitor Kapazität, belegten Swap, Algorithmus, Kompressionsverhältnis und tatsächlichen RAM-Verbrauch.",
+    "verifyLabel": "Überprüfen Sie von der Shell:",
+    "verifyCode": "# Active swap devices and their priority\nswapon --show\n\n# ZRAM device: algorithm, size and compressed data\nzramctl\n\n# Profile written by ProxMenux\ncat /etc/systemd/zram-generator.conf.d/90-proxmenux.conf\n\n# State of the swap unit\nsystemctl status dev-zram0.swap"
+  },
+  "autoApplication": {
+    "title": "Automatische Anwendung",
+    "body": "Wählen Sie in der anpassbaren Variante die optionalen Funktionen nach Bedarf. Log2RAM gehört mit Hardwareerkennung auch zur automatisierten Variante; ZRAM bleibt ausschließlich anpassbar. Die Abschnitte erläutern Abfragen und Voraussetzungen."
+  }
+}
diff --git a/web/messages/de/docs/post-install/performance.json b/web/messages/de/docs/post-install/performance.json
new file mode 100644
index 00000000..c891c190
--- /dev/null
+++ b/web/messages/de/docs/post-install/performance.json
@@ -0,0 +1,61 @@
+{
+  "meta": {
+    "title": "Nach der Installation: Leistung | ProxMenux-Dokumentation",
+    "description": "Leistungsoptionen im anpassbaren ProxMenux-Skript nach der Installation. Ersetzt das einsträngige gzip durch pigz (paralleles gzip) für schnellere Backups und Komprimierung auf Hosts mit mehreren Kernen."
+  },
+  "header": {
+    "title": "Nach der Installation: Leistung",
+    "description": "Leistungsoptionen innerhalb des anpassbaren Post-Installationsskripts. Derzeit enthält diese Kategorie eine einzige Optimierung: Ersetzen von gzip durch pigz, so dass Backups und Kompression jeden CPU-Kern anstelle von einem verwenden.",
+    "section": "Einstellungen nach der Installation von Proxmox"
+  },
+  "intro": {
+    "title": "Was diese Kategorie abdeckt",
+    "body": "Die einzige Leistungsoption hier leitet das gzip des Systems auf eine parallele Implementierung um. Andere Leistungsanpassungen wie Speicheroptimierung, E/A-Scheduling, ZFS-ARC-Größe und Kernel-Limits finden Sie in ihren Kategorien (<em>System</em>, <em>Speicher</em>), da sie andere Subsysteme betreffen."
+  },
+  "pigz": {
+    "heading": "Verwenden Sie pigz für eine schnellere GZIP-Komprimierung",
+    "intro": "Standard-<code>gzip</code> komprimiert Daten mit <strong>einem einzigen CPU-Kern</strong>. Auf modernen Proxmox-Hosts mit 8, 16 oder 32 Kernen ist das ein großer Engpass bei VM-/CT-Backups mit <code>vzdump</code>, Logrotation und allen Vorgängen über <code>gzip</code>. <a>pigz</a> ist ein direkt einsetzbarer paralleler Ersatz: dieselbe gzip-kompatible Ausgabe, aber auf alle Kerne verteilte Arbeit.",
+    "doesTitle": "Was ProxMenux tut",
+    "doesIntro": "Fünf Schritte, alle idempotent:",
+    "doesItems": [
+      "Setzt <code>pigz: 1</code> in <code>/etc/vzdump.conf</code>, so dass das Backup-Tool von Proxmox pigz nativ verwendet.",
+      "Installiert das Paket <code>pigz</code> apt, falls nicht bereits vorhanden.",
+      "Schreibt ein Wrapper-Script bei <code>/bin/pigzwrapper</code>, das jedes Argument an <code>/usr/bin/pigz</code> weiterleitet.",
+      "Registriert eine dpkg-Umleitung für das Systemprogramm <code>gzip</code> (<code>/usr/bin/gzip</code> bei Proxmox VE 9, <code>/bin/gzip</code> bei Proxmox VE 8). Die Originaldatei bleibt daneben als <code>gzip.distrib</code> erhalten und wird durch den Wrapper ersetzt. Danach verwendet <em>alles</em>, was <code>gzip</code> aufruft — logrotate, <code>tar czf</code>, Skripte und vzdump — transparent pigz.",
+      "Prüft, ob die als <code>gzip.distrib</code> gespeicherte Datei ein funktionierender Gzip ist, bevor der Wrapper installiert wird, und installiert das <code>gzip</code>-Paket zuerst neu, wenn dies nicht der Fall ist. Ein Host, der noch den früheren <code>/bin/gzip.original</code>-Swap hat, wird in die Umleitung verschoben, wenn die Option erneut angewendet wird."
+    ],
+    "replacesTitle": "Ersetzt ein Systemprogramm",
+    "replacesBody": "Ein Wrapper anstelle von <code>gzip</code> ist ungewöhnlich. Das ist sicher, da der Wrapper gzip-kompatible Ausgabe erzeugt. Skripte mit fest kodierten Pfaden, in restriktiven chroot-Umgebungen oder mit Prüfung von Binärdatei-Hashes können sich jedoch anders verhalten. Das Original bleibt als <code>gzip.distrib</code> erhalten. Durch die dpkg-Umleitung aktualisieren Updates des Pakets <code>gzip</code> und das Upgrade von Proxmox VE 8 auf 9 diese Datei, während der Wrapper erhalten bleibt.",
+    "revertTitle": "Reversibel aus dem Menü Deinstallieren",
+    "revertBody": "Diese Optimierung wird erfasst. <link>Optimierungen deinstallieren</link> kopiert das Original aus <code>gzip.distrib</code> über den Wrapper, entfernt die Umleitung und <code>pigzwrapper</code>, kommentiert die Zeile <code>pigz</code> in <code>/etc/vzdump.conf</code> aus und führt nach erfolgreicher gzip-Prüfung <code>apt purge pigz</code> aus. Manuelles Äquivalent für Proxmox VE 9:",
+    "verifyTitle": "Verifizierung",
+    "verifyBody": "Nach der Anwendung sollte <code>gzip --version</code> pigz erwähnen. Ein schneller Benchmark zeigt auch den Geschwindigkeitsunterschied auf einem Multi-Core-Host:",
+    "whenTitle": "Wenn das am wichtigsten ist",
+    "whenBody": "Der Nutzen wächst mit der <strong>Anzahl der CPU-Kerne</strong> und der <strong>Häufigkeit der Backups</strong>. Auf einem Heimlaborrechner mit 2 Kernen und einem täglichen vzdump ist der Vorteil gering. Auf einem Produktionshost mit 16 Kernen, der jede Nacht ein Dutzend VMs sichert, kann pigz das Backup-Zeitfenster auf einen Bruchteil der Zeit von einsträngigem gzip verkürzen."
+  },
+  "related": {
+    "heading": "Verwandte Themen",
+    "items": [
+      {
+        "label": "Backup- und Wiederherstellungsbefehle",
+        "href": "/docs/help-info/backup-commands",
+        "tailRich": " — vzdump-CLI-Referenz einschließlich der Thread-Option <code>--pigz</code>."
+      },
+      {
+        "label": "Speicher",
+        "href": "/docs/post-install/storage",
+        "tail": " — Geschwindigkeitsgrenzen für vzdump und ZFS-ARC-Anpassungen."
+      },
+      {
+        "label": "System",
+        "href": "/docs/post-install/system",
+        "tail": " — Anpassung von Dateideskriptoren und Speicher."
+      },
+      {
+        "label": "Anpassbare Nachinstallation",
+        "href": "/docs/post-install/customizable",
+        "tail": " — zurück zum übergeordneten Menü."
+      }
+    ]
+  }
+}
diff --git a/web/messages/de/docs/post-install/security.json b/web/messages/de/docs/post-install/security.json
new file mode 100644
index 00000000..361346ab
--- /dev/null
+++ b/web/messages/de/docs/post-install/security.json
@@ -0,0 +1,57 @@
+{
+  "meta": {
+    "title": "Post-Install: Sicherheit | ProxMenux Dokumentation",
+    "description": "Sicherheitsoptionen im anpassbaren ProxMenux-Skript nach der Installation. Derzeit eine Option: den Dienst portmapper/rpcbind deaktivieren, um die Angriffsfläche des Hosts zu reduzieren."
+  },
+  "header": {
+    "title": "Post-Install: Sicherheit",
+    "section": "Einstellungen nach der Installation von Proxmox"
+  },
+  "intro": {
+    "title": "Was diese Kategorie abdeckt",
+    "body": "Die Sicherheit nach der Installation beschränkt sich auf <strong>Host-Härtung, die sicher unbeaufsichtigt angewendet werden kann</strong>: selten benötigte Dienste deaktivieren und dies über Deinstallieren wieder rückgängig machen. Aktive Sicherheitswerkzeuge wie Fail2Ban zur Einbruchsverhinderung und Lynis für Audits finden Sie unter <em>Sicherheit</em> im ProxMenux-Hauptmenü, außerhalb der Nachinstallation."
+  },
+  "rpcbind": {
+    "heading": "Portmapper/rpcbind deaktivieren",
+    "intro": "<code>rpcbind</code> (früher <code>portmap</code>) ordnet RPC-Programmnummern Netzwerkports zu. NFS und einige ältere RPC-Werkzeuge sind davon abhängig. Auf einem typischen Proxmox-Host ohne NFS-Server <strong>nutzt es nichts</strong>; aktiviert bleibt Port <code>111/tcp</code> auf allen Schnittstellen offen.",
+    "whyTitle": "Warum es sich lohnt zu deaktivieren",
+    "whyItems": [
+      "Reduziert die Angriffsfläche des Hosts – ein Hördienst weniger, um den man sich Sorgen machen muss.",
+      "Historisch missbraucht als Reflexions- / Verstärkungsvektor in DDoS-Angriffen. Durch das Deaktivieren von <code>rpcbind</code> wird dieser Verstärkungsfaktor für Ihren Host entfernt.",
+      "Entfernt das Rauschen, das es in Protokollen und <code>netstat</code> / <code>ss</code> erzeugt, wodurch echte Aktivitäten leichter zu erkennen sind."
+    ],
+    "nfsTitle": "Deaktivieren Sie dies nicht, wenn Sie NFS verwenden",
+    "nfsBody": "NFS-Server <strong>und</strong> NFS-Client benötigen <code>rpcbind</code> zur Aushandlung der Ports für <code>mountd</code>, <code>statd</code>, <code>lockd</code> usw. Wenden Sie diese Option nicht an, wenn Ihr Proxmox-Host NFS-Freigaben <em>exportiert</em> oder NFS-Freigaben eines NAS <em>einbindet</em>. Das Einbinden schlägt sonst mit <code>mount.nfs: rpc.statd is not running</code> oder ähnlichen Fehlern fehl.",
+    "runsTitle": "Was ProxMenux ausführt",
+    "runsOutro": "Das Paket bleibt installiert. ProxMenux zeichnet den ursprünglichen aktivierten/aktiven Zustand von rpcbind.service und rpcbind.socket auf und deaktiviert und stoppt dann beide Einheiten, so dass die Socket-Aktivierung den Dienst nicht zurückbringen kann.",
+    "verifyTitle": "Verifizierung",
+    "verifyBody": "Bestätigen Sie nach der Anwendung, dass <code>rpcbind</code> deaktiviert ist und nichts auf Port 111 zuhört:",
+    "reversibleTitle": "Wiederherstellen des ursprünglichen Service-Status",
+    "reversibleBody": "Die Änderung wird in <code>installed_tools.json</code> erfasst. <link>Optimierungen deinstallieren</link> setzt jede rpcbind-Einheit auf den zuvor aufgezeichneten aktivierten/deaktivierten und aktiven/inaktiven Zustand zurück. Dabei wird nicht vorausgesetzt, dass rpcbind auf jedem Host aktiviert war."
+  },
+  "related": {
+    "heading": "Verwandte Themen",
+    "items": [
+      {
+        "label": "Sicherheitsmenü",
+        "href": "/docs/security",
+        "tail": " — leistungsfähigere Werkzeuge: Fail2Ban (Einbruchsverhinderung) und Lynis (Audit)."
+      },
+      {
+        "label": "Lynis",
+        "href": "/docs/security/lynis",
+        "tail": "– Überprüfen Sie den Host, um weitere Möglichkeiten zur Härtung zu finden."
+      },
+      {
+        "label": "Nützliche Systembefehle",
+        "href": "/docs/help-info/system-commands",
+        "tail": " — Referenz für Dienststatus, journalctl und lynis audit."
+      },
+      {
+        "label": "Anpassbare Nachinstallation",
+        "href": "/docs/post-install/customizable",
+        "tail": " — zurück zum übergeordneten Menü."
+      }
+    ]
+  }
+}
diff --git a/web/messages/de/docs/post-install/storage.json b/web/messages/de/docs/post-install/storage.json
new file mode 100644
index 00000000..ea4710a1
--- /dev/null
+++ b/web/messages/de/docs/post-install/storage.json
@@ -0,0 +1,167 @@
+{
+  "meta": {
+    "title": "Nachinstallation: Speicher | ProxMenux Dokumentation",
+    "description": "Speicheroptimierungen im anpassbaren Nachinstallationsskript von ProxMenux: ZFS-ARC-Größe nach Host-RAM, regelmäßige Snapshots mit zfs-auto-snapshot und Entfernen der vzdump-Backup-Drosselung."
+  },
+  "header": {
+    "title": "Post-Installation: Speicher",
+    "section": "Einstellungen nach der Installation von Proxmox"
+  },
+  "intro": {
+    "title": "Was diese Kategorie abdeckt",
+    "body": "Vier Speicheroptimierungen: <strong>ZFS ARC</strong> auf einen sinnvollen Anteil des Host-RAMs abstimmen, <strong>automatische ZFS-Snapshots</strong> installieren und planen, <strong>ZFS autotrim</strong> auf SSD-/NVMe-Pools aktivieren und <strong>vzdump</strong> von Drosselungen befreien. Wählen Sie die unabhängigen Optionen passend zu Ihrem System. Als fünfte speichernahe Option reduziert <link>Log2RAM</link> SSD-/NVMe-Schreibvorgänge, indem es <code>/var/log</code> in eine RAM-Disk verschiebt. Es steht unter Optional, weil das anpassbare Menü es dort einordnet."
+  },
+  "trackedTitle": "Alle vier werden im Deinstallationsmenü erfasst",
+  "trackedBody": "Jede Option registriert ein Werkzeug in <code>installed_tools.json</code> für <link>Optimierungen deinstallieren</link>. <code>zfs_arc</code> entfernt <code>/etc/modprobe.d/99-zfsarc.conf</code> und erstellt initramfs neu; <code>zfs_auto_snapshot</code> entfernt den Cron-Zeitplan und bietet die vollständige Paketentfernung an; <code>zfs_autotrim</code> setzt <code>autotrim=off</code> auf den zuvor aktivierten Pools; <code>vzdump_speed</code> stellt <code>/etc/vzdump.conf</code> aus der bei Installation erstellten <code>.bak</code> wieder her.",
+  "arc": {
+    "heading": "ZFS ARC-Größe optimieren",
+    "intro": "Der <strong>Adaptive Replacement Cache (ARC)</strong> ist der ZFS-Lesecache im RAM. Proxmox-VE-Installationen ab 8.1 setzen 10% RAM mit maximal 16 GiB; ältere oder aktualisierte Hosts können abweichen. Diese Option schreibt genau diese Regel ausdrücklich (RAM/10, höchstens 16 GiB, mindestens 64 MiB) in eine eigene Datei und deckt so auch ältere oder aktualisierte Hosts ab. Prüfen Sie vorhandene Einstellungen und Arbeitslast; ein kleinerer Cache ist nicht immer schneller.",
+    "sizingTitle": "Größenregeln",
+    "headerRam": "Host-Arbeitsspeicher",
+    "headerMax": "ARC-Obergrenze",
+    "rows": [
+      {
+        "ram": "Formel",
+        "max": "RAM / 10, höchstens 16 GiB und mindestens 64 MiB"
+      },
+      {
+        "ram": "8 GB Host",
+        "max": "≈ 819 MiB (RAM/10)"
+      },
+      {
+        "ram": "16 GB Host",
+        "max": "≈ 1.6 GiB (RAM/10)"
+      },
+      {
+        "ram": "64 GB Host",
+        "max": "≈ 6.4 GiB (RAM/10)"
+      },
+      {
+        "ram": "≥ 160 GB Host",
+        "max": "16 GiB (Obergrenze)"
+      }
+    ],
+    "after": "Die Datei <code>/etc/modprobe.d/99-zfsarc.conf</code> enthält nur <code>options zfs zfs_arc_max=…</code>. Andere ZFS-Parameter (<code>zfs_arc_min</code>, L2ARC-Vorablesen/Schreibbegrenzung, TXG-Zeitlimit) werden nicht abgestimmt. Vorher prüft ein Abgleich andere <code>*.conf</code> in <code>/etc/modprobe.d/</code> auf <code>zfs_arc_min</code> / <code>zfs_arc_max</code>, sichert sie mit Manifest unter <code>/usr/local/share/proxmenux/backups/zfs_arc/</code> und entfernt daraus die widersprüchlichen Werte <code>zfs_arc_min</code> / <code>zfs_arc_max</code> (andere Optionen dieser Zeilen bleiben erhalten). Damit legt nur die ARC-Datei von ProxMenux den Grenzwert fest. Anschließend werden <code>update-initramfs -u -k all</code> und gegebenenfalls <code>proxmox-boot-tool refresh</code> ausgeführt, damit der Grenzwert auch im initramfs für ZFS-Root-Systeme ankommt.",
+    "rebootTitle": "Erfordert einen Neustart, um wirksam zu werden",
+    "rebootBody": "ARC-Einstellungen werden beim Laden des Kernelmoduls <code>zfs</code> gelesen. Für ZFS-Root-Hosts erzeugt ProxMenux initramfs mit <code>update-initramfs -u -k all</code> neu und aktualisiert bei Bedarf den Bootloader mit <code>proxmox-boot-tool refresh</code>. Der neue Modulparameter wird erst nach Neustart genutzt; das entsprechende Flag wird automatisch gesetzt.",
+    "safeTitle": "Sicher auf Nicht-ZFS-Hosts",
+    "safeBody": "Die Funktion schreibt die Konfiguration nur, wenn <code>zpool list</code> mindestens einen importierten ZFS-Pool meldet. Auf ext4 / LVM-only Proxmox-Hosts oder auf Maschinen, auf denen die ZFS-Tools installiert sind, aber kein Pool importiert wird, ist das Ankreuzen dieser Option ein No-Op - nichts wird geschrieben.",
+    "verifyTitle": "Verifizierung und manuelles Rollback"
+  },
+  "autoSnap": {
+    "heading": "ZFS-Auto-Snapshot installieren",
+    "intro": "Installiert <a>zfs-auto-snapshot</a> und schreibt die Cron-Zeitpläne für automatische Snapshots in mehreren Intervallen neu. Eine einfache zusätzliche Absicherung neben regulären vzdump-Backups.",
+    "cadenceTitle": "Von ProxMenux eingerichteter Snapshot-Zeitplan",
+    "headerLabel": "Etikett",
+    "headerRuns": "Ausführung",
+    "headerKept": "Snapshots behalten",
+    "rows": [
+      {
+        "label": "häufig",
+        "runs": "jede 15 min",
+        "kept": "4"
+      },
+      {
+        "label": "stündlich",
+        "runs": "jede Stunde",
+        "kept": "1"
+      },
+      {
+        "label": "täglich",
+        "runs": "einmal täglich",
+        "kept": "1"
+      },
+      {
+        "label": "wöchentlich",
+        "runs": "einmal pro Woche",
+        "kept": "1"
+      },
+      {
+        "label": "monatlich",
+        "runs": "einmal im Monat",
+        "kept": "1"
+      }
+    ],
+    "conservativeTitle": "Zurückhaltende Aufbewahrungszahlen",
+    "conservativeBody": "ProxMenux wird mit konservativer Aufbewahrung ausgeliefert (nur 4 häufig + 1 jedes längeren Intervalls), sodass der ZFS snapshot-Speicher nicht überlastet wird. Wenn Sie eine längere Aufbewahrung wünschen, bearbeiten Sie die Zahlen in <code>/etc/cron.d/zfs-auto-snapshot</code>, <code>/etc/cron.hourly/zfs-auto-snapshot</code> usw., nachdem das Skript ausgeführt wird.",
+    "onlyZfsTitle": "Nur nützlich für ZFS Pools",
+    "onlyZfsBody": "Die Installation des Pakets auf einem Ext4-Host ist harmlos, aber sinnlos - es gibt keine ZFS-Datensätze, die es zum Schnappschuss verwenden kann. Überspringen Sie diese Option, wenn Sie ZFS nicht verwenden.",
+    "verifyTitle": "Verifizierung und manuelles Rollback"
+  },
+  "autotrim": {
+    "heading": "ZFS-Autotrim aktivieren (SSD/NVMe-Pools)",
+    "intro": "Aktiviert <code>autotrim</code> auf ZFS-Pools ausschließlich mit TRIM-fähigen SSDs oder NVMe-Laufwerken. Pools mit rotierenden Laufwerken werden vorsorglich übersprungen. Vorhandenes <code>autotrim=on</code> bleibt unverändert.",
+    "trimTitle": "Was TRIM macht und warum es auf ZFS wichtig ist",
+    "trimBody1": "SSDs und NVMe-Laufwerke arbeiten intern mit Löschblöcken, die größer als die logischen Dateisystemsektoren sind. Nach dem Löschen einer Datei weiß das Laufwerk zunächst nicht, dass die Sektoren frei sind. Seine Speicherbereinigung kopiert daher eventuell unnötige Daten beim Freimachen weiterer Blöcke. <strong>TRIM</strong> meldet dem Laufwerk freie Sektoren, damit es sie vorab löschen kann.",
+    "trimBody2": "Ohne TRIM verschlechtert sich die SSD-Leistung im Laufe der Zeit, da das Laufwerk keine vorgelöschten Blöcke mehr hat und die Lösch-on-Write-Funktion ausführen muss, und die Schreibverstärkung steigt - beides verkürzt die Lebensdauer des Laufwerks. Wenn TRIM aktiviert ist, kann das Laufwerk einen gesunden Pool leerer Blöcke zum Schreiben bereithalten.",
+    "trimBody3": "Mit <code>autotrim=on</code> trimmt ZFS kürzlich freigegebenen Platz im Hintergrund und bündelt Bereiche. Regelmäßiges <code>zpool trim &lt;pool&gt;</code> ist eine Alternative. Autotrim spart einen eigenen Zeitplan, belastet Geräte aber unterschiedlich; regelmäßiges manuelles TRIM kann für einfachere Laufwerke besser sein.",
+    "practicalTitle": "Warum kann die Aktivierung nützlich sein?",
+    "practicalItems": [
+      "<strong>Dauerhafte Schreibleistung.</strong> TRIM kann ungenutzte Blöcke effizient freigeben helfen. Nutzen und Latenzauswirkungen hängen von Gerät und Arbeitslast ab.",
+      "<strong>Laufwerkslebensdauer.</strong> Weniger unnötige interne Kopien können Schreibverstärkung und NAND-Verschleiß verringern. Eine bestimmte zusätzliche Lebensdauer ist nicht garantiert.",
+      "<strong>Kein geplanter Cron-Job zum Erinnern.</strong> Im Gegensatz zu einem periodischen <code>zpool trim</code> ist Autotrim Fire-and-Forget - der Pool erledigt es selbstständig."
+    ],
+    "whenTitle": "Wann ist das notwendig?",
+    "whenIntro1": "<strong>Erwägen Sie die Aktivierung</strong> auf ZFS-Pools nur mit TRIM-fähigen SSD-/NVMe-Geräten. Prüfen Sie Verhalten und Latenz; geplantes manuelles TRIM kann geeigneter sein.",
+    "whenIntro2": "<strong>Das Skript überspringt es automatisch</strong> auf:",
+    "whenSkipItems": [
+      "Pools mit rotierenden HDD-vdevs — ein vorsichtiger Hardwarefilter dieses Skripts.",
+      "Laufwerke ohne in sysfs sichtbares <code>discard_granularity</code> — meist alte SSDs ohne TRIM oder Passthrough-Pfade, über die das Betriebssystem das zugrunde liegende Gerät nicht sieht.",
+      "Pools, in denen ZFS selbst die Eigenschaft nicht unterstützt meldet (selten; sehr alte Pools).",
+      "Pools bereits auf <code>autotrim=on</code> eingestellt (no-op)."
+    ],
+    "whenIntro3": "<strong>Nicht relevant für ext4-nur Hosts</strong> - es gibt nichts für ZFS zu trimmen. Die Funktion wird in diesem Fall mit einer freundlichen Nachricht beendet.",
+    "recordedTitle": "Warum nur von ProxMenux geänderte Pools erfasst werden",
+    "recordedBody": "Die Funktion schreibt einen Pool nur dann in seine interne Zustandsdatei (<code>/usr/local/share/proxmenux/zfs_autotrim_pools</code>), wenn er diesen Pool aktiv von <code>off</code> nach <code>on</code> umgedreht hat. Pools, die Sie vor dem Ausführen des Skripts auf Autotrim hatten, werden aus der Liste ausgeschlossen, so dass eine zukünftige Deinstallation die Einstellungen, die Sie selbst konfiguriert haben, nicht deaktiviert - nur die eigenen Änderungen von ProxMenux werden zurückgesetzt.",
+    "manualTitle": "Manuelles Äquivalent (auf Ihrem Server ausgeführt)",
+    "manualIntro": "Die vollständige Sequenz, die das Skript gegen jeden Pool läuft, ist von Hand replizierbar. Dies ist, was Sie eingeben würden, wenn Sie dasselbe in einem einzelnen Pool ohne ProxMenux tun möchten:",
+    "verifyTitle": "Verifizierung und manuelles Rollback",
+    "oneShotTitle": "Einmaliges TRIM statt Hintergrundaktivität?",
+    "oneShotBody": "Einige Betreiber bevorzugen eine manuelle Trimmung während Off-Peak-Stunden anstelle von kontinuierlichen Trimmaktivitäten. Deaktivieren Sie Autotrim und planen Sie einen Cron-Job, der <code>zpool trim &lt;pool&gt;</code> ausführt - gleiches Endziel, unterschiedliche Kadenz."
+  },
+  "vzdump": {
+    "heading": "Erhöhen Sie die Backup-Geschwindigkeit von vzdump",
+    "intro": "Schreibt bwlimit: 0 und ionice: 5 in die globale vzdump-Konfiguration. Proxmox hat bereits standardmäßig kein Bandbreitenlimit; nur ein vorhandenes Limit wird entfernt. Gegenüber ionice: 7 erhöht 5 die Best-Effort-I/O-Priorität, sofern der Scheduler sie beachtet. Das kann Gäste beeinflussen und garantiert keine schnelleren Backups.",
+    "changedTitle": "Was sich in /etc/vzdump.conf ändert",
+    "backupTitle": "Erster Durchlauf erstellt ein .bak von vzdump.conf",
+    "backupBody": "Beim ersten Ausführen kopiert ProxMenux <code>/etc/vzdump.conf</code> vor Änderungen nach <code>/etc/vzdump.conf.bak</code>. Spätere Läufe überschreiben diese Sicherung nicht; frühere manuelle Einstellungen bleiben wiederherstellbar. <code>bwlimit</code> und <code>ionice</code> werden mit <code>sed</code> geändert, andere Optionen wie compress, pigz, tmpdir und exclude-path bleiben erhalten.",
+    "skipTitle": "Wann man das überspringt",
+    "skipBody": "Auf einem Host mit langsamem lokalem Speicher und VMs, die latenzempfindlich sind, kann das Entfernen der Bandbreitenobergrenze zu spürbaren Verlangsamungen bei Backups führen. Wenn Sie aus diesem Grund zuvor einen bestimmten <code>bwlimit</code> festgelegt haben, behalten Sie ihn bei - überspringen Sie diese Option.",
+    "verifyTitle": "Verifizierung und manuelles Rollback"
+  },
+  "related": {
+    "heading": "Verwandte Themen",
+    "items": [
+      {
+        "label": "ZFS Verwaltungsbefehle",
+        "href": "/docs/help-info/zfs-commands",
+        "tail": "— zpool / zfs Referenz für ARC, Snapshots, Scrub."
+      },
+      {
+        "label": "Speicher- und Festplattenbefehle",
+        "href": "/docs/help-info/storage-commands",
+        "tail": "generische Blockgeräte und Proxmox-Speicherreferenz."
+      },
+      {
+        "label": "Backup- und Wiederherstellungsbefehle",
+        "href": "/docs/help-info/backup-commands",
+        "tail": " — vzdump-CLI-Referenz für Bandbreite und I/O-Priorität."
+      },
+      {
+        "label": "Optimierungen deinstallieren",
+        "href": "/docs/post-install/uninstall",
+        "tail": " — Änderungen an ARC / vzdump rückgängig machen."
+      },
+      {
+        "label": "Log2RAM",
+        "href": "/docs/post-install/optional#log2ram",
+        "tail": "- reduziert den Verschleiß von SSD/NVMe durch Ramdisk-Backing /var/log; dokumentiert unter Optional."
+      },
+      {
+        "label": "Anpassbare Nachinstallation",
+        "href": "/docs/post-install/customizable",
+        "tail": " — zurück zum übergeordneten Menü."
+      }
+    ]
+  }
+}
diff --git a/web/messages/de/docs/post-install/system.json b/web/messages/de/docs/post-install/system.json
new file mode 100644
index 00000000..476ac221
--- /dev/null
+++ b/web/messages/de/docs/post-install/system.json
@@ -0,0 +1,133 @@
+{
+  "meta": {
+    "title": "Post-Install: System | ProxMenux Dokumentation",
+    "description": "Systemoptimierungen im anpassbaren Nachinstallationsskript von ProxMenux: Größenbegrenzungen für journald und logrotate, höhere Kernel- und Dateideskriptorgrenzen, ausgewogene Speicherabstimmung, schnelle Neustarts mit kexec und Wiederherstellung nach Kernel-Panik."
+  },
+  "header": {
+    "title": "Nach der Installation: System",
+    "section": "Einstellungen nach der Installation von Proxmox"
+  },
+  "intro": {
+    "title": "Was diese Kategorie abdeckt",
+    "body": "Sechs unabhängige Systemoptimierungen. Sie stimmen <strong>journald</strong> und <strong>logrotate</strong> ab, damit Logs nicht die Platte füllen, erhöhen <strong>Kernel- und Dateideskriptorgrenzen</strong> für Anwendungen mit vielen offenen Dateien, sorgen für <strong>ausgewogene Speichernutzung</strong> auf einem Virtualisierungshost, ergänzen <strong>kexec</strong> für Neustarts ohne BIOS und konfigurieren <strong>automatische Wiederherstellung</strong> bei Kernel-Panik. Alle sechs werden erfasst und sind über das Deinstallationsmenü rückgängig zu machen."
+  },
+  "journald": {
+    "heading": "journald optimieren",
+    "intro": "Schreibt <code>/etc/systemd/journald.conf</code> mit sinnvollen Standardwerten neu, damit das systemd-Journal nicht nach und nach die Root-Partition füllt. Startet dann <code>systemd-journald</code> neu und bereinigt vorhandene Protokolle.",
+    "keyTitle": "Schlüsselwerte",
+    "keyItems": [
+      "<code>Storage=persistent</code> — Protokolle auf der Festplatte über Neustarts halten.",
+      "<code>SystemMaxUse=64M</code> / <code>RuntimeMaxUse=60M</code> — Grenzen für die Datenträger- und Speichernutzung des Journals.",
+      "<code>Compress=yes</code>, <code>Seal=no</code> — Logs komprimieren, kryptografische Vorwärtssicherung durch Versiegelung auslassen (spart CPU).",
+      "<code>MaxLevelStore=info</code> — info und höhere Schweregrade speichern. Erforderlich für den Logbetrachter von ProxMenux Monitor und damit Fail2Ban fehlgeschlagene SSH-/Proxmox-Anmeldungen im Journal erkennt.",
+      "Ratenbegrenzung: <code>1000 events / 30 s</code>, um eine Protokollflut zu vermeiden.",
+      "<code>ForwardToSyslog=no</code>, <code>ForwardToWall=no</code> - Duplizieren Sie keine Nachrichten in syslog oder senden Sie sie an Konsolen."
+    ],
+    "tipTitle": "Warum MaxLevelStore=info wichtig ist",
+    "tipBody": "Ein strengerer Schweregrad wie <code>warning</code> lässt ProxMenux Monitor in allen Zeiträumen fast dieselben Einträge zeigen, weil die meisten Aktivitäten auf Info-Ebene liegen. Fail2Ban kann dadurch fehlgeschlagene Anmeldungen übersehen. Begrenzen Sie die Menge stattdessen mit <code>SystemMaxUse</code> und <code>RateLimitBurst</code>, ohne die gespeicherten Schweregrade einzuschränken."
+  },
+  "logrotate": {
+    "heading": "Logrotate optimieren",
+    "intro": "Schreibt <code>/etc/logrotate.conf</code> mit globalen Tages- und Größeneinstellungen, 7 aufbewahrten Rotationen, Komprimierung und <code>copytruncate</code> neu, damit Dienste ohne erneutes Öffnen der Logs weiterschreiben. Die spätere Größeneinstellung hat Vorrang vor täglich, sofern keine einzelne Logregel sie überschreibt. Original <code>logrotate.conf</code> wird beim ersten Anwenden nach <code>.bak</code> gesichert.",
+    "tipTitle": "Für Log2RAM geeignet",
+    "tipBody": "Die Anweisung <code>size 10M</code> hat Vorrang vor der vorherigen Tageseinstellung; es gilt <em>nicht</em> das zuerst eintretende Kriterium. Logrotate prüft den Grenzwert beim Ausführen, und einzelne Logregeln können globale Werte überschreiben. Für Log2RAMs RAM-basiertes <code>/var/log</code> sollten Regeln und Timerfrequenz geprüft werden, um die Belegung zu steuern."
+  },
+  "limits": {
+    "heading": "Verschiedene Systemgrenzen erhöhen",
+    "intro": "Erhöht Kernel-, systemd- und PAM-Grenzen, deren Standardwerte für Hosts mit vielen VMs, Containern und Netzwerkdiensten zu niedrig sein können.",
+    "headerFile": "Datei",
+    "headerSets": "Was es setzt",
+    "rows": [
+      {
+        "file": "/etc/sysctl.d/99-maxwatches.conf",
+        "sets": "<code>fs.inotify.max_user_watches / max_user_instances / max_queued_events = 1048576</code>"
+      },
+      {
+        "file": "/etc/sysctl.d/99-maxkeys.conf",
+        "sets": "<code>kernel.keys.maxkeys / root_maxkeys = 1000000</code>"
+      },
+      {
+        "file": "/etc/sysctl.d/99-swap.conf",
+        "sets": "<code>vm.swappiness = 10</code>, <code>vm.vfs_cache_pressure = 100</code>"
+      },
+      {
+        "file": "/etc/sysctl.d/99-fs.conf",
+        "sets": "<code>fs.nr_open / file-max = 2097152</code>, <code>fs.aio-max-nr = 1048576</code>"
+      },
+      {
+        "file": "/etc/security/limits.d/99-limits.conf",
+        "sets": "<code>nofile</code> und <code>nproc</code> bis 1,048,576 (unbegrenzt für root)"
+      },
+      {
+        "file": "/etc/systemd/system.conf + user.conf",
+        "sets": "<code>DefaultLimitNOFILE=1048576</code> für systemd-Dienste"
+      },
+      {
+        "file": "/etc/pam.d/common-session + runuser-l",
+        "sets": "<code>session required pam_limits.so</code>, also gelten die oben genannten für Login-Shells"
+      },
+      {
+        "file": "/root/.profile",
+        "sets": "<code>ulimit -n 1048576</code> für die Root-Shell"
+      }
+    ],
+    "tipTitle": "Warum inotify wichtig ist",
+    "tipBody": "Docker, Syncthing, Node.js-Dateibeobachter und Plex-Bibliotheksscans können <code>max_user_watches</code> ausschöpfen. Der Standard hängt von Kernel und Host-RAM ab und ist nicht immer 8192. 1M erlaubt mehr Überwachungen, ohne sie vorab anzulegen. Aktive Überwachungen benötigen Kernel-Speicher; prüfen Sie die Nutzung auf speicherknappen Hosts."
+  },
+  "memory": {
+    "heading": "Optimieren der Speichereinstellungen",
+    "intro": "Schreibt ein ausgewogenes sysctl-Profil in <code>/etc/sysctl.d/99-memory.conf</code>. Entwickelt für einen Hypervisor-Host - bevorzugt es, VM-Arbeitssets in RAM zu halten und Seiten proaktiv freizugeben, damit Zuweisungsbursts nicht zum Stillstand kommen.",
+    "warnTitle": "swappiness=10 auf Hosts mit wenig freiem Speicher",
+    "warnBody": "Auf einem Host mit 16 GB RAM, auf dem viele VMs ausgeführt werden, kann die Senkung der Swappiness den Kernel zu OOM-Kill-Prozessen anstelle von Swaping bringen. Wenn Sie routinemäßig OOM-Ereignisse sehen, erhöhen Sie die Swappiness nach dem Ausführen des Skripts in <code>/etc/sysctl.d/99-memory.conf</code> auf 30–60."
+  },
+  "kexec": {
+    "heading": "Schnelle Neustarts ermöglichen (kexec)",
+    "intro": "Installiert <code>kexec-tools</code> und verkabelt es, so dass Sie den Host direkt in einen neuen Kernel <em> neu starten können, ohne die BIOS/UEFI-Firmware </em> zu durchlaufen. Auf großen Servern, auf denen POST 45 bis 90 Sekunden benötigt, verwandelt sich ein Neustart von einer Kaffeepause in einige Sekunden Ausfallzeit.",
+    "installsTitle": "Was ProxMenux installiert",
+    "installsItems": [
+      "Paket <code>kexec-tools</code> (debconf mit <code>kexec-tools/load_kexec boolean false</code> vorbeantwortet, damit apt nicht nachfragt und automatisches Laden beim Herunterfahren deaktiviert bleibt).",
+      "Systemd-Einheit <code>/etc/systemd/system/kexec-pve.service</code> lädt den Proxmox-Kernel und initrd beim Booten in den Speicher, wobei die aktuelle cmdline wiederverwendet wird.",
+      "Ein Aliasname in <code>/root/.bash_profile</code>: <code>reboot-quick</code> → <code>systemctl kexec</code>."
+    ],
+    "usageIntro": "Nutzung nach dem nächsten Reboot (oder manuell <code>systemctl start kexec-pve</code>):",
+    "warnTitle": "Wann man Kexec nicht benutzt",
+    "warnBody": "kexec überspringt Firmware-Level Init. Wenn Sie sich auf BIOS/UEFI verlassen, um den Hardwarezustand zurückzusetzen - beispielsweise einen GPU, der Passthrough durchführt, der nur bei voller POST sauber zurückgesetzt wird, oder eine lästige HBA-Firmware - können Kexec-Neustarts diese Geräte in einem halbinitialisierten Zustand belassen. Verwenden Sie einen normalen <code>reboot</code> nach Kernel-Upgrades oder wenn Sie BIOS/UEFI Änderungen benötigen, um wirksam zu werden. <code>reboot-quick</code> ist für alltägliche Neustarts gedacht."
+  },
+  "panic": {
+    "heading": "Neustart bei Kernel-Panic aktivieren",
+    "intro": "Lässt den Kernel <strong>automatisch neu starten</strong>, statt dauerhaft am Panikbildschirm zu hängen. Besonders wichtig für entfernte Proxmox-Hosts ohne lokale Konsole: Bei blockiertem Kernel bleiben alle VMs aus, bis Sie den Host aus- und wieder einschalten können.",
+    "tipTitle": "Verbinden Sie dies mit Remote-Konsolenzugriff",
+    "tipBody": "Der automatische Neustart dient der Wiederherstellung, nicht der Fehlersuche. Um eine Panik zu <em>untersuchen</em>, statt nur neu zu starten, nutzen Sie <link>die kexec-Option</link> oben zusammen mit Kernel-kdump-Unterstützung, die ProxMenux nicht einrichtet. Alternativ zeichnen Sie vor Aktivierung eine serielle Konsole auf einem anderen Host auf."
+  },
+  "verify": {
+    "heading": "Verifizierung",
+    "intro": "Nach Anwendung der Systemoptimierungen:",
+    "tipTitle": "Wiederherstellung und Grenzen",
+    "tipBody": "Alle sechs Optionen werden in <code>installed_tools.json</code> erfasst und unter <link>Optimierungen deinstallieren</link> angeboten. Die Wiederherstellung entfernt die Konfigurationsdateien sowie kexec-Unit und Alias, schreibt journald.conf mit den systemd-Standardwerten neu und stellt logrotate.conf aus der Sicherung wieder her. Manche aktiven Grenzen brauchen eine neue Sitzung oder einen Neustart."
+  },
+  "related": {
+    "heading": "Verwandte Themen",
+    "items": [
+      {
+        "label": "Nützliche Systembefehle",
+        "href": "/docs/help-info/system-commands",
+        "tail": "— die Änderungen überprüfen (free -h, journalctl, ulimit -a)."
+      },
+      {
+        "label": "Leistung",
+        "href": "/docs/post-install/performance",
+        "tail": " — zusätzliche Systemabstimmung (pigz)."
+      },
+      {
+        "label": "Optimierungen deinstallieren",
+        "href": "/docs/post-install/uninstall",
+        "tail": " — diese Änderungen rückgängig machen."
+      },
+      {
+        "label": "Anpassbare Nachinstallation",
+        "href": "/docs/post-install/customizable",
+        "tail": " — zurück zum übergeordneten Menü."
+      }
+    ]
+  }
+}
diff --git a/web/messages/de/docs/post-install/uninstall.json b/web/messages/de/docs/post-install/uninstall.json
new file mode 100644
index 00000000..46255449
--- /dev/null
+++ b/web/messages/de/docs/post-install/uninstall.json
@@ -0,0 +1,271 @@
+{
+  "meta": {
+    "title": "Optimierungen deinstallieren | ProxMenux Dokumentation",
+    "description": "Macht reversible Nachinstallationsänderungen von ProxMenux rückgängig. Registrierte Werkzeuge haben eigene Deinstallationsfunktionen, die den vorherigen Hostzustand nach Möglichkeit erhalten."
+  },
+  "header": {
+    "title": "Optimierungen deinstallieren",
+    "description": "Stellen Sie reversible Änderungen wieder her, die durch die automatisierten oder anpassbaren Skripte nach der Installation vorgenommen wurden. ProxMenux registriert jede unterstützte Optimierung mit ihrer dedizierten Wiederherstellungsfunktion; Paket-Upgrades sind absichtlich ausgeschlossen.",
+    "section": "Einstellungen nach der Installation von Proxmox"
+  },
+  "intro": {
+    "title": "Warum es das gibt",
+    "body": "Jede unterstützte rückgängig zu machende Änderung wird <strong>erfasst</strong> in <code>/usr/local/share/proxmenux/installed_tools.json</code>. Dieses Verzeichnis steuert die Deinstallation: Es zeigt aktive Optimierungen und ruft deren Wiederherstellungsfunktion auf. Aktionen ohne sicheres Zurücksetzen, etwa vollständige Paket-Upgrades, werden nicht aufgenommen."
+  },
+  "openMenu": {
+    "heading": "Wie man es öffnet",
+    "body": "Öffnen Sie im Hauptmenü <strong>Proxmox-Nachinstallationseinstellungen → Optimierungen deinstallieren</strong>. Die Liste zeigt <em>aktuell angewendete</em> Optimierungen; nicht angewendete Einträge fehlen.",
+    "imageAlt": "Auswahlliste „Optimierungen deinstallieren“ mit aktiven Änderungen und Kontrollkästchen zum Zurücksetzen"
+  },
+  "howWorks": {
+    "heading": "Wie die Umkehrung funktioniert",
+    "steps": [
+      {
+        "title": "Gespeicherte Einträge und automatische Erkennung",
+        "body1": "Beim ersten Lauf sucht ProxMenux nach Erkennungsmerkmalen auf dem Host, etwa <code>/etc/sysctl.d/99-memory.conf</code>, <code>/etc/apt/apt.conf.d/99-force-ipv4</code>, installiertem <code>haveged</code> oder aktivem Log2RAM-Dienst. Erkannte Änderungen werden als rückgängig zu machen erfasst, auch wenn eine ältere ProxMenux-Version ohne Register sie vorgenommen hat.",
+        "body2": "Diese Migration wird nur einmal ausgeführt. Anschließend aktualisiert jeder Anwenden- oder Rückgängig-Vorgang den gespeicherten Eintrag direkt."
+      },
+      {
+        "title": "Änderungen zum Zurücksetzen auswählen",
+        "body1": "Die Checkliste zeigt pro Artikel ein menschenlesbares Label (z.B. <em>Speichereinstellungen Optimierung</em>, <em>IOMMU/VFIO PCI-Durchgang</em>, <em>Log2RAM (SSD-Schutz)</em>). Klicken Sie auf die, die Sie umkehren möchten. Nichts, was Sie nicht ankreuzen, wird berührt."
+      },
+      {
+        "title": "Rückgängigmachen wird ausgeführt",
+        "body1": "Für jedes ausgewählte Element ruft ProxMenux seine passende Deinstallationsfunktion auf. Die meisten Umkehrungen folgen einem von drei Mustern:",
+        "items": [
+          "<strong>Backup-basierte </strong> — Wiederherstellung eines <code>.bak</code>, das zum Zeitpunkt der Anwendung erfasst wurde (bashrc, logrotate.conf, journald.conf, GRUB/kernel cmdline).",
+          "<strong>Konfiguration löschen</strong> — ProxMenux-Dateien <code>/etc/sysctl.d/99-*.conf</code>, <code>/etc/apt/apt.conf.d/99-*</code> oder die systemd-Unit entfernen und neu laden.",
+          "<strong>Pakete neu installieren</strong> — bei UI-Änderungen wie dem Abonnementhinweis die Originalpakete mit <code>--force-confnew</code> neu installieren, um ausgelieferte Einstellungen wiederherzustellen."
+        ],
+        "body2": "Jede Umkehrung protokolliert ihren Fortschritt. Elemente, die einen Neustart erfordern (VFIO, persistente Schnittstellennamen), setzen ein Flag, das die Neustartaufforderung am Ende auslöst."
+      },
+      {
+        "title": "Neustartabfrage am Ende",
+        "body1": "Nachdem die Umkehrung beendet ist, zeigt das Menü eine Neustartaufforderung an. Elemente, die Kernelparameter, Kernelmodule oder Netzwerknamen (VFIO, persistente Schnittstellennamen) geändert haben, benötigen den Neustart, um wirksam zu werden; andere Elemente nicht, und die Eingabeaufforderung ist ein Sicherheitsstandard und keine Per-Item-Überprüfung."
+      }
+    ]
+  },
+  "reversible": {
+    "heading": "Was reversibel ist",
+    "intro": "Registrierte reversible Optimierungen und deren passende Deinstallateure werden hier nach Bereichen gruppiert:",
+    "groups": [
+      {
+        "title": "Repositories und APT",
+        "items": [
+          {
+            "tool": "Abonnementbanner entfernen",
+            "restores": "Zunächst wird versucht, die UI-Dateien aus ProxMenux-eigenen Backups wiederherzustellen (/usr/local/share/proxmenux/backups/proxmoxlib.js.backup.* und, wenn die mobile UI gepatcht wird, index.html.tpl.backup.*). Nur wenn ein Backup fehlt oder beschädigt ist, greift man auf die Neuinstallation von pve-manager, proxmox-widget-toolkit, libjs-extjs und libpve-http-server-perl mit force-confnew zurück. Löscht auch zwischengespeicherte .js / .gz-Kopien."
+          },
+          {
+            "tool": "APT-Sprachdateien überspringen",
+            "restores": "Entfernt /etc/apt/apt.conf.d/99-disable-translations, damit APT übersetzte Paketbeschreibungsindizes gemäß den übrigen Spracheinstellungen herunterladen kann."
+          },
+          {
+            "tool": "IPv4 für APT erzwingen",
+            "restores": "Entfernen von /etc/apt/apt.conf.d/99-force-ipv4."
+          },
+          {
+            "tool": "Systemwerkzeuge",
+            "restores": "Entfernt nur ausgewählte Werkzeugpakete vollständig, die ProxMenux als neu installiert erfasst hat. Zuvor vorhandene Pakete werden nie in diese Liste aufgenommen und bleiben unverändert."
+          }
+        ]
+      },
+      {
+        "title": "Kernel, Speicher und Systemgrenzen",
+        "items": [
+          {
+            "tool": "Speichereinstellungen",
+            "restores": "Entfernt /etc/sysctl.d/99-memory.conf und lädt sysctl neu."
+          },
+          {
+            "tool": "Kernel Panic Konfiguration",
+            "restores": "Entfernen von /etc/sysctl.d/99-kernelpanic.conf."
+          },
+          {
+            "tool": "Systemgrenzen erhöhen",
+            "restores": "Entfernt /etc/sysctl.d/99-maxwatches.conf, 99-maxkeys.conf, 99-swap.conf, 99-fs.conf und /etc/security/limits.d/99-limits.conf. Setzt PAM-Grenzen und systemd DefaultLimitNOFILE zurück. In /root/.profile entfernt es nur die alte Zeile ulimit -n 256000; ulimit -n 1048576 des aktuellen Installers kann bleiben und manuelle Entfernung erfordern."
+          },
+          {
+            "tool": "ZRAM-Swapprofil",
+            "restores": "Deaktiviert den Swap auf /dev/zram0, stoppt dev-zram0.swap und entfernt /etc/systemd/zram-generator.conf.d/90-proxmenux.conf. Das systemd-zram-generator-Paket wird nur gelöscht, wenn ProxMenux es installiert hat und kein anderes ZRAM-Setup vorhanden ist. Wenn die Seiten in ZRAM nicht verschoben werden können, bleibt das Profil aktiv und es wird nichts entfernt."
+          }
+        ]
+      },
+      {
+        "title": "Vernetzung",
+        "items": [
+          {
+            "tool": "Netzwerkoptimierungen",
+            "restores": "Entfernt /etc/sysctl.d/99-network.conf, 97-proxmenux-fwbr.conf und 98-proxmenux-rpf.conf sowie proxmenux-fwbr-tune.service, das Hilfsskript /usr/local/sbin/proxmenux-fwbr-tune und die udev-Regel /etc/udev/rules.d/99-zz-proxmenux-fwbr-tune.rules. Entfernt außerdem source /etc/network/interfaces.d/* aus /etc/network/interfaces. Lädt sysctl, systemd und udev-Regeln neu."
+          },
+          {
+            "tool": "Open vSwitch",
+            "restores": "Führt apt purge für openvswitch-switch und openvswitch-common aus. Migrieren Sie OVS-Bridges vorher zu Linux-Bridges, sonst verlieren die VMs darauf beim nächsten Start die Netzwerkanbindung."
+          },
+          {
+            "tool": "TCP BBR + TCP Fast Open",
+            "restores": "Entfernt /etc/sysctl.d/99-kernel-bbr.conf und 99-tcp-fastopen.conf und lädt übrige sysctl-Konfiguration neu. Das Löschen setzt aktive Werte nicht zurück; Standards wie cubic und tcp_fastopen=1 gelten nach Neustart, sofern keine andere Konfiguration sie überschreibt."
+          },
+          {
+            "tool": "Persistente Schnittstellennamen",
+            "restores": "Entfernt nur die 10-proxmenux-*.link-Dateien mit dem ProxMenux-Header aus /etc/systemd/network/. Jede .link-Datei, die von einem anderen Paket bereitgestellt oder vom Benutzer geschrieben wurde, bleibt an Ort und Stelle. Schnittstellennamen kehren beim nächsten Neustart zum Standardverhalten von systemd zurück."
+          }
+        ]
+      },
+      {
+        "title": "Protokollierung",
+        "items": [
+          {
+            "tool": "journald-Optimierung",
+            "restores": "Schreibt /etc/systemd/journald.conf mit ursprünglichen Standardwerten neu und startet systemd-journald neu."
+          },
+          {
+            "tool": "Logrotate-Optimierung",
+            "restores": "Stellt /etc/logrotate.conf aus der vor der Änderung erstellten .bak-Datei wieder her."
+          },
+          {
+            "tool": "Log2RAM",
+            "restores": "Stoppt und deaktiviert Dienst und Timer. Entfernt Cron-Jobs, systemd-Units, Programmdateien, Konfiguration und /var/log.hdd. Entfernt auch das apt-Paket, falls darüber installiert."
+          },
+          {
+            "tool": "Automatisches ZFS-TRIM",
+            "restores": "Liest /usr/local/share/proxmenux/zfs_autotrim_pools mit den tatsächlich geänderten Pools und führt jeweils zpool set autotrim=off aus. Bereits vor ProxMenux manuell aktivierter Autotrim bleibt bestehen."
+          }
+        ]
+      },
+      {
+        "title": "Shell und Erscheinungsbild",
+        "items": [
+          {
+            "tool": "Bashrc anpassen",
+            "restores": "Wiederherstellt /root/.bashrc aus dem .bak-Backup. Wenn kein Backup vorhanden ist, wird der PMX_CORE_BASHRC-Block durch Markierungen entfernt."
+          },
+          {
+            "tool": "Eigenes MOTD-Banner",
+            "restores": "Stellen Sie den genauen ursprünglichen /etc/motd-Inhalt, der unter /usr/local/share/proxmenux gespeichert ist, wieder her, entfernen Sie die Datei, wenn sie vorher nicht vorhanden war, oder entfernen Sie den alten Marker sicher, wenn Sie eine ältere Installation migrieren."
+          },
+          {
+            "tool": "Fastfetch",
+            "restores": "Entfernt Programmdatei, Konfigurationsverzeichnis, update-motd-Hook und den abgegrenzten Block BEGIN FASTFETCH / END FASTFETCH aus /root/.bashrc, ~/.profile, /etc/profile und /etc/profile.d/fastfetch.sh. Entfernt ein installiertes apt-Paket vollständig."
+          },
+          {
+            "tool": "Figurine",
+            "restores": "Entfernt den Binär-, profile.d-Eintrag und den Alias-Block in bashrc/profile."
+          }
+        ]
+      },
+      {
+        "title": "Hardware & Virtualisierung",
+        "items": [
+          {
+            "tool": "IOMMU / VFIO",
+            "restores": "Entfernt vfio Module aus /etc/modules, die Nouveau / Radeon / nvidia Blacklist Einträge und intel_iommu=on / amd_iommu=on / iommu=pt / pcie_acs_override Parameter aus /etc/kernel/cmdline (ZFS) oder GRUB. Baut Initramfs wieder auf."
+          },
+          {
+            "tool": "AMD-CPU-Korrekturen (Ryzen/EPYC)",
+            "restores": "Entfernt idle=nomwait aus Kernel cmdline (ZFS) oder GRUB und die ignore_msrs / report_ignored_msrs Optionen aus /etc/modprobe.d/kvm.conf."
+          },
+          {
+            "tool": "Gast-Agent für einen virtualisierten Proxmox-Host",
+            "restores": "Liest /usr/local/share/proxmenux/guest_agent.pkg und entfernt das erfasste Hostpaket vollständig. Der Installer wählt qemu-guest-agent, open-vm-tools oder virtualbox-guest-utils nach Hypervisor. Ohne Eintrag versucht die Deinstallation diese drei Pakete. Betroffen ist der verschachtelte Proxmox-Host, nicht Gastvorlagen."
+          }
+        ]
+      },
+      {
+        "title": "Speicher",
+        "items": [
+          {
+            "tool": "ZFS-ARC-Größe anpassen",
+            "restores": "Entfernt /etc/modprobe.d/99-zfsarc.conf, stellt gesicherte widersprüchliche externe *.conf aus /usr/local/share/proxmenux/backups/zfs_arc/ wieder her, baut initramfs neu und führt proxmox-boot-tool refresh auf systemd-boot-Hosts aus."
+          },
+          {
+            "tool": "Automatische ZFS-Snapshots",
+            "restores": "Entfernt die Cron-Einträge, die das Skript geschrieben hat, und bietet an, zfs-auto-snapshot zu bereinigen. Bestehende Snapshot-Datensätze in den Pools bleiben intakt - entfernen Sie sie separat, wenn Sie sie weghaben möchten."
+          },
+          {
+            "tool": "vzdump-Geschwindigkeitsbegrenzung",
+            "restores": "Stellt /etc/vzdump.conf aus der Installationssicherung .bak wieder her und setzt bwlimit und ionice auf die Werte vor ProxMenux zurück."
+          }
+        ]
+      },
+      {
+        "title": "Dienstleistungen & Extras",
+        "items": [
+          {
+            "tool": "Zeitsynchronisation",
+            "restores": "Setzt die Zeitzone mit timedatectl auf UTC als sicheren Standard zurück."
+          },
+          {
+            "tool": "Entropieerzeugung (haveged)",
+            "restores": "Stoppt und deaktiviert haveged und entfernt das Paket vollständig."
+          },
+          {
+            "tool": "kexec (schnelle Neustarts)",
+            "restores": "Deaktiviert kexec-pve.service, entfernt die Unit-Datei und den Alias reboot-quick aus /root/.bash_profile und entfernt kexec-tools vollständig."
+          },
+          {
+            "tool": "RPC / rpcbind deaktiviert",
+            "restores": "Stellt rpcbind.service und rpcbind.socket jeweils auf den zuvor erfassten Aktivierungs- und Laufzustand zurück: aktiviert/deaktiviert und aktiv/inaktiv."
+          },
+          {
+            "tool": "pigz (paralleles gzip)",
+            "restores": "Kopiert den echten gzip von gzip.distrib zurück, entfernt die dpkg-Umleitung und /bin/pigzwrapper, kommentiert die pigz-Linie in /etc/vzdump.conf und löscht pigz, sobald gzip verifiziert ist."
+          },
+          {
+            "tool": "Dienste mit hoher Verfügbarkeit",
+            "restores": "Stoppt und deaktiviert pve-ha-lrm, pve-ha-crm und corosync. Bestehende HA-Gruppen und Ressourcendefinitionen werden nicht gelöscht – entfernen Sie sie aus der Web-Benutzeroberfläche, wenn Sie sie nicht mehr benötigen."
+          },
+          {
+            "tool": "Ceph-Repository",
+            "restores": "Bereinigt die mit dieser Option installierten Ceph-Pakete, entfernt die deb822 /etc/apt/sources.list.d/ceph.sources auf PVE 9 (oder die alte Ceph-Liste auf PVE 8) und aktualisiert den APT-Cache."
+          },
+          {
+            "tool": "OVH RTM (Überwachung)",
+            "restores": "Entfernt Pakete passend zu ovh-rtm*, rtm und rtm-*, löscht /etc/rtm und entfernt den RTM-Registereintrag. Puppet-Reste unter /etc/puppet/ müssen eventuell manuell geprüft und bereinigt werden; das Verzeichnis wird nicht gelöscht. Auf Nicht-OVH-Hosts nimmt der Installer normalerweise keine Änderungen vor."
+          }
+        ]
+      }
+    ]
+  },
+  "edge": {
+    "heading": "Sonderfälle und Einschränkungen",
+    "packageTitle": "Neuinstallation betrifft laufende Proxmox-Pakete",
+    "packageBody": "Können ProxMenux-Sicherungen <strong>Abonnementhinweis entfernen</strong> nicht zurücksetzen, installiert der Rückfallweg <code>pve-manager</code>, <code>proxmox-widget-toolkit</code>, <code>libjs-extjs</code> und <code>libpve-http-server-perl</code> mit <code>--force-confnew</code> neu. Das betrifft die laufende Weboberfläche: Browser neu laden und einige Sekunden zum Wiederverbinden abwarten. Nicht während Migrationen oder Klonvorgängen ausführen.",
+    "rebootTitle": "Persistente Namen und VFIO benötigen einen Neustart",
+    "rebootBody": "Das Entfernen der <code>10-proxmenux-*.link</code>-Dateien (<em>Persistente Schnittstellennamen</em>) und Zurücksetzen von <em>IOMMU/VFIO</em> ändern den bereits gestarteten Zustand nicht; sie werden nach Neustart wirksam. ProxMenux setzt dafür automatisch das Neustart-Flag.",
+    "perItemTitle": "Sie können eine Sache rückgängig machen und den Rest behalten",
+    "perItemBody": "Der Deinstaller arbeitet per Item. Wenn Sie nur Log2RAM entfernen möchten, aber die Netzwerk-Tuning- und Bashrc-Änderungen beibehalten möchten, kreuzen Sie nur <em>Log2RAM</em> an. Nichts anderes wird berührt und die Registry wird entsprechend aktualisiert."
+  },
+  "inspect": {
+    "heading": "Kontrolle des Registers manuell",
+    "intro": "Wenn Sie sehen möchten, was verfolgt wird, ohne das Menü zu öffnen:",
+    "outro": "Jeder <code>\"tool\": true</code>-Eintrag entspricht etwas ProxMenux angewendet und kann umgekehrt werden. Das manuelle Entfernen eines Eintrags wird nicht empfohlen - verwenden Sie immer das Menü, das auch die Umkehrfunktion ausführt, anstatt nur die Änderung zu vergessen.",
+    "reinstallTitle": "Neuinstallieren nach Deinstallieren",
+    "reinstallBody": "Eine zurückgesetzte Optimierung kann später erneut angewendet werden. Öffnen Sie <link>das Nachinstallationsmenü</link> und starten Sie Automatisiert oder Anpassbar; das Register erfasst den neuen Zustand."
+  },
+  "related": {
+    "heading": "Verwandte Themen",
+    "items": [
+      {
+        "label": "Automatisiertes Post-Install",
+        "href": "/docs/post-install/automated",
+        "tail": " — die sinnvolle Grundkonfiguration erneut anwenden."
+      },
+      {
+        "label": "Anpassbare Nachinstallation",
+        "href": "/docs/post-install/customizable",
+        "tail": " — eine andere Auswahl treffen."
+      },
+      {
+        "label": "Deinstallieren Sie ProxMenux",
+        "href": "/docs/settings/uninstall-proxmenux",
+        "tail": "- andere Operation: entfernt ProxMenux selbst, nicht seine angewandten Optimierungen."
+      },
+      {
+        "label": "Übersicht Post-Install",
+        "href": "/docs/post-install",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/de/docs/post-install/updates.json b/web/messages/de/docs/post-install/updates.json
new file mode 100644
index 00000000..6dbd533e
--- /dev/null
+++ b/web/messages/de/docs/post-install/updates.json
@@ -0,0 +1,112 @@
+{
+  "meta": {
+    "title": "Verfügbare Updates anwenden — Optimierungen nach der Installation | ProxMenux Dokumentation",
+    "description": "Wie ProxMenux neue Versionen von Nachinstallationsoptimierungen wie Log2Ram, Speichereinstellungen, Systemlimits, Logrotate und Netzwerkanpassungen erkennt und wie Sie sie im Nachinstallationsmenü oder Monitor-Dashboard anwenden."
+  },
+  "header": {
+    "title": "Verfügbare Updates anwenden",
+    "description": "Liegt eine Nachinstallationsoptimierung (Log2Ram, Speichereinstellungen, Systemlimits, Logrotate …) auf dem Datenträger in einer neueren Version vor als der auf dem Host erfassten, zeigt ProxMenux ein verfügbares Update an. Sie können es im Nachinstallationsmenü der Skriptoberfläche oder im Monitor-Dashboard anwenden. Beide Wege führen dieselbe Nachinstallationsfunktion erneut aus und aktualisieren den gespeicherten Versionsstand.",
+    "section": "Einstellungen nach der Installation von Proxmox"
+  },
+  "intro": {
+    "title": "Was das ist",
+    "body": "ProxMenux-Nachinstallationsoptimierungen haben Versionsnummern, etwa <code>Log2ram SSD Protection v1.2</code>. Der Host erfasst aktive Optimierungen und ihre Versionen in <code>/usr/local/share/proxmenux/installed_tools.json</code>. Liefert eine neue ProxMenux-Version eine aktualisierte Optimierung, erkennt ProxMenux den Unterschied und bietet an, nur diese erneut anzuwenden, ohne die gesamte Nachinstallation zu wiederholen."
+  },
+  "why": {
+    "heading": "Warum es das gibt",
+    "body": "Nachinstallationsoptimierungen erhalten Verbesserungen wie bessere sysctl-Einstellungen, strengere Logrotate-Limits, neue Log2RAM-Größenregeln oder Fehlerkorrekturen. Ohne Updateweg mussten Sie den ganzen Skriptlauf mit <em>allen</em> Optimierungen wiederholen oder auf die Verbesserung verzichten. Verfügbare Updates anwenden erlaubt die ausdrückliche Auswahl einzelner Optimierungen, deren Version sich geändert hat."
+  },
+  "detection": {
+    "heading": "Wie Updates erkannt werden",
+    "steps": [
+      {
+        "title": "Versionierte Skripte auf Disk",
+        "body": "Jede Funktion nach der Installation deklariert ihre Version innerhalb des Skripts (<code>scripts/post_install/auto_post_install.sh</code> und <code>scripts/post_install/customizable_post_install.sh</code>). Ein Scanner extrahiert diese Versionen aus der Quelle auf der Festplatte."
+      },
+      {
+        "title": "Versioniertes Register auf dem Host",
+        "body": "Wenn der Operator jede Optimierung anwendete, schrieb der entsprechende <code>register_tool</code>-Aufruf die aktive Version in <code>/usr/local/share/proxmenux/installed_tools.json</code>. Diese Datei ist die Quelle der Wahrheit für \"was auf diesem Host gerade aktiv ist\"."
+      },
+      {
+        "title": "Monitor vergleicht beide Seiten",
+        "body": "Beim Start und alle 24 Stunden vergleicht der Monitor Festplattenversionen mit Registrierungsversionen. Jede Inkongruenz führt zu einem Eintrag in <code>/usr/local/share/proxmenux/updates_available.json</code>. Diese Datei steuert sowohl den Post-Install-Menüeintrag als auch die Monitor-Dashboardkarte."
+      },
+      {
+        "title": "Eine Benachrichtigung pro neuer Version",
+        "body": "Wenn mindestens eine Optimierung ein ausstehendes Update hat, sendet der Monitor eine einzelne gruppierte Benachrichtigung aus - zum Beispiel <em>\"4 ProxMenux Optimierungsupdate(s) verfügbar\"</em> - mit einer Zeile pro Tool im selben <code>name (vX → vY)</code>-Format, das für Proxmox-Paketupdates verwendet wird. Die Benachrichtigung ist Anti-Kaskade, so dass sie sich nicht Tag für Tag für denselben Satz wiederholt; nur eine neue Version (oder ein neues Tool, das in die Liste eintritt) löst sie erneut aus."
+      }
+    ]
+  },
+  "pathA": {
+    "heading": "Pfad A — Aus dem Menü nach der Installation",
+    "intro": "Öffnen Sie im ProxMenux-Hauptmenü <strong>Einstellungen nach der Installation von Proxmox</strong>. Bei ausstehenden Updates erscheint <strong>Verfügbare Updates anwenden (N)</strong> direkt über <em>Optimierungen deinstallieren</em>. Die Zahl zeigt die Optimierungen mit neuerer Version auf dem Datenträger als im Register. Ist alles aktuell, bleibt der Eintrag verborgen.",
+    "menuAlt": "Das Menü Post-Install Scripts zeigt den bedingte Eintrag \"Verfügbare Updates anwenden (N)\" direkt über \"Optimierungen deinstallieren\" an, wobei das Zählabzeichen anzeigt, wie viele Optimierungen eine neuere Version auf der Festplatte haben",
+    "menuCaption": "<em>Verfügbare Updates anwenden (N)</em> erscheint nur, wenn mindestens eine Optimierung ein Update hat, und wird bei aktuellem Host ausgeblendet.",
+    "checklistBody": "Öffnet eine Auswahlliste aller ausstehenden Updates, jeweils im Format <code>name (vX → vY)</code>. Alle Zeilen sind standardmäßig ausgewählt; wählen Sie die ab, die Sie diesmal nicht anwenden möchten.",
+    "checklistAlt": "Auswahldialog Verfügbare Updates anwenden mit einer Zeile pro Optimierung, ihrem Namen und Versionswechsel (aktuell → verfügbar). Alle Zeilen sind ausgewählt.",
+    "checklistCaption": "Jede Optimierung einzeln wählen: Entscheiden Sie, welche Versionen aktualisiert werden. Dieselbe Grundlage wie Automatisch und Anpassbar wendet die Funktionen im Hintergrund erneut an und aktualisiert ihre Registerversionen."
+  },
+  "pathB": {
+    "heading": "Pfad B — Vom Monitor-Dashboard",
+    "intro": "Dieselben Updates erscheinen unter <link>Einstellungen → ProxMenux-Optimierungen</link> im Monitor. Bei ausstehenden Updates zeigt die Karte ein <strong>Update-Zählabzeichen</strong>, das die Auswahl einzelner Optimierungen öffnet. Jedes Werkzeug bietet auch eine eigene Updateaktion.",
+    "imageAlt": "Karte ProxMenux-Optimierungen in den Monitor-Einstellungen mit Zählabzeichen für ausstehende Updates zum Öffnen der Auswahl und Updateaktionen pro Werkzeug",
+    "imageCaption": "Die Optimierungskarte im Monitor bietet über ihr Zählabzeichen Zugriff auf Updates, sobald eine neuere Version auf dem Datenträger liegt, ohne Shell-Zugriff."
+  },
+  "applying": {
+    "heading": "Was beim Anwenden passiert",
+    "steps": [
+      {
+        "title": "Führt die Post-Installation-Funktion erneut aus",
+        "body": "Die Funktion der ausgewählten Optimierung wird gegen den Host erneut ausgeführt. Da jede Funktion nach der Installation <strong>idempotent</strong> ist, wird die Konfiguration nicht dupliziert - sie überschreibt die vorherige Version mit der neuen (Sysctl-Dateien, Drop-Ins, Serviceeinheiten usw.)."
+      },
+      {
+        "title": "Aktualisieren des Registers",
+        "body": "Der <code>register_tool</code>-Aufruf innerhalb der Funktion schreibt die neue Version in <code>installed_tools.json</code>. Beim nächsten Scan wird keine Diskrepanz mehr festgestellt und der Updateeintrag verschwindet sowohl aus dem Menü als auch aus der Monitorkarte."
+      },
+      {
+        "title": "Kein Neustart, es sei denn, die Funktion sagt es",
+        "body": "Die meisten Updates werden sofort wirksam. Updates, die Kernelmodule, persistente Schnittstellennamen oder VFIO berühren, zeigen die gleiche Neustartaufforderung wie eine Neuinstallation."
+      },
+      {
+        "title": "Registrieraktualisierung an den Monitor gesendet",
+        "body": "Nach dem Durchlauf sendet das Menü eine POST-Anfrage an <code>http://127.0.0.1:8008/api/updates/post-install/scan</code>, um <code>/usr/local/share/proxmenux/updates_available.json</code> neu zu erstellen. Nach Anwendung aller Updates verschwinden das Update-Zählabzeichen und der bedingte Shell-Menüeintrag ohne Warten auf den nächsten Scan. Die Optimierungskarte bleibt verfügbar."
+      }
+    ],
+    "jqTitle": "jq ist erforderlich",
+    "jqBody": "Die Path-A-Checkliste basiert auf <code>jq</code>, um die ausstehenden Updates JSON zu analysieren. Wenn <code>jq</code> fehlt, verlässt der Fluss lautlos - Sie würden den Menüeintrag mit einer Zählung sehen, aber nach dem Auswählen von Zeilen würde nichts passieren. Auf jeder modernen Proxmox-Installation ist <code>jq</code> vorhanden; im Zweifelsfall führen Sie <code>apt install -y jq</code> aus."
+  },
+  "differs": {
+    "heading": "Wie es sich von den anderen Pfaden unterscheidet",
+    "headerPath": "Path",
+    "headerScope": "Umfang",
+    "headerWhen": "Wenn es Sinn macht",
+    "rows": [
+      {
+        "pathLabel": "Automatisch",
+        "pathHref": "/docs/post-install/automated",
+        "scope": "Wendet <em>jede</em> Optimierung des Pakets erneut an.",
+        "when": "Frischer Host oder vollständige Re-Baseline eines vollständig verwalteten Knotens."
+      },
+      {
+        "pathLabel": "Anpassbar",
+        "pathHref": "/docs/post-install/customizable",
+        "scope": "Wählen Sie aus dem vollständigen Katalog.",
+        "when": "Gezielt auswählen, welche Optimierungen auf dem Host aktiv sind."
+      },
+      {
+        "pathLabel": "Verfügbare Updates anwenden",
+        "pathHref": null,
+        "scope": "Nur Optimierungen mit neuerer Version auf dem Datenträger.",
+        "when": "Halten Sie bereits installierte Optimierungen aktuell, ohne den Rest zu berühren."
+      },
+      {
+        "pathLabel": "Optimierungen deinstallieren",
+        "pathHref": "/docs/post-install/uninstall",
+        "scope": "Optimierung rückgängig machen und ihren Registereintrag entfernen.",
+        "when": "Rollen Sie eine bestimmte Änderung zurück."
+      }
+    ]
+  },
+  "notifTitle": "Benachrichtigung steuern",
+  "notifBody": "Ausstehende Updates werden durch <em>ProxMenux-Optimierungsupdates verfügbar</em> angekündigt. Das Ereignis ist auf allen Kanälen standardmäßig aktiv und kann unter <link>Einstellungen → Benachrichtigungen</link> pro Kanal stummgeschaltet werden. Es wird nur einmal pro unterschiedlicher Updategruppe ausgelöst, nicht bei jedem 24-Stunden-Scan."
+}
diff --git a/web/messages/de/docs/post-install/virtualization.json b/web/messages/de/docs/post-install/virtualization.json
new file mode 100644
index 00000000..f4f95199
--- /dev/null
+++ b/web/messages/de/docs/post-install/virtualization.json
@@ -0,0 +1,116 @@
+{
+  "meta": {
+    "title": "Post-Install: Virtualisierung | ProxMenux Dokumentation",
+    "description": "Virtualisierungsoptionen im ProxMenux Anpassbares Post-Installationsskript: Installieren Sie automatisch den richtigen Gastagenten, wenn Proxmox in einem VM läuft, und aktivieren Sie IOMMU / VFIO, damit Sie PCI-Geräte (GPUs, NICs, HBAs) an Ihre eigenen VMs weitergeben können."
+  },
+  "header": {
+    "title": "Post-Install: Virtualisierung",
+    "section": "Einstellungen nach der Installation von Proxmox"
+  },
+  "intro": {
+    "title": "Was diese Kategorie abdeckt",
+    "body": "Zwei unabhängige Optionen. <strong>Passenden Gastagenten installieren</strong> hilft, wenn Proxmox selbst in einem anderen Hypervisor verschachtelt läuft. <strong>VFIO-IOMMU-Unterstützung aktivieren</strong> ist für die meisten Benutzer relevant: Es aktiviert die Kernelfunktionen zur direkten Zuweisung einer GPU, HBA oder Netzwerkkarte an eine VM mit nahezu nativer Leistung."
+  },
+  "guestAgent": {
+    "heading": "Relevanten Gastagenten installieren",
+    "intro": "Erkennt die Virtualisierungsumgebung des Proxmox-Hosts mit <code>systemd-detect-virt</code> und <code>dmidecode</code> und installiert das passende Gastwerkzeugpaket für die Kommunikation mit dem äußeren Hypervisor: geordnetes Herunterfahren, Uhrzeitsynchronisierung, IP-Meldung usw.",
+    "headerDetected": "Erkannter Host",
+    "headerPackage": "Installiertes Paket",
+    "rows": [
+      {
+        "detected": "QEMU / KVM",
+        "package": "qemu-guest-agent"
+      },
+      {
+        "detected": "VMware (ESXi, Workstation)",
+        "package": "open-vm-tools"
+      },
+      {
+        "detected": "VirtualBox",
+        "package": "virtualbox-guest-utils"
+      },
+      {
+        "detected": "Direkt auf Hardware (keiner)",
+        "package": "— no-op, nichts installiert"
+      }
+    ],
+    "skipTitle": "Überspringen Sie dies auf Bare-Metal Proxmox",
+    "skipBody": "Wenn Proxmox direkt auf Hardware läuft (der übliche Fall), ist das Ankreuzen dieser Option ein No-Op - der Detektor gibt <code>none</code> zurück und das Skript wird ohne Änderungen beendet. Die Option ist nur für die Minderheit der Setups wichtig, die Proxmox <em> als Gast</em> für Tests oder Labors ausführen."
+  },
+  "vfio": {
+    "heading": "VFIO IOMMU-Unterstützung aktivieren",
+    "intro": "Aktiviert IOMMU auf dem Host und lädt die Kernelmodule für PCI-Passthrough (<code>vfio</code>, <code>vfio_iommu_type1</code>, <code>vfio_pci</code>). Damit kann ein physisches Gerät direkt einer VM zugewiesen werden, deren Gast einen nahezu hardwaredirekten Zugriff erhält.",
+    "whoTitle": "Wer das braucht",
+    "whoItems": [
+      "Sie möchten eine GPU an eine Windows-Gaming-VM oder macOS-VM durchreichen.",
+      "Sie haben eine dedizierte 10G NIC für eine Firewall / Router VM (OPNsense, pfSense).",
+      "Sie möchten einen HBA direkt an einen TrueNAS/Unraid VM für ZFS auf nackten Festplatten übergeben.",
+      "Sie planen, <em>Coral TPU</em>, eine Capture-Karte oder einen SDR-Dongle in einem VM zu verwenden."
+    ],
+    "whoOutro": "Trifft nichts davon zu, können Sie die Option sicher überspringen. Für die Geräteweitergabe an einen <strong>LXC</strong>-Container statt an eine VM ist IOMMU <em>nicht</em> erforderlich.",
+    "doesTitle": "Was ProxMenux tut",
+    "doesIntro": "Die Funktion ist bootloaderbewusst: Sie erkennt, ob Proxmox auf ZFS (systemd-boot) oder LVM/ext4 (GRUB) ist und schreibt in die richtige Datei. Es ist auch idempotent - wenn die Parameter bereits vorhanden sind, wird nichts hinzugefügt.",
+    "headerBoot": "Bootstyp",
+    "headerFile": "Geänderte Datei",
+    "headerPost": "Schritt nach der Aktualisierung",
+    "bootRows": [
+      {
+        "boot": "systemd-boot (ZFS)",
+        "file": "/etc/kernel/cmdline",
+        "post": "proxmox-boot-tool refresh"
+      },
+      {
+        "boot": "GRUB (LVM/ext4)",
+        "file": "/etc/default/grub",
+        "post": "update-grub"
+      }
+    ],
+    "kernelIntro": "Zusätzliche Kernelparameter:",
+    "modulesIntro": "Kernelmodule, die <code>/etc/modules</code> hinzugefügt wurden:",
+    "blacklistIntro": "Konfliktierende Treiber auf der schwarzen Liste in <code>/etc/modprobe.d/blacklist.conf</code>:",
+    "blacklistTitle": "GPU-Treibersperren verhindern die GPU-Nutzung auf dem Host",
+    "blacklistBody": "Die Sperrliste verhindert, dass der Host-Kernel <em>irgendeinen</em> GPU-Treiber bindet, damit VFIO die GPU übernehmen kann. Das ist für die Durchreichung an eine VM erwünscht, aber das <strong>Gegenteil</strong> dessen, was Sie zum <link>Installieren von NVIDIA-Treibern auf dem Host</link> benötigen, etwa für LXC-Transcodierung. Wählen Sie pro GPU einen Weg:",
+    "pathItems": [
+      "<strong>GPU → VM:</strong> aktivieren VFIO/IOMMU hier, lassen Sie die GPU-Treiber auf der schwarzen Liste.",
+      "<strong>GPU → LXC (oder Host):</strong> überspringen Sie diese Option, installieren Sie NVIDIA auf dem Host und sperren Sie nvidia/nouveau nicht.",
+      "<strong>Zwei GPUs:</strong> Eine kann einer VM, die andere einem LXC zugeordnet werden. Dafür ist eine gezieltere Konfiguration nötig: Binden Sie nur eine Karte über ihre PCI-ID an <code>vfio-pci</code>. Die Standardsperrliste ist dafür zu umfassend; bearbeiten Sie danach <code>blacklist.conf</code>."
+    ],
+    "acsTitle": "Über pcie_acs_override - wissen, was Sie aktivieren",
+    "acsBody": "<code>pcie_acs_override=downstream,multifunction</code> entspannt den PCIe Access Control Services Check. Es ermöglicht dem Kernel, IOMMU-Gruppen aufzuteilen, die von der Firmware als monolithisch gemeldet werden, was manchmal die einzige Möglichkeit ist, ein Gerät einer Gruppe zu durchlaufen, ohne den Rest zu ziehen. Der Kompromiss ist <strong> reduzierte Isolation zwischen Geräten</strong>: ein bösartiger oder kompromittierter VM mit Durchgang hat eine größere Angriffsfläche über DMA. Gut für ein Heimlabor; Überlegen Sie zweimal, bevor Sie einen Host aktivieren, der nicht vertrauenswürdige Workloads ausführt. Wenn Sie es nicht benötigen, entfernen Sie dieses Token aus <code>/etc/kernel/cmdline</code> oder <code>/etc/default/grub</code>, nachdem das Skript ausgeführt wurde, und führen Sie den Schritt zur Aktualisierung des Bootloaders erneut aus.",
+    "rebootTitle": "Reboot erforderlich",
+    "rebootBody": "IOMMU, VFIO-Module und Sperrliste werden erst nach initramfs-Neuerstellung und Neustart wirksam. Das Skript führt <code>update-initramfs -u -k all</code> und die Bootloader-Aktualisierung aus und setzt „Neustart erforderlich“, sodass Anpassbar am Ende danach fragt.",
+    "verifyTitle": "Überprüfung nach dem Neustart",
+    "revertTitle": "Reversibel aus dem Menü Deinstallieren",
+    "revertBody": "<link>Optimierungen deinstallieren</link> macht alle Änderungen rückgängig: entfernt IOMMU-Parameter aus <code>/etc/kernel/cmdline</code> oder GRUB, VFIO-Module aus <code>/etc/modules</code> und die Treibersperren und erstellt initramfs neu. Erst ein Neustart wendet die Rücknahme an."
+  },
+  "related": {
+    "heading": "Verwandte Themen",
+    "items": [
+      {
+        "label": "GPU zu VM hinzufügen (Passthrough)",
+        "href": "/docs/hardware/gpu-vm-passthrough",
+        "tail": "— natürlicher nächster Schritt, sobald IOMMU + VFIO aktiviert sind."
+      },
+      {
+        "label": "Controller oder NVMe zu VM hinzufügen",
+        "href": "/docs/disk-manager/add-controller-nvme-vm",
+        "tail": " — dieselbe Passthrough-Infrastruktur für Speichercontroller."
+      },
+      {
+        "label": "GPU-Passthrough-Befehle",
+        "href": "/docs/help-info/gpu-commands",
+        "tail": "Referenz der IOMMU-Prüfung."
+      },
+      {
+        "label": "Optimierungen deinstallieren",
+        "href": "/docs/post-install/uninstall",
+        "tail": " — IOMMU/VFIO sauber rückgängig machen."
+      },
+      {
+        "label": "Anpassbare Nachinstallation",
+        "href": "/docs/post-install/customizable",
+        "tail": " — zurück zum übergeordneten Menü."
+      }
+    ]
+  }
+}
diff --git a/web/messages/de/docs/security/fail2ban.json b/web/messages/de/docs/security/fail2ban.json
new file mode 100644
index 00000000..e65a6918
--- /dev/null
+++ b/web/messages/de/docs/security/fail2ban.json
@@ -0,0 +1,152 @@
+{
+  "meta": {
+    "title": "Fail2Ban | ProxMenux-Dokumentation",
+    "description": "Installieren Sie Fail2Ban mit drei jails abgestimmt auf Proxmox (SSH aggressiv, Proxmox UI 8006, ProxMenux Monitor 8008). Beinhaltet den Fix journald MaxLevelStore, benutzerdefinierte Protokolldienste für Zuverlässigkeit, automatisch erkanntes nftables/iptables-Backend und SSH MaxAuthTries Härtung.",
+    "ogTitle": "Fail2Ban | ProxMenux-Dokumentation",
+    "ogDescription": "Brute-Force-Schutz für SSH und Proxmox-Weboberflächen mit Proxmox-spezifischen journald- und Backend-Korrekturen."
+  },
+  "header": {
+    "title": "Fail2Ban",
+    "description": "Installiert Fail2Ban für Proxmox: drei Jails (SSH aggressiv, Proxmox-Weboberfläche auf 8006, ProxMenux Monitor auf 8008 und Reverse Proxy), journald-Korrektur zum Speichern von SSH-Anmeldeereignissen, zwei Journal-zu-Datei-Dienste als Umgehung eines bekannten systemd-Backend-Problems, automatische Firewall-Backend-Erkennung und SSH-Härtung mit MaxAuthTries.",
+    "section": "Sicherheit"
+  },
+  "intro": {
+    "title": "Was das macht",
+    "body": "Installiert Fail2Ban aus Debian-Paketquellen und schreibt eine Proxmox-Konfiguration, die SSH, Proxmox-Weboberfläche und ProxMenux Monitor sofort schützt. Bei vorhandener Installation erscheint stattdessen ein Verwaltungsmenü zum Neuinstallieren oder Entfernen."
+  },
+  "firstLaunch": {
+    "heading": "Erststart-Dialog",
+    "body": "Ohne vorhandenes Fail2Ban zeigt das Skript einen Bestätigungsdialog mit den geplanten Installations- und Konfigurationsschritten. Abbrechen beendet ohne Änderungen; Bestätigen startet die Installation.",
+    "imageAlt": "Fail2Ban-Installationsbestätigung mit drei Jails, journald-Korrektur und SSH-Härtung"
+  },
+  "jails": {
+    "heading": "Die drei jails",
+    "headerJail": "Jail",
+    "headerProtects": "Schützt",
+    "headerRetries": "Fehlversuche / Zeitfenster",
+    "headerBan": "Sperrdauer",
+    "rows": [
+      {
+        "jail": "[sshd]",
+        "protects": "SSH (aggressiver Modus — umfasst ddos, mode, normal)",
+        "retries": "2 / 60 min",
+        "ban": "9 Stunden"
+      },
+      {
+        "jail": "[proxmox]",
+        "protects": "Proxmox web UI (Port 8006)",
+        "retries": "3 / 10 min",
+        "ban": "1 Stunde"
+      },
+      {
+        "jail": "[proxmenux]",
+        "protects": "ProxMenux Monitor (Port 8008 + http/https Reverse Proxy)",
+        "retries": "3 / 10 min",
+        "ban": "1 Stunde"
+      }
+    ],
+    "outro": "Globale Standardwerte von <code>jail.local</code>: <code>ignoreip = 127.0.0.1/8 ::1</code>, <code>ignoreself = true</code>,<code> bantime = 86400</code> (24-Stunden-Fallback für jails, die es nicht überschreiben), <code>maxretry = 2</code>, <code>findtime = 1800</code>."
+  },
+  "journald": {
+    "heading": "Warum die journald-Korrektur wichtig ist",
+    "intro": "Proxmox liefert <code>/etc/systemd/journald.conf</code> mit <codeNw>MaxLevelStore=warning</codeNw>. journald verwirft Meldungen <em>unterhalb</em> von warning vor dem Speichern. SSH und PAM melden Anmeldefehler auf den Stufen <em>info</em> / <em>notice</em>, daher :",
+    "diagram": {
+      "sshLabel": "SSH / PAM",
+      "sshDetail": "Anmeldefehler\n(Stufe info / notice)",
+      "journaldLabel": "journald",
+      "journaldDetail": "MaxLevelStore=warning\n→ Ereignis ohne Hinweis verworfen",
+      "fail2banLabel": "Fail2Ban",
+      "fail2banDetail": "Nichts sehen\nNiemals etwas verbieten",
+      "arrowLabel": "Standard Proxmox"
+    },
+    "afterDiagram": "Der Installateur erkennt dies und schreibt ein Drop-in bei <codeXs>/etc/systemd/journald.conf.d/proxmenux-loglevel.conf</codeXs> und erhöht sowohl <code>MaxLevelStore</code> als auch <code>MaxLevelSyslog</code> auf <code>info</code>:",
+    "code": "[Journal]\nMaxLevelStore=info\nMaxLevelSyslog=info",
+    "outro": "Dann startet <code>systemd-journald</code> neu. Das Drop-In wird bei der Deinstallation entfernt, wodurch der ursprüngliche Proxmox-Standard wiederhergestellt wird."
+  },
+  "loggers": {
+    "heading": "Warum zwei Custom Logger Services",
+    "intro1": "Fail2Ban kann direkt aus dem systemd-Journal lesen (<code>backend = systemd</code>). Auf Proxmox gibt es jedoch bekannte Zuverlässigkeitsprobleme mit Worker-Prozessen von <code>pvedaemon</code>: Anmeldeereignisse erscheinen im Journal, werden aber nicht immer erkannt. Zeitweise betrifft dies auch <code>sshd</code>.",
+    "intro2": "ProxMenux erstellt zwei kleine systemd-Dienste, die die betreffenden Units mit <code>journalctl -f</code> verfolgen und jede Zeile an eine Datei anhängen. Fail2Ban liest diese Dateien mit dem zuverlässigen <code>backend = auto</code> (Dateimodus) :",
+    "headerService": "Dienst",
+    "headerSource": "Quelleneinheit",
+    "headerOutput": "Ausgabedatei",
+    "rows": [
+      {
+        "service": "proxmox-auth-logger.service",
+        "source": "pvedaemon.service",
+        "output": "/var/log/proxmox-auth.log"
+      },
+      {
+        "service": "ssh-auth-logger.service",
+        "source": "ssh.service",
+        "output": "/var/log/ssh-auth.log"
+      }
+    ],
+    "outro": "Beide Dienste sind als <code>PartOf=fail2ban.service</code> deklariert, sodass sie mit Fail2Ban neu starten und damit stoppen. Modus 640 im Besitz von <code>root:adm</code> in den Protokolldateien. Das dritte Protokoll, das von <code>[proxmenux]</code> jail (<code>/var/log/proxmenux-auth.log</code>) verwendet wird, wird direkt von der App ProxMenux Monitor Flask geschrieben – dafür ist kein Logger-Dienst erforderlich."
+  },
+  "backend": {
+    "heading": "Firewall-Backend-Autoerkennung",
+    "intro": "Der Installer prüft den Host: Wenn <code>nft list ruleset</code> funktioniert, wählt er <code>nftables</code> als Sperraktion. Ansonsten fällt es auf <code>iptables-multiport</code> / <code>iptables-allports</code> zurück. Die Auswahl ist in <code>jail.local</code> geschrieben:",
+    "code": "# nftables host\nbanaction = nftables\nbanaction_allports = nftables[type=allports]\n\n# iptables host (fallback)\nbanaction = iptables-multiport\nbanaction_allports = iptables-allports"
+  },
+  "hardening": {
+    "heading": "SSH-Härtung: MaxAuthTries",
+    "intro": "Die Lynis-Prüfung <strong>SSH-7408</strong> empfiehlt <code>MaxAuthTries 3</code> in <code>sshd_config</code>. Die SSH-Jail verwendet <code>maxretry = 2</code> für Sperren nach wiederholten Fehlversuchen; MaxAuthTries begrenzt die Versuche innerhalb einer Verbindung. Diese SSH-Einstellung bietet zusätzliche Abwehr, auch bei wegen Wartung gestopptem Fail2Ban.",
+    "installerIntro": "Der Installer:",
+    "items": [
+      "Lesen Sie den aktuellen <code>MaxAuthTries</code>-Wert (oder standardmäßig 6, falls nicht vorhanden).",
+      "Speichert es in <code>/usr/local/share/proxmenux/sshd_maxauthtries_backup</code>.",
+      "Bearbeitet <code>sshd_config</code> direkt: ersetzt die vorhandene Zeile, entfernt das Kommentarzeichen oder fügt eine neue Zeile hinzu.",
+      "Lädt <code>sshd</code> neu, ohne den Dienst neu zu starten, damit bestehende Sitzungen aktiv bleiben."
+    ],
+    "outro": "Bei der Deinstallation wird der gespeicherte Originalwert wiederhergestellt und <code>sshd</code> erneut geladen."
+  },
+  "manage": {
+    "heading": "Verwalten einer vorhandenen Installation",
+    "intro": "Wenn Fail2Ban beim Öffnen des Menüs bereits installiert ist, erkennt das Skript es und zeigt ein Verwaltungsmenü an, anstatt das Installationsprogramm erneut auszuführen:",
+    "headerAction": "Aktion",
+    "headerWhat": "Was es tut",
+    "rows": [
+      {
+        "action": "Neuinstallieren",
+        "what": "Führt den vollständigen Installer erneut aus und schreibt alle Jails mit den aktuellen ProxMenux-Vorgaben neu. Verwenden Sie dies, wenn ein Update die empfohlenen Werte ändert."
+      },
+      {
+        "action": "Entfernen",
+        "what": "Stoppt fail2ban und die beiden Logger-Dienste, löscht das apt-Paket, entfernt alle jail/Filterdateien, löscht das journald-Drop-In (stellt die Proxmox-Standardeinstellung wieder her) und stellt das ursprüngliche SSH wieder her. MaxAuthTries."
+      }
+    ]
+  },
+  "verify": {
+    "heading": "Überprüfen Sie, ob es funktioniert",
+    "intro": "Nach der Installation nützliche Befehle vom Host:",
+    "code": "# Service status and version\nsystemctl status fail2ban\nfail2ban-client --version\n\n# All active jails\nfail2ban-client status\n\n# Detail on one jail\nfail2ban-client status sshd\nfail2ban-client status proxmox\nfail2ban-client status proxmenux\n\n# Currently banned IPs in a jail\nfail2ban-client status sshd | grep \"Banned IP\"\n\n# Manually unban an IP (use this if you ban yourself)\nfail2ban-client unban 192.0.2.10\n\n# Tail the auth logs Fail2Ban watches\ntail -f /var/log/ssh-auth.log\ntail -f /var/log/proxmox-auth.log\ntail -f /var/log/fail2ban.log"
+  },
+  "troubleshoot": {
+    "heading": "Fehlerbehebung",
+    "neverBansTitle": "Fail2Ban läuft, verbietet aber niemals etwas",
+    "neverBansBody": "Prüfen Sie, ob <code>tail -f /var/log/ssh-auth.log</code> nach einer SSH-Anmeldung mit falschem Passwort von einem anderen Rechner einen Eintrag erhält. Bleibt die Datei leer, prüfen Sie <code>systemctl status ssh-auth-logger.service</code>. Ist der Logger aktiv, zeigen Sie aktuelle SSH-Ereignisse mit <code>journalctl -u ssh.service -n 50 --no-pager -p info</code> an und prüfen, ob der journald-Zusatz die Stufe <em>info</em> erlaubt.",
+    "monitorEmptyTitle": "ProxMenux Monitor jail hat keine Einträge, auch nach fehlgeschlagenen Anmeldungen",
+    "monitorEmptyBody": "Der <code>[proxmenux]</code> jail liest <code>/var/log/proxmenux-auth.log</code>, der von der ProxMenux Monitor Flask-App geschrieben wurde – nicht von einem journald-Logger. Wenn Sie den Monitor nicht ausführen, bleibt die Datei leer und jail wird nie ausgelöst. Das wird erwartet; Die jail-Konfiguration ist harmlos. Wenn Sie den Monitor ausführen und das Protokoll leer ist, überprüfen Sie die Protokollierungskonfiguration Flask.",
+    "selfBanTitle": "Ich habe meinen eigenen Zugriff gesperrt",
+    "selfBanIntro": "Von einer Konsole / IPMI / iKVM (oder einer anderen Whitelist-IP):",
+    "selfBanCode": "fail2ban-client unban '<'YOUR_IP'>'\n\n# To prevent it next time, edit /etc/fail2ban/jail.local and add your IP:\nignoreip = 127.0.0.1/8 ::1 192.168.1.0/24 203.0.113.42\n\n# Then reload\nfail2ban-client reload",
+    "aptFailTitle": "apt-get schlägt fehl: ''Unable to locate package fail2ban''",
+    "aptFailBody": "Dem Host fehlen die Debian-Repos (üblich bei Barebones, die Proxmox installiert). Der Installateur erkennt dies und schreibt <code>/etc/apt/sources.list.d/debian.sources</code> mit dem richtigen Codenamen (<code>bookworm</code> / <code>trixie</code>), bevor er es erneut versucht. Wenn es immer noch fehlschlägt, überprüfen Sie <code>/etc/os-release</code> für <code>VERSION_CODENAME</code> und bestätigen Sie, dass die Repo-URL erreichbar ist.",
+    "lockoutTitle": "SSH sperrt mich nach der Installation aus",
+    "lockoutBody": "Das Installationsprogramm setzt <code>MaxAuthTries=3</code>. Wenn Ihr Passwort-Manager / Agent mehrere Schlüssel wiederholt, können Sie diese bei einem einzigen Verbindungsversuch überschreiten. Begrenzen Sie die angebotenen Schlüssel: <code>ssh -o IdentitiesOnly=yes -i ~/.ssh/specific_key user@host</code>. Oder erhöhen Sie <code>MaxAuthTries</code> vorübergehend in <code>sshd_config</code>, während Sie debuggen."
+  },
+  "files": {
+    "heading": "Dateien geschrieben",
+    "code": "/etc/fail2ban/jail.local                              # global defaults + [sshd]\n/etc/fail2ban/jail.d/proxmox.conf                     # [proxmox]\n/etc/fail2ban/jail.d/proxmenux.conf                   # [proxmenux]\n/etc/fail2ban/filter.d/proxmox.conf                   # auth-failure regex for pvedaemon\n/etc/fail2ban/filter.d/proxmenux.conf                 # auth-failure regex for Monitor\n/etc/systemd/system/proxmox-auth-logger.service       # journal → file (pvedaemon)\n/etc/systemd/system/ssh-auth-logger.service           # journal → file (sshd)\n/etc/systemd/journald.conf.d/proxmenux-loglevel.conf  # MaxLevelStore=info\n/etc/ssh/sshd_config                                  # MaxAuthTries=3 (in-place edit)\n/var/log/proxmox-auth.log                             # written by logger service\n/var/log/ssh-auth.log                                 # written by logger service\n/var/log/proxmenux-auth.log                           # written by Monitor Flask app\n/usr/local/share/proxmenux/sshd_maxauthtries_backup   # for restore on uninstall"
+  },
+  "related": {
+    "heading": "Verwandte Themen",
+    "monitorLabel": "ProxMenux Monitor - Sicherheits-Tab",
+    "monitorTail": " — Installation über das Dashboard, aktueller Jail-Status, gesperrte IP-Adressen und Einstellung von Fehlversuchen und Sperrdauer je Jail im Browser.",
+    "lynisLabel": "Lynis",
+    "lynisTail": " — führen Sie vorher und nachher eine Sicherheitsprüfung aus, um die Erfüllung von SSH-7408 zu bestätigen.",
+    "securityLabel": "Sicherheitsübersicht",
+    "securityTail": " — zurück zur Abschnittsübersicht."
+  }
+}
diff --git a/web/messages/de/docs/security/index.json b/web/messages/de/docs/security/index.json
new file mode 100644
index 00000000..17af6319
--- /dev/null
+++ b/web/messages/de/docs/security/index.json
@@ -0,0 +1,70 @@
+{
+  "meta": {
+    "title": "Proxmox-Sicherheit — Fail2Ban, Lynis-Härtungsprüfung | ProxMenux",
+    "description": "Zwei installierbare Sicherheitswerkzeuge für Proxmox VE: Fail2Ban (Einbruchsschutz für SSH, Proxmox-Weboberfläche und ProxMenux Monitor) und Lynis (Sicherheits- und Härtungsprüfung aus dem offiziellen GitHub-Repository).",
+    "ogTitle": "Proxmox-Sicherheit — Fail2Ban und Lynis-Härtungsprüfung",
+    "ogDescription": "Fail2Ban und Lynis für Proxmox VE: Einbruchsschutz und Härtungsprüfung, installiert und verwaltet durch ProxMenux.",
+    "twitterTitle": "Proxmox Sicherheit | ProxMenux",
+    "twitterDescription": "Fail2Ban und Lynis für Proxmox VE: Einbruchsschutz und Härtungsprüfung."
+  },
+  "header": {
+    "title": "Sicherheit",
+    "description": "Zwei ergänzende Sicherheitswerkzeuge für Proxmox VE: aktive Abwehr (Fail2Ban sperrt IP-Adressen, die SSH oder Weboberflächen angreifen) und Offline-Prüfung (Lynis sucht Härtungslücken und vergibt 0–100 Punkte). Beide haben ein eigenes Installations- und Verwaltungsmenü, das vorhandene Installationen vor jeder Aktion erkennt.",
+    "section": "Sicherheit"
+  },
+  "intro": {
+    "title": "Aktive Abwehr und Offline-Prüfung",
+    "body": "Sie beantworten unterschiedliche Fragen. <strong>Fail2Ban</strong> beantwortet <em>„Werden wir gerade angegriffen?“</em>, indem es Anmeldeprotokolle überwacht und angreifende IP-Adressen sperrt. <strong>Lynis</strong> beantwortet <em>„Wie gut ist dieser Host gehärtet?“</em> mit einer einmaligen Prüfung und konkreten Empfehlungen. Nutzen Sie beide: Lynis zeigt Verbesserungen auf, Fail2Ban reagiert auf laufende Angriffe."
+  },
+  "opening": {
+    "heading": "Öffnen des Menüs",
+    "body": "Wählen Sie im ProxMenux-Hauptmenü <strong>Sicherheit</strong>. Folgendes wird angezeigt :",
+    "imageAlt": "Sicherheitsmenü mit Fail2Ban und Lynis Optionen"
+  },
+  "pick": {
+    "heading": "Wählen Sie Ihr Werkzeug",
+    "body": "Die beiden Werkzeuge sind unabhängig: Installieren Sie eines, beide oder keines. Jede Karte unten führt zum Abschnitt mit der ausführlichen Erklärung."
+  },
+  "cards": {
+    "fail2ban": {
+      "title": "Fail2Ban",
+      "body": "Aktiver Einbruchsschutz. Überwacht Anmeldeprotokolle von SSH und Weboberflächen und sperrt IP-Adressen nach wiederholten Fehlversuchen.",
+      "bullets": [
+        "Drei jails: SSH, Proxmox UI (8006), ProxMenux Monitor (8008)",
+        "Korrigiert Proxmox-Standardeinstellungen von journald, die Anmeldeprotokolle blockieren",
+        "Erkennt nftables / iptables automatisch",
+        "SSH-Härtung: MaxAuthTries=3 (Empfehlung von Lynis)"
+      ]
+    },
+    "lynis": {
+      "title": "Lynis",
+      "body": "Offline-Sicherheitsprüfer. Prüft den Host und zeigt eine Härtungsbewertung sowie konkrete Hinweise zur Behebung von Problemen.",
+      "bullets": [
+        "Aus dem offiziellen CISOfy-GitHub-Repository installiert (neueste Version)",
+        "Härtungsbewertung 0–100 und Liste mit Warnungen und Vorschlägen",
+        "Prüfung und Aktualisierung über das Menü",
+        "Nur lesend konzipiert: verändert das System nicht"
+      ]
+    }
+  },
+  "workflowTip": {
+    "title": "Workflow, der beides nutzt",
+    "body": "Führen Sie zuerst Lynis aus, um Ausgangsbewertung und wichtigste Empfehlungen zu sehen. Setzen Sie gewünschte Korrekturen um. Installieren Sie dann Fail2Ban: Es setzt automatisch den SSH-Brute-Force-Schutz um und passt <code>MaxAuthTries</code> in <code>sshd_config</code> an die Prüfung SSH-7408 an. Prüfen Sie anschließend mit Lynis die Verbesserung."
+  },
+  "fail2banSection": {
+    "heading": "Fail2Ban",
+    "body": "ProxMenux installiert Fail2Ban mit einer speziell für Proxmox optimierten Konfiguration. Über den Standard SSH jail hinaus bietet es Schutz für das Proxmox-Web UI und das ProxMenux Monitor und umgeht zwei Proxmox-spezifische Macken: eine journald-Standardeinstellung, die Authentifizierungsereignisse verwirft, und die systemd-Backend-Problem, das verhindert, dass Fail2Ban bestimmte Journalquellen zuverlässig liest. Die Detailseite behandelt den vollständigen Installationsablauf, die drei jails, den journald-Fix, die SSH-Härtungsänderung und den Fehlerbehebungs-Cheatsheet.",
+    "optionTitle": "Fail2Ban — installieren und verwalten",
+    "optionDescription": "Drei vorkonfigurierte Jails (sshd aggressiv, Proxmox-Weboberfläche auf 8006, ProxMenux Monitor auf 8008 und Reverse Proxy), automatische nftables/iptables-Erkennung, journald-Korrektur und SSH-Härtung mit MaxAuthTries."
+  },
+  "lynisSection": {
+    "heading": "Lynis",
+    "body": "ProxMenux klont Lynis von <code>github.com/CISOfy/lynis</code> nach <code>/opt/lynis</code> und macht es als <code>/usr/local/bin/lynis</code> verfügbar. Das Debian-Paket wird bewusst vermieden, da es mehrere Hauptversionen hinter dem Originalprojekt liegt. Die Detailseite erklärt Installation, Prüfung, Aktualisierung, Deinstallation, Auswertung des Berichts und Umsetzung der Ergebnisse.",
+    "optionTitle": "Lynis — installieren, auditieren und verwalten",
+    "optionDescription": "Installiert das neueste Lynis aus dem offiziellen CISOfy GitHub-Repo (nicht das ältere Debian-Paket), führt Systemaudits mit Hardening-Score und Updates per Git Pull aus."
+  },
+  "componentStatus": {
+    "heading": "Komponentenstatus",
+    "body": "Beide Installateure registrieren ihren Status in <code>/usr/local/share/proxmenux/components_status.json</code> unter der Kategorie <code>security</code>. ProxMenux verwendet diese Datei, um zu entscheiden, ob die Installation oder das Menü bei nachfolgenden Durchläufen angezeigt werden soll, und die gleichen Daten speisen die Dashboards im ProxMenux Monitor, wenn vorhanden."
+  }
+}
diff --git a/web/messages/de/docs/security/lynis.json b/web/messages/de/docs/security/lynis.json
new file mode 100644
index 00000000..36545875
--- /dev/null
+++ b/web/messages/de/docs/security/lynis.json
@@ -0,0 +1,170 @@
+{
+  "meta": {
+    "title": "Lynis | ProxMenux-Dokumentation",
+    "description": "Installieren Sie die neueste Lynis-Version aus dem offiziellen CISOfy-GitHub-Repository, führen Sie eine Sicherheitsprüfung mit Härtungsbewertung 0–100 aus und aktualisieren Sie per git pull. Rein lesende Prüfung ohne Systemänderungen.",
+    "ogTitle": "Lynis | ProxMenux-Dokumentation",
+    "ogDescription": "Lynis-Sicherheitsprüfung auf Proxmox VE installieren und ausführen. Installation aus dem Original-GitHub-Repository, Prüfung und Aktualisierung."
+  },
+  "header": {
+    "title": "Lynis",
+    "description": "Klont die neueste Lynis-Version aus dem offiziellen CISOfy-GitHub-Repository, stellt sie als /usr/local/bin/lynis bereit und bietet Prüfung, Aktualisierung, Neuinstallation und Deinstallation im Menü. Der Auditor liest nur und meldet Ergebnisse, ohne das System zu ändern.",
+    "section": "Sicherheit"
+  },
+  "intro": {
+    "title": "Was das macht",
+    "body": "Installiert Lynis, den Open-Source-Sicherheitsprüfer von CISOfy, aus dessen GitHub-Repository nach <code>/opt/lynis</code> und erstellt einen Starter unter <code>/usr/local/bin/lynis</code> für den Aufruf über <code>PATH</code>. Eine vorhandene Installation öffnet stattdessen ein Verwaltungsmenü für Prüfung, Aktualisierung, Neuinstallation oder Entfernung."
+  },
+  "manageMenu": {
+    "heading": "Verwaltungsmenü (nach der Installation)",
+    "intro": "Nach der Installation öffnet jeder weitere Aufruf das Verwaltungsmenü. Dort können Sie eine Prüfung starten, per git pull aktualisieren, neu installieren oder deinstallieren.",
+    "imageAlt": "Lynis Management Menü mit Audit, Update, Neuinstallation und Entfernen von Optionen"
+  },
+  "whyUpstream": {
+    "heading": "Warum das Original-GitHub-Repository statt apt",
+    "intro": "Debian bietet Lynis über apt an, doch das Paket liegt meist mehrere Hauptversionen hinter dem Originalprojekt. Neue Prüfungen, Korrekturen für neue Angriffsvektoren und überarbeitete Empfehlungen erscheinen zuerst auf GitHub. Lynis ist ein eigenständiges Shell-Skript ohne Kompilierung und ohne weitere Installationsabhängigkeiten außer <code>git</code>; CISOfy empfiehlt daher das Klonen des Repositorys.",
+    "headerSource": "Quelle",
+    "headerPath": "Install path",
+    "headerUpdate": "Aktualisierungsmethode",
+    "headerFresh": "Aktualität der Version",
+    "rows": [
+      {
+        "sourceRich": "<strong>ProxMenux (dieses Skript)</strong>",
+        "path": "/opt/lynis/",
+        "update": "git pull (im Menü)",
+        "fresh": "Neueste Version des Originalprojekts"
+      },
+      {
+        "sourceRich": "<strong>Debian apt</strong>",
+        "path": "/usr/bin/lynis",
+        "update": "apt upgrade",
+        "fresh": "Oft Monate / Jahre zurück"
+      }
+    ]
+  },
+  "install": {
+    "heading": "Wie die Installation funktioniert",
+    "node1Label": "github.com/CISOfy/lynis",
+    "node1Detail": "git clone\n(git zuerst installieren, falls nicht vorhanden)",
+    "node2Label": "/opt/lynis/",
+    "node2Detail": "Vollständiges Repo\neinschließlich ./lynis Skript",
+    "node3Label": "/usr/local/bin/lynis",
+    "node3Detail": "Umschlag:\ncd /opt/lynis && ./lynis $@",
+    "outro": "Der Wrapper ist obligatorisch - Lynis besteht darauf, aus seinem eigenen Verzeichnis ausgeführt zu werden, da er relative Pfade für Plugins und Profildaten lädt. Der Wrapper verbirgt dieses Detail, so dass <code>lynis audit system</code> von überall aus funktioniert."
+  },
+  "detection": {
+    "heading": "Detektionspfade",
+    "intro": "Bevor Sie das Menü anzeigen, überprüft das Skript drei Standorte, um zu entscheiden, ob Lynis bereits vorhanden ist:",
+    "items": [
+      "<code>/usr/local/bin/lynis</code> — Wrapper installiert von ProxMenux",
+      "<code>/opt/lynis/lynis</code> — direkter Pfad (falls der Wrapper entfernt wurde)",
+      "<code>/usr/bin/lynis</code> — apt-installierte Version, wenn der Benutzer es zuvor so installiert hat"
+    ],
+    "outro": "Wird einer dieser Pfade gefunden, öffnet sich das Verwaltungsmenü. Das Skript deinstalliert <strong>kein</strong> über apt installiertes Lynis, sondern nur die selbst verwaltete Installation in <code>/opt/lynis</code> samt Starter."
+  },
+  "audit": {
+    "heading": "Durchführung eines Audits",
+    "intro": "Wählen Sie im Verwaltungsmenü <strong>Sicherheitsprüfung jetzt ausführen</strong>. Das entspricht folgendem Aufruf :",
+    "code": "lynis audit system --no-colors",
+    "outro": "Die Prüfung dauert je nach Hostgröße 30 Sekunden bis einige Minuten. Die Ausgabe erscheint direkt im Terminal, ohne Warteanimation. Lynis gliedert die Prüfungen nach Kategorien und kennzeichnet Tests mit <ok>[ OK ]</ok>, <warn>[ WARNING ]</warn> oder <sugg>[ SUGGESTION ]</sugg>. Die abschließende Zusammenfassung enthält die wichtigsten Zahlen :",
+    "summary": "================================================================================\n\n  Lynis security scan details:\n\n  Hardening index : 76 [############        ]\n  Tests performed : 247\n  Plugins enabled : 0\n\n  Components:\n  - Firewall               [V]\n  - Malware scanner        [X]\n\n  Lynis modules:\n  - Compliance status      [?]\n  - Security audit         [V]\n  - Vulnerability scan     [V]\n\n================================================================================"
+  },
+  "report": {
+    "heading": "Lesen Sie den Bericht",
+    "intro": "Die beiden wichtigen Abschnitte sind <strong>Warnings</strong> (Dinge, die Sie bald beheben sollten) und <strong>Suggestions</strong> (Empfehlungen zur Verbesserung der Härtung). Jedes Element trägt eine Kontroll-ID wie <code>SSH-7408</code> - nützlich bei der Suche nach den Lynis-Dokumenten für die Gründe und die Korrektur.",
+    "headerMarker": "Markierung",
+    "headerMeaning": "Bedeutung",
+    "headerAction": "Aktion",
+    "rows": [
+      {
+        "markerRich": "<strong>OK</strong>",
+        "meaning": "Test bestanden",
+        "action": "Nichts"
+      },
+      {
+        "markerRich": "<strong>WARNING</strong>",
+        "meaning": "Echtes Problem, Fix empfohlen",
+        "action": "Lesen Sie die Prüfungsbeschreibung und planen Sie eine Korrektur."
+      },
+      {
+        "markerRich": "<strong>SUGGESTION</strong>",
+        "meaning": "Härtungsverbesserung verfügbar",
+        "action": "Umsetzen, wenn es zu Ihrem Bedrohungsmodell passt"
+      }
+    ],
+    "outro": "Der vollständige Bericht und die maschinenlesbaren Daten werden von Lynis selbst in <code>/var/log/lynis.log</code> und <code>/var/log/lynis-report.dat</code> geschrieben."
+  },
+  "pairFail2ban": {
+    "title": "Mit Fail2Ban kombinieren",
+    "body": "SSH-7408 (MaxAuthTries) ist eine der häufigsten Warnungen. Die Installation von <link>Fail2Ban</link> aus ProxMenux löscht es automatisch, da der Installer <code>MaxAuthTries=3</code> als Teil seines SSH-Härtungsschritts einstellt. Führen Sie Lynis danach erneut aus, um zu bestätigen, dass die Warnung verschwunden ist."
+  },
+  "update": {
+    "heading": "Lynis aktualisieren",
+    "body": "Im Verwaltungsmenü führt <strong>Lynis auf die neueste Version aktualisieren</strong> den Befehl <code>git pull --quiet</code> in <code>/opt/lynis</code> aus. Ist das Verzeichnis keine Git-Arbeitskopie, etwa nach manuellem Kopieren der Dateien, wird vollständig neu installiert."
+  },
+  "reinstall": {
+    "heading": "Reinstallieren / Deinstallieren",
+    "headerAction": "Aktion",
+    "headerWhat": "Was es tut",
+    "rows": [
+      {
+        "actionRich": "<strong>Neu installieren</strong>",
+        "whatRich": "Entfernt <code>/opt/lynis</code>, klont erneut von GitHub und erstellt den Starter neu. Für eine beschädigte lokale Arbeitskopie."
+      },
+      {
+        "actionRich": "<strong>Entfernen</strong>",
+        "whatRich": "Löscht <code>/opt/lynis</code> und <code>/usr/local/bin/lynis</code>. Protokolle bei <code>/var/log/lynis*</code> werden aufbewahrt (sie sind Audit-Historie). Ein apt-installiertes Lynis bei <code>/usr/bin/lynis</code> bleibt unberührt."
+      }
+    ]
+  },
+  "cli": {
+    "heading": "Nützliche CLI Optionen",
+    "intro": "Einmal installiert, kann Lynis direkt von einer Shell aus aufgerufen werden, wobei zusätzliche Optionen im Menü nicht angezeigt werden:",
+    "code": "lynis show version            # version + build date\nlynis show commands           # list every available command\nlynis show details TEST-ID    # explain a specific control\nlynis audit system --quick    # skip slow tests (e.g. malware scan)\nlynis audit system --pentest  # treat host as untrusted (more aggressive)\nlynis update info             # check if a newer Lynis is available\n\n# Filter the report log for just the warnings\ngrep \"Warning\" /var/log/lynis.log\n\n# Same, for suggestions only\ngrep \"Suggestion\" /var/log/lynis.log"
+  },
+  "troubleshoot": {
+    "heading": "Fehlerbehebung",
+    "cloneTitle": "git clone schlägt bei der Installation fehl",
+    "cloneBody": "Der Host benötigt Netzwerkzugang und DNS, um <code>github.com</code> zu erreichen. Von einer Konsole: <code>curl -sI https://github.com</code> und <code>git ls-remote https://github.com/CISOfy/lynis.git</code> wird der tatsächliche Fehler (DNS, TLS, Proxy, Repo-URL) enthüllt. Wenn ein Proxy erforderlich ist, legen Sie <code>https_proxy</code> in der Umgebung fest, bevor Sie das Menü erneut ausführen.",
+    "notFoundTitle": "lynis: Befehl nach der Installation nicht gefunden",
+    "notFoundIntro": "Der Wrapper bei <code>/usr/local/bin/lynis</code> wurde entweder nicht erstellt oder entfernt. Schnellste Lösung: Neuinstallation aus dem Menü. Manuelle Fixierung:",
+    "notFoundCode": "cat > /usr/local/bin/lynis <<'EOF'\n#!/bin/bash\ncd /opt/lynis && ./lynis \"$@\"\nEOF\nchmod +x /usr/local/bin/lynis",
+    "sshTitle": "Die Prüfung zeigt \"Warning: Test SSH-7408 — MaxAuthTries set incorrectly\"",
+    "sshIntro": "Der SSH-Daemon erlaubt zu viele Auth-Versuche pro Verbindung. Installieren Sie entweder <link>Fail2Ban</link> von ProxMenux (was <code>MaxAuthTries=3</code> automatisch einstellt) oder bearbeiten Sie <code>/etc/ssh/sshd_config</code> von Hand:",
+    "sshCode": "sed -i 's/^#?MaxAuthTries.*/MaxAuthTries 3/' /etc/ssh/sshd_config\nsystemctl reload sshd",
+    "scoreTitle": "Score ging nach einem Proxmox-Upgrade zurück",
+    "scoreBody": "Führen Sie <code>lynis update info</code> zuerst aus - ein Lynis-Update hat möglicherweise neue Steuerelemente hinzugefügt, die bestehende Konfiguration kennzeichnen. Aktualisieren Sie Lynis aus dem Menü, überprüfen Sie es erneut und sprechen Sie die neuen Erkenntnisse an."
+  },
+  "files": {
+    "heading": "Dateien geschrieben",
+    "code": "/opt/lynis/                   # full Lynis git checkout\n/usr/local/bin/lynis          # wrapper script (cd + exec)\n/var/log/lynis.log            # human-readable audit log (Lynis itself)\n/var/log/lynis-report.dat     # machine-readable report (Lynis itself)"
+  },
+  "sample": {
+    "heading": "Beispielbericht",
+    "intro": "ProxMenux Monitor erstellt zu jedem Lynis-Durchlauf eine mehrseitige PDF-Datei im <link>Reiter Sicherheit</link>. Die erste Seite fasst Härtungsbewertung, Systeminformationen und Sicherheitslage zusammen. Die weiteren Seiten erläutern jede Warnung, ordnen Vorschläge nach Auswirkung und enthalten das bei der Prüfung verwendete Paketinventar.",
+    "imageAlt": "Erste Seite des Lynis Security Audit Report PDF – Zusammenfassung mit Hardening Index 71/100, Systeminformationsblock und Sicherheitsübersicht mit Firewall, Malware-Scanner und installierten Paketen",
+    "captionPrefix": "Erste Seite eines Beispielberichts. Die vollständige PDF-Datei (",
+    "captionLink": "Probe",
+    "captionSuffix": ") fährt mit detaillierten Warnungen, Vorschlägen und der Liste der installierten Pakete fort.",
+    "cli": "Auf der CLI-Seite befinden sich die gleichen Daten in <code>/var/log/lynis-report.dat</code> (maschinenlesbare Flat-Datei) und <code>/var/log/lynis.log</code> (das vom Menschen lesbare Run-Log). Die PDF-Datei wird auf Anfrage von ProxMenux Monitor generiert – die Ausführung von <code>lynis</code> aus der Befehlszeile erzeugt keine."
+  },
+  "related": {
+    "heading": "Verwandte Themen",
+    "items": [
+      {
+        "href": "/docs/monitor/dashboard/security",
+        "label": "ProxMenux Monitor - Sicherheits-Tab",
+        "tail": " — Prüfung ausführen, frühere Berichte ansehen und die PDF-Datei direkt aus dem Dashboard herunterladen."
+      },
+      {
+        "href": "/docs/security/fail2ban",
+        "label": "Fail2Ban",
+        "tailRich": "- implementiert den von Lynis empfohlenen Brute-Force-Schutz SSH."
+      },
+      {
+        "href": "/docs/security",
+        "label": "Sicherheitsübersicht",
+        "tail": " — zurück zur Abschnittsübersicht."
+      }
+    ]
+  }
+}
diff --git a/web/messages/de/docs/security/ssl-letsencrypt.json b/web/messages/de/docs/security/ssl-letsencrypt.json
new file mode 100644
index 00000000..fecde538
--- /dev/null
+++ b/web/messages/de/docs/security/ssl-letsencrypt.json
@@ -0,0 +1,169 @@
+{
+  "meta": {
+    "title": "HTTPS für ProxMenux Monitor — Proxmox-Hostzertifikat oder eigene Pfade | ProxMenux",
+    "description": "Stellen Sie ProxMenux Monitor per HTTPS bereit, mit dem automatisch erkannten Proxmox-Hostzertifikat, einschließlich eines über Proxmox ACME installierten Let’s-Encrypt-Zertifikats, oder einem eigenen Zertifikat an beliebiger Stelle auf dem Datenträger.",
+    "ogTitle": "HTTPS für ProxMenux Monitor — Proxmox-Host oder benutzerdefiniertes Zertifikat",
+    "ogDescription": "Aktivieren Sie HTTPS am Port 8008 mit dem Proxmox-Hostzertifikat oder einem benutzerdefinierten .pem / .key-Paar."
+  },
+  "header": {
+    "title": "HTTPS für ProxMenux Monitor",
+    "description": "Aktivieren Sie HTTPS für Monitor auf Port 8008 mit dem automatisch erkannten Proxmox-Hostzertifikat oder einem eigenen Zertifikat auf dem Datenträger. Die Proxmox-Option bevorzugt das ACME-Zertifikat, falls vorhanden, und nutzt das von Proxmox verwaltete Let’s-Encrypt-Zertifikat ohne eigene Erneuerungsaufgabe.",
+    "section": "Sicherheit"
+  },
+  "intro": {
+    "title": "Was diese Seite abdeckt",
+    "body": "So wechseln Sie Monitor unter Einstellungen → Sicherheit von HTTP auf HTTPS, welche Dateien die Zertifikatsquellen verwenden, wie die Proxmox-Option mit Let’s Encrypt umgeht und wie Sie eigene Pfade für außerhalb von Proxmox verwaltete Zertifikate festlegen."
+  },
+  "wheresetting": {
+    "heading": "Wo Sie die Einstellung finden",
+    "body": "Öffnen Sie Monitor und gehen Sie zu <strong>Einstellungen → Sicherheit → HTTPS / SSL</strong>. Der Bereich zeigt HTTP oder HTTPS und bei noch deaktiviertem HTTPS die erkannten Zertifikatsquellen.",
+    "imageAlt": "Einstellungen → Sicherheit → HTTPS / SSL mit deaktiviertem HTTPS, erkanntem Proxmox-Zertifikat (Inhaber, Aussteller, Ablauf) und der Option für ein eigenes Zertifikat",
+    "caption": "Bereich Einstellungen → Sicherheit → HTTPS / SSL vor der Aktivierung. Monitor zeigt das von Proxmox verwendete Zertifikat und bietet es zur Auswahl mit einem Klick an."
+  },
+  "twoways": {
+    "heading": "Zwei Möglichkeiten, HTTPS zu aktivieren",
+    "proxmox": {
+      "title": "Das Proxmox-Zertifikat verwenden",
+      "summary": "Ein Klick: Monitor nutzt das Zertifikat, das Proxmox VE auf Port 8006 bereitstellt.",
+      "items": [
+        "Automatisch erkannt, keine Pfadeingabe erforderlich",
+        "Bevorzugt das ACME-Zertifikat, falls vorhanden; andernfalls das selbstsignierte Standardzertifikat",
+        "Proxmox erneuert; Monitor prüft und lädt das Zertifikat bei der nächsten neuen TLS-Verbindung"
+      ]
+    },
+    "custom": {
+      "title": "Benutzerdefiniertes Zertifikat verwenden",
+      "summaryRich": "Richten Sie den Monitor auf ein <code>.pem</code> / <code>.key</code>-Paar überall auf der Festplatte.",
+      "items": [
+        "Nur absolute Pfade (der Monitor-Prozess muss beide lesen können)",
+        "Nützlich, wenn Zertifikate von <code>certbot</code>, <code>acme.sh</code> oder einer Wildcard stammen",
+        "Sie verwalten die Erneuerung: Starten Sie Monitor nach Dateiänderungen neu"
+      ]
+    }
+  },
+  "proxmoxCert": {
+    "heading": "Proxmox-Zertifikat - was es tatsächlich zeigt",
+    "intro": "Proxmox VE führt zwei Zertifikatspaare in <code>/etc/pve/local/</code>:",
+    "table": {
+      "headers": {
+        "file": "Datei",
+        "origin": "Ursprung",
+        "when": "Wenn der Monitor es verwendet"
+      },
+      "rows": [
+        {
+          "fileRich": "<code>pveproxy-ssl.pem</code><br /><code>pveproxy-ssl.key</code>",
+          "originRich": "Benutzerdefiniertes Zertifikat, das über die Proxmox-Benutzeroberfläche hochgeladen wird - einschließlich des Let's Encrypt-Zertifikats, das unter <em>Datacenter → Node → Certificates → ACME</em> ausgestellt wurde.",
+          "when": "Bevorzugt, wenn beide Dateien existieren; Monitor nutzt das von Proxmox bereitgestellte Zertifikat."
+        },
+        {
+          "fileRich": "<code>pve-ssl.pem</code><br /><code>pve-ssl.key</code>",
+          "originRich": "Selbstsigniertes Zertifikat, das zum Zeitpunkt der Installation vom Proxmox PKI generiert wurde.",
+          "whenRich": "Fallback, wenn kein <code>pveproxy-ssl.pem</code> vorhanden ist."
+        }
+      ]
+    },
+    "callout": {
+      "title": "Gleiche Priorität wie Proxmox selbst",
+      "bodyRich": "<code>pveproxy</code> nutzt dieselbe Auswahlregel. Mit der Proxmox-Option verwendet Monitor das Zertifikat der Proxmox-Weboberfläche auf Port 8006, ohne Kopieren oder getrennten Erneuerungsablauf."
+    }
+  },
+  "letsencrypt": {
+    "heading": "Erhalten eines Let's Encrypt Zertifikats über Proxmox ACME",
+    "intro": "Proxmox VE enthält einen eigenen ACME-Client. <em>„Order Certificate Now“</em> speichert das Ergebnis in <code>/etc/pve/local/pveproxy-ssl.pem</code>, das Monitor liest. Die folgenden fünf Schritte fassen die <extlink1>offizielle Proxmox-Anleitung</extlink1> in den benötigten Befehlen zusammen.",
+    "prereqs": {
+      "title": "Voraussetzungen",
+      "items": [
+        "Der Knoten hat einen echten DNS-Namen (nicht nur eine IP), der darauf zeigt.",
+        "<strong>Entweder</strong> Port 80 aus dem Internet erreichbar (HTTP-01-Prüfung, am einfachsten) <strong>oder</strong> ein DNS-Anbieter mit API-Zugangsdaten (DNS-01, funktioniert hinter NAT und unterstützt Wildcards).",
+        "Eine E-Mail-Adresse für das ACME-Konto."
+      ]
+    },
+    "step1": {
+      "heading": "Schritt 1 — Registrieren Sie das ACME-Konto",
+      "introRich": "Ersetzen Sie die E-Mail durch Ihre. Der Kontoname <code>default</code> ist nur ein Label - Sie können eine beliebige Zeichenfolge verwenden.",
+      "code": "pvenode acme account register default you@example.com",
+      "afterRich": "Proxmox fordert Sie auf, die Nutzungsbedingungen von Let's Encrypt zu akzeptieren. Danach wird das Konto unter <code>/etc/pve/priv/acme/</code> fortgesetzt und die Registerkarte ACME in der GUI zeigt es an."
+    },
+    "step2": {
+      "heading": "Schritt 2 - Wählen Sie einen Herausforderungstyp",
+      "http01Rich": "<strong>HTTP-01</strong> ist das einfachste: es ist eingebaut, kein zusätzliches Plugin. Let's Encrypt verbindet sich mit <code>http://&lt;your-host&gt;/.well-known/acme-challenge/...</code> an Port 80, so dass Port 80 vom öffentlichen Internet zu Ihrem Knoten geöffnet sein muss - normalerweise ein Port vorwärts auf Ihrem Router.",
+      "dns01Rich": "<strong>DNS-01</strong> funktioniert ohne Port 80 (gut für Homelabs hinter CG-NAT) und ist die einzige Option für Wildcard-Zertifikate. Sie fügen ein DNS-Plugin einmal mit dem API-Token Ihres Providers hinzu. Cloudflare Beispiel:",
+      "code": "pvenode acme plugin add dns cf \\\n  --api cloudflare \\\n  --data CF_Token=YOUR_CLOUDFLARE_API_TOKEN",
+      "outroRich": "Für andere Anbieter (Gandi, OVH, AWS Route 53 usw.) nutzen Sie <code>pvenode acme plugin add dns --help</code>. Proxmox enthält <extlink2>alle DNS-Plugins von acme.sh</extlink2>."
+    },
+    "step3": {
+      "heading": "Schritt 3 - Binden Sie die Domain an Ihren Knoten",
+      "http01Rich": "Für HTTP-01 (verwendet das eingebaute <code>standalone</code>-Plugin):",
+      "code1": "pvenode config set --acme domains=host.example.com,account=default",
+      "dns01": "Für DNS-01 mit dem Cloudflare-Plugin aus Schritt 2:",
+      "code2": "pvenode config set --acmedomain0 domain=host.example.com,plugin=cf\npvenode config set --acme account=default",
+      "wildcardRich": "Wildcard? Fügen Sie <code>domain=*.example.com</code> auf einem separaten <code>--acmedomainN</code>-Eintrag hinzu. Wildcards erfordern DNS-01."
+    },
+    "step4": {
+      "heading": "Schritt 4 — Bestellen Sie das Zertifikat",
+      "code": "pvenode acme cert order",
+      "afterRich": "Der erste Lauf dauert normalerweise 30–60 Sekunden, während sich die Herausforderung ausbreitet. Beim Erfolg schreibt Proxmox <code>/etc/pve/local/pveproxy-ssl.pem</code> + <code>.key</code>, startet <code>pveproxy</code> neu und ein Erneuerungs-Cron wird automatisch geplant (Let's Encrypt Zertifikate sind gültig 90 Tage; Proxmox erneuert bei 60)."
+    },
+    "step5": {
+      "heading": "Schritt 5 — Überprüfung des Emittenten",
+      "code": "openssl x509 -in /etc/pve/local/pveproxy-ssl.pem -noout -issuer",
+      "afterRich": "Sollte einen Emittenten ab <code>O = Let's Encrypt</code> drucken. Wenn stattdessen <code>CN = Proxmox Virtual Environment</code> gelesen wird, ist die Bestellung fehlgeschlagen und die Datei ist immer noch das selbstsignierte PVE-Zertifikat - führen Sie <code>pvenode acme cert order --debug 1</code> erneut aus, um zu sehen, warum."
+    },
+    "gui": {
+      "title": "Bevorzugen Sie die GUI? Gleiche fünf Schritte",
+      "bodyRich": "<em>Datacenter → ACME</em> registriert das Konto; <em>Datacenter → ACME → Plugins</em> fügt das DNS-Plugin hinzu; <em>Node → Certificates → ACME</em> verknüpft die Domain; <em>Order Certificates Now</em> führt Schritt 4 aus. Die obigen CLI-Befehle eignen sich für Skripte und Systeme ohne grafische Oberfläche."
+    }
+  },
+  "switchToHttps": {
+    "heading": "Schalten Sie den Monitor auf HTTPS",
+    "bodyRich": "Sobald <code>/etc/pve/local/pveproxy-ssl.pem</code> von Let's Encrypt signiert ist, öffnen Sie <strong>Einstellungen → Sicherheit → HTTPS / SSL</strong>, prüfen als Aussteller <em>Let's Encrypt</em> statt der lokalen Proxmox-CA und wählen <strong>Proxmox-Zertifikat verwenden</strong>. Monitor startet neu und der nächste Aufruf nutzt HTTPS auf 8008 mit öffentlich vertrauenswürdiger Zertifikatskette. Spätere ACME-Erneuerungen werden bei der nächsten neuen TLS-Verbindung geprüft und ausgewählt, ohne regelmäßige Abfrage oder Dienstneustart zur Erneuerung. <strong>Zertifikat aktualisieren</strong> bleibt unter Sicherheit für Diagnose und Wiederherstellung verfügbar."
+  },
+  "custom": {
+    "heading": "Benutzerdefiniertes Zertifikat — wann es sinnvoll ist",
+    "intro": "Klicken Sie auf <strong>Benutzerdefiniertes Zertifikat verwenden</strong> und geben Sie zwei absolute Pfade ein :",
+    "items": [
+      "<strong>Zertifikat</strong>: vollständige Kette im PEM-Format (<code>.pem</code> oder <code>.crt</code>).",
+      "<strong>Privater Schlüssel</strong>: passender Schlüssel im PEM-Format (<code>.key</code>)."
+    ],
+    "outro": "Beide Dateien werden beim Start vom Monitor-Prozess gelesen. Sie müssen für den Benutzer lesbar bleiben, unter dem die systemd-Unit läuft (standardmäßig root). Übliche Orte bei ACME-Verwaltung außerhalb von Proxmox:",
+    "code": "# certbot\n/etc/letsencrypt/live/<your-host>/fullchain.pem\n/etc/letsencrypt/live/<your-host>/privkey.pem\n\n# acme.sh\n~/.acme.sh/<your-host>_ecc/fullchain.cer\n~/.acme.sh/<your-host>_ecc/<your-host>.key",
+    "symlinkCallout": {
+      "title": "Symlink-Ziele vs. Dateien",
+      "bodyRich": "<code>certbot</code> speichert die eigentlichen Dateien in <code>/etc/letsencrypt/archive/</code> und der <code>live/</code>-Pfad ist ein Symlink. Richten Sie den Monitor auf den <code>live/</code>-Symlink, nicht auf die <code>archive/</code>-Datei - so schreibt jeder Erneuerungszyklus einfach das Symlink-Ziel um und der Monitor nimmt das neue Zertifikat beim nächsten Servicestart entgegen."
+    }
+  },
+  "afterHttps": {
+    "heading": "Nach Aktivierung von HTTPS",
+    "bodyRich": "Das Speichern der Änderung schreibt <code>/etc/proxmenux/ssl_config.json</code> und löst einen Neustart der <code>proxmenux-monitor</code> systemd Einheit aus. Die Browser-Registerkarte verliert ihre aktuelle Verbindung - laden Sie sie auf <code>https://&lt;host&gt;:8008/</code> neu. Die erste Ladung mit einem Let's Encrypt-Zertifikat sollte keine Warnung zeigen; mit dem selbstsignierten Proxmox-Zertifikat benötigt der Browser eine Ausnahme, die gleiche wie für Port 8006.",
+    "reverse": {
+      "heading": "Reverse Proxys und Webhooks",
+      "bodyRich": "Wenn der Monitor zu HTTPS wechselt, schalten auch die für Benachrichtigungen registrierten Proxmox VE-webhook-URLs automatisch von <code>http://</code> zu <code>https://</code> um. Bestehende webhook-Einträge werden beim nächsten Speichern oder erneuten Erkennen einer Benachrichtigungsregel neu geschrieben, so dass keine manuelle Bearbeitung der Proxmox-Benachrichtigungskonfiguration erforderlich ist."
+    }
+  },
+  "trustCa": {
+    "heading": "Der selbstsignierten Proxmox-CA vertrauen",
+    "intro1Rich": "Um das Proxmox-Standardzertifikat ohne ACME zu behalten, importieren Sie die Cluster-Stamm-CA in den Zertifikatsspeicher von Betriebssystem oder Browser. Monitor erkennt <code>/etc/pve/local/pve-ssl.pem</code> als Ersatzzertifikat. Der Client vertraut dadurch dem Aussteller; die URL muss weiterhin zu einem Namen im Zertifikat passen.",
+    "intro2Rich": "Die CA-Datei lebt bei <code>/etc/pve/pve-root-ca.pem</code> auf jedem Knoten. In einem Cluster befindet sich der Pfad auf dem gemeinsamen <code>pmxcfs</code>-Dateisystem, so dass alle Knoten die gleiche Wurzel teilen und ein einziger Import das gesamte Rechenzentrum abdeckt. Kopieren Sie es auf Ihre Maschine:",
+    "code": "scp root@<your-host>:/etc/pve/pve-root-ca.pem ./pve-root-ca.pem",
+    "thenImport": "Importieren Sie die Datei anschließend auf dem Client:",
+    "items": [
+      "<strong>Linux (systemweit):</strong> Führen Sie <code>sudo cp pve-root-ca.pem /usr/local/share/ca-certificates/pve-root-ca.crt</code> und anschließend <code>sudo update-ca-certificates</code> aus. Browser mit System-Zertifikatsspeicher (Chromium, Edge) erkennen die CA nach dem Neustart; Firefox nutzt seinen eigenen Speicher und benötigt den folgenden manuellen Import.",
+      "<strong>macOS:</strong> Doppelklicken Sie auf die <code>.pem</code>-Datei. Fügen Sie sie in der Schlüsselbundverwaltung zum Schlüsselbund <em>System</em> hinzu und wählen Sie <em>Vertrauen → Immer vertrauen</em>.",
+      "<strong>Windows:</strong> Rechtsklick auf die Datei → <em>Zertifikat installieren</em> → unter <em>Vertrauenswürdige Stammzertifizierungsstellen</em> ablegen.",
+      "<strong>Firefox (jedes Betriebssystem):</strong> <em>Einstellungen → Datenschutz und Sicherheit → Zertifikate → Zertifikate anzeigen → Zertifizierungsstellen → Importieren</em>; aktivieren Sie <em>Dieser CA vertrauen, um Websites zu identifizieren</em>."
+    ],
+    "standalone": {
+      "title": "Standalone Knoten außerhalb eines Clusters",
+      "bodyRich": "Jeder nicht geclusterte Proxmox-Host hat seinen eigenen <code>pve-root-ca.pem</code>. Wenn Sie mehrere eigenständige Hosts verwalten, wiederholen Sie die Kopie / den Import für jeden oder verbinden Sie sie zu einem Cluster, so dass sie sich eine einzelne Wurzel teilen."
+    }
+  },
+  "disable": {
+    "heading": "Deaktivierung von HTTPS",
+    "bodyRich": "Wählen Sie im selben Bereich <strong>HTTPS deaktivieren</strong>. Monitor startet mit unverschlüsseltem HTTP neu, etwa wenn eine eigene Zertifikatsdatei unlesbar ist und der Dienst nicht startet. Es gibt keinen weiteren Deinstallationsschritt; Zertifikatsdateien bleiben unverändert.",
+    "stateCallout": {
+      "title": "Wo der Zustand gespeichert wird",
+      "bodyRich": "<code>/etc/proxmenux/ssl_config.json</code> speichert die aktiven Zertifikatpfade und die Quelle (<code>none</code>, <code>proxmox</code>, <code>custom</code>). Das Löschen der Datei entspricht dem Deaktivieren von HTTPS - beim nächsten Start fällt der Monitor auf HTTP zurück."
+    }
+  }
+}
diff --git a/web/messages/de/docs/settings/beta-program.json b/web/messages/de/docs/settings/beta-program.json
new file mode 100644
index 00000000..3dca055c
--- /dev/null
+++ b/web/messages/de/docs/settings/beta-program.json
@@ -0,0 +1,113 @@
+{
+  "meta": {
+    "title": "Veröffentlichungskanal ändern | ProxMenux-Dokumentation",
+    "description": "Wechseln Sie in einem Dialog zwischen den ProxMenux-Kanälen Stable (main) und Beta (develop). Bidirektional und idempotent; führt den offiziellen Installer des gewählten Kanals aus und normalisiert den Monitor-Dienst.",
+    "ogTitle": "Veröffentlichungskanal ändern | ProxMenux-Dokumentation",
+    "ogDescription": "Eine Einstellungsoption zum Wechsel zwischen Stable und Beta, ohne Installer manuell auszuführen."
+  },
+  "header": {
+    "title": "Veröffentlichungskanal ändern",
+    "description": "Eine gemeinsame Einstellungsoption wechselt ProxMenux zwischen Stable (Zweig main) und Beta (Zweig develop). Die frühere einseitige Option „Beta-Programm deaktivieren“ wurde durch einen bidirektionalen Dialog ersetzt, der beide Richtungen anbietet und den offiziellen Installer des gewählten Kanals ausführt.",
+    "section": "Einstellungen"
+  },
+  "intro": {
+    "title": "Was sich geändert hat",
+    "body": "Früher gab es zwei Abläufe: „Beta-Programm deaktivieren“, nur bei aktiver Beta sichtbar, und das manuelle erneute Ausführen des Beta-Installers zum Beitritt. Jetzt vereint der stets verfügbare Eintrag <strong>Veröffentlichungskanal ändern</strong> beide Abläufe, zeigt den aktuellen Kanal und ermöglicht den Wechsel in beide Richtungen."
+  },
+  "why": {
+    "heading": "Warum diese Option existiert",
+    "intro": "ProxMenux wird aus zwei Git-Zweigen bereitgestellt :",
+    "items": [
+      "<strong>Stable</strong>: der Zweig <code>main</code>, auf den das README verweist und den die meisten Betreiber bevorzugen. Seltener erscheinende Versionen mit Änderungen, die bereits die Beta-Validierung durchlaufen haben.",
+      "<strong>Beta</strong>: der Zweig <code>develop</code>. Neuere Funktionen und Monitor-Builds mit dem Versionskennzeichen der nächsten stabilen Version. Manche Funktionen sind noch fehlerhaft; mit der Teilnahme helfen Sie, sie vor der Veröffentlichung zu testen."
+    ],
+    "outro": "Früher musste man die richtige Installer-URL kennen, aus dem README kopieren und bei Unstimmigkeiten <code>config.json</code> manuell bearbeiten. Die gemeinsame Option erledigt den gesamten Ablauf in einer geführten Aktion."
+  },
+  "dialog": {
+    "heading": "Der Dialog",
+    "intro": "Im Hauptmenü: <strong>Einstellungen → Veröffentlichungskanal ändern</strong>. Ein Menü mit zwei Einträgen erscheint :",
+    "options": [
+      "<code>stable</code> — Stable (Zweig main)",
+      "<code>beta</code> — Beta (Zweig develop)"
+    ],
+    "behaviour": "Der aktuelle Kanal ist vorausgewählt und wird oben angezeigt. Wählen Sie denselben Kanal, erscheint „Dieser Veröffentlichungskanal ist bereits aktiv“; der Dialog ist idempotent. Ein anderer Kanal öffnet eine kanalspezifische Bestätigung :",
+    "directions": [
+      "<strong>Stable → Beta:</strong> warnt vor möglichen Fehlern oder unvollständigen Funktionen in Beta-Builds.",
+      "<strong>Beta → Stable: </strong> warnt davor, dass die Beta-Update-Prüfungen gestoppt werden und das stabile Installationsprogramm die Stable-Kanalkomponenten neu installiert."
+    ]
+  },
+  "confirm": {
+    "heading": "Was passiert, wenn Sie bestätigen",
+    "items": [
+      "<strong>Lädt den offiziellen Installer herunter</strong>:<ul><li>Stable: <code>install_proxmenux.sh</code> aus <code>main</code></li><li>Beta: <code>install_proxmenux_beta.sh</code> aus <code>develop</code></li></ul>Vor dem nächsten Schritt wird geprüft, ob die Datei vorhanden ist, und sie wird ausführbar gemacht.",
+      "<strong>Führt den Installer vollständig aus</strong>, denselben, auf den das README verweist. Komponentenerkennung, Dateisicherungen, Installation von Abhängigkeiten und Spracherhaltung folgen dem offiziellen Installationsablauf des Zielkanals.",
+      "Beim Wechsel zu <strong>Stable</strong> entfernt das Menü verbleibende Beta-Metadaten aus <code>config.json</code>: <code>beta_program</code>, <code>beta_version</code>, <code>install_branch</code> und <code>update_available.beta*</code>. <code>proxmenux_monitor.status = beta_updated</code> wird auf <code>updated</code> gesetzt. Die übrig gebliebene Datei <code>beta_version.txt</code> und heruntergeladene Beta-Installer werden entfernt.",
+      "Beim Wechsel zu Stable wird die systemd-Unit von Monitor aus der Stable-Vorlage neu geschrieben: „Beta“ entfällt aus der Beschreibung und <code>ExecStart</code> zeigt wieder auf das Laufzeitverzeichnis. Eine neue Ausgabe von <code>systemctl status</code> zeigt so den aktuellen Kanal.",
+      "Lädt das Konfigurationsmenü neu. <em>Versionsinformationen anzeigen</em> zeigt anschließend den neuen Kanal."
+    ]
+  },
+  "switching": {
+    "heading": "Hin- und Herschalten",
+    "intro": "Beide Richtungen durchlaufen das gleiche Installationsprogramm – es handelt sich <strong>nicht</strong> um Deinstallations- und Neuinstallationsabläufe in Sonderfällen. Jede Richtung führt einfach das eigene Installationsprogramm des Kanals aus, das idempotent und sicher für die erneute Ausführung einer vorhandenen Installation konzipiert ist. Praktische Konsequenzen:",
+    "items": [
+      "Ihre vorhandene Konfiguration, ProxMenux Monitor-Login (<code>auth.json</code>), Benachrichtigungskanäle, Registrierung nach der Installation, benutzerdefinierte Schwellenwerte - keine davon wird berührt. Der Channel Switch tauscht nur den Skriptbaum und den binären AppImage aus.",
+      "Ein Monitor, der vor dem Switch aktiv war, bleibt danach aktiv; einer, der deaktiviert wurde, bleibt deaktiviert.",
+      "ProxMenux Monitor <code>auth.json</code>, API-Token und das JWT-Geheimnis werden über Kanaländerungen hinweg bewahrt. Sitzungen werden nicht abgemeldet.",
+      "Sie können Kanäle so oft umdrehen, wie Sie möchten - der Dialog wird es jedes Mal akzeptieren und das Installationsprogramm erneut ausführen. Es ist kein Neustart von Proxmox erforderlich.",
+      "Der Kanalwechsel ersetzt den ProxMenux-Skriptbaum und kann daher nicht im Browser-Terminal von Monitor laufen: Die PTY würde während des Updates beendet und der Dialog unterbrochen. Dort erscheint stattdessen ein Informationsfenster mit dem offiziellen einzeiligen Installationsbefehl des Zielkanals. Führen Sie ihn per SSH oder in der Proxmox-Hostkonsole aus."
+    ]
+  },
+  "feedback": {
+    "heading": "Melden von Problemen aus der Beta",
+    "intro": "Wenn sich etwas unerwartet verhält, während Sie sich auf dem Beta-Kanal befinden, schließt das Öffnen eines Problems mit genügend Kontext die Lücke zu einem stabilen Release. Der nützlichste Bericht enthält:",
+    "items": [
+      "Was du getan hast und was du erwartet hast.",
+      "Alle Fehlermeldungen auf dem Bildschirm angezeigt.",
+      "Die entsprechenden Monitor-Logs:"
+    ],
+    "logsCommand": "journalctl -u proxmenux-monitor -n 50 --no-pager",
+    "versionLine": "Die aktuelle ProxMenux-Version (Einstellungen → <link>Versionsinformationen anzeigen</link>).",
+    "issueLine": "Öffnen Sie eine <ghlink>GitHub Issue</ghlink> mit diesen Informationen und wir kommen schneller zum Fix."
+  },
+  "manual": {
+    "heading": "Manuelles Äquivalent",
+    "intro": "Wenn Sie die Shell bevorzugen oder den Kanalwechsel per Skript steuern, sind dies die Befehle, die der Dialog ausführt :"
+  },
+  "unifiedCallout": {
+    "title": "Warum beide Richtungen jetzt eine Option sind",
+    "body": "Die frühere Option „Beta-Programm deaktivieren“ erschien nur nach einem Beta-Beitritt. Zum <em>Beitreten</em> musste man die Installer-URL anderswo suchen; zum <em>Verlassen</em> mitunter <code>beta_*</code>-Metadaten manuell bereinigen. <strong>Veröffentlichungskanal ändern</strong> erscheint immer, zeigt den aktuellen Kanal und behandelt beide Richtungen als ausführbaren, wiederholbaren und idempotenten Vorgang."
+  },
+  "troubleshoot": {
+    "heading": "Fehlerbehebung",
+    "downloadTitle": "\"Konnte den Installer nicht herunterladen\"",
+    "downloadBody": "Ausgehendes HTTPS zu <code>raw.githubusercontent.com</code> ist fehlgeschlagen. Prüfen Sie die Verbindung und DNS auf dem Host :",
+    "downloadCmd": "curl -fsSL -o /tmp/test https://raw.githubusercontent.com/MacRimi/ProxMenux/main/install_proxmenux.sh && head -1 /tmp/test",
+    "downloadOutro": "Wenn dies außerhalb von ProxMenux fehlschlägt, handelt es sich um ein Netzwerk- / Proxy-Problem auf dem Host.",
+    "errorsTitle": "\"Installer mit Fehlern beendet\"",
+    "errorsBody": "Der Installer hat einen Exitcode ungleich null zurückgegeben. Es gibt kein automatisches Zurücksetzen; einige Dateien oder Komponenten können bereits geändert worden sein. Lesen Sie die Ausgabe des Installers über der Fehlermeldung, bevor Sie Enter drücken, und prüfen Sie den aktuellen Zustand. Versuchen Sie es danach erneut über das Menü oder führen Sie den Installer manuell per SSH oder in der Hostkonsole aus.",
+    "configTitle": "\"Konfigurationsdatei konnte nicht aktualisiert werden\" nach dem Wechsel zu Stable",
+    "configBody": "Die Bereinigung von Beta-Metadaten nach der Installation ist fehlgeschlagen - in der Regel, weil <code>config.json</code> einen Syntaxfehler aus einer manuellen Bearbeitung aufweist. Validierung:",
+    "configCmd": "jq . /usr/local/share/proxmenux/config.json",
+    "configOutro": "Korrigieren Sie die Datei oder stellen Sie sie wieder her und führen Sie die Option erneut aus."
+  },
+  "related": {
+    "heading": "Verwandte Themen",
+    "items": [
+      {
+        "href": "/docs/settings/show-version-information",
+        "label": "Versionsinformationen anzeigen",
+        "tail": " — bestätigt, welcher Kanal jetzt aktiv ist."
+      },
+      {
+        "href": "/docs/settings/proxmenux-monitor",
+        "label": "ProxMenux Monitor",
+        "tail": "— der Monitordienst, der als Teil des Switches neu erstellt wird."
+      },
+      {
+        "href": "/docs/settings",
+        "label": "Einstellungen Übersicht",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/de/docs/settings/change-language.json b/web/messages/de/docs/settings/change-language.json
new file mode 100644
index 00000000..0a81659c
--- /dev/null
+++ b/web/messages/de/docs/settings/change-language.json
@@ -0,0 +1,108 @@
+{
+  "meta": {
+    "title": "Sprache ändern | ProxMenux-Dokumentation",
+    "description": "Wählen Sie aus acht Sprachen für die ProxMenux-Oberfläche. Jede Installation enthält vorab erzeugte JSON-Übersetzungskataloge; auf dem Host sind weder ein Übersetzungsdienst noch eine Python-Umgebung nötig. Das Menü wird automatisch neu geladen.",
+    "ogTitle": "Sprache ändern | ProxMenux-Dokumentation",
+    "ogDescription": "Wählen Sie in den Einstellungen eine von acht ProxMenux-Sprachen. Bei jeder Installation verfügbar."
+  },
+  "header": {
+    "title": "Sprache ändern",
+    "description": "Wechseln Sie die ProxMenux-Oberfläche zwischen acht unterstützten Sprachen. Die Auswahl wird in config.json gespeichert und das Menü in der neuen Sprache neu gestartet. Jede Installation enthält die Übersetzungskataloge.",
+    "section": "Einstellungen"
+  },
+  "intro": {
+    "title": "Was das ist",
+    "body": "Ein Dialog listet die acht unterstützten Sprachen auf. ProxMenux speichert Ihre Auswahl in <code>config.json</code> unter <code>.language</code> und startet <code>config_menu.sh</code> erneut, damit sie sofort wirksam wird."
+  },
+  "warn": {
+    "title": "Bei jeder Installation verfügbar",
+    "body": "Sprache ändern wird in den Einstellungen immer angezeigt. Die Kataloge werden in <code>/usr/local/share/proxmenux/lang/</code> installiert <em>und</em> die gewählte Sprache wird in <code>config.json</code> gespeichert. Die frühere Python-Übersetzungsumgebung ist nicht erforderlich."
+  },
+  "supported": {
+    "heading": "Unterstützte Sprachen",
+    "headerCode": "Code",
+    "headerLang": "Sprache",
+    "headerNotes": "Notizen",
+    "rows": [
+      {
+        "code": "en",
+        "lang": "Englisch",
+        "notes": "Ausgangssprache — am genauesten"
+      },
+      {
+        "code": "es",
+        "lang": "Spanisch",
+        "notes": "Vorab erzeugter JSON-Katalog"
+      },
+      {
+        "code": "fr",
+        "lang": "Französisch",
+        "notes": "Vorab erzeugter JSON-Katalog"
+      },
+      {
+        "code": "de",
+        "lang": "Deutsch",
+        "notes": "Vorab erzeugter JSON-Katalog"
+      },
+      {
+        "code": "it",
+        "lang": "Italienisch",
+        "notes": "Vorab erzeugter JSON-Katalog"
+      },
+      {
+        "code": "pt",
+        "lang": "Portugiesisch",
+        "notes": "Vorab erzeugter JSON-Katalog"
+      },
+      {
+        "code": "sk",
+        "lang": "Slowakisch",
+        "notes": "Vorab erzeugter JSON-Katalog"
+      },
+      {
+        "code": "sv",
+        "lang": "Schwedisch",
+        "notes": "Vorab erzeugter JSON-Katalog"
+      }
+    ]
+  },
+  "englishTip": {
+    "title": "Englisch ist am genauesten",
+    "body": "Nicht englische Texte stammen aus den mitgelieferten, vorab erzeugten JSON-Katalogen. Fehlende Übersetzungen fallen auf Englisch zurück; der Host ruft keinen Übersetzungsdienst auf. Bei zweifelhaften Übersetzungen bleibt Englisch die Referenz."
+  },
+  "underHood": {
+    "heading": "Wie es unter der Haube funktioniert",
+    "items": [
+      "Der Dialog listet acht Sprachcodes auf; wählen Sie einen aus.",
+      "Wenn <code>config.json</code> vorhanden ist: <code>jq --arg lang \"$new_language\" '.language = $lang''</code> aktualisiert das Feld.",
+      "Wenn <code>config.json</code> nicht existiert: Ein neuer wird mit dem Sprachcode in einem Einzelfeldobjekt erstellt.",
+      "Bestätigungsdialog: <em>\"Sprache geändert in [code]\"</em>.",
+      "<code>exec bash config_menu.sh</code> lädt das Einstellungsmenü mit der neuen aktiven Sprache neu."
+    ]
+  },
+  "manual": {
+    "heading": "Manuelles Äquivalent"
+  },
+  "troubleshoot": {
+    "heading": "Fehlerbehebung",
+    "noOptionTitle": "Option erscheint nicht in Einstellungen",
+    "noOptionBody": "Sprache ändern ist in aktuellen Versionen immer verfügbar. Falls die Option fehlt, aktualisieren Sie ProxMenux mit dem offiziellen Installer und öffnen die Einstellungen erneut.",
+    "stillEnglishTitle": "Sprache geändert, aber UI zeigt immer noch Englisch",
+    "stillEnglishBody": "Das Menü startet nach der Änderung erneut. Wenn Sie eine neue Shell geöffnet und einen anderen ProxMenux-Einstiegspunkt gestartet haben, führen Sie <code>menu</code> erneut aus, um die neue Sprache zu übernehmen. Prüfen Sie dies mit <code>jq -r '.language' /usr/local/share/proxmenux/config.json</code>."
+  },
+  "related": {
+    "heading": "Verwandte Themen",
+    "items": [
+      {
+        "href": "/docs/settings/show-version-information",
+        "label": "Versionsinformationen anzeigen",
+        "tail": " — bestätigt Veröffentlichungskanal, Übersetzungsdateien und aktuelle Sprache."
+      },
+      {
+        "href": "/docs/settings",
+        "label": "Einstellungen Übersicht",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/de/docs/settings/index.json b/web/messages/de/docs/settings/index.json
new file mode 100644
index 00000000..5bee3e2b
--- /dev/null
+++ b/web/messages/de/docs/settings/index.json
@@ -0,0 +1,81 @@
+{
+  "meta": {
+    "title": "ProxMenux-Einstellungen — Monitor aktivieren, Veröffentlichungskanal, Sprachen | ProxMenux",
+    "description": "ProxMenux-Einstellungen: Monitor-Dienst und Passwort-Rücksetzung, Stable/Beta-Kanal, acht Oberflächensprachen, Versionsdiagnose und Deinstallation. Monitor-Optionen erscheinen, wenn der Dienst installiert ist.",
+    "ogTitle": "ProxMenux-Einstellungen — Monitor aktivieren, Veröffentlichungskanal, Sprachen",
+    "ogDescription": "ProxMenux konfigurieren: Monitor-Dienst, Veröffentlichungskanal, Sprache, Versionsinformationen und Deinstallation.",
+    "twitterTitle": "ProxMenux Einstellungen",
+    "twitterDescription": "Monitor aktivieren, Veröffentlichungskanal wechseln, Sprachen, Versionsinformationen und Deinstallation."
+  },
+  "header": {
+    "title": "Einstellungen",
+    "description": "Konfigurieren Sie ProxMenux: Monitor-Dienst umschalten, Anmeldedaten zurücksetzen, in beide Richtungen zwischen Stable und Beta wechseln, eine von acht Sprachen wählen, Versionsdiagnose anzeigen und deinstallieren. Monitor-Aktionen setzen den installierten Dienst voraus; die Sprachauswahl ist immer verfügbar.",
+    "section": "Einstellungen"
+  },
+  "intro": {
+    "title": "Wofür dieses Menü ist",
+    "body": "Verwaltung von ProxMenux selbst: Monitor-Dienst, Verlassen des Beta-Kanals, Sprache, Versionsdiagnose und Deinstallation. Keine Option in diesem Menü verändert Ihre VMs, Container oder den Speicher."
+  },
+  "opening": {
+    "heading": "Öffnen des Menüs",
+    "body": "Drücken Sie im ProxMenux-Hauptmenü <kbd>s</kbd>. Monitor-Aktionen erscheinen, wenn der Dienst installiert ist; die übrigen Einstellungen sind immer verfügbar :",
+    "imageAlt": "ProxMenux-Einstellungsmenü mit bedingten Monitor-Aktionen"
+  },
+  "installTypes": {
+    "heading": "Eine Installation, alle Sprachen",
+    "intro": "Aktuelle Versionen enthalten bei jeder Installation statische JSON-Übersetzungskataloge. Ältere Versionen boten getrennte Modi mit Übersetzung und Normal an :",
+    "headerType": "Art der Installation",
+    "headerBundles": "Enthaltene Komponenten",
+    "headerMenu": "Angezeigte Menüoptionen",
+    "rows": [
+      {
+        "type": "Aktuelle Installation",
+        "bundles": "Statische JSON-Kataloge für sieben Sprachen plus integriertes Englisch; keine Python-Übersetzungsumgebung",
+        "menuRich": "<strong>Sprache ändern</strong> + Version anzeigen + Deinstallieren"
+      },
+      {
+        "type": "Frühere Modi mit Übersetzung / Normal",
+        "bundles": "Veraltete Trennung zwischen Übersetzungsumgebung und rein englischer Installation",
+        "menu": "Mit dem offiziellen Installer aktualisieren, um das aktuelle einheitliche Menü zu verwenden"
+      }
+    ],
+    "detectionTitle": "Sprachauswahl ist immer verfügbar",
+    "detectionBody": "Das Menü prüft keine Übersetzungsumgebung mehr. Jede Installation enthält <code>/usr/local/share/proxmenux/lang/</code> und speichert die gewählte <code>language</code> in <code>config.json</code>."
+  },
+  "options": {
+    "heading": "Menüoptionen",
+    "intro": "Diese Werkzeuge verwalten ProxMenux selbst. <em>Bedingt</em> bedeutet, dass Monitor-Aktionen nur bei installiertem systemd-Dienst erscheinen. Veröffentlichungskanal, Sprache, Versionsdiagnose und Deinstallation sind immer verfügbar.",
+    "list": [
+      {
+        "icon": "Activity",
+        "href": "/docs/settings/proxmenux-monitor",
+        "title": "ProxMenux Monitor",
+        "description": "Aktivieren / deaktivieren Sie die proxmenux-monitor.service systemd-Einheit, überprüfen Sie ihren aktuellen Zustand und setzen Sie das Dashboard-Anmeldepasswort zurück, wenn es verloren gegangen ist. Web-Benutzeroberfläche verfügbar auf TCP 8008.",
+        "badge": "Bedingt"
+      },
+      {
+        "icon": "TestTube",
+        "href": "/docs/settings/beta-program",
+        "title": "Veröffentlichungskanal ändern",
+        "description": "Wechseln Sie in einem Dialog in beide Richtungen zwischen Stable (main) und Beta (develop). Führt den offiziellen Installer des gewählten Kanals aus; idempotent und immer sichtbar.",
+        "badge": "Immer verfügbar"
+      },
+      {
+        "icon": "Info",
+        "href": "/docs/settings/show-version-information",
+        "title": "Versionsinformationen anzeigen",
+        "description": "ProxMenux-Version, Veröffentlichungskanal, installierte Komponenten, Dateipfade, Übersetzungsdateien und aktuelle Sprache."
+      },
+      {
+        "icon": "Trash2",
+        "href": "/docs/settings/uninstall-proxmenux",
+        "title": "Deinstallieren Sie ProxMenux",
+        "description": "Entfernen Sie ProxMenux und (optional) seine Abhängigkeiten. Außerdem werden /root/.bashrc- und /etc/motd-Backups wiederhergestellt, die zum Zeitpunkt der Installation erstellt wurden."
+      }
+    ]
+  },
+  "configTip": {
+    "title": "Speicherort der Konfiguration",
+    "bodyRich": "Die meisten von diesem Menü verwalteten Zustände werden in <code>/usr/local/share/proxmenux/config.json</code> gespeichert: <code>language</code>, <code>beta_program.status</code> und Installationskennzeichen je Komponente. Der Zustand des Monitor-Dienstes wird in systemd (<code>proxmenux-monitor.service</code>) verwaltet, nicht hier. Die Version wird aus <code>/usr/local/share/proxmenux/version.txt</code> gelesen."
+  }
+}
diff --git a/web/messages/de/docs/settings/proxmenux-monitor.json b/web/messages/de/docs/settings/proxmenux-monitor.json
new file mode 100644
index 00000000..f22df8b0
--- /dev/null
+++ b/web/messages/de/docs/settings/proxmenux-monitor.json
@@ -0,0 +1,119 @@
+{
+  "meta": {
+    "title": "ProxMenux Monitor | ProxMenux-Dokumentation",
+    "description": "Aktivieren oder deaktivieren Sie die proxmenux-monitor.service systemd-Einheit und überprüfen Sie ihren aktuellen Zustand. Der Monitor stellt eine Web-Benutzeroberfläche auf TCP 8008 für die visuelle Host-Überwachung zur Verfügung.",
+    "ogTitle": "ProxMenux Monitor | ProxMenux-Dokumentation",
+    "ogDescription": "Aktivieren oder deaktivieren Sie den systemd-Dienst proxmenux-monitor und prüfen Sie seinen Status in den Einstellungen."
+  },
+  "header": {
+    "title": "ProxMenux Monitor",
+    "description": "Zwei zusammenhängende Aktionen innerhalb des Einstellungsmenüs: Umschalten der proxmenux-monitor.service systemd-Einheit (Start / Stopp und Aktivieren / Deaktivieren mit einem Klick) und Anzeigen des aktuellen Detailstatus. Der Monitor stellt eine Web-Benutzeroberfläche auf TCP 8008 für die visuelle Host-Überwachung zur Verfügung.",
+    "section": "Einstellungen"
+  },
+  "intro": {
+    "title": "Was ist ProxMenux Monitor?",
+    "body": "ProxMenux Monitor ist ein integriertes Web-Dashboard, das Echtzeit-Sichtbarkeit in Ihre Proxmox-Infrastruktur bietet - zugänglich von jedem Browser in Ihrem Netzwerk, ohne ein Terminal zu benötigen."
+  },
+  "offers": {
+    "heading": "Was es bietet",
+    "items": [
+      "Echtzeitüberwachung von CPU, RAM, Festplattennutzung und Netzwerkverkehr.",
+      "Überblick über laufende VMs und LXC Container mit Statusindikatoren.",
+      "Login-Authentifizierung zum Schutz des Zugriffs.",
+      "Zwei-Faktor-Authentifizierung (2FA) mit TOTP-Unterstützung.",
+      "Reverse Proxy Unterstützung (Nginx / Traefik).",
+      "Entwickelt für die Arbeit auf Desktop- und mobilen Geräten."
+    ]
+  },
+  "access": {
+    "heading": "Zugang",
+    "intro": "Nach der Installation ist das Dashboard verfügbar unter:",
+    "url": "http://<your-proxmox-ip>:8008",
+    "outro": "Der Monitor wird automatisch als Teil der Standard-ProxMenux-Installation installiert und läuft als systemd-Dienst (<code>proxmenux-monitor.service</code>), der beim Booten automatisch startet."
+  },
+  "warnConditional": {
+    "title": "Einstellungen Optionen nur sichtbar, wenn Monitor installiert ist",
+    "body": "Die beiden unten beschriebenen Menüeinträge erscheinen nur in den Einstellungen, wenn <code>proxmenux-monitor.service</code> bei systemd registriert ist. Wenn Sie sie nicht sehen, wurde der Monitor nicht installiert (er ist während der ProxMenux-Installation optional). Um es später hinzuzufügen, installieren Sie ProxMenux mit der neuesten Version neu und wählen Sie die Option Monitor aus."
+  },
+  "toggle": {
+    "heading": "Aktivieren/Deaktivieren",
+    "intro": "Der erste Menüeintrag ist ein einzelner Umschalter, der zwischen zwei Zuständen wechselt, je nachdem, ob der Dienst gerade ausgeführt wird:",
+    "headerState": "Aktueller Zustand",
+    "headerLabel": "Menü-Label abgebildet",
+    "headerAction": "Aktion nach Bestätigung",
+    "rows": [
+      {
+        "state": "aktiv",
+        "label": "Deaktivieren Sie den ProxMenux Monitor",
+        "action": "systemctl stop + disable"
+      },
+      {
+        "state": "inaktiv",
+        "label": "Aktivieren Sie den ProxMenux Monitor",
+        "action": "systemctl enable + start"
+      }
+    ],
+    "outro": "Jede Umschaltung erfordert einen Ja/Nein-Dialog. Deaktivieren stoppt den Dienst <em>und</em> deaktiviert den Autostart; Aktivieren schaltet den Autostart ein <em>und</em> startet den Dienst sofort."
+  },
+  "status": {
+    "heading": "Status des Überwachungsdienstes anzeigen",
+    "intro": "Der zweite Menüeintrag liest nur Informationen. Er leert den Bildschirm, zeigt das ProxMenux-Logo und den Titel <em>„Überprüfung des Dienstes ProxMenux Monitor“</em> und meldet dann :",
+    "items": [
+      "<strong>Servicestatus: </strong> aktiv, inaktiv oder not_installed.",
+      "<strong>Web UI URL</strong> (nur wenn aktiv): <code>http://&lt;host_ip&gt;:8008</code> — abgeleitet von <code>hostname -I | awk '''{print $1}'''</code>.",
+      "<strong>Detaillierter systemd-Ausgang:</strong> <code>systemctl status proxmenux-monitor.service --no-pager -l</code> — zeigt aktuelle Protokollzeilen, ExecStart, MainPID usw."
+    ]
+  },
+  "manual": {
+    "title": "Manuelle Äquivalente",
+    "intro": "Von jeder Shell:",
+    "code": "systemctl status proxmenux-monitor.service       # detailed status\nsystemctl is-active proxmenux-monitor.service    # one-word status\nsystemctl enable --now proxmenux-monitor.service # enable + start\nsystemctl disable --now proxmenux-monitor.service # stop + disable\njournalctl -u proxmenux-monitor.service -f       # follow live logs"
+  },
+  "reset": {
+    "heading": "ProxMenux Monitor Passwort zurücksetzen",
+    "intro": "Wiederherstellungspfad für den Betreiber, der das Dashboard-Passwort (oder 2FA-Gerät) verloren hat. Die Option wird nur angezeigt, wenn der Monitor auf dem Host installiert ist. Auswählen:",
+    "items": [
+      "Bittet um Bestätigung mit einem Ja / Nein-Dialog - die Aktion ist destruktiv für die Anmeldeinformationen.",
+      "Sichert den vorhandenen <code>/root/.config/proxmenux-monitor/auth.json</code> auf <code>auth.json.bak-&lt;UTC timestamp&gt;</code> (Modus <code>0600</code>), so dass der vorherige Zustand manuell wiederhergestellt werden kann, wenn das Zurücksetzen ein Fehler war.",
+      "Stoppt den Dienst <code>proxmenux-monitor</code>, damit die Dateibearbeitung nicht gleichzeitig mit einer laufenden Anmeldung erfolgt.",
+      "Löscht die Identitätsfelder in <code>auth.json</code>: <code>enabled=false</code>, <code>configured=false</code>, leert <code>username</code>, <code>password_hash</code>, <code>totp_secret</code> und das Backup-Code-Array.",
+      "<strong>Behält</strong> <code>jwt_secret</code> sowie die registrierten <code>api_tokens</code> / <code>revoked_tokens</code> bei, sodass langlebige API-Token von Home Assistant oder anderen Skripten nach dem Zurücksetzen <em>weiterhin zur Authentifizierung funktionieren</em>.",
+      "Startet den Dienst neu. Der nächste Besuch bei <code>http://&lt;host&gt;:8008</code> zeigt den Erststart-Setup-Assistenten, sodass ein neues Admin-Konto erstellt werden kann."
+    ],
+    "preservedTitle": "Was überlebt den Reset, was nicht",
+    "preservedBody": "<strong>Gelöscht:</strong> Benutzername, Passwort-Hash, TOTP-Geheimnis für 2FA und Wiederherstellungscodes. <strong>Beibehalten:</strong> <code>jwt_secret</code>, Metadaten von <code>api_tokens</code> und die Liste <code>revoked_tokens</code>. Um auch alle API-Token ungültig zu machen und vollständig neu zu beginnen, löschen Sie <code>auth.json</code> manuell statt dieser Menüoption. Beim nächsten Dienststart werden JWT-Geheimnis und alle weiteren Daten neu erzeugt.",
+    "trustTitle": "Physical-Host-Zugang ist der Trust-Anker",
+    "trustBody": "Dieser Reset-Pfad erfordert eine Root-Shell auf dem Host. Jeder, der den <code>menu</code>-Befehl als root ausführen kann, steuert bereits die Box, so dass die Passwortwiederherstellung keine Privilegeskalation ist - sie stimmt mit der Funktionsweise jedes anderen Admin-Tools auf Proxmox überein. Die logische Folge: Der Monitor-Login schützt nichts vor jemandem, den Sie bereits in die Proxmox-Shell eingelassen haben.",
+    "seeAlso": "Siehe auch <link>Monitor → Zugriff und Authentifizierung → Verlorenes Passwort wiederherstellen</link> für denselben Ablauf aus Sicht des Dashboards sowie die Hintergründe zu Passwort-Hashes und zur Erzeugung des JWT-Geheimnisses."
+  },
+  "files": {
+    "heading": "Beteiligte Dateien",
+    "code": "/etc/systemd/system/proxmenux-monitor.service       # systemd unit\n/root/.config/proxmenux-monitor/                    # runtime config dir\n/var/log/proxmenux-auth.log                         # Flask app auth log\n                                                    # (read by Fail2Ban [proxmenux] jail)"
+  },
+  "troubleshoot": {
+    "heading": "Fehlerbehebung",
+    "missingTitle": "Beide Menüoptionen fehlen",
+    "missingBody": "Der Monitor ist nicht bei systemd registriert. Bestätigen Sie mit <code>systemctl list-unit-files | grep proxmenux-monitor</code> - wenn keine Ausgabe vorhanden ist, installieren Sie ProxMenux mit der neuesten Version erneut vom offiziellen Installer und wählen Sie während der Installation die Option Monitor aus.",
+    "unreachableTitle": "Service aktiviert, aber die URL ist nicht erreichbar",
+    "unreachableBody": "Die Einstellungsstatusausgabe gibt Ihnen die IP. Bestätigung:",
+    "unreachableCmd": "ss -tlnp | grep 8008                # is anything listening?\njournalctl -u proxmenux-monitor -n 100 --no-pager  # recent errors\ncurl -sI http://localhost:8008      # local reachability",
+    "unreachableOutro": "Wenn localhost funktioniert, aber nicht extern, überprüfen Sie Ihre Host-Firewall (<code>pve-firewall</code> oder nftables) auf eingehende TCP 8008.",
+    "stopsTitle": "Aktiviert den Dienst, aber es stoppt sich ein paar Sekunden später",
+    "stopsBody": "Meist liegt ein Portkonflikt (ein anderer Prozess nutzt 8008) oder eine fehlgeschlagene Abhängigkeitsprüfung vor. Das Systemjournal zeigt die Ursache: <code>journalctl -u proxmenux-monitor.service -b</code>."
+  },
+  "related": {
+    "heading": "Verwandte Themen",
+    "items": [
+      {
+        "href": "/docs/security/fail2ban",
+        "label": "Fail2Ban",
+        "tailRich": "– der <code>[proxmenux]</code> jail schützt den Monitor auf TCP 8008."
+      },
+      {
+        "href": "/docs/settings",
+        "label": "Einstellungen Übersicht",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/de/docs/settings/show-version-information.json b/web/messages/de/docs/settings/show-version-information.json
new file mode 100644
index 00000000..8d87b817
--- /dev/null
+++ b/web/messages/de/docs/settings/show-version-information.json
@@ -0,0 +1,81 @@
+{
+  "meta": {
+    "title": "Versionsinformationen anzeigen | ProxMenux-Dokumentation",
+    "description": "ProxMenux-Diagnose mit reinem Lesezugriff: Version, Veröffentlichungskanal, in config.json erfasste Komponenten, Dateipfade, Übersetzungskataloge und aktuelle Sprache.",
+    "ogTitle": "Versionsinformationen anzeigen | ProxMenux-Dokumentation",
+    "ogDescription": "Diagnoseausgabe zu ProxMenux-Version, Veröffentlichungskanal, Komponenten, Dateien und Sprache."
+  },
+  "header": {
+    "title": "Versionsinformationen anzeigen",
+    "description": "Diagnose mit reinem Lesezugriff. Liest version.txt, config.json und bekannte Dateipfade und zeigt ein scrollbares Textfeld mit Version, Veröffentlichungskanal, installierten Komponenten, vorhandenen Dateien, Übersetzungsdateien und aktueller Sprache an.",
+    "section": "Einstellungen"
+  },
+  "intro": {
+    "title": "Was das ist",
+    "body": "Eine Selbstdiagnose. Nützlich, wenn Sie ein Problem melden (Dialoginhalte in den Fehlerbericht einfügen) oder eine ordnungsgemäß abgeschlossene Installation bestätigen. Ändert nichts."
+  },
+  "reports": {
+    "heading": "Was sie berichtet",
+    "headerSection": "Abschnitt",
+    "headerSource": "Quelle",
+    "headerContent": "Inhalt",
+    "rows": [
+      {
+        "section": "Aktuelle Fassung",
+        "source": "version.txt",
+        "contentRich": "Einzeilige Versionsnummer; <code>Unknown</code> bei fehlender Datei"
+      },
+      {
+        "section": "Veröffentlichungskanal",
+        "source": "Beta-Programm-Status in config.json",
+        "content": "Stable (main) oder Beta (develop); Beta-Version, falls vorhanden"
+      },
+      {
+        "section": "Installierte Komponenten",
+        "source": "config.json",
+        "content": "Status je Komponente (✓ installiert / erstellt / aktualisiert, ✗ fehlt)"
+      },
+      {
+        "section": "ProxMenux Dateien",
+        "source": "Filesystemprüfungen",
+        "contentRich": "<code>menu</code>, <code>utils.sh</code>, <code>config.json</code>, <code>version.txt</code> Präsenz + Pfade"
+      },
+      {
+        "section": "Übersetzungsdateien",
+        "source": "/usr/local/share/proxmenux/lang/",
+        "content": "Vorhandensein des Verzeichnisses lang/, das jeder Installation beiliegt"
+      },
+      {
+        "section": "Aktuelle Sprache",
+        "source": "config.json",
+        "contentRich": "Sprachcode aus <code>.language</code>; standardmäßig <code>en</code>, wenn nicht gesetzt"
+      }
+    ]
+  },
+  "sampleHeading": "Beispielausgabe",
+  "manualHeading": "Manuelle Äquivalente",
+  "troubleshoot": {
+    "heading": "Fehlerbehebung",
+    "unknownTitle": "Version zeigt \"Unknown\"",
+    "unknownBody": "<code>/usr/local/share/proxmenux/version.txt</code> fehlt oder ist nicht lesbar. Am häufigsten verursacht durch eine teilweise Installation. Neuinstallation aus der offiziellen ProxMenux-Quelle.",
+    "noConfigTitle": "Keine Installationsinformationen verfügbar",
+    "noConfigBody": "<code>config.json</code> fehlt. Ohne diese Datei kann das Skript keine Komponenten auflisten. Installieren Sie neu, um sie wiederherzustellen.",
+    "wrongStatusTitle": "Eine Komponente zeigt ✗, obwohl ich sie sicher installiert habe",
+    "wrongStatusBody": "Das bedeutet, dass <code>config.json</code> diese Komponente nicht als installiert erfasst. Möglicherweise registriert sich das Skript noch nicht selbst, oder eine manuelle Installation hat ProxMenux umgangen. Der Dialog gibt den Inhalt von <code>config.json</code> wieder, nicht den tatsächlichen Zustand auf dem Datenträger."
+  },
+  "related": {
+    "heading": "Verwandte Themen",
+    "items": [
+      {
+        "href": "/docs/settings/uninstall-proxmenux",
+        "label": "Deinstallieren Sie ProxMenux",
+        "tail": " — entfernt alle diese Dateien."
+      },
+      {
+        "href": "/docs/settings",
+        "label": "Übersicht der Einstellungen",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/de/docs/settings/uninstall-proxmenux.json b/web/messages/de/docs/settings/uninstall-proxmenux.json
new file mode 100644
index 00000000..3abbcb94
--- /dev/null
+++ b/web/messages/de/docs/settings/uninstall-proxmenux.json
@@ -0,0 +1,92 @@
+{
+  "meta": {
+    "title": "ProxMenux deinstallieren | ProxMenux-Dokumentation",
+    "description": "Saubere ProxMenux-Deinstallation mit optionaler Entfernung von jq und dialog, Bereinigung alter Übersetzungsdateien und des Monitor-Dienstes sowie Wiederherstellung gesicherter Systemdateien.",
+    "ogTitle": "ProxMenux deinstallieren | ProxMenux-Dokumentation",
+    "ogDescription": "Entfernen Sie ProxMenux sauber von einem Proxmox-Host mit optionaler Abhängigkeitsbereinigung."
+  },
+  "header": {
+    "title": "Deinstallieren Sie ProxMenux",
+    "description": "Entfernt ProxMenux interaktiv vom Proxmox-Host: Bestätigung, optionale Entfernung von Abhängigkeiten, Bereinigung des ProxMenux-Monitor-Dienstes und Wiederherstellung der Sicherungen von /root/.bashrc und /etc/motd. Zeigt durchgehend einen Fortschrittsbalken an.",
+    "section": "Einstellungen"
+  },
+  "scopeWarn": {
+    "title": "Beeinflusst nur die ProxMenux-Installation - nicht Ihre VMs / CTs / Speicher",
+    "body": "Die Deinstallation entfernt die ProxMenux-Skripte, den Menüstarter, den optionalen Monitor-Dienst und die von ProxMenux bei der Installation angelegten Sicherungen von Systemdateien. <strong>VMs, Container, Speicher, Netzwerkkonfiguration, Fail2Ban, NVIDIA-Treiber und andere über ProxMenux installierte Komponenten bleiben unberührt.</strong> Sie bleiben in ihrem bisherigen Zustand."
+  },
+  "flow": {
+    "heading": "Ablauf der Deinstallation",
+    "items": [
+      "<strong>Bestätigungsdialog.</strong> Ja/nein: „Möchten Sie ProxMenux wirklich deinstallieren?“",
+      "<strong>Auswahlliste für Abhängigkeiten.</strong> Bietet jq und dialog an. Beide Kästchen sind standardmäßig aus; wählen Sie nur Abhängigkeiten aus, die keine andere Anwendung benötigt.",
+      "<strong>Die Entfernung zeigt einen Fortschrittsbalken.</strong> Entfernt eine gegebenenfalls verbliebene alte Übersetzungsumgebung, den Starter <code>menu</code>, den Verzeichnisbaum <code>/usr/local/share/proxmenux/</code>, den ProxMenux-Monitor-Dienst, falls vorhanden, und dessen in Proxmox VE registriertes Benachrichtigungsziel (<code>proxmenux-webhook</code> samt Matcher) sowie die ausgewählten Abhängigkeiten. Abschließend werden die Sicherungen der Systemdateien wiederhergestellt (siehe unten).",
+      "<strong>Abschlussdialog.</strong> Listet die entfernten Abhängigkeiten auf und beendet das Programm."
+    ]
+  },
+  "deps": {
+    "heading": "Abhängigkeitsentfernung: Was angeboten wird",
+    "intro": "Die Liste bietet jq und dialog an. <strong>Kein Kästchen ist standardmäßig markiert</strong>: Andere Anwendungen können diese systemweiten Pakete verwenden, daher ist Beibehalten sicherer.",
+    "headerType": "Installation",
+    "headerOffered": "Zur Entfernung angeboten",
+    "rows": [
+      {
+        "type": "Aktuelle Versionen",
+        "offeredRich": "<code>dialog</code>, <code>jq</code>"
+      },
+      {
+        "type": "Ältere Installationen nach dem Update",
+        "offeredRich": "<code>dialog</code>, <code>jq</code>"
+      }
+    ],
+    "warnTitle": "Systemweite Pakete - denken Sie zweimal",
+    "warnBody": "Die aktuelle Liste bietet <code>jq</code> und <code>dialog</code> an, nicht <code>python3</code>. Andere Werkzeuge können diese Systempakete benötigen. Beim Entfernen können auch abhängige Pakete oder ungenutzte Abhängigkeiten entfernt werden. Behalten Sie benötigte Pakete und prüfen Sie vorgeschlagene Entfernungen, bevor Sie apt manuell ausführen."
+  },
+  "removed": {
+    "heading": "Was entfernt wird",
+    "code": "/usr/local/bin/menu                                  # the launcher\n/usr/local/share/proxmenux/                          # everything: scripts, config, cache, version\n/opt/googletrans-env/                                # leftover legacy translation environment\n/etc/systemd/system/proxmenux-monitor.service        # Monitor service unit\n/root/.config/proxmenux-monitor/                     # Monitor config dir\n                                                     # + dependencies you ticked in the checklist"
+  },
+  "restored": {
+    "heading": "Was wiederhergestellt wird",
+    "items": [
+      "Wenn <code>/root/.bashrc.bak</code> existiert → zurück in <code>/root/.bashrc</code> umbenannt (Ihr ursprünglicher Bashrc kehrt zurück).",
+      "Falls <code>/etc/motd.bak</code> existiert, wird die Datei wieder in <code>/etc/motd</code> umbenannt. Andernfalls entfernt sed die ProxMenux-Zeile (<em>“This system is optimised by: ProxMenux”</em>) aus der vorhandenen motd."
+    ]
+  },
+  "othersCallout": {
+    "title": "Andere ProxMenux-installierte Komponenten bleiben",
+    "body": "Alles, was ProxMenux über andere Menüs installiert wird – Fail2Ban, Lynis, NVIDIA Treiber, Anpassungen nach der Installation – wird von diesem Deinstallationsprogramm <strong>nicht</strong> berührt. Jedes hat seinen eigenen Deinstallationsablauf in seinem jeweiligen Menü (oder Sie können es direkt mit apt entfernen). Sehen Sie sich zunächst <em>Versionsinformationen anzeigen</em> an, um zu sehen, was registriert ist."
+  },
+  "manual": {
+    "heading": "Manuelle Deinstallation",
+    "intro": "Wenn das Deinstallationsprogramm im Menü nicht ausgeführt werden kann (z. B. weil <code>dialog</code> bereits fehlt), ist dies die entsprechende manuelle Befehlsfolge:",
+    "code": "# 1. Stop and remove the Monitor service (if installed)\nsystemctl stop proxmenux-monitor.service 2>/dev/null\nsystemctl disable proxmenux-monitor.service 2>/dev/null\nrm -f /etc/systemd/system/proxmenux-monitor.service\nrm -rf /root/.config/proxmenux-monitor\nsystemctl daemon-reload\nsystemctl reset-failed 2>/dev/null\n\n# 2. Remove a leftover legacy translation environment\nrm -rf /opt/googletrans-env\n\n# 3. Remove ProxMenux files\nrm -f /usr/local/bin/menu\nrm -rf /usr/local/share/proxmenux\n\n# 4. Restore backups\n[ -f /root/.bashrc.bak ] && mv /root/.bashrc.bak /root/.bashrc\n[ -f /etc/motd.bak ] && mv /etc/motd.bak /etc/motd \\\n    || sed -i '/This system is optimised by: ProxMenux/d' /etc/motd"
+  },
+  "reinstall": {
+    "heading": "Später erneut installieren",
+    "body": "Führen Sie den offiziellen ProxMenux-Installer erneut aus. Aktuelle Versionen verwenden einen einheitlichen Installationsweg mit allen acht Oberflächensprachen."
+  },
+  "troubleshoot": {
+    "heading": "Fehlerbehebung",
+    "hangTitle": "Deinstallation bleibt beim Entfernen einer alten Übersetzungsumgebung hängen",
+    "hangBody": "Aktuelle Versionen entfernen eine übrig gebliebene Umgebung mit <code>rm -rf /opt/googletrans-env</code>; sie führen kein <code>pip uninstall</code> aus. Falls dieser Schritt hängt, prüfen Sie ihn in einer anderen Shell und kontrollieren das Dateisystem des Hosts vor einem erneuten Versuch.",
+    "aptTitle": "apt warnt beim Entfernen von Abhängigkeiten vor weiterhin verwendeten Paketen",
+    "aptBody": "Ausgewählte Pakete werden als automatisch installiert markiert und an <code>apt-get -y --purge autoremove</code> übergeben. Das garantiert keinen Schutz abhängiger Dienste. Lassen Sie benötigte Abhängigkeiten unmarkiert und prüfen Sie vor einer manuellen Bereinigung die von apt vorgeschlagenen Entfernungen.",
+    "motdTitle": "MOTD zeigt noch die ProxMenux Linie nach der Deinstallation",
+    "motdBody": "Möglicherweise existierte keine <code>/etc/motd.bak</code> und sed hat die Zeile nicht gefunden (etwa weil sie geändert wurde). Bearbeiten Sie <code>/etc/motd</code> manuell und entfernen Sie verbliebene ProxMenux-Zeilen."
+  },
+  "related": {
+    "heading": "Verwandte Themen",
+    "items": [
+      {
+        "href": "/docs/settings/show-version-information",
+        "label": "Versionsinformationen anzeigen",
+        "tail": " — zeigt vor der Deinstallation, was entfernt würde."
+      },
+      {
+        "href": "/docs/settings",
+        "label": "Übersicht der Einstellungen",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/de/docs/storage-share/host-iscsi.json b/web/messages/de/docs/storage-share/host-iscsi.json
new file mode 100644
index 00000000..4fd7d1eb
--- /dev/null
+++ b/web/messages/de/docs/storage-share/host-iscsi.json
@@ -0,0 +1,123 @@
+{
+  "meta": {
+    "title": "Host: Hinzufügen von iSCSI-Ziel als Proxmox-Speicher | ProxMenux Dokumentation",
+    "description": "Registrieren Sie ein iSCSI-Ziel als Proxmox-Speicher mit ProxMenux. Das Werkzeug installiert open-iscsi, erkennt Ziele am Portal per sendtargets, lässt ein Ziel auswählen und führt pvesm add iscsi aus. Es stellt rohe Blockgeräte für VM-Festplattenabbilder bereit.",
+    "ogTitle": "Host: Hinzufügen von iSCSI-Ziel als Proxmox-Speicher | ProxMenux Dokumentation",
+    "ogDescription": "Registrieren Sie ein iSCSI-Ziel als Proxmox-Speicher mit geführter Entdeckung. Verwendet pvesm add iscsi und bietet rohe Blockgeräte für VM Festplatten."
+  },
+  "header": {
+    "title": "Host: Hinzufügen von iSCSI-Ziel als Proxmox-Speicher",
+    "description": "Registrieren Sie ein iSCSI-Ziel (von einem SAN, TrueNAS / FreeNAS, Synology, einem Windows Server-Ziel, einem Array, das iSCSI spricht) als Proxmox-Speicher. Die exportierten LUNs erscheinen als Blockgeräte und können VM-Disk-Images mit nahezu lokaler Leistung über das Netzwerk hosten.",
+    "section": "Speicher und Freigaben · Host"
+  },
+  "intro": {
+    "title": "Was das macht",
+    "body": "ProxMenux wickelt <code>pvesm add iscsi</code> mit einem geführten Fluss ab: Es installiert <code>open-iscsi</code> bei Bedarf, fragt nach dem iSCSI-Portal (IP:port), führt <code>iscsiadm --mode discovery --type sendtargets</code> dagegen aus, lässt Sie einen Ziel-IQN auswählen und registriert den iSCSI-Speicher in Proxmox. Der <code>iscsid</code>-Dienst hält dann die iSCSI-Sitzung über Neustarts hinweg am Leben."
+  },
+  "vocab": {
+    "heading": "iSCSI Vokabular (schnelle Referenz)",
+    "headerTerm": "Begriff",
+    "headerMeaning": "Bedeutung",
+    "rows": [
+      {
+        "term": "Portal",
+        "meaningRich": "Der iSCSI-Service-Endpunkt auf dem Zielserver – eine IP (oder ein Hostname) sowie ein TCP-Port. Standard-Port ist <code>3260</code>; ProxMenux nimmt es an, wenn Sie keinen angeben."
+      },
+      {
+        "term": "Ziel",
+        "meaningRich": "Ein einzelner exportierter \"Server\" innerhalb des Portals, der durch seine IQN identifiziert wird (<em>iSCSI Qualified Name</em>). Ein Portal kann viele Ziele hosten."
+      },
+      {
+        "term": "IQN",
+        "meaningRich": "Canonical Form ist <code>iqn.YYYY-MM.reverse.domain:identifier</code>, zum Beispiel <code>iqn.2024-08.com.truenas:proxmox-pool</code>. Sowohl das Ziel als auch der Initiator haben ihren eigenen IQN."
+      },
+      {
+        "term": "LUN",
+        "meaningRich": "Ein Blockgerät innerhalb eines Ziels (Logical Unit Number). Ein einzelnes Ziel kann mehrere LUNs freilegen; jede LUN erscheint als eigene Festplatte in Proxmox und kann eine VM-Festplatte werden."
+      },
+      {
+        "term": "Initiator",
+        "meaningRich": "Der Client, der sich mit einem Ziel verbindet - in diesem Fall Ihr Proxmox-Host. Der Initiator hat seine eigene IQN in <code>/etc/iscsi/initiatorname.iscsi</code> gespeichert. Ziele akzeptieren in der Regel nur Sitzungen von vorautorisierten Initiator-IQNs."
+      }
+    ]
+  },
+  "opening": {
+    "heading": "Öffnen des Tools",
+    "body": "Öffnen Sie im Hauptmenü von ProxMenux <strong>Storage &amp; Share Manager → iSCSI Target als Proxmox Storage</strong> hinzufügen. Sie sehen dieses sub-Menü mit vier Optionen:",
+    "imageAlt": "iSCSI Host Manager-Menü – Konnektivität hinzufügen / anzeigen / entfernen / testen"
+  },
+  "howRuns": {
+    "heading": "Wie das Skript läuft (Flow hinzufügen)",
+    "body": "Der Fluss hat zwei Phasen mit klarer Trennung zwischen \"Einrichten des Initiators, Auffinden von Zielen\" und \"tatsächliche Registrierung von Speicher in Proxmox\". Im Gegensatz zu NFS / Samba gibt es keine automatische Entdeckung im Subnetz - Sie müssen die Portaladresse kennen (iSCSI ist nicht sendefreundlich)."
+  },
+  "add": {
+    "heading": "Hinzufügen von iSCSI-Ziel als Proxmox-Speicher",
+    "items": [
+      "<strong>Portal eingeben</strong> — geben Sie die IP-Adresse oder den Hostnamen des iSCSI-Zielservers ein. Port <code>3260</code> wird angenommen, es sei denn, Sie geben <code>host:port</code> ein.",
+      "<strong>Zielerkennung</strong> — ProxMenux ruft <code>iscsiadm --mode discovery --type sendtargets --portal &lt;ip:port&gt;</code> auf. Der Server antwortet mit jedem IQN, den dieser Initiator sehen kann. Wenn die Entdeckung fehlschlägt, zeigt das Skript den genauen Fehler aus <code>iscsiadm</code> und listet die häufigsten Ursachen auf (falsche IP, Firewall, Initiator IQN nicht autorisiert).",
+      "<strong>Zielauswahl</strong> — einzelnes Ziel wird automatisch ausgewählt; mehrere Ziele zeigen ein Menü an.",
+      "<strong>Storage ID</strong> — Standard ist <code>iscsi-&lt;last IQN segment, 20 chars max&gt;</code>. Nur Buchstaben, Ziffern, <code>-</code> und <code>_</code>.",
+      "<strong>Inhaltstyp</strong> — im Gegensatz zu NFS/Samba ist der iSCSI-Inhalt <strong>fest auf <code>images</code></strong> eingestellt. iSCSI stellt rohe Blockgeräte bereit, kein Dateisystem; deshalb sind dort nur VM-Festplatten möglich."
+    ],
+    "authTitle": "Autorisieren Sie den Proxmox-Initiator auf dem Target",
+    "authBody1": "Bevor der Add-Flow Ende-zu-Ende funktioniert, muss das iSCSI-Ziel Ihren Proxmox-Host kennen. Holen Sie sich Ihren Initiator IQN:",
+    "authBody2": "Fügen Sie dieses IQN zur Zugriffsliste des Ziels hinzu (TrueNAS: <em>Sharing → Block → Initiators Groups</em>; Synology: <em>SAN Manager → iSCSI → Target → Edit → Initiators</em>; usw.). Ist der Initiator nicht autorisiert, liefert die Erkennung mit <code>iscsiadm</code> eine leere Liste oder einen Authentifizierungsfehler."
+  },
+  "manual": {
+    "heading": "Manuelles Äquivalent",
+    "body": "Der gesamte Flow bildet diese Befehle ab:"
+  },
+  "view": {
+    "heading": "Ansicht konfigurierter iSCSI-Speicher",
+    "body": "Listet jeden iSCSI-Eintrag in Proxmox (<code>pvesm status | awk ''$2 == \"iscsi\"''</code>) mit Portal, Ziel-IQN, Inhaltstyp und Live-Status auf."
+  },
+  "remove": {
+    "heading": "iSCSI-Speicher entfernen",
+    "body": "Führt <code>pvesm remove &lt;storage-id&gt;</code> nach Bestätigung von Portal, Ziel und Inhalt aus. Nur die Proxmox-Registrierung wird entfernt - <strong>das iSCSI-Ziel selbst wird nicht berührt</strong> und bestehende Sitzungen auf der Kernelseite können bis zum nächsten Neustart verweilen.",
+    "warnTitle": "Zuerst vorhandene VM-Festplatten auf diesem iSCSI prüfen",
+    "warnBody": "Das Entfernen eines iSCSI-Speichers, während VMs noch Festplatten haben, lässt diese VMs auf einen verschwundenen Speicher zeigen. Proxmox markiert den Fehler, aber die LUN-Daten sind auf dem Ziel unberührt - Sie können den Speicher später erneut registrieren, um die Festplatten zurückzubekommen. Bewegen oder sichern Sie die VMs zuerst, um sicher zu sein."
+  },
+  "test": {
+    "heading": "iSCSI-Konnektivität testen",
+    "body": "Führt einen Diagnosedurchlauf aus: Prüft, ob <code>iscsiadm</code> installiert ist, druckt Ihren Initiator IQN aus, bestätigt, dass <code>iscsid</code> ausgeführt wird, pingt jedes registrierte Portal, prüft seinen Port und meldet <code>pvesm status</code> sowie, ob eine iSCSI-Sitzung derzeit aktiv ist (<code>iscsiadm --mode session</code>). Aktive Sitzung plus erreichbares Portal, aber \"inaktiv\" in Proxmox bedeutet normalerweise einen abgestandenen Zustand - versuchen Sie <code>pvesm set &lt;id&gt; --disable 0</code>."
+  },
+  "troubleshoot": {
+    "heading": "Fehlerbehebung",
+    "portalTitle": "\"Kann das Portal nicht erreichen\", aber die Server-IP antwortet an anderer Stelle",
+    "portalBody": "Ping scheiterte an der Portaladresse. Überprüfen Sie, ob Sie die <em>storage-Netzwerk</em>-Schnittstelle erreichen (iSCSI lebt oft in einem separaten VLAN / Subnetz aus dem Verwaltungsnetzwerk). Überprüfen Sie auch DNS, wenn Sie einen Hostnamen eingegeben haben.",
+    "discoverTitle": "\"iSCSI Discovery failed\" von iscsiadm",
+    "discoverIntro": "Das Skript zeigt den genauen Fehler. Die häufigsten Ursachen:",
+    "discoverItems": [
+      "Portal IP / Port falsch (Doppelprüfung, standardmäßig 3260).",
+      "iSCSI-Dienst läuft nicht auf dem Zielserver.",
+      "Firewall blockiert 3260 zwischen Proxmox und dem Ziel.",
+      "<strong>Die Initiator-IQN ist auf dem Ziel nicht autorisiert.</strong> Dies ist die häufigste Ursache bei Unternehmens-Arrays. Tragen Sie die Proxmox-IQN zuerst in die Initiator-ACL des Ziels ein."
+    ],
+    "noTargetTitle": "Keine Ziele gefunden, aber Entdeckung erfolgreich",
+    "noTargetBody": "Der Server hat Ihren Initiator akzeptiert, setzt ihm aber kein Ziel aus. Überprüfen Sie die Authentifizierung / Zugriffskontrollen des Ziels - einige Arrays ermöglichen die Erkennung für alle IQNs, filtern jedoch, welche Ziele jedes IQN sehen kann.",
+    "noLunTitle": "LUNs erscheinen nicht in /dev/disk/by-path nach der Registrierung",
+    "noLunBody": "<code>pvesm add iscsi</code> war erfolgreich, aber der Kernel sieht keine Blockgeräte. Überprüfen Sie <code>iscsiadm --mode session</code> - wenn keine Sitzung aktiv ist, starten Sie eine manuell mit <code>iscsiadm --mode node --login</code>. Wenn eine Sitzung existiert, aber keine LUNs angezeigt werden, erzwingen Sie ein Rescannen: <code>iscsiadm --mode session --rescan</code>. Wenn immer noch nichts, hat das Ziel wahrscheinlich noch keine LUNs diesem IQN zugewiesen (Konfigurieren Sie die LUN-Zuordnung auf dem Ziel).",
+    "chapTitle": "CHAP-Authentifizierung",
+    "chapBody": "ProxMenux bietet im interaktiven Ablauf keine Felder für CHAP-Benutzername und -Passwort. Schlägt die Erkennung fehl, stoppt das Skript vor <code>pvesm add</code>; der Speicher wird nicht trotzdem registriert. Konfigurieren Sie die CHAP-Anforderungen des Ziels separat in <code>open-iscsi</code>, einschließlich der Erkennungsauthentifizierung, falls nötig, und versuchen Sie es erneut. Prüfen Sie die Konfiguration mit <code>iscsiadm</code> und aktive Sitzungen mit <code>iscsiadm --mode session</code>."
+  },
+  "related": {
+    "heading": "Verwandte Themen",
+    "items": [
+      {
+        "href": "/docs/storage-share/host-nfs",
+        "label": "NFS-Freigabe als Proxmox-Speicher",
+        "tail": "— Alternative auf Dateiebene. Einfacher einzurichten, flexibler (Backup / ISO / tmpl / Images), etwas langsamer für VM-Live-Disketten."
+      },
+      {
+        "href": "/docs/storage-share/host-samba",
+        "label": "Samba / CIFS als Proxmox-Speicher",
+        "tail": " — eine weitere Option auf Dateiebene; wegen der Sperrsemantik für Festplatten laufender VMs vermeiden."
+      },
+      {
+        "href": "/docs/storage-share/host-local-disk",
+        "label": "Lokale Festplatte als Proxmox-Speicher hinzufügen",
+        "tail": "- wenn die Festplatte lokal auf dem Proxmox-Host ist, nicht auf einer anderen Box über das Netzwerk."
+      }
+    ]
+  }
+}
diff --git a/web/messages/de/docs/storage-share/host-local-disk.json b/web/messages/de/docs/storage-share/host-local-disk.json
new file mode 100644
index 00000000..7f66e57a
--- /dev/null
+++ b/web/messages/de/docs/storage-share/host-local-disk.json
@@ -0,0 +1,186 @@
+{
+  "meta": {
+    "title": "Host: Lokale Festplatte als Proxmox-Speicher hinzufügen | ProxMenux Dokumentation",
+    "description": "Formatieren Sie einen lokalen SATA-, SAS- oder NVMe-Datenträger auf einem Proxmox-Host und registrieren Sie ihn als Verzeichnis- oder ZFS-Pool-Storage. Mit sicherer Datenträgerauswahl, Bestätigung vor destruktiven Schritten, UUID-basiertem fstab, ZFS-Pool-Erstellung und pvesm add dir / zfspool im Hintergrund.",
+    "ogTitle": "Host: Lokale Festplatte als Proxmox-Speicher hinzufügen | ProxMenux Dokumentation",
+    "ogDescription": "Formatieren Sie eine lokale Festplatte und registrieren Sie sie als Proxmox-Verzeichnis oder ZFS-Poolspeicher mit einem geführten, sicherheitsgefilterten Fluss."
+  },
+  "header": {
+    "title": "Host: Lokale Festplatte als Proxmox-Speicher hinzufügen",
+    "description": "Nehmen Sie eine physische Festplatte auf dem Proxmox-Host, formatieren Sie sie optional (ext4 / xfs / btrfs / zfs) und registrieren Sie sie als Proxmox-Speicher - entweder als Verzeichnis (pvesm add dir) oder als ZFS-Pool (pvesm add zfspool). ProxMenux filtert die Festplattenliste, so dass Sie die Systemfestplatte oder etwas in Gebrauch nicht auswählen können, und macht jeden destruktiven Schritt explizit, bevor Sie sie ausführen.",
+    "section": "Speicher und Freigaben · Host"
+  },
+  "intro": {
+    "title": "Was das macht",
+    "body": "Andere <em>Host</em>-Tools in diesem Abschnitt befassen sich mit <strong>Netzwerkspeicher</strong> (NFS / Samba / iSCSI). Dieser befasst sich mit <strong>lokalen</strong> Festplatten - Ersatzlaufwerke, die physisch an Ihren Proxmox-Host angeschlossen sind und die Sie für VM-Festplatten, Backups, ISOs oder Vorlagen verwenden möchten. ProxMenux bereitet die Festplatte (Partition + Format + Mount) vor und registriert sie in Proxmox, damit die Benutzeroberfläche Inhalte dort platzieren kann."
+  },
+  "destructive": {
+    "title": "Zerstörendes Werkzeug für den \"Format\"-Pfad",
+    "body": "Der Ablauf <em>Formatieren</em> <strong>zerstört die vorhandenen Partitionen und Daten auf dem ausgewählten Datenträger</strong>. ProxMenux zeigt eine Warnung, filtert verwendete Datenträger heraus und verlangt eine Bestätigung vor <code>wipefs</code> / <code>sgdisk</code> / <code>mkfs</code>. Dies ist kein sicheres Überschreiben jedes Bytes. Prüfen Sie den Gerätepfad vor der Bestätigung zweimal."
+  },
+  "compare": {
+    "heading": "Verzeichnis oder ZFS-Pool — was wählen?",
+    "headerDir": "Verzeichnis (ext4 / xfs / btrfs)",
+    "headerZfs": "ZFS-Pool",
+    "rows": [
+      {
+        "label": "Proxmox-Speichertyp",
+        "dirRich": "<code>dir</code>",
+        "zfsRich": "<code>zfspool</code>"
+      },
+      {
+        "label": "VM Plattenformat",
+        "dir": "qcow2-/raw-Datei in einem Dateisystem",
+        "zfs": "Nativer ZFS-Datensatz (zvol) pro Festplatte"
+      },
+      {
+        "label": "Momentaufnahmen",
+        "dir": "qcow2-Snapshots; btrfs-Snapshots bei fs=btrfs",
+        "zfs": "Native, Instant, Copy-on-Write"
+      },
+      {
+        "label": "Dynamische Speicherzuweisung",
+        "dir": "Ja (qcow2-Standard)",
+        "zfs": "Ja (ZFS Standard)"
+      },
+      {
+        "label": "RAM Bedürfnisse",
+        "dir": "niedrig",
+        "zfs": "Hoch — ZFS nutzt freien RAM als ARC-Cache"
+      },
+      {
+        "label": "Unterstützt Inhaltstypen",
+        "dir": "images, backup, iso, vztmpl, snippets, rootdir",
+        "zfs": "nur images und rootdir (Blockspeicher)"
+      },
+      {
+        "label": "Am besten für",
+        "dir": "Allzweck-Disk: Mix aus VM-Disks, Backups, ISOs",
+        "zfs": "Reine VM / LXC-Datenplatte mit Snapshot + Integritätsanforderungen"
+      }
+    ]
+  },
+  "opening": {
+    "heading": "Öffnen des Tools",
+    "body": "Öffnen Sie im ProxMenux-Hauptmenü <strong>Storage &amp; Share Manager → Add Local Disk as Proxmox Storage</strong>. Das Untermenü enthält vier Optionen:",
+    "imageAlt": "Lokales Disk Manager-Menü – Hinzufügen / Anzeigen / Entfernen / Auflisten verfügbarer Festplatten"
+  },
+  "howRuns": {
+    "heading": "Wie das Skript läuft (Flow hinzufügen)",
+    "body": "Der Ablauf hat zwei Phasen mit einem Sicherheitsfilter mit drei Prüfungen. Phase 1 entdeckt sichere Festplatten, entscheidet, was mit der gewählten zu tun ist und sammelt Speicherparameter; Phase 2 erledigt die destruktive Arbeit. Bis zur endgültigen Bestätigung ist die Festplatte unberührt."
+  },
+  "format": {
+    "heading": "Leeren Datenträger formatieren",
+    "intro": "Der Pfad für eine neue Festplatte oder eine, deren Inhalt Ihnen egal ist.",
+    "items": [
+      "Wählen Sie die Festplatte (System / In-Use-Disks sind versteckt).",
+      "Wählen Sie \"Formatdiskette (ERASE alle Daten)\".",
+      "Wählen Sie das Dateisystem aus - siehe Tabelle oben für Kompromisse.",
+      "Storage ID (default <code>disk-&lt;device&gt;</code>), Mount-Pfad, Voreinstellung des Inhaltstyps.",
+      "Bestätigen Sie im <strong>FINAL CONFIRMATION — DATA WILL BE ERASED</strong> Dialog.",
+      "ProxMenux löscht die Partitionstabelle und erstellt eine Partition über den Datenträger. Es führt <code>mkfs.&lt;fs&gt;</code> oder <code>zpool create</code> aus und hängt das Ergebnis ein. Normale Dateisysteme erhalten einen UUID-Eintrag in <code>/etc/fstab</code> mit <code>defaults,nofail</code>; ZFS verwendet die Mount-Konfiguration des Pools. Ist <em>Als Proxmox-Speicher</em> markiert (bei ZFS immer), wird er anschließend mit <code>pvesm add dir</code> oder <code>pvesm add zfspool</code> registriert; andernfalls bleibt er nur ein Host-Mount."
+    ],
+    "tipTitle": "Warum UUID + nofail in /etc/fstab",
+    "tipBody": "Das Skript schreibt <code>UUID=… /mnt/&lt;id&gt; &lt;fs&gt; defaults,nofail 0 2</code>. UUID überlebt die Geräteumordnung über Neustarts hinweg (so dass <code>/dev/sdc</code>, das <code>/dev/sdd</code> wird, den Boot nicht unterbricht). <code>nofail</code> bedeutet, dass, wenn die Festplatte jemals verschwindet (Hardwarefehler, Unplugged), Proxmox immer noch bootet - der Speicher wird nur als inaktiv angezeigt, bis die Festplatte zurückkommt."
+  },
+  "reuse": {
+    "heading": "Wiederverwendung eines vorhandenen Dateisystems",
+    "intro": "Der Pfad für eine Festplatte, auf der Sie die Daten behalten möchten - vielleicht haben Sie sie von einem anderen Proxmox-Host verschoben, oder die Festplatte verfügt bereits über Backups / ISOs, die Sie zugänglich halten möchten.",
+    "items": [
+      "Wählen Sie den Datenträger.",
+      "Wählen Sie \"Vorhandenes Dateisystem verwenden\".",
+      "Speicher-ID, Mount-Pfad und Inhaltstyp-Voreinstellung.",
+      "ProxMenux berührt die Daten <strong>nicht</strong>: Es erstellt den Mount-Punkt, mountet die Festplatte, fügt einen UUID-Eintrag zu <code>/etc/fstab</code> hinzu und registriert ihn als Proxmox-<code>dir</code>-Speicher."
+    ],
+    "warnTitle": "Wiederverwendungspfad behandelt keine ZFS-Pools",
+    "warnBody": "Wenn die Festplatte bereits einen ZFS-Pool enthält, versucht der <em>reuse</em>-Pfad hier nur, ihn als reguläres Dateisystem zu montieren - was fehlschlägt. Um einen vorhandenen ZFS-Pool zu importieren, verwenden Sie <code>zpool import &lt;name&gt;</code> auf der Kommandozeile und registrieren Sie ihn dann manuell bei <code>pvesm add zfspool</code>."
+  },
+  "presets": {
+    "heading": "Inhaltstyp-Presets",
+    "intro": "ProxMenux bietet drei Voreinstellungen und eine eigene Eingabe. Die gewählte Inhaltsliste wird an <code>pvesm add … --content &lt;csv&gt;</code> übergeben:",
+    "headerPreset": "Voreinstellung",
+    "headerContent": "Inhaltsliste",
+    "headerUse": "Anwendungsfall",
+    "rows": [
+      {
+        "preset": "VM Speicherplatz",
+        "content": "images,backup",
+        "use": "Ein dedizierter VM-Festplattenspeicher, der auch Backups dieser VMs in der Nähe hält."
+      },
+      {
+        "preset": "Standard-NAS",
+        "content": "backup,iso,vztmpl",
+        "use": "Ein Archiv / Media Disk - Backups, ISOs und LXC Vorlagen. Keine live VM Festplatten hier."
+      },
+      {
+        "preset": "Alle Typen",
+        "content": "images,backup,iso,vztmpl,snippets",
+        "use": "Diese breite Voreinstellung aktiviert Images, Sicherungen, ISOs, LXC-Vorlagen und Snippets. Fügen Sie weitere unterstützte Typen wie rootdir bei Bedarf über Benutzerdefiniert hinzu."
+      },
+      {
+        "preset": "Benutzerdefiniert",
+        "content": "(freier Input)",
+        "useRich": "Geben Sie den genauen CSV selbst ein, z.B. <code>images</code> allein oder <code>rootdir,images</code>."
+      }
+    ],
+    "zfsTitle": "ZFS Pool-Inhalte sind schmaler",
+    "zfsBody": "Bei <strong>zfs</strong> unterstützt ein <code>zfspool</code> nur <code>images</code> und <code>rootdir</code>, keine ISO- oder Sicherungsdateien. Geben Sie unter Benutzerdefiniert eine unterstützte Liste ein. Das Skript reicht sie unverändert weiter; unzulässige Typen können die Registrierung scheitern lassen. Prüfen Sie danach <code>pvesm status</code>."
+  },
+  "manual": {
+    "heading": "Manuelles Äquivalent",
+    "extIntro": "Format + Registrierung einer Festplatte als ext4-Verzeichnisspeicher:",
+    "zfsIntro": "Oder als ZFS Pool:"
+  },
+  "view": {
+    "heading": "Datenträgerspeicher anzeigen",
+    "body": "Listet alle plattengestützten Proxmox-Speicher auf (sowohl <code>dir</code> als auch <code>zfspool</code>, die vom Benutzer erstellt wurden – Systempools wie <code>rpool</code> sind ausgeblendet). Zeigt den Mount-Pfad / Pool-Namen, Inhaltstypen und Live-Status an."
+  },
+  "remove": {
+    "heading": "Disk Storage entfernen",
+    "body": "Hebt die Registrierung des Speichers bei Proxmox auf (<code>pvesm remove</code>) und bietet an, den passenden Eintrag in <code>/etc/fstab</code> zu bereinigen. Für ZFS pools zerstört das Skript <strong>nicht</strong> automatisch das pool – das ist ein separater <code>zpool destroy &lt;name&gt;</code>-Schritt, den Sie manuell ausführen, wenn Sie sicher sind.",
+    "warnTitle": "Daten und bestehende VM Abhängigkeiten",
+    "warnBody": "Das Entfernen des Speichers berührt nicht das Dateisystem oder den Pool - die Daten bleiben auf der Festplatte. Aber VMs / CTs, die diesen Speicher nach ID referenzieren, können nach dem Entfernen nicht starten. Verschieben Sie diese VM-Festplatten in einen anderen Speicher (oder nehmen Sie ein Backup), bevor Sie sie entfernen."
+  },
+  "list": {
+    "heading": "Liste der verfügbaren Datenträger",
+    "body": "Eine schreibgeschützte Diagnoseansicht: Druckt die Ausgabe von <code>lsblk -o NAME,SIZE,TYPE,FSTYPE,MOUNTPOINT,MODEL</code>, gefolgt von den <code>dir</code>/<code>zfspool</code>-Speichern, die Proxmox bereits kennt. Guter erster Stopp, wenn Sie das Tool öffnen und sehen möchten \"Was ist auf diesem Host?\", Bevor Sie etwas hinzufügen."
+  },
+  "troubleshoot": {
+    "heading": "Fehlerbehebung",
+    "noDisksTitle": "\"Keine verfügbaren Festplatten gefunden\"",
+    "noDisksIntro": "Der Sicherheitsfilter hat alle Datenträger ausgeblendet. Häufige Gründe:",
+    "noDisksItems": [
+      "Nur die Root Disc ist vorhanden.",
+      "Jede andere Festplatte ist Teil eines aktiven ZFS / LVM / RAID-Arrays.",
+      "Jede andere Festplatte wird durch eine VM- oder LXC-Konfiguration (Durchgang) referenziert.",
+      "Die Festplatte befindet sich im schreibgeschützten Modus (ausfallende Hardware oder Schreibblocker)."
+    ],
+    "noDisksOutro": "Verwenden Sie <em>List Available Disks</em> aus dem Menü, um die <code>lsblk</code>-Rohausgabe zu sehen und zu verstehen, was passiert.",
+    "mountedTitle": "Format fehlschlägt mit \"Device is mount\"",
+    "mountedBody": "Etwas hat die Festplatte automatisch gemountet (udisksd, ein Desktop-Manager, eine anhaltende systemd-Einheit). Unmount: <code>umount /dev/sdX?*</code> oder <code>systemctl stop &lt;whatever-mounts-it&gt;</code>, dann wiederholen. Der Sicherheitsfilter des Skripts sollte versteckte montierte Festplatten haben, so dass, wenn Sie diesen Fehler erreicht haben, die Mount zwischen dem angezeigten Menü und der Bestätigung stattgefunden hat.",
+    "zpoolTitle": "zpool create schlägt mit „invalid vdev specification“ fehl",
+    "zpoolBody": "Normalerweise bedeutet dies, dass die Festplatte immer noch veraltete GPT / LVM / ZFS-Signaturen aufweist, die <code>zpool</code> nicht ohne Erzwingen überschreiben möchte. Das Skript führt <code>wipefs</code> und <code>sgdisk --zap-all</code> vor dem Formatieren aus, aber eine sehr hartnäckige Festplatte kann immer noch ein veraltetes Label haben. Erzwingen Sie manuell eine Bereinigung: <code>zpool labelclear -f /dev/sdX</code> oder <code>dd if=/dev/zero of=/dev/sdX bs=1M count=10</code> und wiederholen Sie es.",
+    "inactiveTitle": "Storage wird nach dem Neustart als inaktiv angezeigt",
+    "inactiveBody": "Überprüfen Sie <code>findmnt &lt;mount-path&gt;</code> - wenn die Mount fehlt, ist etwas in <code>/etc/fstab</code> fehlgeschlagen. <code>dmesg | tail</code> zeigt normalerweise auf den Grund (UUID-Mismatch, Dateisystemkorruption, <code>nofail</code> ließ die Wiederholung fallen). Ein <code>mount -a</code> reaktiviert normalerweise den Speicher, sobald die Ursache behoben ist."
+  },
+  "related": {
+    "heading": "Verwandte Themen",
+    "items": [
+      {
+        "href": "/docs/disk-manager/format-disk",
+        "label": "Datenträgerverwaltung: Physischen Datenträger formatieren / löschen",
+        "tail": "Low-Level-Alternative, wenn Sie nur eine Festplatte vorbereiten möchten, ohne sie als Proxmox-Speicher zu registrieren."
+      },
+      {
+        "href": "/docs/storage-share/host-iscsi",
+        "label": "Hinzufügen von iSCSI-Ziel als Proxmox-Speicher",
+        "tail": " — Entsprechende Netzwerklösung, wenn sich das Blockgerät auf einem anderen Rechner befindet."
+      },
+      {
+        "href": "/docs/storage-share/host-local-shared",
+        "label": "Shared Directory auf Host hinzufügen",
+        "tail": "Bereiten Sie ein Verzeichnis für LXC-Bind-Mounts auf dem Host vor (registriert keinen Proxmox-Speicher)."
+      }
+    ]
+  }
+}
diff --git a/web/messages/de/docs/storage-share/host-local-shared.json b/web/messages/de/docs/storage-share/host-local-shared.json
new file mode 100644
index 00000000..155805e2
--- /dev/null
+++ b/web/messages/de/docs/storage-share/host-local-shared.json
@@ -0,0 +1,103 @@
+{
+  "meta": {
+    "title": "Host: Freigegebenes Verzeichnis auf dem Host hinzufügen | ProxMenux-Dokumentation",
+    "description": "Erstellen Sie ein Hostverzeichnis, das für LXC-Bind-Mounts bereit ist, mit Berechtigungen, die für privilegierte und unprivilegierte Container gleichzeitig funktionieren. Sticky Bit + World-Rwx + ACLs für die Standardvererbung.",
+    "ogTitle": "Host: Freigegebenes Verzeichnis auf dem Host hinzufügen | ProxMenux-Dokumentation",
+    "ogDescription": "Bereiten Sie ein Hostverzeichnis für LXC-Bind-Mounts vor, dessen Berechtigungen mit privilegierten und unprivilegierten CTs kompatibel sind."
+  },
+  "header": {
+    "title": "Host: Freigegebenes Verzeichnis hinzufügen",
+    "description": "Erstellen Sie ein Host-Verzeichnis, das so konzipiert ist, dass es in einen oder mehrere LXC-Container eingebunden wird. ProxMenux wendet eine Reihe von Berechtigungen an, die sowohl für privilegierte als auch für unprivilegierte CTs gleichzeitig funktionieren - keine verschobenen UID-Kopfschmerzen, keine pro-Container-Chowns - und registriert das Verzeichnis, damit der LXC Mount Manager es später abholen kann.",
+    "section": "Speicher und Freigaben · Host"
+  },
+  "intro": {
+    "title": "Was das ist (und nicht ist)",
+    "body": "Dieses Tool registriert <strong>nicht</strong> irgendetwas in Proxmox (kein <code>pvesm add</code> hier). Es bereitet lediglich ein Verzeichnis auf dem Host vor – standardmäßig <code>/mnt/shared</code> – mit Berechtigungen, die jeder LXC-Container lesen und schreiben kann, unabhängig davon, ob der CT privilegiert oder nicht privilegiert ist. Der übliche nächste Schritt besteht darin, es mit dem <mountLink>LXC-Mount-Manager</mountLink> in jedes CT einzubinden."
+  },
+  "why": {
+    "heading": "Warum ein dediziertes Tool dafür",
+    "intro": "Wenn Sie ein Hostverzeichnis in einen LXC-Container binden, hängen die Berechtigungen ab von:",
+    "items": [
+      "Ob der CT <strong>privilegiert</strong> ist (UID 0 im CT = UID 0 auf dem Host) oder <strong>unprivilegiert</strong> (UID 0 im CT = UID 100000 auf dem Host — alle UIDs sind um +100000 verschoben).",
+      "Der Besitz des Hostverzeichnisses (eine Datei im Besitz von UID 1000 auf dem Host erscheint als \"andere\" aus der Perspektive eines unprivilegierten CT, da kein CT-Benutzer UID 1000 zuordnet).",
+      "Ob mehrere CTs das gleiche Verzeichnis teilen (unterschiedliche CTs können unterschiedliche UID-Bereiche haben)."
+    ],
+    "outro": "ProxMenux verwendet hier einen pragmatischen Ansatz: <strong>allen Zugriff gewähren</strong>, und zwar auf Dateisystemebene. Dazu kommen rwx-Rechte für alle, das Sticky-Bit und ACLs zur Vererbung der Rechte an neue Dateien. Jede zugeordnete UID kann lesen und schreiben; ein Abgleich von UIDs/GIDs ist nicht nötig."
+  },
+  "howRuns": {
+    "heading": "Wie das Skript läuft",
+    "body": "Das Skript hat kein Hauptmenü – es führt eine einzelne Aktion aus, <strong>Freigegebenes Verzeichnis erstellen</strong>. Phase 1 sammelt den Zielpfad; Phase 2 erstellt das Verzeichnis und wendet Berechtigungen an."
+  },
+  "bits": {
+    "heading": "Was jedes Berechtigungsbit tut",
+    "intro": "Die Nummer <strong>1777</strong> ist nicht willkürlich - es ist der gleiche Modus, den Linux für <code>/tmp</code> verwendet. Drei Eigenschaften kombiniert:",
+    "headerBit": "Bit",
+    "headerEffect": "Wirkung",
+    "headerWhy": "Warum es hier wichtig ist",
+    "rows": [
+      {
+        "bit": "1 (sticky bit)",
+        "effect": "Löschen und Umbenennen sind auf den Datei- oder Verzeichniseigentümer und ausreichend privilegierte Prozesse beschränkt.",
+        "why": "Hilft Benutzern mit unterschiedlichen zugeordneten UIDs, fremde Dateien vor Löschung zu schützen. CTs mit derselben zugeordneten UID oder privilegiertem Root-Zugriff sind dadurch nicht voneinander isoliert."
+      },
+      {
+        "bit": "777 (rwx-rwx-rwx)",
+        "effect": "Jeder kann lesen, schreiben und das Verzeichnis betreten.",
+        "why": "Unprivilegierte CT UIDs (100000+) erscheinen als \"andere\" vom Host, so dass world-rwx ihnen Zugriff gibt."
+      },
+      {
+        "bit": "ACLs (Standard)",
+        "effect": "Vererbt auf jeder neu erstellten Datei / Subdir.",
+        "why": "Neue Inhalte erben die Standard-ACLs, ohne das Skript erneut auszuführen. Anwendungen können weiterhin restriktive Modi anfordern oder Rechte später ändern."
+      }
+    ],
+    "privTitle": "Privilegierte CTs sehen dasselbe, nur ohne die Verschiebung",
+    "privBody": "Für einen privilegierten CT ist UID 0 im CT UID 0 auf dem Host, so dass <code>root</code> im CT das Hostverzeichnis direkt lesen / schreiben kann. <code>1777</code> ist immer noch in Ordnung - es bedeutet nur, dass Nicht-Root-Benutzer im CT auch das Verzeichnis verwenden können. Die gleichen Berechtigungen decken beide Fälle ab."
+  },
+  "where": {
+    "heading": "Wo das freigegebene Verzeichnis liegen soll",
+    "intro": "Der Location Picker bietet vier Optionen:",
+    "opt1Title": "1. Erstellen Sie einen neuen Ordner in /mnt",
+    "opt1Body": "Die übliche Wahl. ProxMenux schlägt automatisch den ersten freien Namen vor (<code>shared</code>, <code>shared2</code>, <code>shared3</code>, ...). Sie bestätigen oder geben nur einen anderen Namen ein.",
+    "opt2Title": "2. Benutzerdefinierter Pfad",
+    "opt2Body": "Für Verzeichnisse außerhalb von <code>/mnt</code>. Jeder absolute Pfad funktioniert (z.B. <code>/srv/media</code>, <code>/data/family</code>). Das Skript verwendet die gleichen Berechtigungen.",
+    "opt3Title": "3. Bestehende Ordner in /mnt anzeigen",
+    "opt3Body": "Read-only Diagnose: listet jedes Verzeichnis unter <code>/mnt</code> mit seinen Berechtigungen, Eigentümer und verfügbaren Speicherplatz auf. Nützlich, bevor Sie eine neue erstellen, um Namenskollisionen zu vermeiden.",
+    "opt4Title": "4. Abbrechen",
+    "opt4Body": "Beendet den Vorgang, ohne etwas zu erstellen. Entspricht <kbd>Esc</kbd>.",
+    "tipTitle": "Wo lebt /mnt?",
+    "tipBody": "Standardmäßig befindet sich <code>/mnt</code> auf dem Proxmox-Root-Dateisystem. Wenn Sie das freigegebene Verzeichnis auf einer anderen Festplatte (einer Datenplatte, einem ZFS-Pool) haben möchten, mounten Sie diese Festplatte zuerst unter <code>/mnt/&lt;name&gt;</code> (Disk Manager oder <diskLink>Lokale Festplatte als Proxmox-Speicher hinzufügen</diskLink>) und erstellen Sie dann das freigegebene Verzeichnis als Unterordner darin - oder wählen Sie \"Benutzerdefinierten Pfad eingeben\" hier und zeigen Sie auf die eingehängte Festplatte."
+  },
+  "manual": {
+    "heading": "Manuelles Äquivalent",
+    "body": "Der gesamte Flow kann von Hand wiedergegeben werden:"
+  },
+  "next": {
+    "heading": "Nächster Schritt: Bind-Mount in Container",
+    "body": "Durch das Erstellen des Verzeichnisses wird es nur vorbereitet – noch wird es von keinem Container gesehen. Um es in einem oder mehreren LXCs sichtbar zu machen, verwenden Sie den Mount-Manager <mountLink>LXC</mountLink>, um <code>/mnt/&lt;name&gt;</code> in die CTs einzubinden. Da die Berechtigungen bereits geöffnet sind, bietet der Mount-Manager <strong>nicht</strong> an, sie zu ändern – das Verzeichnis kann unverändert verwendet werden."
+  },
+  "troubleshoot": {
+    "heading": "Fehlerbehebung",
+    "mkdirTitle": "\"Failed to create directory\"",
+    "mkdirBody": "Normalerweise ein Dateisystemproblem: <code>/mnt</code> befindet sich in einem schreibgeschützten Dateisystem, der Pfad enthält eine Komponente, die kein Verzeichnis ist (z. B. Sie haben <code>/etc/passwd/sub</code> eingegeben), oder die Festplatte ist voll. Überprüfen Sie mit <code>df -h /mnt</code> und <code>mount | grep /mnt</code>.",
+    "writeTitle": "Container kann trotz offener Berechtigungen nicht schreiben",
+    "writeBody": "Überprüfen Sie, ob der CT tatsächlich den Bind-Mount (<code>pct config &lt;ctid&gt; | grep ^mp</code>) verwendet. Führen Sie im CT <code>touch /mnt/data/test-$(date +%s)</code> aus – wenn dies mit verweigerter Berechtigung fehlschlägt, befindet sich das Mount möglicherweise auf einem Host-Dateisystem, das ACLs nicht berücksichtigt (einige ältere <code>ext3</code>- oder <code>vfat</code>-Mounts). Verschieben Sie das freigegebene Verzeichnis in ein ext4 / xfs / btrfs / zfs Backing.",
+    "aclTitle": "ACL Befehle leise nicht verfügbar",
+    "aclBody": "Bei einer minimalen Proxmox-Installation sind <code>setfacl</code> / <code>getfacl</code> möglicherweise nicht installiert. Das Skript fällt anmutig zurück (<code>command -v setfacl</code>-Check) und wendet nur POSIX-Berechtigungen an - was oft genug ist, aber neue Dateien werden das permissive Profil nicht automatisch erben. Installieren Sie <code>acl</code> mit <code>apt-get install -y acl</code> und führen Sie das Skript im Verzeichnis erneut aus."
+  },
+  "related": {
+    "heading": "Verwandte Themen",
+    "items": [
+      {
+        "href": "/docs/storage-share/lxc-mount-points",
+        "label": "LXC-Mount-Verwaltung",
+        "tail": "— der natürliche nächste Schritt: bind-mount dieses Verzeichnis in einen oder mehrere Container."
+      },
+      {
+        "href": "/docs/storage-share/host-local-disk",
+        "label": "Lokale Festplatte als Proxmox-Speicher hinzufügen",
+        "tailRich": "Wenn Sie das freigegebene Verzeichnis auf einer dedizierten Festplatte haben möchten, bereiten Sie die Festplatte zuerst vor, mounten Sie sie unter <code>/mnt</code> und erstellen Sie dann den freigegebenen Unterordner hier."
+      }
+    ]
+  }
+}
diff --git a/web/messages/de/docs/storage-share/host-nfs.json b/web/messages/de/docs/storage-share/host-nfs.json
new file mode 100644
index 00000000..bb131054
--- /dev/null
+++ b/web/messages/de/docs/storage-share/host-nfs.json
@@ -0,0 +1,174 @@
+{
+  "meta": {
+    "title": "Host: NFS-Freigabe einhängen | ProxMenux-Dokumentation",
+    "description": "Montieren Sie einen externen NFS-Export auf dem Proxmox-Host - entweder als Proxmox-Speicher (pvesm add nfs), als einfacher fstab-Mount auf dem Host (NICHT sichtbar in Datacenter > Storage) oder beides. Die fstab-Methode ist ideal, um die Freigabe in LXC-Container zu binden, ohne sie als Proxmox-Speicher freizulegen.",
+    "ogTitle": "Host: NFS-Freigabe einhängen | ProxMenux-Dokumentation",
+    "ogDescription": "Montieren Sie einen externen NFS-Export auf dem Proxmox-Host über pvesm, fstab oder beides. fstab-Pfad ist ideal für LXC-Bind-Mounts."
+  },
+  "header": {
+    "title": "Host: NFS-Freigabe auf dem Host einhängen",
+    "description": "Montieren Sie einen externen NFS-Export (von einem NAS, einem anderen Server, einer Homelab-Freigabe ...) auf dem Proxmox-Host. Wählen Sie eine oder beide Methoden aus: Registrieren Sie sie als Proxmox-Speicher (sichtbar in Datacenter > Storage) und/oder fügen Sie einen einfachen Mount über /etc/fstab an einem von Ihnen gewählten Pfad hinzu (nützlich für das Binden der Freigabe in LXC-Container, ohne sie als Proxmox-Speicher freizulegen).",
+    "section": "Speicher und Freigaben · Host"
+  },
+  "intro": {
+    "title": "Was das macht",
+    "body": "ProxMenux bietet zwei Mount-Methoden für jeden NFS-Export an: <strong>(1) Proxmox-Speicher</strong> über <code>pvesm add nfs</code> - die Freigabe wird in Datacenter > Storage angezeigt und Proxmox verwaltet das Mount bei <code>/mnt/pve/&lt;id&gt;</code>; <strong>(2) Host-Fstab-Mount</strong> auf einem Weg, den Sie auswählen - persistent über <code>/etc/fstab</code>, NICHT sichtbar als Proxmox-Speicher, ideal für Bindemontage an LXC-Container (Proxmox UI bleibt sauber). Sie können eine Methode, die andere oder beides ausführen."
+  },
+  "opening": {
+    "heading": "Öffnen des Tools",
+    "body": "Öffnen Sie im Hauptmenü von ProxMenux <strong>Speicher &amp; Freigabe-Manager → NFS Freigabe auf Host bereitstellen</strong>. Sie sehen dieses sub-Menü mit vier Optionen:",
+    "imageAlt": "NFS-Host-Menü — Einhängen / Anzeigen / Entfernen / Verbindung testen"
+  },
+  "howRuns": {
+    "heading": "Wie das Skript läuft",
+    "body": "Der Ablauf hat zwei Phasen mit klarer Trennung zwischen \"Entdecken, Validieren und Auswählen\" und \"tatsächlich einhängen und Konfiguration schreiben\". Nachdem Sie einen Export ausgewählt haben, wählen Sie die Mount-Methode(n) über eine Checkliste aus; der Rest der Dialoge fragt nur nach Parametern für die von Ihnen ausgewählten Methoden. Bis zur endgültigen Bestätigung werden weder <code>/etc/pve/storage.cfg</code> noch <code>/etc/fstab</code> berührt."
+  },
+  "modes": {
+    "heading": "Mount-Methode wählen (eine oder beide Optionen)",
+    "intro": "Nach Auswahl und Validierung des Exports zeigt ProxMenux eine Checkliste mit den beiden Mount-Methoden an. Sie können entweder oder beide markieren. Wenn Sie auf OK drücken, ohne etwas zu markieren, erscheint der Dialog erneut, bis Sie mindestens eine Option auswählen oder auf Abbrechen drücken, um den Fluss zu verlassen.",
+    "imageAlt": "Mount Method Checkliste mit pvesm und fstab Optionen",
+    "headerMethod": "Methode",
+    "headerMount": "Mount-Pfad",
+    "headerUi": "Sichtbar in Datacenter > Storage",
+    "headerUseCase": "Typischer Anwendungsfall",
+    "rows": [
+      {
+        "method": "<strong>Als Proxmox-Speicher (pvesm)</strong>",
+        "mountRich": "<code>/mnt/pve/&lt;storage-id&gt;</code> (verwaltet von Proxmox)",
+        "ui": "Ja",
+        "useCase": "VM Disk-Images, Backups, ISOs, LXC-Vorlagen - alles, was in der Proxmox-Benutzeroberfläche angezeigt werden muss."
+      },
+      {
+        "method": "<strong>Nur Host-fstab</strong>",
+        "mountRich": "<code>/mnt/&lt;path&gt;</code> (Sie wählen den Weg)",
+        "ui": "Nein",
+        "useCaseRich": "Die Freigabe per Bind-Mount in einen oder mehrere LXCs einbinden, <em>ohne</em> sie als Proxmox-Speicher anzuzeigen. Hält die Datacenter-Oberfläche übersichtlich."
+      },
+      {
+        "method": "<strong>Beide</strong>",
+        "mount": "Beide Pfade oben (zwei Mount-Punkte desselben NFS-Exports)",
+        "ui": "Ja",
+        "useCase": "Oberflächenintegration und ein separater stabiler Host-Pfad mit offenen Berechtigungen für LXC-Bind-Mounts."
+      }
+    ],
+    "bothTitle": "„Beide“ erstellt zwei unabhängige NFS-Mounts",
+    "bothBody": "Beide Methoden laufen getrennt: pvesm hängt unter <code>/mnt/pve/&lt;id&gt;</code> ein, fstab unter <code>/mnt/&lt;path&gt;</code>. So erhalten Sie einen Proxmox-Mount mit Standardoptionen und einen separaten Host-Mount für LXC-Bind-Mounts. Zwei Mount-Punkte garantieren keine zwei TCP-Verbindungen; der NFS-Client kann Transporte wiederverwenden."
+  },
+  "pvesmBranch": {
+    "heading": "Methode A — als Proxmox-Speicherung (pvesm)",
+    "intro": "Wenn <em>Als Proxmox-Speicher</em> markiert ist, führt ProxMenux den ursprünglichen pvesm-Flow aus:",
+    "items": [
+      "<strong>Storage ID</strong> – was Proxmox diesen Speicher nennen wird. Standardmäßig ist <code>nfs-&lt;server-ip-with-dashes&gt;</code>. Es werden nur Buchstaben, Ziffern, <code>-</code> und <code>_</code> akzeptiert.",
+      "<strong>Inhaltstypen</strong> — Proxmox verknüpft Inhaltskategorien mit Speichervolumen; wählen Sie aus, was dieser NFS enthalten darf:"
+    ],
+    "headerType": "Inhaltsart",
+    "headerAllows": "Was es erlaubt",
+    "rows": [
+      {
+        "type": "import",
+        "allowsRich": "Datenträgerbildimporte (standardmäßig ausgewählt). Benötigt für <em>Import Disk Image zu VM</em>."
+      },
+      {
+        "type": "backup",
+        "allowsRich": "VM und CT Backup-Dateien (<code>vzdump</code>)."
+      },
+      {
+        "type": "iso",
+        "allows": "ISO-Abbildungen für die Installation."
+      },
+      {
+        "type": "vztmpl",
+        "allows": "LXC-Vorlagen."
+      },
+      {
+        "type": "images",
+        "allows": "VM-Disk-Images (dadurch wird der NFS in einen VM-Disk-Store verwandelt)."
+      },
+      {
+        "type": "rootdir",
+        "allows": "LXC Root-Dateisysteme (selten für NFS – lesen Sie den unten stehenden Hinweis)."
+      },
+      {
+        "type": "snippets",
+        "allows": "Hook-Scripts und Cloud-Init-Snippets."
+      }
+    ],
+    "warnTitle": "images und rootdir auf NFS",
+    "warnBody": "Mit <code>images</code> kann Proxmox VM-Festplatten auf NFS speichern. Die Leistung hängt von Netzwerk, Server und Last ab; ein Ausfall kann davon abhängige E/A blockieren. Mit <code>rootdir</code> liegen LXC-Root-Dateisysteme auf NFS. Unprivilegierte Container können dort Einschränkungen bei UID-Zuordnung, Overlay und Eigentümern haben. Prüfen Sie dies vor der Ablage von <code>images</code> / <code>rootdir</code>; NFS eignet sich auch für <code>backup</code> / <code>iso</code> / <code>vztmpl</code>.",
+    "result": "Das Ergebnis ist <code>pvesm add nfs &lt;id&gt; --server &lt;srv&gt; --export &lt;path&gt; --content &lt;csv&gt;</code> und Proxmox Auto-Mounts bei <code>/mnt/pve/&lt;id&gt;</code>."
+  },
+  "fstabBranch": {
+    "heading": "Methode B — nur ein fstab-Mount auf dem Host",
+    "intro": "Wenn <em>Nur fstab-Mount auf dem Host</em> markiert ist, fragt ProxMenux nach einem host mount path und persistenten Optionen, dann mountet und schreibt den Eintrag in <code>/etc/fstab</code>:",
+    "items": [
+      "<strong>Mount-Pfad auf dem Host</strong> — standardmäßig <code>/mnt/&lt;export-basename&gt;</code>. Es muss ein absoluter Weg sein. Wenn dort bereits etwas montiert ist oder ein Fstab-Eintrag für den gleichen Pfad existiert, warnt Sie ProxMenux und bietet an, ihn zu ersetzen.",
+      "<strong>Mount-Optionen</strong> — <em>Lesen/Schreiben</em> (Standard: <code>rw,hard,nofail,_netdev,rsize=131072,wsize=131072,timeo=600,retrans=2</code>), <em>Nur Lesen</em>, <em>Benutzerdefiniert</em> (eigene Optionen eingeben)."
+    ],
+    "appliesIntro": "Sobald Sie bestätigen, das Skript:",
+    "applies": [
+      "<code>mkdir -p</code> der Mount Path.",
+      "<code>mount -t nfs -o &lt;opts&gt; &lt;srv&gt;:&lt;export&gt; &lt;path&gt;</code>.",
+      "Schreibt einen einzeiligen Eintrag in <code>/etc/fstab</code>: <code>&lt;srv&gt;:&lt;export&gt; &lt;path&gt; nfs &lt;opts&gt; 0 0</code>.",
+      "Führt <code>systemctl daemon-reload</code> aus, so dass systemd den neuen Fstab-Eintrag abholt.",
+      "Versucht <code>chmod 1777</code> und <code>setfacl o::rwx</code> auf dem Mount-Punkt. Fehler werden still ignoriert; es gelingt nur, wenn der NFS-Server es erlaubt. Viele NAS-Exporte sind bereits für alle Benutzer beschreibbar."
+    ],
+    "lxcTitle": "Den fstab-Mount aus einem LXC verwenden",
+    "lxcBody": "Das Skript zeigt einen <code>pct set</code>-Befehl für einen Bind-Mount, etwa <code>pct set &lt;ctid&gt; -mp0 /mnt/&lt;path&gt;,mp=/mnt/&lt;ct-path&gt;,shared=1,backup=0</code>. Alternativ erkennt der <mountLink>LXC Mount Manager</mountLink> fstab-Mounts. <strong>Im Container wird nichts geändert</strong>. Der Zugriff unprivilegierter CTs hängt von Serverrechten für ihre zugeordneten UIDs/GIDs ab. Das Skript versucht nur Berechtigungsänderungen vom Host aus; beschreibbare Exporte oder Herstellerstandards sind nicht garantiert. Bei Fehlern siehe Fehlerbehebung.",
+    "noUiTitle": "Der fstab-Mount ist KEIN Proxmox-Speicher",
+    "noUiBody": "Der fstab-Mount auf dem Host erscheint bewusst nicht in der Proxmox-Weboberfläche. Er fehlt unter <em>Datacenter > Storage</em>, lässt sich beim Erstellen einer VM oder eines CT nicht auswählen und kann nicht als Ziel eines Proxmox-Sicherungsauftrags dienen. Er ist lediglich ein Pfad im Dateisystem des Hosts. Wünschen Sie zusätzlich die Integration in die Oberfläche, wählen Sie <em>beide</em> Methoden aus."
+  },
+  "manual": {
+    "heading": "Manuelles Äquivalent",
+    "pvesmIntro": "Methode A (pvesm) bildet ab:",
+    "fstabIntro": "Methode B (Fstab) bildet ab:"
+  },
+  "view": {
+    "heading": "Ansicht konfigurierter NFS-Speicher",
+    "body": "Zeigt alle NFS-Einträge in Proxmox (<code>pvesm status | awk ''$2 == \"nfs\"''</code>) mit Server, Export, Inhaltstypen, Mount-Pfad und aktuellem Status. <strong>Hinweis:</strong> Diese Ansicht enthält nur über pvesm registrierte Storages. Reine fstab-Mounts werden nicht aufgeführt; prüfen Sie diese mit <code>findmnt -t nfs</code> oder <code>grep nfs /etc/fstab</code>."
+  },
+  "remove": {
+    "heading": "NFS-Speicher entfernen",
+    "body": "Führt <code>pvesm remove &lt;storage-id&gt;</code> nach einer Bestätigung aus, die den Server / Export / Inhalt anzeigt. Nur die Registrierung auf Proxmox-Seite wird entfernt — <strong>der entfernte NFS-Server selbst wird nie berührt</strong>, es werden keine Dateien gelöscht. Um ein fstab-only-Halter zu entfernen, bearbeiten Sie <code>/etc/fstab</code> von Hand und führen Sie <code>umount &lt;path&gt;</code> aus.",
+    "warnTitle": "Abhängigkeiten zuerst sichern",
+    "warnBody": "Wenn VMs, CTs oder Backup-Jobs immer noch auf diesen Speicher verweisen (nach ID), zeigt das Entfernen auf einen verschwundenen Speicher. Proxmox wird den Fehler markieren, aber nicht bereinigen. Verschieben oder löschen Sie diese Referenzen zuerst und entfernen Sie dann den Speicher."
+  },
+  "test": {
+    "heading": "NFS-Verbindung testen",
+    "body": "Führt einen Diagnosepass über jeden in Proxmox registrierten NFS-Speicher aus: Prüft, ob <code>showmount</code> verfügbar ist, ob <code>rpcbind</code> ausgeführt wird, pingt jeden Server, prüft den Port 2049, ruft <code>showmount -e</code> auf und meldet schließlich die eigene Ansicht von Proxmox (<code>pvesm status</code>). Gute erste Station, wenn ein Speicher als <em>inactive</em> in der Proxmox-Benutzeroberfläche angezeigt wird."
+  },
+  "troubleshoot": {
+    "heading": "Fehlerbehebung",
+    "noServersTitle": "\"Keine NFS-Server im Netzwerk gefunden\"",
+    "noServersBody": "Auto-discover verwendet <code>nmap -p 2049 --open &lt;subnet&gt;/24</code>. Der Server reagiert möglicherweise nicht, wenn: er befindet sich in einem anderen VLAN / Subnetz, seine Firewall blockiert nmap Sonden (viele tun dies) oder der Port 2049 wird absichtlich auf dieser Schnittstelle geschlossen. Verwenden Sie stattdessen die Option <em>Manual</em> mit der IP oder dem Hostnamen des Servers.",
+    "portTitle": "„NFS-Port (2049) ist nicht erreichbar“",
+    "portBody": "Ping war erfolgreich, aber <code>nc -z -w 3 &lt;server&gt; 2049</code> scheiterte. Überprüfen Sie, ob der NFS-Dienst auf dem Server ausgeführt wird (<code>systemctl status nfs-server</code> auf Linux, Systemsteuerung → Dateidienste auf Synology, NFS-Plugin auf OMV / TrueNAS) und ob die Firewall 2049 vom Proxmox-Host ermöglicht.",
+    "showmountTitle": "\"Failed to connect\" von showmount",
+    "showmountBody": "Der Server lehnte die Exportlistenabfrage ab. Häufige Ursachen: Der Server erzwingt strenge Client-ACLs (Ihre Proxmox-IP steht nicht auf der erlaubten Liste), <code>rpcbind</code> läuft nicht auf dem Server oder der Server stellt nur NFSv4 mit deaktiviertem <code>showmount</code> bereit. Der Exportpfad kann weiterhin manuell hinzugefügt werden, wenn Sie ihn kennen.",
+    "inactiveTitle": "Storage zeigt als inaktiv in der Proxmox UI",
+    "inactiveBody": "Starten Sie zuerst <em>NFS-Verbindung testen</em>: Es prüft, ob der Server auf Ping antwortet, Port 2049 offen ist und die Exportliste (<code>showmount -e</code>) verfügbar ist. Bleibt der Speicher bei funktionierender Verbindung inaktiv, prüfen Sie <code>journalctl -u pvestatd</code> und Server-/Exportkonfiguration. Beheben Sie zuerst Verbindungs- oder Berechtigungsprobleme. <code>pvesm set &lt;id&gt; --disable 0</code> aktiviert einen deaktivierten Speicher und ist keine allgemeine NFS-Reparatur.",
+    "lxcNoWriteTitle": "fstab mount funktioniert, aber unprivilegierte LXC kann nicht durch ein bind-mount schreiben",
+    "lxcNoWriteBody": "NFS-Zugriff hängt von Eigentümern, ACLs und Squash-Einstellungen auf dem Server ab. CIFS-Optionen wie <code>uid=</code> und <code>file_mode=</code> gelten <strong>nicht</strong> für NFS. Bei der Standard-LXC-Zuordnung wird CT-root zu Host-UID 100000, nicht zu Remote-UID 0. Gewähren Sie der tatsächlich zugeordneten UID/GID oder anonymen Serveridentität Zugriff. <code>no_root_squash</code> betrifft nur Remote-UID 0 und löst Probleme mit UID 100000 nicht allgemein. Das Skript versucht <code>chmod 1777</code>, kann Serverrechte aber nicht umgehen.",
+    "fstabBootTitle": "fstab Mount wird nach dem Neustart nicht angezeigt",
+    "fstabBootBody": "Das Skript fügt <code>nofail,_netdev</code> hinzu, so dass ein fehlender Anteil beim Booten den Start nicht blockiert. Wenn das mount nie auftaucht: bestätigen, dass das netzwerk erreichbar ist (<code>ping &lt;server&gt;</code>), überprüfen sie <code>journalctl -u remote-fs.target</code> und überprüfen sie, ob der eintrag mit <code>mount -fav | grep nfs</code> gültig ist. <code>mount -a</code> nach dem Booten montiert alles, was derzeit fehlt."
+  },
+  "related": {
+    "heading": "Verwandte Themen",
+    "items": [
+      {
+        "href": "/docs/storage-share/host-samba",
+        "label": "Samba / CIFS als Proxmox-Speicher",
+        "tail": "— gleiches Flussmuster (Methode A pvesm + Methode B fstab) für SMB/CIFS-Freigaben."
+      },
+      {
+        "href": "/docs/storage-share/lxc-mount-points",
+        "label": "LXC-Mount-Verwaltung",
+        "tailRich": "— bind-mount den fstab-only Pfad <code>/mnt/&lt;path&gt;</code> in einen oder mehrere Container."
+      },
+      {
+        "href": "/docs/storage-share/lxc-nfs-client",
+        "label": "NFS-Client in LXC",
+        "tail": "— Alternative: NFS direkt aus einem privilegierten Container montieren (überspringt den Host)."
+      }
+    ]
+  }
+}
diff --git a/web/messages/de/docs/storage-share/host-samba.json b/web/messages/de/docs/storage-share/host-samba.json
new file mode 100644
index 00000000..1a09af4d
--- /dev/null
+++ b/web/messages/de/docs/storage-share/host-samba.json
@@ -0,0 +1,172 @@
+{
+  "meta": {
+    "title": "Host: Samba-Freigabe einhängen | ProxMenux-Dokumentation",
+    "description": "Montieren Sie eine externe Samba / CIFS-Freigabe auf dem Proxmox-Host - entweder als Proxmox-Speicher (pvesm add cifs), als einfacher fstab-Mount auf dem Host mit offenem uid / gid / file_mode (NICHT sichtbar in Datacenter > Storage) oder beides. Die fstab-Methode öffnet Berechtigungen, so dass eine unprivilegierte LXC-Bindung des Pfades ohne Änderungen im Container lesen / schreiben kann.",
+    "ogTitle": "Host: Samba-Freigabe einhängen | ProxMenux-Dokumentation",
+    "ogDescription": "Eine externe Samba-/CIFS-Freigabe auf dem Proxmox-Host über pvesm, fstab mit offenen Berechtigungen für LXC-Bind-Mounts oder beide Methoden einhängen."
+  },
+  "header": {
+    "title": "Host: Samba-Freigabe auf dem Host einhängen",
+    "description": "Montieren Sie eine externe Samba (SMB / CIFS)-Freigabe - von einem NAS, einer Windows-Box, einem TrueNAS SMB Export - auf dem Proxmox-Host. Wählen Sie eine oder beide Methoden: Registrieren Sie es als Proxmox-Speicher (sichtbar in Datacenter > Storage) und/oder fügen Sie einen einfachen Mount über /etc/fstab an einem von Ihnen gewählten Pfad mit offenem uid/gid/file_mode hinzu, so dass unprivilegierte LXCs ohne Änderungen im Container bind-mounten und schreiben können.",
+    "section": "Speicher und Freigaben · Host"
+  },
+  "intro": {
+    "title": "Was das macht",
+    "body": "ProxMenux bietet zwei Methoden für Samba-Freigaben: <strong>(1) Proxmox-Speicher</strong> über <code>pvesm add cifs</code>, sichtbar unter Datacenter > Storage und eingehängt unter <code>/mnt/pve/&lt;id&gt;</code>. Das Passwort liegt im Klartext in <code>/etc/pve/priv/storage/&lt;id&gt;.pw</code>, geschützt durch das nur für root zugängliche private Verzeichnis. Das ist Zugriffsschutz, keine Verschlüsselung. <strong>(2) fstab-Mount auf dem Host</strong> an einem gewählten Pfad, dauerhaft über <code>/etc/fstab</code> und mit <code>uid=0,gid=0,file_mode=0777,dir_mode=0777</code>, damit unprivilegierte LXCs über Bind-Mounts schreiben können. Die Zugangsdaten liegen in einer nur für root lesbaren Datei unter <code>/etc/samba/credentials/</code>, nie direkt in <code>fstab</code>. Beide Methoden sind einzeln oder gemeinsam nutzbar."
+  },
+  "opening": {
+    "heading": "Öffnen des Tools",
+    "body": "Öffnen Sie im Hauptmenü von ProxMenux <strong>Speicher &amp; Freigabe-Manager → Samba Freigabe auf Host bereitstellen</strong>. Sie sehen dieses sub-Menü mit vier Optionen:",
+    "imageAlt": "Samba-Host-Menü — Einhängen / Anzeigen / Entfernen / Verbindung testen"
+  },
+  "howRuns": {
+    "heading": "Wie das Skript läuft",
+    "body": "Der Ablauf hat zwei Phasen. Phase 1: Server entdecken, Anmeldeinformationen validieren, Share auswählen und dann die Mount-Methode(n) über eine Checkliste auswählen. Phase 2: Nur die von Ihnen markierten Methoden werden ausgeführt. Anmeldeinformationen werden im Voraus benötigt, weil <code>smbclient</code> sie benötigt, um Freigaben aufzulisten. Bis zur endgültigen Bestätigung werden weder <code>/etc/pve/storage.cfg</code> noch <code>/etc/fstab</code> berührt."
+  },
+  "modes": {
+    "heading": "Mount-Methode wählen (eine oder beide Optionen)",
+    "intro": "Nach Auswahl der Freigabe und Validierung der Anmeldeinformationen zeigt ProxMenux eine Checkliste mit den beiden Mount-Methoden an. Sie können entweder oder beide markieren. Wenn Sie auf OK drücken, ohne etwas zu markieren, erscheint der Dialog erneut, bis Sie mindestens eine Option auswählen oder auf Abbrechen drücken, um den Fluss zu verlassen.",
+    "headerMethod": "Methode",
+    "headerMount": "Mount-Pfad",
+    "headerUi": "Sichtbar in Datacenter > Storage",
+    "headerUseCase": "Typischer Anwendungsfall",
+    "rows": [
+      {
+        "method": "<strong>Als Proxmox-Speicher (pvesm)</strong>",
+        "mountRich": "<code>/mnt/pve/&lt;storage-id&gt;</code> (verwaltet von Proxmox)",
+        "ui": "Ja",
+        "useCase": "Backups, ISOs, LXC-Vorlagen - alles, was in der Proxmox-Benutzeroberfläche angezeigt werden muss. Live VM-Festplatten werden technisch unterstützt, aber von CIFS (Locking Semantics) abgeraten."
+      },
+      {
+        "method": "<strong>Nur Host-fstab</strong>",
+        "mountRich": "<code>/mnt/&lt;path&gt;</code> mit offenem uid/gid/file_mode",
+        "ui": "Nein",
+        "useCaseRich": "Die Freigabe per Bind-Mount in LXCs einbinden, <em>ohne</em> Proxmox-Speicher zu registrieren. Offene lokale Rechte erleichtern unprivilegierten CTs den Zugriff; Schreibzugriff muss der SMB-Server dem angemeldeten Benutzer trotzdem erlauben."
+      },
+      {
+        "method": "<strong>Beide</strong>",
+        "mount": "Beide Pfade oben (zwei Mount-Punkte desselben CIFS-Exports)",
+        "ui": "Ja",
+        "useCase": "Sie wollen UI-Integration UND einen stabilen hostseitigen Pfad mit offenen Berechtigungen für LXC-Bind-Mounts. Der pvesm-Mount verwendet Proxmox-Standards; der fstab-Mount wendet das offene uid/gid/file_mode separat an."
+      }
+    ],
+    "bothTitle": "„Beide“ erstellt zwei CIFS-Mount-Punkte",
+    "bothBody": "pvesm hängt unter <code>/mnt/pve/&lt;id&gt;</code> mit Proxmox-Standardoptionen ein. fstab verwendet <code>/mnt/&lt;path&gt;</code> mit <code>uid=0,gid=0,file_mode=0777,dir_mode=0777</code> für lokalen Zugriff über LXC-Bind-Mounts. Der SMB-Server erzwingt weiterhin die Rechte des Mount-Benutzers. Zwei Mount-Punkte garantieren keine zwei getrennten TCP-Verbindungen."
+  },
+  "pvesmBranch": {
+    "heading": "Methode A — als Proxmox-Speicherung (pvesm)",
+    "intro": "Wenn <em>Als Proxmox-Speicher</em> markiert ist, führt ProxMenux den ursprünglichen pvesm-Flow aus:",
+    "items": [
+      "<strong>Storage ID</strong> — Standard <code>cifs-&lt;server-ip-with-dashes&gt;</code>. Nur Buchstaben, Ziffern, <code>-</code> und <code>_</code>.",
+      "<strong>Inhaltstypen</strong> — diese ProxMenux-Auswahl bietet <strong>6</strong> Optionen. Gegenüber NFS fehlt <code>rootdir</code>. Das ist eine Entscheidung des Skripts und keine Aussage, dass jede Proxmox-CIFS-Version LXC-Root-Dateisysteme verbietet:"
+    ],
+    "headerType": "Inhaltsart",
+    "headerAllows": "Was es erlaubt",
+    "rows": [
+      {
+        "type": "import",
+        "allows": "Datenträgerbildimporte (standardmäßig ausgewählt)."
+      },
+      {
+        "type": "backup",
+        "allowsRich": "VM und CT Backup-Dateien (<code>vzdump</code>)."
+      },
+      {
+        "type": "iso",
+        "allows": "ISO-Abbildungen für die Installation."
+      },
+      {
+        "type": "vztmpl",
+        "allows": "LXC-Vorlagen."
+      },
+      {
+        "type": "images",
+        "allowsRich": "VM-Festplatten in Betrieb — <strong>mit Warnung im Dialog</strong>, siehe unten."
+      },
+      {
+        "type": "snippets",
+        "allows": "Hook-Scripts und Cloud-Init-Snippets."
+      }
+    ],
+    "warnTitle": "VM-Disks auf CIFS",
+    "warnBody": "Die Auswahl <code>images</code> löst eine ProxMenux-Warnung aus: CIFS/SMB kann Sperrprobleme bei VM-Festplattenoperationen verursachen. Das Skript empfiehlt NFS, lässt Sie aber fortfahren. Sicherungen und ISOs sind typische CIFS-Anwendungen. Prüfen Sie Sperren, Snapshots, Migration und Last vor der Verwendung für <code>images</code>.",
+    "credsTitle": "Wo pvesm Anmeldeinformationen speichert",
+    "credsBody": "Das Passwort steht nicht in <code>/etc/pve/storage.cfg</code>. Proxmox schreibt Klartext-Zugangsdaten in <code>/etc/pve/priv/storage/&lt;storage-id&gt;.pw</code>, im privaten Bereich des Cluster-Dateisystems, den nur <code>root</code> lesen kann (Modus <code>0600</code>); geschützt sind sie durch Zugriffsrechte, nicht durch Verschlüsselung. Nach einer Passwortänderung am Server verwenden Sie <code>pvesm set &lt;id&gt; --password &lt;new&gt;</code> oder entfernen und ergänzen den Speicher über ProxMenux erneut."
+  },
+  "fstabBranch": {
+    "heading": "Methode B — nur ein fstab-Mount auf dem Host",
+    "intro": "Wenn <em>Nur fstab-Mount auf dem Host</em> ausgewählt ist, fragt ProxMenux nach Host-Pfad und dauerhaften Optionen, erstellt im Benutzermodus eine nur für root lesbare Zugangsdaten-Datei, hängt die Freigabe ein und schreibt den Eintrag in <code>/etc/fstab</code>:",
+    "items": [
+      "<strong>Mount-Pfad auf dem Host</strong> — standardmäßig <code>/mnt/&lt;share-name&gt;</code>. Es muss ein absoluter Weg sein. Wenn dort bereits etwas montiert ist oder ein fstab-Eintrag vorhanden ist, bietet ProxMenux an, ihn zu ersetzen.",
+      "<strong>Mount-Optionen</strong> — <em>Lesen/Schreiben</em> (Standard: <code>rw,uid=0,gid=0,file_mode=0777,dir_mode=0777,iocharset=utf8,nofail,_netdev</code>), <em>Nur Lesen</em> (<code>file_mode=0555,dir_mode=0555</code>), <em>Benutzerdefiniert</em> (eigene Optionen eingeben). Das Skript empfiehlt offene uid/gid/file_mode für Schreibzugriffe über LXC-Bind-Mounts."
+    ],
+    "credsTitle": "Anmeldedatendatei (Benutzermodus)",
+    "credsBody": "Wenn Sie sich mit einem Benutzernamen + Passwort authentifiziert haben, schreibt ProxMenux eine Root-Only-Anmeldedatendatei unter <code>/etc/samba/credentials/&lt;server&gt;_&lt;share&gt;.cred</code> (Modus <code>0600</code>) mit <code>username=</code> und <code>password=</code> Zeilen und verweist sie im fstab-Eintrag über die <code>credentials=</code>-Mount-Option. Klartext landet nie in <code>/etc/fstab</code>. Für den Gastmodus wird stattdessen die Option <code>guest</code> angehängt und es wird keine Anmeldedatei erstellt.",
+    "appliesIntro": "Sobald Sie bestätigen, das Skript:",
+    "applies": [
+      "<code>mkdir -p</code> der Mount Path.",
+      "<code>mount -t cifs -o &lt;opts&gt;,credentials=&lt;file&gt;</code> (oder <code>guest</code>) <code>//&lt;srv&gt;/&lt;share&gt; &lt;path&gt;</code>.",
+      "Schreibt einen einzeiligen Eintrag in <code>/etc/fstab</code>: <code>//&lt;srv&gt;/&lt;share&gt; &lt;path&gt; cifs &lt;opts&gt; 0 0</code>.",
+      "Führt <code>systemctl daemon-reload</code> aus, so dass systemd den neuen Fstab-Eintrag abholt."
+    ],
+    "lxcTitle": "Verwendung des fstab-Mounts aus einem unprivilegierten LXC",
+    "lxcBody": "Die CIFS-Optionen <code>uid=0,gid=0,file_mode=0777,dir_mode=0777</code> öffnen lokale Berechtigungsprüfungen für LXC-Bind-Mounts. Server-ACLs und ausgehandelte Unix-/POSIX-Semantik können den Zugriff weiterhin beeinflussen. <strong>Im Container wird nichts geändert</strong>: kein CT-<code>chown</code>, keine Gruppen oder Änderungen an <code>/etc/lxc</code>. Die <code>mp</code>-Zeile verwaltet Proxmox in der CT-Konfiguration. Verwenden Sie den angezeigten <code>pct set</code>-Befehl oder den <mountLink>LXC Mount Manager</mountLink>.",
+    "noUiTitle": "Der fstab-Mount ist KEIN Proxmox-Speicher",
+    "noUiBody": "Der fstab-Mount auf dem Host erscheint bewusst nicht in der Proxmox-Weboberfläche. Er fehlt unter <em>Datacenter > Storage</em>, lässt sich beim Erstellen einer VM oder eines CT nicht auswählen und kann nicht als Ziel eines Proxmox-Sicherungsauftrags dienen. Er ist lediglich ein Pfad im Dateisystem des Hosts. Wünschen Sie zusätzlich die Integration in die Oberfläche, wählen Sie <em>beide</em> Methoden aus."
+  },
+  "manual": {
+    "heading": "Manuelles Äquivalent",
+    "pvesmIntro": "Methode A (pvesm) bildet ab:",
+    "fstabUserIntro": "Methode B (fstab, user auth) — Anmeldedatendatei + Mount:",
+    "fstabGuestIntro": "Methode B (fstab, guest auth) — keine Anmeldedatendatei:"
+  },
+  "view": {
+    "heading": "CIFS-Speicher und Host-Mounts anzeigen",
+    "body": "Zeigt registrierte CIFS-Speicher (<code>pvesm status | awk ''$2 == \"cifs\"''</code>) mit Server, Freigabe, Inhalt, Benutzer oder <em>Gast</em>, Pfad und Status. Passwörter werden <strong>nie ausgegeben</strong>. <strong>Hinweis:</strong> Ein zweiter Abschnitt zeigt Host-fstab-Mounts mit Optionen, Zugangsdaten-Dateipfad und Aktivitätsstatus. Manuelle Prüfung mit <code>findmnt -t cifs</code> oder <code>grep cifs /etc/fstab</code>."
+  },
+  "remove": {
+    "heading": "CIFS-Speicher oder Host-Mount entfernen",
+    "body": "Die Auswahl enthält pvesm-Speicher und Host-fstab-Mounts. Für pvesm läuft <code>pvesm remove &lt;storage-id&gt;</code>; Proxmox entfernt zugehörige Zugangsdaten. Für fstab versucht das Skript <code>umount &lt;path&gt;</code>, entfernt den Eintrag aus <code>/etc/fstab</code> und Zugangsdaten unter <code>/etc/samba/credentials/</code> sowie nach Möglichkeit das leere Mount-Verzeichnis. Scheitert das Aushängen, sind manueller Unmount oder Neustart nötig. <strong>Der entfernte Samba-Server und seine Dateien bleiben unverändert</strong>.",
+    "warnTitle": "Abhängigkeiten zuerst sichern",
+    "warnBody": "VMs, CTs oder Backup-Jobs, die sich auf diesen Speicher nach ID beziehen, schlagen nach dem Entfernen fehl. Verschieben / löschen Sie diese Referenzen, bevor Sie den Speicher entfernen."
+  },
+  "test": {
+    "heading": "Samba Konnektivität testen",
+    "body": "Führt einen Diagnosepass über jeden in Proxmox registrierten CIFS-Speicher aus: Prüft, ob <code>smbclient</code> verfügbar ist, pingt jeden Server, prüft die Ports 445 und 139, versucht eine Gästeliste und meldet die eigene Ansicht von Proxmox (<code>pvesm status</code>). \"Erfordert Authentifizierung\" auf der Gästeliste bedeutet, dass Ihr Server nur Anteile authentifizierten Benutzern aussetzt - normal für die meisten NAS-Setups."
+  },
+  "troubleshoot": {
+    "heading": "Fehlerbehebung",
+    "noServersTitle": "\"Keine Samba-Server im Netzwerk gefunden\"",
+    "noServersBody": "Auto-discover verwendet <code>nmap -p 139,445</code>. Der Server kann sich in einem anderen Subnetz befinden, eine Firewall haben oder nur über den Hostnamen (mDNS / WINS) erreichbar sein. Verwenden Sie stattdessen die Option <em>Manual</em> mit IP oder Hostname.",
+    "noSharesTitle": "„Keine zugänglichen Freigaben gefunden“",
+    "noSharesBody": "<code>smbclient -L</code> gab nichts für diese Anmeldeinformationen zurück. Ursachen: Der Benutzer hat keine Berechtigung zum Auflisten von Shares (versuchen Sie es einmal mit Admin-Anmeldeinformationen oder geben Sie den Share-Namen manuell ein), der Server hat die Share-Sichtbarkeit deaktiviert oder die Anmeldeinformationen sind falsch. Mit dem Skript können Sie den Share-Namen in diesem Fall von Hand eingeben.",
+    "denyTitle": "Proxmox Mount scheitert mit NT_STATUS_ACCESS_DENIED",
+    "denyBody": "Die gespeicherten Anmeldeinformationen pvesm sind nicht mit dem Samba-Server synchronisiert (Passwort geändert, Konto deaktiviert, Domain / Arbeitsgruppenfehlanpassung). Wiedereingabe von Anmeldeinformationen mit <code>pvesm set &lt;id&gt; --username &lt;u&gt; --password &lt;p&gt;</code> oder Entfernen und erneutes Hinzufügen von ProxMenux. Wenn sich der Server in einer AD-Domäne befindet, fügen Sie <code>--domain &lt;DOMAIN&gt;</code> an den <code>pvesm set</code>-Aufruf an.",
+    "sleepTitle": "\"host is down\" oder der Speicherstatus wird nachts inaktiv",
+    "sleepBody": "Einige NAS-Appliances setzen SMB aggressiv schlafen. <code>pvestatd</code> sieht den Speicher dann als inaktiv, bis der erste Zugriff den NAS weckt. Wenn das kosmetisch ist, ist nichts kaputt. Wenn es zu Backup-Fehlern kommt, deaktivieren Sie die SMB Leerlauftrennung am NAS oder planen Sie Backups außerhalb des Schlaffensters.",
+    "lxcNoWriteTitle": "Unprivilegiertes LXC bind-mount kann nicht in den fstab Pfad schreiben",
+    "lxcNoWriteBody": "Prüfen Sie <code>findmnt /mnt/&lt;path&gt;</code> auf die vorgesehenen Optionen, etwa <code>uid=0,gid=0,file_mode=0777,dir_mode=0777</code>. Fehlende lokale Schreibrechte können zugeordnete LXC-UIDs blockieren. Wenden Sie das RW-Profil erneut an oder passen Sie eigene Optionen an. Prüfen Sie auch die Schreibrechte des SMB-Benutzers auf dem Server und ob Unix-/POSIX-Erweiterungen Servermodi liefern. Offene lokale Modi umgehen keine Server-ACLs.",
+    "fstabBootTitle": "fstab Mount wird nach dem Neustart nicht angezeigt",
+    "fstabBootBody": "Das Skript fügt <code>nofail,_netdev</code> hinzu, so dass ein fehlende Freigabe beim Booten den Start nicht blockiert. Wenn der Mount nie auftaucht: Bestätigen Sie, dass das Netzwerk erreichbar ist (<code>ping &lt;server&gt;</code>), überprüfen Sie <code>journalctl -u remote-fs.target</code>, überprüfen Sie, ob die Anmeldedatendatei noch vorhanden ist (<code>ls -l /etc/samba/credentials/</code>) und lesbar ist, und versuchen Sie <code>mount -a</code> manuell."
+  },
+  "related": {
+    "heading": "Verwandte Themen",
+    "items": [
+      {
+        "href": "/docs/storage-share/host-nfs",
+        "label": "NFS-Freigabe als Proxmox-Speicher",
+        "tail": "— Geschwisterseite mit dem gleichen Flussmuster (Methode A pvesm + Methode B fstab) und Side-by-Side-Trade-offs."
+      },
+      {
+        "href": "/docs/storage-share/lxc-mount-points",
+        "label": "LXC-Mount-Verwaltung",
+        "tailRich": "— bind-mount den fstab-only Pfad <code>/mnt/&lt;path&gt;</code> in einen oder mehrere Container."
+      },
+      {
+        "href": "/docs/storage-share/lxc-samba-client",
+        "label": "Samba-Client in LXC",
+        "tail": "— Alternative: Samba direkt aus einem privilegierten Container montieren (überspringt den Host)."
+      }
+    ]
+  }
+}
diff --git a/web/messages/de/docs/storage-share/index.json b/web/messages/de/docs/storage-share/index.json
new file mode 100644
index 00000000..19280515
--- /dev/null
+++ b/web/messages/de/docs/storage-share/index.json
@@ -0,0 +1,135 @@
+{
+  "meta": {
+    "title": "Proxmox NFS, Samba, iSCSI und LXC-Mounts — Speicher und Freigaben | ProxMenux",
+    "description": "Integrieren Sie externen und lokalen Speicher in Proxmox VE und teilen Sie Ordner zwischen dem Host und LXC-Containern. Fügen Sie NFS-Freigaben, Samba-Freigaben (CIFS) und iSCSI-Ziele als Proxmox-Speicher hinzu, richten Sie LXC-Bind-Mounts mit dem Mount Manager ein und betreiben Sie NFS-/Samba-Clients und -Server in Containern.",
+    "ogTitle": "Proxmox NFS, Samba, iSCSI und LXC-Mounts — Speicher und Freigaben",
+    "ogDescription": "Integrieren Sie externen / lokalen Speicher in Proxmox VE - NFS, Samba, iSCSI-Registrierung sowie LXC-Bind-Mounts und Netzwerkfreigabe.",
+    "twitterTitle": "Proxmox NFS, Samba, iSCSI | ProxMenux",
+    "twitterDescription": "Fügen Sie NFS / Samba / iSCSI als Proxmox-Speicher hinzu und teilen Sie Ordner zwischen Host und LXC."
+  },
+  "header": {
+    "title": "Speicher- und Freigabemanager",
+    "description": "Integrieren Sie externen oder lokalen Speicher in Proxmox VE und teilen Sie Ordner zwischen dem Host und LXC-Containern. Drei Werkzeuggruppen: Host-Speicherintegration (Speicher direkt in Proxmox registrieren), der LXC Mount Manager (Bind-Mounts mit pragmatischer Rechteverwaltung) und LXC-Netzwerkfreigaben (NFS-/Samba-Client- und -Server-Abläufe für bestimmte Anwendungsfälle).",
+    "section": "Speicher und Freigaben"
+  },
+  "intro": {
+    "title": "Wofür dieses Menü ist",
+    "body": "Der Disk Manager arbeitet auf der Ebene von <em>individuellen physischen Disks</em>. Der Storage &amp; Share Manager arbeitet eine Ebene höher – er <strong> registriert Speicherpools und Netzwerkfreigaben in Proxmox</strong> (damit die Benutzeroberfläche und der VM-Ersteller sie verwenden können) und <strong> richtet die Dateifreigabe zwischen dem Host und Ihren Containern</strong> ein."
+  },
+  "opening": {
+    "heading": "Öffnen des Menüs",
+    "body": "Wählen Sie im Hauptmenü von ProxMenux <strong>Storage &amp; Share Manager</strong>. Sie werden sehen:",
+    "imageAlt": "Storage & Share Manager Menü mit HOST und LXC Blöcken"
+  },
+  "groups": {
+    "heading": "Drei Werkzeuggruppen",
+    "intro": "Das Menü ist in drei Gruppen aufgeteilt. <strong>Host-Speicherintegration</strong> registriert externen oder lokalen Speicher direkt in Proxmox. Der <strong>LXC Mount Manager</strong> ist das Hauptwerkzeug zur Ordnerfreigabe für Container — ein pragmatischer Bind-Mount-Ablauf, der die UID-Zuordnung unprivilegierter CTs auf dem Host berücksichtigt. <strong>LXC-Netzwerkfreigaben</strong> decken vier zusätzliche Szenarien ab, in denen ein Container NFS-/Samba-Freigaben direkt <em>nutzen</em> oder <em>bereitstellen</em> muss.",
+    "hostTitle": "Host-Speicher",
+    "hostBody": "Registrieren Sie externe und lokale Speicherung in Proxmox über <code>pvesm add …</code>. Nach der Registrierung erscheint der Speicher in der Proxmox-Benutzeroberfläche und steht den VM- und CT-Erstellern zur Verfügung.",
+    "hostItems": [
+      "Externer NFS / Samba / iSCSI → Proxmox Speicher",
+      "Lokale Festplatte → Proxmox Verzeichnis oder ZFS Speicher",
+      "Lokales freigegebenes Verzeichnis (für Bind-Mounts in mehrere CTs)"
+    ],
+    "lxcMountTitle": "LXC-Mount-Verwaltung",
+    "lxcMountBody": "Das primäre LXC-Sharing-Tool. Bindet Host-Verzeichnisse über <code>pct set -mpN</code> in Container ein und verarbeitet die Besonderheiten der Berechtigungen von unprivilegierten CTs, ohne eine Gruppe oder einen Benutzer im Container zu erstellen.",
+    "lxcMountItems": [
+      "Arbeitet mit privilegierten und unprivilegierten CTs",
+      "Bietet <code>o+rwx</code> für das Hostverzeichnis an, um unprivilegierte UIDs zu unterstützen",
+      "Behebt vorhandene CIFS / NFS Mounts bei Bedarf"
+    ],
+    "lxcNetTitle": "LXC Netzwerkfreigabe",
+    "lxcNetBody": "Vier zusätzliche Abläufe, wenn ein Container NFS-/Samba-Freigaben direkt nutzen oder bereitstellen muss. Alle erfordern einen <strong>privilegierten</strong> Container.",
+    "lxcNetItems": [
+      "NFS-/Samba-<strong>Client</strong> (externe Freigaben nutzen)",
+      "NFS-/Samba-<strong>Server</strong> (CT-Ordner bereitstellen)"
+    ]
+  },
+  "host": {
+    "heading": "Integration von Host-Speicher",
+    "intro": "Speicher in Proxmox registrieren. Jede Option ruft <code>pvesm add …</code> unter der Haube auf, so dass der Speicher in <strong>Datacenter → Storage</strong> angezeigt wird und den VM / CT-Erstellern zur Verfügung steht.",
+    "options": [
+      {
+        "href": "/docs/storage-share/host-nfs",
+        "icon": "Network",
+        "title": "NFS-Freigabe als Proxmox-Speicher hinzufügen",
+        "description": "Registrieren Sie einen externen NFS-Export als Proxmox-Speicher über pvesm add nfs. Proxmox übernimmt das mount - keine fstab-einträge erforderlich."
+      },
+      {
+        "href": "/docs/storage-share/host-samba",
+        "icon": "Share2",
+        "title": "Samba-Freigabe als Proxmox-Speicher hinzufügen",
+        "description": "Registrieren Sie eine externe Samba-/CIFS-Freigabe als Proxmox-Speicher über pvesm add cifs. Proxmox übernimmt das Einhängen und die Anmeldeinformationen."
+      },
+      {
+        "href": "/docs/storage-share/host-iscsi",
+        "icon": "Database",
+        "title": "Hinzufügen von iSCSI-Ziel als Proxmox-Speicher",
+        "description": "Verbinden Sie sich mit einem externen iSCSI-Ziel und registrieren Sie es als Proxmox-Speicher (Blockgerät) für VM-Disk-Images."
+      },
+      {
+        "href": "/docs/storage-share/host-local-disk",
+        "icon": "HardDrive",
+        "title": "Lokale Festplatte als Proxmox-Speicher hinzufügen",
+        "description": "Formatieren Sie eine lokale SATA / SAS / NVMe-Festplatte und registrieren Sie sie als Proxmox-Verzeichnis oder ZFS-Poolspeicher."
+      },
+      {
+        "href": "/docs/storage-share/host-local-shared",
+        "icon": "FolderOpen",
+        "title": "Freigegebenes Verzeichnis auf dem Host hinzufügen",
+        "description": "Erstellen Sie ein Host-Verzeichnis, das in mehrere CTs eingebunden werden soll. Kein Proxmox-Speicher - rein eine hostseitige Ressource für LXC-Bind-Mounts."
+      }
+    ]
+  },
+  "lxcMount": {
+    "heading": "LXC-Mount-Verwaltung",
+    "intro": "Das primäre Tool zum Teilen von Ordnern zwischen dem Proxmox-Host und LXC-Containern. Es verwendet <code>pct set -mpN</code>, um ein Host-Verzeichnis in den Container zu binden, und behandelt die Besonderheiten der Berechtigungen von unprivilegierten CTs auf der Hostseite (es werden keine Gruppen oder Benutzer innerhalb des Containers erstellt).",
+    "card": {
+      "title": "LXC-Mountpoints (Host ↔ CT)",
+      "description": "Binden Sie ein beliebiges Hostverzeichnis mit pct set -mpN in einen LXC-Container ein. Dies funktioniert mit privilegierten und unprivilegierten CTs. Das Werkzeug bietet chmod o+rwx und ACLs für das Hostverzeichnis an und korrigiert bei Bedarf vorhandene CIFS- oder NFS-Mounts."
+    }
+  },
+  "lxcNet": {
+    "heading": "LXC Netzwerkfreigabe",
+    "intro": "Verwenden Sie diese Abläufe, wenn ein Container ein NFS-/Samba-Endpunkt <em>sein</em> muss — entweder eine externe Freigabe nutzen (Client) oder eigene Ordner bereitstellen (Server). Für die meisten Dateifreigaben (Bind-Mounts zwischen Host ↔ CT) ist der <mountLink>LXC Mount Manager</mountLink> einfacher und erfordert keine privilegierten Container.",
+    "options": [
+      {
+        "href": "/docs/storage-share/lxc-nfs-client",
+        "icon": "Download",
+        "title": "NFS-Client in LXC",
+        "description": "NFS-Freigaben innerhalb eines privilegierten LXC-Containers einhängen. Unterstützt automatische Erkennung, dauerhafte Einträge in /etc/fstab und sauberes Aushängen."
+      },
+      {
+        "href": "/docs/storage-share/lxc-samba-client",
+        "icon": "Download",
+        "title": "Samba-Client in LXC",
+        "description": "Samba-/CIFS-Freigaben innerhalb eines privilegierten LXC-Containers einhängen. Zugangsdaten werden geschützt gespeichert; automatische Erkennung ist verfügbar."
+      },
+      {
+        "href": "/docs/storage-share/lxc-nfs-server",
+        "icon": "Upload",
+        "title": "NFS Server in LXC",
+        "description": "Exportieren Sie Ordner über NFS aus einem privilegierten LXC-Container."
+      },
+      {
+        "href": "/docs/storage-share/lxc-samba-server",
+        "icon": "Upload",
+        "title": "Samba-Server in LXC",
+        "description": "Geben Sie Ordner über SMB / CIFS aus einem privilegierten LXC-Container frei."
+      }
+    ]
+  },
+  "privReq": {
+    "title": "Privilegierte Containeranforderung",
+    "body": "Die vier obigen Abläufe für <strong>LXC-Netzwerkfreigaben</strong> erfordern einen <strong>privilegierten</strong> Container. Die Skripte prüfen diesen unterstützten Modus, bevor sie Dienste und Mount-Werkzeuge konfigurieren (<code>nfs-kernel-server</code>, <code>smbd</code>, <code>mount.nfs</code>, <code>mount.cifs</code>). Wenn Sie nur Dateien zwischen Host und unprivilegiertem CT teilen möchten, verwenden Sie den <mountLink>LXC Mount Manager</mountLink>: Er bindet die Verzeichnisse vom Host aus ein und passt dort die Rechte an, sodass der Container lesen und schreiben kann, ohne diese Dienste oder Werkzeuge in ihm einzurichten."
+  },
+  "unprivExplain": {
+    "title": "Wie ProxMenux unprivilegierte CT-Berechtigungen verarbeitet",
+    "body": "Unprivilegierte LXC-Container verschieben ihre UIDs auf dem Host um <strong>+100000</strong> (Container-UID 0 = Host-UID 100000, Container-UID 1000 = Host-UID 101000, …). Eine von einem Container-Benutzer erstellte Datei erscheint daher auf dem Host als <em>andere</em> — sie gehört keinem regulären Host-Benutzer oder keiner regulären Host-Gruppe. Der LXC Mount Manager löst dies pragmatisch: Statt UIDs/GIDs zwischen Host und CT abzugleichen, bietet er <code>chmod o+rwx</code> mit passenden ACLs für das Hostverzeichnis an, sodass jede zugeordnete UID lesen und schreiben kann. CIFS wird mit <code>uid=0,gid=0,file_mode=0777,dir_mode=0777</code> neu eingehängt; bei NFS wird ein für alle beschreibbares Verzeichnis mit Sticky-Bit eingerichtet. Bei Root-Squashing weist das Werkzeug auf die nötige serverseitige Korrektur hin."
+  },
+  "scripts": {
+    "heading": "Involvierte Skripte",
+    "intro": "Jede einzelne Seite verlinkt auf das Skript, das seinen Fluss antreibt. Die folgende Datei ist ein gemeinsamer Helfer, der nicht als eigene Seite dokumentiert ist, sondern von mehreren LXC-Netzwerk-Sharing-Flows verwendet wird:",
+    "itemTail": "CT-Validierung, Einhängepunktauswahl, privilegierte Überprüfung und universelle Gruppeneinrichtungshelfer, die über die LXC-Client- / Serverflüsse hinweg geteilt werden."
+  }
+}
diff --git a/web/messages/de/docs/storage-share/lxc-mount-points.json b/web/messages/de/docs/storage-share/lxc-mount-points.json
new file mode 100644
index 00000000..d28a0f6c
--- /dev/null
+++ b/web/messages/de/docs/storage-share/lxc-mount-points.json
@@ -0,0 +1,174 @@
+{
+  "meta": {
+    "title": "LXC-Einhängepunkte (Host ↔ Container) | ProxMenux-Dokumentation",
+    "description": "Der LXC Mount Manager bindet ein beliebiges Hostverzeichnis mit pct set -mpN in einen oder mehrere LXC-Container ein. Er berücksichtigt Besonderheiten der Berechtigungen unprivilegierter Container, korrigiert vorhandene CIFS- und NFS-Mounts auf dem Host und verändert nichts im Container.",
+    "ogTitle": "LXC-Einhängepunkte (Host ↔ Container) | ProxMenux-Dokumentation",
+    "ogDescription": "Bind-Mount-Hostverzeichnisse in LXC-Containern. Behandelt unprivilegiertes UID-Mapping pragmatisch, behebt CIFS / NFS-Zugriff auf der Hostseite."
+  },
+  "header": {
+    "title": "LXC-Einhängepunkte (Host ↔ Container)",
+    "description": "Das primäre Tool zum Teilen von Ordnern zwischen dem Proxmox-Host und LXC-Containern. Bindet ein beliebiges Hostverzeichnis in einen oder mehrere Container mit Proxmox's nativer pct set -mpN-Syntax. Die Besonderheit: Es löst die Berechtigungsprobleme von unprivilegierten Containern auf der Hostseite - es ändert niemals etwas im Container.",
+    "section": "Speicher und Freigaben · LXC"
+  },
+  "intro": {
+    "title": "Was das macht",
+    "body": "Nehmen Sie ein Verzeichnis, das sich auf dem Proxmox-Host befindet (ein lokaler Ordner, eine eingehängte NAS-Freigabe, ein von Proxmox verwalteter Speicher ...) und lassen Sie es in einem LXC-Container auf einem von Ihnen gewählten Pfad erscheinen, mit Berechtigungen, die auch für unprivilegierte Container funktionieren - ohne etwas im Container zu berühren."
+  },
+  "bigPicture": {
+    "heading": "Wie es funktioniert (das große Bild)",
+    "intro": "Bei einem Bind-Mount weist Proxmox den Kernel an, das Hostverzeichnis <code>X</code> auch unter <code>Y</code> im Container bereitzustellen. Keine Kopie, keine Synchronisierung, kein Netzwerk: Beide Seiten sehen gleichzeitig die <em>gleichen Dateien</em>.",
+    "sourceLabel": "Proxmox-Host",
+    "sourceDetail": "/mnt/data\n(Ihr Ordner)",
+    "targetLabel": "LXC-Container",
+    "targetDetail": "/mnt/data\n(erscheint hier)",
+    "arrowLabel": "Bind-Mount",
+    "outro": "Der Host-Pfad links und der Container-Pfad rechts können unterschiedlich sein - zum Beispiel kann <code>/mnt/nas-films</code> auf dem Host <code>/media/films</code> innerhalb des Containers werden. Das Skript fügt den Eintrag zur Container-Konfiguration (<code>/etc/pve/lxc/&lt;ctid&gt;.conf</code>) mit dem nächsten freien <code>mpN</code>-Index hinzu, wobei zwei sichere Standardeinstellungen eingebaut sind:",
+    "items": [
+      "<code>shared=1</code> — kennzeichnet die Daten als gemeinsam genutzt, sodass Proxmox sie nicht mit dem CT migriert. Das Flag repliziert keine Daten: Derselbe Pfad und dieselben Daten müssen auf dem Zielknoten bereits verfügbar sein.",
+      "<code>backup=0</code> – schließt die Bind-Mount von <code>vzdump</code>-Backups aus (die Daten leben auf dem Host, Sie sichern sie separat)."
+    ]
+  },
+  "perms": {
+    "heading": "Berechtigungen handhaben",
+    "intro": "Bind-Mounts sind prinzipiell einfach. Der schwierige Teil sind Berechtigungen: Ein <strong>unprivilegierter</strong> LXC-Container verschiebt jede UID durch <strong> + 100000</strong>, so dass eine Datei, die vom Benutzer 1000 im Container erstellt wurde, auf dem Host als UID 101000 erscheint - eine UID, die niemand auf dem Host besitzt. Um dies zu ermöglichen, ohne UIDs über Hosts und Container auszurichten, wendet ProxMenux den richtigen \"Öffnen von Berechtigungen\" -Trick auf der <em>Host</em>-Seite an, je nachdem, welche Art von Verzeichnis Sie ausgewählt haben:",
+    "headerType": "Host-Verzeichnistyp",
+    "headerAction": "Was das Skript zu tun anbietet",
+    "localType": "Lokaler Ordner",
+    "localTypeSub": "z.B. /mnt/data",
+    "localActionRich": "<code>chmod o+rwx</code> + <code>setfacl o::rwx</code> im Hostverzeichnis. Nur angeboten, wenn der CT nicht privilegiert ist und die aktuellen Berechtigungen nicht ausreichen.",
+    "cifsType": "Eingehängtes CIFS / SMB",
+    "cifsTypeSub": "z.B. /mnt/pve/cifs-…",
+    "cifsActionRich": "Remount mit <code>uid=0, gid=0, file_mode=0777, dir_mode=0777</code>, damit der CT (jede UID) die Freigabe lesen und schreiben kann. <code>/etc/fstab</code> wird aktualisiert.",
+    "nfsType": "Eingehängtes NFS",
+    "nfsTypeSub": "z.B. /mnt/pve/nfs-…",
+    "nfsActionRich": "<code>chmod 1777</code> und <code>setfacl o::rwx</code> auf dem NFS-Mount. Serverseitiges Squashing lässt sich damit nicht umgehen. Kann selbst root auf dem Host nicht schreiben, werden Sie zur Korrektur des Exports auf dem NFS-Server angeleitet.",
+    "privTitle": "Privilegierte Container benötigen nichts davon",
+    "privBody": "Für privilegierte Container ist UID 0 im CT UID 0 auf dem Host - root im CT kann das Hostverzeichnis direkt ohne Berechtigungstricks lesen und schreiben. Das Skript erkennt dies und überspringt den Schritt \"Öffnen von Berechtigungen\" vollständig.",
+    "noCtTitle": "Das Skript ändert niemals etwas im Container",
+    "noCtBody": "Alle Berechtigungsanpassungen erfolgen auf dem <strong>host-Dateisystem</strong>. Keine <code>pct exec</code>-Chowns, keine im CT erstellten Gruppen, kein Fstab im Container. Wenn Sie das bind-mounted-Verzeichnis später in einem anderen CT wiederverwenden, gelten die gleichen Berechtigungen automatisch - keine Einrichtung pro Container."
+  },
+  "writes": {
+    "heading": "Was ProxMenux schreibt - und was nicht",
+    "intro": "Eine häufige Verwirrung beim Binden in einen unprivilegierten CT: Die Leute gehen davon aus, dass ProxMenux <code>lxc.idmap</code>-Einträge in <code>/etc/pve/lxc/&lt;CTID&gt;.conf</code> schreiben muss. <strong>Das tut es nicht.</strong> Nur eine Zeile ist an diese Datei angehängt – das Bind-Mount selbst:",
+    "outro": "Die Ausgabezeile, die Sie am Ende des Laufs sehen, <em>\"Unprivilegierter Container - UID-Offset: 100000\"</em>, ist rein informativ - sie sagt Ihnen nur, dass der CT die standardmäßige unprivilegierte Zuordnung von Proxmox verwendet (root in CT = UID 100000 auf Host). Das Skript konfiguriert nichts um es herum.",
+    "twoWaysHeading": "Die beiden Möglichkeiten, Berechtigungen funktionieren zu lassen - und warum ProxMenux eine auswählt",
+    "headerApproach": "Ansatz",
+    "headerChanges": "Was es verändert",
+    "headerWhen": "Wenn es passt",
+    "hostType": "Berechtigungen auf dem Host",
+    "hostTypeSub": "(Was dieses Skript macht)",
+    "hostChangesRich": "<code>chmod o+rwx</code> + <code>setfacl o::rwx</code> im Hostverzeichnis. Die abgebildeten UIDs des CT (100000+) fallen in den \"Anderen\"-Bucket, so dass das Öffnen von <em>andere</em> ausreicht.",
+    "hostWhen": "Generic Shared-Ordner-Zugriff von jedem CT. Mehrere CTs teilen sich das gleiche Hostverzeichnis. Einfach und wiederverwendbar.",
+    "idmapTypeRich": "<code>lxc.idmap</code>",
+    "idmapTypeSub": "(nicht von diesem Skript verwendet)",
+    "idmapChangesRich": "Benutzerdefiniertes UID/GID-Mapping in <code>/etc/pve/lxc/&lt;CTID&gt;.conf</code> plus passende <code>/etc/subuid</code> + <code>/etc/subgid</code> Einträge auf dem Host. CT muss bei jeder Änderung neu gestartet werden.",
+    "idmapWhenRich": "Sie benötigen eine <em>bestimmte</em> UID innerhalb der CT, um einer <em>bestimmte</em> UID auf dem Host zuzuordnen (z.B.) <code>media:1000</code> im CT muss Dateien als <code>media:1000</code> auf dem Host besitzen, damit NFS nicht quetscht. Ein starreres Setup, das sich normalerweise nur für genau dieses Szenario lohnt.",
+    "idmapTipTitle": "Wenn Sie lxc.idmap tatsächlich benötigen",
+    "idmapTipBody": "Verwenden Sie manuelle ID-Zuordnung, wenn im CT geschriebene Dateien auf dem Host einer bestimmten numerischen UID/GID gehören sollen, etwa für gemeinsame Eigentümerschaft mit einem Hostbenutzer. Sie umgeht NFS-<code>all_squash</code> nicht; anonyme Identität und Rechte bestimmt weiterhin der Server. Fügen Sie bei Bedarf <code>lxc.idmap</code>-Einträge von Hand hinzu. Die Bind-Mount-Zeile ist davon unabhängig."
+  },
+  "opening": {
+    "heading": "Öffnen des Tools",
+    "body": "Öffnen Sie im Hauptmenü von ProxMenux <strong>Storage &amp; Share Manager → Konfigurieren Sie LXC Mount Points (Host ↔ Container)</strong>. Sie sehen dieses sub-Menü mit drei Optionen:",
+    "imageAlt": "LXC Mount Manager-Menü - Hinzufügen / Ansicht / Entfernen"
+  },
+  "addFlow": {
+    "heading": "Mount hinzufügen — vollständiger Ablauf",
+    "intro": "Die technische Ansicht, wenn Sie genau wissen möchten, was jeder Dialog tut:"
+  },
+  "sources": {
+    "heading": "Was Sie als Host-Verzeichnis auswählen können",
+    "intro": "Der Host-Verzeichnis-Picker ist der gründlichste im Abschnitt Storage &amp; Share. Es scannt vier Quellen und präsentiert eine deduplizierte Liste:",
+    "headerSource": "Quelle",
+    "headerWhere": "Woher es kommt",
+    "headerLabel": "Label im Menü",
+    "rows": [
+      {
+        "source": "Aktive Netzwerk-Mounts",
+        "whereRich": "Aktuell eingehängte CIFS-/NFS-Freigaben aus <code>/proc/mounts</code>.",
+        "labelRich": "<code>NFS [used/size]</code> oder <code>CIFS/SMB [used/size]</code>"
+      },
+      {
+        "source": "Inaktive fstab-Mounts",
+        "whereRich": "Definiert in <code>/etc/fstab</code>, aber derzeit nicht montiert.",
+        "labelRich": "<code>fstab(off)-NFS</code> / <code>fstab(off)-CIFS/SMB</code>"
+      },
+      {
+        "source": "Lokale Verzeichnisse",
+        "whereRich": "Sub-Verzeichnisse unter <code>/mnt</code>, die keine Netzwerk-Mounts sind.",
+        "labelRich": "<code>Local [size]</code>"
+      },
+      {
+        "source": "Proxmox-Speicher",
+        "whereRich": "Speicherpfade unter <code>/mnt/pve/*</code> (NFS / CIFS registriert über <code>pvesm</code>).",
+        "labelRich": "<code>PVE-NFS</code> / <code>PVE-CIFS/SMB</code> / <code>Proxmox-Storage</code>"
+      },
+      {
+        "source": "Manuelle Eingabe",
+        "where": "Alles andere - geben Sie den absoluten Pfad selbst ein.",
+        "labelRich": "<em>Pfad manuell eingeben</em>"
+      }
+    ],
+    "tipTitle": "Interne Proxmox Pfade werden herausgefiltert",
+    "tipBody": "Der Picker überspringt explizit interne Proxmox-Pfade (<code>/mnt/pve/local</code>, <code>/mnt/pve/local-lvm</code>, <code>/mnt/pve/backup</code>, ...) – diese sind für Proxmox-Interna reserviert und Sie sollten sie nicht binden. Nur vom Benutzer hinzugefügte Speicher werden angezeigt."
+  },
+  "manual": {
+    "heading": "Manuelles Äquivalent",
+    "privIntro": "Für einen privilegierten Container — der einfachste Fall, keine Berechtigung Tricks:",
+    "unprivLocalIntro": "Für einen unprivilegierten Container mit einem lokalen Host-Verzeichnis - öffnen Sie zuerst Berechtigungen auf dem Host:",
+    "unprivCifsIntro": "Für einen unprivilegierten Container mit einem CIFS-Freigabe, der bereits auf dem Host montiert ist:"
+  },
+  "view": {
+    "heading": "Einhängepunkte anzeigen",
+    "body": "Listet jeden <code>mpN</code>-Eintrag für jeden Container auf diesem Proxmox-Host auf, gruppiert nach CT ID und zeigt Hostpfad → Containerpfad plus zusätzliche Optionen an. Nur Lesen - nützlich als Plausibilitätsprüfung, bevor Sie etwas hinzufügen oder entfernen."
+  },
+  "remove": {
+    "heading": "Einhängepunkt entfernen",
+    "body": "Wählen Sie den Container, wählen Sie den <code>mpN</code>-Eintrag, bestätigen Sie. Das Skript führt <code>pct set --delete mpN</code> aus, um den Eintrag aus der CT-Konfiguration zu löschen, und bietet an, den Container neu zu starten, wenn er ausgeführt wird. Das Host-Verzeichnis und sein Inhalt sind <strong>unverändert</strong> – Sie können das Mount später erneut hinzufügen (oder dasselbe Verzeichnis an ein anderes CT) anhängen.",
+    "warnTitle": "Live-laufende Container benötigen einen Neustart, damit Änderungen wirksam werden können",
+    "warnBody": "Sowohl Hinzufügen als auch Entfernen von Befestigungspunkten werden erst nach einem Neustart im Inneren des Containers sichtbar. Das Skript bietet einen <code>pct reboot</code> mit einem Klick am Ende jeder Operation; Sie können später manuell ablehnen und neu starten."
+  },
+  "troubleshoot": {
+    "heading": "Fehlerbehebung",
+    "noMountTitle": "Mount erscheint in pct config, aber nicht im Container",
+    "noMountBody": "Bind-Mounts werden nur dann angebracht, wenn der Container startet. Wenn Sie die Mount hinzugefügt haben, während die CT ausgeführt wurde, starten Sie sie neu (<code>pct reboot &lt;ctid&gt;</code>). Wenn es bereits neu gestartet wurde und immer noch fehlt, überprüfen Sie <code>pct config &lt;ctid&gt;</code>, um zu bestätigen, dass der Eintrag existiert und der Hostpfad tatsächlich ein Verzeichnis enthält.",
+    "noWriteTitle": "Container kann das Verzeichnis sehen, aber nicht schreiben",
+    "noWriteBody": "Fast immer ein Berechtigungsproblem. Führen Sie bei unprivilegierten Containern die Berechtigungskorrektur des Skripts erneut aus - die ACLs des Hostverzeichnisses wurden möglicherweise von einem anderen Tool zurückgesetzt (rsync, Wiederherstellen aus dem Backup, manuelles <code>chmod</code>). Überprüfen Sie für CIFS die Mount-Optionen auf dem Host: <code>findmnt /mnt/pve/cifs-…</code>, suchen Sie nach <code>uid=</code> / <code>gid=</code> / <code>file_mode=</code> Werten.",
+    "alreadyTitle": "\"Dieser Pfad wird bereits als Einhängepunkt in diesem Container verwendet\"",
+    "alreadyBody": "Sie haben den gleichen Containerpfad ausgewählt, der bereits mit einem anderen Hostverzeichnis verdrahtet ist. Wählen Sie entweder einen anderen Containerpfad oder entfernen Sie zuerst den vorhandenen Montagepunkt.",
+    "nfsTitle": "NFS-Zugriff auch nach Anwendung des Host-Fixes blockiert",
+    "nfsIntro": "Ihr NFS-Server quetscht Root oder alle Verbindungen. Das Skript kann dies erkennen (es versucht, eine Testdatei vom Host zu schreiben) und zeigt die serverseitige Anleitung. Zwei gängige serverseitige Fixes für den Export:",
+    "nfsItems": [
+      "<code>no_root_squash</code> - privilegierte CTs können direkt schreiben.",
+      "<code>all_squash,anonuid=65534,anongid=65534</code> — für unprivilegierte CTs."
+    ],
+    "nfsOutro": "Diese Änderungen finden auf dem NFS-Server (TrueNAS, Synology, Ihr benutzerdefinierter Export, ...) statt, nicht auf Proxmox.",
+    "fstabOffTitle": "\"Fstab(off)\"-Einträge machen nichts",
+    "fstabOffBody": "Der Picker zeigt <code>fstab(off)-</code>-Einträge an, wenn ein Netzwerk-Mount in fstab definiert, aber derzeit nicht montiert ist. Mit dem Skript können Sie den Pfad bind-mounten, aber das Verzeichnis wird leer sein, bis Sie die Freigabe tatsächlich mounten (<code>mount &lt;path&gt;</code> auf dem Host). Montieren Sie es zuerst und binden Sie es dann in den CT."
+  },
+  "related": {
+    "heading": "Verwandte Themen",
+    "items": [
+      {
+        "href": "/docs/storage-share/host-local-shared",
+        "label": "Shared Directory auf Host hinzufügen",
+        "tailRich": "— typischer erster Schritt: Bereiten Sie einen <code>/mnt/shared</code> auf dem Host vor, bevor Sie ihn hier in einen oder mehrere CTs binden."
+      },
+      {
+        "href": "/docs/storage-share/host-nfs",
+        "label": "NFS-Freigabe als Proxmox-Speicher hinzufügen",
+        "extraHref": "/docs/storage-share/host-samba",
+        "extraLabel": "Samba-Freigabe als Proxmox-Speicher hinzufügen",
+        "joiner": " / ",
+        "tailRich": "- registrieren Sie zuerst eine externe Freigabe in Proxmox und binden Sie dann den <code>/mnt/pve/&lt;id&gt;</code>-Pfad hier in den CT."
+      },
+      {
+        "href": "/docs/storage-share/lxc-nfs-client",
+        "label": "NFS-Client in LXC",
+        "extraHref": "/docs/storage-share/lxc-samba-client",
+        "extraLabel": "Samba-Client in LXC",
+        "joiner": " / ",
+        "tail": "- die Alternative, wenn Sie möchten, dass der CT selbst die Freigabe anbringt (erfordert einen privilegierten Container)."
+      }
+    ]
+  }
+}
diff --git a/web/messages/de/docs/storage-share/lxc-nfs-client.json b/web/messages/de/docs/storage-share/lxc-nfs-client.json
new file mode 100644
index 00000000..7284f86c
--- /dev/null
+++ b/web/messages/de/docs/storage-share/lxc-nfs-client.json
@@ -0,0 +1,128 @@
+{
+  "meta": {
+    "title": "NFS Client in LXC | ProxMenux Dokumentation",
+    "description": "NFS-Freigaben direkt in einem Proxmox-LXC-Container mit ProxMenux einhängen. Installiert nfs-common automatisch, unterstützt automatische Erkennung im LAN, dauerhafte Mounts über /etc/fstab und sichere Starteinstellungen. Erfordert einen privilegierten Container.",
+    "ogTitle": "NFS Client in LXC | ProxMenux Dokumentation",
+    "ogDescription": "NFS-Freigaben in einem privilegierten LXC einhängen. Automatische Erkennung, dauerhafte Einträge in /etc/fstab und sichere Starteinstellungen."
+  },
+  "header": {
+    "title": "NFS-Client in LXC",
+    "description": "NFS-Freigaben direkt in einem Proxmox-LXC-Container einhängen. Der Container ist ein eigener NFS-Client: Er kommuniziert über das Netzwerk mit dem Server, führt mount.nfs aus und schreibt in /etc/fstab. ProxMenux installiert nfs-common, hilft beim Auffinden von Servern und Exporten und setzt sichere Starteinstellungen.",
+    "section": "Speicher und Freigaben · LXC"
+  },
+  "privReq": {
+    "title": "Privilegierter Container erforderlich",
+    "body": "Der Kernel-<code>mount.nfs</code>-Client benötigt Funktionen (mindestens <code>SYS_ADMIN</code>), die nicht privilegierte LXC-Container nicht bereitstellen. Das Skript erzwingt dies - es fordert Sie auf, einen CT auszuwählen, und <strong>bricht bei unprivilegierten CTs ab</strong>. Wenn Sie die Freigabe in einem unprivilegierten CT benötigen, montieren Sie sie zuerst auf dem Proxmox-Host (mit <hostNfsLink>NFS-Freigabe als Proxmox-Speicher</hostNfsLink>) und binden Sie sie mit dem <mountLink>LXC-Mount-Manager</mountLink> in den CT ein."
+  },
+  "what": {
+    "heading": "Was das macht",
+    "body": "Im Gegensatz zum LXC Mount Manager, der den CT dazu bringt, etwas <em>via</em> im Proxmox-Host zu sehen, gibt dieses Skript dem Container seinen <strong>eigenen NFS-Client</strong>: Er spricht NFS über das Netzwerk, mountet Shares direkt vom NFS-Server und speichert das Mount im <code>/etc/fstab</code> des Containers. Der Proxmox-Host befindet sich nicht im Datenpfad.",
+    "diagramServerLabel": "NFS-Server",
+    "diagramServerDetail": "/export/data",
+    "diagramHostLabel": "Proxmox-Host",
+    "diagramHostDetail": "(nur eine\nNetzwerkbrücke)",
+    "diagramCtLabel": "LXC (privilegiert)",
+    "diagramCtDetail": "/mnt/data\nmount.nfs im CT",
+    "diagramArrow": "NFS",
+    "twoWaysTitle": "Zwei Möglichkeiten, einem CT NFS Zugang zu gewähren - wählen Sie einen",
+    "twoWaysBind": "<strong>Bind-Mount über den Host</strong> (<mountLink>LXC Mount Manager</mountLink>): Der Host bindet die NFS-Freigabe einmal ein; jeder CT erhält denselben Pfad als Bind-Mount. Funktioniert mit unprivilegierten CTs und empfiehlt sich, wenn mehrere CTs dieselbe Freigabe benötigen.",
+    "twoWaysDirect": "<strong>Direct NFS Mount im CT</strong> (diese Seite): Der CT montiert den NFS selbst. Erfordert Privilegien. Nützlich, wenn der CT seine Verbindung / Anmeldeinformationen besitzen muss, oder für Setups, bei denen jeder CT mit einem anderen Server spricht."
+  },
+  "opening": {
+    "heading": "Öffnen des Tools",
+    "body": "Öffnen Sie im Hauptmenü von ProxMenux <strong>Storage &amp; Share Manager → NFS-Client in LXC (nur privilegiert)</strong> konfigurieren. ProxMenux fordert Sie zuerst auf, <strong> das Ziel CT</strong> auszuwählen (und startet es, wenn es gestoppt wird); abbricht, wenn es nicht privilegiert ist. Sobald das CT ausgewählt ist, sehen Sie dieses sub-Menü:",
+    "imageAlt": "NFS Client-Manager-Menü — Mount / View / Unmount / Testverbindung"
+  },
+  "howRuns": {
+    "heading": "Wie das Skript läuft (Mount Flow)"
+  },
+  "fstabFlags": {
+    "heading": "Warum diese Fstab Flags",
+    "intro": "Für permanente Mounts fügt das Skript drei Flags hinzu, die über die Standard-NFS-Optionen hinausgehen: <code>_netdev,x-systemd.automount,noauto</code>. Jeder löst ein echtes Boot-Time-Problem:",
+    "headerFlag": "Flagge",
+    "headerEffect": "Was es tut",
+    "rows": [
+      {
+        "flag": "_netdev",
+        "effect": "Sagt dem init-system, dass dieses mount das netzwerk benötigt. Boot blockiert nicht das Warten darauf, bevor das Netzwerk aufgebaut ist."
+      },
+      {
+        "flag": "x-systemd.automount",
+        "effectRich": "Erstellt eine automatische systemd-Einheit: Die Mount erfolgt nur beim ersten Zugriff auf <code>/mnt/&lt;path&gt;</code>. NFS-Server, der beim Booten nicht erreichbar ist, stoppt den CT nicht."
+      },
+      {
+        "flag": "noauto",
+        "effect": "Überspringt das sofortige Einhängen beim Booten. Zusammen mit der Automount-Einheit wird der Mount erst beim ersten Zugriff eingerichtet."
+      }
+    ],
+    "netEffectTitle": "Nettoeffekt",
+    "netEffectBody": "Das NFS-Dateisystem wird beim <em>ersten Zugriff</em> eingehängt statt sofort beim Booten. Ist der Server offline, kann dieser Zugriff warten oder fehlschlagen; davon abhängige Dienste können betroffen sein. Automount verringert die Abhängigkeit beim Booten, garantiert aber nicht, dass alle CT-Dienste von einem NFS-Ausfall unberührt bleiben."
+  },
+  "manual": {
+    "heading": "Manuelles Äquivalent",
+    "body": "Replizieren Sie den gesamten Ablauf per Hand – jeder Befehl führt <strong> im CT</strong> über <code>pct exec &lt;ctid&gt; --</code> oder direkt über <code>pct enter &lt;ctid&gt;</code> aus:"
+  },
+  "view": {
+    "heading": "Aktuelle Mounts anzeigen",
+    "body": "Listet jeden NFS-Montagepunkt auf, der innerhalb des CT (<code>mount | grep nfs</code>) aktiv ist, sowie jede NFS-Linie im <code>/etc/fstab</code> des CT. Für jeden fstab-eintrag wird der live-mount-status angezeigt - nützlich, um permanente mounts zu erkennen, die beim booten nicht aufgekommen sind."
+  },
+  "unmount": {
+    "heading": "NFS-Freigabe aushängen",
+    "body": "Kombiniert die Live-Mounts und die fstab-Einträge in einer Liste, lässt Sie einen auswählen und <strong>entfernt die entsprechende Zeile aus <code>/etc/fstab</code></strong>. Das Skript führt <em>nicht</em> <code>umount</code> auf dem Live-Mount aus – stattdessen teilt es Ihnen mit, dass ein CT Neustart erforderlich ist, damit das Unmounten wirksam wird.",
+    "warnTitle": "Das Skript entfernt fstab-Einträge, nicht Live-Mounts",
+    "warnBody": "Dies ist eine bewusste Entscheidung: <code>umount</code> schlägt bei einem noch verwendeten Mount mit „device busy“ fehl, wenn ein Prozess im CT darauf zugreift. Ohne den fstab-Eintrag wird der Mount beim nächsten CT-Start nicht erneut eingerichtet. Soll er <em>sofort</em> verschwinden und sind Sie sicher, dass nichts mehr darauf zugreift, führen Sie nach Abschluss des Skripts <code>pct exec &lt;ctid&gt; -- umount /mnt/&lt;path&gt;</code> manuell aus."
+  },
+  "test": {
+    "heading": "NFS-Verbindung testen",
+    "body": "Diagnose im CT: Prüft, ob <code>nfs-common</code> installiert ist und <code>rpcbind</code> läuft, und listet die aktuellen NFS-Mounts auf. Anschließend wird für jeden in fstab eingetragenen NFS-Server die Folge Ping → Port 2049 → <code>showmount -e</code> geprüft. Ein sinnvoller erster Schritt, wenn ein dauerhafter Mount nicht verfügbar wird."
+  },
+  "troubleshoot": {
+    "heading": "Fehlerbehebung",
+    "privTitle": "Privilegierter Container erforderlich (Skript bricht ab)",
+    "privBody": "Der ausgewählte CT ist unprivilegiert. Der Kernel-NFS-Client benötigt <code>SYS_ADMIN</code>-Fähigkeiten, die nicht privilegierte CTs nicht aussetzen. Entweder konvertieren Sie die CT in privilegierte (die Konvertierung von Disk Manager &amp; ist auf der <importLink>Import Disk in LXC</importLink> Seite dokumentiert) oder verwenden Sie den alternativen Pfad, der in der Warnung oben auf dieser Seite beschrieben ist.",
+    "aptTitle": "apt-get install nfs-common fails",
+    "aptIntro": "Das Skript nimmt eine Debian-Familie CT (<code>apt-get</code>) an. Wenn der CT Alpine / Arch / Rocky / Alma läuft, schlägt der Installationsschritt lautlos fehl. Installieren Sie den NFS-Client von Hand für diese Distribution:",
+    "aptItems": [
+      "Alpine: <code>apk add nfs-utils</code>",
+      "Arch: <code>pacman -S nfs-utils</code>",
+      "Rocky / Alma: <code>dnf install nfs-utils</code>"
+    ],
+    "aptOutro": "Führen Sie dann das ProxMenux-Skript erneut aus - der Installationsschritt überspringt, wenn die Tools bereits vorhanden sind.",
+    "portTitle": "\"NFS port (2049) is not accessible\"",
+    "portBody": "Ping war erfolgreich, aber <code>nc -z &lt;server&gt; 2049</code> scheiterte innerhalb des CT. Überprüfen Sie, ob der NFS-Dienst auf dem Server ausgeführt wird, ob die Firewall 2049 aus dem Netzwerk des CT zulässt und ob der CT tatsächlich eine gültige Netzwerkroute hat (probieren Sie <code>pct exec &lt;ctid&gt; -- ip route</code>).",
+    "bootTitle": "Permanent Mount gelingt, kommt aber nicht beim Booten",
+    "bootBody": "Fast immer einer von: Das Netzwerk ist nicht bereit, wenn die CT-Mounts (die <code>_netdev,x-systemd.automount,noauto</code>-Flags des Skripts beheben dies - fügen Sie das Mount über das Skript erneut hinzu, wenn Sie die Fstab-Zeile von Hand ohne diese geschrieben haben), der Server ist beim Booten nicht erreichbar (Auto-Mount wartet auf den ersten Zugriff - das ist normal), oder DNS ist beim Booten ungelöst (verwenden Sie die IP des Servers, nicht seinen Hostnamen).",
+    "squashTitle": "Server Squashes root, kein Schreibzugriff von innen CT",
+    "squashIntro": "Der NFS-Export verwendet <code>root_squash</code> (Standard) und der CT schreibt als root. Zwei Optionen:",
+    "squashItems": [
+      "Server-Seite: Ändern Sie den Export in <code>no_root_squash</code> (nur wenn Sie dem CT vertrauen).",
+      "CT-Seite: Schreiben Sie als Nicht-Root-Benutzer, den der Server akzeptiert, oder chownen Sie die Freigabe entsprechend."
+    ],
+    "squashOutro": "ProxMenux kann dies nicht beheben - es ist eine Serverrichtlinie."
+  },
+  "related": {
+    "heading": "Verwandte Themen",
+    "items": [
+      {
+        "href": "/docs/storage-share/lxc-mount-points",
+        "label": "LXC-Einhängepunkte (Host ↔ Container)",
+        "tail": "— die Alternative für unprivilegierte CTs: mount on host, bind in CT."
+      },
+      {
+        "href": "/docs/storage-share/lxc-samba-client",
+        "label": "Samba-Client in LXC",
+        "tail": " — verwandte Seite mit demselben Ablauf für SMB-/CIFS-Freigaben."
+      },
+      {
+        "href": "/docs/storage-share/lxc-nfs-server",
+        "label": "NFS Server in LXC",
+        "tailRich": " — die umgekehrte Richtung: Ordner <em>aus</em> einem CT über NFS freigeben."
+      },
+      {
+        "href": "/docs/storage-share/host-nfs",
+        "label": "NFS-Freigabe als Proxmox-Speicher",
+        "tail": " — die Freigabe direkt in Proxmox statt in einem einzelnen CT registrieren."
+      }
+    ]
+  }
+}
diff --git a/web/messages/de/docs/storage-share/lxc-nfs-server.json b/web/messages/de/docs/storage-share/lxc-nfs-server.json
new file mode 100644
index 00000000..f8502283
--- /dev/null
+++ b/web/messages/de/docs/storage-share/lxc-nfs-server.json
@@ -0,0 +1,159 @@
+{
+  "meta": {
+    "title": "NFS Server in LXC | ProxMenux Dokumentation",
+    "description": "Ordner über NFS aus einem Proxmox-LXC-Container mit ProxMenux freigeben. Installiert nfs-kernel-server automatisch, richtet die gemeinsame Gruppe sharedfiles und /etc/exports ein und bietet Netzwerk-ACLs sowie vollständige Deinstallation. Erfordert einen privilegierten Container.",
+    "ogTitle": "NFS Server in LXC | ProxMenux Dokumentation",
+    "ogDescription": "Führen Sie einen NFS-Server in einem privilegierten LXC-Container aus. Universelle Sharedfiles-Gruppe, Netzwerk-ACL und vollständige Deinstallation."
+  },
+  "header": {
+    "title": "NFS Server in LXC",
+    "description": "Betreiben Sie einen NFS-Kernel-Server in einem Proxmox-LXC-Container und geben Sie Ordner für andere Rechner im Netzwerk frei. ProxMenux installiert nfs-kernel-server, richtet die gemeinsame Gruppe sharedfiles ein, damit mehrere privilegierte CTs Dateien gemeinsam nutzen können, verwaltet /etc/exports und bietet eine vollständige Deinstallation.",
+    "section": "Speicher und Freigaben · LXC"
+  },
+  "privReq": {
+    "title": "Privilegierter Container erforderlich",
+    "body": "<code>nfs-kernel-server</code> muss das Kernel-Dateisystem <code>nfsd</code> unter <code>/proc/fs/nfsd</code> einhängen. Dafür benötigt es <code>CAP_SYS_ADMIN</code> im Namensraum des Host-Kernels, nicht nur im Benutzer-Namensraum des Containers. Unprivilegierte LXC-Container besitzen diese Fähigkeit nicht: <code>rpc.nfsd: Unable to access /proc/fs/nfsd errno 2 (No such file or directory)</code>; systemd markiert <code>nfs-server.service</code> mit einem Abhängigkeitsfehler. Das Skript verlangt daher einen privilegierten CT und <strong>bricht bei unprivilegierten CTs ab</strong>. Alternativ kann der NFS-Server in einer VM laufen."
+  },
+  "what": {
+    "heading": "Was das macht",
+    "body": "Dies ist die umgekehrte Richtung zur <em>NFS-Client-Seite</em>: Der CT wird zum <strong>NFS-Server</strong> und stellt einen eigenen Ordner anderen CTs, dem Proxmox-Host, VMs oder physischen Rechnern bereit.",
+    "diagramServerLabel": "LXC (privilegiert) — NFS-Server",
+    "diagramServerDetail": "/mnt/data\n(freigegebener Ordner)\n\nchown root:sharedfiles\nchmod 2775 (SGID)\n\nnfs-kernel-server\n+ rpcbind läuft",
+    "diagramClientLabel": "Jeder Client im Netzwerk",
+    "diagramClientDetail": "einem anderen CT, dem Host,\nVM, eine physische Maschine...",
+    "diagramArrow": "NFS-Export"
+  },
+  "shared": {
+    "heading": "Die \"sharedfiles\" Gruppenkonvention",
+    "body": "Vor dem Exportieren des Ordners erstellt ProxMenux eine Gruppe namens <code>sharedfiles</code> mit <strong>GID 101000</strong> im Container, fügt jeden regulären Benutzer hinzu und setzt dann das Exportverzeichnis mit dem Modus <code>2775</code> auf <code>root:sharedfiles</code>. Das <code>2</code> an der Vorderseite ist das SGID-Bit - jede Datei oder jeder Ordner, der im Inneren erstellt wird, erbt automatisch die <code>sharedfiles</code>-Gruppe.",
+    "gidTitle": "Warum GID 101000 speziell",
+    "gidBody": "Mit der standardmäßigen LXC-ID-Zuordnung (+100000) erscheint Host-GID 101000 als GID <strong>1000</strong> in einem unprivilegierten CT. Dieser Serverablauf verwendet einen <strong>privilegierten</strong> CT ohne Verschiebung. Zwei privilegierte CTs mit <code>sharedfiles</code> bei GID 101000 verwenden daher dieselbe numerische Gruppen-ID.",
+    "remapTitle": "Die alte Erstellung von „remap_*“-Benutzern wird bei privilegierten CTs übersprungen",
+    "remapBody": "Der alte Zweig für unprivilegierte CTs würde <code>remap_&lt;uid&gt;</code>-Benutzer mit UID <code>&lt;uid&gt; + 100000</code> in <code>sharedfiles</code> für normale Benutzer und übliche UIDs (33, 1000, 1001, 1002) anlegen. Diese <code>+100000</code>-Verschiebung gilt nicht für die hier vorgeschriebenen <strong>privilegierten</strong> CTs; deshalb überspringt das Skript diesen Zweig. Fehlende <code>remap_*</code>-Konten in <code>getent passwd</code> sind zu erwarten und kein Fehler."
+  },
+  "defaults": {
+    "heading": "Standard-Exportoptionen - lesen Sie dies zuerst",
+    "warnTitle": "Standardoptionen umfassen no_root_squash",
+    "warnBody": "ProxMenux verwendet standardmäßig <code>rw,sync,no_subtree_check,'<'strong'>'no_root_squash'<'/strong'>'</code>. <strong>Jeder Client-Benutzer root kann auf dem Export als root schreiben.</strong> Verwenden Sie dies nur in einem vertrauenswürdigen Heimnetz. Ist der CT aus einem nicht vertrauenswürdigen Netzwerk erreichbar (VPS oder fremdes VLAN), <strong>ersetzen Sie die Exportoption im Dialog für eigene Optionen durch <code>root_squash</code></strong>."
+  },
+  "opening": {
+    "heading": "Öffnen des Tools",
+    "body": "Öffnen Sie im Hauptmenü von ProxMenux <strong>Storage &amp; Share Manager → NFS-Server in LXC (nur privilegiert)</strong> konfigurieren. ProxMenux fordert Sie zuerst auf, das Ziel CT auszuwählen (und startet es, wenn es gestoppt wird); abbricht, wenn es nicht privilegiert ist. Sobald das CT ausgewählt ist, sehen Sie dieses sub-Menü mit fünf Optionen:",
+    "imageAlt": "NFS Server-Manager-Menü – Erstellen / Ansicht / Löschen / Status / Deinstallieren"
+  },
+  "howRuns": {
+    "heading": "Wie das Skript läuft (Create flow)"
+  },
+  "network": {
+    "heading": "Netzwerk-ACL — wer darf einhängen?",
+    "intro": "<code>/etc/exports</code> filtert, welche Clients den Export einhängen dürfen. Der Dialog bietet drei Möglichkeiten:",
+    "headerMode": "Modus",
+    "headerValue": "Wert geschrieben an /etc/exports",
+    "headerWhen": "Wann man es wählt",
+    "rows": [
+      {
+        "mode": "Lokales Netz",
+        "value": "192.168.0.0/16",
+        "whenRich": "Für übliche Heim- und SOHO-Netzwerke. Deckt alle Adressen unter <code>192.168.*.*</code> ab."
+      },
+      {
+        "mode": "Eigenes Subnetz",
+        "value": "Ein beliebiges CIDR-Subnetz (z. B. 10.0.0.0/24)",
+        "when": "Wenn sich Ihr LAN nicht in 192.168.x.x befindet oder Sie einen engeren Umfang wünschen."
+      },
+      {
+        "mode": "Einzelner Host",
+        "value": "Die IP-Adresse eines einzelnen Clients (z. B. 192.168.1.50)",
+        "when": "Nur eine bestimmte Maschine sollte montieren. Am restriktivsten."
+      }
+    ]
+  },
+  "options": {
+    "heading": "Exportoptionen",
+    "headerOption": "Option",
+    "headerEffect": "Was es tut",
+    "rows": [
+      {
+        "option": "rw / ro",
+        "effect": "Ermöglichen Sie Lese-Schreib- oder Lesezugriff für Verbindungsclients."
+      },
+      {
+        "option": "sync",
+        "effectRich": "Bestätigt Schreibanforderungen erst, wenn die Daten auf dem Datenträger liegen. Sicherer als <code>async</code>, aber mit geringerem Durchsatz."
+      },
+      {
+        "option": "no_subtree_check",
+        "effect": "Überspringt die Prüfung bei jeder Anfrage, ob die Datei noch im exportierten Teilbaum liegt. Das ist schneller und vermeidet Probleme, wenn Dateien während des Zugriffs umbenannt werden."
+      },
+      {
+        "option": "no_root_squash",
+        "effectRich": "<strong>Root auf dem Client vertrauen.</strong> Ein als root zugreifender Client schreibt auf dem Server als root. Geeignet für vertrauenswürdige LANs, etwa wenn Sicherungswerkzeuge die Eigentümer erhalten müssen. Ersetzen Sie dies durch <code>root_squash</code>, wenn Sie nicht jedem Rechner in der Netzwerk-ACL vollständig vertrauen."
+      }
+    ]
+  },
+  "manual": {
+    "heading": "Manuelles Äquivalent",
+    "body": "Führen Sie den gesamten Ablauf von Hand aus. Jeder Befehl läuft <strong>innerhalb des CTs</strong> über <code>pct exec &lt;ctid&gt; --</code> oder <code>pct enter &lt;ctid&gt;</code>:"
+  },
+  "view": {
+    "heading": "Aktuelle Exporte ansehen",
+    "body": "Zeigt <code>/etc/exports</code> aus dem CT ohne Kommentare und Leerzeilen an. Jeder Export wird mit Netzwerk-ACL und Optionen ausgegeben. Damit lässt sich vor der Weitergabe der CT-IP prüfen, welche Ordner freigegeben sind."
+  },
+  "delete": {
+    "heading": "Einen Export löschen",
+    "body": "Listet jede Zeile in <code>/etc/exports</code> zur Auswahl auf, entfernt die ausgewählte (<code>sed -i</code>), führt <code>exportfs -ra</code> aus und startet <code>nfs-kernel-server</code> neu. Der Ordner selbst und sein Inhalt bleiben intakt."
+  },
+  "status": {
+    "heading": "NFS-Status überprüfen",
+    "body": "Diagnosepass: bestätigt, dass <code>nfs-kernel-server</code> und <code>rpcbind</code> installiert und aktiv sind, druckt <code>exportfs -v</code>-Ausgabe, listet aktive NFS-Sitzungen (<code>showmount -a</code>) und aktuelle Clientverbindungen auf."
+  },
+  "uninstall": {
+    "heading": "NFS-Server deinstallieren",
+    "body": "Vollständige Bereinigung nach Bestätigung: stoppt und deaktiviert <code>nfs-kernel-server</code> und <code>rpcbind</code>, leert <code>/etc/exports</code>, entfernt die NFS-Pakete mit <code>apt-get purge</code>, löscht die Gruppe <code>sharedfiles</code> und die Benutzer <code>remap_*</code> und beendet verbleibende Prozesse. Die <strong>exportierten Ordner selbst bleiben erhalten</strong>; entfernt werden nur NFS-Konfiguration und Pakete.",
+    "warnTitle": "Das Skript stoppt an der Exportlinie, nicht an den Daten",
+    "warnBody": "Sowohl <em>Export löschen</em> als auch <em>NFS-Server deinstallieren</em> entfernen die Exportkonfiguration. Die Daten im freigegebenen Ordner bleiben erhalten. Löschen Sie Daten bei Bedarf nach Abschluss des Skripts ausdrücklich mit <code>rm -rf</code>; sichern Sie sie vorher, falls jemand sie noch benötigen könnte."
+  },
+  "troubleshoot": {
+    "heading": "Fehlerbehebung",
+    "privTitle": "Privilegierter Container erforderlich (Skript bricht ab)",
+    "privBody": "Der ausgewählte CT ist unprivilegiert. <code>nfs-kernel-server</code> kann dort nicht starten, da die Einhängen von <code>/proc/fs/nfsd</code> <code>CAP_SYS_ADMIN</code> im Host-Kernel-Namespace benötigt und das <code>nfsd</code>-Modul auch nicht dem Namespace des Containers ausgesetzt ist (<code>modprobe nfsd</code> von innen gibt <code>FATAL: Module nfsd not found</code>). Wenn Sie das Gate umgehen, sehen Sie <code>rpc.nfsd: Unable to access /proc/fs/nfsd errno 2 (No such file or directory)</code> im Journal und keine NFS-Ports werden jemals geöffnet. Die einzigen praktikablen Optionen sind: Wandeln Sie den CT in einen privilegierten CT um oder verschieben Sie den NFS-Server in eine VM.",
+    "aptTitle": "apt-get install schlägt fehl",
+    "aptIntro": "Das Skript nimmt eine Debian-Familie CT an. Auf Alpine / Arch / Rocky / Alma installieren Sie die NFS-Serverpakete von Hand:",
+    "aptItems": [
+      "Alpine: <code>apk add nfs-utils</code>",
+      "Arch: <code>pacman -S nfs-utils</code>",
+      "Rocky / Alma: <code>dnf install nfs-utils</code>"
+    ],
+    "aptOutro": "Führen Sie danach das ProxMenux-Skript erneut aus; sind die Werkzeuge schon vorhanden, wird die Installation übersprungen.",
+    "aclTitle": "Client kann nicht mounten: \"Zugriff verweigert durch Server\"",
+    "aclBody": "Die Client-IP liegt außerhalb der konfigurierten Netzwerk-ACL. Erstellen Sie den Export mit einem größeren Subnetz neu oder fügen Sie die genaue Client-IP hinzu. Häufige Ursache: Hinter Router-NAT kann der Client mit der WAN-IP des Routers statt seiner LAN-IP erscheinen. Prüfen Sie dies auf dem Server mit <code>tcpdump -n port 2049</code>.",
+    "ownTitle": "Vom Client geschriebene Dateien erscheinen mit seltsamem Besitz auf dem Server",
+    "ownIntro": "Zwei Möglichkeiten:",
+    "ownItems": [
+      "Mit <code>no_root_squash</code> (Standard) schreibt Client root als root auf den Server. Dateien gehören <code>root:sharedfiles</code> dank der SGID im Ordner.",
+      "Nicht-Root-Client-Benutzer schreiben als ihre eigene UID / GID. Wenn ihre UID nicht auf dem Server existiert, erscheinen Dateien mit Rohnummern (z.B. <code>1234:1234</code>). Verwenden Sie die <code>sharedfiles</code>-Gruppe auch auf dem Client oder richten Sie UIDs auf den Systemen aus, die Dateien gemeinsam nutzen."
+    ],
+    "noShowTitle": "Server erreichbar, aber showmount gibt nichts zurück",
+    "noShowBody": "Nach dem Bearbeiten von <code>/etc/exports</code> müssen Sie die Exporttabelle mit <code>exportfs -ra</code> neu laden und <code>nfs-kernel-server</code> neu starten – das Skript macht beides, aber wenn Sie die Datei von Hand bearbeitet haben, tun Sie es selbst. Bestätigen Sie auch, dass die Firewall auf dem CT (und auf dem Proxmox-Host) TCP/UDP 2049 und den rpcbind-Port (111) ermöglicht."
+  },
+  "related": {
+    "heading": "Verwandte Themen",
+    "items": [
+      {
+        "href": "/docs/storage-share/lxc-nfs-client",
+        "label": "NFS-Client in LXC",
+        "tail": " — umgekehrte Richtung: externe NFS-Freigaben im CT einhängen."
+      },
+      {
+        "href": "/docs/storage-share/lxc-samba-server",
+        "label": "Samba-Server in LXC",
+        "tail": "— Geschwisterseite, gleiches Muster mit SMB / CIFS anstelle von NFS."
+      },
+      {
+        "href": "/docs/storage-share/host-nfs",
+        "label": "NFS-Freigabe als Proxmox-Speicher",
+        "tailRich": " — Sobald der CT Ordner über NFS freigibt, registrieren Sie die NFS-Freigabe in Proxmox, damit sie unter <em>Datacenter → Storage</em> erscheint."
+      }
+    ]
+  }
+}
diff --git a/web/messages/de/docs/storage-share/lxc-samba-client.json b/web/messages/de/docs/storage-share/lxc-samba-client.json
new file mode 100644
index 00000000..26643413
--- /dev/null
+++ b/web/messages/de/docs/storage-share/lxc-samba-client.json
@@ -0,0 +1,155 @@
+{
+  "meta": {
+    "title": "Samba-Client in LXC | ProxMenux Dokumentation",
+    "description": "Samba-/CIFS-Freigaben direkt in einem Proxmox-LXC-Container mit ProxMenux einhängen. Installiert cifs-utils und smbclient automatisch, unterstützt Erkennung im Netzwerk, geschützte Zugangsdaten und dauerhafte Mounts über /etc/fstab. Erfordert einen privilegierten Container.",
+    "ogTitle": "Samba-Client in LXC | ProxMenux Dokumentation",
+    "ogDescription": "Samba-/CIFS-Freigaben in einem privilegierten LXC einhängen. Automatische Erkennung, geschützte Zugangsdaten-Datei und dauerhafte Einträge in /etc/fstab."
+  },
+  "header": {
+    "title": "Samba-Client in LXC",
+    "description": "Samba-Freigaben (SMB/CIFS) direkt in einem Proxmox-LXC-Container einhängen. Der Container wird zu einem echten CIFS-Client - spricht mit dem Samba-Server über das Netzwerk, führt mount.cifs aus, speichert Anmeldeinformationen sicher und schreibt an /etc/fstab. ProxMenux installiert cifs-utils + smbclient für Sie und validiert Anmeldeinformationen gegen den Server vor der Montage.",
+    "section": "Speicher und Freigaben · LXC"
+  },
+  "privReq": {
+    "title": "Privilegierter Container erforderlich",
+    "body": "Der Kernel-<code>mount.cifs</code>-Client benötigt Funktionen (mindestens <code>SYS_ADMIN</code>), die nicht privilegierte LXC-Container nicht bereitstellen. Das Skript erzwingt dies - es fordert Sie auf, einen CT auszuwählen, und <strong>bricht bei unprivilegierten CTs ab</strong>. Wenn Sie die Freigabe in einem unprivilegierten CT benötigen, montieren Sie sie zuerst auf dem Proxmox-Host (mit <hostSambaLink>Samba / CIFS-Freigabe als Proxmox-Speicher</hostSambaLink>) und binden Sie sie mit dem <mountLink>LXC-Mount-Manager</mountLink> in den CT ein."
+  },
+  "what": {
+    "heading": "Was das macht",
+    "body": "Der Container spricht CIFS über das Netzwerk und montiert die Freigabe selbstständig. Der Proxmox-Host ist nur die Netzwerkbrücke - er sieht oder verwaltet das Mount nicht.",
+    "diagramServerLabel": "Samba-Server",
+    "diagramServerDetail": "//srv/share",
+    "diagramHostLabel": "Proxmox-Host",
+    "diagramHostDetail": "(nur eine\nNetzwerkbrücke)",
+    "diagramCtLabel": "LXC (privilegiert)",
+    "diagramCtDetail": "/mnt/share\nmount.cifs im CT",
+    "diagramArrow": "CIFS",
+    "twoWaysTitle": "Zwei Möglichkeiten, einem CT einen Samba-Anteil zu geben - wählen Sie einen",
+    "twoWaysBind": "<strong>Bind-Mount über den Host</strong> (<mountLink>LXC Mount Manager</mountLink>): Der Host bindet die CIFS-Freigabe einmal ein; jeder CT erhält denselben Pfad als Bind-Mount. Funktioniert mit unprivilegierten CTs und empfiehlt sich, wenn mehrere CTs dieselbe Freigabe benötigen.",
+    "twoWaysDirect": "<strong>Direkte CIFS-Montage im CT</strong> (diese Seite): Der CT montiert das CIFS selbst. Erfordert Privilegien. Nützlich, wenn der CT seine eigenen Anmeldeinformationen besitzen muss oder wenn jeder CT mit einem anderen Server spricht."
+  },
+  "opening": {
+    "heading": "Öffnen des Tools",
+    "body": "Öffnen Sie im Hauptmenü von ProxMenux <strong>Storage &amp; Share Manager → Samba-Client in LXC (nur privilegiert)</strong> konfigurieren. ProxMenux fordert Sie zuerst auf, <strong> das Ziel CT</strong> auszuwählen (und startet es, wenn es gestoppt wird); abbricht, wenn es nicht privilegiert ist. Sobald das CT ausgewählt ist, sehen Sie dieses sub-Menü:",
+    "imageAlt": "Menü Samba Client Manager — Mount / View / Unmount / Test Connectivity"
+  },
+  "howRuns": {
+    "heading": "Wie das Skript läuft (Mount Flow)"
+  },
+  "creds": {
+    "heading": "Wo sich das Passwort befindet",
+    "body": "ProxMenux <strong>schreibt das Passwort nicht in den Mount-Befehl</strong> oder in <code>/etc/fstab</code>. Stattdessen wird eine Zugangsdaten-Datei im CT angelegt. Sie enthält Klartext-Zugangsdaten mit Nur-Root-Berechtigungen und ist nicht verschlüsselt:",
+    "whyTitle": "Warum eine separate Datei statt fstab",
+    "whyBody": "Das CIFS-Modul akzeptiert <code>username=</code> / <code>password=</code> Optionen inline in fstab, aber jeder, der <code>/etc/fstab</code> lesen kann, sieht das Passwort klar. Wenn Sie Anmeldeinformationen in eine Root-only-Datei einfügen und darauf zeigen (<code>credentials=</code>), wird das Passwort aus der weltlesbaren Konfiguration ausgeschlossen."
+  },
+  "options": {
+    "heading": "Mount Optionen erklärt",
+    "headerOption": "Option",
+    "headerEffect": "Was es tut",
+    "rows": [
+      {
+        "option": "rw / ro",
+        "effect": "Read-Write- oder Read-Only-Modus für das gesamte Mount."
+      },
+      {
+        "option": "file_mode=0664",
+        "effect": "Berechtigungen für Dateien gemeldet über CIFS. Default lässt owner+group schreiben, andere lesen."
+      },
+      {
+        "option": "dir_mode=0775",
+        "effect": "Gemeldete Verzeichnisrechte. Standardmäßig dürfen Eigentümer und Gruppe das Verzeichnis betreten und Inhalte erstellen; andere dürfen es durchqueren."
+      },
+      {
+        "option": "iocharset=utf8",
+        "effect": "Erzwingen Sie UTF-8 für Dateinamen, die über den Draht kommen. Vermeidet Mojibake auf Nicht-ASCII-Namen."
+      },
+      {
+        "option": "credentials=file",
+        "effect": "Lesen Sie Benutzername / Passwort aus der Datei (automatisch für Benutzer auth hinzugefügt)."
+      },
+      {
+        "option": "guest",
+        "effect": "Authentifizierung als Gast, keine Anmeldeinformationen erforderlich (automatisch hinzugefügt, wenn der Gast ausgewählt wird)."
+      },
+      {
+        "option": "_netdev",
+        "effect": "Sagt dem init-system, dass dieses mount das netzwerk benötigt. Boot blockiert nicht das Warten darauf."
+      },
+      {
+        "option": "x-systemd.automount",
+        "effect": "Lazy Mount: nur Mounts beim ersten Zugriff. CIFS-Server, der beim Booten nicht erreichbar ist, stoppt den CT nicht."
+      },
+      {
+        "option": "noauto",
+        "effect": "Überspringt das sofortige Einhängen beim Booten. Die Automount-Einheit richtet den Mount erst beim ersten Zugriff ein."
+      }
+    ],
+    "netEffectTitle": "Nettoeffekt der Fstab Flags",
+    "netEffectBody": "Das CIFS-Dateisystem wird beim <em>ersten Zugriff</em> eingehängt statt sofort beim Booten. Ist der Server offline, kann dieser Zugriff warten oder fehlschlagen; davon abhängige Dienste können betroffen sein. Automount verringert die Abhängigkeit beim Booten, garantiert aber nicht, dass alle CT-Dienste von einem CIFS-Ausfall unberührt bleiben."
+  },
+  "manual": {
+    "heading": "Manuelles Äquivalent",
+    "body": "Replizieren Sie den gesamten Ablauf per Hand – jeder Befehl führt <strong> im CT</strong> über <code>pct exec &lt;ctid&gt; --</code> oder direkt über <code>pct enter &lt;ctid&gt;</code> aus:",
+    "guestIntro": "Gastvariante — keine Anmeldedatendatei erforderlich:"
+  },
+  "view": {
+    "heading": "Aktuelle Mounts anzeigen",
+    "body": "Listet jeden CIFS-Einhängepunkt auf, der innerhalb des CT (<code>mount -t cifs</code>) aktiv ist, sowie jede CIFS-Linie im <code>/etc/fstab</code> des CT. Für jeden fstab-eintrag wird der live-mount-status angezeigt - nützlich, um permanente mounts zu erkennen, die beim boot nicht aufgekommen sind."
+  },
+  "unmount": {
+    "heading": "Samba-Freigabe aushängen",
+    "body": "Fasst aktive Mounts und fstab-Einträge in einer Auswahlliste zusammen. Für den gewählten Eintrag <strong>wird die entsprechende Zeile aus <code>/etc/fstab</code> entfernt</strong>, zusammen mit der zugehörigen Datei mit Zugangsdaten. Das Skript führt kein <code>umount</code> auf dem aktiven Mount aus, sondern weist darauf hin, dass zum Aushängen ein CT-Neustart nötig ist.",
+    "warnTitle": "Das Skript entfernt fstab-Einträge, nicht Live-Mounts",
+    "warnBody": "Gleiches Design wie der NFS-Client: <code>umount</code> auf einem belegten Mount schlägt mit \"Device Besetzt\" fehl. Das Entfernen des Fstab-Eingangs garantiert, dass die Mount beim nächsten CT-Start sauber verschwindet. Wenn Sie möchten, dass die Mount <em>sofort</em> verschwunden ist, führen Sie <code>pct exec &lt;ctid&gt; -- umount /mnt/&lt;path&gt;</code> nach Abschluss des Skripts von Hand aus."
+  },
+  "test": {
+    "heading": "Samba Konnektivität testen",
+    "body": "Diagnose im CT: Prüft, ob <code>cifs-utils</code> installiert ist, listet aktive CIFS-Mounts auf und prüft für jeden in fstab eingetragenen Server Ping → Ports 139/445 → Freigabenliste als Gast. „Authentifizierung erforderlich“ beim Gasttest ist normal, wenn der Server keine öffentlichen Freigaben anbietet."
+  },
+  "troubleshoot": {
+    "heading": "Fehlerbehebung",
+    "privTitle": "Privilegierter Container erforderlich (Skript bricht ab)",
+    "privBody": "Der ausgewählte CT ist unprivilegiert. Der Kernel-CIFS-Client benötigt <code>SYS_ADMIN</code>-Fähigkeit, die nicht privilegierte CTs nicht aussetzen. Konvertieren Sie entweder den CT in privilegierte oder verwenden Sie den alternativen Pfad, der in der Warnung oben auf dieser Seite beschrieben ist.",
+    "aptTitle": "apt-get install fails",
+    "aptIntro": "Das Skript nimmt eine Debian-Familie CT (<code>apt-get</code>) an. Auf Alpine / Arch / Rocky / Alma installieren Sie den CIFS-Client von Hand:",
+    "aptItems": [
+      "Alpine: <code>apk add cifs-utils samba-client</code>",
+      "Arch: <code>pacman -S cifs-utils smbclient</code>",
+      "Rocky / Alma: <code>dnf install cifs-utils samba-client</code>"
+    ],
+    "aptOutro": "Führen Sie dann das ProxMenux-Skript erneut aus - der Installationsschritt überspringt, wenn die Tools bereits vorhanden sind.",
+    "guestFallbackTitle": "\"Der Server hat Sie als Gast anstelle des angegebenen Benutzers verbunden\"",
+    "guestFallbackBody": "Die aktive Validierung des Skripts hat ein echtes Auth-Problem aufgefangen. Der server akzeptierte die verbindung, degradierte sie jedoch auf gast, weil die anmeldeinformationen falsch sind. Häufige Ursachen: Tippfehler im Benutzernamen oder Passwort, der Benutzer existiert nicht auf dem Server, der Benutzer ist ausgesperrt oder die Arbeitsgruppe / Domäne ist nicht übereinstimmend. Führen Sie den Ablauf erneut aus und geben Sie die Anmeldeinformationen sorgfältig erneut ein (das Passwort ist im Dialog verborgen).",
+    "denyTitle": "\"NT_STATUS_ACCESS_DENIED\" bei der Montage",
+    "denyBody": "Anmeldeinformationen wurden validiert, aber die Freigabe verweigert den Zugang. Überprüfen Sie auf der Serverseite, ob der Benutzer über Berechtigungen für diese bestimmte Freigabe verfügt (die Validierung bestätigt nur die Anmeldung, nicht per-share-ACLs). Überprüfen Sie auch, ob der Server eine bestimmte SMB-Protokollversion benötigt: Fügen Sie <code>vers=3.0</code> (oder <code>2.1</code>, <code>2.0</code>) an die Mount-Optionen an.",
+    "utf8Title": "UTF-8 / Nicht-ASCII-Dateinamen sind verstümmelt",
+    "utf8Body": "Die Standardoptionen umfassen <code>iocharset=utf8</code>, aber einige Serverkonfigurationen melden eine unerwartete Codepage. Wenn Dateinamen mit Akzenten / Symbolen falsch aussehen, versuchen Sie auch <code>nounix</code> (einige Linux-Samba-Server benötigen dies, wenn der Client auch Linux ist) oder setzen Sie die Serverseite auf <code>unix extensions = no</code>.",
+    "bootTitle": "Permanent Mount gelingt, kommt aber nicht beim Booten",
+    "bootBody": "Fast immer eines von: das Netzwerk ist nicht bereit, wenn die CT-Mounts (die <code>_netdev,x-systemd.automount,noauto</code>-Flags des Skripts beheben dies), der Server ist beim Booten nicht erreichbar (Auto-Mount wartet auf den ersten Zugriff - das ist normal), oder DNS ist beim Booten ungelöst (verwenden Sie die IP des Servers, nicht seinen Hostnamen)."
+  },
+  "related": {
+    "heading": "Verwandte Themen",
+    "items": [
+      {
+        "href": "/docs/storage-share/lxc-mount-points",
+        "label": "LXC-Einhängepunkte (Host ↔ Container)",
+        "tail": "— die Alternative für unprivilegierte CTs: mount on host, bind in CT."
+      },
+      {
+        "href": "/docs/storage-share/lxc-nfs-client",
+        "label": "NFS-Client in LXC",
+        "tail": " — verwandte Seite mit demselben Ablauf für NFS-Freigaben."
+      },
+      {
+        "href": "/docs/storage-share/lxc-samba-server",
+        "label": "Samba-Server in LXC",
+        "tailRich": " — die umgekehrte Richtung: Ordner <em>aus</em> einem CT über Samba freigeben."
+      },
+      {
+        "href": "/docs/storage-share/host-samba",
+        "label": "Samba / CIFS als Proxmox-Speicher",
+        "tail": " — die Freigabe direkt in Proxmox statt in einem einzelnen CT registrieren."
+      }
+    ]
+  }
+}
diff --git a/web/messages/de/docs/storage-share/lxc-samba-server.json b/web/messages/de/docs/storage-share/lxc-samba-server.json
new file mode 100644
index 00000000..1e2bd699
--- /dev/null
+++ b/web/messages/de/docs/storage-share/lxc-samba-server.json
@@ -0,0 +1,132 @@
+{
+  "meta": {
+    "title": "Samba-Server in LXC | ProxMenux Dokumentation",
+    "description": "Mit ProxMenux einen Samba-Server (SMB / CIFS) in einem Proxmox-LXC-Container betreiben. Installiert samba automatisch und verwaltet /etc/samba/smb.conf, smbpasswd-Benutzer und die Gruppe sharedfiles für per Bind-Mount eingebundene Ordner. Erfordert einen privilegierten Container.",
+    "ogTitle": "Samba-Server in LXC | ProxMenux Dokumentation",
+    "ogDescription": "Ordner über SMB/CIFS aus einem privilegierten LXC-Container freigeben. Automatische Installation, smbpasswd-Benutzer und an Bind-Mounts angepasste Berechtigungen."
+  },
+  "header": {
+    "title": "Samba-Server in LXC",
+    "description": "Führen Sie einen Samba-Server (SMB / CIFS) in einem Proxmox LXC-Container aus und stellen Sie Ordner Windows / macOS / Linux-Clients im Netzwerk aus. ProxMenux installiert samba, erstellt einen Samba-Benutzer mit smbpasswd, verwaltet /etc/samba/smb.conf und wendet bind-mount-bewusste Berechtigungen an, wenn der freigegebene Ordner vom Host stammt.",
+    "section": "Speicher und Freigaben · LXC"
+  },
+  "privReq": {
+    "title": "Privilegierter Container erforderlich",
+    "body": "Samba nimmt die Identität des verbindenden Benutzers an mit <code>setgroups()</code> auf jeder Baumverbindung (der Moment, in dem ein Client eine Freigabe öffnet). In einem unprivilegierten LXC lehnt der Kernel diesen Syscall ab, weil der Namespace des Containers mit <code>setgroups=deny</code> erstellt wird – und <code>smbd</code> reagiert, indem er den Worker-Prozess mit <code>PANIC: sys_setgroups failed</code> abbricht. Das Ergebnis ist, dass <code>smbd</code> die Ports 139/445 startet und bindet, aber jede Clientverbindung mit <code>NT_STATUS_CONNECTION_DISCONNECTED</code> fehlschlägt. Das Skript erzwingt aus diesem Grund einen privilegierten CT und <strong>bricht bei unprivilegierten CTs ab</strong>. Es gibt keine saubere Lösung auf der Serverseite; Verwenden Sie einen privilegierten CT oder führen Sie Samba in einer VM aus."
+  },
+  "what": {
+    "heading": "Was das macht",
+    "body": "Der Container wird zu einem SMB/CIFS-Server: Er führt <code>smbd</code> aus, stellt einen Ordner über <code>/etc/samba/smb.conf</code> frei und akzeptiert Clientverbindungen an den Ports <code>139</code> / <code>445</code>. Clients sehen die Freigabe unter <code>\\\\&lt;ct-ip&gt;\\&lt;share-name&gt;</code> im Windows Explorer, <code>smb://&lt;ct-ip&gt;/&lt;share-name&gt;</code> im macOS Finder oder über <code>mount.cifs</code> unter Linux.",
+    "diagramServerLabel": "LXC (privilegiert) — Samba-Server",
+    "diagramServerDetail": "/mnt/data\n(freigegebener Ordner)\n\nsmbd + nmbd laufen\n\nBenutzer: <username>\n(via smbpasswd)\n\nErzwungene Gruppe:\nsharedfiles",
+    "diagramClientLabel": "Jeder Client im Netzwerk",
+    "diagramClientDetail": "Windows: \\\\<ip>\\<share>\nmacOS:   smb://<ip>/<share>\nLinux: mount.cifs",
+    "diagramArrow": "SMB / CIFS"
+  },
+  "perms": {
+    "heading": "Zwei Berechtigungspfade abhängig vom Ordnertyp",
+    "body": "Vor dem Hinzufügen der Freigabe zu <code>smb.conf</code> prüft das Skript, ob der Ordner ein <strong>Bind-Mount vom Host</strong> oder ein normaler <strong>lokaler Ordner im CT</strong> ist. Entsprechend setzt es Eigentümer und Berechtigungen:",
+    "headerType": "Art des Ordners",
+    "headerAction": "Was das Skript macht",
+    "bindType": "Bind-Mount vom Host",
+    "bindTypeSubRich": "erfasst über <code>mount</code> Ausgang",
+    "bindActionRich": "Erstellt Gruppe <code>sharedfiles</code> (Standard GID 999, dynamisch, wenn genommen), fügt den Samba-Benutzer hinzu, dann <code>chown root:sharedfiles</code> + <code>chmod 2775</code> (SGID - neue Dateien erben die Gruppe). Wenn der Benutzer immer noch nicht schreiben kann, wendet <code>setfacl -m u:&lt;user&gt;:rwx</code> an.",
+    "localType": "Lokaler Ordner im CT",
+    "localTypeSub": "Kein Bind-Mount erkannt",
+    "localActionRich": "Standardbesitz: <code>chown -R &lt;user&gt;:&lt;user&gt;</code> + <code>chmod -R 755</code>. Keine freigegebene Gruppe erforderlich, da kein anderer CT in diesen Ordner schreibt. Fällt zurück zu <code>setfacl</code>, wenn der Schreibzugriff noch fehlt.",
+    "gidTitle": "GID für 'sharedfiles' unterscheidet sich vom NFS Server Flow",
+    "gidBody": "Das Samba-Serverskript verwendet GID <strong>999</strong> für <code>sharedfiles</code>, während der <nfsLink>NFS-Serverablauf</nfsLink> GID <strong>101000</strong> verwendet. Wenn Sie beide Server in demselben CT betreiben und eine einzelne gemeinsame Gruppe für beide Protokolle wünschen, bearbeiten Sie eines von ihnen nach der Installation so, dass es mit dem anderen übereinstimmt (z.B. <code>groupmod -g 101000 sharedfiles</code>) und setzen Sie die Eigentümer der betroffenen Ordner erneut. Dies ist eine bekannte Inkonsistenz in den aktuellen Skripten."
+  },
+  "opening": {
+    "heading": "Öffnen des Tools",
+    "body": "Öffnen Sie im Hauptmenü von ProxMenux <strong>Storage &amp; Share Manager → Samba-Server in LXC (nur privilegiert)</strong> konfigurieren. ProxMenux fordert Sie zuerst auf, das Ziel CT auszuwählen (und startet es, wenn es gestoppt wird); abbricht, wenn es nicht privilegiert ist. Sobald das CT ausgewählt ist, sehen Sie dieses sub-Menü mit fünf Optionen:",
+    "imageAlt": "Samba Server Manager-Menü - Erstellen / Anzeigen / Löschen / Status / Deinstallieren"
+  },
+  "howRuns": {
+    "heading": "Ablauf des Skripts beim Erstellen"
+  },
+  "modes": {
+    "heading": "Die drei Share-Modi",
+    "intro": "Jeder Modus schreibt einen anderen Konfigurationsabschnitt in <code>smb.conf</code>. Alle drei beinhalten <code>valid users = &lt;username&gt;</code> (nicht anonym), <code>force group = sharedfiles</code> (damit neue Dateien zur freigegebenen Gruppe gehören) und <code>veto files = /lost+found/</code> (versteckt sie vor Clients).",
+    "headerMode": "Modus",
+    "headerBlock": "Block geschrieben an smb.conf",
+    "rwMode": "Lesen und Schreiben",
+    "roMode": "Schreibgeschützt",
+    "customMode": "Benutzerdefiniert",
+    "customBodyRich": "Sie geben Ihre eigenen Direktiven in ein Freitextfeld ein. ProxMenux wickelt sie weiterhin in einen <code>[share]</code>-Block mit den Standards <code>path</code>, <code>valid users</code>, <code>force group</code> und <code>veto files</code> ein."
+  },
+  "manual": {
+    "heading": "Manuelles Äquivalent",
+    "body": "Führen Sie den gesamten Ablauf von Hand aus. Jeder Befehl läuft <strong>innerhalb des CTs</strong> über <code>pct exec &lt;ctid&gt; --</code> oder <code>pct enter &lt;ctid&gt;</code>:"
+  },
+  "connect": {
+    "heading": "Verbindung von Clients",
+    "headerOs": "Client-Betriebssystem",
+    "headerHow": "Wie man verbindet",
+    "windowsOs": "Windows",
+    "windowsHowRich": "Datei-Explorer → Adressleiste: <code>\\\\&lt;ct-ip&gt;\\&lt;share-name&gt;</code>. Oder <em>Netzlaufwerk verbinden</em> → „Verbindung mit anderen Anmeldeinformationen herstellen“ aktivieren.",
+    "macosOs": "macOS",
+    "macosHowRich": "Finder → <em>Gehe zu → Verbindung zum Server...</em> → <code>smb://&lt;ct-ip&gt;/&lt;share-name&gt;</code>. Oder <code>mount_smbfs //user@&lt;ct-ip&gt;/&lt;share&gt; /mountpoint</code>.",
+    "linuxOs": "Linux",
+    "linuxHowRich": "<code>mount -t cifs //&lt;ct-ip&gt;/&lt;share&gt; /mnt/x -o username=&lt;u&gt;,password=&lt;p&gt;,iocharset=utf8</code>. Oder verwenden Sie den <clientLink>Samba-Client auf der LXC</clientLink>-Seite, wenn der Client ein anderer Proxmox CT ist."
+  },
+  "view": {
+    "heading": "Aktuelle Freigaben anzeigen",
+    "body": "Liest <code>/etc/samba/smb.conf</code> im CT und listet jeden <code>[share]</code>-Block (überspringen <code>[global]</code>, <code>[homes]</code>, <code>[printers]</code>) mit seinem Pfad auf. Nützlich als schnelles Inventar."
+  },
+  "delete": {
+    "heading": "Freigabe löschen",
+    "body": "Sie können eine Freigabe nach Namen auswählen, den Block aus <code>smb.conf</code> entfernen (<code>sed</code> löscht aus <code>[share]</code> bis zur nächsten leeren Zeile) und <code>smbd</code> neu starten. Der Ordner selbst und sein Inhalt bleiben intakt."
+  },
+  "status": {
+    "heading": "Samba-Status überprüfen",
+    "body": "Gibt an, ob <code>smbd</code> und <code>nmbd</code> installiert und aktiv sind, listet Samba-Benutzer auf (<code>pdbedit -L</code>) und druckt aktive Sitzungen aus (<code>smbstatus</code>)."
+  },
+  "uninstall": {
+    "heading": "Samba-Server deinstallieren",
+    "body": "Vollständige Bereinigung nach Bestätigung: stoppt und deaktiviert <code>smbd</code> und <code>nmbd</code>, sichert <code>smb.conf</code> als <code>smb.conf.backup.YYYYMMDD_HHMMSS</code>, entfernt Samba-Benutzer mit <code>smbpasswd -x</code> und die Samba-Pakete mit <code>apt-get purge</code>. Die <strong>exportierten Ordner selbst bleiben erhalten</strong>.",
+    "warnTitle": "Ordner überleben – Daten separat sichern",
+    "warnBody": "<em>Freigabe löschen</em> und <em>Samba-Server deinstallieren</em> entfernen die Freigabekonfiguration. Die Daten in den exportierten Ordnern bleiben erhalten. Löschen Sie Daten bei Bedarf nach Abschluss des Skripts ausdrücklich mit <code>rm -rf</code>."
+  },
+  "troubleshoot": {
+    "heading": "Fehlerbehebung",
+    "privTitle": "Privilegierter Container erforderlich (Skript bricht ab)",
+    "privBody": "Der ausgewählte CT ist unprivilegiert und <code>smbd</code> kann dort keine Dateien bedienen. Wenn Sie das Gate umgehen und Samba von Hand konfigurieren, startet <code>smbd</code> und die Ports öffnen sich, aber die erste Clientverbindung gerät in Panik mit <code>PANIC: sys_setgroups failed</code> in <code>/var/log/samba/log.&lt;client&gt;</code> und der Client sieht <code>NT_STATUS_CONNECTION_DISCONNECTED</code>. Die Ursache ist der unprivilegierte Benutzernamensraum mit <code>setgroups=deny</code>, der die Per-Verbindungs-Imitation von Samba blockiert. Weder <code>features=keyctl=1</code> noch das Entfernen von <code>force user</code> / <code>force group</code> ändert dies. Die einzigen praktikablen Optionen sind: Wandeln Sie den CT in einen privilegierten CT um oder verschieben Sie Samba in eine VM.",
+    "aptTitle": "apt-get install schlägt fehl",
+    "aptIntro": "Das Skript nimmt eine Debian-Familie CT an. Auf Alpine / Arch / Rocky / Alma installieren Sie Samba von Hand:",
+    "aptItems": [
+      "Alpine: <code>apk add samba</code>",
+      "Arch: <code>pacman -S samba</code>",
+      "Rocky / Alma: <code>dnf install samba</code>"
+    ],
+    "aptOutro": "Führen Sie danach das ProxMenux-Skript erneut aus; sind die Werkzeuge schon vorhanden, wird die Installation übersprungen.",
+    "noShareTitle": "Client verbindet sich, sieht aber die Freigabe nicht",
+    "noShareBody": "Überprüfen Sie, ob <code>browseable = yes</code> im Freigabeblock eingestellt ist (Standard für rw / ro-Modi; möglicherweise fehlt es in benutzerdefinierten). Überprüfen Sie auch die CT-Firewall und die Proxmox-Host-Firewall erlauben TCP 445 (SMB) und 139 (NetBIOS). Einige Windows-Clients benötigen auch eine Namensauflösung - versuchen Sie die IP direkt zuerst.",
+    "authTitle": "Authentifizierung fehlschlägt (NT_STATUS_LOGON_FAILURE)",
+    "authBody": "Entweder ist das Passwort falsch (Samba-Passwörter sind von Systempasswörtern <em>getrennt</em>; Samba-Benutzer mit <code>pdbedit -L</code> auflisten) oder der Benutzer fehlt in <code>valid users</code> für diese Freigabe. Setzen Sie das Passwort im CT mit <code>smbpasswd &lt;user&gt;</code> zurück.",
+    "groupTitle": "Vom Client geschriebene Dateien erscheinen mit falscher Gruppe auf dem Server",
+    "groupBody": "Das Skript setzt <code>force group = sharedfiles</code> im Freigabeblock, so dass neue Dateien die Gruppe <code>sharedfiles</code> sein sollten. Wenn dies nicht der Fall ist, ist das SGID-Bit im Elternverzeichnis möglicherweise verloren gegangen (jemand hat <code>chmod</code> von Hand ausgeführt). Erneut anwenden: <code>chmod 2775 /mnt/&lt;share&gt;</code>.",
+    "bothTitle": "Teilen des gleichen Ordners über NFS und Samba",
+    "bothBody": "ProxMenux verwendet unterschiedliche GIDs für <code>sharedfiles</code> in jedem Skript (Samba: 999, NFS: 101000). Wenn Sie den gleichen Ordner über beide bedienen, entscheiden Sie sich für eine GID und richten Sie beide aus. Die einfachste Lösung: Nachdem Sie beide Skripte ausgeführt haben, bearbeiten Sie die kleinere GID:"
+  },
+  "related": {
+    "heading": "Verwandte Themen",
+    "items": [
+      {
+        "href": "/docs/storage-share/lxc-samba-client",
+        "label": "Samba-Client in LXC",
+        "tail": " — umgekehrte Richtung: externe Samba-Freigaben im CT einhängen."
+      },
+      {
+        "href": "/docs/storage-share/lxc-nfs-server",
+        "label": "NFS Server in LXC",
+        "tail": "— Geschwisterseite, gleiches Muster mit NFS anstelle von CIFS."
+      },
+      {
+        "href": "/docs/storage-share/host-samba",
+        "label": "Samba / CIFS als Proxmox-Speicher",
+        "tailRich": " — Sobald der CT Ordner über Samba freigibt, registrieren Sie die Samba-Freigabe in Proxmox, damit sie unter <em>Datacenter → Storage</em> erscheint."
+      }
+    ]
+  }
+}
diff --git a/web/messages/de/docs/utils/export-vm.json b/web/messages/de/docs/utils/export-vm.json
new file mode 100644
index 00000000..a94b427e
--- /dev/null
+++ b/web/messages/de/docs/utils/export-vm.json
@@ -0,0 +1,145 @@
+{
+  "meta": {
+    "title": "VM nach OVA / OVF exportieren | ProxMenux-Dokumentation",
+    "description": "Exportieren Sie eine Proxmox-VM mit dem DMTF-Standardschema in ein portables OVA-Archiv oder OVF-Verzeichnis. VMDK-Festplatten im Format streamOptimized und SHA1-Manifest. Importierbar in VMware ESXi / Workstation / Fusion, VirtualBox und wieder in Proxmox.",
+    "ogTitle": "VM nach OVA / OVF exportieren | ProxMenux-Dokumentation",
+    "ogDescription": "Wandeln Sie eine Proxmox-VM in ein portables OVA- / OVF-Paket um, das mit VMware und VirtualBox kompatibel ist."
+  },
+  "header": {
+    "title": "VM nach OVA / OVF exportieren",
+    "description": "Wandelt eine Proxmox-VM mit dem DMTF-OVF-Standardschema in ein portables OVA-Paket (ein TAR-Archiv) oder OVF-Paket (Deskriptor und VMDK-Dateien) um. Die Festplatten werden mit qemu-img in VMDK im Format streamOptimized konvertiert. Das Ergebnis lässt sich in VMware (ESXi / Workstation / Fusion), VirtualBox und mit dem Importwerkzeug wieder in Proxmox importieren.",
+    "section": "Dienstprogramme"
+  },
+  "intro": {
+    "title": "Was das macht",
+    "body": "Liest die Konfiguration einer gestoppten VM, konvertiert jede Festplatte in VMDK im Format streamOptimized, erzeugt einen OVF-Deskriptor und ein SHA1-Manifest und verpackt alles als einzelne <code>.ova</code>-Datei oder als <code>-ovf</code>-Verzeichnis. Die Quell-VM wird dabei nicht verändert."
+  },
+  "picker": {
+    "heading": "VM-Auswahl",
+    "body": "Beim Start zeigt das Skript alle VMs aus <code>qm list</code> mit VMID, Name und Status an. Wählen Sie die zu exportierende VM aus:",
+    "imgAlt": "Dialog zur Auswahl der zu exportierenden VM mit einer Liste aller VMs"
+  },
+  "stopped": {
+    "heading": "Die VM muss gestoppt sein",
+    "intro": "Für ein konsistentes Festplattenabbild muss die VM gestoppt sein. Falls die ausgewählte VM läuft, bietet ProxMenux an, sie herunterzufahren:",
+    "items": [
+      "Geordnetes Herunterfahren mit <code>qm shutdown $VMID --timeout 120</code> (wartet 2 Minuten auf das Herunterfahren des Gasts über ACPI).",
+      "Nach Ablauf der Wartezeit wird ein erzwungener Stopp angeboten: <code>qm stop $VMID</code> (entspricht dem Abschalten der Stromversorgung).",
+      "Wenn Sie beide ablehnen, wird der Export abgebrochen - es werden keine Daten berührt."
+    ],
+    "warnTitle": "Ein erzwungener Stopp entspricht dem Abschalten der Stromversorgung",
+    "warnBody": "<code>qm stop</code> entspricht dem Ziehen des Netzsteckers. Beim nächsten Start kann eine Reparatur des Gastdateisystems nötig sein. Nutzen Sie nach Möglichkeit das geordnete Herunterfahren und erzwingen Sie den Stopp nur bei Gästen, die nicht reagieren."
+  },
+  "format": {
+    "heading": "Formatauswahl: OVA vs. OVF",
+    "headerFormat": "Format",
+    "headerOutput": "Ausgabe",
+    "headerPros": "Vorteile",
+    "headerCons": "Nachteile",
+    "rows": [
+      {
+        "format": "OVA",
+        "output": "name-vmid-ts.ova",
+        "pros": "Eine einzelne, in sich geschlossene Datei, die sich einfach verschieben, per sftp übertragen oder an ein Ticket anhängen lässt.",
+        "cons": "Benötigt ~220% der virtuellen Festplattengröße (zusätzlicher Platz für das TAR-Archiv während der Erstellung)."
+      },
+      {
+        "format": "OVF",
+        "output": "name-vmid-ts-ovf/",
+        "pros": "~120% der virtuellen Festplattengröße. Leichter zu prüfen, da der Deskriptor reines XML ist. Kann vor dem Import bearbeitet werden.",
+        "cons": "Mehrere Dateien, die gemeinsam übertragen werden müssen."
+      }
+    ]
+  },
+  "destination": {
+    "heading": "Zielverzeichnis",
+    "body": "Wählen Sie ein voreingestelltes Verzeichnis (<code>/var/lib/vz/dump</code>, <code>/var/lib/vz/template/iso</code>) oder geben Sie einen eigenen Pfad ein. Das Skript prüft vor dem Start, ob das Verzeichnis beschreibbar ist, und warnt bei knappem Speicherplatz.",
+    "calloutTitle": "Faustregel für freien Speicherplatz",
+    "calloutBody": "Planen Sie für den OVF-Export einer VM mit insgesamt 100 GB virtueller Festplattengröße ~120 GB freien Platz ein, für OVA ~220 GB. Bei weitgehend leeren Festplatten kann der tatsächliche Bedarf geringer sein. Das OVA-Archiv wird als unkomprimiertes TAR erstellt, während die temporären VMDK-Dateien noch vorhanden sind. Planen Sie daher Platz für beides ein. Geht der Platz während des Exports aus, räumt der EXIT-Handler das temporäre Verzeichnis auf und Sie müssen neu beginnen."
+  },
+  "package": {
+    "heading": "Was im Paket landet",
+    "intro": "Für eine OVA / OVF namens <code>myvm-100-2026-04-26_18-30-15</code>:",
+    "code": "# OVA mode (single .ova file is a TAR of):\nmyvm-100-2026-04-26_18-30-15.ovf      # XML descriptor (DMTF OVF 1.0 + RASD + VSSD)\nmyvm-100-2026-04-26_18-30-15.mf       # SHA1 manifest\nmyvm-100-2026-04-26_18-30-15-disk0.vmdk\nmyvm-100-2026-04-26_18-30-15-disk1.vmdk\n...\n\n# OVF mode (a directory):\nmyvm-100-2026-04-26_18-30-15-ovf/\n├── myvm-100-2026-04-26_18-30-15.ovf\n├── myvm-100-2026-04-26_18-30-15.mf\n├── myvm-100-2026-04-26_18-30-15-disk0.vmdk\n└── myvm-100-2026-04-26_18-30-15-disk1.vmdk"
+  },
+  "exported": {
+    "heading": "Was exportiert wird",
+    "items": [
+      "<strong>Festplatten:</strong> Alle Einträge <code>scsi*</code>, <code>sata*</code>, <code>virtio*</code> und <code>ide*</code> in der VM-Konfiguration werden in VMDK im Format streamOptimized konvertiert.",
+      "<strong>vCPU-Anzahl</strong> (RASD ResourceType 3) und <strong>Arbeitsspeicher</strong> in MiB (ResourceType 4).",
+      "<strong>Anzahl der Netzwerkkarten</strong> (ResourceType 10, nur die Anzahl, nicht Bridge oder Modell).",
+      "<strong>VM-Name</strong> und ein Hinweis auf den Betriebssystemtyp."
+    ],
+    "notTitle": "Was nicht exportiert wird",
+    "notItems": [
+      "CD-ROM- und ISO-Mounts (bewusst ausgeschlossen).",
+      "Cloud-init-Laufwerke (bewusst ausgeschlossen).",
+      "Die konkrete Bridge und das Modell der Netzwerkkarte (nur die Anzahl bleibt erhalten).",
+      "BIOS- / UEFI-Auswahl, die beim Import neu festgelegt werden muss.",
+      "Konfiguration der PCI-Durchreichung.",
+      "Snapshots - nur der aktuelle Zustand wird erfasst.",
+      "Optionen auf VM-Ebene (NUMA, hugepages, hotplug, …)."
+    ]
+  },
+  "conversion": {
+    "heading": "Plattenumwandlung",
+    "intro": "Jede Festplatte wird konvertiert mit:",
+    "code": "qemu-img convert -p -O vmdk -o subformat=streamOptimized \\\n    \"$source_path\" \\\n    \"$work_dir/<base_name>-disk<N>.vmdk\"",
+    "outro": "<code>streamOptimized</code> ist ein in einem Durchlauf lesbares VMware-Format, das von ESXi 6.7+, VMware Workstation, VirtualBox und Proxmox selbst unterstützt wird. Es ist das am breitesten unterstützte VMDK-Unterformat und eignet sich für portable VMs. Der Nachteil: Es bietet keinen wahlfreien Zugriff und kann deshalb ohne Umwandlung nicht direkt eingebunden werden."
+  },
+  "manifest": {
+    "heading": "SHA1-Manifest",
+    "intro": "Jedes Paket enthält eine <code>.mf</code>-Datei mit SHA1-Hashes des OVF-Deskriptors und jedes VMDK:",
+    "code": "SHA1(myvm-100-2026-04-26_18-30-15.ovf)= 3a7bd3e2360a3d29eea436fcfb7e44c735d117c9\nSHA1(myvm-100-2026-04-26_18-30-15-disk0.vmdk)= b7e23ec29af22b0b4e41da31e868d57226121c84\nSHA1(myvm-100-2026-04-26_18-30-15-disk1.vmdk)= a87ff679a2f3e71d9181a67b7542122c",
+    "outro": "In der OVF-Spezifikation ist das Manifest optional; viele Importprogramme ignorieren es. Es hilft jedoch zu prüfen, ob das Paket unbeschädigt übertragen wurde. Prüfen Sie es manuell mit <code>sha1sum -c file.mf</code>."
+  },
+  "import": {
+    "heading": "Importieren des Ergebnisses",
+    "intro": "Das exportierte Paket kann in folgende Systeme importiert werden:",
+    "items": [
+      {
+        "href": "/docs/utils/import-vm",
+        "preRich": "<strong>Proxmox</strong> — verwenden Sie das zugehörige Werkzeug ",
+        "linkLabel": "VM von OVA / OVF importieren",
+        "tailRich": "."
+      },
+      {
+        "tailRich": "<strong>VMware ESXi</strong> — Datacenter → Deploy OVF Template; wählen Sie die .ova- oder .ovf-Datei aus."
+      },
+      {
+        "tailRich": "<strong>VMware Workstation / Fusion</strong> — Datei → Öffnen, wählen Sie .ova oder .ovf."
+      },
+      {
+        "tailRich": "<strong>VirtualBox</strong> — Datei → Appliance importieren, .ova oder .ovf auswählen."
+      }
+    ]
+  },
+  "troubleshoot": {
+    "heading": "Fehlerbehebung",
+    "noSpaceTitle": "qemu-img convert bricht während der Umwandlung mit \"No space left on device\" ab",
+    "noSpaceBody": "Am Ziel ist kein Speicherplatz mehr frei. Der EXIT-Handler räumt das temporäre Verzeichnis automatisch auf. Wählen Sie ein Ziel mit mehr freiem Platz (siehe Faustregel oben) und führen Sie den Export erneut aus.",
+    "unsupportedHwTitle": "Der Export ist abgeschlossen, aber VMware verweigert den Import mit \"Unsupported hardware family\"",
+    "unsupportedHwBody": "Einige ESXi-Versionen lehnen OVF-Deskriptoren ab, deren Hardwarefamilie sie nicht erkennen. Öffnen Sie die .ovf-Datei in einem Texteditor oder entpacken Sie zuerst die .ova-Datei. Suchen Sie <code>&lt;vssd:VirtualSystemType&gt;</code> und ändern Sie den Wert auf einen von ESXi akzeptierten Wert, etwa <code>vmx-13</code> für ESXi 6.5+. Als schnelle Umgehung können Sie VirtualBox ausprobieren, das weniger streng prüft.",
+    "nicTitle": "Die importierte VM verwendet eine andere Netzwerkkarte oder einen anderen SCSI-Controller",
+    "nicBody": "Die OVF-Datei übernimmt die Anzahl der Netzwerkkarten, nicht deren ursprüngliches Modell. Prüfen Sie die Netzwerkeinstellungen der importierten VM im Zielhypervisor. Für die VMware-Kompatibilität deklariert der Export einen lsilogic-SCSI-Controller. Beim Rückimport in Proxmox mit ProxMenux wird die VM mit einem LSI-Controller und e1000-Netzwerkkarten erstellt; wechseln Sie danach zu <code>VirtIO SCSI</code> und VirtIO, wenn der Gast passende Treiber besitzt.",
+    "runningTitle": "Die VM lief und ich habe das Herunterfahren abgelehnt: Export abgebrochen",
+    "runningBody": "Das Skript kann kein konsistentes Abbild erstellen, während auf die Festplatten geschrieben wird. Bestätigen Sie beim nächsten Mal das Herunterfahren oder fahren Sie die VM zuvor manuell herunter (<code>qm shutdown $VMID</code>) und starten Sie den Export erneut.",
+    "slowTitle": "Die Festplattenumwandlung ist langsam",
+    "slowBody": "<code>qemu-img convert</code> arbeitet mit einem Thread und liest die Quelle mit voller Geschwindigkeit. Rechnen Sie bei einer 100-GB-Festplatte auf einer mechanischen Festplatte mit 15–30 Minuten. Von NVMe zu NVMe geht es 5–10-mal schneller. Die Festplatten einer VM werden nacheinander umgewandelt; die Dauer wächst linear mit der gesamten virtuellen Größe."
+  },
+  "related": {
+    "heading": "Verwandte Themen",
+    "items": [
+      {
+        "href": "/docs/utils/import-vm",
+        "label": "VM aus OVA / OVF importieren",
+        "tail": " — das passende Werkzeug für den Rückimport."
+      },
+      {
+        "href": "/docs/utils",
+        "label": "Übersicht der Dienstprogramme",
+        "tail": " — zurück zur Abschnittsübersicht."
+      }
+    ]
+  }
+}
diff --git a/web/messages/de/docs/utils/import-vm.json b/web/messages/de/docs/utils/import-vm.json
new file mode 100644
index 00000000..07d2a2ff
--- /dev/null
+++ b/web/messages/de/docs/utils/import-vm.json
@@ -0,0 +1,218 @@
+{
+  "meta": {
+    "title": "VM aus OVA / OVF importieren | ProxMenux-Dokumentation",
+    "description": "Importieren Sie eine VM aus VMware ESXi / Workstation / Fusion / VirtualBox / ProxMenux in Proxmox VE. Entpackt OVA automatisch, liest OVF-Metadaten, erstellt die VM und importiert jede Festplatte in das native Speicherformat (qcow2 / raw).",
+    "ogTitle": "VM aus OVA / OVF importieren | ProxMenux-Dokumentation",
+    "ogDescription": "Importieren Sie VMs aus VMware-, VirtualBox- oder ProxMenux-Exporten in Proxmox. Festplatten werden automatisch in das native Speicherformat umgewandelt."
+  },
+  "header": {
+    "title": "VM von OVA / OVF importieren",
+    "description": "Importiert ein OVA / OVF-Paket in Proxmox VE: extrahiert OVA-Archive, analysiert den OVF-Deskriptor für vCPU / Speicher / NIC Anzahl und Festplattenreferenzen, erstellt dann die VM und importiert jede Festplatte über qm importdisk in den ausgewählten Speicher. Kompatibel mit Exporten von VMware (ESXi / Workstation / Fusion), VirtualBox und ProxMenux selbst.",
+    "section": "Dienstprogramme"
+  },
+  "intro": {
+    "title": "Was das macht",
+    "body": "Erstellt eine vollständige VM in Proxmox aus einem portablen Paket. Nach dem Import ist die VM startbereit. Für Leistung und Kompatibilität sollten Sie Netzwerkkartenmodell, Firmware und Betriebssystemtyp anschließend prüfen und anpassen."
+  },
+  "picker": {
+    "heading": "Dateiauswahl",
+    "intro": "Beim Start bietet das Skript zwei voreingestellte Verzeichnisse oder einen manuellen Pfad:",
+    "items": [
+      "<code>/var/lib/vz/dump</code> — das Standardverzeichnis Proxmox vzdump Backup.",
+      "<code>/var/lib/vz/template/iso</code> — sinnvoll, wenn Sie die OVA-Datei per sftp dorthin übertragen haben.",
+      "Manueller Pfad - für OVA / OVF-Dateien an anderer Stelle auf dem Host."
+    ],
+    "outro": "Es listet dann jede <code>.ova</code>- und <code>.ovf</code>-Datei im ausgewählten Verzeichnis auf.",
+    "imageAlt": "Dateiauswahldialog für den VM-Import"
+  },
+  "flow": {
+    "heading": "Wie der Import funktioniert",
+    "nodes": [
+      {
+        "label": "OVA-/OVF-Eingabe",
+        "detail": ".ova → tar xf nach\n /tmp/.proxmenux-import-*\n.ovf → direkt verwenden",
+        "variant": "source"
+      },
+      {
+        "label": "Analyse und Dialoge",
+        "detail": "AWK liest OVF\n(Name, vCPU, RAM, NICs,\nFestplatten). Auswahl von\nVMID / Speicher / Bridge",
+        "variant": "bridge"
+      },
+      {
+        "label": "qm create + importdisk",
+        "detail": "qm create $VMID\nqm importdisk\n(VMDK → Speicherformat)\nqm set --scsiN",
+        "variant": "target"
+      }
+    ]
+  },
+  "ovf": {
+    "heading": "OVF-Analyse",
+    "intro": "Ein <strong>gawk</strong>-Parser liest den OVF-Deskriptor und zieht die VM-Metadaten heraus. Der Parser verwendet die 3-Argumentform von <code>match()</code>, die gawk-spezifisch ist (mawk - die Standard-<code>awk</code> auf Debian / Proxmox - unterstützt sie nicht). Beim ersten Import installiert das Skript automatisch Gawk über das kanonische <code>ensure_repositories</code> + <code>install_single_package</code>-Paar, wenn es fehlt; nachfolgende Importe beginnen sofort. Felder extrahiert:",
+    "headerField": "Feld",
+    "headerSource": "Quelle in OVF",
+    "headerDefault": "Standardwert bei fehlendem Feld",
+    "rows": [
+      {
+        "field": "VM-Name",
+        "source": "<Name> (erster Treffer)",
+        "default": "imported-vm"
+      },
+      {
+        "field": "vCPU Anzahl",
+        "source": "RASD ResourceType 3 → VirtualQuantity",
+        "default": "1"
+      },
+      {
+        "field": "Speicher (MiB)",
+        "source": "RASD ResourceType 4 → VirtualQuantity",
+        "default": "1024"
+      },
+      {
+        "field": "NIC-Zahl",
+        "source": "Anzahl ResourceType 10",
+        "default": "1"
+      },
+      {
+        "field": "OS-Typ",
+        "source": "/Linux/ oder /Windows/ in der Beschreibung",
+        "default": "other"
+      },
+      {
+        "field": "Plattenreferenzen",
+        "source": "href Attribute enden mit .vmdk / .qcow2 / .img / .raw",
+        "default": "Keine (Import wird abgebrochen)"
+      }
+    ]
+  },
+  "memWarn": {
+    "title": "Mehrdeutigkeit der Speichereinheit",
+    "body": "Der Parser rechnet erkannte Speichereinheiten in <strong>MiB</strong> um, darunter Bytes, KiB, MiB, GiB und unterstützte Textbezeichnungen. Fehlende oder unbekannte Einheiten werden <em>als MiB behandelt</em>. Vergleichen Sie nach dem Import <code>qm config $VMID | grep memory</code> mit dem dokumentierten RAM der Quell-VM und korrigieren Sie ihn bei Bedarf mit <code>qm set $VMID --memory &lt;MiB&gt;</code>."
+  },
+  "dialog": {
+    "heading": "Importdialogfluss",
+    "items": [
+      "<strong>VMID</strong> — vorgeschlagen wird die nächste freie ID (<code>pvesh get /cluster/nextid</code>).",
+      "<strong>VM-Name</strong> — voreingestellt ist der aus OVF gelesene Name; Sie können ihn ändern.",
+      "<strong>Zielspeicher</strong> — Auswahl aller Speicher mit dem Inhaltstyp <code>images</code>, ermittelt mit <code>pvesm status -content images</code>.",
+      "<strong>Netzwerk-Bridge</strong> — Auswahl der Bridges aus <code>ip link show type bridge</code>. Bei nur einer wird sie automatisch gewählt; der Standard ist <code>vmbr0</code>.",
+      "<strong>Bestätigung</strong> — zusammenfassender Dialog mit VMID, Name, vCPU, Speicher, NICs, Speicher, Bridge und der Liste der zu importierenden Festplatten. Abbrechen hier = nichts ändert sich."
+    ]
+  },
+  "create": {
+    "heading": "VM Erstellung",
+    "intro": "Nach der Bestätigung läuft das Skript:",
+    "code": "qm create $VMID \\\n    --name \"$NAME\" \\\n    --memory $MEMORY \\\n    --cores $VCPU \\\n    --ostype $OSTYPE \\\n    --scsihw lsi \\\n    --net0 e1000,bridge=$BRIDGE\n\n# For each additional NIC:\nqm set $VMID --netN e1000,bridge=$BRIDGE",
+    "outro": "SCSI-Controller ist standardmäßig <code>lsi</code> (LSI Logic) für VMDK-Kompatibilität. NICs standardmäßig <code>e1000</code> (universelle Kompatibilität) auf der gewählten Brücke."
+  },
+  "diskLoop": {
+    "heading": "Ablauf des Festplattenimports",
+    "intro": "Für jede Plattenreferenz im OVF:",
+    "items": [
+      "<code>qm importdisk $VMID $disk_path $STORAGE</code> — importiert die Festplatte in einem vom Zielspeicher unterstützten Format und erstellt einen Eintrag <code>unusedN:</code> in der VM-Konfiguration.",
+      "Das Skript sucht mit grep nach dem gerade erstellten Verweis <code>unusedN</code> in der Konfiguration.",
+      "<code>qm set $VMID --scsiN $unused_disk</code> — verbindet die Festplatte als <code>scsi0</code>, <code>scsi1</code>, ...",
+      "<code>qm set $VMID --delete unusedN</code> — löscht den jetzt redundanten unbenutzten Marker."
+    ],
+    "outro": "Der Start wird auf die erste SCSI-Festplatte gesetzt: <code>qm set $VMID --boot c --bootdisk scsi0</code>."
+  },
+  "postImport": {
+    "heading": "Empfohlene Anpassungen nach dem Import",
+    "intro": "Der Import verwendet bewusst breit kompatible Einstellungen, damit die VM möglichst beim ersten Versuch startet. Sobald Sie den erfolgreichen Start bestätigt haben, können Sie über die Proxmox-Oberfläche oder CLI bessere Einstellungen wählen:",
+    "headerSetting": "Einstellung",
+    "headerDefault": "Standard nach dem Import",
+    "headerRecommended": "Empfohlen (wenn Gast unterstützt)",
+    "rows": [
+      {
+        "setting": "NIC-Modell",
+        "default": "e1000",
+        "recommended": "VirtIO (deutlich schneller, benötigt Treiber im Gastsystem)"
+      },
+      {
+        "setting": "SCSI-Controller",
+        "default": "LSI",
+        "recommended": "VirtIO SCSI single (modernes Linux oder Windows mit VirtIO-Treibern)"
+      },
+      {
+        "setting": "Firmware (BIOS / UEFI)",
+        "default": "Proxmox-Standard (BIOS)",
+        "recommended": "Firmware der Quell-VM übernehmen; bei Abweichungen kann der Start scheitern"
+      },
+      {
+        "setting": "QEMU Gastagent",
+        "default": "Ausgeschaltet",
+        "recommendedRich": "Aktivieren und <code>qemu-guest-agent</code> im Gast installieren (bessere Sicherungen und IP-Meldung)"
+      },
+      {
+        "setting": "OS-Typ",
+        "default": "l26 / win10 / other (heuristisch)",
+        "recommended": "Überprüfen Sie das tatsächliche Gast-Betriebssystem"
+      },
+      {
+        "setting": "Anzeige",
+        "default": "Standard",
+        "recommended": "VirtIO-GPU oder SPICE (bessere Konsolenleistung)"
+      }
+    ]
+  },
+  "fwWarn": {
+    "title": "Firmware-Mismatch = kein Boot",
+    "body": "Wenn die Quelle VM UEFI war, Proxmox sie jedoch als BIOS erstellt (oder umgekehrt), findet der Gast keine bootfähige Festplatte. Überprüfen Sie die Einstellungen des OVF oder des ursprünglichen VM für <em>FirmwareType / Firmware</em> und stellen Sie dasselbe in Proxmox ein: <code>qm set $VMID --bios ovmf</code> für UEFI; Standard ist <code>seabios</code> für BIOS."
+  },
+  "notImported": {
+    "heading": "Was nicht importiert wird",
+    "items": [
+      "<strong>Konkrete Netzwerk-Bridges</strong> — nur die Anzahl der Netzwerkkarten. Alle verwenden die beim Import ausgewählte Bridge.",
+      "<strong>Netzwerkkartenmodell</strong> — voreingestellt ist e1000.",
+      "<strong>BIOS / UEFI-Firmware Typ</strong> — Standard auf Proxmox Standard (BIOS).",
+      "<strong>Konfiguration der PCI-Durchreichung</strong>.",
+      "<strong>TPM</strong> (vTPM).",
+      "<strong>Cloud-init</strong>-Laufwerke.",
+      "<strong>Snapshots</strong> — nur der aktuelle Zustand.",
+      "<strong>USB / serielle / parallele Geräte</strong> deklariert im OVF.",
+      "<strong>VM Tags / Notizen / Start-on-Boot</strong> Optionen."
+    ]
+  },
+  "troubleshoot": {
+    "heading": "Fehlerbehebung",
+    "orphanTitle": "VM erstellt, aber Festplattenimport fehlgeschlagen: teilweise VM bleibt zurück",
+    "orphanIntro": "Bei fehlgeschlagenem Import bietet das Skript an, die teilweise erstellte VM und ihre importierten Festplatten zu entfernen. Haben Sie abgelehnt oder ist die automatische Löschung fehlgeschlagen, prüfen Sie die VM und entfernen Sie sie manuell mit:",
+    "orphanCode": "qm destroy $VMID --destroy-unreferenced-disks 1",
+    "orphanOutro": "Beheben Sie dann die zugrunde liegende Ursache (wahrscheinlich Speicherplatz auf dem Zielspeicher) und importieren Sie erneut.",
+    "memTitle": "Importierte VM hat 8 MB RAM (oder 8 TB)",
+    "memIntro": "Der Parser rechnet erkannte AllocationUnits in MiB um. Fehlende oder unbekannte Einheiten behandelt er als MiB. Prüfen Sie die OVF-Datei und vergleichen Sie den importierten Wert mit der Quell-VM. Korrigieren Sie den Arbeitsspeicher bei Bedarf:",
+    "memCode": "qm set $VMID --memory 8192    # 8 GiB",
+    "bootTitle": "Importierte VM startet nicht: \"No bootable device\"",
+    "bootIntro": "Häufige Ursache: BIOS und UEFI passen nicht zusammen. Die Quell-VM verwendete UEFI, wurde in Proxmox aber mit BIOS erstellt. Stellen Sie die passende Firmware ein:",
+    "bootCode": "qm set $VMID --bios ovmf       # UEFI\n# also add an EFI disk for the EFI vars:\nqm set $VMID --efidisk0 $STORAGE:1,format=qcow2,efitype=4m,pre-enrolled-keys=1",
+    "bootOutro": "Eine weitere häufige Ursache: Die Startreihenfolge verweist auf scsi0, das Betriebssystem liegt aber auf scsi1. Ändern Sie die Startreihenfolge unter den VM-Optionen.",
+    "bsodTitle": "Aus VMware exportierte Windows-VM zeigt beim ersten Start einen Bluescreen",
+    "bsodBody": "Windows reagiert empfindlich auf einen Wechsel des Festplattencontrollers. Installieren Sie entweder VirtIO-Treiber <em>vor</em> dem Export aus VMware oder behalten Sie zunächst den Standardcontroller <code>lsi</code>. Wechseln Sie erst nach erfolgreichem Gaststart und Installation der VirtIO-Treiber in Windows zu VirtIO SCSI.",
+    "zeroTitle": "OVF-Parser meldet 0 Festplatten",
+    "zeroBody": "Die OVF-Datei kann Festplattenverweise verwenden, die der Parser nicht erkennt. Öffnen Sie sie und suchen Sie für jede Festplatte einen Eintrag <code>&lt;File ovf:href=\"...vmdk\" ...&gt;</code>. Ist die Festplatte tatsächlich VMDK, hat aber eine ungewöhnliche Endung wie <code>.dat</code>, benennen Sie sie in <code>.vmdk</code> um und passen Sie den OVF-Verweis an. Umbenennen wandelt das Format nicht um.",
+    "awkTitle": "awk: Syntaxfehler bei oder nahe , — Parser schlägt bei jedem OVA / OVF fehl",
+    "awkIntro": "Der OVF-Parser verwendet gawk-spezifische Syntax: <code>match()</code> mit drei Argumenten. mawk, das standardmäßige <code>awk</code> unter Debian / Proxmox, unterstützt sie nicht. Aktuelle Skriptversionen installieren gawk beim ersten Einsatz automatisch über <code>ensure_repositories</code> + <code>install_single_package</code>. Bei einer älteren Kopie installieren Sie es manuell:",
+    "awkCode": "apt-get install -y gawk",
+    "awkOutro": "Dann führen Sie den Import erneut durch.",
+    "netTitle": "Netzwerk funktioniert nicht nach dem ersten Booten",
+    "netBody": "Das Netzwerkkartenmodell e1000 in Proxmox passt möglicherweise nicht zu den Gasttreibern, oder die gewählte Bridge ist falsch. Ändern Sie in der Hardwareansicht der VM das Modell unter Network Device → Model. Prüfen Sie außerdem <code>ip a</code> im Gast: Die Schnittstelle kann anders heißen, etwa ens18 statt eth0, während die Netzwerkkonfiguration noch den alten Namen verwendet."
+  },
+  "files": {
+    "heading": "Beteiligte Dateien",
+    "code": "scripts/utilities/import_vm_ova_ovf.sh       # this script\n/tmp/.proxmenux-import-*/                    # temp extraction dir for OVA\n/etc/pve/nodes/<node>/qemu-server/<vmid>.conf  # created by qm create\n<storage>/<vmid>/<vmid>-disk-<n>.<fmt>        # disk images, format depends on storage"
+  },
+  "related": {
+    "heading": "Verwandte Themen",
+    "items": [
+      {
+        "href": "/docs/utils/export-vm",
+        "label": "VM nach OVA / OVF exportieren",
+        "tail": " — das passende Werkzeug für den Export."
+      },
+      {
+        "href": "/docs/utils",
+        "label": "Übersicht der Dienstprogramme",
+        "tail": " — zurück zur Abschnittsübersicht."
+      }
+    ]
+  }
+}
diff --git a/web/messages/de/docs/utils/index.json b/web/messages/de/docs/utils/index.json
new file mode 100644
index 00000000..b0b129ef
--- /dev/null
+++ b/web/messages/de/docs/utils/index.json
@@ -0,0 +1,115 @@
+{
+  "meta": {
+    "title": "Proxmox-Dienstprogramme — UUP Dump, Upgrade von PVE 8 auf 9, OVA-Export/-Import | ProxMenux",
+    "description": "Dienstprogramme für den Proxmox-VE-Alltag: Windows-ISOs mit UUP Dump erstellen, ausgewählte CLI-Werkzeuge installieren, das Proxmox-System sicher aktualisieren, das Versionsupgrade von PVE 8 auf PVE 9 durchführen sowie VMs als OVA / OVF exportieren und aus VMware oder VirtualBox importieren.",
+    "ogTitle": "Proxmox-Dienstprogramme — UUP Dump, Upgrade von PVE 8 auf 9, OVA-Export/-Import",
+    "ogDescription": "Erstellen Sie Windows ISOs, installieren Sie CLI-Tools, führen Sie ein sicheres Update aus, aktualisieren Sie PVE 8 auf PVE 9, exportieren / importieren Sie OVA / OVF-VMs.",
+    "twitterTitle": "Proxmox Dienstprogramme | ProxMenux",
+    "twitterDescription": "ISO-Erstellung, CLI-Werkzeuge, Proxmox-Aktualisierung, Upgrade PVE 8→9, portable VMs im OVA- / OVF-Format."
+  },
+  "header": {
+    "title": "Dienstprogramme und Werkzeuge",
+    "description": "Sechs Werkzeuge ergänzen den täglichen Proxmox-VE-Arbeitsablauf: ISO-Erstellung, Systemwartung und portable VMs. Jede Option ist unabhängig. Wählen Sie die benötigte aus; erst auf Ihre Anforderung wird etwas installiert.",
+    "section": "Dienstprogramme"
+  },
+  "intro": {
+    "title": "Wofür dieses Menü ist",
+    "body": "Drei Gruppen unabhängiger, aber häufig benötigter Werkzeuge: <strong>eine Windows-ISO erstellen</strong> mit UUP Dump, <strong>den Proxmox-Host warten</strong> (CLI-Werkzeuge, Aktualisierungen und Versionsupgrade) und <strong>VMs importieren und exportieren</strong> mit dem Standardformat OVA / OVF."
+  },
+  "opening": {
+    "heading": "Öffnen des Menüs",
+    "body": "Wählen Sie im Hauptmenü von ProxMenux <strong>Utilities</strong>. Sie werden sehen:",
+    "imageAlt": "Dienstprogrammmenü mit UUP Dump, Systemwerkzeugen, Aktualisierung, Versionsupgrade, Export und Import"
+  },
+  "groups": {
+    "heading": "Drei Werkzeuggruppen",
+    "intro": "Die sechs Werkzeuge fallen in drei unabhängige Gruppen. Klicken Sie auf eine Karte unten, um zum passenden Abschnitt zu springen.",
+    "iso": {
+      "title": "ISO-Erstellung",
+      "body": "Erstellen Sie offizielle Windows ISOs von UUP Dump auf dem Proxmox-Host selbst.",
+      "bullets": [
+        "Freigabelink von UUP Dump → bootfähige ISO",
+        "Abhängigkeiten automatisch installiert",
+        "Das Ergebnis wird im ISO-Vorlagenverzeichnis von Proxmox gespeichert"
+      ]
+    },
+    "maintenance": {
+      "title": "Systemwartung",
+      "body": "Halten Sie den Host in gutem Zustand: mit CLI-Werkzeugen, regelmäßigen Aktualisierungen und dem Versionsupgrade, wenn es ansteht.",
+      "bullets": [
+        "Installationsprogramm für Systemwerkzeuge (25 CLI-Werkzeuge)",
+        "Proxmox-Systemaktualisierung (apt + dist-upgrade)",
+        "Versionsupgrade PVE 8 → PVE 9"
+      ]
+    },
+    "portability": {
+      "title": "VM Portabilität",
+      "body": "Bewegen Sie VMs in und aus Proxmox mit dem Standard-OVA / OVF-Format.",
+      "bullets": [
+        "Proxmox-VM exportieren → OVA / OVF",
+        "OVA / OVF importieren → Proxmox-VM",
+        "Kompatibel mit VMware und VirtualBox"
+      ]
+    }
+  },
+  "upgradeWarn": {
+    "title": "Das PVE 8 → 9 Upgrade ist destruktiv und nicht reversibel",
+    "body": "Ein Versionsupgrade ersetzt die Debian-Basis (Bookworm → Trixie) und die Proxmox-Komponenten direkt im bestehenden System. Es gibt keinen Rückweg. Sie benötigen vor dem Start <strong>geprüfte Sicherungen</strong> aller VMs und CTs sowie <strong>Zugriff über Konsole / IPMI / iKVM</strong>. Deshalb verweigert das Upgrade-Werkzeug die Ausführung im Proxmox-Webterminal."
+  },
+  "isoSection": {
+    "heading": "ISO-Erstellung",
+    "body": "Erstellen Sie direkt auf dem Proxmox-Host eine neue, aktuelle Windows-Installations-ISO. Das Skript automatisiert den gesamten UUP-Dump-Ablauf: Installation der Abhängigkeiten (aria2c, cabextract, wimlib-imagex, …), paralleler Download der Aktualisierungsdateien mit aria2 und Umwandlung in eine bootfähige ISO. Diese wird unter <code>/var/lib/vz/template/iso</code> gespeichert und kann einer VM zugewiesen werden.",
+    "options": [
+      {
+        "title": "UUP-Dump-ISO-Erstellung",
+        "description": "Erstellen Sie eine aktuelle Windows-Installations-ISO über einen Freigabelink von UUP Dump. Abhängigkeiten, Download und Umwandlung werden vollständig automatisch abgewickelt. Die fertige ISO wird unter /var/lib/vz/template/iso für die VM-Erstellung gespeichert.",
+        "href": "/docs/utils/UUp-Dump-ISO-Creator"
+      }
+    ]
+  },
+  "maintenanceSection": {
+    "heading": "Systemwartung",
+    "body": "Drei Werkzeuge decken tägliche und gelegentliche Arbeiten am Host ab. Das <strong>Installationsprogramm für Systemwerkzeuge</strong> richtet die nach einer Neuinstallation benötigten CLI-Werkzeuge ein. Die <strong>Proxmox-Systemaktualisierung</strong> dient der wöchentlichen oder monatlichen Wartung. Das <strong>Upgrade von PVE 8 auf PVE 9</strong> ist der große Wechsel beim nächsten Hauptversionszyklus. Zusätzliche Sicherheitsprüfungen sind vorgesehen, weil er nicht rückgängig gemacht werden kann.",
+    "options": [
+      {
+        "title": "Installationsprogramm für Systemdienstprogramme",
+        "description": "Auswahl von 25 bewährten CLI-Werkzeugen (htop, btop, iperf3, tmux, ...) mit individueller Auswahl oder vordefinierten Gruppen (Basis, Entwicklung, Komprimierung, Multiplexer, Analyse, Netzwerk). Verwendet den standardisierten Ablauf mit Repository und Prüfbefehl.",
+        "href": "/docs/utils/system-utils"
+      },
+      {
+        "title": "Proxmox-Systemupdate",
+        "description": "Repository-Prüfung + apt update + apt dist-upgrade mit Rückfrage vor dem Neustart. Erkennt die PVE-Hauptversion (8 oder 9), behält die konfigurierten Repositories bei und fragt nach, bevor ein Host ohne Abonnement auf das no-subscription-Repository umgestellt wird. Anschließend wird autoremove ausgeführt.",
+        "href": "/docs/utils/system-update"
+      },
+      {
+        "title": "Aktualisieren Sie PVE 8 auf PVE 9",
+        "description": "Versionsupgrade (Debian Bookworm → Trixie + PVE 8 → 9). Vorabprüfungen, Repository-Migration, automatischer oder interaktiver Modus, Prüfung nach dem Upgrade und Neustart. Verweigert die Ausführung im Webterminal.",
+        "href": "/docs/utils/upgrade-pve8-pve9"
+      }
+    ]
+  },
+  "portabilitySection": {
+    "heading": "VM Portabilität (OVA / OVF)",
+    "body": "OVA und OVF sind hypervisorübergreifende Paketformate des DMTF-Standards, die von VMware, VirtualBox und Proxmox unterstützt werden. Die beiden Werkzeuge ermöglichen Export und Rückimport: Eine aus Proxmox exportierte VM lässt sich wieder importieren und umgekehrt. Damit können Sie Arbeitslasten von ESXi migrieren, eine portable VM-Sicherung erstellen oder eine vorbereitete VM mit jemandem teilen, der VirtualBox nutzt.",
+    "options": [
+      {
+        "title": "VM nach OVA / OVF exportieren",
+        "description": "Wandeln Sie eine Proxmox-VM in ein portables OVA-Archiv oder OVF-Verzeichnis um. DMTF-Standardschema, SHA1-Manifest, VMDK-Festplatten im Format streamOptimized. Importierbar in VMware (ESXi / Workstation / Fusion), VirtualBox und wieder in Proxmox.",
+        "href": "/docs/utils/export-vm"
+      },
+      {
+        "title": "VM von OVA / OVF importieren",
+        "description": "Importieren Sie einen Export aus VMware / VirtualBox / ProxMenux in Proxmox. Das Werkzeug entpackt OVA automatisch, liest die OVF-Metadaten, erstellt die VM und importiert jede Festplatte in das native Format des Speichers.",
+        "href": "/docs/utils/import-vm"
+      }
+    ]
+  },
+  "diskSpaceCallout": {
+    "title": "Eine Notiz zum Speicherplatz für den Export / Import",
+    "body": "Beide Werkzeuge wandeln Festplattenformate um: Der Export verwendet <code>qemu-img convert -O vmdk -o subformat=streamOptimized</code>, der Import <code>qm importdisk</code> für die Rückwandlung in das native Speicherformat (qcow2 / raw). Planen Sie für den Export <strong>~120% der virtuellen Festplattengröße</strong> für OVF und <strong>~220%</strong> für OVA ein. Das OVA-Archiv wird als unkomprimiertes TAR erstellt, während die temporären VMDK-Dateien noch vorhanden sind. Prüfen Sie vor dem Start, ob im Zielverzeichnis ausreichend Platz frei ist."
+  },
+  "fitsTogether": {
+    "heading": "Wie das Menü zusammenpasst",
+    "body": "Jedes Werkzeug hat ein eigenes Skript unter <code>scripts/utilities/</code>. Die Proxmox-Systemaktualisierung ruft ein einziges Arbeitsskript unter <code>scripts/global/</code> auf: update-pve-safe.sh erkennt die Hauptversion und verarbeitet PVE 8 und PVE 9. Das Upgrade PVE 8 → 9 bietet im eigenen Menü zwei weitere Aktionen: eine eigenständige <em>Prüfung vor dem Upgrade</em> (führt <code>pve8to9 --full</code> aus) und eine schreibgeschützte <em>Anleitung für das manuelle Upgrade</em> (17 Schritte). Damit können Benutzer den Ablauf prüfen oder von Hand ausführen."
+  }
+}
diff --git a/web/messages/de/docs/utils/system-update.json b/web/messages/de/docs/utils/system-update.json
new file mode 100644
index 00000000..f9544cfc
--- /dev/null
+++ b/web/messages/de/docs/utils/system-update.json
@@ -0,0 +1,168 @@
+{
+  "meta": {
+    "title": "Proxmox-Systemaktualisierung | ProxMenux-Dokumentation",
+    "description": "Aktualisiert Pakete innerhalb der aktuellen Proxmox-Hauptversion mit apt-get update und apt full-upgrade -y. Prüft Speicherplatz und konfigurierte Repositories, versucht GPG-Schlüssel wiederherzustellen, prüft und repariert alte LVM-PV-Header, erstellt bei Bedarf verwaltete DKMS-Treiber neu, führt autoremove/autoclean aus und bietet einen nötigen Neustart an.",
+    "ogTitle": "Proxmox-Systemaktualisierung | ProxMenux-Dokumentation",
+    "ogDescription": "apt full-upgrade mit Repository-Prüfung, autoremove/autoclean und Rückfrage bei erforderlichem Neustart."
+  },
+  "header": {
+    "title": "Proxmox-Systemupdate",
+    "description": "Ruft ein einziges Arbeitsskript (<code>update-pve-safe.sh</code>) auf, das die laufende Proxmox-Hauptversion erkennt. Konfigurierte Repositories werden über die Proxmox-API gelesen und beibehalten. Ein Host ohne Abonnement, der nur Enterprise verwendet, wird vor der Umstellung auf no-subscription gefragt. Das Arbeitsskript aktualisiert Pakete und erstellt von ProxMenux verwaltete DKMS-Treiber für einen bereitgestellten Kernel neu. Das Hauptskript bietet einen Neustart an, wenn die Neustartmarkierung existiert oder sich der neueste installierte vom laufenden Kernel unterscheidet. Bei ausstehenden Aktualisierungen lässt sich der Vorgang auch über <em>Update Now</em> im Kopfbereich von ProxMenux Monitor starten.",
+    "section": "Dienstprogramme"
+  },
+  "calloutWhat": {
+    "title": "Was das macht",
+    "body": "Bringt den Host auf den neuesten Aktualisierungsstand seiner aktuellen Hauptversion. Führt <strong>kein</strong> Upgrade auf eine andere Hauptversion durch. Für PVE 8 → PVE 9 siehe <link>Upgrade von PVE 8 auf PVE 9</link>."
+  },
+  "official": {
+    "heading": "Die offizielle Proxmox Empfehlung",
+    "intro": "Proxmox empfiehlt für die Aktualisierung eines laufenden Hosts innerhalb derselben Hauptversion diesen Befehl:",
+    "code": "apt update && apt full-upgrade -y",
+    "outro": "Diese eine Zeile ist der offizielle Befehl für aktuelle Proxmox-Versionen. Entscheidend ist außerdem, dass die Repositories bereinigt und die richtigen aktiviert sind und sich der Host anschließend in einem ordnungsgemäßen Zustand befindet."
+  },
+  "onTop": {
+    "heading": "Was ProxMenux zusätzlich ausführt: am Skript geprüft",
+    "intro": "Verwendet <strong>denselben Vorgang apt full-upgrade</strong>, ergänzt um Repository-Prüfungen, DKMS-Neubau und anschließende Bereinigung. Die folgenden Schritte entsprechen <code>scripts/utilities/proxmox_update.sh</code> und seinem einzigen Arbeitsskript <code>scripts/global/update-pve-safe.sh</code>:",
+    "items": [
+      "<strong>Erkennt die PVE-Hauptversion</strong> im Arbeitsskript (<code>pveversion | grep -oP ''pve-manager/\\K[0-9]+''</code>). Ein Skript verarbeitet PVE 8 und PVE 9. Die konfigurierten Repositories bleiben erhalten, sofern ein Host ohne Abonnement der angebotenen Umstellung nicht zustimmt.",
+      "<strong>Behält konfigurierte Repositories bei.</strong> <code>ensure_repositories</code> liest die Repositories und den Abonnementstatus über die Proxmox-Repository-API. Bei aktivem Abonnement oder bereits verwendetem no-subscription- oder Test-Repository wird nichts geändert. Ein Host ohne aktives Abonnement, dessen einziges Proxmox-Repository Enterprise ist, wird vor der Umstellung auf no-subscription gefragt. Bei Ablehnung endet die Aktualisierung, ohne eine Paketquelle zu ändern.",
+      "<strong>Führt die Aktualisierung ohne Interaktion aus</strong> mit <code>DEBIAN_FRONTEND=noninteractive</code> und <code>--force-confdef --force-confold</code>. Bei Entscheidungen zu dpkg-Konfigurationsdateien wird die Standardaktion gewählt, falls vorhanden; andernfalls bleibt die bestehende Datei erhalten.",
+      "<strong>Erzwingt keine optionalen Werkzeuge.</strong> Das Arbeitsskript installiert weder <code>zfsutils-linux</code> noch <code>chrony</code>, <code>ifupdown2</code> oder ähnliche Pakete gegen die bestehende Auswahl. Wurde bei der Proxmox-Installation auf ein Paket verzichtet, bleibt das so. Fehlende Pakete werden in den übergeordneten Installationsabläufen angezeigt, nicht bei der Aktualisierung.",
+      "<strong>LVM-Metadatenprüfung und -reparatur.</strong> Erkennt alte PV-Header und führt vgck --updatemetadata sowie vgchange -ay für die betroffenen Volume-Gruppen aus. Dabei können LVM-Metadaten geändert werden; die Prüfung zeigt nicht nur Warnungen an.",
+      "<strong>Bereinigt anschließend:</strong> <code>apt-get autoremove -y</code> + <code>apt-get autoclean -y</code>.",
+      "<strong>DKMS-Neubau vor der Neustartabfrage.</strong> Das Arbeitsskript ruft <code>pmx_rebuild_dkms_after_kernel</code> auf, wenn ein neuerer installierter Kernel bereitsteht. Das Hauptskript prüft <code>/var/run/reboot-required</code> und vergleicht mit <code>dpkg-query</code> den von <code>uname -r</code> gemeldeten Kernel mit dem neuesten installierten Paket <code>proxmox-kernel-*-pve-signed</code> / <code>pve-kernel-*-pve</code>. Auf Hosts ohne <code>needrestart</code> kann die Markierung fehlen; der Kernelvergleich funktioniert trotzdem."
+    ]
+  },
+  "calloutOneSentence": {
+    "title": "In einem Satz",
+    "body": "Aktualisiert Hostpakete, behält konfigurierte Repositories ohne Zustimmung zu einer Umstellung bei, prüft LVM-Metadaten, erstellt verwaltete DKMS-Treiber neu, bereinigt mit autoremove/autoclean und bietet bei Bedarf einen Neustart an."
+  },
+  "confirm": {
+    "heading": "Bestätigungsdialog",
+    "intro": "Die Auswahl öffnet eine Zusammenfassung der geplanten Schritte und erfordert eine ausdrückliche Bestätigung:",
+    "imageAlt": "Bestätigungsdialog der Proxmox-Systemaktualisierung mit Repository-Prüfung, Paketaktualisierung und Bereinigung"
+  },
+  "routes": {
+    "heading": "So ruft das Hauptskript das Arbeitsskript auf",
+    "nodes": {
+      "source": {
+        "label": "proxmox_update.sh",
+        "detail": "pveversion |\ngrep -oP ''pve-manager/\\K[0-9]+''"
+      },
+      "bridge": {
+        "label": "Ein einziges Arbeitsskript",
+        "detail": "update-pve-safe.sh\n(erkennt PVE 8 / 9\nintern)"
+      },
+      "target": {
+        "label": "Nach der Aktualisierung",
+        "detail": "apt-get autoremove\napt-get autoclean\nNeustartabfrage bei Bedarf"
+      }
+    }
+  },
+  "worker": {
+    "heading": "Was das Arbeitsskript ausführt",
+    "intro": "Ein Arbeitsskript (<code>scripts/global/update-pve-safe.sh</code>) verarbeitet PVE 8 (<code>bookworm</code>) und PVE 9 (<code>trixie</code>). Es erkennt die Hauptversion intern und prüft die bestehende Repository-Konfiguration, ohne die Debian-Basisquellen neu zu schreiben. Die Schritte sind:",
+    "items": [
+      "<strong>Vorabprüfungen.</strong> Prüft, ob mindestens ~1 GB in <code>/var/cache/apt/archives</code> frei ist. Bei zu wenig Platz wird frühzeitig mit einer klaren Meldung abgebrochen, damit der Vorgang nicht mitten in einer apt-Transaktion scheitert.",
+      "<strong>Repository-Prüfung.</strong> <code>ensure_repositories</code> liest Repositories und Abonnementstatus. Bei einem verwendbaren Proxmox-Repository wird nichts geändert. Ein Host ohne aktives Abonnement, der nur Enterprise verwendet, wird vor der Umstellung auf no-subscription gefragt. Bei Ablehnung endet die Aktualisierung.",
+      "<strong>apt update mit automatischer GPG-Wiederherstellung.</strong> Bei <code>NO_PUBKEY</code> für ein Repository, auch eines von Drittanbietern, importiert das Arbeitsskript den fehlenden Schlüssel und versucht es erneut, bevor es abbricht.",
+      "<strong>Ausstehende Aktualisierungen und Sicherheitsaktualisierungen.</strong> Zeigt an, wie viele Pakete geändert werden und wie viele davon aus der Sicherheitssuite stammen. Der Bestätigungsdialog enthält dadurch konkrete Zahlen.",
+      "<strong>Bestätigungsdialog.</strong> Nach dem Aktualisieren der Paketlisten verlangt das Arbeitsskript ein ausdrückliches Ja vor der Paketaktualisierung.",
+      "<strong>apt full-upgrade.</strong> Verwendet <code>DEBIAN_FRONTEND=noninteractive</code> und <code>--force-confdef --force-confold</code>. Dpkg folgt bei Entscheidungen zu Konfigurationsdateien seiner Standardaktion, falls vorhanden, und behält andernfalls die bestehende Datei bei.",
+      "<strong>LVM-Prüfung.</strong> <code>lvm_repair_check</code> aktualisiert VG-Metadaten, wenn an Gast-VMs (DSM, TrueNAS, Speicher-Appliances) durchgereichte Festplatten mit alten PV-Headern zurückkehren.",
+      "<strong>DKMS-Neubau für von ProxMenux verwaltete Treiber.</strong> Steht nach der Aktualisierung ein neuer Kernel bereit, liest <code>pmx_rebuild_dkms_after_kernel</code> die von ProxMenux installierten Treiber aus <code>components_status.json</code> (derzeit <code>nvidia_driver</code> → Modul <code>nvidia</code> und <code>coral_driver</code> → Modul <code>gasket</code>), installiert passende Kernel-Header (<code>proxmox-headers-&lt;newkver&gt;</code>, falls verfügbar, sonst <code>pve-headers-&lt;newkver&gt;</code>) und führt <code>dkms autoinstall -k &lt;newkver&gt;</code> aus. Zeigt <code>dkms status</code> die Module danach nicht für den neuen Kernel an, werden die jeweiligen Installationsprogramme mit <code>--auto-reinstall</code> erneut ausgeführt. Fehler werden protokolliert, brechen die Aktualisierung aber nicht ab; die Neustartabfrage wird dennoch erreicht.",
+      "<strong>Anschließende Bereinigung.</strong> <code>apt-get autoremove</code> + <code>apt-get autoclean</code>, bevor die Steuerung an das Hauptskript zurückgeht."
+    ]
+  },
+  "post": {
+    "heading": "Bereinigung und Neustart nach dem Update",
+    "intro": "Nach Abschluss des Arbeitsskripts führt das Hauptskript Folgendes aus:",
+    "code": "apt-get autoremove -y    # drop unused dependencies pulled in by old packages\napt-get autoclean        # drop downloaded .deb files no longer in the index",
+    "afterCode": "Das Hauptskript prüft außerdem, ob ein Neustart erforderlich ist. Jedes dieser Signale löst die Abfrage aus:",
+    "items": [
+      "<code>/var/run/reboot-required</code> existiert: Ein Paket oder Systemwerkzeug hat einen nötigen Neustart markiert.",
+      "Das neueste installierte Proxmox-Kernelpaket unterscheidet sich vom laufenden Kernel, ermittelt mit <code>dpkg-query</code> und uname -r."
+    ],
+    "outro": "Trifft eines der Signale zu, fragt ein whiptail-Dialog <em>„Einige Änderungen erfordern einen Neustart. Möchten Sie jetzt neu starten?“</em>. Lehnen Sie ab, um mit dem laufenden Kernel weiterzuarbeiten, bis Sie selbst neu starten, etwa in einem geplanten Wartungsfenster."
+  },
+  "end": {
+    "heading": "Was Sie am Ende sehen",
+    "intro": "Nach Abschluss des Arbeitsskripts zeigt das Terminal die Bereinigungsausgabe und bei erforderlichem Neustart die entsprechende Abfrage an:",
+    "imageAlt": "Abschlussübersicht der Proxmox-Systemaktualisierung mit Bereinigungsausgabe und Neustartabfrage"
+  },
+  "calloutDeclineReboot": {
+    "title": "Neustart nur mit gutem Grund aufschieben",
+    "body": "Die Installation eines neuen Pakets <code>proxmox-kernel-*</code> ersetzt den laufenden Kernel erst beim Neustart. Der neue Kernel und seine passenden Module werden beim nächsten Start aktiv. Planen Sie dafür ein geeignetes Wartungsfenster und prüfen Sie zuvor alle DKMS-Bauwarnungen."
+  },
+  "noSub": {
+    "heading": "Wie das Arbeitsskript das Enterprise-Repository behandelt",
+    "intro": "Proxmox aktiviert das Enterprise-Repository standardmäßig. Ohne aktives Abonnement liefert es bei <code>apt-get update</code> den Fehler 401. Nur in diesem Fall und nach Rückfrage ändert das Arbeitsskript die Repositories über die Proxmox-Repository-API, die auch hinter <em>Node → Updates → Repositories</em> steht. Die einzelnen Fälle:",
+    "items": [
+      "Mit <strong>aktivem Abonnement</strong> bleiben die Repositories unverändert und Enterprise liefert die Aktualisierungen.",
+      "Ist das <strong>no-subscription- oder Test-Repository bereits aktiviert</strong>, bleiben die Repositories unverändert, unabhängig von weiteren eingerichteten Quellen.",
+      "Bei <strong>fehlendem aktivem Abonnement und ausschließlich Enterprise-Repository</strong> bietet ein Dialog die Umstellung an. Bei Zustimmung wird die Enterprise-Quelle deaktiviert, no-subscription aktiviert und die Paketliste aktualisiert. Die Änderung wird in der Ansicht <em>Changes</em> von Audit & Report erfasst. Bei Ablehnung endet die Aktualisierung ohne Änderung einer Paketquelle.",
+      "Vorhandene <strong>Enterprise-Ceph-Quellen</strong> werden bei derselben Umstellung deaktiviert, ohne einen anderen Ceph-Kanal auszuwählen. Auf Hosts mit Ceph wird dessen Kanal separat konfiguriert.",
+      "Steht <strong>kein Terminal für die Rückfrage</strong> zur Verfügung, wird keine Paketquelle geändert. Die Aktualisierung endet mit einem Hinweis auf <em>Node → Updates → Repositories</em>."
+    ],
+    "outro": "Debian-Quellen und alle anderen Repository-Dateien werden bei der Aktualisierung nicht bearbeitet. Enthält ein Eintrag Enterprise zusammen mit weiteren Komponenten, wird er nicht umgestellt. Die Aktualisierung stoppt und fordert dazu auf, den Eintrag in der Proxmox-Repository-Ansicht aufzuteilen."
+  },
+  "cluster": {
+    "heading": "Clusterüberlegungen",
+    "calloutTitle": "Auf Clustern: Aktualisieren Sie jeweils einen Knoten",
+    "calloutBody": "Führen Sie diese Option im Proxmox-Cluster auf <strong>einem Knoten nach dem anderen</strong> aus. Warten Sie jeweils den vollständigen Neustart ab, bevor Sie fortfahren. Migrieren Sie Gäste vorher vom Knoten, um clusterweite Dienstunterbrechungen zu vermeiden. Unterschiedliche Nebenversionen wie 8.4.1 und 8.4.5 können für einige Stunden parallel laufen; unterschiedliche laufende Kernel können bei HA-verwalteten Gästen unerwartetes Verhalten verursachen."
+  },
+  "doesnt": {
+    "heading": "Was es nicht tut",
+    "items": [
+      "<strong>Upgrade der Hauptversion.</strong> 8 → 9 ist ein eigener Vorgang; siehe <link>Upgrade von PVE 8 auf PVE 9</link>.",
+      "<strong>Backup.</strong> Keine Snapshots, kein Rollback. Apt Operationen sind nicht transaktional. Kombinieren Sie mit Ihrer normalen Backup-Disziplin (PBS, vzdump, ZFS Snapshots).",
+      "<strong>Aktualisierung von Containern / VMs.</strong> Nur der Host wird aktualisiert; die Gastsysteme bleiben unverändert.",
+      "<strong>Gezieltes Einspielen von Firmware.</strong> Dies ist kein Werkzeug zum Flashen von BIOS oder Gerätefirmware. Bereits installierte Firmware- oder CPU-Mikrocodepakete können weiterhin über apt aktualisiert werden."
+    ]
+  },
+  "troubleshooting": {
+    "heading": "Fehlerbehebung",
+    "items": [
+      {
+        "title": "apt update scheitert mit 401 Unauthorized",
+        "body": "Das Enterprise-Repository ist aktiviert, aber der Host hat kein aktives Abonnement. Das Arbeitsskript bietet vor <code>apt-get update</code> die Umstellung auf no-subscription an. Wurde sie abgelehnt, starten Sie die Aktualisierung erneut und stimmen Sie zu. Alternativ deaktivieren Sie Enterprise unter <em>Node → Updates → Repositories</em> und aktivieren no-subscription."
+      },
+      {
+        "title": "dist-upgrade bleibt bei \"Configuring grub-pc\" hängen",
+        "body": "Falls eine interaktive GRUB-Abfrage erscheint, fragt sie nach den Geräten für den Bootloader. <code>--force-confold</code> gilt für Entscheidungen zu Konfigurationsdateien, nicht für diese Geräteauswahl. Wählen Sie mit <kbd>Tab</kbd> + <kbd>Space</kbd> die passenden Startfestplatten und dann OK. Die Auswahl lässt sich vorher mit <code>dpkg-reconfigure grub-pc</code> konfigurieren."
+      },
+      {
+        "title": "Kernel aktualisiert, aber die neuen Module fehlen für einen Out-of-Tree-Treiber",
+        "body": "Für verwaltete Treiber (<code>nvidia_driver</code> und <code>coral_driver</code>) führt die Hilfsfunktion <code>dkms autoinstall -k &lt;newkver&gt;</code> aus und kann deren Installationsprogramme mit <code>--auto-reinstall</code> erneut starten. Prüfen Sie das Ergebnis mit <code>dkms status</code>. Der autoinstall-Befehl kann auch andere registrierte DKMS-Module neu erstellen. Der erneute Installer-Aufruf beschränkt sich auf die verwalteten Einträge in <code>components_status.json</code>. Prüfen Sie weiterhin fehlende Drittanbietermodule und erstellen Sie sie bei Bedarf mit <code>dkms autoinstall</code> neu."
+      },
+      {
+        "title": "Die Neustartabfrage erschien nicht, obwohl ein neuer Kernel installiert wurde",
+        "body": "Die Signale gelten alternativ: <code>/var/run/reboot-required</code> oder ein Unterschied zwischen laufendem und neuestem installiertem Proxmox-Kernel. Das Hauptskript wertet keine linux-image-Einträge im apt-Protokoll aus. Prüfen Sie die laufende Version mit <code>uname -r</code> und die installierten Kernelpakete mit <code>dpkg-query</code>. Planen Sie einen nötigen Neustart oder führen Sie zum passenden Zeitpunkt <code>shutdown -r now</code> aus."
+      }
+    ]
+  },
+  "files": {
+    "heading": "Beteiligte Dateien",
+    "code": "scripts/utilities/proxmox_update.sh              # this script (wrapper)\nscripts/global/update-pve-safe.sh                # single safe worker (PVE 8 + PVE 9)\nscripts/global/repository-functions.sh           # ensure_repositories\nscripts/global/repository_policy.py              # reads and switches repositories through the Proxmox API\nscripts/global/utils-install-functions.sh        # pmx_rebuild_dkms_after_kernel\n/usr/local/share/proxmenux/components_status.json # ProxMenux-managed DKMS driver registry\n/etc/apt/sources.list.d/proxmox.sources          # no-subscription source, written by Proxmox when the switch is accepted\n/var/run/reboot-required                         # read to decide on reboot prompt\n# Reboot fallback when needrestart isn't installed:\n# dpkg-query -W 'proxmox-kernel-*-pve-signed' 'pve-kernel-*-pve' vs. uname -r"
+  },
+  "related": {
+    "heading": "Verwandte Themen",
+    "items": [
+      {
+        "href": "/docs/utils/upgrade-pve8-pve9",
+        "label": "Aktualisieren Sie PVE 8 auf PVE 9",
+        "tail": " — für das Upgrade der Hauptversion mit einem anderen Werkzeug und Sicherheitsmodell."
+      },
+      {
+        "href": "/docs/utils/system-utils",
+        "label": "Installationsprogramm für Systemdienstprogramme",
+        "tail": " — zur Installation nützlicher CLI-Werkzeuge für Aktualisierungen (htop / btop / ncdu)."
+      },
+      {
+        "href": "/docs/utils",
+        "label": "Übersicht der Dienstprogramme",
+        "tail": " — zurück zur Abschnittsübersicht."
+      }
+    ]
+  }
+}
diff --git a/web/messages/de/docs/utils/system-utils.json b/web/messages/de/docs/utils/system-utils.json
new file mode 100644
index 00000000..d250de76
--- /dev/null
+++ b/web/messages/de/docs/utils/system-utils.json
@@ -0,0 +1,252 @@
+{
+  "meta": {
+    "title": "Installationsprogramm für Systemwerkzeuge | ProxMenux-Dokumentation",
+    "description": "CLI-Werkzeuginstallation für Proxmox VE mit 25 Paketen in der zentralen Liste (htop, btop, iperf3, tmux, ...). Individuelle Auswahl, Gesamtinstallation und vordefinierte Gruppen (Basis, Entwicklung, Komprimierung, Multiplexer, Analyse, Netzwerk). Gruppen können zusätzliche Pakete enthalten. Verwendet ensure_repositories + install_single_package.",
+    "ogTitle": "Installationsprogramm für Systemwerkzeuge | ProxMenux-Dokumentation",
+    "ogDescription": "Installieren Sie kuratierte CLI-Tools auf Proxmox VE mit einem Klick oder einer benutzerdefinierten Auswahl."
+  },
+  "header": {
+    "title": "Installationsprogramm für Systemdienstprogramme",
+    "description": "Auswahl der 25 CLI-Werkzeuge in der zentralen Liste PROXMENUX_UTILS. Bietet individuelle Auswahl, Gesamtinstallation, sechs vordefinierte Gruppen und eine Installationsprüfung. Gruppen können weitere Werkzeuge enthalten. Gemeinsame Hilfsfunktionen ensure_repositories() + install_single_package() sorgen für einheitliche Repository-Verwaltung und Paketmeldungen.",
+    "section": "Dienstprogramme"
+  },
+  "info": {
+    "title": "Was das macht",
+    "body": "Installiert CLI-Werkzeuge aus einer Liste mit 25 Paketen. Jede Installation verwendet denselben Ablauf: <code>ensure_repositories</code> prüft ein nutzbares Proxmox-Repository für die laufende PVE-Hauptversion; anschließend installiert <code>install_single_package</code> das Paket und prüft, ob dessen Befehl in PATH liegt."
+  },
+  "opening": {
+    "heading": "Installationsprogramm öffnen",
+    "intro": "Wählen Sie im Menü Utilities <strong>System Utilities Installer</strong>. Das Hauptmenü bietet neun Optionen:",
+    "imageAlt": "Menü System Utilities Installer mit benutzerdefinierter Auswahl, ALL, vordefinierten Gruppen und Verifizierung"
+  },
+  "actions": {
+    "heading": "Die 9 Menüaktionen",
+    "headerOption": "Option",
+    "headerBehaviour": "Verhalten",
+    "rows": [
+      {
+        "option": "1. Individuelle Auswahl",
+        "behaviourRich": "Auswahlliste aller 25 Pakete. Mit SPACE umschalten und mit ENTER bestätigen; nur ausgewählte Pakete werden installiert."
+      },
+      {
+        "option": "2. Alle Werkzeuge installieren",
+        "behaviourRich": "Installiert alle Pakete aus <code>PROXMENUX_UTILS</code> in einem Durchgang. Geeignet nach einer neuen Proxmox-Installation."
+      },
+      {
+        "option": "3. Grundlegend",
+        "behaviourRich": "<code>grc</code>, <code>htop</code>, <code>tree</code>, <code>curl</code>, <code>wget</code>"
+      },
+      {
+        "option": "4. Entwicklung",
+        "behaviourRich": "<code>git</code>, <code>vim</code>, <code>nano</code>"
+      },
+      {
+        "option": "5. Kompression",
+        "behaviourRich": "<code>zip</code>, <code>unzip</code>, <code>rsync</code>"
+      },
+      {
+        "option": "6. Terminalmultiplexer",
+        "behaviourRich": "<code>screen</code>, <code>tmux</code>"
+      },
+      {
+        "option": "7. Analyse",
+        "behaviourRich": "<code>jq</code>, <code>ncdu</code>, <code>iotop</code>"
+      },
+      {
+        "option": "8. Netz",
+        "behaviourRich": "<code>iperf3</code>, <code>nethogs</code>, <code>nmap</code>, <code>tcpdump</code>, <code>lsof</code>"
+      },
+      {
+        "option": "9. Installationen prüfen",
+        "behaviourRich": "Prüft für jeden Eintrag in <code>PROXMENUX_UTILS</code>, ob der zugehörige Prüfbefehl in PATH verfügbar ist, und zeigt eine Übersicht mit Verfügbar / Fehlend."
+      }
+    ]
+  },
+  "packages": {
+    "heading": "Die 25 Pakete",
+    "intro": "In der gemeinsamen Datei <code>scripts/global/utils-install-functions.sh</code> als <code>PROXMENUX_UTILS</code> definiert (Format: <code>package:verify_command:description</code>). Andere ProxMenux-Skripte, etwa die Netzwerküberwachungsstarter für iftop / iptraf-ng / iperf3, verwenden diese Einträge ebenfalls, damit Paket und Prüfbefehl zusammenpassen.",
+    "headerPackage": "Paket",
+    "headerVerify": "Prüfbefehl",
+    "headerDescription": "Beschreibung",
+    "rows": [
+      {
+        "package": "axel",
+        "verify": "axel",
+        "description": "Downloadbeschleuniger"
+      },
+      {
+        "package": "aria2",
+        "verify": "aria2c",
+        "description": "Multisource-Downloader"
+      },
+      {
+        "package": "btop",
+        "verify": "btop",
+        "description": "Moderner Ressourcenmonitor"
+      },
+      {
+        "package": "cabextract",
+        "verify": "cabextract",
+        "description": "Extrahieren von CAB-Dateien"
+      },
+      {
+        "package": "chntpw",
+        "verify": "chntpw",
+        "description": "Bearbeiten der Windows-Registrierung / Passwörter"
+      },
+      {
+        "package": "dos2unix",
+        "verify": "dos2unix",
+        "description": "Konvertieren von DOS / Unix Textdateien"
+      },
+      {
+        "package": "genisoimage",
+        "verify": "genisoimage",
+        "description": "ISO-Images erstellen"
+      },
+      {
+        "package": "grc",
+        "verify": "grc",
+        "description": "Allgemeine farbige Hervorhebung von Protokollen"
+      },
+      {
+        "package": "htop",
+        "verify": "htop",
+        "description": "Interaktiver Prozess-Viewer"
+      },
+      {
+        "package": "iftop",
+        "verify": "iftop",
+        "description": "Echtzeit-Netzwerknutzung"
+      },
+      {
+        "package": "intel-gpu-tools",
+        "verify": "intel_gpu_top",
+        "description": "Intel GPU Werkzeuge"
+      },
+      {
+        "package": "iotop",
+        "verify": "iotop",
+        "description": "Festplatten-E/A überwachen"
+      },
+      {
+        "package": "iperf3",
+        "verify": "iperf3",
+        "description": "Prüfung der Netzwerkbandbreite"
+      },
+      {
+        "package": "ipset",
+        "verify": "ipset",
+        "description": "Verwalten von IP-Sets"
+      },
+      {
+        "package": "iptraf-ng",
+        "verify": "iptraf-ng",
+        "description": "Netzüberwachungsinstrument"
+      },
+      {
+        "package": "libguestfs-tools",
+        "verify": "virt-filesystems",
+        "description": "Werkzeuge für VM-Festplatten"
+      },
+      {
+        "package": "msr-tools",
+        "verify": "rdmsr",
+        "description": "Zugriff auf CPU-MSRs"
+      },
+      {
+        "package": "net-tools",
+        "verify": "netstat",
+        "description": "Ältere Netzwerkwerkzeuge"
+      },
+      {
+        "package": "plocate",
+        "verify": "locate",
+        "description": "Dateien schnell finden"
+      },
+      {
+        "package": "s-tui",
+        "verify": "s-tui",
+        "description": "Stress-Terminal UI"
+      },
+      {
+        "package": "sshpass",
+        "verify": "sshpass",
+        "description": "Nicht-interaktives SSH-Login"
+      },
+      {
+        "package": "tmux",
+        "verify": "tmux",
+        "description": "Terminal-Multiplexer"
+      },
+      {
+        "package": "unzip",
+        "verify": "unzip",
+        "description": "ZIP-Dateien extrahieren"
+      },
+      {
+        "package": "wimtools",
+        "verify": "wimlib-imagex",
+        "description": "Verwalten von WIM-Bildern"
+      },
+      {
+        "package": "zip",
+        "verify": "zip",
+        "description": "ZIP-Dateien erstellen"
+      }
+    ]
+  },
+  "howItWorks": {
+    "heading": "Wie eine einzelne Paketinstallation funktioniert",
+    "items": [
+      "<code>ensure_repositories</code> erkennt PVE 8 oder 9 und liest die Repositories über die Proxmox-API. Bei einem nutzbaren Proxmox-Repository wird nichts geändert. Ein Host ohne aktives Abonnement, der nur Enterprise verwendet, wird vor der Umstellung auf no-subscription gefragt. Nach einer bestätigten Umstellung wird <code>apt-get update</code> ausgeführt.",
+      "<code>install_single_package \"pkg\" \"verify_cmd\" \"description\"</code> führt <code>apt-get install -y \"$pkg\"</code> mit Feedback aus (<code>msg_info</code> / <code>msg_ok</code> / <code>msg_error</code>)."
+    ],
+    "verifyIntro": "Nach der Installation wird der Verifizierungsbefehl mit <code>command -v \"$verify_cmd\"</code> überprüft. Drei Ergebnisse:",
+    "verifyOutcomes": [
+      "<strong>0 (Erfolg): </strong> Befehl verfügbar, Paket gezählt als <em>Erfolgreich</em>.",
+      "<strong>1 (fehlgeschlagen):</strong> apt fehlgeschlagen, gezählt als <em>Failed</em>.",
+      "<strong>2 (Warnung):</strong> apt war erfolgreich, aber der erwartete Befehl wurde nicht in PATH gefunden. Das Paket zählt als <em>Mit Warnungen</em>."
+    ],
+    "summary": "Nach einer Gruppeninstallation oder individuellen Installation zeigt ein Dialog die Anzahl <em>Erfolgreich / Mit Warnungen / Fehlgeschlagen</em>."
+  },
+  "verify": {
+    "heading": "Überprüfen Sie die Installationen",
+    "intro": "Option 9 liest nur: Sie durchläuft <code>PROXMENUX_UTILS</code> und führt für jeden Prüfbefehl <code>command -v</code> aus. Die Ausgabe sieht so aus:",
+    "code": "Total: 25\nAvailable: 18\nMissing: 8\n\n✓ axel - Download accelerator\n✓ aria2c - Multi-source downloader\n✓ btop - Modern resource monitor\n✗ cabextract - Extract CAB files\n✓ dos2unix - Convert DOS / Unix text files\n✗ genisoimage - Create ISO images\n✓ grc - Generic log colorizer\n...",
+    "outro": "Nützlich vor Skripten, die diese Werkzeuge benötigen. Beispielsweise braucht <code>uup_dump_iso_creator.sh</code> die Befehle <code>aria2c</code> + <code>cabextract</code> + <code>wimlib-imagex</code>. Fehlt etwas, installieren Sie die passende Gruppe oder wählen Sie die fehlenden Pakete einzeln aus."
+  },
+  "troubleshoot": {
+    "heading": "Fehlerbehebung",
+    "reposTitle": "„Repositories konnten nicht konfiguriert werden. Installation abgebrochen.“",
+    "reposBody": "Der Repository-Check wurde nicht bestanden: Der Wechsel zum No-Subscription-Repository wurde abgelehnt, der Subscription-Status konnte nicht gelesen werden oder ein Repository-Eintrag benötigt Aufmerksamkeit. Die darüber gedruckte Botschaft gibt die Ursache an. Die Repositories sind in <em>Node → Updates → Repositories</em> aufgeführt, und <code>apt-get update</code> von einer Konsole zeigt die Fehlermeldungen an.",
+    "warningsTitle": "Ein Paket wird \"Mit Warnungen\" gemeldet, aber der Befehl funktioniert, nachdem ich das Menü geschlossen habe",
+    "warningsBody": "Nach <code>apt-get install</code> führt die Hilfsfunktion <code>hash -r</code> aus, wartet kurz und prüft den erwarteten Befehl mit <code>command -v</code>. Eine Warnung bedeutet, dass diese Prüfung weiterhin fehlschlug; sie benennt keine Ursache. Versuchen Sie eine neue Shell und prüfen Sie Paketinstallation sowie PATH, falls der Befehl weiterhin fehlt.",
+    "hangsTitle": "Ein apt install hängt",
+    "hangsBody": "Höchstwahrscheinlich wird eine Debconf-Eingabeaufforderung hinter der stummgeschalteten Ausgabe blockiert. Das Skript wickelt alle apt-Aufrufe mit <code>DEBIAN_FRONTEND=noninteractive</code> ab, was normalerweise Aufforderungen unterdrückt, aber einige Pakete erfordern immer noch Benutzereingaben. Abbrechen mit <kbd>Ctrl</kbd> + <kbd>C</kbd>, führen Sie <code>apt-get install -y &lt;pkg&gt;</code> manuell aus einer Shell aus, um die Eingabeaufforderung zu sehen und zu entscheiden."
+  },
+  "files": {
+    "heading": "Beteiligte Dateien",
+    "code": "scripts/utilities/system_utils.sh                    # this script\nscripts/global/utils-install-functions.sh            # PROXMENUX_UTILS, install_single_package\nscripts/global/repository-functions.sh               # ensure_repositories\nscripts/global/repository_policy.py                  # reads and switches repositories through the Proxmox API\n/etc/apt/sources.list.d/proxmox.sources              # no-subscription source, written by Proxmox when the switch is accepted"
+  },
+  "related": {
+    "heading": "Verwandte Themen",
+    "items": [
+      {
+        "href": "/docs/utils/system-update",
+        "label": "Proxmox-Systemupdate",
+        "tailRich": "— für den eigentlichen <code>apt dist-upgrade</code> auf dem Host."
+      },
+      {
+        "href": "/docs/network/monitoring",
+        "label": "Live-Überwachungswerkzeuge (Netzwerk)",
+        "tailRich": "- verwendet iftop / iptraf-ng / iperf3 aus derselben Liste."
+      },
+      {
+        "href": "/docs/utils",
+        "label": "Übersicht der Dienstprogramme",
+        "tailRich": " — zurück zur Abschnittsübersicht."
+      }
+    ]
+  }
+}
diff --git a/web/messages/de/docs/utils/upgrade-pve8-pve9.json b/web/messages/de/docs/utils/upgrade-pve8-pve9.json
new file mode 100644
index 00000000..f7f766b2
--- /dev/null
+++ b/web/messages/de/docs/utils/upgrade-pve8-pve9.json
@@ -0,0 +1,335 @@
+{
+  "meta": {
+    "title": "PVE 8 auf PVE 9 aktualisieren | ProxMenux-Dokumentation",
+    "description": "Drei Wege von Proxmox VE 8 zu 9 (Debian Bookworm zu Trixie und PVE 8 zu 9): automatisch, interaktiv oder manuell nach der offiziellen Proxmox-Anleitung. Mit pve8to9-Vorabprüfung, Repository-Umstellung, dist-upgrade und abschließender Kontrolle. Start im Webterminal wird verweigert.",
+    "ogTitle": "PVE 8 auf PVE 9 aktualisieren | ProxMenux-Dokumentation",
+    "ogDescription": "Drei Verfahren (automatisch, interaktiv, manuell) für den Wechsel von Proxmox VE 8 auf 9."
+  },
+  "header": {
+    "title": "Aktualisieren Sie PVE 8 auf PVE 9",
+    "description": "Führt das Upgrade von Proxmox VE 8 auf 9 nach der offiziellen Anleitung durch: Debian Bookworm zu Trixie und PVE 8 zu 9. Zur Auswahl stehen automatische, interaktive und manuelle Durchführung sowie eine separate Vorabprüfung. Der Start im Webterminal wird verweigert, da ein Verbindungsabbruch während des Upgrades den Host beschädigen kann.",
+    "section": "Dienstprogramme"
+  },
+  "dangerCallout": {
+    "title": "Ein Wechsel der Hauptversion lässt sich nicht rückgängig machen",
+    "intro": "Dieser Vorgang ersetzt die Debian-Basis (Bookworm → Trixie) und den Proxmox-Softwarebestand auf dem bestehenden System. Es gibt <strong>keine Rückkehr zur alten Version</strong>. Vor dem Start:",
+    "items": [
+      "<strong>Geprüfte Sicherungen</strong> aller VMs und CTs (PBS, vzdump, ZFS-Snapshots — auch die Wiederherstellung prüfen).",
+      "<strong>Konsolen- / IPMI- / iKVM-Zugang</strong> zum Host, falls SSH während des Upgrades ausfällt.",
+      "Der Host ist bereits auf PVE 8.4.x auf dem neuesten Stand (das Skript erzwingt dies).",
+      "Ceph (falls vorhanden) auf der Version 19.x Squid.",
+      "Mindestens <strong>5 GB freier Speicher</strong> im Root-Dateisystem."
+    ]
+  },
+  "modeMenu": {
+    "heading": "Das Menü zur Modusauswahl",
+    "intro": "Die Option öffnet ein Menü mit vier Einträgen: Automatisch, Interaktiv, Vorabprüfung und Manuelle Anleitung. Drei Optionen <em>führen</em> das Upgrade aus oder erklären es; die separate Prüfung <em>kontrolliert</em> die Voraussetzungen und kann Reparaturen anbieten.",
+    "imageAlt": "Modusauswahl für das PVE-8-auf-9-Upgrade: Automatisch, Interaktiv, Vorabprüfung und Manuelle Anleitung"
+  },
+  "threeWays": {
+    "heading": "Drei Wege zum Upgrade",
+    "intro": "Automatisch und Interaktiv verwenden denselben Ablauf mit Vorabprüfung und abschließender Kontrolle. Sie unterscheiden sich beim Umgang mit dpkg-Rückfragen während <code>dist-upgrade</code>. Die manuelle Anleitung zeigt die Befehle samt Prüfungen; Sie müssen jeden Schritt selbst ausführen.",
+    "auto": {
+      "title": "Automatisch / unbeaufsichtigt",
+      "summary": "Setzt <code>ASSUME_YES=1</code> + <code>DEBIAN_FRONTEND=noninteractive</code>. Bei geänderten Konfigurationsdateien verwendet dpkg seine Standardaktion, sofern vorhanden; andernfalls wird <strong>die vorhandene Datei beibehalten</strong> (<code>--force-confold</code>).",
+      "items": [
+        "Am schnellsten — keine dpkg-Rückfragen während des Upgrades",
+        "Geeignet für Standardinstallationen ohne angepasste Konfigurationsdateien",
+        "Risiko: Eine angepasste Datei bleibt ohne Rückfrage erhalten und kann neue Standardwerte überlagern"
+      ]
+    },
+    "interactive": {
+      "title": "Interaktiv",
+      "summary": "Derselbe Ablauf, aber Sie beantworten jede dpkg-Rückfrage zu Konflikten bei Konfigurationsdateien. Langsamer, dafür mit voller Einsicht.",
+      "items": [
+        "Sie sehen jeden config Konflikt und entscheiden",
+        "Am besten, wenn Sie <code>/etc/lvm</code>, <code>/etc/ssh</code> usw. angepasst haben.",
+        "Konsultieren Sie die Tabelle der empfohlenen Antworten im manuellen Verfahren unten"
+      ]
+    },
+    "manual": {
+      "title": "Handbuch zur Aktualisierung",
+      "summary": "Zeigt das Verfahren in 17 Schritten nach dem offiziellen Proxmox-Wiki an, ohne es auszuführen. Führen Sie die Befehle selbst in einer separaten Shell aus.",
+      "items": [
+        "Maximale Kontrolle - Sie geben jeden Befehl ein",
+        "Am besten, wenn Sie das Verfahren lernen möchten oder nichts vertrauen",
+        "Das Skript zeigt die Schritte an; nichts wird automatisch ausgeführt"
+      ]
+    }
+  },
+  "precheckCallout": {
+    "title": "Plus einen separaten Pre-Check",
+    "body": "Option 3 — <strong>PVE-8-auf-9-Prüfung ausführen</strong> — startet die offizielle Prüfung <code>pve8to9 --full</code>, bietet geführte Reparaturen häufiger Probleme an und <strong>endet danach</strong>. Nutzen Sie sie vor dem Upgrade oder nach manuellen Reparaturen. Automatisch und Interaktiv führen sie ebenfalls aus; in der manuellen Anleitung führen Sie die Prüfung selbst aus."
+  },
+  "webTerminal": {
+    "heading": "Warum das Web-Terminal blockiert ist",
+    "body": "Alle drei Upgrade-Modi erkennen <code>termproxy</code> / <code>vncshell</code> in der Kette übergeordneter Prozesse und verweigern den Start. Das Proxmox-Webterminal wird von <code>pveproxy</code> bereitgestellt, einem Dienst, der beim Upgrade aktualisiert wird. Sobald <code>pveproxy</code> neu startet, endet die Terminalsitzung und damit auch das darin laufende Upgrade-Skript. Der Host kann unvollständig aktualisiert zurückbleiben.",
+    "warningTitle": "SSH oder eine physische / IPMI- / iKVM-Konsole verwenden",
+    "warningBody": "SSH ist die übliche Wahl. Starten Sie die Sitzung in <code>tmux</code> oder <code>screen</code>, damit das Upgrade kurze Netzunterbrechungen übersteht. Erkennt das Skript eine einfache SSH-Shell, zeigt es zu Beginn einen Hinweis auf tmux/screen an."
+  },
+  "auto": {
+    "heading": "Automatischer / unbeaufsichtigter Modus",
+    "intro": "Rückfragen zu Paketen und Konfigurationsdateien verwenden die Standardwerte aus der folgenden Tabelle, und ein 401 vom Enterprise-Repository wechselt ohne Rückfrage zu no-subscription. Die Upgrade-Bestätigung, die Zusammenfassung des PVE-8-Updates, Reparaturen der Vorabprüfung und die Neustart-Rückfrage werden weiterhin angezeigt.",
+    "behaviourHeading": "Besonderheiten des automatischen Modus",
+    "behaviourTable": {
+      "settingHeader": "Einstellung",
+      "effectHeader": "Wirkung",
+      "rows": [
+        {
+          "settingRich": "<code>ASSUME_YES=1</code>",
+          "effectRich": "Interner Schalter — das Skript beantwortet seine eigenen Ja/Nein-Rückfragen, etwa den Wechsel zu no-subscription nach einem 401"
+        },
+        {
+          "settingRich": "<code>DEBIAN_FRONTEND=noninteractive</code>",
+          "effectRich": "apt / dpkg laufen ohne debconf-Rückfragen"
+        },
+        {
+          "settingRich": "<code>--force-confdef</code>",
+          "effectRich": "Bei unveränderten Konfigurationsdateien: neue Version des Paketbetreuers installieren"
+        },
+        {
+          "settingRich": "<code>--force-confold</code>",
+          "effectRich": "Bei geänderten Dateien: Standardaktion von dpkg verwenden, sofern vorhanden; andernfalls <strong>Ihre Version beibehalten</strong>."
+        }
+      ]
+    },
+    "flowHeading": "Ablauf im automatischen Modus",
+    "flowIntro": "Sechs aufeinanderfolgende Phasen. Phase 2 aktualisiert die PVE-8-Pakete, Phase 3 schreibt die Repository-Konfiguration für PVE 9. Ein Fehler hält den Ablauf an, macht diese Änderungen aber nicht rückgängig; schlägt das PVE-8-Update fehl oder wird es abgebrochen, bleiben die Repositories unverändert. Phase 5 führt <code>dist-upgrade</code> auf PVE 9 aus.",
+    "flowDiagram": "1. PRÜFUNGEN\ntermproxy / vncshell blockieren; Upgrade bestätigen; PVE 9 ablehnen.\n\n2. PVE 8 VORBEREITEN\nscripts/global/update-pve8.sh\nPVE-8-Pakete aktualisieren; Abbruch, wenn das Update fehlschlägt oder abgebrochen wird.\npve8to9 --full (kann Reparaturen anbieten).\nSpeicher und Verbindung prüfen; Ceph 19.x Squid auf hyperkonvergenten Knoten.\n\n3. REPOSITORIES UMSTELLEN\nBookworm → Trixie; deb822-Dateien .sources schreiben.\nAlte .list-Dateien auskommentieren; apt-get update.\n\n4. PVE-9-KANDIDAT PRÜFEN\napt-cache policy proxmox-ve\napt-get -s dist-upgrade\nAbbruch, wenn der Kandidat nicht 9.x ist oder proxmox-ve entfernt würde.\n\n5. UPGRADE\napt-get -y -o Dpkg::Options::='--force-confdef' -o Dpkg::Options::='--force-confold' dist-upgrade\nOhne Subskription: pve-enterprise.sources deaktivieren.\nProtokoll: /var/log/pve8-a-pve9-'<'timestamp'>'.log\n\n6. PRÜFEN UND NEU STARTEN\nEFI: apt install grub-efi-amd64\npve8to9 --full; Ergebnis und Neustart-Rückfrage prüfen.",
+    "preflightHeading": "Vor dem Upgrade: diese Punkte werden geprüft",
+    "preflightTable": {
+      "checkHeader": "Prüfung",
+      "whyHeader": "Warum es wichtig ist",
+      "rows": [
+        {
+          "checkRich": "<strong>Webterminal-Sperre</strong>",
+          "whyRich": "Verhindert, dass das Upgrade seine eigene Shell beendet"
+        },
+        {
+          "checkRich": "<strong>Bereits auf 9.x</strong>",
+          "whyRich": "Abbruch, wenn der Host bereits PVE 9 ausführt (nichts zu tun)"
+        },
+        {
+          "checkRich": "<strong>Neueste PVE-8.4.x-Version</strong>",
+          "whyRich": "Aktualisiert PVE 8 zunächst mit dem PVE-8-Aktualisierungsskript auf den neuesten Stand; für ältere 8.x-Versionen gelten andere Voraussetzungen"
+        },
+        {
+          "checkRich": "<strong>pve8to9 --full</strong>",
+          "whyRich": "Proxmox-Prüfung der Upgrade-Voraussetzungen; FAIL-Meldungen blockieren das Upgrade bis zur Reparatur"
+        },
+        {
+          "checkRich": "<strong>Speicherplatz</strong>",
+          "whyRich": "≥ 1024 MB frei in <code>/var/cache/apt/archives</code> für heruntergeladene .deb-Dateien"
+        },
+        {
+          "checkRich": "<strong>Verbindungen</strong>",
+          "whyRich": "Ping auf <code>download.proxmox.com</code> — schlägt er fehl, wird nicht begonnen"
+        },
+        {
+          "checkRich": "<strong>Ceph 19.x Squid</strong>",
+          "whyRich": "Installiertes Ceph muss bereits 19.x verwenden. PVE 9 kann nicht mit Ceph 17/18 betrieben werden. Die Optionen <code>--ignore-ceph-check</code> und <code>--warn-ceph-check</code> umgehen die Prüfung; nutzen Sie sie nur mit entsprechendem Fachwissen."
+        }
+      ]
+    },
+    "distUpgradeHeading": "Der Befehl dist-upgrade (Auto-Modus)",
+    "distUpgradeCode": "apt-get -y \\\n    -o Dpkg::Options::='--force-confdef' \\\n    -o Dpkg::Options::='--force-confold' \\\n    dist-upgrade",
+    "distUpgradeOutro": "Die Ausgabe erscheint in Echtzeit auf stdout und wird zugleich in <code>/var/log/pve8-a-pve9-&lt;timestamp&gt;.log</code> gespeichert. Sie sehen alles; nur die Rückfragen entfallen.",
+    "postHeading": "Post-Upgrade-Aufgaben (Automodus)",
+    "postItems": [
+      "<strong>EFI-Hosts:</strong> installiert <code>grub-efi-amd64</code> gemäß dem bekannten Problem in der Proxmox-Dokumentation. Das Paket wird beim Upgrade nicht automatisch installiert und kann für den nächsten Start erforderlich sein.",
+      "<strong>Enterprise-Repository ohne Subskription.</strong> pve-manager 9 legt beim Upgrade <code>pve-enterprise.sources</code> an; im no-subscription-Modus setzt das Skript es auf <code>Enabled: false</code>.",
+      "<strong><code>pve8to9 --full</code> erneut ausführen.</strong> Zeigt verbliebene Probleme. Bei FAIL-Meldungen erscheint das gleiche Reparaturmenü wie bei der Vorabprüfung.",
+      "<strong>Neustart-Rückfrage.</strong> Ein Neustart wird empfohlen, um den neuen Kernel und die Dienste zu laden. Lehnen Sie ihn nur aus einem konkreten Grund ab; der alte Kernel nach einem Hauptversionswechsel birgt Risiken."
+    ]
+  },
+  "interactive": {
+    "heading": "Interaktiver Modus",
+    "intro": "Derselbe Ablauf wie im <autolink>automatischen Modus</autolink>: gleiche Vorabprüfungen, Repository-Umstellung und Abschlussprüfung. Der Unterschied liegt bei <code>dist-upgrade</code>: <strong>Sie beantworten jede dpkg-Rückfrage zu Konfigurationskonflikten selbst</strong>. ProxMenux verwendet <code>apt-get dist-upgrade</code> ohne die Optionen <code>--force-conf*</code>.",
+    "distUpgradeHeading": "Der Befehl dist-upgrade (interaktiver Modus)",
+    "distUpgradeCode": "apt-get dist-upgrade\n# (user answers each dpkg config-file conflict prompt as it appears)",
+    "whenHeading": "Wenn interaktiv die richtige Wahl ist",
+    "whenItems": [
+      "Sie haben <code>/etc/lvm/lvm.conf</code>, <code>/etc/ssh/sshd_config</code>, <code>/etc/default/grub</code> oder eine andere Konfigurationsdatei angepasst, die vom Upgrade berührt wird.",
+      "Sie möchten sehen, welche Pakete Konfigurationskonflikte verursachen, und für jede Datei einzeln entscheiden.",
+      "Sie aktualisieren einen Produktionshost, bei dem versteckte Änderungen inakzeptabel sind."
+    ],
+    "promptCalloutTitle": "Was bei jeder Aufforderung zu antworten",
+    "promptCalloutBody": "Hier gelten die gleichen Empfehlungen wie im manuellen Verfahren: siehe <dpkglink>Empfohlene Antworten auf dpkg-Rückfragen</dpkglink> weiter unten. Mit <strong>D</strong> zeigen Sie die Unterschiede an; mit <strong>Z</strong> öffnen Sie eine Shell."
+  },
+  "manual": {
+    "heading": "Manuelles Upgrade-Verfahren",
+    "intro": "Dies zeigt die Menüoption <strong>Manuelle Upgrade-Anleitung</strong>: die <wikilink>offizielle Proxmox-Anleitung für das Upgrade von 8 auf 9</wikilink>, in vier Phasen gegliedert. Das Skript <em>zeigt</em> die Befehle; Sie führen sie selbst in einer separaten Root-Shell aus. Volle Einsicht in jeden Schritt.",
+    "rootCalloutTitle": "Alle Befehle brauchen root",
+    "rootCalloutBody": "Verwenden Sie eine Root-Shell, auch für Umleitungen und Here-Dokumente. Bei <code>sudo</code> muss der gesamte Befehl mit Root-Rechten ausgeführt werden.",
+    "phase1Heading": "Phase 1 — Vorbereitung",
+    "phase1Intro": "PVE auf den neuesten Stand von 8.4.x bringen, Version und gegebenenfalls Ceph prüfen, die Proxmox-Vorabprüfung ausführen und einen Terminal-Multiplexer gegen Verbindungsabbrüche starten.",
+    "phase1Code": "# Step 1 — Update PVE 8 to the latest 8.4+\napt update && apt dist-upgrade -y\n\n# Step 2 — Verify version (must be 8.4.1 or newer)\npveversion\n\n# Step 2.1 — Hyper-converged Ceph: must already be on 19.x Squid\nceph --version\n# If older, follow https://pve.proxmox.com/wiki/Ceph_Reef_to_Squid\n\n# Step 3 — Run the official upgrade-readiness check\npve8to9 --full\n# If it warns about systemd-boot meta-package, remove it:\n#   apt remove systemd-boot\n\n# Step 4 — Start tmux or screen (so SSH disconnect doesn't kill the upgrade)\ntmux new-session -s upgrade\n# or\nscreen -S upgrade",
+    "phase2Heading": "Phase 2 — Repository-Umstellung",
+    "phase2Intro": "Alle Debian- und Proxmox-Repositories von Bookworm auf Trixie umstellen und Proxmox-Quellen ins deb822-Format überführen. <strong>Schritt 7 ODER 8 wählen</strong>, je nachdem, ob Sie ein Enterprise-Abonnement haben. Ohne Ceph Schritt 9 überspringen.",
+    "phase2Code": "# Step 5 — Debian: bookworm → trixie\nsed -i 's/bookworm/trixie/g' /etc/apt/sources.list\n\n# Step 6 — Same for the legacy enterprise list (only if you use enterprise)\nsed -i 's/bookworm/trixie/g' /etc/apt/sources.list.d/pve-enterprise.list\n\n# Step 7 — Add the new PVE 9 enterprise repo (deb822) — Enterprise users only\ncat > /etc/apt/sources.list.d/pve-enterprise.sources << EOF\nTypes: deb\nURIs: https://enterprise.proxmox.com/debian/pve\nSuites: trixie\nComponents: pve-enterprise\nSigned-By: /usr/share/keyrings/proxmox-archive-keyring.gpg\nEOF\n\n# Step 8 — OR add the no-subscription repo (most home / lab users)\ncat > /etc/apt/sources.list.d/proxmox.sources << EOF\nTypes: deb\nURIs: http://download.proxmox.com/debian/pve\nSuites: trixie\nComponents: pve-no-subscription\nSigned-By: /usr/share/keyrings/proxmox-archive-keyring.gpg\nEOF\n\n# Step 8.1 — Refresh and verify proxmox-ve candidate is 9.x\napt update && apt policy | sed -n '1,120p'\n\n# Step 9 — Update Ceph repo (only if you run Ceph)\ncat > /etc/apt/sources.list.d/ceph.sources << EOF\nTypes: deb\nURIs: http://download.proxmox.com/debian/ceph-squid\nSuites: trixie\nComponents: no-subscription\nSigned-By: /usr/share/keyrings/proxmox-archive-keyring.gpg\nEOF\n\n# Step 10 — Remove old .list files now superseded by deb822 .sources\nrm -f /etc/apt/sources.list.d/pve-enterprise.list /etc/apt/sources.list.d/ceph.list\n\n# Step 11 — Final apt update\napt update",
+    "phase3Heading": "Phase 3 — Das dist-upgrade",
+    "phase3Intro": "Das eigentliche Upgrade. Schritt 12 ist optional, aber empfohlen, um zahlreiche Audit-Meldungen zu unterdrücken. Schritt 13 dauert länger; beantworten Sie die dpkg-Rückfragen anhand der Tabelle. Schritt 13.1 betrifft nur EFI und folgt den offiziell bekannten Problemen.",
+    "phase3Code": "# Step 12 — Disable kernel audit messages (optional)\nsystemctl disable --now systemd-journald-audit.socket\n\n# Step 13 — The main upgrade (this takes a while)\napt dist-upgrade\n# (answer prompts using the table below)\n\n# Step 13.1 — EFI hosts: install grub for EFI (per known issues)\n[ -d /sys/firmware/efi ] && apt install grub-efi-amd64",
+    "dpkgHeading": "Empfohlene Antworten für die dpkg prompts",
+    "dpkgIntro": "Empfehlungen der offiziellen Proxmox-Anleitung: <strong>Y</strong> installiert die neue Datei des Paketbetreuers und überschreibt Ihre Datei; <strong>N</strong> behält Ihre Datei. Prüfen Sie bei Zweifeln zuerst die Unterschiede:",
+    "dpkgTable": {
+      "fileHeader": "Datei / prompt",
+      "answerHeader": "Empfohlene Antwort",
+      "whyHeader": "Warum",
+      "rows": [
+        {
+          "fileRich": "/etc/issue",
+          "answerRich": "<strong>N</strong> (vorhandene Datei behalten)",
+          "whyRich": "Die gewohnte Anmeldeinformation bleibt erhalten",
+          "fileFont": true
+        },
+        {
+          "fileRich": "/etc/lvm/lvm.conf",
+          "answerRich": "<strong>Y</strong> (Version des Paketbetreuers)",
+          "whyRich": "PVE 9 benötigt die neuen LVM-Standardwerte",
+          "fileFont": true
+        },
+        {
+          "fileRich": "/etc/ssh/sshd_config",
+          "answerRich": "<strong>Y</strong> bei reinen Standardänderungen; angepasste Dateien zuerst prüfen",
+          "whyRich": "Lokale SSH-Einstellungen prüfen und den Zugang sichern, bevor die Datei ersetzt wird. Standardänderungen betreffen umbenannte Optionen und Kommentare.",
+          "fileFont": true
+        },
+        {
+          "fileRich": "/etc/default/grub",
+          "answerRich": "<strong>N</strong>, falls angepasst",
+          "whyRich": "Hier stehen Startparameter, etwa für IOMMU und PCI-Passthrough",
+          "fileFont": true
+        },
+        {
+          "fileRich": "/etc/chrony/chrony.conf",
+          "answerRich": "<strong>Y</strong>, falls unverändert; lokale Einstellungen zuvor sichern",
+          "whyRich": "Trixie aktualisiert die Zeitsynchronisation. Lokale Einstellungen vor Übernahme der neuen Datei in chronys Verzeichnisse conf.d / sources.d verschieben.",
+          "fileFont": true
+        },
+        {
+          "fileRich": "Dienstneustarts während des Upgrades",
+          "answerRich": "<strong>Ja</strong> (Standard)",
+          "whyRich": "Die meisten Dienste werden ohne Neustart des Hosts neu geladen",
+          "fileFont": false
+        },
+        {
+          "fileRich": "<code>apt-listchanges</code>",
+          "answerRich": "<kbd>q</kbd> drücken",
+          "whyRich": "Beendet nur den Pager; angezeigt wird die Zusammenfassung des Änderungsprotokolls",
+          "fileFont": false
+        }
+      ]
+    },
+    "inspectCalloutTitle": "Prüfung eines spezifischen dpkg-Konflikts",
+    "inspectCalloutBody": "Bei einer dpkg-Rückfrage zu Konfigurationsdateien zeigt <strong>D</strong> die Unterschiede zwischen Ihrer Datei und der neuen Version; <strong>Z</strong> öffnet eine Shell für weitere Prüfungen. Beides hilft, eine fundierte Entscheidung zu treffen.",
+    "phase4Heading": "Phase 4 — Post-Upgrade",
+    "phase4Intro": "Erfolgreiches Upgrade prüfen, zum Laden des PVE-9-Kernels neu starten und die neue Version bestätigen. Verbliebene alte <code>.list</code>-Dateien können anschließend ins deb822-Format umgewandelt werden.",
+    "phase4Code": "# Step 14 — Re-run the readiness check (should be much cleaner now)\npve8to9 --full\n\n# Step 15 — Reboot to load the new kernel and PVE 9 daemons\nreboot\n\n# Step 16 — After reboot, confirm PVE 9.x\npveversion\n# Should show pve-manager/9.x.x\n\n# Step 17 — Optional: modernise the remaining legacy .list files to deb822\napt modernize-sources\n# (keeps .list backups as .bak)"
+  },
+  "clusterCeph": {
+    "heading": "Cluster & Ceph",
+    "clusterCalloutTitle": "Cluster: Upgrade-Knoten nacheinander",
+    "clusterCalloutBody": "Erkannt über <code>pvecm status</code>. <strong>Nicht</strong> mehrere Knoten gleichzeitig aktualisieren. Gäste zuerst verschieben, den Knoten aktualisieren, neu starten und die Cluster-Mitgliedschaft prüfen. Erst dann fortfahren. Während des Upgrades funktioniert Live-Migration von älteren zu neueren PVE-Versionen; die Gegenrichtung wird grundsätzlich nicht unterstützt. HA-Gruppen werden automatisch in HA-Regeln umgewandelt, sobald alle Knoten PVE 9 verwenden.",
+    "cephCalloutTitle": "Ceph: ZUERST Ceph, danach Proxmox aktualisieren",
+    "cephCalloutBody": "Ceph muss vor dem Proxmox-Upgrade bereits 19.x Squid verwenden. Folgen Sie der offiziellen Reihenfolge Quincy 17 → Reef 18 → Squid 19: Pakete aktualisieren und Ceph-Daemons schrittweise in der dokumentierten Reihenfolge neu starten. Vor dem Upgrade jedes Proxmox-Knotens <code>ceph --version</code> prüfen. Vollständiges Verfahren: <cephlink>Wiki zum Upgrade von Ceph Reef auf Squid</cephlink>."
+  },
+  "troubleshooting": {
+    "heading": "Fehlerbehebung",
+    "items": [
+      {
+        "title": "Skript bricht ab: \"This script cannot be executed from the Proxmox web terminal\"",
+        "bodyRich": "Eine SSH-Verbindung oder Konsole / IPMI / iKVM verwenden und dort erneut starten. Mit <code>tmux new -s pveupgrade</code> übersteht die Sitzung kurze Netzunterbrechungen."
+      },
+      {
+        "title": "pve8to9 meldet FAIL, automatische Reparatur mit Option 1 meldet \"command not found\"",
+        "bodyRich": "Erwähnt der Fehler <code>configure_repositories</code>, ist die Skriptkopie veraltet. Die aktuelle Reparatur verwendet cleanup_duplicate_repos und ensure_repositories. Kopie aktualisieren oder die manuellen Befehle mit Option 2 prüfen. <code>apt-get update</code> aktualisiert Paketlisten, behebt aber nicht jede blockierende Prüfung."
+      },
+      {
+        "title": "apt-Simulation meldet \"proxmox-ve will be REMOVED\"",
+        "bodyRich": "Die neuen Repositories sind nicht erreichbar oder die Umstellung des Codenamens fehlt. <code>cat /etc/apt/sources.list.d/proxmox.sources</code> prüfen: Bei <code>Suites:</code> muss <code>trixie</code> statt <code>bookworm</code> stehen. <code>apt-cache policy proxmox-ve</code> muss einen 9.x-Kandidaten aus dem neuen Repository anzeigen."
+      },
+      {
+        "title": "dist-upgrade scheitert teilweise",
+        "bodyRich": "Mit <code>apt-get -f install</code> beschädigte Abhängigkeiten beheben und das Upgrade erneut starten. Bei weiteren Fehlern die letzten Zeilen von <code>/var/log/pve8-a-pve9-&lt;timestamp&gt;.log</code> prüfen. Nicht neu starten, bevor <code>dpkg -l | grep ^iU</code> keine Ausgabe mehr liefert."
+      },
+      {
+        "title": "EFI-Host startet nicht nach dem Neustart",
+        "bodyRich": "Nach dem Upgrade wird <code>grub-efi-amd64</code> installiert. Falls dieser Schritt fehlte oder scheiterte, das Proxmox-Installations-ISO im Rettungsmodus starten, das Root-Dateisystem einhängen, chroot aufrufen und <code>apt-get install grub-efi-amd64 &amp;&amp; update-grub</code> ausführen."
+      },
+      {
+        "title": "GUI wird nach dem Upgrade nicht geladen",
+        "bodyRich": "<code>systemctl status pveproxy</code> und <code>systemctl restart pveproxy</code> ausführen. Besteht das Problem weiter, den Fehler mit <code>journalctl -u pveproxy -b</code> untersuchen."
+      },
+      {
+        "title": "Netzwerk funktioniert nicht nach dem Neustart",
+        "bodyRich": "Prüfen, ob <code>/etc/network/interfaces</code> vorhandene Geräte nennt und <code>ifupdown2</code> installiert ist: <code>apt install ifupdown2</code>. Bei geänderten Gerätenamen siehe <netlink>Persistente Schnittstellennamen</netlink>."
+      },
+      {
+        "title": "Split-Brain im Cluster nach dem Upgrade eines Knotens",
+        "bodyRich": "Gemischte Cluster mit PVE 8 und PVE 9 werden während des Upgrades unterstützt. Live-Migration von älteren zu neueren Versionen funktioniert; die Gegenrichtung wird grundsätzlich nicht unterstützt. Bei einem offline angezeigten Knoten <code>corosync</code> und die QDevice-/Netzkonfiguration prüfen. Mit <code>pvecm status</code> auf jedem Knoten das Quorum bestätigen."
+      }
+    ]
+  },
+  "files": {
+    "heading": "Beteiligte Dateien",
+    "code": "scripts/utilities/upgrade_pve8_to_pve9.sh                         # main upgrade orchestrator\nscripts/utilities/pve8to9_check.sh                                # pre-check (separate menu option)\nscripts/utilities/proxmox-upgrade-pve8-to-pve9-manual-guide.sh    # 17-step runbook\nscripts/global/update-pve8.sh                                     # PVE 8 worker (final patches)\n/etc/apt/sources.list                                             # bookworm → trixie sed\n/etc/apt/sources.list.d/proxmox.sources                           # created (deb822 PVE 9)\n/etc/apt/sources.list.d/debian.sources                            # created (deb822 trixie)\n/etc/apt/sources.list.d/ceph.sources                              # created if Ceph\n/etc/apt/sources.list.d/*.list                                    # legacy files commented out / removed\n/var/log/pve8-a-pve9-'<'timestamp'>'.log                              # full upgrade log"
+  },
+  "references": {
+    "heading": "Offizielle Quellen",
+    "intro": "Das manuelle Verfahren des Skripts folgt diesen offiziellen Quellen. Bei Zweifeln während eines Upgrades gilt das offizielle Wiki; ProxMenux unterstützt die Durchführung, maßgeblich ist Proxmox.",
+    "items": [
+      {
+        "href": "https://pve.proxmox.com/wiki/Upgrade_from_8_to_9",
+        "title": "Upgrade von 8 auf 9",
+        "desc": "Die Haupt-Proxmox-Wikiseite für das 8 → 9 Upgrade. Quelle der Wahrheit für jeden Befehl im manuellen Verfahren oben."
+      },
+      {
+        "href": "https://pve.proxmox.com/wiki/Ceph_Reef_to_Squid",
+        "title": "Upgrade auf Ceph Squid (19.x)",
+        "desc": "Erforderlicher Vorbereitungsschritt für hyperkonvergente Ceph-Knoten. Vor PVE 9 muss Ceph 19.x Squid laufen."
+      },
+      {
+        "href": "https://pve.proxmox.com/wiki/Roadmap",
+        "title": "Proxmox VE Fahrplan",
+        "desc": "Neuerungen von PVE 9 gegenüber 8.x. Vor dem Upgrade lesen, um die Änderungen zu kennen."
+      },
+      {
+        "href": "https://www.debian.org/releases/trixie/releasenotes",
+        "title": "Versionshinweise zu Debian Trixie",
+        "desc": "PVE 9 basiert auf Debian Trixie. Die Debian-Versionshinweise erläutern Änderungen am Betriebssystem, die auch Ihren Host betreffen."
+      },
+      {
+        "href": "https://forum.proxmox.com/forums/proxmox-ve-installation-and-configuration.16/",
+        "title": "Proxmox VE Installationsforum",
+        "desc": "Bei Problemen während des Upgrades zuerst dieses Forum durchsuchen. Möglicherweise ist das gleiche Problem bereits beschrieben."
+      },
+      {
+        "href": "https://pve.proxmox.com/wiki/Backup_and_Restore",
+        "title": "Backup und Restore",
+        "desc": "Ein Major-Version-Upgrade ist nicht reversibel. Überprüfen Sie Ihre Backup-Disziplin vor dem Start."
+      }
+    ]
+  },
+  "video": {
+    "heading": "Videoanleitung",
+    "intro": "Bevor Sie das Upgrade Ende-zu-Ende laufen sehen, bevor Sie es selbst tun? Dieser Walkthrough zeigt den ProxMenux Upgrade-Flow in Echtzeit.",
+    "title": "ProxMenux — Videoanleitung zum Upgrade von Proxmox VE 8 auf 9",
+    "caption": "Externes YouTube-Video. Wiedergabe im erweiterten Datenschutzmodus; Cookies erst nach dem Start der Wiedergabe."
+  },
+  "related": {
+    "heading": "Verwandte Themen",
+    "items": [
+      {
+        "href": "/docs/utils/system-update",
+        "label": "Proxmox-Systemupdate",
+        "tail": " — für reguläre Aktualisierungen innerhalb einer Hauptversion (8.4.1 → 8.4.5 usw.)."
+      },
+      {
+        "href": "/docs/utils",
+        "label": "Übersicht der Dienstprogramme",
+        "tail": " — zurück zur Abschnittsübersicht."
+      }
+    ]
+  }
+}
diff --git a/web/messages/de/docs/utils/uup-dump-iso-creator.json b/web/messages/de/docs/utils/uup-dump-iso-creator.json
new file mode 100644
index 00000000..5095772d
--- /dev/null
+++ b/web/messages/de/docs/utils/uup-dump-iso-creator.json
@@ -0,0 +1,161 @@
+{
+  "meta": {
+    "title": "UUP-Dump-ISO-Erstellung | ProxMenux-Dokumentation",
+    "description": "Erstellen Sie mit der ProxMenux-UUP-Dump-ISO-Erstellung eine aktuelle Windows-Installations-ISO auf Ihrem Proxmox-Host. Installation der Abhängigkeiten, Download und Umwandlung der UUP-Dateien in eine bootfähige ISO für die VM-Erstellung werden automatisiert.",
+    "ogTitle": "UUP-Dump-ISO-Erstellung | ProxMenux-Dokumentation",
+    "ogDescription": "Erstellen Sie mit ProxMenux eine aktuelle Windows-ISO aus UUP Dump. Abhängigkeiten, Download und Umwandlung werden vollständig automatisiert.",
+    "ogImageAlt": "ProxMenux — UUP-Dump-ISO-Erstellung"
+  },
+  "header": {
+    "title": "UUP-Dump-ISO-Erstellung",
+    "description": "Erstellen Sie mit UUP Dump eine aktuelle Windows-Installations-ISO auf Ihrem Proxmox-Host. ProxMenux verwaltet die Abhängigkeiten, lädt UUP-Dateien parallel herunter, führt den UUP-Dump-Konverter aus und verschiebt die ISO in das gewählte Ausgabeverzeichnis. Voreingestellt ist der erkannte Proxmox-ISO-Speicher.",
+    "section": "Dienstprogramme"
+  },
+  "intro": {
+    "title": "Was dieses Skript macht",
+    "body": "Geben Sie eine von uupdump.net nach Auswahl von Build, Sprache und Edition erzeugte URL an. Das Skript installiert fehlende Abhängigkeiten, lädt den UUP-Dump-Konverter und die UUP-Dateien herunter, erstellt eine bootfähige Windows-ISO und verschiebt sie in das gewählte Ausgabeverzeichnis. Als Standardziel wird der erkannte Proxmox-ISO-Speicher angeboten."
+  },
+  "hero": {
+    "imageAlt": "UUP Dump ISO Creator Eintrag in ProxMenux",
+    "caption": "UUP Dump ISO Creator Eintrag in ProxMenux"
+  },
+  "what": {
+    "heading": "Was ist UUP Dump?",
+    "intro": "UUP Dump ist ein Community-Dienst zum Herunterladen der ursprünglichen Unified-Update-Platform-Dateien (UUP), mit denen Windows Update Windows bereitstellt. Daraus lässt sich eine normale bootfähige ISO erstellen. So erhalten Sie:",
+    "items": [
+      "Der neueste Windows-Build (einschließlich Insider Preview-Kanäle).",
+      "Ein spezifischer historischer Build, der nicht mehr auf der Download-Seite von Microsoft aufgeführt ist.",
+      "Saubere, unveränderte Dateien, die direkt von den Servern von Microsoft stammen.",
+      "Die genaue Kombination von Editionen und Sprachen, die Sie in einer einzigen ISO wünschen."
+    ],
+    "learnMore": "Erfahren Sie mehr auf der <extlink>UUP Dump Projektseite</extlink>."
+  },
+  "automates": {
+    "heading": "Was das Skript automatisiert"
+  },
+  "dependencies": {
+    "heading": "Abhängigkeiten",
+    "intro": "Das erste, was das Skript tut, ist die Suche nach den Tools, die zum Herunterladen von UUP-Nutzlasten und zum Zusammenbauen der ISO erforderlich sind. Alle, die fehlen, werden mit <code>apt-get</code> installiert:",
+    "headerPackage": "Paket",
+    "headerRole": "Rolle",
+    "rows": [
+      {
+        "pkg": "curl",
+        "roleRich": "HTTP-Downloads für den Start des Konverters."
+      },
+      {
+        "pkg": "aria2",
+        "roleRich": "Paralleler Downloader für alle UUP-Dateien."
+      },
+      {
+        "pkg": "cabextract",
+        "roleRich": "Extrahiert Microsoft CAB-Pakete."
+      },
+      {
+        "pkg": "wimtools",
+        "roleRich": "Erstellt <code>install.wim</code> (wimlib-imagex)."
+      },
+      {
+        "pkg": "genisoimage",
+        "roleRich": "Schreibt die endgültige bootfähige ISO (oder <code>mkisofs</code>)."
+      },
+      {
+        "pkg": "chntpw",
+        "roleRich": "Passt Windows-Registrierungsstrukturen während der Erstellung an."
+      }
+    ],
+    "manualIntro": "Manuelles Äquivalent - wenn Sie sie jemals selbst installieren müssen:",
+    "manualCode": "apt-get install curl aria2 cabextract wimtools genisoimage chntpw"
+  },
+  "flow": {
+    "heading": "Download und Konvertierung",
+    "steps": [
+      "Erkennt den Proxmox ISO-Speicher (über <code>pvesm status -content iso</code>) oder fällt auf <code>/var/lib/vz/template/iso</code> zurück.",
+      "Bittet um einen Basisordner für temporäre Dateien (Standard <code>/root/uup-temp</code>).",
+      "Lädt den UUP-Dump-Konverter von <code>git.uupdump.net</code> herunter.",
+      "Liest <code>id</code>, <code>pack</code> und <code>edition</code> aus der eingefügten URL.",
+      "Ruft <code>https://uupdump.net/get.php?…&aria2=2</code> auf, um eine aria2-Downloadliste zu erstellen.",
+      "Lädt alle UUP-Dateien mit aria2 nach <code>UUPs/</code> herunter, parallel und fortsetzbar.",
+      "Führt <code>convert.sh wim UUPs 1</code> aus dem Konverter aus, um die fertige ISO zu erstellen.",
+      "Verschiebt die ISO in das gewählte Ausgabeverzeichnis und entfernt temporäre Dateien."
+    ]
+  },
+  "aria2": {
+    "heading": "Verwendete aria2-Downloadoptionen",
+    "code": "aria2c --no-conf --console-log-level=warn --log-level=info \\\n  --log=aria2_download.log \\\n  -x16 -s16 -j5 -c -R \\\n  -d\"$destDir\" -i\"$tempScript\"",
+    "flags": [
+      "<code>-x16</code> — bis zu 16 Verbindungen pro Server.",
+      "<code>-s16</code> — teilt jede Datei in 16 Segmente.",
+      "<code>-j5</code> — 5 Dateien, die parallel heruntergeladen wurden.",
+      "<code>-c</code> — nimmt teilweise Downloads wieder auf.",
+      "<code>-R</code> — übernimmt den Zeitstempel der entfernten Datei für die heruntergeladene Datei, falls verfügbar."
+    ],
+    "runtime": "Die typische Laufzeit beträgt etwa 10 Minuten und hängt vor allem von der Internetgeschwindigkeit und der Auslastung der UUP-Dump-Downloadserver ab."
+  },
+  "step1": {
+    "heading": "Schritt 1 · Erhalten Sie eine UUP Dump URL",
+    "intro": "Bevor Sie das Skript ausführen, benötigen Sie eine UUP-Dump-URL, die die Abfrageparameter <code>id</code>, <code>pack</code> und <code>edition</code> enthält. Generieren Sie es auf <extlink>uupdump.net</extlink>:",
+    "stepBadge": "Schritt",
+    "items": [
+      {
+        "title": "Wählen Sie eine Windows-Version",
+        "img": "/iso-creator/step-1-select-version-windows.png",
+        "caption": "UUP Dump Hauptseite - Wählen Sie eine Windows-Version",
+        "body": "Öffnen Sie die UUP Dump-Homepage und wählen Sie die gewünschte Windows-Version aus."
+      },
+      {
+        "title": "Wählen Sie einen bestimmten Build",
+        "img": "/iso-creator/step-2-select-version-windows.png",
+        "caption": "Wählen Sie einen bestimmten Build",
+        "body": "Wählen Sie den gewünschten Build: den neuesten, einen aus einem Insider-Preview-Kanal oder einen noch aufgeführten älteren Build."
+      },
+      {
+        "title": "Wählen Sie eine Sprache",
+        "img": "/iso-creator/step-3-select-version-windows.png",
+        "caption": "Wählen Sie eine Sprache",
+        "body": "Wählen Sie die Sprache für die ISO."
+      },
+      {
+        "title": "Editionen auswählen",
+        "img": "/iso-creator/step-4-select-version-windows.png",
+        "caption": "Wählen Sie die aufzunehmenden Editionen",
+        "body": "Wählen Sie die Editionen aus, um sie in die ISO zu bündeln (Home, Pro, Enterprise, ...). Sie können mehrere kombinieren."
+      },
+      {
+        "title": "Kopieren der URL",
+        "img": "/iso-creator/step-5-select-version-windows.png",
+        "caption": "Kopieren der URL aus der Adressleiste",
+        "bodyRich": "Kopieren Sie auf der letzten Seite die URL <em>aus der Adressleiste des Browsers</em>. Sie muss <code>id=…</code>, <code>pack=…</code> und <code>edition=…</code> enthalten. Das Skript liest diese Zeichenfolge aus."
+      }
+    ]
+  },
+  "step2": {
+    "heading": "Schritt 2 · ISO-Erstellung starten",
+    "intro": "Mit der URL in der Hand, öffnen Sie ProxMenux und starten Sie den Creator:",
+    "stepBadge": "Schritt",
+    "items": [
+      {
+        "title": "Starten Sie UUP Dump ISO Creator",
+        "img": "/iso-creator/start-uupdump-iso-creator.png",
+        "caption": "Starten Sie UUP Dump ISO Creator von ProxMenux",
+        "bodyRich": "Öffnen Sie in ProxMenux <strong>Utilities → UUP Dump ISO Creator</strong>. Das Skript prüft vor der Eingabeaufforderung die Abhängigkeiten und das ISO-Speicherverzeichnis."
+      },
+      {
+        "title": "Fügen Sie die UUP Dump URL ein",
+        "img": "/iso-creator/add-url-iso-creator.png",
+        "caption": "Fügen Sie die von uupdump.net kopierte URL ein",
+        "body": "Fügen Sie die URL in den Eingabedialog ein. Das Skript bestätigt, dass die drei erforderlichen Parameter vorhanden sind; wenn eines fehlt, wird es sauber abgebrochen."
+      },
+      {
+        "title": "Warten Sie, bis der Build fertig ist",
+        "img": "/iso-creator/end-uupdump-iso-creator.png",
+        "caption": "Build fertig - ISO ist bereit im Proxmox ISO-Speicher",
+        "bodyRich": "Die Konsole zeigt den aria2-Fortschritt und anschließend die Ausgabe des Konverters. Die fertige ISO wird in das gewählte Ausgabeverzeichnis verschoben. Liegt sie in einem konfigurierten Proxmox-ISO-Speicher, lässt sie sich unter <strong>Windows-VM erstellen → Mit persönlicher ISO installieren</strong> auswählen."
+      }
+    ]
+  },
+  "tempFiles": {
+    "title": "Temporäre Dateien",
+    "body": "Der temporäre Standardordner ist <code>/root/uup-temp</code>. Downloads liegen in <code>UUPs/</code>, der Konverter in <code>converter/</code>. Bei einem eigenen Basispfad wird ein separates Sitzungsunterverzeichnis angelegt. Nach erfolgreicher Erstellung oder im Zweig ohne erzeugte ISO wird die temporäre Sitzung entfernt. Bei früheren Fehlern oder einem Abbruch können temporäre Dateien zurückbleiben."
+  }
+}
diff --git a/web/messages/de/guides/backup-cloud.json b/web/messages/de/guides/backup-cloud.json
new file mode 100644
index 00000000..ebd26a61
--- /dev/null
+++ b/web/messages/de/guides/backup-cloud.json
@@ -0,0 +1,119 @@
+{
+  "meta": {
+    "title": "Proxmox-Sicherungen in persönlichem Cloud-Speicher | ProxMenux",
+    "description": "Mit rclone einen persönlichen Cloud-Speicher wie Google Drive, Mega, Dropbox oder OneDrive als Verzeichnis auf dem Proxmox-VE-Host einhängen, als Sicherungsspeicher für vzdump registrieren und VMs sowie Container direkt in die Cloud sichern — ohne zusätzliches Sicherungsskript.",
+    "ogTitle": "Proxmox-Sicherungen in persönlichem Cloud-Speicher",
+    "ogDescription": "Mit rclone Cloud-Speicher auf dem Proxmox-VE-Host einhängen und als vzdump-Ziel für Sicherungen von VMs und Containern verwenden."
+  },
+  "header": {
+    "title": "Proxmox-Sicherungen in persönlichem Cloud-Speicher",
+    "description": "Mit rclone einen persönlichen Cloud-Speicher wie Google Drive, Mega, Dropbox oder OneDrive als Verzeichnis auf dem Proxmox-VE-Host einhängen, als Sicherungsspeicher für vzdump registrieren und VMs sowie Container direkt in die Cloud sichern — ohne zusätzliches Sicherungsskript.",
+    "section": "Leitfäden"
+  },
+  "intro": {
+    "pbsCalloutTitle": "Ziehen Sie zuerst Proxmox Backup Server in Betracht",
+    "pbsCalloutBody": "Auf einem zweiten Rechner, der die x86-64-Anforderungen erfüllt, bietet <pbsLink>Proxmox Backup Server</pbsLink> inkrementelle, deduplizierte Sicherungen mit optionaler clientseitiger Verschlüsselung. Er ist für VM-Sicherungen ausgelegt. Diese Anleitung beschreibt stattdessen das Einhängen von Cloud-Speicher wie Google Drive, Mega, OneDrive oder Dropbox als Sicherungsziel.",
+    "stepsTitle": "Was Sie einrichten",
+    "steps": [
+      "Ein Verzeichnis auf dem Proxmox-Host erstellen und als Speicher für vzdump-Sicherungen registrieren.",
+      "Installieren und konfigurieren Sie rclone für Ihren Cloud-Anbieter.",
+      "Montieren Sie den Cloud-Ordner in das Verzeichnis.",
+      "Den Cloud-Speicher bei jedem Systemstart mit einer systemd-Einheit einhängen."
+    ],
+    "vzdumpCalloutTitle": "Hinweis zu vzdump-Sicherungen in Proxmox",
+    "vzdumpCalloutBody": "Proxmox-vzdump-Archive sind <strong>Vollsicherungen, keine inkrementellen Sicherungen</strong>. Ihre tatsächliche Größe hängt von den enthaltenen Daten und der Komprimierung ab, nicht allein von der Kapazität des virtuellen Datenträgers. Belegt ein Archiv 30 GB, benötigen fünf aufbewahrte Archive ungefähr 150 GB. Legen Sie eine Aufbewahrungsrichtlinie fest, damit der Cloud-Speicher nicht vollläuft."
+  },
+  "createDir": {
+    "heading": "1. Verzeichnis auf dem Host erstellen und als Sicherungsspeicher registrieren",
+    "body": "Verbinden Sie sich per SSH mit dem Host oder öffnen Sie die Proxmox-Shell. Erstellen Sie unter <code>/mnt/</code> ein Verzeichnis als Einhängepunkt. Wählen Sie einen Namen, der den Anbieter erkennen lässt:",
+    "mkdirCode": "mkdir -p /mnt/gdrive",
+    "afterMkdir": "Im Proxmox Web UI: <strong>Datacenter → Storage → Add → Directory</strong>.",
+    "image1Alt": "Hinzufügen von neuem Speicher in Proxmox",
+    "configIntro": "Konfigurieren Sie es so:",
+    "configItems": [
+      "<strong>ID: </strong> <code>gdrive</code> (oder was auch immer Sie für den Verzeichnisnamen verwendet haben)",
+      "<strong>Verzeichnis:</strong> <code>/mnt/gdrive</code>",
+      "<strong>Inhalt:</strong> Wählen Sie <strong>VZDump-Sicherungsdatei</strong>."
+    ],
+    "image2Alt": "Konfiguration eines neuen Speichers in Proxmox",
+    "afterConfig": "Klicken Sie auf <strong>Hinzufügen</strong>:",
+    "image3Alt": "Neuer Speicher in Proxmox hinzugefügt",
+    "afterAdd": "Das Verzeichnis ist nun als Proxmox-Speicher registriert. Es ist noch leer, da der Cloud-Speicher bisher nicht eingehängt wurde."
+  },
+  "installRclone": {
+    "heading": "2. rclone installieren und konfigurieren",
+    "body": "<rcloneLink>rclone</rcloneLink> verbindet sich mit Cloud-Speicheranbietern. Installieren Sie es aus den Debian-Paketquellen:",
+    "installCode": "apt-get update\napt-get install -y rclone",
+    "newerCalloutTitle": "Wenn Sie ein neueres rclone benötigen",
+    "newerCalloutBody": "Wenn Sie eine neuere Version als die in Debian benötigen, verwenden Sie den offiziellen Installer:",
+    "newerCode": "curl https://rclone.org/install.sh | bash",
+    "tunnelHeading": "2.1 Browserbasierte Authentifizierung über SSH-Tunnel",
+    "tunnelBody": "Bei Anbietern mit Browser-Anmeldung fehlt auf dem Proxmox-Host meist ein Browser. Folgen Sie der <remoteSetupLink>rclone-Anleitung zur Ferneinrichtung</remoteSetupLink>: Nutzen Sie den Browser Ihres Laptops und leiten Sie dessen lokale Rückrufverbindung per SSH an rclone auf dem Host weiter.",
+    "tunnelFrom": "Auf Ihrem <strong>Laptop</strong>, wobei Sie <code>ip_proxmox</code> durch die Proxmox-IP ersetzen:",
+    "tunnelCode": "ssh -L localhost:53682:localhost:53682 root@ip_proxmox",
+    "tunnelAfter": "Diese SSH-Sitzung öffnet den lokalen Port 53682 auf Ihrem Laptop und leitet Verbindungen an denselben Port des Proxmox-Hosts weiter. Lassen Sie sie während der rclone-Konfiguration geöffnet.",
+    "runHeading": "2.2 rclone config ausführen",
+    "runBody": "Führen Sie in der gerade geöffneten SSH-Sitzung Folgendes aus:",
+    "runCode": "rclone config",
+    "runAfter": "Folgen Sie den Anweisungen zum Hinzufügen einer neuen Remote-Konfiguration. Die Antworten hängen vom Anbieter ab; beachten Sie die <providerDocsLink>rclone-Anbieterdokumentation</providerDocsLink> für Google Drive, Mega, Dropbox, OneDrive usw. Entscheidend ist die Frage zur Authentifizierung:",
+    "authPrompt": "Use web browser to automatically authenticate rclone with remote?\n * Say Y if the machine running rclone has a web browser you can use\n * Say N if running rclone on a (remote) machine without web browser access\nIf not sure try Y. If Y failed, try N.\ny) Yes\nn) No\ny/n> y",
+    "authAfter": "Antworten Sie mit <strong>Y</strong>. rclone zeigt eine lokale URL an. Öffnen Sie sie im <strong>Browser Ihres Laptops</strong>; der SSH-Tunnel leitet die Verbindung weiter. Erlauben Sie rclone den Zugriff beim Cloud-Anbieter, um die Konfiguration abzuschließen.",
+    "nameRemote": "Wählen Sie als Namen der Remote-Konfiguration einen zum Verzeichnis passenden Namen, etwa <code>gdrive</code>."
+  },
+  "mount": {
+    "heading": "3. Cloud-Ordner einhängen",
+    "body": "Erstellen Sie in Ihrem Cloud-Speicher einen Ordner für die Sicherungen, zum Beispiel <code>PBC</code> für Proxmox Backup Cloud.",
+    "mountIntro": "Hängen Sie ihn im Verzeichnis auf dem Host ein:",
+    "mountCode": "rclone mount gdrive:/PBC /mnt/gdrive --allow-other --allow-non-empty --vfs-cache-mode writes",
+    "mountItems": [
+      "<code>gdrive:/PBC</code> - der Ordner in Ihrer Cloud.",
+      "<code>/mnt/gdrive</code> - das Hostverzeichnis, das Sie als Datenspeicher registriert haben."
+    ],
+    "mountFootnote": "<strong>Dieser Befehl läuft im Vordergrund.</strong> Lassen Sie ihn zum Testen in einem Terminal laufen und erstellen Sie eine Sicherung. Für das automatische Einhängen bei jedem Systemstart richten Sie anschließend eine systemd-Einheit ein."
+  },
+  "systemd": {
+    "heading": "4. Automatisch bei jedem Systemstart einhängen (systemd)",
+    "body": "Eine systemd-Einheit bietet mehr Kontrolle als <code>crontab @reboot</code>: Sie kann den Netzwerkstart abwarten, bei Fehlern neu starten und Protokolle über <code>journalctl</code> bereitstellen.",
+    "createIntro": "Erstellen Sie die Unit-Datei:",
+    "createCode": "nano /etc/systemd/system/rclone-gdrive.service",
+    "pasteIntro": "Einfügen:",
+    "unitCode": "[Unit]\nDescription=rclone mount for Proxmox cloud backups\nWants=network-online.target\nAfter=network-online.target\n\n[Service]\nType=notify\nExecStart=/usr/bin/rclone mount \\\n    gdrive:/PBC /mnt/gdrive \\\n    --allow-other \\\n    --allow-non-empty \\\n    --vfs-cache-mode writes \\\n    --log-level INFO \\\n    --log-file /var/log/rclone-gdrive.log\nExecStop=/bin/fusermount -uz /mnt/gdrive\nRestart=on-failure\nRestartSec=10\n\n[Install]\nWantedBy=multi-user.target",
+    "adjust": "Passen Sie <code>gdrive:/PBC</code> und <code>/mnt/gdrive</code> an, falls Sie andere Namen verwenden. Speichern Sie, verlassen Sie den Editor mit <code>Ctrl+X</code> und aktivieren und starten Sie den Dienst:",
+    "enableCode": "systemctl daemon-reload\nsystemctl enable --now rclone-gdrive.service",
+    "verifyIntro": "Überprüfung:",
+    "verifyCode": "systemctl status rclone-gdrive.service\nmount | grep /mnt/gdrive",
+    "verifyAfter": "Die Unit fordert nach 10 Sekunden einen Neustart an, wenn der rclone-Prozess mit einem Fehler endet. Das repariert keine abgelaufenen Zugangsdaten und garantiert keine Behebung aller Netzwerk- oder Anbieterfehler. Prüfen Sie <code>/var/log/rclone-gdrive.log</code> und <code>journalctl -u rclone-gdrive.service -f</code>.",
+    "vfsCalloutTitle": "Warum --vfs-cache-mode writes?",
+    "vfsCalloutBody": "Mit Schreibcache landen Schreibzugriffe wie <code>fwrite</code> zunächst im lokalen Datenträgercache. rclone lädt eine Datei nach dem Schließen und Ablauf der Schreibverzögerung hoch. Halten Sie genügend lokalen Platz für laufende Sicherungen frei und prüfen Sie den abgeschlossenen Upload, bevor Sie die Cloud-Kopie als verfügbar ansehen."
+  },
+  "configureBackup": {
+    "heading": "5. Cloud-Speicher als Sicherungsziel einrichten",
+    "body": "Wählen Sie in Proxmox bei einer geplanten oder manuell gestarteten Sicherung den registrierten Speicher als <strong>Ziel</strong>:",
+    "image5Alt": "Backup-Ziel in Proxmox auswählen",
+    "after": "Warten Sie nach Abschluss von vzdump auf das Ende des rclone-Uploads im Hintergrund und prüfen Sie das Archiv in der Oberfläche des Cloud-Anbieters:",
+    "image6Alt": "Backup-Datei im Cloud Storage"
+  },
+  "retention": {
+    "heading": "6. Aufbewahrung — Cloud-Speicherplatz im Blick behalten",
+    "body": "Proxmox-vzdump-Archive sind <strong>Vollsicherungen, keine inkrementellen Sicherungen</strong>. Ihre tatsächliche Größe hängt von den enthaltenen Daten und der Komprimierung ab, nicht allein von der Kapazität des virtuellen Datenträgers. Belegt ein Archiv 30 GB, benötigen fünf aufbewahrte Archive ungefähr 150 GB. Legen Sie eine Aufbewahrungsrichtlinie fest, damit der Cloud-Speicher nicht vollläuft.",
+    "uiPath": "In der Proxmox-Oberfläche: <strong>Rechenzentrum → Sicherung → [Ihr Auftrag] → Aufbewahrung</strong>:",
+    "image7Alt": "Aufbewahrungseinstellungen für Sicherungen in Proxmox",
+    "starterIntro": "Mögliche Ausgangswerte für eine Heim- oder Testumgebung:",
+    "starterItems": [
+      "Die letzten 5 täglichen Sicherungen aufbewahren",
+      "Die letzten 4 wöchentlichen Sicherungen aufbewahren",
+      "Die letzten 6 monatlichen Sicherungen aufbewahren"
+    ],
+    "adjust": "Passen Sie die Werte an Ihr Cloud-Kontingent und die Änderungshäufigkeit der VMs an."
+  },
+  "troubleshoot": {
+    "heading": "Fehlerbehebung",
+    "items": [
+      "<strong><code>Mount point /mnt/gdrive is itself on a fuse.rclone filesystem</code>:</strong> Das Verzeichnis ist bereits eingehängt, möglicherweise durch eine andere rclone-Instanz. Prüfen Sie, dass keine Sicherung läuft, bevor Sie den alten Mount mit <code>fusermount -uz /mnt/gdrive</code> entfernen. Starten Sie danach die systemd-Einheit neu.",
+      "<strong>Die Sicherung ist sehr langsam:</strong> Prüfen Sie <code>--vfs-cache-mode writes</code> in der Zeile <code>ExecStart</code>, die Leistung des lokalen Caches, die Upload-Bandbreite und Anbieterlimits. Der Upload kann nach Abschluss von vzdump weiterlaufen.",
+      "<strong>Die Sicherung meldet No space left on device:</strong> Prüfen Sie lokalen Cache-Platz und Cloud-Kontingent. Der Cache liegt meist unter <code>~/.cache/rclone/</code>. Wählen Sie bei Platzmangel etwa <code>--cache-dir /var/cache/rclone</code> auf einem Dateisystem mit genügend Platz. Ein anderer Pfad auf demselben vollen Dateisystem hilft nicht.",
+      "<strong>Das rclone-Anmeldetoken ist abgelaufen:</strong> Verbinden Sie sich erneut per SSH mit dem Tunnel (<code>ssh -L localhost:53682:localhost:53682 root@ip_proxmox</code>) und führen Sie <code>rclone config reconnect gdrive:</code> aus, um die Anmeldung zu erneuern.",
+      "<strong>Sicherungen sind in der Cloud vorhanden, lassen sich aber nicht korrekt wiederherstellen:</strong> Nutzen Sie Cloud-Speicher nicht als <strong>einziges</strong> Sicherungsziel. Ergänzen Sie ihn durch lokales PBS oder vzdump auf einem anderen Datenträger."
+    ]
+  }
+}
diff --git a/web/messages/de/guides/index.json b/web/messages/de/guides/index.json
new file mode 100644
index 00000000..ae4c53ea
--- /dev/null
+++ b/web/messages/de/guides/index.json
@@ -0,0 +1,118 @@
+{
+  "meta": {
+    "title": "Proxmox-VE-Anleitungen — Coral TPU, NVIDIA, Kodi in LXC, Samba, Cloud-Backups | ProxMenux",
+    "description": "Ausführliche Proxmox-VE-Anleitungen: Kodi in einem LXC-Container mit GPU-Beschleunigung, NVIDIA-Treiber auf PVE 9, USB-Laufwerke per Samba im Container und vzdump-Sicherungen in Google Drive, Mega, Dropbox oder OneDrive. Dazu ausgewählte Community-Ressourcen, Glossar und Befehlsreferenz.",
+    "ogTitle": "Proxmox-VE-Anleitungen — Coral TPU, NVIDIA, Kodi in LXC, Samba und Cloud-Backups",
+    "ogDescription": "Ausführliche Proxmox-VE-Anleitungen zu GPU-Durchreichung, Kodi als LXC-Mediacenter, per Samba freigegebenen USB-Laufwerken und Cloud-Backups mit rclone sowie ausgewählte Community-Ressourcen.",
+    "twitterTitle": "Proxmox-VE-Anleitungen | ProxMenux",
+    "twitterDescription": "Ausführliche Proxmox-VE-Anleitungen zu GPUs, Kodi in LXC, Samba, Cloud-Backups und weiteren Themen.",
+    "ogImageAlt": "ProxMenux-Anleitungen — ausführliche Tutorials für Proxmox VE"
+  },
+  "header": {
+    "title": "ProxMenux-Anleitungen",
+    "tagline": "Ausführliche Anleitungen, Kurzreferenzen und ausgewählte Community-Ressourcen, um Proxmox VE optimal zu nutzen."
+  },
+  "inDepth": {
+    "heading": "Ausführliche Anleitungen",
+    "intro": "Ausführliche Anleitungen für konkrete Proxmox-Aufgaben. Jede beschreibt die manuellen Schritte eines automatisierten ProxMenux-Ablaufs, damit Sie jeden Schritt nachvollziehen können.",
+    "items": [
+      {
+        "slug": "kodi-lxc",
+        "title": "Kodi in LXC mit GPU-Beschleunigung installieren und an Monitor oder Fernseher anschließen",
+        "description": "Kodi in einem privilegierten LXC-Container unter Proxmox VE ausführen, die iGPU und USB-Eingabegeräte des Hosts zugänglich machen und den Server als Mediacenter direkt an einen Fernseher anschließen."
+      },
+      {
+        "slug": "backup-cloud",
+        "title": "Proxmox-Sicherungen in persönlichem Cloud-Speicher",
+        "description": "Mit rclone einen persönlichen Cloud-Speicher wie Google Drive, Mega, Dropbox oder OneDrive als Verzeichnis auf dem Proxmox-VE-Host einhängen, als Sicherungsspeicher für vzdump registrieren und VMs sowie Container direkt in die Cloud sichern — ohne zusätzliches Sicherungsskript."
+      },
+      {
+        "slug": "lxc-samba",
+        "title": "USB-Festplatte oder -Stick in LXC einbinden und per Samba im Netzwerk freigeben",
+        "description": "Eine USB-Festplatte oder einen USB-Stick in einem privilegierten LXC-Container unter Proxmox VE zugänglich machen, Samba installieren und die Inhalte im Netzwerk freigeben."
+      },
+      {
+        "slug": "nvidia-manual",
+        "title": "NVIDIA Grafikkartentreiber auf Proxmox VE 9 installieren (manuelles Verfahren)",
+        "description": "NVIDIA-Treiber auf einem Proxmox-VE-9-Host manuell installieren und konfigurieren sowie die GPU einem oder mehreren LXC-Containern zugänglich machen. Behandelt Treiberinstallation, Persistenzdienst, optionalen NVENC-Patch und die Konfiguration je Container."
+      }
+    ]
+  },
+  "references": {
+    "heading": "ProxMenux-Referenzen",
+    "intro": "Schnellreferenzmaterial aus der ProxMenux-Dokumentation selbst.",
+    "cards": {
+      "glossary": {
+        "title": "Glossar",
+        "description": "Mehr als 60 Definitionen technischer Begriffe aus ProxMenux: Proxmox, Virtualisierung, Speicher, Netzwerk und Linux. Schnell nachschlagen mit Kategorien und Querverweisen."
+      },
+      "helpInfo": {
+        "title": "Hilfe und Info - Befehlskatalog",
+        "description": "Ausgewählte Linux- und Proxmox-Befehle, nach Themen geordnet und mit Kopierfunktion. Entspricht der Befehlsreferenz im ProxMenux-Menü."
+      },
+      "linuxResources": {
+        "title": "Linux Ressourcen",
+        "description": "Externe Ressourcen zum Lernen der Linux-Kommandozeile, zu Sicherheitspraktiken, Überwachungswerkzeugen und ZFS — als Ergänzung zum ProxMenux-Befehlskatalog."
+      },
+      "externalRepos": {
+        "title": "Externe Repositories",
+        "description": "Skript-Repositories von Drittanbietern, die als alternative Menüoptionen in ProxMenux eingebunden sind, etwa community-scripts/ProxmoxVE."
+      }
+    }
+  },
+  "official": {
+    "heading": "Offizielle Proxmox Ressourcen",
+    "intro": "Dokumentation direkt von Proxmox Server Solutions — die maßgebliche Referenz für die Plattform.",
+    "cards": {
+      "pveDocs": {
+        "title": "Proxmox VE Dokumentation",
+        "description": "Das offizielle Administrationshandbuch mit umfassenden Informationen zu Installation, Netzwerk, Speicher, Clustern, Hochverfügbarkeit und API."
+      },
+      "pbsDocs": {
+        "title": "Proxmox-Backup-Server-Dokumentation",
+        "description": "Dokumentation für PBS — inkrementelle, deduplizierte, verschlüsselte Backups für Proxmox VE."
+      },
+      "videoTraining": {
+        "title": "Offizielles Videotraining",
+        "description": "Offizielle Videoanleitungen und Schulungen von Proxmox."
+      },
+      "forum": {
+        "title": "Proxmox Forum",
+        "description": "Offizielles Community-Forum für Fragen, Fehlerbehebung und Erfahrungsaustausch. Wird von den Projektbetreuern mitverfolgt."
+      }
+    }
+  },
+  "community": {
+    "heading": "Gemeinschaftsprojekte & Ressourcen",
+    "intro": "Open-Source-Projekte und ausgewählte Listen aus der Proxmox-Community. Unabhängig von Proxmox Server Solutions und ProxMenux; hier aufgeführt, weil sie sich als nützlich erwiesen haben.",
+    "cards": {
+      "helperScripts": {
+        "title": "Proxmox VE Helper-Scripts",
+        "description": "Von der Community gepflegter Katalog von Skripten zur einfachen Bereitstellung von LXC-Containern und VMs sowie für PVE-Anpassungen, etwa für Home Assistant, Plex oder Frigate. Führt die Idee von ttecks Helper-Scripts fort."
+      },
+      "awesome": {
+        "title": "awesome-proxmox-ve (ausgewählte Ressourcen)",
+        "description": "Umfangreiche, von der Community zusammengestellte Sammlung von Proxmox-VE-Ressourcen: Werkzeuge, Bibliotheken, Integrationen, Blogs und Videos. Ein guter Ausgangspunkt, um mehr zu entdecken."
+      }
+    },
+    "suggestRich": "Kennen Sie eine gute Ressource, die hier fehlt? Erstellen Sie ein Issue oder einen PR auf <link>GitHub</link>. Diese Liste soll eine gezielte Auswahl bleiben und nicht alles auflisten."
+  },
+  "discussion": {
+    "heading": "Gemeinschaftsdiskussion",
+    "intro": "Wo Leute über Proxmox und ProxMenux sprechen.",
+    "cards": {
+      "proxmenuxDiscussions": {
+        "title": "ProxMenux Discussions",
+        "description": "GitHub Discussions für ProxMenux: Funktionsideen, Fragen und Antworten sowie Einblicke in eigene Installationen. Der passende Ort für Themen zu Menü, Monitor und Dokumentation."
+      },
+      "proxmoxForum": {
+        "title": "Proxmox Forum",
+        "description": "Offizielles Proxmox-Forum (auch oben verlinkt). Der richtige Ort für eingehende Fehlersuche und konfigurationsspezifische Probleme."
+      },
+      "reddit": {
+        "title": "r/Proxmox auf Reddit",
+        "description": "Aktives Subreddit für Diskussionen, Tipps und technische Hilfe. Niedrigere Einstiegshürde als im Forum und oft schnellere Antworten auf allgemeine Fragen."
+      }
+    }
+  }
+}
diff --git a/web/messages/de/guides/kodi-lxc.json b/web/messages/de/guides/kodi-lxc.json
new file mode 100644
index 00000000..5f7af82f
--- /dev/null
+++ b/web/messages/de/guides/kodi-lxc.json
@@ -0,0 +1,70 @@
+{
+  "meta": {
+    "title": "Kodi in LXC mit GPU-Beschleunigung installieren | ProxMenux-Anleitungen",
+    "description": "Kodi in einem privilegierten LXC-Container unter Proxmox VE ausführen, die iGPU und USB-Eingabegeräte des Hosts zugänglich machen und den Server als Mediacenter direkt an einen Fernseher anschließen.",
+    "ogTitle": "Kodi in LXC mit GPU-Beschleunigung installieren",
+    "ogDescription": "Kodi in einem privilegierten LXC-Container unter Proxmox VE mit Zugriff auf iGPU und USB-Eingabegeräte des Hosts ausführen und den Server zum Mediacenter machen."
+  },
+  "header": {
+    "title": "Kodi in LXC mit GPU-Beschleunigung installieren und an Monitor oder Fernseher anschließen",
+    "description": "Kodi in einem privilegierten LXC-Container unter Proxmox VE ausführen, die iGPU und USB-Eingabegeräte des Hosts zugänglich machen und den Server als Mediacenter direkt an einen Fernseher anschließen.",
+    "section": "Leitfäden"
+  },
+  "intro": {
+    "calloutTitle": "Hinweis",
+    "calloutBody": "Diese Anleitung verwendet ein externes Community-Skript zur Einrichtung des Kodi-LXC-Containers. Den Zugriff auf die iGPU des Hosts können Sie auch mit ProxMenux einrichten: <strong>GPUs und Coral-TPU → GPU zu LXC hinzufügen</strong> konfiguriert <code>/dev/dri</code> und installiert die Treiber im Container. Das folgende Skript richtet zusätzlich Kodi und den Autostart auf <code>tty7</code> ein. Verwenden Sie es für ein fertig eingerichtetes LXC-Mediacenter; den <gpuLink>ProxMenux-Ablauf</gpuLink> nutzen Sie, wenn Sie nur GPU-Zugriff für einen selbst eingerichteten Container benötigen.",
+    "credit": "Das ursprüngliche Kodi-LXC-Skript stammt von <authorLink>mrrudy</authorLink>.",
+    "stepsTitle": "Was Sie einrichten",
+    "steps": [
+      "Mit dem Skript einen privilegierten LXC-Container mit Kodi erstellen.",
+      "USB-Tastatur, Maus oder Controller im Container zugänglich machen.",
+      "(Optional) Kodi aus den im Container eingerichteten Paketquellen aktualisieren."
+    ]
+  },
+  "createCt": {
+    "heading": "1. Erstellen Sie den Kodi LXC",
+    "body": "Wählen Sie für diese Anleitung <strong>Privileged</strong> in den erweiterten Skripteinstellungen. Standardmäßig erstellt das Skript unprivilegierte Container, die passende Geräteberechtigungen und ID-Zuordnungen benötigen. Es konfiguriert GPU-Zugriff, Kodi und den Autostart auf <code>tty7</code>:",
+    "code": "bash -c \"$(wget -qLO - https://raw.githubusercontent.com/mrrudy/proxmoxHelper/main/ct/kodi-v1.sh)\"",
+    "after": "Die Installation dauert etwas. Sobald Kodi auf <code>tty7</code> startet, schließen Sie Monitor oder Fernseher an den HDMI-/DisplayPort-Ausgang des Hosts an. Dort sollte die Kodi-Oberfläche erscheinen."
+  },
+  "addInput": {
+    "heading": "2. Tastatur, Maus oder USB-Controller hinzufügen",
+    "body": "Eingabegeräte finden Sie auf dem Host unter <code>/dev/input/</code>. Ermitteln Sie deren Major-Nummer:",
+    "listCode": "ls -l /dev/input",
+    "imageAlt": "Liste der Eingabegeräte",
+    "afterList": "Verwenden Sie bei Zeichengeräten die Major-Nummer vor dem Komma, im Beispiel <code>13</code>. Bearbeiten Sie auf dem Host die Konfiguration des Kodi-LXC-Containers. Ersetzen Sie <code>'<'CTID'>'</code> durch seine ID, etwa <code>102</code>:",
+    "editCode": "nano /etc/pve/lxc/CTID.conf",
+    "addLines": "Fügen Sie Folgendes hinzu und passen Sie <code>13</code> an die Nummer auf <strong>Ihrem</strong> Host an:",
+    "configCode": "lxc.cgroup2.devices.allow: c 13:* rwm\nlxc.mount.entry: /dev/input dev/input none bind,optional,create=dir",
+    "imageConfigAlt": "LXC Konfiguration",
+    "save": "Speichern Sie die Datei, beenden Sie den Editor mit <code>Ctrl+X</code> und starten Sie <strong>nur den Container</strong> neu. Ein Neustart des Proxmox-Hosts ist nicht nötig:",
+    "restartCode": "pct reboot CTID",
+    "plug": "Schließen Sie Tastatur, Maus oder Controller an. Kodi sollte nun darauf reagieren."
+  },
+  "updateKodi": {
+    "heading": "3. (Optional) Kodi aus den eingerichteten Paketquellen aktualisieren",
+    "calloutTitle": "Wichtig",
+    "calloutBody": "Das team-xbmc-PPA ist <strong>nur für Ubuntu</strong> vorgesehen und wird laut Kodi derzeit nicht gepflegt. Ein fehlendes <code>add-apt-repository</code> identifiziert nicht die Distribution. Prüfen Sie <code>cat /etc/os-release</code> auf <code>NAME=\"Ubuntu\"</code>; fügen Sie Debian keine Ubuntu-PPAs hinzu. Die folgenden Befehle aktualisieren Pakete aus den eingerichteten Paketquellen des Containers.",
+    "body": "Im Container (<code>pct enter '<'CTID'>'</code>):",
+    "code": "apt update\napt install --only-upgrade kodi kodi-bin",
+    "after": "Starten Sie den Container nach dem Update neu. Kodi verwendet die Version aus den eingerichteten Paketquellen; diese kann von der neuesten Projektversion abweichen."
+  },
+  "screenshots": {
+    "heading": "Bildschirmfotos",
+    "image1Alt": "Kodi-Schnittstelle 1",
+    "image2Alt": "Kodi-Schnittstelle 2"
+  },
+  "troubleshoot": {
+    "heading": "Fehlerbehebung",
+    "items": [
+      "<strong>Der Kodi-LXC-Container startet, aber der Fernseher bleibt leer:</strong> Möglicherweise fehlt der Zugriff auf die iGPU. Prüfen Sie im Container <code>ls /dev/dri</code>; dort sollten <code>card0</code> und <code>renderD128</code> erscheinen. Falls das Verzeichnis leer ist, prüfen Sie die GPU-Durchreichung oder verwenden Sie in ProxMenux <strong>GPU zu LXC hinzufügen</strong>.",
+      "<strong>Tastatur oder Maus nach Neustart nicht erkannt:</strong> Prüfen Sie, ob <code>/dev/input</code> eingehängt ist und Kodi Leserechte auf die Geräte hat. Führen Sie <code>ls -l /dev/input</code> auf Host und Container aus und prüfen Sie die Regel <code>lxc.cgroup2.devices.allow</code>.",
+      "<strong>Hardwarebeschleunigte Wiedergabe nutzt CPU statt GPU:</strong> Installieren oder aktualisieren Sie die VA-API-Treiber im Container: <code>intel-media-va-driver</code> für neuere Intel-iGPUs, <code>i965-va-driver</code> für ältere und <code>mesa-va-drivers</code> für AMD.",
+      "<strong><code>add-apt-repository: command not found</code>:</strong> Der Befehl ist nicht installiert; das beweist nicht, dass der Container Debian verwendet. Prüfen Sie Distribution und verfügbare Pakete. Verwenden Sie unter Debian die Debian-Pakete für Kodi und kein Ubuntu-PPA."
+    ]
+  },
+  "further": {
+    "heading": "Weiterführende Informationen",
+    "konpatRich": "<konpatLink>Konpats Blogbeitrag</konpatLink> mit weiterem Hintergrund zur Intel-iGPU-Durchreichung an LXC."
+  }
+}
diff --git a/web/messages/de/guides/lxc-samba.json b/web/messages/de/guides/lxc-samba.json
new file mode 100644
index 00000000..360f3fc9
--- /dev/null
+++ b/web/messages/de/guides/lxc-samba.json
@@ -0,0 +1,119 @@
+{
+  "meta": {
+    "title": "USB-Laufwerk in LXC einbinden und per Samba freigeben | ProxMenux",
+    "description": "Eine USB-Festplatte oder einen USB-Stick in einem privilegierten LXC-Container unter Proxmox VE zugänglich machen, Samba installieren und die Inhalte im Netzwerk freigeben.",
+    "ogTitle": "USB-Laufwerk in LXC einbinden und per Samba freigeben",
+    "ogDescription": "USB-Laufwerk einem privilegierten LXC-Container unter Proxmox VE zugänglich machen, Samba installieren und den Inhalt im LAN freigeben."
+  },
+  "header": {
+    "title": "USB-Festplatte oder -Stick in LXC einbinden und per Samba im Netzwerk freigeben",
+    "description": "Eine USB-Festplatte oder einen USB-Stick in einem privilegierten LXC-Container unter Proxmox VE zugänglich machen, Samba installieren und die Inhalte im Netzwerk freigeben.",
+    "section": "Leitfäden"
+  },
+  "recommended": {
+    "calloutTitle": "Empfohlen",
+    "calloutIntro": "ProxMenux bietet beide Teile dieses Ablaufs als geführte Menüs an:",
+    "items": [
+      "<strong>Datenträgerverwaltung → Physischen Datenträger formatieren/löschen</strong> für die Formatierung.",
+      "<strong>Speicher und Freigaben → LXC-Netzwerkfreigaben → Samba-Server in LXC</strong> für die Installation im privilegierten Container und die Samba-Konfiguration."
+    ],
+    "calloutOutro": "Die geführten Abläufe berücksichtigen die Berechtigungen unprivilegierter Container und bieten Freigabeprofile für Lesen/Schreiben, Nur-Lesen oder eigene Einstellungen sowie die Gruppe sharedfiles. Diese Anleitung beschreibt die manuellen Schritte, damit Sie sie nachvollziehen oder selbst konfigurieren können."
+  },
+  "intro": {
+    "body": "Ein zusätzliches USB-Laufwerk kann für einen Proxmox-Host hilfreich sein, besonders bei Mini-PCs mit wenig internem Erweiterungsplatz. Diese Anleitung erklärt:",
+    "stepsTitle": "Was Sie einrichten",
+    "steps": [
+      "Ein USB-Laufwerk einem privilegierten LXC-Container zugänglich machen.",
+      "Installieren von Samba im Container.",
+      "Teilen der Festplatteninhalte über das LAN."
+    ],
+    "useCasesTitle": "Anwendungsfälle",
+    "useCases": [
+      "Torrent-Dateien speichern und im Netzwerk bereitstellen.",
+      "Speicher für einen Medienserver wie Plex, Jellyfin oder Emby bereitstellen.",
+      "Dokumente speichern, die Paperless automatisch einliest.",
+      "Generischer NAS-Speicher für das Heimnetzwerk."
+    ],
+    "privilegedCalloutTitle": "Privilegierter Container für diese Anleitung",
+    "privilegedCalloutBody": "Diese Anleitung verwendet einen privilegierten LXC-Container mit einem Blockgerät als <code>mp0</code>. Bei unprivilegierten Containern können Sie stattdessen das Dateisystem auf dem Host einhängen und sein Verzeichnis per Bind-Mount mit passenden ID-Zuordnungen und Berechtigungen durchreichen. Siehe <strong>Speicher und Freigaben → LXC-Einhängepunkte</strong> in ProxMenux."
+  },
+  "attach": {
+    "heading": "1. USB-Laufwerk in LXC einbinden",
+    "identifyHeading": "1.1 Identifizieren Sie das Gerät",
+    "identifyBody": "Vergleichen Sie die Datenträgerliste <strong>vor</strong> und <strong>nach</strong> dem Anschließen des USB-Laufwerks. Das neue Gerät ist das gesuchte Laufwerk.",
+    "beforeLabel": "Vorher:",
+    "afterLabel": "Nachher:",
+    "imageBeforeAlt": "Festplattenliste vor dem Hinzufügen von USB-Laufwerk",
+    "imageAfterAlt": "Festplattenliste nach dem Hinzufügen von USB-Laufwerk",
+    "lsblkBody": "Mit <code>lsblk -o NAME,SIZE,MODEL,SERIAL</code> listen Sie Blockgeräte mit Modell und Seriennummer auf.",
+    "stableCalloutTitle": "Wichtig — Verwenden Sie eine stabile Kennung",
+    "stableCalloutBody": "Der Gerätename <code>/dev/sdb1</code> kann sich nach einem Neustart ändern, besonders bei mehreren USB-Laufwerken. Ermitteln Sie die dauerhafte Kennung:",
+    "stableCalloutCode": "ls -l /dev/disk/by-id/",
+    "stableCalloutAfter": "Verwenden Sie in der LXC-Konfiguration den Eintrag <code>/dev/disk/by-id/usb-...</code> der gewünschten Partition statt <code>/dev/sdb1</code>. Wählen Sie die Partition, nicht den ganzen Datenträger. Sie bleibt so bei geänderter Geräteerkennung identifizierbar.",
+    "formatHeading": "1.2 Formatieren Sie die Festplatte",
+    "formatBody": "ext4 eignet sich für Linux-Freigaben: Es unterscheidet Groß-/Kleinschreibung und unterstützt POSIX-ACLs sowie große Dateien. Das Formatieren zerstört den Inhalt des vorhandenen Dateisystems. Prüfen Sie die Partition und führen Sie den Befehl auf dem <strong>Proxmox-Host</strong> aus:",
+    "formatCode": "mkfs.ext4 /dev/sdb1",
+    "formatAfter": "Ersetzen Sie <code>/dev/sdb1</code> durch die tatsächliche Partition oder deren dauerhaften Pfad <code>/dev/disk/by-id/usb-...-part1</code>.",
+    "mkdirHeading": "1.3 Einhängepunkt im LXC-Container erstellen",
+    "mkdirBody": "Erstellen Sie im LXC das Verzeichnis, in dem die Festplatte angezeigt wird (jeder Name funktioniert):",
+    "mkdirCode": "mkdir /mnt/lxc_USB",
+    "wireHeading": "1.4 Gerät in LXC einbinden",
+    "wireBody": "Bearbeiten Sie auf dem <strong>Proxmox-Host</strong> die Containerkonfiguration. Ersetzen Sie <code>'<'CTID'>'</code> durch die Container-ID:",
+    "wireEditCode": "nano /etc/pve/lxc/CTID.conf",
+    "wireAddLine": "Fügen Sie diese Zeile hinzu:",
+    "wireConfigCode": "mp0: /dev/disk/by-id/usb-VENDOR_MODEL_SERIAL-part1,mp=/mnt/lxc_USB,backup=0",
+    "wireShortForm": "Alternativ können Sie den kürzeren Eintrag <code>mp0: /dev/sdb1,mp=/mnt/lxc_USB,backup=0</code> verwenden, wenn Sie das Risiko einer Änderung des Gerätepfads akzeptieren.",
+    "wireBackupNote": "Das Beispiel setzt <code>backup=0</code>. Inhalte von Geräte- und Bind-Mounts werden nicht in Container-Sicherungen mit <code>vzdump</code> aufgenommen. Sichern Sie die Daten des externen Laufwerks separat.",
+    "restartHeading": "1.5 Starten Sie den LXC neu und setzen Sie Berechtigungen",
+    "restartBody": "Starten Sie den CT neu, um den Mount Point anzuwenden:",
+    "restartCode": "pct reboot CTID",
+    "permsBody": "Erstellen Sie im LXC-Container zuerst das Freigabekonto, bevor Sie ihm das Verzeichnis zuweisen, und setzen Sie dann die Berechtigungen:",
+    "permsCode": "adduser --system --group --no-create-home --shell /usr/sbin/nologin proxmenux\nmkdir -p /mnt/lxc_USB\nchown -R proxmenux:proxmenux /mnt/lxc_USB\nchmod 770 /mnt/lxc_USB",
+    "permsNoteTitle": "Notiz",
+    "permsNote": "Ersetzen Sie <code>proxmenux</code> durch Ihren Kontonamen. Der Modus <code>770</code> erlaubt Eigentümer und Gruppe den Zugriff und sperrt andere aus. Er ist restriktiver als <code>chmod -R 777</code>. Das Konto wird hier erstellt und in Schritt 2.2 bei Samba registriert."
+  },
+  "samba": {
+    "heading": "2. Installieren Sie Samba",
+    "installHeading": "2.1 Installieren Sie das Paket im LXC",
+    "installCode": "apt-get update\napt-get install -y samba",
+    "confirmBody": "Bestätigen Sie, dass der Dienst läuft:",
+    "confirmCode": "systemctl status smbd.service",
+    "userHeading": "2.2 Freigabekonto prüfen",
+    "userBody": "Das Systemkonto <code>proxmenux</code> wurde in Schritt 1.5 ohne Anmeldeshell erstellt. Prüfen Sie es vor dem Setzen des Samba-Passworts und verwenden Sie durchgehend Ihren gewählten Namen:",
+    "userCode": "id proxmenux",
+    "passwordBody": "Setzen Sie das Samba-Passwort. Es ist vom Systempasswort getrennt, da Samba einen eigenen Anmeldedatenspeicher führt:",
+    "passwordCode": "smbpasswd -a proxmenux",
+    "aclHeading": "2.3 Eigentümer und ACLs festlegen",
+    "aclBody": "Wenn <code>chown</code> aus Schritt 1.5 genügt, sind die Dateirechte eingerichtet. Für mehrere Benutzer mit unterschiedlichen Rechten auf denselben Pfad können Sie ACLs verwenden:",
+    "aclCode": "apt-get install -y acl\nsetfacl -R -m \"u:proxmenux:rwx\" /mnt/lxc_USB\nsetfacl -d -R -m \"u:proxmenux:rwx\" /mnt/lxc_USB    # default ACL — applies to new files"
+  },
+  "configure": {
+    "heading": "3. Samba-Freigabe konfigurieren",
+    "editHeading": "3.1 Bearbeiten smb.conf",
+    "editCode": "nano /etc/samba/smb.conf",
+    "appendBody": "Fügen Sie am Dateiende eine Freigabedefinition hinzu:",
+    "shareCode": "[lxc_usb]\n    comment = Shared USB storage\n    path = /mnt/lxc_USB\n    read only = no\n    writable = yes\n    browseable = yes\n    guest ok = no\n    valid users = proxmenux\n    create mask = 0660\n    directory mask = 0770",
+    "validUsersNoteTitle": "Notiz",
+    "validUsersNote": "Die <code>valid users = proxmenux</code>-Linie beschränkt den Zugriff auf diesen einzelnen Samba-Benutzer. Verwenden Sie für den gruppenbasierten Zugriff <code>valid users = @samba_users</code>, nachdem Sie den/die Benutzer zu einer Gruppe namens <code>samba_users</code> hinzugefügt haben.",
+    "reloadHeading": "3.2 Samba neu laden",
+    "reloadCode": "systemctl restart smbd"
+  },
+  "verify": {
+    "heading": "4. Zugang prüfen",
+    "body": "Suchen Sie von jedem LAN-Client zu <code>\\\\'<'CT_IP'>'</code> (Windows) oder <code>smb://'<'CT_IP'>'</code> (macOS / Linux-Dateimanager). Authentifizierung mit dem Samba-Benutzer (<code>proxmenux</code>) und dem Passwort, das Sie mit <code>smbpasswd</code> festgelegt haben.",
+    "image1Alt": "Samba-Serverzugriff von einem Client",
+    "image2Alt": "Samba-Authentifizierungsaufforderung",
+    "usageBody": "Sie können die Freigabe im Container und über das Netzwerk verwenden:",
+    "image3Alt": "USB-Laufwerk über die Freigabe nutzen"
+  },
+  "troubleshoot": {
+    "heading": "Fehlerbehebung",
+    "items": [
+      "<strong><code>pct reboot</code> meldet „device not found“:</strong> Prüfen Sie, ob der Gerätepfad in <code>mp0</code> auf dem Host existiert. Kontrollieren Sie <code>ls -l /dev/disk/by-id/</code> und korrigieren Sie den Pfad.",
+      "<strong>Der Container startet, aber <code>/mnt/lxc_USB</code> ist leer:</strong> Der Datenträger ist möglicherweise nicht eingehängt oder sein Dateisystem ist leer. Prüfen Sie auf dem Host mit <code>pct exec '<'CTID'>' -- mount | grep lxc_USB</code>. Fehlt der Mount, prüfen Sie Konfiguration, Gerätepfad und Startfehler.",
+      "<strong>Die Samba-Anmeldung klappt, aber Schreiben meldet „Permission denied“:</strong> Prüfen Sie Linux-Dateirechte und Schreibeinstellungen der Freigabe. Kontrollieren Sie <code>chown</code> und <code>setfacl</code> in den Abschnitten 1.5 und 2.3.",
+      "<strong>Die Freigabe wird nicht gefunden, aber <code>smb://'<'ip'>'/lxc_usb</code> funktioniert:</strong> Die ältere NetBIOS-Erkennung nutzt <code>nmbd</code>. Modernes Windows nutzt WS-Discovery. Installieren Sie unter Debian 12 <code>apt-get install -y wsdd</code>; unter Debian 13, wo <code>wsdd</code> nicht im stabilen Archiv ist, <code>apt-get install -y wsdd2</code>. Prüfen Sie Dienst und Firewall. Nur <code>nmbd</code> zu aktivieren stellt kein WS-Discovery bereit.",
+      "<strong>Weiteren Benutzer zur Freigabe hinzufügen:</strong> Erstellen Sie das Konto mit <code>adduser</code>, registrieren Sie es mit <code>smbpasswd -a</code> und ergänzen Sie die kommaseparierte Liste <code>valid users =</code>. Vergeben Sie auch die nötigen Dateirechte oder ACLs."
+    ]
+  }
+}
diff --git a/web/messages/de/guides/nvidia-manual.json b/web/messages/de/guides/nvidia-manual.json
new file mode 100644
index 00000000..29d9b7de
--- /dev/null
+++ b/web/messages/de/guides/nvidia-manual.json
@@ -0,0 +1,165 @@
+{
+  "meta": {
+    "title": "NVIDIA Treiber auf Proxmox VE 9 installieren (manuelles Verfahren) | ProxMenux Guides",
+    "description": "NVIDIA-Treiber auf einem Proxmox-VE-9-Host manuell installieren und konfigurieren sowie die GPU einem oder mehreren LXC-Containern zugänglich machen. Behandelt Treiberinstallation, Persistenzdienst, optionalen NVENC-Patch und die Konfiguration je Container.",
+    "ogTitle": "NVIDIA-Treiber auf Proxmox VE 9 installieren (manuelles Verfahren)",
+    "ogDescription": "NVIDIA-Treiber auf PVE 9 manuell einrichten: Hosttreiber, Persistenzdienst, optionaler NVENC-Patch und GPU-Zugriff für einzelne LXC-Container."
+  },
+  "header": {
+    "title": "NVIDIA Grafikkartentreiber auf Proxmox VE 9 installieren (manuelles Verfahren)",
+    "description": "NVIDIA-Treiber auf einem Proxmox-VE-9-Host manuell installieren und konfigurieren sowie die GPU einem oder mehreren LXC-Containern zugänglich machen. Behandelt Treiberinstallation, Persistenzdienst, optionalen NVENC-Patch und die Konfiguration je Container.",
+    "section": "Leitfäden"
+  },
+  "intro": {
+    "calloutTitle": "Notiz",
+    "calloutBody": "Diese Anleitung beschreibt die manuellen Schritte als Referenz. Für die meisten Nutzer empfiehlt sich der ProxMenux-Assistent: <strong>NVIDIA-Treiber installieren (Host)</strong> unter <em>GPUs und Coral-TPU</em> sowie <strong>GPU zu LXC hinzufügen</strong> oder <strong>GPU zu VM hinzufügen</strong> für die jeweilige Gastkonfiguration. Der Assistent erledigt diese Schritte mit zusätzlichen Prüfungen für Kernel-Header, IOMMU und VFIO-Konflikte. Die manuelle Anleitung hilft, einzelne Befehle zu verstehen oder abweichende Konfigurationen einzurichten.",
+    "targetNote": "Gezielt auf <strong>Proxmox VE 9</strong> (Debian Trixie). PVE 7 (Bullseye) und PVE 8 (Bookworm) sind nicht mehr abgedeckt.",
+    "stepsTitle": "Was Sie einrichten",
+    "steps": [
+      "Proxmox-VE-9-Host vorbereiten: nouveau sperren, Paketquellen und Voraussetzungen prüfen.",
+      "Installieren Sie den NVIDIA Treiber auf dem Host.",
+      "Installieren Sie den NVIDIA Persistenzdienst.",
+      "Optional: Mit dem keylase-Patch das Limit gleichzeitiger NVENC-Sitzungen bei Consumer-GPUs aufheben.",
+      "Die GPU einem oder mehreren LXC-Containern zugänglich machen und jeweils die passende Treiberversion installieren."
+    ]
+  },
+  "prepareHost": {
+    "heading": "1. Bereiten Sie den Host vor (PVE 9)",
+    "blacklistHeading": "1.1 nouveau sperren",
+    "blacklistBody": "Überprüfen Sie, ob der Open-Source-<code>nouveau</code>-Treiber bereits auf der schwarzen Liste steht:",
+    "blacklistCheckCode": "cat /etc/modprobe.d/blacklist.conf",
+    "blacklistAdd": "Wenn <code>blacklist nouveau</code> nicht angezeigt wird, fügen Sie es hinzu und starten Sie neu:",
+    "blacklistAddCode": "echo \"blacklist nouveau\" >> /etc/modprobe.d/blacklist.conf\nupdate-initramfs -u -k all\nreboot",
+    "blacklistImageAlt": "Blacklist-Prüfung",
+    "reposHeading": "1.2 Paketquellen prüfen (PVE 9 / Trixie)",
+    "reposBody": "Post-Install-Werkzeuge haben die Paketquellen möglicherweise schon eingerichtet. Prüfen Sie zuerst die vorhandenen Quellen und überspringen Sie bereits erledigte Änderungen. Vermeiden Sie doppelte Einträge.",
+    "reposOtherwise": "Andernfalls für eine unveränderte PVE-9-Installation ohne Enterprise-Abonnement:",
+    "reposEditCode": "nano /etc/apt/sources.list.d/proxmox.sources",
+    "reposPveBody": "Stellen Sie sicher, dass es die No-Abonnement-Quelle für Trixie enthält:",
+    "reposPveCode": "Types: deb\nURIs: http://download.proxmox.com/debian/pve\nSuites: trixie\nComponents: pve-no-subscription\nSigned-By: /usr/share/keyrings/proxmox-archive-keyring.gpg",
+    "reposDebianBody": "Und die Debian-Quellen bei <code>/etc/apt/sources.list.d/debian.sources</code>:",
+    "reposDebianCode": "Types: deb\nURIs: http://deb.debian.org/debian/\nSuites: trixie trixie-updates\nComponents: main contrib non-free non-free-firmware\nSigned-By: /usr/share/keyrings/debian-archive-keyring.gpg\n\nTypes: deb\nURIs: http://security.debian.org/debian-security/\nSuites: trixie-security\nComponents: main contrib non-free non-free-firmware\nSigned-By: /usr/share/keyrings/debian-archive-keyring.gpg",
+    "updateHeading": "1.3 Aktualisieren Sie das System und installieren Sie die Voraussetzungen",
+    "updateCode": "apt update && apt dist-upgrade -y",
+    "buildToolsBody": "Installieren Sie die Build-Tools und Kernel-Header, die zum Kompilieren des Kernel-Moduls NVIDIA erforderlich sind:",
+    "buildToolsCode": "apt-get install -y git\napt-get install -qqy pve-headers-$(uname -r) gcc make"
+  },
+  "installDriver": {
+    "heading": "2. Installieren Sie den NVIDIA-Treiber auf dem Host",
+    "pickHeading": "2.1 Wählen Sie eine Treiberversion",
+    "pickBody": "Wählen Sie einen Treiberzweig, der GPU und laufenden Kernel unterstützt. Der neueste Zweig unterstützt ältere GPUs möglicherweise nicht. Prüfen Sie die Produktliste der gewählten NVIDIA-Version:",
+    "pickUrlCode": "https://download.nvidia.com/XFree86/Linux-x86_64/latest.txt",
+    "nvencCallout": "Wenn Sie den NVENC-Patch anwenden möchten (Schritt 4), überprüfen Sie zuerst, ob der Patch die von Ihnen gewählte Treiberversion unterstützt: <patchLink>github.com/keylase/nvidia-patch</patchLink>",
+    "nvencCalloutTitle": "Hinweis",
+    "pickReplace": "Ersetzen Sie <code>latest.txt</code> in der URL durch die Versionsnummer, um den Installer mit der Endung <code>.run</code> zu finden. Die vollständige Treiberliste steht unter:",
+    "pickListCode": "https://download.nvidia.com/XFree86/Linux-x86_64/",
+    "pickImageAlt": "NVIDIA Treiber herunterladen",
+    "pickVersionNote": "Ersetzen Sie <code>'<'VERSION'>'</code> durch die aktuelle Version (z. B. <code>580.95.05</code>).",
+    "downloadHeading": "2.2 Download und Ausführen des Installationsprogramms",
+    "downloadCode": "mkdir -p /opt/nvidia\ncd /opt/nvidia\nwget https://download.nvidia.com/XFree86/Linux-x86_64/VERSION/NVIDIA-Linux-x86_64-VERSION.run\nchmod +x NVIDIA-Linux-x86_64-VERSION.run",
+    "firstPassBody": "Starten Sie den Installer. Die folgende Option kann <code>nouveau</code> bei Bedarf deaktivieren; vor Abschluss kann ein Neustart nötig sein:",
+    "firstPassCode": "./NVIDIA-Linux-x86_64-VERSION.run --no-questions --ui=none --disable-nouveau\nreboot",
+    "secondPassBody": "Nachdem der Host zurückgekommen ist, führen Sie das Installationsprogramm erneut aus, um das Kernelmodul zu kompilieren und zu installieren:",
+    "secondPassCode": "/opt/nvidia/NVIDIA-Linux-x86_64-VERSION.run --no-questions --ui=none",
+    "modulesHeading": "2.3 NVIDIA-Module beim Booten laden",
+    "modulesBody": "Bearbeiten Sie die Konfiguration zum Laden der Module:",
+    "modulesEditCode": "nano /etc/modules-load.d/modules.conf",
+    "modulesAddBody": "Fügen Sie die NVIDIA-Module für Host und LXC hinzu. VFIO-Module sind für VM-Durchreichung vorgesehen und werden hier nicht benötigt:",
+    "modulesAddCode": "nvidia\nnvidia_uvm",
+    "modulesSaveBody": "Speichern Sie die Datei, beenden Sie den Editor mit <code>Ctrl+X</code> und erstellen Sie initramfs neu:",
+    "modulesSaveCode": "update-initramfs -u -k all",
+    "udevHeading": "2.4 Udev-Regeln erstellen",
+    "udevBody": "Damit beim Laden der Module die Geräteknoten <code>/dev/nvidia*</code> erstellt werden:",
+    "udevEditCode": "nano /etc/udev/rules.d/70-nvidia.rules",
+    "udevRulesCode": "# /etc/udev/rules.d/70-nvidia.rules\nKERNEL==\"nvidia\", RUN+=\"/bin/bash -c '/usr/bin/nvidia-smi -L'\"\nKERNEL==\"nvidia_uvm\", RUN+=\"/bin/bash -c '/usr/bin/nvidia-modprobe -c0 -u'\"",
+    "udevSaveBody": "Speichern (<code>Ctrl+X</code>)."
+  },
+  "persistence": {
+    "heading": "3. NVIDIA-Persistenzdienst",
+    "body": "Der Persistenzdienst hält die GPU initialisiert, wenn keine andere Anwendung sie nutzt. Das reduziert wiederholte Initialisierungslatenz und erhält den Initialisierungszustand zwischen Clients:",
+    "installCode": "cd /opt/nvidia\ngit clone https://github.com/NVIDIA/nvidia-persistenced.git\ncd nvidia-persistenced/init\n./install.sh\nreboot",
+    "verifyBody": "Prüfen Sie nach dem Neustart, ob der Treiber geladen ist und der Dienst läuft:",
+    "verifySmiCode": "nvidia-smi",
+    "smiImageAlt": "Ausgabe von NVIDIA SMI",
+    "verifyServiceCode": "systemctl status nvidia-persistenced",
+    "serviceImageAlt": "Status des NVIDIA-Persistenzdienstes"
+  },
+  "nvenc": {
+    "heading": "4. Optional: Limit gleichzeitiger NVENC-Sitzungen aufheben",
+    "body": "NVENC-Sitzungslimits hängen von GPU-Modell und Treiberversion ab. Prüfen Sie die NVIDIA-Matrix statt eines pauschalen Limits je Generation. Der keylase-Patch entfernt das Softwarelimit bei unterstützten Treiberversionen und kann Kodierungsaufgaben wie Plex- oder Jellyfin-Transkodierung helfen.",
+    "code": "cd /opt/nvidia\ngit clone https://github.com/keylase/nvidia-patch.git\ncd nvidia-patch\n./patch.sh",
+    "imageAlt": "NVIDIA Patch-Anwendung",
+    "after": "Wenden Sie den Patch nach jedem Treiberupdate erneut an. Das keylase-Repository enthält bei Bedarf auch <code>patch-fbc.sh</code> für FBC, die Erfassung des Bildpuffers."
+  },
+  "lxcSetup": {
+    "heading": "5. GPU-Zugriff für einen LXC-Container einrichten",
+    "identifyHeading": "5.1 Gerätenummern angeben",
+    "identifyBody": "Auf dem Host:",
+    "identifyCode": "ls -l /dev/nv*",
+    "identifyImageAlt": "NVIDIA Geräteliste",
+    "identifyNote": "Notieren Sie die Major-Gerätenummern. Sie können sich je nach System unterscheiden. Typische Werte:",
+    "tableHeaders": {
+      "device": "Gerät",
+      "major": "Typische Major-Nummer"
+    },
+    "tableRows": [
+      {
+        "device": "<code>/dev/nvidia0</code>, <code>/dev/nvidiactl</code>",
+        "major": "195"
+      },
+      {
+        "device": "<code>/dev/nvidia-uvm</code>, <code>/dev/nvidia-uvm-tools</code>",
+        "major": "509 (variiert)"
+      },
+      {
+        "device": "<code>/dev/dri/*</code>",
+        "major": "226"
+      },
+      {
+        "device": "<code>/dev/nvidia-modeset</code>",
+        "major": "195 (mit nvidia geteilt)"
+      }
+    ],
+    "editHeading": "5.2 Bearbeiten der LXC-Konfiguration",
+    "editBody": "Stoppen Sie den Container, falls er läuft. Öffnen Sie seine Konfiguration und ersetzen Sie <code>'<'CTID'>'</code> durch die Container-ID:",
+    "editCode": "nano /etc/pve/lxc/CTID.conf",
+    "editConfigBody": "Kommentieren Sie nur tatsächlich widersprüchliche Zeilen zu <code>lxc.cgroup2.devices.allow</code> oder <code>/dev/dri</code> aus. Ergänzen Sie die NVIDIA-Gerätekonfiguration und passen Sie die Major-Nummern an die NVIDIA-Geräte an, die <code>ls -l /dev/nv*</code> auf <strong>Ihrem</strong> Host zeigt:",
+    "editConfigCode": "lxc.cgroup2.devices.allow: c 195:* rwm\nlxc.cgroup2.devices.allow: c 509:* rwm\nlxc.mount.entry: /dev/nvidia0 dev/nvidia0 none bind,optional,create=file\nlxc.mount.entry: /dev/nvidiactl dev/nvidiactl none bind,optional,create=file\nlxc.mount.entry: /dev/nvidia-uvm dev/nvidia-uvm none bind,optional,create=file\nlxc.mount.entry: /dev/nvidia-modeset dev/nvidia-modeset none bind,optional,create=file\nlxc.mount.entry: /dev/nvidia-uvm-tools dev/nvidia-uvm-tools none bind,optional,create=file",
+    "editConfigImageAlt": "LXC Konfiguration",
+    "editSave": "Speichern (<code>Ctrl+X</code>) und starten Sie den Container.",
+    "installCtHeading": "5.3 Installieren Sie den Treiber im Container",
+    "installCtCalloutTitle": "Wichtig",
+    "installCtCalloutBody": "Dieser Teil wird <strong>im Container</strong> ausgeführt, nicht auf dem Host.",
+    "installCtBody": "Das Kernelmodul ist bereits auf dem Host geladen. Der Container benötigt nur die Bibliotheken im Benutzerbereich mit derselben Treiberversion:",
+    "installCtCode": "mkdir -p /opt/nvidia\ncd /opt/nvidia\nwget https://download.nvidia.com/XFree86/Linux-x86_64/VERSION/NVIDIA-Linux-x86_64-VERSION.run\nchmod +x NVIDIA-Linux-x86_64-VERSION.run\n./NVIDIA-Linux-x86_64-VERSION.run --no-kernel-module",
+    "installCtAfter": "Prüfen Sie die Abfragen und installieren Sie hier nur Bibliotheken im Benutzerbereich. Kompilieren oder installieren Sie kein Kernelmodul im LXC-Container.",
+    "installCtImageAlt": "NVIDIA Treiberinstallation",
+    "verifyCtHeading": "5.4 Verifizieren im Container",
+    "verifyCtSmiCode": "nvidia-smi",
+    "verifyCtSmiImageAlt": "NVIDIA SMI in LXC",
+    "verifyCtLsCode": "ls -l /dev/nv*",
+    "verifyCtLsImageAlt": "NVIDIA Geräte in LXC",
+    "verifyCtAfter": "Die GPU sollte aufgelistet sein und ihre Geräteknoten sollten im Containerdateisystem erscheinen.",
+    "workloadHeading": "5.5 GPU-Nutzung mit einer echten Arbeitslast prüfen",
+    "workloadBody": "Aktivieren Sie NVIDIA-Hardwarebeschleunigung in Plex oder Jellyfin, starten Sie eine Videotranskodierung und prüfen Sie im Dashboard oder Protokoll die tatsächliche GPU-Nutzung. Die Treiberinstallation allein aktiviert sie nicht in der Anwendung.",
+    "workloadImage1Alt": "Plex mit NVIDIA GPU",
+    "workloadImage2Alt": "Plex mit NVIDIA GPU - aktive Sitzung",
+    "repeatNote": "Wiederholen Sie <strong>Abschnitt 5</strong> für jeden weiteren Container mit GPU-Zugriff. Aktualisieren Sie bei Hosttreiber-Updates auch die Bibliotheken im Benutzerbereich aller Container auf die passende Version."
+  },
+  "docker": {
+    "heading": "6. (Optional) NVIDIA Docker in einem LXC",
+    "body": "Wenn Docker bereits im LXC-Container läuft, installieren Sie dort <code>nvidia-container-toolkit</code> für den GPU-Zugriff seiner Docker-Container. Zuerst muss die GPU im LXC funktionieren. Die folgenden Befehle gelten für Docker als Root-Dienst:",
+    "code": "apt-get update\napt-get install -y ca-certificates curl gnupg\ncurl -fsSL https://nvidia.github.io/libnvidia-container/gpgkey | gpg --dearmor --yes -o /usr/share/keyrings/nvidia-container-toolkit-keyring.gpg\ncurl -fsSL https://nvidia.github.io/libnvidia-container/stable/deb/nvidia-container-toolkit.list | sed 's#deb https://#deb [signed-by=/usr/share/keyrings/nvidia-container-toolkit-keyring.gpg] https://#g' > /etc/apt/sources.list.d/nvidia-container-toolkit.list\napt-get update\napt-get install -y nvidia-container-toolkit\nnvidia-ctk runtime configure --runtime=docker\nsystemctl restart docker",
+    "after": "Die Befehle richten das NVIDIA-Repository ein, installieren das Toolkit, konfigurieren die Docker-Laufzeit und starten Docker neu. Geräteberechtigungen und cgroup-Beschränkungen des LXC gelten weiterhin. Prüfen Sie die GPU mit einer Testlast."
+  },
+  "troubleshoot": {
+    "heading": "Fehlerbehebung",
+    "items": [
+      "<strong><code>nvidia-smi</code> funktioniert auf dem Host, meldet im Container aber „No devices found“:</strong> Prüfen Sie Gerätemounts, Berechtigungen und passende Treiberbibliotheken. Bei abweichenden Versionen installieren Sie die Hostversion <code>'<'VERSION'>'</code> im Container mit <code>--no-kernel-module</code>.",
+      "<strong>Die Treiberkompilierung schlägt fehl:</strong> Prüfen Sie das Bauprotokoll. „No precompiled kernel interface was found“ kann nur bedeuten, dass lokal kompiliert werden muss. Installieren Sie zu <code>uname -r</code> passende Header mit <code>apt-get install pve-headers-$(uname -r)</code> oder dem entsprechenden proxmox-headers-Paket.",
+      "<strong>NVENC-Sitzungen bleiben begrenzt:</strong> Prüfen Sie die Unterstützung des aktiven Treibers durch den Patch. Ein Treiberupdate kann ihn überschreiben. Wenden Sie bei unterstützter Version <code>./patch.sh</code> aus <code>/opt/nvidia/nvidia-patch</code> erneut an und prüfen Sie die Ausgabe.",
+      "<strong>Die GPU reagiert nach Leerlauf nicht mehr:</strong> Prüfen Sie <code>systemctl status nvidia-persistenced</code> und aktivieren Sie den Dienst bei Bedarf. Prüfen Sie auch Kernel- und Treiberprotokolle; ein gestoppter Persistenzdienst ist nicht die einzig mögliche Ursache.",
+      "<strong>Der Container startet, aber <code>ls /dev/nv*</code> zeigt keine NVIDIA-Geräte:</strong> Prüfen Sie Bind-Mounts und Gerätepfade auf dem Host. Ermitteln Sie mit <code>ls -l /dev/nv*</code> die NVIDIA-Major-Nummern und prüfen Sie Regeln für <code>lxc.cgroup2.devices.allow</code> sowie Dateirechte."
+    ]
+  }
+}
diff --git a/web/messages/en/common.json b/web/messages/en/common.json
index 8e5f794b..2c37c948 100644
--- a/web/messages/en/common.json
+++ b/web/messages/en/common.json
@@ -28,7 +28,12 @@
     "switcher": "Language",
     "en": "English",
     "es": "Español",
-    "sk": "Slovenčina"
+    "sk": "Slovenčina",
+    "de": "Deutsch",
+    "fr": "Français",
+    "it": "Italiano",
+    "pt": "Português",
+    "sv": "Svenska"
   },
   "resources": {
     "documentation": {
diff --git a/web/messages/en/docs/about/code-of-conduct.json b/web/messages/en/docs/about/code-of-conduct.json
index e8923f6a..6eefef4b 100644
--- a/web/messages/en/docs/about/code-of-conduct.json
+++ b/web/messages/en/docs/about/code-of-conduct.json
@@ -8,5 +8,6 @@
   "errors": {
     "notFound": "Error: CODE_OF_CONDUCT.md file not found.",
     "loadFailed": "Error: Unable to load the Code of Conduct content."
-  }
+  },
+  "contentMarkdown": "# 📝 Code of Conduct & Best Practices\n\nThis document defines the **principles and guidelines** for the use of **ProxMenux**, aiming to foster **respect, collaboration, and security** in development.\n\n## 📌 1. Code Attribution & Recognition\n\n- If **scripts, code snippets, or ideas** from other repositories or developers are used, the original author will always be credited.  \n- A comment will be added in the code or documentation mentioning the source and linking to the original repository if possible.  \n- When using code with a specific **license**, its terms must be respected.  \n\n### ✅ Example of proper attribution in code:\n\n```bash\n# Script based on the work of [Author] at [Repository Link]\n```\n\n## 🔒 2. Security & Code Responsibility\n\n- All code in this repository follows secure development best practices.\n- Contributions introducing intentional vulnerabilities or unsafe practices are not allowed.\n- Scripts should never compromise system security or user data.\n- Before implementation, contributions should be reviewed to ensure security and stability.\n\n### ⚠️ Responsible Disclosure of Vulnerabilities\n\nIf you discover a security vulnerability, DO NOT report it in public Issues or forums.\n\nInstead, please report it privately via email:\n\n📧 proxmenux@macrimi.pro\n\nFor detailed information on security vulnerabilities and how to report them, please refer to our [Security Policy](./SECURITY.md).\n\n## 🤝 3. Community Guidelines\n\nTo maintain a respectful and professional environment, all users must follow these guidelines:\n\n- ✅ Be respectful and constructive in discussions.\n- ❌ No harassment, hate speech, or offensive behavior will be tolerated.\n- ✅ Provide feedback professionally, avoiding personal attacks.\n- ❌ Violating these guidelines may result in warnings or bans, depending on severity.\n\n\n##\n\nWith this document, we promote ethical code use, security awareness, and a respectful community.\n\n📢 Let's build something great, together!\n\n"
 }
diff --git a/web/messages/en/docs/about/faq.json b/web/messages/en/docs/about/faq.json
index ab16cfa6..b1fdc48f 100644
--- a/web/messages/en/docs/about/faq.json
+++ b/web/messages/en/docs/about/faq.json
@@ -45,7 +45,7 @@
   },
   "q4": {
     "question": "Can I customise ProxMenux?",
-    "p1Rich": "The core scripts can't be modified directly because they're hosted on GitHub and refreshed by the auto-update flow. What you <em>can</em> customise:",
+    "p1Rich": "Local changes to the core scripts can be overwritten by the update flow, so avoid editing those files directly. What you <em>can</em> customise:",
     "items": [
       "The console banner via the <strong>FastFetch</strong> tool in the Post-Install options.",
       "Which optional components are installed (Monitor, Fail2Ban, Lynis…) — pick during install or via the relevant menu later."
@@ -63,15 +63,15 @@
   },
   "q7": {
     "question": "Can I contribute to ProxMenux?",
-    "p1Rich": "<strong>Absolutely.</strong> ProxMenux is open source and collaborative. Contributions can be code (bash, Next.js / TypeScript, the translation Python venv), testing, documentation, design, or just ideas.",
+    "p1Rich": "<strong>Absolutely.</strong> ProxMenux is open source and collaborative. Contributions can be code (Bash, Next.js/TypeScript and Python translation tools), testing, documentation, design, or just ideas.",
     "item1Rich": "Discuss ideas in <discusslink>GitHub Discussions</discusslink> before opening a feature request.",
     "item2Rich": "For PRs, read the <coclink>Code of Conduct & Best Practices</coclink> first.",
     "item3Rich": "See the <contriblink>Contributors page</contriblink> for current testers and reviewers."
   },
   "q8": {
     "question": "Does ProxMenux modify critical system files?",
-    "p1Rich": "<strong>No.</strong> ProxMenux installs:",
-    "item1Rich": "Dependencies via apt: <code>dialog</code>, <code>curl</code>, <code>jq</code>, <code>git</code> (and <code>python3</code> + <code>googletrans</code> on the Translation install).",
+    "p1Rich": "<strong>Installing ProxMenux adds the following components.</strong>",
+    "item1Rich": "Dependencies via apt: <code>dialog</code>, <code>curl</code>, <code>jq</code> and <code>git</code>. Translations use pre-built JSON catalogs; the installer does not add a translation virtualenv to the host.",
     "item2Rich": "The script tree at <code>/usr/local/share/proxmenux/</code>.",
     "item3Rich": "The launcher at <code>/usr/local/bin/menu</code>.",
     "item4Rich": "Optional: the Monitor systemd service at <code>proxmenux-monitor.service</code>.",
@@ -83,12 +83,12 @@
   },
   "q10": {
     "question": "How do I uninstall ProxMenux?",
-    "p1Rich": "From inside ProxMenux: <strong>Settings → Uninstall ProxMenux</strong>. The uninstaller removes the script tree, the launcher and the Monitor service, optionally removes selected dependencies, and restores <code>/root/.bashrc</code> and <code>/etc/motd</code> backups taken at install time.",
+    "p1Rich": "From inside ProxMenux: <strong>Settings → Uninstall ProxMenux</strong>. The uninstaller removes the script tree, the launcher and the Monitor service, optionally removes selected dependencies, and restores <code>/root/.bashrc</code> and <code>/etc/motd</code> from the backups created by Post-Install, if they exist (otherwise it removes the ProxMenux MOTD line).",
     "p2Rich": "Full step-by-step: <uninstalllink>Uninstall ProxMenux</uninstalllink>."
   },
   "q11": {
     "question": "VirusTotal flags the install URL — is it safe?",
-    "p1Rich": "A 1/95 detection by heuristic engines (e.g. <em>Chong Lua Dao</em>) is a known false positive. The installer uses the standard <code>curl | bash</code> pattern and downloads legitimate binaries (like <code>jq</code> from its official GitHub release), which aggressive scanners flag based on <em>behaviour</em> rather than actual malicious code.",
+    "p1Rich": "The 1/95 result reported in Issue #162, from <em>Chong Lua Dao</em>, was identified by the maintainer as a false positive. The installer is run with a command that downloads and executes the script (<code>bash -c \"$(wget -qLO - …)\"</code>) and can download <code>jq</code> from its official GitHub release. Such <em>behaviour</em> can trigger heuristic scanners; the historical report is not a verdict on every future download.",
     "p2Rich": "ProxMenux is 100% open source and the install script is reviewable line by line: <scriptlink>install_proxmenux.sh</scriptlink>. More context in <issuelink>Issue #162</issuelink>."
   }
 }
diff --git a/web/messages/en/docs/backup-restore/cross-kernel.json b/web/messages/en/docs/backup-restore/cross-kernel.json
index e774df5e..7d003ddd 100644
--- a/web/messages/en/docs/backup-restore/cross-kernel.json
+++ b/web/messages/en/docs/backup-restore/cross-kernel.json
@@ -20,9 +20,21 @@
     "heading": "The direction check",
     "intro": "During the compatibility check, <code>hb_compat_check</code> compares the kernel recorded in the backup's manifest against the target's current kernel (<code>uname -r</code>) and classifies the restore into one of three cases, stored in the internal variable <code>HB_COMPAT_KERNEL_DIRECTION</code>:",
     "rows": [
-      { "direction": "same", "condition": "The major kernel version matches between backup and target.", "behavior": "The full restore flow runs unchanged. No extra filter, no hydration, no special notice in the UI." },
-      { "direction": "bk_newer", "condition": "Backup kernel is NEWER than the target's (for example: the backup was made on kernel 7.0 and the target runs kernel 6.17).", "behavior": "The full restore flow runs unchanged, exactly like <code>same</code>. No filter is applied. Verified empirically: drivers auto-reinstall against the target's kernel, IOMMU config applies cleanly, VMs with GPU passthrough come up without issue." },
-      { "direction": "bk_older", "condition": "Backup kernel is OLDER than the target's (for example: the backup was made on kernel 6.17 and the target runs kernel 7.0).", "behavior": "The safe-subset filter and the four-phase hydration below are activated. The restore proceeds — the target reproduces the source, but boot-critical files are not copied verbatim." }
+      {
+        "direction": "same",
+        "condition": "The major kernel version matches between backup and target.",
+        "behavior": "The full restore flow runs unchanged. No extra filter, no hydration, no special notice in the UI."
+      },
+      {
+        "direction": "bk_newer",
+        "condition": "Backup kernel is NEWER than the target's (for example: the backup was made on kernel 7.0 and the target runs kernel 6.17).",
+        "behavior": "The full restore flow runs unchanged, exactly like <code>same</code>. No filter is applied. Verified empirically: drivers auto-reinstall against the target's kernel, IOMMU config applies cleanly, VMs with GPU passthrough come up without issue."
+      },
+      {
+        "direction": "bk_older",
+        "condition": "Backup kernel is OLDER than the target's (for example: the backup was made on kernel 6.17 and the target runs kernel 7.0).",
+        "behavior": "The safe-subset filter and the four-phase hydration below are activated. The restore proceeds — the target reproduces the source, but boot-critical files are not copied verbatim."
+      }
     ]
   },
   "whyBkNewerIsSafe": {
@@ -31,25 +43,60 @@
   },
   "safeSubsetFilter": {
     "heading": "The safe-subset filter (only when the target kernel is newer)",
-    "intro": "When the target kernel is newer than the backup's, the compatibility check adds 16 boot-critical paths from <code>hb_unsafe_paths_cross_version</code> to <code>RS_SKIP_PATHS</code>. These paths are excluded from the restore because writing a version of them from an older kernel over a target running a newer one has caused kernel panics in bench tests. The paths cover four categories:",
+    "intro": "When the target kernel is newer than the backup's, the compatibility check adds 16 boot-critical paths from <code>hb_unsafe_paths_cross_version</code> to <code>RS_SKIP_PATHS</code>. These paths are excluded from the restore because writing a version of them from an older kernel over a target running a newer one has caused kernel panics in bench tests. The paths cover five categories:",
     "categoryRows": [
-      { "category": "Bootloader", "paths": "<code>/etc/default/grub</code>, <code>/etc/kernel</code>", "reason": "GRUB defaults tied to the prior kernel order, and proxmox-boot-tool state (cmdline, ESP UUIDs, hooks) that references paths and identifiers from the older install." },
-      { "category": "Kernel modules and boot artifacts", "paths": "<code>/etc/modules-load.d</code>, <code>/etc/modprobe.d</code>, <code>/etc/initramfs-tools</code>", "reason": "Autoload lists that may reference modules renamed between kernel majors, module options that may not apply, initramfs hooks written for the older kernel." },
-      { "category": "Storage stack and filesystem identity", "paths": "<code>/etc/fstab</code>, <code>/etc/multipath</code>, <code>/etc/iscsi</code>, <code>/etc/udev/rules.d</code>, <code>/etc/zfs</code>", "reason": "UUIDs that may not exist on this install, multipath drivers that change between kernels, iSCSI parameters that evolve, udev rules that may bind to nonexistent subsystems, ZFS state (<code>zpool.cache</code> + <code>hostid</code>) that can lock the pool as foreign." },
-      { "category": "APT sources", "paths": "<code>/etc/apt</code>", "reason": "APT source suites may trigger a downgrade of critical packages on the next upgrade." },
-      { "category": "systemd", "paths": "<code>/etc/systemd/system</code>, <code>/etc/systemd/journald.conf</code>, <code>/etc/systemd/logind.conf</code>, <code>/etc/systemd/system.conf</code>, <code>/etc/systemd/user.conf</code>", "reason": "Unit overrides and .wants tied to the older systemd major; configuration keys that may not parse on a newer systemd." }
+      {
+        "category": "Bootloader",
+        "paths": "<code>/etc/default/grub</code>, <code>/etc/kernel</code>",
+        "reason": "GRUB defaults tied to the prior kernel order, and proxmox-boot-tool state (cmdline, ESP UUIDs, hooks) that references paths and identifiers from the older install."
+      },
+      {
+        "category": "Kernel modules and boot artifacts",
+        "paths": "<code>/etc/modules-load.d</code>, <code>/etc/modprobe.d</code>, <code>/etc/initramfs-tools</code>",
+        "reason": "Autoload lists that may reference modules renamed between kernel majors, module options that may not apply, initramfs hooks written for the older kernel."
+      },
+      {
+        "category": "Storage stack and filesystem identity",
+        "paths": "<code>/etc/fstab</code>, <code>/etc/multipath</code>, <code>/etc/iscsi</code>, <code>/etc/udev/rules.d</code>, <code>/etc/zfs</code>",
+        "reason": "UUIDs that may not exist on this install, multipath drivers that change between kernels, iSCSI parameters that evolve, udev rules that may bind to nonexistent subsystems, ZFS state (<code>zpool.cache</code> + <code>hostid</code>) that can lock the pool as foreign."
+      },
+      {
+        "category": "APT sources",
+        "paths": "<code>/etc/apt</code>",
+        "reason": "APT source suites may trigger a downgrade of critical packages on the next upgrade."
+      },
+      {
+        "category": "systemd",
+        "paths": "<code>/etc/systemd/system</code>, <code>/etc/systemd/journald.conf</code>, <code>/etc/systemd/logind.conf</code>, <code>/etc/systemd/system.conf</code>, <code>/etc/systemd/user.conf</code>",
+        "reason": "Unit overrides and .wants tied to the older systemd major; configuration keys that may not parse on a newer systemd."
+      }
     ],
-    "outroBody": "The filter runs BEFORE the confirmation dialog so the user sees the exact list of paths that will be skipped, categorised by reason. The restore still proceeds — everything else (VMs, LXCs, network, /etc/pve, users, cron, ProxMenux state, packages, drivers, /root) is restored normally."
+    "outroBody": "The filter runs BEFORE the confirmation dialog so the user sees the exact list of paths that will be skipped, categorised by reason. The restore still proceeds — everything else (VM/LXC configuration, network, /etc/pve, users, cron, ProxMenux state, packages, drivers, /root) is restored normally."
   },
   "hydration": {
     "heading": "Kernel-agnostic hydration",
-    "intro": "The safe-subset filter alone would leave the target without the tuning the user had inside those boot-critical files: IOMMU cmdline for GPU passthrough, VFIO device IDs, custom <code>GRUB_TIMEOUT</code>, nvidia blacklists. The hydration pass re-applies those bits kernel-agnostically. Four phases run when the target kernel is newer than the backup's, each additive (never overwrites a value the target already carries) and idempotent (running twice is a no-op).",
+    "intro": "The filter omits boot-critical files, so hydration reapplies selected user tuning: IOMMU cmdline, VFIO IDs, custom <code>GRUB_TIMEOUT</code> and nvidia blacklists. It runs when the target kernel is newer. Cmdline merges preserve existing target keys and module merges append missing entries. Whitelisted GRUB values and user files may replace differing target content. Repeating the same input is idempotent.",
     "phaseRows": [
-      { "phase": "1a — GRUB path", "detail": "For hosts using GRUB (ext4/lvm installs). <code>_rs_hyd_grub</code> merges every token from the backup's <code>manifest.kernel_params.cmdline_extra</code> into the target's live <code>GRUB_CMDLINE_LINUX_DEFAULT</code>, skipping tokens whose key the target already carries. Then merges whitelisted <code>GRUB_*</code> keys (<code>GRUB_TIMEOUT</code>, <code>GRUB_TIMEOUT_STYLE</code>, <code>GRUB_DEFAULT</code>, <code>GRUB_TERMINAL</code>, <code>GRUB_DISABLE_OS_PROBER</code>, <code>GRUB_SERIAL_COMMAND</code>, <code>GRUB_GFXMODE</code>, <code>GRUB_GFXPAYLOAD_LINUX</code>) from the backup's <code>/etc/default/grub</code> if they differ from the target's." },
-      { "phase": "1b — systemd-boot / ZFS path", "detail": "For hosts using systemd-boot (typically ZFS-on-root). <code>_rs_hyd_kernel_cmdline</code> merges user tokens from <code>cmdline_extra</code> into the target's <code>/etc/kernel/cmdline</code>, keeping the target's own <code>root=</code>, <code>boot=</code> and <code>rootflags=</code> boilerplate intact." },
-      { "phase": "2 — /etc/modules merge", "detail": "<code>_rs_hyd_modules</code> appends modules from <code>manifest.kernel_params.modules_loaded_at_boot</code> that are in the whitelist (<code>vfio</code>, <code>vfio_pci</code>, <code>vfio_iommu_type1</code>, <code>vfio_virqfd</code>, <code>kvm</code>, <code>kvm_intel</code>, <code>kvm_amd</code>, <code>nvidia</code>, <code>nvidia_drm</code>, <code>nvidia_modeset</code>, <code>nvidia_uvm</code>, <code>i915</code>, <code>xe</code>) AND not already present in the target's <code>/etc/modules</code>." },
-      { "phase": "3 — Whitelisted files copy", "detail": "<code>_rs_hyd_files</code> copies user-authored files from the staging rootfs to the live target when the content differs. Whitelist covers VFIO/nvidia/blacklist files under <code>/etc/modprobe.d</code>, <code>/etc/modules-load.d</code>, and the ProxMenux VFIO bind rule + nvidia udev rules under <code>/etc/udev/rules.d</code>. Distro-owned files (<code>pve-blacklist.conf</code>, <code>mdadm.conf</code>, <code>nvme.conf</code>) are intentionally excluded — their contents evolve between releases." },
-      { "phase": "4 — Force post-boot reflows", "detail": "The four phases write directly to the live target OUTSIDE the normal restore pipeline. To make the merged tokens/modules/files take effect on the next boot, <code>HB_HYDRATION_APPLIED=1</code> propagates through <code>plan.env</code> to <code>apply_pending_restore.sh</code>, which forces <code>NEEDS_INITRAMFS=1</code> and <code>NEEDS_GRUB=1</code> regardless of what was in the apply list. The post-boot dispatcher then regenerates initramfs and refreshes the bootloader." }
+      {
+        "phase": "1a — GRUB path",
+        "detail": "For hosts using GRUB (ext4/lvm installs). <code>_rs_hyd_grub</code> merges every token from the backup's <code>manifest.kernel_params.cmdline_extra</code> into the target's live <code>GRUB_CMDLINE_LINUX_DEFAULT</code>, skipping tokens whose key the target already carries. Then merges whitelisted <code>GRUB_*</code> keys (<code>GRUB_TIMEOUT</code>, <code>GRUB_TIMEOUT_STYLE</code>, <code>GRUB_DEFAULT</code>, <code>GRUB_TERMINAL</code>, <code>GRUB_DISABLE_OS_PROBER</code>, <code>GRUB_SERIAL_COMMAND</code>, <code>GRUB_GFXMODE</code>, <code>GRUB_GFXPAYLOAD_LINUX</code>) from the backup's <code>/etc/default/grub</code> if they differ from the target's."
+      },
+      {
+        "phase": "1b — systemd-boot / ZFS path",
+        "detail": "For hosts using systemd-boot (typically ZFS-on-root). <code>_rs_hyd_kernel_cmdline</code> merges user tokens from <code>cmdline_extra</code> into the target's <code>/etc/kernel/cmdline</code>, keeping the target's own <code>root=</code>, <code>boot=</code> and <code>rootflags=</code> boilerplate intact."
+      },
+      {
+        "phase": "2 — /etc/modules merge",
+        "detail": "<code>_rs_hyd_modules</code> appends modules from <code>manifest.kernel_params.modules_loaded_at_boot</code> that are in the whitelist (<code>vfio</code>, <code>vfio_pci</code>, <code>vfio_iommu_type1</code>, <code>vfio_virqfd</code>, <code>kvm</code>, <code>kvm_intel</code>, <code>kvm_amd</code>, <code>nvidia</code>, <code>nvidia_drm</code>, <code>nvidia_modeset</code>, <code>nvidia_uvm</code>, <code>i915</code>, <code>xe</code>) AND not already present in the target's <code>/etc/modules</code>."
+      },
+      {
+        "phase": "3 — Whitelisted files copy",
+        "detail": "<code>_rs_hyd_files</code> copies user-authored files from the staging rootfs to the live target when the content differs. Whitelist covers VFIO/nvidia/blacklist files under <code>/etc/modprobe.d</code>, <code>/etc/modules-load.d</code>, and the ProxMenux VFIO bind rule + nvidia udev rules under <code>/etc/udev/rules.d</code>. Distro-owned files (<code>pve-blacklist.conf</code>, <code>mdadm.conf</code>, <code>nvme.conf</code>) are intentionally excluded — their contents evolve between releases."
+      },
+      {
+        "phase": "4 — Force post-boot reflows",
+        "detail": "The four phases write directly to the live target OUTSIDE the normal restore pipeline. To make the merged tokens/modules/files take effect on the next boot, <code>HB_HYDRATION_APPLIED=1</code> propagates through <code>plan.env</code> to <code>apply_pending_restore.sh</code>, which forces <code>NEEDS_INITRAMFS=1</code> and <code>NEEDS_GRUB=1</code> regardless of what was in the apply list. The post-boot dispatcher then regenerates initramfs and refreshes the bootloader."
+      }
     ]
   },
   "planCommit": {
@@ -65,8 +112,14 @@
     "heading": "Concrete examples",
     "intro": "The hydration pass is not abstract — it produces observable, correct outcomes for common scenarios. Two examples that hydration handles automatically:",
     "rows": [
-      { "scenario": "GPU passthrough (VFIO)", "detail": "Source had <code>intel_iommu=on iommu=pt</code> in the cmdline, <code>vfio</code>/<code>vfio_pci</code>/<code>vfio_iommu_type1</code> in <code>/etc/modules</code>, an <code>/etc/modprobe.d/vfio.conf</code> with <code>options vfio-pci ids=10de:2216</code>, and a <code>/etc/modprobe.d/blacklist-nvidia.conf</code>. Hydration merges the cmdline tokens into the target's GRUB or kernel cmdline, appends the vfio modules to <code>/etc/modules</code>, and copies the two user-authored modprobe files. On the next boot, IOMMU is active, VFIO modules load, the GPU is bound to vfio-pci and the VM comes up with passthrough working." },
-      { "scenario": "Custom GRUB defaults", "detail": "Source had <code>GRUB_TIMEOUT=1</code> and <code>GRUB_DISABLE_OS_PROBER=true</code>. Hydration reads both keys from the backup's <code>/etc/default/grub</code>, sees they differ from the fresh install's defaults, and rewrites those two lines in the target's file (leaving everything else, including <code>GRUB_DISTRIBUTOR</code>, untouched)." }
+      {
+        "scenario": "GPU passthrough (VFIO)",
+        "detail": "Source had <code>intel_iommu=on iommu=pt</code> in the cmdline, <code>vfio</code>/<code>vfio_pci</code>/<code>vfio_iommu_type1</code> in <code>/etc/modules</code>, an <code>/etc/modprobe.d/vfio.conf</code> with <code>options vfio-pci ids=10de:2216</code>, and a <code>/etc/modprobe.d/blacklist-nvidia.conf</code>. Hydration merges the cmdline tokens into the target's GRUB or kernel cmdline, appends the vfio modules to <code>/etc/modules</code>, and copies the two user-authored modprobe files. On the next boot, IOMMU is active, VFIO modules load, the GPU is bound to vfio-pci and the VM comes up with passthrough working."
+      },
+      {
+        "scenario": "Custom GRUB defaults",
+        "detail": "Source had <code>GRUB_TIMEOUT=1</code> and <code>GRUB_DISABLE_OS_PROBER=true</code>. Hydration reads both keys from the backup's <code>/etc/default/grub</code>, sees they differ from the fresh install's defaults, and rewrites those two lines in the target's file (leaving everything else, including <code>GRUB_DISTRIBUTOR</code>, untouched)."
+      }
     ]
   },
   "callout": {
@@ -77,18 +130,41 @@
     "heading": "Where the mechanisms live",
     "intro": "For developers looking to trace or extend the cross-kernel behaviour:",
     "rows": [
-      { "component": "Direction detection", "location": "<code>hb_compat_check</code> in <code>lib_host_backup_common.sh</code>. Sets <code>HB_COMPAT_KERNEL_DIRECTION</code>." },
-      { "component": "Safe-subset path list", "location": "<code>hb_unsafe_paths_cross_version</code> in <code>lib_host_backup_common.sh</code>. Emits <code>path\\treason</code> lines used by both the CLI filter and the Web endpoint <code>/api/host-backups/restore/prepare</code>." },
-      { "component": "Hydration phases", "location": "<code>_rs_hyd_grub</code>, <code>_rs_hyd_kernel_cmdline</code>, <code>_rs_hyd_modules</code>, <code>_rs_hyd_files</code> in <code>backup_host.sh</code>. Orchestrated by <code>_rs_apply_bk_older_hydration</code>." },
-      { "component": "Post-boot reflow forcing", "location": "<code>apply_pending_restore.sh</code> reads <code>HB_HYDRATION_APPLIED</code> from <code>plan.env</code> and forces <code>NEEDS_INITRAMFS=1</code>/<code>NEEDS_GRUB=1</code>." },
-      { "component": "Web preview", "location": "<code>/api/host-backups/restore/prepare</code> in <code>flask_server.py</code>. Sources the helper library, runs <code>_rs_apply_bk_older_hydration</code> in plan mode, returns the actions to the Web modal." }
+      {
+        "component": "Direction detection",
+        "location": "<code>hb_compat_check</code> in <code>lib_host_backup_common.sh</code>. Sets <code>HB_COMPAT_KERNEL_DIRECTION</code>."
+      },
+      {
+        "component": "Safe-subset path list",
+        "location": "<code>hb_unsafe_paths_cross_version</code> in <code>lib_host_backup_common.sh</code>. Emits <code>path\\treason</code> lines used by both the CLI filter and the Web endpoint <code>/api/host-backups/restore/prepare</code>."
+      },
+      {
+        "component": "Hydration phases",
+        "location": "<code>_rs_hyd_grub</code>, <code>_rs_hyd_kernel_cmdline</code>, <code>_rs_hyd_modules</code>, <code>_rs_hyd_files</code> in <code>backup_host.sh</code>. Orchestrated by <code>_rs_apply_bk_older_hydration</code>."
+      },
+      {
+        "component": "Post-boot reflow forcing",
+        "location": "<code>apply_pending_restore.sh</code> reads <code>HB_HYDRATION_APPLIED</code> from <code>plan.env</code> and forces <code>NEEDS_INITRAMFS=1</code>/<code>NEEDS_GRUB=1</code>."
+      },
+      {
+        "component": "Web preview",
+        "location": "<code>/api/host-backups/restore/prepare</code> in <code>flask_server.py</code>. Sources the helper library, runs <code>_rs_apply_bk_older_hydration</code> in plan mode, returns the actions to the Web modal."
+      }
     ]
   },
   "whereNext": {
     "heading": "Where to go next",
     "items": [
-      { "label": "Restoring", "href": "/docs/backup-restore/restoring", "tail": " — the full restore pipeline this page's mechanisms plug into." },
-      { "label": "How it works", "href": "/docs/backup-restore/how-it-works", "tail": " — the manifest and collectors that produce the <code>kernel_params</code> block hydration reads from." }
+      {
+        "label": "Restoring",
+        "href": "/docs/backup-restore/restoring",
+        "tail": " — the full restore pipeline this page's mechanisms plug into."
+      },
+      {
+        "label": "How it works",
+        "href": "/docs/backup-restore/how-it-works",
+        "tail": " — the manifest and collectors that produce the <code>kernel_params</code> block hydration reads from."
+      }
     ]
   }
 }
diff --git a/web/messages/en/docs/backup-restore/destinations/borg.json b/web/messages/en/docs/backup-restore/destinations/borg.json
index 78d5a3ec..bebe8813 100644
--- a/web/messages/en/docs/backup-restore/destinations/borg.json
+++ b/web/messages/en/docs/backup-restore/destinations/borg.json
@@ -24,19 +24,47 @@
     "heading": "The borg binary",
     "intro": "Borg is not a base dependency of the ProxMenux installer. When a backup runs, <code>hb_ensure_borg</code> resolves the binary from four sources in order and returns the first that works:",
     "rows": [
-      { "priority": "1", "source": "System <code>borg</code>", "detail": "If the host already has <code>borg</code> installed via APT (<code>which borg</code> resolves), that binary is used." },
-      { "priority": "2", "source": "State-dir cache", "detail": "<code>/usr/local/share/proxmenux/borg</code> — kept from a prior GitHub download on this host." },
-      { "priority": "3", "source": "Monitor AppImage bundle", "detail": "<code>/usr/local/share/proxmenux/monitor-app/usr/bin/borg</code> — the AppImage bundles a signed borg-linux64. This is the offline-safe path: a host with no internet still has a working <code>borg</code>." },
-      { "priority": "4", "source": "GitHub download", "detail": "<code>wget</code> against the pinned <code>borg-linux64</code> URL under <code>github.com/borgbackup/borg/releases/</code>, verified against a constant SHA-256 in <code>lib_host_backup_common.sh</code> (<code>HB_BORG_LINUX64_SHA256</code>). On checksum mismatch the binary is discarded and the backup aborts. The downloaded file is cached in the state dir so subsequent backups use path 2." }
+      {
+        "priority": "1",
+        "source": "System <code>borg</code>",
+        "detail": "If the host already has <code>borg</code> installed via APT (<code>which borg</code> resolves), that binary is used."
+      },
+      {
+        "priority": "2",
+        "source": "State-dir cache",
+        "detail": "<code>/usr/local/share/proxmenux/borg</code> — kept from a prior GitHub download on this host."
+      },
+      {
+        "priority": "3",
+        "source": "Monitor AppImage bundle",
+        "detail": "<code>/usr/local/share/proxmenux/monitor-app/usr/bin/borg</code> — the AppImage bundles a signed borg-linux64. This is the offline-safe path: a host with no internet still has a working <code>borg</code>."
+      },
+      {
+        "priority": "4",
+        "source": "GitHub download",
+        "detail": "<code>wget</code> against the pinned <code>borg-linux64</code> URL under <code>github.com/borgbackup/borg/releases/</code>, verified against a constant SHA-256 in <code>lib_host_backup_common.sh</code> (<code>HB_BORG_LINUX64_SHA256</code>). On checksum mismatch the binary is discarded and the backup aborts. The downloaded file is cached in the state dir so subsequent backups use path 2."
+      }
     ]
   },
   "repoTypes": {
     "heading": "Repository types",
     "intro": "The repository type is chosen when a target is added. Each type resolves to a different repository URL that Borg understands.",
     "rows": [
-      { "type": "remote", "url": "ssh://USER@HOST/RPATH", "detail": "Repository lives on a remote server that runs <code>borg serve</code>. Requires an SSH connection to that server." },
-      { "type": "usb", "url": "/mnt/MOUNTPOINT/borgbackup", "detail": "Repository lives on a mounted external disk (typically USB). The mount is resolved via <code>hb_prompt_mounted_path</code>, which detects, mounts or formats USB partitions as needed." },
-      { "type": "local", "url": "/backup/borgbackup (any absolute path)", "detail": "Repository lives on a local directory. Meaningful only when the target directory is on a separate physical disk — a repository on the same disk as the source protects against operator error but not against disk failure." }
+      {
+        "type": "remote",
+        "url": "ssh://USER@HOST/RPATH",
+        "detail": "Repository lives on a remote server that runs <code>borg serve</code>. Requires an SSH connection to that server."
+      },
+      {
+        "type": "usb",
+        "url": "/mnt/MOUNTPOINT/borgbackup",
+        "detail": "Repository lives on a mounted external disk (typically USB). The mount is resolved via <code>hb_prompt_mounted_path</code>, which detects, mounts or formats USB partitions as needed."
+      },
+      {
+        "type": "local",
+        "url": "/backup/borgbackup (any absolute path)",
+        "detail": "Repository lives on a local directory. Meaningful only when the target directory is on a separate physical disk — a repository on the same disk as the source protects against operator error but not against disk failure."
+      }
     ]
   },
   "serverSetup": {
@@ -50,30 +78,62 @@
       "Another Proxmox host on the same LAN, or a VM anywhere reachable over SSH."
     ],
     "lxcWarningTitle": "LXC as Borg server",
-    "lxcWarningBody": "If the Borg server runs inside an LXC, the container must have a user account with a password.",
+    "lxcWarningBody": "If the Borg server runs inside an LXC, generate-auto requires an account that accepts SSH password authentication during key installation. If password login is unavailable, use manual key installation or the generate-pct alternative through the PVE host.",
     "requirementsTitle": "Requirements on the server",
     "requirementsRows": [
-      { "requirement": "borg binary at <code>/usr/bin/borg</code>", "detail": "The <code>command=\"/usr/bin/borg serve ...\"</code> line ProxMenux writes into <code>authorized_keys</code> hard-codes that path. Installing via APT (<code>apt install borgbackup</code>) puts it there. A standalone binary must be symlinked to <code>/usr/bin/borg</code>." },
-      { "requirement": "A dedicated user account (typically <code>borg</code>)", "detail": "Owns the repository directory and receives incoming SSH connections. Does not need sudo or shell access — the authorized_keys line disables interactive shells anyway." },
-      { "requirement": "A writable repository directory", "detail": "The path the operator gives ProxMenux (for example <code>/backup/borgbackup</code>) must exist on the server and be owned by the borg user." },
-      { "requirement": "SSH daemon accepting the borg user", "detail": "<code>PubkeyAuthentication yes</code> (default). Password authentication is only needed for the one-shot <em>generate-auto</em> flow — after the key is installed, the server can disable password auth entirely." }
+      {
+        "requirement": "borg binary at <code>/usr/bin/borg</code>",
+        "detail": "The <code>command=\"/usr/bin/borg serve ...\"</code> line ProxMenux writes into <code>authorized_keys</code> hard-codes that path. Installing via APT (<code>apt install borgbackup</code>) puts it there. A standalone binary must be symlinked to <code>/usr/bin/borg</code>."
+      },
+      {
+        "requirement": "A dedicated user account (typically <code>borg</code>)",
+        "detail": "Owns the repository directory and receives incoming SSH connections. Does not need sudo or shell access — the authorized_keys line disables interactive shells anyway."
+      },
+      {
+        "requirement": "A writable repository directory",
+        "detail": "The path the operator gives ProxMenux (for example <code>/backup/borgbackup</code>) must exist on the server and be owned by the borg user."
+      },
+      {
+        "requirement": "SSH daemon accepting the borg user",
+        "detail": "<code>PubkeyAuthentication yes</code> (default). Password authentication is only needed for the one-shot <em>generate-auto</em> flow — after the key is installed, the server can disable password auth entirely."
+      }
     ],
     "minimalSetupTitle": "Minimal server setup",
     "minimalSetupBody": "On a Debian or Ubuntu Borg server, a working baseline is four commands as root:",
     "minimalSetupCmd": "apt install borgbackup\nuseradd -m -d /home/borg -s /bin/bash borg\nmkdir -p /backup/borgbackup\nchown borg:borg /backup/borgbackup",
-    "minimalSetupNote": "After this, ProxMenux's <code>generate-auto</code> mode can connect using the borg user's password once, install its own SSH key, and every subsequent backup uses that key. No further server-side configuration is needed — the key restricts itself to <code>borg serve</code> on that path."
+    "minimalSetupNote": "With the server prepared and SSH password authentication available, ProxMenux’s <code>generate-auto</code> mode can install its SSH key using an account permitted to write the borg user’s authorized_keys file. Subsequent backups use that key, restricted to <code>borg serve</code> on the configured path. Without password login, install the key manually or use the PVE-host alternative."
   },
   "sshAuth": {
     "heading": "SSH authentication (client side)",
     "intro": "Remote Borg repositories are accessed over SSH. The connection runs from the ProxMenux host to a user account on the Borg server that runs <code>borg serve</code>. This user is typically named <code>borg</code>, NOT the admin/root user of the server — the borg-serve command line locks the connection to that specific repository path (see the key strategies below).",
-    "strategiesTitle": "The four key strategies",
-    "strategiesIntro": "When a remote target is added, ProxMenux prompts for the SSH user, host and remote path, then asks how to authenticate. Four modes:",
+    "strategiesTitle": "SSH key strategies",
+    "strategiesIntro": "When a remote target is added, ProxMenux asks for the SSH user, host, port and remote path, then offers four authentication choices. The additional generate-pct path is offered when password authentication is refused. The modes are described below:",
     "strategyRows": [
-      { "mode": "generate-auto", "label": "Recommended", "detail": "ProxMenux generates a new ed25519 keypair at <code>~/.ssh/borg_proxmenux_HOST_ed25519</code>, then uses <code>sshpass</code> to log in ONCE to the server with the admin password and append the public key to <code>~borg/.ssh/authorized_keys</code>. The admin password is only used for this one call — it is never stored." },
-      { "mode": "generate-manual", "label": "No admin password on this host", "detail": "ProxMenux generates the keypair as above but displays the full <code>authorized_keys</code> line for the operator to paste manually into the server. The admin password never leaves the ProxMenux host because it is never asked for." },
-      { "mode": "generate-pct", "label": "Borg server is a PVE LXC", "detail": "The Borg server runs inside an LXC on a PVE node. ProxMenux authorises the key via <code>pct exec</code> from the PVE host — root on the PVE host writes into the LXC's <code>~borg/.ssh/authorized_keys</code> without needing SSH into the LXC itself." },
-      { "mode": "existing", "label": "Use an existing key", "detail": "ProxMenux scans <code>/root/.ssh/</code> and <code>$HOME/.ssh/</code> for parseable ed25519/RSA private keys and lists them. The operator picks one or browses manually to a non-standard path." },
-      { "mode": "none", "label": "Default SSH config", "detail": "No custom key — Borg relies on the host's default SSH configuration (typically <code>~/.ssh/id_rsa</code> or an SSH agent)." }
+      {
+        "mode": "generate-auto",
+        "label": "Recommended",
+        "detail": "ProxMenux generates or reuses an ed25519 keypair at <code>~/.ssh/borg_proxmenux_HOST_ed25519</code>, then uses <code>sshpass</code> for a login probe and installation of the public key in <code>~borg/.ssh/authorized_keys</code>. The password belongs to an account allowed to write that file, usually root or the borg user. It is used during setup and is not saved."
+      },
+      {
+        "mode": "generate-manual",
+        "label": "No admin password on this host",
+        "detail": "ProxMenux generates the keypair as above but displays the full <code>authorized_keys</code> line for the operator to paste manually into the server. The admin password never leaves the ProxMenux host because it is never asked for."
+      },
+      {
+        "mode": "generate-pct",
+        "label": "Borg server is a PVE LXC",
+        "detail": "The Borg server runs inside an LXC on a PVE node. ProxMenux authorises the key via <code>pct exec</code> from the PVE host — root on the PVE host writes into the LXC's <code>~borg/.ssh/authorized_keys</code> without needing SSH into the LXC itself."
+      },
+      {
+        "mode": "existing",
+        "label": "Use an existing key",
+        "detail": "ProxMenux scans <code>/root/.ssh/</code> and <code>$HOME/.ssh/</code> for parseable ed25519/RSA private keys and lists them. The operator picks one or browses manually to a non-standard path."
+      },
+      {
+        "mode": "none",
+        "label": "Default SSH config",
+        "detail": "No custom key — Borg relies on the host's default SSH configuration (typically <code>~/.ssh/id_rsa</code> or an SSH agent)."
+      }
     ],
     "restrictTitle": "The authorized_keys line",
     "restrictBody": "For every generated key, the <code>authorized_keys</code> line ProxMenux writes on the server locks the key to a single borg-serve invocation against the configured repository path:",
@@ -84,24 +144,50 @@
     "heading": "Saved targets",
     "intro": "A saved target persists the repository configuration under a friendly name so the details do not have to be re-entered. Storage layout in the ProxMenux state directory:",
     "rows": [
-      { "file": "borg-targets.txt", "content": "One line per target: <code>NAME|REPO|SSH_KEY_PATH|ENCRYPT_MODE</code>. Read by <code>hb_collect_borg_configs</code> to populate the target-selection menu." },
-      { "file": "borg-pass-NAME.txt", "content": "Passphrase for the target NAMEd above (<code>chmod 600</code>). Only present when the operator chose repokey encryption." }
+      {
+        "file": "borg-targets.txt",
+        "content": "One line per target: <code>NAME|REPO|SSH_KEY_PATH|ENCRYPT_MODE</code>. Read by <code>hb_collect_borg_configs</code> to populate the target-selection menu."
+      },
+      {
+        "file": "borg-pass-NAME.txt",
+        "content": "Passphrase for the target NAMEd above (<code>chmod 600</code>). Only present when the operator chose repokey encryption."
+      }
     ],
-    "outro": "Saving is optional — the operator can decline the save prompt for a one-shot backup that leaves no credentials on the host."
+    "outro": "Saving the target is optional. Declining the save prompt omits the named target configuration, but does not remove a generated SSH key. If repokey encryption is enabled without a saved target, ProxMenux still saves the passphrase in the legacy borg-pass.txt file."
   },
   "encryption": {
     "heading": "Encryption",
-    "body": "Repositories are initialised with an encryption mode via <code>hb_borg_init_if_needed</code>: the modern <code>borg repo-create -e MODE</code> when available, or the legacy <code>borg init --encryption=MODE</code>. ProxMenux exposes two modes: <code>repokey</code> (default) and <code>none</code>. In <code>repokey</code> mode Borg stores the encryption key inside the repository itself; access requires a passphrase, which ProxMenux prompts for twice with match validation and stores at <code>borg-pass-NAME.txt</code>. A mandatory acknowledgement dialog is shown after the passphrase is saved: the passphrase is the only way to access the encrypted archives, and losing it makes every archive in the repository unrecoverable."
+    "body": "Repositories are initialised with an encryption mode via <code>hb_borg_init_if_needed</code>: the modern <code>borg repo-create -e MODE</code> when available, or the legacy <code>borg init --encryption=MODE</code>. ProxMenux exposes two modes: <code>repokey</code> (default) and <code>none</code>. In <code>repokey</code> mode Borg stores the encryption key inside the repository itself; access requires a passphrase, which ProxMenux prompts for twice with match validation and stores at <code>borg-pass-NAME.txt</code> for saved targets (or in the legacy file described above). A mandatory acknowledgement dialog is shown after the passphrase is saved: the passphrase is the only way to access the encrypted archives, and losing it makes every archive in the repository unrecoverable."
   },
   "runtimeEnv": {
     "heading": "Runtime environment",
     "intro": "ProxMenux exports the following environment variables before invoking <code>borg</code>. They configure the connection and unlock the repository without embedding secrets in the command line.",
     "rows": [
-      { "var": "BORG_RSH", "value": "ssh -i SSH_KEY_PATH -o StrictHostKeyChecking=accept-new", "purpose": "The remote-shell command Borg uses for SSH-served repositories. Set only when a custom key was selected; otherwise unset so Borg uses the default SSH configuration." },
-      { "var": "BORG_PASSPHRASE", "value": "(passphrase from borg-pass-NAME.txt)", "purpose": "Unlocks the repokey. Set only when the target uses <code>repokey</code> encryption. Never appears in the process argument list." },
-      { "var": "BORG_ENCRYPT_MODE", "value": "repokey | none", "purpose": "Used by <code>hb_borg_init_if_needed</code> when initialising a repository that does not yet exist. Ignored by <code>borg create</code> on existing repositories." },
-      { "var": "BORG_RELOCATED_REPO_ACCESS_IS_OK", "value": "yes", "purpose": "Suppresses the interactive prompt Borg raises when the repository URL differs from the URL it was originally reached from (common after a mount-point rename or SSH-host reachable via new address)." },
-      { "var": "BORG_UNKNOWN_UNENCRYPTED_REPO_ACCESS_IS_OK", "value": "yes", "purpose": "Suppresses the interactive prompt Borg raises the first time an unencrypted repository is accessed from a new client." }
+      {
+        "var": "BORG_RSH",
+        "value": "ssh -i SSH_KEY_PATH -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new [-p PORT]",
+        "purpose": "The remote-shell command Borg uses for SSH repositories. A selected key adds the identity options. When a target is first added with a non-default port, ProxMenux also appends -p PORT; saved targets, scheduled jobs and the Monitor rely on the port in the ssh:// URL instead. Without a custom key, and for a newly added target with the default port, the variable is unset so Borg uses the host’s default SSH configuration."
+      },
+      {
+        "var": "BORG_PASSPHRASE",
+        "value": "(passphrase from borg-pass-NAME.txt)",
+        "purpose": "Unlocks the repokey. Set only when the target uses <code>repokey</code> encryption. Never appears in the process argument list."
+      },
+      {
+        "var": "BORG_ENCRYPT_MODE",
+        "value": "repokey | none",
+        "purpose": "Used by <code>hb_borg_init_if_needed</code> when initialising a repository that does not yet exist. Ignored by <code>borg create</code> on existing repositories."
+      },
+      {
+        "var": "BORG_RELOCATED_REPO_ACCESS_IS_OK",
+        "value": "yes",
+        "purpose": "Suppresses the interactive prompt Borg raises when the repository URL differs from the URL it was originally reached from (common after a mount-point rename or SSH-host reachable via new address)."
+      },
+      {
+        "var": "BORG_UNKNOWN_UNENCRYPTED_REPO_ACCESS_IS_OK",
+        "value": "yes",
+        "purpose": "Suppresses the interactive prompt Borg raises the first time an unencrypted repository is accessed from a new client."
+      }
     ]
   },
   "archiveFormat": {
diff --git a/web/messages/en/docs/backup-restore/destinations/index.json b/web/messages/en/docs/backup-restore/destinations/index.json
index a1d262a2..5f0f8ff2 100644
--- a/web/messages/en/docs/backup-restore/destinations/index.json
+++ b/web/messages/en/docs/backup-restore/destinations/index.json
@@ -14,7 +14,7 @@
   },
   "intro": {
     "title": "Same payload, three backends",
-    "body": "Every backup produces the same three payloads (rootfs, manifest, applications). What changes between destinations is how those payloads are stored and how the operator retrieves them for a restore. Each backend is implemented as a separate function in <code>backup_host.sh</code> — <code>_bk_local</code>, <code>_bk_pbs</code>, <code>_bk_borg</code> — but all four share the same staging step (<code>hb_prepare_staging</code>) and the same restore code path. The choice of destination only affects the write and the retrieval; it does not change what a restore does or how it consumes the archive."
+    "body": "Every backup produces the same three payloads (rootfs, manifest, applications). What changes between destinations is how those payloads are stored and how the operator retrieves them for a restore. Each backend is implemented as a separate function in <code>backup_host.sh</code> — <code>_bk_local</code>, <code>_bk_pbs</code>, <code>_bk_borg</code> — but all three share the same staging step (<code>hb_prepare_staging</code>) and the same restore code path. The choice of destination only affects the write and the retrieval; it does not change what a restore does or how it consumes the archive."
   },
   "comparison": {
     "heading": "Feature comparison",
@@ -29,8 +29,8 @@
       {
         "feature": "Compression",
         "local": "zstd (default level) via <code>tar --zstd</code>. gzip fallback.",
-        "pbs": "PBS-managed. The client streams uncompressed; the server chunks + compresses.",
-        "borg": "Borg's built-in (lz4 default). Configurable at repo init."
+        "pbs": "Managed by proxmox-backup-client. ProxMenux does not override compression settings.",
+        "borg": "Borg’s built-in compression. ProxMenux invokes borg create without overriding compression settings."
       },
       {
         "feature": "Deduplication",
diff --git a/web/messages/en/docs/backup-restore/destinations/pbs.json b/web/messages/en/docs/backup-restore/destinations/pbs.json
index 270f1b02..e5aac4e6 100644
--- a/web/messages/en/docs/backup-restore/destinations/pbs.json
+++ b/web/messages/en/docs/backup-restore/destinations/pbs.json
@@ -41,7 +41,7 @@
   },
   "backupCommand": {
     "heading": "The backup command",
-    "intro": "The upload is a single invocation of <code>proxmox-backup-client backup</code>. ProxMenux runs it inside an <code>env</code> wrapper so credentials never appear in the process argument list.",
+    "intro": "The upload is a single invocation of <code>proxmox-backup-client backup</code>. ProxMenux uses <code>env</code> to pass the password, encryption password and fingerprint to the client as environment variables.",
     "cmd": "env \\\n    PBS_PASSWORD=\"$HB_PBS_SECRET\" \\\n    PBS_ENCRYPTION_PASSWORD=\"$HB_PBS_ENC_PASS\" \\\n    PBS_FINGERPRINT=\"$HB_PBS_FINGERPRINT\" \\\n    proxmox-backup-client backup \\\n        hostcfg.pxar:$staging_root \\\n        --repository USER@REALM@HOST:DATASTORE \\\n        --backup-type host \\\n        --backup-id  hostcfg-HOSTNAME \\\n        --backup-time BACKUP-EPOCH \\\n        [--keyfile /usr/local/share/proxmenux/pbs-key.conf]",
     "backupIdTitle": "Backup ID naming",
     "backupIdBody": "The default backup ID is <code>hostcfg-HOSTNAME</code>. The operator is asked to confirm or edit it before the upload; any characters outside <code>[A-Za-z0-9_-]</code> are stripped and trailing dashes are trimmed. Reusing the same ID across runs is intentional — PBS treats the ID as a <em>group</em>, and every subsequent backup appears as a new backup inside that group, sharing dedup with prior runs.",
@@ -61,13 +61,13 @@
     "modesSharedTitle": "Shared keyfile (import on every host)",
     "modesSharedBody": "One master keyfile generated once and installed on every host via the <em>Use an existing keyfile</em> option. Management is simpler: a single secret to safeguard, and any host can decrypt the archives of any other (useful for consolidation, cross-host restore drills or centralised backup verification). The trade-off is that a leak of the shared keyfile exposes every host at once. Recommended for homelabs and for fleets where all hosts have the same owner and trust boundary.",
     "recoveryTitle": "Upload key to PBS — the operator decides",
-    "recoveryBody": "Right after the keyfile is chosen, ProxMenux asks a single explicit question — <em>Upload key to PBS?</em> — with two answers. <strong>Nothing gets uploaded to PBS until the operator answers Yes.</strong> The default is <em>No, keep local only</em>: the keyfile stays only at the canonical local path, ProxMenux never touches PBS with any recovery artefact, and the operator handles the offsite copy themselves (the Monitor's <em>Download keyfile</em> button in the PBS destination row provides one on demand). Choosing <em>Yes, upload</em> prompts for a recovery passphrase — twice, with match validation — and ProxMenux wraps the keyfile with that passphrase using AES-256-CBC and PBKDF2 (600 000 iterations, random salt) to produce <code>pbs-key.recovery.enc</code>. Every subsequent encrypted backup uploads that envelope to PBS as a paired backup group. Neither the passphrase nor a plaintext copy of the keyfile ever leaves the host. The choice can be changed later from the Monitor at any time — the escrow toggle inline in the PBS destination row flips Yes/No and applies immediately (Start uploading, Stop uploading, or Update passphrase, matching the current state).",
+    "recoveryBody": "Right after the keyfile is chosen, ProxMenux asks a single explicit question — <em>Upload key to PBS?</em> — with two answers. <strong>No recovery artifact is uploaded to PBS until the operator answers Yes.</strong> The default is <em>No, keep local only</em>: the keyfile stays at the canonical local path, ProxMenux uploads no recovery artifact to PBS, and the operator handles the offsite copy themselves (the Monitor’s <em>Download keyfile</em> button in the PBS destination row provides one on demand). Choosing <em>Yes, upload</em> prompts for a recovery passphrase — twice, with match validation — and ProxMenux wraps the keyfile with that passphrase using AES-256-CBC and PBKDF2 (600 000 iterations, random salt) to produce <code>pbs-key.recovery.enc</code>. Every subsequent encrypted backup uploads that envelope to PBS as a paired backup group. Neither the passphrase nor a plaintext copy of the keyfile is sent to PBS during these uploads. The choice can be changed later from the Monitor at any time — the escrow toggle inline in the PBS destination row flips Yes/No and applies immediately (Start uploading, Stop uploading, or Update passphrase, matching the current state).",
     "blobUploadTitle": "Paired backup group on PBS",
     "blobUploadBody1": "When the escrow mode is <em>Yes, upload</em>, ProxMenux uploads the recovery envelope to PBS after every encrypted backup as a second, paired backup group with the same name as the host group but ending in <code>-keyrecovery</code>. The two groups sit next to each other in the datastore listing — one for host backups, one for recovery envelopes. <strong>The envelope never leaves the host in plaintext</strong>: encryption happens on the host itself with AES-256-CBC and PBKDF2 before any bytes go on the wire (<code>openssl enc -aes-256-cbc -pbkdf2 -iter 600000 -salt</code>). PBS receives only the already-encrypted envelope.",
     "envelopeSecurityTitle": "Is uploading the keyrecovery file to PBS a security risk?",
     "envelopeSecurityBody": "The keyrecovery file is encrypted in transit and at rest. The recovery passphrase never leaves the host: encryption happens locally before the upload, and PBS only ever sees the already-encrypted result. A PBS administrator — or anyone with access to the datastore — can download the keyrecovery file, but without the recovery passphrase they cannot read the keyfile inside: it is opaque ciphertext. Reconstructing the keyfile requires both pieces at once, the keyrecovery file and the passphrase, and only the operator holds both.",
     "blobUploadConstraintTitle": "Why two groups instead of a single encrypted one",
-    "blobUploadConstraintBody": "A single <code>proxmox-backup-client backup</code> invocation encrypts every one of its archives with the same keyfile, or none at all — there is no in-between. The host backup has to be encrypted with the host keyfile, but the recovery envelope cannot ride along in that same upload, because it would end up encrypted with the very keyfile it contains: on a freshly reinstalled host there would be no way to open it (you would need the keyfile to decrypt the keyfile). That is why the two artefacts are uploaded independently and appear as two separate groups: the host backup is encrypted by PBS with the keyfile, and the recovery envelope is encrypted by ProxMenux with the passphrase before upload. Two different encryption layers protecting two different assets.",
+    "blobUploadConstraintBody": "A single <code>proxmox-backup-client backup</code> invocation encrypts every one of its archives with the same keyfile, or none at all — there is no in-between. The host backup has to be encrypted with the host keyfile, but the recovery envelope cannot ride along in that same upload, because it would end up encrypted with the very keyfile it contains: on a freshly reinstalled host there would be no way to open it (you would need the keyfile to decrypt the keyfile). That is why the two artefacts are uploaded independently and appear as two separate groups: the host backup is encrypted by the PBS client with the keyfile, and the recovery envelope is encrypted by ProxMenux with the passphrase before upload. Two different encryption layers protecting two different assets.",
     "blobUploadImageAlt": "PBS UI showing the hostcfg-HOSTNAME and hostcfg-HOSTNAME-keyrecovery backup groups adjacent in the datastore listing.",
     "blobUploadImageCaption": "PBS UI — the paired backup groups. The main group holds the host backups; the -keyrecovery group holds the passphrase-wrapped keyfile.",
     "recoverTitle": "Recovery on a fresh host",
diff --git a/web/messages/en/docs/backup-restore/glossary.json b/web/messages/en/docs/backup-restore/glossary.json
index e750271d..35974d12 100644
--- a/web/messages/en/docs/backup-restore/glossary.json
+++ b/web/messages/en/docs/backup-restore/glossary.json
@@ -28,7 +28,7 @@
         {
           "id": "clave-cifrado",
           "term": "Keyfile (encryption key)",
-          "def": "Binary file that Proxmox Backup Server uses to encrypt the <a href=\"#chunk\">chunks</a> of each backup before uploading them. Without this file, no encrypted backup can be read. ProxMenux stores it at <code>/usr/local/share/proxmenux/pbs-key.conf</code> with mode <code>600</code>. This is the asset that has to be protected; the <a href=\"#sobre-recuperacion\">recovery envelope</a> exists precisely so that this file can be rescued if it is lost."
+          "def": "Key file used by proxmox-backup-client to encrypt the <a href=\"#chunk\">chunks</a> before uploading them to PBS. Without the matching key, encrypted backup data cannot be read. ProxMenux stores the file at <code>/usr/local/share/proxmenux/pbs-key.conf</code> with mode <code>600</code>. Protect it: the <a href=\"#sobre-recuperacion\">recovery envelope</a> is designed to recover this file if it is lost."
         },
         {
           "id": "contrasena-keyfile",
@@ -156,7 +156,7 @@
         {
           "id": "modo-adjunto",
           "term": "Attach mode",
-          "def": "Scheduled job with no schedule of its own; it fires automatically whenever an existing PVE <code>vzdump</code> task runs. It inherits the schedule and retention from that parent task. Supported for Local and PBS destinations only."
+          "def": "Job without its own timer. A PVE <code>vzdump</code> job-end hook triggers it after guest backups when the destination storage matches. The selected parent supplies the storage and the retention, which is re-read from the parent job on every run, but the hook matches storage rather than parent job ID; another task using that storage may also trigger it. Supported for Local and PBS only."
         },
         {
           "id": "timer-systemd",
diff --git a/web/messages/en/docs/backup-restore/how-it-works.json b/web/messages/en/docs/backup-restore/how-it-works.json
index dc68cee6..5651f7ef 100644
--- a/web/messages/en/docs/backup-restore/how-it-works.json
+++ b/web/messages/en/docs/backup-restore/how-it-works.json
@@ -14,7 +14,7 @@
   },
   "intro": {
     "title": "One archive, three payloads",
-    "body": "Every backup produces a directory layout with three well-defined payloads under a single staging root. The archive uploaded to the destination (local <code>.tar.zst</code>, PBS backup or Borg archive) contains this exact layout. The restore reads the three payloads independently, in a specific order that guarantees correctness: <strong>rootfs</strong> is copied first to lay down configuration, <strong>the manifest</strong> is consulted to detect drift and decide what to skip, and <strong>the application inventory</strong> drives the post-boot reinstall pass. No cross-payload dependencies — each one can be inspected or extracted independently."
+    "body": "Every backup produces a directory layout with three well-defined payloads under a single staging root. The archive uploaded to the destination (local <code>.tar.zst</code>, PBS backup or Borg archive) contains this exact layout. The restore uses all three: <strong>the manifest</strong> is consulted before applying changes to detect drift and decide what to skip; <strong>rootfs</strong> supplies the configuration files, applied live or deferred until reboot; and <strong>the application inventory</strong> drives package installation and the post-boot component reinstall. Each payload can be inspected or extracted independently."
   },
   "layout": {
     "heading": "Archive layout",
@@ -26,7 +26,7 @@
     "heading": "The rootfs payload",
     "intro": "The <code>rootfs/</code> tree is a <strong>plain filesystem copy</strong> produced by <code>rsync</code> from the source host. It contains a curated <strong>default profile</strong> of paths that matter for a Proxmox restore, plus any <strong>custom paths</strong> added by the user to the backup job or interactive session. The set is deliberately narrow: only paths that either <em>hold configuration</em> or <em>hold state that Proxmox cannot regenerate on its own</em>.",
     "defaultProfileTitle": "The default profile",
-    "defaultProfileBody": "The default profile is defined by <code>hb_default_profile_paths</code> in <code>lib_host_backup_common.sh</code>. It covers eight categories that together describe a working Proxmox host:",
+    "defaultProfileBody": "The default profile is defined by <code>hb_default_profile_paths</code> in <code>lib_host_backup_common.sh</code>. It covers eight fixed categories, plus conditional ZFS state, that together describe a working Proxmox host:",
     "categoriesTitle": "Path categories",
     "categoryRows": [
       {
@@ -125,7 +125,7 @@
   },
   "applications": {
     "heading": "The application inventory",
-    "intro": "Two files under <code>metadata/</code> catalogue everything installed on the source that is not part of the base Proxmox VE package set. The restore uses them to reproduce the exact set of user-installed software on the target, using either APT or ProxMenux's own installers depending on how the software was originally installed.",
+    "intro": "Two inventories catalogue the software installed on the source beyond the base Proxmox VE package set: the package list under <code>metadata/</code> and the component registry inside rootfs, detailed below. The restore uses them to reproduce user-installed software with APT or ProxMenux’s own installers, depending on how it was originally installed.",
     "packagesTitle": "packages.manual.list",
     "packagesBody": "A plain-text list produced by <code>apt-mark showmanual</code>: every APT package that was <em>explicitly installed</em> on the source host, sorted alphabetically. This excludes packages installed as dependencies of the base Proxmox VE ISO (they are re-pulled automatically by the target's own APT). Read by <code>_rs_run_complete_extras</code> during restore, filtered through a three-pass <em>cascade-safe</em> filter (<code>dpkg -s</code> for already-installed, sibling-major detection for library packages, <code>apt-get install --simulate</code> for cascade-remove risk), then installed with <code>apt-get install -y</code>.",
     "componentsTitle": "components_status.json (part of the rootfs)",
diff --git a/web/messages/en/docs/backup-restore/restoring.json b/web/messages/en/docs/backup-restore/restoring.json
index 51c2ce22..cd16d81a 100644
--- a/web/messages/en/docs/backup-restore/restoring.json
+++ b/web/messages/en/docs/backup-restore/restoring.json
@@ -14,7 +14,7 @@
   },
   "intro": {
     "title": "The restore reproduces the source, not just the files",
-    "body": "Restoring a ProxMenux backup is not an extraction. Files are only the first step: after the filesystem is in place, the restore reads the manifest to detect differences between source and target, filters paths that would break the target's boot, hydrates user-authored tuning that cannot be copied verbatim, and — after the mandatory reboot — reinstalls every component the source had (NVIDIA driver, Coral TPU, GPU tools) against the target's own kernel. What the user picks from the menu is a single archive; what actually happens involves the compatibility check, the path classification, the on-boot dispatcher and the post-boot pass working together to produce a host that behaves like the source."
+    "body": "Restoring a ProxMenux backup involves more than extracting files. Before applying changes, the restore reads the manifest to detect differences between source and target, filters paths that could break the target’s boot and adapts user-authored tuning that cannot be copied verbatim. After the required reboot, it attempts to reinstall the recorded supported components (NVIDIA driver, Coral TPU, GPU tools) for the target’s running kernel. A single selected archive drives the compatibility check, path classification, on-boot dispatcher and post-boot work. Review the per-component results and logs to confirm the outcome."
   },
   "threeActions": {
     "heading": "Three actions on a backup",
@@ -52,7 +52,7 @@
       },
       {
         "output": "Rollback plan",
-        "detail": "Computed by <code>compute_rollback_plan.sh</code>. Lists VMs, LXCs and components present on the target but not in the backup. The user opts in during the confirmation dialog to have these removed as part of the restore, so the target ends up matching the backup exactly."
+        "detail": "Computed by <code>compute_rollback_plan.sh</code>. Lists VMs, LXCs and components present on the target but absent from the backup. The confirmation dialog offers optional removal of the extra guests before reboot. Component removal remains manual, and guest deletion can fail, so this does not guarantee an exact match with the backup."
       }
     ],
     "reportBody": "The check also emits a structured report (<code>HB_COMPAT_RESULTS</code>) categorised as PASS / INFO / WARN / FAIL. WARN and FAIL entries surface in the pre-restore panel; the restore refuses to proceed only when a FAIL is present that the user cannot resolve by clicking Continue."
@@ -81,11 +81,11 @@
       },
       {
         "class": "reboot",
-        "detail": "Paths applied <strong>immediately</strong> as well, but whose actual effect only kicks in on the <strong>next boot</strong>: the kernel only reads <code>/etc/default/grub</code> when the bootloader starts, <code>/etc/fstab</code> when filesystems are mounted at boot, <code>/etc/modules</code> when modules are loaded, etc. The file is in place the moment it is applied but the system has to reboot to consume it. Examples: <code>/etc/default/grub</code>, <code>/etc/kernel</code>, <code>/etc/modules</code>, <code>/etc/fstab</code>, <code>/etc/zfs</code>, <code>/etc/initramfs-tools</code>."
+        "detail": "Paths deferred to the <strong>next boot</strong>, rather than applied <strong>immediately</strong> by this restore flow. They affect boot-time configuration: bootloader generation reads <code>/etc/default/grub</code>, filesystem mounting uses <code>/etc/fstab</code>, and module loading uses <code>/etc/modules</code>. The pending files are applied after reboot and the required boot artifacts are then regenerated. Examples: <code>/etc/default/grub</code>, <code>/etc/kernel</code>, <code>/etc/modules</code>, <code>/etc/fstab</code>, <code>/etc/zfs</code>, <code>/etc/modprobe.d</code>."
       },
       {
         "class": "dangerous",
-        "detail": "Paths that are <strong>NOT applied on the running system</strong> — a live write could corrupt state or drop the active connection. These are staged in the pending set and written by the post-boot dispatcher after the reboot, when the cluster is up but the system is not yet fully in use. Examples: <code>/etc/pve</code> (pmxcfs is a live FUSE mount; writing directly to it bypasses it), <code>/var/lib/pve-cluster</code> (live cluster data), <code>/etc/network</code> (could reconfigure the very interface the user is connected on over SSH and drop the session)."
+        "detail": "Paths that are <strong>NOT applied on the running system</strong> — a live write could corrupt state or drop the active connection. These are staged in the pending set: <code>/etc/network</code> is written early in the next boot, before networking starts, and <code>/etc/pve</code> is written by the post-boot dispatcher once the cluster filesystem is up. Examples: <code>/etc/pve</code> (pmxcfs is a live FUSE mount holding active cluster configuration), <code>/var/lib/pve-cluster</code> (live cluster data, kept in the recovery directory for manual recovery only), <code>/etc/network</code> (could reconfigure the very interface the user is connected on over SSH and drop the session)."
       }
     ]
   },
@@ -131,7 +131,7 @@
       },
       {
         "task": "Component auto-reinstall",
-        "detail": "Reads the restored <code>components_status.json</code> and iterates over the registered installers (nvidia_driver, coral_driver, amdgpu_top, intel_gpu_tools). Each installer runs in <code>--auto-reinstall</code> mode, reads its previously-recorded version from the state file, and rebuilds against the target's current kernel. The interactive flow does not do this — reinstalling drivers against a kernel that has not yet booted is meaningless."
+        "detail": "Reads the restored <code>components_status.json</code> and iterates over the registered supported installers (nvidia_driver, coral_driver, amdgpu_top, intel_gpu_tools). Each selected installer runs in <code>--auto-reinstall</code> mode, reads its recorded state and reinstalls for the target’s environment, rebuilding kernel modules when applicable. This is deferred until after reboot so the installers use the kernel then running on the target. Individual failures are recorded and do not stop the next component."
       },
       {
         "task": "Boot sanity check",
@@ -145,7 +145,7 @@
   },
   "liveProgress": {
     "heading": "Live progress in the Monitor's Backups tab",
-    "body": "After the reboot the Backups tab of ProxMenux Monitor renders a live post-restore card that reflects the state of <code>apply_cluster_postboot.service</code> as it runs. The card is driven by <code>/var/lib/proxmenux/restore-state.json</code>, which the dispatcher updates at every milestone (apply cluster config, rebuild initramfs, update bootloader, per-component reinstall, boot sanity check, finalize).",
+    "body": "After the reboot the Backups tab of ProxMenux Monitor renders a live post-restore card that reflects the state of <code>proxmenux-apply-cluster-postboot.service</code> as it runs. The card is driven by <code>/var/lib/proxmenux/restore-state.json</code>, which the dispatcher updates at every milestone (apply cluster config, rebuild initramfs, update bootloader, per-component reinstall, boot sanity check, finalize).",
     "fields": [
       {
         "name": "Status badge",
@@ -184,9 +184,9 @@
   },
   "postbootExample": {
     "heading": "What the post-boot looks like on the console",
-    "body": "On the host's physical console, a successful dispatcher run ends with a <code>[ OK ] Finished proxmenux-apply-cluster-postboot.service</code> line. When that line appears — usually alongside the <code>OK</code>s for <code>multi-user.target</code> and <code>graphical.target</code> — the restore is completely finished: components reinstalled, boot artifacts regenerated, cluster reconciled.",
+    "body": "On the host’s physical console, a dispatcher run that exits successfully ends with <code>[ OK ] Finished proxmenux-apply-cluster-postboot.service</code>, often near the <code>OK</code>s for <code>multi-user.target</code> and <code>graphical.target</code>. This marks the end of the dispatcher process. Individual component failures or boot warnings can still have been recorded; check the Monitor’s component states and logs before treating the host as fully restored.",
     "imageAlt": "Proxmox physical console showing '[ OK ] Finished proxmenux-apply-cluster-postboot.service - ProxMenux Apply Cluster Configs (post-boot).' followed by the OK for multi-user.target and graphical.target, with the host login prompt above.",
-    "imageCaption": "Physical console after a successful post-boot. The 'Finished proxmenux-apply-cluster-postboot.service' line is the signal that the restore flow is fully complete — the same event the 'Host restore finished' notification surfaces in the Monitor."
+    "imageCaption": "Physical console after the dispatcher process finishes. 'Finished proxmenux-apply-cluster-postboot.service' marks process completion, also reported by 'Host restore finished' in the Monitor. Component results and warnings still need review."
   },
   "tenMinutes": {
     "heading": "Why the last ten minutes matter",
@@ -228,11 +228,11 @@
         "detail": "Cheap. The user learns the run completed the moment the notification fires."
       }
     ],
-    "outroBody": "The window matters because the user can log in during this time and see missing tools (<code>nvidia-smi</code> not found, <code>coral</code> not detected). This is expected — the reinstall is still running in the background. The completion notification signals when everything is ready."
+    "outroBody": "During this window a login may show missing tools (<code>nvidia-smi</code> not found, <code>coral</code> not detected) because reinstall work is still running in the background. The completion notification marks the end of that work; check component results, warnings and logs to distinguish success from individual failures."
   },
   "destructiveRollback": {
     "heading": "The optional destructive rollback",
-    "body": "A restore is additive by default: if the target has VMs, LXCs or components that are not in the backup, they survive. This preserves work but can leave stale hostpci entries, orphan components or VMs the user no longer wants. When drift is detected between target and backup, the confirmation dialog offers a second yes/no: <em>Execute destructive rollback?</em>. Accepting it triggers <code>_rs_execute_rollback</code>, which deletes the VMs, LXCs and components that exist on the target but not in the backup. The rollback runs BEFORE the reboot so that the pending restore machinery sees a clean state. This is opt-in — the default is No, and the user sees exactly what would be removed listed by name (VMID and CTID) before deciding."
+    "body": "A restore is additive by default: extra VMs, LXCs and components on the target remain. When differences are detected, the confirmation dialog offers <em>Execute destructive rollback?</em>, defaulting to No. Accepting calls <code>_rs_execute_rollback</code> before reboot to attempt deletion of listed extra VMs and LXCs. Components are flagged for manual uninstall because automatic uninstall is not implemented. Guest deletion failures are reported and processing continues, so an exact match with the backup is not guaranteed. Review the listed names and VMIDs/CTIDs before choosing this destructive option."
   },
   "logs": {
     "heading": "Where the logs live",
diff --git a/web/messages/en/docs/backup-restore/scheduled-jobs.json b/web/messages/en/docs/backup-restore/scheduled-jobs.json
index 5357ec6a..b5a3acf2 100644
--- a/web/messages/en/docs/backup-restore/scheduled-jobs.json
+++ b/web/messages/en/docs/backup-restore/scheduled-jobs.json
@@ -22,7 +22,7 @@
   },
   "attachBadge": {
     "title": "Attach mode — recommended when a PVE vzdump task already exists",
-    "body": "When a PVE vzdump backup task is already configured for the VMs and LXCs on this node, attaching the host backup to that task guarantees the host configuration is captured in the <strong>same window</strong> as the guests. On restore, the guest configs come from the host backup (they live under <code>/etc/pve</code>), and the guest disks come from the vzdump backup taken alongside — both sets are consistent with each other, so a full-node recovery can reproduce the host and re-attach every guest without version drift."
+    "body": "When a PVE vzdump backup task is already configured for the VMs and LXCs on this node, attaching the host backup runs it after the guest backup job, in the <strong>same backup cycle</strong>. On restore, guest configurations come from the host backup (under <code>/etc/pve</code>) and guest disks come from the vzdump backups taken in that cycle. This helps coordinate a full-node recovery, but is not an atomic snapshot: changes made during the backup cycle can leave differences between host configuration and guest disk state."
   },
   "frequencyBadge": {
     "title": "Recommended frequency",
@@ -31,29 +31,63 @@
   "modes": {
     "heading": "The two modes",
     "rows": [
-      { "mode": "New scheduled job", "backends": "Local, PBS, Borg", "schedule": "Own <code>OnCalendar</code> expression (systemd calendar syntax — e.g. <code>daily</code>, <code>Mon..Fri 03:00</code>).", "retention": "Prompted separately: <code>keep-last</code>, <code>keep-hourly</code>, <code>keep-daily</code>, <code>keep-weekly</code>, <code>keep-monthly</code>, <code>keep-yearly</code>. Applied by the runner after each successful backup." },
-      { "mode": "Attach to a PVE vzdump job", "backends": "Local, PBS (Borg has no PVE-side scheduler)", "schedule": "Inherited from the parent PVE job. No systemd timer is installed on the ProxMenux side.", "retention": "Inherited from the parent's <code>prune-backups</code> configuration (mapped one-to-one to the runner's <code>KEEP_*</code> variables via <code>hb_pve_prune_to_keep_env</code>)." }
+      {
+        "mode": "New scheduled job",
+        "backends": "Local, PBS, Borg",
+        "schedule": "Own <code>OnCalendar</code> expression (systemd calendar syntax — e.g. <code>daily</code>, <code>Mon..Fri 03:00</code>).",
+        "retention": "Prompted separately: <code>keep-last</code>, <code>keep-hourly</code>, <code>keep-daily</code>, <code>keep-weekly</code>, <code>keep-monthly</code>, <code>keep-yearly</code>. Applied by the runner after each successful backup."
+      },
+      {
+        "mode": "Attach to a PVE vzdump job",
+        "backends": "Local, PBS (Borg has no PVE-side scheduler)",
+        "schedule": "Inherited from the parent PVE job. No systemd timer is installed on the ProxMenux side.",
+        "retention": "Inherited from the parent's <code>prune-backups</code> configuration (mapped one-to-one to the runner's <code>KEEP_*</code> variables via <code>hb_pve_prune_to_keep_env</code>)."
+      }
     ]
   },
   "attachDetail": {
     "heading": "How attach mode works",
-    "intro": "PVE writes <code>vzdump</code> tasks to <code>/etc/pve/jobs.cfg</code> — one stanza per task, each pointing at a storage where the VM and LXC dumps land. Attach mode requires that storage to be a backend ProxMenux understands (Local or PBS); when the task fires, ProxMenux runs alongside it.",
+    "intro": "PVE writes <code>vzdump</code> tasks to <code>/etc/pve/jobs.cfg</code> — one stanza per task, each pointing at a storage where the VM and LXC dumps land. Attach mode requires a backend ProxMenux understands (Local or PBS). The host backup runs from the job-end hook after the guest backup job finishes.",
     "steps": [
-      { "step": "1", "detail": "During job creation, ProxMenux lists compatible parent PVE tasks via <code>hb_pve_list_vzdump_jobs_for_backend</code>. The user picks one." },
-      { "step": "2", "detail": "The job's <code>.env</code> is written with <code>PVE_PARENT_JOB</code>, <code>PVE_STORAGE</code> and the inherited <code>KEEP_*</code> values; no systemd timer is created." },
-      { "step": "3", "detail": "<code>hb_install_vzdump_hook</code> registers a script-hook in <code>/etc/vzdump.conf</code>. When PVE runs any vzdump task, the hook script fires; if the <code>$STOREID</code> passed to it matches an attached job's <code>PVE_STORAGE</code>, the runner is invoked for that job." },
-      { "step": "4", "detail": "The archive lands in the same storage the vzdump dumps just wrote to: <code>path/dump/</code> for Local, or the PBS repository configured on the PVE storage entry." }
+      {
+        "step": "1",
+        "detail": "During job creation, ProxMenux lists compatible parent PVE tasks via <code>hb_pve_list_vzdump_jobs_for_backend</code>. The user picks one."
+      },
+      {
+        "step": "2",
+        "detail": "The job's <code>.env</code> is written with <code>PVE_PARENT_JOB</code>, <code>PVE_STORAGE</code> and the inherited <code>KEEP_*</code> values; no systemd timer is created."
+      },
+      {
+        "step": "3",
+        "detail": "<code>hb_install_vzdump_hook</code> registers a script-hook in <code>/etc/vzdump.conf</code>. In the job-end phase of any vzdump task, it compares the supplied <code>$STOREID</code> with each enabled attached job’s <code>PVE_STORAGE</code> and invokes the runner for matching jobs. The match is by storage, not by the selected parent job ID."
+      },
+      {
+        "step": "4",
+        "detail": "The archive lands in the same storage the vzdump dumps just wrote to: <code>path/dump/</code> for Local, or the PBS repository configured on the PVE storage entry."
+      }
     ],
-    "outroBody": "Attach mode has one operational implication: disabling or deleting the parent PVE task also disables the host backup — there is no timer of its own to fall back on. The job entry stays on disk so it can be re-attached later."
+    "outroBody": "Attach mode has no timer of its own. Disabling or deleting the selected parent PVE task stops that task’s trigger, but another vzdump task using the same storage can still trigger the attached host backup. Disable or delete the ProxMenux job itself to prevent that. The job entry remains on disk when disabled and can be re-enabled or re-attached later."
   },
   "storageLayout": {
     "heading": "Files that make up a job",
     "intro": "Every scheduled job is fully described by three or four files on disk. Reading them gives the full configuration of the job without relying on the interface.",
     "rows": [
-      { "path": "/var/lib/proxmenux/backup-jobs/JOB_ID.env", "content": "Backend, backup ID or destination, schedule (New mode) or PVE parent (Attach mode), enabled flag, retention <code>KEEP_*</code> values, credentials pointers." },
-      { "path": "/var/lib/proxmenux/backup-jobs/JOB_ID.paths", "content": "One absolute path per line — the frozen selection resolved from the profile at job-creation time. Editing the file re-runs the job with the new selection on the next timer fire." },
-      { "path": "/etc/systemd/system/proxmenux-backup-JOB_ID.timer + .service", "content": "New mode only. The service invokes <code>run_scheduled_backup.sh JOB_ID</code>. The timer schedules it with <code>Persistent=true</code> (missed fires run at next boot) and a small <code>RandomizedDelaySec=120</code> to spread load when multiple jobs share the same OnCalendar expression." },
-      { "path": "/etc/vzdump.conf script-hook", "content": "Attach mode only. Installed once by <code>hb_install_vzdump_hook</code>; matches every attached job's <code>PVE_STORAGE</code> against the <code>$STOREID</code> PVE passes to the hook script." }
+      {
+        "path": "/var/lib/proxmenux/backup-jobs/JOB_ID.env",
+        "content": "Backend, backup ID or destination, schedule (New mode) or PVE parent (Attach mode), enabled flag, retention <code>KEEP_*</code> values, credentials pointers."
+      },
+      {
+        "path": "/var/lib/proxmenux/backup-jobs/JOB_ID.paths",
+        "content": "One absolute path per line — the frozen selection resolved from the profile at job-creation time. Editing the file re-runs the job with the new selection on the next timer fire."
+      },
+      {
+        "path": "/etc/systemd/system/proxmenux-backup-JOB_ID.timer + .service",
+        "content": "New mode only. The service invokes <code>run_scheduled_backup.sh JOB_ID</code>. The timer schedules it with <code>Persistent=true</code> (missed fires run at next boot) and a small <code>RandomizedDelaySec=120</code> to spread load when multiple jobs share the same OnCalendar expression."
+      },
+      {
+        "path": "/etc/vzdump.conf script-hook",
+        "content": "Attach mode only. Installed once by <code>hb_install_vzdump_hook</code>; matches every attached job's <code>PVE_STORAGE</code> against the <code>$STOREID</code> PVE passes to the hook script."
+      }
     ]
   },
   "runner": {
@@ -69,11 +103,26 @@
     "heading": "Managing jobs",
     "intro": "The scheduler menu (Scripts TUI) and the Monitor Backups tab expose the same actions on any job.",
     "rows": [
-      { "action": "Run now", "detail": "Invokes the runner immediately, bypassing the timer / vzdump hook. Useful to verify a job configuration without waiting for the next scheduled fire." },
-      { "action": "Enable / Disable", "detail": "New mode: <code>systemctl enable/disable --now</code> the timer. Attach mode: flips the <code>ENABLED</code> flag in the job env — the hook script honours it on the next PVE fire." },
-      { "action": "Edit", "detail": "Reopens the destination, schedule, profile and retention prompts and rewrites the job files. Preserves the job ID." },
-      { "action": "Delete", "detail": "Removes the job env, paths file, systemd timer + service (New mode), and disables the hook binding (Attach mode). Does not touch archives already on the destination." },
-      { "action": "View log", "detail": "Streams <code>/var/log/proxmenux/backup-jobs/JOB_ID-YYYYMMDD_HHMMSS.log</code> — one log file per run. The runner also emits a compact status line to journald under the systemd service." }
+      {
+        "action": "Run now",
+        "detail": "Invokes the runner immediately, bypassing the timer / vzdump hook. Useful to verify a job configuration without waiting for the next scheduled fire."
+      },
+      {
+        "action": "Enable / Disable",
+        "detail": "New mode: <code>systemctl enable/disable --now</code> the timer. Attach mode: flips the <code>ENABLED</code> flag in the job env — the hook script honours it on the next PVE fire."
+      },
+      {
+        "action": "Edit",
+        "detail": "Reopens the destination, schedule, profile and retention prompts and rewrites the job files. Preserves the job ID."
+      },
+      {
+        "action": "Delete",
+        "detail": "Removes the job env, paths file, systemd timer + service (New mode), and disables the hook binding (Attach mode). Does not touch archives already on the destination."
+      },
+      {
+        "action": "View log",
+        "detail": "Streams <code>/var/log/proxmenux/backup-jobs/JOB_ID-YYYYMMDD_HHMMSS.log</code> — one log file per run. The runner also emits a compact status line to journald under the systemd service."
+      }
     ]
   },
   "notifications": {
@@ -83,9 +132,21 @@
   "whereNext": {
     "heading": "Where to go next",
     "items": [
-      { "label": "Creating backups", "href": "/docs/backup-restore/creating-backups", "tail": " — the interactive flow that shares the backend with the scheduler." },
-      { "label": "Destinations", "href": "/docs/backup-restore/destinations", "tail": " — per-backend configuration used by both the interactive flow and the scheduler." },
-      { "label": "Restoring", "href": "/docs/backup-restore/restoring", "tail": " — the flow that consumes what jobs produce." }
+      {
+        "label": "Creating backups",
+        "href": "/docs/backup-restore/creating-backups",
+        "tail": " — the interactive flow that shares the backend with the scheduler."
+      },
+      {
+        "label": "Destinations",
+        "href": "/docs/backup-restore/destinations",
+        "tail": " — per-backend configuration used by both the interactive flow and the scheduler."
+      },
+      {
+        "label": "Restoring",
+        "href": "/docs/backup-restore/restoring",
+        "tail": " — the flow that consumes what jobs produce."
+      }
     ]
   }
 }
diff --git a/web/messages/en/docs/create-vm/index.json b/web/messages/en/docs/create-vm/index.json
index 4a3c9d12..e7784947 100644
--- a/web/messages/en/docs/create-vm/index.json
+++ b/web/messages/en/docs/create-vm/index.json
@@ -1,12 +1,12 @@
 {
   "meta": {
     "title": "Create VMs on Proxmox VE — Synology, Windows, Linux, NAS Wizards | ProxMenux",
-    "description": "Create and configure virtual machines on Proxmox VE with ProxMenux. Dedicated wizards for NAS appliances (Synology DSM, TrueNAS, OpenMediaVault, UnRAID, etc.), Windows, Linux distros, and an external macOS installer. Sensible defaults for VM hardware, storage and networking.",
+    "description": "Create and configure virtual machines on Proxmox VE with ProxMenux. Dedicated wizards for NAS appliances (Synology DSM, TrueNAS, OpenMediaVault, XigmaNAS, etc.), Windows, Linux distros, and an external macOS installer. Sensible defaults for VM hardware, storage and networking.",
     "ogTitle": "Create VMs on Proxmox VE — Synology, Windows, Linux, NAS Wizards",
-    "ogDescription": "ProxMenux wizards for creating Synology DSM, TrueNAS, OMV, UnRAID, Windows and Linux VMs on Proxmox VE.",
+    "ogDescription": "ProxMenux wizards for creating Synology DSM, TrueNAS, OMV, XigmaNAS, Windows and Linux VMs on Proxmox VE.",
     "ogImageAlt": "ProxMenux Create VM Menu",
     "twitterTitle": "Create VMs on Proxmox VE | ProxMenux",
-    "twitterDescription": "Wizards for Synology, TrueNAS, OMV, UnRAID, Windows and Linux VMs on Proxmox VE."
+    "twitterDescription": "Wizards for Synology, TrueNAS, OMV, XigmaNAS, Windows and Linux VMs on Proxmox VE."
   },
   "header": {
     "title": "Create VM",
@@ -33,13 +33,13 @@
         "href": "/docs/create-vm/system-nas",
         "accent": "border-emerald-300 bg-emerald-50",
         "iconBg": "bg-emerald-100 text-emerald-700",
-        "description": "Seven NAS operating systems as dedicated VMs. Most use the auto-ISO flow; Synology DSM runs the specialised loader wizard.",
+        "description": "Eight NAS operating systems as dedicated VMs. Most use the auto-ISO flow; Synology DSM runs the specialised loader wizard.",
         "bullets": [
-          "Synology DSM (ARC / RR / TinyCore loaders)",
+          "Synology DSM (Arc / RR / Alpine RedPill M-shell loaders)",
           "TrueNAS SCALE and CORE (ZFS)",
           "OpenMediaVault (Debian-based)",
           "XigmaNAS (FreeBSD ZFS)",
-          "Rockstor (openSUSE / Btrfs), ZimaOS"
+          "Rockstor (openSUSE / Btrfs), ZimaOS, FygoOS"
         ]
       },
       {
@@ -106,7 +106,7 @@
       },
       {
         "path": "vm/select_nas_iso.sh",
-        "role": "ISO / appliance selector for NAS systems (Synology, TrueNAS, OMV, Rockstor, ZimaOS)."
+        "role": "ISO / appliance selector for NAS systems (Synology, TrueNAS, OMV, Rockstor, XigmaNAS, ZimaOS, FygoOS)."
       },
       {
         "path": "vm/select_windows_iso.sh",
diff --git a/web/messages/en/docs/create-vm/synology.json b/web/messages/en/docs/create-vm/synology.json
index 60b6314b..92dddc4d 100644
--- a/web/messages/en/docs/create-vm/synology.json
+++ b/web/messages/en/docs/create-vm/synology.json
@@ -16,7 +16,7 @@
         "extra": ""
       },
       {
-        "name": "TinyCore RedPill M-shell",
+        "name": "Alpine RedPill M-shell (TinyCore project)",
         "url": "https://github.com/PeterSuh-Q3/tinycore-redpill",
         "extra": ""
       }
@@ -115,24 +115,24 @@
   },
   "diskSelection": {
     "heading": "Disk Selection",
-    "intro": "Once the machine is configured, the script allows you to choose between two types of disks:",
+    "intro": "The storage plan lets you add virtual disks, physical disks, and PCI controllers or NVMe devices. The disk options are explained below.",
     "virtualHeading": "Virtual Disk",
     "virtualItems": [
       "The script lists the storage options available in Proxmox",
       "The user selects the disk and size in GB",
-      "The virtual disk is automatically assigned to the VM. If more disks are configured, they will be added as <strong>SATA</strong> (e.g., sata0, sata1, etc.), up to a maximum of 6 virtual disks."
+      "Virtual disks are attached as <strong>SATA</strong> (sata0, sata1, etc.). Virtual and physical data disks share the six SATA slots numbered 0–5; the loader uses a separate IDE slot."
     ],
     "physicalHeading": "Physical Disk Passthrough",
     "physicalItems": [
       "The script detects all available physical disks",
       "The user selects the physical disk or disks they want to use.",
-      "The physical disk is directly assigned to the VM via passthrough. If more disks are configured, they will be added as <strong>SATA</strong> (e.g., sata0, sata1, etc.), up to a maximum of 6 physical disks."
+      "Physical disks are attached as <strong>SATA</strong> devices. They share the six SATA slots numbered 0–5 with virtual data disks; this is not a separate allowance of six physical disks."
     ]
   },
   "loaderInstall": {
     "heading": "Loader Installation",
     "intro1": "The script automatically downloads and extracts the loader from the developer's repository. If the download fails, the script will display an error message.",
-    "intro2Rich": "<strong>AuxXxilium Arc</strong>, <strong>RedPill RR</strong>, and <strong>TinyCore RedPill M-shell</strong>. Downloads and extracts automatically.",
+    "intro2Rich": "<strong>AuxXxilium Arc</strong>, <strong>RedPill RR</strong>, and <strong>Alpine RedPill M-shell</strong> are downloaded and extracted automatically.",
     "customRich": "For <strong>Custom Loader</strong>, the script searches for files in <code>/var/lib/vz/template/iso</code>. If multiple files are found, you will be prompted to select the desired file.",
     "uploadIntro": "You can upload custom loaders from the local storage options:",
     "imageAlt": "Add Custom Loader",
@@ -143,14 +143,14 @@
     "intro": "Once the loader is downloaded, the script creates the VM using the following commands:",
     "items": [
       "<code>qm create</code> – Creates the virtual machine with the configured parameters",
-      "<code>qm importdisk</code> – Imports the boot loader disk to the VM. For greater compatibility the loader is imported as an IDE disk",
+      "<code>qm importdisk</code> imports the loader image to Proxmox storage. The script then attaches that image to the VM as ide0 for compatibility.",
       "<code>qm set</code> – Assigns configuration values such as CPU, RAM, and storage",
-      "<code>qm set -boot</code> – Configures the boot order"
+      "<code>qm set VMID --boot order=ide0</code> configures the loader as the boot device. Replace VMID with the VM ID."
     ]
   },
   "stepGuide": {
     "heading": "Step-by-Step Boot Loader Configuration Guide",
-    "intro": "While all loaders share similarities, each one has its own structure and configuration methods. This section provides a basic guide covering the 6 steps involved in setting up a Synology DSM loader. The exact steps may vary depending on the loader and any changes introduced by the developer. Therefore, understanding these common basic steps is crucial to correctly building and configuring the loader of your choice for proper Synology DSM functionality.",
+    "intro": "Each loader has its own menus and configuration methods. The six steps below explain the common process; follow the current loader’s prompts when they differ. The M-shell screenshots show an earlier TinyCore interface, while the current script downloads Alpine RedPill M-shell.",
     "selectorHeading": "Select your loader type:",
     "loaderButtons": {
       "arc": "Arc Loader",
diff --git a/web/messages/en/docs/create-vm/system-linux.json b/web/messages/en/docs/create-vm/system-linux.json
index c2eafe21..2961a40b 100644
--- a/web/messages/en/docs/create-vm/system-linux.json
+++ b/web/messages/en/docs/create-vm/system-linux.json
@@ -73,7 +73,7 @@
       },
       {
         "param": "CPU type",
-        "options": "Host or KVM64"
+        "options": "Host, KVM64 and other listed CPU models"
       },
       {
         "param": "Cores",
@@ -108,19 +108,19 @@
     "virtualDiskItems": [
       "Lists the Proxmox storage volumes available on the host.",
       "You pick the target storage and the size in GB.",
-      "The disk is attached to the VM as SATA (<code>sata0</code>, <code>sata1</code>, … up to 6)."
+      "The disk uses the selected bus: SCSI (default), SATA, VirtIO or IDE. SATA slots are <code>sata0</code>, <code>sata1</code>, …, with six slots numbered 0–5."
     ],
     "importDiskTitle": "b. Add import disk",
     "importDiskItems": [
       "Detects physical disks that are safe to import (system and protected disks are hidden).",
       "You select one or more disks via a checklist.",
-      "Imported disks are attached as SATA via <code>qm set</code>."
+      "Imported disks use the selected bus and are attached via <code>qm set</code>."
     ],
     "pciTitle": "c. Add Controller or NVMe (PCI passthrough)",
     "pciItems": [
       "Detects SATA/SAS HBAs and NVMe devices on the host and lets you pass an <em>entire controller</em> into the VM. IOMMU must be enabled; the script offers to enable it and reboots if required.",
       "A confirmation step warns about controller-wide risk (the whole card, including every disk on it, leaves the host).",
-      "The selected PCI devices are attached via <code>qm set hostpciN: …</code>."
+      "The selected PCI devices are attached with commands such as <code>qm set VMID --hostpci0 PCI_ADDRESS,pcie=1</code>. Replace VMID and PCI_ADDRESS with the VM ID and PCI address, and use an unused hostpci index for each device."
     ],
     "resetTitle": "Reset and finish",
     "resetBody": "The menu also offers <strong>r</strong> (reset the current selection and start over) and <strong>d</strong> (finish and continue). You cannot finish with an empty plan."
@@ -241,15 +241,15 @@
   "postInstall": {
     "heading": "Post-install tips",
     "guestAgentHeading": "Install the QEMU Guest Agent inside the VM",
-    "guestAgentBody": "ProxMenux enables the guest agent channel in the VM config, but the agent itself has to be installed inside the guest. It enables graceful shutdown, filesystem freeze for consistent snapshots and accurate memory reporting in the Proxmox UI.",
+    "guestAgentBody": "ProxMenux enables the guest agent channel in the VM config, but the agent itself has to be installed inside the guest. It supports controlled shutdown and filesystem freezing during backups to improve data consistency.",
     "debian": "Debian / Ubuntu",
     "fedora": "Fedora / Rocky / RHEL",
     "arch": "Arch Linux",
     "opensuse": "openSUSE",
     "virtioHeading": "VirtIO support in Linux",
-    "virtioBody": "Modern Linux kernels (2.6.25+) include VirtIO disk and network drivers out of the box, so you can switch the disk interface to <code>virtio</code> or <code>virtio-scsi</code> in the Advanced wizard and the network adapter to <code>virtio</code> without any extra driver step.",
+    "virtioBody": "Modern Linux distributions normally include VirtIO disk and network drivers. Select <code>virtio</code> for VirtIO block disks, or <code>scsi</code> with the configured VirtIO SCSI controller; the network adapter also uses <code>virtio</code>. Check driver support with older installers.",
     "virtioWarnTitle": "Very old distributions",
-    "virtioWarnBody": "If you are installing something predating the 2.6.25 kernel, VirtIO modules may not be available at install time. In that case keep SATA / SCSI or provide a driver disk.",
+    "virtioWarnBody": "Very old installers may lack the required VirtIO drivers. In that case use an emulated SATA / SCSI controller or supply suitable drivers.",
     "trimHeading": "Enable TRIM / discard on SSD-backed storage",
     "trimBody": "When the VM sits on SSD-backed Proxmox storage and the disk was attached with the <code>discard</code> flag, you can forward trim commands from inside the guest. Two options:",
     "trimItems": [
@@ -257,7 +257,7 @@
       "Or mount filesystems with the <code>discard</code> option in <code>/etc/fstab</code>."
     ],
     "balloonHeading": "Memory ballooning",
-    "balloonBody": "The <code>virtio_balloon</code> driver ships with modern Linux kernels. Proxmox uses it to reclaim unused memory from the VM and show accurate utilisation in the UI — no guest-side configuration required."
+    "balloonBody": "Modern Linux kernels normally include the <code>virtio_balloon</code> driver. With a balloon device enabled, Proxmox can collect memory statistics. Dynamic memory reclamation also requires a minimum memory setting below the configured maximum; equal values keep memory allocation fixed."
   },
   "related": {
     "heading": "Related",
diff --git a/web/messages/en/docs/create-vm/system-nas/index.json b/web/messages/en/docs/create-vm/system-nas/index.json
index 804f5105..dbd47be1 100644
--- a/web/messages/en/docs/create-vm/system-nas/index.json
+++ b/web/messages/en/docs/create-vm/system-nas/index.json
@@ -13,7 +13,7 @@
   },
   "intro": {
     "title": "How the NAS selector works",
-    "body": "The NAS selector detects the latest stable release of each appliance (querying its upstream mirror), downloads the ISO — or builds the VM from a pre-packaged image — and then hands over to the generic ProxMenux VM wizard for CPU, RAM, disk and network configuration."
+    "body": "For the generic ISO flow, the NAS selector tries to detect the latest stable release from the project’s mirror, uses a fallback version if needed, downloads the ISO and opens the shared VM configurator for CPU, RAM, disks and networking. Synology DSM and ZimaOS use dedicated installer flows."
   },
   "image": {
     "alt": "ProxMenux System NAS selector",
@@ -43,7 +43,7 @@
       },
       {
         "name": "TrueNAS SCALE",
-        "tagline": "Debian-based TrueNAS with Docker / Kubernetes apps and ZFS as primary filesystem.",
+        "tagline": "Debian-based TrueNAS with Docker apps in current releases and ZFS as the primary filesystem. Kubernetes was used by older SCALE releases.",
         "icon": "Database",
         "base": "Debian Linux",
         "fileSystem": "ZFS",
@@ -52,7 +52,7 @@
       },
       {
         "name": "TrueNAS CORE",
-        "tagline": "FreeBSD-based TrueNAS. Enterprise-grade ZFS storage with jails and plugins.",
+        "tagline": "FreeBSD-based TrueNAS focused on ZFS storage. Jails and plugins in CORE 13.3 are obsolete and unsupported.",
         "icon": "Database",
         "base": "FreeBSD",
         "fileSystem": "ZFS",
@@ -90,7 +90,7 @@
         "name": "ZimaOS",
         "tagline": "Lightweight NAS OS focused on media, Docker apps and home automation. Uses its own installer.",
         "icon": "MonitorIcon",
-        "base": "Debian / CasaOS",
+        "base": "Buildroot (evolved from CasaOS)",
         "fileSystem": "ext4",
         "href": "/docs/create-vm/system-nas/system-nas-others#zimaos",
         "flow": "dedicated"
@@ -112,7 +112,7 @@
   },
   "zfsMem": {
     "title": "ZFS memory rule of thumb",
-    "bodyRich": "If you pick a ZFS-based NAS (TrueNAS, XigmaNAS), allocate at least <strong>8 GB RAM</strong> to the VM — ZFS uses free memory as ARC cache and performance degrades noticeably below that. Rockstor (Btrfs) and OMV (ext4) are far less memory-hungry."
+    "bodyRich": "For TrueNAS, allocate at least <strong>8 GB RAM</strong> for basic operation and more for demanding workloads. ZFS uses RAM for its ARC cache, but there is no universal 8 GB performance cliff for every ZFS-based NAS. Check the chosen distribution’s requirements and size memory for its disks, services and apps; lighter OMV or Rockstor setups can need less."
   },
   "related": {
     "heading": "Related",
diff --git a/web/messages/en/docs/create-vm/system-nas/synology.json b/web/messages/en/docs/create-vm/system-nas/synology.json
index 70c057ef..27506294 100644
--- a/web/messages/en/docs/create-vm/system-nas/synology.json
+++ b/web/messages/en/docs/create-vm/system-nas/synology.json
@@ -1,13 +1,13 @@
 {
   "meta": {
     "title": "Create VM: Synology DSM | ProxMenux Documentation",
-    "description": "Create a Synology DSM virtual machine on Proxmox VE. ProxMenux downloads the loader of your choice (Arc, RR, TinyCore M-shell or a custom one), imports it as the VM's boot disk and prepares CPU, RAM and storage through the default or advanced wizard.",
+    "description": "Create a Synology DSM virtual machine on Proxmox VE. ProxMenux downloads your chosen loader (Arc, RR, Alpine RedPill M-shell or a custom image), imports it as the VM boot disk and configures CPU, RAM and storage through the default or advanced wizard.",
     "ogTitle": "Create VM: Synology DSM | ProxMenux Documentation",
     "ogDescription": "Create a Synology DSM virtual machine on Proxmox VE with ProxMenux."
   },
   "header": {
     "title": "Create VM: Synology DSM",
-    "description": "Create a Synology DSM virtual machine on Proxmox VE. ProxMenux downloads the loader of your choice (Arc, RR, TinyCore M-shell or a custom one), imports it as the VM's boot disk and prepares CPU, RAM and storage through the default or advanced wizard.",
+    "description": "Create a Synology DSM virtual machine on Proxmox VE. ProxMenux downloads your chosen loader (Arc, RR, Alpine RedPill M-shell or a custom image), imports it as the VM boot disk and configures CPU, RAM and storage through the default or advanced wizard.",
     "section": "Virtual Machines · NAS"
   },
   "loaderLabels": {
@@ -32,7 +32,7 @@
         "url": "https://github.com/RROrg/rr"
       },
       {
-        "name": "TinyCore RedPill M-shell",
+        "name": "Alpine RedPill M-shell (TinyCore project)",
         "url": "https://github.com/PeterSuh-Q3/tinycore-redpill"
       }
     ],
@@ -127,7 +127,7 @@
     "virtualItemsRich": [
       "Lists the Proxmox storage volumes available on the host.",
       "You pick the target storage and the size in GB.",
-      "The disk is attached to the VM as SATA (<code>sata0</code>, <code>sata1</code>, … up to 6)."
+      "The disk is attached as SATA (<code>sata0</code>, <code>sata1</code>, …). Virtual and physical data disks share the six SATA slots numbered 0–5."
     ],
     "importHeading": "b. Add import disk",
     "importItemsRich": [
@@ -139,7 +139,7 @@
     "pciItemsRich": [
       "Detects SATA/SAS HBAs and NVMe devices on the host and lets you pass an <em>entire controller</em> into the VM. IOMMU must be enabled; the script offers to enable it and reboots if required.",
       "A confirmation step warns about controller-wide risk (the whole card, including every disk on it, leaves the host).",
-      "The selected PCI devices are attached via <code>qm set hostpciN: …</code>."
+      "The selected PCI devices are attached with commands such as <code>qm set VMID --hostpci0 PCI_ADDRESS,pcie=1</code>. Replace VMID and PCI_ADDRESS with the VM ID and PCI address, and use an unused hostpci index for each device."
     ],
     "resetCalloutTitle": "Reset and finish",
     "resetCalloutBodyRich": "The menu also offers <strong>r</strong> (reset the current selection and start over) and <strong>d</strong> (finish and continue). You cannot finish with an empty plan — Synology needs at least one disk to install DSM on."
@@ -150,7 +150,7 @@
   },
   "loaderInstall": {
     "heading": "Loader installation",
-    "intro1Rich": "<strong>Arc</strong>, <strong>RR</strong> and <strong>TinyCore M-shell</strong> are downloaded and extracted automatically from their upstream GitHub repositories. If the download fails the script aborts with a clear message.",
+    "intro1Rich": "<strong>Arc</strong>, <strong>RR</strong> and <strong>Alpine RedPill M-shell</strong> are downloaded and extracted automatically from their upstream GitHub repositories. If the download fails the script aborts with a clear message.",
     "intro2Rich": "For the <strong>Custom Loader</strong> option the script scans <code>/var/lib/vz/template/iso</code>. If more than one candidate is found you are prompted to pick the one you want.",
     "uploadIntro": "You can upload custom loaders from Proxmox local storage:",
     "imageAlt": "Add custom loader",
@@ -161,17 +161,17 @@
     "introRich": "Once you confirm the loader, ProxMenux runs the equivalent of these <code>qm</code> commands:",
     "itemsRich": [
       "<code>qm create</code> — creates the VM with the selected CPU, RAM, BIOS and machine type.",
-      "<code>qm importdisk</code> — imports the loader as an <strong>IDE</strong> disk (maximum compatibility).",
-      "<code>qm set sataN: …</code> — attaches virtual disks and imported disks from the storage plan, plus the network interface.",
-      "<code>qm set hostpciN: …</code> — attaches any Controller / NVMe devices selected for PCI passthrough.",
-      "<code>qm set --boot</code> — sets the loader as the first boot device."
+      "<code>qm importdisk</code> imports the loader image to Proxmox storage. The script then attaches it to the VM as an <strong>IDE</strong> disk on ide0 for compatibility.",
+      "<code>qm set VMID --sata0 DISK_REFERENCE</code> attaches a planned data disk. Replace VMID and DISK_REFERENCE with the VM ID and disk reference; use a free SATA index from 0–5. The network adapter is configured by qm create.",
+      "<code>qm set VMID --hostpci0 PCI_ADDRESS,pcie=1</code> attaches a selected PCI controller or NVMe device. Replace VMID and PCI_ADDRESS with the VM ID and PCI address, and use a free hostpci index for each device.",
+      "<code>qm set VMID --boot order=ide0</code> configures the loader as the boot device. Replace VMID with the VM ID."
     ]
   },
   "stepByStep": {
     "heading": "Step-by-step loader configuration",
-    "intro": "All loaders follow the same high-level pattern — start the VM, pick a model, pick a DSM version, pick add-ons, build, boot — but the screens and menus differ. The guide below walks through the six shared steps with screenshots for each loader. Exact options may change with new loader releases.",
+    "intro": "The six common steps are: start the VM, choose a model, choose a DSM version, choose add-ons, build and boot. Menus and options vary by release. The M-shell screenshots below show an earlier TinyCore interface; the current script downloads Alpine RedPill M-shell, so follow its current prompts.",
     "warnCalloutTitle": "Loaders are not maintained by ProxMenux",
-    "warnCalloutBody": "Arc, RR and TinyCore are community projects with their own release cadence. If a step looks different from the screenshots below, the loader has probably updated — check the loader's own documentation (links at the bottom of this page)."
+    "warnCalloutBody": "Arc, RR and Alpine RedPill M-shell are community projects with their own release cadence. If a step looks different from the screenshots below, the loader has probably updated — check the loader's own documentation (links at the bottom of this page)."
   },
   "stepBadge": "Step",
   "step1": {
diff --git a/web/messages/en/docs/create-vm/system-nas/system-nas-others.json b/web/messages/en/docs/create-vm/system-nas/system-nas-others.json
index d84f12c1..7cee45e1 100644
--- a/web/messages/en/docs/create-vm/system-nas/system-nas-others.json
+++ b/web/messages/en/docs/create-vm/system-nas/system-nas-others.json
@@ -69,7 +69,7 @@
       },
       {
         "param": "CPU type",
-        "optionsRich": "Host or KVM64"
+        "optionsRich": "Host, KVM64 and other listed CPU models (ZimaOS: Host or KVM64)"
       },
       {
         "param": "Cores",
@@ -97,7 +97,7 @@
       }
     ],
     "zfsCalloutTitle": "ZFS and RAM",
-    "zfsCalloutBody": "TrueNAS SCALE / CORE and XigmaNAS are ZFS-based. ZFS uses free memory as ARC cache, so the 8 GB default is a minimum — bump it to 16 GB or more if you plan to store anything meaningful. OMV (ext4/XFS), Rockstor (Btrfs) and ZimaOS are far less memory-hungry."
+    "zfsCalloutBody": "TrueNAS SCALE / CORE and XigmaNAS use ZFS, whose ARC cache benefits from RAM. TrueNAS needs at least 8 GB for basic use; 16 GB or more can help with heavier services and apps. Size the VM for the chosen distribution and workload rather than treating 8 GB as a universal ZFS minimum. Lighter OMV, Rockstor or ZimaOS setups can need less."
   },
   "storagePlan": {
     "heading": "Storage plan",
@@ -106,19 +106,19 @@
     "virtualItemsRich": [
       "Lists the Proxmox storage volumes available on the host.",
       "You pick the target storage and the size in GB.",
-      "The disk is attached to the VM as SATA (<code>sata0</code>, <code>sata1</code>, … up to 6)."
+      "The disk uses the selected bus: SCSI (default), SATA, VirtIO or IDE (ZimaOS: SCSI or SATA). SATA slots are <code>sata0</code>, <code>sata1</code>, …, with six slots numbered 0–5."
     ],
     "importHeading": "b. Add import disk",
     "importItemsRich": [
       "Detects physical disks that are safe to import (system and protected disks are hidden).",
       "You select one or more disks via a checklist.",
-      "Imported disks are attached as SATA via <code>qm set</code>."
+      "Imported disks use the selected bus and are attached via <code>qm set</code>."
     ],
     "pciHeading": "c. Add Controller or NVMe (PCI passthrough)",
     "pciItemsRich": [
       "Detects SATA/SAS HBAs and NVMe devices on the host and lets you pass an <em>entire controller</em> into the VM. IOMMU must be enabled; the script offers to enable it and reboots if required.",
       "A confirmation step warns about controller-wide risk (the whole card, including every disk on it, leaves the host).",
-      "The selected PCI devices are attached via <code>qm set hostpciN: …</code>."
+      "The selected PCI devices are attached with commands such as <code>qm set VMID --hostpci0 PCI_ADDRESS,pcie=1</code>. Replace VMID and PCI_ADDRESS with the VM ID and PCI address, and use an unused hostpci index for each device."
     ],
     "resetCalloutTitle": "Reset and finish",
     "resetCalloutBodyRich": "The menu also offers <strong>r</strong> (reset the current selection and start over) and <strong>d</strong> (finish and continue). You cannot finish with an empty plan."
@@ -163,7 +163,7 @@
       "icon": "Database",
       "officialName": "TrueNAS SCALE",
       "officialUrl": "https://www.truenas.com/truenas-scale/",
-      "description": "Debian-based TrueNAS with Docker / Kubernetes apps, Linux KVM and ZFS as the primary filesystem. The modern successor to FreeNAS for users who want ZFS plus a container ecosystem.",
+      "description": "Debian-based TrueNAS with Docker apps in current releases, Linux KVM and ZFS as the primary filesystem. Older SCALE releases used Kubernetes. It combines ZFS storage with a container ecosystem.",
       "specs": [
         "Recommended interface: SATA or SCSI (both support discard/trim)",
         "Minimum RAM: 8 GB (16 GB+ recommended for real workloads)",
@@ -182,7 +182,7 @@
       "icon": "Database",
       "officialName": "TrueNAS CORE",
       "officialUrl": "https://www.truenas.com/truenas-core/",
-      "description": "FreeBSD-based TrueNAS (the former FreeNAS). Mature ZFS storage with jails and plugins, but no Docker / Kubernetes. Being phased out in favour of SCALE but still widely deployed.",
+      "description": "FreeBSD-based TrueNAS, formerly FreeNAS, focused on ZFS storage. CORE 13.3 jails, plugins and virtualization features are obsolete and unsupported; current development focuses on the Linux-based editions.",
       "specs": [
         "Recommended interface: SATA",
         "Minimum RAM: 8 GB (16 GB+ recommended)",
@@ -254,7 +254,7 @@
       "icon": "MonitorIcon",
       "officialName": "zimaspace.com",
       "officialUrl": "https://www.zimaspace.com/zimaos",
-      "description": "Lightweight NAS / home-server OS built on top of Debian, with a focus on media, Docker apps and home automation. ZimaOS uses a dedicated ProxMenux installer (vm/zimaos.sh) that downloads a pre-built image, but the VM profile follows the same flow as the other NAS systems.",
+      "description": "Lightweight NAS / home-server OS built with Buildroot, evolved from CasaOS, with a focus on media, Docker apps and home automation. ZimaOS uses a dedicated ProxMenux installer (vm/zimaos.sh) that downloads a pre-built image, while offering CPU, RAM and storage configuration.",
       "specs": [
         "Recommended interface: SATA or VirtIO",
         "Default RAM: 4 GB (enough for media / self-hosted apps)",
diff --git a/web/messages/en/docs/create-vm/system-windows.json b/web/messages/en/docs/create-vm/system-windows.json
index aaa78f8e..99ec68dd 100644
--- a/web/messages/en/docs/create-vm/system-windows.json
+++ b/web/messages/en/docs/create-vm/system-windows.json
@@ -77,7 +77,7 @@
       },
       {
         "param": "CPU type",
-        "options": "Host or KVM64"
+        "options": "Host, KVM64 and other listed CPU models"
       },
       {
         "param": "Cores",
@@ -105,11 +105,11 @@
       },
       {
         "param": "TPM",
-        "options": "Enable or disable TPM 2.0"
+        "options": "TPM 2.0 is added automatically for Windows; this wizard has no TPM toggle."
       }
     ],
-    "tpmWarnTitle": "Windows 11 and Windows Server 2022 need TPM",
-    "tpmWarnBody": "Windows 11 and Windows Server 2022 refuse to install without a TPM 2.0 device attached to the VM. ProxMenux adds it by default; only disable it in Advanced if you know the target edition does not require it."
+    "tpmWarnTitle": "TPM requirements depend on the Windows edition",
+    "tpmWarnBody": "Windows 11 normally requires TPM 2.0. Windows Server 2022 requires it for certain security features, not for every installation. ProxMenux adds a virtual TPM for Windows; the advanced wizard does not offer a TPM toggle."
   },
   "storagePlan": {
     "heading": "Storage plan",
@@ -118,19 +118,19 @@
     "virtualDiskItems": [
       "Lists the Proxmox storage volumes available on the host.",
       "You pick the target storage and the size in GB.",
-      "The disk is attached to the VM as SATA (<code>sata0</code>, <code>sata1</code>, … up to 6)."
+      "The disk uses the selected bus: SCSI (default), SATA, VirtIO or IDE. SATA slots are <code>sata0</code>, <code>sata1</code>, …, with six slots numbered 0–5."
     ],
     "importDiskTitle": "b. Add import disk",
     "importDiskItems": [
       "Detects physical disks that are safe to import (system and protected disks are hidden).",
       "You select one or more disks via a checklist.",
-      "Imported disks are attached as SATA via <code>qm set</code>."
+      "Imported disks use the selected bus and are attached via <code>qm set</code>."
     ],
     "pciTitle": "c. Add Controller or NVMe (PCI passthrough)",
     "pciItems": [
       "Detects SATA/SAS HBAs and NVMe devices on the host and lets you pass an <em>entire controller</em> into the VM. IOMMU must be enabled; the script offers to enable it and reboots if required.",
       "A confirmation step warns about controller-wide risk (the whole card, including every disk on it, leaves the host).",
-      "The selected PCI devices are attached via <code>qm set hostpciN: …</code>."
+      "The selected PCI devices are attached with commands such as <code>qm set VMID --hostpci0 PCI_ADDRESS,pcie=1</code>. Replace VMID and PCI_ADDRESS with the VM ID and PCI address, and use an unused hostpci index for each device."
     ],
     "resetTitle": "Reset and finish",
     "resetBody": "The menu also offers <strong>r</strong> (reset the current selection and start over) and <strong>d</strong> (finish and continue). You cannot finish with an empty plan."
@@ -144,7 +144,7 @@
     "efiTitle": "EFI disk",
     "efiBody": "When OVMF (UEFI) is selected, ProxMenux creates a 4 MB EFI system disk on the storage you pick and attaches it to the VM so the UEFI firmware has a place to store its variables.",
     "tpmTitle": "TPM 2.0",
-    "tpmBody": "A virtual TPM 2.0 device is added automatically so Windows 11 / Server 2022 installers pass the hardware compatibility check.",
+    "tpmBody": "ProxMenux adds a virtual TPM 2.0 device for Windows VMs. This meets the Windows 11 TPM requirement and supports TPM-dependent features in Windows Server.",
     "isoTitle": "ISO mounting",
     "isoBody": "The installation ISO is attached to <code>ide2</code>. The VirtIO drivers ISO is downloaded (if needed) and attached to <code>ide3</code>, ready for the <em>Load driver</em> step.",
     "guestTitle": "QEMU Guest Agent",
@@ -187,9 +187,9 @@
   },
   "virtio": {
     "heading": "VirtIO drivers during installation",
-    "body": "If you leave storage and networking at defaults (SATA + e1000), Windows will install without extra steps. However, the Proxmox storage plan always attaches virtual disks as SATA, which works out of the box. Where VirtIO becomes relevant is if, during the Advanced wizard, you pick VirtIO or SCSI for disks or VirtIO for the NIC — in that case Windows will not see those devices until the matching driver is loaded from the VirtIO ISO mounted at <code>ide3</code>.",
-    "warnTitle": "Without the VirtIO network driver there is no internet during install",
-    "warnBody": "If you picked VirtIO (<code>virtio</code>) as the network interface and do not load the driver during setup, Windows will not have internet access. That can block activation and Windows Update steps during first boot.",
+    "body": "The VM creator defaults to SCSI disks with a VirtIO SCSI controller and a VirtIO network adapter. A standard Windows ISO may need their drivers from the VirtIO ISO mounted at <code>ide3</code>. SATA disks usually work with built-in Windows drivers; choosing SATA does not change the VirtIO network adapter.",
+    "warnTitle": "Load the VirtIO network driver if Windows has no network",
+    "warnBody": "The VM uses a VirtIO (<code>virtio</code>) network adapter. If Windows does not include its driver, load it during setup to obtain network access. Otherwise activation and Windows Update may be unavailable during first boot.",
     "stepLabel": "Step",
     "steps": [
       {
@@ -206,7 +206,7 @@
       },
       {
         "title": "Browse to the correct driver folder",
-        "bodyRich": "On the VirtIO ISO navigate to the folder that matches the interface and Windows version — for example <code>viostor</code> for VirtIO SCSI, with subfolders per Windows edition (10 / 11 / Server).",
+        "bodyRich": "On the VirtIO ISO select <code>vioscsi</code> for the VirtIO SCSI controller or <code>viostor</code> for VirtIO block disks. Then choose the subfolder for your Windows version and architecture.",
         "img": "/vm/windows/virtio-step-3.png",
         "caption": "Browse to the appropriate driver folder"
       },
@@ -237,7 +237,7 @@
       {
         "href": "/docs/disk-manager/import-disk-image-vm",
         "label": "Import Disk Image to VM",
-        "tail": " — attach an existing Windows .vhdx / .vmdk to a fresh VM."
+        "tail": " — import an existing Windows disk image (.vmdk, .qcow2, .img or .raw) into an existing VM; convert .vhdx images to a supported format first."
       },
       {
         "href": "/docs/hardware/gpu-vm-passthrough",
diff --git a/web/messages/en/docs/disk-manager/add-controller-nvme-vm.json b/web/messages/en/docs/disk-manager/add-controller-nvme-vm.json
index 5ededbcd..c31d5306 100644
--- a/web/messages/en/docs/disk-manager/add-controller-nvme-vm.json
+++ b/web/messages/en/docs/disk-manager/add-controller-nvme-vm.json
@@ -20,7 +20,7 @@
   },
   "iommu": {
     "heading": "IOMMU groups — why the whole card leaves at once",
-    "body": "PCI passthrough is done per <strong>IOMMU group</strong>, which is the smallest unit the CPU's IOMMU can isolate. Everything inside a group moves together. If your SATA controller shares its IOMMU group with the USB controller, passing the SATA card to a VM also takes the USB ports with it — often undesirable.",
+    "body": "The isolation boundary for PCI passthrough is the <strong>IOMMU group</strong>, the smallest unit the CPU’s IOMMU can isolate. Devices in the same group cannot be isolated from each other. If a SATA controller shares its group with a USB controller, passing through SATA may also require releasing USB from the host, or may prevent passthrough. It does not automatically assign every device in the group to the VM.",
     "outro": "ProxMenux shows the IOMMU group next to each device and warns you when a group carries more than just the controller you want. You can still proceed if the extra devices in the group are acceptable (all disk controllers, for example), or back out if they are not."
   },
   "prereqs": {
@@ -97,7 +97,7 @@
     "busyBody": "Another process still holds the PCI device. Most common causes: a previous VM that crashed without releasing it, or the host kernel reclaimed it on the last boot. Run <code>lspci -nnk -s &lt;addr&gt;</code> to see which driver is bound; it should be <code>vfio-pci</code>. A full host reboot usually clears this.",
     "noDisksTitle": "Guest sees the controller but not the disks",
     "noDisksBody": "The controller model lacks an in-guest driver. Linux almost never hits this; Windows does — install the vendor driver (e.g. LSI / Broadcom for older SAS HBAs) while the card is detached, then reboot with the card attached.",
-    "sharedTitle": "Shared IOMMU group also exports an unrelated device",
+    "sharedTitle": "The IOMMU group includes an unrelated device",
     "sharedBody": "Options: (a) move the card to a different PCIe slot to change its group, (b) enable <em>ACS override</em> in the kernel to split groups (security trade-off — research before applying), or (c) pick a different card in a cleaner group."
   },
   "related": {
diff --git a/web/messages/en/docs/disk-manager/format-disk.json b/web/messages/en/docs/disk-manager/format-disk.json
index 47231c5f..f60c46b5 100644
--- a/web/messages/en/docs/disk-manager/format-disk.json
+++ b/web/messages/en/docs/disk-manager/format-disk.json
@@ -46,19 +46,19 @@
         "mode": "1. Wipe all",
         "part": "Destroyed",
         "data": "Signatures wiped",
-        "useCase": "Starting fresh: everything on the disk goes, ready for a new layout."
+        "useCase": "Removes the partition table and the filesystem and RAID metadata, zeroes the first and last 16 MiB and, on drives that support discard, trims the whole disk. The rest of the data is not overwritten and may still be recoverable on HDDs; this is not a secure erase."
       },
       {
         "mode": "2. Remove FS labels",
         "part": "Preserved",
         "data": "Preserved",
-        "useCase": "Clears stale ZFS / LVM / RAID signatures so the disk stops being auto-claimed, without touching the data."
+        "useCase": "Removes stale ZFS / LVM / RAID signatures so the disk is no longer auto-claimed. Bulk user data is not overwritten, but removing signatures can make it inaccessible."
       },
       {
         "mode": "3. Zero all data",
         "part": "Preserved",
         "data": "Destroyed (zeroed)",
-        "useCase": "Sanitise before handing the disk over, keeping the existing partition layout."
+        "useCase": "Overwrite the existing partitions with zeros while keeping the partition table. Unallocated space and SSD spare areas are not covered; this is not a complete device sanitization guarantee."
       },
       {
         "mode": "4. Full format",
diff --git a/web/messages/en/docs/disk-manager/import-disk-image-vm.json b/web/messages/en/docs/disk-manager/import-disk-image-vm.json
index f2de9d99..314bbf4e 100644
--- a/web/messages/en/docs/disk-manager/import-disk-image-vm.json
+++ b/web/messages/en/docs/disk-manager/import-disk-image-vm.json
@@ -52,7 +52,7 @@
         "intro": "For every selected image ProxMenux asks:",
         "items": [
           "<strong>Interface</strong> — <code>scsi</code> (default), <code>virtio</code>, <code>sata</code> or <code>ide</code>. Matches how the guest will see the disk.",
-          "<strong>SSD emulation</strong> — only offered for non-VirtIO interfaces. Adds <code>ssd=1</code> so the guest advertises the disk as solid-state (useful for OS-level TRIM / alignment).",
+          "<strong>SSD emulation</strong> — only offered for non-VirtIO interfaces. Adds <code>ssd=1</code> so the guest recognizes a solid-state disk. Discard/TRIM support must be configured separately.",
           "<strong>Bootable</strong> — if yes, ProxMenux adds the disk to the boot order so it becomes the primary boot device of the VM."
         ]
       },
@@ -73,7 +73,7 @@
     "noImagesTitle": "\"No compatible disk images found\"",
     "noImagesBody": "The script scanned the directory but found no <code>.img</code> / <code>.qcow2</code> / <code>.vmdk</code> / <code>.raw</code> file. Check the extension (case matters), that the file sits directly in the selected directory (no sub-directories are searched) and that permissions allow root to read it.",
     "slowTitle": "Import is slow",
-    "slowBody": "VMDK → QCOW2 → raw conversions are CPU- and I/O-bound. Import speed depends on the source read speed, the target storage write speed and CPU for decompression. Prefer raw or qcow2 sources when possible.",
+    "slowBody": "Conversions between VMDK, QCOW2 and raw can be limited by CPU and I/O. Import speed depends on source reads, target writes and any decompression work. Prefer raw or qcow2 sources when possible.",
     "uefiTitle": "Imported disk boots into UEFI shell",
     "uefiBody": "The image was built for legacy (SeaBIOS) but the VM uses OVMF (or vice versa). Either switch the VM's BIOS in Proxmox to match the image, or rebuild the image in the correct mode before importing."
   },
diff --git a/web/messages/en/docs/disk-manager/import-disk-lxc.json b/web/messages/en/docs/disk-manager/import-disk-lxc.json
index 9dd095b7..a9793c01 100644
--- a/web/messages/en/docs/disk-manager/import-disk-lxc.json
+++ b/web/messages/en/docs/disk-manager/import-disk-lxc.json
@@ -27,7 +27,7 @@
       "At least one physical disk not in use by the host or any other guest."
     ],
     "warnTitle": "Privileged container required",
-    "warnBody": "Direct device passthrough to an LXC container only works if the container is <strong>privileged</strong>. If the script detects <code>unprivileged: 1</code> in the config it offers to convert it in place (edits <code>/etc/pve/lxc/&lt;CTID&gt;.conf</code>). Cancel if you cannot accept the security trade-off of a privileged container."
+    "warnBody": "This script requires a <strong>privileged</strong> container for its direct disk attachment. If it detects <code>unprivileged: 1</code>, it offers to edit <code>/etc/pve/lxc/&lt;CTID&gt;.conf</code> in place. This changes the security model and does not remap existing file ownership. Back up the container and verify ownership before accepting, or rebuild it as privileged."
   },
   "steps": {
     "heading": "Step-by-step",
@@ -83,9 +83,9 @@
   "troubleshoot": {
     "heading": "Troubleshooting",
     "unprivTitle": "\"Cannot continue with an unprivileged container\"",
-    "unprivBody": "You declined the conversion offer. Either re-run and accept the conversion, or convert the container manually by editing <code>/etc/pve/lxc/&lt;CTID&gt;.conf</code> and replacing <code>unprivileged: 1</code> with <code>unprivileged: 0</code>. You can also rebuild the container as privileged if you prefer not to convert in place.",
+    "unprivBody": "You declined the conversion, so the script stopped without changing anything. To continue, run it again and accept: the script stops the container, backs up its configuration to <code>/etc/pve/lxc/&lt;CTID&gt;.conf.bak</code> and replaces <code>unprivileged: 1</code> with <code>unprivileged: 0</code>. That flag change alone does not convert the UID/GID ownership of existing files, so back up the container and fix the ownership first; alternatively, restore or rebuild the container as privileged.",
     "permsTitle": "Permissions inside the container are wrong",
-    "permsBody": "Mounts from the host into a privileged container land as <code>root:root</code>. If the service inside the CT runs as a different user (e.g. <code>www-data</code> for Nextcloud), <code>chown</code>/<code>chmod</code> inside the container to match its UID/GID after the first mount."
+    "permsBody": "Existing file ownership is retained when a partition is mounted into a privileged container; a newly formatted filesystem is often owned by <code>root:root</code>. If the service runs as another user (e.g. <code>www-data</code> for Nextcloud), inspect its UID/GID and adjust the required files with <code>chown</code>/<code>chmod</code>. Changes also affect the underlying disk."
   },
   "related": {
     "heading": "Related",
diff --git a/web/messages/en/docs/disk-manager/import-disk-vm.json b/web/messages/en/docs/disk-manager/import-disk-vm.json
index 7d953c4f..1ad8b3b5 100644
--- a/web/messages/en/docs/disk-manager/import-disk-vm.json
+++ b/web/messages/en/docs/disk-manager/import-disk-vm.json
@@ -12,7 +12,7 @@
   },
   "intro": {
     "title": "What this does",
-    "body": "This is a raw-disk passthrough: the guest OS sees the drive as a real block device (with its SMART data and native geometry). The disk is attached via its <code>/dev/disk/by-id/…</code> path — not <code>/dev/sdX</code> — so the assignment does not break if disk controllers enumerate devices in a different order on the next boot."
+    "body": "This attaches a raw physical disk as the backing device for a virtual disk interface. The guest does not automatically receive native SMART data or the physical controller’s features; use controller PCI passthrough when those are required. The disk is attached through its <code>/dev/disk/by-id/…</code> path when one exists, so a changed device enumeration order at boot does not break the assignment; otherwise <code>/dev/sdX</code> is used."
   },
   "howRuns": {
     "heading": "How the script runs",
@@ -49,7 +49,7 @@
         "items": [
           "<strong>SCSI</strong> — modern default for Linux and Windows with VirtIO-SCSI drivers installed.",
           "<strong>SATA</strong> — broad compatibility, works out of the box on virtually every guest.",
-          "<strong>VirtIO</strong> — paravirtualised block device, fastest but requires guest drivers.",
+          "<strong>VirtIO</strong> — efficient paravirtualised block device; requires guest drivers.",
           "<strong>IDE</strong> — for legacy guests that lack any of the above drivers."
         ]
       },
@@ -63,7 +63,7 @@
     "heading": "Manual equivalent",
     "body": "The script is a wrapper around <code>qm set</code>. The exact command for a single disk looks like this:",
     "migrationTitle": "Live migration is not possible",
-    "migrationBody": "A VM with a passthrough disk is <strong>tied to the host that exposes that disk</strong>. Live migration to another Proxmox node will fail because the target node does not see the same <code>/dev/disk/by-id/…</code> path. Use replication or backup/restore instead, or pick virtual disks on shared storage if you need mobility.",
+    "migrationBody": "A VM with a physical passthrough disk is <strong>tied to the host that exposes that disk</strong>. Another node normally lacks the same <code>/dev/disk/by-id/…</code> path and disk data. Back up and transfer that data separately, or use managed virtual disks on shared or supported replicated storage for mobility; do not assume Proxmox storage replication covers this device.",
     "shareTitle": "Do not share a physical disk between VMs",
     "shareBody": "Attaching the same physical disk to two VMs at the same time will corrupt data on next write. ProxMenux detects this situation and blocks it, but if you bypass the script (direct <code>qm set</code>), make sure only one guest ever mounts the disk."
   },
diff --git a/web/messages/en/docs/disk-manager/index.json b/web/messages/en/docs/disk-manager/index.json
index 7ba5f8ae..46a1debd 100644
--- a/web/messages/en/docs/disk-manager/index.json
+++ b/web/messages/en/docs/disk-manager/index.json
@@ -1,7 +1,7 @@
 {
   "meta": {
     "title": "Proxmox Disk Manager — Attach Disks to VMs / LXC, SMART Tests, Wipe | ProxMenux",
-    "description": "Manage physical disks on a Proxmox VE host with ProxMenux: pass disks through to VMs or LXC containers (qm set scsi/sata/virtio, pct mp), import qcow2 / vmdk / vdi disk images, pass through whole HBAs or NVMe controllers, safely wipe disks and run SMART self-tests.",
+    "description": "Manage physical disks on a Proxmox VE host with ProxMenux: attach disks to VMs or LXC containers (qm set scsi/sata/virtio, pct mp), import img / qcow2 / vmdk / raw disk images, pass through whole HBAs or NVMe controllers, wipe disks with safety checks and run SMART self-tests.",
     "ogTitle": "Proxmox Disk Manager — Attach Disks to VMs / LXC, SMART Tests, Wipe",
     "ogDescription": "Attach disks to VMs / LXC, import disk images, PCI passthrough for controllers, safe wipe and SMART tests on Proxmox VE.",
     "twitterTitle": "Proxmox Disk Manager | ProxMenux",
@@ -14,7 +14,7 @@
   },
   "intro": {
     "title": "What this menu is for",
-    "body": "Every option here operates on <strong>physical disks already visible to the Proxmox host</strong>. The menu is split in three groups — <strong>VM</strong> (attach disks or import images into a virtual machine), <strong>LXC</strong> (attach disks to a container), and <strong>Utilities</strong> (safe format, SMART health). Safety checks apply everywhere: system disks and disks already in use are hidden or blocked."
+    "body": "These tools work with <strong>physical disks visible to the Proxmox host and image files stored on it</strong>. The menu has three groups: <strong>VM</strong> (attach disks or import images), <strong>LXC</strong> (attach disks to a container), and <strong>Utilities</strong> (formatting and SMART health). Attachment and wipe operations hide or block system disks and disks already in use; SMART checks can inspect those disks without wiping them."
   },
   "opening": {
     "heading": "Opening the menu",
@@ -32,7 +32,7 @@
       "Add Controller or NVMe to VM"
     ],
     "lxcTitle": "LXC",
-    "lxcBody": "Tools that operate on existing containers. Direct device passthrough needs a privileged container; the script offers to convert it if necessary.",
+    "lxcBody": "Tools for existing LXC containers. This script requires a privileged container and offers to change the flag when needed. Read the conversion and file-ownership cautions on the tool page first.",
     "lxcItems": [
       "Import Disk to LXC"
     ],
@@ -69,7 +69,7 @@
   },
   "lxc": {
     "heading": "LXC",
-    "intro": "Tools that operate on existing LXC containers. Direct device passthrough requires a privileged container; the script offers to convert the container if needed.",
+    "intro": "Tools for existing LXC containers. This script requires a privileged container and offers to change the flag when needed. Read the conversion and file-ownership cautions on the tool page first.",
     "options": [
       {
         "icon": "Boxes",
@@ -98,8 +98,8 @@
     ]
   },
   "safety": {
-    "title": "Safety rules shared by every option",
-    "intro": "ProxMenux filters out anything that could harm the host:",
+    "title": "Safety rules for disk attachment and wiping",
+    "intro": "Attachment and wipe operations filter out devices that could harm the host:",
     "items": [
       "The <strong>system disk</strong> (root pool, swap, active ZFS / LVM / RAID members) is always hidden.",
       "Disks <strong>mounted</strong> anywhere on the host are hidden or blocked at execution.",
diff --git a/web/messages/en/docs/disk-manager/smart-disk-test.json b/web/messages/en/docs/disk-manager/smart-disk-test.json
index 0c97b0fe..4ff76f57 100644
--- a/web/messages/en/docs/disk-manager/smart-disk-test.json
+++ b/web/messages/en/docs/disk-manager/smart-disk-test.json
@@ -55,11 +55,11 @@
       }
     ],
     "tipTitle": "Long tests survive terminal close",
-    "tipBody": "A long test is queued <em>inside the drive</em> — it does not depend on the ProxMenux process staying alive. You can close the terminal, reboot the Proxmox host (the test picks up where it left off on some drives) or just come back later and use <strong>Check test progress</strong> to see the result."
+    "tipBody": "A long test runs <em>inside the drive</em> and does not depend on the ProxMenux process staying alive. You can close the terminal and return later to <strong>Check test progress</strong>. A host reboot, controller reset or power loss may interrupt the test and its result collector; do not assume it will resume automatically."
   },
   "json": {
     "heading": "JSON export for the Monitor",
-    "intro": "Every run writes a timestamped JSON file to <code>/usr/local/share/proxmenux/smart/&lt;disk&gt;/</code>. The structure is:",
+    "intro": "Status, short-test and progress actions write a timestamped JSON file to <code>/usr/local/share/proxmenux/smart/&lt;disk&gt;/</code>; long-test results are collected in the background. The full-report action only displays its report. The structure is:",
     "outro": "The ProxMenux Monitor picks these up to render health trends per disk; old files are rotated out automatically once the retention limit is reached."
   },
   "steps": {
@@ -89,7 +89,7 @@
       },
       {
         "title": "Review results",
-        "bodyRich": "Status and report are printed to the terminal and written to JSON. For long tests, return later and run <strong>Check test progress</strong> on the same disk to see the outcome.",
+        "bodyRich": "Status, test and progress output is shown in the terminal; <strong>Full report</strong> opens in a scrollable dialog. JSON is exported for the actions described above, not for Full report. For long tests, return later and run <strong>Check test progress</strong> on the same disk to see the outcome.",
         "img": "/disk/smart/quick-status.png",
         "alt": "Quick health status output",
         "caption": "Quick health status output (SATA — smartctl -H + -A)"
@@ -106,7 +106,7 @@
     "noSmartTitle": "\"Could not read SMART data from /dev/sdX\"",
     "noSmartBody": "The disk is probably behind a RAID / SAS controller that does not pass SMART through. With megaraid-based cards, try <code>smartctl -d megaraid,N /dev/sdX</code>. For HBAs in IT mode the direct invocation works.",
     "longTitle": "Long test never completes",
-    "longBody": "The test is queued on the drive firmware and pauses if the disk is under heavy load. Running it overnight on an idle system usually works. You can also check <code>smartctl -c</code> to see percentage remaining; if it is stuck at a fixed LBA, the disk is failing at that sector."
+    "longBody": "The drive runs the test in firmware, and heavy I/O can delay completion. Try an idle period such as overnight. For SATA, <code>smartctl -c</code> shows the remaining percentage, and for SAS, <code>smartctl -l selftest</code>; inspect the self-test log for completion status and any failing LBA. A reported read failure needs investigation; slow progress alone does not prove a bad sector."
   },
   "related": {
     "heading": "Related",
@@ -124,7 +124,7 @@
       {
         "href": "/docs/help-info/zfs-commands",
         "label": "ZFS Management commands",
-        "tail": " — zpool scrub for the storage-layer equivalent of SMART tests."
+        "tail": " — zpool scrub verifies ZFS data checksums and complements hardware SMART tests."
       },
       {
         "href": "/docs/monitor/dashboard/storage",
diff --git a/web/messages/en/docs/glossary.json b/web/messages/en/docs/glossary.json
index 032cad32..a42a6ec6 100644
--- a/web/messages/en/docs/glossary.json
+++ b/web/messages/en/docs/glossary.json
@@ -19,7 +19,7 @@
   "aliasesLabel": "also:",
   "missingCallout": {
     "title": "Missing a term?",
-    "leadRich": "If a term in the docs isn't defined here, open an issue or PR on <ext>GitHub</ext> — the glossary lives in <code>web/app/docs/glossary/page.tsx</code> as a simple data array."
+    "leadRich": "If a term in the docs is missing, open an issue or PR on <ext>GitHub</ext>. Glossary content lives in <code>web/messages/en/docs/glossary.json</code>, with matching locale catalogs."
   },
   "entries": [
     {
@@ -29,7 +29,7 @@
         "ACS override"
       ],
       "category": "Virtualization",
-      "definitionRich": "PCIe extension that prevents direct peer-to-peer traffic between devices, ensuring each device sits in its own IOMMU group. The <em>ACS override</em> kernel patch loosens this so devices in the same IOMMU group can be passed to different VMs — useful but a security trade-off.",
+      "definitionRich": "PCIe access-control features that help isolate device traffic. IOMMU grouping depends on hardware and topology. The <em>ACS override</em> kernel patch can split groups reported by Linux, but does not add hardware isolation; assigning those devices to separate VMs carries a security risk.",
       "seeAlso": [
         {
           "label": "Add Controller or NVMe to VM",
@@ -43,7 +43,7 @@
         "Adaptive Replacement Cache"
       ],
       "category": "Storage",
-      "definitionRich": "ZFS's in-memory read cache. Holds recently and frequently used data blocks; size scales with available host RAM. Defaults are aggressive — Proxmox post-install lets you cap it.",
+      "definitionRich": "ZFS read cache in host RAM, holding recently and frequently used data blocks. Its default limit depends on the Proxmox version and installation settings. ProxMenux Post-Install offers an option to cap it.",
       "seeAlso": [
         {
           "label": "Post-Install: Storage",
@@ -83,7 +83,7 @@
         "Linux bridge"
       ],
       "category": "Network",
-      "definitionRich": "A virtual layer-2 switch on the host. <code>vmbr0</code> is the default Proxmox bridge that connects VMs and containers to the physical network. Multiple bridges (<code>vmbr1</code>, <code>vmbr2</code>...) isolate groups of guests.",
+      "definitionRich": "A virtual layer-2 switch on the host. <code>vmbr0</code> commonly connects guests to the physical network. Additional bridges (<code>vmbr1</code>, <code>vmbr2</code>...) can separate guest networks, depending on their physical links and configuration.",
       "seeAlso": [
         {
           "label": "Bridge analysis & guided repair",
@@ -94,7 +94,7 @@
     {
       "term": "Ceph",
       "category": "Storage",
-      "definitionRich": "Distributed storage system tightly integrated with Proxmox for hyper-converged clusters. Provides object, block and file storage backed by OSDs (Object Storage Daemons). PVE 9 requires Ceph 19.x (Squid).",
+      "definitionRich": "Distributed storage integrated with Proxmox for hyper-converged clusters. OSDs (Object Storage Daemons) underpin its object, block and file storage. Required Ceph versions depend on the Proxmox release and upgrade path; consult the corresponding upgrade guide.",
       "seeAlso": [
         {
           "label": "Upgrade PVE 8 to PVE 9",
@@ -134,7 +134,7 @@
         "Discrete GPU"
       ],
       "category": "Virtualization",
-      "definitionRich": "A standalone graphics card on its own PCIe slot (e.g. NVIDIA RTX, AMD Radeon). Contrasts with <strong>iGPU</strong>. Typically used for VFIO passthrough to a single VM, not for sharing across LXCs.",
+      "definitionRich": "A separate graphics card, typically connected over PCIe, unlike an <strong>iGPU</strong>. It can be assigned to a VM with VFIO or accessed by multiple LXC containers through device nodes and the host driver, subject to hardware and application support.",
       "seeAlso": [
         {
           "label": "Add GPU to VM (Passthrough)",
@@ -153,7 +153,7 @@
         "Dynamic Kernel Module Support"
       ],
       "category": "Linux",
-      "definitionRich": "Framework that automatically rebuilds out-of-tree kernel modules (NVIDIA, ZFS, custom drivers) when the kernel is upgraded. Avoids modules being left behind after kernel updates.",
+      "definitionRich": "Framework for rebuilding registered out-of-tree kernel modules, such as NVIDIA or ZFS, when the kernel changes. Successful builds still require compatible module sources and matching kernel headers.",
       "seeAlso": [
         {
           "label": "Install Coral TPU (Host)",
@@ -189,7 +189,7 @@
         "GRand Unified Bootloader"
       ],
       "category": "Linux",
-      "definitionRich": "Boot loader for most Linux distributions. Configuration lives in <code>/etc/default/grub</code> + <code>/boot/grub/</code>. Modified for IOMMU enablement, kernel parameters and EFI boot entries. Run <code>update-grub</code> after edits.",
+      "definitionRich": "Boot loader used on GRUB-based Linux installations. Configuration is in <code>/etc/default/grub</code> and <code>/boot/grub/</code>; run <code>update-grub</code> after edits. Other Proxmox boot setups may use systemd-boot, so check the active boot loader before changing kernel parameters.",
       "seeAlso": [
         {
           "label": "GPU Passthrough commands",
@@ -229,7 +229,7 @@
         "AMD-Vi"
       ],
       "category": "Virtualization",
-      "definitionRich": "Hardware feature (Intel VT-d / AMD-Vi) that lets PCIe devices be safely assigned directly to guest VMs. Required for GPU and disk-controller passthrough. Must be enabled both in BIOS / UEFI and in the kernel command line (<code>intel_iommu=on</code> or <code>amd_iommu=on</code>).",
+      "definitionRich": "Hardware feature (Intel VT-d / AMD-Vi) needed for PCIe passthrough to VMs. Enable it in firmware and ensure kernel support is active. Kernel arguments such as <code>intel_iommu=on</code> or <code>amd_iommu=on</code> may be needed, depending on platform and kernel defaults.",
       "seeAlso": [
         {
           "label": "Post-Install: Virtualization",
@@ -244,7 +244,7 @@
     {
       "term": "IOMMU group",
       "category": "Virtualization",
-      "definitionRich": "The smallest unit of devices that the IOMMU can isolate from each other. All devices in a group must be passed through together — usually one device, but multi-function cards or shared root-port devices land in the same group. Listed via <code>find /sys/kernel/iommu_groups/ -type l | sort -V</code>."
+      "definitionRich": "A set of devices that forms the smallest IOMMU isolation boundary. Devices within a group are not necessarily isolated from one another; review every member before VFIO assignment. Listed via <code>find /sys/kernel/iommu_groups/ -type l | sort -V</code>."
     },
     {
       "term": "iSCSI",
@@ -274,7 +274,7 @@
         "Logical Volume Manager"
       ],
       "category": "Storage",
-      "definitionRich": "Linux storage stack that abstracts physical disks into volume groups (VG) of logical volumes (LV). Proxmox uses LVM-thin pools for VM disks by default. Concise tools: <code>pvs</code>, <code>vgs</code>, <code>lvs</code>.",
+      "definitionRich": "Linux volume-management layer that groups physical storage into volume groups (VG) containing logical volumes (LV). LVM-based Proxmox installations commonly use LVM-thin for guest disks; other backends are available. Tools include <code>pvs</code>, <code>vgs</code> and <code>lvs</code>.",
       "seeAlso": [
         {
           "label": "Storage and Disks commands",
@@ -288,7 +288,7 @@
         "Linux Containers"
       ],
       "category": "Linux",
-      "definitionRich": "OS-level virtualization technology — multiple isolated user-space instances share the host's kernel. Lighter and faster than VMs but less isolated. Proxmox manages LXC containers via the <code>pct</code> CLI.",
+      "definitionRich": "OS-level virtualization in which isolated userspace instances share the host kernel. Usually has less overhead than VMs, with a different isolation boundary. Proxmox manages LXC containers with the <code>pct</code> CLI.",
       "seeAlso": [
         {
           "label": "VM and CT Management",
@@ -313,7 +313,7 @@
         "Hardware address"
       ],
       "category": "Network",
-      "definitionRich": "48-bit identifier burnt into a NIC's firmware. Used by Proxmox <em>Persistent Network Names</em> to pin interface names (<code>eno1</code>, <code>enp3s0</code>) so they survive PCI re-enumeration.",
+      "definitionRich": "Usually a 48-bit Ethernet interface identifier, assigned by hardware or software. ProxMenux <em>Persistent Network Names</em> matches MAC addresses to stable interface names (<code>eno1</code>, <code>enp3s0</code>) to keep names consistent after PCI re-enumeration.",
       "seeAlso": [
         {
           "label": "Persistent interface names",
@@ -327,7 +327,7 @@
         "Message of the Day"
       ],
       "category": "Linux",
-      "definitionRich": "Text shown after SSH login. Stored in <code>/etc/motd</code>. ProxMenux Post-Install can add a banner here; the uninstaller restores the backup if you applied it."
+      "definitionRich": "Text displayed after SSH login, stored in <code>/etc/motd</code>. ProxMenux Post-Install can add a banner; the uninstaller restores the previous file when a backup exists."
     },
     {
       "term": "NFS",
@@ -346,7 +346,7 @@
     {
       "term": "nftables / iptables",
       "category": "Network",
-      "definitionRich": "Linux firewall systems. <code>nftables</code> is the modern engine; <code>iptables</code> is the legacy front-end (still works as a translation layer). Proxmox's <code>pve-firewall</code> emits nftables rules from the cluster firewall config.",
+      "definitionRich": "Linux firewall tooling. <code>nftables</code> is the modern framework; <code>iptables</code> can use legacy or nft-compatible backends. Classic <code>pve-firewall</code> uses iptables, while the alternative proxmox-firewall backend uses nftables.",
       "seeAlso": [
         {
           "label": "Network commands",
@@ -357,7 +357,7 @@
     {
       "term": "nouveau",
       "category": "Linux",
-      "definitionRich": "Open-source NVIDIA driver bundled with the Linux kernel. Must be blacklisted before installing the proprietary NVIDIA driver, otherwise both load and the install fails.",
+      "definitionRich": "Open-source NVIDIA graphics driver included with the Linux kernel. When installing the proprietary NVIDIA driver, prevent nouveau from binding the same GPU, usually by blacklisting it and rebuilding initramfs.",
       "seeAlso": [
         {
           "label": "NVIDIA installation guide",
@@ -368,7 +368,7 @@
     {
       "term": "no-subscription repo",
       "category": "Proxmox",
-      "definitionRich": "Free Proxmox repository for users without an enterprise subscription. Less polished QA than the enterprise repo (slightly riskier for production) but free. Set up automatically by the ProxMenux Post-Install.",
+      "definitionRich": "Proxmox package repository available without an enterprise subscription. Packages receive less validation than in the enterprise repository, which Proxmox recommends for production. ProxMenux Post-Install offers repository configuration.",
       "seeAlso": [
         {
           "label": "Post-Install: Basic Settings",
@@ -382,7 +382,7 @@
         "Open Virtualization Format"
       ],
       "category": "Virtualization",
-      "definitionRich": "DMTF-standard packaging formats for portable VMs. <strong>OVA</strong> is a single TAR archive; <strong>OVF</strong> is a directory with an XML descriptor + external VMDK files. Importable on VMware, VirtualBox and Proxmox.",
+      "definitionRich": "DMTF formats for packaging portable VMs. <strong>OVA</strong> packages the files in a single TAR archive; <strong>OVF</strong> describes the VM in XML with accompanying disk files, commonly VMDK. Import support depends on the target hypervisor and configuration.",
       "seeAlso": [
         {
           "label": "Export VM to OVA / OVF",
@@ -401,7 +401,7 @@
         "Open Virtual Machine Firmware"
       ],
       "category": "Virtualization",
-      "definitionRich": "UEFI firmware implementation for VMs. Set with <code>qm set &lt;vmid&gt; -bios ovmf</code>. Required for Windows 11, Secure Boot, and most modern OS installs. Pair with an <code>efidisk0</code> to persist EFI variables.",
+      "definitionRich": "UEFI firmware for VMs, selected with <code>qm set &lt;vmid&gt; -bios ovmf</code>. Used for UEFI guests, including Windows 11 and Secure Boot configurations. An <code>efidisk0</code> stores persistent EFI variables; many other guests can still use legacy BIOS.",
       "seeAlso": [
         {
           "label": "Add GPU to VM (Passthrough)",
@@ -415,7 +415,7 @@
         "Proxmox Backup Server"
       ],
       "category": "Proxmox",
-      "definitionRich": "Standalone product from Proxmox for incremental, deduplicated, encrypted VM / CT backups. Recommended over plain vzdump when you have a separate machine to host it on."
+      "definitionRich": "Separate Proxmox backup product providing incremental transfers, deduplication and optional client-side encryption for VM and CT backups. It can be used as a vzdump destination; a separate backup server is preferable to keeping backups on the protected host."
     },
     {
       "term": "pct",
@@ -466,7 +466,7 @@
     {
       "term": "Privileged container",
       "category": "Linux",
-      "definitionRich": "LXC container where the root user inside the container <em>is</em> root on the host (UIDs not shifted). Required for hardware passthrough (USB devices, GPU sharing) and Samba / NFS server inside the CT. Less secure than unprivileged — use only when needed."
+      "definitionRich": "LXC container whose root user <em>maps to host UID 0</em>, while namespaces and other restrictions still apply. Less isolated than an unprivileged container. GPU, USB and Samba access do not universally require this mode; permissions and UID mappings matter."
     },
     {
       "term": "ProxMenux Monitor",
@@ -485,7 +485,7 @@
         "QEMU Copy-On-Write v2"
       ],
       "category": "Storage",
-      "definitionRich": "Default VM disk image format on Proxmox directory storage. Supports thin provisioning, snapshots, and copy-on-write. Convert with <code>qemu-img convert -O qcow2 ...</code>."
+      "definitionRich": "VM disk image format commonly used on directory storage. Supports allocation on demand, snapshots and copy-on-write. Convert an image with <code>qemu-img convert -O qcow2 ...</code>."
     },
     {
       "term": "qm",
@@ -514,7 +514,7 @@
     {
       "term": "rclone",
       "category": "Linux",
-      "definitionRich": "Command-line tool that talks to ~50 cloud storage providers (Google Drive, Dropbox, OneDrive, Mega, S3, …). Used in the Proxmox cloud-backup guide to mount a personal cloud as a directory the host can write vzdump archives to.",
+      "definitionRich": "Command-line tool supporting many cloud storage providers, including Google Drive, Dropbox, OneDrive, Mega and S3. The cloud-backup guide uses it to mount remote storage as a directory for vzdump archives.",
       "seeAlso": [
         {
           "label": "Backup to Personal Cloud",
@@ -564,7 +564,7 @@
     {
       "term": "sysctl",
       "category": "Linux",
-      "definitionRich": "Kernel parameter management. Reads <code>/etc/sysctl.conf</code> + <code>/etc/sysctl.d/*.conf</code> at boot. ProxMenux Post-Install ships a curated sysctl tuning profile.",
+      "definitionRich": "Tool for reading and changing kernel parameters. Persistent settings are commonly placed in <code>/etc/sysctl.d/*.conf</code>; support for <code>/etc/sysctl.conf</code> depends on the loader. ProxMenux Post-Install offers a sysctl tuning profile.",
       "seeAlso": [
         {
           "label": "Post-Install: Network",
@@ -594,7 +594,7 @@
         "UID shift"
       ],
       "category": "Linux",
-      "definitionRich": "In <strong>unprivileged</strong> LXC containers, UIDs and GIDs are shifted by <code>+100000</code> on the host. Container UID 0 = host UID 100000, container UID 1000 = host UID 101000, etc. Affects file ownership on bind mounts.",
+      "definitionRich": "With the default mapping in <strong>unprivileged</strong> LXC containers, host UIDs and GIDs are shifted by <code>+100000</code>: container UID 0 maps to host UID 100000, and 1000 to 101000. Custom mappings can differ; file ownership on bind mounts must match the chosen mapping.",
       "seeAlso": [
         {
           "label": "LXC Mount Points",
@@ -605,7 +605,7 @@
     {
       "term": "Unprivileged container",
       "category": "Linux",
-      "definitionRich": "LXC container where root inside is mapped to an unprivileged UID on the host (UID shift +100000). Safer than privileged but can't do hardware passthrough or run kernel-level services. Default for most use cases."
+      "definitionRich": "LXC container whose root maps to an unprivileged host UID, normally 100000. This reduces host privileges while sharing its kernel. Hardware access can still be configured with suitable device permissions and mappings; privileged mode is not universally required."
     },
     {
       "term": "VFIO",
@@ -640,7 +640,7 @@
         "Virtual Machine"
       ],
       "category": "Proxmox",
-      "definitionRich": "A full machine emulation managed by Proxmox via QEMU/KVM. Has a numeric VMID that maps to <code>/etc/pve/qemu-server/&lt;VMID&gt;.conf</code>. Heavier than LXC containers but fully isolated.",
+      "definitionRich": "Virtual machine managed by Proxmox with QEMU/KVM, running its own guest kernel. Its numeric VMID maps to <code>/etc/pve/qemu-server/&lt;VMID&gt;.conf</code>. Usually has more overhead than LXC, with a separate kernel isolation boundary.",
       "seeAlso": [
         {
           "label": "VM and CT Management",
@@ -651,7 +651,7 @@
     {
       "term": "vzdump",
       "category": "Proxmox",
-      "definitionRich": "Proxmox's built-in backup tool for VMs and CTs. <strong>Not incremental</strong> — every backup is a full snapshot. Configure modes (snapshot / suspend / stop), compression (zstd / pigz / lzo), retention and notification per job.",
+      "definitionRich": "Proxmox backup tool for VMs and CTs. File archives are <strong>not incremental</strong>; PBS targets support incremental transfers. Jobs can configure backup mode (snapshot / suspend / stop), compression (such as zstd, gzip or lzo), retention and notifications.",
       "seeAlso": [
         {
           "label": "Backup and Restore commands",
@@ -665,7 +665,7 @@
         "Zettabyte File System"
       ],
       "category": "Storage",
-      "definitionRich": "Combined filesystem and volume manager known for snapshots, send/receive replication, end-to-end checksums, compression and self-healing. Memory-hungry (see <strong>ARC</strong>) but extremely robust.",
+      "definitionRich": "Combined filesystem and volume manager with snapshots, send/receive replication, checksums and compression. It can repair corrupted data when a valid redundant copy is available. Read caching uses RAM through <strong>ARC</strong>, whose size can be limited.",
       "seeAlso": [
         {
           "label": "ZFS Management commands",
diff --git a/web/messages/en/docs/hardware/coral-tpu-lxc.json b/web/messages/en/docs/hardware/coral-tpu-lxc.json
index cb97aeb7..1440c05f 100644
--- a/web/messages/en/docs/hardware/coral-tpu-lxc.json
+++ b/web/messages/en/docs/hardware/coral-tpu-lxc.json
@@ -14,18 +14,18 @@
   },
   "whenUse": {
     "heading": "When to use this",
-    "body": "Typical use case: running <frigateLink>Frigate</frigateLink>, Agent DVR, Blue Iris + CodeProject.AI, or any other object-detection app inside an LXC and wanting the Coral TPU to do the ML inference instead of the CPU. With Coral, inference latency drops from ~100 ms to ~5 ms per frame and CPU load stays near zero."
+    "body": "Use this for <frigateLink>Frigate</frigateLink> or another compatible Linux detection app in LXC. Coral runs supported ML inference instead of the CPU. Performance depends on the model and hardware; video decoding and other application work still consume resources."
   },
   "prereqs": {
     "title": "Before you start",
-    "drivers": "<strong>Coral drivers already installed on the host</strong>. This script does not install them; it only configures passthrough to the container. Run <hostLink>Install Coral TPU on the Host</hostLink> first if you haven't.",
+    "drivers": "<strong>Prepare the Coral device on the host</strong>. M.2 / PCIe needs the host driver loaded; USB needs device access and suitable permissions. See <hostLink>Install Coral TPU on the Host</hostLink>. The script installs the app runtime in Debian/Ubuntu containers; other distributions must provide it separately.",
     "driversCheck": "ls /dev/apex_* 2>/dev/null ; lsusb | grep -E '1a6e:089a|18d1:9302'",
     "container": "<strong>An existing LXC container</strong>, ideally running a <strong>Debian / Ubuntu</strong>-based distro — the in-container runtime install uses <code>apt-get</code>. <strong>Non-Debian containers</strong> (Alpine, Arch, RHEL, SUSE…) are still supported in <strong>passthrough-only mode</strong>: the script detects the distro and offers a prompt to skip the <code>libedgetpu</code> APT install while still writing the device passthrough config — useful for app containers that bundle the runtime themselves (e.g. the Frigate Docker image).",
     "downtime": "<strong>Be OK with a brief downtime</strong> of the container. The script stops it to apply config changes, then starts it back up to install drivers inside. No host reboot needed."
   },
   "hostPrep": {
     "title": "Host must be prepared first",
-    "body": "If you run this script before installing Coral drivers on the host (the <code>gasket</code>/<code>apex</code> kernel module for M.2, the <code>libedgetpu</code> runtime for USB), the LXC config is still written but the container won't find the device at runtime. Order matters: <strong>host install → LXC passthrough → in-container app</strong>."
+    "body": "M.2 / PCIe needs the host <code>gasket</code>/<code>apex</code> driver and a working device node. USB needs the connected device and permissions; it does not require the host to run the app. The <code>libedgetpu</code> runtime must be available where the app runs. Follow <strong>host preparation → LXC device access → app setup</strong>."
   },
   "running": {
     "heading": "Running the script",
@@ -34,39 +34,39 @@
   },
   "howRuns": {
     "heading": "How the script runs",
-    "body": "One decision upfront (which container?), then the script handles USB and PCIe paths independently based on what it finds on the host. If both are present, both get passed."
+    "body": "Choose the target container. The script configures USB access even if no USB Coral is currently connected, then adds M.2 / PCIe access when the corresponding hardware is detected."
   },
   "walkthrough": {
     "heading": "Walking through the flow",
     "pick": {
       "title": "Pick the LXC container",
-      "body": "A dialog shows every LXC on the host (from <code>pct list</code>). Pick the one that should get the Coral. Running or stopped, it doesn't matter — the script handles both (stops it briefly to write config, then starts it back up to install drivers)."
+      "body": "The picker lists eligible containers from <code>pct list</code>; OCI-image containers are hidden and managed through OCI manager Apps. Choose the target, running or stopped. The script stops it if needed, writes configuration and starts it for runtime installation."
     },
     "gpuHint": {
       "title": "GPU passthrough suggestion (optional)",
-      "body": "If the host has a GPU (Intel iGPU, AMD, NVIDIA) and the chosen container does NOT have GPU passthrough configured, the script shows a one-time dialog suggesting you run <lxcGpuLink>Add GPU to LXC</lxcGpuLink> first. Coral is most often paired with hardware video decode (Quick Sync, VA-API, NVENC) for apps like Frigate. You can say yes (exits, run the GPU script, then come back) or no (continues with TPU-only setup)."
+      "body": "If a GPU is detected but not configured for this container, a dialog recommends <lxcGpuLink>Add GPU to LXC</lxcGpuLink> for hardware video decoding, such as Quick Sync, VA-API or NVENC. It asks whether to continue with Coral only: Yes continues TPU setup; No exits so you can configure the GPU first."
     },
     "usb": {
       "title": "Write LXC config — USB path",
-      "body": "If a USB Accelerator is present, the script does two things: (1) writes a udev rule on the host so the device gets a stable name <code>/dev/coral</code> whatever USB port it's in, and (2) bind-mounts the <strong>whole</strong> <code>/dev/bus/usb</code> tree into the container.",
+      "body": "The script creates a host udev rule for the <code>/dev/coral</code> symlink and bind-mounts the <strong>whole</strong> <code>/dev/bus/usb</code> tree into the container. This USB configuration is written even when no Coral USB is currently connected; it exposes more than just that one device.",
       "whyTitle": "Why mount /dev/bus/usb instead of /dev/coral?",
-      "whyBody": "The USB device node path (e.g. <code>/dev/bus/usb/001/005</code>) changes when you replug the accelerator into a different port. Earlier versions of the script bind-mounted the <code>/dev/coral</code> symlink, which pointed at an old path and broke. Mounting the whole USB tree means the container sees whatever the current path is, so a replug just works."
+      "whyBody": "USB node paths such as <code>/dev/bus/usb/001/005</code> change on reconnect. Older versions bind-mounted the <code>/dev/coral</code> symlink and could retain a stale path. Mounting the whole USB tree makes the current device node visible; the app may still need to reopen it."
     },
     "pcie": {
       "title": "Write LXC config — M.2 / PCIe path",
       "body1": "If a M.2 / PCIe Coral is present on the host and <code>/dev/apex_0</code> exists (the apex kernel module is loaded), the script uses the modern Proxmox <code>dev</code> API which handles cgroup2 permissions automatically for both privileged and unprivileged containers:",
-      "body2": "If the host hasn't booted yet with the apex module loaded (you just ran <hostLink>Install Coral on Host</hostLink> and haven't rebooted), <code>/dev/apex_0</code> doesn't exist yet. The script falls back to classic cgroup2 + bind mount with <code>create=file</code> so the entries are valid even when the device hasn't materialised:",
+      "body2": "If <code>/dev/apex_0</code> is absent after <hostLink>Install Coral on Host</hostLink>, the script writes a bind mount with <code>create=file</code> and, only when the apex major number is listed in <code>/proc/devices</code>, a classic cgroup2 rule. Neither creates a working device:",
       "rebootTitle": "Reboot the host first if you just installed Coral drivers",
-      "rebootBody": "The fallback cgroup2 + mount will be written, but the device only actually exists after a host reboot loads the <code>apex</code> module. If you haven't rebooted, reboot now before starting the container."
+      "rebootBody": "The fallback mount does not load the host <code>apex</code> driver. Load the driver, or reboot after installation, and verify the host device exists. Re-run the script once the device is ready to apply the modern device entry, then restart the container."
     },
     "drivers": {
       "title": "Start the container + install Coral runtime inside",
-      "body": "Config changes in Proxmox LXC take effect on the next start — so the script starts the container, waits up to 15 seconds for <code>pct exec</code> to respond, then drops a bash script inside that:",
+      "body": "The script starts the container and waits up to 15 seconds for its running status, then uses <code>pct exec</code> to run the runtime installer inside. The installer:",
       "items": [
         "Runs <code>apt-get update</code>.",
         "Installs the Coral repository prerequisites: <code>gnupg</code>, <code>curl</code>, <code>ca-certificates</code>.",
         "Imports Google's Coral GPG key to <code>/etc/apt/keyrings/coral-edgetpu.gpg</code> (modern path, same as the host installer uses) and adds the <code>coral-edgetpu-stable</code> APT repository with <code>signed-by=</code>.",
-        "Installs the latest <code>libedgetpu1-std</code> (default). If you have a M.2 Coral, you'll be prompted to pick between <code>libedgetpu1-std</code> (standard) and <code>libedgetpu1-max</code> (max performance, runs hotter)."
+        "Installs <code>libedgetpu1-std</code> by default. When an M.2 Coral is detected, the script offers a choice of <code>libedgetpu1-std</code> or <code>libedgetpu1-max</code>. The choice of runtime package does not itself configure application detection settings."
       ],
       "noIgpuTitle": "Why no iGPU drivers here?",
       "noIgpuBody": "Earlier versions of this script also installed Intel <code>va-driver-all</code>, <code>intel-opencl-icd</code> and friends so the same container could do Quick Sync video decode alongside Coral inference. That doubled-up responsibility caused confusing failures when the user only wanted Coral. The iGPU side is now the exclusive job of <lxcGpuLink>Add GPU to LXC</lxcGpuLink> — run it first if you also want hardware video decode in the container.",
@@ -92,15 +92,15 @@
   "troubleshoot": {
     "heading": "Troubleshooting",
     "apexTitle": "Container started but /dev/apex_0 missing inside",
-    "apexBody": "Host apex module isn't loaded. On the host: <code>lsmod | grep apex</code> — if empty, run <code>modprobe apex</code>, or reboot if you just installed Coral drivers. Once the host has <code>/dev/apex_0</code>, restart the container: <code>pct stop &lt;ctid&gt; &amp;&amp; pct start &lt;ctid&gt;</code>.",
+    "apexBody": "Check the host driver first: <code>lsmod | grep apex</code>. If missing, try <code>modprobe apex</code> or reboot after driver installation. Once <code>/dev/apex_0</code> exists on the host, verify the LXC device entry (re-run the script if only the fallback entries were written) and restart the container with <code>pct stop &lt;ctid&gt; &amp;&amp; pct start &lt;ctid&gt;</code>.",
     "replugTitle": "USB Coral disappears after replug in a different port",
     "replugBody": "This is exactly why the script mounts <code>/dev/bus/usb</code> instead of the <code>/dev/coral</code> symlink. If you're hitting this, check your LXC config has <code>lxc.mount.entry: /dev/bus/usb dev/bus/usb ...</code> and not a reference to <code>/dev/coral</code> directly. Old configs from earlier script versions may need updating — re-run the script on the same container and the config gets refreshed.",
     "alpineTitle": "Alpine / Arch / RHEL / SUSE container — runtime not installed",
-    "alpineBody": "If you chose <em>passthrough-only mode</em> when the script prompted, the LXC config is written and the Coral device is visible inside the container, but the <code>libedgetpu</code> runtime is not installed. That's by design: Google's APT repo only ships for Debian/Ubuntu. Install the runtime manually with your distro's package manager (Alpine: <code>apk add</code>; Arch: AUR; RHEL/SUSE: build from source) following Google's official guide, or run an app container that bundles the runtime — the Frigate Docker image is the canonical example: just expose the device with <code>--device /dev/apex_0:/dev/apex_0</code> (M.2) or the USB bind mount the script already wrote (USB).",
+    "alpineBody": "In <em>passthrough-only mode</em>, device configuration is written but <code>libedgetpu</code> is not installed. Use a compatible community package or build from source; check availability before using a package command such as Alpine <code>apk add</code>. An app image such as Frigate can bundle the runtime. With nested Docker, also forward the M.2 device using <code>--device /dev/apex_0:/dev/apex_0</code>, or mount the USB tree into that Docker container; the LXC mount alone does not forward it into Docker.",
     "frigateTitle": "Frigate says 'Coral EdgeTPU detected but not available'",
-    "frigateBody": "Almost always a permissions issue inside the container. Frigate runs as root by default; check the root user is in the <code>plugdev</code> group inside the container (for USB), and that the process can read <code>/dev/apex_0</code> (for M.2). <code>ls -l /dev/apex_0</code> from inside the container should show group <code>apex</code> — if not, add the GID alignment to <code>/etc/group</code> or switch the container to privileged mode.",
+    "frigateBody": "Check runtime availability, device visibility and read/write access for the actual app process. For USB, inspect permissions and any <code>plugdev</code> membership. For M.2, inspect <code>/dev/apex_0</code> with <code>ls -l /dev/apex_0</code>. A group name such as <code>apex</code> in <code>/etc/group</code> is not enough: numeric GIDs and LXC mappings must match. Also check whether another process already claims the TPU; do not switch to privileged mode as the first fix.",
     "logsTitle": "Check both host and container logs",
-    "logsBody": "On the host: <code>journalctl -u pvedaemon | grep -i coral</code>. Inside the container: check the app logs (Frigate: <code>/config/logs/</code>, CodeProject.AI: its own log directory). The classic error pattern is \"Coral detected, runtime loaded, but inference engine can't claim it\" — that's permissions 9 out of 10 times."
+    "logsBody": "On the host, inspect kernel device messages with <code>journalctl -k | grep -i -e apex -e gasket -e usb</code>. Inside the container, inspect the app logs; for nested Docker use <code>docker logs &lt;container&gt;</code>. Permissions, missing runtime, USB connectivity or another process claiming the TPU can all cause failures."
   },
   "related": {
     "heading": "Related",
diff --git a/web/messages/en/docs/hardware/gpu-vm-passthrough.json b/web/messages/en/docs/hardware/gpu-vm-passthrough.json
index e772d0ac..9cc33400 100644
--- a/web/messages/en/docs/hardware/gpu-vm-passthrough.json
+++ b/web/messages/en/docs/hardware/gpu-vm-passthrough.json
@@ -10,7 +10,7 @@
   },
   "intro": {
     "title": "What this does",
-    "body": "Everything the <pveLink>official Proxmox PCI passthrough wiki</pveLink> walks you through manually — IOMMU enablement, VFIO modules, driver blacklisting, vendor ID discovery, <code>hostpci</code> setup, ROM dumps on AMD, KVM hiding on NVIDIA — done in one run with sanity checks at every step. The script is also aware of the <em>other</em> things on your host: if the same GPU is already assigned to an LXC or another VM, it offers to migrate cleanly instead of silently breaking the existing setup."
+    "body": "Automates the relevant host and <code>hostpci</code> configuration steps described in the <pveLink>Proxmox PCI passthrough documentation</pveLink>. It checks assignments in <em>other</em> guests and offers conflict-handling choices. These checks do not guarantee support for every GPU, reset method or guest driver."
   },
   "who": {
     "heading": "Who is this for?",
@@ -20,11 +20,11 @@
     "title": "Before you start",
     "gpu": "<strong>A supported GPU</strong> physically installed. The script detects Intel, AMD and NVIDIA via <code>lspci</code>.",
     "gpuCheck": "lspci | grep -iE 'VGA|3D|Display'",
-    "iommu": "<strong>IOMMU virtualization</strong> available in BIOS/UEFI (Intel VT-d or AMD-Vi). If it's off at the firmware level, no amount of Linux config fixes it — you have to enable it in the BIOS first. The script detects this and offers to enable it on the OS side.",
-    "q35": "The target VM uses <strong>q35</strong> machine type. Older <code>i440fx</code> does not reliably support PCIe passthrough and the script will refuse to proceed.",
-    "q35Check": "qm config '<'vmid'>' | grep machine",
+    "iommu": "<strong>IOMMU support</strong> must be available in hardware and enabled in firmware where required (Intel VT-d or AMD-Vi). The script checks the running system and can configure Linux boot parameters; it cannot change BIOS/UEFI settings or prove that every inactive IOMMU is disabled in firmware.",
+    "q35": "This assistant requires the <strong>q35</strong> machine type and refuses <code>i440fx</code>. Machine type is separate from BIOS/UEFI firmware; changing an existing VM chipset requires planning and is not performed automatically.",
+    "q35Check": "qm config VMID | grep machine",
     "moreGpus": "Preferably <strong>more than one GPU</strong> in the host, or console access on another output (IPMI, KVM-over-IP, serial). Once you pass the only GPU to a VM, the host console goes dark. With two NVIDIA GPUs you can pass one to a VM and keep the other on the host — the script handles this per-BDF (see <em>NVIDIA</em> in the vendor notes below).",
-    "nvidiaInstalled": "If you're on a Proxmox that already installed the NVIDIA driver via <nvidiaLink>NVIDIA Drivers on the Host</nvidiaLink>: the GPU you pass to the VM gets unbound from the host <code>nvidia</code> driver and rebound to <code>vfio-pci</code>. The <code>nvidia</code> module stays loaded so any <strong>other</strong> NVIDIA GPU you have on the host keeps working with <code>nvidia-smi</code>."
+    "nvidiaInstalled": "If you installed <nvidiaLink>NVIDIA Drivers on the Host</nvidiaLink>, selected functions are reserved for <code>vfio-pci</code> rather than <code>nvidia</code>. The <code>nvidia</code> module can remain available for <strong>other</strong> cards outside the affected IOMMU group; verify them with <code>nvidia-smi</code>."
   },
   "pickOne": {
     "title": "VM passthrough vs LXC sharing — pick one per GPU",
@@ -39,34 +39,34 @@
   },
   "howRuns": {
     "heading": "How the script runs",
-    "body": "The flow has three phases with clear separation between \"collecting information and decisions\" and \"actually applying changes\". Until the final confirmation, nothing on your host or VM has been touched."
+    "body": "Detection and selection precede the main host/VM changes and a final summary confirms that plan. Enabling IOMMU has its own earlier confirmation and can already edit the boot configuration. Later associated-audio cleanup may also ask for a choice."
   },
   "walkthrough": {
     "heading": "Walking through the flow",
     "detect": {
       "title": "Detect GPUs and check IOMMU",
-      "body": "The script lists every GPU it finds. If IOMMU isn't already enabled in the running kernel cmdline, you'll get a yes/no prompt to append <code>intel_iommu=on</code> (or <code>amd_iommu=on</code>) + <code>iommu=pt</code> to the right boot file. Selection is based on the bootloader: <code>/etc/kernel/cmdline</code> when the host boots via systemd-boot (detected by the presence of <code>root=ZFS=</code> in that file, the default on ProxmoxVE-installed ZFS-on-root systems), otherwise <code>/etc/default/grub</code>. If you accept and the kernel cmdline changes, the script flags that a reboot will be needed at the end.",
+      "body": "Treats IOMMU as active only when the running kernel has <code>intel_iommu=on</code> or <code>amd_iommu=on</code> and IOMMU groups exist. If the parameter is already saved for the next boot, it continues in pending-reboot mode; otherwise a separately confirmed step can add it with <code>iommu=pt</code>. Its boot-file heuristic uses <code>/etc/kernel/cmdline</code> when a ZFS-root marker such as <code>root=ZFS=</code> exists there; otherwise it uses <code>/etc/default/grub</code>. That heuristic is not proof of the actual bootloader. Newly configured IOMMU takes effect after reboot; inspect the real groups afterwards.",
       "tipTitle": "Already ran post-install?",
-      "tipBody": "If you previously enabled <postLink>VFIO IOMMU support</postLink> from the post-install scripts, IOMMU is already on and this step silently passes. Good.",
+      "tipBody": "If <postLink>VFIO IOMMU support</postLink> was previously configured and is active in the running kernel, this check passes. A saved next-boot setting alone does not prove it is active.",
       "imageAlt": "List of detected GPUs with vendor and PCI address"
     },
     "preflight": {
       "title": "Pick a GPU and run pre-flight checks",
       "intro": "Once you pick the GPU, the script runs a series of checks that can each block further progress:",
       "items": [
-        "<strong>Not in SR-IOV.</strong> If the device is a Virtual Function or a Physical Function with active VFs, passthrough would clash with SR-IOV usage. Blocked.",
+        "<strong>SR-IOV guard.</strong> This assistant refuses VFs and PFs with active VFs because its full-device workflow is not an SR-IOV configuration flow. SR-IOV passthrough must be configured separately on supported hardware.",
         "<strong>Single-GPU warning.</strong> If this is the only GPU in the host, you get a scary dialog reminding you that after reboot the console goes dark — make sure you have SSH or web-UI access from another machine.",
-        "<strong>AMD reset method.</strong> AMD GPUs have a long history of not resetting cleanly between VM stops and starts. The script checks <code>/sys/bus/pci/devices/&lt;pci&gt;/reset_method</code>: if the card is an APU without FLR it <em>blocks</em> (practically unusable); a dedicated AMD card without FLR is also blocked; anything with an unknown reset mode warns but lets you continue with explicit override.",
+        "<strong>AMD reset policy.</strong> Reads <code>/sys/bus/pci/devices/&lt;pci&gt;/reset_method</code>. An APU or dedicated card without FLR is <em>blocked by this assistant’s policy</em>; an unknown subtype without FLR requires an explicit override. This does not establish universal hardware impossibility.",
         "<strong>Not in D3cold.</strong> Some AMD cards report <code>D3cold</code> power state while idle, which makes them invisible during VM startup. Blocked until you wake the GPU.",
-        "<strong>IOMMU group analysis.</strong> Reads <code>/sys/kernel/iommu_groups/</code> to find every non-bridge device in the GPU's group. <em>All of them</em> will be passed to the VM together — if your motherboard groups the GPU with a network card, the network card goes too."
+        "<strong>IOMMU group analysis.</strong> Reads <code>/sys/kernel/iommu_groups/</code> and includes <em>all non-bridge members</em> in the VM plan, possibly network or storage controllers. When the group contains devices from another slot, the script lists them before the summary; check that the host does not need any of them. If IOMMU is pending reboot, real groups are unavailable and the plan initially contains only the selected GPU function; verify isolation after reboot."
       ],
       "audioIntro": "<strong>Audio companion.</strong> Two paths, depending on where the audio lives:",
-      "audioDgpu": "<strong>Discrete GPU (NVIDIA / AMD):</strong> HDMI audio sits on the same card as function <code>.1</code> of the GPU's PCI slot. Auto-included. This audio device was never used by the host, so no one loses anything.",
+      "audioDgpu": "<strong>Discrete GPU:</strong> HDMI audio often occupies function <code>.1</code> of the same PCI slot and is automatically included when detected. If the host was using that audio device, it loses access when the device is reserved for the VM.",
       "audioIgpu": "<strong>Intel iGPU (or any GPU without a <code>.1</code> sibling):</strong> the HDMI / analog audio lives on the chipset at a different slot (<code>00:1f.3</code> typically). The script scans the host, lists every PCI audio controller with its current driver (<code>snd_hda_intel</code>, etc.), and asks you which one(s) to pass through. Default is <strong>none</strong> — you explicitly opt in."
     },
     "pickVm": {
       "title": "Pick the target VM",
-      "body": "You're shown the list of VMs on the host and pick one. The script checks the VM is q35 — BIOS/i440fx machine types are refused because PCIe passthrough on them is unreliable. If you have a q35 VM with the GPU already assigned (partially or fully), the existing entry is reused instead of being duplicated.",
+      "body": "Choose a VM from the list. The assistant requires q35 and reuses existing GPU entries where possible. BIOS/UEFI firmware is a separate setting, not a machine type; this check does not automatically change the installed guest’s chipset or boot mode.",
       "imageAlt": "VM list with name, ID and status shown as a picker"
     },
     "switchMode": {
@@ -75,34 +75,34 @@
       "items": [
         "<strong>GPU is free.</strong> Nothing to do, continue.",
         "<strong>GPU is in a different VM.</strong> If the source VM is currently running, the script aborts — two VMs can't share an exclusive VFIO assignment, and the source VM has to be stopped first. If the source VM is stopped, you get two options: <em>Keep GPU in the source VM's config but disable Start on boot</em>, or <em>Remove the GPU lines from the source VM's config and keep Start on boot</em>. A fast-path also exists: if the GPU is already bound to <code>vfio-pci</code> and the source VM is a plain VM→VM swap, no host reconfiguration is done and no reboot is needed.",
-        "<strong>GPU is in an LXC (shared mode).</strong> You get two options on a menu: <em>Keep GPU in the LXC config but disable Start on boot</em>, or <em>Remove the GPU lines from the LXC config (<code>lxc.cgroup2.devices.allow</code> / <code>lxc.mount.entry</code>) and keep Start on boot</em>. Either way the LXC won't see the GPU after the switch, and the VM will — this is the \"switch mode\" mechanic that gives this menu entry its secondary label."
+        "<strong>GPU used by LXC.</strong> For ordinary containers, choose <em>keep the GPU configuration and disable Start on boot</em> or <em>remove GPU device configuration and keep Start on boot</em>. Removal deletes the <code>devN</code> entries and, for AMD/Intel, also legacy <code>/dev/dri</code> <code>lxc.mount.entry</code> and <code>lxc.cgroup2.devices.allow</code> rules. OCI containers retain their configuration and are stopped with Start on boot disabled; remove their GPU through OCI manager Apps. Conflict detection is by GPU device family and may include other cards of that family."
       ],
       "imageAlt": "Dialog offering to remove the GPU from an LXC before assigning it to the VM",
       "smartTitle": "Audio siblings are cleaned up smartly too",
-      "smartBody": "If the source VM had extra audio devices attached alongside the GPU, the script removes <strong>only the ones that are now orphan</strong> — i.e. audio entries whose display sibling is also being removed. Audio tied to a different GPU that stays in the VM is kept untouched. This matters when you detach an Intel iGPU (which shares chipset audio) from a VM that also has a discrete NVIDIA / AMD card still passed through: the dGPU's HDMI audio (<code>02:00.1</code>) stays, the chipset audio (<code>00:1f.3</code>) leaves."
+      "smartBody": "After removing GPU assignments from the source VM, the script can offer a checklist of <strong>potentially orphaned audio devices</strong>. Review it and uncheck anything the source still needs. For example, dedicated-card audio at <code>02:00.1</code> may remain while chipset audio at <code>00:1f.3</code> is offered for removal. The checklist, not a universal display/audio pairing guarantee, determines the extra removals."
     },
     "audioPick": {
       "title": "(If no .1 sibling) Pick which audio controllers to include",
       "body": "Only happens for Intel iGPU and similar split-audio setups. A checklist shows every PCI audio controller on the host (excluding any already in the GPU's IOMMU group), labelled with its current driver. Select the ones you want — or none, if the VM doesn't need audio from the host hardware.",
       "imageAlt": "Checklist dialog with every host PCI audio controller (BDF + driver) when the GPU has no .1 sibling audio",
       "warnTitle": "Don't tick audio the host relies on",
-      "warnBody": "If the host currently uses an audio controller for anything — for example, the Proxmox shell beeping, or a VM you've already passed it to — ticking it here means the host (and any other VM sharing it) loses access after reboot. When in doubt, leave this empty and you can always re-run the script later to add audio if needed."
+      "warnBody": "Assigning an audio controller to the VM can remove host access; it cannot simultaneously belong to another running VM. Leave optional audio unselected when unnecessary, and verify ownership before moving it. PCI audio is not necessarily the source of the host console beep."
     },
     "summary": {
       "title": "Review the confirmation summary",
-      "body": "A final dialog shows exactly what's about to change on the host and in the VM. This is the last off ramp — if anything looks wrong (an extra device in the IOMMU group you didn't expect, the wrong GPU, the wrong VM), cancel here and nothing has been touched yet.",
+      "body": "Review the final host and VM plan and cancel if it is wrong. It shows the IOMMU group and its device count; members from another slot are listed in the previous step. Cancelling stops the main changes; it does not undo an earlier separately confirmed IOMMU boot-configuration change.",
       "imageAlt": "Summary dialog listing host changes (VFIO/blacklist files) and VM config changes (hostpci lines) before applying"
     },
     "hostApply": {
       "title": "Host changes are applied",
-      "intro": "Phase 2 runs non-interactively. Host-side the script can touch:",
+      "intro": "The apply phase performs the host and VM changes. Associated-audio cleanup may still prompt for a selection. Host changes can include:",
       "items": [
         "<code>/etc/modules</code> — adds <code>vfio</code>, <code>vfio_iommu_type1</code>, <code>vfio_pci</code> (plus <code>vfio_virqfd</code> on kernels &lt; 6.2).",
         "<code>/etc/modprobe.d/vfio.conf</code> — for AMD / Intel, sets <code>options vfio-pci ids=&lt;vendor:device,...&gt; disable_vga=1</code> so VFIO claims the GPU early at boot. For NVIDIA the file only adds <code>softdep nvidia pre: vfio-pci</code> (plus <code>_drm</code>/<code>_modeset</code>/<code>_uvm</code>) — actual binding is per-BDF via the udev rule below. On AMD, also adds <code>softdep</code> lines forcing <code>vfio-pci</code> to load before <code>radeon</code> / <code>amdgpu</code>.",
-        "<code>/etc/modprobe.d/iommu_unsafe_interrupts.conf</code> and <code>kvm.conf</code> — sensible workarounds that most Windows / macOS VMs need (<code>allow_unsafe_interrupts=1</code>, <code>ignore_msrs=1</code>).",
-        "<code>/etc/modprobe.d/blacklist.conf</code> — blacklists only the open-source drivers for the selected vendor (<code>nouveau</code>/<code>lbm-nouveau</code> for NVIDIA; <code>radeon</code>+<code>amdgpu</code> for AMD; <code>i915</code> for Intel), so drivers for other vendors on the same host stay loaded. The proprietary <code>nvidia</code> module is <strong>only</strong> blacklisted (via a separate <code>/etc/modprobe.d/proxmenux-nvidia-vfio-blacklist.conf</code>) once <em>every</em> NVIDIA GPU on the host has been switched to VFIO — until that point it stays loaded so any NVIDIA card you keep on the host keeps working.",
-        "<code>/etc/udev/rules.d/10-proxmenux-vfio-bind.rules</code> + <code>/etc/proxmenux/vfio-bind.bdfs</code> — <strong>NVIDIA only</strong>. Per-BDF binding state. The udev rule applies <code>ATTR'{'driver_override'}'=\"vfio-pci\"</code> at the PCI ADD event for each tracked Bus:Device.Function, so only the GPU(s) you've explicitly passed go to VFIO. This is what makes multi-GPU NVIDIA work — your other NVIDIA cards keep their <code>nvidia</code> driver and stay usable on the host.",
-        "<strong>AMD only.</strong> Dumps the GPU ROM from sysfs (<code>/sys/bus/pci/.../rom</code>) or the ACPI VFCT table to <code>/usr/share/kvm/vbios_&lt;card&gt;.bin</code>. The VM references it via <code>romfile=</code> so cards that misreport their own VBIOS still initialise correctly.",
+        "Writes <code>/etc/modprobe.d/iommu_unsafe_interrupts.conf</code> and <code>kvm.conf</code> with <code>allow_unsafe_interrupts=1</code> and <code>ignore_msrs=1</code>. These are compatibility settings applied by the script, not universal Windows/macOS requirements; unsafe interrupts relax interrupt-remapping protection.",
+        "<code>/etc/modprobe.d/blacklist.conf</code>: NVIDIA — <code>nouveau</code>/<code>lbm-nouveau</code>; AMD — <code>radeon</code> + <code>amdgpu</code>; Intel — <code>i915</code>. These vendor-wide entries may affect other cards using the same driver. The proprietary <code>nvidia</code> module is blocked <strong>only</strong> through <code>/etc/modprobe.d/proxmenux-nvidia-vfio-blacklist.conf</code> when <em>all</em> host NVIDIA cards are tracked for VFIO.",
+        "<code>/etc/udev/rules.d/10-proxmenux-vfio-bind.rules</code> + <code>/etc/proxmenux/vfio-bind.bdfs</code> — <strong>NVIDIA only.</strong> The udev rule sets <code>ATTR'{'driver_override'}'=\"vfio-pci\"</code> at PCI ADD for tracked BDFs, including affected IOMMU-group functions. Cards outside those groups can retain the <code>nvidia</code> driver. Per-BDF policy does not split a hardware IOMMU group.",
+        "<strong>AMD only.</strong> Attempts a ROM dump from <code>/sys/bus/pci/.../rom</code> or ACPI VFCT into <code>/usr/share/kvm/vbios_&lt;vendor&gt;_&lt;device&gt;.bin</code>. If successful, the VM uses <code>romfile=</code>. A valid dump does not guarantee successful GPU initialization.",
         "<strong>NVIDIA only.</strong> Host NVIDIA services (<code>nvidia-persistenced</code>, <code>nvidia-powerd</code>, <code>nvidia-fabricmanager</code>) are stopped and disabled only when every NVIDIA GPU is assigned to VFIO. With a mixed host they remain active, together with the <code>nvidia</code> module, for the GPU(s) that stay native.",
         "<code>update-initramfs -u -k all</code> — only runs if any of the above actually changed."
       ]
@@ -110,25 +110,25 @@
     "vmApply": {
       "title": "VM config is applied via qm set",
       "body": "The VM config at <code>/etc/pve/qemu-server/&lt;vmid&gt;.conf</code> is updated via <code>qm set</code> (never by direct <code>sed</code>):",
-      "after1": "A <code>x-vga=1</code> flag is added for every vendor <strong>except</strong> Intel iGPU — Intel integrated GPUs don't have dedicated VRAM for a pre-boot console, so that flag causes hangs.",
+      "after1": "The script adds <code>x-vga=1</code> for AMD and NVIDIA, <strong>not</strong> Intel. This describes its configuration policy; it does not establish that every Intel iGPU lacks firmware or that the flag universally causes hangs.",
       "after2": "Additional <code>hostpciN</code> lines are appended if the GPU's IOMMU group contains other devices you need to pass together."
     },
     "reboot": {
       "title": "Reboot if host config was touched",
-      "body": "If Phase 2 changed anything at the kernel-module / cmdline / blacklist level, you'll be prompted to reboot. Reboot is mandatory before starting the VM — otherwise the GPU is still held by the host driver and VFIO can't claim it.",
+      "body": "Follow the reboot prompt when host boot or driver settings change, and verify the GPU’s active binding before starting the VM. Saved configuration does not prove it is active. A VM-to-VM reassignment with the correct VFIO state can avoid a host reboot.",
       "imageAlt": "Summary screen showing what was changed, followed by a reboot prompt"
     }
   },
   "vendors": {
     "heading": "Vendor-specific notes",
     "nvidiaHeading": "NVIDIA",
-    "nvidiaBody": "NVIDIA consumer drivers detect that they're running in a VM and refuse to initialise with the infamous <em>\"Code 43\"</em> error. ProxMenux's workaround: hide KVM from the guest (<code>hidden=1</code>), set a spoofed hypervisor vendor ID <code>NV43FIX</code> in the <code>args</code> line, and pass <code>kvm=off</code>. This has worked reliably on GeForce drivers for years. On datacenter / Tesla / Quadro cards this isn't needed — those drivers are licensed for virtualisation.",
+    "nvidiaBody": "The script retains a legacy <em>Code 43</em> workaround: <code>hidden=1</code>, vendor ID <code>NV43FIX</code> in <code>args</code>, and <code>kvm=off</code>. It is not a universal requirement for current GeForce drivers: NVIDIA enabled Windows-VM passthrough support in R465. Code 43 can have other causes; verify the actual GPU and driver combination.",
     "nvidiaMultiHeading": "Multi-GPU NVIDIA support",
-    "nvidiaMultiBody": "Hosts with two or more NVIDIA GPUs are first-class. You can pass one card to a VM and keep the other(s) on the host for <code>nvidia-smi</code>, LXC GPU sharing, or any host-side workload. ProxMenux binds VFIO <strong>per-BDF</strong> (Bus:Device.Function) via a udev rule rather than globally blacklisting the <code>nvidia</code> module — so each card's destination is independent of the others, even when both GPUs are the same model and share the same <code>vendor:device</code> ID. The host nvidia driver stays loaded; only the specific BDFs you select get redirected to <code>vfio-pci</code>.",
+    "nvidiaMultiBody": "Mixed NVIDIA use is supported <strong>per BDF</strong>. Functions assigned to <code>vfio-pci</code> are tracked by PCI address, not merely a shared <code>vendor:device</code> ID. Cards outside the affected IOMMU groups can keep <code>nvidia</code> and be checked with <code>nvidia-smi</code>. Two cards in the same group are not independently isolated by this policy.",
     "amdHeading": "AMD",
-    "amdBody": "The \"AMD reset bug\" means some cards crash when the VM stops and can't re-initialise without a host reboot. ProxMenux pre-screens for this by reading the PCI reset method, but cannot fix it after the fact. If you hit it, the community fix is the <vendorResetLink>vendor-reset</vendorResetLink> kernel module. The script doesn't install it automatically — the module is a DKMS build you add yourself if you see reset failures. Also on Windows guests, the <em>RadeonResetBugFix</em> service is the common userspace workaround.",
+    "amdBody": "Some AMD GPUs fail to reset after a VM stops. The assistant checks reported capabilities, not every real restart cycle. <vendorResetLink>vendor-reset</vendorResetLink> supports a limited device list and requires compatible kernel support and early loading; the script does not install it. The Windows <em>RadeonResetBugFix</em> project is another hardware-dependent workaround, not a guaranteed fix for all AMD GPUs.",
     "intelHeading": "Intel iGPU",
-    "intelBody": "Intel iGPU passthrough is flaky but possible on UHD 630+ generations with <sriovLink>i915-sriov-dkms</sriovLink> for SR-IOV. For a single \"give the iGPU to one VM\" case, the script binds it exactly like a dedicated GPU, but skips <code>x-vga=1</code> (iGPUs don't carry a pre-boot VBIOS). You'll lose host console output — plan accordingly."
+    "intelBody": "Full Intel iGPU passthrough and SR-IOV are separate workflows. This assistant reserves the full device for one VM and omits <code>x-vga=1</code>. <sriovLink>i915-sriov-dkms</sriovLink> applies only to supported SR-IOV hardware/kernel combinations; a “UHD 630+” label is not a compatibility rule. Plan alternate host-console access."
   },
   "verification": {
     "heading": "Verification"
@@ -136,19 +136,19 @@
   "troubleshoot": {
     "heading": "Troubleshooting",
     "code43Title": "Code 43 in Windows (NVIDIA)",
-    "code43Body": "The KVM hiding args didn't apply. Check <code>qm config &lt;vmid&gt; | grep -E \"cpu|args\"</code> — you should see <code>hidden=1</code> and <code>hv_vendor_id=NV43FIX</code>. If missing, re-run the script and re-select the same VM.",
+    "code43Body": "Code 43 is not proof of failed KVM hiding. Inspect <code>qm config VMID | grep -E \"cpu|args\"</code> (replace VMID) for the script’s <code>hidden=1</code> and <code>hv_vendor_id=NV43FIX</code> settings, but also check the guest driver, GPU firmware and assignment. Re-running may exit early if the GPU is already assigned.",
     "amdResetTitle": "AMD GPU works once, fails on VM restart",
-    "amdResetBody": "The AMD reset bug. Solutions (in order): (1) reboot the host — GPU will be usable again for one more VM cycle; (2) install the <code>vendor-reset</code> DKMS module and add <code>softdep amdgpu pre: vendor-reset</code>; (3) inside Windows, install the <em>RadeonResetBugFix</em> service.",
+    "amdResetBody": "A reset failure is one possible cause. A host reboot or power cycle may restore the device temporarily. Check whether <code>vendor-reset</code> supports this exact GPU and kernel and load it early as its documentation requires; <code>softdep amdgpu pre: vendor-reset</code> alone does not guarantee early loading before VFIO. The Windows <em>RadeonResetBugFix</em> workaround also requires a compatible GPU.",
     "stuckBootTitle": "VM stuck booting / GPU not detected",
-    "stuckBootBody": "Confirm VFIO actually holds the GPU on boot: <code>lspci -nnk -d vendor:device</code> must show <code>Kernel driver in use: vfio-pci</code>. If it still shows the vendor driver, the blacklist didn't take effect — check <code>/etc/modprobe.d/blacklist.conf</code> and <code>dmesg | grep vfio</code>, and regenerate initramfs: <code>update-initramfs -u -k all</code> then reboot.",
+    "stuckBootBody": "Inspect the selected PCI address with <code>lspci -nnk -s PCI_ADDRESS</code>; expect <code>Kernel driver in use: vfio-pci</code>. Replace PCI_ADDRESS with the real BDF. If the native driver remains, inspect the appropriate binding policy, not only <code>/etc/modprobe.d/blacklist.conf</code>; NVIDIA also uses per-BDF state. Read <code>dmesg | grep vfio</code>. After correcting persistent configuration, rebuild with <code>update-initramfs -u -k all</code> and follow the reboot plan.",
     "darkTitle": "Host console goes dark after reboot and I can't SSH in",
-    "darkBody": "You passed the primary GPU through before having alternate access. Boot into a recovery shell (rescue ISO, IPMI), remove the lines from the VM config (<code>/etc/pve/qemu-server/&lt;vmid&gt;.conf</code>), and remove the vfio options:",
+    "darkBody": "A dark display does not prove the host is down. If SSH also fails, check network connectivity and whether a network/storage controller was included in the IOMMU group. Recover through IPMI, serial or a recovery environment; inspect the VM config <code>/etc/pve/qemu-server/&lt;vmid&gt;.conf</code> and only revert the relevant assignments and host binding rules. Do not delete unrelated blacklist or VFIO configuration.",
     "logTitle": "Check the install log",
     "logBody": "Every run writes to <code>/tmp/add_gpu_vm.log</code>. Attach it when asking for help on GitHub."
   },
   "revert": {
     "heading": "Reverting manually",
-    "intro": "There isn't a dedicated \"remove GPU from VM\" shortcut in ProxMenux today. To detach cleanly:"
+    "intro": "Stop the VM and remove only its relevant PCI assignments in Proxmox Hardware, or with the explicit index shown below. Detaching from the VM does not return the device to a native host driver. Use Switch GPU Mode for that separate transition and inspect the affected guests before confirming."
   },
   "related": {
     "heading": "Related",
@@ -156,7 +156,7 @@
       {
         "label": "Install NVIDIA Drivers (Host)",
         "href": "/docs/hardware/nvidia-host",
-        "tail": " — install drivers on the host first if you also want the GPU usable from there."
+        "tail": " — prepare host-driver access for cards kept native; a card bound to VFIO cannot be used by the host driver simultaneously."
       },
       {
         "label": "Add GPU to LXC",
diff --git a/web/messages/en/docs/hardware/igpu-acceleration-lxc.json b/web/messages/en/docs/hardware/igpu-acceleration-lxc.json
index c5f2da3a..678ef7bc 100644
--- a/web/messages/en/docs/hardware/igpu-acceleration-lxc.json
+++ b/web/messages/en/docs/hardware/igpu-acceleration-lxc.json
@@ -10,7 +10,7 @@
   },
   "intro": {
     "title": "What this does",
-    "body": "Adds <code>dev&lt;N&gt;</code> entries to the LXC config (<code>/etc/pve/lxc/&lt;ctid&gt;.conf</code>) so the container sees <code>/dev/dri/*</code>, <code>/dev/kfd</code> or <code>/dev/nvidia*</code> — whichever applies to your GPU. Then it boots the container, detects the distro inside, and installs the matching userspace drivers (Mesa, intel-media-driver, NVIDIA runtime…) so apps like Plex, Jellyfin or Frigate actually use the GPU for transcoding. GIDs (<code>video</code>, <code>render</code>) are aligned between host and container so permissions match."
+    "body": "Adds <code>dev&lt;N&gt;</code> entries to <code>/etc/pve/lxc/&lt;ctid&gt;.conf</code> for applicable <code>/dev/dri/*</code>, <code>/dev/kfd</code> or <code>/dev/nvidia*</code> nodes. It starts the container, installs userspace packages for its distribution and, for Intel/AMD, aligns the <code>video</code> and <code>render</code> groups. Application acceleration still requires compatible hardware, libraries and app configuration."
   },
   "compare": {
     "heading": "LXC sharing vs VM passthrough",
@@ -37,12 +37,12 @@
       {
         "feature": "Reboot required?",
         "lxc": "Usually no (just restart the CT)",
-        "vm": "Yes, always"
+        "vm": "When host driver or IOMMU setup changes; not for every VM assignment"
       },
       {
-        "feature": "Supports running any OS?",
+        "feature": "Guest operating systems",
         "lxc": "Only Linux (LXC is Linux-only)",
-        "vm": "Windows, macOS, any Linux"
+        "vm": "Supported guest OS with a compatible GPU driver"
       }
     ]
   },
@@ -53,7 +53,7 @@
     "vfio": "<strong>The GPU is NOT bound to vfio-pci.</strong> If the GPU is currently assigned to a VM via passthrough, it's invisible to the host kernel driver and the LXC can't use it. The script detects this and offers to run <switchLink>Switch GPU Mode</switchLink> for you.",
     "nvidia": "<strong>For NVIDIA only:</strong> the NVIDIA host driver must already be installed — ProxMenux needs to match the container's userspace libs to the host version. If you haven't done it yet, run <nvidiaLink>Install NVIDIA Drivers on the Host</nvidiaLink> first.",
     "nvidiaCheck": "nvidia-smi",
-    "container": "<strong>An existing LXC container.</strong> The script operates on a container you already created — it doesn't create one. The container should ideally be <strong>privileged</strong> (unprivileged works but needs UID/GID mapping which the script does not configure)."
+    "container": "<strong>An existing LXC container.</strong> The script does not create one. Both privilege modes are supported; a <strong>privileged</strong> container is not universally required. Device entries and the application’s numeric group permissions still need to match."
   },
   "unpriv": {
     "title": "Works on both privileged and unprivileged containers",
@@ -66,7 +66,7 @@
   },
   "howRuns": {
     "heading": "How the script runs",
-    "body": "Two phases: all the decisions upfront, then all the changes in one go. Nothing on your container is touched until you confirm."
+    "body": "Select the container and GPU families, then pass the checks. Processing then stops the container and changes its configuration; there is no additional final confirmation. Optional VFIO cleanup has its own confirmation and can change the host earlier."
   },
   "walkthrough": {
     "heading": "Walking through the flow",
@@ -78,12 +78,12 @@
     },
     "pickCt": {
       "title": "Pick an LXC container",
-      "body": "You'll see a list of every LXC on the host with its ID and name. Pick the one that should get the GPU. The container can be running or stopped — the script handles both (stops it briefly during config, restarts it, and leaves it in its original state at the end).",
+      "body": "Lists eligible LXC containers by ID and name; OCI containers are excluded and use OCI manager Apps for devices. The container is stopped if running, started for driver installation and normally returned to its original running/stopped state.",
       "imageAlt": "Dialog listing existing LXC containers to choose from"
     },
     "selectGpu": {
       "title": "Select the GPU(s) to add",
-      "body": "If more than one GPU is present, you get a checklist. You can add multiple to the same container (e.g. an Intel iGPU for Quick Sync + an AMD dGPU for ROCm). If only one GPU is detected, it's auto-selected.",
+      "body": "The checklist selects detected vendor families, not an isolated PCI device. Intel/AMD add the visible DRI nodes used by the script; NVIDIA adds its available device nodes, potentially covering multiple cards. One detected family is selected automatically. Verify the resulting device list, particularly on multi-GPU hosts.",
       "imageAlt": "Checklist showing detected GPUs (Intel / AMD / NVIDIA) with vendor and PCI address"
     },
     "preflight": {
@@ -91,14 +91,14 @@
       "imageAlt": "Dialog offering to run Switch GPU Mode when the selected GPU is still bound to vfio-pci for VM passthrough",
       "intro": "Three checks, any of which can block or redirect you:",
       "items": [
-        "<strong>SR-IOV.</strong> If the selected GPU is a Virtual Function (VF) or a Physical Function with active VFs, LXC passthrough doesn't apply — the device is managed by the SR-IOV driver. Blocked.",
+        "<strong>SR-IOV guard.</strong> This assistant blocks a selected VF or PF with active VFs. That is a limitation of its broad device selection, not a universal prohibition on SR-IOV with LXC; configure those devices separately.",
         "<strong>Bound to vfio-pci.</strong> If the GPU is currently held by VFIO for VM passthrough, the host kernel can't create <code>/dev/dri/*</code> or <code>/dev/nvidia*</code> nodes for it. The script offers to run <switchLink>Switch GPU Mode</switchLink> which undoes the VFIO binding; you'll likely need a reboot before re-running Add GPU to LXC.",
         "<strong>Already configured.</strong> If the container already has every dev node for the selected GPU, the script says so and exits cleanly. If it's partially configured, it continues with only the missing pieces."
       ]
     },
     "applyConfig": {
       "title": "Apply the LXC config changes",
-      "body1": "The script stops the container, edits <code>/etc/pve/lxc/&lt;ctid&gt;.conf</code>, and adds <code>dev&lt;N&gt;</code> entries with the right GIDs for the selected GPUs. Using <code>dev:</code> entries (over the older <code>lxc.mount.entry</code> lines) is the modern Proxmox way — group permissions are set at config parse time instead of at mount time.",
+      "body1": "Stops the container if running and edits <code>/etc/pve/lxc/&lt;ctid&gt;.conf</code>. Numbered <code>dev&lt;N&gt;</code> entries carry the host <code>video</code> or <code>render</code> GID. Existing <code>lxc.mount.entry</code> bind lines for <code>/dev/dri</code> are replaced by <code>dev:</code> entries; inspect the resulting configuration and permissions.",
       "body2": "Example after Intel + NVIDIA on the same container:"
     },
     "installDrivers": {
@@ -123,24 +123,24 @@
       "debianIntel": "apt-get install va-driver-all intel-opencl-icd vainfo",
       "debianNvidia": "extract host <code>.run</code> → <code>pct push</code> → run with <code>--no-kernel-modules --no-dkms</code>",
       "whyTitle": "Why the NVIDIA .run dance on Debian",
-      "whyBody": "Debian / Ubuntu don't ship NVIDIA packages with a version granular enough to match the host driver byte-for-byte. The userspace libs inside the container <strong>must match the kernel module version</strong> loaded on the host, or <code>nvidia-smi</code> fails with a version mismatch. ProxMenux solves this by using the exact same <code>.run</code> installer that was used for the host — extracted, tarred, pushed into the container with <code>pct push</code>, and run with <code>--no-kernel-modules --no-dkms</code> so only the userspace is touched."
+      "whyBody": "Repository packages may not match the host driver. Container libraries <strong>must match the loaded host module</strong> for NVML tools such as <code>nvidia-smi</code>. The Debian/glibc path uses the cached host-version <code>.run</code> installer, extracts and packs it on the host, transfers it with <code>pct push</code> and installs with <code>--no-kernel-modules --no-dkms</code>. Alpine and Arch use repository packages, whose versions still need checking."
     },
     "alignGids": {
       "title": "Align GIDs and restore state",
-      "body1": "Device files on the host are owned by group <code>video</code> (GID 44) or <code>render</code> (GID 104). The container's distro may ship different GID numbers for those groups, which would make the GPU nodes unreachable from inside. The script rewrites <code>/etc/group</code> in the container so <code>video:44</code> and <code>render:104</code> match exactly.",
-      "body2": "Finally, it restores the container to its original state — if it was stopped when you started, it gets stopped again. If it was running, it stays running."
+      "body1": "For Intel/AMD, reads the host GIDs for <code>video</code> and <code>render</code>, using 44/104 only as fallbacks, then edits <code>/etc/group</code> inside the container to match; NVIDIA-only runs skip this step. Entries such as <code>video:44</code> and <code>render:104</code> are examples, not universal IDs. Verify app membership and effective device permissions.",
+      "body2": "On the normal completion path, a container that was initially stopped is stopped again; one that was running stays running. If startup or installation fails, verify its final state and the log."
     }
   },
   "vendors": {
     "heading": "Vendor-specific notes",
     "intelHeading": "Intel iGPU",
-    "intelBody": "Most common path — great for Plex / Jellyfin / Frigate hardware transcoding via <em>Quick Sync</em>. The container gets <code>/dev/dri/card0</code> (legacy) and <code>/dev/dri/renderD128</code> (modern render-only node — what apps actually use). No host-side changes needed; the <code>i915</code> driver on the host already created the nodes.",
+    "intelBody": "Intel media acceleration, including <em>Quick Sync</em>, depends on GPU generation, codecs and app configuration. The script shares whichever of <code>/dev/dri/card0</code>, <code>card1</code>, <code>renderD128</code> and <code>renderD129</code> exist; other node numbers are not added. The host must already provide them through its native driver, for example <code>i915</code>.",
     "amdHeading": "AMD",
-    "amdBody": "Same DRI nodes as Intel for graphics / VA-API. If <code>/dev/kfd</code> exists on the host (AMD compute / ROCm kernel support), the script also adds it so containers can do OpenCL / ROCm workloads. Mesa VA drivers cover the video decode side.",
+    "amdBody": "AMD uses DRI nodes for Mesa/VA-API. If the host exposes <code>/dev/kfd</code>, the script also shares it. ROCm/OpenCL workloads still require supported hardware and compatible userspace packages; sharing the device does not install a complete ROCm stack.",
     "nvidiaHeading": "NVIDIA",
-    "nvidiaBody": "Adds every <code>/dev/nvidia*</code> node the host exposes. The critical piece is <strong>driver-version matching</strong>: host module version and container userspace lib version must be identical, otherwise <code>nvidia-smi</code> inside the container fails. ProxMenux captures the host version at detection time and uses the same <code>.run</code> file to install the container userspace. For Debian containers the install bumps container memory to 2 GB temporarily (installer needs ~1.5 GB free to extract) and restores it afterwards.",
-    "updateTitle": "After you update the host NVIDIA driver, re-run this script",
-    "updateBody": "When you upgrade the NVIDIA driver on the host, the container's userspace libs stay on the old version and <code>nvidia-smi</code> inside the container breaks. ProxMenux's <nvidiaLink>NVIDIA host installer</nvidiaLink> detects containers with NVIDIA passthrough and offers to update them automatically — but if you skipped that prompt, just run Add GPU to LXC again on the same container and it'll refresh the userspace."
+    "nvidiaBody": "Shares available <code>/dev/nvidia*</code> nodes. <strong>Driver-version matching</strong> remains essential for <code>nvidia-smi</code>. Debian/glibc uses the cached host-version <code>.run</code>; Alpine/Arch use repository packages. If the Debian path finds less than 2048 MiB configured RAM, it offers a temporary increase and later restores it; it also requires at least 1500 MiB of free disk space.",
+    "updateTitle": "After a host NVIDIA update, check container library versions",
+    "updateBody": "Old container libraries can make <code>nvidia-smi</code> report a mismatch. The <nvidiaLink>NVIDIA host installer</nvidiaLink> offers container updates. Re-running Add GPU to LXC may exit when its device entries already exist, so it is not a guaranteed library-refresh command. Check the installed versions and update the appropriate container packages or userspace installer."
   },
   "verification": {
     "heading": "Verification",
@@ -149,11 +149,11 @@
   "troubleshoot": {
     "heading": "Troubleshooting",
     "mismatchTitle": "nvidia-smi: Failed to initialize NVML: Driver/library version mismatch",
-    "mismatchBody": "Container userspace version ≠ host module version. Run Add GPU to LXC again on that container — the script extracts the current host <code>.run</code> and re-installs userspace matching.",
+    "mismatchBody": "Container libraries do not match the loaded host module. Inspect versions and update the container userspace appropriately. The cached <code>.run</code> supports the Debian/glibc path, but Add GPU to LXC can exit early when all device entries already exist.",
     "denyTitle": "Permission denied on /dev/dri/renderD128 inside the container",
-    "denyBody": "Usually one of: (1) container is unprivileged without UID/GID mapping to host <code>render</code> group; (2) the user inside the container isn't in the <code>render</code> group. Fix: add the user to <code>render</code> inside the container (<code>usermod -aG render &lt;user&gt;</code>), or switch to privileged mode if the workload is trusted.",
+    "denyBody": "Check the device entry and numeric <code>render</code> group permissions, then whether the app user belongs to <code>render</code>. Where available, add that user to <code>render</code> with <code>usermod -aG render &lt;user&gt;</code>, replacing the placeholder with the actual account. Restart the application session to apply membership; changing privilege mode is not a general permissions fix.",
     "vainfoTitle": "vainfo says: VA-API version 1.xx; failed to initialize",
-    "vainfoBody": "The VA-API runtime is there but no suitable driver was installed. On Intel, install <code>intel-media-driver</code> (newer gens) or <code>i965-va-driver</code> (older gens). On AMD, <code>mesa-va-drivers</code>. Re-run the script if in doubt.",
+    "vainfoBody": "Check device access and the selected VA-API driver. Package names vary by distribution: examples include <code>intel-media-driver</code> for supported newer Intel GPUs, <code>i965-va-driver</code> for supported older ones, and <code>mesa-va-drivers</code> for AMD. The message alone does not prove a missing package.",
     "logTitle": "Install log",
     "logBody": "Every run writes to <code>/tmp/add_gpu_lxc.log</code> on the host. Include it when asking for help on GitHub."
   },
diff --git a/web/messages/en/docs/hardware/install-coral-tpu-host.json b/web/messages/en/docs/hardware/install-coral-tpu-host.json
index 082a8bf2..dd183688 100644
--- a/web/messages/en/docs/hardware/install-coral-tpu-host.json
+++ b/web/messages/en/docs/hardware/install-coral-tpu-host.json
@@ -10,7 +10,7 @@
   },
   "intro": {
     "title": "What this does",
-    "body": "The Coral installer is <strong>unified and hardware-aware</strong>: you run one menu option and it figures out what you actually have. M.2 / Mini-PCIe cards need kernel modules (<code>gasket</code> + <code>apex</code>) built with DKMS so they survive kernel upgrades. USB Accelerators just need the Google Edge TPU runtime (<code>libedgetpu1-std</code>) from Google's own APT repository. Both types plugged in? Both paths run in sequence."
+    "body": "A <strong>single hardware-aware installer</strong> selects the detected device paths. PCIe uses <code>gasket</code> and <code>apex</code> modules with DKMS; future rebuilds still need compatible driver sources and kernel headers. USB uses the <code>libedgetpu1-std</code> userspace runtime. If both types are detected, both paths run. USB runtime must be available where the app runs; a host runtime is not inherently required for an app running only inside LXC."
   },
   "which": {
     "heading": "Which Coral do I have?",
@@ -20,7 +20,7 @@
     "headerInstall": "Install type",
     "headerReboot": "Reboot?",
     "pcieForm": "M.2 / Mini-PCIe",
-    "pcieFormSub": "(dual-edge TPU on an M.2 card)",
+    "pcieFormSub": "(M.2 cards include single- and dual-Edge-TPU variants)",
     "pcieDetect": "PCI vendor <code>1ac1</code>",
     "pcieInstall": "Kernel module (gasket + apex) via DKMS",
     "pcieReboot": "Yes",
@@ -32,15 +32,15 @@
   },
   "prereqs": {
     "title": "Before you start",
-    "coral": "<strong>A Coral TPU plugged into the host</strong> (M.2, Mini-PCIe or USB). No Coral means no install — the script just tells you nothing was detected and exits.",
+    "coral": "<strong>A connected Coral TPU</strong> (M.2, Mini-PCIe or USB) is required for installation. Without detected hardware, the script can still offer cleanup or removal of an existing installation; it will not install a new hardware path.",
     "coralCheck": "lspci -d 1ac1: ; lsusb | grep -E '1a6e:089a|18d1:9302'",
     "internet": "<strong>Internet access</strong> on the host — for PCIe the DKMS path clones a GitHub repo, for USB it adds a Google APT repo and downloads the <code>libedgetpu1-std</code> package.",
     "headers": "<strong>Kernel headers available via APT</strong>. On Proxmox this means <code>proxmox-headers-$(uname -r)</code> must be installable — needed only for the PCIe/M.2 path, but the script fetches it automatically so you don't have to.",
-    "reboot": "<strong>Be OK with a reboot</strong> if you have PCIe hardware. The kernel module is built and loaded at the end, but a fresh boot is the clean way to confirm it comes up on its own."
+    "reboot": "<strong>Plan a reboot</strong> for PCIe hardware. The script attempts to load the built modules; a planned restart also verifies that they load automatically."
   },
   "hostPrepTip": {
     "title": "This only prepares the host",
-    "body": "Installing Coral here makes the host <em>ready</em> — the TPU is visible to the host kernel and can be handed to an LXC. To actually <em>use</em> it from a container (Frigate, DeepStack, etc.), the next step is <lxcLink>Add Coral TPU to an LXC</lxcLink>."
+    "body": "This prepares the host for <em>device access</em>; it does not configure or test an application. To <em>use</em> Coral in a compatible container application such as Frigate, continue with <lxcLink>Add Coral TPU to an LXC</lxcLink>."
   },
   "running": {
     "heading": "Running the installer",
@@ -60,28 +60,28 @@
         "<code>1a6e:089a</code> — Global Unichip, <em>unprogrammed</em> state (before the Edge TPU runtime talks to it the first time).",
         "<code>18d1:9302</code> — Google, <em>programmed</em> state (after the runtime loads firmware onto it)."
       ],
-      "outro": "If neither is found, you get an informative dialog and the script exits cleanly — no partial changes on the host."
+      "outro": "If no Coral is detected and no installation exists, the script exits with an explanatory dialog. Existing components can still trigger the cleanup or removal menu."
     },
     "prompt": {
       "title": "Pre-install prompt",
-      "body": "Before touching anything, a single dialog summarises what was detected and what will be installed. You can cancel here without any side effects.",
+      "body": "Before the installation steps, a dialog lists detected devices and the planned components. Cancel to skip installation. Optional legacy cleanup has its own earlier confirmation.",
       "imageAlt": "Pre-install dialog showing detected Coral hardware (M.2/PCIe count + USB count) and the list of steps the installer will run"
     },
     "pcie": {
       "title": "PCIe path — gasket + apex kernel modules via DKMS",
       "body": "Only runs if the script found a PCIe / M.2 Coral. It's the heavier of the two paths because it's compiling a kernel module for your exact running kernel.",
       "items": [
-        "<strong>Cleanup.</strong> If a previous <code>gasket-dkms</code> install left dpkg in a broken state (typical after a PVE 9 kernel upgrade where DKMS autoinstall failed silently), force-purge it.",
+        "<strong>Cleanup.</strong> Any existing <code>gasket-dkms</code> package is removed before rebuilding; if it is in a broken package state, the script forces its removal and purge.",
         "<strong>Install build deps:</strong> <code>git</code>, <code>dkms</code>, <code>build-essential</code>, <code>proxmox-headers-$(uname -r)</code>."
       ],
-      "cloneIntro": "<strong>Clone the driver source.</strong> Prefers the <feranickLink>feranick/gasket-driver</feranickLink> community fork (actively maintained, kernel 6.12+ ready). Falls back to <googleLink>google/gasket-driver</googleLink> if feranick is unreachable, applying kernel-specific patches:",
+      "cloneIntro": "<strong>Clone the driver source.</strong> Prefers <feranickLink>feranick/gasket-driver</feranickLink>, falling back to <googleLink>google/gasket-driver</googleLink> if unavailable. A successful build still depends on kernel compatibility. The Google fallback receives these version-dependent patches:",
       "kernelPatches": [
-        "Kernel 6.5+ : <code>no_llseek</code> removed upstream → <code>noop_llseek</code> substitution",
+        "For kernel 6.5+, the fallback patch replaces <code>no_llseek</code> with <code>noop_llseek</code>.",
         "Kernel 6.13+ : <code>MODULE_IMPORT_NS(DMA_BUF)</code> requires string literal"
       ],
       "afterItems": [
         "<strong>Stage sources under <code>/usr/src/gasket-1.0/</code>,</strong> generate <code>dkms.conf</code>, register with <code>dkms add</code>.",
-        "<strong>Build + install:</strong> <code>dkms build</code> then <code>dkms install</code>. If anything fails, the last 50 lines of <code>make.log</code> print to the terminal so you see the real error — no hunting in log files.",
+        "<strong>Build and install:</strong> <code>dkms build</code> followed by <code>dkms install</code>. On failure, the script displays the last 50 lines of <code>make.log</code> if that file is available.",
         "<strong>Create the <code>apex</code> group + udev rules</strong> (<code>/etc/udev/rules.d/99-coral-apex.rules</code>) so <code>/dev/apex_*</code> nodes get the right group on the next boot.",
         "<strong>Load the modules:</strong> <code>modprobe gasket</code> + <code>modprobe apex</code>."
       ],
@@ -92,16 +92,16 @@
       "body": "Only runs if a USB Accelerator was detected. Much simpler:",
       "items": [
         "<strong>Add Google's GPG key</strong> to <code>/etc/apt/keyrings/coral-edgetpu.gpg</code>.",
-        "<strong>Add the APT repository</strong> to <code>/etc/apt/sources.list.d/coral-edgetpu.list</code> with <code>signed-by=</code> pointing at the keyring (modern, non-deprecated format).",
+        "<strong>Add the APT repository</strong> in <code>/etc/apt/sources.list.d/coral-edgetpu.list</code>, with <code>signed-by=</code> restricting verification to its keyring. This is one-line .list syntax, not deb822 .sources syntax.",
         "<strong>Install <code>libedgetpu1-std</code></strong> — the standard-performance Edge TPU runtime.",
         "<strong>Reload udev</strong> so the rules shipped with the package apply to the USB device without having to unplug/replug."
       ],
       "stdTitle": "Why libedgetpu1-std and not libedgetpu1-max?",
-      "stdBody": "The <code>max</code> variant overclocks the Coral and runs hotter. Fine for desktop use with airflow; not recommended inside small NUC / Mini-PC builds or passively cooled Proxmox hosts. If you really want it, install by hand afterwards: <code>apt install libedgetpu1-max</code>."
+      "stdBody": "The <code>max</code> package enables the maximum supported clock frequency, increasing performance, power use and heat compared with the standard runtime. Check the accelerator’s cooling and operating conditions before switching. The packages are mutually exclusive; install the alternative with <code>apt install libedgetpu1-max</code>."
     },
     "reboot": {
       "title": "Reboot prompt (only if PCIe ran)",
-      "body": "If the PCIe path ran, the script offers a reboot. The modules were <code>modprobe</code>'d already so in theory you can skip the reboot — but a clean boot is the right way to verify the module comes up on its own and <code>/dev/apex_0</code> appears with group <code>apex</code>. For USB-only installs, no reboot is suggested (the runtime and udev rules are active immediately).",
+      "body": "After the PCIe path, the script offers a reboot. It has attempted <code>modprobe</code>, but verify that the modules load and <code>/dev/apex_0</code> appears with group <code>apex</code>. A planned reboot also checks automatic loading. USB-only installation does not prompt for a host reboot.",
       "imageAlt": "Final summary + reboot prompt after a PCIe install"
     }
   },
@@ -125,18 +125,18 @@
     "reinstallHeading": "Reinstall / update",
     "reinstallBody": "Continues with the normal install flow — useful after a kernel upgrade if the DKMS rebuild didn't happen automatically, or to lift the runtime to a newer <code>libedgetpu1-*</code> from the Google Coral apt repo. The previous DKMS state is cleaned up first so a half-installed package from a failed earlier attempt doesn't block the new build.",
     "uninstallHeading": "Uninstall — what gets removed",
-    "uninstallIntro": "Confirms with a yes/no dialog before doing anything (LXC containers with apex passthrough will lose access to <code>/dev/apex_*</code> after the next reboot — the warning makes that clear). Then it performs a full, idempotent rollback:",
+    "uninstallIntro": "Requires confirmation before removal. LXC applications using <code>/dev/apex_*</code> may lose access during removal or after the next reboot. The removal sequence is:",
     "uninstallItems": [
-      "Unloads the <code>apex</code> and <code>gasket</code> kernel modules.",
+      "Attempts to unload <code>apex</code> and <code>gasket</code>; active users can prevent module removal.",
       "Removes every DKMS-registered <code>gasket/&lt;version&gt;</code> entry so the modules don't come back on the next kernel install.",
       "Purges the <code>gasket-dkms</code>, <code>libedgetpu1-std</code> and <code>libedgetpu1-max</code> apt packages, then runs <code>apt-get autoremove --purge</code>.",
       "Deletes the udev rule <code>/etc/udev/rules.d/99-coral-apex.rules</code> ProxMenux wrote; restores the upstream <code>60-gasket-dkms.rules</code> group to its default if it's still present.",
-      "Removes the <code>apex</code> system group <strong>only if no users still belong to it</strong> — if you mapped a custom user into <code>apex</code> for an LXC passthrough, the group is left in place and a warning prints the current members.",
-      "Cleans the Google Coral apt repository entry and keyring (<code>/etc/apt/sources.list.d/coral-edgetpu.list</code> + <code>coral-edgetpu-archive-keyring.gpg</code>).",
+      "Checks the supplementary member list of <code>apex</code>. <strong>If that list is empty</strong>, it attempts group removal; otherwise it retains <code>apex</code> and lists its members. This is not a complete check of primary-group users.",
+      "Removes the repository list <code>/etc/apt/sources.list.d/coral-edgetpu.list</code>, the legacy <code>coral-cloud.list</code> and old keyrings named <code>coral-edgetpu-archive-keyring.gpg</code>. The current keyring at <code>/etc/apt/keyrings/coral-edgetpu.gpg</code> is not removed by this sequence.",
       "Prompts for a reboot at the end <strong>only if the PCIe path was installed</strong> — the cleanest way to flush the kernel modules. USB-only uninstalls don't need one."
     ],
     "lxcWarnTitle": "LXC containers with apex passthrough",
-    "lxcWarnBody": "Uninstalling on the host invalidates the device path mapped into any LXC container configured for apex passthrough. Plan the operation during a maintenance window if Frigate / DeepStack / similar workloads depend on it."
+    "lxcWarnBody": "Removing the host components can break LXC device access. Schedule maintenance if compatible applications such as Frigate depend on this Coral."
   },
   "updates": {
     "heading": "Update notifications",
@@ -145,7 +145,7 @@
     "headerTracked": "Tracked version",
     "headerUpstream": "Upstream source",
     "pcieVariant": "PCIe / M.2",
-    "pcieTracked": "<code>gasket-dkms</code> Debian version (or the DKMS-registered version if the package was force-removed)",
+    "pcieTracked": "Recorded release tag from the successful installation, then a healthy <code>gasket-dkms</code> package version, with the DKMS module version as fallback. The bare DKMS version does not identify the fork’s patch level.",
     "pcieUpstream": "Latest tag of <code>feranick/gasket-driver</code> on GitHub (7-day cache, build-number comparison)",
     "usbVariant": "USB",
     "usbTracked": "<code>libedgetpu1-std</code> or <code>libedgetpu1-max</code> apt version",
@@ -153,8 +153,8 @@
     "outro": "When a newer version is detected the Monitor fires a <code>coral_driver_update_available</code> notification on every enabled channel (Telegram, Discord, Gotify, ntfy, email, webhook). The notification points back at the same installer entry — pick <strong>Reinstall / update</strong> from the action menu above to apply it.",
     "antiTitle": "Anti-cascade by design",
     "antiBody": "One notification per variant, only when the upstream version actually changes — never on every 24h scan. If you ignore an update it doesn't re-ping you until a newer release lands.",
-    "rebootTitle": "Reboot is only needed for the PCIe path",
-    "rebootBody": "The gasket DKMS rebuild loads new kernel modules — that needs a reboot to be active. The USB runtime upgrade is a user-space library swap, no reboot required."
+    "rebootTitle": "PCIe updates: plan a reboot",
+    "rebootBody": "A rebuilt PCIe module must be loaded before it takes effect; a planned reboot also verifies automatic loading. A USB userspace-library upgrade needs no host reboot, but applications using the old library may need a restart."
   },
   "manual": {
     "heading": "Manual equivalent",
@@ -170,13 +170,13 @@
   "troubleshoot": {
     "heading": "Troubleshooting",
     "dkmsFailTitle": "DKMS build fails after a kernel upgrade",
-    "dkmsFailBody": "Most common cause on PVE 9: the running kernel bumped but <code>proxmox-headers-$(uname -r)</code> isn't installed for it yet. Check with <code>dpkg -l proxmox-headers-$(uname -r)</code>. Install the missing headers and re-run the script — ProxMenux's <code>cleanup_broken_gasket_dkms</code> step handles any leftover half-configured package state.",
+    "dkmsFailBody": "Missing headers are one possible cause. Verify <code>proxmox-headers-$(uname -r)</code> with <code>dpkg -l proxmox-headers-$(uname -r)</code>. Install them if missing, then inspect the build log for source/kernel incompatibility. Re-running invokes <code>cleanup_broken_gasket_dkms</code>, but cleanup cannot guarantee compatibility with every kernel.",
     "apexMissTitle": "/dev/apex_0 missing after reboot",
-    "apexMissBody": "The module isn't loaded. Try <code>modprobe apex</code> by hand. If that errors, check <code>dmesg | grep -iE \"apex|gasket\"</code> for the real failure — common culprits are kernel version mismatch (DKMS was built for a different kernel than the one you booted) or a firmware upgrade that disabled the PCIe slot the Coral is in.",
+    "apexMissBody": "Check whether the PCIe device is detected and the module matches the running kernel. Try <code>modprobe apex</code> and inspect <code>dmesg | grep -iE \"apex|gasket\"</code>. Build failures, module loading or slot/firmware configuration can prevent device creation.",
     "lxcMissTitle": "Can see /dev/apex_0 but LXC can't",
-    "lxcMissBody": "Host is fine. Problem is passthrough config — see <lxcLink>Add Coral TPU to an LXC</lxcLink>.",
+    "lxcMissBody": "A visible host node alone does not prove the device works. Verify host access, then the LXC mount, cgroup rules and numeric user/group permissions. See <lxcLink>Add Coral TPU to an LXC</lxcLink>.",
     "usbUnreachTitle": "USB Accelerator detected but Frigate / TFLite can't reach it",
-    "usbUnreachBody": "Check the udev rules shipped with <code>libedgetpu1-std</code> took effect: <code>ls -l /dev/bus/usb/*/*</code>. The device should NOT be owned by root:root with mode 0600 — if it is, run <code>udevadm control --reload-rules &amp;&amp; udevadm trigger</code> on the host, unplug the USB Coral, wait 3 seconds and plug it back in.",
+    "usbUnreachBody": "Check the rules supplied by <code>libedgetpu1-std</code> and inspect permissions with <code>ls -l /dev/bus/usb/*/*</code>. The application’s mapped user/group needs read/write access; root ownership alone is not an error. After changing rules, run <code>udevadm control --reload-rules &amp;&amp; udevadm trigger</code> and reconnect the device if needed.",
     "logTitle": "Install log",
     "logBody": "Every run writes to <code>/tmp/coral_install.log</code> on the host. If the DKMS build dies, the script also appends the last 50 lines of <code>/var/lib/dkms/gasket/1.0/build/make.log</code> to that log — attach it when asking for help on GitHub."
   },
@@ -196,7 +196,7 @@
       {
         "label": "ProxMenux Monitor — Hardware tab",
         "href": "/docs/monitor/dashboard/hardware",
-        "tail": " — the Coral modal that surfaces driver, modules, device nodes, runtime status and live temperature once the host install is done."
+        "tail": " — the Coral panel shows driver, modules, device nodes and runtime status, plus temperature when a supported sensor exposes it."
       }
     ]
   }
diff --git a/web/messages/en/docs/hardware/nvidia-host.json b/web/messages/en/docs/hardware/nvidia-host.json
index 037acd88..56c40f13 100644
--- a/web/messages/en/docs/hardware/nvidia-host.json
+++ b/web/messages/en/docs/hardware/nvidia-host.json
@@ -10,11 +10,11 @@
   },
   "intro": {
     "title": "What this does",
-    "body": "ProxMenux automates the whole NVIDIA driver lifecycle on the host: detects your GPU, offers maintained NVIDIA branches that list its PCI Device ID, blacklists <code>nouveau</code>, downloads and runs the official NVIDIA <code>.run</code> installer with DKMS, installs the <code>nvidia-persistenced</code> service and udev rules, and offers to apply the optional NVENC patch. The DKMS build is the final compatibility check against the running kernel. If you already have LXC containers with NVIDIA passthrough, it can update their userspace libraries to match the host."
+    "body": "ProxMenux detects the GPU and offers maintained NVIDIA branches listing its PCI ID. It blacklists <code>nouveau</code>, downloads the official <code>.run</code> installer, uses DKMS, installs <code>nvidia-persistenced</code>, udev rules and the NVIDIA Container Toolkit, and offers an optional NVENC patch. Build checks assess the running kernel; successful compilation does not guarantee every app works. Existing NVIDIA LXCs are offered a userspace library update, version-matched except on Arch."
   },
   "who": {
     "heading": "Who is this for?",
-    "body": "If you have an NVIDIA GPU and you want to use it for hardware-accelerated transcoding in Plex, Jellyfin, Frigate, Immich, Stable Diffusion or any other app running <strong>inside an LXC container</strong>, you need to install the driver on the Proxmox <em>host</em> first. This page covers that host-side install. Passing the GPU to a <strong>virtual machine (VM)</strong> uses a different flow (VFIO passthrough) and is documented separately."
+    "body": "For GPU-accelerated video or compute apps such as Plex, Jellyfin, Frigate, Immich or Stable Diffusion <strong>inside LXC</strong>, install the supported NVIDIA driver on the Proxmox <em>host</em> first. Assigning a GPU directly to a <strong>VM</strong> uses the separate VFIO workflow."
   },
   "prereqs": {
     "title": "Before you start",
@@ -22,11 +22,11 @@
     "gpuCheck": "lspci | grep -i nvidia",
     "notVm": "The GPU <strong>is not currently assigned to a VM via VFIO passthrough</strong>. If it is, the script will refuse to install the host driver to avoid breaking the passthrough config.",
     "internet": "Internet access on the host. The installer downloads the driver from <code>download.nvidia.com</code> and, optionally, clones <code>nvidia-persistenced</code> and <code>nvidia-patch</code> from GitHub.",
-    "space": "Some free space in <code>/opt/nvidia</code> for the <code>.run</code> installer plus the RAM used during the build. When propagating to LXCs on non-Arch distros, each container needs at least 1.5 GB free; ProxMenux temporarily raises container RAM to 2 GB and restores it after. A reboot is required at the end of the host install."
+    "space": "Allow disk space in <code>/opt/nvidia</code> for the <code>.run</code> installer and RAM for compilation. The non-Arch LXC update path checks for 1500 MiB free and can request a temporary increase to 2048 MiB RAM if lower, restoring the prior limit afterwards. Plan for the host reboot prompt."
   },
   "vmWarn": {
     "title": "GPU assigned to a VM? Stop here",
-    "body": "If the GPU is currently bound to <code>vfio-pci</code> (i.e. it is being passed through to a VM), installing the host driver can break the passthrough and destabilise the system. ProxMenux detects this and aborts. Remove the GPU from the VM passthrough configuration and reboot before running this script."
+    "body": "If any NVIDIA device is bound to <code>vfio-pci</code>, this installer aborts, including when the VM is stopped. A reserved device is not necessarily in active use by a VM. Plan the return to host-driver mode and remove obsolete VM and VFIO assignments before rebooting and installing."
   },
   "running": {
     "heading": "Running the installer",
@@ -35,30 +35,30 @@
   },
   "howRuns": {
     "heading": "How the script runs",
-    "body": "The installer goes through three phases with clear separation between \"collecting information and validating\" and \"actually touching the host\". Until the final confirmation, nothing has been changed."
+    "body": "The workflow detects devices, selects a release and performs installation. A separately confirmed stale-VFIO cleanup can occur before the overview. Repository/header preparation and downloading also precede replacement of the existing driver, so there is no single final confirmation after which all changes begin."
   },
   "walkthrough": {
     "detect": {
       "title": "GPU detection and overview",
       "body1": "The script scans the PCI bus and shows every NVIDIA video controller it finds, the current driver status (or <em>\"No NVIDIA driver installed\"</em>), and any LXC container that already has NVIDIA passthrough configured (driver version inside each one).",
-      "body2": "Review the overview carefully. If the detected GPU is not what you expect, or if a container's version already matches the host, you can cancel here without side effects.",
+      "body2": "Review the detected GPU and host/container versions before proceeding. Cancel at the overview if the selection is unexpected; any separately confirmed earlier VFIO cleanup has already taken place.",
       "imageAlt": "Pre-install overview showing detected GPUs, current driver status and LXC containers with NVIDIA passthrough"
     },
     "version": {
       "title": "Choose the driver version",
       "body1": "ProxMenux fetches the list of available drivers from NVIDIA and narrows the picker to versions that <strong>list your GPU's PCI Device ID in the supported chips table</strong> of the corresponding branch on <code>nvidia.com</code>. Additional heuristics discard developer / beta CDN drops that would otherwise appear at the top. The first entry is labelled <em>&lt;version&gt; — Recommended</em>: it prefers the head of the branch of the driver already installed on the host (bugfix in place), otherwise the head of the current Production Branch, otherwise the highest supported numeric.",
-      "body2": "If the currently installed driver was patched via keylase (NVENC), the picker auto-narrows to versions still covered by the patch table, so applying <em>Reinstall / update</em> without losing the patch is one click.",
+      "body2": "When the installed driver is tracked as NVENC-patched through keylase, the picker narrows to versions listed in the patch table. The <em>Reinstall / update</em> workflow still includes confirmation and patch prompts; check the final patch result.",
       "whyTitle": "How kernel compatibility is validated",
-      "whyBody": "The version list is filtered by NVIDIA branch maintenance and GPU PCI support, not by a hard-coded kernel/driver matrix. After selection, DKMS builds the module against the running kernel. A failed build stops the installation from being treated as valid; choose another maintained branch if NVIDIA has not adapted that release to your kernel.",
+      "whyBody": "The list uses maintained branches and GPU PCI support, rather than a fixed kernel/driver matrix. A pre-build check tests the selected release against the running kernel. A confirmed build failure returns to selection; an unavailable pre-check can produce a warning and continue. Final installation and runtime checks still matter.",
       "imageAlt": "Driver version selector with GPU-supported NVIDIA branches and the Recommended entry on top"
     },
     "uninstall": {
       "title": "Clean uninstall (only if reinstalling)",
-      "body": "If a driver is already present and you picked a different version, ProxMenux stops the NVIDIA services, unloads the kernel modules, removes DKMS entries and purges <code>nvidia-*</code> / <code>libnvidia-*</code> / <code>cuda-*</code> packages before touching the new installer. This avoids the classic mixed-version mess."
+      "body": "After downloading and checking the selected installer, an existing driver is removed before replacement. ProxMenux stops NVIDIA services, unloads modules, removes DKMS entries and purges <code>nvidia-*</code> / <code>libnvidia-*</code> / <code>cuda-*</code> packages. This also applies to a confirmed reinstall of the same version."
     },
     "prepare": {
       "title": "Prepare the system",
-      "body": "Behind a single confirmation, the script:",
+      "body": "During preparation, the script:",
       "items": [
         "Checks the repositories of the host before anything is removed or installed: a host with no active subscription and only the Enterprise repository is asked before switching to no-subscription, and the installation stops when the switch is declined.",
         "Installs <code>pve-headers-$(uname -r)</code> (or <code>proxmox-headers-$(uname -r)</code>), <code>build-essential</code> and <code>dkms</code>.",
@@ -68,7 +68,7 @@
     },
     "download": {
       "title": "Download and run the NVIDIA installer",
-      "body": "The installer downloads the <code>NVIDIA-Linux-x86_64-&lt;version&gt;.run</code> file into <code>/opt/nvidia</code>, validates it (size + executable signature, not just HTTP 200), then runs it with DKMS so the kernel module rebuilds automatically across kernel upgrades.",
+      "body": "Downloads <code>NVIDIA-Linux-x86_64-&lt;version&gt;.run</code> into <code>/opt/nvidia</code>, checking file size and executable type. These are file-format checks, not cryptographic signature verification. The installer registers DKMS for rebuilds on kernel changes; source and kernel compatibility are still required.",
       "imageAlt": "Download progress followed by the NVIDIA installer running its DKMS build"
     },
     "persist": {
@@ -77,39 +77,39 @@
     },
     "nvenc": {
       "title": "Optional: apply the NVENC patch",
-      "body": "Consumer NVIDIA GPUs (GeForce line) limit the number of simultaneous NVENC encoding sessions. The community <patchLink>keylase/nvidia-patch</patchLink> removes that restriction. If you plan to use the GPU for Plex / Jellyfin / Frigate with many concurrent streams, answer <strong>Yes</strong> when prompted.",
+      "body": "NVENC session limits depend on GPU and driver. The community <patchLink>keylase/nvidia-patch</patchLink> can remove the driver session limit for supported versions. Choose <strong>Yes</strong> only if you need that encoding change and your version is supported. This does not accelerate decoding or remove hardware capacity limits.",
       "supportTitle": "Check patch support for your driver",
-      "supportBody": "The patch does not cover every driver version. Before relying on it in production, verify your version is listed in the <patchTableLink>patch table</patchTableLink>. If it isn't supported yet, pick a nearby older driver that is."
+      "supportBody": "Check your exact release in the <patchTableLink>patch table</patchTableLink>. If it is missing, keep an unpatched driver or select another maintained release that supports your GPU and kernel as well as the patch; do not choose an older release solely because it is nearby in the list."
     },
     "propagate": {
       "title": "Optional: propagate the driver to LXC containers",
       "body1": "If the overview screen listed containers with NVIDIA passthrough, ProxMenux now offers to update the userspace libraries inside each one to match the host. Host kernel module and container userspace <strong>must be the exact same version</strong> — otherwise <code>nvidia-smi</code> inside the container will fail with a \"version mismatch\" error.",
-      "body2": "The update is distro-aware. For Debian / Ubuntu and other glibc distros, the same <code>.run</code> installer (with <code>--no-kernel-modules --no-dkms --no-install-compat32-libs</code>) is pushed into the container and executed; container RAM is temporarily raised to 2 GB if lower and restored after. For <strong>Arch, Manjaro and EndeavourOS</strong> the update is a <code>pacman -Syu nvidia-utils</code> pinned to the host's driver branch. <strong>Alpine</strong> uses a different path — the <code>.run</code> is extracted on the host, only the userspace libraries are packaged as a tarball and pushed with <code>pct push</code>, then <code>gcompat</code> + <code>binutils</code> shims are installed via <code>apk</code> and SONAME symlinks are recreated with <code>readelf</code> so the glibc-linked libraries load correctly on musl.",
+      "body2": "Debian / Ubuntu and other glibc containers receive the extracted <code>.run</code> installer with <code>--no-kernel-modules --no-dkms --no-install-compat32-libs</code>; RAM can temporarily increase to 2 GiB and is restored afterwards. <strong>Arch, Manjaro and EndeavourOS</strong> use <code>pacman -Syu nvidia-utils</code> from configured repositories, without pinning to the host version: verify the result. <strong>Alpine</strong> receives the extracted <code>.run</code> payload through <code>pct push</code>, installs <code>gcompat</code> and <code>binutils</code> with <code>apk</code>, and builds SONAME links using <code>readelf</code>. Check runtime functionality; compatibility shims do not guarantee every driver library works on musl.",
       "imageAlt": "Prompt listing LXCs with NVIDIA passthrough and current driver version, with Yes/No to update them all"
     },
     "reboot": {
       "title": "Reboot",
-      "body": "Finally, the script rebuilds <code>initramfs</code> for all kernels and offers to reboot. A reboot <strong>is required</strong>: the nouveau blacklist and the new kernel module only take effect after restart."
+      "body": "After the driver installation, the script rebuilds <code>initramfs</code> for all kernels; its last step offers a reboot. <strong>Plan that restart</strong> to verify the persistent module and nouveau configuration on a fresh boot, even when the new driver already responds before reboot."
     }
   },
   "reinstallUninstall": {
     "heading": "Reinstall or uninstall",
-    "intro": "When the installer detects that the <code>nvidia</code> kernel module is currently loaded and <code>nvidia-smi</code> returns a version, it doesn't silently re-install on top. Instead it shows an action menu so you can choose what to do. (Binaries present on disk but the module not loaded do not count as installed — the module has to be live.)",
+    "intro": "If <code>nvidia</code> is loaded and <code>nvidia-smi</code> returns a version, an action menu appears. This identifies an active driver for the menu; driver files can still be installed even when the module is not loaded.",
     "imageAlt": "NVIDIA action menu offered when a driver is already installed — two choices: Reinstall / update driver, or Uninstall the NVIDIA driver completely",
     "imageCaption": "The action menu only appears when an NVIDIA driver is currently active on the host.",
     "reinstallHeading": "Reinstall / update",
-    "reinstallBody": "Continues with the normal install flow but, before downloading anything, runs a clean removal of the current driver (apt purge + DKMS entries dropped + leftover modules unloaded). This is the safe path to apply a newer same-branch version, choose another maintained branch when needed, or recover from a half-broken state. The LXC propagation and NVENC patch prompts re-run at the end.",
+    "reinstallBody": "Continues through release selection, repository/header preparation, download and pre-build checking before removing the old driver and installing the new one. It can update within a maintained branch or select another supported branch. LXC library and NVENC patch prompts appear again afterwards.",
     "uninstallHeading": "Uninstall — what gets removed",
-    "uninstallIntro": "Confirms with a yes/no dialog first. Then performs a full, idempotent rollback:",
+    "uninstallIntro": "After a yes/no confirmation, the uninstall removes the following driver components:",
     "uninstallItems": [
-      "Runs <code>nvidia-uninstall --silent</code> first (the counterpart to the <code>.run</code> installer), then stops and disables <code>nvidia-persistenced</code> and <code>nvidia-powerd</code>, and unloads the kernel modules (<code>nvidia_uvm</code>, <code>nvidia_drm</code>, <code>nvidia_modeset</code>, <code>nvidia</code>) — any LXC container with NVIDIA passthrough will be cleanly cut off.",
-      "Runs <code>apt purge</code> on <code>nvidia-*</code>, <code>libnvidia-*</code>, <code>cuda-*</code> and <code>libcudnn*</code>, removes the DKMS source tree and the <code>/opt/nvidia</code> .run installer cache.",
+      "Stops and disables <code>nvidia-persistenced</code> and <code>nvidia-powerd</code>, attempts to unload <code>nvidia_uvm</code>, <code>nvidia_drm</code>, <code>nvidia_modeset</code> and <code>nvidia</code>, then runs <code>nvidia-uninstall --silent</code> for the <code>.run</code> installation. NVIDIA-dependent LXC workloads are affected; active clients can prevent unloading.",
+      "Runs <code>apt purge</code> on <code>nvidia-*</code>, <code>libnvidia-*</code>, <code>cuda-*</code> and <code>libcudnn*</code>, removes the DKMS source tree and the <code>nvidia-persistenced</code> and <code>nvidia-patch</code> folders under <code>/opt/nvidia</code>.",
       "Removes the modules-load config (<code>/etc/modules-load.d/nvidia-vfio.conf</code>) and the nouveau blacklist entries owned by ProxMenux. Legacy two-line ProxMenux blacklist files are migrated and removed too; modified or unrelated administrator files are preserved.",
       "Removes the udev rules (<code>/etc/udev/rules.d/70-nvidia.rules</code>) and clears the NVENC patch state (a field in the ProxMenux managed-installs registry, set to <em>removed</em> — no separate file to delete).",
       "Rebuilds <code>initramfs</code> for all kernels, runs <code>proxmox-boot-tool refresh</code> on systemd-boot hosts, and prompts for a reboot to finalise."
     ],
     "lxcWarnTitle": "LXC containers with NVIDIA passthrough",
-    "lxcWarnBody": "Removing the host driver invalidates the device paths and CUDA libraries mapped into any LXC with NVIDIA passthrough. Plan the operation during a maintenance window if Frigate / Plex / Jellyfin / Ollama (or anything else) depends on it."
+    "lxcWarnBody": "Removing the host driver interrupts NVIDIA-dependent LXC workloads, even when their userspace libraries remain installed. Schedule maintenance for Frigate, Plex, Jellyfin, Ollama or other apps that use the GPU."
   },
   "updates": {
     "heading": "Update notifications",
@@ -121,26 +121,26 @@
     "antiTitle": "Anti-cascade by design",
     "antiBody": "One notification per distinct upstream version, never on every 24h scan. If no newer release exists in the installed branch, the tracker stays quiet.",
     "applyTitle": "Applying the update",
-    "applyBody": "The Monitor doesn't auto-apply driver updates — reinstalling the NVIDIA driver always needs a reboot. Open the same installer entry described above, pick <strong>Reinstall / update</strong>, and the new version is downloaded, the DKMS module rebuilt against the running kernel, and the reboot prompted at the end."
+    "applyBody": "Monitor reports updates without installing them automatically. Open the installer and choose <strong>Reinstall / update</strong>, select a supported version, and complete its build and installation steps. The workflow ends with a reboot prompt; plan the restart and verify the host and LXC libraries afterwards."
   },
   "verify": {
     "heading": "Verifying the install",
     "intro": "Once the host is back up, log in over SSH or the Proxmox shell and run:",
-    "after": "You should see your GPU listed, the driver version on the top border, and no processes yet (nothing is using the GPU at this point). Then check the persistence service:",
+    "after": "Check that your GPU and the expected driver version appear. Processes may already be listed if host services or autostarted containers use the GPU. Then check the persistence service:",
     "imageAlt": "Output of nvidia-smi on the host showing the detected GPU and installed driver version"
   },
   "troubleshoot": {
     "heading": "Troubleshooting",
     "smiFailTitle": "`nvidia-smi` says 'NVIDIA-SMI has failed'",
-    "smiFailBody": "Almost always a <strong>nouveau</strong> still loaded or a <strong>kernel header mismatch</strong>. After reboot, run <code>lsmod | grep nouveau</code> — if it returns anything, check <code>/etc/modprobe.d/proxmenux-nouveau-blacklist.conf</code>, rebuild initramfs with <code>update-initramfs -u -k all</code>, and reboot. If nouveau is gone, check <code>dmesg | grep -i nvidia</code> — DKMS build errors usually mean the headers do not match the running kernel.",
+    "smiFailBody": "Possible causes include <strong>nouveau</strong> claiming the GPU, <strong>missing or mismatched kernel headers</strong>, incompatible driver sources or other module-load errors. Inspect <code>lsmod | grep nouveau</code> and <code>dmesg | grep -i nvidia</code>, plus the installer/DKMS logs. If nouveau policy needs fixing, check <code>/etc/modprobe.d/proxmenux-nouveau-blacklist.conf</code> before rebuilding with <code>update-initramfs -u -k all</code> and rebooting. Do not assume every build error is a header mismatch.",
     "lxcMissTitle": "LXC container can't see the GPU after host update",
-    "lxcMissBody": "The container's userspace libraries are stuck at the previous driver version. Either re-run the NVIDIA installer and accept the LXC propagation prompt, or install the same driver version manually inside the container with <code>--no-kernel-modules</code>.",
+    "lxcMissBody": "Check host device nodes, LXC permissions and the driver-library version before reinstalling. A version mismatch can require the matching userspace driver inside the LXC, using the supported distro path; on glibc systems the installer uses <code>--no-kernel-modules</code>. Reinstalling libraries will not repair missing device mounts or permissions.",
     "logTitle": "Check the install log",
     "logBody": "Every install writes to <code>/tmp/nvidia_install.log</code>. If something fails silently, that file has the full output (downloads, DKMS build, service installs). Attach it when reporting issues on GitHub."
   },
   "manualSteps": {
     "heading": "Looking for the manual steps?",
-    "body": "The original community guide — installing everything by hand with <code>wget</code> and <code>./NVIDIA-Linux-...run</code> — is still available as a reference under <guideLink>Guides → NVIDIA</guideLink>. It's useful if you want to understand every command the ProxMenux installer runs, or if you're troubleshooting an unusual setup. For day-to-day installs, use ProxMenux — it's the path that keeps receiving fixes (kernel compatibility, LXC propagation, VFIO safety checks)."
+    "body": "See <guideLink>Guides → NVIDIA</guideLink> for manual background, including <code>wget</code> and <code>./NVIDIA-Linux-...run</code>. It explains the components but is not an exact transcript of the automated installer. Use the maintained ProxMenux workflow for its GPU filtering, build checks, LXC updates and VFIO checks."
   },
   "related": {
     "heading": "Related",
diff --git a/web/messages/en/docs/hardware/switch-gpu-mode.json b/web/messages/en/docs/hardware/switch-gpu-mode.json
index ec555f1f..03e047e8 100644
--- a/web/messages/en/docs/hardware/switch-gpu-mode.json
+++ b/web/messages/en/docs/hardware/switch-gpu-mode.json
@@ -5,7 +5,7 @@
   },
   "header": {
     "title": "Switch GPU Mode (VM ↔ LXC)",
-    "description": "Reassign a GPU that's already in use — flip it from VM passthrough to LXC sharing or the other way round. ProxMenux handles all the host-side binding changes (vfio.conf, driver blacklist, modules, initramfs) and offers a clean policy for every VM or LXC currently using the GPU, so the switch doesn't leave broken config behind.",
+    "description": "Move an assigned GPU between VM passthrough and LXC sharing. ProxMenux manages the host driver binding, VFIO configuration, module settings and initramfs, and asks how to handle affected guests. Review those choices and verify the resulting configuration after reboot.",
     "section": "Hardware: GPUs and Coral-TPU"
   },
   "intro": {
@@ -42,21 +42,21 @@
       },
       {
         "situation": "I just want to completely unbind a GPU from everything.",
-        "use": "Yes — pick the LXC-mode target and then detach manually."
+        "use": "LXC mode restores host-driver ownership; the VM conflict policy can remove hostpci entries, but LXC device entries must be removed separately. This does not leave the GPU unbound from every driver."
       }
     ]
   },
   "prereqs": {
     "title": "Before you start",
     "assigned": "<strong>A GPU already assigned</strong> — either in a VM via VFIO or attached to at least one LXC. If you haven't assigned it yet, start from Add GPU to VM / LXC instead.",
-    "iommu": "<strong>IOMMU enabled on the host</strong> — only strictly required when switching <em>to</em> VM mode, but worth having on either way. If the kernel param is missing the script auto-adds <code>intel_iommu=on iommu=pt</code> or <code>amd_iommu=on</code> to the boot command line (via <code>proxmox-boot-tool refresh</code> on systemd-boot or <code>update-grub</code> on GRUB) and includes it in the reboot prompt at the end.",
+    "iommu": "<strong>IOMMU must be active on the host</strong> when switching <em>to</em> VM mode. Firmware settings and kernel support both matter. If <code>intel_iommu=on</code> or <code>amd_iommu=on</code> is missing from the running kernel, the script adds it with <code>iommu=pt</code> to <code>/etc/kernel/cmdline</code> (ZFS-root marker) or <code>/etc/default/grub</code>, then runs <code>proxmox-boot-tool refresh</code> or <code>update-grub</code>. Check any warnings and reboot when prompted.",
     "iommuCheck": "dmesg | grep -i 'IOMMU enabled' | head -1",
-    "reboot": "<strong>Be OK with a reboot.</strong> Switching GPU bindings at the kernel level means the host regenerates initramfs and you reboot to apply. The script prompts at the end.",
+    "reboot": "<strong>Plan for a reboot.</strong> Persistent driver and boot changes may require rebuilding initramfs and rebooting. The script presents a reboot prompt at the end.",
     "knowList": "<strong>Know which VMs / LXCs are using the GPU.</strong> The script will find them and ask what to do with each, but it's faster if you already know the list."
   },
   "blocklist": {
     "title": "Not all GPUs are safe to pass to a VM",
-    "body": "A small blocklist of GPU IDs is refused for VM mode due to known passthrough instability (e.g. Intel Arc A770 <code>8086:5a84</code> / <code>8086:5a85</code>). If the selected GPU matches, the script explains why and exits. Switching <em>to</em> LXC mode is always allowed."
+    "body": "The script blocks VM mode for device IDs <code>8086:5a84</code> and <code>8086:5a85</code> under its compatibility policy. If a selected GPU matches, it stops the VM-mode switch and returns to GPU selection, or exits when it is the only GPU. This blocklist does not prevent switching <em>to</em> LXC mode; other checks can still apply."
   },
   "running": {
     "heading": "Running the script",
@@ -65,7 +65,7 @@
   },
   "howRuns": {
     "heading": "How the script runs",
-    "body": "Two phases as usual: everything is collected and validated first, nothing is applied until you confirm at the end."
+    "body": "GPU selection and direction are reviewed before the main switch. A separate stale-VFIO cleanup can ask for confirmation earlier, and affected guests have their own conflict prompts. Read each confirmation: there is not one final confirmation covering every possible change."
   },
   "walkthrough": {
     "heading": "Walking through the flow",
@@ -85,27 +85,27 @@
       "intro": "Based on the current mode, the script proposes the opposite as target:",
       "items": [
         "<strong>VM → LXC:</strong> unbind from <code>vfio-pci</code>, let the native driver (<code>nvidia</code>, <code>amdgpu</code>, <code>i915</code>) reclaim the card so LXCs can share it. On NVIDIA, the per-BDF entry is removed from <code>/etc/udev/rules.d/10-proxmenux-vfio-bind.rules</code> so the nvidia module reclaims the GPU after reboot.",
-        "<strong>LXC → VM:</strong> bind to <code>vfio-pci</code> so the card is free for VFIO passthrough to a single VM. On AMD / Intel this means blacklisting the native driver and setting <code>options vfio-pci ids=…</code>. On NVIDIA the <code>nvidia</code> module is <strong>not</strong> blacklisted — instead a per-BDF udev rule applies <code>driver_override=vfio-pci</code> only to the GPUs you select, so other NVIDIA GPUs on the host keep their <code>nvidia</code> driver."
+        "<strong>LXC → VM:</strong> prepares <code>vfio-pci</code> ownership. AMD / Intel use native-driver blacklisting and <code>options vfio-pci ids=…</code>. For NVIDIA, <code>nvidia</code> is globally blacklisted only when every host NVIDIA GPU is in VFIO; otherwise per-BDF rules set <code>driver_override=vfio-pci</code> for the affected IOMMU-group devices, and NVIDIA GPUs outside those groups keep <code>nvidia</code>. Review every group member before switching."
       ],
       "outro": "Confirm the direction or cancel."
     },
     "conflict": {
       "title": "Conflict policy per affected workload",
-      "body": "The script scans every <code>/etc/pve/lxc/*.conf</code> and <code>/etc/pve/qemu-server/*.conf</code> looking for references to the GPU's PCI slot. For each affected workload you pick a policy:",
+      "body": "The script checks <code>/etc/pve/lxc/*.conf</code> for GPU-device references by driver family, and <code>/etc/pve/qemu-server/*.conf</code> for PCI assignments. LXC detection is not a precise per-card BDF match. Review the detected guests and choose how to handle each:",
       "headerPolicy": "Policy",
       "headerEffect": "Effect",
       "headerWhen": "When to pick",
       "keepPolicy": "Keep config, disable onboot",
-      "keepEffect": "<code>pct set -onboot 0</code> (or <code>qm set</code>). GPU lines stay in the config.",
+      "keepEffect": "<code>pct set CTID -onboot 0</code> (or <code>qm set VMID -onboot 0</code>). GPU entries stay in the configuration.",
       "keepWhen": "You plan to come back to this VM/LXC once the GPU is back in its original mode. Safe default.",
       "removePolicy": "Remove GPU from config",
-      "removeEffect": "<code>hostpci</code> / <code>dev</code> lines for this GPU's slot are sed'd out.",
-      "removeWhen": "The VM/LXC will keep running without the GPU (CPU-only transcoding, etc.). Clean workflow.",
+      "removeEffect": "Removes identified <code>hostpci</code> / <code>dev</code> entries and supported legacy device references.",
+      "removeWhen": "Choose this if the guest should operate without the GPU. Check its application settings first: CPU fallback is application-dependent, and removing the device does not automatically reconfigure the app.",
       "imageAlt": "Dialog asking per-VM / per-LXC conflict policy when switching a GPU that's currently assigned"
     },
     "audio": {
       "title": "Orphan audio cleanup (only when leaving VM mode)",
-      "body1": "dGPUs (NVIDIA / AMD) ship with an HDMI audio function at <code>.1</code> of the same slot, and sometimes extra audio controllers are attached alongside the GPU. When the GPU leaves the VM, those audio lines become orphans — the VM has <code>hostpci</code> entries pointing to audio devices that aren't going with the GPU.",
+      "body1": "Many dedicated NVIDIA / AMD GPUs expose HDMI audio at function <code>.1</code> of the same slot; additional audio devices may also have been assigned. Removing the GPU can leave obsolete <code>hostpci</code> audio entries in the VM. Review which devices should remain assigned.",
       "body2": "The script discovers them (precise BDF match, no substring false-positives) and shows a checklist so you can remove them cleanly. It also cleans their vendor:device IDs from <code>/etc/modprobe.d/vfio.conf</code> — but only if no other VM still uses those audio IDs."
     },
     "apply": {
@@ -119,9 +119,9 @@
     }
   },
   "manual": {
-    "heading": "Manual equivalent",
-    "intro": "If you want to understand exactly what the script does (or troubleshoot one of the steps by hand), these are the raw operations for <strong>VM → LXC</strong> on an NVIDIA card with vendor:device <code>10de:2204</code>:",
-    "lxcToVm": "And for <strong>LXC → VM</strong>:",
+    "heading": "Manual inspection",
+    "intro": "Before a <strong>VM → LXC</strong> switch, inspect the driver and existing per-BDF policy. This NVIDIA example uses vendor:device <code>10de:2204</code>; adapt it to your card. These commands inspect state; the script also manages affected guests and IOMMU-group members.",
+    "lxcToVm": "Before <strong>LXC → VM</strong>, inspect the selected PCI address and its IOMMU group. Replace the example address with yours and review all group members before assigning devices.",
     "oneVmTitle": "Only one VM can use a given vfio-pci GPU at a time",
     "oneVmBody": "Putting multiple <code>hostpci</code> entries with the same PCI slot in two VMs is valid config but only one of the VMs can start with the GPU — the second one will fail. The ProxMenux conflict policy step is exactly about avoiding this trap."
   },
@@ -131,11 +131,11 @@
   "troubleshoot": {
     "heading": "Troubleshooting",
     "stillVfioTitle": "GPU still shows vfio-pci after switching to LXC mode",
-    "stillVfioBody": "<code>update-initramfs</code> didn't run (or the reboot didn't actually happen). Check <code>lsmod | grep vfio</code> — if vfio-pci is loaded, rerun <code>update-initramfs -u -k all</code> and reboot. For AMD/Intel: verify <code>vfio.conf</code> no longer contains the GPU's vendor:device ID. For NVIDIA: verify the BDF is no longer in <code>/etc/proxmenux/vfio-bind.bdfs</code> and that <code>/etc/udev/rules.d/10-proxmenux-vfio-bind.rules</code> doesn't list it.",
+    "stillVfioBody": "A loaded VFIO module does not prove which driver owns this GPU. Check the card binding and whether <code>update-initramfs</code> and the reboot completed. <code>lsmod | grep vfio</code> only lists modules. For AMD / Intel inspect <code>vfio.conf</code>; for NVIDIA inspect <code>/etc/proxmenux/vfio-bind.bdfs</code> and <code>/etc/udev/rules.d/10-proxmenux-vfio-bind.rules</code>. Correct stale policy before running <code>update-initramfs -u -k all</code> and rebooting.",
     "vmFailTitle": "A VM won't start after switching a GPU to LXC mode",
-    "vmFailBody": "The VM still has <code>hostpci</code> entries pointing to a GPU it can't claim. Run the script again and pick the <em>Remove GPU from config</em> policy, or clean the config by hand:",
+    "vmFailBody": "Check whether the VM still has obsolete <code>hostpci</code> references. The <em>Remove GPU from config</em> policy can remove them during the intended switch; inspect the proposed direction before rerunning the script so you do not reverse the mode unintentionally. Alternatively, remove the obsolete assignment in Proxmox with the VM stopped.",
     "smiFailTitle": "nvidia-smi fails with 'Driver/library version mismatch' after going back to LXC",
-    "smiFailBody": "Host NVIDIA modules didn't reload cleanly. <code>modprobe -r nvidia</code> then <code>modprobe nvidia</code>. If that fails, reboot — a full reboot always clears residual state from the vfio binding.",
+    "smiFailBody": "Compare the loaded host NVIDIA module with the installed userspace libraries, including those in LXCs. Align versions first; a reboot loads the installed module but cannot repair mismatched library packages. Reloading with <code>modprobe -r nvidia</code> and <code>modprobe nvidia</code> requires stopped GPU clients and may fail while dependent modules are in use.",
     "logTitle": "Install log",
     "logBody": "Every run writes to <code>/tmp/proxmenux_gpu_switch_mode.log</code> on the host. Attach it when asking for help on GitHub."
   },
diff --git a/web/messages/en/docs/help-info/backup-commands.json b/web/messages/en/docs/help-info/backup-commands.json
index eb98a21e..6fe17d7b 100644
--- a/web/messages/en/docs/help-info/backup-commands.json
+++ b/web/messages/en/docs/help-info/backup-commands.json
@@ -14,7 +14,7 @@
   },
   "intro": {
     "title": "Three backup modes",
-    "body": "<strong>snapshot</strong> uses a live snapshot — guest stays running, briefly pauses I/O. <strong>suspend</strong> freezes the VM during backup (safer than snapshot for non-snapshot-aware FS). <strong>stop</strong> shuts down the VM, backs up cold, restarts. Pick by guest tolerance and storage capability."
+    "body": "For VMs, <strong>snapshot</strong> is a live backup and does not require storage snapshots. <strong>suspend</strong> pauses the VM before the live backup and does not necessarily improve consistency. <strong>stop</strong> shuts the VM down first; a previously running VM can resume once backup has started. LXC differs: snapshot mode requires snapshot-capable storage, suspend uses two rsync passes, and stop keeps the container stopped during backup."
   },
   "commandGroups": [
     {
@@ -34,18 +34,18 @@
         },
         {
           "command": "vzdump <vmid> --mode suspend",
-          "description": "Suspend VM during backup"
+          "description": "Pause VM before the live backup (legacy suspend mode)"
         },
         {
           "command": "vzdump <vmid> --mode stop",
-          "description": "Stop VM during backup"
+          "description": "Shut down VM before starting the backup"
         },
         {
           "command": "vzdump --all",
           "description": "Backup all VMs and containers"
         },
         {
-          "command": "vzdump --exclude <vmid1>,<vmid2>",
+          "command": "vzdump --all --exclude <vmid1>,<vmid2>",
           "description": "Backup all except specified VMs"
         }
       ]
@@ -58,11 +58,11 @@
           "description": "Use zstd compression for backup"
         },
         {
-          "command": "vzdump <vmid> --pigz <threads>",
+          "command": "vzdump <vmid> --compress gzip --pigz <threads>",
           "description": "Use pigz with multiple threads"
         },
         {
-          "command": "vzdump <vmid> --notes <text>",
+          "command": "vzdump <vmid> --storage <storage> --notes-template <text>",
           "description": "Add notes to backup"
         },
         {
@@ -70,7 +70,7 @@
           "description": "Send notification email"
         },
         {
-          "command": "vzdump <vmid> --maxfiles <n>",
+          "command": "vzdump <vmid> --prune-backups keep-last=<n>",
           "description": "Keep only n backups per VM"
         },
         {
@@ -96,7 +96,7 @@
         },
         {
           "command": "qmrestore <backup-file> <vmid> --unique",
-          "description": "Create a VM with unique ID"
+          "description": "Restore VM with newly generated random MAC addresses"
         },
         {
           "command": "pct restore <vmid> <backup-file>",
@@ -107,8 +107,8 @@
           "description": "Restore container to specific storage"
         },
         {
-          "command": "pct restore <vmid> <backup-file> --rootfs <storage>",
-          "description": "Restore to specific rootfs"
+          "command": "pct restore <vmid> <backup-file> --rootfs <storage>:<size-GiB>",
+          "description": "Restore with a root disk allocated on the chosen storage and size"
         },
         {
           "command": "pct restore <vmid> <backup-file> --unprivileged 1",
@@ -132,7 +132,7 @@
           "description": "Find container backups"
         },
         {
-          "command": "pvesm list <storage>",
+          "command": "pvesm list <storage> --content backup",
           "description": "List backups in specific storage"
         },
         {
@@ -149,7 +149,7 @@
       "title": "Scheduled Backups",
       "commands": [
         {
-          "command": "cat /etc/cron.d/vzdump",
+          "command": "cat /etc/pve/jobs.cfg",
           "description": "Show backup schedule"
         },
         {
@@ -158,19 +158,19 @@
         },
         {
           "command": "systemctl list-timers",
-          "description": "List all scheduled tasks"
+          "description": "List systemd timers"
         },
         {
           "command": "systemctl status cron",
           "description": "Check cron service status"
         },
         {
-          "command": "grep vzdump /var/log/syslog",
-          "description": "Check backup logs in syslog"
+          "command": "pvenode task list --typefilter vzdump",
+          "description": "List completed backup tasks"
         },
         {
-          "command": "tail -f /var/log/vzdump.log",
-          "description": "Monitor backup log in real-time"
+          "command": "pvenode task log <upid>",
+          "description": "Show the log for a backup task UPID"
         }
       ]
     },
@@ -202,15 +202,15 @@
           "description": "Wait for lock"
         },
         {
-          "command": "qm importdisk <vmid> <backup> <storage>",
-          "description": "Import disk from backup"
+          "command": "qm importdisk <vmid> <disk-image> <storage>",
+          "description": "Import a disk image file (for example raw, qcow2 or vmdk) as an unused disk, not a vzdump backup archive"
         }
       ]
     }
   ],
   "testRestores": {
     "title": "Test your restores",
-    "bodyRich": "A backup you've never restored isn't a backup. Periodically pick a backup, restore it to a test VMID with <code>qmrestore --unique</code>, boot the resulting VM and confirm the contents are intact. Same idea for containers via <code>pct restore</code>."
+    "bodyRich": "Periodically restore a backup to an unused test VMID with <code>qmrestore --unique</code>, start the VM on an isolated test network and check its contents. The unique option generates new MAC addresses; it does not change static IPs or application settings. Test container restores with <code>pct restore</code> in the same way."
   },
   "related": {
     "heading": "Related",
diff --git a/web/messages/en/docs/help-info/gpu-commands.json b/web/messages/en/docs/help-info/gpu-commands.json
index 5cc7a967..edf02db6 100644
--- a/web/messages/en/docs/help-info/gpu-commands.json
+++ b/web/messages/en/docs/help-info/gpu-commands.json
@@ -14,7 +14,7 @@
   },
   "intro": {
     "title": "IOMMU must be enabled in BIOS / UEFI",
-    "body": "Before any of these commands matter, IOMMU has to be enabled at the firmware level (look for <em>VT-d</em>, <em>AMD-Vi</em> or <em>IOMMU</em> in BIOS / UEFI). Common GRUB parameters to enable it on the Linux side: <code>intel_iommu=on</code> (Intel) or <code>amd_iommu=on</code> (AMD), often combined with <code>iommu=pt video=efifb:off video=vesa:off</code>."
+    "body": "Enable IOMMU in firmware first: look for <em>VT-d</em>, <em>AMD-Vi</em> or <em>IOMMU</em> in BIOS/UEFI. AMD enables IOMMU by default on the Linux side, as do Intel systems with Proxmox kernels 6.8 and newer. Older Intel kernels may need <code>intel_iommu=on</code>. The optional <code>iommu=pt</code> setting controls IOMMU passthrough mode; it is not a reason to disable the host framebuffer indiscriminately."
   },
   "commandGroups": [
     {
@@ -130,14 +130,14 @@
         },
         {
           "command": "qm set <vmid> -bios ovmf",
-          "description": "Set VM to use UEFI/OVMF (required for GPU passthrough)"
+          "description": "Set VM to UEFI/OVMF (recommended when the GPU ROM supports UEFI)"
         }
       ]
     }
   ],
   "afterChangesTip": {
     "title": "After changing GRUB or modprobe configs",
-    "bodyRich": "Run <code>update-grub</code> + <code>update-initramfs -u</code>, then reboot. Verify with <code>cat /proc/cmdline</code> (kernel parameters), <code>dmesg | grep -i iommu</code> (IOMMU initialised) and <code>find /sys/kernel/iommu_groups/ -type l | sort -V</code> (groups present)."
+    "bodyRich": "On hosts using GRUB, apply boot-option changes with <code>update-grub</code>. Refresh module changes with <code>update-initramfs -u -k all</code>, then reboot. Other bootloaders require their own configuration procedure. Verify with <code>cat /proc/cmdline</code> (kernel parameters), <code>dmesg | grep -i iommu</code> (IOMMU initialised) and <code>find /sys/kernel/iommu_groups/ -type l | sort -V</code> (groups present)."
   },
   "related": {
     "heading": "Related",
@@ -150,7 +150,7 @@
       {
         "href": "/docs/hardware/igpu-acceleration-lxc",
         "label": "Add GPU to LXC",
-        "tail": " — passthrough to a container instead of a VM."
+        "tail": " — share host GPU device access with an LXC container."
       },
       {
         "href": "/docs/help-info",
diff --git a/web/messages/en/docs/help-info/network-commands.json b/web/messages/en/docs/help-info/network-commands.json
index 64c89e6d..369067be 100644
--- a/web/messages/en/docs/help-info/network-commands.json
+++ b/web/messages/en/docs/help-info/network-commands.json
@@ -149,7 +149,7 @@
   ],
   "iptablesTip": {
     "title": "iptables vs nftables",
-    "bodyRich": "Modern Debian / Proxmox uses <strong>nftables</strong> as the underlying firewall engine. The classic <code>iptables -L -n -v</code> command still works as a translation layer, but the source of truth is <code>nft list ruleset</code>. <code>pve-firewall</code> commands are Proxmox's wrapper that emits nftables rules from the cluster firewall config."
+    "bodyRich": "The classic <code>pve-firewall</code> service generates iptables rules. The alternative proxmox-firewall service uses <strong>nftables</strong>. Inspect the iptables-based backend with <code>iptables -L -n -v</code> and the nftables backend with <code>nft list ruleset</code>. Use the tools for the enabled backend; do not assume these listings are interchangeable."
   },
   "related": {
     "heading": "Related",
diff --git a/web/messages/en/docs/help-info/storage-commands.json b/web/messages/en/docs/help-info/storage-commands.json
index b7430efb..7dc1154e 100644
--- a/web/messages/en/docs/help-info/storage-commands.json
+++ b/web/messages/en/docs/help-info/storage-commands.json
@@ -14,7 +14,7 @@
   },
   "intro": {
     "title": "Quick disk inventory",
-    "body": "<code>lsblk</code> is the fastest way to see all block devices and their partitions in a tree view. For persistent identifiers (which survive between boots and hardware changes) use <code>ls -lh /dev/disk/by-id/</code>."
+    "body": "<code>lsblk</code> shows block devices and partitions in a tree. Inspect persistent identifiers with <code>ls -lh /dev/disk/by-id/</code>: these normally remain stable across reboots and device reordering for the same disk. Replacing a disk or changing the way a controller exposes its identity can change its by-id path."
   },
   "commandGroups": [
     {
@@ -104,16 +104,16 @@
           "description": "Show status of all storage pools"
         },
         {
-          "command": "pvesm list",
-          "description": "List all available storage"
+          "command": "pvesm status --enabled 1",
+          "description": "List enabled configured storage"
         },
         {
           "command": "pvesm list <storage>",
           "description": "List content of specific storage"
         },
         {
-          "command": "pvesm scan <storage>",
-          "description": "Scan storage for new content"
+          "command": "pvesm scan nfs <server>",
+          "description": "Discover NFS exports on a server"
         }
       ]
     },
@@ -122,7 +122,7 @@
       "commands": [
         {
           "command": "qm importdisk <vmid> <image_path> <storage>",
-          "description": "Attach disk image to VM"
+          "description": "Import disk image as an unused disk for the VM; attach it separately"
         },
         {
           "command": "qm set <vmid> -<bus><index> <disk_path>",
@@ -130,7 +130,7 @@
         },
         {
           "command": "qemu-img convert -O <format> <input> <output>",
-          "description": "Convert disk image format"
+          "description": "Convert an offline disk image format"
         }
       ]
     },
@@ -199,15 +199,15 @@
   ],
   "lvmTip": {
     "title": "LVM short vs long commands",
-    "bodyRich": "Both forms exist for compatibility. <code>pvs</code> / <code>vgs</code> / <code>lvs</code> give a clean single-line-per-volume table; <code>pvdisplay</code> / <code>vgdisplay</code> / <code>lvdisplay</code> give a verbose multi-line dump per volume. For day-to-day use prefer the short versions."
+    "bodyRich": "Both forms are available. <code>pvs</code> / <code>vgs</code> / <code>lvs</code> produce compact tables with one row per physical volume, volume group or logical volume respectively. <code>pvdisplay</code> / <code>vgdisplay</code> / <code>lvdisplay</code> provide more detailed multi-line output. The short forms are convenient for everyday checks."
   },
   "smartInfo": {
-    "title": "SMART for spinning disks vs NVMe",
-    "bodyRich": "<strong>Spinning / SATA / SAS disks</strong> use the <code>smartctl</code> family from <code>smartmontools</code> (installed by default on Proxmox). Pass the device as <code>/dev/sda</code>, <code>/dev/sdb</code>, etc. <strong>NVMe disks</strong> have their own native protocol — <code>smartctl</code> works against them (passes most data through), but the <code>nvme</code> tool from <code>nvme-cli</code> reports more NVMe-specific fields (wear levelling, media errors, namespace info). Install with <code>apt install nvme-cli</code> if not present."
+    "title": "SMART for SATA/SAS vs NVMe",
+    "bodyRich": "<strong>SATA / SAS disks, including SSDs,</strong> can be inspected with <code>smartctl</code> from <code>smartmontools</code> (installed by default on Proxmox). Specify the device, for example <code>/dev/sda</code> or <code>/dev/sdb</code>. <strong>NVMe disks</strong> use a different native protocol. <code>smartctl</code> also supports them, while <code>nvme</code> from <code>nvme-cli</code> provides NVMe-specific controller, namespace and health queries. Install it with <code>apt install nvme-cli</code> if absent."
   },
   "selfTestWarn": {
     "title": "Self-tests run in the background",
-    "bodyRich": "<code>smartctl -t short</code> and <code>-t long</code> return immediately — the disk runs the test on its own. Check progress with <code>smartctl -a /dev/&lt;disk&gt;</code> (look for the \"Self-test routine in progress\" line) or wait for completion and read <code>smartctl -l selftest /dev/&lt;disk&gt;</code>. Short tests take ~2 min; long tests can take hours on large spinners. The disk stays usable during the test, but I/O performance drops."
+    "bodyRich": "On supported drives, <code>smartctl -t short /dev/&lt;disk&gt;</code> and <code>smartctl -t long /dev/&lt;disk&gt;</code> start background tests and return immediately. Check progress with <code>smartctl -a /dev/&lt;disk&gt;</code> (look for \"Self-test routine in progress\") or wait and read <code>smartctl -l selftest /dev/&lt;disk&gt;</code>. Short tests commonly take about two minutes; long tests can take hours. The disk remains usable, but testing can reduce I/O performance."
   },
   "related": {
     "heading": "Related",
diff --git a/web/messages/en/docs/help-info/system-commands.json b/web/messages/en/docs/help-info/system-commands.json
index 7864a4cb..009b7faf 100644
--- a/web/messages/en/docs/help-info/system-commands.json
+++ b/web/messages/en/docs/help-info/system-commands.json
@@ -1,15 +1,15 @@
 {
   "meta": {
     "title": "Proxmox VE System Commands — pveversion, uptime, journalctl, systemctl | ProxMenux",
-    "description": "Reference of essential Proxmox VE and Linux system commands: pveversion, pveperf, uptime, journalctl, systemctl, lscpu, lsblk, df, free, last, who. All read-only and safe to run on any host.",
+    "description": "Proxmox VE and Linux system commands for versions, uptime, memory, services, logs and users, plus auditing and summary tools. Includes a service restart command; not every example is read-only.",
     "ogTitle": "Proxmox VE System Commands — pveversion, uptime, journalctl, systemctl",
-    "ogDescription": "Reference of essential Proxmox VE and Linux system commands — version, uptime, services, logs, user info, hardware probes. All read-only.",
+    "ogDescription": "Proxmox VE and Linux system commands for version, uptime, services, logs and user information, including service management and auditing tools.",
     "twitterTitle": "Proxmox VE System Commands | ProxMenux",
     "twitterDescription": "Essential system inspection commands for Proxmox VE — version, status, services, logs, user info."
   },
   "header": {
     "title": "Useful System Commands",
-    "description": "Read-only commands to look at the Proxmox host: version, kernel, uptime, memory, web UI status, recent log lines, who's logged in, and a couple of audit / summary tools. None of them modifies the system.",
+    "description": "Commands for inspecting the Proxmox host: version, kernel, uptime, memory, web UI status, recent logs and logged-in users, plus auditing and summary tools. Most inspect state, but systemctl restart pveproxy restarts the web UI proxy, and audit tools can write reports and logs.",
     "section": "Help and Info"
   },
   "intro": {
diff --git a/web/messages/en/docs/help-info/tools-commands.json b/web/messages/en/docs/help-info/tools-commands.json
index fa44a689..c59f531f 100644
--- a/web/messages/en/docs/help-info/tools-commands.json
+++ b/web/messages/en/docs/help-info/tools-commands.json
@@ -251,7 +251,7 @@
   ],
   "tmuxTip": {
     "title": "Use tmux / screen for long-running commands",
-    "bodyRich": "Anything that takes longer than a coffee break — a backup, a long upgrade, a big rsync — should run inside <code>tmux</code> or <code>screen</code>. SSH disconnects don't kill the session, and you can re-attach from anywhere with <code>tmux attach</code>."
+    "bodyRich": "Long-running work — a backup, a lengthy upgrade or a large rsync transfer — should run inside <code>tmux</code> or <code>screen</code> so an SSH disconnect does not end the terminal session. For a tmux session, reconnect to the same host as the same user and run <code>tmux attach</code>. Screen sessions use their own reattachment command."
   },
   "related": {
     "heading": "Related",
diff --git a/web/messages/en/docs/help-info/update-commands.json b/web/messages/en/docs/help-info/update-commands.json
index 06c13f20..8602b7e6 100644
--- a/web/messages/en/docs/help-info/update-commands.json
+++ b/web/messages/en/docs/help-info/update-commands.json
@@ -22,7 +22,7 @@
       "commands": [
         {
           "command": "apt update && apt upgrade -y",
-          "description": "Update and upgrade all system packages"
+          "description": "Refresh package lists and upgrade installed packages (apt upgrade)"
         },
         {
           "command": "apt dist-upgrade -y",
@@ -51,15 +51,15 @@
         },
         {
           "command": "pveupgrade",
-          "description": "Show available Proxmox upgrades"
+          "description": "Start the interactive Proxmox package upgrade"
         },
         {
-          "command": "pve-upgrade",
-          "description": "Perform Proxmox VE upgrade"
+          "command": "pve8to9 --full",
+          "description": "Check readiness for the PVE 8 to 9 upgrade (does not perform it)"
         },
         {
-          "command": "pveceph upgrade",
-          "description": "Upgrade Ceph packages (if Ceph is installed)"
+          "command": "ceph versions",
+          "description": "Show Ceph daemon versions before planning a Ceph upgrade"
         }
       ]
     },
@@ -134,18 +134,18 @@
         },
         {
           "command": "cat /etc/apt/sources.list.d/pve-enterprise.list",
-          "description": "Show Proxmox Enterprise repo config"
+          "description": "Show Proxmox Enterprise repository configuration in the PVE 8 .list file"
         },
         {
           "command": "apt-key list",
-          "description": "List repository signing keys"
+          "description": "List legacy repository signing keys where apt-key is available"
         }
       ]
     }
   ],
   "backupWarn": {
     "title": "Take a backup before major upgrades",
-    "bodyRich": "For point releases (8.4.1 → 8.4.5) the standard <code>apt update &amp;&amp; apt upgrade</code> is safe. For <strong>major version upgrades</strong> (PVE 8 → 9) use the dedicated ProxMenux flow: <upgradeLink>Upgrade PVE 8 to PVE 9</upgradeLink> — it adds pre-flight checks, repository migration and post-upgrade validation."
+    "bodyRich": "For routine updates, Proxmox recommends <code>apt update &amp;&amp; apt full-upgrade</code>; review the proposed package changes before confirming. For <strong>major version upgrades</strong> (PVE 8 → 9), use the dedicated ProxMenux flow: <upgradeLink>Upgrade PVE 8 to PVE 9</upgradeLink>. It adds readiness checks, repository migration and post-upgrade validation. Back up first."
   },
   "related": {
     "heading": "Related",
diff --git a/web/messages/en/docs/help-info/vm-ct-commands.json b/web/messages/en/docs/help-info/vm-ct-commands.json
index 3c2e15c1..d8a5dce5 100644
--- a/web/messages/en/docs/help-info/vm-ct-commands.json
+++ b/web/messages/en/docs/help-info/vm-ct-commands.json
@@ -116,7 +116,7 @@
           "description": "Gracefully shutdown a container"
         },
         {
-          "command": "pct restart <ctid>",
+          "command": "pct reboot <ctid>",
           "description": "Restart a container"
         },
         {
@@ -153,11 +153,11 @@
   ],
   "destroyWarn": {
     "title": "Destroy is irreversible",
-    "bodyRich": "<code>qm destroy</code> and <code>pct destroy</code> delete the VM / CT and all its disks. There is no confirmation prompt by default. Take a backup first if there's any chance you might want the data back — see <backupLink>Backup and Restore</backupLink>."
+    "bodyRich": "<code>qm destroy</code> and <code>pct destroy</code> remove the guest configuration and its managed disk volumes. Do not assume that external or bind-mounted data is deleted. The CLI has no confirmation prompt by default. Back up any data you may need before running it; see <backupLink>Backup and Restore</backupLink>."
   },
   "qmConfigTip": {
     "title": "qm config vs editing the .conf file directly",
-    "bodyRich": "<code>qm config &lt;vmid&gt;</code> and <code>pct config &lt;ctid&gt;</code> read the file through Proxmox's own parser — output is normalised, comments stripped, pending changes shown separately. Editing <code>/etc/pve/qemu-server/&lt;vmid&gt;.conf</code> or <code>/etc/pve/lxc/&lt;ctid&gt;.conf</code> directly bypasses the parser. Useful for fixing a corrupted config or applying a setting <code>qm set</code> won't accept, but stop the guest first to avoid races. The cluster filesystem (<code>pmxcfs</code>) takes care of propagating the change to other nodes."
+    "bodyRich": "<code>qm config &lt;vmid&gt;</code> and <code>pct config &lt;ctid&gt;</code> display configuration through Proxmox’s parsers. For normal changes, prefer <code>qm set</code> or the corresponding pct setter. Direct edits to <code>/etc/pve/qemu-server/&lt;vmid&gt;.conf</code> or <code>/etc/pve/lxc/&lt;ctid&gt;.conf</code> bypass the validation and locking in management commands; the file must still remain parseable. Stop the guest and keep a copy before manual repair. <code>pmxcfs</code> synchronises configuration across cluster nodes, not guest disk contents."
   },
   "related": {
     "heading": "Related",
diff --git a/web/messages/en/docs/help-info/zfs-commands.json b/web/messages/en/docs/help-info/zfs-commands.json
index 980ba092..5a580115 100644
--- a/web/messages/en/docs/help-info/zfs-commands.json
+++ b/web/messages/en/docs/help-info/zfs-commands.json
@@ -202,7 +202,7 @@
   ],
   "bestPractices": {
     "title": "Operational best practices",
-    "bodyRich": "Run <code>zpool scrub</code> weekly or monthly to detect silent corruption. Keep at least 10-15% of pool space free — ZFS performance degrades sharply over 80% full. Always replace failed devices with <code>zpool replace</code> (in-place) rather than detach + add (which loses redundancy temporarily)."
+    "bodyRich": "Schedule <code>zpool scrub</code> regularly to verify checksums and inspect its results. Keep free capacity: the impact of a nearly full pool depends on workload and layout. Use <code>zpool replace</code> for a failed device and follow the procedure for its vdev type. Detach + add is not an equivalent replacement procedure and can alter topology or remove redundancy."
   },
   "related": {
     "heading": "Related",
diff --git a/web/messages/en/docs/installation.json b/web/messages/en/docs/installation.json
index 6d90772f..b633ad91 100644
--- a/web/messages/en/docs/installation.json
+++ b/web/messages/en/docs/installation.json
@@ -1,7 +1,7 @@
 {
   "meta": {
     "title": "Installing ProxMenux | ProxMenux Documentation",
-    "description": "One-line installer for ProxMenux on Proxmox VE 8+ hosts. Ships pre-generated translation files for six languages (English, Spanish, French, German, Italian, Portuguese) — the language is picked once during installation. Beta channel also available for early access to new features.",
+    "description": "One-command installer for ProxMenux on Proxmox VE 8+ hosts. Includes pre-generated JSON catalogs for eight languages: English, Spanish, French, German, Italian, Portuguese, Slovak and Swedish. Choose a language during installation or change it later in Settings. A beta channel provides early access to new features.",
     "ogTitle": "Installing ProxMenux | ProxMenux Documentation",
     "ogDescription": "Install ProxMenux on Proxmox VE 8+ in one command. Stable and beta channels available."
   },
@@ -61,12 +61,12 @@
   },
   "uninstall": {
     "heading": "Uninstalling",
-    "body": "From inside ProxMenux: <strong>Settings → Uninstall ProxMenux</strong>. Removes the script tree, launcher and Monitor service, optionally removes selected dependencies, restores <code>/root/.bashrc</code> and <code>/etc/motd</code> backups taken at install time. Full step-by-step: <uninstalllink>Uninstall ProxMenux</uninstalllink>."
+    "body": "From inside ProxMenux: <strong>Settings → Uninstall ProxMenux</strong>. Removes the script tree, launcher and Monitor service, optionally removes selected dependencies, and restores <code>/root/.bashrc</code> and <code>/etc/motd</code> from the backups created by Post-Install, if they exist (otherwise it removes the ProxMenux MOTD line). Full step-by-step: <uninstalllink>Uninstall ProxMenux</uninstalllink>."
   },
   "troubleshoot": {
     "heading": "Troubleshooting",
     "virustotalTitle": "VirusTotal flags the install URL",
-    "virustotalBody": "A 1/95 detection by heuristic engines (e.g. <em>Chong Lua Dao</em>) is a known false positive. The installer uses the standard <code>curl | bash</code> pattern and downloads legitimate binaries (like <code>jq</code> from its official GitHub release), which aggressive scanners flag based on <em>behaviour</em> rather than actual malicious code. The installer is 100% open source and reviewable. More context in <issuelink>Issue #162</issuelink>.",
+    "virustotalBody": "The 1/95 result from <em>Chong Lua Dao</em> reported in Issue #162 was identified by the maintainer as a false positive. The installer is run with a command that downloads and executes the script (<code>bash -c \"$(wget -qLO - …)\"</code>) and can download <code>jq</code> from its official GitHub release. This <em>behaviour</em> can trigger heuristic scanners. That historical report does not assess every future download. The installer is open source and reviewable. More context in <issuelink>Issue #162</issuelink>.",
     "aptTitle": "Install fails with apt errors",
     "aptBody": "Usually a missing or misconfigured Proxmox repo. The installer pulls dependencies via apt; if the repo config is broken (often the case on bare-bones Proxmox 8 installs that haven't been updated yet), apt fails. Run <code>apt-get update</code> manually first and resolve any errors, then re-run the installer.",
     "menuTitle": "`menu: command not found` after install",
diff --git a/web/messages/en/docs/introduction.json b/web/messages/en/docs/introduction.json
index 494ede57..7781d8dc 100644
--- a/web/messages/en/docs/introduction.json
+++ b/web/messages/en/docs/introduction.json
@@ -18,7 +18,7 @@
   },
   "twoProducts": {
     "heading": "Two products, one project",
-    "intro": "ProxMenux ships as two independent pieces sharing the same source tree. The installer deploys both — they live side by side on the host and don't depend on each other:",
+    "intro": "ProxMenux has two components in the same source tree. The installer deploys both on the host: Scripts provides the terminal interface, and Monitor provides the web dashboard:",
     "scripts": {
       "title": "ProxMenux Scripts",
       "body": "The original CLI/TUI you launch with <code>menu</code>. Nine functional areas covering post-install optimizations, VM and LXC creation, GPU and Coral TPU passthrough, disks, storage, network, security, utilities, plus a curated commands reference. Runs in any terminal — local, SSH or web."
@@ -113,7 +113,7 @@
       },
       {
         "title": "AI Assistant",
-        "description": "Optional rewrite of notifications in plain language. Six providers: OpenAI, Anthropic Claude, Google Gemini, Groq, OpenRouter, local Ollama. Twelve languages.",
+        "description": "Optional rewrite of notifications in plain language. Six providers: OpenAI, Anthropic Claude, Google Gemini, Groq, OpenRouter, local Ollama. Thirteen languages in the AI language selector.",
         "icon": "Sparkles",
         "href": "/docs/monitor/ai-assistant"
       },
@@ -139,24 +139,24 @@
   },
   "installPaths": {
     "heading": "Install paths",
-    "intro": "The installer deploys Scripts and Monitor in one go. Scripts has two flavours — translation or lightweight — and the Monitor is installed as a standalone AppImage you enable from the menu later:",
+    "intro": "Both installers deploy Scripts and Monitor. Scripts uses pre-generated JSON catalogs in eight languages, without online translation. Choose the stable or beta channel; Monitor is packaged as an AppImage and runs from its extracted runtime:",
     "headerPath": "Install path",
     "headerBundles": "What it bundles",
     "headerWhen": "When you'd pick it",
     "rows": [
       {
-        "pathRich": "<strong>Scripts: Translation</strong>",
-        "bundles": "CLI/TUI + Python venv + googletrans (English, Spanish, French, German, Italian, Portuguese)",
-        "when": "Multi-language menus, non-English speakers"
+        "pathRich": "<strong>Scripts: stable</strong>",
+        "bundles": "CLI/TUI with pre-generated JSON translations in eight languages; no translation venv or online translation service.",
+        "when": "Normal use with the stable release channel."
       },
       {
-        "pathRich": "<strong>Scripts: Normal (lightweight)</strong>",
-        "bundles": "CLI/TUI English-only, smaller footprint, no Python venv",
-        "when": "Most users — Proxmox docs are English anyway"
+        "pathRich": "<strong>Scripts: beta</strong>",
+        "bundles": "The same multilingual interface, installed from the develop branch for testing upcoming changes.",
+        "when": "Early testing of new features, with a greater risk of bugs."
       },
       {
         "pathRich": "<strong>Monitor</strong>",
-        "bundles": "Self-contained AppImage on TCP 8008. Independent install — can be enabled from the Scripts menu, or run the AppImage directly.",
+        "bundles": "Self-contained AppImage with a web dashboard on TCP 8008. The installer extracts its runtime and manages the service; Monitor can be controlled from Settings.",
         "when": "When a web dashboard for the host is useful — phone, tablet, browser tab"
       }
     ],
@@ -187,7 +187,7 @@
         "lead": "<strong>Want a web dashboard?</strong> ",
         "linkHref": "/docs/monitor",
         "linkLabel": "ProxMenux Monitor",
-        "tail": " covers what it shows, how it's built and how to secure it."
+        "tail": " documentation explains what it shows, how it is built and how to secure it."
       },
       {
         "lead": "<strong>Looking for a specific command?</strong> ",
diff --git a/web/messages/en/docs/network/monitoring.json b/web/messages/en/docs/network/monitoring.json
index c6e85f08..ef749366 100644
--- a/web/messages/en/docs/network/monitoring.json
+++ b/web/messages/en/docs/network/monitoring.json
@@ -7,7 +7,7 @@
   },
   "header": {
     "title": "Live monitoring tools",
-    "description": "Three interactive launchers for real-time network observation and bandwidth measurement: iftop, iptraf-ng and iperf3. Each tool is auto-installed from apt on first use, runs in the foreground, and is exited with the documented keystroke. Read-only against the host configuration — they only observe traffic.",
+    "description": "Three interactive launchers for real-time network observation and bandwidth measurement: iftop, iptraf-ng and iperf3. Each tool is auto-installed from apt on first use, runs in the foreground, and is exited with the documented keystroke. They do not change the host network configuration; iperf3 generates test traffic.",
     "section": "Network"
   },
   "intro": {
diff --git a/web/messages/en/docs/oci-manager/custom-image.json b/web/messages/en/docs/oci-manager/custom-image.json
index 7b3fc108..5ae7cb95 100644
--- a/web/messages/en/docs/oci-manager/custom-image.json
+++ b/web/messages/en/docs/oci-manager/custom-image.json
@@ -192,7 +192,7 @@
           "list": {
             "items": [
               "A Dockerfile without a published image: the image has to be built and published in an OCI registry first.",
-              "A Compose file with several services: it is blocked because it describes more than one image. This option installs a single container.",
+              "A Compose file with several services is blocked: this option installs one service in one container at a time, even when several services use the same image.",
               "<code>configs</code>, external secrets or device formats that cannot be translated unambiguously.",
               "Shell substitutions such as <code>$(command)</code>: the resulting value has to be written instead.",
               "<code>docker run</code> options that are not recognised, and <code>--env-file</code>: an explicit Compose file is read instead."
diff --git a/web/messages/en/docs/oci-manager/lifecycle.json b/web/messages/en/docs/oci-manager/lifecycle.json
index 96ccaf84..cdb3f103 100644
--- a/web/messages/en/docs/oci-manager/lifecycle.json
+++ b/web/messages/en/docs/oci-manager/lifecycle.json
@@ -215,7 +215,7 @@
     {
       "id": "restore",
       "title": "Backup, restore and another host",
-      "intro": "A backup made with vzdump or Proxmox Backup Server includes the container, its disks and the copy of its contract. What the installation keeps on the host is not part of it. <strong>Manage installed OCI applications</strong> detects the containers restored on a host that has no contract for them, a new Proxmox installation or another host, and offers to register them again.",
+      "intro": "A backup made with vzdump or Proxmox Backup Server includes the container, the container disks selected for backup and the copy of its contract. What the installation keeps on the host is not part of it. <strong>Manage installed OCI applications</strong> detects the containers restored on a host that has no contract for them, a new Proxmox installation or another host, and offers to register them again.",
       "blocks": [
         {
           "steps": {
@@ -462,7 +462,7 @@
               ],
               [
                 "Container disks",
-                "Proxmox moves them with the container. HA needs them on shared storage."
+                "Proxmox moves them with the container. HA needs their data available on the target node, through shared storage or a supported replication setup."
               ],
               [
                 "Host directories and devices",
diff --git a/web/messages/en/docs/oci-manager/storage-network.json b/web/messages/en/docs/oci-manager/storage-network.json
index 5c4fee47..4665d890 100644
--- a/web/messages/en/docs/oci-manager/storage-network.json
+++ b/web/messages/en/docs/oci-manager/storage-network.json
@@ -179,7 +179,7 @@
               ["OCI rootfs", "Yes", "The CT backup; it can also be rebuilt from the image and the contract"],
               ["Container disk with <code>backup=1</code>", "Yes", "The CT backup"],
               ["Host directory", "No", "The backup of the host storage"],
-              ["Instance contract", "No", "<code>/usr/local/share/proxmenux/oci/instances/VMID/</code> on the host"],
+              ["Instance contract", "Yes, the copy carried inside the CT", "<code>/.proxmenux/oci-record.json</code> inside the CT; additional host and cluster copies are kept separately"],
               ["Multi-container application", "Each member in its own backup", "The backups of every member, plus the stack contract and its bridge on the host"]
             ]
           }
diff --git a/web/messages/en/docs/post-install/automated.json b/web/messages/en/docs/post-install/automated.json
index e501bf05..ed1aa387 100644
--- a/web/messages/en/docs/post-install/automated.json
+++ b/web/messages/en/docs/post-install/automated.json
@@ -1,13 +1,13 @@
 {
   "meta": {
     "title": "Automated Post-Install Script | ProxMenux Documentation",
-    "description": "The ProxMenux Automated post-install script applies a curated set of 14 safe, hardware-aware optimizations to a fresh Proxmox VE host with zero prompts. Reversible configuration changes are registered for later restoration.",
+    "description": "The ProxMenux Automated post-install script runs a fixed set of 14 hardware-aware optimizations on a fresh Proxmox VE host. It has no feature-selection checklist, but the system update, banner removal, some Log2RAM installations and rebooting can ask for confirmation. Reversible configuration changes are registered for later restoration.",
     "ogTitle": "Automated Post-Install Script | ProxMenux Documentation",
-    "ogDescription": "14 curated optimizations applied to a fresh Proxmox VE host with zero prompts. Hardware-aware, with reversible configuration changes tracked."
+    "ogDescription": "14 fixed, hardware-aware optimizations for a fresh Proxmox VE host, with confirmations for some actions and reversible configuration changes tracked."
   },
   "header": {
     "title": "Automated Post-Install Script",
-    "description": "One click, zero prompts — ProxMenux applies a curated set of 14 safe optimizations that almost every Proxmox host benefits from. Reversible configuration changes are registered for Uninstall Optimizations; package upgrades are not described as reversible.",
+    "description": "ProxMenux runs a fixed set of 14 baseline optimizations without a feature-selection checklist. Some actions still ask for confirmation. Reversible configuration changes are registered for Uninstall Optimizations; package upgrades are not described as reversible.",
     "section": "Post-Install · Automated"
   },
   "intro": {
@@ -43,7 +43,7 @@
     },
     {
       "tool": "Skip language packages",
-      "what": "Writes /etc/apt/apt.conf.d/99-disable-translations to stop downloading locale-specific packages. Faster, lighter apt updates.",
+      "what": "Writes /etc/apt/apt.conf.d/99-disable-translations to stop downloading translated package-description indexes, reducing the data fetched by apt updates.",
       "category": "Basic Settings",
       "categorySlug": "basic-settings"
     },
@@ -97,7 +97,7 @@
     },
     {
       "tool": "Logrotate tuning",
-      "what": "Daily rotation with size cap 10M, 7 rotations, compression and copytruncate — Log2RAM-friendly.",
+      "what": "Sets daily and then size 10M globally, keeps 7 rotations, enables compression and copytruncate. The later size criterion takes precedence; per-log rules may override it. Suitable for Log2RAM, but rotation frequency depends on the rules and timer.",
       "category": "System",
       "categorySlug": "system"
     },
diff --git a/web/messages/en/docs/post-install/basic-settings.json b/web/messages/en/docs/post-install/basic-settings.json
index 33d0343e..8c48cb99 100644
--- a/web/messages/en/docs/post-install/basic-settings.json
+++ b/web/messages/en/docs/post-install/basic-settings.json
@@ -31,7 +31,7 @@
     ],
     "officialTitle": "The official Proxmox recommendation",
     "officialBody": "Proxmox's own upgrade guidance is to run, in this exact order:",
-    "officialOutro": "That single line is all you need on any current Proxmox release. The challenge isn't the command itself — it's making sure the repositories on the host are sane <em>before</em> running it.",
+    "officialOutro": "For routine updates within the installed Proxmox VE major version, this is the usual command. Check the host’s repositories and review the proposed package changes <em>before</em> proceeding. Upgrading to another major version requires the official migration procedure.",
     "doesTitle": "What the ProxMenux option does — verified against the script",
     "doesIntro": "The ProxMenux update wraps the exact apt commands above and adds a number of pre/post steps you would otherwise have to remember by hand. Every item below is what the dispatcher script actually does (see <link>Proxmox System Update</link> for the full breakdown):",
     "doesItems": [
@@ -59,7 +59,7 @@
   },
   "languages": {
     "heading": "Skip downloading additional languages",
-    "intro": "On every <code>apt update</code>, Debian by default pulls translation files for every locale it ships — a lot of traffic and disk space for something you'll rarely see. This option tells APT to only fetch the main metadata. Before disabling, ProxMenux <strong>makes sure the host's own locale is actually generated</strong> (reads <code>/etc/default/locale</code> or <code>/etc/environment</code>, appends to <code>/etc/locale.gen</code> if missing, and runs <code>locale-gen</code>). So you don't lose your shell locale as a side effect.",
+    "intro": "During <code>apt update</code>, APT can download translated package descriptions as well as the main metadata. This option disables those translation downloads to save bandwidth and disk space. Before disabling them, ProxMenux <strong>makes sure the host’s own locale is actually generated</strong> (reads <code>/etc/default/locale</code> or <code>/etc/environment</code>, appends to <code>/etc/locale.gen</code> if missing, and runs <code>locale-gen</code>). So you do not lose your shell locale as a side effect.",
     "writtenTitle": "What gets written",
     "revertTitle": "Reversible from the Uninstall menu",
     "revertBody": "Deleting <code>/etc/apt/apt.conf.d/99-disable-translations</code> (either manually or from the Uninstall menu) restores the default behaviour and APT downloads language files again."
diff --git a/web/messages/en/docs/post-install/customizable.json b/web/messages/en/docs/post-install/customizable.json
index 62fdd25e..ae1a2289 100644
--- a/web/messages/en/docs/post-install/customizable.json
+++ b/web/messages/en/docs/post-install/customizable.json
@@ -7,12 +7,12 @@
   },
   "header": {
     "title": "Customizable Post-Install Script",
-    "description": "Cherry-pick exactly which optimizations to apply to a Proxmox VE host. ProxMenux groups ~35 individual tools into 10 categories, each with its own checklist dialog. Same engine as Automated, but with full control over what gets applied.",
+    "description": "Cherry-pick exactly which optimizations to apply to a Proxmox VE host. ProxMenux groups ~35 individual tools into 10 categories in one checklist dialog. Same engine as Automated, but with full control over what gets applied.",
     "section": "Post-Install · Customizable"
   },
   "intro": {
     "title": "When to pick Customizable",
-    "body": "Choose this path when you already know which tweaks you want on the host — or which you definitely do not want. The script presents a checklist per category so you can pre-select, deselect or mix-and-match optimizations. Items can be applied again later, and reversible configuration changes are tracked for <link>Uninstall Optimizations</link>. Package upgrades are not presented as reversible."
+    "body": "Choose this path when you already know which tweaks you want on the host — or which you definitely do not want. The script presents a checklist grouped by category so you can pre-select, deselect or mix-and-match optimizations. Items can be applied again later, and reversible configuration changes are tracked for <link>Uninstall Optimizations</link>. Package upgrades are not presented as reversible."
   },
   "compare": {
     "heading": "How it compares to Automated",
@@ -20,7 +20,7 @@
   },
   "categoriesSection": {
     "heading": "The 10 categories",
-    "body": "The Customizable script groups optimizations into 10 categories. Each category has its own checklist dialog and its own documentation page — open one of the cards below for the per-option rationale, defaults and verification steps."
+    "body": "The Customizable script groups optimizations into 10 categories in one checklist dialog. Each category has its own documentation page — open one of the cards below for the per-option rationale, defaults and verification steps."
   },
   "categories": [
     {
@@ -33,7 +33,7 @@
     },
     {
       "name": "Virtualization",
-      "description": "Prepare the host for advanced virtualization. Auto-installs the guest agent on templates and enables IOMMU/VFIO for PCI passthrough of GPUs, controllers and TPUs."
+      "description": "Prepare the host for advanced virtualization. Installs a matching guest agent when Proxmox itself runs inside a supported VM, and enables IOMMU/VFIO for PCI passthrough of GPUs, controllers and TPUs."
     },
     {
       "name": "Network",
@@ -53,7 +53,7 @@
     },
     {
       "name": "Monitoring",
-      "description": "Integrate the host with OVH Real-Time Monitoring. Only appears when ProxMenux detects an OVH server."
+      "description": "Integrate the host with OVH Real-Time Monitoring. Installs RTM only when ProxMenux detects an OVH server; on other hosts the option makes no changes."
     },
     {
       "name": "Performance",
diff --git a/web/messages/en/docs/post-install/customization.json b/web/messages/en/docs/post-install/customization.json
index eccbbba0..93344524 100644
--- a/web/messages/en/docs/post-install/customization.json
+++ b/web/messages/en/docs/post-install/customization.json
@@ -38,7 +38,7 @@
     "breakTitle": "Can break after Proxmox updates",
     "breakBody": "Proxmox regularly ships UI updates that overwrite <code>proxmoxlib.js</code>. When that happens, the banner comes back. You can re-apply this option after every Proxmox update to re-patch the file, or just accept the nag until you reapply. ProxMenux also installs an APT hook that auto-re-patches on package upgrades — see <link>Uninstall Optimizations</link> for how that hook is reversed.",
     "legalTitle": "Legal note (always worth repeating)",
-    "legalBody": "This option only hides the UI nag. It does <strong>not</strong> grant you enterprise support, access to the enterprise repository, or any rights to ship Proxmox commercially without a subscription. If you run Proxmox in a revenue-generating environment, buy a subscription — it supports the project and gets you the stable enterprise channel."
+    "legalBody": "This option only hides the UI notice. It does <strong>not</strong> grant enterprise support or access to the enterprise repository, and it does not change the software license. Proxmox VE is released under the GNU AGPLv3. A subscription supports the project and provides access to the enterprise update channel; choose the appropriate support level for your environment."
   },
   "verify": {
     "heading": "Verification",
diff --git a/web/messages/en/docs/post-install/index.json b/web/messages/en/docs/post-install/index.json
index e6e60c1f..46ab94f8 100644
--- a/web/messages/en/docs/post-install/index.json
+++ b/web/messages/en/docs/post-install/index.json
@@ -78,6 +78,17 @@
     "heading": "Community scripts",
     "body": "The menu also exposes two third-party scripts from the <a>community-scripts</a> project: <em>Proxmox VE Post Install</em> and <em>Proxmox VE Microcode</em>. These are wrappers that <code>wget | bash</code> the original authors' scripts. They are not maintained by ProxMenux. See <link>External Repositories</link> for details and trust considerations before running them."
   },
+  "pbs": {
+    "heading": "On Proxmox Backup Server",
+    "body": "On a Proxmox Backup Server host, the same menu opens from <strong>Settings post-install Proxmox</strong> in the PBS menu. Automated, Customizable, Apply Available Updates and Uninstall Optimizations work as on Proxmox VE, with these differences:",
+    "items": [
+      "<strong>Repositories and upgrade:</strong> when the server has no subscription and only the Enterprise PBS repository is active, ProxMenux asks before switching to the PBS no-subscription repository. The switch goes through the server's own repository API, the same one behind <em>Administration > Repositories</em>. With an active subscription, or with a no-subscription or test repository already configured, the sources stay as they are.",
+      "<strong>Customizable list:</strong> the options that only apply to Proxmox VE are not listed: guest agent, VFIO IOMMU, Open vSwitch, vzdump backup speed, pigz, Appliance Manager, Ceph, High Availability and OVH Real Time Monitoring.",
+      "<strong>Subscription banner:</strong> the patch applies to the Proxmox Backup Server web interface, and Uninstall Optimizations restores it.",
+      "<strong>Figurine:</strong> installs without the Proxmox VE aliases.",
+      "<strong>Community scripts:</strong> the section offers <em>Proxmox Backup Server Post Install</em> and <em>Proxmox Backup Server Microcode</em> in place of the Proxmox VE scripts."
+    ]
+  },
   "related": {
     "heading": "Related",
     "items": [
diff --git a/web/messages/en/docs/post-install/monitoring.json b/web/messages/en/docs/post-install/monitoring.json
index b9fda635..82dcccb5 100644
--- a/web/messages/en/docs/post-install/monitoring.json
+++ b/web/messages/en/docs/post-install/monitoring.json
@@ -30,8 +30,8 @@
     "verifyTitle": "Verification",
     "verifyBody": "On a real OVH host, after a reboot you should see the <a>RTM dashboard</a> in your OVH Manager populated with live data for the host. On the Proxmox side, the RTM collector is a systemd service — check it directly:",
     "troubleTitle": "Troubleshooting",
-    "revertTitle": "Not reversible from the Uninstall menu",
-    "revertBody": "There is no dedicated uninstall entry for RTM. On a real OVH host, remove the packages manually with <code>apt purge ovh-*</code> and delete any puppet manifests under <code>/etc/puppet/</code> that RTM installed. On a non-OVH host, nothing was ever installed, so there's nothing to revert."
+    "revertTitle": "Remove RTM from the Uninstall menu",
+    "revertBody": "When RTM is registered as installed, Uninstall Optimizations offers an OVH Real-Time Monitoring entry. It runs <code>apt-get purge -y ''ovh-rtm*'' ''rtm'' ''rtm-*''</code>, removes /etc/rtm, and marks RTM as uninstalled. Puppet artefacts may still need manual cleanup; review any RTM-specific manifests under <code>/etc/puppet/</code>. On a non-OVH host, no RTM packages were installed, so there is nothing to remove."
   },
   "related": {
     "heading": "Related",
diff --git a/web/messages/en/docs/post-install/network.json b/web/messages/en/docs/post-install/network.json
index 28f2a175..e84682d0 100644
--- a/web/messages/en/docs/post-install/network.json
+++ b/web/messages/en/docs/post-install/network.json
@@ -74,7 +74,7 @@
     "impactTitle": "Impact is workload-dependent",
     "impactBody": "BBR shines on high-latency or lossy links (cross-continent replication, VPN tunnels, mobile clients). On a LAN between two machines on the same switch, the difference is often within noise. TFO helps short, repeated HTTP connections the most.",
     "revertTitle": "Reversible from the Uninstall menu",
-    "revertBody": "BBR/TFO are tracked. <link>Uninstall Optimizations</link> removes the two sysctl files (<code>/etc/sysctl.d/99-tcp-bbr.conf</code> and <code>99-tcp-fastopen.conf</code>) and reloads sysctl so the kernel returns to <code>cubic</code> and <code>tcp_fastopen=1</code>. Manual equivalent:"
+    "revertBody": "BBR/TFO are tracked. <link>Uninstall Optimizations</link> removes the two sysctl files (<code>/etc/sysctl.d/99-kernel-bbr.conf</code> and <code>99-tcp-fastopen.conf</code>) and reloads the remaining sysctl configuration. Removing a file does not itself reset its live kernel values. Defaults such as <code>cubic</code> and <code>tcp_fastopen=1</code> return after a reboot unless another configuration overrides them. Manual equivalent:"
   },
   "names": {
     "heading": "Interface Names (persistent)",
@@ -83,13 +83,13 @@
     "whyItems": [
       "Adding or removing PCIe devices can shift the bus numbering, turning <code>enp3s0</code> into <code>enp4s0</code>. If your <code>/etc/network/interfaces</code> references the old name, the bridge vanishes on reboot.",
       "BIOS / firmware updates sometimes change how devices enumerate, with the same effect.",
-      "LXC containers with <code>hotplug</code> NICs and bonded links can race on boot and end up named inconsistently. Pinning fixes that."
+      "The helper writes <code>.link</code> files for physical NICs, including bond member ports, using the MAC currently reported in sysfs; for bond members this may be the bond’s shared MAC, so check their names after a reboot. It skips virtual interfaces such as LXC veth devices and the bond devices themselves; it does not fix naming races for virtual <code>hotplug</code> NICs."
     ],
     "writtenTitle": "What gets written",
     "writtenIntro": "One file per physical NIC, at <code>/etc/systemd/network/10-proxmenux-&lt;iface&gt;.link</code>. Each file starts with the header <code># Managed by ProxMenux — do not edit</code> so ProxMenux can distinguish its own files from user- or package-provided <code>.link</code> files.",
     "writtenOutro": "<code>.link</code> files from other packages or hand-written by the user are left in place — only files carrying the ProxMenux header are managed. On re-run, the function reconciles its own set: it re-reads <code>MACAddress=</code> from every <code>10-proxmenux-*.link</code> and drops any whose MAC no longer appears under <code>/sys/class/net/</code>. Files written by an earlier ProxMenux release in the old <code>10-&lt;iface&gt;.link</code> format are migrated automatically the first time.",
     "pveTitle": "PVE 9 vs PVE 8",
-    "pveBody": "On Proxmox VE 9 (<code>systemd-networkd</code> native), the script reloads udev rules after writing the <code>.link</code> files so new hotplug NICs pick up the correct name without a reboot. On PVE 8 (<code>ifupdown2</code>), interface naming is resolved at boot anyway — a reboot is required for the changes to take effect. The script sets the reboot flag either way so Customizable prompts you.",
+    "pveBody": "The script uses systemd <code>.link</code> files for persistent names. On Proxmox VE 9 it also reloads udev rules after writing them, so a pinned NIC that is re-added or re-probed can pick up its rule without rebooting. Existing interfaces should be checked after a reboot on both PVE 8 and PVE 9. This does not switch the host away from <code>ifupdown2</code>. The script sets the reboot flag in either case so Customizable prompts you.",
     "reviewTitle": "Review existing /etc/network/interfaces first",
     "reviewBody": "If your host has legacy configuration in <code>/etc/network/interfaces</code> that references NIC names generated by the kernel's default scheme, pinning <em>today's</em> names is exactly what you want. But if you've already manually customised the config around specific names, double-check the pinning matches what the interfaces file expects before rebooting.",
     "revertTitle": "Reversible from the Uninstall menu",
diff --git a/web/messages/en/docs/post-install/optional.json b/web/messages/en/docs/post-install/optional.json
index a7221f42..e6aca71a 100644
--- a/web/messages/en/docs/post-install/optional.json
+++ b/web/messages/en/docs/post-install/optional.json
@@ -119,9 +119,9 @@
     "intro": "This option installs and configures Figurine, a tool that creates stylish ASCII text banners for your terminal, displaying your hostname in a visually appealing 3D format.",
     "doesLabel": "What it does:",
     "doesItems": [
-      "Downloads and installs Figurine v2.0.0 from GitHub",
+      "Downloads and installs Figurine v2.1.1 from GitHub for the host architecture (AMD64, ARM64 or ARMv7)",
       "Creates a welcome message that displays your hostname in 3D ASCII art when you log in",
-      "Automatically removes any previous Figurine installation if present",
+      "Updates an existing Figurine binary after download and extraction succeed",
       "Sets up the welcome message to run automatically at login"
     ],
     "practicalLabel": "Practical Use:",
@@ -133,7 +133,7 @@
   },
   "log2ram": {
     "title": "Install Log2RAM (SSD/NVMe wear reduction)",
-    "intro": "Log2RAM mounts <code>/var/log</code> on a tmpfs ramdisk and periodically syncs the contents back to the underlying disk. On a hypervisor journald churn hits the root SSD every few seconds; moving the writes to RAM reduces wear and disk I/O without losing logs — the periodic sync flushes them to disk and a clean shutdown flushes them too.",
+    "intro": "Log2RAM mounts <code>/var/log</code> on a tmpfs ramdisk and periodically syncs it to the underlying disk. Buffering frequent journald writes in RAM can reduce root SSD wear and disk I/O. Periodic sync and a clean shutdown save logs to disk, but an abrupt power loss can lose entries written since the last sync.",
     "upstreamLabel": "Upstream project:",
     "upstreamUrl": "https://github.com/azlux/log2ram",
     "upstreamLinkLabel": "azlux/log2ram on GitHub",
@@ -149,7 +149,7 @@
       "Registers itself in <code>installed_tools.json</code> so it can be reverted from Uninstall Optimizations."
     ],
     "howUseLabel": "How to use:",
-    "howUseBody": "On the Automated flow Log2RAM applies unattended when an SSD/NVMe root is detected. On the Customizable flow the script prompts for size, sync interval and whether to enable the 90% auto-sync guard.",
+    "howUseBody": "On the Automated flow Log2RAM installs unattended when an SSD/NVMe root is detected. The Customizable flow asks for size, sync interval and whether to enable the auto-sync guard. Its prompt currently says 90%, but the generated guard uses the 80% cleanup and 92% aggressive thresholds described above.",
     "verifyLabel": "Verify and manage from the shell:",
     "verifyCode": "# Service state and configured timers\nsystemctl status log2ram\nsystemctl list-timers log2ram*\n\n# Current ramdisk usage — /var/log IS the tmpfs itself\ndf -h /var/log\n\n# Force a sync now (tmpfs → disk); does NOT shrink the tmpfs\nlog2ram write\n\n# Trigger the auto-sync guard on demand (vacuum + sync when usage is high)\n/usr/local/bin/log2ram-check.sh\n\n# Current config: SIZE, mail settings, path\ncat /etc/log2ram.conf\n\n# ProxMenux-specific cron jobs\ncat /etc/cron.d/log2ram /etc/cron.d/log2ram-auto-sync\n\n# Recent Log2RAM activity\njournalctl -u log2ram -n 50 --no-pager"
   },
@@ -172,6 +172,6 @@
   },
   "autoApplication": {
     "title": "Automatic Application",
-    "body": "These optional features are applied only when specifically selected during the post-install process. Each feature can be individually chosen based on your specific needs and preferences."
+    "body": "In the Customizable flow, select each optional feature according to your needs. Log2RAM is also part of the Automated flow with hardware detection; ZRAM remains Customizable-only. Review the individual sections for prompts and prerequisites."
   }
 }
diff --git a/web/messages/en/docs/post-install/performance.json b/web/messages/en/docs/post-install/performance.json
index d6fdd610..82ca4195 100644
--- a/web/messages/en/docs/post-install/performance.json
+++ b/web/messages/en/docs/post-install/performance.json
@@ -16,7 +16,7 @@
     "heading": "Use pigz for faster gzip compression",
     "intro": "Standard <code>gzip</code> compresses data using a <strong>single CPU core</strong>. On modern Proxmox hosts with 8, 16 or 32 cores, that is a huge bottleneck during <code>vzdump</code> VM/CT backups, log rotation, and anything else that pipes through <code>gzip</code>. <a>pigz</a> is a drop-in parallel replacement: same gzip-compatible output, but it spreads the work across every core.",
     "doesTitle": "What ProxMenux does",
-    "doesIntro": "Four steps, all idempotent:",
+    "doesIntro": "Five steps, all idempotent:",
     "doesItems": [
       "Sets <code>pigz: 1</code> in <code>/etc/vzdump.conf</code> so Proxmox's backup tool uses pigz natively.",
       "Installs the <code>pigz</code> apt package if not already present.",
diff --git a/web/messages/en/docs/post-install/storage.json b/web/messages/en/docs/post-install/storage.json
index 3dfc9d40..2998ba58 100644
--- a/web/messages/en/docs/post-install/storage.json
+++ b/web/messages/en/docs/post-install/storage.json
@@ -15,7 +15,7 @@
   "trackedBody": "Each of these options registers a tool in <code>installed_tools.json</code>, so they appear in <link>Uninstall Optimizations</link>. Reverting <code>zfs_arc</code> removes <code>/etc/modprobe.d/99-zfsarc.conf</code> and rebuilds initramfs; <code>zfs_auto_snapshot</code> reverses the cron schedule and offers to purge the package; <code>zfs_autotrim</code> sets <code>autotrim=off</code> on the pools it enabled; <code>vzdump_speed</code> restores <code>/etc/vzdump.conf</code> from the <code>.bak</code> the install created.",
   "arc": {
     "heading": "Optimize ZFS ARC size",
-    "intro": "The <strong>Adaptive Replacement Cache (ARC)</strong> is ZFS's in-memory read cache. Without explicit tuning, ZFS happily grabs up to half the host RAM for itself, which is excessive on a Proxmox host that also needs memory for VMs and LXCs. This option caps ARC to a sane fraction of total RAM based on the size of the machine.",
+    "intro": "The <strong>Adaptive Replacement Cache (ARC)</strong> is ZFS’s in-memory read cache. Proxmox VE installations since 8.1 set a limit of 10% of RAM, capped at 16 GiB; older or upgraded hosts may differ. This option writes that same policy explicitly (RAM/10, capped at 16 GiB, with a 64 MiB floor) to its own file, which also covers older or upgraded hosts. Check existing settings and workload needs before changing it; a smaller cache is not always faster.",
     "sizingTitle": "Sizing rules",
     "headerRam": "Host RAM",
     "headerMax": "ARC cap",
@@ -41,7 +41,7 @@
         "max": "16 GiB (cap)"
       }
     ],
-    "after": "The file <code>/etc/modprobe.d/99-zfsarc.conf</code> contains a single directive — <code>options zfs zfs_arc_max=…</code>. Every other ZFS module parameter (<code>zfs_arc_min</code>, L2ARC prefetch/write throttle, TXG timeout) is left at its OpenZFS default. Before writing, a reconcile step scans any other <code>*.conf</code> in <code>/etc/modprobe.d/</code> that sets <code>zfs_arc_min</code> / <code>zfs_arc_max</code>, backs them up to <code>/usr/local/share/proxmenux/backups/zfs_arc/</code> with a manifest, and strips the conflicting lines so only ProxMenux's file is active. After writing the file, ProxMenux runs <code>update-initramfs -u -k all</code> and, when applicable, <code>proxmox-boot-tool refresh</code>, so the cap also lands in the initramfs used by ZFS-on-root setups.",
+    "after": "The file <code>/etc/modprobe.d/99-zfsarc.conf</code> contains a single directive — <code>options zfs zfs_arc_max=…</code>. This option does not tune other ZFS module parameters (<code>zfs_arc_min</code>, L2ARC prefetch/write throttle, TXG timeout). Before writing, a reconcile step scans other <code>*.conf</code> in <code>/etc/modprobe.d/</code> that set <code>zfs_arc_min</code> / <code>zfs_arc_max</code>, backs them up to <code>/usr/local/share/proxmenux/backups/zfs_arc/</code> with a manifest, and removes the conflicting <code>zfs_arc_min</code> / <code>zfs_arc_max</code> values (other options on those lines are kept), so only ProxMenux’s ARC file sets the limit. After writing, it runs <code>update-initramfs -u -k all</code> and, when applicable, <code>proxmox-boot-tool refresh</code>, so the limit also reaches the initramfs used by ZFS-on-root setups.",
     "rebootTitle": "Requires a reboot to take effect",
     "rebootBody": "ARC settings are read when the <code>zfs</code> kernel module loads. To make the cap take effect on ZFS-on-root hosts, ProxMenux regenerates the initramfs with <code>update-initramfs -u -k all</code> and, when applicable, refreshes the boot loader with <code>proxmox-boot-tool refresh</code>. A reboot is still required to pick up the new module parameter; the \"reboot required\" flag is set automatically.",
     "safeTitle": "Safe on non-ZFS hosts",
@@ -90,22 +90,22 @@
   },
   "autotrim": {
     "heading": "Enable ZFS autotrim (SSD/NVMe pools)",
-    "intro": "Enables the <code>autotrim</code> property on every ZFS pool that is backed exclusively by SSDs or NVMe drives with TRIM support. Pools that include a single HDD vdev are skipped automatically — TRIM on rotational drives is meaningless and ZFS will refuse it. Pools that were already set to <code>autotrim=on</code> are left as they are.",
+    "intro": "Enables the <code>autotrim</code> property on ZFS pools backed exclusively by SSDs or NVMe drives with TRIM support. The script conservatively skips pools containing a rotational device. Pools already set to <code>autotrim=on</code> are left unchanged.",
     "trimTitle": "What TRIM does, and why it matters on ZFS",
     "trimBody1": "SSDs / NVMe drives manage internal storage in fixed-size erase blocks that are much larger than the logical sectors the filesystem talks to. When a filesystem deletes a file, the drive doesn't know — it still thinks those sectors are in use, so its internal garbage collector keeps shuffling stale data around to free new erase blocks. <strong>TRIM</strong> is the standard command the OS uses to tell the drive \"these sectors are now free, you can erase them ahead of time\".",
     "trimBody2": "Without TRIM, SSD performance degrades over time as the drive runs out of pre-erased blocks and has to do erase-on-write, and write amplification increases — both shortening the drive's useful life. With TRIM enabled, the drive can keep a healthy pool of empty blocks ready to write into.",
-    "trimBody3": "On ZFS, <code>autotrim=on</code> is the modern equivalent of the periodic <code>zpool trim &lt;pool&gt;</code> command — instead of having to remember to run a trim manually (or schedule one), the pool issues TRIM commands automatically and continuously as blocks become free. It's low-overhead and the recommended setting for SSD-backed pools.",
+    "trimBody3": "With <code>autotrim=on</code>, ZFS trims recently freed space in the background, grouping ranges before issuing commands. A periodic <code>zpool trim &lt;pool&gt;</code> is another option. Autotrim avoids a separate schedule, but its performance impact depends on the devices; periodic manual trim may suit some lower-end drives better.",
     "practicalTitle": "Why is this practical to enable?",
     "practicalItems": [
-      "<strong>Sustained write performance.</strong> SSDs that never see TRIM commands slow down measurably over months. Autotrim keeps the controller's job easier.",
-      "<strong>Drive longevity.</strong> Lower write amplification means fewer total NAND writes for the same amount of data — measurable in years of useful life for the disk.",
+      "<strong>Sustained write performance.</strong> TRIM can help a drive reclaim unused blocks efficiently. The benefit and any latency impact depend on the device and workload.",
+      "<strong>Drive longevity.</strong> Avoiding unnecessary internal copying can reduce write amplification and NAND wear. It does not guarantee a specific increase in drive lifespan.",
       "<strong>No scheduled cron job to remember.</strong> Unlike a periodic <code>zpool trim</code>, autotrim is fire-and-forget — the pool handles it on its own."
     ],
     "whenTitle": "When is this necessary?",
-    "whenIntro1": "<strong>You should enable it</strong> on any ZFS pool whose vdevs are all SSD or NVMe with TRIM support — the typical Proxmox install on consumer or enterprise SSDs.",
+    "whenIntro1": "<strong>Consider enabling it</strong> on ZFS pools made entirely of TRIM-capable SSD or NVMe devices. Check device behaviour and workload latency; a scheduled manual trim can be preferable on some hardware.",
     "whenIntro2": "<strong>The script skips it automatically</strong> on:",
     "whenSkipItems": [
-      "Pools containing any HDD (rotational) vdev — TRIM is meaningless there.",
+      "Pools containing any HDD (rotational) vdev — a conservative hardware filter used by this script.",
       "Drives without <code>discard_granularity</code> exposed in sysfs — usually old SSDs without TRIM, or pass-through paths where the OS can't see the underlying device.",
       "Pools where ZFS itself reports the property unsupported (rare; very old pools).",
       "Pools already set to <code>autotrim=on</code> (no-op)."
@@ -121,7 +121,7 @@
   },
   "vzdump": {
     "heading": "Increase vzdump backup speed",
-    "intro": "By default, Proxmox vzdump throttles backups to protect running VMs/CTs from IO starvation. On many setups that throttle is more conservative than needed. This option removes the bandwidth cap and lowers the I/O priority so vzdump can saturate the storage path during backup windows.",
+    "intro": "Writes bwlimit: 0 and ionice: 5 in the global vzdump configuration. Proxmox already defaults to no bandwidth limit, so this removes a cap only if one was configured. Compared with the default ionice: 7, the value 5 gives a higher best-effort I/O priority where the scheduler honours it. This can affect running guests and does not guarantee faster backups.",
     "changedTitle": "What gets changed in /etc/vzdump.conf",
     "backupTitle": "First run creates a .bak of vzdump.conf",
     "backupBody": "The first time this option runs, ProxMenux copies <code>/etc/vzdump.conf</code> to <code>/etc/vzdump.conf.bak</code> before touching it. Subsequent runs re-use that backup and won't overwrite it, so a hand-edited config from before the first apply stays recoverable. The changes to <code>bwlimit</code> and <code>ionice</code> are then made with <code>sed</code>, and any other options in the file (compress, pigz, tmpdir, exclude-path, etc.) are preserved.",
@@ -145,7 +145,7 @@
       {
         "label": "Backup and Restore commands",
         "href": "/docs/help-info/backup-commands",
-        "tail": " — vzdump CLI reference (now without the legacy bwlimit / ionice caps)."
+        "tail": " — vzdump CLI reference for bandwidth and I/O-priority settings."
       },
       {
         "label": "Uninstall Optimizations",
diff --git a/web/messages/en/docs/post-install/system.json b/web/messages/en/docs/post-install/system.json
index 935a33f5..8c62ce20 100644
--- a/web/messages/en/docs/post-install/system.json
+++ b/web/messages/en/docs/post-install/system.json
@@ -28,9 +28,9 @@
   },
   "logrotate": {
     "heading": "Optimize logrotate",
-    "intro": "Rewrites <code>/etc/logrotate.conf</code> with a tighter policy suitable for a host that's also part of an SSD-protecting Log2RAM setup: daily rotation, 7-day retention, 10 MB size trigger, compression, and <code>copytruncate</code> so active services keep writing without reopening their log files. Original <code>logrotate.conf</code> is backed up to <code>.bak</code> on first apply.",
+    "intro": "Rewrites <code>/etc/logrotate.conf</code> with global daily and size settings, 7 retained rotations, compression and <code>copytruncate</code>, so active services can keep writing without reopening their log files. The size setting follows daily and takes precedence unless a per-log rule overrides it. Original <code>logrotate.conf</code> is backed up to <code>.bak</code> on first apply.",
     "tipTitle": "Log2RAM-friendly",
-    "tipBody": "The <code>size 10M</code> trigger means logs rotate on size <em>or</em> daily, whichever comes first. Combined with Log2RAM's RAM-backed <code>/var/log</code>, this keeps the working set small so flushes to disk stay cheap."
+    "tipBody": "The <code>size 10M</code> directive takes precedence over the earlier daily setting; it does <em>not</em> mean whichever comes first. Logrotate checks the threshold when it runs, and per-log rules may override the global settings. With Log2RAM’s RAM-backed <code>/var/log</code>, review both the rules and the timer frequency to control disk usage."
   },
   "limits": {
     "heading": "Increase various system limits",
@@ -72,7 +72,7 @@
       }
     ],
     "tipTitle": "Why inotify matters",
-    "tipBody": "Applications like Docker, Syncthing, Node.js watchers, Plex's library scanner and many more hit <code>max_user_watches</code> quickly. Default on Debian is 8192 — a single running Plex can exhaust it. 1M is generous and costs ~1 KB of RAM per watch, which is negligible."
+    "tipBody": "Docker, Syncthing, Node.js file watchers and Plex library scans can exhaust <code>max_user_watches</code>. The default depends on the kernel and host memory; it is not always 8192. Raising the limit to 1M allows more watches, but does not preallocate them. Active watches consume kernel memory, so monitor actual usage on memory-constrained hosts."
   },
   "memory": {
     "heading": "Optimize memory settings",
@@ -102,8 +102,8 @@
   "verify": {
     "heading": "Verification",
     "intro": "After applying the System optimizations:",
-    "tipTitle": "Fully reversible",
-    "tipBody": "All six options are tracked in <code>installed_tools.json</code>, so they appear in <link>Uninstall Optimizations</link> if you want to back any of them out. Reverts restore the sysctl files' defaults, drop the systemd unit and alias for kexec, and reset journald/logrotate to stock Debian configs."
+    "tipTitle": "Restoration and limitations",
+    "tipBody": "All six options are tracked in <code>installed_tools.json</code> and offered in <link>Uninstall Optimizations</link>. Restoration removes the configuration files and the kexec unit and alias, rewrites journald.conf with the stock systemd defaults and restores logrotate.conf from its backup. Some live limits need a new session or reboot."
   },
   "related": {
     "heading": "Related",
diff --git a/web/messages/en/docs/post-install/uninstall.json b/web/messages/en/docs/post-install/uninstall.json
index 613ec0ac..f25407f2 100644
--- a/web/messages/en/docs/post-install/uninstall.json
+++ b/web/messages/en/docs/post-install/uninstall.json
@@ -58,7 +58,7 @@
           },
           {
             "tool": "APT Language Skip",
-            "restores": "Removes /etc/apt/apt.conf.d/99-disable-translations. APT will download language packages again."
+            "restores": "Removes /etc/apt/apt.conf.d/99-disable-translations, allowing APT to download translated package-description indexes according to its remaining language settings."
           },
           {
             "tool": "APT IPv4 Force",
@@ -83,7 +83,7 @@
           },
           {
             "tool": "System Limits Increase",
-            "restores": "Removes /etc/sysctl.d/99-maxwatches.conf, 99-maxkeys.conf, 99-swap.conf, 99-fs.conf and /etc/security/limits.d/99-limits.conf. Reverts PAM limits and systemd DefaultLimitNOFILE, and strips the ulimit -n 256000 line from /root/.profile."
+            "restores": "Removes /etc/sysctl.d/99-maxwatches.conf, 99-maxkeys.conf, 99-swap.conf, 99-fs.conf and /etc/security/limits.d/99-limits.conf. Reverts PAM limits and systemd DefaultLimitNOFILE. Its /root/.profile cleanup targets the legacy ulimit -n 256000 line; a ulimit -n 1048576 line from the current installer can remain and may need manual removal."
           },
           {
             "tool": "ZRAM swap profile",
@@ -104,7 +104,7 @@
           },
           {
             "tool": "TCP BBR + TCP Fast Open",
-            "restores": "Removes /etc/sysctl.d/99-tcp-bbr.conf and 99-tcp-fastopen.conf and reloads sysctl so the kernel returns to the cubic congestion control and to tcp_fastopen=1."
+            "restores": "Removes /etc/sysctl.d/99-kernel-bbr.conf and 99-tcp-fastopen.conf and reloads remaining sysctl configuration. File removal does not itself reset live values; defaults such as cubic and tcp_fastopen=1 return after reboot unless another configuration overrides them."
           },
           {
             "tool": "Persistent Interface Names",
@@ -166,8 +166,8 @@
             "restores": "Removes idle=nomwait from kernel cmdline (ZFS) or GRUB, and the ignore_msrs / report_ignored_msrs options from /etc/modprobe.d/kvm.conf."
           },
           {
-            "tool": "QEMU Guest Agent (templates)",
-            "restores": "Reads /usr/local/share/proxmenux/guest_agent.pkg (recorded at install time) and apt purges whichever package was installed (qemu-guest-agent for standard hosts, spice-vdagent when Spice mode is used)."
+            "tool": "Guest agent for a virtualized Proxmox host",
+            "restores": "Reads /usr/local/share/proxmenux/guest_agent.pkg and purges the recorded host package. The installer selects qemu-guest-agent, open-vm-tools or virtualbox-guest-utils according to the detected hypervisor. If the record is missing, the uninstaller tries those three packages. This acts on the nested Proxmox host, not guest templates."
           }
         ]
       },
@@ -221,7 +221,7 @@
           },
           {
             "tool": "OVH RTM (monitoring)",
-            "restores": "apt purges any ovh-* packages the RTM installer added and deletes the puppet manifests it dropped under /etc/puppet/. On non-OVH hosts nothing was ever installed, so nothing is removed."
+            "restores": "Purges packages matching ovh-rtm*, rtm and rtm-*, removes /etc/rtm and clears the RTM registry entry. Puppet artefacts under /etc/puppet/ may need manual inspection and cleanup; the uninstaller does not delete that directory. On non-OVH hosts the installer normally makes no changes."
           }
         ]
       }
@@ -230,7 +230,7 @@
   "edge": {
     "heading": "Edge cases and caveats",
     "packageTitle": "Package reinstall touches live Proxmox packages",
-    "packageBody": "Reverting <strong>Subscription Banner Removal</strong> reinstalls <code>pve-manager</code>, <code>proxmox-widget-toolkit</code>, <code>libjs-extjs</code> and <code>libpve-http-server-perl</code> with <code>--force-confnew</code>. This is generally safe but does touch the running web UI — refresh your browser afterwards, and expect a few seconds of reconnection. Don't run this in the middle of a migration or clone operation.",
+    "packageBody": "If ProxMenux’s own backups cannot restore <strong>Subscription Banner Removal</strong>, the fallback reinstalls <code>pve-manager</code>, <code>proxmox-widget-toolkit</code>, <code>libjs-extjs</code> and <code>libpve-http-server-perl</code> with <code>--force-confnew</code>. This touches the running web UI: refresh the browser afterwards and allow a few seconds to reconnect. Avoid doing it during a migration or clone operation.",
     "rebootTitle": "Persistent names and VFIO need a reboot",
     "rebootBody": "Removing ProxMenux's <code>10-proxmenux-*.link</code> files (<em>Persistent Interface Names</em>) and reverting <em>IOMMU/VFIO</em> do not affect the running system — they only matter after a reboot. ProxMenux sets the reboot flag automatically for these.",
     "perItemTitle": "You can revert one thing and keep the rest",
diff --git a/web/messages/en/docs/post-install/updates.json b/web/messages/en/docs/post-install/updates.json
index 4ac308cb..482c4072 100644
--- a/web/messages/en/docs/post-install/updates.json
+++ b/web/messages/en/docs/post-install/updates.json
@@ -48,9 +48,9 @@
   },
   "pathB": {
     "heading": "Path B — From the Monitor dashboard",
-    "intro": "The same updates appear in the Monitor under <link>Settings → ProxMenux Optimizations</link>. When pending updates are detected the card shows an \"Updates available\" banner with the count and an <strong>Apply</strong> action that opens the same per-optimization picker.",
-    "imageAlt": "ProxMenux Optimizations card on the Monitor dashboard with an Updates available banner at the top showing the count of pending updates and an Apply button that opens the per-optimization picker",
-    "imageCaption": "The Optimizations card in the Monitor — when at least one optimization has a newer version on disk, the banner surfaces it without requiring shell access."
+    "intro": "The same updates appear in the Monitor under <link>Settings → ProxMenux Optimizations</link>. When pending updates are detected, the card shows an <strong>updates count badge</strong> that opens the per-optimization picker. Individual tools also provide their own update action.",
+    "imageAlt": "ProxMenux Optimizations card in Monitor settings, with a pending-updates count badge that opens the per-optimization picker and update actions on individual tools",
+    "imageCaption": "The Optimizations card in the Monitor — when at least one optimization has a newer version on disk, its count badge makes the updates accessible without shell access."
   },
   "applying": {
     "heading": "What happens when you apply",
@@ -69,7 +69,7 @@
       },
       {
         "title": "Registry refresh sent to the Monitor",
-        "body": "Once the batch finishes, the menu POSTs to <code>http://127.0.0.1:8008/api/updates/post-install/scan</code> to rebuild <code>/usr/local/share/proxmenux/updates_available.json</code>. That is what makes the Monitor's Optimizations card and the shell menu entry disappear immediately after the update, without waiting for the next scheduled scan."
+        "body": "Once the batch finishes, the menu POSTs to <code>http://127.0.0.1:8008/api/updates/post-install/scan</code> to rebuild <code>/usr/local/share/proxmenux/updates_available.json</code>. After all pending updates are applied, the update badge in the Monitor’s Optimizations card and the conditional shell menu entry disappear without waiting for the next scheduled scan. The Optimizations card itself remains available."
       }
     ],
     "jqTitle": "jq is required",
diff --git a/web/messages/en/docs/security/fail2ban.json b/web/messages/en/docs/security/fail2ban.json
index f7d431d8..18b0ad34 100644
--- a/web/messages/en/docs/security/fail2ban.json
+++ b/web/messages/en/docs/security/fail2ban.json
@@ -91,7 +91,7 @@
   },
   "hardening": {
     "heading": "SSH hardening: MaxAuthTries",
-    "intro": "Lynis control <strong>SSH-7408</strong> recommends <code>MaxAuthTries 3</code> in <code>sshd_config</code>. With Fail2Ban's <code>maxretry = 2</code> on the SSH jail, a malicious client never reaches three attempts anyway — but the explicit setting satisfies the audit and adds defence in depth (e.g. if Fail2Ban is stopped for maintenance).",
+    "intro": "Lynis control <strong>SSH-7408</strong> recommends <code>MaxAuthTries 3</code> in <code>sshd_config</code>. The SSH jail uses <code>maxretry = 2</code> to trigger a ban after repeated failures, while MaxAuthTries limits attempts within a connection. The explicit SSH setting adds defence in depth, including when Fail2Ban is stopped for maintenance.",
     "installerIntro": "The installer:",
     "items": [
       "Reads the current <code>MaxAuthTries</code> value (or defaults to 6 if absent).",
@@ -125,7 +125,7 @@
   "troubleshoot": {
     "heading": "Troubleshooting",
     "neverBansTitle": "Fail2Ban runs but never bans anything",
-    "neverBansBody": "Check the auth log files actually receive entries: <code>tail -f /var/log/ssh-auth.log</code> and try a wrong-password SSH attempt from a different machine. If the log stays empty, the logger service is not running: <code>systemctl status ssh-auth-logger.service</code>. If it's active but the log is empty, check that the journald drop-in took effect: <code>journalctl --dump-catalog | head</code> — events at <em>info</em> level should be visible.",
+    "neverBansBody": "Check that <code>tail -f /var/log/ssh-auth.log</code> receives an entry after a wrong-password SSH attempt from another machine. If it stays empty, inspect <code>systemctl status ssh-auth-logger.service</code>. If the logger is active, inspect recent SSH events with <code>journalctl -u ssh.service -n 50 --no-pager -p info</code> and check whether the journald drop-in permits the <em>info</em> level.",
     "monitorEmptyTitle": "ProxMenux Monitor jail has no entries even after failed logins",
     "monitorEmptyBody": "The <code>[proxmenux]</code> jail reads <code>/var/log/proxmenux-auth.log</code>, which is written by the ProxMenux Monitor Flask app — not by a journald logger. If you don't run the Monitor, the file stays empty and the jail never fires. That's expected; the jail config is harmless. If you do run the Monitor and the log is empty, check the Flask logging config.",
     "selfBanTitle": "I banned myself",
diff --git a/web/messages/en/docs/security/ssl-letsencrypt.json b/web/messages/en/docs/security/ssl-letsencrypt.json
index 19f4ea50..b5a65563 100644
--- a/web/messages/en/docs/security/ssl-letsencrypt.json
+++ b/web/messages/en/docs/security/ssl-letsencrypt.json
@@ -28,7 +28,7 @@
       "items": [
         "Auto-detected — no path to type",
         "Picks the ACME-uploaded cert if present, falls back to the self-signed default",
-        "Renewal happens through Proxmox; the Monitor follows automatically on next start"
+        "Proxmox handles renewal; the Monitor validates and loads it on the next new TLS connection"
       ]
     },
     "custom": {
@@ -143,7 +143,7 @@
   },
   "trustCa": {
     "heading": "Trust the Proxmox self-signed CA",
-    "intro1Rich": "If you prefer to keep the default Proxmox-generated certificate (no ACME), you can stop the browser warning by importing the cluster's root CA into the OS or browser trust store. The Monitor will keep auto-detecting the same <code>/etc/pve/local/pveproxy-ssl.pem</code>; the only thing that changes is that the device viewing the dashboard now recognises the issuer.",
+    "intro1Rich": "To keep the default Proxmox-generated certificate without ACME, import the cluster root CA into the OS or browser trust store. The Monitor detects <code>/etc/pve/local/pve-ssl.pem</code> as the fallback certificate. This makes the client trust its issuer; the URL must still match a name in the certificate.",
     "intro2Rich": "The CA file lives at <code>/etc/pve/pve-root-ca.pem</code> on every node. In a cluster the path is on the shared <code>pmxcfs</code> filesystem so all nodes share the same root, and a single import covers the whole datacenter. Copy it to your machine:",
     "code": "scp root@<your-host>:/etc/pve/pve-root-ca.pem ./pve-root-ca.pem",
     "thenImport": "Then import it on the client side:",
diff --git a/web/messages/en/docs/settings/beta-program.json b/web/messages/en/docs/settings/beta-program.json
index 112f7a58..8157582a 100644
--- a/web/messages/en/docs/settings/beta-program.json
+++ b/web/messages/en/docs/settings/beta-program.json
@@ -84,7 +84,7 @@
     "downloadCmd": "curl -fsSL -o /tmp/test https://raw.githubusercontent.com/MacRimi/ProxMenux/main/install_proxmenux.sh && head -1 /tmp/test",
     "downloadOutro": "If this fails outside ProxMenux, it's a network / proxy issue on the host.",
     "errorsTitle": "“Installer finished with errors”",
-    "errorsBody": "The installer surfaced a non-zero exit code. The previous channel and any already-installed components are left as they were before the switch. Re-run the action; if it keeps failing, run the installer manually from a shell (see the manual equivalent above) — that gives you the full output instead of the dialog summary.",
+    "errorsBody": "The installer returned a non-zero exit code. There is no automatic rollback: some files or components may already have changed. Read the installer output shown above the error before pressing Enter and check the current state, then retry from the menu or run the installer manually from SSH or the host console.",
     "configTitle": "“Could not update config file” after switching to Stable",
     "configBody": "The post-install cleanup of beta metadata failed — usually because <code>config.json</code> has a syntax error from a manual edit. Validate it:",
     "configCmd": "jq . /usr/local/share/proxmenux/config.json",
diff --git a/web/messages/en/docs/settings/change-language.json b/web/messages/en/docs/settings/change-language.json
index 782fd5ae..474ff5c7 100644
--- a/web/messages/en/docs/settings/change-language.json
+++ b/web/messages/en/docs/settings/change-language.json
@@ -1,22 +1,22 @@
 {
   "meta": {
     "title": "Change Language | ProxMenux Documentation",
-    "description": "Switch ProxMenux UI between English, Spanish, French, German, Italian or Portuguese. Translation install only — uses googletrans + a pre-cached translation table. The menu reloads automatically with the new language.",
+    "description": "Choose from eight ProxMenux interface languages. Every installation includes pre-generated JSON translation catalogs; no translation service or Python environment is needed on the host. The menu reloads automatically.",
     "ogTitle": "Change Language | ProxMenux Documentation",
-    "ogDescription": "Pick the ProxMenux interface language from the Settings menu. Six languages supported."
+    "ogDescription": "Pick one of eight ProxMenux interface languages from Settings. Available on every installation."
   },
   "header": {
     "title": "Change Language",
-    "description": "Switch the ProxMenux UI between six supported languages. Saves the choice to config.json and re-execs the menu with the new language. Only available on the Translation install type — the Normal (lightweight) install is English-only by design.",
+    "description": "Switch the ProxMenux interface between eight supported languages. The choice is saved to config.json and the menu is restarted in the new language. Every installation includes the translation catalogs.",
     "section": "Settings"
   },
   "intro": {
     "title": "What this is",
-    "body": "A dialog menu that lists the six supported languages. Pick one, ProxMenux saves it to <code>config.json</code> as <code>.language</code>, then re-execs <code>config_menu.sh</code> so the new language takes effect immediately."
+    "body": "A dialog lists the eight supported languages. ProxMenux saves your choice to <code>config.json</code> as <code>.language</code>, then restarts <code>config_menu.sh</code> so it takes effect immediately."
   },
   "warn": {
-    "title": "Translation install only",
-    "body": "This option only appears in Settings if both checks pass: <code>/opt/googletrans-env/bin/activate</code> exists (Python venv with googletrans), <em>and</em> <code>config.json</code> has a non-empty <code>.language</code>. On the Normal (English-only) install neither is present and the language picker is not shown."
+    "title": "Available on every installation",
+    "body": "Settings always shows Change Language. Translation catalogs are installed in <code>/usr/local/share/proxmenux/lang/</code>, <em>and</em> the selected language is stored in <code>config.json</code>. No legacy Python translation environment is required."
   },
   "supported": {
     "heading": "Supported languages",
@@ -32,38 +32,48 @@
       {
         "code": "es",
         "lang": "Spanish",
-        "notes": "Cached + auto-translated"
+        "notes": "Pre-generated JSON catalog"
       },
       {
         "code": "fr",
         "lang": "French",
-        "notes": "Cached + auto-translated"
+        "notes": "Pre-generated JSON catalog"
       },
       {
         "code": "de",
         "lang": "German",
-        "notes": "Cached + auto-translated"
+        "notes": "Pre-generated JSON catalog"
       },
       {
         "code": "it",
         "lang": "Italian",
-        "notes": "Cached + auto-translated"
+        "notes": "Pre-generated JSON catalog"
       },
       {
         "code": "pt",
         "lang": "Portuguese",
-        "notes": "Cached + auto-translated"
+        "notes": "Pre-generated JSON catalog"
+      },
+      {
+        "code": "sk",
+        "lang": "Slovak",
+        "notes": "Pre-generated JSON catalog"
+      },
+      {
+        "code": "sv",
+        "lang": "Swedish",
+        "notes": "Pre-generated JSON catalog"
       }
     ]
   },
   "englishTip": {
     "title": "English is the most accurate",
-    "body": "Non-English strings are produced by a pre-cached table seeded from googletrans. Edge-case strings (rarely triggered options, recent additions) may fall through to a live googletrans call or to the English original. If a translation feels off, English is always the source of truth."
+    "body": "Non-English text comes from pre-generated JSON catalogs included with ProxMenux. Missing translations fall back to English; there is no live translation call on the host. English remains the reference when a translation seems incorrect."
   },
   "underHood": {
     "heading": "How it works under the hood",
     "items": [
-      "Dialog menu lists the 6 codes; you pick one.",
+      "The dialog lists eight language codes; choose one.",
       "If <code>config.json</code> exists: <code>jq --arg lang \"$new_language\" '.language = $lang''</code> updates the field in place.",
       "If <code>config.json</code> doesn't exist: a fresh one is created with the language code in a single-field object.",
       "Confirmation dialog: <em>\"Language changed to [code]\"</em>.",
@@ -76,7 +86,7 @@
   "troubleshoot": {
     "heading": "Troubleshooting",
     "noOptionTitle": "Option doesn't appear in Settings",
-    "noOptionBody": "You're on the Normal (English-only) install. To get language support, reinstall ProxMenux choosing the Translation install option (it pulls Python venv + googletrans).",
+    "noOptionBody": "Change Language is always available in current releases. If it is missing, update ProxMenux using the official installer and open Settings again.",
     "stillEnglishTitle": "Language changed but UI still shows English",
     "stillEnglishBody": "The menu re-execs itself after the change. If you opened a fresh shell and started a different ProxMenux entrypoint, run <code>menu</code> again to pick up the new language. Confirm: <code>jq -r '.language' /usr/local/share/proxmenux/config.json</code>."
   },
@@ -86,7 +96,7 @@
       {
         "href": "/docs/settings/show-version-information",
         "label": "Show Version Information",
-        "tail": " — confirms install type and current language."
+        "tail": " — confirms the release channel, translation files and current language."
       },
       {
         "href": "/docs/settings",
diff --git a/web/messages/en/docs/settings/index.json b/web/messages/en/docs/settings/index.json
index 4f36f030..9fd02ecc 100644
--- a/web/messages/en/docs/settings/index.json
+++ b/web/messages/en/docs/settings/index.json
@@ -1,7 +1,7 @@
 {
   "meta": {
     "title": "ProxMenux Settings — Monitor Activation, Release Channel, Languages | ProxMenux",
-    "description": "ProxMenux configuration menu: ProxMenux Monitor activation and service toggle, Reset Monitor Password, Change Release Channel between Stable and Beta, language selection (translation install), version information and uninstall. Options appear conditionally based on what is installed and active.",
+    "description": "ProxMenux settings: Monitor service and password reset, Stable/Beta release channel, eight interface languages, version diagnostics and uninstall. Monitor options appear when its service is installed.",
     "ogTitle": "ProxMenux Settings — Monitor Activation, Release Channel, Languages",
     "ogDescription": "Configure ProxMenux — Monitor service, Release Channel, language, version info and uninstall.",
     "twitterTitle": "ProxMenux Settings",
@@ -9,7 +9,7 @@
   },
   "header": {
     "title": "Settings",
-    "description": "ProxMenux configuration menu. Lists what's installed, lets you toggle the Monitor service, reset the Monitor login password, switch between Stable and Beta release channels in either direction, change the UI language (Translation install only), and provides a clean uninstaller. Options appear conditionally — what you see depends on your install type and current state.",
+    "description": "Configure ProxMenux: toggle the Monitor service, reset its login credentials, switch between Stable and Beta in either direction, choose one of eight interface languages, inspect version diagnostics and uninstall. Monitor actions require its service to be installed; language selection is always available.",
     "section": "Settings"
   },
   "intro": {
@@ -18,33 +18,33 @@
   },
   "opening": {
     "heading": "Opening the menu",
-    "body": "From ProxMenux's main menu, press <kbd>s</kbd>. The options shown depend on your install type and on what is currently active:",
-    "imageAlt": "Settings ProxMenux menu with conditional options based on install type and component state"
+    "body": "From ProxMenux's main menu, press <kbd>s</kbd>. Monitor actions appear when its service is installed; the remaining settings are always available:",
+    "imageAlt": "ProxMenux Settings menu with conditional Monitor actions"
   },
   "installTypes": {
-    "heading": "Two install types, different menus",
-    "intro": "ProxMenux ships in two flavours. The Settings menu adapts to which one you have:",
+    "heading": "One installation, all languages",
+    "intro": "Current releases include static JSON translation catalogs in every installation. Older releases offered separate Translation and Normal modes:",
     "headerType": "Install type",
     "headerBundles": "What it bundles",
     "headerMenu": "Menu shows",
     "rows": [
       {
-        "type": "Translation",
-        "bundles": "Python venv + googletrans + multi-language config",
+        "type": "Current installation",
+        "bundles": "Static JSON catalogs for seven languages plus built-in English; no translation Python environment",
         "menuRich": "<strong>Change Language</strong> + Show Version + Uninstall"
       },
       {
-        "type": "Normal (lightweight)",
-        "bundles": "English-only, no venv, smaller footprint",
-        "menu": "Show Version + Uninstall (no language picker)"
+        "type": "Legacy Translation / Normal modes",
+        "bundles": "Obsolete split between a translation environment and an English-only installation",
+        "menu": "Update with the official installer to use the current unified menu"
       }
     ],
-    "detectionTitle": "Detection happens automatically",
-    "detectionBody": "The script checks for <code>/opt/googletrans-env/bin/activate</code> and a non-empty <code>language</code> key in <code>config.json</code>. Both present → Translation install. Either missing → Normal install. You don't choose; the menu adapts."
+    "detectionTitle": "Language selection is always available",
+    "detectionBody": "The menu no longer checks for a translation environment. Every installation includes <code>/usr/local/share/proxmenux/lang/</code> and saves the selected <code>language</code> in <code>config.json</code>."
   },
   "options": {
     "heading": "Menu options",
-    "intro": "Five tools. The <em>Conditional</em> badges mean the option only appears when the prerequisite is met (Monitor installed; Beta program active; Translation install).",
+    "intro": "The tools below manage ProxMenux itself. <em>Conditional</em> means the Monitor actions appear only when its systemd service is installed. Release channel, language, version diagnostics and uninstall are always available.",
     "list": [
       {
         "icon": "Activity",
@@ -64,7 +64,7 @@
         "icon": "Info",
         "href": "/docs/settings/show-version-information",
         "title": "Show Version Information",
-        "description": "ProxMenux version, install type, installed components, file paths, virtual environment state and current language."
+        "description": "ProxMenux version, release channel, installed components, file paths, translation files and current language."
       },
       {
         "icon": "Trash2",
diff --git a/web/messages/en/docs/settings/show-version-information.json b/web/messages/en/docs/settings/show-version-information.json
index c0fefa54..4e138cba 100644
--- a/web/messages/en/docs/settings/show-version-information.json
+++ b/web/messages/en/docs/settings/show-version-information.json
@@ -1,13 +1,13 @@
 {
   "meta": {
     "title": "Show Version Information | ProxMenux Documentation",
-    "description": "Read-only ProxMenux self-diagnostic: version number, install type (Translation / Normal), installed components from config.json, file paths, virtual environment state and current language.",
+    "description": "Read-only ProxMenux diagnostics: version, release channel, components recorded in config.json, file paths, translation catalogs and current language.",
     "ogTitle": "Show Version Information | ProxMenux Documentation",
-    "ogDescription": "Diagnostic dump of ProxMenux version, install type, components, files and language."
+    "ogDescription": "Diagnostic output of ProxMenux version, release channel, components, files and language."
   },
   "header": {
     "title": "Show Version Information",
-    "description": "Read-only diagnostic. Reads version.txt, config.json and a few well-known file paths, then renders a scrollable text box with version, install type, installed components, file presence, virtual environment state and current language.",
+    "description": "Read-only diagnostics. Reads version.txt, config.json and known file paths, then shows a scrollable text box with the version, release channel, installed components, file presence, translation files and current language.",
     "section": "Settings"
   },
   "intro": {
@@ -26,9 +26,9 @@
         "contentRich": "Single-line version number; <code>Unknown</code> if file missing"
       },
       {
-        "section": "Install type",
-        "source": "venv + config.json checks",
-        "content": "Translation (multi-language) or Normal (English-only)"
+        "section": "Release channel",
+        "source": "config.json beta-program status",
+        "content": "Stable (main) or Beta (develop); beta version when available"
       },
       {
         "section": "Installed components",
@@ -41,14 +41,14 @@
         "contentRich": "<code>menu</code>, <code>utils.sh</code>, <code>config.json</code>, <code>version.txt</code> presence + paths"
       },
       {
-        "section": "Virtual environment",
-        "source": "/opt/googletrans-env",
-        "content": "Translation install only — venv + pip presence"
+        "section": "Translation files",
+        "source": "/usr/local/share/proxmenux/lang/",
+        "content": "Presence of the lang/ directory included with every installation"
       },
       {
         "section": "Current language",
         "source": "config.json",
-        "contentRich": "Translation: language code from <code>.language</code>; Normal: <code>English (Fixed)</code>"
+        "contentRich": "Language code from <code>.language</code>; defaults to <code>en</code> when unset"
       }
     ]
   },
diff --git a/web/messages/en/docs/settings/uninstall-proxmenux.json b/web/messages/en/docs/settings/uninstall-proxmenux.json
index ff6433b6..66942d3e 100644
--- a/web/messages/en/docs/settings/uninstall-proxmenux.json
+++ b/web/messages/en/docs/settings/uninstall-proxmenux.json
@@ -1,7 +1,7 @@
 {
   "meta": {
     "title": "Uninstall ProxMenux | ProxMenux Documentation",
-    "description": "Clean ProxMenux uninstaller with optional dependency removal (jq, dialog, python3-*) and automatic restoration of /root/.bashrc and /etc/motd backups created at install time. Also removes the proxmenux-monitor service if present.",
+    "description": "Clean ProxMenux uninstaller with optional removal of jq and dialog, cleanup of legacy translation files and the Monitor service, and restoration of system-file backups.",
     "ogTitle": "Uninstall ProxMenux | ProxMenux Documentation",
     "ogDescription": "Cleanly remove ProxMenux from a Proxmox host with optional dependency cleanup."
   },
@@ -18,32 +18,32 @@
     "heading": "The uninstall flow",
     "items": [
       "<strong>Confirmation dialog.</strong> Yes/no — “Are you sure you want to uninstall ProxMenux?”",
-      "<strong>Dependency removal checklist.</strong> Pre-selected list depends on install type (see table below). All boxes default to OFF — you opt in to removing each dependency.",
-      "<strong>Removal runs with a progress bar.</strong> Removes the venv (Translation install only), the <code>menu</code> launcher, the <code>/usr/local/share/proxmenux/</code> tree, the ProxMenux Monitor service if present together with the notification target it registered in Proxmox VE (<code>proxmenux-webhook</code> and its matcher), the dependencies you ticked, and finally restores the system file backups (see below).",
+      "<strong>Dependency removal checklist.</strong> Offers jq and dialog. Both boxes are OFF by default; select only dependencies that no other application needs.",
+      "<strong>Removal runs with a progress bar.</strong> Removes any leftover legacy translation environment, the <code>menu</code> launcher, the <code>/usr/local/share/proxmenux/</code> tree, the ProxMenux Monitor service if present together with the notification target it registered in Proxmox VE (<code>proxmenux-webhook</code> and its matcher), the dependencies you ticked, and finally restores the system file backups (see below).",
       "<strong>Completion dialog.</strong> Lists removed dependencies and exits."
     ]
   },
   "deps": {
     "heading": "Dependency removal: what's offered",
-    "intro": "The checklist depends on install type. <strong>None of the boxes is checked by default</strong> — these are system-wide packages that other applications might use, so the safer default is to leave them.",
-    "headerType": "Install type",
+    "intro": "The checklist offers jq and dialog. <strong>Neither box is checked by default</strong>: other applications may use these system-wide packages, so keeping them is safer.",
+    "headerType": "Installation",
     "headerOffered": "Offered for removal",
     "rows": [
       {
-        "type": "Translation",
-        "offeredRich": "<code>python3-venv</code>, <code>python3-pip</code>, <code>python3</code>, <code>jq</code>"
+        "type": "Current releases",
+        "offeredRich": "<code>dialog</code>, <code>jq</code>"
       },
       {
-        "type": "Normal",
+        "type": "Legacy installations after updating",
         "offeredRich": "<code>dialog</code>, <code>jq</code>"
       }
     ],
     "warnTitle": "System-wide packages — think twice",
-    "warnBody": "<code>python3</code>, <code>jq</code> and <code>dialog</code> are commonly used by other tools (including Proxmox itself in some workflows). Removing <code>python3</code> in particular can break Proxmox helpers, Ceph utilities and many third-party scripts. Leave them unless you're positive nothing else needs them."
+    "warnBody": "The current checklist offers <code>jq</code> and <code>dialog</code>, not <code>python3</code>. These are system packages that other tools may need. Removal can also remove dependent packages or unused dependencies. Keep required packages and review any proposed removal before running apt manually."
   },
   "removed": {
     "heading": "What gets removed",
-    "code": "/usr/local/bin/menu                                  # the launcher\n/usr/local/share/proxmenux/                          # everything: scripts, config, cache, version\n/opt/googletrans-env/                                # virtual env (Translation install only)\n/etc/systemd/system/proxmenux-monitor.service        # Monitor service unit\n/root/.config/proxmenux-monitor/                     # Monitor config dir\n                                                     # + dependencies you ticked in the checklist"
+    "code": "/usr/local/bin/menu                                  # the launcher\n/usr/local/share/proxmenux/                          # everything: scripts, config, cache, version\n/opt/googletrans-env/                                # leftover legacy translation environment\n/etc/systemd/system/proxmenux-monitor.service        # Monitor service unit\n/root/.config/proxmenux-monitor/                     # Monitor config dir\n                                                     # + dependencies you ticked in the checklist"
   },
   "restored": {
     "heading": "What gets restored",
@@ -59,18 +59,18 @@
   "manual": {
     "heading": "Manual uninstall",
     "intro": "If for some reason the menu uninstaller can't run (e.g. <code>dialog</code> already missing), the equivalent manual sequence:",
-    "code": "# 1. Stop and remove the Monitor service (if installed)\nsystemctl stop proxmenux-monitor.service 2>/dev/null\nsystemctl disable proxmenux-monitor.service 2>/dev/null\nrm -f /etc/systemd/system/proxmenux-monitor.service\nrm -rf /root/.config/proxmenux-monitor\nsystemctl daemon-reload\nsystemctl reset-failed 2>/dev/null\n\n# 2. Remove the venv (Translation install only)\nrm -rf /opt/googletrans-env\n\n# 3. Remove ProxMenux files\nrm -f /usr/local/bin/menu\nrm -rf /usr/local/share/proxmenux\n\n# 4. Restore backups\n[ -f /root/.bashrc.bak ] && mv /root/.bashrc.bak /root/.bashrc\n[ -f /etc/motd.bak ] && mv /etc/motd.bak /etc/motd \\\n    || sed -i '/This system is optimised by: ProxMenux/d' /etc/motd"
+    "code": "# 1. Stop and remove the Monitor service (if installed)\nsystemctl stop proxmenux-monitor.service 2>/dev/null\nsystemctl disable proxmenux-monitor.service 2>/dev/null\nrm -f /etc/systemd/system/proxmenux-monitor.service\nrm -rf /root/.config/proxmenux-monitor\nsystemctl daemon-reload\nsystemctl reset-failed 2>/dev/null\n\n# 2. Remove a leftover legacy translation environment\nrm -rf /opt/googletrans-env\n\n# 3. Remove ProxMenux files\nrm -f /usr/local/bin/menu\nrm -rf /usr/local/share/proxmenux\n\n# 4. Restore backups\n[ -f /root/.bashrc.bak ] && mv /root/.bashrc.bak /root/.bashrc\n[ -f /etc/motd.bak ] && mv /etc/motd.bak /etc/motd \\\n    || sed -i '/This system is optimised by: ProxMenux/d' /etc/motd"
   },
   "reinstall": {
     "heading": "Reinstalling later",
-    "body": "Run the official ProxMenux installer again. Pick Translation or Normal as you prefer — the choice is independent of what you had before."
+    "body": "Run the official ProxMenux installer again. Current releases use one installation path with all eight interface languages included."
   },
   "troubleshoot": {
     "heading": "Troubleshooting",
-    "hangTitle": "Uninstall hangs at “Removing googletrans and virtual environment”",
-    "hangBody": "<code>pip uninstall</code> can stall if pip is unresponsive. From another shell: <code>rm -rf /opt/googletrans-env</code> directly (the script does the same as a fallback after pip).",
+    "hangTitle": "Uninstall stalls while removing a legacy translation environment",
+    "hangBody": "Current releases remove a leftover environment with <code>rm -rf /opt/googletrans-env</code>; they do not run <code>pip uninstall</code>. If this step stalls, inspect it from another shell and check the host filesystem before retrying.",
     "aptTitle": "apt warns about packages still in use during dependency removal",
-    "aptBody": "Expected if you ticked <code>python3</code> or <code>jq</code> while other things on the host depend on them. apt's <code>autoremove</code> will refuse to remove them in that case (which is the safe behaviour). Untick that dependency and re-run.",
+    "aptBody": "Selected packages are marked automatic and passed to <code>apt-get -y --purge autoremove</code>. This does not guarantee that dependent services are protected. Leave dependencies unchecked if other tools need them; review apt’s proposed removals before any manual cleanup.",
     "motdTitle": "MOTD still shows the ProxMenux line after uninstall",
     "motdBody": "Either no <code>/etc/motd.bak</code> existed and the sed strip didn't match (e.g. the line was modified). Edit <code>/etc/motd</code> by hand and remove any leftover ProxMenux line."
   },
diff --git a/web/messages/en/docs/storage-share/host-iscsi.json b/web/messages/en/docs/storage-share/host-iscsi.json
index 534271da..0bf78ea5 100644
--- a/web/messages/en/docs/storage-share/host-iscsi.json
+++ b/web/messages/en/docs/storage-share/host-iscsi.json
@@ -98,7 +98,7 @@
     "noLunTitle": "LUNs do not appear in /dev/disk/by-path after registering",
     "noLunBody": "<code>pvesm add iscsi</code> succeeded but the kernel is not seeing block devices. Check <code>iscsiadm --mode session</code> — if no session is active, start one manually with <code>iscsiadm --mode node --login</code>. If a session exists but no LUNs appear, force a rescan: <code>iscsiadm --mode session --rescan</code>. If still nothing, the target probably has no LUNs assigned to this IQN yet (configure LUN mapping on the target).",
     "chapTitle": "CHAP authentication",
-    "chapBody": "ProxMenux does not expose the CHAP username / password fields in the interactive flow. If your target requires CHAP, register with ProxMenux first (discovery with CHAP may fail, but <code>pvesm add</code> will still write the entry), then add credentials manually: <code>pvesm set &lt;id&gt; --username &lt;chap-user&gt;</code> and edit <code>/etc/iscsi/iscsid.conf</code> with the password, then <code>systemctl restart iscsid</code>. This is a gap in the current script — documented here so you know what to do."
+    "chapBody": "ProxMenux does not expose CHAP username/password fields in the interactive flow. If discovery fails, the script stops before <code>pvesm add</code>; it does not register the storage anyway. Configure the target’s CHAP requirements separately in <code>open-iscsi</code>, including discovery authentication when required, then retry. Use <code>iscsiadm</code> to check the configuration and verify active sessions with <code>iscsiadm --mode session</code>."
   },
   "related": {
     "heading": "Related",
diff --git a/web/messages/en/docs/storage-share/host-local-disk.json b/web/messages/en/docs/storage-share/host-local-disk.json
index 78ae2f67..056fbd3e 100644
--- a/web/messages/en/docs/storage-share/host-local-disk.json
+++ b/web/messages/en/docs/storage-share/host-local-disk.json
@@ -16,7 +16,7 @@
   },
   "destructive": {
     "title": "Destructive tool for the 'format' path",
-    "body": "The <em>Format</em> path <strong>erases every partition and byte on the selected disk</strong>. ProxMenux shows the disk list with a warning banner, filters out disks already in use, and requires an explicit confirmation before any <code>wipefs</code> / <code>sgdisk</code> / <code>mkfs</code> runs. Still — read the device path aloud twice before typing \"yes\"."
+    "body": "The <em>Format</em> path <strong>destroys the existing partitions and data on the selected disk</strong>. ProxMenux shows the disk list with a warning banner, filters out disks already in use, and requires confirmation before any <code>wipefs</code> / <code>sgdisk</code> / <code>mkfs</code> runs. This is not a secure overwrite of every byte. Double-check the device path before confirming."
   },
   "compare": {
     "heading": "Directory vs ZFS pool — which to pick",
@@ -78,7 +78,7 @@
       "Pick the filesystem — see the table above for trade-offs.",
       "Storage ID (default <code>disk-&lt;device&gt;</code>), mount path, content-type preset.",
       "Confirm at the <strong>FINAL CONFIRMATION — DATA WILL BE ERASED</strong> dialog.",
-      "ProxMenux wipes the partition table, creates one partition spanning the whole disk, runs <code>mkfs.&lt;fs&gt;</code> (or <code>zpool create</code>), mounts it, adds it to <code>/etc/fstab</code> by UUID with <code>defaults,nofail</code>, and registers it in Proxmox via <code>pvesm add dir</code> or <code>pvesm add zfspool</code>."
+      "ProxMenux clears the partition table and creates one partition spanning the disk. It runs <code>mkfs.&lt;fs&gt;</code> or <code>zpool create</code> and mounts the result. Regular filesystems get an entry in <code>/etc/fstab</code> by UUID with <code>defaults,nofail</code>; ZFS uses its pool mount configuration instead. If <em>As Proxmox storage</em> is marked (always the case for ZFS), it is then registered with <code>pvesm add dir</code> or <code>pvesm add zfspool</code>; otherwise it stays a host mount only."
     ],
     "tipTitle": "Why UUID + nofail in /etc/fstab",
     "tipBody": "The script writes <code>UUID=… /mnt/&lt;id&gt; &lt;fs&gt; defaults,nofail 0 2</code>. UUID survives device reordering across reboots (so <code>/dev/sdc</code> becoming <code>/dev/sdd</code> does not break boot). <code>nofail</code> means that if the disk ever disappears (hardware failure, unplugged), Proxmox still boots — storage will just show as inactive until the disk comes back."
@@ -97,7 +97,7 @@
   },
   "presets": {
     "heading": "Content-type presets",
-    "intro": "Instead of a long checklist, ProxMenux offers 4 presets plus a custom option. The preset string is passed to <code>pvesm add … --content &lt;csv&gt;</code>:",
+    "intro": "ProxMenux offers three presets plus a custom option. The selected content string is passed to <code>pvesm add … --content &lt;csv&gt;</code>:",
     "headerPreset": "Preset",
     "headerContent": "Content string",
     "headerUse": "Use case",
@@ -115,7 +115,7 @@
       {
         "preset": "All types",
         "content": "images,backup,iso,vztmpl,snippets",
-        "use": "\"Let the host decide\" — allows every content type Proxmox supports on this storage."
+        "use": "The broad preset shown here enables images, backups, ISOs, LXC templates and snippets. Add other supported types, such as rootdir, through Custom if needed."
       },
       {
         "preset": "Custom",
@@ -124,7 +124,7 @@
       }
     ],
     "zfsTitle": "ZFS pool content is narrower",
-    "zfsBody": "If you picked <strong>zfs</strong> as the filesystem, Proxmox only accepts <code>images</code> and <code>rootdir</code> as content types on a <code>zfspool</code> (it is block storage, not a filesystem for ISOs). The presets above will still work but Proxmox silently drops the content types it cannot use — check <code>pvesm status</code> afterwards."
+    "zfsBody": "If you picked <strong>zfs</strong>, a <code>zfspool</code> supports only <code>images</code> and <code>rootdir</code>, not ISO or backup files. Use Custom to enter a supported content list. The script forwards your selection unchanged; unsupported types may make registration fail. Check <code>pvesm status</code> afterwards."
   },
   "manual": {
     "heading": "Manual equivalent",
diff --git a/web/messages/en/docs/storage-share/host-local-shared.json b/web/messages/en/docs/storage-share/host-local-shared.json
index ec908059..2adf7958 100644
--- a/web/messages/en/docs/storage-share/host-local-shared.json
+++ b/web/messages/en/docs/storage-share/host-local-shared.json
@@ -37,8 +37,8 @@
     "rows": [
       {
         "bit": "1 (sticky)",
-        "effect": "Only the file owner can delete / rename a file.",
-        "why": "Prevents CT-A from deleting files created by CT-B in the same directory."
+        "effect": "Deleting or renaming a file is restricted to its owner, the directory owner or a suitably privileged process.",
+        "why": "Helps prevent users with different mapped UIDs from deleting each other’s files. It does not isolate CTs that share a mapped UID or privileged root access."
       },
       {
         "bit": "777 (rwx-rwx-rwx)",
@@ -48,7 +48,7 @@
       {
         "bit": "ACLs (default)",
         "effect": "Inherited on every newly created file / subdir.",
-        "why": "The permissions apply forever — new content keeps the open profile without re-running the script."
+        "why": "New content inherits the default ACLs without re-running the script. Applications can still request restrictive modes or change permissions later."
       }
     ],
     "privTitle": "Privileged CTs see the same thing, just without the shift",
diff --git a/web/messages/en/docs/storage-share/host-nfs.json b/web/messages/en/docs/storage-share/host-nfs.json
index e4b26d7a..fdff8644 100644
--- a/web/messages/en/docs/storage-share/host-nfs.json
+++ b/web/messages/en/docs/storage-share/host-nfs.json
@@ -46,13 +46,13 @@
       },
       {
         "method": "<strong>Both</strong>",
-        "mount": "Both paths above (two independent NFS connections to the server)",
+        "mount": "Both paths above (two mount points for the same NFS export)",
         "ui": "Yes",
-        "useCase": "You want UI integration AND a stable host-side path with open permissions for LXC bind-mounts. Server sees two connections from the host."
+        "useCase": "UI integration plus a separate stable host path with open permissions for LXC bind mounts."
       }
     ],
     "bothTitle": "\"Both\" creates two independent NFS mounts",
-    "bothBody": "Marking both options runs each method independently — pvesm mounts at <code>/mnt/pve/&lt;id&gt;</code>, fstab mounts at <code>/mnt/&lt;path&gt;</code>. The server sees two TCP connections from the Proxmox host. This is intentional: it lets you keep the pvesm storage clean (default Proxmox options) while having a separate host-side mount with open permissions for LXC bind-mounts."
+    "bothBody": "Both methods run separately: pvesm mounts at <code>/mnt/pve/&lt;id&gt;</code> and fstab at <code>/mnt/&lt;path&gt;</code>. This provides a Proxmox-managed mount with default options and a separate host mount for LXC bind mounts. Two mount points do not guarantee two separate TCP connections; the NFS client may reuse transport connections."
   },
   "pvesmBranch": {
     "heading": "Method A — As Proxmox storage (pvesm)",
@@ -94,7 +94,7 @@
       }
     ],
     "warnTitle": "images and rootdir on NFS",
-    "warnBody": "Marking <code>images</code> on an NFS storage lets Proxmox place live VM disks there. It works, but NFS latency + its lock semantics make this noticeably slower than local storage (and a network outage pauses every VM backed by that store). Marking <code>rootdir</code> means you will host LXC root filesystems over NFS, which historically has trouble with unprivileged containers (overlay / chown interactions). Prefer keeping <code>images</code> / <code>rootdir</code> on local or iSCSI storage and using NFS for <code>backup</code> / <code>iso</code> / <code>vztmpl</code>.",
+    "warnBody": "Selecting <code>images</code> lets Proxmox store VM disks on NFS. Performance depends on the network, server and workload; an outage can block I/O that depends on the mount. Selecting <code>rootdir</code> stores LXC root filesystems on NFS, where unprivileged containers can encounter UID mapping, overlay and ownership limitations. Assess these requirements before placing <code>images</code> / <code>rootdir</code> there; NFS is also useful for <code>backup</code> / <code>iso</code> / <code>vztmpl</code>.",
     "result": "The result is <code>pvesm add nfs &lt;id&gt; --server &lt;srv&gt; --export &lt;path&gt; --content &lt;csv&gt;</code> and Proxmox auto-mounts at <code>/mnt/pve/&lt;id&gt;</code>."
   },
   "fstabBranch": {
@@ -113,7 +113,7 @@
       "Attempts <code>chmod 1777</code> + <code>setfacl o::rwx</code> on the mount point (silent best-effort — only succeeds if the NFS server allows it; many NAS exports already serve world-writable paths)."
     ],
     "lxcTitle": "Using the fstab mount from an LXC",
-    "lxcBody": "The script prints the exact <code>pct set</code> command at the end to bind-mount the path into a container, e.g. <code>pct set &lt;ctid&gt; -mp0 /mnt/&lt;path&gt;,mp=/mnt/&lt;ct-path&gt;,shared=1,backup=0</code>. Or use the <mountLink>LXC Mount Manager</mountLink>, which detects the fstab mount automatically. <strong>No changes are made inside the container</strong> — for unprivileged LXCs to read/write the NFS data, the script relies on server-side world-writable export semantics (typical for Synology, TrueNAS, OMV defaults). If your NFS server squashes root or restricts perms, see Troubleshooting.",
+    "lxcBody": "The script prints a <code>pct set</code> command for a bind mount, e.g. <code>pct set &lt;ctid&gt; -mp0 /mnt/&lt;path&gt;,mp=/mnt/&lt;ct-path&gt;,shared=1,backup=0</code>. Or use the <mountLink>LXC Mount Manager</mountLink>, which detects fstab mounts. <strong>No changes are made inside the container</strong>. Access from an unprivileged CT depends on server-side permissions for its mapped UIDs/GIDs. The script only attempts host-side permission changes; it cannot guarantee writable exports or manufacturer defaults. See Troubleshooting if access fails.",
     "noUiTitle": "The fstab mount is NOT a Proxmox storage",
     "noUiBody": "The host fstab mount is invisible to the Proxmox web UI — by design. It does not appear in <em>Datacenter > Storage</em>, you cannot select it in the VM / CT creator, and Proxmox backup jobs cannot target it. It is purely a host filesystem path. If you also want UI integration, mark <em>both</em> methods in the picker."
   },
@@ -145,9 +145,9 @@
     "showmountTitle": "\"Failed to connect\" from showmount",
     "showmountBody": "The server refused the export-list query. Common causes: the server enforces strict client ACLs (your Proxmox IP is not on the allowed list), <code>rpcbind</code> is not running on the server, or the server exposes only NFSv4 with <code>showmount</code> disabled. The export path can still be added manually if you know it.",
     "inactiveTitle": "Storage shows as inactive in the Proxmox UI",
-    "inactiveBody": "Run <em>Test NFS Connectivity</em> first — 99 % of the time this flags the exact hop that breaks (DNS, port, mount permissions). If connectivity is fine but Proxmox still flags inactive, check <code>journalctl -u pvestatd</code> on the Proxmox node; intermittent DNS or slow NFS mounts on boot can leave storages in an inactive state until <code>pvesm set &lt;id&gt; --disable 0</code> is re-applied.",
+    "inactiveBody": "Run <em>Test NFS Connectivity</em> first: it checks that the server answers ping, that port 2049 is open and that the export list (<code>showmount -e</code>) is available. If connectivity works but storage remains inactive, inspect <code>journalctl -u pvestatd</code> and the server/export configuration. Restore the underlying connectivity or permissions first. <code>pvesm set &lt;id&gt; --disable 0</code> enables a disabled storage; it is not a general repair for NFS failures.",
     "lxcNoWriteTitle": "fstab mount works but unprivileged LXC can't write through a bind-mount",
-    "lxcNoWriteBody": "NFS permissions are enforced server-side, not by the host. The fstab options (<code>uid=</code>, <code>file_mode=</code>) that work for CIFS do <strong>not</strong> apply to NFS. If your unprivileged LXC (root inside CT = UID 100000 on host, mapped to NFS as \"others\") cannot write, the NFS server is either squashing root or has restrictive perms. Fix on the server: change the export to <code>no_root_squash</code> if you trust the host, or set the export world-writable (Synology, TrueNAS, OMV all expose this in the UI). The script tries <code>chmod 1777</code> on the mount but that only succeeds when the server permits it.",
+    "lxcNoWriteBody": "NFS access depends on server-side ownership, ACLs and squash settings. CIFS-style options such as <code>uid=</code> and <code>file_mode=</code> do <strong>not</strong> apply to NFS. With default LXC mapping, CT root becomes host UID 100000, not remote UID 0. Configure access for the actual mapped UID/GID or the server’s anonymous identity. <code>no_root_squash</code> only affects remote UID 0, so it is not a universal fix for UID 100000. The script attempts <code>chmod 1777</code> but cannot override the server’s permissions.",
     "fstabBootTitle": "fstab mount does not come up after reboot",
     "fstabBootBody": "The script adds <code>nofail,_netdev</code> so a missing share at boot does not block startup. If the mount never comes up: confirm the network is reachable (<code>ping &lt;server&gt;</code>), check <code>journalctl -u remote-fs.target</code>, and verify the entry is valid with <code>mount -fav | grep nfs</code>. <code>mount -a</code> after boot mounts everything that is currently missing."
   },
diff --git a/web/messages/en/docs/storage-share/host-samba.json b/web/messages/en/docs/storage-share/host-samba.json
index 52698240..bd3de8d7 100644
--- a/web/messages/en/docs/storage-share/host-samba.json
+++ b/web/messages/en/docs/storage-share/host-samba.json
@@ -12,7 +12,7 @@
   },
   "intro": {
     "title": "What this does",
-    "body": "ProxMenux offers two mount methods for any Samba share: <strong>(1) Proxmox storage</strong> via <code>pvesm add cifs</code> — visible in Datacenter > Storage, mounted at <code>/mnt/pve/&lt;id&gt;</code>, credentials stored encrypted in <code>/etc/pve/priv/storage/&lt;id&gt;.pw</code>; <strong>(2) Host fstab mount</strong> at a path you pick — persistent via <code>/etc/fstab</code>, mounted with <code>uid=0,gid=0,file_mode=0777,dir_mode=0777</code> so unprivileged LXC bind-mounts can write, credentials stored in a root-only <code>/etc/samba/credentials/</code> file (password never in <code>fstab</code>). You can run one method, the other, or both."
+    "body": "ProxMenux offers two mount methods for a Samba share: <strong>(1) Proxmox storage</strong> via <code>pvesm add cifs</code>, visible in Datacenter > Storage and mounted at <code>/mnt/pve/&lt;id&gt;</code>. The password is stored as plaintext in <code>/etc/pve/priv/storage/&lt;id&gt;.pw</code>, protected by the root-only private directory; this is access control, not encryption. <strong>(2) Host fstab mount</strong> at a chosen path, persistent through <code>/etc/fstab</code> and mounted with <code>uid=0,gid=0,file_mode=0777,dir_mode=0777</code> so unprivileged LXC bind mounts can write. Its credentials are in a root-only file under <code>/etc/samba/credentials/</code>, never directly in <code>fstab</code>. Either or both methods can be used."
   },
   "opening": {
     "heading": "Opening the tool",
@@ -41,24 +41,24 @@
         "method": "<strong>Host fstab only</strong>",
         "mountRich": "<code>/mnt/&lt;path&gt;</code> with open uid/gid/file_mode",
         "ui": "No",
-        "useCaseRich": "Bind-mounting the share into one or more LXCs <em>without</em> exposing it as a Proxmox storage. Open perms guarantee unprivileged CTs can write through the bind-mount."
+        "useCaseRich": "Bind-mount the share into one or more LXCs <em>without</em> registering Proxmox storage. Open local permissions help unprivileged CTs access it, but writing still requires permission from the SMB server for the authenticated user."
       },
       {
         "method": "<strong>Both</strong>",
-        "mount": "Both paths above (two independent CIFS connections to the server)",
+        "mount": "Both paths above (two mount points for the same CIFS export)",
         "ui": "Yes",
         "useCase": "You want UI integration AND a stable host-side path with open permissions for LXC bind-mounts. The pvesm mount uses Proxmox defaults; the fstab mount applies the open uid/gid/file_mode separately."
       }
     ],
-    "bothTitle": "\"Both\" creates two independent CIFS connections",
-    "bothBody": "pvesm and fstab mount the same share twice with different options. The pvesm mount at <code>/mnt/pve/&lt;id&gt;</code> uses Proxmox defaults (no open uid/gid) — Proxmox UI is happy. The fstab mount at <code>/mnt/&lt;path&gt;</code> uses <code>uid=0,gid=0,file_mode=0777,dir_mode=0777</code> — unprivileged LXC bind-mounts to it can write. Two TCP connections to the SMB server from the same Proxmox host."
+    "bothTitle": "“Both” creates two CIFS mount points",
+    "bothBody": "pvesm mounts at <code>/mnt/pve/&lt;id&gt;</code> with Proxmox defaults. fstab mounts at <code>/mnt/&lt;path&gt;</code> with <code>uid=0,gid=0,file_mode=0777,dir_mode=0777</code> to permit local access through LXC bind mounts. The SMB server still enforces the mounted user’s permissions. These are two mount points; they do not guarantee two separate TCP connections."
   },
   "pvesmBranch": {
     "heading": "Method A — As Proxmox storage (pvesm)",
     "intro": "If <em>As Proxmox storage</em> is marked, ProxMenux runs the original pvesm flow:",
     "items": [
       "<strong>Storage ID</strong> — default <code>cifs-&lt;server-ip-with-dashes&gt;</code>. Only letters, digits, <code>-</code> and <code>_</code>.",
-      "<strong>Content types</strong> — CIFS exposes <strong>6</strong> options (same as NFS minus <code>rootdir</code>, which Proxmox does not allow on CIFS because the locking semantics cannot hold a live LXC rootfs):"
+      "<strong>Content types</strong> — this ProxMenux checklist offers <strong>6</strong> choices. It omits <code>rootdir</code> compared with the NFS checklist; this is a script-level choice, not a claim that every Proxmox CIFS backend version forbids LXC root filesystems:"
     ],
     "headerType": "Content type",
     "headerAllows": "What it allows",
@@ -89,16 +89,16 @@
       }
     ],
     "warnTitle": "Live VM disks on CIFS",
-    "warnBody": "If you tick <code>images</code>, ProxMenux pops up a warning before continuing. CIFS uses an advisory locking model that interacts badly with KVM disk operations (snapshots, live migration, I/O under contention). A backup or ISO store on CIFS is perfectly fine; a live-disk store is asking for trouble. Use NFS (or local storage) for <code>images</code> when you can.",
+    "warnBody": "Selecting <code>images</code> triggers a ProxMenux warning that CIFS/SMB can cause locking issues with VM disk operations. The script recommends NFS for VM disk images but lets you continue. Backups and ISOs are common CIFS uses. Assess locking, snapshots, migration and workload requirements before using CIFS for <code>images</code>.",
     "credsTitle": "Where pvesm stores credentials",
-    "credsBody": "When you use User authentication, the password is NOT written in <code>/etc/pve/storage.cfg</code>. Proxmox keeps it in <code>/etc/pve/priv/storage/&lt;storage-id&gt;.pw</code> — mode <code>0600</code>, owner <code>root</code>, member of the cluster sync. If you later change the password on the Samba server, use <code>pvesm set &lt;id&gt; --password &lt;new&gt;</code> or remove and re-add through ProxMenux."
+    "credsBody": "The password is not written in <code>/etc/pve/storage.cfg</code>. Proxmox writes plaintext credentials in <code>/etc/pve/priv/storage/&lt;storage-id&gt;.pw</code>, inside the private area of the cluster filesystem, readable only by <code>root</code> (mode <code>0600</code>); it is protected by access control, not by encryption. After a server password change, use <code>pvesm set &lt;id&gt; --password &lt;new&gt;</code> or remove and re-add through ProxMenux."
   },
   "fstabBranch": {
     "heading": "Method B — Host fstab mount only",
     "intro": "If <em>As host fstab mount only</em> is marked, ProxMenux asks for a host mount path and persistent options, writes a root-only credentials file (User mode), then mounts and writes the entry to <code>/etc/fstab</code>:",
     "items": [
       "<strong>Host mount path</strong> — default <code>/mnt/&lt;share-name&gt;</code>. Must be an absolute path. If something is already mounted there, or a fstab entry exists, ProxMenux offers to replace it.",
-      "<strong>Mount options</strong> — pick <em>Read/Write</em> (default with <code>rw,uid=0,gid=0,file_mode=0777,dir_mode=0777,iocharset=utf8,nofail,_netdev</code>), <em>Read-only</em> (read-only variant with <code>file_mode=0555,dir_mode=0555</code>), or <em>Custom</em> (type your own option string). Open uid/gid/file_mode are always recommended for LXC bind-mount writes."
+      "<strong>Mount options</strong> — choose <em>Read/Write</em> (default: <code>rw,uid=0,gid=0,file_mode=0777,dir_mode=0777,iocharset=utf8,nofail,_netdev</code>), <em>Read-only</em> (<code>file_mode=0555,dir_mode=0555</code>), or <em>Custom</em> (enter your own options). The script recommends open uid/gid/file_mode for writes through LXC bind mounts."
     ],
     "credsTitle": "Credentials file (User mode)",
     "credsBody": "If you authenticated with a username + password, ProxMenux writes a root-only credentials file at <code>/etc/samba/credentials/&lt;server&gt;_&lt;share&gt;.cred</code> (mode <code>0600</code>) with <code>username=</code> and <code>password=</code> lines, and references it in the fstab entry via the <code>credentials=</code> mount option. Plain text never lands in <code>/etc/fstab</code>. For Guest mode, the option <code>guest</code> is appended instead and no credentials file is created.",
@@ -110,7 +110,7 @@
       "Runs <code>systemctl daemon-reload</code> so systemd picks up the new fstab entry."
     ],
     "lxcTitle": "Using the fstab mount from an unprivileged LXC",
-    "lxcBody": "Because the CIFS client applies <code>uid=0,gid=0,file_mode=0777,dir_mode=0777</code>, every file in the mount is owned by host UID 0 with mode 0777. An unprivileged LXC bind-mounting the path sees \"others\" perms on every entry (CT root = host UID 100000 = others on the host filesystem), so reads and writes succeed. <strong>No changes are made inside the container</strong> — no <code>chown</code> in the CT, no group setup, nothing modified in <code>/etc/lxc</code> beyond the single <code>mp</code> bind-mount line. The script prints the exact <code>pct set</code> command at the end, or use the <mountLink>LXC Mount Manager</mountLink> to attach the path.",
+    "lxcBody": "The CIFS options <code>uid=0,gid=0,file_mode=0777,dir_mode=0777</code> open local permission checks for LXC bind mounts. Server ACLs and negotiated Unix/POSIX semantics can still affect access. <strong>No changes are made inside the container</strong>: no CT <code>chown</code>, groups or edits to <code>/etc/lxc</code>. The <code>mp</code> line is managed in Proxmox CT configuration. Use the printed <code>pct set</code> command or the <mountLink>LXC Mount Manager</mountLink>.",
     "noUiTitle": "The fstab mount is NOT a Proxmox storage",
     "noUiBody": "The host fstab mount is invisible to the Proxmox web UI — by design. It does not appear in <em>Datacenter > Storage</em>, you cannot select it in the VM / CT creator, and Proxmox backup jobs cannot target it. It is purely a host filesystem path. If you also want UI integration, mark <em>both</em> methods in the picker."
   },
@@ -121,12 +121,12 @@
     "fstabGuestIntro": "Method B (fstab, guest auth) — no credentials file:"
   },
   "view": {
-    "heading": "View configured CIFS storages",
-    "body": "Lists every CIFS entry in Proxmox (<code>pvesm status | awk ''$2 == \"cifs\"''</code>) with server, share, content types, username (or <em>Guest</em>), mount path and live status. Password is <strong>never printed</strong>. <strong>Note:</strong> this view only shows pvesm-registered storages — fstab-only mounts are not listed. Check those with <code>findmnt -t cifs</code> or <code>grep cifs /etc/fstab</code>."
+    "heading": "View configured CIFS storages and host mounts",
+    "body": "Shows registered CIFS storages (<code>pvesm status | awk ''$2 == \"cifs\"''</code>) with server, share, content, username or <em>Guest</em>, path and status. Passwords are <strong>never printed</strong>. <strong>Note:</strong> a second section lists host fstab mounts, their options, authentication-file path and active/inactive state. For manual checks use <code>findmnt -t cifs</code> or <code>grep cifs /etc/fstab</code>."
   },
   "remove": {
-    "heading": "Remove CIFS storage",
-    "body": "Runs <code>pvesm remove &lt;storage-id&gt;</code> after a confirmation that shows the server / share / content. Only the Proxmox-side registration is removed — <strong>the remote Samba server is not touched</strong>. Proxmox also deletes the paired credentials file. To remove a fstab-only mount, edit <code>/etc/fstab</code> by hand, run <code>umount &lt;path&gt;</code>, and remove the file from <code>/etc/samba/credentials/</code>.",
+    "heading": "Remove CIFS storage or a host mount",
+    "body": "The removal picker offers pvesm storages and host fstab mounts. For pvesm, it runs <code>pvesm remove &lt;storage-id&gt;</code> and Proxmox removes the paired credentials. For fstab, it attempts <code>umount &lt;path&gt;</code>, removes the matching <code>/etc/fstab</code> entry and credentials under <code>/etc/samba/credentials/</code>, and removes an empty mount directory if possible. A failed unmount requires a manual unmount or reboot. <strong>The remote Samba server and its files are not modified</strong>.",
     "warnTitle": "Back up dependencies first",
     "warnBody": "VMs, CTs or backup jobs that reference this storage by ID will fail after removal. Move / drop those references before removing the storage."
   },
@@ -145,7 +145,7 @@
     "sleepTitle": "\"host is down\" or storage status goes inactive at night",
     "sleepBody": "Some NAS appliances put SMB to sleep aggressively. <code>pvestatd</code> then sees the storage as inactive until the first access wakes the NAS. If this is cosmetic, nothing is broken. If it causes backup failures, disable SMB idle disconnect on the NAS or schedule backups outside the sleep window.",
     "lxcNoWriteTitle": "Unprivileged LXC bind-mount can't write to the fstab path",
-    "lxcNoWriteBody": "Confirm the mount uses the open options: <code>findmnt /mnt/&lt;path&gt;</code> should show <code>uid=0,gid=0,file_mode=0777,dir_mode=0777</code>. If a Custom option string omits those, an unprivileged LXC will get permission denied (CT UIDs map to host \"others\", which without open file_mode have no write bit). Re-mount with the default RW preset or add the four options back to your custom string.",
+    "lxcNoWriteBody": "Check <code>findmnt /mnt/&lt;path&gt;</code> for the intended options, such as <code>uid=0,gid=0,file_mode=0777,dir_mode=0777</code>. Missing local write permissions can block mapped LXC UIDs. Reapply the default RW preset or adjust Custom options as needed. Also verify the mounted SMB user can write on the server and whether Unix/POSIX extensions supply server modes; open local modes cannot override server ACLs.",
     "fstabBootTitle": "fstab mount does not come up after reboot",
     "fstabBootBody": "The script adds <code>nofail,_netdev</code> so a missing share at boot does not block startup. If the mount never comes up: confirm the network is reachable (<code>ping &lt;server&gt;</code>), check <code>journalctl -u remote-fs.target</code>, verify the credentials file still exists (<code>ls -l /etc/samba/credentials/</code>) and is readable, and try <code>mount -a</code> manually."
   },
diff --git a/web/messages/en/docs/storage-share/index.json b/web/messages/en/docs/storage-share/index.json
index 21bfaf95..77a72916 100644
--- a/web/messages/en/docs/storage-share/index.json
+++ b/web/messages/en/docs/storage-share/index.json
@@ -121,7 +121,7 @@
   },
   "privReq": {
     "title": "Privileged container requirement",
-    "body": "The four <strong>LXC network sharing</strong> flows above require a <strong>privileged</strong> container — the kernel modules (<code>nfs-kernel-server</code>, <code>smbd</code>, <code>mount.nfs</code>, <code>mount.cifs</code>) need capabilities that unprivileged CTs do not expose. If you only need to share files between the host and an unprivileged CT, use the <mountLink>LXC Mount Manager</mountLink> instead — it bind-mounts from the host and adjusts permissions on the host side so the container can read and write without any kernel-module magic."
+    "body": "The four <strong>LXC network sharing</strong> flows above require a <strong>privileged</strong> container. The scripts enforce this supported mode before configuring the services and mount tools (<code>nfs-kernel-server</code>, <code>smbd</code>, <code>mount.nfs</code>, <code>mount.cifs</code>). If you only need to share files between the host and an unprivileged CT, use the <mountLink>LXC Mount Manager</mountLink> instead — it bind-mounts from the host and adjusts permissions on the host side so the container can read and write without configuring these services or mount tools inside it."
   },
   "unprivExplain": {
     "title": "How ProxMenux handles unprivileged CT permissions",
diff --git a/web/messages/en/docs/storage-share/lxc-mount-points.json b/web/messages/en/docs/storage-share/lxc-mount-points.json
index 227c07b7..71e2fdf0 100644
--- a/web/messages/en/docs/storage-share/lxc-mount-points.json
+++ b/web/messages/en/docs/storage-share/lxc-mount-points.json
@@ -24,7 +24,7 @@
     "arrowLabel": "bind mount",
     "outro": "The host path on the left and the container path on the right can be different — for example, <code>/mnt/nas-films</code> on the host can become <code>/media/films</code> inside the container. The script adds the entry to the container config (<code>/etc/pve/lxc/&lt;ctid&gt;.conf</code>) using the next free <code>mpN</code> index, with two safe-defaults baked in:",
     "items": [
-      "<code>shared=1</code> — tells Proxmox the data is shared storage, so it does not try to migrate the disk when you migrate the container.",
+      "<code>shared=1</code> — tells Proxmox the mount uses shared data, so it does not migrate the data with the CT. This flag does not replicate data: the same path and data must already be available on the destination node.",
       "<code>backup=0</code> — excludes the bind mount from <code>vzdump</code> backups (the data lives on the host, you back it up separately)."
     ]
   },
@@ -64,7 +64,7 @@
     "idmapChangesRich": "Custom UID/GID mapping in <code>/etc/pve/lxc/&lt;CTID&gt;.conf</code> plus matching <code>/etc/subuid</code> + <code>/etc/subgid</code> entries on the host. CT must be restarted on every change.",
     "idmapWhenRich": "You need a <em>specific</em> UID inside the CT to map to a <em>specific</em> UID on the host (e.g. <code>media:1000</code> in the CT must own files as <code>media:1000</code> on the host so NFS doesn't squash). A more rigid setup, normally only worth it for that exact scenario.",
     "idmapTipTitle": "When you actually need lxc.idmap",
-    "idmapTipBody": "If the LXC Mount Manager doesn't cover your case — typically because you need files written from inside the CT to land on the host as a specific UID/GID (NFS exports with <code>all_squash</code>, Samba shares with strict ownership, sharing a directory with a host user that has the same name as someone inside the CT) — that is the moment to add <code>lxc.idmap</code> entries by hand. The Mount Manager won't fight you: the bind-mount line it wrote is independent of any idmap configuration you add later."
+    "idmapTipBody": "Use manual ID mapping when files written in the CT must appear on the host under a specific numeric UID/GID, for example to share ownership with a host user. It cannot override NFS <code>all_squash</code>; the server still decides the anonymous identity and permissions. Add <code>lxc.idmap</code> entries by hand if needed. The Mount Manager’s bind-mount line is independent of those entries."
   },
   "opening": {
     "heading": "Opening the tool",
diff --git a/web/messages/en/docs/storage-share/lxc-nfs-client.json b/web/messages/en/docs/storage-share/lxc-nfs-client.json
index 1a386046..fb9c779d 100644
--- a/web/messages/en/docs/storage-share/lxc-nfs-client.json
+++ b/web/messages/en/docs/storage-share/lxc-nfs-client.json
@@ -56,7 +56,7 @@
       }
     ],
     "netEffectTitle": "Net effect",
-    "netEffectBody": "Your container always boots, even if the NFS server is offline. The first time something touches the mount path, systemd quietly mounts it. If the server is still down, that one access fails with <em>resource temporarily unavailable</em> — but nothing else in the CT is affected."
+    "netEffectBody": "The NFS filesystem is mounted on <em>first access</em> rather than eagerly during boot. If the server is offline, that access may wait or fail, and services that depend on the path can be affected. Automount reduces the boot-time dependency; it does not guarantee that every CT service is unaffected by an unavailable NFS server."
   },
   "manual": {
     "heading": "Manual equivalent",
diff --git a/web/messages/en/docs/storage-share/lxc-nfs-server.json b/web/messages/en/docs/storage-share/lxc-nfs-server.json
index ba03b018..2dad3d80 100644
--- a/web/messages/en/docs/storage-share/lxc-nfs-server.json
+++ b/web/messages/en/docs/storage-share/lxc-nfs-server.json
@@ -27,9 +27,9 @@
     "heading": "The \"sharedfiles\" group convention",
     "body": "Before exporting the folder, ProxMenux creates a group called <code>sharedfiles</code> with <strong>GID 101000</strong> inside the container, adds every regular user to it, then sets the export directory to <code>root:sharedfiles</code> with mode <code>2775</code>. The <code>2</code> at the front is the SGID bit — every file or folder created inside automatically inherits the <code>sharedfiles</code> group.",
     "gidTitle": "Why GID 101000 specifically",
-    "gidBody": "It maps to host GID <strong>1000</strong> when an unprivileged container reads the same file (LXC default idmap shifts everything by +100000). In the current ProxMenux flow the NFS server itself runs in a <strong>privileged</strong> CT (no shift on its side), but the convention keeps the group ID numerically consistent with unprivileged client CTs that may mount this share later. Two privileged CTs both using <code>sharedfiles</code> at GID 101000 can read / write each other's files cleanly because the GID numbers match end-to-end.",
-    "remapTitle": "The script also creates 'remap_*' users — they are vestigial here",
-    "remapBody": "For every regular user in the CT (and for common UIDs like 33 = www-data, 1000, 1001, 1002), the script creates a parallel <code>remap_&lt;uid&gt;</code> user with UID = <code>&lt;uid&gt; + 100000</code>, all members of <code>sharedfiles</code>. The <code>+100000</code> shift mimics the LXC unprivileged idmap, but since this script enforces a <strong>privileged</strong> CT (no shift), those <code>remap_*</code> users are shadow accounts with no real-world counterpart on the host. They are harmless leftovers from a more ambitious design intent. If you don't see them in <code>getent passwd</code>, nothing breaks."
+    "gidBody": "With the default LXC ID map (+100000), host GID 101000 appears as GID <strong>1000</strong> inside an unprivileged CT. This server flow uses a <strong>privileged</strong> CT, where there is no shift. Two privileged CTs using <code>sharedfiles</code> at GID 101000 therefore share the same numeric group ID.",
+    "remapTitle": "Legacy 'remap_*' user creation is skipped for privileged CTs",
+    "remapBody": "The legacy unprivileged branch would create <code>remap_&lt;uid&gt;</code> users with UID <code>&lt;uid&gt; + 100000</code>, all in <code>sharedfiles</code>, for regular users and common UIDs (33, 1000, 1001, 1002). This <code>+100000</code> shift is irrelevant in the <strong>privileged</strong> CTs required by this flow, so the script skips that branch. Missing <code>remap_*</code> accounts in <code>getent passwd</code> are expected and do not indicate a failure."
   },
   "defaults": {
     "heading": "Default export options — read this first",
diff --git a/web/messages/en/docs/storage-share/lxc-samba-client.json b/web/messages/en/docs/storage-share/lxc-samba-client.json
index 38c71d6a..e3b91673 100644
--- a/web/messages/en/docs/storage-share/lxc-samba-client.json
+++ b/web/messages/en/docs/storage-share/lxc-samba-client.json
@@ -38,7 +38,7 @@
   },
   "creds": {
     "heading": "Where the password lives",
-    "body": "ProxMenux <strong>never stores the password in plain text</strong> in the mount command or in <code>/etc/fstab</code>. Instead it writes a credentials file inside the CT:",
+    "body": "ProxMenux <strong>does not put the password in the mount command</strong> or in <code>/etc/fstab</code>. It writes a credentials file inside the CT instead. That file contains plaintext credentials protected by root-only permissions; it is not encrypted:",
     "whyTitle": "Why a separate file rather than fstab",
     "whyBody": "The CIFS module accepts <code>username=</code> / <code>password=</code> options inline in fstab, but anyone who can read <code>/etc/fstab</code> sees the password in clear. Putting credentials in a root-only file and pointing fstab at it (<code>credentials=</code>) keeps the password out of world-readable config."
   },
@@ -85,7 +85,7 @@
       }
     ],
     "netEffectTitle": "Net effect of the fstab flags",
-    "netEffectBody": "Your container always boots, even if the Samba server is offline. The first time something touches the mount path, systemd quietly mounts it. If the server is still down, that one access fails with <em>resource temporarily unavailable</em> — but nothing else in the CT is affected."
+    "netEffectBody": "The CIFS filesystem is mounted on <em>first access</em> rather than eagerly during boot. If the server is offline, that access may wait or fail, and services that depend on the path can be affected. Automount reduces the boot-time dependency; it does not guarantee that every CT service is unaffected by an unavailable CIFS server."
   },
   "manual": {
     "heading": "Manual equivalent",
diff --git a/web/messages/en/docs/storage-share/lxc-samba-server.json b/web/messages/en/docs/storage-share/lxc-samba-server.json
index 8cc9f1d9..dd0b9d0b 100644
--- a/web/messages/en/docs/storage-share/lxc-samba-server.json
+++ b/web/messages/en/docs/storage-share/lxc-samba-server.json
@@ -103,7 +103,7 @@
     "noShareTitle": "Client connects but cannot see the share",
     "noShareBody": "Check that <code>browseable = yes</code> is set in the share block (default for rw / ro modes; may be missing in custom). Also check the CT firewall and the Proxmox host firewall allow TCP 445 (SMB) and 139 (NetBIOS). Some Windows clients also require name resolution — try the IP directly first.",
     "authTitle": "Authentication fails (NT_STATUS_LOGON_FAILURE)",
-    "authBody": "Either the wrong password (Samba passwords are <em>separate</em> from system passwords — see them with <code>pdbedit -L</code>) or the user is not in <code>valid users</code> for that share. Reset the password with <code>smbpasswd &lt;user&gt;</code> inside the CT.",
+    "authBody": "Either the password is wrong (Samba passwords are <em>separate</em> from system passwords; list Samba users with <code>pdbedit -L</code>) or the user is not in <code>valid users</code> for that share. Reset the password with <code>smbpasswd &lt;user&gt;</code> inside the CT.",
     "groupTitle": "Files written by the client appear with wrong group on the server",
     "groupBody": "The script sets <code>force group = sharedfiles</code> in the share block, so new files should be group <code>sharedfiles</code>. If they aren't, the SGID bit on the parent directory may have been lost (someone ran <code>chmod</code> by hand). Reapply: <code>chmod 2775 /mnt/&lt;share&gt;</code>.",
     "bothTitle": "Sharing the same folder over both NFS and Samba",
diff --git a/web/messages/en/docs/utils/export-vm.json b/web/messages/en/docs/utils/export-vm.json
index 66659468..a5eaafad 100644
--- a/web/messages/en/docs/utils/export-vm.json
+++ b/web/messages/en/docs/utils/export-vm.json
@@ -46,7 +46,7 @@
       {
         "format": "OVF",
         "output": "name-vmid-ts-ovf/",
-        "pros": "~120% disk overhead. Easier to inspect (descriptor is plain XML). Can edit before importing.",
+        "pros": "~120% of virtual disk size. Easier to inspect (descriptor is plain XML). Can edit before importing.",
         "cons": "Multiple files — must transfer all of them together."
       }
     ]
@@ -55,7 +55,7 @@
     "heading": "Destination directory",
     "body": "Pick from presets (<code>/var/lib/vz/dump</code>, <code>/var/lib/vz/template/iso</code>) or enter a manual path. The script validates the directory is writeable and warns if free space looks tight before starting.",
     "calloutTitle": "Free space rule of thumb",
-    "calloutBody": "For an OVF export of a VM with disks totalling 100 GB virtual: budget ~120 GB free. For an OVA: budget ~220 GB. Sparse / mostly-empty disks may use less, but the conversion writes them out fully before the OVA TAR step compresses anything. If you run out of space mid-export, the temp directory is cleaned up by the EXIT trap and you start over."
+    "calloutBody": "For an OVF export of a VM with disks totalling 100 GB virtual: budget ~120 GB free. For an OVA: budget ~220 GB. Actual usage may be lower for mostly-empty disks. The OVA archive is created with uncompressed TAR while the temporary VMDK files still exist, so allow space for both. If you run out of space mid-export, the temp directory is cleaned up by the EXIT trap and you start over."
   },
   "package": {
     "heading": "What ends up in the package",
@@ -120,8 +120,8 @@
     "noSpaceBody": "Destination ran out of space. The temp directory is auto-cleaned by the EXIT trap. Pick a destination with more headroom (rule of thumb above) and re-run.",
     "unsupportedHwTitle": "Export completes but VMware refuses to import: \"Unsupported hardware family\"",
     "unsupportedHwBody": "Some ESXi versions reject OVF descriptors that declare a hardware family they don't recognise. Open the .ovf in a text editor (or extract the .ova first), find <code>&lt;vssd:VirtualSystemType&gt;</code> and edit it to a value ESXi accepts (e.g. <code>vmx-13</code> for ESXi 6.5+). For a quick workaround, try VirtualBox — it's more permissive.",
-    "nicTitle": "Imported VM in VMware has e1000 NIC but I want VirtIO",
-    "nicBody": "Expected — the OVF only stores the NIC count, not the model. Edit the imported VM's NIC settings in VMware after import. Same applies for SCSI controller (export uses lsilogic for VMware compatibility; change to <code>VirtIO SCSI</code> if your guest supports it).",
+    "nicTitle": "Imported VM uses a different NIC or SCSI controller",
+    "nicBody": "The OVF preserves the NIC count, not the original model. Review the imported VM’s network settings in the destination hypervisor. The export declares an lsilogic SCSI controller for VMware compatibility. When importing back into Proxmox with ProxMenux, the VM is created with an LSI controller and e1000 NICs; switch to <code>VirtIO SCSI</code> and VirtIO afterwards if the guest has suitable drivers.",
     "runningTitle": "VM was running and I declined to stop it — export aborted",
     "runningBody": "The script can't produce a consistent image while disks are being written. Either accept the shutdown prompt next time, or stop the VM manually first (<code>qm shutdown $VMID</code>) and re-run.",
     "slowTitle": "Disk conversion is slow",
diff --git a/web/messages/en/docs/utils/import-vm.json b/web/messages/en/docs/utils/import-vm.json
index 66637d61..4075942c 100644
--- a/web/messages/en/docs/utils/import-vm.json
+++ b/web/messages/en/docs/utils/import-vm.json
@@ -40,7 +40,7 @@
       },
       {
         "label": "qm create + importdisk",
-        "detail": "qm create $VMID\nqm importdisk\n(VMDK → qcow2)\nqm set --scsiN",
+        "detail": "qm create $VMID\nqm importdisk\n(VMDK → storage format)\nqm set --scsiN",
         "variant": "target"
       }
     ]
@@ -86,7 +86,7 @@
   },
   "memWarn": {
     "title": "Memory unit ambiguity",
-    "body": "The parser <strong>assumes MiB</strong>. If the OVF declares memory in <em>GB</em> (e.g. some VMware exports do), the imported VM will have 1/1024th of the intended RAM. After import, double-check <code>qm config $VMID | grep memory</code> against the source VM's documented RAM and adjust with <code>qm set $VMID --memory &lt;MiB&gt;</code> if it's off by a factor of 1024 or 1024²."
+    "body": "The parser normalizes recognized memory units to <strong>MiB</strong>, including bytes, KiB, MiB, GiB and supported textual labels. Missing or unrecognized units are <em>treated as MiB</em>. After import, compare <code>qm config $VMID | grep memory</code> with the source VM’s documented RAM and, if needed, correct it using <code>qm set $VMID --memory &lt;MiB&gt;</code>."
   },
   "dialog": {
     "heading": "Import dialog flow",
@@ -108,7 +108,7 @@
     "heading": "Disk import loop",
     "intro": "For each disk reference in the OVF:",
     "items": [
-      "<code>qm importdisk $VMID $disk_path $STORAGE</code> — converts the VMDK to the storage-native format (e.g. qcow2 on local-lvm, raw on ZFS) and creates an <code>unusedN:</code> entry in the VM config.",
+      "<code>qm importdisk $VMID $disk_path $STORAGE</code> — imports the disk in a format supported by the target storage and creates an <code>unusedN:</code> entry in the VM configuration.",
       "The script greps the config for the just-created <code>unusedN</code> reference.",
       "<code>qm set $VMID --scsiN $unused_disk</code> — attaches the disk as <code>scsi0</code>, <code>scsi1</code>, …",
       "<code>qm set $VMID --delete unusedN</code> — clears the now-redundant unused marker."
@@ -175,11 +175,11 @@
   "troubleshoot": {
     "heading": "Troubleshooting",
     "orphanTitle": "VM was created but disk import failed — orphan VM left behind",
-    "orphanIntro": "Known limitation. The script doesn't auto-clean a partial import. Destroy the orphan with:",
+    "orphanIntro": "When an import fails, the script offers to remove the partial VM and its imported disks. If you declined, or automatic deletion failed, inspect the VM and remove it manually with:",
     "orphanCode": "qm destroy $VMID --destroy-unreferenced-disks 1",
     "orphanOutro": "Then fix the underlying cause (likely disk space on the target storage) and re-import.",
     "memTitle": "Imported VM has 8 MB of RAM (or 8 TB)",
-    "memIntro": "Memory unit ambiguity in the OVF parser. Off by a factor of 1024 → OVF used GB instead of MiB. Fix:",
+    "memIntro": "The parser converts recognized AllocationUnits to MiB. Missing or unsupported units are treated as MiB, so inspect the OVF and compare the imported setting with the source VM. Correct the memory if necessary:",
     "memCode": "qm set $VMID --memory 8192    # 8 GiB",
     "bootTitle": "Imported VM doesn't boot — \"No bootable device\"",
     "bootIntro": "Most common cause: BIOS / UEFI mismatch. The VM was UEFI but Proxmox created it as BIOS. Set the matching firmware:",
@@ -188,7 +188,7 @@
     "bsodTitle": "VMware-exported Windows VM imports but BSODs on first boot",
     "bsodBody": "Windows is sensitive to disk controller changes. Either: (a) install VirtIO drivers <em>before</em> exporting from VMware, or (b) keep the SCSI controller as <code>lsi</code> (the default) and only switch to VirtIO SCSI after the guest boots and you can install the VirtIO drivers in Windows.",
     "zeroTitle": "OVF parser reports 0 disks",
-    "zeroBody": "The OVF descriptor uses an unusual disk reference style. Open the .ovf in a text editor and confirm each disk has a <code>&lt;File ovf:href=\"...vmdk\" ...&gt;</code> entry. If the file extension is unusual (e.g. just <code>.dat</code>), rename it to <code>.vmdk</code> and update the OVF reference, then re-run.",
+    "zeroBody": "The OVF descriptor may use a disk reference style the parser does not recognize. Open the .ovf and look for each disk’s <code>&lt;File ovf:href=\"...vmdk\" ...&gt;</code> entry. If a disk really is VMDK but has an unusual extension such as <code>.dat</code>, rename it to <code>.vmdk</code> and update the OVF reference. Renaming does not convert a disk’s format.",
     "awkTitle": "awk: syntax error at or near , — parser fails on every OVA / OVF",
     "awkIntro": "The OVF parser uses gawk-specific syntax (3-argument <code>match()</code>) which mawk — the default <code>awk</code> on Debian / Proxmox — does not support. Recent versions of the script auto-install gawk on first use via the canonical <code>ensure_repositories</code> + <code>install_single_package</code> pair; if you're running an older copy, install it manually:",
     "awkCode": "apt-get install -y gawk",
diff --git a/web/messages/en/docs/utils/index.json b/web/messages/en/docs/utils/index.json
index 43c9340e..5d9388df 100644
--- a/web/messages/en/docs/utils/index.json
+++ b/web/messages/en/docs/utils/index.json
@@ -37,7 +37,7 @@
       "title": "System maintenance",
       "body": "Keep the host healthy: CLI tooling, regular updates, and the major-version upgrade when it's time.",
       "bullets": [
-        "System Utilities Installer (26 CLI tools)",
+        "System Utilities Installer (25 CLI tools)",
         "Proxmox System Update (apt + dist-upgrade)",
         "PVE 8 → PVE 9 major upgrade"
       ]
@@ -73,7 +73,7 @@
     "options": [
       {
         "title": "System Utilities Installer",
-        "description": "Curated picker for 26 CLI tools (htop, btop, iperf3, jq, tmux, ncdu, ...) with custom selection or predefined groups (basic, dev, compression, multiplexers, analysis, network). Uses the canonical repo + verify-command flow.",
+        "description": "Curated picker for 25 CLI tools (htop, btop, iperf3, tmux, ...) with custom selection or predefined groups (basic, dev, compression, multiplexers, analysis, network). Uses the canonical repo + verify-command flow.",
         "href": "/docs/utils/system-utils"
       },
       {
@@ -106,10 +106,10 @@
   },
   "diskSpaceCallout": {
     "title": "A note on disk space for export / import",
-    "body": "Both tools convert disk formats: export uses <code>qemu-img convert -O vmdk -o subformat=streamOptimized</code>; import uses <code>qm importdisk</code> to convert back to the storage-native format (qcow2 / raw). Plan for <strong>~120% of virtual disk size</strong> for OVF and <strong>~220%</strong> for OVA — the conversion writes the full disk before any compression. Check the destination directory has the headroom before you start."
+    "body": "Both tools convert disk formats: export uses <code>qemu-img convert -O vmdk -o subformat=streamOptimized</code>; import uses <code>qm importdisk</code> to convert back to the storage-native format (qcow2 / raw). For export, plan for <strong>~120% of virtual disk size</strong> for OVF and <strong>~220%</strong> for OVA. The OVA archive uses uncompressed TAR and is created while the temporary VMDK files still exist. Check the destination directory has the headroom before you start."
   },
   "fitsTogether": {
     "heading": "How the menu fits together",
-    "body": "Each tool has a dedicated script under <code>scripts/utilities/</code>. The Proxmox System Update is a wrapper that delegates to one of two worker scripts in <code>scripts/global/</code> depending on the detected major version (PVE 8 or PVE 9). The PVE 8 → 9 upgrade exposes two extra menu actions inside its own flow — a stand-alone <em>Pre-upgrade check</em> (runs <code>pve8to9 --full</code>) and a read-only <em>Manual upgrade guide</em> (17-step runbook) — for users who want to inspect or operate by hand instead of the automated path."
+    "body": "Each tool has a dedicated script under <code>scripts/utilities/</code>. Proxmox System Update calls one safe worker in <code>scripts/global/</code>, update-pve-safe.sh, which detects the major version and handles both PVE 8 and PVE 9. The PVE 8 → 9 upgrade offers two extra actions in its own menu: a stand-alone <em>Pre-upgrade check</em> (runs <code>pve8to9 --full</code>) and a read-only <em>Manual upgrade guide</em> (17-step runbook), for users who want to inspect the process or carry it out by hand."
   }
 }
diff --git a/web/messages/en/docs/utils/system-update.json b/web/messages/en/docs/utils/system-update.json
index 38672793..dffc2bca 100644
--- a/web/messages/en/docs/utils/system-update.json
+++ b/web/messages/en/docs/utils/system-update.json
@@ -1,13 +1,13 @@
 {
   "meta": {
     "title": "Proxmox System Update | ProxMenux Documentation",
-    "description": "Runs the official Proxmox upgrade sequence (apt update + apt full-upgrade -y) and adds the repo hygiene, essential-package check, LVM sanity scan, autoremove/autoclean and reboot prompt that the upgrade guide also recommends. Detects the running major version automatically.",
+    "description": "Updates packages within the current Proxmox major version with apt-get update and apt full-upgrade -y. Checks disk space and configured repositories, attempts GPG key recovery, checks and repairs old LVM PV headers, rebuilds managed DKMS drivers when needed, runs autoremove/autoclean and offers a reboot when required.",
     "ogTitle": "Proxmox System Update | ProxMenux Documentation",
-    "ogDescription": "Official apt full-upgrade / dist-upgrade wrapped with repo hygiene, autoremove and a smart reboot prompt."
+    "ogDescription": "apt full-upgrade with repository checks, autoremove/autoclean and a reboot prompt when required."
   },
   "header": {
     "title": "Proxmox System Update",
-    "description": "Wrapper that delegates to a single safe worker (<code>update-pve-safe.sh</code>) which detects the running Proxmox major version by itself. The configured repositories are read through the Proxmox API and kept as they are; a host with no active subscription whose only Proxmox repository is Enterprise is asked before switching to no-subscription. All packages are upgraded, ProxMenux-managed DKMS drivers are rebuilt if a new kernel landed, and the reboot prompt fires only when the kernel actually changed. Also launchable from the <em>Update Now</em> button in the ProxMenux Monitor dashboard header when pending updates are detected.",
+    "description": "Delegates to a single worker (<code>update-pve-safe.sh</code>) that detects the running Proxmox major version. Configured repositories are read through the Proxmox API and preserved; an unsubscribed host with only Enterprise is asked before switching to no-subscription. The worker upgrades packages and rebuilds ProxMenux-managed DKMS drivers for a staged kernel. The wrapper offers a reboot when the system reboot marker exists or the newest installed kernel differs from the running kernel. Also available from <em>Update Now</em> in the ProxMenux Monitor header when pending updates are detected.",
     "section": "Utilities"
   },
   "calloutWhat": {
@@ -22,25 +22,25 @@
   },
   "onTop": {
     "heading": "What ProxMenux runs on top — verified against the script",
-    "intro": "This option runs <strong>exactly</strong> the apt command above, wrapped with the repo hygiene, DKMS rebuild for ProxMenux-managed drivers and post-upgrade cleanup the official upgrade guide also recommends. Everything below maps 1:1 to <code>scripts/utilities/proxmox_update.sh</code> and the single safe worker <code>scripts/global/update-pve-safe.sh</code> — nothing implied, every step is in the code:",
+    "intro": "Uses <strong>the same apt full-upgrade operation</strong>, with repository checks, DKMS rebuilding and post-update cleanup. The steps below correspond to <code>scripts/utilities/proxmox_update.sh</code> and its single worker <code>scripts/global/update-pve-safe.sh</code>:",
     "items": [
-      "<strong>Detects the PVE major version</strong> from inside the worker (<code>pveversion | grep -oP ''pve-manager/\\K[0-9]+''</code>) and adapts the base Proxmox / Debian repo URLs (bookworm on PVE 8, trixie on PVE 9). There is no fan-out to per-version worker scripts — a single safe worker handles both.",
+      "<strong>Detects the PVE major version</strong> inside the worker (<code>pveversion | grep -oP ''pve-manager/\\K[0-9]+''</code>). A single worker handles PVE 8 and PVE 9; configured repositories are preserved unless an unsubscribed host accepts the offered switch.",
       "<strong>Keeps the configured repositories.</strong> <code>ensure_repositories</code> reads the repositories through the Proxmox repository API, together with the subscription status. A host with an active subscription, or one that already uses the no-subscription or test repository, is left unchanged. A host with no active subscription whose only Proxmox repository is Enterprise is asked whether to switch to no-subscription; declining stops the update with no source changed.",
-      "<strong>Runs the upgrade non-interactively</strong> with <code>DEBIAN_FRONTEND=noninteractive</code> and <code>--force-confdef --force-confold</code> — if a configuration file you already modified also changed upstream, your version stays in place. No silent overwrites of custom configs.",
+      "<strong>Runs the upgrade non-interactively</strong> with <code>DEBIAN_FRONTEND=noninteractive</code> and <code>--force-confdef --force-confold</code>. For dpkg conffile decisions, it accepts the default action when one exists; otherwise it keeps the existing configuration file.",
       "<strong>Skips forcing optional utilities.</strong> The safe worker does not push <code>zfsutils-linux</code>, <code>chrony</code>, <code>ifupdown2</code> or similar packages onto the host — a Proxmox install that opted out of any of them keeps its choice. Missing packages are surfaced by the higher-level installer flows, not by the update path.",
-      "<strong>LVM metadata sanity check</strong> against stray PV headers from passthrough disks (warn-only, no automatic fix).",
+      "<strong>LVM metadata check and repair.</strong> Detects old PV headers and runs vgck --updatemetadata and vgchange -ay for the affected volume groups. This can change LVM metadata; it is not a warning-only scan.",
       "<strong>Cleans up afterwards:</strong> <code>apt-get autoremove -y</code> + <code>apt-get autoclean -y</code>.",
-      "<strong>DKMS rebuild before the reboot prompt.</strong> When the upgrade staged a new kernel, the wrapper calls <code>pmx_rebuild_dkms_after_kernel</code> to rebuild every driver that ProxMenux installed via DKMS against the incoming kernel version — so the modules are ready before the box comes back up. Reboot detection uses <code>/var/run/reboot-required</code> when <code>needrestart</code> is present, and falls back to a <code>dpkg-query</code> comparison between the running kernel and the newest installed <code>proxmox-kernel-*-pve-signed</code> / <code>pve-kernel-*-pve</code> package when it isn't — a signal that survives the many Proxmox hosts that ship without <code>needrestart</code>."
+      "<strong>DKMS rebuild before the reboot prompt.</strong> The worker calls <code>pmx_rebuild_dkms_after_kernel</code> when a newer installed kernel is staged. The wrapper checks <code>/var/run/reboot-required</code> and also uses <code>dpkg-query</code> to compare the kernel reported by <code>uname -r</code> with the newest installed <code>proxmox-kernel-*-pve-signed</code> / <code>pve-kernel-*-pve</code> package. The marker may be absent on hosts without <code>needrestart</code>; the kernel comparison still works in that case."
     ]
   },
   "calloutOneSentence": {
     "title": "In one sentence",
-    "body": "Same upgrade Proxmox tells you to run, plus the repo cleanup, the essential-package check, the LVM sanity scan, the autoremove/autoclean afterwards, and a reboot prompt only when it matters."
+    "body": "Updates host packages, preserves configured repositories unless you accept a switch, checks LVM metadata, rebuilds managed DKMS drivers, cleans up with autoremove/autoclean and offers a reboot when needed."
   },
   "confirm": {
     "heading": "Confirmation dialog",
     "intro": "Selecting the option opens a summary of what the worker will do, requiring an explicit confirmation:",
-    "imageAlt": "Proxmox System Update confirmation dialog listing repo hygiene, package updates, cleanup"
+    "imageAlt": "Proxmox System Update confirmation dialog with repository checks, package updates and cleanup"
   },
   "routes": {
     "heading": "How the wrapper routes",
@@ -61,14 +61,14 @@
   },
   "worker": {
     "heading": "What the worker does",
-    "intro": "A single worker (<code>scripts/global/update-pve-safe.sh</code>) handles both PVE 8 and PVE 9. It detects the major version internally and uses the version-appropriate codename (<code>bookworm</code> or <code>trixie</code>) for its base sources. The stages are:",
+    "intro": "One worker (<code>scripts/global/update-pve-safe.sh</code>) handles PVE 8 (<code>bookworm</code>) and PVE 9 (<code>trixie</code>). It detects the major version internally and checks the existing repository configuration without rewriting the Debian base sources. The stages are:",
     "items": [
       "<strong>Sanity checks.</strong> Verifies at least ~1 GB free in <code>/var/cache/apt/archives</code>. Aborts early with a clear message when it fails, so the run doesn't die in the middle of an apt transaction.",
       "<strong>Repository check.</strong> <code>ensure_repositories</code> reads the repositories and the subscription status. On a host with a usable Proxmox repository it changes nothing; on a host with no active subscription and only the Enterprise repository it asks before switching to no-subscription, and stops the update when the answer is no.",
       "<strong>Apt update with GPG auto-recovery.</strong> On <code>NO_PUBKEY</code> for any repo (yours or a third-party one) the worker imports the missing key and retries automatically before failing.",
       "<strong>Pending upgrades + security count.</strong> Reports how many packages will change and how many of those come from the security suite, so the confirmation dialog has real numbers to show.",
-      "<strong>Confirmation dialog.</strong> The wrapper asks for an explicit yes before touching apt.",
-      "<strong>apt full-upgrade.</strong> Runs with <code>DEBIAN_FRONTEND=noninteractive</code> and <code>--force-confdef --force-confold</code> so any configuration file you customised keeps its current contents when upstream also changed it. Never overwrites operator-edited configs silently.",
+      "<strong>Confirmation dialog.</strong> After refreshing package lists, the worker asks for an explicit yes before running the package upgrade.",
+      "<strong>apt full-upgrade.</strong> Uses <code>DEBIAN_FRONTEND=noninteractive</code> and <code>--force-confdef --force-confold</code>. Dpkg follows its default action for conffile decisions when available and otherwise retains the existing file.",
       "<strong>LVM sanity check.</strong> <code>lvm_repair_check</code> refreshes VG metadata when disks passed through to guest VMs (DSM, TrueNAS, storage appliances) come back with old PV headers.",
       "<strong>DKMS rebuild for ProxMenux-managed drivers.</strong> When the upgrade staged a new kernel, <code>pmx_rebuild_dkms_after_kernel</code> reads <code>components_status.json</code> for the drivers ProxMenux installed (currently <code>nvidia_driver</code> → module <code>nvidia</code>, <code>coral_driver</code> → module <code>gasket</code>), installs the matching kernel headers (<code>proxmox-headers-&lt;newkver&gt;</code> when available, else <code>pve-headers-&lt;newkver&gt;</code>) and runs <code>dkms autoinstall -k &lt;newkver&gt;</code>. If <code>dkms status</code> then doesn't show the modules built against the new kernel, the worker falls back to re-running each installer with <code>--auto-reinstall</code>. Any failure is logged but does not abort the update — you land on the reboot prompt in every case.",
       "<strong>Post-cleanup.</strong> <code>apt-get autoremove</code> + <code>apt-get autoclean</code> before returning control to the wrapper."
@@ -78,21 +78,21 @@
     "heading": "Post-update cleanup & reboot",
     "intro": "After the worker exits, the wrapper runs:",
     "code": "apt-get autoremove -y    # drop unused dependencies pulled in by old packages\napt-get autoclean        # drop downloaded .deb files no longer in the index",
-    "afterCode": "Then it checks whether a reboot is needed. Two signals trigger the prompt:",
+    "afterCode": "The wrapper also checks whether a reboot is needed. Either of these signals triggers the prompt:",
     "items": [
-      "<code>/var/run/reboot-required</code> exists (created by the kernel package post-install hook)",
-      "The update log contains <code>linux-image</code> entries (kernel was actually upgraded)"
+      "<code>/var/run/reboot-required</code> exists: a package or system tool has marked the host as needing a reboot.",
+      "The newest installed Proxmox kernel package differs from the running kernel, as determined by <code>dpkg-query</code> and uname -r."
     ],
     "outro": "If either is true, a whiptail dialog asks <em>\"Some changes require a reboot to take effect. Do you want to restart now?\"</em>. Decline to keep running on the old kernel until you choose to reboot manually (e.g. during a planned maintenance window)."
   },
   "end": {
     "heading": "What you see at the end",
-    "intro": "When the worker finishes, the terminal shows the cleanup output and (if the kernel changed) the reboot prompt:",
+    "intro": "When the worker finishes, the terminal shows the cleanup output and, if a reboot is required, the reboot prompt:",
     "imageAlt": "Proxmox System Update completion summary with cleanup output and reboot prompt"
   },
   "calloutDeclineReboot": {
     "title": "Decline reboot only if you know why",
-    "body": "Running on an old kernel after upgrading <code>linux-image-*</code> means you're on a half-upgraded system: userspace is new, kernel is old. Most of the time things work, but ZFS modules, IOMMU groups, KSMBD and any out-of-tree drivers will only match the kernel they were built for — a mismatch produces obscure failures. Reboot at the earliest sensible moment."
+    "body": "Installing a new <code>proxmox-kernel-*</code> package does not replace the running kernel until you reboot. The new kernel and its matching modules become active on the next boot. Plan the reboot for a suitable maintenance window, and review any DKMS build warnings beforehand."
   },
   "noSub": {
     "heading": "How the safe worker treats the Enterprise repository",
@@ -117,7 +117,7 @@
       "<strong>Major-version upgrade.</strong> 8 → 9 is a separate operation — see <link>Upgrade PVE 8 to PVE 9</link>.",
       "<strong>Backup.</strong> No snapshots, no rollback. Apt operations are not transactional. Combine with your normal backup discipline (PBS, vzdump, ZFS snapshots).",
       "<strong>Container / VM updates.</strong> Only the host is upgraded; guests are left alone.",
-      "<strong>Firmware updates.</strong> CPU microcode, NIC firmware, BIOS — out of scope."
+      "<strong>Dedicated firmware flashing.</strong> This is not a BIOS or device-firmware flashing tool. Installed firmware or CPU-microcode packages can still receive updates through apt."
     ]
   },
   "troubleshooting": {
@@ -129,15 +129,15 @@
       },
       {
         "title": "dist-upgrade hangs at \"Configuring grub-pc\"",
-        "body": "A dpkg prompt is asking which device(s) to install GRUB to. The wrapper passes <code>--force-confold</code> for config files but boot-loader install is a separate prompt. Use <kbd>Tab</kbd> + <kbd>Space</kbd> to select all your boot disks, then OK. Best avoided by selecting the boot disks once with <code>dpkg-reconfigure grub-pc</code> beforehand."
+        "body": "If an interactive GRUB prompt is visible, it asks which devices should receive the boot loader. The <code>--force-confold</code> option applies to configuration-file decisions, not to this device selection. Use <kbd>Tab</kbd> + <kbd>Space</kbd> to select the appropriate boot disks, then OK. You can configure this selection beforehand with <code>dpkg-reconfigure grub-pc</code>."
       },
       {
         "title": "Kernel upgraded but the new modules are missing for an out-of-tree driver",
-        "body": "The drivers ProxMenux installed via DKMS (currently <code>nvidia_driver</code> and <code>coral_driver</code>) are rebuilt automatically at the end of the upgrade against the incoming kernel version, using <code>dkms autoinstall -k &lt;newkver&gt;</code> and, when needed, a fallback to each installer with <code>--auto-reinstall</code>. Confirm with <code>dkms status</code>. Third-party out-of-tree modules that aren't in ProxMenux's <code>components_status.json</code> registry (custom NIC drivers, hand-installed DKMS packages, …) still need a manual <code>dkms autoinstall</code> — the safe worker only touches what it originally installed."
+        "body": "For managed drivers (<code>nvidia_driver</code> and <code>coral_driver</code>), the helper runs <code>dkms autoinstall -k &lt;newkver&gt;</code> and can retry their installers with <code>--auto-reinstall</code>. Check the result with <code>dkms status</code>. The autoinstall command can also rebuild other registered DKMS modules; the installer fallback is limited to the managed entries in <code>components_status.json</code>. Inspect any third-party module that remains missing and rebuild it as needed with <code>dkms autoinstall</code>."
       },
       {
         "title": "The reboot prompt didn't appear but I'm sure the kernel changed",
-        "body": "Two signals must agree (<code>/var/run/reboot-required</code> and <code>linux-image</code> in the upgrade log). If the marker file was cleared but the log is being parsed wrong, reboot manually with <code>shutdown -r now</code>. To confirm a kernel upgrade happened: <code>grep linux-image /var/log/apt/history.log</code>."
+        "body": "The signals are alternatives: <code>/var/run/reboot-required</code> or a difference between the running and newest installed Proxmox kernel. The wrapper does not parse linux-image entries in the apt log. Check the running version with <code>uname -r</code> and the installed kernel packages with <code>dpkg-query</code>. If a reboot is needed, schedule it or run <code>shutdown -r now</code> when ready."
       }
     ]
   },
diff --git a/web/messages/en/docs/utils/system-utils.json b/web/messages/en/docs/utils/system-utils.json
index a31ecaa0..a47a9e04 100644
--- a/web/messages/en/docs/utils/system-utils.json
+++ b/web/messages/en/docs/utils/system-utils.json
@@ -1,18 +1,18 @@
 {
   "meta": {
     "title": "System Utilities Installer | ProxMenux Documentation",
-    "description": "Curated installer for 26 CLI utilities (htop, btop, iperf3, jq, tmux, ncdu, ...) on Proxmox VE. Custom selection or predefined groups (basic, dev, compression, multiplexers, analysis, network). Uses the canonical ensure_repositories + install_single_package flow.",
+    "description": "CLI utility installer for Proxmox VE, with 25 packages in the canonical list (htop, btop, iperf3, tmux, ...). Custom selection, install-all and predefined groups (basic, development, compression, multiplexers, analysis, network). Groups can include additional packages. Uses ensure_repositories + install_single_package.",
     "ogTitle": "System Utilities Installer | ProxMenux Documentation",
     "ogDescription": "Install curated CLI tools on Proxmox VE with one click or custom selection."
   },
   "header": {
     "title": "System Utilities Installer",
-    "description": "Curated picker for 26 CLI utilities defined in the canonical PROXMENUX_UTILS list. Offers custom selection, install-all, six predefined groups and a verify-installations check. Uses the shared ensure_repositories() + install_single_package() pair so repo configuration and per-package feedback stay consistent across the project.",
+    "description": "Picker for 25 CLI utilities in the canonical PROXMENUX_UTILS list. Offers custom selection, install-all, six predefined groups and an installation check. Groups can include tools outside the canonical list. Uses shared ensure_repositories() + install_single_package() helpers for consistent repository handling and per-package feedback.",
     "section": "Utilities"
   },
   "info": {
     "title": "What this does",
-    "body": "Installs CLI tools from a curated list of 26 packages. Every installation goes through the same canonical flow: <code>ensure_repositories</code> checks that the host has a usable Proxmox repository for the running PVE major version, then <code>install_single_package</code> runs the install and verifies the resulting command is in PATH."
+    "body": "Installs CLI tools from a list of 25 packages. Every installation uses the same flow: <code>ensure_repositories</code> checks that the host has a usable Proxmox repository for the running PVE major version, then <code>install_single_package</code> installs the package and checks that its command is in PATH."
   },
   "opening": {
     "heading": "Opening the installer",
@@ -26,7 +26,7 @@
     "rows": [
       {
         "option": "1. Custom selection",
-        "behaviourRich": "Dialog checklist of all 26 packages. Use SPACE to toggle, ENTER to confirm; only the selected ones are installed."
+        "behaviourRich": "Checklist of all 25 packages. Use SPACE to toggle and ENTER to confirm; only the selected packages are installed."
       },
       {
         "option": "2. Install ALL utilities",
@@ -63,7 +63,7 @@
     ]
   },
   "packages": {
-    "heading": "The 26 packages",
+    "heading": "The 25 packages",
     "intro": "Defined in the shared <code>scripts/global/utils-install-functions.sh</code> as <code>PROXMENUX_UTILS</code> (format: <code>package:verify_command:description</code>). Other ProxMenux scripts (e.g. the network monitoring launchers for iftop / iptraf-ng / iperf3) reuse entries from this list so package + verify command stay in sync.",
     "headerPackage": "Package",
     "headerVerify": "Verify command",
@@ -193,11 +193,6 @@
         "package": "zip",
         "verify": "zip",
         "description": "Create ZIP files"
-      },
-      {
-        "package": "libguestfs-tools",
-        "verify": "virt-filesystems",
-        "description": "VM disk utilities"
       }
     ]
   },
@@ -211,14 +206,14 @@
     "verifyOutcomes": [
       "<strong>0 (success):</strong> command available, package counted as <em>Successful</em>.",
       "<strong>1 (failed):</strong> apt failed, counted as <em>Failed</em>.",
-      "<strong>2 (warning):</strong> apt succeeded but command not yet in PATH (hash refresh pending) — counted as <em>With warnings</em>."
+      "<strong>2 (warning):</strong> apt succeeded but the expected command was not found in PATH — counted as <em>With warnings</em>."
     ],
     "summary": "At the end of a group / custom install, a summary dialog shows <em>Successful / With warnings / Failed</em> counts."
   },
   "verify": {
     "heading": "Verify installations",
     "intro": "Option 9 is read-only: it walks <code>PROXMENUX_UTILS</code> and runs <code>command -v</code> for each verify command. Output looks like this:",
-    "code": "Total: 26\nAvailable: 18\nMissing: 8\n\n✓ axel - Download accelerator\n✓ aria2c - Multi-source downloader\n✓ btop - Modern resource monitor\n✗ cabextract - Extract CAB files\n✓ dos2unix - Convert DOS / Unix text files\n✗ genisoimage - Create ISO images\n✓ grc - Generic log colorizer\n...",
+    "code": "Total: 25\nAvailable: 18\nMissing: 8\n\n✓ axel - Download accelerator\n✓ aria2c - Multi-source downloader\n✓ btop - Modern resource monitor\n✗ cabextract - Extract CAB files\n✓ dos2unix - Convert DOS / Unix text files\n✗ genisoimage - Create ISO images\n✓ grc - Generic log colorizer\n...",
     "outro": "Useful before running scripts that depend on these tools (e.g. <code>uup_dump_iso_creator.sh</code> needs <code>aria2c</code> + <code>cabextract</code> + <code>wimlib-imagex</code>). If anything is missing, run the matching group install or pick the missing packages via custom selection."
   },
   "troubleshoot": {
@@ -226,7 +221,7 @@
     "reposTitle": "\"Failed to configure repositories. Installation aborted.\"",
     "reposBody": "The repository check did not pass: the switch to the no-subscription repository was declined, the subscription status could not be read, or a repository entry needs attention. The message printed above it states the cause. The repositories are listed in <em>Node → Updates → Repositories</em>, and <code>apt-get update</code> from a console shows the error apt reports.",
     "warningsTitle": "A package is reported \"With warnings\" but the command works after I close the menu",
-    "warningsBody": "Expected. After <code>apt-get install</code>, the new binary is on disk but the current shell's PATH cache (<code>hash -t</code>) doesn't know yet. ProxMenux runs <code>hash -r</code> after each install, but in some shells the refresh only takes effect on the next prompt. Open a new shell and the command will work.",
+    "warningsBody": "After <code>apt-get install</code>, the helper runs <code>hash -r</code>, waits briefly and checks the expected command with <code>command -v</code>. A warning means that check still failed; it does not identify the cause. Try a new shell, then check the package installation and PATH if the command is still missing.",
     "hangsTitle": "An apt install hangs",
     "hangsBody": "Most likely a debconf prompt is blocked behind the silenced output. The script wraps all apt calls with <code>DEBIAN_FRONTEND=noninteractive</code>, which usually suppresses prompts, but a few packages still require user input. Cancel with <kbd>Ctrl</kbd>+<kbd>C</kbd>, run <code>apt-get install -y &lt;pkg&gt;</code> manually from a shell to see the prompt and decide."
   },
diff --git a/web/messages/en/docs/utils/upgrade-pve8-pve9.json b/web/messages/en/docs/utils/upgrade-pve8-pve9.json
index 036df1e3..559442bf 100644
--- a/web/messages/en/docs/utils/upgrade-pve8-pve9.json
+++ b/web/messages/en/docs/utils/upgrade-pve8-pve9.json
@@ -23,17 +23,17 @@
   },
   "modeMenu": {
     "heading": "The mode menu",
-    "intro": "Launching the option opens a 4-way menu. The first three are different ways to <em>perform</em> the upgrade (pick the one that matches your comfort level); the fourth is a diagnostic that <em>verifies</em> the host is ready without changing anything:",
+    "intro": "Launching the option opens a four-way menu: Automatic, Interactive, Pre-check and Manual guide. Three choices <em>perform</em> the upgrade or show how to do it; the separate pre-check <em>verifies</em> readiness and may offer repairs.",
     "imageAlt": "PVE 8 to 9 upgrade mode menu with Automatic, Interactive, Pre-check and Manual guide options"
   },
   "threeWays": {
     "heading": "Three ways to upgrade",
-    "intro": "Same end state, different level of operator involvement. None of them lets you skip the pre-flight safeguards or the post-upgrade verification — the difference is purely how the dpkg prompts during <code>dist-upgrade</code> are handled and whether you watch each step or hand it all off.",
+    "intro": "Automatic and Interactive run the same upgrade flow, including pre-checks and post-upgrade verification. They differ in how dpkg prompts during <code>dist-upgrade</code> are handled. The Manual guide displays commands for you to run, including the checks; you are responsible for completing each step.",
     "auto": {
       "title": "Automatic / Unattended",
-      "summary": "One-shot. Sets <code>ASSUME_YES=1</code> + <code>DEBIAN_FRONTEND=noninteractive</code>; dpkg config-file conflicts default to <strong>keep current</strong> (<code>--force-confold</code>).",
+      "summary": "Sets <code>ASSUME_YES=1</code> + <code>DEBIAN_FRONTEND=noninteractive</code>. For modified configuration files, dpkg uses its default action when available; otherwise it will <strong>keep the current file</strong> (<code>--force-confold</code>).",
       "items": [
-        "Fastest — no waiting for prompts",
+        "Fastest — no dpkg prompts during the upgrade",
         "Best for vanilla installs without custom config files",
         "Risk: a config you customised is silently kept and may shadow new defaults"
       ]
@@ -59,7 +59,7 @@
   },
   "precheckCallout": {
     "title": "Plus a separate Pre-check",
-    "body": "Option 3 of the menu — <strong>Run PVE 8 to 9 check</strong> — is not an upgrade mode. It runs Proxmox's official <code>pve8to9 --full</code> and offers guided remediation for the common blocking issues, then <strong>stops</strong>. Use it before committing to any of the three upgrade modes above. It also runs automatically as part of every upgrade flow, so this stand-alone option is for early verification or for re-running after manual fixes."
+    "body": "Option 3 — <strong>Run PVE 8 to 9 check</strong> — runs Proxmox’s official <code>pve8to9 --full</code>, offers guided repairs for common blocking issues, then <strong>stops</strong>. Use it before upgrading or after manual repairs. Automatic and Interactive also run this check; the Manual guide tells you to run it yourself."
   },
   "webTerminal": {
     "heading": "Why the web terminal is blocked",
@@ -69,7 +69,7 @@
   },
   "auto": {
     "heading": "Automatic / Unattended mode",
-    "intro": "The fully unattended path. Every dpkg prompt is auto-answered with safe defaults so the upgrade runs end-to-end without operator input. Use it on vanilla installs where you haven't hand-edited config files, or when you're running the upgrade as part of a maintenance window and just want it to finish.",
+    "intro": "Package and configuration-file prompts use the defaults in the table below, and a 401 from the enterprise repository switches to no-subscription without asking. The upgrade confirmation, the PVE 8 update summary, any pre-check repairs and the reboot prompt are still shown.",
     "behaviourHeading": "Auto-mode-specific behaviour",
     "behaviourTable": {
       "settingHeader": "Setting",
@@ -77,7 +77,7 @@
       "rows": [
         {
           "settingRich": "<code>ASSUME_YES=1</code>",
-          "effectRich": "Internal flag — every yes/no confirmation in the script auto-confirms"
+          "effectRich": "Internal flag — the script answers its own yes/no questions, such as switching to no-subscription after a 401"
         },
         {
           "settingRich": "<code>DEBIAN_FRONTEND=noninteractive</code>",
@@ -89,13 +89,13 @@
         },
         {
           "settingRich": "<code>--force-confold</code>",
-          "effectRich": "For files you customised: <strong>keep your version</strong> — never overwrite"
+          "effectRich": "For modified files: use dpkg’s default action when available; otherwise <strong>keep your version</strong>."
         }
       ]
     },
     "flowHeading": "Auto-mode flow",
-    "flowIntro": "Six sequential phases. Any failure in phases 1-4 aborts cleanly and the host stays on PVE 8 — nothing has been written yet. Phase 5 (<code>dist-upgrade</code>) is the point of no return.",
-    "flowDiagram": "┌─────────────────────────────────────────────────────────────────┐\n│  1. PRE-FLIGHT CHECKS                              (read-only)  │\n│─────────────────────────────────────────────────────────────────│\n│  • Block if running from web terminal (termproxy / vncshell)    │\n│  • Abort if host already on PVE 9.x                             │\n│  • Verify ≥ 1024 MB free in /var/cache/apt/archives             │\n│  • Ping download.proxmox.com                                    │\n│  • If Ceph is installed: must already be on 19.x Squid          │\n│  • Run pve8to9 --full → no FAILs (offer guided repair if any)   │\n└────────────────────────────────┬────────────────────────────────┘\n                                 │  all pass\n                                 ▼\n┌─────────────────────────────────────────────────────────────────┐\n│  2. BRING PVE 8 TO LATEST 8.4.x                                 │\n│─────────────────────────────────────────────────────────────────│\n│  • Delegate to scripts/global/update-pve8.sh                    │\n│  • Final apt update + dist-upgrade on the 8.x branch            │\n│  • Ensures the documented upgrade prerequisites are met         │\n└────────────────────────────────┬────────────────────────────────┘\n                                 │\n                                 ▼\n┌─────────────────────────────────────────────────────────────────┐\n│  3. REPOSITORY MIGRATION                                        │\n│─────────────────────────────────────────────────────────────────│\n│  • sed 's/bookworm/trixie/g' on /etc/apt/sources.list           │\n│    and any /etc/apt/sources.list.d/*.list                       │\n│  • Write deb822 .sources files for Proxmox + Debian + Ceph      │\n│  • Try Enterprise repo → fall back to no-subscription on 401    │\n│  • Comment out legacy .list files (do not delete yet)           │\n│  • apt-get update with retry logic                              │\n└────────────────────────────────┬────────────────────────────────┘\n                                 │\n                                 ▼\n┌─────────────────────────────────────────────────────────────────┐\n│  4. VALIDATE BEFORE WRITING ANYTHING                            │\n│─────────────────────────────────────────────────────────────────│\n│  • apt-cache policy proxmox-ve  →  candidate must be 9.x        │\n│  • apt-get -s dist-upgrade  (dry-run)                           │\n│       →  must NOT propose removing proxmox-ve                   │\n│  • Both must pass; otherwise abort with a clear message         │\n└────────────────────────────────┬────────────────────────────────┘\n                                 │  point of no return\n                                 ▼\n┌─────────────────────────────────────────────────────────────────┐\n│  5. RUN dist-upgrade  (UNATTENDED)                              │\n│─────────────────────────────────────────────────────────────────│\n│  apt-get -y \\\\                                                   │\n│      -o Dpkg::Options::='--force-confdef' \\\\                     │\n│      -o Dpkg::Options::='--force-confold' \\\\                     │\n│      dist-upgrade                                               │\n│                                                                 │\n│  • Full Bookworm → Trixie + PVE 8 → 9                           │\n│  • Output streams in real time                                  │\n│  • Also tee'd to /var/log/pve8-a-pve9-'<'timestamp'>'.log           │\n└────────────────────────────────┬────────────────────────────────┘\n                                 │\n                                 ▼\n┌─────────────────────────────────────────────────────────────────┐\n│  6. POST-UPGRADE                                                │\n│─────────────────────────────────────────────────────────────────│\n│  • EFI hosts:  apt install grub-efi-amd64                       │\n│  • systemctl restart pve-manager                                │\n│  • Re-run pve8to9 --full  →  confirm clean                      │\n│  • Reboot prompt  (decline only if you have a reason)           │\n└─────────────────────────────────────────────────────────────────┘",
+    "flowIntro": "Six sequential phases. Phase 2 updates the PVE 8 packages and phase 3 writes the PVE 9 repository configuration. A failure stops the flow without rolling those changes back; if the PVE 8 update fails or is cancelled, the repositories are left unchanged. Phase 5 runs the PVE 9 <code>dist-upgrade</code>.",
+    "flowDiagram": "1. CHECKS\nBlock termproxy / vncshell; confirm the upgrade; reject PVE 9.\n\n2. PREPARE PVE 8\nscripts/global/update-pve8.sh\nUpdate PVE 8 packages; stop if the update fails or is cancelled.\npve8to9 --full (may offer repairs).\nCheck space and connectivity; Ceph 19.x Squid on hyper-converged nodes.\n\n3. MIGRATE REPOSITORIES\nBookworm → Trixie; write deb822 .sources files.\nComment legacy .list files; apt-get update.\n\n4. VALIDATE THE PVE 9 CANDIDATE\napt-cache policy proxmox-ve\napt-get -s dist-upgrade\nStop if the candidate is not 9.x or proxmox-ve would be removed.\n\n5. UPGRADE\napt-get -y -o Dpkg::Options::='--force-confdef' -o Dpkg::Options::='--force-confold' dist-upgrade\nNo subscription: disable pve-enterprise.sources.\nLog: /var/log/pve8-a-pve9-'<'timestamp'>'.log\n\n6. VERIFY AND REBOOT\nEFI: apt install grub-efi-amd64\npve8to9 --full; review results and the reboot prompt.",
     "preflightHeading": "Pre-flight: what gets checked",
     "preflightTable": {
       "checkHeader": "Check",
@@ -137,7 +137,7 @@
     "postHeading": "Post-upgrade tasks (auto mode)",
     "postItems": [
       "<strong>EFI hosts:</strong> installs <code>grub-efi-amd64</code> (known issue per Proxmox docs — the upgrade doesn't pull it in automatically and the next boot would fail without it).",
-      "<strong>Restart <code>pve-manager</code>.</strong> Forces a clean reload of the new daemons.",
+      "<strong>Enterprise repository without a subscription.</strong> pve-manager 9 adds <code>pve-enterprise.sources</code> during the upgrade; in no-subscription mode the script sets it to <code>Enabled: false</code>.",
       "<strong>Re-run <code>pve8to9 --full</code>.</strong> Surfaces any residual issues that the upgrade didn't resolve. If FAILs are reported, the same guided-repair menu as the pre-check appears.",
       "<strong>Reboot prompt.</strong> \"It is RECOMMENDED to reboot now to load the new kernel and services. Reboot now?\" Decline only if you have a specific reason — running on the old kernel after a major upgrade is risky."
     ]
@@ -160,10 +160,10 @@
     "heading": "Manual upgrade procedure",
     "intro": "This is what the <strong>Manual upgrade guide</strong> menu option displays — a faithful mirror of <wikilink>the official Proxmox 8-to-9 upgrade wiki</wikilink> organised in 4 phases. The script <em>shows</em> these commands; you type them yourself in a separate root shell. No automation — full visibility.",
     "rootCalloutTitle": "All commands need root",
-    "rootCalloutBody": "Run as root or prefix every command with <code>sudo</code>. The Proxmox host itself runs as root by default; only relevant if you locked it down.",
+    "rootCalloutBody": "Use a root shell for these commands, including redirections and here-documents. If you use <code>sudo</code>, ensure the entire command runs with root privileges.",
     "phase1Heading": "Phase 1 — Preparation",
     "phase1Intro": "Bring the host to the latest PVE 8.4.x, verify the version, validate Ceph (if used), run Proxmox's own pre-check, and start a terminal multiplexer to survive disconnections.",
-    "phase1Code": "# Step 1 — Update PVE 8 to the latest 8.4+\napt update && apt dist-upgrade -y\n\n# Step 2 — Verify version (must be 8.4.1 or newer)\npveversion\n\n# Step 2.1 — Hyper-converged Ceph: must already be on 19.x Squid\nceph --version\n# If older, follow https://pve.proxmox.com/wiki/Ceph_Squid\n\n# Step 3 — Run the official upgrade-readiness check\npve8to9 --full\n# If it warns about systemd-boot meta-package, remove it:\n#   apt remove systemd-boot\n\n# Step 4 — Start tmux or screen (so SSH disconnect doesn't kill the upgrade)\ntmux new-session -s upgrade\n# or\nscreen -S upgrade",
+    "phase1Code": "# Step 1 — Update PVE 8 to the latest 8.4+\napt update && apt dist-upgrade -y\n\n# Step 2 — Verify version (must be 8.4.1 or newer)\npveversion\n\n# Step 2.1 — Hyper-converged Ceph: must already be on 19.x Squid\nceph --version\n# If older, follow https://pve.proxmox.com/wiki/Ceph_Reef_to_Squid\n\n# Step 3 — Run the official upgrade-readiness check\npve8to9 --full\n# If it warns about systemd-boot meta-package, remove it:\n#   apt remove systemd-boot\n\n# Step 4 — Start tmux or screen (so SSH disconnect doesn't kill the upgrade)\ntmux new-session -s upgrade\n# or\nscreen -S upgrade",
     "phase2Heading": "Phase 2 — Repository migration",
     "phase2Intro": "Switch every Debian and Proxmox repository from the Bookworm codename to Trixie, and convert the Proxmox sources to the new deb822 format. <strong>Pick step 7 OR step 8</strong> depending on whether you have an Enterprise subscription. Skip step 9 if you don't run Ceph.",
     "phase2Code": "# Step 5 — Debian: bookworm → trixie\nsed -i 's/bookworm/trixie/g' /etc/apt/sources.list\n\n# Step 6 — Same for the legacy enterprise list (only if you use enterprise)\nsed -i 's/bookworm/trixie/g' /etc/apt/sources.list.d/pve-enterprise.list\n\n# Step 7 — Add the new PVE 9 enterprise repo (deb822) — Enterprise users only\ncat > /etc/apt/sources.list.d/pve-enterprise.sources << EOF\nTypes: deb\nURIs: https://enterprise.proxmox.com/debian/pve\nSuites: trixie\nComponents: pve-enterprise\nSigned-By: /usr/share/keyrings/proxmox-archive-keyring.gpg\nEOF\n\n# Step 8 — OR add the no-subscription repo (most home / lab users)\ncat > /etc/apt/sources.list.d/proxmox.sources << EOF\nTypes: deb\nURIs: http://download.proxmox.com/debian/pve\nSuites: trixie\nComponents: pve-no-subscription\nSigned-By: /usr/share/keyrings/proxmox-archive-keyring.gpg\nEOF\n\n# Step 8.1 — Refresh and verify proxmox-ve candidate is 9.x\napt update && apt policy | sed -n '1,120p'\n\n# Step 9 — Update Ceph repo (only if you run Ceph)\ncat > /etc/apt/sources.list.d/ceph.sources << EOF\nTypes: deb\nURIs: http://download.proxmox.com/debian/ceph-squid\nSuites: trixie\nComponents: no-subscription\nSigned-By: /usr/share/keyrings/proxmox-archive-keyring.gpg\nEOF\n\n# Step 10 — Remove old .list files now superseded by deb822 .sources\nrm -f /etc/apt/sources.list.d/pve-enterprise.list /etc/apt/sources.list.d/ceph.list\n\n# Step 11 — Final apt update\napt update",
@@ -191,8 +191,8 @@
         },
         {
           "fileRich": "/etc/ssh/sshd_config",
-          "answerRich": "<strong>Y</strong> (maintainer)",
-          "whyRich": "Re-apply your customisations after",
+          "answerRich": "<strong>Y</strong> for default-only changes; inspect customised files first",
+          "whyRich": "Review local SSH settings and preserve access before replacing the file. The default-only changes include renamed options and comments.",
           "fileFont": true
         },
         {
@@ -203,8 +203,8 @@
         },
         {
           "fileRich": "/etc/chrony/chrony.conf",
-          "answerRich": "<strong>Y</strong> (maintainer)",
-          "whyRich": "Time sync defaults updated for Trixie",
+          "answerRich": "<strong>Y</strong> if unmodified; preserve local settings first",
+          "whyRich": "Trixie updates time-sync defaults. Move local settings into chrony’s conf.d / sources.d directories before accepting the new file.",
           "fileFont": true
         },
         {
@@ -230,9 +230,9 @@
   "clusterCeph": {
     "heading": "Cluster & Ceph",
     "clusterCalloutTitle": "Cluster: upgrade nodes one at a time",
-    "clusterCalloutBody": "Detected via <code>pvecm status</code>. <strong>Do not</strong> upgrade more than one node at a time. Migrate guests off the node first, upgrade, reboot, verify the node is back in the cluster as PVE 9, only then move to the next node. Mixed PVE 8 / PVE 9 cluster works for the duration of the upgrade window, but live migration between mixed versions is not supported — only cold migration. HA groups will be migrated to the new HA rules format automatically.",
+    "clusterCalloutBody": "Detected via <code>pvecm status</code>. <strong>Do not</strong> upgrade more than one node at a time. Move guests off the node, upgrade, reboot and verify cluster membership before proceeding. During the upgrade, live migration from an older PVE version to a newer one works; the reverse direction is generally unsupported. HA groups migrate automatically to HA rules once all nodes run PVE 9.",
     "cephCalloutTitle": "Ceph: upgrade Ceph FIRST, then Proxmox",
-    "cephCalloutBody": "Ceph must already be on 19.x Squid before the Proxmox upgrade. The official order: Ceph 17/18 → Ceph 19 (per <code>pveceph upgrade</code> per node) → reboot for new Ceph daemons → Proxmox upgrade per node. Skipping the Ceph step leaves the cluster broken until you fix it from the console. Full Ceph procedure: <cephlink>Ceph Squid upgrade wiki</cephlink>."
+    "cephCalloutBody": "Ceph must already run 19.x Squid before upgrading Proxmox. Follow the official sequence: Quincy 17 → Reef 18 → Squid 19, updating packages and restarting Ceph daemons in the documented rolling order. Verify <code>ceph --version</code> before upgrading each Proxmox node. Follow the full procedure: <cephlink>Ceph Reef to Squid upgrade wiki</cephlink>."
   },
   "troubleshooting": {
     "heading": "Troubleshooting",
@@ -243,7 +243,7 @@
       },
       {
         "title": "pve8to9 reports FAIL and auto-repair Option 1 produces \"command not found\"",
-        "bodyRich": "Known bug — the auto-repair refers to a function (<code>configure_repositories</code>) that doesn't exist in the current codebase. Use Option 2 (show manual commands) and run them from a separate shell, or run the canonical fixes by hand: <code>apt-get update</code>, then re-run the upgrade."
+        "bodyRich": "If the error mentions <code>configure_repositories</code>, the script copy is outdated: the current repair uses cleanup_duplicate_repos and ensure_repositories. Update that copy or use Option 2 to review the manual commands. <code>apt-get update</code> refreshes package lists, but does not fix every blocking check."
       },
       {
         "title": "apt simulation flags \"proxmox-ve will be REMOVED\"",
@@ -267,7 +267,7 @@
       },
       {
         "title": "Cluster split-brain after upgrading one node",
-        "bodyRich": "Mixed PVE 8 / PVE 9 cluster is supported during the upgrade window but migration is cold-only. If the cluster shows the upgraded node as offline, check <code>corosync</code> on both: the QDevice / network config might have shifted. Run <code>pvecm status</code> on each node to confirm quorum."
+        "bodyRich": "Mixed PVE 8 / PVE 9 clusters are supported during the upgrade. Live migration from older to newer versions works; the reverse direction is generally unsupported. If the upgraded node appears offline, check <code>corosync</code> and the QDevice / network configuration. Run <code>pvecm status</code> on each node to confirm quorum."
       }
     ]
   },
@@ -285,7 +285,7 @@
         "desc": "The main Proxmox wiki page for the 8 → 9 upgrade. Source of truth for every command in the manual procedure above."
       },
       {
-        "href": "https://pve.proxmox.com/wiki/Ceph_Squid",
+        "href": "https://pve.proxmox.com/wiki/Ceph_Reef_to_Squid",
         "title": "Ceph Squid (19.x) upgrade",
         "desc": "Mandatory pre-step for hyper-converged Ceph nodes. Ceph must be on 19.x Squid before PVE 9."
       },
diff --git a/web/messages/en/docs/utils/uup-dump-iso-creator.json b/web/messages/en/docs/utils/uup-dump-iso-creator.json
index bf6edb3a..8bc3b62e 100644
--- a/web/messages/en/docs/utils/uup-dump-iso-creator.json
+++ b/web/messages/en/docs/utils/uup-dump-iso-creator.json
@@ -8,12 +8,12 @@
   },
   "header": {
     "title": "UUP Dump ISO Creator",
-    "description": "Build an up-to-date Windows installation ISO on your Proxmox host using UUP Dump. ProxMenux handles the dependencies, downloads the UUP files in parallel, runs the official converter and drops the final ISO into the Proxmox ISO storage — ready to attach to a new Windows VM.",
+    "description": "Build an up-to-date Windows installation ISO on your Proxmox host using UUP Dump. ProxMenux handles dependencies, downloads UUP files in parallel, runs the UUP Dump converter and moves the ISO to your chosen output directory, which defaults to the detected Proxmox ISO storage.",
     "section": "Utilities"
   },
   "intro": {
     "title": "What this script does",
-    "body": "You provide a UUP Dump URL (the one uupdump.net generates after you pick the build, language and edition) and the script does the rest: installs any missing dependencies, downloads the UUP Dump converter, downloads every UUP payload file with aria2, assembles a bootable Windows ISO and moves it into the Proxmox ISO storage so the VM creator can mount it on first boot."
+    "body": "Provide a UUP Dump URL generated by uupdump.net after choosing a build, language and edition. The script installs missing dependencies, downloads the UUP Dump converter and UUP payloads, assembles a bootable Windows ISO and moves it to the output directory you selected. The detected Proxmox ISO storage is offered as the default destination."
   },
   "hero": {
     "imageAlt": "UUP Dump ISO Creator entry in ProxMenux",
@@ -77,7 +77,7 @@
       "Calls <code>https://uupdump.net/get.php?…&aria2=2</code> to generate an aria2 download list.",
       "Downloads every UUP payload into <code>UUPs/</code> with aria2 (parallel, resumable).",
       "Runs <code>convert.sh wim UUPs 1</code> from the converter to produce the final ISO.",
-      "Moves the ISO into the Proxmox ISO storage and cleans up temporary files."
+      "Moves the ISO to the chosen output directory and cleans up temporary files."
     ]
   },
   "aria2": {
@@ -88,7 +88,7 @@
       "<code>-s16</code> — splits each file into 16 segments.",
       "<code>-j5</code> — 5 files downloaded in parallel.",
       "<code>-c</code> — resumes partial downloads.",
-      "<code>-R</code> — retries on failure."
+      "<code>-R</code> — applies the remote file’s timestamp to the downloaded file when available."
     ],
     "runtime": "Typical runtime is around 10 minutes, dominated by your internet link speed and UUP Dump's mirror load."
   },
@@ -150,12 +150,12 @@
         "title": "Wait for the build to finish",
         "img": "/iso-creator/end-uupdump-iso-creator.png",
         "caption": "Build finished — ISO is ready in Proxmox ISO storage",
-        "bodyRich": "The console shows aria2 progress and then the converter output. When it finishes, the ISO lands in the detected Proxmox ISO storage and is ready to pick from <strong>Create VM → System Windows → Install with ISO from UUP Dump</strong>."
+        "bodyRich": "The console shows aria2 progress and then converter output. The finished ISO is moved to your chosen output directory. If it is in configured Proxmox ISO storage, it can be selected from <strong>Create VM → System Windows → Install with personal ISO</strong>."
       }
     ]
   },
   "tempFiles": {
     "title": "Temporary files",
-    "body": "By default, temporary files live under <code>/root/uup-temp</code> (<code>uup-temp/</code> for downloads and <code>uup-converter/</code> for the converter script). The creator cleans both after a successful run. On failure it still cleans up and returns you to the menu so a retry starts from scratch."
+    "body": "The default temporary folder is <code>/root/uup-temp</code>, with downloads in <code>UUPs/</code> and the converter in <code>converter/</code>. A custom temporary base path gets a separate session subdirectory. The successful-build and no-ISO-generated branches remove the temporary session. Earlier failures or cancellation can leave temporary files behind."
   }
 }
diff --git a/web/messages/en/guides/backup-cloud.json b/web/messages/en/guides/backup-cloud.json
index 191dce85..557e5280 100644
--- a/web/messages/en/guides/backup-cloud.json
+++ b/web/messages/en/guides/backup-cloud.json
@@ -12,7 +12,7 @@
   },
   "intro": {
     "pbsCalloutTitle": "Consider Proxmox Backup Server first",
-    "pbsCalloutBody": "If you have a second machine (a Pi, an old PC, a NAS), running <pbsLink>Proxmox Backup Server</pbsLink> on it gives you incremental, deduplicated, encrypted backups — a much better fit for VM backup than rsync-style cloud sync. The cloud-mount approach in this guide is for users who specifically want backups to land in their personal cloud (Google Drive / Mega / OneDrive / Dropbox).",
+    "pbsCalloutBody": "On a second machine that meets its x86-64 requirements, <pbsLink>Proxmox Backup Server</pbsLink> offers incremental, deduplicated backups and optional client-side encryption. It is designed for VM backups. This guide instead covers mounting personal cloud storage such as Google Drive, Mega, OneDrive or Dropbox as a backup destination.",
     "stepsTitle": "What you'll do",
     "steps": [
       "Create a directory on the Proxmox host and register it as a vzdump-capable datastore.",
@@ -21,7 +21,7 @@
       "Make the mount survive reboots (systemd unit — more robust than crontab)."
     ],
     "vzdumpCalloutTitle": "Heads up about Proxmox vzdump backups",
-    "vzdumpCalloutBody": "They're <strong>not incremental</strong>. Every backup contains the full VM disk image (compressed). On a quota-limited cloud, this fills up fast. Plan a retention policy from day one (see end of guide)."
+    "vzdumpCalloutBody": "Proxmox vzdump archives are <strong>full backups, not incremental</strong>. Their actual size depends on the data included and compression, not just the virtual disk capacity. If one archive occupies 30 GB, five retained archives need roughly 150 GB. Set a retention policy so the cloud does not fill up."
   },
   "createDir": {
     "heading": "1. Create the host directory and register it as a datastore",
@@ -48,10 +48,10 @@
     "newerCalloutBody": "If you need a newer rclone than what Debian ships, use the official installer:",
     "newerCode": "curl https://rclone.org/install.sh | bash",
     "tunnelHeading": "2.1 Browser-based authentication via SSH tunnel",
-    "tunnelBody": "rclone's auth flow opens a local web browser. Since the Proxmox host doesn't have a desktop, <remoteSetupLink>rclone's remote-setup procedure</remoteSetupLink> routes the auth callback through an SSH tunnel back to your laptop's browser.",
+    "tunnelBody": "For providers with browser-based login, the Proxmox host usually has no browser. Follow <remoteSetupLink>rclone’s remote-setup procedure</remoteSetupLink>: use your laptop’s browser and forward its localhost callback connection through SSH to rclone on the host.",
     "tunnelFrom": "From your <strong>laptop</strong> (replace <code>ip_proxmox</code> with the Proxmox IP):",
     "tunnelCode": "ssh -L localhost:53682:localhost:53682 root@ip_proxmox",
-    "tunnelAfter": "This SSH session forwards port 53682 from the Proxmox host to your laptop's localhost. Keep it open during the rclone config below.",
+    "tunnelAfter": "This SSH session opens localhost port 53682 on your laptop and forwards connections to the same port on the Proxmox host. Keep it open during the rclone configuration below.",
     "runHeading": "2.2 Run rclone config",
     "runBody": "In the SSH session you just opened, run:",
     "runCode": "rclone config",
@@ -64,7 +64,7 @@
     "heading": "3. Mount the cloud folder",
     "body": "Create a folder in your personal cloud to hold the backups. Call it something like <code>PBC</code> (Proxmox Backup Cloud).",
     "mountIntro": "Mount it onto the host directory:",
-    "mountCode": "rclone mount gdrive:/PBC /mnt/gdrive --allow-other --allow-non-empty",
+    "mountCode": "rclone mount gdrive:/PBC /mnt/gdrive --allow-other --allow-non-empty --vfs-cache-mode writes",
     "mountItems": [
       "<code>gdrive:/PBC</code> — the folder in your cloud.",
       "<code>/mnt/gdrive</code> — the host directory you registered as a datastore."
@@ -82,20 +82,20 @@
     "enableCode": "systemctl daemon-reload\nsystemctl enable --now rclone-gdrive.service",
     "verifyIntro": "Verify:",
     "verifyCode": "systemctl status rclone-gdrive.service\nmount | grep /mnt/gdrive",
-    "verifyAfter": "If the service ever fails (provider rate-limits, expired auth token, network blip), it'll auto-restart after 10 seconds. Logs are at <code>/var/log/rclone-gdrive.log</code> and via <code>journalctl -u rclone-gdrive.service -f</code>.",
+    "verifyAfter": "The unit requests a restart after 10 seconds if the rclone process exits with a failure. This does not repair expired credentials or guarantee recovery from every network or provider error. Check <code>/var/log/rclone-gdrive.log</code> and <code>journalctl -u rclone-gdrive.service -f</code>.",
     "vfsCalloutTitle": "Why --vfs-cache-mode writes?",
-    "vfsCalloutBody": "vzdump streams the backup archive to disk; without VFS write caching, every <code>fwrite</code> blocks on a HTTP round-trip to the cloud — backups get slow and providers may rate-limit. The cache buffers writes locally and flushes them in the background."
+    "vfsCalloutBody": "With write caching, writes such as <code>fwrite</code> go to a local disk cache. rclone uploads a file after it is closed and the write-back delay has passed. Reserve enough local space for active backups, and verify the upload has completed before counting the cloud copy as available."
   },
   "configureBackup": {
     "heading": "5. Configure the backup to land in the cloud",
     "body": "In the Proxmox UI, when scheduling a backup or running an ad-hoc one, pick the storage you registered as the <strong>target</strong>:",
     "image5Alt": "Selecting backup destination in Proxmox",
-    "after": "After the backup completes, the file appears in your cloud:",
+    "after": "After vzdump finishes, wait for rclone’s background upload to complete and verify the archive in the cloud provider’s interface:",
     "image6Alt": "Backup file in cloud storage"
   },
   "retention": {
     "heading": "6. Retention — keep cloud quota under control",
-    "body": "Proxmox vzdump backups are <strong>full snapshots, not incremental</strong>. A 30 GB VM = 30 GB per backup. Without retention, the cloud fills up.",
+    "body": "Proxmox vzdump archives are <strong>full backups, not incremental</strong>. Their actual size depends on the data included and compression, not just the virtual disk capacity. If one archive occupies 30 GB, five retained archives need roughly 150 GB. Set a retention policy so the cloud does not fill up.",
     "uiPath": "In the Proxmox UI: <strong>Datacenter → Backup → [your job] → Retention</strong>:",
     "image7Alt": "Backup retention settings in Proxmox",
     "starterIntro": "Reasonable starter values for a home / lab setup:",
@@ -109,10 +109,10 @@
   "troubleshoot": {
     "heading": "Troubleshooting",
     "items": [
-      "<strong><code>Mount point /mnt/gdrive is itself on a fuse.rclone filesystem</code>:</strong> the previous mount didn't unmount cleanly. Force-unmount: <code>fusermount -uz /mnt/gdrive</code>, then restart the systemd unit.",
-      "<strong>Backup is extremely slow:</strong> confirm <code>--vfs-cache-mode writes</code> is on the <code>ExecStart</code> line. Without it, every write blocks on the cloud. Also check your upstream bandwidth — vzdump is bound by it.",
-      "<strong>Backup fails with ''No space left on device'':</strong> the cache directory (<code>~/.cache/rclone/</code>) filled up before the upload caught up. Move it to a larger filesystem with <code>--cache-dir /var/cache/rclone</code> in the systemd unit.",
-      "<strong>rclone auth token expired (typical on Google Drive after a long idle period):</strong> SSH back in with the tunnel (<code>ssh -L localhost:53682:localhost:53682 root@ip_proxmox</code>) and run <code>rclone config reconnect gdrive:</code> to refresh.",
+      "<strong><code>Mount point /mnt/gdrive is itself on a fuse.rclone filesystem</code>:</strong> the directory is already mounted, possibly by another rclone instance. Check that no backup is active before removing the old mount with <code>fusermount -uz /mnt/gdrive</code>, then restart the systemd unit.",
+      "<strong>Backup is extremely slow:</strong> confirm <code>--vfs-cache-mode writes</code> is on the <code>ExecStart</code> line. Check local cache performance, upload bandwidth and provider limits. The background upload can continue after vzdump finishes.",
+      "<strong>Backup fails with No space left on device:</strong> check local cache space and the provider’s quota. The cache commonly uses <code>~/.cache/rclone/</code>. If it is full, select a cache path such as <code>--cache-dir /var/cache/rclone</code> on a filesystem with enough space; a different path on the same full filesystem will not help.",
+      "<strong>rclone authentication token expired:</strong> reconnect over SSH with the tunnel (<code>ssh -L localhost:53682:localhost:53682 root@ip_proxmox</code>) and run <code>rclone config reconnect gdrive:</code> to renew authorization.",
       "<strong>Backups land but are corrupted on restore:</strong> stop using cloud storage as the <strong>only</strong> backup destination. Combine with local PBS / vzdump on a different disk for resilience."
     ]
   }
diff --git a/web/messages/en/guides/kodi-lxc.json b/web/messages/en/guides/kodi-lxc.json
index 572963f0..e89a6899 100644
--- a/web/messages/en/guides/kodi-lxc.json
+++ b/web/messages/en/guides/kodi-lxc.json
@@ -18,12 +18,12 @@
     "steps": [
       "Create a privileged LXC running Kodi (script-driven).",
       "Wire your USB keyboard, mouse or controller into the CT.",
-      "(Optional) Update Kodi to the latest version from the team-xbmc PPA."
+      "(Optional) Update Kodi from the container’s configured repositories."
     ]
   },
   "createCt": {
     "heading": "1. Create the Kodi LXC",
-    "body": "The CT needs to be <strong>privileged</strong> so it can access USB input devices (keyboards, remotes, controllers). The script handles privilege flags + GPU wiring + Kodi install + autostart on <code>tty7</code>:",
+    "body": "For this recipe, select <strong>Privileged</strong> in the script’s advanced settings. The script defaults to unprivileged containers, which require appropriate device permissions and ID mapping. It configures GPU access, Kodi and autostart on <code>tty7</code>:",
     "code": "bash -c \"$(wget -qLO - https://raw.githubusercontent.com/mrrudy/proxmoxHelper/main/ct/kodi-v1.sh)\"",
     "after": "Be patient — it takes a while to install. When it finishes and Kodi starts on <code>tty7</code>, you can plug your monitor or TV directly into the host's HDMI / DisplayPort output and you should see the Kodi UI."
   },
@@ -32,22 +32,22 @@
     "body": "Input devices live under <code>/dev/input/</code> on the host. Identify the major number:",
     "listCode": "ls -l /dev/input",
     "imageAlt": "Input devices list",
-    "afterList": "Take the first column number (in the example: <code>13</code>). Stop the Kodi LXC, then edit its config (replace <code>'<'CTID'>'</code> with the container ID — for example, <code>102</code>):",
-    "editCode": "nano /etc/pve/lxc/'<'CTID'>'.conf",
+    "afterList": "For character devices, use the major number before the comma (in the example: <code>13</code>). On the host, edit the Kodi LXC's configuration, replacing <code>'<'CTID'>'</code> with its ID, for example <code>102</code>:",
+    "editCode": "nano /etc/pve/lxc/CTID.conf",
     "addLines": "Add (adjust <code>13</code> to what you saw on <strong>your</strong> host):",
-    "configCode": "lxc.cgroup2.devices.allow = c 13:* rwm\nlxc.mount.entry: /dev/input dev/input none bind,optional,create=dir",
+    "configCode": "lxc.cgroup2.devices.allow: c 13:* rwm\nlxc.mount.entry: /dev/input dev/input none bind,optional,create=dir",
     "imageConfigAlt": "LXC configuration",
     "save": "Save (<code>Ctrl+X</code>) and restart <strong>only the container</strong> — no need to reboot the whole Proxmox host:",
-    "restartCode": "pct restart '<'CTID'>'",
+    "restartCode": "pct reboot CTID",
     "plug": "Plug in the keyboard / mouse / controller and Kodi should respond to it."
   },
   "updateKodi": {
-    "heading": "3. (Optional) Update Kodi to the latest release",
+    "heading": "3. (Optional) Update Kodi from the configured repositories",
     "calloutTitle": "Important",
-    "calloutBody": "The team-xbmc PPA is <strong>Ubuntu-only</strong>. If the Kodi LXC is based on a Debian template, <code>add-apt-repository</code> won't be available and the PPA will not work. The mrrudy script defaults to an Ubuntu template, so this should normally apply. To verify: <code>cat /etc/os-release</code> inside the container — look for <code>NAME=\"Ubuntu\"</code>.",
+    "calloutBody": "The team-xbmc PPA is <strong>Ubuntu-only</strong>, and Kodi currently states that it is unmaintained. A missing <code>add-apt-repository</code> command does not identify the distribution. Check <code>cat /etc/os-release</code> and look for <code>NAME=\"Ubuntu\"</code>; do not add Ubuntu PPAs to Debian. The commands below update packages from the container’s configured repositories.",
     "body": "Inside the container (<code>pct enter '<'CTID'>'</code>):",
-    "code": "sudo add-apt-repository ppa:team-xbmc/ppa\nsudo apt update\nsudo apt install kodi kodi-bin",
-    "after": "Restart the container when it finishes; on boot you'll have the latest Kodi."
+    "code": "apt update\napt install --only-upgrade kodi kodi-bin",
+    "after": "Restart the container after the update. Kodi will use the version available from its configured repositories, which may differ from the latest upstream release."
   },
   "screenshots": {
     "heading": "Screenshots",
@@ -58,9 +58,9 @@
     "heading": "Troubleshooting",
     "items": [
       "<strong>Kodi LXC starts but nothing on the TV:</strong> the CT may not have inherited the iGPU. Confirm with <code>ls /dev/dri</code> inside the container (you should see <code>card0</code>, <code>renderD128</code>). If empty, the GPU passthrough wasn't applied — re-run the script or use the ProxMenux <strong>Add GPU to LXC</strong> menu.",
-      "<strong>Keyboard / mouse not detected after restart:</strong> the major number for <code>/dev/input</code> changed (rare, but happens after kernel updates). Re-run <code>ls -l /dev/input</code> on the host and update the <code>lxc.cgroup2.devices.allow</code> line.",
+      "<strong>Keyboard / mouse not detected after restart:</strong> check that <code>/dev/input</code> is mounted and device permissions let Kodi read it. Run <code>ls -l /dev/input</code> on the host and in the container, and check the <code>lxc.cgroup2.devices.allow</code> rule.",
       "<strong>Hardware-accelerated playback uses CPU instead of GPU:</strong> install or update VA-API drivers inside the container (<code>intel-media-va-driver</code> for newer Intel iGPUs, <code>i965-va-driver</code> for older ones, <code>mesa-va-drivers</code> on AMD).",
-      "<strong><code>add-apt-repository: command not found</code>:</strong> the container is Debian, not Ubuntu. Either use the Debian Kodi packages (older but stable) or recreate the CT from an Ubuntu template."
+      "<strong><code>add-apt-repository: command not found</code>:</strong> the command is not installed; this does not prove the container is Debian. Check its distribution and available packages. Use Debian’s Kodi packages on Debian, without adding the Ubuntu PPA."
     ]
   },
   "further": {
diff --git a/web/messages/en/guides/lxc-samba.json b/web/messages/en/guides/lxc-samba.json
index d88ac704..97bd3a68 100644
--- a/web/messages/en/guides/lxc-samba.json
+++ b/web/messages/en/guides/lxc-samba.json
@@ -34,8 +34,8 @@
       "Holding documents that get auto-scanned by Paperless.",
       "Generic NAS-style storage for the home network."
     ],
-    "privilegedCalloutTitle": "Privileged container required",
-    "privilegedCalloutBody": "Direct device passthrough (<code>mp0</code> with a host path) needs a privileged LXC. Unprivileged CTs can't bind-mount block devices directly — for those you need bind mounts of host directories instead (see ProxMenux <strong>Storage & Share Manager → LXC Mount Points</strong>)."
+    "privilegedCalloutTitle": "Privileged container used in this recipe",
+    "privilegedCalloutBody": "This recipe uses a privileged LXC with a block device as <code>mp0</code>. For an unprivileged container, an alternative is to mount the filesystem on the host and bind-mount its directory, with appropriate ID mapping and permissions. See <strong>Storage & Share Manager → LXC Mount Points</strong> in ProxMenux."
   },
   "attach": {
     "heading": "1. Attach the USB disk to the LXC",
@@ -48,10 +48,10 @@
     "lsblkBody": "You can also use <code>lsblk -o NAME,SIZE,MODEL,SERIAL</code> to list every block device with model and serial.",
     "stableCalloutTitle": "Important — use a stable identifier",
     "stableCalloutBody": "<code>/dev/sdb1</code> can change between boots if you have multiple USB disks. Find the persistent identifier:",
-    "stableCalloutCode": "ls -l /dev/disk/by-id/ | grep -v part",
-    "stableCalloutAfter": "Use the <code>/dev/disk/by-id/usb-...</code> path in the LXC config below instead of <code>/dev/sdb1</code>. It survives reboots and re-plugging.",
+    "stableCalloutCode": "ls -l /dev/disk/by-id/",
+    "stableCalloutAfter": "Use the <code>/dev/disk/by-id/usb-...</code> entry for the intended partition in the LXC config, instead of <code>/dev/sdb1</code>. Choose the partition entry, not the whole-disk entry; it identifies the same partition when device enumeration changes.",
     "formatHeading": "1.2 Format the disk",
-    "formatBody": "ext4 is a sensible default for Linux-backed shares (case-sensitive, supports POSIX ACLs, no file-size limits). Run from the <strong>Proxmox host</strong>, not the container:",
+    "formatBody": "ext4 is a practical choice for Linux-backed shares: it is case-sensitive and supports POSIX ACLs and large files. Formatting destroys the existing filesystem’s contents. Run on the <strong>Proxmox host</strong>, after confirming the partition, not inside the container:",
     "formatCode": "mkfs.ext4 /dev/sdb1",
     "formatAfter": "Replace <code>/dev/sdb1</code> with the actual partition device — or with the persistent <code>/dev/disk/by-id/usb-...-part1</code> path.",
     "mkdirHeading": "1.3 Create the mount point inside the LXC",
@@ -59,18 +59,18 @@
     "mkdirCode": "mkdir /mnt/lxc_USB",
     "wireHeading": "1.4 Wire the device into the LXC",
     "wireBody": "On the <strong>Proxmox host</strong> (not inside the CT), edit the container's config. Replace <code>'<'CTID'>'</code> with the container ID:",
-    "wireEditCode": "nano /etc/pve/lxc/'<'CTID'>'.conf",
+    "wireEditCode": "nano /etc/pve/lxc/CTID.conf",
     "wireAddLine": "Add this line:",
     "wireConfigCode": "mp0: /dev/disk/by-id/usb-VENDOR_MODEL_SERIAL-part1,mp=/mnt/lxc_USB,backup=0",
     "wireShortForm": "(Or, if you accept the risk of the device path changing, the shorter form: <code>mp0: /dev/sdb1,mp=/mnt/lxc_USB,backup=0</code>.)",
-    "wireBackupNote": "The <code>backup=0</code> flag excludes this mount point from <code>vzdump</code> backups — usually the right call for large external drives that are the host's target storage rather than its data.",
+    "wireBackupNote": "This example sets <code>backup=0</code>. Device and bind mount contents are not included in container <code>vzdump</code> backups. Arrange a separate backup for the external disk’s data.",
     "restartHeading": "1.5 Restart the LXC and set permissions",
     "restartBody": "Restart the CT to apply the mount point:",
-    "restartCode": "pct restart '<'CTID'>'",
-    "permsBody": "Inside the LXC, give the directory permissions appropriate for the user that will own the share:",
-    "permsCode": "# Inside the container\nmkdir -p /mnt/lxc_USB\nchown -R proxmenux:proxmenux /mnt/lxc_USB\nchmod 770 /mnt/lxc_USB",
+    "restartCode": "pct reboot CTID",
+    "permsBody": "Inside the LXC, create the share account before assigning ownership, then set the directory permissions:",
+    "permsCode": "adduser --system --group --no-create-home --shell /usr/sbin/nologin proxmenux\nmkdir -p /mnt/lxc_USB\nchown -R proxmenux:proxmenux /mnt/lxc_USB\nchmod 770 /mnt/lxc_USB",
     "permsNoteTitle": "Note",
-    "permsNote": "Replace <code>proxmenux</code> with the username you'll create in step 2.2 below. <code>770</code> gives full access to the user and group, no access to others — safer than the wide-open <code>chmod -R 777</code> while still letting the share work."
+    "permsNote": "Replace <code>proxmenux</code> with your chosen account name. The mode <code>770</code> allows the owner and group to access the directory, with no access for others; it is more restrictive than <code>chmod -R 777</code>. The account is created here and registered with Samba in step 2.2."
   },
   "samba": {
     "heading": "2. Install Samba",
@@ -78,9 +78,9 @@
     "installCode": "apt-get update\napt-get install -y samba",
     "confirmBody": "Confirm the service is running:",
     "confirmCode": "systemctl status smbd.service",
-    "userHeading": "2.2 Create the share user",
-    "userBody": "Pick a username (here we use <code>proxmenux</code>; substitute your own). Create it as a system user with no shell:",
-    "userCode": "adduser proxmenux",
+    "userHeading": "2.2 Verify the share user",
+    "userBody": "The account <code>proxmenux</code> was created in step 1.5 as a system user without a login shell. Check it before setting its Samba password; substitute your chosen name throughout:",
+    "userCode": "id proxmenux",
     "passwordBody": "Set the Samba password (separate from the system password — Samba maintains its own credential store):",
     "passwordCode": "smbpasswd -a proxmenux",
     "aclHeading": "2.3 Set ownership / ACLs",
@@ -109,11 +109,11 @@
   "troubleshoot": {
     "heading": "Troubleshooting",
     "items": [
-      "<strong><code>pct restart</code> fails with \"device not found\":</strong> the device path in <code>mp0</code> doesn't exist on the host. Check with <code>ls -l /dev/disk/by-id/</code> and update the path.",
-      "<strong>CT starts but <code>/mnt/lxc_USB</code> is empty:</strong> the disk isn't mounted inside the CT. Check from the host: <code>pct exec '<'CTID'>' -- mount | grep lxc_USB</code>. If absent, the mount point in the config is wrong.",
-      "<strong>Samba authenticates but writes fail with \"Permission denied\":</strong> Linux permissions on the directory don't allow the Samba user to write. Re-check <code>chown</code> / <code>setfacl</code> in section 1.5 / 2.3.",
-      "<strong>Share doesn't appear in network browsers but <code>smb://'<'ip'>'/lxc_usb</code> works:</strong> browseability over the LAN depends on NetBIOS / WS-Discovery. Add <code>nmbd</code>: <code>apt-get install -y samba-common-bin</code> and ensure <code>nmbd</code> is enabled.",
-      "<strong>Want to add a second user to the same share:</strong> create the user with <code>adduser</code>, register with <code>smbpasswd -a</code>, add to the share's <code>valid users =</code> list comma-separated."
+      "<strong><code>pct reboot</code> fails with \"device not found\":</strong> the device path in <code>mp0</code> doesn't exist on the host. Check with <code>ls -l /dev/disk/by-id/</code> and update the path.",
+      "<strong>CT starts but <code>/mnt/lxc_USB</code> is empty:</strong> the disk may not be mounted, or its filesystem may be empty. Check from the host with <code>pct exec '<'CTID'>' -- mount | grep lxc_USB</code>. If the mount is absent, inspect its configuration, device path and startup errors.",
+      "<strong>Samba authenticates but writes fail with \"Permission denied\":</strong> check the directory’s Linux permissions and the share’s write settings. Review <code>chown</code> and <code>setfacl</code> in sections 1.5 and 2.3.",
+      "<strong>Share discovery fails but <code>smb://'<'ip'>'/lxc_usb</code> works:</strong> legacy NetBIOS discovery uses <code>nmbd</code>. Modern Windows discovery uses WS-Discovery instead; on Debian 12 install <code>apt-get install -y wsdd</code>; on Debian 13, where <code>wsdd</code> is not in the stable archive, use <code>apt-get install -y wsdd2</code>. Check the service and firewall. Enabling <code>nmbd</code> alone does not provide WS-Discovery.",
+      "<strong>To add a second user to the share:</strong> create the account with <code>adduser</code>, register it with <code>smbpasswd -a</code> and add it to the comma-separated <code>valid users =</code> list. Also grant the required filesystem permissions or ACLs."
     ]
   }
 }
diff --git a/web/messages/en/guides/nvidia-manual.json b/web/messages/en/guides/nvidia-manual.json
index da02ba62..513a1f99 100644
--- a/web/messages/en/guides/nvidia-manual.json
+++ b/web/messages/en/guides/nvidia-manual.json
@@ -29,10 +29,10 @@
     "blacklistBody": "Check whether the open-source <code>nouveau</code> driver is already blacklisted:",
     "blacklistCheckCode": "cat /etc/modprobe.d/blacklist.conf",
     "blacklistAdd": "If <code>blacklist nouveau</code> does not appear, add it and reboot:",
-    "blacklistAddCode": "echo \"blacklist nouveau\" '>>' /etc/modprobe.d/blacklist.conf\nreboot",
+    "blacklistAddCode": "echo \"blacklist nouveau\" >> /etc/modprobe.d/blacklist.conf\nupdate-initramfs -u -k all\nreboot",
     "blacklistImageAlt": "Blacklist check",
     "reposHeading": "1.2 Verify repositories (PVE 9 / Trixie)",
-    "reposBody": "If you ran the ProxMenux Post-Install script (or any other Proxmox post-install tooling), the repositories are already in place — skip this step.",
+    "reposBody": "Post-install tools may already have configured the repositories. Inspect the existing sources first and skip changes that are already in place; do not create duplicate entries.",
     "reposOtherwise": "Otherwise, on a vanilla PVE 9 install with no enterprise subscription:",
     "reposEditCode": "nano /etc/apt/sources.list.d/proxmox.sources",
     "reposPveBody": "Make sure it contains the no-subscription source for Trixie:",
@@ -47,7 +47,7 @@
   "installDriver": {
     "heading": "2. Install the NVIDIA driver on the host",
     "pickHeading": "2.1 Pick a driver version",
-    "pickBody": "Check the latest stable driver:",
+    "pickBody": "Choose a driver branch that supports your GPU and running kernel. The newest branch may not support older GPU models; check NVIDIA’s supported-products list for the chosen release:",
     "pickUrlCode": "https://download.nvidia.com/XFree86/Linux-x86_64/latest.txt",
     "nvencCallout": "If you plan to apply the NVENC patch (step 4), verify the patch supports your chosen driver version first: <patchLink>github.com/keylase/nvidia-patch</patchLink>",
     "nvencCalloutTitle": "Heads up",
@@ -56,27 +56,27 @@
     "pickImageAlt": "NVIDIA driver download",
     "pickVersionNote": "Throughout the rest of this guide, replace <code>'<'VERSION'>'</code> with the actual version (for example <code>580.95.05</code>).",
     "downloadHeading": "2.2 Download and run the installer",
-    "downloadCode": "mkdir -p /opt/nvidia\ncd /opt/nvidia\nwget https://download.nvidia.com/XFree86/Linux-x86_64/'<'VERSION'>'/NVIDIA-Linux-x86_64-'<'VERSION'>'.run\nchmod +x NVIDIA-Linux-x86_64-'<'VERSION'>'.run",
-    "firstPassBody": "First pass — this disables <code>nouveau</code> and prepares the system:",
-    "firstPassCode": "./NVIDIA-Linux-x86_64-'<'VERSION'>'.run --no-questions --ui=none --disable-nouveau\nreboot",
+    "downloadCode": "mkdir -p /opt/nvidia\ncd /opt/nvidia\nwget https://download.nvidia.com/XFree86/Linux-x86_64/VERSION/NVIDIA-Linux-x86_64-VERSION.run\nchmod +x NVIDIA-Linux-x86_64-VERSION.run",
+    "firstPassBody": "Run the installer. The option below can disable <code>nouveau</code> if necessary; installation may need a reboot before it can finish:",
+    "firstPassCode": "./NVIDIA-Linux-x86_64-VERSION.run --no-questions --ui=none --disable-nouveau\nreboot",
     "secondPassBody": "After the host comes back, run the installer again to compile and install the kernel module:",
-    "secondPassCode": "/opt/nvidia/NVIDIA-Linux-x86_64-'<'VERSION'>'.run --no-questions --ui=none",
+    "secondPassCode": "/opt/nvidia/NVIDIA-Linux-x86_64-VERSION.run --no-questions --ui=none",
     "modulesHeading": "2.3 Load NVIDIA modules at boot",
     "modulesBody": "Edit the modules-load configuration:",
     "modulesEditCode": "nano /etc/modules-load.d/modules.conf",
-    "modulesAddBody": "Add the VFIO and NVIDIA modules:",
-    "modulesAddCode": "vfio\nvfio_iommu_type1\nvfio_pci\nvfio_virqfd\nnvidia\nnvidia_uvm",
+    "modulesAddBody": "Add the NVIDIA modules needed for host/LXC use. VFIO modules are for VM passthrough and are not required for this LXC setup:",
+    "modulesAddCode": "nvidia\nnvidia_uvm",
     "modulesSaveBody": "Save (<code>Ctrl+X</code>) and rebuild initramfs:",
     "modulesSaveCode": "update-initramfs -u -k all",
     "udevHeading": "2.4 Create udev rules",
     "udevBody": "So that <code>/dev/nvidia*</code> device nodes are created when the modules load:",
     "udevEditCode": "nano /etc/udev/rules.d/70-nvidia.rules",
-    "udevRulesCode": "# /etc/udev/rules.d/70-nvidia.rules\n# Create /dev/nvidia0, /dev/nvidia1 ... and /dev/nvidiactl when nvidia module is loaded\nKERNEL==\"nvidia\", RUN+=\"/bin/bash -c ''/usr/bin/nvidia-smi -L''\"\n\n# Create the CUDA node when nvidia_uvm CUDA module is loaded\nKERNEL==\"nvidia_uvm\", RUN+=\"/bin/bash -c ''/usr/bin/nvidia-modprobe -c0 -u''\"",
+    "udevRulesCode": "# /etc/udev/rules.d/70-nvidia.rules\nKERNEL==\"nvidia\", RUN+=\"/bin/bash -c '/usr/bin/nvidia-smi -L'\"\nKERNEL==\"nvidia_uvm\", RUN+=\"/bin/bash -c '/usr/bin/nvidia-modprobe -c0 -u'\"",
     "udevSaveBody": "Save (<code>Ctrl+X</code>)."
   },
   "persistence": {
     "heading": "3. NVIDIA driver persistence service",
-    "body": "The persistence daemon keeps the GPU initialised between uses, which avoids the latency hit and occasional state loss that happens when the kernel module is loaded and unloaded repeatedly:",
+    "body": "The persistence daemon keeps the GPU initialized when no other application is using it. This reduces repeated initialization latency and preserves GPU-initialization state between clients:",
     "installCode": "cd /opt/nvidia\ngit clone https://github.com/NVIDIA/nvidia-persistenced.git\ncd nvidia-persistenced/init\n./install.sh\nreboot",
     "verifyBody": "Verify the driver is loaded and the service is running after reboot:",
     "verifySmiCode": "nvidia-smi",
@@ -86,7 +86,7 @@
   },
   "nvenc": {
     "heading": "4. (Optional) Lift the NVENC concurrent-session limit",
-    "body": "Consumer NVIDIA GPUs ship with a hardcoded limit on the number of simultaneous NVENC encoding sessions (typically 3, 5 or 8 depending on generation). The keylase patch removes that restriction. Useful when running Plex / Jellyfin / Frigate transcoding workloads.",
+    "body": "NVENC session limits depend on the GPU model and driver version; consult NVIDIA’s support matrix rather than assuming a fixed limit by GPU generation. The keylase patch removes the software limit for supported driver versions. It can help encoding workloads such as Plex or Jellyfin transcoding.",
     "code": "cd /opt/nvidia\ngit clone https://github.com/keylase/nvidia-patch.git\ncd nvidia-patch\n./patch.sh",
     "imageAlt": "NVIDIA patch application",
     "after": "The patch must be re-applied after every driver update. The keylase repo also includes <code>patch-fbc.sh</code> for the FBC (frame buffer capture) limit if you need it."
@@ -103,24 +103,36 @@
       "major": "Typical major"
     },
     "tableRows": [
-      { "device": "<code>/dev/nvidia0</code>, <code>/dev/nvidiactl</code>", "major": "195" },
-      { "device": "<code>/dev/nvidia-uvm</code>, <code>/dev/nvidia-uvm-tools</code>", "major": "509 (varies)" },
-      { "device": "<code>/dev/dri/*</code>", "major": "226" },
-      { "device": "<code>/dev/nvidia-modeset</code>", "major": "195 (shares with nvidia)" }
+      {
+        "device": "<code>/dev/nvidia0</code>, <code>/dev/nvidiactl</code>",
+        "major": "195"
+      },
+      {
+        "device": "<code>/dev/nvidia-uvm</code>, <code>/dev/nvidia-uvm-tools</code>",
+        "major": "509 (varies)"
+      },
+      {
+        "device": "<code>/dev/dri/*</code>",
+        "major": "226"
+      },
+      {
+        "device": "<code>/dev/nvidia-modeset</code>",
+        "major": "195 (shares with nvidia)"
+      }
     ],
     "editHeading": "5.2 Edit the LXC config",
     "editBody": "Stop the container first if it's running. Open its config file (replace <code>'<'CTID'>'</code> with the container ID):",
-    "editCode": "nano /etc/pve/lxc/'<'CTID'>'.conf",
+    "editCode": "nano /etc/pve/lxc/CTID.conf",
     "editConfigBody": "Comment out any pre-existing <code>lxc.cgroup2.devices.allow</code> or <code>/dev/dri</code> lines that conflict, then append the NVIDIA wiring (adjust the major numbers to match what <code>ls -l /dev/nv*</code> showed on <strong>your</strong> host):",
-    "editConfigCode": "lxc.cgroup2.devices.allow: c 195:* rwm\nlxc.cgroup2.devices.allow: c 509:* rwm\nlxc.cgroup2.devices.allow: c 10:* rwm\nlxc.cgroup2.devices.allow: c 238:* rwm\nlxc.mount.entry: /dev/nvidia0 dev/nvidia0 none bind,optional,create=file\nlxc.mount.entry: /dev/nvidiactl dev/nvidiactl none bind,optional,create=file\nlxc.mount.entry: /dev/nvidia-uvm dev/nvidia-uvm none bind,optional,create=file\nlxc.mount.entry: /dev/nvidia-modeset dev/nvidia-modeset none bind,optional,create=file\nlxc.mount.entry: /dev/nvidia-uvm-tools dev/nvidia-uvm-tools none bind,optional,create=file\nlxc.mount.entry: /dev/nvram dev/nvram none bind,optional,create=file",
+    "editConfigCode": "lxc.cgroup2.devices.allow: c 195:* rwm\nlxc.cgroup2.devices.allow: c 509:* rwm\nlxc.mount.entry: /dev/nvidia0 dev/nvidia0 none bind,optional,create=file\nlxc.mount.entry: /dev/nvidiactl dev/nvidiactl none bind,optional,create=file\nlxc.mount.entry: /dev/nvidia-uvm dev/nvidia-uvm none bind,optional,create=file\nlxc.mount.entry: /dev/nvidia-modeset dev/nvidia-modeset none bind,optional,create=file\nlxc.mount.entry: /dev/nvidia-uvm-tools dev/nvidia-uvm-tools none bind,optional,create=file",
     "editConfigImageAlt": "LXC configuration",
     "editSave": "Save (<code>Ctrl+X</code>) and start the container.",
     "installCtHeading": "5.3 Install the driver inside the container",
     "installCtCalloutTitle": "Important",
     "installCtCalloutBody": "This part runs <strong>inside</strong> the container, not on the host.",
     "installCtBody": "The kernel module is already loaded by the host — the container only needs the userland libraries that match the same driver version:",
-    "installCtCode": "mkdir -p /opt/nvidia\ncd /opt/nvidia\nwget https://download.nvidia.com/XFree86/Linux-x86_64/'<'VERSION'>'/NVIDIA-Linux-x86_64-'<'VERSION'>'.run\nchmod +x NVIDIA-Linux-x86_64-'<'VERSION'>'.run\n./NVIDIA-Linux-x86_64-'<'VERSION'>'.run --no-kernel-module",
-    "installCtAfter": "Accept the defaults at every prompt.",
+    "installCtCode": "mkdir -p /opt/nvidia\ncd /opt/nvidia\nwget https://download.nvidia.com/XFree86/Linux-x86_64/VERSION/NVIDIA-Linux-x86_64-VERSION.run\nchmod +x NVIDIA-Linux-x86_64-VERSION.run\n./NVIDIA-Linux-x86_64-VERSION.run --no-kernel-module",
+    "installCtAfter": "Review the prompts and keep this installation limited to user-space libraries. Do not build or install a kernel module inside the LXC.",
     "installCtImageAlt": "NVIDIA driver installation",
     "verifyCtHeading": "5.4 Verify inside the container",
     "verifyCtSmiCode": "nvidia-smi",
@@ -129,25 +141,25 @@
     "verifyCtLsImageAlt": "NVIDIA devices in LXC",
     "verifyCtAfter": "You should see the GPU listed and the device nodes mounted into the container's filesystem.",
     "workloadHeading": "5.5 Confirm a real workload picks up the GPU",
-    "workloadBody": "For Plex / Jellyfin, transcode a video and check the dashboard / logs — hardware-accelerated transcoding is now active.",
+    "workloadBody": "Enable NVIDIA hardware acceleration in Plex or Jellyfin, start a video transcode and check its dashboard or logs for actual GPU use. Installing the driver alone does not enable acceleration in the application.",
     "workloadImage1Alt": "Plex using NVIDIA GPU",
     "workloadImage2Alt": "Plex using NVIDIA GPU - active session",
-    "repeatNote": "To wire the GPU into another container, repeat <strong>section 5</strong> for each additional CTID. The driver install inside the container only needs to be done once per container."
+    "repeatNote": "Repeat <strong>section 5</strong> for each additional container that needs GPU access. Keep the user-space driver libraries in every container aligned when the host driver is updated."
   },
   "docker": {
     "heading": "6. (Optional) NVIDIA Docker inside an LXC",
-    "body": "If the container runs Docker and you want containers-inside-the-container to use the GPU, install <code>nvidia-docker2</code>. From inside the LXC:",
-    "code": "wget https://raw.githubusercontent.com/MacRimi/manuales/main/NVIDIA/nvidia-docker.sh\nchmod +x nvidia-docker.sh\n./nvidia-docker.sh",
-    "after": "The script handles the repository setup, package install and Docker daemon configuration in one go."
+    "body": "If Docker already runs inside the LXC, install <code>nvidia-container-toolkit</code> there to expose the GPU to its Docker containers. GPU access from the LXC must work first. The following commands are for a rootful Docker installation:",
+    "code": "apt-get update\napt-get install -y ca-certificates curl gnupg\ncurl -fsSL https://nvidia.github.io/libnvidia-container/gpgkey | gpg --dearmor --yes -o /usr/share/keyrings/nvidia-container-toolkit-keyring.gpg\ncurl -fsSL https://nvidia.github.io/libnvidia-container/stable/deb/nvidia-container-toolkit.list | sed 's#deb https://#deb [signed-by=/usr/share/keyrings/nvidia-container-toolkit-keyring.gpg] https://#g' > /etc/apt/sources.list.d/nvidia-container-toolkit.list\napt-get update\napt-get install -y nvidia-container-toolkit\nnvidia-ctk runtime configure --runtime=docker\nsystemctl restart docker",
+    "after": "These commands configure NVIDIA’s repository, install the toolkit, configure the Docker runtime and restart Docker. LXC device permissions and cgroup restrictions still apply; verify GPU use with a test workload."
   },
   "troubleshoot": {
     "heading": "Troubleshooting",
     "items": [
-      "<strong><code>nvidia-smi</code> on the host shows the GPU, but inside the container it errors with \"No devices found\":</strong> the driver versions don't match. Re-download the same <code>'<'VERSION'>'</code> inside the container and run with <code>--no-kernel-module</code>.",
-      "<strong>Driver compile fails on the host with \"No precompiled kernel interface was found\":</strong> kernel headers are missing or out of sync. Re-run <code>apt-get install pve-headers-$(uname -r)</code> and confirm <code>uname -r</code> matches the running kernel.",
-      "<strong>NVENC sessions still capped after applying the patch:</strong> the patch was overwritten by a driver update. Re-run <code>./patch.sh</code> from <code>/opt/nvidia/nvidia-patch</code>.",
-      "<strong>GPU stops responding after a few hours of idle:</strong> persistence daemon isn't running. Check with <code>systemctl status nvidia-persistenced</code> and start / enable it.",
-      "<strong>Container starts but <code>ls /dev/nv*</code> shows nothing:</strong> the major numbers in the LXC config don't match the host's. Re-run <code>ls -l /dev/nv*</code> on the host and adjust the <code>lxc.cgroup2.devices.allow</code> lines accordingly."
+      "<strong><code>nvidia-smi</code> works on the host but reports \"No devices found\" in the container:</strong> check device mounts, permissions and matching driver libraries. If versions differ, install the host’s <code>'<'VERSION'>'</code> in the container with <code>--no-kernel-module</code>.",
+      "<strong>Driver compilation fails:</strong> inspect the build log. \"No precompiled kernel interface was found\" can simply mean the installer must compile locally. Install headers matching <code>uname -r</code> using <code>apt-get install pve-headers-$(uname -r)</code>, or the equivalent proxmox-headers package for that kernel.",
+      "<strong>NVENC sessions remain limited:</strong> confirm the patch supports the active driver. A driver update can overwrite it. For a supported version, reapply <code>./patch.sh</code> from <code>/opt/nvidia/nvidia-patch</code> and review its output.",
+      "<strong>GPU stops responding after idle:</strong> check <code>systemctl status nvidia-persistenced</code> and enable the service if intended. Also inspect kernel and driver logs; a stopped persistence daemon is not the only possible cause.",
+      "<strong>Container starts but <code>ls /dev/nv*</code> shows no NVIDIA devices:</strong> check the bind-mount entries and host device paths. Use <code>ls -l /dev/nv*</code> on the host to verify NVIDIA major numbers, then check the <code>lxc.cgroup2.devices.allow</code> rules and permissions."
     ]
   }
 }
diff --git a/web/messages/es/common.json b/web/messages/es/common.json
index 3ba17487..477d303b 100644
--- a/web/messages/es/common.json
+++ b/web/messages/es/common.json
@@ -28,7 +28,12 @@
     "switcher": "Idioma",
     "en": "English",
     "es": "Español",
-    "sk": "Slovenčina"
+    "sk": "Slovenčina",
+    "de": "Deutsch",
+    "fr": "Français",
+    "it": "Italiano",
+    "pt": "Português",
+    "sv": "Svenska"
   },
   "resources": {
     "documentation": {
diff --git a/web/messages/es/docs/about/code-of-conduct.json b/web/messages/es/docs/about/code-of-conduct.json
index 77757c6a..b1ee353a 100644
--- a/web/messages/es/docs/about/code-of-conduct.json
+++ b/web/messages/es/docs/about/code-of-conduct.json
@@ -1,12 +1,13 @@
 {
   "meta": {
-    "title": "Código de conducta | ProxMenux Documentation",
+    "title": "Código de conducta | Documentación de ProxMenux",
     "description": "Código de conducta y buenas prácticas de ProxMenux para colaboradores, testers y usuarios.",
-    "ogTitle": "Código de conducta | ProxMenux Documentation",
+    "ogTitle": "Código de conducta | Documentación de ProxMenux",
     "ogDescription": "Expectativas sobre responsabilidad del código, divulgación de problemas de seguridad y alcance de los PRs para el proyecto ProxMenux."
   },
   "errors": {
     "notFound": "Error: archivo CODE_OF_CONDUCT.md no encontrado.",
     "loadFailed": "Error: no se pudo cargar el contenido del código de conducta."
-  }
+  },
+  "contentMarkdown": "# 📝 Código de conducta y buenas prácticas\n\nEste documento define los **principios y las pautas** de uso de **ProxMenux** para promover el **respeto, la colaboración y la seguridad** durante el desarrollo.\n\n## 📌 1. Autoría del código y reconocimiento\n\n- Si se utilizan **scripts, fragmentos de código o ideas** de otros repositorios o desarrolladores, se reconocerá siempre la autoría original.\n- Se añadirá un comentario en el código o la documentación que indique la fuente y, si es posible, enlace al repositorio original.\n- Al utilizar código con una **licencia** concreta, se deben respetar sus condiciones.\n\n### ✅ Ejemplo de reconocimiento de autoría en el código:\n\n```bash\n# Script basado en el trabajo de [Autor] en [Enlace al repositorio]\n```\n\n## 🔒 2. Seguridad y responsabilidad del código\n\n- Todo el código de este repositorio sigue las buenas prácticas de desarrollo seguro.\n- No se permiten contribuciones que introduzcan vulnerabilidades intencionadas o prácticas inseguras.\n- Los scripts nunca deben comprometer la seguridad del sistema ni los datos de los usuarios.\n- Las contribuciones deben revisarse antes de implementarlas para comprobar su seguridad y estabilidad.\n\n### ⚠️ Divulgación responsable de vulnerabilidades\n\nSi descubres una vulnerabilidad de seguridad, NO la notifiques en incidencias o foros públicos.\n\nComunícala en privado por correo electrónico:\n\n📧 proxmenux@macrimi.pro\n\nPara más información sobre las vulnerabilidades y cómo notificarlas, consulta nuestra [política de seguridad](./SECURITY.md).\n\n## 🤝 3. Normas de la comunidad\n\nPara mantener un entorno respetuoso y profesional, todos los usuarios deben seguir estas pautas:\n\n- ✅ Sé respetuoso y constructivo en las discusiones.\n- ❌ No se tolerarán el acoso, el discurso de odio ni las conductas ofensivas.\n- ✅ Aporta comentarios de forma profesional, sin ataques personales.\n- ❌ El incumplimiento puede dar lugar a advertencias o expulsiones, según la gravedad.\n\n##\n\nEste documento promueve un uso ético del código, la conciencia de seguridad y una comunidad respetuosa.\n\n📢 ¡Construyamos algo grande juntos!\n"
 }
diff --git a/web/messages/es/docs/about/contributing.json b/web/messages/es/docs/about/contributing.json
index aeaeb889..f5090e22 100644
--- a/web/messages/es/docs/about/contributing.json
+++ b/web/messages/es/docs/about/contributing.json
@@ -1,6 +1,6 @@
 {
   "meta": {
-    "title": "Contribuir a ProxMenux | ProxMenux Documentation",
+    "title": "Contribuir a ProxMenux | Documentación de ProxMenux",
     "description": "Cómo contribuir a ProxMenux — modelo de ramas (main / develop / feature/*), flujo de pull requests, plantilla de cabecera de script con atribución de autor y enlace opcional de patrocinio, política de diseño UI en dos fases, funciones de mensajes y el camino desde una rama de función hasta un release estable.",
     "ogTitle": "Contribuir a ProxMenux",
     "ogDescription": "Modelo de ramas, flujo de trabajo, atribución en la cabecera del script y política de diseño UI en dos fases que los colaboradores deben seguir."
@@ -129,7 +129,7 @@
     "intro": "Todas definidas en <code>utils.sh</code>. Úsalas como el valor por defecto para cualquier salida visible para el usuario — visuales coherentes entre scripts es la idea. Si tu script necesita una función nueva que no encaja en el conjunto existente (un nuevo nivel de severidad, un nuevo helper de layout, etc.), propónla en tu Pull Request — se revisará y se añadirá a <code>utils.sh</code> si es útil de forma amplia.",
     "headerFunction": "Función",
     "headerWhen": "Cuándo usar",
-    "headerSpinner": "Spinner",
+    "headerSpinner": "Indicador de progreso",
     "rows": [
       {
         "function": "msg_info \"text\"",
@@ -163,7 +163,7 @@
       },
       {
         "function": "msg_success \"text\"",
-        "whenRich": "Prompt final \"Press Enter to return\" al final de la fase 2.",
+        "whenRich": "Mensaje final «Press Enter to return» al terminar la fase 2.",
         "spinner": "Para"
       },
       {
diff --git a/web/messages/es/docs/about/contributors.json b/web/messages/es/docs/about/contributors.json
index 6cf0ca0f..bba0ff22 100644
--- a/web/messages/es/docs/about/contributors.json
+++ b/web/messages/es/docs/about/contributors.json
@@ -1,32 +1,32 @@
 {
   "meta": {
-    "title": "Colaboradores | ProxMenux Documentation",
-    "description": "Reconocimiento a las personas que hacen posible ProxMenux — testers, revisores y desarrolladores que dan forma a cada release.",
-    "ogTitle": "Colaboradores | ProxMenux Documentation",
+    "title": "Colaboradores | Documentación de ProxMenux",
+    "description": "Reconocimiento a las personas que hacen posible ProxMenux: quienes prueban, revisan y desarrollan cada versión.",
+    "ogTitle": "Colaboradores | Documentación de ProxMenux",
     "ogDescription": "Conoce a los colaboradores detrás de ProxMenux."
   },
   "header": {
     "title": "Colaboradores",
-    "description": "El proyecto ProxMenux crece y prospera gracias a la contribución de sus colaboradores. Este es el merecido reconocimiento a su trabajo — probando builds antes del release, cazando regresiones, revisando PRs y dando forma a la dirección de las nuevas funciones.",
+    "description": "ProxMenux crece gracias a sus colaboradores. Esta página reconoce su trabajo: probar versiones antes de publicarlas, detectar regresiones, revisar PR y ayudar a orientar las nuevas funciones.",
     "section": "Acerca de"
   },
   "beyond": {
     "title": "Más allá de esta lista",
-    "body": "Mucha más gente contribuye vía reportes de bugs, ideas de funciones en Discussions, pruebas beta y traducciones. La lista completa de colaboradores de código vive en el <extlink>grafo de colaboradores de GitHub</extlink>. La página de abajo destaca a las personas que han estado más activamente involucradas en probar y revisar releases de ProxMenux."
+    "body": "Muchas más personas contribuyen notificando errores, proponiendo funciones en Discussions, probando versiones beta y traduciendo el proyecto. La lista completa de colaboradores del código está en el <extlink>gráfico de colaboradores de GitHub</extlink>. Esta página destaca a quienes participan más activamente en las pruebas y la revisión de las versiones de ProxMenux."
   },
   "testers": {
-    "heading": "Testers y revisores",
-    "intro": "Estas personas fueron de las primeras en contribuir al proyecto, probando, reportando incidencias y proponiendo mejoras que ayudaron a que ProxMenux haya crecido hasta convertirse en lo que es hoy.",
+    "heading": "Pruebas y revisión",
+    "intro": "Estas personas estuvieron entre las primeras en contribuir al proyecto. Sus pruebas, avisos de errores y propuestas de mejora ayudaron a convertir ProxMenux en lo que es hoy.",
     "roles": {
       "testing": "Pruebas",
-      "testingReviewer": "Pruebas y revisor"
+      "testingReviewer": "Pruebas y revisión"
     },
     "youtube": "YouTube"
   },
   "contribute": {
     "heading": "¿Quieres colaborar?",
     "intro": "Cualquier contribución es bienvenida — código, pruebas, diseño, documentación o simplemente compartir tus ideas:",
-    "tester": "<strong>Tester</strong> — prueba el <beta>canal beta</beta> y reporta qué funciona y qué no antes de los releases estables.",
+    "tester": "<strong>Pruebas</strong>: prueba el <beta>canal beta</beta> y comunica qué funciona y qué no antes de que se publiquen las versiones estables.",
     "developer": "<strong>Desarrollador</strong> — Bash + Next.js (TypeScript) + un poco de Python para el venv de traducción. Los PRs son bienvenidos en <gh>GitHub</gh>.",
     "designer": "<strong>Diseñador</strong> — mejoras de UI, iconos, capturas para la documentación.",
     "ideas": "<strong>Ideas</strong> — abre un hilo en <disc>GitHub Discussions</disc> antes de abrir una incidencia de petición de función."
diff --git a/web/messages/es/docs/about/faq.json b/web/messages/es/docs/about/faq.json
index 404377e6..5b879271 100644
--- a/web/messages/es/docs/about/faq.json
+++ b/web/messages/es/docs/about/faq.json
@@ -1,8 +1,8 @@
 {
   "meta": {
-    "title": "FAQ | ProxMenux Documentation",
+    "title": "Preguntas frecuentes | Documentación de ProxMenux",
     "description": "Preguntas frecuentes sobre ProxMenux: qué es, instalación, compatibilidad (solo PVE 8+), personalización, actualizaciones, seguridad, uso en producción, seguridad de archivos del sistema, contribuir, desinstalación.",
-    "ogTitle": "FAQ | ProxMenux Documentation",
+    "ogTitle": "Preguntas frecuentes | Documentación de ProxMenux",
     "ogDescription": "Preguntas frecuentes sobre instalación, compatibilidad, seguridad y contribución a ProxMenux."
   },
   "header": {
@@ -24,7 +24,7 @@
   "q1": {
     "question": "¿Qué es ProxMenux y para qué sirve?",
     "p1Rich": "<strong>ProxMenux</strong> es una herramienta interactiva basada en menús diseñada para hacer <strong>Proxmox VE</strong> accesible a todos los usuarios, independientemente de su experiencia técnica. Simplifica la ejecución de comandos, permitiendo a los usuarios realizar acciones en su sistema sin necesidad de conocimientos avanzados de Linux.",
-    "p2": "Para usuarios menos experimentados, ProxMenux ofrece una forma intuitiva de ejecutar comandos mediante una interfaz de menús estructurada, reduciendo la necesidad de entrada manual por terminal. Para administradores con experiencia, recorta pulsaciones para flujos repetitivos (hardening post-instalación, passthrough de GPU, importación de VMs OVF, rotaciones de snapshots ZFS).",
+    "p2": "Para quienes tienen menos experiencia, ProxMenux ofrece menús estructurados que reducen la necesidad de escribir comandos a mano. A los administradores con experiencia les ahorra pasos en tareas repetitivas: reforzar la seguridad tras instalar, pasar una GPU, importar VM en formato OVF o gestionar la rotación de snapshots ZFS.",
     "p3": "Proxmox VE se usa ampliamente para:",
     "items": [
       "Virtualización de nivel empresarial",
@@ -34,7 +34,7 @@
   },
   "q2": {
     "question": "¿Cómo instalo ProxMenux?",
-    "p1Rich": "Sigue la <installlink>guía de instalación</installlink>. En corto:",
+    "p1Rich": "Sigue la <installlink>guía de instalación</installlink>. En resumen:",
     "stableInstall": "bash -c \"$(wget -qLO - https://raw.githubusercontent.com/MacRimi/ProxMenux/main/install_proxmenux.sh)\"",
     "p2": "Una vez instalado, simplemente arráncalo con:",
     "menuCmd": "menu"
@@ -45,7 +45,7 @@
   },
   "q4": {
     "question": "¿Puedo personalizar ProxMenux?",
-    "p1Rich": "Los scripts del núcleo no se pueden modificar directamente porque están alojados en GitHub y se refrescan con el flujo de auto-actualización. Lo que <em>sí</em> puedes personalizar:",
+    "p1Rich": "Las actualizaciones pueden sobrescribir los cambios locales en los scripts principales, así que evita editar esos archivos directamente. Lo que <em>sí</em> puedes personalizar:",
     "items": [
       "El banner de la consola vía la herramienta <strong>FastFetch</strong> en las opciones de post-instalación.",
       "Qué componentes opcionales se instalan (Monitor, Fail2Ban, Lynis…) — elige durante la instalación o vía el menú correspondiente más tarde."
@@ -53,8 +53,8 @@
   },
   "q5": {
     "question": "¿Cómo actualizo ProxMenux?",
-    "p1Rich": "Cuando hay una nueva versión disponible, ProxMenux la detecta en el siguiente lanzamiento de <code>menu</code> y te pide actualizar. Aceptar reemplaza los archivos de utilidad y las configuraciones en sitio. No hace falta descarga manual.",
-    "p2Rich": "Los usuarios estables reciben releases estables; los usuarios beta reciben releases beta. Cuando se publica una versión estable, ProxMenux notifica a los usuarios beta en el siguiente lanzamiento y ofrece cambiar automáticamente — mira la página del <betalink>programa beta</betalink>."
+    "p1Rich": "Cuando hay una nueva versión, ProxMenux la detecta la próxima vez que ejecutas <code>menu</code> y te propone actualizar. Si aceptas, sustituye los archivos de la herramienta y su configuración en la instalación existente; no necesitas descargar nada a mano.",
+    "p2Rich": "Los usuarios de la versión estable reciben las actualizaciones estables y los de la beta, las actualizaciones beta. Cuando se publica una versión estable, la beta avisa al volver a abrir el menú y ofrece cambiar automáticamente a la estable. Consulta el <betalink>programa beta</betalink>."
   },
   "q6": {
     "question": "¿Dónde puedo reportar incidencias?",
@@ -63,19 +63,19 @@
   },
   "q7": {
     "question": "¿Puedo contribuir a ProxMenux?",
-    "p1Rich": "<strong>Absolutamente.</strong> ProxMenux es de código abierto y colaborativo. Las contribuciones pueden ser código (bash, Next.js / TypeScript, el venv de Python de traducción), pruebas, documentación, diseño o simplemente ideas.",
+    "p1Rich": "<strong>Por supuesto.</strong> ProxMenux es un proyecto de código abierto y colaborativo. Puedes contribuir con código (Bash, Next.js/TypeScript y herramientas de traducción en Python), pruebas, documentación, diseño o ideas.",
     "item1Rich": "Discute ideas en <discusslink>GitHub Discussions</discusslink> antes de abrir una petición de función.",
     "item2Rich": "Para PRs, lee primero el <coclink>código de conducta y buenas prácticas</coclink>.",
     "item3Rich": "Mira la <contriblink>página de colaboradores</contriblink> para los testers y revisores actuales."
   },
   "q8": {
     "question": "¿ProxMenux modifica archivos críticos del sistema?",
-    "p1Rich": "<strong>No.</strong> ProxMenux instala:",
-    "item1Rich": "Dependencias vía apt: <code>dialog</code>, <code>curl</code>, <code>jq</code>, <code>git</code> (y <code>python3</code> + <code>googletrans</code> en la instalación con traducción).",
+    "p1Rich": "<strong>La instalación de ProxMenux añade los siguientes componentes.</strong>",
+    "item1Rich": "Dependencias mediante apt: <code>dialog</code>, <code>curl</code>, <code>jq</code> y <code>git</code>. Las traducciones usan catálogos JSON pregenerados; el instalador no añade al host un entorno virtual de traducción.",
     "item2Rich": "El árbol de scripts en <code>/usr/local/share/proxmenux/</code>.",
     "item3Rich": "El lanzador en <code>/usr/local/bin/menu</code>.",
     "item4Rich": "Opcional: el servicio systemd del Monitor en <code>proxmenux-monitor.service</code>.",
-    "p2Rich": "ProxMenux <em>no</em> toca la configuración del núcleo de Proxmox a menos que se lo pidas explícitamente vía un menú dedicado (p. ej. el flujo de reparación de red edita <code>/etc/network/interfaces</code> — pero solo después de que confirmes y se haga un backup)."
+    "p2Rich": "ProxMenux <em>no</em> modifica la configuración principal de Proxmox salvo que lo solicites expresamente desde un menú específico. Por ejemplo, la reparación de red edita <code>/etc/network/interfaces</code>, pero solo después de tu confirmación y de hacer un backup."
   },
   "q9": {
     "question": "¿Es seguro usar ProxMenux en producción?",
@@ -83,12 +83,12 @@
   },
   "q10": {
     "question": "¿Cómo desinstalo ProxMenux?",
-    "p1Rich": "Desde dentro de ProxMenux: <strong>Settings → Desinstalar ProxMenux</strong>. El desinstalador elimina el árbol de scripts, el lanzador y el servicio del Monitor, opcionalmente elimina las dependencias seleccionadas y restaura los backups de <code>/root/.bashrc</code> y <code>/etc/motd</code> tomados en el momento de la instalación.",
+    "p1Rich": "Desde ProxMenux: <strong>Ajustes → Desinstalar ProxMenux</strong>. El desinstalador elimina el árbol de scripts, el lanzador y el servicio Monitor, permite eliminar dependencias seleccionadas y restaura <code>/root/.bashrc</code> y <code>/etc/motd</code> desde los backups que crea Post-Install, si existen (si no, elimina la línea de ProxMenux del MOTD).",
     "p2Rich": "Paso a paso completo: <uninstalllink>Desinstalar ProxMenux</uninstalllink>."
   },
   "q11": {
     "question": "VirusTotal marca la URL de instalación — ¿es seguro?",
-    "p1Rich": "Una detección 1/95 por motores heurísticos (p. ej. <em>Chong Lua Dao</em>) es un falso positivo conocido. El instalador usa el patrón estándar <code>curl | bash</code> y descarga binarios legítimos (como <code>jq</code> desde su release oficial en GitHub), que los escáneres agresivos marcan basándose en el <em>comportamiento</em> y no en código realmente malicioso.",
+    "p1Rich": "El resultado de 1/95 notificado en el issue #162, de <em>Chong Lua Dao</em>, fue identificado por el mantenedor como un falso positivo. El instalador se ejecuta con una orden que descarga y ejecuta el script (<code>bash -c \"$(wget -qLO - …)\"</code>) y puede descargar <code>jq</code> desde su versión oficial de GitHub. Este <em>comportamiento</em> puede activar análisis heurísticos; aquel informe histórico no determina la seguridad de futuras descargas.",
     "p2Rich": "ProxMenux es 100% código abierto y el script de instalación es revisable línea por línea: <scriptlink>install_proxmenux.sh</scriptlink>. Más contexto en la <issuelink>Issue #162</issuelink>."
   }
 }
diff --git a/web/messages/es/docs/about/index.json b/web/messages/es/docs/about/index.json
index e0ca4406..058cc210 100644
--- a/web/messages/es/docs/about/index.json
+++ b/web/messages/es/docs/about/index.json
@@ -1,8 +1,8 @@
 {
   "meta": {
-    "title": "Acerca de | ProxMenux Documentation",
+    "title": "Acerca del proyecto | Documentación de ProxMenux",
     "description": "Acerca de ProxMenux: objetivos del proyecto, colaboradores, FAQ y código de conducta. Herramienta de gestión basada en menús, de código abierto, para Proxmox VE 8+, construida y mantenida por MacRimi con un pequeño equipo de testers y colaboradores.",
-    "ogTitle": "Acerca de | ProxMenux Documentation",
+    "ogTitle": "Acerca del proyecto | Documentación de ProxMenux",
     "ogDescription": "Acerca de ProxMenux — herramienta de gestión basada en menús, de código abierto, para Proxmox VE 8+."
   },
   "header": {
@@ -27,7 +27,7 @@
         "icon": "Users",
         "href": "/docs/about/contributors",
         "title": "Colaboradores",
-        "description": "Reconocimiento a las personas que hacen posible ProxMenux — testers, revisores y desarrolladores que dan forma a cada release."
+        "description": "Reconocimiento a las personas que hacen posible ProxMenux: quienes prueban, revisan y desarrollan cada versión."
       },
       {
         "icon": "ScrollText",
@@ -38,7 +38,7 @@
     ]
   },
   "involved": {
-    "heading": "Implicarse",
+    "heading": "Participa",
     "intro": "Tres lugares para participar en el proyecto:",
     "cards": [
       {
diff --git a/web/messages/es/docs/backup-restore/creating-backups.json b/web/messages/es/docs/backup-restore/creating-backups.json
index f4b2188f..b3805757 100644
--- a/web/messages/es/docs/backup-restore/creating-backups.json
+++ b/web/messages/es/docs/backup-restore/creating-backups.json
@@ -1,20 +1,20 @@
 {
   "meta": {
-    "title": "Crear copias — flujo interactivo de copia | ProxMenux",
-    "description": "El flujo interactivo de copia en ProxMenux. Dos puntos de entrada (menú TUI de Scripts y UI Web del Monitor), tres destinos, dos modos de perfil, un paso común de staging y un diálogo de confirmación. Documenta la matriz de seis opciones, los perfiles Default y Custom, y qué ve el usuario entre seleccionar una copia y ver el archivo aterrizando en el destino.",
-    "ogTitle": "ProxMenux Backup — crear copias",
-    "ogDescription": "El flujo interactivo de copia con tres destinos, dos perfiles y un paso común de staging.",
-    "twitterTitle": "Crear copias | ProxMenux",
-    "twitterDescription": "Flujo interactivo de copia con tres destinos y dos modos de perfil."
+    "title": "Crear backups — flujo interactivo de backup | ProxMenux",
+    "description": "El flujo interactivo de backup en ProxMenux. Dos puntos de entrada (menú TUI de Scripts y UI Web del Monitor), tres destinos, dos modos de perfil, un paso común de staging y un diálogo de confirmación. Documenta la matriz de seis opciones, los perfiles Default y Custom, y qué ve el usuario entre seleccionar un backup y ver el archivo aterrizando en el destino.",
+    "ogTitle": "ProxMenux Backup — crear backups",
+    "ogDescription": "El flujo interactivo de backup con tres destinos, dos perfiles y un paso común de staging.",
+    "twitterTitle": "Crear backups | ProxMenux",
+    "twitterDescription": "Flujo interactivo de backup con tres destinos y dos modos de perfil."
   },
   "header": {
-    "title": "Crear copias",
-    "description": "El flujo interactivo de copia: elegir un destino y un perfil, revisar el resumen de confirmación, y ver el archivo aterrizando. Dos puntos de entrada comparten el mismo backend y producen archivos idénticos.",
+    "title": "Crear backups",
+    "description": "El flujo interactivo de backup: elegir un destino y un perfil, revisar el resumen de confirmación, y ver el archivo aterrizando. Dos puntos de entrada comparten el mismo backend y producen archivos idénticos.",
     "section": "Backup & Restore"
   },
   "intro": {
     "title": "Dos puntos de entrada, funcionalidad idéntica",
-    "body": "El TUI de Scripts y la UI Web del Monitor exponen <strong>exactamente la misma funcionalidad</strong>. Cada copia — manual o programada — pasa por la misma matriz de elección (tres destinos × dos perfiles) e invoca la misma función backend por celda (<code>_bk_pbs</code>, <code>_bk_borg</code> o <code>_bk_local</code>). Los archivos producidos desde uno u otro punto de entrada son indistinguibles. Cuál usar es una cuestión de preferencia: el TUI es amigable por SSH y admite scripting; el Monitor ofrece click-y-elegir y convive con las vistas de notificaciones y de tail del log."
+    "body": "El TUI de Scripts y la UI Web del Monitor exponen <strong>exactamente la misma funcionalidad</strong>. Cada backup — manual o programado — pasa por la misma matriz de elección (tres destinos × dos perfiles) e invoca la misma función backend por celda (<code>_bk_pbs</code>, <code>_bk_borg</code> o <code>_bk_local</code>). Los archivos producidos desde uno u otro punto de entrada son indistinguibles. Cuál usar es una cuestión de preferencia: el TUI es amigable por SSH y admite scripting; el Monitor ofrece click-y-elegir y convive con las vistas de notificaciones y de tail del log."
   },
   "entryPoints": {
     "heading": "Los dos puntos de entrada",
@@ -32,11 +32,11 @@
     ]
   },
   "modes": {
-    "heading": "Copias manuales vs programadas",
-    "body": "Las copias se pueden producir en dos modos: <strong>manuales</strong> (el flujo interactivo que documenta esta página — el usuario elige un destino y un perfil desde un menú y ve el archivo aterrizando) o <strong>programadas</strong> (un trabajo desatendido que se ejecuta en un timer estilo cron y aplica la retención configurada en el trabajo). Ambos modos soportan los mismos tres destinos y los mismos dos perfiles, y ambos están disponibles desde los dos puntos de entrada — el menú TUI de Scripts y la pestaña Backups del Monitor. Los trabajos programados usan las mismas funciones backend que el flujo manual a través de <code>run_scheduled_backup.sh</code>; los archivos producidos son indistinguibles.",
+    "heading": "Backups manuales vs programados",
+    "body": "Los backups se pueden producir en dos modos: <strong>manuales</strong> (el flujo interactivo que documenta esta página — el usuario elige un destino y un perfil desde un menú y ve el archivo aterrizando) o <strong>programadas</strong> (un trabajo desatendido que se ejecuta en un timer estilo cron y aplica la retención configurada en el trabajo). Ambos modos soportan los mismos tres destinos y los mismos dos perfiles, y ambos están disponibles desde los dos puntos de entrada — el menú TUI de Scripts y la pestaña Backups del Monitor. Los trabajos programados usan las mismas funciones backend que el flujo manual a través de <code>run_scheduled_backup.sh</code>; los archivos producidos son indistinguibles.",
     "seeAlso": "La página de trabajos programados cubre el flujo completo, incluyendo cómo crear un trabajo, adjuntarlo a un timer vzdump de PVE existente, y configurar los valores de retención.",
     "monitorAlt": "Pestaña Backups del Monitor de ProxMenux mostrando el diálogo New scheduled backup con los campos de destino, perfil, horario y retención.",
-    "monitorCaption": "Copia programada — Monitor de ProxMenux. El mismo diálogo estilo asistente que crea una copia manual lleva los campos de horario y retención al final para la ruta desatendida."
+    "monitorCaption": "Backup programado — Monitor de ProxMenux. El mismo diálogo estilo asistente que crea un backup manual lleva los campos de horario y retención al final para la ruta desatendida."
   },
   "matrix": {
     "heading": "La matriz de seis opciones",
@@ -83,13 +83,13 @@
   "profiles": {
     "heading": "Perfil Default vs Custom",
     "defaultTitle": "Perfil Default",
-    "defaultBody": "El perfil por defecto es la lista curada de <code>hb_default_profile_paths</code> (documentada en <em>Cómo funciona</em> bajo <em>Categorías de rutas</em>) más cada entrada del fichero de extras persistentes <code>/usr/local/share/proxmenux/backup-extra-paths.txt</code>. El usuario confirma el destino y las opciones de cifrado y la copia continúa sin más selección de rutas.",
+    "defaultBody": "El perfil por defecto es la lista curada de <code>hb_default_profile_paths</code> (documentada en <em>Cómo funciona</em> bajo <em>Categorías de rutas</em>) más cada entrada del fichero de extras persistentes <code>/usr/local/share/proxmenux/backup-extra-paths.txt</code>. El usuario confirma el destino y las opciones de cifrado y el backup continúa sin más selección de rutas.",
     "customTitle": "Perfil Custom",
-    "customBody": "El perfil Custom abre un checklist mostrando cada ruta del perfil por defecto (sin marcar) y cada extra persistente (premarcado, prefijado con <code>[+]</code>). El usuario marca el conjunto para esa ejecución y puede pulsar <em>Add custom path</em> para añadir una nueva ruta absoluta. Cualquier ruta añadida en línea se persiste en <code>backup-extra-paths.txt</code> para que futuras copias la recojan automáticamente sin volver a añadirla. Quitar la marca a un extra persistente lo desmarca para esa ejecución pero no lo elimina del fichero — la eliminación es una acción <em>Manage custom paths</em> separada, fuera del flujo de copia.",
+    "customBody": "El perfil Custom abre un checklist mostrando cada ruta del perfil por defecto (sin marcar) y cada extra persistente (premarcado, prefijado con <code>[+]</code>). El usuario marca el conjunto para esa ejecución y puede pulsar <em>Add custom path</em> para añadir una nueva ruta absoluta. Cualquier ruta añadida en línea se persiste en <code>backup-extra-paths.txt</code> para que futuros backups la recojan automáticamente sin volver a añadirla. Quitar la marca a un extra persistente lo desmarca para esa ejecución pero no lo elimina del fichero — la eliminación es una acción <em>Manage custom paths</em> separada, fuera del flujo de backup.",
     "customPickerAlt": "Checklist del perfil Custom mostrando las rutas del perfil por defecto (sin marcar) y los extras persistentes (premarcados con prefijo [+]), más botones para añadir una ruta nueva o confirmar la selección.",
     "customPickerCaption": "Perfil Custom — el path picker. Las rutas del perfil por defecto aparecen sin marcar; los extras persistentes aparecen premarcados con prefijo [+]. El usuario marca el conjunto para esa ejecución.",
     "manageCustomAlt": "Menú Manage custom paths mostrando la lista de extras persistentes y opciones para añadirlos, eliminarlos o editarlos.",
-    "manageCustomCaption": "Manage custom paths — el punto de entrada donde se añaden o eliminan los extras persistentes. Cada ruta listada aquí se incluye automáticamente en las copias en modo Default sin necesidad de abrir el picker Custom."
+    "manageCustomCaption": "Manage custom paths — el punto de entrada donde se añaden o eliminan los extras persistentes. Cada ruta listada aquí se incluye automáticamente en los backups en modo Default sin necesidad de abrir el picker Custom."
   },
   "commonPipeline": {
     "heading": "Qué se ejecuta con independencia del destino",
@@ -98,7 +98,7 @@
       {
         "step": "1",
         "name": "Ensamblado del rootfs",
-        "detail": "Ejecuta <code>rsync -a</code> por cada ruta seleccionada hacia <code>staging_root/rootfs/</code>. La base pmxcfs en <code>/var/lib/pve-cluster/config.db</code> se captura aparte con <code>sqlite3 .backup</code> para obtener un snapshot consistente sin parar el clúster, y los sidecars <code>.db-wal</code> / <code>.db-shm</code> se excluyen del rsync; si <code>sqlite3</code> no está disponible, se deposita un <code>config.db.raw-fallback</code> que la restauración promociona al importar. Excluye subrutas volátiles (historial de bash, cachés, papelera) de <code>/root/</code>. Las rutas ausentes en el origen se registran en <code>metadata/missing_paths.txt</code> sin detener la copia."
+        "detail": "Ejecuta <code>rsync -a</code> por cada ruta seleccionada hacia <code>staging_root/rootfs/</code>. La base pmxcfs en <code>/var/lib/pve-cluster/config.db</code> se captura aparte con <code>sqlite3 .backup</code> para obtener un snapshot consistente sin parar el clúster, y los sidecars <code>.db-wal</code> / <code>.db-shm</code> se excluyen del rsync; si <code>sqlite3</code> no está disponible, se deposita un <code>config.db.raw-fallback</code> que la restauración promociona al importar. Excluye subrutas volátiles (historial de bash, cachés, papelera) de <code>/root/</code>. Las rutas ausentes en el origen se registran en <code>metadata/missing_paths.txt</code> sin detener el backup."
       },
       {
         "step": "2",
@@ -113,7 +113,7 @@
       {
         "step": "4",
         "name": "Info de la ejecución",
-        "detail": "<code>metadata/run_info.env</code> registra la identidad de la ejecución de copia — hostname, timestamp, versión del kernel — usada por el chequeo de compatibilidad de la restauración para determinar la dirección cross-kernel."
+        "detail": "<code>metadata/run_info.env</code> registra la identidad de la ejecución de backup — hostname, timestamp, versión del kernel — usada por el chequeo de compatibilidad de la restauración para determinar la dirección cross-kernel."
       },
       {
         "step": "5",
@@ -150,17 +150,17 @@
       "<code>ProxMenux-Monitor.AppImage*</code>, <code>install_proxmenux*.sh</code>"
     ],
     "notInProfileTitle": "Rutas fuera del perfil",
-    "notInProfileBody": "Todo lo que no esté listado en <code>hb_default_profile_paths</code> y no se haya añadido como ruta custom o extra persistente no forma parte de la copia. Ejemplos notables:",
+    "notInProfileBody": "Todo lo que no esté listado en <code>hb_default_profile_paths</code> y no se haya añadido como ruta custom o extra persistente no forma parte del backup. Ejemplos notables:",
     "notInProfileItems": [
-      "<strong>Discos de VMs y LXCs</strong> — los gestiona <code>vzdump</code>, no esta funcionalidad. Los ficheros de configuración de los invitados bajo <code>/etc/pve/nodes/*/qemu-server/*.conf</code> y <code>lxc/*.conf</code> sí se capturan (viven bajo <code>/etc/pve</code>) para que la restauración reproduzca el inventario; los discos se re-adjuntan desde una copia existente de vzdump/PBS.",
+      "<strong>Discos de VMs y LXCs</strong> — los gestiona <code>vzdump</code>, no esta funcionalidad. Los ficheros de configuración de los invitados bajo <code>/etc/pve/nodes/*/qemu-server/*.conf</code> y <code>lxc/*.conf</code> sí se capturan (viven bajo <code>/etc/pve</code>) para que la restauración reproduzca el inventario; los discos se re-adjuntan desde un backup existente de vzdump/PBS.",
       "<strong><code>/boot</code> y <code>/boot/efi</code></strong> — los binarios del kernel, el initramfs y la partición ESP UEFI los regenera el propio destino con <code>update-initramfs</code>, <code>update-grub</code> o <code>proxmox-boot-tool refresh</code> tras la restauración. El bootloader nunca se copia verbatim.",
       "<strong>Filesystems runtime del kernel y sistema</strong> — <code>/proc</code>, <code>/sys</code>, <code>/dev</code> y <code>/run</code> son pseudo-filesystems que produce el kernel y udev; no se persisten en ningún sitio.",
       "<strong>Binarios de paquetes bajo <code>/usr/bin</code>, <code>/usr/lib</code>, <code>/lib</code>, <code>/sbin</code></strong> — los reinstala el APT del destino a partir de <code>packages.manual.list</code>.",
       "<strong><code>/var/log/</code>, <code>/var/tmp/</code>, <code>/var/cache/</code></strong> — estado runtime por host, no se restaura.",
-      "<strong><code>/home/USUARIO</code></strong> — no está en el perfil por defecto. Añadirlo como ruta custom cuando un sistema tenga directorios home de usuario que deban sobrevivir a una restauración."
+      "<strong><code>/home/USER</code></strong> — no está en el perfil por defecto. Añadirlo como ruta custom cuando un sistema tenga directorios home de usuario que deban sobrevivir a una restauración."
     ],
     "customPathsTitle": "Cómo se tratan las rutas custom",
-    "customPathsBody": "Una ruta custom añadida en línea en modo Custom o persistida en <code>backup-extra-paths.txt</code> pasa por el mismo pipeline de <code>rsync</code> que las rutas del perfil por defecto. Se aplican las exclusiones globales. Si la ruta custom está bajo <code>/root/</code> o <code>/usr/local/share/proxmenux/</code>, siguen aplicando las exclusiones específicas de arriba. Cada ruta archivada — default o custom — queda registrada en <code>metadata/paths_archived.txt</code>. Las rutas que no existen en el origen se registran en <code>metadata/missing_paths.txt</code> sin detener la copia."
+    "customPathsBody": "Una ruta custom añadida en línea en modo Custom o persistida en <code>backup-extra-paths.txt</code> pasa por el mismo pipeline de <code>rsync</code> que las rutas del perfil por defecto. Se aplican las exclusiones globales. Si la ruta custom está bajo <code>/root/</code> o <code>/usr/local/share/proxmenux/</code>, siguen aplicando las exclusiones específicas de arriba. Cada ruta archivada — default o custom — queda registrada en <code>metadata/paths_archived.txt</code>. Las rutas que no existen en el origen se registran en <code>metadata/missing_paths.txt</code> sin detener el backup."
   },
   "archiveStructure": {
     "heading": "Estructura del archivo",
@@ -169,7 +169,7 @@
   },
   "confirmation": {
     "heading": "Resumen de confirmación",
-    "body": "Antes de que el backend escriba nada en el destino, ProxMenux muestra un diálogo resumen con el destino, el backup ID o nombre del archivo, el estado del cifrado y la lista de rutas que se copian. Cancelar aquí aborta la copia limpiamente — el directorio de staging se elimina por el hook <code>trap</code> definido en la función backend y ningún dato parcial llega al destino."
+    "body": "Antes de que el backend escriba nada en el destino, ProxMenux muestra un diálogo resumen con el destino, el backup ID o nombre del archivo, el estado del cifrado y la lista de rutas que se copian. Cancelar aquí aborta el backup limpiamente — el directorio de staging se elimina por el hook <code>trap</code> definido en la función backend y ningún dato parcial llega al destino."
   },
   "writing": {
     "heading": "Escritura en el destino",
@@ -181,7 +181,7 @@
       },
       {
         "topic": "Sidecar (sólo local)",
-        "detail": "<code>hb_write_archive_sidecar</code> deposita un <code>*.proxmenux.json</code> junto al archivo local para que el Monitor lo identifique como copia de host de ProxMenux incluso tras movimientos o renombrados."
+        "detail": "<code>hb_write_archive_sidecar</code> deposita un <code>*.proxmenux.json</code> junto al archivo local para que el Monitor lo identifique como backup de host de ProxMenux incluso tras movimientos o renombrados."
       },
       {
         "topic": "Notificación (complete/fail)",
@@ -190,12 +190,12 @@
     ]
   },
   "finishedScreens": {
-    "heading": "Cómo se ve una copia finalizada",
+    "heading": "Cómo se ve un backup finalizado",
     "intro": "El mismo evento de finalización lo exponen los dos puntos de entrada. El TUI escribe un bloque resumen en el terminal; la pestaña Backups del Monitor muestra la ejecución en la lista de archivos con badges de tamaño, duración y estado.",
-    "scriptsAlt": "TUI de ProxMenux Scripts mostrando una copia de host finalizada — destino, backup ID, ruta del snapshot, tamaño de datos, duración y estado de cifrado.",
-    "scriptsCaption": "Copia finalizada — ProxMenux Scripts (TUI). El bloque de finalización imprime el destino, backup ID, nombre del snapshot o archivo resultante, tamaño de datos, duración y estado de cifrado.",
-    "monitorAlt": "Pestaña Backups del Monitor de ProxMenux mostrando una entrada de copia de host finalizada con tamaño, duración, badge del método y indicador de cifrado.",
-    "monitorCaption": "Copia finalizada — pestaña Backups del Monitor de ProxMenux. La nueva copia aparece en la lista de archivos con el badge del método del destino, tamaño, duración y — cuando aplica — el indicador de cifrado."
+    "scriptsAlt": "TUI de ProxMenux Scripts mostrando un backup de host finalizado — destino, backup ID, ruta del snapshot, tamaño de datos, duración y estado de cifrado.",
+    "scriptsCaption": "Backup finalizado — ProxMenux Scripts (TUI). El bloque de finalización imprime el destino, backup ID, nombre del snapshot o archivo resultante, tamaño de datos, duración y estado de cifrado.",
+    "monitorAlt": "Pestaña Backups del Monitor de ProxMenux mostrando una entrada de backup de host finalizado con tamaño, duración, badge del método y indicador de cifrado.",
+    "monitorCaption": "Backup finalizado — pestaña Backups del Monitor de ProxMenux. El nuevo backup aparece en la lista de archivos con el badge del método del destino, tamaño, duración y — cuando aplica — el indicador de cifrado."
   },
   "whereNext": {
     "heading": "A dónde seguir",
@@ -208,7 +208,7 @@
       {
         "label": "Trabajos programados",
         "href": "/docs/backup-restore/scheduled-jobs",
-        "tail": " — ejecutar la misma copia desatendida en un horario en lugar de interactivamente."
+        "tail": " — ejecutar el mismo backup desatendido en un horario en lugar de interactivamente."
       },
       {
         "label": "Restauración",
diff --git a/web/messages/es/docs/backup-restore/cross-kernel.json b/web/messages/es/docs/backup-restore/cross-kernel.json
index 407a7f53..9dfe82c4 100644
--- a/web/messages/es/docs/backup-restore/cross-kernel.json
+++ b/web/messages/es/docs/backup-restore/cross-kernel.json
@@ -1,55 +1,102 @@
 {
   "meta": {
     "title": "Restauración cross-kernel — detección de dirección, filtro de subconjunto seguro, hidratación | ProxMenux",
-    "description": "Cómo restaura ProxMenux una copia de host sobre un destino con un kernel de versión mayor distinta. Documenta cómo se detecta la dirección del salto, el filtro de subconjunto seguro que salta rutas críticas del arranque cuando el destino corre un kernel más reciente que la copia, y la hidratación independiente del kernel de cuatro fases que reaplica la configuración del usuario como IOMMU, IDs VFIO y tokens custom del cmdline sin copiar verbatim los ficheros ligados al kernel.",
+    "description": "Cómo restaura ProxMenux un backup de host sobre un destino con un kernel de versión mayor distinta. Documenta cómo se detecta la dirección del salto, el filtro de subconjunto seguro que salta rutas críticas del arranque cuando el destino corre un kernel más reciente que el backup, y la hidratación independiente del kernel de cuatro fases que reaplica la configuración del usuario como IOMMU, IDs VFIO y tokens custom del cmdline sin copiar verbatim los ficheros ligados al kernel.",
     "ogTitle": "ProxMenux Backup — restauración cross-kernel e hidratación",
     "ogDescription": "Restauración cross-kernel direccional con filtro de subconjunto seguro e hidratación independiente del kernel.",
     "twitterTitle": "Restauración cross-kernel | ProxMenux",
-    "twitterDescription": "Cómo maneja ProxMenux una restauración cuando el kernel del destino difiere del de la copia."
+    "twitterDescription": "Cómo maneja ProxMenux una restauración cuando el kernel del destino difiere del del backup."
   },
   "header": {
     "title": "Restauración cross-kernel",
-    "description": "Cómo maneja ProxMenux una restauración cuando el kernel del host de destino es distinto al kernel que había en el momento de la copia — especialmente cuando el destino ejecuta un kernel más reciente. Documenta cómo se detecta la diferencia, cómo se filtran las rutas críticas del arranque que podrían romper el destino, y cómo se reaplica la configuración propia del usuario sin copiar verbatim los ficheros ligados al kernel.",
+    "description": "Cómo maneja ProxMenux una restauración cuando el kernel del host de destino es distinto al kernel que había en el momento del backup — especialmente cuando el destino ejecuta un kernel más reciente. Documenta cómo se detecta la diferencia, cómo se filtran las rutas críticas del arranque que podrían romper el destino, y cómo se reaplica la configuración propia del usuario sin copiar verbatim los ficheros ligados al kernel.",
     "section": "Backup & Restore"
   },
   "intro": {
     "title": "Cada salto de kernel se maneja de forma distinta",
-    "body": "Cuando la restauración detecta que la copia y el destino tienen versiones mayores distintas de kernel, el flujo se ramifica en función de la dirección del salto — si la copia es más antigua o más reciente que el destino — porque los dos casos tienen modos de fallo opuestos. Las copias más recientes que el destino se restauran limpiamente tal cual (verificado empíricamente en múltiples pruebas de banco). Las copias más antiguas que el destino necesitan un filtro para evitar romper el arranque del destino con configuración escrita para un kernel que desde entonces ha cambiado."
+    "body": "El kernel de un host Proxmox se identifica con una cadena de versión como <code>6.17.13-2-pve</code>. Los dos primeros números (<strong>6.17</strong> en este ejemplo) definen la versión mayor: cuando cambian, algunos ficheros de configuración escritos para el kernel anterior pueden no ser válidos en el nuevo. Cuando la restauración detecta que el backup y el destino tienen versiones mayores de kernel distintas, el flujo se ramifica según la dirección del salto —si el backup es más antiguo o más reciente que el destino— porque los dos casos tienen modos de fallo opuestos. Los backups más recientes que el destino se restauran limpiamente tal cual (verificado en banco de pruebas con varios saltos de kernel). Los backups más antiguos que el destino necesitan un filtro para no romper el arranque del destino con configuración escrita para un kernel que desde entonces ha cambiado."
   },
   "directionCheck": {
     "heading": "La comprobación de dirección",
-    "intro": "Durante la comprobación de compatibilidad, <code>hb_compat_check</code> compara el kernel registrado en el manifiesto de la copia contra el kernel actual del destino (<code>uname -r</code>) y clasifica la restauración en uno de tres casos, guardado en la variable interna <code>HB_COMPAT_KERNEL_DIRECTION</code>:",
+    "intro": "Durante la comprobación de compatibilidad, <code>hb_compat_check</code> compara el kernel registrado en el manifiesto del backup contra el kernel actual del destino (<code>uname -r</code>) y clasifica la restauración en uno de tres casos, guardado en la variable interna <code>HB_COMPAT_KERNEL_DIRECTION</code>:",
     "rows": [
-      { "direction": "same", "condition": "La versión mayor del kernel coincide entre la copia y el destino.", "behavior": "El flujo de restauración completo corre sin cambios. Sin filtro adicional, sin hidratación, sin aviso especial en la interfaz." },
-      { "direction": "bk_newer", "condition": "El kernel de la copia es más RECIENTE que el del destino (por ejemplo: la copia se hizo con kernel 7.0 y el destino corre kernel 6.17).", "behavior": "El flujo de restauración completo corre sin cambios, exactamente igual que en <code>same</code>. No se aplica ningún filtro. Verificado empíricamente: los controladores se reinstalan contra el kernel del destino, la configuración IOMMU se aplica limpia, las VMs con passthrough GPU arrancan sin problemas." },
-      { "direction": "bk_older", "condition": "El kernel de la copia es más ANTIGUO que el del destino (por ejemplo: la copia se hizo con kernel 6.17 y el destino corre kernel 7.0).", "behavior": "Se activan el filtro de subconjunto seguro y la hidratación de cuatro fases descritos más abajo. La restauración procede — el destino reproduce el origen, pero los ficheros críticos del arranque no se copian verbatim." }
+      {
+        "direction": "same",
+        "condition": "La versión mayor del kernel coincide entre el backup y el destino.",
+        "behavior": "El flujo de restauración completo corre sin cambios. Sin filtro adicional, sin hidratación, sin aviso especial en la interfaz."
+      },
+      {
+        "direction": "bk_newer",
+        "condition": "El kernel del backup es más RECIENTE que el del destino (por ejemplo: el backup se hizo con kernel 7.0 y el destino corre kernel 6.17).",
+        "behavior": "El flujo de restauración completo corre sin cambios, exactamente igual que en <code>same</code>. No se aplica ningún filtro. Verificado empíricamente: los controladores se reinstalan contra el kernel del destino, la configuración IOMMU se aplica limpia, las VMs con passthrough GPU arrancan sin problemas."
+      },
+      {
+        "direction": "bk_older",
+        "condition": "El kernel del backup es más ANTIGUO que el del destino (por ejemplo: el backup se hizo con kernel 6.17 y el destino corre kernel 7.0).",
+        "behavior": "Se activan el filtro de subconjunto seguro y la hidratación de cuatro fases descritos más abajo. La restauración procede — el destino reproduce el origen, pero los ficheros críticos del arranque no se copian verbatim."
+      }
     ]
   },
   "whyBkNewerIsSafe": {
-    "heading": "Por qué una copia con kernel más reciente que el destino se restaura sin cambios",
-    "body": "Cuando la restauración corre contra un destino con un kernel <em>más antiguo</em> que el registrado en la copia, todos los mecanismos de los que depende la restauración son independientes de la versión del kernel. Los instaladores de controladores de GPU y otros dispositivos PCI detectan el kernel en ejecución con <code>uname -r</code> y compilan DKMS contra lo que tenga el destino. La instalación de paquetes por APT trae binarios construidos para la distribución del destino. Los tokens IOMMU del cmdline como <code>intel_iommu=on</code> son estables entre versiones mayores de kernel. La copia lleva rutas escritas bajo un kernel más reciente, pero esas rutas (blacklists de módulos, defaults de GRUB, configuración de initramfs) siguen siendo sintaxis válida en el más antiguo — los kernels ignoran los tokens que no reconocen en lugar de fallar. Este caso es equivalente en la práctica a una restauración con el mismo kernel, y ProxMenux lo trata como tal."
+    "heading": "Por qué un backup con kernel más reciente que el destino se restaura sin cambios",
+    "body": "Cuando la restauración corre contra un destino con un kernel <em>más antiguo</em> que el registrado en el backup, todos los mecanismos de los que depende la restauración son independientes de la versión del kernel. Los instaladores de controladores de GPU y otros dispositivos PCI detectan el kernel en ejecución con <code>uname -r</code> y compilan DKMS contra lo que tenga el destino. La instalación de paquetes por APT trae binarios construidos para la distribución del destino. Los tokens IOMMU del cmdline como <code>intel_iommu=on</code> son estables entre versiones mayores de kernel. El backup lleva rutas escritas bajo un kernel más reciente, pero esas rutas (blacklists de módulos, defaults de GRUB, configuración de initramfs) siguen siendo sintaxis válida en el más antiguo — los kernels ignoran los tokens que no reconocen en lugar de fallar. Este caso es equivalente en la práctica a una restauración con el mismo kernel, y ProxMenux lo trata como tal."
   },
   "safeSubsetFilter": {
     "heading": "El filtro de subconjunto seguro (sólo cuando el kernel del destino es más reciente)",
-    "intro": "Cuando el kernel del destino es más reciente que el de la copia, la comprobación de compatibilidad añade 16 rutas críticas del arranque de <code>hb_unsafe_paths_cross_version</code> a <code>RS_SKIP_PATHS</code>. Estas rutas se excluyen de la restauración porque escribir una versión suya de un kernel más antiguo sobre un destino que corre uno más reciente ha causado kernel panics en pruebas de banco. Las rutas cubren cuatro categorías:",
+    "intro": "Cuando el kernel del destino es más reciente que el del backup, la comprobación de compatibilidad añade 16 rutas críticas del arranque de <code>hb_unsafe_paths_cross_version</code> a <code>RS_SKIP_PATHS</code>. Estas rutas se excluyen de la restauración porque escribir una versión suya de un kernel más antiguo sobre un destino que corre uno más reciente ha causado kernel panics en pruebas de banco. Las rutas cubren cinco categorías:",
     "categoryRows": [
-      { "category": "Bootloader", "paths": "<code>/etc/default/grub</code>, <code>/etc/kernel</code>", "reason": "Defaults de GRUB atados al orden previo de kernels, y estado de proxmox-boot-tool (cmdline, UUIDs de ESP, hooks) que referencia rutas e identificadores de la instalación más antigua." },
-      { "category": "Módulos del kernel y artefactos de arranque", "paths": "<code>/etc/modules-load.d</code>, <code>/etc/modprobe.d</code>, <code>/etc/initramfs-tools</code>", "reason": "Listas de autocarga que pueden referenciar módulos renombrados entre majors del kernel, opciones de módulo que pueden no aplicar, hooks de initramfs escritos para el kernel más antiguo." },
-      { "category": "Stack de almacenamiento e identidad de filesystem", "paths": "<code>/etc/fstab</code>, <code>/etc/multipath</code>, <code>/etc/iscsi</code>, <code>/etc/udev/rules.d</code>, <code>/etc/zfs</code>", "reason": "UUIDs que pueden no existir en esta instalación, drivers de multipath que cambian entre kernels, parámetros iSCSI que evolucionan, reglas udev que pueden atarse a subsistemas inexistentes, estado ZFS (<code>zpool.cache</code> + <code>hostid</code>) que puede bloquear el pool como si no perteneciera al host." },
-      { "category": "Fuentes APT", "paths": "<code>/etc/apt</code>", "reason": "Las suites de fuentes APT pueden disparar un downgrade de paquetes críticos en la próxima actualización." },
-      { "category": "systemd", "paths": "<code>/etc/systemd/system</code>, <code>/etc/systemd/journald.conf</code>, <code>/etc/systemd/logind.conf</code>, <code>/etc/systemd/system.conf</code>, <code>/etc/systemd/user.conf</code>", "reason": "Overrides de unit y .wants ligados al major de systemd más antiguo; claves de configuración que pueden no parsearse en un systemd más reciente." }
+      {
+        "category": "Bootloader",
+        "paths": "<code>/etc/default/grub</code>, <code>/etc/kernel</code>",
+        "reason": "Defaults de GRUB atados al orden previo de kernels, y estado de proxmox-boot-tool (cmdline, UUIDs de ESP, hooks) que referencia rutas e identificadores de la instalación más antigua."
+      },
+      {
+        "category": "Módulos del kernel y artefactos de arranque",
+        "paths": "<code>/etc/modules-load.d</code>, <code>/etc/modprobe.d</code>, <code>/etc/initramfs-tools</code>",
+        "reason": "Listas de autocarga que pueden referenciar módulos renombrados entre majors del kernel, opciones de módulo que pueden no aplicar, hooks de initramfs escritos para el kernel más antiguo."
+      },
+      {
+        "category": "Stack de almacenamiento e identidad de filesystem",
+        "paths": "<code>/etc/fstab</code>, <code>/etc/multipath</code>, <code>/etc/iscsi</code>, <code>/etc/udev/rules.d</code>, <code>/etc/zfs</code>",
+        "reason": "UUIDs que pueden no existir en esta instalación, drivers de multipath que cambian entre kernels, parámetros iSCSI que evolucionan, reglas udev que pueden atarse a subsistemas inexistentes, estado ZFS (<code>zpool.cache</code> + <code>hostid</code>) que puede bloquear el pool como si no perteneciera al host."
+      },
+      {
+        "category": "Fuentes APT",
+        "paths": "<code>/etc/apt</code>",
+        "reason": "Las suites de fuentes APT pueden disparar un downgrade de paquetes críticos en la próxima actualización."
+      },
+      {
+        "category": "systemd",
+        "paths": "<code>/etc/systemd/system</code>, <code>/etc/systemd/journald.conf</code>, <code>/etc/systemd/logind.conf</code>, <code>/etc/systemd/system.conf</code>, <code>/etc/systemd/user.conf</code>",
+        "reason": "Overrides de unit y .wants ligados al major de systemd más antiguo; claves de configuración que pueden no parsearse en un systemd más reciente."
+      }
     ],
-    "outroBody": "El filtro corre ANTES del diálogo de confirmación para que el usuario vea la lista exacta de rutas que se saltarán, categorizadas por motivo. La restauración procede igualmente — todo lo demás (VMs, LXCs, red, /etc/pve, usuarios, cron, estado de ProxMenux, paquetes, drivers, /root) se restaura con normalidad."
+    "outroBody": "El filtro corre ANTES del diálogo de confirmación para que el usuario vea la lista exacta de rutas que se saltarán, categorizadas por motivo. La restauración procede igualmente — todo lo demás (configuración de VM/LXC, red, /etc/pve, usuarios, cron, estado de ProxMenux, paquetes, drivers, /root) se restaura con normalidad."
   },
   "hydration": {
     "heading": "Hidratación independiente del kernel",
-    "intro": "El filtro de subconjunto seguro por sí solo dejaría al destino sin la configuración que el usuario había puesto dentro de esos ficheros críticos del arranque: cmdline IOMMU para passthrough GPU, IDs de dispositivo VFIO, <code>GRUB_TIMEOUT</code> custom, blacklists de nvidia. La pasada de hidratación reaplica esas piezas de forma independiente de la versión del kernel. Corren cuatro fases cuando el kernel del destino es más reciente que el de la copia, cada una aditiva (nunca sobrescribe un valor que el destino ya lleva) e idempotente (correr dos veces es un no-op).",
+    "intro": "El filtro omite archivos críticos del arranque; la hidratación reaplica ajustes seleccionados: cmdline IOMMU, IDs VFIO, <code>GRUB_TIMEOUT</code> personalizado y listas de bloqueo nvidia. Se ejecuta con un kernel destino más reciente. La fusión de cmdline conserva las claves del destino y añade módulos que faltan. Los valores GRUB y archivos permitidos pueden reemplazar contenido distinto del destino. Repetir la misma entrada es idempotente.",
     "phaseRows": [
-      { "phase": "1a — Ruta GRUB", "detail": "Para hosts que usan GRUB (instalaciones ext4/lvm). <code>_rs_hyd_grub</code> mergea cada token de <code>manifest.kernel_params.cmdline_extra</code> de la copia en el <code>GRUB_CMDLINE_LINUX_DEFAULT</code> vivo del destino, saltando los tokens cuya clave el destino ya lleva. Después mergea claves whitelisted <code>GRUB_*</code> (<code>GRUB_TIMEOUT</code>, <code>GRUB_TIMEOUT_STYLE</code>, <code>GRUB_DEFAULT</code>, <code>GRUB_TERMINAL</code>, <code>GRUB_DISABLE_OS_PROBER</code>, <code>GRUB_SERIAL_COMMAND</code>, <code>GRUB_GFXMODE</code>, <code>GRUB_GFXPAYLOAD_LINUX</code>) del <code>/etc/default/grub</code> de la copia si difieren de las del destino." },
-      { "phase": "1b — Ruta systemd-boot / ZFS", "detail": "Para hosts que usan systemd-boot (típicamente ZFS-on-root). <code>_rs_hyd_kernel_cmdline</code> mergea los tokens del usuario de <code>cmdline_extra</code> en el <code>/etc/kernel/cmdline</code> del destino, manteniendo intacto el boilerplate propio del destino: <code>root=</code>, <code>boot=</code> y <code>rootflags=</code>." },
-      { "phase": "2 — Merge en /etc/modules", "detail": "<code>_rs_hyd_modules</code> añade los módulos de <code>manifest.kernel_params.modules_loaded_at_boot</code> que estén en la whitelist (<code>vfio</code>, <code>vfio_pci</code>, <code>vfio_iommu_type1</code>, <code>vfio_virqfd</code>, <code>kvm</code>, <code>kvm_intel</code>, <code>kvm_amd</code>, <code>nvidia</code>, <code>nvidia_drm</code>, <code>nvidia_modeset</code>, <code>nvidia_uvm</code>, <code>i915</code>, <code>xe</code>) Y que aún no estén presentes en <code>/etc/modules</code> del destino." },
-      { "phase": "3 — Copia de ficheros whitelisted", "detail": "<code>_rs_hyd_files</code> copia ficheros escritos por el usuario del staging rootfs al destino en vivo cuando el contenido difiere. La whitelist cubre ficheros VFIO/nvidia/blacklist bajo <code>/etc/modprobe.d</code>, <code>/etc/modules-load.d</code>, y la regla VFIO bind + reglas udev de nvidia de ProxMenux bajo <code>/etc/udev/rules.d</code>. Los ficheros propiedad de la distro (<code>pve-blacklist.conf</code>, <code>mdadm.conf</code>, <code>nvme.conf</code>) se excluyen intencionadamente — sus contenidos evolucionan entre releases." },
-      { "phase": "4 — Forzar reflows post-arranque", "detail": "Las cuatro fases escriben directamente en el destino vivo FUERA del pipeline normal de restauración. Para que los tokens/módulos/ficheros mergeados tengan efecto en el siguiente arranque, <code>HB_HYDRATION_APPLIED=1</code> se propaga a través de <code>plan.env</code> a <code>apply_pending_restore.sh</code>, que fuerza <code>NEEDS_INITRAMFS=1</code> y <code>NEEDS_GRUB=1</code> con independencia de lo que hubiera en la lista de apply. El dispatcher post-arranque después regenera el initramfs y refresca el bootloader." }
+      {
+        "phase": "1a — Ruta GRUB",
+        "detail": "Para hosts que usan GRUB (instalaciones ext4/lvm). <code>_rs_hyd_grub</code> mergea cada token de <code>manifest.kernel_params.cmdline_extra</code> del backup en el <code>GRUB_CMDLINE_LINUX_DEFAULT</code> vivo del destino, saltando los tokens cuya clave el destino ya lleva. Después mergea claves whitelisted <code>GRUB_*</code> (<code>GRUB_TIMEOUT</code>, <code>GRUB_TIMEOUT_STYLE</code>, <code>GRUB_DEFAULT</code>, <code>GRUB_TERMINAL</code>, <code>GRUB_DISABLE_OS_PROBER</code>, <code>GRUB_SERIAL_COMMAND</code>, <code>GRUB_GFXMODE</code>, <code>GRUB_GFXPAYLOAD_LINUX</code>) del <code>/etc/default/grub</code> del backup si difieren de las del destino."
+      },
+      {
+        "phase": "1b — Ruta systemd-boot / ZFS",
+        "detail": "Para hosts que usan systemd-boot (típicamente ZFS-on-root). <code>_rs_hyd_kernel_cmdline</code> mergea los tokens del usuario de <code>cmdline_extra</code> en el <code>/etc/kernel/cmdline</code> del destino, manteniendo intacto el boilerplate propio del destino: <code>root=</code>, <code>boot=</code> y <code>rootflags=</code>."
+      },
+      {
+        "phase": "2 — Merge en /etc/modules",
+        "detail": "<code>_rs_hyd_modules</code> añade los módulos de <code>manifest.kernel_params.modules_loaded_at_boot</code> que estén en la whitelist (<code>vfio</code>, <code>vfio_pci</code>, <code>vfio_iommu_type1</code>, <code>vfio_virqfd</code>, <code>kvm</code>, <code>kvm_intel</code>, <code>kvm_amd</code>, <code>nvidia</code>, <code>nvidia_drm</code>, <code>nvidia_modeset</code>, <code>nvidia_uvm</code>, <code>i915</code>, <code>xe</code>) Y que aún no estén presentes en <code>/etc/modules</code> del destino."
+      },
+      {
+        "phase": "3 — Copia de ficheros whitelisted",
+        "detail": "<code>_rs_hyd_files</code> copia ficheros escritos por el usuario del staging rootfs al destino en vivo cuando el contenido difiere. La whitelist cubre ficheros VFIO/nvidia/blacklist bajo <code>/etc/modprobe.d</code>, <code>/etc/modules-load.d</code>, y la regla VFIO bind + reglas udev de nvidia de ProxMenux bajo <code>/etc/udev/rules.d</code>. Los ficheros propiedad de la distro (<code>pve-blacklist.conf</code>, <code>mdadm.conf</code>, <code>nvme.conf</code>) se excluyen intencionadamente — sus contenidos evolucionan entre releases."
+      },
+      {
+        "phase": "4 — Forzar reflows post-arranque",
+        "detail": "Las cuatro fases escriben directamente en el destino vivo FUERA del pipeline normal de restauración. Para que los tokens/módulos/ficheros mergeados tengan efecto en el siguiente arranque, <code>HB_HYDRATION_APPLIED=1</code> se propaga a través de <code>plan.env</code> a <code>apply_pending_restore.sh</code>, que fuerza <code>NEEDS_INITRAMFS=1</code> y <code>NEEDS_GRUB=1</code> con independencia de lo que hubiera en la lista de apply. El dispatcher post-arranque después regenera el initramfs y refresca el bootloader."
+      }
     ]
   },
   "planCommit": {
@@ -57,7 +104,7 @@
     "body": "La hidratación corre en dos modos. Antes del diálogo de confirmación, ProxMenux ejecuta <code>_rs_apply_bk_older_hydration</code> en modo <code>plan</code>: calcula exactamente lo que se mergearía, rellena <code>RS_HYDRATION_SUMMARY</code> con un bloque verde que lista cada acción, y retorna sin escribir nada. El diálogo de confirmación muestra ese bloque verde junto a la lista ámbar de rutas saltadas por el subconjunto seguro, para que el usuario vea POR ADELANTADO qué se reaplicará automáticamente. Tras la confirmación del usuario, ProxMenux vuelve a ejecutar el mismo helper en modo <code>commit</code> — mismas fases, misma lógica, pero esta vez cada fase escribe en el destino vivo. Cancelar el diálogo de confirmación deja el destino intacto."
   },
   "flowDiagram": {
-    "heading": "El flujo cuando el kernel del destino es más reciente que el de la copia",
+    "heading": "El flujo cuando el kernel del destino es más reciente que el del backup",
     "intro": "Los pasos específicos que se añaden cuando el kernel del destino es más reciente se insertan dentro del flujo normal de restauración. Todo lo demás — hot apply, prepare pending, instalación de paquetes, dispatcher post-arranque — corre idéntico a una restauración con el mismo kernel.",
     "diagram": "  ┌────────────────────────────────────────────────────────────┐\n  │ hb_compat_check                                             │\n  │   HB_COMPAT_KERNEL_DIRECTION = bk_older                     │\n  └───────────────────────────┬────────────────────────────────┘\n                              │\n                              ▼\n  ┌────────────────────────────────────────────────────────────┐\n  │ Añade 16 rutas críticas del arranque a RS_SKIP_PATHS        │\n  │   /etc/default/grub, /etc/kernel, /etc/modules-load.d, ...  │\n  └───────────────────────────┬────────────────────────────────┘\n                              │\n                              ▼\n  ┌────────────────────────────────────────────────────────────┐\n  │ _rs_apply_bk_older_hydration \"plan\"                         │\n  │   Calcula qué se mergearía                                  │\n  │   Rellena RS_HYDRATION_SUMMARY (bloque verde)               │\n  │   Sin escrituras                                            │\n  └───────────────────────────┬────────────────────────────────┘\n                              │\n                              ▼\n  ┌────────────────────────────────────────────────────────────┐\n  │ Diálogo de confirmación                                     │\n  │   Ámbar: rutas saltadas por el filtro de subconjunto seguro │\n  │   Verde: tokens/ficheros reaplicados por la hidratación     │\n  │   El usuario acepta o cancela                               │\n  └───────────────────────────┬────────────────────────────────┘\n                              │ (aceptado)\n                              ▼\n  ┌────────────────────────────────────────────────────────────┐\n  │ _rs_apply_bk_older_hydration \"commit\"                       │\n  │   Fase 1a/1b: mergea tokens del cmdline + claves GRUB       │\n  │   Fase 2: añade módulos a /etc/modules                      │\n  │   Fase 3: copia ficheros whitelisted vfio/nvidia            │\n  │   Fija HB_HYDRATION_APPLIED=1                               │\n  └───────────────────────────┬────────────────────────────────┘\n                              │\n                              ▼\n  ┌────────────────────────────────────────────────────────────┐\n  │ El resto de la restauración corre normalmente               │\n  │   _rs_apply hot (salta RS_SKIP_PATHS)                       │\n  │   _rs_prepare_pending_restore (escribe plan.env con         │\n  │     HB_HYDRATION_APPLIED=1)                                 │\n  │   packages.manual.list install                              │\n  │   Reinicio                                                  │\n  │   apply_pending_restore.sh (fuerza NEEDS_INITRAMFS=1,       │\n  │     NEEDS_GRUB=1 por el flag de hidratación)                │\n  │   apply_cluster_postboot.sh                                 │\n  │     update-initramfs -u -k all                              │\n  │     update-grub / proxmox-boot-tool refresh                 │\n  │     component --auto-reinstall                              │\n  └────────────────────────────────────────────────────────────┘"
   },
@@ -65,30 +112,59 @@
     "heading": "Ejemplos concretos",
     "intro": "La pasada de hidratación no es abstracta — produce resultados observables y correctos en escenarios habituales. Dos ejemplos que la hidratación resuelve automáticamente:",
     "rows": [
-      { "scenario": "GPU passthrough (VFIO)", "detail": "El origen tenía <code>intel_iommu=on iommu=pt</code> en el cmdline, <code>vfio</code>/<code>vfio_pci</code>/<code>vfio_iommu_type1</code> en <code>/etc/modules</code>, un <code>/etc/modprobe.d/vfio.conf</code> con <code>options vfio-pci ids=10de:2216</code>, y un <code>/etc/modprobe.d/blacklist-nvidia.conf</code>. La hidratación mergea los tokens del cmdline en el GRUB o kernel cmdline del destino, añade los módulos vfio a <code>/etc/modules</code>, y copia los dos ficheros modprobe escritos por el usuario. En el siguiente arranque, IOMMU está activo, los módulos VFIO cargan, la GPU queda ligada a vfio-pci y la VM arranca con el passthrough funcionando." },
-      { "scenario": "Defaults custom de GRUB", "detail": "El origen tenía <code>GRUB_TIMEOUT=1</code> y <code>GRUB_DISABLE_OS_PROBER=true</code>. La hidratación lee ambas claves del <code>/etc/default/grub</code> de la copia, ve que difieren de los defaults de la instalación fresca, y reescribe esas dos líneas en el fichero del destino (dejando todo lo demás, incluido <code>GRUB_DISTRIBUTOR</code>, intacto)." }
+      {
+        "scenario": "GPU passthrough (VFIO)",
+        "detail": "El origen tenía <code>intel_iommu=on iommu=pt</code> en el cmdline, <code>vfio</code>/<code>vfio_pci</code>/<code>vfio_iommu_type1</code> en <code>/etc/modules</code>, un <code>/etc/modprobe.d/vfio.conf</code> con <code>options vfio-pci ids=10de:2216</code>, y un <code>/etc/modprobe.d/blacklist-nvidia.conf</code>. La hidratación mergea los tokens del cmdline en el GRUB o kernel cmdline del destino, añade los módulos vfio a <code>/etc/modules</code>, y copia los dos ficheros modprobe escritos por el usuario. En el siguiente arranque, IOMMU está activo, los módulos VFIO cargan, la GPU queda ligada a vfio-pci y la VM arranca con el passthrough funcionando."
+      },
+      {
+        "scenario": "Defaults custom de GRUB",
+        "detail": "El origen tenía <code>GRUB_TIMEOUT=1</code> y <code>GRUB_DISABLE_OS_PROBER=true</code>. La hidratación lee ambas claves del <code>/etc/default/grub</code> del backup, ve que difieren de los defaults de la instalación fresca, y reescribe esas dos líneas en el fichero del destino (dejando todo lo demás, incluido <code>GRUB_DISTRIBUTOR</code>, intacto)."
+      }
     ]
   },
   "callout": {
     "warningTitle": "Qué no reaplica la hidratación cuando el kernel del destino es más reciente",
-    "warningBody": "La hidratación reaplica sólo la configuración que ProxMenux sabe que es segura entre versiones del kernel: tokens IOMMU, IDs VFIO, claves whitelisted de GRUB y módulos de una lista fija (<code>vfio*</code>, <code>nvidia*</code>, <code>i915</code>, <code>xe</code>, <code>kvm*</code>). Todo lo que quede fuera de ese conjunto — hooks custom de initramfs bajo <code>/etc/initramfs-tools/hooks/</code>, ficheros no whitelisted bajo <code>/etc/modprobe.d/</code>, overrides de unit de systemd escritos por el usuario — permanece excluido. El motivo es concreto: esos ficheros pueden invocar interfaces internas del kernel (APIs de módulos, layout de <code>/sys</code>, hooks de <code>udev</code>) que cambian entre versiones mayores, y aplicarlos verbatim sobre el kernel más reciente puede impedir que el destino arranque. Cuando se necesita reproducción exacta de la cadena de arranque, la restauración debe correr sobre un host con la misma versión mayor de kernel que la copia."
+    "warningBody": "La hidratación reaplica sólo la configuración que ProxMenux sabe que es segura entre versiones del kernel: tokens IOMMU, IDs VFIO, claves whitelisted de GRUB y módulos de una lista fija (<code>vfio*</code>, <code>nvidia*</code>, <code>i915</code>, <code>xe</code>, <code>kvm*</code>). Todo lo que quede fuera de ese conjunto — hooks custom de initramfs bajo <code>/etc/initramfs-tools/hooks/</code>, ficheros no whitelisted bajo <code>/etc/modprobe.d/</code>, overrides de unit de systemd escritos por el usuario — permanece excluido. El motivo es concreto: esos ficheros pueden invocar interfaces internas del kernel (APIs de módulos, layout de <code>/sys</code>, hooks de <code>udev</code>) que cambian entre versiones mayores, y aplicarlos verbatim sobre el kernel más reciente puede impedir que el destino arranque. Cuando se necesita reproducción exacta de la cadena de arranque, la restauración debe correr sobre un host con la misma versión mayor de kernel que el backup."
   },
   "codeReference": {
     "heading": "Dónde viven los mecanismos",
     "intro": "Para desarrolladores que quieran trazar o extender el comportamiento cross-kernel:",
     "rows": [
-      { "component": "Detección de dirección", "location": "<code>hb_compat_check</code> en <code>lib_host_backup_common.sh</code>. Fija <code>HB_COMPAT_KERNEL_DIRECTION</code>." },
-      { "component": "Lista de rutas del subconjunto seguro", "location": "<code>hb_unsafe_paths_cross_version</code> en <code>lib_host_backup_common.sh</code>. Emite líneas <code>path\\tmotivo</code> usadas tanto por el filtro CLI como por el endpoint Web <code>/api/host-backups/restore/prepare</code>." },
-      { "component": "Fases de hidratación", "location": "<code>_rs_hyd_grub</code>, <code>_rs_hyd_kernel_cmdline</code>, <code>_rs_hyd_modules</code>, <code>_rs_hyd_files</code> en <code>backup_host.sh</code>. Orquestados por <code>_rs_apply_bk_older_hydration</code>." },
-      { "component": "Forzado de reflow post-arranque", "location": "<code>apply_pending_restore.sh</code> lee <code>HB_HYDRATION_APPLIED</code> de <code>plan.env</code> y fuerza <code>NEEDS_INITRAMFS=1</code>/<code>NEEDS_GRUB=1</code>." },
-      { "component": "Preview Web", "location": "<code>/api/host-backups/restore/prepare</code> en <code>flask_server.py</code>. Fuentea la librería helper, ejecuta <code>_rs_apply_bk_older_hydration</code> en modo plan, devuelve las acciones al modal Web." }
+      {
+        "component": "Detección de dirección",
+        "location": "<code>hb_compat_check</code> en <code>lib_host_backup_common.sh</code>. Fija <code>HB_COMPAT_KERNEL_DIRECTION</code>."
+      },
+      {
+        "component": "Lista de rutas del subconjunto seguro",
+        "location": "<code>hb_unsafe_paths_cross_version</code> en <code>lib_host_backup_common.sh</code>. Emite líneas <code>path\\treason</code> usadas tanto por el filtro CLI como por el endpoint Web <code>/api/host-backups/restore/prepare</code>."
+      },
+      {
+        "component": "Fases de hidratación",
+        "location": "<code>_rs_hyd_grub</code>, <code>_rs_hyd_kernel_cmdline</code>, <code>_rs_hyd_modules</code>, <code>_rs_hyd_files</code> en <code>backup_host.sh</code>. Orquestados por <code>_rs_apply_bk_older_hydration</code>."
+      },
+      {
+        "component": "Forzado de reflow post-arranque",
+        "location": "<code>apply_pending_restore.sh</code> lee <code>HB_HYDRATION_APPLIED</code> de <code>plan.env</code> y fuerza <code>NEEDS_INITRAMFS=1</code>/<code>NEEDS_GRUB=1</code>."
+      },
+      {
+        "component": "Preview Web",
+        "location": "<code>/api/host-backups/restore/prepare</code> en <code>flask_server.py</code>. Fuentea la librería helper, ejecuta <code>_rs_apply_bk_older_hydration</code> en modo plan, devuelve las acciones al modal Web."
+      }
     ]
   },
   "whereNext": {
     "heading": "A dónde seguir",
     "items": [
-      { "label": "Restaurar", "href": "/docs/backup-restore/restoring", "tail": " — el pipeline completo de restauración en el que se enchufan los mecanismos de esta página." },
-      { "label": "Cómo funciona", "href": "/docs/backup-restore/how-it-works", "tail": " — el manifiesto y los colectores que producen el bloque <code>kernel_params</code> del que lee la hidratación." }
+      {
+        "label": "Restaurar",
+        "href": "/docs/backup-restore/restoring",
+        "tail": " — el pipeline completo de restauración en el que se enchufan los mecanismos de esta página."
+      },
+      {
+        "label": "Cómo funciona",
+        "href": "/docs/backup-restore/how-it-works",
+        "tail": " — el manifiesto y los colectores que producen el bloque <code>kernel_params</code> del que lee la hidratación."
+      }
     ]
   }
 }
diff --git a/web/messages/es/docs/backup-restore/destinations/borg.json b/web/messages/es/docs/backup-restore/destinations/borg.json
index 860788e8..317e8387 100644
--- a/web/messages/es/docs/backup-restore/destinations/borg.json
+++ b/web/messages/es/docs/backup-restore/destinations/borg.json
@@ -1,28 +1,28 @@
 {
   "meta": {
     "title": "Destino Borg — tipos de repositorio, autenticación SSH, cifrado | ProxMenux",
-    "description": "El destino Borg escribe las copias de host de ProxMenux en un repositorio Borg — local, en un disco externo montado, o en un servidor remoto accedido por SSH. Cubre la cadena de resolución del binario borg, las cuatro estrategias de clave SSH, el cifrado repokey, la configuración de destinos guardados y la retención por trabajo programado.",
+    "description": "El destino Borg escribe los backups de host de ProxMenux en un repositorio Borg — local, en un disco externo montado, o en un servidor remoto accedido por SSH. Cubre la cadena de resolución del binario borg, las cuatro estrategias de clave SSH, el cifrado repokey, la configuración de destinos guardados y la retención por trabajo programado.",
     "ogTitle": "ProxMenux Backup — destino Borg",
-    "ogDescription": "Cómo escribe ProxMenux las copias de host en repositorios Borg, con estrategias de autenticación SSH y cifrado repokey.",
-    "twitterTitle": "Destino Borg de copia | ProxMenux",
-    "twitterDescription": "Repositorios Borg local, USB y servidos por SSH para copias del host."
+    "ogDescription": "Cómo escribe ProxMenux los backups de host en repositorios Borg, con estrategias de autenticación SSH y cifrado repokey.",
+    "twitterTitle": "Destino Borg de backup | ProxMenux",
+    "twitterDescription": "Repositorios Borg local, USB y servidos por SSH para backups del host."
   },
   "header": {
     "title": "Borg",
-    "description": "El destino Borg escribe las copias del host en un repositorio Borg. Se soportan tres tipos de repositorio: ruta local de sistema de ficheros, disco externo montado o servidor remoto vía SSH. Deduplicación a nivel de chunk entre todos los archivos del repositorio y cifrado opcional repokey.",
+    "description": "El destino Borg escribe los backups del host en un repositorio Borg. Se soportan tres tipos de repositorio: ruta local de sistema de ficheros, disco externo montado o servidor remoto vía SSH. Deduplicación a nivel de chunk entre todos los archivos del repositorio y cifrado opcional repokey.",
     "section": "Backup & Restore"
   },
   "aboutBorg": {
     "heading": "Qué es Borg",
-    "body": "Borg (también escrito BorgBackup) es una herramienta de copia de seguridad open-source con deduplicación, mantenida por la comunidad Borg Backup. Almacena cada archivo como un conjunto de chunks de longitud variable dentro de un repositorio; los chunks se comparten entre archivos, por lo que volver a copiar datos que no han cambiado tiene un coste de almacenamiento prácticamente nulo. Borg no está atado a Proxmox — es una herramienta de copia de uso general utilizada en muchos entornos. ProxMenux la usa como uno de los tres destinos para copias del host; cada mecanismo específico de Borg descrito en esta página (tipos de repositorio, borg-serve por SSH, cifrado repokey, prune) es comportamiento estándar de Borg."
+    "body": "Borg (también escrito BorgBackup) es una herramienta de backup open-source con deduplicación, mantenida por la comunidad Borg Backup. Almacena cada archivo como un conjunto de chunks de longitud variable dentro de un repositorio; los chunks se comparten entre archivos, por lo que volver a copiar datos que no han cambiado tiene un coste de almacenamiento prácticamente nulo. Borg no está atado a Proxmox — es una herramienta de backup de uso general utilizada en muchos entornos. ProxMenux la usa como uno de los tres destinos para backups del host; cada mecanismo específico de Borg descrito en esta página (tipos de repositorio, borg-serve por SSH, cifrado repokey, prune) es comportamiento estándar de Borg."
   },
   "intro": {
     "title": "Deduplicación por chunks con repositorios locales o servidos por SSH",
-    "body": "Un repositorio Borg almacena chunks que se comparten entre cada archivo que contiene, por lo que volver a copiar un fichero que no ha cambiado no transfiere ni almacena nada nuevo. ProxMenux invoca <code>borg create</code> contra el repositorio en el momento de la copia y <code>borg extract</code> en la restauración. El repositorio puede vivir en el mismo sistema de ficheros que el origen, en un disco externo montado, o en un host remoto accedido por SSH."
+    "body": "Un repositorio Borg almacena chunks que se comparten entre cada archivo que contiene, por lo que volver a copiar un fichero que no ha cambiado no transfiere ni almacena nada nuevo. ProxMenux invoca <code>borg create</code> contra el repositorio en el momento del backup y <code>borg extract</code> en la restauración. El repositorio puede vivir en el mismo sistema de ficheros que el origen, en un disco externo montado, o en un host remoto accedido por SSH."
   },
   "binarySourcing": {
     "heading": "El binario borg",
-    "intro": "Borg no es una dependencia base del instalador de ProxMenux. Cuando se ejecuta una copia, <code>hb_ensure_borg</code> resuelve el binario desde cuatro fuentes por orden y devuelve la primera que funciona:",
+    "intro": "Borg no es una dependencia base del instalador de ProxMenux. Cuando se ejecuta un backup, <code>hb_ensure_borg</code> resuelve el binario desde cuatro fuentes por orden y devuelve la primera que funciona:",
     "rows": [
       {
         "priority": "1",
@@ -42,7 +42,7 @@
       {
         "priority": "4",
         "source": "Descarga desde GitHub",
-        "detail": "<code>wget</code> contra la URL fijada de <code>borg-linux64</code> bajo <code>github.com/borgbackup/borg/releases/</code>, verificado contra un SHA-256 constante en <code>lib_host_backup_common.sh</code> (<code>HB_BORG_LINUX64_SHA256</code>). Si el checksum no coincide, el binario se descarta y la copia se aborta. El fichero descargado se cachea en el state-dir para que las copias posteriores usen el camino 2."
+        "detail": "<code>wget</code> contra la URL fijada de <code>borg-linux64</code> bajo <code>github.com/borgbackup/borg/releases/</code>, verificado contra un SHA-256 constante en <code>lib_host_backup_common.sh</code> (<code>HB_BORG_LINUX64_SHA256</code>). Si el checksum no coincide, el binario se descarta y el backup se aborta. El fichero descargado se cachea en el state-dir para que los backups posteriores usen el camino 2."
       }
     ]
   },
@@ -74,11 +74,11 @@
     "hostChoicesBody": "Cualquier host Linux con acceso SSH cumple. Setups habituales:",
     "hostChoicesItems": [
       "Un NAS dedicado o caja de backup (Debian, Ubuntu, TrueNAS SCALE con shell).",
-      "Un contenedor LXC dentro de un nodo Proxmox. Huella pequeña, aislado del host que ejecuta las copias.",
+      "Un contenedor LXC dentro de un nodo Proxmox. Huella pequeña, aislado del host que ejecuta los backups.",
       "Otro host Proxmox en la misma LAN, o una VM en cualquier lugar alcanzable por SSH."
     ],
     "lxcWarningTitle": "LXC como servidor Borg",
-    "lxcWarningBody": "Si el servidor Borg se ejecuta dentro de un LXC, el contenedor debe tener una cuenta de usuario con contraseña.",
+    "lxcWarningBody": "Si el servidor Borg está en un LXC, generate-auto necesita una cuenta que acepte autenticación SSH por contraseña durante la instalación de la clave. Si no está disponible, utiliza la instalación manual de la clave o la alternativa generate-pct a través del host PVE.",
     "requirementsTitle": "Requisitos en el servidor",
     "requirementsRows": [
       {
@@ -101,18 +101,18 @@
     "minimalSetupTitle": "Setup mínimo del servidor",
     "minimalSetupBody": "En un servidor Borg Debian o Ubuntu, un baseline funcional son cuatro comandos como root:",
     "minimalSetupCmd": "apt install borgbackup\nuseradd -m -d /home/borg -s /bin/bash borg\nmkdir -p /backup/borgbackup\nchown borg:borg /backup/borgbackup",
-    "minimalSetupNote": "Tras esto, el modo <code>generate-auto</code> de ProxMenux puede conectarse usando la contraseña del usuario borg una vez, instalar su propia clave SSH, y cada copia posterior usa esa clave. No hace falta más configuración en el servidor — la clave se restringe a sí misma a <code>borg serve</code> sobre esa ruta."
+    "minimalSetupNote": "Con el servidor preparado y la autenticación SSH por contraseña disponible, <code>generate-auto</code> instala la clave mediante una cuenta que pueda escribir en authorized_keys del usuario borg. Los backups posteriores usan esa clave, restringida a <code>borg serve</code> en la ruta configurada. Si no hay acceso por contraseña, instala la clave manualmente o usa la alternativa a través del host PVE."
   },
   "sshAuth": {
     "heading": "Autenticación SSH (lado cliente)",
     "intro": "Los repositorios Borg remotos se acceden vía SSH. La conexión va desde el host ProxMenux a una cuenta de usuario en el servidor Borg que ejecuta <code>borg serve</code>. Ese usuario se llama típicamente <code>borg</code>, NO el usuario admin/root del servidor — la línea de comando de borg-serve bloquea la conexión a esa ruta concreta del repositorio (ver las estrategias de clave más abajo).",
-    "strategiesTitle": "Las cuatro estrategias de clave",
-    "strategiesIntro": "Al añadir un destino remoto, ProxMenux pregunta por el usuario SSH, host y ruta remota, y a continuación pregunta cómo autenticar. Cuatro modos:",
+    "strategiesTitle": "Estrategias de clave SSH",
+    "strategiesIntro": "Al añadir un destino remoto, ProxMenux pide el usuario SSH, el host, el puerto y la ruta remota, y ofrece cuatro opciones de autenticación. Si se rechaza la autenticación por contraseña, también ofrece generate-pct. Los modos se describen a continuación:",
     "strategyRows": [
       {
         "mode": "generate-auto",
         "label": "Recomendado",
-        "detail": "ProxMenux genera una nueva keypair ed25519 en <code>~/.ssh/borg_proxmenux_HOST_ed25519</code>, y a continuación usa <code>sshpass</code> para hacer login UNA VEZ en el servidor con la contraseña de admin y añadir la clave pública a <code>~borg/.ssh/authorized_keys</code>. La contraseña de admin se usa sólo para esa única llamada — nunca se almacena."
+        "detail": "ProxMenux genera o reutiliza un par de claves ed25519 en <code>~/.ssh/borg_proxmenux_HOST_ed25519</code> y usa <code>sshpass</code> para probar el acceso e instalar la clave pública en <code>~borg/.ssh/authorized_keys</code>. La contraseña es de una cuenta que pueda escribir ese archivo, normalmente root o el usuario borg. Se utiliza durante la configuración y no se guarda."
       },
       {
         "mode": "generate-manual",
@@ -153,11 +153,11 @@
         "content": "Passphrase del destino con el NAME dado arriba (<code>chmod 600</code>). Sólo está presente si el usuario eligió cifrado repokey."
       }
     ],
-    "outro": "Guardar es opcional — el usuario puede rechazar el prompt de guardado para una copia puntual que no deje credenciales en el host."
+    "outro": "Guardar el destino es opcional. Si se rechaza, no se guarda la configuración del destino con nombre, pero no se elimina una clave SSH generada. Si se activa repokey sin guardar el destino, ProxMenux guarda igualmente la frase de contraseña en el archivo heredado borg-pass.txt."
   },
   "encryption": {
     "heading": "Cifrado",
-    "body": "Los repositorios se inicializan con un modo de cifrado vía <code>hb_borg_init_if_needed</code>: <code>borg repo-create -e MODE</code> en versiones modernas, o el legacy <code>borg init --encryption=MODE</code>. ProxMenux expone dos modos: <code>repokey</code> (por defecto) y <code>none</code>. En modo <code>repokey</code>, Borg almacena la clave de cifrado dentro del propio repositorio; el acceso requiere una passphrase, que ProxMenux pregunta dos veces con validación de coincidencia y guarda en <code>borg-pass-NAME.txt</code>. Un diálogo de reconocimiento obligatorio se muestra tras guardar la passphrase: la passphrase es la única manera de acceder a los archivos cifrados, y perderla hace irrecuperable todo archivo del repositorio."
+    "body": "Los repositorios se inicializan con un modo de cifrado vía <code>hb_borg_init_if_needed</code>: <code>borg repo-create -e MODE</code> en versiones modernas, o el legacy <code>borg init --encryption=MODE</code>. ProxMenux expone dos modos: <code>repokey</code> (por defecto) y <code>none</code>. En modo <code>repokey</code>, Borg almacena la clave de cifrado dentro del propio repositorio; el acceso requiere una passphrase, que ProxMenux pregunta dos veces con validación de coincidencia y guarda en <code>borg-pass-NAME.txt</code> para destinos guardados, o en el archivo heredado descrito antes. Un diálogo de reconocimiento obligatorio se muestra tras guardar la passphrase: la passphrase es la única manera de acceder a los archivos cifrados, y perderla hace irrecuperable todo archivo del repositorio."
   },
   "runtimeEnv": {
     "heading": "Entorno de ejecución",
@@ -165,8 +165,8 @@
     "rows": [
       {
         "var": "BORG_RSH",
-        "value": "ssh -i SSH_KEY_PATH -o StrictHostKeyChecking=accept-new",
-        "purpose": "El comando de shell remoto que Borg usa para repositorios servidos por SSH. Se fija sólo cuando se seleccionó una clave personalizada; en caso contrario queda sin definir para que Borg use la configuración SSH por defecto."
+        "value": "ssh -i SSH_KEY_PATH -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new [-p PORT]",
+        "purpose": "Comando de shell remoto que Borg utiliza para repositorios SSH. Elegir una clave añade las opciones de identidad. Al añadir un destino con un puerto distinto del predeterminado, ProxMenux añade además -p PORT; los destinos guardados, los trabajos programados y el Monitor usan el puerto de la URL ssh://. Sin clave personalizada, y en un destino nuevo con el puerto predeterminado, la variable queda sin definir y Borg usa la configuración SSH del host."
       },
       {
         "var": "BORG_PASSPHRASE",
@@ -192,9 +192,9 @@
   },
   "archiveFormat": {
     "heading": "Nombrado de archivos y retención",
-    "intro": "Cada copia crea un archivo nuevo dentro del repositorio.",
+    "intro": "Cada backup crea un archivo nuevo dentro del repositorio.",
     "namePattern": "hostcfg-HOSTNAME-YYYYMMDD_HHMMSS",
-    "retentionBody": "Para trabajos programados, <code>run_scheduled_backup.sh</code> ejecuta <code>borg prune</code> contra el repositorio tras cada copia exitosa con los valores de retención configurados en el trabajo (<code>--keep-last</code>, <code>--keep-daily</code>, <code>--keep-weekly</code>). Las copias interactivas no aplican poda."
+    "retentionBody": "Para trabajos programados, <code>run_scheduled_backup.sh</code> ejecuta <code>borg prune</code> contra el repositorio tras cada backup exitoso con los valores de retención configurados en el trabajo (<code>--keep-last</code>, <code>--keep-daily</code>, <code>--keep-weekly</code>). Los backups interactivos no aplican poda."
   },
   "restoreAccess": {
     "heading": "Recuperación del lado de la restauración",
@@ -212,7 +212,7 @@
       {
         "label": "borg create",
         "href": "https://borgbackup.readthedocs.io/en/stable/usage/create.html",
-        "tail": " — el comando que ProxMenux invoca en cada copia, con todas las flags soportadas."
+        "tail": " — el comando que ProxMenux invoca en cada backup, con todas las flags soportadas."
       },
       {
         "label": "Cifrado del repositorio",
diff --git a/web/messages/es/docs/backup-restore/destinations/index.json b/web/messages/es/docs/backup-restore/destinations/index.json
index 1965649f..1f6eca83 100644
--- a/web/messages/es/docs/backup-restore/destinations/index.json
+++ b/web/messages/es/docs/backup-restore/destinations/index.json
@@ -1,11 +1,11 @@
 {
   "meta": {
-    "title": "Destinos de copia — Local, Proxmox Backup Server, Borg | ProxMenux",
-    "description": "Tres backends de almacenamiento reciben el mismo contenido de una copia de ProxMenux: un archivo local .tar.zst en cualquier sistema de ficheros escribible, un backup en un datastore de Proxmox Backup Server o un archivo en un repositorio local o remoto de Borg. Cada backend tiene sus propias características de compresión, deduplicación, cifrado y red.",
+    "title": "Destinos de backup — Local, Proxmox Backup Server, Borg | ProxMenux",
+    "description": "Tres backends de almacenamiento reciben el mismo contenido de un backup de ProxMenux: un archivo local .tar.zst en cualquier sistema de ficheros escribible, un backup en un datastore de Proxmox Backup Server o un archivo en un repositorio local o remoto de Borg. Cada backend tiene sus propias características de compresión, deduplicación, cifrado y red.",
     "ogTitle": "Destinos de ProxMenux Backup",
-    "ogDescription": "Local, Proxmox Backup Server y Borg — tres backends de almacenamiento para el mismo contenido de copia del host.",
+    "ogDescription": "Local, Proxmox Backup Server y Borg — tres backends de almacenamiento para el mismo contenido de backup del host.",
     "twitterTitle": "Destinos de ProxMenux Backup | ProxMenux",
-    "twitterDescription": "Archivo local, Proxmox Backup Server y Borg como backends para copias del host."
+    "twitterDescription": "Archivo local, Proxmox Backup Server y Borg como backends para backups del host."
   },
   "header": {
     "title": "Destinos",
@@ -14,7 +14,7 @@
   },
   "intro": {
     "title": "El mismo contenido, tres backends",
-    "body": "Cada copia produce los mismos tres bloques (rootfs, manifiesto, aplicaciones). Lo que cambia entre destinos es cómo se almacenan esos bloques y cómo el usuario los recupera para una restauración. Cada backend está implementado como una función independiente en <code>backup_host.sh</code> — <code>_bk_local</code>, <code>_bk_pbs</code>, <code>_bk_borg</code> — pero los tres comparten el mismo paso de staging (<code>hb_prepare_staging</code>) y el mismo camino de restauración. La elección del destino sólo afecta a la escritura y la recuperación; no cambia lo que hace una restauración ni cómo consume el archivo."
+    "body": "Cada backup produce los mismos tres bloques (rootfs, manifiesto, aplicaciones). Lo que cambia entre destinos es cómo se almacenan esos bloques y cómo el usuario los recupera para una restauración. Cada backend está implementado como una función independiente en <code>backup_host.sh</code> — <code>_bk_local</code>, <code>_bk_pbs</code>, <code>_bk_borg</code> — pero los tres comparten el mismo paso de staging (<code>hb_prepare_staging</code>) y el mismo camino de restauración. La elección del destino sólo afecta a la escritura y la recuperación; no cambia lo que hace una restauración ni cómo consume el archivo."
   },
   "comparison": {
     "heading": "Comparativa de características",
@@ -29,12 +29,12 @@
       {
         "feature": "Compresión",
         "local": "zstd (nivel por defecto) mediante <code>tar --zstd</code>. Fallback a gzip.",
-        "pbs": "Gestionada por PBS. El cliente envía sin comprimir; el servidor chunkiza + comprime.",
-        "borg": "La integrada de Borg (lz4 por defecto). Configurable al inicializar el repo."
+        "pbs": "La gestiona proxmox-backup-client. ProxMenux no modifica las opciones de compresión.",
+        "borg": "La compresión integrada de Borg. ProxMenux ejecuta borg create sin modificar las opciones de compresión."
       },
       {
         "feature": "Deduplicación",
-        "local": "Ninguna. Cada copia es un archivo completo independiente.",
+        "local": "Ninguna. Cada backup es un archivo completo independiente.",
         "pbs": "Deduplicación completa a nivel de chunk entre todas las backups del datastore.",
         "borg": "Deduplicación completa a nivel de chunk entre todos los archivos del repositorio."
       },
@@ -46,9 +46,9 @@
       },
       {
         "feature": "Retención / poda",
-        "local": "Aplicada por trabajo programado vía <code>KEEP_LAST</code>. Los archivos antiguos (y sus sidecars + logs del runner) se eliminan de forma simétrica. Las copias interactivas no aplican poda.",
-        "pbs": "Aplicada por trabajo programado vía <code>proxmox-backup-client prune --keep-last / --keep-daily / --keep-weekly</code>. Las copias interactivas no aplican poda.",
-        "borg": "Aplicada por trabajo programado vía <code>borg prune --keep-last / --keep-daily / --keep-weekly</code>. Las copias interactivas no aplican poda."
+        "local": "Aplicada por trabajo programado vía <code>KEEP_LAST</code>. Los archivos antiguos (y sus sidecars + logs del runner) se eliminan de forma simétrica. Los backups interactivos no aplican poda.",
+        "pbs": "Aplicada por trabajo programado vía <code>proxmox-backup-client prune --keep-last / --keep-daily / --keep-weekly</code>. Los backups interactivos no aplican poda.",
+        "borg": "Aplicada por trabajo programado vía <code>borg prune --keep-last / --keep-daily / --keep-weekly</code>. Los backups interactivos no aplican poda."
       },
       {
         "feature": "Red",
@@ -75,11 +75,11 @@
     "captionBorg": "Borg"
   },
   "sameArchive": {
-    "heading": "El contenido interno de la copia es el mismo en cualquier destino",
-    "body": "Con independencia de dónde se guarde la copia, dentro siempre están los mismos tres bloques descritos en <em>Cómo funciona</em>: el sistema de ficheros (<code>rootfs/</code>), los metadatos (<code>metadata/</code>) y el manifiesto (<code>manifest.json</code>). Al extraer una copia local <code>.tar.zst</code>, restaurar un archivo <code>.pxar</code> desde PBS o descomprimir un archivo Borg, el árbol de directorios resultante es idéntico en los tres casos. Esto significa que el proceso de restauración lee siempre los mismos ficheros y no le importa desde qué destino provenga la copia."
+    "heading": "El contenido interno del backup es el mismo en cualquier destino",
+    "body": "Los tres destinos contienen la misma estructura <code>rootfs/</code> + <code>metadata/</code> + <code>manifest.json</code> descrita en <em>Cómo funciona</em>. Extraer un <code>.tar.zst</code> de un archivo local, restaurar un <code>.pxar</code> desde PBS o extraer un archivo de Borg con <code>borg extract</code> produce el mismo árbol de directorios. El proceso de restauración (<code>_rs_check_layout</code>, <code>_rs_apply</code>, <code>_rs_prepare_pending_restore</code>) lee los mismos tres componentes sin necesitar saber de qué destino proceden."
   },
   "extractStandalone": {
-    "heading": "Extraer una copia fuera de ProxMenux",
+    "heading": "Extraer un backup fuera de ProxMenux",
     "intro": "Cualquiera de los tres formatos de archivo se puede leer con herramientas estándar sin tener ProxMenux instalado en el host de lectura. Los comandos siguientes producen el mismo árbol de directorios que consume internamente una restauración.",
     "localCmd": "# Desde un archivo local .tar.zst:\ntar --zstd -xf hostcfg-HOST-TIMESTAMP.tar.zst\n\n# Desde el fallback .tar.gz:\ntar -xzf hostcfg-HOST-TIMESTAMP.tar.gz",
     "pbsCmd": "# Desde un backup PBS (requiere proxmox-backup-client):\nproxmox-backup-client restore \\\n    --repository USER@REALM@HOST:DATASTORE \\\n    host/hostcfg-HOST/BACKUP-TIME \\\n    hostcfg.pxar /tmp/hostcfg\n\n# Añadir --keyfile KEY-PATH cuando el backup está cifrado.",
diff --git a/web/messages/es/docs/backup-restore/destinations/local.json b/web/messages/es/docs/backup-restore/destinations/local.json
index e99f5190..79d75136 100644
--- a/web/messages/es/docs/backup-restore/destinations/local.json
+++ b/web/messages/es/docs/backup-restore/destinations/local.json
@@ -1,11 +1,11 @@
 {
   "meta": {
     "title": "Destino de archivo local — tar.zst en filesystem o unidad USB | ProxMenux",
-    "description": "El destino local de la copia escribe un único archivo .tar.zst en cualquier directorio escribible: un disco interno, un punto de montaje de Proxmox, un share NFS o una unidad USB. Documenta el flujo de configuración, la lógica de detección y montaje USB, el chequeo de seguridad contra escribir el archivo dentro de una ruta que se está copiando, y el sidecar JSON que identifica el fichero.",
+    "description": "El destino local del backup escribe un único archivo .tar.zst en cualquier directorio escribible: un disco interno, un punto de montaje de Proxmox, un share NFS o una unidad USB. Documenta el flujo de configuración, la lógica de detección y montaje USB, el chequeo de seguridad contra escribir el archivo dentro de una ruta que se está copiando, y el sidecar JSON que identifica el fichero.",
     "ogTitle": "ProxMenux Backup — Destino local",
-    "ogDescription": "Cómo escribe ProxMenux las copias locales como archivos .tar.zst y cómo configurar el directorio de destino o la unidad USB.",
-    "twitterTitle": "Destino local de copia | ProxMenux",
-    "twitterDescription": "Cómo escribe ProxMenux las copias locales como archivos .tar.zst en filesystem o USB."
+    "ogDescription": "Cómo escribe ProxMenux los backups locales como archivos .tar.zst y cómo configurar el directorio de destino o la unidad USB.",
+    "twitterTitle": "Destino local de backup | ProxMenux",
+    "twitterDescription": "Cómo escribe ProxMenux los backups locales como archivos .tar.zst en filesystem o USB."
   },
   "header": {
     "title": "Archivo local",
@@ -14,11 +14,11 @@
   },
   "intro": {
     "title": "Un solo fichero, autocontenido",
-    "body": "Una copia local produce un único fichero <code>hostcfg-HOST-TIMESTAMP.tar.zst</code> (o <code>.tar.gz</code> cuando <code>zstd</code> no está presente). El fichero contiene el árbol completo del archivo — <code>manifest.json</code>, <code>metadata/</code> y <code>rootfs/</code> — y puede restaurarse en cualquier host Proxmox con el flujo de restauración de ProxMenux, o extraerse a mano con <code>tar --zstd -xf</code> en cualquier sistema Linux. Sin servidor, sin inicialización de repositorio, sin dependencia externa. Es el destino con el camino de recuperación más corto cuando ni PBS ni Borg están disponibles."
+    "body": "Un backup local produce un único fichero <code>hostcfg-HOST-TIMESTAMP.tar.zst</code> (o <code>.tar.gz</code> cuando <code>zstd</code> no está presente). El fichero contiene el árbol completo del archivo — <code>manifest.json</code>, <code>metadata/</code> y <code>rootfs/</code> — y puede restaurarse en cualquier host Proxmox con el flujo de restauración de ProxMenux, o extraerse a mano con <code>tar --zstd -xf</code> en cualquier sistema Linux. Sin servidor, sin inicialización de repositorio, sin dependencia externa. Es el destino con el camino de recuperación más corto cuando ni PBS ni Borg están disponibles."
   },
   "targetConfig": {
     "heading": "Configurar el directorio de destino",
-    "intro": "El destino local es un <strong>único directorio de destino persistido</strong> — no una lista. ProxMenux guarda la elección del usuario en <code>/usr/local/share/proxmenux/local-target.conf</code> y la lee en cada copia. Cuando no hay ningún destino configurado, se usa el valor por defecto <code>HB_LOCAL_TARGET_DEFAULT = /var/lib/vz/dump</code> (el mismo directorio que Proxmox utiliza para las salidas de <code>vzdump</code>). El destino se configura desde <em>Configure backup destinations → Local destinations</em>:",
+    "intro": "El destino local es un <strong>único directorio de destino persistido</strong> — no una lista. ProxMenux guarda la elección del usuario en <code>/usr/local/share/proxmenux/local-target.conf</code> y la lee en cada backup. Cuando no hay ningún destino configurado, se usa el valor por defecto <code>HB_LOCAL_TARGET_DEFAULT = /var/lib/vz/dump</code> (el mismo directorio que Proxmox utiliza para las salidas de <code>vzdump</code>). El destino se configura desde <em>Configure backup destinations → Local destinations</em>:",
     "options": [
       "<strong>Usar el valor por defecto (<code>/var/lib/vz/dump</code>).</strong> El almacenamiento local de Proxmox. Está presente en cualquier instalación de Proxmox; el archivo queda junto a las salidas de vzdump y lo detecta automáticamente la pestaña Backups del Monitor.",
       "<strong>Introducir una ruta personalizada.</strong> Cualquier ruta absoluta del sistema de ficheros vale: un montaje NFS, un share SMB montado por <code>fstab</code>, un dataset ZFS dedicado, un segundo disco interno. ProxMenux valida que la ruta existe y es un directorio antes de persistirla.",
@@ -32,7 +32,7 @@
     "stateRows": [
       {
         "state": "mounted",
-        "shown": "Tamaño · label · [fstype] · → /punto/de/montaje",
+        "shown": "Tamaño · label · [fstype] · → /mount/point",
         "action": "La partición ya está montada en algún sitio. Seleccionarla persiste ese punto de montaje como destino local. No se realiza ningún montaje."
       },
       {
@@ -50,11 +50,11 @@
   },
   "safetyCheck": {
     "heading": "Chequeo de seguridad — destino dentro de una ruta copiada",
-    "body": "Antes de escribir el archivo, <code>_bk_local</code> verifica que el directorio de destino <strong>no</strong> sea un subcamino de ninguno de los directorios que se están copiando. Un footgun habitual sería añadir <code>/root</code> al perfil y elegir <code>/root/backups</code> como destino — el archivo se incluiría a sí mismo, produciendo o bien un archivo corrupto o bien crecimiento sin límite hasta llenar el disco. El chequeo resuelve ambos caminos con <code>readlink -m</code>, los compara y, si hay conflicto, aborta la copia con un diálogo que nombra la ruta en conflicto y lista tres formas de resolverlo: elegir un destino fuera de la ruta en conflicto, eliminar la entrada personalizada que contiene el destino, o usar modo Custom para desmarcar la ruta en conflicto en esa ejecución."
+    "body": "Antes de escribir el archivo, <code>_bk_local</code> verifica que el directorio de destino <strong>no</strong> sea un subcamino de ninguno de los directorios que se están copiando. Un footgun habitual sería añadir <code>/root</code> al perfil y elegir <code>/root/backups</code> como destino — el archivo se incluiría a sí mismo, produciendo o bien un archivo corrupto o bien crecimiento sin límite hasta llenar el disco. El chequeo resuelve ambos caminos con <code>readlink -m</code>, los compara y, si hay conflicto, aborta el backup con un diálogo que nombra la ruta en conflicto y lista tres formas de resolverlo: elegir un destino fuera de la ruta en conflicto, eliminar la entrada personalizada que contiene el destino, o usar modo Custom para desmarcar la ruta en conflicto en esa ejecución."
   },
   "archiveFormat": {
     "heading": "Formato de archivo y compresión",
-    "intro": "El nombre del fichero de salida incorpora el hostname del origen y el timestamp de la copia para que un directorio con varios archivos se ordene cronológicamente y cada fichero se identifique por sí mismo.",
+    "intro": "El nombre del fichero de salida incorpora el hostname del origen y el timestamp del backup para que un directorio con varios archivos se ordene cronológicamente y cada fichero se identifique por sí mismo.",
     "namePattern": "hostcfg-HOSTNAME-YYYYMMDD_HHMMSS.tar.zst",
     "compressionTitle": "Compresión",
     "compressionBody": "El camino principal usa <code>tar --zstd -cf</code> — un pipeline de un solo comando que comprime al nivel por defecto de zstd. Cuando <code>zstd</code> no está presente en el origen (raro en Proxmox pero posible en instalaciones minimalistas), ProxMenux cae en <code>gzip</code>. En el camino de fallback, si <code>pv</code> está disponible, se añade una barra de progreso al pipeline para que el usuario vea crecer el tamaño del archivo en tiempo real; sin <code>pv</code>, se usa <code>tar -czf</code> plano en silencio.",
@@ -63,13 +63,13 @@
   },
   "sidecar": {
     "heading": "El sidecar JSON",
-    "intro": "Cada copia local con éxito produce un fichero compañero: <code>HOSTNAME-TIMESTAMP.tar.zst.proxmenux.json</code>, escrito junto al archivo por <code>hb_write_archive_sidecar</code>. Este pequeño fichero JSON permite al Monitor de ProxMenux identificar el archivo como una copia de host de ProxMenux incluso si posteriormente se mueve, renombra o archiva en otro lugar.",
+    "intro": "Cada backup local con éxito produce un fichero compañero: <code>HOSTNAME-TIMESTAMP.tar.zst.proxmenux.json</code>, escrito junto al archivo por <code>hb_write_archive_sidecar</code>. Este pequeño fichero JSON permite al Monitor de ProxMenux identificar el archivo como un backup de host de ProxMenux incluso si posteriormente se mueve, renombra o archiva en otro lugar.",
     "contentTitle": "Contenido del sidecar",
-    "contentBody": "El sidecar almacena la versión de schema, si la copia viene de una ejecución interactiva o de un trabajo programado (<code>kind</code>), el ID de trabajo para las ejecuciones programadas, el modo de perfil usado (<code>default</code> o <code>custom</code>), el hostname del origen, el basename original del archivo, un timestamp de creación en ISO-8601 y el tamaño del archivo en bytes.",
-    "whyBody": "La pestaña Backups del Monitor escanea los directorios locales configurados buscando sidecars <code>*.proxmenux.json</code> — no ficheros <code>*.tar.zst</code> — porque un <code>.tar.zst</code> sin sidecar podría no ser una copia de ProxMenux en absoluto. El escaneo es rápido (los JSON son diminutos) y el emparejamiento es estable frente a renombrados del archivo mientras el sidecar se renombre en paralelo."
+    "contentBody": "El sidecar almacena la versión de schema, si el backup viene de una ejecución interactiva o de un trabajo programado (<code>kind</code>), el ID de trabajo para las ejecuciones programadas, el modo de perfil usado (<code>default</code> o <code>custom</code>), el hostname del origen, el basename original del archivo, un timestamp de creación en ISO-8601 y el tamaño del archivo en bytes.",
+    "whyBody": "La pestaña Backups del Monitor escanea los directorios locales configurados buscando sidecars <code>*.proxmenux.json</code> — no ficheros <code>*.tar.zst</code> — porque un <code>.tar.zst</code> sin sidecar podría no ser un backup de ProxMenux en absoluto. El escaneo es rápido (los JSON son diminutos) y el emparejamiento es estable frente a renombrados del archivo mientras el sidecar se renombre en paralelo."
   },
   "restoreAccess": {
     "heading": "Restaurar desde un archivo local",
-    "body": "El flujo de restauración de ProxMenux descubre los archivos locales escaneando el destino local configurado buscando sidecars y mostrándolos en la lista de copias disponibles. Seleccionar uno dispara <code>_rs_check_layout</code>, que extrae el tarball en un directorio de staging y confirma el layout de tres bloques antes de continuar. Para una extracción manual fuera de ProxMenux, <code>tar --zstd -xf hostcfg-HOSTNAME-TIMESTAMP.tar.zst -C /tmp/hostcfg</code> produce el mismo árbol que consume el código de restauración."
+    "body": "El flujo de restauración de ProxMenux descubre los archivos locales escaneando el destino local configurado buscando sidecars y mostrándolos en la lista de backups disponibles. Seleccionar uno dispara <code>_rs_check_layout</code>, que extrae el tarball en un directorio de staging y confirma el layout de tres bloques antes de continuar. Para una extracción manual fuera de ProxMenux, <code>tar --zstd -xf hostcfg-HOSTNAME-TIMESTAMP.tar.zst -C /tmp/hostcfg</code> produce el mismo árbol que consume el código de restauración."
   }
 }
diff --git a/web/messages/es/docs/backup-restore/destinations/pbs.json b/web/messages/es/docs/backup-restore/destinations/pbs.json
index 917cc76d..d92ff2ef 100644
--- a/web/messages/es/docs/backup-restore/destinations/pbs.json
+++ b/web/messages/es/docs/backup-restore/destinations/pbs.json
@@ -1,10 +1,10 @@
 {
   "meta": {
     "title": "Destino Proxmox Backup Server — repositorio, cifrado, recuperación | ProxMenux",
-    "description": "El destino PBS escribe las copias de host de ProxMenux como backups PBS. Documenta la auto-detección del repositorio desde /etc/pve/storage.cfg, la configuración manual de PBS, el comando de subida .pxar, el modelo de cifrado por keyfile del lado del cliente, el blob de escrow con passphrase de recuperación, y la recuperación del keyfile desde PBS en instalaciones frescas.",
+    "description": "El destino PBS escribe los backups de host de ProxMenux como backups PBS. Documenta la auto-detección del repositorio desde /etc/pve/storage.cfg, la configuración manual de PBS, el comando de subida .pxar, el modelo de cifrado por keyfile del lado del cliente, el blob de escrow con passphrase de recuperación, y la recuperación del keyfile desde PBS en instalaciones frescas.",
     "ogTitle": "ProxMenux Backup — destino Proxmox Backup Server",
-    "ogDescription": "Cómo escribe ProxMenux las copias de host en Proxmox Backup Server con cifrado por keyfile del lado del cliente y escrow de recuperación.",
-    "twitterTitle": "Destino PBS de copia | ProxMenux",
+    "ogDescription": "Cómo escribe ProxMenux los backups de host en Proxmox Backup Server con cifrado por keyfile del lado del cliente y escrow de recuperación.",
+    "twitterTitle": "Destino PBS de backup | ProxMenux",
     "twitterDescription": "Destino Proxmox Backup Server con cifrado por keyfile y escrow de passphrase de recuperación."
   },
   "header": {
@@ -15,15 +15,15 @@
   "recommendedBadge": "Destino recomendado",
   "aboutPbs": {
     "heading": "Qué es Proxmox Backup Server",
-    "body": "Proxmox Backup Server (PBS) es el producto de servidor de copias propio de Proxmox, desarrollado y mantenido por el mismo equipo que autora Proxmox VE. Es un servidor dedicado diseñado para recibir copias desde hosts Proxmox VE (VMs, LXCs y — vía <code>proxmox-backup-client</code> — directorios arbitrarios del host) con deduplicación a nivel de chunk, cifrado del lado del cliente y políticas de retención aplicadas del lado del servidor. ProxMenux usa PBS como uno de los tres destinos para copias del host; cada mecanismo específico de PBS descrito en esta página (grupos de copia, archivos <code>.pxar</code>, <code>--backup-id</code>, cifrado por keyfile) es comportamiento estándar de PBS."
+    "body": "Proxmox Backup Server (PBS) es el producto de servidor de backups propio de Proxmox, desarrollado y mantenido por el mismo equipo que autora Proxmox VE. Es un servidor dedicado diseñado para recibir backups desde hosts Proxmox VE (VMs, LXCs y — vía <code>proxmox-backup-client</code> — directorios arbitrarios del host) con deduplicación a nivel de chunk, cifrado del lado del cliente y políticas de retención aplicadas del lado del servidor. ProxMenux usa PBS como uno de los tres destinos para backups del host; cada mecanismo específico de PBS descrito en esta página (grupos de backup, archivos <code>.pxar</code>, <code>--backup-id</code>, cifrado por keyfile) es comportamiento estándar de PBS."
   },
   "intro": {
     "title": "Un backup por ejecución, deduplicación a nivel de chunk",
-    "body": "Una copia PBS produce una única entrada en el datastore, agrupada bajo el backup ID <code>host/hostcfg-HOSTNAME/BACKUP-TIME</code>. El contenido es un archivo <code>.pxar</code> con el mismo layout de tres bloques descrito en <em>Cómo funciona</em>. PBS deduplica a nivel de chunk en todas las copias del datastore, por lo que las copias siguientes del mismo host transfieren y almacenan sólo los chunks que hayan cambiado. La retención la aplica el propio ProxMenux para los trabajos programados — <code>run_scheduled_backup.sh</code> ejecuta <code>proxmox-backup-client prune</code> con <code>--keep-last</code> / <code>--keep-daily</code> / <code>--keep-weekly</code> tras cada ejecución exitosa usando los valores configurados en el trabajo."
+    "body": "Un backup PBS produce una única entrada en el datastore, agrupada bajo el backup ID <code>host/hostcfg-HOSTNAME/BACKUP-TIME</code>. El contenido es un archivo <code>.pxar</code> con el mismo layout de tres bloques descrito en <em>Cómo funciona</em>. PBS deduplica a nivel de chunk en todos los backups del datastore, por lo que los backups siguientes del mismo host transfieren y almacenan sólo los chunks que hayan cambiado. La retención la aplica el propio ProxMenux para los trabajos programados — <code>run_scheduled_backup.sh</code> ejecuta <code>proxmox-backup-client prune</code> con <code>--keep-last</code> / <code>--keep-daily</code> / <code>--keep-weekly</code> tras cada ejecución exitosa usando los valores configurados en el trabajo."
   },
   "repoSelection": {
     "heading": "Selección del repositorio",
-    "intro": "ProxMenux descubre repositorios PBS desde dos fuentes en cada copia. El usuario elige uno desde un menú unificado; esa elección determina, para esa ejecución concreta, contra qué servidor y datastore se envía la copia, con qué contraseña se autentica y con qué huella (<em>fingerprint</em>) valida el certificado.",
+    "intro": "ProxMenux descubre los repositorios de PBS a partir de dos fuentes en cada backup. El usuario elige uno en un menú unificado; esa elección determina los valores de <code>HB_PBS_REPOSITORY</code>, <code>HB_PBS_SECRET</code> y <code>HB_PBS_FINGERPRINT</code> para esa ejecución.",
     "sourceRows": [
       {
         "source": "storage.cfg de Proxmox (auto-descubierto)",
@@ -33,51 +33,51 @@
       {
         "source": "Configuración manual de ProxMenux",
         "path": "/usr/local/share/proxmenux/pbs-manual-configs.txt + pbs-pass-NAME.txt + pbs-fingerprint-NAME.txt",
-        "content": "Se añade desde <em>Configure backup destinations → PBS destinations → Add PBS</em>. Pregunta por un nombre, usuario (<code>root@pam</code> o <code>user@pbs!token</code>), host o IP, datastore y contraseña. La contraseña se re-pregunta ante entrada vacía — un guardado vacío persistiría silenciosamente y cada copia posterior fallaría con un error de autenticación opaco. Este camino se usa cuando el PBS objetivo no está registrado como storage de Proxmox."
+        "content": "Se añade desde <em>Configure backup destinations → PBS destinations → Add PBS</em>. Pregunta por un nombre, usuario (<code>root@pam</code> o <code>user@pbs!token</code>), host o IP, datastore y contraseña. La contraseña se re-pregunta ante entrada vacía — un guardado vacío persistiría silenciosamente y cada backup posterior fallaría con un error de autenticación opaco. Este camino se usa cuando el PBS objetivo no está registrado como storage de Proxmox."
       }
     ],
     "menuTitle": "Menú de selección",
-    "menuBody": "Ambas fuentes se muestran en un único menú, cada fila etiquetada con su origen (<code>[proxmox]</code> o <code>[manual]</code>). Las entradas cuya contraseña no se pudo resolver se marcan con un aviso <code>⚠ no password</code> — seleccionarlas dispara una re-introducción de contraseña antes de iniciar la copia. El fingerprint se pasa a <code>proxmox-backup-client</code> vía la variable de entorno <code>PBS_FINGERPRINT</code>; cuando no está presente, el cliente pide al usuario aceptar el certificado del servidor de forma interactiva en la primera copia."
+    "menuBody": "Ambas fuentes se muestran en un único menú, cada fila etiquetada con su origen (<code>[proxmox]</code> o <code>[manual]</code>). Las entradas cuya contraseña no se pudo resolver se marcan con un aviso <code>⚠ no password</code> — seleccionarlas dispara una re-introducción de contraseña antes de iniciar el backup. El fingerprint se pasa a <code>proxmox-backup-client</code> vía la variable de entorno <code>PBS_FINGERPRINT</code>; cuando no está presente, el cliente pide al usuario aceptar el certificado del servidor de forma interactiva en el primer backup."
   },
   "backupCommand": {
-    "heading": "El comando de copia",
-    "intro": "La subida es una única invocación de <code>proxmox-backup-client backup</code>. ProxMenux la ejecuta dentro de un envoltorio <code>env</code> para que las credenciales nunca aparezcan en la lista de argumentos del proceso.",
+    "heading": "El comando de backup",
+    "intro": "La subida se realiza con una única invocación de <code>proxmox-backup-client backup</code>. ProxMenux utiliza <code>env</code> para pasar al cliente la contraseña, la contraseña de cifrado y el fingerprint como variables de entorno.",
     "cmd": "env \\\n    PBS_PASSWORD=\"$HB_PBS_SECRET\" \\\n    PBS_ENCRYPTION_PASSWORD=\"$HB_PBS_ENC_PASS\" \\\n    PBS_FINGERPRINT=\"$HB_PBS_FINGERPRINT\" \\\n    proxmox-backup-client backup \\\n        hostcfg.pxar:$staging_root \\\n        --repository USER@REALM@HOST:DATASTORE \\\n        --backup-type host \\\n        --backup-id  hostcfg-HOSTNAME \\\n        --backup-time BACKUP-EPOCH \\\n        [--keyfile /usr/local/share/proxmenux/pbs-key.conf]",
     "backupIdTitle": "Nombrado del backup ID",
-    "backupIdBody": "El backup ID por defecto es <code>hostcfg-HOSTNAME</code>. Se pide al usuario que lo confirme o edite antes de la subida; cualquier carácter fuera de <code>[A-Za-z0-9_-]</code> se elimina y los guiones finales se recortan. Reutilizar el mismo ID entre ejecuciones es intencional — PBS trata el ID como un <em>grupo</em>, y cada copia posterior aparece como un nuevo backup dentro de ese grupo, compartiendo dedup con las ejecuciones previas.",
+    "backupIdBody": "El backup ID por defecto es <code>hostcfg-HOSTNAME</code>. Se pide al usuario que lo confirme o edite antes de la subida; cualquier carácter fuera de <code>[A-Za-z0-9_-]</code> se elimina y los guiones finales se recortan. Reutilizar el mismo ID entre ejecuciones es intencional — PBS trata el ID como un <em>grupo</em>, y cada backup posterior aparece como un nuevo backup dentro de ese grupo, compartiendo dedup con las ejecuciones previas.",
     "pxarTitle": "Qué se incluye dentro del archivo .pxar",
-    "pxarBody": "Al construir el archivo <code>.pxar</code> se empaqueta el directorio de trabajo completo: el sistema de ficheros del host (<code>rootfs/</code>), los metadatos (<code>metadata/</code>) y el manifiesto (<code>manifest.json</code>). Al restaurar, ProxMenux compara la información del manifiesto con la del host destino para detectar si son equivalentes, si cambia el hardware o si se trata de un equipo distinto, y ajustar el proceso en consecuencia. Las copias antiguas —hechas con versiones anteriores de ProxMenux que empaquetaban solo el sistema de ficheros— siguen restaurándose sin problema: el flujo de restauración detecta ese formato heredado y lo reorganiza automáticamente."
+    "pxarBody": "El origen del <code>.pxar</code> es todo el directorio <code>staging_root</code>, con <code>rootfs/</code>, <code>metadata/</code> y <code>manifest.json</code> juntos. Las versiones anteriores utilizaban <code>$staging_root/rootfs</code> como origen; esto dejaba <code>metadata/</code> fuera del archivo y la comprobación de compatibilidad de la restauración no tenía datos que leer, por lo que mostraba advertencias de restauración entre hosts incluso al restaurar en el mismo host. Los backups antiguos creados solo a partir de rootfs siguen restaurándose correctamente mediante la rama del caso 3 de <code>_rs_check_layout</code>, que vuelve a colocar el árbol plano <code>etc/var/root/usr</code> dentro de una estructura <code>rootfs/</code>."
   },
   "encryption": {
     "heading": "Cifrado del lado del cliente",
     "glossaryHint": "En esta sección aparecen los términos <em>clave</em>, <em>passphrase</em> y <em>sobre de recuperación</em>. El <glosarioLink>glosario</glosarioLink> resume las diferencias en una frase por término.",
-    "intro": "PBS puede cifrar las copias con una clave que vive solo en el host. Los datos se cifran en el host antes de subirse; en PBS llegan ya cifrados. En ProxMenux este cifrado es opcional. Al activarlo, el usuario decide aparte, con una pregunta sí/no, si quiere subir a PBS también una copia de esa clave envuelta con una passphrase (el sobre de recuperación) como red de seguridad. La respuesta se puede cambiar después desde el Monitor. La clave siempre queda en una única ruta del host — <code>/usr/local/share/proxmenux/pbs-key.conf</code> — y se reutiliza sin volver a preguntar en las copias siguientes.",
+    "intro": "PBS puede cifrar los backups con una clave que vive solo en el host. Los datos se cifran en el host antes de subirse; en PBS llegan ya cifrados. En ProxMenux este cifrado es opcional. Al activarlo, el usuario decide aparte, con una pregunta sí/no, si quiere subir a PBS también una copia de esa clave envuelta con una passphrase (el sobre de recuperación) como red de seguridad. La respuesta se puede cambiar después desde el Monitor. La clave siempre queda en una única ruta del host — <code>/usr/local/share/proxmenux/pbs-key.conf</code> — y se reutiliza sin volver a preguntar en los backups siguientes.",
     "keyfileTitle": "Configuración inicial de la clave",
-    "keyfileBody": "El diálogo aparece en la primera copia cifrada del host y hace dos preguntas. Primero, si se quiere cifrar la copia: <em>No</em> sigue sin cifrado; <em>Sí</em> pasa al segundo paso. Segundo, qué clave usar. Si ya hay una instalada en <code>/usr/local/share/proxmenux/pbs-key.conf</code>, se reutiliza sin preguntar más y las copias posteriores tampoco vuelven a preguntar. Si no la hay, aparecen dos opciones: <em>Generar una clave nueva</em> crea una con <code>proxmox-backup-client key create --kdf none</code>. <em>Usar una clave existente</em> busca primero una gestionada por PVE: si el repositorio PBS elegido tiene una en <code>/etc/pve/priv/storage/&lt;NAME&gt;.enc</code>, ese fichero se copia solo a la ruta canónica. Si no hay ninguna que coincida, el diálogo pide la ruta absoluta donde el usuario ha dejado la clave en este host. En cualquier caso, el fichero termina en la ruta canónica con <code>chmod 600</code>.",
+    "keyfileBody": "El diálogo aparece en el primer backup cifrado del host y hace dos preguntas. Primero, si se quiere cifrar el backup: <em>No</em> sigue sin cifrado; <em>Sí</em> pasa al segundo paso. Segundo, qué clave usar. Si ya hay una instalada en <code>/usr/local/share/proxmenux/pbs-key.conf</code>, se reutiliza sin preguntar más y los backups posteriores tampoco vuelven a preguntar. Si no la hay, aparecen dos opciones: <em>Generar una clave nueva</em> crea una con <code>proxmox-backup-client key create --kdf none</code>. <em>Usar una clave existente</em> busca primero una gestionada por PVE: si el repositorio PBS elegido tiene una en <code>/etc/pve/priv/storage/&lt;NAME&gt;.enc</code>, ese fichero se copia solo a la ruta canónica. Si no hay ninguna que coincida, el diálogo pide la ruta absoluta donde el usuario ha dejado la clave en este host. En cualquier caso, el fichero termina en la ruta canónica con <code>chmod 600</code>.",
     "modesTitle": "Clave por host o compartida",
     "modesIntro": "Los dos modos están soportados y ninguno se impone — el usuario elige según cómo tenga organizados sus hosts.",
     "modesPerHostTitle": "Clave por host (por defecto)",
-    "modesPerHostBody": "Cada host genera su propia clave la primera vez que se activa el cifrado. Es el modo con mayor aislamiento: si la clave de un host se ve comprometida, no afecta a las copias de ningún otro. Recomendado para entornos de producción y para escenarios donde cada host tiene su propio responsable o requisitos distintos.",
+    "modesPerHostBody": "Cada host genera su propia clave la primera vez que se activa el cifrado. Es el modo con mayor aislamiento: si la clave de un host se ve comprometida, no afecta a los backups de ningún otro. Recomendado para entornos de producción y para escenarios donde cada host tiene su propio responsable o requisitos distintos.",
     "modesSharedTitle": "Clave compartida (importar la misma en cada host)",
-    "modesSharedBody": "Se genera una única clave y se importa en todos los hosts mediante la opción <em>Usar una clave existente</em>. La gestión es más sencilla: hay un solo secreto que proteger, y cualquier host puede leer las copias de cualquier otro (útil para verificación centralizada, ejercicios de restauración cruzada o consolidación). A cambio, si la clave compartida se filtra queda expuesto todo el conjunto de hosts a la vez. Recomendado para laboratorios personales y entornos donde todos los hosts pertenecen al mismo responsable y comparten el mismo nivel de confianza.",
+    "modesSharedBody": "Se genera una única clave y se importa en todos los hosts mediante la opción <em>Usar una clave existente</em>. La gestión es más sencilla: hay un solo secreto que proteger, y cualquier host puede leer los backups de cualquier otro (útil para verificación centralizada, ejercicios de restauración cruzada o consolidación). A cambio, si la clave compartida se filtra queda expuesto todo el conjunto de hosts a la vez. Recomendado para laboratorios personales y entornos donde todos los hosts pertenecen al mismo responsable y comparten el mismo nivel de confianza.",
     "recoveryTitle": "¿Subir la clave a PBS? — el usuario decide",
-    "recoveryBody": "Justo después de elegir la clave, ProxMenux pregunta si se quiere subir una copia de esa clave a PBS como red de seguridad, con dos opciones. <strong>No</strong> (por defecto) mantiene la clave solo en el host; ProxMenux no toca PBS con nada relacionado con la recuperación y el usuario gestiona por su cuenta la copia externa (desde el Monitor, la acción <em>Descargar</em> en la fila del destino PBS la exporta en el acto). <strong>Sí</strong> pide una passphrase de recuperación —dos veces, para comprobar que coincidan—; con esa passphrase, la clave se envuelve localmente con AES-256-CBC y PBKDF2 (600 000 iteraciones, sal aleatoria) en un fichero <code>pbs-key.recovery.enc</code>. A partir de ese momento, cada copia cifrada sube también ese fichero envuelto a PBS. Ni la passphrase ni la clave en claro salen del host. La respuesta se puede cambiar después desde el Monitor en cualquier momento; el interruptor está inline en la fila del destino PBS y el botón que aparece se adapta al estado (empezar a subir, dejar de subir, o cambiar la passphrase).",
+    "recoveryBody": "Justo después de elegir la clave, ProxMenux pregunta <em>¿Subir clave a PBS?</em>, con dos respuestas. <strong>No se sube ningún artefacto de recuperación a PBS hasta que el usuario responde Sí.</strong> Por defecto se elige <em>No, mantener solo local</em>: la clave queda en su ruta canónica, ProxMenux no sube artefactos de recuperación a PBS y el usuario se encarga de guardarla fuera del host. El botón <em>Descargar archivo clave</em> del Monitor, en la fila del destino PBS, permite obtenerla cuando se necesite. Al elegir <em>Sí, subir</em>, se pide dos veces una frase de contraseña de recuperación y se comprueba que coincidan. ProxMenux protege la clave con AES-256-CBC y PBKDF2 (600.000 iteraciones y sal aleatoria) para generar <code>pbs-key.recovery.enc</code>. Cada backup cifrado posterior sube esa envoltura a PBS como un grupo de backup asociado. En estas subidas no se envían a PBS ni la frase de contraseña ni la clave en texto claro. La elección puede cambiarse en cualquier momento desde el Monitor: el control de custodia de la fila del destino permite elegir Sí o No y aplicar inmediatamente Iniciar subida, Detener subida o Actualizar frase de contraseña, según el estado.",
     "blobUploadTitle": "Grupo emparejado en PBS",
-    "blobUploadBody1": "Cuando el usuario ha respondido Sí, ProxMenux sube el sobre de recuperación a PBS después de cada copia cifrada como un segundo grupo emparejado, con el mismo nombre que el del host pero terminado en <code>-keyrecovery</code>. Los dos grupos aparecen juntos en el listado del datastore: uno con las copias del host, otro con los sobres. <strong>El sobre nunca sale del host en claro</strong>: se cifra en el host con AES-256-CBC y PBKDF2 antes de enviar un solo byte (<code>openssl enc -aes-256-cbc -pbkdf2 -iter 600000 -salt</code>). PBS solo recibe el sobre ya cifrado.",
+    "blobUploadBody1": "Cuando la respuesta es <em>Sí, subir</em>, ProxMenux sube el sobre de recuperación a PBS después de cada backup cifrado como un segundo grupo emparejado, con el mismo nombre que el del host pero terminado en <code>-keyrecovery</code>. Los dos grupos aparecen juntos en el listado del datastore: uno con los backups del host, otro con los sobres de recuperación. <strong>El sobre nunca sale del host en claro</strong>: se cifra en el propio host con AES-256-CBC y PBKDF2 antes de enviar un solo byte (<code>openssl enc -aes-256-cbc -pbkdf2 -iter 600000 -salt</code>). PBS solo recibe el sobre ya cifrado.",
     "envelopeSecurityTitle": "¿No es un riesgo subir el archivo keyrecovery a PBS?",
     "envelopeSecurityBody": "El sobre viaja y se guarda cifrado en todo momento. La passphrase de recuperación no sale nunca del host: el cifrado ocurre en local antes de la subida y PBS solo recibe el resultado ya cifrado. Un administrador de PBS —o cualquiera con acceso al datastore— puede descargar el sobre, pero sin la passphrase no puede leer la clave que contiene: son solo bytes cifrados. Para reconstruir la clave hacen falta las dos cosas a la vez, el sobre y la passphrase, y solo el usuario tiene ambas.",
     "blobUploadConstraintTitle": "Por qué dos grupos y no uno solo cifrado",
-    "blobUploadConstraintBody": "Cada subida de <code>proxmox-backup-client backup</code> cifra todos sus archivos con la misma clave —o ninguno—. No hay opción intermedia. La copia del host tiene que ir cifrada con la clave. El sobre de recuperación no puede viajar en esa misma subida: quedaría cifrado con la clave que precisamente contiene, y en un equipo recién reinstalado no habría manera de abrirlo (haría falta la clave para descifrar la clave). Por eso salen dos subidas independientes y aparecen dos grupos separados: la copia del host la cifra PBS con la clave, y el sobre lo cifra ProxMenux con la passphrase antes de subirlo. Dos capas de cifrado distintas para dos cosas distintas.",
+    "blobUploadConstraintBody": "Una invocación de <code>proxmox-backup-client backup</code> cifra todos sus archivos con la misma clave o no cifra ninguno; no permite mezclar ambos casos. El backup del host se cifra con su archivo de clave, pero la envoltura de recuperación no puede acompañarla en la misma subida porque acabaría cifrada con la propia clave que contiene. En un host recién reinstalado sería imposible abrirla: haría falta la clave para descifrar esa misma clave. Por eso los dos artefactos se suben por separado y aparecen en dos grupos: el cliente PBS cifra el backup del host con el archivo de clave y ProxMenux cifra la envoltura con la frase de contraseña antes de subirla. Dos capas de cifrado distintas protegen dos elementos diferentes.",
     "blobUploadImageAlt": "Interfaz de PBS mostrando los grupos hostcfg-HOSTNAME y hostcfg-HOSTNAME-keyrecovery adyacentes en el listado del datastore.",
-    "blobUploadImageCaption": "Interfaz de PBS — los grupos de copia emparejados. El grupo principal contiene las copias del host; el grupo -keyrecovery contiene la clave envuelta con la passphrase.",
+    "blobUploadImageCaption": "Interfaz de PBS — los grupos de backup emparejados. El grupo principal contiene los backups del host; el grupo -keyrecovery contiene la clave envuelta con la passphrase.",
     "recoverTitle": "Recuperación en un equipo recién instalado",
-    "recoverBody": "Cuando la clave no está en su sitio —tras reinstalar el host desde cero o después de eliminarla a propósito— el flujo de restauración prueba tres fuentes en orden y se queda con la primera que produce una clave usable. Primero, si el repositorio PBS elegido tiene una clave gestionada por PVE en <code>/etc/pve/priv/storage/&lt;NAME&gt;.enc</code>, se copia sola a la ruta canónica. Segundo, si en PBS hay un grupo <code>-keyrecovery</code>, se descarga la copia más reciente y se pide la passphrase de recuperación para abrirla. Tercero, si ninguna de las dos anteriores funciona o el usuario las descarta, el diálogo pide la ruta absoluta donde ha dejado la clave en este host, y se copia a la ruta canónica. El Monitor expone el mismo flujo dentro del modal de la copia. Si al Restaurar, Descargar o Ver contenido falta la clave, aparece un panel ámbar arriba del modal con las mismas tres vías de importación. Si la clave está instalada pero no es la correcta para esa copia, PBS devuelve un error de tipo <code>wrong key — manifest's key XX does not match provided key YY</code> y el modal muestra un panel estructurado con el fingerprint que PBS espera (el que quedó grabado en el manifest de la copia), para que el usuario sepa qué clave concreta necesita importar.",
+    "recoverBody": "Cuando la clave no está en su sitio —tras reinstalar el host desde cero o después de eliminarla a propósito— el flujo de restauración prueba tres fuentes en orden y se queda con la primera que produce una clave usable. Primero, si el repositorio PBS elegido tiene una clave gestionada por PVE en <code>/etc/pve/priv/storage/&lt;NAME&gt;.enc</code>, se copia sola a la ruta canónica. Segundo, si en PBS hay un grupo <code>-keyrecovery</code>, se descarga el backup más reciente y se pide la passphrase de recuperación para abrirla. Tercero, si ninguna de las dos anteriores funciona o el usuario las descarta, el diálogo pide la ruta absoluta donde ha dejado la clave en este host, y se copia a la ruta canónica. El Monitor expone el mismo flujo dentro del modal del backup. Si al Restaurar, Descargar o Ver contenido falta la clave, aparece un panel ámbar arriba del modal con las mismas tres vías de importación. Si la clave está instalada pero no es la correcta para ese backup, PBS devuelve un error de tipo <code>wrong key — manifest's key XX does not match provided key YY</code> y el modal muestra un panel estructurado con el fingerprint que PBS espera (el que quedó grabado en el manifest del backup), para que el usuario sepa qué clave concreta necesita importar.",
     "monitorManagementTitle": "Gestionar la clave desde el Monitor",
-    "monitorManagementBody": "En la página de configuración de copias, la fila de cada destino PBS incluye los controles de la clave. Tres acciones directas: <em>Descargar</em> exporta la clave actual al navegador. <em>Subir</em> reemplaza la clave instalada por otra que aporta el usuario (la anterior solo se sobrescribe cuando la nueva ha llegado correctamente a su sitio). <em>Eliminar</em> retira la clave del host. Justo al lado está el interruptor del sobre de recuperación: un Sí/No para subir o no la clave a PBS, un campo de passphrase que aparece al elegir Sí, y un botón que se adapta al estado actual (empezar a subir, dejar de subir, o cambiar la passphrase). Los controles del Monitor y el diálogo del shell hacen lo mismo por dentro, así que el resultado en disco y en PBS es idéntico se use la que se use."
+    "monitorManagementBody": "En la página de configuración de backups, la fila de cada destino PBS incluye los controles de la clave. Tiene tres acciones: <em>Descargar</em> exporta la clave actual al navegador del usuario, <em>Subir</em> reemplaza la clave instalada por otra que aporta el usuario (la anterior solo se sobrescribe cuando la nueva ha llegado correctamente a su ruta) y <em>Eliminar</em> retira la clave del host. Justo al lado está el interruptor del sobre de recuperación: un Sí/No para <em>¿Subir clave a PBS?</em>, un campo de passphrase que aparece al elegir Sí y un botón que se adapta al estado actual: <em>Empezar a subir</em>, <em>Dejar de subir</em> o <em>Actualizar passphrase</em>. Los controles del Monitor y el diálogo del shell hacen lo mismo por dentro, así que el resultado en disco y en PBS es idéntico se use el que se use."
   },
   "restoreAccess": {
     "heading": "Recuperación del lado de la restauración",
-    "body": "El flujo de restauración descubre las copias de host de ProxMenux en PBS listando los grupos de backups bajo el repositorio configurado y filtrando por patrón de backup ID. La pestaña Backups del Monitor renderiza la misma lista. Seleccionar un backup dispara <code>proxmox-backup-client restore</code> con el mismo repositorio + contraseña + fingerprint (y <code>--keyfile</code> cuando el backup iba cifrado), extrayendo el <code>.pxar</code> a un directorio de staging que <code>_rs_check_layout</code> alimenta al pipeline estándar de restauración. Para recuperación manual fuera de ProxMenux, el mismo comando extrae el archivo a cualquier ruta — el árbol resultante puede inspeccionarse o alimentar una restauración a mano."
+    "body": "El flujo de restauración descubre los backups de host de ProxMenux en PBS listando los grupos de backups bajo el repositorio configurado y filtrando por patrón de backup ID. La pestaña Backups del Monitor renderiza la misma lista. Seleccionar un backup dispara <code>proxmox-backup-client restore</code> con el mismo repositorio + contraseña + fingerprint (y <code>--keyfile</code> cuando el backup iba cifrado), extrayendo el <code>.pxar</code> a un directorio de staging que <code>_rs_check_layout</code> alimenta al pipeline estándar de restauración. Para recuperación manual fuera de ProxMenux, el mismo comando extrae el archivo a cualquier ruta — el árbol resultante puede inspeccionarse o alimentar una restauración a mano."
   },
   "references": {
     "heading": "Referencias",
@@ -91,7 +91,7 @@
       {
         "label": "proxmox-backup-client",
         "href": "https://pbs.proxmox.com/docs/backup-client.html",
-        "tail": " — la herramienta de línea de comandos que ProxMenux invoca en cada copia y restauración. Cubre backup IDs, tipos de backup, archivos, sintaxis del repositorio y variables de entorno."
+        "tail": " — la herramienta de línea de comandos que ProxMenux invoca en cada backup y restauración. Cubre backup IDs, tipos de backup, archivos, sintaxis del repositorio y variables de entorno."
       },
       {
         "label": "Cifrado del lado del cliente",
@@ -101,7 +101,7 @@
       {
         "label": "Gestión de datastores",
         "href": "https://pbs.proxmox.com/docs/storage.html",
-        "tail": " — creación y administración de los datastores que reciben las copias de host, incluyendo el layout del chunk-store y permisos."
+        "tail": " — creación y administración de los datastores que reciben los backups de host, incluyendo el layout del chunk-store y permisos."
       },
       {
         "label": "Poda y recolección de basura",
diff --git a/web/messages/es/docs/backup-restore/glossary.json b/web/messages/es/docs/backup-restore/glossary.json
index c96e29a7..6cb1d2d1 100644
--- a/web/messages/es/docs/backup-restore/glossary.json
+++ b/web/messages/es/docs/backup-restore/glossary.json
@@ -1,15 +1,15 @@
 {
   "meta": {
     "title": "Glosario de términos — Backup & Restore | ProxMenux",
-    "description": "Glosario de términos y definiciones en español para el sistema de copia y restauración de ProxMenux: cifrado, clave, passphrase, sobre de recuperación, PBS, chunks, rootfs, manifiesto, runner y hidratación cross-kernel.",
+    "description": "Glosario de términos y definiciones en español para el sistema de backup y restauración de ProxMenux: cifrado, clave, passphrase, sobre de recuperación, PBS, chunks, rootfs, manifiesto, runner y hidratación cross-kernel.",
     "ogTitle": "Glosario de Backup & Restore | ProxMenux",
-    "ogDescription": "Definiciones claras en español para los términos que aparecen en la documentación de copia y restauración de ProxMenux.",
+    "ogDescription": "Definiciones claras en español para los términos que aparecen en la documentación de backup y restauración de ProxMenux.",
     "twitterTitle": "Glosario Backup & Restore | ProxMenux",
     "twitterDescription": "Passphrase, keyfile, sobre de recuperación, rootfs, manifiesto, PBS, chunks — todo definido en español."
   },
   "header": {
     "title": "Glosario",
-    "description": "Términos que aparecen a lo largo de la documentación de copia y restauración, con su definición.",
+    "description": "Términos que aparecen a lo largo de la documentación de backup y restauración, con su definición.",
     "section": "Backup & Restore"
   },
   "intro": {
@@ -18,49 +18,42 @@
   "groups": [
     {
       "title": "Cifrado y recuperación de clave",
-      "intro": "Terminología del bloque de cifrado de copias en PBS. Incluye dos secretos distintos: una clave binaria y una passphrase escrita.",
+      "intro": "Terminología del bloque de cifrado de backups en PBS. Incluye dos secretos distintos: una clave binaria y una passphrase escrita.",
       "entries": [
         {
           "id": "passphrase-recuperacion",
           "term": "Passphrase de recuperación",
-          "also": "recovery passphrase",
-          "def": "Contraseña de texto que elige el usuario para proteger el <a href=\"#sobre-recuperacion\">sobre de recuperación</a>. Se pide dos veces con validación de coincidencia y solo se usa para cifrar el sobre y para descifrarlo si algún día hay que recuperar la clave. <strong>No sirve para desbloquear la clave del keyfile</strong> ni se envía nunca a PBS. Nunca sale del host durante una copia normal."
+          "def": "Contraseña de texto que elige el usuario para proteger el <a href=\"#sobre-recuperacion\">sobre de recuperación</a>. Se pide dos veces con validación de coincidencia y solo se usa para cifrar el sobre y para descifrarlo si algún día hay que recuperar la clave. <strong>No sirve para desbloquear la clave del keyfile</strong> ni se envía nunca a PBS. Nunca sale del host durante un backup normal."
         },
         {
           "id": "clave-cifrado",
           "term": "Clave de cifrado (keyfile)",
-          "also": "keyfile, PBS encryption key",
-          "def": "Fichero binario que Proxmox Backup Server utiliza para cifrar los <a href=\"#chunk\">chunks</a> de la copia antes de subirlos. Sin ese fichero, ninguna copia cifrada puede leerse. ProxMenux lo guarda en <code>/usr/local/share/proxmenux/pbs-key.conf</code> con permisos <code>600</code>. Es el activo que hay que proteger; el <a href=\"#sobre-recuperacion\">sobre de recuperación</a> existe precisamente para poder rescatar este fichero si se pierde."
+          "def": "Archivo de clave que proxmox-backup-client usa para cifrar los <a href=\"#chunk\">chunks</a> antes de subirlos a PBS. Sin la clave correspondiente no se leen los datos cifrados. ProxMenux lo guarda en <code>/usr/local/share/proxmenux/pbs-key.conf</code> con modo <code>600</code>. Protégelo: el <a href=\"#sobre-recuperacion\">sobre de recuperación</a> permite recuperarlo si se pierde."
         },
         {
           "id": "contrasena-keyfile",
           "term": "Contraseña de la clave (KDF passphrase)",
-          "also": "keyfile passphrase, scrypt passphrase",
-          "def": "Contraseña opcional que puede llevar la propia clave, distinta de la <a href=\"#passphrase-recuperacion\">passphrase de recuperación</a>. Solo aparece si la clave se creó con <code>--kdf scrypt</code> (una clave importada de otro sitio, por ejemplo). Sin ella, la clave no se puede desbloquear en cada uso. ProxMenux la persiste cifrada en el host para que las copias programadas puedan ejecutarse sin diálogo interactivo."
+          "def": "Contraseña opcional que puede llevar la propia clave, distinta de la <a href=\"#passphrase-recuperacion\">passphrase de recuperación</a>. Solo aparece si la clave se creó con <code>--kdf scrypt</code> (una clave importada de otro sitio, por ejemplo). Sin ella, la clave no se puede desbloquear en cada uso. ProxMenux la persiste cifrada en el host para que los backups programados puedan ejecutarse sin diálogo interactivo."
         },
         {
           "id": "sobre-recuperacion",
           "term": "Sobre de recuperación",
-          "also": "recovery envelope, escrow blob, pbs-key.recovery.enc",
           "def": "La propia <a href=\"#clave-cifrado\">clave de cifrado</a> envuelta en una capa adicional: se cifra con la <a href=\"#passphrase-recuperacion\">passphrase de recuperación</a> mediante <a href=\"#aes-256-cbc\">AES-256-CBC</a> y <a href=\"#pbkdf2\">PBKDF2</a> antes de salir del host. Es lo que se sube a PBS en el grupo <code>-keyrecovery</code>. Sin la passphrase, el sobre es opaco: descargarlo desde PBS no revela la clave."
         },
         {
           "id": "cifrado-cliente",
           "term": "Cifrado del lado del cliente",
-          "also": "client-side encryption",
           "def": "Modelo en el que los datos se cifran en el host de origen antes de subirse. PBS solo recibe y almacena datos cifrados; ni siquiera un administrador de PBS con acceso al datastore puede leerlos sin la clave. ProxMenux se apoya en este modelo y añade el <a href=\"#sobre-recuperacion\">sobre de recuperación</a> encima."
         },
         {
           "id": "kdf-none",
           "term": "--kdf none",
-          "also": "clave sin contraseña",
           "def": "Opción de <code>proxmox-backup-client key create</code> que genera una clave sin contraseña asociada. La clave se puede usar directamente sin ningún diálogo, lo que es imprescindible para que los trabajos programados corran de forma desatendida. Es lo que ProxMenux usa por defecto al generar una clave nueva."
         },
         {
           "id": "kdf-scrypt",
           "term": "--kdf scrypt",
-          "also": "clave con contraseña",
-          "def": "Opción de <code>proxmox-backup-client key create</code> que genera una clave protegida con una <a href=\"#contrasena-keyfile\">contraseña de la clave</a>. Cada vez que se usa la clave hay que desbloquearla con esa contraseña. ProxMenux acepta este tipo de claves al importarlas y guarda la contraseña cifrada para que las copias programadas puedan correr sin intervención."
+          "def": "Opción de <code>proxmox-backup-client key create</code> que genera una clave protegida con una <a href=\"#contrasena-keyfile\">contraseña de la clave</a>. Cada vez que se usa la clave hay que desbloquearla con esa contraseña. ProxMenux acepta este tipo de claves al importarlas y guarda la contraseña cifrada para que los backups programados puedan correr sin intervención."
         },
         {
           "id": "aes-256-cbc",
@@ -75,8 +68,8 @@
       ]
     },
     {
-      "title": "Estructura de la copia",
-      "intro": "Términos que describen lo que hay dentro de una copia, sea cual sea el destino.",
+      "title": "Estructura del backup",
+      "intro": "Términos que describen lo que hay dentro de un backup, sea cual sea el destino.",
       "entries": [
         {
           "id": "rootfs",
@@ -86,17 +79,17 @@
         {
           "id": "manifiesto",
           "term": "Manifiesto (manifest.json)",
-          "def": "Documento JSON estructurado que describe el host de origen en el momento de la copia: hardware, almacenamiento, kernel, componentes instalados por ProxMenux e inventario de VMs y LXCs. Lo genera ProxMenux con seis colectores independientes. La restauración lo utiliza para comparar origen y destino."
+          "def": "Documento JSON estructurado que describe el host de origen en el momento del backup: hardware, almacenamiento, kernel, componentes instalados por ProxMenux e inventario de VMs y LXCs. Lo genera ProxMenux con seis colectores independientes. La restauración lo utiliza para comparar origen y destino."
         },
         {
           "id": "staging",
           "term": "Directorio de staging",
-          "def": "Directorio temporal donde ProxMenux ensambla los tres bloques (rootfs, metadata y manifiesto) antes de empaquetarlos y subirlos al destino. Se elimina automáticamente al terminar la copia, incluso si se aborta."
+          "def": "Directorio temporal donde ProxMenux ensambla los tres bloques (rootfs, metadata y manifiesto) antes de empaquetarlos y subirlos al destino. Se elimina automáticamente al terminar el backup, incluso si se aborta."
         },
         {
           "id": "perfil-defecto",
           "term": "Perfil por defecto",
-          "def": "Conjunto curado de rutas que ProxMenux copia por defecto en toda copia. Cubre configuración de PVE, red, SSH, kernel, apt, herramientas ProxMenux y otras. Está definido en el código y se documenta en la página <em>Cómo funciona</em>."
+          "def": "Conjunto curado de rutas que ProxMenux copia por defecto en todo backup. Cubre configuración de PVE, red, SSH, kernel, apt, herramientas ProxMenux y otras. Está definido en el código y se documenta en la página <em>Cómo funciona</em>."
         },
         {
           "id": "rutas-personalizadas",
@@ -107,22 +100,22 @@
     },
     {
       "title": "Destinos y almacenamiento",
-      "intro": "Términos ligados al lugar donde acaba la copia — servidor PBS, archivo local o repositorio Borg — y a la forma en que PBS organiza los datos.",
+      "intro": "Términos ligados al lugar donde acaba el backup — servidor PBS, archivo local o repositorio Borg — y a la forma en que PBS organiza los datos.",
       "entries": [
         {
           "id": "repositorio-pbs",
           "term": "Repositorio PBS",
-          "def": "Combinación de servidor Proxmox Backup Server + <a href=\"#datastore\">datastore</a> + usuario al que se suben las copias. Se identifica con el formato <code>usuario@realm@host:datastore</code>. Un mismo servidor PBS puede alojar varios repositorios."
+          "def": "Combinación de servidor Proxmox Backup Server + <a href=\"#datastore\">datastore</a> + usuario al que se suben los backups. Se identifica con el formato <code>user@realm@host:datastore</code>. Un mismo servidor PBS puede alojar varios repositorios."
         },
         {
           "id": "datastore",
           "term": "Datastore",
-          "def": "Almacén concreto dentro de un servidor PBS donde se guardan las copias y sus chunks. Cada datastore vive sobre un sistema de ficheros del servidor PBS y tiene sus propios permisos y políticas."
+          "def": "Almacén concreto dentro de un servidor PBS donde se guardan los backups y sus chunks. Cada datastore vive sobre un sistema de ficheros del servidor PBS y tiene sus propios permisos y políticas."
         },
         {
           "id": "chunk",
           "term": "Chunk / deduplicación por chunks",
-          "def": "PBS divide cada copia en trozos (chunks) de tamaño variable, identifica cada trozo por su hash y solo guarda cada trozo una vez, aunque aparezca en muchas copias distintas. Esto hace que copias sucesivas del mismo host o entre hosts similares consuman muy poco espacio adicional."
+          "def": "PBS divide cada backup en trozos (chunks) de tamaño variable, identifica cada trozo por su hash y solo guarda cada trozo una vez, aunque aparezca en muchos backups distintos. Esto hace que backups sucesivos del mismo host o entre hosts similares consuman muy poco espacio adicional."
         },
         {
           "id": "fingerprint",
@@ -131,13 +124,13 @@
         },
         {
           "id": "grupo-copia",
-          "term": "Grupo de copia (backup group)",
-          "def": "Contenedor lógico dentro de PBS bajo el cual se acumulan todas las copias sucesivas del mismo activo. Cada nueva copia comparte deduplicación con las anteriores del mismo grupo. ProxMenux utiliza dos grupos por host cuando hay cifrado: uno para la copia del host y otro con sufijo <code>-keyrecovery</code> para el <a href=\"#sobre-recuperacion\">sobre de recuperación</a>."
+          "term": "Grupo de backup (backup group)",
+          "def": "Contenedor lógico dentro de PBS bajo el cual se acumulan todos los backups sucesivos del mismo activo. Cada nuevo backup comparte deduplicación con los anteriores del mismo grupo. ProxMenux utiliza dos grupos por host cuando hay cifrado: uno para el backup del host y otro con sufijo <code>-keyrecovery</code> para el <a href=\"#sobre-recuperacion\">sobre de recuperación</a>."
         },
         {
           "id": "backup-id",
           "term": "Backup ID",
-          "def": "Nombre del <a href=\"#grupo-copia\">grupo de copia</a>. ProxMenux propone por defecto <code>hostcfg-HOSTNAME</code> y permite editarlo antes de la subida; los caracteres no admitidos se limpian automáticamente."
+          "def": "Nombre del <a href=\"#grupo-copia\">grupo de backup</a>. ProxMenux propone por defecto <code>hostcfg-HOSTNAME</code> y permite editarlo antes de la subida; los caracteres no admitidos se limpian automáticamente."
         },
         {
           "id": "pxar",
@@ -153,17 +146,17 @@
         {
           "id": "runner",
           "term": "Runner",
-          "def": "Script <code>run_scheduled_backup.sh</code> que ejecuta una copia programada. Lee la configuración del trabajo, lanza el backend correspondiente (Local, PBS o Borg), aplica la retención al terminar y envía las notificaciones configuradas."
+          "def": "Script <code>run_scheduled_backup.sh</code> que ejecuta un backup programado. Lee la configuración del trabajo, lanza el backend correspondiente (Local, PBS o Borg), aplica la retención al terminar y envía las notificaciones configuradas."
         },
         {
           "id": "trabajo-programado",
           "term": "Trabajo programado",
-          "def": "Configuración persistida de una copia recurrente. Incluye destino, credenciales, cifrado, horario y retención. Se guarda en <code>/var/lib/proxmenux/backup-jobs/&lt;id&gt;.env</code>."
+          "def": "Configuración persistida de un backup recurrente. Incluye destino, credenciales, cifrado, horario y retención. Se guarda en <code>/var/lib/proxmenux/backup-jobs/&lt;id&gt;.env</code>."
         },
         {
           "id": "modo-adjunto",
           "term": "Modo adjunto (attach mode)",
-          "def": "Trabajo programado que no lleva horario propio; se dispara automáticamente cada vez que una tarea <code>vzdump</code> de PVE existente se ejecuta. Hereda el horario y la retención de esa tarea padre. Solo compatible con destinos Local y PBS."
+          "def": "Trabajo sin timer propio. Un hook job-end de <code>vzdump</code> lo ejecuta después de los backups de invitados cuando coincide el almacenamiento. El padre seleccionado aporta el destino y la retención, que se vuelve a leer de la tarea padre en cada ejecución, pero el hook compara almacenamiento, no ID de tarea padre; otra tarea con el mismo destino también puede activarlo. Solo para Local y PBS."
         },
         {
           "id": "timer-systemd",
@@ -173,7 +166,7 @@
         {
           "id": "retencion",
           "term": "Retención (keep-last, keep-daily…)",
-          "def": "Política que decide qué copias antiguas se conservan y cuáles se eliminan. Se define por trabajo con parámetros como <code>keep-last</code>, <code>keep-daily</code>, <code>keep-weekly</code>, <code>keep-monthly</code>. El runner la aplica después de cada copia exitosa."
+          "def": "Política que decide qué backups antiguos se conservan y cuáles se eliminan. Se define por trabajo con parámetros como <code>keep-last</code>, <code>keep-daily</code>, <code>keep-weekly</code>, <code>keep-monthly</code>. El runner la aplica después de cada backup exitoso."
         }
       ]
     },
@@ -189,7 +182,7 @@
         {
           "id": "hidratacion",
           "term": "Hidratación (cross-kernel)",
-          "def": "Pasada de restauración que funde la configuración propia del usuario del origen (tokens IOMMU, IDs de dispositivos VFIO, quirks personalizadas, claves de GRUB) sobre la configuración de arranque fresca del destino, sin copiar verbatim los ficheros ligados al kernel del origen. Se ejecuta cuando el kernel del destino es más reciente que el de la copia."
+          "def": "Pasada de restauración que funde la configuración propia del usuario del origen (tokens IOMMU, IDs de dispositivos VFIO, quirks personalizadas, claves de GRUB) sobre la configuración de arranque fresca del destino, sin copiar verbatim los ficheros ligados al kernel del origen. Se ejecuta cuando el kernel del destino es más reciente que el del backup."
         },
         {
           "id": "cross-kernel",
@@ -209,8 +202,7 @@
         {
           "id": "equipo-recien-instalado",
           "term": "Equipo recién instalado",
-          "also": "fresh install",
-          "def": "Host acabado de reinstalar desde cero, sin la <a href=\"#clave-cifrado\">clave de cifrado</a> local. Para restaurar copias cifradas hace falta primero recuperar la clave desde el <a href=\"#sobre-recuperacion\">sobre</a> almacenado en PBS, con la <a href=\"#passphrase-recuperacion\">passphrase de recuperación</a>."
+          "def": "Host acabado de reinstalar desde cero, sin la <a href=\"#clave-cifrado\">clave de cifrado</a> local. Para restaurar backups cifrados hace falta primero recuperar la clave desde el <a href=\"#sobre-recuperacion\">sobre</a> almacenado en PBS, con la <a href=\"#passphrase-recuperacion\">passphrase de recuperación</a>."
         }
       ]
     }
@@ -221,7 +213,7 @@
       {
         "label": "Cómo funciona",
         "href": "/docs/backup-restore/how-it-works",
-        "tail": " — dónde encajan el rootfs, el manifiesto y el inventario de aplicaciones en cada copia."
+        "tail": " — dónde encajan el rootfs, el manifiesto y el inventario de aplicaciones en cada backup."
       },
       {
         "label": "Destino Proxmox Backup Server",
diff --git a/web/messages/es/docs/backup-restore/how-it-works.json b/web/messages/es/docs/backup-restore/how-it-works.json
index 0c5ec8c7..9240775f 100644
--- a/web/messages/es/docs/backup-restore/how-it-works.json
+++ b/web/messages/es/docs/backup-restore/how-it-works.json
@@ -1,38 +1,38 @@
 {
   "meta": {
     "title": "Cómo funciona ProxMenux Backup por dentro — rootfs, manifiesto, aplicaciones",
-    "description": "Desglose detallado del contenido de una copia de ProxMenux: el rootfs producido por rsync del perfil de rutas por defecto, el manifiesto estructurado construido por seis colectores independientes, y el inventario de aplicaciones que dirige la reinstalación automática de paquetes y componentes tras una restauración.",
+    "description": "Desglose detallado del contenido de un backup de ProxMenux: el rootfs producido por rsync del perfil de rutas por defecto, el manifiesto estructurado construido por seis colectores independientes, y el inventario de aplicaciones que dirige la reinstalación automática de paquetes y componentes tras una restauración.",
     "ogTitle": "Cómo funciona ProxMenux Backup por dentro",
-    "ogDescription": "Los tres bloques de una copia de ProxMenux explicados: rootfs, manifiesto y aplicaciones.",
+    "ogDescription": "Los tres bloques de un backup de ProxMenux explicados: rootfs, manifiesto y aplicaciones.",
     "twitterTitle": "Cómo funciona ProxMenux Backup | ProxMenux",
-    "twitterDescription": "Los tres bloques de una copia de ProxMenux y cómo la restauración reproduce el host de origen a partir de ellos."
+    "twitterDescription": "Los tres bloques de un backup de ProxMenux y cómo la restauración reproduce el host de origen a partir de ellos."
   },
   "header": {
     "title": "Cómo funciona",
-    "description": "Desglose interno de una copia de seguridad creada con ProxMenux — sistema de ficheros, manifiesto e inventario de aplicaciones — y cómo la restauración consume los tres para reproducir el host de origen sobre un destino que puede no compartir el mismo kernel.",
+    "description": "Desglose interno de un backup creado con ProxMenux — sistema de ficheros, manifiesto e inventario de aplicaciones — y cómo la restauración consume los tres para reproducir el host de origen sobre un destino que puede no compartir el mismo kernel.",
     "section": "Backup & Restore"
   },
   "intro": {
     "title": "Un archivo, tres bloques",
-    "body": "Cada copia produce un layout de directorio con tres bloques bien definidos bajo una única raíz de staging. El archivo que se sube al destino (archivo local <code>.tar.zst</code>, backup PBS o archivo Borg) contiene ese layout exacto. La restauración lee los tres bloques de forma independiente, en un orden concreto que garantiza la corrección: primero se copia el <strong>rootfs</strong> —el sistema de archivos raíz del host— para colocar la configuración, después se consulta <strong>el manifiesto</strong> para detectar drift y decidir qué omitir, y finalmente <strong>el inventario de aplicaciones</strong> dirige la pasada de reinstalación post-arranque. No hay dependencias entre bloques — cada uno puede inspeccionarse o extraerse de forma independiente."
+    "body": "Cada backup produce una estructura con tres bloques definidos bajo un único directorio de preparación. El archivo subido al destino (<code>.tar.zst</code> local, backup PBS o archivo Borg) contiene esa misma estructura. La restauración utiliza los tres: consulta <strong>el manifiesto</strong> antes de aplicar cambios para detectar diferencias y decidir qué omitir; <strong>rootfs</strong> aporta los archivos de configuración, que se aplican en vivo o tras el reinicio; y <strong>el inventario de aplicaciones</strong> dirige la instalación de paquetes y la reinstalación de componentes después del arranque. Cada bloque puede inspeccionarse o extraerse de forma independiente."
   },
   "layout": {
     "heading": "Layout del archivo",
-    "intro": "Cada archivo respeta el mismo layout con independencia del destino. El subdirectorio <code>metadata/</code> contiene los bloques estructurados; el subdirectorio <code>rootfs/</code> contiene la copia del sistema de ficheros.",
-    "treeCaption": "El directorio de staging generado durante una copia. Todos los destinos reciben el mismo árbol (adaptado a su formato nativo: tar para local, chunks PBS para PBS, segmentos borg para Borg).",
+    "intro": "Cada archivo respeta el mismo layout con independencia del destino. El subdirectorio <code>metadata/</code> contiene los bloques estructurados; el subdirectorio <code>rootfs/</code> contiene el backup del sistema de ficheros.",
+    "treeCaption": "El directorio de staging generado durante un backup. Todos los destinos reciben el mismo árbol (adaptado a su formato nativo: tar para local, chunks PBS para PBS, segmentos borg para Borg).",
     "tree": "backup-[timestamp]/\n├── manifest.json                  # estado estructurado del host\n├── metadata/\n│   ├── packages.manual.list       # apt-mark showmanual\n│   ├── run_info.env               # identidad de la ejecución + versión del kernel + método pmxcfs\n│   ├── paths_archived.txt         # lista exacta de rutas que llegaron a rootfs/\n│   └── missing_paths.txt          # rutas del perfil ausentes en el origen\n└── rootfs/\n    ├── etc/                       # /etc/pve, /etc/network, /etc/systemd/network, /etc/ssh, …\n    ├── root/                      # /root (con subdirs volátiles excluidos)\n    ├── usr/local/                 # /usr/local/bin, /usr/local/share/proxmenux, …\n    └── var/                       # /var/lib/pve-cluster (config.db vía sqlite3 .backup), /var/spool/cron/…"
   },
   "rootfs": {
     "heading": "El bloque rootfs",
-    "intro": "El árbol <code>rootfs/</code> es una <strong>copia plana del sistema de ficheros</strong> producida por <code>rsync</code> desde el host de origen. Contiene un <strong>perfil por defecto</strong> curado de rutas que importan para una restauración de Proxmox, más cualquier <strong>ruta personalizada</strong> añadida por el usuario al trabajo de copia o a la sesión interactiva. El conjunto es intencionadamente estrecho: solamente rutas que <em>contienen configuración</em> o <em>contienen estado que Proxmox no puede regenerar por sí solo</em>.",
+    "intro": "El árbol <code>rootfs/</code> es una <strong>copia plana del sistema de ficheros</strong> producida por <code>rsync</code> desde el host de origen. Contiene un <strong>perfil por defecto</strong> curado de rutas que importan para una restauración de Proxmox, más cualquier <strong>ruta personalizada</strong> añadida por el usuario al trabajo de backup o a la sesión interactiva. El conjunto es intencionadamente estrecho: solamente rutas que <em>contienen configuración</em> o <em>contienen estado que Proxmox no puede regenerar por sí solo</em>.",
     "defaultProfileTitle": "El perfil por defecto",
-    "defaultProfileBody": "El perfil por defecto está definido por <code>hb_default_profile_paths</code> en <code>lib_host_backup_common.sh</code>. Cubre ocho categorías que en conjunto describen un host Proxmox operativo:",
+    "defaultProfileBody": "El perfil por defecto se define en <code>hb_default_profile_paths</code> de <code>lib_host_backup_common.sh</code>. Incluye ocho categorías fijas y, si corresponde, el estado ZFS, que juntas describen un host Proxmox operativo:",
     "categoriesTitle": "Categorías de rutas",
     "categoryRows": [
       {
         "category": "Núcleo PVE",
         "paths": "/etc/pve, /var/lib/pve-cluster, /etc/vzdump.conf",
-        "why": "Contenido del filesystem del clúster y valores por defecto de vzdump. La base pmxcfs (<code>config.db</code>) se captura con un snapshot consistente vía <code>sqlite3 .backup</code> sin parar el clúster, y los sidecars <code>.db-wal</code> y <code>.db-shm</code> quedan excluidos del rsync. Si <code>sqlite3</code> no está disponible, la copia deposita un <code>config.db.raw-fallback</code> que la restauración promociona automáticamente."
+        "why": "Contenido del filesystem del clúster y valores por defecto de vzdump. La base pmxcfs (<code>config.db</code>) se captura con un snapshot consistente vía <code>sqlite3 .backup</code> sin parar el clúster, y los sidecars <code>.db-wal</code> y <code>.db-shm</code> quedan excluidos del rsync. Si <code>sqlite3</code> no está disponible, el backup deposita un <code>config.db.raw-fallback</code> que la restauración promociona automáticamente."
       },
       {
         "category": "Identidad del host y red",
@@ -62,12 +62,12 @@
       {
         "category": "Estado ProxMenux y herramientas",
         "paths": "/etc/proxmenux, /etc/systemd/system, /etc/log2ram.conf, /etc/logrotate.conf, /etc/logrotate.d, /etc/lm-sensors, /etc/sensors3.conf, /etc/fail2ban, /etc/snmp, /etc/postfix, /etc/wireguard, /etc/openvpn, /etc/grafana, /etc/influxdb, /etc/prometheus, /etc/telegraf, /etc/zabbix",
-        "why": "Herramientas opcionales pero habituales de Proxmox. Las rutas ausentes se registran en <code>metadata/missing_paths.txt</code> sin detener la copia."
+        "why": "Herramientas opcionales pero habituales de Proxmox. Las rutas ausentes se registran en <code>metadata/missing_paths.txt</code> sin detener el backup."
       },
       {
         "category": "Binarios ProxMenux y root",
         "paths": "/usr/local/bin, /usr/local/sbin, /usr/local/share/proxmenux, /var/lib/proxmenux, /root (subdirs volátiles excluidos)",
-        "why": "Binarios instalados por ProxMenux y configuración por usuario bajo <code>/root</code>. Las rutas volátiles (<code>.bash_history</code>, <code>.cache/</code>, <code>tmp/</code>, <code>.local/share/Trash/</code>) quedan fuera de la copia. <code>/var/lib/proxmenux</code> guarda los trabajos de backup programados y el estado del host que mantiene ProxMenux; quedan fuera la preparación de una restauración, las copias de rollback y las marcas posteriores a la restauración, porque pertenecen al host que la ejecuta."
+        "why": "Binarios instalados por ProxMenux y configuración por usuario bajo <code>/root</code>. Las rutas volátiles (<code>.bash_history</code>, <code>.cache/</code>, <code>tmp/</code>, <code>.local/share/Trash/</code>) quedan fuera del backup. <code>/var/lib/proxmenux</code> guarda los trabajos de backup programados y el estado del host que mantiene ProxMenux; quedan fuera la preparación de una restauración, los backups de rollback y las marcas posteriores a la restauración, porque pertenecen al host que la ejecuta."
       },
       {
         "category": "Estado ZFS (condicional)",
@@ -76,18 +76,18 @@
       }
     ],
     "customTitle": "Ampliar el perfil con rutas propias",
-    "customBody": "Además del perfil por defecto, ProxMenux ofrece dos maneras de incluir rutas adicionales en una copia. Se combinan sin conflicto y ambas se aplican tanto a copias interactivas como a trabajos programados.",
+    "customBody": "Además del perfil por defecto, ProxMenux ofrece dos maneras de incluir rutas adicionales en un backup. Se combinan sin conflicto y ambas se aplican tanto a backups interactivos como a trabajos programados.",
     "customExtrasTitle": "1. Extras persistentes (fichero por-host)",
-    "customExtrasBody": "Un fichero de texto en <code>/usr/local/share/proxmenux/backup-extra-paths.txt</code> guarda una lista de rutas absolutas que el usuario ha marcado como \"incluir siempre\" en este host. Cuando una copia se ejecuta en modo <strong>Default</strong>, ProxMenux añade automáticamente estas rutas al perfil por defecto sin preguntar. El fichero se edita desde la interfaz — no hay que tocarlo a mano — y persiste entre reinicios y actualizaciones. Cada línea es una ruta absoluta; se admiten comentarios con <code>#</code>.",
+    "customExtrasBody": "Un fichero de texto en <code>/usr/local/share/proxmenux/backup-extra-paths.txt</code> guarda una lista de rutas absolutas que el usuario ha marcado como \"incluir siempre\" en este host. Cuando un backup se ejecuta en modo <strong>Default</strong>, ProxMenux añade automáticamente estas rutas al perfil por defecto sin preguntar. El fichero se edita desde la interfaz — no hay que tocarlo a mano — y persiste entre reinicios y actualizaciones. Cada línea es una ruta absoluta; se admiten comentarios con <code>#</code>.",
     "customModeTitle": "2. Modo Custom (por ejecución)",
-    "customModeBody": "Al lanzar una copia en modo <strong>Custom</strong>, en lugar de aplicar el perfil por defecto directamente, se muestra un checklist con todas las rutas: las del perfil por defecto y las de extras persistentes (estas últimas premarcadas con <code>[+]</code>). El usuario marca o desmarca lo que quiera para esa ejecución concreta, y puede además pulsar <em>Add custom path</em> para introducir una ruta nueva — que queda registrada en el fichero de extras persistentes para futuras copias.",
+    "customModeBody": "Al lanzar un backup en modo <strong>Custom</strong>, en lugar de aplicar el perfil por defecto directamente, se muestra un checklist con todas las rutas: las del perfil por defecto y las de extras persistentes (estas últimas premarcadas con <code>[+]</code>). El usuario marca o desmarca lo que quiera para esa ejecución concreta, y puede además pulsar <em>Add custom path</em> para introducir una ruta nueva — que queda registrada en el fichero de extras persistentes para futuros backups.",
     "customMissingTitle": "Rutas ausentes en el origen",
-    "customMissingBody": "Cualquier ruta del perfil (por defecto o añadida) que no exista en el host de origen se registra en <code>metadata/missing_paths.txt</code> dentro del archivo. La copia no falla ni interrumpe — el usuario ve el resumen de rutas archivadas y rutas ausentes al terminar. En la práctica esto ocurre con las rutas de herramientas opcionales como <code>/etc/wireguard</code> o <code>/etc/prometheus</code> cuando esas herramientas no están instaladas."
+    "customMissingBody": "Cualquier ruta del perfil (por defecto o añadida) que no exista en el host de origen se registra en <code>metadata/missing_paths.txt</code> dentro del archivo. El backup no falla ni interrumpe — el usuario ve el resumen de rutas archivadas y rutas ausentes al terminar. En la práctica esto ocurre con las rutas de herramientas opcionales como <code>/etc/wireguard</code> o <code>/etc/prometheus</code> cuando esas herramientas no están instaladas."
   },
   "manifest": {
     "heading": "El bloque manifiesto",
-    "intro": "<code>manifest.json</code> es un documento JSON estructurado que describe el host de origen en el momento de la copia. Se produce mediante <strong>seis colectores independientes</strong> orquestados por <code>build_manifest.sh</code>. Cada colector es de sólo lectura, produce un fragmento JSON bien definido y hace fallback a un valor vacío seguro si falla — el manifiesto sigue siendo utilizable aunque una sección quede incompleta.",
-    "orchestratorCaption": "Los seis colectores componen el manifiesto. Cada uno corre en su propio subproceso; un fallo en uno hace fallback al valor por defecto documentado y advierte, pero no aborta la copia.",
+    "intro": "<code>manifest.json</code> es un documento JSON estructurado que describe el host de origen en el momento del backup. Se produce mediante <strong>seis colectores independientes</strong> orquestados por <code>build_manifest.sh</code>. Cada colector es de sólo lectura, produce un fragmento JSON bien definido y hace fallback a un valor vacío seguro si falla — el manifiesto sigue siendo utilizable aunque una sección quede incompleta.",
+    "orchestratorCaption": "Los seis colectores componen el manifiesto. Cada uno corre en su propio subproceso; un fallo en uno hace fallback al valor por defecto documentado y advierte, pero no aborta el backup.",
     "collectorRows": [
       {
         "collector": "collect_source_host.sh",
@@ -117,15 +117,15 @@
       {
         "collector": "collect_guests.sh",
         "produces": "vms_lxcs_at_backup",
-        "content": "Enumera VMs (<code>qm list</code>) y LXCs (<code>pct list</code>) presentes en el momento de la copia — VMID, nombre, estado actual. Sólo el inventario: los datos reales del invitado son responsabilidad de <code>vzdump</code> / PBS."
+        "content": "Enumera VMs (<code>qm list</code>) y LXCs (<code>pct list</code>) presentes en el momento del backup — VMID, nombre, estado actual. Sólo el inventario: los datos reales del invitado son responsabilidad de <code>vzdump</code> / PBS."
       }
     ],
     "schemaTitle": "Validación por esquema",
-    "schemaBody": "ProxMenux incluye una plantilla que describe qué campos debe contener el manifiesto y qué forma tiene cada uno. Cuando se genera una copia se puede comprobar automáticamente que el manifiesto respeta esa plantilla, de modo que si un colector produjera un JSON malformado o con un campo mal escrito se detectaría en el momento. Es una comprobación destinada al desarrollo del propio ProxMenux: si el sistema no la tiene instalada, la copia sigue funcionando con normalidad y el manifiesto se genera igual."
+    "schemaBody": "El manifiesto se valida con <code>scripts/backup_restore/schema/manifest.schema.json</code>. Ejecutar <code>build_manifest.sh --validate</code> activa una validación JSON Schema en Python (requiere <code>python3</code> y <code>jsonschema</code>). Si el módulo no está instalado, se omite la comprobación sin mostrar ningún aviso: esta validación es principalmente una ayuda para el desarrollo, no una dependencia necesaria durante la ejecución."
   },
   "applications": {
     "heading": "El inventario de aplicaciones",
-    "intro": "Dos ficheros bajo <code>metadata/</code> catalogan todo lo instalado en el origen que no forma parte del conjunto de paquetes base de Proxmox VE. La restauración los utiliza para reproducir el conjunto exacto de software instalado por el usuario en el destino, usando APT o los instaladores propios de ProxMenux según cómo se instalara originalmente el software.",
+    "intro": "Dos inventarios registran el software añadido al conjunto base de Proxmox VE: la lista de paquetes en <code>metadata/</code> y el registro de componentes dentro de rootfs, detallados a continuación. La restauración los usa para reproducir el software del usuario con APT o los instaladores de ProxMenux, según cómo se instalara originalmente.",
     "packagesTitle": "packages.manual.list",
     "packagesBody": "Una lista de texto plano producida por <code>apt-mark showmanual</code>: todos los paquetes APT que fueron <em>instalados explícitamente</em> en el host de origen, ordenados alfabéticamente. Esto excluye los paquetes instalados como dependencias del ISO base de Proxmox VE (que APT del destino vuelve a traer automáticamente). Es leída por <code>_rs_run_complete_extras</code> durante la restauración, filtrada por un filtro <em>cascade-safe</em> de tres pases (<code>dpkg -s</code> para lo ya instalado, detección de sibling-major para librerías, <code>apt-get install --simulate</code> para riesgo de cascade-remove) y después instalada con <code>apt-get install -y</code>.",
     "componentsTitle": "components_status.json (parte del rootfs)",
diff --git a/web/messages/es/docs/backup-restore/index.json b/web/messages/es/docs/backup-restore/index.json
index 7625af0c..dc1c3451 100644
--- a/web/messages/es/docs/backup-restore/index.json
+++ b/web/messages/es/docs/backup-restore/index.json
@@ -1,20 +1,20 @@
 {
   "meta": {
-    "title": "ProxMenux Backup & Restore — Descripción general | Copia y restauración completa del host Proxmox VE",
-    "description": "ProxMenux Backup & Restore captura el estado completo de un host Proxmox — sistema de ficheros, manifiesto estructurado de configuración y paquetes/componentes instalados — y lo reproduce en el mismo host o en uno distinto. La copia y la restauración son autocontenidas: sin dependencias externas, y con soporte para restauraciones cross-kernel mediante un filtro direccional de subconjunto seguro y una hidratación kernel-agnóstica.",
+    "title": "ProxMenux Backup & Restore — Descripción general | Backup y restauración completa del host Proxmox VE",
+    "description": "ProxMenux Backup & Restore captura el estado completo de un host Proxmox — sistema de ficheros, manifiesto estructurado de configuración y paquetes/componentes instalados — y lo reproduce en el mismo host o en uno distinto. El backup y la restauración son autocontenidos: sin dependencias externas, y con soporte para restauraciones cross-kernel mediante un filtro direccional de subconjunto seguro y una hidratación kernel-agnóstica.",
     "ogTitle": "ProxMenux Backup & Restore — Descripción general",
-    "ogDescription": "Copia y restauración completa del host Proxmox VE con manifiesto estructurado, lista de paquetes y reinstaladores de componentes.",
+    "ogDescription": "Backup y restauración completa del host Proxmox VE con manifiesto estructurado, lista de paquetes y reinstaladores de componentes.",
     "twitterTitle": "ProxMenux Backup & Restore | ProxMenux",
-    "twitterDescription": "Copia y restauración completa del host Proxmox VE con manifiesto estructurado, lista de paquetes y reinstaladores de componentes."
+    "twitterDescription": "Backup y restauración completa del host Proxmox VE con manifiesto estructurado, lista de paquetes y reinstaladores de componentes."
   },
   "header": {
     "title": "Backup & Restore",
-    "description": "Copia y restauración a nivel de host para Proxmox VE. Captura el sistema de ficheros, la configuración y los componentes instalados en un único archivo y reproduce el host sobre la misma instalación de Proxmox o sobre una distinta, sin dependencias externas.",
+    "description": "Backup y restauración a nivel de host para Proxmox VE. Captura el sistema de ficheros, la configuración y los componentes instalados en un único archivo y reproduce el host sobre la misma instalación de Proxmox o sobre una distinta, sin dependencias externas.",
     "section": "Backup & Restore"
   },
   "intro": {
     "title": "Qué es, en un párrafo",
-    "body": "Una copia de ProxMenux captura el estado completo de un host Proxmox: <strong>el sistema de ficheros</strong> (directorios relevantes bajo <code>/etc</code>, <code>/root</code>, <code>/var/lib/pve-cluster</code>, más rutas personalizadas opcionales), <strong>un manifiesto estructurado</strong> (JSON con el hardware detectado, los parámetros del kernel, la topología de red, el estado de ZFS, los usuarios y las entradas de cron) y <strong>un inventario de aplicaciones</strong> (todos los paquetes marcados como instalados manualmente por APT, más la lista de componentes instalados por ProxMenux con sus versiones exactas). Cualquiera de los tres destinos soportados — archivo local, Proxmox Backup Server (recomendado) o Borg — recibe el mismo contenido autocontenido, y cualquiera de ellos puede hidratar el host de destino sin depender de que el origen esté accesible en el momento de la restauración."
+    "body": "Un backup de ProxMenux captura el estado completo de un host Proxmox: <strong>el sistema de ficheros</strong> (directorios relevantes bajo <code>/etc</code>, <code>/root</code>, <code>/var/lib/pve-cluster</code>, más rutas personalizadas opcionales), <strong>un manifiesto estructurado</strong> (JSON con el hardware detectado, los parámetros del kernel, la topología de red, el estado de ZFS, los usuarios y las entradas de cron) y <strong>un inventario de aplicaciones</strong> (todos los paquetes marcados como instalados manualmente por APT, más la lista de componentes instalados por ProxMenux con sus versiones exactas). Cualquiera de los tres destinos soportados — archivo local, Proxmox Backup Server (recomendado) o Borg — recibe el mismo contenido autocontenido, y cualquiera de ellos puede hidratar el host de destino sin depender de que el origen esté accesible en el momento de la restauración."
   },
   "video": {
     "heading": "Vídeo demostración",
@@ -24,17 +24,17 @@
   },
   "whatItIsNot": {
     "heading": "Qué no es",
-    "intro": "La sección cubre copia y restauración <strong>a nivel de host</strong>: la instalación de Proxmox en sí, no las cargas de trabajo que se ejecutan sobre ella.",
+    "intro": "La sección cubre backup y restauración <strong>a nivel de host</strong>: la instalación de Proxmox en sí, no las cargas de trabajo que se ejecutan sobre ella.",
     "items": [
-      "<strong>No es una herramienta de copia de VMs/CTs.</strong> Los discos de los invitados y su estado de RAM no se capturan en esta función; para eso está <code>vzdump</code>. Los <strong>ficheros de configuración</strong> de los invitados (<code>/etc/pve/nodes/&lt;node&gt;/qemu-server/*.conf</code> y <code>lxc/*.conf</code>) <strong>sí</strong> se capturan, de modo que tras la restauración el inventario de invitados reaparece y sus discos pueden re-adjuntarse desde una copia existente de PBS o local.",
+      "<strong>No es una herramienta de backup de VMs/CTs.</strong> Los discos de los invitados y su estado de RAM no se capturan en esta función; para eso está <code>vzdump</code>. Los <strong>ficheros de configuración</strong> de los invitados (<code>/etc/pve/nodes/&lt;node&gt;/qemu-server/*.conf</code> y <code>lxc/*.conf</code>) <strong>sí</strong> se capturan, de modo que tras la restauración el inventario de invitados reaparece y sus discos pueden re-adjuntarse desde un backup existente de PBS o local.",
       "<strong>No es una operación a nivel de clúster.</strong> Cada nodo se copia a sí mismo. La pertenencia al clúster se captura como parte de <code>/etc/pve</code> para que un nodo restaurado pueda re-incorporarse al clúster, pero restaurar un clúster completo requiere coordinación por nodo.",
       "<strong>No es una imagen completa del disco.</strong> Los binarios del kernel, el initramfs y la partición de arranque no se capturan. En la restauración, ProxMenux utiliza los artefactos de arranque propios del host de destino (regenerados automáticamente por <code>update-initramfs</code> y la herramienta de bootloader) e instala los controladores adecuados contra el kernel que el destino tenga en ejecución."
     ]
   },
   "threePillars": {
-    "heading": "Los tres pilares de una copia",
+    "heading": "Los tres pilares de un backup",
     "intro": "Un archivo de ProxMenux se estructura en torno a tres cargas útiles autocontenidas. La restauración utiliza las tres en conjunto para reproducir el host de origen sobre un destino que puede no tener siquiera el mismo kernel instalado.",
-    "diagramCaption": "Cada copia contiene los mismos tres bloques con independencia del destino. La restauración los consume todos: rootfs para colocar los ficheros, manifiesto para detectar drift y diferencias cross-kernel, e inventario de aplicaciones para reinstalar paquetes y componentes contra el kernel del propio destino.",
+    "diagramCaption": "Cada backup contiene los mismos tres bloques con independencia del destino. La restauración los consume todos: rootfs para colocar los ficheros, manifiesto para detectar drift y diferencias cross-kernel, e inventario de aplicaciones para reinstalar paquetes y componentes contra el kernel del propio destino.",
     "pillar1Label": "Sistema de ficheros",
     "pillar1Detail": "rootfs/\n(rsync de /etc,\n/etc/systemd/network,\n/root, más snapshot\nsqlite3 de\n/var/lib/pve-cluster,\n+ rutas opcionales)",
     "pillar2Label": "Manifiesto",
@@ -44,11 +44,11 @@
   },
   "restoreIsUniversal": {
     "heading": "La restauración reproduce el host de origen, no el archivo",
-    "body": "Restaurar una copia de seguridad no consiste solamente en extraer el sistema de ficheros. El flujo de restauración lee el manifiesto para detectar diferencias entre origen y destino (variaciones de hardware, renombrado de NICs, versión de kernel, identidad de la pool ZFS), reproduce el sistema de ficheros y lanza el instalador correspondiente a cada servicio que estuviera instalado en el origen (controlador NVIDIA, Coral TPU, herramientas AMD GPU, herramientas Intel GPU). Cada instalador se ejecuta contra el <strong>kernel actual del destino</strong>, por lo que el host restaurado no depende de que el kernel del origen esté presente. Cuando el kernel del destino es más reciente que el de la copia, una pasada de <strong>hidratación</strong> kernel-agnóstica funde la configuración propia del usuario (tokens IOMMU, IDs de dispositivos VFIO, quirks personalizadas, claves de GRUB) sobre la configuración de arranque fresca del destino, sin copiar verbatim los ficheros ligados al kernel."
+    "body": "Restaurar un backup no consiste solamente en extraer el sistema de ficheros. El flujo de restauración lee el manifiesto para detectar diferencias entre origen y destino (variaciones de hardware, renombrado de NICs, versión de kernel, identidad de la pool ZFS), reproduce el sistema de ficheros y lanza el instalador correspondiente a cada servicio que estuviera instalado en el origen (controlador NVIDIA, Coral TPU, herramientas AMD GPU, herramientas Intel GPU). Cada instalador se ejecuta contra el <strong>kernel actual del destino</strong>, por lo que el host restaurado no depende de que el kernel del origen esté presente. Cuando el kernel del destino es más reciente que el del backup, una pasada de <strong>hidratación</strong> kernel-agnóstica funde la configuración propia del usuario (tokens IOMMU, IDs de dispositivos VFIO, quirks personalizadas, claves de GRUB) sobre la configuración de arranque fresca del destino, sin copiar verbatim los ficheros ligados al kernel."
   },
   "twoInterfaces": {
     "heading": "Dos interfaces, un único backend",
-    "intro": "Cada paso del flujo de copia y restauración está disponible desde dos puntos de entrada. Ambos invocan la misma librería de shell, producen archivos idénticos y leen el mismo registro de trabajos.",
+    "intro": "Cada paso del flujo de backup y restauración está disponible desde dos puntos de entrada. Ambos invocan la misma librería de shell, producen archivos idénticos y leen el mismo registro de trabajos.",
     "cliLabel": "ProxMenux Scripts (TUI)",
     "cliDetail": "menu → Utilities →\nHost Backup / Restore\n\nFlujo basado en diálogos,\namigable por SSH, admite\nejecución desatendida\ndesde scripts.",
     "webLabel": "ProxMenux Monitor (Web UI)",
@@ -56,7 +56,7 @@
   },
   "whereNext": {
     "heading": "A dónde seguir desde aquí",
-    "intro": "Cada subsección posterior desarrolla en detalle un aspecto del flujo. Se recomienda empezar por <em>Cómo funciona</em> para entender qué contiene el archivo y por qué. Consultar <em>Destinos</em> para configurar el destino de la copia. Leer <em>Restauración</em> y <em>Restauración cross-kernel</em> para el lado de recuperación.",
+    "intro": "Cada subsección posterior desarrolla en detalle un aspecto del flujo. Se recomienda empezar por <em>Cómo funciona</em> para entender qué contiene el archivo y por qué. Consultar <em>Destinos</em> para configurar el destino del backup. Leer <em>Restauración</em> y <em>Restauración cross-kernel</em> para el lado de recuperación.",
     "items": [
       {
         "label": "Cómo funciona",
@@ -69,9 +69,9 @@
         "tail": " — comparativa entre archivo local, Proxmox Backup Server (recomendado) y Borg, y cómo configurar cada uno."
       },
       {
-        "label": "Crear copias",
+        "label": "Crear backups",
         "href": "/docs/backup-restore/creating-backups",
-        "tail": " — copias puntuales, perfil de rutas por defecto, adición de rutas personalizadas, cifrado en PBS."
+        "tail": " — backups puntuales, perfil de rutas por defecto, adición de rutas personalizadas, cifrado en PBS."
       },
       {
         "label": "Trabajos programados",
@@ -86,7 +86,7 @@
       {
         "label": "Restauración cross-kernel",
         "href": "/docs/backup-restore/cross-kernel",
-        "tail": " — comportamiento direccional cuando el kernel del destino difiere del de la copia, el filtro de subconjunto seguro y las cuatro fases de hidratación."
+        "tail": " — comportamiento direccional cuando el kernel del destino difiere del del backup, el filtro de subconjunto seguro y las cuatro fases de hidratación."
       }
     ]
   }
diff --git a/web/messages/es/docs/backup-restore/restoring.json b/web/messages/es/docs/backup-restore/restoring.json
index 44689048..5f3ea69c 100644
--- a/web/messages/es/docs/backup-restore/restoring.json
+++ b/web/messages/es/docs/backup-restore/restoring.json
@@ -1,32 +1,32 @@
 {
   "meta": {
-    "title": "Restaurar una copia — flujos Completo y Personalizado | ProxMenux",
-    "description": "El flujo completo de restauración. Documenta las tres acciones disponibles sobre cualquier copia (ver, descargar, restaurar), la comprobación de compatibilidad y sus resultados, los modos Completo y Personalizado, la clasificación de rutas que decide qué se aplica en vivo y qué espera al siguiente arranque, el dispatcher de arranque y la pasada de reinstalación post-arranque de componentes.",
+    "title": "Restaurar un backup — flujos Completo y Personalizado | ProxMenux",
+    "description": "El flujo completo de restauración. Documenta las tres acciones disponibles sobre cualquier backup (ver, descargar, restaurar), la comprobación de compatibilidad y sus resultados, los modos Completo y Personalizado, la clasificación de rutas que decide qué se aplica en vivo y qué espera al siguiente arranque, el dispatcher de arranque y la pasada de reinstalación post-arranque de componentes.",
     "ogTitle": "ProxMenux Backup — restaurar",
     "ogDescription": "Flujos de restauración completo y personalizado con la comprobación de compatibilidad, la clasificación de rutas, el dispatcher post-arranque y la reinstalación de componentes.",
-    "twitterTitle": "Restaurar una copia | ProxMenux",
-    "twitterDescription": "Cómo se convierte una copia de host de ProxMenux en un host Proxmox operativo."
+    "twitterTitle": "Restaurar un backup | ProxMenux",
+    "twitterDescription": "Cómo se convierte un backup de host de ProxMenux en un host Proxmox operativo."
   },
   "header": {
-    "title": "Restaurar una copia",
-    "description": "El flujo completo de restauración: desde elegir una copia hasta un host operativo. Documenta la comprobación de compatibilidad, los dos modos de restauración, el dispatcher post-arranque, la pasada de reinstalación de componentes, y los mecanismos que hacen predecibles las restauraciones cross-host y cross-kernel.",
+    "title": "Restaurar un backup",
+    "description": "El flujo completo de restauración: desde elegir un backup hasta un host operativo. Documenta la comprobación de compatibilidad, los dos modos de restauración, el dispatcher post-arranque, la pasada de reinstalación de componentes, y los mecanismos que hacen predecibles las restauraciones cross-host y cross-kernel.",
     "section": "Backup & Restore"
   },
   "intro": {
     "title": "La restauración reproduce el origen, no sólo los ficheros",
-    "body": "Restaurar una copia de ProxMenux no es una extracción. Los ficheros son sólo el primer paso: una vez colocado el sistema de ficheros, la restauración lee el manifiesto para detectar diferencias entre origen y destino, filtra rutas que romperían el arranque del destino, hidrata configuración propia del usuario que no puede copiarse verbatim, y — tras el reinicio obligatorio — reinstala cada componente que tuviera el origen (controlador NVIDIA, Coral TPU, herramientas GPU) contra el kernel actual del destino. Lo que el usuario elige del menú es una única copia; lo que realmente sucede involucra a la comprobación de compatibilidad, la clasificación de rutas, el dispatcher post-arranque y la pasada de reinstalación trabajando juntos para producir un host que se comporta como el origen."
+    "body": "Restaurar un backup de ProxMenux requiere más que extraer archivos. Antes de aplicar cambios, se consulta el manifiesto para detectar diferencias entre origen y destino, se filtran rutas que podrían impedir el arranque y se adapta la configuración del usuario que no puede copiarse literalmente. Tras el reinicio necesario, se intenta reinstalar los componentes compatibles registrados (controlador NVIDIA, Coral TPU y herramientas GPU) para el kernel que ejecuta el destino. Un único backup dirige la comprobación de compatibilidad, la clasificación de rutas y los procesos de arranque y posteriores. Revisa los resultados de cada componente y los logs para confirmar el resultado."
   },
   "threeActions": {
-    "heading": "Tres acciones sobre una copia",
-    "intro": "Seleccionar una copia de la lista abre un menú con tres acciones.",
+    "heading": "Tres acciones sobre un backup",
+    "intro": "Seleccionar un backup de la lista abre un menú con tres acciones.",
     "actionRows": [
       {
         "action": "Ver",
-        "detail": "Abre una vista de sólo lectura del archivo: contenido de manifest.json (hostname de origen, versión de PVE, kernel, hardware, componentes instalados), la lista de rutas dentro de <code>rootfs/</code>, y un diff de qué cambiaría en el host actual si se aplicara la copia."
+        "detail": "Abre una vista de sólo lectura del archivo: contenido de manifest.json (hostname de origen, versión de PVE, kernel, hardware, componentes instalados), la lista de rutas dentro de <code>rootfs/</code>, y un diff de qué cambiaría en el host actual si se aplicara el backup."
       },
       {
         "action": "Descargar",
-        "detail": "Exporta el archivo como un fichero portable <code>.tar.zst</code> (tar comprimido con zstd). Se puede extraer en cualquier sistema Linux con <code>tar --zstd -xf FICHERO.tar.zst</code>, o desde macOS/Windows con herramientas que soporten zstd (7-Zip, PeaZip, Keka…). El árbol extraído contiene <code>manifest.json</code>, <code>metadata/</code> y <code>rootfs/</code>, exactamente el mismo layout que consume la restauración. Es útil para inspección offline o para restaurar en un host que no tiene acceso al destino original (PBS, Borg)."
+        "detail": "Exporta el archivo como un fichero portable <code>.tar.zst</code> (tar comprimido con zstd). Se puede extraer en cualquier sistema Linux con <code>tar --zstd -xf FILE.tar.zst</code>, o desde macOS/Windows con herramientas que soporten zstd (7-Zip, PeaZip, Keka…). El árbol extraído contiene <code>manifest.json</code>, <code>metadata/</code> y <code>rootfs/</code>, exactamente el mismo layout que consume la restauración. Es útil para inspección offline o para restaurar en un host que no tiene acceso al destino original (PBS, Borg)."
       },
       {
         "action": "Restaurar",
@@ -40,7 +40,7 @@
     "outputRows": [
       {
         "output": "Flag de dirección",
-        "detail": "<code>HB_COMPAT_KERNEL_DIRECTION</code> — uno de <code>same</code>, <code>bk_newer</code> o <code>bk_older</code>. Compara la versión mayor del kernel de la copia contra la del destino. Dirige el filtro cross-kernel de subconjunto seguro (sólo dispara en <code>bk_older</code>) y la pasada de hidratación documentada en la página cross-kernel."
+        "detail": "<code>HB_COMPAT_KERNEL_DIRECTION</code> — uno de <code>same</code>, <code>bk_newer</code> o <code>bk_older</code>. Compara la versión mayor del kernel del backup contra la del destino. Dirige el filtro cross-kernel de subconjunto seguro (sólo dispara en <code>bk_older</code>) y la pasada de hidratación documentada en la página cross-kernel."
       },
       {
         "output": "Lista de rutas a saltar",
@@ -52,7 +52,7 @@
       },
       {
         "output": "Plan de rollback",
-        "detail": "Lo calcula <code>compute_rollback_plan.sh</code>. Lista las VMs, LXCs y componentes presentes en el destino pero no en la copia. El usuario puede optar durante el diálogo de confirmación por eliminarlos como parte de la restauración, de modo que el destino termine casando exactamente con la copia."
+        "detail": "Lo calcula <code>compute_rollback_plan.sh</code>. Lista las VMs, LXCs y componentes presentes en el destino pero ausentes del backup. La confirmación permite optar por eliminar los invitados adicionales antes del reinicio. Los componentes deben desinstalarse manualmente y la eliminación de invitados puede fallar; no garantiza que el destino coincida exactamente con el backup."
       }
     ],
     "reportBody": "La comprobación también emite un informe estructurado (<code>HB_COMPAT_RESULTS</code>) categorizado como PASS / INFO / WARN / FAIL. Las entradas WARN y FAIL aparecen en el panel previo a la restauración; la restauración se niega a continuar sólo cuando hay un FAIL que el usuario no puede resolver pulsando Continuar."
@@ -77,15 +77,15 @@
     "rows": [
       {
         "class": "hot",
-        "detail": "Rutas que se aplican <strong>de inmediato</strong> sobre el sistema en ejecución. El servicio que las consume detecta el cambio por sí mismo o al siguiente reload, sin necesidad de reiniciar. Son la mayoría del contenido de una copia: <code>/etc/ssh</code>, <code>/etc/apt</code>, <code>/etc/cron.*</code>, <code>/root</code>, <code>/usr/local/bin</code>, ficheros de configuración de servicios generales, etc."
+        "detail": "Rutas que se aplican <strong>de inmediato</strong> sobre el sistema en ejecución. El servicio que las consume detecta el cambio por sí mismo o al siguiente reload, sin necesidad de reiniciar. Son la mayoría del contenido de un backup: <code>/etc/ssh</code>, <code>/etc/apt</code>, <code>/etc/cron.*</code>, <code>/root</code>, <code>/usr/local/bin</code>, ficheros de configuración de servicios generales, etc."
       },
       {
         "class": "reboot",
-        "detail": "Rutas que se aplican <strong>de inmediato</strong> también, pero cuyo efecto real sólo se manifiesta en el <strong>siguiente arranque</strong>: el kernel sólo lee <code>/etc/default/grub</code> al iniciar el bootloader, <code>/etc/fstab</code> al montar los filesystems, <code>/etc/modules</code> al cargar módulos, etc. El fichero está en su sitio nada más aplicarse, pero el sistema tiene que reiniciar para consumirlo. Ejemplos: <code>/etc/default/grub</code>, <code>/etc/kernel</code>, <code>/etc/modules</code>, <code>/etc/fstab</code>, <code>/etc/zfs</code>, <code>/etc/initramfs-tools</code>."
+        "detail": "Rutas que este flujo difiere al <strong>siguiente arranque</strong> en lugar de aplicar <strong>de inmediato</strong>. Afectan a la configuración de arranque: la generación del bootloader lee <code>/etc/default/grub</code>, los montajes usan <code>/etc/fstab</code> y la carga de módulos usa <code>/etc/modules</code>. Los archivos pendientes se aplican tras reiniciar y después se regeneran los artefactos de arranque necesarios. Ejemplos: <code>/etc/default/grub</code>, <code>/etc/kernel</code>, <code>/etc/modules</code>, <code>/etc/fstab</code>, <code>/etc/zfs</code>, <code>/etc/modprobe.d</code>."
       },
       {
         "class": "dangerous",
-        "detail": "Rutas que <strong>NO se aplican en el sistema en ejecución</strong> — la escritura viva podría corromper estado o cortar la conexión activa. Estas rutas se preparan en el conjunto pendiente y las escribe el dispatcher post-arranque después del reinicio, cuando el clúster está arriba pero antes de que el sistema esté completamente en uso. Ejemplos: <code>/etc/pve</code> (pmxcfs es un FUSE vivo; escribir directo en él lo saltea), <code>/var/lib/pve-cluster</code> (datos vivos del clúster), <code>/etc/network</code> (podría reconfigurar la misma interfaz por la que el usuario está conectado por SSH y cortar la sesión)."
+        "detail": "Rutas que <strong>NO se aplican en el sistema en ejecución</strong>: escribirlas en caliente podría corromper el estado o cortar la conexión activa. Se preparan en el conjunto pendiente: <code>/etc/network</code> se escribe al principio del siguiente arranque, antes de que se levante la red, y <code>/etc/pve</code> lo escribe el dispatcher post-arranque cuando el sistema de archivos del clúster ya está activo. Ejemplos: <code>/etc/pve</code> (pmxcfs es un montaje FUSE con la configuración activa del clúster), <code>/var/lib/pve-cluster</code> (datos vivos del clúster; se guardan en el directorio de recuperación solo para recuperarlos a mano), <code>/etc/network</code> (podría reconfigurar la misma interfaz por la que el usuario está conectado por SSH y cortar la sesión)."
       }
     ]
   },
@@ -131,7 +131,7 @@
       },
       {
         "task": "Reinstalación de componentes",
-        "detail": "Lee el <code>components_status.json</code> restaurado e itera sobre los instaladores registrados (nvidia_driver, coral_driver, amdgpu_top, intel_gpu_tools). Cada instalador corre en modo <code>--auto-reinstall</code>, lee su versión previamente registrada del state file, y recompila contra el kernel actual del destino. El flujo interactivo no hace esto — reinstalar drivers contra un kernel que aún no ha arrancado carece de sentido."
+        "detail": "Lee el <code>components_status.json</code> restaurado y recorre los instaladores compatibles registrados (nvidia_driver, coral_driver, amdgpu_top e intel_gpu_tools). Cada uno se ejecuta en modo <code>--auto-reinstall</code>, lee su estado guardado y reinstala para el entorno del destino, recompilando módulos cuando corresponde. Se difiere hasta después del reinicio para utilizar el kernel que ejecute entonces el destino. Los fallos individuales se registran y no detienen el siguiente componente."
       },
       {
         "task": "Comprobación de sanidad del arranque",
@@ -145,7 +145,7 @@
   },
   "liveProgress": {
     "heading": "Progreso en vivo en la pestaña Backups del Monitor",
-    "body": "Tras el reboot, la pestaña Backups del Monitor de ProxMenux muestra una tarjeta de progreso en vivo que refleja el estado de <code>apply_cluster_postboot.service</code> a medida que avanza. La tarjeta lee <code>/var/lib/proxmenux/restore-state.json</code>, que el dispatcher actualiza en cada hito (aplicar configuración del cluster, reconstruir initramfs, actualizar bootloader, reinstalación por componente, verificación de arranque, finalización).",
+    "body": "Tras el reboot, la pestaña Backups del Monitor de ProxMenux muestra una tarjeta de progreso en vivo que refleja el estado de <code>proxmenux-apply-cluster-postboot.service</code> a medida que avanza. La tarjeta lee <code>/var/lib/proxmenux/restore-state.json</code>, que el dispatcher actualiza en cada hito (aplicar configuración del cluster, reconstruir initramfs, actualizar bootloader, reinstalación por componente, verificación de arranque, finalización).",
     "fields": [
       {
         "name": "Insignia de estado",
@@ -184,9 +184,9 @@
   },
   "postbootExample": {
     "heading": "Cómo se ve el post-boot en la consola",
-    "body": "En la consola física del host la ejecución exitosa del dispatcher termina con una línea <code>[ OK ] Finished proxmenux-apply-cluster-postboot.service</code>. Cuando esa línea aparece — normalmente acompañada de los <code>OK</code> del <code>multi-user.target</code> y del <code>graphical.target</code> — la restauración ha terminado por completo: componentes reinstalados, boot artifacts regenerados, cluster reconciliado.",
+    "body": "En la consola física del host, una ejecución del dispatcher que termina correctamente muestra <code>[ OK ] Finished proxmenux-apply-cluster-postboot.service</code>, a menudo junto a los <code>OK</code> de <code>multi-user.target</code> y <code>graphical.target</code>. Esto señala el final del proceso. Puede haber fallos individuales o avisos de arranque registrados; comprueba los estados de componentes y los logs del Monitor antes de dar el host por totalmente restaurado.",
     "imageAlt": "Consola física de Proxmox mostrando el mensaje '[ OK ] Finished proxmenux-apply-cluster-postboot.service - ProxMenux Apply Cluster Configs (post-boot).' seguido del OK de multi-user.target y graphical.target, con el prompt de login del host encima.",
-    "imageCaption": "Consola física tras un post-boot exitoso. La línea 'Finished proxmenux-apply-cluster-postboot.service' es la señal de que el flujo de restauración ha terminado por completo — el mismo evento que la notificación 'Host restore finished' expone en el Monitor."
+    "imageCaption": "Consola física al terminar el proceso. 'Finished proxmenux-apply-cluster-postboot.service' señala su finalización, que también comunica 'Host restore finished' en el Monitor. Hay que revisar los resultados de componentes y los avisos."
   },
   "tenMinutes": {
     "heading": "Por qué importan los últimos diez minutos",
@@ -228,11 +228,11 @@
         "detail": "Barata. El usuario se entera de que la ejecución ha terminado en el momento en que dispara la notificación."
       }
     ],
-    "outroBody": "La ventana importa porque el usuario puede hacer login durante este tiempo y ver herramientas ausentes (<code>nvidia-smi</code> no encontrado, <code>coral</code> no detectado). Es esperado — la reinstalación sigue corriendo en background. La notificación de finalización señala cuando todo está listo."
+    "outroBody": "Durante este intervalo puede que falten herramientas al iniciar sesión (<code>nvidia-smi</code> no encontrado, <code>coral</code> no detectado) porque la reinstalación sigue en segundo plano. La notificación marca el final del proceso; revisa los resultados de componentes, avisos y logs para distinguir los éxitos de los fallos individuales."
   },
   "destructiveRollback": {
     "heading": "El rollback destructivo opcional",
-    "body": "Una restauración es aditiva por defecto: si el destino tiene VMs, LXCs o componentes que no están en la copia, sobreviven. Esto preserva el trabajo pero puede dejar entradas hostpci obsoletas, componentes huérfanos o VMs que el usuario ya no quiere. Cuando se detecta drift entre destino y copia, el diálogo de confirmación ofrece un segundo yes/no: <em>¿Ejecutar rollback destructivo?</em>. Aceptar dispara <code>_rs_execute_rollback</code>, que elimina las VMs, LXCs y componentes que existen en el destino pero no en la copia. El rollback corre ANTES del reinicio para que la maquinaria de pending-restore vea un estado limpio. Es opt-in — el default es No, y el usuario ve exactamente qué se eliminaría listado por nombre (VMID y CTID) antes de decidir."
+    "body": "La restauración es aditiva por defecto: se conservan las VMs, LXCs y componentes adicionales del destino. Si hay diferencias, la confirmación ofrece <em>¿Ejecutar el rollback destructivo?</em>, con No por defecto. Aceptar llama a <code>_rs_execute_rollback</code> antes del reinicio para intentar eliminar las VMs y LXCs adicionales indicados. Los componentes se señalan para desinstalación manual porque la automática no está implementada. Los fallos al eliminar invitados se registran y el proceso continúa; no se garantiza una coincidencia exacta con el backup. Revisa nombres y VMID/CTID antes de elegir esta opción destructiva."
   },
   "logs": {
     "heading": "Dónde viven los logs",
@@ -265,7 +265,7 @@
       {
         "label": "Restauración cross-kernel",
         "href": "/docs/backup-restore/cross-kernel",
-        "tail": " — el filtro direccional de subconjunto seguro y la pasada de hidratación que se invocan cuando el kernel del destino difiere del de la copia."
+        "tail": " — el filtro direccional de subconjunto seguro y la pasada de hidratación que se invocan cuando el kernel del destino difiere del del backup."
       },
       {
         "label": "Cómo funciona",
diff --git a/web/messages/es/docs/backup-restore/scheduled-jobs.json b/web/messages/es/docs/backup-restore/scheduled-jobs.json
index d38ef39e..692d60dc 100644
--- a/web/messages/es/docs/backup-restore/scheduled-jobs.json
+++ b/web/messages/es/docs/backup-restore/scheduled-jobs.json
@@ -1,15 +1,15 @@
 {
   "meta": {
     "title": "Trabajos programados — timers, modo adjunto, retención | ProxMenux",
-    "description": "Trabajos de copia de host programados en ProxMenux. Dos modos de creación (timer systemd propio o adjuntarse a un trabajo vzdump de PVE existente), valores de retención aplicados por trabajo vía proxmox-backup-client/borg/local prune, layout de almacenamiento bajo /var/lib/proxmenux/backup-jobs, y el script runner que produce archivos idénticos al flujo interactivo.",
+    "description": "Trabajos de backup de host programados en ProxMenux. Dos modos de creación (timer systemd propio o adjuntarse a un trabajo vzdump de PVE existente), valores de retención aplicados por trabajo vía proxmox-backup-client/borg/local prune, layout de almacenamiento bajo /var/lib/proxmenux/backup-jobs, y el script runner que produce archivos idénticos al flujo interactivo.",
     "ogTitle": "ProxMenux Backup — trabajos programados",
-    "ogDescription": "Copias de host desatendidas programadas con modo adjunto, retención, y los mismos tres destinos que el flujo interactivo.",
+    "ogDescription": "Backups de host desatendidos programados con modo adjunto, retención, y los mismos tres destinos que el flujo interactivo.",
     "twitterTitle": "Trabajos programados | ProxMenux",
-    "twitterDescription": "Trabajos de copia de host desatendidos con modo adjunto y retención."
+    "twitterDescription": "Trabajos de backup de host desatendidos con modo adjunto y retención."
   },
   "header": {
     "title": "Trabajos programados",
-    "description": "Trabajos de copia de host desatendidos. Dos modelos de creación: un trabajo nuevo e independiente con su propio horario, o un trabajo adjuntado a una tarea vzdump de PVE existente que hereda el horario y la retención de esa tarea. Ambos producen archivos idénticos al flujo interactivo.",
+    "description": "Trabajos de backup de host desatendidos. Dos modelos de creación: un trabajo nuevo e independiente con su propio horario, o un trabajo adjuntado a una tarea vzdump de PVE existente que hereda el horario y la retención de esa tarea. Ambos producen archivos idénticos al flujo interactivo.",
     "section": "Backup & Restore"
   },
   "intro": {
@@ -22,11 +22,11 @@
   },
   "attachBadge": {
     "title": "Modo adjunto — recomendado cuando ya existe una tarea vzdump de PVE",
-    "body": "Cuando ya hay una tarea de copia vzdump de PVE configurada para las VMs y los LXCs de este nodo, adjuntar la copia de host a esa tarea garantiza que la configuración del host se captura en la <strong>misma ventana</strong> que los invitados. En la restauración, las configuraciones de los invitados vienen de la copia de host (viven bajo <code>/etc/pve</code>), y los discos de los invitados vienen de la copia vzdump tomada al mismo tiempo — ambos conjuntos son consistentes entre sí, por lo que una recuperación completa del nodo puede reproducir el host y re-adjuntar cada invitado sin drift de versiones."
+    "body": "Si ya existe una tarea vzdump de PVE para las VM y los LXC de este nodo, adjuntar el backup del host hace que se ejecute después del backup de los invitados, en el <strong>mismo ciclo de backup</strong>. Al restaurar, las configuraciones de los invitados proceden del backup del host (bajo <code>/etc/pve</code>) y sus discos de los backups vzdump de ese ciclo. Esto facilita coordinar la recuperación de todo el nodo, pero no es un snapshot atómico: los cambios durante el ciclo pueden dejar diferencias entre la configuración del host y el estado de los discos de los invitados."
   },
   "frequencyBadge": {
     "title": "Frecuencia recomendada",
-    "body": "Para garantizar la máxima compatibilidad entre la copia y su posterior restauración se recomienda hacer copias de seguridad del host con frecuencia. Cuanto más reciente sea la copia respecto al estado actual del host, menor será la desviación de configuración, paquetes y componentes que la restauración tendrá que reconciliar."
+    "body": "Para garantizar la máxima compatibilidad entre el backup y su posterior restauración se recomienda hacer backups del host con frecuencia. Cuanto más reciente sea el backup respecto al estado actual del host, menor será la desviación de configuración, paquetes y componentes que la restauración tendrá que reconciliar."
   },
   "modes": {
     "heading": "Los dos modos",
@@ -35,7 +35,7 @@
         "mode": "Nuevo trabajo programado",
         "backends": "Local, PBS, Borg",
         "schedule": "Expresión <code>OnCalendar</code> propia (sintaxis de calendario systemd — por ejemplo <code>daily</code>, <code>Mon..Fri 03:00</code>).",
-        "retention": "Se pregunta por separado: <code>keep-last</code>, <code>keep-hourly</code>, <code>keep-daily</code>, <code>keep-weekly</code>, <code>keep-monthly</code>, <code>keep-yearly</code>. La aplica el runner tras cada copia exitosa."
+        "retention": "Se pregunta por separado: <code>keep-last</code>, <code>keep-hourly</code>, <code>keep-daily</code>, <code>keep-weekly</code>, <code>keep-monthly</code>, <code>keep-yearly</code>. La aplica el runner tras cada backup exitoso."
       },
       {
         "mode": "Adjuntar a un trabajo vzdump de PVE",
@@ -47,7 +47,7 @@
   },
   "attachDetail": {
     "heading": "Cómo funciona el modo adjunto",
-    "intro": "PVE escribe las tareas <code>vzdump</code> en <code>/etc/pve/jobs.cfg</code> — una entrada por tarea, cada una apuntando a un storage donde caen los dumps de VMs y LXCs. El modo adjunto requiere que ese storage sea un backend que ProxMenux entienda (Local o PBS); cuando la tarea dispara, ProxMenux se ejecuta al mismo tiempo.",
+    "intro": "PVE guarda las tareas <code>vzdump</code> en <code>/etc/pve/jobs.cfg</code>: una sección por tarea, con el almacenamiento de los backups de VM y LXC. El modo adjunto requiere un backend compatible con ProxMenux (Local o PBS). El backup del host se ejecuta desde el hook job-end cuando termina la tarea de backup de los invitados.",
     "steps": [
       {
         "step": "1",
@@ -59,14 +59,14 @@
       },
       {
         "step": "3",
-        "detail": "<code>hb_install_vzdump_hook</code> registra un script-hook en <code>/etc/vzdump.conf</code>. Cuando PVE ejecuta cualquier tarea vzdump, el script-hook dispara; si el <code>$STOREID</code> que se le pasa coincide con el <code>PVE_STORAGE</code> de un trabajo adjuntado, el runner se invoca para ese trabajo."
+        "detail": "<code>hb_install_vzdump_hook</code> registra un hook en <code>/etc/vzdump.conf</code>. En la fase job-end de cualquier tarea vzdump, compara el <code>$STOREID</code> recibido con el <code>PVE_STORAGE</code> de cada trabajo adjunto habilitado y ejecuta el script correspondiente si coincide. La asociación se basa en el almacenamiento, no en el ID de la tarea padre seleccionada."
       },
       {
         "step": "4",
         "detail": "El archivo aterriza en el mismo storage donde los dumps de vzdump acaban de escribirse: <code>path/dump/</code> para Local, o el repositorio PBS configurado en la entrada de storage de PVE."
       }
     ],
-    "outroBody": "El modo adjunto tiene una implicación operativa: desactivar o eliminar la tarea padre de PVE también desactiva la copia de host — no hay timer propio al que recurrir. La entrada del trabajo permanece en disco para poder re-adjuntarla más tarde."
+    "outroBody": "El modo adjunto no tiene temporizador propio. Desactivar o eliminar la tarea padre seleccionada detiene ese disparador, pero otra tarea vzdump con el mismo almacenamiento aún puede activar el backup del host. Para impedirlo, desactiva o elimina el propio trabajo de ProxMenux. Al desactivarlo, su entrada sigue en disco para poder reactivarla o volver a adjuntarla."
   },
   "storageLayout": {
     "heading": "Ficheros que componen un trabajo",
@@ -94,9 +94,9 @@
     "heading": "Qué hace un trabajo cuando se dispara",
     "intro": "Cada trabajo — sea del modelo nuevo o adjunto — ejecuta la misma secuencia de tres pasos:",
     "steps": [
-      "<strong>Preparar la copia.</strong> Lee la configuración del trabajo (destino, perfil, rutas) y ensambla el árbol de la copia siguiendo exactamente el mismo procedimiento que el flujo interactivo. El resultado es el mismo archivo que produciría una copia manual con esos ajustes.",
-      "<strong>Escribir en el destino.</strong> Sube o escribe la copia al destino configurado — un archivo local <code>.tar.zst</code>, un backup PBS o un archivo Borg — usando exactamente las mismas herramientas y credenciales que utilizaría una copia manual al mismo destino.",
-      "<strong>Aplicar retención.</strong> Elimina las copias antiguas del destino conservando los valores <code>keep-last</code> / <code>keep-daily</code> / <code>keep-weekly</code> configurados en el trabajo. La poda la realiza el propio destino: PBS mantiene la cuenta en su lado, Borg ejecuta <code>borg prune</code>, y en Local ProxMenux borra los archivos que quedan fuera del <code>keep-last</code>."
+      "<strong>Preparar el backup.</strong> Lee la configuración del trabajo (destino, perfil, rutas) y ensambla el árbol del backup siguiendo exactamente el mismo procedimiento que el flujo interactivo. El resultado es el mismo archivo que produciría un backup manual con esos ajustes.",
+      "<strong>Escribir en el destino.</strong> Sube o escribe el backup al destino configurado — un archivo local <code>.tar.zst</code>, un backup PBS o un archivo Borg — usando exactamente las mismas herramientas y credenciales que utilizaría un backup manual al mismo destino.",
+      "<strong>Aplicar retención.</strong> Elimina los backups antiguos del destino conservando los valores <code>keep-last</code> / <code>keep-daily</code> / <code>keep-weekly</code> configurados en el trabajo. La poda la realiza el propio destino: PBS mantiene la cuenta en su lado, Borg ejecuta <code>borg prune</code>, y en Local ProxMenux borra los archivos que quedan fuera del <code>keep-last</code>."
     ]
   },
   "management": {
@@ -127,13 +127,13 @@
   },
   "notifications": {
     "heading": "Notificaciones",
-    "body": "Cada ejecución programada dispara los mismos eventos <code>hb_notify_lifecycle</code> que el flujo interactivo (<code>start</code>, <code>complete</code>, <code>fail</code>). Si hay canales de notificación configurados en el Monitor, los trabajos desatendidos exponen sus resultados igual que las copias manuales — un usuario no necesita revisar el log para saber si un trabajo tuvo éxito."
+    "body": "Cada ejecución programada dispara los mismos eventos <code>hb_notify_lifecycle</code> que el flujo interactivo (<code>start</code>, <code>complete</code>, <code>fail</code>). Si hay canales de notificación configurados en el Monitor, los trabajos desatendidos exponen sus resultados igual que los backups manuales — un usuario no necesita revisar el log para saber si un trabajo tuvo éxito."
   },
   "whereNext": {
     "heading": "A dónde seguir",
     "items": [
       {
-        "label": "Crear copias",
+        "label": "Crear backups",
         "href": "/docs/backup-restore/creating-backups",
         "tail": " — el flujo interactivo que comparte backend con el scheduler."
       },
diff --git a/web/messages/es/docs/create-vm/index.json b/web/messages/es/docs/create-vm/index.json
index 9a3b52a5..75d125da 100644
--- a/web/messages/es/docs/create-vm/index.json
+++ b/web/messages/es/docs/create-vm/index.json
@@ -1,12 +1,12 @@
 {
   "meta": {
     "title": "Crear VMs en Proxmox VE — asistentes Synology, Windows, Linux y NAS | ProxMenux",
-    "description": "Crea y configura máquinas virtuales en Proxmox VE con ProxMenux. Asistentes específicos para appliances NAS (Synology DSM, TrueNAS, OpenMediaVault, UnRAID, etc.), Windows, distribuciones Linux y un instalador externo de macOS. Valores por defecto sensatos de hardware, almacenamiento y red.",
+    "description": "Crea y configura máquinas virtuales en Proxmox VE con ProxMenux. Asistentes para sistemas NAS (Synology DSM, TrueNAS, OpenMediaVault, XigmaNAS, etc.), Windows, distribuciones Linux y un instalador externo de macOS. Valores predeterminados adecuados de hardware, almacenamiento y red.",
     "ogTitle": "Crear VMs en Proxmox VE — asistentes Synology, Windows, Linux y NAS",
-    "ogDescription": "Asistentes de ProxMenux para crear VMs Synology DSM, TrueNAS, OMV, UnRAID, Windows y Linux en Proxmox VE.",
+    "ogDescription": "Asistentes de ProxMenux para crear VM de Synology DSM, TrueNAS, OMV, XigmaNAS, Windows y Linux en Proxmox VE.",
     "ogImageAlt": "Menú Crear VM de ProxMenux",
     "twitterTitle": "Crear VMs en Proxmox VE | ProxMenux",
-    "twitterDescription": "Asistentes para VMs Synology, TrueNAS, OMV, UnRAID, Windows y Linux en Proxmox VE."
+    "twitterDescription": "Asistentes para VM Synology, TrueNAS, OMV, XigmaNAS, Windows y Linux en Proxmox VE."
   },
   "header": {
     "title": "Crear VM",
@@ -28,23 +28,23 @@
     "routes": [
       {
         "key": "nas",
-        "title": "System NAS",
+        "title": "Sistema NAS",
         "icon": "HardDrive",
         "href": "/docs/create-vm/system-nas",
         "accent": "border-emerald-300 bg-emerald-50",
         "iconBg": "bg-emerald-100 text-emerald-700",
-        "description": "Siete sistemas operativos NAS como VMs específicas. La mayoría usan el flujo auto-ISO; Synology DSM ejecuta el asistente especializado de loader.",
+        "description": "Ocho sistemas operativos NAS como VM específicas. La mayoría usan el flujo automático de ISO; Synology DSM tiene un asistente especializado de loader.",
         "bullets": [
-          "Synology DSM (loaders ARC / RR / TinyCore)",
+          "Synology DSM (loaders Arc / RR / Alpine RedPill M-shell)",
           "TrueNAS SCALE y CORE (ZFS)",
           "OpenMediaVault (basado en Debian)",
           "XigmaNAS (FreeBSD ZFS)",
-          "Rockstor (openSUSE / Btrfs), ZimaOS"
+          "Rockstor (openSUSE / Btrfs), ZimaOS, FygoOS"
         ]
       },
       {
         "key": "windows",
-        "title": "System Windows",
+        "title": "Sistema Windows",
         "icon": "MonitorCog",
         "href": "/docs/create-vm/system-windows",
         "accent": "border-blue-300 bg-blue-50",
@@ -60,15 +60,15 @@
       },
       {
         "key": "linux",
-        "title": "System Linux",
+        "title": "Sistema Linux",
         "icon": "Laptop",
         "href": "/docs/create-vm/system-linux",
         "accent": "border-amber-300 bg-amber-50",
         "iconBg": "bg-amber-100 text-amber-700",
         "description": "Catálogo curado de ISOs oficiales de Linux descargadas automáticamente desde el upstream, más un selector de ISO local para cualquier otra cosa.",
         "bullets": [
-          "Ubuntu (Desktop / Server, 20.04–25.10)",
-          "Debian (Desktop / Netinst, 11–13)",
+          "Ubuntu (Escritorio / Servidor, 20.04–25.10)",
+          "Debian (Escritorio / Netinst, 11–13)",
           "Fedora, Arch, Rocky, Mint, openSUSE",
           "Alpine, Kali, Manjaro",
           "Ruta de ISO local para imágenes personalizadas"
@@ -106,7 +106,7 @@
       },
       {
         "path": "vm/select_nas_iso.sh",
-        "role": "Selector de ISO / appliance para sistemas NAS (Synology, TrueNAS, OMV, Rockstor, ZimaOS)."
+        "role": "Selector de ISO / appliance para sistemas NAS (Synology, TrueNAS, OMV, Rockstor, XigmaNAS, ZimaOS, FygoOS)."
       },
       {
         "path": "vm/select_windows_iso.sh",
@@ -147,12 +147,12 @@
     "items": [
       {
         "href": "/docs/disk-manager",
-        "label": "Disk Manager",
+        "label": "Administrador de discos",
         "tail": " — adjunta discos físicos existentes o importa imágenes de disco en VMs."
       },
       {
         "href": "/docs/utils/UUp-Dump-ISO-Creator",
-        "label": "UUP Dump ISO Creator",
+        "label": "Creador de ISO UUP Dump",
         "tail": " — genera ISOs de instalación de Windows listas para usar como medio de arranque."
       },
       {
diff --git a/web/messages/es/docs/create-vm/synology.json b/web/messages/es/docs/create-vm/synology.json
index ec5fdab3..1274954e 100644
--- a/web/messages/es/docs/create-vm/synology.json
+++ b/web/messages/es/docs/create-vm/synology.json
@@ -16,7 +16,7 @@
         "extra": ""
       },
       {
-        "name": "TinyCore RedPill M-shell",
+        "name": "Alpine RedPill M-shell (proyecto TinyCore)",
         "url": "https://github.com/PeterSuh-Q3/tinycore-redpill",
         "extra": ""
       }
@@ -25,7 +25,7 @@
     "simplifiesIntro": "El script simplifica el proceso de creación de la VM ofreciendo las siguientes opciones:",
     "simplifies": [
       "Selección de configuración por defecto o avanzada",
-      "Configuración de CPU, RAM, BIOS y machine type",
+      "Configuración de CPU, RAM, BIOS y tipo de máquina",
       "Elección entre disco virtual o passthrough de disco físico"
     ]
   },
@@ -38,35 +38,35 @@
     "headerValue": "Valor por defecto",
     "defaultRows": [
       {
-        "param": "Machine Type",
+        "param": "Tipo de máquina",
         "value": "q35"
       },
       {
-        "param": "BIOS Type",
+        "param": "Tipo de BIOS",
         "value": "OVMF (UEFI)"
       },
       {
-        "param": "CPU Type",
+        "param": "Tipo de procesador",
         "value": "Host"
       },
       {
-        "param": "Core Count",
+        "param": "Número de núcleos",
         "value": "2"
       },
       {
-        "param": "RAM Size",
+        "param": "Tamaño de RAM",
         "value": "4096 MB"
       },
       {
-        "param": "Bridge",
+        "param": "Puente",
         "value": "vmbr0"
       },
       {
-        "param": "MAC Address",
+        "param": "Dirección MAC",
         "value": "Generada automáticamente"
       },
       {
-        "param": "Start VM on Completion",
+        "param": "Arrancar la VM al terminar",
         "value": "No"
       }
     ],
@@ -76,31 +76,31 @@
     "headerOptions": "Opciones",
     "advancedRows": [
       {
-        "param": "Machine Type",
+        "param": "Tipo de máquina",
         "options": "q35 o i440fx"
       },
       {
-        "param": "BIOS Type",
+        "param": "Tipo de BIOS",
         "options": "OVMF (UEFI) o SeaBIOS (Legacy)"
       },
       {
-        "param": "CPU Type",
+        "param": "Tipo de procesador",
         "options": "Host o KVM64"
       },
       {
-        "param": "Core Count",
+        "param": "Número de núcleos",
         "options": "Número de núcleos de CPU"
       },
       {
-        "param": "RAM Size",
+        "param": "Tamaño de RAM",
         "options": "Cantidad de memoria asignada a la VM"
       },
       {
-        "param": "Bridge",
+        "param": "Puente",
         "options": "Bridge de red para la conexión"
       },
       {
-        "param": "MAC Address",
+        "param": "Dirección MAC",
         "options": "MAC personalizada"
       },
       {
@@ -115,24 +115,24 @@
   },
   "diskSelection": {
     "heading": "Selección de disco",
-    "intro": "Una vez configurada la máquina, el script te permite elegir entre dos tipos de discos:",
+    "intro": "El plan de almacenamiento permite añadir discos virtuales, discos físicos y controladoras PCI o dispositivos NVMe. Las opciones de disco se explican a continuación.",
     "virtualHeading": "Disco virtual",
     "virtualItems": [
       "El script lista las opciones de almacenamiento disponibles en Proxmox",
       "El usuario selecciona el disco y el tamaño en GB",
-      "El disco virtual se asigna automáticamente a la VM. Si se configuran más discos, se añadirán como <strong>SATA</strong> (p. ej., sata0, sata1, etc.), hasta un máximo de 6 discos virtuales."
+      "Los discos virtuales se conectan como <strong>SATA</strong> (sata0, sata1, etc.). Los discos de datos virtuales y físicos comparten los seis puertos SATA numerados del 0 al 5; el loader usa un puerto IDE aparte."
     ],
     "physicalHeading": "Passthrough de disco físico",
     "physicalItems": [
       "El script detecta todos los discos físicos disponibles",
       "El usuario selecciona el disco o discos físicos que quiere usar.",
-      "El disco físico se asigna directamente a la VM mediante passthrough. Si se configuran más discos, se añadirán como <strong>SATA</strong> (p. ej., sata0, sata1, etc.), hasta un máximo de 6 discos físicos."
+      "Los discos físicos se conectan como dispositivos <strong>SATA</strong>. Comparten con los discos de datos virtuales los seis puertos SATA numerados del 0 al 5; no hay un cupo adicional de seis discos físicos."
     ]
   },
   "loaderInstall": {
     "heading": "Instalación del loader",
     "intro1": "El script descarga y extrae automáticamente el loader desde el repositorio del desarrollador. Si la descarga falla, el script mostrará un mensaje de error.",
-    "intro2Rich": "<strong>AuxXxilium Arc</strong>, <strong>RedPill RR</strong> y <strong>TinyCore RedPill M-shell</strong>. Descarga y extrae automáticamente.",
+    "intro2Rich": "<strong>AuxXxilium Arc</strong>, <strong>RedPill RR</strong> y <strong>Alpine RedPill M-shell</strong> se descargan y extraen automáticamente.",
     "customRich": "Para <strong>Custom Loader</strong>, el script busca archivos en <code>/var/lib/vz/template/iso</code>. Si encuentra varios, te pedirá que selecciones el archivo deseado.",
     "uploadIntro": "Puedes subir loaders personalizados desde las opciones de almacenamiento local:",
     "imageAlt": "Añadir Custom Loader",
@@ -143,14 +143,14 @@
     "intro": "Una vez descargado el loader, el script crea la VM con los siguientes comandos:",
     "items": [
       "<code>qm create</code> – Crea la máquina virtual con los parámetros configurados",
-      "<code>qm importdisk</code> – Importa el disco del loader de arranque a la VM. Para mayor compatibilidad el loader se importa como disco IDE",
+      "<code>qm importdisk</code> importa la imagen del loader al almacenamiento Proxmox. Después el script la conecta a la VM como ide0 para mejorar la compatibilidad.",
       "<code>qm set</code> – Asigna valores de configuración como CPU, RAM y almacenamiento",
-      "<code>qm set -boot</code> – Configura el orden de arranque"
+      "<code>qm set VMID --boot order=ide0</code> configura el loader como dispositivo de arranque. Sustituye VMID por el ID de la VM."
     ]
   },
   "stepGuide": {
     "heading": "Guía paso a paso de configuración del loader de arranque",
-    "intro": "Aunque todos los loaders comparten similitudes, cada uno tiene su propia estructura y métodos de configuración. Esta sección ofrece una guía básica que cubre los 6 pasos para configurar un loader de Synology DSM. Los pasos exactos pueden variar según el loader y los cambios introducidos por el desarrollador. Por eso, entender estos pasos básicos comunes es clave para construir y configurar correctamente el loader que elijas y conseguir que Synology DSM funcione bien.",
+    "intro": "Cada loader tiene sus propios menús y métodos de configuración. Los seis pasos siguientes explican el proceso común; sigue las indicaciones del loader actual cuando difieran. Las capturas de M-shell muestran una interfaz anterior de TinyCore, mientras que el script actual descarga Alpine RedPill M-shell.",
     "selectorHeading": "Selecciona tu tipo de loader:",
     "loaderButtons": {
       "arc": "Arc Loader",
@@ -168,13 +168,13 @@
           {
             "htmlBefore": "<strong>Interfaz web</strong>, Para acceder a la interfaz web, abre un navegador y entra en la IP que aparece en la salida de la consola de la VM. Por ejemplo, en nuestro caso: http://192.169.0.32.",
             "src": "https://macrimi.github.io/ProxMenux/vm/synology/arc/arc_1_0_1.png",
-            "alt": "Arc Loader Web Interface",
+            "alt": "Interfaz web de Arc Loader",
             "caption": "Interfaz web de Arc Loader"
           },
           {
             "htmlBefore": "<strong>Interfaz por terminal</strong>, Accede directamente desde la salida de la consola de la VM.",
             "src": "https://macrimi.github.io/ProxMenux/vm/synology/arc/arc_1_1_1.png",
-            "alt": "Arc Loader Terminal Interface",
+            "alt": "Interfaz por terminal de Arc Loader",
             "caption": "Interfaz por terminal de Arc Loader"
           }
         ],
@@ -182,13 +182,13 @@
           {
             "htmlBefore": "<strong>Interfaz web</strong>, Para acceder a la interfaz web, abre un navegador y entra en la IP que aparece en la salida de la consola de la VM, seguida del puerto <strong>7681</strong>. Por ejemplo, en nuestro caso: <code>http://192.169.0.33:7681</code>.",
             "src": "https://macrimi.github.io/ProxMenux/vm/synology/rr/rr_2_0_2.png",
-            "alt": "RR Command Example",
+            "alt": "Ejemplo de comando RR",
             "caption": "Interfaz web de RR Loader"
           },
           {
             "htmlBefore": "<strong>Interfaz por terminal</strong>, Accede directamente desde la salida de la consola de la VM tecleando <strong>menu.sh</strong> en pantalla",
             "src": "https://macrimi.github.io/ProxMenux/vm/synology/rr/rr_2_1_1.png",
-            "alt": "RR Loader Interface",
+            "alt": "Interfaz de RR Loader",
             "caption": "Interfaz por terminal de RR Loader"
           }
         ],
@@ -196,13 +196,13 @@
           {
             "htmlBefore": "<strong>Interfaz web</strong>, Para acceder a la interfaz web, abre un navegador y entra en la IP que aparece en la salida de la consola de la VM, seguida del puerto <strong>7681</strong>. Por ejemplo, en nuestro caso: <code>http://192.169.0.35:7681</code>.",
             "src": "https://macrimi.github.io/ProxMenux/vm/synology/tinycore/tinycore_3_0_1.png",
-            "alt": "TinyCore Loader Interface",
+            "alt": "Interfaz de TinyCore Loader",
             "caption": "Interfaz web de TinyCore Loader"
           },
           {
             "htmlBefore": "<strong>Interfaz por terminal</strong>, Accede directamente desde la salida de la consola de la VM. Vigila la pantalla, porque en algún momento puede pedirte que pulses una tecla para continuar o preguntarte si quieres cambiar el idioma.",
             "src": "https://macrimi.github.io/ProxMenux/vm/synology/tinycore/tinycore_3_1_1.png",
-            "alt": "TinyCore Loader Interface",
+            "alt": "Interfaz de TinyCore Loader",
             "caption": "Interfaz por terminal de TinyCore Loader"
           }
         ]
@@ -217,21 +217,21 @@
         "arc": [
           {
             "src": "https://macrimi.github.io/ProxMenux/vm/synology/arc/arc_1_2_1.png",
-            "alt": "Arc Model Selection",
+            "alt": "Selección de modelo en Arc",
             "caption": "Selección de modelo en Arc"
           }
         ],
         "rr": [
           {
             "src": "https://macrimi.github.io/ProxMenux/vm/synology/rr/rr_2_2_1.png",
-            "alt": "RR Model Selection",
+            "alt": "Selección de modelo en RR",
             "caption": "Selección de modelo en RR"
           }
         ],
         "tinycore": [
           {
             "src": "https://macrimi.github.io/ProxMenux/vm/synology/tinycore/tinycore_3_2_1.png",
-            "alt": "TinyCore Model Selection",
+            "alt": "Selección de modelo en TinyCore",
             "caption": "Selección de modelo en TinyCore"
           }
         ]
@@ -245,41 +245,41 @@
         "arc": [
           {
             "src": "https://macrimi.github.io/ProxMenux/vm/synology/arc/arc_1_3_1.png",
-            "alt": "Arc Version Selection - Step 1",
+            "alt": "Selección de versión en Arc - Paso 1",
             "caption": "Selección de versión en Arc - Paso 1"
           },
           {
             "src": "https://macrimi.github.io/ProxMenux/vm/synology/arc/arc_1_3_2.png",
-            "alt": "Arc Version Selection - Step 2",
+            "alt": "Selección de versión en Arc - Paso 2",
             "caption": "Selección de versión en Arc - Paso 2"
           }
         ],
         "rr": [
           {
             "src": "https://macrimi.github.io/ProxMenux/vm/synology/rr/rr_2_3_1.png",
-            "alt": "RR Version Selection - Step 1",
+            "alt": "Selección de versión en RR - Paso 1",
             "caption": "Selección de versión en RR - Paso 1"
           },
           {
             "src": "https://macrimi.github.io/ProxMenux/vm/synology/rr/rr_2_3_2.png",
-            "alt": "RR Version Selection - Step 2",
+            "alt": "Selección de versión en RR - Paso 2",
             "caption": "Selección de versión en RR - Paso 2"
           },
           {
             "src": "https://macrimi.github.io/ProxMenux/vm/synology/rr/rr_2_3_3.png",
-            "alt": "RR Version Selection - Step 3",
+            "alt": "Selección de versión en RR - Paso 3",
             "caption": "Selección de versión en RR - Paso 3"
           }
         ],
         "tinycore": [
           {
             "src": "https://macrimi.github.io/ProxMenux/vm/synology/tinycore/tinycore_3_3_1.png",
-            "alt": "TinyCore Version Selection - Step 1",
+            "alt": "Selección de versión en TinyCore - Paso 1",
             "caption": "Selección de versión en TinyCore - Paso 1"
           },
           {
             "src": "https://macrimi.github.io/ProxMenux/vm/synology/tinycore/tinycore_3_3_2.png",
-            "alt": "TinyCore Version Selection - Step 2",
+            "alt": "Selección de versión en TinyCore - Paso 2",
             "caption": "Selección de versión en TinyCore - Paso 2"
           }
         ]
@@ -294,18 +294,18 @@
           {
             "htmlBefore": "<strong>Arc</strong> te da la opción de configurar automáticamente o ajustar los parámetros manualmente. Si eliges configuración automática, el loader empezará a aplicar los ajustes necesarios y reiniciará automáticamente al completar el proceso.",
             "src": "https://macrimi.github.io/ProxMenux/vm/synology/arc/arc_1_4_1.png",
-            "alt": "Arc Auto Configuration",
+            "alt": "Configuración automática de Arc",
             "caption": "Configuración automática de Arc"
           },
           {
             "htmlBefore": "Si optamos por no usar el modo automático, entramos en el menú para configurar las distintas opciones necesarias del loader:",
             "src": "https://macrimi.github.io/ProxMenux/vm/synology/arc/arc_1_4_2.png",
-            "alt": "Arc Manual Configuration",
+            "alt": "Configuración manual de Arc",
             "caption": "Configuración manual de Arc"
           },
           {
             "src": "https://macrimi.github.io/ProxMenux/vm/synology/arc/arc_1_4_3.png",
-            "alt": "Arc SN/Mac Configuration",
+            "alt": "Configuración de SN/MAC en Arc",
             "caption": "Configuración de SN/MAC en Arc"
           },
           {
@@ -315,46 +315,46 @@
           },
           {
             "src": "https://macrimi.github.io/ProxMenux/vm/synology/arc/arc_1_4_5.png",
-            "alt": "Arc Addons Selection",
+            "alt": "Selección de addons en Arc",
             "caption": "Selección de addons en Arc"
           }
         ],
         "rr": [
           {
             "src": "https://macrimi.github.io/ProxMenux/vm/synology/rr/rr_2_4_1.png",
-            "alt": "RR Addon Step 1",
+            "alt": "RR Addon Paso 1",
             "caption": "RR Addon Paso 1"
           },
           {
             "src": "https://macrimi.github.io/ProxMenux/vm/synology/rr/rr_2_4_2.png",
-            "alt": "RR Addon Step 2",
+            "alt": "RR Addon Paso 2",
             "caption": "RR Addon Paso 2 - Pulsa para añadir addons"
           },
           {
             "src": "https://macrimi.github.io/ProxMenux/vm/synology/rr/rr_2_4_3.png",
-            "alt": "RR Addon Step 3",
+            "alt": "RR Addon Paso 3",
             "caption": "RR Addon Paso 3 - Selecciona el que quieras pulsando sobre él. Si quieres añadir más, repite el proceso de las imágenes 2.4.2 y 2.4.3"
           }
         ],
         "tinycore": [
           {
             "src": "https://macrimi.github.io/ProxMenux/vm/synology/tinycore/tinycore_3_4_1.png",
-            "alt": "TinyCore SN Configuration",
+            "alt": "Configuración de SN en TinyCore",
             "caption": "Configuración de SN en TinyCore"
           },
           {
             "src": "https://macrimi.github.io/ProxMenux/vm/synology/tinycore/tinycore_3_4_2.png",
-            "alt": "TinyCore Random Option",
+            "alt": "Opción aleatoria de TinyCore",
             "caption": "Opción Random de TinyCore - Se recomienda la opción aleatoria"
           },
           {
             "src": "https://macrimi.github.io/ProxMenux/vm/synology/tinycore/tinycore_3_4_3.png",
-            "alt": "TinyCore MAC Configuration",
+            "alt": "Configuración de MAC en TinyCore",
             "caption": "Configuración de MAC en TinyCore"
           },
           {
             "src": "https://macrimi.github.io/ProxMenux/vm/synology/tinycore/tinycore_3_4_4.png",
-            "alt": "TinyCore VM MAC",
+            "alt": "MAC de la VM en TinyCore",
             "caption": "MAC de la VM en TinyCore - Elige usar la MAC de tu VM o una aleatoria"
           }
         ]
@@ -368,22 +368,22 @@
         "arc": [
           {
             "src": "https://macrimi.github.io/ProxMenux/vm/synology/arc/arc_1_5_1.png",
-            "alt": "Arc Build Loader",
-            "caption": "Build Loader en Arc"
+            "alt": "Construcción del loader en Arc",
+            "caption": "Construcción del loader en Arc"
           }
         ],
         "rr": [
           {
             "src": "https://macrimi.github.io/ProxMenux/vm/synology/rr/rr_2_5_1.png",
-            "alt": "RR Build Loader",
-            "caption": "Build Loader en RR"
+            "alt": "Construcción del loader en RR",
+            "caption": "Construcción del loader en RR"
           }
         ],
         "tinycore": [
           {
             "src": "https://macrimi.github.io/ProxMenux/vm/synology/tinycore/tinycore_3_5_1.png",
-            "alt": "TinyCore Build Loader",
-            "caption": "Build Loader en TinyCore"
+            "alt": "Construcción del loader en TinyCore",
+            "caption": "Construcción del loader en TinyCore"
           }
         ]
       }
@@ -396,22 +396,22 @@
         "arc": [
           {
             "src": "https://macrimi.github.io/ProxMenux/vm/synology/arc/arc_1_6_1.png",
-            "alt": "Arc Boot Loader",
-            "caption": "Boot Loader en Arc"
+            "alt": "Arranque del loader en Arc",
+            "caption": "Arranque del loader en Arc"
           }
         ],
         "rr": [
           {
             "src": "https://macrimi.github.io/ProxMenux/vm/synology/rr/rr_2_6_1.png",
-            "alt": "RR Boot Loader",
-            "caption": "Boot Loader en RR"
+            "alt": "Arranque del loader en RR",
+            "caption": "Arranque del loader en RR"
           }
         ],
         "tinycore": [
           {
             "src": "https://macrimi.github.io/ProxMenux/vm/synology/tinycore/tinycore_3_6_1.png",
-            "alt": "TinyCore Boot Loader",
-            "caption": "Boot Loader en TinyCore"
+            "alt": "Arranque del loader en TinyCore",
+            "caption": "Arranque del loader en TinyCore"
           }
         ]
       }
@@ -421,10 +421,10 @@
     "heading": "Iniciar la instalación de DSM",
     "intro": "Una vez arrancado el loader, puedes encontrar tu dispositivo Synology usando:",
     "afterCode": "Sigue los pasos en pantalla para completar la instalación de DSM.",
-    "setupAlt": "DSM Setup",
+    "setupAlt": "Configuración de DSM",
     "setupCaption": "Pantalla de setup de DSM",
     "patience": "Ten paciencia – El proceso puede tardar unos minutos en completarse. El porcentaje de progreso se actualizará automáticamente conforme avance la instalación. Se iniciará una cuenta atrás cuando la instalación esté a punto de terminar.",
-    "finishAlt": "Installation Complete",
+    "finishAlt": "Instalación Completa",
     "finishCaption": "Instalación completada"
   },
   "tips": {
diff --git a/web/messages/es/docs/create-vm/system-linux.json b/web/messages/es/docs/create-vm/system-linux.json
index ab7e8693..8c0e7aa1 100644
--- a/web/messages/es/docs/create-vm/system-linux.json
+++ b/web/messages/es/docs/create-vm/system-linux.json
@@ -1,13 +1,13 @@
 {
   "meta": {
-    "title": "Crear VM: System Linux | ProxMenux Documentation",
+    "title": "Crear VM: sistema Linux | Documentación de ProxMenux",
     "description": "Crea máquinas virtuales Linux en Proxmox VE con ProxMenux. Cubre el catálogo curado de ISOs oficiales (Ubuntu, Debian, Fedora, Arch, Rocky, Mint, openSUSE, Alpine, Kali, Manjaro), el plan de almacenamiento unificado, el passthrough de GPU opcional y consejos post-instalación.",
-    "ogTitle": "Crear VM: System Linux | ProxMenux Documentation",
+    "ogTitle": "Crear VM: sistema Linux | Documentación de ProxMenux",
     "ogDescription": "Crea VMs Linux en Proxmox VE con ProxMenux. Catálogo curado de ISOs, plan de almacenamiento unificado, passthrough de GPU opcional y consejos post-instalación.",
     "ogImageAlt": "Menú de VM Linux de ProxMenux"
   },
   "header": {
-    "title": "Crear VM: System Linux",
+    "title": "Crear VM: sistema Linux",
     "description": "Crea una VM Linux en Proxmox VE. ProxMenux trae un catálogo curado de ISOs oficiales de Linux listas para descargar, más un selector de ISO local, y enruta todo a través del asistente de VM compartido, el plan de almacenamiento unificado y el asistente opcional de passthrough de GPU.",
     "section": "Máquinas virtuales"
   },
@@ -27,7 +27,7 @@
     "headerValue": "Valor por defecto",
     "defaultRows": [
       {
-        "param": "Machine type",
+        "param": "Tipo de máquina",
         "valueRich": "<code>q35</code>"
       },
       {
@@ -35,11 +35,11 @@
         "value": "OVMF (UEFI)"
       },
       {
-        "param": "CPU type",
+        "param": "Tipo de CPU",
         "value": "Host"
       },
       {
-        "param": "Cores",
+        "param": "Núcleos",
         "value": "2"
       },
       {
@@ -47,15 +47,15 @@
         "value": "4096 MB"
       },
       {
-        "param": "Bridge",
+        "param": "Puente",
         "valueRich": "<code>vmbr0</code>"
       },
       {
-        "param": "MAC address",
+        "param": "Dirección MAC",
         "value": "Generada automáticamente"
       },
       {
-        "param": "Start on completion",
+        "param": "Arrancar al terminar",
         "value": "No"
       }
     ],
@@ -64,7 +64,7 @@
     "headerOptions": "Opciones",
     "advancedRows": [
       {
-        "param": "Machine type",
+        "param": "Tipo de máquina",
         "optionsRich": "<code>q35</code> o <code>i440fx</code>"
       },
       {
@@ -72,11 +72,11 @@
         "options": "OVMF (UEFI) o SeaBIOS (Legacy)"
       },
       {
-        "param": "CPU type",
-        "options": "Host o KVM64"
+        "param": "Tipo de CPU",
+        "options": "Host, KVM64 y otros modelos de CPU de la lista"
       },
       {
-        "param": "Cores",
+        "param": "Núcleos",
         "options": "Número de núcleos de CPU"
       },
       {
@@ -84,11 +84,11 @@
         "options": "Memoria asignada a la VM"
       },
       {
-        "param": "Bridge",
+        "param": "Puente",
         "options": "Bridge de red"
       },
       {
-        "param": "MAC address",
+        "param": "Dirección MAC",
         "options": "MAC personalizada"
       },
       {
@@ -108,19 +108,19 @@
     "virtualDiskItems": [
       "Lista los volúmenes de almacenamiento Proxmox disponibles en el host.",
       "Eliges el almacenamiento destino y el tamaño en GB.",
-      "El disco se adjunta a la VM como SATA (<code>sata0</code>, <code>sata1</code>, … hasta 6)."
+      "El disco usa el bus elegido: SCSI (predeterminado), SATA, VirtIO o IDE. Los puertos SATA son <code>sata0</code>, <code>sata1</code>, …, seis puertos numerados del 0 al 5."
     ],
     "importDiskTitle": "b. Añadir disco importado",
     "importDiskItems": [
       "Detecta los discos físicos que es seguro importar (los discos del sistema y protegidos están ocultos).",
       "Seleccionas uno o varios discos mediante una checklist.",
-      "Los discos importados se adjuntan como SATA mediante <code>qm set</code>."
+      "Los discos importados usan el bus elegido y se conectan mediante <code>qm set</code>."
     ],
     "pciTitle": "c. Añadir controladora o NVMe (PCI passthrough)",
     "pciItems": [
       "Detecta HBAs SATA/SAS y dispositivos NVMe del host y te deja pasar una <em>controladora entera</em> a la VM. IOMMU debe estar habilitado; el script se ofrece a habilitarlo y reinicia si hace falta.",
       "Un paso de confirmación advierte del riesgo a nivel de controladora (la tarjeta completa, incluidos todos los discos que tenga, deja de estar en el host).",
-      "Los dispositivos PCI seleccionados se adjuntan mediante <code>qm set hostpciN: …</code>."
+      "Los dispositivos PCI se conectan con comandos como <code>qm set VMID --hostpci0 PCI_ADDRESS,pcie=1</code>. Sustituye VMID y PCI_ADDRESS por el ID de la VM y la dirección PCI y usa un índice hostpci libre para cada dispositivo."
     ],
     "resetTitle": "Resetear y terminar",
     "resetBody": "El menú también ofrece <strong>r</strong> (resetear la selección actual y empezar de nuevo) y <strong>d</strong> (terminar y continuar). No puedes terminar con un plan vacío."
@@ -135,7 +135,7 @@
     "efiBody": "Cuando se selecciona OVMF (UEFI), ProxMenux crea un disco EFI de 4 MB en el almacenamiento que elijas para que el firmware tenga dónde guardar sus variables.",
     "isoTitle": "Montaje de la ISO",
     "isoBody": "La ISO de instalación se adjunta a <code>ide2</code> como CD-ROM, lista para el primer arranque.",
-    "guestTitle": "QEMU Guest Agent",
+    "guestTitle": "QEMU Agente invitado",
     "guestBody": "El canal del guest agent se habilita en la configuración de la VM. Aún tienes que instalar el agente dentro del guest — mira los consejos más abajo."
   },
   "installOptions": {
@@ -182,7 +182,7 @@
       {
         "name": "Arch Linux",
         "variants": [
-          "latest"
+          "el último"
         ]
       },
       {
@@ -227,7 +227,7 @@
     "heading": "Qué hace el script de principio a fin",
     "items": [
       "Obtiene la ISO de Linux (descarga oficial o archivo local).",
-      "Aplica la configuración por defecto o avanzada de CPU / RAM / BIOS / machine type.",
+      "Aplica la configuración predeterminada o avanzada de CPU, RAM, BIOS y tipo de máquina.",
       "Abre el plan de almacenamiento y adjunta los discos virtuales, discos importados y dispositivos PCI seleccionados.",
       "Crea el disco EFI cuando se selecciona UEFI.",
       "Monta la ISO de Linux en <code>ide2</code>.",
@@ -241,23 +241,23 @@
   "postInstall": {
     "heading": "Consejos post-instalación",
     "guestAgentHeading": "Instala el QEMU Guest Agent dentro de la VM",
-    "guestAgentBody": "ProxMenux habilita el canal del guest agent en la configuración de la VM, pero el agente como tal tiene que instalarse dentro del guest. Permite el apagado controlado, el freeze del filesystem para snapshots consistentes y un reporte de memoria preciso en la UI de Proxmox.",
+    "guestAgentBody": "ProxMenux habilita el canal del agente invitado en la configuración de la VM, pero debes instalar el agente dentro del sistema invitado. Permite el apagado controlado y congelar los sistemas de archivos durante los backups para mejorar la coherencia de los datos.",
     "debian": "Debian / Ubuntu",
     "fedora": "Fedora / Rocky / RHEL",
     "arch": "Arch Linux",
     "opensuse": "openSUSE",
     "virtioHeading": "Soporte de VirtIO en Linux",
-    "virtioBody": "Los kernels modernos de Linux (2.6.25+) incluyen los drivers VirtIO de disco y red por defecto, así que puedes cambiar la interfaz del disco a <code>virtio</code> o <code>virtio-scsi</code> en el asistente avanzado y el adaptador de red a <code>virtio</code> sin ningún paso extra de drivers.",
+    "virtioBody": "Las distribuciones modernas de Linux suelen incluir controladores VirtIO de disco y red. Selecciona <code>virtio</code> para discos de bloques VirtIO o <code>scsi</code> con la controladora VirtIO SCSI configurada; el adaptador de red también usa <code>virtio</code>. Comprueba la compatibilidad en instaladores antiguos.",
     "virtioWarnTitle": "Distribuciones muy antiguas",
-    "virtioWarnBody": "Si vas a instalar algo anterior al kernel 2.6.25, puede que los módulos VirtIO no estén disponibles en el momento de la instalación. En ese caso mantén SATA / SCSI o proporciona un disco de drivers.",
+    "virtioWarnBody": "Los instaladores muy antiguos pueden carecer de los controladores VirtIO necesarios. En ese caso usa una controladora SATA / SCSI emulada o proporciona los controladores adecuados.",
     "trimHeading": "Habilita TRIM / discard en almacenamiento SSD",
     "trimBody": "Cuando la VM está sobre almacenamiento Proxmox respaldado por SSD y el disco se adjuntó con el flag <code>discard</code>, puedes propagar los comandos trim desde dentro del guest. Dos opciones:",
     "trimItems": [
-      "Ejecutar <code>fstrim -av</code> periódicamente (o habilitar la unit <code>fstrim.timer</code> en distribuciones systemd).",
-      "O montar los filesystems con la opción <code>discard</code> en <code>/etc/fstab</code>."
+      "Ejecuta <code>fstrim -av</code> periódicamente o habilita la unidad <code>fstrim.timer</code> en distribuciones con systemd.",
+      "O monta los sistemas de archivos con la opción <code>discard</code> en <code>/etc/fstab</code>."
     ],
-    "balloonHeading": "Memory ballooning",
-    "balloonBody": "El driver <code>virtio_balloon</code> viene con los kernels modernos de Linux. Proxmox lo usa para reclamar memoria no usada de la VM y mostrar utilización precisa en la UI — sin configuración del lado del guest."
+    "balloonHeading": "Asignación dinámica de memoria (ballooning)",
+    "balloonBody": "Los kernels modernos de Linux suelen incluir el controlador <code>virtio_balloon</code>. Con el dispositivo de ballooning habilitado, Proxmox puede recopilar estadísticas de memoria. La recuperación dinámica requiere además una memoria mínima inferior a la máxima configurada; con valores iguales la asignación permanece fija."
   },
   "related": {
     "heading": "Relacionado",
diff --git a/web/messages/es/docs/create-vm/system-nas/index.json b/web/messages/es/docs/create-vm/system-nas/index.json
index 6b7304ef..4677338e 100644
--- a/web/messages/es/docs/create-vm/system-nas/index.json
+++ b/web/messages/es/docs/create-vm/system-nas/index.json
@@ -1,8 +1,8 @@
 {
   "meta": {
-    "title": "Crear VM: System NAS | ProxMenux Documentation",
+    "title": "Crear VM: sistema NAS | Documentación de ProxMenux",
     "description": "Crea máquinas virtuales NAS en Proxmox VE con ProxMenux. Soporta Synology DSM (loader), TrueNAS SCALE / CORE, OpenMediaVault, XigmaNAS, Rockstor, ZimaOS y FygoOS. Umbrel OS está disponible vía community script.",
-    "ogTitle": "Crear VM: System NAS | ProxMenux Documentation",
+    "ogTitle": "Crear VM: sistema NAS | Documentación de ProxMenux",
     "ogDescription": "Crea máquinas virtuales NAS en Proxmox VE con ProxMenux. Soporta Synology DSM (loader), TrueNAS SCALE / CORE, OpenMediaVault, XigmaNAS, Rockstor, ZimaOS y FygoOS.",
     "ogImageAlt": "Menú System NAS de ProxMenux"
   },
@@ -13,7 +13,7 @@
   },
   "intro": {
     "title": "Cómo funciona el selector de NAS",
-    "body": "El selector de NAS detecta la última release estable de cada appliance (consultando su mirror upstream), descarga la ISO — o construye la VM a partir de una imagen pre-empaquetada — y luego cede el control al asistente genérico de VM de ProxMenux para CPU, RAM, disco y configuración de red."
+    "body": "En el flujo genérico de ISO, el selector NAS intenta detectar la última versión estable en el servidor del proyecto, usa una versión alternativa si hace falta, descarga la ISO y abre la configuración compartida de CPU, RAM, discos y red. Synology DSM y ZimaOS usan instaladores específicos."
   },
   "image": {
     "alt": "Selector System NAS de ProxMenux",
@@ -26,7 +26,7 @@
   },
   "labels": {
     "base": "Base",
-    "fileSystem": "Filesystem",
+    "fileSystem": "Sistema de archivos",
     "viewDetails": "Ver detalles"
   },
   "supported": {
@@ -36,14 +36,14 @@
         "name": "Synology DSM",
         "tagline": "DiskStation Manager con el loader ARC / RR. Requiere configurar el loader antes del primer arranque.",
         "icon": "HardDrive",
-        "base": "Linux (custom)",
+        "base": "Linux (personalizado)",
         "fileSystem": "Btrfs, ext4",
         "href": "/docs/create-vm/system-nas/synology",
         "flow": "loader"
       },
       {
         "name": "TrueNAS SCALE",
-        "tagline": "TrueNAS basado en Debian con apps Docker / Kubernetes y ZFS como filesystem principal.",
+        "tagline": "TrueNAS basado en Debian con apps Docker en las versiones actuales y ZFS como sistema de archivos principal. Las versiones antiguas de SCALE usaban Kubernetes.",
         "icon": "Database",
         "base": "Debian Linux",
         "fileSystem": "ZFS",
@@ -52,7 +52,7 @@
       },
       {
         "name": "TrueNAS CORE",
-        "tagline": "TrueNAS basado en FreeBSD. Almacenamiento ZFS de nivel empresarial con jails y plugins.",
+        "tagline": "TrueNAS basado en FreeBSD, centrado en almacenamiento ZFS. Las jails y los plugins de CORE 13.3 están obsoletos y carecen de soporte.",
         "icon": "Database",
         "base": "FreeBSD",
         "fileSystem": "ZFS",
@@ -90,7 +90,7 @@
         "name": "ZimaOS",
         "tagline": "SO NAS ligero centrado en multimedia, apps Docker y domótica. Usa su propio instalador.",
         "icon": "MonitorIcon",
-        "base": "Debian / CasaOS",
+        "base": "Buildroot (evolución de CasaOS)",
         "fileSystem": "ext4",
         "href": "/docs/create-vm/system-nas/system-nas-others#zimaos",
         "flow": "dedicated"
@@ -112,7 +112,7 @@
   },
   "zfsMem": {
     "title": "Regla rápida de memoria para ZFS",
-    "bodyRich": "Si eliges un NAS basado en ZFS (TrueNAS, XigmaNAS), asigna al menos <strong>8 GB de RAM</strong> a la VM — ZFS usa la memoria libre como caché ARC y el rendimiento se degrada notablemente por debajo de eso. Rockstor (Btrfs) y OMV (ext4) son mucho menos exigentes con la memoria."
+    "bodyRich": "Para TrueNAS, asigna al menos <strong>8 GB de RAM</strong> para el funcionamiento básico y más para cargas exigentes. ZFS usa RAM para la caché ARC, pero no existe un umbral universal de 8 GB para todo NAS ZFS. Comprueba los requisitos de la distribución y dimensiona según discos, servicios y apps; configuraciones ligeras de OMV o Rockstor pueden necesitar menos."
   },
   "related": {
     "heading": "Relacionado",
diff --git a/web/messages/es/docs/create-vm/system-nas/synology.json b/web/messages/es/docs/create-vm/system-nas/synology.json
index 71094821..a52d4a85 100644
--- a/web/messages/es/docs/create-vm/system-nas/synology.json
+++ b/web/messages/es/docs/create-vm/system-nas/synology.json
@@ -1,13 +1,13 @@
 {
   "meta": {
-    "title": "Crear VM: Synology DSM | ProxMenux Documentation",
-    "description": "Crea una máquina virtual Synology DSM en Proxmox VE. ProxMenux descarga el loader que elijas (Arc, RR, TinyCore M-shell o uno personalizado), lo importa como disco de arranque de la VM y prepara CPU, RAM y almacenamiento mediante el asistente por defecto o avanzado.",
-    "ogTitle": "Crear VM: Synology DSM | ProxMenux Documentation",
+    "title": "Crear VM: Synology DSM | Documentación de ProxMenux",
+    "description": "Crea una máquina virtual Synology DSM en Proxmox VE. ProxMenux descarga el loader elegido (Arc, RR, Alpine RedPill M-shell o una imagen propia), lo importa como disco de arranque de la VM y configura CPU, RAM y almacenamiento mediante el asistente predeterminado o avanzado.",
+    "ogTitle": "Crear VM: Synology DSM | Documentación de ProxMenux",
     "ogDescription": "Crea una máquina virtual Synology DSM en Proxmox VE con ProxMenux."
   },
   "header": {
     "title": "Crear VM: Synology DSM",
-    "description": "Crea una máquina virtual Synology DSM en Proxmox VE. ProxMenux descarga el loader que elijas (Arc, RR, TinyCore M-shell o uno personalizado), lo importa como disco de arranque de la VM y prepara CPU, RAM y almacenamiento mediante el asistente por defecto o avanzado.",
+    "description": "Crea una máquina virtual Synology DSM en Proxmox VE. ProxMenux descarga el loader elegido (Arc, RR, Alpine RedPill M-shell o una imagen propia), lo importa como disco de arranque de la VM y configura CPU, RAM y almacenamiento mediante el asistente predeterminado o avanzado.",
     "section": "Máquinas virtuales · NAS"
   },
   "loaderLabels": {
@@ -32,7 +32,7 @@
         "url": "https://github.com/RROrg/rr"
       },
       {
-        "name": "TinyCore RedPill M-shell",
+        "name": "Alpine RedPill M-shell (proyecto TinyCore)",
         "url": "https://github.com/PeterSuh-Q3/tinycore-redpill"
       }
     ],
@@ -46,7 +46,7 @@
     "headerValue": "Valor por defecto",
     "defaultRowsRich": [
       {
-        "param": "Machine type",
+        "param": "Tipo de máquina",
         "valueRich": "<code>q35</code>"
       },
       {
@@ -54,11 +54,11 @@
         "valueRich": "OVMF (UEFI)"
       },
       {
-        "param": "CPU type",
+        "param": "Tipo de CPU",
         "valueRich": "Host"
       },
       {
-        "param": "Cores",
+        "param": "Núcleos",
         "valueRich": "2"
       },
       {
@@ -66,15 +66,15 @@
         "valueRich": "4096 MB"
       },
       {
-        "param": "Bridge",
+        "param": "Puente",
         "valueRich": "<code>vmbr0</code>"
       },
       {
-        "param": "MAC address",
+        "param": "Dirección MAC",
         "valueRich": "Generada automáticamente"
       },
       {
-        "param": "Start on completion",
+        "param": "Arrancar al terminar",
         "valueRich": "No"
       }
     ],
@@ -83,7 +83,7 @@
     "headerOptions": "Opciones",
     "advancedRowsRich": [
       {
-        "param": "Machine type",
+        "param": "Tipo de máquina",
         "optionsRich": "<code>q35</code> o <code>i440fx</code>"
       },
       {
@@ -91,11 +91,11 @@
         "optionsRich": "OVMF (UEFI) o SeaBIOS (Legacy)"
       },
       {
-        "param": "CPU type",
+        "param": "Tipo de CPU",
         "optionsRich": "Host o KVM64"
       },
       {
-        "param": "Cores",
+        "param": "Núcleos",
         "optionsRich": "Número de núcleos de CPU"
       },
       {
@@ -103,11 +103,11 @@
         "optionsRich": "Memoria asignada a la VM"
       },
       {
-        "param": "Bridge",
+        "param": "Puente",
         "optionsRich": "Bridge de red"
       },
       {
-        "param": "MAC address",
+        "param": "Dirección MAC",
         "optionsRich": "MAC personalizada"
       },
       {
@@ -127,7 +127,7 @@
     "virtualItemsRich": [
       "Lista los volúmenes de almacenamiento Proxmox disponibles en el host.",
       "Eliges el almacenamiento destino y el tamaño en GB.",
-      "El disco se adjunta a la VM como SATA (<code>sata0</code>, <code>sata1</code>, … hasta 6)."
+      "El disco se conecta como SATA (<code>sata0</code>, <code>sata1</code>, …). Los discos de datos virtuales y físicos comparten los seis puertos SATA numerados del 0 al 5."
     ],
     "importHeading": "b. Añadir disco importado",
     "importItemsRich": [
@@ -139,7 +139,7 @@
     "pciItemsRich": [
       "Detecta HBAs SATA/SAS y dispositivos NVMe del host y te deja pasar una <em>controladora entera</em> a la VM. IOMMU debe estar habilitado; el script se ofrece a habilitarlo y reinicia si hace falta.",
       "Un paso de confirmación advierte del riesgo a nivel de controladora (la tarjeta completa, incluidos todos los discos que tenga, deja de estar en el host).",
-      "Los dispositivos PCI seleccionados se adjuntan mediante <code>qm set hostpciN: …</code>."
+      "Los dispositivos PCI se conectan con comandos como <code>qm set VMID --hostpci0 PCI_ADDRESS,pcie=1</code>. Sustituye VMID y PCI_ADDRESS por el ID de la VM y la dirección PCI y usa un índice hostpci libre para cada dispositivo."
     ],
     "resetCalloutTitle": "Resetear y terminar",
     "resetCalloutBodyRich": "El menú también ofrece <strong>r</strong> (resetear la selección actual y empezar de nuevo) y <strong>d</strong> (terminar y continuar). No puedes terminar con un plan vacío — Synology necesita al menos un disco para instalar DSM."
@@ -150,7 +150,7 @@
   },
   "loaderInstall": {
     "heading": "Instalación del loader",
-    "intro1Rich": "<strong>Arc</strong>, <strong>RR</strong> y <strong>TinyCore M-shell</strong> se descargan y extraen automáticamente desde sus repositorios upstream de GitHub. Si la descarga falla, el script aborta con un mensaje claro.",
+    "intro1Rich": "<strong>Arc</strong>, <strong>RR</strong> y <strong>Alpine RedPill M-shell</strong> se descargan y extraen automáticamente desde sus repositorios originales de GitHub. Si la descarga falla, el script se detiene con un mensaje claro.",
     "intro2Rich": "Para la opción <strong>Custom Loader</strong>, el script escanea <code>/var/lib/vz/template/iso</code>. Si hay más de un candidato te pedirá que elijas el que quieres.",
     "uploadIntro": "Puedes subir loaders personalizados desde el almacenamiento local de Proxmox:",
     "imageAlt": "Añadir custom loader",
@@ -160,18 +160,18 @@
     "heading": "Creación de la VM — qué ejecuta el script",
     "introRich": "Una vez confirmas el loader, ProxMenux ejecuta el equivalente a estos comandos <code>qm</code>:",
     "itemsRich": [
-      "<code>qm create</code> — crea la VM con la CPU, RAM, BIOS y machine type seleccionados.",
-      "<code>qm importdisk</code> — importa el loader como disco <strong>IDE</strong> (máxima compatibilidad).",
-      "<code>qm set sataN: …</code> — adjunta los discos virtuales y discos importados del plan de almacenamiento, más la interfaz de red.",
-      "<code>qm set hostpciN: …</code> — adjunta cualquier dispositivo controladora / NVMe seleccionado para PCI passthrough.",
-      "<code>qm set --boot</code> — pone el loader como primer dispositivo de arranque."
+      "<code>qm create</code> — crea la VM con la CPU, RAM, BIOS y tipo de máquina elegidos.",
+      "<code>qm importdisk</code> importa la imagen del loader al almacenamiento Proxmox. Después el script la conecta a la VM como disco <strong>IDE</strong> en ide0 para mejorar la compatibilidad.",
+      "<code>qm set VMID --sata0 DISK_REFERENCE</code> conecta un disco de datos del plan. Sustituye VMID y DISK_REFERENCE por el ID de la VM y la referencia del disco; usa un índice SATA libre del 0 al 5. La red se configura mediante qm create.",
+      "<code>qm set VMID --hostpci0 PCI_ADDRESS,pcie=1</code> conecta una controladora PCI o un dispositivo NVMe seleccionado. Sustituye VMID y PCI_ADDRESS por el ID de la VM y la dirección PCI y usa un índice hostpci libre para cada dispositivo.",
+      "<code>qm set VMID --boot order=ide0</code> configura el loader como dispositivo de arranque. Sustituye VMID por el ID de la VM."
     ]
   },
   "stepByStep": {
     "heading": "Configuración del loader paso a paso",
-    "intro": "Todos los loaders siguen el mismo patrón general — arrancar la VM, elegir un modelo, elegir una versión de DSM, elegir add-ons, construir, arrancar — pero las pantallas y los menús difieren. La guía siguiente recorre los seis pasos comunes con capturas de cada loader. Las opciones exactas pueden cambiar con nuevas releases del loader.",
+    "intro": "Los seis pasos comunes son: arrancar la VM, elegir modelo, versión de DSM y complementos, construir y arrancar. Los menús y las opciones varían según la versión. Las capturas de M-shell muestran una interfaz anterior de TinyCore; el script actual descarga Alpine RedPill M-shell, por lo que debes seguir sus indicaciones actuales.",
     "warnCalloutTitle": "Los loaders no los mantiene ProxMenux",
-    "warnCalloutBody": "Arc, RR y TinyCore son proyectos de la comunidad con su propia cadencia de release. Si un paso se ve distinto a las capturas de abajo, lo más probable es que el loader se haya actualizado — consulta la documentación del propio loader (enlaces al final de esta página)."
+    "warnCalloutBody": "Arc, RR y Alpine RedPill M-shell son proyectos de la comunidad con su propia cadencia de release. Si un paso se ve distinto a las capturas de abajo, lo más probable es que el loader se haya actualizado — consulta la documentación del propio loader (enlaces al final de esta página)."
   },
   "stepBadge": "Paso",
   "step1": {
@@ -310,32 +310,32 @@
     "title": "Construye el loader",
     "introRich": "Con el modelo, la versión de DSM y los addons elegidos, selecciona <strong>Build the Loader</strong>. Esto puede tardar unos minutos según el loader y las opciones elegidas.",
     "arc": {
-      "alt": "Build loader en Arc",
-      "caption": "Arc — build loader"
+      "alt": "Construcción del loader en Arc",
+      "caption": "Construcción del loader en Arc"
     },
     "rr": {
-      "alt": "Build loader en RR",
-      "caption": "RR — build loader"
+      "alt": "Construcción del loader en RR",
+      "caption": "Construcción del loader en RR"
     },
     "tinycore": {
-      "alt": "Build loader en TinyCore",
-      "caption": "TinyCore — build loader"
+      "alt": "Construcción del loader en TinyCore",
+      "caption": "Construcción del loader en TinyCore"
     }
   },
   "step6": {
     "title": "Arranca el loader",
     "intro": "Una vez construido el loader, la VM reinicia con la configuración que has creado y empieza la instalación de DSM.",
     "arc": {
-      "alt": "Boot loader en Arc",
-      "caption": "Arc — boot loader"
+      "alt": "Arranque del loader en Arc",
+      "caption": "Arranque del loader en Arc"
     },
     "rr": {
-      "alt": "Boot loader en RR",
-      "caption": "RR — boot loader"
+      "alt": "Arranque del loader en RR",
+      "caption": "Arranque del loader en RR"
     },
     "tinycore": {
-      "alt": "Boot loader en TinyCore",
-      "caption": "TinyCore — boot loader"
+      "alt": "Arranque del loader en TinyCore",
+      "caption": "Arranque del loader en TinyCore"
     }
   },
   "dsmInstall": {
@@ -377,12 +377,12 @@
     "itemsRich": [
       {
         "href": "/docs/create-vm/system-nas",
-        "label": "Resumen de System NAS",
+        "label": "Resumen de sistemas NAS",
         "tail": " — comparativa entre Synology y TrueNAS / OMV / Rockstor / XigmaNAS."
       },
       {
         "href": "/docs/create-vm/system-nas/system-nas-others",
-        "label": "Otros System NAS",
+        "label": "Otros sistemas NAS",
         "tail": " — distribuciones NAS no-Synology."
       },
       {
diff --git a/web/messages/es/docs/create-vm/system-nas/system-nas-others.json b/web/messages/es/docs/create-vm/system-nas/system-nas-others.json
index 90b0ce32..ab8b3ae6 100644
--- a/web/messages/es/docs/create-vm/system-nas/system-nas-others.json
+++ b/web/messages/es/docs/create-vm/system-nas/system-nas-others.json
@@ -1,8 +1,8 @@
 {
   "meta": {
-    "title": "Crear VM: Otros sistemas NAS | ProxMenux Documentation",
+    "title": "Crear VM: otros sistemas NAS | Documentación de ProxMenux",
     "description": "Crea máquinas virtuales de TrueNAS SCALE, TrueNAS CORE, OpenMediaVault, XigmaNAS, Rockstor, ZimaOS y FygoOS en Proxmox VE con ProxMenux. Cubre la configuración por defecto / avanzada, el nuevo plan de almacenamiento, el passthrough de GPU opcional y las specs recomendadas por sistema.",
-    "ogTitle": "Crear VM: Otros sistemas NAS | ProxMenux Documentation",
+    "ogTitle": "Crear VM: otros sistemas NAS | Documentación de ProxMenux",
     "ogDescription": "Crea VMs de TrueNAS SCALE / CORE, OpenMediaVault, XigmaNAS, Rockstor, ZimaOS y FygoOS en Proxmox VE con ProxMenux.",
     "ogImageAlt": "Selector NAS de ProxMenux"
   },
@@ -23,7 +23,7 @@
     "headerValue": "Valor por defecto",
     "defaultRowsRich": [
       {
-        "param": "Machine type",
+        "param": "Tipo de máquina",
         "valueRich": "<code>q35</code>"
       },
       {
@@ -31,11 +31,11 @@
         "valueRich": "OVMF (UEFI)<note> — SeaBIOS para OpenMediaVault</note>"
       },
       {
-        "param": "CPU type",
+        "param": "Tipo de CPU",
         "valueRich": "Host"
       },
       {
-        "param": "Cores",
+        "param": "Núcleos",
         "valueRich": "2"
       },
       {
@@ -43,15 +43,15 @@
         "valueRich": "8192 MB<note> — 4096 MB para ZimaOS</note>"
       },
       {
-        "param": "Bridge",
+        "param": "Puente",
         "valueRich": "<code>vmbr0</code>"
       },
       {
-        "param": "MAC address",
+        "param": "Dirección del MAC",
         "valueRich": "Generada automáticamente"
       },
       {
-        "param": "Start on completion",
+        "param": "Arrancar al terminar",
         "valueRich": "No"
       }
     ],
@@ -60,7 +60,7 @@
     "headerOptions": "Opciones",
     "advancedRowsRich": [
       {
-        "param": "Machine type",
+        "param": "Tipo de máquina",
         "optionsRich": "<code>q35</code> o <code>i440fx</code>"
       },
       {
@@ -68,11 +68,11 @@
         "optionsRich": "OVMF (UEFI) o SeaBIOS (Legacy)"
       },
       {
-        "param": "CPU type",
-        "optionsRich": "Host o KVM64"
+        "param": "Tipo de CPU",
+        "optionsRich": "Host, KVM64 y otros modelos de CPU de la lista (ZimaOS: Host o KVM64)"
       },
       {
-        "param": "Cores",
+        "param": "Núcleos",
         "optionsRich": "Número de núcleos de CPU"
       },
       {
@@ -80,11 +80,11 @@
         "optionsRich": "Memoria asignada a la VM"
       },
       {
-        "param": "Bridge",
+        "param": "Puente",
         "optionsRich": "Bridge de red"
       },
       {
-        "param": "MAC address",
+        "param": "Dirección del MAC",
         "optionsRich": "MAC personalizada"
       },
       {
@@ -97,7 +97,7 @@
       }
     ],
     "zfsCalloutTitle": "ZFS y RAM",
-    "zfsCalloutBody": "TrueNAS SCALE / CORE y XigmaNAS están basados en ZFS. ZFS usa la memoria libre como caché ARC, así que los 8 GB por defecto son un mínimo — súbela a 16 GB o más si tienes pensado guardar algo serio. OMV (ext4/XFS), Rockstor (Btrfs) y ZimaOS son mucho menos exigentes con la memoria."
+    "zfsCalloutBody": "TrueNAS SCALE / CORE y XigmaNAS usan ZFS, cuya caché ARC se beneficia de la RAM. TrueNAS necesita al menos 8 GB para uso básico; 16 GB o más pueden ayudar con servicios y apps exigentes. Dimensiona la VM según la distribución y la carga; 8 GB no es un mínimo universal de ZFS. Las configuraciones ligeras de OMV, Rockstor o ZimaOS pueden necesitar menos."
   },
   "storagePlan": {
     "heading": "Plan de almacenamiento",
@@ -106,19 +106,19 @@
     "virtualItemsRich": [
       "Lista los volúmenes de almacenamiento Proxmox disponibles en el host.",
       "Eliges el almacenamiento destino y el tamaño en GB.",
-      "El disco se adjunta a la VM como SATA (<code>sata0</code>, <code>sata1</code>, … hasta 6)."
+      "El disco usa el bus elegido: SCSI (predeterminado), SATA, VirtIO o IDE (ZimaOS: SCSI o SATA). Los puertos SATA son <code>sata0</code>, <code>sata1</code>, …, seis puertos numerados del 0 al 5."
     ],
     "importHeading": "b. Añadir disco importado",
     "importItemsRich": [
       "Detecta los discos físicos que es seguro importar (los discos del sistema y protegidos están ocultos).",
       "Seleccionas uno o varios discos mediante una checklist.",
-      "Los discos importados se adjuntan como SATA mediante <code>qm set</code>."
+      "Los discos importados usan el bus elegido y se conectan mediante <code>qm set</code>."
     ],
     "pciHeading": "c. Añadir controladora o NVMe (PCI passthrough)",
     "pciItemsRich": [
       "Detecta HBAs SATA/SAS y dispositivos NVMe del host y te deja pasar una <em>controladora entera</em> a la VM. IOMMU debe estar habilitado; el script se ofrece a habilitarlo y reinicia si hace falta.",
       "Un paso de confirmación advierte del riesgo a nivel de controladora (la tarjeta completa, incluidos todos los discos que tenga, deja de estar en el host).",
-      "Los dispositivos PCI seleccionados se adjuntan mediante <code>qm set hostpciN: …</code>."
+      "Los dispositivos PCI se conectan con comandos como <code>qm set VMID --hostpci0 PCI_ADDRESS,pcie=1</code>. Sustituye VMID y PCI_ADDRESS por el ID de la VM y la dirección PCI y usa un índice hostpci libre para cada dispositivo."
     ],
     "resetCalloutTitle": "Resetear y terminar",
     "resetCalloutBodyRich": "El menú también ofrece <strong>r</strong> (resetear la selección actual y empezar de nuevo) y <strong>d</strong> (terminar y continuar). No puedes terminar con un plan vacío."
@@ -133,7 +133,7 @@
     "efiBody": "Cuando se selecciona OVMF (UEFI), ProxMenux crea automáticamente un disco EFI de 4 MB en el almacenamiento que elijas, formateado para coincidir con el tipo de almacenamiento (raw para almacenamiento basado en directorio).",
     "isoTitle": "Montaje de la ISO",
     "isoBodyRich": "La ISO de instalación se descarga (si hace falta) y se adjunta a <code>ide2</code> como CD-ROM, lista para el primer arranque.",
-    "guestTitle": "QEMU Guest Agent",
+    "guestTitle": "QEMU Agente invitado",
     "guestBody": "El canal del guest agent se habilita en la configuración de la VM. Aún tienes que instalar el agente dentro del guest una vez el SO NAS esté arriba."
   },
   "endToEnd": {
@@ -163,7 +163,7 @@
       "icon": "Database",
       "officialName": "TrueNAS SCALE",
       "officialUrl": "https://www.truenas.com/truenas-scale/",
-      "description": "TrueNAS basado en Debian con apps Docker / Kubernetes, Linux KVM y ZFS como filesystem principal. El sucesor moderno de FreeNAS para quien quiere ZFS más un ecosistema de contenedores.",
+      "description": "TrueNAS basado en Debian con apps Docker en las versiones actuales, Linux KVM y ZFS como sistema de archivos principal. Las versiones antiguas de SCALE usaban Kubernetes. Combina almacenamiento ZFS y un ecosistema de contenedores.",
       "specs": [
         "Interfaz recomendada: SATA o SCSI (ambas soportan discard/trim)",
         "RAM mínima: 8 GB (16 GB+ recomendado para cargas reales)",
@@ -182,7 +182,7 @@
       "icon": "Database",
       "officialName": "TrueNAS CORE",
       "officialUrl": "https://www.truenas.com/truenas-core/",
-      "description": "TrueNAS basado en FreeBSD (el antiguo FreeNAS). Almacenamiento ZFS maduro con jails y plugins, pero sin Docker / Kubernetes. Se está descontinuando en favor de SCALE pero sigue ampliamente desplegado.",
+      "description": "TrueNAS basado en FreeBSD, antes FreeNAS, centrado en almacenamiento ZFS. Las jails, plugins y funciones de virtualización de CORE 13.3 están obsoletas y sin soporte; el desarrollo actual se centra en las ediciones Linux.",
       "specs": [
         "Interfaz recomendada: SATA",
         "RAM mínima: 8 GB (16 GB+ recomendado)",
@@ -254,7 +254,7 @@
       "icon": "MonitorIcon",
       "officialName": "zimaspace.com",
       "officialUrl": "https://www.zimaspace.com/zimaos",
-      "description": "SO ligero de NAS / home server construido sobre Debian, con foco en multimedia, apps Docker y domótica. ZimaOS usa un instalador dedicado de ProxMenux (vm/zimaos.sh) que descarga una imagen pre-construida, pero el perfil de la VM sigue el mismo flujo que los otros sistemas NAS.",
+      "description": "SO ligero para NAS y servidor doméstico construido con Buildroot, evolución de CasaOS, centrado en multimedia, apps Docker y domótica. ZimaOS usa un instalador específico de ProxMenux (vm/zimaos.sh) que descarga una imagen preparada y permite configurar CPU, RAM y almacenamiento.",
       "specs": [
         "Interfaz recomendada: SATA o VirtIO",
         "RAM por defecto: 4 GB (suficiente para multimedia / apps autoalojadas)",
diff --git a/web/messages/es/docs/create-vm/system-windows.json b/web/messages/es/docs/create-vm/system-windows.json
index da4fa582..6f1795ba 100644
--- a/web/messages/es/docs/create-vm/system-windows.json
+++ b/web/messages/es/docs/create-vm/system-windows.json
@@ -1,14 +1,14 @@
 {
   "meta": {
-    "title": "Crear VM: System Windows | ProxMenux Documentation",
+    "title": "Crear VM: sistema Windows | Documentación de ProxMenux",
     "description": "Crea y configura máquinas virtuales Windows en Proxmox VE con ProxMenux. Incluye rutas de ISO UUP Dump y ISO local, configuración por defecto / avanzada, plan de almacenamiento unificado, passthrough de GPU opcional, configuración de TPM 2.0 e instalación de drivers VirtIO.",
-    "ogTitle": "Crear VM: System Windows | ProxMenux Documentation",
+    "ogTitle": "Crear VM: sistema Windows | Documentación de ProxMenux",
     "ogDescription": "Crea VMs Windows en Proxmox VE con ProxMenux. UUP Dump o ISO local, plan de almacenamiento unificado, passthrough de GPU opcional, TPM 2.0 y drivers VirtIO.",
     "ogImageAlt": "Menú de VM Windows de ProxMenux"
   },
   "header": {
-    "title": "Crear VM: System Windows",
-    "description": "Crea una VM Windows en Proxmox VE. ProxMenux gestiona la selección de ISO (UUP Dump o local), la configuración de CPU / RAM / machine type, el plan de almacenamiento unificado, el passthrough de GPU opcional, la configuración de TPM 2.0 y la instalación de drivers VirtIO.",
+    "title": "Crear VM: sistema Windows",
+    "description": "Crea una VM Windows en Proxmox VE. ProxMenux gestiona la selección de ISO (UUP Dump o local), la configuración de CPU, RAM y tipo de máquina, el plan de almacenamiento común, el passthrough de GPU opcional, TPM 2.0 y la instalación de controladores VirtIO.",
     "section": "Máquinas virtuales"
   },
   "intro": {
@@ -27,7 +27,7 @@
     "headerValue": "Valor por defecto",
     "defaultRows": [
       {
-        "param": "Machine type",
+        "param": "Tipo de máquina",
         "valueRich": "<code>q35</code>"
       },
       {
@@ -35,11 +35,11 @@
         "value": "OVMF (UEFI)"
       },
       {
-        "param": "CPU type",
+        "param": "Tipo de CPU",
         "value": "Host"
       },
       {
-        "param": "Cores",
+        "param": "Núcleos",
         "value": "4"
       },
       {
@@ -47,11 +47,11 @@
         "value": "8192 MB"
       },
       {
-        "param": "Bridge",
+        "param": "Puente",
         "valueRich": "<code>vmbr0</code>"
       },
       {
-        "param": "MAC address",
+        "param": "Dirección MAC",
         "value": "Generada automáticamente"
       },
       {
@@ -59,7 +59,7 @@
         "value": "Habilitado (v2.0)"
       },
       {
-        "param": "Start on completion",
+        "param": "Arrancar al terminar",
         "value": "No"
       }
     ],
@@ -68,7 +68,7 @@
     "headerOptions": "Opciones",
     "advancedRows": [
       {
-        "param": "Machine type",
+        "param": "Tipo de máquina",
         "optionsRich": "<code>q35</code> o <code>i440fx</code>"
       },
       {
@@ -76,11 +76,11 @@
         "options": "OVMF (UEFI) o SeaBIOS (Legacy)"
       },
       {
-        "param": "CPU type",
-        "options": "Host o KVM64"
+        "param": "Tipo de CPU",
+        "options": "Host, KVM64 y otros modelos de CPU de la lista"
       },
       {
-        "param": "Cores",
+        "param": "Núcleos",
         "options": "Número de núcleos de CPU"
       },
       {
@@ -88,11 +88,11 @@
         "options": "Memoria asignada a la VM"
       },
       {
-        "param": "Bridge",
+        "param": "Puente",
         "options": "Bridge de red"
       },
       {
-        "param": "MAC address",
+        "param": "Dirección MAC",
         "options": "MAC personalizada"
       },
       {
@@ -105,11 +105,11 @@
       },
       {
         "param": "TPM",
-        "options": "Habilitar o deshabilitar TPM 2.0"
+        "options": "TPM 2.0 se añade automáticamente para Windows; este asistente no permite activarlo o desactivarlo."
       }
     ],
-    "tpmWarnTitle": "Windows 11 y Windows Server 2022 necesitan TPM",
-    "tpmWarnBody": "Windows 11 y Windows Server 2022 se niegan a instalarse sin un dispositivo TPM 2.0 adjunto a la VM. ProxMenux lo añade por defecto; deshabilítalo en Avanzado solo si sabes que la edición destino no lo requiere."
+    "tpmWarnTitle": "Los requisitos de TPM dependen de la edición de Windows",
+    "tpmWarnBody": "Windows 11 normalmente requiere TPM 2.0. Windows Server 2022 lo necesita para determinadas funciones de seguridad, no para todas las instalaciones. ProxMenux añade un TPM virtual para Windows; el asistente avanzado no permite activarlo o desactivarlo."
   },
   "storagePlan": {
     "heading": "Plan de almacenamiento",
@@ -118,19 +118,19 @@
     "virtualDiskItems": [
       "Lista los volúmenes de almacenamiento Proxmox disponibles en el host.",
       "Eliges el almacenamiento destino y el tamaño en GB.",
-      "El disco se adjunta a la VM como SATA (<code>sata0</code>, <code>sata1</code>, … hasta 6)."
+      "El disco usa el bus elegido: SCSI (predeterminado), SATA, VirtIO o IDE. Los puertos SATA son <code>sata0</code>, <code>sata1</code>, …, seis puertos numerados del 0 al 5."
     ],
     "importDiskTitle": "b. Añadir disco importado",
     "importDiskItems": [
       "Detecta los discos físicos que es seguro importar (los discos del sistema y protegidos están ocultos).",
       "Seleccionas uno o varios discos mediante una checklist.",
-      "Los discos importados se adjuntan como SATA mediante <code>qm set</code>."
+      "Los discos importados usan el bus elegido y se conectan mediante <code>qm set</code>."
     ],
     "pciTitle": "c. Añadir controladora o NVMe (PCI passthrough)",
     "pciItems": [
       "Detecta HBAs SATA/SAS y dispositivos NVMe del host y te deja pasar una <em>controladora entera</em> a la VM. IOMMU debe estar habilitado; el script se ofrece a habilitarlo y reinicia si hace falta.",
       "Un paso de confirmación advierte del riesgo a nivel de controladora (la tarjeta completa, incluidos todos los discos que tenga, deja de estar en el host).",
-      "Los dispositivos PCI seleccionados se adjuntan mediante <code>qm set hostpciN: …</code>."
+      "Los dispositivos PCI se conectan con comandos como <code>qm set VMID --hostpci0 PCI_ADDRESS,pcie=1</code>. Sustituye VMID y PCI_ADDRESS por el ID de la VM y la dirección PCI y usa un índice hostpci libre para cada dispositivo."
     ],
     "resetTitle": "Resetear y terminar",
     "resetBody": "El menú también ofrece <strong>r</strong> (resetear la selección actual y empezar de nuevo) y <strong>d</strong> (terminar y continuar). No puedes terminar con un plan vacío."
@@ -144,16 +144,16 @@
     "efiTitle": "Disco EFI",
     "efiBody": "Cuando se selecciona OVMF (UEFI), ProxMenux crea un disco EFI de 4 MB en el almacenamiento que elijas y lo adjunta a la VM para que el firmware UEFI tenga dónde guardar sus variables.",
     "tpmTitle": "TPM 2.0",
-    "tpmBody": "Se añade automáticamente un dispositivo TPM 2.0 virtual para que los instaladores de Windows 11 / Server 2022 pasen el chequeo de compatibilidad de hardware.",
+    "tpmBody": "ProxMenux añade un dispositivo TPM 2.0 virtual a las VM Windows. Cumple el requisito de TPM de Windows 11 y permite funciones de Windows Server que dependen de TPM.",
     "isoTitle": "Montaje de la ISO",
     "isoBody": "La ISO de instalación se adjunta a <code>ide2</code>. La ISO de drivers VirtIO se descarga (si hace falta) y se adjunta a <code>ide3</code>, lista para el paso <em>Load driver</em>.",
-    "guestTitle": "QEMU Guest Agent",
+    "guestTitle": "QEMU Agente invitado",
     "guestBody": "El canal del guest agent se habilita en la configuración de la VM. El agente como tal se instala dentro de Windows ejecutando <code>virtio-win-guest-tools.exe</code> después del setup."
   },
   "installOptions": {
     "heading": "Opciones de instalación de Windows",
     "intro": "ProxMenux ofrece dos métodos para obtener el medio de instalación de Windows:",
-    "uupTitle": "UUP Dump ISO Creator",
+    "uupTitle": "Creador de ISO UUP Dump",
     "uupLogoAlt": "Logo de UUP Dump",
     "uupBody": "El script <strong>UUP Dump ISO Creator</strong> es una utilidad de ProxMenux que construye una ISO de Windows al vuelo desde los servidores de Windows Update de Microsoft. Trae archivos de instalación oficiales y limpios (incluyendo builds Insider Preview).",
     "uupItems": [
@@ -173,7 +173,7 @@
     "heading": "Qué hace el script de principio a fin",
     "items": [
       "Obtiene la ISO de Windows (build de UUP Dump o copia local).",
-      "Aplica la configuración por defecto o avanzada de CPU / RAM / BIOS / machine type.",
+      "Aplica la configuración predeterminada o avanzada de CPU, RAM, BIOS y tipo de máquina.",
       "Abre el plan de almacenamiento y adjunta los discos virtuales, discos importados y dispositivos PCI seleccionados.",
       "Crea el disco EFI (instalaciones UEFI) y adjunta el dispositivo TPM 2.0.",
       "Monta la ISO de Windows en <code>ide2</code>.",
@@ -187,9 +187,9 @@
   },
   "virtio": {
     "heading": "Drivers VirtIO durante la instalación",
-    "body": "Si dejas almacenamiento y red en los valores por defecto (SATA + e1000), Windows instalará sin pasos extra. Eso sí, el plan de almacenamiento de Proxmox siempre adjunta los discos virtuales como SATA, lo cual funciona por defecto. Donde VirtIO se vuelve relevante es si, durante el asistente avanzado, eliges VirtIO o SCSI para los discos o VirtIO para la NIC — en ese caso Windows no verá esos dispositivos hasta que se cargue el driver correspondiente desde la ISO de VirtIO montada en <code>ide3</code>.",
-    "warnTitle": "Sin el driver de red VirtIO no hay internet durante la instalación",
-    "warnBody": "Si elegiste VirtIO (<code>virtio</code>) como interfaz de red y no cargas el driver durante el setup, Windows no tendrá acceso a internet. Eso puede bloquear los pasos de activación y de Windows Update en el primer arranque.",
+    "body": "El creador de VM usa por defecto discos SCSI con controladora VirtIO SCSI y un adaptador de red VirtIO. Una ISO estándar de Windows puede necesitar sus controladores desde la ISO de VirtIO montada en <code>ide3</code>. Los discos SATA suelen funcionar con los controladores incluidos en Windows; elegir SATA no cambia el adaptador de red VirtIO.",
+    "warnTitle": "Carga el controlador de red VirtIO si Windows no tiene red",
+    "warnBody": "La VM usa un adaptador de red VirtIO (<code>virtio</code>). Si Windows no incluye su controlador, cárgalo durante la instalación para obtener acceso a la red. De lo contrario, la activación y Windows Update pueden no estar disponibles en el primer arranque.",
     "stepLabel": "Paso",
     "steps": [
       {
@@ -199,14 +199,14 @@
         "caption": "Setup de Windows sin discos visibles"
       },
       {
-        "title": "Pulsa \"Load driver\"",
+        "title": "Pulsa «Cargar controlador»",
         "bodyRich": "Pulsa <strong>Load driver</strong> para navegar por la ISO de VirtIO montada y elegir el driver de almacenamiento que corresponda a la interfaz que elegiste.",
         "img": "/vm/windows/virtio-step-2.png",
         "caption": "Pulsa Load driver para navegar por la ISO de VirtIO"
       },
       {
         "title": "Navega a la carpeta de drivers correcta",
-        "bodyRich": "En la ISO de VirtIO navega a la carpeta que coincida con la interfaz y la versión de Windows — por ejemplo <code>viostor</code> para VirtIO SCSI, con subcarpetas por edición de Windows (10 / 11 / Server).",
+        "bodyRich": "En la ISO de VirtIO selecciona <code>vioscsi</code> para la controladora VirtIO SCSI o <code>viostor</code> para discos de bloques VirtIO. Después elige la subcarpeta de tu versión de Windows y arquitectura.",
         "img": "/vm/windows/virtio-step-3.png",
         "caption": "Navega a la carpeta de drivers adecuada"
       },
@@ -231,13 +231,13 @@
     "items": [
       {
         "href": "/docs/utils/UUp-Dump-ISO-Creator",
-        "label": "UUP Dump ISO Creator",
+        "label": "Creador de ISO UUP Dump",
         "tail": " — genera ISOs de instalación de Windows actualizadas en el host Proxmox."
       },
       {
         "href": "/docs/disk-manager/import-disk-image-vm",
         "label": "Importar imagen de disco a VM",
-        "tail": " — adjunta un .vhdx / .vmdk existente de Windows a una VM nueva."
+        "tail": " — importa una imagen de disco de Windows existente (.vmdk, .qcow2, .img o .raw) en una VM existente; convierte primero las imágenes .vhdx a un formato compatible."
       },
       {
         "href": "/docs/hardware/gpu-vm-passthrough",
diff --git a/web/messages/es/docs/disk-manager/add-controller-nvme-vm.json b/web/messages/es/docs/disk-manager/add-controller-nvme-vm.json
index fd5e9332..7be436cb 100644
--- a/web/messages/es/docs/disk-manager/add-controller-nvme-vm.json
+++ b/web/messages/es/docs/disk-manager/add-controller-nvme-vm.json
@@ -1,14 +1,14 @@
 {
   "meta": {
-    "title": "Añadir controladora o NVMe a VM | ProxMenux Documentation",
+    "title": "Añadir controladora o NVMe a una VM | Documentación de ProxMenux",
     "description": "PCI passthrough de una controladora de almacenamiento (HBA SATA / SAS) o un dispositivo NVMe a una VM Proxmox usando ProxMenux. Gestiona la habilitación de IOMMU, la detección de conflictos y el conexionado con qm set --hostpci.",
-    "ogTitle": "Añadir controladora o NVMe a VM | ProxMenux Documentation",
+    "ogTitle": "Añadir controladora o NVMe a una VM | Documentación de ProxMenux",
     "ogDescription": "Pasa un HBA SATA / SAS entero o un dispositivo NVMe a una VM Proxmox. ProxMenux gestiona IOMMU, detección de conflictos y conexionado hostpci."
   },
   "header": {
     "title": "Añadir controladora o NVMe a VM",
     "description": "Pasa un host bus adapter (HBA) SATA / SAS entero o un dispositivo NVMe a una VM Proxmox mediante PCI passthrough. ProxMenux comprueba — y, con tu consentimiento, habilita — IOMMU, enumera los dispositivos elegibles para passthrough, filtra los conflictos y conecta la asignación con qm set --hostpci.",
-    "section": "Disk Manager · VM"
+    "section": "Administrador de discos · VM"
   },
   "intro": {
     "title": "Qué hace (y qué no hace) esto",
@@ -20,7 +20,7 @@
   },
   "iommu": {
     "heading": "Grupos IOMMU — por qué la tarjeta entera sale a la vez",
-    "body": "El PCI passthrough se hace por <strong>grupo IOMMU</strong>, que es la unidad más pequeña que el IOMMU de la CPU puede aislar. Todo lo que hay dentro de un grupo se mueve junto. Si tu controladora SATA comparte grupo IOMMU con la controladora USB, pasar la tarjeta SATA a una VM se lleva también los puertos USB — algo a menudo no deseado.",
+    "body": "El límite de aislamiento del passthrough PCI es el <strong>grupo IOMMU</strong>, la unidad más pequeña que puede aislar el IOMMU de la CPU. Los dispositivos del mismo grupo no pueden aislarse entre sí. Si una controladora SATA comparte grupo con una USB, pasar la SATA puede requerir liberar también la USB del host o impedir el passthrough. Esto no asigna automáticamente a la VM todos los dispositivos del grupo.",
     "outro": "ProxMenux muestra el grupo IOMMU junto a cada dispositivo y te avisa cuando un grupo lleva algo más que la controladora que quieres. Aún así puedes continuar si los dispositivos extra del grupo son aceptables (todas controladoras de disco, por ejemplo), o echar atrás si no lo son."
   },
   "prereqs": {
@@ -54,8 +54,8 @@
         ],
         "outro": "Es necesario reiniciar después de este cambio. El script te pide reiniciar ahora o más tarde; el passthrough no puede continuar hasta que la nueva cmdline del kernel esté activa.",
         "img": "/disk/nvme-passthrough/iommu-warning.png",
-        "alt": "Diálogo IOMMU Required",
-        "caption": "IOMMU Required — propuesta de habilitar y reiniciar"
+        "alt": "Diálogo que indica que se requiere IOMMU",
+        "caption": "Se requiere IOMMU: propuesta de habilitarlo y reiniciar"
       },
       {
         "title": "Enumeración de dispositivos",
@@ -97,7 +97,7 @@
     "busyBody": "Otro proceso aún retiene el dispositivo PCI. Causas más comunes: una VM anterior que crasheó sin soltarlo, o el kernel del host lo recuperó en el último arranque. Ejecuta <code>lspci -nnk -s &lt;addr&gt;</code> para ver qué driver está vinculado; debería ser <code>vfio-pci</code>. Un reinicio completo del host suele resolverlo.",
     "noDisksTitle": "El guest ve la controladora pero no los discos",
     "noDisksBody": "El modelo de la controladora no tiene driver en el guest. Linux casi nunca tiene este problema; Windows sí — instala el driver del fabricante (p. ej. LSI / Broadcom para HBAs SAS antiguos) con la tarjeta desconectada y luego reinicia con la tarjeta adjuntada.",
-    "sharedTitle": "Grupo IOMMU compartido que exporta también un dispositivo no relacionado",
+    "sharedTitle": "El grupo IOMMU incluye un dispositivo no relacionado",
     "sharedBody": "Opciones: (a) mover la tarjeta a un slot PCIe distinto para cambiar su grupo, (b) habilitar <em>ACS override</em> en el kernel para separar grupos (compromiso de seguridad — investiga antes de aplicarlo), o (c) elegir otra tarjeta en un grupo más limpio."
   },
   "related": {
diff --git a/web/messages/es/docs/disk-manager/format-disk.json b/web/messages/es/docs/disk-manager/format-disk.json
index 5e630681..c8835c94 100644
--- a/web/messages/es/docs/disk-manager/format-disk.json
+++ b/web/messages/es/docs/disk-manager/format-disk.json
@@ -1,8 +1,8 @@
 {
   "meta": {
-    "title": "Formatear / borrar disco físico | ProxMenux Documentation",
+    "title": "Formatear o borrar un disco físico | Documentación de ProxMenux",
     "description": "Wipe seguro y formateo de disco físico en Proxmox VE usando ProxMenux. Cuatro modos de operación, filtros estrictos de seguridad (discos del sistema / montados / en uso bloqueados) y doble confirmación incluyendo tecleo de la ruta completa.",
-    "ogTitle": "Formatear / borrar disco físico | ProxMenux Documentation",
+    "ogTitle": "Formatear o borrar un disco físico | Documentación de ProxMenux",
     "ogDescription": "Borra o formatea de forma segura un disco físico en Proxmox. Reglas de visibilidad seguras, 4 modos de operación, doble confirmación."
   },
   "header": {
@@ -43,31 +43,31 @@
     "headerUseCase": "Caso de uso",
     "rows": [
       {
-        "mode": "1. Wipe all",
+        "mode": "1. Borrar todo",
         "part": "Destruida",
         "data": "Firmas borradas",
-        "useCase": "Empezar de cero: todo lo del disco se va, listo para una nueva distribución."
+        "useCase": "Elimina la tabla de particiones y los metadatos de sistemas de archivos y RAID, pone a cero los primeros y los últimos 16 MiB y, en unidades que admiten discard, aplica TRIM a todo el disco. El resto de los datos no se sobrescribe y en un HDD aún podría recuperarse; no es un borrado seguro."
       },
       {
-        "mode": "2. Remove FS labels",
+        "mode": "2. Borrar firmas FS",
         "part": "Preservada",
         "data": "Preservados",
-        "useCase": "Limpia firmas obsoletas de ZFS / LVM / RAID para que el disco deje de ser reclamado automáticamente, sin tocar los datos."
+        "useCase": "Elimina firmas antiguas de ZFS / LVM / RAID para evitar que el disco se reclame automáticamente. No sobrescribe los datos de usuario en bloque, pero borrar las firmas puede dejarlos inaccesibles."
       },
       {
-        "mode": "3. Zero all data",
+        "mode": "3. Poner a cero",
         "part": "Preservada",
-        "data": "Destruidos (zerados)",
-        "useCase": "Sanear antes de entregar el disco, manteniendo la distribución de particiones existente."
+        "data": "Destruidos (sobrescritos con ceros)",
+        "useCase": "Sobrescribir con ceros las particiones existentes conservando la tabla de particiones. No cubre el espacio sin asignar ni las áreas de reserva de los SSD; no garantiza el saneamiento completo del dispositivo."
       },
       {
-        "mode": "4. Full format",
+        "mode": "4. Formato completo",
         "part": "Nuevo GPT",
         "data": "Destruidos",
         "useCase": "Disco listo para usar con una única partición nueva y un filesystem fresco."
       }
     ],
-    "fullFormatOutro": "<strong>Full format</strong> continúa con dos diálogos extra:",
+    "fullFormatOutro": "<strong>Formato completo</strong> continúa con dos diálogos más:",
     "fullFormatItems": [
       "<strong>Filesystem</strong> — <code>ext4</code>, <code>xfs</code>, <code>exfat</code> (portable) o <code>btrfs</code>. Si faltan herramientas (por ejemplo <code>mkfs.btrfs</code>) aborta con un mensaje claro.",
       "<strong>Etiqueta</strong> — etiqueta opcional del filesystem para identificación."
@@ -83,10 +83,10 @@
       },
       {
         "title": "Elige un modo de operación",
-        "bodyRich": "Elige entre <strong>Wipe all</strong>, <strong>Remove FS labels</strong>, <strong>Zero all data</strong> o <strong>Full format</strong> según la tabla de arriba."
+        "bodyRich": "Elige entre <strong>Borrar todo</strong>, <strong>Borrar firmas FS</strong>, <strong>Poner a cero</strong> o <strong>Formato completo</strong> según la tabla anterior."
       },
       {
-        "title": "(Solo Full format) Elige filesystem y etiqueta",
+        "title": "(Solo Formato completo) Elegir sistema de archivos y etiqueta",
         "body": "ext4 / xfs / exfat / btrfs, más una etiqueta opcional."
       },
       {
diff --git a/web/messages/es/docs/disk-manager/import-disk-image-vm.json b/web/messages/es/docs/disk-manager/import-disk-image-vm.json
index 29901f53..6457ccb1 100644
--- a/web/messages/es/docs/disk-manager/import-disk-image-vm.json
+++ b/web/messages/es/docs/disk-manager/import-disk-image-vm.json
@@ -1,14 +1,14 @@
 {
   "meta": {
-    "title": "Importar imagen de disco a VM | ProxMenux Documentation",
+    "title": "Importar imagen de disco a una VM | Documentación de ProxMenux",
     "description": "Importa un archivo de imagen de disco (.img / .qcow2 / .vmdk / .raw) a una VM Proxmox existente usando ProxMenux. Interfaz por imagen, emulación SSD y flag bootable, con qm importdisk por debajo.",
-    "ogTitle": "Importar imagen de disco a VM | ProxMenux Documentation",
+    "ogTitle": "Importar imagen de disco a una VM | Documentación de ProxMenux",
     "ogDescription": "Importa imágenes de disco .img / .qcow2 / .vmdk / .raw a una VM existente con ProxMenux. Usa qm importdisk por debajo."
   },
   "header": {
     "title": "Importar imagen de disco a VM",
     "description": "Importa un archivo de imagen de disco (.img, .qcow2, .vmdk o .raw) a una VM Proxmox existente. ProxMenux recopila todas las decisiones por adelantado — VM destino, almacenamiento Proxmox, directorio origen, interfaz, emulación SSD, orden de arranque — y luego ejecuta qm importdisk para cada imagen seleccionada.",
-    "section": "Disk Manager · VM"
+    "section": "Administrador de discos · VM"
   },
   "intro": {
     "title": "Qué hace esto",
@@ -52,8 +52,8 @@
         "intro": "Para cada imagen seleccionada ProxMenux pregunta:",
         "items": [
           "<strong>Interfaz</strong> — <code>scsi</code> (por defecto), <code>virtio</code>, <code>sata</code> o <code>ide</code>. Determina cómo verá el disco el guest.",
-          "<strong>Emulación SSD</strong> — solo se ofrece para interfaces no-VirtIO. Añade <code>ssd=1</code> para que el guest anuncie el disco como solid-state (útil para TRIM / alineación a nivel de SO).",
-          "<strong>Bootable</strong> — si es sí, ProxMenux añade el disco al orden de arranque para que se convierta en el dispositivo de arranque primario de la VM."
+          "<strong>Emulación SSD</strong>: solo se ofrece para interfaces que no sean VirtIO. Añade <code>ssd=1</code> para que el invitado reconozca un disco de estado sólido. La compatibilidad con discard/TRIM debe configurarse aparte.",
+          "<strong>Disco de arranque</strong>: si eliges sí, ProxMenux añade el disco al orden de arranque como dispositivo principal de la VM."
         ]
       },
       {
@@ -70,10 +70,10 @@
   },
   "troubleshoot": {
     "heading": "Solución de problemas",
-    "noImagesTitle": "\"No compatible disk images found\"",
+    "noImagesTitle": "\"No se encontraron imágenes de disco compatibles\"",
     "noImagesBody": "El script escaneó el directorio pero no encontró ningún archivo <code>.img</code> / <code>.qcow2</code> / <code>.vmdk</code> / <code>.raw</code>. Comprueba la extensión (las mayúsculas importan), que el archivo esté directamente en el directorio seleccionado (no se buscan subdirectorios) y que los permisos permitan a root leerlo.",
     "slowTitle": "La importación va lenta",
-    "slowBody": "Las conversiones VMDK → QCOW2 → raw están limitadas por CPU y E/S. La velocidad de importación depende de la velocidad de lectura del origen, la velocidad de escritura del almacenamiento destino y la CPU para descompresión. Prefiere orígenes raw o qcow2 cuando sea posible.",
+    "slowBody": "Las conversiones entre VMDK, QCOW2 y raw pueden estar limitadas por CPU y E/S. La velocidad depende de la lectura del origen, la escritura del destino y la descompresión necesaria. Prefiere fuentes raw o qcow2 cuando sea posible.",
     "uefiTitle": "El disco importado arranca en la UEFI shell",
     "uefiBody": "La imagen se construyó para legacy (SeaBIOS) pero la VM usa OVMF (o al revés). O bien cambia la BIOS de la VM en Proxmox para que coincida con la imagen, o reconstruye la imagen en el modo correcto antes de importar."
   },
@@ -92,7 +92,7 @@
       },
       {
         "href": "/docs/utils/UUp-Dump-ISO-Creator",
-        "label": "UUP Dump ISO Creator",
+        "label": "Creador de ISO UUP Dump",
         "tail": " — genera una ISO de Windows si necesitas una para una instalación nueva."
       },
       {
diff --git a/web/messages/es/docs/disk-manager/import-disk-lxc.json b/web/messages/es/docs/disk-manager/import-disk-lxc.json
index 0ed87f3e..9732c752 100644
--- a/web/messages/es/docs/disk-manager/import-disk-lxc.json
+++ b/web/messages/es/docs/disk-manager/import-disk-lxc.json
@@ -1,14 +1,14 @@
 {
   "meta": {
-    "title": "Importar disco a LXC | ProxMenux Documentation",
+    "title": "Importar disco a LXC | Documentación de ProxMenux",
     "description": "Adjunta un disco físico a un contenedor LXC existente en Proxmox VE usando ProxMenux. Gestiona la detección / formateo del filesystem, el mount point, la conversión unprivileged → privilegiado y rutas de dispositivo persistentes.",
-    "ogTitle": "Importar disco a LXC | ProxMenux Documentation",
+    "ogTitle": "Importar disco a LXC | Documentación de ProxMenux",
     "ogDescription": "Adjunta un disco físico a un contenedor LXC existente. Gestiona el filesystem, el mount point y la conversión unprivileged → privilegiado."
   },
   "header": {
     "title": "Importar disco a LXC",
     "description": "Adjunta un disco físico a un contenedor LXC existente en el host Proxmox. ProxMenux detecta los discos libres, opcionalmente los formatea con un filesystem soportado y conecta la partición a un mount point dentro del contenedor usando rutas de dispositivo persistentes.",
-    "section": "Disk Manager · LXC"
+    "section": "Administrador de discos · LXC"
   },
   "intro": {
     "title": "Passthrough en VM vs passthrough en LXC",
@@ -27,7 +27,7 @@
       "Al menos un disco físico que no esté en uso por el host ni por ningún otro guest."
     ],
     "warnTitle": "Se requiere contenedor privilegiado",
-    "warnBody": "El passthrough directo de dispositivos a un contenedor LXC solo funciona si el contenedor es <strong>privilegiado</strong>. Si el script detecta <code>unprivileged: 1</code> en la config, se ofrece a convertirlo in situ (edita <code>/etc/pve/lxc/&lt;CTID&gt;.conf</code>). Cancela si no puedes aceptar el compromiso de seguridad de un contenedor privilegiado."
+    "warnBody": "Este script requiere un contenedor <strong>privilegiado</strong> para conectar el disco directamente. Si detecta <code>unprivileged: 1</code>, ofrece editar <code>/etc/pve/lxc/&lt;CTID&gt;.conf</code> in situ. Esto cambia el modelo de seguridad y no reasigna la propiedad de los archivos existentes. Haz una copia del contenedor y comprueba la propiedad antes de aceptar, o recréalo como privilegiado."
   },
   "steps": {
     "heading": "Paso a paso",
@@ -82,10 +82,10 @@
   },
   "troubleshoot": {
     "heading": "Solución de problemas",
-    "unprivTitle": "\"Cannot continue with an unprivileged container\"",
-    "unprivBody": "Rechazaste la oferta de conversión. O bien vuelves a ejecutar y aceptas la conversión, o conviertes el contenedor manualmente editando <code>/etc/pve/lxc/&lt;CTID&gt;.conf</code> y reemplazando <code>unprivileged: 1</code> por <code>unprivileged: 0</code>. También puedes reconstruir el contenedor como privilegiado si prefieres no convertirlo in situ.",
+    "unprivTitle": "\"No se puede continuar con un contenedor sin privilegios\"",
+    "unprivBody": "Rechazaste la conversión, así que el script se detuvo sin cambiar nada. Para continuar, vuelve a ejecutarlo y acepta: el script detiene el contenedor, guarda una copia de su configuración en <code>/etc/pve/lxc/&lt;CTID&gt;.conf.bak</code> y sustituye <code>unprivileged: 1</code> por <code>unprivileged: 0</code>. Ese cambio por sí solo no convierte los UID/GID de los archivos existentes, así que haz antes un backup del contenedor y corrige los propietarios; como alternativa, restaura o recrea el contenedor como privilegiado.",
     "permsTitle": "Los permisos dentro del contenedor están mal",
-    "permsBody": "Los mounts del host hacia un contenedor privilegiado entran como <code>root:root</code>. Si el servicio dentro del CT corre como otro usuario (p. ej. <code>www-data</code> para Nextcloud), haz <code>chown</code>/<code>chmod</code> dentro del contenedor para que coincida con su UID/GID después del primer mount."
+    "permsBody": "Al montar una partición en un contenedor privilegiado se conserva la propiedad existente; un sistema de archivos recién formateado suele pertenecer a <code>root:root</code>. Si el servicio usa otro usuario, por ejemplo <code>www-data</code> para Nextcloud, comprueba su UID/GID y ajusta los archivos necesarios con <code>chown</code>/<code>chmod</code>. Los cambios afectan también al disco subyacente."
   },
   "related": {
     "heading": "Relacionado",
diff --git a/web/messages/es/docs/disk-manager/import-disk-vm.json b/web/messages/es/docs/disk-manager/import-disk-vm.json
index eee37df8..5dfdf100 100644
--- a/web/messages/es/docs/disk-manager/import-disk-vm.json
+++ b/web/messages/es/docs/disk-manager/import-disk-vm.json
@@ -1,18 +1,18 @@
 {
   "meta": {
-    "title": "Importar disco a VM | ProxMenux Documentation",
+    "title": "Importar disco a una VM | Documentación de ProxMenux",
     "description": "Adjunta un disco físico a una VM Proxmox existente con ProxMenux. Detección segura de discos (excluye sistema, montados, en uso, ZFS/RAID/LVM), rutas persistentes /dev/disk/by-id e interfaces SATA / SCSI / VirtIO / IDE.",
-    "ogTitle": "Importar disco a VM | ProxMenux Documentation",
+    "ogTitle": "Importar disco a una VM | Documentación de ProxMenux",
     "ogDescription": "Adjunta un disco físico a una VM Proxmox existente. Usa rutas persistentes /dev/disk/by-id y soporta SATA / SCSI / VirtIO / IDE."
   },
   "header": {
     "title": "Importar disco a VM",
     "description": "Adjunta un disco físico ya existente en el host Proxmox a una máquina virtual existente. ProxMenux detecta los discos libres, te deja elegir la VM destino y el tipo de bus (SATA / SCSI / VirtIO / IDE), y lo adjunta todo usando rutas persistentes /dev/disk/by-id para que el mapeo sobreviva a reinicios y cambios en el orden de los dispositivos.",
-    "section": "Disk Manager · VM"
+    "section": "Administrador de discos · VM"
   },
   "intro": {
     "title": "Qué hace esto",
-    "body": "Esto es un passthrough de disco crudo: el SO guest ve la unidad como un block device real (con sus datos SMART y geometría nativa). El disco se adjunta por su ruta <code>/dev/disk/by-id/…</code> — no <code>/dev/sdX</code> — para que la asignación no se rompa si las controladoras de disco enumeran los dispositivos en otro orden en el siguiente arranque."
+    "body": "Conecta un disco físico como dispositivo subyacente de una interfaz de disco virtual. El invitado no recibe automáticamente los datos SMART nativos ni las funciones de la controladora física; usa passthrough PCI de la controladora si los necesitas. Se conecta mediante su ruta <code>/dev/disk/by-id/…</code> cuando existe, para que un cambio en el orden de enumeración al arrancar no rompa la asignación; si no existe, se usa <code>/dev/sdX</code>."
   },
   "howRuns": {
     "heading": "Cómo se ejecuta el script",
@@ -49,7 +49,7 @@
         "items": [
           "<strong>SCSI</strong> — opción por defecto moderna para Linux y Windows con drivers VirtIO-SCSI instalados.",
           "<strong>SATA</strong> — amplia compatibilidad, funciona por defecto en prácticamente cualquier guest.",
-          "<strong>VirtIO</strong> — block device paravirtualizado, el más rápido pero requiere drivers en el guest.",
+          "<strong>VirtIO</strong>: dispositivo de bloques paravirtualizado eficiente; requiere controladores en el invitado.",
           "<strong>IDE</strong> — para guests legacy que no tienen ninguno de los drivers anteriores."
         ]
       },
@@ -63,13 +63,13 @@
     "heading": "Equivalente manual",
     "body": "El script es un wrapper alrededor de <code>qm set</code>. El comando exacto para un solo disco se ve así:",
     "migrationTitle": "La migración en vivo no es posible",
-    "migrationBody": "Una VM con un disco en passthrough está <strong>atada al host que expone ese disco</strong>. La migración en vivo a otro nodo Proxmox fallará porque el nodo destino no ve la misma ruta <code>/dev/disk/by-id/…</code>. Usa replicación o backup/restore en su lugar, o elige discos virtuales en almacenamiento compartido si necesitas movilidad.",
+    "migrationBody": "Una VM con un disco físico conectado directamente está <strong>ligada al host que expone ese disco</strong>. Otro nodo normalmente no dispone de la misma ruta <code>/dev/disk/by-id/…</code> ni de sus datos. Copia y transfiere esos datos por separado, o usa discos virtuales gestionados en almacenamiento compartido o con replicación compatible para facilitar la movilidad. No presupongas que la replicación de almacenamiento de Proxmox cubre este dispositivo.",
     "shareTitle": "No compartas un disco físico entre VMs",
     "shareBody": "Adjuntar el mismo disco físico a dos VMs a la vez corromperá los datos en la siguiente escritura. ProxMenux detecta esta situación y la bloquea, pero si te saltas el script (un <code>qm set</code> directo), asegúrate de que solo un guest monte el disco."
   },
   "troubleshoot": {
     "heading": "Solución de problemas",
-    "noDisksTitle": "\"No disks available for this VM\"",
+    "noDisksTitle": "\"No hay discos disponibles para esta máquina virtual\"",
     "noDisksIntro": "El script encontró discos, pero todos los candidatos se filtraron. Razones comunes:",
     "noDisksItems": [
       "Cada disco restante ya está referenciado en la config de la VM destino.",
diff --git a/web/messages/es/docs/disk-manager/index.json b/web/messages/es/docs/disk-manager/index.json
index 8d886d15..b32df976 100644
--- a/web/messages/es/docs/disk-manager/index.json
+++ b/web/messages/es/docs/disk-manager/index.json
@@ -1,20 +1,20 @@
 {
   "meta": {
     "title": "Disk Manager de Proxmox — adjuntar discos a VMs / LXC, tests SMART, wipe | ProxMenux",
-    "description": "Gestiona discos físicos en un host Proxmox VE con ProxMenux: pasa discos a VMs o contenedores LXC (qm set scsi/sata/virtio, pct mp), importa imágenes de disco qcow2 / vmdk / vdi, pasa HBAs o controladoras NVMe enteras, borra discos de forma segura y ejecuta self-tests SMART.",
+    "description": "Gestiona discos físicos en un host Proxmox VE con ProxMenux: conecta discos a VM o contenedores LXC (qm set scsi/sata/virtio, pct mp), importa imágenes img / qcow2 / vmdk / raw, asigna HBA o controladoras NVMe completas, borra discos con controles de seguridad y ejecuta pruebas SMART.",
     "ogTitle": "Disk Manager de Proxmox — adjuntar discos a VMs / LXC, tests SMART, wipe",
     "ogDescription": "Adjuntar discos a VMs / LXC, importar imágenes de disco, PCI passthrough para controladoras, wipe seguro y tests SMART en Proxmox VE.",
     "twitterTitle": "Disk Manager de Proxmox | ProxMenux",
     "twitterDescription": "Adjuntar discos a VMs / LXC, importar imágenes, PCI passthrough, wipe seguro y tests SMART."
   },
   "header": {
-    "title": "Disk Manager",
+    "title": "Administrador de discos",
     "description": "El menú Disk Manager agrupa las herramientas de ProxMenux para gestionar discos físicos en un host Proxmox: adjuntar discos a VMs y contenedores LXC, importar imágenes de disco, pasar una controladora entera o un dispositivo NVMe, borrar discos de forma segura y ejecutar tests de salud SMART.",
-    "section": "Disk Manager"
+    "section": "Administrador de discos"
   },
   "intro": {
     "title": "Para qué sirve este menú",
-    "body": "Cada opción aquí opera sobre <strong>discos físicos ya visibles para el host Proxmox</strong>. El menú está dividido en tres grupos — <strong>VM</strong> (adjuntar discos o importar imágenes a una máquina virtual), <strong>LXC</strong> (adjuntar discos a un contenedor) y <strong>Utilidades</strong> (format seguro, salud SMART). Los chequeos de seguridad se aplican en todas partes: los discos del sistema y los discos ya en uso están ocultos o bloqueados."
+    "body": "Estas herramientas trabajan con <strong>discos físicos visibles para el host Proxmox y archivos de imagen guardados en él</strong>. Hay tres grupos: <strong>VM</strong> (conectar discos o importar imágenes), <strong>LXC</strong> (conectar discos a un contenedor) y <strong>Utilidades</strong> (formateo y salud SMART). Las operaciones de conexión y borrado ocultan o bloquean los discos del sistema y en uso; las comprobaciones SMART pueden examinarlos sin borrarlos."
   },
   "opening": {
     "heading": "Abrir el menú",
@@ -32,7 +32,7 @@
       "Añadir controladora o NVMe a VM"
     ],
     "lxcTitle": "LXC",
-    "lxcBody": "Herramientas que operan sobre contenedores existentes. El passthrough directo de dispositivos necesita un contenedor privilegiado; el script se ofrece a convertirlo si hace falta.",
+    "lxcBody": "Herramientas para contenedores LXC existentes. Este script requiere un contenedor privilegiado y ofrece cambiar la opción cuando hace falta. Lee primero las precauciones sobre conversión y propiedad de archivos en la página de la herramienta.",
     "lxcItems": [
       "Importar disco a LXC"
     ],
@@ -69,7 +69,7 @@
   },
   "lxc": {
     "heading": "LXC",
-    "intro": "Herramientas que operan sobre contenedores LXC existentes. El passthrough directo de dispositivos requiere un contenedor privilegiado; el script se ofrece a convertir el contenedor si hace falta.",
+    "intro": "Herramientas para contenedores LXC existentes. Este script requiere un contenedor privilegiado y ofrece cambiar la opción cuando hace falta. Lee primero las precauciones sobre conversión y propiedad de archivos en la página de la herramienta.",
     "options": [
       {
         "icon": "Boxes",
@@ -98,8 +98,8 @@
     ]
   },
   "safety": {
-    "title": "Reglas de seguridad comunes a todas las opciones",
-    "intro": "ProxMenux filtra cualquier cosa que pueda dañar el host:",
+    "title": "Reglas de seguridad para conectar y borrar discos",
+    "intro": "Las operaciones de conexión y borrado excluyen los dispositivos que podrían dañar el host:",
     "items": [
       "El <strong>disco del sistema</strong> (root pool, swap, miembros activos de ZFS / LVM / RAID) está siempre oculto.",
       "Los discos <strong>montados</strong> en cualquier punto del host se ocultan o se bloquean en ejecución.",
@@ -112,7 +112,7 @@
     "items": [
       {
         "href": "/docs/storage-share",
-        "label": "Storage & Share Manager",
+        "label": "Gestor de almacenamiento y recursos compartidos",
         "tail": " — registrar almacenamiento en el propio Proxmox (NFS / Samba / iSCSI / local) y compartir carpetas entre host y CTs."
       },
       {
diff --git a/web/messages/es/docs/disk-manager/smart-disk-test.json b/web/messages/es/docs/disk-manager/smart-disk-test.json
index 66d91725..958b199f 100644
--- a/web/messages/es/docs/disk-manager/smart-disk-test.json
+++ b/web/messages/es/docs/disk-manager/smart-disk-test.json
@@ -1,8 +1,8 @@
 {
   "meta": {
-    "title": "Salud y test SMART de disco | ProxMenux Documentation",
+    "title": "Salud y pruebas SMART del disco | Documentación de ProxMenux",
     "description": "Ejecuta chequeos de salud SMART y tests de disco en Proxmox VE con ProxMenux. Soporta SATA / SAS (smartmontools) y NVMe (nvme-cli). Self-tests cortos y largos, exportación JSON para integración con ProxMenux Monitor.",
-    "ogTitle": "Salud y test SMART de disco | ProxMenux Documentation",
+    "ogTitle": "Salud y pruebas SMART del disco | Documentación de ProxMenux",
     "ogDescription": "Chequeos de salud SMART y self-tests para unidades SATA / SAS y NVMe en Proxmox. Exportación JSON para el Monitor."
   },
   "header": {
@@ -49,17 +49,17 @@
         "dur": "Horas (depende del tamaño del disco)"
       },
       {
-        "action": "Comprobar el progreso del test",
+        "action": "Progreso de prueba",
         "what": "Estado del self-test activo o más reciente.",
         "dur": "Instantáneo"
       }
     ],
     "tipTitle": "Los tests largos sobreviven al cierre del terminal",
-    "tipBody": "Un test largo se encola <em>dentro de la unidad</em> — no depende de que el proceso de ProxMenux siga vivo. Puedes cerrar el terminal, reiniciar el host Proxmox (el test continúa donde lo dejó en algunas unidades) o simplemente volver más tarde y usar <strong>Comprobar el progreso del test</strong> para ver el resultado."
+    "tipBody": "Un test largo se ejecuta <em>dentro de la unidad</em> y no depende de que siga activo el proceso de ProxMenux. Puedes cerrar el terminal y volver después a <strong>Progreso de prueba</strong>. Un reinicio del host, de la controladora o una pérdida de alimentación puede interrumpir el test y su recopilador de resultados; no presupongas que se reanudará automáticamente."
   },
   "json": {
     "heading": "Exportación JSON para el Monitor",
-    "intro": "Cada ejecución escribe un archivo JSON con marca de tiempo en <code>/usr/local/share/proxmenux/smart/&lt;disk&gt;/</code>. La estructura es:",
+    "intro": "Las acciones de estado, test corto y progreso guardan un JSON con fecha en <code>/usr/local/share/proxmenux/smart/&lt;disk&gt;/</code>; los resultados del test largo se recopilan en segundo plano. El informe completo solo se muestra. La estructura es:",
     "outro": "El ProxMenux Monitor los recoge para renderizar tendencias de salud por disco; los archivos viejos se rotan automáticamente cuando se alcanza el límite de retención."
   },
   "steps": {
@@ -89,7 +89,7 @@
       },
       {
         "title": "Revisa los resultados",
-        "bodyRich": "El estado y el informe se imprimen en el terminal y se escriben en JSON. Para los tests largos, vuelve más tarde y ejecuta <strong>Comprobar el progreso del test</strong> en el mismo disco para ver el resultado.",
+        "bodyRich": "La salida del estado, de las pruebas y del progreso se muestra en el terminal; <strong>Informe completo</strong> se abre en un diálogo desplazable. El JSON se exporta para las acciones indicadas arriba, no para Informe completo. Para las pruebas largas, vuelve después a <strong>Progreso de prueba</strong> en el mismo disco.",
         "img": "/disk/smart/quick-status.png",
         "alt": "Salida del estado de salud rápido",
         "caption": "Salida del estado de salud rápido (SATA — smartctl -H + -A)"
@@ -103,10 +103,10 @@
   },
   "troubleshoot": {
     "heading": "Solución de problemas",
-    "noSmartTitle": "\"Could not read SMART data from /dev/sdX\"",
+    "noSmartTitle": "\"No se pudieron leer los datos SMART de /dev/sdX\"",
     "noSmartBody": "El disco está probablemente detrás de una controladora RAID / SAS que no pasa SMART. Con tarjetas basadas en megaraid, prueba <code>smartctl -d megaraid,N /dev/sdX</code>. Para HBAs en modo IT la invocación directa funciona.",
     "longTitle": "El test largo no termina nunca",
-    "longBody": "El test se encola en el firmware de la unidad y pausa si el disco tiene carga pesada. Ejecutarlo de noche en un sistema en reposo suele funcionar. También puedes revisar <code>smartctl -c</code> para ver el porcentaje restante; si se queda atascado en un LBA fijo, el disco está fallando en ese sector."
+    "longBody": "La unidad ejecuta el test en su firmware y la carga de E/S puede retrasarlo. Prueba en un periodo de poca actividad, como de noche. En SATA, <code>smartctl -c</code> muestra el porcentaje restante, y en SAS, <code>smartctl -l selftest</code>; revisa el registro de tests para ver el resultado y posibles LBA con fallos. Un error de lectura requiere investigación; la lentitud por sí sola no demuestra un sector defectuoso."
   },
   "related": {
     "heading": "Relacionado",
@@ -124,7 +124,7 @@
       {
         "href": "/docs/help-info/zfs-commands",
         "label": "Comandos de gestión de ZFS",
-        "tail": " — zpool scrub como equivalente a los tests SMART a nivel de capa de almacenamiento."
+        "tail": " — zpool scrub comprueba las sumas de verificación de los datos ZFS y complementa los tests SMART del hardware."
       },
       {
         "href": "/docs/monitor/dashboard/storage",
diff --git a/web/messages/es/docs/external-repositories.json b/web/messages/es/docs/external-repositories.json
index c77f697f..95f01a63 100644
--- a/web/messages/es/docs/external-repositories.json
+++ b/web/messages/es/docs/external-repositories.json
@@ -1,58 +1,58 @@
 {
   "meta": {
-    "title": "Repositorios externos | ProxMenux Documentation",
-    "description": "ProxMenux integra repositorios de scripts externos seleccionados (community-scripts, ZimaOS) como alternativas en algunas secciones del menú. Cada script externo se etiqueta claramente con su origen; los reportes de bugs van al mantenedor original.",
-    "ogTitle": "Repositorios externos | ProxMenux Documentation",
-    "ogDescription": "Repositorios de scripts externos integrados en ProxMenux como opciones alternativas en los menús."
+    "title": "Repositorios externos | Documentación de ProxMenux",
+    "description": "ProxMenux integra repositorios externos de scripts seleccionados (community-scripts y ZimaOS) como alternativas en algunas secciones del menú. Cada script indica su procedencia; los errores se notifican al mantenedor original.",
+    "ogTitle": "Repositorios externos | Documentación de ProxMenux",
+    "ogDescription": "Repositorios externos de scripts integrados como alternativas en los menús de ProxMenux."
   },
   "header": {
     "title": "Repositorios externos",
-    "description": "ProxMenux integra repositorios de scripts externos seleccionados como opciones alternativas en algunas secciones del menú. Estos scripts vienen de fuentes de terceros confiables y se etiquetan claramente con su origen cuando se muestran en el menú.",
+    "description": "ProxMenux integra repositorios externos de scripts seleccionados como alternativas en algunas secciones del menú. Estos scripts proceden de terceros de confianza y el menú indica claramente su origen.",
     "section": "Repositorios externos"
   },
   "practice": {
     "title": "Qué significa esto en la práctica",
-    "body": "Cuando una opción del menú está respaldada por un script externo (en lugar del código propio de ProxMenux), el menú dice explícitamente de dónde viene y qué repositorio carga. ProxMenux actúa como lanzador — no modifica los scripts externos. Las incidencias con lo que hace un script externo corresponden al mantenedor de ese repositorio, no a ProxMenux."
+    "body": "Cuando una opción usa un script externo en lugar de código propio, el menú indica de dónde procede y qué repositorio carga. ProxMenux actúa como lanzador y no modifica esos scripts. Los problemas de su funcionamiento corresponden al mantenedor del repositorio de origen, no a ProxMenux."
   },
   "integrated": {
-    "heading": "Actualmente integrados",
+    "heading": "Integrados actualmente",
     "usedInLabel": "Usado en:",
     "items": [
       {
         "name": "community-scripts / ProxmoxVE",
         "url": "https://community-scripts.github.io/ProxmoxVE/",
-        "description": "Sucesor espiritual de los helper scripts de tteck. Gran catálogo de scripts de un tirón para desplegar LXCs (Home Assistant, Plex, Frigate, …), VMs, addons y ajustes de PVE.",
-        "usedIn": "Lanzador de helper scripts, Red (arreglo de offloading de NIC para Intel e1000e)"
+        "description": "Continúa el trabajo de los helper scripts de tteck. Incluye un amplio catálogo de scripts para desplegar en una sola ejecución LXC (Home Assistant, Plex, Frigate…), VM, complementos y ajustes de PVE.",
+        "usedIn": "Lanzador de Helper Scripts y Red (corrección de offloading de la NIC Intel e1000e)"
       }
     ]
   },
   "attribution": {
-    "heading": "Atribución y reconocimiento",
+    "heading": "Autoría y reconocimiento",
     "items": [
-      "El crédito siempre se da a los autores originales en el menú y en la página de documentación que envuelve el script.",
-      "Se muestra un enlace al repositorio fuente — tanto antes de ejecutar el script como en la página de docs correspondiente.",
-      "Se anima a los usuarios a apoyar a los desarrolladores de estos proyectos externos (dar una ⭐, patrocinar, presentar reportes de bugs de calidad)."
+      "Los autores originales aparecen siempre en el menú y en la página que documenta el uso del script desde ProxMenux.",
+      "Se muestra un enlace al repositorio de origen antes de ejecutar el script y en su página de documentación.",
+      "Puedes apoyar a los desarrolladores de estos proyectos externos con una ⭐, patrocinándolos o enviando informes de errores bien documentados."
     ]
   },
   "report": {
     "title": "Dónde reportar problemas con scripts externos",
-    "body": "Si un script de uno de estos repositorios externos no funciona como se espera, <strong>repórtalo directamente a ese repositorio</strong> — no a ProxMenux. ProxMenux solo descarga y ejecuta el script tal cual; no modifica la fuente. El mantenedor original es la persona indicada para triarlo y arreglarlo. Las incidencias de ProxMenux son para problemas con el propio lanzador o con cómo ProxMenux integra el script externo."
+    "body": "Si un script externo no funciona como debería, <strong>notifícalo directamente en su repositorio</strong>, no en ProxMenux. ProxMenux lo descarga y ejecuta sin modificar su código. El mantenedor original es quien debe analizar y corregir el fallo. Usa las incidencias de ProxMenux para problemas del lanzador o de la integración del script."
   },
   "suggest": {
     "heading": "Sugerir nuevos repositorios externos",
     "intro": "¿Has encontrado un script o repositorio que encajaría bien en un menú de ProxMenux? Sugiérelo vía:",
-    "discussionTitle": "💬 Abrir una Discussion",
-    "discussionBody": "Mejor para ideas — recibe input de la comunidad antes de convertirse en una petición de función.",
-    "issueTitle": "🐛 Abrir una Issue",
-    "issueBody": "Para peticiones de función concretas con un alcance claro."
+    "discussionTitle": "💬 Abrir una discusión",
+    "discussionBody": "Ideal para ideas: recoge opiniones de la comunidad antes de convertirlas en una petición de funcionalidad.",
+    "issueTitle": "🐛 Abrir una incidencia",
+    "issueBody": "Para peticiones de funcionalidades concretas con un alcance claro."
   },
   "candidate": {
     "title": "Qué hace un buen candidato a integración",
     "items": [
       "Código abierto con un mantenedor activo.",
-      "Idempotente / seguro de ejecutar más de una vez.",
-      "No modifica silenciosamente la configuración del núcleo de Proxmox.",
-      "Resuelve un problema que ProxMenux no cubre ya (evita duplicación de funciones)."
+      "Idempotente: seguro de ejecutar más de una vez.",
+      "No modifica la configuración principal de Proxmox sin avisar.",
+      "Resuelve un problema que ProxMenux todavía no cubre, evitando duplicar funciones."
     ]
   }
 }
diff --git a/web/messages/es/docs/glossary.json b/web/messages/es/docs/glossary.json
index dd74cc60..37f43a0f 100644
--- a/web/messages/es/docs/glossary.json
+++ b/web/messages/es/docs/glossary.json
@@ -1,35 +1,35 @@
 {
   "meta": {
-    "title": "Glosario | ProxMenux Documentation",
-    "description": "Definiciones de los términos técnicos usados a lo largo de la documentación de ProxMenux — conceptos de Proxmox (VM, LXC, qm, pct, pmxcfs), fundamentos de virtualización (KVM, IOMMU, VFIO, OVMF), almacenamiento (ZFS, ARC, LVM, vzdump, PBS), red (bridge, VLAN, nftables) y terminología específica de ProxMenux.",
-    "ogTitle": "Glosario | ProxMenux Documentation",
+    "title": "Glosario | Documentación de ProxMenux",
+    "description": "Definiciones de los términos usados en la documentación de ProxMenux: Proxmox, almacenamiento, redes y virtualización.",
+    "ogTitle": "Glosario | Documentación de ProxMenux",
     "ogDescription": "Referencia rápida para los términos técnicos usados en la documentación de ProxMenux."
   },
   "header": {
     "title": "Glosario",
-    "description": "Definiciones de los términos técnicos usados a lo largo de la documentación de ProxMenux. Cubre conceptos de Proxmox, fundamentos de virtualización, almacenamiento, red, internals de Linux y terminología específica de ProxMenux.",
+    "description": "Definiciones breves de los términos usados en ProxMenux y el funcionamiento interno de Proxmox.",
     "section": "Glosario"
   },
   "callout": {
     "title": "Cómo usar esta página",
-    "bodyRich": "Cada entrada tiene un badge de categoría y una definición corta. Los enlaces <em>Ver también</em> saltan a la página de docs donde el término es más relevante. Usa la navegación A–Z de abajo para desplazarte directamente a una letra."
+    "bodyRich": "Cada entrada incluye su categoría y una definición breve. Los enlaces <em>Ver también</em> llevan a la documentación relacionada. Usa la navegación A–Z para ir directamente a una letra."
   },
   "jumpHeading": "Saltar a la letra",
   "seeAlsoLabel": "Ver también:",
   "aliasesLabel": "también:",
   "missingCallout": {
     "title": "¿Falta un término?",
-    "leadRich": "Si un término en las docs no está definido aquí, abre una incidencia o PR en <ext>GitHub</ext> — el glosario vive en <code>web/app/docs/glossary/page.tsx</code> como un simple array de datos."
+    "leadRich": "Si falta un término, abre un issue o PR en <ext>GitHub</ext>. El glosario está en <code>web/messages/en/docs/glossary.json</code>, con sus catálogos para cada idioma."
   },
   "entries": [
     {
       "term": "ACS",
       "aliases": [
         "Access Control Services",
-        "ACS override"
+        "Anulación de ACS"
       ],
       "category": "Virtualización",
-      "definitionRich": "Extensión de PCIe que evita el tráfico peer-to-peer directo entre dispositivos, asegurando que cada dispositivo está en su propio grupo IOMMU. El parche del kernel <em>ACS override</em> afloja esto para que dispositivos del mismo grupo IOMMU puedan pasarse a VMs distintas — útil pero con compromiso de seguridad.",
+      "definitionRich": "Funciones de control de acceso PCIe que ayudan a aislar el tráfico entre dispositivos. Los grupos IOMMU dependen del hardware y la topología. El parche <em>ACS override</em> puede dividir los grupos que muestra Linux, pero no añade aislamiento físico; asignarlos a VM distintas implica un riesgo de seguridad.",
       "seeAlso": [
         {
           "label": "Añadir controlador o NVMe a una VM",
@@ -43,10 +43,10 @@
         "Adaptive Replacement Cache"
       ],
       "category": "Almacenamiento",
-      "definitionRich": "Caché de lectura en memoria de ZFS. Mantiene los bloques de datos usados recientemente y con frecuencia; el tamaño escala con la RAM disponible del host. Los valores por defecto son agresivos — la post-instalación de Proxmox te deja limitarlo.",
+      "definitionRich": "Caché de lectura de ZFS en la RAM del host, con bloques de uso reciente y frecuente. El límite predeterminado depende de la versión y la instalación de Proxmox. La postinstalación de ProxMenux permite limitarla.",
       "seeAlso": [
         {
-          "label": "Post-instalación: Almacenamiento",
+          "label": "Postinstalación: almacenamiento",
           "href": "/docs/post-install/storage"
         },
         {
@@ -56,9 +56,9 @@
       ]
     },
     {
-      "term": "Bind mount",
+      "term": "Montaje bind",
       "category": "Linux",
-      "definitionRich": "Función de Linux que expone una parte del sistema de archivos en otra ruta. ProxMenux usa bind mounts para compartir directorios del host con contenedores LXC vía <code>pct set -mpN</code>.",
+      "definitionRich": "Función de Linux que hace accesible una parte del sistema de archivos desde otra ruta. ProxMenux la usa para compartir directorios del host con contenedores LXC mediante <code>pct set -mpN</code>.",
       "seeAlso": [
         {
           "label": "Puntos de montaje LXC",
@@ -67,23 +67,23 @@
       ]
     },
     {
-      "term": "Bond",
+      "term": "Bond de red",
       "aliases": [
-        "Network bond",
-        "Link aggregation"
+        "Agrupación de interfaces de red",
+        "Agregación de enlaces"
       ],
       "category": "Red",
-      "definitionRich": "Combina múltiples interfaces de red físicas en una interfaz lógica — para redundancia (active-backup), throughput (LACP / 802.3ad) o ambas. Se configura en <code>/etc/network/interfaces</code>."
+      "definitionRich": "Agrupa varias interfaces físicas en una lógica para ofrecer redundancia (active-backup), rendimiento agregado (LACP / 802.3ad) o ambos. Se configura en <code>/etc/network/interfaces</code>."
     },
     {
-      "term": "Bridge",
+      "term": "Puente",
       "aliases": [
         "vmbrX",
         "vmbr0",
-        "Linux bridge"
+        "Puente de Linux"
       ],
       "category": "Red",
-      "definitionRich": "Un switch virtual de capa 2 en el host. <code>vmbr0</code> es el bridge por defecto de Proxmox que conecta VMs y contenedores a la red física. Múltiples bridges (<code>vmbr1</code>, <code>vmbr2</code>...) aíslan grupos de guests.",
+      "definitionRich": "Conmutador virtual de capa 2 en el host. <code>vmbr0</code> suele conectar los invitados a la red física. Otros bridges (<code>vmbr1</code>, <code>vmbr2</code>...) permiten separar redes según sus conexiones físicas y configuración.",
       "seeAlso": [
         {
           "label": "Análisis de bridges y reparación guiada",
@@ -94,7 +94,7 @@
     {
       "term": "Ceph",
       "category": "Almacenamiento",
-      "definitionRich": "Sistema de almacenamiento distribuido fuertemente integrado con Proxmox para clústeres hiperconvergentes. Proporciona almacenamiento de objetos, bloques y archivos respaldado por OSDs (Object Storage Daemons). PVE 9 requiere Ceph 19.x (Squid).",
+      "definitionRich": "Almacenamiento distribuido integrado con Proxmox para clústeres hiperconvergentes. Los OSD (Object Storage Daemons) sustentan el almacenamiento de objetos, bloques y archivos. La versión de Ceph requerida depende de la versión de Proxmox y la actualización; consulta su guía.",
       "seeAlso": [
         {
           "label": "Actualizar PVE 8 a PVE 9",
@@ -105,14 +105,14 @@
     {
       "term": "CT",
       "aliases": [
-        "Container",
-        "LXC container"
+        "Contenedor",
+        "Contenedor LXC"
       ],
       "category": "Proxmox",
-      "definitionRich": "Abreviatura de \"contenedor\" — terminología de Proxmox para una instancia LXC. Tiene un CTID numérico que mapea a <code>/etc/pve/lxc/&lt;CTID&gt;.conf</code>. Mira también <strong>LXC</strong>.",
+      "definitionRich": "Abreviatura de «contenedor» en Proxmox para una instancia LXC. Su CTID numérico corresponde a <code>/etc/pve/lxc/&lt;CTID&gt;.conf</code>. Véase también <strong>LXC</strong>.",
       "seeAlso": [
         {
-          "label": "Gestión de VMs y CTs",
+          "label": "Gestión de VM y contenedores",
           "href": "/docs/help-info/vm-ct-commands"
         }
       ]
@@ -120,7 +120,7 @@
     {
       "term": "deb822",
       "category": "Linux",
-      "definitionRich": "Formato moderno para fuentes de repositorios APT, usando archivos <code>.sources</code> con bloques estructurados clave/valor (Types, URIs, Suites, Components, Signed-By). Reemplaza el formato heredado de una línea <code>.list</code>. Estándar desde PVE 9 / Debian Trixie en adelante.",
+      "definitionRich": "Formato moderno de fuentes APT: archivos <code>.sources</code> con bloques estructurados y campos Types, URIs, Suites, Components y Signed-By. Sustituye el formato de una línea <code>.list</code> y es el estándar desde PVE 9 / Debian Trixie.",
       "seeAlso": [
         {
           "label": "Actualizar PVE 8 a PVE 9",
@@ -131,13 +131,13 @@
     {
       "term": "dGPU",
       "aliases": [
-        "Discrete GPU"
+        "GPU dedicada"
       ],
       "category": "Virtualización",
-      "definitionRich": "Una tarjeta gráfica independiente en su propio slot PCIe (p. ej. NVIDIA RTX, AMD Radeon). Contrasta con <strong>iGPU</strong>. Típicamente se usa para passthrough VFIO a una única VM, no para compartir entre LXCs.",
+      "definitionRich": "Tarjeta gráfica independiente, normalmente conectada por PCIe, a diferencia de una <strong>iGPU</strong>. Puede asignarse a una VM con VFIO o compartirse entre LXC mediante dispositivos y el controlador del host, según la compatibilidad del hardware y las aplicaciones.",
       "seeAlso": [
         {
-          "label": "Añadir GPU a una VM (passthrough)",
+          "label": "Añadir GPU a una VM (acceso directo)",
           "href": "/docs/hardware/gpu-vm-passthrough"
         }
       ]
@@ -145,15 +145,15 @@
     {
       "term": "Dialog",
       "category": "Linux",
-      "definitionRich": "Herramienta basada en ncurses para dibujar menús, prompts y barras de progreso en un terminal. ProxMenux está construido alrededor de menús dialog."
+      "definitionRich": "Herramienta basada en ncurses para mostrar menús, preguntas y barras de progreso en la terminal. ProxMenux utiliza menús de dialog."
     },
     {
       "term": "DKMS",
       "aliases": [
-        "Dynamic Kernel Module Support"
+        "Soporte de módulo de núcleo dinámico"
       ],
       "category": "Linux",
-      "definitionRich": "Framework que reconstruye automáticamente los módulos del kernel fuera del árbol (NVIDIA, ZFS, drivers propios) cuando el kernel se actualiza. Evita que los módulos se queden atrás tras actualizaciones del kernel.",
+      "definitionRich": "Sistema para recompilar módulos externos registrados, como NVIDIA o ZFS, al cambiar el kernel. La compilación requiere código del módulo compatible y las cabeceras correspondientes.",
       "seeAlso": [
         {
           "label": "Instalar Coral TPU (host)",
@@ -164,7 +164,7 @@
     {
       "term": "Fail2Ban",
       "category": "Linux",
-      "definitionRich": "Servicio de prevención de intrusiones que vigila los archivos de log en busca de fallos repetidos de autenticación y banea las IPs ofensoras en la capa del firewall. ProxMenux entrega jails preconfigurados para SSH, la UI de Proxmox y el Monitor.",
+      "definitionRich": "Servicio que detecta fallos repetidos de autenticación en los registros y bloquea las IP responsables mediante el cortafuegos. ProxMenux incluye filtros y reglas de bloqueo (jails) para SSH, la interfaz Proxmox y Monitor.",
       "seeAlso": [
         {
           "label": "Fail2Ban",
@@ -175,7 +175,7 @@
     {
       "term": "Fastfetch",
       "category": "Linux",
-      "definitionRich": "Herramienta de info del sistema en ASCII-art que se ejecuta en el login del shell (el \"banner de resumen del sistema\"). Reemplaza al antiguo <code>neofetch</code>; disponible como opción opt-in en la post-instalación de ProxMenux.",
+      "definitionRich": "Herramienta de información del sistema con arte ASCII que aparece al iniciar sesión en la consola. Sustituye a <code>neofetch</code> y se puede activar en la postinstalación de ProxMenux.",
       "seeAlso": [
         {
           "label": "Post-instalación: opcional",
@@ -189,7 +189,7 @@
         "GRand Unified Bootloader"
       ],
       "category": "Linux",
-      "definitionRich": "Cargador de arranque para la mayoría de distribuciones Linux. La configuración vive en <code>/etc/default/grub</code> + <code>/boot/grub/</code>. Se modifica para habilitar IOMMU, parámetros del kernel y entradas de arranque EFI. Ejecuta <code>update-grub</code> tras editar.",
+      "definitionRich": "Gestor de arranque de instalaciones Linux basadas en GRUB. Se configura en <code>/etc/default/grub</code> y <code>/boot/grub/</code>; aplica los cambios con <code>update-grub</code>. Proxmox también puede usar systemd-boot: comprueba el gestor activo antes de cambiar parámetros del kernel.",
       "seeAlso": [
         {
           "label": "Comandos de passthrough de GPU",
@@ -200,10 +200,10 @@
     {
       "term": "iGPU",
       "aliases": [
-        "Integrated GPU"
+        "GPU integrada"
       ],
       "category": "Virtualización",
-      "definitionRich": "Procesador gráfico integrado en el paquete de CPU (Intel UHD / Iris, AMD Radeon Vega en APUs Ryzen). Típicamente compartido entre múltiples contenedores LXC vía <code>/dev/dri</code> en lugar de pasarse a una única VM.",
+      "definitionRich": "Procesador gráfico integrado en el encapsulado de la CPU, como Intel UHD / Iris o el Radeon de las APU Ryzen. Suele compartirse entre varios LXC mediante <code>/dev/dri</code>, en lugar de asignarse en exclusiva a una VM.",
       "seeAlso": [
         {
           "label": "Añadir GPU a LXC",
@@ -214,37 +214,37 @@
     {
       "term": "ifupdown / ifupdown2",
       "category": "Red",
-      "definitionRich": "El clásico sistema de configuración de red de Debian que lee <code>/etc/network/interfaces</code>. <code>ifupdown2</code> es la versión reescrita que Proxmox usa por defecto — soporta recarga en vivo vía <code>ifreload -a</code>."
+      "definitionRich": "Sistema clásico de configuración de red de Debian, basado en <code>/etc/network/interfaces</code>. Proxmox utiliza su versión reescrita <code>ifupdown2</code>, que permite recargar la configuración en vivo con <code>ifreload -a</code>."
     },
     {
       "term": "initramfs",
       "category": "Linux",
-      "definitionRich": "Sistema de archivos en RAM inicial que el kernel usa al arrancar antes de montar el sistema de archivos raíz real. Contiene drivers necesarios pronto (almacenamiento, cifrado, RAID). Reconstruido con <code>update-initramfs -u -k all</code> tras cambios de VFIO, IOMMU o driver de almacenamiento."
+      "definitionRich": "Sistema de archivos inicial en RAM que usa el kernel antes de montar la raíz real. Contiene controladores necesarios al arrancar. Tras cambiar VFIO, IOMMU o los controladores de almacenamiento, se regenera con <code>update-initramfs -u -k all</code>."
     },
     {
       "term": "IOMMU",
       "aliases": [
-        "Input/Output Memory Management Unit",
+        "Unidad de gestión de memoria de entrada/salida",
         "VT-d",
         "AMD-Vi"
       ],
       "category": "Virtualización",
-      "definitionRich": "Función de hardware (Intel VT-d / AMD-Vi) que permite asignar dispositivos PCIe de forma segura directamente a VMs guest. Requerido para passthrough de GPU y controladores de disco. Debe habilitarse tanto en BIOS / UEFI como en la línea de comandos del kernel (<code>intel_iommu=on</code> o <code>amd_iommu=on</code>).",
+      "definitionRich": "Función de hardware (Intel VT-d / AMD-Vi) necesaria para asignar dispositivos PCIe a VM. Actívala en el firmware y comprueba que el kernel la usa. Según la plataforma y sus valores predeterminados, pueden necesitarse <code>intel_iommu=on</code> o <code>amd_iommu=on</code>.",
       "seeAlso": [
         {
           "label": "Post-instalación: virtualización",
           "href": "/docs/post-install/virtualization"
         },
         {
-          "label": "Añadir GPU a una VM (passthrough)",
+          "label": "Añadir GPU a una VM (acceso directo)",
           "href": "/docs/hardware/gpu-vm-passthrough"
         }
       ]
     },
     {
-      "term": "IOMMU group",
+      "term": "Grupo IOMMU",
       "category": "Virtualización",
-      "definitionRich": "La unidad más pequeña de dispositivos que el IOMMU puede aislar entre sí. Todos los dispositivos de un grupo deben pasarse juntos — normalmente un dispositivo, pero las tarjetas multi-función o los dispositivos que comparten root-port aterrizan en el mismo grupo. Se listan vía <code>find /sys/kernel/iommu_groups/ -type l | sort -V</code>."
+      "definitionRich": "Conjunto de dispositivos que forma la unidad mínima de aislamiento IOMMU. Sus miembros no están necesariamente aislados entre sí; revisa todos antes de asignar dispositivos con VFIO. Se listan con <code>find /sys/kernel/iommu_groups/ -type l | sort -V</code>."
     },
     {
       "term": "iSCSI",
@@ -252,7 +252,7 @@
         "Internet SCSI"
       ],
       "category": "Almacenamiento",
-      "definitionRich": "Protocolo de red que expone almacenamiento de bloques sobre IP — un disco remoto aparece como un dispositivo SCSI local. Se registra como almacenamiento de Proxmox vía <code>pvesm add iscsi</code>.",
+      "definitionRich": "Protocolo de almacenamiento por bloques sobre IP: el disco remoto aparece como un dispositivo SCSI local. Se registra en Proxmox con <code>pvesm add iscsi</code>.",
       "seeAlso": [
         {
           "label": "Añadir target iSCSI como almacenamiento de Proxmox",
@@ -263,10 +263,10 @@
     {
       "term": "KVM",
       "aliases": [
-        "Kernel-based Virtual Machine"
+        "Máquina Virtual basada en kernel"
       ],
       "category": "Virtualización",
-      "definitionRich": "Módulo del kernel de Linux que convierte el host en un hipervisor. Combinado con <strong>QEMU</strong> para emulación de dispositivos, es la base que Proxmox usa para ejecutar VMs."
+      "definitionRich": "Módulo del kernel Linux que convierte el host en hipervisor. Junto con <strong>QEMU</strong>, que emula dispositivos, constituye la base de las VM de Proxmox."
     },
     {
       "term": "LVM",
@@ -274,7 +274,7 @@
         "Logical Volume Manager"
       ],
       "category": "Almacenamiento",
-      "definitionRich": "Stack de almacenamiento de Linux que abstrae los discos físicos en grupos de volumen (VG) de volúmenes lógicos (LV). Proxmox usa pools LVM-thin para discos de VM por defecto. Herramientas concisas: <code>pvs</code>, <code>vgs</code>, <code>lvs</code>.",
+      "definitionRich": "Gestión de volúmenes Linux que agrupa almacenamiento físico en grupos (VG) con volúmenes lógicos (LV). Las instalaciones Proxmox basadas en LVM suelen usar LVM-thin para discos de invitados; existen otros backends. Herramientas: <code>pvs</code>, <code>vgs</code> y <code>lvs</code>.",
       "seeAlso": [
         {
           "label": "Comandos de almacenamiento y discos",
@@ -288,10 +288,10 @@
         "Linux Containers"
       ],
       "category": "Linux",
-      "definitionRich": "Tecnología de virtualización a nivel de SO — múltiples instancias aisladas de espacio de usuario comparten el kernel del host. Más ligera y rápida que las VMs pero menos aislada. Proxmox gestiona los contenedores LXC vía la CLI <code>pct</code>.",
+      "definitionRich": "Virtualización del sistema operativo: instancias aisladas del espacio de usuario comparten el kernel del host. Suele tener menos sobrecarga que una VM, con un aislamiento distinto. Proxmox gestiona los LXC con <code>pct</code>.",
       "seeAlso": [
         {
-          "label": "Gestión de VMs y CTs",
+          "label": "Gestión de VM y contenedores",
           "href": "/docs/help-info/vm-ct-commands"
         }
       ]
@@ -299,7 +299,7 @@
     {
       "term": "Lynis",
       "category": "Linux",
-      "definitionRich": "Auditor de seguridad de código abierto (de CISOfy) que escanea el host e imprime una puntuación de hardening más pistas concretas de remediación. ProxMenux instala el último de GitHub upstream en lugar del paquete (más antiguo) de Debian.",
+      "definitionRich": "Auditor de seguridad de código abierto de CISOfy. Analiza el host y presenta una puntuación de seguridad y recomendaciones concretas. ProxMenux instala la versión del repositorio original de GitHub en lugar del paquete más antiguo de Debian.",
       "seeAlso": [
         {
           "label": "Lynis",
@@ -308,12 +308,12 @@
       ]
     },
     {
-      "term": "MAC address",
+      "term": "Dirección MAC",
       "aliases": [
-        "Hardware address"
+        "Dirección de hardware"
       ],
       "category": "Red",
-      "definitionRich": "Identificador de 48 bits grabado en el firmware de una NIC. Usado por los <em>nombres de red persistentes</em> de Proxmox para fijar nombres de interfaz (<code>eno1</code>, <code>enp3s0</code>) para que sobrevivan a la reenumeración PCI.",
+      "definitionRich": "Identificador de una interfaz Ethernet, normalmente de 48 bits, asignado por hardware o software. <em>Nombres de red persistentes</em> de ProxMenux asocia las MAC a nombres estables (<code>eno1</code>, <code>enp3s0</code>) para conservarlos tras cambios en la enumeración PCI.",
       "seeAlso": [
         {
           "label": "Nombres de interfaz persistentes",
@@ -324,18 +324,18 @@
     {
       "term": "MOTD",
       "aliases": [
-        "Message of the Day"
+        "Mensaje del día"
       ],
       "category": "Linux",
-      "definitionRich": "Texto mostrado tras el login SSH. Almacenado en <code>/etc/motd</code>. La post-instalación de ProxMenux puede añadir un banner aquí; el desinstalador restaura el backup si lo aplicaste."
+      "definitionRich": "Texto mostrado tras iniciar sesión por SSH, guardado en <code>/etc/motd</code>. La postinstalación de ProxMenux puede añadir una cabecera; el desinstalador restaura el archivo anterior si existe una copia."
     },
     {
       "term": "NFS",
       "aliases": [
-        "Network File System"
+        "Sistema de archivos de red"
       ],
       "category": "Almacenamiento",
-      "definitionRich": "Protocolo de compartición de archivos en red nativo de Unix. Se registra como almacenamiento de Proxmox vía <code>pvesm add nfs</code>; también usable como cliente / servidor LXC vía flujos dedicados de ProxMenux.",
+      "definitionRich": "Protocolo de archivos en red originado en Unix. Se registra como almacenamiento Proxmox con <code>pvesm add nfs</code>; ProxMenux también permite configurar clientes y servidores NFS en LXC.",
       "seeAlso": [
         {
           "label": "Almacenamiento y compartición",
@@ -346,7 +346,7 @@
     {
       "term": "nftables / iptables",
       "category": "Red",
-      "definitionRich": "Sistemas de firewall de Linux. <code>nftables</code> es el motor moderno; <code>iptables</code> es el front-end heredado (sigue funcionando como capa de traducción). El <code>pve-firewall</code> de Proxmox emite reglas nftables desde la configuración del firewall del clúster.",
+      "definitionRich": "Herramientas de cortafuegos Linux. <code>nftables</code> es el sistema moderno; <code>iptables</code> puede usar el backend clásico o uno compatible con nft. <code>pve-firewall</code> usa iptables; el backend alternativo proxmox-firewall usa nftables.",
       "seeAlso": [
         {
           "label": "Comandos de red",
@@ -357,7 +357,7 @@
     {
       "term": "nouveau",
       "category": "Linux",
-      "definitionRich": "Driver NVIDIA de código abierto incluido con el kernel de Linux. Debe ponerse en blacklist antes de instalar el driver propietario NVIDIA, si no ambos cargan y la instalación falla.",
+      "definitionRich": "Controlador gráfico NVIDIA de código abierto incluido en Linux. Al instalar el controlador propietario, evita que nouveau controle la misma GPU, normalmente bloqueando su carga y regenerando initramfs.",
       "seeAlso": [
         {
           "label": "Guía de instalación de NVIDIA",
@@ -366,9 +366,9 @@
       ]
     },
     {
-      "term": "no-subscription repo",
+      "term": "Repositorio no-subscription",
       "category": "Proxmox",
-      "definitionRich": "Repositorio gratuito de Proxmox para usuarios sin suscripción enterprise. QA menos pulido que el repo enterprise (ligeramente más arriesgado para producción) pero gratis. Se configura automáticamente por la post-instalación de ProxMenux.",
+      "definitionRich": "Repositorio de paquetes Proxmox disponible sin suscripción empresarial. Sus paquetes reciben menos validación que los del repositorio enterprise, recomendado por Proxmox para producción. La postinstalación de ProxMenux permite configurar los repositorios.",
       "seeAlso": [
         {
           "label": "Post-instalación: ajustes básicos",
@@ -382,7 +382,7 @@
         "Open Virtualization Format"
       ],
       "category": "Virtualización",
-      "definitionRich": "Formatos de empaquetado estándar DMTF para VMs portables. <strong>OVA</strong> es un único archivo TAR; <strong>OVF</strong> es un directorio con un descriptor XML + archivos VMDK externos. Importables en VMware, VirtualBox y Proxmox.",
+      "definitionRich": "Formatos DMTF para distribuir VM. <strong>OVA</strong> reúne los archivos en un TAR; <strong>OVF</strong> describe la VM en XML acompañado de discos, habitualmente VMDK. La compatibilidad de importación depende del hipervisor y la configuración.",
       "seeAlso": [
         {
           "label": "Exportar VM a OVA / OVF",
@@ -397,14 +397,14 @@
     {
       "term": "OVMF",
       "aliases": [
-        "UEFI firmware",
+        "Firmware UEFI",
         "Open Virtual Machine Firmware"
       ],
       "category": "Virtualización",
-      "definitionRich": "Implementación de firmware UEFI para VMs. Se establece con <code>qm set &lt;vmid&gt; -bios ovmf</code>. Requerido para Windows 11, Secure Boot y la mayoría de instalaciones modernas de SO. Combínalo con un <code>efidisk0</code> para persistir las variables EFI.",
+      "definitionRich": "Firmware UEFI para VM, seleccionado con <code>qm set &lt;vmid&gt; -bios ovmf</code>. Se usa para invitados UEFI, como Windows 11 y configuraciones con Secure Boot. <code>efidisk0</code> conserva variables EFI; muchos otros invitados admiten BIOS clásico.",
       "seeAlso": [
         {
-          "label": "Añadir GPU a una VM (passthrough)",
+          "label": "Añadir GPU a una VM (acceso directo)",
           "href": "/docs/hardware/gpu-vm-passthrough"
         }
       ]
@@ -415,15 +415,15 @@
         "Proxmox Backup Server"
       ],
       "category": "Proxmox",
-      "definitionRich": "Producto independiente de Proxmox para backups incrementales, deduplicados y cifrados de VMs / CTs. Recomendado sobre vzdump plano cuando tienes una máquina aparte donde alojarlo."
+      "definitionRich": "Producto de copias de Proxmox con transferencias incrementales, deduplicación y cifrado opcional en el cliente para VM y CT. Puede ser destino de vzdump; es preferible un servidor separado a guardar copias en el propio host protegido."
     },
     {
       "term": "pct",
       "category": "Proxmox",
-      "definitionRich": "Herramienta CLI para gestionar contenedores LXC en Proxmox: <code>pct list / start / stop / shutdown / config / enter / exec / push / pull / destroy</code>.",
+      "definitionRich": "Herramienta de terminal para gestionar contenedores LXC en Proxmox: <code>pct list / start / stop / shutdown / config / enter / exec / push / pull / destroy</code>.",
       "seeAlso": [
         {
-          "label": "Gestión de VMs y CTs",
+          "label": "Gestión de VM y contenedores",
           "href": "/docs/help-info/vm-ct-commands"
         }
       ]
@@ -434,25 +434,25 @@
         "Proxmox Cluster Filesystem"
       ],
       "category": "Proxmox",
-      "definitionRich": "Sistema de archivos virtual basado en FUSE montado en <code>/etc/pve/</code>. Replica los cambios de configuración entre todos los nodos del clúster en tiempo real. Editar un archivo bajo <code>/etc/pve/</code> se propaga automáticamente."
+      "definitionRich": "Sistema de archivos virtual basado en FUSE, montado en <code>/etc/pve/</code>. Replica cambios de configuración entre nodos del clúster: las ediciones en <code>/etc/pve/</code> se propagan automáticamente."
     },
     {
       "term": "pveam",
       "aliases": [
-        "Proxmox VE Appliance Manager"
+        "Gestor de dispositivos virtuales de Proxmox VE"
       ],
       "category": "Proxmox",
-      "definitionRich": "CLI para gestionar el catálogo local de plantillas de CT. <code>pveam update</code> refresca el índice; <code>pveam available</code> lista plantillas; <code>pveam download &lt;storage&gt; &lt;template&gt;</code> descarga una."
+      "definitionRich": "Herramienta del catálogo local de plantillas CT. <code>pveam update</code> actualiza el índice; <code>pveam available</code> lista plantillas y <code>pveam download &lt;storage&gt; &lt;template&gt;</code> descarga una."
     },
     {
       "term": "pveproxy",
       "category": "Proxmox",
-      "definitionRich": "El servicio HTTPS que sirve la UI web de Proxmox en el puerto 8006 y el terminal web. Se reinicia automáticamente durante los upgrades mayores — por eso ProxMenux se niega a ejecutar el upgrade PVE 8 → 9 desde el terminal web."
+      "definitionRich": "Servicio HTTPS de la interfaz web de Proxmox y su terminal, en el puerto 8006. Se reinicia durante las actualizaciones mayores; por eso ProxMenux impide ejecutar la actualización PVE 8 → 9 desde la terminal web."
     },
     {
       "term": "pvesm",
       "aliases": [
-        "Proxmox Storage Manager"
+        "Gestor de almacenamiento de Proxmox"
       ],
       "category": "Proxmox",
       "definitionRich": "Herramienta CLI para gestionar el almacenamiento de Proxmox. <code>pvesm status</code> muestra todos los almacenamientos configurados; <code>pvesm add &lt;type&gt;</code> registra nuevos (NFS, Samba, iSCSI, dir, ZFS, LVM, …).",
@@ -464,14 +464,14 @@
       ]
     },
     {
-      "term": "Privileged container",
+      "term": "Contenedor privilegiado",
       "category": "Linux",
-      "definitionRich": "Contenedor LXC donde el usuario root dentro del contenedor <em>es</em> root en el host (UIDs no desplazados). Requerido para passthrough de hardware (dispositivos USB, compartición de GPU) y servidor Samba / NFS dentro del CT. Menos seguro que unprivileged — úsalo solo cuando sea necesario."
+      "definitionRich": "Contenedor LXC cuyo usuario root <em>corresponde al UID 0 del host</em>, aunque conserva namespaces y otras restricciones. Ofrece menos aislamiento que uno sin privilegios. GPU, USB y Samba no siempre requieren este modo: importan los permisos y el mapeo de UID."
     },
     {
       "term": "ProxMenux Monitor",
       "category": "ProxMenux",
-      "definitionRich": "Panel web opcional instalado junto a ProxMenux. Sirve estadísticas del host en tiempo real (CPU / RAM / disco / red), resumen de VMs y LXC, login + 2FA, en el puerto TCP <code>8008</code>.",
+      "definitionRich": "Panel web opcional instalado junto a ProxMenux. Muestra estadísticas del host en tiempo real (CPU, RAM, discos y red), un resumen de VM y LXC, e inicio de sesión con 2FA, en el puerto TCP <code>8008</code>.",
       "seeAlso": [
         {
           "label": "ProxMenux Monitor",
@@ -485,18 +485,18 @@
         "QEMU Copy-On-Write v2"
       ],
       "category": "Almacenamiento",
-      "definitionRich": "Formato de imagen de disco de VM por defecto en el almacenamiento de directorio de Proxmox. Soporta thin provisioning, snapshots y copy-on-write. Convierte con <code>qemu-img convert -O qcow2 ...</code>."
+      "definitionRich": "Formato de imagen de disco VM habitual en almacenamiento de directorio. Admite asignación de espacio bajo demanda, snapshots y copia en escritura. Convierte una imagen con <code>qemu-img convert -O qcow2 ...</code>."
     },
     {
       "term": "qm",
       "aliases": [
-        "QEMU Manager"
+        "Gestor de QEMU"
       ],
       "category": "Proxmox",
-      "definitionRich": "Herramienta CLI para gestionar VMs en Proxmox: <code>qm list / start / stop / shutdown / config / set / destroy / importdisk / migrate</code>. Comando hermano de <code>pct</code> para contenedores.",
+      "definitionRich": "Herramienta para gestionar VM en Proxmox: <code>qm list / start / stop / shutdown / config / set / destroy / importdisk / migrate</code>. Equivale a <code>pct</code> para contenedores.",
       "seeAlso": [
         {
-          "label": "Gestión de VMs y CTs",
+          "label": "Gestión de VM y contenedores",
           "href": "/docs/help-info/vm-ct-commands"
         }
       ]
@@ -504,20 +504,20 @@
     {
       "term": "Q35",
       "category": "Virtualización",
-      "definitionRich": "Tipo de máquina moderno de QEMU que emula un chipset Intel Q35 con soporte PCIe. Recomendado sobre el antiguo i440FX para VMs que necesitan passthrough PCIe o soporte de SO guest moderno. Se establece con <code>qm set &lt;vmid&gt; -machine q35</code>."
+      "definitionRich": "Tipo de máquina QEMU que emula el chipset Intel Q35 con PCIe. Recomendado frente a i440FX para VM con asignación directa PCIe o sistemas modernos. Se configura con <code>qm set &lt;vmid&gt; -machine q35</code>."
     },
     {
       "term": "QEMU",
       "category": "Virtualización",
-      "definitionRich": "Emulador y virtualizador de máquinas genérico, de código abierto. Combinado con KVM en Proxmox para ejecutar VMs a velocidad casi nativa."
+      "definitionRich": "Emulador y virtualizador de máquinas de código abierto. Proxmox lo combina con KVM para ejecutar VM con rendimiento cercano al nativo."
     },
     {
       "term": "rclone",
       "category": "Linux",
-      "definitionRich": "Herramienta de línea de comandos que habla con ~50 proveedores de almacenamiento en la nube (Google Drive, Dropbox, OneDrive, Mega, S3, …). Usada en la guía de backup en la nube de Proxmox para montar una nube personal como un directorio en el que el host pueda escribir archivos vzdump.",
+      "definitionRich": "Herramienta de terminal compatible con numerosos proveedores de almacenamiento, como Google Drive, Dropbox, OneDrive, Mega y S3. La guía de copias en la nube la usa para montar un directorio remoto donde guardar archivos vzdump.",
       "seeAlso": [
         {
-          "label": "Backup a nube personal",
+          "label": "Copias a la nube personal",
           "href": "/guides/backup_cloud"
         }
       ]
@@ -525,7 +525,7 @@
     {
       "term": "Samba / SMB / CIFS",
       "category": "Almacenamiento",
-      "definitionRich": "Familia de protocolos de compartición de archivos de Microsoft. <strong>SMB</strong> es el protocolo; <strong>Samba</strong> es la implementación de código abierto en Linux; <strong>CIFS</strong> es un dialecto SMB más antiguo. Se registra como almacenamiento de Proxmox vía <code>pvesm add cifs</code>.",
+      "definitionRich": "Familia de protocolos de archivos de Microsoft. <strong>SMB</strong> es el protocolo; <strong>Samba</strong>, su implementación abierta para Linux; y <strong>CIFS</strong>, un dialecto antiguo de SMB. Se registra en Proxmox con <code>pvesm add cifs</code>.",
       "seeAlso": [
         {
           "label": "Almacenamiento y compartición",
@@ -536,7 +536,7 @@
     {
       "term": "SeaBIOS",
       "category": "Virtualización",
-      "definitionRich": "Implementación de código abierto de BIOS heredado usada por QEMU. Firmware por defecto para nuevas VMs salvo que cambies a OVMF. Apropiado para SO más antiguos e instalaciones simples de Linux que no necesitan UEFI."
+      "definitionRich": "Implementación abierta de BIOS clásico utilizada por QEMU. Firmware predeterminado de VM nuevas salvo que elijas OVMF. Adecuado para sistemas antiguos e instalaciones Linux que no necesitan UEFI."
     },
     {
       "term": "smartctl / SMART",
@@ -544,7 +544,7 @@
         "Self-Monitoring, Analysis and Reporting Technology"
       ],
       "category": "Almacenamiento",
-      "definitionRich": "Diagnósticos de disco integrados que reportan salud del drive, conteos de errores y resultados de self-tests. <code>smartctl</code> (de <code>smartmontools</code>) es la CLI; para drives NVMe, el paquete <code>nvme-cli</code> añade comandos específicos de NVMe.",
+      "definitionRich": "Diagnóstico integrado de discos que informa del estado, los errores y las pruebas internas. La herramienta es <code>smartctl</code>, del paquete <code>smartmontools</code>; <code>nvme-cli</code> añade comandos específicos para NVMe.",
       "seeAlso": [
         {
           "label": "Salud y test SMART de discos",
@@ -559,12 +559,12 @@
     {
       "term": "systemd / systemctl / journalctl",
       "category": "Linux",
-      "definitionRich": "Sistema init moderno usado por Debian / Proxmox. <code>systemctl</code> gestiona servicios (start / stop / enable / status). <code>journalctl</code> lee el log binario escrito por <code>systemd-journald</code>."
+      "definitionRich": "Sistema de inicio de Debian / Proxmox. <code>systemctl</code> gestiona servicios (iniciar, detener, habilitar y consultar el estado). <code>journalctl</code> lee el registro binario de <code>systemd-journald</code>."
     },
     {
       "term": "sysctl",
       "category": "Linux",
-      "definitionRich": "Gestión de parámetros del kernel. Lee <code>/etc/sysctl.conf</code> + <code>/etc/sysctl.d/*.conf</code> al arrancar. La post-instalación de ProxMenux entrega un perfil curado de tuning de sysctl.",
+      "definitionRich": "Herramienta para leer y cambiar parámetros del kernel. Los ajustes persistentes suelen ir en <code>/etc/sysctl.d/*.conf</code>; la lectura de <code>/etc/sysctl.conf</code> depende del cargador. La postinstalación de ProxMenux ofrece un perfil de ajustes sysctl.",
       "seeAlso": [
         {
           "label": "Post-instalación: red",
@@ -575,7 +575,7 @@
     {
       "term": "trixie",
       "category": "Linux",
-      "definitionRich": "Codename para Debian 13, la base de SO para Proxmox VE 9. Predecesor: <em>bookworm</em> (Debian 12 / PVE 8).",
+      "definitionRich": "Nombre en clave de Debian 13, base de Proxmox VE 9. Su predecesor es <em>bookworm</em> (Debian 12 / PVE 8).",
       "seeAlso": [
         {
           "label": "Actualizar PVE 8 a PVE 9",
@@ -586,15 +586,15 @@
     {
       "term": "udev",
       "category": "Linux",
-      "definitionRich": "Gestor de dispositivos de Linux. Reacciona a eventos de hardware y crea / elimina entradas bajo <code>/dev</code>. Reglas propias en <code>/etc/udev/rules.d/</code> mapean persistentemente direcciones MAC a nombres de interfaz, configuran nodos de dispositivo NVIDIA al cargar el driver, etc."
+      "definitionRich": "Gestor de dispositivos Linux. Responde a eventos de hardware y crea o elimina entradas en <code>/dev</code>. Las reglas de <code>/etc/udev/rules.d/</code> permiten fijar nombres por MAC, crear dispositivos NVIDIA al cargar el controlador y otras tareas."
     },
     {
       "term": "UID / GID idmap",
       "aliases": [
-        "UID shift"
+        "Cambio UID"
       ],
       "category": "Linux",
-      "definitionRich": "En contenedores LXC <strong>unprivileged</strong>, los UIDs y GIDs se desplazan en <code>+100000</code> en el host. UID 0 del contenedor = UID 100000 del host, UID 1000 del contenedor = UID 101000 del host, etc. Afecta a la propiedad de archivos en bind mounts.",
+      "definitionRich": "Con el mapeo predeterminado de LXC <strong>sin privilegios</strong>, los UID y GID del host se desplazan <code>+100000</code>: UID 0 corresponde a 100000 y 1000 a 101000. Los mapeos personalizados pueden variar; los propietarios en montajes bind deben corresponder al mapeo elegido.",
       "seeAlso": [
         {
           "label": "Puntos de montaje LXC",
@@ -603,17 +603,17 @@
       ]
     },
     {
-      "term": "Unprivileged container",
+      "term": "Contenedor sin privilegios",
       "category": "Linux",
-      "definitionRich": "Contenedor LXC donde root dentro está mapeado a un UID sin privilegios en el host (desplazamiento de UID +100000). Más seguro que privileged pero no puede hacer passthrough de hardware ni ejecutar servicios a nivel de kernel. Por defecto para la mayoría de casos de uso."
+      "definitionRich": "Contenedor LXC cuyo root corresponde a un UID sin privilegios del host, normalmente 100000. Reduce sus privilegios aunque comparte el kernel. El acceso al hardware puede configurarse con permisos y mapeos adecuados; el modo privilegiado no siempre es necesario."
     },
     {
       "term": "VFIO",
       "aliases": [
-        "Virtual Function I/O"
+        "Función Virtual I/O"
       ],
       "category": "Virtualización",
-      "definitionRich": "Framework del kernel de Linux para drivers de dispositivo seguros en espacio de usuario — usado para asociar dispositivos PCIe a VMs para passthrough directo. Se habilita cargando los módulos del kernel <code>vfio</code>, <code>vfio_iommu_type1</code> y <code>vfio_pci</code>, configurados vía <code>/etc/modprobe.d/vfio.conf</code>.",
+      "definitionRich": "Sistema del kernel Linux para controladores seguros en espacio de usuario, usado al asignar dispositivos PCIe directamente a VM. Intervienen <code>vfio</code>, <code>vfio_iommu_type1</code> y <code>vfio_pci</code>, con configuración en <code>/etc/modprobe.d/vfio.conf</code>.",
       "seeAlso": [
         {
           "label": "Post-instalación: virtualización",
@@ -624,26 +624,26 @@
     {
       "term": "VirtIO",
       "category": "Virtualización",
-      "definitionRich": "Familia de drivers de dispositivo paravirtualizados (red, almacenamiento, balloon, GPU) que corren más rápido que el hardware heredado emulado (p. ej. NICs e1000, discos IDE). El guest necesita el driver VirtIO correspondiente — nativo del kernel en Linux, instalación separada de ISO en Windows."
+      "definitionRich": "Familia de controladores paravirtualizados de red, almacenamiento, memoria dinámica y GPU. Evitan la sobrecarga de emular hardware antiguo como e1000 o IDE. El invitado necesita los controladores: integrados en Linux y disponibles en una ISO para Windows."
     },
     {
       "term": "VLAN",
       "aliases": [
-        "Virtual LAN"
+        "Red de área local virtual"
       ],
       "category": "Red",
-      "definitionRich": "Tags 802.1Q que segmentan una red física en múltiples redes lógicas. Se configura por bridge o por NIC en <code>/etc/network/interfaces</code>."
+      "definitionRich": "Etiquetas 802.1Q para dividir una red física en varias redes lógicas. Se configuran por bridge o interfaz en <code>/etc/network/interfaces</code>."
     },
     {
       "term": "VM",
       "aliases": [
-        "Virtual Machine"
+        "Máquina virtual"
       ],
       "category": "Proxmox",
-      "definitionRich": "Una emulación completa de máquina gestionada por Proxmox vía QEMU/KVM. Tiene un VMID numérico que mapea a <code>/etc/pve/qemu-server/&lt;VMID&gt;.conf</code>. Más pesada que los contenedores LXC pero totalmente aislada.",
+      "definitionRich": "Máquina virtual gestionada por Proxmox con QEMU/KVM, con su propio kernel. Su VMID numérico corresponde a <code>/etc/pve/qemu-server/&lt;VMID&gt;.conf</code>. Suele tener más sobrecarga que LXC, con aislamiento mediante un kernel separado.",
       "seeAlso": [
         {
-          "label": "Gestión de VMs y CTs",
+          "label": "Gestión de VM y contenedores",
           "href": "/docs/help-info/vm-ct-commands"
         }
       ]
@@ -651,10 +651,10 @@
     {
       "term": "vzdump",
       "category": "Proxmox",
-      "definitionRich": "Herramienta de backup integrada de Proxmox para VMs y CTs. <strong>No incremental</strong> — cada backup es un snapshot completo. Configura modos (snapshot / suspend / stop), compresión (zstd / pigz / lzo), retención y notificación por trabajo.",
+      "definitionRich": "Herramienta de copias de VM y CT de Proxmox. Los archivos de copia <strong>no son incrementales</strong>; los destinos PBS admiten transferencias incrementales. Cada tarea configura modo (snapshot / suspend / stop), compresión (como zstd, gzip o lzo), retención y avisos.",
       "seeAlso": [
         {
-          "label": "Comandos de backup y restauración",
+          "label": "Comandos de copias y restauración",
           "href": "/docs/help-info/backup-commands"
         }
       ]
@@ -665,10 +665,10 @@
         "Zettabyte File System"
       ],
       "category": "Almacenamiento",
-      "definitionRich": "Sistema de archivos combinado con gestor de volúmenes conocido por sus snapshots, replicación send/receive, checksums end-to-end, compresión y auto-reparación. Hambriento de memoria (mira <strong>ARC</strong>) pero extremadamente robusto.",
+      "definitionRich": "Sistema de archivos y gestor de volúmenes con snapshots, replicación send/receive, sumas de comprobación y compresión. Puede reparar datos dañados si dispone de una copia redundante válida. La caché <strong>ARC</strong> usa RAM y puede limitarse.",
       "seeAlso": [
         {
-          "label": "Comandos de gestión de ZFS",
+          "label": "Comandos de gestión ZFS",
           "href": "/docs/help-info/zfs-commands"
         }
       ]
diff --git a/web/messages/es/docs/hardware/coral-tpu-lxc.json b/web/messages/es/docs/hardware/coral-tpu-lxc.json
index 6b169463..222c734f 100644
--- a/web/messages/es/docs/hardware/coral-tpu-lxc.json
+++ b/web/messages/es/docs/hardware/coral-tpu-lxc.json
@@ -1,81 +1,81 @@
 {
   "meta": {
-    "title": "Añadir Coral TPU a LXC | ProxMenux Documentation",
-    "description": "Pasa una Google Coral TPU (USB o M.2 / PCIe) a un contenedor LXC de Proxmox. ProxMenux escribe las entradas correctas de dev / cgroup / mount para cada variante, arranca el contenedor e instala el runtime de Edge TPU dentro para que apps como Frigate puedan usar el acelerador."
+    "title": "Añadir Coral TPU a LXC | Documentación de ProxMenux",
+    "description": "Comparte una Google Coral TPU USB o M.2 / PCIe con un contenedor LXC de Proxmox. ProxMenux configura dispositivos, permisos y montajes, arranca el contenedor e instala el runtime Edge TPU en distribuciones compatibles."
   },
   "header": {
     "title": "Añadir Coral TPU a LXC",
-    "description": "Comparte una Google Coral TPU (USB Accelerator o M.2 / Mini-PCIe) con un contenedor LXC de Proxmox. ProxMenux se encarga de la config del LXC y de la instalación del runtime Edge TPU dentro del contenedor. Coral es solo TPU: para compartir GPU / iGPU (Quick Sync, VA-API, NVENC) en el mismo contenedor, ejecuta Añadir GPU a LXC por separado.",
-    "section": "Hardware: GPUs y Coral-TPU"
+    "description": "Comparte una Coral USB Accelerator o M.2 / Mini-PCIe con un LXC. ProxMenux configura el contenedor y el runtime Edge TPU. Esta opción solo gestiona la TPU: para Quick Sync, VA-API o NVENC, ejecuta también Añadir GPU a LXC.",
+    "section": "Hardware: GPU y Coral-TPU"
   },
   "intro": {
-    "title": "Qué hace esto",
-    "body": "Escribe la config de passthrough en <code>/etc/pve/lxc/&lt;ctid&gt;.conf</code> — entradas distintas dependiendo de si el host tiene un <strong>USB Accelerator</strong>, una <strong>Coral M.2 / PCIe</strong>, o ambos. Luego arranca el contenedor e instala el último runtime <code>libedgetpu</code> de Google dentro de él. El passthrough de iGPU / GPU lo gestiona un script aparte (<lxcGpuLink>Añadir GPU a LXC</lxcGpuLink>) — este se centra en la TPU."
+    "title": "Qué hace",
+    "body": "Escribe la configuración en <code>/etc/pve/lxc/&lt;ctid&gt;.conf</code> para <strong>USB Accelerator</strong>, <strong>Coral M.2 / PCIe</strong> o ambos. Arranca el contenedor e instala el runtime <code>libedgetpu</code> de Google. La GPU se gestiona por separado en <lxcGpuLink>Añadir GPU a LXC</lxcGpuLink>."
   },
   "whenUse": {
-    "heading": "Cuándo usar esto",
-    "body": "Caso de uso típico: ejecutar <frigateLink>Frigate</frigateLink>, Agent DVR, Blue Iris + CodeProject.AI o cualquier otra app de detección de objetos dentro de un LXC y querer que la Coral TPU haga la inferencia ML en lugar de la CPU. Con Coral, la latencia de inferencia baja de ~100 ms a ~5 ms por frame y la carga de CPU se mantiene cerca de cero."
+    "heading": "Cuándo usarlo",
+    "body": "Úsalo con <frigateLink>Frigate</frigateLink> u otra aplicación Linux compatible en LXC. Coral ejecuta la inferencia compatible en lugar de la CPU. El rendimiento depende del modelo y el hardware; la decodificación y el resto de la aplicación siguen consumiendo recursos."
   },
   "prereqs": {
     "title": "Antes de empezar",
-    "drivers": "<strong>Drivers de Coral ya instalados en el host</strong>. Este script no los instala; solo configura el passthrough al contenedor. Ejecuta <hostLink>Install Coral TPU on the Host</hostLink> primero si no lo has hecho.",
+    "drivers": "<strong>Prepara la Coral en el host</strong>. M.2 / PCIe necesita el controlador cargado; USB, acceso al dispositivo y permisos adecuados. Consulta <hostLink>Instalar Coral TPU en el host</hostLink>. El script instala el runtime de la aplicación en contenedores Debian/Ubuntu; en otras distribuciones hay que instalarlo aparte.",
     "driversCheck": "ls /dev/apex_* 2>/dev/null ; lsusb | grep -E '1a6e:089a|18d1:9302'",
-    "container": "<strong>Un contenedor LXC existente</strong>, idealmente con una distro basada en <strong>Debian / Ubuntu</strong> — la instalación del runtime dentro del contenedor usa <code>apt-get</code>. Los <strong>contenedores no-Debian</strong> (Alpine, Arch, RHEL, SUSE…) siguen estando soportados en <strong>modo passthrough-only</strong>: el script detecta la distro y ofrece un prompt para saltarse la instalación APT de <code>libedgetpu</code> mientras escribe la config de passthrough del dispositivo — útil para contenedores de aplicación que ya incluyen el runtime (p.ej. la imagen Docker de Frigate).",
-    "downtime": "<strong>Asume una breve interrupción</strong> del contenedor. El script lo para para aplicar los cambios de config y lo arranca de nuevo para instalar los drivers dentro. No hace falta reiniciar el host."
+    "container": "<strong>Un LXC existente</strong>, preferiblemente basado en <strong>Debian / Ubuntu</strong>: la instalación usa <code>apt-get</code>. Los <strong>contenedores de otras distribuciones</strong> pueden usar el <strong>modo de solo acceso al dispositivo</strong>, que omite la instalación APT de <code>libedgetpu</code>. Resulta útil si la aplicación ya incluye ese runtime, como la imagen Docker de Frigate.",
+    "downtime": "<strong>Prepara una breve interrupción</strong> del contenedor. El script lo detiene para cambiar la configuración y lo arranca para instalar el runtime. No necesita reiniciar el host para estos cambios."
   },
   "hostPrep": {
     "title": "El host debe estar preparado primero",
-    "body": "Si ejecutas este script antes de instalar los drivers de Coral en el host (el módulo de kernel <code>gasket</code>/<code>apex</code> para M.2, el runtime <code>libedgetpu</code> para USB), la config del LXC se escribe igualmente pero el contenedor no encontrará el dispositivo en tiempo de ejecución. El orden importa: <strong>instalación en el host → passthrough al LXC → app dentro del contenedor</strong>."
+    "body": "M.2 / PCIe necesita <code>gasket</code>/<code>apex</code> en el host y un dispositivo funcional. USB necesita conexión y permisos; la aplicación no tiene que ejecutarse en el host. El runtime <code>libedgetpu</code> debe estar donde se ejecute la app. Sigue el orden <strong>preparar host → acceso desde LXC → configurar app</strong>."
   },
   "running": {
     "heading": "Ejecutar el script",
-    "body": "Abre ProxMenux en el host, ve a <strong>Hardware: GPUs and Coral-TPU → Add Coral TPU to LXC</strong>.",
-    "imageAlt": "Entrada del menú 'Add Coral TPU to LXC' dentro de Hardware: GPUs and Coral-TPU"
+    "body": "En ProxMenux, abre <strong>Hardware: GPU y Coral-TPU → Añadir Coral TPU a LXC</strong>.",
+    "imageAlt": "Opción Añadir Coral TPU a LXC en el menú de hardware"
   },
   "howRuns": {
-    "heading": "Cómo se ejecuta el script",
-    "body": "Una decisión por adelantado (¿qué contenedor?), luego el script gestiona los caminos USB y PCIe de forma independiente según lo que encuentre en el host. Si ambos están presentes, ambos se pasan."
+    "heading": "Cómo funciona el script",
+    "body": "Elige el contenedor. El script configura el acceso USB aunque no haya una Coral USB conectada y añade M.2 / PCIe cuando detecta ese hardware."
   },
   "walkthrough": {
-    "heading": "Recorriendo el flujo",
+    "heading": "Proceso paso a paso",
     "pick": {
       "title": "Elige el contenedor LXC",
-      "body": "Un diálogo muestra cada LXC del host (desde <code>pct list</code>). Elige el que debería recibir la Coral. En ejecución o parado, da igual — el script gestiona ambos casos (lo para brevemente para escribir la config y luego lo arranca de nuevo para instalar los drivers)."
+      "body": "El selector muestra los contenedores compatibles de <code>pct list</code>; los OCI se ocultan y se gestionan desde Apps del gestor OCI. Elige uno, esté arrancado o parado. El script lo detiene si hace falta, configura y lo arranca para instalar el runtime."
     },
     "gpuHint": {
-      "title": "Sugerencia de passthrough de GPU (opcional)",
-      "body": "Si el host tiene una GPU (Intel iGPU, AMD, NVIDIA) y el contenedor elegido NO tiene passthrough de GPU configurado, el script muestra un diálogo único sugiriendo que ejecutes <lxcGpuLink>Añadir GPU a LXC</lxcGpuLink> primero. La Coral suele combinarse con decodificación de vídeo por hardware (Quick Sync, VA-API, NVENC) para apps como Frigate. Puedes decir sí (sale, ejecutas el script de GPU y vuelves) o no (continúa con el setup solo de TPU)."
+      "title": "Sugerencia opcional de acceso a GPU",
+      "body": "Si detecta GPU pero no está configurada para el contenedor, recomienda <lxcGpuLink>Añadir GPU a LXC</lxcGpuLink> para decodificación de vídeo (Quick Sync, VA-API o NVENC). Pregunta si quieres continuar solo con Coral: Sí continúa; No sale para que configures antes la GPU."
     },
     "usb": {
-      "title": "Escribir la config del LXC — ruta USB",
-      "body": "Si hay un USB Accelerator presente, el script hace dos cosas: (1) escribe una regla udev en el host para que el dispositivo tenga un nombre estable <code>/dev/coral</code> independientemente del puerto USB en el que esté, y (2) hace bind-mount del árbol <strong>completo</strong> <code>/dev/bus/usb</code> dentro del contenedor.",
+      "title": "Configurar el acceso USB del LXC",
+      "body": "Crea una regla udev en el host para <code>/dev/coral</code> y monta el árbol <strong>completo</strong> <code>/dev/bus/usb</code> en el contenedor. Lo configura aunque no haya una Coral USB conectada; expone más dispositivos que solo la Coral.",
       "whyTitle": "¿Por qué montar /dev/bus/usb en lugar de /dev/coral?",
-      "whyBody": "La ruta del nodo del dispositivo USB (p. ej. <code>/dev/bus/usb/001/005</code>) cambia cuando reconectas el acelerador a otro puerto. Versiones anteriores del script hacían bind-mount del symlink <code>/dev/coral</code>, que apuntaba a una ruta vieja y se rompía. Montar el árbol USB completo significa que el contenedor ve la ruta actual sea cual sea, así que reconectar simplemente funciona."
+      "whyBody": "La ruta USB, por ejemplo <code>/dev/bus/usb/001/005</code>, cambia al reconectar el acelerador. Las versiones antiguas montaban el enlace <code>/dev/coral</code> y podían conservar una ruta obsoleta. Montar todo el árbol USB permite ver el nodo actual. Puede que la aplicación tenga que volver a abrirlo."
     },
     "pcie": {
-      "title": "Escribir la config del LXC — ruta M.2 / PCIe",
-      "body1": "Si hay una Coral M.2 / PCIe presente en el host y <code>/dev/apex_0</code> existe (el módulo de kernel apex está cargado), el script usa la API moderna <code>dev</code> de Proxmox que gestiona los permisos de cgroup2 automáticamente tanto para contenedores privilegiados como unprivileged:",
-      "body2": "Si el host aún no ha arrancado con el módulo apex cargado (acabas de ejecutar <hostLink>Install Coral on Host</hostLink> y no has reiniciado), <code>/dev/apex_0</code> aún no existe. El script recurre al cgroup2 + bind mount clásico con <code>create=file</code> para que las entradas sean válidas incluso cuando el dispositivo no se ha materializado:",
+      "title": "Configurar el acceso M.2 / PCIe del LXC",
+      "body1": "Si detecta una Coral M.2 / PCIe y existe <code>/dev/apex_0</code>, usa la API <code>dev</code> de Proxmox para gestionar cgroup2 tanto en LXC privilegiados como sin privilegios:",
+      "body2": "Si acabas de ejecutar <hostLink>Instalar Coral en el host</hostLink> y aún no existe <code>/dev/apex_0</code>, escribe un montaje con <code>create=file</code> y, solo si el número mayor de apex aparece en <code>/proc/devices</code>, una regla clásica cgroup2. Ninguno de los dos crea un dispositivo funcional:",
       "rebootTitle": "Reinicia el host primero si acabas de instalar los drivers de Coral",
-      "rebootBody": "El fallback de cgroup2 + mount se escribirá, pero el dispositivo solo existe realmente después de un reinicio del host que cargue el módulo <code>apex</code>. Si no has reiniciado, reinicia ahora antes de arrancar el contenedor."
+      "rebootBody": "El montaje alternativo no carga <code>apex</code> en el host. Carga el controlador o reinicia tras instalarlo y comprueba el dispositivo. Cuando esté listo, ejecuta otra vez el script para aplicar la entrada moderna y reinicia el contenedor."
     },
     "drivers": {
-      "title": "Arrancar el contenedor + instalar el runtime de Coral dentro",
-      "body": "Los cambios de config en LXC de Proxmox surten efecto en el siguiente arranque — así que el script arranca el contenedor, espera hasta 15 segundos a que <code>pct exec</code> responda y luego deja un bash script dentro que:",
+      "title": "Arrancar el LXC e instalar el runtime de Coral",
+      "body": "Arranca el contenedor, espera hasta 15 segundos a que su estado sea «running» y usa <code>pct exec</code> para ejecutar el instalador dentro. Este instalador:",
       "items": [
         "Ejecuta <code>apt-get update</code>.",
-        "Instala los prerequisitos del repositorio Coral: <code>gnupg</code>, <code>curl</code>, <code>ca-certificates</code>.",
+        "Instala los requisitos del repositorio Coral: <code>gnupg</code>, <code>curl</code> y <code>ca-certificates</code>.",
         "Importa la clave GPG de Coral de Google en <code>/etc/apt/keyrings/coral-edgetpu.gpg</code> (ruta moderna, la misma que usa el instalador del host) y añade el repositorio APT <code>coral-edgetpu-stable</code> con <code>signed-by=</code>.",
-        "Instala el último <code>libedgetpu1-std</code> (por defecto). Si tienes una Coral M.2, se te preguntará entre <code>libedgetpu1-std</code> (estándar) y <code>libedgetpu1-max</code> (máximo rendimiento, calienta más)."
+        "Instala <code>libedgetpu1-std</code> por defecto. Si detecta Coral M.2, ofrece <code>libedgetpu1-std</code> o <code>libedgetpu1-max</code>. Elegir el paquete no configura por sí solo la detección de la aplicación."
       ],
       "noIgpuTitle": "¿Por qué no hay drivers de iGPU aquí?",
-      "noIgpuBody": "Versiones anteriores de este script también instalaban Intel <code>va-driver-all</code>, <code>intel-opencl-icd</code> y compañía para que el mismo contenedor pudiera hacer decode de vídeo Quick Sync junto a la inferencia de Coral. Esa doble responsabilidad causaba fallos confusos cuando el usuario solo quería Coral. El lado iGPU es ahora trabajo exclusivo de <lxcGpuLink>Añadir GPU a LXC</lxcGpuLink> — ejecútalo primero si también quieres decode de vídeo por hardware en el contenedor.",
-      "debianTitle": "Contenedores no-Debian — modo passthrough-only",
-      "debianBody": "La instalación del runtime dentro del contenedor usa <code>apt-get</code>, que solo viene con distros de la familia Debian/Ubuntu. En contenedores <strong>Alpine, Arch, RHEL o SUSE</strong> el script detecta la distro vía <code>/etc/os-release</code> y muestra un prompt de confirmación: <em>continuar en modo passthrough-only</em> (escribe la config del dispositivo en <code>/etc/pve/lxc/&lt;ctid&gt;.conf</code> y se salta la instalación APT de <code>libedgetpu</code>) o <em>cancelar</em>. Passthrough-only es la opción correcta si el contenedor de aplicación que va a usar Coral ya incluye el runtime — el ejemplo canónico es la imagen Docker de Frigate. Si no, sigue la <coralLink>guía oficial</coralLink> de Google para instalar <code>libedgetpu</code> manualmente después de que el script haya escrito la config del LXC."
+      "noIgpuBody": "Antes también instalaba <code>va-driver-all</code>, <code>intel-opencl-icd</code> y otros paquetes Intel para combinar Quick Sync y Coral. Esa mezcla provocaba fallos confusos cuando solo se quería Coral. Ahora la iGPU se configura con <lxcGpuLink>Añadir GPU a LXC</lxcGpuLink>; ejecútalo primero si necesitas decodificación de vídeo por hardware.",
+      "debianTitle": "Otras distribuciones: solo acceso al dispositivo",
+      "debianBody": "Instala con <code>apt-get</code> en Debian/Ubuntu. En <strong>Alpine, Arch, RHEL o SUSE</strong>, detectados mediante <code>/etc/os-release</code>, ofrece <em>continuar solo con el acceso al dispositivo</em>: configura <code>/etc/pve/lxc/&lt;ctid&gt;.conf</code> sin instalar <code>libedgetpu</code>; o <em>cancelar</em>. Si la app ya incluye el runtime, como Frigate Docker, basta ese modo. Si no, instala <code>libedgetpu</code> siguiendo la <coralLink>guía oficial de Google</coralLink>."
     },
     "summary": {
       "title": "Resumen",
-      "body": "El script imprime una checklist al final resumiendo qué se habilitó (Coral USB, Coral M.2) con marcas ✓ o ⚠ según si el hardware se detectó realmente. El contenedor sigue en ejecución — puedes saltar directamente a la config de Frigate / CodeProject.AI / tu app."
+      "body": "Al terminar muestra Coral USB y M.2 con ✓ o ⚠ según la detección del hardware. El contenedor queda arrancado para configurar Frigate, CodeProject.AI o tu aplicación."
     }
   },
   "manual": {
@@ -83,37 +83,37 @@
     "body": "Si quieres ver exactamente qué va en la config del LXC, o aplicarlo a mano:",
     "usbHeading": "Coral USB",
     "pcieHeading": "Coral M.2 / PCIe",
-    "runtimeHeading": "Dentro del contenedor — runtime de Coral"
+    "runtimeHeading": "Dentro del contenedor: runtime de Coral"
   },
   "verification": {
     "heading": "Verificación",
-    "body": "Entra en el contenedor y comprueba que la Coral es visible:"
+    "body": "Entra en el contenedor y comprueba que Coral es visible:"
   },
   "troubleshoot": {
     "heading": "Solución de problemas",
-    "apexTitle": "El contenedor arrancó pero /dev/apex_0 no está dentro",
-    "apexBody": "El módulo apex del host no está cargado. En el host: <code>lsmod | grep apex</code> — si está vacío, ejecuta <code>modprobe apex</code>, o reinicia si acabas de instalar los drivers de Coral. Una vez el host tenga <code>/dev/apex_0</code>, reinicia el contenedor: <code>pct stop &lt;ctid&gt; &amp;&amp; pct start &lt;ctid&gt;</code>.",
-    "replugTitle": "La Coral USB desaparece al reconectarla en otro puerto",
-    "replugBody": "Justo por eso el script monta <code>/dev/bus/usb</code> en lugar del symlink <code>/dev/coral</code>. Si te pasa esto, comprueba que tu config del LXC tiene <code>lxc.mount.entry: /dev/bus/usb dev/bus/usb ...</code> y no una referencia directa a <code>/dev/coral</code>. Las configs viejas de versiones anteriores del script pueden necesitar actualizarse — vuelve a ejecutar el script sobre el mismo contenedor y la config se refresca.",
-    "alpineTitle": "Contenedor Alpine / Arch / RHEL / SUSE — runtime no instalado",
-    "alpineBody": "Si elegiste <em>modo passthrough-only</em> cuando el script lo preguntó, la config del LXC se escribió y el dispositivo Coral es visible dentro del contenedor, pero el runtime <code>libedgetpu</code> no está instalado. Es así por diseño: el repo APT de Google solo se publica para Debian/Ubuntu. Instala el runtime manualmente con el gestor de paquetes de tu distro (Alpine: <code>apk add</code>; Arch: AUR; RHEL/SUSE: compilar desde fuente) siguiendo la guía oficial de Google, o usa un contenedor de aplicación que incluya el runtime — la imagen Docker de Frigate es el ejemplo canónico: solo expone el dispositivo con <code>--device /dev/apex_0:/dev/apex_0</code> (M.2) o el bind mount USB que el script ya escribió (USB).",
-    "frigateTitle": "Frigate dice 'Coral EdgeTPU detected but not available'",
-    "frigateBody": "Casi siempre es un problema de permisos dentro del contenedor. Frigate corre como root por defecto; comprueba que el usuario root está en el grupo <code>plugdev</code> dentro del contenedor (para USB), y que el proceso puede leer <code>/dev/apex_0</code> (para M.2). <code>ls -l /dev/apex_0</code> desde dentro del contenedor debería mostrar el grupo <code>apex</code> — si no, añade el alineamiento de GID a <code>/etc/group</code> o cambia el contenedor a modo privilegiado.",
+    "apexTitle": "El LXC arranca pero falta /dev/apex_0",
+    "apexBody": "Comprueba el controlador del host: <code>lsmod | grep apex</code>. Si falta, prueba <code>modprobe apex</code> o reinicia tras instalarlo. Cuando exista <code>/dev/apex_0</code> en el host, verifica la configuración del LXC (vuelve a ejecutar el script si solo se escribieron las entradas alternativas) y reinícialo con <code>pct stop &lt;ctid&gt; &amp;&amp; pct start &lt;ctid&gt;</code>.",
+    "replugTitle": "Coral USB desaparece al conectarla a otro puerto",
+    "replugBody": "Comprueba que el LXC monta <code>/dev/bus/usb</code> y no el enlace <code>/dev/coral</code>. La configuración debe incluir <code>lxc.mount.entry: /dev/bus/usb dev/bus/usb ...</code>, sin depender directamente de <code>/dev/coral</code>. Vuelve a ejecutar el script si conservas una configuración antigua.",
+    "alpineTitle": "Alpine / Arch / RHEL / SUSE: runtime sin instalar",
+    "alpineBody": "El <em>modo de solo acceso al dispositivo</em> configura LXC sin instalar <code>libedgetpu</code>. Usa un paquete compatible o compila desde fuente; comprueba su disponibilidad antes de usar, por ejemplo, <code>apk add</code> en Alpine. Frigate puede incluir el runtime. Si usas Docker dentro del LXC, pasa también M.2 con <code>--device /dev/apex_0:/dev/apex_0</code> o monta USB dentro de Docker: el montaje LXC no basta.",
+    "frigateTitle": "Frigate muestra «Coral EdgeTPU detected but not available»",
+    "frigateBody": "Comprueba runtime, visibilidad y permisos de lectura/escritura del proceso real. En USB revisa permisos y, si procede, el grupo <code>plugdev</code>. En M.2 inspecciona <code>/dev/apex_0</code> con <code>ls -l /dev/apex_0</code>. Un nombre como <code>apex</code> en <code>/etc/group</code> no basta: deben coincidir GID numéricos y mapeos LXC. Comprueba también si otro proceso ocupa la TPU; no cambies a privilegiado como primera solución.",
     "logsTitle": "Revisa los logs del host y del contenedor",
-    "logsBody": "En el host: <code>journalctl -u pvedaemon | grep -i coral</code>. Dentro del contenedor: revisa los logs de la app (Frigate: <code>/config/logs/</code>, CodeProject.AI: su propio directorio de logs). El patrón clásico de error es \"Coral detected, runtime loaded, but inference engine can't claim it\" — eso son permisos 9 de cada 10 veces."
+    "logsBody": "En el host revisa los mensajes del kernel con <code>journalctl -k | grep -i -e apex -e gasket -e usb</code>. Dentro del LXC revisa los registros de la app; con Docker anidado usa <code>docker logs &lt;container&gt;</code>. Pueden fallar permisos, runtime, conexión USB o la disponibilidad de la TPU si otro proceso la ocupa."
   },
   "related": {
     "heading": "Relacionado",
     "items": [
       {
-        "label": "Instalar Coral TPU (Host)",
+        "label": "Instalar Coral TPU en el host",
         "href": "/docs/hardware/install-coral-tpu-host",
-        "tail": " — prerequisito necesario para tarjetas Coral M.2 / PCIe antes de pasarlas a un CT."
+        "tail": " — requisito previo para usar una Coral M.2 / PCIe en un CT."
       },
       {
         "label": "Añadir GPU a LXC",
         "href": "/docs/hardware/igpu-acceleration-lxc",
-        "tail": " — el mismo patrón para GPUs (a menudo emparejado con una Coral TPU en setups de Frigate)."
+        "tail": " — acceso a GPU, que suele combinarse con Coral en Frigate."
       }
     ]
   }
diff --git a/web/messages/es/docs/hardware/gpu-vm-passthrough.json b/web/messages/es/docs/hardware/gpu-vm-passthrough.json
index 63af3ddb..8aa92b02 100644
--- a/web/messages/es/docs/hardware/gpu-vm-passthrough.json
+++ b/web/messages/es/docs/hardware/gpu-vm-passthrough.json
@@ -1,134 +1,134 @@
 {
   "meta": {
-    "title": "Añadir GPU a VM (Passthrough) | ProxMenux Documentation",
-    "description": "Pasa una GPU Intel, AMD o NVIDIA a una VM Proxmox con rendimiento cercano al nativo. ProxMenux gestiona la preparación del host (módulos VFIO, blacklist de drivers, cmdline del kernel), la configuración de la VM (hostpci, función de audio, hermanos del grupo IOMMU), workarounds específicos del fabricante (Code 43 de NVIDIA, reset bug de AMD, dump de ROM) y conflictos de switch-mode con LXCs."
+    "title": "Añadir GPU a VM | Documentación de ProxMenux",
+    "description": "Asigna una GPU física a una VM de Proxmox. ProxMenux revisa IOMMU, configura VFIO y dispositivos de la VM y detecta conflictos con otras VM o LXC."
   },
   "header": {
     "title": "Añadir GPU a VM (Passthrough)",
-    "description": "Dale una de tus GPUs a una máquina virtual con rendimiento cercano al nativo. ProxMenux detecta Intel / AMD / NVIDIA, valida IOMMU, analiza el grupo IOMMU de la GPU para pasar cada dispositivo hermano junto, configura VFIO en el host, escribe las líneas hostpci correctas en la config de la VM y aplica fixes específicos del fabricante cuando hace falta.",
-    "section": "Hardware: GPUs y Coral-TPU"
+    "description": "Detecta GPU Intel, AMD o NVIDIA y prepara acceso directo desde una VM. Revisa IOMMU y los dispositivos asociados, configura VFIO y la VM y aplica sus reglas de compatibilidad. Comprueba siempre todos los dispositivos afectados.",
+    "section": "Hardware: GPU y Coral-TPU"
   },
   "intro": {
-    "title": "Qué hace esto",
-    "body": "Todo lo que la <pveLink>wiki oficial de Proxmox de PCI passthrough</pveLink> te explica paso a paso manualmente — habilitar IOMMU, módulos VFIO, blacklisting de drivers, descubrimiento de vendor ID, setup de <code>hostpci</code>, dump de ROM en AMD, ocultación de KVM en NVIDIA — hecho en una sola ejecución con comprobaciones de cordura en cada paso. El script también es consciente de las <em>otras</em> cosas en tu host: si la misma GPU ya está asignada a un LXC u otra VM, te ofrece migrar limpiamente en lugar de romper silenciosamente el setup existente."
+    "title": "Qué hace",
+    "body": "Automatiza la configuración del host y <code>hostpci</code> descrita en la <pveLink>documentación de passthrough PCI de Proxmox</pveLink>. Comprueba asignaciones en <em>otros</em> invitados y ofrece resolver conflictos. No garantiza compatibilidad con cualquier GPU, método de reinicio o controlador invitado."
   },
   "who": {
     "heading": "¿Para quién es esto?",
-    "body": "Tienes una GPU física en tu host Proxmox y quieres que una <strong>máquina virtual</strong> (Windows gaming, macOS, un nodo headless de cómputo en GPU, un media server en VM) la use directamente. Pasar una GPU a una VM no es lo mismo que pasarla a un LXC — las VMs necesitan que el kernel trate la GPU como dispositivo VFIO (en esencia \"el host no la tocará\"), lo que significa que el host no puede usar esa GPU para nada más mientras la VM esté en ejecución. Para transcoding / cómputo en <em>LXC</em>, usa <lxcLink>Añadir GPU a LXC</lxcLink> — comparte la GPU y no necesita VFIO."
+    "body": "Para que una <strong>máquina virtual</strong> use directamente una GPU mediante VFIO. Mientras esté vinculada a VFIO, el controlador del host no puede usarla, aunque la VM esté parada. Para compartirla con <em>LXC</em>, usa <lxcLink>Añadir GPU a LXC</lxcLink>."
   },
   "prereqs": {
     "title": "Antes de empezar",
-    "gpu": "<strong>Una GPU soportada</strong> instalada físicamente. El script detecta Intel, AMD y NVIDIA vía <code>lspci</code>.",
+    "gpu": "<strong>GPU compatible</strong> instalada físicamente. El script detecta Intel, AMD y NVIDIA con <code>lspci</code>.",
     "gpuCheck": "lspci | grep -iE 'VGA|3D|Display'",
-    "iommu": "<strong>Virtualización IOMMU</strong> disponible en BIOS/UEFI (Intel VT-d o AMD-Vi). Si está apagada a nivel de firmware, ninguna config de Linux lo arregla — tienes que habilitarla primero en la BIOS. El script detecta esto y se ofrece a habilitarlo en el lado del SO.",
-    "q35": "La VM destino usa machine type <strong>q35</strong>. El antiguo <code>i440fx</code> no soporta de forma fiable el passthrough PCIe y el script se negará a continuar.",
-    "q35Check": "qm config '<'vmid'>' | grep machine",
-    "moreGpus": "Preferiblemente <strong>más de una GPU</strong> en el host, o acceso por consola en otra salida (IPMI, KVM-over-IP, serie). Una vez pases la única GPU a una VM, la consola del host se queda a oscuras. Con dos GPUs NVIDIA puedes pasar una a una VM y mantener la otra en el host — el script gestiona esto por BDF (ver <em>NVIDIA</em> en las notas del fabricante más abajo).",
-    "nvidiaInstalled": "Si estás en un Proxmox que ya instaló el driver de NVIDIA vía <nvidiaLink>NVIDIA Drivers en el host</nvidiaLink>: la GPU que pases a la VM se desvincula del driver <code>nvidia</code> del host y se vincula a <code>vfio-pci</code>. El módulo <code>nvidia</code> sigue cargado, así que cualquier <strong>otra</strong> GPU NVIDIA que tengas en el host sigue funcionando con <code>nvidia-smi</code>."
+    "iommu": "<strong>Soporte IOMMU</strong> en hardware y firmware cuando lo requiera (Intel VT-d o AMD-Vi). Comprueba el sistema y puede añadir parámetros Linux; no cambia BIOS/UEFI ni demuestra que un IOMMU inactivo esté desactivado en firmware.",
+    "q35": "Este asistente exige tipo de máquina <strong>q35</strong> y rechaza <code>i440fx</code>. El chipset es independiente de BIOS/UEFI; cambiarlo en una VM existente requiere planificación y no se hace automáticamente.",
+    "q35Check": "qm config VMID | grep machine",
+    "moreGpus": "Prepara <strong>otra GPU o acceso alternativo</strong> mediante SSH, IPMI o serie. La consola puede perder imagen al reservar la GPU principal. En <em>NVIDIA</em>, otra tarjeta fuera del grupo IOMMU afectado puede seguir en el host.",
+    "nvidiaInstalled": "Con <nvidiaLink>NVIDIA instalado en el host</nvidiaLink>, las funciones elegidas se reservan para <code>vfio-pci</code>, no para <code>nvidia</code>. El módulo <code>nvidia</code> puede seguir disponible para <strong>otras</strong> tarjetas fuera del grupo IOMMU afectado. Verifícalas con <code>nvidia-smi</code>."
   },
   "pickOne": {
-    "title": "Passthrough a VM vs compartición con LXC — elige uno por GPU",
+    "title": "Asignación exclusiva a VM o compartición LXC",
     "body": "Una GPU vinculada a <code>vfio-pci</code> para passthrough a VM no puede usarla simultáneamente el host ni un LXC. Si tienes dos GPUs, puedes dedicar una a cada ruta. Si solo tienes una, elige:",
-    "vmItem": "<strong>Ruta VM (esta página):</strong> acceso completo al hardware, pero exclusivo para la VM dueña de la GPU mientras esté en ejecución.",
-    "lxcItem": "<strong>Ruta LXC (<lxcLink>Añadir GPU a LXC</lxcLink>):</strong> compartida con el host y otros contenedores, ideal para transcoding, sin magia VFIO."
+    "vmItem": "<strong>VM:</strong> acceso directo y exclusivo para esa VM.",
+    "lxcItem": "<strong>LXC (<lxcLink>Añadir GPU a LXC</lxcLink>):</strong> comparte el dispositivo con host y otros contenedores mediante el controlador nativo."
   },
   "running": {
     "heading": "Ejecutar el instalador",
-    "body": "Abre ProxMenux en el host, ve a <strong>Hardware: GPUs and Coral-TPU → Add GPU to VM</strong>.",
-    "imageAlt": "Entrada del menú 'Add GPU to VM' dentro de Hardware: GPUs and Coral-TPU"
+    "body": "Abre ProxMenux y ve a <strong>Hardware: GPU y Coral-TPU → Añadir GPU a VM</strong>.",
+    "imageAlt": "Opción del menú para añadir GPU a VM"
   },
   "howRuns": {
-    "heading": "Cómo se ejecuta el script",
-    "body": "El flujo tiene tres fases con separación clara entre \"recopilar información y decisiones\" y \"aplicar cambios realmente\". Hasta la confirmación final, no se ha tocado nada en tu host ni en la VM."
+    "heading": "Cómo funciona el script",
+    "body": "Detecta y selecciona antes de aplicar los cambios principales y confirma el plan en un resumen final. Activar IOMMU tiene una confirmación anterior y puede modificar ya el arranque. La limpieza posterior de audio asociado también puede pedir una elección."
   },
   "walkthrough": {
-    "heading": "Recorriendo el flujo",
+    "heading": "Proceso paso a paso",
     "detect": {
       "title": "Detectar GPUs y comprobar IOMMU",
-      "body": "El script lista cada GPU que encuentra. Si IOMMU no está ya habilitado en la cmdline del kernel en ejecución, recibirás un prompt sí/no para añadir <code>intel_iommu=on</code> (o <code>amd_iommu=on</code>) + <code>iommu=pt</code> al archivo de arranque correcto. La selección depende del bootloader: <code>/etc/kernel/cmdline</code> cuando el host arranca con systemd-boot (se detecta por la presencia de <code>root=ZFS=</code> en ese fichero, lo habitual en instalaciones de Proxmox VE sobre ZFS-on-root), o <code>/etc/default/grub</code> en el resto. Si aceptas y la cmdline cambia, el script marca que hará falta un reinicio al final.",
-      "tipTitle": "¿Ya ejecutaste post-instalación?",
-      "tipBody": "Si habilitaste anteriormente <postLink>soporte VFIO IOMMU</postLink> desde los scripts post-instalación, IOMMU ya está activo y este paso pasa silenciosamente. Bien.",
+      "body": "Considera IOMMU activo solo si el kernel en ejecución tiene <code>intel_iommu=on</code> o <code>amd_iommu=on</code> y existen grupos IOMMU. Si el parámetro ya está guardado para el próximo arranque, continúa en modo pendiente de reinicio; si no, con confirmación aparte puede añadirlo con <code>iommu=pt</code>. Elige <code>/etc/kernel/cmdline</code> si encuentra una marca ZFS como <code>root=ZFS=</code>; si no, <code>/etc/default/grub</code>. Es una heurística, no una prueba del cargador. Reinicia para activar el cambio y revisa los grupos reales.",
+      "tipTitle": "¿Ya configuraste la postinstalación?",
+      "tipBody": "Si el <postLink>soporte VFIO IOMMU</postLink> ya está configurado y activo en el kernel, supera la comprobación. Guardarlo para el próximo arranque no prueba que esté activo ahora.",
       "imageAlt": "Lista de GPUs detectadas con fabricante y dirección PCI"
     },
     "preflight": {
-      "title": "Elegir una GPU y ejecutar las comprobaciones previas",
+      "title": "Elegir GPU y ejecutar comprobaciones previas",
       "intro": "Una vez eliges la GPU, el script ejecuta una serie de comprobaciones que pueden bloquear el progreso:",
       "items": [
-        "<strong>No en SR-IOV.</strong> Si el dispositivo es una Virtual Function o una Physical Function con VFs activas, el passthrough chocaría con el uso de SR-IOV. Bloqueado.",
-        "<strong>Aviso de GPU única.</strong> Si esta es la única GPU del host, recibirás un diálogo de aviso recordándote que después del reinicio la consola se queda a oscuras — asegúrate de tener acceso SSH o por la UI web desde otra máquina.",
-        "<strong>Método de reset AMD.</strong> Las GPUs AMD tienen un largo historial de no resetear limpiamente entre paradas y arranques de VM. El script comprueba <code>/sys/bus/pci/devices/&lt;pci&gt;/reset_method</code>: si la tarjeta es una APU sin FLR <em>bloquea</em> (prácticamente inutilizable); una tarjeta AMD dedicada sin FLR también se bloquea; cualquier cosa con un modo de reset desconocido avisa pero te deja continuar con override explícito.",
-        "<strong>No en D3cold.</strong> Algunas tarjetas AMD reportan estado de energía <code>D3cold</code> en reposo, lo que las hace invisibles durante el arranque de la VM. Bloqueado hasta que despiertes la GPU.",
-        "<strong>Análisis del grupo IOMMU.</strong> Lee <code>/sys/kernel/iommu_groups/</code> para encontrar cada dispositivo no-bridge del grupo de la GPU. <em>Todos ellos</em> se pasarán a la VM juntos — si tu placa base agrupa la GPU con una tarjeta de red, la tarjeta de red va también."
+        "<strong>Protección SR-IOV.</strong> Rechaza VF y PF con VF activas porque configura dispositivos completos, no SR-IOV. Configura SR-IOV por separado con hardware compatible.",
+        "<strong>Una sola GPU.</strong> La consola local puede perder su salida al reservarla para VFIO. Comprueba antes el acceso SSH o web desde otro equipo.",
+        "<strong>Política de reinicio AMD.</strong> Lee <code>/sys/bus/pci/devices/&lt;pci&gt;/reset_method</code>. Una APU o dedicada sin FLR queda <em>bloqueada por la política del asistente</em>; un subtipo desconocido sin FLR exige confirmación. No demuestra que sea imposible en todo entorno.",
+        "<strong>Estado D3cold.</strong> El asistente bloquea tarjetas AMD que indican <code>D3cold</code> por riesgo de fallo al activarlas. Revisa alimentación y firmware antes de continuar.",
+        "<strong>Grupo IOMMU.</strong> Lee <code>/sys/kernel/iommu_groups/</code> e incluye <em>todos los miembros que no sean puentes</em>, incluso controladores de red o discos. Si el grupo contiene dispositivos de otro slot, el script los muestra antes del resumen; comprueba que el host no necesite ninguno. Si falta reiniciar para activar IOMMU, solo puede planificar inicialmente la función GPU; comprueba el aislamiento después."
       ],
-      "audioIntro": "<strong>Audio compañero.</strong> Dos rutas, según dónde viva el audio:",
-      "audioDgpu": "<strong>GPU discreta (NVIDIA / AMD):</strong> el audio HDMI está en la misma tarjeta como función <code>.1</code> del slot PCI de la GPU. Incluido automáticamente. Este dispositivo de audio nunca lo usó el host, así que nadie pierde nada.",
-      "audioIgpu": "<strong>iGPU Intel (o cualquier GPU sin hermano <code>.1</code>):</strong> el audio HDMI / analógico vive en el chipset en un slot distinto (<code>00:1f.3</code> normalmente). El script escanea el host, lista cada controlador de audio PCI con su driver actual (<code>snd_hda_intel</code>, etc.) y te pregunta cuál(es) pasar. Por defecto <strong>ninguno</strong> — tienes que aceptarlo explícitamente."
+      "audioIntro": "<strong>Audio asociado.</strong> Dos casos según dónde esté el controlador:",
+      "audioDgpu": "<strong>GPU dedicada:</strong> el audio HDMI suele ocupar la función <code>.1</code> del mismo slot y se incluye al detectarlo. Si el host lo usaba, pierde acceso al reservarlo para la VM.",
+      "audioIgpu": "<strong>Sin función de audio <code>.1</code>:</strong> puede estar en otro dispositivo, como <code>00:1f.3</code>. Lista controladores y sus drivers, por ejemplo <code>snd_hda_intel</code>. Por defecto no selecciona <strong>ninguno</strong>; elige solo los necesarios."
     },
     "pickVm": {
-      "title": "Elegir la VM destino",
-      "body": "Se te muestra la lista de VMs del host y eliges una. El script comprueba que la VM es q35 — los machine types BIOS/i440fx se rechazan porque el passthrough PCIe en ellos no es fiable. Si tienes una VM q35 con la GPU ya asignada (parcial o completamente), la entrada existente se reutiliza en lugar de duplicarse.",
-      "imageAlt": "Lista de VMs con nombre, ID y estado mostrada como selector"
+      "title": "Elige la VM destino",
+      "body": "Elige la VM de la lista. Exige q35 y reutiliza entradas GPU existentes cuando puede. BIOS/UEFI es una opción distinta, no un tipo de máquina. No cambia automáticamente el chipset ni el arranque del invitado instalado.",
+      "imageAlt": "Selección de VM por nombre, ID y estado"
     },
     "switchMode": {
-      "title": "Switch mode — gestionar que la GPU ya esté en otro sitio",
+      "title": "Resolver asignaciones existentes",
       "intro": "El script escanea cada config de VM y cada config de LXC en el host buscando la GPU que elegiste. Tres resultados posibles:",
       "items": [
-        "<strong>La GPU está libre.</strong> Nada que hacer, continúa.",
-        "<strong>La GPU está en otra VM.</strong> Si la VM origen está en ejecución, el script aborta — dos VMs no pueden compartir una asignación VFIO exclusiva y la VM origen ha de pararse antes. Si la VM origen está parada, aparece un menú con dos opciones: <em>Mantener la GPU en la config de la VM origen pero desactivar Arranque al inicio</em>, o <em>Eliminar las líneas de la GPU de la config de la VM origen y mantener Arranque al inicio</em>. También existe un camino rápido: si la GPU ya está vinculada a <code>vfio-pci</code> y es un simple traspaso VM→VM, no se reconfigura el host y no hace falta reinicio.",
-        "<strong>La GPU está en un LXC (modo compartido).</strong> Aparece un menú con dos opciones: <em>Mantener la GPU en la config del LXC pero desactivar Arranque al inicio</em>, o <em>Eliminar las líneas de la GPU de la config del LXC (<code>lxc.cgroup2.devices.allow</code> / <code>lxc.mount.entry</code>) y mantener Arranque al inicio</em>. En ambos casos, el LXC dejará de ver la GPU tras el switch, y la VM la verá — esta es la mecánica de \"switch mode\" que le da a esta entrada de menú su etiqueta secundaria."
+        "<strong>GPU disponible.</strong> Continúa sin retirar asignaciones.",
+        "<strong>Asignada a otra VM.</strong> Detén primero la VM origen. Puedes <em>conservar sus entradas y desactivar el arranque automático</em> o <em>retirarlas conservando el arranque automático</em>. Si ya usa <code>vfio-pci</code> y no requiere cambios del host, el traspaso VM→VM puede evitar reiniciar el host.",
+        "<strong>Usada por LXC.</strong> En contenedores normales elige <em>conservar configuración y desactivar arranque automático</em> o <em>eliminar la configuración de la GPU y conservar arranque automático</em>. Esta opción elimina las entradas <code>devN</code> y, en AMD/Intel, también las reglas antiguas <code>lxc.mount.entry</code> de <code>/dev/dri</code> y <code>lxc.cgroup2.devices.allow</code>. OCI conserva la configuración y se detiene sin arranque automático; elimina su GPU desde Apps del gestor OCI. La detección por familia puede afectar a otras tarjetas similares."
       ],
-      "imageAlt": "Diálogo que ofrece quitar la GPU de un LXC antes de asignarla a la VM",
-      "smartTitle": "Los hermanos de audio también se limpian con inteligencia",
-      "smartBody": "Si la VM origen tenía dispositivos de audio extra adjuntos junto a la GPU, el script quita <strong>solo los que ahora son huérfanos</strong> — es decir, entradas de audio cuyo hermano de display también se está quitando. El audio vinculado a otra GPU que se queda en la VM se deja intacto. Esto importa cuando desadjuntas una iGPU Intel (que comparte el audio del chipset) de una VM que también tiene una tarjeta dedicada NVIDIA / AMD aún pasada: el audio HDMI de la dGPU (<code>02:00.1</code>) se queda, el audio del chipset (<code>00:1f.3</code>) se va."
+      "imageAlt": "Diálogo que ofrece eliminar la GPU de un LXC antes de asignarla a la VM",
+      "smartTitle": "Revisión de audio asociado al retirar la GPU",
+      "smartBody": "Después ofrece una lista de <strong>audio posiblemente sin uso</strong> en la VM origen. Desmarca lo que aún necesite. Por ejemplo, puede conservar <code>02:00.1</code> y ofrecer retirar <code>00:1f.3</code>. La lista decide qué audio adicional se elimina; no garantiza toda asociación entre pantalla y audio."
     },
     "audioPick": {
-      "title": "(Si no hay hermano .1) Elegir qué controladores de audio incluir",
+      "title": "Si no hay audio .1, selecciona los controladores que necesites",
       "body": "Solo ocurre para iGPUs Intel y setups similares con audio separado. Una checklist muestra cada controlador de audio PCI del host (excluyendo cualquiera ya en el grupo IOMMU de la GPU), etiquetado con su driver actual. Selecciona los que quieras — o ninguno, si la VM no necesita audio del hardware del host.",
       "imageAlt": "Diálogo checklist con cada controlador de audio PCI del host (BDF + driver) cuando la GPU no tiene audio hermano .1",
-      "warnTitle": "No marques audio del que depende el host",
-      "warnBody": "Si el host usa actualmente un controlador de audio para algo — por ejemplo, el beep del shell de Proxmox o una VM a la que ya lo has pasado — marcarlo aquí significa que el host (y cualquier otra VM que lo comparta) pierde acceso después del reinicio. Ante la duda, déjalo vacío y siempre puedes volver a ejecutar el script más tarde para añadir audio si hace falta."
+      "warnTitle": "No selecciones audio que necesita el host",
+      "warnBody": "Asignar audio puede dejar al host sin acceso; tampoco puede pertenecer a otra VM activa a la vez. Deja audio opcional sin seleccionar si no lo necesitas y revisa sus asignaciones. El pitido de consola no procede necesariamente del audio PCI."
     },
     "summary": {
       "title": "Revisar el resumen de confirmación",
-      "body": "Un diálogo final muestra exactamente qué está a punto de cambiar en el host y en la VM. Esta es la última salida — si algo se ve mal (un dispositivo extra en el grupo IOMMU que no esperabas, la GPU equivocada, la VM equivocada), cancela aquí y aún no se ha tocado nada.",
-      "imageAlt": "Diálogo de resumen listando los cambios del host (archivos VFIO/blacklist) y los cambios de config de la VM (líneas hostpci) antes de aplicar"
+      "body": "Revisa el plan final y cancela si no es correcto. Muestra el grupo IOMMU y su número de dispositivos; los miembros de otro slot aparecen en el paso anterior. Cancelar detiene los cambios principales, pero no revierte una activación de IOMMU confirmada anteriormente.",
+      "imageAlt": "Resumen de cambios previstos en host y VM"
     },
     "hostApply": {
       "title": "Se aplican los cambios del host",
-      "intro": "La Fase 2 se ejecuta de forma no interactiva. En el lado del host el script puede tocar:",
+      "intro": "La fase de aplicación cambia host y VM. La limpieza de audio asociado aún puede pedir una elección. Puede modificar:",
       "items": [
         "<code>/etc/modules</code> — añade <code>vfio</code>, <code>vfio_iommu_type1</code>, <code>vfio_pci</code> (más <code>vfio_virqfd</code> en kernels &lt; 6.2).",
-        "<code>/etc/modprobe.d/vfio.conf</code> — para AMD / Intel, define <code>options vfio-pci ids=&lt;vendor:device,...&gt; disable_vga=1</code> para que VFIO reclame la GPU pronto en el arranque. Para NVIDIA el archivo solo añade <code>softdep nvidia pre: vfio-pci</code> (más <code>_drm</code>/<code>_modeset</code>/<code>_uvm</code>) — el binding real es por BDF vía la regla udev de abajo. En AMD, también añade líneas <code>softdep</code> forzando que <code>vfio-pci</code> cargue antes de <code>radeon</code> / <code>amdgpu</code>.",
-        "<code>/etc/modprobe.d/iommu_unsafe_interrupts.conf</code> y <code>kvm.conf</code> — workarounds sensatos que la mayoría de VMs Windows / macOS necesitan (<code>allow_unsafe_interrupts=1</code>, <code>ignore_msrs=1</code>).",
-        "<code>/etc/modprobe.d/blacklist.conf</code> — solo pone en blacklist los drivers open-source del vendor seleccionado (<code>nouveau</code>/<code>lbm-nouveau</code> para NVIDIA; <code>radeon</code>+<code>amdgpu</code> para AMD; <code>i915</code> para Intel), así los drivers de otros vendors en el mismo host siguen cargados. El módulo propietario <code>nvidia</code> <strong>solo</strong> se pone en blacklist (mediante un fichero aparte, <code>/etc/modprobe.d/proxmenux-nvidia-vfio-blacklist.conf</code>) una vez que <em>todas</em> las GPUs NVIDIA del host han pasado a VFIO — hasta entonces sigue cargado para que cualquier NVIDIA que mantengas en el host siga funcionando.",
-        "<code>/etc/udev/rules.d/10-proxmenux-vfio-bind.rules</code> + <code>/etc/proxmenux/vfio-bind.bdfs</code> — <strong>solo NVIDIA</strong>. Estado de binding por BDF. La regla udev aplica <code>ATTR'{'driver_override'}'=\"vfio-pci\"</code> en el evento PCI ADD para cada Bus:Device.Function rastreado, así que solo las GPUs que has pasado explícitamente van a VFIO. Esto es lo que hace que NVIDIA multi-GPU funcione — tus otras tarjetas NVIDIA mantienen su driver <code>nvidia</code> y siguen siendo usables en el host.",
-        "<strong>Solo AMD.</strong> Vuelca la ROM de la GPU desde sysfs (<code>/sys/bus/pci/.../rom</code>) o la tabla ACPI VFCT a <code>/usr/share/kvm/vbios_&lt;card&gt;.bin</code>. La VM la referencia vía <code>romfile=</code> para que las tarjetas que mal-reportan su propia VBIOS aún inicialicen correctamente.",
-        "<strong>Solo NVIDIA.</strong> Los servicios NVIDIA del host (<code>nvidia-persistenced</code>, <code>nvidia-powerd</code>, <code>nvidia-fabricmanager</code>) solo se detienen y deshabilitan cuando todas las GPU NVIDIA están asignadas a VFIO. En un host mixto permanecen activos, junto con el módulo <code>nvidia</code>, para las GPU que continúan en modo nativo.",
+        "<code>/etc/modprobe.d/vfio.conf</code> — AMD/Intel: <code>options vfio-pci ids=&lt;vendor:device,...&gt; disable_vga=1</code>. NVIDIA: <code>softdep nvidia pre: vfio-pci</code> (<code>_drm</code>/<code>_modeset</code>/<code>_uvm</code>); la asignación real es por BDF. AMD añade orden de carga <code>softdep</code>: <code>vfio-pci</code> → <code>radeon</code>/<code>amdgpu</code>.",
+        "Escribe <code>/etc/modprobe.d/iommu_unsafe_interrupts.conf</code> y <code>kvm.conf</code> con <code>allow_unsafe_interrupts=1</code> e <code>ignore_msrs=1</code>. Son ajustes del script, no requisitos universales de Windows/macOS; permitir interrupciones inseguras reduce esa protección.",
+        "<code>/etc/modprobe.d/blacklist.conf</code>: NVIDIA — <code>nouveau</code>/<code>lbm-nouveau</code>; AMD — <code>radeon</code> + <code>amdgpu</code>; Intel — <code>i915</code>. Estas reglas por fabricante pueden afectar a otras tarjetas con el mismo controlador. El módulo <code>nvidia</code> se bloquea <strong>solo</strong> mediante <code>/etc/modprobe.d/proxmenux-nvidia-vfio-blacklist.conf</code> cuando <em>todas</em> las NVIDIA del host están reservadas a VFIO.",
+        "<code>/etc/udev/rules.d/10-proxmenux-vfio-bind.rules</code> + <code>/etc/proxmenux/vfio-bind.bdfs</code> — <strong>Solo NVIDIA.</strong> Aplica <code>ATTR'{'driver_override'}'=\"vfio-pci\"</code> al evento PCI ADD de BDF registrados, incluidas funciones del grupo IOMMU afectado. Fuera de esos grupos puede conservarse <code>nvidia</code>. La política por BDF no divide grupos IOMMU.",
+        "<strong>Solo AMD.</strong> Intenta extraer ROM de <code>/sys/bus/pci/.../rom</code> o ACPI VFCT a <code>/usr/share/kvm/vbios_&lt;vendor&gt;_&lt;device&gt;.bin</code>. Si funciona, usa <code>romfile=</code>. Una ROM válida no garantiza que la GPU se inicialice.",
+        "<strong>Solo NVIDIA.</strong> Detiene y deshabilita <code>nvidia-persistenced</code>, <code>nvidia-powerd</code>, <code>nvidia-fabricmanager</code> solo cuando todas las NVIDIA están reservadas para VFIO. En uso mixto conserva los servicios y <code>nvidia</code> para las tarjetas nativas.",
         "<code>update-initramfs -u -k all</code> — solo se ejecuta si algo de lo de arriba ha cambiado realmente."
       ]
     },
     "vmApply": {
       "title": "La config de la VM se aplica vía qm set",
       "body": "La config de la VM en <code>/etc/pve/qemu-server/&lt;vmid&gt;.conf</code> se actualiza vía <code>qm set</code> (nunca por <code>sed</code> directo):",
-      "after1": "Se añade un flag <code>x-vga=1</code> para cada fabricante <strong>excepto</strong> iGPU Intel — las GPUs integradas Intel no tienen VRAM dedicada para una consola pre-arranque, así que ese flag causa hangs.",
+      "after1": "Añade <code>x-vga=1</code> para AMD y NVIDIA, <strong>no</strong> para Intel. Es la política del script; no demuestra que todas las iGPU Intel carezcan de firmware o que ese ajuste siempre provoque bloqueos.",
       "after2": "Se añaden líneas <code>hostpciN</code> adicionales si el grupo IOMMU de la GPU contiene otros dispositivos que necesitas pasar juntos."
     },
     "reboot": {
-      "title": "Reiniciar si se tocó la config del host",
-      "body": "Si la Fase 2 cambió algo a nivel de módulo de kernel / cmdline / blacklist, se te pedirá reiniciar. El reinicio es obligatorio antes de arrancar la VM — si no la GPU sigue retenida por el driver del host y VFIO no puede reclamarla.",
+      "title": "Reinicia si lo requiere el cambio del host",
+      "body": "Sigue el aviso de reinicio si cambia arranque o controladores y comprueba la vinculación activa antes de iniciar la VM. Guardar configuración no prueba que esté aplicada. Un traspaso VM→VM con VFIO correcto puede evitar reiniciar el host.",
       "imageAlt": "Pantalla de resumen mostrando qué se cambió, seguida de un prompt de reinicio"
     }
   },
   "vendors": {
-    "heading": "Notas específicas del fabricante",
+    "heading": "Notas por fabricante",
     "nvidiaHeading": "NVIDIA",
-    "nvidiaBody": "Los drivers de consumo de NVIDIA detectan que están corriendo en una VM y se niegan a inicializar con el infame error <em>\"Code 43\"</em>. El workaround de ProxMenux: ocultar KVM al guest (<code>hidden=1</code>), poner un hypervisor vendor ID falseado <code>NV43FIX</code> en la línea <code>args</code> y pasar <code>kvm=off</code>. Esto ha funcionado de forma fiable en drivers GeForce durante años. En tarjetas datacenter / Tesla / Quadro esto no hace falta — esos drivers están licenciados para virtualización.",
+    "nvidiaBody": "Conserva un ajuste heredado para <em>Code 43</em>: <code>hidden=1</code>, ID <code>NV43FIX</code> en <code>args</code> y <code>kvm=off</code>. No es requisito universal de GeForce actuales: NVIDIA añadió soporte de passthrough Windows en R465. El error puede tener otras causas; verifica GPU y controlador.",
     "nvidiaMultiHeading": "Soporte NVIDIA multi-GPU",
-    "nvidiaMultiBody": "Los hosts con dos o más GPUs NVIDIA son de primera clase. Puedes pasar una tarjeta a una VM y mantener la(s) otra(s) en el host para <code>nvidia-smi</code>, compartición de GPU con LXC o cualquier carga del lado del host. ProxMenux vincula VFIO <strong>por BDF</strong> (Bus:Device.Function) vía una regla udev en lugar de poner en blacklist globalmente el módulo <code>nvidia</code> — así el destino de cada tarjeta es independiente de las otras, incluso cuando ambas GPUs son del mismo modelo y comparten el mismo ID <code>vendor:device</code>. El driver nvidia del host sigue cargado; solo los BDFs específicos que selecciones se redirigen a <code>vfio-pci</code>.",
+    "nvidiaMultiBody": "Admite uso mixto NVIDIA <strong>por BDF</strong>. Registra funciones de <code>vfio-pci</code> por dirección, no solo por ID <code>vendor:device</code>. Fuera de los grupos afectados pueden conservar <code>nvidia</code>; compruébalas con <code>nvidia-smi</code>. No aísla dos tarjetas del mismo grupo.",
     "amdHeading": "AMD",
-    "amdBody": "El \"AMD reset bug\" significa que algunas tarjetas crashean cuando la VM para y no pueden re-inicializarse sin un reinicio del host. ProxMenux pre-criba para esto leyendo el método de reset PCI, pero no puede arreglarlo después. Si lo encuentras, el fix de la comunidad es el módulo de kernel <vendorResetLink>vendor-reset</vendorResetLink>. El script no lo instala automáticamente — el módulo es una build DKMS que añades tú si ves fallos de reset. También en guests Windows, el servicio <em>RadeonResetBugFix</em> es el workaround común a nivel userspace.",
+    "amdBody": "Algunas AMD fallan al reiniciar tras parar una VM. El asistente comprueba capacidades declaradas, no todos los ciclos reales. <vendorResetLink>vendor-reset</vendorResetLink> admite una lista limitada y exige kernel compatible y carga temprana; no lo instala. <em>RadeonResetBugFix</em> en Windows también depende del hardware, sin garantía universal.",
     "intelHeading": "iGPU Intel",
-    "intelBody": "El passthrough de iGPU Intel es inestable pero posible en generaciones UHD 630+ con <sriovLink>i915-sriov-dkms</sriovLink> para SR-IOV. Para un caso simple de \"darle la iGPU a una VM\", el script la vincula exactamente como una GPU dedicada, pero se salta <code>x-vga=1</code> (las iGPUs no llevan una VBIOS pre-arranque). Perderás la salida de consola del host — planifícalo en consecuencia."
+    "intelBody": "Asignar toda la iGPU Intel y usar SR-IOV son procesos distintos. Este asistente reserva el dispositivo para una VM y omite <code>x-vga=1</code>. <sriovLink>i915-sriov-dkms</sriovLink> requiere hardware y kernel compatibles; «UHD 630+» no es una regla válida. Prevé acceso alternativo al host."
   },
   "verification": {
     "heading": "Verificación"
@@ -136,19 +136,19 @@
   "troubleshoot": {
     "heading": "Solución de problemas",
     "code43Title": "Code 43 en Windows (NVIDIA)",
-    "code43Body": "Los args de ocultación de KVM no se aplicaron. Comprueba <code>qm config &lt;vmid&gt; | grep -E \"cpu|args\"</code> — deberías ver <code>hidden=1</code> y <code>hv_vendor_id=NV43FIX</code>. Si faltan, vuelve a ejecutar el script y reselecciona la misma VM.",
+    "code43Body": "Code 43 no prueba un fallo de ocultación. Consulta <code>qm config VMID | grep -E \"cpu|args\"</code> sustituyendo VMID y revisa <code>hidden=1</code> y <code>hv_vendor_id=NV43FIX</code>. Comprueba también controlador invitado, firmware y asignación. Repetir el script puede salir si ya está asignada.",
     "amdResetTitle": "La GPU AMD funciona una vez, falla al reiniciar la VM",
-    "amdResetBody": "El AMD reset bug. Soluciones (en orden): (1) reiniciar el host — la GPU será usable de nuevo para un ciclo más de VM; (2) instalar el módulo DKMS <code>vendor-reset</code> y añadir <code>softdep amdgpu pre: vendor-reset</code>; (3) dentro de Windows, instalar el servicio <em>RadeonResetBugFix</em>.",
+    "amdResetBody": "Una causa posible es el fallo de reinicio de la GPU. Reiniciar o apagar el host puede recuperarla temporalmente. Comprueba soporte de <code>vendor-reset</code> y carga temprana; <code>softdep amdgpu pre: vendor-reset</code> no garantiza por sí solo cargar antes de VFIO. <em>RadeonResetBugFix</em> en Windows también requiere GPU compatible.",
     "stuckBootTitle": "VM colgada arrancando / GPU no detectada",
-    "stuckBootBody": "Confirma que VFIO realmente retiene la GPU al arrancar: <code>lspci -nnk -d vendor:device</code> debe mostrar <code>Kernel driver in use: vfio-pci</code>. Si aún muestra el driver del fabricante, el blacklist no surtió efecto — revisa <code>/etc/modprobe.d/blacklist.conf</code> y <code>dmesg | grep vfio</code>, y regenera initramfs: <code>update-initramfs -u -k all</code> y luego reinicia.",
+    "stuckBootBody": "Consulta la dirección real con <code>lspci -nnk -s PCI_ADDRESS</code>; espera <code>Kernel driver in use: vfio-pci</code>. Sustituye PCI_ADDRESS. Si sigue el driver nativo, revisa su política de vinculación, no solo <code>/etc/modprobe.d/blacklist.conf</code>; NVIDIA usa estado por BDF. Consulta <code>dmesg | grep vfio</code>. Tras corregir configuración, ejecuta <code>update-initramfs -u -k all</code> y sigue el plan de reinicio.",
     "darkTitle": "La consola del host se queda a oscuras tras reiniciar y no puedo entrar por SSH",
-    "darkBody": "Pasaste la GPU primaria sin tener acceso alternativo. Arranca en un recovery shell (ISO de rescate, IPMI), quita las líneas de la config de la VM (<code>/etc/pve/qemu-server/&lt;vmid&gt;.conf</code>) y quita las opciones vfio:",
+    "darkBody": "Una pantalla negra no prueba que el host esté caído. Si falla SSH, revisa red y controladores incluidos en el grupo IOMMU. Recupera acceso por IPMI, serie o entorno de rescate; revisa <code>/etc/pve/qemu-server/&lt;vmid&gt;.conf</code> y revierte solo asignaciones y reglas relacionadas. No borres configuración ajena.",
     "logTitle": "Revisa el log de instalación",
-    "logBody": "Cada ejecución escribe en <code>/tmp/add_gpu_vm.log</code>. Adjúntalo cuando pidas ayuda en GitHub."
+    "logBody": "Cada ejecución escribe <code>/tmp/add_gpu_vm.log</code>. Adjunta el registro al pedir ayuda."
   },
   "revert": {
-    "heading": "Revertir manualmente",
-    "intro": "Hoy no hay un atajo dedicado de \"quitar GPU de la VM\" en ProxMenux. Para desadjuntar limpiamente:"
+    "heading": "Deshacer cambios manualmente",
+    "intro": "Detén la VM y retira solo sus asignaciones PCI correspondientes desde Hardware o mediante el índice explícito del ejemplo. Eliminarla de la VM no devuelve la GPU al controlador del host. Para eso usa Cambiar modo de GPU y revisa los invitados afectados antes de confirmar."
   },
   "related": {
     "heading": "Relacionado",
@@ -156,7 +156,7 @@
       {
         "label": "Instalar drivers NVIDIA (Host)",
         "href": "/docs/hardware/nvidia-host",
-        "tail": " — instala los drivers en el host primero si también quieres la GPU usable desde ahí."
+        "tail": " — prepara el controlador para tarjetas que sigan en el host; una GPU en VFIO no puede usarlo a la vez."
       },
       {
         "label": "Añadir GPU a LXC",
@@ -164,9 +164,9 @@
         "tail": " — modelo alternativo: comparte la GPU con varios contenedores en lugar de dedicarla a una VM."
       },
       {
-        "label": "Switch GPU Mode (VM ↔ LXC)",
+        "label": "Cambiar modo de GPU (VM ↔ LXC)",
         "href": "/docs/hardware/switch-gpu-mode",
-        "tail": " — cambia la misma GPU entre modos sin rehacer todo el cableado."
+        "tail": " — cambia la misma GPU entre uso compartido y asignación exclusiva."
       },
       {
         "label": "Comandos de GPU Passthrough",
diff --git a/web/messages/es/docs/hardware/igpu-acceleration-lxc.json b/web/messages/es/docs/hardware/igpu-acceleration-lxc.json
index b5e91c8f..c290b0b3 100644
--- a/web/messages/es/docs/hardware/igpu-acceleration-lxc.json
+++ b/web/messages/es/docs/hardware/igpu-acceleration-lxc.json
@@ -1,20 +1,20 @@
 {
   "meta": {
-    "title": "Añadir GPU a LXC | ProxMenux Documentation",
-    "description": "Comparte una GPU Intel, AMD o NVIDIA con un contenedor LXC para transcoding acelerado por hardware (Plex / Jellyfin / Frigate), cargas OpenCL / CUDA y aceleración de vídeo Mesa. ProxMenux gestiona los nodos de dispositivo, la alineación de GIDs y la instalación de drivers específica por distro dentro del contenedor."
+    "title": "Añadir GPU a LXC | Documentación de ProxMenux",
+    "description": "Comparte GPU Intel, AMD o NVIDIA con LXC. ProxMenux configura dispositivos, grupos y bibliotecas según la distribución; la aplicación debe admitir y tener configurada la aceleración."
   },
   "header": {
     "title": "Añadir GPU a LXC",
-    "description": "Comparte una o varias GPUs con un contenedor LXC de Proxmox. El host sigue usando la GPU con normalidad — el contenedor solo recibe acceso a través de los nodos de dispositivo. Funciona con iGPUs Intel (Quick Sync / VA-API), tarjetas AMD (Mesa / ROCm) y NVIDIA (CUDA / NVENC).",
-    "section": "Hardware: GPUs y Coral-TPU"
+    "description": "Comparte acceso a GPU con LXC mediante dispositivos del host. El controlador sigue en el host; las aplicaciones usan bibliotecas compatibles y requieren su propia configuración.",
+    "section": "Hardware: GPU y Coral-TPU"
   },
   "intro": {
-    "title": "Qué hace esto",
-    "body": "Añade entradas <code>dev&lt;N&gt;</code> a la config del LXC (<code>/etc/pve/lxc/&lt;ctid&gt;.conf</code>) para que el contenedor vea <code>/dev/dri/*</code>, <code>/dev/kfd</code> o <code>/dev/nvidia*</code> — lo que aplique a tu GPU. Luego arranca el contenedor, detecta la distro de dentro e instala los drivers de userspace correspondientes (Mesa, intel-media-driver, runtime NVIDIA…) para que apps como Plex, Jellyfin o Frigate usen realmente la GPU para transcoding. Los GIDs (<code>video</code>, <code>render</code>) se alinean entre host y contenedor para que los permisos coincidan."
+    "title": "Qué hace",
+    "body": "Añade entradas <code>dev&lt;N&gt;</code> a <code>/etc/pve/lxc/&lt;ctid&gt;.conf</code> para los dispositivos <code>/dev/dri/*</code>, <code>/dev/kfd</code> o <code>/dev/nvidia*</code> que correspondan. Arranca el LXC, instala paquetes según la distribución y, en Intel/AMD, alinea los grupos <code>video</code> y <code>render</code>. La aceleración requiere hardware y bibliotecas compatibles y configurar la app."
   },
   "compare": {
-    "heading": "Compartición LXC vs passthrough a VM",
-    "intro": "Los contenedores LXC comparten el kernel del host, así que pueden <em>compartir</em> la GPU del host sin apropiársela. Esa es una gran diferencia con las VMs: con <vmLink>passthrough a VM</vmLink> la GPU es exclusiva de una VM y el host no puede usarla. Con LXC, varios contenedores más el host pueden usar a la vez la misma GPU.",
+    "heading": "Compartir con LXC frente a asignar a una VM",
+    "intro": "LXC comparte el kernel y puede <em>compartir</em> la GPU entre host y contenedores. Con <vmLink>passthrough completo a una VM</vmLink>, el dispositivo se dedica a esa VM y deja de estar disponible para el controlador del host.",
     "headerFeature": "Característica",
     "headerLxc": "LXC (esta página)",
     "headerVm": "VM",
@@ -37,74 +37,74 @@
       {
         "feature": "¿Hace falta reiniciar?",
         "lxc": "Normalmente no (solo reiniciar el CT)",
-        "vm": "Sí, siempre"
+        "vm": "Al cambiar controlador o IOMMU del host; no con cada asignación"
       },
       {
-        "feature": "¿Soporta correr cualquier SO?",
+        "feature": "Sistemas operativos invitados",
         "lxc": "Solo Linux (LXC es solo Linux)",
-        "vm": "Windows, macOS, cualquier Linux"
+        "vm": "SO invitado admitido con controlador GPU compatible"
       }
     ]
   },
   "prereqs": {
     "title": "Antes de empezar",
-    "gpu": "<strong>Una GPU en el host</strong> — iGPU Intel, dGPU o APU AMD, o una tarjeta NVIDIA. El script autodetecta los tres vía <code>lspci</code>.",
+    "gpu": "<strong>GPU en el host</strong> Intel, AMD o NVIDIA, detectada mediante <code>lspci</code>.",
     "gpuCheck": "lspci | grep -iE 'VGA|3D|Display'",
-    "vfio": "<strong>La GPU NO está vinculada a vfio-pci.</strong> Si la GPU está actualmente asignada a una VM vía passthrough, es invisible para el driver del kernel del host y el LXC no puede usarla. El script detecta esto y se ofrece a ejecutar <switchLink>Switch GPU Mode</switchLink> por ti.",
-    "nvidia": "<strong>Solo para NVIDIA:</strong> el driver NVIDIA del host debe estar ya instalado — ProxMenux necesita hacer coincidir las libs userspace del contenedor con la versión del host. Si aún no lo has hecho, ejecuta <nvidiaLink>Instalar drivers NVIDIA en el host</nvidiaLink> primero.",
+    "vfio": "<strong>La GPU no debe estar vinculada a vfio-pci.</strong> Necesita el controlador nativo del host. Si está asignada a una VM, el script ofrece <switchLink>Cambiar modo de GPU</switchLink>.",
+    "nvidia": "<strong>Para NVIDIA:</strong> instala primero el controlador en el host. Las bibliotecas del contenedor deben ser compatibles con su versión. Usa <nvidiaLink>Instalar controladores NVIDIA en el host</nvidiaLink>.",
     "nvidiaCheck": "nvidia-smi",
-    "container": "<strong>Un contenedor LXC existente.</strong> El script opera sobre un contenedor que ya creaste — no crea uno. El contenedor debería idealmente ser <strong>privilegiado</strong> (unprivileged funciona pero necesita mapeo UID/GID que el script no configura)."
+    "container": "<strong>Un LXC existente.</strong> El script no lo crea. Admite ambos modos; no requiere siempre un contenedor <strong>privilegiado</strong>. Deben coincidir los dispositivos y permisos numéricos de la aplicación."
   },
   "unpriv": {
-    "title": "Funciona en contenedores privilegiados y unprivileged",
+    "title": "Admite contenedores privilegiados y sin privilegios",
     "body": "El script escribe entradas <code>dev&lt;N&gt;</code> en la config del LXC y, en contenedores unprivileged, alinea los GIDs de <code>video</code> y <code>render</code> entre host y contenedor para que los nodos de la GPU sean accesibles desde dentro sin tener que tocar manualmente <code>lxc.idmap</code>."
   },
   "running": {
     "heading": "Ejecutar el instalador",
-    "body": "Abre ProxMenux en el host, ve a <strong>Hardware: GPUs and Coral-TPU → Add GPU to LXC</strong>.",
-    "imageAlt": "Entrada del menú 'Add GPU to LXC' dentro de Hardware: GPUs and Coral-TPU"
+    "body": "Abre ProxMenux y ve a <strong>Hardware: GPU y Coral-TPU → Añadir GPU a LXC</strong>.",
+    "imageAlt": "Opción del menú para añadir GPU a LXC"
   },
   "howRuns": {
-    "heading": "Cómo se ejecuta el script",
-    "body": "Dos fases: todas las decisiones por adelantado, luego todos los cambios de una vez. No se toca nada en tu contenedor hasta que confirmas."
+    "heading": "Cómo funciona el script",
+    "body": "Selecciona contenedor y familias de GPU y supera las comprobaciones. Después detiene el LXC y cambia su configuración, sin confirmación final adicional. La limpieza opcional de VFIO se confirma aparte y puede modificar antes el host."
   },
   "walkthrough": {
-    "heading": "Recorriendo el flujo",
+    "heading": "Proceso paso a paso",
     "detect": {
       "title": "Detectar GPUs del host",
-      "body": "El script escanea <code>lspci</code> buscando controladoras VGA / 3D / Display que coincidan con Intel, AMD o NVIDIA. Para NVIDIA también verifica que el módulo de kernel <code>nvidia</code> esté cargado y que <code>nvidia-smi</code> funcione — la versión del driver del host que reporta se usará para elegir el instalador <code>.run</code> correcto para el contenedor.",
+      "body": "Busca controladoras GPU con <code>lspci</code>. Para NVIDIA comprueba el módulo <code>nvidia</code> y <code>nvidia-smi</code>; usa la versión detectada para elegir el <code>.run</code> del contenedor.",
       "tipTitle": "¿NVIDIA no está listo?",
-      "tipBody": "Si NVIDIA se detecta pero el módulo no está cargado, el script no ofrecerá la ruta NVIDIA. Ejecuta <nvidiaLink>Instalar drivers NVIDIA en el host</nvidiaLink> primero (y reinicia), luego vuelve."
+      "tipBody": "Si falta el módulo o no funciona NVIDIA en el host, usa primero <nvidiaLink>Instalar controladores NVIDIA en el host</nvidiaLink> y verifica el controlador antes de volver."
     },
     "pickCt": {
       "title": "Elige un contenedor LXC",
-      "body": "Verás una lista de cada LXC del host con su ID y nombre. Elige el que debería recibir la GPU. El contenedor puede estar en ejecución o parado — el script gestiona ambos casos (lo para brevemente durante la config, lo reinicia y lo deja en su estado original al final).",
-      "imageAlt": "Diálogo listando los contenedores LXC existentes para elegir"
+      "body": "Lista los LXC admitidos por ID y nombre. Excluye OCI: sus dispositivos se gestionan en Apps del gestor OCI. Detiene el LXC si está en marcha, lo arranca para instalar y normalmente recupera su estado inicial.",
+      "imageAlt": "Selección de un contenedor LXC existente"
     },
     "selectGpu": {
-      "title": "Selecciona la(s) GPU(s) a añadir",
-      "body": "Si hay más de una GPU presente, recibes una checklist. Puedes añadir varias al mismo contenedor (p. ej., una iGPU Intel para Quick Sync + una dGPU AMD para ROCm). Si solo se detecta una GPU, se autoselecciona.",
-      "imageAlt": "Checklist mostrando las GPUs detectadas (Intel / AMD / NVIDIA) con fabricante y dirección PCI"
+      "title": "Selecciona las familias de GPU",
+      "body": "Selecciona familias por fabricante, no un dispositivo PCI aislado. Intel/AMD añaden los nodos DRI previstos; NVIDIA añade sus dispositivos disponibles, que pueden corresponder a varias tarjetas. Una sola familia se selecciona automáticamente. Revisa la lista final, sobre todo con varias GPU.",
+      "imageAlt": "Lista de familias GPU detectadas con nombre y dirección PCI"
     },
     "preflight": {
       "title": "Comprobaciones previas",
-      "imageAlt": "Diálogo que ofrece ejecutar Switch GPU Mode cuando la GPU seleccionada sigue vinculada a vfio-pci para passthrough a VM",
+      "imageAlt": "Oferta para cambiar el modo de una GPU vinculada a vfio-pci",
       "intro": "Tres comprobaciones, cualquiera de las cuales puede bloquearte o redirigirte:",
       "items": [
-        "<strong>SR-IOV.</strong> Si la GPU seleccionada es una Virtual Function (VF) o una Physical Function con VFs activas, el passthrough a LXC no aplica — el dispositivo lo gestiona el driver SR-IOV. Bloqueado.",
-        "<strong>Vinculada a vfio-pci.</strong> Si la GPU está actualmente retenida por VFIO para passthrough a VM, el kernel del host no puede crear nodos <code>/dev/dri/*</code> o <code>/dev/nvidia*</code> para ella. El script se ofrece a ejecutar <switchLink>Switch GPU Mode</switchLink> que deshace el binding VFIO; probablemente necesitarás un reinicio antes de volver a ejecutar Añadir GPU a LXC.",
-        "<strong>Ya configurada.</strong> Si el contenedor ya tiene todos los nodos de dispositivo para la GPU seleccionada, el script lo dice y sale limpiamente. Si está parcialmente configurada, continúa solo con las piezas que faltan."
+        "<strong>Protección SR-IOV.</strong> El asistente bloquea una VF o PF con VF activas. Es una limitación de su selección amplia de dispositivos, no una prohibición universal en LXC. Configura esos dispositivos por separado.",
+        "<strong>Vinculada a vfio-pci.</strong> El controlador nativo no puede crear <code>/dev/dri/*</code> o <code>/dev/nvidia*</code>. Ofrece <switchLink>Cambiar modo de GPU</switchLink>; sigue las indicaciones de reinicio y vuelve después.",
+        "<strong>Ya configurada.</strong> Si están todos los dispositivos, sale sin reinstalar bibliotecas. Si solo falta alguna familia seleccionada, continúa con ella."
       ]
     },
     "applyConfig": {
       "title": "Aplica los cambios de config del LXC",
-      "body1": "El script para el contenedor, edita <code>/etc/pve/lxc/&lt;ctid&gt;.conf</code> y añade entradas <code>dev&lt;N&gt;</code> con los GIDs correctos para las GPUs seleccionadas. Usar entradas <code>dev:</code> (en lugar de las viejas líneas <code>lxc.mount.entry</code>) es la forma moderna de Proxmox — los permisos de grupo se aplican en tiempo de parseo de la config en lugar de en tiempo de mount.",
+      "body1": "Detiene el LXC si está en marcha y edita <code>/etc/pve/lxc/&lt;ctid&gt;.conf</code>. Las entradas <code>dev&lt;N&gt;</code> llevan el GID <code>video</code> o <code>render</code> del host. Sustituye las líneas <code>lxc.mount.entry</code> de <code>/dev/dri</code> por entradas <code>dev:</code>. Revisa configuración y permisos resultantes.",
       "body2": "Ejemplo después de Intel + NVIDIA en el mismo contenedor:"
     },
     "installDrivers": {
       "title": "Arranca el contenedor e instala los drivers dentro",
-      "body": "Una vez escrita la config, el script arranca el contenedor, espera hasta ~30 segundos a que <code>pct exec</code> responda y luego detecta la distro del contenedor desde <code>/etc/os-release</code>. En base a eso, instala los paquetes userspace correctos.",
-      "headerDistro": "Distro",
+      "body": "Arranca el contenedor y espera hasta unos 30 segundos a que responda <code>pct exec</code>. Detecta la distribución con <code>/etc/os-release</code> e instala los paquetes correspondientes.",
+      "headerDistro": "Distribución",
       "headerInt": "Intel / AMD",
       "headerNvidia": "NVIDIA",
       "rows": [
@@ -121,41 +121,41 @@
       ],
       "debianDistro": "Debian / Ubuntu / otras",
       "debianIntel": "apt-get install va-driver-all intel-opencl-icd vainfo",
-      "debianNvidia": "extraer el <code>.run</code> del host → <code>pct push</code> → ejecutar con <code>--no-kernel-modules --no-dkms</code>",
-      "whyTitle": "Por qué el baile del .run de NVIDIA en Debian",
-      "whyBody": "Debian / Ubuntu no traen paquetes NVIDIA con una versión lo bastante granular como para coincidir con el driver del host byte por byte. Las libs userspace dentro del contenedor <strong>deben coincidir con la versión del módulo de kernel</strong> cargado en el host, o <code>nvidia-smi</code> falla con un version mismatch. ProxMenux lo resuelve usando exactamente el mismo instalador <code>.run</code> que se usó para el host — extraído, tarred, enviado al contenedor con <code>pct push</code> y ejecutado con <code>--no-kernel-modules --no-dkms</code> para que solo se toque el userspace."
+      "debianNvidia": "Extrae <code>.run</code> en el host → <code>pct push</code> → instala con <code>--no-kernel-modules --no-dkms</code>.",
+      "whyTitle": "Por qué usa el instalador NVIDIA .run en Debian",
+      "whyBody": "Los paquetes del repositorio pueden no coincidir con el host. Las bibliotecas <strong>deben coincidir con el módulo cargado</strong> para herramientas NVML como <code>nvidia-smi</code>. En Debian/glibc extrae y comprime en el host el <code>.run</code> de esa versión, lo transfiere con <code>pct push</code> e instala con <code>--no-kernel-modules --no-dkms</code>. Alpine y Arch usan paquetes: verifica sus versiones."
     },
     "alignGids": {
       "title": "Alinear GIDs y restaurar el estado",
-      "body1": "Los archivos de dispositivo en el host pertenecen al grupo <code>video</code> (GID 44) o <code>render</code> (GID 104). La distro del contenedor puede traer números de GID distintos para esos grupos, lo que haría que los nodos de la GPU fueran inalcanzables desde dentro. El script reescribe <code>/etc/group</code> en el contenedor para que <code>video:44</code> y <code>render:104</code> coincidan exactamente.",
-      "body2": "Finalmente, restaura el contenedor a su estado original — si estaba parado cuando empezaste, se vuelve a parar. Si estaba en ejecución, se queda en ejecución."
+      "body1": "En Intel/AMD, lee los GID del host para <code>video</code> y <code>render</code>; usa 44/104 solo como alternativa. Ajusta <code>/etc/group</code> dentro del LXC; si solo hay NVIDIA, omite este paso. <code>video:44</code> y <code>render:104</code> son ejemplos, no valores universales. Verifica grupos de la app y permisos efectivos.",
+      "body2": "Al completar normalmente, vuelve a detener el LXC si inicialmente estaba parado; si estaba funcionando, lo deja activo. Ante un fallo de arranque o instalación, revisa el estado final y el registro."
     }
   },
   "vendors": {
-    "heading": "Notas específicas del fabricante",
+    "heading": "Notas por fabricante",
     "intelHeading": "iGPU Intel",
-    "intelBody": "La ruta más común — ideal para transcoding por hardware de Plex / Jellyfin / Frigate vía <em>Quick Sync</em>. El contenedor recibe <code>/dev/dri/card0</code> (legacy) y <code>/dev/dri/renderD128</code> (nodo render-only moderno — lo que las apps usan realmente). No hace falta cambios del lado del host; el driver <code>i915</code> del host ya creó los nodos.",
+    "intelBody": "La aceleración Intel, incluido <em>Quick Sync</em>, depende de generación, códecs y configuración de la app. Comparte los nodos que existan entre <code>/dev/dri/card0</code>, <code>card1</code>, <code>renderD128</code> y <code>renderD129</code>; no añade otros números. Debe crearlos antes el controlador nativo del host, como <code>i915</code>.",
     "amdHeading": "AMD",
-    "amdBody": "Los mismos nodos DRI que Intel para gráficos / VA-API. Si <code>/dev/kfd</code> existe en el host (soporte de cómputo AMD / kernel ROCm), el script también lo añade para que los contenedores puedan hacer cargas OpenCL / ROCm. Los drivers VA de Mesa cubren el lado de decodificación de vídeo.",
+    "amdBody": "AMD usa DRI para Mesa/VA-API. Si existe <code>/dev/kfd</code> en el host, lo comparte también. ROCm/OpenCL requiere hardware y paquetes compatibles; compartir el dispositivo no instala toda la pila ROCm.",
     "nvidiaHeading": "NVIDIA",
-    "nvidiaBody": "Añade cada nodo <code>/dev/nvidia*</code> que el host expone. La pieza crítica es <strong>el matching de versión de driver</strong>: la versión del módulo del host y la versión de la lib userspace del contenedor deben ser idénticas, si no <code>nvidia-smi</code> dentro del contenedor falla. ProxMenux captura la versión del host en tiempo de detección y usa el mismo archivo <code>.run</code> para instalar el userspace del contenedor. Para contenedores Debian, la instalación sube la memoria del contenedor a 2 GB temporalmente (el instalador necesita ~1.5 GB libres para extraer) y la restaura después.",
-    "updateTitle": "Después de actualizar el driver NVIDIA del host, vuelve a ejecutar este script",
-    "updateBody": "Cuando actualizas el driver NVIDIA en el host, las libs userspace del contenedor se quedan en la versión vieja y <code>nvidia-smi</code> dentro del contenedor se rompe. El <nvidiaLink>instalador NVIDIA host</nvidiaLink> de ProxMenux detecta los contenedores con passthrough NVIDIA y se ofrece a actualizarlos automáticamente — pero si te saltaste ese prompt, simplemente ejecuta Añadir GPU a LXC otra vez sobre el mismo contenedor y refrescará el userspace."
+    "nvidiaBody": "Comparte <code>/dev/nvidia*</code> disponibles. <strong>Coincidir la versión del controlador</strong> es esencial para <code>nvidia-smi</code>. Debian/glibc usa el <code>.run</code> de la versión del host; Alpine/Arch, repositorios. Con menos de 2048 MiB de RAM configurada, la ruta Debian ofrece aumentarla temporalmente y restaurarla; exige 1500 MiB libres en disco.",
+    "updateTitle": "Tras actualizar NVIDIA en el host, comprueba las bibliotecas LXC",
+    "updateBody": "Bibliotecas antiguas pueden provocar incompatibilidad en <code>nvidia-smi</code>. El <nvidiaLink>instalador NVIDIA del host</nvidiaLink> ofrece actualizar LXC. Repetir Añadir GPU a LXC puede salir si ya existen los dispositivos: no garantiza actualizar bibliotecas. Verifica versiones y actualiza paquetes o el instalador de usuario apropiado."
   },
   "verification": {
     "heading": "Verificación",
-    "body": "Después de que el script termine, entra en el contenedor y comprueba que la GPU es visible:"
+    "body": "Entra en el contenedor y verifica que ve la GPU y puede utilizarla."
   },
   "troubleshoot": {
     "heading": "Solución de problemas",
     "mismatchTitle": "nvidia-smi: Failed to initialize NVML: Driver/library version mismatch",
-    "mismatchBody": "La versión userspace del contenedor ≠ la versión del módulo del host. Ejecuta Añadir GPU a LXC otra vez sobre ese contenedor — el script extrae el <code>.run</code> actual del host y reinstala el userspace haciéndolo coincidir.",
+    "mismatchBody": "Las bibliotecas no coinciden con el módulo activo. Verifica versiones y actualiza el espacio de usuario del LXC. El <code>.run</code> almacenado sirve para Debian/glibc, pero Añadir GPU a LXC puede salir si ya están todos los dispositivos.",
     "denyTitle": "Permission denied en /dev/dri/renderD128 dentro del contenedor",
-    "denyBody": "Normalmente uno de: (1) el contenedor es unprivileged sin mapeo UID/GID al grupo <code>render</code> del host; (2) el usuario dentro del contenedor no está en el grupo <code>render</code>. Fix: añade el usuario a <code>render</code> dentro del contenedor (<code>usermod -aG render &lt;user&gt;</code>), o pasa a modo privilegiado si la carga es de confianza.",
+    "denyBody": "Revisa dispositivo y permisos numéricos de <code>render</code>; comprueba que el usuario de la app pertenezca a <code>render</code>. Si está disponible, añádelo a <code>render</code> con <code>usermod -aG render &lt;user&gt;</code>, sustituyendo el marcador por la cuenta real. Reinicia su sesión. Cambiar privilegios no es una solución general.",
     "vainfoTitle": "vainfo dice: VA-API version 1.xx; failed to initialize",
-    "vainfoBody": "El runtime de VA-API está, pero no se instaló ningún driver adecuado. En Intel, instala <code>intel-media-driver</code> (gens nuevas) o <code>i965-va-driver</code> (gens viejas). En AMD, <code>mesa-va-drivers</code>. Vuelve a ejecutar el script en caso de duda.",
-    "logTitle": "Log de instalación",
-    "logBody": "Cada ejecución escribe en <code>/tmp/add_gpu_lxc.log</code> en el host. Inclúyelo cuando pidas ayuda en GitHub."
+    "vainfoBody": "Comprueba acceso y controlador VA-API. Los paquetes varían por distribución: ejemplos son <code>intel-media-driver</code> para Intel modernas compatibles, <code>i965-va-driver</code> para antiguas compatibles y <code>mesa-va-drivers</code> para AMD. El mensaje no prueba por sí solo que falte un paquete.",
+    "logTitle": "Registro de instalación",
+    "logBody": "Cada ejecución escribe <code>/tmp/add_gpu_lxc.log</code> en el host. Adjunta el registro al pedir ayuda."
   },
   "related": {
     "heading": "Relacionado",
@@ -163,17 +163,17 @@
       {
         "label": "Instalar drivers NVIDIA (Host)",
         "href": "/docs/hardware/nvidia-host",
-        "tail": " — prerequisito necesario para GPUs NVIDIA antes de pasarlas a un contenedor."
+        "tail": " — instala primero el controlador del host para compartir NVIDIA."
       },
       {
         "label": "Añadir GPU a VM (Passthrough)",
         "href": "/docs/hardware/gpu-vm-passthrough",
-        "tail": " — modelo alternativo cuando necesitas la GPU dedicada a una sola VM."
+        "tail": " — alternativa para dedicar una GPU a una VM."
       },
       {
-        "label": "Switch GPU Mode (VM ↔ LXC)",
+        "label": "Cambiar modo de GPU (VM ↔ LXC)",
         "href": "/docs/hardware/switch-gpu-mode",
-        "tail": " — alterna la misma GPU entre compartición LXC y passthrough a VM."
+        "tail": " — cambia la GPU entre compartir con LXC y asignar a VM."
       },
       {
         "label": "Comandos de GPU Passthrough",
diff --git a/web/messages/es/docs/hardware/install-coral-tpu-host.json b/web/messages/es/docs/hardware/install-coral-tpu-host.json
index d61e8fee..afd64935 100644
--- a/web/messages/es/docs/hardware/install-coral-tpu-host.json
+++ b/web/messages/es/docs/hardware/install-coral-tpu-host.json
@@ -1,164 +1,164 @@
 {
   "meta": {
-    "title": "Instalar Coral TPU en el host | ProxMenux Documentation",
-    "description": "Instala los drivers de Google Coral TPU en un host Proxmox VE. ProxMenux autodetecta si tienes M.2 / Mini-PCIe o el USB Accelerator (o ambos) y ejecuta solo la ruta de instalación que aplica — módulos de kernel gasket/apex vía DKMS para PCIe, runtime libedgetpu1-std para USB."
+    "title": "Instalar Coral TPU en el host | Documentación de ProxMenux",
+    "description": "Instala componentes Coral en Proxmox VE según el hardware detectado: módulos gasket/apex con DKMS para M.2 / Mini-PCIe y runtime libedgetpu1-std para USB. Si detecta ambos, ejecuta los dos procesos."
   },
   "header": {
     "title": "Instalar Coral TPU en el host",
-    "description": "Prepara el host Proxmox para que más adelante se pueda pasar una Coral TPU a un contenedor LXC. ProxMenux autodetecta si tienes una tarjeta M.2 / Mini-PCIe, un USB Accelerator, o ambos, y ejecuta solo la ruta de instalación que aplica — build del módulo de kernel vía DKMS para PCIe, runtime Edge TPU de Google para USB.",
-    "section": "Hardware: GPUs y Coral-TPU"
+    "description": "Prepara el host Proxmox para usar Coral y compartirla con LXC. Detecta M.2 / Mini-PCIe, USB o ambos y ejecuta el proceso correspondiente: módulos DKMS para PCIe y runtime Google Edge TPU para USB.",
+    "section": "Hardware: GPU y Coral-TPU"
   },
   "intro": {
-    "title": "Qué hace esto",
-    "body": "El instalador de Coral es <strong>unificado y consciente del hardware</strong>: ejecutas una opción del menú y averigua qué tienes realmente. Las tarjetas M.2 / Mini-PCIe necesitan módulos de kernel (<code>gasket</code> + <code>apex</code>) construidos con DKMS para que sobrevivan a las actualizaciones de kernel. Los USB Accelerators solo necesitan el runtime Edge TPU de Google (<code>libedgetpu1-std</code>) desde el propio repositorio APT de Google. ¿Ambos tipos enchufados? Ambas rutas se ejecutan en secuencia."
+    "title": "Qué hace",
+    "body": "Un <strong>instalador único que detecta el hardware</strong>. PCIe usa <code>gasket</code> y <code>apex</code> con DKMS; futuras compilaciones requieren fuentes y cabeceras compatibles. USB usa <code>libedgetpu1-std</code>. Si detecta ambos, ejecuta ambos procesos. El runtime USB debe estar donde corre la app; si solo corre en LXC, no es obligatorio tenerlo también en el host."
   },
   "which": {
     "heading": "¿Qué Coral tengo?",
-    "body": "Los dos tipos de dispositivos Coral que puedes enchufar en un host Proxmox se ven muy diferentes y la instalación del lado del host también es muy diferente. El script gestiona ambos, pero conviene saber qué tienes antes de ejecutar nada:",
+    "body": "Los modelos PCIe y USB tienen formatos y requisitos distintos. El script gestiona ambos; identifica tu dispositivo antes de ejecutarlo.",
     "headerForm": "Factor de forma",
     "headerDetect": "Detección",
     "headerInstall": "Tipo de instalación",
     "headerReboot": "¿Reiniciar?",
     "pcieForm": "M.2 / Mini-PCIe",
-    "pcieFormSub": "(TPU dual-edge en una tarjeta M.2)",
-    "pcieDetect": "PCI vendor <code>1ac1</code>",
+    "pcieFormSub": "(hay tarjetas M.2 con una o dos Edge TPU)",
+    "pcieDetect": "ID de fabricante PCI <code>1ac1</code>",
     "pcieInstall": "Módulo de kernel (gasket + apex) vía DKMS",
     "pcieReboot": "Sí",
-    "usbForm": "USB Accelerator",
+    "usbForm": "Acelerador USB",
     "usbFormSub": "(pequeño dongle de plástico)",
     "usbDetect": "USB <code>1a6e:089a</code> (sin programar) / <code>18d1:9302</code> (programado)",
-    "usbInstall": "Runtime userspace (<code>libedgetpu1-std</code>) desde el repo APT de Google",
+    "usbInstall": "Runtime <code>libedgetpu1-std</code> del repositorio APT de Google",
     "usbReboot": "No"
   },
   "prereqs": {
     "title": "Antes de empezar",
-    "coral": "<strong>Una Coral TPU enchufada en el host</strong> (M.2, Mini-PCIe o USB). Sin Coral no hay instalación — el script simplemente te dice que no se detectó nada y sale.",
+    "coral": "<strong>Una Coral conectada</strong> (M.2, Mini-PCIe o USB) para instalar. Sin hardware detectado puede ofrecer limpiar o desinstalar componentes existentes, pero no instala una nueva ruta de hardware.",
     "coralCheck": "lspci -d 1ac1: ; lsusb | grep -E '1a6e:089a|18d1:9302'",
-    "internet": "<strong>Acceso a internet</strong> en el host — para PCIe la ruta DKMS clona un repo de GitHub, para USB añade un repo APT de Google y descarga el paquete <code>libedgetpu1-std</code>.",
-    "headers": "<strong>Headers del kernel disponibles vía APT</strong>. En Proxmox esto significa que <code>proxmox-headers-$(uname -r)</code> debe ser instalable — solo necesario para la ruta PCIe/M.2, pero el script lo trae automáticamente para que tú no tengas que hacerlo.",
-    "reboot": "<strong>Asume un reinicio</strong> si tienes hardware PCIe. El módulo de kernel se construye y se carga al final, pero un arranque limpio es la forma limpia de confirmar que sale por sí solo."
+    "internet": "<strong>Acceso a Internet</strong> en el host para clonar el controlador PCIe de GitHub o descargar <code>libedgetpu1-std</code> del repositorio APT de Google para USB.",
+    "headers": "<strong>Cabeceras del kernel disponibles en APT</strong>: <code>proxmox-headers-$(uname -r)</code>. Solo las necesita PCIe/M.2; el script las instala.",
+    "reboot": "<strong>Planifica un reinicio</strong> para PCIe. El script intenta cargar los módulos compilados; reiniciar permite comprobar que se cargan automáticamente."
   },
   "hostPrepTip": {
     "title": "Esto solo prepara el host",
-    "body": "Instalar Coral aquí deja el host <em>listo</em> — la TPU es visible para el kernel del host y se puede entregar a un LXC. Para <em>usarla</em> realmente desde un contenedor (Frigate, DeepStack, etc.), el siguiente paso es <lxcLink>Añadir Coral TPU a un LXC</lxcLink>."
+    "body": "Prepara el host para <em>acceder al dispositivo</em>; no configura ni prueba la aplicación. Para <em>usar</em> Coral en una app compatible como Frigate, continúa con <lxcLink>Añadir Coral TPU a un LXC</lxcLink>."
   },
   "running": {
     "heading": "Ejecutar el instalador",
-    "body": "Abre ProxMenux en el host, ve a <strong>Hardware: GPUs and Coral-TPU → Install/Update Coral TPU on Host</strong>.",
-    "imageAlt": "Entrada del menú 'Install/Update Coral TPU on Host' dentro de Hardware: GPUs and Coral-TPU"
+    "body": "Abre ProxMenux en el host y ve a <strong>Hardware: GPU y Coral-TPU → Instalar/actualizar Coral TPU en el host</strong>.",
+    "imageAlt": "Opción del menú para instalar o actualizar Coral TPU en el host"
   },
   "howRuns": {
-    "heading": "Cómo se ejecuta el script",
-    "body": "El hardware se detecta primero, así que el plan de instalación se adapta a tu setup real. No se instala nada hasta que confirmas."
+    "heading": "Cómo funciona el script",
+    "body": "Primero detecta el hardware y prepara el plan correspondiente. La instalación requiere confirmación."
   },
   "walkthrough": {
-    "heading": "Recorriendo el flujo",
+    "heading": "Proceso paso a paso",
     "detect": {
       "title": "Detección de hardware",
-      "body": "El script lee <code>/sys/bus/pci/devices/*/vendor</code> buscando <code>0x1ac1</code> (Global Unichip Corp., el fabricante del silicio de los chips Coral TPU) y ejecuta <code>lsusb</code> buscando los IDs del USB Accelerator. El dispositivo USB tiene <strong>dos</strong> IDs según si su firmware ya se ha cargado:",
+      "body": "Busca el fabricante <code>0x1ac1</code> en <code>/sys/bus/pci/devices/*/vendor</code> y usa <code>lsusb</code> para detectar USB. Hay <strong>dos</strong> ID USB, según se haya cargado el firmware:",
       "items": [
-        "<code>1a6e:089a</code> — Global Unichip, estado <em>sin programar</em> (antes de que el runtime Edge TPU le hable por primera vez).",
-        "<code>18d1:9302</code> — Google, estado <em>programado</em> (después de que el runtime le cargue firmware)."
+        "<code>1a6e:089a</code> — Global Unichip, estado <em>sin programar</em>, antes de que el runtime cargue el firmware.",
+        "<code>18d1:9302</code> — Google, estado <em>programado</em>, tras cargar el firmware."
       ],
-      "outro": "Si no se encuentra ninguno, recibes un diálogo informativo y el script sale limpiamente — sin cambios parciales en el host."
+      "outro": "Si no detecta Coral ni una instalación previa, muestra un aviso y sale. Si hay componentes existentes, puede ofrecer limpiarlos o desinstalarlos."
     },
     "prompt": {
-      "title": "Prompt previo a la instalación",
-      "body": "Antes de tocar nada, un único diálogo resume lo que se detectó y lo que se instalará. Puedes cancelar aquí sin ningún efecto secundario.",
-      "imageAlt": "Diálogo previo a la instalación mostrando el hardware Coral detectado (cuenta de M.2/PCIe + cuenta de USB) y la lista de pasos que ejecutará el instalador"
+      "title": "Confirmación de la instalación",
+      "body": "Antes de instalar, un diálogo resume los dispositivos y componentes previstos. Cancelar omite la instalación. La limpieza opcional de componentes antiguos tiene una confirmación anterior independiente.",
+      "imageAlt": "Resumen de dispositivos Coral y pasos de instalación"
     },
     "pcie": {
-      "title": "Ruta PCIe — módulos de kernel gasket + apex vía DKMS",
-      "body": "Solo se ejecuta si el script encontró una Coral PCIe / M.2. Es la más pesada de las dos rutas porque está compilando un módulo de kernel para tu kernel en ejecución exacto.",
+      "title": "PCIe: módulos gasket y apex mediante DKMS",
+      "body": "Solo se ejecuta si detecta una Coral PCIe/M.2. Compila módulos para el kernel que está ejecutando el host.",
       "items": [
-        "<strong>Limpieza.</strong> Si una instalación anterior de <code>gasket-dkms</code> dejó dpkg en un estado roto (típico tras una actualización de kernel PVE 9 donde el autoinstall de DKMS falló silenciosamente), force-purge.",
-        "<strong>Instalar dependencias de build:</strong> <code>git</code>, <code>dkms</code>, <code>build-essential</code>, <code>proxmox-headers-$(uname -r)</code>."
+        "<strong>Limpieza.</strong> Elimina cualquier paquete <code>gasket-dkms</code> existente antes de compilar; si está en mal estado, fuerza su eliminación y lo purga.",
+        "<strong>Dependencias de compilación:</strong> <code>git</code>, <code>dkms</code>, <code>build-essential</code>, <code>proxmox-headers-$(uname -r)</code>."
       ],
-      "cloneIntro": "<strong>Clonar el código del driver.</strong> Prefiere el fork de la comunidad <feranickLink>feranick/gasket-driver</feranickLink> (mantenimiento activo, listo para kernel 6.12+). Recurre a <googleLink>google/gasket-driver</googleLink> si feranick no es accesible, aplicando parches específicos del kernel:",
+      "cloneIntro": "<strong>Clona el controlador.</strong> Prefiere <feranickLink>feranick/gasket-driver</feranickLink> y recurre a <googleLink>google/gasket-driver</googleLink> si no está disponible. Compilar requiere compatibilidad con el kernel. Al código de Google le aplica estos parches según la versión:",
       "kernelPatches": [
-        "Kernel 6.5+ : <code>no_llseek</code> eliminado en upstream → sustitución por <code>noop_llseek</code>",
-        "Kernel 6.13+ : <code>MODULE_IMPORT_NS(DMA_BUF)</code> requiere literal de string"
+        "Para kernel 6.5 o superior, sustituye <code>no_llseek</code> por <code>noop_llseek</code> en el código alternativo.",
+        "Kernel 6.13 o superior: convierte el argumento de <code>MODULE_IMPORT_NS(DMA_BUF)</code> en una cadena literal."
       ],
       "afterItems": [
-        "<strong>Stage del código en <code>/usr/src/gasket-1.0/</code>,</strong> generar <code>dkms.conf</code>, registrar con <code>dkms add</code>.",
-        "<strong>Build + install:</strong> <code>dkms build</code> y luego <code>dkms install</code>. Si algo falla, las últimas 50 líneas de <code>make.log</code> se imprimen en el terminal para que veas el error real — sin tener que cazar en archivos de log.",
-        "<strong>Crear el grupo <code>apex</code> + reglas udev</strong> (<code>/etc/udev/rules.d/99-coral-apex.rules</code>) para que los nodos <code>/dev/apex_*</code> tengan el grupo correcto en el siguiente arranque.",
-        "<strong>Cargar los módulos:</strong> <code>modprobe gasket</code> + <code>modprobe apex</code>."
+        "<strong>Copia las fuentes a <code>/usr/src/gasket-1.0/</code>,</strong> genera <code>dkms.conf</code> y las registra con <code>dkms add</code>.",
+        "<strong>Compila e instala:</strong> <code>dkms build</code> y después <code>dkms install</code>. Si falla, muestra las últimas 50 líneas de <code>make.log</code> si existe.",
+        "<strong>Crea el grupo <code>apex</code> y reglas udev</strong> (<code>/etc/udev/rules.d/99-coral-apex.rules</code>) para asignar el grupo a <code>/dev/apex_*</code>.",
+        "<strong>Intenta cargar los módulos:</strong> <code>modprobe gasket</code> y <code>modprobe apex</code>."
       ],
-      "imageAlt": "Progreso de build DKMS + salida de carga de módulo para los módulos de kernel gasket/apex"
+      "imageAlt": "Compilación DKMS y carga de módulos gasket/apex"
     },
     "usb": {
-      "title": "Ruta USB — runtime Edge TPU de Google",
+      "title": "USB: runtime Edge TPU de Google",
       "body": "Solo se ejecuta si se detectó un USB Accelerator. Mucho más simple:",
       "items": [
-        "<strong>Añadir la clave GPG de Google</strong> a <code>/etc/apt/keyrings/coral-edgetpu.gpg</code>.",
-        "<strong>Añadir el repositorio APT</strong> a <code>/etc/apt/sources.list.d/coral-edgetpu.list</code> con <code>signed-by=</code> apuntando al keyring (formato moderno, no deprecado).",
-        "<strong>Instalar <code>libedgetpu1-std</code></strong> — el runtime Edge TPU de rendimiento estándar.",
-        "<strong>Recargar udev</strong> para que las reglas que vienen con el paquete apliquen al dispositivo USB sin tener que desenchufar/reenchufar."
+        "<strong>Añade la clave GPG de Google</strong> a <code>/etc/apt/keyrings/coral-edgetpu.gpg</code>.",
+        "<strong>Añade el repositorio APT</strong> en <code>/etc/apt/sources.list.d/coral-edgetpu.list</code>; <code>signed-by=</code> limita la verificación a su llavero. Usa sintaxis .list de una línea, no .sources de deb822.",
+        "<strong>Instala <code>libedgetpu1-std</code></strong>, el runtime Edge TPU de rendimiento estándar.",
+        "<strong>Recarga udev</strong> y activa las reglas del paquete sobre el dispositivo USB."
       ],
       "stdTitle": "¿Por qué libedgetpu1-std y no libedgetpu1-max?",
-      "stdBody": "La variante <code>max</code> overclockea la Coral y calienta más. Está bien para uso de desktop con ventilación; no recomendado en builds NUC / Mini-PC pequeños o hosts Proxmox refrigerados pasivamente. Si realmente la quieres, instálala a mano después: <code>apt install libedgetpu1-max</code>."
+      "stdBody": "El paquete <code>max</code> activa la máxima frecuencia admitida, con más rendimiento, consumo y calor. Comprueba la refrigeración y condiciones del acelerador antes de cambiar. Los paquetes son excluyentes; cambia con <code>apt install libedgetpu1-max</code>."
     },
     "reboot": {
-      "title": "Prompt de reinicio (solo si se ejecutó PCIe)",
-      "body": "Si la ruta PCIe se ejecutó, el script ofrece un reinicio. Los módulos ya se <code>modprobe</code>'aron así que en teoría puedes saltarte el reinicio — pero un arranque limpio es la forma correcta de verificar que el módulo sale por sí solo y que <code>/dev/apex_0</code> aparece con grupo <code>apex</code>. Para instalaciones solo USB, no se sugiere reinicio (el runtime y las reglas udev están activos inmediatamente).",
-      "imageAlt": "Resumen final + prompt de reinicio después de una instalación PCIe"
+      "title": "Reinicio opcional tras la instalación PCIe",
+      "body": "Tras PCIe ofrece reiniciar. Ya ha intentado <code>modprobe</code>, pero comprueba que carga los módulos y que <code>/dev/apex_0</code> aparece con grupo <code>apex</code>. Un reinicio planificado verifica la carga automática. Con solo USB no pide reiniciar el host.",
+      "imageAlt": "Resumen y propuesta de reinicio tras instalar PCIe"
     }
   },
   "legacyCleanup": {
-    "heading": "Limpieza de gasket-dkms antiguo en hosts con Coral USB",
-    "intro": "Si el host <strong>no tiene ninguna Coral PCIe / M.2 detectada</strong>, pero conserva una instalación anterior de <code>gasket-dkms</code>, ProxMenux identifica ese estado por separado y ofrece una limpieza opcional. No se elimina nada sin confirmación.",
+    "heading": "Limpiar gasket-dkms antiguo en hosts que solo usan USB",
+    "intro": "Si <strong>no detecta Coral PCIe/M.2</strong> pero existe una instalación anterior de <code>gasket-dkms</code>, ofrece una limpieza opcional. Requiere confirmación.",
     "items": [
-      "Si hay una Coral PCIe / M.2 presente, esta limpieza nunca se ofrece; se utiliza la ruta normal de reconstrucción DKMS.",
-      "La limpieza purga <code>gasket-dkms</code>, elimina registros DKMS y árboles de código gasket residuales, y repara cualquier estado pendiente de <code>dpkg</code> o APT.",
-      "Los paquetes del runtime USB <code>libedgetpu1-std</code> y <code>libedgetpu1-max</code> no se modifican, por lo que una Coral USB conserva su runtime.",
+      "Si detecta una Coral PCIe/M.2, usa la ruta normal de recompilación DKMS y no ofrece esta limpieza.",
+      "Purga <code>gasket-dkms</code>, elimina registros DKMS y fuentes obsoletas de gasket y repara el estado pendiente de <code>dpkg</code>/APT.",
+      "Conserva los paquetes USB <code>libedgetpu1-std</code> y <code>libedgetpu1-max</code>, por lo que la Coral USB mantiene su runtime.",
       "Antes de indicar que ha terminado correctamente, el script verifica que el paquete antiguo ya no existe y que el gestor de paquetes está en buen estado."
     ],
     "warningTitle": "Confirma primero el hardware",
-    "warningBody": "Si puede haber una Coral PCIe / M.2 instalada pero no está siendo detectada, cancela la limpieza y comprueba la tarjeta, la ranura y la configuración del firmware antes de continuar."
+    "warningBody": "Si esperabas una Coral PCIe/M.2 y no aparece, cancela la limpieza y revisa tarjeta, slot y firmware."
   },
   "reinstallUninstall": {
     "heading": "Reinstalar o desinstalar",
-    "intro": "Ejecutar el instalador en un host donde Coral ya está instalada (PCIe vía <code>gasket-dkms</code>, USB vía <code>libedgetpu1-std</code>/<code>libedgetpu1-max</code>, o ambos) ya no cae directamente en otra instalación fresca. En su lugar, ProxMenux detecta el setup existente y muestra un menú de acciones para que decidas qué hacer.",
-    "imageAlt": "Menú de acciones de Coral con dos opciones — Reinstalar / actualizar drivers Coral, o Desinstalar drivers y configuración Coral — mostrado cuando el instalador detecta una instalación previa de Coral en el host",
-    "imageCaption": "El menú de acciones solo aparece cuando al menos un componente de Coral está ya instalado (entrada DKMS de gasket, paquete <code>libedgetpu1-*</code> o nodos de dispositivo <code>/dev/apex_*</code> en vivo).",
+    "intro": "Si detecta una instalación PCIe con <code>gasket-dkms</code>, USB con <code>libedgetpu1-std</code>/<code>libedgetpu1-max</code> o ambas, muestra un menú para elegir la acción.",
+    "imageAlt": "Menú para reinstalar, actualizar o desinstalar Coral",
+    "imageCaption": "El menú aparece si existe algún componente: un registro DKMS gasket, un paquete <code>libedgetpu1-*</code> o dispositivos <code>/dev/apex_*</code>.",
     "reinstallHeading": "Reinstalar / actualizar",
-    "reinstallBody": "Continúa con el flujo normal de instalación — útil después de una actualización de kernel si la rebuild DKMS no ocurrió automáticamente, o para elevar el runtime a un <code>libedgetpu1-*</code> más nuevo del repo apt de Google Coral. Primero se limpia el estado DKMS anterior para que un paquete medio instalado de un intento previo fallido no bloquee el nuevo build.",
+    "reinstallBody": "Ejecuta la instalación normal: recompila tras cambiar de kernel o actualiza <code>libedgetpu1-*</code> desde Google. Antes limpia el estado DKMS anterior para evitar que una instalación fallida bloquee la compilación.",
     "uninstallHeading": "Desinstalar — qué se elimina",
-    "uninstallIntro": "Confirma con un diálogo sí/no antes de hacer nada (los contenedores LXC con passthrough de apex perderán acceso a <code>/dev/apex_*</code> después del siguiente reinicio — el aviso lo deja claro). Luego ejecuta un rollback completo e idempotente:",
+    "uninstallIntro": "Requiere confirmación. Las apps LXC que usan <code>/dev/apex_*</code> pueden perder acceso durante la desinstalación o tras reiniciar. El proceso es:",
     "uninstallItems": [
-      "Descarga los módulos de kernel <code>apex</code> y <code>gasket</code>.",
-      "Quita cada entrada <code>gasket/&lt;version&gt;</code> registrada en DKMS para que los módulos no vuelvan en la siguiente instalación de kernel.",
-      "Purga los paquetes apt <code>gasket-dkms</code>, <code>libedgetpu1-std</code> y <code>libedgetpu1-max</code>, luego ejecuta <code>apt-get autoremove --purge</code>.",
-      "Borra la regla udev <code>/etc/udev/rules.d/99-coral-apex.rules</code> que escribió ProxMenux; restaura el grupo de la regla upstream <code>60-gasket-dkms.rules</code> a su default si sigue presente.",
-      "Elimina el grupo de sistema <code>apex</code> <strong>solo si ya no hay usuarios en él</strong> — si mapeaste un usuario custom a <code>apex</code> para un passthrough a LXC, el grupo se deja en su sitio y un aviso imprime los miembros actuales.",
-      "Limpia la entrada del repositorio apt de Google Coral y el keyring (<code>/etc/apt/sources.list.d/coral-edgetpu.list</code> + <code>coral-edgetpu-archive-keyring.gpg</code>).",
-      "Pide reiniciar al final <strong>solo si se instaló la ruta PCIe</strong> — la forma más limpia de descargar los módulos del kernel. Las desinstalaciones solo USB no lo necesitan."
+      "Intenta descargar <code>apex</code> y <code>gasket</code>; si están en uso pueden permanecer cargados.",
+      "Elimina cada entrada <code>gasket/&lt;version&gt;</code> registrada en DKMS para que los módulos no vuelvan en la siguiente instalación de kernel.",
+      "Purga <code>gasket-dkms</code>, <code>libedgetpu1-std</code> y <code>libedgetpu1-max</code> y ejecuta <code>apt-get autoremove --purge</code>.",
+      "Elimina <code>/etc/udev/rules.d/99-coral-apex.rules</code> y restaura el grupo predeterminado de <code>60-gasket-dkms.rules</code> si aún existe.",
+      "Consulta los miembros secundarios de <code>apex</code>. <strong>Si la lista está vacía</strong>, intenta eliminar el grupo; si no, conserva <code>apex</code> y muestra sus miembros. No comprueba por completo los usuarios que lo tienen como grupo principal.",
+      "Elimina la lista del repositorio <code>/etc/apt/sources.list.d/coral-edgetpu.list</code>, la antigua <code>coral-cloud.list</code> y los llaveros antiguos llamados <code>coral-edgetpu-archive-keyring.gpg</code>. Este proceso no elimina el llavero actual <code>/etc/apt/keyrings/coral-edgetpu.gpg</code>.",
+      "Ofrece reiniciar <strong>solo si estaba instalado PCIe</strong> para descargar los módulos que sigan activos. Desinstalar solo USB no requiere reinicio."
     ],
     "lxcWarnTitle": "Contenedores LXC con passthrough de apex",
-    "lxcWarnBody": "Desinstalar en el host invalida la ruta de dispositivo mapeada a cualquier contenedor LXC configurado para passthrough de apex. Planifica la operación en una ventana de mantenimiento si Frigate / DeepStack / cargas similares dependen de ello."
+    "lxcWarnBody": "Desinstalar los componentes del host puede romper el acceso desde LXC. Planifica mantenimiento si aplicaciones compatibles como Frigate dependen de esta Coral."
   },
   "updates": {
-    "heading": "Notificaciones de actualización",
-    "intro": "ProxMenux ahora rastrea los componentes Coral instalados en su registro de instalaciones gestionadas. Ambas variantes se siguen de forma independiente — un host con dispositivos Coral M.2 y USB recibe dos streams de actualización, cada uno con su propia fuente upstream:",
+    "heading": "Avisos de actualización",
+    "intro": "ProxMenux registra los componentes Coral instalados y comprueba PCIe/M.2 y USB por separado. Si tienes ambos, cada variante usa su propia fuente de versiones:",
     "headerVariant": "Variante",
-    "headerTracked": "Versión rastreada",
-    "headerUpstream": "Fuente upstream",
+    "headerTracked": "Versión registrada",
+    "headerUpstream": "Fuente de versiones",
     "pcieVariant": "PCIe / M.2",
-    "pcieTracked": "Versión Debian de <code>gasket-dkms</code> (o la versión registrada en DKMS si el paquete se quitó a la fuerza)",
-    "pcieUpstream": "Último tag de <code>feranick/gasket-driver</code> en GitHub (caché de 7 días, comparación por número de build)",
+    "pcieTracked": "Primero la etiqueta registrada tras instalar; después la versión de <code>gasket-dkms</code> si el paquete está bien; como alternativa, la versión DKMS. Esta última no identifica los parches del fork.",
+    "pcieUpstream": "Última etiqueta de <code>feranick/gasket-driver</code> en GitHub; caché de siete días y comparación del número de compilación.",
     "usbVariant": "USB",
     "usbTracked": "Versión apt de <code>libedgetpu1-std</code> o <code>libedgetpu1-max</code>",
     "usbUpstream": "Candidato local de <code>apt-cache policy</code> (repo apt de Google Coral)",
-    "outro": "Cuando se detecta una versión más nueva el Monitor dispara una notificación <code>coral_driver_update_available</code> en cada canal habilitado (Telegram, Discord, Gotify, ntfy, email, webhook). La notificación apunta de vuelta a la misma entrada del instalador — elige <strong>Reinstall / update</strong> del menú de acciones de arriba para aplicarla.",
-    "antiTitle": "Anti-cascada por diseño",
-    "antiBody": "Una notificación por variante, solo cuando la versión upstream cambia realmente — nunca en cada escaneo de 24h. Si ignoras una actualización no te vuelve a pingar hasta que llegue una release más nueva.",
-    "rebootTitle": "El reinicio solo hace falta para la ruta PCIe",
-    "rebootBody": "La rebuild DKMS de gasket carga nuevos módulos de kernel — eso necesita un reinicio para estar activo. La actualización del runtime USB es un swap de librería userspace, sin reinicio."
+    "outro": "Si detecta una versión nueva, Monitor emite <code>coral_driver_update_available</code> por los canales habilitados. El aviso lleva al instalador: elige <strong>Reinstalar / actualizar</strong> para aplicarla.",
+    "antiTitle": "Sin avisos repetidos",
+    "antiBody": "Un aviso por variante cuando cambia la versión disponible. No lo repite en cada revisión diaria; vuelve a avisar cuando aparece una versión posterior.",
+    "rebootTitle": "Actualizaciones PCIe: planifica un reinicio",
+    "rebootBody": "El módulo PCIe recompilado debe cargarse para usarlo; reiniciar comprueba también su carga automática. Actualizar la biblioteca USB no requiere reiniciar el host, pero puede requerir reiniciar las apps que usaban la anterior."
   },
   "manual": {
     "heading": "Equivalente manual",
-    "intro": "Si quieres saber qué pasa bajo el capó, o rehacer un paso individual a mano, los comandos crudos por ruta se ven así.",
+    "intro": "Estos comandos muestran los pasos principales de cada ruta para consultarlos o ejecutarlos manualmente.",
     "pcieHeading": "PCIe / M.2 (gasket + apex vía DKMS)",
     "usbHeading": "USB (runtime libedgetpu)"
   },
@@ -169,16 +169,16 @@
   },
   "troubleshoot": {
     "heading": "Solución de problemas",
-    "dkmsFailTitle": "La build DKMS falla después de una actualización de kernel",
-    "dkmsFailBody": "Causa más común en PVE 9: el kernel en ejecución subió pero <code>proxmox-headers-$(uname -r)</code> aún no está instalado para él. Comprueba con <code>dpkg -l proxmox-headers-$(uname -r)</code>. Instala los headers que faltan y vuelve a ejecutar el script — el paso <code>cleanup_broken_gasket_dkms</code> de ProxMenux gestiona cualquier estado residual de paquete medio configurado.",
+    "dkmsFailTitle": "Falla la compilación DKMS tras actualizar el kernel",
+    "dkmsFailBody": "Una causa posible son cabeceras ausentes. Comprueba <code>proxmox-headers-$(uname -r)</code> con <code>dpkg -l proxmox-headers-$(uname -r)</code>. Instálalas si faltan y revisa incompatibilidades en el registro. Al repetir ejecuta <code>cleanup_broken_gasket_dkms</code>, pero limpiar no garantiza compatibilidad con cualquier kernel.",
     "apexMissTitle": "/dev/apex_0 no está después del reinicio",
-    "apexMissBody": "El módulo no está cargado. Prueba <code>modprobe apex</code> a mano. Si eso da error, comprueba <code>dmesg | grep -iE \"apex|gasket\"</code> para el fallo real — culpables comunes son version mismatch del kernel (DKMS se construyó para un kernel distinto del que arrancaste) o una actualización de firmware que deshabilitó el slot PCIe en el que está la Coral.",
-    "lxcMissTitle": "Puedo ver /dev/apex_0 pero el LXC no",
-    "lxcMissBody": "El host está bien. El problema es la config de passthrough — consulta <lxcLink>Añadir Coral TPU a un LXC</lxcLink>.",
+    "apexMissBody": "Comprueba la detección PCIe y que el módulo corresponda al kernel activo. Prueba <code>modprobe apex</code> y consulta <code>dmesg | grep -iE \"apex|gasket\"</code>. Fallos de compilación, carga o configuración de slot/firmware pueden impedir crear el dispositivo.",
+    "lxcMissTitle": "El host ve /dev/apex_0, pero el LXC no",
+    "lxcMissBody": "Ver el nodo no prueba que funcione. Verifica acceso en el host, montaje LXC, reglas cgroup y permisos de UID/GID. Consulta <lxcLink>Añadir Coral TPU a un LXC</lxcLink>.",
     "usbUnreachTitle": "USB Accelerator detectado pero Frigate / TFLite no llega a él",
-    "usbUnreachBody": "Comprueba que las reglas udev que vienen con <code>libedgetpu1-std</code> surtieron efecto: <code>ls -l /dev/bus/usb/*/*</code>. El dispositivo NO debería ser propiedad de root:root con modo 0600 — si lo es, ejecuta <code>udevadm control --reload-rules &amp;&amp; udevadm trigger</code> en el host, desenchufa la Coral USB, espera 3 segundos y vuelve a enchufarla.",
-    "logTitle": "Log de instalación",
-    "logBody": "Cada ejecución escribe en <code>/tmp/coral_install.log</code> en el host. Si la build DKMS muere, el script también añade las últimas 50 líneas de <code>/var/lib/dkms/gasket/1.0/build/make.log</code> a ese log — adjúntalo cuando pidas ayuda en GitHub."
+    "usbUnreachBody": "Revisa las reglas de <code>libedgetpu1-std</code> y permisos con <code>ls -l /dev/bus/usb/*/*</code>. El UID/GID de la app debe tener lectura y escritura; ser propiedad de root no basta para diagnosticar el fallo. Tras cambiar reglas, ejecuta <code>udevadm control --reload-rules &amp;&amp; udevadm trigger</code> y reconecta si hace falta.",
+    "logTitle": "Registro de instalación",
+    "logBody": "Cada ejecución escribe <code>/tmp/coral_install.log</code>. Si falla DKMS y existe el registro, añade sus últimas 50 líneas desde <code>/var/lib/dkms/gasket/1.0/build/make.log</code>. Adjunta el registro al pedir ayuda."
   },
   "related": {
     "heading": "Relacionado",
@@ -186,7 +186,7 @@
       {
         "label": "Añadir Coral TPU a LXC",
         "href": "/docs/hardware/coral-tpu-lxc",
-        "tail": " — pasar el dispositivo Coral del host a un contenedor (Frigate, CodeProject.AI…)."
+        "tail": " — pasar Coral del host a un contenedor con una app compatible."
       },
       {
         "label": "Instalar drivers NVIDIA (Host)",
@@ -196,7 +196,7 @@
       {
         "label": "ProxMenux Monitor — pestaña Hardware",
         "href": "/docs/monitor/dashboard/hardware",
-        "tail": " — el modal de Coral que muestra driver, módulos, nodos de dispositivo, estado del runtime y temperatura en vivo una vez hecha la instalación en el host."
+        "tail": " — el panel Coral muestra controlador, módulos, dispositivos y runtime; también temperatura si hay un sensor compatible."
       }
     ]
   }
diff --git a/web/messages/es/docs/hardware/nvidia-host.json b/web/messages/es/docs/hardware/nvidia-host.json
index acd3328c..b3fd9d63 100644
--- a/web/messages/es/docs/hardware/nvidia-host.json
+++ b/web/messages/es/docs/hardware/nvidia-host.json
@@ -1,146 +1,146 @@
 {
   "meta": {
-    "title": "Instalar drivers NVIDIA en el host | ProxMenux Documentation",
-    "description": "Instala y configura los drivers propietarios NVIDIA en un host Proxmox VE usando ProxMenux. Cubre filtrado por GPU, validación DKMS, servicio de persistencia, parche NVENC opcional y propagación automática a LXC."
+    "title": "Instalar NVIDIA en el host | Documentación de ProxMenux",
+    "description": "Instala controladores propietarios NVIDIA en Proxmox VE con ProxMenux: filtrado por GPU, comprobaciones de compilación y DKMS, persistencia, parche NVENC opcional y actualización de bibliotecas en LXC."
   },
   "header": {
     "title": "Instalar drivers NVIDIA en el host",
-    "description": "Instala el driver propietario NVIDIA en un host Proxmox VE usando ProxMenux. El instalador filtra las ramas mantenidas por el PCI ID de la GPU, valida la versión elegida mediante DKMS, gestiona nouveau, instala el servicio de persistencia y puede propagar el driver a contenedores LXC con passthrough NVIDIA.",
-    "section": "Hardware: GPUs y Coral-TPU"
+    "description": "Instala NVIDIA en el host Proxmox VE. Filtra las ramas mantenidas según el ID PCI de la GPU, comprueba la compilación, usa DKMS, gestiona nouveau e instala persistencia. También puede actualizar bibliotecas de LXC con acceso NVIDIA.",
+    "section": "Hardware: GPU y Coral-TPU"
   },
   "intro": {
-    "title": "Qué hace esto",
-    "body": "ProxMenux automatiza todo el ciclo de vida del driver NVIDIA en el host: detecta tu GPU, ofrece ramas mantenidas por NVIDIA que incluyen su PCI Device ID, pone <code>nouveau</code> en blacklist, descarga y ejecuta el instalador oficial <code>.run</code> con DKMS, instala <code>nvidia-persistenced</code> y las reglas udev, y ofrece aplicar el parche NVENC opcional. La compilación DKMS es la validación final frente al kernel en ejecución. Si ya tienes contenedores LXC con passthrough NVIDIA, puede actualizar sus librerías de espacio de usuario para que coincidan con el host."
+    "title": "Qué hace",
+    "body": "Detecta la GPU y ofrece ramas mantenidas que incluyen su ID PCI. Bloquea <code>nouveau</code>, descarga el instalador oficial <code>.run</code>, usa DKMS, instala <code>nvidia-persistenced</code>, reglas udev y NVIDIA Container Toolkit, con parche NVENC opcional. Las comprobaciones de compilación evalúan el kernel actual; compilar no garantiza que todas las apps funcionen. Ofrece actualizar las bibliotecas de los LXC NVIDIA existentes, con la misma versión salvo en Arch."
   },
   "who": {
     "heading": "¿Para quién es esto?",
-    "body": "Si tienes una GPU NVIDIA y quieres usarla para transcoding acelerado por hardware en Plex, Jellyfin, Frigate, Immich, Stable Diffusion o cualquier otra app corriendo <strong>dentro de un contenedor LXC</strong>, necesitas instalar el driver en el <em>host</em> Proxmox primero. Esta página cubre esa instalación en el lado del host. Pasar la GPU a una <strong>máquina virtual (VM)</strong> usa un flujo distinto (passthrough VFIO) y se documenta aparte."
+    "body": "Para vídeo o cálculo acelerado en Plex, Jellyfin, Frigate, Immich o Stable Diffusion <strong>dentro de LXC</strong>, instala primero NVIDIA en el <em>host</em> Proxmox. Asignar la GPU directamente a una <strong>VM</strong> usa el procedimiento VFIO."
   },
   "prereqs": {
     "title": "Antes de empezar",
-    "gpu": "<strong>Una GPU NVIDIA</strong> instalada físicamente en el host. El script la autodetecta; las GPUs AMD e Intel no se gestionan aquí.",
+    "gpu": "<strong>Una GPU NVIDIA</strong> instalada en el host. Se detecta automáticamente; esta opción no gestiona AMD ni Intel.",
     "gpuCheck": "lspci | grep -i nvidia",
-    "notVm": "La GPU <strong>no está asignada actualmente a una VM vía passthrough VFIO</strong>. Si lo está, el script se negará a instalar el driver del host para evitar romper la config de passthrough.",
+    "notVm": "La GPU <strong>no debe estar reservada para VM mediante VFIO</strong>. El instalador rechaza esa situación para evitar interferir en la asignación.",
     "internet": "Acceso a internet en el host. El instalador descarga el driver desde <code>download.nvidia.com</code> y, opcionalmente, clona <code>nvidia-persistenced</code> y <code>nvidia-patch</code> desde GitHub.",
-    "space": "Algo de espacio libre en <code>/opt/nvidia</code> para el instalador <code>.run</code> más la RAM usada durante el build. Al propagar a LXCs con distros no-Arch, cada contenedor necesita al menos 1.5 GB libres; ProxMenux eleva temporalmente la RAM del contenedor a 2 GB y la restaura al terminar. Se necesita reiniciar al final de la instalación del host."
+    "space": "Reserva espacio en <code>/opt/nvidia</code> para <code>.run</code> y RAM para compilar. La actualización LXC no-Arch comprueba 1500 MiB libres y puede solicitar subir temporalmente a 2048 MiB de RAM si tiene menos; después restaura el límite anterior. Planifica el reinicio del host."
   },
   "vmWarn": {
-    "title": "¿GPU asignada a una VM? Para aquí",
-    "body": "Si la GPU está actualmente vinculada a <code>vfio-pci</code> (es decir, se está pasando a una VM), instalar el driver del host puede romper el passthrough y desestabilizar el sistema. ProxMenux detecta esto y aborta. Quita la GPU de la configuración de passthrough de la VM y reinicia antes de ejecutar este script."
+    "title": "¿GPU reservada para VM? Detente aquí",
+    "body": "Si algún dispositivo NVIDIA está vinculado a <code>vfio-pci</code>, el instalador sale aunque la VM esté parada. Estar reservado no implica que una VM lo esté usando. Planifica el regreso al controlador del host y retira asignaciones VM y VFIO obsoletas antes de reiniciar e instalar."
   },
   "running": {
     "heading": "Ejecutar el instalador",
-    "body": "Abre ProxMenux en el host, ve a <strong>Hardware Graphics → NVIDIA GPU Driver Installer</strong>. Lo que verás depende de si ya hay un driver presente.",
-    "imageAlt": "Menú Hardware Graphics con la entrada NVIDIA GPU Driver Installer resaltada"
+    "body": "Abre <strong>Hardware Graphics → NVIDIA GPU Driver Installer</strong> en ProxMenux. El menú depende de si ya hay un controlador activo.",
+    "imageAlt": "Menú de hardware con el instalador NVIDIA resaltado"
   },
   "howRuns": {
-    "heading": "Cómo se ejecuta el script",
-    "body": "El instalador pasa por tres fases con separación clara entre \"recopilar información y validar\" y \"tocar realmente el host\". Hasta la confirmación final, no se ha cambiado nada."
+    "heading": "Cómo funciona el script",
+    "body": "Detecta dispositivos, elige versión e instala. Antes del resumen puede ofrecer limpiar VFIO antiguo con confirmación propia. La preparación de repositorios/cabeceras y la descarga preceden a sustituir el controlador; no todos los cambios empiezan tras una única confirmación final."
   },
   "walkthrough": {
     "detect": {
       "title": "Detección de GPU y resumen",
-      "body1": "El script escanea el bus PCI y muestra cada controladora de vídeo NVIDIA que encuentra, el estado actual del driver (o <em>\"No NVIDIA driver installed\"</em>) y cualquier contenedor LXC que ya tenga passthrough NVIDIA configurado (versión del driver dentro de cada uno).",
-      "body2": "Revisa el resumen cuidadosamente. Si la GPU detectada no es la que esperas, o si la versión de un contenedor ya coincide con la del host, puedes cancelar aquí sin efectos secundarios.",
-      "imageAlt": "Resumen previo a la instalación mostrando las GPUs detectadas, el estado actual del driver y los contenedores LXC con passthrough NVIDIA"
+      "body1": "Muestra las controladoras de vídeo NVIDIA, el estado del controlador o <em>«No NVIDIA driver installed»</em> y los LXC con acceso NVIDIA configurado, con su versión interna.",
+      "body2": "Revisa GPU y versiones del host y contenedores. Cancela en el resumen si algo no coincide con lo esperado; una limpieza VFIO confirmada antes ya se habrá aplicado.",
+      "imageAlt": "Resumen previo con GPU, controlador y LXC configurados para NVIDIA"
     },
     "version": {
       "title": "Elegir la versión del driver",
-      "body1": "ProxMenux obtiene la lista de drivers disponibles de NVIDIA y acota el selector a las versiones que <strong>listan el PCI Device ID de tu GPU en la tabla de chips soportados</strong> de la rama correspondiente en <code>nvidia.com</code>. Una serie de heurísticas descartan además las builds developer / beta del CDN que aparecerían al principio. La primera entrada se etiqueta como <em>&lt;versión&gt; — Recommended</em>: prefiere la cabeza de la rama del driver ya instalado en el host (bugfix in place), en su defecto la cabeza de la Production Branch actual, y en último caso el número más alto entre los filtrados.",
-      "body2": "Si el driver actualmente instalado fue parcheado con keylase (NVENC), el selector se acota automáticamente a versiones aún cubiertas por la tabla de parches, para que aplicar <em>Reinstalar / actualizar</em> sin perder el parche sea un click.",
+      "body1": "Filtra las versiones de <code>nvidia.com</code> que <strong>incluyen el ID PCI de la GPU en la tabla de chips compatibles</strong> y descarta versiones beta/desarrollo mediante heurísticas. <em>&lt;versión&gt; — Recomendada</em> prioriza la última de la rama instalada; después Production Branch y, por último, la versión compatible de número más alto.",
+      "body2": "Si consta como parcheado por keylase, el selector limita las versiones a la tabla NVENC. <em>Reinstalar / actualizar</em> mantiene las confirmaciones y la opción de parche; comprueba el resultado final.",
       "whyTitle": "Cómo se valida la compatibilidad con el kernel",
-      "whyBody": "La lista se filtra por el mantenimiento de la rama NVIDIA y el soporte del PCI ID de la GPU, no mediante una matriz fija de kernel y driver. Después de elegir, DKMS compila el módulo contra el kernel en ejecución. Si la compilación falla, la instalación no se considera válida; elige otra rama mantenida si NVIDIA todavía no ha adaptado esa versión a tu kernel.",
-      "imageAlt": "Selector de versiones con ramas NVIDIA compatibles con la GPU y la opción recomendada en primer lugar"
+      "whyBody": "Filtra por ramas mantenidas e ID PCI, sin una matriz fija de kernel/controlador. Una prueba previa intenta compilar para el kernel actual. Si confirma incompatibilidad, vuelve al selector; si no puede comprobarla, puede avisar y continuar. La instalación y las pruebas de funcionamiento siguen siendo necesarias.",
+      "imageAlt": "Selector de ramas compatibles con la GPU y recomendación al principio"
     },
     "uninstall": {
-      "title": "Desinstalación limpia (solo si reinstalas)",
-      "body": "Si ya hay un driver presente y elegiste una versión distinta, ProxMenux para los servicios NVIDIA, descarga los módulos de kernel, quita las entradas DKMS y purga los paquetes <code>nvidia-*</code> / <code>libnvidia-*</code> / <code>cuda-*</code> antes de tocar el nuevo instalador. Esto evita el clásico desastre de versiones mezcladas."
+      "title": "Retirar el controlador anterior al reinstalar",
+      "body": "Tras descargar y comprobar el instalador elegido, retira el controlador anterior antes de sustituirlo. Detiene servicios NVIDIA, descarga módulos, elimina entradas DKMS y purga <code>nvidia-*</code> / <code>libnvidia-*</code> / <code>cuda-*</code>. También se aplica al reinstalar la misma versión con confirmación."
     },
     "prepare": {
       "title": "Preparar el sistema",
-      "body": "Tras una única confirmación, el script:",
+      "body": "Durante la preparación, el script:",
       "items": [
-        "Comprueba los repositorios del host antes de eliminar o instalar nada: en un host sin suscripción activa y solo con el repositorio Enterprise se pregunta antes de cambiar a sin suscripción, y la instalación se detiene cuando el cambio se rechaza.",
+        "Comprueba repositorios antes de eliminar o instalar componentes. Si no hay suscripción y solo está Enterprise, pide permiso para usar no-subscription; si rechazas el cambio, detiene la instalación.",
         "Instala <code>pve-headers-$(uname -r)</code> (o <code>proxmox-headers-$(uname -r)</code>), <code>build-essential</code> y <code>dkms</code>.",
-        "Crea el archivo propiedad de ProxMenux <code>/etc/modprobe.d/proxmenux-nouveau-blacklist.conf</code> con <code>blacklist nouveau</code> y <code>options nouveau modeset=0</code>, registra si añadió la línea complementaria a <code>blacklist.conf</code> e intenta descargar el módulo inmediatamente.",
+        "Crea <code>/etc/modprobe.d/proxmenux-nouveau-blacklist.conf</code>, gestionado por ProxMenux, con <code>blacklist nouveau</code> y <code>options nouveau modeset=0</code>. Registra si añadió la línea complementaria a <code>blacklist.conf</code> e intenta descargar nouveau.",
         "Escribe <code>/etc/modules-load.d/nvidia-vfio.conf</code> con <code>nvidia</code> y <code>nvidia_uvm</code> para que los módulos se carguen pronto en el arranque."
       ]
     },
     "download": {
       "title": "Descargar y ejecutar el instalador NVIDIA",
-      "body": "El instalador descarga el archivo <code>NVIDIA-Linux-x86_64-&lt;version&gt;.run</code> en <code>/opt/nvidia</code>, lo valida (tamaño + firma de ejecutable, no solo HTTP 200), y luego lo ejecuta con DKMS para que el módulo de kernel se reconstruya automáticamente con las actualizaciones de kernel.",
-      "imageAlt": "Progreso de descarga seguido del instalador NVIDIA ejecutando su build DKMS"
+      "body": "Descarga <code>NVIDIA-Linux-x86_64-&lt;version&gt;.run</code> a <code>/opt/nvidia</code> y comprueba tamaño y tipo ejecutable. Son comprobaciones de formato, no de firma criptográfica. Registra DKMS para recompilar al cambiar el kernel; sigue necesitando fuentes y kernel compatibles.",
+      "imageAlt": "Progreso de descarga y compilación DKMS del instalador NVIDIA"
     },
     "persist": {
       "title": "Servicio de persistencia y reglas udev",
-      "body": "ProxMenux luego instala <persistLink>nvidia-persistenced</persistLink> y escribe reglas udev en <code>/etc/udev/rules.d/70-nvidia.rules</code> para que los nodos de dispositivo <code>/dev/nvidia*</code> aparezcan de forma fiable en el arranque. Sin esto, el passthrough LXC puede tener carreras al arranque del contenedor y acabar con un contenedor que no ve la GPU."
+      "body": "Instala <persistLink>nvidia-persistenced</persistLink> y escribe <code>/etc/udev/rules.d/70-nvidia.rules</code> para crear dispositivos <code>/dev/nvidia*</code> al arrancar. Así evita que un LXC intente acceder a la GPU antes de que existan los dispositivos."
     },
     "nvenc": {
       "title": "Opcional: aplicar el parche NVENC",
-      "body": "Las GPUs NVIDIA de consumo (línea GeForce) limitan el número de sesiones simultáneas de codificación NVENC. El <patchLink>keylase/nvidia-patch</patchLink> de la comunidad elimina esa restricción. Si planeas usar la GPU para Plex / Jellyfin / Frigate con muchos streams concurrentes, responde <strong>Sí</strong> cuando se pregunte.",
-      "supportTitle": "Comprueba el soporte del parche para tu driver",
-      "supportBody": "El parche no cubre todas las versiones de driver. Antes de depender de él en producción, verifica que tu versión esté listada en la <patchTableLink>tabla de parches</patchTableLink>. Si aún no está soportada, elige un driver cercano más antiguo que sí lo esté."
+      "body": "El límite de sesiones NVENC depende de GPU y controlador. <patchLink>keylase/nvidia-patch</patchLink> puede retirar el límite del controlador en versiones compatibles. Elige <strong>Sí</strong> si necesitas ese cambio de codificación y tu versión está soportada. No acelera la decodificación ni elimina los límites físicos.",
+      "supportTitle": "Comprobar compatibilidad del parche",
+      "supportBody": "Busca la versión exacta en la <patchTableLink>tabla de parches</patchTableLink>. Si falta, usa el controlador sin parche o elige otra versión mantenida compatible con GPU, kernel y parche; no elijas una anterior solo por estar cerca en la lista."
     },
     "propagate": {
-      "title": "Opcional: propagar el driver a los contenedores LXC",
-      "body1": "Si la pantalla de resumen listó contenedores con passthrough NVIDIA, ProxMenux ahora se ofrece a actualizar las librerías userspace dentro de cada uno para que coincidan con el host. El módulo de kernel del host y el userspace del contenedor <strong>deben ser exactamente la misma versión</strong> — si no <code>nvidia-smi</code> dentro del contenedor fallará con un error \"version mismatch\".",
-      "body2": "La actualización es consciente de la distro. Para Debian / Ubuntu y otras distros glibc, el mismo instalador <code>.run</code> (con <code>--no-kernel-modules --no-dkms --no-install-compat32-libs</code>) se copia al contenedor y se ejecuta; la RAM del contenedor se eleva temporalmente a 2 GB si es menor y se restaura al terminar. Para <strong>Arch, Manjaro y EndeavourOS</strong> la actualización es un <code>pacman -Syu nvidia-utils</code> pineado a la rama del driver del host. <strong>Alpine</strong> usa un camino distinto — se extrae el <code>.run</code> en el host, solo las librerías userspace se empaquetan como tarball y se envían con <code>pct push</code>, luego se instalan los shims <code>gcompat</code> + <code>binutils</code> vía <code>apk</code> y se recrean los symlinks SONAME con <code>readelf</code> para que las librerías glibc-linked carguen correctamente sobre musl.",
-      "imageAlt": "Prompt listando los LXCs con passthrough NVIDIA y la versión actual del driver, con Sí/No para actualizarlos todos"
+      "title": "Opcional: actualizar bibliotecas NVIDIA en LXC",
+      "body1": "Ofrece actualizar las bibliotecas del controlador en los LXC detectados. Estas y el módulo del host <strong>deben tener versiones coincidentes</strong>; si no, <code>nvidia-smi</code> puede mostrar «version mismatch».",
+      "body2": "Debian / Ubuntu y otros contenedores glibc reciben el instalador <code>.run</code> extraído con <code>--no-kernel-modules --no-dkms --no-install-compat32-libs</code>; puede aumentar temporalmente la RAM a 2 GiB y luego restaurarla. <strong>Arch, Manjaro y EndeavourOS</strong> usan <code>pacman -Syu nvidia-utils</code> de sus repositorios, sin fijar la versión del host: comprueba el resultado. <strong>Alpine</strong> recibe el contenido <code>.run</code> extraído mediante <code>pct push</code>, instala <code>gcompat</code> y <code>binutils</code> con <code>apk</code> y crea enlaces SONAME con <code>readelf</code>. Verifica el funcionamiento: la compatibilidad glibc no garantiza todas las bibliotecas sobre musl.",
+      "imageAlt": "Diálogo con los LXC NVIDIA y su versión para confirmar la actualización"
     },
     "reboot": {
       "title": "Reiniciar",
-      "body": "Finalmente, el script reconstruye <code>initramfs</code> para todos los kernels y ofrece reiniciar. Reiniciar <strong>es obligatorio</strong>: el blacklist de nouveau y el nuevo módulo de kernel solo surten efecto tras el reinicio."
+      "body": "Tras instalar el controlador, regenera <code>initramfs</code> para todos los kernels; el último paso ofrece reiniciar. <strong>Planifica ese reinicio</strong> para verificar módulos y bloqueo de nouveau en un arranque limpio, aunque el controlador ya responda antes."
     }
   },
   "reinstallUninstall": {
     "heading": "Reinstalar o desinstalar",
-    "intro": "Cuando el instalador detecta que el módulo de kernel <code>nvidia</code> está cargado actualmente y <code>nvidia-smi</code> devuelve una versión, no reinstala silenciosamente encima. En lugar de eso muestra un menú de acciones para que elijas qué hacer. (Los binarios presentes en disco pero el módulo no cargado no cuentan como instalados — el módulo tiene que estar activo.)",
+    "intro": "Si el módulo <code>nvidia</code> está cargado y <code>nvidia-smi</code> devuelve una versión, muestra un menú de acciones. Este criterio detecta un controlador activo; puede haber archivos instalados aunque el módulo no esté cargado.",
     "imageAlt": "Menú de acciones NVIDIA ofrecido cuando ya hay un driver instalado — dos opciones: Reinstalar / actualizar driver, o Desinstalar el driver NVIDIA completamente",
     "imageCaption": "El menú de acciones solo aparece cuando hay un driver NVIDIA activo actualmente en el host.",
     "reinstallHeading": "Reinstalar / actualizar",
-    "reinstallBody": "Continúa con el flujo normal de instalación pero, antes de descargar nada, ejecuta una eliminación limpia del driver actual (apt purge + entradas DKMS eliminadas + módulos residuales descargados). Es la ruta segura para aplicar una versión más nueva de la misma rama, elegir otra rama mantenida cuando sea necesario o recuperarse de un estado incompleto. Al final vuelven a mostrarse las opciones de propagación LXC y del parche NVENC.",
+    "reinstallBody": "Elige versión, prepara repositorios/cabeceras, descarga y prueba la compilación antes de retirar el controlador anterior e instalar el nuevo. Permite actualizar dentro de una rama mantenida o elegir otra compatible. Después vuelven las opciones de bibliotecas LXC y parche NVENC.",
     "uninstallHeading": "Desinstalar — qué se elimina",
-    "uninstallIntro": "Confirma primero con un diálogo sí/no. Luego ejecuta un rollback completo e idempotente:",
+    "uninstallIntro": "Tras confirmar con Sí/No, desinstala estos componentes:",
     "uninstallItems": [
-      "Ejecuta primero <code>nvidia-uninstall --silent</code> (el reverso del instalador <code>.run</code>), luego para y deshabilita <code>nvidia-persistenced</code> y <code>nvidia-powerd</code>, y descarga los módulos de kernel (<code>nvidia_uvm</code>, <code>nvidia_drm</code>, <code>nvidia_modeset</code>, <code>nvidia</code>) — cualquier contenedor LXC con passthrough NVIDIA será cortado limpiamente.",
-      "Ejecuta <code>apt purge</code> sobre <code>nvidia-*</code>, <code>libnvidia-*</code>, <code>cuda-*</code> y <code>libcudnn*</code>, quita el árbol fuente DKMS y la caché del instalador .run de <code>/opt/nvidia</code>.",
-      "Quita la configuración de carga de módulos (<code>/etc/modules-load.d/nvidia-vfio.conf</code>) y las entradas de blacklist de nouveau creadas por ProxMenux. También migra y elimina los archivos antiguos de ProxMenux con las dos líneas conocidas; conserva los archivos modificados o ajenos del administrador.",
-      "Quita las reglas udev (<code>/etc/udev/rules.d/70-nvidia.rules</code>) y limpia el estado del parche NVENC (un campo del registro de instalaciones gestionadas de ProxMenux, marcado como <em>removed</em> — no hay fichero aparte que borrar).",
-      "Reconstruye <code>initramfs</code> para todos los kernels, ejecuta <code>proxmox-boot-tool refresh</code> en hosts con systemd-boot, y pide reiniciar para finalizar."
+      "Detiene y desactiva <code>nvidia-persistenced</code> y <code>nvidia-powerd</code>, intenta descargar <code>nvidia_uvm</code>, <code>nvidia_drm</code>, <code>nvidia_modeset</code> y <code>nvidia</code> y después ejecuta <code>nvidia-uninstall --silent</code> para la instalación <code>.run</code>. Afecta a las apps LXC que usan NVIDIA; clientes activos pueden impedir la descarga.",
+      "Ejecuta <code>apt purge</code> sobre <code>nvidia-*</code>, <code>libnvidia-*</code>, <code>cuda-*</code> y <code>libcudnn*</code>, elimina el árbol fuente DKMS y las carpetas <code>nvidia-persistenced</code> y <code>nvidia-patch</code> de <code>/opt/nvidia</code>.",
+      "Elimina la configuración de carga de módulos (<code>/etc/modules-load.d/nvidia-vfio.conf</code>) y las entradas de blacklist de nouveau creadas por ProxMenux. También migra y elimina los archivos antiguos de ProxMenux con las dos líneas conocidas; conserva los archivos modificados o ajenos del administrador.",
+      "Retira <code>/etc/udev/rules.d/70-nvidia.rules</code> y marca el estado NVENC como <em>removed</em> en el registro de instalaciones gestionadas; no hay un archivo de estado separado.",
+      "Regenera <code>initramfs</code> para todos los kernels, ejecuta <code>proxmox-boot-tool refresh</code> según la configuración de arranque y solicita reiniciar."
     ],
-    "lxcWarnTitle": "Contenedores LXC con passthrough NVIDIA",
-    "lxcWarnBody": "Quitar el driver del host invalida las rutas de dispositivo y las librerías CUDA mapeadas a cualquier LXC con passthrough NVIDIA. Planifica la operación en una ventana de mantenimiento si Frigate / Plex / Jellyfin / Ollama (o cualquier otra cosa) depende de ello."
+    "lxcWarnTitle": "LXC con acceso a NVIDIA",
+    "lxcWarnBody": "Eliminar el controlador del host interrumpe las apps LXC que usan NVIDIA, aunque conserven sus bibliotecas. Programa mantenimiento para Frigate, Plex, Jellyfin, Ollama y otras apps que dependan de la GPU."
   },
   "updates": {
-    "heading": "Notificaciones de actualización",
+    "heading": "Avisos de actualizaciones",
     "body": "El driver NVIDIA instalado se rastrea en el registro de instalaciones gestionadas de ProxMenux. En el arranque y cada 24 horas, el Monitor compara el listado de <code>download.nvidia.com/XFree86/Linux-x86_64/</code> con la versión que devuelve <code>nvidia-smi</code> y solo avisa cuando existe una versión de mantenimiento más nueva en la rama instalada.",
     "kindsHeading": "Mensaje de actualización",
     "kindsItems": [
-      "<strong>Mantenimiento de la misma rama.</strong> Una versión más reciente dentro de la rama instalada (por ejemplo, 580.65.06 instalada → 580.105.08 disponible). El Monitor no deduce compatibilidad entre ramas y kernels."
+      "<strong>Mantenimiento dentro de la rama.</strong> Por ejemplo, 580.65.06 instalada → 580.105.08 disponible. Monitor no deduce compatibilidad de kernel entre ramas."
     ],
-    "antiTitle": "Anti-cascada por diseño",
-    "antiBody": "Una notificación por cada versión nueva distinta, nunca en cada comprobación de 24 horas. Si no hay una versión más reciente en la rama instalada, el seguimiento permanece silencioso.",
+    "antiTitle": "Evitar avisos repetidos",
+    "antiBody": "Un aviso por cada versión nueva, no en cada comprobación diaria. Si no hay una más reciente en la rama instalada, no notifica.",
     "applyTitle": "Aplicar la actualización",
-    "applyBody": "El Monitor no autoaplica actualizaciones de driver — reinstalar el driver NVIDIA siempre necesita un reinicio. Abre la misma entrada del instalador descrita arriba, elige <strong>Reinstall / update</strong> y la nueva versión se descarga, el módulo DKMS se reconstruye contra el kernel en ejecución y se pide el reinicio al final."
+    "applyBody": "Monitor avisa sin instalar automáticamente. Abre el instalador, elige <strong>Reinstalar / actualizar</strong> y una versión compatible, y completa compilación e instalación. Termina con una solicitud de reinicio; planifícalo y verifica después host y bibliotecas LXC."
   },
   "verify": {
     "heading": "Verificar la instalación",
-    "intro": "Una vez el host esté arriba de nuevo, entra por SSH o por la shell de Proxmox y ejecuta:",
-    "after": "Deberías ver tu GPU listada, la versión del driver en el borde superior y ningún proceso aún (nada está usando la GPU en este punto). Luego comprueba el servicio de persistencia:",
+    "intro": "Tras reiniciar el host, entra por SSH o desde la consola Proxmox y ejecuta:",
+    "after": "Comprueba que aparecen la GPU y la versión esperada. Puede haber procesos si servicios del host o contenedores arrancados automáticamente ya usan la GPU. Después comprueba la persistencia:",
     "imageAlt": "Salida de nvidia-smi en el host mostrando la GPU detectada y la versión del driver instalada"
   },
   "troubleshoot": {
     "heading": "Solución de problemas",
-    "smiFailTitle": "`nvidia-smi` dice 'NVIDIA-SMI has failed'",
-    "smiFailBody": "Casi siempre se debe a que <strong>nouveau</strong> sigue cargado o a que las <strong>cabeceras no coinciden con el kernel</strong>. Tras reiniciar, ejecuta <code>lsmod | grep nouveau</code>. Si devuelve algo, comprueba <code>/etc/modprobe.d/proxmenux-nouveau-blacklist.conf</code>, reconstruye initramfs con <code>update-initramfs -u -k all</code> y reinicia. Si nouveau no aparece, revisa <code>dmesg | grep -i nvidia</code>; los errores de DKMS suelen indicar que faltan las cabeceras del kernel en ejecución.",
+    "smiFailTitle": "nvidia-smi muestra «NVIDIA-SMI has failed»",
+    "smiFailBody": "Puede deberse a <strong>nouveau</strong>, <strong>cabeceras ausentes o incompatibles</strong>, fuentes del controlador incompatibles u otros errores de carga. Revisa <code>lsmod | grep nouveau</code>, <code>dmesg | grep -i nvidia</code> y los registros del instalador/DKMS. Si hay que corregir nouveau, revisa <code>/etc/modprobe.d/proxmenux-nouveau-blacklist.conf</code> antes de <code>update-initramfs -u -k all</code> y reiniciar. No todo fallo de compilación es de cabeceras.",
     "lxcMissTitle": "El contenedor LXC no ve la GPU tras actualizar el host",
-    "lxcMissBody": "Las librerías userspace del contenedor están atascadas en la versión anterior del driver. O vuelves a ejecutar el instalador NVIDIA y aceptas el prompt de propagación LXC, o instalas la misma versión del driver manualmente dentro del contenedor con <code>--no-kernel-modules</code>.",
+    "lxcMissBody": "Revisa dispositivos del host, permisos LXC y versión de bibliotecas antes de reinstalar. Si no coinciden, instala el controlador de usuario correspondiente mediante el método compatible con la distribución; en glibc usa <code>--no-kernel-modules</code>. Reinstalar bibliotecas no corrige montajes o permisos ausentes.",
     "logTitle": "Revisa el log de instalación",
-    "logBody": "Cada instalación escribe en <code>/tmp/nvidia_install.log</code>. Si algo falla silenciosamente, ese archivo tiene la salida completa (descargas, build DKMS, instalaciones de servicio). Adjúntalo cuando reportes issues en GitHub."
+    "logBody": "La instalación escribe en <code>/tmp/nvidia_install.log</code>. Revisa descargas, compilación DKMS y servicios si falla. Adjunta el registro al comunicar el problema en GitHub."
   },
   "manualSteps": {
     "heading": "¿Buscas los pasos manuales?",
-    "body": "La guía original de la comunidad — instalar todo a mano con <code>wget</code> y <code>./NVIDIA-Linux-...run</code> — sigue disponible como referencia en <guideLink>Guides → NVIDIA</guideLink>. Es útil si quieres entender cada comando que ejecuta el instalador de ProxMenux, o si estás depurando un setup inusual. Para instalaciones del día a día, usa ProxMenux — es la ruta que sigue recibiendo fixes (compatibilidad de kernel, propagación a LXC, comprobaciones de seguridad VFIO)."
+    "body": "Consulta <guideLink>Guías → NVIDIA</guideLink> para los pasos manuales, incluidos <code>wget</code> y <code>./NVIDIA-Linux-...run</code>. Explica los componentes, pero no reproduce exactamente el instalador. El proceso mantenido de ProxMenux añade filtrado GPU, comprobación de compilación, actualizaciones LXC y controles VFIO."
   },
   "related": {
     "heading": "Relacionado",
@@ -148,25 +148,25 @@
       {
         "label": "Añadir GPU a VM (Passthrough)",
         "href": "/docs/hardware/gpu-vm-passthrough",
-        "tail": " — pasar la GPU NVIDIA a una VM (modelo de binding distinto al de LXC)."
+        "tail": " — asignar NVIDIA directamente a una VM mediante VFIO."
       },
       {
         "label": "Añadir GPU a LXC",
         "href": "/docs/hardware/igpu-acceleration-lxc",
-        "tail": " — compartir la GPU NVIDIA con uno o más contenedores."
+        "tail": " — compartir NVIDIA con uno o varios contenedores."
       },
       {
-        "label": "Switch GPU Mode (VM ↔ LXC)",
+        "label": "Cambiar modo GPU (VM ↔ LXC)",
         "href": "/docs/hardware/switch-gpu-mode",
-        "tail": " — alternar la misma GPU entre modos passthrough (VM) y compartido (LXC)."
+        "tail": " — alternar entre acceso directo a VM y uso compartido en LXC."
       },
       {
         "label": "ProxMenux Monitor — pestaña Hardware",
         "href": "/docs/monitor/dashboard/hardware",
-        "tail": " — el modal de GPU que dispara este instalador en un click, más monitorización en vivo una vez hecho."
+        "tail": " — ventana GPU que abre este instalador y muestra estadísticas en tiempo real."
       },
       {
-        "label": "Comandos de GPU Passthrough",
+        "label": "Comandos de asignación directa de GPU",
         "href": "/docs/help-info/gpu-commands",
         "tail": " — referencia de lspci / dmesg / IOMMU / nvidia-smi."
       }
diff --git a/web/messages/es/docs/hardware/switch-gpu-mode.json b/web/messages/es/docs/hardware/switch-gpu-mode.json
index b3aabdcf..35f973e8 100644
--- a/web/messages/es/docs/hardware/switch-gpu-mode.json
+++ b/web/messages/es/docs/hardware/switch-gpu-mode.json
@@ -1,16 +1,16 @@
 {
   "meta": {
-    "title": "Switch GPU Mode (VM ↔ LXC) | ProxMenux Documentation",
-    "description": "Mueve una GPU ya asignada entre modo VM (vfio-pci) y modo LXC (driver nativo) en un host Proxmox. ProxMenux detecta el binding actual, pide políticas de conflicto por workload, gestiona la limpieza de audio huérfano y reconstruye initramfs solo cuando hace falta."
+    "title": "Cambiar modo GPU (VM ↔ LXC) | Documentación de ProxMenux",
+    "description": "Cambia una GPU entre VFIO para VM y controlador nativo para LXC. ProxMenux detecta el controlador, pregunta cómo resolver asignaciones en conflicto, retira audio asociado y regenera initramfs si cambia la configuración del host."
   },
   "header": {
-    "title": "Switch GPU Mode (VM ↔ LXC)",
-    "description": "Reasigna una GPU que ya está en uso — cambia de passthrough a VM a compartición con LXC o al revés. ProxMenux gestiona todos los cambios de binding del lado del host (vfio.conf, blacklist de drivers, módulos, initramfs) y ofrece una política limpia para cada VM o LXC que use la GPU actualmente, para que el cambio no deje config rota detrás.",
-    "section": "Hardware: GPUs y Coral-TPU"
+    "title": "Cambiar modo GPU (VM ↔ LXC)",
+    "description": "Cambia una GPU asignada entre acceso directo a VM y uso compartido en LXC. ProxMenux gestiona controlador, VFIO, módulos e initramfs y pregunta cómo tratar los invitados afectados. Revisa las opciones y verifica el resultado tras reiniciar.",
+    "section": "Hardware: GPU y Coral-TPU"
   },
   "intro": {
-    "title": "Qué hace esto",
-    "body": "Una GPU en un host Proxmox vive en uno de dos modos: vinculada a <code>vfio-pci</code> (reservada para una VM) o vinculada a su driver nativo <em>(i915 / amdgpu / nvidia)</em> para que el host + los LXCs puedan compartirla. <strong>Switch GPU Mode</strong> alterna entre esos dos sin que tengas que editar <code>vfio.conf</code> a mano, gestionar blacklists o recordar qué líneas de VM / LXC apuntan a la tarjeta. También te avisa limpiamente si un workload aún referencia la GPU para que no acabes con una VM rota en el arranque."
+    "title": "Qué hace",
+    "body": "Con <code>vfio-pci</code>, la GPU se reserva para una VM. Con el controlador nativo <em>(i915 / amdgpu / nvidia)</em>, pueden compartirla el host y los LXC. <strong>Cambiar modo GPU</strong> gestiona <code>vfio.conf</code>, módulos bloqueados y referencias en invitados, y avisa de asignaciones pendientes."
   },
   "graphics": {
     "lxcTitle": "Listo para contenedores LXC",
@@ -20,16 +20,16 @@
   },
   "when": {
     "heading": "¿Cuándo debería usar esto?",
-    "intro": "Usa este script cuando una GPU está <strong>ya asignada</strong> y quieres moverla:",
+    "intro": "Úsalo si la GPU <strong>ya está asignada</strong> y quieres cambiar su uso:",
     "headerSituation": "Situación",
     "headerUse": "¿Usar esta página?",
     "rows": [
       {
-        "situation": "La GPU está libre — nunca asignada. Quieres dársela a una VM.",
+        "situation": "GPU libre, nunca asignada: quiero usarla en una VM.",
         "useRich": "No — usa <vmLink>Añadir GPU a VM</vmLink>"
       },
       {
-        "situation": "La GPU está libre — nunca asignada. Quieres dársela a un LXC.",
+        "situation": "GPU libre, nunca asignada: quiero usarla en un LXC.",
         "useRich": "No — usa <lxcLink>Añadir GPU a LXC</lxcLink>"
       },
       {
@@ -41,88 +41,88 @@
         "useRich": "<strong>Sí — esta página.</strong>"
       },
       {
-        "situation": "Solo quiero desvincular completamente una GPU de todo.",
-        "use": "Sí — elige el destino LXC y luego desadjunta manualmente."
+        "situation": "Quiero retirar todas las asignaciones de esta GPU.",
+        "use": "El modo LXC devuelve la GPU al controlador del host; la política de conflictos de VM puede eliminar las entradas hostpci, pero las entradas de dispositivo de los LXC hay que eliminarlas aparte. No deja la GPU sin controlador."
       }
     ]
   },
   "prereqs": {
     "title": "Antes de empezar",
-    "assigned": "<strong>Una GPU ya asignada</strong> — o bien en una VM vía VFIO o adjuntada al menos a un LXC. Si aún no la has asignado, empieza desde Añadir GPU a VM / LXC en su lugar.",
-    "iommu": "<strong>IOMMU habilitado en el host</strong> — solo estrictamente necesario al cambiar <em>a</em> modo VM, pero vale la pena tenerlo en cualquier caso. Si falta el parámetro del kernel, el script lo añade automáticamente al command line de arranque (<code>intel_iommu=on iommu=pt</code> o <code>amd_iommu=on</code>, vía <code>proxmox-boot-tool refresh</code> en systemd-boot o <code>update-grub</code> en GRUB) y lo incluye en el aviso de reinicio final.",
+    "assigned": "<strong>Una GPU ya asignada</strong> a una VM por VFIO o a un LXC. Para la primera asignación, usa Añadir GPU a VM / LXC.",
+    "iommu": "<strong>IOMMU debe estar activo en el host</strong> al pasar <em>a</em> modo VM. Depende del firmware y del kernel. Si al kernel en ejecución le falta <code>intel_iommu=on</code> o <code>amd_iommu=on</code>, el script lo añade con <code>iommu=pt</code> a <code>/etc/kernel/cmdline</code> (marca de raíz ZFS) o a <code>/etc/default/grub</code> y ejecuta <code>proxmox-boot-tool refresh</code> o <code>update-grub</code>. Revisa los avisos y reinicia cuando lo solicite.",
     "iommuCheck": "dmesg | grep -i 'IOMMU enabled' | head -1",
-    "reboot": "<strong>Asume un reinicio.</strong> Cambiar bindings de GPU a nivel de kernel significa que el host regenera initramfs y reinicias para aplicar. El script lo pide al final.",
-    "knowList": "<strong>Saber qué VMs / LXCs están usando la GPU.</strong> El script las encontrará y preguntará qué hacer con cada una, pero es más rápido si ya conoces la lista."
+    "reboot": "<strong>Planifica un reinicio.</strong> Los cambios persistentes de controlador y arranque pueden requerir regenerar initramfs y reiniciar. El script muestra la solicitud al terminar.",
+    "knowList": "<strong>Identifica las VM y LXC que usan la GPU.</strong> El script detecta referencias y pregunta qué hacer con cada invitado; conocerlos facilita revisar la selección."
   },
   "blocklist": {
     "title": "No todas las GPUs son seguras para pasar a una VM",
-    "body": "Una pequeña blocklist de IDs de GPU se rechaza para modo VM por inestabilidad conocida de passthrough (p. ej. Intel Arc A770 <code>8086:5a84</code> / <code>8086:5a85</code>). Si la GPU seleccionada coincide, el script explica por qué y sale. Cambiar <em>a</em> modo LXC siempre se permite."
+    "body": "El script bloquea el modo VM para los ID <code>8086:5a84</code> y <code>8086:5a85</code> por su política de compatibilidad. Si coincide la GPU elegida, detiene el cambio a modo VM y vuelve a la selección de GPU, o sale si es la única GPU. Esta lista no impide pasar <em>a</em> LXC, aunque siguen aplicándose otras comprobaciones."
   },
   "running": {
     "heading": "Ejecutar el script",
-    "body": "Abre ProxMenux en el host, ve a <strong>Hardware: GPUs and Coral-TPU → Switch GPU Mode (VM ↔ LXC)</strong>.",
-    "imageAlt": "Entrada del menú 'Switch GPU Mode (VM ↔ LXC)' dentro de Hardware: GPUs and Coral-TPU"
+    "body": "Abre <strong>Hardware: GPU y Coral-TPU → Cambiar modo GPU (VM ↔ LXC)</strong> en ProxMenux.",
+    "imageAlt": "Opción Cambiar modo GPU (VM ↔ LXC) en el menú de hardware"
   },
   "howRuns": {
-    "heading": "Cómo se ejecuta el script",
-    "body": "Dos fases como siempre: todo se recopila y valida primero, no se aplica nada hasta que confirmas al final."
+    "heading": "Cómo funciona el script",
+    "body": "Revisas GPU y dirección antes del cambio principal. Una limpieza separada de VFIO antiguo puede pedir confirmación antes, y los invitados tienen sus propios diálogos de conflicto. Lee cada confirmación: no hay una única confirmación final para todos los cambios."
   },
   "walkthrough": {
-    "heading": "Recorriendo el flujo",
+    "heading": "Proceso paso a paso",
     "detect": {
-      "title": "Detectar las GPUs y su binding actual",
-      "body": "El script escanea cada controladora VGA / 3D / Display del host e inspecciona <code>/sys/bus/pci/devices/*/driver</code> para encontrar el driver de kernel actual. Verás cada GPU etiquetada con su nombre, slot PCI y binding de driver actual — así puedes ver de un vistazo en qué modo está.",
+      "title": "Detectar GPU y controlador actual",
+      "body": "Examina las controladoras VGA, 3D y Display del host y consulta <code>/sys/bus/pci/devices/*/driver</code>. Muestra nombre, dirección PCI y controlador actual de cada GPU para identificar su modo.",
       "imageAlt": "Checklist de GPU mostrando cada GPU detectada con su driver actual (vfio-pci / nvidia / amdgpu / i915) y slot PCI"
     },
     "pickGpu": {
-      "title": "Elegir la(s) GPU(s) a cambiar",
-      "body": "Una GPU → autoseleccionada. Varias GPUs → checklist. Puedes marcar varias, pero todas deben estar en el <em>mismo</em> modo actual — si no el script no puede elegir un modo destino para el batch y recibes un aviso de \"modo mixto\" pidiéndote que reduzcas la selección.",
-      "tipTitle": "Cambios en batch",
-      "tipBody": "Útil cuando estás reconstruyendo un host: \"Las tres NVIDIA van a modo VM, luego la iGPU vuelve a LXC.\" Dos ejecuciones, cada una con destino uniforme, mucha menos fricción que una a una."
+      "title": "Elegir las GPU que cambiar",
+      "body": "Si hay una GPU, se selecciona sola. Si hay varias, puedes marcar más de una, pero deben estar en el <em>mismo</em> modo. Si mezclas modos, pide reducir la selección.",
+      "tipTitle": "Cambiar varias GPU a la vez",
+      "tipBody": "Por ejemplo: pasar tres NVIDIA a modo VM y luego devolver la iGPU a LXC. Son dos ejecuciones, cada una con un destino común, en lugar de cambiar cada tarjeta por separado."
     },
     "direction": {
       "title": "Revisar la dirección propuesta",
       "intro": "Según el modo actual, el script propone el opuesto como destino:",
       "items": [
-        "<strong>VM → LXC:</strong> desvincular de <code>vfio-pci</code>, dejar que el driver nativo (<code>nvidia</code>, <code>amdgpu</code>, <code>i915</code>) reclame la tarjeta para que los LXCs puedan compartirla. En NVIDIA, la entrada por BDF se quita de <code>/etc/udev/rules.d/10-proxmenux-vfio-bind.rules</code> para que el módulo nvidia reclame la GPU tras reiniciar.",
-        "<strong>LXC → VM:</strong> vincular a <code>vfio-pci</code> para que la tarjeta esté libre para passthrough VFIO a una sola VM. En AMD / Intel esto significa poner el driver nativo en blacklist y definir <code>options vfio-pci ids=…</code>. En NVIDIA el módulo <code>nvidia</code> <strong>no</strong> se pone en blacklist — en su lugar una regla udev por BDF aplica <code>driver_override=vfio-pci</code> solo a las GPUs que selecciones, para que otras GPUs NVIDIA del host mantengan su driver <code>nvidia</code>."
+        "<strong>VM → LXC:</strong> retira la asignación a <code>vfio-pci</code> para que el controlador nativo (<code>nvidia</code>, <code>amdgpu</code>, <code>i915</code>) pueda usar la GPU. En NVIDIA elimina las entradas BDF correspondientes de <code>/etc/udev/rules.d/10-proxmenux-vfio-bind.rules</code> para el próximo arranque.",
+        "<strong>LXC → VM:</strong> prepara la asignación a <code>vfio-pci</code>. AMD / Intel bloquea el controlador nativo y usa <code>options vfio-pci ids=…</code>. En NVIDIA, <code>nvidia</code> solo se bloquea globalmente si todas las GPU NVIDIA del host están en VFIO; si no, las reglas BDF aplican <code>driver_override=vfio-pci</code> a los dispositivos de los grupos IOMMU afectados y las GPU NVIDIA externas a esos grupos conservan <code>nvidia</code>. Revisa cada miembro del grupo."
       ],
       "outro": "Confirma la dirección o cancela."
     },
     "conflict": {
-      "title": "Política de conflicto por workload afectado",
-      "body": "El script escanea cada <code>/etc/pve/lxc/*.conf</code> y <code>/etc/pve/qemu-server/*.conf</code> buscando referencias al slot PCI de la GPU. Por cada workload afectado eliges una política:",
+      "title": "Cómo tratar cada VM o LXC afectado",
+      "body": "Revisa <code>/etc/pve/lxc/*.conf</code> por dispositivos según la familia del controlador y <code>/etc/pve/qemu-server/*.conf</code> por asignaciones PCI. En LXC no identifica cada tarjeta por BDF exacto. Revisa los invitados detectados y elige qué hacer con cada uno:",
       "headerPolicy": "Política",
       "headerEffect": "Efecto",
       "headerWhen": "Cuándo elegirla",
-      "keepPolicy": "Mantener config, deshabilitar onboot",
-      "keepEffect": "<code>pct set -onboot 0</code> (o <code>qm set</code>). Las líneas de GPU se quedan en la config.",
-      "keepWhen": "Planeas volver a esta VM/LXC una vez la GPU esté de vuelta en su modo original. Default seguro.",
-      "removePolicy": "Quitar GPU de la config",
-      "removeEffect": "Las líneas <code>hostpci</code> / <code>dev</code> del slot de esta GPU se quitan con sed.",
-      "removeWhen": "La VM/LXC seguirá funcionando sin la GPU (transcoding solo por CPU, etc.). Workflow limpio.",
-      "imageAlt": "Diálogo preguntando la política de conflicto por VM / por LXC al cambiar una GPU que está actualmente asignada"
+      "keepPolicy": "Conservar configuración y desactivar arranque automático",
+      "keepEffect": "<code>pct set CTID -onboot 0</code> o <code>qm set VMID -onboot 0</code>. Conserva las entradas de GPU.",
+      "keepWhen": "Si piensas reutilizar el invitado cuando la GPU vuelva al modo anterior. Opción predeterminada conservadora.",
+      "removePolicy": "Eliminar la GPU de la configuración",
+      "removeEffect": "Retira las entradas <code>hostpci</code> / <code>dev</code> identificadas y las referencias antiguas compatibles.",
+      "removeWhen": "Elígelo si el invitado debe funcionar sin GPU. Revisa antes la aplicación: el uso alternativo de CPU depende de ella y retirar el dispositivo no la reconfigura automáticamente.",
+      "imageAlt": "Diálogo para elegir qué hacer con cada VM o LXC afectado"
     },
     "audio": {
-      "title": "Limpieza de audio huérfano (solo al salir del modo VM)",
-      "body1": "Las dGPUs (NVIDIA / AMD) traen una función de audio HDMI en <code>.1</code> del mismo slot, y a veces se adjuntan controladores de audio extra junto a la GPU. Cuando la GPU deja la VM, esas líneas de audio quedan huérfanas — la VM tiene entradas <code>hostpci</code> apuntando a dispositivos de audio que no van con la GPU.",
-      "body2": "El script las descubre (match BDF preciso, sin falsos positivos por substring) y muestra una checklist para que puedas quitarlas limpiamente. También limpia sus IDs vendor:device de <code>/etc/modprobe.d/vfio.conf</code> — pero solo si ninguna otra VM sigue usando esos IDs de audio."
+      "title": "Retirar asignaciones de audio asociadas al salir de VM",
+      "body1": "Muchas GPU NVIDIA / AMD tienen audio HDMI en la función <code>.1</code> del mismo slot; también puede haber audio adicional asignado. Al retirar la GPU pueden quedar entradas <code>hostpci</code> de audio obsoletas. Revisa qué dispositivos deben conservarse.",
+      "body2": "Identifica las direcciones BDF de audio y muestra una lista para elegir qué retirar. También elimina sus ID vendor:device de <code>/etc/modprobe.d/vfio.conf</code>, solo si ninguna otra VM los usa."
     },
     "apply": {
-      "title": "Aplicar cambios del host + workloads",
-      "body": "Una vez confirmas, el script escribe los cambios del lado del host — <code>vfio.conf</code>, blacklist, módulos y (para NVIDIA) la regla udev por BDF en <code>/etc/udev/rules.d/10-proxmenux-vfio-bind.rules</code> más el estado BDF en <code>/etc/proxmenux/vfio-bind.bdfs</code>. También aplica la política de conflicto elegida a cada VM/LXC afectada. Si la config del host realmente cambió, ejecuta <code>update-initramfs -u -k all</code> — si no, salta ese paso."
+      "title": "Aplicar cambios al host y a los invitados",
+      "body": "Tras confirmar, el script escribe los cambios en el host: <code>vfio.conf</code>, la lista de módulos bloqueados, los módulos y, para NVIDIA, la regla udev por BDF en <code>/etc/udev/rules.d/10-proxmenux-vfio-bind.rules</code> y el estado BDF en <code>/etc/proxmenux/vfio-bind.bdfs</code>. También aplica la política de conflictos elegida a cada VM/LXC afectado. Si la configuración del host ha cambiado, ejecuta <code>update-initramfs -u -k all</code> y después <code>proxmox-boot-tool refresh</code>; si no ha cambiado, omite ambos comandos."
     },
     "reboot": {
       "title": "Reiniciar",
-      "body": "El nuevo binding de GPU solo surte efecto tras reiniciar. El script te lo pide; puedes reiniciar ahora o luego, pero no arranques la VM/LXC destino hasta que el host haya reiniciado — si no la GPU sigue retenida por el driver anterior.",
+      "body": "Reinicia el host para aplicar la nueva asignación persistente. Puedes posponerlo, pero verifica el controlador activo antes de arrancar el invitado destino: hasta el reinicio puede seguir usando el anterior.",
       "imageAlt": "Diálogo de resumen listando qué cambió, seguido del prompt de reinicio"
     }
   },
   "manual": {
-    "heading": "Equivalente manual",
-    "intro": "Si quieres entender exactamente qué hace el script (o depurar uno de los pasos a mano), estas son las operaciones crudas para <strong>VM → LXC</strong> en una tarjeta NVIDIA con vendor:device <code>10de:2204</code>:",
-    "lxcToVm": "Y para <strong>LXC → VM</strong>:",
-    "oneVmTitle": "Solo una VM puede usar una GPU vfio-pci dada a la vez",
+    "heading": "Inspección manual",
+    "intro": "Antes de pasar de <strong>VM → LXC</strong>, revisa el controlador y la política BDF. Este ejemplo NVIDIA usa <code>10de:2204</code>; adáptalo a tu tarjeta. Los comandos consultan el estado; el script también gestiona invitados y miembros del grupo IOMMU.",
+    "lxcToVm": "Antes de <strong>LXC → VM</strong>, consulta la dirección PCI y su grupo IOMMU. Sustituye la dirección del ejemplo y revisa todos los miembros antes de asignar dispositivos.",
+    "oneVmTitle": "Una GPU física asignada por VFIO solo puede usarla una VM a la vez",
     "oneVmBody": "Poner varias entradas <code>hostpci</code> con el mismo slot PCI en dos VMs es config válida pero solo una de las VMs puede arrancar con la GPU — la segunda fallará. El paso de política de conflicto de ProxMenux trata exactamente de evitar esta trampa."
   },
   "verification": {
@@ -131,13 +131,13 @@
   "troubleshoot": {
     "heading": "Solución de problemas",
     "stillVfioTitle": "La GPU sigue mostrando vfio-pci tras cambiar a modo LXC",
-    "stillVfioBody": "<code>update-initramfs</code> no se ejecutó (o el reinicio no llegó a pasar realmente). Comprueba <code>lsmod | grep vfio</code> — si vfio-pci está cargado, vuelve a ejecutar <code>update-initramfs -u -k all</code> y reinicia. Para AMD/Intel: verifica que <code>vfio.conf</code> ya no contiene el ID vendor:device de la GPU. Para NVIDIA: verifica que el BDF ya no está en <code>/etc/proxmenux/vfio-bind.bdfs</code> y que <code>/etc/udev/rules.d/10-proxmenux-vfio-bind.rules</code> no lo lista.",
-    "vmFailTitle": "Una VM no arranca tras cambiar una GPU a modo LXC",
-    "vmFailBody": "La VM aún tiene entradas <code>hostpci</code> apuntando a una GPU que no puede reclamar. Vuelve a ejecutar el script y elige la política <em>Quitar GPU de la config</em>, o limpia la config a mano:",
-    "smiFailTitle": "nvidia-smi falla con 'Driver/library version mismatch' tras volver a LXC",
-    "smiFailBody": "Los módulos NVIDIA del host no se recargaron limpiamente. <code>modprobe -r nvidia</code> y luego <code>modprobe nvidia</code>. Si eso falla, reinicia — un reinicio completo siempre limpia el estado residual del binding vfio.",
-    "logTitle": "Log de instalación",
-    "logBody": "Cada ejecución escribe en <code>/tmp/proxmenux_gpu_switch_mode.log</code> en el host. Adjúntalo cuando pidas ayuda en GitHub."
+    "stillVfioBody": "Un módulo VFIO cargado no demuestra qué controlador usa esta GPU. Revisa la tarjeta y si finalizaron <code>update-initramfs</code> y el reinicio. <code>lsmod | grep vfio</code> solo lista módulos. En AMD / Intel revisa <code>vfio.conf</code>; en NVIDIA, <code>/etc/proxmenux/vfio-bind.bdfs</code> y <code>/etc/udev/rules.d/10-proxmenux-vfio-bind.rules</code>. Corrige las reglas antiguas antes de ejecutar <code>update-initramfs -u -k all</code> y reiniciar.",
+    "vmFailTitle": "Una VM no arranca tras pasar la GPU a LXC",
+    "vmFailBody": "Comprueba si conserva referencias <code>hostpci</code> obsoletas. La política <em>Eliminar la GPU de la configuración</em> puede retirarlas durante el cambio previsto; revisa la dirección antes de repetir el script para no invertir el modo por error. También puedes retirar la asignación en Proxmox con la VM parada.",
+    "smiFailTitle": "nvidia-smi muestra «Driver/library version mismatch» al volver a LXC",
+    "smiFailBody": "Compara el módulo NVIDIA cargado con las bibliotecas instaladas, también en LXC. Iguala versiones: reiniciar carga el módulo instalado, pero no corrige paquetes incompatibles. Recargar con <code>modprobe -r nvidia</code> y <code>modprobe nvidia</code> requiere detener los clientes GPU y puede fallar si hay módulos dependientes en uso.",
+    "logTitle": "Registro de ejecución",
+    "logBody": "Cada ejecución escribe en <code>/tmp/proxmenux_gpu_switch_mode.log</code> del host. Adjunta el registro al pedir ayuda en GitHub."
   },
   "related": {
     "heading": "Relacionado",
@@ -145,12 +145,12 @@
       {
         "label": "Añadir GPU a VM (Passthrough)",
         "href": "/docs/hardware/gpu-vm-passthrough",
-        "tail": " — setup inicial del modo VM."
+        "tail": " — primera configuración del modo VM."
       },
       {
         "label": "Añadir GPU a LXC",
         "href": "/docs/hardware/igpu-acceleration-lxc",
-        "tail": " — setup inicial del modo LXC."
+        "tail": " — primera configuración del modo LXC."
       },
       {
         "label": "Instalar drivers NVIDIA (Host)",
@@ -160,10 +160,10 @@
       {
         "label": "ProxMenux Monitor — pestaña Hardware",
         "href": "/docs/monitor/dashboard/hardware",
-        "tail": " — la sección Graphics Cards donde cada GPU muestra su modo actual y expone el control inline para cambiarlo."
+        "tail": " — sección Tarjetas gráficas, con el modo actual y el control para cambiarlo."
       },
       {
-        "label": "Comandos de GPU Passthrough",
+        "label": "Comandos de asignación directa de GPU",
         "href": "/docs/help-info/gpu-commands",
         "tail": " — referencia rápida de comandos."
       }
diff --git a/web/messages/es/docs/help-info/backup-commands.json b/web/messages/es/docs/help-info/backup-commands.json
index 0d0a7fdb..43d183f1 100644
--- a/web/messages/es/docs/help-info/backup-commands.json
+++ b/web/messages/es/docs/help-info/backup-commands.json
@@ -9,12 +9,12 @@
   },
   "header": {
     "title": "Backup y restauración",
-    "description": "Referencia curada de comandos vzdump, qmrestore y pct restore para los flujos de backup de Proxmox. Incluye programación, opciones avanzadas como hook scripts / rutas excluidas / prioridad de E/S, y gestión de ficheros de backup.",
+    "description": "Selección de comandos vzdump, qmrestore y pct restore para backups en Proxmox. Incluye programación, opciones avanzadas como hooks, rutas excluidas y prioridad de E/S, y gestión de archivos de copia.",
     "section": "Ayuda e información"
   },
   "intro": {
     "title": "Tres modos de backup",
-    "body": "<strong>snapshot</strong> usa un snapshot en vivo — el guest sigue funcionando, pausa brevemente la E/S. <strong>suspend</strong> congela la VM durante el backup (más seguro que snapshot para FS que no soportan snapshots). <strong>stop</strong> apaga la VM, hace el backup en frío y la vuelve a arrancar. Elige según la tolerancia del guest y la capacidad del almacenamiento."
+    "body": "En VM, <strong>snapshot</strong> realiza una copia en vivo y no necesita snapshots del almacenamiento. <strong>suspend</strong> pausa la VM antes de la copia y no mejora necesariamente la consistencia. <strong>stop</strong> la apaga primero; si estaba encendida, puede reanudarse una vez iniciada la copia. En LXC es distinto: snapshot requiere almacenamiento con snapshots, suspend usa dos pasadas de rsync y stop mantiene el contenedor parado durante toda la copia."
   },
   "commandGroups": [
     {
@@ -34,18 +34,18 @@
         },
         {
           "command": "vzdump <vmid> --mode suspend",
-          "description": "Suspender la VM durante el backup"
+          "description": "Pausar la VM antes de la copia en vivo, modo suspend heredado"
         },
         {
           "command": "vzdump <vmid> --mode stop",
-          "description": "Apagar la VM durante el backup"
+          "description": "Apagar la VM antes de iniciar la copia"
         },
         {
           "command": "vzdump --all",
           "description": "Backup de todas las VMs y contenedores"
         },
         {
-          "command": "vzdump --exclude <vmid1>,<vmid2>",
+          "command": "vzdump --all --exclude <vmid1>,<vmid2>",
           "description": "Backup de todas excepto las VMs especificadas"
         }
       ]
@@ -58,11 +58,11 @@
           "description": "Usar compresión zstd para el backup"
         },
         {
-          "command": "vzdump <vmid> --pigz <threads>",
+          "command": "vzdump <vmid> --compress gzip --pigz <threads>",
           "description": "Usar pigz con varios hilos"
         },
         {
-          "command": "vzdump <vmid> --notes <text>",
+          "command": "vzdump <vmid> --storage <storage> --notes-template <text>",
           "description": "Añadir notas al backup"
         },
         {
@@ -70,7 +70,7 @@
           "description": "Enviar email de notificación"
         },
         {
-          "command": "vzdump <vmid> --maxfiles <n>",
+          "command": "vzdump <vmid> --prune-backups keep-last=<n>",
           "description": "Conservar solo n backups por VM"
         },
         {
@@ -96,7 +96,7 @@
         },
         {
           "command": "qmrestore <backup-file> <vmid> --unique",
-          "description": "Crear una VM con ID único"
+          "description": "Restaurar la VM generando nuevas direcciones MAC aleatorias"
         },
         {
           "command": "pct restore <vmid> <backup-file>",
@@ -107,8 +107,8 @@
           "description": "Restaurar contenedor a un almacenamiento concreto"
         },
         {
-          "command": "pct restore <vmid> <backup-file> --rootfs <storage>",
-          "description": "Restaurar a un rootfs concreto"
+          "command": "pct restore <vmid> <backup-file> --rootfs <storage>:<size-GiB>",
+          "description": "Restaurar asignando el disco raíz al almacenamiento y tamaño elegidos"
         },
         {
           "command": "pct restore <vmid> <backup-file> --unprivileged 1",
@@ -132,7 +132,7 @@
           "description": "Buscar backups de contenedor"
         },
         {
-          "command": "pvesm list <storage>",
+          "command": "pvesm list <storage> --content backup",
           "description": "Listar backups en un almacenamiento concreto"
         },
         {
@@ -149,7 +149,7 @@
       "title": "Backups programados",
       "commands": [
         {
-          "command": "cat /etc/cron.d/vzdump",
+          "command": "cat /etc/pve/jobs.cfg",
           "description": "Mostrar la programación de backups"
         },
         {
@@ -158,19 +158,19 @@
         },
         {
           "command": "systemctl list-timers",
-          "description": "Listar todas las tareas programadas"
+          "description": "Listar temporizadores de systemd"
         },
         {
           "command": "systemctl status cron",
           "description": "Comprobar el estado del servicio cron"
         },
         {
-          "command": "grep vzdump /var/log/syslog",
-          "description": "Buscar logs de backup en syslog"
+          "command": "pvenode task list --typefilter vzdump",
+          "description": "Listar tareas de backup finalizadas"
         },
         {
-          "command": "tail -f /var/log/vzdump.log",
-          "description": "Seguir el log de backup en tiempo real"
+          "command": "pvenode task log <upid>",
+          "description": "Mostrar el registro de una tarea de copia mediante su UPID"
         }
       ]
     },
@@ -202,15 +202,15 @@
           "description": "Esperar al lock"
         },
         {
-          "command": "qm importdisk <vmid> <backup> <storage>",
-          "description": "Importar un disco desde un backup"
+          "command": "qm importdisk <vmid> <disk-image> <storage>",
+          "description": "Importar un archivo de imagen de disco (por ejemplo raw, qcow2 o vmdk) como disco sin usar, no un archivo de backup de vzdump"
         }
       ]
     }
   ],
   "testRestores": {
     "title": "Prueba tus restauraciones",
-    "bodyRich": "Un backup que nunca has restaurado no es un backup. Periódicamente coge un backup, restáuralo a un VMID de prueba con <code>qmrestore --unique</code>, arranca la VM resultante y confirma que el contenido está intacto. La misma idea para contenedores con <code>pct restore</code>."
+    "bodyRich": "Restaura periódicamente una copia en un VMID de prueba libre con <code>qmrestore --unique</code>, arranca la VM en una red aislada y comprueba su contenido. La opción unique genera nuevas direcciones MAC; no cambia las IP estáticas ni la configuración de las aplicaciones. Prueba igual los contenedores con <code>pct restore</code>."
   },
   "related": {
     "heading": "Relacionado",
diff --git a/web/messages/es/docs/help-info/gpu-commands.json b/web/messages/es/docs/help-info/gpu-commands.json
index 394fd250..2b02490c 100644
--- a/web/messages/es/docs/help-info/gpu-commands.json
+++ b/web/messages/es/docs/help-info/gpu-commands.json
@@ -14,7 +14,7 @@
   },
   "intro": {
     "title": "IOMMU debe estar activado en BIOS / UEFI",
-    "body": "Antes de que ninguno de estos comandos importe, IOMMU tiene que estar activado a nivel de firmware (busca <em>VT-d</em>, <em>AMD-Vi</em> o <em>IOMMU</em> en BIOS / UEFI). Parámetros habituales de GRUB para activarlo del lado de Linux: <code>intel_iommu=on</code> (Intel) o <code>amd_iommu=on</code> (AMD), a menudo combinados con <code>iommu=pt video=efifb:off video=vesa:off</code>."
+    "body": "Activa primero IOMMU en el firmware: busca <em>VT-d</em>, <em>AMD-Vi</em> o <em>IOMMU</em> en BIOS/UEFI. En Linux está activado por defecto en AMD y en Intel con kernels Proxmox 6.8 o posteriores. Los kernels Intel anteriores pueden necesitar <code>intel_iommu=on</code>. La opción <code>iommu=pt</code> controla el modo passthrough de IOMMU; no justifica desactivar indiscriminadamente el framebuffer del host."
   },
   "commandGroups": [
     {
@@ -130,14 +130,14 @@
         },
         {
           "command": "qm set <vmid> -bios ovmf",
-          "description": "Hacer que la VM use UEFI/OVMF (necesario para passthrough de GPU)"
+          "description": "Configurar UEFI/OVMF en la VM, recomendado si la ROM de la GPU admite UEFI"
         }
       ]
     }
   ],
   "afterChangesTip": {
     "title": "Después de cambiar GRUB o configs de modprobe",
-    "bodyRich": "Ejecuta <code>update-grub</code> + <code>update-initramfs -u</code> y reinicia. Verifica con <code>cat /proc/cmdline</code> (parámetros del kernel), <code>dmesg | grep -i iommu</code> (IOMMU inicializado) y <code>find /sys/kernel/iommu_groups/ -type l | sort -V</code> (grupos presentes)."
+    "bodyRich": "En hosts que usan GRUB, aplica los cambios de arranque con <code>update-grub</code>. Actualiza los módulos con <code>update-initramfs -u -k all</code> y reinicia. Otros cargadores de arranque requieren su propio procedimiento. Comprueba <code>cat /proc/cmdline</code> (parámetros del kernel), <code>dmesg | grep -i iommu</code> (IOMMU inicializado) y <code>find /sys/kernel/iommu_groups/ -type l | sort -V</code> (grupos presentes)."
   },
   "related": {
     "heading": "Relacionado",
@@ -150,7 +150,7 @@
       {
         "href": "/docs/hardware/igpu-acceleration-lxc",
         "label": "Añadir GPU a LXC",
-        "tail": " — passthrough a un contenedor en lugar de a una VM."
+        "tail": " — compartir acceso a los dispositivos GPU del host con un contenedor LXC."
       },
       {
         "href": "/docs/help-info",
diff --git a/web/messages/es/docs/help-info/index.json b/web/messages/es/docs/help-info/index.json
index 28e56332..7a055c8c 100644
--- a/web/messages/es/docs/help-info/index.json
+++ b/web/messages/es/docs/help-info/index.json
@@ -1,15 +1,15 @@
 {
   "meta": {
     "title": "Referencia de comandos de Proxmox — qm, pct, vzdump, zpool, pveversion | ProxMenux",
-    "description": "Referencia curada de comandos esenciales de Proxmox VE y Linux organizados por tema: inspección del sistema, gestión de VMs y LXC (qm / pct), almacenamiento y discos, red, actualizaciones, passthrough de GPU, ZFS, backup y restauración, y herramientas CLI del día a día.",
+    "description": "Selección de comandos esenciales de Proxmox VE y Linux por tema: inspección del sistema, gestión de VM y LXC (qm / pct), almacenamiento y discos, red, actualizaciones, passthrough de GPU, ZFS, backup y restauración, y herramientas de terminal para el día a día.",
     "ogTitle": "Referencia de comandos de Proxmox — qm, pct, vzdump, zpool",
-    "ogDescription": "Referencia curada de los comandos más útiles de Proxmox VE y Linux, agrupados por tema — sistema, VM/CT, almacenamiento, red, actualizaciones, passthrough de GPU, ZFS, backup y herramientas CLI.",
+    "ogDescription": "Selección de comandos útiles de Proxmox VE y Linux por tema: sistema, VM/CT, almacenamiento, red, actualizaciones, passthrough de GPU, ZFS, backups y herramientas CLI.",
     "twitterTitle": "Referencia de comandos de Proxmox | ProxMenux",
-    "twitterDescription": "Referencia curada de los comandos más útiles de Proxmox VE y Linux, agrupados por tema."
+    "twitterDescription": "Selección de comandos útiles de Proxmox VE y Linux, agrupados por tema."
   },
   "header": {
     "title": "Ayuda e información",
-    "description": "Compendio curado de comandos útiles de Linux y Proxmox VE organizados por tema. Nueve categorías — cubre desde una comprobación rápida con pveversion hasta un zfs send/receive multilínea — pensado para convivir con las secciones de GPU, disco y compartición de ProxMenux como una referencia única.",
+    "description": "Selección de comandos útiles de Linux y Proxmox VE organizados por tema. Las nueve categorías abarcan desde una consulta rápida con pveversion hasta una secuencia de zfs send/receive en varias líneas. Sirve de referencia junto a las secciones de GPU, discos y recursos compartidos de ProxMenux.",
     "section": "Ayuda e información"
   },
   "intro": {
@@ -27,14 +27,14 @@
       {
         "icon": "Terminal",
         "href": "/docs/help-info/system-commands",
-        "title": "Comandos de sistema útiles",
-        "description": "pveversion, uptime, free, journalctl, hostnamectl, información del usuario actual, auditoría de lynis, fastfetch."
+        "title": "Comandos útiles del sistema",
+        "description": "pveversion, uptime, free, journalctl, hostnamectl, información del usuario actual, auditoría con lynis y fastfetch."
       },
       {
         "icon": "Cpu",
         "href": "/docs/help-info/vm-ct-commands",
         "title": "Gestión de VM y CT",
-        "description": "qm list / config / start / stop / migrate, pct list / config / enter, snapshots, clonación."
+        "description": "qm list / config / start / stop / migrate, pct list / config / enter, snapshots y clonación."
       },
       {
         "icon": "HardDrive",
@@ -46,25 +46,25 @@
         "icon": "Network",
         "href": "/docs/help-info/network-commands",
         "title": "Comandos de red",
-        "description": "ip / ss / nmcli, inspección de bridges, ping / traceroute, consultas DNS, fail2ban-client."
+        "description": "ip / ss / nmcli, inspección de bridges, ping / traceroute, consultas DNS y fail2ban-client."
       },
       {
         "icon": "Package",
         "href": "/docs/help-info/update-commands",
         "title": "Actualizaciones y paquetes",
-        "description": "apt update / dist-upgrade, apt-cache policy, consultas dpkg, comprobación de ficheros de repositorio."
+        "description": "apt update / dist-upgrade, apt-cache policy, consultas con dpkg y revisión de archivos de repositorios."
       },
       {
         "icon": "Cpu",
         "href": "/docs/help-info/gpu-commands",
         "title": "Passthrough de GPU",
-        "description": "comprobaciones con lspci / dmesg, verificación de IOMMU, binding de vfio-pci, uso de GPU desde el host."
+        "description": "Comprobaciones con lspci / dmesg, verificación de IOMMU, vinculación a vfio-pci y uso de GPU desde el host."
       },
       {
         "icon": "Database",
         "href": "/docs/help-info/zfs-commands",
         "title": "Gestión de ZFS",
-        "description": "comandos zpool / zfs para estado, datasets, snapshots, send/receive, ajuste de ARC, trimming."
+        "description": "Comandos zpool / zfs para estado, datasets, snapshots, send/receive, ajuste de ARC y TRIM."
       },
       {
         "icon": "Archive",
@@ -76,7 +76,7 @@
         "icon": "Wrench",
         "href": "/docs/help-info/tools-commands",
         "title": "Herramientas CLI del sistema",
-        "description": "tmux, screen, htop / btop, ncdu, jq, dig, lsof, watch — herramientas de administración del día a día."
+        "description": "tmux, screen, htop / btop, ncdu, jq, dig, lsof, watch: herramientas de administración para el día a día."
       }
     ]
   },
diff --git a/web/messages/es/docs/help-info/network-commands.json b/web/messages/es/docs/help-info/network-commands.json
index 16c38888..85bc8dae 100644
--- a/web/messages/es/docs/help-info/network-commands.json
+++ b/web/messages/es/docs/help-info/network-commands.json
@@ -9,7 +9,7 @@
   },
   "header": {
     "title": "Comandos de red",
-    "description": "Referencia curada para la red del host Proxmox: información de interfaces, pruebas de conectividad, configuración, monitorización de tráfico y gestión del firewall. Combina ip / ss / nmcli / ethtool / tcpdump / pve-firewall.",
+    "description": "Selección de comandos de red para el host Proxmox: información de interfaces, pruebas de conectividad, configuración, monitorización de tráfico y gestión del firewall. Incluye ip / ss / nmcli / ethtool / tcpdump / pve-firewall.",
     "section": "Ayuda e información"
   },
   "intro": {
@@ -88,11 +88,11 @@
         },
         {
           "command": "ip link set <iface> up",
-          "description": "Levantar una interfaz de red"
+          "description": "Activar una interfaz de red"
         },
         {
           "command": "ip link set <iface> down",
-          "description": "Bajar una interfaz de red"
+          "description": "Desactivar una interfaz de red"
         }
       ]
     },
@@ -149,7 +149,7 @@
   ],
   "iptablesTip": {
     "title": "iptables vs nftables",
-    "bodyRich": "Debian / Proxmox modernos usan <strong>nftables</strong> como motor de firewall subyacente. El clásico <code>iptables -L -n -v</code> sigue funcionando como capa de traducción, pero la fuente de verdad es <code>nft list ruleset</code>. Los comandos <code>pve-firewall</code> son el wrapper de Proxmox que emite reglas nftables a partir de la configuración del firewall del clúster."
+    "bodyRich": "El servicio clásico <code>pve-firewall</code> genera reglas de iptables. El servicio alternativo proxmox-firewall usa <strong>nftables</strong>. Consulta el backend iptables con <code>iptables -L -n -v</code> y el backend nftables con <code>nft list ruleset</code>. Usa las herramientas del backend activado; estos listados no son intercambiables."
   },
   "related": {
     "heading": "Relacionado",
diff --git a/web/messages/es/docs/help-info/storage-commands.json b/web/messages/es/docs/help-info/storage-commands.json
index 8c9ca5b3..e647323f 100644
--- a/web/messages/es/docs/help-info/storage-commands.json
+++ b/web/messages/es/docs/help-info/storage-commands.json
@@ -1,20 +1,20 @@
 {
   "meta": {
-    "title": "Comandos de almacenamiento y disco en Proxmox — lsblk, LVM, pvesm, qm importdisk | ProxMenux",
+    "title": "Comandos de almacenamiento y discos de Proxmox — lsblk, LVM, pvesm, qm importdisk | ProxMenux",
     "description": "Referencia de comandos de almacenamiento y disco en Proxmox VE: lsblk, blkid, parted, lvdisplay, vgdisplay, pvs, mount, df, du, ncdu, pvesm status, qm importdisk y qemu-img convert para operaciones de disco de VM.",
-    "ogTitle": "Comandos de almacenamiento y disco en Proxmox — lsblk, LVM, pvesm, qm importdisk",
+    "ogTitle": "Comandos de almacenamiento y discos de Proxmox — lsblk, LVM, pvesm, qm importdisk",
     "ogDescription": "Referencia de comandos de almacenamiento y disco en Proxmox VE — inspección de discos, LVM, montajes, gestión de almacenamiento de Proxmox, importación de disco de VM y conversión de imágenes.",
     "twitterTitle": "Comandos de almacenamiento de Proxmox | ProxMenux",
     "twitterDescription": "Inspección de discos, información de montajes, gestión LVM, almacenamiento de Proxmox y comandos de importación / conversión de discos de VM."
   },
   "header": {
     "title": "Almacenamiento y discos",
-    "description": "Referencia curada para inspección de almacenamiento en hosts Proxmox: dispositivos de bloque, particiones, montajes, volúmenes LVM, configuración de almacenamiento de Proxmox y algunas operaciones de disco de VM (importdisk, qemu-img convert).",
+    "description": "Selección de comandos para inspeccionar el almacenamiento de hosts Proxmox: dispositivos de bloque, particiones, montajes, volúmenes LVM, configuración de Proxmox y operaciones con discos de VM (importdisk, qemu-img convert).",
     "section": "Ayuda e información"
   },
   "intro": {
     "title": "Inventario rápido de discos",
-    "body": "<code>lsblk</code> es la forma más rápida de ver todos los dispositivos de bloque y sus particiones en árbol. Para identificadores persistentes (que sobreviven entre reinicios y cambios de hardware) usa <code>ls -lh /dev/disk/by-id/</code>."
+    "body": "<code>lsblk</code> muestra los dispositivos de bloque y sus particiones en árbol. Consulta los identificadores persistentes con <code>ls -lh /dev/disk/by-id/</code>: para un mismo disco suelen mantenerse tras reinicios o cambios en el orden de detección de los dispositivos. Sustituir el disco o cambiar cómo la controladora expone su identidad puede modificar su ruta by-id."
   },
   "commandGroups": [
     {
@@ -104,16 +104,16 @@
           "description": "Mostrar el estado de todos los pools de almacenamiento"
         },
         {
-          "command": "pvesm list",
-          "description": "Listar todo el almacenamiento disponible"
+          "command": "pvesm status --enabled 1",
+          "description": "Listar los almacenamientos configurados y habilitados"
         },
         {
           "command": "pvesm list <storage>",
           "description": "Listar el contenido de un almacenamiento concreto"
         },
         {
-          "command": "pvesm scan <storage>",
-          "description": "Escanear el almacenamiento en busca de contenido nuevo"
+          "command": "pvesm scan nfs <server>",
+          "description": "Descubrir las exportaciones NFS de un servidor"
         }
       ]
     },
@@ -122,7 +122,7 @@
       "commands": [
         {
           "command": "qm importdisk <vmid> <image_path> <storage>",
-          "description": "Adjuntar una imagen de disco a una VM"
+          "description": "Importar la imagen como disco sin usar de la VM; hay que conectarlo después"
         },
         {
           "command": "qm set <vmid> -<bus><index> <disk_path>",
@@ -130,7 +130,7 @@
         },
         {
           "command": "qemu-img convert -O <format> <input> <output>",
-          "description": "Convertir el formato de una imagen de disco"
+          "description": "Convertir el formato de una imagen de disco sin uso activo"
         }
       ]
     },
@@ -199,15 +199,15 @@
   ],
   "lvmTip": {
     "title": "LVM: comandos cortos vs largos",
-    "bodyRich": "Existen ambas formas por compatibilidad. <code>pvs</code> / <code>vgs</code> / <code>lvs</code> dan una tabla limpia de una línea por volumen; <code>pvdisplay</code> / <code>vgdisplay</code> / <code>lvdisplay</code> dan un volcado verboso de varias líneas por volumen. Para el día a día prefiere las versiones cortas."
+    "bodyRich": "Existen ambas formas. <code>pvs</code> / <code>vgs</code> / <code>lvs</code> muestran tablas compactas con una fila por volumen físico, grupo de volúmenes o volumen lógico, respectivamente. <code>pvdisplay</code> / <code>vgdisplay</code> / <code>lvdisplay</code> ofrecen más detalle en varias líneas. Las formas cortas resultan prácticas para las consultas habituales."
   },
   "smartInfo": {
-    "title": "SMART para discos mecánicos vs NVMe",
-    "bodyRich": "<strong>Discos mecánicos / SATA / SAS</strong> usan la familia <code>smartctl</code> de <code>smartmontools</code> (instalada por defecto en Proxmox). Pasa el dispositivo como <code>/dev/sda</code>, <code>/dev/sdb</code>, etc. <strong>Los discos NVMe</strong> tienen su propio protocolo nativo — <code>smartctl</code> funciona contra ellos (pasa la mayoría de datos), pero la herramienta <code>nvme</code> de <code>nvme-cli</code> reporta más campos específicos de NVMe (wear levelling, errores de medio, info de namespace). Instala con <code>apt install nvme-cli</code> si no está."
+    "title": "SMART en SATA/SAS frente a NVMe",
+    "bodyRich": "<strong>Los discos SATA / SAS, incluidos los SSD,</strong> se pueden consultar con <code>smartctl</code> de <code>smartmontools</code>, instalado por defecto en Proxmox. Indica el dispositivo, por ejemplo <code>/dev/sda</code> o <code>/dev/sdb</code>. <strong>Los discos NVMe</strong> usan otro protocolo nativo. <code>smartctl</code> también los admite, mientras que <code>nvme</code> de <code>nvme-cli</code> ofrece consultas específicas de controladoras, namespaces y salud NVMe. Instálalo con <code>apt install nvme-cli</code> si falta."
   },
   "selfTestWarn": {
     "title": "Los self-tests se ejecutan en segundo plano",
-    "bodyRich": "<code>smartctl -t short</code> y <code>-t long</code> retornan inmediatamente — el disco ejecuta el test por su cuenta. Comprueba el progreso con <code>smartctl -a /dev/&lt;disk&gt;</code> (busca la línea \"Self-test routine in progress\") o espera a que termine y lee <code>smartctl -l selftest /dev/&lt;disk&gt;</code>. Los tests cortos tardan ~2 min; los largos pueden tardar horas en mecánicos grandes. El disco sigue usable durante la prueba, pero el rendimiento de E/S baja."
+    "bodyRich": "En discos compatibles, <code>smartctl -t short /dev/&lt;disk&gt;</code> y <code>smartctl -t long /dev/&lt;disk&gt;</code> inician pruebas en segundo plano y devuelven el control enseguida. Consulta el progreso con <code>smartctl -a /dev/&lt;disk&gt;</code>, buscando \"Self-test routine in progress\", o espera y lee <code>smartctl -l selftest /dev/&lt;disk&gt;</code>. Las cortas suelen tardar unos dos minutos; las largas pueden durar horas. El disco sigue disponible, aunque puede bajar el rendimiento de E/S."
   },
   "related": {
     "heading": "Relacionado",
@@ -219,7 +219,7 @@
       },
       {
         "href": "/docs/disk-manager",
-        "label": "Disk Manager",
+        "label": "Administrador de discos",
         "tail": " — flujos interactivos de ProxMenux para passthrough de disco, importación, formateo y SMART."
       },
       {
diff --git a/web/messages/es/docs/help-info/system-commands.json b/web/messages/es/docs/help-info/system-commands.json
index 9fd0b7ef..e00c2ee1 100644
--- a/web/messages/es/docs/help-info/system-commands.json
+++ b/web/messages/es/docs/help-info/system-commands.json
@@ -1,20 +1,20 @@
 {
   "meta": {
     "title": "Comandos de sistema de Proxmox VE — pveversion, uptime, journalctl, systemctl | ProxMenux",
-    "description": "Referencia de comandos esenciales de Proxmox VE y Linux: pveversion, pveperf, uptime, journalctl, systemctl, lscpu, lsblk, df, free, last, who. Todos son de solo lectura y seguros de ejecutar en cualquier host.",
+    "description": "Comandos de Proxmox VE y Linux para versiones, tiempo de actividad, memoria, servicios, registros y usuarios, además de herramientas de auditoría y resumen. Incluye un comando de reinicio de servicio; los ejemplos no son todos de solo lectura.",
     "ogTitle": "Comandos de sistema de Proxmox VE — pveversion, uptime, journalctl, systemctl",
-    "ogDescription": "Referencia de comandos esenciales de Proxmox VE y Linux — versión, uptime, servicios, logs, información de usuarios, exploración de hardware. Todos de solo lectura.",
+    "ogDescription": "Comandos de Proxmox VE y Linux para versión, tiempo de actividad, servicios, registros y usuarios, con gestión de servicios y herramientas de auditoría.",
     "twitterTitle": "Comandos de sistema de Proxmox VE | ProxMenux",
     "twitterDescription": "Comandos esenciales de inspección del sistema para Proxmox VE — versión, estado, servicios, logs, información de usuarios."
   },
   "header": {
-    "title": "Comandos de sistema útiles",
-    "description": "Comandos de solo lectura para inspeccionar el host Proxmox: versión, kernel, uptime, memoria, estado de la interfaz web, últimas líneas de log, usuarios conectados y un par de herramientas de auditoría y resumen. Ninguno modifica el sistema.",
+    "title": "Comandos útiles del sistema",
+    "description": "Comandos para inspeccionar el host Proxmox: versión, kernel, tiempo de actividad, memoria, estado de la interfaz web, registros recientes y usuarios conectados, además de herramientas de auditoría y resumen. La mayoría consultan el estado, pero systemctl restart pveproxy reinicia el proxy web y las auditorías pueden escribir informes y registros.",
     "section": "Ayuda e información"
   },
   "intro": {
     "title": "Qué es esto",
-    "body": "La misma lista numerada que ProxMenux muestra cuando eliges <em>Comandos de sistema útiles</em>. Usa el botón Copiar para llevarte cualquier comando, o consúltalo para recordar el flag exacto."
+    "body": "Es la misma lista numerada que ProxMenux muestra al elegir <em>Comandos útiles del sistema</em>. Usa el botón Copiar para copiar un comando o consulta la lista para recordar la opción exacta."
   },
   "commandGroups": [
     {
@@ -141,12 +141,12 @@
       {
         "href": "/docs/help-info/update-commands",
         "label": "Actualizaciones y paquetes",
-        "tail": " — comandos de apt y de actualización de pve."
+        "tail": " — comandos de apt y de actualización de PVE."
       },
       {
         "href": "/docs/help-info/tools-commands",
         "label": "Herramientas CLI del sistema",
-        "tail": " — htop, btop, ncdu y similares."
+        "tail": " — htop, btop, ncdu y herramientas similares."
       },
       {
         "href": "/docs/help-info",
diff --git a/web/messages/es/docs/help-info/tools-commands.json b/web/messages/es/docs/help-info/tools-commands.json
index 29b9f156..306d7272 100644
--- a/web/messages/es/docs/help-info/tools-commands.json
+++ b/web/messages/es/docs/help-info/tools-commands.json
@@ -63,7 +63,7 @@
         },
         {
           "command": "tcpdump -i <interface>",
-          "description": "Volcar tráfico de red"
+          "description": "Capturar tráfico de red"
         },
         {
           "command": "netstat -tuln",
@@ -191,7 +191,7 @@
         },
         {
           "command": "scp <file> <user>@<host>:<path>",
-          "description": "Copiar ficheros de forma segura"
+          "description": "Copiar archivos de forma segura"
         },
         {
           "command": "rsync -avz <src> <dest>",
@@ -228,15 +228,15 @@
         },
         {
           "command": "timedatectl",
-          "description": "Controlar la hora y fecha del sistema"
+          "description": "Gestionar la hora y la fecha del sistema"
         },
         {
           "command": "hostnamectl",
-          "description": "Controlar el hostname del sistema"
+          "description": "Gestionar el nombre del host"
         },
         {
           "command": "localectl",
-          "description": "Controlar el locale y el teclado del sistema"
+          "description": "Gestionar la configuración regional y el teclado del sistema"
         },
         {
           "command": "update-alternatives --config <name>",
@@ -251,7 +251,7 @@
   ],
   "tmuxTip": {
     "title": "Usa tmux / screen para comandos de larga duración",
-    "bodyRich": "Cualquier cosa que tarde más que un café — un backup, una actualización larga, un rsync grande — debería correr dentro de <code>tmux</code> o <code>screen</code>. Las desconexiones SSH no matan la sesión, y puedes reengancharte desde cualquier sitio con <code>tmux attach</code>."
+    "bodyRich": "Ejecuta las tareas largas, como un backup, una actualización o una transferencia grande con rsync, dentro de <code>tmux</code> o <code>screen</code> para que una desconexión SSH no termine la sesión del terminal. En una sesión tmux, vuelve a conectarte al mismo host con el mismo usuario y ejecuta <code>tmux attach</code>. Las sesiones screen tienen su propio comando de reconexión."
   },
   "related": {
     "heading": "Relacionado",
@@ -263,7 +263,7 @@
       },
       {
         "href": "/docs/help-info/system-commands",
-        "label": "Comandos de sistema útiles",
+        "label": "Comandos útiles del sistema",
         "tail": " — comandos de inspección específicos de Proxmox."
       },
       {
diff --git a/web/messages/es/docs/help-info/update-commands.json b/web/messages/es/docs/help-info/update-commands.json
index a1069611..444d2b66 100644
--- a/web/messages/es/docs/help-info/update-commands.json
+++ b/web/messages/es/docs/help-info/update-commands.json
@@ -1,15 +1,15 @@
 {
   "meta": {
-    "title": "Comandos de actualización y paquetes en Proxmox — apt, pveupgrade, dpkg | ProxMenux",
+    "title": "Comandos de actualización y paquetes de Proxmox — apt, pveupgrade, dpkg | ProxMenux",
     "description": "Referencia de comandos de actualización y paquetes para Proxmox VE: apt update, apt upgrade, apt dist-upgrade, pveupgrade, dpkg -l, consultas de información de paquetes y configuración de repositorios en /etc/apt/sources.list.d/.",
-    "ogTitle": "Comandos de actualización y paquetes en Proxmox — apt, pveupgrade, dpkg",
+    "ogTitle": "Comandos de actualización y paquetes de Proxmox — apt, pveupgrade, dpkg",
     "ogDescription": "Comandos apt, pveupgrade y dpkg para mantener Proxmox VE al día — actualizaciones del sistema, gestión de paquetes, configuración de repositorios.",
     "twitterTitle": "Comandos de actualización de Proxmox | ProxMenux",
     "twitterDescription": "Comandos apt y pveupgrade para gestionar actualizaciones y paquetes en hosts Proxmox VE."
   },
   "header": {
     "title": "Actualizaciones y paquetes",
-    "description": "Referencia curada de comandos apt y de actualización específicos de Proxmox: actualizaciones del sistema, instalación / eliminación / purga de paquetes, consultas (apt-cache policy, dpkg -l) e inspección de la configuración de repositorios.",
+    "description": "Selección de comandos apt y específicos de Proxmox: actualización del sistema, instalación, eliminación y purga de paquetes, consultas con apt-cache policy y dpkg -l, y revisión de repositorios.",
     "section": "Ayuda e información"
   },
   "intro": {
@@ -22,7 +22,7 @@
       "commands": [
         {
           "command": "apt update && apt upgrade -y",
-          "description": "Actualizar y mejorar todos los paquetes del sistema"
+          "description": "Actualizar las listas y los paquetes instalados (apt upgrade)"
         },
         {
           "command": "apt dist-upgrade -y",
@@ -51,15 +51,15 @@
         },
         {
           "command": "pveupgrade",
-          "description": "Mostrar las actualizaciones disponibles de Proxmox"
+          "description": "Iniciar la actualización interactiva de paquetes de Proxmox"
         },
         {
-          "command": "pve-upgrade",
-          "description": "Realizar la actualización de Proxmox VE"
+          "command": "pve8to9 --full",
+          "description": "Comprobar si está preparado para pasar de PVE 8 a 9, sin realizar la actualización"
         },
         {
-          "command": "pveceph upgrade",
-          "description": "Actualizar los paquetes de Ceph (si Ceph está instalado)"
+          "command": "ceph versions",
+          "description": "Mostrar versiones de los demonios de Ceph antes de planificar su actualización"
         }
       ]
     },
@@ -134,18 +134,18 @@
         },
         {
           "command": "cat /etc/apt/sources.list.d/pve-enterprise.list",
-          "description": "Mostrar la configuración del repo Proxmox Enterprise"
+          "description": "Mostrar la configuración de Proxmox Enterprise del archivo .list de PVE 8"
         },
         {
           "command": "apt-key list",
-          "description": "Listar las claves de firma de los repositorios"
+          "description": "Listar claves de repositorios del sistema antiguo donde esté disponible apt-key"
         }
       ]
     }
   ],
   "backupWarn": {
-    "title": "Haz un backup antes de actualizaciones mayores",
-    "bodyRich": "Para releases puntuales (8.4.1 → 8.4.5) el clásico <code>apt update &amp;&amp; apt upgrade</code> es seguro. Para <strong>actualizaciones de versión mayor</strong> (PVE 8 → 9) usa el flujo dedicado de ProxMenux: <upgradeLink>Actualizar PVE 8 a PVE 9</upgradeLink> — añade comprobaciones previas, migración de repositorios y validación post-actualización."
+    "title": "Haz un backup antes de las actualizaciones mayores",
+    "bodyRich": "Para las actualizaciones habituales, Proxmox recomienda <code>apt update &amp;&amp; apt full-upgrade</code>; revisa los cambios de paquetes antes de confirmar. Para <strong>actualizaciones de versión mayor</strong> (PVE 8 → 9), usa el procedimiento específico de ProxMenux: <upgradeLink>Actualizar PVE 8 a PVE 9</upgradeLink>. Añade comprobaciones previas, migración de repositorios y validación posterior. Haz un backup antes."
   },
   "related": {
     "heading": "Relacionado",
@@ -153,7 +153,7 @@
       {
         "href": "/docs/utils/system-update",
         "label": "Actualización del sistema Proxmox (interactivo)",
-        "tail": " — wrapper que hace todo esto con un diálogo de confirmación, una recompilación DKMS automática de los drivers gestionados por ProxMenux cuando se instala un kernel nuevo y un prompt de reinicio. También lanzable desde el botón Update Now del dashboard de ProxMenux Monitor."
+        "tail": " — realiza estas tareas con confirmación, recompila mediante DKMS los controladores gestionados por ProxMenux cuando se instala un kernel nuevo y propone reiniciar. También se puede abrir desde Actualizar ahora en el panel de ProxMenux Monitor."
       },
       {
         "href": "/docs/utils/upgrade-pve8-pve9",
diff --git a/web/messages/es/docs/help-info/vm-ct-commands.json b/web/messages/es/docs/help-info/vm-ct-commands.json
index 5b433213..9f33b9ac 100644
--- a/web/messages/es/docs/help-info/vm-ct-commands.json
+++ b/web/messages/es/docs/help-info/vm-ct-commands.json
@@ -5,11 +5,11 @@
     "ogTitle": "Comandos qm y pct de Proxmox — gestión de VM y contenedores LXC",
     "ogDescription": "Referencia de comandos qm y pct de Proxmox VE — gestiona máquinas virtuales y contenedores LXC desde la CLI: arrancar, parar, configurar, snapshot, migrar, clonar, destruir.",
     "twitterTitle": "Comandos qm / pct de Proxmox | ProxMenux",
-    "twitterDescription": "Comandos qm / pct curados para gestionar máquinas virtuales y contenedores LXC en Proxmox VE."
+    "twitterDescription": "Selección de comandos qm / pct para gestionar VM y contenedores LXC en Proxmox VE."
   },
   "header": {
     "title": "Gestión de VM y CT",
-    "description": "Referencia curada de los comandos qm (VMs) y pct (contenedores LXC). Listado, ciclo de vida (start / stop / shutdown / destroy), inspección de configuración y operaciones específicas de contenedor como exec, enter, push y pull.",
+    "description": "Selección de comandos qm para VM y pct para contenedores LXC. Listados, ciclo de vida (start / stop / shutdown / destroy), consulta de configuración y operaciones de contenedor como exec, enter, push y pull.",
     "section": "Ayuda e información"
   },
   "intro": {
@@ -30,11 +30,11 @@
         },
         {
           "command": "qm config <vmid>",
-          "description": "Mostrar la configuración de la VM (parseada por qm)"
+          "description": "Mostrar la configuración de la VM interpretada por qm"
         },
         {
           "command": "pct config <ctid>",
-          "description": "Mostrar la configuración del contenedor (parseada por pct)"
+          "description": "Mostrar la configuración del contenedor interpretada por pct"
         }
       ]
     },
@@ -84,7 +84,7 @@
         },
         {
           "command": "qm reset <vmid>",
-          "description": "Resetear una máquina virtual (reinicio en caliente)"
+          "description": "Forzar un reinicio de la máquina virtual (reset)"
         },
         {
           "command": "qm suspend <vmid>",
@@ -116,7 +116,7 @@
           "description": "Apagar un contenedor de forma ordenada"
         },
         {
-          "command": "pct restart <ctid>",
+          "command": "pct reboot <ctid>",
           "description": "Reiniciar un contenedor"
         },
         {
@@ -153,18 +153,18 @@
   ],
   "destroyWarn": {
     "title": "Destroy es irreversible",
-    "bodyRich": "<code>qm destroy</code> y <code>pct destroy</code> eliminan la VM / CT y todos sus discos. No hay confirmación por defecto. Haz un backup primero si hay alguna posibilidad de que quieras recuperar los datos — ver <backupLink>Backup y restauración</backupLink>."
+    "bodyRich": "<code>qm destroy</code> y <code>pct destroy</code> eliminan la configuración del guest y sus volúmenes de disco gestionados. No supongas que borran los datos externos o montados por bind mount. La CLI no pide confirmación por defecto. Guarda antes cualquier dato que puedas necesitar; consulta <backupLink>Backup & Restore</backupLink>."
   },
   "qmConfigTip": {
-    "title": "qm config vs editar el fichero .conf directamente",
-    "bodyRich": "<code>qm config &lt;vmid&gt;</code> y <code>pct config &lt;ctid&gt;</code> leen el fichero a través del parser de Proxmox — la salida está normalizada, sin comentarios, y los cambios pendientes se muestran aparte. Editar <code>/etc/pve/qemu-server/&lt;vmid&gt;.conf</code> o <code>/etc/pve/lxc/&lt;ctid&gt;.conf</code> directamente salta el parser. Útil para arreglar una config corrupta o aplicar un ajuste que <code>qm set</code> no acepte, pero detén antes el guest para evitar races. El sistema de ficheros del clúster (<code>pmxcfs</code>) se encarga de propagar el cambio a los demás nodos."
+    "title": "qm config frente a editar directamente el archivo .conf",
+    "bodyRich": "<code>qm config &lt;vmid&gt;</code> y <code>pct config &lt;ctid&gt;</code> muestran la configuración mediante los analizadores de Proxmox. Para cambios normales, usa <code>qm set</code> o su equivalente de pct. Editar directamente <code>/etc/pve/qemu-server/&lt;vmid&gt;.conf</code> o <code>/etc/pve/lxc/&lt;ctid&gt;.conf</code> evita la validación y los bloqueos de los comandos de gestión; el archivo debe seguir siendo válido. Detén el guest y guarda una copia antes de repararlo a mano. <code>pmxcfs</code> sincroniza la configuración entre nodos del clúster, no el contenido de sus discos."
   },
   "related": {
     "heading": "Relacionado",
     "items": [
       {
         "href": "/docs/help-info/backup-commands",
-        "label": "Backup y restauración",
+        "label": "Backup & Restore",
         "tail": " — vzdump y qmrestore / pct restore."
       },
       {
diff --git a/web/messages/es/docs/help-info/zfs-commands.json b/web/messages/es/docs/help-info/zfs-commands.json
index c597f55e..fb1342de 100644
--- a/web/messages/es/docs/help-info/zfs-commands.json
+++ b/web/messages/es/docs/help-info/zfs-commands.json
@@ -9,7 +9,7 @@
   },
   "header": {
     "title": "Gestión de ZFS",
-    "description": "Referencia curada de comandos zpool y zfs: inspección de pools, CRUD de datasets, snapshots, clone y send/receive (incremental y recursivo), scrub / clear / replace para mantenimiento, además de estadísticas de E/S y resumen de ARC.",
+    "description": "Selección de comandos zpool y zfs: consulta de pools, creación, lectura, modificación y borrado de datasets, snapshots, clone y send/receive incremental y recursivo, mantenimiento con scrub / clear / replace, estadísticas de E/S y resumen de ARC.",
     "section": "Ayuda e información"
   },
   "intro": {
@@ -104,16 +104,16 @@
         },
         {
           "command": "zfs hold <tag> <pool>/<dataset>@<snapshot-name>",
-          "description": "Poner un hold en un snapshot"
+          "description": "Proteger un snapshot del borrado mediante un hold"
         },
         {
           "command": "zfs release <tag> <pool>/<dataset>@<snapshot-name>",
-          "description": "Liberar un hold en un snapshot"
+          "description": "Liberar la protección hold de un snapshot"
         }
       ]
     },
     {
-      "title": "Clone y send/receive",
+      "title": "Clonación y send/receive",
       "commands": [
         {
           "command": "zfs clone <pool>/<dataset>@<snapshot> <pool>/<clone-name>",
@@ -142,15 +142,15 @@
       "commands": [
         {
           "command": "zpool scrub <pool>",
-          "description": "Iniciar un scrub sobre un pool"
+          "description": "Iniciar una comprobación scrub del pool"
         },
         {
           "command": "zpool scrub -s <pool>",
-          "description": "Parar un scrub en curso"
+          "description": "Detener el scrub en curso"
         },
         {
           "command": "zpool clear <pool>",
-          "description": "Limpiar los contadores de error de un pool"
+          "description": "Reiniciar los contadores de errores del pool"
         },
         {
           "command": "zpool clear <pool> <device>",
@@ -202,7 +202,7 @@
   ],
   "bestPractices": {
     "title": "Buenas prácticas operativas",
-    "bodyRich": "Ejecuta <code>zpool scrub</code> semanal o mensualmente para detectar corrupción silenciosa. Mantén al menos un 10-15% del pool libre — el rendimiento de ZFS cae con fuerza por encima del 80% lleno. Reemplaza siempre los dispositivos fallidos con <code>zpool replace</code> (in-place) en lugar de detach + add (que pierde la redundancia temporalmente)."
+    "bodyRich": "Programa <code>zpool scrub</code> periódicamente para verificar las sumas de comprobación y revisa el resultado. Mantén espacio libre: el impacto de llenar el pool depende de la carga y la distribución. Usa <code>zpool replace</code> para sustituir un dispositivo fallido y sigue el procedimiento de su tipo de vdev. Detach + add no equivale a sustituirlo y puede cambiar la topología o eliminar redundancia."
   },
   "related": {
     "heading": "Relacionado",
@@ -214,7 +214,7 @@
       },
       {
         "href": "/docs/help-info/backup-commands",
-        "label": "Backup y restauración",
+        "label": "Backup & Restore",
         "tail": " — vzdump, qmrestore."
       },
       {
diff --git a/web/messages/es/docs/installation.json b/web/messages/es/docs/installation.json
index 96cc7076..829cf7b4 100644
--- a/web/messages/es/docs/installation.json
+++ b/web/messages/es/docs/installation.json
@@ -1,8 +1,8 @@
 {
   "meta": {
-    "title": "Instalar ProxMenux | ProxMenux Documentation",
-    "description": "Instalador de una línea para ProxMenux en hosts Proxmox VE 8+. Incluye ficheros de traducción pre-generados para seis idiomas (inglés, español, francés, alemán, italiano, portugués) — el idioma se elige una vez durante la instalación. Canal beta también disponible para acceso temprano a nuevas funciones.",
-    "ogTitle": "Instalar ProxMenux | ProxMenux Documentation",
+    "title": "Instalar ProxMenux | Documentación de ProxMenux",
+    "description": "Instala ProxMenux con un comando en hosts Proxmox VE 8+. Incluye catálogos JSON pregenerados en ocho idiomas: inglés, español, francés, alemán, italiano, portugués, eslovaco y sueco. Elige el idioma durante la instalación o cámbialo después en Configuración. El canal beta permite probar antes las nuevas funciones.",
+    "ogTitle": "Instalar ProxMenux | Documentación de ProxMenux",
     "ogDescription": "Instala ProxMenux en Proxmox VE 8+ con un comando. Canales estable y beta disponibles."
   },
   "header": {
@@ -42,50 +42,50 @@
     "imageAlt": "Instalación de ProxMenux en progreso"
   },
   "first": {
-    "heading": "Primer lanzamiento",
+    "heading": "Primer inicio",
     "intro": "Una vez instalado, ejecuta:",
     "code": "menu",
-    "outro": "ProxMenux arranca y aterrizas en el menú principal. Desde aquí puedes ejecutar cualquiera de los flujos documentados en este sitio — <postlink>Post-instalación</postlink> es una buena primera parada en un host Proxmox recién hecho."
+    "outro": "ProxMenux se abre en el menú principal. Desde ahí puedes ejecutar cualquiera de los procedimientos documentados en esta web. En un host Proxmox recién instalado, conviene empezar por <postlink>Postinstalación</postlink>."
   },
   "beta": {
     "heading": "Canal beta",
     "calloutTitle": "¿Qué es el programa beta?",
-    "calloutBody": "¿Quieres probar las últimas funciones antes del release oficial y ayudar a dar forma a la versión final? El programa beta de ProxMenux da acceso temprano a la nueva funcionalidad — incluyendo los builds más nuevos de ProxMenux Monitor — directamente desde la rama <code>develop</code>. Los builds beta pueden contener bugs o funciones incompletas. Tu feedback ayuda a arreglarlos antes del release estable.",
+    "calloutBody": "¿Quieres probar las nuevas funciones antes de su publicación oficial y ayudar a dar forma a la versión final? El programa beta de ProxMenux da acceso anticipado a las novedades, incluidas las últimas compilaciones de ProxMenux Monitor, desde la rama <code>develop</code>. Las versiones beta pueden contener errores o funciones incompletas. Tus comentarios ayudan a corregirlos antes de la versión estable.",
     "intro": "Instala la versión beta en lugar de la estable con:",
     "code": "bash -c \"$(wget -qLO - https://raw.githubusercontent.com/MacRimi/ProxMenux/develop/install_proxmenux_beta.sh)\"",
-    "outro": "La beta es opt-in — tienes que ejecutar explícitamente el instalador beta. Cuando se publica una release estable, ProxMenux te notifica en el siguiente lanzamiento de <code>menu</code> y ofrece cambiar automáticamente. Para salir antes, usa la opción <betalink>Desactivar programa beta</betalink> en Settings."
+    "outro": "La beta es voluntaria: debes ejecutar expresamente su instalador. Cuando se publica una versión estable, ProxMenux avisa al volver a ejecutar <code>menu</code> y ofrece cambiar automáticamente. Para salir antes de la beta, usa <betalink>Desactivar programa beta</betalink> en Configuración."
   },
   "updating": {
     "heading": "Actualizar",
-    "body": "ProxMenux se autoactualiza. Cuando hay una nueva versión disponible, el siguiente lanzamiento de <code>menu</code> ofrece la actualización; al aceptar se reemplazan los archivos de utilidad y las configuraciones en sitio. No hace falta descarga manual. Los usuarios estables reciben releases estables; los usuarios beta reciben releases beta (y el prompt de auto-cambio de arriba cuando una estable se publica). La forma del prompt depende de dónde se ejecute <code>menu</code>: por SSH o desde la consola de Proxmox aparece el diálogo clásico sí / no y al aceptar la actualización se aplica de inmediato. Dentro del terminal WebSocket de ProxMenux Monitor se sustituye por un msgbox informativo — ese terminal no puede sobrevivir a una autoactualización en curso, así que el msgbox muestra el instalador canónico de una línea (<code>bash -c \"$(wget -qLO - https://raw.githubusercontent.com/MacRimi/ProxMenux/main/install_proxmenux.sh)\"</code> para el canal estable, o la URL equivalente de <code>install_proxmenux_beta.sh</code> para beta) para lanzarlo desde SSH o consola."
+    "body": "ProxMenux gestiona sus actualizaciones. Si hay una nueva versión, al ejecutar <code>menu</code> ofrece actualizar: si aceptas, sustituye los archivos y la configuración de la herramienta en la instalación existente. No necesitas descargar nada a mano. La versión estable recibe actualizaciones estables y la beta, actualizaciones beta, con la opción de cambiar a estable descrita arriba. El aviso depende de dónde ejecutes <code>menu</code>: por SSH o desde la consola de Proxmox aparece un diálogo de sí o no, y al aceptar se aplica la actualización. En el terminal WebSocket de ProxMenux Monitor aparece un mensaje informativo, porque ese terminal se interrumpiría durante la actualización. El mensaje muestra el instalador de una línea (<code>bash -c \"$(wget -qLO - https://raw.githubusercontent.com/MacRimi/ProxMenux/main/install_proxmenux.sh)\"</code> para estable, o la URL equivalente de <code>install_proxmenux_beta.sh</code> para beta), que debes ejecutar por SSH o desde la consola."
   },
   "uninstall": {
     "heading": "Desinstalar",
-    "body": "Desde dentro de ProxMenux: <strong>Settings → Desinstalar ProxMenux</strong>. Elimina el árbol de scripts, el lanzador y el servicio del Monitor, opcionalmente elimina las dependencias seleccionadas, restaura los backups de <code>/root/.bashrc</code> y <code>/etc/motd</code> tomados en el momento de la instalación. Paso a paso completo: <uninstalllink>Desinstalar ProxMenux</uninstalllink>."
+    "body": "Desde ProxMenux: <strong>Ajustes → Desinstalar ProxMenux</strong>. El desinstalador elimina el árbol de scripts, el lanzador y el servicio Monitor, permite eliminar dependencias seleccionadas y restaura <code>/root/.bashrc</code> y <code>/etc/motd</code> desde los backups que crea Post-Install, si existen (si no, elimina la línea de ProxMenux del MOTD). Procedimiento completo: <uninstalllink>Desinstalar ProxMenux</uninstalllink>."
   },
   "troubleshoot": {
     "heading": "Solución de problemas",
     "virustotalTitle": "VirusTotal marca la URL de instalación",
-    "virustotalBody": "Una detección 1/95 por motores heurísticos (p. ej. <em>Chong Lua Dao</em>) es un falso positivo conocido. El instalador usa el patrón estándar <code>curl | bash</code> y descarga binarios legítimos (como <code>jq</code> desde su release oficial en GitHub), que los escáneres agresivos marcan basándose en el <em>comportamiento</em> y no en código realmente malicioso. El instalador es 100% código abierto y revisable. Más contexto en la <issuelink>Issue #162</issuelink>.",
+    "virustotalBody": "El resultado de 1/95 notificado en el issue #162, de <em>Chong Lua Dao</em>, fue identificado por el mantenedor como un falso positivo. El instalador se ejecuta con una orden que descarga y ejecuta el script (<code>bash -c \"$(wget -qLO - …)\"</code>) y puede descargar <code>jq</code> desde su versión oficial de GitHub. Este <em>comportamiento</em> puede activar análisis heurísticos; aquel informe histórico no determina la seguridad de futuras descargas. El código del instalador es abierto y se puede revisar. Más contexto en el <issuelink>issue #162</issuelink>.",
     "aptTitle": "La instalación falla con errores de apt",
-    "aptBody": "Normalmente un repo de Proxmox faltante o mal configurado. El instalador trae las dependencias vía apt; si la configuración del repo está rota (común en instalaciones de Proxmox 8 a pelo que no se han actualizado aún), apt falla. Ejecuta <code>apt-get update</code> manualmente primero y resuelve cualquier error, después vuelve a ejecutar el instalador.",
+    "aptBody": "Suele deberse a un repositorio de Proxmox ausente o mal configurado. El instalador obtiene las dependencias mediante apt: si los repositorios están mal configurados, apt falla. Es habitual en instalaciones mínimas de Proxmox 8 que aún no se han actualizado. Ejecuta primero <code>apt-get update</code> a mano, resuelve los errores y vuelve a ejecutar el instalador.",
     "menuTitle": "`menu: command not found` tras la instalación",
-    "menuBody": "El lanzador vive en <code>/usr/local/bin/menu</code>. Comprueba que esté ahí: <code>ls -lh /usr/local/bin/menu</code>. Si falta, la instalación terminó antes — vuelve a ejecutar el instalador. Si está pero no se encuentra, tu PATH no incluye <code>/usr/local/bin</code>; o arreglas el PATH o invocas el lanzador directamente: <code>/usr/local/bin/menu</code>.",
+    "menuBody": "El lanzador está en <code>/usr/local/bin/menu</code>. Comprueba que exista con <code>ls -lh /usr/local/bin/menu</code>. Si falta, la instalación se interrumpió: vuelve a ejecutar el instalador. Si existe pero no se encuentra el comando, PATH no incluye <code>/usr/local/bin</code>. Corrige PATH o ejecuta directamente <code>/usr/local/bin/menu</code>.",
     "stuckTitle": "La instalación se queda colgada o no avanza",
     "stuckBody": "Si una instalación, reinstalación o actualización se queda congelada por un problema de conexión, cancela el proceso con <strong>Ctrl + C</strong> y vuelve a lanzar el instalador a mano.",
     "otherTitle": "Otros problemas",
-    "otherBody": "Mira las <issueslink>GitHub Issues</issueslink> en busca de problemas conocidos o abre una nueva con la salida de log relevante. Usuarios beta: incluye <code>journalctl -u proxmenux-monitor -n 50</code> si está relacionado con el Monitor."
+    "otherBody": "Consulta <issueslink>GitHub Issues</issueslink> para buscar problemas conocidos o abre una incidencia con los registros relevantes. Si usas la beta y el problema afecta a Monitor, incluye la salida de <code>journalctl -u proxmenux-monitor -n 50</code>."
   },
   "next": {
     "heading": "Por dónde seguir",
-    "postInstall": "<postlink>Script de post-instalación</postlink> — ajustes y hardening para un host Proxmox recién hecho.",
-    "introduction": "<introlink>Introducción</introlink> — el tour completo de funciones.",
+    "postInstall": "<postlink>Script de postinstalación</postlink>: ajustes y refuerzo de seguridad para un host Proxmox recién instalado.",
+    "introduction": "<introlink>Introducción</introlink>: repaso completo de las funciones.",
     "monitor": "<monitorlink>ProxMenux Monitor</monitorlink> — panel web para el host (instalado automáticamente junto al menú)."
   },
   "requirements": {
     "heading": "Requisitos y buenas prácticas",
     "reqTitle": "Requisitos",
-    "reqBody": "Proxmox VE <strong>8.x o posterior</strong>. PVE 7 y anteriores no están soportados. Acceso a internet desde el host (el instalador descarga scripts, dependencias y la AppImage de ProxMenux Monitor). Ejecuta como <strong>root</strong> en el host Proxmox.",
+    "reqBody": "Proxmox VE <strong>8.x o posterior</strong>. PVE 7 y versiones anteriores no son compatibles. El host necesita acceso a internet para descargar scripts, dependencias y la AppImage de ProxMenux Monitor. Ejecuta el instalador como <strong>root</strong> en el host Proxmox.",
     "inspectTitle": "Revisa siempre los scripts que ejecutas desde internet",
     "inspectReview": "<sourcelink>Revisa la fuente del instalador</sourcelink> antes de ejecutarlo.",
     "inspectCoc": "Todos los enlaces ejecutables siguen el <coclink>código de conducta de ProxMenux</coclink>."
diff --git a/web/messages/es/docs/introduction.json b/web/messages/es/docs/introduction.json
index fb1283fb..fdd39690 100644
--- a/web/messages/es/docs/introduction.json
+++ b/web/messages/es/docs/introduction.json
@@ -9,7 +9,7 @@
   },
   "header": {
     "title": "Introducción",
-    "description": "ProxMenux es una herramienta de código abierto basada en menús para Proxmox VE. Dos piezas comparten el mismo proyecto: una CLI/TUI que envuelve los flujos más comunes del host, VMs, contenedores, almacenamiento, red y seguridad; y un panel web autoalojado con monitor de salud proactivo, notificaciones, un gancho de reescritura con IA y una API REST.",
+    "description": "ProxMenux es una herramienta de código abierto para Proxmox VE que se maneja mediante menús. El proyecto reúne dos componentes: una CLI/TUI para las tareas habituales del host, las VM, los contenedores, el almacenamiento, la red y la seguridad; y un panel web autoalojado con supervisión proactiva, notificaciones, reformulación opcional mediante IA y una API REST.",
     "section": "Introducción"
   },
   "hero": {
@@ -18,7 +18,7 @@
   },
   "twoProducts": {
     "heading": "Dos productos, un solo proyecto",
-    "intro": "ProxMenux se distribuye como dos piezas independientes que comparten el mismo árbol de código. El instalador despliega ambas — conviven en el host y no dependen entre sí:",
+    "intro": "ProxMenux tiene dos componentes en el mismo árbol de código fuente. El instalador despliega ambos en el host: Scripts ofrece la interfaz de terminal y Monitor el panel web:",
     "scripts": {
       "title": "ProxMenux Scripts",
       "body": "La CLI/TUI original que se lanza con <code>menu</code>. Nueve áreas funcionales que cubren optimizaciones post-instalación, creación de VMs y LXC, passthrough de GPU y Coral TPU, discos, almacenamiento, red, seguridad, utilidades, además de una referencia curada de comandos. Funciona en cualquier terminal — local, SSH o web."
@@ -58,7 +58,7 @@
         "href": "/docs/create-vm"
       },
       {
-        "title": "Disk Manager",
+        "title": "Administrador de discos",
         "description": "Importar discos físicos a VMs y LXC, formatear y borrar, tests SMART, importación de imágenes qcow2 / vmdk / vdi — todo desde un menú.",
         "icon": "HardDrive",
         "href": "/docs/disk-manager"
@@ -71,13 +71,13 @@
       },
       {
         "title": "Red",
-        "description": "Diagnósticos de solo lectura, flujos de análisis-y-sugerencia y reparaciones guiadas de /etc/network/interfaces. Copias de seguridad obligatorias antes de cualquier cambio.",
+        "description": "Diagnósticos de solo lectura, flujos de análisis-y-sugerencia y reparaciones guiadas de /etc/network/interfaces. Backups obligatorios antes de cualquier cambio.",
         "icon": "Network",
         "href": "/docs/network"
       },
       {
         "title": "Seguridad",
-        "description": "Fail2Ban (prevención de intrusiones para SSH y las interfaces web) y Lynis (auditoría de hardening) — instalación y gestión con valores por defecto sensatos.",
+        "description": "Fail2Ban para prevenir intrusiones por SSH y las interfaces web, y Lynis para auditar el refuerzo de la seguridad: instalación y gestión con valores predeterminados adecuados.",
         "icon": "Shield",
         "href": "/docs/security"
       },
@@ -89,7 +89,7 @@
       },
       {
         "title": "Referencia de comandos",
-        "description": "Catálogo curado de comandos de Linux y Proxmox organizados por tema — sistema, VM/CT (qm, pct), almacenamiento, red, ZFS, passthrough de GPU, backup, herramientas CLI del día a día.",
+        "description": "Selección de comandos de Linux y Proxmox organizada por temas: sistema, VM/CT con qm y pct, almacenamiento, red, ZFS, acceso directo a GPU, backups y herramientas CLI de uso diario.",
         "icon": "BookOpen",
         "href": "/docs/help-info"
       }
@@ -113,7 +113,7 @@
       },
       {
         "title": "Asistente de IA",
-        "description": "Reescritura opcional de notificaciones en lenguaje natural. Seis proveedores: OpenAI, Anthropic Claude, Google Gemini, Groq, OpenRouter, Ollama local. Doce idiomas.",
+        "description": "Reescritura opcional de notificaciones en lenguaje natural. Seis proveedores: OpenAI, Anthropic Claude, Google Gemini, Groq, OpenRouter, Ollama local. Trece idiomas en el selector de idioma de la IA.",
         "icon": "Sparkles",
         "href": "/docs/monitor/ai-assistant"
       },
@@ -138,32 +138,32 @@
     ]
   },
   "installPaths": {
-    "heading": "Rutas de instalación",
-    "intro": "El instalador despliega Scripts y Monitor en un solo paso. Scripts tiene dos variantes — con traducción o ligera — y el Monitor se instala como AppImage independiente que se activa después desde el menú:",
-    "headerPath": "Ruta de instalación",
+    "heading": "Opciones de instalación",
+    "intro": "Los dos instaladores despliegan Scripts y Monitor. Scripts utiliza catálogos JSON pregenerados en ocho idiomas, sin traducción en línea. Puedes elegir el canal estable o beta; Monitor se distribuye como AppImage y se ejecuta desde su entorno extraído:",
+    "headerPath": "Install path",
     "headerBundles": "Qué incluye",
-    "headerWhen": "Cuándo elegirla",
+    "headerWhen": "Cuándo elegirlo",
     "rows": [
       {
-        "pathRich": "<strong>Scripts: con traducción</strong>",
-        "bundles": "CLI/TUI + entorno virtual de Python + googletrans (inglés, español, francés, alemán, italiano, portugués)",
-        "when": "Menús multi-idioma, usuarios no anglófonos"
+        "pathRich": "<strong>Scripts: estable</strong>",
+        "bundles": "CLI/TUI con traducciones JSON pregeneradas en ocho idiomas, sin entorno virtual ni servicio de traducción en línea.",
+        "when": "Uso habitual con el canal de versiones estables."
       },
       {
-        "pathRich": "<strong>Scripts: normal (ligera)</strong>",
-        "bundles": "CLI/TUI solo en inglés, huella menor, sin entorno virtual de Python",
-        "when": "La mayoría de usuarios — la documentación de Proxmox está en inglés de todos modos"
+        "pathRich": "<strong>Scripts: beta</strong>",
+        "bundles": "La misma interfaz multilingüe, instalada desde la rama develop para probar los próximos cambios.",
+        "when": "Pruebas anticipadas de nuevas funciones, con mayor riesgo de errores."
       },
       {
         "pathRich": "<strong>Monitor</strong>",
-        "bundles": "AppImage autocontenido en el puerto TCP 8008. Instalación independiente — se puede activar desde el menú de Scripts o ejecutar el AppImage directamente.",
-        "when": "Cuando un panel web del host resulta útil — móvil, tablet, pestaña del navegador"
+        "bundles": "AppImage autónoma con panel web en el puerto TCP 8008. El instalador extrae su entorno de ejecución y gestiona el servicio; Monitor se controla desde Ajustes.",
+        "when": "Cuando te resulte útil consultar el host desde un panel web: móvil, tableta o navegador."
       }
     ],
-    "outro": "Los comandos de instalación detallados y los requisitos están en la <link>página de instalación</link>."
+    "outro": "Los comandos y requisitos detallados están en la <link>página de instalación</link>."
   },
   "warnSource": {
-    "title": "Revisa siempre los scripts que ejecutas desde internet",
+    "title": "Revisa siempre los scripts de Internet antes de ejecutarlos",
     "body": "ProxMenux es de código abierto y cada script se puede revisar en GitHub. Antes de ejecutar el comando de instalación, mira el código fuente. Haz lo mismo con cualquier otra herramienta de automatización.",
     "sourceLabel": "Ver el código fuente de ProxMenux",
     "cocLabel": "Código de conducta"
@@ -172,34 +172,34 @@
     "heading": "Por dónde seguir",
     "items": [
       {
-        "lead": "<strong>¿Nuevo en ProxMenux?</strong> ",
+        "lead": "<strong>¿Es tu primera vez con ProxMenux?</strong> ",
         "linkHref": "/docs/installation",
-        "linkLabel": "Instálalo con un solo comando",
+        "linkLabel": "Instálalo con un comando",
         "tailRich": " y ejecuta <code>menu</code>."
       },
       {
         "lead": "<strong>¿Acabas de instalar Proxmox?</strong> Empieza por el ",
         "linkHref": "/docs/post-install",
-        "linkLabel": "script Post-Install",
+        "linkLabel": "script de postinstalación",
         "tail": "."
       },
       {
         "lead": "<strong>¿Quieres un panel web?</strong> ",
         "linkHref": "/docs/monitor",
         "linkLabel": "ProxMenux Monitor",
-        "tail": " cubre lo que muestra, cómo está construido y cómo asegurarlo."
+        "tail": " tiene una documentación que explica qué muestra, cómo está construido y cómo protegerlo."
       },
       {
-        "lead": "<strong>¿Buscas un comando concreto?</strong> ",
+        "lead": "<strong>¿Buscas un comando concreto?</strong> La ",
         "linkHref": "/docs/help-info",
-        "linkLabel": "Referencia de comandos",
-        "tail": " es un catálogo curado organizado por tema, con botones de copia."
+        "linkLabel": "referencia de comandos",
+        "tail": " reúne una selección organizada por temas, con botones para copiar."
       },
       {
-        "lead": "<strong>¿Quieres guías más largas paso a paso?</strong> La ",
+        "lead": "<strong>¿Quieres guías más detalladas?</strong> La ",
         "linkHref": "/guides",
-        "linkLabel": "sección de Guías",
-        "tail": " cubre Coral TPU, passthrough de NVIDIA, Kodi en LXC y más."
+        "linkLabel": "sección de guías",
+        "tail": " trata Coral TPU, acceso directo a NVIDIA, Kodi en LXC y mucho más."
       }
     ]
   }
diff --git a/web/messages/es/docs/monitor/access-auth.json b/web/messages/es/docs/monitor/access-auth.json
index 82207bf9..1600caa8 100644
--- a/web/messages/es/docs/monitor/access-auth.json
+++ b/web/messages/es/docs/monitor/access-auth.json
@@ -257,7 +257,7 @@
       "<strong>Hecho.</strong> El 2FA está ahora activo. La próxima vez que te logues, el panel pide primero la contraseña; una vez aceptada pide el código actual de 6 dígitos."
     ],
     "setupStep4Sub": [
-      "<em>Camino fácil:</em> en la app, pulsa <em>Añadir cuenta</em> → <em>Escanear código QR</em>, apunta la cámara al QR en la pantalla. La app nombra la entrada automáticamente (algo como <code>ProxMenux Monitor (tu-usuario)</code>) y empieza a mostrar un código de 6 dígitos que se refresca cada 30 segundos.",
+      "<em>Camino fácil:</em> en la app, pulsa <em>Añadir cuenta</em> → <em>Escanear código QR</em>, apunta la cámara al QR en la pantalla. La app nombra la entrada automáticamente (algo como <code>ProxMenux Monitor (your-username)</code>) y empieza a mostrar un código de 6 dígitos que se refresca cada 30 segundos.",
       "<em>Plan B manual</em> (cuando escanear no es posible — p. ej. configurando en el mismo móvil con el que abriste el panel): pulsa <em>Añadir cuenta</em> → <em>Introducir clave de setup</em>. Escribe cualquier nombre (p. ej. <em>Proxmox Monitor</em>), pega la cadena Base32 del diálogo, deja <em>Tipo</em> como <em>Basado en tiempo</em>, guarda."
     ],
     "testTitle": "Prueba antes de hacer logout",
@@ -319,7 +319,7 @@
     "heading": "Secure Gateway (Tailscale)",
     "intro": "Los reverse proxies son la respuesta clásica a \"llegar al panel desde fuera\" pero requieren un dominio público, certificado y un puerto abierto en el borde. <strong>Secure Gateway</strong> es la alternativa cero-puertos que viene dentro del propio Monitor — una app desplegable preconstruida que levanta un LXC Alpine ejecutando <a>Tailscale</a> como subnet router. Una vez unido a tu tailnet, cada dispositivo en él puede llegar al Monitor en la propia IP LAN del host — desde un portátil de vacaciones, un móvil con 5G u otro nodo — sin exponer TCP 8008 a internet.",
     "calloutTitle": "Por qué esto es cómodo",
-    "calloutBody": "La URL se mantiene igual que en la LAN — <code>http://&lt;ip-lan-proxmox&gt;:8008</code> funciona donde Tailscale funcione. Sin certificados, sin DNS, sin port forwarding. El propio Monitor ve la petición viniendo de una IP de tailnet (típicamente <code>100.x.y.z</code>), así que el log de auth y el hook de Fail2Ban siguen funcionando como en la LAN.",
+    "calloutBody": "La URL se mantiene igual que en la LAN — <code>http://&lt;proxmox-lan-ip&gt;:8008</code> funciona donde Tailscale funcione. Sin certificados, sin DNS, sin port forwarding. El propio Monitor ve la petición viniendo de una IP de tailnet (típicamente <code>100.x.y.z</code>), así que el log de auth y el hook de Fail2Ban siguen funcionando como en la LAN.",
     "deployBody": "El flujo de despliegue es una sola pantalla — elige el storage LXC del host, pega un auth-key de Tailscale (generado en <a>login.tailscale.com/admin/settings/keys</a>), elige qué subnets anunciar, pulsa Deploy. El LXC tarda ~30 segundos en arrancar y se registra en el tailnet automáticamente.",
     "outro": "El despliegue paso a paso, la configuración de subnet-routes, las ACLs de Tailscale y el modo Exit Node se documentan por separado en <link>Dashboard → Security → Secure Gateway</link> — ahí vive el wizard de despliegue en la UI del panel. Esta página solo cubre el patrón de acceso."
   },
diff --git a/web/messages/es/docs/monitor/api-reference.json b/web/messages/es/docs/monitor/api-reference.json
index b2906347..11ffc9eb 100644
--- a/web/messages/es/docs/monitor/api-reference.json
+++ b/web/messages/es/docs/monitor/api-reference.json
@@ -55,7 +55,7 @@
     "heading": "Convenciones",
     "items": [
       "Todas las peticiones y respuestas son JSON salvo que se indique explícitamente (la descarga de logs es texto plano, <code>/api/prometheus</code> es text/plain en formato OpenMetrics, el log de tareas es texto plano).",
-      "Los endpoints que modifican estado con éxito devuelven <code>'{'\"success\": true, ...'}'</code>. Las respuestas de error usan un estado HTTP no-2xx con <code>'{'\"success\": false, \"error\": \"'<'motivo'>'\"'}'</code>.",
+      "Los endpoints que modifican estado con éxito devuelven <code>'{'\"success\": true, ...'}'</code>. Las respuestas de error usan un estado HTTP no-2xx con <code>'{'\"success\": false, \"error\": \"'<'reason'>'\"'}'</code>.",
       "Los endpoints de listado aceptan <code>limit</code>, <code>offset</code>, <code>since</code> opcionales y filtros específicos por categoría vía query string.",
       "Los campos de tiempo se devuelven como segundos epoch Unix o ISO-8601 con zona horaria explícita, nunca como cadenas de locale."
     ]
@@ -174,7 +174,7 @@
     "syncVsAsyncBody": "Las acciones a nivel de sistema (power del host, PVE update, self-update de ProxMenux) pueden tardar minutos — corren en su propia unit systemd transitoria y exponen un endpoint <code>.../status</code> más un <code>DELETE</code> para cancelar. Las acciones VM / LXC (start, stop, shutdown, reboot, backup) son rápidas y usan el estilo fire-and-return que la UI del Monitor ya expone: el POST devuelve el resultado directo. Ambos estilos comparten el mismo modelo de autenticación (JWT o token de API de larga duración).",
     "curlTitle": "Ejemplo con curl",
     "curlBody": "Disparar una actualización de PVE y hacer polling hasta que termine — exactamente la misma secuencia que ejecutaría una automatización de Home Assistant o un playbook de Ansible:",
-    "curlCode": "TOKEN=<tu token full_admin>\n\ncurl -sSf -X POST \\\n  -H \"Authorization: Bearer $TOKEN\" \\\n  https://<host>:8008/api/system/pve-update/run\n\nwhile true; do\n  state=$(curl -sSf -H \"Authorization: Bearer $TOKEN\" \\\n    https://<host>:8008/api/system/pve-update/status | jq -r .state)\n  [ \"$state\" != \"running\" ] && break\n  sleep 30\ndone\necho \"estado final: $state\"",
+    "curlCode": "TOKEN=<your full_admin token>\n\ncurl -sSf -X POST \\\n  -H \"Authorization: Bearer $TOKEN\" \\\n  https://<host>:8008/api/system/pve-update/run\n\nwhile true; do\n  state=$(curl -sSf -H \"Authorization: Bearer $TOKEN\" \\\n    https://<host>:8008/api/system/pve-update/status | jq -r .state)\n  [ \"$state\" != \"running\" ] && break\n  sleep 30\ndone\necho \"final state: $state\"",
     "haTitle": "Snippet de integración con Home Assistant",
     "haBody": "Un sensor <code>rest</code> hace polling del estado y un <code>rest_command</code> dispara la actualización. Conecta ambos a un botón del dashboard y a las automatizaciones que quieras:",
     "haCode": "# configuration.yaml\nsensor:\n  - platform: rest\n    resource: https://pve.local:8008/api/system/pve-update/status\n    name: pve_update_state\n    value_template: \"{{ value_json.state }}\"\n    scan_interval: 60\n    headers:\n      Authorization: \"Bearer !secret proxmenux_token\"\n\nrest_command:\n  pve_update:\n    url: https://pve.local:8008/api/system/pve-update/run\n    method: POST\n    headers:\n      Authorization: \"Bearer !secret proxmenux_token\"\n\n  # Encender VM 100 (funciona igual para LXC — mismo endpoint)\n  vm_100_start:\n    url: https://pve.local:8008/api/vms/100/control\n    method: POST\n    content_type: 'application/json'\n    payload: '{\"action\": \"start\"}'\n    headers:\n      Authorization: \"Bearer !secret proxmenux_token\"\n\n  # Backup de la VM 100 al storage 'pbs-main'\n  vm_100_backup:\n    url: https://pve.local:8008/api/vms/100/backup\n    method: POST\n    content_type: 'application/json'\n    payload: '{\"storage\": \"pbs-main\", \"mode\": \"snapshot\", \"compress\": \"zstd\"}'\n    headers:\n      Authorization: \"Bearer !secret proxmenux_token\""
diff --git a/web/messages/es/docs/monitor/dashboard/vms-lxcs-app.json b/web/messages/es/docs/monitor/dashboard/vms-lxcs-app.json
index 08895a8f..1cafcd5b 100644
--- a/web/messages/es/docs/monitor/dashboard/vms-lxcs-app.json
+++ b/web/messages/es/docs/monitor/dashboard/vms-lxcs-app.json
@@ -101,7 +101,7 @@
     ],
     "sourcesHeading": "Fuentes para la versión disponible",
     "sources": [
-      "<strong>Repositorio de GitHub</strong>: último lanzamiento o etiqueta de un repositorio público <code>propietario/nombre</code>.",
+      "<strong>Repositorio de GitHub</strong>: último lanzamiento o etiqueta de un repositorio público <code>owner/name</code>.",
       "<strong>HTTP JSON</strong>: un punto final público y una ruta como <code>data.version</code> o <code>releases[0].tag_name</code>.",
       "<strong>Docker Hub</strong>: etiquetas versionadas filtradas con una expresión regular. La vista previa muestra etiquetas reales coincidentes antes de guardar.",
       "Las etiquetas móviles como <code>latest</code>, <code>stable</code> o <code>lts</code> no contienen una versión. Esas imágenes se siguen por digest desde las actualizaciones de imágenes Docker."
diff --git a/web/messages/es/docs/monitor/dashboard/vms-lxcs-updates.json b/web/messages/es/docs/monitor/dashboard/vms-lxcs-updates.json
index 6bd3f77d..0fb53ddb 100644
--- a/web/messages/es/docs/monitor/dashboard/vms-lxcs-updates.json
+++ b/web/messages/es/docs/monitor/dashboard/vms-lxcs-updates.json
@@ -110,8 +110,8 @@
       "No incluyas <code>pct exec</code>; ProxMenux ya entra en el contenedor y ejecuta el comando como root."
     ],
     "exampleLead": "Ejemplo de procedimiento completo dentro del contenedor:",
-    "example": "cd /opt/mi-app && ./update.sh",
-    "callout": "Un comando de versión como <code>miapp --version</code> solo lee una versión; no instala nada. Los comandos se ejecutan con privilegios administrativos y deben revisarse con el mismo cuidado que un comando de shell como root."
+    "example": "cd /opt/my-app && ./update.sh",
+    "callout": "Un comando de versión como <code>myapp --version</code> solo lee una versión; no instala nada. Los comandos se ejecutan con privilegios administrativos y deben revisarse con el mismo cuidado que un comando de shell como root."
   },
   "bulk": {
     "heading": "Actualización en bloque",
@@ -142,7 +142,7 @@
       "La espera tras una versión solo se aplica a las apps seleccionadas con seguimiento. Las apps sin seguimiento ejecutan su actualizador cuando vence la programación.",
       "El estado de la última ejecución diferencia entre éxito, finalización parcial, error, retención de seguridad y ausencia de elementos pendientes. Después de la primera ejecución programada, <strong>Actualizaciones → Actualizaciones programadas → Ver log</strong> abre la salida completa capturada del actualizador y de los scripts secundarios que haya ejecutado.",
       "Después de cada ejecución, ProxMenux comprueba el marcador estándar de Debian que indica si es necesario reiniciar. Cuando hace falta, la pestaña Actualizaciones y la notificación de finalización lo indican; el aviso se elimina cuando ese LXC se inicia o reinicia.",
-      "En el host Proxmox, los logs de las ejecuciones programadas se guardan en <code>/usr/local/share/proxmenux/logs/lxc-updates/</code> con el nombre <code>&lt;VMID&gt;-scheduled-&lt;id-de-ejecución&gt;.log</code>. Se conservan los diez últimos logs de cada LXC y los archivos más antiguos se eliminan automáticamente.",
+      "En el host Proxmox, los logs de las ejecuciones programadas se guardan en <code>/usr/local/share/proxmenux/logs/lxc-updates/</code> con el nombre <code>&lt;VMID&gt;-scheduled-&lt;run-id&gt;.log</code>. Se conservan los diez últimos logs de cada LXC y los archivos más antiguos se eliminan automáticamente.",
       "Este historial corresponde a las actualizaciones programadas. Una actualización manual muestra su salida en tiempo real en la ventana de ejecución del Monitor y no crea un log de ejecución programada en ese directorio.",
       "Las programaciones externas detectadas de Proxmox VE Helper-Scripts se muestran aparte para hacer visible cualquier automatización coincidente."
     ],
@@ -186,7 +186,7 @@
       },
       {
         "problem": "Una actualización programada indica que es necesario reiniciar",
-        "resolution": "Abre <strong>Ver log</strong> para revisar la ejecución completada y reinicia ese LXC. ProxMenux elimina el aviso mediante el evento de ciclo de vida existente cuando el contenedor vuelve a arrancar."
+        "resolution": "Abre Ver registro para revisar la ejecución completada y después reinicia ese LXC. ProxMenux borra el aviso cuando el evento de ciclo de vida detecta el nuevo arranque."
       }
     ]
   },
diff --git a/web/messages/es/docs/monitor/integrations.json b/web/messages/es/docs/monitor/integrations.json
index 36896b10..13c8d5de 100644
--- a/web/messages/es/docs/monitor/integrations.json
+++ b/web/messages/es/docs/monitor/integrations.json
@@ -37,7 +37,7 @@
     "headingHref": "https://gethomepage.dev",
     "intro": "Homepage es un panel de aplicaciones totalmente estático y personalizable. ProxMenux Monitor se enchufa vía el widget <code>customapi</code> integrado — pega una entrada de servicio en <code>services.yaml</code>, reinicia Homepage y la tarjeta aparece con números en vivo.",
     "iconCalloutTitle": "El logo oficial de ProxMenux está en dashboardicons.com",
-    "iconCalloutBody": "Las guías de abajo usan <code>icon: proxmenux.png</code>. Homepage resuelve automáticamente los nombres de archivo simples contra <a1>dashboardicons.com</a1> — una librería de iconos curada para paneles autoalojados. La entrada de ProxMenux vive en <a2>dashboardicons.com/icons/external/proxmenux</a2> y Homepage la descarga en el primer render. La misma búsqueda funciona para miles de otras herramientas (Telegram, Discord, Grafana, Tailscale, etc.) — basta con escribir <code>icon: &lt;nombre&gt;.png</code> en cualquier entrada de servicio.",
+    "iconCalloutBody": "Las guías de abajo usan <code>icon: proxmenux.png</code>. Homepage resuelve automáticamente los nombres de archivo simples contra <a1>dashboardicons.com</a1> — una librería de iconos curada para paneles autoalojados. La entrada de ProxMenux vive en <a2>dashboardicons.com/icons/external/proxmenux</a2> y Homepage la descarga en el primer render. La misma búsqueda funciona para miles de otras herramientas (Telegram, Discord, Grafana, Tailscale, etc.) — basta con escribir <code>icon: &lt;name&gt;.png</code> en cualquier entrada de servicio.",
     "imageAlt": "Panel Homepage mostrando tres tarjetas de ProxMenux Monitor (EDGE, VOID, DREAM) con uptime, CPU, RAM y temperatura para cada host Proxmox",
     "imageCaption": "Tres instancias de ProxMenux Monitor renderizadas como tarjetas Homepage — uptime, CPU, RAM y temperatura de CPU leídas en vivo desde <code>/api/system</code> en cada host cada 10 s.",
     "basicTitle": "Widget básico — sin autenticación",
@@ -94,7 +94,7 @@
     "twoColTipBody": "Reemplaza cualquier par de tarjetas (p. ej. <em>Sistema</em> + <em>VMs</em>, o <em>Almacenamiento</em> + <em>Red</em>) con un único <code>horizontal-stack</code> envolviendo ambas, para que siempre se rendericen lado a lado independientemente del ancho de pantalla:",
     "twoColTipOutro": "En móvil la fila se mantiene comprimida; el auto layout de HA (sin horizontal-stack) refluye mejor a anchos estrechos.",
     "step6Title": "6 · Automatizaciones",
-    "step6Body": "Tres automatizaciones que cubren los escenarios reactivos más comunes — reemplaza <code>notify.mobile_app_&lt;tu_movil&gt;</code> por el servicio notify que uses:",
+    "step6Body": "Tres automatizaciones que cubren los escenarios reactivos más comunes — reemplaza <code>notify.mobile_app_&lt;your_phone&gt;</code> por el servicio notify que uses:",
     "logoTitle": "Sobre el logo de ProxMenux",
     "logoBody": "La tarjeta picture-entity en la parte superior del YAML Lovelace descarga el logo oficial de ProxMenux desde <a1>dashboardicons.com</a1> — una librería de iconos gratuita curada para paneles autoalojados. La entrada de ProxMenux vive en <a2>dashboardicons.com/icons/external/proxmenux</a2>. Home Assistant descarga el SVG sobre HTTPS en el primer render y lo cachea.",
     "logoBrokenTitle": "Si la tarjeta del logo muestra una imagen rota",
@@ -120,7 +120,7 @@
     "tokenTipTitle": "Token vía archivo o env, no inline",
     "tokenTipBody": "Para despliegues en producción evita poner el token inline. Prometheus soporta <code>credentials_file: /etc/prometheus/secrets/proxmenux.token</code> como alternativa — guarda el token en un archivo 0600 y deja que Prometheus lo lea.",
     "step2Title": "2 · Verifica el scrape con un par de queries",
-    "step2Body": "Antes de configurar Grafana, confirma que Prometheus realmente tiene los datos. Abre la propia UI de Prometheus en <code>http://&lt;host-prometheus&gt;:9090</code>, pulsa <em>Query</em> y ejecuta cualquiera de estas — deberías obtener números en vivo de tu host Proxmox:",
+    "step2Body": "Antes de configurar Grafana, confirma que Prometheus realmente tiene los datos. Abre la propia UI de Prometheus en <code>http://&lt;prometheus-host&gt;:9090</code>, pulsa <em>Query</em> y ejecuta cualquiera de estas — deberías obtener números en vivo de tu host Proxmox:",
     "headerQuery": "Query",
     "headerConfirms": "Qué confirma",
     "verifyRows": [
diff --git a/web/messages/es/docs/monitor/notifications.json b/web/messages/es/docs/monitor/notifications.json
index 85089fa0..6a0cf1f3 100644
--- a/web/messages/es/docs/monitor/notifications.json
+++ b/web/messages/es/docs/monitor/notifications.json
@@ -44,7 +44,7 @@
       "Arranca el hilo de fondo de despacho. El hilo hace polling de la cola de eventos y camina cada evento por la pipeline diagramada arriba."
     ],
     "activeAlt": "Tarjeta de notificaciones activada con pestañas de canales, nombre visible y opciones avanzadas de IA",
-    "activeCaption": "Estado activo: pestañas Telegram, Gotify, Discord, Email, Pushover y Apprise, nombre visible, categorías por canal y opciones avanzadas de IA."
+    "activeCaption": "Estado activo: pestañas de canales en la parte superior (Telegram / Gotify / Discord / correo electrónico / Pushover / Apprise), campo Nombre para mostrar, lista de categorías de cada canal y sección desplegable <em>Avanzado: mejora con IA</em>."
   },
   "sources": {
     "heading": "Fuentes de eventos",
@@ -119,7 +119,7 @@
     "groupItems": [
       "Añade el bot al grupo como miembro (y hazlo admin si el grupo lo requiere para publicar).",
       "Envía cualquier mensaje en el grupo.",
-      "Abre <code>https://api.telegram.org/bot&lt;TU_TOKEN&gt;/getUpdates</code> en un navegador. Busca <code>chat.id</code> en la respuesta JSON — para grupos es un número negativo, para supergrupos empieza con <code>-100</code>.",
+      "Abre <code>https://api.telegram.org/bot&lt;YOUR_TOKEN&gt;/getUpdates</code> en un navegador. Busca <code>chat.id</code> en la respuesta JSON — para grupos es un número negativo, para supergrupos empieza con <code>-100</code>.",
       "Para supergrupos con <em>Topics</em> activado, anota también el <code>message_thread_id</code> del tema al que quieres apuntar — eso va en el campo opcional <em>Topic ID</em>."
     ],
     "groupAlt": "Formulario de canal Telegram con Bot Token (enmascarado), Chat ID negativo prefijado con -100 indicando un supergrupo, y Topic ID 3 configurado para entregar a un tema específico",
@@ -203,7 +203,7 @@
     "stepsTitle": "Pasos",
     "steps": [
       "Elige el servicio destino en la <a>wiki de Apprise</a> y copia la plantilla de URL para él. Cada página de servicio muestra el esquema exacto a usar (<code>ntfy://</code>, <code>matrix://</code>, <code>pover://</code>, <code>slack://</code>…) más cualquier token, canal u hostname requerido.",
-      "Rellena los placeholders con tus propias credenciales. Por ejemplo, un topic de ntfy.sh tiene aspecto de <code>ntfy://ntfy.sh/mi-topic</code>; una URL de Pushover tiene aspecto de <code>pover://user@token</code>; una URL de Matrix tiene aspecto de <code>matrix://user:pass@host:port/#room</code>.",
+      "Sustituye los marcadores por tus credenciales. Ejemplos: ntfy.sh <code>ntfy://ntfy.sh/my-topic</code>; Pushover <code>pover://user@token</code>; Matrix <code>matrix://user:pass@host:port/#room</code>.",
       "Pega la URL final en el campo <em>Apprise URL</em> en la pestaña Apprise del panel Notifications y guarda.",
       "Pulsa <em>Send Test</em> para verificar que la URL es alcanzable y las credenciales se aceptan."
     ],
@@ -295,7 +295,7 @@
     "rows": [
       {
         "stage": "1. Deduplicación por huella",
-        "what": "Cada evento genera una huella (<code>event_type + campos clave de data</code>). Las huellas idénticas dentro de una ventana corta se consideran duplicados del primero.",
+        "what": "Cada evento genera una huella (<code>event_type + key fields from data</code>). Las huellas idénticas dentro de una ventana corta se consideran duplicados del primero.",
         "tunable": "No — lógica interna del dispatcher."
       },
       {
@@ -339,7 +339,7 @@
       "<strong>Llamadores remotos.</strong> Cinco capas se apilan encima del rate-limiting: un shared secret en la cabecera <code>X-Webhook-Secret</code>, un timestamp de frescura en <code>X-ProxMenux-Timestamp</code> (rechazado si se desvía más allá de la ventana configurada), una búsqueda de caché de replay y una allowlist de IP opcional. El shared secret vive en la tabla de ajustes SQLite del Monitor — no en <code>/etc/pve/priv/notifications.cfg</code> — y se genera en el primer setup. Este camino existe para integraciones personalizadas que hacen POST desde fuera del host; el destino configurado por PVE nunca lo ejercita."
     ],
     "practiceTitle": "En la práctica",
-    "practiceBody": "El setup de PVE escribe el destino como <code>http://127.0.0.1:8008</code>, así que las notificaciones emitidas por PVE siempre pasan por el camino loopback con seguridad solo rate-limit. El camino de llamador remoto con shared secret es opt-in para integraciones personalizadas — apunta un servicio externo a <code>https://&lt;host-monitor&gt;:&lt;port&gt;/api/notifications/webhook</code> y suministra la cabecera <code>X-Webhook-Secret</code> para usarlo.",
+    "practiceBody": "El setup de PVE escribe el destino como <code>http://127.0.0.1:8008</code>, así que las notificaciones emitidas por PVE siempre pasan por el camino loopback con seguridad solo rate-limit. El camino de llamador remoto con shared secret es opt-in para integraciones personalizadas — apunta un servicio externo a <code>https://&lt;monitor-host&gt;:&lt;port&gt;/api/notifications/webhook</code> y suministra la cabecera <code>X-Webhook-Secret</code> para usarlo.",
     "actionsIntro": "El Monitor gestiona este destino a través de tres acciones en la pestaña Settings:",
     "actionsItems": [
       "<strong>Setup</strong> — corre automáticamente cuando activas Notifications. Crea la entrada en <code>/etc/pve/notifications.cfg</code>. El archivo solo se escribe cuando su contenido tiene que cambiar, y se guarda un backup del anterior en <code>/usr/local/share/proxmenux/backups/pve-notifications/</code> (los tres más recientes). No se escribe nada mientras <code>/etc/pve</code> no está montado: un Monitor que arranca durante un reinicio de <code>pve-cluster</code> registra la entrada cuando vuelve.",
diff --git a/web/messages/es/docs/network/backup-restore.json b/web/messages/es/docs/network/backup-restore.json
index 4e6945a4..c8759c70 100644
--- a/web/messages/es/docs/network/backup-restore.json
+++ b/web/messages/es/docs/network/backup-restore.json
@@ -1,8 +1,8 @@
 {
   "meta": {
-    "title": "Backup y reinicio de interfaces | ProxMenux Documentation",
+    "title": "Backup y reinicio de interfaces | Documentación de ProxMenux",
     "description": "Snapshot manual, navegación y restauración de backups de /etc/network/interfaces almacenados en /var/backups/proxmenux/. Incluye un reinicio del servicio de red con confirmación y una vista rápida de la configuración en vivo.",
-    "ogTitle": "Backup y reinicio de interfaces | ProxMenux Documentation",
+    "ogTitle": "Backup y reinicio de interfaces | Documentación de ProxMenux",
     "ogDescription": "Snapshot y restauración de la configuración de red de Proxmox; reinicia el servicio de red con confirmación."
   },
   "header": {
@@ -27,7 +27,7 @@
     "heading": "Crear backup de red",
     "body": "Copia el <code>/etc/network/interfaces</code> actual al directorio de backups con un timestamp nuevo. Ya está — sin análisis, sin prompts, solo un snapshot.",
     "whenTitle": "Cuándo hacer un backup manual",
-    "whenBody": "Antes de editar <code>/etc/network/interfaces</code> a mano, antes de instalar un paquete que pueda tocar la stack de red (p. ej. NetworkManager, Open vSwitch) o antes de cualquier cambio de hardware. Las reparaciones guiadas ya hacen snapshot automáticamente — esta opción es para los momentos <em>manuales</em>."
+    "whenBody": "Antes de editar <code>/etc/network/interfaces</code> a mano, antes de instalar un paquete que pueda modificar la pila de red (p. ej. NetworkManager, Open vSwitch) o antes de cualquier cambio de hardware. Las reparaciones guiadas ya hacen un backup automáticamente; esta opción es para las operaciones <em>manuales</em>."
   },
   "restore": {
     "heading": "Restaurar backup de red",
@@ -96,7 +96,7 @@
         "tail": " — la razón más habitual por la que un backup acaba aquí."
       },
       {
-        "label": "Análisis de config y limpieza guiada",
+        "label": "Análisis de configuración y limpieza guiada",
         "href": "/docs/network/config-analysis",
         "tailRich": " — también escribe en <code>/var/backups/proxmenux/</code> automáticamente."
       },
diff --git a/web/messages/es/docs/network/bridge-analysis.json b/web/messages/es/docs/network/bridge-analysis.json
index 6fba5f64..08511c30 100644
--- a/web/messages/es/docs/network/bridge-analysis.json
+++ b/web/messages/es/docs/network/bridge-analysis.json
@@ -1,8 +1,8 @@
 {
   "meta": {
-    "title": "Análisis de bridges y reparación guiada | ProxMenux Documentation",
+    "title": "Análisis de bridges y reparación guiada | Documentación de ProxMenux",
     "description": "Detecta bridges vmbrX con puertos físicos ausentes o inválidos (típico tras una re-enumeración PCI), los reporta con comandos de shell propuestos y ofrece una reparación guiada de 5 pasos con backup obligatorio.",
-    "ogTitle": "Análisis de bridges y reparación guiada | ProxMenux Documentation",
+    "ogTitle": "Análisis de bridges y reparación guiada | Documentación de ProxMenux",
     "ogDescription": "Auditar y reparar los puertos de bridge de Proxmox tras cambios de hardware, con flujo guiado y rollback seguro."
   },
   "header": {
@@ -35,7 +35,7 @@
         "bridgeLabel": "Analizar (solo lectura)",
         "bridgeDetail": "ip link show enp3s0\n→ no existe",
         "targetLabel": "Informe + sugerencia",
-        "targetDetail": "❌ enp3s0: NOT FOUND\nReemplazar por: eno1\n(aún sin cambios)"
+        "targetDetail": "❌ enp3s0: NO ENCONTRADO\nReemplazar por: eno1\n(aún sin cambios)"
       }
     },
     "diagram2": {
@@ -50,7 +50,7 @@
   },
   "step1": {
     "heading": "Paso 1: análisis (solo lectura)",
-    "intro": "Seleccionar <strong>Analizar configuración de bridges</strong> aborta inmediatamente si el host no usa la stack clásica de Debian/Proxmox. Si no, recorre cada bridge y reporta:",
+    "intro": "Al seleccionar <strong>Analizar configuración de bridges</strong>, la herramienta se detiene inmediatamente si el host no usa la pila clásica de Debian/Proxmox. En caso contrario, recorre todos los bridges e informa de:",
     "items": [
       "Nombre del bridge, estado actual (UP / DOWN), IP asignada.",
       "Cada puerto declarado y si existe actualmente (<code>ip link show &lt;port&gt;</code>).",
@@ -76,7 +76,7 @@
       },
       {
         "title": "3. Previsualizar los cambios propuestos",
-        "body": "Lista exactamente qué bridges se van a tocar y qué sustituciones de puerto se van a hacer. Si el análisis decide que en realidad no hay que arreglar nada (race condition: el puerto volvió), el flujo sale limpio con <em>\"No changes needed.\"</em>",
+        "body": "Lista exactamente qué bridges se modificarán y qué sustituciones de puertos se harán. Si el análisis determina que no hay nada que reparar porque el puerto ha reaparecido entre las comprobaciones, el proceso termina con <em>«No se necesitan cambios»</em>.",
         "tone": "blue"
       },
       {
@@ -90,7 +90,7 @@
         "tone": "emerald"
       }
     ],
-    "restartTitle": "Reiniciar networking ≠ un undo gratis",
+    "restartTitle": "Reiniciar la red ≠ deshacer los cambios sin riesgo",
     "restartBody": "La reparación se escribe en disco independientemente de si reinicias el servicio. <code>systemctl restart networking</code> aplica el cambio <em>ahora</em>, lo que puede cortar tu sesión SSH si el nuevo puerto es incorrecto. Si rechazas el reinicio, el cambio sigue surtiendo efecto en el siguiente reinicio — confirma antes la nueva config o haz rollback con el comando impreso."
   },
   "edits": {
@@ -99,8 +99,8 @@
   },
   "troubleshoot": {
     "heading": "Solución de problemas",
-    "unsupportedTitle": "El análisis aborta con \"Unsupported Network Stack\"",
-    "unsupportedBody": "El host usa netplan, systemd-networkd o NetworkManager. La herramienta solo soporta <code>/etc/network/interfaces</code>. Cambia el host a la stack clásica primero, o edita la configuración con las herramientas nativas del gestor (p. ej. <code>netplan apply</code>).",
+    "unsupportedTitle": "El análisis se detiene con «Unsupported Network Stack»",
+    "unsupportedBody": "El host usa netplan, systemd-networkd o NetworkManager. La herramienta solo admite <code>/etc/network/interfaces</code>. Cambia primero el host a la pila clásica o edita la configuración con las herramientas nativas del gestor (p. ej. <code>netplan apply</code>).",
     "noSuggestTitle": "No se imprime sugerencia para un puerto inválido",
     "noSuggestBody": "El host no tiene ninguna interfaz física libre (todas están ya en otro bridge o no existen). El análisis cae a sugerir <code>bridge-ports none</code> para que el bridge al menos pueda levantar sin puerto. Añade una NIC o migra puertos entre bridges manualmente antes de volver a ejecutar.",
     "stillDownTitle": "La reparación termina pero el bridge sigue DOWN",
@@ -118,7 +118,7 @@
         "tail": " — fija los nombres a direcciones MAC para que esto deje de pasar."
       },
       {
-        "label": "Análisis de config y limpieza guiada",
+        "label": "Análisis de configuración y limpieza guiada",
         "href": "/docs/network/config-analysis",
         "tailRich": " — para bloques <code>iface</code> huérfanos (la otra mitad del mismo problema)."
       },
diff --git a/web/messages/es/docs/network/config-analysis.json b/web/messages/es/docs/network/config-analysis.json
index af835473..e04f23a2 100644
--- a/web/messages/es/docs/network/config-analysis.json
+++ b/web/messages/es/docs/network/config-analysis.json
@@ -1,12 +1,12 @@
 {
   "meta": {
-    "title": "Análisis de config y limpieza guiada | ProxMenux Documentation",
+    "title": "Análisis de configuración y limpieza guiada | Documentación de ProxMenux",
     "description": "Detecta bloques iface en /etc/network/interfaces que referencian NICs físicas que ya no están en el host. Los reporta y ofrece una eliminación guiada de 5 pasos con backup obligatorio y previsualización por bloque.",
-    "ogTitle": "Análisis de config y limpieza guiada | ProxMenux Documentation",
+    "ogTitle": "Análisis de configuración y limpieza guiada | Documentación de ProxMenux",
     "ogDescription": "Encuentra y elimina bloques de interfaz huérfanos dejados por cambios de hardware, con previsualización completa y rollback."
   },
   "header": {
-    "title": "Análisis de config y limpieza guiada",
+    "title": "Análisis de configuración y limpieza guiada",
     "description": "Recorre cada bloque iface en /etc/network/interfaces y verifica que la NIC física subyacente sigue existiendo. Reporta los bloques huérfanos dejados por cambios de hardware y ofrece una eliminación guiada con backup, previsualización y confirmación por bloque.",
     "section": "Red"
   },
@@ -18,7 +18,7 @@
     "heading": "En qué se diferencia del análisis de bridges",
     "headerAspect": "Aspecto",
     "headerBridge": "Análisis de bridges",
-    "headerConfig": "Análisis de config",
+    "headerConfig": "Análisis de configuración",
     "rows": [
       {
         "aspect": "Mira",
@@ -45,7 +45,7 @@
   },
   "step1": {
     "heading": "Paso 1: análisis (solo lectura)",
-    "intro": "Aborta inmediatamente si el host no usa la stack clásica. Si no, lista cada interfaz configurada que no sea loopback y reporta su estado:",
+    "intro": "Se detiene inmediatamente si el host no usa la pila clásica. En caso contrario, lista todas las interfaces configuradas salvo loopback e indica su estado:",
     "virtTitle": "Las interfaces virtuales están protegidas",
     "virtBody": "Los bridges (<code>vmbrX</code>) y los bonds (<code>bondX</code>) son construcciones virtuales. Pueden no existir legítimamente en el momento de la inspección (p. ej. un bridge aún sin puertos), por lo que el análisis nunca propone eliminarlos — solo NICs físicas."
   },
@@ -60,7 +60,7 @@
       },
       {
         "title": "2. Confirmar la lista a eliminar",
-        "body": "Lista exactamente qué bloques de interfaz física se van a eliminar. Si, entre el análisis y la limpieza, las NICs han reaparecido (p. ej. has reasentado una tarjeta), el flujo sale con <em>\"No cleanup needed.\"</em>",
+        "body": "Lista exactamente qué bloques de interfaz física se eliminarán. Si las NIC han reaparecido entre el análisis y la limpieza, por ejemplo al volver a insertar una tarjeta, el proceso termina con <em>«No se necesita limpieza»</em>.",
         "tone": "blue"
       },
       {
@@ -91,7 +91,7 @@
   },
   "troubleshoot": {
     "heading": "Solución de problemas",
-    "notFoundTitle": "El análisis muestra mi NIC nueva como \"NOT FOUND\"",
+    "notFoundTitle": "El análisis muestra mi NIC nueva como «NO ENCONTRADO»",
     "notFoundBody": "El kernel ve el dispositivo con un nombre distinto al que hay en el fichero. Ejecuta <code>ip link show</code> para obtener el nombre real. Este es exactamente el caso en el que <link>Nombres persistentes de interfaz</link> evitaría el problema de aquí en adelante.",
     "tooMuchTitle": "La limpieza eliminó demasiado (un bloque que quería conservar)",
     "tooMuchBody": "Restaura desde el backup impreso en el paso 5:",
diff --git a/web/messages/es/docs/network/diagnostics.json b/web/messages/es/docs/network/diagnostics.json
index 2e01d19e..7ea0b105 100644
--- a/web/messages/es/docs/network/diagnostics.json
+++ b/web/messages/es/docs/network/diagnostics.json
@@ -1,8 +1,8 @@
 {
   "meta": {
-    "title": "Diagnóstico | ProxMenux Documentation",
-    "description": "Tres comprobaciones de diagnóstico puntuales de solo lectura: Mostrar tabla de rutas, Test de conectividad y Diagnóstico avanzado. Pura inspección — nunca escribe en /etc/network/interfaces y nunca ejecuta un comando modificador (con una excepción explícita y opt-in para purgar NetworkManager cuando se detecta).",
-    "ogTitle": "Diagnóstico | ProxMenux Documentation",
+    "title": "Diagnóstico | Documentación de ProxMenux",
+    "description": "Tres comprobaciones de diagnóstico puntuales de solo lectura: Mostrar tabla de rutas, Test de conectividad y Diagnóstico avanzado. Pura inspección: nunca escribe en /etc/network/interfaces ni ejecuta comandos modificadores, con una excepción explícita que requiere tu aceptación para purgar NetworkManager si se detecta.",
+    "ogTitle": "Diagnóstico | Documentación de ProxMenux",
     "ogDescription": "Diagnóstico de red de solo lectura para el host Proxmox: rutas, alcanzabilidad, estadísticas avanzadas."
   },
   "header": {
@@ -21,12 +21,12 @@
   "connectivity": {
     "heading": "Test de conectividad",
     "intro": "Envía dos sondas ICMP a tres destinos en secuencia y reporta cada uno. Luego ejecuta un <code>nslookup google.com</code> para verificar la resolución DNS independientemente de ICMP.",
-    "headerTest": "Test",
+    "headerTest": "Prueba",
     "headerTarget": "Destino",
     "headerConfirms": "Qué confirma",
     "rows": [
       {
-        "test": "Google DNS",
+        "test": "DNS de Google",
         "target": "8.8.8.8",
         "confirms": "Alcanzabilidad externa por IP anycast conocida"
       },
@@ -36,7 +36,7 @@
         "confirms": "Segunda opinión independiente si Google bloquea ICMP"
       },
       {
-        "test": "Gateway",
+        "test": "Pasarela",
         "target": "(ruta por defecto)",
         "confirms": "Conectividad L2 / L3 con el router local"
       },
@@ -53,7 +53,7 @@
     "heading": "Diagnóstico avanzado",
     "intro": "Agrega estadísticas de red a nivel global y ejecuta una batería de comprobaciones de problemas comunes. Reporta el número de conexiones activas, puertos en escucha, total de interfaces y señala dos antipatrones explícitamente:",
     "items": [
-      "<strong>NetworkManager corriendo en un host Proxmox.</strong> NetworkManager y el <code>ifupdown</code> de Proxmox entran en conflicto — los dos intentan gestionar interfaces, lo que provoca bridges que flapean o se niegan a levantar. Si se detecta, la herramienta ofrece un prompt interactivo para detenerlo, deshabilitarlo y purgarlo (es el <em>único</em> diagnóstico que puede modificar el sistema, y solo tras consentimiento explícito).",
+      "<strong>NetworkManager ejecutándose en un host Proxmox.</strong> NetworkManager y el <code>ifupdown</code> de Proxmox entran en conflicto: ambos intentan gestionar las interfaces, lo que provoca bridges con caídas intermitentes o que no se activan. Si se detecta, la herramienta ofrece una confirmación interactiva para detenerlo, deshabilitarlo y purgarlo (es el <em>único</em> diagnóstico que puede modificar el sistema, y solo tras consentimiento explícito).",
       "<strong>Direcciones IP duplicadas en distintas interfaces.</strong> Dos interfaces con la misma IPv4 causan conectividad intermitente extremadamente difícil de depurar desde dentro de la VM. Se detecta vía <code>ip -4 addr show | sort | uniq -d</code>."
     ],
     "nmTitle": "El prompt de NetworkManager es la única acción modificadora aquí",
@@ -80,7 +80,7 @@
         "tail": " — cuando un vmbrX se queda sin su puerto físico."
       },
       {
-        "label": "Análisis de config y limpieza guiada",
+        "label": "Análisis de configuración y limpieza guiada",
         "href": "/docs/network/config-analysis",
         "tail": " — cuando una NIC antigua sigue declarada pero ya no está."
       },
diff --git a/web/messages/es/docs/network/index.json b/web/messages/es/docs/network/index.json
index 2d7e778e..07c20084 100644
--- a/web/messages/es/docs/network/index.json
+++ b/web/messages/es/docs/network/index.json
@@ -1,15 +1,15 @@
 {
   "meta": {
     "title": "Gestión de red en Proxmox — bridges, bonds, diagnóstico, reparación | ProxMenux",
-    "description": "Diagnóstico de solo lectura, flujos de analizar-y-sugerir y reparaciones guiadas para la stack de red Debian / Proxmox (/etc/network/interfaces). Inspecciona bridges y bonds, ejecuta herramientas de monitorización en vivo, persiste nombres de interfaz, hace backup y reinicia la red de forma segura — con backups obligatorios y previsualizaciones paso a paso.",
+    "description": "Diagnóstico de solo lectura, análisis con propuestas y reparaciones guiadas para la pila de red Debian / Proxmox (/etc/network/interfaces). Inspecciona bridges y bonds, ejecuta herramientas de monitorización en vivo, fija nombres de interfaz, crea backups y reinicia la red de forma segura, con backups obligatorios y vistas previas paso a paso.",
     "ogTitle": "Gestión de red en Proxmox — bridges, bonds, diagnóstico, reparación",
-    "ogDescription": "Diagnóstico, análisis y reparaciones guiadas para la stack de red de Proxmox con backups obligatorios y previsualizaciones paso a paso.",
+    "ogDescription": "Diagnóstico, análisis y reparaciones guiadas para la pila de red de Proxmox con backups obligatorios y vistas previas paso a paso.",
     "twitterTitle": "Gestión de red en Proxmox | ProxMenux",
-    "twitterDescription": "Bridges, bonds, diagnóstico y reparaciones guiadas para la stack de red de Proxmox con backups obligatorios."
+    "twitterDescription": "Bridges, bonds, diagnóstico y reparaciones guiadas para la pila de red de Proxmox con backups obligatorios."
   },
   "header": {
     "title": "Gestión de red",
-    "description": "Diagnóstico de solo lectura, informes de analizar-y-sugerir y reparaciones guiadas para la stack clásica de red Debian/Proxmox. Cada flujo destructivo hace primero un backup y previsualiza los cambios exactos antes de aplicarlos.",
+    "description": "Diagnóstico de solo lectura, informes de análisis con propuestas y reparaciones guiadas para la pila de red clásica de Debian/Proxmox. Cada operación destructiva hace primero un backup y muestra los cambios exactos antes de aplicarlos.",
     "section": "Red"
   },
   "intro": {
@@ -52,8 +52,8 @@
       ]
     }
   },
-  "classicTitle": "Solo stack clásica",
-  "classicBody": "Cada función de análisis y reparación comprueba el gestor de red activo antes de tocar nada. Si el host usa <strong>netplan</strong>, <strong>systemd-networkd</strong> o <strong>NetworkManager</strong>, la herramienta aborta inmediatamente con un mensaje claro — el menú solo soporta la stack clásica de Debian/Proxmox en <code>/etc/network/interfaces</code>. Es intencional: editar un fichero de netplan con reglas escritas para <code>ifupdown</code> corrompería silenciosamente la configuración.",
+  "classicTitle": "Solo la pila de red clásica",
+  "classicBody": "Cada función de análisis y reparación comprueba el gestor de red activo antes de tocar nada. Si el host usa <strong>netplan</strong>, <strong>systemd-networkd</strong> o <strong>NetworkManager</strong>, la herramienta se detiene inmediatamente con un mensaje claro: el menú solo admite la pila clásica de Debian/Proxmox en <code>/etc/network/interfaces</code>. Es intencional: editar un fichero de netplan con reglas escritas para <code>ifupdown</code> corrompería silenciosamente la configuración.",
   "backups": {
     "heading": "Dónde van los backups",
     "intro": "Cada reparación guiada, restauración o backup manual escribe una copia con timestamp de <code>/etc/network/interfaces</code> en <code>/var/backups/proxmenux/</code>:",
@@ -61,7 +61,7 @@
   },
   "readOnlySection": {
     "heading": "Inspección de solo lectura",
-    "body": "El punto de partida cuando algo huele raro. Pura inspección — nunca escribe en <code>/etc/network/interfaces</code> y nunca ejecuta un comando modificador (con una única excepción explícita y opt-in para purgar NetworkManager cuando se detecta). Seguro de usar por SSH en cualquier momento.",
+    "body": "El punto de partida cuando algo parece ir mal. Pura inspección: nunca escribe en <code>/etc/network/interfaces</code> ni ejecuta comandos que modifiquen el sistema (con una única excepción explícita, que requiere tu aceptación, para purgar NetworkManager cuando se detecta). Se puede usar por SSH en cualquier momento de forma segura.",
     "options": [
       {
         "title": "Diagnóstico",
@@ -82,7 +82,7 @@
         "description": "Detecta bridges vmbrX con puertos ausentes o inválidos (típico tras una re-enumeración PCI). Muestra primero un informe; solo repara cuando aceptas el flujo guiado de 5 pasos."
       },
       {
-        "title": "Análisis de config y limpieza guiada",
+        "title": "Análisis de configuración y limpieza guiada",
         "description": "Encuentra interfaces físicas declaradas en /etc/network/interfaces que ya no existen (configs huérfanas que dejan cambios de hardware). Las reporta y ofrece una eliminación guiada."
       }
     ]
diff --git a/web/messages/es/docs/network/monitoring.json b/web/messages/es/docs/network/monitoring.json
index 2db64fb1..5a04cbfb 100644
--- a/web/messages/es/docs/network/monitoring.json
+++ b/web/messages/es/docs/network/monitoring.json
@@ -1,13 +1,13 @@
 {
   "meta": {
-    "title": "Herramientas de monitorización en vivo | ProxMenux Documentation",
+    "title": "Herramientas de monitorización en vivo | Documentación de ProxMenux",
     "description": "Tres lanzadores interactivos de monitorización de red: iftop (ancho de banda en tiempo real por par de hosts), iptraf-ng (monitor de tráfico multimodo) e iperf3 (test de ancho de banda, modo servidor / cliente). Cada uno se instala la primera vez que se usa.",
-    "ogTitle": "Herramientas de monitorización en vivo | ProxMenux Documentation",
+    "ogTitle": "Herramientas de monitorización en vivo | Documentación de ProxMenux",
     "ogDescription": "Monitorización interactiva de red y test de ancho de banda para el host Proxmox: iftop, iptraf-ng, iperf3."
   },
   "header": {
     "title": "Herramientas de monitorización en vivo",
-    "description": "Tres lanzadores interactivos para observación de red en tiempo real y medición de ancho de banda: iftop, iptraf-ng e iperf3. Cada herramienta se autoinstala desde apt la primera vez que se usa, corre en primer plano y se sale con la tecla documentada. De solo lectura sobre la configuración del host — solo observan el tráfico.",
+    "description": "Tres lanzadores interactivos para observar la red en tiempo real y medir el ancho de banda: iftop, iptraf-ng e iperf3. Cada herramienta se instala automáticamente desde apt la primera vez que se usa, se ejecuta en primer plano y se cierra con la tecla indicada. No cambian la configuración de red del host; iperf3 genera tráfico de prueba.",
     "section": "Red"
   },
   "intro": {
@@ -69,7 +69,7 @@
       }
     ],
     "exit": "<strong>Salir:</strong> pulsa <kbd>x</kbd> desde cualquier vista (o <kbd>Q</kbd> desde el menú principal). ProxMenux muestra un diálogo recordatorio antes de lanzarlo.",
-    "logTitle": "El logging captura a fichero",
+    "logTitle": "Guardar las capturas en un fichero",
     "logBody": "Cada modo ofrece registrar las estadísticas capturadas en <code>/var/log/iptraf-ng/</code>. Útil si necesitas un registro de un pico de tráfico — déjalo corriendo, vuelca al fichero, revisa el fichero después en lugar de intentar leer la pantalla en vivo."
   },
   "iperf3": {
@@ -81,24 +81,24 @@
     "headerCli": "CLI equivalente",
     "rows": [
       {
-        "mode": "Server",
+        "mode": "Servidor",
         "behaviour": "Escucha en TCP 5201 e imprime resultados de cada test entrante. Se detiene con Ctrl+C.",
         "cli": "iperf3 -s"
       },
       {
-        "mode": "Client",
+        "mode": "Cliente",
         "behaviour": "Pide la IP / hostname del servidor, conecta, ejecuta un test por defecto de 10 segundos e imprime el informe.",
         "cli": "iperf3 -c <target>"
       }
     ],
     "workflowIntro": "Flujo típico para probar un enlace 10 GbE entre dos hosts Proxmox:",
     "workflow": [
-      "En el host A, abre el menú Red → <em>Test de ancho de banda (iperf3)</em> → elige <strong>Server</strong>.",
-      "En el host B, abre la misma entrada de menú → elige <strong>Client</strong> → introduce la IP del host A.",
+      "En el host A, abre el menú Red → <em>Test de ancho de banda (iperf3)</em> → elige <strong>Servidor</strong>.",
+      "En el host B, abre la misma entrada de menú → elige <strong>Cliente</strong> → introduce la IP del host A.",
       "Espera 10 segundos. Compara la tasa reportada con el máximo teórico del enlace."
     ],
     "sample": "Salida de ejemplo del cliente:",
-    "flagsTitle": "Flags útiles a mano (desde una shell)",
+    "flagsTitle": "Opciones útiles para ejecutar a mano desde una shell",
     "flagsBody": "<code>-t 60</code> test más largo (60s en lugar de los 10s por defecto), <code>-P 4</code> 4 streams en paralelo (satura más rápido), <code>-R</code> dirección inversa (servidor → cliente), <code>-u -b 100M</code> test UDP a 100 Mbit/s (para mediciones de jitter / pérdida de paquetes), <code>-p 5202</code> usa un puerto distinto (varios tests en paralelo). <code>man iperf3</code> para el set completo.",
     "firewallTitle": "Abre el puerto del firewall en el servidor",
     "firewallBody": "El servidor escucha en TCP <strong>5201</strong> por defecto. Si corres el servidor dentro de un host Proxmox con un firewall estricto (a nivel de datacenter o de host), permite entrada TCP 5201 desde la IP del cliente durante el test y luego ciérralo. Lo mismo aplica a <code>nftables</code> / <code>iptables</code> en hosts bare metal."
diff --git a/web/messages/es/docs/network/persistent-names.json b/web/messages/es/docs/network/persistent-names.json
index fb4e9b9f..5859a0ff 100644
--- a/web/messages/es/docs/network/persistent-names.json
+++ b/web/messages/es/docs/network/persistent-names.json
@@ -1,8 +1,8 @@
 {
   "meta": {
-    "title": "Nombres persistentes de interfaz | ProxMenux Documentation",
+    "title": "Nombres persistentes de interfaz | Documentación de ProxMenux",
     "description": "Fija los nombres de interfaz de Proxmox (eno1, enp3s0, …) a direcciones MAC mediante ficheros .link de systemd para que los nombres sobrevivan a la re-enumeración PCI, actualizaciones de kernel y al añadir / quitar otras NICs.",
-    "ogTitle": "Nombres persistentes de interfaz | ProxMenux Documentation",
+    "ogTitle": "Nombres persistentes de interfaz | Documentación de ProxMenux",
     "ogDescription": "Evita que los nombres de interfaz de Proxmox cambien al modificar el hardware. Usa ficheros .link de systemd basados en la dirección MAC."
   },
   "header": {
@@ -16,7 +16,7 @@
   },
   "problem": {
     "heading": "El problema que resuelve",
-    "intro": "Linux deriva los nombres de interfaz por defecto a partir de la topología PCI — <code>eno1</code> = onboard, <code>enp3s0</code> = la tarjeta en el bus PCI 3, slot 0, etc. El esquema de naming es determinista <em>dado el mismo layout de hardware</em>. Cambia el layout y los nombres se mueven:",
+    "intro": "Linux obtiene los nombres de interfaz predeterminados a partir de la topología PCI: <code>eno1</code> = integrada en placa, <code>enp3s0</code> = la tarjeta en el bus PCI 3, slot 0, etc. El esquema de nombres es determinista <em>con la misma disposición de hardware</em>. Si cambia la disposición, cambian los nombres:",
     "items": [
       "Añade una GPU delante de una NIC existente → el número de bus de la NIC puede cambiar → el nombre cambia.",
       "Mueve una tarjeta a otro slot PCIe → el nombre cambia.",
@@ -46,7 +46,7 @@
     "headerWhy": "Por qué",
     "rows": [
       {
-        "type": "NIC onboard / PCIe",
+        "type": "NIC integrada / PCIe",
         "behaviour": "Se escribe fichero <code>.link</code>",
         "why": "Respaldada por un dispositivo PCI real — el caso para el que está la herramienta"
       },
@@ -56,7 +56,7 @@
         "why": "Tiene una MAC real y se beneficia de la estabilidad de nombre"
       },
       {
-        "type": "Bridges (vmbrX)",
+        "type": "Puentes (vmbrX)",
         "behaviour": "Se omite",
         "why": "Virtual; el nombre viene de <code>/etc/network/interfaces</code>"
       },
@@ -87,7 +87,7 @@
     "intro": "Si <code>/etc/systemd/network/</code> ya contiene ficheros <code>.link</code> (de una ejecución anterior u otra herramienta), se copian a un directorio de backup con timestamp antes de generar los nuevos:",
     "outro": "Para hacer rollback: copia los ficheros desde el directorio de backup y reinicia.",
     "rebootTitle": "Tiene efecto en el siguiente reinicio, no inmediatamente",
-    "rebootBody": "Los cambios en ficheros <code>.link</code> solo se aplican en el arranque, cuando udev re-enumera los dispositivos. La herramienta reporta <em>\"Changes will apply after reboot\"</em> por este motivo. Renombrar una interfaz en vivo es arriesgado y no se intenta: un <code>vmbr0</code> activo con miembros tendría que reconfigurarse atómicamente, por eso la operación se difiere al siguiente arranque limpio."
+    "rebootBody": "Los cambios en ficheros <code>.link</code> solo se aplican en el arranque, cuando udev vuelve a enumerar los dispositivos. Por eso la herramienta indica <em>«Los cambios se aplicarán después del reinicio»</em>. No intenta renombrar una interfaz en vivo por el riesgo que supone: un <code>vmbr0</code> activo con interfaces miembro tendría que reconfigurarse de forma atómica, así que la operación se aplaza al siguiente arranque limpio."
   },
   "afterReboot": {
     "heading": "Tras el reinicio",
@@ -100,11 +100,11 @@
   },
   "troubleshoot": {
     "heading": "Solución de problemas",
-    "emptyTitle": "\"No physical interfaces found\" tras ejecutar la herramienta",
+    "emptyTitle": "«No se encontraron interfaces físicas» tras ejecutar la herramienta",
     "emptyBody": "El host no tiene interfaces respaldadas por PCI / phy80211 visibles para el kernel. Confirma con <code>ls -l /sys/class/net/</code> — cada entrada debería tener un symlink <code>device</code> (PCI) o una entrada <code>phy80211</code> (Wi-Fi). Si faltan ambos para lo que debería ser una NIC real, el driver no está cargado.",
     "noChangeTitle": "Tras el reinicio, los nombres no han cambiado como esperaba",
     "noChangeBody": "Comprueba que el fichero está presente y bien formado: <code>cat /etc/systemd/network/10-&lt;iface&gt;.link</code>. Después mira los logs de udev: <code>journalctl -u systemd-udevd -b | grep -i link</code>. Una causa habitual es un parámetro de kernel <code>net.ifnames=0</code> residual que deshabilita el naming predictivo por completo — quítalo de <code>/etc/default/grub</code>, ejecuta <code>update-grub</code> y reinicia.",
-    "undoTitle": "Quiero deshacer el naming persistente",
+    "undoTitle": "Quiero deshacer los nombres persistentes",
     "undoBody": "O bien borra los ficheros <code>.link</code> (<code>rm /etc/systemd/network/10-*.link</code>) o restaura desde el directorio de backup generado en la ejecución anterior. Reinicia para aplicar."
   },
   "related": {
@@ -116,7 +116,7 @@
         "tailRich": " — el camino de recuperación cuando los nombres <em>ya</em> se han movido."
       },
       {
-        "label": "Análisis de config y limpieza guiada",
+        "label": "Análisis de configuración y limpieza guiada",
         "href": "/docs/network/config-analysis",
         "tail": " — para eliminar bloques huérfanos dejados por los cambios de nombre."
       },
diff --git a/web/messages/es/docs/oci-manager/architecture.json b/web/messages/es/docs/oci-manager/architecture.json
index b9b22769..1a65c74f 100644
--- a/web/messages/es/docs/oci-manager/architecture.json
+++ b/web/messages/es/docs/oci-manager/architecture.json
@@ -1,17 +1,17 @@
 {
   "meta": {
-    "title": "Cómo se traduce una imagen OCI | ProxMenux",
-    "description": "Del repositorio de la imagen y su archivo Compose a una plantilla revisable, un plan de despliegue y un LXC nativo de Proxmox VE, sin Docker dentro."
+    "title": "Cómo se adapta una imagen OCI | ProxMenux",
+    "description": "Del repositorio de la imagen y su archivo Compose a una plantilla que puedes revisar, un plan de despliegue y un LXC nativo de Proxmox VE, sin Docker dentro."
   },
   "header": {
-    "title": "Cómo se traduce una imagen OCI",
-    "description": "Del repositorio de la imagen y su archivo Compose a una plantilla revisable, un plan de despliegue y un LXC nativo, sin instalar Docker dentro.",
+    "title": "Cómo se adapta una imagen OCI",
+    "description": "Del repositorio de la imagen y su archivo Compose a una plantilla que puedes revisar, un plan de despliegue y un LXC nativo, sin instalar Docker dentro.",
     "section": "OCI manager Apps"
   },
   "sections": [
     {
       "id": "pipeline",
-      "title": "La cadena de traducción",
+      "title": "El proceso de adaptación",
       "blocks": [
         {
           "mermaid": {
@@ -20,7 +20,7 @@
               "repo": "Repositorio de la imagen",
               "converter": "Conversor",
               "template": "Plantilla JSON",
-              "blockers": "¿Sin bloqueos?",
+              "blockers": "¿Sin impedimentos?",
               "no": "No",
               "yes": "Sí",
               "review": "Revisión / overlay",
@@ -30,7 +30,7 @@
           }
         },
         {
-          "p": "El conversor lee la imagen y el archivo Compose que publica su proyecto y escribe una plantilla JSON. Una plantilla con bloqueos sin traducir pasa por revisión, donde un overlay curado los resuelve, antes de publicarse en el catálogo. Solo las plantillas sin bloqueos se ofrecen para instalar."
+          "p": "El conversor lee la imagen y el archivo Compose publicados por el proyecto y genera una plantilla JSON. Si quedan requisitos que no se han podido adaptar y que impiden la instalación, la plantilla pasa por una revisión: un archivo de ajustes revisados, llamado overlay, los resuelve antes de publicarla en el catálogo. Solo se ofrecen para instalar las plantillas que no tienen impedimentos pendientes."
         }
       ]
     },
@@ -41,10 +41,26 @@
         {
           "cards": {
             "items": [
-              { "icon": "archive", "title": "Identidad de la imagen", "body": "Repositorio, etiqueta rolling, arquitectura, digest resuelto y revisión del origen." },
-              { "icon": "braces", "title": "Contrato del contenedor", "body": "Entrypoint, Cmd, entorno, usuario, directorio de trabajo, señal de parada, puertos y volúmenes." },
-              { "icon": "layers", "title": "Traducción a Proxmox VE", "body": "Recursos, seguridad, puntos de montaje, dispositivos, sysctls, healthchecks y las adaptaciones que necesita cada uno, con su motivo." },
-              { "icon": "shield", "title": "Compatibilidad", "body": "Claves admitidas, bloqueos sin traducir y el estado de cada validación." }
+              {
+                "icon": "archive",
+                "title": "Identidad de la imagen",
+                "body": "Repositorio, etiqueta de actualización continua, arquitectura, digest resuelto y revisión de origen."
+              },
+              {
+                "icon": "braces",
+                "title": "Contrato del contenedor",
+                "body": "Entrypoint, Cmd, entorno, usuario, directorio de trabajo, señal de parada, puertos y volúmenes."
+              },
+              {
+                "icon": "layers",
+                "title": "Adaptación a Proxmox VE",
+                "body": "Recursos, seguridad, puntos de montaje, dispositivos, sysctls, comprobaciones de estado y las adaptaciones necesarias en cada caso, con su justificación."
+              },
+              {
+                "icon": "shield",
+                "title": "Compatibilidad",
+                "body": "Claves compatibles, requisitos pendientes de adaptar que impiden la instalación y estado de cada validación."
+              }
             ]
           }
         }
@@ -56,12 +72,32 @@
       "blocks": [
         {
           "table": {
-            "headers": ["Origen", "Ejemplo", "Resultado nativo"],
+            "headers": [
+              "Origen",
+              "Ejemplo",
+              "Resultado nativo"
+            ],
             "rows": [
-              ["Metadatos OCI", "<code>Entrypoint</code>, <code>Cmd</code>, <code>User</code>", "Proxmox VE los importa al crear el CT"],
-              ["Docker Compose", "<code>environment</code>, <code>volumes</code>, <code>devices</code>", "entradas de entorno del LXC, <code>mpN</code> y <code>devN</code>"],
-              ["Perfil de ProxMenux", "GPU, healthcheck, credenciales", "preguntas y adaptaciones revisadas"],
-              ["Usuario", "VMID, almacenamiento, red", "el contrato de la instancia"]
+              [
+                "Metadatos OCI",
+                "<code>Entrypoint</code>, <code>Cmd</code>, <code>User</code>",
+                "Proxmox VE los importa al crear el CT"
+              ],
+              [
+                "Docker Compose",
+                "<code>environment</code>, <code>volumes</code>, <code>devices</code>",
+                "Entradas de entorno de LXC, <code>mpN</code> y <code>devN</code>"
+              ],
+              [
+                "Perfil de ProxMenux",
+                "GPU, comprobación de estado, credenciales",
+                "Preguntas y adaptaciones revisadas"
+              ],
+              [
+                "Usuario",
+                "VMID, almacenamiento, red",
+                "El contrato de la instancia"
+              ]
             ]
           }
         }
@@ -69,18 +105,39 @@
     },
     {
       "id": "install",
-      "title": "Qué ocurre durante una instalación",
+      "title": "Qué ocurre durante la instalación",
       "blocks": [
         {
           "steps": {
             "items": [
-              { "title": "Resolver", "body": "Se consulta el registro, se selecciona la arquitectura del host y se fija el digest efectivo de la etiqueta rolling." },
-              { "title": "Descargar y verificar", "body": "Skopeo descarga la imagen como archivo OCI, y cada capa se comprueba contra su digest y se descomprime antes de crear nada. Una descarga dañada se repite una vez antes de detener la instalación." },
-              { "title": "Construir", "body": "<code>pct create</code> construye el rootfs a partir del archivo y conserva los metadatos oficiales de proceso de la imagen." },
-              { "title": "Conectar", "body": "Se añaden los volúmenes, la red, el entorno, los dispositivos y los perfiles de seguridad declarados." },
-              { "title": "Consola", "body": "La salida de consola del contenedor se guarda en el host, y la consola de Proxmox VE abre un shell cuando la imagen incluye uno." },
-              { "title": "Comprobar", "body": "El primer arranque espera una dirección y la respuesta del servicio; un fallo no se presenta como instalación correcta." },
-              { "title": "Registrar", "body": "La configuración efectiva se escribe en el contrato de la instancia que usan las actualizaciones y las recreaciones." }
+              {
+                "title": "Resolver la referencia",
+                "body": "Se consulta el registro, se selecciona la arquitectura del host y se fija el digest concreto al que apunta la etiqueta de actualización continua."
+              },
+              {
+                "title": "Descargar y verificar",
+                "body": "Skopeo descarga la imagen como un archivo OCI. Antes de crear nada, se verifica el digest de cada capa y se descomprimen todas las capas. Si la descarga está dañada, se vuelve a descargar una vez antes de detener la instalación."
+              },
+              {
+                "title": "Crear el sistema de archivos",
+                "body": "<code>pct create</code> crea el rootfs a partir del archivo y conserva los metadatos oficiales del proceso de la imagen."
+              },
+              {
+                "title": "Conectar los recursos",
+                "body": "Se aplican los volúmenes, la red, el entorno, los dispositivos y los perfiles de seguridad declarados."
+              },
+              {
+                "title": "Consola",
+                "body": "La salida de consola del contenedor se guarda en el host. La consola de Proxmox VE abre una shell si la imagen incluye una."
+              },
+              {
+                "title": "Comprobar",
+                "body": "En el primer arranque se espera a que el contenedor tenga una dirección y el servicio responda. Si falla, la instalación no se da por completada correctamente."
+              },
+              {
+                "title": "Registrar la configuración",
+                "body": "La configuración efectiva se guarda en el contrato de la instancia que utilizan las actualizaciones y las recreaciones."
+              }
             ]
           }
         }
@@ -89,7 +146,7 @@
     {
       "id": "example",
       "title": "Ejemplo: una imagen con /config y /downloads",
-      "intro": "Una definición habitual de Compose y la configuración de Proxmox VE en la que se convierte. Las rutas que espera la aplicación no cambian.",
+      "intro": "Una definición Compose habitual y la configuración de Proxmox VE que se genera a partir de ella. Las rutas que espera la aplicación no cambian.",
       "blocks": [
         {
           "codeGrid": {
@@ -99,14 +156,14 @@
                 "code": "image: lscr.io/linuxserver/example:latest\nenvironment:\n  - PUID=1000\n  - PGID=1000\nvolumes:\n  - config:/config\n  - /srv/downloads:/downloads\nports:\n  - 8080:8080"
               },
               {
-                "title": "/etc/pve/lxc/VMID.conf (extracto)",
+                "title": "/etc/pve/lxc/VMID.conf (fragmento)",
                 "code": "entrypoint: /init\nmp0: local-lvm:vm-VMID-disk-1,mp=/config,backup=1,size=8G\nmp1: /srv/downloads,mp=/downloads\nnet0: name=eth0,bridge=vmbr0,ip=dhcp,type=veth\nlxc.environment.runtime: PUID=1000\nlxc.environment.runtime: PGID=1000"
               }
             ]
           }
         },
         {
-          "p": "<code>mp0</code> es un segundo disco que pertenece al contenedor, con el nombre <code>vm-VMID-disk-N</code> en el almacenamiento elegido. Se monta en <code>/config</code> y, con <code>backup=1</code>, forma parte del backup del contenedor. <code>mp1</code> no crea ningún disco: enlaza el directorio del host <code>/srv/downloads</code> con <code>/downloads</code> dentro del LXC. El puerto 8080 no se mapea: el LXC tiene una dirección propia y el servicio responde en ella."
+          "p": "<code>mp0</code> es un segundo disco que pertenece al contenedor, con el nombre <code>vm-VMID-disk-N</code> en el almacenamiento seleccionado. Se monta en <code>/config</code> y, con <code>backup=1</code>, forma parte del backup del contenedor. <code>mp1</code> no crea ningún disco: monta el directorio del host <code>/srv/downloads</code> en <code>/downloads</code> dentro del LXC. El puerto 8080 no se mapea: el LXC tiene su propia dirección y el servicio responde en ella."
         }
       ]
     }
diff --git a/web/messages/es/docs/oci-manager/custom-image.json b/web/messages/es/docs/oci-manager/custom-image.json
index 5a9316c7..ed75b621 100644
--- a/web/messages/es/docs/oci-manager/custom-image.json
+++ b/web/messages/es/docs/oci-manager/custom-image.json
@@ -1,11 +1,11 @@
 {
   "meta": {
-    "title": "Instalar una imagen que no está en el catálogo | ProxMenux",
-    "description": "Traducción de una imagen OCI desde un archivo Compose, una URL, un comando docker run o una referencia de imagen, con revisión de lo que ProxMenux puede reproducir antes de instalarla."
+    "title": "Instalar una imagen fuera del catálogo | ProxMenux",
+    "description": "Adapta una imagen OCI a partir de un archivo Compose, una URL, un comando docker run o una referencia de imagen, y revisa qué puede reproducir ProxMenux antes de instalarla."
   },
   "header": {
-    "title": "Instalar una imagen que no está en el catálogo",
-    "description": "Una imagen propia se traduce desde su archivo Compose, un comando docker run o solo su referencia, y el resultado se presenta para revisión antes de crear ningún LXC.",
+    "title": "Instalar una imagen que no esté en el catálogo",
+    "description": "Tu imagen se adapta a partir de su archivo Compose, de un comando docker run o de su referencia. El resultado se muestra para que lo revises antes de crear ningún LXC.",
     "section": "OCI manager Apps"
   },
   "sections": [
@@ -14,8 +14,8 @@
       "blocks": [
         {
           "calloutInfo": {
-            "title": "El mismo conversor, el mismo instalador",
-            "body": "La opción <strong>Instalar una imagen que no está en el catálogo</strong> utiliza el conversor y el instalador de las plantillas del catálogo. La diferencia es que el contrato se genera en ese momento a partir de la definición aportada y se valida antes de crear ningún LXC."
+            "title": "El mismo conversor y el mismo instalador",
+            "body": "La opción <strong>Instalar una imagen que no esté en el catálogo</strong> utiliza el mismo conversor y el mismo instalador que las plantillas del catálogo. La diferencia es que el contrato se genera en ese momento a partir de la definición proporcionada y se valida antes de crear ningún LXC."
           }
         }
       ]
@@ -23,45 +23,92 @@
     {
       "id": "sources",
       "title": "Cómo se describe la imagen",
-      "intro": "La primera pantalla pregunta cómo se describe la imagen. Cuatro formas aportan una definición que se traduce, una quinta usa solo el nombre de la imagen y tres reciben un oci-compose ya escrito.",
+      "intro": "La primera pantalla pregunta cómo vas a describir la imagen. Cuatro opciones reciben una definición que se adapta, una quinta usa solo el nombre de la imagen y otras tres leen un oci-compose ya escrito.",
       "blocks": [
         {
           "table": {
-            "headers": ["Opción", "Qué lee"],
+            "headers": [
+              "Opción",
+              "Qué lee"
+            ],
             "rows": [
-              ["Pegar su archivo Compose en la terminal", "El YAML se pega en la terminal y termina con Ctrl+D."],
-              ["Leer su archivo Compose desde un archivo de este host", "Una ruta del nodo, <code>/root/docker-compose.yml</code> por defecto. El archivo debe existir y ocupar como máximo 256 KiB."],
-              ["Descargar su archivo Compose desde una dirección", "Una dirección <code>http://</code> o <code>https://</code> que sirva el YAML sin procesar. Se descargan como máximo 256 KiB."],
-              ["Pegar su comando docker run en la terminal", "El comando que publica el proyecto. Se traducen puertos, entorno, volúmenes, dispositivos, capacidades, usuario, memoria compartida y el resto de opciones admitidas."],
-              ["Solo la referencia de la imagen, sin archivo Compose", "Una referencia como <code>ghcr.io/user/application:latest</code>. Se consulta el registro y se conservan los metadatos OCI de la imagen."],
-              ["Pegar un oci-compose en la terminal", "El JSON se pega en la terminal y termina con Ctrl+D. No se traduce: se comprueba y se instala tal como está escrito."],
-              ["Leer un oci-compose desde un archivo de este host", "Un archivo JSON del nodo, <code>/root/oci-compose.json</code> por defecto, de 2 MiB como máximo."],
-              ["Descargar un oci-compose desde una dirección", "Una dirección <code>http://</code> o <code>https://</code> que sirva el archivo JSON. Se descargan como máximo 2 MiB."]
+              [
+                "Pegar su archivo Compose en la terminal",
+                "Pega el YAML en la terminal y termina con Ctrl+D."
+              ],
+              [
+                "Leer su archivo Compose desde este host",
+                "Una ruta del nodo; la predeterminada es <code>/root/docker-compose.yml</code>. El archivo debe existir y no superar los 256 KiB."
+              ],
+              [
+                "Descargar su archivo Compose desde una dirección",
+                "Una dirección <code>http://</code> o <code>https://</code> que sirva el YAML sin procesar. Se descargan como máximo 256 KiB."
+              ],
+              [
+                "Pegar su comando docker run en la terminal",
+                "El comando publicado por el proyecto. Se adaptan los puertos, el entorno, los volúmenes, los dispositivos, las capabilities, el usuario, la memoria compartida y las demás opciones compatibles."
+              ],
+              [
+                "Solo la referencia de imagen, sin archivo Compose",
+                "Una referencia como <code>ghcr.io/user/application:latest</code>. Se consulta el registro y se conservan los metadatos OCI de la imagen."
+              ],
+              [
+                "Pegar un oci-compose en la terminal",
+                "Pega el JSON en la terminal y termina con Ctrl+D. No se convierte: se valida y se instala tal como está escrito."
+              ],
+              [
+                "Leer un oci-compose desde este host",
+                "Un archivo JSON del nodo, <code>/root/oci-compose.json</code> por defecto, de un máximo de 2 MiB."
+              ],
+              [
+                "Descargar un oci-compose desde una dirección",
+                "Una dirección <code>http://</code> o <code>https://</code> que sirva el archivo JSON. Se descargan como máximo 2 MiB."
+              ]
             ]
           }
         },
         {
           "figure": {
             "src": "/oci-manager/custom-source-menu.png",
-            "alt": "Menú que pregunta cómo se describe una imagen que no está en el catálogo",
-            "caption": "Las formas de describir una imagen que no está en el catálogo."
+            "alt": "Menú para elegir cómo describir una imagen que no está en el catálogo",
+            "caption": "Formas de describir una imagen fuera del catálogo."
           }
         }
       ]
     },
     {
       "id": "reference-only",
-      "title": "Qué aporta solo la referencia de la imagen",
-      "intro": "Una imagen lleva sus metadatos de proceso, pero no todo lo que un archivo Compose suele añadir a su alrededor.",
+      "title": "Qué aporta una referencia de imagen por sí sola",
+      "intro": "La imagen contiene los metadatos de su proceso, pero no todo el entorno que suele añadir un archivo Compose.",
       "blocks": [
         {
           "table": {
-            "headers": ["Se lee de la imagen", "No está en la imagen", "Consecuencia"],
+            "headers": [
+              "Se lee de la imagen",
+              "No está en la imagen",
+              "Consecuencia"
+            ],
             "rows": [
-              ["<code>Entrypoint</code>, <code>Cmd</code>, <code>User</code>, <code>WorkingDir</code> y entorno integrado", "Variables que solo aparecen en la documentación", "Se añaden durante la instalación o con Modificar"],
-              ["Volúmenes declarados por la imagen", "Directorios del host que solo nombra un archivo Compose", "Las rutas adicionales se añaden antes de instalar"],
-              ["Puertos <code>EXPOSE</code>", "La URL, el protocolo o un healthcheck funcional", "Se confirman el puerto y la forma de comprobar el servicio"],
-              ["Arquitecturas y digest del registro", "Dispositivos, privilegios o dependencias externas", "Ninguno se activa sin una definición que lo pida"]
+              [
+                "<code>Entrypoint</code>, <code>Cmd</code>, <code>User</code>, <code>WorkingDir</code> y el entorno incorporado",
+                "Variables que solo figuran en la documentación",
+                "Se añaden durante la instalación o desde Modificar"
+              ],
+              [
+                "Volúmenes declarados por la imagen",
+                "Directorios del host que solo se indican en Compose",
+                "Las rutas adicionales se añaden antes de instalar"
+              ],
+              [
+                "Puertos <code>EXPOSE</code>",
+                "La URL, el protocolo o la comprobación funcional del servicio",
+                "Se confirman el puerto y la forma de comprobar el servicio"
+              ],
+              [
+                "Arquitecturas y digest del registro",
+                "Dispositivos, privilegios o dependencias externas",
+                "No se habilitan sin una definición que los solicite"
+              ]
             ]
           }
         }
@@ -69,29 +116,44 @@
     },
     {
       "id": "review",
-      "title": "Revisión antes de instalar",
-      "intro": "Tras traducir la definición, ProxMenux muestra lo que ha entendido antes de pedir VMID, recursos o almacenamiento.",
+      "title": "Revisar antes de instalar",
+      "intro": "Tras adaptar la definición, ProxMenux muestra cómo la ha interpretado antes de preguntar el VMID, los recursos o el almacenamiento.",
       "blocks": [
         {
           "steps": {
             "items": [
-              { "title": "Analizar", "body": "Se leen servicios, imagen, puertos, rutas, entorno, dispositivos, seguridad y healthcheck." },
-              { "title": "Consultar el registro", "body": "La imagen debe existir en su registro, y se enumeran las arquitecturas que publica. Un registro privado se lee con la cuenta guardada para él." },
-              { "title": "Enumerar lo que no se aplica", "body": "Se enumeran las etiquetas, las redes Docker, los ajustes de Swarm y el resto de claves que no tienen efecto en un LXC." },
-              { "title": "Bloquear lo que no puede traducirse", "body": "Una clave sin equivalencia segura aparece en <strong>Lo que no puede traducirse</strong> y la instalación no continúa. Nada se descarta en silencio." },
-              { "title": "Pedir los secretos", "body": "Las variables cuyo nombre corresponde a una contraseña, un token o una clave se convierten en preguntas sensibles de la instalación." }
+              {
+                "title": "Analizar",
+                "body": "Se leen servicios, imagen, puertos, rutas, entorno, dispositivos, seguridad y comprobaciones de estado."
+              },
+              {
+                "title": "Consultar el registro",
+                "body": "La imagen debe existir en el registro y se muestran las arquitecturas publicadas. Si el registro es privado, se utiliza la cuenta guardada para él."
+              },
+              {
+                "title": "Enumerar lo que no se aplica",
+                "body": "Se enumeran las etiquetas, redes de Docker, ajustes de Swarm y otras claves que no tienen efecto en un LXC."
+              },
+              {
+                "title": "Bloquear opciones sin equivalente seguro",
+                "body": "Las claves sin equivalente seguro aparecen en <strong>Opciones sin equivalente</strong> e impiden continuar con la instalación. No se descartan silenciosamente."
+              },
+              {
+                "title": "Solicitar secretos",
+                "body": "Las variables cuyo nombre indica una contraseña, token o clave se solicitan como datos sensibles durante la instalación."
+              }
             ]
           }
         },
         {
           "figure": {
             "src": "/oci-manager/custom-review.png",
-            "alt": "Resumen de lo que ProxMenux ha entendido de un archivo Compose",
-            "caption": "El resumen que se muestra antes de que la instalación pida VMID y recursos."
+            "alt": "Resumen de cómo ProxMenux ha interpretado el archivo Compose",
+            "caption": "Resumen mostrado antes de que el instalador pregunte el VMID y los recursos."
           }
         },
         {
-          "p": "Tras aceptar el resumen, el recorrido es el del catálogo: nombre, modo predeterminado o avanzado, VMID, CPU, memoria, red, arranque con el nodo, rutas persistentes, rutas adicionales, dispositivos compatibles y resumen final."
+          "p": "Tras aceptar el resumen se sigue el mismo asistente que en el catálogo: nombre, modo predeterminado o avanzado, VMID, CPU, memoria, red, arranque con el nodo, rutas persistentes, rutas adicionales, dispositivos compatibles y resumen final."
         }
       ]
     },
@@ -118,68 +180,79 @@
     {
       "id": "oci-compose",
       "title": "Un oci-compose escrito a mano",
-      "intro": "Un oci-compose es el archivo JSON desde el que se instala una aplicación. El catálogo guarda uno por cada aplicación, y el mismo formato puede escribirse a mano e instalarse con esta opción.",
+      "intro": "Un oci-compose es el archivo JSON a partir del cual se instala una aplicación. El catálogo conserva uno por aplicación. Puedes escribir el mismo formato a mano e instalarlo con esta opción.",
       "blocks": [
         {
-          "p": "El que se escribe a mano indica lo que decide su autor: la imagen, sus puertos, variables y volúmenes, y lo que pregunta la instalación. ProxMenux completa el resto al leer el archivo. Puede decir lo que un archivo Compose no puede: el texto de una pregunta, una contraseña generada durante la instalación, un perfil de GPU, el propietario de cada volumen, la comprobación del primer arranque o las credenciales que se muestran al terminar."
+          "p": "Al escribirlo a mano, el autor decide la imagen, los puertos, las variables, los volúmenes y las preguntas de la instalación. ProxMenux completa el resto al leer el archivo. Permite expresar lo que Compose no incluye: el texto de una pregunta, una contraseña generada durante la instalación, un perfil de GPU, el propietario de cada volumen, la comprobación del primer arranque o las credenciales mostradas al final."
         },
         {
           "steps": {
             "items": [
               {
                 "title": "Comprobar",
-                "body": "Un archivo con errores no se instala. Cada error indica el campo en el que está, y un archivo que no es JSON válido indica la línea y la columna."
+                "body": "Los archivos con errores no se instalan. Cada error indica el campo afectado; si el JSON no es válido, se muestran la línea y la columna."
               },
               {
                 "title": "Revisar",
-                "body": "Un archivo válido muestra lo que instala: imagen, dirección web, puertos, rutas persistentes, las variables que pide la instalación y los archivos que escribe."
+                "body": "Si el archivo es válido, se muestra lo que instalará: imagen, dirección web, puertos, rutas persistentes, variables que solicitará el instalador y archivos que escribirá."
               },
               {
                 "title": "Instalar",
-                "body": "La instalación es la de cualquier aplicación del catálogo, con ajustes por defecto o avanzados."
+                "body": "Se utiliza el mismo instalador que para cualquier aplicación del catálogo, con ajustes predeterminados o avanzados."
               }
             ]
           }
         },
         {
           "calloutWarning": {
-            "title": "Un archivo que decide privilegios",
-            "body": "Un oci-compose decide qué se monta en el contenedor y con qué privilegios. El resumen lo indica antes de instalar: instala solo archivos que vengan de una fuente de confianza."
+            "title": "Un archivo que decide los privilegios",
+            "body": "El oci-compose determina qué se monta dentro del contenedor y con qué privilegios. La revisión lo muestra antes de instalar: utiliza únicamente archivos de fuentes de confianza."
           }
         },
         {
-          "p": "El formato se describe bloque a bloque, con dos ejemplos completos, en el <readmeLink>README del motor OCI</readmeLink>. El registro de una instalación se lee de la misma forma: solo se usa la plantilla con la que se instaló, y ninguna de las respuestas de esa instalación."
+          "p": "El <readmeLink>README del motor OCI</readmeLink> explica el formato bloque a bloque e incluye dos ejemplos completos. También se puede leer el registro de una instalación: solo se utiliza la plantilla original, sin incorporar ninguna de las respuestas de aquella instalación."
         }
       ]
     },
     {
       "id": "private-registries",
-      "title": "Imágenes en registros privados",
-      "intro": "Una imagen en un registro privado, como un paquete privado de GitHub o un repositorio privado de Docker Hub, se lee con una cuenta guardada en ProxMenux.",
+      "title": "Imágenes de registros privados",
+      "intro": "Las imágenes de registros privados, como un paquete privado de GitHub o un repositorio privado de Docker Hub, se consultan con una cuenta guardada en ProxMenux.",
       "blocks": [
         {
           "steps": {
             "items": [
-              { "title": "El registro rechaza la imagen", "body": "Cuando el registro responde que la imagen necesita una cuenta, la revisión ofrece iniciar sesión en ese registro y vuelve a leer la imagen." },
-              { "title": "Iniciar sesión", "body": "Un usuario y una contraseña o un token de acceso que puedan descargar la imagen. El registro los comprueba y solo se guardan si los acepta." },
-              { "title": "Instalar y mantener al día", "body": "La instalación descarga la imagen con esa cuenta, y también las actualizaciones, Modificar, Recrear, la vigilancia y la comprobación de actualizaciones del Monitor, en cualquier nodo del clúster." }
+              {
+                "title": "El registro deniega el acceso a la imagen",
+                "body": "Si el registro indica que la imagen requiere una cuenta, la revisión ofrece iniciar sesión en ese registro y vuelve a consultar la imagen."
+              },
+              {
+                "title": "Iniciar sesión",
+                "body": "Un usuario y una contraseña o token con permiso para descargar la imagen. El registro los comprueba y solo se guardan si los acepta."
+              },
+              {
+                "title": "Instalar y mantener al día",
+                "body": "Esa cuenta se utiliza para descargar la imagen durante la instalación y también en las actualizaciones, Modificar, Recrear, la vigilancia y la comprobación de actualizaciones del Monitor, en cualquier nodo del clúster."
+              }
             ]
           }
         },
-        { "p": "<strong>Cuentas de registro</strong>, en el menú principal de OCI manager Apps, lista las cuentas guardadas por registro y usuario, nunca su secreto. Desde cada cuenta se puede comprobar, descargar o instalar una imagen, y actualizar o eliminar la cuenta." },
+        {
+          "p": "<strong>Cuentas de registros</strong>, en el menú principal de OCI manager Apps, muestra las cuentas guardadas por registro y usuario, nunca sus secretos. Desde cada cuenta puedes comprobar, descargar o instalar una imagen, actualizar las credenciales o eliminarlas."
+        },
         {
           "list": {
             "items": [
-              "GitHub (<code>ghcr.io</code>): el usuario es la cuenta de GitHub, y la contraseña un token de acceso personal con el permiso <code>read:packages</code>.",
-              "Docker Hub (<code>docker.io</code>): el usuario es la cuenta de Docker Hub, y la contraseña un token de acceso con permiso de lectura.",
-              "Otros registros, también uno con su propio puerto como <code>registry.example.com:5000</code>: el usuario y la contraseña o token que da ese registro."
+              "GitHub (<code>ghcr.io</code>): el usuario es la cuenta de GitHub y la contraseña es un token de acceso personal con permiso <code>read:packages</code>.",
+              "Docker Hub (<code>docker.io</code>): el usuario es la cuenta de Docker Hub y la contraseña es un token con permiso de lectura.",
+              "Otros registros, incluidos los que usan un puerto propio como <code>registry.example.com:5000</code>: el usuario y la contraseña o token que proporcione ese registro."
             ]
           }
         },
         {
           "calloutInfo": {
-            "title": "Dónde se guardan",
-            "body": "En <code>/etc/pve/priv/proxmenux/registry-auth.json</code>, legible solo por root, en la misma carpeta donde Proxmox guarda las contraseñas de sus almacenamientos. <code>/etc/pve</code> lo comparten todos los nodos del clúster, así que una cuenta añadida en un nodo se usa en todos. El backup del host lo incluye, y al desinstalar ProxMenux se elimina de todos los nodos."
+            "title": "Dónde se guardan las cuentas",
+            "body": "En <code>/etc/pve/priv/proxmenux/registry-auth.json</code>, accesible solo por root, en la misma carpeta donde Proxmox guarda las contraseñas de almacenamiento. <code>/etc/pve</code> se comparte entre los nodos del clúster, de modo que una cuenta añadida en un nodo se utiliza en todos. El backup del host incluye ese archivo y desinstalar ProxMenux lo elimina de todos los nodos."
           }
         }
       ]
@@ -191,11 +264,11 @@
         {
           "list": {
             "items": [
-              "Un Dockerfile sin imagen publicada: la imagen debe construirse y publicarse antes en un registro OCI.",
-              "Un archivo Compose con varios servicios: queda bloqueado porque describe más de una imagen. Esta opción instala un único contenedor.",
-              "<code>configs</code>, secretos externos o formatos de dispositivo que no pueden traducirse sin ambigüedad.",
-              "Sustituciones del shell como <code>$(command)</code>: debe escribirse el valor resultante.",
-              "Opciones de <code>docker run</code> no reconocidas y <code>--env-file</code>: se lee en su lugar un archivo Compose explícito."
+              "Un Dockerfile sin imagen publicada: primero hay que construir la imagen y publicarla en un registro OCI.",
+              "Un archivo Compose con varios servicios: se bloquea porque esta opción instala un único servicio por contenedor, aunque varios servicios utilicen la misma imagen.",
+              "<code>configs</code>, secretos externos o formatos de dispositivo que no puedan adaptarse de forma inequívoca.",
+              "Sustituciones de shell como <code>$(command)</code>: hay que escribir directamente el valor resultante.",
+              "Opciones de <code>docker run</code> no reconocidas y <code>--env-file</code>: utiliza un archivo Compose con los valores explícitos."
             ]
           }
         }
diff --git a/web/messages/es/docs/oci-manager/hardware.json b/web/messages/es/docs/oci-manager/hardware.json
index b4f24154..72239db9 100644
--- a/web/messages/es/docs/oci-manager/hardware.json
+++ b/web/messages/es/docs/oci-manager/hardware.json
@@ -19,9 +19,18 @@
         {
           "flow": {
             "nodes": [
-              { "label": "Inventario del host", "detail": "/dev/dri/renderD128\nGID 993 · Intel" },
-              { "label": "ProxMenux", "detail": "fabricante y\npermisos comprobados" },
-              { "label": "LXC", "detail": "mismo dispositivo\nGID efectivo" }
+              {
+                "label": "Inventario del host",
+                "detail": "/dev/dri/renderD128\nGID 993 · Intel"
+              },
+              {
+                "label": "ProxMenux",
+                "detail": "fabricante y\npermisos comprobados"
+              },
+              {
+                "label": "LXC",
+                "detail": "mismo dispositivo\nGID efectivo"
+              }
             ]
           }
         }
@@ -33,12 +42,32 @@
       "blocks": [
         {
           "table": {
-            "headers": ["Origen", "Qué se lee", "Qué hace el instalador"],
+            "headers": [
+              "Origen",
+              "Qué se lee",
+              "Qué hace el instalador"
+            ],
             "rows": [
-              ["Docker Compose", "<code>devices</code>, <code>group_add</code>, <code>deploy.resources</code> y peticiones NVIDIA", "Cada requisito se convierte en una petición de dispositivo que se muestra para revisión"],
-              ["Perfil del catálogo", "El soporte de GPU, Coral, OpenCL, USB o FUSE que tiene realmente la aplicación", "Solo se ofrecen las opciones validadas para esa imagen"],
-              ["Metadatos y documentación de la imagen", "VA-API, Selkies, mods de LinuxServer o el runtime NVIDIA", "Se añaden las variables y la preparación documentadas"],
-              ["Selección del usuario", "Solo CPU, Intel/AMD, OpenCL, NVIDIA o un dispositivo opcional", "La selección se guarda en el contrato de la instancia"]
+              [
+                "Docker Compose",
+                "<code>devices</code>, <code>group_add</code>, <code>deploy.resources</code> y peticiones NVIDIA",
+                "Cada requisito se convierte en una petición de dispositivo que se muestra para revisión"
+              ],
+              [
+                "Perfil del catálogo",
+                "El soporte de GPU, Coral, OpenCL, USB o FUSE que tiene realmente la aplicación",
+                "Solo se ofrecen las opciones validadas para esa imagen"
+              ],
+              [
+                "Metadatos y documentación de la imagen",
+                "VA-API, Selkies, mods de LinuxServer o el runtime NVIDIA",
+                "Se añaden las variables y la preparación documentadas"
+              ],
+              [
+                "Selección del usuario",
+                "Solo CPU, Intel/AMD, OpenCL, NVIDIA o un dispositivo opcional",
+                "La selección se guarda en el contrato de la instancia"
+              ]
             ]
           }
         },
@@ -57,16 +86,52 @@
       "blocks": [
         {
           "table": {
-            "headers": ["Tipo", "Identificación", "Validación"],
+            "headers": [
+              "Tipo",
+              "Identificación",
+              "Validación"
+            ],
             "rows": [
-              ["Intel/AMD DRM", "<code>/dev/dri/renderD*</code> y <code>/sys/class/drm/NODO/device/vendor</code>", "Un dispositivo de caracteres con fabricante <code>0x8086</code> (Intel) o <code>0x1002</code> (AMD)"],
-              ["OpenCL AMD", "El render node, más <code>/dev/kfd</code> cuando el perfil lo necesita", "Existencia, tipo, fabricante, permisos y compatibilidad declarada"],
-              ["AMD ROCm", "El nodo de render, <code>/dev/kfd</code> y la generación que declara el driver de cómputo en <code>/sys/class/kfd/kfd/topology/nodes/*/properties</code>", "Una generación para la que la imagen ROCm de la aplicación trae kernels, las GPU RDNA2 que incluye y las posteriores, se ofrece tal cual. Las demás GPU de esas familias, como las Radeon 680M y 780M, se ofrecen como experimentales y nunca son la opción propuesta: ROCm no las soporta oficialmente, la aplicación las presenta como la generación de su familia (<code>HSA_OVERRIDE_GFX_VERSION</code>) y el instalador pide confirmación antes de descargar la imagen, que es más grande. Una GPU anterior, como los gráficos integrados de un Ryzen 5000U, no se ofrece e Immich deja el reconocimiento en la CPU"],
-              ["NVIDIA", "<code>nvidia-smi</code> y <code>nvidia-container-cli</code>", "GPU, UUID, bus PCI, versión del driver, Toolkit, nodos <code>/dev/nvidia*</code>, binarios y librerías"],
-              ["Coral PCIe/M.2", "<code>/dev/apex_N</code> y su enlace en <code>/sys/dev/char/MAJOR:MINOR</code>", "Nodo de caracteres, major/minor, propietario, GID y permisos"],
-              ["USB y serie", "<code>/dev/ttyUSB*</code>, <code>/dev/ttyACM*</code> o <code>/dev/bus/usb/BBB/DDD</code>", "Nodo de caracteres; en USB también fabricante, producto y número de serie cuando sysfs los publica"],
-              ["KVM, TUN, FUSE, vídeo y SCSI genérico", "<code>/dev/kvm</code>, <code>/dev/net/tun</code>, <code>/dev/fuse</code>, <code>/dev/videoN</code> o <code>/dev/sgN</code>", "Ruta admitida, tipo de nodo y permisos efectivos"],
-              ["Unidad óptica", "<code>/dev/srN</code>", "Un dispositivo de bloques"]
+              [
+                "Intel/AMD DRM",
+                "<code>/dev/dri/renderD*</code> y <code>/sys/class/drm/NODE/device/vendor</code>",
+                "Un dispositivo de caracteres con fabricante <code>0x8086</code> (Intel) o <code>0x1002</code> (AMD)"
+              ],
+              [
+                "OpenCL AMD",
+                "El render node, más <code>/dev/kfd</code> cuando el perfil lo necesita",
+                "Existencia, tipo, fabricante, permisos y compatibilidad declarada"
+              ],
+              [
+                "AMD ROCm",
+                "El nodo de render, <code>/dev/kfd</code> y la generación que declara el driver de cómputo en <code>/sys/class/kfd/kfd/topology/nodes/*/properties</code>",
+                "Una generación para la que la imagen ROCm de la aplicación trae kernels, las GPU RDNA2 que incluye y las posteriores, se ofrece tal cual. Las demás GPU de esas familias, como las Radeon 680M y 780M, se ofrecen como experimentales y nunca son la opción propuesta: ROCm no las soporta oficialmente, la aplicación las presenta como la generación de su familia (<code>HSA_OVERRIDE_GFX_VERSION</code>) y el instalador pide confirmación antes de descargar la imagen, que es más grande. Una GPU anterior, como los gráficos integrados de un Ryzen 5000U, no se ofrece e Immich deja el reconocimiento en la CPU"
+              ],
+              [
+                "NVIDIA",
+                "<code>nvidia-smi</code> y <code>nvidia-container-cli</code>",
+                "GPU, UUID, bus PCI, versión del driver, Toolkit, nodos <code>/dev/nvidia*</code>, binarios y librerías"
+              ],
+              [
+                "Coral PCIe/M.2",
+                "<code>/dev/apex_N</code> y su enlace en <code>/sys/dev/char/MAJOR:MINOR</code>",
+                "Nodo de caracteres, major/minor, propietario, GID y permisos"
+              ],
+              [
+                "USB y serie",
+                "<code>/dev/ttyUSB*</code>, <code>/dev/ttyACM*</code> o <code>/dev/bus/usb/BBB/DDD</code>",
+                "Nodo de caracteres; en USB también fabricante, producto y número de serie cuando sysfs los publica"
+              ],
+              [
+                "KVM, TUN, FUSE, vídeo y SCSI genérico",
+                "<code>/dev/kvm</code>, <code>/dev/net/tun</code>, <code>/dev/fuse</code>, <code>/dev/videoN</code> o <code>/dev/sgN</code>",
+                "Ruta admitida, tipo de nodo y permisos efectivos"
+              ],
+              [
+                "Unidad óptica",
+                "<code>/dev/srN</code>",
+                "Un dispositivo de bloques"
+              ]
             ]
           }
         }
@@ -79,12 +144,30 @@
         {
           "steps": {
             "items": [
-              { "title": "La plantilla ofrece sus perfiles", "body": "Por ejemplo solo CPU, Intel/AMD VA-API, OpenCL AMD, OpenCL Intel o NVIDIA. Las opciones pertenecen a la imagen, no a un menú común." },
-              { "title": "Se elige un perfil", "body": "Define los nodos de dispositivo, el entorno, los mods o el runtime que necesita la aplicación." },
-              { "title": "Se propone una ruta", "body": "Para DRM, <code>/dev/dri/renderD128</code>, que puede cambiarse en un host con varios render nodes. Para USB o serie se selecciona el nodo concreto." },
-              { "title": "Validación", "body": "Se comprueban existencia, tipo, fabricante admitido, permisos y GID. Una discrepancia detiene la operación." },
-              { "title": "Se escribe el contrato", "body": "Ruta, modo, GID, acceso de escritura y perfil quedan registrados para las actualizaciones y las recreaciones." },
-              { "title": "Conexión y prueba", "body": "<code>pct set</code> añade la entrada <code>devN</code> y después se comprueba el acceso dentro del LXC. Las imágenes de LinuxServer se comprueban también como usuario <code>abc</code>." }
+              {
+                "title": "La plantilla ofrece sus perfiles",
+                "body": "Por ejemplo solo CPU, Intel/AMD VA-API, OpenCL AMD, OpenCL Intel o NVIDIA. Las opciones pertenecen a la imagen, no a un menú común."
+              },
+              {
+                "title": "Se elige un perfil",
+                "body": "Define los nodos de dispositivo, el entorno, los mods o el runtime que necesita la aplicación."
+              },
+              {
+                "title": "Se propone una ruta",
+                "body": "Para DRM, <code>/dev/dri/renderD128</code>, que puede cambiarse en un host con varios render nodes. Para USB o serie se selecciona el nodo concreto."
+              },
+              {
+                "title": "Validación",
+                "body": "Se comprueban existencia, tipo, fabricante admitido, permisos y GID. Una discrepancia detiene la operación."
+              },
+              {
+                "title": "Se escribe el contrato",
+                "body": "Ruta, modo, GID, acceso de escritura y perfil quedan registrados para las actualizaciones y las recreaciones."
+              },
+              {
+                "title": "Conexión y prueba",
+                "body": "<code>pct set</code> añade la entrada <code>devN</code> y después se comprueba el acceso dentro del LXC. Las imágenes de LinuxServer se comprueban también como usuario <code>abc</code>."
+              }
             ]
           }
         }
@@ -98,10 +181,22 @@
         {
           "codeGrid": {
             "items": [
-              { "title": "Intel/AMD VA-API", "code": "dev0: path=/dev/dri/renderD128,mode=0660,gid=993,deny-write=0" },
-              { "title": "Coral PCIe/M.2", "code": "dev0: path=/dev/apex_0,mode=0660,gid=GID,deny-write=0" },
-              { "title": "Un dispositivo USB concreto", "code": "dev0: path=/dev/bus/usb/003/004,mode=0660,gid=GID,deny-write=0" },
-              { "title": "OpenCL AMD", "code": "dev0: path=/dev/dri/renderD128,mode=0660,gid=GID,deny-write=0\ndev1: path=/dev/kfd,mode=0660,gid=GID,deny-write=0" }
+              {
+                "title": "Intel/AMD VA-API",
+                "code": "dev0: path=/dev/dri/renderD128,mode=0660,gid=993,deny-write=0"
+              },
+              {
+                "title": "Coral PCIe/M.2",
+                "code": "dev0: path=/dev/apex_0,mode=0660,gid=GID,deny-write=0"
+              },
+              {
+                "title": "Un dispositivo USB concreto",
+                "code": "dev0: path=/dev/bus/usb/003/004,mode=0660,gid=GID,deny-write=0"
+              },
+              {
+                "title": "OpenCL AMD",
+                "code": "dev0: path=/dev/dri/renderD128,mode=0660,gid=GID,deny-write=0\ndev1: path=/dev/kfd,mode=0660,gid=GID,deny-write=0"
+              }
             ]
           }
         },
@@ -116,13 +211,37 @@
       "blocks": [
         {
           "table": {
-            "headers": ["Perfil", "Traducción", "Se ofrece cuando"],
+            "headers": [
+              "Perfil",
+              "Configuración resultante",
+              "Se ofrece cuando"
+            ],
             "rows": [
-              ["Intel/AMD VA-API", "Render node de <code>/dev/dri</code>", "La aplicación admite aceleración de vídeo"],
-              ["OpenCL", "Render node, <code>/dev/kfd</code> si hace falta y el mod oficial", "La imagen o el perfil lo documentan"],
-              ["NVIDIA", "Dispositivos y librerías del driver del host", "El host tiene un driver operativo y NVIDIA Container Toolkit"],
-              ["Coral", "<code>/dev/apex_0</code> o el bus USB", "El perfil declara soporte de Coral (Frigate)"],
-              ["USB, serie, FUSE", "Un dispositivo concreto, un árbol validado o una función LXC", "El contrato lo pide"]
+              [
+                "Intel/AMD VA-API",
+                "Render node de <code>/dev/dri</code>",
+                "La aplicación admite aceleración de vídeo"
+              ],
+              [
+                "OpenCL",
+                "Render node, <code>/dev/kfd</code> si hace falta y el mod oficial",
+                "La imagen o el perfil lo documentan"
+              ],
+              [
+                "NVIDIA",
+                "Dispositivos y librerías del driver del host",
+                "El host tiene un driver operativo y NVIDIA Container Toolkit"
+              ],
+              [
+                "Coral",
+                "<code>/dev/apex_0</code> o el bus USB",
+                "El perfil declara soporte de Coral (Frigate)"
+              ],
+              [
+                "USB, serie, FUSE",
+                "Un dispositivo concreto, un árbol validado o una función LXC",
+                "El contrato lo pide"
+              ]
             ]
           }
         }
@@ -145,7 +264,9 @@
           "p": "Estos dos comandos, en el host, muestran si el driver y el Toolkit están disponibles:"
         },
         {
-          "shell": { "code": "nvidia-smi -L\nnvidia-container-cli --version" }
+          "shell": {
+            "code": "nvidia-smi -L\nnvidia-container-cli --version"
+          }
         },
         {
           "p": "En un host cuyo driver se instaló por otros medios, el Toolkit se instala desde el repositorio estable oficial:"
@@ -159,7 +280,9 @@
           "p": "El inventario que usa OCI manager Apps es la salida de:"
         },
         {
-          "shell": { "code": "nvidia-container-cli list --device all --libraries --binaries --firmwares --ipcs" }
+          "shell": {
+            "code": "nvidia-container-cli list --device all --libraries --binaries --firmwares --ipcs"
+          }
         },
         {
           "calloutInfo": {
@@ -170,10 +293,26 @@
         {
           "cards": {
             "items": [
-              { "icon": "cpu", "title": "Inventario desde el driver", "body": "<code>nvidia-container-cli</code> enumera los nodos de dispositivo, los binarios, el firmware y las librerías del driver instalado." },
-              { "icon": "refresh", "title": "Sin versión fija", "body": "La plantilla no nombra archivos de librería. El perfil se genera a partir del host actual." },
-              { "icon": "shield", "title": "Montajes de solo lectura", "body": "Las librerías del host se montan en solo lectura en lugar de copiarse dentro del contenedor." },
-              { "icon": "hardDrive", "title": "Cambios de driver", "body": "Tras un cambio de driver, el inventario se genera de nuevo antes de que arranquen los LXC afectados." }
+              {
+                "icon": "cpu",
+                "title": "Inventario desde el driver",
+                "body": "<code>nvidia-container-cli</code> enumera los nodos de dispositivo, los binarios, el firmware y las librerías del driver instalado."
+              },
+              {
+                "icon": "refresh",
+                "title": "Sin versión fija",
+                "body": "La plantilla no nombra archivos de librería. El perfil se genera a partir del host actual."
+              },
+              {
+                "icon": "shield",
+                "title": "Montajes de solo lectura",
+                "body": "Las librerías del host se montan en solo lectura en lugar de copiarse dentro del contenedor."
+              },
+              {
+                "icon": "hardDrive",
+                "title": "Cambios de driver",
+                "body": "Tras un cambio de driver, el inventario se genera de nuevo antes de que arranquen los LXC afectados."
+              }
             ]
           }
         },
@@ -209,12 +348,32 @@
       "blocks": [
         {
           "table": {
-            "headers": ["Petición", "Traducción", "Alcance"],
+            "headers": [
+              "Petición",
+              "Configuración resultante",
+              "Alcance"
+            ],
             "rows": [
-              ["<code>/dev/dvb</code>, <code>/dev/snd</code> o <code>/dev/bus/usb</code>", "Cada nodo de caracteres del árbol recibe su propia entrada <code>devN</code> con el modo y el GID del host", "Solo el árbol pedido, no el resto de <code>/dev</code>"],
-              ["<code>/dev/fuse</code>", "El nodo y, cuando el perfil lo necesita, la función <code>fuse=1</code>", "FUSE por sí solo no publica montajes a otros LXC"],
-              ["<code>/dev/net/tun</code>", "Una entrada <code>devN</code> en la misma ruta dentro del LXC", "La configuración de la VPN o de la red queda en la aplicación"],
-              ["<code>/dev/kvm</code>", "Una entrada <code>devN</code> validada", "Solo se ofrece cuando el contrato lo pide"]
+              [
+                "<code>/dev/dvb</code>, <code>/dev/snd</code> o <code>/dev/bus/usb</code>",
+                "Cada nodo de caracteres del árbol recibe su propia entrada <code>devN</code> con el modo y el GID del host",
+                "Solo el árbol pedido, no el resto de <code>/dev</code>"
+              ],
+              [
+                "<code>/dev/fuse</code>",
+                "El nodo y, cuando el perfil lo necesita, la función <code>fuse=1</code>",
+                "FUSE por sí solo no publica montajes a otros LXC"
+              ],
+              [
+                "<code>/dev/net/tun</code>",
+                "Una entrada <code>devN</code> en la misma ruta dentro del LXC",
+                "La configuración de la VPN o de la red queda en la aplicación"
+              ],
+              [
+                "<code>/dev/kvm</code>",
+                "Una entrada <code>devN</code> validada",
+                "Solo se ofrece cuando el contrato lo pide"
+              ]
             ]
           }
         }
diff --git a/web/messages/es/docs/oci-manager/index.json b/web/messages/es/docs/oci-manager/index.json
index 5f548dbf..635b395f 100644
--- a/web/messages/es/docs/oci-manager/index.json
+++ b/web/messages/es/docs/oci-manager/index.json
@@ -1,11 +1,11 @@
 {
   "meta": {
     "title": "OCI manager Apps | ProxMenux",
-    "description": "Imágenes OCI oficiales ejecutadas como contenedores LXC nativos de Proxmox VE, con datos persistentes, dispositivos, aplicaciones multicontenedor y actualizaciones transaccionales."
+    "description": "Ejecuta imágenes OCI oficiales como contenedores LXC nativos de Proxmox VE, con datos persistentes, acceso a dispositivos, aplicaciones con varios contenedores y actualizaciones transaccionales."
   },
   "header": {
     "title": "OCI manager Apps",
-    "description": "Las imágenes OCI oficiales se ejecutan como contenedores LXC nativos de Proxmox VE. La imagen sigue siendo la que publica su responsable; ProxMenux reproduce el entorno que Docker Compose habría creado a su alrededor.",
+    "description": "Las imágenes OCI oficiales se ejecutan como contenedores LXC nativos de Proxmox VE. Se utiliza la misma imagen que publica su desarrollador; ProxMenux reproduce el entorno que Docker Compose habría creado a su alrededor.",
     "section": "OCI manager Apps"
   },
   "sections": [
@@ -15,34 +15,43 @@
         {
           "calloutInfo": {
             "title": "Una imagen OCI, un LXC nativo",
-            "body": "Dentro de los contenedores no se ejecuta ningún motor Docker. Proxmox VE importa el sistema de archivos de la imagen y sus metadatos OCI, y la aplicación pasa a ser el proceso principal de un LXC nativo, gestionado con las mismas herramientas que cualquier otro contenedor del nodo."
+            "body": "No se ejecuta Docker Engine dentro de los contenedores. Proxmox VE importa el sistema de archivos de la imagen y sus metadatos OCI; la aplicación pasa a ser el proceso principal de un LXC nativo, administrado con las mismas herramientas que cualquier otro contenedor del nodo."
           }
         },
         {
           "flow": {
             "nodes": [
-              { "label": "Origen", "detail": "Imagen OCI\nCompose y documentación" },
-              { "label": "ProxMenux", "detail": "Contrato JSON\nvalidación y plan" },
-              { "label": "Proxmox VE", "detail": "LXC nativo\nvolúmenes y dispositivos" }
+              {
+                "label": "Origen",
+                "detail": "Imagen OCI\nCompose y documentación"
+              },
+              {
+                "label": "ProxMenux",
+                "detail": "Contrato JSON\nvalidación y planificación"
+              },
+              {
+                "label": "Proxmox VE",
+                "detail": "LXC nativo\nvolúmenes y dispositivos"
+              }
             ],
-            "caption": "La aplicación no se reconstruye: su entorno se reproduce de forma declarativa."
+            "caption": "Se utiliza la aplicación original; su entorno se define de forma declarativa y se reproduce."
           }
         }
       ]
     },
     {
       "id": "where",
-      "title": "Dónde se encuentra",
-      "intro": "OCI manager Apps se abre desde la opción <strong>OCI manager Apps (Technology Preview)</strong> del menú principal de ProxMenux, en el nodo Proxmox y como root. Su primera pantalla ofrece:",
+      "title": "Dónde encontrarlo",
+      "intro": "OCI manager Apps se abre desde la opción <strong>OCI manager Apps (Technology Preview)</strong> del menú principal de ProxMenux, en el nodo Proxmox y como root. La primera pantalla ofrece:",
       "blocks": [
         {
           "list": {
             "items": [
-              "<strong>Buscar aplicaciones</strong>: búsqueda por nombre en todo el catálogo.",
-              "<strong>Todas las aplicaciones</strong>: el catálogo completo, con el número de aplicaciones.",
-              "<strong>Gestionar aplicaciones OCI instaladas</strong>: actualizar, modificar, eliminar o recuperar lo instalado.",
-              "<strong>Cuentas de registro</strong>: las cuentas con las que se instalan y actualizan imágenes de registros privados.",
-              "<strong>Instalar una imagen que no está en el catálogo</strong>: traducción de un archivo Compose, un comando <code>docker run</code> o una referencia de imagen.",
+              "<strong>Buscar aplicaciones</strong>: busca por nombre en todo el catálogo.",
+              "<strong>Todas las aplicaciones</strong>: muestra el catálogo completo y su número de aplicaciones.",
+              "<strong>Gestionar aplicaciones OCI instaladas</strong>: actualiza, modifica, elimina o recupera las aplicaciones que ya has instalado.",
+              "<strong>Cuentas de registros</strong>: administra las cuentas utilizadas para instalar y actualizar imágenes de registros privados.",
+              "<strong>Instalar una imagen que no esté en el catálogo</strong>: adapta un archivo Compose, un comando <code>docker run</code> o una referencia de imagen.",
               "Las categorías del catálogo, cada una con su número de aplicaciones."
             ]
           }
@@ -50,40 +59,72 @@
         {
           "figure": {
             "src": "/oci-manager/main-menu.png",
-            "alt": "Pantalla principal de OCI manager Apps con la búsqueda, todas las aplicaciones, la gestión, la imagen propia y las categorías del catálogo",
+            "alt": "Pantalla principal de OCI manager Apps con búsqueda, listado completo, gestión de aplicaciones, imágenes fuera del catálogo y categorías.",
             "caption": "Pantalla principal de OCI manager Apps."
           }
         },
         {
-          "p": "Al seleccionar una aplicación se muestra su descripción, la imagen que ejecuta y dos modos de instalación: <strong>Instalar con la configuración predeterminada</strong>, que pregunta solo lo que decide toda instalación (almacenamiento, dónde van los datos, dirección e inicio), e <strong>Instalar con la configuración avanzada</strong>, que abre cada decisión en orden: VMID y recursos, el almacenamiento de cada ruta, el bridge y los dispositivos."
+          "p": "Al seleccionar una aplicación se muestran su descripción, la imagen que utiliza y dos modos de instalación. <strong>Instalar con ajustes predeterminados</strong> solo pregunta lo esencial de cada instalación: almacenamiento, ubicación de los datos, dirección y arranque. <strong>Instalar con ajustes avanzados</strong> recorre todas las decisiones en orden: VMID y recursos, almacenamiento de cada ruta, puente de red y dispositivos."
         },
         {
-          "p": "Una aplicación probada en real muestra <strong>Verificado</strong> en esa vista y aparece marcada con ✓ en las listas, tanto si se probó en el laboratorio de ProxMenux como si la probó la comunidad."
+          "p": "Las aplicaciones que se han probado realmente muestran <strong>Verificado</strong> en esa vista y una marca ✓ en las listas, tanto si la prueba se hizo en el laboratorio de ProxMenux como si la realizó la comunidad."
         }
       ]
     },
     {
       "id": "beta",
-      "title": "Por qué es una Technology Preview",
+      "title": "Por qué lleva la etiqueta Technology Preview",
       "blocks": [
-        { "p": "OCI manager Apps lleva la etiqueta <strong>Technology Preview</strong> que Proxmox VE da a los contenedores de aplicación creados a partir de imágenes OCI, introducidos en Proxmox VE 9.1. Se refiere a aquello sobre lo que funciona OCI manager Apps, no al motor de ProxMenux: el comportamiento de esos contenedores todavía puede cambiar entre versiones de Proxmox VE. La etiqueta se mantiene hasta que Proxmox VE dé ese soporte por estable." },
-        { "p": "El motor de OCI manager Apps (instalación, actualización, modificación, recreación, backups, restauración, migración y vigilancia) está probado en el laboratorio de ProxMenux. Cada aplicación se prueba por separado: las que se han probado de verdad muestran <strong>Verified</strong> y llevan una ✓ en las listas." }
+        {
+          "p": "OCI manager Apps mantiene la etiqueta <strong>Technology Preview</strong> que Proxmox VE asigna a los contenedores de aplicaciones creados a partir de imágenes OCI, cuyo soporte se introdujo en Proxmox VE 9.1. La etiqueta se refiere a la tecnología sobre la que funciona OCI manager Apps, no al motor de ProxMenux: el comportamiento de estos contenedores puede cambiar entre versiones de Proxmox VE. Se mantendrá hasta que Proxmox VE considere estable ese soporte."
+        },
+        {
+          "p": "El motor de OCI manager Apps se prueba en el laboratorio de ProxMenux: instalación, actualización, modificación, recreación, backups, restauración, migración y vigilancia. Cada aplicación se verifica por separado. Las que se han probado realmente muestran <strong>Verificado</strong> y llevan un ✓ en las listas."
+        }
       ]
     },
     {
       "id": "translation",
-      "title": "Lo que Docker expresa y en qué lo convierte OCI manager Apps",
+      "title": "Cómo describe Docker los requisitos y cómo los aplica OCI manager Apps",
       "blocks": [
         {
           "table": {
-            "headers": ["Necesidad", "Docker la expresa como", "OCI manager Apps la convierte en"],
+            "headers": [
+              "Requisito",
+              "Cómo lo expresa Docker",
+              "Cómo lo aplica OCI manager Apps"
+            ],
             "rows": [
-              ["Ejecutar la aplicación", "<code>image</code>, <code>entrypoint</code>, <code>command</code>", "rootfs OCI y proceso principal del LXC"],
-              ["Conservar la configuración", "<code>volumes: /config</code>", "un disco <code>mpN</code> persistente incluido en el backup, o un directorio del host"],
-              ["Publicar el servicio", "<code>ports</code>", "una dirección propia del LXC y la URL de acceso al servicio"],
-              ["Usar hardware", "<code>devices</code>, <code>group_add</code>", "entradas <code>devN</code> con el GID efectivo del host y un perfil validado"],
-              ["Conectar dependencias", "<code>networks</code>, <code>depends_on</code>", "un bridge privado, direcciones fijas, orden de arranque y healthchecks"],
-              ["Actualizar", "<code>pull</code> y recrear", "un rootfs nuevo con el mismo contrato persistente"]
+              [
+                "Ejecutar la aplicación",
+                "<code>image</code>, <code>entrypoint</code>, <code>command</code>",
+                "El rootfs de la imagen OCI y el proceso principal del LXC"
+              ],
+              [
+                "Conservar la configuración",
+                "<code>volumes: /config</code>",
+                "Un volumen persistente <code>mpN</code> incluido en el backup, o bien un directorio del host."
+              ],
+              [
+                "Publicar el servicio",
+                "<code>ports</code>",
+                "Una dirección propia para el LXC y la URL de acceso al servicio."
+              ],
+              [
+                "Usar hardware",
+                "<code>devices</code>, <code>group_add</code>",
+                "Entradas <code>devN</code> con el GID efectivo del host y un perfil validado."
+              ],
+              [
+                "Conectar las dependencias",
+                "<code>networks</code>, <code>depends_on</code>",
+                "Un puente de red privado, direcciones fijas, orden de arranque y comprobaciones de estado."
+              ],
+              [
+                "Actualizar",
+                "Descargar con <code>pull</code> y recrear",
+                "Un rootfs nuevo que mantiene el mismo contrato de persistencia."
+              ]
             ]
           }
         }
@@ -91,15 +132,31 @@
     },
     {
       "id": "kept",
-      "title": "Qué se mantiene y qué cambia",
+      "title": "Qué se conserva y qué cambia",
       "blocks": [
         {
           "cards": {
             "items": [
-              { "icon": "archive", "title": "Se mantiene", "body": "La imagen oficial, sus rutas internas, su entorno, su proceso de arranque y su documentación funcional." },
-              { "icon": "boxes", "title": "Se adapta", "body": "El entorno de ejecución: red, persistencia, dispositivos, permisos y dependencias usan primitivas LXC nativas de Proxmox VE." },
-              { "icon": "shield", "title": "No se traduce", "body": "Una clave de Compose sin equivalencia segura figura como bloqueo. Las plantillas con bloqueos no se ofrecen, y las opciones sensibles se confirman durante la instalación." },
-              { "icon": "refresh", "title": "Se registra", "body": "Digest de la imagen, recursos, rutas, red, dispositivos y pertenencia a una pila quedan en el contrato de la instancia, que las actualizaciones y las recreaciones reproducen." }
+              {
+                "icon": "archive",
+                "title": "Se conserva",
+                "body": "La imagen oficial, sus rutas internas, su entorno, su proceso de arranque y su documentación de uso."
+              },
+              {
+                "icon": "boxes",
+                "title": "Se adapta",
+                "body": "El entorno de ejecución: la red, la persistencia, los dispositivos, los permisos y las dependencias utilizan los mecanismos nativos de LXC de Proxmox VE."
+              },
+              {
+                "icon": "shield",
+                "title": "Sin equivalente",
+                "body": "Una opción de Compose sin una equivalencia segura se registra como un impedimento para la instalación. Las plantillas con impedimentos no se ofrecen para instalar, y las opciones sensibles requieren confirmación durante el asistente."
+              },
+              {
+                "icon": "refresh",
+                "title": "Se registra",
+                "body": "El digest de la imagen, los recursos, las rutas, la red, los dispositivos y la pertenencia a una pila se guardan en el contrato de la instancia. Las actualizaciones y recreaciones reproducen ese contrato."
+              }
             ]
           }
         }
@@ -112,13 +169,41 @@
         {
           "next": {
             "items": [
-              { "label": "Cómo se traduce una imagen OCI", "href": "/docs/oci-manager/architecture", "tail": "de la imagen y su archivo Compose a un LXC nativo." },
-              { "label": "Instalar una imagen que no está en el catálogo", "href": "/docs/oci-manager/custom-image", "tail": "Compose, docker run o una referencia de imagen." },
-              { "label": "Datos, rutas y red", "href": "/docs/oci-manager/storage-network", "tail": "discos del contenedor, directorios del host, montajes Rclone y direcciones." },
-              { "label": "Dispositivos y aceleración", "href": "/docs/oci-manager/hardware", "tail": "GPU, NVIDIA, Coral, USB y otros dispositivos." },
-              { "label": "Aplicaciones multicontenedor", "href": "/docs/oci-manager/stacks", "tail": "aplicación, base de datos y caché como LXC coordinados." },
-              { "label": "Instalar, actualizar y modificar", "href": "/docs/oci-manager/lifecycle", "tail": "el contrato de la instancia y sus operaciones." },
-              { "label": "En ProxMenux Monitor", "href": "/docs/oci-manager/monitor", "tail": "versiones, actualizaciones, salida de consola y terminal." }
+              {
+                "label": "Cómo se adapta una imagen OCI",
+                "href": "/docs/oci-manager/architecture",
+                "tail": "De la imagen y su archivo Compose a un LXC nativo."
+              },
+              {
+                "label": "Instalar una imagen que no esté en el catálogo",
+                "href": "/docs/oci-manager/custom-image",
+                "tail": "Un archivo Compose, un comando docker run o una referencia de imagen."
+              },
+              {
+                "label": "Datos, rutas y red",
+                "href": "/docs/oci-manager/storage-network",
+                "tail": "Volúmenes del contenedor, directorios del host, montajes con rclone y direcciones."
+              },
+              {
+                "label": "Dispositivos y aceleración",
+                "href": "/docs/oci-manager/hardware",
+                "tail": "GPU, NVIDIA, Coral, USB y otros dispositivos."
+              },
+              {
+                "label": "Aplicaciones con varios contenedores",
+                "href": "/docs/oci-manager/stacks",
+                "tail": "Aplicación, base de datos y caché en varios LXC coordinados."
+              },
+              {
+                "label": "Instalar, actualizar y modificar",
+                "href": "/docs/oci-manager/lifecycle",
+                "tail": "El contrato de la instancia y sus operaciones."
+              },
+              {
+                "label": "En ProxMenux Monitor",
+                "href": "/docs/oci-manager/monitor",
+                "tail": "Versiones, actualizaciones, salida de consola y terminal."
+              }
             ]
           }
         }
diff --git a/web/messages/es/docs/oci-manager/lifecycle.json b/web/messages/es/docs/oci-manager/lifecycle.json
index a722935a..0649c11e 100644
--- a/web/messages/es/docs/oci-manager/lifecycle.json
+++ b/web/messages/es/docs/oci-manager/lifecycle.json
@@ -18,7 +18,7 @@
         },
         {
           "code": {
-            "code": "instances/\n└── 105/\n    └── oci-compose.json\n        ├── imagen y digest resuelto\n        ├── recursos y red\n        ├── entorno (secretos protegidos)\n        ├── discos del contenedor y directorios del host\n        ├── perfil de hardware y dispositivos\n        ├── log de consola y modo de terminal\n        └── pertenencia a una pila y ciclo de vida"
+            "code": "instances/\n└── 105/\n    └── oci-compose.json\n        ├── image and resolved digest\n        ├── resources and network\n        ├── environment (secrets protected)\n        ├── container disks and host directories\n        ├── hardware profile and devices\n        ├── console log and terminal mode\n        └── stack membership and lifecycle"
           }
         },
         {
@@ -86,7 +86,7 @@
               "registry": "Registro OCI",
               "update": "Actualizar la instancia",
               "resolve": "Resolver la etiqueta",
-              "verify": "Verificar el archivo y preflight",
+              "verify": "Verificar el archivo y realizar las comprobaciones previas",
               "backup": "Detener y respaldar el CT",
               "import": "Importar el rootfs nuevo",
               "reapply": "Aplicar de nuevo el contrato",
@@ -215,7 +215,7 @@
     {
       "id": "restore",
       "title": "Backup, restauración y otro host",
-      "intro": "Un backup hecho con vzdump o Proxmox Backup Server incluye el contenedor, sus discos y la copia de su contrato. Lo que la instalación guarda en el host no forma parte de él. <strong>Gestionar aplicaciones OCI instaladas</strong> detecta los contenedores restaurados en un host que no tiene su contrato, un Proxmox recién instalado u otro host, y ofrece registrarlos de nuevo.",
+      "intro": "Un backup hecho con vzdump o Proxmox Backup Server incluye el contenedor, los discos del contenedor seleccionados para el backup y la copia de su contrato. Lo que la instalación guarda en el host no forma parte de él. <strong>Gestionar aplicaciones OCI instaladas</strong> detecta los contenedores restaurados en un host que no tiene su contrato, un Proxmox recién instalado u otro host, y ofrece registrarlos de nuevo.",
       "blocks": [
         {
           "steps": {
@@ -462,7 +462,7 @@
               ],
               [
                 "Discos del contenedor",
-                "Proxmox los mueve con el contenedor. HA necesita que estén en un almacenamiento compartido."
+                "Proxmox los mueve con el contenedor. HA necesita sus datos disponibles en el nodo de destino, mediante almacenamiento compartido o una configuración de replicación compatible."
               ],
               [
                 "Directorios del host y dispositivos",
diff --git a/web/messages/es/docs/oci-manager/monitor.json b/web/messages/es/docs/oci-manager/monitor.json
index 80b1361b..72701fb7 100644
--- a/web/messages/es/docs/oci-manager/monitor.json
+++ b/web/messages/es/docs/oci-manager/monitor.json
@@ -52,7 +52,7 @@
     },
     {
       "id": "app",
-      "title": "App",
+      "title": "Aplicación",
       "intro": "La pestaña <appLink>App</appLink> ofrece la aplicación instalada como una detección, con el nombre, el logo, el puerto y el esquema del registro. Al registrarla se abre el editor con el método <strong>Imagen OCI (instalada por ProxMenux)</strong>, que no necesita configuración.",
       "blocks": [
         {
diff --git a/web/messages/es/docs/oci-manager/stacks.json b/web/messages/es/docs/oci-manager/stacks.json
index 854f3f5b..2f690790 100644
--- a/web/messages/es/docs/oci-manager/stacks.json
+++ b/web/messages/es/docs/oci-manager/stacks.json
@@ -4,7 +4,7 @@
     "description": "Cómo convierte OCI manager Apps una aplicación con su base de datos y su caché en LXC nativos coordinados: plan, red privada, hook de dependencias, validación y actualizaciones transaccionales."
   },
   "header": {
-    "title": "Aplicaciones multicontenedor",
+    "title": "Aplicaciones con varios contenedores",
     "description": "Una aplicación con su base de datos, su caché y otros servicios se convierte en varios LXC nativos coordinados, que se instalan y actualizan como uno solo.",
     "section": "OCI manager Apps"
   },
@@ -21,7 +21,14 @@
         {
           "mermaid": {
             "chartCode": "flowchart LR\n C[\"Docker Compose\"] --> O[\"{{plan}}\"]\n O --> A[\"{{app}}<br/>{{appNet}}\"]\n O --> D[\"{{db}}<br/>{{private}}\"]\n O --> R[\"{{cache}}<br/>{{private}}\"]\n V1[(\"config\")] --> A\n V2[(\"database\")] --> D\n V3[(\"cache\")] --> R\n D --> A\n R --> A",
-            "labels": { "plan": "Plan de la pila", "app": "LXC de la aplicación", "appNet": "LAN + privada", "db": "LXC PostgreSQL", "cache": "LXC Valkey", "private": "privada" }
+            "labels": {
+              "plan": "Plan de la pila",
+              "app": "LXC de la aplicación",
+              "appNet": "LAN + privada",
+              "db": "LXC PostgreSQL",
+              "cache": "LXC Valkey",
+              "private": "privada"
+            }
           }
         }
       ]
@@ -35,14 +42,42 @@
         },
         {
           "table": {
-            "headers": ["Elemento del plan", "Contenido", "Comprobado antes de crear nada"],
+            "headers": [
+              "Elemento del plan",
+              "Contenido",
+              "Comprobado antes de crear nada"
+            ],
             "rows": [
-              ["Miembros", "Aplicación principal, base de datos, caché, aprendizaje automático y demás dependencias", "VMID únicos, roles conocidos y exactamente un miembro principal"],
-              ["Imágenes", "Referencia rolling, arquitectura y digest resuelto de cada servicio", "Todas existen, admiten la arquitectura y superan la verificación de integridad OCI"],
-              ["Red", "Bridge privado, subred, una dirección fija por servicio y acceso LAN para el miembro principal", "Sin colisión con bridges o subredes existentes y sin direcciones repetidas"],
-              ["Persistencia", "Discos del contenedor, directorios del host, propietarios y backup", "Rutas sin solapamientos, almacenamiento disponible y permisos declarados"],
-              ["Secretos", "Contraseña de la base de datos, claves de la aplicación y credenciales iniciales", "Se generan una vez y solo se entregan a los miembros que los usan"],
-              ["Ciclo de vida", "Orden de arranque, orden de parada y una comprobación de salud por miembro", "La aplicación principal arranca la última y se detiene la primera"]
+              [
+                "Miembros",
+                "Aplicación principal, base de datos, caché, aprendizaje automático y demás dependencias",
+                "VMID únicos, roles conocidos y exactamente un miembro principal"
+              ],
+              [
+                "Imágenes",
+                "Referencia rolling, arquitectura y digest resuelto de cada servicio",
+                "Todas existen, admiten la arquitectura y superan la verificación de integridad OCI"
+              ],
+              [
+                "Red",
+                "Bridge privado, subred, una dirección fija por servicio y acceso LAN para el miembro principal",
+                "Sin colisión con bridges o subredes existentes y sin direcciones repetidas"
+              ],
+              [
+                "Persistencia",
+                "Discos del contenedor, directorios del host, propietarios y backup",
+                "Rutas sin solapamientos, almacenamiento disponible y permisos declarados"
+              ],
+              [
+                "Secretos",
+                "Contraseña de la base de datos, claves de la aplicación y credenciales iniciales",
+                "Se generan una vez y solo se entregan a los miembros que los usan"
+              ],
+              [
+                "Ciclo de vida",
+                "Orden de arranque, orden de parada y una comprobación de salud por miembro",
+                "La aplicación principal arranca la última y se detiene la primera"
+              ]
             ]
           }
         }
@@ -55,13 +90,34 @@
         {
           "steps": {
             "items": [
-              { "title": "Reservar todos los VMID", "body": "Se comprueban el inventario de Proxmox VE y el registro de instancias. No se adopta un CT existente ni se reutiliza un contrato que todavía pertenece a otra instancia." },
-              { "title": "Preparar todas las imágenes", "body": "Todas las imágenes se resuelven, descargan y verifican antes de crear el primer contenedor." },
-              { "title": "Crear cada rootfs", "body": "Se importan los metadatos OCI oficiales y se añaden la identidad de instancia de ProxMenux y el rol del miembro." },
-              { "title": "Red privada", "body": "Se crean un bridge y una subred y cada miembro recibe su dirección fija; solo el miembro principal recibe además la interfaz de la LAN." },
-              { "title": "Persistencia", "body": "Cada base de datos y configuración recibe su propio disco del contenedor; solo los datos destinados a compartirse usan directorios del host." },
-              { "title": "Entorno", "body": "Se escriben los endpoints internos, los secretos compartidos y las variables de servicio. La aplicación llega a sus dependencias en sus direcciones privadas reservadas." },
-              { "title": "Registro", "body": "Cada miembro registra su configuración nativa, los cambios del rootfs que las actualizaciones deben reproducir y su relación con la pila." }
+              {
+                "title": "Reservar todos los VMID",
+                "body": "Se comprueban el inventario de Proxmox VE y el registro de instancias. No se adopta un CT existente ni se reutiliza un contrato que todavía pertenece a otra instancia."
+              },
+              {
+                "title": "Preparar todas las imágenes",
+                "body": "Todas las imágenes se resuelven, descargan y verifican antes de crear el primer contenedor."
+              },
+              {
+                "title": "Crear cada rootfs",
+                "body": "Se importan los metadatos OCI oficiales y se añaden la identidad de instancia de ProxMenux y el rol del miembro."
+              },
+              {
+                "title": "Red privada",
+                "body": "Se crean un bridge y una subred y cada miembro recibe su dirección fija; solo el miembro principal recibe además la interfaz de la LAN."
+              },
+              {
+                "title": "Persistencia",
+                "body": "Cada base de datos y configuración recibe su propio disco del contenedor; solo los datos destinados a compartirse usan directorios del host."
+              },
+              {
+                "title": "Entorno",
+                "body": "Se escriben los endpoints internos, los secretos compartidos y las variables de servicio. La aplicación llega a sus dependencias en sus direcciones privadas reservadas."
+              },
+              {
+                "title": "Registro",
+                "body": "Cada miembro registra su configuración nativa, los cambios del rootfs que las actualizaciones deben reproducir y su relación con la pila."
+              }
             ]
           }
         }
@@ -74,20 +130,48 @@
       "blocks": [
         {
           "table": {
-            "headers": ["Servicio", "Comprobación", "Qué demuestra"],
+            "headers": [
+              "Servicio",
+              "Comprobación",
+              "Qué demuestra"
+            ],
             "rows": [
-              ["PostgreSQL", "<code>pg_isready</code> en el CT con el host, el usuario y la base de datos esperados", "El servidor acepta conexiones para la base de datos configurada"],
-              ["Redis / Valkey", "<code>redis-cli</code> o <code>valkey-cli</code> <code>PING</code> contra su dirección privada", "El broker escucha y responde"],
-              ["Aprendizaje automático de Immich", "HTTP <code>GET /ping</code>, más una comprobación del runtime GPU seleccionado", "El servicio responde y la aceleración pedida no ha pasado a CPU"],
-              ["Nextcloud", "<code>GET /status.php</code> con <code>installed=true</code>, <code>maintenance=false</code> y <code>needsDbUpgrade=false</code>", "La inicialización terminó sin migraciones pendientes"],
-              ["Paperless-ngx / Tandoor", "HTTP en la dirección de la LAN y el puerto real del servicio", "El frontend y sus dependencias sirven la aplicación"],
-              ["Aplicación principal", "El endpoint de su plantilla, por ejemplo <code>/api/server/ping</code> en Immich", "La pila completa funciona a través de la aplicación que usa las dependencias"]
+              [
+                "PostgreSQL",
+                "<code>pg_isready</code> en el CT con el host, el usuario y la base de datos esperados",
+                "El servidor acepta conexiones para la base de datos configurada"
+              ],
+              [
+                "Redis / Valkey",
+                "<code>redis-cli</code> o <code>valkey-cli</code> <code>PING</code> contra su dirección privada",
+                "El broker escucha y responde"
+              ],
+              [
+                "Aprendizaje automático de Immich",
+                "HTTP <code>GET /ping</code>, más una comprobación del runtime GPU seleccionado",
+                "El servicio responde y la aceleración pedida no ha pasado a CPU"
+              ],
+              [
+                "Nextcloud",
+                "<code>GET /status.php</code> con <code>installed=true</code>, <code>maintenance=false</code> y <code>needsDbUpgrade=false</code>",
+                "La inicialización terminó sin migraciones pendientes"
+              ],
+              [
+                "Paperless-ngx / Tandoor",
+                "HTTP en la dirección de la LAN y el puerto real del servicio",
+                "El frontend y sus dependencias sirven la aplicación"
+              ],
+              [
+                "Aplicación principal",
+                "El endpoint de su plantilla, por ejemplo <code>/api/server/ping</code> en Immich",
+                "La pila completa funciona a través de la aplicación que usa las dependencias"
+              ]
             ]
           }
         },
         {
           "calloutWarning": {
-            "title": "running no significa healthy",
+            "title": "En ejecución no significa que funcione correctamente",
             "body": "El estado running solo indica que existe el proceso del LXC. Cuando el servicio ofrece una comprobación mejor, se usa una comprobación exec o HTTP con un tiempo límite. Si un miembro se detiene o no supera su comprobación, la pila no se declara instalada."
           }
         }
@@ -103,8 +187,14 @@
         {
           "codeGrid": {
             "items": [
-              { "title": "Configuración del CT principal", "code": "hookscript: local:snippets/proxmenux-stack-dependencies.sh" },
-              { "title": "Contrato privado (ejemplo)", "code": "/etc/pve/priv/proxmenux-stack-VMID.json\n{\n  \"schema\": 1,\n  \"stack\": \"immich\",\n  \"dependencies\": [\n    {\"vmid\": 107, \"label\": \"PostgreSQL\", \"healthcheck\": {...}},\n    {\"vmid\": 108, \"label\": \"Valkey\", \"healthcheck\": {...}},\n    {\"vmid\": 106, \"label\": \"Machine Learning\", \"healthcheck\": {...}}\n  ]\n}" }
+              {
+                "title": "Configuración del CT principal",
+                "code": "hookscript: local:snippets/proxmenux-stack-dependencies.sh"
+              },
+              {
+                "title": "Contrato privado (ejemplo)",
+                "code": "/etc/pve/priv/proxmenux-stack-VMID.json\n{\n  \"schema\": 1,\n  \"stack\": \"immich\",\n  \"dependencies\": [\n    {\"vmid\": 107, \"label\": \"PostgreSQL\", \"healthcheck\": {...}},\n    {\"vmid\": 108, \"label\": \"Valkey\", \"healthcheck\": {...}},\n    {\"vmid\": 106, \"label\": \"Machine Learning\", \"healthcheck\": {...}}\n  ]\n}"
+              }
             ]
           }
         },
@@ -121,12 +211,30 @@
         {
           "steps": {
             "items": [
-              { "title": "Proxmox VE llama a pre-start", "body": "Antes de arrancar el CT principal, el hook se ejecuta con su VMID y la fase del ciclo de vida." },
-              { "title": "Un bloqueo por pila", "body": "<code>flock</code> sobre <code>/run/lock/proxmenux-stack-VMID.lock</code> impide dos secuencias de arranque a la vez." },
-              { "title": "Se lee y valida el contrato", "body": "Se exigen un esquema conocido, dependencias numéricas, etiquetas, una comprobación exec, http o running y un tiempo límite positivo." },
-              { "title": "Dependencias en orden", "body": "Cada CT debe existir; uno detenido se arranca y uno que ya está en marcha no se reinicia." },
-              { "title": "Espera de salud", "body": "La comprobación se ejecuta cada dos segundos y se confirma además que el CT sigue en marcha." },
-              { "title": "Arranca el CT principal", "body": "Cuando todas las dependencias están listas, pre-start termina y Proxmox VE arranca la aplicación." }
+              {
+                "title": "Proxmox VE llama a pre-start",
+                "body": "Antes de arrancar el CT principal, el hook se ejecuta con su VMID y la fase del ciclo de vida."
+              },
+              {
+                "title": "Un bloqueo por pila",
+                "body": "<code>flock</code> sobre <code>/run/lock/proxmenux-stack-VMID.lock</code> impide dos secuencias de arranque a la vez."
+              },
+              {
+                "title": "Se lee y valida el contrato",
+                "body": "Se exigen un esquema conocido, dependencias numéricas, etiquetas, una comprobación exec, http o running y un tiempo límite positivo."
+              },
+              {
+                "title": "Dependencias en orden",
+                "body": "Cada CT debe existir; uno detenido se arranca y uno que ya está en marcha no se reinicia."
+              },
+              {
+                "title": "Esperar a que el servicio esté listo",
+                "body": "La comprobación se ejecuta cada dos segundos y se confirma además que el CT sigue en marcha."
+              },
+              {
+                "title": "Arranca el CT principal",
+                "body": "Cuando todas las dependencias están listas, pre-start termina y Proxmox VE arranca la aplicación."
+              }
             ]
           }
         },
@@ -138,11 +246,27 @@
         },
         {
           "table": {
-            "headers": ["Tipo", "Ejemplo", "Arranques posteriores"],
+            "headers": [
+              "Tipo",
+              "Ejemplo",
+              "Arranques posteriores"
+            ],
             "rows": [
-              ["Pila dependiente", "Immich, Nextcloud, aplicación con PostgreSQL", "El hook del CT principal arranca las dependencias y las espera"],
-              ["Suite de aplicaciones", "Suite Arr", "Sin miembro principal: cada LXC sigue su propio <code>onboot</code>"],
-              ["Aplicación simple", "Jellyfin", "Proxmox VE arranca directamente ese LXC"]
+              [
+                "Pila dependiente",
+                "Immich, Nextcloud, aplicación con PostgreSQL",
+                "El hook del CT principal arranca las dependencias y las espera"
+              ],
+              [
+                "Suite de aplicaciones",
+                "Suite Arr",
+                "Sin miembro principal: cada LXC sigue su propio <code>onboot</code>"
+              ],
+              [
+                "Aplicación simple",
+                "Jellyfin",
+                "Proxmox VE arranca directamente ese LXC"
+              ]
             ]
           }
         }
@@ -176,21 +300,51 @@
         {
           "steps": {
             "items": [
-              { "title": "Cualquier miembro", "body": "El contrato del miembro indica el VMID principal y la lista completa de miembros." },
-              { "title": "La pila es reproducible", "body": "Se validan identidades, contratos, hook, adaptaciones y la existencia de una reproducción coordinada para esa receta." },
-              { "title": "Primero las imágenes", "body": "La aplicación no se detiene hasta que todos los digests están resueltos, descargados y verificados." },
-              { "title": "Detener y respaldar el conjunto", "body": "Los backups nativos verificados se toman con la pila detenida, de modo que aplicación y bases de datos corresponden al mismo momento." },
-              { "title": "Actualizar y comprobar cada miembro", "body": "Adaptación, red, montajes, secretos y dispositivos se aplican de nuevo antes de la comprobación de salud de cada miembro." },
-              { "title": "Publicar o recuperar todo", "body": "Los contratos nuevos solo se publican cuando todos los miembros pasan. Si uno falla, se restauran todos." }
+              {
+                "title": "Cualquier miembro",
+                "body": "El contrato del miembro indica el VMID principal y la lista completa de miembros."
+              },
+              {
+                "title": "La pila es reproducible",
+                "body": "Se validan identidades, contratos, hook, adaptaciones y la existencia de una reproducción coordinada para esa receta."
+              },
+              {
+                "title": "Primero las imágenes",
+                "body": "La aplicación no se detiene hasta que todos los digests están resueltos, descargados y verificados."
+              },
+              {
+                "title": "Detener y respaldar el conjunto",
+                "body": "Los backups nativos verificados se toman con la pila detenida, de modo que aplicación y bases de datos corresponden al mismo momento."
+              },
+              {
+                "title": "Actualizar y comprobar cada miembro",
+                "body": "Adaptación, red, montajes, secretos y dispositivos se aplican de nuevo antes de la comprobación de salud de cada miembro."
+              },
+              {
+                "title": "Publicar o recuperar todo",
+                "body": "Los contratos nuevos solo se publican cuando todos los miembros pasan. Si uno falla, se restauran todos."
+              }
             ]
           }
         },
         {
           "table": {
-            "headers": ["Modificar", "Qué cambia", "Qué se conserva"],
+            "headers": [
+              "Modificar",
+              "Qué cambia",
+              "Qué se conserva"
+            ],
             "rows": [
-              ["Rutas y dispositivos extra", "Se añaden al contenedor de la aplicación o se eliminan de él, y el contenedor se reinicia. No se reconstruye nada", "Los datos de la aplicación, su base de datos y los demás contenedores"],
-              ["Qué ejecuta el reconocimiento (Immich)", "El contenedor Machine learning toma la imagen y los dispositivos de la CPU o de una GPU del host. Toda la aplicación se detiene y se actualiza, como en una actualización", "La caché de modelos, la biblioteca y la base de datos. Si algo falla, se restauran los contenedores y la opción anteriores"]
+              [
+                "Rutas y dispositivos extra",
+                "Se añaden al contenedor de la aplicación o se eliminan de él, y el contenedor se reinicia. No se reconstruye nada",
+                "Los datos de la aplicación, su base de datos y los demás contenedores"
+              ],
+              [
+                "Qué ejecuta el reconocimiento (Immich)",
+                "El contenedor Machine learning toma la imagen y los dispositivos de la CPU o de una GPU del host. Toda la aplicación se detiene y se actualiza, como en una actualización",
+                "La caché de modelos, la biblioteca y la base de datos. Si algo falla, se restauran los contenedores y la opción anteriores"
+              ]
             ]
           }
         },
@@ -220,7 +374,7 @@
               "stop": "Detener, primero el principal",
               "backup": "Backup verificado de cada CT",
               "replace": "Sustituir el rootfs",
-              "healthy": "¿Todos sanos?",
+              "healthy": "¿Todos funcionan correctamente?",
               "yes": "Sí",
               "no": "No",
               "commit": "Publicar los contratos",
diff --git a/web/messages/es/docs/oci-manager/storage-network.json b/web/messages/es/docs/oci-manager/storage-network.json
index 08d67c4e..5884786e 100644
--- a/web/messages/es/docs/oci-manager/storage-network.json
+++ b/web/messages/es/docs/oci-manager/storage-network.json
@@ -1,11 +1,11 @@
 {
   "meta": {
     "title": "Datos, rutas y red | ProxMenux",
-    "description": "Cómo conserva OCI manager Apps los datos de un contenedor OCI: discos del contenedor, directorios del host, montajes Rclone, direcciones y redes privadas."
+    "description": "Cómo conserva OCI manager Apps los datos de un contenedor OCI: discos del contenedor, directorios del host, montajes con rclone, direcciones y redes privadas."
   },
   "header": {
     "title": "Datos, rutas y red",
-    "description": "Qué vive en el rootfs, qué sobrevive a su sustitución, cómo se comparten datos entre contenedores y cómo obtiene cada contenedor su dirección.",
+    "description": "Qué se guarda en el rootfs, qué sobrevive a su sustitución, cómo se comparten datos entre contenedores y cómo obtiene cada uno su dirección.",
     "section": "OCI manager Apps"
   },
   "sections": [
@@ -14,8 +14,8 @@
       "blocks": [
         {
           "calloutInfo": {
-            "title": "La persistencia se decide antes de que exista el LXC",
-            "body": "Los volúmenes que publican la imagen y su archivo Compose se leen antes de crear el contenedor. Cada ruta que debe sobrevivir a una actualización se convierte en un punto de montaje independiente del rootfs, de modo que el rootfs solo contiene lo que pertenece a la imagen y puede sustituirse."
+            "title": "La persistencia se decide antes de crear el LXC",
+            "body": "Antes de crear el contenedor se leen los volúmenes declarados por la imagen y por su archivo Compose. Cada ruta que deba conservarse tras una actualización se convierte en un punto de montaje independiente del rootfs. Así, el rootfs solo contiene lo que pertenece a la imagen y puede sustituirse."
           }
         }
       ]
@@ -23,17 +23,35 @@
     {
       "id": "questions",
       "title": "Qué pregunta el instalador",
-      "intro": "La plantilla aporta las rutas que necesita la aplicación. Cada una se sitúa en un disco del contenedor o en un directorio del host, y pueden añadirse más rutas antes del resumen.",
+      "intro": "La plantilla proporciona las rutas que necesita la aplicación. Cada una se ubica en un disco del contenedor o en un directorio del host, y se pueden añadir más rutas antes del resumen.",
       "blocks": [
         {
           "steps": {
             "items": [
-              { "title": "Rutas requeridas", "body": "Se enumeran <code>/config</code>, <code>/data</code>, bibliotecas, descargas y cualquier volumen que declare la aplicación." },
-              { "title": "Ubicación", "body": "Cada ruta se sitúa en un disco del contenedor o en un directorio existente del host." },
-              { "title": "Almacenamiento y tamaño", "body": "Un disco del contenedor se crea en un almacenamiento de Proxmox VE con el tamaño indicado. La instalación por defecto usa <code>local-lvm</code>; la instalación avanzada pregunta el almacenamiento de cada ruta justo antes de su tamaño y propone el del rootfs. Aparece como <code>vm-VMID-disk-N</code> y se conecta como <code>mpN</code>." },
-              { "title": "Directorio del host", "body": "Un directorio del host se indica por su ruta. Si no existe, se crea con el propietario que mapea el contenedor." },
-              { "title": "Rutas adicionales", "body": "Antes de instalar pueden añadirse más pares de ruta del host o volumen y ruta del contenedor." },
-              { "title": "Resumen", "body": "La relación completa se muestra antes de crear el CT y se guarda en su contrato de instancia." }
+              {
+                "title": "Rutas necesarias",
+                "body": "Se enumeran <code>/config</code>, <code>/data</code>, bibliotecas, descargas y todos los volúmenes declarados por la aplicación."
+              },
+              {
+                "title": "Ubicación",
+                "body": "Cada ruta se ubica en un disco del contenedor o en un directorio del host ya existente."
+              },
+              {
+                "title": "Almacenamiento y tamaño",
+                "body": "Se crea un disco del contenedor en un almacenamiento de Proxmox VE con el tamaño indicado. La instalación predeterminada usa <code>local-lvm</code>; la avanzada pregunta el almacenamiento de cada ruta justo antes de su tamaño y propone el del rootfs. El disco aparece como <code>vm-VMID-disk-N</code> y se conecta como <code>mpN</code>."
+              },
+              {
+                "title": "Directorio del host",
+                "body": "El directorio del host se indica mediante su ruta. Si no existe, se crea con el usuario al que se mapea el del contenedor como propietario."
+              },
+              {
+                "title": "Rutas adicionales",
+                "body": "Antes de instalar se pueden añadir más pares de ruta o volumen del host y ruta dentro del contenedor."
+              },
+              {
+                "title": "Resumen",
+                "body": "Antes de crear el CT se muestra la correspondencia completa de rutas y se guarda en el contrato de la instancia."
+              }
             ]
           }
         }
@@ -45,44 +63,85 @@
       "blocks": [
         {
           "table": {
-            "headers": ["Propiedad", "Disco del contenedor", "Directorio del host"],
+            "headers": [
+              "Propiedad",
+              "Disco del contenedor",
+              "Directorio del host"
+            ],
             "rows": [
-              ["En la configuración", "<code>mpN: STORAGE:vm-VMID-disk-N,mp=/config,backup=1,size=16G</code>", "<code>mpN: /mnt/oci-shared/media,mp=/data/media</code>"],
-              ["Backup del contenedor (vzdump)", "Incluido, con <code>backup=1</code>", "No incluido"],
-              ["Tamaño", "Fijo; crece con un redimensionado del punto de montaje", "El espacio libre del sistema de archivos o dataset del host"],
-              ["Otros contenedores", "Solo lo monta su propio contenedor", "El mismo directorio puede montarse en varios contenedores"],
-              ["Snapshots y restauración", "Los gestiona Proxmox VE junto con el CT", "Se gestionan en el almacenamiento del host"],
-              ["Al eliminar la aplicación", "Se elimina con el contenedor", "Se conserva, con su contenido"],
-              ["Al mover el CT a otro nodo", "Se mueve con el CT", "La misma ruta debe existir en el otro nodo"]
+              [
+                "En la configuración",
+                "<code>mpN: STORAGE:vm-VMID-disk-N,mp=/config,backup=1,size=16G</code>",
+                "<code>mpN: /mnt/oci-shared/media,mp=/data/media</code>"
+              ],
+              [
+                "Backup del contenedor (vzdump)",
+                "Incluido, con <code>backup=1</code>",
+                "No incluido"
+              ],
+              [
+                "Tamaño",
+                "Fijo; se amplía redimensionando el punto de montaje",
+                "El espacio libre del sistema de archivos o dataset del host"
+              ],
+              [
+                "Otros contenedores",
+                "Solo lo monta el contenedor al que pertenece",
+                "El mismo directorio se puede montar en varios contenedores"
+              ],
+              [
+                "Snapshots y restauración",
+                "Los gestiona Proxmox VE junto con el CT",
+                "Se gestionan en el almacenamiento del host"
+              ],
+              [
+                "Al eliminar la aplicación",
+                "Se elimina con el contenedor",
+                "Se conserva con su contenido"
+              ],
+              [
+                "Al mover el CT a otro nodo",
+                "Se mueve con el CT",
+                "La misma ruta debe existir en el otro nodo"
+              ]
             ]
           }
         },
         {
-          "p": "El rootfs queda reservado para los binarios y el contenido de la imagen. Una actualización o una recreación lo sustituye sin tocar ninguno de los dos tipos de punto de montaje."
+          "p": "El rootfs se reserva para los binarios y el contenido de la imagen. Una actualización o recreación lo sustituye sin tocar ninguno de los dos tipos de punto de montaje."
         }
       ]
     },
     {
       "id": "example",
-      "title": "Ejemplo: un contenedor con las dos ubicaciones",
+      "title": "Ejemplo: un contenedor con ambas ubicaciones",
       "blocks": [
         {
           "code": {
-            "title": "Jellyfin instalado como CT 151 en local-lvm (extracto)",
-            "code": "rootfs: local-lvm:vm-151-disk-0,size=8G\n# Disco del contenedor, incluido en el backup del CT\nmp0: local-lvm:vm-151-disk-1,mp=/config,backup=1,size=16G\n\n# Directorio del host, fuera del backup del CT\nmp1: /mnt/oci-shared/media,mp=/data/media"
+            "title": "Jellyfin instalado como CT 151 en local-lvm (fragmento)",
+            "code": "rootfs: local-lvm:vm-151-disk-0,size=8G\n# Container disk, part of the CT backup\nmp0: local-lvm:vm-151-disk-1,mp=/config,backup=1,size=16G\n\n# Host directory, outside the CT backup\nmp1: /mnt/oci-shared/media,mp=/data/media"
           }
         },
         {
-          "p": "Una actualización o una recreación sustituye solo el rootfs: <code>mp0</code> conserva usuarios, bibliotecas y ajustes, y <code>mp1</code> sigue mostrando los mismos archivos multimedia. Restaurar el backup del CT devuelve <code>/config</code>; el directorio multimedia se restaura, si hace falta, desde el backup del almacenamiento del host."
+          "p": "Una actualización o recreación solo sustituye el rootfs: <code>mp0</code> conserva usuarios, bibliotecas y ajustes, y <code>mp1</code> sigue mostrando los mismos archivos multimedia. Al restaurar el backup del CT se recupera <code>/config</code>; si hace falta restaurar el directorio multimedia, se utiliza el backup del almacenamiento del host."
         },
         {
           "flow": {
             "nodes": [
-              { "label": "Contrato", "detail": "/config" },
-              { "label": "Ubicación", "detail": "disco del contenedor\no directorio del host" },
-              { "label": "LXC", "detail": "siempre /config\npara la aplicación" }
+              {
+                "label": "Contrato",
+                "detail": "/config"
+              },
+              {
+                "label": "Ubicación",
+                "detail": "Disco del contenedor\no directorio del host"
+              },
+              {
+                "label": "LXC",
+                "detail": "Siempre /config\npara la aplicación"
+              }
             ],
-            "caption": "La aplicación ve la ruta que publica la imagen; solo cambia dónde se guarda."
+            "caption": "La aplicación ve la ruta declarada por la imagen; solo cambia dónde se almacena."
           }
         }
       ]
@@ -94,33 +153,48 @@
         {
           "mermaid": {
             "chartCode": "flowchart TB\n H[\"{{host}}<br/>/mnt/oci-shared/media\"]\n H --> Q[\"qBittorrent<br/>/data\"]\n H --> J[\"Jellyfin<br/>/data\"]\n H --> R[\"Radarr / Sonarr<br/>/data\"]\n Q -. \"{{config}}\" .-> QV[(\"/config mpN\")]\n J -. \"{{config}}\" .-> JV[(\"/config mpN\")]\n R -. \"{{config}}\" .-> RV[(\"/config mpN\")]",
-            "labels": { "host": "Directorio del host", "config": "configuración propia" }
+            "labels": {
+              "host": "Directorio del host",
+              "config": "Configuración propia"
+            }
           }
         },
         {
-          "p": "Cada contenedor guarda su configuración en su propio disco. La biblioteca o las descargas son un único directorio del host montado en la misma ruta interna de todos los contenedores, de modo que la ruta en la que escribe una aplicación es la misma en la que lee otra."
+          "p": "Cada contenedor guarda su configuración en su propio disco. La biblioteca o las descargas se guardan en un único directorio del host, montado en la misma ruta interna en todos los contenedores. Así, una ruta en la que escribe una aplicación es la misma desde la que lee otra."
         }
       ]
     },
     {
       "id": "rclone",
-      "title": "Almacenamiento en la nube con la aplicación Rclone",
-      "intro": "La aplicación Rclone del catálogo ofrece, además de su instalación, <strong>Activar un montaje en un contenedor Rclone OCI existente</strong>. Monta un remoto ya creado y autorizado en la interfaz web de Rclone y lo publica en el host, donde otros contenedores pueden usarlo como directorio del host.",
+      "title": "Almacenamiento en la nube mediante la aplicación rclone",
+      "intro": "Además de instalarla, la ficha de rclone en el catálogo permite <strong>Activar un montaje en un contenedor OCI de rclone existente</strong>. Se monta un remoto ya creado y autorizado en la interfaz web de rclone y se publica en el host. Otros contenedores pueden usarlo como un directorio del host.",
       "blocks": [
         {
           "steps": {
             "items": [
-              { "title": "Contenedor y remoto", "body": "El VMID del contenedor Rclone, el nombre exacto del remoto y, opcionalmente, una ruta dentro de él." },
-              { "title": "Nombre y caché", "body": "El nombre del montaje y el modo de caché VFS: <code>off</code>, <code>minimal</code>, <code>writes</code> o <code>full</code> (por defecto)." },
-              { "title": "Vistas publicadas", "body": "Una raíz común, <code>/mnt/oci-shared</code> por defecto, contiene una vista de lectura y escritura en <code>/mnt/oci-shared/remotes/NOMBRE</code> y una de solo lectura en <code>/mnt/oci-shared/remotes-ro/NOMBRE</code>." },
-              { "title": "Activación", "body": "Tras una confirmación, el CT se detiene, se configuran su orden de arranque y un hookscript de Proxmox VE, y se vuelve a iniciar. La operación espera hasta que las dos vistas están montadas en el host." }
+              {
+                "title": "Contenedor y remoto",
+                "body": "El VMID del contenedor de rclone, el nombre exacto del remoto y, opcionalmente, una ruta dentro de él."
+              },
+              {
+                "title": "Nombre del montaje y caché",
+                "body": "El nombre del montaje y el modo de caché VFS: <code>off</code>, <code>minimal</code>, <code>writes</code> o <code>full</code> (predeterminado)."
+              },
+              {
+                "title": "Vistas publicadas",
+                "body": "Una raíz común, <code>/mnt/oci-shared</code> de forma predeterminada, contiene una vista de lectura y escritura en <code>/mnt/oci-shared/remotes/NAME</code> y otra de solo lectura en <code>/mnt/oci-shared/remotes-ro/NAME</code>."
+              },
+              {
+                "title": "Activación",
+                "body": "Tras confirmar, se detiene el CT, se configuran su comando de arranque y un hookscript de Proxmox VE y se vuelve a iniciar. La operación espera a que ambas vistas estén montadas en el host."
+              }
             ]
           }
         },
         {
           "calloutInfo": {
-            "title": "Si el montaje no llega a activarse",
-            "body": "Se restaura la configuración anterior del contenedor y se vuelve a iniciar, de modo que una activación fallida deja Rclone como estaba."
+            "title": "Si el montaje no se activa",
+            "body": "Se restaura la configuración anterior del contenedor y se vuelve a iniciar. Así, si la activación falla, rclone queda como estaba."
           }
         }
       ]
@@ -128,41 +202,58 @@
     {
       "id": "network",
       "title": "Direcciones y redes",
-      "intro": "Una aplicación simple necesita una dirección. Una aplicación multicontenedor necesita además una red estable entre sus miembros.",
+      "intro": "Una aplicación de un solo contenedor necesita una dirección. Una aplicación con varios contenedores también necesita una red estable entre sus miembros.",
       "blocks": [
         {
           "cards": {
             "items": [
-              { "icon": "network", "title": "Aplicación simple", "body": "Se eligen el bridge y DHCP o una dirección CIDR fija. El LXC tiene una dirección propia y el resumen muestra las URL completas de los servicios." },
-              { "icon": "waypoints", "title": "Aplicación multicontenedor", "body": "Se busca una subred libre, se crea un bridge privado persistente y cada miembro (aplicación, base de datos, caché) recibe en él una dirección fija." }
+              {
+                "icon": "network",
+                "title": "Aplicación de un contenedor",
+                "body": "Se elige el puente de red y DHCP o una dirección fija en formato CIDR. El LXC tiene su propia dirección y el resumen muestra las URL completas de los servicios."
+              },
+              {
+                "icon": "waypoints",
+                "title": "Aplicación con varios contenedores",
+                "body": "Se busca una subred libre, se crea un puente privado persistente y cada miembro —aplicación, base de datos y caché— recibe una dirección fija en él."
+              }
             ]
           }
         },
         {
           "flow": {
             "nodes": [
-              { "label": "LAN", "detail": "dirección accesible\nsolo el servicio principal" },
-              { "label": "LXC principal", "detail": "web / API\nLAN + red privada" },
-              { "label": "Red privada", "detail": "PostgreSQL · Valkey · ML\ndirecciones fijas" }
+              {
+                "label": "LAN",
+                "detail": "Dirección accesible\nsolo para el servicio principal"
+              },
+              {
+                "label": "LXC principal",
+                "detail": "Web / API\nLAN + red privada"
+              },
+              {
+                "label": "Red privada",
+                "detail": "PostgreSQL · Valkey · ML\ndirecciones fijas"
+              }
             ],
-            "caption": "Las dependencias se comunican por la red privada y no tienen dirección en la LAN."
+            "caption": "Las dependencias se comunican por la red privada y no tienen una dirección en la LAN."
           }
         },
         {
-          "p": "El contrato de la pila guarda el bridge, la subred, las direcciones y las relaciones entre servicios. La actualización de la aplicación reutiliza la misma topología en todos sus miembros. ProxMenux Monitor abre el contenedor principal en su dirección de la LAN, no en la de la red privada."
+          "p": "El contrato de la pila guarda el puente, la subred, las direcciones y las relaciones entre servicios. Al actualizar la aplicación se reutiliza la misma topología para todos sus miembros. ProxMenux Monitor abre el contenedor principal en su dirección de la LAN, no en la de la red privada."
         }
       ]
     },
     {
       "id": "ownership",
-      "title": "Propietarios",
+      "title": "Propietarios de archivos y directorios",
       "blocks": [
         {
           "list": {
             "items": [
-              "Los directorios nuevos se crean con el UID y el GID que mapea el LXC no privilegiado.",
-              "Los directorios existentes no cambian de propietario de forma recursiva.",
-              "Los sockets, los archivos del sistema y las rutas sensibles no se ofrecen como directorios del host genéricos."
+              "Los directorios nuevos se crean con el UID y el GID a los que se mapea el LXC sin privilegios.",
+              "No se cambia recursivamente el propietario de los directorios existentes.",
+              "Los sockets, archivos del sistema y rutas sensibles no se ofrecen como directorios genéricos del host."
             ]
           }
         }
@@ -174,13 +265,37 @@
       "blocks": [
         {
           "table": {
-            "headers": ["Elemento", "En el vzdump del CT", "Dónde se conserva"],
+            "headers": [
+              "Elemento",
+              "En el backup vzdump del CT",
+              "Dónde se conserva"
+            ],
             "rows": [
-              ["rootfs OCI", "Sí", "El backup del CT; también puede reconstruirse desde la imagen y el contrato"],
-              ["Disco del contenedor con <code>backup=1</code>", "Sí", "El backup del CT"],
-              ["Directorio del host", "No", "El backup del almacenamiento del host"],
-              ["Contrato de la instancia", "No", "<code>/usr/local/share/proxmenux/oci/instances/VMID/</code> en el host"],
-              ["Aplicación multicontenedor", "Cada miembro en su propio backup", "Los backups de cada miembro, más el contrato de la pila y su bridge en el host"]
+              [
+                "Rootfs OCI",
+                "Sí",
+                "En el backup del CT; también se puede reconstruir a partir de la imagen y el contrato"
+              ],
+              [
+                "Disco del contenedor con <code>backup=1</code>",
+                "Sí",
+                "El backup del CT"
+              ],
+              [
+                "Directorio del host",
+                "No",
+                "El backup del almacenamiento del host"
+              ],
+              [
+                "Contrato de la instancia",
+                "Sí, la copia que guarda el CT",
+                "<code>/.proxmenux/oci-record.json</code> dentro del CT; las copias adicionales del host y del clúster se guardan por separado"
+              ],
+              [
+                "Aplicación con varios contenedores",
+                "Cada miembro en su propio backup",
+                "Los backups de todos los miembros, más el contrato de la pila y su puente de red en el host"
+              ]
             ]
           }
         }
diff --git a/web/messages/es/docs/post-install/automated.json b/web/messages/es/docs/post-install/automated.json
index 4d3b127f..432263c5 100644
--- a/web/messages/es/docs/post-install/automated.json
+++ b/web/messages/es/docs/post-install/automated.json
@@ -1,14 +1,14 @@
 {
   "meta": {
-    "title": "Script Automatizado post-instalación | ProxMenux Documentation",
-    "description": "El script Automatizado post-instalación de ProxMenux aplica un conjunto seleccionado de 14 optimizaciones seguras y adaptadas al hardware a un host Proxmox VE recién instalado, sin preguntas. Los cambios de configuración reversibles quedan registrados para restaurarlos después.",
-    "ogTitle": "Script Automatizado post-instalación | ProxMenux Documentation",
-    "ogDescription": "14 optimizaciones aplicadas a un host Proxmox VE recién instalado sin preguntas. Adaptadas al hardware y con los cambios reversibles registrados."
+    "title": "Script automatizado post-instalación | Documentación de ProxMenux",
+    "description": "El script automatizado post-instalación de ProxMenux ejecuta un conjunto fijo de 14 optimizaciones adaptadas al hardware en un host Proxmox VE recién instalado. No ofrece una lista de funciones para elegir, pero puede pedir confirmación para la actualización del sistema, ocultar el aviso de suscripción, instalar Log2RAM en ciertos casos y reiniciar. Los cambios reversibles se registran para restaurarlos después.",
+    "ogTitle": "Script automatizado post-instalación | Documentación de ProxMenux",
+    "ogDescription": "14 optimizaciones fijas adaptadas al hardware para un host Proxmox VE nuevo, con confirmaciones para algunas acciones y registro de cambios reversibles."
   },
   "header": {
     "title": "Script Automatizado post-instalación",
-    "description": "Un clic, sin preguntas: ProxMenux aplica 14 optimizaciones seguras de las que se beneficia casi cualquier host Proxmox. Los cambios de configuración reversibles quedan registrados para Uninstall Optimizations; las actualizaciones de paquetes no se describen como reversibles.",
-    "section": "Post-Install · Automated"
+    "description": "ProxMenux ejecuta 14 optimizaciones de base sin lista de funciones para elegir. Algunas acciones piden confirmación. Los cambios reversibles se registran para Desinstalar optimizaciones; las actualizaciones de paquetes no se describen como reversibles.",
+    "section": "Post-instalación · Automatizada"
   },
   "intro": {
     "title": "Cuándo elegir Automatizado",
@@ -24,91 +24,91 @@
   },
   "optimizations": [
     {
-      "tool": "Repositorios APT + full upgrade",
+      "tool": "Repositorios APT + actualización completa",
       "what": "Desactiva pve-enterprise.sources y ceph.sources enterprise, escribe una fuente limpia sin suscripción para el codename Debian del host, y luego ejecuta apt update && apt full-upgrade -y (el comando oficial de upgrade de Proxmox).",
-      "category": "Basic Settings",
+      "category": "Ajustes básicos",
       "categorySlug": "basic-settings"
     },
     {
       "tool": "Eliminación del banner de suscripción",
-      "what": "Parchea la UI web para ocultar el banner 'No valid subscription'. Pide confirmación antes de aplicar; reversible desde Uninstall Optimizations.",
-      "category": "Customization",
+      "what": "Modifica la interfaz web para ocultar el aviso «No valid subscription». Pide confirmación antes de aplicarlo; reversible desde Desinstalar optimizaciones.",
+      "category": "Personalización",
       "categorySlug": "customization"
     },
     {
       "tool": "Forzar IPv4",
       "what": "Escribe /etc/apt/apt.conf.d/99-force-ipv4 para que apt use solo IPv4 — esquiva setups de mirror IPv6 inestables.",
-      "category": "Network",
+      "category": "Red",
       "categorySlug": "network"
     },
     {
       "tool": "Saltar paquetes de idioma",
-      "what": "Escribe /etc/apt/apt.conf.d/99-disable-translations para dejar de descargar paquetes específicos de locale. Updates de apt más rápidos y ligeros.",
-      "category": "Basic Settings",
+      "what": "Escribe /etc/apt/apt.conf.d/99-disable-translations para dejar de descargar índices de descripciones traducidas de paquetes y reducir los datos de las actualizaciones de apt.",
+      "category": "Ajustes básicos",
       "categorySlug": "basic-settings"
     },
     {
       "tool": "Aumentar límites del sistema",
       "what": "Sube los inotify watches, los límites nofile/nproc, los límites del keyring del kernel y fs.file-max en sysctl.d, limits.d, pam y systemd — lo bastante altos para hosts con muchos contenedores.",
-      "category": "System",
+      "category": "Sistema",
       "categorySlug": "system"
     },
     {
-      "tool": "Tuning de memoria",
+      "tool": "Ajuste de memoria",
       "what": "Establece vm.swappiness=10, dirty ratios balanceados, vm.max_map_count=262144 y compaction proactiveness cuando es soportado. La política de memory-overcommit del kernel se deja en el valor por defecto de Proxmox.",
-      "category": "System",
+      "category": "Sistema",
       "categorySlug": "system"
     },
     {
       "tool": "Comportamiento ante kernel panic",
       "what": "Configura el host para reiniciar 10 segundos después de un panic / oops / hardlockup en lugar de quedarse congelado indefinidamente.",
-      "category": "System",
+      "category": "Sistema",
       "categorySlug": "system"
     },
     {
       "tool": "Tuning del stack de red",
       "what": "Dimensionado de buffers TCP, hardening IPv4 (redirects off, rp_filter=2, martian log off), rango de puertos locales 1024-65535, TCP MTU probing, RFC 1337, más un helper en /usr/local/sbin/proxmenux-fwbr-tune conectado a una unit systemd oneshot y a una regla udev, de forma que rp_filter=0 / log_martians=0 se reapliquen a las interfaces fwbr*/fwln*/fwpr*/tap* cada vez que Proxmox las recrea al iniciar/parar VMs, en reinicios o en migraciones en vivo.",
-      "category": "Network",
+      "category": "Red",
       "categorySlug": "network"
     },
     {
       "tool": "Customización de bashrc (root)",
       "what": "PS1 con colores, aliases comunes (l/la/ll/ls/grep), historial con marcas de tiempo y sourcing de bash-completion, todo dentro de un bloque PMX_CORE_BASHRC delimitado para que sea fácil de quitar.",
-      "category": "Customization",
+      "category": "Personalización",
       "categorySlug": "customization"
     },
     {
-      "tool": "Log2RAM (consciente de SSD, automático)",
+      "tool": "Log2RAM (según el SSD, automático)",
       "what": "Reduce el desgaste del SSD/NVMe moviendo /var/log a una ramdisk tmpfs con sync periódico al disco. Se instala desde el proyecto oficial cuando el disco raíz es SSD o NVMe. Dimensiona la ramdisk según la RAM (128M / 256M / 512M), programa el sync periódico y un guardián de auto-sync que compacta al 80% y trunca los logs calientes al 92% antes de escribir. Ajusta los límites de journald para caber en la ramdisk. Detalle completo en <link>Log2RAM</link>.",
-      "category": "Storage",
+      "category": "Almacenamiento",
       "categorySlug": "storage"
     },
     {
       "tool": "ZFS autotrim (solo SSD)",
       "what": "Activa zpool autotrim=on en cada pool ZFS cuyos vdevs sean todos SSD/NVMe con soporte TRIM (comprueba /sys/block/[dev]/queue/rotational y discard_granularity). Los pools respaldados por HDDs se saltan automáticamente. Solo los pools realmente cambiados por ProxMenux quedan registrados para el uninstall — los pools en los que activaste autotrim a mano se dejan en paz.",
-      "category": "Storage",
+      "category": "Almacenamiento",
       "categorySlug": "storage"
     },
     {
       "tool": "Límites de tamaño de journald",
-      "what": "Fuerza almacenamiento persistente, capa SystemMaxUse=64M / RuntimeMaxUse=60M, activa compresión, logging a nivel info (requerido para el Monitor). Se salta automáticamente cuando Log2RAM está activo (hace su propio ajuste).",
-      "category": "System",
+      "what": "Fuerza almacenamiento persistente, limita SystemMaxUse=64M / RuntimeMaxUse=60M, activa compresión y registros de nivel info (necesarios para Monitor). Se omite cuando Log2RAM está activo, pues hace su propio ajuste.",
+      "category": "Sistema",
       "categorySlug": "system"
     },
     {
-      "tool": "Tuning de logrotate",
-      "what": "Rotación diaria con tope de tamaño 10M, 7 rotaciones, compresión y copytruncate — amigable con Log2RAM.",
-      "category": "System",
+      "tool": "Ajuste de logrotate",
+      "what": "Configura globalmente daily y después size 10M, conserva 7 rotaciones y activa compresión y copytruncate. El criterio de tamaño posterior prevalece; las reglas particulares pueden cambiarlo. Adecuado para Log2RAM, pero la frecuencia depende de reglas y temporizador.",
+      "category": "Sistema",
       "categorySlug": "system"
     },
     {
       "tool": "Nombres de interfaz persistentes",
       "what": "Escribe un <code>/etc/systemd/network/10-proxmenux-&lt;iface&gt;.link</code> por NIC física (cada uno comenzando con la cabecera 'Managed by ProxMenux') que fija el MAC al nombre actual, de forma que los nombres <code>eth0</code> / <code>enp…</code> se mantengan estables tras reinicios y al añadir nuevas NICs.",
-      "category": "Network",
+      "category": "Red",
       "categorySlug": "network"
     }
   ],
-  "hardwareTitle": "Valores por defecto conscientes del hardware",
+  "hardwareTitle": "Valores predeterminados adaptados al hardware",
   "hardwareBody": "El script lee el hardware del host antes de aplicar los ajustes. Log2RAM solo se instala en discos raíz SSD / NVMe por defecto (pregunta si la detección dice lo contrario). El tamaño del ramdisk de Log2RAM se elige a partir de la RAM total (<code>≤ 8 GB → 128M</code>, <code>≤ 16 GB → 256M</code>, <code>'>' 16 GB → 512M</code>). Los límites de journald se ajustan al tamaño del ramdisk cuando Log2RAM está activo, para no llenarlo.",
   "upgrade": {
     "heading": "Actualizar y hacer upgrade del sistema",
@@ -118,9 +118,9 @@
       "Desactiva enterprise <code>pve-enterprise.sources</code> / <code>ceph.sources</code>, elimina archivos de repos legacy, escribe una fuente limpia sin suscripción para el codename del host.",
       "Ejecuta el upgrade de forma no interactiva con <code>DEBIAN_FRONTEND=noninteractive</code> y <code>--force-confdef --force-confold</code> — los archivos de configuración que has customizado siguen siendo tuyos cuando upstream también ha cambiado.",
       "Instala paquetes esenciales de Proxmox si faltan (<code>zfsutils-linux</code>, <code>proxmox-backup-restore-image</code>, <code>chrony</code>).",
-      "Comprobación de cordura de metadatos LVM, <code>apt-get autoremove -y</code> + <code>apt-get autoclean -y</code>, y prompt de reinicio solo si el kernel realmente cambió."
+      "Comprobación de coherencia de metadatos LVM, <code>apt-get autoremove -y</code> + <code>apt-get autoclean -y</code> y solicitud de reinicio solo si cambió el núcleo."
     ],
-    "sameTitle": "Mismo updater, dos puntos de entrada",
+    "sameTitle": "Mismo actualizador, dos puntos de entrada",
     "sameBody": "El bundle Automatizado y la utilidad independiente <link>Proxmox System Update</link> comparten los mismos scripts subyacentes (<code>update-pve8.sh</code> / <code>update-pve9_2.sh</code>). Usa la utilidad por separado cuando solo quieras hacer upgrade del host sin aplicar el resto de las optimizaciones."
   },
   "endResult": {
@@ -142,18 +142,18 @@
   "xshokBody": "Si el host ha ejecutado previamente el script <code>xshok-proxmox</code>, ProxMenux detecta el archivo marcador y te avisa antes de continuar. Algunos tweaks pueden solaparse. El script complementario está deprecado — si decides continuar de todos modos, revisa <link>el resumen</link> para contexto.",
   "revert": {
     "heading": "Revertir",
-    "body": "Cada herramienta de la tabla anterior se registra a sí misma en <code>/usr/local/share/proxmenux/installed_tools.json</code>. Abre <link>Uninstall Optimizations</link> para elegir items individuales que revertir. Los backups de los archivos de configuración modificados se dejan junto a los originales con sufijo <code>.bak</code>."
+    "body": "Cada herramienta de la tabla se registra en <code>/usr/local/share/proxmenux/installed_tools.json</code>. Abre <link>Desinstalar optimizaciones</link> para elegir los elementos que quieras revertir. Las copias de los archivos modificados se guardan junto a los originales con sufijo <code>.bak</code>."
   },
   "related": {
     "heading": "Relacionado",
     "items": [
       {
-        "label": "Customizable Post-Install",
+        "label": "Post-instalación personalizable",
         "href": "/docs/post-install/customizable",
         "tail": " — elige exactamente qué quieres del mismo catálogo."
       },
       {
-        "label": "Uninstall Optimizations",
+        "label": "Desinstalar optimizaciones",
         "href": "/docs/post-install/uninstall",
         "tail": " — revierte cualquier subconjunto de lo aplicado aquí."
       },
@@ -163,7 +163,7 @@
         "tail": " — verifica los cambios (uptime, free, journalctl, etc.)."
       },
       {
-        "label": "Resumen de Post-Install",
+        "label": "Resumen de post-instalación",
         "href": "/docs/post-install",
         "tail": "."
       }
diff --git a/web/messages/es/docs/post-install/basic-settings.json b/web/messages/es/docs/post-install/basic-settings.json
index 6c931685..a20194bd 100644
--- a/web/messages/es/docs/post-install/basic-settings.json
+++ b/web/messages/es/docs/post-install/basic-settings.json
@@ -1,11 +1,11 @@
 {
   "meta": {
-    "title": "Post-instalación: Basic Settings | ProxMenux Documentation",
+    "title": "Post-instalación: Ajustes básicos | Documentación de ProxMenux",
     "description": "Opciones post-instalación fundamentales: cambiar a los repositorios sin suscripción de Proxmox y hacer upgrade, autodetectar la zona horaria y activar NTP, saltar la descarga de idiomas de APT, y elegir entre 25 utilidades de sistema comunes para instalar."
   },
   "header": {
-    "title": "Post-instalación: Basic Settings",
-    "section": "Settings post-install Proxmox"
+    "title": "Post-instalación: Ajustes básicos",
+    "section": "Configuración post instalación de Proxmox"
   },
   "intro": {
     "title": "Qué cubre esta categoría",
@@ -15,8 +15,8 @@
     "heading": "Actualizar y hacer upgrade del sistema",
     "intro": "Reconfigura APT para usar el repositorio gratuito <em>pve-no-subscription</em> (en lugar del repo enterprise que requiere suscripción) y ejecuta un upgrade completo del sistema. Los pasos exactos dependen de la versión mayor de Proxmox VE: ProxMenux la detecta y despacha al script correcto.",
     "headerVersion": "Versión PVE",
-    "headerScript": "Script despachador",
-    "headerCodename": "Codename Debian",
+    "headerScript": "Script de selección por versión",
+    "headerCodename": "Nombre en clave de Debian",
     "rows": [
       {
         "version": "9.x",
@@ -31,7 +31,7 @@
     ],
     "officialTitle": "La recomendación oficial de Proxmox",
     "officialBody": "La guía oficial de upgrade de Proxmox es ejecutar, exactamente en este orden:",
-    "officialOutro": "Esa única línea es todo lo que necesitas en cualquier release actual de Proxmox. El reto no es el comando en sí — es asegurarse de que los repositorios del host están sanos <em>antes</em> de ejecutarlo.",
+    "officialOutro": "Este es el comando habitual para actualizaciones dentro de la misma versión mayor de Proxmox VE. Comprueba los repositorios del host y revisa los cambios de paquetes propuestos <em>antes</em> de continuar. Cambiar de versión mayor requiere el procedimiento oficial de migración.",
     "doesTitle": "Qué hace la opción de ProxMenux — verificado contra el script",
     "doesIntro": "El update de ProxMenux envuelve los comandos apt exactos de arriba y añade una serie de pasos pre/post que tendrías que recordar tú a mano. Cada item de abajo es lo que el script despachador realmente hace (mira <link>Proxmox System Update</link> para el desglose completo):",
     "doesItems": [
@@ -39,37 +39,37 @@
       "<strong>Repos Debian reescritos</strong> con main / updates / security, incluyendo <code>non-free-firmware</code>, para que la advertencia de firmware durante el upgrade desaparezca.",
       "<strong>Ejecuta el upgrade oficial.</strong> <code>apt-get update</code> seguido de <code>apt full-upgrade -y</code> (PVE 9) o <code>apt dist-upgrade -y</code> (PVE 8), ambos lanzados de forma no interactiva con <code>--force-confdef --force-confold</code> para que cualquier archivo de configuración que hayas customizado siga siendo tuyo.",
       "<strong>Instala paquetes esenciales</strong> si faltan: <code>zfsutils-linux</code>, <code>proxmox-backup-restore-image</code>, <code>chrony</code>.",
-      "<strong>Comprobación de cordura de metadatos LVM.</strong> Busca VMs con passthrough de disco que puedan haber garabateado cabeceras stale de physical-volume sobre discos en bruto; avisa si hay algo raro (no hay fix automático).",
+      "<strong>Comprueba los metadatos LVM.</strong> Busca VM con passthrough de disco que puedan haber dejado cabeceras antiguas de volúmenes físicos en discos en bruto; avisa si detecta anomalías, sin corregirlas automáticamente.",
       "<strong>Limpia al final:</strong> <code>apt-get autoremove -y</code> + <code>apt-get autoclean -y</code>, y luego pregunta por un reinicio si el kernel fue actualizado o si está presente <code>/var/run/reboot-required</code>."
     ],
     "shortTitle": "En resumen",
     "shortBody": "La opción ejecuta el exacto <code>apt update && apt full-upgrade -y</code> que Proxmox recomienda, lo envuelve con la limpieza de repos y la limpieza post-upgrade que la guía oficial también te dice que hagas, y pregunta por el reinicio al final. Mira <link>Proxmox System Update</link> — el mismo updater también está disponible como utilidad independiente en el menú principal, con el diagrama completo del proceso.",
     "subTitle": "No apliques esto a un host con suscripción",
-    "subBody": "Si tienes una suscripción de Proxmox y quieres seguir usando los repositorios enterprise, omite esta opción. Al ejecutarla se desactiva el repositorio enterprise y el host pasa al canal comunitario. La actualización de paquetes y la reescritura de repositorios no se presentan como reversibles en Uninstall Optimizations; restaura deliberadamente la configuración de repositorios si más adelante necesitas cambiar de canal.",
+    "subBody": "Si tienes una suscripción de Proxmox y quieres mantener los repositorios Enterprise, omite esta opción. Al ejecutarla, el host pasa al canal comunitario. La actualización de paquetes y la reescritura de repositorios no se pueden revertir desde Desinstalar optimizaciones; si quieres cambiar de canal después, debes configurar los repositorios expresamente.",
     "safetyTitle": "Comprobación de seguridad post-update",
-    "safetyBody": "Tras el upgrade, el script comprueba si hay discos con metadatos PV (Physical Volume) obsoletos — un caso límite que puede pasar cuando una VM con passthrough de disco garabatea cabeceras LVM sobre un disco en bruto. Si encuentra algo sospechoso verás un aviso sugiriendo <code>pvs</code> para inspeccionarlo. No se toma ninguna acción automáticamente."
+    "safetyBody": "Tras actualizar, el script busca discos con metadatos antiguos de volúmenes físicos (PV). Puede ocurrir si una VM con passthrough de disco escribe cabeceras LVM en un disco en bruto. Si encuentra algo sospechoso, avisa y sugiere inspeccionarlo con <code>pvs</code>. No modifica nada automáticamente."
   },
   "time": {
     "heading": "Sincronizar la hora automáticamente",
     "intro": "Detecta la IP pública del servidor vía <code>dig myip.opendns.com @resolver1.opendns.com</code>, luego consulta <code>ipapi.co/'{'ip'}'/timezone</code> para buscar la zona horaria IANA correspondiente, y la aplica con <code>timedatectl set-timezone</code>. Finalmente activa NTP con <code>timedatectl set-ntp true</code>.",
     "depTitle": "Depende de dos servicios externos",
     "depBody": "El lookup depende de que OpenDNS e <code>ipapi.co</code> sean accesibles, y de que sus respuestas sean correctas. Si ejecutas Proxmox detrás de una VPN o en una VLAN que sale por una región distinta, la zona horaria autodetectada puede ser incorrecta. En ese caso sáltate esta opción y configura la zona horaria a mano:",
-    "revertTitle": "Reversible desde el menú Uninstall",
-    "revertBody": "<link>Uninstall Optimizations</link> resetea la zona horaria a UTC (un valor por defecto seguro). No desactiva NTP — tu reloj sigue sincronizándose, solo anclado a UTC hasta que pongas una nueva zona horaria manualmente."
+    "revertTitle": "Reversible desde el menú Desinstalar",
+    "revertBody": "<link>Desinstalar optimizaciones</link> restablece la zona horaria a UTC, un valor predeterminado seguro. No desactiva NTP: el reloj sigue sincronizándose y muestra UTC hasta que configures otra zona manualmente."
   },
   "languages": {
     "heading": "Saltar la descarga de idiomas adicionales",
-    "intro": "En cada <code>apt update</code>, Debian por defecto descarga archivos de traducción para cada locale que distribuye — mucho tráfico y espacio en disco para algo que rara vez verás. Esta opción le dice a APT que solo descargue los metadatos principales. Antes de desactivarlo, ProxMenux <strong>se asegura de que el propio locale del host está realmente generado</strong> (lee <code>/etc/default/locale</code> o <code>/etc/environment</code>, lo añade a <code>/etc/locale.gen</code> si falta, y ejecuta <code>locale-gen</code>). Así no pierdes tu locale de shell como efecto colateral.",
+    "intro": "Durante <code>apt update</code>, APT puede descargar descripciones de paquetes traducidas además de los metadatos principales. Esta opción desactiva esas traducciones para ahorrar ancho de banda y disco. Antes, ProxMenux <strong>comprueba que la configuración regional del host está generada</strong>: lee <code>/etc/default/locale</code> o <code>/etc/environment</code>, la añade a <code>/etc/locale.gen</code> si falta y ejecuta <code>locale-gen</code>. Así se conserva la configuración regional de la shell.",
     "writtenTitle": "Qué se escribe",
-    "revertTitle": "Reversible desde el menú Uninstall",
+    "revertTitle": "Reversible desde el menú Desinstalar",
     "revertBody": "Borrar <code>/etc/apt/apt.conf.d/99-disable-translations</code> (manualmente o desde el menú Uninstall) restaura el comportamiento por defecto y APT vuelve a descargar los archivos de idioma."
   },
   "utilities": {
     "heading": "Instalar utilidades de sistema comunes",
-    "intro": "Abre un checklist con <strong>25 utilidades curadas</strong> organizadas en grupos. Elige las que quieras, confirma, y ProxMenux instala cada una vía <code>apt</code>, verificando que el paquete funcionó y mostrando un resumen al final.",
-    "imageAlt": "Diálogo de checklist mostrando la lista de utilidades de sistema de ProxMenux con espacio para seleccionar y enter para confirmar",
+    "intro": "Abre una lista con <strong>25 utilidades seleccionadas</strong> organizadas en grupos. Elige las que quieras y confirma; ProxMenux las instala mediante <code>apt</code>, comprueba el resultado y muestra un resumen final.",
+    "imageAlt": "Diálogo de selección de utilidades de ProxMenux: Espacio selecciona y Entrar confirma",
     "reuseTitle": "La misma lista se reutiliza en otro sitio",
-    "reuseBody": "El catálogo de 25 utilidades vive en una única fuente de verdad (<code>PROXMENUX_UTILS</code> en <code>scripts/global/utils-install-functions.sh</code>). El menú <em>Utilities and Tools → System Utilities</em> del menú principal de ProxMenux expone la misma lista, así que puedes volver más tarde e instalar más sin volver a ejecutar la post-instalación.",
+    "reuseBody": "El catálogo de 25 utilidades tiene una única definición: <code>PROXMENUX_UTILS</code> en <code>scripts/global/utils-install-functions.sh</code>. El menú <em>Utilidades y herramientas → Utilidades del sistema</em> ofrece la misma lista para instalar más adelante sin repetir la post-instalación.",
     "listTitle": "Qué hay en la lista",
     "groups": [
       {
@@ -177,7 +177,7 @@
           },
           {
             "pkg": "tmux",
-            "desc": "Multiplexador de terminal — sesiones que se separan, paneles divididos, sobrevive a desconexiones"
+            "desc": "Multiplexador de terminal: separa sesiones, divide paneles y mantiene las sesiones tras desconectarte"
           }
         ]
       },
@@ -210,18 +210,18 @@
     ],
     "actionTitle": "Algunas de ellas en acción",
     "noBulkTitle": "Solo se eliminan las utilidades instaladas por ProxMenux",
-    "noBulkBody": "ProxMenux registra únicamente los paquetes seleccionados que no estaban instalados antes de esta acción. Uninstall Optimizations puede purgar después esos paquetes, mientras que las utilidades que ya existían en el host permanecen intactas. La actualización general mediante APT no se registra como reversible porque los paquetes actualizados no disponen de una restauración atómica segura."
+    "noBulkBody": "ProxMenux registra únicamente los paquetes seleccionados que no estaban ya instalados. Al ejecutar Desinstalar optimizaciones, purga esos paquetes y conserva los que ya tenías. Las actualizaciones de APT no tienen una reversión atómica segura: desinstalar utilidades no deshace la actualización del sistema."
   },
   "related": {
     "heading": "Relacionado",
     "items": [
       {
-        "label": "Proxmox System Update",
+        "label": "Actualización del sistema Proxmox",
         "href": "/docs/utils/system-update",
         "tail": " — vuelve a ejecutar el ciclo apt update + dist-upgrade bajo demanda."
       },
       {
-        "label": "System Utilities Installer",
+        "label": "Instalador de utilidades del sistema",
         "href": "/docs/utils/system-utils",
         "tail": " — instala (o reinstala) utilidades individualmente tras la post-instalación."
       },
@@ -231,7 +231,7 @@
         "tail": " — referencia de apt."
       },
       {
-        "label": "Customizable Post-Install",
+        "label": "Post-instalación personalizable",
         "href": "/docs/post-install/customizable",
         "tail": " — volver al menú padre."
       }
diff --git a/web/messages/es/docs/post-install/customizable.json b/web/messages/es/docs/post-install/customizable.json
index 602cdd31..8db627be 100644
--- a/web/messages/es/docs/post-install/customizable.json
+++ b/web/messages/es/docs/post-install/customizable.json
@@ -1,103 +1,103 @@
 {
   "meta": {
-    "title": "Script Personalizable post-instalación | ProxMenux Documentation",
+    "title": "Script post-instalación personalizable | Documentación de ProxMenux",
     "description": "Elige exactamente qué optimizaciones aplicar a un host Proxmox VE con ProxMenux. 10 categorías, ~35 herramientas individuales, UI de selección. Incluye todo lo que hace el script Automatizado, más funcionalidades opcionales (IOMMU, Fastfetch, Figurine, Ceph, HA, ajustes de AMD…).",
-    "ogTitle": "Script Personalizable post-instalación | ProxMenux Documentation",
+    "ogTitle": "Script post-instalación personalizable | Documentación de ProxMenux",
     "ogDescription": "10 categorías, ~35 optimizaciones individuales. Elige exactamente qué quieres en un host Proxmox VE. Los cambios reversibles quedan registrados."
   },
   "header": {
     "title": "Script Personalizable post-instalación",
-    "description": "Elige exactamente qué optimizaciones aplicar a un host Proxmox VE. ProxMenux agrupa ~35 herramientas individuales en 10 categorías, cada una con su propio diálogo de selección. Mismo motor que el Automatizado, pero con control total sobre qué se aplica.",
-    "section": "Post-Install · Customizable"
+    "description": "Elige exactamente qué optimizaciones aplicar a un host Proxmox VE. ProxMenux agrupa unas 35 herramientas en 10 categorías dentro de un único diálogo de selección. Usa el mismo motor que Automatizado, con control total sobre lo que se aplica.",
+    "section": "Post-instalación · Personalizable"
   },
   "intro": {
     "title": "Cuándo elegir Personalizable",
-    "body": "Elige esta ruta cuando ya sabes qué ajustes quieres en el host — o cuáles definitivamente no quieres. El script presenta una selección por categoría para que puedas combinar optimizaciones. Las opciones se pueden volver a aplicar y los cambios de configuración reversibles quedan registrados para <link>Uninstall Optimizations</link>. Las actualizaciones de paquetes no se presentan como reversibles."
+    "body": "Elige esta opción si ya sabes qué ajustes quieres en el host o cuáles no quieres. El script muestra una lista con casillas agrupada por categorías para seleccionar, desmarcar y combinar optimizaciones. Puedes volver a aplicarlas después; los cambios reversibles se registran para <link>Desinstalar optimizaciones</link>. Las actualizaciones de paquetes no se presentan como reversibles."
   },
   "compare": {
     "heading": "Comparación con el Automatizado",
-    "body": "Personalizable es un superset del <link>script Automatizado</link>. Cubre las mismas 14 optimizaciones de baseline más una larga lista de opt-ins que el Automatizado se salta a propósito — cosas que solo son útiles en hardware específico (fixes de AMD), hosting específico (OVH RTM), o cargas específicas (IOMMU/VFIO, repo de Ceph, High Availability, Fastfetch, Figurine, tuning del ARC de ZFS, pigz, ZFS auto-snapshot, límites de velocidad de vzdump, Open vSwitch, TCP BBR + TCP Fast Open, refresco del índice del PVE Appliance Manager…)."
+    "body": "Personalizable incluye todo el <link>script Automatizado</link>. Cubre las mismas 14 optimizaciones básicas y una larga lista de opciones que Automatizado omite deliberadamente, útiles para hardware específico (correcciones AMD), alojamiento específico (OVH RTM) o cargas concretas (IOMMU/VFIO, repositorio Ceph, alta disponibilidad, Fastfetch, Figurine, ajuste del ARC de ZFS, pigz, snapshots automáticos de ZFS, límites de velocidad vzdump, Open vSwitch, TCP BBR…)."
   },
   "categoriesSection": {
     "heading": "Las 10 categorías",
-    "body": "El script Personalizable agrupa optimizaciones en 10 categorías. Cada categoría tiene su propio diálogo de selección y su propia página de documentación — abre una de las tarjetas para consultar el razonamiento, los valores predeterminados y los pasos de verificación."
+    "body": "El script Personalizable agrupa las optimizaciones en 10 categorías dentro de un único diálogo de selección. Cada categoría tiene su propia página de documentación; abre una tarjeta para consultar la justificación, los valores predeterminados y la verificación de cada opción."
   },
   "categories": [
     {
-      "name": "Basic Settings",
+      "name": "Ajustes básicos",
       "description": "Sanea las fuentes APT, ejecuta el upgrade oficial de Proxmox y fija zona horaria, locale y utilidades básicas. Es la base sobre la que apoyan todas las demás categorías."
     },
     {
-      "name": "System",
+      "name": "Sistema",
       "description": "Ajusta el subsistema de logs y los límites del kernel para un host que aloja muchas VMs y contenedores. Cubre journald, logrotate, sysctl (memoria, límites de ficheros), comportamiento en panic y reinicios rápidos."
     },
     {
-      "name": "Virtualization",
-      "description": "Prepara el host para virtualización avanzada. Auto-instala el guest agent en las plantillas y activa IOMMU/VFIO para passthrough de dispositivos PCI (GPU, controladoras, TPU)."
+      "name": "Virtualización",
+      "description": "Prepara el host para virtualización avanzada. Instala el agente invitado correspondiente si el propio Proxmox se ejecuta dentro de una VM compatible y activa IOMMU/VFIO para el passthrough PCI de GPU, controladoras y TPU."
     },
     {
-      "name": "Network",
+      "name": "Red",
       "description": "Endurece y afina la pila de red del host. Fuerza APT sobre IPv4, aplica sysctl con hardening y tuning de buffers TCP, ofrece Open vSwitch, TCP BBR + TCP Fast Open, y fija nombres persistentes de interfaces por MAC."
     },
     {
-      "name": "Storage",
+      "name": "Almacenamiento",
       "description": "Configura los subsistemas de almacenamiento habituales de Proxmox: ARC de ZFS, auto-snapshots, ZFS autotrim para pools SSD/NVMe y límites de velocidad de vzdump para evitar saturar el disco durante backups."
     },
     {
-      "name": "Security",
+      "name": "Seguridad",
       "description": "Reduce la superficie de ataque expuesta por defecto. Desactiva los servicios RPC (portmapper/rpcbind) que Proxmox no necesita pero deja escuchando."
     },
     {
-      "name": "Customization",
+      "name": "Personalización",
       "description": "Cambia la experiencia visual y de shell del host: colores y aliases en bashrc, banner MOTD y eliminación del aviso de suscripción del web UI."
     },
     {
-      "name": "Monitoring",
-      "description": "Integra el host con Real-Time Monitoring de OVH. Sólo aparece cuando ProxMenux detecta un servidor OVH."
+      "name": "Monitorización",
+      "description": "Integra el host con OVH Real-Time Monitoring. Solo instala RTM cuando ProxMenux detecta un servidor OVH; en otros hosts no hace cambios."
     },
     {
-      "name": "Performance",
+      "name": "Rendimiento",
       "description": "Acelera las operaciones de compresión (backups, transferencias) sustituyendo gzip por su versión paralela pigz."
     },
     {
-      "name": "Optional",
+      "name": "Opcional",
       "description": "Opciones que no necesita todo host: ajustes de CPU AMD, banner Fastfetch, nombre 3D con Figurine, actualización del índice de PVE Appliance Manager, repositorio Ceph, servicios de alta disponibilidad, Log2RAM para reducir el desgaste del SSD y un perfil de swap con ZRAM."
     }
   ],
   "mixTip": {
     "title": "Mezcla Automatizado y Personalizable",
-    "body": "Un patrón común: ejecutar primero <strong>Automatizado</strong> para fijar el baseline sensato, luego abrir <strong>Personalizable</strong> y elegir solo las herramientas opt-in que te interesan (por ejemplo, IOMMU en un host que va a hacer passthrough de GPU). Los cambios se registran de forma independiente; el menú Uninstall muestra todo lo que has aplicado independientemente de qué ruta lo añadió."
+    "body": "Un uso habitual: ejecuta primero <strong>Automatizado</strong> para aplicar una base sensata, abre después <strong>Personalizable</strong> y elige solo las herramientas opcionales que necesitas, como IOMMU para passthrough de GPU. Los cambios se registran por separado; Desinstalar muestra lo aplicado con independencia de la opción que lo añadió."
   },
   "related": {
     "heading": "Relacionado",
     "items": [
       {
-        "label": "Automated Post-Install",
+        "label": "Post-instalación automatizada",
         "href": "/docs/post-install/automated",
         "tail": " — valores por defecto sensatos aplicados sin preguntas."
       },
       {
-        "label": "Uninstall Optimizations",
+        "label": "Desinstalar optimizaciones",
         "href": "/docs/post-install/uninstall",
         "tail": " — revierte cualquier selección de forma limpia."
       },
       {
-        "label": "Basic Settings",
+        "label": "Ajustes básicos",
         "href": "/docs/post-install/basic-settings",
         "tail": " — repos, hora, idioma, utilidades."
       },
       {
-        "label": "Virtualization",
+        "label": "Virtualización",
         "href": "/docs/post-install/virtualization",
         "tail": " — IOMMU + VFIO para passthrough."
       },
       {
-        "label": "Security",
+        "label": "Seguridad",
         "href": "/docs/post-install/security",
-        "tailRich": " · <storageLink>Storage</storageLink> · <networkLink>Network</networkLink> · <customLink>Customization</customLink> — otras categorías."
+        "tailRich": " · <storageLink>Almacenamiento</storageLink> · <networkLink>Red</networkLink> · <customLink>Personalización</customLink> — otras categorías."
       },
       {
-        "label": "Resumen de Post-Install",
+        "label": "Resumen de post-instalación",
         "href": "/docs/post-install",
         "tail": "."
       }
diff --git a/web/messages/es/docs/post-install/customization.json b/web/messages/es/docs/post-install/customization.json
index 8bf427b7..cfb54007 100644
--- a/web/messages/es/docs/post-install/customization.json
+++ b/web/messages/es/docs/post-install/customization.json
@@ -1,24 +1,24 @@
 {
   "meta": {
-    "title": "Post-instalación: Customización | ProxMenux Documentation",
-    "description": "Opciones de customización en el script post-instalación Customizable de ProxMenux: un prompt de bash con colores y aliases útiles, un banner de ProxMenux en el MOTD, y la opción de eliminar el aviso de suscripción de Proxmox de la interfaz web."
+    "title": "Post-instalación: Personalización | Documentación de ProxMenux",
+    "description": "Opciones de personalización en el script post-instalación Personalizable de ProxMenux: un prompt de bash con colores y alias útiles, un banner de ProxMenux en el MOTD y la opción de eliminar el aviso de suscripción de la interfaz web de Proxmox."
   },
   "header": {
-    "title": "Post-instalación: Customización",
-    "description": "Ajustes estéticos y de comodidad para el host Proxmox. Hacen más agradable el uso de la consola y ocultan el aviso de suscripción de la interfaz web. Bashrc, MOTD y el banner de suscripción quedan registrados y son reversibles desde el menú Uninstall.",
-    "section": "Settings post-install Proxmox"
+    "title": "Post-instalación: Personalización",
+    "description": "Ajustes estéticos y de comodidad para el host Proxmox. Mejoran el uso de la shell y ocultan el aviso de suscripción de la interfaz web. Bashrc, MOTD y el banner de suscripción se registran y se pueden revertir desde Desinstalar.",
+    "section": "Configuración post instalación de Proxmox"
   },
   "intro": {
     "title": "Qué cubre esta categoría",
     "body": "Tres opciones pequeñas e independientes: un <strong>prompt de bash con colores + aliases</strong> para la shell de root, un <strong>banner MOTD</strong> de una línea visible al hacer login por SSH, y la eliminación del <strong>popup \"No valid subscription\"</strong> que Proxmox muestra en cada login a la UI web."
   },
   "bashrc": {
-    "heading": "Customizar bashrc",
+    "heading": "Personalizar bashrc",
     "intro": "Inyecta un bloque curado en <code>/root/.bashrc</code> con un prompt con colores, historial con marcas de tiempo, aliases estándar de <code>ls</code> / <code>grep</code> y un <code>source</code> para autocompletado de bash. Hace que trabajar sobre SSH sea bastante más agradable y deja claro en qué host estás cuando tienes muchas pestañas abiertas.",
     "writesTitle": "Qué añade ProxMenux a .bashrc",
     "writesOutro": "El bloque está delimitado por los marcadores <code>PMX_CORE_BASHRC</code>. Ejecutar el script de nuevo reemplaza el bloque anterior en lugar de duplicarlo. El <code>.bashrc</code> original se respalda una vez en <code>/root/.bashrc.bak</code>, y se añade una línea <code>source /root/.bashrc</code> a <code>/root/.bash_profile</code> para que el prompt también se aplique en shells de login (p. ej. tras <code>su -</code>).",
     "rootTitle": "Solo se aplica a root",
-    "rootBody": "La customización apunta a la shell de la cuenta root. Otros usuarios que crees en el host conservan sus propios valores por defecto. Si administras Proxmox exclusivamente por la UI web y nunca usas la shell, esta opción es pura estética y puedes saltártela."
+    "rootBody": "La personalización afecta a la shell de la cuenta root. Otros usuarios del host conservan sus propios valores predeterminados. Si administras Proxmox exclusivamente desde la interfaz web y nunca usas la shell, puedes omitir esta opción estética."
   },
   "motd": {
     "heading": "Configurar banner MOTD personalizado",
@@ -29,43 +29,43 @@
   "banner": {
     "heading": "Eliminar banner de suscripción",
     "intro": "Elimina el modal <em>\"You do not have a valid subscription for this server\"</em> que aparece cada vez que alguien entra en la UI web de Proxmox sin una suscripción enterprise. El parche es consciente de la versión: las distintas versiones mayores de Proxmox tienen distintos bundles de UI, así que ProxMenux despacha al script correcto.",
-    "versionTitle": "Despacho consciente de la versión",
+    "versionTitle": "Selección de script según la versión",
     "versionItems": [
       "<strong>PVE 9.x</strong> → ejecuta <code>remove-banner-pve-v3.sh</code> (parchea tanto el <code>proxmoxlib.js</code> de escritorio como la nueva UI móvil basada en Yew).",
       "<strong>PVE 8.x</strong> → ejecuta <code>remove-banner-pve8.sh</code> (solo escritorio)."
     ],
     "versionOutro": "Antes de parchear, ProxMenux respalda los archivos JS/template originales en <code>/usr/local/share/proxmenux/backups/</code> con una marca de tiempo. El flujo Uninstall usa esos backups para restaurar los archivos originales, y como fallback reinstala los paquetes de la UI de Proxmox si el backup falta o está corrupto.",
     "breakTitle": "Puede romperse tras actualizaciones de Proxmox",
-    "breakBody": "Proxmox publica regularmente actualizaciones de UI que sobrescriben <code>proxmoxlib.js</code>. Cuando eso pasa, el banner vuelve. Puedes reaplicar esta opción tras cada actualización de Proxmox para volver a parchear el archivo, o simplemente aceptar el aviso hasta que la vuelvas a aplicar. ProxMenux también instala un hook APT que vuelve a parchear automáticamente en los upgrades de paquetes — mira <link>Uninstall Optimizations</link> para ver cómo se revierte ese hook.",
+    "breakBody": "Las actualizaciones de la interfaz de Proxmox pueden sobrescribir <code>proxmoxlib.js</code> y hacer que vuelva el aviso. Puedes volver a aplicar esta opción para parchearlo o mantener el aviso hasta entonces. ProxMenux también instala un hook de APT para volver a parchear tras las actualizaciones de paquetes; consulta <link>Desinstalar optimizaciones</link> para saber cómo se elimina.",
     "legalTitle": "Nota legal (siempre conviene repetirla)",
-    "legalBody": "Esta opción solo oculta el aviso de la UI. <strong>No</strong> te concede soporte enterprise, acceso al repositorio enterprise, ni derecho alguno a distribuir Proxmox comercialmente sin suscripción. Si ejecutas Proxmox en un entorno que genera ingresos, compra una suscripción — apoya al proyecto y te da el canal enterprise estable."
+    "legalBody": "Esta opción solo oculta el aviso de la interfaz. <strong>No</strong> concede soporte Enterprise ni acceso al repositorio Enterprise, y no cambia la licencia del software. Proxmox VE se distribuye bajo GNU AGPLv3. Una suscripción apoya el proyecto y da acceso al canal de actualizaciones Enterprise; elige el nivel de soporte adecuado para tu entorno."
   },
   "verify": {
     "heading": "Verificación",
     "intro": "Tras aplicar los tres:",
     "reversibleTitle": "Los tres cambios de personalización quedan registrados",
-    "reversibleBody": "<link>Uninstall Optimizations</link> restaura <code>/root/.bashrc</code>, devuelve MOTD exactamente al contenido anterior a ProxMenux (o elimina el archivo si antes no existía) y restaura los archivos parcheados de la interfaz desde sus copias o reinstala los paquetes de Proxmox afectados cuando sea necesario."
+    "reversibleBody": "<link>Desinstalar optimizaciones</link> restaura <code>/root/.bashrc</code>, devuelve MOTD al contenido exacto anterior a ProxMenux o elimina el archivo si antes no existía, y restaura los archivos de interfaz parcheados desde sus copias o reinstala los paquetes afectados cuando sea necesario."
   },
   "related": {
     "heading": "Relacionado",
     "items": [
       {
-        "label": "Optional",
+        "label": "Opcional",
         "href": "/docs/post-install/optional",
-        "tail": " — Fastfetch y Figurine (otras customizaciones visuales)."
+        "tail": " — Fastfetch y Figurine, otras personalizaciones visuales."
       },
       {
         "label": "Mostrar información de versión",
         "href": "/docs/settings/show-version-information",
-        "tail": " — confirma que las customizaciones están registradas como instaladas."
+        "tail": " — confirma que las personalizaciones están registradas como instaladas."
       },
       {
-        "label": "Uninstall Optimizations",
+        "label": "Desinstalar optimizaciones",
         "href": "/docs/post-install/uninstall",
         "tail": " — revierte bashrc, motd, aviso de suscripción."
       },
       {
-        "label": "Customizable Post-Install",
+        "label": "Post-instalación personalizable",
         "href": "/docs/post-install/customizable",
         "tail": " — volver al menú padre."
       }
diff --git a/web/messages/es/docs/post-install/index.json b/web/messages/es/docs/post-install/index.json
index 05bd570f..12b41d67 100644
--- a/web/messages/es/docs/post-install/index.json
+++ b/web/messages/es/docs/post-install/index.json
@@ -1,7 +1,7 @@
 {
   "meta": {
     "title": "Script post-instalación de Proxmox VE — Automatizado y personalizable | ProxMenux",
-    "description": "Resumen de los scripts post-instalación de ProxMenux para Proxmox VE. Ejecuta el script Automatizado para aplicar valores recomendados sin preguntas, usa Personalizable para elegir entre 10 categorías o restaura los cambios reversibles compatibles mediante Uninstall Optimizations.",
+    "description": "Resumen de los scripts post-instalación de ProxMenux para Proxmox VE. Ejecuta el script Automatizado para aplicar valores recomendados sin preguntas, usa Personalizable para elegir exactamente lo que quieres entre 10 categorías o restaura los cambios reversibles compatibles mediante Desinstalar optimizaciones.",
     "ogTitle": "Script post-instalación de Proxmox VE — Automatizado y personalizable",
     "ogDescription": "Aplica optimizaciones comunes post-instalación de Proxmox VE en 10 categorías — automatizadas o a la carta, con opciones reversibles.",
     "twitterTitle": "Script post-instalación de Proxmox VE | ProxMenux",
@@ -10,7 +10,7 @@
   "header": {
     "title": "Scripts post-instalación",
     "description": "Configura un host de Proxmox VE recién instalado con las optimizaciones post-instalación de ProxMenux. Aplica la configuración base automáticamente, elige opciones individuales, actualiza funciones instaladas o restaura cambios reversibles compatibles. Las actualizaciones de paquetes no se presentan como reversibles.",
-    "section": "Settings post-install Proxmox"
+    "section": "Configuración post instalación de Proxmox"
   },
   "intro": {
     "title": "Para qué sirve este menú",
@@ -18,8 +18,8 @@
   },
   "openingMenu": {
     "heading": "Abrir el menú",
-    "body": "Desde el menú principal de ProxMenux, selecciona <strong>Settings post-install Proxmox</strong>. Verás esto:",
-    "imageAlt": "Menú de scripts post-instalación — Automatizado, Personalizable, la entrada condicional Aplicar Actualizaciones Disponibles (solo cuando hay updates pendientes) y Uninstall, seguidos de la sección Community Scripts"
+    "body": "Desde el menú principal de ProxMenux, selecciona <strong>Configuración post instalación de Proxmox</strong>. Verás esto:",
+    "imageAlt": "Menú de scripts post-instalación: Automatizado, Personalizable, la entrada condicional Aplicar actualizaciones disponibles (solo cuando hay actualizaciones pendientes) y Desinstalar, seguidos de la sección Scripts de la comunidad"
   },
   "threeWays": {
     "heading": "Cuatro formas de aplicar optimizaciones",
@@ -34,29 +34,29 @@
         "Tuning de memoria, kernel y red",
         "Log2RAM (autodetectado en SSD/NVMe)",
         "Límites de tamaño de journald + logrotate",
-        "Nombres de interfaz persistentes"
+        "Nombres persistentes de interfaz"
       ]
     },
     {
       "title": "Personalizable",
       "description": "~35 optimizaciones individuales en 10 categorías. Eliges exactamente cuáles aplicar. Mismo motor que el Automatizado, pero con control total.",
       "bullets": [
-        "UI de checklist por categoría",
-        "Incluye todo lo que hace el Automatizado, más opciones opt-in (IOMMU, Fastfetch, Figurine, Ceph, HA, fixes de AMD…)",
+        "Interfaz con casillas de selección por categoría",
+        "Incluye todo lo que hace Automatizado, más opciones que debes activar expresamente (IOMMU, Fastfetch, Figurine, Ceph, HA, correcciones de AMD…)",
         "Ejecuta tantas veces como quieras — los cambios son idempotentes"
       ]
     },
     {
-      "title": "Apply Available Updates",
-      "description": "Cuando una optimización post-instalación (Log2Ram, Memory Settings, Logrotate…) tiene en disco una versión más nueva que la registrada en el host, esta entrada muestra solo las que se han movido. Re-ejecuta la función correspondiente y refresca el registro — no toca nada más.",
+      "title": "Aplicar actualizaciones disponibles",
+      "description": "Cuando una optimización post-instalación (Log2Ram, ajustes de memoria, Logrotate…) tiene en disco una versión más nueva que la registrada en el host, esta entrada muestra solo las optimizaciones que han cambiado. Vuelve a ejecutar la función correspondiente y actualiza el registro, sin tocar nada más.",
       "bullets": [
-        "Opt-in por optimización (solo lo que ha cambiado)",
+        "Aceptación individual por optimización (solo lo que ha cambiado)",
         "Mismo selector disponible desde el panel del Monitor",
         "Una única notificación agrupada cuando llegan actualizaciones nuevas"
       ]
     },
     {
-      "title": "Uninstall Optimizations",
+      "title": "Desinstalar optimizaciones",
       "description": "Los cambios reversibles compatibles quedan registrados en un JSON y asociados a una función de restauración. Las acciones sin reversión segura, como una actualización completa de paquetes, se excluyen deliberadamente.",
       "bullets": [
         "Detecta automáticamente las optimizaciones aplicadas previamente",
@@ -66,7 +66,7 @@
     }
   ],
   "whichTitle": "¿Cuál deberías elegir?",
-  "whichBody": "Si es una instalación recién hecha de Proxmox y quieres el baseline sensato sin tener que decidir: <autoLink><strong>Automatizado</strong></autoLink>. Si ya sabes qué tweaks quieres (o cuáles definitivamente no quieres): <customLink><strong>Personalizable</strong></customLink>. Si algo que ya aplicaste tiene una versión más nueva en disco y solo quieres subir esa: <updatesLink><strong>Apply Available Updates</strong></updatesLink>. Si aplicaste algo antes y quieres revertirlo de forma limpia: <uninstallLink><strong>Uninstall Optimizations</strong></uninstallLink>. Puedes mezclarlas — aplicar primero Automatizado, luego abrir Personalizable para añadir opt-ins como Fastfetch o IOMMU, y revertir cualquier item individual más tarde.",
+  "whichBody": "Si acabas de instalar Proxmox y quieres una base sensata sin tomar decisiones: <autoLink><strong>Automatizado</strong></autoLink>. Si ya sabes qué ajustes quieres o cuáles no quieres: <customLink><strong>Personalizable</strong></customLink>. Si una optimización aplicada tiene una versión más nueva en disco y solo quieres actualizar esa: <updatesLink><strong>Aplicar actualizaciones disponibles</strong></updatesLink>. Para revertir algo aplicado anteriormente: <uninstallLink><strong>Desinstalar optimizaciones</strong></uninstallLink>. Puedes combinarlos: aplica primero Automatizado, abre después Personalizable para añadir opciones como Fastfetch o IOMMU y revierte cualquier elemento individual más adelante.",
   "mixing": {
     "heading": "Mezclar con otros scripts post-instalación",
     "stackTitle": "No apiles varios scripts post-instalación",
@@ -75,14 +75,25 @@
     "xshokBody": "Versiones anteriores de ProxMenux referenciaban <a>xshok-proxmox</a> como herramienta post-instalación complementaria. Ese proyecto ahora está deprecado y ya no se ofrece desde ProxMenux. Si una ejecución anterior de xshok-proxmox dejó marcadores en el host, ProxMenux todavía los detecta y te avisa — pero no es algo que debas instalar junto a ProxMenux hoy."
   },
   "community": {
-    "heading": "Community scripts",
-    "body": "El menú también expone dos scripts de terceros del proyecto <a>community-scripts</a>: <em>Proxmox VE Post Install</em> y <em>Proxmox VE Microcode</em>. Son wrappers que hacen <code>wget | bash</code> de los scripts de los autores originales. No los mantiene ProxMenux. Mira <link>External Repositories</link> para detalles y consideraciones de confianza antes de ejecutarlos."
+    "heading": "Scripts de la comunidad",
+    "body": "El menú también ofrece dos scripts de terceros del proyecto <a>community-scripts</a>: <em>Proxmox VE Post Install</em> y <em>Proxmox VE Microcode</em>. Son envoltorios que descargan y ejecutan los scripts originales mediante <code>wget | bash</code>. ProxMenux no los mantiene. Consulta <link>Repositorios externos</link> para conocer los detalles y valorar la confianza antes de ejecutarlos."
+  },
+  "pbs": {
+    "heading": "En Proxmox Backup Server",
+    "body": "En un host Proxmox Backup Server, el mismo menú se abre desde <strong>Configuración post instalación de Proxmox</strong> en el menú de PBS. Automatizado, Personalizable, Aplicar actualizaciones disponibles y Desinstalar optimizaciones funcionan igual que en Proxmox VE, con estas diferencias:",
+    "items": [
+      "<strong>Repositorios y actualización:</strong> cuando el servidor no tiene suscripción y solo está activo el repositorio Enterprise de PBS, ProxMenux pregunta antes de cambiar al repositorio sin suscripción de PBS. El cambio se hace con la API de repositorios del propio servidor, la misma que usa <em>Administration > Repositories</em>. Con una suscripción activa, o con un repositorio sin suscripción o de pruebas ya configurado, las fuentes se mantienen como están.",
+      "<strong>Lista personalizable:</strong> no aparecen las opciones que solo se aplican a Proxmox VE: agente de invitado, VFIO IOMMU, Open vSwitch, velocidad de backups vzdump, pigz, Appliance Manager, Ceph, alta disponibilidad y OVH Real Time Monitoring.",
+      "<strong>Banner de suscripción:</strong> el parche se aplica a la interfaz web de Proxmox Backup Server, y Desinstalar optimizaciones lo restaura.",
+      "<strong>Figurine:</strong> se instala sin los alias de Proxmox VE.",
+      "<strong>Scripts comunitarios:</strong> la sección ofrece <em>Proxmox Backup Server Post Install</em> y <em>Proxmox Backup Server Microcode</em> en lugar de los scripts de Proxmox VE."
+    ]
   },
   "related": {
     "heading": "Relacionado",
     "items": [
       {
-        "label": "Proxmox System Update",
+        "label": "Actualización del sistema Proxmox",
         "href": "/docs/utils/system-update",
         "tail": " — mantiene el host actualizado una vez ya se ha hecho la post-instalación."
       },
diff --git a/web/messages/es/docs/post-install/monitoring.json b/web/messages/es/docs/post-install/monitoring.json
index eee9ef79..f3f892a6 100644
--- a/web/messages/es/docs/post-install/monitoring.json
+++ b/web/messages/es/docs/post-install/monitoring.json
@@ -1,12 +1,12 @@
 {
   "meta": {
-    "title": "Post-instalación: Monitorización | ProxMenux Documentation",
-    "description": "Opciones de monitorización en el script post-instalación Customizable de ProxMenux. Por ahora una sola opción: instalar OVH Real-Time Monitoring (RTM), que solo se activa si se detecta que el host es un servidor OVH."
+    "title": "Post-instalación: Monitorización | Documentación de ProxMenux",
+    "description": "Opciones de monitorización en el script post-instalación Personalizable de ProxMenux. Por ahora una sola opción: instalar OVH Real-Time Monitoring (RTM), que solo se activa si se detecta que el host es un servidor OVH."
   },
   "header": {
     "title": "Post-instalación: Monitorización",
-    "description": "Opciones de monitorización dentro del script post-instalación Customizable. Esta categoría es pequeña y específica del proveedor — instala el agente OVH Real-Time Monitoring en servidores dedicados de OVH y no hace nada en cualquier otro sitio.",
-    "section": "Settings post-install Proxmox"
+    "description": "Opciones de monitorización del script post-instalación Personalizable. Esta categoría es pequeña y específica del proveedor: instala el agente OVH Real-Time Monitoring en servidores dedicados de OVH y no hace nada en otros servidores.",
+    "section": "Configuración post instalación de Proxmox"
   },
   "intro": {
     "title": "Alcance estrecho a propósito",
@@ -23,15 +23,15 @@
       "Si el resultado <em>no</em> menciona OVH, no se instala nada. La opción es un no-op."
     ],
     "remoteTitle": "Script remoto pasado por tubería a bash",
-    "remoteBody": "La instalación ejecuta <code>wget -qO - https://…apply.sh | bash</code>. Si el mirror de OVH se ve comprometido alguna vez, el script se ejecuta como root en tu host. Antes de activar esta opción, decide si confías más en la cadena de mirrors de OVH que en la monitorización que ganas. Para la mayoría de usuarios de home-lab o no-OVH esta opción debería quedarse simplemente apagada.",
+    "remoteBody": "La instalación ejecuta <code>wget -qO - https://…apply.sh | bash</code>. Si el servidor espejo de OVH se ve comprometido, el script se ejecutará como root en tu host. Antes de activar esta opción, valora la confianza en la cadena de servidores espejo de OVH frente al beneficio de monitorización. Para la mayoría de usuarios de laboratorios domésticos o servidores ajenos a OVH, la opción debe permanecer desactivada.",
     "noOpTitle": "Actívalo solo si el host está realmente en OVH",
-    "noOpBody": "La opción es un no-op en servidores no-OVH, así que marcarla en un Proxmox de home-lab no rompe nada. En un host no-OVH el script imprime <em>\"Not an OVH server, skipping RTM installation\"</em> y termina limpiamente; no se instala ningún paquete.",
+    "noOpBody": "La opción no hace cambios en servidores ajenos a OVH, así que marcarla en un Proxmox doméstico no rompe nada. El script muestra <em>«No es un servidor OVH, se omite la instalación de RTM»</em> y termina sin instalar paquetes.",
     "runsTitle": "Qué ejecuta ProxMenux",
     "verifyTitle": "Verificación",
     "verifyBody": "En un host OVH real, tras un reinicio deberías ver el <a>panel de RTM</a> en tu OVH Manager con datos en vivo del host. En el lado de Proxmox, el colector RTM es un servicio systemd — compruébalo directamente:",
     "troubleTitle": "Solución de problemas",
-    "revertTitle": "No reversible desde el menú Uninstall",
-    "revertBody": "No hay una entrada de uninstall dedicada para RTM. En un host OVH real, elimina los paquetes a mano con <code>apt purge ovh-*</code> y borra cualquier manifest puppet bajo <code>/etc/puppet/</code> que RTM haya instalado. En un host no-OVH no se instaló nada, así que no hay nada que revertir."
+    "revertTitle": "Eliminar RTM desde el menú Desinstalar",
+    "revertBody": "Cuando RTM está registrado como instalado, Desinstalar optimizaciones ofrece una entrada OVH Real-Time Monitoring. Ejecuta <code>apt-get purge -y ''ovh-rtm*'' ''rtm'' ''rtm-*''</code>, elimina /etc/rtm y marca RTM como desinstalado. Los restos de Puppet pueden requerir limpieza manual; revisa los manifiestos específicos de RTM en <code>/etc/puppet/</code>. En un host ajeno a OVH no se instalaron paquetes RTM, así que no hay nada que eliminar."
   },
   "related": {
     "heading": "Relacionado",
@@ -47,7 +47,7 @@
         "tail": " — referencia de monitorización del host local."
       },
       {
-        "label": "Customizable Post-Install",
+        "label": "Post-instalación personalizable",
         "href": "/docs/post-install/customizable",
         "tail": " — volver al menú padre."
       }
diff --git a/web/messages/es/docs/post-install/network.json b/web/messages/es/docs/post-install/network.json
index 9e7c1664..f60275d6 100644
--- a/web/messages/es/docs/post-install/network.json
+++ b/web/messages/es/docs/post-install/network.json
@@ -1,11 +1,11 @@
 {
   "meta": {
-    "title": "Post-instalación: Red | ProxMenux Documentation",
-    "description": "Optimizaciones relacionadas con la red en el script post-instalación Customizable de ProxMenux: forzar APT sobre IPv4, aplicar un perfil curado de tuning de sysctl, instalar Open vSwitch, activar TCP BBR + Fast Open, y fijar nombres de interfaz a sus direcciones MAC."
+    "title": "Post-instalación: Red | Documentación de ProxMenux",
+    "description": "Opciones de red de la post-instalación personalizable de ProxMenux: forzar APT sobre IPv4, aplicar un perfil sysctl seleccionado, instalar Open vSwitch, activar TCP BBR + Fast Open y vincular los nombres de interfaz a sus direcciones MAC."
   },
   "header": {
     "title": "Post-instalación: Red",
-    "section": "Settings post-install Proxmox"
+    "section": "Configuración post instalación de Proxmox"
   },
   "intro": {
     "title": "Qué cubre esta categoría",
@@ -19,13 +19,13 @@
   },
   "sysctl": {
     "heading": "Aplicar optimizaciones de red",
-    "intro": "Escribe un perfil sysctl curado en <code>/etc/sysctl.d/99-network.conf</code> que cubre buffers de socket core, hardening de ICMP, protección básica contra spoof y tamaños de buffer TCP que tienen sentido en un hipervisor con muchos flujos concurrentes.",
-    "tunedTitle": "Qué se tunea",
+    "intro": "Escribe un perfil sysctl seleccionado en <code>/etc/sysctl.d/99-network.conf</code> que ajusta los búferes de sockets del núcleo, refuerza ICMP, añade protección básica contra suplantación y configura búferes TCP adecuados para un hipervisor con muchos flujos simultáneos.",
+    "tunedTitle": "Qué se ajusta",
     "headerArea": "Área",
     "headerSettings": "Ajustes clave",
     "rows": [
       {
-        "area": "Buffers de socket core",
+        "area": "Búferes de sockets del núcleo",
         "settings": "<code>netdev_max_backlog=8192</code>, <code>rmem_max=16M</code>, <code>wmem_max=16M</code>, <code>somaxconn=8192</code>"
       },
       {
@@ -37,7 +37,7 @@
         "settings": "<code>accept_redirects=0</code>, <code>accept_source_route=0</code>, <code>secure_redirects=0</code>, <code>send_redirects=0</code>, <code>log_martians=0</code>"
       },
       {
-        "area": "Reverse path filter",
+        "area": "Filtro de ruta inversa",
         "settings": "<code>rp_filter=2</code> (modo loose, mira la nota abajo)"
       },
       {
@@ -64,17 +64,17 @@
     "intro": "Instala <code>openvswitch-switch</code> + <code>openvswitch-common</code>. Estos paquetes añaden OVS como implementación alternativa de bridges a los bridges Linux estándar que Proxmox usa por defecto. La instalación por sí sola no cambia ninguna configuración de red — los bridges <code>vmbrX</code> existentes siguen funcionando. OVS pasa a estar disponible en la UI de Proxmox cuando <em>creas</em> un bridge nuevo y lo eliges del desplegable de tipo.",
     "tipTitle": "Cuándo tiene sentido OVS",
     "tipBody": "Considera OVS si necesitas <strong>trunking VLAN con IDs de VLAN no contiguos</strong>, <strong>LACP con LLDP en modos específicos</strong>, <strong>programación de flujos granular</strong> (OpenFlow), o interoperación con controladores SDN. Para un home lab con un par de VLANs y un único uplink LACP, los bridges Linux estándar + <code>vmbrX.VID</code> son más simples y van perfectamente bien.",
-    "revertTitle": "Reversible desde el menú Uninstall",
-    "revertBody": "OVS está registrado. <link>Uninstall Optimizations</link> ejecuta <code>apt purge</code> sobre <code>openvswitch-switch</code> y <code>openvswitch-common</code>. Migra cualquier bridge OVS de vuelta a bridges Linux <em>antes</em> de desinstalar, si no las VMs sobre esos bridges pierden red en el próximo arranque. Equivalente manual:"
+    "revertTitle": "Reversible desde el menú Desinstalar",
+    "revertBody": "OVS queda registrado. <link>Desinstalar optimizaciones</link> ejecuta <code>apt purge</code> sobre <code>openvswitch-switch</code> y <code>openvswitch-common</code>. Migra los bridges OVS a bridges Linux <em>antes</em> de desinstalar; de lo contrario, sus VM perderán la red en el próximo arranque. Equivalente manual:"
   },
   "bbr": {
     "heading": "Activar TCP BBR + TCP Fast Open",
-    "intro": "Escribe dos archivos sysctl y los recarga. BBR sustituye el control de congestión por defecto CUBIC por el algoritmo basado en ancho de banda de Google, que maneja long-fat pipes y enlaces con pérdidas mucho mejor. TCP Fast Open (TFO) elimina un round trip en conexiones TCP repetidas al transportar datos en el SYN.",
+    "intro": "Escribe dos archivos sysctl y los recarga. BBR sustituye el control de congestión CUBIC por el algoritmo de Google basado en ancho de banda, que gestiona mejor los enlaces de gran capacidad y alta latencia y los enlaces con pérdidas. TCP Fast Open (TFO) elimina un intercambio de ida y vuelta en conexiones TCP repetidas enviando datos en el SYN.",
     "verifyTitle": "Verificación",
     "impactTitle": "El impacto depende de la carga",
     "impactBody": "BBR brilla en enlaces de alta latencia o con pérdidas (replicación intercontinental, túneles VPN, clientes móviles). En una LAN entre dos máquinas en el mismo switch, la diferencia a menudo está dentro del ruido. TFO ayuda más a conexiones HTTP cortas y repetidas.",
-    "revertTitle": "Reversible desde el menú Uninstall",
-    "revertBody": "BBR/TFO están registrados. <link>Uninstall Optimizations</link> elimina los dos ficheros sysctl (<code>/etc/sysctl.d/99-tcp-bbr.conf</code> y <code>99-tcp-fastopen.conf</code>) y recarga sysctl para que el kernel vuelva a <code>cubic</code> y a <code>tcp_fastopen=1</code>. Equivalente manual:"
+    "revertTitle": "Reversible desde el menú Desinstalar",
+    "revertBody": "BBR/TFO quedan registrados. <link>Desinstalar optimizaciones</link> elimina los dos archivos sysctl (<code>/etc/sysctl.d/99-kernel-bbr.conf</code> y <code>99-tcp-fastopen.conf</code>) y recarga la configuración restante. Borrar un archivo no restablece sus valores activos en el núcleo. Los valores predeterminados como <code>cubic</code> y <code>tcp_fastopen=1</code> vuelven tras reiniciar, salvo que otra configuración los sobrescriba. Equivalente manual:"
   },
   "names": {
     "heading": "Nombres de interfaz (persistentes)",
@@ -83,17 +83,17 @@
     "whyItems": [
       "Añadir o quitar dispositivos PCIe puede desplazar la numeración del bus, convirtiendo <code>enp3s0</code> en <code>enp4s0</code>. Si tu <code>/etc/network/interfaces</code> referencia el nombre antiguo, el bridge desaparece al reiniciar.",
       "Actualizaciones de BIOS / firmware a veces cambian cómo se enumeran los dispositivos, con el mismo efecto.",
-      "Contenedores LXC con NICs <code>hotplug</code> y enlaces bonded pueden hacer race en el arranque y acabar nombrados de forma inconsistente. Fijarlos lo soluciona."
+      "El auxiliar escribe archivos <code>.link</code> para las NIC físicas, incluidos los puertos de los bonds, con la MAC que muestra sysfs en ese momento; en los puertos de un bond puede ser la MAC compartida del bond, así que comprueba sus nombres tras reiniciar. Omite interfaces virtuales como veth de LXC y los propios dispositivos bond; no corrige carreras de nombres de NIC virtuales <code>hotplug</code>."
     ],
     "writtenTitle": "Qué se escribe",
     "writtenIntro": "Un archivo por NIC física, en <code>/etc/systemd/network/10-proxmenux-&lt;iface&gt;.link</code>. Cada archivo comienza con la cabecera <code># Managed by ProxMenux — do not edit</code>, marca que permite a ProxMenux distinguir sus propios archivos de los <code>.link</code> provistos por el usuario o por otros paquetes.",
     "writtenOutro": "Los archivos <code>.link</code> de otros paquetes o escritos a mano por el usuario se dejan intactos — solo se gestionan los archivos que llevan la cabecera de ProxMenux. En cada nueva ejecución la función reconcilia su propio conjunto: relee <code>MACAddress=</code> de cada <code>10-proxmenux-*.link</code> y elimina los cuya MAC ya no aparece en <code>/sys/class/net/</code>. Los archivos escritos por una versión antigua de ProxMenux en el formato <code>10-&lt;iface&gt;.link</code> se migran automáticamente en la primera ejecución.",
     "pveTitle": "PVE 9 vs PVE 8",
-    "pveBody": "En Proxmox VE 9 (<code>systemd-networkd</code> nativo), el script recarga las reglas udev tras escribir los archivos <code>.link</code> para que las nuevas NICs hotplug cojan el nombre correcto sin reiniciar. En PVE 8 (<code>ifupdown2</code>), el naming de interfaz se resuelve en el arranque de todos modos — se requiere un reinicio para que los cambios surtan efecto. El script activa el flag de reinicio en cualquier caso para que Personalizable te lo pregunte.",
+    "pveBody": "El script utiliza archivos <code>.link</code> de systemd para los nombres persistentes. En Proxmox VE 9 también recarga las reglas udev al escribirlos, para que una NIC ya fijada que se vuelva a conectar o detectar aplique su regla sin reiniciar. Comprueba las interfaces existentes tras reiniciar tanto en PVE 8 como en PVE 9. Esto no sustituye <code>ifupdown2</code> en el host. El script marca el reinicio como necesario en ambos casos para que la post-instalación personalizable lo solicite.",
     "reviewTitle": "Revisa antes el /etc/network/interfaces existente",
     "reviewBody": "Si tu host tiene configuración legacy en <code>/etc/network/interfaces</code> que referencia nombres de NIC generados por el esquema por defecto del kernel, fijar los nombres <em>de hoy</em> es exactamente lo que quieres. Pero si ya has customizado manualmente la configuración alrededor de nombres específicos, comprueba dos veces que el pinning coincide con lo que el archivo interfaces espera antes de reiniciar.",
-    "revertTitle": "Reversible desde el menú Uninstall",
-    "revertBody": "<link>Uninstall Optimizations</link> solo borra los archivos <code>10-proxmenux-*.link</code> que llevan la cabecera de ProxMenux en <code>/etc/systemd/network/</code>. Cualquier archivo <code>.link</code> añadido por el usuario o por otro paquete se preserva. Los nombres de interfaz vuelven al comportamiento por defecto de systemd en el siguiente reinicio."
+    "revertTitle": "Reversible desde el menú Desinstalar",
+    "revertBody": "<link>Desinstalar optimizaciones</link> elimina solo los archivos <code>10-proxmenux-*.link</code> con cabecera ProxMenux de <code>/etc/systemd/network/</code>. Conserva cualquier <code>.link</code> añadido por el usuario u otro paquete. Los nombres vuelven al comportamiento predeterminado de systemd al reiniciar."
   },
   "related": {
     "heading": "Relacionado",
@@ -114,12 +114,12 @@
         "tail": " — ip, ss, ethtool, sysctl."
       },
       {
-        "label": "Uninstall Optimizations",
+        "label": "Desinstalar optimizaciones",
         "href": "/docs/post-install/uninstall",
         "tail": " — revierte cualquiera de estos cambios de red."
       },
       {
-        "label": "Customizable Post-Install",
+        "label": "Post-instalación personalizable",
         "href": "/docs/post-install/customizable",
         "tail": " — volver al menú padre."
       }
diff --git a/web/messages/es/docs/post-install/optional.json b/web/messages/es/docs/post-install/optional.json
index 0882f1ac..1d7dc558 100644
--- a/web/messages/es/docs/post-install/optional.json
+++ b/web/messages/es/docs/post-install/optional.json
@@ -1,13 +1,13 @@
 {
   "meta": {
-    "title": "ProxMenux Post-instalación: Optional Settings",
-    "description": "Guía de Optional Settings en el script post-instalación de ProxMenux para funcionalidades y optimizaciones adicionales de Proxmox VE.",
-    "ogTitle": "ProxMenux Post-instalación: Optional Settings",
-    "ogDescription": "Guía de Optional Settings en el script post-instalación de ProxMenux para funcionalidades y optimizaciones adicionales de Proxmox VE.",
-    "ogImageAlt": "ProxMenux Post-instalación Optional Settings"
+    "title": "Post-instalación de ProxMenux: Ajustes opcionales",
+    "description": "Guía de los ajustes opcionales del script post-instalación de ProxMenux para añadir funciones y optimizaciones a Proxmox VE.",
+    "ogTitle": "Post-instalación de ProxMenux: Ajustes opcionales",
+    "ogDescription": "Guía de los ajustes opcionales del script post-instalación de ProxMenux para añadir funciones y optimizaciones a Proxmox VE.",
+    "ogImageAlt": "Ajustes opcionales post-instalación de ProxMenux"
   },
-  "title": "Optional Settings",
-  "intro": "La categoría <strong>Optional Settings</strong> ofrece funcionalidades y optimizaciones adicionales que puedes elegir aplicar a tu instalación de Proxmox VE. Estos ajustes no son esenciales pero pueden mejorar las capacidades de tu sistema en escenarios específicos.",
+  "title": "Ajustes opcionales",
+  "intro": "La categoría <strong>Ajustes opcionales</strong> ofrece funciones y optimizaciones adicionales para tu instalación de Proxmox VE. No son esenciales, pero pueden mejorar las capacidades del sistema en situaciones concretas.",
   "available": "Funcionalidades opcionales disponibles",
   "stepLabel": "Paso",
   "ceph": {
@@ -24,7 +24,7 @@
     "automates": "Este ajuste automatiza los siguientes comandos:"
   },
   "amd": {
-    "title": "Aplicar fixes para CPUs AMD",
+    "title": "Aplicar correcciones para CPU AMD",
     "intro": "Esta opción aplica fixes específicos para CPUs AMD EPYC y Ryzen para mejorar la estabilidad y la compatibilidad.",
     "doesIntro": "Qué hace:",
     "doesItems": [
@@ -32,11 +32,11 @@
       "Aplica el parámetro de kernel 'idle=nomwait' para prevenir crashes aleatorios (vía /etc/kernel/cmdline en hosts con systemd-boot, o /etc/default/grub en hosts con GRUB — con un .bak del original)",
       "Configura KVM para que ignore ciertos MSRs (Model Specific Registers) y mejorar la compatibilidad con guests Windows"
     ],
-    "howUse": "Cómo usarlo: Estos fixes se aplican automáticamente y requieren un reinicio del sistema para surtir efecto.",
+    "howUse": "Cómo usarlo: Estas correcciones se aplican automáticamente y requieren reiniciar el sistema para surtir efecto.",
     "automates": "Este ajuste automatiza los siguientes comandos:"
   },
   "ha": {
-    "title": "Activar servicios High Availability",
+    "title": "Activar servicios de alta disponibilidad",
     "intro": "Esta opción activa los servicios High Availability (HA) en Proxmox VE, permitiendo failover automático de VMs y contenedores en caso de fallo de un nodo.",
     "doesIntro": "Qué hace:",
     "doesItems": [
@@ -64,8 +64,8 @@
     "doesLabel": "Qué hace:",
     "doesItems": [
       "Descarga e instala silenciosamente la última versión de Fastfetch",
-      "Te permite elegir un logo personalizado (<strong>ProxMenux, Proxmox, Helper-Scripts, Home-Labs-Club, Proxmology</strong>, o uno custom)",
-      "Configura Fastfetch para mostrar <em>\"System optimised by ProxMenux\"</em>",
+      "Permite elegir un logo (<strong>ProxMenux, Proxmox, Helper-Scripts, Home-Labs-Club, Proxmology</strong> o uno personalizado)",
+      "Configura Fastfetch para mostrar <em>«Sistema optimizado por ProxMenux»</em>",
       "Configura Fastfetch para que se ejecute automáticamente al hacer login en consola"
     ],
     "importantLabel": "Importante:",
@@ -119,9 +119,9 @@
     "intro": "Esta opción instala y configura Figurine, una herramienta que crea banners de texto ASCII con estilo para tu terminal, mostrando tu hostname en un formato 3D atractivo visualmente.",
     "doesLabel": "Qué hace:",
     "doesItems": [
-      "Descarga e instala Figurine v2.0.0 desde GitHub",
+      "Descarga e instala Figurine v2.1.1 desde GitHub para la arquitectura del host (AMD64, ARM64 o ARMv7)",
       "Crea un mensaje de bienvenida que muestra tu hostname en ASCII art 3D al hacer login",
-      "Elimina automáticamente cualquier instalación previa de Figurine si la hay",
+      "Actualiza el binario existente de Figurine tras descargar y extraer el paquete correctamente",
       "Configura el mensaje de bienvenida para que se ejecute automáticamente al hacer login"
     ],
     "practicalLabel": "Uso práctico:",
@@ -133,7 +133,7 @@
   },
   "log2ram": {
     "title": "Instalar Log2RAM (reducción de desgaste en SSD/NVMe)",
-    "intro": "Log2RAM monta <code>/var/log</code> sobre una ramdisk tmpfs y sincroniza periódicamente el contenido al disco subyacente. En un hipervisor el churn de journald golpea el SSD del sistema cada pocos segundos; mover las escrituras a RAM reduce el desgaste y la I/O de disco sin perder logs — la sincronización periódica los vuelca a disco y un apagado limpio también los vuelca.",
+    "intro": "Log2RAM monta <code>/var/log</code> en una ramdisk tmpfs y lo sincroniza periódicamente al disco. Almacenar temporalmente en RAM las escrituras frecuentes de journald puede reducir el desgaste del SSD y la E/S. La sincronización y un apagado limpio guardan los registros, pero un corte brusco puede perder las entradas posteriores a la última sincronización.",
     "upstreamLabel": "Proyecto oficial:",
     "upstreamUrl": "https://github.com/azlux/log2ram",
     "upstreamLinkLabel": "azlux/log2ram en GitHub",
@@ -146,12 +146,12 @@
       "Instala un guardián de auto-sync en <code>/usr/local/bin/log2ram-check.sh</code>, conectado a <code>/etc/cron.d/log2ram-auto-sync</code> para ejecutarse cada 10 minutos. Cuando <code>/var/log</code> alcanza el 80% del tamaño de la ramdisk el guardián compacta journald; al 92% primero ejecuta <code>logrotate -f /etc/logrotate.d/proxmox-backup-api</code> si ese archivo existe (para forzar la rotación de los logs del API de PBS, que suelen ser los que más crecen en un host con PBS) y a continuación trunca <code>pveproxy access/error</code> y <code>pveam.log</code> antes de sincronizar. El comando <code>log2ram write</code> por sí solo copia tmpfs a disco pero NO reduce la tmpfs, así que este guardián evita que PVE caiga con <em>No space left on device</em> cuando los logs crecen sin control.",
       "Detecta si <code>proxmox-backup-server</code> corre como servicio en el host. Cuando está presente, deposita <code>/etc/logrotate.d/proxmox-backup-api</code> (rotación de 20 MB × 3) y <code>/etc/cron.hourly/proxmox-backup-logrotate</code>, de forma que los logs del API de PBS — el origen habitual del crecimiento en un host con PBS — queden acotados incluso entre las sincronizaciones periódicas de Log2RAM. En hosts sin PBS este paso es un no-op.",
       "Ajusta los límites de systemd-journald (<code>SystemMaxUse</code>, <code>RuntimeMaxUse</code>) para que quepan en la ramdisk y así una ráfaga puntual no la llene.",
-      "Se registra en <code>installed_tools.json</code> para poder revertirlo desde Uninstall Optimizations."
+      "Se registra en <code>installed_tools.json</code> para poder revertirlo desde Desinstalar optimizaciones."
     ],
     "howUseLabel": "Cómo se usa:",
-    "howUseBody": "En el flujo Automatizado Log2RAM se aplica sin intervención cuando se detecta un disco raíz SSD/NVMe. En el flujo Personalizable el script pregunta por el tamaño, el intervalo de sincronización y si activar el guardián de auto-sync al 90%.",
+    "howUseBody": "En el flujo automatizado Log2RAM se instala sin intervención al detectar un disco raíz SSD/NVMe. El personalizable pregunta por tamaño, intervalo y activación del auxiliar de sincronización. El mensaje indica 90%, pero el auxiliar generado usa los umbrales de limpieza del 80% y actuación intensiva del 92% descritos arriba.",
     "verifyLabel": "Verificar y gestionar desde la shell:",
-    "verifyCode": "# Estado del servicio y timers configurados\nsystemctl status log2ram\nsystemctl list-timers log2ram*\n\n# Uso actual de la ramdisk — /var/log ES la tmpfs\ndf -h /var/log\n\n# Forzar sincronización ahora (tmpfs → disco); NO reduce la tmpfs\nlog2ram write\n\n# Disparar el guardián de auto-sync manualmente (compacta + sincroniza si el uso es alto)\n/usr/local/bin/log2ram-check.sh\n\n# Configuración actual: SIZE, mail, path\ncat /etc/log2ram.conf\n\n# Crons específicos de ProxMenux\ncat /etc/cron.d/log2ram /etc/cron.d/log2ram-auto-sync\n\n# Actividad reciente de Log2RAM\njournalctl -u log2ram -n 50 --no-pager"
+    "verifyCode": "# Service state and configured timers\nsystemctl status log2ram\nsystemctl list-timers log2ram*\n\n# Current ramdisk usage — /var/log IS the tmpfs itself\ndf -h /var/log\n\n# Force a sync now (tmpfs → disk); does NOT shrink the tmpfs\nlog2ram write\n\n# Trigger the auto-sync guard on demand (vacuum + sync when usage is high)\n/usr/local/bin/log2ram-check.sh\n\n# Current config: SIZE, mail settings, path\ncat /etc/log2ram.conf\n\n# ProxMenux-specific cron jobs\ncat /etc/cron.d/log2ram /etc/cron.d/log2ram-auto-sync\n\n# Recent Log2RAM activity\njournalctl -u log2ram -n 50 --no-pager"
   },
   "zram": {
     "title": "Activar el perfil de swap con ZRAM",
@@ -163,15 +163,15 @@
       "Con esa prioridad el kernel llena primero ZRAM. Un swap en disco que ya exista conserva su prioridad y recibe las páginas que ya no caben en ZRAM.",
       "Antes de cambiar nada, busca otra configuración de ZRAM: un swap zram activo, una línea zram en <code>/etc/fstab</code>, una unidad de systemd u otro fichero del generador. Si encuentra una, la opción se detiene y la deja como está.",
       "Arranca <code>dev-zram0.swap</code> y comprueba que el dispositivo activo coincide con el perfil. Si no coincide, se restaura el estado anterior.",
-      "Se registra en <code>installed_tools.json</code> para poder revertirlo desde Uninstall Optimizations."
+      "Se registra en <code>installed_tools.json</code> para poder revertirlo desde Desinstalar optimizaciones."
     ],
     "howUseLabel": "Cómo se usa:",
     "howUseBody": "La opción solo forma parte del flujo Personalizable; el flujo Automatizado no la aplica. El dispositivo se crea de nuevo en cada arranque. Mientras está activo, la tarjeta de Memoria del ProxMenux Monitor muestra su capacidad, el swap usado, el algoritmo, la relación de compresión y la memoria física que ocupa.",
     "verifyLabel": "Verificar desde la shell:",
-    "verifyCode": "# Dispositivos de swap activos y su prioridad\nswapon --show\n\n# Dispositivo ZRAM: algoritmo, tamaño y datos comprimidos\nzramctl\n\n# Perfil escrito por ProxMenux\ncat /etc/systemd/zram-generator.conf.d/90-proxmenux.conf\n\n# Estado de la unidad de swap\nsystemctl status dev-zram0.swap"
+    "verifyCode": "# Active swap devices and their priority\nswapon --show\n\n# ZRAM device: algorithm, size and compressed data\nzramctl\n\n# Profile written by ProxMenux\ncat /etc/systemd/zram-generator.conf.d/90-proxmenux.conf\n\n# State of the swap unit\nsystemctl status dev-zram0.swap"
   },
   "autoApplication": {
     "title": "Aplicación automática",
-    "body": "Estas funcionalidades opcionales solo se aplican cuando se seleccionan específicamente durante el proceso post-instalación. Cada funcionalidad puede elegirse individualmente según tus necesidades y preferencias específicas."
+    "body": "En el flujo personalizable, selecciona cada función opcional según tus necesidades. Log2RAM también forma parte del automatizado con detección de hardware; ZRAM es exclusivo del personalizable. Revisa cada sección para conocer las preguntas y requisitos."
   }
 }
diff --git a/web/messages/es/docs/post-install/performance.json b/web/messages/es/docs/post-install/performance.json
index d8042b1e..95d7bdce 100644
--- a/web/messages/es/docs/post-install/performance.json
+++ b/web/messages/es/docs/post-install/performance.json
@@ -1,12 +1,12 @@
 {
   "meta": {
-    "title": "Post-instalación: Rendimiento | ProxMenux Documentation",
-    "description": "Opciones de rendimiento en el script post-instalación Customizable de ProxMenux. Sustituye gzip de un solo hilo por pigz (gzip paralelo) para backups y compresión más rápidos en hosts multinúcleo."
+    "title": "Post-instalación: Rendimiento | Documentación de ProxMenux",
+    "description": "Opciones de rendimiento en el script post-instalación Personalizable de ProxMenux. Sustituye gzip de un solo hilo por pigz (gzip paralelo) para backups y compresión más rápidos en hosts multinúcleo."
   },
   "header": {
     "title": "Post-instalación: Rendimiento",
-    "description": "Opciones de rendimiento dentro del script post-instalación Customizable. Por ahora esta categoría contiene una sola optimización: sustituir gzip por pigz para que los backups y la compresión usen todos los núcleos de la CPU en lugar de uno.",
-    "section": "Settings post-install Proxmox"
+    "description": "Opciones de rendimiento del script post-instalación Personalizable. Esta categoría contiene una sola optimización: sustituir gzip por pigz para que los backups y la compresión usen todos los núcleos de la CPU en lugar de uno.",
+    "section": "Configuración post instalación de Proxmox"
   },
   "intro": {
     "title": "Qué cubre esta categoría",
@@ -16,7 +16,7 @@
     "heading": "Usar pigz para compresión gzip más rápida",
     "intro": "El <code>gzip</code> estándar comprime datos usando <strong>un solo núcleo de CPU</strong>. En hosts Proxmox modernos con 8, 16 o 32 núcleos, eso es un cuello de botella enorme durante backups <code>vzdump</code> de VM/CT, rotación de logs y cualquier otra cosa que pase por <code>gzip</code>. <a>pigz</a> es un reemplazo paralelo drop-in: misma salida compatible con gzip, pero reparte el trabajo entre todos los núcleos.",
     "doesTitle": "Qué hace ProxMenux",
-    "doesIntro": "Cuatro pasos, todos idempotentes:",
+    "doesIntro": "Cinco pasos, todos idempotentes:",
     "doesItems": [
       "Establece <code>pigz: 1</code> en <code>/etc/vzdump.conf</code> para que la herramienta de backup de Proxmox use pigz de forma nativa.",
       "Instala el paquete apt <code>pigz</code> si no está presente.",
@@ -26,8 +26,8 @@
     ],
     "replacesTitle": "Esto sustituye un binario del sistema",
     "replacesBody": "Colocar un wrapper en el lugar de <code>gzip</code> es inusual. Es seguro (el wrapper produce salida compatible con gzip), pero conviene saberlo: scripts que tengan paths hardcodeados, que se ejecuten dentro de chroots restrictivos o que verifiquen hashes de binarios pueden comportarse de forma distinta. El binario real se conserva como <code>gzip.distrib</code> y, al ser una desviación de dpkg, una actualización del paquete <code>gzip</code> — o la actualización de Proxmox VE 8 a 9 — actualiza ese fichero y deja el wrapper en su sitio.",
-    "revertTitle": "Reversible desde el menú Uninstall",
-    "revertBody": "Esta optimización está registrada. <link>Uninstall Optimizations</link> copia el binario real desde <code>gzip.distrib</code> sobre el wrapper, elimina la desviación y el <code>pigzwrapper</code>, comenta la línea <code>pigz</code> de <code>/etc/vzdump.conf</code> y ejecuta <code>apt purge pigz</code> una vez verificado que gzip funciona. Equivalente manual en Proxmox VE 9:",
+    "revertTitle": "Reversible desde el menú Desinstalar",
+    "revertBody": "Esta optimización está registrada. <link>Desinstalar optimizaciones</link> copia el binario real desde <code>gzip.distrib</code> sobre el wrapper, elimina la desviación y el <code>pigzwrapper</code>, comenta la línea <code>pigz</code> de <code>/etc/vzdump.conf</code> y ejecuta <code>apt purge pigz</code> tras verificar que gzip funciona. Equivalente manual en Proxmox VE 9:",
     "verifyTitle": "Verificación",
     "verifyBody": "Tras aplicar, <code>gzip --version</code> debería mencionar pigz. Un benchmark rápido también muestra la diferencia de velocidad en un host multinúcleo:",
     "whenTitle": "Cuándo importa más",
@@ -52,7 +52,7 @@
         "tail": " — tuning de descriptores de fichero y de memoria."
       },
       {
-        "label": "Customizable Post-Install",
+        "label": "Post-instalación personalizable",
         "href": "/docs/post-install/customizable",
         "tail": " — volver al menú padre."
       }
diff --git a/web/messages/es/docs/post-install/security.json b/web/messages/es/docs/post-install/security.json
index 6cabdec2..a3fc60ab 100644
--- a/web/messages/es/docs/post-install/security.json
+++ b/web/messages/es/docs/post-install/security.json
@@ -1,15 +1,15 @@
 {
   "meta": {
-    "title": "Post-instalación: Seguridad | ProxMenux Documentation",
-    "description": "Opciones de seguridad disponibles en el script post-instalación Customizable de ProxMenux. Por ahora una sola opción: desactivar el servicio portmapper/rpcbind para reducir la superficie de ataque del host."
+    "title": "Post-instalación: Seguridad | Documentación de ProxMenux",
+    "description": "Opciones de seguridad disponibles en el script post-instalación Personalizable de ProxMenux. Por ahora una sola opción: desactivar el servicio portmapper/rpcbind para reducir la superficie de ataque del host."
   },
   "header": {
     "title": "Post-instalación: Seguridad",
-    "section": "Settings post-install Proxmox"
+    "section": "Configuración post instalación de Proxmox"
   },
   "intro": {
     "title": "Qué cubre esta categoría",
-    "body": "La seguridad post-instalación se limita al <strong>hardening del host que es seguro aplicar sin supervisión</strong> — cosas que desactivan servicios que casi nadie necesita y que se pueden deshacer desde el menú Uninstall. Las herramientas de seguridad activa (Fail2Ban para prevención de intrusiones, Lynis para auditoría) viven bajo la entrada dedicada <em>Seguridad</em> del menú principal de ProxMenux, no aquí en post-instalación."
+    "body": "La seguridad post-instalación se limita al <strong>refuerzo del host que se puede aplicar sin supervisión de forma segura</strong>: desactivar servicios que casi nadie necesita y poder revertirlo desde Desinstalar. Las herramientas de seguridad activa (Fail2Ban para prevenir intrusiones y Lynis para auditorías) están en la entrada <em>Seguridad</em> del menú principal de ProxMenux, fuera de la post-instalación."
   },
   "rpcbind": {
     "heading": "Desactivar portmapper / rpcbind",
@@ -27,7 +27,7 @@
     "verifyTitle": "Verificación",
     "verifyBody": "Tras aplicar, confirma que <code>rpcbind</code> está apagado y que nada escucha en el puerto 111:",
     "reversibleTitle": "Restaura el estado original del servicio",
-    "reversibleBody": "El cambio queda registrado en <code>installed_tools.json</code>. <link>Uninstall Optimizations</link> devuelve cada unidad de rpcbind al estado habilitado o deshabilitado y activo o inactivo que tenía antes de aplicar ProxMenux; no presupone que rpcbind estuviera habilitado en todos los hosts."
+    "reversibleBody": "El cambio queda registrado en <code>installed_tools.json</code>. <link>Desinstalar optimizaciones</link> devuelve cada unidad de rpcbind al estado habilitado o deshabilitado y activo o inactivo que tenía antes de aplicar ProxMenux; no presupone que rpcbind estuviera habilitado en todos los hosts."
   },
   "related": {
     "heading": "Relacionado",
@@ -48,7 +48,7 @@
         "tail": " — estado de servicios, journalctl, referencia de lynis audit."
       },
       {
-        "label": "Customizable Post-Install",
+        "label": "Post-instalación personalizable",
         "href": "/docs/post-install/customizable",
         "tail": " — volver al menú padre."
       }
diff --git a/web/messages/es/docs/post-install/storage.json b/web/messages/es/docs/post-install/storage.json
index 1b9d4b29..4e92d452 100644
--- a/web/messages/es/docs/post-install/storage.json
+++ b/web/messages/es/docs/post-install/storage.json
@@ -1,24 +1,24 @@
 {
   "meta": {
-    "title": "Post-instalación: Almacenamiento | ProxMenux Documentation",
+    "title": "Post-instalación: Almacenamiento | Documentación de ProxMenux",
     "description": "Optimizaciones de almacenamiento en el script post-instalación Customizable de ProxMenux: dimensionado del ARC de ZFS basado en la RAM del host, zfs-auto-snapshot para snapshots periódicas, y eliminación de los límites de velocidad de backups vzdump."
   },
   "header": {
     "title": "Post-instalación: Almacenamiento",
-    "section": "Settings post-install Proxmox"
+    "section": "Configuración post instalación de Proxmox"
   },
   "intro": {
     "title": "Qué cubre esta categoría",
     "body": "Cuatro optimizaciones relacionadas con almacenamiento: tunear el tamaño de la caché <strong>ARC de ZFS</strong> a una fracción sensata de la RAM del host, instalar y programar <strong>auto-snapshots de ZFS</strong>, activar <strong>autotrim de ZFS</strong> en pools SSD/NVMe y eliminar throttles de <strong>vzdump</strong> para que los backups corran a máxima velocidad. Las cuatro son independientes — elige las que se ajusten a tu setup. Una quinta optimización cercana al almacenamiento, <link>Log2RAM</link>, reduce el desgaste del SSD/NVMe moviendo <code>/var/log</code> a una ramdisk — vive en la página Optional porque el menú Personalizable de ProxMenux la agrupa allí."
   },
-  "trackedTitle": "Las cuatro están registradas en el menú Uninstall",
-  "trackedBody": "Cada una de estas opciones registra un tool en <code>installed_tools.json</code>, así que aparecen en <link>Uninstall Optimizations</link>. Revertir <code>zfs_arc</code> elimina <code>/etc/modprobe.d/99-zfsarc.conf</code> y reconstruye initramfs; <code>zfs_auto_snapshot</code> revierte la programación cron y ofrece purgar el paquete; <code>zfs_autotrim</code> pone <code>autotrim=off</code> en los pools que activó; <code>vzdump_speed</code> restaura <code>/etc/vzdump.conf</code> desde el <code>.bak</code> que la instalación creó.",
+  "trackedTitle": "Las cuatro se registran en el menú Desinstalar",
+  "trackedBody": "Cada una de estas opciones registra un tool en <code>installed_tools.json</code>, así que aparecen en <link>Desinstalar optimizaciones</link>. Revertir <code>zfs_arc</code> elimina <code>/etc/modprobe.d/99-zfsarc.conf</code> y reconstruye initramfs; <code>zfs_auto_snapshot</code> revierte la programación cron y ofrece purgar el paquete; <code>zfs_autotrim</code> pone <code>autotrim=off</code> en los pools que activó; <code>vzdump_speed</code> restaura <code>/etc/vzdump.conf</code> desde el <code>.bak</code> que la instalación creó.",
   "arc": {
     "heading": "Optimizar el tamaño del ARC de ZFS",
-    "intro": "El <strong>Adaptive Replacement Cache (ARC)</strong> es la caché de lectura en memoria de ZFS. Sin tuning explícito, ZFS coge alegremente hasta la mitad de la RAM del host para sí mismo, lo que es excesivo en un host Proxmox que también necesita memoria para VMs y LXCs. Esta opción limita el ARC a una fracción sensata de la RAM total según el tamaño de la máquina.",
+    "intro": "La <strong>Adaptive Replacement Cache (ARC)</strong> es la caché de lectura en memoria de ZFS. Las instalaciones Proxmox VE desde 8.1 fijan un límite del 10% de RAM, con máximo 16 GiB; hosts antiguos o actualizados pueden diferir. Esta opción escribe esa misma política de forma explícita (RAM/10, con un máximo de 16 GiB y un mínimo de 64 MiB) en su propio archivo, lo que cubre también hosts antiguos o actualizados. Revisa ajustes y carga: una caché menor no siempre es más rápida.",
     "sizingTitle": "Reglas de dimensionado",
     "headerRam": "RAM del host",
-    "headerMax": "Cap ARC",
+    "headerMax": "Límite del ARC",
     "rows": [
       {
         "ram": "Fórmula",
@@ -41,12 +41,12 @@
         "max": "16 GiB (tope)"
       }
     ],
-    "after": "El archivo <code>/etc/modprobe.d/99-zfsarc.conf</code> contiene una única directiva — <code>options zfs zfs_arc_max=…</code>. El resto de parámetros del módulo (<code>zfs_arc_min</code>, prefetch/write throttle de L2ARC, timeout de TXG) se dejan en los valores por defecto de OpenZFS. Antes de escribir, un paso de reconciliación escanea otros <code>*.conf</code> en <code>/etc/modprobe.d/</code> que definan <code>zfs_arc_min</code> / <code>zfs_arc_max</code>, los respalda a <code>/usr/local/share/proxmenux/backups/zfs_arc/</code> con un manifest, y elimina las líneas en conflicto para que solo quede activo el fichero de ProxMenux. Tras escribir el archivo, ProxMenux ejecuta <code>update-initramfs -u -k all</code> y, cuando corresponde, <code>proxmox-boot-tool refresh</code>, para que el cap llegue también al initramfs que usan las instalaciones con ZFS-on-root.",
+    "after": "El archivo <code>/etc/modprobe.d/99-zfsarc.conf</code> contiene solo <code>options zfs zfs_arc_max=…</code>. Esta opción no ajusta otros parámetros ZFS (<code>zfs_arc_min</code>, lectura anticipada/límite de escritura L2ARC, tiempo de espera TXG). Antes busca otros <code>*.conf</code> en <code>/etc/modprobe.d/</code> que definan <code>zfs_arc_min</code> / <code>zfs_arc_max</code>, los copia con un manifiesto a <code>/usr/local/share/proxmenux/backups/zfs_arc/</code> y elimina de ellos los valores <code>zfs_arc_min</code> / <code>zfs_arc_max</code> en conflicto (el resto de opciones de esas líneas se conserva), para que solo el archivo ARC de ProxMenux fije el límite. Después ejecuta <code>update-initramfs -u -k all</code> y, si procede, <code>proxmox-boot-tool refresh</code> para incorporar el límite al initramfs de los sistemas con raíz ZFS.",
     "rebootTitle": "Requiere reinicio para surtir efecto",
     "rebootBody": "Los ajustes del ARC se leen cuando se carga el módulo del kernel <code>zfs</code>. Para que el cap se aplique en hosts ZFS-on-root, ProxMenux regenera el initramfs con <code>update-initramfs -u -k all</code> y, cuando corresponde, refresca el cargador de arranque con <code>proxmox-boot-tool refresh</code>. Un reinicio sigue siendo necesario para que el módulo relea el parámetro; el flag de \"se requiere reinicio\" se activa automáticamente.",
     "safeTitle": "Seguro en hosts sin ZFS",
     "safeBody": "La función solo escribe la configuración cuando <code>zpool list</code> reporta al menos un pool ZFS importado. En hosts Proxmox solo ext4 / LVM, o en máquinas con las utilidades ZFS instaladas pero sin ningún pool importado, marcar esta opción es un no-op — no se escribe nada.",
-    "verifyTitle": "Verificación y rollback manual"
+    "verifyTitle": "Verificación y reversión manual"
   },
   "autoSnap": {
     "heading": "Instalar ZFS auto-snapshot",
@@ -57,27 +57,27 @@
     "headerKept": "Snapshots conservadas",
     "rows": [
       {
-        "label": "frequent",
+        "label": "frecuentes",
         "runs": "cada 15 min",
         "kept": "4"
       },
       {
-        "label": "hourly",
+        "label": "horaria",
         "runs": "cada hora",
         "kept": "1"
       },
       {
-        "label": "daily",
+        "label": "diario",
         "runs": "una vez al día",
         "kept": "1"
       },
       {
-        "label": "weekly",
+        "label": "semanales",
         "runs": "una vez por semana",
         "kept": "1"
       },
       {
-        "label": "monthly",
+        "label": "mensual",
         "runs": "una vez al mes",
         "kept": "1"
       }
@@ -86,26 +86,26 @@
     "conservativeBody": "ProxMenux viene con una retención conservadora (solo 4 frequent + 1 de cada intervalo más largo) para que el almacenamiento de snapshots de ZFS no se infle. Si quieres una retención mayor, edita los números en <code>/etc/cron.d/zfs-auto-snapshot</code>, <code>/etc/cron.hourly/zfs-auto-snapshot</code>, etc. después de ejecutar el script.",
     "onlyZfsTitle": "Solo útil en pools ZFS",
     "onlyZfsBody": "Instalar el paquete en un host solo ext4 es inofensivo pero inútil — no hay datasets ZFS de los que tomar snapshot. Sáltate esta opción si no usas ZFS.",
-    "verifyTitle": "Verificación y rollback manual"
+    "verifyTitle": "Verificación y reversión manual"
   },
   "autotrim": {
     "heading": "Activar ZFS autotrim (pools SSD/NVMe)",
-    "intro": "Activa la propiedad <code>autotrim</code> en cada pool ZFS que esté respaldado exclusivamente por SSDs o NVMe con soporte TRIM. Los pools que incluyen un solo vdev HDD se saltan automáticamente — TRIM en discos rotacionales no tiene sentido y ZFS lo rechazará. Los pools que ya estaban configurados con <code>autotrim=on</code> se dejan como están.",
+    "intro": "Activa <code>autotrim</code> en pools ZFS formados exclusivamente por SSD o NVMe compatibles con TRIM. El script omite por precaución los pools con algún dispositivo rotacional. Conserva los pools que ya tenían <code>autotrim=on</code>.",
     "trimTitle": "Qué hace TRIM, y por qué importa en ZFS",
     "trimBody1": "Las SSDs / NVMe gestionan el almacenamiento interno en erase blocks de tamaño fijo que son mucho mayores que los sectores lógicos con los que habla el sistema de archivos. Cuando un sistema de archivos borra un archivo, el disco no lo sabe — sigue pensando que esos sectores están en uso, así que su garbage collector interno sigue moviendo datos obsoletos para liberar nuevos erase blocks. <strong>TRIM</strong> es el comando estándar que el SO usa para decirle al disco \"estos sectores ya están libres, puedes borrarlos por adelantado\".",
     "trimBody2": "Sin TRIM, el rendimiento de la SSD se degrada con el tiempo a medida que el disco se queda sin bloques pre-borrados y tiene que hacer erase-on-write, y la amplificación de escritura aumenta — ambas cosas acortan la vida útil del disco. Con TRIM activado, el disco puede mantener un pool saludable de bloques vacíos listos para escribir.",
-    "trimBody3": "En ZFS, <code>autotrim=on</code> es el equivalente moderno del comando periódico <code>zpool trim &lt;pool&gt;</code> — en lugar de tener que acordarte de ejecutar un trim manualmente (o programar uno), el pool emite comandos TRIM automáticamente y de forma continua a medida que los bloques se liberan. Es de bajo overhead y es el ajuste recomendado para pools respaldados por SSD.",
+    "trimBody3": "Con <code>autotrim=on</code>, ZFS aplica TRIM en segundo plano al espacio liberado recientemente, agrupando rangos. Otra opción es <code>zpool trim &lt;pool&gt;</code> periódico. Autotrim evita otra programación, pero su impacto depende del dispositivo; el TRIM manual periódico puede ir mejor en algunas unidades modestas.",
     "practicalTitle": "¿Por qué es práctico activarlo?",
     "practicalItems": [
-      "<strong>Rendimiento de escritura sostenido.</strong> Las SSDs que nunca ven comandos TRIM se ralentizan de forma medible con los meses. Autotrim le facilita el trabajo a la controladora.",
-      "<strong>Longevidad del disco.</strong> Menor amplificación de escritura significa menos escrituras NAND totales para la misma cantidad de datos — medible en años de vida útil del disco.",
+      "<strong>Rendimiento de escritura sostenido.</strong> TRIM puede ayudar al disco a recuperar bloques sin uso. El beneficio y el impacto en latencia dependen del dispositivo y la carga.",
+      "<strong>Vida útil del disco.</strong> Evitar copias internas innecesarias puede reducir la amplificación de escritura y el desgaste NAND. No garantiza una cantidad concreta de vida adicional.",
       "<strong>Sin cron programado que recordar.</strong> A diferencia de un <code>zpool trim</code> periódico, autotrim es fire-and-forget — el pool lo maneja por su cuenta."
     ],
     "whenTitle": "¿Cuándo es necesario?",
-    "whenIntro1": "<strong>Deberías activarlo</strong> en cualquier pool ZFS cuyos vdevs sean todos SSD o NVMe con soporte TRIM — la instalación típica de Proxmox sobre SSDs de consumo o enterprise.",
+    "whenIntro1": "<strong>Considera activarlo</strong> en pools ZFS solo con SSD/NVMe compatibles con TRIM. Comprueba el comportamiento y la latencia; algunos equipos funcionan mejor con TRIM manual programado.",
     "whenIntro2": "<strong>El script se lo salta automáticamente</strong> en:",
     "whenSkipItems": [
-      "Pools que contienen cualquier vdev HDD (rotacional) — TRIM no tiene sentido allí.",
+      "Pools con algún vdev HDD rotacional: un filtro conservador de hardware del script.",
       "Discos sin <code>discard_granularity</code> expuesto en sysfs — normalmente SSDs viejas sin TRIM, o rutas pass-through donde el SO no puede ver el dispositivo subyacente.",
       "Pools donde ZFS mismo reporta la propiedad como no soportada (raro; pools muy antiguos).",
       "Pools ya configurados con <code>autotrim=on</code> (no-op)."
@@ -115,19 +115,19 @@
     "recordedBody": "La función solo escribe un pool en su archivo de estado interno (<code>/usr/local/share/proxmenux/zfs_autotrim_pools</code>) cuando ha cambiado activamente ese pool de <code>off</code> a <code>on</code>. Los pools que ya tenías con autotrim antes de ejecutar el script se dejan fuera de la lista, para que un futuro Uninstall no apague ajustes que tú mismo configuraste — solo se revierten los cambios propios de ProxMenux.",
     "manualTitle": "Equivalente manual (ejecuta en tu servidor)",
     "manualIntro": "La secuencia completa que el script ejecuta contra cada pool es replicable a mano. Esto es lo que escribirías si quisieras hacer lo mismo en un solo pool sin ProxMenux:",
-    "verifyTitle": "Verificación y rollback manual",
+    "verifyTitle": "Verificación y reversión manual",
     "oneShotTitle": "¿Necesitas un trim puntual en lugar de continuo?",
-    "oneShotBody": "Algunos operadores prefieren un trim manual durante horas de baja carga en lugar de actividad de trim continua. Desactiva autotrim y programa un cron que ejecute <code>zpool trim &lt;pool&gt;</code> — mismo objetivo final, distinta cadencia."
+    "oneShotBody": "Algunos usuarios prefieren un trim manual durante horas de baja carga en lugar de actividad de trim continua. Desactiva autotrim y programa un cron que ejecute <code>zpool trim &lt;pool&gt;</code> — mismo objetivo final, distinta cadencia."
   },
   "vzdump": {
     "heading": "Aumentar la velocidad de backup de vzdump",
-    "intro": "Por defecto, vzdump de Proxmox throttlea los backups para proteger las VMs/CTs en ejecución de inanición de IO. En muchos setups ese throttle es más conservador de lo necesario. Esta opción quita el cap de ancho de banda y baja la prioridad de I/O para que vzdump pueda saturar el path de almacenamiento durante las ventanas de backup.",
+    "intro": "Escribe bwlimit: 0 e ionice: 5 en la configuración global de vzdump. Proxmox ya usa ancho de banda sin límite por defecto: solo elimina un límite si estaba configurado. Frente al ionice: 7 predeterminado, 5 da mayor prioridad de E/S de mejor esfuerzo cuando el planificador la respeta. Puede afectar a los huéspedes y no garantiza backups más rápidos.",
     "changedTitle": "Qué se cambia en /etc/vzdump.conf",
     "backupTitle": "La primera ejecución crea un .bak de vzdump.conf",
     "backupBody": "La primera vez que se ejecuta esta opción, ProxMenux copia <code>/etc/vzdump.conf</code> a <code>/etc/vzdump.conf.bak</code> antes de tocarlo. Las ejecuciones siguientes reutilizan ese backup y no lo sobrescriben, para que una configuración editada a mano previa a la primera aplicación se pueda recuperar. Los cambios sobre <code>bwlimit</code> y <code>ionice</code> se hacen con <code>sed</code>, y cualquier otra opción del fichero (compress, pigz, tmpdir, exclude-path, etc.) se preserva.",
     "skipTitle": "Cuándo saltárselo",
     "skipBody": "En un host con almacenamiento local lento y VMs sensibles a la latencia, quitar el cap de ancho de banda puede causar ralentizaciones notables durante los backups. Si previamente has puesto un <code>bwlimit</code> específico por esa razón, mantenlo — sáltate esta opción.",
-    "verifyTitle": "Verificación y rollback manual"
+    "verifyTitle": "Verificación y reversión manual"
   },
   "related": {
     "heading": "Relacionado",
@@ -145,10 +145,10 @@
       {
         "label": "Comandos de backup y restauración",
         "href": "/docs/help-info/backup-commands",
-        "tail": " — referencia de la CLI de vzdump (ahora sin los caps legacy de bwlimit / ionice)."
+        "tail": " — referencia de la CLI de vzdump para ancho de banda y prioridad de E/S."
       },
       {
-        "label": "Uninstall Optimizations",
+        "label": "Desinstalar optimizaciones",
         "href": "/docs/post-install/uninstall",
         "tail": " — revierte cambios de ARC / vzdump."
       },
@@ -158,7 +158,7 @@
         "tail": " — reduce el desgaste del SSD/NVMe usando una ramdisk para /var/log; documentado en Optional."
       },
       {
-        "label": "Customizable Post-Install",
+        "label": "Post-instalación personalizable",
         "href": "/docs/post-install/customizable",
         "tail": " — volver al menú padre."
       }
diff --git a/web/messages/es/docs/post-install/system.json b/web/messages/es/docs/post-install/system.json
index 0861d3b7..52764c82 100644
--- a/web/messages/es/docs/post-install/system.json
+++ b/web/messages/es/docs/post-install/system.json
@@ -1,11 +1,11 @@
 {
   "meta": {
-    "title": "Post-instalación: Sistema | ProxMenux Documentation",
+    "title": "Post-instalación: Sistema | Documentación de ProxMenux",
     "description": "Optimizaciones a nivel de sistema en el script post-instalación Customizable de ProxMenux: límites de tamaño de journald y logrotate, límites de kernel y descriptores de fichero más altos, tuning de memoria balanceado, kexec para reinicios rápidos, y recuperación ante kernel panic."
   },
   "header": {
     "title": "Post-instalación: Sistema",
-    "section": "Settings post-install Proxmox"
+    "section": "Configuración post instalación de Proxmox"
   },
   "intro": {
     "title": "Qué cubre esta categoría",
@@ -17,10 +17,10 @@
     "keyTitle": "Valores clave",
     "keyItems": [
       "<code>Storage=persistent</code> — conservar logs en disco entre reinicios.",
-      "<code>SystemMaxUse=64M</code> / <code>RuntimeMaxUse=60M</code> — caps duros sobre el uso de disco/memoria del journal.",
+      "<code>SystemMaxUse=64M</code> / <code>RuntimeMaxUse=60M</code> — límites de uso de disco y memoria del journal.",
       "<code>Compress=yes</code>, <code>Seal=no</code> — comprimir logs, saltar el forward-secure sealing (ahorra CPU).",
       "<code>MaxLevelStore=info</code> — almacenar info y superiores (requerido para el visor de logs del ProxMenux Monitor y para que Fail2Ban detecte fallos de autenticación SSH/Proxmox desde el journal).",
-      "Rate-limits: <code>1000 eventos / 30 s</code> para prevenir flooding de logs.",
+      "Límite de frecuencia: <code>1000 events / 30 s</code> para evitar una avalancha de registros.",
       "<code>ForwardToSyslog=no</code>, <code>ForwardToWall=no</code> — no duplicar mensajes a syslog ni broadcastear a consolas."
     ],
     "tipTitle": "Por qué importa MaxLevelStore=info",
@@ -28,9 +28,9 @@
   },
   "logrotate": {
     "heading": "Optimizar logrotate",
-    "intro": "Reescribe <code>/etc/logrotate.conf</code> con una política más estricta adecuada para un host que también forma parte de un setup Log2RAM de protección de SSD: rotación diaria, retención de 7 días, trigger de tamaño 10 MB, compresión, y <code>copytruncate</code> para que los servicios activos sigan escribiendo sin reabrir sus archivos de log. El <code>logrotate.conf</code> original se respalda en <code>.bak</code> en la primera aplicación.",
+    "intro": "Reescribe <code>/etc/logrotate.conf</code> con ajustes globales de frecuencia diaria y tamaño, 7 rotaciones conservadas, compresión y <code>copytruncate</code> para que los servicios sigan escribiendo sin reabrir los archivos. El tamaño aparece después de la frecuencia diaria y prevalece salvo que una regla particular lo cambie. El <code>logrotate.conf</code> original se copia a <code>.bak</code> la primera vez.",
     "tipTitle": "Amigable con Log2RAM",
-    "tipBody": "El trigger <code>size 10M</code> significa que los logs rotan por tamaño <em>o</em> diariamente, lo que ocurra primero. Combinado con el <code>/var/log</code> respaldado en RAM de Log2RAM, esto mantiene el working set pequeño para que los flushes a disco sean baratos."
+    "tipBody": "La directiva <code>size 10M</code> prevalece sobre el ajuste diario anterior; <em>no</em> significa lo que ocurra primero. Logrotate comprueba el umbral al ejecutarse y las reglas particulares pueden cambiar los valores globales. Con <code>/var/log</code> en la RAM de Log2RAM, revisa las reglas y la frecuencia del temporizador para controlar el espacio."
   },
   "limits": {
     "heading": "Aumentar varios límites del sistema",
@@ -72,7 +72,7 @@
       }
     ],
     "tipTitle": "Por qué importa inotify",
-    "tipBody": "Aplicaciones como Docker, Syncthing, watchers de Node.js, el escáner de biblioteca de Plex y muchas más pegan rápido contra <code>max_user_watches</code>. El valor por defecto en Debian es 8192 — un solo Plex en ejecución puede agotarlo. 1M es generoso y cuesta ~1 KB de RAM por watch, lo que es despreciable."
+    "tipBody": "Docker, Syncthing, los observadores de archivos de Node.js y los análisis de bibliotecas de Plex pueden agotar <code>max_user_watches</code>. El valor predeterminado depende del núcleo y la memoria; no siempre es 8192. Subirlo a 1M permite más observadores, sin preasignarlos. Los observadores activos consumen memoria del núcleo: vigila el uso en hosts con poca RAM."
   },
   "memory": {
     "heading": "Optimizar ajustes de memoria",
@@ -102,8 +102,8 @@
   "verify": {
     "heading": "Verificación",
     "intro": "Tras aplicar las optimizaciones de Sistema:",
-    "tipTitle": "Totalmente reversible",
-    "tipBody": "Las seis opciones están registradas en <code>installed_tools.json</code>, así que aparecen en <link>Uninstall Optimizations</link> si quieres revertir alguna. Las reversiones restauran los valores por defecto de los archivos sysctl, eliminan la unit systemd y el alias de kexec, y resetean journald/logrotate a las configuraciones stock de Debian."
+    "tipTitle": "Restauración y limitaciones",
+    "tipBody": "Las seis opciones se registran en <code>installed_tools.json</code> y aparecen en <link>Desinstalar optimizaciones</link>. La restauración elimina los archivos de configuración, la unidad y el alias de kexec, reescribe journald.conf con los valores predeterminados de systemd y restaura logrotate.conf desde su backup. Algunos límites activos requieren otra sesión o reinicio."
   },
   "related": {
     "heading": "Relacionado",
@@ -119,12 +119,12 @@
         "tail": " — tuning adicional a nivel de sistema (pigz)."
       },
       {
-        "label": "Uninstall Optimizations",
+        "label": "Desinstalar optimizaciones",
         "href": "/docs/post-install/uninstall",
         "tail": " — revierte cualquiera de estos cambios."
       },
       {
-        "label": "Customizable Post-Install",
+        "label": "Post-instalación personalizable",
         "href": "/docs/post-install/customizable",
         "tail": " — volver al menú padre."
       }
diff --git a/web/messages/es/docs/post-install/uninstall.json b/web/messages/es/docs/post-install/uninstall.json
index 1b4defdc..32311b09 100644
--- a/web/messages/es/docs/post-install/uninstall.json
+++ b/web/messages/es/docs/post-install/uninstall.json
@@ -1,12 +1,12 @@
 {
   "meta": {
-    "title": "Uninstall Optimizations | ProxMenux Documentation",
+    "title": "Desinstalar optimizaciones | Documentación de ProxMenux",
     "description": "Restaura los cambios reversibles de post-instalación aplicados por ProxMenux. Las herramientas registradas usan desinstaladores específicos que conservan el estado anterior del host cuando es posible."
   },
   "header": {
-    "title": "Uninstall Optimizations",
+    "title": "Desinstalar optimizaciones",
     "description": "Restaura los cambios reversibles realizados por los scripts de post-instalación Automatizado o Personalizable. ProxMenux registra cada optimización compatible con su función de restauración; las actualizaciones de paquetes quedan excluidas deliberadamente.",
-    "section": "Settings post-install Proxmox"
+    "section": "Configuración post instalación de Proxmox"
   },
   "intro": {
     "title": "Por qué existe",
@@ -14,8 +14,8 @@
   },
   "openMenu": {
     "heading": "Cómo abrirlo",
-    "body": "Desde el menú principal de ProxMenux, <strong>Settings post-install Proxmox → Uninstall optimizations</strong>. Verás un checklist de optimizaciones <em>actualmente aplicadas</em> — los items que no has aplicado no aparecen.",
-    "imageAlt": "Checklist de Uninstall Optimizations mostrando los items actualmente aplicados en el host, con checkboxes para seleccionar cuáles revertir"
+    "body": "Desde el menú principal, abre <strong>Configuración post instalación de Proxmox → Desinstalar optimizaciones</strong>. Verás una lista de optimizaciones <em>actualmente aplicadas</em>; las no aplicadas no aparecen.",
+    "imageAlt": "Lista de Desinstalar optimizaciones con las opciones activas del host y casillas para elegir cuáles revertir"
   },
   "howWorks": {
     "heading": "Cómo funciona la reversión",
@@ -40,7 +40,7 @@
         "body2": "Cada reversión registra su progreso. Los items que requieren un reinicio (VFIO, nombres de interfaz persistentes) activan un flag que dispara el prompt de reinicio al final."
       },
       {
-        "title": "Prompt de reinicio al final",
+        "title": "Solicitud de reinicio al final",
         "body1": "Al terminar la reversión el menú muestra un prompt de reinicio. Los items que cambiaron parámetros del kernel, módulos del kernel o naming de red (VFIO, nombres de interfaz persistentes) sí necesitan el reinicio para surtir efecto; otros no lo necesitan, y el prompt es un valor por defecto de seguridad más que una comprobación por item."
       }
     ]
@@ -53,15 +53,15 @@
         "title": "Repositorios y APT",
         "items": [
           {
-            "tool": "Subscription Banner Removal",
+            "tool": "Eliminación del aviso de suscripción",
             "restores": "Primero intenta restaurar los archivos de la UI desde los backups propios de ProxMenux (/usr/local/share/proxmenux/backups/proxmoxlib.js.backup.* y, cuando la UI móvil está parcheada, index.html.tpl.backup.*). Solo si un backup falta o está corrupto, cae al reinstalado de pve-manager, proxmox-widget-toolkit, libjs-extjs y libpve-http-server-perl con force-confnew. También limpia las copias .js / .gz cacheadas."
           },
           {
-            "tool": "APT Language Skip",
-            "restores": "Elimina /etc/apt/apt.conf.d/99-disable-translations. APT volverá a descargar paquetes de idioma."
+            "tool": "Omitir idiomas de APT",
+            "restores": "Elimina /etc/apt/apt.conf.d/99-disable-translations para que APT pueda descargar índices de descripciones traducidas según el resto de ajustes de idioma."
           },
           {
-            "tool": "APT IPv4 Force",
+            "tool": "Forzar IPv4 en APT",
             "restores": "Elimina /etc/apt/apt.conf.d/99-force-ipv4."
           },
           {
@@ -74,16 +74,16 @@
         "title": "Kernel, memoria y límites del sistema",
         "items": [
           {
-            "tool": "Memory Settings",
+            "tool": "Ajustes de memoria",
             "restores": "Elimina /etc/sysctl.d/99-memory.conf y recarga sysctl."
           },
           {
-            "tool": "Kernel Panic Configuration",
+            "tool": "Configuración de kernel panic",
             "restores": "Elimina /etc/sysctl.d/99-kernelpanic.conf."
           },
           {
-            "tool": "System Limits Increase",
-            "restores": "Elimina /etc/sysctl.d/99-maxwatches.conf, 99-maxkeys.conf, 99-swap.conf, 99-fs.conf y /etc/security/limits.d/99-limits.conf. Revierte los límites PAM y DefaultLimitNOFILE de systemd, y elimina la línea ulimit -n 256000 de /root/.profile."
+            "tool": "Aumento de los límites del sistema",
+            "restores": "Elimina /etc/sysctl.d/99-maxwatches.conf, 99-maxkeys.conf, 99-swap.conf, 99-fs.conf y /etc/security/limits.d/99-limits.conf. Revierte límites PAM y DefaultLimitNOFILE de systemd. En /root/.profile solo limpia la línea antigua ulimit -n 256000; la actual ulimit -n 1048576 puede permanecer y requerir eliminación manual."
           },
           {
             "tool": "Perfil de swap con ZRAM",
@@ -95,7 +95,7 @@
         "title": "Red",
         "items": [
           {
-            "tool": "Network Optimizations",
+            "tool": "Optimización de la red",
             "restores": "Elimina /etc/sysctl.d/99-network.conf, 97-proxmenux-fwbr.conf y 98-proxmenux-rpf.conf junto con la unit proxmenux-fwbr-tune.service, el helper /usr/local/sbin/proxmenux-fwbr-tune y la regla /etc/udev/rules.d/99-zz-proxmenux-fwbr-tune.rules. También elimina la línea source /etc/network/interfaces.d/* de /etc/network/interfaces. Recarga sysctl, systemd y el conjunto de reglas udev."
           },
           {
@@ -104,23 +104,23 @@
           },
           {
             "tool": "TCP BBR + TCP Fast Open",
-            "restores": "Elimina /etc/sysctl.d/99-tcp-bbr.conf y 99-tcp-fastopen.conf y recarga sysctl para que el kernel vuelva al control de congestión cubic y a tcp_fastopen=1."
+            "restores": "Elimina /etc/sysctl.d/99-kernel-bbr.conf y 99-tcp-fastopen.conf y recarga el resto de sysctl. Borrar archivos no restablece valores activos; los predeterminados como cubic y tcp_fastopen=1 vuelven al reiniciar salvo otra configuración."
           },
           {
-            "tool": "Persistent Interface Names",
+            "tool": "Nombres de la interfaz persistentes",
             "restores": "Elimina solo los archivos 10-proxmenux-*.link que llevan la cabecera de ProxMenux en /etc/systemd/network/. Cualquier archivo .link provisto por otro paquete o escrito por el usuario se mantiene intacto. Los nombres de interfaz vuelven al comportamiento por defecto de systemd en el siguiente reinicio."
           }
         ]
       },
       {
-        "title": "Logging",
+        "title": "Registro",
         "items": [
           {
-            "tool": "Journald Optimization",
-            "restores": "Reescribe /etc/systemd/journald.conf con los valores por defecto vanilla y reinicia systemd-journald."
+            "tool": "Optimización de journald",
+            "restores": "Reescribe /etc/systemd/journald.conf con valores estándar y reinicia systemd-journald."
           },
           {
-            "tool": "Logrotate Optimization",
+            "tool": "Optimización de logrotate",
             "restores": "Restaura /etc/logrotate.conf desde el archivo .bak capturado antes del cambio."
           },
           {
@@ -128,7 +128,7 @@
             "restores": "Para y desactiva el servicio y el timer. Purga cron jobs, units systemd, binarios, archivos de configuración y el directorio /var/log.hdd. También desinstala el paquete apt si se instaló por esa vía."
           },
           {
-            "tool": "ZFS autotrim",
+            "tool": "TRIM automático de ZFS",
             "restores": "Lee /usr/local/share/proxmenux/zfs_autotrim_pools (la lista de pools que ProxMenux realmente cambió) y ejecuta zpool set autotrim=off en cada uno. Los pools en los que tú activaste autotrim manualmente antes de ejecutar ProxMenux no se tocan."
           }
         ]
@@ -137,7 +137,7 @@
         "title": "Shell y apariencia",
         "items": [
           {
-            "tool": "Bashrc Customization",
+            "tool": "Personalización de Bashrc",
             "restores": "Restaura /root/.bashrc desde el backup .bak. Si no existe backup, elimina el bloque PMX_CORE_BASHRC por marcadores."
           },
           {
@@ -162,28 +162,28 @@
             "restores": "Elimina los módulos vfio de /etc/modules, las entradas de blacklist nouveau / radeon / nvidia, y los parámetros intel_iommu=on / amd_iommu=on / iommu=pt / pcie_acs_override de /etc/kernel/cmdline (ZFS) o GRUB. Reconstruye initramfs."
           },
           {
-            "tool": "AMD CPU fixes (Ryzen/EPYC)",
+            "tool": "Correcciones para CPU AMD (Ryzen/EPYC)",
             "restores": "Elimina idle=nomwait de la cmdline del kernel (ZFS) o GRUB, y las opciones ignore_msrs / report_ignored_msrs de /etc/modprobe.d/kvm.conf."
           },
           {
-            "tool": "QEMU Guest Agent (templates)",
-            "restores": "Lee /usr/local/share/proxmenux/guest_agent.pkg (registrado en tiempo de instalación) y hace apt purge del paquete que se instaló (qemu-guest-agent en hosts estándar, spice-vdagent cuando se usa modo Spice)."
+            "tool": "Agente invitado para un host Proxmox virtualizado",
+            "restores": "Lee /usr/local/share/proxmenux/guest_agent.pkg y purga el paquete registrado del host. El instalador elige qemu-guest-agent, open-vm-tools o virtualbox-guest-utils según el hipervisor. Si falta el registro, el desinstalador prueba esos tres paquetes. Actúa en el host Proxmox anidado, no en plantillas de huéspedes."
           }
         ]
       },
       {
-        "title": "Storage",
+        "title": "Almacenamiento",
         "items": [
           {
-            "tool": "ZFS ARC sizing",
+            "tool": "Ajuste del tamaño de ARC de ZFS",
             "restores": "Elimina /etc/modprobe.d/99-zfsarc.conf, restaura cualquier *.conf externo en conflicto que se dejó apartado en /usr/local/share/proxmenux/backups/zfs_arc/, reconstruye initramfs y ejecuta proxmox-boot-tool refresh en hosts con systemd-boot."
           },
           {
-            "tool": "ZFS auto-snapshot",
+            "tool": "Instantáneas automáticas de ZFS",
             "restores": "Elimina las entradas cron que el script escribió y ofrece hacer apt purge zfs-auto-snapshot. Los datasets de snapshots existentes en los pools se dejan intactos — bórralos por separado si los quieres fuera."
           },
           {
-            "tool": "vzdump speed limits",
+            "tool": "Límites de velocidad de vzdump",
             "restores": "Restaura /etc/vzdump.conf desde el .bak que creó la instalación, devolviendo bwlimit e ionice a sus valores previos a ProxMenux."
           }
         ]
@@ -192,15 +192,15 @@
         "title": "Servicios y extras",
         "items": [
           {
-            "tool": "Time Synchronization",
+            "tool": "Sincronización del tiempo",
             "restores": "Devuelve la zona horaria a UTC (valor por defecto seguro) vía timedatectl."
           },
           {
-            "tool": "Entropy Generation (haveged)",
+            "tool": "Generación de entropía (haveged)",
             "restores": "Para, desactiva y purga el paquete haveged."
           },
           {
-            "tool": "kexec (fast reboots)",
+            "tool": "kexec (reinicios rápidos)",
             "restores": "Desactiva kexec-pve.service, elimina el archivo de unit y el alias reboot-quick de /root/.bash_profile, purga kexec-tools."
           },
           {
@@ -212,16 +212,16 @@
             "restores": "Copia el gzip real desde gzip.distrib, elimina la desviación de dpkg y /bin/pigzwrapper, comenta la línea pigz en /etc/vzdump.conf y hace apt purge pigz una vez verificado gzip."
           },
           {
-            "tool": "High Availability services",
+            "tool": "Servicios de alta disponibilidad",
             "restores": "Para y desactiva pve-ha-lrm, pve-ha-crm y corosync. Los grupos HA y las definiciones de recursos existentes no se eliminan — quítalos desde la UI web si ya no los necesitas."
           },
           {
-            "tool": "Ceph repository",
+            "tool": "Repositorio Ceph",
             "restores": "Purga los paquetes Ceph instalados por esta opción, elimina /etc/apt/sources.list.d/ceph.sources en PVE 9 (o la lista Ceph tradicional en PVE 8) y actualiza la caché de APT."
           },
           {
-            "tool": "OVH RTM (monitoring)",
-            "restores": "Ejecuta apt purge sobre cualquier paquete ovh-* que el instalador RTM añadió y borra los manifests puppet que dejó bajo /etc/puppet/. En hosts no-OVH nunca se instaló nada, así que no se elimina nada."
+            "tool": "OVH RTM (monitorización)",
+            "restores": "Purga paquetes que coincidan con ovh-rtm*, rtm y rtm-*, elimina /etc/rtm y borra el registro de RTM. Los restos de Puppet en /etc/puppet/ pueden requerir revisión y limpieza manual; el desinstalador no elimina ese directorio. En hosts no OVH el instalador normalmente no hace cambios."
           }
         ]
       }
@@ -229,10 +229,10 @@
   },
   "edge": {
     "heading": "Casos límite y matices",
-    "packageTitle": "La reinstalación de paquetes toca paquetes vivos de Proxmox",
-    "packageBody": "Revertir <strong>Subscription Banner Removal</strong> reinstala <code>pve-manager</code>, <code>proxmox-widget-toolkit</code>, <code>libjs-extjs</code> y <code>libpve-http-server-perl</code> con <code>--force-confnew</code>. Es generalmente seguro pero sí toca la UI web en ejecución — refresca tu navegador después, y espera unos segundos de reconexión. No lo ejecutes a mitad de una migración o una operación de clonado.",
+    "packageTitle": "La reinstalación afecta a paquetes de Proxmox en uso",
+    "packageBody": "Si las copias de ProxMenux no pueden revertir <strong>Eliminación del aviso de suscripción</strong>, la alternativa reinstala <code>pve-manager</code>, <code>proxmox-widget-toolkit</code>, <code>libjs-extjs</code> y <code>libpve-http-server-perl</code> con <code>--force-confnew</code>. Afecta a la interfaz web en uso: recarga el navegador y espera unos segundos de reconexión. Evítalo durante migraciones o clonados.",
     "rebootTitle": "Los nombres persistentes y VFIO necesitan reinicio",
-    "rebootBody": "Eliminar los archivos <code>10-proxmenux-*.link</code> propios de ProxMenux (<em>Persistent Interface Names</em>) y revertir <em>IOMMU/VFIO</em> no afectan al sistema en ejecución — solo importan tras un reinicio. ProxMenux activa el flag de reinicio automáticamente para estos.",
+    "rebootBody": "Eliminar los archivos <code>10-proxmenux-*.link</code> de ProxMenux (<em>Nombres de interfaz persistentes</em>) y revertir <em>IOMMU/VFIO</em> no cambia el sistema ya arrancado: los cambios se aplican tras reiniciar. ProxMenux marca el reinicio como necesario.",
     "perItemTitle": "Puedes revertir una cosa y mantener el resto",
     "perItemBody": "El uninstaller opera por item. Si solo quieres eliminar Log2RAM pero mantener el tuning de red y los cambios de bashrc, marca solo <em>Log2RAM</em>. Nada más se toca, y el registro se actualiza en consecuencia."
   },
@@ -240,19 +240,19 @@
     "heading": "Inspeccionar el registro manualmente",
     "intro": "Si quieres ver qué está registrado sin abrir el menú:",
     "outro": "Cada entrada <code>\"tool\": true</code> se corresponde con algo que ProxMenux aplicó y puede revertir. Eliminar una entrada manualmente no se recomienda — usa siempre el menú, que también ejecuta la función de reversión en lugar de simplemente olvidarse del cambio.",
-    "reinstallTitle": "Reinstalación tras uninstall",
+    "reinstallTitle": "Reinstalar tras desinstalar",
     "reinstallBody": "Revertir una optimización no te impide volver a aplicarla más tarde. Abre <link>el menú Post-Install</link> de nuevo y ejecuta Automatizado o Personalizable — el registro recogerá el nuevo estado."
   },
   "related": {
     "heading": "Relacionado",
     "items": [
       {
-        "label": "Automated Post-Install",
+        "label": "Post-instalación automatizada",
         "href": "/docs/post-install/automated",
         "tail": " — vuelve a aplicar el baseline de valores por defecto sensatos."
       },
       {
-        "label": "Customizable Post-Install",
+        "label": "Post-instalación personalizable",
         "href": "/docs/post-install/customizable",
         "tail": " — elige un subconjunto distinto."
       },
@@ -262,7 +262,7 @@
         "tail": " — operación distinta: elimina el propio ProxMenux, no sus optimizaciones aplicadas."
       },
       {
-        "label": "Resumen de Post-Install",
+        "label": "Resumen de post-instalación",
         "href": "/docs/post-install",
         "tail": "."
       }
diff --git a/web/messages/es/docs/post-install/updates.json b/web/messages/es/docs/post-install/updates.json
index 3b0b1618..daea8ffc 100644
--- a/web/messages/es/docs/post-install/updates.json
+++ b/web/messages/es/docs/post-install/updates.json
@@ -1,12 +1,12 @@
 {
   "meta": {
-    "title": "Apply Available Updates — Optimizaciones post-instalación | ProxMenux Documentation",
-    "description": "Cómo ProxMenux detecta cuándo una optimización post-instalación (Log2Ram, Memory Settings, System Limits, Logrotate, tuning de red…) se ha actualizado upstream, y cómo aplicar la nueva versión — desde el menú Post-Install o desde el panel del Monitor."
+    "title": "Aplicar actualizaciones disponibles — Optimizaciones post-instalación | Documentación de ProxMenux",
+    "description": "Cómo ProxMenux detecta las nuevas versiones de optimizaciones post-instalación (Log2Ram, ajustes de memoria, límites del sistema, Logrotate, red…) y cómo aplicarlas desde el menú post-instalación o el panel de Monitor."
   },
   "header": {
-    "title": "Apply Available Updates",
+    "title": "Aplicar actualizaciones disponibles",
     "description": "Cuando una optimización post-instalación (Log2Ram, Memory Settings, System Limits, Logrotate…) tiene en disco una versión más nueva que la registrada actualmente en el host, ProxMenux la muestra como una actualización disponible. Puedes aplicarla desde el menú Post-Install (lado Scripts) o desde el panel del Monitor — ambas rutas vuelven a ejecutar la misma función post-instalación y refrescan el registro.",
-    "section": "Settings post-install Proxmox"
+    "section": "Configuración post instalación de Proxmox"
   },
   "intro": {
     "title": "Qué es esto",
@@ -14,7 +14,7 @@
   },
   "why": {
     "heading": "Por qué existe",
-    "body": "Las optimizaciones post-instalación reciben mejoras de vez en cuando — un mejor tuning de sysctl, un límite de Logrotate más estricto, una nueva heurística de tamaño de Log2RAM, un fix para un caso límite reportado por un tester. Sin una ruta de actualización el operador solo tenía dos opciones: volver a ejecutar manualmente el script post-instalación (lo que reaplica <em>cada</em> optimización) o saltarse la mejora por completo. Apply Available Updates es el término medio: una re-ejecución opt-in por optimización que sube solo las versiones que realmente se han movido."
+    "body": "Las optimizaciones post-instalación reciben mejoras: ajustes de sysctl, límites Logrotate más estrictos, nuevas reglas para dimensionar Log2RAM o correcciones de casos límite. Sin esta vía había que repetir el script, que reaplica <em>todas</em> las optimizaciones, o renunciar a la mejora. Aplicar actualizaciones disponibles permite elegir individualmente solo las optimizaciones cuya versión ha cambiado."
   },
   "detection": {
     "heading": "Cómo se detectan las actualizaciones",
@@ -25,7 +25,7 @@
       },
       {
         "title": "Registro versionado en el host",
-        "body": "Cuando el operador aplicó cada optimización, la llamada <code>register_tool</code> correspondiente escribió la versión activa en <code>/usr/local/share/proxmenux/installed_tools.json</code>. Ese archivo es la fuente de verdad de \"qué está activo en este host ahora mismo\"."
+        "body": "Cuando el usuario aplicó cada optimización, la llamada <code>register_tool</code> correspondiente escribió la versión activa en <code>/usr/local/share/proxmenux/installed_tools.json</code>. Ese archivo es la fuente de verdad de \"qué está activo en este host ahora mismo\"."
       },
       {
         "title": "El Monitor compara ambos lados",
@@ -33,24 +33,24 @@
       },
       {
         "title": "Una notificación por versión nueva",
-        "body": "Cuando al menos una optimización tiene una actualización pendiente, el Monitor emite una única notificación agrupada — por ejemplo <em>\"4 ProxMenux optimization update(s) available\"</em> — con una línea por herramienta en el mismo formato <code>name (vX → vY)</code> que se usa para las actualizaciones de paquetes de Proxmox. La notificación es anti-cascada para que no se repita día tras día con el mismo conjunto; solo una versión nueva (o una herramienta nueva que entra en la lista) la vuelve a disparar."
+        "body": "Cuando hay al menos una actualización pendiente, Monitor envía una única notificación agrupada, por ejemplo <em>«4 actualizaciones de optimizaciones de ProxMenux disponibles»</em>, con una línea por herramienta en formato <code>name (vX → vY)</code>, igual que para los paquetes Proxmox. Evita repeticiones diarias del mismo conjunto: solo una versión nueva o una nueva herramienta en la lista vuelve a activarla."
       }
     ]
   },
   "pathA": {
-    "heading": "Ruta A — Desde el menú Post-Install",
-    "intro": "Desde el menú principal de ProxMenux, abre <strong>Settings post-install Proxmox</strong>. Cuando hay actualizaciones pendientes, una entrada nueva <strong>Apply available updates (N)</strong> aparece justo encima de <em>Uninstall optimizations</em>. El número refleja cuántas optimizaciones tienen una versión más nueva en disco que la que el host tiene registrada actualmente. Cuando todo está al día la entrada simplemente no aparece, así el menú se mantiene limpio.",
-    "menuAlt": "Menú de Post-Install Scripts mostrando la entrada condicional 'Apply available updates (N)' posicionada justo encima de 'Uninstall optimizations', con el contador indicando cuántas optimizaciones tienen una versión más nueva en disco",
-    "menuCaption": "La entrada <em>Apply available updates (N)</em> solo se renderiza cuando al menos una optimización tiene una actualización pendiente — se oculta cuando el host está al día.",
+    "heading": "Ruta A — Desde el menú post-instalación",
+    "intro": "Desde el menú principal de ProxMenux, abre <strong>Configuración post instalación de Proxmox</strong>. Si hay actualizaciones pendientes, aparece <strong>Aplicar actualizaciones disponibles (N)</strong> justo encima de <em>Desinstalar optimizaciones</em>. El número indica cuántas optimizaciones tienen una versión en disco más reciente que la registrada. Si todo está al día, la entrada se oculta.",
+    "menuAlt": "Menú de scripts post-instalación con la entrada condicional Aplicar actualizaciones disponibles (N) encima de Desinstalar optimizaciones; el contador indica cuántas optimizaciones tienen una versión más nueva en disco",
+    "menuCaption": "La entrada <em>Aplicar actualizaciones disponibles (N)</em> solo aparece cuando al menos una optimización tiene una actualización pendiente; se oculta si el host está al día.",
     "checklistBody": "Seleccionar la entrada abre un checklist con cada actualización pendiente, cada fila formateada como <code>name (vX → vY)</code>. Todas las filas están pre-marcadas por defecto; desmarca las que no quieras aplicar esta ronda.",
-    "checklistAlt": "Diálogo checklist Apply Available Updates con una fila por optimización pendiente, cada una etiquetada con el nombre de la optimización y la transición de versión (actual → disponible). Todas las filas pre-marcadas.",
-    "checklistCaption": "Opt-in por optimización: elige exactamente qué versiones subir. El mismo motor que alimenta Automatizado y Personalizable post-instalación se ejecuta en segundo plano para reaplicar cada función y refrescar su versión en el registro."
+    "checklistAlt": "Diálogo Aplicar actualizaciones disponibles con una fila por optimización pendiente, su nombre y el cambio de versión (actual → disponible). Todas las filas están seleccionadas.",
+    "checklistCaption": "Selección individual por optimización: elige qué versiones actualizar. El mismo motor de Automatizado y Personalizable vuelve a aplicar cada función en segundo plano y actualiza su versión en el registro."
   },
   "pathB": {
     "heading": "Ruta B — Desde el panel del Monitor",
-    "intro": "Las mismas actualizaciones aparecen en el Monitor bajo <link>Settings → ProxMenux Optimizations</link>. Cuando se detectan actualizaciones pendientes la tarjeta muestra un banner \"Updates available\" con el contador y una acción <strong>Apply</strong> que abre el mismo selector por optimización.",
-    "imageAlt": "Tarjeta de ProxMenux Optimizations en el panel del Monitor con un banner Updates available arriba mostrando el contador de actualizaciones pendientes y un botón Apply que abre el selector por optimización",
-    "imageCaption": "La tarjeta Optimizations en el Monitor — cuando al menos una optimización tiene una versión más nueva en disco, el banner lo muestra sin necesidad de acceso por shell."
+    "intro": "Las mismas actualizaciones aparecen en Monitor, en <link>Ajustes → Optimizaciones de ProxMenux</link>. Si hay actualizaciones pendientes, la tarjeta muestra un <strong>contador de actualizaciones</strong> que abre el selector por optimización. Cada herramienta también ofrece su propia acción de actualización.",
+    "imageAlt": "Tarjeta Optimizaciones de ProxMenux en los ajustes de Monitor, con un contador de actualizaciones pendientes que abre el selector por optimización y acciones de actualización por herramienta",
+    "imageCaption": "La tarjeta Optimizaciones de Monitor permite acceder a las actualizaciones mediante su contador cuando hay una versión más nueva en disco, sin entrar en la shell."
   },
   "applying": {
     "heading": "Qué pasa cuando aplicas",
@@ -69,7 +69,7 @@
       },
       {
         "title": "Refresco del registro enviado al Monitor",
-        "body": "Al terminar el batch, el menú hace POST a <code>http://127.0.0.1:8008/api/updates/post-install/scan</code> para reconstruir <code>/usr/local/share/proxmenux/updates_available.json</code>. Eso hace que la tarjeta de Optimizations del Monitor y la entrada del menú de shell desaparezcan inmediatamente tras la actualización, sin esperar al siguiente escaneo programado."
+        "body": "Al terminar el lote, el menú envía una petición POST a <code>http://127.0.0.1:8008/api/updates/post-install/scan</code> para reconstruir <code>/usr/local/share/proxmenux/updates_available.json</code>. Tras aplicar todo lo pendiente, desaparecen el contador de actualizaciones de la tarjeta Optimizaciones y la entrada condicional de la shell, sin esperar al siguiente análisis. La tarjeta Optimizaciones sigue disponible."
       }
     ],
     "jqTitle": "jq es obligatorio",
@@ -77,7 +77,7 @@
   },
   "differs": {
     "heading": "En qué se diferencia de las otras rutas",
-    "headerPath": "Ruta",
+    "headerPath": "Path",
     "headerScope": "Alcance",
     "headerWhen": "Cuándo tiene sentido",
     "rows": [
@@ -85,7 +85,7 @@
         "pathLabel": "Automatizado",
         "pathHref": "/docs/post-install/automated",
         "scope": "Reaplica <em>cada</em> optimización del bundle.",
-        "when": "Host recién instalado, o re-baseline completo de un nodo totalmente gestionado."
+        "when": "Host recién instalado o reaplicación completa de la base de un nodo totalmente gestionado."
       },
       {
         "pathLabel": "Personalizable",
@@ -94,13 +94,13 @@
         "when": "Selecciona qué optimizaciones están activas en el host."
       },
       {
-        "pathLabel": "Apply available updates",
+        "pathLabel": "Aplicar actualizaciones disponibles",
         "pathHref": null,
         "scope": "Solo las optimizaciones cuya versión ha subido en disco.",
         "when": "Mantén las optimizaciones ya instaladas al día sin tocar el resto."
       },
       {
-        "pathLabel": "Uninstall optimizations",
+        "pathLabel": "Desinstalar optimizaciones",
         "pathHref": "/docs/post-install/uninstall",
         "scope": "Revierte la optimización y elimina su entrada del registro.",
         "when": "Hacer rollback de un cambio específico."
@@ -108,5 +108,5 @@
     ]
   },
   "notifTitle": "Filtro de notificación",
-  "notifBody": "La notificación que anuncia actualizaciones pendientes es el evento <em>ProxMenux optimization updates available</em>. Está activada por defecto en cada canal, se puede silenciar por canal desde <link>Settings → Notifications</link>, y es anti-cascada — se dispara una vez por conjunto distinto de actualizaciones pendientes, no en cada escaneo de 24h."
+  "notifBody": "El evento que anuncia las actualizaciones pendientes es <em>Actualizaciones de optimizaciones de ProxMenux disponibles</em>. Se activa por defecto en todos los canales y se puede silenciar por canal en <link>Ajustes → Notificaciones</link>. Evita repeticiones: se envía una vez por conjunto distinto de actualizaciones pendientes, no en cada análisis de 24 horas."
 }
diff --git a/web/messages/es/docs/post-install/virtualization.json b/web/messages/es/docs/post-install/virtualization.json
index e13450cc..ca1e42e3 100644
--- a/web/messages/es/docs/post-install/virtualization.json
+++ b/web/messages/es/docs/post-install/virtualization.json
@@ -1,19 +1,19 @@
 {
   "meta": {
-    "title": "Post-instalación: Virtualización | ProxMenux Documentation",
-    "description": "Opciones de virtualización en el script post-instalación Customizable de ProxMenux: auto-instalar el guest agent correcto si Proxmox corre dentro de una VM, y activar IOMMU / VFIO para que puedas pasar dispositivos PCI (GPUs, NICs, HBAs) directamente a tus propias VMs."
+    "title": "Post-instalación: Virtualización | Documentación de ProxMenux",
+    "description": "Opciones de virtualización del script post-instalación Personalizable de ProxMenux: instala automáticamente el agente invitado correcto si Proxmox se ejecuta dentro de una VM y activa IOMMU / VFIO para pasar dispositivos PCI (GPU, NIC, HBA) directamente a tus VM."
   },
   "header": {
     "title": "Post-instalación: Virtualización",
-    "section": "Settings post-install Proxmox"
+    "section": "Configuración post instalación de Proxmox"
   },
   "intro": {
     "title": "Qué cubre esta categoría",
-    "body": "Dos opciones independientes. <strong>Install relevant guest agent</strong> es una red de seguridad para cuando Proxmox mismo corre anidado dentro de otro hipervisor. <strong>Enable VFIO IOMMU support</strong> es la que le importa a la mayoría: activa las funcionalidades del kernel que necesitas para pasar una GPU, HBA o NIC directamente a una VM con rendimiento casi nativo."
+    "body": "Dos opciones independientes. <strong>Instalar el guest agent correspondiente</strong> ayuda cuando el propio Proxmox se ejecuta anidado dentro de otro hipervisor. <strong>Activar soporte VFIO IOMMU</strong> es la opción que más usuarios necesitan: activa las funciones del kernel para asignar una GPU, HBA o NIC directamente a una VM con rendimiento casi nativo."
   },
   "guestAgent": {
-    "heading": "Instalar guest agent relevante",
-    "intro": "Detecta el entorno de virtualización en el que corre el host Proxmox (usando <code>systemd-detect-virt</code> y <code>dmidecode</code>) e instala el paquete de guest-tools correspondiente para que el hipervisor exterior pueda comunicarse con Proxmox de forma limpia (shutdown elegante, sincronización de reloj, reporte de IP, etc.).",
+    "heading": "Instalar el guest agent correspondiente",
+    "intro": "Detecta el entorno de virtualización del host Proxmox mediante <code>systemd-detect-virt</code> y <code>dmidecode</code> e instala el paquete de herramientas de invitado correspondiente para comunicarse correctamente con el hipervisor exterior: apagado ordenado, sincronización del reloj, información de IP, etc.",
     "headerDetected": "Host detectado",
     "headerPackage": "Paquete instalado",
     "rows": [
@@ -76,23 +76,23 @@
       "<strong>Dos GPUs:</strong> una puede ir a una VM y la otra a un LXC, pero necesitarás una configuración más granular (vincular solo una tarjeta a <code>vfio-pci</code> por ID PCI). La blacklist por defecto es demasiado amplia para este caso — edita <code>blacklist.conf</code> después."
     ],
     "acsTitle": "Sobre pcie_acs_override — sé consciente de lo que estás activando",
-    "acsBody": "<code>pcie_acs_override=downstream,multifunction</code> relaja el chequeo de PCIe Access Control Services. Permite al kernel partir grupos IOMMU que el firmware reporta como monolíticos, que a veces es la única forma de hacer passthrough de un dispositivo de un grupo sin arrastrar el resto. El trade-off es <strong>aislamiento reducido entre dispositivos</strong>: una VM maliciosa o comprometida con passthrough tiene una superficie de ataque mayor vía DMA. Bien para un home lab; piénsatelo dos veces antes de activarlo en un host que ejecuta cargas no confiables. Si no lo necesitas, quita ese token de <code>/etc/kernel/cmdline</code> o <code>/etc/default/grub</code> tras ejecutar el script y vuelve a ejecutar el paso de actualización del cargador de arranque.",
+    "acsBody": "<code>pcie_acs_override=downstream,multifunction</code> relaja el chequeo de PCIe Access Control Services. Permite al kernel partir grupos IOMMU que el firmware reporta como monolíticos, que a veces es la única forma de hacer passthrough de un dispositivo de un grupo sin arrastrar el resto. El trade-off es <strong>aislamiento reducido entre dispositivos</strong>: una VM maliciosa o comprometida con passthrough tiene una superficie de ataque mayor vía DMA. Bien para un home lab; piénsatelo dos veces antes de activarlo en un host que ejecuta cargas no confiables. Si no lo necesitas, elimina ese token de <code>/etc/kernel/cmdline</code> o <code>/etc/default/grub</code> tras ejecutar el script y vuelve a ejecutar el paso de actualización del cargador de arranque.",
     "rebootTitle": "Se requiere reinicio",
     "rebootBody": "IOMMU, los módulos VFIO y la blacklist solo surten efecto tras un reinicio + regeneración del initramfs. El script dispara <code>update-initramfs -u -k all</code> y el refresh del cargador de arranque, y activa el flag de \"se requiere reinicio\" para que Personalizable te lo pregunte al final.",
     "verifyTitle": "Verificación tras el reinicio",
-    "revertTitle": "Reversible desde el menú Uninstall",
-    "revertBody": "<link>Uninstall Optimizations</link> revierte todos los cambios: quita los tokens IOMMU de <code>/etc/kernel/cmdline</code> o GRUB, quita los módulos VFIO de <code>/etc/modules</code>, quita las entradas de blacklist de drivers y reconstruye el initramfs. Se requiere un reinicio para aplicar realmente la reversión."
+    "revertTitle": "Reversible desde el menú Desinstalar",
+    "revertBody": "<link>Desinstalar optimizaciones</link> revierte todos los cambios: elimina los parámetros IOMMU de <code>/etc/kernel/cmdline</code> o GRUB, elimina los módulos VFIO de <code>/etc/modules</code>, elimina las entradas de bloqueo de controladores y reconstruye initramfs. Debes reiniciar para aplicar la reversión."
   },
   "related": {
     "heading": "Relacionado",
     "items": [
       {
-        "label": "Add GPU to VM (Passthrough)",
+        "label": "Añadir GPU a VM (Passthrough)",
         "href": "/docs/hardware/gpu-vm-passthrough",
         "tail": " — siguiente paso natural una vez IOMMU + VFIO están activos."
       },
       {
-        "label": "Add Controller or NVMe to VM",
+        "label": "Añadir Controlador o NVMe a VM",
         "href": "/docs/disk-manager/add-controller-nvme-vm",
         "tail": " — misma infraestructura de passthrough para controladoras de almacenamiento."
       },
@@ -102,12 +102,12 @@
         "tail": " — referencia de verificación de IOMMU."
       },
       {
-        "label": "Uninstall Optimizations",
+        "label": "Desinstalar optimizaciones",
         "href": "/docs/post-install/uninstall",
         "tail": " — revierte IOMMU / VFIO de forma limpia."
       },
       {
-        "label": "Customizable Post-Install",
+        "label": "Post-instalación personalizable",
         "href": "/docs/post-install/customizable",
         "tail": " — volver al menú padre."
       }
diff --git a/web/messages/es/docs/security/fail2ban.json b/web/messages/es/docs/security/fail2ban.json
index d1fdd044..d72c9441 100644
--- a/web/messages/es/docs/security/fail2ban.json
+++ b/web/messages/es/docs/security/fail2ban.json
@@ -1,30 +1,30 @@
 {
   "meta": {
-    "title": "Fail2Ban | ProxMenux Documentation",
+    "title": "Fail2Ban | Documentación de ProxMenux",
     "description": "Instala Fail2Ban con tres jails afinados para Proxmox (SSH agresivo, Proxmox UI 8006, ProxMenux Monitor 8008). Incluye el arreglo de journald MaxLevelStore, servicios de log propios para fiabilidad, backend nftables/iptables autodetectado y hardening de SSH MaxAuthTries.",
-    "ogTitle": "Fail2Ban | ProxMenux Documentation",
-    "ogDescription": "Protección contra fuerza bruta para SSH y las UIs web de Proxmox, con arreglos específicos de journald y backend para Proxmox."
+    "ogTitle": "Fail2Ban | Documentación de ProxMenux",
+    "ogDescription": "Protección contra fuerza bruta para SSH y las interfaces web de Proxmox, con correcciones de journald y del backend específicas para Proxmox."
   },
   "header": {
     "title": "Fail2Ban",
-    "description": "Instala Fail2Ban con una configuración específica para Proxmox: tres jails (SSH agresivo, Proxmox UI en puerto 8006, ProxMenux Monitor en puerto 8008 + proxy inverso), un arreglo del nivel de log de journald para que los eventos de autenticación SSH se almacenen de verdad, dos servicios logger journal-a-archivo que rodean un problema conocido del backend systemd de Fail2Ban, backend de firewall autodetectado y hardening de SSH MaxAuthTries.",
+    "description": "Instala Fail2Ban con configuración para Proxmox: tres jails (SSH agresivo, Proxmox en 8006 y ProxMenux Monitor en 8008 y proxy inverso), corrección del nivel de journald para guardar fallos SSH, dos servicios que copian el journal a archivos para evitar un problema del backend systemd de Fail2Ban, detección del backend de firewall y refuerzo SSH mediante MaxAuthTries.",
     "section": "Seguridad"
   },
   "intro": {
     "title": "Qué hace",
-    "body": "Instala Fail2Ban desde los repos de Debian y escribe una configuración completa afinada para Proxmox que protege tres superficies de ataque (SSH, Proxmox UI, ProxMenux Monitor) por defecto. Detecta una instalación existente y ofrece un menú de gestión (reinstalar / eliminar) en lugar de volver a ejecutar el instalador."
+    "body": "Instala Fail2Ban desde los repositorios Debian y escribe una configuración para Proxmox que protege SSH, Proxmox UI y ProxMenux Monitor desde el primer momento. Si detecta una instalación existente, ofrece un menú para reinstalar o eliminar."
   },
   "firstLaunch": {
     "heading": "Diálogo de primer lanzamiento",
-    "body": "En un host sin Fail2Ban, el script muestra un diálogo de confirmación que resume todo lo que va a instalar y configurar. Cancelar sale sin cambios; confirmar arranca el flujo de instalación.",
-    "imageAlt": "Diálogo de confirmación de instalación de Fail2Ban listando los tres jails, el arreglo de journald y el hardening de SSH"
+    "body": "Sin Fail2Ban instalado, el script muestra un diálogo con lo que instalará y configurará. Cancelar termina sin cambios; confirmar inicia la instalación.",
+    "imageAlt": "Confirmación de instalación de Fail2Ban con las tres jails, corrección de journald y refuerzo SSH"
   },
   "jails": {
     "heading": "Los tres jails",
     "headerJail": "Jail",
     "headerProtects": "Protege",
     "headerRetries": "Reintentos / Ventana",
-    "headerBan": "Tiempo de ban",
+    "headerBan": "Tiempo de bloqueo",
     "rows": [
       {
         "jail": "[sshd]",
@@ -49,12 +49,12 @@
   },
   "journald": {
     "heading": "Por qué importa el arreglo de journald",
-    "intro": "Proxmox entrega <code>/etc/systemd/journald.conf</code> con <codeNw>MaxLevelStore=warning</codeNw>. journald descarta cada mensaje de log <em>por debajo</em> de warning antes de almacenarlo. SSH y PAM emiten fallos de autenticación a niveles <em>info</em> / <em>notice</em>, así que:",
+    "intro": "Proxmox incluye <code>/etc/systemd/journald.conf</code> con <codeNw>MaxLevelStore=warning</codeNw>. journald descarta los mensajes de nivel <em>inferior</em> a warning antes de guardarlos. SSH y PAM emiten fallos de autenticación en los niveles <em>info</em> / <em>notice</em>, por lo que:",
     "diagram": {
       "sshLabel": "SSH / PAM",
       "sshDetail": "fallo de autenticación\n(nivel info / notice)",
       "journaldLabel": "journald",
-      "journaldDetail": "MaxLevelStore=warning\n→ evento descartado en silencio",
+      "journaldDetail": "MaxLevelStore=warning\n→ evento descartado sin aviso",
       "fail2banLabel": "Fail2Ban",
       "fail2banDetail": "no ve nada\n→ nunca banea nada",
       "arrowLabel": "Proxmox por defecto"
@@ -65,8 +65,8 @@
   },
   "loggers": {
     "heading": "Por qué dos servicios logger propios",
-    "intro1": "Fail2Ban puede leer directamente del journal de systemd (<code>backend = systemd</code>), pero en Proxmox este backend tiene problemas conocidos de fiabilidad con los procesos worker de <code>pvedaemon</code> (los eventos de autenticación aparecen en el journal pero Fail2Ban no siempre los recoge) e intermitentemente con <code>sshd</code>.",
-    "intro2": "La solución alternativa: ProxMenux crea dos pequeños servicios systemd que hacen <code>journalctl -f</code> de las unidades relevantes y añaden cada línea a un archivo. Fail2Ban entonces lee esos archivos con el sólido como una roca <code>backend = auto</code> (modo archivo):",
+    "intro1": "Fail2Ban puede leer directamente el journal de systemd (<code>backend = systemd</code>), pero en Proxmox este backend presenta problemas de fiabilidad con procesos worker de <code>pvedaemon</code> (los eventos aparecen en el journal pero Fail2Ban no siempre los recoge) y ocasionalmente con <code>sshd</code>.",
+    "intro2": "ProxMenux crea dos pequeños servicios systemd que siguen las unidades correspondientes con <code>journalctl -f</code> y añaden cada línea a un archivo. Fail2Ban lee esos archivos con el fiable <code>backend = auto</code> (modo archivo):",
     "headerService": "Servicio",
     "headerSource": "Unidad origen",
     "headerOutput": "Archivo de salida",
@@ -91,12 +91,12 @@
   },
   "hardening": {
     "heading": "Hardening de SSH: MaxAuthTries",
-    "intro": "El control de Lynis <strong>SSH-7408</strong> recomienda <code>MaxAuthTries 3</code> en <code>sshd_config</code>. Con el <code>maxretry = 2</code> de Fail2Ban en el jail SSH, un cliente malicioso nunca llega a tres intentos de todas formas — pero el ajuste explícito satisface la auditoría y añade defensa en profundidad (p. ej. si Fail2Ban está parado por mantenimiento).",
+    "intro": "El control Lynis <strong>SSH-7408</strong> recomienda <code>MaxAuthTries 3</code> en <code>sshd_config</code>. La jail SSH usa <code>maxretry = 2</code> para bloquear tras fallos repetidos; MaxAuthTries limita los intentos dentro de una conexión. Este ajuste SSH añade defensa en profundidad, también cuando Fail2Ban está detenido por mantenimiento.",
     "installerIntro": "El instalador:",
     "items": [
       "Lee el valor actual de <code>MaxAuthTries</code> (o por defecto 6 si está ausente).",
       "Lo guarda en <code>/usr/local/share/proxmenux/sshd_maxauthtries_backup</code>.",
-      "Edita <code>sshd_config</code> en sitio — reemplaza la línea existente, descomenta la línea comentada o la añade.",
+      "Edita <code>sshd_config</code> directamente: sustituye la línea existente, descomenta la comentada o añade una nueva.",
       "Recarga <code>sshd</code> (reload, no restart, para mantener vivas las sesiones existentes)."
     ],
     "outro": "Al desinstalar, el valor original guardado se restaura y se recarga <code>sshd</code> otra vez."
@@ -109,7 +109,7 @@
     "rows": [
       {
         "action": "Reinstalar",
-        "what": "Vuelve a ejecutar el instalador completo — reescribe todos los jails con los valores por defecto actuales de ProxMenux. Úsalo cuando una actualización de ProxMenux suba los valores recomendados."
+        "what": "Repite la instalación completa y reescribe todas las jails con los valores actuales de ProxMenux. Úsalo cuando una actualización cambie las recomendaciones."
       },
       {
         "action": "Eliminar",
@@ -125,7 +125,7 @@
   "troubleshoot": {
     "heading": "Solución de problemas",
     "neverBansTitle": "Fail2Ban corre pero nunca banea nada",
-    "neverBansBody": "Comprueba que los archivos de log de autenticación reciben entradas de verdad: <code>tail -f /var/log/ssh-auth.log</code> y prueba un intento SSH con contraseña incorrecta desde otra máquina. Si el log se queda vacío, el servicio logger no está corriendo: <code>systemctl status ssh-auth-logger.service</code>. Si está activo pero el log está vacío, comprueba que el drop-in de journald surtió efecto: <code>journalctl --dump-catalog | head</code> — eventos a nivel <em>info</em> deberían ser visibles.",
+    "neverBansBody": "Comprueba que <code>tail -f /var/log/ssh-auth.log</code> recibe una entrada tras intentar acceder por SSH con contraseña incorrecta desde otra máquina. Si sigue vacío, consulta <code>systemctl status ssh-auth-logger.service</code>. Si el logger está activo, mira los eventos SSH recientes con <code>journalctl -u ssh.service -n 50 --no-pager -p info</code> y comprueba que el drop-in de journald admite el nivel <em>info</em>.",
     "monitorEmptyTitle": "El jail del Monitor de ProxMenux no tiene entradas ni siquiera tras logins fallidos",
     "monitorEmptyBody": "El jail <code>[proxmenux]</code> lee <code>/var/log/proxmenux-auth.log</code>, que lo escribe la app Flask del Monitor de ProxMenux — no un logger de journald. Si no usas el Monitor, el archivo se queda vacío y el jail nunca dispara. Eso es lo esperado; la configuración del jail es inocua. Si sí usas el Monitor y el log está vacío, comprueba la configuración de logging de Flask.",
     "selfBanTitle": "Me he baneado a mí mismo",
@@ -143,7 +143,7 @@
   "related": {
     "heading": "Relacionado",
     "monitorLabel": "ProxMenux Monitor → pestaña de Seguridad",
-    "monitorTail": " — misma instalación accesible desde el panel, más estado en vivo de los jails, IPs baneadas y ajuste por jail de reintentos / tiempo de ban desde el navegador.",
+    "monitorTail": " — instalación desde el panel, estado de las jails en directo, IP bloqueadas y ajuste de reintentos y duración de bloqueo por jail desde el navegador.",
     "lynisLabel": "Lynis",
     "lynisTail": " — ejecuta una auditoría de seguridad antes/después para confirmar que el control SSH-7408 se satisface.",
     "securityLabel": "Resumen de Seguridad",
diff --git a/web/messages/es/docs/security/index.json b/web/messages/es/docs/security/index.json
index 7e89921b..09522610 100644
--- a/web/messages/es/docs/security/index.json
+++ b/web/messages/es/docs/security/index.json
@@ -1,24 +1,24 @@
 {
   "meta": {
-    "title": "Seguridad de Proxmox — Fail2Ban, auditoría de hardening con Lynis | ProxMenux",
-    "description": "Dos herramientas de seguridad instalables para Proxmox VE: Fail2Ban (prevención de intrusiones para SSH, la UI web de Proxmox y el Monitor de ProxMenux) y Lynis (escáner de auditoría y hardening de seguridad instalado desde GitHub upstream).",
-    "ogTitle": "Seguridad de Proxmox — Fail2Ban, auditoría de hardening con Lynis",
-    "ogDescription": "Fail2Ban y Lynis para Proxmox VE — prevención de intrusiones más una auditoría de hardening instaladas y gestionadas por ProxMenux.",
+    "title": "Seguridad de Proxmox — Fail2Ban y auditoría de refuerzo con Lynis | ProxMenux",
+    "description": "Dos herramientas de seguridad para Proxmox VE: Fail2Ban (prevención de intrusiones para SSH, la interfaz web de Proxmox y ProxMenux Monitor) y Lynis (auditor de seguridad y refuerzo del sistema instalado desde el repositorio original en GitHub).",
+    "ogTitle": "Seguridad de Proxmox — Fail2Ban y auditoría de refuerzo con Lynis",
+    "ogDescription": "Fail2Ban y Lynis para Proxmox VE: prevención de intrusiones y auditoría de refuerzo, instaladas y gestionadas por ProxMenux.",
     "twitterTitle": "Seguridad de Proxmox | ProxMenux",
-    "twitterDescription": "Fail2Ban y Lynis para Proxmox VE — prevención de intrusiones y auditoría de hardening."
+    "twitterDescription": "Fail2Ban y Lynis para Proxmox VE: prevención de intrusiones y auditoría de refuerzo."
   },
   "header": {
     "title": "Seguridad",
-    "description": "Dos herramientas de seguridad complementarias para Proxmox VE: una defensa activa (Fail2Ban — banea IPs que atacan SSH o las UIs web) y una auditoría offline (Lynis — escanea el sistema en busca de huecos de hardening y da una puntuación 0–100). Ambas se instalan y gestionan mediante su propio menú dedicado, con detección de una instalación existente antes de cualquier acción.",
+    "description": "Dos herramientas complementarias para Proxmox VE: defensa activa (Fail2Ban bloquea IP que atacan SSH o las interfaces web) y auditoría local (Lynis busca carencias de seguridad y da una puntuación de 0 a 100). Cada una tiene su propio menú de instalación y gestión, que detecta instalaciones existentes antes de actuar.",
     "section": "Seguridad"
   },
   "intro": {
-    "title": "Defensa activa vs. auditoría offline",
-    "body": "Estas dos herramientas responden a preguntas distintas. <strong>Fail2Ban</strong> responde a <em>\"¿hay algo atacándonos ahora mismo?\"</em> vigilando los logs de autenticación y baneando las IPs ofensoras. <strong>Lynis</strong> responde a <em>\"¿cómo de hardened está este host?\"</em> ejecutando una auditoría de un tirón e imprimiendo recomendaciones concretas. Úsalas juntas: Lynis te dice qué arreglar, Fail2Ban gestiona el abuso en vivo."
+    "title": "Defensa activa y auditoría local",
+    "body": "Responden a preguntas distintas. <strong>Fail2Ban</strong> contesta <em>«¿nos están atacando ahora?»</em> vigilando registros de autenticación y bloqueando las IP responsables. <strong>Lynis</strong> contesta <em>«¿qué nivel de refuerzo tiene este host?»</em> mediante una auditoría puntual con recomendaciones concretas. Usa ambas: Lynis indica qué mejorar y Fail2Ban responde a los ataques en curso."
   },
   "opening": {
     "heading": "Abrir el menú",
-    "body": "Desde el menú principal de ProxMenux, selecciona <strong>Seguridad</strong>. Verás esto:",
+    "body": "Desde el menú principal de ProxMenux, selecciona <strong>Seguridad</strong>. Verás lo siguiente:",
     "imageAlt": "Menú de Seguridad con opciones de Fail2Ban y Lynis"
   },
   "pick": {
@@ -28,7 +28,7 @@
   "cards": {
     "fail2ban": {
       "title": "Fail2Ban",
-      "body": "Prevención de intrusiones activa. Vigila los logs de autenticación de SSH y las UIs web y banea IPs tras fallos repetidos.",
+      "body": "Prevención activa de intrusiones. Vigila los registros de autenticación de SSH y las interfaces web y bloquea IP tras fallos repetidos.",
       "bullets": [
         "Tres jails: SSH, Proxmox UI (8006), ProxMenux Monitor (8008)",
         "Arregla los valores por defecto de journald de Proxmox que bloquean los logs de autenticación",
@@ -38,28 +38,28 @@
     },
     "lynis": {
       "title": "Lynis",
-      "body": "Auditor de seguridad offline. Escanea el host e imprime una puntuación de hardening más pistas concretas de remediación.",
+      "body": "Auditor local de seguridad. Analiza el host y muestra una puntuación de refuerzo y recomendaciones concretas para corregir problemas.",
       "bullets": [
-        "Instalado desde el GitHub upstream de CISOfy (siempre el último)",
-        "Puntuación de hardening 0–100 + lista de warnings y sugerencias",
-        "Acciones de ejecutar auditoría y actualizar dentro del menú",
-        "De solo lectura por diseño — nunca cambia el sistema"
+        "Instalado desde el repositorio original de CISOfy en GitHub (última versión)",
+        "Puntuación de refuerzo 0–100 y lista de advertencias y sugerencias",
+        "Acciones de auditoría y actualización desde el menú",
+        "De solo lectura: nunca modifica el sistema"
       ]
     }
   },
   "workflowTip": {
     "title": "Flujo de trabajo que usa ambos",
-    "body": "Ejecuta primero una auditoría de Lynis para ver tu puntuación de partida y las recomendaciones principales. Aplica los arreglos que quieras. Después instala Fail2Ban — implementa una de las recomendaciones más comunes de Lynis (protección contra fuerza bruta SSH) automáticamente y ajusta <code>MaxAuthTries</code> en <code>sshd_config</code> para satisfacer el control SSH-7408. Vuelve a ejecutar Lynis después para confirmar que la puntuación mejoró."
+    "body": "Ejecuta primero una auditoría Lynis para ver la puntuación inicial y las recomendaciones principales. Aplica las correcciones que elijas. Instala Fail2Ban: implementa automáticamente la protección contra fuerza bruta SSH y ajusta <code>MaxAuthTries</code> en <code>sshd_config</code> para cumplir el control SSH-7408. Vuelve a ejecutar Lynis para comprobar la mejora."
   },
   "fail2banSection": {
     "heading": "Fail2Ban",
     "body": "ProxMenux instala Fail2Ban con una configuración afinada específicamente para Proxmox. Más allá del jail estándar de SSH, añade protección para la UI web de Proxmox y el Monitor de ProxMenux, y rodea dos rarezas específicas de Proxmox: un valor por defecto de journald que descarta eventos de autenticación, y el problema del backend systemd que impide a Fail2Ban leer de forma fiable ciertas fuentes del journal. La página de detalle cubre el flujo de instalación completo, los tres jails, el arreglo de journald, el cambio de hardening SSH y la chuleta de solución de problemas.",
     "optionTitle": "Fail2Ban — instalar y gestionar",
-    "optionDescription": "Tres jails preconfigurados (sshd agresivo, Proxmox UI puerto 8006, ProxMenux Monitor puerto 8008 + proxy inverso), backend nftables/iptables autodetectado, arreglo de journald y hardening de SSH MaxAuthTries."
+    "optionDescription": "Tres jails preconfiguradas (sshd agresivo, Proxmox en 8006, ProxMenux Monitor en 8008 y proxy inverso), detección de nftables/iptables, corrección de journald y refuerzo SSH mediante MaxAuthTries."
   },
   "lynisSection": {
     "heading": "Lynis",
-    "body": "ProxMenux clona Lynis desde <code>github.com/CISOfy/lynis</code> en <code>/opt/lynis</code> y lo expone como <code>/usr/local/bin/lynis</code>. El paquete de Debian se evita intencionadamente porque va varias versiones mayores por detrás de upstream. La página de detalle cubre el flujo de instalar / auditar / actualizar / desinstalar, cómo leer el informe y cómo actuar sobre los hallazgos.",
+    "body": "ProxMenux clona Lynis de <code>github.com/CISOfy/lynis</code> en <code>/opt/lynis</code> y lo expone como <code>/usr/local/bin/lynis</code>. Evita el paquete Debian porque va varias versiones principales por detrás del proyecto original. La página detallada explica instalación, auditoría, actualización, desinstalación, lectura del informe y aplicación de sus recomendaciones.",
     "optionTitle": "Lynis — instalar, auditar y gestionar",
     "optionDescription": "Instala el último Lynis desde el repo oficial de CISOfy en GitHub (no el paquete más antiguo de Debian), ejecuta auditorías del sistema con puntuación de hardening y actualiza vía git pull."
   },
diff --git a/web/messages/es/docs/security/lynis.json b/web/messages/es/docs/security/lynis.json
index 46cddaa9..d5387aa7 100644
--- a/web/messages/es/docs/security/lynis.json
+++ b/web/messages/es/docs/security/lynis.json
@@ -1,37 +1,37 @@
 {
   "meta": {
-    "title": "Lynis | ProxMenux Documentation",
-    "description": "Instala Lynis desde el repositorio oficial de CISOfy en GitHub (siempre el último), ejecuta una auditoría del sistema con puntuación de hardening 0–100, actualiza vía git pull. De solo lectura por diseño — nunca modifica el sistema.",
-    "ogTitle": "Lynis | ProxMenux Documentation",
-    "ogDescription": "Instala y ejecuta el auditor de seguridad Lynis en Proxmox VE. Instalación desde GitHub upstream, auditoría, actualización."
+    "title": "Lynis | Documentación de ProxMenux",
+    "description": "Instala Lynis desde el repositorio oficial CISOfy de GitHub, ejecuta una auditoría con puntuación de refuerzo de 0 a 100 y actualiza mediante git pull. Auditor de solo lectura: no modifica el sistema.",
+    "ogTitle": "Lynis | Documentación de ProxMenux",
+    "ogDescription": "Instala y ejecuta el auditor de seguridad Lynis en Proxmox VE. Instalación desde el repositorio original GitHub, auditoría y actualización."
   },
   "header": {
     "title": "Lynis",
-    "description": "Clona el último Lynis desde el repositorio oficial de CISOfy en GitHub, lo expone como /usr/local/bin/lynis y ofrece acciones de ejecutar auditoría / actualizar / reinstalar / desinstalar desde el menú. Auditor de solo lectura por diseño — nunca modifica el sistema, solo reporta.",
+    "description": "Clona el último Lynis del repositorio oficial CISOfy en GitHub, lo expone como /usr/local/bin/lynis y ofrece auditoría, actualización, reinstalación y desinstalación desde el menú. El auditor es de solo lectura: informa sin modificar el sistema.",
     "section": "Seguridad"
   },
   "intro": {
     "title": "Qué hace",
-    "body": "Instala Lynis (el auditor de seguridad de código abierto de CISOfy) desde GitHub upstream en <code>/opt/lynis</code> y crea un wrapper en <code>/usr/local/bin/lynis</code> para que esté en tu <code>PATH</code>. Detecta una instalación existente al arrancar y muestra un menú de gestión (auditoría / actualizar / reinstalar / eliminar) en su lugar."
+    "body": "Instala Lynis, el auditor de código abierto de CISOfy, desde su repositorio GitHub en <code>/opt/lynis</code> y crea un script lanzador en <code>/usr/local/bin/lynis</code> para incluirlo en <code>PATH</code>. Si detecta una instalación existente al abrirlo, muestra un menú de auditoría, actualización, reinstalación o eliminación."
   },
   "manageMenu": {
-    "heading": "Menú de gestión (tras la instalación)",
+    "heading": "Menú de gestión (tras instalar)",
     "intro": "Una vez instalado Lynis, cada invocación posterior abre el menú de gestión en lugar de volver a ejecutar el instalador. Desde aquí lanzas una auditoría, actualizas vía git pull, reinstalas o desinstalas:",
     "imageAlt": "Menú de gestión de Lynis con opciones de auditoría, actualizar, reinstalar y eliminar"
   },
   "whyUpstream": {
-    "heading": "Por qué GitHub upstream, no apt",
-    "intro": "Debian entrega Lynis vía apt, pero el paquete suele ir varias versiones mayores por detrás de upstream. Los controles más nuevos, los arreglos para nuevos vectores de ataque y las recomendaciones refinadas solo aterrizan en el repo de GitHub. El propio Lynis es un script de shell autocontenido — sin compilación, sin dependencias más allá de <code>git</code> para la instalación — así que clonar el repo es el método de instalación canónico recomendado por la propia CISOfy.",
+    "heading": "Por qué el repositorio oficial de GitHub y no apt",
+    "intro": "Debian distribuye Lynis mediante apt, pero el paquete suele ir varias versiones principales por detrás del proyecto original. GitHub recibe antes los controles, correcciones de nuevos vectores de ataque y mejoras de las recomendaciones. Lynis es un script de shell autocontenido, sin compilación ni dependencias de instalación aparte de <code>git</code>; por eso clonar el repositorio es el método recomendado por CISOfy.",
     "headerSource": "Origen",
-    "headerPath": "Ruta de instalación",
+    "headerPath": "Install path",
     "headerUpdate": "Método de actualización",
-    "headerFresh": "Frescura de versión",
+    "headerFresh": "Actualidad de la versión",
     "rows": [
       {
         "sourceRich": "<strong>ProxMenux (este script)</strong>",
         "path": "/opt/lynis/",
         "update": "git pull (desde el menú)",
-        "fresh": "Última versión upstream"
+        "fresh": "Última versión del proyecto original"
       },
       {
         "sourceRich": "<strong>Debian apt</strong>",
@@ -59,13 +59,13 @@
       "<code>/opt/lynis/lynis</code> — ruta directa (por si el wrapper se eliminó)",
       "<code>/usr/bin/lynis</code> — versión instalada por apt, si el usuario la instaló así anteriormente"
     ],
-    "outro": "Si se encuentra cualquiera de estas, se abre el menú de gestión. El script <strong>no</strong> desinstala un Lynis instalado por apt — solo el que él mismo gestiona (<code>/opt/lynis</code> + el wrapper)."
+    "outro": "Si encuentra cualquiera de estas rutas, abre el menú de gestión. El script <strong>no</strong> desinstala Lynis instalado por apt; solo el que gestiona en <code>/opt/lynis</code> y su lanzador."
   },
   "audit": {
     "heading": "Ejecutar una auditoría",
-    "intro": "Desde el menú de gestión, elige <strong>Ejecutar auditoría de seguridad ahora</strong>. Esto equivale a ejecutar:",
+    "intro": "En el menú de gestión, elige <strong>Ejecutar auditoría de seguridad ahora</strong>. Equivale a ejecutar:",
     "code": "lynis audit system --no-colors",
-    "outro": "La auditoría tarda de 30 segundos a unos minutos según el tamaño del host. La salida fluye directamente al terminal — no hay spinner. Lynis imprime secciones por cada categoría de control, marcando cada test como <ok>[ OK ]</ok>, <warn>[ WARNING ]</warn> o <sugg>[ SUGGESTION ]</sugg>. El resumen al final tiene los números titulares:",
+    "outro": "La auditoría tarda de 30 segundos a varios minutos según el tamaño del host. La salida se muestra directamente en el terminal, sin indicador giratorio. Lynis organiza los controles por categoría y marca cada prueba como <ok>[ OK ]</ok>, <warn>[ WARNING ]</warn> o <sugg>[ SUGGESTION ]</sugg>. El resumen final muestra las cifras principales:",
     "summary": "================================================================================\n\n  Lynis security scan details:\n\n  Hardening index : 76 [############        ]\n  Tests performed : 247\n  Plugins enabled : 0\n\n  Components:\n  - Firewall               [V]\n  - Malware scanner        [X]\n\n  Lynis modules:\n  - Compliance status      [?]\n  - Security audit         [V]\n  - Vulnerability scan     [V]\n\n================================================================================"
   },
   "report": {
@@ -99,7 +99,7 @@
   },
   "update": {
     "heading": "Actualizar Lynis",
-    "body": "Desde el menú de gestión, <strong>Actualizar Lynis a la última versión</strong> ejecuta <code>git pull --quiet</code> dentro de <code>/opt/lynis</code>. Si el directorio existe pero no es un checkout de Git (p. ej. alguien copió los archivos a mano), el script recae en una reinstalación completa."
+    "body": "En el menú, <strong>Actualizar Lynis a la última versión</strong> ejecuta <code>git pull --quiet</code> en <code>/opt/lynis</code>. Si el directorio existe pero no es una copia Git (por ejemplo, se copiaron archivos manualmente), el script reinstala por completo."
   },
   "reinstall": {
     "heading": "Reinstalar / desinstalar",
@@ -108,7 +108,7 @@
     "rows": [
       {
         "actionRich": "<strong>Reinstalar</strong>",
-        "whatRich": "Elimina <code>/opt/lynis</code>, vuelve a clonar desde GitHub, recrea el wrapper. Úsalo si el checkout local está corrupto."
+        "whatRich": "Elimina <code>/opt/lynis</code>, clona de nuevo desde GitHub y recrea el lanzador. Úsalo si la copia local está dañada."
       },
       {
         "actionRich": "<strong>Eliminar</strong>",
@@ -128,7 +128,7 @@
     "notFoundTitle": "lynis: command not found tras la instalación",
     "notFoundIntro": "El wrapper en <code>/usr/local/bin/lynis</code> no se creó o se eliminó. Arreglo más rápido: reinstalar desde el menú. Arreglo manual:",
     "notFoundCode": "cat > /usr/local/bin/lynis <<'EOF'\n#!/bin/bash\ncd /opt/lynis && ./lynis \"$@\"\nEOF\nchmod +x /usr/local/bin/lynis",
-    "sshTitle": "La auditoría imprime \"Warning: Test SSH-7408 — MaxAuthTries set incorrectly\"",
+    "sshTitle": "La auditoría muestra \"Warning: Test SSH-7408 — MaxAuthTries set incorrectly\"",
     "sshIntro": "El demonio SSH permite demasiados intentos de autenticación por conexión. O bien instala <link>Fail2Ban</link> desde ProxMenux (que establece <code>MaxAuthTries=3</code> automáticamente) o edita <code>/etc/ssh/sshd_config</code> a mano:",
     "sshCode": "sed -i 's/^#?MaxAuthTries.*/MaxAuthTries 3/' /etc/ssh/sshd_config\nsystemctl reload sshd",
     "scoreTitle": "La puntuación bajó tras una actualización de Proxmox",
@@ -140,7 +140,7 @@
   },
   "sample": {
     "heading": "Informe de ejemplo",
-    "intro": "ProxMenux Monitor empaqueta cada ejecución de Lynis en un PDF de varias páginas disponible desde la <link>pestaña de Seguridad</link> en el panel. La primera página es el resumen ejecutivo — puntuación de hardening, info del sistema, vista general de la postura de seguridad. Las páginas siguientes listan cada warning con explicación y cada sugerencia rankeada por impacto, más el inventario de paquetes usado durante la auditoría.",
+    "intro": "ProxMenux Monitor genera un PDF de varias páginas para cada ejecución de Lynis desde la <link>pestaña Seguridad</link>. La primera página resume puntuación de refuerzo, información del sistema y estado de seguridad. Las siguientes detallan cada advertencia, las sugerencias ordenadas por impacto y el inventario de paquetes utilizado en la auditoría.",
     "imageAlt": "Primera página del PDF del Lynis Security Audit Report — resumen ejecutivo con Hardening Index 71/100, bloque de información del sistema y vista general de la postura de seguridad con firewall, escáner de malware y recuento de paquetes instalados",
     "captionPrefix": "Primera página de un informe de ejemplo. El PDF completo (",
     "captionLink": "ejemplo",
diff --git a/web/messages/es/docs/security/ssl-letsencrypt.json b/web/messages/es/docs/security/ssl-letsencrypt.json
index 9fb83863..f7710e7a 100644
--- a/web/messages/es/docs/security/ssl-letsencrypt.json
+++ b/web/messages/es/docs/security/ssl-letsencrypt.json
@@ -1,13 +1,13 @@
 {
   "meta": {
     "title": "HTTPS para ProxMenux Monitor — certificado del host Proxmox o rutas personalizadas | ProxMenux",
-    "description": "Sirve ProxMenux Monitor sobre HTTPS usando o bien el certificado del host Proxmox (autodetectado, incluyendo el certificado Let's Encrypt subido vía la pestaña ACME de Proxmox) o un certificado personalizado en cualquier ruta del disco.",
+    "description": "Sirve ProxMenux Monitor por HTTPS con el certificado del host Proxmox (detectado automáticamente, incluido el de Let’s Encrypt instalado mediante ACME de Proxmox) o un certificado personalizado en cualquier ruta del disco.",
     "ogTitle": "HTTPS para ProxMenux Monitor — certificado del host Proxmox o personalizado",
     "ogDescription": "Habilita HTTPS en el puerto 8008 con el certificado del host Proxmox o cualquier par .pem / .key personalizado."
   },
   "header": {
     "title": "HTTPS para ProxMenux Monitor",
-    "description": "Activa HTTPS para el Monitor (puerto 8008) usando o bien el certificado del host Proxmox que el Monitor autodetecta, o un certificado personalizado ubicado en cualquier sitio del disco. La opción de Proxmox elige de forma transparente el certificado subido por ACME cuando está presente, así que un certificado Let's Encrypt gestionado por la UI de Proxmox se reutiliza sin un trabajo de renovación extra.",
+    "description": "Activa HTTPS para Monitor en 8008 con el certificado del host Proxmox detectado automáticamente o uno personalizado en disco. La opción Proxmox prefiere el certificado instalado mediante ACME, si existe, y reutiliza el Let’s Encrypt gestionado por Proxmox sin otra tarea de renovación.",
     "section": "Seguridad"
   },
   "intro": {
@@ -15,20 +15,20 @@
     "body": "Cómo cambiar el Monitor de HTTP a HTTPS en el panel Settings → Security, a qué apunta realmente cada fuente de certificado en disco, cómo se comporta la opción de Proxmox cuando el host tiene un certificado Let's Encrypt y cómo establecer rutas personalizadas si gestionas certificados fuera de Proxmox."
   },
   "wheresetting": {
-    "heading": "Dónde vive el ajuste",
-    "body": "Abre el Monitor y ve a <strong>Settings → Security → HTTPS / SSL</strong>. El panel muestra el estado actual (HTTP o HTTPS), y en un host sin HTTPS aún lista las fuentes de certificado que el Monitor ha podido detectar.",
+    "heading": "Ubicación del ajuste",
+    "body": "Abre Monitor y ve a <strong>Ajustes → Seguridad → HTTPS / SSL</strong>. El panel muestra HTTP o HTTPS y, si HTTPS no está activo, las fuentes de certificados detectadas.",
     "imageAlt": "Panel Settings → Security → HTTPS / SSL en el Monitor mostrando el estado HTTPS desactivado, el certificado de Proxmox autodetectado (subject, issuer, expiry) y la opción Use Custom Certificate",
-    "caption": "Panel Settings → Security → HTTPS / SSL antes de la activación. El Monitor saca a la luz el certificado que el propio Proxmox está usando y lo ofrece como una fuente de un solo clic."
+    "caption": "Panel Ajustes → Seguridad → HTTPS / SSL antes de activar HTTPS. Monitor muestra el certificado que usa Proxmox y permite elegirlo con un clic."
   },
   "twoways": {
     "heading": "Dos formas de habilitar HTTPS",
     "proxmox": {
       "title": "Usar el certificado de Proxmox",
-      "summary": "Un clic. El Monitor reutiliza el certificado que el propio Proxmox VE sirve en el puerto 8006.",
+      "summary": "Un clic: Monitor reutiliza el certificado que Proxmox VE presenta en el puerto 8006.",
       "items": [
-        "Autodetectado — no hay ruta que teclear",
-        "Elige el certificado subido por ACME si está presente, recae en el self-signed por defecto",
-        "La renovación pasa por Proxmox; el Monitor sigue automáticamente en el siguiente arranque"
+        "Detectado automáticamente, sin introducir rutas",
+        "Prefiere el certificado ACME si existe; si no, usa el autofirmado predeterminado",
+        "Proxmox renueva; Monitor valida y carga el certificado en la siguiente conexión TLS nueva"
       ]
     },
     "custom": {
@@ -37,7 +37,7 @@
       "items": [
         "Solo rutas absolutas (el proceso del Monitor debe poder leer ambos)",
         "Útil cuando los certificados vienen de <code>certbot</code>, <code>acme.sh</code> o un wildcard",
-        "La renovación es tuya — reinicia el servicio del Monitor tras que el archivo cambie"
+        "La renovación queda a tu cargo: reinicia Monitor cuando cambien los archivos"
       ]
     }
   },
@@ -54,7 +54,7 @@
         {
           "fileRich": "<code>pveproxy-ssl.pem</code><br /><code>pveproxy-ssl.key</code>",
           "originRich": "Certificado personalizado subido vía la UI de Proxmox — incluyendo el certificado Let's Encrypt emitido en <em>Datacenter → Node → Certificates → ACME</em>.",
-          "when": "Preferido siempre que existan ambos archivos. El Monitor seguirá el certificado que el propio Proxmox está sirviendo."
+          "when": "Se prefiere cuando existen ambos archivos; Monitor usa el certificado presentado por Proxmox."
         },
         {
           "fileRich": "<code>pve-ssl.pem</code><br /><code>pve-ssl.key</code>",
@@ -65,17 +65,17 @@
     },
     "callout": {
       "title": "Misma prioridad que el propio Proxmox",
-      "bodyRich": "<code>pveproxy</code> usa la misma regla de selección, así que elegir la opción de Proxmox en el Monitor siempre sirve el certificado que la UI web de Proxmox ya está sirviendo en el puerto 8006. Sin copias, sin pipeline de renovación aparte."
+      "bodyRich": "<code>pveproxy</code> aplica la misma selección: al elegir Proxmox, Monitor usa el certificado que la interfaz de Proxmox presenta en 8006, sin copiarlo ni mantener otro proceso de renovación."
     }
   },
   "letsencrypt": {
     "heading": "Obtener un certificado Let's Encrypt vía Proxmox ACME",
-    "intro": "Proxmox VE entrega su propio cliente ACME. Pulsar <em>\"Order Certificate Now\"</em> escribe el resultado en <code>/etc/pve/local/pveproxy-ssl.pem</code>, que es exactamente lo que el Monitor lee. La receta de cinco pasos de abajo es el mismo procedimiento que la <extlink1>guía oficial de Proxmox</extlink1> — destilada a los comandos que realmente necesitas ejecutar.",
+    "intro": "Proxmox VE incluye su propio cliente ACME. <em>«Order Certificate Now»</em> guarda el resultado en <code>/etc/pve/local/pveproxy-ssl.pem</code>, que Monitor lee. Los cinco pasos siguientes condensan el procedimiento de la <extlink1>guía oficial de Proxmox</extlink1> en los comandos necesarios.",
     "prereqs": {
       "title": "Prerrequisitos",
       "items": [
         "El nodo tiene un nombre DNS real (no solo una IP) apuntándole.",
-        "<strong>O bien</strong> puerto 80 alcanzable desde la internet pública (challenge HTTP-01, el más simple), <strong>o bien</strong> un proveedor de DNS con credenciales API (challenge DNS-01 — funciona detrás de NAT, soporta wildcards).",
+        "<strong>O bien</strong> puerto 80 accesible desde Internet (verificación HTTP-01, la más sencilla), <strong>o bien</strong> proveedor DNS con credenciales API (DNS-01, funciona tras NAT y admite comodines).",
         "Una dirección de email para la cuenta ACME."
       ]
     },
@@ -90,7 +90,7 @@
       "http01Rich": "<strong>HTTP-01</strong> es el más fácil: está integrado, sin plugin extra. Let's Encrypt se conecta a <code>http://&lt;your-host&gt;/.well-known/acme-challenge/...</code> en el puerto 80, así que el puerto 80 debe estar abierto desde la internet pública a tu nodo — típicamente un port forward en tu router.",
       "dns01Rich": "<strong>DNS-01</strong> funciona sin exponer el puerto 80 (bueno para homelabs detrás de CG-NAT) y es la única opción para certificados wildcard. Añades un plugin DNS una vez con el token API de tu proveedor. Ejemplo con Cloudflare:",
       "code": "pvenode acme plugin add dns cf \\\n  --api cloudflare \\\n  --data CF_Token=YOUR_CLOUDFLARE_API_TOKEN",
-      "outroRich": "Para otros proveedores (Gandi, OVH, AWS Route 53, etc.) consulta <code>pvenode acme plugin add dns --help</code> — Proxmox entrega <extlink2>todos los plugins DNS de acme.sh</extlink2>."
+      "outroRich": "Para otros proveedores (Gandi, OVH, AWS Route 53, etc.), consulta <code>pvenode acme plugin add dns --help</code>. Proxmox incluye <extlink2>todos los plugins DNS de acme.sh</extlink2>."
     },
     "step3": {
       "heading": "Paso 3 — Asocia el dominio a tu nodo",
@@ -112,19 +112,19 @@
     },
     "gui": {
       "title": "¿Prefieres la GUI? Los mismos cinco pasos",
-      "bodyRich": "<em>Datacenter → ACME</em> registra la cuenta, <em>Datacenter → ACME → Plugins</em> añade el plugin DNS, <em>Node → Certificates → ACME</em> asocia el dominio y <em>Order Certificates Now</em> ejecuta el paso 4. Los comandos CLI de arriba son útiles para scriptar y para setups headless / solo CLI."
+      "bodyRich": "<em>Datacenter → ACME</em> registra la cuenta; <em>Datacenter → ACME → Plugins</em> añade DNS; <em>Node → Certificates → ACME</em> vincula el dominio; <em>Order Certificates Now</em> ejecuta el paso 4. Los comandos anteriores sirven para automatizar y trabajar sin interfaz gráfica."
     }
   },
   "switchToHttps": {
     "heading": "Cambiar el Monitor a HTTPS",
-    "bodyRich": "Una vez que <code>/etc/pve/local/pveproxy-ssl.pem</code> está firmado por Let's Encrypt, en el Monitor solo hace falta un clic: abre <strong>Ajustes → Seguridad → HTTPS / SSL</strong>, confirma que el emisor mostrado en el panel del certificado detectado sea <em>Let's Encrypt</em> (y no la CA local de Proxmox) y pulsa <strong>Usar certificado de Proxmox</strong>. El servicio del Monitor se reinicia y la siguiente carga del navegador usa HTTPS en el puerto 8008, sin advertencias porque la cadena es de confianza pública. Las renovaciones posteriores de Proxmox ACME se validan y seleccionan durante la siguiente conexión TLS nueva; no existe un comprobador periódico del certificado ni se reinicia el servicio durante la renovación. <strong>Actualizar certificado</strong> permanece disponible en Seguridad como acción explícita de diagnóstico y recuperación."
+    "bodyRich": "Una vez que <code>/etc/pve/local/pveproxy-ssl.pem</code> está firmado por Let's Encrypt, abre <strong>Ajustes → Seguridad → HTTPS / SSL</strong>, comprueba que el emisor sea <em>Let's Encrypt</em> y no la CA local de Proxmox, y pulsa <strong>Usar certificado de Proxmox</strong>. Monitor se reinicia y la siguiente carga usa HTTPS en 8008 con una cadena de confianza pública. Las renovaciones ACME posteriores se validan y seleccionan en la siguiente conexión TLS nueva, sin sondeo periódico ni reinicio del servicio por renovación. <strong>Actualizar certificado</strong> sigue disponible en Seguridad como acción explícita de diagnóstico y recuperación."
   },
   "custom": {
     "heading": "Certificado personalizado — cuándo usarlo",
-    "intro": "Pulsa <strong>Use Custom Certificate</strong> para introducir dos rutas absolutas:",
+    "intro": "Pulsa <strong>Usar certificado personalizado</strong> e introduce dos rutas absolutas:",
     "items": [
       "<strong>Certificado</strong> — cadena completa en PEM (<code>.pem</code> o <code>.crt</code>).",
-      "<strong>Clave privada</strong> — clave correspondiente en PEM (<code>.key</code>)."
+      "<strong>Clave privada</strong>: clave correspondiente en PEM (<code>.key</code>)."
     ],
     "outro": "Ambos archivos los lee el proceso del Monitor al arrancar. Asegúrate de que se mantengan legibles por el usuario con el que corre la unidad systemd (root por defecto). Ubicaciones comunes cuando ACME se gestiona fuera de Proxmox:",
     "code": "# certbot\n/etc/letsencrypt/live/<your-host>/fullchain.pem\n/etc/letsencrypt/live/<your-host>/privkey.pem\n\n# acme.sh\n~/.acme.sh/<your-host>_ecc/fullchain.cer\n~/.acme.sh/<your-host>_ecc/<your-host>.key",
@@ -143,15 +143,15 @@
   },
   "trustCa": {
     "heading": "Confiar en la CA self-signed de Proxmox",
-    "intro1Rich": "Si prefieres mantener el certificado por defecto generado por Proxmox (sin ACME), puedes parar el warning del navegador importando la CA raíz del clúster en el almacén de confianza del SO o navegador. El Monitor seguirá autodetectando el mismo <code>/etc/pve/local/pveproxy-ssl.pem</code>; lo único que cambia es que el dispositivo que ve el panel ahora reconoce el issuer.",
+    "intro1Rich": "Para conservar el certificado predeterminado de Proxmox sin ACME, importa la CA raíz del clúster en el almacén de confianza del sistema o navegador. Monitor detecta <code>/etc/pve/local/pve-ssl.pem</code> como certificado alternativo. El cliente confiará en su emisor; la URL aún debe coincidir con un nombre del certificado.",
     "intro2Rich": "El archivo de la CA vive en <code>/etc/pve/pve-root-ca.pem</code> en cada nodo. En un clúster la ruta está en el sistema de archivos compartido <code>pmxcfs</code>, así que todos los nodos comparten la misma raíz, y una sola importación cubre el datacenter entero. Cópialo a tu máquina:",
     "code": "scp root@<your-host>:/etc/pve/pve-root-ca.pem ./pve-root-ca.pem",
     "thenImport": "Después impórtalo en el lado del cliente:",
     "items": [
-      "<strong>Linux (todo el sistema):</strong> <code>sudo cp pve-root-ca.pem /usr/local/share/ca-certificates/pve-root-ca.crt</code> seguido de <code>sudo update-ca-certificates</code>. Los navegadores que usan el almacén del sistema (Chromium, Edge) lo toman tras reiniciar; Firefox usa su propio almacén y necesita la importación manual de abajo.",
-      "<strong>macOS:</strong> doble clic en el archivo <code>.pem</code>, se abre Keychain Access → añádelo al keychain del <em>Sistema</em> → establece <em>Trust → Always Trust</em>.",
-      "<strong>Windows:</strong> clic derecho en el archivo → <em>Install Certificate</em> → colócalo en <em>Trusted Root Certification Authorities</em>.",
-      "<strong>Firefox (cualquier SO):</strong> <em>Settings → Privacy y Security → Certificates → View Certificates → Authorities → Import</em>, marca <em>Trust this CA to identify websites</em>."
+      "<strong>Linux (todo el sistema):</strong> ejecuta <code>sudo cp pve-root-ca.pem /usr/local/share/ca-certificates/pve-root-ca.crt</code> y después <code>sudo update-ca-certificates</code>. Los navegadores que usan el almacén del sistema (Chromium, Edge) lo reconocen tras reiniciar; Firefox usa su propio almacén y requiere la importación manual siguiente.",
+      "<strong>macOS:</strong> abre el archivo <code>.pem</code> con doble clic en Acceso a Llaveros, añádelo al llavero <em>Sistema</em> y configura <em>Confiar → Confiar siempre</em>.",
+      "<strong>Windows:</strong> clic derecho en el archivo → <em>Instalar certificado</em> → guárdalo en <em>Entidades de certificación raíz de confianza</em>.",
+      "<strong>Firefox (cualquier SO):</strong> <em>Ajustes → Privacidad y seguridad → Certificados → Ver certificados → Autoridades → Importar</em>; marca <em>Confiar en esta CA para identificar sitios web</em>."
     ],
     "standalone": {
       "title": "Nodos standalone fuera de un clúster",
@@ -160,9 +160,9 @@
   },
   "disable": {
     "heading": "Deshabilitar HTTPS",
-    "bodyRich": "Pulsa <strong>Disable HTTPS</strong> en el mismo panel. El servicio del Monitor reinicia de vuelta en HTTP plano — útil si un archivo de certificado personalizado se vuelve no legible y el servicio no vuelve a levantarse. No hay paso de desinstalación aparte; los propios archivos de certificado no se tocan.",
+    "bodyRich": "Pulsa <strong>Deshabilitar HTTPS</strong> en el mismo panel. Monitor reinicia con HTTP sin cifrar, útil si un certificado personalizado no se puede leer y el servicio no arranca. No hay otra desinstalación y los archivos de certificado no se modifican.",
     "stateCallout": {
-      "title": "Dónde vive el estado",
+      "title": "Dónde se guarda el estado",
       "bodyRich": "<code>/etc/proxmenux/ssl_config.json</code> almacena las rutas de certificado activas y la fuente (<code>none</code>, <code>proxmox</code>, <code>custom</code>). Borrar el archivo equivale a deshabilitar HTTPS — en el siguiente arranque el Monitor recae en HTTP."
     }
   }
diff --git a/web/messages/es/docs/settings/beta-program.json b/web/messages/es/docs/settings/beta-program.json
index 1b5438d3..4f8199e3 100644
--- a/web/messages/es/docs/settings/beta-program.json
+++ b/web/messages/es/docs/settings/beta-program.json
@@ -1,36 +1,36 @@
 {
   "meta": {
-    "title": "Cambiar canal de release | ProxMenux Documentation",
-    "description": "Cambia ProxMenux entre los canales estable (main) y beta (develop) en un diálogo. Bidireccional, idempotente, ejecuta el instalador oficial para el canal elegido y normaliza el servicio del Monitor.",
-    "ogTitle": "Cambiar canal de release | ProxMenux Documentation",
-    "ogDescription": "Una opción de Settings para cambiar entre los canales estable y beta — sin volver a ejecutar instaladores a mano."
+    "title": "Cambiar canal de versiones | Documentación de ProxMenux",
+    "description": "Cambia entre los canales estable (main) y beta (develop) de ProxMenux en un diálogo. Es bidireccional e idempotente, ejecuta el instalador oficial del canal elegido y normaliza el servicio Monitor.",
+    "ogTitle": "Cambiar canal de versiones | Documentación de ProxMenux",
+    "ogDescription": "Una opción de Ajustes permite cambiar entre estable y beta sin ejecutar instaladores a mano."
   },
   "header": {
-    "title": "Cambiar canal de release",
-    "description": "Una opción unificada de Settings para cambiar ProxMenux entre los canales estable (rama main) y beta (rama develop). La antigua \"Desactivar programa beta\" unidireccional se ha sustituido por un diálogo bidireccional que siempre ofrece ambas direcciones y ejecuta el instalador oficial del canal que elijas.",
-    "section": "Settings"
+    "title": "Cambiar canal de versiones",
+    "description": "Una opción de Ajustes cambia ProxMenux entre estable (rama main) y beta (rama develop). La antigua opción unidireccional «Desactivar programa beta» se sustituye por un diálogo bidireccional que ofrece ambos sentidos y ejecuta el instalador oficial del canal elegido.",
+    "section": "Ajustes"
   },
   "intro": {
     "title": "Qué ha cambiado",
-    "body": "Versiones anteriores de ProxMenux exponían dos flujos separados — \"Desactivar programa beta\" (solo visible cuando beta estaba activo) y una nueva ejecución manual del instalador beta para volver a unirte. Se han fusionado en una única entrada <strong>Cambiar canal de release</strong> siempre presente, que muestra el canal actual y te deja saltar entre estable y beta en cualquier dirección."
+    "body": "Antes había dos procedimientos: «Desactivar programa beta», visible solo con beta activa, y volver a ejecutar manualmente el instalador beta para entrar de nuevo. Ahora se unen en <strong>Cambiar canal de versiones</strong>, una opción siempre disponible que muestra el canal actual y permite cambiar entre estable y beta en ambos sentidos."
   },
   "why": {
     "heading": "Por qué existe esta opción",
-    "intro": "ProxMenux se entrega desde dos ramas git:",
+    "intro": "ProxMenux se distribuye desde dos ramas de Git:",
     "items": [
-      "<strong>Estable</strong> — la rama <code>main</code>. A donde apunta el README, lo que la mayoría de operadores quieren, con una cadencia de releases más lenta y solo cambios que ya han pasado por validación beta.",
-      "<strong>Beta</strong> — la rama <code>develop</code>. Funciones nuevas y builds del Monitor; lleva el tag que la próxima release estable heredará. Algunas cosas pueden no funcionar perfectamente — ese es el trato al que te apuntas y la forma en que las funciones nuevas se prueban antes de salir."
+      "<strong>Estable</strong>: la rama <code>main</code>, enlazada desde el README y adecuada para la mayoría de administradores. Publica con menor frecuencia e incluye cambios que ya han pasado por la validación beta.",
+      "<strong>Beta</strong>: la rama <code>develop</code>. Incluye funciones y compilaciones de Monitor más recientes y la etiqueta que heredará la siguiente versión estable. Puede haber fallos: al elegirla participas en las pruebas previas al lanzamiento."
     ],
-    "outro": "Saltar entre canales requería antes recordar la URL del instalador correcta, copiarla del README y editar <code>config.json</code> a mano si algo se desincronizaba. La opción unificada hace todo el flujo como una única acción guiada."
+    "outro": "Antes, cambiar de canal exigía recordar la URL correcta del instalador, copiarla del README y editar <code>config.json</code> si algo se desincronizaba. La opción unificada realiza todo el proceso mediante una acción guiada."
   },
   "dialog": {
     "heading": "El diálogo",
-    "intro": "Desde el menú principal, <strong>Settings → Cambiar canal de release</strong>. Aparece un menú de dos líneas:",
+    "intro": "Desde el menú principal: <strong>Ajustes → Cambiar canal de versiones</strong>. Aparece un menú de dos líneas:",
     "options": [
       "<code>stable</code> — Estable (rama main)",
       "<code>beta</code> — Beta (rama develop)"
     ],
-    "behaviour": "El canal actual aparece preseleccionado y mostrado en la parte superior del menú. Elegir el mismo canal devuelve un mensaje amable de \"Este canal de release ya está activo\" — el diálogo es totalmente idempotente. Elegir un canal distinto saca una confirmación con texto específico del canal:",
+    "behaviour": "El canal actual aparece preseleccionado y se muestra arriba. Si eliges el mismo, aparece «Este canal de versiones ya está activo»: el diálogo es idempotente. Si eliges otro, aparece una confirmación específica del canal:",
     "directions": [
       "<strong>Estable → Beta:</strong> avisa de que los builds beta pueden contener bugs o funciones incompletas.",
       "<strong>Beta → Estable:</strong> avisa de que las comprobaciones de actualizaciones beta cesarán y el instalador estable reinstalará los componentes del canal estable."
@@ -39,11 +39,11 @@
   "confirm": {
     "heading": "Qué pasa al confirmar",
     "items": [
-      "<strong>Descarga el instalador oficial</strong> del canal de destino:<ul><li>Estable: <code>install_proxmenux.sh</code> desde <code>main</code></li><li>Beta: <code>install_proxmenux_beta.sh</code> desde <code>develop</code></li></ul>Se verifica que la descarga existe y se hace ejecutable antes del siguiente paso.",
-      "<strong>Ejecuta el instalador</strong> de principio a fin. El instalador es el mismo que publica el README — sin ruta propia, sin atajos. Eso significa que la detección de componentes existentes, backups de archivos, instalación de dependencias, preservación de idioma, etc. se comportan idénticamente a una instalación recién hecha del canal de destino.",
+      "<strong>Descarga el instalador oficial</strong> del canal de destino:<ul><li>Estable: <code>install_proxmenux.sh</code> desde <code>main</code></li><li>Beta: <code>install_proxmenux_beta.sh</code> desde <code>develop</code></li></ul>Se comprueba que la descarga existe y se hace ejecutable antes de continuar.",
+      "<strong>Ejecuta el instalador</strong> completo, el mismo que enlaza el README. La detección de componentes, los backups, las dependencias y la conservación del idioma siguen el procedimiento oficial de instalación del canal elegido.",
       "Al cambiar a <strong>estable</strong>, el menú poda después cualquier metadato beta sobrante de <code>config.json</code>: <code>beta_program</code>, <code>beta_version</code>, <code>install_branch</code>, <code>update_available.beta*</code> se borran, y <code>proxmenux_monitor.status = beta_updated</code> se normaliza a <code>updated</code>. El archivo sobrante <code>beta_version.txt</code> y cualquier instalador beta descargado se eliminan.",
-      "Al cambiar a estable, el archivo de la unidad systemd del Monitor también se reescribe desde la plantilla estable (elimina el sufijo \"Beta\" de la descripción de la unidad, apunta <code>ExecStart</code> de vuelta al directorio de runtime) para que un <code>systemctl status</code> fresco refleje el canal en el que estás.",
-      "Recarga el menú de configuración. La siguiente visita a <em>Mostrar información de versión</em> mostrará el nuevo canal."
+      "Al cambiar a estable, se reescribe la unidad systemd de Monitor con la plantilla estable: se quita «Beta» de la descripción y <code>ExecStart</code> vuelve a apuntar al directorio de ejecución. Así, <code>systemctl status</code> refleja el canal actual.",
+      "Recarga el menú de configuración. <em>Mostrar información de versión</em> mostrará el nuevo canal."
     ]
   },
   "switching": {
@@ -54,7 +54,7 @@
       "Un Monitor que estaba activo antes del cambio sigue activo después; uno que estaba desactivado sigue desactivado.",
       "El <code>auth.json</code>, los tokens de API y el secreto JWT de ProxMenux Monitor se preservan entre cambios de canal. Las sesiones no se cierran.",
       "Puedes saltar de canal tantas veces como quieras — el diálogo lo aceptará cada vez y volverá a ejecutar el instalador. No hace falta reiniciar Proxmox.",
-      "El instalador de cambio de canal reemplaza el propio árbol de scripts de ProxMenux, así que no puede correr dentro del terminal del navegador del Monitor (esa PTY sería desmontada a mitad de la actualización y dejaría el diálogo colgado). Si lanzas la opción desde ahí, la confirmación se sustituye por un msgbox informativo con el instalador canónico de una línea para el canal de destino; ejecuta ese comando desde una sesión SSH o desde la consola del host Proxmox."
+      "El instalador de cambio de canal sustituye el árbol de scripts de ProxMenux, por lo que no puede ejecutarse desde el terminal del navegador de Monitor: la PTY se cerraría a mitad de la actualización y dejaría el diálogo bloqueado. Si lo abres desde allí, aparece un cuadro informativo con el comando oficial de una línea del canal elegido. Ejecútalo desde SSH o la consola del host Proxmox."
     ]
   },
   "feedback": {
@@ -66,16 +66,16 @@
       "Los logs relevantes del Monitor:"
     ],
     "logsCommand": "journalctl -u proxmenux-monitor -n 50 --no-pager",
-    "versionLine": "La versión actual de ProxMenux (Settings → <link>Mostrar información de versión</link>).",
+    "versionLine": "La versión actual de ProxMenux (Ajustes → <link>Mostrar información de versión</link>).",
     "issueLine": "Abre una <ghlink>incidencia en GitHub</ghlink> con esa información y llegamos al arreglo más rápido."
   },
   "manual": {
     "heading": "Equivalente manual",
-    "intro": "Si prefieres el shell o estás scriptando el cambio de canal, el diálogo no es más que un wrapper fino sobre estos comandos:"
+    "intro": "Si prefieres el shell o automatizas el cambio de canal, el diálogo ejecuta estos comandos:"
   },
   "unifiedCallout": {
     "title": "Por qué ahora ambas direcciones son una sola opción",
-    "body": "La antigua \"Desactivar programa beta\" solo existía si el host se había unido alguna vez a la beta. Los operadores que querían <em>unirse</em> tenían que encontrar la URL del instalador beta en otro sitio; los que querían <em>salir</em> a veces tenían que limpiar manualmente los metadatos <code>beta_*</code> para asegurarse. La opción unificada <strong>Cambiar canal de release</strong> siempre aparece, hace explícito el canal actual y trata ambas direcciones como el mismo tipo de operación — ejecutable, repetible, idempotente."
+    "body": "La antigua opción «Desactivar programa beta» solo aparecía si el host se había unido a la beta. Para <em>entrar</em> había que buscar el instalador en otro lugar; para <em>salir</em> a veces había que limpiar los metadatos <code>beta_*</code> a mano. <strong>Cambiar canal de versiones</strong> siempre aparece, muestra el canal actual y aplica el mismo procedimiento ejecutable, repetible e idempotente en ambos sentidos."
   },
   "troubleshoot": {
     "heading": "Solución de problemas",
@@ -84,7 +84,7 @@
     "downloadCmd": "curl -fsSL -o /tmp/test https://raw.githubusercontent.com/MacRimi/ProxMenux/main/install_proxmenux.sh && head -1 /tmp/test",
     "downloadOutro": "Si esto falla fuera de ProxMenux, es un problema de red / proxy en el host.",
     "errorsTitle": "\"El instalador terminó con errores\"",
-    "errorsBody": "El instalador devolvió un código de salida distinto de cero. El canal anterior y los componentes ya instalados se quedan como estaban antes del cambio. Vuelve a ejecutar la acción; si sigue fallando, ejecuta el instalador manualmente desde un shell (mira el equivalente manual de arriba) — eso te da la salida completa en lugar del resumen del diálogo.",
+    "errorsBody": "El instalador devolvió un código distinto de cero. No hay reversión automática: algunos archivos o componentes pueden haber cambiado. Lee la salida del instalador que aparece encima del error antes de pulsar Intro y comprueba el estado actual; después reintenta desde el menú o ejecuta el instalador a mano por SSH o desde la consola del host.",
     "configTitle": "\"No se pudo actualizar el archivo de configuración\" tras cambiar a estable",
     "configBody": "La limpieza post-instalación de metadatos beta falló — normalmente porque <code>config.json</code> tiene un error de sintaxis por una edición manual. Valídalo:",
     "configCmd": "jq . /usr/local/share/proxmenux/config.json",
@@ -105,7 +105,7 @@
       },
       {
         "href": "/docs/settings",
-        "label": "Resumen de Settings",
+        "label": "Resumen de Ajustes",
         "tail": "."
       }
     ]
diff --git a/web/messages/es/docs/settings/change-language.json b/web/messages/es/docs/settings/change-language.json
index 573abf8b..b56b19ca 100644
--- a/web/messages/es/docs/settings/change-language.json
+++ b/web/messages/es/docs/settings/change-language.json
@@ -1,26 +1,26 @@
 {
   "meta": {
-    "title": "Cambiar idioma | ProxMenux Documentation",
-    "description": "Cambia la UI de ProxMenux entre inglés, español, francés, alemán, italiano o portugués. Solo instalación con traducción — usa googletrans + una tabla de traducción precacheada. El menú se recarga automáticamente con el nuevo idioma.",
-    "ogTitle": "Cambiar idioma | ProxMenux Documentation",
-    "ogDescription": "Elige el idioma de la interfaz de ProxMenux desde el menú Settings. Seis idiomas soportados."
+    "title": "Cambiar idioma | Documentación de ProxMenux",
+    "description": "Elige entre ocho idiomas de la interfaz de ProxMenux. Todas las instalaciones incluyen catálogos JSON de traducciones pregenerados; el host no necesita servicios de traducción ni un entorno Python. El menú se recarga automáticamente.",
+    "ogTitle": "Cambiar idioma | Documentación de ProxMenux",
+    "ogDescription": "Elige uno de los ocho idiomas de ProxMenux en Ajustes. Disponible en todas las instalaciones."
   },
   "header": {
     "title": "Cambiar idioma",
-    "description": "Cambia la UI de ProxMenux entre seis idiomas soportados. Guarda la elección en config.json y vuelve a ejecutar el menú con el nuevo idioma. Solo disponible en el tipo de instalación con traducción — la instalación normal (ligera) es solo en inglés por diseño.",
-    "section": "Settings"
+    "description": "Cambia la interfaz de ProxMenux entre ocho idiomas. La elección se guarda en config.json y el menú se reinicia en el nuevo idioma. Todas las instalaciones incluyen los catálogos de traducciones.",
+    "section": "Ajustes"
   },
   "intro": {
     "title": "Qué es esto",
-    "body": "Un menú de diálogo que lista los seis idiomas soportados. Elige uno, ProxMenux lo guarda en <code>config.json</code> como <code>.language</code>, después vuelve a ejecutar <code>config_menu.sh</code> para que el nuevo idioma surta efecto inmediatamente."
+    "body": "Un diálogo enumera los ocho idiomas admitidos. ProxMenux guarda tu elección en <code>config.json</code> como <code>.language</code> y reinicia <code>config_menu.sh</code> para aplicarla inmediatamente."
   },
   "warn": {
-    "title": "Solo instalación con traducción",
-    "body": "Esta opción solo aparece en Settings si pasan ambas comprobaciones: existe <code>/opt/googletrans-env/bin/activate</code> (venv de Python con googletrans) <em>y</em> <code>config.json</code> tiene un <code>.language</code> no vacío. En la instalación normal (solo inglés) ninguno está presente y el selector de idioma no se muestra."
+    "title": "Disponible en todas las instalaciones",
+    "body": "Ajustes siempre muestra Cambiar idioma. Los catálogos se instalan en <code>/usr/local/share/proxmenux/lang/</code> <em>y</em> el idioma seleccionado se guarda en <code>config.json</code>. No se necesita el antiguo entorno Python de traducción."
   },
   "supported": {
     "heading": "Idiomas soportados",
-    "headerCode": "Código",
+    "headerCode": "Code",
     "headerLang": "Idioma",
     "headerNotes": "Notas",
     "rows": [
@@ -32,42 +32,52 @@
       {
         "code": "es",
         "lang": "Español",
-        "notes": "Cacheado + autotraducido"
+        "notes": "Catálogo JSON pregenerado"
       },
       {
         "code": "fr",
         "lang": "Francés",
-        "notes": "Cacheado + autotraducido"
+        "notes": "Catálogo JSON pregenerado"
       },
       {
         "code": "de",
         "lang": "Alemán",
-        "notes": "Cacheado + autotraducido"
+        "notes": "Catálogo JSON pregenerado"
       },
       {
         "code": "it",
         "lang": "Italiano",
-        "notes": "Cacheado + autotraducido"
+        "notes": "Catálogo JSON pregenerado"
       },
       {
         "code": "pt",
         "lang": "Portugués",
-        "notes": "Cacheado + autotraducido"
+        "notes": "Catálogo JSON pregenerado"
+      },
+      {
+        "code": "sk",
+        "lang": "Eslovaco",
+        "notes": "Catálogo JSON pregenerado"
+      },
+      {
+        "code": "sv",
+        "lang": "Sueco",
+        "notes": "Catálogo JSON pregenerado"
       }
     ]
   },
   "englishTip": {
     "title": "El inglés es el más preciso",
-    "body": "Las cadenas en otros idiomas se producen mediante una tabla precacheada sembrada desde googletrans. Cadenas de casos límite (opciones que se disparan raramente, añadidos recientes) pueden caer en una llamada en vivo a googletrans o en el original inglés. Si una traducción no encaja, el inglés es siempre la fuente de verdad."
+    "body": "Los textos de otros idiomas proceden de catálogos JSON pregenerados incluidos con ProxMenux. Si falta una traducción se usa el inglés; el host no realiza llamadas de traducción en directo. El inglés sigue siendo la referencia ante una traducción dudosa."
   },
   "underHood": {
     "heading": "Cómo funciona por dentro",
     "items": [
-      "El menú de diálogo lista los 6 códigos; eliges uno.",
+      "El diálogo enumera ocho códigos de idioma; elige uno.",
       "Si <code>config.json</code> existe: <code>jq --arg lang \"$new_language\" '.language = $lang''</code> actualiza el campo en sitio.",
       "Si <code>config.json</code> no existe: se crea uno nuevo con el código de idioma en un objeto de un solo campo.",
       "Diálogo de confirmación: <em>\"Idioma cambiado a [code]\"</em>.",
-      "<code>exec bash config_menu.sh</code> recarga el menú Settings con el nuevo idioma activo."
+      "<code>exec bash config_menu.sh</code> recarga el menú Ajustes con el nuevo idioma activo."
     ]
   },
   "manual": {
@@ -75,10 +85,10 @@
   },
   "troubleshoot": {
     "heading": "Solución de problemas",
-    "noOptionTitle": "La opción no aparece en Settings",
-    "noOptionBody": "Estás en la instalación normal (solo inglés). Para obtener soporte de idiomas, reinstala ProxMenux eligiendo la opción de instalación con traducción (trae venv de Python + googletrans).",
+    "noOptionTitle": "La opción no aparece en Ajustes",
+    "noOptionBody": "Cambiar idioma siempre está disponible en las versiones actuales. Si no aparece, actualiza ProxMenux con el instalador oficial y vuelve a abrir Ajustes.",
     "stillEnglishTitle": "Cambié de idioma pero la UI sigue mostrando inglés",
-    "stillEnglishBody": "El menú se vuelve a ejecutar tras el cambio. Si abriste un shell nuevo y arrancaste un entrypoint distinto de ProxMenux, ejecuta <code>menu</code> de nuevo para tomar el nuevo idioma. Confirma: <code>jq -r '.language' /usr/local/share/proxmenux/config.json</code>."
+    "stillEnglishBody": "El menú se vuelve a ejecutar tras el cambio. Si abriste una nueva sesión de shell e iniciaste otro punto de entrada de ProxMenux, ejecuta <code>menu</code> de nuevo para aplicar el nuevo idioma. Compruébalo con <code>jq -r '.language' /usr/local/share/proxmenux/config.json</code>."
   },
   "related": {
     "heading": "Relacionado",
@@ -86,11 +96,11 @@
       {
         "href": "/docs/settings/show-version-information",
         "label": "Mostrar información de versión",
-        "tail": " — confirma el tipo de instalación y el idioma actual."
+        "tail": " — confirma el canal de versiones, los archivos de traducción y el idioma actual."
       },
       {
         "href": "/docs/settings",
-        "label": "Resumen de Settings",
+        "label": "Resumen de Ajustes",
         "tail": "."
       }
     ]
diff --git a/web/messages/es/docs/settings/index.json b/web/messages/es/docs/settings/index.json
index 48fbd64e..53cf6776 100644
--- a/web/messages/es/docs/settings/index.json
+++ b/web/messages/es/docs/settings/index.json
@@ -1,70 +1,70 @@
 {
   "meta": {
-    "title": "Settings de ProxMenux — Activación del Monitor, canal de release, idiomas | ProxMenux",
-    "description": "Menú de configuración de ProxMenux: activación de ProxMenux Monitor y conmutador del servicio, restablecer contraseña del Monitor, cambiar canal de release entre estable y beta, selección de idioma (instalación con traducción), información de versión y desinstalación. Las opciones aparecen condicionalmente según lo que esté instalado y activo.",
-    "ogTitle": "Settings de ProxMenux — Activación del Monitor, canal de release, idiomas",
-    "ogDescription": "Configura ProxMenux — servicio del Monitor, canal de release, idioma, info de versión y desinstalación.",
-    "twitterTitle": "Settings de ProxMenux",
-    "twitterDescription": "Activación del Monitor, cambio de canal de release, idiomas, info de versión y desinstalación."
+    "title": "Ajustes de ProxMenux — Activación del Monitor, canal de versiones e idiomas | ProxMenux",
+    "description": "Ajustes de ProxMenux: servicio Monitor y restablecimiento de contraseña, canal estable/beta, ocho idiomas de interfaz, diagnóstico de versión y desinstalación. Las opciones de Monitor aparecen cuando su servicio está instalado.",
+    "ogTitle": "Ajustes de ProxMenux — Activación del Monitor, canal de versiones e idiomas",
+    "ogDescription": "Configura ProxMenux: servicio Monitor, canal de versiones, idioma, versión y desinstalación.",
+    "twitterTitle": "Ajustes de ProxMenux",
+    "twitterDescription": "Activación de Monitor, cambio de canal de versiones, idiomas, versión y desinstalación."
   },
   "header": {
-    "title": "Settings",
-    "description": "Menú de configuración de ProxMenux. Lista lo que está instalado, te deja conmutar el servicio del Monitor, restablecer la contraseña de login del Monitor, cambiar entre canales de release estable y beta en cualquier dirección, cambiar el idioma de la UI (solo instalación con traducción) y proporciona un desinstalador limpio. Las opciones aparecen condicionalmente — lo que ves depende de tu tipo de instalación y del estado actual.",
-    "section": "Settings"
+    "title": "Ajustes",
+    "description": "Configura ProxMenux: activa o desactiva Monitor, restablece sus credenciales de acceso, cambia entre estable y beta en ambos sentidos, elige uno de ocho idiomas, consulta el diagnóstico de versión y desinstala. Las acciones de Monitor requieren su servicio instalado; el cambio de idioma siempre está disponible.",
+    "section": "Ajustes"
   },
   "intro": {
     "title": "Para qué sirve este menú",
-    "body": "Auto-administración del propio ProxMenux: servicio del Monitor, salida del canal beta, idioma, diagnósticos de versión y el desinstalador. Nada en este menú toca tus VMs, contenedores ni almacenamiento."
+    "body": "Administración del propio ProxMenux: servicio Monitor, salida del canal beta, idioma, diagnóstico de versión y desinstalador. Ninguna opción modifica tus máquinas virtuales, contenedores ni almacenamiento."
   },
   "opening": {
     "heading": "Abrir el menú",
-    "body": "Desde el menú principal de ProxMenux, pulsa <kbd>s</kbd>. Las opciones mostradas dependen de tu tipo de instalación y de lo que esté actualmente activo:",
-    "imageAlt": "Menú Settings de ProxMenux con opciones condicionales según el tipo de instalación y el estado de los componentes"
+    "body": "Desde el menú principal de ProxMenux, pulsa <kbd>s</kbd>. Las acciones de Monitor aparecen si su servicio está instalado; los demás ajustes siempre están disponibles:",
+    "imageAlt": "Menú Ajustes de ProxMenux con acciones de Monitor condicionales"
   },
   "installTypes": {
-    "heading": "Dos tipos de instalación, menús distintos",
-    "intro": "ProxMenux se entrega en dos sabores. El menú Settings se adapta al que tengas:",
+    "heading": "Una instalación, todos los idiomas",
+    "intro": "Las versiones actuales incluyen catálogos JSON estáticos de traducciones en todas las instalaciones. Las antiguas ofrecían modalidades separadas con traducción y normal:",
     "headerType": "Tipo de instalación",
     "headerBundles": "Qué incluye",
     "headerMenu": "El menú muestra",
     "rows": [
       {
-        "type": "Con traducción",
-        "bundles": "venv de Python + googletrans + configuración multi-idioma",
+        "type": "Instalación actual",
+        "bundles": "Catálogos JSON estáticos para siete idiomas, más el inglés integrado; sin entorno Python de traducción",
         "menuRich": "<strong>Cambiar idioma</strong> + Mostrar versión + Desinstalar"
       },
       {
-        "type": "Normal (ligera)",
-        "bundles": "Solo inglés, sin venv, huella menor",
-        "menu": "Mostrar versión + Desinstalar (sin selector de idioma)"
+        "type": "Modalidades antiguas con traducción / normal",
+        "bundles": "Antigua separación entre entorno de traducción e instalación solo en inglés",
+        "menu": "Actualiza con el instalador oficial para usar el menú unificado actual"
       }
     ],
-    "detectionTitle": "La detección es automática",
-    "detectionBody": "El script comprueba <code>/opt/googletrans-env/bin/activate</code> y una clave <code>language</code> no vacía en <code>config.json</code>. Ambas presentes → instalación con traducción. Falta alguna → instalación normal. No eliges; el menú se adapta."
+    "detectionTitle": "La selección de idioma siempre está disponible",
+    "detectionBody": "El menú ya no comprueba un entorno de traducción. Todas las instalaciones incluyen <code>/usr/local/share/proxmenux/lang/</code> y guardan el <code>language</code> seleccionado en <code>config.json</code>."
   },
   "options": {
     "heading": "Opciones del menú",
-    "intro": "Cinco herramientas. Los badges de <em>Condicional</em> significan que la opción solo aparece cuando se cumple el prerrequisito (Monitor instalado; programa beta activo; instalación con traducción).",
+    "intro": "Las herramientas siguientes gestionan el propio ProxMenux. <em>Condicional</em> indica que las acciones de Monitor solo aparecen si su servicio systemd está instalado. Canal de versiones, idioma, diagnóstico de versión y desinstalación siempre están disponibles.",
     "list": [
       {
         "icon": "Activity",
         "href": "/docs/settings/proxmenux-monitor",
-        "title": "ProxMenux Monitor",
+        "title": "Monitor de ProxMenux",
         "description": "Activa / desactiva la unidad systemd proxmenux-monitor.service, comprueba su estado actual y restablece la contraseña de login del panel si se ha perdido. UI web disponible en TCP 8008.",
         "badge": "Condicional"
       },
       {
         "icon": "TestTube",
         "href": "/docs/settings/beta-program",
-        "title": "Cambiar canal de release",
-        "description": "Cambia entre estable (main) y beta (develop) en cualquier dirección desde un único diálogo. Ejecuta el instalador oficial para el canal elegido; idempotente y siempre visible.",
+        "title": "Cambiar canal de versiones",
+        "description": "Cambia entre estable (main) y beta (develop) en ambos sentidos desde un único diálogo. Ejecuta el instalador oficial del canal elegido; es idempotente y siempre está visible.",
         "badge": "Siempre disponible"
       },
       {
         "icon": "Info",
         "href": "/docs/settings/show-version-information",
         "title": "Mostrar información de versión",
-        "description": "Versión de ProxMenux, tipo de instalación, componentes instalados, rutas de archivos, estado del entorno virtual e idioma actual."
+        "description": "Versión de ProxMenux, canal de versiones, componentes instalados, rutas de archivos, archivos de traducción e idioma actual."
       },
       {
         "icon": "Trash2",
@@ -75,7 +75,7 @@
     ]
   },
   "configTip": {
-    "title": "Dónde vive la configuración",
-    "bodyRich": "La mayor parte del estado gestionado por este menú vive en <code>/usr/local/share/proxmenux/config.json</code> — <code>language</code>, <code>beta_program.status</code> y flags de instalación por componente. El estado del servicio del Monitor vive en systemd (<code>proxmenux-monitor.service</code>), no aquí. La versión se lee de <code>/usr/local/share/proxmenux/version.txt</code>."
+    "title": "Dónde se guarda la configuración",
+    "bodyRich": "La mayor parte del estado gestionado por este menú se guarda en <code>/usr/local/share/proxmenux/config.json</code>: <code>language</code>, <code>beta_program.status</code> e indicadores de instalación por componente. El estado del servicio Monitor se guarda en systemd (<code>proxmenux-monitor.service</code>), no aquí. La versión se lee de <code>/usr/local/share/proxmenux/version.txt</code>."
   }
 }
diff --git a/web/messages/es/docs/settings/proxmenux-monitor.json b/web/messages/es/docs/settings/proxmenux-monitor.json
index 694435f1..d4ea04df 100644
--- a/web/messages/es/docs/settings/proxmenux-monitor.json
+++ b/web/messages/es/docs/settings/proxmenux-monitor.json
@@ -1,14 +1,14 @@
 {
   "meta": {
-    "title": "ProxMenux Monitor | ProxMenux Documentation",
+    "title": "ProxMenux Monitor | Documentación de ProxMenux",
     "description": "Activa o desactiva la unidad systemd proxmenux-monitor.service e inspecciona su estado actual. El Monitor expone una UI web en TCP 8008 para monitorización visual del host.",
-    "ogTitle": "ProxMenux Monitor | ProxMenux Documentation",
-    "ogDescription": "Conmuta el servicio systemd proxmenux-monitor y comprueba su estado desde el menú Settings."
+    "ogTitle": "ProxMenux Monitor | Documentación de ProxMenux",
+    "ogDescription": "Activa o desactiva el servicio systemd proxmenux-monitor y consulta su estado en Ajustes."
   },
   "header": {
     "title": "ProxMenux Monitor",
-    "description": "Dos acciones relacionadas dentro del menú Settings: conmutar la unidad systemd proxmenux-monitor.service (start / stop y enable / disable en un clic) y ver su estado detallado actual. El Monitor expone una UI web en TCP 8008 para monitorización visual del host.",
-    "section": "Settings"
+    "description": "Dos acciones relacionadas en Ajustes: activar o desactivar la unidad systemd proxmenux-monitor.service (iniciar/detener y habilitar/deshabilitar el arranque automático a la vez) y ver su estado detallado. Monitor ofrece una interfaz web en TCP 8008 para monitorizar el host.",
+    "section": "Ajustes"
   },
   "intro": {
     "title": "¿Qué es ProxMenux Monitor?",
@@ -32,7 +32,7 @@
     "outro": "El Monitor se instala automáticamente como parte de la instalación estándar de ProxMenux y corre como un servicio systemd (<code>proxmenux-monitor.service</code>) que arranca automáticamente al iniciar."
   },
   "warnConditional": {
-    "title": "Las opciones de Settings solo son visibles cuando el Monitor está instalado",
+    "title": "Las opciones de Ajustes solo aparecen cuando Monitor está instalado",
     "body": "Las dos entradas de menú descritas debajo solo aparecen en Settings si <code>proxmenux-monitor.service</code> está registrado en systemd. Si no las ves, el Monitor no se instaló (es opcional durante la instalación de ProxMenux). Para añadirlo más tarde, reinstala ProxMenux con la última versión y elige la opción de Monitor."
   },
   "toggle": {
@@ -43,17 +43,17 @@
     "headerAction": "Acción al confirmar",
     "rows": [
       {
-        "state": "active",
+        "state": "activo",
         "label": "Desactivar ProxMenux Monitor",
         "action": "systemctl stop + disable"
       },
       {
-        "state": "inactive",
+        "state": "inactivo",
         "label": "Activar ProxMenux Monitor",
         "action": "systemctl enable + start"
       }
     ],
-    "outro": "Cada conmutación requiere un diálogo explícito sí/no antes de ejecutarse. Activar / Desactivar es simétrico: desactivar para el servicio <em>y</em> deshabilita el auto-arranque al iniciar; activar habilita el auto-arranque <em>y</em> arranca el servicio inmediatamente."
+    "outro": "Cada cambio requiere confirmación sí/no. Desactivar detiene el servicio <em>y</em> deshabilita su inicio automático; activar habilita el inicio automático <em>y</em> arranca el servicio inmediatamente."
   },
   "status": {
     "heading": "Mostrar estado del servicio del Monitor",
@@ -70,21 +70,21 @@
     "code": "systemctl status proxmenux-monitor.service       # detailed status\nsystemctl is-active proxmenux-monitor.service    # one-word status\nsystemctl enable --now proxmenux-monitor.service # enable + start\nsystemctl disable --now proxmenux-monitor.service # stop + disable\njournalctl -u proxmenux-monitor.service -f       # follow live logs"
   },
   "reset": {
-    "heading": "Restablecer contraseña del Monitor",
-    "intro": "Ruta de recuperación para el operador que perdió la contraseña del panel (o el dispositivo 2FA). La opción solo aparece cuando el Monitor está instalado en el host. Al seleccionarla:",
+    "heading": "Restablecer la contraseña de ProxMenux Monitor",
+    "intro": "Ruta de recuperación para el usuario que perdió la contraseña del panel (o el dispositivo 2FA). La opción solo aparece cuando el Monitor está instalado en el host. Al seleccionarla:",
     "items": [
       "Pide confirmación con un diálogo sí/no — la acción es destructiva para las credenciales de login.",
       "Hace backup del <code>/root/.config/proxmenux-monitor/auth.json</code> existente a <code>auth.json.bak-&lt;UTC timestamp&gt;</code> (modo <code>0600</code>) para que el estado previo se pueda restaurar manualmente si el reset fue un error.",
-      "Para el servicio <code>proxmenux-monitor</code> para que la edición en disco no compita con un login en vuelo.",
+      "Detiene el servicio <code>proxmenux-monitor</code> para evitar conflictos entre la edición del archivo y un inicio de sesión en curso.",
       "Limpia los campos de identidad en <code>auth.json</code>: <code>enabled=false</code>, <code>configured=false</code>, vacía <code>username</code>, <code>password_hash</code>, <code>totp_secret</code> y el array de códigos de backup.",
-      "<strong>Preserva</strong> el <code>jwt_secret</code> y los <code>api_tokens</code> / <code>revoked_tokens</code> registrados — para que los tokens de API de larga vida usados por Home Assistant u otros scripts <em>sigan autenticando</em> tras el reset.",
+      "<strong>Conserva</strong> <code>jwt_secret</code> y los <code>api_tokens</code> / <code>revoked_tokens</code> registrados para que los tokens de larga duración de Home Assistant u otros scripts <em>sigan autenticándose</em> tras el restablecimiento.",
       "Reinicia el servicio. La siguiente visita a <code>http://&lt;host&gt;:8008</code> muestra el asistente de configuración de primer lanzamiento para que se pueda crear una nueva cuenta de administrador."
     ],
     "preservedTitle": "Qué sobrevive al reset, qué no",
-    "preservedBody": "<strong>Borrado:</strong> nombre de usuario, hash de contraseña, secreto TOTP de 2FA, códigos de backup. <strong>Preservado:</strong> <code>jwt_secret</code>, metadatos de <code>api_tokens</code>, lista de <code>revoked_tokens</code>. Si quieres activamente invalidar también todo token de API existente (pizarra limpia total), borra <code>auth.json</code> manualmente en lugar de usar esta opción de menú — el siguiente arranque del servicio regenera el secreto JWT y todo lo demás desde cero.",
+    "preservedBody": "<strong>Borra:</strong> usuario, hash de contraseña, secreto TOTP de 2FA y códigos de recuperación. <strong>Conserva:</strong> <code>jwt_secret</code>, metadatos de <code>api_tokens</code> y lista <code>revoked_tokens</code>. Para invalidar también todos los tokens API y empezar de cero, elimina <code>auth.json</code> manualmente en lugar de usar esta opción. Al reiniciar el servicio se regeneran el secreto JWT y los demás datos.",
     "trustTitle": "El acceso al host físico es el ancla de confianza",
     "trustBody": "Esta ruta de reset requiere shell root en el host. Cualquiera que pueda ejecutar el comando <code>menu</code> como root ya controla la máquina, así que darle la recuperación de contraseña no es una escalada de privilegios — es coherente con cómo funciona cualquier otra herramienta de administración en Proxmox. El corolario: el login del Monitor no protegerá nada de alguien a quien ya hayas dejado entrar al shell de Proxmox.",
-    "seeAlso": "Mira también <link>Monitor → Access y Auth → Recuperar una contraseña perdida</link> para el mismo flujo descrito desde el lado del panel, además del contexto más amplio sobre cómo se hashean las contraseñas y cómo se genera el secreto JWT."
+    "seeAlso": "Consulta también <link>Monitor → Acceso y autenticación → Recuperar una contraseña perdida</link> para ver este procedimiento desde el panel y conocer cómo se calculan los hashes de contraseñas y se genera el secreto JWT."
   },
   "files": {
     "heading": "Archivos implicados",
@@ -95,7 +95,7 @@
     "missingTitle": "Ambas opciones del menú faltan",
     "missingBody": "El Monitor no está registrado en systemd. Confirma con <code>systemctl list-unit-files | grep proxmenux-monitor</code> — si no hay salida, reinstala ProxMenux desde el instalador oficial con la última versión y elige la opción de Monitor durante la instalación.",
     "unreachableTitle": "Servicio activado pero la URL es inalcanzable",
-    "unreachableBody": "La salida del estado en Settings te da la IP. Confirma:",
+    "unreachableBody": "El estado en Ajustes muestra la IP. Comprueba:",
     "unreachableCmd": "ss -tlnp | grep 8008                # is anything listening?\njournalctl -u proxmenux-monitor -n 100 --no-pager  # recent errors\ncurl -sI http://localhost:8008      # local reachability",
     "unreachableOutro": "Si localhost funciona pero el externo no, comprueba el firewall del host (<code>pve-firewall</code> o nftables) para TCP 8008 entrante.",
     "stopsTitle": "Activé el servicio pero se para solo unos segundos después",
@@ -111,7 +111,7 @@
       },
       {
         "href": "/docs/settings",
-        "label": "Resumen de Settings",
+        "label": "Resumen de Ajustes",
         "tail": "."
       }
     ]
diff --git a/web/messages/es/docs/settings/show-version-information.json b/web/messages/es/docs/settings/show-version-information.json
index 4fd8fec4..2b7581b6 100644
--- a/web/messages/es/docs/settings/show-version-information.json
+++ b/web/messages/es/docs/settings/show-version-information.json
@@ -1,14 +1,14 @@
 {
   "meta": {
-    "title": "Mostrar información de versión | ProxMenux Documentation",
-    "description": "Autodiagnóstico de ProxMenux de solo lectura: número de versión, tipo de instalación (con traducción / normal), componentes instalados desde config.json, rutas de archivos, estado del entorno virtual e idioma actual.",
-    "ogTitle": "Mostrar información de versión | ProxMenux Documentation",
-    "ogDescription": "Volcado de diagnóstico de versión de ProxMenux, tipo de instalación, componentes, archivos e idioma."
+    "title": "Mostrar información de versión | Documentación de ProxMenux",
+    "description": "Diagnóstico de ProxMenux de solo lectura: versión, canal de versiones, componentes registrados en config.json, rutas de archivos, catálogos de traducción e idioma actual.",
+    "ogTitle": "Mostrar información de versión | Documentación de ProxMenux",
+    "ogDescription": "Datos de diagnóstico de ProxMenux: versión, canal de versiones, componentes, archivos e idioma."
   },
   "header": {
     "title": "Mostrar información de versión",
-    "description": "Diagnóstico de solo lectura. Lee version.txt, config.json y unas pocas rutas de archivos conocidas, después renderiza un cuadro de texto desplazable con la versión, tipo de instalación, componentes instalados, presencia de archivos, estado del entorno virtual e idioma actual.",
-    "section": "Settings"
+    "description": "Diagnóstico de solo lectura. Lee version.txt, config.json y rutas de archivos conocidas; muestra un cuadro de texto desplazable con la versión, el canal de versiones, los componentes instalados, la presencia de archivos, los archivos de traducción y el idioma actual.",
+    "section": "Ajustes"
   },
   "intro": {
     "title": "Qué es esto",
@@ -26,14 +26,14 @@
         "contentRich": "Número de versión de una sola línea; <code>Unknown</code> si el archivo falta"
       },
       {
-        "section": "Tipo de instalación",
-        "source": "comprobaciones de venv + config.json",
-        "content": "Con traducción (multi-idioma) o Normal (solo inglés)"
+        "section": "Canal de versiones",
+        "source": "Estado del programa beta en config.json",
+        "content": "Estable (main) o beta (develop); versión beta si está disponible"
       },
       {
         "section": "Componentes instalados",
         "source": "config.json",
-        "content": "Estado por componente (✓ instalado / creado / actualizado, ✗ faltante)"
+        "content": "Estado de cada componente (✓ instalado / creado / actualizado, ✗ ausente)"
       },
       {
         "section": "Archivos de ProxMenux",
@@ -41,14 +41,14 @@
         "contentRich": "Presencia y rutas de <code>menu</code>, <code>utils.sh</code>, <code>config.json</code>, <code>version.txt</code>"
       },
       {
-        "section": "Entorno virtual",
-        "source": "/opt/googletrans-env",
-        "content": "Solo instalación con traducción — presencia de venv + pip"
+        "section": "Archivos de traducción",
+        "source": "/usr/local/share/proxmenux/lang/",
+        "content": "Presencia del directorio lang/ incluido en todas las instalaciones"
       },
       {
         "section": "Idioma actual",
         "source": "config.json",
-        "contentRich": "Con traducción: código de idioma desde <code>.language</code>; Normal: <code>English (Fixed)</code>"
+        "contentRich": "Código de idioma de <code>.language</code>; usa <code>en</code> por defecto si no está definido"
       }
     ]
   },
@@ -60,7 +60,7 @@
     "unknownBody": "<code>/usr/local/share/proxmenux/version.txt</code> falta o no es legible. Lo más habitual es por una instalación parcial. Reinstala desde la fuente oficial de ProxMenux.",
     "noConfigTitle": "No hay información de instalación disponible",
     "noConfigBody": "<code>config.json</code> falta. El script no puede enumerar los componentes sin él. Reinstala para regenerarlo.",
-    "wrongStatusTitle": "Un componente muestra ✗ y estoy seguro de haberlo instalado",
+    "wrongStatusTitle": "Un componente muestra ✗ aunque estoy seguro de haberlo instalado",
     "wrongStatusBody": "Significa que <code>config.json</code> no registra ese componente como instalado — podría ser un script que aún no se registra a sí mismo, o una instalación manual que se saltó ProxMenux. El diálogo refleja lo que dice <code>config.json</code>, no lo que hay realmente en disco."
   },
   "related": {
@@ -73,7 +73,7 @@
       },
       {
         "href": "/docs/settings",
-        "label": "Resumen de Settings",
+        "label": "Resumen de Ajustes",
         "tail": "."
       }
     ]
diff --git a/web/messages/es/docs/settings/uninstall-proxmenux.json b/web/messages/es/docs/settings/uninstall-proxmenux.json
index a799f687..99f77f70 100644
--- a/web/messages/es/docs/settings/uninstall-proxmenux.json
+++ b/web/messages/es/docs/settings/uninstall-proxmenux.json
@@ -1,55 +1,55 @@
 {
   "meta": {
-    "title": "Desinstalar ProxMenux | ProxMenux Documentation",
-    "description": "Desinstalador limpio de ProxMenux con eliminación opcional de dependencias (jq, dialog, python3-*) y restauración automática de los backups de /root/.bashrc y /etc/motd creados en el momento de la instalación. También elimina el servicio proxmenux-monitor si está presente.",
-    "ogTitle": "Desinstalar ProxMenux | ProxMenux Documentation",
+    "title": "Desinstalar ProxMenux | Documentación de ProxMenux",
+    "description": "Desinstalador de ProxMenux con eliminación opcional de jq y dialog, limpieza de archivos de traducción antiguos y del servicio Monitor, y restauración de copias de archivos del sistema.",
+    "ogTitle": "Desinstalar ProxMenux | Documentación de ProxMenux",
     "ogDescription": "Elimina limpiamente ProxMenux de un host Proxmox con limpieza opcional de dependencias."
   },
   "header": {
     "title": "Desinstalar ProxMenux",
-    "description": "Elimina ProxMenux del host Proxmox con un flujo interactivo: confirmación, eliminación opcional de dependencias, limpieza del servicio ProxMenux Monitor, restauración de los backups de /root/.bashrc y /etc/motd. Muestra una barra de progreso todo el tiempo.",
-    "section": "Settings"
+    "description": "Elimina ProxMenux del host Proxmox mediante un proceso interactivo: confirmación, eliminación opcional de dependencias, limpieza del servicio ProxMenux Monitor y restauración de las copias de /root/.bashrc y /etc/motd. Muestra una barra de progreso durante todo el proceso.",
+    "section": "Ajustes"
   },
   "scopeWarn": {
     "title": "Afecta solo a la instalación de ProxMenux — no a tus VMs / CTs / almacenamiento",
-    "body": "Desinstalar ProxMenux elimina los scripts de ProxMenux, el lanzador del menú, el servicio opcional Monitor y cualquier backup que ProxMenux hizo de archivos del sistema cuando lo instalaste. <strong>No toca tus VMs, contenedores, almacenamiento, configuración de red, Fail2Ban, driver NVIDIA ni nada más que hayas instalado vía ProxMenux.</strong> Esas cosas se quedan como están."
+    "body": "Desinstalar ProxMenux elimina sus scripts, el lanzador del menú, el servicio opcional Monitor y las copias de archivos del sistema que creó durante la instalación. <strong>No modifica tus máquinas virtuales, contenedores, almacenamiento, configuración de red, Fail2Ban, el controlador NVIDIA ni nada más que hayas instalado mediante ProxMenux.</strong> Todo ello permanece como está."
   },
   "flow": {
-    "heading": "El flujo de desinstalación",
+    "heading": "El proceso de desinstalación",
     "items": [
-      "<strong>Diálogo de confirmación.</strong> Sí/no — \"¿Seguro que quieres desinstalar ProxMenux?\"",
-      "<strong>Checklist de eliminación de dependencias.</strong> La lista preseleccionada depende del tipo de instalación (mira la tabla de abajo). Todas las casillas por defecto en OFF — te apuntas a eliminar cada dependencia.",
-      "<strong>La eliminación corre con una barra de progreso.</strong> Elimina el venv (solo instalación con traducción), el lanzador <code>menu</code>, el árbol <code>/usr/local/share/proxmenux/</code>, el servicio ProxMenux Monitor si está presente junto con el destino de notificaciones que registró en Proxmox VE (<code>proxmenux-webhook</code> y su matcher), las dependencias que marcaste y, por último, restaura los backups de archivos del sistema (mira abajo).",
-      "<strong>Diálogo de finalización.</strong> Lista las dependencias eliminadas y sale."
+      "<strong>Diálogo de confirmación.</strong> Sí/no: «¿Estás seguro de que deseas desinstalar ProxMenux?»",
+      "<strong>Lista de eliminación de dependencias.</strong> Ofrece jq y dialog. Ambas casillas están desmarcadas por defecto; selecciona solo dependencias que ninguna otra aplicación necesite.",
+      "<strong>La eliminación muestra una barra de progreso.</strong> Elimina cualquier entorno de traducción antiguo que quede, el lanzador <code>menu</code>, el árbol <code>/usr/local/share/proxmenux/</code>, el servicio ProxMenux Monitor si existe y el destino de notificaciones que registró en Proxmox VE (<code>proxmenux-webhook</code> y su regla de coincidencia), las dependencias seleccionadas y, por último, restaura las copias de los archivos del sistema (ver más abajo).",
+      "<strong>Diálogo de finalización.</strong> Enumera las dependencias eliminadas y termina."
     ]
   },
   "deps": {
     "heading": "Eliminación de dependencias: qué se ofrece",
-    "intro": "La checklist depende del tipo de instalación. <strong>Ninguna casilla está marcada por defecto</strong> — son paquetes de todo el sistema que otras aplicaciones podrían usar, así que el valor por defecto más seguro es dejarlos.",
-    "headerType": "Tipo de instalación",
+    "intro": "La lista ofrece jq y dialog. <strong>Ninguna casilla está marcada por defecto</strong>: otras aplicaciones pueden usar estos paquetes del sistema, por lo que es más seguro conservarlos.",
+    "headerType": "Instalación",
     "headerOffered": "Se ofrece para eliminar",
     "rows": [
       {
-        "type": "Con traducción",
-        "offeredRich": "<code>python3-venv</code>, <code>python3-pip</code>, <code>python3</code>, <code>jq</code>"
+        "type": "Versiones actuales",
+        "offeredRich": "<code>dialog</code>, <code>jq</code>"
       },
       {
-        "type": "Normal",
+        "type": "Instalaciones antiguas tras actualizar",
         "offeredRich": "<code>dialog</code>, <code>jq</code>"
       }
     ],
     "warnTitle": "Paquetes de todo el sistema — piénsalo dos veces",
-    "warnBody": "<code>python3</code>, <code>jq</code> y <code>dialog</code> los usan habitualmente otras herramientas (incluyendo el propio Proxmox en algunos flujos). Eliminar <code>python3</code> en particular puede romper helpers de Proxmox, utilidades de Ceph y muchos scripts de terceros. Déjalos a menos que estés seguro de que nada más los necesita."
+    "warnBody": "La lista actual ofrece <code>jq</code> y <code>dialog</code>, no <code>python3</code>. Son paquetes del sistema que otras herramientas pueden necesitar. La eliminación también puede eliminar paquetes dependientes o dependencias sin uso. Conserva los paquetes necesarios y revisa cualquier propuesta de eliminación antes de ejecutar apt manualmente."
   },
   "removed": {
     "heading": "Qué se elimina",
-    "code": "/usr/local/bin/menu                                  # the launcher\n/usr/local/share/proxmenux/                          # everything: scripts, config, cache, version\n/opt/googletrans-env/                                # virtual env (Translation install only)\n/etc/systemd/system/proxmenux-monitor.service        # Monitor service unit\n/root/.config/proxmenux-monitor/                     # Monitor config dir\n                                                     # + dependencies you ticked in the checklist"
+    "code": "/usr/local/bin/menu                                  # the launcher\n/usr/local/share/proxmenux/                          # everything: scripts, config, cache, version\n/opt/googletrans-env/                                # leftover legacy translation environment\n/etc/systemd/system/proxmenux-monitor.service        # Monitor service unit\n/root/.config/proxmenux-monitor/                     # Monitor config dir\n                                                     # + dependencies you ticked in the checklist"
   },
   "restored": {
     "heading": "Qué se restaura",
     "items": [
       "Si <code>/root/.bashrc.bak</code> existe → se renombra de vuelta a <code>/root/.bashrc</code> (tu bashrc original vuelve).",
-      "Si <code>/etc/motd.bak</code> existe → se renombra de vuelta a <code>/etc/motd</code>. Si no, la línea de ProxMenux (<em>\"This system is optimised by: ProxMenux\"</em>) se elimina del motd existente con sed."
+      "Si existe <code>/etc/motd.bak</code>, se renombra a <code>/etc/motd</code>. Si no, sed elimina del motd actual la línea de ProxMenux (<em>“This system is optimised by: ProxMenux”</em>)."
     ]
   },
   "othersCallout": {
@@ -59,20 +59,20 @@
   "manual": {
     "heading": "Desinstalación manual",
     "intro": "Si por alguna razón el desinstalador del menú no se puede ejecutar (p. ej. <code>dialog</code> ya falta), la secuencia manual equivalente:",
-    "code": "# 1. Stop and remove the Monitor service (if installed)\nsystemctl stop proxmenux-monitor.service 2>/dev/null\nsystemctl disable proxmenux-monitor.service 2>/dev/null\nrm -f /etc/systemd/system/proxmenux-monitor.service\nrm -rf /root/.config/proxmenux-monitor\nsystemctl daemon-reload\nsystemctl reset-failed 2>/dev/null\n\n# 2. Remove the venv (Translation install only)\nrm -rf /opt/googletrans-env\n\n# 3. Remove ProxMenux files\nrm -f /usr/local/bin/menu\nrm -rf /usr/local/share/proxmenux\n\n# 4. Restore backups\n[ -f /root/.bashrc.bak ] && mv /root/.bashrc.bak /root/.bashrc\n[ -f /etc/motd.bak ] && mv /etc/motd.bak /etc/motd \\\n    || sed -i '/This system is optimised by: ProxMenux/d' /etc/motd"
+    "code": "# 1. Stop and remove the Monitor service (if installed)\nsystemctl stop proxmenux-monitor.service 2>/dev/null\nsystemctl disable proxmenux-monitor.service 2>/dev/null\nrm -f /etc/systemd/system/proxmenux-monitor.service\nrm -rf /root/.config/proxmenux-monitor\nsystemctl daemon-reload\nsystemctl reset-failed 2>/dev/null\n\n# 2. Remove a leftover legacy translation environment\nrm -rf /opt/googletrans-env\n\n# 3. Remove ProxMenux files\nrm -f /usr/local/bin/menu\nrm -rf /usr/local/share/proxmenux\n\n# 4. Restore backups\n[ -f /root/.bashrc.bak ] && mv /root/.bashrc.bak /root/.bashrc\n[ -f /etc/motd.bak ] && mv /etc/motd.bak /etc/motd \\\n    || sed -i '/This system is optimised by: ProxMenux/d' /etc/motd"
   },
   "reinstall": {
     "heading": "Reinstalar más tarde",
-    "body": "Ejecuta el instalador oficial de ProxMenux otra vez. Elige con traducción o normal como prefieras — la elección es independiente de lo que tuvieses antes."
+    "body": "Vuelve a ejecutar el instalador oficial de ProxMenux. Las versiones actuales usan una única modalidad de instalación que incluye los ocho idiomas de la interfaz."
   },
   "troubleshoot": {
     "heading": "Solución de problemas",
-    "hangTitle": "La desinstalación se queda colgada en \"Removing googletrans and virtual environment\"",
-    "hangBody": "<code>pip uninstall</code> puede atascarse si pip no responde. Desde otro shell: <code>rm -rf /opt/googletrans-env</code> directamente (el script hace lo mismo como fallback tras pip).",
-    "aptTitle": "apt avisa de paquetes aún en uso durante la eliminación de dependencias",
-    "aptBody": "Esperado si marcaste <code>python3</code> o <code>jq</code> mientras otras cosas en el host dependen de ellos. El <code>autoremove</code> de apt se negará a eliminarlos en ese caso (que es el comportamiento seguro). Desmarca esa dependencia y vuelve a ejecutar.",
+    "hangTitle": "La desinstalación se bloquea al eliminar un entorno de traducción antiguo",
+    "hangBody": "Las versiones actuales eliminan el entorno residual con <code>rm -rf /opt/googletrans-env</code>; no ejecutan <code>pip uninstall</code>. Si este paso se bloquea, examínalo desde otro shell y comprueba el sistema de archivos del host antes de reintentarlo.",
+    "aptTitle": "apt avisa de paquetes aún en uso al eliminar dependencias",
+    "aptBody": "Los paquetes seleccionados se marcan como automáticos y se pasan a <code>apt-get -y --purge autoremove</code>. Esto no garantiza la protección de los servicios dependientes. Deja las dependencias sin marcar si otras herramientas las necesitan; revisa las eliminaciones que proponga apt antes de cualquier limpieza manual.",
     "motdTitle": "El MOTD sigue mostrando la línea de ProxMenux tras desinstalar",
-    "motdBody": "O no existía <code>/etc/motd.bak</code> y la limpieza con sed no coincidió (p. ej. la línea fue modificada). Edita <code>/etc/motd</code> a mano y elimina cualquier línea sobrante de ProxMenux."
+    "motdBody": "Puede ocurrir si no existía <code>/etc/motd.bak</code> y sed no encontró la línea (por ejemplo, porque se había modificado). Edita <code>/etc/motd</code> a mano y elimina las líneas de ProxMenux que queden."
   },
   "related": {
     "heading": "Relacionado",
@@ -84,7 +84,7 @@
       },
       {
         "href": "/docs/settings",
-        "label": "Resumen de Settings",
+        "label": "Resumen de Ajustes",
         "tail": "."
       }
     ]
diff --git a/web/messages/es/docs/storage-share/host-iscsi.json b/web/messages/es/docs/storage-share/host-iscsi.json
index 04be8a5f..ef7d8bdc 100644
--- a/web/messages/es/docs/storage-share/host-iscsi.json
+++ b/web/messages/es/docs/storage-share/host-iscsi.json
@@ -24,7 +24,7 @@
         "meaningRich": "El endpoint del servicio iSCSI en el servidor del target — una IP (o hostname) más un puerto TCP. El puerto por defecto es <code>3260</code>; ProxMenux lo asume si no especificas uno."
       },
       {
-        "term": "Target",
+        "term": "Destino (target)",
         "meaningRich": "Un único \"servidor\" exportado dentro del portal, identificado por su IQN (<em>iSCSI Qualified Name</em>). Un portal puede alojar muchos targets."
       },
       {
@@ -36,7 +36,7 @@
         "meaningRich": "Un dispositivo de bloque dentro de un target (Logical Unit Number). Un único target puede exponer varias LUNs; cada LUN aparece como su propio disco en Proxmox y puede convertirse en un disco de VM."
       },
       {
-        "term": "Initiator",
+        "term": "Iniciador",
         "meaningRich": "El cliente que conecta a un target — en este caso, tu host Proxmox. El initiator tiene su propio IQN guardado en <code>/etc/iscsi/initiatorname.iscsi</code>. Los targets normalmente solo aceptan sesiones de IQNs de initiator preautorizados."
       }
     ]
@@ -44,7 +44,7 @@
   "opening": {
     "heading": "Abrir la herramienta",
     "body": "Desde el menú principal de ProxMenux, abre <strong>Storage &amp; Share Manager → Add iSCSI Target as Proxmox Storage</strong>. Verás este submenú con cuatro opciones:",
-    "imageAlt": "Menú iSCSI Host Manager — Add / View / Remove / Test connectivity"
+    "imageAlt": "Menú del gestor iSCSI del host — Añadir / Ver / Eliminar / Probar conectividad"
   },
   "howRuns": {
     "heading": "Cómo se ejecuta el script (flujo Add)",
@@ -56,7 +56,7 @@
       "<strong>Entrada del portal</strong> — escribe la IP o hostname del servidor del target iSCSI. Se asume el puerto <code>3260</code> a menos que escribas <code>host:port</code>.",
       "<strong>Descubrimiento de targets</strong> — ProxMenux llama a <code>iscsiadm --mode discovery --type sendtargets --portal &lt;ip:port&gt;</code>. El servidor responde con cada IQN que permite ver a este initiator. Si el descubrimiento falla, el script muestra el error exacto de <code>iscsiadm</code> y lista las causas comunes (IP incorrecta, firewall, IQN del initiator no autorizado).",
       "<strong>Selección del target</strong> — si hay un solo target se selecciona automáticamente; con varios targets se muestra un menú.",
-      "<strong>Storage ID</strong> — por defecto es <code>iscsi-&lt;último segmento del IQN, máx. 20 caracteres&gt;</code>. Solo letras, dígitos, <code>-</code> y <code>_</code>.",
+      "<strong>Storage ID</strong> — por defecto es <code>iscsi-&lt;last IQN segment, 20 chars max&gt;</code>. Solo letras, dígitos, <code>-</code> y <code>_</code>.",
       "<strong>Content type</strong> — a diferencia de NFS / Samba, el contenido iSCSI está <strong>fijado a <code>images</code></strong>. iSCSI expone dispositivos de bloque raw, no un sistema de archivos, así que Proxmox solo te deja alojar discos de VM ahí."
     ],
     "authTitle": "Autorizar el initiator de Proxmox en el target",
@@ -74,7 +74,7 @@
   "remove": {
     "heading": "Eliminar almacenamiento iSCSI",
     "body": "Ejecuta <code>pvesm remove &lt;storage-id&gt;</code> tras confirmar portal, target y contenido. Solo se elimina el registro en Proxmox — <strong>el propio target iSCSI no se toca</strong> y las sesiones existentes en el lado del kernel pueden persistir hasta el siguiente reinicio.",
-    "warnTitle": "Discos de VM existentes en este iSCSI primero",
+    "warnTitle": "Primero revisa los discos de VM existentes en este iSCSI",
     "warnBody": "Eliminar un almacenamiento iSCSI mientras las VMs todavía tienen discos en él deja a esas VMs apuntando a un almacén desaparecido. Proxmox marcará el error, pero los datos de la LUN siguen intactos en el target — puedes volver a registrar el almacenamiento después para recuperar los discos. Aun así, mueve o haz backup de las VMs primero por seguridad."
   },
   "test": {
@@ -98,7 +98,7 @@
     "noLunTitle": "Las LUNs no aparecen en /dev/disk/by-path tras el registro",
     "noLunBody": "<code>pvesm add iscsi</code> tuvo éxito pero el kernel no ve dispositivos de bloque. Comprueba <code>iscsiadm --mode session</code> — si no hay sesión activa, inicia una manualmente con <code>iscsiadm --mode node --login</code>. Si hay sesión pero no aparecen LUNs, fuerza un rescan: <code>iscsiadm --mode session --rescan</code>. Si sigue sin haber nada, probablemente el target todavía no tiene LUNs asignadas a este IQN (configura el mapeo de LUN en el target).",
     "chapTitle": "Autenticación CHAP",
-    "chapBody": "ProxMenux no expone los campos de usuario / contraseña CHAP en el flujo interactivo. Si tu target requiere CHAP, registra con ProxMenux primero (el descubrimiento con CHAP puede fallar, pero <code>pvesm add</code> escribirá la entrada igualmente), luego añade credenciales manualmente: <code>pvesm set &lt;id&gt; --username &lt;chap-user&gt;</code> y edita <code>/etc/iscsi/iscsid.conf</code> con la contraseña, después <code>systemctl restart iscsid</code>. Es una carencia del script actual — documentada aquí para que sepas qué hacer."
+    "chapBody": "ProxMenux no ofrece campos de usuario y contraseña CHAP en el flujo interactivo. Si falla el descubrimiento, el script se detiene antes de <code>pvesm add</code>; no registra el almacenamiento de todos modos. Configura por separado los requisitos CHAP del destino en <code>open-iscsi</code>, incluida la autenticación del descubrimiento si hace falta, y vuelve a intentarlo. Usa <code>iscsiadm</code> para comprobar la configuración y verifica las sesiones activas con <code>iscsiadm --mode session</code>."
   },
   "related": {
     "heading": "Relacionado",
diff --git a/web/messages/es/docs/storage-share/host-local-disk.json b/web/messages/es/docs/storage-share/host-local-disk.json
index 9aac83df..513f9f0e 100644
--- a/web/messages/es/docs/storage-share/host-local-disk.json
+++ b/web/messages/es/docs/storage-share/host-local-disk.json
@@ -1,8 +1,8 @@
 {
   "meta": {
-    "title": "Host: añadir disco local como almacenamiento de Proxmox | ProxMenux Documentation",
+    "title": "Host: añadir disco local como almacenamiento de Proxmox | Documentación de ProxMenux",
     "description": "Formatea un disco local SATA / SAS / NVMe en un host Proxmox y regístralo como almacenamiento Proxmox directory o ZFS pool. Detección segura de discos, gate de confirmación para operaciones destructivas, fstab basado en UUID, creación de ZFS pool y pvesm add dir / zfspool por dentro.",
-    "ogTitle": "Host: añadir disco local como almacenamiento de Proxmox | ProxMenux Documentation",
+    "ogTitle": "Host: añadir disco local como almacenamiento de Proxmox | Documentación de ProxMenux",
     "ogDescription": "Formatea un disco local y regístralo como almacenamiento Proxmox directory o ZFS pool con un flujo guiado y filtrado por seguridad."
   },
   "header": {
@@ -16,11 +16,11 @@
   },
   "destructive": {
     "title": "Herramienta destructiva para la ruta 'format'",
-    "body": "La ruta <em>Format</em> <strong>borra cada partición y byte del disco seleccionado</strong>. ProxMenux muestra la lista de discos con un banner de advertencia, filtra los discos ya en uso y exige una confirmación explícita antes de ejecutar cualquier <code>wipefs</code> / <code>sgdisk</code> / <code>mkfs</code>. Aun así — lee la ruta del dispositivo en voz alta dos veces antes de escribir \"yes\"."
+    "body": "La opción <em>Formatear</em> <strong>destruye las particiones y los datos existentes en el disco seleccionado</strong>. ProxMenux muestra una advertencia, filtra los discos en uso y exige confirmación antes de ejecutar <code>wipefs</code> / <code>sgdisk</code> / <code>mkfs</code>. No es una sobrescritura segura de cada byte. Comprueba dos veces la ruta del dispositivo antes de confirmar."
   },
   "compare": {
     "heading": "Directory vs ZFS pool — cuál elegir",
-    "headerDir": "Directory (ext4 / xfs / btrfs)",
+    "headerDir": "Directorio (ext4 / xfs / btrfs)",
     "headerZfs": "ZFS pool",
     "rows": [
       {
@@ -34,12 +34,12 @@
         "zfs": "Dataset ZFS nativo (zvol) por disco"
       },
       {
-        "label": "Snapshots",
+        "label": "Instantáneas",
         "dir": "Snapshots qcow2; snapshots btrfs si fs=btrfs",
         "zfs": "Nativos, instantáneos, copy-on-write"
       },
       {
-        "label": "Thin provisioning",
+        "label": "Aprovisionamiento fino",
         "dir": "Sí (qcow2 por defecto)",
         "zfs": "Sí (ZFS por defecto)"
       },
@@ -51,7 +51,7 @@
       {
         "label": "Content types soportados",
         "dir": "images, backup, iso, vztmpl, snippets, rootdir",
-        "zfs": "images, rootdir solamente (almacenamiento de bloque)"
+        "zfs": "solo images y rootdir (almacenamiento de bloques)"
       },
       {
         "label": "Mejor para",
@@ -63,7 +63,7 @@
   "opening": {
     "heading": "Abrir la herramienta",
     "body": "Desde el menú principal de ProxMenux, abre <strong>Storage &amp; Share Manager → Add Local Disk as Proxmox Storage</strong>. Verás este submenú con cuatro opciones:",
-    "imageAlt": "Menú Local Disk Manager — Add / View / Remove / List available disks"
+    "imageAlt": "Menú de discos locales — Añadir / Ver / Eliminar / Listar discos disponibles"
   },
   "howRuns": {
     "heading": "Cómo se ejecuta el script (flujo Add)",
@@ -78,7 +78,7 @@
       "Elige el sistema de archivos — mira la tabla de arriba para las contrapartidas.",
       "Storage ID (por defecto <code>disk-&lt;device&gt;</code>), ruta de montaje, preset de content type.",
       "Confirma en el diálogo <strong>FINAL CONFIRMATION — DATA WILL BE ERASED</strong>.",
-      "ProxMenux limpia la tabla de particiones, crea una partición que abarca el disco entero, ejecuta <code>mkfs.&lt;fs&gt;</code> (o <code>zpool create</code>), la monta, la añade a <code>/etc/fstab</code> por UUID con <code>defaults,nofail</code> y la registra en Proxmox vía <code>pvesm add dir</code> o <code>pvesm add zfspool</code>."
+      "ProxMenux limpia la tabla de particiones y crea una partición que abarca el disco. Ejecuta <code>mkfs.&lt;fs&gt;</code> o <code>zpool create</code> y monta el resultado. Los sistemas de archivos normales reciben una entrada en <code>/etc/fstab</code> por UUID con <code>defaults,nofail</code>; ZFS usa la configuración de montaje del pool. Si <em>Como almacenamiento Proxmox</em> está marcado (siempre en ZFS), se registra con <code>pvesm add dir</code> o <code>pvesm add zfspool</code>; si no, queda solo como montaje del host."
     ],
     "tipTitle": "Por qué UUID + nofail en /etc/fstab",
     "tipBody": "El script escribe <code>UUID=… /mnt/&lt;id&gt; &lt;fs&gt; defaults,nofail 0 2</code>. El UUID sobrevive a reordenaciones de dispositivos entre reinicios (así que <code>/dev/sdc</code> pasando a ser <code>/dev/sdd</code> no rompe el arranque). <code>nofail</code> significa que si el disco desaparece alguna vez (fallo de hardware, desconectado), Proxmox arranca igualmente — el almacenamiento simplemente se mostrará como inactive hasta que el disco vuelva."
@@ -96,35 +96,35 @@
     "warnBody": "Si el disco ya contiene un pool ZFS, la ruta de <em>reuse</em> aquí simplemente intenta montarlo como un sistema de archivos normal — y falla. Para importar un pool ZFS existente usa <code>zpool import &lt;name&gt;</code> en línea de comandos y después regístralo manualmente con <code>pvesm add zfspool</code>."
   },
   "presets": {
-    "heading": "Presets de content type",
-    "intro": "En vez de una larga lista de verificación, ProxMenux ofrece 4 presets más una opción custom. La cadena del preset se pasa a <code>pvesm add … --content &lt;csv&gt;</code>:",
-    "headerPreset": "Preset",
+    "heading": "Preajustes de tipos de contenido",
+    "intro": "ProxMenux ofrece tres preajustes y una opción personalizada. La cadena de contenido elegida se pasa a <code>pvesm add … --content &lt;csv&gt;</code>:",
+    "headerPreset": "Preajuste",
     "headerContent": "Cadena de contenido",
     "headerUse": "Caso de uso",
     "rows": [
       {
-        "preset": "VM Storage",
+        "preset": "Almacenamiento VM",
         "content": "images,backup",
         "use": "Un almacén de discos de VM dedicado que también guarda backups de esas VMs cerca."
       },
       {
-        "preset": "Standard NAS",
+        "preset": "NAS estándar",
         "content": "backup,iso,vztmpl",
         "use": "Un disco de archivo / media — backups, ISOs y templates LXC. Sin discos de VM en vivo aquí."
       },
       {
-        "preset": "All types",
+        "preset": "Todos los tipos",
         "content": "images,backup,iso,vztmpl,snippets",
-        "use": "\"Que decida el host\" — permite todos los content types que Proxmox soporta en este almacenamiento."
+        "use": "Este preajuste amplio habilita imágenes, backups, ISO, plantillas LXC y snippets. Si necesitas otros tipos compatibles, como rootdir, añádelos mediante Personalizado."
       },
       {
-        "preset": "Custom",
+        "preset": "Personalizado",
         "content": "(entrada libre)",
         "useRich": "Escribe el CSV exacto tú mismo, p. ej. <code>images</code> solo, o <code>rootdir,images</code>."
       }
     ],
     "zfsTitle": "El contenido del ZFS pool es más limitado",
-    "zfsBody": "Si elegiste <strong>zfs</strong> como sistema de archivos, Proxmox solo acepta <code>images</code> y <code>rootdir</code> como content types en un <code>zfspool</code> (es almacenamiento de bloque, no un sistema de archivos para ISOs). Los presets de arriba siguen funcionando pero Proxmox descarta silenciosamente los content types que no puede usar — comprueba <code>pvesm status</code> después."
+    "zfsBody": "Si elegiste <strong>zfs</strong>, un <code>zfspool</code> solo admite <code>images</code> y <code>rootdir</code>, no archivos ISO ni backups. Usa Personalizado para introducir una lista compatible. El script la pasa sin modificar; los tipos no compatibles pueden hacer fallar el registro. Comprueba <code>pvesm status</code> después."
   },
   "manual": {
     "heading": "Equivalente manual",
@@ -147,7 +147,7 @@
   },
   "troubleshoot": {
     "heading": "Solución de problemas",
-    "noDisksTitle": "\"No available disks found\"",
+    "noDisksTitle": "\"No se encontraron discos disponibles\"",
     "noDisksIntro": "El filtro de seguridad ocultó cada disco. Razones comunes:",
     "noDisksItems": [
       "Solo está presente el disco raíz.",
@@ -168,7 +168,7 @@
     "items": [
       {
         "href": "/docs/disk-manager/format-disk",
-        "label": "Disk Manager: Format / Wipe Physical Disk",
+        "label": "Gestor de discos: Formatear / Borrar disco físico",
         "tail": " — alternativa de bajo nivel cuando solo quieres preparar un disco sin registrarlo como almacenamiento de Proxmox."
       },
       {
diff --git a/web/messages/es/docs/storage-share/host-local-shared.json b/web/messages/es/docs/storage-share/host-local-shared.json
index 44c2ad81..f9b1a24a 100644
--- a/web/messages/es/docs/storage-share/host-local-shared.json
+++ b/web/messages/es/docs/storage-share/host-local-shared.json
@@ -36,9 +36,9 @@
     "headerWhy": "Por qué importa aquí",
     "rows": [
       {
-        "bit": "1 (sticky)",
-        "effect": "Solo el propietario del archivo puede borrar / renombrar un archivo.",
-        "why": "Evita que el CT-A borre archivos creados por el CT-B en el mismo directorio."
+        "bit": "1 (sticky bit)",
+        "effect": "Solo pueden borrar o renombrar un archivo su propietario, el propietario del directorio o un proceso con privilegios suficientes.",
+        "why": "Ayuda a impedir que usuarios con UID mapeados diferentes borren archivos ajenos. No aísla CT que comparten un UID mapeado o acceso root privilegiado."
       },
       {
         "bit": "777 (rwx-rwx-rwx)",
@@ -46,9 +46,9 @@
         "why": "Los UIDs de CT unprivileged (100000+) aparecen como \"others\" desde el host, así que world-rwx les da acceso."
       },
       {
-        "bit": "ACLs (default)",
+        "bit": "ACL (predeterminadas)",
         "effect": "Heredado en cada archivo / subdir recién creado.",
-        "why": "Los permisos se aplican para siempre — el contenido nuevo conserva el perfil abierto sin reejecutar el script."
+        "why": "El contenido nuevo hereda las ACL predeterminadas sin volver a ejecutar el script. Las aplicaciones pueden solicitar modos restrictivos o cambiar los permisos después."
       }
     ],
     "privTitle": "Los CTs privileged ven lo mismo, solo que sin el desplazamiento",
@@ -90,7 +90,7 @@
     "items": [
       {
         "href": "/docs/storage-share/lxc-mount-points",
-        "label": "LXC Mount Manager",
+        "label": "Gestor de montajes LXC",
         "tail": " — el siguiente paso natural: hacer bind mount de este directorio en uno o más contenedores."
       },
       {
diff --git a/web/messages/es/docs/storage-share/host-nfs.json b/web/messages/es/docs/storage-share/host-nfs.json
index 836386ed..743e712c 100644
--- a/web/messages/es/docs/storage-share/host-nfs.json
+++ b/web/messages/es/docs/storage-share/host-nfs.json
@@ -1,8 +1,8 @@
 {
   "meta": {
-    "title": "Host: montar share NFS en el host | ProxMenux Documentation",
+    "title": "Host: montar recurso NFS en el host | Documentación de ProxMenux",
     "description": "Monta un export NFS externo en el host Proxmox — bien como almacenamiento de Proxmox (pvesm add nfs), bien como un montaje fstab del host normal (NO visible en Datacenter > Storage), o ambos. El método fstab es ideal para hacer bind mount del share en contenedores LXC sin exponerlo como almacenamiento de Proxmox.",
-    "ogTitle": "Host: montar share NFS en el host | ProxMenux Documentation",
+    "ogTitle": "Host: montar recurso NFS en el host | Documentación de ProxMenux",
     "ogDescription": "Monta un export NFS externo en el host Proxmox vía pvesm, fstab o ambos. La ruta fstab es ideal para bind mounts LXC."
   },
   "header": {
@@ -17,7 +17,7 @@
   "opening": {
     "heading": "Abrir la herramienta",
     "body": "Desde el menú principal de ProxMenux, abre <strong>Storage &amp; Share Manager → Mount NFS Share on Host</strong>. Verás este submenú con cuatro opciones:",
-    "imageAlt": "Menú NFS Host Manager — Mount / View / Remove / Test connectivity"
+    "imageAlt": "Menú NFS del host — Montar / Ver / Eliminar / Probar conectividad"
   },
   "howRuns": {
     "heading": "Cómo se ejecuta el script",
@@ -46,13 +46,13 @@
       },
       {
         "method": "<strong>Ambos</strong>",
-        "mount": "Ambas rutas de arriba (dos conexiones NFS independientes al servidor)",
+        "mount": "Ambas rutas anteriores (dos puntos de montaje del mismo export NFS)",
         "ui": "Sí",
-        "useCase": "Quieres integración con la UI Y una ruta estable del lado del host con permisos abiertos para bind mounts LXC. El servidor ve dos conexiones desde el host."
+        "useCase": "Integración con la interfaz y una ruta estable separada en el host con permisos abiertos para bind mounts LXC."
       }
     ],
     "bothTitle": "\"Ambos\" crea dos montajes NFS independientes",
-    "bothBody": "Marcar ambas opciones ejecuta cada método independientemente — pvesm monta en <code>/mnt/pve/&lt;id&gt;</code>, fstab monta en <code>/mnt/&lt;path&gt;</code>. El servidor ve dos conexiones TCP desde el host Proxmox. Esto es intencional: te permite mantener el almacenamiento pvesm limpio (opciones por defecto de Proxmox) mientras tienes un montaje separado del lado del host con permisos abiertos para bind mounts LXC."
+    "bothBody": "Los dos métodos se ejecutan por separado: pvesm monta en <code>/mnt/pve/&lt;id&gt;</code> y fstab en <code>/mnt/&lt;path&gt;</code>. Así tienes un montaje gestionado por Proxmox con opciones predeterminadas y otro en el host para bind mounts LXC. Dos puntos de montaje no garantizan dos conexiones TCP: el cliente NFS puede reutilizarlas."
   },
   "pvesmBranch": {
     "heading": "Método A — Como almacenamiento de Proxmox (pvesm)",
@@ -61,7 +61,7 @@
       "<strong>Storage ID</strong> — cómo llamará Proxmox a este almacenamiento. Por defecto es <code>nfs-&lt;server-ip-with-dashes&gt;</code>. Solo se aceptan letras, dígitos, <code>-</code> y <code>_</code>.",
       "<strong>Content types</strong> — Proxmox vincula categorías de contenido a volúmenes de almacenamiento; elige qué se le permite a este NFS contener:"
     ],
-    "headerType": "Content type",
+    "headerType": "Tipo de contenido",
     "headerAllows": "Qué permite",
     "rows": [
       {
@@ -94,7 +94,7 @@
       }
     ],
     "warnTitle": "images y rootdir en NFS",
-    "warnBody": "Marcar <code>images</code> en un almacenamiento NFS deja a Proxmox colocar discos de VM en vivo ahí. Funciona, pero la latencia de NFS + su semántica de locks lo hacen notablemente más lento que el almacenamiento local (y un corte de red pausa cada VM respaldada por ese almacén). Marcar <code>rootdir</code> significa que alojarás sistemas de archivos raíz de LXC sobre NFS, lo que históricamente da problemas con contenedores unprivileged (interacciones overlay / chown). Es preferible mantener <code>images</code> / <code>rootdir</code> en almacenamiento local o iSCSI y usar NFS para <code>backup</code> / <code>iso</code> / <code>vztmpl</code>.",
+    "warnBody": "Seleccionar <code>images</code> permite guardar discos de VM en NFS. El rendimiento depende de la red, el servidor y la carga; una caída puede bloquear la E/S que dependa del montaje. Seleccionar <code>rootdir</code> guarda sistemas de archivos raíz LXC en NFS, donde los contenedores sin privilegios pueden encontrar limitaciones de mapeo de UID, overlay y propiedad. Evalúa estos requisitos antes de colocar <code>images</code> / <code>rootdir</code> ahí; NFS también sirve para <code>backup</code> / <code>iso</code> / <code>vztmpl</code>.",
     "result": "El resultado es <code>pvesm add nfs &lt;id&gt; --server &lt;srv&gt; --export &lt;path&gt; --content &lt;csv&gt;</code> y Proxmox automonta en <code>/mnt/pve/&lt;id&gt;</code>."
   },
   "fstabBranch": {
@@ -102,7 +102,7 @@
     "intro": "Si <em>Solo como montaje fstab del host</em> está marcado, ProxMenux pide una ruta de montaje del host y opciones persistentes, luego monta y escribe la entrada en <code>/etc/fstab</code>:",
     "items": [
       "<strong>Ruta de montaje del host</strong> — por defecto <code>/mnt/&lt;export-basename&gt;</code>. Debe ser una ruta absoluta. Si algo ya está montado ahí, o existe una entrada fstab para la misma ruta, ProxMenux te avisa y ofrece reemplazarla.",
-      "<strong>Mount options</strong> — elige <em>Read/Write</em> (por defecto con <code>rw,hard,nofail,_netdev,rsize=131072,wsize=131072,timeo=600,retrans=2</code>), <em>Read-only</em>, o <em>Custom</em> (escribe tu propia cadena de opciones)."
+      "<strong>Opciones de montaje</strong> — <em>Lectura/escritura</em> (predeterminado: <code>rw,hard,nofail,_netdev,rsize=131072,wsize=131072,timeo=600,retrans=2</code>), <em>Solo lectura</em>, <em>Personalizado</em> (escribe tus propias opciones)."
     ],
     "appliesIntro": "Una vez confirmes, el script:",
     "applies": [
@@ -113,7 +113,7 @@
       "Intenta <code>chmod 1777</code> + <code>setfacl o::rwx</code> en el punto de montaje (best-effort silencioso — solo tiene éxito si el servidor NFS lo permite; muchos exports NAS ya sirven rutas world-writable)."
     ],
     "lxcTitle": "Usar el montaje fstab desde un LXC",
-    "lxcBody": "El script imprime el comando <code>pct set</code> exacto al final para hacer bind mount de la ruta en un contenedor, p. ej. <code>pct set &lt;ctid&gt; -mp0 /mnt/&lt;path&gt;,mp=/mnt/&lt;ct-path&gt;,shared=1,backup=0</code>. O usa el <mountLink>LXC Mount Manager</mountLink>, que detecta el montaje fstab automáticamente. <strong>No se hacen cambios dentro del contenedor</strong> — para que los LXCs unprivileged lean/escriban los datos NFS, el script depende de la semántica world-writable del export del lado del servidor (típica en defaults de Synology, TrueNAS, OMV). Si tu servidor NFS aplica squash a root o restringe permisos, mira Solución de problemas.",
+    "lxcBody": "El script muestra un comando <code>pct set</code> para un bind mount, p. ej. <code>pct set &lt;ctid&gt; -mp0 /mnt/&lt;path&gt;,mp=/mnt/&lt;ct-path&gt;,shared=1,backup=0</code>. También puedes usar <mountLink>LXC Mount Manager</mountLink>, que detecta los montajes fstab. <strong>No se cambia nada dentro del contenedor</strong>. El acceso desde un CT sin privilegios depende de los permisos del servidor para sus UID/GID mapeados. El script solo intenta ajustar permisos desde el host; no garantiza exports escribibles ni ajustes predeterminados de fabricantes. Si falla, consulta Solución de problemas.",
     "noUiTitle": "El montaje fstab NO es un almacenamiento de Proxmox",
     "noUiBody": "El montaje fstab del host es invisible para la UI web de Proxmox — por diseño. No aparece en <em>Datacenter > Storage</em>, no puedes seleccionarlo en el creador de VM / CT, y los trabajos de backup de Proxmox no pueden apuntarlo. Es puramente una ruta del sistema de archivos del host. Si quieres también integración con la UI, marca <em>ambos</em> métodos en el selector."
   },
@@ -138,16 +138,16 @@
   },
   "troubleshoot": {
     "heading": "Solución de problemas",
-    "noServersTitle": "\"No NFS servers found on the network\"",
+    "noServersTitle": "\"No se encontraron servidores NFS en la red\"",
     "noServersBody": "El auto-descubrimiento usa <code>nmap -p 2049 --open &lt;subnet&gt;/24</code>. El servidor puede no responder si: está en una VLAN / subnet diferente, su firewall bloquea las sondas nmap (muchos lo hacen) o el puerto 2049 está intencionalmente cerrado en esa interfaz. Usa la opción <em>Manual</em> con la IP o hostname del servidor en su lugar.",
-    "portTitle": "\"NFS port (2049) is not accessible\"",
+    "portTitle": "«No se puede acceder al puerto NFS (2049)»",
     "portBody": "El ping tuvo éxito pero <code>nc -z -w 3 &lt;server&gt; 2049</code> falló. Comprueba que el servicio NFS está corriendo en el servidor (<code>systemctl status nfs-server</code> en Linux, Panel de Control → File Services en Synology, plugin NFS en OMV / TrueNAS) y que el firewall permite el 2049 desde el host Proxmox.",
     "showmountTitle": "\"Failed to connect\" desde showmount",
     "showmountBody": "El servidor rechazó la consulta de la lista de exports. Causas comunes: el servidor aplica ACLs de cliente estrictas (tu IP de Proxmox no está en la lista permitida), <code>rpcbind</code> no está corriendo en el servidor o el servidor expone solo NFSv4 con <code>showmount</code> deshabilitado. La ruta del export se puede añadir manualmente igualmente si la conoces.",
     "inactiveTitle": "El almacenamiento aparece como inactive en la UI de Proxmox",
-    "inactiveBody": "Ejecuta <em>Test NFS Connectivity</em> primero — el 99 % de las veces esto marca el salto exacto que se rompe (DNS, puerto, permisos de montaje). Si la conectividad va bien pero Proxmox sigue marcando inactive, comprueba <code>journalctl -u pvestatd</code> en el nodo Proxmox; DNS intermitente o montajes NFS lentos al arrancar pueden dejar almacenamientos en estado inactive hasta que <code>pvesm set &lt;id&gt; --disable 0</code> se reaplica.",
+    "inactiveBody": "Ejecuta primero <em>Probar la conectividad NFS</em>: comprueba que el servidor responde al ping, que el puerto 2049 está abierto y que la lista de exports (<code>showmount -e</code>) está disponible. Si la conectividad funciona pero sigue inactivo, consulta <code>journalctl -u pvestatd</code> y la configuración del servidor/export. Corrige primero la conectividad o los permisos. <code>pvesm set &lt;id&gt; --disable 0</code> habilita un almacenamiento deshabilitado; no repara fallos NFS en general.",
     "lxcNoWriteTitle": "El montaje fstab funciona pero un LXC unprivileged no puede escribir por un bind mount",
-    "lxcNoWriteBody": "Los permisos NFS se aplican del lado del servidor, no del host. Las opciones fstab (<code>uid=</code>, <code>file_mode=</code>) que funcionan para CIFS <strong>no</strong> se aplican a NFS. Si tu LXC unprivileged (root dentro del CT = UID 100000 en el host, mapeado a NFS como \"others\") no puede escribir, el servidor NFS o bien aplica squash a root o bien tiene permisos restrictivos. Arregla en el servidor: cambia el export a <code>no_root_squash</code> si confías en el host, o pon el export world-writable (Synology, TrueNAS, OMV exponen esto en su UI). El script intenta <code>chmod 1777</code> en el montaje pero eso solo tiene éxito cuando el servidor lo permite.",
+    "lxcNoWriteBody": "El acceso NFS depende de propiedad, ACL y squash en el servidor. Las opciones CIFS como <code>uid=</code> y <code>file_mode=</code> <strong>no</strong> se aplican a NFS. Con el mapeo LXC predeterminado, root del CT se convierte en UID 100000 del host, no en UID remoto 0. Da acceso al UID/GID mapeado real o a la identidad anónima del servidor. <code>no_root_squash</code> solo afecta al UID remoto 0, por lo que no resuelve todos los casos de UID 100000. El script intenta <code>chmod 1777</code>, pero no anula permisos del servidor.",
     "fstabBootTitle": "El montaje fstab no se levanta tras el reinicio",
     "fstabBootBody": "El script añade <code>nofail,_netdev</code> para que un share que falte al arranque no bloquee el inicio. Si el montaje nunca se levanta: confirma que la red es alcanzable (<code>ping &lt;server&gt;</code>), comprueba <code>journalctl -u remote-fs.target</code> y verifica que la entrada es válida con <code>mount -fav | grep nfs</code>. <code>mount -a</code> después del arranque monta todo lo que falte actualmente."
   },
@@ -161,7 +161,7 @@
       },
       {
         "href": "/docs/storage-share/lxc-mount-points",
-        "label": "LXC Mount Manager",
+        "label": "Gestor de montajes LXC",
         "tailRich": " — hacer bind mount de la ruta solo en fstab <code>/mnt/&lt;path&gt;</code> en uno o más contenedores."
       },
       {
diff --git a/web/messages/es/docs/storage-share/host-samba.json b/web/messages/es/docs/storage-share/host-samba.json
index 7e633879..25e45b47 100644
--- a/web/messages/es/docs/storage-share/host-samba.json
+++ b/web/messages/es/docs/storage-share/host-samba.json
@@ -1,8 +1,8 @@
 {
   "meta": {
-    "title": "Host: montar share Samba en el host | ProxMenux Documentation",
+    "title": "Host: montar recurso Samba en el host | Documentación de ProxMenux",
     "description": "Monta un share Samba / CIFS externo en el host Proxmox — bien como almacenamiento de Proxmox (pvesm add cifs), bien como un montaje fstab del host normal con uid/gid/file_mode abiertos (NO visible en Datacenter > Storage), o ambos. El método fstab abre los permisos para que un LXC unprivileged que haga bind mount de la ruta pueda leer/escribir sin cambios dentro del contenedor.",
-    "ogTitle": "Host: montar share Samba en el host | ProxMenux Documentation",
+    "ogTitle": "Host: montar recurso Samba en el host | Documentación de ProxMenux",
     "ogDescription": "Monta un share Samba / CIFS externo en el host Proxmox vía pvesm, fstab con permisos abiertos (ideal para bind mounts LXC), o ambos."
   },
   "header": {
@@ -12,12 +12,12 @@
   },
   "intro": {
     "title": "Qué hace",
-    "body": "ProxMenux ofrece dos métodos de montaje para cualquier share Samba: <strong>(1) Almacenamiento de Proxmox</strong> vía <code>pvesm add cifs</code> — visible en Datacenter > Storage, montado en <code>/mnt/pve/&lt;id&gt;</code>, credenciales guardadas cifradas en <code>/etc/pve/priv/storage/&lt;id&gt;.pw</code>; <strong>(2) Montaje fstab del host</strong> en una ruta que tú elijas — persistente vía <code>/etc/fstab</code>, montado con <code>uid=0,gid=0,file_mode=0777,dir_mode=0777</code> para que los bind mounts LXC unprivileged puedan escribir, credenciales guardadas en un archivo solo para root en <code>/etc/samba/credentials/</code> (la contraseña nunca aparece en <code>fstab</code>). Puedes ejecutar un método, el otro o ambos."
+    "body": "ProxMenux ofrece dos métodos para montar un recurso Samba: <strong>(1) Almacenamiento de Proxmox</strong> mediante <code>pvesm add cifs</code>, visible en Datacenter > Storage y montado en <code>/mnt/pve/&lt;id&gt;</code>. La contraseña se guarda en texto claro en <code>/etc/pve/priv/storage/&lt;id&gt;.pw</code>, protegida por el directorio privado accesible solo por root: es control de acceso, no cifrado. <strong>(2) Montaje fstab del host</strong> en una ruta elegida, persistente mediante <code>/etc/fstab</code> y montada con <code>uid=0,gid=0,file_mode=0777,dir_mode=0777</code> para permitir la escritura desde bind mounts de LXC sin privilegios. Sus credenciales se guardan en un archivo accesible solo por root dentro de <code>/etc/samba/credentials/</code>, nunca directamente en <code>fstab</code>. Puedes utilizar cualquiera de los métodos o ambos."
   },
   "opening": {
     "heading": "Abrir la herramienta",
     "body": "Desde el menú principal de ProxMenux, abre <strong>Storage &amp; Share Manager → Mount Samba Share on Host</strong>. Verás este submenú con cuatro opciones:",
-    "imageAlt": "Menú Samba Host Manager — Mount / View / Remove / Test connectivity"
+    "imageAlt": "Menú Samba del host — Montar / Ver / Eliminar / Probar conectividad"
   },
   "howRuns": {
     "heading": "Cómo se ejecuta el script",
@@ -41,26 +41,26 @@
         "method": "<strong>Solo fstab del host</strong>",
         "mountRich": "<code>/mnt/&lt;path&gt;</code> con uid/gid/file_mode abiertos",
         "ui": "No",
-        "useCaseRich": "Hacer bind mount del share en uno o más LXCs <em>sin</em> exponerlo como almacenamiento de Proxmox. Los permisos abiertos garantizan que los CTs unprivileged puedan escribir a través del bind mount."
+        "useCaseRich": "Haz bind mount del recurso en uno o más LXC <em>sin</em> registrarlo como almacenamiento Proxmox. Los permisos locales abiertos facilitan el acceso desde CT sin privilegios, pero escribir sigue requiriendo permiso del servidor SMB para el usuario autenticado."
       },
       {
         "method": "<strong>Ambos</strong>",
-        "mount": "Ambas rutas de arriba (dos conexiones CIFS independientes al servidor)",
+        "mount": "Ambas rutas anteriores (dos puntos de montaje del mismo export CIFS)",
         "ui": "Sí",
         "useCase": "Quieres integración con la UI Y una ruta estable del lado del host con permisos abiertos para bind mounts LXC. El montaje pvesm usa los valores por defecto de Proxmox; el montaje fstab aplica el uid/gid/file_mode abierto por separado."
       }
     ],
-    "bothTitle": "\"Ambos\" crea dos conexiones CIFS independientes",
-    "bothBody": "pvesm y fstab montan el mismo share dos veces con opciones distintas. El montaje pvesm en <code>/mnt/pve/&lt;id&gt;</code> usa los valores por defecto de Proxmox (sin uid/gid abiertos) — la UI de Proxmox está contenta. El montaje fstab en <code>/mnt/&lt;path&gt;</code> usa <code>uid=0,gid=0,file_mode=0777,dir_mode=0777</code> — los bind mounts LXC unprivileged a él pueden escribir. Dos conexiones TCP al servidor SMB desde el mismo host Proxmox."
+    "bothTitle": "«Ambos» crea dos puntos de montaje CIFS",
+    "bothBody": "pvesm monta en <code>/mnt/pve/&lt;id&gt;</code> con las opciones de Proxmox. fstab monta en <code>/mnt/&lt;path&gt;</code> con <code>uid=0,gid=0,file_mode=0777,dir_mode=0777</code> para permitir acceso local mediante bind mounts LXC. El servidor SMB sigue aplicando los permisos del usuario del montaje. Son dos puntos de montaje; no garantizan dos conexiones TCP separadas."
   },
   "pvesmBranch": {
     "heading": "Método A — Como almacenamiento de Proxmox (pvesm)",
     "intro": "Si <em>Como almacenamiento de Proxmox</em> está marcado, ProxMenux ejecuta el flujo pvesm original:",
     "items": [
       "<strong>Storage ID</strong> — por defecto <code>cifs-&lt;server-ip-with-dashes&gt;</code>. Solo letras, dígitos, <code>-</code> y <code>_</code>.",
-      "<strong>Content types</strong> — CIFS expone <strong>6</strong> opciones (las mismas que NFS menos <code>rootdir</code>, que Proxmox no permite en CIFS porque la semántica de locking no puede sostener un rootfs LXC en vivo):"
+      "<strong>Tipos de contenido</strong> — este selector de ProxMenux ofrece <strong>6</strong> opciones. Omite <code>rootdir</code> respecto al selector NFS; es una decisión del script, no significa que todas las versiones del backend CIFS de Proxmox prohíban sistemas de archivos raíz LXC:"
     ],
-    "headerType": "Content type",
+    "headerType": "Tipo de contenido",
     "headerAllows": "Qué permite",
     "rows": [
       {
@@ -89,16 +89,16 @@
       }
     ],
     "warnTitle": "Discos de VM en vivo en CIFS",
-    "warnBody": "Si marcas <code>images</code>, ProxMenux saca un aviso antes de continuar. CIFS usa un modelo de locking advisory que interactúa mal con las operaciones de disco de KVM (snapshots, migración en vivo, I/O bajo contención). Un almacén de backups o ISOs en CIFS es perfectamente correcto; un almacén de discos en vivo es buscarse problemas. Usa NFS (o almacenamiento local) para <code>images</code> cuando puedas.",
+    "warnBody": "Seleccionar <code>images</code> muestra un aviso: CIFS/SMB puede causar problemas de bloqueo en operaciones con discos de VM. El script recomienda NFS para imágenes de VM, pero permite continuar. Backups e ISO son usos habituales de CIFS. Evalúa bloqueos, instantáneas, migración y carga antes de usar CIFS para <code>images</code>.",
     "credsTitle": "Dónde guarda pvesm las credenciales",
-    "credsBody": "Cuando usas autenticación de usuario, la contraseña NO se escribe en <code>/etc/pve/storage.cfg</code>. Proxmox la guarda en <code>/etc/pve/priv/storage/&lt;storage-id&gt;.pw</code> — modo <code>0600</code>, propietario <code>root</code>, miembro del cluster sync. Si más adelante cambias la contraseña en el servidor Samba, usa <code>pvesm set &lt;id&gt; --password &lt;new&gt;</code> o elimina y vuelve a añadir a través de ProxMenux."
+    "credsBody": "La contraseña no se escribe en <code>/etc/pve/storage.cfg</code>. Proxmox guarda credenciales en texto plano en <code>/etc/pve/priv/storage/&lt;storage-id&gt;.pw</code>, dentro del área privada del sistema de archivos del clúster, que solo puede leer <code>root</code> (modo <code>0600</code>); están protegidas por permisos, no por cifrado. Tras cambiar la contraseña en el servidor, usa <code>pvesm set &lt;id&gt; --password &lt;new&gt;</code> o elimina y vuelve a añadir desde ProxMenux."
   },
   "fstabBranch": {
     "heading": "Método B — Solo montaje fstab del host",
     "intro": "Si <em>Solo como montaje fstab del host</em> está marcado, ProxMenux pide una ruta de montaje del host y opciones persistentes, escribe un archivo de credenciales solo para root (modo User), luego monta y escribe la entrada en <code>/etc/fstab</code>:",
     "items": [
       "<strong>Ruta de montaje del host</strong> — por defecto <code>/mnt/&lt;share-name&gt;</code>. Debe ser una ruta absoluta. Si algo ya está montado ahí, o existe una entrada fstab, ProxMenux ofrece reemplazarla.",
-      "<strong>Mount options</strong> — elige <em>Read/Write</em> (por defecto con <code>rw,uid=0,gid=0,file_mode=0777,dir_mode=0777,iocharset=utf8,nofail,_netdev</code>), <em>Read-only</em> (variante de solo lectura con <code>file_mode=0555,dir_mode=0555</code>), o <em>Custom</em> (escribe tu propia cadena de opciones). El uid/gid/file_mode abiertos siempre se recomiendan para escrituras a través de bind mount LXC."
+      "<strong>Opciones de montaje</strong> — <em>Lectura/escritura</em> (predeterminado: <code>rw,uid=0,gid=0,file_mode=0777,dir_mode=0777,iocharset=utf8,nofail,_netdev</code>), <em>Solo lectura</em> (<code>file_mode=0555,dir_mode=0555</code>), <em>Personalizado</em> (escribe tus opciones). El script recomienda uid/gid/file_mode abiertos para escrituras mediante bind mounts LXC."
     ],
     "credsTitle": "Archivo de credenciales (modo User)",
     "credsBody": "Si te autenticaste con usuario + contraseña, ProxMenux escribe un archivo de credenciales solo para root en <code>/etc/samba/credentials/&lt;server&gt;_&lt;share&gt;.cred</code> (modo <code>0600</code>) con líneas <code>username=</code> y <code>password=</code>, y lo referencia en la entrada fstab vía la opción de montaje <code>credentials=</code>. El texto en claro nunca aterriza en <code>/etc/fstab</code>. Para el modo Guest, en su lugar se añade la opción <code>guest</code> y no se crea archivo de credenciales.",
@@ -110,9 +110,9 @@
       "Ejecuta <code>systemctl daemon-reload</code> para que systemd recoja la nueva entrada fstab."
     ],
     "lxcTitle": "Usar el montaje fstab desde un LXC unprivileged",
-    "lxcBody": "Como el cliente CIFS aplica <code>uid=0,gid=0,file_mode=0777,dir_mode=0777</code>, cada archivo en el montaje pertenece al UID 0 del host con modo 0777. Un LXC unprivileged que haga bind mount de la ruta ve permisos \"others\" en cada entrada (root del CT = UID 100000 del host = others en el sistema de archivos del host), así que las lecturas y escrituras tienen éxito. <strong>No se hacen cambios dentro del contenedor</strong> — sin <code>chown</code> en el CT, sin configuración de grupo, nada modificado en <code>/etc/lxc</code> más allá de la única línea <code>mp</code> de bind mount. El script imprime el comando <code>pct set</code> exacto al final, o usa el <mountLink>LXC Mount Manager</mountLink> para adjuntar la ruta.",
+    "lxcBody": "Las opciones CIFS <code>uid=0,gid=0,file_mode=0777,dir_mode=0777</code> abren las comprobaciones locales de permisos para bind mounts LXC. Las ACL del servidor y la semántica Unix/POSIX negociada aún pueden afectar al acceso. <strong>No se cambia nada dentro del contenedor</strong>: ni <code>chown</code> en el CT, ni grupos, ni ediciones de <code>/etc/lxc</code>. La línea <code>mp</code> se gestiona en la configuración Proxmox del CT. Usa el comando <code>pct set</code> mostrado o <mountLink>LXC Mount Manager</mountLink>.",
     "noUiTitle": "El montaje fstab NO es un almacenamiento de Proxmox",
-    "noUiBody": "El montaje fstab del host es invisible para la UI web de Proxmox — por diseño. No aparece en <em>Datacenter > Storage</em>, no puedes seleccionarlo en el creador de VM / CT y los trabajos de backup de Proxmox no pueden apuntarlo. Es puramente una ruta del sistema de archivos del host. Si quieres también integración con la UI, marca <em>ambos</em> métodos en el selector."
+    "noUiBody": "El montaje fstab del host es invisible para la UI web de Proxmox — por diseño. No aparece en <em>Datacenter > Storage</em>, no puedes seleccionarlo en el creador de VM / CT, y los trabajos de backup de Proxmox no pueden apuntarlo. Es puramente una ruta del sistema de archivos del host. Si quieres también integración con la UI, marca <em>ambos</em> métodos en el selector."
   },
   "manual": {
     "heading": "Equivalente manual",
@@ -121,12 +121,12 @@
     "fstabGuestIntro": "Método B (fstab, auth guest) — sin archivo de credenciales:"
   },
   "view": {
-    "heading": "Ver almacenamientos CIFS configurados",
-    "body": "Lista cada entrada CIFS en Proxmox (<code>pvesm status | awk ''$2 == \"cifs\"''</code>) con servidor, share, content types, usuario (o <em>Guest</em>), ruta de montaje y estado en vivo. La contraseña <strong>nunca se imprime</strong>. <strong>Nota:</strong> esta vista solo muestra almacenamientos registrados con pvesm — los montajes solo en fstab no se listan. Compruébalos con <code>findmnt -t cifs</code> o <code>grep cifs /etc/fstab</code>."
+    "heading": "Ver almacenamientos CIFS y montajes del host",
+    "body": "Muestra almacenamientos CIFS registrados (<code>pvesm status | awk ''$2 == \"cifs\"''</code>) con servidor, recurso, contenido, usuario o <em>Invitado</em>, ruta y estado. Las contraseñas <strong>nunca se muestran</strong>. <strong>Nota:</strong> otra sección lista montajes fstab del host, sus opciones, ruta del archivo de credenciales y estado activo/inactivo. Para comprobarlo manualmente usa <code>findmnt -t cifs</code> o <code>grep cifs /etc/fstab</code>."
   },
   "remove": {
-    "heading": "Eliminar almacenamiento CIFS",
-    "body": "Ejecuta <code>pvesm remove &lt;storage-id&gt;</code> tras una confirmación que muestra servidor / share / contenido. Solo se elimina el registro del lado de Proxmox — <strong>el servidor Samba remoto no se toca</strong>. Proxmox también borra el archivo de credenciales emparejado. Para eliminar un montaje solo en fstab, edita <code>/etc/fstab</code> a mano, ejecuta <code>umount &lt;path&gt;</code> y elimina el archivo de <code>/etc/samba/credentials/</code>.",
+    "heading": "Eliminar almacenamiento CIFS o montaje del host",
+    "body": "El selector ofrece almacenamientos pvesm y montajes fstab del host. Para pvesm ejecuta <code>pvesm remove &lt;storage-id&gt;</code> y Proxmox borra las credenciales asociadas. Para fstab intenta <code>umount &lt;path&gt;</code>, elimina la entrada de <code>/etc/fstab</code> y las credenciales de <code>/etc/samba/credentials/</code>, y elimina el directorio de montaje si está vacío. Si falla el desmontaje, debes hacerlo manualmente o reiniciar. <strong>No modifica el servidor Samba remoto ni sus archivos</strong>.",
     "warnTitle": "Haz backup de las dependencias primero",
     "warnBody": "Las VMs, CTs o trabajos de backup que referencien este almacenamiento por ID fallarán tras la eliminación. Mueve / elimina esas referencias antes de eliminar el almacenamiento."
   },
@@ -136,16 +136,16 @@
   },
   "troubleshoot": {
     "heading": "Solución de problemas",
-    "noServersTitle": "\"No Samba servers found on the network\"",
+    "noServersTitle": "\"No se encontraron servidores Samba en la red\"",
     "noServersBody": "El auto-descubrimiento usa <code>nmap -p 139,445</code>. El servidor puede estar en una subnet diferente, con firewall o solo alcanzable por hostname (mDNS / WINS). Usa la opción <em>Manual</em> con la IP o hostname en su lugar.",
-    "noSharesTitle": "\"No accessible shares found\"",
+    "noSharesTitle": "«No se encontraron recursos compartidos accesibles»",
     "noSharesBody": "<code>smbclient -L</code> no devolvió nada para estas credenciales. Causas: el usuario no tiene permiso para listar shares (prueba con credenciales de admin una vez, o escribe el nombre del share manualmente), el servidor tiene la visibilidad de shares deshabilitada o las credenciales son incorrectas. El script te permite escribir el nombre del share a mano en este caso.",
     "denyTitle": "El montaje de Proxmox falla con NT_STATUS_ACCESS_DENIED",
     "denyBody": "Las credenciales que pvesm guardó están desincronizadas con el servidor Samba (contraseña cambiada, cuenta deshabilitada, mismatch de domain / workgroup). Vuelve a introducir credenciales con <code>pvesm set &lt;id&gt; --username &lt;u&gt; --password &lt;p&gt;</code> o elimina y vuelve a añadir desde ProxMenux. Si el servidor está en un dominio AD, añade <code>--domain &lt;DOMAIN&gt;</code> a la llamada <code>pvesm set</code>.",
     "sleepTitle": "\"host is down\" o el estado del almacenamiento pasa a inactive por la noche",
     "sleepBody": "Algunos appliances NAS ponen SMB en suspensión agresivamente. <code>pvestatd</code> entonces ve el almacenamiento como inactive hasta que el primer acceso despierta al NAS. Si es cosmético, no hay nada roto. Si causa fallos de backup, deshabilita la desconexión por idle de SMB en el NAS o programa los backups fuera de la ventana de suspensión.",
     "lxcNoWriteTitle": "El bind mount LXC unprivileged no puede escribir en la ruta fstab",
-    "lxcNoWriteBody": "Confirma que el montaje usa las opciones abiertas: <code>findmnt /mnt/&lt;path&gt;</code> debería mostrar <code>uid=0,gid=0,file_mode=0777,dir_mode=0777</code>. Si una cadena de opciones Custom omite esas, un LXC unprivileged tendrá permission denied (los UIDs del CT mapean a \"others\" del host, que sin file_mode abierto no tienen bit de escritura). Vuelve a montar con el preset RW por defecto o añade las cuatro opciones de vuelta a tu cadena custom.",
+    "lxcNoWriteBody": "Comprueba en <code>findmnt /mnt/&lt;path&gt;</code> las opciones previstas, como <code>uid=0,gid=0,file_mode=0777,dir_mode=0777</code>. La falta de permisos locales de escritura puede bloquear los UID mapeados de LXC. Reaplica el perfil RW o ajusta las opciones personalizadas. Verifica también que el usuario SMB pueda escribir en el servidor y si las extensiones Unix/POSIX proporcionan sus modos; los modos locales abiertos no anulan las ACL del servidor.",
     "fstabBootTitle": "El montaje fstab no se levanta tras el reinicio",
     "fstabBootBody": "El script añade <code>nofail,_netdev</code> para que un share que falte al arranque no bloquee el inicio. Si el montaje nunca se levanta: confirma que la red es alcanzable (<code>ping &lt;server&gt;</code>), comprueba <code>journalctl -u remote-fs.target</code>, verifica que el archivo de credenciales sigue existiendo (<code>ls -l /etc/samba/credentials/</code>) y es legible, y prueba <code>mount -a</code> manualmente."
   },
@@ -159,7 +159,7 @@
       },
       {
         "href": "/docs/storage-share/lxc-mount-points",
-        "label": "LXC Mount Manager",
+        "label": "Gestor de montajes LXC",
         "tailRich": " — hacer bind mount de la ruta solo en fstab <code>/mnt/&lt;path&gt;</code> en uno o más contenedores."
       },
       {
diff --git a/web/messages/es/docs/storage-share/index.json b/web/messages/es/docs/storage-share/index.json
index 4982a127..ea6ceef3 100644
--- a/web/messages/es/docs/storage-share/index.json
+++ b/web/messages/es/docs/storage-share/index.json
@@ -8,7 +8,7 @@
     "twitterDescription": "Añade NFS / Samba / iSCSI como almacenamiento de Proxmox y comparte carpetas entre el host y LXC."
   },
   "header": {
-    "title": "Storage & Share Manager",
+    "title": "Gestor de almacenamiento y recursos compartidos",
     "description": "Integra almacenamiento externo o local en Proxmox VE y comparte carpetas entre el host y los contenedores LXC. Tres bloques de herramientas: integración de almacenamiento en el host (registra almacenamiento en el propio Proxmox), el LXC Mount Manager (bind mounts con un manejo pragmático de permisos) y compartición por red en LXC (flujos de cliente y servidor NFS / Samba para casos de uso concretos).",
     "section": "Almacenamiento y compartición"
   },
@@ -31,7 +31,7 @@
       "Disco local → almacenamiento Proxmox directory o ZFS",
       "Directorio local compartido (para bind mounts entre CTs)"
     ],
-    "lxcMountTitle": "LXC Mount Manager",
+    "lxcMountTitle": "Gestor de montajes LXC",
     "lxcMountBody": "La herramienta principal de compartición LXC. Hace bind mount de directorios del host dentro de los contenedores vía <code>pct set -mpN</code> y gestiona las particularidades de permisos de los CTs unprivileged sin crear ningún grupo o usuario dentro del contenedor.",
     "lxcMountItems": [
       "Funciona con CTs privileged y unprivileged",
@@ -82,7 +82,7 @@
     ]
   },
   "lxcMount": {
-    "heading": "LXC Mount Manager",
+    "heading": "Gestor de montajes LXC",
     "intro": "La herramienta principal para compartir carpetas entre el host Proxmox y los contenedores LXC. Usa <code>pct set -mpN</code> para hacer bind mount de un directorio del host dentro del contenedor, y gestiona las particularidades de permisos de los CTs unprivileged en el lado del host (no se crea ningún grupo ni usuario dentro del contenedor).",
     "card": {
       "title": "Puntos de montaje LXC (host ↔ CT)",
@@ -121,7 +121,7 @@
   },
   "privReq": {
     "title": "Requisito de contenedor privileged",
-    "body": "Los cuatro flujos de <strong>compartición por red en LXC</strong> de arriba requieren un contenedor <strong>privileged</strong> — los módulos de kernel (<code>nfs-kernel-server</code>, <code>smbd</code>, <code>mount.nfs</code>, <code>mount.cifs</code>) necesitan capabilities que los CTs unprivileged no exponen. Si solo necesitas compartir archivos entre el host y un CT unprivileged, usa el <mountLink>LXC Mount Manager</mountLink> en su lugar — hace bind mount desde el host y ajusta los permisos en el lado del host para que el contenedor pueda leer y escribir sin trucos de módulos de kernel."
+    "body": "Los cuatro flujos de <strong>compartición por red en LXC</strong> anteriores requieren un contenedor <strong>privilegiado</strong>. Los scripts exigen este modo antes de configurar los servicios y herramientas de montaje (<code>nfs-kernel-server</code>, <code>smbd</code>, <code>mount.nfs</code>, <code>mount.cifs</code>). Si solo necesitas compartir archivos entre el host y un CT sin privilegios, usa el <mountLink>LXC Mount Manager</mountLink>: hace bind mount desde el host y ajusta allí los permisos para que el contenedor pueda leer y escribir sin configurar esos servicios o herramientas dentro de él."
   },
   "unprivExplain": {
     "title": "Cómo gestiona ProxMenux los permisos de CT unprivileged",
diff --git a/web/messages/es/docs/storage-share/lxc-mount-points.json b/web/messages/es/docs/storage-share/lxc-mount-points.json
index d89b7a54..3ae18e97 100644
--- a/web/messages/es/docs/storage-share/lxc-mount-points.json
+++ b/web/messages/es/docs/storage-share/lxc-mount-points.json
@@ -1,8 +1,8 @@
 {
   "meta": {
-    "title": "Puntos de montaje LXC (host ↔ contenedor) | ProxMenux Documentation",
+    "title": "Puntos de montaje LXC (host ↔ contenedor) | Documentación de ProxMenux",
     "description": "El LXC Mount Manager — bind mount de cualquier directorio del host en uno o más contenedores LXC vía pct set -mpN. Gestiona las particularidades de permisos de los contenedores unprivileged, repara montajes CIFS / NFS existentes en el lado del host y nunca modifica nada dentro del contenedor.",
-    "ogTitle": "Puntos de montaje LXC (host ↔ contenedor) | ProxMenux Documentation",
+    "ogTitle": "Puntos de montaje LXC (host ↔ contenedor) | Documentación de ProxMenux",
     "ogDescription": "Bind mount de directorios del host en contenedores LXC. Gestiona el mapeo de UIDs unprivileged de forma pragmática, repara el acceso CIFS / NFS en el lado del host."
   },
   "header": {
@@ -24,7 +24,7 @@
     "arrowLabel": "bind mount",
     "outro": "La ruta del host a la izquierda y la ruta del contenedor a la derecha pueden ser diferentes — por ejemplo, <code>/mnt/nas-films</code> en el host puede convertirse en <code>/media/films</code> dentro del contenedor. El script añade la entrada a la config del contenedor (<code>/etc/pve/lxc/&lt;ctid&gt;.conf</code>) usando el siguiente índice <code>mpN</code> libre, con dos valores por defecto seguros incorporados:",
     "items": [
-      "<code>shared=1</code> — le dice a Proxmox que los datos son almacenamiento compartido, así que no intenta migrar el disco al migrar el contenedor.",
+      "<code>shared=1</code> — indica a Proxmox que el montaje usa datos compartidos, por lo que no los migra con el CT. Esta opción no replica datos: la misma ruta y los mismos datos deben estar disponibles en el nodo destino.",
       "<code>backup=0</code> — excluye el bind mount de los backups <code>vzdump</code> (los datos viven en el host, los respaldas por separado)."
     ]
   },
@@ -64,12 +64,12 @@
     "idmapChangesRich": "Mapeo personalizado de UID/GID en <code>/etc/pve/lxc/&lt;CTID&gt;.conf</code> más entradas correspondientes en <code>/etc/subuid</code> + <code>/etc/subgid</code> en el host. El CT debe reiniciarse en cada cambio.",
     "idmapWhenRich": "Necesitas que un UID <em>específico</em> dentro del CT mapee a un UID <em>específico</em> en el host (p. ej. <code>media:1000</code> en el CT debe poseer archivos como <code>media:1000</code> en el host para que NFS no aplique squash). Un setup más rígido, normalmente solo merece la pena para ese escenario exacto.",
     "idmapTipTitle": "Cuándo necesitas lxc.idmap de verdad",
-    "idmapTipBody": "Si el LXC Mount Manager no cubre tu caso — típicamente porque necesitas que los archivos escritos desde dentro del CT aterricen en el host como un UID/GID específico (exports NFS con <code>all_squash</code>, shares Samba con propiedad estricta, compartir un directorio con un usuario del host que tiene el mismo nombre que alguien dentro del CT) — ese es el momento de añadir entradas <code>lxc.idmap</code> a mano. El Mount Manager no te peleará: la línea de bind mount que escribió es independiente de cualquier configuración idmap que añadas después."
+    "idmapTipBody": "Usa mapeo manual de ID cuando los archivos escritos en el CT deban aparecer en el host con un UID/GID numérico concreto, por ejemplo para compartir propietario con un usuario del host. No anula <code>all_squash</code> de NFS: el servidor sigue decidiendo la identidad anónima y sus permisos. Añade entradas <code>lxc.idmap</code> a mano si hace falta. La línea de bind mount es independiente de esas entradas."
   },
   "opening": {
     "heading": "Abrir la herramienta",
     "body": "Desde el menú principal de ProxMenux, abre <strong>Storage &amp; Share Manager → Configure LXC Mount Points (Host ↔ Container)</strong>. Verás este submenú con tres opciones:",
-    "imageAlt": "Menú LXC Mount Manager — Add / View / Remove"
+    "imageAlt": "Menú LXC Mount Manager — Añadir / Ver / Eliminar"
   },
   "addFlow": {
     "heading": "Añadir un montaje — flujo completo",
@@ -123,17 +123,17 @@
   },
   "remove": {
     "heading": "Eliminar un punto de montaje",
-    "body": "Elige el contenedor, elige la entrada <code>mpN</code>, confirma. El script ejecuta <code>pct set --delete mpN</code> para quitar la entrada de la config del CT y ofrece reiniciar el contenedor si está corriendo. El directorio del host y su contenido <strong>no se tocan</strong> — puedes volver a añadir el montaje después (o adjuntar el mismo directorio a un CT distinto).",
+    "body": "Elige el contenedor, elige la entrada <code>mpN</code>, confirma. El script ejecuta <code>pct set --delete mpN</code> para eliminar la entrada de la config del CT y ofrece reiniciar el contenedor si está corriendo. El directorio del host y su contenido <strong>no se tocan</strong> — puedes volver a añadir el montaje después (o adjuntar el mismo directorio a un CT distinto).",
     "warnTitle": "Los contenedores en ejecución necesitan un reinicio para que los cambios surtan efecto",
     "warnBody": "Tanto añadir como eliminar puntos de montaje solo se hacen visibles dentro del contenedor tras un reinicio. El script ofrece un <code>pct reboot</code> de un clic al final de cada operación; puedes declinar y reiniciar manualmente después."
   },
   "troubleshoot": {
     "heading": "Solución de problemas",
-    "noMountTitle": "El montaje aparece en la config del pct pero no dentro del contenedor",
+    "noMountTitle": "El montaje aparece en pct config, pero no dentro del contenedor",
     "noMountBody": "Los bind mounts solo se adjuntan cuando el contenedor arranca. Si añadiste el montaje mientras el CT estaba corriendo, reinícialo (<code>pct reboot &lt;ctid&gt;</code>). Si ya está reiniciado y sigue faltando, comprueba <code>pct config &lt;ctid&gt;</code> para confirmar que la entrada existe y que la ruta del host realmente contiene un directorio.",
     "noWriteTitle": "El contenedor puede ver el directorio pero no puede escribir",
     "noWriteBody": "Casi siempre un problema de permisos. Para contenedores unprivileged, ejecuta de nuevo el fix de permisos del script — las ACLs del directorio del host pueden haber sido reseteadas por otra herramienta (rsync, restore desde backup, <code>chmod</code> manual). Para CIFS, revisa las opciones de montaje en el host: <code>findmnt /mnt/pve/cifs-…</code>, busca valores <code>uid=</code> / <code>gid=</code> / <code>file_mode=</code>.",
-    "alreadyTitle": "\"This path is already used as a mount point in this container\"",
+    "alreadyTitle": "\"Esta ruta ya se utiliza como punto de montaje en este contenedor\"",
     "alreadyBody": "Elegiste la misma ruta del contenedor que ya está cableada a un directorio del host distinto. O elige una ruta del contenedor diferente, o elimina el punto de montaje existente primero.",
     "nfsTitle": "El acceso NFS sigue bloqueado tras aplicar el fix del host",
     "nfsIntro": "Tu servidor NFS está aplicando squash a root o a todas las conexiones. El script puede detectar esto (intenta escribir un archivo de prueba desde el host) y muestra guía del lado del servidor. Dos arreglos comunes del lado del servidor para el export:",
diff --git a/web/messages/es/docs/storage-share/lxc-nfs-client.json b/web/messages/es/docs/storage-share/lxc-nfs-client.json
index f9611677..e3856e7c 100644
--- a/web/messages/es/docs/storage-share/lxc-nfs-client.json
+++ b/web/messages/es/docs/storage-share/lxc-nfs-client.json
@@ -21,7 +21,7 @@
     "diagramServerDetail": "/export/data",
     "diagramHostLabel": "Host Proxmox",
     "diagramHostDetail": "(solo un\npuente de red)",
-    "diagramCtLabel": "LXC (privileged)",
+    "diagramCtLabel": "LXC (con privilegios)",
     "diagramCtDetail": "/mnt/data\nmount.nfs dentro del CT",
     "diagramArrow": "NFS",
     "twoWaysTitle": "Dos formas de dar acceso NFS a un CT — elige una",
@@ -39,7 +39,7 @@
   "fstabFlags": {
     "heading": "Por qué esos flags de fstab",
     "intro": "Para montajes permanentes el script añade tres flags más allá de las opciones NFS estándar: <code>_netdev,x-systemd.automount,noauto</code>. Cada uno resuelve un problema real de boot:",
-    "headerFlag": "Flag",
+    "headerFlag": "Bandera",
     "headerEffect": "Qué hace",
     "rows": [
       {
@@ -52,11 +52,11 @@
       },
       {
         "flag": "noauto",
-        "effect": "Salta el montaje eager al arrancar. Combinado con la unit automount de arriba, el montaje se establece de forma lazy en el primer acceso."
+        "effect": "Omite el montaje inmediato al arrancar. Con la unidad automount anterior, el montaje se realiza al primer acceso."
       }
     ],
     "netEffectTitle": "Efecto neto",
-    "netEffectBody": "Tu contenedor siempre arranca, incluso si el servidor NFS está offline. La primera vez que algo toca la ruta de montaje, systemd lo monta silenciosamente. Si el servidor sigue caído, ese único acceso falla con <em>resource temporarily unavailable</em> — pero nada más en el CT se ve afectado."
+    "netEffectBody": "El sistema de archivos NFS se monta en el <em>primer acceso</em>, en lugar de hacerlo inmediatamente al arrancar. Si el servidor no está disponible, ese acceso puede esperar o fallar y afectar a los servicios que dependen de la ruta. Automount reduce la dependencia durante el arranque, pero no garantiza que todos los servicios del CT queden al margen del fallo."
   },
   "manual": {
     "heading": "Equivalente manual",
@@ -80,7 +80,7 @@
     "heading": "Solución de problemas",
     "privTitle": "Contenedor privileged requerido (el script aborta)",
     "privBody": "El CT seleccionado es unprivileged. El cliente NFS del kernel necesita la capability <code>SYS_ADMIN</code> que los CTs unprivileged no exponen. O bien convierte el CT a privileged (la conversión &amp; Disk Manager está documentada en la página <importLink>Import Disk to LXC</importLink>) o usa la ruta alternativa descrita en el aviso al inicio de esta página.",
-    "aptTitle": "apt-get install nfs-common falla",
+    "aptTitle": "apt-get install nfs-common fails",
     "aptIntro": "El script asume un CT de la familia Debian (<code>apt-get</code>). Si el CT corre Alpine / Arch / Rocky / Alma, el paso de instalación falla silenciosamente. Instala el cliente NFS a mano para esa distro:",
     "aptItems": [
       "Alpine: <code>apk add nfs-utils</code>",
diff --git a/web/messages/es/docs/storage-share/lxc-nfs-server.json b/web/messages/es/docs/storage-share/lxc-nfs-server.json
index 12aa8ef6..0023ee31 100644
--- a/web/messages/es/docs/storage-share/lxc-nfs-server.json
+++ b/web/messages/es/docs/storage-share/lxc-nfs-server.json
@@ -27,9 +27,9 @@
     "heading": "La convención del grupo \"sharedfiles\"",
     "body": "Antes de exportar la carpeta, ProxMenux crea un grupo llamado <code>sharedfiles</code> con <strong>GID 101000</strong> dentro del contenedor, añade cada usuario regular a él, luego pone el directorio del export a <code>root:sharedfiles</code> con modo <code>2775</code>. El <code>2</code> al principio es el bit SGID — cada archivo o carpeta creada dentro hereda automáticamente el grupo <code>sharedfiles</code>.",
     "gidTitle": "Por qué GID 101000 específicamente",
-    "gidBody": "Mapea al GID <strong>1000</strong> del host cuando un contenedor unprivileged lee el mismo archivo (el idmap por defecto de LXC desplaza todo en +100000). En el flujo actual de ProxMenux el propio servidor NFS corre en un CT <strong>privileged</strong> (sin desplazamiento de su lado), pero la convención mantiene el GID numéricamente consistente con CTs cliente unprivileged que puedan montar este share después. Dos CTs privileged usando ambos <code>sharedfiles</code> con GID 101000 pueden leer / escribir los archivos del otro limpiamente porque los números de GID coinciden de principio a fin.",
-    "remapTitle": "El script también crea usuarios 'remap_*' — son vestigiales aquí",
-    "remapBody": "Por cada usuario regular en el CT (y para UIDs comunes como 33 = www-data, 1000, 1001, 1002), el script crea un usuario paralelo <code>remap_&lt;uid&gt;</code> con UID = <code>&lt;uid&gt; + 100000</code>, todos miembros de <code>sharedfiles</code>. El desplazamiento <code>+100000</code> imita el idmap unprivileged de LXC, pero como este script impone un CT <strong>privileged</strong> (sin desplazamiento), esos usuarios <code>remap_*</code> son cuentas shadow sin contraparte real en el host. Son restos inofensivos de una intención de diseño más ambiciosa. Si no los ves en <code>getent passwd</code>, no se rompe nada."
+    "gidBody": "Con el mapa de ID predeterminado de LXC (+100000), el GID 101000 del host aparece como GID <strong>1000</strong> dentro de un CT sin privilegios. Este flujo de servidor usa un CT <strong>con privilegios</strong>, donde no hay desplazamiento. Dos CT con privilegios que usen <code>sharedfiles</code> con GID 101000 comparten el mismo ID numérico de grupo.",
+    "remapTitle": "La creación heredada de usuarios «remap_*» se omite en CT con privilegios",
+    "remapBody": "La rama heredada para CT sin privilegios crearía usuarios <code>remap_&lt;uid&gt;</code> con UID <code>&lt;uid&gt; + 100000</code>, todos en <code>sharedfiles</code>, para usuarios normales y UID habituales (33, 1000, 1001, 1002). Este desplazamiento <code>+100000</code> no se aplica a los CT <strong>con privilegios</strong> exigidos por este flujo, por lo que el script omite esa rama. Es normal que no aparezcan cuentas <code>remap_*</code> en <code>getent passwd</code>; no indica un fallo."
   },
   "defaults": {
     "heading": "Opciones de export por defecto — léelo primero",
@@ -39,7 +39,7 @@
   "opening": {
     "heading": "Abrir la herramienta",
     "body": "Desde el menú principal de ProxMenux, abre <strong>Storage &amp; Share Manager → Configure NFS Server in LXC (only privileged)</strong>. ProxMenux te pide primero elegir el CT destino (y lo arranca si está parado); aborta si es unprivileged. Una vez seleccionado el CT ves este submenú con cinco opciones:",
-    "imageAlt": "Menú NFS Server Manager — Create / View / Delete / Status / Uninstall"
+    "imageAlt": "Menú del servidor NFS — Crear / Ver / Eliminar / Estado / Desinstalar"
   },
   "howRuns": {
     "heading": "Cómo se ejecuta el script (flujo Create)"
@@ -79,7 +79,7 @@
       },
       {
         "option": "sync",
-        "effectRich": "Responder a las peticiones de escritura solo después de que los datos estén en disco. Más seguro que <code>async</code> a costa de throughput."
+        "effectRich": "Responde a las peticiones de escritura solo cuando los datos están en disco. Más seguro que <code>async</code>, a costa del rendimiento."
       },
       {
         "option": "no_subtree_check",
@@ -97,7 +97,7 @@
   },
   "view": {
     "heading": "Ver exports actuales",
-    "body": "Cat de <code>/etc/exports</code> desde dentro del CT (saltando comentarios / blancos) e imprime cada export con su ACL de red y cadena de opciones. Útil para comprobar qué carpetas están expuestas antes de compartir la IP del CT con alguien."
+    "body": "Muestra <code>/etc/exports</code> desde dentro del CT, omitiendo comentarios y líneas vacías, y presenta cada export con su ACL de red y opciones. Útil para comprobar qué carpetas están expuestas antes de compartir la IP del CT."
   },
   "delete": {
     "heading": "Eliminar un export",
@@ -115,9 +115,9 @@
   },
   "troubleshoot": {
     "heading": "Solución de problemas",
-    "privTitle": "Contenedor privileged requerido (el script aborta)",
+    "privTitle": "Se requiere un contenedor con privilegios (el script se detiene)",
     "privBody": "El CT seleccionado es unprivileged. <code>nfs-kernel-server</code> no puede arrancar ahí porque montar <code>/proc/fs/nfsd</code> necesita <code>CAP_SYS_ADMIN</code> en el namespace del kernel del host, y el módulo <code>nfsd</code> tampoco está expuesto al namespace del contenedor (<code>modprobe nfsd</code> desde dentro devuelve <code>FATAL: Module nfsd not found</code>). Si te saltas el gate, verás <code>rpc.nfsd: Unable to access /proc/fs/nfsd errno 2 (No such file or directory)</code> en el journal y ningún puerto NFS llegará a abrirse. Las únicas opciones viables son: convertir el CT a privileged, o mover el servidor NFS a una VM.",
-    "aptTitle": "apt-get install falla",
+    "aptTitle": "Falla apt-get install",
     "aptIntro": "El script asume un CT de la familia Debian. En Alpine / Arch / Rocky / Alma, instala los paquetes del servidor NFS a mano:",
     "aptItems": [
       "Alpine: <code>apk add nfs-utils</code>",
diff --git a/web/messages/es/docs/storage-share/lxc-samba-client.json b/web/messages/es/docs/storage-share/lxc-samba-client.json
index 48c94a75..f63450a8 100644
--- a/web/messages/es/docs/storage-share/lxc-samba-client.json
+++ b/web/messages/es/docs/storage-share/lxc-samba-client.json
@@ -12,7 +12,7 @@
   },
   "privReq": {
     "title": "Contenedor privileged requerido",
-    "body": "El cliente <code>mount.cifs</code> del kernel necesita capabilities (<code>SYS_ADMIN</code> como mínimo) que los contenedores LXC unprivileged no exponen. El script lo impone — te pide elegir un CT y <strong>aborta si es unprivileged</strong>. Si necesitas el share dentro de un CT unprivileged, móntalo en el host Proxmox primero (con <hostSambaLink>Samba / CIFS como almacenamiento de Proxmox</hostSambaLink>) y hazle bind mount en el CT con el <mountLink>LXC Mount Manager</mountLink>."
+    "body": "El cliente <code>mount.cifs</code> del kernel necesita capabilities (<code>SYS_ADMIN</code> como mínimo) que los contenedores LXC unprivileged no exponen. El script lo impone — te pide elegir un CT y <strong>aborta si es unprivileged</strong>. Si necesitas el share dentro de un CT unprivileged, móntalo en el host Proxmox primero (con <hostSambaLink>Share Samba / CIFS como almacenamiento de Proxmox</hostSambaLink>) y hazle bind mount en el CT con el <mountLink>LXC Mount Manager</mountLink>."
   },
   "what": {
     "heading": "Qué hace",
@@ -21,7 +21,7 @@
     "diagramServerDetail": "//srv/share",
     "diagramHostLabel": "Host Proxmox",
     "diagramHostDetail": "(solo un\npuente de red)",
-    "diagramCtLabel": "LXC (privileged)",
+    "diagramCtLabel": "LXC (con privilegios)",
     "diagramCtDetail": "/mnt/share\nmount.cifs dentro del CT",
     "diagramArrow": "CIFS",
     "twoWaysTitle": "Dos formas de dar a un CT un share Samba — elige una",
@@ -30,7 +30,7 @@
   },
   "opening": {
     "heading": "Abrir la herramienta",
-    "body": "Desde el menú principal de ProxMenux, abre <strong>Storage &amp; Share Manager → Configure Samba Client in LXC (only privileged)</strong>. ProxMenux te pide primero <strong>elegir el CT destino</strong> (y lo arranca si está parado); aborta si es unprivileged. Una vez seleccionado el CT ves este submenú:",
+    "body": "Desde el menú principal de ProxMenux, abre <strong>Storage &amp; Share Manager → Configure Samba Client in LXC (only privileged)</strong>. ProxMenux te pide primero <strong>elegir el CT destino</strong> (y lo arranca si está parado); aborta si es unprivileged. Una vez seleccionado el CT, ves este submenú:",
     "imageAlt": "Menú Samba Client Manager — Mount / View / Unmount / Test connectivity"
   },
   "howRuns": {
@@ -38,7 +38,7 @@
   },
   "creds": {
     "heading": "Dónde vive la contraseña",
-    "body": "ProxMenux <strong>nunca guarda la contraseña en texto plano</strong> en el comando de montaje ni en <code>/etc/fstab</code>. En su lugar escribe un archivo de credenciales dentro del CT:",
+    "body": "ProxMenux <strong>no incluye la contraseña en el comando de montaje</strong> ni en <code>/etc/fstab</code>. La guarda en un archivo de credenciales dentro del CT. Ese archivo contiene las credenciales en texto plano protegidas con permisos solo para root; no está cifrado:",
     "whyTitle": "Por qué un archivo separado en vez de fstab",
     "whyBody": "El módulo CIFS acepta opciones <code>username=</code> / <code>password=</code> en línea en fstab, pero cualquiera que pueda leer <code>/etc/fstab</code> ve la contraseña en claro. Poner las credenciales en un archivo solo para root y apuntar fstab a él (<code>credentials=</code>) mantiene la contraseña fuera de la config legible por todos."
   },
@@ -81,11 +81,11 @@
       },
       {
         "option": "noauto",
-        "effect": "Salta el montaje eager al arrancar. Combinado con la unit automount, el montaje se establece de forma lazy."
+        "effect": "Omite el montaje inmediato al arrancar. Con la unidad automount, el montaje se realiza al primer acceso."
       }
     ],
     "netEffectTitle": "Efecto neto de los flags fstab",
-    "netEffectBody": "Tu contenedor siempre arranca, incluso si el servidor Samba está offline. La primera vez que algo toca la ruta de montaje, systemd lo monta silenciosamente. Si el servidor sigue caído, ese único acceso falla con <em>resource temporarily unavailable</em> — pero nada más en el CT se ve afectado."
+    "netEffectBody": "El sistema de archivos CIFS se monta en el <em>primer acceso</em>, en lugar de hacerlo inmediatamente al arrancar. Si el servidor no está disponible, ese acceso puede esperar o fallar y afectar a los servicios que dependen de la ruta. Automount reduce la dependencia durante el arranque, pero no garantiza que todos los servicios del CT queden al margen del fallo."
   },
   "manual": {
     "heading": "Equivalente manual",
@@ -110,7 +110,7 @@
     "heading": "Solución de problemas",
     "privTitle": "Contenedor privileged requerido (el script aborta)",
     "privBody": "El CT seleccionado es unprivileged. El cliente CIFS del kernel necesita la capability <code>SYS_ADMIN</code> que los CTs unprivileged no exponen. O bien convierte el CT a privileged, o usa la ruta alternativa descrita en el aviso al inicio de esta página.",
-    "aptTitle": "apt-get install falla",
+    "aptTitle": "apt-get install fails",
     "aptIntro": "El script asume un CT de la familia Debian (<code>apt-get</code>). En Alpine / Arch / Rocky / Alma, instala el cliente CIFS a mano:",
     "aptItems": [
       "Alpine: <code>apk add cifs-utils samba-client</code>",
@@ -118,7 +118,7 @@
       "Rocky / Alma: <code>dnf install cifs-utils samba-client</code>"
     ],
     "aptOutro": "Después reejecuta el script de ProxMenux — el paso de instalación se salta cuando las herramientas ya están presentes.",
-    "guestFallbackTitle": "\"The server connected you as guest instead of the specified user\"",
+    "guestFallbackTitle": "\"El servidor te conectó como invitado en lugar de con el usuario indicado\"",
     "guestFallbackBody": "La validación activa del script detectó un problema real de auth. El servidor aceptó la conexión pero la degradó a guest porque las credenciales son incorrectas. Causas comunes: typo en el usuario / contraseña, el usuario no existe en el servidor, el usuario está bloqueado o el workgroup / dominio no coincide. Reejecuta el flujo y vuelve a introducir las credenciales con cuidado (la contraseña queda oculta en el diálogo).",
     "denyTitle": "\"NT_STATUS_ACCESS_DENIED\" al montar",
     "denyBody": "Las credenciales se validaron pero el share deniega el acceso. Comprueba en el lado del servidor si el usuario tiene permisos en ese share específico (la validación solo confirma el login, no las ACLs por share). Comprueba también si el servidor requiere una versión específica del protocolo SMB: añade <code>vers=3.0</code> (o <code>2.1</code>, <code>2.0</code>) a las opciones de montaje.",
diff --git a/web/messages/es/docs/storage-share/lxc-samba-server.json b/web/messages/es/docs/storage-share/lxc-samba-server.json
index 9d354308..1f27a55b 100644
--- a/web/messages/es/docs/storage-share/lxc-samba-server.json
+++ b/web/messages/es/docs/storage-share/lxc-samba-server.json
@@ -1,9 +1,9 @@
 {
   "meta": {
-    "title": "Servidor Samba en LXC | ProxMenux Documentation",
+    "title": "Servidor Samba en LXC | Documentación de ProxMenux",
     "description": "Ejecuta un servidor Samba (SMB / CIFS) dentro de un contenedor LXC de Proxmox con ProxMenux. Auto-instala samba, gestiona /etc/samba/smb.conf, usuarios smbpasswd, grupo sharedfiles para carpetas bind-mounted. Requiere un contenedor privileged.",
-    "ogTitle": "Servidor Samba en LXC | ProxMenux Documentation",
-    "ogDescription": "Expón carpetas por SMB/CIFS desde dentro de un contenedor LXC privileged. Auto-instalación, usuario smbpasswd, permisos conscientes de bind mount."
+    "ogTitle": "Servidor Samba en LXC | Documentación de ProxMenux",
+    "ogDescription": "Expón carpetas por SMB/CIFS desde un contenedor LXC con privilegios. Instalación automática, usuario smbpasswd y permisos adaptados a bind mounts."
   },
   "header": {
     "title": "Servidor Samba en LXC",
@@ -20,7 +20,7 @@
     "diagramServerLabel": "LXC (privileged) — servidor Samba",
     "diagramServerDetail": "/mnt/data\n(carpeta que expones)\n\nsmbd + nmbd corriendo\n\nUsuario: <username>\n(vía smbpasswd)\n\nForce group:\nsharedfiles",
     "diagramClientLabel": "Cualquier cliente en la red",
-    "diagramClientDetail": "Windows: \\\\<ip>\\<share>\nmacOS:   smb://<ip>/<share>\nLinux:   mount.cifs",
+    "diagramClientDetail": "Windows: \\\\<ip>\\<share>\nmacOS: smb://<ip>/<share>\nLinux: mount.cifs",
     "diagramArrow": "SMB / CIFS"
   },
   "perms": {
@@ -40,19 +40,19 @@
   "opening": {
     "heading": "Abrir la herramienta",
     "body": "Desde el menú principal de ProxMenux, abre <strong>Storage &amp; Share Manager → Configure Samba Server in LXC (only privileged)</strong>. ProxMenux te pide primero elegir el CT destino (y lo arranca si está parado); aborta si es unprivileged. Una vez seleccionado el CT ves este submenú con cinco opciones:",
-    "imageAlt": "Menú Samba Server Manager — Create / View / Delete / Status / Uninstall"
+    "imageAlt": "Menú del servidor Samba — Crear / Ver / Eliminar / Estado / Desinstalar"
   },
   "howRuns": {
     "heading": "Cómo se ejecuta el script (flujo Create)"
   },
   "modes": {
     "heading": "Los tres modos de share",
-    "intro": "Cada modo escribe una stanza diferente en <code>smb.conf</code>. Los tres incluyen <code>valid users = &lt;username&gt;</code> (sin anónimo), <code>force group = sharedfiles</code> (para que los archivos nuevos pertenezcan al grupo compartido) y <code>veto files = /lost+found/</code> (lo oculta a los clientes).",
+    "intro": "Cada modo escribe un bloque diferente en <code>smb.conf</code>. Los tres incluyen <code>valid users = &lt;username&gt;</code> (sin anónimo), <code>force group = sharedfiles</code> (para que los archivos nuevos pertenezcan al grupo compartido) y <code>veto files = /lost+found/</code> (lo oculta a los clientes).",
     "headerMode": "Modo",
     "headerBlock": "Bloque escrito en smb.conf",
-    "rwMode": "Read-Write",
-    "roMode": "Read-Only",
-    "customMode": "Custom",
+    "rwMode": "Lectura y escritura",
+    "roMode": "Solo lectura",
+    "customMode": "Personalizado",
     "customBodyRich": "Tú escribes tus propias directivas en un cuadro de texto libre. ProxMenux igualmente las envuelve en un bloque <code>[share]</code> con los <code>path</code>, <code>valid users</code>, <code>force group</code> y <code>veto files</code> estándar."
   },
   "manual": {
@@ -90,9 +90,9 @@
   },
   "troubleshoot": {
     "heading": "Solución de problemas",
-    "privTitle": "Contenedor privileged requerido (el script aborta)",
+    "privTitle": "Se requiere un contenedor con privilegios (el script se detiene)",
     "privBody": "El CT seleccionado es unprivileged y <code>smbd</code> no puede servir archivos ahí. Si te saltas el gate y configuras Samba a mano, <code>smbd</code> arranca y los puertos se abren, pero la primera conexión de cliente entra en pánico con <code>PANIC: sys_setgroups failed</code> en <code>/var/log/samba/log.&lt;client&gt;</code> y el cliente ve <code>NT_STATUS_CONNECTION_DISCONNECTED</code>. La causa es que el namespace de usuario unprivileged tiene <code>setgroups=deny</code>, lo que bloquea la impersonación por conexión de Samba. Ni <code>features=keyctl=1</code> ni eliminar <code>force user</code> / <code>force group</code> cambian esto. Las únicas opciones viables son: convertir el CT a privileged, o mover Samba a una VM.",
-    "aptTitle": "apt-get install falla",
+    "aptTitle": "Falla apt-get install",
     "aptIntro": "El script asume un CT de la familia Debian. En Alpine / Arch / Rocky / Alma, instala Samba a mano:",
     "aptItems": [
       "Alpine: <code>apk add samba</code>",
@@ -103,7 +103,7 @@
     "noShareTitle": "El cliente conecta pero no puede ver el share",
     "noShareBody": "Comprueba que <code>browseable = yes</code> está puesto en el bloque del share (por defecto para los modos rw / ro; puede faltar en custom). Comprueba también que el firewall del CT y el firewall del host Proxmox permiten TCP 445 (SMB) y 139 (NetBIOS). Algunos clientes Windows también requieren resolución de nombres — prueba la IP directamente primero.",
     "authTitle": "La autenticación falla (NT_STATUS_LOGON_FAILURE)",
-    "authBody": "O bien la contraseña es incorrecta (las contraseñas Samba son <em>separadas</em> de las contraseñas de sistema — mira <code>pdbedit -L</code>) o el usuario no está en <code>valid users</code> para ese share. Resetea la contraseña con <code>smbpasswd &lt;user&gt;</code> dentro del CT.",
+    "authBody": "La contraseña es incorrecta (las contraseñas Samba son <em>independientes</em> de las del sistema; lista los usuarios Samba con <code>pdbedit -L</code>) o el usuario no figura en <code>valid users</code> para ese recurso. Restablece la contraseña con <code>smbpasswd &lt;user&gt;</code> dentro del CT.",
     "groupTitle": "Los archivos escritos por el cliente aparecen con grupo incorrecto en el servidor",
     "groupBody": "El script pone <code>force group = sharedfiles</code> en el bloque del share, así que los archivos nuevos deberían ser del grupo <code>sharedfiles</code>. Si no lo son, el bit SGID en el directorio padre puede haberse perdido (alguien ejecutó <code>chmod</code> a mano). Reaplica: <code>chmod 2775 /mnt/&lt;share&gt;</code>.",
     "bothTitle": "Compartir la misma carpeta por NFS y Samba",
@@ -125,7 +125,7 @@
       {
         "href": "/docs/storage-share/host-samba",
         "label": "Samba / CIFS como almacenamiento de Proxmox",
-        "tailRich": " — una vez que tu CT esté exponiendo, registra ese share en Proxmox para que aparezca bajo <em>Datacenter → Storage</em>."
+        "tailRich": " — una vez que tu CT esté exportando, registra ese share Samba en Proxmox para que aparezca bajo <em>Datacenter → Storage</em>."
       }
     ]
   }
diff --git a/web/messages/es/docs/utils/export-vm.json b/web/messages/es/docs/utils/export-vm.json
index 248823c0..5cdb7953 100644
--- a/web/messages/es/docs/utils/export-vm.json
+++ b/web/messages/es/docs/utils/export-vm.json
@@ -1,8 +1,8 @@
 {
   "meta": {
-    "title": "Exportar VM a OVA / OVF | ProxMenux Documentation",
+    "title": "Exportar VM a OVA / OVF | Documentación de ProxMenux",
     "description": "Exporta una VM de Proxmox a un archivo OVA portable o un directorio OVF usando el esquema estándar DMTF. Discos VMDK en formato streamOptimized, manifiesto SHA1. Importable en VMware ESXi / Workstation / Fusion, VirtualBox y de vuelta a Proxmox.",
-    "ogTitle": "Exportar VM a OVA / OVF | ProxMenux Documentation",
+    "ogTitle": "Exportar VM a OVA / OVF | Documentación de ProxMenux",
     "ogDescription": "Convierte una VM de Proxmox en un paquete portable OVA / OVF compatible con VMware y VirtualBox."
   },
   "header": {
@@ -40,13 +40,13 @@
       {
         "format": "OVA",
         "output": "name-vmid-ts.ova",
-        "pros": "Un único archivo — fácil de mover, sftp, adjuntar a un ticket. Autocontenido.",
+        "pros": "Un único archivo, fácil de mover, transferir por sftp o adjuntar a una incidencia. Contiene todo lo necesario.",
         "cons": "Necesita ~220% del tamaño virtual del disco (overhead de TAR durante la creación)."
       },
       {
         "format": "OVF",
         "output": "name-vmid-ts-ovf/",
-        "pros": "~120% de overhead de disco. Más fácil de inspeccionar (el descriptor es XML plano). Editable antes de importar.",
+        "pros": "~120% del tamaño virtual del disco. Más fácil de inspeccionar (el descriptor es XML de texto). Se puede editar antes de importar.",
         "cons": "Varios archivos — hay que transferirlos todos juntos."
       }
     ]
@@ -54,8 +54,8 @@
   "destination": {
     "heading": "Directorio de destino",
     "body": "Elige entre presets (<code>/var/lib/vz/dump</code>, <code>/var/lib/vz/template/iso</code>) o introduce una ruta manual. El script valida que el directorio es escribible y avisa si el espacio libre va justo antes de empezar.",
-    "calloutTitle": "Regla del pulgar de espacio libre",
-    "calloutBody": "Para una exportación OVF de una VM con discos que suman 100 GB virtuales: presupuesta ~120 GB libres. Para OVA: presupuesta ~220 GB. Los discos sparse / mayormente vacíos pueden usar menos, pero la conversión los escribe enteros antes de que el paso TAR de OVA comprima nada. Si te quedas sin espacio a mitad de la exportación, el directorio temporal se limpia con el trap de EXIT y vuelves a empezar."
+    "calloutTitle": "Estimación orientativa del espacio libre",
+    "calloutBody": "Para exportar a OVF una VM cuyos discos suman 100 GB virtuales, reserva ~120 GB libres; para OVA, ~220 GB. El uso real puede ser menor si los discos están casi vacíos. El archivo OVA se crea con TAR sin compresión mientras aún existen los archivos VMDK temporales, por lo que hay que reservar espacio para ambos. Si te quedas sin espacio durante la exportación, el manejador de EXIT limpia el directorio temporal y tendrás que empezar de nuevo."
   },
   "package": {
     "heading": "Qué acaba en el paquete",
@@ -73,7 +73,7 @@
     "notTitle": "Qué NO se exporta",
     "notItems": [
       "Montajes de CD-ROM / ISO (excluidos por diseño).",
-      "Drives de cloud-init (excluidos por diseño).",
+      "Unidades de cloud-init (excluidas por diseño).",
       "Bridge / modelo específico de NIC (solo se preserva el recuento).",
       "Elección de BIOS / UEFI — hay que volver a configurarla al importar.",
       "Configuración de passthrough PCI.",
@@ -95,7 +95,7 @@
   },
   "import": {
     "heading": "Importar el resultado",
-    "intro": "El paquete exportado lo pueden consumir:",
+    "intro": "El paquete exportado se puede importar en:",
     "items": [
       {
         "href": "/docs/utils/import-vm",
@@ -117,12 +117,12 @@
   "troubleshoot": {
     "heading": "Solución de problemas",
     "noSpaceTitle": "qemu-img convert falla a mitad con \"No space left on device\"",
-    "noSpaceBody": "El destino se quedó sin espacio. El directorio temporal se limpia automáticamente con el trap de EXIT. Elige un destino con más margen (regla del pulgar más arriba) y vuelve a ejecutar.",
+    "noSpaceBody": "El destino se ha quedado sin espacio. El manejador de EXIT limpia automáticamente el directorio temporal. Elige un destino con más espacio libre (consulta la estimación anterior) y vuelve a ejecutar la herramienta.",
     "unsupportedHwTitle": "La exportación termina pero VMware se niega a importar: \"Unsupported hardware family\"",
-    "unsupportedHwBody": "Algunas versiones de ESXi rechazan descriptores OVF que declaran una hardware family que no reconocen. Abre el .ovf en un editor de texto (o extrae primero el .ova), busca <code>&lt;vssd:VirtualSystemType&gt;</code> y edítalo a un valor que ESXi acepte (p. ej. <code>vmx-13</code> para ESXi 6.5+). Como solución rápida, prueba con VirtualBox — es más permisivo.",
-    "nicTitle": "La VM importada en VMware tiene NIC e1000 pero quiero VirtIO",
-    "nicBody": "Esperado — el OVF solo almacena el recuento de NICs, no el modelo. Edita la configuración de NIC de la VM importada en VMware después de importar. Lo mismo aplica para el controlador SCSI (la exportación usa lsilogic por compatibilidad con VMware; cámbialo a <code>VirtIO SCSI</code> si tu guest lo soporta).",
-    "runningTitle": "La VM estaba corriendo y decliné pararla — exportación abortada",
+    "unsupportedHwBody": "Algunas versiones de ESXi rechazan los descriptores OVF que declaran una familia de hardware que no reconocen. Abre el .ovf en un editor de texto (o extrae primero el .ova), busca <code>&lt;vssd:VirtualSystemType&gt;</code> y cambia su valor por uno que ESXi acepte (por ejemplo, <code>vmx-13</code> para ESXi 6.5+). Como solución rápida, prueba con VirtualBox, que es más permisivo.",
+    "nicTitle": "La VM importada usa una NIC o un controlador SCSI diferente",
+    "nicBody": "El OVF conserva el número de NIC, pero no el modelo original. Revisa la configuración de red de la VM importada en el hipervisor de destino. La exportación declara un controlador SCSI lsilogic por compatibilidad con VMware. Al importarla de vuelta a Proxmox con ProxMenux, la VM se crea con un controlador LSI y tarjetas e1000; cambia después a <code>VirtIO SCSI</code> y VirtIO si el sistema invitado tiene los controladores adecuados.",
+    "runningTitle": "La VM estaba en ejecución y rechacé detenerla: exportación cancelada",
     "runningBody": "El script no puede producir una imagen consistente mientras se escribe en los discos. O bien aceptas el prompt de apagado la próxima vez, o paras la VM manualmente primero (<code>qm shutdown $VMID</code>) y vuelves a ejecutar.",
     "slowTitle": "La conversión de discos es lenta",
     "slowBody": "<code>qemu-img convert</code> es de un solo hilo y lee el origen a velocidad máxima. Para un disco de 100 GB en disco mecánico, espera 15-30 minutos. NVMe a NVMe es 5-10x más rápido. Las VMs multi-disco se convierten secuencialmente — el tiempo escala linealmente con el tamaño virtual total."
@@ -133,11 +133,11 @@
       {
         "href": "/docs/utils/import-vm",
         "label": "Importar VM desde OVA / OVF",
-        "tail": " — el compañero del viaje de ida y vuelta."
+        "tail": " — la herramienta complementaria para volver a importar."
       },
       {
         "href": "/docs/utils",
-        "label": "Resumen de Utilidades",
+        "label": "Resumen de utilidades",
         "tail": " — volver al resumen de la sección."
       }
     ]
diff --git a/web/messages/es/docs/utils/import-vm.json b/web/messages/es/docs/utils/import-vm.json
index d58336e3..73837aa7 100644
--- a/web/messages/es/docs/utils/import-vm.json
+++ b/web/messages/es/docs/utils/import-vm.json
@@ -1,8 +1,8 @@
 {
   "meta": {
-    "title": "Importar VM desde OVA / OVF | ProxMenux Documentation",
+    "title": "Importar VM desde OVA / OVF | Documentación de ProxMenux",
     "description": "Importa una VM de VMware ESXi / Workstation / Fusion / VirtualBox / ProxMenux en Proxmox VE. Extrae OVA automáticamente, parsea los metadatos OVF, crea la VM e importa cada disco al formato nativo del almacenamiento (qcow2 / raw).",
-    "ogTitle": "Importar VM desde OVA / OVF | ProxMenux Documentation",
+    "ogTitle": "Importar VM desde OVA / OVF | Documentación de ProxMenux",
     "ogDescription": "Trae VMs de exportaciones de VMware, VirtualBox o ProxMenux a Proxmox. Los discos se convierten automáticamente al formato nativo del almacenamiento."
   },
   "header": {
@@ -40,7 +40,7 @@
       },
       {
         "label": "qm create + importdisk",
-        "detail": "qm create $VMID\nqm importdisk\n(VMDK → qcow2)\nqm set --scsiN",
+        "detail": "qm create $VMID\nqm importdisk\n(VMDK → formato del almacenamiento)\nqm set --scsiN",
         "variant": "target"
       }
     ]
@@ -86,7 +86,7 @@
   },
   "memWarn": {
     "title": "Ambigüedad de unidad de memoria",
-    "body": "El parser <strong>asume MiB</strong>. Si el OVF declara la memoria en <em>GB</em> (p. ej. algunas exportaciones de VMware lo hacen), la VM importada tendrá 1/1024 de la RAM prevista. Tras la importación, contrasta <code>qm config $VMID | grep memory</code> contra la RAM documentada de la VM origen y ajusta con <code>qm set $VMID --memory &lt;MiB&gt;</code> si está desviada por un factor de 1024 o 1024²."
+    "body": "El analizador convierte las unidades de memoria reconocidas a <strong>MiB</strong>, incluidos bytes, KiB, MiB, GiB y las etiquetas de texto compatibles. Las unidades ausentes o no reconocidas se <em>interpretan como MiB</em>. Después de importar, compara <code>qm config $VMID | grep memory</code> con la RAM documentada de la VM de origen y, si hace falta, corrígela con <code>qm set $VMID --memory &lt;MiB&gt;</code>."
   },
   "dialog": {
     "heading": "Flujo de diálogos de importación",
@@ -108,7 +108,7 @@
     "heading": "Bucle de importación de discos",
     "intro": "Para cada referencia de disco en el OVF:",
     "items": [
-      "<code>qm importdisk $VMID $disk_path $STORAGE</code> — convierte el VMDK al formato nativo del almacenamiento (p. ej. qcow2 en local-lvm, raw en ZFS) y crea una entrada <code>unusedN:</code> en la configuración de la VM.",
+      "<code>qm importdisk $VMID $disk_path $STORAGE</code> — importa el disco en un formato compatible con el almacenamiento de destino y crea una entrada <code>unusedN:</code> en la configuración de la VM.",
       "El script busca con grep en la configuración la referencia <code>unusedN</code> recién creada.",
       "<code>qm set $VMID --scsiN $unused_disk</code> — asocia el disco como <code>scsi0</code>, <code>scsi1</code>, …",
       "<code>qm set $VMID --delete unusedN</code> — elimina el marcador unused ya redundante."
@@ -130,7 +130,7 @@
       {
         "setting": "Controlador SCSI",
         "default": "LSI",
-        "recommended": "VirtIO SCSI single (Linux moderno + Windows con drivers VirtIO)"
+        "recommended": "VirtIO SCSI single (Linux moderno o Windows con controladores VirtIO)"
       },
       {
         "setting": "Firmware (BIOS / UEFI)",
@@ -138,8 +138,8 @@
         "recommended": "Igualar al firmware de la VM origen (desigualados = no arranca)"
       },
       {
-        "setting": "QEMU guest agent",
-        "default": "Off",
+        "setting": "QEMU Agente invitado",
+        "default": "Desactivado",
         "recommendedRich": "On + instalar <code>qemu-guest-agent</code> en el guest (mejores backups, reporte de IP)"
       },
       {
@@ -148,8 +148,8 @@
         "recommended": "Verificar contra el SO real del guest"
       },
       {
-        "setting": "Display",
-        "default": "Default",
+        "setting": "Pantalla",
+        "default": "Por defecto",
         "recommended": "VirtIO-GPU o SPICE (mejor rendimiento de consola)"
       }
     ]
@@ -166,7 +166,7 @@
       "<strong>Tipo de firmware BIOS / UEFI</strong> — por defecto el de Proxmox (BIOS).",
       "<strong>Configuración de passthrough PCI</strong>.",
       "<strong>TPM</strong> (vTPM).",
-      "<strong>Drives de cloud-init</strong>.",
+      "Unidades <strong>cloud-init</strong>.",
       "<strong>Snapshots</strong> — solo el estado actual.",
       "<strong>Dispositivos USB / serie / paralelo</strong> declarados en el OVF.",
       "<strong>Tags de VM / notas / arranque al inicio</strong>."
@@ -175,20 +175,20 @@
   "troubleshoot": {
     "heading": "Solución de problemas",
     "orphanTitle": "La VM se creó pero la importación de discos falló — VM huérfana en el sistema",
-    "orphanIntro": "Limitación conocida. El script no limpia automáticamente una importación parcial. Destruye la huérfana con:",
+    "orphanIntro": "Si la importación falla, el script ofrece eliminar la VM parcial y sus discos importados. Si lo rechazaste o la eliminación automática falló, revisa la VM y elimínala manualmente con:",
     "orphanCode": "qm destroy $VMID --destroy-unreferenced-disks 1",
     "orphanOutro": "Después corrige la causa raíz (probablemente espacio en disco en el almacenamiento de destino) y vuelve a importar.",
     "memTitle": "La VM importada tiene 8 MB de RAM (o 8 TB)",
-    "memIntro": "Ambigüedad de unidad de memoria en el parser de OVF. Desviado por un factor de 1024 → el OVF usó GB en lugar de MiB. Arreglo:",
+    "memIntro": "El analizador convierte las AllocationUnits reconocidas a MiB. Si las unidades faltan o no son compatibles, las interpreta como MiB. Revisa el OVF, compara la memoria importada con la VM de origen y corrígela si hace falta:",
     "memCode": "qm set $VMID --memory 8192    # 8 GiB",
     "bootTitle": "La VM importada no arranca — \"No bootable device\"",
     "bootIntro": "Causa más común: desigualdad BIOS / UEFI. La VM era UEFI pero Proxmox la creó como BIOS. Configura el firmware coincidente:",
     "bootCode": "qm set $VMID --bios ovmf       # UEFI\n# also add an EFI disk for the EFI vars:\nqm set $VMID --efidisk0 $STORAGE:1,format=qcow2,efitype=4m,pre-enrolled-keys=1",
     "bootOutro": "Segunda más común: el orden de arranque apunta a scsi0 pero el disco real del SO es scsi1. Edita el orden de arranque en la pestaña VM Options.",
     "bsodTitle": "Una VM Windows exportada desde VMware se importa pero hace BSOD al primer arranque",
-    "bsodBody": "Windows es sensible a cambios de controlador de disco. Bien: (a) instala los drivers VirtIO <em>antes</em> de exportar desde VMware, o (b) mantén el controlador SCSI como <code>lsi</code> (el valor por defecto) y solo cambia a VirtIO SCSI tras que el guest arranque y puedas instalar los drivers VirtIO en Windows.",
+    "bsodBody": "Windows es sensible a los cambios de controlador de disco. Puedes (a) instalar los controladores VirtIO <em>antes</em> de exportar desde VMware o (b) mantener el controlador SCSI <code>lsi</code> predeterminado y cambiar a VirtIO SCSI después de arrancar el sistema invitado e instalar sus controladores VirtIO en Windows.",
     "zeroTitle": "El parser de OVF reporta 0 discos",
-    "zeroBody": "El descriptor OVF usa un estilo inusual de referencia a disco. Abre el .ovf en un editor de texto y confirma que cada disco tiene una entrada <code>&lt;File ovf:href=\"...vmdk\" ...&gt;</code>. Si la extensión del archivo es inusual (p. ej. solo <code>.dat</code>), renómbralo a <code>.vmdk</code> y actualiza la referencia en el OVF, después vuelve a ejecutar.",
+    "zeroBody": "El descriptor OVF puede usar referencias a discos que el analizador no reconoce. Abre el .ovf y busca la entrada <code>&lt;File ovf:href=\"...vmdk\" ...&gt;</code> de cada disco. Si el disco es realmente VMDK, pero tiene una extensión inusual como <code>.dat</code>, renómbralo a <code>.vmdk</code> y actualiza la referencia en el OVF. Renombrarlo no convierte su formato.",
     "awkTitle": "awk: syntax error at or near , — el parser falla en cada OVA / OVF",
     "awkIntro": "El parser de OVF usa sintaxis específica de gawk (<code>match()</code> con 3 argumentos) que mawk — el <code>awk</code> por defecto en Debian / Proxmox — no soporta. Versiones recientes del script instalan automáticamente gawk en el primer uso vía el par canónico <code>ensure_repositories</code> + <code>install_single_package</code>; si estás ejecutando una copia más antigua, instálalo manualmente:",
     "awkCode": "apt-get install -y gawk",
@@ -206,11 +206,11 @@
       {
         "href": "/docs/utils/export-vm",
         "label": "Exportar VM a OVA / OVF",
-        "tail": " — el compañero del viaje de ida y vuelta."
+        "tail": " — la herramienta complementaria para exportar."
       },
       {
         "href": "/docs/utils",
-        "label": "Resumen de Utilidades",
+        "label": "Resumen de utilidades",
         "tail": " — volver al resumen de la sección."
       }
     ]
diff --git a/web/messages/es/docs/utils/index.json b/web/messages/es/docs/utils/index.json
index 7587393c..769b1772 100644
--- a/web/messages/es/docs/utils/index.json
+++ b/web/messages/es/docs/utils/index.json
@@ -8,13 +8,13 @@
     "twitterDescription": "Creación de ISOs, herramientas CLI, actualización de Proxmox, salto PVE 8→9, portabilidad de VMs OVA / OVF."
   },
   "header": {
-    "title": "Utilidades",
+    "title": "Utilidades y herramientas",
     "description": "Seis herramientas que completan el flujo de trabajo del día a día en Proxmox VE: creación de ISOs, mantenimiento del sistema y portabilidad de VMs. Cada opción es independiente — elige la que necesites; nada se instala hasta que lo pidas.",
     "section": "Utilidades"
   },
   "intro": {
     "title": "Para qué sirve este menú",
-    "body": "Tres grupos de herramientas no relacionadas pero habitualmente necesarias: <strong>crear una ISO de Windows</strong> desde UUP Dump, <strong>mantener el host Proxmox</strong> (utilidades CLI, actualizaciones, el salto de versión mayor) y <strong>mover VMs dentro y fuera</strong> de Proxmox usando el formato estándar OVA / OVF."
+    "body": "Tres grupos de herramientas independientes pero de uso habitual: <strong>crear una ISO de Windows</strong> desde UUP Dump, <strong>mantener el host Proxmox</strong> (utilidades CLI, actualizaciones y el salto de versión mayor) e <strong>importar y exportar máquinas virtuales</strong> en Proxmox mediante el formato estándar OVA / OVF."
   },
   "opening": {
     "heading": "Abrir el menú",
@@ -30,14 +30,14 @@
       "bullets": [
         "Enlace compartido de UUP Dump → ISO arrancable",
         "Dependencias instaladas automáticamente",
-        "El resultado aterriza en la ruta de plantillas ISO de Proxmox"
+        "El resultado se guarda en la ruta de plantillas ISO de Proxmox"
       ]
     },
     "maintenance": {
       "title": "Mantenimiento del sistema",
       "body": "Mantén el host sano: herramientas CLI, actualizaciones periódicas y el salto de versión mayor cuando toca.",
       "bullets": [
-        "Instalador de utilidades del sistema (26 herramientas CLI)",
+        "Instalador de utilidades del sistema (25 herramientas CLI)",
         "Actualización del sistema Proxmox (apt + dist-upgrade)",
         "Salto de versión mayor PVE 8 → PVE 9"
       ]
@@ -61,7 +61,7 @@
     "body": "Crea una ISO de instalación de Windows actualizada directamente en el host Proxmox. El script automatiza todo el flujo de UUP Dump: instalación de dependencias (aria2c, cabextract, wimlib-imagex, …), descarga paralelizada de los archivos de actualización vía aria2 y conversión en una única ISO arrancable que aterriza en <code>/var/lib/vz/template/iso</code> lista para asociar a una VM.",
     "options": [
       {
-        "title": "UUP Dump ISO Creator",
+        "title": "Creador de ISO UUP Dump",
         "description": "Crea una ISO de instalación de Windows actualizada desde un enlace compartido de UUP Dump. Dependencias, descarga y conversión totalmente automatizadas; la ISO resultante aterriza en /var/lib/vz/template/iso lista para crear una VM.",
         "href": "/docs/utils/UUp-Dump-ISO-Creator"
       }
@@ -69,16 +69,16 @@
   },
   "maintenanceSection": {
     "heading": "Mantenimiento del sistema",
-    "body": "Tres herramientas cubren el trabajo del host del día a día y el ocasional. <strong>Instalador de utilidades del sistema</strong> configura las herramientas CLI que realmente usas tras una instalación recién hecha. <strong>Actualización del sistema Proxmox</strong> es la rutina semanal / mensual de higiene. <strong>Actualizar PVE 8 a PVE 9</strong> es la gran mudanza una vez por ciclo mayor — se trata con compuertas de seguridad adicionales porque no es reversible.",
+    "body": "Tres herramientas cubren las tareas diarias y ocasionales del host. El <strong>Instalador de utilidades del sistema</strong> configura las herramientas CLI que usas tras una instalación nueva. La <strong>Actualización del sistema Proxmox</strong> sirve para el mantenimiento semanal o mensual. <strong>Actualizar PVE 8 a PVE 9</strong> es el gran cambio de cada ciclo de versión mayor y cuenta con comprobaciones de seguridad adicionales porque no es reversible.",
     "options": [
       {
         "title": "Instalador de utilidades del sistema",
-        "description": "Selector curado para 26 herramientas CLI (htop, btop, iperf3, jq, tmux, ncdu, ...) con selección personalizada o grupos predefinidos (básico, dev, compresión, multiplexores, análisis, red). Usa el flujo canónico de repo + comando de verificación.",
+        "description": "Selector de 25 herramientas CLI escogidas (htop, btop, iperf3, tmux, ...) con selección personalizada o grupos predefinidos (básico, desarrollo, compresión, multiplexores, análisis y red). Usa el flujo estándar de repositorio y comando de verificación.",
         "href": "/docs/utils/system-utils"
       },
       {
         "title": "Actualización del sistema Proxmox",
-        "description": "Comprobación de repositorios + apt update + apt dist-upgrade con preguntar antes de reiniciar. Detecta la versión mayor de PVE (8 o 9), mantiene los repositorios configurados y pregunta antes de cambiar a sin suscripción un host que no la tiene, y después ejecuta autoremove.",
+        "description": "Comprobación de repositorios + apt update + apt dist-upgrade, con confirmación antes de reiniciar. Detecta la versión mayor de PVE (8 o 9), conserva los repositorios configurados y solicita confirmación antes de cambiar al repositorio no-subscription un host sin suscripción; después ejecuta autoremove.",
         "href": "/docs/utils/system-update"
       },
       {
@@ -99,17 +99,17 @@
       },
       {
         "title": "Importar VM desde OVA / OVF",
-        "description": "Trae una exportación de VMware / VirtualBox / ProxMenux de vuelta a Proxmox. Extrae OVA automáticamente, parsea los metadatos OVF, crea la VM e importa cada disco al formato nativo del almacenamiento.",
+        "description": "Importa en Proxmox una exportación de VMware / VirtualBox / ProxMenux. Extrae OVA automáticamente, analiza los metadatos OVF, crea la VM e importa cada disco en el formato nativo del almacenamiento.",
         "href": "/docs/utils/import-vm"
       }
     ]
   },
   "diskSpaceCallout": {
     "title": "Nota sobre espacio en disco para exportar / importar",
-    "body": "Ambas herramientas convierten formatos de disco: la exportación usa <code>qemu-img convert -O vmdk -o subformat=streamOptimized</code>; la importación usa <code>qm importdisk</code> para convertir de vuelta al formato nativo del almacenamiento (qcow2 / raw). Planea <strong>~120% del tamaño virtual del disco</strong> para OVF y <strong>~220%</strong> para OVA — la conversión escribe el disco completo antes de cualquier compresión. Comprueba que el directorio de destino tiene margen antes de empezar."
+    "body": "Ambas herramientas convierten formatos de disco: la exportación usa <code>qemu-img convert -O vmdk -o subformat=streamOptimized</code>; la importación usa <code>qm importdisk</code> para volver al formato nativo del almacenamiento (qcow2 / raw). Para exportar, reserva <strong>~120% del tamaño virtual del disco</strong> para OVF y <strong>~220%</strong> para OVA. El archivo OVA usa TAR sin compresión y se crea mientras aún existen los archivos VMDK temporales. Comprueba que el directorio de destino tiene espacio suficiente antes de empezar."
   },
   "fitsTogether": {
     "heading": "Cómo encaja el menú",
-    "body": "Cada herramienta tiene un script dedicado bajo <code>scripts/utilities/</code>. La Actualización del sistema Proxmox es un wrapper que delega en uno de dos scripts worker en <code>scripts/global/</code> según la versión mayor detectada (PVE 8 o PVE 9). El salto PVE 8 → 9 expone dos acciones extra de menú dentro de su propio flujo — una <em>Comprobación previa al upgrade</em> independiente (ejecuta <code>pve8to9 --full</code>) y una <em>Guía manual de upgrade</em> de solo lectura (runbook de 17 pasos) — para los usuarios que quieren inspeccionar u operar a mano en lugar de la ruta automatizada."
+    "body": "Cada herramienta tiene un script dedicado en <code>scripts/utilities/</code>. La actualización del sistema Proxmox llama a un único script seguro de <code>scripts/global/</code>, update-pve-safe.sh, que detecta la versión mayor y gestiona tanto PVE 8 como PVE 9. La actualización PVE 8 → 9 ofrece dos acciones adicionales en su propio menú: una <em>Comprobación previa a la actualización</em> independiente (ejecuta <code>pve8to9 --full</code>) y una <em>Guía de actualización manual</em> de solo lectura (procedimiento de 17 pasos), para quienes quieran inspeccionar el proceso o realizarlo manualmente."
   }
 }
diff --git a/web/messages/es/docs/utils/system-update.json b/web/messages/es/docs/utils/system-update.json
index 49d4a35e..aa85497a 100644
--- a/web/messages/es/docs/utils/system-update.json
+++ b/web/messages/es/docs/utils/system-update.json
@@ -1,13 +1,13 @@
 {
   "meta": {
-    "title": "Actualización del sistema Proxmox | ProxMenux Documentation",
-    "description": "Ejecuta la secuencia oficial de upgrade de Proxmox (apt update + apt full-upgrade -y) y añade la higiene de repos, comprobación de paquetes esenciales, escaneo de sanity de LVM, autoremove/autoclean y preguntar antes de reiniciar que la guía de upgrade también recomienda. Detecta la versión mayor en ejecución automáticamente.",
-    "ogTitle": "Actualización del sistema Proxmox | ProxMenux Documentation",
-    "ogDescription": "apt full-upgrade / dist-upgrade oficial envuelto con higiene de repos, autoremove y un preguntar antes de reiniciar inteligente."
+    "title": "Actualización del sistema Proxmox | Documentación de ProxMenux",
+    "description": "Actualiza los paquetes dentro de la versión mayor actual de Proxmox con apt-get update y apt full-upgrade -y. Comprueba el espacio en disco y los repositorios configurados, intenta recuperar las claves GPG, comprueba y repara cabeceras PV antiguas de LVM, recompila los controladores DKMS gestionados cuando hace falta, ejecuta autoremove/autoclean y ofrece reiniciar cuando es necesario.",
+    "ogTitle": "Actualización del sistema Proxmox | Documentación de ProxMenux",
+    "ogDescription": "apt full-upgrade con comprobación de repositorios, autoremove/autoclean y confirmación de reinicio cuando es necesario."
   },
   "header": {
     "title": "Actualización del sistema Proxmox",
-    "description": "Wrapper que delega en un único worker seguro (<code>update-pve-safe.sh</code>) que detecta la versión mayor de Proxmox por sí mismo. Los repositorios configurados se leen a través de la API de Proxmox y se mantienen como están; en un host sin suscripción activa cuyo único repositorio de Proxmox es Enterprise se pregunta antes de cambiar a sin suscripción. Se actualizan todos los paquetes, se recompilan los drivers DKMS gestionados por ProxMenux si aterriza un kernel nuevo y el prompt de reinicio solo se dispara cuando el kernel realmente cambió. También lanzable desde el botón <em>Update Now</em> de la cabecera del dashboard de ProxMenux Monitor cuando se detectan actualizaciones pendientes.",
+    "description": "Delega en un único script (<code>update-pve-safe.sh</code>) que detecta la versión mayor de Proxmox en ejecución. Los repositorios configurados se leen mediante la API de Proxmox y se conservan; si un host sin suscripción solo tiene Enterprise, se pide confirmación antes de cambiar a no-subscription. El script actualiza los paquetes y recompila los controladores DKMS gestionados por ProxMenux para un kernel pendiente de arrancar. El script principal ofrece reiniciar si existe la marca de reinicio del sistema o si el kernel más reciente instalado difiere del que está en ejecución. También se puede iniciar desde <em>Update Now</em> en la cabecera de ProxMenux Monitor cuando se detectan actualizaciones pendientes.",
     "section": "Utilidades"
   },
   "calloutWhat": {
@@ -21,81 +21,81 @@
     "outro": "Esa única línea es el comando oficial en cualquier release actual de Proxmox. La parte difícil no es el upgrade en sí; es asegurar que los repositorios están limpios, que están habilitados los correctos y que el host queda en un estado razonable después."
   },
   "onTop": {
-    "heading": "Qué hace ProxMenux encima — verificado contra el script",
-    "intro": "Esta opción ejecuta <strong>exactamente</strong> el comando apt de arriba, envuelto con la higiene de repos, la recompilación DKMS de los drivers gestionados por ProxMenux y la limpieza post-upgrade que la guía oficial de upgrade también recomienda. Todo lo de abajo mapea 1:1 a <code>scripts/utilities/proxmox_update.sh</code> y al único worker seguro <code>scripts/global/update-pve-safe.sh</code> — nada implícito, cada paso está en el código:",
+    "heading": "Qué añade ProxMenux: verificado en el código",
+    "intro": "Usa <strong>la misma operación apt full-upgrade</strong>, con comprobación de repositorios, recompilación DKMS y limpieza posterior. Los pasos siguientes corresponden a <code>scripts/utilities/proxmox_update.sh</code> y a su único script de ejecución, <code>scripts/global/update-pve-safe.sh</code>:",
     "items": [
-      "<strong>Detecta la versión mayor de PVE</strong> desde dentro del worker (<code>pveversion | grep -oP ''pve-manager/\\K[0-9]+''</code>) y adapta las URLs base de repo Proxmox / Debian (bookworm en PVE 8, trixie en PVE 9). No hay reparto a scripts worker por versión — un único worker seguro maneja ambas.",
+      "<strong>Detecta la versión mayor de PVE</strong> dentro del script (<code>pveversion | grep -oP ''pve-manager/\\K[0-9]+''</code>). Un único script gestiona PVE 8 y PVE 9; los repositorios configurados se conservan salvo que un host sin suscripción acepte el cambio ofrecido.",
       "<strong>Mantiene los repositorios configurados.</strong> <code>ensure_repositories</code> lee los repositorios a través de la API de repositorios de Proxmox, junto con el estado de la suscripción. Un host con suscripción activa, o que ya usa el repositorio sin suscripción o el de test, se deja sin cambios. En un host sin suscripción activa cuyo único repositorio de Proxmox es Enterprise se pregunta si se cambia a sin suscripción; al rechazarlo, la actualización se detiene sin modificar ninguna fuente.",
-      "<strong>Ejecuta el upgrade no interactivamente</strong> con <code>DEBIAN_FRONTEND=noninteractive</code> y <code>--force-confdef --force-confold</code> — si un archivo de configuración que ya modificaste también cambió upstream, tu versión se queda en su sitio. Sin sobrescrituras silenciosas de configuraciones propias.",
-      "<strong>No fuerza utilidades opcionales.</strong> El worker seguro no empuja <code>zfsutils-linux</code>, <code>chrony</code>, <code>ifupdown2</code> ni paquetes similares al host — una instalación de Proxmox que optó por no tener alguno de ellos conserva su elección. La ausencia de paquetes la surface los flujos de instalación de alto nivel, no la ruta de actualización.",
-      "<strong>Comprobación de sanity de metadatos LVM</strong> contra cabeceras PV sueltas de discos en passthrough (solo aviso, sin arreglo automático).",
+      "<strong>Ejecuta la actualización sin interacción</strong> con <code>DEBIAN_FRONTEND=noninteractive</code> y <code>--force-confdef --force-confold</code>. Para las decisiones sobre archivos de configuración de dpkg, acepta la acción predeterminada si existe; en caso contrario conserva el archivo actual.",
+      "<strong>No fuerza la instalación de utilidades opcionales.</strong> El script no instala por la fuerza <code>zfsutils-linux</code>, <code>chrony</code>, <code>ifupdown2</code> ni paquetes similares. Una instalación de Proxmox que haya prescindido de alguno mantiene esa elección. Los paquetes que faltan se señalan en los procesos de instalación superiores, no en el de actualización.",
+      "<strong>Comprobación y reparación de metadatos LVM.</strong> Detecta cabeceras PV antiguas y ejecuta vgck --updatemetadata y vgchange -ay para los grupos de volúmenes afectados. Puede cambiar metadatos LVM; no se limita a mostrar avisos.",
       "<strong>Limpia después:</strong> <code>apt-get autoremove -y</code> + <code>apt-get autoclean -y</code>.",
-      "<strong>Recompilación DKMS antes del prompt de reinicio.</strong> Cuando el upgrade dejó staged un kernel nuevo, el wrapper llama a <code>pmx_rebuild_dkms_after_kernel</code> para recompilar cada driver que ProxMenux instaló vía DKMS contra la versión del kernel entrante — así los módulos están listos antes de que la caja vuelva a arrancar. La detección de reinicio usa <code>/var/run/reboot-required</code> cuando <code>needrestart</code> está presente, y como fallback una comparación por <code>dpkg-query</code> entre el kernel en ejecución y el paquete <code>proxmox-kernel-*-pve-signed</code> / <code>pve-kernel-*-pve</code> más nuevo instalado cuando no lo está — señal que sobrevive a los muchos hosts Proxmox que se entregan sin <code>needrestart</code>."
+      "<strong>Recompilación DKMS antes de ofrecer el reinicio.</strong> El script de ejecución llama a <code>pmx_rebuild_dkms_after_kernel</code> cuando hay un kernel instalado más reciente pendiente de arrancar. El script principal comprueba <code>/var/run/reboot-required</code> y usa también <code>dpkg-query</code> para comparar el kernel que indica <code>uname -r</code> con el paquete <code>proxmox-kernel-*-pve-signed</code> / <code>pve-kernel-*-pve</code> más reciente instalado. La marca puede faltar en hosts sin <code>needrestart</code>; la comparación de kernels sigue funcionando en ese caso."
     ]
   },
   "calloutOneSentence": {
     "title": "En una frase",
-    "body": "El mismo upgrade que Proxmox te dice que ejecutes, más la limpieza de repos, la comprobación de paquetes esenciales, el escaneo de sanity de LVM, el autoremove/autoclean después y un preguntar antes de reiniciar solo cuando toca."
+    "body": "Actualiza los paquetes del host, conserva los repositorios configurados salvo que aceptes un cambio, comprueba los metadatos LVM, recompila los controladores DKMS gestionados, limpia con autoremove/autoclean y ofrece reiniciar cuando es necesario."
   },
   "confirm": {
     "heading": "Diálogo de confirmación",
-    "intro": "Seleccionar la opción abre un resumen de lo que va a hacer el worker, requiriendo una confirmación explícita:",
-    "imageAlt": "Diálogo de confirmación de Actualización del sistema Proxmox listando higiene de repos, actualizaciones de paquetes, limpieza"
+    "intro": "Al seleccionar la opción se abre un resumen de lo que hará el script y se solicita confirmación explícita:",
+    "imageAlt": "Diálogo de confirmación de la actualización del sistema Proxmox con comprobación de repositorios, actualización de paquetes y limpieza"
   },
   "routes": {
-    "heading": "Cómo enruta el wrapper",
+    "heading": "Cómo se delega la ejecución",
     "nodes": {
       "source": {
         "label": "proxmox_update.sh",
         "detail": "pveversion |\ngrep -oP ''pve-manager/\\K[0-9]+''"
       },
       "bridge": {
-        "label": "Único worker seguro",
+        "label": "Único script de ejecución",
         "detail": "update-pve-safe.sh\n(detecta PVE 8 / 9\ninternamente)"
       },
       "target": {
         "label": "Post-actualización",
-        "detail": "apt-get autoremove\napt-get autoclean\nPreguntar antes de reiniciar si toca"
+        "detail": "apt-get autoremove\napt-get autoclean\nConfirmación de reinicio si es necesario"
       }
     }
   },
   "worker": {
-    "heading": "Qué hace el worker",
-    "intro": "Un único worker (<code>scripts/global/update-pve-safe.sh</code>) maneja tanto PVE 8 como PVE 9. Detecta la versión mayor internamente y usa el codename propio de cada versión (<code>bookworm</code> o <code>trixie</code>) para sus fuentes base. Las etapas son:",
+    "heading": "Qué hace el script de ejecución",
+    "intro": "Un único script (<code>scripts/global/update-pve-safe.sh</code>) gestiona PVE 8 (<code>bookworm</code>) y PVE 9 (<code>trixie</code>). Detecta la versión mayor y comprueba la configuración actual de repositorios sin reescribir las fuentes base de Debian. Las etapas son:",
     "items": [
       "<strong>Comprobaciones previas.</strong> Verifica al menos ~1 GB libres en <code>/var/cache/apt/archives</code>. Aborta pronto con un mensaje claro cuando falla, para que la ejecución no muera a mitad de una transacción apt.",
       "<strong>Comprobación de repositorios.</strong> <code>ensure_repositories</code> lee los repositorios y el estado de la suscripción. En un host con un repositorio de Proxmox utilizable no cambia nada; en un host sin suscripción activa y solo con el repositorio Enterprise pregunta antes de cambiar a sin suscripción, y detiene la actualización cuando la respuesta es no.",
       "<strong>Apt update con auto-recuperación de GPG.</strong> Ante un <code>NO_PUBKEY</code> de cualquier repo (los propios o uno de terceros), el worker importa la clave que falta y vuelve a intentar automáticamente antes de fallar.",
       "<strong>Actualizaciones pendientes + conteo de seguridad.</strong> Reporta cuántos paquetes van a cambiar y cuántos de esos vienen de la suite de seguridad, para que el diálogo de confirmación tenga números reales que mostrar.",
-      "<strong>Diálogo de confirmación.</strong> El wrapper pide un sí explícito antes de tocar apt.",
-      "<strong>apt full-upgrade.</strong> Se ejecuta con <code>DEBIAN_FRONTEND=noninteractive</code> y <code>--force-confdef --force-confold</code> para que cualquier archivo de configuración que personalizaste mantenga su contenido actual cuando upstream también lo cambió. Nunca sobrescribe silenciosamente configs editados por el usuario.",
-      "<strong>Comprobación de sanity LVM.</strong> <code>lvm_repair_check</code> refresca los metadatos de VG cuando discos en passthrough a VMs guest (DSM, TrueNAS, appliances de almacenamiento) vuelven con cabeceras PV antiguas.",
-      "<strong>Recompilación DKMS de los drivers gestionados por ProxMenux.</strong> Cuando el upgrade dejó staged un kernel nuevo, <code>pmx_rebuild_dkms_after_kernel</code> lee <code>components_status.json</code> para los drivers que ProxMenux instaló (actualmente <code>nvidia_driver</code> → módulo <code>nvidia</code>, <code>coral_driver</code> → módulo <code>gasket</code>), instala los headers de kernel correspondientes (<code>proxmox-headers-&lt;newkver&gt;</code> cuando está disponible, si no <code>pve-headers-&lt;newkver&gt;</code>) y ejecuta <code>dkms autoinstall -k &lt;newkver&gt;</code>. Si <code>dkms status</code> no muestra los módulos construidos contra el kernel nuevo, el worker cae a reejecutar cada instalador con <code>--auto-reinstall</code>. Cualquier fallo se registra pero no aborta la actualización — llegas al prompt de reinicio en todos los casos.",
-      "<strong>Post-limpieza.</strong> <code>apt-get autoremove</code> + <code>apt-get autoclean</code> antes de devolver el control al wrapper."
+      "<strong>Diálogo de confirmación.</strong> Tras refrescar las listas de paquetes, el script solicita un sí explícito antes de ejecutar la actualización de paquetes.",
+      "<strong>apt full-upgrade.</strong> Usa <code>DEBIAN_FRONTEND=noninteractive</code> y <code>--force-confdef --force-confold</code>. Dpkg aplica su acción predeterminada a las decisiones sobre archivos de configuración cuando existe; en caso contrario conserva el archivo actual.",
+      "<strong>Comprobación de LVM.</strong> <code>lvm_repair_check</code> actualiza los metadatos de los grupos de volúmenes cuando los discos cedidos directamente a máquinas virtuales (DSM, TrueNAS o dispositivos de almacenamiento) vuelven con cabeceras PV antiguas.",
+      "<strong>Recompilación DKMS de los controladores gestionados por ProxMenux.</strong> Cuando hay un kernel nuevo pendiente de arrancar, <code>pmx_rebuild_dkms_after_kernel</code> consulta en <code>components_status.json</code> los controladores instalados por ProxMenux (actualmente <code>nvidia_driver</code> → módulo <code>nvidia</code> y <code>coral_driver</code> → módulo <code>gasket</code>), instala las cabeceras correspondientes (<code>proxmox-headers-&lt;newkver&gt;</code> si está disponible; si no, <code>pve-headers-&lt;newkver&gt;</code>) y ejecuta <code>dkms autoinstall -k &lt;newkver&gt;</code>. Si <code>dkms status</code> no muestra los módulos compilados para el kernel nuevo, vuelve a ejecutar cada instalador con <code>--auto-reinstall</code>. Los fallos se registran sin cancelar la actualización, que continúa hasta la confirmación de reinicio.",
+      "<strong>Limpieza posterior.</strong> <code>apt-get autoremove</code> + <code>apt-get autoclean</code> antes de devolver el control al script principal."
     ]
   },
   "post": {
     "heading": "Limpieza post-actualización y reinicio",
-    "intro": "Tras salir el worker, el wrapper ejecuta:",
+    "intro": "Cuando finaliza el script de ejecución, el script principal ejecuta:",
     "code": "apt-get autoremove -y    # drop unused dependencies pulled in by old packages\napt-get autoclean        # drop downloaded .deb files no longer in the index",
-    "afterCode": "Después comprueba si hace falta un reinicio. Dos señales disparan el prompt:",
+    "afterCode": "El script principal también comprueba si hace falta reiniciar. Cualquiera de estas señales activa la pregunta:",
     "items": [
-      "<code>/var/run/reboot-required</code> existe (creado por el hook post-install del paquete del kernel)",
-      "El log del upgrade contiene entradas de <code>linux-image</code> (el kernel se actualizó de verdad)"
+      "Existe <code>/var/run/reboot-required</code>: un paquete o una herramienta del sistema ha marcado que el host necesita reiniciarse.",
+      "El paquete de kernel Proxmox más reciente instalado difiere del kernel en ejecución, según <code>dpkg-query</code> y uname -r."
     ],
-    "outro": "Si alguna es cierta, un diálogo whiptail pregunta <em>\"Some changes require a reboot to take effect. Do you want to restart now?\"</em>. Decline para seguir corriendo en el kernel antiguo hasta que elijas reiniciar manualmente (p. ej. durante una ventana de mantenimiento planificada)."
+    "outro": "Si se cumple alguna condición, un diálogo de whiptail pregunta <em>«Algunos cambios requieren reiniciar para aplicarse. ¿Quieres reiniciar ahora?»</em>. Recházalo para seguir con el kernel actual hasta que decidas reiniciar manualmente, por ejemplo durante una ventana de mantenimiento."
   },
   "end": {
     "heading": "Qué ves al final",
-    "intro": "Cuando el worker termina, el terminal muestra la salida de la limpieza y (si el kernel cambió) el preguntar antes de reiniciar:",
-    "imageAlt": "Resumen de finalización de Actualización del sistema Proxmox con salida de limpieza y preguntar antes de reiniciar"
+    "intro": "Cuando termina el script de ejecución, el terminal muestra el resultado de la limpieza y, si hace falta reiniciar, la pregunta correspondiente:",
+    "imageAlt": "Resumen final de la actualización del sistema Proxmox con el resultado de la limpieza y la confirmación de reinicio"
   },
   "calloutDeclineReboot": {
-    "title": "Decline el reinicio solo si sabes por qué",
-    "body": "Correr en un kernel antiguo tras actualizar <code>linux-image-*</code> significa que estás en un sistema medio actualizado: userspace nuevo, kernel viejo. La mayoría del tiempo las cosas funcionan, pero los módulos ZFS, grupos IOMMU, KSMBD y cualquier driver fuera del árbol solo cuadran con el kernel para el que fueron construidos — un desajuste produce fallos oscuros. Reinicia en el primer momento razonable."
+    "title": "Pospón el reinicio solo si sabes por qué",
+    "body": "Instalar un paquete <code>proxmox-kernel-*</code> nuevo no sustituye al kernel en ejecución hasta que reinicies. El nuevo kernel y sus módulos correspondientes se activan en el siguiente arranque. Planifica el reinicio para una ventana de mantenimiento adecuada y revisa antes los avisos de compilación DKMS."
   },
   "noSub": {
-    "heading": "Cómo trata el worker seguro al repositorio Enterprise",
+    "heading": "Cómo trata el script al repositorio Enterprise",
     "intro": "Proxmox entrega los hosts con el repositorio Enterprise habilitado por defecto. Sin una suscripción activa, ese repositorio devuelve 401 en <code>apt-get update</code>. El worker seguro cambia los repositorios solo en ese caso, solo tras preguntar, y a través de la API de repositorios de Proxmox — la misma que hay detrás de <em>Nodo → Actualizaciones → Repositorios</em>. Lo que ocurre en cada caso:",
     "items": [
       "Con una <strong>suscripción activa</strong>, los repositorios se dejan sin cambios y Enterprise dirige la actualización.",
@@ -117,7 +117,7 @@
       "<strong>Salto de versión mayor.</strong> 8 → 9 es una operación aparte — mira <link>Actualizar PVE 8 a PVE 9</link>.",
       "<strong>Backup.</strong> Sin snapshots, sin rollback. Las operaciones de apt no son transaccionales. Combínalo con tu disciplina normal de backups (PBS, vzdump, snapshots ZFS).",
       "<strong>Actualizaciones de contenedores / VMs.</strong> Solo se actualiza el host; los guests se quedan en paz.",
-      "<strong>Actualizaciones de firmware.</strong> Microcódigo de CPU, firmware de NIC, BIOS — fuera de alcance."
+      "<strong>Instalación específica de firmware.</strong> Esta herramienta no sirve para flashear BIOS ni firmware de dispositivos. Los paquetes de firmware o microcódigo de CPU ya instalados pueden recibir actualizaciones mediante apt."
     ]
   },
   "troubleshooting": {
@@ -129,21 +129,21 @@
       },
       {
         "title": "dist-upgrade se queda colgado en \"Configuring grub-pc\"",
-        "body": "Un prompt de dpkg está preguntando en qué dispositivo(s) instalar GRUB. El wrapper pasa <code>--force-confold</code> para archivos de configuración pero la instalación del cargador de arranque es un prompt aparte. Usa <kbd>Tab</kbd> + <kbd>Space</kbd> para seleccionar todos tus discos de arranque, después OK. Mejor evitarlo seleccionando los discos de arranque una vez con <code>dpkg-reconfigure grub-pc</code> de antemano."
+        "body": "Si aparece una pregunta interactiva de GRUB, solicita los dispositivos donde instalar el cargador de arranque. La opción <code>--force-confold</code> se aplica a decisiones sobre archivos de configuración, no a esta selección de dispositivos. Usa <kbd>Tab</kbd> + <kbd>Space</kbd> para seleccionar los discos de arranque adecuados y después OK. Puedes configurar esta selección de antemano con <code>dpkg-reconfigure grub-pc</code>."
       },
       {
         "title": "El kernel se actualizó pero los nuevos módulos faltan para un driver fuera del árbol",
-        "body": "Los drivers que ProxMenux instaló vía DKMS (actualmente <code>nvidia_driver</code> y <code>coral_driver</code>) se recompilan automáticamente al final del upgrade contra la versión del kernel entrante, usando <code>dkms autoinstall -k &lt;newkver&gt;</code> y, si hace falta, un fallback a cada instalador con <code>--auto-reinstall</code>. Confirma con <code>dkms status</code>. Los módulos fuera del árbol de terceros que no están en el registro <code>components_status.json</code> de ProxMenux (drivers de NIC propios, paquetes DKMS instalados a mano, …) siguen necesitando un <code>dkms autoinstall</code> manual — el worker seguro solo toca lo que instaló originalmente."
+        "body": "Para los controladores gestionados (<code>nvidia_driver</code> y <code>coral_driver</code>), la función ejecuta <code>dkms autoinstall -k &lt;newkver&gt;</code> y puede volver a ejecutar sus instaladores con <code>--auto-reinstall</code>. Comprueba el resultado con <code>dkms status</code>. El comando autoinstall también puede recompilar otros módulos DKMS registrados; la ejecución alternativa de instaladores se limita a las entradas gestionadas de <code>components_status.json</code>. Revisa cualquier módulo de terceros que siga faltando y recompílalo con <code>dkms autoinstall</code> si hace falta."
       },
       {
-        "title": "El preguntar antes de reiniciar no apareció pero estoy seguro de que el kernel cambió",
-        "body": "Tienen que coincidir dos señales (<code>/var/run/reboot-required</code> y <code>linux-image</code> en el log del upgrade). Si el archivo marcador se borró pero el log se está parseando mal, reinicia manualmente con <code>shutdown -r now</code>. Para confirmar que hubo una actualización de kernel: <code>grep linux-image /var/log/apt/history.log</code>."
+        "title": "No apareció la pregunta de reinicio, pero creo que se instaló un kernel nuevo",
+        "body": "Las señales son alternativas: <code>/var/run/reboot-required</code> o una diferencia entre el kernel en ejecución y el Proxmox más reciente instalado. El script principal no analiza entradas linux-image del registro de apt. Comprueba la versión en ejecución con <code>uname -r</code> y los paquetes de kernel instalados con <code>dpkg-query</code>. Si hace falta reiniciar, prográmalo o ejecuta <code>shutdown -r now</code> cuando estés listo."
       }
     ]
   },
   "files": {
     "heading": "Archivos implicados",
-    "code": "scripts/utilities/proxmox_update.sh              # este script (wrapper)\nscripts/global/update-pve-safe.sh                # único worker seguro (PVE 8 + PVE 9)\nscripts/global/repository-functions.sh           # ensure_repositories\nscripts/global/repository_policy.py              # lee y cambia los repositorios a través de la API de Proxmox\nscripts/global/utils-install-functions.sh        # pmx_rebuild_dkms_after_kernel\n/usr/local/share/proxmenux/components_status.json # registro de drivers DKMS gestionados por ProxMenux\n/etc/apt/sources.list.d/proxmox.sources          # fuente sin suscripción, escrita por Proxmox al aceptar el cambio\n/var/run/reboot-required                         # se lee para decidir el prompt de reinicio\n# Fallback de reinicio cuando needrestart no está instalado:\n# dpkg-query -W 'proxmox-kernel-*-pve-signed' 'pve-kernel-*-pve' vs. uname -r"
+    "code": "scripts/utilities/proxmox_update.sh              # this script (wrapper)\nscripts/global/update-pve-safe.sh                # single safe worker (PVE 8 + PVE 9)\nscripts/global/repository-functions.sh           # ensure_repositories\nscripts/global/repository_policy.py              # reads and switches repositories through the Proxmox API\nscripts/global/utils-install-functions.sh        # pmx_rebuild_dkms_after_kernel\n/usr/local/share/proxmenux/components_status.json # ProxMenux-managed DKMS driver registry\n/etc/apt/sources.list.d/proxmox.sources          # no-subscription source, written by Proxmox when the switch is accepted\n/var/run/reboot-required                         # read to decide on reboot prompt\n# Reboot fallback when needrestart isn't installed:\n# dpkg-query -W 'proxmox-kernel-*-pve-signed' 'pve-kernel-*-pve' vs. uname -r"
   },
   "related": {
     "heading": "Relacionado",
@@ -156,11 +156,11 @@
       {
         "href": "/docs/utils/system-utils",
         "label": "Instalador de utilidades del sistema",
-        "tail": " — para instalar las herramientas CLI que quieras alrededor de las actualizaciones (htop / btop / ncdu)."
+        "tail": " — para instalar herramientas CLI útiles durante las actualizaciones (htop / btop / ncdu)."
       },
       {
         "href": "/docs/utils",
-        "label": "Resumen de Utilidades",
+        "label": "Resumen de utilidades",
         "tail": " — volver al resumen de la sección."
       }
     ]
diff --git a/web/messages/es/docs/utils/system-utils.json b/web/messages/es/docs/utils/system-utils.json
index 62cae0e0..37c79df0 100644
--- a/web/messages/es/docs/utils/system-utils.json
+++ b/web/messages/es/docs/utils/system-utils.json
@@ -1,18 +1,18 @@
 {
   "meta": {
-    "title": "Instalador de utilidades del sistema | ProxMenux Documentation",
-    "description": "Instalador curado para 26 utilidades CLI (htop, btop, iperf3, jq, tmux, ncdu, ...) en Proxmox VE. Selección personalizada o grupos predefinidos (básico, dev, compresión, multiplexores, análisis, red). Usa el flujo canónico ensure_repositories + install_single_package.",
-    "ogTitle": "Instalador de utilidades del sistema | ProxMenux Documentation",
-    "ogDescription": "Instala herramientas CLI curadas en Proxmox VE con un clic o con selección personalizada."
+    "title": "Instalador de utilidades del sistema | Documentación de ProxMenux",
+    "description": "Instalador de utilidades CLI para Proxmox VE, con 25 paquetes en la lista canónica (htop, btop, iperf3, tmux, ...). Selección personalizada, instalación completa y grupos predefinidos (básico, desarrollo, compresión, multiplexores, análisis y red). Los grupos pueden incluir paquetes adicionales. Usa ensure_repositories + install_single_package.",
+    "ogTitle": "Instalador de utilidades del sistema | Documentación de ProxMenux",
+    "ogDescription": "Instala una selección de herramientas CLI en Proxmox VE con un clic o mediante selección personalizada."
   },
   "header": {
     "title": "Instalador de utilidades del sistema",
-    "description": "Selector curado para 26 utilidades CLI definidas en la lista canónica PROXMENUX_UTILS. Ofrece selección personalizada, instalar todo, seis grupos predefinidos y una comprobación de verificación de instalaciones. Usa el par compartido ensure_repositories() + install_single_package() para que la configuración de repos y el feedback por paquete se mantengan consistentes en todo el proyecto.",
+    "description": "Selector de las 25 utilidades CLI de la lista canónica PROXMENUX_UTILS. Ofrece selección personalizada, instalación completa, seis grupos predefinidos y comprobación de instalaciones. Los grupos pueden incluir herramientas ajenas a la lista canónica. Usa las funciones compartidas ensure_repositories() + install_single_package() para gestionar los repositorios y los mensajes de cada paquete de forma coherente.",
     "section": "Utilidades"
   },
   "info": {
     "title": "Qué hace",
-    "body": "Instala herramientas CLI de una lista curada de 26 paquetes. Cada instalación pasa por el mismo flujo canónico: <code>ensure_repositories</code> comprueba que el host tiene un repositorio de Proxmox utilizable para la versión mayor de PVE en ejecución, después <code>install_single_package</code> ejecuta la instalación y verifica que el comando resultante esté en PATH."
+    "body": "Instala herramientas CLI de una lista de 25 paquetes. Cada instalación usa el mismo proceso: <code>ensure_repositories</code> comprueba que el host tenga un repositorio Proxmox utilizable para la versión mayor de PVE en ejecución; después <code>install_single_package</code> instala el paquete y comprueba que su comando esté en PATH."
   },
   "opening": {
     "heading": "Abrir el instalador",
@@ -26,7 +26,7 @@
     "rows": [
       {
         "option": "1. Selección personalizada",
-        "behaviourRich": "Checklist de diálogo con los 26 paquetes. Usa SPACE para alternar, ENTER para confirmar; solo se instalan los seleccionados."
+        "behaviourRich": "Lista de selección de los 25 paquetes. Usa SPACE para marcar y ENTER para confirmar; solo se instalan los paquetes seleccionados."
       },
       {
         "option": "2. Instalar TODAS las utilidades",
@@ -63,7 +63,7 @@
     ]
   },
   "packages": {
-    "heading": "Los 26 paquetes",
+    "heading": "Los 25 paquetes",
     "intro": "Definidos en el compartido <code>scripts/global/utils-install-functions.sh</code> como <code>PROXMENUX_UTILS</code> (formato: <code>package:verify_command:description</code>). Otros scripts de ProxMenux (p. ej. los lanzadores de monitorización de red para iftop / iptraf-ng / iperf3) reutilizan entradas de esta lista para que paquete + comando de verificación se mantengan sincronizados.",
     "headerPackage": "Paquete",
     "headerVerify": "Comando de verificación",
@@ -193,11 +193,6 @@
         "package": "zip",
         "verify": "zip",
         "description": "Crear archivos ZIP"
-      },
-      {
-        "package": "libguestfs-tools",
-        "verify": "virt-filesystems",
-        "description": "Utilidades de disco de VM"
       }
     ]
   },
@@ -209,30 +204,30 @@
     ],
     "verifyIntro": "Tras instalar, el comando de verificación se comprueba con <code>command -v \"$verify_cmd\"</code>. Tres desenlaces:",
     "verifyOutcomes": [
-      "<strong>0 (éxito):</strong> comando disponible, paquete contado como <em>Successful</em>.",
-      "<strong>1 (fallido):</strong> apt falló, contado como <em>Failed</em>.",
-      "<strong>2 (advertencia):</strong> apt tuvo éxito pero el comando aún no está en PATH (refresco de hash pendiente) — contado como <em>With warnings</em>."
+      "<strong>0 (correcto):</strong> comando disponible; el paquete se cuenta como <em>Correcto</em>.",
+      "<strong>1 (fallo):</strong> apt ha fallado; se cuenta como <em>Fallido</em>.",
+      "<strong>2 (advertencia):</strong> apt ha terminado correctamente, pero el comando esperado no se encuentra en PATH; se cuenta como <em>Con advertencias</em>."
     ],
-    "summary": "Al final de una instalación de grupo / personalizada, un diálogo de resumen muestra los conteos de <em>Successful / With warnings / Failed</em>."
+    "summary": "Al terminar una instalación de grupo o personalizada, un diálogo muestra los recuentos de <em>Correctos / Con advertencias / Fallidos</em>."
   },
   "verify": {
     "heading": "Verificar instalaciones",
     "intro": "La opción 9 es de solo lectura: recorre <code>PROXMENUX_UTILS</code> y ejecuta <code>command -v</code> para cada comando de verificación. La salida se ve así:",
-    "code": "Total: 26\nAvailable: 18\nMissing: 8\n\n✓ axel - Download accelerator\n✓ aria2c - Multi-source downloader\n✓ btop - Modern resource monitor\n✗ cabextract - Extract CAB files\n✓ dos2unix - Convert DOS / Unix text files\n✗ genisoimage - Create ISO images\n✓ grc - Generic log colorizer\n...",
+    "code": "Total: 25\nAvailable: 18\nMissing: 8\n\n✓ axel - Download accelerator\n✓ aria2c - Multi-source downloader\n✓ btop - Modern resource monitor\n✗ cabextract - Extract CAB files\n✓ dos2unix - Convert DOS / Unix text files\n✗ genisoimage - Create ISO images\n✓ grc - Generic log colorizer\n...",
     "outro": "Útil antes de ejecutar scripts que dependen de estas herramientas (p. ej. <code>uup_dump_iso_creator.sh</code> necesita <code>aria2c</code> + <code>cabextract</code> + <code>wimlib-imagex</code>). Si falta algo, ejecuta la instalación del grupo correspondiente o elige los paquetes que faltan mediante selección personalizada."
   },
   "troubleshoot": {
     "heading": "Solución de problemas",
-    "reposTitle": "\"Failed to configure repositories. Installation aborted.\"",
+    "reposTitle": "«No se pudieron configurar los repositorios. Instalación cancelada.»",
     "reposBody": "La comprobación de repositorios no se superó: se rechazó el cambio al repositorio sin suscripción, no se pudo leer el estado de la suscripción o una entrada de repositorio requiere atención. El mensaje impreso justo encima indica la causa. Los repositorios se listan en <em>Nodo → Actualizaciones → Repositorios</em>, y <code>apt-get update</code> desde una consola muestra el error que reporta apt.",
     "warningsTitle": "Un paquete se reporta como \"With warnings\" pero el comando funciona tras cerrar el menú",
-    "warningsBody": "Esperado. Tras <code>apt-get install</code>, el nuevo binario está en disco pero la caché de PATH del shell actual (<code>hash -t</code>) aún no lo sabe. ProxMenux ejecuta <code>hash -r</code> tras cada instalación, pero en algunos shells el refresco solo surte efecto en el siguiente prompt. Abre un nuevo shell y el comando funcionará.",
+    "warningsBody": "Después de <code>apt-get install</code>, la función ejecuta <code>hash -r</code>, espera brevemente y comprueba el comando esperado con <code>command -v</code>. Una advertencia indica que esa comprobación sigue fallando, pero no identifica la causa. Prueba con una sesión de shell nueva y comprueba la instalación del paquete y PATH si el comando sigue faltando.",
     "hangsTitle": "Un apt install se queda colgado",
     "hangsBody": "Lo más probable es que un prompt de debconf esté bloqueado detrás de la salida silenciada. El script envuelve todas las llamadas de apt con <code>DEBIAN_FRONTEND=noninteractive</code>, que normalmente suprime los prompts, pero algunos paquetes aún requieren entrada del usuario. Cancela con <kbd>Ctrl</kbd>+<kbd>C</kbd>, ejecuta <code>apt-get install -y &lt;pkg&gt;</code> manualmente desde un shell para ver el prompt y decidir."
   },
   "files": {
     "heading": "Archivos implicados",
-    "code": "scripts/utilities/system_utils.sh                    # este script\nscripts/global/utils-install-functions.sh            # PROXMENUX_UTILS, install_single_package\nscripts/global/repository-functions.sh               # ensure_repositories\nscripts/global/repository_policy.py                  # lee y cambia los repositorios a través de la API de Proxmox\n/etc/apt/sources.list.d/proxmox.sources              # fuente sin suscripción, escrita por Proxmox al aceptar el cambio"
+    "code": "scripts/utilities/system_utils.sh                    # this script\nscripts/global/utils-install-functions.sh            # PROXMENUX_UTILS, install_single_package\nscripts/global/repository-functions.sh               # ensure_repositories\nscripts/global/repository_policy.py                  # reads and switches repositories through the Proxmox API\n/etc/apt/sources.list.d/proxmox.sources              # no-subscription source, written by Proxmox when the switch is accepted"
   },
   "related": {
     "heading": "Relacionado",
@@ -249,7 +244,7 @@
       },
       {
         "href": "/docs/utils",
-        "label": "Resumen de Utilidades",
+        "label": "Resumen de utilidades",
         "tailRich": " — volver al resumen de la sección."
       }
     ]
diff --git a/web/messages/es/docs/utils/upgrade-pve8-pve9.json b/web/messages/es/docs/utils/upgrade-pve8-pve9.json
index 69b0d2e4..659a968f 100644
--- a/web/messages/es/docs/utils/upgrade-pve8-pve9.json
+++ b/web/messages/es/docs/utils/upgrade-pve8-pve9.json
@@ -1,8 +1,8 @@
 {
   "meta": {
-    "title": "Actualizar PVE 8 a PVE 9 | ProxMenux Documentation",
+    "title": "Actualizar PVE 8 a PVE 9 | Documentación de ProxMenux",
     "description": "Tres formas de actualizar Proxmox VE 8 a 9 (Debian Bookworm a Trixie + PVE 8 a 9): Automática / Desatendida, Interactiva o a mano siguiendo el procedimiento oficial de Proxmox paso a paso. Comprobación previa pve8to9, migración de repositorios, dist-upgrade con valores por defecto seguros, validación post-upgrade. Se niega a ejecutarse desde el terminal web.",
-    "ogTitle": "Actualizar PVE 8 a PVE 9 | ProxMenux Documentation",
+    "ogTitle": "Actualizar PVE 8 a PVE 9 | Documentación de ProxMenux",
     "ogDescription": "Tres enfoques de upgrade (Auto / Interactiva / Manual) para la migración de versión mayor de Proxmox VE 8 a 9."
   },
   "header": {
@@ -23,17 +23,17 @@
   },
   "modeMenu": {
     "heading": "El menú de modo",
-    "intro": "Al lanzar la opción se abre un menú con 4 vías. Las tres primeras son formas distintas de <em>realizar</em> el upgrade (elige la que se ajusta a tu nivel de comodidad); la cuarta es un diagnóstico que <em>verifica</em> que el host está listo sin cambiar nada:",
+    "intro": "Esta opción abre un menú con cuatro entradas: Automático, Interactivo, Comprobación previa y Guía manual. Tres opciones <em>realizan</em> la actualización o explican cómo hacerla; la comprobación independiente <em>verifica</em> los requisitos y puede ofrecer reparaciones.",
     "imageAlt": "Menú de modo del upgrade PVE 8 a 9 con opciones Automática, Interactiva, Comprobación previa y Guía manual"
   },
   "threeWays": {
     "heading": "Tres formas de actualizar",
-    "intro": "Mismo estado final, distinto nivel de implicación del operador. Ninguna deja saltarte las salvaguardas previas ni la verificación post-upgrade — la diferencia está puramente en cómo se manejan los prompts de dpkg durante <code>dist-upgrade</code> y si miras cada paso o lo delegas entero.",
+    "intro": "Los modos Automático e Interactivo ejecutan el mismo proceso, con comprobaciones previas y verificación posterior. Cambia cómo se responden las preguntas de dpkg durante <code>dist-upgrade</code>. La guía manual muestra los comandos, incluidas las comprobaciones, y tú debes completar cada paso.",
     "auto": {
       "title": "Automática / Desatendida",
-      "summary": "De un tirón. Establece <code>ASSUME_YES=1</code> + <code>DEBIAN_FRONTEND=noninteractive</code>; los conflictos de archivos de configuración de dpkg toman por defecto <strong>mantener el actual</strong> (<code>--force-confold</code>).",
+      "summary": "Establece <code>ASSUME_YES=1</code> + <code>DEBIAN_FRONTEND=noninteractive</code>. Para archivos de configuración modificados, dpkg utiliza su acción predeterminada si existe; en caso contrario, <strong>conserva el archivo actual</strong> (<code>--force-confold</code>).",
       "items": [
-        "Lo más rápido — sin esperas por prompts",
+        "Lo más rápido — sin preguntas de dpkg durante la actualización",
         "Mejor para instalaciones vanilla sin archivos de configuración personalizados",
         "Riesgo: una configuración que personalizaste se mantiene silenciosamente y puede tapar nuevos valores por defecto"
       ]
@@ -59,7 +59,7 @@
   },
   "precheckCallout": {
     "title": "Más una Comprobación previa aparte",
-    "body": "La opción 3 del menú — <strong>Ejecutar comprobación PVE 8 a 9</strong> — no es un modo de upgrade. Ejecuta el <code>pve8to9 --full</code> oficial de Proxmox y ofrece reparación guiada para los problemas bloqueantes comunes, después <strong>se detiene</strong>. Úsala antes de comprometerte con cualquiera de los tres modos de arriba. También se ejecuta automáticamente como parte de cada flujo de upgrade, así que esta opción independiente es para verificación temprana o para volver a ejecutarla tras arreglos manuales."
+    "body": "La opción 3 — <strong>Ejecutar la comprobación de PVE 8 a 9</strong> — ejecuta la herramienta oficial <code>pve8to9 --full</code>, ofrece reparaciones guiadas para problemas habituales y después <strong>se detiene</strong>. Úsala antes de actualizar o tras reparar manualmente. Los modos Automático e Interactivo también la ejecutan; la guía manual indica que debes ejecutarla tú."
   },
   "webTerminal": {
     "heading": "Por qué se bloquea el terminal web",
@@ -69,7 +69,7 @@
   },
   "auto": {
     "heading": "Modo Automático / Desatendido",
-    "intro": "La ruta totalmente desatendida. Cada prompt de dpkg se autocontesta con valores por defecto seguros para que el upgrade corra de principio a fin sin entrada del operador. Úsalo en instalaciones vanilla donde no has editado a mano archivos de configuración, o cuando ejecutas el upgrade como parte de una ventana de mantenimiento y solo quieres que termine.",
+    "intro": "Las preguntas de paquetes y archivos de configuración usan los valores predeterminados de la tabla siguiente, y un 401 del repositorio Enterprise cambia a no-subscription sin preguntar. La confirmación de la actualización, el resumen de la actualización de PVE 8, las reparaciones de la comprobación previa y la pregunta de reinicio se siguen mostrando.",
     "behaviourHeading": "Comportamiento específico del modo automático",
     "behaviourTable": {
       "settingHeader": "Ajuste",
@@ -77,11 +77,11 @@
       "rows": [
         {
           "settingRich": "<code>ASSUME_YES=1</code>",
-          "effectRich": "Flag interno — cada confirmación sí/no del script se autoconfirma"
+          "effectRich": "Flag interno — el script responde sí a sus propias preguntas, como cambiar a no-subscription tras un 401"
         },
         {
           "settingRich": "<code>DEBIAN_FRONTEND=noninteractive</code>",
-          "effectRich": "apt / dpkg corren sin abrir ningún prompt de debconf"
+          "effectRich": "apt / dpkg se ejecutan sin abrir preguntas de debconf"
         },
         {
           "settingRich": "<code>--force-confdef</code>",
@@ -89,13 +89,13 @@
         },
         {
           "settingRich": "<code>--force-confold</code>",
-          "effectRich": "Para archivos que personalizaste: <strong>mantener tu versión</strong> — nunca sobrescribir"
+          "effectRich": "Para archivos modificados: utiliza la acción predeterminada de dpkg si existe; en caso contrario, <strong>conserva tu versión</strong>."
         }
       ]
     },
     "flowHeading": "Flujo del modo automático",
-    "flowIntro": "Seis fases secuenciales. Cualquier fallo en las fases 1-4 aborta limpiamente y el host se queda en PVE 8 — nada se ha escrito aún. La fase 5 (<code>dist-upgrade</code>) es el punto de no retorno.",
-    "flowDiagram": "┌─────────────────────────────────────────────────────────────────┐\n│  1. PRE-FLIGHT CHECKS                              (read-only)  │\n│─────────────────────────────────────────────────────────────────│\n│  • Block if running from web terminal (termproxy / vncshell)    │\n│  • Abort if host already on PVE 9.x                             │\n│  • Verify ≥ 1024 MB free in /var/cache/apt/archives             │\n│  • Ping download.proxmox.com                                    │\n│  • If Ceph is installed: must already be on 19.x Squid          │\n│  • Run pve8to9 --full → no FAILs (offer guided repair if any)   │\n└────────────────────────────────┬────────────────────────────────┘\n                                 │  all pass\n                                 ▼\n┌─────────────────────────────────────────────────────────────────┐\n│  2. BRING PVE 8 TO LATEST 8.4.x                                 │\n│─────────────────────────────────────────────────────────────────│\n│  • Delegate to scripts/global/update-pve8.sh                    │\n│  • Final apt update + dist-upgrade on the 8.x branch            │\n│  • Ensures the documented upgrade prerequisites are met         │\n└────────────────────────────────┬────────────────────────────────┘\n                                 │\n                                 ▼\n┌─────────────────────────────────────────────────────────────────┐\n│  3. REPOSITORY MIGRATION                                        │\n│─────────────────────────────────────────────────────────────────│\n│  • sed 's/bookworm/trixie/g' on /etc/apt/sources.list           │\n│    and any /etc/apt/sources.list.d/*.list                       │\n│  • Write deb822 .sources files for Proxmox + Debian + Ceph      │\n│  • Try Enterprise repo → fall back to no-subscription on 401    │\n│  • Comment out legacy .list files (do not delete yet)           │\n│  • apt-get update with retry logic                              │\n└────────────────────────────────┬────────────────────────────────┘\n                                 │\n                                 ▼\n┌─────────────────────────────────────────────────────────────────┐\n│  4. VALIDATE BEFORE WRITING ANYTHING                            │\n│─────────────────────────────────────────────────────────────────│\n│  • apt-cache policy proxmox-ve  →  candidate must be 9.x        │\n│  • apt-get -s dist-upgrade  (dry-run)                           │\n│       →  must NOT propose removing proxmox-ve                   │\n│  • Both must pass; otherwise abort with a clear message         │\n└────────────────────────────────┬────────────────────────────────┘\n                                 │  point of no return\n                                 ▼\n┌─────────────────────────────────────────────────────────────────┐\n│  5. RUN dist-upgrade  (UNATTENDED)                              │\n│─────────────────────────────────────────────────────────────────│\n│  apt-get -y \\\\                                                   │\n│      -o Dpkg::Options::='--force-confdef' \\\\                     │\n│      -o Dpkg::Options::='--force-confold' \\\\                     │\n│      dist-upgrade                                               │\n│                                                                 │\n│  • Full Bookworm → Trixie + PVE 8 → 9                           │\n│  • Output streams in real time                                  │\n│  • Also tee'd to /var/log/pve8-a-pve9-'<'timestamp'>'.log           │\n└────────────────────────────────┬────────────────────────────────┘\n                                 │\n                                 ▼\n┌─────────────────────────────────────────────────────────────────┐\n│  6. POST-UPGRADE                                                │\n│─────────────────────────────────────────────────────────────────│\n│  • EFI hosts:  apt install grub-efi-amd64                       │\n│  • systemctl restart pve-manager                                │\n│  • Re-run pve8to9 --full  →  confirm clean                      │\n│  • Reboot prompt  (decline only if you have a reason)           │\n└─────────────────────────────────────────────────────────────────┘",
+    "flowIntro": "Seis fases consecutivas. La fase 2 actualiza los paquetes de PVE 8 y la fase 3 escribe la configuración de repositorios de PVE 9. Un fallo detiene el proceso sin revertir esos cambios; si la actualización de PVE 8 falla o se cancela, los repositorios no se modifican. La fase 5 ejecuta <code>dist-upgrade</code> para PVE 9.",
+    "flowDiagram": "1. COMPROBACIONES\nBloquea termproxy / vncshell; confirma la actualización; rechaza PVE 9.\n\n2. PREPARAR PVE 8\nscripts/global/update-pve8.sh\nActualiza los paquetes de PVE 8; se detiene si la actualización falla o se cancela.\npve8to9 --full (puede ofrecer reparaciones).\nComprueba espacio y conectividad; Ceph 19.x Squid en nodos hiperconvergentes.\n\n3. MIGRAR REPOSITORIOS\nBookworm → Trixie; escribe archivos deb822 .sources.\nComenta los archivos .list antiguos; apt-get update.\n\n4. VALIDAR EL CANDIDATO DE PVE 9\napt-cache policy proxmox-ve\napt-get -s dist-upgrade\nSe detiene si el candidato no es 9.x o se eliminaría proxmox-ve.\n\n5. ACTUALIZAR\napt-get -y -o Dpkg::Options::='--force-confdef' -o Dpkg::Options::='--force-confold' dist-upgrade\nSin suscripción: desactiva pve-enterprise.sources.\nRegistro: /var/log/pve8-a-pve9-'<'timestamp'>'.log\n\n6. VERIFICAR Y REINICIAR\nEFI: apt install grub-efi-amd64\npve8to9 --full; revisa el resultado y la pregunta de reinicio.",
     "preflightHeading": "Comprobaciones previas: qué se chequea",
     "preflightTable": {
       "checkHeader": "Chequeo",
@@ -137,9 +137,9 @@
     "postHeading": "Tareas post-upgrade (modo automático)",
     "postItems": [
       "<strong>Hosts EFI:</strong> instala <code>grub-efi-amd64</code> (problema conocido según la documentación de Proxmox — el upgrade no lo trae automáticamente y el siguiente arranque fallaría sin él).",
-      "<strong>Reiniciar <code>pve-manager</code>.</strong> Fuerza una recarga limpia de los nuevos demonios.",
+      "<strong>Repositorio Enterprise sin suscripción.</strong> pve-manager 9 añade <code>pve-enterprise.sources</code> durante la actualización; en modo no-subscription, el script lo marca como <code>Enabled: false</code>.",
       "<strong>Volver a ejecutar <code>pve8to9 --full</code>.</strong> Saca a la luz cualquier problema residual que el upgrade no resolvió. Si se reportan FAILs, aparece el mismo menú de reparación guiada de la pre-comprobación.",
-      "<strong>Preguntar antes de reiniciar.</strong> \"It is RECOMMENDED to reboot now to load the new kernel and services. Reboot now?\" Decline solo si tienes una razón concreta — correr en el kernel antiguo tras un upgrade mayor es arriesgado."
+      "<strong>Pregunta de reinicio.</strong> Se recomienda reiniciar para cargar el nuevo núcleo y los servicios. Recházalo solo si tienes un motivo concreto: seguir con el núcleo anterior tras un cambio de versión principal supone un riesgo."
     ]
   },
   "interactive": {
@@ -147,7 +147,7 @@
     "intro": "Mismo flujo general que el <autolink>modo automático</autolink> — mismas comprobaciones previas, misma migración de repositorios, misma verificación post-upgrade. La única diferencia está en el paso <code>dist-upgrade</code>: <strong>tú respondes cada prompt de conflicto de archivo de configuración de dpkg</strong>. ProxMenux pasa el upgrade a un <code>apt-get dist-upgrade</code> plano sin los flags <code>--force-conf*</code>.",
     "distUpgradeHeading": "El comando dist-upgrade (modo interactivo)",
     "distUpgradeCode": "apt-get dist-upgrade\n# (user answers each dpkg config-file conflict prompt as it appears)",
-    "whenHeading": "Cuándo es interactivo la opción correcta",
+    "whenHeading": "Cuándo elegir el modo interactivo",
     "whenItems": [
       "Has personalizado <code>/etc/lvm/lvm.conf</code>, <code>/etc/ssh/sshd_config</code>, <code>/etc/default/grub</code> o cualquier otro archivo de configuración que el upgrade toca.",
       "Quieres ver exactamente qué paquetes introducen conflictos de configuración y decidir caso por caso.",
@@ -160,10 +160,10 @@
     "heading": "Procedimiento manual de upgrade",
     "intro": "Esto es lo que muestra la opción de menú <strong>Guía manual de upgrade</strong> — un espejo fiel del <wikilink>wiki oficial de upgrade Proxmox 8 a 9</wikilink> organizado en 4 fases. El script <em>muestra</em> estos comandos; tú los tecleas en un shell root aparte. Sin automatización — visibilidad total.",
     "rootCalloutTitle": "Todos los comandos necesitan root",
-    "rootCalloutBody": "Ejecuta como root o prefija cada comando con <code>sudo</code>. El propio host Proxmox corre como root por defecto; solo es relevante si lo bloqueaste.",
+    "rootCalloutBody": "Usa una sesión de shell como root para estos comandos, incluidas las redirecciones y los documentos here-document. Si utilizas <code>sudo</code>, asegúrate de ejecutar el comando completo con privilegios de root.",
     "phase1Heading": "Fase 1 — Preparación",
     "phase1Intro": "Lleva el host a la última PVE 8.4.x, verifica la versión, valida Ceph (si se usa), ejecuta la pre-comprobación de la propia Proxmox y arranca un multiplexor de terminal para sobrevivir a desconexiones.",
-    "phase1Code": "# Step 1 — Update PVE 8 to the latest 8.4+\napt update && apt dist-upgrade -y\n\n# Step 2 — Verify version (must be 8.4.1 or newer)\npveversion\n\n# Step 2.1 — Hyper-converged Ceph: must already be on 19.x Squid\nceph --version\n# If older, follow https://pve.proxmox.com/wiki/Ceph_Squid\n\n# Step 3 — Run the official upgrade-readiness check\npve8to9 --full\n# If it warns about systemd-boot meta-package, remove it:\n#   apt remove systemd-boot\n\n# Step 4 — Start tmux or screen (so SSH disconnect doesn't kill the upgrade)\ntmux new-session -s upgrade\n# or\nscreen -S upgrade",
+    "phase1Code": "# Step 1 — Update PVE 8 to the latest 8.4+\napt update && apt dist-upgrade -y\n\n# Step 2 — Verify version (must be 8.4.1 or newer)\npveversion\n\n# Step 2.1 — Hyper-converged Ceph: must already be on 19.x Squid\nceph --version\n# If older, follow https://pve.proxmox.com/wiki/Ceph_Reef_to_Squid\n\n# Step 3 — Run the official upgrade-readiness check\npve8to9 --full\n# If it warns about systemd-boot meta-package, remove it:\n#   apt remove systemd-boot\n\n# Step 4 — Start tmux or screen (so SSH disconnect doesn't kill the upgrade)\ntmux new-session -s upgrade\n# or\nscreen -S upgrade",
     "phase2Heading": "Fase 2 — Migración de repositorios",
     "phase2Intro": "Cambia cada repositorio Debian y Proxmox del codename Bookworm a Trixie y convierte las fuentes Proxmox al nuevo formato deb822. <strong>Elige el paso 7 O el paso 8</strong> según si tienes una suscripción Enterprise. Sáltate el paso 9 si no usas Ceph.",
     "phase2Code": "# Step 5 — Debian: bookworm → trixie\nsed -i 's/bookworm/trixie/g' /etc/apt/sources.list\n\n# Step 6 — Same for the legacy enterprise list (only if you use enterprise)\nsed -i 's/bookworm/trixie/g' /etc/apt/sources.list.d/pve-enterprise.list\n\n# Step 7 — Add the new PVE 9 enterprise repo (deb822) — Enterprise users only\ncat > /etc/apt/sources.list.d/pve-enterprise.sources << EOF\nTypes: deb\nURIs: https://enterprise.proxmox.com/debian/pve\nSuites: trixie\nComponents: pve-enterprise\nSigned-By: /usr/share/keyrings/proxmox-archive-keyring.gpg\nEOF\n\n# Step 8 — OR add the no-subscription repo (most home / lab users)\ncat > /etc/apt/sources.list.d/proxmox.sources << EOF\nTypes: deb\nURIs: http://download.proxmox.com/debian/pve\nSuites: trixie\nComponents: pve-no-subscription\nSigned-By: /usr/share/keyrings/proxmox-archive-keyring.gpg\nEOF\n\n# Step 8.1 — Refresh and verify proxmox-ve candidate is 9.x\napt update && apt policy | sed -n '1,120p'\n\n# Step 9 — Update Ceph repo (only if you run Ceph)\ncat > /etc/apt/sources.list.d/ceph.sources << EOF\nTypes: deb\nURIs: http://download.proxmox.com/debian/ceph-squid\nSuites: trixie\nComponents: no-subscription\nSigned-By: /usr/share/keyrings/proxmox-archive-keyring.gpg\nEOF\n\n# Step 10 — Remove old .list files now superseded by deb822 .sources\nrm -f /etc/apt/sources.list.d/pve-enterprise.list /etc/apt/sources.list.d/ceph.list\n\n# Step 11 — Final apt update\napt update",
@@ -191,8 +191,8 @@
         },
         {
           "fileRich": "/etc/ssh/sshd_config",
-          "answerRich": "<strong>Y</strong> (mantenedor)",
-          "whyRich": "Vuelve a aplicar tus personalizaciones después",
+          "answerRich": "<strong>Y</strong> si solo hay cambios predeterminados; revisa antes los archivos personalizados",
+          "whyRich": "Revisa los ajustes locales de SSH y conserva el acceso antes de sustituir el archivo. Los cambios predeterminados incluyen opciones renombradas y comentarios.",
           "fileFont": true
         },
         {
@@ -203,8 +203,8 @@
         },
         {
           "fileRich": "/etc/chrony/chrony.conf",
-          "answerRich": "<strong>Y</strong> (mantenedor)",
-          "whyRich": "Valores por defecto de sincronización horaria actualizados para Trixie",
+          "answerRich": "<strong>Y</strong> si no lo modificaste; conserva antes los ajustes locales",
+          "whyRich": "Trixie actualiza los valores predeterminados de sincronización horaria. Traslada los ajustes locales a los directorios conf.d / sources.d de chrony antes de aceptar el archivo nuevo.",
           "fileFont": true
         },
         {
@@ -230,9 +230,9 @@
   "clusterCeph": {
     "heading": "Clúster y Ceph",
     "clusterCalloutTitle": "Clúster: actualiza los nodos uno a uno",
-    "clusterCalloutBody": "Detectado vía <code>pvecm status</code>. <strong>No</strong> actualices más de un nodo a la vez. Migra los guests fuera del nodo primero, actualiza, reinicia, verifica que el nodo está de vuelta en el clúster como PVE 9, solo entonces pasa al siguiente nodo. Un clúster mezclado PVE 8 / PVE 9 funciona durante la ventana del upgrade, pero la migración en vivo entre versiones mezcladas no está soportada — solo migración en frío. Los grupos HA se migrarán automáticamente al nuevo formato de reglas HA.",
+    "clusterCalloutBody": "Se detecta mediante <code>pvecm status</code>. <strong>No</strong> actualices más de un nodo a la vez. Mueve sus máquinas, actualízalo, reinícialo y verifica su pertenencia al clúster antes de continuar. Durante la actualización funciona la migración en vivo desde versiones anteriores de PVE a posteriores; la dirección inversa generalmente no es compatible. Los grupos de HA se convierten automáticamente en reglas de HA cuando todos los nodos ejecutan PVE 9.",
     "cephCalloutTitle": "Ceph: actualiza Ceph PRIMERO, después Proxmox",
-    "cephCalloutBody": "Ceph debe estar ya en 19.x Squid antes del upgrade de Proxmox. El orden oficial: Ceph 17/18 → Ceph 19 (vía <code>pveceph upgrade</code> por nodo) → reinicio para los nuevos demonios Ceph → upgrade de Proxmox por nodo. Saltarse el paso de Ceph deja el clúster roto hasta que lo arregles desde la consola. Procedimiento completo de Ceph: <cephlink>wiki de upgrade Ceph Squid</cephlink>."
+    "cephCalloutBody": "Ceph debe ejecutar ya 19.x Squid antes de actualizar Proxmox. Sigue la secuencia oficial: Quincy 17 → Reef 18 → Squid 19, actualizando paquetes y reiniciando los demonios de Ceph de forma escalonada en el orden documentado. Comprueba <code>ceph --version</code> antes de actualizar cada nodo Proxmox. Sigue el procedimiento completo: <cephlink>guía de actualización de Ceph Reef a Squid</cephlink>."
   },
   "troubleshooting": {
     "heading": "Solución de problemas",
@@ -243,10 +243,10 @@
       },
       {
         "title": "pve8to9 reporta FAIL y la opción 1 de auto-reparación produce \"command not found\"",
-        "bodyRich": "Bug conocido — la auto-reparación se refiere a una función (<code>configure_repositories</code>) que no existe en el código actual. Usa la opción 2 (mostrar comandos manuales) y ejecútalos desde un shell aparte, o ejecuta los arreglos canónicos a mano: <code>apt-get update</code>, después vuelve a ejecutar el upgrade."
+        "bodyRich": "Si el error menciona <code>configure_repositories</code>, la copia del script está desactualizada: la reparación actual usa cleanup_duplicate_repos y ensure_repositories. Actualiza esa copia o usa la opción 2 para revisar los comandos manuales. <code>apt-get update</code> actualiza las listas de paquetes, pero no resuelve todos los bloqueos."
       },
       {
-        "title": "La simulación de apt señala \"proxmox-ve will be REMOVED\"",
+        "title": "La simulación de apt indica \"proxmox-ve will be REMOVED\"",
         "bodyRich": "Los nuevos repos no son alcanzables o la sustitución de codename no surtió efecto. Comprueba <code>cat /etc/apt/sources.list.d/proxmox.sources</code> — la línea <code>Suites:</code> debe decir <code>trixie</code>, no <code>bookworm</code>. Confirma también que <code>apt-cache policy proxmox-ve</code> muestra un candidato 9.x del nuevo repo."
       },
       {
@@ -267,7 +267,7 @@
       },
       {
         "title": "Split-brain del clúster tras actualizar un nodo",
-        "bodyRich": "Un clúster mezclado PVE 8 / PVE 9 está soportado durante la ventana del upgrade pero la migración es solo en frío. Si el clúster muestra el nodo actualizado como offline, comprueba <code>corosync</code> en ambos: la configuración QDevice / de red puede haberse desplazado. Ejecuta <code>pvecm status</code> en cada nodo para confirmar el quórum."
+        "bodyRich": "Se admiten clústeres con PVE 8 y PVE 9 durante la actualización. Funciona la migración en vivo de versiones anteriores a posteriores; la dirección inversa generalmente no es compatible. Si el nodo actualizado aparece desconectado, revisa <code>corosync</code> y la configuración del QDevice y de la red. Ejecuta <code>pvecm status</code> en cada nodo para confirmar el quórum."
       }
     ]
   },
@@ -281,11 +281,11 @@
     "items": [
       {
         "href": "https://pve.proxmox.com/wiki/Upgrade_from_8_to_9",
-        "title": "Upgrade from 8 to 9",
+        "title": "Actualización de 8 a 9",
         "desc": "La página principal del wiki de Proxmox para el upgrade 8 → 9. Fuente de verdad de cada comando del procedimiento manual de arriba."
       },
       {
-        "href": "https://pve.proxmox.com/wiki/Ceph_Squid",
+        "href": "https://pve.proxmox.com/wiki/Ceph_Reef_to_Squid",
         "title": "Upgrade Ceph Squid (19.x)",
         "desc": "Paso previo obligatorio para nodos hiperconvergentes con Ceph. Ceph debe estar en 19.x Squid antes de PVE 9."
       },
@@ -327,7 +327,7 @@
       },
       {
         "href": "/docs/utils",
-        "label": "Resumen de Utilidades",
+        "label": "Resumen de utilidades",
         "tail": " — volver al resumen de la sección."
       }
     ]
diff --git a/web/messages/es/docs/utils/uup-dump-iso-creator.json b/web/messages/es/docs/utils/uup-dump-iso-creator.json
index 3cf9bdfd..581b47a8 100644
--- a/web/messages/es/docs/utils/uup-dump-iso-creator.json
+++ b/web/messages/es/docs/utils/uup-dump-iso-creator.json
@@ -1,19 +1,19 @@
 {
   "meta": {
-    "title": "UUP Dump ISO Creator | ProxMenux Documentation",
+    "title": "Creador de ISO UUP Dump | Documentación de ProxMenux",
     "description": "Crea una ISO de instalación de Windows actualizada en tu host Proxmox usando el UUP Dump ISO Creator de ProxMenux. Automatiza la instalación de dependencias, descarga y conversión de archivos UUP en una ISO arrancable lista para crear una VM.",
-    "ogTitle": "UUP Dump ISO Creator | ProxMenux Documentation",
+    "ogTitle": "Creador de ISO UUP Dump | Documentación de ProxMenux",
     "ogDescription": "Crea una ISO de Windows actualizada desde UUP Dump usando ProxMenux. Dependencias, descarga y conversión totalmente automatizadas.",
     "ogImageAlt": "UUP Dump ISO Creator de ProxMenux"
   },
   "header": {
-    "title": "UUP Dump ISO Creator",
-    "description": "Crea una ISO de instalación de Windows actualizada en tu host Proxmox usando UUP Dump. ProxMenux se encarga de las dependencias, descarga los archivos UUP en paralelo, ejecuta el conversor oficial y deja la ISO final en el almacenamiento de ISOs de Proxmox — lista para asociar a una nueva VM Windows.",
+    "title": "Creador de ISO UUP Dump",
+    "description": "Crea una ISO de instalación de Windows actualizada en tu host Proxmox con UUP Dump. ProxMenux gestiona las dependencias, descarga los archivos UUP en paralelo, ejecuta el conversor de UUP Dump y mueve la ISO al directorio de salida elegido, que por defecto es el almacenamiento de ISOs de Proxmox detectado.",
     "section": "Utilidades"
   },
   "intro": {
     "title": "Qué hace este script",
-    "body": "Tú aportas una URL de UUP Dump (la que uupdump.net genera tras elegir build, idioma y edición) y el script hace el resto: instala las dependencias que falten, descarga el conversor de UUP Dump, descarga cada archivo de payload UUP con aria2, ensambla una ISO arrancable de Windows y la mueve al almacenamiento de ISOs de Proxmox para que el creador de VM pueda montarla en el primer arranque."
+    "body": "Proporciona una URL generada por uupdump.net tras elegir una compilación, un idioma y una edición. El script instala las dependencias que falten, descarga el conversor de UUP Dump y los archivos UUP, crea una ISO arrancable de Windows y la mueve al directorio de salida elegido. Como destino predeterminado ofrece el almacenamiento de ISOs de Proxmox detectado."
   },
   "hero": {
     "imageAlt": "Entrada UUP Dump ISO Creator en ProxMenux",
@@ -61,7 +61,7 @@
       },
       {
         "pkg": "chntpw",
-        "roleRich": "Ajusta hives del registro de Windows durante la construcción."
+        "roleRich": "Modifica las secciones del registro de Windows durante la creación."
       }
     ],
     "manualIntro": "Equivalente manual — si alguna vez necesitas instalarlas tú mismo:",
@@ -73,22 +73,22 @@
       "Detecta el almacenamiento de ISOs de Proxmox (vía <code>pvesm status -content iso</code>) o recae en <code>/var/lib/vz/template/iso</code>.",
       "Pregunta por una carpeta base para archivos temporales (por defecto <code>/root/uup-temp</code>).",
       "Descarga el conversor de UUP Dump desde <code>git.uupdump.net</code>.",
-      "Parsea <code>id</code>, <code>pack</code> y <code>edition</code> de la URL que pegas.",
+      "Extrae <code>id</code>, <code>pack</code> y <code>edition</code> de la URL pegada.",
       "Llama a <code>https://uupdump.net/get.php?…&aria2=2</code> para generar una lista de descargas de aria2.",
       "Descarga cada payload UUP en <code>UUPs/</code> con aria2 (paralelo, reanudable).",
       "Ejecuta <code>convert.sh wim UUPs 1</code> del conversor para producir la ISO final.",
-      "Mueve la ISO al almacenamiento de ISOs de Proxmox y limpia los archivos temporales."
+      "Mueve la ISO al directorio de salida elegido y limpia los archivos temporales."
     ]
   },
   "aria2": {
-    "heading": "Flags de descarga de Aria2 usados",
+    "heading": "Opciones de descarga de aria2 utilizadas",
     "code": "aria2c --no-conf --console-log-level=warn --log-level=info \\\n  --log=aria2_download.log \\\n  -x16 -s16 -j5 -c -R \\\n  -d\"$destDir\" -i\"$tempScript\"",
     "flags": [
       "<code>-x16</code> — hasta 16 conexiones por servidor.",
       "<code>-s16</code> — divide cada archivo en 16 segmentos.",
       "<code>-j5</code> — 5 archivos descargados en paralelo.",
       "<code>-c</code> — reanuda descargas parciales.",
-      "<code>-R</code> — reintenta tras fallos."
+      "<code>-R</code> — aplica al archivo descargado la fecha y hora del archivo remoto, si están disponibles."
     ],
     "runtime": "El tiempo típico ronda los 10 minutos, dominado por la velocidad de tu enlace de internet y la carga del mirror de UUP Dump."
   },
@@ -147,15 +147,15 @@
         "body": "Pega la URL en el diálogo de entrada. El script valida que los tres parámetros requeridos están presentes; si falta alguno, aborta limpiamente."
       },
       {
-        "title": "Espera a que termine la construcción",
+        "title": "Espera a que termine la creación",
         "img": "/iso-creator/end-uupdump-iso-creator.png",
-        "caption": "Construcción terminada — la ISO está lista en el almacenamiento de ISOs de Proxmox",
-        "bodyRich": "La consola muestra el progreso de aria2 y luego la salida del conversor. Cuando termina, la ISO aterriza en el almacenamiento de ISOs de Proxmox detectado y está lista para elegirse desde <strong>Create VM → System Windows → Install with ISO from UUP Dump</strong>."
+        "caption": "Creación terminada: la ISO está lista en el almacenamiento de ISOs de Proxmox",
+        "bodyRich": "La consola muestra el progreso de aria2 y después la salida del conversor. La ISO terminada se mueve al directorio de salida elegido. Si está en un almacenamiento de ISOs configurado en Proxmox, se puede seleccionar desde <strong>Crear VM con Windows → Instalar con ISO personal</strong>."
       }
     ]
   },
   "tempFiles": {
     "title": "Archivos temporales",
-    "body": "Por defecto, los archivos temporales viven bajo <code>/root/uup-temp</code> (<code>uup-temp/</code> para descargas y <code>uup-converter/</code> para el script conversor). El creador limpia ambos tras una ejecución exitosa. En caso de fallo igual limpia y te devuelve al menú para que un reintento empiece desde cero."
+    "body": "La carpeta temporal predeterminada es <code>/root/uup-temp</code>, con las descargas en <code>UUPs/</code> y el conversor en <code>converter/</code>. Si eliges otra ruta base, se crea un subdirectorio de sesión independiente. Las ramas de creación correcta y de ausencia de ISO eliminan la sesión temporal. Los fallos o las cancelaciones anteriores pueden dejar archivos temporales."
   }
 }
diff --git a/web/messages/es/guides/backup-cloud.json b/web/messages/es/guides/backup-cloud.json
index 5af2079b..d8f69ef1 100644
--- a/web/messages/es/guides/backup-cloud.json
+++ b/web/messages/es/guides/backup-cloud.json
@@ -1,18 +1,18 @@
 {
   "meta": {
-    "title": "Backup de Proxmox a almacenamiento en la nube personal | Guías ProxMenux",
-    "description": "Usa rclone para montar una nube personal (Google Drive, Mega, Dropbox, OneDrive, etc.) como un directorio en el host Proxmox VE, regístralo como datastore de vzdump y haz backup de VMs / CTs directamente a la nube — sin scripts adicionales.",
-    "ogTitle": "Backup de Proxmox a almacenamiento en la nube personal",
+    "title": "Backup de Proxmox en almacenamiento en la nube personal | ProxMenux",
+    "description": "Usa rclone para montar una nube personal (Google Drive, Mega, Dropbox, OneDrive, etc.) como un directorio en el host Proxmox VE, regístralo como datastore de vzdump y haz backup de VMs / CTs directamente a la nube — sin script extra.",
+    "ogTitle": "Backup de Proxmox en almacenamiento en la nube personal",
     "ogDescription": "Monta una nube personal con rclone en un host Proxmox VE y haz backup de VMs / CTs directamente a ella como datastore de vzdump."
   },
   "header": {
-    "title": "Backup de Proxmox a almacenamiento en la nube personal",
-    "description": "Usa rclone para montar una nube personal (Google Drive, Mega, Dropbox, OneDrive, etc.) como un directorio en el host Proxmox VE, regístralo como datastore de vzdump y haz backup de VMs / CTs directamente a la nube — sin scripts adicionales.",
+    "title": "Backup de Proxmox en almacenamiento en la nube personal",
+    "description": "Usa rclone para montar una nube personal (Google Drive, Mega, Dropbox, OneDrive, etc.) como un directorio en el host Proxmox VE, regístralo como datastore de vzdump y haz backup de VMs / CTs directamente a la nube — sin script extra.",
     "section": "Guías"
   },
   "intro": {
     "pbsCalloutTitle": "Considera primero Proxmox Backup Server",
-    "pbsCalloutBody": "Si tienes una segunda máquina (una Pi, un PC viejo, un NAS), ejecutar <pbsLink>Proxmox Backup Server</pbsLink> en ella te da backups incrementales, deduplicados y cifrados — una opción mucho más adecuada para backup de VMs que una sincronización tipo rsync a la nube. El enfoque de montar la nube de esta guía es para usuarios que específicamente quieren que los backups acaben en su nube personal (Google Drive / Mega / OneDrive / Dropbox).",
+    "pbsCalloutBody": "En una segunda máquina que cumpla sus requisitos x86-64, <pbsLink>Proxmox Backup Server</pbsLink> ofrece copias incrementales, deduplicadas y con cifrado opcional en el cliente. Está diseñado para copias de VM. Esta guía explica cómo montar una nube personal, como Google Drive, Mega, OneDrive o Dropbox, como destino de las copias.",
     "stepsTitle": "Qué vas a hacer",
     "steps": [
       "Crear un directorio en el host Proxmox y registrarlo como un datastore compatible con vzdump.",
@@ -21,7 +21,7 @@
       "Hacer que el montaje sobreviva a los reinicios (unit de systemd — más robusto que crontab)."
     ],
     "vzdumpCalloutTitle": "Aviso sobre los backups vzdump de Proxmox",
-    "vzdumpCalloutBody": "<strong>No son incrementales</strong>. Cada backup contiene la imagen completa del disco de la VM (comprimida). En una nube con cuota limitada, esto se llena rápido. Planea una política de retención desde el primer día (ver el final de la guía)."
+    "vzdumpCalloutBody": "Los archivos vzdump de Proxmox son <strong>copias completas, no incrementales</strong>. Su tamaño real depende de los datos incluidos y de la compresión, no solo de la capacidad del disco virtual. Si un archivo ocupa 30 GB, conservar cinco requiere unos 150 GB. Configura una política de retención para evitar que la nube se llene."
   },
   "createDir": {
     "heading": "1. Crear el directorio del host y registrarlo como datastore",
@@ -32,7 +32,7 @@
     "configIntro": "Configúralo así:",
     "configItems": [
       "<strong>ID:</strong> <code>gdrive</code> (o lo que hayas usado como nombre de directorio)",
-      "<strong>Directory:</strong> <code>/mnt/gdrive</code>",
+      "<strong>Directorio:</strong> <code>/mnt/gdrive</code>",
       "<strong>Content:</strong> selecciona <strong>VZDump backup file</strong>"
     ],
     "image2Alt": "Configurando nuevo almacenamiento en Proxmox",
@@ -48,10 +48,10 @@
     "newerCalloutBody": "Si necesitas un rclone más reciente que el que trae Debian, usa el instalador oficial:",
     "newerCode": "curl https://rclone.org/install.sh | bash",
     "tunnelHeading": "2.1 Autenticación basada en navegador a través de un túnel SSH",
-    "tunnelBody": "El flujo de autenticación de rclone abre un navegador web local. Como el host Proxmox no tiene escritorio, el <remoteSetupLink>procedimiento de remote-setup de rclone</remoteSetupLink> redirige el callback de autenticación a través de un túnel SSH hasta el navegador de tu portátil.",
+    "tunnelBody": "Para los proveedores que usan autenticación web, el host Proxmox normalmente no tiene navegador. Sigue el <remoteSetupLink>procedimiento remoto de rclone</remoteSetupLink>: utiliza el navegador del portátil y reenvía su conexión de retorno a localhost por SSH hasta rclone en el host.",
     "tunnelFrom": "Desde tu <strong>portátil</strong> (reemplaza <code>ip_proxmox</code> por la IP de Proxmox):",
     "tunnelCode": "ssh -L localhost:53682:localhost:53682 root@ip_proxmox",
-    "tunnelAfter": "Esta sesión SSH reenvía el puerto 53682 del host Proxmox al localhost de tu portátil. Mantenla abierta durante la configuración de rclone que viene a continuación.",
+    "tunnelAfter": "Esta sesión SSH abre el puerto localhost 53682 en tu portátil y reenvía las conexiones al mismo puerto del host Proxmox. Mantenla abierta durante la configuración de rclone.",
     "runHeading": "2.2 Ejecutar rclone config",
     "runBody": "En la sesión SSH que acabas de abrir, ejecuta:",
     "runCode": "rclone config",
@@ -64,7 +64,7 @@
     "heading": "3. Montar la carpeta de la nube",
     "body": "Crea una carpeta en tu nube personal para guardar los backups. Llámala algo como <code>PBC</code> (Proxmox Backup Cloud).",
     "mountIntro": "Móntala sobre el directorio del host:",
-    "mountCode": "rclone mount gdrive:/PBC /mnt/gdrive --allow-other --allow-non-empty",
+    "mountCode": "rclone mount gdrive:/PBC /mnt/gdrive --allow-other --allow-non-empty --vfs-cache-mode writes",
     "mountItems": [
       "<code>gdrive:/PBC</code> — la carpeta en tu nube.",
       "<code>/mnt/gdrive</code> — el directorio del host que registraste como datastore."
@@ -82,21 +82,21 @@
     "enableCode": "systemctl daemon-reload\nsystemctl enable --now rclone-gdrive.service",
     "verifyIntro": "Verifica:",
     "verifyCode": "systemctl status rclone-gdrive.service\nmount | grep /mnt/gdrive",
-    "verifyAfter": "Si el servicio falla alguna vez (rate-limits del proveedor, token de autenticación caducado, corte de red), se reiniciará automáticamente al cabo de 10 segundos. Los logs están en <code>/var/log/rclone-gdrive.log</code> y vía <code>journalctl -u rclone-gdrive.service -f</code>.",
-    "vfsCalloutTitle": "¿Por qué --vfs-cache-mode writes?",
-    "vfsCalloutBody": "vzdump escribe el archivo de backup al disco en streaming; sin caché de escritura VFS, cada <code>fwrite</code> se bloquea esperando a un round-trip HTTP a la nube — los backups se vuelven lentos y los proveedores pueden aplicar rate-limit. La caché bufferiza las escrituras localmente y las vuelca en segundo plano."
+    "verifyAfter": "La unidad solicita un reinicio al cabo de 10 segundos si rclone termina con un error. No repara credenciales caducadas ni garantiza recuperarse de cualquier fallo de red o del proveedor. Consulta <code>/var/log/rclone-gdrive.log</code> y <code>journalctl -u rclone-gdrive.service -f</code>.",
+    "vfsCalloutTitle": "¿Por qué usar --vfs-cache-mode writes?",
+    "vfsCalloutBody": "Con caché de escritura, operaciones como <code>fwrite</code> escriben en una caché local en disco. rclone sube el archivo cuando se cierra y transcurre el intervalo de escritura diferida. Reserva espacio local para las copias en curso y verifica que la subida termine antes de dar por disponible la copia remota."
   },
   "configureBackup": {
-    "heading": "5. Configurar el backup para que aterrice en la nube",
+    "heading": "5. Configurar la nube como destino de las copias",
     "body": "En la UI de Proxmox, cuando programes un backup o ejecutes uno ad-hoc, elige el almacenamiento que registraste como <strong>destino</strong>:",
     "image5Alt": "Seleccionando destino de backup en Proxmox",
-    "after": "Cuando el backup termine, el fichero aparece en tu nube:",
+    "after": "Cuando termine vzdump, espera a que finalice la subida de rclone en segundo plano y comprueba el archivo en la interfaz del proveedor:",
     "image6Alt": "Fichero de backup en el almacenamiento en la nube"
   },
   "retention": {
     "heading": "6. Retención — mantén la cuota de la nube bajo control",
-    "body": "Los backups vzdump de Proxmox son <strong>snapshots completos, no incrementales</strong>. Una VM de 30 GB = 30 GB por backup. Sin retención, la nube se llena.",
-    "uiPath": "En la UI de Proxmox: <strong>Datacenter → Backup → [tu job] → Retention</strong>:",
+    "body": "Los archivos vzdump de Proxmox son <strong>copias completas, no incrementales</strong>. Su tamaño real depende de los datos incluidos y de la compresión, no solo de la capacidad del disco virtual. Si un archivo ocupa 30 GB, conservar cinco requiere unos 150 GB. Configura una política de retención para evitar que la nube se llene.",
+    "uiPath": "En la interfaz de Proxmox: <strong>Datacenter → Backup → [tu tarea] → Retention</strong>:",
     "image7Alt": "Ajustes de retención de backup en Proxmox",
     "starterIntro": "Valores iniciales razonables para un montaje doméstico / de laboratorio:",
     "starterItems": [
@@ -109,11 +109,11 @@
   "troubleshoot": {
     "heading": "Solución de problemas",
     "items": [
-      "<strong><code>Mount point /mnt/gdrive is itself on a fuse.rclone filesystem</code>:</strong> el montaje anterior no se desmontó limpiamente. Fuerza el desmontaje: <code>fusermount -uz /mnt/gdrive</code>, luego reinicia la unit de systemd.",
-      "<strong>El backup es extremadamente lento:</strong> confirma que <code>--vfs-cache-mode writes</code> está en la línea <code>ExecStart</code>. Sin esa opción, cada escritura se bloquea en la nube. Comprueba también tu ancho de banda de subida — vzdump está limitado por él.",
-      "<strong>El backup falla con ''No space left on device'':</strong> el directorio de caché (<code>~/.cache/rclone/</code>) se llenó antes de que la subida pudiera alcanzarlo. Muévelo a un sistema de ficheros más grande con <code>--cache-dir /var/cache/rclone</code> en la unit de systemd.",
-      "<strong>El token de autenticación de rclone caducó (típico en Google Drive tras un periodo largo de inactividad):</strong> vuelve a conectarte por SSH con el túnel (<code>ssh -L localhost:53682:localhost:53682 root@ip_proxmox</code>) y ejecuta <code>rclone config reconnect gdrive:</code> para refrescarlo.",
-      "<strong>Los backups llegan pero salen corruptos al restaurar:</strong> deja de usar el almacenamiento en la nube como <strong>único</strong> destino de backup. Combínalo con PBS local / vzdump en un disco diferente para tener resiliencia."
+      "<strong><code>Mount point /mnt/gdrive is itself on a fuse.rclone filesystem</code>:</strong> el directorio ya está montado, quizá por otra instancia de rclone. Comprueba que no haya copias en curso antes de desmontar el montaje anterior con <code>fusermount -uz /mnt/gdrive</code> y reinicia la unidad systemd.",
+      "<strong>La copia es muy lenta:</strong> confirma que <code>--vfs-cache-mode writes</code> figure en la línea <code>ExecStart</code>. Revisa el rendimiento de la caché local, la velocidad de subida y los límites del proveedor. La subida puede continuar después de terminar vzdump.",
+      "<strong>La copia falla con No space left on device:</strong> revisa el espacio de la caché local y la cuota del proveedor. La caché suele estar en <code>~/.cache/rclone/</code>. Si se llena, elige una ruta como <code>--cache-dir /var/cache/rclone</code> en un sistema de archivos con espacio; cambiar de ruta dentro del mismo sistema lleno no ayuda.",
+      "<strong>El token de rclone ha caducado:</strong> vuelve a conectarte por SSH con el túnel (<code>ssh -L localhost:53682:localhost:53682 root@ip_proxmox</code>) y ejecuta <code>rclone config reconnect gdrive:</code> para renovar la autorización.",
+      "<strong>Las copias llegan a la nube, pero fallan al restaurarlas:</strong> evita que la nube sea el <strong>único</strong> destino de las copias. Combínala con PBS local o vzdump en otro disco."
     ]
   }
 }
diff --git a/web/messages/es/guides/index.json b/web/messages/es/guides/index.json
index 8bbcd020..80496395 100644
--- a/web/messages/es/guides/index.json
+++ b/web/messages/es/guides/index.json
@@ -1,20 +1,20 @@
 {
   "meta": {
     "title": "Guías de Proxmox VE — Coral TPU, NVIDIA, Kodi en LXC, Samba, backup en la nube | ProxMenux",
-    "description": "Tutoriales hechos a mano para Proxmox VE: instalar Kodi dentro de un LXC con aceleración por GPU, configurar drivers NVIDIA en PVE 9, disco USB compartido por Samba en un contenedor, backups con vzdump a la nube personal (Google Drive, Mega, Dropbox, OneDrive). Más recursos curados de la comunidad, glosario y referencia de comandos.",
+    "description": "Tutoriales detallados de Proxmox VE: Kodi en LXC con aceleración por GPU, controladores NVIDIA en PVE 9, un disco USB compartido por Samba desde un contenedor y copias vzdump a Google Drive, Mega, Dropbox o OneDrive. Incluye recursos seleccionados de la comunidad, glosario y referencia de comandos.",
     "ogTitle": "Guías de Proxmox VE — Coral TPU, NVIDIA, Kodi en LXC, Samba, backup en la nube",
-    "ogDescription": "Tutoriales hechos a mano para Proxmox VE: passthrough de GPU, Kodi como media center en LXC, Samba sobre USB, backup en la nube con rclone, y recursos curados de la comunidad.",
+    "ogDescription": "Tutoriales detallados de Proxmox VE: acceso directo a GPU, Kodi en LXC, discos USB compartidos por Samba, copias en la nube con rclone y recursos seleccionados de la comunidad.",
     "twitterTitle": "Guías de Proxmox VE | ProxMenux",
-    "twitterDescription": "Tutoriales hechos a mano para Proxmox VE — GPU, Kodi en LXC, Samba, backup en la nube y más.",
-    "ogImageAlt": "Guías ProxMenux — Tutoriales hechos a mano para Proxmox VE"
+    "twitterDescription": "Tutoriales detallados de Proxmox VE: GPU, Kodi en LXC, Samba, copias en la nube y mucho más.",
+    "ogImageAlt": "Guías ProxMenux — Tutoriales detallados de Proxmox VE"
   },
   "header": {
     "title": "Guías de ProxMenux",
-    "tagline": "Tutoriales en profundidad, referencias rápidas y recursos curados de la comunidad para sacarle todo el partido a Proxmox VE."
+    "tagline": "Tutoriales en profundidad, referencias rápidas y recursos seleccionados de la comunidad para aprovechar Proxmox VE."
   },
   "inDepth": {
     "heading": "Guías en profundidad",
-    "intro": "Tutoriales hechos a mano que cubren flujos concretos de Proxmox. Cada uno es el equivalente manual de un flujo automatizado de ProxMenux — útil cuando quieres visibilidad completa de cada paso.",
+    "intro": "Tutoriales detallados para tareas concretas de Proxmox. Cada uno explica los pasos manuales de un proceso automatizado por ProxMenux, para que puedas ver qué se hace en cada etapa.",
     "items": [
       {
         "slug": "kodi-lxc",
@@ -34,7 +34,7 @@
       {
         "slug": "nvidia-manual",
         "title": "Instalación de drivers de tarjeta gráfica NVIDIA en Proxmox VE 9 (procedimiento manual)",
-        "description": "Instalación y configuración manual de drivers NVIDIA en un host Proxmox VE 9, más el cableado de LXC necesario para exponer la GPU a uno o más contenedores. Cubre instalación del driver, servicio de persistencia, parche NVENC opcional y la configuración por contenedor."
+        "description": "Instalación y configuración manual de los controladores NVIDIA en un host Proxmox VE 9 y del acceso a la GPU desde uno o varios contenedores LXC. Incluye el controlador, el servicio de persistencia, el parche NVENC opcional y la configuración de cada contenedor."
       }
     ]
   },
@@ -48,7 +48,7 @@
       },
       "helpInfo": {
         "title": "Ayuda e información — Catálogo de comandos",
-        "description": "Catálogo curado de comandos útiles de Linux y Proxmox organizados por tema, con copia al portapapeles. Espeja la referencia disponible dentro del menú de ProxMenux."
+        "description": "Selección de comandos útiles de Linux y Proxmox organizada por temas, con copia al portapapeles. Recoge la referencia disponible en el menú de ProxMenux."
       },
       "linuxResources": {
         "title": "Recursos de Linux",
@@ -84,18 +84,18 @@
   },
   "community": {
     "heading": "Proyectos y recursos de la comunidad",
-    "intro": "Proyectos de código abierto y listas curadas de la comunidad Proxmox en general. No están afiliados a Proxmox Server Solutions ni a ProxMenux — se incluyen porque han demostrado ser útiles.",
+    "intro": "Proyectos de código abierto y listas seleccionadas de la comunidad Proxmox. No están afiliados a Proxmox Server Solutions ni a ProxMenux; se incluyen porque han demostrado ser útiles.",
     "cards": {
       "helperScripts": {
         "title": "Proxmox VE Helper-Scripts",
         "description": "Catálogo mantenido por la comunidad con scripts de un solo paso para desplegar LXCs (Home Assistant, Plex, Frigate, …), VMs y ajustes de PVE. Sucesor espiritual de los helper scripts de tteck."
       },
       "awesome": {
-        "title": "awesome-proxmox-ve (lista curada)",
-        "description": "Gran meta-lista curada por la comunidad con recursos de Proxmox VE: herramientas, librerías, integraciones, blogs y vídeos. Buen punto de partida para descubrir más."
+        "title": "awesome-proxmox-ve (lista de recursos seleccionados)",
+        "description": "Amplia colección de recursos de Proxmox VE seleccionados por la comunidad: herramientas, bibliotecas, integraciones, blogs y vídeos. Un buen punto de partida para descubrir más."
       }
     },
-    "suggestRich": "¿Tienes un recurso de calidad que deberíamos añadir aquí? Abre un issue o un PR en <link>GitHub</link>. La idea es mantener esta lista curada, no exhaustiva."
+    "suggestRich": "¿Conoces algún recurso de calidad que falte? Abre un issue o un PR en <link>GitHub</link>. Queremos mantener una selección útil, en lugar de una lista exhaustiva."
   },
   "discussion": {
     "heading": "Discusión de la comunidad",
diff --git a/web/messages/es/guides/kodi-lxc.json b/web/messages/es/guides/kodi-lxc.json
index 2a92b365..42f19edf 100644
--- a/web/messages/es/guides/kodi-lxc.json
+++ b/web/messages/es/guides/kodi-lxc.json
@@ -12,18 +12,18 @@
   },
   "intro": {
     "calloutTitle": "Aviso",
-    "calloutBody": "Esta guía usa un script externo de la comunidad para arrancar el LXC de Kodi. La parte de GPU (passthrough de la iGPU del host al contenedor) también la cubre el flujo automatizado de ProxMenux: <strong>GPUs and Coral-TPU → Add GPU to LXC</strong> en el menú de ProxMenux — se encarga del cableado de <code>/dev/dri</code> y de la instalación del driver dentro del CT. El script de abajo además arranca el propio Kodi y el autoarranque en <code>tty7</code>. Úsalo si quieres un LXC media center llave en mano; usa el <gpuLink>flujo de ProxMenux</gpuLink> si solo necesitas acceso a la GPU para un CT que has montado a mano.",
+    "calloutBody": "Esta guía utiliza un script externo de la comunidad para preparar el LXC de Kodi. ProxMenux también puede configurar el acceso a la iGPU del host: <strong>GPUs y Coral-TPU → Agregar GPU a un LXC</strong> configura <code>/dev/dri</code> e instala los controladores dentro del contenedor. El script siguiente instala además Kodi y el arranque automático en <code>tty7</code>. Úsalo para preparar un centro multimedia en LXC; elige el <gpuLink>asistente de ProxMenux</gpuLink> si solo necesitas dar acceso a la GPU a un contenedor que ya has configurado.",
     "credit": "Script original del LXC de Kodi creado por <authorLink>mrrudy</authorLink>.",
     "stepsTitle": "Qué vas a hacer",
     "steps": [
       "Crear un LXC privilegiado ejecutando Kodi (con el script).",
-      "Cablear tu teclado, ratón o mando USB dentro del CT.",
-      "(Opcional) Actualizar Kodi a la última versión desde el PPA team-xbmc."
+      "Dar acceso al teclado, ratón o mando USB desde el contenedor.",
+      "(Opcional) Actualizar Kodi desde los repositorios configurados en el contenedor."
     ]
   },
   "createCt": {
     "heading": "1. Crear el LXC de Kodi",
-    "body": "El CT tiene que ser <strong>privilegiado</strong> para que pueda acceder a los dispositivos USB de entrada (teclados, mandos a distancia, controles). El script se encarga de los flags de privilegio, el cableado de la GPU, la instalación de Kodi y el autoarranque en <code>tty7</code>:",
+    "body": "Para este procedimiento, selecciona <strong>Privileged</strong> en los ajustes avanzados del script. Por defecto crea contenedores sin privilegios, que requieren permisos de dispositivos y mapeo de identificadores adecuados. El script configura el acceso a la GPU, Kodi y su arranque en <code>tty7</code>:",
     "code": "bash -c \"$(wget -qLO - https://raw.githubusercontent.com/mrrudy/proxmoxHelper/main/ct/kodi-v1.sh)\"",
     "after": "Ten paciencia — la instalación tarda un rato. Cuando termine y Kodi arranque en <code>tty7</code>, puedes conectar tu monitor o TV directamente a la salida HDMI / DisplayPort del host y deberías ver la UI de Kodi."
   },
@@ -32,22 +32,22 @@
     "body": "Los dispositivos de entrada viven en <code>/dev/input/</code> en el host. Identifica el número major:",
     "listCode": "ls -l /dev/input",
     "imageAlt": "Listado de dispositivos de entrada",
-    "afterList": "Coge el número de la primera columna (en el ejemplo: <code>13</code>). Para el LXC de Kodi y luego edita su config (reemplaza <code>'<'CTID'>'</code> por el ID del contenedor — por ejemplo, <code>102</code>):",
-    "editCode": "nano /etc/pve/lxc/'<'CTID'>'.conf",
+    "afterList": "En los dispositivos de caracteres, toma el número major situado antes de la coma (en el ejemplo, <code>13</code>). En el host, edita la configuración del LXC de Kodi; sustituye <code>'<'CTID'>'</code> por su ID, por ejemplo <code>102</code>:",
+    "editCode": "nano /etc/pve/lxc/CTID.conf",
     "addLines": "Añade (ajusta <code>13</code> a lo que viste en <strong>tu</strong> host):",
-    "configCode": "lxc.cgroup2.devices.allow = c 13:* rwm\nlxc.mount.entry: /dev/input dev/input none bind,optional,create=dir",
+    "configCode": "lxc.cgroup2.devices.allow: c 13:* rwm\nlxc.mount.entry: /dev/input dev/input none bind,optional,create=dir",
     "imageConfigAlt": "Configuración del LXC",
     "save": "Guarda (<code>Ctrl+X</code>) y reinicia <strong>solo el contenedor</strong> — no hace falta reiniciar el host Proxmox entero:",
-    "restartCode": "pct restart '<'CTID'>'",
+    "restartCode": "pct reboot CTID",
     "plug": "Conecta el teclado / ratón / mando y Kodi debería responder."
   },
   "updateKodi": {
-    "heading": "3. (Opcional) Actualizar Kodi a la última versión",
+    "heading": "3. (Opcional) Actualizar Kodi desde los repositorios configurados",
     "calloutTitle": "Importante",
-    "calloutBody": "El PPA team-xbmc es <strong>solo para Ubuntu</strong>. Si el LXC de Kodi está basado en una plantilla Debian, <code>add-apt-repository</code> no estará disponible y el PPA no funcionará. El script de mrrudy usa por defecto una plantilla Ubuntu, así que normalmente esto se cumple. Para verificarlo: <code>cat /etc/os-release</code> dentro del contenedor — busca <code>NAME=\"Ubuntu\"</code>.",
+    "calloutBody": "El PPA team-xbmc es <strong>solo para Ubuntu</strong> y Kodi indica que ya no tiene mantenimiento. Que falte <code>add-apt-repository</code> no identifica la distribución. Compruébala con <code>cat /etc/os-release</code> y busca <code>NAME=\"Ubuntu\"</code>; no añadas PPA de Ubuntu a Debian. Los comandos siguientes actualizan los paquetes desde los repositorios configurados en el contenedor.",
     "body": "Dentro del contenedor (<code>pct enter '<'CTID'>'</code>):",
-    "code": "sudo add-apt-repository ppa:team-xbmc/ppa\nsudo apt update\nsudo apt install kodi kodi-bin",
-    "after": "Reinicia el contenedor cuando termine; al arrancar tendrás el último Kodi."
+    "code": "apt update\napt install --only-upgrade kodi kodi-bin",
+    "after": "Reinicia el contenedor después de actualizar. Kodi utilizará la versión disponible en los repositorios configurados, que puede diferir de la última versión del proyecto."
   },
   "screenshots": {
     "heading": "Capturas",
@@ -57,14 +57,14 @@
   "troubleshoot": {
     "heading": "Solución de problemas",
     "items": [
-      "<strong>El LXC de Kodi arranca pero no se ve nada en la TV:</strong> puede que el CT no haya heredado la iGPU. Confírmalo con <code>ls /dev/dri</code> dentro del contenedor (deberías ver <code>card0</code>, <code>renderD128</code>). Si está vacío, el passthrough de GPU no se aplicó — vuelve a ejecutar el script o usa el menú <strong>Add GPU to LXC</strong> de ProxMenux.",
-      "<strong>El teclado / ratón no se detecta tras reiniciar:</strong> el número major de <code>/dev/input</code> cambió (raro, pero pasa tras actualizaciones de kernel). Vuelve a ejecutar <code>ls -l /dev/input</code> en el host y actualiza la línea <code>lxc.cgroup2.devices.allow</code>.",
-      "<strong>La reproducción acelerada por hardware usa CPU en lugar de GPU:</strong> instala o actualiza los drivers VA-API dentro del contenedor (<code>intel-media-va-driver</code> para iGPUs Intel modernas, <code>i965-va-driver</code> para las más antiguas, <code>mesa-va-drivers</code> en AMD).",
-      "<strong><code>add-apt-repository: command not found</code>:</strong> el contenedor es Debian, no Ubuntu. O bien usa los paquetes Kodi de Debian (más antiguos pero estables), o bien recrea el CT desde una plantilla Ubuntu."
+      "<strong>El LXC de Kodi arranca pero no se ve nada en la TV:</strong> puede que el contenedor no tenga acceso a la iGPU. Comprueba <code>ls /dev/dri</code> en su interior: deberían aparecer <code>card0</code> y <code>renderD128</code>. Si está vacío, revisa el acceso a la GPU; puedes usar el menú <strong>Agregar GPU a un LXC</strong> de ProxMenux.",
+      "<strong>El teclado o ratón no se detecta tras reiniciar:</strong> comprueba que <code>/dev/input</code> esté montado y Kodi tenga permiso para leer los dispositivos. Ejecuta <code>ls -l /dev/input</code> en el host y el contenedor, y revisa la regla <code>lxc.cgroup2.devices.allow</code>.",
+      "<strong>La reproducción acelerada por hardware usa la CPU en lugar de la GPU:</strong> instala o actualiza los controladores VA-API en el contenedor: <code>intel-media-va-driver</code> para iGPU Intel modernas, <code>i965-va-driver</code> para las antiguas y <code>mesa-va-drivers</code> para AMD.",
+      "<strong><code>add-apt-repository: command not found</code>:</strong> falta el comando; eso no demuestra que el contenedor sea Debian. Comprueba la distribución y los paquetes disponibles. En Debian, utiliza sus paquetes Kodi sin añadir el PPA de Ubuntu."
     ]
   },
   "further": {
-    "heading": "Más lecturas",
-    "konpatRich": "<konpatLink>El post de Konpat</konpatLink> — contexto adicional sobre passthrough de iGPU Intel a LXC."
+    "heading": "Más información",
+    "konpatRich": "<konpatLink>Artículo de Konpat</konpatLink> con más contexto sobre el acceso a la iGPU Intel desde LXC."
   }
 }
diff --git a/web/messages/es/guides/lxc-samba.json b/web/messages/es/guides/lxc-samba.json
index c0bd16a3..a6d092e0 100644
--- a/web/messages/es/guides/lxc-samba.json
+++ b/web/messages/es/guides/lxc-samba.json
@@ -1,13 +1,13 @@
 {
   "meta": {
     "title": "Añadir una unidad USB a un LXC y compartirla con Samba | Guías ProxMenux",
-    "description": "Conecta un disco duro USB o una memoria USB a un contenedor LXC privilegiado en Proxmox VE, instala Samba dentro del contenedor y comparte el contenido por la red.",
+    "description": "Conecta un disco duro USB o memoria USB a un contenedor LXC privilegiado en Proxmox VE, instala Samba dentro del contenedor y comparte el contenido por la red.",
     "ogTitle": "Añadir una unidad USB a un LXC y compartirla con Samba",
     "ogDescription": "Conecta una unidad USB a un LXC privilegiado en Proxmox VE, instala Samba dentro del contenedor y comparte el contenido por la LAN."
   },
   "header": {
-    "title": "Añadir una unidad USB o memoria a un LXC y compartirla por la red con Samba",
-    "description": "Conecta un disco duro USB o una memoria USB a un contenedor LXC privilegiado en Proxmox VE, instala Samba dentro del contenedor y comparte el contenido por la red.",
+    "title": "Añadir un disco o memoria USB a un LXC y compartirlo por la red con Samba",
+    "description": "Conecta un disco duro USB o memoria USB a un contenedor LXC privilegiado en Proxmox VE, instala Samba dentro del contenedor y comparte el contenido por la red.",
     "section": "Guías"
   },
   "recommended": {
@@ -17,7 +17,7 @@
       "<strong>Disk Manager → Format / Wipe Physical Disk</strong> para el paso de formateo.",
       "<strong>Storage & Share Manager → LXC network sharing → Samba server in LXC</strong> para la instalación del CT privilegiado y la configuración de Samba."
     ],
-    "calloutOutro": "Los flujos guiados se encargan de las peculiaridades de permisos de los CT unprivileged, de los presets de modo de share (lectura-escritura / solo lectura / personalizado) y de la configuración del grupo sharedfiles. Esta guía es el equivalente manual — útil si quieres visibilidad total sobre cada paso o si prefieres cablearlo todo a mano."
+    "calloutOutro": "Los asistentes gestionan las particularidades de permisos de los contenedores sin privilegios, los perfiles de lectura y escritura, solo lectura o personalizados y el grupo sharedfiles. Esta guía explica los pasos manuales para que puedas entenderlos o configurarlos por tu cuenta."
   },
   "intro": {
     "body": "A veces resulta útil añadir un disco duro o una memoria USB a un host Proxmox, sobre todo en un mini PC con expansión interna limitada. Esta guía cubre:",
@@ -34,8 +34,8 @@
       "Guardar documentos que escanea automáticamente Paperless.",
       "Almacenamiento tipo NAS genérico para la red doméstica."
     ],
-    "privilegedCalloutTitle": "Se requiere un contenedor privilegiado",
-    "privilegedCalloutBody": "El passthrough directo de dispositivos (<code>mp0</code> con una ruta del host) necesita un LXC privilegiado. Los CT unprivileged no pueden hacer bind-mount directo de dispositivos de bloque — para esos necesitas bind mounts de directorios del host (consulta ProxMenux <strong>Storage & Share Manager → LXC Mount Points</strong>)."
+    "privilegedCalloutTitle": "Contenedor privilegiado para este procedimiento",
+    "privilegedCalloutBody": "Este procedimiento utiliza un LXC privilegiado con un dispositivo de bloque como <code>mp0</code>. Para un contenedor sin privilegios, una alternativa es montar el sistema de archivos en el host y pasar su directorio mediante bind mount, con permisos y mapeo de identificadores adecuados. Consulta <strong>Gestor de almacenamiento y recursos compartidos → Configurar puntos de montaje LXC</strong> en ProxMenux."
   },
   "attach": {
     "heading": "1. Conectar el disco USB al LXC",
@@ -48,29 +48,29 @@
     "lsblkBody": "También puedes usar <code>lsblk -o NAME,SIZE,MODEL,SERIAL</code> para listar cada dispositivo de bloque con su modelo y número de serie.",
     "stableCalloutTitle": "Importante — usa un identificador estable",
     "stableCalloutBody": "<code>/dev/sdb1</code> puede cambiar entre arranques si tienes varios discos USB. Busca el identificador persistente:",
-    "stableCalloutCode": "ls -l /dev/disk/by-id/ | grep -v part",
-    "stableCalloutAfter": "Usa la ruta <code>/dev/disk/by-id/usb-...</code> en la config del LXC en lugar de <code>/dev/sdb1</code>. Sobrevive a reinicios y a desconexiones.",
+    "stableCalloutCode": "ls -l /dev/disk/by-id/",
+    "stableCalloutAfter": "Utiliza la entrada <code>/dev/disk/by-id/usb-...</code> de la partición elegida en la configuración LXC, en lugar de <code>/dev/sdb1</code>. Escoge la partición, no el disco completo: así seguirá identificada aunque cambie el orden de los dispositivos.",
     "formatHeading": "1.2 Formatear el disco",
-    "formatBody": "ext4 es un valor por defecto razonable para shares basados en Linux (sensible a mayúsculas, soporta ACLs POSIX, sin límites de tamaño de fichero). Ejecútalo desde el <strong>host Proxmox</strong>, no desde el contenedor:",
+    "formatBody": "ext4 es una opción práctica para recursos compartidos desde Linux: distingue mayúsculas, admite ACL POSIX y archivos grandes. El formateo destruye el contenido del sistema de archivos existente. Confirma la partición y ejecuta el comando en el <strong>host Proxmox</strong>:",
     "formatCode": "mkfs.ext4 /dev/sdb1",
     "formatAfter": "Reemplaza <code>/dev/sdb1</code> por el dispositivo de partición real — o por la ruta persistente <code>/dev/disk/by-id/usb-...-part1</code>.",
     "mkdirHeading": "1.3 Crear el punto de montaje dentro del LXC",
     "mkdirBody": "Dentro del LXC, crea el directorio donde aparecerá el disco (cualquier nombre vale):",
     "mkdirCode": "mkdir /mnt/lxc_USB",
-    "wireHeading": "1.4 Cablear el dispositivo al LXC",
-    "wireBody": "En el <strong>host Proxmox</strong> (no dentro del CT), edita la config del contenedor. Reemplaza <code>'<'CTID'>'</code> por el ID del contenedor:",
-    "wireEditCode": "nano /etc/pve/lxc/'<'CTID'>'.conf",
+    "wireHeading": "1.4 Configurar el dispositivo en LXC",
+    "wireBody": "En el <strong>host Proxmox</strong>, edita la configuración del contenedor. Sustituye <code>'<'CTID'>'</code> por su ID:",
+    "wireEditCode": "nano /etc/pve/lxc/CTID.conf",
     "wireAddLine": "Añade esta línea:",
     "wireConfigCode": "mp0: /dev/disk/by-id/usb-VENDOR_MODEL_SERIAL-part1,mp=/mnt/lxc_USB,backup=0",
     "wireShortForm": "(O, si aceptas el riesgo de que la ruta del dispositivo cambie, la forma corta: <code>mp0: /dev/sdb1,mp=/mnt/lxc_USB,backup=0</code>.)",
-    "wireBackupNote": "El flag <code>backup=0</code> excluye este punto de montaje de los backups de <code>vzdump</code> — normalmente la elección correcta para discos externos grandes que son el almacenamiento de destino del host y no sus datos.",
+    "wireBackupNote": "El ejemplo utiliza <code>backup=0</code>. El contenido de los montajes de dispositivos y de tipo bind no se incluye en las copias <code>vzdump</code> del contenedor. Prepara una copia independiente de los datos del disco externo.",
     "restartHeading": "1.5 Reiniciar el LXC y ajustar permisos",
     "restartBody": "Reinicia el CT para aplicar el punto de montaje:",
-    "restartCode": "pct restart '<'CTID'>'",
-    "permsBody": "Dentro del LXC, dale al directorio los permisos apropiados para el usuario que será dueño del share:",
-    "permsCode": "# Dentro del contenedor\nmkdir -p /mnt/lxc_USB\nchown -R proxmenux:proxmenux /mnt/lxc_USB\nchmod 770 /mnt/lxc_USB",
+    "restartCode": "pct reboot CTID",
+    "permsBody": "Dentro del LXC, crea el usuario del recurso compartido antes de asignarle la propiedad y ajusta los permisos del directorio:",
+    "permsCode": "adduser --system --group --no-create-home --shell /usr/sbin/nologin proxmenux\nmkdir -p /mnt/lxc_USB\nchown -R proxmenux:proxmenux /mnt/lxc_USB\nchmod 770 /mnt/lxc_USB",
     "permsNoteTitle": "Nota",
-    "permsNote": "Reemplaza <code>proxmenux</code> por el nombre de usuario que crearás en el paso 2.2 más abajo. <code>770</code> da acceso total al usuario y al grupo, sin acceso para el resto — más seguro que el <code>chmod -R 777</code> abierto a todos y aun así suficiente para que el share funcione."
+    "permsNote": "Sustituye <code>proxmenux</code> por el nombre que elijas. El modo <code>770</code> permite acceder al propietario y al grupo, sin acceso para otros; es más restrictivo que <code>chmod -R 777</code>. El usuario se crea aquí y se registra en Samba en el paso 2.2."
   },
   "samba": {
     "heading": "2. Instalar Samba",
@@ -78,17 +78,17 @@
     "installCode": "apt-get update\napt-get install -y samba",
     "confirmBody": "Confirma que el servicio está corriendo:",
     "confirmCode": "systemctl status smbd.service",
-    "userHeading": "2.2 Crear el usuario del share",
-    "userBody": "Escoge un nombre de usuario (aquí usamos <code>proxmenux</code>; sustitúyelo por el tuyo). Créalo como usuario del sistema sin shell:",
-    "userCode": "adduser proxmenux",
+    "userHeading": "2.2 Verificar el usuario del recurso compartido",
+    "userBody": "El usuario <code>proxmenux</code> se creó en el paso 1.5 como usuario del sistema sin shell de inicio de sesión. Compruébalo antes de establecer la contraseña Samba; utiliza el nombre que hayas elegido en todos los pasos:",
+    "userCode": "id proxmenux",
     "passwordBody": "Establece la contraseña de Samba (independiente de la contraseña del sistema — Samba mantiene su propio almacén de credenciales):",
     "passwordCode": "smbpasswd -a proxmenux",
     "aclHeading": "2.3 Configurar la propiedad / ACLs",
     "aclBody": "Si el simple <code>chown</code> del paso 1.5 te basta, los permisos ya están listos. Para un control más fino (varios usuarios compartiendo la misma ruta con permisos distintos), usa ACLs:",
-    "aclCode": "apt-get install -y acl\nsetfacl -R -m \"u:proxmenux:rwx\" /mnt/lxc_USB\nsetfacl -d -R -m \"u:proxmenux:rwx\" /mnt/lxc_USB    # ACL por defecto — se aplica a los ficheros nuevos"
+    "aclCode": "apt-get install -y acl\nsetfacl -R -m \"u:proxmenux:rwx\" /mnt/lxc_USB\nsetfacl -d -R -m \"u:proxmenux:rwx\" /mnt/lxc_USB    # default ACL — applies to new files"
   },
   "configure": {
-    "heading": "3. Configurar el share de Samba",
+    "heading": "3. Configurar el recurso compartido Samba",
     "editHeading": "3.1 Editar smb.conf",
     "editCode": "nano /etc/samba/smb.conf",
     "appendBody": "Añade una definición de share al final:",
@@ -109,11 +109,11 @@
   "troubleshoot": {
     "heading": "Solución de problemas",
     "items": [
-      "<strong><code>pct restart</code> falla con \"device not found\":</strong> la ruta del dispositivo en <code>mp0</code> no existe en el host. Comprueba con <code>ls -l /dev/disk/by-id/</code> y actualiza la ruta.",
-      "<strong>El CT arranca pero <code>/mnt/lxc_USB</code> está vacío:</strong> el disco no está montado dentro del CT. Comprueba desde el host: <code>pct exec '<'CTID'>' -- mount | grep lxc_USB</code>. Si no aparece, el punto de montaje en la config está mal.",
-      "<strong>Samba autentica pero las escrituras fallan con \"Permission denied\":</strong> los permisos Linux del directorio no permiten al usuario de Samba escribir. Revisa <code>chown</code> / <code>setfacl</code> en la sección 1.5 / 2.3.",
-      "<strong>El share no aparece en los navegadores de red pero <code>smb://'<'ip'>'/lxc_usb</code> sí funciona:</strong> la visibilidad por LAN depende de NetBIOS / WS-Discovery. Añade <code>nmbd</code>: <code>apt-get install -y samba-common-bin</code> y asegúrate de que <code>nmbd</code> esté habilitado.",
-      "<strong>Quieres añadir un segundo usuario al mismo share:</strong> crea el usuario con <code>adduser</code>, regístralo con <code>smbpasswd -a</code> y añádelo a la lista <code>valid users =</code> del share separado por comas."
+      "<strong><code>pct reboot</code> falla con “device not found”:</strong> comprueba que la ruta del dispositivo en <code>mp0</code> exista en el host. Revisa <code>ls -l /dev/disk/by-id/</code> y corrígela si hace falta.",
+      "<strong>El CT arranca, pero <code>/mnt/lxc_USB</code> está vacío:</strong> puede faltar el montaje o estar vacío el sistema de archivos. Comprueba desde el host con <code>pct exec '<'CTID'>' -- mount | grep lxc_USB</code>. Si no aparece el montaje, revisa su configuración, la ruta del dispositivo y los errores de arranque.",
+      "<strong>Samba autentica, pero falla al escribir con “Permission denied”:</strong> revisa los permisos Linux del directorio y los ajustes de escritura del recurso compartido. Comprueba <code>chown</code> y <code>setfacl</code> en las secciones 1.5 y 2.3.",
+      "<strong>El recurso no aparece en la red, pero <code>smb://'<'ip'>'/lxc_usb</code> funciona:</strong> el descubrimiento NetBIOS antiguo utiliza <code>nmbd</code>. Windows moderno usa WS-Discovery; en Debian 12 instala <code>apt-get install -y wsdd</code>; en Debian 13, donde <code>wsdd</code> no está en el archivo estable, usa <code>apt-get install -y wsdd2</code>. Revisa el servicio y el cortafuegos. Habilitar solo <code>nmbd</code> no proporciona WS-Discovery.",
+      "<strong>Para añadir otro usuario al recurso compartido:</strong> créalo con <code>adduser</code>, regístralo con <code>smbpasswd -a</code> y añádelo a la lista <code>valid users =</code>, separada por comas. Concede también los permisos o ACL necesarios en el sistema de archivos."
     ]
   }
 }
diff --git a/web/messages/es/guides/nvidia-manual.json b/web/messages/es/guides/nvidia-manual.json
index 9d1d5f0d..41ec7744 100644
--- a/web/messages/es/guides/nvidia-manual.json
+++ b/web/messages/es/guides/nvidia-manual.json
@@ -1,18 +1,18 @@
 {
   "meta": {
     "title": "Instalación de drivers NVIDIA en Proxmox VE 9 (procedimiento manual) | Guías ProxMenux",
-    "description": "Instalación y configuración manual de drivers NVIDIA en un host Proxmox VE 9, más el cableado del LXC necesario para exponer la GPU a uno o varios contenedores. Cubre la instalación de drivers, el servicio de persistencia, el parche NVENC opcional y la configuración por contenedor.",
+    "description": "Instalación y configuración manual de los controladores NVIDIA en un host Proxmox VE 9 y del acceso a la GPU desde uno o varios contenedores LXC. Incluye el controlador, el servicio de persistencia, el parche NVENC opcional y la configuración de cada contenedor.",
     "ogTitle": "Instalación de drivers NVIDIA en Proxmox VE 9 (procedimiento manual)",
     "ogDescription": "Instalación manual de drivers NVIDIA en PVE 9 — driver del host, servicio de persistencia, parche NVENC opcional y cableado LXC por contenedor."
   },
   "header": {
     "title": "Instalación de drivers de tarjeta gráfica NVIDIA en Proxmox VE 9 (procedimiento manual)",
-    "description": "Instalación y configuración manual de drivers NVIDIA en un host Proxmox VE 9, más el cableado del LXC necesario para exponer la GPU a uno o varios contenedores. Cubre la instalación de drivers, el servicio de persistencia, el parche NVENC opcional y la configuración por contenedor.",
+    "description": "Instalación y configuración manual de los controladores NVIDIA en un host Proxmox VE 9 y del acceso a la GPU desde uno o varios contenedores LXC. Incluye el controlador, el servicio de persistencia, el parche NVENC opcional y la configuración de cada contenedor.",
     "section": "Guías"
   },
   "intro": {
     "calloutTitle": "Nota",
-    "calloutBody": "Este es el procedimiento manual conservado como referencia. Para la mayoría de usuarios, el camino recomendado es el flujo automatizado de ProxMenux: <strong>Install NVIDIA Drivers (Host)</strong> en el menú <em>GPUs and Coral-TPU</em>, y <strong>Add GPU to LXC</strong> (o <strong>Add GPU to VM</strong>) para el cableado por guest. El flujo automatizado se encarga de los mismos pasos documentados aquí (con comprobaciones de seguridad adicionales: compatibilidad de kernel headers, validación de IOMMU, resolución de conflictos con VFIO). Esta página es para operadores que quieran entender cada comando, o que necesiten desviarse del flujo estándar.",
+    "calloutBody": "Este procedimiento manual se conserva como referencia. Para la mayoría de usuarios recomendamos el asistente de ProxMenux: <strong>Instalar controladores NVIDIA en el host</strong>, en <em>GPUs y Coral-TPU</em>, y después <strong>Agregar GPU a un LXC</strong> o <strong>Añadir GPU a VM</strong> para configurar el invitado. El asistente realiza los mismos pasos con comprobaciones adicionales de las cabeceras del kernel, IOMMU y conflictos VFIO. Esta página permite entender cada comando o adaptar la configuración.",
     "targetNote": "Dirigido a <strong>Proxmox VE 9</strong> (Debian Trixie). PVE 7 (Bullseye) y PVE 8 (Bookworm) ya no se cubren.",
     "stepsTitle": "Qué vas a hacer",
     "steps": [
@@ -20,19 +20,19 @@
       "Instalar el driver NVIDIA en el host.",
       "Instalar el servicio de persistencia NVIDIA.",
       "(Opcional) Aplicar el parche de keylase para levantar el límite de sesiones concurrentes de NVENC en GPUs de consumo.",
-      "Cablear la GPU en uno o varios contenedores LXC e instalar el driver correspondiente dentro de cada uno."
+      "Dar acceso a la GPU a uno o varios contenedores LXC e instalar la versión correspondiente del controlador en cada uno."
     ]
   },
   "prepareHost": {
     "heading": "1. Preparar el host (PVE 9)",
-    "blacklistHeading": "1.1 Blacklist de nouveau",
+    "blacklistHeading": "1.1 Bloquear nouveau",
     "blacklistBody": "Comprueba si el driver open-source <code>nouveau</code> ya está en la blacklist:",
     "blacklistCheckCode": "cat /etc/modprobe.d/blacklist.conf",
     "blacklistAdd": "Si <code>blacklist nouveau</code> no aparece, añádelo y reinicia:",
-    "blacklistAddCode": "echo \"blacklist nouveau\" '>>' /etc/modprobe.d/blacklist.conf\nreboot",
+    "blacklistAddCode": "echo \"blacklist nouveau\" >> /etc/modprobe.d/blacklist.conf\nupdate-initramfs -u -k all\nreboot",
     "blacklistImageAlt": "Comprobación de blacklist",
     "reposHeading": "1.2 Verificar repositorios (PVE 9 / Trixie)",
-    "reposBody": "Si has ejecutado el script Post-Install de ProxMenux (o cualquier otra herramienta post-install de Proxmox), los repositorios ya están listos — sáltate este paso.",
+    "reposBody": "Las herramientas de postinstalación pueden haber configurado ya los repositorios. Revisa las fuentes existentes y omite los cambios que ya estén hechos; no dupliques entradas.",
     "reposOtherwise": "Si no, en una instalación PVE 9 limpia sin suscripción enterprise:",
     "reposEditCode": "nano /etc/apt/sources.list.d/proxmox.sources",
     "reposPveBody": "Asegúrate de que contiene la fuente no-subscription para Trixie:",
@@ -47,7 +47,7 @@
   "installDriver": {
     "heading": "2. Instalar el driver NVIDIA en el host",
     "pickHeading": "2.1 Elegir una versión de driver",
-    "pickBody": "Consulta el último driver estable:",
+    "pickBody": "Elige una rama del controlador compatible con tu GPU y el kernel en uso. La más reciente puede excluir modelos antiguos; consulta la lista de productos compatibles de la versión NVIDIA elegida:",
     "pickUrlCode": "https://download.nvidia.com/XFree86/Linux-x86_64/latest.txt",
     "nvencCallout": "Si vas a aplicar el parche NVENC (paso 4), verifica primero que el parche soporte tu versión de driver: <patchLink>github.com/keylase/nvidia-patch</patchLink>",
     "nvencCalloutTitle": "Aviso",
@@ -56,27 +56,27 @@
     "pickImageAlt": "Descarga del driver NVIDIA",
     "pickVersionNote": "A lo largo del resto de esta guía, reemplaza <code>'<'VERSION'>'</code> por la versión real (por ejemplo, <code>580.95.05</code>).",
     "downloadHeading": "2.2 Descargar y ejecutar el instalador",
-    "downloadCode": "mkdir -p /opt/nvidia\ncd /opt/nvidia\nwget https://download.nvidia.com/XFree86/Linux-x86_64/'<'VERSION'>'/NVIDIA-Linux-x86_64-'<'VERSION'>'.run\nchmod +x NVIDIA-Linux-x86_64-'<'VERSION'>'.run",
-    "firstPassBody": "Primera pasada — esto desactiva <code>nouveau</code> y prepara el sistema:",
-    "firstPassCode": "./NVIDIA-Linux-x86_64-'<'VERSION'>'.run --no-questions --ui=none --disable-nouveau\nreboot",
+    "downloadCode": "mkdir -p /opt/nvidia\ncd /opt/nvidia\nwget https://download.nvidia.com/XFree86/Linux-x86_64/VERSION/NVIDIA-Linux-x86_64-VERSION.run\nchmod +x NVIDIA-Linux-x86_64-VERSION.run",
+    "firstPassBody": "Ejecuta el instalador. La opción siguiente puede desactivar <code>nouveau</code> si hace falta; quizá necesites reiniciar antes de completar la instalación:",
+    "firstPassCode": "./NVIDIA-Linux-x86_64-VERSION.run --no-questions --ui=none --disable-nouveau\nreboot",
     "secondPassBody": "Cuando el host vuelva, ejecuta el instalador de nuevo para compilar e instalar el módulo del kernel:",
-    "secondPassCode": "/opt/nvidia/NVIDIA-Linux-x86_64-'<'VERSION'>'.run --no-questions --ui=none",
+    "secondPassCode": "/opt/nvidia/NVIDIA-Linux-x86_64-VERSION.run --no-questions --ui=none",
     "modulesHeading": "2.3 Cargar módulos NVIDIA en el arranque",
     "modulesBody": "Edita la configuración de carga de módulos:",
     "modulesEditCode": "nano /etc/modules-load.d/modules.conf",
-    "modulesAddBody": "Añade los módulos VFIO y NVIDIA:",
-    "modulesAddCode": "vfio\nvfio_iommu_type1\nvfio_pci\nvfio_virqfd\nnvidia\nnvidia_uvm",
+    "modulesAddBody": "Añade los módulos NVIDIA necesarios para el host y LXC. Los módulos VFIO son para acceso directo desde una VM y no hacen falta para este procedimiento LXC:",
+    "modulesAddCode": "nvidia\nnvidia_uvm",
     "modulesSaveBody": "Guarda (<code>Ctrl+X</code>) y reconstruye initramfs:",
     "modulesSaveCode": "update-initramfs -u -k all",
     "udevHeading": "2.4 Crear reglas udev",
     "udevBody": "Para que los nodos de dispositivo <code>/dev/nvidia*</code> se creen cuando se cargan los módulos:",
     "udevEditCode": "nano /etc/udev/rules.d/70-nvidia.rules",
-    "udevRulesCode": "# /etc/udev/rules.d/70-nvidia.rules\n# Create /dev/nvidia0, /dev/nvidia1 ... and /dev/nvidiactl when nvidia module is loaded\nKERNEL==\"nvidia\", RUN+=\"/bin/bash -c ''/usr/bin/nvidia-smi -L''\"\n\n# Create the CUDA node when nvidia_uvm CUDA module is loaded\nKERNEL==\"nvidia_uvm\", RUN+=\"/bin/bash -c ''/usr/bin/nvidia-modprobe -c0 -u''\"",
+    "udevRulesCode": "# /etc/udev/rules.d/70-nvidia.rules\nKERNEL==\"nvidia\", RUN+=\"/bin/bash -c '/usr/bin/nvidia-smi -L'\"\nKERNEL==\"nvidia_uvm\", RUN+=\"/bin/bash -c '/usr/bin/nvidia-modprobe -c0 -u'\"",
     "udevSaveBody": "Guarda (<code>Ctrl+X</code>)."
   },
   "persistence": {
     "heading": "3. Servicio de persistencia del driver NVIDIA",
-    "body": "El daemon de persistencia mantiene la GPU inicializada entre usos, lo que evita la penalización de latencia y la pérdida ocasional de estado que ocurre cuando el módulo del kernel se carga y descarga repetidamente:",
+    "body": "El servicio de persistencia mantiene la GPU inicializada cuando ninguna otra aplicación la usa. Reduce la latencia de reinicialización y conserva el estado de inicialización entre clientes:",
     "installCode": "cd /opt/nvidia\ngit clone https://github.com/NVIDIA/nvidia-persistenced.git\ncd nvidia-persistenced/init\n./install.sh\nreboot",
     "verifyBody": "Verifica que el driver está cargado y el servicio está en marcha tras reiniciar:",
     "verifySmiCode": "nvidia-smi",
@@ -86,7 +86,7 @@
   },
   "nvenc": {
     "heading": "4. (Opcional) Levantar el límite de sesiones concurrentes de NVENC",
-    "body": "Las GPUs NVIDIA de consumo vienen con un límite hardcodeado en el número de sesiones simultáneas de codificación NVENC (típicamente 3, 5 u 8 según la generación). El parche de keylase elimina esa restricción. Útil cuando ejecutas cargas de transcodificación de Plex / Jellyfin / Frigate.",
+    "body": "El límite de sesiones NVENC depende del modelo de GPU y de la versión del controlador; consulta la matriz de NVIDIA en vez de asumir una cifra por generación. El parche keylase elimina el límite de software en las versiones compatibles. Puede ayudar en tareas de codificación como la transcodificación de Plex o Jellyfin.",
     "code": "cd /opt/nvidia\ngit clone https://github.com/keylase/nvidia-patch.git\ncd nvidia-patch\n./patch.sh",
     "imageAlt": "Aplicación del parche NVIDIA",
     "after": "El parche debe reaplicarse después de cada actualización del driver. El repositorio de keylase también incluye <code>patch-fbc.sh</code> para el límite de FBC (frame buffer capture) si lo necesitas."
@@ -103,24 +103,36 @@
       "major": "Major típico"
     },
     "tableRows": [
-      { "device": "<code>/dev/nvidia0</code>, <code>/dev/nvidiactl</code>", "major": "195" },
-      { "device": "<code>/dev/nvidia-uvm</code>, <code>/dev/nvidia-uvm-tools</code>", "major": "509 (varía)" },
-      { "device": "<code>/dev/dri/*</code>", "major": "226" },
-      { "device": "<code>/dev/nvidia-modeset</code>", "major": "195 (comparte con nvidia)" }
+      {
+        "device": "<code>/dev/nvidia0</code>, <code>/dev/nvidiactl</code>",
+        "major": "195"
+      },
+      {
+        "device": "<code>/dev/nvidia-uvm</code>, <code>/dev/nvidia-uvm-tools</code>",
+        "major": "509 (varía)"
+      },
+      {
+        "device": "<code>/dev/dri/*</code>",
+        "major": "226"
+      },
+      {
+        "device": "<code>/dev/nvidia-modeset</code>",
+        "major": "195 (comparte con nvidia)"
+      }
     ],
     "editHeading": "5.2 Editar la config del LXC",
     "editBody": "Para el contenedor primero si está corriendo. Abre su archivo de configuración (reemplaza <code>'<'CTID'>'</code> por el ID del contenedor):",
-    "editCode": "nano /etc/pve/lxc/'<'CTID'>'.conf",
+    "editCode": "nano /etc/pve/lxc/CTID.conf",
     "editConfigBody": "Comenta las líneas <code>lxc.cgroup2.devices.allow</code> o <code>/dev/dri</code> preexistentes que entren en conflicto, luego añade el cableado NVIDIA (ajusta los números major a lo que <code>ls -l /dev/nv*</code> mostró en <strong>tu</strong> host):",
-    "editConfigCode": "lxc.cgroup2.devices.allow: c 195:* rwm\nlxc.cgroup2.devices.allow: c 509:* rwm\nlxc.cgroup2.devices.allow: c 10:* rwm\nlxc.cgroup2.devices.allow: c 238:* rwm\nlxc.mount.entry: /dev/nvidia0 dev/nvidia0 none bind,optional,create=file\nlxc.mount.entry: /dev/nvidiactl dev/nvidiactl none bind,optional,create=file\nlxc.mount.entry: /dev/nvidia-uvm dev/nvidia-uvm none bind,optional,create=file\nlxc.mount.entry: /dev/nvidia-modeset dev/nvidia-modeset none bind,optional,create=file\nlxc.mount.entry: /dev/nvidia-uvm-tools dev/nvidia-uvm-tools none bind,optional,create=file\nlxc.mount.entry: /dev/nvram dev/nvram none bind,optional,create=file",
+    "editConfigCode": "lxc.cgroup2.devices.allow: c 195:* rwm\nlxc.cgroup2.devices.allow: c 509:* rwm\nlxc.mount.entry: /dev/nvidia0 dev/nvidia0 none bind,optional,create=file\nlxc.mount.entry: /dev/nvidiactl dev/nvidiactl none bind,optional,create=file\nlxc.mount.entry: /dev/nvidia-uvm dev/nvidia-uvm none bind,optional,create=file\nlxc.mount.entry: /dev/nvidia-modeset dev/nvidia-modeset none bind,optional,create=file\nlxc.mount.entry: /dev/nvidia-uvm-tools dev/nvidia-uvm-tools none bind,optional,create=file",
     "editConfigImageAlt": "Configuración del LXC",
     "editSave": "Guarda (<code>Ctrl+X</code>) y arranca el contenedor.",
     "installCtHeading": "5.3 Instalar el driver dentro del contenedor",
     "installCtCalloutTitle": "Importante",
     "installCtCalloutBody": "Esta parte se ejecuta <strong>dentro</strong> del contenedor, no en el host.",
     "installCtBody": "El módulo del kernel ya está cargado por el host — el contenedor solo necesita las librerías de userland que coincidan con la misma versión del driver:",
-    "installCtCode": "mkdir -p /opt/nvidia\ncd /opt/nvidia\nwget https://download.nvidia.com/XFree86/Linux-x86_64/'<'VERSION'>'/NVIDIA-Linux-x86_64-'<'VERSION'>'.run\nchmod +x NVIDIA-Linux-x86_64-'<'VERSION'>'.run\n./NVIDIA-Linux-x86_64-'<'VERSION'>'.run --no-kernel-module",
-    "installCtAfter": "Acepta los valores por defecto en cada prompt.",
+    "installCtCode": "mkdir -p /opt/nvidia\ncd /opt/nvidia\nwget https://download.nvidia.com/XFree86/Linux-x86_64/VERSION/NVIDIA-Linux-x86_64-VERSION.run\nchmod +x NVIDIA-Linux-x86_64-VERSION.run\n./NVIDIA-Linux-x86_64-VERSION.run --no-kernel-module",
+    "installCtAfter": "Revisa las preguntas y limita esta instalación a las bibliotecas de espacio de usuario. No compiles ni instales un módulo del kernel dentro del LXC.",
     "installCtImageAlt": "Instalación del driver NVIDIA",
     "verifyCtHeading": "5.4 Verificar dentro del contenedor",
     "verifyCtSmiCode": "nvidia-smi",
@@ -129,25 +141,25 @@
     "verifyCtLsImageAlt": "Dispositivos NVIDIA en LXC",
     "verifyCtAfter": "Deberías ver la GPU listada y los nodos de dispositivo montados en el sistema de archivos del contenedor.",
     "workloadHeading": "5.5 Confirmar que una carga real usa la GPU",
-    "workloadBody": "Para Plex / Jellyfin, transcodifica un vídeo y mira el dashboard / logs — la transcodificación acelerada por hardware ya está activa.",
+    "workloadBody": "Activa la aceleración NVIDIA en Plex o Jellyfin, transcodifica un vídeo y comprueba el uso real de la GPU en su panel o registros. Instalar el controlador no activa por sí solo la aceleración en la aplicación.",
     "workloadImage1Alt": "Plex usando la GPU NVIDIA",
     "workloadImage2Alt": "Plex usando la GPU NVIDIA - sesión activa",
-    "repeatNote": "Para cablear la GPU en otro contenedor, repite la <strong>sección 5</strong> para cada CTID adicional. La instalación del driver dentro del contenedor solo hace falta hacerla una vez por contenedor."
+    "repeatNote": "Repite la <strong>sección 5</strong> para cada contenedor adicional que necesite la GPU. Cuando actualices el controlador del host, mantén sincronizadas las bibliotecas de espacio de usuario de todos los contenedores."
   },
   "docker": {
     "heading": "6. (Opcional) NVIDIA Docker dentro de un LXC",
-    "body": "Si el contenedor ejecuta Docker y quieres que los contenedores-dentro-del-contenedor usen la GPU, instala <code>nvidia-docker2</code>. Desde dentro del LXC:",
-    "code": "wget https://raw.githubusercontent.com/MacRimi/manuales/main/NVIDIA/nvidia-docker.sh\nchmod +x nvidia-docker.sh\n./nvidia-docker.sh",
-    "after": "El script se encarga de la configuración del repositorio, la instalación del paquete y la configuración del daemon Docker de una sola vez."
+    "body": "Si Docker ya está instalado en el LXC, instala <code>nvidia-container-toolkit</code> dentro para dar acceso a la GPU a sus contenedores Docker. El acceso desde el LXC debe funcionar primero. Estos comandos son para Docker ejecutado como root:",
+    "code": "apt-get update\napt-get install -y ca-certificates curl gnupg\ncurl -fsSL https://nvidia.github.io/libnvidia-container/gpgkey | gpg --dearmor --yes -o /usr/share/keyrings/nvidia-container-toolkit-keyring.gpg\ncurl -fsSL https://nvidia.github.io/libnvidia-container/stable/deb/nvidia-container-toolkit.list | sed 's#deb https://#deb [signed-by=/usr/share/keyrings/nvidia-container-toolkit-keyring.gpg] https://#g' > /etc/apt/sources.list.d/nvidia-container-toolkit.list\napt-get update\napt-get install -y nvidia-container-toolkit\nnvidia-ctk runtime configure --runtime=docker\nsystemctl restart docker",
+    "after": "Estos comandos configuran el repositorio de NVIDIA, instalan el toolkit, configuran el entorno de Docker y lo reinician. Siguen aplicándose los permisos de dispositivos y las restricciones cgroup del LXC; verifica la GPU con una carga de prueba."
   },
   "troubleshoot": {
     "heading": "Solución de problemas",
     "items": [
-      "<strong><code>nvidia-smi</code> en el host muestra la GPU, pero dentro del contenedor da error \"No devices found\":</strong> las versiones del driver no coinciden. Vuelve a descargar la misma <code>'<'VERSION'>'</code> dentro del contenedor y ejecútalo con <code>--no-kernel-module</code>.",
-      "<strong>La compilación del driver falla en el host con \"No precompiled kernel interface was found\":</strong> faltan los kernel headers o están desincronizados. Vuelve a ejecutar <code>apt-get install pve-headers-$(uname -r)</code> y confirma que <code>uname -r</code> coincide con el kernel en ejecución.",
-      "<strong>Las sesiones de NVENC siguen capadas después de aplicar el parche:</strong> el parche fue sobrescrito por una actualización del driver. Vuelve a ejecutar <code>./patch.sh</code> desde <code>/opt/nvidia/nvidia-patch</code>.",
-      "<strong>La GPU deja de responder tras unas horas de inactividad:</strong> el daemon de persistencia no está corriendo. Compruébalo con <code>systemctl status nvidia-persistenced</code> y arráncalo / habilítalo.",
-      "<strong>El contenedor arranca pero <code>ls /dev/nv*</code> no muestra nada:</strong> los números major en la config del LXC no coinciden con los del host. Vuelve a ejecutar <code>ls -l /dev/nv*</code> en el host y ajusta las líneas <code>lxc.cgroup2.devices.allow</code> en consecuencia."
+      "<strong><code>nvidia-smi</code> funciona en el host, pero muestra “No devices found” en el contenedor:</strong> revisa los montajes, permisos y versiones de las bibliotecas. Si difieren, instala la misma <code>'<'VERSION'>'</code> del host dentro del contenedor con <code>--no-kernel-module</code>.",
+      "<strong>Falla la compilación del controlador:</strong> consulta el registro. “No precompiled kernel interface was found” puede indicar que el instalador debe compilar localmente. Instala las cabeceras de <code>uname -r</code> con <code>apt-get install pve-headers-$(uname -r)</code> o el paquete proxmox-headers equivalente.",
+      "<strong>Las sesiones NVENC siguen limitadas:</strong> confirma que el parche admita el controlador activo. Una actualización puede sobrescribirlo. Para una versión compatible, vuelve a aplicar <code>./patch.sh</code> desde <code>/opt/nvidia/nvidia-patch</code> y revisa su salida.",
+      "<strong>La GPU deja de responder tras estar inactiva:</strong> comprueba <code>systemctl status nvidia-persistenced</code> y activa el servicio si corresponde. Revisa también los registros del kernel y del controlador; no es la única causa posible.",
+      "<strong>El contenedor arranca, pero <code>ls /dev/nv*</code> no muestra dispositivos NVIDIA:</strong> revisa los bind mounts y las rutas del host. Usa <code>ls -l /dev/nv*</code> en el host para verificar los números major de NVIDIA y comprueba las reglas <code>lxc.cgroup2.devices.allow</code> y los permisos."
     ]
   }
 }
diff --git a/web/messages/fr/common.json b/web/messages/fr/common.json
new file mode 100644
index 00000000..76c712d2
--- /dev/null
+++ b/web/messages/fr/common.json
@@ -0,0 +1,254 @@
+{
+  "site": {
+    "name": "ProxMenux",
+    "tagline": "Menu interactif et tableau de bord web pour Proxmox VE"
+  },
+  "nav": {
+    "home": "Accueil",
+    "docs": "Documentation",
+    "documentation": "Documentation",
+    "guides": "Guides",
+    "changelog": "Journal des modifications",
+    "github": "GitHub",
+    "rss": "RSS",
+    "rssTitle": "Flux RSS",
+    "menuOpen": "Ouvrir le menu"
+  },
+  "footer": {
+    "sponsorHeading": "Soutenir le projet",
+    "sponsorBody": "Si vous souhaitez soutenir le projet.",
+    "sponsorAlt": "Soutenez-moi sur Ko-fi",
+    "connectHeading": "Communauté",
+    "connectBody": "Rejoignez les discussions de la communauté sur GitHub pour obtenir de l’aide, partager vos idées et contribuer au projet. Toutes les idées sont les bienvenues !",
+    "joinDiscussion": "Participer à la discussion",
+    "copyrightPrefix": "ProxMenux, un projet collaboratif et open source créé par",
+    "copyrightSuffix": "."
+  },
+  "language": {
+    "switcher": "Langue",
+    "en": "English",
+    "es": "Español",
+    "sk": "Slovenčina",
+    "de": "Deutsch",
+    "fr": "Français",
+    "it": "Italiano",
+    "pt": "Português",
+    "sv": "Svenska"
+  },
+  "resources": {
+    "documentation": {
+      "title": "Documentation",
+      "description": "Présentation du système et guides d’utilisation"
+    },
+    "changelog": {
+      "title": "Journal des modifications",
+      "description": "Informations sur les dernières mises à jour"
+    },
+    "guides": {
+      "title": "Guides",
+      "description": "Tutoriels et guides pas à pas pour les tâches courantes"
+    },
+    "github": {
+      "title": "Dépôt GitHub",
+      "description": "Consultez le code source."
+    }
+  },
+  "docSidebar": {
+    "documentation": "Documentation",
+    "items": {
+      "introduction": "Introduction",
+      "installation": "Installation",
+      "proxmenuxMonitor": "ProxMenux Monitor",
+      "monitorOverview": "Vue d’ensemble",
+      "architecture": "Architecture",
+      "accessAuth": "Accès et authentification",
+      "dashboard": "Tableau de bord",
+      "dashboardSystemOverview": "Onglet Vue d’ensemble du système",
+      "dashboardApps": "Onglet Applications",
+      "dashboardStorage": "Onglet Stockage",
+      "dashboardNetwork": "Onglet Réseau",
+      "dashboardVmsLxcs": "Onglet VM et LXC",
+      "dashboardVmsLxcsApp": "Application",
+      "dashboardVmsLxcsUpdates": "Mises à jour",
+      "dashboardHardware": "Onglet Matériel",
+      "dashboardSystemLogs": "Onglet Journaux système",
+      "dashboardTerminal": "Onglet Terminal",
+      "dashboardSecurity": "Onglet Sécurité",
+      "dashboardSettings": "Onglet Paramètres",
+      "healthMonitor": "Surveillance de l’état du système",
+      "auditReport": "Audit et rapports",
+      "auditReportOverview": "Vue d’ensemble",
+      "auditReportAssessment": "Évaluation et inventaire",
+      "auditReportPolicy": "Politique",
+      "auditReportChanges": "Modifications",
+      "auditReportReports": "Rapports et comparaisons",
+      "auditReportScope": "Périmètre et garanties",
+      "notifications": "Notifications",
+      "aiAssistant": "Assistant IA",
+      "apiReference": "Référence de l’API",
+      "integrations": "Intégrations",
+      "ociManager": "OCI manager Apps",
+      "ociOverview": "Vue d’ensemble",
+      "ociArchitecture": "Comment une image OCI est adaptée",
+      "ociCustomImage": "Image absente du catalogue",
+      "ociStorageNetwork": "Données, chemins et réseau",
+      "ociHardware": "Périphériques et accélération",
+      "ociStacks": "Applications à plusieurs conteneurs",
+      "ociLifecycle": "Installer, mettre à jour et modifier",
+      "ociMonitor": "Dans ProxMenux Monitor",
+      "proxmenuxScripts": "ProxMenux Scripts",
+      "postInstallScript": "Script de post-installation",
+      "postInstallOverview": "Vue d’ensemble",
+      "postInstallAutomated": "Automatique",
+      "postInstallCustomizable": "Personnalisable",
+      "postInstallBasicSettings": "Paramètres de base",
+      "postInstallSystem": "Système",
+      "postInstallVirtualization": "Virtualisation",
+      "postInstallNetwork": "Réseau",
+      "postInstallStorage": "Stockage",
+      "postInstallSecurity": "Sécurité",
+      "postInstallCustomization": "Personnalisation",
+      "postInstallMonitoring": "Surveillance",
+      "postInstallPerformance": "Performances",
+      "postInstallOptional": "Facultatif",
+      "postInstallUpdates": "Appliquer les mises à jour disponibles",
+      "postInstallUninstall": "Supprimer les optimisations",
+      "gpusCoralTpu": "GPU et Coral TPU",
+      "nvidiaHost": "Installer les pilotes NVIDIA sur l’hôte",
+      "coralHost": "Installer Coral TPU sur l’hôte",
+      "addGpuLxc": "Donner accès à un GPU dans un LXC",
+      "addCoralLxc": "Donner accès à Coral TPU dans un LXC",
+      "addGpuVm": "Attribuer un GPU à une VM (passthrough)",
+      "switchGpuMode": "Changer le mode du GPU (VM ↔ LXC)",
+      "createVm": "Créer une VM",
+      "createVmOverview": "Vue d’ensemble",
+      "createVmSystemNas": "Systèmes NAS",
+      "createVmSynology": "VM Synology",
+      "createVmNasOthers": "Autres systèmes NAS",
+      "createVmSystemWindows": "Systèmes Windows",
+      "createVmSystemLinux": "Systèmes Linux",
+      "diskManager": "Gestionnaire de disques",
+      "diskManagerOverview": "Vue d’ensemble",
+      "diskImportVm": "Importer un disque dans une VM",
+      "diskImportImageVm": "Importer une image disque dans une VM",
+      "diskAddController": "Ajouter un contrôleur ou un périphérique NVMe à une VM",
+      "diskImportLxc": "Importer un disque dans un LXC",
+      "diskFormat": "Formater ou effacer un disque physique",
+      "diskSmart": "État SMART et tests du disque",
+      "storageShareManager": "Gestion du stockage et des partages",
+      "storageShareOverview": "Vue d’ensemble",
+      "hostStorage": "Intégration du stockage à l’hôte",
+      "hostNfs": "Ajouter un partage NFS comme stockage Proxmox",
+      "hostSamba": "Ajouter un partage Samba comme stockage Proxmox",
+      "hostIscsi": "Ajouter une cible iSCSI comme stockage Proxmox",
+      "hostLocalDisk": "Ajouter un disque local comme stockage Proxmox",
+      "hostLocalShared": "Créer un répertoire partagé sur l’hôte",
+      "lxcMountPoints": "Points de montage LXC (hôte ↔ CT)",
+      "lxcNetworkSharing": "Partages réseau dans LXC",
+      "lxcNfsClient": "Client NFS dans LXC",
+      "lxcSambaClient": "Client Samba dans LXC",
+      "lxcNfsServer": "Serveur NFS dans LXC",
+      "lxcSambaServer": "Serveur Samba dans LXC",
+      "network": "Réseau",
+      "networkOverview": "Vue d’ensemble",
+      "networkDiagnostics": "Diagnostic",
+      "networkMonitoring": "Outils de surveillance en temps réel",
+      "networkBridge": "Analyse et réparation des ponts réseau",
+      "networkConfig": "Analyse et nettoyage de la configuration",
+      "networkPersistent": "Noms persistants des interfaces",
+      "networkBackup": "Sauvegarde et redémarrage des interfaces",
+      "security": "Sécurité",
+      "securityOverview": "Vue d’ensemble",
+      "securityFail2ban": "Fail2Ban",
+      "securityLynis": "Lynis",
+      "utilities": "Utilitaires",
+      "utilsOverview": "Vue d’ensemble",
+      "utilsUupDump": "Création d’ISO avec UUP Dump",
+      "utilsSystemUtils": "Installation d’utilitaires système",
+      "utilsSystemUpdate": "Mise à jour du système Proxmox",
+      "utilsUpgradePve": "Passer de PVE 8 à PVE 9",
+      "utilsExportVm": "Exporter une VM au format OVA/OVF",
+      "utilsImportVm": "Importer une VM depuis OVA/OVF",
+      "settingsProxmenux": "Paramètres de ProxMenux",
+      "settingsOverview": "Vue d’ensemble",
+      "settingsMonitor": "ProxMenux Monitor",
+      "settingsBeta": "Changer de canal de publication",
+      "settingsVersion": "Afficher les informations de version",
+      "settingsUninstall": "Désinstaller ProxMenux",
+      "commandsReference": "Référence des commandes",
+      "commandsOverview": "Vue d’ensemble",
+      "commandsSystem": "Commandes système utiles",
+      "commandsVmCt": "Gestion des VM et CT",
+      "commandsStorage": "Stockage et disques",
+      "commandsNetwork": "Commandes réseau",
+      "commandsUpdates": "Mises à jour et paquets",
+      "commandsGpu": "Passthrough GPU",
+      "commandsZfs": "Gestion de ZFS",
+      "commandsBackup": "Sauvegarde et restauration",
+      "commandsTools": "Outils système en ligne de commande",
+      "glossary": "Glossaire",
+      "about": "À propos",
+      "aboutOverview": "Vue d’ensemble",
+      "aboutFaq": "FAQ",
+      "aboutContributors": "Contributeurs",
+      "aboutContributing": "Contribuer",
+      "aboutCodeOfConduct": "Code de conduite",
+      "externalRepositories": "Dépôts externes",
+      "backupRestore": "Sauvegarde et restauration",
+      "backupRestoreOverview": "Vue d’ensemble",
+      "backupRestoreHowItWorks": "Fonctionnement",
+      "backupRestoreDestinations": "Destinations",
+      "backupRestoreDestOverview": "Vue d’ensemble",
+      "backupRestoreDestLocal": "Archive locale",
+      "backupRestoreDestPbs": "Proxmox Backup Server",
+      "backupRestoreDestBorg": "Borg",
+      "backupRestoreCreating": "Créer des sauvegardes",
+      "backupRestoreJobs": "Tâches planifiées",
+      "backupRestoreRestoring": "Restaurer",
+      "backupRestoreCrossKernel": "Restauration entre versions du noyau",
+      "backupRestoreGlossary": "Glossaire"
+    }
+  },
+  "hero": {
+    "title": "ProxMenux",
+    "tagline": "Un menu interactif et un tableau de bord web pour Proxmox VE",
+    "description": "ProxMenux réunit un menu interactif et un tableau de bord web pour Proxmox VE. Exécutez des commandes, des scripts et des assistants depuis le terminal, ou consultez l’état de l’hôte, ses métriques et ses notifications dans un navigateur.",
+    "installButton": "Installer maintenant",
+    "whatIsButton": "Qu’est-ce que ProxMenux ?",
+    "logoAlt": "Logo ProxMenux"
+  },
+  "docNav": {
+    "previous": "Précédent",
+    "next": "Suivant"
+  },
+  "tocPanel": {
+    "onThisPage": "Sur cette page"
+  },
+  "supportProject": {
+    "heading": "Soutenez le projet !",
+    "body": "Si <strong>ProxMenux</strong> vous est utile, donnez-lui une ⭐ sur GitHub pour aider d’autres personnes à le découvrir.",
+    "button": "Ajouter une étoile sur GitHub"
+  },
+  "rssLink": {
+    "heading": "Suivez les nouveautés !",
+    "body": "Abonnez-vous à notre flux RSS pour être informé des nouveautés.",
+    "copy": "Copier",
+    "copied": "Copié !",
+    "copyTitle": "Copier l’URL du flux RSS",
+    "openFeed": "Ouvrir le flux RSS",
+    "openTitle": "Ouvrir le flux RSS"
+  },
+  "changelog": {
+    "pageTitle": "Journal des modifications",
+    "meta": {
+      "title": "Journal des modifications de ProxMenux",
+      "titleSuffix": "Notes de version",
+      "latest": "Dernière version",
+      "mostRecent": "Version la plus récente",
+      "description": "Notes de version et historique des mises à jour de ProxMenux, le script à menus pour administrer Proxmox VE.",
+      "descriptionTail": "Nouvelles fonctionnalités, corrections de bugs, mises à jour de sécurité, améliorations de ProxMenux Monitor, compatibilité avec les fournisseurs d’IA, sécurisation du passthrough GPU et bien plus.",
+      "ogDescription": "Notes de version de ProxMenux.",
+      "ogTail": "Abonnez-vous au flux RSS ou revenez consulter les nouvelles versions."
+    }
+  }
+}
diff --git a/web/messages/fr/docs/about/code-of-conduct.json b/web/messages/fr/docs/about/code-of-conduct.json
new file mode 100644
index 00000000..4842f6b2
--- /dev/null
+++ b/web/messages/fr/docs/about/code-of-conduct.json
@@ -0,0 +1,13 @@
+{
+  "meta": {
+    "title": "Code de conduite | Documentation ProxMenux",
+    "description": "Code de conduite et bonnes pratiques de ProxMenux pour les contributeurs, les testeurs et les utilisateurs.",
+    "ogTitle": "Code de conduite | Documentation ProxMenux",
+    "ogDescription": "Attentes concernant la responsabilité du code, le signalement des vulnérabilités et le périmètre des PR du projet ProxMenux."
+  },
+  "errors": {
+    "notFound": "Erreur : fichier CODE_OF_CONDUCT.md introuvable.",
+    "loadFailed": "Erreur : Impossible de charger le contenu du Code de conduite."
+  },
+  "contentMarkdown": "# 📝 Code de conduite et bonnes pratiques\n\nCe document définit les **principes et les consignes** d’utilisation de **ProxMenux**, afin de promouvoir le **respect, la collaboration et la sécurité** dans le développement.\n\n## 📌 1. Attribution du code et reconnaissance\n\n- Si des **scripts, extraits de code ou idées** proviennent d’autres dépôts ou développeurs, leur auteur d’origine sera toujours cité.\n- Un commentaire dans le code ou la documentation indiquera la source et, si possible, un lien vers le dépôt original.\n- Lors de l’utilisation de code soumis à une **licence** particulière, ses conditions doivent être respectées.\n\n### ✅ Exemple d’attribution correcte dans le code :\n\n```bash\n# Script fondé sur le travail de [Auteur] dans [Lien du dépôt]\n```\n\n## 🔒 2. Sécurité et responsabilité du code\n\n- Tout le code de ce dépôt suit les bonnes pratiques de développement sécurisé.\n- Les contributions introduisant volontairement des vulnérabilités ou des pratiques dangereuses sont interdites.\n- Les scripts ne doivent jamais compromettre la sécurité du système ni les données des utilisateurs.\n- Avant leur mise en œuvre, les contributions doivent être examinées pour vérifier leur sécurité et leur stabilité.\n\n### ⚠️ Divulgation responsable des vulnérabilités\n\nSi vous découvrez une vulnérabilité de sécurité, ne la signalez PAS dans des issues ou forums publics.\n\nSignalez-la plutôt en privé par e-mail :\n\n📧 proxmenux@macrimi.pro\n\nPour en savoir plus sur les vulnérabilités et leur signalement, consultez notre [politique de sécurité](./SECURITY.md).\n\n## 🤝 3. Règles de la communauté\n\nPour maintenir un cadre respectueux et professionnel, tous les utilisateurs doivent suivre ces règles :\n\n- ✅ Restez respectueux et constructifs dans les discussions.\n- ❌ Le harcèlement, les propos haineux et les comportements offensants ne seront pas tolérés.\n- ✅ Formulez vos retours de manière professionnelle, sans attaques personnelles.\n- ❌ Les manquements peuvent entraîner des avertissements ou des exclusions selon leur gravité.\n\n##\n\nCe document encourage un usage éthique du code, la vigilance en matière de sécurité et une communauté respectueuse.\n\n📢 Construisons ensemble quelque chose de remarquable !\n"
+}
diff --git a/web/messages/fr/docs/about/contributing.json b/web/messages/fr/docs/about/contributing.json
new file mode 100644
index 00000000..6b46bd4c
--- /dev/null
+++ b/web/messages/fr/docs/about/contributing.json
@@ -0,0 +1,293 @@
+{
+  "meta": {
+    "title": "Contribution à ProxMenux | ProxMenux Documentation",
+    "description": "Comment contribuer à ProxMenux : modèle de branches (main / develop / feature/*), processus de pull request, en-tête de script avec attribution et lien de soutien facultatif, interface en deux phases, fonctions de message et passage d’une branche de fonctionnalité à une version stable.",
+    "ogTitle": "Contribuer à ProxMenux",
+    "ogDescription": "Modèle de branches, processus, attribution dans l’en-tête et règle d’interface en deux phases à respecter pour contribuer."
+  },
+  "header": {
+    "title": "Contribuer à ProxMenux",
+    "description": "ProxMenux accueille les contributions de la communauté : nouveaux scripts, corrections, amélioration des dialogues, traductions et intégrations. Cette page présente la structure du dépôt, le modèle de branches, le processus de pull request, l’en-tête avec attribution et lien de soutien facultatif, ainsi que les conventions à respecter.",
+    "section": "À propos"
+  },
+  "twoPagesCallout": {
+    "title": "Deux pages connexes, un projet",
+    "body": "Ne confondez pas cette page avec <contributorsLink>Contributeurs</contributorsLink>, qui met à l’honneur les testeurs, relecteurs et développeurs déjà impliqués. Cette page s’adresse à <em>vous</em>, futur contributeur, et explique comment préparer une pull request en vue de son intégration."
+  },
+  "branching": {
+    "heading": "Modèle de branchement",
+    "intro": "ProxMenux utilise un modèle de branchement à trois niveaux :",
+    "headerBranch": "Branche",
+    "headerPurpose": "Objet",
+    "rows": [
+      {
+        "branch": "main",
+        "purposeRich": "Code stable, prêt pour la production. Seules les modifications prêtes à être publiées sont intégrées ici. C’est la version obtenue lors d’une installation normale de ProxMenux."
+      },
+      {
+        "branch": "develop",
+        "purposeRich": "Branche de développement actif : tous les nouveaux changements y sont intégrés en premier. Elle correspond au canal « bêta ». Lorsqu’une version stable est prête, elle est publiée dans <code>main</code> à partir de cette branche."
+      },
+      {
+        "branch": "feature/*",
+        "purposeRich": "Branches temporaires pour une fonctionnalité, une correction ou une amélioration. Créées à partir de <code>develop</code>, puis fusionnées dans <code>develop</code> par pull request après relecture."
+      }
+    ],
+    "calloutTitle": "Ce que cela signifie pour les utilisateurs",
+    "calloutBody": "Les utilisateurs qui suivent <code>main</code> reçoivent des versions testées. Ceux qui souhaitent les nouveautés plus tôt et acceptent quelques imperfections peuvent suivre <code>develop</code>. Les nouvelles fonctions passent toujours d’abord par <code>develop</code> ; rien n’arrive dans <code>main</code> sans ce cycle."
+  },
+  "workflow": {
+    "heading": "Processus de pull request",
+    "intro": "De l'idée à la version fusionnée en cinq étapes:",
+    "step1Lead": "<strong>Créer une branche de fonction à partir de <code>develop</code></strong>:",
+    "step1Code": "git clone https://github.com/MacRimi/ProxMenux.git\ncd ProxMenux\ngit checkout develop\ngit pull origin develop\ngit checkout -b feature/your-feature-name",
+    "step1Trail": "Utilisez un nom descriptif de branche : <code>feature/zfs-arc-tuning</code>, <code>feature/fix-iommu-detection</code>, <code>feature/add-tailscale-script</code>.",
+    "step2Lead": "<strong>Travailler sur vos changements et pousser la branche:</strong>",
+    "step2Code": "# Make your changes, then:\ngit add scripts/...\ngit commit -m \"Add ZFS ARC tuning script\"\ngit push -u origin feature/your-feature-name",
+    "step3": "<strong>Ouvrez une pull request vers <code>develop</code></strong>, pas vers <code>main</code>. Vérifiez sur GitHub que la branche de base est <code>develop</code>. Décrivez le rôle du script, ses modifications et les versions de Proxmox VE utilisées pour les tests.",
+    "step4": "<strong>Après relecture, les modifications sont fusionnées dans <code>develop</code>.</strong> Un responsable vérifie le code, les conventions d’en-tête et la règle d’interface en deux phases. S’il demande des corrections, envoyez de nouveaux commits dans la même branche : la PR se met à jour automatiquement.",
+    "step5": "<strong>Les versions stables passent de <code>develop</code> à <code>main</code>.</strong> Lors d’une publication, <code>main</code> est avancée jusqu’à <code>develop</code> par fast-forward, puis étiquetée. Votre contribution entre dans la prochaine version stable."
+  },
+  "scriptHeader": {
+    "heading": "En-tête de script — métadonnées et description",
+    "intro": "Chaque script de ProxMenux s'ouvre avec deux blocs de commentaires adjacents qui forment ensemble l'en-tête. Ils sont <strong>tous les deux requis</strong> — ensemble, ils font savoir à tout lecteur qui a écrit le script et ce qu'il fait, le tout sans ouvrir le code lui-même.",
+    "bullets": [
+      "<strong>Bloc supérieur : métadonnées.</strong> Auteur, liens GitHub/de soutien facultatifs, responsable, copyright, licence, version et date de mise à jour. C’est aussi la <em>reconnaissance des contributeurs</em> : pour un nouveau script, ajoutez votre nom et, si vous le souhaitez, votre page GitHub et un profil de soutien tel que Ko-fi, GitHub Sponsors ou Buy Me a Coffee.",
+      "<strong>Bloc inférieur : description.</strong> Un court paragraphe en anglais simple explique le rôle du script. Il se lit <em>avant</em> le code et doit se suffire à lui-même : objectif, actions principales, ressources concernées et prérequis."
+    ],
+    "licenseCalloutTitle": "La ligne de licence est fixe — GPL-3.0",
+    "licenseCalloutBody": "ProxMenux est publié sous la licence publique générale <strong>GNU v3.0</strong>. Chaque script du projet est livré sous cette même licence; la ligne <code>License</code> dans l'en-tête est toujours la référence GPL-3.0 montrée dans l'exemple ci-dessous — ce n'est pas un choix par script. En contribuant un script, vous acceptez de le publier sous GPL-3.0, ce qui signifie que n'importe qui peut le lire, le modifier et le redistribuer (y compris les modifications) tant qu'ils le conservent sous la même licence. Le texte entier vit à <licenseLink>MacRimi/ProxMenux/LICENSE</licenseLink>.",
+    "templateCode": "#!/bin/bash\n\n# ==========================================================\n# ProxMenux - A menu-driven script for Proxmox VE management\n# ==========================================================\n# Author      : Your Name\n# GitHub      : github.com/yourhandle\n# Sponsor     : ko-fi.com/yourhandle\n# Maintainer  : MacRimi\n# Copyright   : (c) 2026 MacRimi & contributors\n# License     : (GPL-3.0) (https://github.com/MacRimi/ProxMenux/blob/main/LICENSE)\n# Version     : 1.0\n# Last Updated: DD/MM/YYYY\n# ==========================================================\n# Description:\n# Short paragraph explaining what the script does.\n# Mention the main actions (e.g. \"creates a ZFS pool\",\n# \"configures IOMMU and reboots\", \"imports an ISO into a VM\"),\n# the resources it touches, and any prerequisites the user\n# should be aware of before running it.\n# ==========================================================",
+    "optionalNote": "Les lignes <code>GitHub</code> et <code>Sponsor</code> sont optionnelles — laissez-les dehors si vous ne voulez pas les publier. Tout le reste est nécessaire.",
+    "whyCalloutTitle": "Pourquoi cela est important",
+    "whyCalloutBody": "Contribuer à l’open source est un travail bénévole. Le nom et le lien de soutien éventuel dans le code rendent l’auteur visible à chaque lecture, au lieu de le cacher derrière le projet. La description a un autre rôle : c’est la première chose qu’un futur responsable ou utilisateur curieux lit. Sa clarté détermine souvent si le script inspire confiance ou est évité."
+  },
+  "structure": {
+    "heading": "Structure du projet",
+    "intro": "Où chaque type de script vit dans le dépôt :",
+    "treeCode": "scripts/\n├── menus/              # Top-level menu scripts (entry points)\n├── storage/            # Disk, storage and passthrough scripts\n├── share/              # NFS, Samba, local share scripts\n├── vm/                 # VM creation and configuration scripts\n├── gpu_tpu/            # GPU / TPU passthrough scripts\n├── post_install/       # Post-install automation scripts\n├── backup_restore/     # Backup and restore scripts\n├── utilities/          # System utility scripts\n├── global/             # Shared helper libraries (sourced by other scripts)\n├── utils.sh            # Shared utility functions and message helpers\n└── help_info_menu.sh   # Interactive help and command reference",
+    "outro": "Chaque script charge <code>utils.sh</code> au démarrage avec source pour obtenir les fonctions de message, l’indicateur d’attente, les couleurs et le système de traduction. Les bibliothèques communes dans <code>scripts/global/</code> sont chargées explicitement par les scripts qui les utilisent."
+  },
+  "twoPhase": {
+    "heading": "La règle de conception de l’interface en deux phases",
+    "intro": "C’est la convention la plus importante de ProxMenux et celle qui entraîne le plus souvent des demandes de correction dans les PR. Chaque script est divisé en <strong>exactement deux phases</strong> :",
+    "headerPhase": "Phase",
+    "headerPurpose": "Objet",
+    "headerScreen": "État de l'écran",
+    "rows": [
+      {
+        "phaseRich": "<strong>Phase 1 — Sélection</strong>",
+        "purposeRich": "Recueillir chaque décision de l'utilisateur. Effectuer tout travail préparatoire nécessaire (sondes, scans, vérifications).",
+        "screenRich": "<code>dialog</code> superpositions. Si une sonde entre deux menus prend plus d'une seconde ou deux, montrez un spinner <code>msg_info</code> afin que l'utilisateur sache que le script n'a pas gelé, puis appelez <code>stop_spinner</code> juste avant la boîte de dialogue suivante."
+      },
+      {
+        "phaseRich": "<strong>Phase 2 — Exécution</strong>",
+        "purposeRich": "Exécutez toutes les opérations. Affichez l'historique complet des progrès accumulés à l'écran.",
+        "screenRich": "Messages visibles <code>msg_info</code> / <code>msg_ok</code>; jamais <code>dialog</code>."
+      }
+    ],
+    "principle": "Le principe: <strong> collecte tout d'abord, puis exécute tout</strong>. L'utilisateur voit un menu de dialogue propre (phase 1), puis une vue d'exécution propre (phase 2). Pas de mélange — pas de dialogue apparaissant au milieu de l'exécution, pas de bruit de progression pendant la sélection.",
+    "phase1Heading": "Phase 1 — modèle typique",
+    "phase1Code": "# Silent preparatory work between dialogs\nmsg_info \"$(translate \"Checking disk assignments...\")\"\nASSIGNED_TO=$(check_assignments \"$DISK\")\nstop_spinner   # ← clears line silently, result saved in variable\n\n# Next dialog can now use ASSIGNED_TO\nif [ -n \"$ASSIGNED_TO\" ]; then\n    dialog --yesno \"$(translate \"Disk already assigned. Continue?\")\" $UI_YESNO_H $UI_YESNO_W\nfi\n\n# Collect multiple decisions per item with parallel arrays\ndeclare -a DISK_LIST=()\ndeclare -a DISK_FORMAT_TYPES=()\ndeclare -a DISK_MOUNT_POINTS=()\nfor DISK in $SELECTED; do\n    msg_info \"$(translate \"Analyzing disk...\")\"\n    CURRENT_FS=$(lsblk -no FSTYPE \"$DISK\" | xargs)\n    stop_spinner\n\n    FORMAT=$(dialog --backtitle \"$BACKTITLE\" \\\n        --title \"$(translate \"Select Filesystem\")\" \\\n        --menu \"...\" $UI_SHORT_MENU_H $UI_SHORT_MENU_W $UI_SHORT_MENU_LIST_H \\\n        \"ext4\" \"...\" \"xfs\" \"...\" \"btrfs\" \"...\" \\\n        2>&1 >/dev/tty)\n    [ -z \"$FORMAT\" ] && continue\n\n    DISK_LIST+=(\"$DISK\")\n    DISK_FORMAT_TYPES+=(\"$FORMAT\")\ndone",
+    "phase1RulesIntro": "Règles <strong> pour la phase 1:</strong>",
+    "phase1Rules": [
+      "Si un spinner <code>msg_info</code> est en cours d'exécution et que vous devez ouvrir un menu <code>dialog</code> ou <code>whiptail</code>, appelez d'abord <code>stop_spinner</code> — le spinner ne peut pas coexister avec la superposition dessinée par l'un ou l'autre des outils. Si aucun spinner n'est actif, vous n'avez pas besoin de l'appeler.",
+      "Utilisez <code>show_proxmenux_logo</code> + <code>msg_title</code> + <code>msg_info</code> pour donner un contexte visuel à une opération longue en phase 1, par exemple une vérification de plus de cinq secondes. La fonction efface déjà l’écran : n’appelez pas <code>clear</code> avant.",
+      "N'appelez pas <code>show_proxmenux_logo</code> entre les menus de dialogue où il n'y a rien à afficher — le nettoyage de l'écran pour un terminal vide n'est que du bruit visuel.",
+      "Conservez toutes les décisions et les résultats de la sonde dans des variables ou des tableaux parallèles. La récapitulation visible se produit au début de la phase 2, pas dans la phase 1."
+    ],
+    "phase2Heading": "Phase 2 — modèle typique",
+    "phase2Code": "# ── PHASE 2 — EXECUTION ─────────────────────────────\nshow_proxmenux_logo\nmsg_title \"$(translate \"My Script Title\")\"\n\n# Recap Phase 1 preparatory results — show what was already done\nmsg_ok \"$(translate \"CT $CTID selected.\")\"\nmsg_ok \"$(translate \"Repositories verified.\")\"\nmsg_ok \"$(translate \"Disks to process: ${#DISK_LIST[@]}\")\"\n\n# Now execute operations\nfor i in \"${!DISK_LIST[@]}\"; do\n    DISK=\"${DISK_LIST[$i]}\"\n    FORMAT=\"${DISK_FORMAT_TYPES[$i]}\"\n\n    msg_info \"$(translate \"Formatting\") $DISK $(translate \"as\") $FORMAT...\"\n    mkfs.\"$FORMAT\" \"$DISK\" >/dev/null 2>&1\n    msg_ok \"$(translate \"Formatted.\")\"\ndone\n\nmsg_ok \"$(translate \"Completed. ${#DISK_LIST[@]} disk(s) processed.\")\"\nmsg_success \"$(translate \"Press Enter to return to menu...\")\"\nread -r",
+    "phase2Rules": "<strong>Règles pour la phase 2:</strong> toujours commencer avec <code>show_proxmenux_logo + msg_title</code>; récapituler immédiatement les résultats de la phase 1 sous la forme de lignes <code>msg_ok</code>; n'appelez plus jamais <code>show_proxmenux_logo</code> (il effacerait les progrès accumulés); n'appelez jamais <code>dialog</code> dans la phase 2 — si une décision d'exécution est vraiment inévitable, utilisez <code>whiptail</code> (voir la section suivante)."
+  },
+  "dialogVsWhiptail": {
+    "headingRich": "Quand utiliser <code>dialog</code> vs <code>whiptail</code>",
+    "intro": "Les deux outils dessinent des interfaces utilisateur en mode texte, mais ils se comportent très différemment à l'écran — et ProxMenux les utilise en deux phases distinctes pour une raison.",
+    "headerTool": "Outil",
+    "headerWhen": "Quand l'utiliser",
+    "headerEffect": "Effet sur l'écran",
+    "rows": [
+      {
+        "toolRich": "<strong><code>dialog</code></strong>",
+        "whenRich": "<strong>Toujours dans la phase 1.</strong> Chaque sélection interactive — choisir un VM, un disque, un système de fichiers, confirmer une action — utilise <code>dialog</code>. C'est l'outil d'interface utilisateur par défaut de ProxMenux.",
+        "effectRich": "Prend le contrôle du terminal : efface l’écran, dessine son interface et rétablit l’état précédent à la fermeture. Cela convient à la phase 1, où aucun résultat utile n’est encore affiché."
+      },
+      {
+        "toolRich": "<strong><code>whiptail</code></strong>",
+        "whenRich": "<strong>Seulement en phase 2, en cas de nécessité.</strong> Le cas typique est la proposition de redémarrage en fin d’exécution. N’utilisez pas <code>whiptail</code> pour demander « continuer ? » en cours d’exécution : cette décision devait être prise en phase 1.",
+        "effectRich": "Interface plus légère qui <em>n’efface pas</em> le contexte du terminal. L’historique <code>msg_ok</code>/<code>msg_info</code> de la phase 2 reste visible derrière la boîte de dialogue. Elle convient donc lorsque la progression est déjà affichée."
+      }
+    ],
+    "calloutTitle": "Pourquoi la scission est importante",
+    "calloutBody": "Si vous appelez <code>dialog</code> au milieu de la phase 2, chaque ligne <code>msg_ok</code> que l'utilisateur regarde disparaît. Vous effacez la piste de vérification. <code>whiptail</code> évite cela. Donc la règle n'est pas arbitraire — il s'agit de préserver la vision de l'utilisateur de ce que le script a fait jusqu'ici.",
+    "rebootHeading": "Proposition de redémarrage : le cas type de whiptail en phase 2",
+    "rebootIntro": "Si un script peut nécessiter un redémarrage après l’activation d’IOMMU ou la modification du noyau, la question de fin de phase 2 utilise <code>whiptail</code>. Prévoyez toujours une branche « Non » avertissant de ne pas utiliser la ressource concernée avant le redémarrage :",
+    "rebootCode": "if [[ \"$HOST_REBOOT_REQUIRED\" == \"yes\" ]]; then\n  echo \"\"\n  if whiptail --title \"$(translate \"Reboot Required\")\" --yesno \\\n    \"\\n$(translate \"A host reboot is required before starting the VM. Reboot now?\")\" \\\n    13 78; then\n      msg_warn \"$(translate \"Rebooting the system...\")\"\n      reboot\n  else\n      echo \"\"\n      msg_info2 \"$(translate \"Do not start the VM until the system has been rebooted.\")\"\n  fi\nfi\n\nmsg_success \"$(translate \"Press Enter to return to menu...\")\"\nread -r"
+  },
+  "messageFunctions": {
+    "heading": "Référence des fonctions du message",
+    "intro": "Toutes sont définies dans <code>utils.sh</code>. Utilisez-les par défaut pour les sorties visibles afin de garder une présentation cohérente entre scripts. Si une fonction manque, par exemple un niveau de sévérité ou un outil de mise en page, proposez-la dans votre pull request. Elle sera examinée et ajoutée à <code>utils.sh</code> si elle est utile à plusieurs scripts.",
+    "headerFunction": "Fonction",
+    "headerWhen": "Quand utiliser",
+    "headerSpinner": "Indicateur de progression",
+    "rows": [
+      {
+        "function": "msg_info \"text\"",
+        "whenRich": "Opération en cours.",
+        "spinner": "Démarre"
+      },
+      {
+        "function": "stop_spinner",
+        "whenRich": "Fin des travaux préparatoires silencieux dans la phase 1 — tue spinner, efface la ligne.",
+        "spinner": "Arrête"
+      },
+      {
+        "function": "msg_ok \"text\"",
+        "whenRich": "Opération réussie. À utiliser aussi pour une fonction activée, même si un redémarrage reste nécessaire.",
+        "spinner": "Arrête"
+      },
+      {
+        "function": "msg_warn \"text\"",
+        "whenRich": "Avertissement réel ou état dégradé.",
+        "spinner": "Arrête"
+      },
+      {
+        "function": "msg_error \"text\"",
+        "whenRich": "Erreur fatale.",
+        "spinner": "Arrête"
+      },
+      {
+        "function": "msg_info2 \"text\"",
+        "whenRich": "Conseil sans blocage, dans une ligne d’information cyan.",
+        "spinner": "Arrête"
+      },
+      {
+        "function": "msg_success \"text\"",
+        "whenRich": "Message final « Appuyez sur Entrée pour revenir » en fin de phase 2.",
+        "spinner": "Arrête"
+      },
+      {
+        "function": "msg_title \"text\"",
+        "whenRich": "Titre gras avec espacement intégré. Utilisé au début de la phase 2.",
+        "spinner": "—"
+      },
+      {
+        "function": "show_proxmenux_logo",
+        "whenRich": "Efface l’écran et affiche le logo. À appeler <em>une seule fois</em> au début de la phase 2.",
+        "spinner": "—"
+      }
+    ]
+  },
+  "dialogConventions": {
+    "heading": "conventions de dialogue",
+    "bullets": [
+      "Passez toujours <code>--backtitle \"$BACKTITLE\"</code> à chaque appel <code>dialog</code> et <code>whiptail</code>. <code>$BACKTITLE</code> est toujours <code>\"ProxMenux\"</code> — réglé une fois à l'en-tête du script et jamais dépassé. L'utilisateur doit toujours voir le nom du projet comme le contexte de cadrage, jamais le propre titre du script.",
+      "Enveloppez toujours les titres et les messages avec <code>$(translate \"...\")</code>.",
+      "Redirige toujours la sortie <code>dialog</code> avec <code>2&gt;&amp;1 &gt;/dev/tty</code> — le stdout capturé devient la sélection de l'utilisateur, tandis que la boîte de dialogue elle-même s'appuie sur le terminal.",
+      "Utilisez les variables standard de dimension UI (<code>$UI_MENU_H</code>, <code>$UI_MSG_W</code>, etc.) pour un calibrage cohérent entre les scripts.",
+      "Vérifiez toujours les choix vides ou annulés et gérez-les proprement."
+    ],
+    "exampleIntro": "Exemple complet — construire un menu de sélection VM et gérer l'annulation:",
+    "exampleCode": "# 1) Build the list of VMs as alternating \"ID  NAME\" pairs.\n#    dialog --menu expects this exact shape: tag1 description1 tag2 description2 ...\nVM_LIST=\"\"\nfor vmid in $(qm list | awk 'NR>1 {print $1}'); do\n    vm_name=$(qm config \"$vmid\" | awk -F': ' '/^name:/ {print $2}')\n    VM_LIST=\"$VM_LIST $vmid \\\"$vm_name\\\"\"\ndone\n\n# 2) Show the dialog. Captured stdout is the user's selection (the VMID).\nVMID=$(eval \"dialog --backtitle \\\"\\$BACKTITLE\\\" \\\n    --title \\\"\\$(translate \\\"Select VM\\\")\\\" \\\n    --menu \\\"\\$(translate \\\"Choose a VM from the list:\\\")\\\" \\\n    \\$UI_MENU_H \\$UI_MENU_W \\$UI_MENU_LIST_H \\\n    $VM_LIST \\\n    2>&1 >/dev/tty\")\n\n# 3) Empty result means the user pressed Cancel or Esc — exit silently.\nif [ -z \"$VMID\" ]; then\n    exit 0\nfi\n\n# 4) Continue with the rest of Phase 1, knowing VMID is now set.\necho \"User selected VMID=$VMID\""
+  },
+  "translation": {
+    "heading": "Politique de traduction",
+    "intro": "Toutes les chaînes visibles par l'utilisateur doivent être enveloppées avec la fonction <code>translate</code>. ProxMenux les traduit automatiquement dans toutes les langues prises en charge — vous écrivez l'anglais, l'utilisateur lit leur langue maternelle.",
+    "code": "msg_ok \"$(translate \"Operation completed successfully.\")\"\nmsg_error \"$(translate \"Failed to start container\") $CTID.\"\ndialog --title \"$(translate \"Select Storage\")\" ...",
+    "bullets": [
+      "Écrivez les chaînes en anglais : la traduction est gérée automatiquement lors du build.",
+      "Rédigez des chaînes concises. Évitez si possible les variables dans de longues phrases.",
+      "Ne traduisez <strong>pas</strong> les noms de variables, chemins ou identifiants techniques."
+    ]
+  },
+  "variableStyle": {
+    "heading": "Conventions de variables et de style",
+    "bullets": [
+      "Utilisez <code>UPPER_CASE</code> pour les variables de niveau script.",
+      "Utiliser <code>lower_case</code> pour les variables de fonction locales (déclarer avec <code>local</code>).",
+      "Entourez les expansions de variables de guillemets : <code>\"$VAR\"</code>, pas <code>$VAR</code>.",
+      "Utiliser <code>[[ ]]</code> pour les conditions, et non <code>[ ]</code> (sauf lorsque POSIX est nécessaire).",
+      "<code>show_proxmenux_logo</code> est le moyen prévu pour effacer l’écran : il le nettoie et affiche le logo du projet pour conserver un contexte visuel. Appelez-le une fois au début de la phase 2, et éventuellement avant une longue attente en phase 1."
+    ],
+    "standardNamesIntro": "Noms de variables standard dans l'ensemble du projet :",
+    "standardNamesCode": "CTID         # container ID\nVMID         # virtual machine ID\nDISK         # device path (e.g. /dev/sdb)\nPARTITION    # partition path (e.g. /dev/sdb1)\nSTORAGE      # Proxmox storage name\nMOUNT_POINT  # filesystem mount path",
+    "redirectHeading": "Réorienter la sortie de l'outil pendant la phase 2",
+    "redirectIntro": "La phase 2 affiche un journal de lignes <code>msg_info → msg_ok</code>. Si un outil appelé, comme apt, mkfs, qm, pct ou dd, écrit sur stdout/stderr, sa sortie fait défiler les messages et brouille la présentation. L’utilisateur ne distingue plus la progression du script des détails produits par l’outil.",
+    "withoutRedirectIntro": "<strong>Sans redirection</strong> — ce que l'utilisateur voit si vous ne manipulez pas le bruit:",
+    "withoutRedirectCode": "ℹ Installing kernel package...\nReading package lists... Done\nBuilding dependency tree... Done\nReading state information... Done\nThe following NEW packages will be installed:\n  proxmox-kernel-6.5\n0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded.\nNeed to get 12.5 MB of archives.\nAfter this operation, 47.2 MB of additional disk space will be used.\nGet:1 http://download.proxmox.com/debian/pve trixie/pve-no-subscription amd64 ...\n... [200+ more lines of dpkg output] ...\n✓ Kernel installed.",
+    "withRedirectIntro": "<strong>Avec redirection</strong> — à quoi ressemble la même opération lorsque le bruit est envoyé ailleurs:",
+    "withRedirectCode": "ℹ Installing kernel package...\n✓ Kernel installed.\nℹ Configuring kernel command line...\n✓ Configured.\nℹ Refreshing boot loader...\n✓ Boot loader updated.",
+    "twoPatternsIntro": "Deux modèles à choisir :",
+    "discardLead": "<strong>Éliminez la sortie</strong> lorsque vous n'en avez pas besoin — plus rapide et plus simple:",
+    "discardCode": "DEBIAN_FRONTEND=noninteractive apt-get install -y \"$package\" >/dev/null 2>&1",
+    "logLead": "<strong>Envoyez la sortie à un fichier journal</strong> lorsque vous voudrez peut-être l'inspecter plus tard (débogage d'une installation échouée, vérification de ce que dpkg a fait réellement). C'est le modèle préféré pour toute opération apt:",
+    "logCode": "apt-get install -y \"$package\" >> \"$log_file\" 2>&1",
+    "referenceOutro": "Le script <code>scripts/global/update-pve9_2.sh</code> est une implémentation de référence — chaque appel <code>apt-get</code> envoie une sortie vers un fichier journal de sorte que l'utilisateur ne voit que le flux propre <code>msg_info → msg_ok</code>, tandis que le journal sur le disque vous permet de reconstruire exactement ce qu'apt a fait si quelque chose tourne mal."
+  },
+  "dosAndDonts": {
+    "heading": "Faites et ne faites pas",
+    "doHeading": "✅ À faire",
+    "doBullets": [
+      "<code>stop_spinner</code> avant un <code>dialog</code> dans la phase 1 seulement quand un spinner <code>msg_info</code> est en cours d'exécution.",
+      "La phase 2 commence par <code>show_proxmenux_logo + msg_title + msg_ok</code> pour récapituler les résultats de la phase 1.",
+      "Utilisez <code>msg_ok</code> pour des fonctionnalités activées avec succès, même si un redémarrage est nécessaire.",
+      "Utilisez le <code>whiptail</code> (et non le <code>dialog</code>) pour toute invitation après exécution qui doit apparaître dans la phase 2.",
+      "Prévoyez toujours une branche « Non » dans les dialogues de redémarrage pour avertir de ne pas démarrer la ressource concernée avant le redémarrage.",
+      "Protégez la logique VM uniquement en vérifiant <code>[[ -f \"/etc/pve/qemu-server/$'{'vmid'}'.conf\" ]]</code> — les contrôleurs et NVMe PCIe ne peuvent pas être ajoutés aux conteneurs LXC.",
+      "Utiliser <code>ensure_repositories</code> de <code>utils-install-functions.sh</code> au lieu de <code>apt-get update</code> inconditionnel.",
+      "Utiliser des tableaux parallèles dans la phase 1 lorsque chaque élément nécessite plusieurs dialogues."
+    ],
+    "dontHeading": "❌ À éviter",
+    "dontBullets": [
+      "Appelez <code>dialog</code> alors qu'un spinner est actif.",
+      "Passez la récapitulation de la phase 1 au début de la phase 2.",
+      "Appelez <code>show_proxmenux_logo</code> une deuxième fois — il efface tout ce que la phase 2 a imprimé.",
+      "Utiliser <code>dialog</code> dans la phase 2 (utiliser <code>whiptail</code> pour le cas inévitable rare).",
+      "Utiliser <code>clear</code> seul.",
+      "Enveloppez <code>msg_title</code> dans des lignes vierges <code>echo \"\"</code> — il inclut déjà l'espacement.",
+      "Utilisez <code>msg_warn</code> pour signaler une fonctionnalité activée avec succès — c'est un <code>msg_ok</code>.",
+      "Exécuter sans condition <code>apt-get update</code> — utiliser <code>ensure_repositories</code>."
+    ]
+  },
+  "submitting": {
+    "heading": "Soumettre votre contribution",
+    "steps": [
+      "Créez un fork de <code>MacRimi/ProxMenux</code> sur GitHub, puis clonez votre fork.",
+      "Créer une branche <code>feature/*</code> à partir de <code>develop</code> (voir <em>Modèle de branchage</em> ci-dessus).",
+      "Suivez ce guide pour tout script nouveau ou modifié. Écrivez l'en-tête avec votre nom; ajoutez la ligne de sponsor optionnelle si vous voulez.",
+      "Testez le script sur une véritable instance Proxmox VE : phase 1 avec toutes les branches de dialogue, et phase 2 avec chaque opération et son retour arrière propre en cas d’erreur.",
+      "Ouvrez une pull request <strong>vers <code>develop</code></strong> avec une description claire : rôle du script, changements et version Proxmox VE utilisée pour les tests.",
+      "Assurez-vous que votre contribution respecte le <cocLink>Code de conduite</cocLink>."
+    ],
+    "securityOutro": "Pour les questions sensibles à la sécurité, suivez le flux de divulgation dans <securityLink>SECURITY.md</securityLink> plutôt que d'ouvrir une question publique."
+  },
+  "whereNext": {
+    "heading": "Où aller ensuite",
+    "items": [
+      {
+        "kind": "external",
+        "url": "https://github.com/MacRimi/ProxMenux/blob/main/CONTRIBUTING.md",
+        "label": "CONTRIBUTING.md (guide complet)",
+        "tail": "— la source de vérité pour chaque convention, y compris les modèles matériels avancés."
+      },
+      {
+        "kind": "internal",
+        "href": "/docs/about/contributors",
+        "label": "Contributeurs",
+        "tail": " — les personnes dont le travail a façonné les versions de ProxMenux. Il s’agit d’une autre page."
+      },
+      {
+        "kind": "internal",
+        "href": "/docs/about/code-of-conduct",
+        "label": "Code de conduite",
+        "tail": "— les normes que chaque contributeur accepte de respecter."
+      },
+      {
+        "kind": "external",
+        "url": "https://github.com/MacRimi/ProxMenux/discussions",
+        "label": "GitHub Discussions",
+        "tail": "— demander avant de construire si vous n'êtes pas sûr si une idée correspond, ou de trouver des collaborateurs sur une fonctionnalité plus grande."
+      }
+    ]
+  }
+}
diff --git a/web/messages/fr/docs/about/contributors.json b/web/messages/fr/docs/about/contributors.json
new file mode 100644
index 00000000..47f3e6f5
--- /dev/null
+++ b/web/messages/fr/docs/about/contributors.json
@@ -0,0 +1,38 @@
+{
+  "meta": {
+    "title": "Contributeurs | Documentation ProxMenux",
+    "description": "Un hommage aux personnes qui rendent ProxMenux possible : testeurs, relecteurs et développeurs qui contribuent à chaque version.",
+    "ogTitle": "Contributeurs | Documentation ProxMenux",
+    "ogDescription": "Rencontrez les contributeurs derrière ProxMenux."
+  },
+  "header": {
+    "title": "Contributeurs",
+    "description": "Le projet ProxMenux grandit grâce à ses contributeurs. Cette page reconnaît leur travail : tester les versions avant leur publication, détecter les régressions, examiner les PR et orienter les nouvelles fonctionnalités.",
+    "section": "À propos"
+  },
+  "beyond": {
+    "title": "Au-delà de cette liste",
+    "body": "De nombreuses autres personnes contribuent en signalant des bugs, en proposant des fonctionnalités dans Discussions, en testant les versions bêta ou en traduisant le projet. La liste complète des contributeurs au code figure dans le <extlink>graphique des contributeurs GitHub</extlink>. La page ci-dessous met en avant les personnes les plus actives dans les tests et la vérification des versions de ProxMenux."
+  },
+  "testers": {
+    "heading": "Testeurs et évaluateurs",
+    "intro": "Ces personnes ont été parmi les premières à contribuer au projet. Leurs tests, signalements de problèmes et suggestions ont aidé ProxMenux à devenir ce qu’il est aujourd’hui.",
+    "roles": {
+      "testing": "Tests",
+      "testingReviewer": "Tests et relecture"
+    },
+    "youtube": "YouTube"
+  },
+  "contribute": {
+    "heading": "Vous voulez contribuer ?",
+    "intro": "Toute contribution est la bienvenue — code, test, conception, documentation, ou tout simplement partager vos idées:",
+    "tester": "<strong>Testeur</strong> — essayez le <beta>canal bêta</beta> et signalez ce qui fonctionne ou non avant la publication des versions stables.",
+    "developer": "<strong>Développeur</strong> — Bash, Next.js (TypeScript) et un peu de Python pour l’environnement virtuel de traduction (venv). Les PR sont les bienvenues sur <gh>GitHub</gh>.",
+    "designer": "<strong>Designer</strong> — Améliorations de l'interface utilisateur, icônes, captures d'écran pour la documentation.",
+    "ideas": "<strong>Idées</strong> — ouvrez un sujet dans <disc>GitHub Discussions</disc> avant de créer une issue pour demander une fonctionnalité."
+  },
+  "coc": {
+    "title": "Lisez d'abord le Code de conduite",
+    "body": "Avant de proposer du code ou de signaler un problème, lisez le <coclink>Code de conduite et les bonnes pratiques</coclink>. Il précise les attentes sur la responsabilité du code, le signalement des vulnérabilités et le périmètre des PR."
+  }
+}
diff --git a/web/messages/fr/docs/about/faq.json b/web/messages/fr/docs/about/faq.json
new file mode 100644
index 00000000..1c4b1719
--- /dev/null
+++ b/web/messages/fr/docs/about/faq.json
@@ -0,0 +1,94 @@
+{
+  "meta": {
+    "title": "Questions fréquentes | Documentation ProxMenux",
+    "description": "Questions fréquentes sur ProxMenux : présentation, installation, compatibilité à partir de PVE 8, personnalisation, mises à jour, sécurité, utilisation en production, fichiers système, contributions et désinstallation.",
+    "ogTitle": "Questions fréquentes | Documentation ProxMenux",
+    "ogDescription": "Questions fréquentes sur l’installation de ProxMenux, sa compatibilité, sa sécurité et les façons de contribuer."
+  },
+  "header": {
+    "title": "Foire aux questions",
+    "description": "Questions courantes sur ProxMenux : présentation, public visé, installation, mise à jour, désinstallation, compatibilité, personnalisation, sécurité et contributions. Si votre question n’est pas ici, consultez GitHub Discussions ou ouvrez une issue.",
+    "section": "À propos"
+  },
+  "quickLinks": {
+    "title": "Liens rapides",
+    "installationLabel": "Installation",
+    "installationSuffix": "— la commande d'installation en une seule ligne + dépendances.",
+    "introductionLabel": "Présentation",
+    "introductionSuffix": " — ce que fait ProxMenux, en cinq minutes.",
+    "uninstallLabel": "Désinstaller",
+    "uninstallSuffix": " — désinstallation propre.",
+    "issuesLabel": "GitHub Issues",
+    "discussionsLabel": "Discussions"
+  },
+  "q1": {
+    "question": "Qu'est-ce que ProxMenux et dans quel cas est-il utilisé?",
+    "p1Rich": "<strong>ProxMenux</strong> est un outil interactif à menus qui rend <strong>Proxmox VE</strong> accessible à tous, quel que soit le niveau technique. Il simplifie l’exécution des commandes et permet d’agir sur le système sans connaissances avancées de Linux.",
+    "p2": "Les utilisateurs moins expérimentés exécutent les commandes depuis des menus structurés, avec moins de saisie manuelle dans le terminal. Les administrateurs expérimentés gagnent du temps sur les tâches répétitives : sécurisation après installation, passthrough GPU, importation de VM OVF et rotation des instantanés ZFS.",
+    "p3": "Proxmox VE est largement utilisé pour:",
+    "items": [
+      "Virtualisation de qualité entreprise",
+      "HomeLab et solutions cloud personnelles",
+      "Serveurs multimédias, automatisation et plus encore"
+    ]
+  },
+  "q2": {
+    "question": "Comment installer ProxMenux ?",
+    "p1Rich": "Suivez le <installlink>guide d’installation</installlink>. En résumé :",
+    "stableInstall": "bash -c \"$(wget -qLO - https://raw.githubusercontent.com/MacRimi/ProxMenux/main/install_proxmenux.sh)\"",
+    "p2": "Une fois l’installation terminée, lancez simplement :",
+    "menuCmd": "menu"
+  },
+  "q3": {
+    "question": "ProxMenux est-il compatible avec toutes les versions Proxmox ?",
+    "bodyRich": "<strong>Non — ProxMenux nécessite Proxmox VE 8 ou une version ultérieure.</strong> PVE 7 et les versions antérieures ne sont pas pris en charge. Passez d’abord de PVE 7 à 8.x en suivant la procédure officielle Proxmox. ProxMenux peut ensuite gérer le passage de 8 à 9 via <upgradelink>Utilitaires → Mettre à niveau PVE 8 vers PVE 9</upgradelink>."
+  },
+  "q4": {
+    "question": "Puis-je personnaliser ProxMenux ?",
+    "p1Rich": "Les mises à jour peuvent écraser les modifications locales des scripts principaux. Évitez donc de modifier directement ces fichiers. Voici ce que vous <em>pouvez</em> personnaliser :",
+    "items": [
+      "La bannière console via l'outil <strong>FastFetch</strong> dans les options Post-Install.",
+      "Quels composants optionnels sont installés (Monitor, Fail2Ban, Lynis...) — choisissez lors de l'installation ou via le menu correspondant plus tard."
+    ]
+  },
+  "q5": {
+    "question": "Comment mettre à jour ProxMenux?",
+    "p1Rich": "Lorsqu’une nouvelle version est disponible, ProxMenux la détecte au prochain lancement de <code>menu</code> et propose la mise à jour. Si vous acceptez, les fichiers et la configuration de l’outil sont remplacés dans l’installation existante ; aucun téléchargement manuel n’est nécessaire.",
+    "p2Rich": "Les utilisateurs de la version stable reçoivent les mises à jour stables, et ceux de la bêta, les mises à jour bêta. Lorsqu’une version stable est publiée, la bêta le signale à la prochaine ouverture du menu et propose de basculer automatiquement. Consultez le <betalink>programme bêta</betalink>."
+  },
+  "q6": {
+    "question": "Où puis-je signaler les problèmes?",
+    "p1Rich": "Signalez les bogues sur <issueslink>GitHub Issues</issueslink>. Indiquez les étapes pour les reproduire, le message d’erreur et, si nécessaire, la sortie de Monitor obtenue avec <code>journalctl -u proxmenux-monitor -n 50</code>.",
+    "p2Rich": "Pour les problèmes de <strong>sécurité</strong>, <strong>ne les divulguez pas publiquement</strong>. Suivez la procédure de signalement responsable du <coclink>code de conduite et des bonnes pratiques</coclink>."
+  },
+  "q7": {
+    "question": "Puis-je contribuer au ProxMenux?",
+    "p1Rich": "<strong>Bien sûr.</strong> ProxMenux est un projet libre et collaboratif. Vous pouvez contribuer au code (Bash, Next.js/TypeScript et outils de traduction en Python), aux tests, à la documentation, au design ou proposer des idées.",
+    "item1Rich": "Discutez des idées dans <discusslink>GitHub Discussions</discusslink> avant d'ouvrir une demande de fonctionnalité.",
+    "item2Rich": "Avant de soumettre une pull request, lisez le <coclink>code de conduite et les bonnes pratiques</coclink>.",
+    "item3Rich": "Consultez la <contriblink>page des contributeurs</contriblink> pour connaître les personnes qui participent actuellement aux tests et aux revues."
+  },
+  "q8": {
+    "question": "Est-ce que ProxMenux modifie les fichiers système critiques?",
+    "p1Rich": "<strong>L’installation de ProxMenux ajoute les composants suivants.</strong>",
+    "item1Rich": "Dépendances via apt : <code>dialog</code>, <code>curl</code>, <code>jq</code> et <code>git</code>. Les traductions utilisent des catalogues JSON préconstruits ; l’installateur n’ajoute aucun environnement virtuel de traduction à l’hôte.",
+    "item2Rich": "L'arborescence des scripts à <code>/usr/local/share/proxmenux/</code>.",
+    "item3Rich": "Le lanceur situé dans <code>/usr/local/bin/menu</code>.",
+    "item4Rich": "En option : le service systemd de Monitor, <code>proxmenux-monitor.service</code>.",
+    "p2Rich": "ProxMenux ne modifie <em>pas</em> la configuration principale de Proxmox, sauf si vous le demandez explicitement depuis un menu dédié. Par exemple, la réparation du réseau modifie <code>/etc/network/interfaces</code>, mais seulement après votre confirmation et la création d’une sauvegarde."
+  },
+  "q9": {
+    "question": "Est-il sûr d'utiliser ProxMenux en production?",
+    "bodyRich": "<strong>Oui.</strong> ProxMenux ne modifie les fichiers principaux de Proxmox que sur demande explicite et peut donc être utilisé en production. Comme pour toute automatisation, testez d’abord dans un environnement contrôlé et prévoyez des sauvegardes avant les opérations destructives : mise à niveau de PVE 8 vers 9, formatage d’un disque, suppression d’une VM, etc."
+  },
+  "q10": {
+    "question": "Comment désinstaller ProxMenux ?",
+    "p1Rich": "Dans ProxMenux : <strong>Paramètres → Désinstaller ProxMenux</strong>. La désinstallation supprime l’arborescence des scripts, le lanceur et le service Monitor, ainsi que les dépendances sélectionnées si vous le souhaitez. Elle restaure <code>/root/.bashrc</code> et <code>/etc/motd</code> depuis les sauvegardes créées par Post-Install, si elles existent (sinon, elle supprime la ligne ProxMenux du MOTD).",
+    "p2Rich": "Étape par étape : <uninstalllink>Désinstaller ProxMenux</uninstalllink>."
+  },
+  "q11": {
+    "question": "VirusTotal affiche l'URL d'installation — est-ce sûr?",
+    "p1Rich": "Le résultat de 1/95 attribué à <em>Chong Lua Dao</em> et signalé dans l’issue #162 a été identifié par le mainteneur comme un faux positif. L’installateur est lancé par une commande qui télécharge puis exécute le script (<code>bash -c \"$(wget -qLO - …)\"</code>) et peut télécharger <code>jq</code> depuis sa version officielle sur GitHub. Ce <em>comportement</em> peut déclencher des analyses heuristiques ; ce rapport historique ne préjuge pas de tous les téléchargements futurs.",
+    "p2Rich": "ProxMenux est entièrement open source. Vous pouvez examiner le script d’installation ligne par ligne : <scriptlink>install_proxmenux.sh</scriptlink>. Plus de contexte dans l’<issuelink>issue #162</issuelink>."
+  }
+}
diff --git a/web/messages/fr/docs/about/index.json b/web/messages/fr/docs/about/index.json
new file mode 100644
index 00000000..d0bb7318
--- /dev/null
+++ b/web/messages/fr/docs/about/index.json
@@ -0,0 +1,67 @@
+{
+  "meta": {
+    "title": "À propos | Documentation ProxMenux",
+    "description": "À propos de ProxMenux : objectifs du projet, contributeurs, FAQ et code de conduite. Cet outil de gestion open source à menus pour Proxmox VE 8+ est développé et maintenu par MacRimi avec une petite équipe de testeurs et de contributeurs.",
+    "ogTitle": "À propos | Documentation ProxMenux",
+    "ogDescription": "À propos de ProxMenux — un outil de gestion open source à menus pour Proxmox VE 8+."
+  },
+  "header": {
+    "title": "À propos",
+    "description": "Informations sur le projet, FAQ, contributeurs et code de conduite. ProxMenux est un outil de gestion open source à menus pour Proxmox VE 8+, développé et maintenu par MacRimi avec l’aide d’une petite équipe de testeurs et de contributeurs.",
+    "section": "À propos"
+  },
+  "callout": {
+    "title": "Open source, porté par la communauté",
+    "body": "ProxMenux est distribué sous licence GPL-3.0 et développé publiquement sur GitHub. Chaque script peut être examiné et chaque modification retracée. Les contributions sont les bienvenues : signalements de bugs, idées, code et tests."
+  },
+  "section": {
+    "heading": "Dans cette section",
+    "options": [
+      {
+        "icon": "HelpCircle",
+        "href": "/docs/about/faq",
+        "title": "FAQ",
+        "description": "Questions fréquentes : présentation de ProxMenux, installation, compatibilité, personnalisation, mises à jour, sécurité, utilisation en production et désinstallation."
+      },
+      {
+        "icon": "Users",
+        "href": "/docs/about/contributors",
+        "title": "Contributeurs",
+        "description": "Un hommage aux personnes qui rendent ProxMenux possible : testeurs, relecteurs et développeurs qui contribuent à chaque version."
+      },
+      {
+        "icon": "ScrollText",
+        "href": "/docs/about/code-of-conduct",
+        "title": "Code de conduite",
+        "description": "Valeurs du projet, attentes en matière de responsabilité du code et lignes directrices en matière de contribution. Lecture obligatoire avant d'ouvrir un PR ou un rapport."
+      }
+    ]
+  },
+  "involved": {
+    "heading": "Participer",
+    "intro": "Trois endroits pour participer au projet :",
+    "cards": [
+      {
+        "href": "https://github.com/MacRimi/ProxMenux/issues/new",
+        "title": "🐛 Signaler un bug",
+        "description": "GitHub Issues — joignez les journaux et les étapes pour reproduire le problème."
+      },
+      {
+        "href": "https://github.com/MacRimi/ProxMenux/discussions",
+        "title": "💡 Proposer une fonctionnalité",
+        "description": "GitHub Discussions — échangez des idées avant d'ouvrir un PR."
+      },
+      {
+        "href": "https://github.com/MacRimi/ProxMenux/pulls",
+        "title": "🔀 Proposer une PR",
+        "description": "GitHub Pull Requests — lisez d’abord le code de conduite."
+      }
+    ]
+  },
+  "support": {
+    "heading": "Soutenir le projet",
+    "introRich": "Si ProxMenux vous fait gagner du temps, le moyen le plus simple de le faire découvrir est de <starlink>donner une ⭐ au dépôt sur GitHub</starlink>. Pour aller plus loin :",
+    "kofiLabel": "Soutien sur Ko-fi",
+    "kofiOutro": "— achète au responsable un café et continue le développement."
+  }
+}
diff --git a/web/messages/fr/docs/backup-restore/creating-backups.json b/web/messages/fr/docs/backup-restore/creating-backups.json
new file mode 100644
index 00000000..8fcdb1fe
--- /dev/null
+++ b/web/messages/fr/docs/backup-restore/creating-backups.json
@@ -0,0 +1,220 @@
+{
+  "meta": {
+    "title": "Création de sauvegardes — flux de sauvegarde interactif ProxMenux",
+    "description": "Le processus de sauvegarde interactif de ProxMenux : deux points d’entrée (le menu TUI de Scripts et l’interface web de Monitor), trois destinations, deux modes de profil, une étape de préparation temporaire et une boîte de dialogue de confirmation. Cette page décrit la matrice de six options, les profils par défaut et personnalisé, et ce que voit l’utilisateur entre le choix d’une sauvegarde et l’enregistrement de l’archive à destination.",
+    "ogTitle": "Sauvegarde ProxMenux — création de sauvegardes",
+    "ogDescription": "Le processus de sauvegarde interactif avec trois destinations, deux profils et une étape commune de préparation temporaire.",
+    "twitterTitle": "Création de sauvegardes ProxMenux",
+    "twitterDescription": "Flux de sauvegarde interactif avec trois destinations et deux modes de profil."
+  },
+  "header": {
+    "title": "Création de sauvegardes",
+    "description": "Le processus de sauvegarde interactif : choisissez une destination et un profil, vérifiez le récapitulatif de confirmation et suivez l’enregistrement de l’archive. Les deux points d’entrée partagent le même backend et produisent des archives identiques.",
+    "section": "Sauvegarde et restauration"
+  },
+  "intro": {
+    "title": "Deux points d'entrée, fonctionnalité identique",
+    "body": "La TUI de Scripts et l’interface web de Monitor offrent <strong>exactement les mêmes fonctions</strong>. Chaque sauvegarde — manuelle ou programmée — utilise la même matrice de choix (trois destinations × deux profils) et appelle la même fonction backend par cellule (<code>_bk_pbs</code>, <code>_bk_borg</code> ou <code>_bk_local</code>). Les archives produites depuis les deux points d’entrée sont identiques. Le choix dépend des préférences : la TUI se prête à SSH et aux scripts ; Monitor permet une utilisation à la souris et regroupe les vues des notifications et du suivi des journaux."
+  },
+  "entryPoints": {
+    "heading": "Les deux points d'entrée",
+    "rows": [
+      {
+        "entry": "ProxMenux Scripts (TUI)",
+        "path": "menu → Utilities → Host Config Backup",
+        "detail": "Processus fondé sur des boîtes de dialogue, adapté à SSH. Le menu principal présente directement les six options. Utilise <code>backup_menu</code> dans <code>backup_host.sh</code>."
+      },
+      {
+        "entry": "ProxMenux Monitor (interface utilisateur Web)",
+        "path": "Backups tab → Create backup",
+        "detail": "Processus guidé par un assistant. Les six mêmes options sont présentées dans un formulaire en deux étapes (destination → profil). Les mêmes fonctions backend sont appelées via l’API Flask."
+      }
+    ]
+  },
+  "modes": {
+    "heading": "Sauvegardes manuelles ou programmées",
+    "body": "Les sauvegardes peuvent être produites en deux modes : <strong>manuel</strong> (le processus interactif décrit sur cette page — l'utilisateur choisit une destination et un profil à partir d'un menu et suit l’enregistrement de l’archive) ou <strong>programmé</strong> (un travail sans surveillance qui fonctionne sur un minuteur de style cron et applique la rétention configurée sur le travail). Les deux modes supportent les mêmes trois destinations et les mêmes deux profils, et les deux sont disponibles à partir des deux points d'entrée — le menu Scripts TUI et l'onglet Sauvegardes Monitor. Les tâches programmées utilisent les mêmes fonctions de backend que le flux manuel à travers <code>run_scheduled_backup.sh</code> ; les archives produites sont indistinguables.",
+    "seeAlso": "La page des tâches programmées décrit tout le processus, notamment la création d’une tâche, son association à un minuteur vzdump PVE existant et la configuration des valeurs de rétention.",
+    "monitorAlt": "L'onglet Sauvegardes ProxMenux Monitor affiche la boîte de dialogue Nouvelle sauvegarde programmée avec les champs destination, profil, calendrier et conservation.",
+    "monitorCaption": "Sauvegarde programmée — ProxMenux Monitor. La même boîte de dialogue de style assistant qui crée une sauvegarde manuelle porte les champs de planning et de rétention en bas pour le chemin sans surveillance."
+  },
+  "matrix": {
+    "heading": "La matrice de six options",
+    "intro": "Le choix détermine le backend exécuté et la stratégie de sélection des chemins. Consultez les pages de chaque destination pour connaître les détails de configuration de chaque cellule.",
+    "rows": [
+      {
+        "combo": "1",
+        "destination": "PBS",
+        "profile": "Par défaut",
+        "action": "Envoie le profil par défaut et les ajouts persistants vers un dépôt PBS configuré."
+      },
+      {
+        "combo": "2",
+        "destination": "Borg",
+        "profile": "Par défaut",
+        "action": "Crée une archive avec le profil par défaut plus des extras persistants dans le dépôt Borg sélectionné."
+      },
+      {
+        "combo": "3",
+        "destination": "Locale",
+        "profile": "Par défaut",
+        "action": "Écrit une archive <code>.tar.zst</code> avec le profil par défaut et des suppléments persistants à la cible locale configurée."
+      },
+      {
+        "combo": "4",
+        "destination": "PBS",
+        "profile": "Personnalisé",
+        "action": "Ouvre le sélecteur de chemins avant l’envoi vers PBS ; l’utilisateur coche les chemins et peut en ajouter."
+      },
+      {
+        "combo": "5",
+        "destination": "Borg",
+        "profile": "Personnalisé",
+        "action": "Ouvre le sélecteur de chemin avant la création de l'archive Borg."
+      },
+      {
+        "combo": "6",
+        "destination": "Locale",
+        "profile": "Personnalisé",
+        "action": "Ouvre le sélecteur de chemin avant d'écrire le <code>.tar.zst</code> local."
+      }
+    ]
+  },
+  "profiles": {
+    "heading": "Profil par défaut vs personnalisé",
+    "defaultTitle": "Profil par défaut",
+    "defaultBody": "Le profil par défaut est la liste prédéfinie de <code>hb_default_profile_paths</code> (documentée dans <em>Comment ça marche</em> sous <em>Catégories de chemins</em>) plus chaque entrée dans le fichier supplémentaire persistant <code>/usr/local/share/proxmenux/backup-extra-paths.txt</code>. L'utilisateur confirme les options de destination et de chiffrement et la sauvegarde se déroule sans autre sélection de chemin.",
+    "customTitle": "Profil personnalisé",
+    "customBody": "Le profil personnalisé ouvre une liste à cocher avec tous les chemins du profil par défaut (décochés) et tous les ajouts persistants (précochés, avec le préfixe <code>[+]</code>). L’utilisateur coche les chemins pour cette exécution et peut cliquer sur <em>Ajouter un chemin personnalisé</em> pour ajouter un chemin absolu. Tout chemin ainsi ajouté est enregistré dans <code>backup-extra-paths.txt</code> afin que les sauvegardes suivantes l’incluent automatiquement. Décocher un ajout persistant l’exclut de cette exécution sans le supprimer du fichier — la suppression se fait séparément par <em>Gérer les chemins personnalisés</em>, en dehors du processus de sauvegarde.",
+    "customPickerAlt": "Liste de contrôle de profil personnalisé montrant les chemins de profil par défaut (non coché) et les extras persistants (pré coché avec un préfixe [+]), ainsi que des boutons pour ajouter un nouveau chemin ou confirmer la sélection.",
+    "customPickerCaption": "Profil personnalisé — le sélecteur de chemins. Les chemins du profil par défaut sont décochés ; les ajouts persistants sont précochés avec le préfixe [+]. L’utilisateur coche les chemins pour cette exécution.",
+    "manageCustomAlt": "Menu de gestion des chemins personnalisés montrant les ajouts persistants et les options pour les ajouter, les supprimer ou les modifier.",
+    "manageCustomCaption": "Gérer les chemins personnalisés — le point d'entrée où des extras persistants sont ajoutés ou supprimés. Chaque chemin listé ici est automatiquement inclus dans les sauvegardes en mode Défaut sans avoir à ouvrir le sélecteur personnalisé."
+  },
+  "commonPipeline": {
+    "heading": "Ce qui s’exécute quelle que soit la destination",
+    "intro": "Une fois le profil défini, chaque backend suit le même processus de préparation temporaire avant de passer à sa propre méthode d’envoi. <code>hb_prepare_staging</code> assemble l’arborescence de l’archive dans <code>/tmp/proxmenux-DESTINATION-stage.XXXXXX</code> et remplit chacun des trois blocs de données.",
+    "steps": [
+      {
+        "step": "1",
+        "name": "Assemblage du rootfs",
+        "detail": "Exécute <code>rsync -a</code> pour chaque chemin sélectionné dans <code>staging_root/rootfs/</code>. La base de données pmxcfs de <code>/var/lib/pve-cluster/config.db</code> est capturée séparément via <code>sqlite3 .backup</code> pour produire un instantané cohérent sans arrêter le cluster, et les sidecars <code>.db-wal</code> / <code>.db-shm</code> sont exclus du rsync; lorsque <code>sqlite3</code> n'est pas disponible, un fichier <code>config.db.raw-fallback</code> est créé puis utilisé comme base de données lors de l’importation. Les sous-chemins volatils (historique bash, caches, poubelles) sont exclus du <code>/root/</code>. Les chemins absents de la source sont enregistrés dans <code>metadata/missing_paths.txt</code> sans arrêter la sauvegarde."
+      },
+      {
+        "step": "2",
+        "name": "Génération de manifestes",
+        "detail": "<code>build_manifest.sh</code> coordonne les six collecteurs et écrit <code>manifest.json</code> à la racine du répertoire temporaire. Si un collecteur échoue, la section concernée reçoit une valeur vide par défaut documentée ; le manifeste reste valide."
+      },
+      {
+        "step": "3",
+        "name": "Inventaire des paquets",
+        "detail": "<code>apt-mark showmanual</code> est capté mot à mot dans <code>metadata/packages.manual.list</code>. L'état des composants est déjà à l'intérieur des rootfs restauré (<code>components_status.json</code>) car <code>/usr/local/share/proxmenux/</code> fait partie du profil par défaut."
+      },
+      {
+        "step": "4",
+        "name": "Informations sur l’exécution",
+        "detail": "<code>metadata/run_info.env</code> enregistre l'identité d'exécution de sauvegarde — nom d'hôte, horodatage, version du noyau — utilisée par la vérification de compatibilité de la restauration pour déterminer la direction du cross-kernel."
+      },
+      {
+        "step": "5",
+        "name": "Notification (démarrage)",
+        "detail": "<code>hb_notify_lifecycle \"start\"</code> est déclenché. Si les notifications sont configurées dans Monitor, un événement <em>Sauvegarde de l’hôte démarrée</em> est envoyé à l’utilisateur. Aucun envoi si aucun canal n’est configuré."
+      }
+    ]
+  },
+  "included": {
+    "heading": "Ce qui entre et ce qui reste en dehors",
+    "intro": "Chaque chemin dans le profil résolu (par défaut + suppléments persistants + sélection en mode personnalisé) est copié avec <code>rsync -aAXH --numeric-ids</code>. Une liste d'exclusion partagée s'applique à chaque chemin, et deux répertoires comportent d'autres exclusions spécifiques au chemin.",
+    "globalTitle": "Les exclusions globales (appliquées à chaque voie)",
+    "globalItems": [
+      "<code>images/</code> — images de disque exportées.",
+      "<code>dump/</code> — sorties vzdump.",
+      "<code>tmp/</code> — fichiers temporaires.",
+      "<code>*.log</code> — fichiers journaux."
+    ],
+    "rootTitle": "Exclusions de <code>/root/</code>",
+    "rootBody": "<code>/root/</code> fait partie du profil par défaut, de sorte que les scripts utilisateur et la configuration se trouvent dans l'archive. Les sous-chemins volatils sont abandonnés:",
+    "rootItems": [
+      "<code>.bash_history</code>",
+      "<code>.cache/</code>",
+      "<code>tmp/</code>",
+      "<code>.local/share/Trash/</code>"
+    ],
+    "proxmenuxTitle": "Exclusions de <code>/usr/local/share/proxmenux/</code>",
+    "proxmenuxBody": "Ce répertoire ne livre que l'état utilisateur — <code>components_status.json</code>, préférences, cache post-installation. Code que la destination aura déjà de sa propre installation ProxMenux est exclu de sorte qu'une restauration n'écrase pas les binaires actuels de la cible avec les plus anciens:",
+    "proxmenuxItems": [
+      "<code>restore-pending/</code>, <code>scripts/</code>, <code>web/</code>",
+      "<code>monitor-app/</code>, <code>monitor-app.*/</code>, <code>AppImage/</code>",
+      "<code>images/</code>, <code>json/</code>",
+      "<code>utils.sh</code>, <code>helpers_cache.json</code>",
+      "<code>ProxMenux-Monitor.AppImage*</code>, <code>install_proxmenux*.sh</code>"
+    ],
+    "notInProfileTitle": "Chemins en dehors du profil",
+    "notInProfileBody": "Tout ce qui n'est pas listé dans <code>hb_default_profile_paths</code> et qui n'est pas ajouté en tant qu'extra personnalisé ou persistant ne fait pas partie de la sauvegarde. Exemples notables:",
+    "notInProfileItems": [
+      "<strong>Disques des VM et des LXC</strong> — manipulés par <code>vzdump</code>, pas par cette fonctionnalité. Les fichiers de configuration invités sous <code>/etc/pve/nodes/*/qemu-server/*.conf</code> et <code>lxc/*.conf</code> sont capturés (ils vivent sous <code>/etc/pve</code>) de sorte que la restauration reproduit l'inventaire; les disques eux-mêmes sont ré-attachés à partir d'une sauvegarde existante vzdump/PBS.",
+      "<strong><code>/boot</code> et <code>/boot/efi</code></strong> — les binaires du noyau, les initramfs et la partition ESP UEFI sont régénérés par les propres <code>update-initramfs</code>, <code>update-grub</code> ou <code>proxmox-boot-tool refresh</code> après la restauration. Le chargeur de démarrage n’est jamais recopié à l’identique.",
+      "<strong>Les systèmes de fichiers de noyau et d'exécution du système</strong> — <code>/proc</code>, <code>/sys</code>, <code>/dev</code> et <code>/run</code> sont des pseudo-systèmes de fichiers produits par le noyau et l'udev; ils ne persistent nulle part.",
+      "<strong>Binaires des paquets sous <code>/usr/bin</code>, <code>/usr/lib</code>, <code>/lib</code>, <code>/sbin</code></strong> — réinstallés par APT sur la cible à partir de <code>packages.manual.list</code>.",
+      "<strong><code>/var/log/</code>, <code>/var/tmp/</code>, <code>/var/cache/</code></strong> — état d'exécution par hôte, non restauré.",
+      "<strong><code>/home/USER</code></strong> — pas dans le profil par défaut. Ajoutez-le comme un chemin personnalisé lorsqu'un système transporte des répertoires d'utilisateur qui doivent survivre à une restauration."
+    ],
+    "customPathsTitle": "Comment les chemins personnalisés sont gérés",
+    "customPathsBody": "Un chemin personnalisé ajouté en ligne en mode personnalisé ou maintenu dans <code>backup-extra-paths.txt</code> passe par le même pipeline <code>rsync</code> que les chemins de profil par défaut. Les exclusions globales s'appliquent. Si le chemin personnalisé se trouve sous <code>/root/</code> ou <code>/usr/local/share/proxmenux/</code>, les exclusions spécifiques au chemin ci-dessus s'appliquent toujours. Chaque chemin archivé — par défaut ou personnalisé — est enregistré dans <code>metadata/paths_archived.txt</code>. Les chemins qui n'existent pas sur la source sont enregistrés dans <code>metadata/missing_paths.txt</code> sans arrêter la sauvegarde."
+  },
+  "archiveStructure": {
+    "heading": "Structure des archives",
+    "intro": "Le répertoire de préparation temporaire produit par chaque moteur suit la même disposition quelle que soit la destination. L'archive tarball, PBS <code>.pxar</code> ou Borg stocke cet arbre dans son intégralité.",
+    "tree": "backup-[timestamp]/\n├── manifest.json                  # structured host state (kernel_params, hardware, storage, guests, components, source_host)\n├── metadata/\n│   ├── packages.manual.list       # output of apt-mark showmanual\n│   ├── run_info.env               # hostname, timestamp, kernel version, pmxcfs method\n│   ├── paths_archived.txt         # exact list of paths that reached rootfs/\n│   └── missing_paths.txt          # paths from the profile absent on source\n└── rootfs/\n    ├── etc/                       # /etc/pve, /etc/network, /etc/systemd/network, /etc/ssh, /etc/apt, ...\n    ├── root/                      # /root without volatile subpaths\n    ├── usr/local/                 # /usr/local/bin, /usr/local/sbin, /usr/local/share/proxmenux (state only)\n    └── var/                       # /var/lib/pve-cluster (config.db via sqlite3 .backup), /var/spool/cron/crontabs"
+  },
+  "confirmation": {
+    "heading": "Résumé de la confirmation",
+    "body": "Avant que le moteur n'écrive quoi que ce soit à la destination, ProxMenux affiche une boîte de dialogue de résumé avec la destination, l’identifiant de sauvegarde ou le nom de l’archive, l'état de chiffrement et la liste des chemins copiés. Annuler ici avorte la sauvegarde proprement — le répertoire temporaire est supprimé par le gestionnaire <code>trap</code> défini dans la fonction backend et aucune donnée partielle n'arrive à destination."
+  },
+  "writing": {
+    "heading": "Écrire à la destination",
+    "intro": "Après confirmation, chaque backend exécute sa propre étape d’écriture. Les pages des destinations en décrivent le fonctionnement ; les éléments communs sont le journal, le fichier annexe et la notification de fin.",
+    "rows": [
+      {
+        "topic": "Fichier journal",
+        "detail": "Chaque moteur écrit sa sortie complète sur <code>/tmp/proxmenux-DESTINATION-backup-YYYYMMDD_HHMMSS.log</code> et, en cas d'échec, propose de l'ouvrir dans une boîte de dialogue défilante. Le chemin du journal n'est imprimé dans le résumé d'achèvement que lorsque le fichier contient du contenu."
+      },
+      {
+        "topic": "Sidecar (local seulement)",
+        "detail": "<code>hb_write_archive_sidecar</code> dépose un <code>*.proxmenux.json</code> à côté de l'archive locale afin que le moniteur l'identifie comme une sauvegarde d'hôte ProxMenux même après des déplacements ou des renoms."
+      },
+      {
+        "topic": "Notification (réussite/échec)",
+        "detail": "<code>hb_notify_lifecycle \"complete\"</code> ou <code>\"fail\"</code> est déclenché avec la durée, la taille de l’archive et — en cas d’échec — la dernière ligne du journal qui ressemble à une erreur."
+      }
+    ]
+  },
+  "finishedScreens": {
+    "heading": "A quoi ressemble une sauvegarde terminée",
+    "intro": "Le même événement d'achèvement est présenté par les deux points d'entrée. Le TUI écrit un bloc de résumé au terminal; l'onglet Sauvegardes de Monitor affiche l'exécution dans la liste des archives avec la taille, la durée et les badges d'état.",
+    "scriptsAlt": "ProxMenux Scripts TUI montrant une sauvegarde d'hôte terminée — destination, ID de sauvegarde, chemin instantané, taille des données, durée et état de chiffrement.",
+    "scriptsCaption": "Sauvegarde terminée — ProxMenux Scripts (TUI). Le bloc d'achèvement imprime la destination, l'ID de sauvegarde, le nom d'instantané ou d'archive, la taille des données, la durée et l'état de chiffrement.",
+    "monitorAlt": "Onglet de sauvegarde ProxMenux Monitor montrant une entrée de sauvegarde d'hôte terminée avec taille, durée, badge de méthode et indicateur de chiffrement.",
+    "monitorCaption": "Sauvegarde terminée — onglet Sauvegardes ProxMenux Monitor. La nouvelle sauvegarde apparaît dans la liste des archives avec le badge de la méthode de destination, la taille, la durée et, le cas échéant, l'indicateur de verrouillage de chiffrement."
+  },
+  "whereNext": {
+    "heading": "Où aller ensuite?",
+    "items": [
+      {
+        "label": "Destinations",
+        "href": "/docs/backup-restore/destinations",
+        "tail": "— détails de configuration pour Local, PBS et Borg."
+      },
+      {
+        "label": "Tâches programmées",
+        "href": "/docs/backup-restore/scheduled-jobs",
+        "tail": " — exécuter la même sauvegarde sans intervention selon un calendrier, plutôt que de façon interactive."
+      },
+      {
+        "label": "Restauration",
+        "href": "/docs/backup-restore/restoring",
+        "tail": "— le flux qui consomme ce que cette page produit."
+      }
+    ]
+  }
+}
diff --git a/web/messages/fr/docs/backup-restore/cross-kernel.json b/web/messages/fr/docs/backup-restore/cross-kernel.json
new file mode 100644
index 00000000..135e0424
--- /dev/null
+++ b/web/messages/fr/docs/backup-restore/cross-kernel.json
@@ -0,0 +1,170 @@
+{
+  "meta": {
+    "title": "Restauration entre noyaux différents — détection, filtrage et adaptation | ProxMenux",
+    "description": "Comment ProxMenux restaure une sauvegarde d’hôte sur une version principale différente du noyau. Détection du sens de l’écart, filtre des chemins critiques si la cible utilise un noyau plus récent et adaptation en quatre phases pour réappliquer IOMMU, ID VFIO et paramètres de ligne de commande sans recopier tels quels les fichiers liés au noyau.",
+    "ogTitle": "ProxMenux Backup — restauration entre versions du noyau et adaptation",
+    "ogDescription": "Restauration entre versions du noyau tenant compte du sens du changement, avec filtrage sûr et adaptation indépendante du noyau.",
+    "twitterTitle": "Restauration entre noyaux différents | ProxMenux",
+    "twitterDescription": "Comment ProxMenux gère une restauration lorsque le noyau cible diffère de celui de la sauvegarde."
+  },
+  "header": {
+    "title": "Restauration entre versions du noyau",
+    "description": "Comment ProxMenux gère une restauration lorsque l'hôte cible exécute un noyau différent de celui enregistré dans la sauvegarde, surtout lorsque la cible exécute un noyau plus récent. Explique comment la différence est détectée, comment les chemins critiques de démarrage qui pourraient briser la cible sont filtrés, et comment la configuration propre de l'utilisateur est réappliquée sans copier les fichiers liés au noyau mot pour mot.",
+    "section": "Sauvegarde et restauration"
+  },
+  "intro": {
+    "title": "Chaque saut du noyau est géré différemment",
+    "body": "Le noyau d'un hôte Proxmox est identifié par une chaîne de version comme <code>6.17.13-2-pve</code>. Les deux premiers nombres (<strong>6.17</strong> dans cet exemple) définissent la version principale : lorsqu'ils changent, certains fichiers de configuration écrits pour le noyau précédent peuvent ne pas être valides sur le nouveau. Lorsque la restauration détecte que la sauvegarde et la cible ont différentes versions majeures du noyau, les branches de flux basées sur la direction du saut — que la sauvegarde soit plus ancienne ou plus récente que la cible — parce que les deux cas ont des modes de défaillance opposés. Les sauvegardes plus récentes que la cible restaurent proprement comme-est (vérifiées sur plusieurs sauts du noyau). Les sauvegardes plus anciennes que la cible ont besoin d'un filtre pour éviter de casser le démarrage de la cible avec une configuration écrite pour un noyau qui a depuis changé."
+  },
+  "directionCheck": {
+    "heading": "Le contrôle de direction",
+    "intro": "Lors de la vérification de compatibilité, <code>hb_compat_check</code> compare le noyau enregistré dans le manifeste de sauvegarde au noyau courant de la cible (<code>uname -r</code>) et classifie la restauration dans l'un des trois cas, stockés dans la variable interne <code>HB_COMPAT_KERNEL_DIRECTION</code>:",
+    "rows": [
+      {
+        "direction": "same",
+        "condition": "La version principale du noyau correspond entre la sauvegarde et la cible.",
+        "behavior": "Le flux complet de restauration est inchangé. Pas de filtre supplémentaire, pas d'hydratation, pas de notice spéciale dans l'interface utilisateur."
+      },
+      {
+        "direction": "bk_newer",
+        "condition": "Le noyau de la sauvegarde est PLUS RÉCENT que celui de la cible (exemple : sauvegarde sous 7.0, cible sous 6.17).",
+        "behavior": "Le processus complet reste inchangé, comme pour <code>same</code>, sans filtre. Les essais rapportés ont montré la réinstallation des pilotes pour le noyau cible, l’application de la configuration IOMMU et le démarrage des VM avec passthrough GPU."
+      },
+      {
+        "direction": "bk_older",
+        "condition": "Le noyau de la sauvegarde est PLUS ANCIEN que celui de la cible (exemple : sauvegarde sous 6.17, cible sous 7.0).",
+        "behavior": "Le filtre sous-ensemble et l'hydratation en quatre phases ci-dessous sont activés. Le processus de restauration — la cible reproduit la source, mais les fichiers critiques de démarrage ne sont pas copiés mot à mot."
+      }
+    ]
+  },
+  "whyBkNewerIsSafe": {
+    "heading": "Pourquoi une sauvegarde avec un noyau plus récent que la cible restaure inchangé",
+    "body": "Lorsque la restauration s'exécute contre une cible avec un noyau <em>plus ancien</em> que celui enregistré dans la sauvegarde, chaque mécanisme dont dépend la restauration est indépendant de la version du noyau. Les installateurs de pilotes GPU et d'autres installateurs PCI détectent le noyau en cours d'exécution avec <code>uname -r</code> et compilent DKMS contre tout ce que la cible a. Le paquet APT installe tire des binaires construits pour la distribution de la cible. Les jetons IOMMU cmdline comme <code>intel_iommu=on</code> sont stables dans les principales versions du noyau. La sauvegarde porte des chemins écrits sous un noyau plus récent, mais ces chemins (module blacklists, GRUB par défaut, initramfs config) sont toujours valides sur l'ancien — les noyaux ignorent les jetons qu'ils ne reconnaissent pas au lieu d'échouer. Ce cas est équivalent en pratique à une restauration du même noyau, et ProxMenux le traite comme tel."
+  },
+  "safeSubsetFilter": {
+    "heading": "Le filtre de sous-ensemble de sécurité (uniquement lorsque le noyau cible est plus récent)",
+    "intro": "Lorsque le noyau cible est plus récent que celui de la sauvegarde, la vérification de compatibilité ajoute des chemins critiques de démarrage 16 de <code>hb_unsafe_paths_cross_version</code> à <code>RS_SKIP_PATHS</code>. Ces chemins sont exclus de la restauration parce que l'écriture d'une version d'un noyau plus ancien sur une cible en cours d'exécution d'un nouveau a causé des paniques du noyau dans les tests de banc. Les chemins couvrent cinq catégories:",
+    "categoryRows": [
+      {
+        "category": "Chargeur d'amorçage",
+        "paths": "<code>/etc/default/grub</code>, <code>/etc/kernel</code>",
+        "reason": "GRUB est lié à l'ordre du noyau précédent, et à l'état proxmox-boot-tool (cmdline, ESP UUIDs, crochets) qui fait référence aux chemins et aux identifiants de l'ancienne installation."
+      },
+      {
+        "category": "Modules de noyau et artefacts de démarrage",
+        "paths": "<code>/etc/modules-load.d</code>, <code>/etc/modprobe.d</code>, <code>/etc/initramfs-tools</code>",
+        "reason": "Autoload listes qui peuvent renvoyer des modules rebaptisés entre les majors du noyau, options de module qui peuvent ne pas s'appliquer, initramfs crochets écrits pour l'ancien noyau."
+      },
+      {
+        "category": "Empilement de stockage et identité du système de fichiers",
+        "paths": "<code>/etc/fstab</code>, <code>/etc/multipath</code>, <code>/etc/iscsi</code>, <code>/etc/udev/rules.d</code>, <code>/etc/zfs</code>",
+        "reason": "UUID qui peuvent ne pas exister sur cette installation, pilotes multipath qui changent entre les noyaux, paramètres iSCSI qui évoluent, règles udev qui peuvent se lier à des sous-systèmes inexistants, état ZFS (<code>zpool.cache</code> + <code>hostid</code>) qui peuvent verrouiller le pool comme étranger."
+      },
+      {
+        "category": "Sources APT",
+        "paths": "<code>/etc/apt</code>",
+        "reason": "Les suites sources APT peuvent déclencher une dégradation des paquets critiques lors de la prochaine mise à jour."
+      },
+      {
+        "category": "systemd",
+        "paths": "<code>/etc/systemd/system</code>, <code>/etc/systemd/journald.conf</code>, <code>/etc/systemd/logind.conf</code>, <code>/etc/systemd/system.conf</code>, <code>/etc/systemd/user.conf</code>",
+        "reason": "Surcharges d’unités et liens .wants liés à une ancienne version majeure de systemd ; clés de configuration pouvant être invalides pour une version plus récente."
+      }
+    ],
+    "outroBody": "Le filtre fonctionne AVANT la boîte de dialogue de confirmation afin que l'utilisateur voit la liste exacte des chemins qui seront ignorés, catégorisé par la raison. La restauration continue — tout le reste (configuration VM/LXC, réseau, /etc/pve, utilisateurs, cron, état ProxMenux, paquets, pilotes, /root) est restauré normalement."
+  },
+  "hydration": {
+    "heading": "Hydratation du noyau-agnostique",
+    "intro": "Le filtre omet les fichiers critiques ; l’adaptation réapplique certains réglages : paramètres IOMMU, ID VFIO, <code>GRUB_TIMEOUT</code> personnalisé et listes de blocage nvidia. Elle s’exécute si le noyau cible est plus récent. La fusion cmdline conserve les clés de la cible et ajoute les modules manquants. Les valeurs GRUB et fichiers autorisés peuvent remplacer un contenu cible différent. Répéter les mêmes entrées est idempotent.",
+    "phaseRows": [
+      {
+        "phase": "1a — Voie GRUB",
+        "detail": "Pour les hôtes GRUB (installations ext4/lvm). <code>_rs_hyd_grub</code> fusionne les paramètres de <code>manifest.kernel_params.cmdline_extra</code> de la sauvegarde dans <code>GRUB_CMDLINE_LINUX_DEFAULT</code> de la cible, en ignorant les clés déjà présentes. Il reprend ensuite les clés autorisées <code>GRUB_*</code> (<code>GRUB_TIMEOUT</code>, <code>GRUB_TIMEOUT_STYLE</code>, <code>GRUB_DEFAULT</code>, <code>GRUB_TERMINAL</code>, <code>GRUB_DISABLE_OS_PROBER</code>, <code>GRUB_SERIAL_COMMAND</code>, <code>GRUB_GFXMODE</code>, <code>GRUB_GFXPAYLOAD_LINUX</code>) depuis <code>/etc/default/grub</code> de la sauvegarde si leurs valeurs diffèrent de la cible."
+      },
+      {
+        "phase": "1b — systemd-boot / ZFS",
+        "detail": "Pour systemd-boot (souvent ZFS à la racine). <code>_rs_hyd_kernel_cmdline</code> fusionne les paramètres utilisateur de <code>cmdline_extra</code> dans <code>/etc/kernel/cmdline</code> de la cible tout en préservant ses paramètres de démarrage <code>root=</code>, <code>boot=</code> et <code>rootflags=</code>."
+      },
+      {
+        "phase": "2 — Fusion /etc/modules",
+        "detail": "<code>_rs_hyd_modules</code> ajoute des modules de <code>manifest.kernel_params.modules_loaded_at_boot</code> qui sont dans la liste blanche (<code>vfio</code>, <code>vfio_pci</code>, <code>vfio_iommu_type1</code>, <code>vfio_virqfd</code>, <code>kvm</code>, <code>kvm_intel</code>, <code>kvm_amd</code>, <code>nvidia</code>, <code>nvidia_drm</code>, <code>nvidia_modeset</code>, <code>nvidia_uvm</code>, <code>i915</code>, <code>xe</code>) ET n'est pas déjà présent dans la cible <code>/etc/modules</code>."
+      },
+      {
+        "phase": "3 — Copie des fichiers figurant sur la liste blanche",
+        "detail": "<code>_rs_hyd_files</code> copie les fichiers rédigés par l’utilisateur depuis les rootfs jusqu'à la cible en direct lorsque le contenu diffère. La liste blanche couvre les fichiers VFIO/nvidia/blacklist sous <code>/etc/modprobe.d</code>, <code>/etc/modules-load.d</code>, et la règle de liaison ProxMenux VFIO + règles nvidia udev sous <code>/etc/udev/rules.d</code>. Les fichiers appartenant à des Distro (<code>pve-blacklist.conf</code>, <code>mdadm.conf</code>, <code>nvme.conf</code>) sont délibérément exclus — leur contenu évolue entre les versions."
+      },
+      {
+        "phase": "4 — Forcer la régénération après démarrage",
+        "detail": "Les quatre phases écrivent directement à la cible en direct EN DEHORS DE le pipeline normal de restauration. Pour que les paramètres/modules/fichiers fusionnés prennent effet sur le prochain boot, <code>HB_HYDRATION_APPLIED=1</code> se propage via <code>plan.env</code> vers <code>apply_pending_restore.sh</code>, ce qui force <code>NEEDS_INITRAMFS=1</code> et <code>NEEDS_GRUB=1</code> indépendamment de ce qui était dans la liste d'application. Le répartiteur post-démarrage régénère ensuite les initramfs et rafraîchit le chargeur."
+      }
+    ]
+  },
+  "planCommit": {
+    "heading": "Plan vs commit — l'utilisateur voit d'abord un aperçu",
+    "body": "L'hydratation fonctionne en deux modes. Avant la boîte de dialogue de confirmation, ProxMenux exécute <code>_rs_apply_bk_older_hydration</code> en mode <code>plan</code> : il calcule exactement ce qui serait fusionné, peuple <code>RS_HYDRATION_SUMMARY</code> avec un bloc vert listant chaque action, et retourne sans écrire. La boîte de dialogue de confirmation montre que le bloc vert à côté de la liste orange des chemins exclus, de sorte que l'utilisateur voit À L’AVANCE ce qui sera ré-appliqué automatiquement. Après que l'utilisateur ait confirmé, ProxMenux réexécute le même helper en mode <code>commit</code> — mêmes phases, même logique, mais cette fois chaque phase écrit à la cible en direct. L'annulation de la boîte de dialogue de confirmation laisse la cible intacte."
+  },
+  "flowDiagram": {
+    "heading": "Le flux lorsque le noyau cible est plus récent que celui de la sauvegarde",
+    "intro": "Les étapes ajoutées lorsque le noyau cible est plus récent s'assoient à l'intérieur du flux normal de restauration. Tout le reste — application chaude, préparation en attente, installation de paquets, répartiteur post-démarrage — fonctionne identiquement à une restauration du même noyau.",
+    "diagram": "  ┌────────────────────────────────────────────────────────────┐\n  │ hb_compat_check                                             │\n  │   HB_COMPAT_KERNEL_DIRECTION = bk_older                     │\n  └───────────────────────────┬────────────────────────────────┘\n                              │\n                              ▼\n  ┌────────────────────────────────────────────────────────────┐\n  │ Add 16 boot-critical paths to RS_SKIP_PATHS                 │\n  │   /etc/default/grub, /etc/kernel, /etc/modules-load.d, ...  │\n  └───────────────────────────┬────────────────────────────────┘\n                              │\n                              ▼\n  ┌────────────────────────────────────────────────────────────┐\n  │ _rs_apply_bk_older_hydration \"plan\"                         │\n  │   Compute what would be merged                              │\n  │   Populate RS_HYDRATION_SUMMARY (green block)               │\n  │   No writes                                                 │\n  └───────────────────────────┬────────────────────────────────┘\n                              │\n                              ▼\n  ┌────────────────────────────────────────────────────────────┐\n  │ Confirmation dialog                                         │\n  │   Amber: paths skipped by safe-subset filter                │\n  │   Green: tokens/files reapplied by hydration                │\n  │   User accepts or cancels                                   │\n  └───────────────────────────┬────────────────────────────────┘\n                              │ (accepted)\n                              ▼\n  ┌────────────────────────────────────────────────────────────┐\n  │ _rs_apply_bk_older_hydration \"commit\"                       │\n  │   Phase 1a/1b: merge cmdline tokens + GRUB keys             │\n  │   Phase 2: append modules to /etc/modules                   │\n  │   Phase 3: copy whitelisted vfio/nvidia files               │\n  │   Set HB_HYDRATION_APPLIED=1                                │\n  └───────────────────────────┬────────────────────────────────┘\n                              │\n                              ▼\n  ┌────────────────────────────────────────────────────────────┐\n  │ Rest of the restore runs normally                           │\n  │   _rs_apply hot (skips RS_SKIP_PATHS)                       │\n  │   _rs_prepare_pending_restore (writes plan.env with         │\n  │     HB_HYDRATION_APPLIED=1)                                 │\n  │   packages.manual.list install                              │\n  │   Reboot                                                    │\n  │   apply_pending_restore.sh (forces NEEDS_INITRAMFS=1,       │\n  │     NEEDS_GRUB=1 because of the hydration flag)             │\n  │   apply_cluster_postboot.sh                                 │\n  │     update-initramfs -u -k all                              │\n  │     update-grub / proxmox-boot-tool refresh                 │\n  │     component --auto-reinstall                              │\n  └────────────────────────────────────────────────────────────┘"
+  },
+  "concreteExamples": {
+    "heading": "Exemples concrets",
+    "intro": "Le passe d'hydratation n'est pas abstrait — il produit des résultats observables et corrects pour des scénarios communs. Deux exemples que l'hydratation gère automatiquement :",
+    "rows": [
+      {
+        "scenario": "Passage de GPU (VFIO)",
+        "detail": "La source avait le <code>intel_iommu=on iommu=pt</code> dans la ligne cmd, le <code>vfio</code>/<code>vfio_pci</code>/<code>vfio_iommu_type1</code> dans le <code>/etc/modules</code>, un <code>/etc/modprobe.d/vfio.conf</code> avec le <code>options vfio-pci ids=10de:2216</code> et un <code>/etc/modprobe.d/blacklist-nvidia.conf</code>. L'hydratation fusionne les jetons cmdline dans le GRUB de la cible ou le noyau cmdline, ajoute les modules vfio au <code>/etc/modules</code>, et copie les deux fichiers modprobe rédigés par l’utilisateur. Sur le prochain démarrage, IOMMU est actif, les modules VFIO chargent, le GPU est lié à vfio-pci et le VM est livré avec le travail de passage."
+      },
+      {
+        "scenario": "Par défaut du GRUB personnalisé",
+        "detail": "Source : <code>GRUB_TIMEOUT=1</code> et <code>GRUB_DISABLE_OS_PROBER=true</code>. L'hydratation lit les deux clés de la sauvegarde <code>/etc/default/grub</code>, voit qu'elles diffèrent des valeurs par défaut de la nouvelle installation, et réécrit ces deux lignes dans le fichier de la cible (en laissant tout le reste, y compris <code>GRUB_DISTRIBUTOR</code>, intact)."
+      }
+    ]
+  },
+  "callout": {
+    "warningTitle": "Ce que l'hydratation ne réapplique pas lorsque le noyau cible est plus récent",
+    "warningBody": "L'hydratation ne réapplique que la configuration ProxMenux sait être sûre dans toutes les versions du noyau : jetons IOMMU, ID VFIO, clés GRUB sur liste blanche et modules d'une liste fixe (<code>vfio*</code>, <code>nvidia*</code>, <code>i915</code>, <code>xe</code>, <code>kvm*</code>). Tout ce qui se trouve à l'extérieur de cet ensemble — les crochets initramfs personnalisés sous <code>/etc/initramfs-tools/hooks/</code>, les fichiers non inscrits sur la liste blanche sous <code>/etc/modprobe.d/</code>, les surcharges d’unités systemd rédigées par l’utilisateur — reste exclu. La raison en est concrète : ces fichiers peuvent appeler des interfaces internes au noyau (API modulaires, mise en page <code>/sys</code>, crochets <code>udev</code>) qui changent entre les versions principales, et les appliquer mot à mot sur le nouveau noyau peut empêcher la cible de démarrer. Lorsque la reproduction exacte de la chaîne de démarrage est requise, la restauration doit être exécutée sur un hôte avec la même version principale du noyau que la sauvegarde."
+  },
+  "codeReference": {
+    "heading": "Où vivent les mécanismes",
+    "intro": "Pour les développeurs qui cherchent à tracer ou à étendre le comportement du cross-kernel:",
+    "rows": [
+      {
+        "component": "Détection de la direction",
+        "location": "<code>hb_compat_check</code> dans <code>lib_host_backup_common.sh</code>. Définit <code>HB_COMPAT_KERNEL_DIRECTION</code>."
+      },
+      {
+        "component": "Liste des chemins de sous-ensembles sécurisés",
+        "location": "<code>hb_unsafe_paths_cross_version</code> dans <code>lib_host_backup_common.sh</code>. Émet <code>path\\treason</code> lignes utilisées à la fois par le filtre CLI et le point de terminaison Web <code>/api/host-backups/restore/prepare</code>."
+      },
+      {
+        "component": "Phases d'hydratation",
+        "location": "<code>_rs_hyd_grub</code>, <code>_rs_hyd_kernel_cmdline</code>, <code>_rs_hyd_modules</code>, <code>_rs_hyd_files</code> dans <code>backup_host.sh</code>. Ordonné par <code>_rs_apply_bk_older_hydration</code>."
+      },
+      {
+        "component": "Régénération forcée après démarrage",
+        "location": "<code>apply_pending_restore.sh</code> lit <code>HB_HYDRATION_APPLIED</code> de <code>plan.env</code> et force <code>NEEDS_INITRAMFS=1</code>/<code>NEEDS_GRUB=1</code>."
+      },
+      {
+        "component": "Aperçu du Web",
+        "location": "<code>/api/host-backups/restore/prepare</code> dans <code>flask_server.py</code>. Charge la bibliothèque d'aide, exécute <code>_rs_apply_bk_older_hydration</code> en mode plan, renvoie les actions au mode Web."
+      }
+    ]
+  },
+  "whereNext": {
+    "heading": "Où aller ensuite?",
+    "items": [
+      {
+        "label": "Restauration",
+        "href": "/docs/backup-restore/restoring",
+        "tail": " — le processus complet de restauration qui intègre les mécanismes de cette page."
+      },
+      {
+        "label": "Comment ça marche",
+        "href": "/docs/backup-restore/how-it-works",
+        "tail": " — le manifeste et les collecteurs qui produisent le bloc <code>kernel_params</code> lu par l’adaptation."
+      }
+    ]
+  }
+}
diff --git a/web/messages/fr/docs/backup-restore/destinations/borg.json b/web/messages/fr/docs/backup-restore/destinations/borg.json
new file mode 100644
index 00000000..8658819a
--- /dev/null
+++ b/web/messages/fr/docs/backup-restore/destinations/borg.json
@@ -0,0 +1,234 @@
+{
+  "meta": {
+    "title": "Destination Borg — types de dépôts, authentification SSH, chiffrement | ProxMenux",
+    "description": "La destination Borg enregistre les sauvegardes d’hôte ProxMenux dans un dépôt local, sur un disque externe monté ou sur un serveur distant via SSH. Cette page décrit la recherche de l’exécutable borg, les quatre options initiales de clé SSH, le chiffrement repokey, la configuration des destinations enregistrées et la rétention par tâche planifiée.",
+    "ogTitle": "Sauvegarde ProxMenux — Destination borg",
+    "ogDescription": "Comment ProxMenux enregistre les sauvegardes d’hôte dans des dépôts Borg avec authentification SSH et chiffrement repokey.",
+    "twitterTitle": "Destination de sauvegarde Borg: ProxMenux",
+    "twitterDescription": "Dépôts Borg locaux, USB et SSH pour les sauvegardes hôtes."
+  },
+  "header": {
+    "title": "Borg",
+    "description": "La destination Borg écrit des sauvegardes d'hôte dans un dépôt Borg. Trois types de dépôt sont pris en charge : chemin du système de fichiers local, disque externe monté ou serveur distant via SSH. Déduplication au niveau du chunk dans toutes les archives du dépôt et cryptage facultatif des repokey.",
+    "section": "Sauvegarde et restauration"
+  },
+  "aboutBorg": {
+    "heading": "Ce que Borg est",
+    "body": "Borg, aussi appelé BorgBackup, est un outil de sauvegarde libre avec déduplication, maintenu par la communauté Borg Backup. Il stocke chaque archive sous forme de blocs de longueur variable dans un dépôt. Les blocs sont partagés entre archives : sauvegarder à nouveau des données inchangées ne consomme presque aucun espace supplémentaire. Borg est indépendant de Proxmox et sert dans de nombreux environnements. ProxMenux l’utilise comme l’une des trois destinations de sauvegarde d’hôte ; les mécanismes décrits ici (types de dépôts, borg-serve via SSH, chiffrement repokey, prune) sont ceux de Borg."
+  },
+  "intro": {
+    "title": "Déduplication par blocs avec dépôts locaux ou accessibles via SSH",
+    "body": "Un dépôt Borg stocke des blocs partagés entre toutes ses archives. Sauvegarder à nouveau un fichier inchangé ne transfère ni ne stocke de nouvelles données. ProxMenux utilise <code>borg create</code> pour sauvegarder et <code>borg extract</code> pour restaurer. Le dépôt peut se trouver sur le même système de fichiers que la source, sur un disque externe monté ou sur un hôte distant accessible via SSH."
+  },
+  "binarySourcing": {
+    "heading": "Le binaire borg",
+    "intro": "Borg n'est pas une dépendance de base de l'installateur ProxMenux. Lorsqu'une sauvegarde s'exécute, <code>hb_ensure_borg</code> résout le binaire à partir de quatre sources dans l'ordre et retourne le premier qui fonctionne :",
+    "rows": [
+      {
+        "priority": "1",
+        "source": "Système <code>borg</code>",
+        "detail": "Si l'hôte a déjà <code>borg</code> installé via APT (<code>which borg</code> résout), ce binaire est utilisé."
+      },
+      {
+        "priority": "2",
+        "source": "Cache du répertoire d’état",
+        "detail": "<code>/usr/local/share/proxmenux/borg</code> — conservé d'un téléchargement préalable de GitHub sur cet hôte."
+      },
+      {
+        "priority": "3",
+        "source": "Paquet AppImage du moniteur",
+        "detail": "<code>/usr/local/share/proxmenux/monitor-app/usr/bin/borg</code> — le AppImage regroupe un borg-linux64 signé. C'est le chemin hors ligne sécurisé : un hôte sans internet a toujours un <code>borg</code> fonctionnant."
+      },
+      {
+        "priority": "4",
+        "source": "Téléchargement GitHub",
+        "detail": "<code>wget</code> contre l'URL <code>borg-linux64</code> épinglée sous <code>github.com/borgbackup/borg/releases/</code>, vérifiée contre une constante SHA-256 dans <code>lib_host_backup_common.sh</code> (<code>HB_BORG_LINUX64_SHA256</code>). En cas de somme de contrôle incorrecte, le binaire est rejeté et la sauvegarde avorte. Le fichier téléchargé est mis en cache dans l'état dir afin que les sauvegardes suivantes utilisent le chemin 2."
+      }
+    ]
+  },
+  "repoTypes": {
+    "heading": "Types de dépôts",
+    "intro": "Le type de dépôt est choisi lorsqu'une cible est ajoutée. Chaque type résout une URL de dépôt différente que Borg comprend.",
+    "rows": [
+      {
+        "type": "remote",
+        "url": "ssh://USER@HOST/RPATH",
+        "detail": "Le dépôt vit sur un serveur distant qui exécute <code>borg serve</code>. Nécessite une connexion SSH à ce serveur."
+      },
+      {
+        "type": "usb",
+        "url": "/mnt/MOUNTPOINT/borgbackup",
+        "detail": "Le dépôt vit sur un disque externe monté (habituellement USB). Le montage est résolu via <code>hb_prompt_mounted_path</code>, qui détecte, monte ou formate les partitions USB au besoin."
+      },
+      {
+        "type": "local",
+        "url": "/backup/borgbackup (any absolute path)",
+        "detail": "Le dépôt vit dans un répertoire local. Signifiant seulement lorsque le répertoire cible est sur un disque physique séparé — un dépôt sur le même disque que la source protège contre l'erreur de l'opérateur mais pas contre la défaillance du disque."
+      }
+    ]
+  },
+  "serverSetup": {
+    "heading": "Préparation du serveur Borg (côté serveur)",
+    "intro": "Le type de dépôt <code>remote</code> nécessite un serveur Borg fonctionnel accessible via SSH. ProxMenux ne configure pas le serveur lui-même : il autorise seulement une clé sur un compte existant. Cette section décrit les prérequis du serveur.",
+    "hostChoicesTitle": "Où le serveur peut vivre",
+    "hostChoicesBody": "Tout hôte Linux avec accès SSH se qualifie. Configurations communes :",
+    "hostChoicesItems": [
+      "Un NAS dédié ou une boîte de sauvegarde (Debian, Ubuntu, TrueNAS SCALE avec un shell).",
+      "Un conteneur LXC à l'intérieur d'un nœud Proxmox. Petite empreinte, isolée de l'hôte exécutant les sauvegardes.",
+      "Un autre hôte Proxmox sur le même LAN, ou un VM n'importe où accessible sur SSH."
+    ],
+    "lxcWarningTitle": "LXC comme serveur Borg",
+    "lxcWarningBody": "Si le serveur Borg est dans un LXC, generate-auto nécessite un compte acceptant l’authentification SSH par mot de passe pour installer la clé. Sinon, utilisez l’installation manuelle ou l’alternative generate-pct via l’hôte PVE.",
+    "requirementsTitle": "Exigences sur le serveur",
+    "requirementsRows": [
+      {
+        "requirement": "Exécutable borg dans <code>/usr/bin/borg</code>",
+        "detail": "La ligne <code>command=\"/usr/bin/borg serve ...\"</code> écrite par ProxMenux dans <code>authorized_keys</code> utilise ce chemin fixe. L’installation APT (<code>apt install borgbackup</code>) y place l’exécutable. Pour un binaire autonome, créez un lien symbolique à <code>/usr/bin/borg</code>."
+      },
+      {
+        "requirement": "Un compte utilisateur dédié (généralement <code>borg</code>)",
+        "detail": "Possède le répertoire du dépôt et reçoit les connexions SSH entrantes. N'a pas besoin d'accès sudo ou shell — la ligne authorized_keys désactive de toute façon les shells interactifs."
+      },
+      {
+        "requirement": "Un répertoire de dépôt en écriture",
+        "detail": "Le chemin que l'opérateur donne à ProxMenux (par exemple <code>/backup/borgbackup</code>) doit exister sur le serveur et être la propriété de l'utilisateur borg."
+      },
+      {
+        "requirement": "SSH démon acceptant l'utilisateur borg",
+        "detail": "<code>PubkeyAuthentication yes</code> (par défaut). L'authentification par mot de passe n'est nécessaire que pour le flux <em>generate-auto</em>, une fois la clé installée, le serveur peut désactiver complètement le mot de passe auth."
+      }
+    ],
+    "minimalSetupTitle": "Configuration minimale du serveur",
+    "minimalSetupBody": "Sur un serveur Debian ou Ubuntu Borg, une référence de travail est quatre commandes comme root:",
+    "minimalSetupCmd": "apt install borgbackup\nuseradd -m -d /home/borg -s /bin/bash borg\nmkdir -p /backup/borgbackup\nchown borg:borg /backup/borgbackup",
+    "minimalSetupNote": "Une fois le serveur préparé et l’authentification SSH par mot de passe disponible, <code>generate-auto</code> installe la clé via un compte pouvant écrire dans authorized_keys de l’utilisateur borg. Les sauvegardes suivantes utilisent cette clé, limitée à <code>borg serve</code> au chemin configuré. Sans connexion par mot de passe, installez-la manuellement ou via l’hôte PVE."
+  },
+  "sshAuth": {
+    "heading": "authentification SSH (côté client)",
+    "intro": "Les dépôts distants Borg sont accessibles sur SSH. La connexion passe de l'hôte ProxMenux à un compte utilisateur sur le serveur Borg qui exécute <code>borg serve</code>. Cet utilisateur s'appelle généralement <code>borg</code>, PAS l'utilisateur admin/root du serveur — la ligne de commande borg-serve verrouille la connexion à ce chemin de dépôt spécifique (voir les stratégies clés ci-dessous).",
+    "strategiesTitle": "Stratégies de clé SSH",
+    "strategiesIntro": "Lors de l’ajout d’une destination distante, ProxMenux demande l’utilisateur SSH, l’hôte, le port et le chemin distant, puis propose quatre choix d’authentification. L’alternative generate-pct est proposée si l’authentification par mot de passe est refusée. Voici les modes :",
+    "strategyRows": [
+      {
+        "mode": "generate-auto",
+        "label": "Recommandé",
+        "detail": "ProxMenux crée ou réutilise une paire de clés ed25519 dans <code>~/.ssh/borg_proxmenux_HOST_ed25519</code>, puis utilise <code>sshpass</code> pour tester la connexion et installer la clé publique dans <code>~borg/.ssh/authorized_keys</code>. Le mot de passe est celui d’un compte autorisé à écrire ce fichier, généralement root ou borg. Il sert pendant la configuration et n’est pas enregistré."
+      },
+      {
+        "mode": "generate-manual",
+        "label": "Pas de mot de passe admin sur cet hôte",
+        "detail": "ProxMenux génère la paire de clés comme ci-dessus, mais affiche la ligne complète <code>authorized_keys</code> pour que l'opérateur colle manuellement dans le serveur. Le mot de passe administrateur ne quitte jamais l'hôte ProxMenux car il n'est jamais demandé."
+      },
+      {
+        "mode": "generate-pct",
+        "label": "Le serveur Borg est un PVE LXC",
+        "detail": "Le serveur Borg fonctionne à l'intérieur d'un LXC sur un nœud PVE. ProxMenux autorise la clé via <code>pct exec</code> de l'hôte PVE — root sur l'hôte PVE écrit dans le LXC de <code>~borg/.ssh/authorized_keys</code> sans avoir besoin de SSH dans le LXC lui-même."
+      },
+      {
+        "mode": "existing",
+        "label": "Utiliser une clé existante",
+        "detail": "ProxMenux recherche dans <code>/root/.ssh/</code> et <code>$HOME/.ssh/</code> les clés privées ed25519/RSA qu’il peut lire, puis les liste. L’opérateur en choisit une ou indique manuellement un chemin non standard."
+      },
+      {
+        "mode": "none",
+        "label": "Config par défaut SSH",
+        "detail": "Aucune clé personnalisée — Borg s'appuie sur la configuration par défaut de l'hôte SSH (généralement <code>~/.ssh/id_rsa</code> ou un agent SSH)."
+      }
+    ],
+    "restrictTitle": "La ligne authorized_keys",
+    "restrictBody": "Pour chaque clé générée, la ligne <code>authorized_keys</code> écrite par ProxMenux sur le serveur limite la clé à cet appel borg-serve sur le chemin configuré du dépôt :",
+    "restrictLine": "command=\"/usr/bin/borg serve --restrict-to-path RPATH\",restrict PUBKEY",
+    "restrictNote": "Le <code>command=</code> force chaque session SSH en utilisant cette clé pour exécuter seulement la commande borg-serve; <code>restrict</code> désactive le renvoi de port, le renvoi d'agent, le renvoi de X11 et l'allocation de PTY. La clé ne peut pas être utilisée pour ouvrir un shell interactif sur le serveur ou pour accéder à tout autre chemin de dépôt, même si le compte a des privilèges plus larges."
+  },
+  "savedTargets": {
+    "heading": "Objectifs enregistrés",
+    "intro": "Une destination enregistrée conserve la configuration du dépôt sous un nom lisible pour éviter de ressaisir les détails. Fichiers dans le répertoire d’état ProxMenux :",
+    "rows": [
+      {
+        "file": "borg-targets.txt",
+        "content": "Une ligne par destination : <code>NAME|REPO|SSH_KEY_PATH|ENCRYPT_MODE</code>. <code>hb_collect_borg_configs</code> la lit pour remplir le menu de sélection des destinations."
+      },
+      {
+        "file": "borg-pass-NAME.txt",
+        "content": "Phrase secrète de la destination nommée NAME ci-dessus (<code>chmod 600</code>). Présente uniquement si le chiffrement repokey a été choisi."
+      }
+    ],
+    "outro": "Enregistrer la destination est facultatif. Refuser omet la configuration nommée, mais ne supprime pas une clé SSH générée. Si le chiffrement repokey est activé sans destination enregistrée, ProxMenux conserve tout de même la phrase secrète dans l’ancien fichier borg-pass.txt."
+  },
+  "encryption": {
+    "heading": "Cryptage",
+    "body": "Les dépôts sont initialisés avec un mode de chiffrement via <code>hb_borg_init_if_needed</code>: le <code>borg repo-create -e MODE</code> moderne quand disponible, ou le <code>borg init --encryption=MODE</code> hérité. ProxMenux expose deux modes : <code>repokey</code> (par défaut) et <code>none</code>. En mode <code>repokey</code> Borg stocke la clé de cryptage à l'intérieur du dépôt lui-même ; l'accès nécessite une phrase de passe, que ProxMenux invite pour deux fois avec vérification de concordance et enregistre dans <code>borg-pass-NAME.txt</code> pour une destination enregistrée, sinon dans l’ancien fichier décrit plus haut. Une boîte de dialogue de reconnaissance obligatoire s'affiche après l'enregistrement de la phrase de passe : la phrase de passe est la seule façon d'accéder aux archives chiffrées, et la perdre rend chaque archive du dépôt inrécupérable."
+  },
+  "runtimeEnv": {
+    "heading": "Environnement d'exécution",
+    "intro": "ProxMenux exporte les variables d'environnement suivantes avant d'invoquer <code>borg</code>. Ils configurent la connexion et déverrouillent le dépôt sans intégrer de secrets dans la ligne de commande.",
+    "rows": [
+      {
+        "var": "BORG_RSH",
+        "value": "ssh -i SSH_KEY_PATH -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new [-p PORT]",
+        "purpose": "Commande distante utilisée par Borg pour les dépôts SSH. Une clé sélectionnée ajoute les options d’identité. Quand une destination est ajoutée avec un port non standard, ProxMenux ajoute aussi -p PORT ; les destinations enregistrées, les tâches planifiées et le Monitor utilisent plutôt le port de l’URL ssh://. Sans clé personnalisée, et pour une nouvelle destination avec le port par défaut, la variable reste non définie et Borg utilise la configuration SSH de l’hôte."
+      },
+      {
+        "var": "BORG_PASSPHRASE",
+        "value": "(Passphrase de borg-pass-NAME.txt)",
+        "purpose": "Débloque le repokey. Définir uniquement lorsque la cible utilise le chiffrement <code>repokey</code>. N'apparaît jamais dans la liste des arguments du processus."
+      },
+      {
+        "var": "BORG_ENCRYPT_MODE",
+        "value": "repokey | none",
+        "purpose": "Utilisé par <code>hb_borg_init_if_needed</code> lors de l'initialisation d'un dépôt qui n'existe pas encore. Ignoré par <code>borg create</code> sur les dépôts existants."
+      },
+      {
+        "var": "BORG_RELOCATED_REPO_ACCESS_IS_OK",
+        "value": "yes",
+        "purpose": "Supprime la confirmation interactive demandée par Borg lorsque l’URL du dépôt diffère de celle utilisée initialement, par exemple après avoir renommé un point de montage ou changé l’adresse du serveur SSH."
+      },
+      {
+        "var": "BORG_UNKNOWN_UNENCRYPTED_REPO_ACCESS_IS_OK",
+        "value": "yes",
+        "purpose": "Supprime l'invite interactive Borg soulève la première fois qu'un dépôt non chiffré est accessible depuis un nouveau client."
+      }
+    ]
+  },
+  "archiveFormat": {
+    "heading": "Nom et conservation des archives",
+    "intro": "Chaque sauvegarde crée une nouvelle archive dans le dépôt.",
+    "namePattern": "hostcfg-HOSTNAME-YYYYMMDD_HHMMSS",
+    "retentionBody": "Pour les tâches programmées, <code>run_scheduled_backup.sh</code> exécute <code>borg prune</code> contre le dépôt après chaque sauvegarde réussie avec les valeurs de conservation configurées sur le travail (<code>--keep-last</code>, <code>--keep-daily</code>, <code>--keep-weekly</code>). Les sauvegardes interactives ne se prunent pas."
+  },
+  "restoreAccess": {
+    "heading": "Récupération du côté restauration",
+    "body": "Le flux de restauration liste les archives avec <code>borg list REPO</code> et extrait celui sélectionné avec <code>borg extract REPO::ARCHIVE-NAME</code> dans un répertoire de mise en scène que <code>_rs_check_layout</code> alimente dans le pipeline de restauration standard. Pour la récupération manuelle à l'extérieur de ProxMenux les mêmes commandes fonctionnent; l'arborescence extraite est la mise en page standard à trois payload décrite dans <em>Comment ça marche</em>."
+  },
+  "references": {
+    "heading": "Références",
+    "intro": "Documentation officielle de Borg pour les composants utilisés par ProxMenux.",
+    "items": [
+      {
+        "label": "Documentation borg",
+        "href": "https://borgbackup.readthedocs.io/",
+        "tail": "— point d'entrée principal couvrant les concepts, le déploiement, le démarrage rapide et chaque commande."
+      },
+      {
+        "label": "borg create",
+        "href": "https://borgbackup.readthedocs.io/en/stable/usage/create.html",
+        "tail": " — la commande utilisée par ProxMenux pour chaque sauvegarde, avec toutes les options prises en charge."
+      },
+      {
+        "label": "Chiffrement des dépôts",
+        "href": "https://borgbackup.readthedocs.io/en/stable/usage/init.html#encryption-mode",
+        "tail": "— les modes de cryptage pris en charge par Borg, y compris la repokey que ProxMenux utilise par défaut."
+      },
+      {
+        "label": "borg serve et déploiement via SSH",
+        "href": "https://borgbackup.readthedocs.io/en/stable/deployment/central-backup-server.html",
+        "tail": " — configuration d’un serveur Borg central accessible via SSH, avec la commande borg-serve et l’option restrict-to-path inscrites par ProxMenux dans authorized_keys."
+      },
+      {
+        "label": "borg prune",
+        "href": "https://borgbackup.readthedocs.io/en/stable/usage/prune.html",
+        "tail": " — le modèle de rétention de --keep-last / --keep-daily / --keep-weekly appliqué par ProxMenux à chaque tâche planifiée."
+      }
+    ]
+  }
+}
diff --git a/web/messages/fr/docs/backup-restore/destinations/index.json b/web/messages/fr/docs/backup-restore/destinations/index.json
new file mode 100644
index 00000000..ff0d8970
--- /dev/null
+++ b/web/messages/fr/docs/backup-restore/destinations/index.json
@@ -0,0 +1,110 @@
+{
+  "meta": {
+    "title": "Destinations des sauvegardes — archive locale, Proxmox Backup Server et Borg | ProxMenux",
+    "description": "Trois moteurs de stockage reçoivent la même charge utile de sauvegarde ProxMenux : une archive locale .tar.zst sur tout système de fichiers accessible en écriture, une sauvegarde PBS dans un datastore Proxmox Backup Server ou une archive Borg dans un dépôt Borg local ou distant. Chaque moteur a ses propres caractéristiques de compression, de déduplication, de chiffrement et de réseau.",
+    "ogTitle": "Destinations de sauvegarde ProxMenux",
+    "ogDescription": "Local, Proxmox Backup Server et Borg — trois moteurs de stockage pour la même charge utile de sauvegarde d'hôte.",
+    "twitterTitle": "Destinations de sauvegarde ProxMenux | ProxMenux",
+    "twitterDescription": "Archives locales, moteurs Proxmox Backup Server et Borg pour les sauvegardes d'hôte."
+  },
+  "header": {
+    "title": "Destinations",
+    "description": "Trois backends de stockage pris en charge par ProxMenux Backup: archive locale, Proxmox Backup Server (recommandé) et Borg. Chacun reçoit la même archive à trois charges; ils diffèrent en format de stockage, déduplication, modèle de chiffrement et exigences du réseau.",
+    "section": "Sauvegarde et restauration"
+  },
+  "intro": {
+    "title": "Même charge utile, trois moteurs",
+    "body": "Chaque sauvegarde produit les mêmes trois charges utiles (rootfs, manifeste, applications). Ce qui change entre les destinations, c'est comment ces charges sont stockées et comment l'opérateur les récupère pour une restauration. Chaque moteur est implémenté comme une fonction séparée dans <code>backup_host.sh</code> — <code>_bk_local</code>, <code>_bk_pbs</code>, <code>_bk_borg</code> — mais les trois partagent la même étape de préparation temporaire (<code>hb_prepare_staging</code>) et le même chemin de code de restauration. Le choix de la destination n'affecte que l'écriture et la récupération ; il ne change pas ce qu'une restauration fait ou comment elle consomme l'archive."
+  },
+  "comparison": {
+    "heading": "Comparaison des caractéristiques",
+    "intro": "Le tableau suivant répertorie les différences concrètes entre les trois backends tels qu'ils se comportent dans ProxMenux aujourd'hui. Toutes les valeurs décrivent le comportement observé du backend lui-même, et non des recommandations éditoriales.",
+    "rows": [
+      {
+        "feature": "Format de stockage",
+        "local": "Un seul fichier <code>.tar.zst</code> (ou <code>.tar.gz</code> si <code>zstd</code> est absent).",
+        "pbs": "Sauvegarde PBS (blocs <code>.pxar</code> dans le datastore).",
+        "borg": "Archive Borg à l'intérieur d'un dépôt Borg (fichiers de segments)."
+      },
+      {
+        "feature": "Compression",
+        "local": "zstd (niveau par défaut) via <code>tar --zstd</code>. Repli sur gzip.",
+        "pbs": "Gérée par proxmox-backup-client. ProxMenux ne modifie pas les paramètres de compression.",
+        "borg": "Compression intégrée à Borg. ProxMenux appelle borg create sans modifier les paramètres de compression."
+      },
+      {
+        "feature": "Déduplication",
+        "local": "Aucune. Chaque sauvegarde est une archive indépendante complète.",
+        "pbs": "Déduplication complète de niveau chunk sur toutes les sauvegardes dans le datastore.",
+        "borg": "Déduplication complète au niveau des blocs entre toutes les archives du dépôt."
+      },
+      {
+        "feature": "Chiffrement au repos",
+        "local": "Aucun (dépend de la protection au niveau du système de fichiers).",
+        "pbs": "Chiffrement facultatif côté client avec un fichier de clé. Si activé, le blob de récupération est envoyé dans un groupe de sauvegarde distinct.",
+        "borg": "Chiffrement facultatif des repokey (clé stockée dans la repo, déverrouillée par une phrase de passe)."
+      },
+      {
+        "feature": "Rétention / purge",
+        "local": "Appliquée par tâche programmée via <code>KEEP_LAST</code>. Les anciennes archives sont supprimées avec leurs fichiers annexes et journaux d’exécution. Les sauvegardes interactives ne font pas de purge.",
+        "pbs": "Appliquée par tâche programmée via <code>proxmox-backup-client prune --keep-last / --keep-daily / --keep-weekly</code>. Les sauvegardes interactives ne font pas de purge.",
+        "borg": "Appliquée par tâche programmée via <code>borg prune --keep-last / --keep-daily / --keep-weekly</code>. Les sauvegardes interactives ne font pas de purge."
+      },
+      {
+        "feature": "Réseau",
+        "local": "Aucune. Écrit à un point de montage local (généralement un disque interne ou un lecteur USB).",
+        "pbs": "TCP vers le serveur PBS (port par défaut 8007). Nécessite des identifiants PBS + empreinte du certificat.",
+        "borg": "Chemin du système de fichiers local ou tunnel SSH vers un hôte Borg distant."
+      },
+      {
+        "feature": "Dépendances",
+        "local": "<code>tar</code>, <code>zstd</code> (présent sur Proxmox par défaut).",
+        "pbs": "Paquet <code>proxmox-backup-client</code> (fourni avec Proxmox VE 8+).",
+        "borg": "<code>borg</code> binaire. Auto-provisionné par ProxMenux à partir du paquet Moniteur AppImage quand il manque."
+      },
+      {
+        "feature": "Accès pour restaurer",
+        "local": "Tout hôte avec tar+zstd peut extraire l'archive. Pas de PBS/Borg nécessaire.",
+        "pbs": "Nécessite <code>proxmox-backup-client</code>, les identifiants PBS et le fichier de clé (si la sauvegarde est chiffrée).",
+        "borg": "Nécessite <code>borg</code> + le chemin du dépôt + la phrase de passe (si chiffrée)."
+      }
+    ],
+    "captionCode": "feature",
+    "captionLocal": "Locale",
+    "captionPbs": "Proxmox Backup Server (recommandé)",
+    "captionBorg": "Borg"
+  },
+  "sameArchive": {
+    "heading": "La disposition des archives ne change pas avec la destination",
+    "body": "A l'intérieur de l'une des trois destinations, la même disposition <code>rootfs/</code> + <code>metadata/</code> + <code>manifest.json</code> décrite dans <em>Comment ça marche</em> est présente. Un <code>.tar.zst</code> extrait d'une archive locale, un <code>.pxar</code> restauré de PBS et une archive Borg extraite de <code>borg extract</code> donnent tous un arbre de répertoire identique. Le chemin du code de restauration (<code>_rs_check_layout</code>, <code>_rs_apply</code>, <code>_rs_prepare_pending_restore</code>) lit les mêmes trois charges utiles sans savoir de quelle destination elles proviennent."
+  },
+  "extractStandalone": {
+    "heading": "Extraire une sauvegarde à l'extérieur de ProxMenux",
+    "intro": "N'importe lequel des trois formats d'archive peut être lu avec des outils standard sans ProxMenux installé sur l'hôte de lecture. Les commandes ci-dessous produisent le même arbre de répertoire qu'une restauration consomme en interne.",
+    "localCmd": "# From a local .tar.zst archive:\ntar --zstd -xf hostcfg-HOST-TIMESTAMP.tar.zst\n\n# From a .tar.gz fallback:\ntar -xzf hostcfg-HOST-TIMESTAMP.tar.gz",
+    "pbsCmd": "# From a PBS backup (requires proxmox-backup-client):\nproxmox-backup-client restore \\\n    --repository USER@REALM@HOST:DATASTORE \\\n    host/hostcfg-HOST/BACKUP-TIME \\\n    hostcfg.pxar /tmp/hostcfg\n\n# Add --keyfile KEY-PATH when the backup is encrypted.",
+    "borgCmd": "# Depuis une archive Borg (nécessite borg et la phrase de passe des dépôts chiffrés) :\nborg extract REPO-PATH::ARCHIVE-NAME\n\n# Sur un dépôt distant accessible par SSH :\nborg extract ssh://USER@HOST:PORT/REPO-PATH::ARCHIVE-NAME",
+    "note": "L'arbre extrait peut ensuite être inspecté manuellement ou alimenté à une restauration manuelle. Consultez les pages de destination individuelles pour connaître le processus de récupération exact que ProxMenux utilise sous le capot."
+  },
+  "whereNext": {
+    "heading": "Détails par destination",
+    "intro": "Chaque destination a sa propre page couvrant le flux de configuration, le format sur disque et la commande de récupération utilisée par la restauration.",
+    "items": [
+      {
+        "label": "Archives locales",
+        "href": "/docs/backup-restore/destinations/local",
+        "tail": "— pré-configuration d'une cible locale, montage d'un lecteur USB, vérification de sécurité contre l'écriture de l'archive en soi, le sidecar JSON qui permet au moniteur d'identifier le fichier."
+      },
+      {
+        "label": "Proxmox Backup Server (recommandé)",
+        "href": "/docs/backup-restore/destinations/pbs",
+        "tail": " — choix du datastore, identifiants et empreinte du certificat, cycle de vie du fichier de clé, phrase de passe de récupération et envoi du blob de récupération à PBS pour restaurer après une nouvelle installation."
+      },
+      {
+        "label": "Borg",
+        "href": "/docs/backup-restore/destinations/borg",
+        "tail": " — dépôts locaux ou accessibles par SSH, provenance du binaire Borg (système / cache / paquet AppImage de Monitor / téléchargement GitHub), initialisation du dépôt, gestion des phrases de passe et configuration des clés SSH pour les dépôts distants."
+      }
+    ]
+  }
+}
diff --git a/web/messages/fr/docs/backup-restore/destinations/local.json b/web/messages/fr/docs/backup-restore/destinations/local.json
new file mode 100644
index 00000000..0a89acf8
--- /dev/null
+++ b/web/messages/fr/docs/backup-restore/destinations/local.json
@@ -0,0 +1,75 @@
+{
+  "meta": {
+    "title": "Destination d'archive locale — tar.zst sur un système de fichiers ou un lecteur USB ProxMenux",
+    "description": "La destination de sauvegarde locale écrit une seule archive .tar.zst dans n'importe quel répertoire accessible en écriture : un disque interne, un point de montage Proxmox, un partage NFS ou un lecteur USB. Cette page décrit le processus de configuration, la détection USB et la logique de montage, le contrôle de sécurité contre l'écriture de l'archive dans un chemin en cours de sauvegarde, et le sidecar JSON qui identifie le fichier.",
+    "ogTitle": "Sauvegarde ProxMenux — Destination des archives locales",
+    "ogDescription": "Comment ProxMenux écrit des sauvegardes locales comme archives .tar.zst et comment configurer le répertoire de destination ou le lecteur USB.",
+    "twitterTitle": "Destination de sauvegarde locale ProxMenux",
+    "twitterDescription": "Comment ProxMenux écrit des sauvegardes locales comme des archives .tar.zst sur un système de fichiers ou un lecteur USB."
+  },
+  "header": {
+    "title": "Archives locales",
+    "description": "La destination locale écrit une seule archive tar compressée dans n'importe quel répertoire accessible en écriture sur l'hôte : un disque interne, un montage NFS ou SMB ou un lecteur USB.",
+    "section": "Sauvegarde et restauration"
+  },
+  "intro": {
+    "title": "Un fichier autonome",
+    "body": "Une sauvegarde locale produit un seul fichier <code>hostcfg-HOST-TIMESTAMP.tar.zst</code> (ou <code>.tar.gz</code> lorsque <code>zstd</code> est absent). Le fichier contient l'arborescence entière de l'archive — <code>manifest.json</code>, <code>metadata/</code> et <code>rootfs/</code> — et peut être restauré sur n'importe quel hôte Proxmox avec le flux de restauration ProxMenux ou extrait manuellement avec <code>tar --zstd -xf</code> sur n'importe quel système Linux. Pas de serveur, pas d’initialisation de dépôt, pas de dépendance externe. C'est la destination avec le chemin de récupération le plus court lorsque ni PBS ni Borg n'est disponible."
+  },
+  "targetConfig": {
+    "heading": "Configuration du répertoire cible",
+    "intro": "La destination locale est un <strong>unique répertoire cible enregistré durablement</strong> — pas une liste. ProxMenux stocke le choix de l'opérateur chez <code>/usr/local/share/proxmenux/local-target.conf</code> et le lit sur chaque sauvegarde. Lorsqu'aucune cible n'a été configurée, le <code>HB_LOCAL_TARGET_DEFAULT = /var/lib/vz/dump</code> par défaut est utilisé (le même répertoire que Proxmox utilise pour ses propres sorties <code>vzdump</code>). La cible est configurée à partir de <em>Configurer les destinations de sauvegarde → Destinations locales</em>:",
+    "options": [
+      "<strong>Utilisez par défaut (<code>/var/lib/vz/dump</code>).</strong> Le stockage local Proxmox. Présent sur chaque install Proxmox ; l'archive se trouve à côté des sorties vzdump et est captée automatiquement par l'onglet Sauvegardes du moniteur.",
+      "<strong>Entrez un chemin personnalisé.</strong> Tout chemin absolu du système de fichiers peut être utilisé : un montage NFS, un partage SMB monté via <code>fstab</code>, un jeu de données ZFS dédié, un deuxième disque interne. ProxMenux valide que le chemin existe et est un répertoire avant de l’enregistrer.",
+      "<strong>Choisissez un lecteur USB.</strong> Ouvre le sous-menu USB (ci-dessous), qui détecte les appareils amovibles et propose de monter ou de formater un périphérique."
+    ]
+  },
+  "usbFlow": {
+    "heading": "Détection et montage du lecteur USB",
+    "intro": "Le sous-menu USB énumère les partitions sur les périphériques amovibles signalées par <code>lsblk</code>. Chaque partition est présentée avec sa taille, l'étiquette du système de fichiers et l'état actuel. L'état détermine l'action ProxMenux offre.",
+    "statesTitle": "Les trois états de l'appareil",
+    "stateRows": [
+      {
+        "state": "monté",
+        "shown": "Taille · étiquette · [fstype] · → /mount/point",
+        "action": "La partition est déjà montée quelque part. La sélection enregistre le point de montage actuel en tant que cible locale. Aucun montage n'est effectué."
+      },
+      {
+        "state": "non monté",
+        "shown": "Taille · étiquette · [fstype] · (non monté — sera monté)",
+        "action": "Un système de fichiers est présent mais n'est pas monté. Lors de la confirmation, ProxMenux exécute <code>hb_mount_usb_partition</code> : crée <code>/mnt/backup-LABEL</code> (ou un chemin basé sur UUID s'il n'y a pas d'étiquette), monte la partition et persiste le point de montage comme cible locale."
+      },
+      {
+        "state": "vide",
+        "shown": "Taille · disque USB brut — aucun système de fichiers (sera FORMATÉ)",
+        "action": "Le périphérique n’a pas de système de fichiers. Cette opération destructive est protégée par deux confirmations. Une boîte de dialogue Oui/Non avertit d’abord que le disque sera effacé. Ensuite, un champ exige de <strong>saisir le chemin exact du périphérique</strong> (par exemple <code>/dev/sdb</code>) avant que ProxMenux crée une nouvelle table GPT avec une partition ext4 et la monte."
+      }
+    ],
+    "notMountedFallback": "Lorsqu'aucun périphérique USB n'est détecté, le sous-menu revient à une boîte d'entrée simple. L'opérateur peut entrer un chemin de point de montage arbitraire ; si le chemin n'est pas un point de montage enregistré, une boîte de dialogue de confirmation avertit avant de procéder."
+  },
+  "safetyCheck": {
+    "heading": "Contrôle de sécurité — destination dans un chemin de sauvegarde",
+    "body": "Avant d'écrire l'archive, <code>_bk_local</code> vérifie que le répertoire de destination n'est <strong>pas</strong> un sous-chemin d'un répertoire en cours de sauvegarde. Une erreur courante consisterait à ajouter <code>/root</code> au profil et à choisir <code>/root/backups</code> comme destination — l'archive s'inclurait alors elle-même, produisant soit une archive corrompue, soit s'agrandissant sans limite jusqu'à ce que le disque se remplisse. La vérification résout les deux chemins avec <code>readlink -m</code>, les compare et, en cas de conflit, abandonne la sauvegarde avec une boîte de dialogue qui nomme le chemin en conflit et répertorie trois façons de le résoudre : choisissez une destination en dehors du chemin en conflit, supprimez l'entrée personnalisée qui contient la destination ou utilisez le mode personnalisé pour décocher le chemin en conflit pour cette exécution."
+  },
+  "archiveFormat": {
+    "heading": "Format d'archives et compression",
+    "intro": "Le nom du fichier contient le nom d’hôte source et l’horodatage de la sauvegarde, afin de permettre un tri chronologique dans un répertoire contenant plusieurs archives et d’identifier chaque fichier.",
+    "namePattern": "hostcfg-HOSTNAME-YYYYMMDD_HHMMSS.tar.zst",
+    "compressionTitle": "Compression",
+    "compressionBody": "Le chemin primaire utilise <code>tar --zstd -cf</code> — un pipeline à commande unique qui compresse au niveau par défaut de zstd. Lorsque <code>zstd</code> n'est pas présent sur la source (rare sur Proxmox mais possible sur des installations minimales), ProxMenux revient à <code>gzip</code>. Dans le chemin de repli, si <code>pv</code> est disponible, une barre de progression est ajoutée au pipeline afin que l'opérateur voit la taille des archives croître en temps réel; sans <code>pv</code>, <code>tar -czf</code> est utilisé en silence.",
+    "sourceTitle": "Ce qui va dans l'archive",
+    "sourceBody": "La commande tar est appelée avec <code>-C \"$staging_root\" .</code>, ce qui archive <strong>toute la racine du répertoire temporaire</strong> : <code>rootfs/</code>, <code>metadata/</code> et <code>manifest.json</code>. Les trois blocs de données se trouvent côte à côte à la racine de l’archive tar. L’extraction produit exactement l’arborescence utilisée par le code de restauration."
+  },
+  "sidecar": {
+    "heading": "Le sidecar JSON",
+    "intro": "Chaque sauvegarde locale réussie produit un fichier compagnon : <code>HOSTNAME-TIMESTAMP.tar.zst.proxmenux.json</code>, écrit à côté de l'archive par <code>hb_write_archive_sidecar</code>. Ce petit fichier JSON permet au ProxMenux Monitor d'identifier l'archive comme une sauvegarde d'hôte ProxMenux même s'il est déplacé, rebaptisé ou archivé ailleurs.",
+    "contentTitle": "Contenu du sidecar",
+    "contentBody": "Le sidecar stocke la version du schéma, que la sauvegarde soit issue d'une opération interactive ou d'un travail programmé (<code>kind</code>), l'ID de travail pour les opérations programmées, le mode de profil utilisé (<code>default</code> ou <code>custom</code>), le nom d'hôte source, le nom de base d'archive original, un horodatage de création ISO-8601 et la taille des archives en octets.",
+    "whyBody": "L'onglet Sauvegardes du moniteur scanne les répertoires locaux configurés pour les sidecars <code>*.proxmenux.json</code> — pas pour les fichiers <code>*.tar.zst</code> — parce qu'un <code>.tar.zst</code> sans sidecar pourrait ne pas être une sauvegarde ProxMenux du tout. Le scan est rapide (les fichiers JSON sont minuscules) et l'appariement est stable à travers les renoms de l'archive aussi longtemps que le sidecar est renommé pour correspondre."
+  },
+  "restoreAccess": {
+    "heading": "Restauration à partir d'une archive locale",
+    "body": "Le flux de restauration ProxMenux découvre les archives locales en scannant la cible locale configurée pour les sidecars et en les affichant dans la liste des archives. La sélection d’une archive déclenche <code>_rs_check_layout</code>, qui extrait le tarball dans un répertoire de préparation temporaire et confirme la mise en page à trois payload avant de procéder. Pour l'extraction manuelle à l'extérieur de ProxMenux, <code>tar --zstd -xf hostcfg-HOSTNAME-TIMESTAMP.tar.zst -C /tmp/hostcfg</code> donne le même arbre que le code de restauration consommé."
+  }
+}
diff --git a/web/messages/fr/docs/backup-restore/destinations/pbs.json b/web/messages/fr/docs/backup-restore/destinations/pbs.json
new file mode 100644
index 00000000..ef0daf61
--- /dev/null
+++ b/web/messages/fr/docs/backup-restore/destinations/pbs.json
@@ -0,0 +1,113 @@
+{
+  "meta": {
+    "title": "Proxmox Backup Server destination — dépôt, chiffrement, récupération ProxMenux",
+    "description": "La destination PBS enregistre les sauvegardes d’hôte ProxMenux au format PBS. Cette page décrit la détection des dépôts dans /etc/pve/storage.cfg, la configuration manuelle, l’envoi des archives .pxar, le chiffrement côté client avec un fichier clé et sa copie de secours facultative protégée par une phrase secrète, ainsi que sa récupération depuis plusieurs sources sur un hôte réinstallé.",
+    "ogTitle": "ProxMenux Sauvegarde — Proxmox Backup Server destination",
+    "ogDescription": "Comment ProxMenux écrit des sauvegardes d'hôte à Proxmox Backup Server avec le cryptage de fichier clé côté client et la récupération séquestre.",
+    "twitterTitle": "PBS destination de sauvegarde ProxMenux",
+    "twitterDescription": "Destination Proxmox Backup Server avec chiffrement par fichier clé et copie de récupération protégée par une phrase secrète."
+  },
+  "header": {
+    "title": "Proxmox Backup Server",
+    "description": "La destination PBS envoie tout le répertoire de préparation sous forme d’une seule sauvegarde .pxar vers un datastore Proxmox Backup Server. Le chiffrement côté client avec un fichier clé est facultatif, tout comme l’envoi, à côté de chaque sauvegarde, d’une copie de récupération de la clé protégée par une phrase secrète.",
+    "section": "Sauvegarde et restauration"
+  },
+  "recommendedBadge": "Destination recommandée",
+  "aboutPbs": {
+    "heading": "Qu'est-ce que Proxmox Backup Server",
+    "body": "Proxmox Backup Server (PBS) est le propre produit serveur de sauvegarde de Proxmox, développé et entretenu par la même équipe que les auteurs Proxmox VE. Il s'agit d'un serveur de sauvegarde dédié conçu pour recevoir des sauvegardes des hôtes Proxmox VE (VMs, LXCs et — via <code>proxmox-backup-client</code> — répertoires d'hôtes arbitraires) avec déduplication basée sur le chunk, chiffrement côté client et politiques de rétention appliquées côté serveur. ProxMenux utilise le PBS comme l'une des trois destinations pour les sauvegardes d'hôtes; chaque mécanisme spécifique au PBS décrit sur cette page (groupes de sauvegarde, archives <code>.pxar</code>, <code>--backup-id</code>, cryptage de fichiers clés) est le comportement standard du PBS."
+  },
+  "intro": {
+    "title": "Une sauvegarde par exécution, déduplication par blocs",
+    "body": "Une sauvegarde PBS crée une seule entrée dans le datastore, sous l’identifiant <code>host/hostcfg-HOSTNAME/BACKUP-TIME</code>. Les données sont une archive <code>.pxar</code> contenant la même structure en trois blocs que celle décrite dans <em>Fonctionnement</em>. PBS déduplique les blocs entre toutes les sauvegardes du datastore : les suivantes ne transfèrent et ne stockent que les blocs modifiés de cet hôte. Pour les tâches planifiées, ProxMenux applique lui-même la rétention : après chaque exécution réussie, <code>run_scheduled_backup.sh</code> lance <code>proxmox-backup-client prune</code> avec <code>--keep-last</code> / <code>--keep-daily</code> / <code>--keep-weekly</code> et les valeurs configurées pour la tâche."
+  },
+  "repoSelection": {
+    "heading": "Sélection du dépôt",
+    "intro": "ProxMenux découvre des dépôts PBS de deux sources sur chaque sauvegarde. L'opérateur en choisit un dans un menu unifié; le choix détermine <code>HB_PBS_REPOSITORY</code>, <code>HB_PBS_SECRET</code> et <code>HB_PBS_FINGERPRINT</code> pour l'exécution.",
+    "sourceRows": [
+      {
+        "source": "storage.cfg de Proxmox (détection automatique)",
+        "path": "/etc/pve/storage.cfg + /etc/pve/priv/storage/NAME.pw",
+        "content": "Toute stanza <code>pbs:</code> dans la configuration de stockage propre de Proxmox est captée automatiquement. Serveur, datastore, nom d'utilisateur et empreinte digitale viennent de la stanza. Le mot de passe est lu dans le propre répertoire d'identification de Proxmox. Aucune réentrée nécessaire du côté ProxMenux — le dépôt est disponible dès qu'il est configuré dans Proxmox."
+      },
+      {
+        "source": "Configuration manuelle ProxMenux",
+        "path": "/usr/local/share/proxmenux/pbs-manual-configs.txt + pbs-pass-NAME.txt + pbs-fingerprint-NAME.txt",
+        "content": "Ajouté de <em>Configurer les destinations de sauvegarde → PBS destinations → Ajouter PBS</em>. Prompts pour un nom, nom d'utilisateur (<code>root@pam</code> ou <code>user@pbs!token</code>), hôte ou IP, datastore et mot de passe. Le mot de passe reprend sur l'entrée vide — une sauvegarde vide persisterait silencieusement et chaque sauvegarde ultérieure échouerait avec une erreur d'authentification opaque. Ce chemin est utilisé lorsque la cible PBS n'est pas enregistrée comme stockage Proxmox."
+      }
+    ],
+    "menuTitle": "Menu de sélection",
+    "menuBody": "Les deux sources sont affichées dans un menu unique, chaque ligne marquée avec son origine (<code>[proxmox]</code> ou <code>[manual]</code>). Les entrées dont le mot de passe n'a pas pu être résolu sont marquées d'un avertissement <code>⚠ no password</code> – la sélection d'une entrée déclenche une réentrée de mot de passe avant le début de la sauvegarde. L'empreinte digitale est transmise à <code>proxmox-backup-client</code> via la variable d'environnement <code>PBS_FINGERPRINT</code>; en cas d'absence, le client demande à l'opérateur d'accepter le certificat serveur de manière interactive lors de la première sauvegarde."
+  },
+  "backupCommand": {
+    "heading": "La commande de sauvegarde",
+    "intro": "L’envoi se fait en un seul appel à <code>proxmox-backup-client backup</code>. ProxMenux utilise <code>env</code> pour transmettre au client le mot de passe, le mot de passe de chiffrement et l’empreinte sous forme de variables d’environnement.",
+    "cmd": "env \\\n    PBS_PASSWORD=\"$HB_PBS_SECRET\" \\\n    PBS_ENCRYPTION_PASSWORD=\"$HB_PBS_ENC_PASS\" \\\n    PBS_FINGERPRINT=\"$HB_PBS_FINGERPRINT\" \\\n    proxmox-backup-client backup \\\n        hostcfg.pxar:$staging_root \\\n        --repository USER@REALM@HOST:DATASTORE \\\n        --backup-type host \\\n        --backup-id  hostcfg-HOSTNAME \\\n        --backup-time BACKUP-EPOCH \\\n        [--keyfile /usr/local/share/proxmenux/pbs-key.conf]",
+    "backupIdTitle": "Nom de l'ID de sauvegarde",
+    "backupIdBody": "L’identifiant de sauvegarde par défaut est <code>hostcfg-HOSTNAME</code>. L’opérateur doit le confirmer ou le modifier avant l’envoi ; les caractères hors de <code>[A-Za-z0-9_-]</code> et les tirets finaux sont supprimés. Réutiliser le même identifiant est volontaire : PBS le considère comme un <em>groupe</em>. Chaque sauvegarde suivante devient une nouvelle entrée du groupe et partage la déduplication avec les précédentes.",
+    "pxarTitle": "Pourquoi la source est la racine de mise en scène complète",
+    "pxarBody": "La source <code>.pxar</code> est la totalité du <code>staging_root</code> — <code>rootfs/</code>, <code>metadata/</code> et <code>manifest.json</code> ensemble. Les versions antérieures ont passé le <code>$staging_root/rootfs</code> comme source; cela a laissé le <code>metadata/</code> hors de l'archive et la vérification de compatibilité de la restauration n'avait rien à lire, dégradant aux avertissements cross-host même sur les restaurations même-host. Les anciennes sauvegardes créées avec la source rootfs-only restaure toujours correctement via la branche case-<code>_rs_check_layout</code> de 3, qui enveloppe un arbre plat <code>etc/var/root/usr</code> dans une hiérarchie <code>rootfs/</code>."
+  },
+  "encryption": {
+    "heading": "Chiffrement côté client",
+    "glossaryHint": "Cette section emploie les termes <em>fichier clé</em>, <em>phrase secrète</em> et <em>enveloppe de récupération</em>. Le <glosarioLink>glossaire</glosarioLink> résume leurs différences en une phrase par terme.",
+    "intro": "Le chiffrement PBS côté client avec un fichier clé chiffre les blocs sur l’hôte source avant leur envoi. Dans ProxMenux, il est facultatif. Une fois activé, l’opérateur choisit explicitement, par oui ou non lors de la configuration, s’il faut aussi déposer sur PBS une copie de récupération du fichier clé protégée par une phrase secrète ; ce choix reste modifiable dans le moniteur. Le fichier clé se trouve toujours au chemin canonique <code>/usr/local/share/proxmenux/pbs-key.conf</code> et est réutilisé sans nouvelle demande pour chaque sauvegarde chiffrée suivante.",
+    "keyfileTitle": "Configuration du fichier de clés",
+    "keyfileBody": "Le dialogue de chiffrement apparaît lors de la première sauvegarde chiffrée de l’hôte. Il demande d’abord s’il faut chiffrer la sauvegarde : <em>Non</em> poursuit sans chiffrement, <em>Oui</em> passe à la deuxième étape. Celle-ci dépend de la présence d’un fichier clé dans <code>/usr/local/share/proxmenux/pbs-key.conf</code>. S’il existe, il est réutilisé sans nouvelle demande et la sauvegarde continue ; les suivantes ne reposent pas la question. Sinon, un menu propose deux options. <em>Générer un nouveau fichier clé</em> exécute <code>proxmox-backup-client key create --kdf none</code>. <em>Utiliser un fichier clé existant</em> détecte automatiquement une clé gérée par PVE : si le dépôt PBS choisi est enregistré dans Proxmox avec une clé de chiffrement dans <code>/etc/pve/priv/storage/&lt;NAME&gt;.enc</code>, ce fichier est copié sans demande au chemin canonique ProxMenux. Si aucune clé PVE ne correspond au dépôt, le dialogue demande le chemin absolu où l’opérateur a déjà placé le fichier clé sur cet hôte. Dans les deux cas, le fichier est installé au chemin canonique avec <code>chmod 600</code>.",
+    "modesTitle": "Fichier clé par hôte ou partagé",
+    "modesIntro": "Les deux modes sont pris en charge, sans en imposer un : l’opérateur choisit selon l’organisation de son parc.",
+    "modesPerHostTitle": "Fichier de clés par hôte (par défaut)",
+    "modesPerHostBody": "Chaque hôte génère son propre fichier de clé la première fois qu'il permet le cryptage PBS. L'isolement est maximal : compromettre le fichier clé d'un hôte n'expose les sauvegardes d'aucun autre. Recommandé pour les flottes de production et pour les environnements où les hôtes ont différents propriétaires ou limites de conformité.",
+    "modesSharedTitle": "Fichier de clés partagé (import sur chaque hôte)",
+    "modesSharedBody": "Un fichier clé principal généré une fois et installé sur chaque hôte via l’option <em>Utiliser un fichier clé existant</em>. La gestion est plus simple: un seul secret à sauvegarder, et tout hôte peut déchiffrer les archives de n'importe quel autre (utile pour la consolidation, les exercices de restauration cross-host ou la vérification centralisée de sauvegarde). Le compromis est qu'une fuite du fichier de clés partagé expose chaque hôte à la fois. Recommandé pour les labos et les flottes où tous les hôtes ont le même propriétaire et la même limite de confiance.",
+    "recoveryTitle": "Déposer la clé sur PBS : l’opérateur décide",
+    "recoveryBody": "Juste après le choix du fichier clé, ProxMenux pose une question explicite, <em>Déposer la clé sur PBS ?</em>, avec deux réponses. <strong>Aucun élément de récupération n’est envoyé à PBS tant que l’opérateur n’a pas répondu Oui.</strong> Le choix par défaut est <em>Non, conserver uniquement en local</em> : le fichier clé reste au chemin canonique local, ProxMenux n’envoie aucun élément de récupération à PBS et l’opérateur gère lui-même la copie hors site. Le bouton <em>Télécharger le fichier clé</em> du moniteur, dans la ligne du dépôt PBS, permet de l’obtenir à la demande. Choisir <em>Oui, envoyer</em> demande deux saisies identiques d’une phrase secrète de récupération. ProxMenux protège le fichier clé avec cette phrase par AES-256-CBC et PBKDF2 (600 000 itérations, sel aléatoire), produisant <code>pbs-key.recovery.enc</code>. Chaque sauvegarde chiffrée suivante envoie cette enveloppe à PBS dans un groupe de sauvegarde associé. Ces envois ne transmettent à PBS ni la phrase secrète ni le fichier clé en clair. Le choix reste modifiable à tout moment dans le moniteur : le contrôle de la ligne PBS permet Oui ou Non et applique immédiatement Démarrer l’envoi, Arrêter l’envoi ou Modifier la phrase secrète selon l’état courant.",
+    "blobUploadTitle": "Groupe de sauvegarde associé sur PBS",
+    "blobUploadBody1": "Lorsque le mode de dépôt est <em>Oui, envoyer</em>, ProxMenux envoie l’enveloppe de récupération à PBS après chaque sauvegarde chiffrée, dans un second groupe associé. Son nom reprend celui du groupe de l’hôte avec le suffixe <code>-keyrecovery</code>. Les deux groupes se trouvent côte à côte dans le datastore : l’un pour les sauvegardes de l’hôte, l’autre pour les enveloppes de récupération. <strong>L’enveloppe ne quitte jamais l’hôte en clair</strong> : le chiffrement se fait sur l’hôte avec AES-256-CBC et PBKDF2 avant toute transmission (<code>openssl enc -aes-256-cbc -pbkdf2 -iter 600000 -salt</code>). PBS ne reçoit que l’enveloppe déjà chiffrée.",
+    "envelopeSecurityTitle": "Le téléchargement du fichier de récupération de clé vers PBS est-il un risque de sécurité?",
+    "envelopeSecurityBody": "Le fichier de récupération des clés est chiffré en transit et au repos. Le mot de passe de récupération ne quitte jamais l'hôte : le chiffrement se produit localement avant le téléchargement, et PBS ne voit que le résultat déjà chiffré. Un administrateur PBS — ou toute personne ayant accès à la datastore — peut télécharger le fichier de récupération de clé, mais sans la phrase de récupération, ils ne peuvent pas lire le fichier de clé à l'intérieur : c'est un chiffrement opaque. Reconstruire le fichier de clés nécessite les deux pièces à la fois, le fichier de récupération de clés et la phrase de passe, et seul l'opérateur détient les deux.",
+    "blobUploadConstraintTitle": "Pourquoi deux groupes au lieu d'un seul crypté",
+    "blobUploadConstraintBody": "Un seul appel à <code>proxmox-backup-client backup</code> chiffre toutes ses archives avec le même fichier clé, ou aucune : il ne permet pas de mélanger les deux. La sauvegarde de l’hôte doit être chiffrée avec sa clé, mais l’enveloppe de récupération ne peut pas être envoyée dans le même appel : elle serait alors chiffrée avec le fichier clé qu’elle contient. Sur un hôte réinstallé, il serait impossible de l’ouvrir, puisqu’il faudrait la clé pour déchiffrer cette même clé. Les deux éléments sont donc envoyés indépendamment et apparaissent dans deux groupes. Le client PBS chiffre la sauvegarde de l’hôte avec le fichier clé ; ProxMenux chiffre l’enveloppe avec la phrase secrète avant son envoi. Deux couches de chiffrement distinctes protègent deux éléments différents.",
+    "blobUploadImageAlt": "PBS UI montrant les groupes de sauvegarde hostcfg-HOSTNAME et hostcfg-HOSTNAME-keyrecovery adjacents à la liste datastore.",
+    "blobUploadImageCaption": "PBS UI — les groupes de sauvegarde appariés. Le groupe principal détient les sauvegardes de l'hôte; le groupe -keyrecovery détient le fichier de clés enveloppé de la phrase de passe.",
+    "recoverTitle": "Récupération sur un hôte frais",
+    "recoverBody": "Lorsque le fichier clé manque au chemin canonique, après une réinstallation ou une suppression explicite, la restauration essaie trois sources dans l’ordre et retient la première clé utilisable. D’abord, si une clé gérée par PVE correspond au dépôt PBS choisi dans <code>/etc/pve/priv/storage/&lt;NAME&gt;.enc</code>, elle est copiée sans demande au chemin canonique. Ensuite, si un groupe <code>-keyrecovery</code> existe sur PBS, son instantané le plus récent est téléchargé et la phrase secrète de récupération est demandée pour le déchiffrer. Enfin, si les deux options échouent ou sont refusées, le dialogue demande le chemin absolu du fichier clé sur cet hôte et le copie au chemin canonique. Le moniteur propose le même import dans la fenêtre de détail de la sauvegarde. Un panneau ambre apparaît en haut lorsque Restaurer, Télécharger ou Voir le contenu nécessite une clé absente. Si une clé est installée mais ne correspond pas à celle du chiffrement, PBS renvoie <code>wrong key — manifest's key XX does not match provided key YY</code>. Les mêmes trois actions affichent alors un panneau structuré mettant en évidence l’empreinte exigée par le manifeste, afin de déterminer quelle clé importer pour ouvrir cette sauvegarde.",
+    "monitorManagementTitle": "Gestion du fichier clé depuis le moniteur",
+    "monitorManagementBody": "Le moniteur affiche les commandes du fichier clé directement dans chaque ligne de destination PBS de la page de configuration des sauvegardes. Trois actions sont proposées : <em>Télécharger</em> exporte le fichier actuel vers le navigateur ; <em>Envoyer</em> remplace le fichier installé par celui fourni par l’opérateur, l’ancien n’étant écrasé qu’après l’installation réussie du nouveau au chemin canonique ; <em>Supprimer</em> retire le fichier de l’hôte. À côté figure le contrôle du dépôt de récupération : un choix Oui/Non pour <em>Déposer la clé sur PBS ?</em>, un champ de phrase secrète si Oui est choisi et un bouton d’application contextuel indiquant <em>Démarrer l’envoi</em>, <em>Arrêter l’envoi</em> ou <em>Modifier la phrase secrète</em>. Chaque action utilise les mêmes points d’accès Flask que l’interface de terminal : l’effet sur disque et l’état sur PBS sont donc identiques depuis les deux interfaces."
+  },
+  "restoreAccess": {
+    "heading": "Récupération du côté restauration",
+    "body": "La restauration repère les sauvegardes d’hôte ProxMenux sur PBS en listant les groupes du dépôt configuré puis en filtrant leur identifiant. L’onglet Sauvegardes du moniteur affiche la même liste. Choisir une sauvegarde lance <code>proxmox-backup-client restore</code> avec le même dépôt, mot de passe et empreinte, ainsi que <code>--keyfile</code> si elle est chiffrée. L’archive <code>.pxar</code> est extraite dans un répertoire de préparation que <code>_rs_check_layout</code> transmet au processus de restauration standard. Hors de ProxMenux, la même commande extrait l’archive à l’emplacement souhaité pour examiner l’arborescence ou effectuer une restauration manuelle."
+  },
+  "references": {
+    "heading": "Références",
+    "intro": "Documentation officielle de Proxmox Backup Server pour les composants utilisés par ProxMenux.",
+    "items": [
+      {
+        "label": "Documentation Proxmox Backup Server",
+        "href": "https://pbs.proxmox.com/docs/",
+        "tail": "— point d'entrée principal couvrant l'installation, l'administration, le stockage, les utilisateurs et les rôles."
+      },
+      {
+        "label": "proxmox-backup-client",
+        "href": "https://pbs.proxmox.com/docs/backup-client.html",
+        "tail": " — l’outil en ligne de commande appelé par ProxMenux pour chaque sauvegarde et restauration. Décrit les identifiants et types de sauvegarde, les archives, la syntaxe des dépôts et les variables d’environnement."
+      },
+      {
+        "label": "Chiffrement côté client",
+        "href": "https://pbs.proxmox.com/docs/backup-client.html#encryption",
+        "tail": " — création du fichier clé, modes --kdf et modèle de chiffrement que ProxMenux complète par une copie de récupération protégée par une phrase secrète."
+      },
+      {
+        "label": "Gestion des Datastore",
+        "href": "https://pbs.proxmox.com/docs/storage.html",
+        "tail": " — création et gestion des datastores qui reçoivent les sauvegardes d’hôte, avec la structure du stockage des blocs et les permissions."
+      },
+      {
+        "label": "Élagage des sauvegardes et récupération d’espace",
+        "href": "https://pbs.proxmox.com/docs/maintenance.html#pruning",
+        "tail": " — le modèle de rétention de --keep-last / --keep-daily / --keep-weekly que ProxMenux applique par tâche planifiée, et la récupération des blocs inutilisés par PBS après l’élagage."
+      }
+    ]
+  }
+}
diff --git a/web/messages/fr/docs/backup-restore/glossary.json b/web/messages/fr/docs/backup-restore/glossary.json
new file mode 100644
index 00000000..f99080d9
--- /dev/null
+++ b/web/messages/fr/docs/backup-restore/glossary.json
@@ -0,0 +1,230 @@
+{
+  "meta": {
+    "title": "Glossaire — Sauvegarde et restauration ProxMenux",
+    "description": "Glossaire des termes et définitions de la pile de sauvegarde et de restauration ProxMenux: chiffrement, fichier de clés, mots de passe, enveloppe de récupération, PBS, morceaux, rootfs, manifeste, hydratation coureur et cross-kernel.",
+    "ogTitle": "Glossaire de la sauvegarde et de la restauration | ProxMenux",
+    "ogDescription": "Définitions claires des termes utilisés dans la documentation de sauvegarde et de restauration ProxMenux.",
+    "twitterTitle": "Glossaire de la sauvegarde et de la restauration | ProxMenux",
+    "twitterDescription": "Phrase de passe, fichier clé, enveloppe de récupération, rootfs, manifeste, PBS, morceaux — tous définis en un seul endroit."
+  },
+  "header": {
+    "title": "Glossaire",
+    "description": "Termes utilisés dans la documentation de sauvegarde et de restauration, avec leur définition.",
+    "section": "Sauvegarde et restauration"
+  },
+  "intro": {
+    "body": "Les termes sont regroupés par thème. Chaque entrée donne le terme et une courte définition."
+  },
+  "groups": [
+    {
+      "title": "Chiffrement et récupération des clés",
+      "intro": "Vocabulaire pour le bloc de chiffrement PBS. Il implique deux secrets distincts: un fichier de clés binaires et une phrase de passe écrite.",
+      "entries": [
+        {
+          "id": "passphrase-recuperacion",
+          "term": "Phrase secrète de récupération",
+          "def": "Mot de passe texte choisi par l'utilisateur pour protéger l’<a href=\"#sobre-recuperacion\">enveloppe de récupération</a>. Il est demandé deux fois avec une vérification de correspondance, et n'est utilisé que pour chiffrer l'enveloppe et la déchiffrer si le fichier clé a besoin d'être récupéré. <strong>Ce n'est pas la phrase de passe qui déverrouille le fichier clé lui-même</strong>, et il n'est jamais envoyé à PBS. Pendant une sauvegarde normale, il ne quitte jamais l'hôte."
+        },
+        {
+          "id": "clave-cifrado",
+          "term": "Fichier-clé (clé de chiffrement)",
+          "def": "Fichier de clé utilisé par proxmox-backup-client pour chiffrer les <a href=\"#chunk\">blocs</a> avant leur envoi à PBS. Sans la clé correspondante, les données chiffrées sont illisibles. ProxMenux le stocke dans <code>/usr/local/share/proxmenux/pbs-key.conf</code> avec le mode <code>600</code>. Protégez-le : l’<a href=\"#sobre-recuperacion\">enveloppe de récupération</a> permet de le récupérer en cas de perte."
+        },
+        {
+          "id": "contrasena-keyfile",
+          "term": "Phrase de passe du fichier clé (phrase de passe KDF)",
+          "def": "Phrase de passe optionnelle que le fichier clé lui-même peut porter, distincte de la <a href=\"#passphrase-recuperacion\">phrase de passe de récupération</a>. Il n'existe que lorsque le fichier clé a été créé avec <code>--kdf scrypt</code> (généralement un fichier clé importé). Sans cela, le fichier clé ne peut pas être déverrouillé pour utilisation. ProxMenux le maintient sous forme chiffrée sur l'hôte afin que les sauvegardes programmées puissent fonctionner sans une demande interactive."
+        },
+        {
+          "id": "sobre-recuperacion",
+          "term": "Enveloppe de récupération",
+          "def": "Le fichier <a href=\"#clave-cifrado\">keyfile</a> enveloppé dans une couche supplémentaire: il est crypté avec la <a href=\"#passphrase-recuperacion\">phrase de passe de récupération</a> utilisant <a href=\"#aes-256-cbc\">AES-256-CBC</a> et <a href=\"#pbkdf2\">PBKDF2</a> avant de quitter l'hôte. C'est ce qui est téléchargé sur PBS en tant que groupe <code>-keyrecovery</code>. Sans la phrase de passe, l'enveloppe est opaque : le téléchargement de PBS ne révèle pas le fichier de clés."
+        },
+        {
+          "id": "cifrado-cliente",
+          "term": "Chiffrement côté client",
+          "def": "Modèle de chiffrement dans lequel les données sont chiffrées sur l'hôte source avant d'être téléchargées. PBS ne reçoit et stocke que du texte codé; même un administrateur PBS avec accès datastore ne peut pas le lire sans le fichier clé. ProxMenux s'appuie sur ce modèle et ajoute l’<a href=\"#sobre-recuperacion\">enveloppe de récupération</a> sur le dessus."
+        },
+        {
+          "id": "kdf-none",
+          "term": "--kdf none",
+          "def": "Option de <code>proxmox-backup-client key create</code> qui produit un fichier de clés sans phrase de passe jointe. Le fichier de clés peut être utilisé directement sans une prompte, ce qui est essentiel pour les travaux programmés qui ne sont pas surveillés. C'est ce que ProxMenux utilise par défaut lors de la génération d'un nouveau fichier clé."
+        },
+        {
+          "id": "kdf-scrypt",
+          "term": "--kdf scrypt",
+          "def": "Option pour <code>proxmox-backup-client key create</code> qui produit un fichier clé protégé par une <a href=\"#contrasena-keyfile\">phrase de passe du fichier de clé</a>. Chaque utilisation du fichier clé nécessite de le déverrouiller avec cette phrase de passe. ProxMenux accepte ce style de keyfile sur l'importation et stocke la phrase de passe cryptée afin que les sauvegardes programmées puissent toujours fonctionner sans surveillance."
+        },
+        {
+          "id": "aes-256-cbc",
+          "term": "AES-256-CBC",
+          "def": "Chiffrement symétrique standard. ProxMenux l’utilise via <code>openssl enc -aes-256-cbc</code> pour protéger le <a href=\"#clave-cifrado\">fichier de clé</a> avec la <a href=\"#passphrase-recuperacion\">phrase de passe de récupération</a> et produire l’<a href=\"#sobre-recuperacion\">enveloppe</a>."
+        },
+        {
+          "id": "pbkdf2",
+          "term": "PBKDF2",
+          "def": "Fonction cryptographique qui transforme une phrase de passe de type humain en une clé binaire adaptée au chiffrement. Il ralentit les tentatives de force brute en appliquant de nombreuses itérations. ProxMenux l'utilise avec des itérations 600 000 et un sel aléatoire lors du chiffrement de l'enveloppe de récupération."
+        }
+      ]
+    },
+    {
+      "title": "Structure de sauvegarde",
+      "intro": "Termes décrivant ce qui vit dans une sauvegarde, quelle que soit la destination.",
+      "entries": [
+        {
+          "id": "rootfs",
+          "term": "rootfs / système de fichiers racine",
+          "def": "Copie des fichiers de l’hôte source réalisée par <code>rsync</code> selon le <a href=\"#perfil-defecto\">profil par défaut</a> et les <a href=\"#rutas-personalizadas\">chemins personnalisés</a>. Ce n’est pas une image de disque complet : seuls sont copiés les chemins contenant la configuration ou l’état que Proxmox ne peut pas recréer seul."
+        },
+        {
+          "id": "manifiesto",
+          "term": "Manifeste (manifest.json)",
+          "def": "Document structuré JSON décrivant l'hôte source au moment de la sauvegarde : matériel, stockage, noyau, composants installés par ProxMenux et inventaire des VM et des LXC. Il est produit par six collecteurs indépendants. Le flux de restauration l'utilise pour comparer la source et la cible."
+        },
+        {
+          "id": "staging",
+          "term": "Répertoire de préparation",
+          "def": "Répertoire temporaire où ProxMenux assemble les trois blocs (rootfs, métadonnées et manifeste) avant de les emballer et de les télécharger vers la destination. Il est supprimé automatiquement lorsque la sauvegarde se termine, même sur avorter."
+        },
+        {
+          "id": "perfil-defecto",
+          "term": "Profil par défaut",
+          "def": "Ensemble sélectionné de chemins copiés par défaut dans chaque sauvegarde : configuration PVE, réseau, SSH, noyau, apt, outils ProxMenux et plus encore. Défini dans le code et documenté sur la page <em>Comment ça marche</em>."
+        },
+        {
+          "id": "rutas-personalizadas",
+          "term": "Chemins personnalisés",
+          "def": "Les chemins supplémentaires que l'utilisateur ajoute au dessus du <a href=\"#perfil-defecto\">profil par défaut</a>. Soit persistante (conservée en <code>backup-extra-paths.txt</code>) soit per-run (en mode personnalisé)."
+        }
+      ]
+    },
+    {
+      "title": "Destinations et stockage",
+      "intro": "Termes liés à l'emplacement de la sauvegarde — serveur PBS, archive locale ou dépôt Borg — et comment PBS organise les données.",
+      "entries": [
+        {
+          "id": "repositorio-pbs",
+          "term": "Dépôt PBS",
+          "def": "Combinaison de Proxmox Backup Server + <a href=\"#datastore\">datastore</a> + utilisateur qui reçoit la sauvegarde. Identifié par la chaîne <code>user@realm@host:datastore</code>. Un seul serveur PBS peut héberger plusieurs dépôts."
+        },
+        {
+          "id": "datastore",
+          "term": "Banque de données",
+          "def": "Espace de stockage précis dans un serveur PBS contenant les sauvegardes et leurs blocs. Chaque datastore repose sur un système de fichiers du serveur PBS avec ses propres permissions et politiques."
+        },
+        {
+          "id": "chunk",
+          "term": "Bloc (chunk) / déduplication par blocs",
+          "def": "PBS divise chaque sauvegarde en morceaux de taille variable, identifie chaque morceau par son hachage et ne stocke chaque morceau qu'une seule fois, même s'il apparaît dans de nombreuses sauvegardes différentes. Cela signifie que les sauvegardes successives d'un même hôte — ou d'un hôte similaire — prennent très peu d'espace supplémentaire."
+        },
+        {
+          "id": "fingerprint",
+          "term": "Empreinte",
+          "def": "Empreinte cryptographique du certificat du serveur PBS TLS Il permet au client de vérifier qu'il parle au serveur prévu sans compter sur une autorité de certification publique. ProxMenux le transmet à <code>proxmox-backup-client</code> via la variable d'environnement <code>PBS_FINGERPRINT</code>."
+        },
+        {
+          "id": "grupo-copia",
+          "term": "Groupe de sauvegarde",
+          "def": "Conteneur logique à l'intérieur de PBS sous lequel les sauvegardes successives du même actif s'accumulent. Chaque nouvelle sauvegarde partage la déduplication avec les précédentes dans le même groupe. ProxMenux utilise deux groupes par hôte lorsque le chiffrement est activé : un pour la sauvegarde de l'hôte et un avec un suffixe <code>-keyrecovery</code> pour l’<a href=\"#sobre-recuperacion\">enveloppe de récupération</a>."
+        },
+        {
+          "id": "backup-id",
+          "term": "ID de sauvegarde",
+          "def": "Nom du groupe <a href=\"#grupo-copia\">backup</a>. ProxMenux par défaut sur <code>hostcfg-HOSTNAME</code> et permet à l'utilisateur de l'éditer avant le téléchargement; les caractères non pris en charge sont supprimés automatiquement."
+        },
+        {
+          "id": "pxar",
+          "term": ".pxar",
+          "def": "Format d'archive native PBS pour les répertoires. Il se comporte comme un tar optimisé pour la déduplication des morceaux : au lieu de stocker un fichier opaque, PBS brise son contenu en morceaux réutilisables."
+        }
+      ]
+    },
+    {
+      "title": "Exécution et calendrier",
+      "intro": "Termes utilisés par le système ProxMenux emploi programmé.",
+      "entries": [
+        {
+          "id": "runner",
+          "term": "Processus d'exécution",
+          "def": "Le script <code>run_scheduled_backup.sh</code> qui exécute une sauvegarde programmée. Il lit la configuration du travail, lance le moteur correspondant (Local, PBS ou Borg), applique la conservation sur le succès et envoie les notifications configurées."
+        },
+        {
+          "id": "trabajo-programado",
+          "term": "Tâche planifiée",
+          "def": "Configuration permanente d'une sauvegarde récurrente. Tient destination, identifiants, chiffrement, calendrier et conservation. Vit à <code>/var/lib/proxmenux/backup-jobs/&lt;id&gt;.env</code>."
+        },
+        {
+          "id": "modo-adjunto",
+          "term": "Mode rattaché",
+          "def": "Tâche sans timer propre. Un hook job-end de PVE <code>vzdump</code> la déclenche après les sauvegardes des invités si le stockage correspond. La tâche parent fournit la destination et la conservation, relue depuis la tâche parent à chaque exécution, mais le hook compare le stockage, pas l’ID parent. Une autre tâche sur ce stockage peut aussi la déclencher. Uniquement Local et PBS."
+        },
+        {
+          "id": "timer-systemd",
+          "term": "Systemd minuterie",
+          "def": "Mécanisme standard systemd qui déclenche une commande sur un calendrier. ProxMenux crée une minuterie par <em>indépendant</em> emploi programmé; <a href=\"#modo-adjunto\"> mode rattaché</a> emplois n'utilisent pas de minuterie, ils fonctionnent via le script PVE-hook."
+        },
+        {
+          "id": "retencion",
+          "term": "Conservation (keep-last, keep-daily…)",
+          "def": "Politique qui décide quelles sauvegardes plus anciennes à conserver et à pruner. Défini par travail avec des paramètres comme <code>keep-last</code>, <code>keep-daily</code>, <code>keep-weekly</code>, <code>keep-monthly</code>. Appliquée par le processus d’exécution après chaque sauvegarde réussie."
+        }
+      ]
+    },
+    {
+      "title": "Restaurer",
+      "intro": "Termes du flux de restauration.",
+      "entries": [
+        {
+          "id": "restauracion-universal",
+          "term": "Restauration universelle",
+          "def": "Le flux de restauration ProxMenux n'extrait pas seulement le système de fichiers : il lit le manifeste pour repérer les différences entre la source et la cible, reproduit la configuration du système et réexécute les installateurs des composants gérés par ProxMenux. Le but est de reproduire l'hôte source, pas seulement l'archive."
+        },
+        {
+          "id": "hidratacion",
+          "term": "Hydratation entre versions du noyau",
+          "def": "Étape de restauration qui fusionne les réglages de l’utilisateur depuis la source (paramètres IOMMU, ID VFIO, particularités et clés GRUB) avec la configuration de démarrage neuve de la cible, sans recopier tels quels les fichiers liés au noyau source. S’exécute si le noyau cible est plus récent que celui de la sauvegarde."
+        },
+        {
+          "id": "cross-kernel",
+          "term": "Restaurer le cross-kernel",
+          "def": "Restaurer où le noyau de la cible diffère de (habituellement est plus récent que) celui de la source. Nécessite le passage <a href=\"#hidratacion\">hydration</a> pour éviter de traîner le long de fichiers incompatibles avec le noyau de la cible."
+        },
+        {
+          "id": "instalador-postboot",
+          "term": "Installation après démarrage",
+          "def": "Composants réinstallés après le premier démarrage de l'hôte restauré (drivers NVIDIA, drivers Coral TPU, outils AMD GPU, outils Intel GPU). Chaque installateur fonctionne contre le noyau de la cible, de sorte que l'hôte restauré ne dépend pas de la présence du noyau de la source."
+        },
+        {
+          "id": "compatibility-check",
+          "term": "Vérification de compatibilité",
+          "def": "Comparaison entre le manifeste source et l'état de la cible que ProxMenux effectue au début de la restauration. Il décide quelles parties sont copiées mot à mot, qui ont besoin d'hydratation et qui sont recréées par un installateur."
+        },
+        {
+          "id": "equipo-recien-instalado",
+          "term": "Installation fraîche",
+          "def": "Hôte juste réinstallé à partir de zéro, sans fichier local <a href=\"#clave-cifrado\">key</a>. La restauration d'une sauvegarde chiffrée nécessite d'abord la récupération du fichier clé à partir de l’<a href=\"#sobre-recuperacion\">enveloppe</a> stockée sur PBS, en utilisant la phrase de passe <a href=\"#passphrase-recuperacion\">de récupération</a>."
+        }
+      ]
+    }
+  ],
+  "whereNext": {
+    "heading": "Où après",
+    "items": [
+      {
+        "label": "Comment ça marche",
+        "href": "/docs/backup-restore/how-it-works",
+        "tail": " — où se placent rootfs, le manifeste et l’inventaire des applications dans une sauvegarde."
+      },
+      {
+        "label": "Destination Proxmox Backup Server",
+        "href": "/docs/backup-restore/destinations/pbs",
+        "tail": "— où le cryptage côté client, le fichier clé, la phrase de récupération et l'enveloppe sont documentés en profondeur."
+      },
+      {
+        "label": "Restauration",
+        "href": "/docs/backup-restore/restoring",
+        "tail": " — procédure de restauration et utilisation du manifeste."
+      }
+    ]
+  }
+}
diff --git a/web/messages/fr/docs/backup-restore/how-it-works.json b/web/messages/fr/docs/backup-restore/how-it-works.json
new file mode 100644
index 00000000..aba3a5f8
--- /dev/null
+++ b/web/messages/fr/docs/backup-restore/how-it-works.json
@@ -0,0 +1,205 @@
+{
+  "meta": {
+    "title": "Comment ProxMenux Sauvegarde fonctionne en interne — rootfs, manifeste, applications",
+    "description": "Description détaillée de ce qu'une sauvegarde ProxMenux contient : les rootfs produits par rsync du profil de chemin par défaut, le manifeste structuré construit par six collecteurs indépendants, et l'inventaire d'applications qui entraîne la réinstallation automatique des paquets et des composants après une restauration.",
+    "ogTitle": "Comment la sauvegarde ProxMenux fonctionne en interne",
+    "ogDescription": "Les trois parties d’une sauvegarde ProxMenux : rootfs, manifeste et applications.",
+    "twitterTitle": "Fonctionnement des sauvegardes ProxMenux | ProxMenux",
+    "twitterDescription": "Les trois charges utiles d'une sauvegarde ProxMenux et comment la restauration reproduit l'hôte source à partir d'eux."
+  },
+  "header": {
+    "title": "Comment ça marche",
+    "description": "La structure interne d’une sauvegarde ProxMenux — système de fichiers, manifeste et inventaire des applications — et leur utilisation pour recréer l’hôte source sur une destination dont le noyau peut être différent.",
+    "section": "Sauvegarde et restauration"
+  },
+  "intro": {
+    "title": "Une archive, trois charges utiles",
+    "body": "Chaque sauvegarde crée trois parties bien définies dans un même répertoire de préparation. L’archive envoyée à la destination (<code>.tar.zst</code> local, sauvegarde PBS ou archive Borg) conserve cette structure. La restauration utilise les trois : <strong>le manifeste</strong> est consulté avant toute modification pour détecter les différences et déterminer les exclusions ; <strong>rootfs</strong> fournit les fichiers de configuration, appliqués à chaud ou après redémarrage ; <strong>l’inventaire des applications</strong> guide l’installation des paquets et la réinstallation des composants après démarrage. Chaque partie peut être examinée ou extraite indépendamment."
+  },
+  "layout": {
+    "heading": "Mise en page des archives",
+    "intro": "Chaque archive suit la même disposition de l'arbre, quelle que soit la destination. Le sous-répertoire <code>metadata/</code> détient les charges utiles structurées; le sous-répertoire <code>rootfs/</code> détient la copie du système de fichiers.",
+    "treeCaption": "Le répertoire de mise en scène a été établi lors d'une sauvegarde. Chaque destination reçoit le même arbre (adapté à son format natif: tar pour local, PBS morceaux pour PBS, segments borg pour Borg).",
+    "tree": "backup-[timestamp]/\n├── manifest.json                  # structured host state\n├── metadata/\n│   ├── packages.manual.list       # apt-mark showmanual\n│   ├── run_info.env               # backup run identity + kernel version + pmxcfs method\n│   ├── paths_archived.txt         # exact list of paths that reached rootfs/\n│   └── missing_paths.txt          # paths from the profile absent on source\n└── rootfs/\n    ├── etc/                       # /etc/pve, /etc/network, /etc/systemd/network, /etc/ssh, …\n    ├── root/                      # /root (with volatile subdirs excluded)\n    ├── usr/local/                 # /usr/local/bin, /usr/local/share/proxmenux, …\n    └── var/                       # /var/lib/pve-cluster (config.db via sqlite3 .backup), /var/spool/cron/…"
+  },
+  "rootfs": {
+    "heading": "La partie rootfs",
+    "intro": "L’arborescence <code>rootfs/</code> est une <strong>simple copie du système de fichiers</strong>, créée par <code>rsync</code> depuis l’hôte source. Elle contient un <strong>profil par défaut</strong> sélectionnant les chemins nécessaires à une restauration Proxmox, ainsi que les <strong>chemins personnalisés</strong> ajoutés à la tâche ou à la session interactive. La sélection est volontairement limitée aux chemins qui <em>contiennent de la configuration</em> ou <em>conservent un état que Proxmox ne peut pas recréer seul</em>.",
+    "defaultProfileTitle": "Le profil par défaut",
+    "defaultProfileBody": "Le profil par défaut est défini par <code>hb_default_profile_paths</code> dans <code>lib_host_backup_common.sh</code>. Il couvre huit catégories fixes, plus l’état ZFS si nécessaire, qui décrivent ensemble un hôte Proxmox fonctionnel :",
+    "categoriesTitle": "Catégories de chemins",
+    "categoryRows": [
+      {
+        "category": "Noyau PVE",
+        "paths": "/etc/pve, /var/lib/pve-cluster, /etc/vzdump.conf",
+        "why": "Contenus du système de fichiers cluster et vzdump par défaut. La base de données pmxcfs (<code>config.db</code>) est capturée comme un instantané cohérent via <code>sqlite3 .backup</code> sans arrêter le cluster, et les sidecars <code>.db-wal</code> / <code>.db-shm</code> sont exclus du rsync. Lorsque <code>sqlite3</code> n'est pas disponible, un fichier <code>config.db.raw-fallback</code> est créé puis utilisé automatiquement comme base lors de la restauration."
+      },
+      {
+        "category": "Identité de l'hôte & réseau",
+        "paths": "/etc/hostname, /etc/hosts, /etc/timezone, /etc/resolv.conf, /etc/network, /etc/systemd/network",
+        "why": "Les éléments nécessaires pour retrouver le réseau avec la même identité. Les fichiers <code>.link</code> dans <code>/etc/systemd/network</code> associent le nom des interfaces à leur adresse MAC, afin de conserver les noms lors des réinstallations et des changements matériels."
+      },
+      {
+        "category": "Accès et authentification",
+        "paths": "/etc/ssh, /etc/sudoers, /etc/sudoers.d, /etc/pam.d, /etc/security",
+        "why": "Clés SSH, règles sudo et configuration PAM. Les perdre peut empêcher l’utilisateur d’accéder à l’hôte restauré."
+      },
+      {
+        "category": "Noyau et démarrage",
+        "paths": "/etc/default/grub, /etc/kernel, /etc/modules, /etc/modules-load.d, /etc/modprobe.d, /etc/sysctl.conf, /etc/sysctl.d, /etc/udev/rules.d, /etc/fstab, /etc/iscsi, /etc/multipath",
+        "why": "IOMMU jetons, listes noires de module, ID de périphérique VFIO, table de montage, configuration de la pile de stockage."
+      },
+      {
+        "category": "Shell et paramètres régionaux",
+        "paths": "/etc/environment, /etc/bash.bashrc, /etc/inputrc, /etc/profile, /etc/profile.d, /etc/locale.gen, /etc/locale.conf",
+        "why": "Configuration shell à l'échelle du système, variables d'environnement, configuration de génération locale."
+      },
+      {
+        "category": "Gestion des paquets et cron",
+        "paths": "/etc/apt, /etc/cron.d, /etc/cron.{daily,hourly,weekly,monthly}, /etc/cron.allow, /etc/cron.deny, /var/spool/cron/crontabs",
+        "why": "Sources APT pour une résolution de paquets cohérente, tâches programmées définies par l'utilisateur."
+      },
+      {
+        "category": "État et outils ProxMenux",
+        "paths": "/etc/proxmenux, /etc/systemd/system, /etc/log2ram.conf, /etc/logrotate.conf, /etc/logrotate.d, /etc/lm-sensors, /etc/sensors3.conf, /etc/fail2ban, /etc/snmp, /etc/postfix, /etc/wireguard, /etc/openvpn, /etc/grafana, /etc/influxdb, /etc/prometheus, /etc/telegraf, /etc/zabbix",
+        "why": "Outillage facultatif mais courant Proxmox. Les chemins manquants sont notés dans <code>metadata/missing_paths.txt</code> sans arrêter la sauvegarde."
+      },
+      {
+        "category": "Exécutables ProxMenux et compte root",
+        "paths": "/usr/local/bin, /usr/local/sbin, /usr/local/share/proxmenux, /var/lib/proxmenux, /root (sous-dirs volatils exclus)",
+        "why": "Les binaires installés par ProxMenux et la configuration par utilisateur sous <code>/root</code>. Les chemins volatils (<code>.bash_history</code>, <code>.cache/</code>, <code>tmp/</code>, <code>.local/share/Trash/</code>) sont exclus de la copie. <code>/var/lib/proxmenux</code> détient les tâches de sauvegarde programmées et l'état de l'hôte conservé par ProxMenux; la mise en scène de restauration, les copies de retour et les marqueurs post-restauration sont exclus, parce qu'ils appartiennent à l'hôte qui exécute une restauration."
+      },
+      {
+        "category": "État ZFS (conditionnel)",
+        "paths": "/etc/zfs",
+        "why": "Seulement inclus lorsque l'hôte source exécute ZFS. Contient <code>zpool.cache</code> et <code>hostid</code>."
+      }
+    ],
+    "customTitle": "Extension du profil avec des chemins personnalisés",
+    "customBody": "Au-delà du profil par défaut, ProxMenux offre deux façons d'inclure des chemins supplémentaires dans une sauvegarde. Ils composent sans conflit et s'appliquent à la fois aux sauvegardes interactives et aux emplois programmés.",
+    "customExtrasTitle": "1. Extras persistants (fichier par hôte)",
+    "customExtrasBody": "Un fichier texte à <code>/usr/local/share/proxmenux/backup-extra-paths.txt</code> contient une liste de chemins absolus que l'utilisateur a marqués comme « toujours inclure » sur cet hôte. Lorsqu'une sauvegarde fonctionne en mode <strong>Default</strong>, ProxMenux ajoute ces chemins au profil par défaut automatiquement sans demander. Le fichier est édité à partir de l'interface — pas d'édition manuelle nécessaire — et persiste à travers les reboots et les mises à jour. Un chemin absolu par ligne ; les commentaires <code>#</code> sont autorisés.",
+    "customModeTitle": "2. Mode personnalisé (par exécution)",
+    "customModeBody": "Lancer une sauvegarde en mode <strong>Custom</strong> remplace l'application automatique du profil par défaut par une liste de contrôle montrant chaque chemin : les entrées par défaut du profil et les extras persistants (préfixés avec <code>[+]</code> et pré-cochés). L'utilisateur coche ou désactive les entrées pour cette exécution spécifique, et peut également appuyer sur <em>Ajouter un chemin personnalisé</em> pour entrer un nouveau chemin — qui est ensuite maintenu dans le fichier extras pour les futures sauvegardes.",
+    "customMissingTitle": "Voies absentes de la source",
+    "customMissingBody": "Tout chemin du profil (par défaut ou ajouté) qui n'existe pas sur l'hôte source est enregistré dans <code>metadata/missing_paths.txt</code> à l'intérieur de l'archive. La sauvegarde n’échoue ni ne s'arrête — l'utilisateur voit un résumé des chemins archivés et des chemins manquants à la fin. En pratique, cela se produit pour les chemins optionnels d'outillage comme <code>/etc/wireguard</code> ou <code>/etc/prometheus</code> lorsque ces outils ne sont pas installés."
+  },
+  "manifest": {
+    "heading": "La partie manifeste",
+    "intro": "<code>manifest.json</code> est un document structuré JSON qui décrit l'hôte source au moment de la sauvegarde. Il est produit par <strong>six modules de collecte indépendants</strong> orchestrés par <code>build_manifest.sh</code>. Chaque collecteur est en lecture seule, produit un fragment JSON bien défini, et revient à une valeur par défaut vide s'il échoue – le manifeste est toujours utilisable si une section est incomplète.",
+    "orchestratorCaption": "Les six modules de collecte composent le manifeste. Chaque collecteur fonctionne dans son propre sous-processus; une défaillance d'un seul tombe à un défaut de sécurité documenté et avertit mais n'interrompt pas la sauvegarde.",
+    "collectorRows": [
+      {
+        "collector": "collect_source_host.sh",
+        "produces": "source_host",
+        "content": "Nom d'hôte, version PVE (<code>pveversion</code>), version PBS si l'hôte exécute le rôle de serveur de sauvegarde, noyau (<code>uname -r</code>), mode de démarrage (efi/bios), type de système de fichiers racine, modèle CPU + architecture, mémoire en KB."
+      },
+      {
+        "collector": "collect_hardware.sh",
+        "produces": "hardware_inventory",
+        "content": "GPU avec fabricant et correspondance avec l’installateur ProxMenux ; TPU Coral USB et M.2 détectés par <code>lsusb</code>/<code>lspci</code> ; interfaces réseau avec MAC, emplacement PCI et appartenance à un pont ; périphériques sans fil. Les entrées GPU comprennent l’heuristique <code>passthrough_eligible</code>."
+      },
+      {
+        "collector": "collect_storage.sh",
+        "produces": "storage_inventory",
+        "content": "ZFS pools (avec pool type + disques membres résolus à <code>/dev/disk/by-id/*</code>, <code>/dev/disk/by-partuuid/*</code> ou crus <code>/dev/sdX</code> chemins en fonction de la façon dont chaque pool a été créé à l'origine), LVM Groupes de volume + mince pools, disques physiques avec SMART capacité, PVE <code>storage.cfg</code> entrées, montages externes."
+      },
+      {
+        "collector": "collect_kernel.sh",
+        "produces": "kernel_params",
+        "content": "Paramètres ajoutés par l’opérateur dans <code>/proc/cmdline</code>, sans les éléments standard comme <code>BOOT_IMAGE=</code>, <code>root=</code>, <code>ro/rw</code>, <code>quiet</code> et <code>splash</code> ; modules chargés au démarrage depuis <code>/etc/modules</code> ; chemins des fichiers <code>/etc/modprobe.d/*.conf</code> contenant des directives effectives (<code>options</code>, <code>blacklist</code>, <code>install</code>, <code>alias</code>, <code>softdep</code>)."
+      },
+      {
+        "collector": "collect_proxmenux_state.sh",
+        "produces": "proxmenux_installed_components",
+        "content": "Lire <code>/usr/local/share/proxmenux/managed_installs.json</code> (enregistrement de tout ce que ProxMenux a installé) et <code>installed_tools.json</code>. Chaque entrée conserve le chemin d'installation (<code>menu_script</code>) afin que la restauration puisse déclencher le même flux d'installation."
+      },
+      {
+        "collector": "collect_guests.sh",
+        "produces": "vms_lxcs_at_backup",
+        "content": "Énumère les VM (<code>qm list</code>) et les LXC (<code>pct list</code>) présents au moment de la sauvegarde — VMID, nom, état actuel. Seul l'inventaire : les données des invités sont sous la responsabilité de <code>vzdump</code> / PBS."
+      }
+    ],
+    "schemaTitle": "Validation du schéma",
+    "schemaBody": "Le manifeste valide contre <code>scripts/backup_restore/schema/manifest.schema.json</code>. L'exécution du <code>build_manifest.sh --validate</code> déclenche une validation de schéma côté Python JSON (exige <code>python3</code> + <code>jsonschema</code>). Si le module n'est pas présent, la vérification est ignorée silencieusement — la validation est principalement une aide au développeur, et non une dépendance à l'exécution."
+  },
+  "applications": {
+    "heading": "L'inventaire des applications",
+    "intro": "Deux inventaires recensent les logiciels ajoutés aux paquets de base Proxmox VE : la liste des paquets dans <code>metadata/</code> et le registre des composants dans rootfs, détaillés ci-dessous. La restauration les utilise pour réinstaller les logiciels de l’utilisateur avec APT ou les installateurs ProxMenux selon leur mode d’installation initial.",
+    "packagesTitle": "packages.manual.list",
+    "packagesBody": "Une liste alphabétique en texte brut produite par <code>apt-mark showmanual</code>, avec les paquets APT <em>explicitement installés</em> sur l’hôte source. Les dépendances du système Proxmox VE de base sont exclues ; APT les réinstalle automatiquement sur la destination. Lors de la restauration, <code>_rs_run_complete_extras</code> lit la liste et applique un <em>filtre contre les suppressions en cascade</em> en trois passes : <code>dpkg -s</code> repère les paquets déjà installés, la détection des autres versions majeures vise les bibliothèques, et <code>apt-get install --simulate</code> vérifie le risque de suppression en cascade. Les paquets retenus sont installés avec <code>apt-get install -y</code>.",
+    "componentsTitle": "components_status.json (dans rootfs)",
+    "componentsBody": "Un registre JSON sous <code>/usr/local/share/proxmenux/</code> qui enregistre chaque composant ProxMenux a installé avec son état exact : version, drapeaux spécifiques ProxMenux (pour NVIDIA : <code>patched</code> booléen ; pour Coral : DKMS version). Ce fichier vit à l'intérieur des rootfs — pas dans <code>metadata/</code> — parce que c'est <em>lu après</em> la copie de rootfs vers la cible. Le répartiteur post-démarrage (<code>apply_cluster_postboot.sh</code>) itère ses entrées et exécute le crochet <code>--auto-reinstall</code> de chaque composant, qui lit l'état enregistré et reproduit l'installation contre le noyau courant de la cible.",
+    "componentInstallersTitle": "Installateurs de composants",
+    "componentInstallersBody": "Quatre installateurs ProxMenux exposent actuellement un point d'entrée <code>--auto-reinstall</code> :",
+    "installerRows": [
+      {
+        "component": "nvidia_driver",
+        "installer": "gpu_tpu/nvidia_installer.sh",
+        "action": "Lire <code>version</code> + <code>patched</code>. Télécharge exactement le même fichier d'exécution NVIDIA, construit des modules DKMS contre le noyau de la cible, réapplique le patch ProxMenux si la source l'avait."
+      },
+      {
+        "component": "coral_driver",
+        "installer": "gpu_tpu/install_coral.sh",
+        "action": "Lire la version du pilote Coral. Compile le module DKMS contre le noyau de la cible."
+      },
+      {
+        "component": "amdgpu_top",
+        "installer": "gpu_tpu/amd_gpu_tools.sh",
+        "action": "Lis la version enregistrée. Re-télécharge le <code>.deb</code> exact de la version GitHub."
+      },
+      {
+        "component": "intel_gpu_tools",
+        "installer": "gpu_tpu/intel_gpu_tools.sh",
+        "action": "APT-installe le paquet. Idépotent si déjà présent à partir de <code>packages.manual.list</code>."
+      }
+    ]
+  },
+  "restoreFlow": {
+    "heading": "Comment la restauration consomme les trois charges utiles",
+    "intro": "La restauration est un pipeline en six étapes. Chaque étape lit un sous-ensemble spécifique de l'archive et met à jour l'hôte cible. Aucune étape n'exige que l'hôte source soit accessible — l'archive est entièrement autonome.",
+    "stagesCaption": "L’étape 1 consulte le manifeste pour déterminer les modifications possibles. L’étape 2 copie les chemins rootfs applicables à chaud. L’étape 3 prépare les chemins à risque pour le prochain démarrage. L’étape 3b importe les pools ZFS de données ne contenant pas la racine et dont tous les disques sont présents. L’étape 4 installe les paquets. L’étape 5 réinstalle les composants après redémarrage pour le noyau de la destination.",
+    "stageRows": [
+      {
+        "stage": "1",
+        "name": "Vérification de compatibilité",
+        "reads": "manifest.json",
+        "action": "Exécute <code>hb_compat_check</code>. Comparer le matériel source par rapport au matériel cible (NIC, ID de stockage), la version PVE et la version principale du noyau. Ensembles <code>HB_COMPAT_KERNEL_DIRECTION</code> (<code>same</code>, <code>bk_newer</code> ou <code>bk_older</code>) et peuple <code>RS_SKIP_PATHS</code> avec des exclusions à la dérive matérielle et aux différences de noyau."
+      },
+      {
+        "stage": "2",
+        "name": "Appliquer à chaud",
+        "reads": "rootfs/ (chemins sûrs seulement)",
+        "action": "<code>_rs_apply … hot</code> copie les entrées de <code>hb_classify_path</code>=<code>hot</code> directement à la cible en direct. Tout ce qui est sous <code>/etc/pve</code>, <code>/etc/network</code> ou des chemins classés comme <em>reboot</em>/<em>dangerous</em> est reporté."
+      },
+      {
+        "stage": "3",
+        "name": "En attente de préparation",
+        "reads": "rootfs/ (redémarrage + chemins dangereux)",
+        "action": "<code>_rs_prepare_pending_restore</code> prépare les chemins à risque dans <code>/var/lib/proxmenux/pending-restore/</code>, écrit <code>plan.env</code>, <code>apply-on-boot.list</code> et <code>rs-skip-paths.txt</code>, puis active <code>proxmenux-restore-onboot.service</code> pour le prochain démarrage."
+      },
+      {
+        "stage": "3b",
+        "name": "Importation des pools de données",
+        "reads": "manifest.storage_inventory + état ZFS de la destination",
+        "action": "<code>_rs_import_data_pools</code> tente d’importer chaque pool ZFS ne contenant pas la racine et dont tous les disques sont présents sur la destination. Avec un hostid étranger, l’importation est retentée avec <code>zpool import -f</code>. Si un disque manque, le pool est ignoré avec un avertissement. Le résultat par pool est enregistré dans <code>/var/log/proxmenux/restore-datapools-&lt;timestamp&gt;.log</code>."
+      },
+      {
+        "stage": "4",
+        "name": "Installation du paquet",
+        "reads": "metadata/packages.manual.list",
+        "action": "<code>_rs_run_complete_extras</code> exécute le filtre sans risque de cascade et appelle <code>apt-get install -y</code> avec la liste des paquets survivants. La sortie complète va à <code>/var/log/proxmenux/restore-apt-*.log</code>."
+      },
+      {
+        "stage": "5",
+        "name": "Après le démarrage",
+        "reads": "rootfs (déjà appliqué) + components_status.json",
+        "action": "Après le redémarrage, <code>apply_pending_restore.sh</code> rejoue les chemins différés et <code>apply_cluster_postboot.sh</code> exécute <code>update-initramfs</code>, <code>update-grub</code> (ou <code>proxmox-boot-tool refresh</code>) et itère sur <code>components_status.json</code> en tirant le crochet <code>--auto-reinstall</code> de chaque composant."
+      }
+    ]
+  },
+  "whyItWorks": {
+    "heading": "Pourquoi séparer la sauvegarde en trois parties",
+    "body": "La séparation suit le <strong>cycle de vie</strong> des données. Le système de fichiers est transféré avec <code>rsync</code> : rapidement, de façon transparente et atomique par fichier. L’état de configuration à interpréter avant toute modification est du <strong>JSON structuré</strong>, lisible indépendamment, versionnable par schéma et comparable automatiquement à l’état de la destination. Les logiciels à réinstaller sont décrits dans un <strong>inventaire</strong> de noms et versions ; le gestionnaire de paquets et les installateurs ProxMenux choisissent les binaires adaptés. Chaque partie répond à son besoin. Leur combinaison vise une restauration cohérente tout en tolérant les échecs : un manifeste corrompu laisse rootfs récupérable, un paquet manquant n’empêche pas l’installation des composants et l’échec d’un installateur sur une entrée n’arrête pas la suivante."
+  }
+}
diff --git a/web/messages/fr/docs/backup-restore/index.json b/web/messages/fr/docs/backup-restore/index.json
new file mode 100644
index 00000000..2b40cfc2
--- /dev/null
+++ b/web/messages/fr/docs/backup-restore/index.json
@@ -0,0 +1,93 @@
+{
+  "meta": {
+    "title": "ProxMenux Sauvegarde et restauration — Présentation | Sauvegarde et restauration complètes de l'hôte pour Proxmox VE",
+    "description": "La fonction de sauvegarde et de restauration de ProxMenux capture l'état complet d'un hôte Proxmox (système de fichiers, manifeste de configuration structuré et paquets/composants installés) et le reproduisent sur le même hôte ou sur un hôte différent. La sauvegarde et la restauration sont autonomes : aucune dépendance externe et les restaurations inter-noyaux sont prises en charge via un filtre de sous-ensemble sécurisé sensible à la direction et une hydratation indépendante du noyau.",
+    "ogTitle": "ProxMenux Sauvegarde et restauration – Présentation",
+    "ogDescription": "Sauvegarde et restauration complètes de l'hôte pour Proxmox VE avec manifeste structuré, liste de packages et réinstallateurs de composants.",
+    "twitterTitle": "ProxMenux Sauvegarde et restauration | ProxMenux",
+    "twitterDescription": "Sauvegarde et restauration complètes de l'hôte pour Proxmox VE avec manifeste structuré, liste de packages et réinstallateurs de composants."
+  },
+  "header": {
+    "title": "Sauvegarde et restauration",
+    "description": "Sauvegarde et restauration de l'hôte complet pour Proxmox VE. Capture le système de fichiers, la configuration et les composants installés dans une seule archive, et reproduit l'hôte sur la même installation Proxmox ou sur une autre installation Proxmox sans dépendances externes.",
+    "section": "Sauvegarde et restauration"
+  },
+  "intro": {
+    "title": "Qu'est-ce que c'est, en un seul paragraphe",
+    "body": "Une sauvegarde ProxMenux capture l’état complet d’un hôte Proxmox : <strong>le système de fichiers</strong>, avec les répertoires pertinents sous <code>/etc</code>, <code>/root</code> et <code>/var/lib/pve-cluster</code>, ainsi que les chemins personnalisés facultatifs ; <strong>un manifeste structuré</strong> en JSON décrivant le matériel détecté, les paramètres du noyau, la configuration réseau, l’état de ZFS, les utilisateurs et les entrées cron ; et <strong>un inventaire des applications</strong>, avec les paquets marqués comme installés manuellement par APT et les composants installés par ProxMenux, accompagnés de leurs versions exactes. Les trois destinations prises en charge — archive locale, Proxmox Backup Server (recommandé) et Borg — reçoivent le même contenu autonome. Chacune permet de reconstruire l’hôte cible sans que l’hôte source soit accessible pendant la restauration."
+  },
+  "video": {
+    "heading": "Présentation vidéo",
+    "intro": "Vous préférez regarder la sauvegarde et la restauration en action avant de la configurer ? Cette procédure pas à pas couvre une démonstration complète de bout en bout de la fonctionnalité dans ProxMenux.",
+    "title": "ProxMenux — Procédure pas à pas de sauvegarde et de restauration",
+    "caption": "Vidéo externe sur YouTube. Lecture en mode de confidentialité amélioré (pas de cookies jusqu'à ce que vous appuyiez sur play)."
+  },
+  "whatItIsNot": {
+    "heading": "Ce que ce n'est pas",
+    "intro": "Cette section couvre la sauvegarde et la restauration <strong>de l’hôte</strong> : l’installation Proxmox elle-même, et non les applications ou systèmes invités qui y fonctionnent.",
+    "items": [
+      "<strong>Ce n’est pas un outil de sauvegarde des VM/CT.</strong> Cette fonction ne capture ni les disques ni l’état de la RAM des invités ; c’est le rôle de <code>vzdump</code>. Les <strong>fichiers de configuration</strong> des invités (<code>/etc/pve/nodes/&lt;node&gt;/qemu-server/*.conf</code> et <code>lxc/*.conf</code>) sont <strong>bien</strong> sauvegardés. Après restauration, l’inventaire réapparaît et les disques peuvent être restaurés ou rattachés à partir d’une sauvegarde existante sur PBS ou en local.",
+      "<strong>Ce n’est pas une opération à l’échelle du cluster.</strong> Chaque nœud se sauvegarde lui-même. L’appartenance au cluster est enregistrée dans <code>/etc/pve</code> afin de pouvoir réintégrer un nœud restauré, mais la restauration de tout le cluster nécessite de coordonner les différents nœuds.",
+      "<strong>Ce n’est pas une image complète du disque.</strong> Les binaires du noyau, l’initramfs et la partition de démarrage ne sont pas sauvegardés. Lors de la restauration, ProxMenux utilise les fichiers de démarrage de l’hôte cible, régénérés automatiquement par <code>update-initramfs</code> et l’outil du chargeur d’amorçage, puis installe les pilotes adaptés au noyau en cours d’exécution sur la cible."
+    ]
+  },
+  "threePillars": {
+    "heading": "Les trois piliers d'une sauvegarde",
+    "intro": "Une archive ProxMenux est structurée autour de trois charges utiles autonomes. La restauration utilise les trois ensemble pour reproduire l'hôte source sur une cible sur laquelle le même noyau n'est peut-être même pas installé.",
+    "diagramCaption": "Chaque sauvegarde expédie les trois mêmes charges utiles, quelle que soit la destination. La restauration consomme les trois : rootfs pour déposer les fichiers, le manifeste pour détecter les dérives et les différences entre les noyaux, et l'inventaire des applications pour réinstaller les packages et les composants sur le propre noyau de la cible.",
+    "pillar1Label": "Système de fichiers",
+    "pillar1Detail": "rootfs/\n(rsync de /etc,\n/etc/systemd/network,\n/root, plus un\ninstantané sqlite3\nde /var/lib/pve-cluster,\n+ chemins facultatifs)",
+    "pillar2Label": "Manifeste",
+    "pillar2Detail": "manifest.json\n(matériel, paramètres\ndu noyau, réseau,\nZFS, utilisateurs, cron,\npools ZFS, stockage)",
+    "pillar3Label": "Applications",
+    "pillar3Detail": "packages.manual.list\n+ components_status.json\n(paquets APT manuels + installateurs\nProxMenux avec versions)"
+  },
+  "restoreIsUniversal": {
+    "heading": "La restauration reproduit l'hôte source, pas l'archive",
+    "body": "La restauration d'une sauvegarde ProxMenux ne se contente pas d'extraire le système de fichiers. Le flux de restauration lit le manifeste pour détecter la dérive entre la source et la cible (différences matérielles, renommages des cartes réseau, version du noyau, identité du pool ZFS), restaure le système de fichiers, puis déclenche le programme d'installation de composant correct pour chaque service installé sur la source (pilote NVIDIA, Coral TPU, outils GPU AMD, outils Intel GPU). Chaque programme d'installation s'exécute sur le <strong>noyau actuel de la cible</strong>, de sorte que l'hôte restauré ne dépend pas de la présence du noyau de la source. Lorsque le noyau de la cible est plus récent que celui de la sauvegarde, une passe d'<strong>hydratation</strong> indépendante du noyau fusionne les propres réglages de l'utilisateur (jetons IOMMU, ID de périphérique VFIO, adaptations particulières, clés GRUB) dans la nouvelle configuration de démarrage de la cible sans copier textuellement les fichiers liés au noyau."
+  },
+  "twoInterfaces": {
+    "heading": "Deux interfaces, un backend",
+    "intro": "Chaque étape du workflow de sauvegarde et de restauration est disponible à partir de deux points d'entrée. Les deux appellent la même bibliothèque shell, produisent des archives identiques et lisent le même registre de tâches.",
+    "cliLabel": "ProxMenux Scripts (TUI)",
+    "cliDetail": "menu → Utilitaires →\nSauvegarde / Restauration de l'hôte\n\nFlux basé sur le dialogue,\nCompatible avec SSH, scriptable\npour une utilisation sans surveillance.",
+    "webLabel": "ProxMenux Monitor (Web UI)",
+    "webDetail": "Onglet Sauvegardes dans\nl’interface web de Monitor.\n\nRestauration en un clic, suivi\ndes journaux en direct, intégré\naux notifications et à la vue\ndes différences de retour arrière."
+  },
+  "whereNext": {
+    "heading": "Où aller à partir d'ici",
+    "intro": "Chaque sous-section ci-dessous couvre en profondeur un aspect du flux de travail. Commencez par <em>Comment ça marche</em> si l'objectif est de comprendre ce que contient l'archive et pourquoi. Accédez à <em>Destinations</em> pour configurer la cible de la copie. Lisez <em>Restauration</em> et <em>Restauration inter-noyaux</em> pour le côté récupération.",
+    "items": [
+      {
+        "label": "Comment ça marche",
+        "href": "/docs/backup-restore/how-it-works",
+        "tail": "— les trois charges utiles (rootfs, manifeste, applications) en détail, avec les collecteurs qui les produisent et le format de chaque fichier."
+      },
+      {
+        "label": "Destinations",
+        "href": "/docs/backup-restore/destinations",
+        "tail": "— comparaison de local, Proxmox Backup Server (recommandé) et Borg, et comment configurer chacun d'eux."
+      },
+      {
+        "label": "Création de sauvegardes",
+        "href": "/docs/backup-restore/creating-backups",
+        "tail": "— sauvegardes ponctuelles, profil de chemin par défaut, ajout de chemins personnalisés, chiffrement pour PBS."
+      },
+      {
+        "label": "Tâches planifiées",
+        "href": "/docs/backup-restore/scheduled-jobs",
+        "tail": "— nouvelles tâches ou attachement à une tâche vzdump PVE existante, formats de planification, modal de détail de la tâche."
+      },
+      {
+        "label": "Restauration",
+        "href": "/docs/backup-restore/restoring",
+        "tail": "— les trois actions sur une archive (afficher, télécharger, restaurer), la restauration complète ou personnalisée, le répartiteur post-démarrage et pourquoi les dix dernières minutes sont importantes."
+      },
+      {
+        "label": "Restauration inter-noyaux",
+        "href": "/docs/backup-restore/cross-kernel",
+        "tail": " — comportement tenant compte du sens du changement de version lorsque le noyau cible diffère de celui de la sauvegarde, filtre de sous-ensemble sûr et quatre phases d’hydratation."
+      }
+    ]
+  }
+}
diff --git a/web/messages/fr/docs/backup-restore/restoring.json b/web/messages/fr/docs/backup-restore/restoring.json
new file mode 100644
index 00000000..fcd555cf
--- /dev/null
+++ b/web/messages/fr/docs/backup-restore/restoring.json
@@ -0,0 +1,282 @@
+{
+  "meta": {
+    "title": "Restaurer une sauvegarde — flux complets et personnalisés ProxMenux",
+    "description": "Le processus complet de restauration : consulter, télécharger ou restaurer une sauvegarde, vérifier la compatibilité, choisir le mode complet ou personnalisé, classer les chemins appliqués à chaud ou après redémarrage, puis réinstaller les composants après le démarrage.",
+    "ogTitle": "Sauvegarde ProxMenux — restauration",
+    "ogDescription": "Restauration complète ou personnalisée avec contrôle de compatibilité, classification des chemins, traitement au démarrage et réinstallation après démarrage.",
+    "twitterTitle": "Restaurer une sauvegarde ProxMenux",
+    "twitterDescription": "Comment une sauvegarde d'hôte ProxMenux est transformée en un hôte Proxmox fonctionnant."
+  },
+  "header": {
+    "title": "Restaurer une sauvegarde",
+    "description": "Le workflow complet de restauration : de la sélection d'une archive à un hôte de travail. Documente la vérification de compatibilité, les deux modes de restauration, le répartiteur sur le démarrage, le passe de réinstallation post-démarrage, et les mécanismes qui rendent prévisible la restauration cross-host et cross-kernel.",
+    "section": "Sauvegarde et restauration"
+  },
+  "intro": {
+    "title": "La restauration reproduit la source, pas seulement les fichiers",
+    "body": "Restaurer une sauvegarde ProxMenux va au-delà de l’extraction des fichiers. Avant les modifications, la restauration consulte le manifeste pour détecter les différences, écarte les chemins pouvant compromettre le démarrage et adapte les réglages de l’utilisateur qui ne peuvent pas être copiés tels quels. Après le redémarrage nécessaire, elle tente de réinstaller les composants pris en charge enregistrés (pilote NVIDIA, Coral TPU, outils GPU) pour le noyau actif de la destination. Une seule archive pilote le contrôle de compatibilité, la classification des chemins et les traitements au démarrage puis après démarrage. Consultez les résultats par composant et les journaux pour vérifier le résultat."
+  },
+  "threeActions": {
+    "heading": "Trois actions sur une sauvegarde",
+    "intro": "La sélection d'une sauvegarde dans la liste ouvre un menu avec trois actions.",
+    "actionRows": [
+      {
+        "action": "Affichage",
+        "detail": "Ouvre une vue en lecture seule de l'archive : le contenu de manifest.json (nom d'hôte source, version PVE, noyau, matériel, composants installés), la liste des chemins à l'intérieur de <code>rootfs/</code>, et un diff de ce qui changerait sur l'hôte actuel si la sauvegarde était appliquée."
+      },
+      {
+        "action": "Télécharger",
+        "detail": "Exporte l'archive comme un fichier portable <code>.tar.zst</code> (tar compressé avec zstd). Il peut être extrait sur n'importe quel système Linux avec <code>tar --zstd -xf FILE.tar.zst</code>, ou sur macOS/Windows avec n'importe quel outil qui supporte zstd (7-Zip, PeaZip, Keka...). L'arbre extrait contient <code>manifest.json</code>, <code>metadata/</code> et <code>rootfs/</code> — exactement la même disposition que la restauration consomme. Utile pour une inspection hors ligne ou pour la restauration sur un hôte sans accès à la destination originale (PBS, Borg)."
+      },
+      {
+        "action": "Restaurer",
+        "detail": "Le chemin de l'écriture. Extrait l'archive dans un répertoire de mise en scène, effectue la vérification de compatibilité et présente le mode de sélection (complète ou personnalisée)."
+      }
+    ]
+  },
+  "compatibilityCheck": {
+    "heading": "Le contrôle de compatibilité",
+    "intro": "Avant d'écrire un fichier, <code>hb_compat_check</code> compare l'état décrit dans le manifeste avec l'hôte cible. La vérification fonctionne en lecture seule et produit quatre sorties indépendantes qui conduisent le reste de la restauration.",
+    "outputRows": [
+      {
+        "output": "Drapeau de direction",
+        "detail": "<code>HB_COMPAT_KERNEL_DIRECTION</code> vaut <code>same</code>, <code>bk_newer</code> ou <code>bk_older</code> selon la comparaison des versions majeures du noyau de la sauvegarde et de la destination. Il pilote le filtre de chemins compatibles entre noyaux, actif uniquement pour <code>bk_older</code>, et l’adaptation des réglages décrite sur la page correspondante."
+      },
+      {
+        "output": "Liste des chemins exclus",
+        "detail": "<code>RS_SKIP_PATHS</code> — chaque chemin de restauration ne doit PAS s'appliquer. Populé par deux mécanismes : la dérive matérielle (manque de NIC, défaut d'identification de stockage, pool étranger ZFS) et — lorsque la direction est <code>bk_older</code> — la liste des sentiers dangereux à travers le noyau."
+      },
+      {
+        "output": "Plan de réaffectation des interfaces réseau",
+        "detail": "Lorsqu'un NIC sur la cible a le même MAC que celui sur la source mais un nom différent (typique après un swap de carte mère), la vérification de compatibilité enregistre un plan de renommer (<code>HB_NIC_REMAP</code>) qui réécrirea <code>/etc/network/interfaces</code> pendant la restauration."
+      },
+      {
+        "output": "Plan de restauration",
+        "detail": "Calculé par <code>compute_rollback_plan.sh</code>. Liste les VM, LXC et composants présents sur la destination mais absents de la sauvegarde. Le dialogue propose de supprimer les invités supplémentaires avant redémarrage. La suppression des composants reste manuelle et celle des invités peut échouer ; une correspondance exacte n’est donc pas garantie."
+      }
+    ],
+    "reportBody": "Le contrôle émet également un rapport structuré (<code>HB_COMPAT_RESULTS</code>) classé PASS / INFO / WARN / FAIL. Les entrées WARN et FAIL sont présentes dans le panneau pré-restauration ; la restauration refuse de procéder seulement lorsqu'une FAIL est présente et que l'utilisateur ne peut pas résoudre en cliquant sur Continuer."
+  },
+  "twoModes": {
+    "heading": "Restauration complète vs restauration personnalisée",
+    "intro": "Après le contrôle de compatibilité, le menu de mode apparaît. Le choix détermine <em>ce qui</em> est appliqué, pas <em>comment</em> : les deux modes utilisent le même processus.",
+    "modeRows": [
+      {
+        "mode": "Restauration complète",
+        "detail": "Applique tous les chemins de l'archive qui survivent à la dérive et aux filtres de cross-kernel. Exécute également l'installation du paquet et le passe de réinstallation automatique du composant. C'est le choix par défaut et le choix recommandé — le but est de reproduire la source, pas de choisir des morceaux."
+      },
+      {
+        "mode": "Restauration personnalisée",
+        "detail": "Ouvre une liste de contrôle montrant chaque chemin que porte l'archive. L'utilisateur coche un sous-ensemble. Les chemins bloqués par le filtre croisé apparaissent grisés et ne peuvent être sélectionnés. L'installation du paquet et l'auto-réinstallation du composant sont ignorées par défaut en mode Custom — l'utilisateur indique qu'il veut une application partielle, pas une reproduction complète."
+      }
+    ]
+  },
+  "pathClassification": {
+    "heading": "Comment les chemins sont classés",
+    "intro": "Chaque chemin sélectionné pour la restauration est classé par <code>hb_classify_path</code> dans l'une des trois catégories. La catégorie détermine quand le chemin est appliqué au système et pourquoi.",
+    "rows": [
+      {
+        "class": "hot",
+        "detail": "Voies appliquées <strong>immédiatement</strong> au système d'exécution. Le service qui les consomme ramasse le changement seul ou au prochain rechargement — aucun redémarrage n'est nécessaire. Ce sont l'essentiel d'une sauvegarde: <code>/etc/ssh</code>, <code>/etc/apt</code>, <code>/etc/cron.*</code>, <code>/root</code>, <code>/usr/local/bin</code>, fichiers de configuration de service général, etc."
+      },
+      {
+        "class": "reboot",
+        "detail": "Chemins reportés au <strong>prochain démarrage</strong>, au lieu d’être appliqués <strong>immédiatement</strong> par ce processus. Ils concernent la configuration de démarrage : la génération du chargeur lit <code>/etc/default/grub</code>, les montages utilisent <code>/etc/fstab</code> et le chargement des modules utilise <code>/etc/modules</code>. Les fichiers en attente sont appliqués après redémarrage, puis les éléments de démarrage nécessaires sont régénérés. Exemples : <code>/etc/default/grub</code>, <code>/etc/kernel</code>, <code>/etc/modules</code>, <code>/etc/fstab</code>, <code>/etc/zfs</code>, <code>/etc/modprobe.d</code>."
+      },
+      {
+        "class": "dangerous",
+        "detail": "Chemins <strong>NON appliqués sur le système en cours d’exécution</strong> : une écriture à chaud pourrait corrompre l’état ou couper la connexion active. Ils sont placés dans l’ensemble en attente : <code>/etc/network</code> est écrit tôt au démarrage suivant, avant le démarrage du réseau, et <code>/etc/pve</code> est écrit par le répartiteur post-démarrage une fois le système de fichiers du cluster disponible. Exemples : <code>/etc/pve</code> (pmxcfs est un montage FUSE contenant la configuration active du cluster), <code>/var/lib/pve-cluster</code> (données actives du cluster, conservées dans le répertoire de récupération pour une récupération manuelle uniquement), <code>/etc/network</code> (pourrait reconfigurer l’interface même par laquelle l’utilisateur est connecté en SSH et couper la session)."
+      }
+    ]
+  },
+  "fullFlow": {
+    "heading": "Le workflow complet de restauration",
+    "intro": "Le pipeline complet de la sélection des archives à un hôte opérationnel restauré. Chaque étape alimente la suivante; l'état écrit par les étapes précédentes est consommé par les suivantes.",
+    "diagram": "┌─────────────────────────────────────────────────────────────────┐\n│  Archive → staging_root/                                        │\n│    manifest.json   metadata/   rootfs/                          │\n└──────────────────────────────┬──────────────────────────────────┘\n                               │\n                               ▼\n   ┌─────────────────────────────────────────────────────────┐\n   │  1. hb_compat_check                                     │\n   │     · hardware drift → RS_SKIP_PATHS                    │\n   │     · kernel direction → same / bk_newer / bk_older     │\n   │     · NIC remap plan                                    │\n   │     · hydration plan (bk_older only)                    │\n   │     · rollback plan                                     │\n   └──────────────────────────────┬──────────────────────────┘\n                                  │\n                                  ▼\n   ┌─────────────────────────────────────────────────────────┐\n   │  2. Confirmation dialog                                 │\n   │     Shows: hot count, pending count, drift, hydration,  │\n   │     NIC remap, cross-kernel note, reinstalls preview    │\n   └──────────────────────────────┬──────────────────────────┘\n                                  │ (accepted)\n                                  ▼\n   ┌─────────────────────────────────────────────────────────┐\n   │  3. Apply hot paths → LIVE                              │\n   │     _rs_apply rsyncs each hot path                      │\n   │     from staging_root/rootfs to /                       │\n   │     (skips paths in RS_SKIP_PATHS)                      │\n   └──────────────────────────────┬──────────────────────────┘\n                                  │\n                                  ▼\n   ┌─────────────────────────────────────────────────────────┐\n   │  4. _rs_prepare_pending_restore                         │\n   │     /var/lib/proxmenux/pending-restore/                 │\n   │       ├── apply-on-boot.list                            │\n   │       ├── plan.env                                      │\n   │       ├── rs-skip-paths.txt                             │\n   │       └── rootfs/ (deferred paths)                      │\n   │     Enable proxmenux-restore-onboot.service             │\n   └──────────────────────────────┬──────────────────────────┘\n                                  │\n                                  ▼\n   ┌─────────────────────────────────────────────────────────┐\n   │  4b. _rs_import_data_pools                              │\n   │      Imports non-root ZFS pools whose disks are all     │\n   │      present; retries with -f on foreign hostid;        │\n   │      skips with a warning when disks are missing.       │\n   │      Log: /var/log/proxmenux/restore-datapools-*.log    │\n   └──────────────────────────────┬──────────────────────────┘\n                                  │\n                                  ▼\n   ┌─────────────────────────────────────────────────────────┐\n   │  5. _rs_run_complete_extras                             │\n   │     packages.manual.list                                │\n   │       → cascade-safe filter                             │\n   │       → apt-get install                                 │\n   └──────────────────────────────┬──────────────────────────┘\n                                  │\n                                  ▼\n   ┌─────────────────────────────────────────────────────────┐\n   │  6. REBOOT                                              │\n   └──────────────────────────────┬──────────────────────────┘\n                                  │\n                                  ▼\n   ┌─────────────────────────────────────────────────────────┐\n   │  7. apply_pending_restore.sh (on early boot)            │\n   │     Reads plan.env                                      │\n   │     Applies apply-on-boot.list (filtered)               │\n   │     Installs the postboot systemd unit                  │\n   └──────────────────────────────┬──────────────────────────┘\n                                  │\n                                  ▼\n   ┌─────────────────────────────────────────────────────────┐\n   │  8. apply_cluster_postboot.sh (~10 minutes)             │\n   │     Runs after pve-cluster is up                        │\n   │     · Applies /etc/pve entries to pmxcfs                │\n   │     · update-initramfs -u -k all                        │\n   │     · update-grub / proxmox-boot-tool refresh           │\n   │     · component --auto-reinstall (nvidia, coral, ...)   │\n   │     · Boot sanity check                                 │\n   │     · Notification: \"Host restore finished\"             │\n   └─────────────────────────────────────────────────────────┘"
+  },
+  "pendingMachinery": {
+    "heading": "Mécanisme de restauration différée",
+    "intro": "Les chemins classés comme <code>reboot</code> ou <code>dangerous</code>, et l'hydratation écrit, sont mis en scène pour le prochain démarrage au lieu d'être appliqués en direct. Cela se fait par le biais d'un petit ensemble autonome de fichiers sous <code>/var/lib/proxmenux/pending-restore/</code> :",
+    "rows": [
+      {
+        "file": "apply-on-boot.list",
+        "content": "Un chemin relatif par ligne : les chemins exacts que <code>apply_pending_restore.sh</code> appliquera depuis rootfs préparé. Le fichier permet de voir les changements prévus au prochain démarrage."
+      },
+      {
+        "file": "plan.env",
+        "content": "Variables d’environnement chargées par le script de démarrage : identifiant de restauration, indicateurs de compatibilité (<code>HB_COMPAT_CROSS_VERSION</code>, <code>HB_COMPAT_KERNEL_DIRECTION</code>, <code>HB_HYDRATION_APPLIED</code>), accord pour le rollback et options du cluster."
+      },
+      {
+        "file": "rs-skip-paths.txt",
+        "content": "La liste finale <code>RS_SKIP_PATHS</code>, enregistrée pour que <code>apply_pending_restore.sh</code> conserve après redémarrage les exclusions calculées lors de l’étape interactive. Elle empêche de restaurer au démarrage les chemins incompatibles avec le matériel ou le noyau."
+      },
+      {
+        "file": "rootfs/",
+        "content": "Les fichiers mis en scène eux-mêmes — les octets exacts qui seront établis. Conservé sur le même système de fichiers que <code>/</code> de sorte que le rsync on-boot est rapide et ne dépend pas du stockage externe encore accessible au démarrage."
+      }
+    ],
+    "unitBody": "L’unité systemd <code>proxmenux-restore-onboot.service</code> est activée à la fin de l’étape interactive. Ce service ponctuel démarre tôt au prochain démarrage, appelle <code>apply_pending_restore.sh</code> puis se désactive. La condition <code>ConditionPathExists=/var/lib/proxmenux/pending-restore/state</code> empêche toute exécution lorsqu’aucune restauration n’est en attente."
+  },
+  "postbootDispatcher": {
+    "heading": "Le répartiteur après démarrage — apply_cluster_postboot.sh",
+    "intro": "Où l'étape interactive se termine et où se produit la reproduction réelle de l'hôte. <code>apply_cluster_postboot.sh</code> est installé sous la forme d'une seconde unité systemd (<code>proxmenux-apply-cluster-postboot.service</code>) dont les cibles <code>After=</code>/<code>Wants=</code> s'assurent qu'elle ne fonctionne qu'après la mise en place du pve-cluster et de network-online. C'est là que les actions de restauration visible de l'hôte atterrissent.",
+    "tasks": [
+      {
+        "task": "Appliquer /etc/pve",
+        "detail": "<code>/etc/pve</code> est un montage en direct pmxcfs FUSE — il ne peut pas être écrit sur le démarrage précoce. Le répartiteur copie les fichiers des rootfs en attente vers le <code>/etc/pve</code> en direct une fois le système de fichiers cluster mis en place, un fichier à la fois, sans redémarrer pve-cluster. Le <code>/var/lib/pve-cluster/config.db</code> capturé de la sauvegarde (ou le <code>config.db.raw-fallback</code>) promu est matérialisé avec le <code>systemctl stop pve-cluster</code> → copie de fichier atomique → modèle <code>systemctl start pve-cluster</code>, de sorte que pmxcfs relise l'état restauré sur le chemin du retour."
+      },
+      {
+        "task": "Reconstruction initramfs et bootloader",
+        "detail": "Exécute <code>update-initramfs -u -k all</code> dans chaque noyau installé, puis soit <code>update-grub</code> (installations GRUB) soit <code>proxmox-boot-tool refresh</code> (installations systemd-boot / ZFS). Passé si l'étape interactive n'a rien déterminé dans les chemins qui affectent ces outils."
+      },
+      {
+        "task": "Réinstallation automatique du composant",
+        "detail": "Lit <code>components_status.json</code> restauré et parcourt les installateurs pris en charge (nvidia_driver, coral_driver, amdgpu_top, intel_gpu_tools). Chacun est lancé en mode <code>--auto-reinstall</code>, lit l’état enregistré et réinstalle pour l’environnement de destination, en recompilant les modules si nécessaire. L’opération attend le redémarrage pour utiliser le noyau alors actif. Les échecs individuels sont enregistrés sans arrêter le composant suivant."
+      },
+      {
+        "task": "Vérification du démarrage",
+        "detail": "Avant de lancer la notification d'achèvement, vérifie que <code>proxmox-boot-tool status</code> affiche un ESP configuré, chaque <code>/boot/vmlinuz-*</code> possède un répertoire <code>/lib/modules/&lt;ver&gt;</code> correspondant, et <code>/vmlinuz</code> résout. Toute incohérence apparaît dans la notification au lieu d'être cachée."
+      },
+      {
+        "task": "Avis d'achèvement",
+        "detail": "Envoie l'événement <code>Host restore finished</code> via <code>hb_notify_lifecycle</code>. Comprend la durée totale, le nombre de chemins appliqués, les avertissements de vérification de la santé, le cas échéant, et un lien vers le journal à <code>/var/log/proxmenux/proxmenux-cluster-postboot-*.log</code>. Si les notifications ne sont pas configurées, l'événement est silencieux — le journal enregistre toujours tout."
+      }
+    ]
+  },
+  "liveProgress": {
+    "heading": "Progrès en direct dans l'onglet Sauvegardes du moniteur",
+    "body": "Après le redémarrage, l’onglet Sauvegardes de ProxMenux Monitor affiche une carte de progression reflétant l’état de <code>proxmenux-apply-cluster-postboot.service</code>. Elle lit <code>/var/lib/proxmenux/restore-state.json</code>, mis à jour à chaque étape : configuration du cluster, initramfs, chargeur de démarrage, réinstallation de chaque composant, contrôle du démarrage et finalisation.",
+    "fields": [
+      {
+        "name": "Insigne d'état",
+        "detail": "Un des <em>Restaurer en cours</em>, <em>Restaurer complet</em> ou <em>Restaurer échoué</em>. La carte permet de vérifier le fichier d'état toutes les 2 secondes en cours d'exécution et toutes les 30 secondes après la fin."
+      },
+      {
+        "name": "Barre de progression + compteur de pas",
+        "detail": "Affiche <code>N/M steps</code> avec l'étiquette de l'étape actuelle. Pendant que la restauration exécute un <em> temps estimé</em> est dérivé des étapes terminées et du temps écoulé."
+      },
+      {
+        "name": "Liste des composants",
+        "detail": "Une ligne par pilote étant réinstallée (NVIDIA, outils Intel GPU, outils AMD, Coral TPU) avec <code>installing</code> / <code>ok</code> / <code>failed</code> plus un lien vers le journal par composant à <code>/var/log/proxmenux/component-*.log</code>."
+      },
+      {
+        "name": "Importation des pools de données",
+        "detail": "Le bloc <code>data_pools_import</code> montre cinq lignes colorées : <em>Importés</em>, <em>Forcés</em> (avec <code>-f</code> pour un hostid étranger), <em>Ignorés, disques partiels</em> (seuls certains disques sont présents), <em>Ignorés, disques absents</em> (aucun disque présent) et <em>Échecs</em>. L’état est conservé dans <code>/var/lib/proxmenux/restore-state.json</code> et le journal brut de l’exécution dans <code>/var/log/proxmenux/restore-datapools-&lt;timestamp&gt;.log</code>."
+      },
+      {
+        "name": "Avertissements relatifs au bon fonctionnement du démarrage",
+        "detail": "Le traitement vérifie les répertoires <code>/lib/modules/&lt;kernel&gt;</code> manquants, l’absence de configuration ESP et les liens symboliques <code>/vmlinuz</code> pointant vers une cible absente. Les avertissements apparaissent ici dans une bannière colorée."
+      },
+      {
+        "name": "Delta de restauration",
+        "detail": "Listes VMs, LXCs et composants qui existent sur la cible mais n'étaient pas dans la sauvegarde restaurée — les mêmes entrées sont apparues dans la boîte de dialogue de rappel destructive pré-restauration. Chaque ligne porte la commande de nettoyage manuel."
+      },
+      {
+        "name": "Fin du journal",
+        "detail": "Les dernières lignes 600 de <code>proxmenux-cluster-postboot-&lt;ts&gt;.log</code>, avec un filtre <em>Problèmes uniquement</em> qui maintient juste des lignes correspondant à <code>error</code>, <code>warning</code>, <code>failed</code>, <code>✗</code> ou <code>traceback</code>."
+      }
+    ],
+    "dismissBody": "Une fois la restauration <em>terminée</em> ou <em>en échec</em>, le bouton Masquer replie la carte. Le fichier d’état est conservé ; Historique rouvre cette restauration et les précédentes. Les 20 dernières exécutions sont archivées dans <code>/var/lib/proxmenux/restore-history/</code>.",
+    "imageAlt": "Fenêtre Détails du suivi de restauration dans ProxMenux Monitor pendant l’exécution : badge bleu, étape « Reconstruction initramfs », temps restant estimé, barre partiellement remplie et dernières lignes du journal en direct.",
+    "imageCaption": "Le mode Détails pendant que le répartiteur post-démarrage est toujours en marche — badge, étape actuelle, temps restant et queue de log en direct.",
+    "detailsImageAlt": "Le même détail modal après la restauration a terminé, avec le badge vert Restore complet, la durée totale d'exécution (0m53s), une barre de progression 6/6, le delta Rollback vide et le journal de post-démarrage archivé.",
+    "detailsImageCaption": "Le même modal une fois la exécution terminée — badge, durée totale, barre de progression remplie et le journal de post-démarrage archivé."
+  },
+  "postbootExample": {
+    "heading": "A quoi ressemble le post-boot sur la console",
+    "body": "Sur la console physique, un traitement qui se termine sans erreur de processus affiche <code>[ OK ] Finished proxmenux-apply-cluster-postboot.service</code>, souvent près des <code>OK</code> de <code>multi-user.target</code> et <code>graphical.target</code>. Cela marque la fin du processus. Des échecs de composants ou avertissements de démarrage peuvent néanmoins avoir été enregistrés ; vérifiez leurs états et les journaux du moniteur avant de considérer l’hôte comme entièrement restauré.",
+    "imageAlt": "Console physique Proxmox affichant '[ OK ] Finished proxmenux-apply-cluster-postboot.service - ProxMenux Apply Cluster Configs (post-boot).', puis OK pour multi-user.target et graphical.target, avec l’invite de connexion au-dessus.",
+    "imageCaption": "Console physique à la fin du processus. 'Finished proxmenux-apply-cluster-postboot.service' marque sa fin, également signalée par 'Host restore finished' dans le moniteur. Les résultats des composants et les avertissements restent à vérifier."
+  },
+  "tenMinutes": {
+    "heading": "Pourquoi les dix dernières minutes comptent",
+    "intro": "Le redémarrage lui-même prend des secondes, mais le répartiteur post-démarrage passe environ dix minutes à terminer la restauration. Pendant cette fenêtre, l'hôte est accessible et la connexion fonctionne, mais certains services (principalement dépendants des pilotes GPU) ne sont pas encore disponibles. Répartition du temps d'un hôte Proxmox typique avec NVIDIA + Coral installé:",
+    "rows": [
+      {
+        "stage": "Boot + pve-cluster prêt",
+        "time": "~30 s",
+        "detail": "Démarrage standard de Proxmox. SSH, interface web et connexion sont disponibles à la fin de cette étape."
+      },
+      {
+        "stage": "Appliquer /etc/pve à pmxcfs",
+        "time": "~10 s",
+        "detail": "Rapide — petits fichiers de configuration copiés un par un dans le système de fichiers cluster live."
+      },
+      {
+        "stage": "Reconstruire les initramfs à travers les noyaux",
+        "time": "3–5 min",
+        "detail": "<code>update-initramfs -u -k all</code> reconstruit une image initramfs par noyau installé. Le gros de l'attente."
+      },
+      {
+        "stage": "Reconstruire la configuration du chargeur de démarrage",
+        "time": "10–30 s",
+        "detail": "<code>update-grub</code> ou <code>proxmox-boot-tool refresh</code>. Rapide même sur ZFS."
+      },
+      {
+        "stage": "Réinstallation du pilote NVIDIA (le cas échéant)",
+        "time": "5–10 min",
+        "detail": "Télécharger la version du pilote enregistrée, compiler les modules DKMS contre le noyau actuel, applique le correctif ProxMenux si la source l'avait. La tâche la plus longue."
+      },
+      {
+        "stage": "Réinstallation de Coral et des autres composants",
+        "time": "3–5 min",
+        "detail": "DKMS compile pour Coral, apt install pour intel-gpu-tools, .deb download + install pour amdgpu_top."
+      },
+      {
+        "stage": "Vérification du démarrage et notification",
+        "time": "~2 s",
+        "detail": "Très rapide. La notification informe l’utilisateur dès la fin de l’exécution."
+      }
+    ],
+    "outroBody": "Pendant cette période, certains outils peuvent manquer après connexion (<code>nvidia-smi</code> introuvable, <code>coral</code> non détecté), car la réinstallation continue en arrière-plan. La notification marque la fin du traitement ; vérifiez résultats des composants, avertissements et journaux pour distinguer succès et échecs individuels."
+  },
+  "destructiveRollback": {
+    "heading": "Le renversement destructeur facultatif",
+    "body": "La restauration est additive par défaut : VM, LXC et composants supplémentaires restent présents. En cas de différences, le dialogue propose <em>Exécuter le rollback destructif ?</em>, avec Non par défaut. Accepter appelle <code>_rs_execute_rollback</code> avant redémarrage pour tenter de supprimer les VM et LXC supplémentaires listés. Les composants sont signalés pour désinstallation manuelle, faute de désinstallation automatique. Les échecs de suppression sont rapportés sans arrêter la suite ; une correspondance exacte n’est pas garantie. Vérifiez noms et VMID/CTID avant ce choix destructif."
+  },
+  "logs": {
+    "heading": "Emplacement des journaux",
+    "rows": [
+      {
+        "log": "/var/log/proxmenux/restore-YYYYMMDD_HHMMSS.log",
+        "detail": "Écrit lors de l’étape interactive : résultats de compatibilité, filtre des différences, plan d’adaptation, sorties de l’application à chaud et de la préparation différée, installation des paquets."
+      },
+      {
+        "log": "/var/log/proxmenux/apply-pending-YYYYMMDD_HHMMSS.log",
+        "detail": "Écrit par <code>apply_pending_restore.sh</code> au début du démarrage : chargement de plan.env, parcours de apply-on-boot et filtrage des chemins exclus."
+      },
+      {
+        "log": "/var/log/proxmenux/proxmenux-cluster-postboot-YYYYMMDD_HHMMSS.log",
+        "detail": "Écrit par <code>apply_cluster_postboot.sh</code>. Contient: pve-cluster appliquer, initramfs et sortie de chargeur d'amorçage, sortie d'installation par composant, vérification de la santé, charge utile de notification."
+      },
+      {
+        "log": "/var/log/proxmenux/component-<name>-YYYYMMDD_HHMMSS.log",
+        "detail": "Un journal par programme d'installation de composant (nvidia, coral, etc.) exécuté lors de la passe post-démarrage. Utile lorsque la réinstallation d'un composant spécifique a échoué et que l'utilisateur a besoin de la propre sortie de l'outil."
+      },
+      {
+        "log": "/var/log/proxmenux/restore-datapools-YYYYMMDD_HHMMSS.log",
+        "detail": "Écrit par <code>_rs_import_data_pools</code>. Contient : le dénombrement de pools non-racines à partir du manifeste, le résultat par pool (importé proprement, importé avec <code>-f</code> pour un hôte étranger, ignoré en raison de disques absents, ou échoué), et la sortie brute de chaque appel <code>zpool import</code>."
+      }
+    ]
+  },
+  "whereNext": {
+    "heading": "Où aller ensuite?",
+    "items": [
+      {
+        "label": "Restauration entre versions du noyau",
+        "href": "/docs/backup-restore/cross-kernel",
+        "tail": " — le filtre de chemins sûrs tenant compte du sens du changement de noyau et l’adaptation des réglages lorsque le noyau de destination diffère de celui de la sauvegarde."
+      },
+      {
+        "label": "Comment ça marche",
+        "href": "/docs/backup-restore/how-it-works",
+        "tail": "— la mise en page des archives, le manifeste et l'inventaire des applications que la restauration consomme."
+      },
+      {
+        "label": "Tâches planifiées",
+        "href": "/docs/backup-restore/scheduled-jobs",
+        "tail": "— le flux sans surveillance qui produit les archives que cette page consomme."
+      }
+    ]
+  }
+}
diff --git a/web/messages/fr/docs/backup-restore/scheduled-jobs.json b/web/messages/fr/docs/backup-restore/scheduled-jobs.json
new file mode 100644
index 00000000..8f8ac95c
--- /dev/null
+++ b/web/messages/fr/docs/backup-restore/scheduled-jobs.json
@@ -0,0 +1,152 @@
+{
+  "meta": {
+    "title": "Tâches planifiées — temporisateurs, mode attach et rétention | ProxMenux",
+    "description": "Tâches de sauvegarde d’hôte ProxMenux programmées. Deux modes de création (minuteur systemd propre ou association à une tâche vzdump PVE existante), règles de rétention appliquées par tâche avec proxmox-backup-client, Borg ou le nettoyage local, fichiers sous /var/lib/proxmenux/backup-jobs et script d’exécution produisant les mêmes archives que le processus interactif.",
+    "ogTitle": "Sauvegarde ProxMenux — tâches programmées",
+    "ogDescription": "Sauvegardes d'hôte programmées non surveillées avec mode de fixation, conservation, et les mêmes trois destinations que le flux interactif.",
+    "twitterTitle": "Tâches planifiées | ProxMenux",
+    "twitterDescription": "Tâches programmées de sauvegarde d’hôte sans intervention, avec mode d’association et rétention."
+  },
+  "header": {
+    "title": "Tâches programmées",
+    "description": "Tâches de sauvegarde d’hôte sans intervention. Deux modèles de création : une nouvelle tâche indépendante avec son propre calendrier, ou une tâche associée à une tâche vzdump PVE existante, dont elle reprend le calendrier et la rétention. Les deux produisent les mêmes archives que le processus interactif.",
+    "section": "Sauvegarde et restauration"
+  },
+  "intro": {
+    "title": "Les deux modèles de tâches programmées",
+    "body": "Une tâche programmée peut être créé selon l'un des deux modèles suivants :",
+    "modelsList": [
+      "<strong>Nouveau travail indépendant</strong> — ProxMenux définit lui-même l'horaire de travail avec sa propre minuterie systemd, indépendamment de toute autre tâche sur l'hôte. Compatible avec les trois destinations : Local, PBS et Borg.",
+      "<strong>Associer à une tâche vzdump PVE existante</strong> — la tâche n’a pas de calendrier propre ; elle s’exécute automatiquement quand la tâche vzdump parente sauvegarde les VM et LXC de cet hôte. Elle reprend son calendrier et sa rétention. Compatible avec les destinations locale et PBS (Borg n’est pas pris en charge, car PVE n’a pas de planificateur natif pour Borg)."
+    ]
+  },
+  "attachBadge": {
+    "title": "Mode d’association — recommandé si une tâche vzdump PVE existe déjà",
+    "body": "Lorsqu’une tâche de sauvegarde vzdump PVE est déjà configurée pour les VM et LXC du nœud, l’association de la sauvegarde hôte la fait exécuter après celle des invités, dans le <strong>même cycle de sauvegarde</strong>. À la restauration, les configurations des invités viennent de la sauvegarde hôte (sous <code>/etc/pve</code>) et leurs disques des sauvegardes vzdump du même cycle. Cela facilite la récupération coordonnée du nœud, sans constituer un instantané atomique : des modifications pendant le cycle peuvent créer des écarts entre la configuration hôte et l’état des disques des invités."
+  },
+  "frequencyBadge": {
+    "title": "Fréquence recommandée",
+    "body": "Pour maximiser la compatibilité entre une sauvegarde hôte et sa future restauration, sauvegardez fréquemment l’hôte. Plus la copie est proche de son état actuel, moins la restauration doit réconcilier d’écarts de configuration, de paquets et de composants."
+  },
+  "modes": {
+    "heading": "Les deux modes",
+    "rows": [
+      {
+        "mode": "Nouveau travail planifié",
+        "backends": "Local, PBS, Borg",
+        "schedule": "Propre expression <code>OnCalendar</code> (syntaxe du calendrier systemd — par exemple <code>daily</code>, <code>Mon..Fri 03:00</code>).",
+        "retention": "Demandée séparément: <code>keep-last</code>, <code>keep-hourly</code>, <code>keep-daily</code>, <code>keep-weekly</code>, <code>keep-monthly</code>, <code>keep-yearly</code>. Appliquée par le script d’exécution après chaque sauvegarde réussie."
+      },
+      {
+        "mode": "Associer à une tâche vzdump PVE",
+        "backends": "Local, PBS (Borg n'a pas de planificateur côté PVE)",
+        "schedule": "Hérité de la tâche PVE parente. Aucun minuteur systemd n’est installé côté ProxMenux.",
+        "retention": "Héritée de la configuration <code>prune-backups</code> de la tâche parente (associée une à une aux variables <code>KEEP_*</code> du script d’exécution via <code>hb_pve_prune_to_keep_env</code>)."
+      }
+    ]
+  },
+  "attachDetail": {
+    "heading": "Comment fonctionne le mode de fixation",
+    "intro": "PVE écrit les tâches <code>vzdump</code> dans <code>/etc/pve/jobs.cfg</code>, avec une section par tâche indiquant le stockage des sauvegardes VM et LXC. Le mode d’association exige un backend compris par ProxMenux (local ou PBS). La sauvegarde hôte s’exécute via le hook job-end après la fin de la tâche de sauvegarde des invités.",
+    "steps": [
+      {
+        "step": "1",
+        "detail": "Lors de la création de tâches, ProxMenux liste les tâches parent PVE compatibles via <code>hb_pve_list_vzdump_jobs_for_backend</code>. L'utilisateur en choisit un."
+      },
+      {
+        "step": "2",
+        "detail": "Le <code>.env</code> de l'emploi est écrit avec <code>PVE_PARENT_JOB</code>, <code>PVE_STORAGE</code> et les valeurs de <code>KEEP_*</code> héritées; aucun minuteur systemd n'est créé."
+      },
+      {
+        "step": "3",
+        "detail": "<code>hb_install_vzdump_hook</code> enregistre un hook dans <code>/etc/vzdump.conf</code>. À la phase job-end de toute tâche vzdump, il compare le <code>$STOREID</code> reçu au <code>PVE_STORAGE</code> de chaque tâche associée activée et appelle le script d’exécution en cas de correspondance. L’association se fait par stockage, et non par identifiant de la tâche parente choisie."
+      },
+      {
+        "step": "4",
+        "detail": "L’archive est enregistrée dans le même stockage que les sauvegardes vzdump : <code>path/dump/</code> pour la destination locale ou le dépôt PBS configuré dans l’entrée de stockage PVE."
+      }
+    ],
+    "outroBody": "Le mode d’association n’a pas de minuteur propre. Désactiver ou supprimer la tâche PVE parente choisie arrête son déclenchement, mais une autre tâche vzdump utilisant le même stockage peut encore lancer la sauvegarde hôte. Désactivez ou supprimez la tâche ProxMenux elle-même pour l’empêcher. Lors d’une désactivation, son entrée reste sur disque pour permettre une réactivation ou une nouvelle association."
+  },
+  "storageLayout": {
+    "heading": "Fichiers qui constituent un travail",
+    "intro": "Chaque travail programmé est entièrement décrit par trois ou quatre fichiers sur disque. Les lire donne la configuration complète du travail sans compter sur l'interface.",
+    "rows": [
+      {
+        "path": "/var/lib/proxmenux/backup-jobs/JOB_ID.env",
+        "content": "Backend, identifiant de sauvegarde ou destination, calendrier (nouvelle tâche) ou tâche PVE parente (association), indicateur d’activation, valeurs de rétention <code>KEEP_*</code> et références aux identifiants."
+      },
+      {
+        "path": "/var/lib/proxmenux/backup-jobs/JOB_ID.paths",
+        "content": "Un chemin absolu par ligne : la sélection figée à partir du profil lors de la création de la tâche. Modifier le fichier utilise la nouvelle sélection à la prochaine exécution du minuteur."
+      },
+      {
+        "path": "/etc/systemd/system/proxmenux-backup-JOB_ID.timer + .service",
+        "content": "Nouveau mode seulement. Le service invoque <code>run_scheduled_backup.sh JOB_ID</code>. Le minuteur le planifie avec <code>Persistent=true</code> (exécutions manquées rattrapées au prochain démarrage) et un petit <code>RandomizedDelaySec=120</code> pour répartir la charge lorsque plusieurs tâches partagent la même expression OnCalendar."
+      },
+      {
+        "path": "/etc/vzdump.conf script-hook",
+        "content": "Mode d’association uniquement. Installé une fois par <code>hb_install_vzdump_hook</code> ; compare le <code>PVE_STORAGE</code> de chaque tâche associée au <code>$STOREID</code> transmis par PVE au hook."
+      }
+    ]
+  },
+  "runner": {
+    "heading": "Ce que fait une tâche à son déclenchement",
+    "intro": "Chaque travail — qu’il s’agisse d’une nouvelle tâche indépendante ou d’une tâche associée — comporte la même séquence en trois étapes:",
+    "steps": [
+      "<strong>Prépare la sauvegarde.</strong> Lit la configuration de travail (destination, profil, chemins) et assemble l'arborescence des archives exactement comme le flux interactif. Le résultat est la même archive qu'une sauvegarde manuelle avec ces paramètres produirait.",
+      "<strong>Écrire à la destination.</strong> Charge ou écrit l'archive vers la destination configurée — un fichier local <code>.tar.zst</code>, une sauvegarde PBS ou une archive Borg — en utilisant exactement les mêmes outils et identifiants qu’une sauvegarde manuelle vers la même destination.",
+      "<strong>Appliquer la rétention.</strong> Supprime les anciennes sauvegardes de la destination, en maintenant les nombres <code>keep-last</code> / <code>keep-daily</code> / <code>keep-weekly</code> configurés sur le travail. La purge est effectuée par la destination elle-même: PBS applique sa propre conservation, Borg exécute <code>borg prune</code>, et pour Local ProxMenux supprime les fichiers qui tombent en dehors de la fenêtre <code>keep-last</code>."
+    ]
+  },
+  "management": {
+    "heading": "Gestion des tâches",
+    "intro": "Le menu planificateur (Scripts TUI) et l'onglet Sauvegardes Monitor exposent les mêmes actions sur n'importe quel travail.",
+    "rows": [
+      {
+        "action": "Exécuter maintenant",
+        "detail": "Appelle immédiatement le script d’exécution, sans attendre le minuteur ou le hook vzdump. Utile pour vérifier la configuration sans attendre le prochain déclenchement."
+      },
+      {
+        "action": "Activer / Désactiver",
+        "detail": "Nouveau mode : <code>systemctl enable/disable --now</code> la minuterie. Attache le mode : retourne le drapeau <code>ENABLED</code> dans le travail env — le script hook l'honore au prochain déclenchement PVE."
+      },
+      {
+        "action": "Modifier",
+        "detail": "Rouvre les champs de destination, calendrier, profil et rétention et réécrit les fichiers de la tâche. Conserve son identifiant."
+      },
+      {
+        "action": "Supprimer",
+        "detail": "Supprime le fichier env, la liste des chemins et le minuteur et service systemd (nouvelle tâche), et désactive l’association au hook (mode d’association). Les archives déjà présentes à destination restent intactes."
+      },
+      {
+        "action": "Voir le journal",
+        "detail": "Affiche en continu <code>/var/log/proxmenux/backup-jobs/JOB_ID-YYYYMMDD_HHMMSS.log</code> : un fichier journal par exécution. Le programme d'exécution émet également une ligne d'état compacte à journald sous le service systemd."
+      }
+    ]
+  },
+  "notifications": {
+    "heading": "Notifications",
+    "body": "Chaque exécution programmée déclenche les mêmes événements <code>hb_notify_lifecycle</code> que le flux interactif (<code>start</code>, <code>complete</code>, <code>fail</code>). Si les canaux de notification sont configurés dans le moniteur, les tâches non surveillées présentent leurs résultats de la même manière que les sauvegardes manuelles, un utilisateur n'a pas besoin de vérifier le journal pour savoir si une tâche a réussi."
+  },
+  "whereNext": {
+    "heading": "Où aller ensuite?",
+    "items": [
+      {
+        "label": "Création de sauvegardes",
+        "href": "/docs/backup-restore/creating-backups",
+        "tail": "— le flux interactif qui partage le moteur avec le planificateur."
+      },
+      {
+        "label": "Destinations",
+        "href": "/docs/backup-restore/destinations",
+        "tail": "— configuration par moteur utilisée à la fois par le flux interactif et le planificateur."
+      },
+      {
+        "label": "Restauration",
+        "href": "/docs/backup-restore/restoring",
+        "tail": " — le processus qui utilise les sauvegardes produites par les tâches."
+      }
+    ]
+  }
+}
diff --git a/web/messages/fr/docs/create-vm/index.json b/web/messages/fr/docs/create-vm/index.json
new file mode 100644
index 00000000..b0c57e98
--- /dev/null
+++ b/web/messages/fr/docs/create-vm/index.json
@@ -0,0 +1,175 @@
+{
+  "meta": {
+    "title": "Créer des VM dans Proxmox VE — assistants Synology, Windows, Linux et NAS | ProxMenux",
+    "description": "Créez et configurez des VM sur Proxmox VE avec ProxMenux. Assistants pour NAS (Synology DSM, TrueNAS, OpenMediaVault, XigmaNAS, etc.), Windows, distributions Linux et installateur macOS externe. Réglages adaptés pour le matériel, le stockage et le réseau.",
+    "ogTitle": "Créer des VM sur Proxmox VE : assistants Synology, Windows, Linux et NAS",
+    "ogDescription": "Assistants ProxMenux pour créer des VM Synology DSM, TrueNAS, OMV, XigmaNAS, Windows et Linux sur Proxmox VE.",
+    "ogImageAlt": "Menu Créer VM de ProxMenux",
+    "twitterTitle": "Création de VMs sur Proxmox VE | ProxMenux",
+    "twitterDescription": "Assistants pour VM Synology, TrueNAS, OMV, XigmaNAS, Windows et Linux sur Proxmox VE."
+  },
+  "header": {
+    "title": "Créer VM",
+    "description": "ProxMenux regroupe la création de VM dans un répartiteur interactif. Choisissez la famille de systèmes d'exploitation et l'assistant correspondant gère la sélection ISO, CPU, RAM, BIOS, réseau, stockage et — en option — GPU passant.",
+    "section": "Machines virtuelles"
+  },
+  "intro": {
+    "title": "Ce menu sert à",
+    "body": "Le menu Créer VM oriente vers plusieurs assistants. Il demande la famille du système et charge la sélection d’ISO et le configurateur adaptés. Le mode par défaut utilise des réglages raisonnables ; le mode avancé présente les options disponibles avant la création."
+  },
+  "opening": {
+    "heading": "Ouverture du menu",
+    "body": "Dans le menu principal de ProxMenux, sélectionnez <strong>Créer VM</strong>. Vous verrez ceci :",
+    "imageAlt": "Créer un répartiteur VM avec les options 3 ProxMenux (NAS / Windows / Linux) suivi de la section Scripts communautaires (macOS / Autres)"
+  },
+  "families": {
+    "heading": "Trois familles OS",
+    "intro": "Les trois entrées ProxMenux en haut du menu partagent le même moteur sous-jacent et le même flux post-ISO — elles se dirigent vers différents sélecteurs ISO et appliquent des valeurs par défaut pour chaque famille. Choisissez celui qui correspond à l'invité que vous voulez installer.",
+    "routes": [
+      {
+        "key": "nas",
+        "title": "Système NAS",
+        "icon": "HardDrive",
+        "href": "/docs/create-vm/system-nas",
+        "accent": "border-emerald-300 bg-emerald-50",
+        "iconBg": "bg-emerald-100 text-emerald-700",
+        "description": "Huit systèmes NAS en VM dédiées. La plupart utilisent le parcours ISO automatique ; Synology DSM dispose d’un assistant spécialisé avec chargeur.",
+        "bullets": [
+          "Synology DSM (chargeurs Arc / RR / Alpine RedPill M-shell)",
+          "TrueNAS SCALE et CORE (ZFS)",
+          "OpenMediaVault (basé sur Debian)",
+          "XigmaNAS (FreeBSD ZFS)",
+          "Rockstor (openSUSE / Btrfs), ZimaOS, FygoOS"
+        ]
+      },
+      {
+        "key": "windows",
+        "title": "Système Windows",
+        "icon": "MonitorCog",
+        "href": "/docs/create-vm/system-windows",
+        "accent": "border-blue-300 bg-blue-50",
+        "iconBg": "bg-blue-100 text-blue-700",
+        "description": "Éditions Windows 10, 11 et Server avec des réglages adaptés (q35 + OVMF + TPM 2.0) et l’ISO des pilotes VirtIO déjà montée.",
+        "bullets": [
+          "UUP Dump pour les ISO à jour",
+          "Ou ISO local à partir de /var/lib/vz/template/iso",
+          "TPM 2.0 ajouté automatiquement",
+          "ISO des pilotes VirtIO connectée à ide3",
+          "canal d'agent invité activé"
+        ]
+      },
+      {
+        "key": "linux",
+        "title": "Système Linux",
+        "icon": "Laptop",
+        "href": "/docs/create-vm/system-linux",
+        "accent": "border-amber-300 bg-amber-50",
+        "iconBg": "bg-amber-100 text-amber-700",
+        "description": "Catalogue sélectionné d’ISO Linux officielles téléchargées automatiquement depuis leurs projets, plus un sélecteur d’ISO locales pour les autres images.",
+        "bullets": [
+          "Ubuntu (Bureau / Serveur, 20.04–25.10)",
+          "Debian (Bureau / Netinst, 11–13)",
+          "Fedora, Arch, Rocky, Mint, openSUSE",
+          "Alpine, Kali, Manjaro",
+          "Chemin ISO local pour les images personnalisées"
+        ]
+      }
+    ]
+  },
+  "community": {
+    "title": "Scripts communautaires (non documentés ici)",
+    "intro": "Les deux entrées sous le séparateur <em>Community Scripts</em> exécutent du code qui <strong>ne fait pas partie de ProxMenux</strong>. Elles sont donc volontairement exclues de cette documentation :",
+    "macosRich": "<strong>Système macOS</strong> : exécute l’installateur externe <osxLink>OSX-PROXMOX</osxLink>. Il clone le dépôt d’origine, prépare l’hôte et <strong>redémarre automatiquement à la fin</strong>. Consultez la documentation du projet.",
+    "othersRich": "<strong>Autres systèmes (basés sur Linux)</strong> : charge une sélection d’installateurs communautaires pour serveurs domestiques, routeurs, pare-feu, etc. Chaque script est maintenu hors de ProxMenux."
+  },
+  "afterPick": {
+    "heading": "Ce qui se passe après avoir choisi un OS",
+    "intro": "Une fois l'ISO sélectionné, le répartiteur prend le même chemin indépendamment de la famille d'OS:",
+    "items": [
+      "<strong>Par défaut ou avancé.</strong> Un dialogue permet d’accepter les réglages ProxMenux ou d’ouvrir le configurateur complet : modèle et cœurs du CPU, RAM, BIOS/UEFI, carte réseau et type de machine.",
+      "<strong>Plan de stockage.</strong> Vous combinez un ou plusieurs disques virtuels, disques importés et périphériques PCI passants (contrôleur entier / NVMe) dans le même VM.",
+      "<strong>Passthrough GPU facultatif.</strong> Si un GPU compatible est détecté, ProxMenux propose l’assistant GPU après la création de la VM. Un redémarrage peut être nécessaire.",
+      "<strong>Création de la VM.</strong> La VM est créée, étiquetée et reçoit une description HTML mise en forme pour consultation rapide dans Proxmox."
+    ],
+    "tipTitle": "Préférez Advanced pour les VMs que vous avez l'intention de conserver",
+    "tipBody": "Les préréglages par défaut fonctionnent bien pour des tests rapides. Pour un VM que vous avez l'intention de conserver, le chemin avancé vous permet de choisir le bon BIOS (SeaBIOS vs OVMF/UEFI), le type de machine (<code>i440fx</code> vs <code>q35</code>) et le contrôleur de disque (VirtIO SCSI single vs SATA) à l'avant – ils sont douloureux à changer plus tard."
+  },
+  "scripts": {
+    "heading": "Scripts utilisés",
+    "intro": "Le menu charge plusieurs scripts de composants partagés sans page individuelle. Ils sont listés ici comme référence. Chaque sous-page renvoie au script principal de sa procédure.",
+    "headerScript": "Script",
+    "headerRole": "Rôle",
+    "rows": [
+      {
+        "path": "menus/create_vm_menu.sh",
+        "role": "Point d’entrée et orientation."
+      },
+      {
+        "path": "vm/select_nas_iso.sh",
+        "role": "Sélection des ISO et systèmes NAS (Synology, TrueNAS, OMV, Rockstor, XigmaNAS, ZimaOS, FygoOS)."
+      },
+      {
+        "path": "vm/select_windows_iso.sh",
+        "role": "Sélecteur d’ISO Windows. Utilise le générateur UUP Dump si nécessaire."
+      },
+      {
+        "path": "vm/select_linux_iso.sh",
+        "role": "Sélecteur ISO Linux pour le flux Linux (distributions principales)."
+      },
+      {
+        "path": "vm/synology.sh",
+        "role": "Procédure Synology DSM : récupère le chargeur et l’image DSM et prépare le profil de VM."
+      },
+      {
+        "path": "vm/zimaos.sh",
+        "role": "Flux ZimaOS : télécharge l'image et l'enfile dans la définition VM."
+      },
+      {
+        "path": "vm/vm_configurator.sh",
+        "role": "Assistant par défaut vs Assistant avancé : CPU model/cores, RAM, BIOS, NIC, type de machine."
+      },
+      {
+        "path": "vm/disk_selector.sh",
+        "role": "Plan de stockage: disque virtuel, importation de disque, ou Passthrough Controller/NVMe."
+      },
+      {
+        "path": "vm/vm_creator.sh",
+        "role": "Création finale de VM : applique la configuration, fixe le stockage, écrit la description HTML."
+      },
+      {
+        "path": "vm/guest_agent_config.sh",
+        "role": "Hook facultatif de configuration de l’agent invité QEMU, utilisé par plusieurs procédures."
+      }
+    ]
+  },
+  "related": {
+    "heading": "Voir aussi",
+    "items": [
+      {
+        "href": "/docs/disk-manager",
+        "label": "Gestionnaire de disque",
+        "tail": "— fixer des disques physiques existants ou importer des images de disques dans des VM."
+      },
+      {
+        "href": "/docs/utils/UUp-Dump-ISO-Creator",
+        "label": "Créateur d’ISO UUP Dump",
+        "tail": "— générer des ISO d'installation Windows prêts à utiliser comme support de démarrage."
+      },
+      {
+        "href": "/docs/utils/import-vm",
+        "label": "Importer VM de OVA / OVF",
+        "tail": "— apporter des VM préconçus à partir de VMware / VirtualBox / ProxMenux exportations."
+      },
+      {
+        "href": "/docs/hardware/gpu-vm-passthrough",
+        "label": "Ajouter GPU à VM (Passthrough)",
+        "tail": "— passer un GPU dans un VM fraîchement créé."
+      },
+      {
+        "href": "/docs/help-info/vm-ct-commands",
+        "label": "Commandes de gestion VM et CT",
+        "tail": "— référence qm pour le côté CLI."
+      }
+    ]
+  }
+}
diff --git a/web/messages/fr/docs/create-vm/synology.json b/web/messages/fr/docs/create-vm/synology.json
new file mode 100644
index 00000000..e8f44084
--- /dev/null
+++ b/web/messages/fr/docs/create-vm/synology.json
@@ -0,0 +1,453 @@
+{
+  "title": "Script de création de VM Synology",
+  "stepLabel": "Étape",
+  "intro": {
+    "heading": "Présentation",
+    "intro": "ProxMenux fournit un script automatisé qui crée et configure une machine virtuelle (VM) pour installer Synology DSM (DiskStation Manager) sur Proxmox VE. Ce script simplifie le processus en téléchargeant et en ajoutant l'un des chargeurs disponibles au démarrage VM, vous donnant l'option entre quatre choix différents :",
+    "loaders": [
+      {
+        "name": "AuxXxilium Arc",
+        "url": "https://github.com/AuxXxilium/arc",
+        "extra": ""
+      },
+      {
+        "name": "RedPill RR",
+        "url": "https://github.com/RROrg/rr",
+        "extra": ""
+      },
+      {
+        "name": "Alpine RedPill M-shell (projet TinyCore)",
+        "url": "https://github.com/PeterSuh-Q3/tinycore-redpill",
+        "extra": ""
+      }
+    ],
+    "customLoader": "Chargeur personnalisé – option pour utiliser un chargeur personnalisé si vous préférez modifier ou créer votre propre configuration",
+    "simplifiesIntro": "Le script simplifie le processus de création de VM en offrant les options suivantes:",
+    "simplifies": [
+      "Sélection de configuration par défaut ou avancée",
+      "Configuration de CPU, RAM, BIOS et type de machine",
+      "Choix entre disque virtuel et passthrough d’un disque physique"
+    ]
+  },
+  "config": {
+    "heading": "Configuration par défaut et avancée",
+    "intro": "Le script offre deux modes de configuration:",
+    "defaultHeading": "Configuration par défaut",
+    "defaultIntro": "Si vous sélectionnez la configuration par défaut, le script appliquera automatiquement les valeurs suivantes :",
+    "headerParam": "Paramètre",
+    "headerValue": "Valeur par défaut",
+    "defaultRows": [
+      {
+        "param": "Type de machine",
+        "value": "q35"
+      },
+      {
+        "param": "Type de BIOS",
+        "value": "OVMF (UEFI)"
+      },
+      {
+        "param": "Type de processeur",
+        "value": "Host"
+      },
+      {
+        "param": "Nombre de cœurs",
+        "value": "2"
+      },
+      {
+        "param": "Taille de la RAM",
+        "value": "4096 MB"
+      },
+      {
+        "param": "Pont",
+        "value": "vmbr0"
+      },
+      {
+        "param": "Adresse MAC",
+        "value": "Produit automatiquement"
+      },
+      {
+        "param": "Démarrer VM à la fin",
+        "value": "Non"
+      }
+    ],
+    "defaultOutro": "Si vous souhaitez personnaliser la configuration, sélectionnez l'option Paramètres avancés dans le menu.",
+    "advancedHeading": "Configuration avancée",
+    "advancedIntro": "Si vous sélectionnez la configuration avancée, le script vous permettra de personnaliser chaque paramètre:",
+    "headerOptions": "Possibilités",
+    "advancedRows": [
+      {
+        "param": "Type de machine",
+        "options": "q35 ou i440fx"
+      },
+      {
+        "param": "Type de BIOS",
+        "options": "OVMF (UEFI) ou SeaBIOS (Légacy)"
+      },
+      {
+        "param": "Type de processeur",
+        "options": "Host ou KVM64"
+      },
+      {
+        "param": "Nombre de cœurs",
+        "options": "Nombre de cœurs CPU"
+      },
+      {
+        "param": "Taille de la RAM",
+        "options": "Quantité de mémoire attribuée à la VM"
+      },
+      {
+        "param": "Pont",
+        "options": "Pont réseau pour la connexion"
+      },
+      {
+        "param": "Adresse MAC",
+        "options": "Adresse MAC personnalisée"
+      },
+      {
+        "param": "VLAN",
+        "options": "Étiquette VLAN (le cas échéant)"
+      },
+      {
+        "param": "MTU",
+        "options": "Taille maximale de l'unité de transmission"
+      }
+    ]
+  },
+  "diskSelection": {
+    "heading": "Sélection du disque",
+    "intro": "Le plan de stockage permet d’ajouter des disques virtuels, des disques physiques et des contrôleurs PCI ou périphériques NVMe. Les options de disque sont expliquées ci-dessous.",
+    "virtualHeading": "Disque virtuel",
+    "virtualItems": [
+      "Le script liste les options de stockage disponibles dans Proxmox",
+      "L'utilisateur sélectionne le disque et la taille en GB",
+      "Les disques virtuels sont connectés en <strong>SATA</strong> (sata0, sata1, etc.). Les disques de données virtuels et physiques partagent les six emplacements SATA numérotés de 0 à 5 ; le chargeur utilise un emplacement IDE distinct."
+    ],
+    "physicalHeading": "Passage de disque physique",
+    "physicalItems": [
+      "Le script détecte tous les disques physiques disponibles",
+      "L'utilisateur sélectionne le ou les disques physiques qu'il souhaite utiliser.",
+      "Les disques physiques sont connectés en <strong>SATA</strong>. Ils partagent les six emplacements SATA numérotés de 0 à 5 avec les disques de données virtuels ; il ne s’agit pas de six disques physiques supplémentaires."
+    ]
+  },
+  "loaderInstall": {
+    "heading": "Installation du chargeur",
+    "intro1": "Le script télécharge et extrait automatiquement le chargeur du dépôt du développeur. Si le téléchargement échoue, le script affichera un message d'erreur.",
+    "intro2Rich": "<strong>AuxXxilium Arc</strong>, <strong>RedPill RR</strong> et <strong>Alpine RedPill M-shell</strong> sont téléchargés et extraits automatiquement.",
+    "customRich": "Pour <strong>Chargeur personnalisé</strong>, le script recherche des fichiers dans <code>/var/lib/vz/template/iso</code>. Si plusieurs fichiers sont trouvés, vous serez invité à sélectionner le fichier souhaité.",
+    "uploadIntro": "Vous pouvez télécharger des chargeurs personnalisés à partir des options de stockage local:",
+    "imageAlt": "Ajouter un chargeur personnalisé",
+    "imageCaption": "Ajouter un chargeur personnalisé"
+  },
+  "vmCreation": {
+    "heading": "Création de VM",
+    "intro": "Une fois le chargeur téléchargé, le script crée le VM en utilisant les commandes suivantes:",
+    "items": [
+      "<code>qm create</code> – Crée la machine virtuelle avec les paramètres configurés",
+      "<code>qm importdisk</code> importe l’image du chargeur dans le stockage Proxmox. Le script la connecte ensuite à la VM sur ide0 pour la compatibilité.",
+      "<code>qm set</code> – Assigne des valeurs de configuration telles que CPU, RAM, et de stockage",
+      "<code>qm set VMID --boot order=ide0</code> définit le chargeur comme périphérique de démarrage. Remplacez VMID par l’ID de la VM."
+    ]
+  },
+  "stepGuide": {
+    "heading": "Guide de configuration du chargeur de démarrage étape par étape",
+    "intro": "Chaque chargeur possède ses menus et méthodes de configuration. Les six étapes ci-dessous expliquent le processus commun ; suivez les indications du chargeur actuel en cas de différence. Les captures M-shell montrent une ancienne interface TinyCore, tandis que le script actuel télécharge Alpine RedPill M-shell.",
+    "selectorHeading": "Sélectionnez votre type de chargeur :",
+    "loaderButtons": {
+      "arc": "Arc Loader",
+      "rr": "RR Loader",
+      "tinycore": "TinyCore Loader"
+    }
+  },
+  "steps": [
+    {
+      "id": "step1",
+      "title": "Démarrer la VM et ouvrir le menu principal",
+      "intro": "Une fois que le VM est créé, démarrez-le. La première fois que vous démarrez le VM, vous accéderez au menu principal du chargeur pour sélectionner et configurer le modèle DSM que vous souhaitez construire. Une fois le chargeur créé, cette étape sera ignorée à moins de forcer manuellement une reconfiguration à partir du moniteur de démarrage. Tous les chargeurs ont également la possibilité de configurer le chargeur via une interface web.",
+      "loaders": {
+        "arc": [
+          {
+            "htmlBefore": "<strong>Interface web</strong>, Pour accéder à l'interface Web, il suffit d'ouvrir un navigateur Web et d'entrer l'adresse IP affichée dans la sortie console de VM. Par exemple, dans notre cas: http://192.169.0.32.",
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/arc/arc_1_0_1.png",
+            "alt": "Interface web d’Arc Loader",
+            "caption": "Interface web d’Arc Loader"
+          },
+          {
+            "htmlBefore": "<strong>Interface terminal</strong> : ouvrez-la directement depuis la console de la VM.",
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/arc/arc_1_1_1.png",
+            "alt": "Interface terminal d’Arc Loader",
+            "caption": "Interface terminal d’Arc Loader"
+          }
+        ],
+        "rr": [
+          {
+            "htmlBefore": "<strong>Interface web</strong>, Pour accéder à l'interface web, il suffit d'ouvrir un navigateur Web et d'entrer l'adresse IP affichée dans la sortie console du VM, suivie du port <strong>7681</strong>. Par exemple, dans notre cas : <code>http://192.169.0.33:7681</code>.",
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/rr/rr_2_0_2.png",
+            "alt": "Exemple de commande RR",
+            "caption": "Interface Web du chargeur RR"
+          },
+          {
+            "htmlBefore": "<strong>Interface terminal</strong> : ouvrez-la depuis la console de la VM en saisissant <strong>menu.sh</strong>.",
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/rr/rr_2_1_1.png",
+            "alt": "Interface du chargeur RR",
+            "caption": "Interface du terminal du chargeur RR"
+          }
+        ],
+        "tinycore": [
+          {
+            "htmlBefore": "<strong>Interface web</strong>, Pour accéder à l'interface web, il suffit d'ouvrir un navigateur Web et d'entrer l'adresse IP affichée dans la sortie console du VM, suivie du port <strong>7681</strong>. Par exemple, dans notre cas : <code>http://192.169.0.35:7681</code>.",
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/tinycore/tinycore_3_0_1.png",
+            "alt": "Interface de TinyCore Loader",
+            "caption": "Interface Web du chargeur TinyCore"
+          },
+          {
+            "htmlBefore": "<strong>Interface terminal</strong> : ouvrez-la directement depuis la console de la VM. Surveillez l’écran : il peut vous demander d’appuyer sur une touche pour continuer ou de changer de langue.",
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/tinycore/tinycore_3_1_1.png",
+            "alt": "Interface de TinyCore Loader",
+            "caption": "Interface du terminal de chargeur TinyCore"
+          }
+        ]
+      }
+    },
+    {
+      "id": "step2",
+      "title": "Sélectionner un modèle",
+      "intro": "Après avoir chargé le menu, sélectionnez le modèle Synology DSM que vous souhaitez installer. Selon le chargeur, vous pouvez parfois avoir besoin d'élargir les options pour voir plus de modèles.",
+      "outro": "Dans notre exemple, nous choisirons le modèle SA6400.",
+      "loaders": {
+        "arc": [
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/arc/arc_1_2_1.png",
+            "alt": "Sélection du modèle Arc",
+            "caption": "Sélection du modèle Arc"
+          }
+        ],
+        "rr": [
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/rr/rr_2_2_1.png",
+            "alt": "Sélection du modèle RR",
+            "caption": "Sélection du modèle RR"
+          }
+        ],
+        "tinycore": [
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/tinycore/tinycore_3_2_1.png",
+            "alt": "Sélection du modèle TinyCore",
+            "caption": "Sélection du modèle TinyCore"
+          }
+        ]
+      }
+    },
+    {
+      "id": "step3",
+      "title": "Sélectionner la version DSM",
+      "intro": "Après avoir sélectionné le modèle, vous devez choisir la version DSM que vous souhaitez installer.",
+      "loaders": {
+        "arc": [
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/arc/arc_1_3_1.png",
+            "alt": "Sélection de la version Arc - Étape 1",
+            "caption": "Sélection de la version Arc - Étape 1"
+          },
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/arc/arc_1_3_2.png",
+            "alt": "Sélection de la version Arc - Étape 2",
+            "caption": "Sélection de la version Arc - Étape 2"
+          }
+        ],
+        "rr": [
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/rr/rr_2_3_1.png",
+            "alt": "Sélection de la version RR - Étape 1",
+            "caption": "Sélection de la version RR - Étape 1"
+          },
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/rr/rr_2_3_2.png",
+            "alt": "Sélection de la version RR - Étape 2",
+            "caption": "Sélection de la version RR - Étape 2"
+          },
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/rr/rr_2_3_3.png",
+            "alt": "Sélection de la version RR - Étape 3",
+            "caption": "Sélection de la version RR - Étape 3"
+          }
+        ],
+        "tinycore": [
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/tinycore/tinycore_3_3_1.png",
+            "alt": "Sélection de la version TinyCore - Étape 1",
+            "caption": "Sélection de la version TinyCore - Étape 1"
+          },
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/tinycore/tinycore_3_3_2.png",
+            "alt": "Sélection de la version TinyCore - Étape 2",
+            "caption": "Sélection de la version TinyCore - Étape 2"
+          }
+        ]
+      }
+    },
+    {
+      "id": "step4",
+      "title": "Sélectionner des addons",
+      "intro": "Cette étape vous permet d'ajouter des fonctionnalités supplémentaires ou des configurations personnalisées au chargeur.",
+      "loaders": {
+        "arc": [
+          {
+            "htmlBefore": "<strong>Arc</strong> vous donne la possibilité de configurer automatiquement ou manuellement les paramètres. Si la configuration automatique est sélectionnée, le chargeur commencera à appliquer les paramètres nécessaires et redémarrera automatiquement une fois le processus terminé.",
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/arc/arc_1_4_1.png",
+            "alt": "Configuration automatique d’Arc",
+            "caption": "Configuration automatique d’Arc"
+          },
+          {
+            "htmlBefore": "Si nous choisissons de ne pas utiliser le mode automatique, nous entrerons dans le menu pour configurer différentes options nécessaires pour le chargeur:",
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/arc/arc_1_4_2.png",
+            "alt": "Configuration manuelle d’Arc",
+            "caption": "Configuration manuelle d’Arc"
+          },
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/arc/arc_1_4_3.png",
+            "alt": "Configuration SN/MAC dans Arc",
+            "caption": "Configuration SN/MAC dans Arc"
+          },
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/arc/arc_1_4_4.png",
+            "alt": "Arc Sata Portmap",
+            "caption": "Arc Sata Portmap (utilisez l'option recommandée)"
+          },
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/arc/arc_1_4_5.png",
+            "alt": "Sélection des extensions dans Arc",
+            "caption": "Sélection des extensions dans Arc"
+          }
+        ],
+        "rr": [
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/rr/rr_2_4_1.png",
+            "alt": "Extension RR — étape 1",
+            "caption": "Extension RR — étape 1"
+          },
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/rr/rr_2_4_2.png",
+            "alt": "Extension RR — étape 2",
+            "caption": "Extension RR — étape 2 : cliquez pour ajouter des extensions."
+          },
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/rr/rr_2_4_3.png",
+            "alt": "Extension RR — étape 3",
+            "caption": "Extension RR — étape 3 : cliquez sur celle de votre choix. Pour en ajouter d’autres, répétez les actions des images 2.4.2 et 2.4.3."
+          }
+        ],
+        "tinycore": [
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/tinycore/tinycore_3_4_1.png",
+            "alt": "Configuration de TinyCore SN",
+            "caption": "Configuration de TinyCore SN"
+          },
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/tinycore/tinycore_3_4_2.png",
+            "alt": "Option aléatoire TinyCore",
+            "caption": "Option aléatoire TinyCore - L'option aléatoire est recommandée"
+          },
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/tinycore/tinycore_3_4_3.png",
+            "alt": "Configuration MAC de TinyCore",
+            "caption": "Configuration MAC de TinyCore"
+          },
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/tinycore/tinycore_3_4_4.png",
+            "alt": "TinyCore VM MAC",
+            "caption": "TinyCore VM MAC - Choisissez d'utiliser la MAC de votre VM ou une MAC aléatoire"
+          }
+        ]
+      }
+    },
+    {
+      "id": "step5",
+      "title": "Construisez le chargeur",
+      "intro": "Une fois que vous avez sélectionné le modèle, la version DSM et les addons, procédez à la construction du chargeur. Ce processus peut prendre quelques minutes en fonction du chargeur et de la configuration sélectionnée. Pour démarrer, sélectionnez l'option \"Construire le chargeur\".",
+      "loaders": {
+        "arc": [
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/arc/arc_1_5_1.png",
+            "alt": "Construction du chargeur dans Arc",
+            "caption": "Construction du chargeur dans Arc"
+          }
+        ],
+        "rr": [
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/rr/rr_2_5_1.png",
+            "alt": "Construction du chargeur dans RR",
+            "caption": "Construction du chargeur dans RR"
+          }
+        ],
+        "tinycore": [
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/tinycore/tinycore_3_5_1.png",
+            "alt": "Construction du chargeur dans TinyCore",
+            "caption": "Construction du chargeur dans TinyCore"
+          }
+        ]
+      }
+    },
+    {
+      "id": "step6",
+      "title": "Démarrer le chargeur",
+      "intro": "Une fois le chargeur construit, il vous invite à démarrer. Le VM redémarre avec la configuration que vous avez créée et démarre l'installation DSM.",
+      "loaders": {
+        "arc": [
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/arc/arc_1_6_1.png",
+            "alt": "Démarrage du chargeur dans Arc",
+            "caption": "Démarrage du chargeur dans Arc"
+          }
+        ],
+        "rr": [
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/rr/rr_2_6_1.png",
+            "alt": "Démarrage du chargeur dans RR",
+            "caption": "Démarrage du chargeur dans RR"
+          }
+        ],
+        "tinycore": [
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/tinycore/tinycore_3_6_1.png",
+            "alt": "Démarrage du chargeur dans TinyCore",
+            "caption": "Démarrage du chargeur dans TinyCore"
+          }
+        ]
+      }
+    }
+  ],
+  "dsmInstall": {
+    "heading": "Démarrer l'installation DSM",
+    "intro": "Une fois le chargeur démarré, vous pouvez trouver votre appareil Synology en utilisant:",
+    "afterCode": "Suivez les étapes à l'écran pour terminer l'installation de DSM.",
+    "setupAlt": "Configuration de DSM",
+    "setupCaption": "Écran de configuration de DSM",
+    "patience": "Veuillez être patient – Le processus peut prendre quelques minutes. Le pourcentage de progression sera automatiquement mis à jour au fur et à mesure que la configuration progresse. Un compte à rebours démarrera lorsque l'installation sera presque terminée.",
+    "finishAlt": "Installation terminée",
+    "finishCaption": "Installation terminée"
+  },
+  "tips": {
+    "heading": "Conseils",
+    "introItem": "Gardez à l'esprit que les options disponibles peuvent changer en fonction de la version du chargeur et des mises à jour du développeur. Si vous rencontrez des problèmes lors de la création du chargeur, consultez la documentation du chargeur:",
+    "docLinks": [
+      {
+        "label": "Documentation Arc",
+        "url": "https://github.com/AuxXxilium/arc"
+      },
+      {
+        "label": "Documentation RR",
+        "url": "https://github.com/RROrg/rr"
+      },
+      {
+        "label": "Documentation TinyCore",
+        "url": "https://github.com/PeterSuh-Q3/tinycore-redpill"
+      }
+    ],
+    "olderModels": "Certains modèles DSM plus anciens peuvent avoir des problèmes à reconnaître les disques ou la carte réseau. Il est recommandé d'utiliser des modèles plus récents.",
+    "updateLabel": "Mise à jour :",
+    "updateBody": "Certains chargeurs offrent l'option de mettre à jour le chargeur directement depuis le menu.",
+    "importantLabel": "Important:",
+    "importantBody": "ProxMenux ne fournit pas de support pour les différents chargeurs."
+  }
+}
diff --git a/web/messages/fr/docs/create-vm/system-linux.json b/web/messages/fr/docs/create-vm/system-linux.json
new file mode 100644
index 00000000..1c32cba1
--- /dev/null
+++ b/web/messages/fr/docs/create-vm/system-linux.json
@@ -0,0 +1,292 @@
+{
+  "meta": {
+    "title": "Créer une VM : système Linux | Documentation ProxMenux",
+    "description": "Créez des machines virtuelles Linux sur Proxmox VE avec ProxMenux. Découvrez le catalogue d’ISO officielles (Ubuntu, Debian, Fedora, Arch, Rocky, Mint, openSUSE, Alpine, Kali, Manjaro), le plan de stockage commun, le passthrough GPU facultatif et les conseils après installation.",
+    "ogTitle": "Créer une VM : système Linux | Documentation ProxMenux",
+    "ogDescription": "Créez des VM Linux sur Proxmox VE : catalogue d’ISO officielles, stockage, passthrough GPU et conseils après installation.",
+    "ogImageAlt": "Menu ProxMenux Linux VM"
+  },
+  "header": {
+    "title": "Créer une VM : système Linux",
+    "description": "Créez une VM Linux sur Proxmox VE. ProxMenux propose un catalogue d’ISO Linux officielles à télécharger et un sélecteur d’ISO locales. Chaque parcours passe par l’assistant VM commun, le plan de stockage et l’assistant facultatif de passthrough GPU.",
+    "section": "Machines virtuelles"
+  },
+  "intro": {
+    "title": "Ce que ce script fait",
+    "body": "Choisissez une ISO Linux officielle à télécharger automatiquement ou une ISO locale déjà chargée. L’assistant commun passe ensuite par CPU, RAM et BIOS, le plan de stockage, le passthrough GPU facultatif et la création de la VM."
+  },
+  "image": {
+    "alt": "Options d'installation de ProxMenux Linux",
+    "caption": "Options d'installation Linux"
+  },
+  "config": {
+    "heading": "Configuration par défaut vs Configuration avancée",
+    "intro": "Une fois l'ISO sélectionné, ProxMenux demande s'il faut utiliser le profil VM par défaut ou ouvrir l'assistant avancé.",
+    "defaultHeading": "Configuration par défaut",
+    "headerParam": "Paramètre",
+    "headerValue": "Valeur par défaut",
+    "defaultRows": [
+      {
+        "param": "Type de machine",
+        "valueRich": "<code>q35</code>"
+      },
+      {
+        "param": "BIOS",
+        "value": "OVMF (UEFI)"
+      },
+      {
+        "param": "Type CPU",
+        "value": "Host"
+      },
+      {
+        "param": "Noyaux",
+        "value": "2"
+      },
+      {
+        "param": "RAM",
+        "value": "4096 MB"
+      },
+      {
+        "param": "Pont",
+        "valueRich": "<code>vmbr0</code>"
+      },
+      {
+        "param": "Adresse MAC",
+        "value": "Généré automatiquement"
+      },
+      {
+        "param": "Démarrer à la fin",
+        "value": "Non"
+      }
+    ],
+    "advancedHeading": "Configuration avancée",
+    "advancedIntro": "L'assistant avancé expose chaque paramètre individuellement :",
+    "headerOptions": "Possibilités",
+    "advancedRows": [
+      {
+        "param": "Type de machine",
+        "optionsRich": "<code>q35</code> ou <code>i440fx</code>"
+      },
+      {
+        "param": "BIOS",
+        "options": "OVMF (UEFI) ou SeaBIOS (Légacy)"
+      },
+      {
+        "param": "Type CPU",
+        "options": "Host, KVM64 et autres modèles CPU proposés"
+      },
+      {
+        "param": "Noyaux",
+        "options": "Nombre de cœurs CPU"
+      },
+      {
+        "param": "RAM",
+        "options": "Mémoire attribuée au VM"
+      },
+      {
+        "param": "Pont",
+        "options": "Pont réseau"
+      },
+      {
+        "param": "Adresse MAC",
+        "options": "MAC personnalisée"
+      },
+      {
+        "param": "VLAN",
+        "options": "Étiquette VLAN (facultatif)"
+      },
+      {
+        "param": "MTU",
+        "options": "Taille MTU"
+      }
+    ]
+  },
+  "storagePlan": {
+    "heading": "Plan de stockage",
+    "body": "Après CPU / RAM, ProxMenux ouvre le menu <strong>Plan de stockage</strong>, où vous pouvez combiner des disques virtuels, des disques importés et des périphériques PCI passants dans le même VM, ajoutant des éléments un à la fois et finissant lorsque vous avez terminé.",
+    "virtualDiskTitle": "a. Ajouter un disque virtuel",
+    "virtualDiskItems": [
+      "Liste les volumes de stockage Proxmox disponibles sur l'hôte.",
+      "Vous choisissez le stockage cible et la taille en GB.",
+      "Le disque utilise le bus choisi : SCSI (par défaut), SATA, VirtIO ou IDE. SATA offre six emplacements numérotés de 0 à 5 : <code>sata0</code>, <code>sata1</code>, …."
+    ],
+    "importDiskTitle": "b. Ajouter un disque d'importation",
+    "importDiskItems": [
+      "Détecte les disques physiques qui sont sûrs à importer (le système et les disques protégés sont cachés).",
+      "Vous sélectionnez un ou plusieurs disques via une liste de contrôle.",
+      "Les disques importés utilisent le bus choisi et sont connectés par <code>qm set</code>."
+    ],
+    "pciTitle": "c. Ajouter un contrôleur ou NVMe (passthrough PCI)",
+    "pciItems": [
+      "Détecte les appareils HBA SATA/SAS et NVMe sur l'hôte et vous permet de passer un contrôleur <em>entier</em> dans le VM. IOMMU doit être activé ; le script offre de l'activer et de redémarrer si nécessaire.",
+      "Une étape de confirmation met en garde contre le risque à l'échelle du contrôleur (la carte entière, y compris chaque disque sur elle, quitte l'hôte).",
+      "Les périphériques PCI sont affectés avec des commandes comme <code>qm set VMID --hostpci0 PCI_ADDRESS,pcie=1</code>. Remplacez VMID et PCI_ADDRESS par l’ID de VM et l’adresse PCI, et utilisez un indice hostpci libre pour chaque périphérique."
+    ],
+    "resetTitle": "Réinitialiser et terminer",
+    "resetBody": "Le menu offre également <strong>r</strong> (réinitialiser la sélection actuelle et recommencer) et <strong>d</strong> (finir et poursuivre). Vous ne pouvez pas finir avec un plan vide."
+  },
+  "gpu": {
+    "heading": "Passage facultatif de GPU",
+    "body": "Après le plan de stockage, si un GPU compatible est détecté sur l'hôte ProxMenux offre de lancer l'assistant de passage GPU. Voir <gpuLink>Ajouter GPU à un VM (Passthrough)</gpuLink> pour savoir comment fonctionne l'assistant — un redémarrage d'hôte peut être nécessaire."
+  },
+  "autoFeatures": {
+    "heading": "Fonctions automatiques VM",
+    "efiTitle": "disque EFI",
+    "efiBody": "Lorsque OVMF (UEFI) est sélectionné, ProxMenux crée un disque système EFI 4 MB sur le stockage que vous choisissez afin que le firmware ait un endroit pour stocker ses variables.",
+    "isoTitle": "Montage ISO",
+    "isoBody": "L'installation ISO est fixée à <code>ide2</code> en tant que CD-ROM, prêt pour le premier démarrage.",
+    "guestTitle": "QEMU Agent invité",
+    "guestBody": "Le canal d'agent invité est activé dans la configuration VM. Vous devez toujours installer l'agent à l'intérieur de l'invité — voir les conseils ci-dessous."
+  },
+  "installOptions": {
+    "heading": "Options d'installation Linux",
+    "officialHeading": "ISO officielle (installation traditionnelle)",
+    "officialBody": "ProxMenux propose une sélection d’ISO Linux officielles. Choisissez-en une : le script la télécharge depuis le miroir du projet dans <code>/var/lib/vz/template/iso</code>, puis la connecte à la VM.",
+    "officialImageAlt": "Sélection de distribution Linux",
+    "officialImageCaption": "Sélection de distribution Linux",
+    "localHeading": "ISO locale",
+    "localBody": "Utilise une ISO Linux déjà présente dans <code>/var/lib/vz/template/iso</code>. Le script affiche tous les fichiers <code>*.iso</code> trouvés et vous permet d’en choisir un.",
+    "localImageAlt": "Menu local de sélection ISO",
+    "localImageCaption": "Menu local de sélection ISO",
+    "distros": [
+      {
+        "name": "Ubuntu",
+        "variants": [
+          "25.10 Desktop",
+          "24.04 Desktop",
+          "22.04 Desktop",
+          "20.04 Desktop",
+          "25.10 Server",
+          "24.04 Server",
+          "22.04 Server",
+          "20.04 Server"
+        ]
+      },
+      {
+        "name": "Debian",
+        "variants": [
+          "13 Desktop",
+          "12 Desktop",
+          "11 Desktop",
+          "13 Netinst",
+          "12 Netinst",
+          "11 Netinst"
+        ]
+      },
+      {
+        "name": "Fedora",
+        "variants": [
+          "Workstation 42"
+        ]
+      },
+      {
+        "name": "Arch Linux",
+        "variants": [
+          "dernière version"
+        ]
+      },
+      {
+        "name": "Rocky Linux",
+        "variants": [
+          "9"
+        ]
+      },
+      {
+        "name": "Linux Mint",
+        "variants": [
+          "22.1 Cinnamon"
+        ]
+      },
+      {
+        "name": "openSUSE",
+        "variants": [
+          "Leap 15.6"
+        ]
+      },
+      {
+        "name": "Alpine Linux",
+        "variants": [
+          "3.21"
+        ]
+      },
+      {
+        "name": "Kali Linux",
+        "variants": [
+          "2026.1"
+        ]
+      },
+      {
+        "name": "Manjaro",
+        "variants": [
+          "25.0 GNOME"
+        ]
+      }
+    ]
+  },
+  "endToEnd": {
+    "heading": "Ce que fait le script de bout en bout",
+    "items": [
+      "Récupère l’ISO Linux par téléchargement officiel ou depuis un fichier local.",
+      "Applique la configuration par défaut ou avancée CPU / RAM / BIOS / type machine.",
+      "Ouvre le plan de stockage et fixe les disques virtuels sélectionnés, les disques importés et les périphériques PCI.",
+      "Crée le disque EFI lorsque UEFI est sélectionné.",
+      "Monte l'ISO Linux sur <code>ide2</code>.",
+      "Définit l'ordre de démarrage (disque d'abord, puis ISO).",
+      "Active le canal QEMU Guest Agent.",
+      "En option, exécute l'assistant de passage GPU.",
+      "Génère une description HTML de style jointe au VM.",
+      "Démarre la VM si vous l’avez choisi."
+    ]
+  },
+  "postInstall": {
+    "heading": "Conseils après l'installation",
+    "guestAgentHeading": "Installez l’agent invité QEMU dans la VM",
+    "guestAgentBody": "ProxMenux active le canal de l’agent invité dans la configuration VM ; l’agent doit être installé dans le système invité. Il permet l’arrêt contrôlé et le gel des systèmes de fichiers pendant les sauvegardes pour améliorer la cohérence des données.",
+    "debian": "Debian / Ubuntu",
+    "fedora": "Fedora / Rocky / RHEL",
+    "arch": "Arch Linux",
+    "opensuse": "openSUSE",
+    "virtioHeading": "Support VirtIO sous Linux",
+    "virtioBody": "Les distributions Linux modernes incluent généralement les pilotes VirtIO de disque et réseau. Choisissez <code>virtio</code> pour les disques blocs VirtIO, ou <code>scsi</code> avec le contrôleur VirtIO SCSI configuré ; l’adaptateur réseau utilise aussi <code>virtio</code>. Vérifiez les pilotes avec les anciens installateurs.",
+    "virtioWarnTitle": "Distributions très anciennes",
+    "virtioWarnBody": "Les très anciens installateurs peuvent manquer des pilotes VirtIO nécessaires. Utilisez alors un contrôleur SATA / SCSI émulé ou fournissez les pilotes adaptés.",
+    "trimHeading": "Activer TRIM / discard sur un stockage SSD",
+    "trimBody": "Si la VM utilise un stockage Proxmox sur SSD et que le disque a été connecté avec l’option <code>discard</code>, vous pouvez transmettre les commandes TRIM du système invité. Deux possibilités :",
+    "trimItems": [
+      "Exécuter périodiquement <code>fstrim -av</code> (ou activer l'unité <code>fstrim.timer</code> sur les distributions systemd).",
+      "Ou monter des systèmes de fichiers avec l'option <code>discard</code> dans <code>/etc/fstab</code>."
+    ],
+    "balloonHeading": "Allocation dynamique de mémoire (ballooning)",
+    "balloonBody": "Les noyaux Linux modernes incluent généralement le pilote <code>virtio_balloon</code>. Avec le périphérique balloon activé, Proxmox peut recueillir des statistiques mémoire. La récupération dynamique nécessite aussi une mémoire minimale inférieure au maximum configuré ; des valeurs égales maintiennent une allocation fixe."
+  },
+  "related": {
+    "heading": "Voir aussi",
+    "items": [
+      {
+        "href": "/docs/disk-manager/import-disk-image-vm",
+        "label": "Importer l'image disque vers la VM",
+        "tail": " — connecter une image Linux existante .qcow2 / .img / .raw à une nouvelle VM."
+      },
+      {
+        "href": "/docs/utils/import-vm",
+        "label": "Importer VM de OVA / OVF",
+        "tail": " — importer une VM Linux exportée depuis VMware / VirtualBox / Proxmox."
+      },
+      {
+        "href": "/docs/hardware/gpu-vm-passthrough",
+        "label": "Ajouter GPU à VM (Passthrough)",
+        "tail": "— pour les VM Linux qui ont besoin d'accélération GPU."
+      },
+      {
+        "href": "/docs/help-info/vm-ct-commands",
+        "label": "Commandes de gestion VM et CT",
+        "tail": "— qm CLI référence."
+      },
+      {
+        "href": "/docs/create-vm",
+        "label": "Vue d’ensemble de la création de VM",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/fr/docs/create-vm/system-nas/index.json b/web/messages/fr/docs/create-vm/system-nas/index.json
new file mode 100644
index 00000000..0fc25ad3
--- /dev/null
+++ b/web/messages/fr/docs/create-vm/system-nas/index.json
@@ -0,0 +1,147 @@
+{
+  "meta": {
+    "title": "Créer une VM NAS | Documentation ProxMenux",
+    "description": "Créez des VM NAS sur Proxmox VE avec ProxMenux : Synology DSM avec chargeur, TrueNAS SCALE/CORE, OpenMediaVault, XigmaNAS, Rockstor, ZimaOS et FygoOS. Umbrel OS est disponible via un script communautaire.",
+    "ogTitle": "Créer une VM NAS | Documentation ProxMenux",
+    "ogDescription": "Créez des VM NAS sur Proxmox VE avec ProxMenux : Synology DSM avec chargeur, TrueNAS SCALE/CORE, OpenMediaVault, XigmaNAS, Rockstor, ZimaOS et FygoOS.",
+    "ogImageAlt": "Menu du NAS système ProxMenux"
+  },
+  "header": {
+    "title": "Créer une VM NAS",
+    "description": "ProxMenux prend en charge huit systèmes d'exploitation NAS en tant que VM dédiés, plus un chemin Umbrel OS optionnel via un script communautaire. La plupart des systèmes partagent le même flux auto-ISO; Synology DSM utilise un assistant de chargeur spécialisé.",
+    "section": "Machines virtuelles"
+  },
+  "intro": {
+    "title": "Comment fonctionne le sélecteur de NAS",
+    "body": "Pour le parcours ISO générique, le sélecteur tente de détecter la dernière version stable sur le miroir du projet, utilise une version de secours si nécessaire, télécharge l’ISO et ouvre le configurateur commun pour CPU, RAM, disques et réseau. Synology DSM et ZimaOS utilisent des installateurs spécifiques."
+  },
+  "image": {
+    "alt": "Sélecteur de NAS système ProxMenux",
+    "caption": "Sélecteur de NAS système"
+  },
+  "flowBadges": {
+    "loader": "Procédure avec chargeur",
+    "auto-iso": "Procédure ISO automatique",
+    "dedicated": "Script dédié"
+  },
+  "labels": {
+    "base": "Base",
+    "fileSystem": "Système de fichiers",
+    "viewDetails": "Afficher les détails"
+  },
+  "supported": {
+    "heading": "Systèmes NAS pris en charge",
+    "cards": [
+      {
+        "name": "Synology DSM",
+        "tagline": "DiskStation Manager avec le chargeur ARC / RR. Nécessite la configuration du chargeur avant le premier démarrage.",
+        "icon": "HardDrive",
+        "base": "Linux (sur mesure)",
+        "fileSystem": "Btrfs, ext4",
+        "href": "/docs/create-vm/system-nas/synology",
+        "flow": "loader"
+      },
+      {
+        "name": "TrueNAS SCALE",
+        "tagline": "TrueNAS basé sur Debian avec des applications Docker dans les versions actuelles et ZFS comme système de fichiers principal. Les anciennes versions de SCALE utilisaient Kubernetes.",
+        "icon": "Database",
+        "base": "Debian Linux",
+        "fileSystem": "ZFS",
+        "href": "/docs/create-vm/system-nas/system-nas-others#truenas-scale",
+        "flow": "auto-iso"
+      },
+      {
+        "name": "TrueNAS CORE",
+        "tagline": "TrueNAS basé sur FreeBSD, axé sur le stockage ZFS. Les jails et plugins de CORE 13.3 sont obsolètes et non pris en charge.",
+        "icon": "Database",
+        "base": "FreeBSD",
+        "fileSystem": "ZFS",
+        "href": "/docs/create-vm/system-nas/system-nas-others#truenas-core",
+        "flow": "auto-iso"
+      },
+      {
+        "name": "OpenMediaVault",
+        "tagline": "NAS léger basé sur Debian avec une architecture modulaire plugin. Parfait pour le matériel plus ancien.",
+        "icon": "Server",
+        "base": "Debian Linux",
+        "fileSystem": "ext4, XFS, Btrfs",
+        "href": "/docs/create-vm/system-nas/system-nas-others#openmediavault",
+        "flow": "auto-iso"
+      },
+      {
+        "name": "XigmaNAS",
+        "tagline": "NAS basé sur FreeBSD — le successeur original de FreeNAS, axé sur ZFS et la simplicité.",
+        "icon": "Database",
+        "base": "FreeBSD",
+        "fileSystem": "ZFS, UFS",
+        "href": "/docs/create-vm/system-nas/system-nas-others#xigmanas",
+        "flow": "auto-iso"
+      },
+      {
+        "name": "Rockstor",
+        "tagline": "NAS openSUSE construit autour de Btrfs. Rock-ons (applications Docker) prolongent la fonctionnalité.",
+        "icon": "HardDrive",
+        "base": "openSUSE Leap",
+        "fileSystem": "Btrfs",
+        "href": "/docs/create-vm/system-nas/system-nas-others#rockstor",
+        "flow": "auto-iso"
+      },
+      {
+        "name": "ZimaOS",
+        "tagline": "Léger NAS OS axé sur les médias, les applications Docker et la domotique. Utilise son propre installateur.",
+        "icon": "MonitorIcon",
+        "base": "Buildroot (issu de CasaOS)",
+        "fileSystem": "ext4",
+        "href": "/docs/create-vm/system-nas/system-nas-others#zimaos",
+        "flow": "dedicated"
+      },
+      {
+        "name": "FygoOS",
+        "tagline": "Edition internationale de fnOS : un NAS basé sur Debian avec des volumes de stockage, des applications et du streaming multimédia, géré depuis son interface web et les applications Fygo.",
+        "icon": "Server",
+        "base": "Debian Linux",
+        "fileSystem": "Btrfs, ext4",
+        "href": "/docs/create-vm/system-nas/system-nas-others#fygoos",
+        "flow": "auto-iso"
+      }
+    ]
+  },
+  "umbrel": {
+    "title": "Option communautaire: Umbrel OS",
+    "bodyRich": "La neuvième entrée du menu NAS est <strong>Umbrel OS</strong>. Elle lance un <umbrelLink>installateur community-scripts</umbrelLink> maintenu hors de ProxMenux et non documenté ici. L’installateur gère tout le parcours et affiche les identifiants par défaut à la fin."
+  },
+  "zfsMem": {
+    "title": "Repère pour la mémoire ZFS",
+    "bodyRich": "Pour TrueNAS, prévoyez au moins <strong>8 Go de RAM</strong> pour un usage de base, davantage pour les charges lourdes. ZFS utilise la RAM pour le cache ARC, sans seuil universel de 8 Go pour tous les NAS ZFS. Vérifiez les exigences de la distribution et dimensionnez selon disques, services et applications ; OMV ou Rockstor en configuration légère peuvent demander moins."
+  },
+  "related": {
+    "heading": "Voir aussi",
+    "items": [
+      {
+        "href": "/docs/create-vm/system-nas/synology",
+        "label": "VM Synology",
+        "tail": "— installateur dédié pour Synology DSM (Xpenology) sur Proxmox."
+      },
+      {
+        "href": "/docs/create-vm/system-nas/system-nas-others",
+        "label": "Autre NAS système",
+        "tail": "— TrueNAS, OpenMediaVault, Rockstor, XigmaNAS, FygoOS et similaires."
+      },
+      {
+        "href": "/docs/disk-manager/import-disk-vm",
+        "label": "Importer le disque vers la VM",
+        "tail": "— passer les vrais disques physiques au NAS VM (recommandé sur les disques virtuels pour la production)."
+      },
+      {
+        "href": "/docs/help-info/zfs-commands",
+        "label": "Commandes de gestion ZFS",
+        "tail": "— utile si votre distribution NAS utilise ZFS ci-dessous."
+      },
+      {
+        "href": "/docs/create-vm",
+        "label": "Vue d’ensemble de la création de VM",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/fr/docs/create-vm/system-nas/synology.json b/web/messages/fr/docs/create-vm/system-nas/synology.json
new file mode 100644
index 00000000..0a3636ed
--- /dev/null
+++ b/web/messages/fr/docs/create-vm/system-nas/synology.json
@@ -0,0 +1,400 @@
+{
+  "meta": {
+    "title": "Créer une VM : Synology DSM | Documentation ProxMenux",
+    "description": "Créez une VM Synology DSM sur Proxmox VE. ProxMenux télécharge le chargeur choisi (Arc, RR, Alpine RedPill M-shell ou une image personnalisée), l’importe comme disque de démarrage et configure CPU, RAM et stockage avec l’assistant par défaut ou avancé.",
+    "ogTitle": "Créer une VM : Synology DSM | Documentation ProxMenux",
+    "ogDescription": "Créez une machine virtuelle Synology DSM sur Proxmox VE avec ProxMenux."
+  },
+  "header": {
+    "title": "Créer une VM : Synology DSM",
+    "description": "Créez une VM Synology DSM sur Proxmox VE. ProxMenux télécharge le chargeur choisi (Arc, RR, Alpine RedPill M-shell ou une image personnalisée), l’importe comme disque de démarrage et configure CPU, RAM et stockage avec l’assistant par défaut ou avancé.",
+    "section": "Machines virtuelles · NAS"
+  },
+  "loaderLabels": {
+    "arc": "Arc Loader",
+    "rr": "RR Loader",
+    "tinycore": "TinyCore Loader"
+  },
+  "whatThisDoes": {
+    "title": "Ce que ça fait",
+    "bodyRich": "ProxMenux automatise la préparation de la VM pour Synology DSM : téléchargement d’un chargeur pris en charge, importation comme disque de démarrage IDE et application des réglages CPU, RAM, réseau et stockage choisis. La construction du chargeur, le choix du modèle et l’installation DSM se font <strong>dans la VM</strong>, avec l’interface web ou terminal du chargeur. Ces étapes communautaires changent souvent ; cette page fournit une base de travail."
+  },
+  "supportedLoaders": {
+    "heading": "Chargeurs pris en charge",
+    "intro": "Le script propose quatre sources de chargeur :",
+    "loaders": [
+      {
+        "name": "AuxXxilium Arc",
+        "url": "https://github.com/AuxXxilium/arc"
+      },
+      {
+        "name": "RedPill RR",
+        "url": "https://github.com/RROrg/rr"
+      },
+      {
+        "name": "Alpine RedPill M-shell (projet TinyCore)",
+        "url": "https://github.com/PeterSuh-Q3/tinycore-redpill"
+      }
+    ],
+    "customRich": "<strong>Chargeur personnalisé</strong> — déposez votre propre image de chargeur dans <code>/var/lib/vz/template/iso</code> et le script le récupérera."
+  },
+  "config": {
+    "heading": "Configuration par défaut vs Configuration avancée",
+    "intro": "Au lancement, le script demande si vous voulez utiliser le profil VM ProxMenux par défaut ou ouvrir l’assistant avancé. Les valeurs par défaut sont adaptées à DSM et conviennent à la plupart des installations.",
+    "defaultHeading": "Configuration par défaut",
+    "headerParam": "Paramètre",
+    "headerValue": "Valeur par défaut",
+    "defaultRowsRich": [
+      {
+        "param": "Type de machine",
+        "valueRich": "<code>q35</code>"
+      },
+      {
+        "param": "BIOS",
+        "valueRich": "OVMF (UEFI)"
+      },
+      {
+        "param": "Type CPU",
+        "valueRich": "Host"
+      },
+      {
+        "param": "Cœurs",
+        "valueRich": "2"
+      },
+      {
+        "param": "RAM",
+        "valueRich": "4096 MB"
+      },
+      {
+        "param": "Pont",
+        "valueRich": "<code>vmbr0</code>"
+      },
+      {
+        "param": "Adresse MAC",
+        "valueRich": "Généré automatiquement"
+      },
+      {
+        "param": "Démarrer à la fin",
+        "valueRich": "Non"
+      }
+    ],
+    "advancedHeading": "Configuration avancée",
+    "advancedIntro": "L’assistant avancé présente chaque paramètre séparément. Vous pouvez modifier les valeurs suivantes :",
+    "headerOptions": "Possibilités",
+    "advancedRowsRich": [
+      {
+        "param": "Type de machine",
+        "optionsRich": "<code>q35</code> ou <code>i440fx</code>"
+      },
+      {
+        "param": "BIOS",
+        "optionsRich": "OVMF (UEFI) ou SeaBIOS (Légacy)"
+      },
+      {
+        "param": "Type CPU",
+        "optionsRich": "Host ou KVM64"
+      },
+      {
+        "param": "Cœurs",
+        "optionsRich": "Nombre de cœurs CPU"
+      },
+      {
+        "param": "RAM",
+        "optionsRich": "Mémoire attribuée à la VM"
+      },
+      {
+        "param": "Pont",
+        "optionsRich": "Pont réseau"
+      },
+      {
+        "param": "Adresse MAC",
+        "optionsRich": "MAC personnalisée"
+      },
+      {
+        "param": "VLAN",
+        "optionsRich": "Étiquette VLAN (facultatif)"
+      },
+      {
+        "param": "MTU",
+        "optionsRich": "Taille MTU"
+      }
+    ]
+  },
+  "storagePlan": {
+    "heading": "Plan de stockage",
+    "introRich": "Après CPU et RAM, ProxMenux ouvre le menu <strong>Plan de stockage</strong>. Vous pouvez y <strong>combiner</strong> disques virtuels, disques importés et périphériques PCI en passthrough dans la même VM. Ajoutez les éléments un par un, puis terminez le plan.",
+    "virtualHeading": "a. Ajouter un disque virtuel",
+    "virtualItemsRich": [
+      "Liste les volumes de stockage Proxmox disponibles sur l'hôte.",
+      "Vous choisissez le stockage cible et la taille en GB.",
+      "Le disque est connecté en SATA (<code>sata0</code>, <code>sata1</code>, …). Les disques de données virtuels et physiques partagent les six emplacements SATA numérotés de 0 à 5."
+    ],
+    "importHeading": "b. Ajouter un disque d'importation",
+    "importItemsRich": [
+      "Détecte les disques physiques qui sont sûrs à importer (le système et les disques protégés sont cachés).",
+      "Vous sélectionnez un ou plusieurs disques via une liste de contrôle.",
+      "Les disques importés sont attachés comme SATA via <code>qm set</code>."
+    ],
+    "pciHeading": "c. Ajouter un contrôleur ou NVMe (passthrough PCI)",
+    "pciItemsRich": [
+      "Détecte les appareils HBA SATA/SAS et NVMe sur l'hôte et vous permet de passer un contrôleur <em>entier</em> dans le VM. IOMMU doit être activé ; le script offre de l'activer et de redémarrer si nécessaire.",
+      "Une étape de confirmation met en garde contre le risque à l'échelle du contrôleur (la carte entière, y compris chaque disque sur elle, quitte l'hôte).",
+      "Les périphériques PCI sont affectés avec des commandes comme <code>qm set VMID --hostpci0 PCI_ADDRESS,pcie=1</code>. Remplacez VMID et PCI_ADDRESS par l’ID de VM et l’adresse PCI, et utilisez un indice hostpci libre pour chaque périphérique."
+    ],
+    "resetCalloutTitle": "Réinitialiser et terminer",
+    "resetCalloutBodyRich": "Le menu offre également <strong>r</strong> (réinitialiser la sélection actuelle et recommencer) et <strong>d</strong> (finir et poursuivre). Vous ne pouvez pas terminer avec un plan vide — Synology a besoin d'au moins un disque pour installer DSM."
+  },
+  "gpu": {
+    "heading": "Passage facultatif de GPU",
+    "bodyRich": "Après le plan de stockage, si le script détecte un GPU compatible sur l'hôte, il demande si vous voulez le transmettre à ce VM. Voir <link>Ajouter GPU à un VM (Passthrough)</link> pour savoir comment fonctionne l'assistant — un redémarrage d'hôte peut être nécessaire."
+  },
+  "loaderInstall": {
+    "heading": "Installation du chargeur",
+    "intro1Rich": "<strong>Arc</strong>, <strong>RR</strong> et <strong>Alpine RedPill M-shell</strong> sont téléchargés et extraits automatiquement depuis leurs dépôts GitHub d’origine. En cas d’échec, le script s’arrête avec un message clair.",
+    "intro2Rich": "Pour l'option <strong>Custom Loader</strong> le script scanne <code>/var/lib/vz/template/iso</code>. Si plus d'un candidat est trouvé, vous êtes invité à choisir celui que vous voulez.",
+    "uploadIntro": "Vous pouvez télécharger des chargeurs personnalisés à partir du stockage local Proxmox:",
+    "imageAlt": "Ajouter un chargeur personnalisé",
+    "imageCaption": "Ajouter un chargeur personnalisé"
+  },
+  "vmCreation": {
+    "heading": "Création VM — ce que le script exécute",
+    "introRich": "Une fois que vous avez confirmé le chargeur, ProxMenux exécute l'équivalent de ces commandes <code>qm</code> :",
+    "itemsRich": [
+      "<code>qm create</code> — crée la VM avec CPU, RAM, BIOS et type de machine choisis.",
+      "<code>qm importdisk</code> importe l’image du chargeur dans le stockage Proxmox. Le script la connecte ensuite comme disque <strong>IDE</strong> sur ide0 pour la compatibilité.",
+      "<code>qm set VMID --sata0 DISK_REFERENCE</code> connecte un disque de données du plan. Remplacez VMID et DISK_REFERENCE par l’ID de VM et la référence du disque ; utilisez un indice SATA libre de 0 à 5. Le réseau est configuré par qm create.",
+      "<code>qm set VMID --hostpci0 PCI_ADDRESS,pcie=1</code> affecte un contrôleur PCI ou périphérique NVMe choisi. Remplacez VMID et PCI_ADDRESS par l’ID de VM et l’adresse PCI, et utilisez un indice hostpci libre par périphérique.",
+      "<code>qm set VMID --boot order=ide0</code> définit le chargeur comme périphérique de démarrage. Remplacez VMID par l’ID de la VM."
+    ]
+  },
+  "stepByStep": {
+    "heading": "Configuration du chargeur étape par étape",
+    "intro": "Les six étapes communes sont : démarrer la VM, choisir modèle, version DSM et extensions, construire et démarrer. Les menus et options varient selon la version. Les captures M-shell montrent une ancienne interface TinyCore ; le script actuel télécharge Alpine RedPill M-shell. Suivez donc ses indications actuelles.",
+    "warnCalloutTitle": "Les chargeurs ne sont pas entretenus par ProxMenux",
+    "warnCalloutBody": "Arc, RR et Alpine RedPill M-shell sont des projets communautaires avec leur propre cadence de sortie. Si une étape semble différente des captures d'écran ci-dessous, le chargeur a probablement mis à jour — vérifiez la documentation propre du chargeur (liens au bas de cette page)."
+  },
+  "stepBadge": "Étape",
+  "step1": {
+    "title": "Démarrer la VM et ouvrir le menu principal",
+    "intro": "Démarrez la VM créée. Le premier démarrage ouvre la configuration du chargeur pour choisir et construire le modèle DSM. Les démarrages suivants ignorent cette étape, sauf si vous forcez une reconfiguration depuis le menu de démarrage du chargeur. Les trois chargeurs proposent une interface terminal et une interface web.",
+    "arc": {
+      "webRich": "<strong>Interface Web.</strong> Ouvrez un navigateur et accédez à l'IP affiché dans la console VM (dans notre exemple : <code>http://192.168.0.32</code>).",
+      "webAlt": "Interface web d’Arc Loader",
+      "webCaption": "Interface web d’Arc Loader",
+      "termRich": "<strong>Interface terminal</strong> : ouvrez-la directement depuis la console de la VM.",
+      "termAlt": "Interface terminal d’Arc Loader",
+      "termCaption": "Interface terminal d’Arc Loader"
+    },
+    "rr": {
+      "webRich": "<strong>Interface Web.</strong> Ouvrez un navigateur et allez à l'IP affiché dans la console VM suivie du port <strong>7681</strong> (exemple : <code>http://192.168.0.33:7681</code>).",
+      "webAlt": "Interface web du chargeur RR",
+      "webCaption": "Interface web du chargeur RR",
+      "termRich": "<strong>Interface terminal.</strong> Saisissez <code>menu.sh</code> dans la console de la VM pour l’ouvrir.",
+      "termAlt": "Interface du terminal de chargeur RR",
+      "termCaption": "Interface du terminal de chargeur RR"
+    },
+    "tinycore": {
+      "webRich": "<strong>Interface Web.</strong> Ouvrez un navigateur et allez à l'IP affiché dans la console VM suivie du port <strong>7681</strong> (exemple : <code>http://192.168.0.35:7681</code>).",
+      "webAlt": "Interface web du chargeur TinyCore",
+      "webCaption": "Interface web du chargeur TinyCore",
+      "termRich": "<strong>Interface terminal</strong> : ouvrez-la directement depuis la console de la VM. Surveillez l’écran : il peut vous demander d’appuyer sur une touche pour continuer ou de changer de langue.",
+      "termAlt": "Interface terminal du chargeur TinyCore",
+      "termCaption": "Interface terminal du chargeur TinyCore"
+    }
+  },
+  "step2": {
+    "title": "Sélectionnez le modèle",
+    "introRich": "Choisissez le modèle Synology DSM que vous souhaitez installer. Selon le chargeur, vous pouvez avoir besoin d'élargir les options pour voir la liste complète. Dans les captures d'écran ci-dessous, nous utilisons le modèle <strong>SA6400</strong> comme exemple.",
+    "arc": {
+      "alt": "Sélection du modèle Arc",
+      "caption": "Sélection du modèle Arc"
+    },
+    "rr": {
+      "alt": "Sélection du modèle RR",
+      "caption": "Sélection du modèle RR"
+    },
+    "tinycore": {
+      "alt": "Sélection du modèle TinyCore",
+      "caption": "Sélection du modèle TinyCore"
+    }
+  },
+  "step3": {
+    "title": "Sélectionnez la version DSM",
+    "intro": "Après avoir choisi le modèle, choisissez la version DSM à installer.",
+    "arc": [
+      {
+        "alt": "Version Arc — étape 1",
+        "caption": "Sélection de la version Arc — étape 1"
+      },
+      {
+        "alt": "Version Arc — étape 2",
+        "caption": "Sélection de la version Arc — étape 2"
+      }
+    ],
+    "rr": [
+      {
+        "alt": "Version RR — étape 1",
+        "caption": "Sélection de la version RR — étape 1"
+      },
+      {
+        "alt": "Version RR — étape 2",
+        "caption": "Sélection de la version RR — étape 2"
+      },
+      {
+        "alt": "Version RR — étape 3",
+        "caption": "Sélection de la version RR — étape 3"
+      }
+    ],
+    "tinycore": [
+      {
+        "alt": "Version TinyCore — étape 1",
+        "caption": "Sélection de la version TinyCore — étape 1"
+      },
+      {
+        "alt": "Version TinyCore — étape 2",
+        "caption": "Sélection de la version TinyCore — étape 2"
+      }
+    ]
+  },
+  "step4": {
+    "title": "Sélectionner des addons",
+    "intro": "Cette étape vous permet d'ajouter des fonctionnalités supplémentaires ou une configuration personnalisée au chargeur.",
+    "arc": {
+      "autoRich": "<strong>Arc</strong> propose un mode automatique conseillé et un mode manuel. En mode automatique, le chargeur applique des réglages par défaut adaptés et redémarre seul une fois terminé.",
+      "autoAlt": "Configuration automatique d’Arc",
+      "autoCaption": "Configuration automatique d’Arc",
+      "manualRich": "En mode manuel, vous parcourez les options une par une :",
+      "manualAlt": "Configuration manuelle d’Arc",
+      "manualCaption": "Configuration manuelle d’Arc",
+      "snMacAlt": "Arc SN/MAC",
+      "snMacCaption": "Configuration Arc SN / MAC",
+      "portmapAlt": "Arc SATA portmap",
+      "portmapCaption": "Carte de port SATA Arc (utiliser l'option recommandée)",
+      "addonsAlt": "Extensions d’Arc",
+      "addonsCaption": "Sélection des extensions dans Arc"
+    },
+    "rr": [
+      {
+        "alt": "Addon RR — étape 1",
+        "caption": "Addon RR — étape 1"
+      },
+      {
+        "alt": "Addon RR — étape 2",
+        "caption": "Extension RR — étape 2 : cliquez pour ajouter une extension."
+      },
+      {
+        "alt": "Addon RR — étape 3",
+        "caption": "Addon RR — étape 3: cliquez sur l'addon que vous voulez. Répétez les deux captures d'écran précédentes pour ajouter plus."
+      }
+    ],
+    "tinycore": [
+      {
+        "alt": "Configuration de TinyCore SN",
+        "caption": "Configuration de TinyCore SN"
+      },
+      {
+        "alt": "Option aléatoire TinyCore",
+        "caption": "Option aléatoire TinyCore (recommandée)"
+      },
+      {
+        "alt": "Configuration MAC de TinyCore",
+        "caption": "Configuration MAC de TinyCore"
+      },
+      {
+        "alt": "TinyCore VM MAC",
+        "caption": "TinyCore — choisissez la MAC du VM ou une MAC aléatoire"
+      }
+    ]
+  },
+  "step5": {
+    "title": "Construire le chargeur",
+    "introRich": "Avec le modèle, la version DSM et les addons choisis, choisissez <strong>Construisez le Loader</strong>. Cela peut prendre quelques minutes en fonction du chargeur et des options sélectionnées.",
+    "arc": {
+      "alt": "Construction du chargeur dans Arc",
+      "caption": "Construction du chargeur dans Arc"
+    },
+    "rr": {
+      "alt": "Construction du chargeur dans RR",
+      "caption": "Construction du chargeur dans RR"
+    },
+    "tinycore": {
+      "alt": "Construction du chargeur dans TinyCore",
+      "caption": "Construction du chargeur dans TinyCore"
+    }
+  },
+  "step6": {
+    "title": "Démarrer le chargeur",
+    "intro": "Une fois le chargeur construit, la VM redémarre avec la configuration créée et l’installation DSM commence.",
+    "arc": {
+      "alt": "Démarrage du chargeur dans Arc",
+      "caption": "Démarrage du chargeur dans Arc"
+    },
+    "rr": {
+      "alt": "Démarrage du chargeur dans RR",
+      "caption": "Démarrage du chargeur dans RR"
+    },
+    "tinycore": {
+      "alt": "Démarrage du chargeur dans TinyCore",
+      "caption": "Démarrage du chargeur dans TinyCore"
+    }
+  },
+  "dsmInstall": {
+    "heading": "Démarrer l'installation DSM",
+    "intro": "Une fois le chargeur démarré, trouvez votre VM DSM en ouvrant :",
+    "afterCode": "Suivez les étapes à l'écran pour terminer l'installation de DSM.",
+    "setupAlt": "Configuration DSM",
+    "setupCaption": "Écran de configuration DSM",
+    "patience": "Patientez quelques minutes. La progression se met à jour automatiquement et un compte à rebours apparaît vers la fin de l’installation.",
+    "finishAlt": "Installation terminée",
+    "finishCaption": "Installation terminée"
+  },
+  "tips": {
+    "heading": "Conseils",
+    "recentTitle": "Utiliser des modèles DSM récents",
+    "recentBody": "Certains modèles DSM plus anciens ont du mal à reconnaître les disques ou la carte réseau. Préférez les modèles récents (p. ex. SA6400) pour une expérience de premier démarrage plus fluide.",
+    "updateTitle": "Mise à jour du chargeur",
+    "updateBody": "Certains chargeurs offrent la possibilité de se mettre à jour directement depuis leur menu de configuration — vous n'avez pas à détruire et recréer le VM.",
+    "warnTitle": "ProxMenux ne supporte pas les chargeurs",
+    "warnBody": "ProxMenux automatise le côté VM. Les problèmes de chargeur (modèle non trouvé, add-on défaut d'installation, DSM refusant de démarrer) sont hors de portée ici — utiliser le tracker de problème propre à chaque chargeur et la documentation.",
+    "docsHeading": "Documentation du chargeur",
+    "docLinks": [
+      {
+        "label": "Documentation Arc",
+        "url": "https://github.com/AuxXxilium/arc"
+      },
+      {
+        "label": "Documentation RR",
+        "url": "https://github.com/RROrg/rr"
+      },
+      {
+        "label": "Documentation TinyCore",
+        "url": "https://github.com/PeterSuh-Q3/tinycore-redpill"
+      }
+    ]
+  },
+  "related": {
+    "heading": "Voir aussi",
+    "itemsRich": [
+      {
+        "href": "/docs/create-vm/system-nas",
+        "label": "Vue d’ensemble des systèmes NAS",
+        "tail": "— comparaison de Synology vs TrueNAS / OMV / Rockstor / XigmaNAS."
+      },
+      {
+        "href": "/docs/create-vm/system-nas/system-nas-others",
+        "label": "Autres systèmes NAS",
+        "tail": " — autres distributions NAS que Synology."
+      },
+      {
+        "href": "/docs/disk-manager/import-disk-vm",
+        "label": "Importer le disque vers la VM",
+        "tail": " — connecter des disques physiques à la VM Synology pour les performances de stockage."
+      },
+      {
+        "href": "/docs/create-vm",
+        "label": "Vue d’ensemble de la création de VM",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/fr/docs/create-vm/system-nas/system-nas-others.json b/web/messages/fr/docs/create-vm/system-nas/system-nas-others.json
new file mode 100644
index 00000000..3084922e
--- /dev/null
+++ b/web/messages/fr/docs/create-vm/system-nas/system-nas-others.json
@@ -0,0 +1,312 @@
+{
+  "meta": {
+    "title": "Créer une VM : autres systèmes NAS | Documentation ProxMenux",
+    "description": "Créez des VM TrueNAS SCALE, TrueNAS CORE, OpenMediaVault, XigmaNAS, Rockstor, ZimaOS et FygoOS sur Proxmox VE avec ProxMenux. Configuration par défaut ou avancée, plan de stockage, passthrough GPU facultatif et ressources conseillées pour chaque système.",
+    "ogTitle": "Créer une VM : autres systèmes NAS | Documentation ProxMenux",
+    "ogDescription": "Créez TrueNAS SCALE / CORE, OpenMediaVault, XigmaNAS, Rockstor, ZimaOS et FygoOS VMs sur Proxmox VE avec ProxMenux.",
+    "ogImageAlt": "Sélecteur de NAS ProxMenux"
+  },
+  "header": {
+    "title": "Créer VM: Autres systèmes NAS",
+    "description": "ProxMenux peut créer un VM prêt à installer pour TrueNAS SCALE, TrueNAS CORE, OpenMediaVault, XigmaNAS, Rockstor, ZimaOS et FygoOS. Cette page couvre le flux de création partagé (configuration par défaut / avancée, nouveau plan de stockage, passage optionnel GPU) plus les notes par système et les spécifications recommandées.",
+    "section": "Machines virtuelles · NAS"
+  },
+  "intro": {
+    "title": "Comment ces systèmes sont créés",
+    "bodyRich": "Les sept systèmes partagent le même assistant ProxMenux. Le sélecteur de NAS choisit l'installateur correspondant (détectant automatiquement la dernière version stable pour TrueNAS, OMV, XigmaNAS, Rockstor et FygoOS) et passe ensuite au configurateur générique VM et au plan de stockage. ZimaOS utilise son propre script d'installation (<code>vm/zimaos.sh</code>) mais suit la même séquence CPU / RAM / stockage / option-GPU."
+  },
+  "config": {
+    "heading": "Configuration par défaut vs Configuration avancée",
+    "intro": "Lorsqu'un NAS est sélectionné, ProxMenux demande s'il faut utiliser le profil VM par défaut ou ouvrir l'assistant avancé. Les valeurs par défaut sont adaptées aux charges de travail du NAS — plus de RAM qu'un simple Linux VM car les systèmes basés sur ZFS en ont besoin pour le cache ARC.",
+    "defaultHeading": "Configuration par défaut",
+    "headerParam": "Paramètre",
+    "headerValue": "Valeur par défaut",
+    "defaultRowsRich": [
+      {
+        "param": "Type de machine",
+        "valueRich": "<code>q35</code>"
+      },
+      {
+        "param": "BIOS",
+        "valueRich": "OVMF (UEFI)<note> — SeaBIOS pour OpenMediaVault</note>"
+      },
+      {
+        "param": "Type CPU",
+        "valueRich": "Host"
+      },
+      {
+        "param": "Noyaux",
+        "valueRich": "2"
+      },
+      {
+        "param": "RAM",
+        "valueRich": "8192 MB<note> — 4096 MB pour ZimaOS</note>"
+      },
+      {
+        "param": "Pont",
+        "valueRich": "<code>vmbr0</code>"
+      },
+      {
+        "param": "Adresse MAC",
+        "valueRich": "Généré automatiquement"
+      },
+      {
+        "param": "Démarrer à la fin",
+        "valueRich": "Non"
+      }
+    ],
+    "advancedHeading": "Configuration avancée",
+    "advancedIntro": "L'assistant avancé expose chaque paramètre individuellement :",
+    "headerOptions": "Possibilités",
+    "advancedRowsRich": [
+      {
+        "param": "Type de machine",
+        "optionsRich": "<code>q35</code> ou <code>i440fx</code>"
+      },
+      {
+        "param": "BIOS",
+        "optionsRich": "OVMF (UEFI) ou SeaBIOS (Légacy)"
+      },
+      {
+        "param": "Type CPU",
+        "optionsRich": "Host, KVM64 et autres modèles CPU proposés (ZimaOS : Host ou KVM64)"
+      },
+      {
+        "param": "Noyaux",
+        "optionsRich": "Nombre de cœurs CPU"
+      },
+      {
+        "param": "RAM",
+        "optionsRich": "Mémoire attribuée au VM"
+      },
+      {
+        "param": "Pont",
+        "optionsRich": "Pont réseau"
+      },
+      {
+        "param": "Adresse MAC",
+        "optionsRich": "MAC personnalisée"
+      },
+      {
+        "param": "VLAN",
+        "optionsRich": "Étiquette VLAN (facultatif)"
+      },
+      {
+        "param": "MTU",
+        "optionsRich": "Taille MTU"
+      }
+    ],
+    "zfsCalloutTitle": "ZFS et RAM",
+    "zfsCalloutBody": "TrueNAS SCALE/CORE et XigmaNAS utilisent ZFS, dont le cache ARC profite de la RAM. TrueNAS nécessite au moins 8 Go pour un usage de base ; 16 Go ou plus peuvent aider pour des services et applications exigeants. Dimensionnez selon la distribution et la charge : 8 Go n’est pas un minimum universel de ZFS. Des configurations légères OMV, Rockstor ou ZimaOS peuvent demander moins."
+  },
+  "storagePlan": {
+    "heading": "Plan de stockage",
+    "intro": "Après CPU / RAM, ProxMenux ouvre le menu Plan de stockage, où vous pouvez combiner des disques virtuels, des disques importés et des périphériques PCI passants dans le même VM, ajoutant des éléments un à la fois et finissant lorsque vous avez terminé.",
+    "virtualHeading": "a. Ajouter un disque virtuel",
+    "virtualItemsRich": [
+      "Liste les volumes de stockage Proxmox disponibles sur l'hôte.",
+      "Vous choisissez le stockage cible et la taille en GB.",
+      "Le disque utilise le bus choisi : SCSI (par défaut), SATA, VirtIO ou IDE (ZimaOS : SCSI ou SATA). SATA offre six emplacements numérotés de 0 à 5 : <code>sata0</code>, <code>sata1</code>, …."
+    ],
+    "importHeading": "b. Ajouter un disque d'importation",
+    "importItemsRich": [
+      "Détecte les disques physiques qui sont sûrs à importer (le système et les disques protégés sont cachés).",
+      "Vous sélectionnez un ou plusieurs disques via une liste de contrôle.",
+      "Les disques importés utilisent le bus choisi et sont connectés par <code>qm set</code>."
+    ],
+    "pciHeading": "c. Ajouter un contrôleur ou NVMe (passthrough PCI)",
+    "pciItemsRich": [
+      "Détecte les appareils HBA SATA/SAS et NVMe sur l'hôte et vous permet de passer un contrôleur <em>entier</em> dans le VM. IOMMU doit être activé ; le script offre de l'activer et de redémarrer si nécessaire.",
+      "Une étape de confirmation met en garde contre le risque à l'échelle du contrôleur (la carte entière, y compris chaque disque sur elle, quitte l'hôte).",
+      "Les périphériques PCI sont affectés avec des commandes comme <code>qm set VMID --hostpci0 PCI_ADDRESS,pcie=1</code>. Remplacez VMID et PCI_ADDRESS par l’ID de VM et l’adresse PCI, et utilisez un indice hostpci libre pour chaque périphérique."
+    ],
+    "resetCalloutTitle": "Réinitialiser et terminer",
+    "resetCalloutBodyRich": "Le menu offre également <strong>r</strong> (réinitialiser la sélection actuelle et recommencer) et <strong>d</strong> (finir et poursuivre). Vous ne pouvez pas finir avec un plan vide."
+  },
+  "gpu": {
+    "heading": "Passage facultatif de GPU",
+    "bodyRich": "Après le plan de stockage, si un GPU compatible est détecté sur l'hôte, ProxMenux propose de lancer l'assistant de passage GPU. Voir <link>Ajouter GPU à un VM (Passthrough)</link> pour savoir comment fonctionne l'assistant — un redémarrage d'hôte peut être nécessaire."
+  },
+  "autoFeatures": {
+    "heading": "Fonctions automatiques VM",
+    "efiTitle": "disque EFI",
+    "efiBody": "Lorsque OVMF (UEFI) est sélectionné, ProxMenux crée automatiquement un disque EFI 4 MB sur le stockage que vous choisissez, formaté pour correspondre au type de stockage (raw pour le stockage par répertoire).",
+    "isoTitle": "Montage ISO",
+    "isoBodyRich": "L'installation ISO est téléchargée (si nécessaire) et fixée à <code>ide2</code> sous forme de CD-ROM, prêt pour le premier démarrage.",
+    "guestTitle": "QEMU Agent invité",
+    "guestBody": "Le canal d'agent invité est activé dans la configuration VM. Vous devez toujours installer l'agent à l'intérieur de l'invité après la mise en place du NAS OS."
+  },
+  "endToEnd": {
+    "heading": "Ce que fait le script de bout en bout",
+    "itemsRich": [
+      "Détecte et télécharge la dernière ISO stable, ou utilise une version de secours si le projet d’origine est inaccessible.",
+      "Applique les réglages par défaut ou avancés de CPU, RAM, BIOS et type de machine.",
+      "Ouvre le plan de stockage et fixe les disques virtuels sélectionnés, les disques importés et les périphériques PCI.",
+      "Crée un disque EFI si UEFI est sélectionné.",
+      "Monte l'installation ISO sur <code>ide2</code>.",
+      "Définit l'ordre de démarrage (disque d'abord, puis ISO).",
+      "Active le canal QEMU Guest Agent.",
+      "En option, exécute l'assistant de passage GPU.",
+      "Génère une description HTML de style jointe au VM.",
+      "Démarre le VM si vous le souhaitez."
+    ]
+  },
+  "perSystem": {
+    "heading": "Notes par système",
+    "shellLabel": "Interface Shell",
+    "webLabel": "Interface Web"
+  },
+  "systems": {
+    "truenasScale": {
+      "id": "truenas-scale",
+      "title": "TrueNAS SCALE",
+      "icon": "Database",
+      "officialName": "TrueNAS SCALE",
+      "officialUrl": "https://www.truenas.com/truenas-scale/",
+      "description": "TrueNAS basé sur Debian avec des applications Docker dans les versions actuelles, Linux KVM et ZFS comme système de fichiers principal. Les anciennes versions SCALE utilisaient Kubernetes. Il associe stockage ZFS et écosystème de conteneurs.",
+      "specs": [
+        "Interface conseillée : SATA ou SCSI, avec prise en charge de discard/TRIM",
+        "Minimum RAM: 8 GB (16 GB+ recommandé pour les charges de travail réelles)",
+        "Cœurs CPU minimum : 2 (4 ou plus conseillés)",
+        "Démarrage UEFI (OVMF) recommandé",
+        "Adaptateur réseau VirtIO pour le meilleur débit"
+      ],
+      "shellImg": "/vm/truenas/truenas-scale-shell.png",
+      "webImg": "/vm/truenas/truenas-scale-web.png",
+      "shellAlt": "Interface shell SCALE TrueNAS",
+      "webAlt": "TrueNAS Interface web SCALE"
+    },
+    "truenasCore": {
+      "id": "truenas-core",
+      "title": "TrueNAS CORE",
+      "icon": "Database",
+      "officialName": "TrueNAS CORE",
+      "officialUrl": "https://www.truenas.com/truenas-core/",
+      "description": "TrueNAS basé sur FreeBSD, anciennement FreeNAS, axé sur ZFS. Les jails, plugins et fonctions de virtualisation de CORE 13.3 sont obsolètes et non pris en charge ; le développement se concentre sur les éditions Linux.",
+      "specs": [
+        "Interface recommandée: SATA",
+        "Minimum RAM: 8 GB (16 GB+ recommandé)",
+        "Cœurs CPU minimum : 2 (4 ou plus conseillés)",
+        "Démarrage UEFI (OVMF) recommandé",
+        "Adaptateur réseau VirtIO pour le meilleur débit"
+      ],
+      "shellImg": "/vm/truenas/truenas-core-shell.png",
+      "webImg": "/vm/truenas/truenas-core-web.png",
+      "shellAlt": "Interface shell TrueNAS CORE",
+      "webAlt": "TrueNAS Interface web CORE"
+    },
+    "openmediavault": {
+      "id": "openmediavault",
+      "title": "OpenMediaVault",
+      "icon": "Server",
+      "officialName": "openmediavault.org",
+      "officialUrl": "https://www.openmediavault.org",
+      "description": "NAS basé sur Debian avec plugins modulaires. Peu gourmand et facile à utiliser sur un matériel modeste lorsque ZFS n’est pas nécessaire.",
+      "specs": [
+        "Interface recommandée: SATA ou VirtIO",
+        "Minimum RAM: 2 GB (4 GB+ recommandé)",
+        "Cœurs CPU minimum : 1 (2 ou plus conseillés)",
+        "BIOS: ProxMenux par défaut vers SeaBIOS pour OMV (surpasser en Advanced si nécessaire)",
+        "Adaptateur réseau VirtIO pour le meilleur débit"
+      ],
+      "shellImg": "/vm/openmediavault/openmediavault-shell.png",
+      "webImg": "/vm/openmediavault/openmediavault-web.png",
+      "shellAlt": "Interface shell OpenMediaVault",
+      "webAlt": "Interface web OpenMediaVault"
+    },
+    "xigmanas": {
+      "id": "xigmanas",
+      "title": "XigmaNAS",
+      "icon": "Database",
+      "officialName": "xigmanas.com",
+      "officialUrl": "https://www.xigmanas.com",
+      "description": "NAS basé sur FreeBSD — la continuation directe de la base de codes FreeNAS originale (0.7). Concentré sur ZFS et la simplicité, avec une empreinte plus légère que TrueNAS.",
+      "specs": [
+        "Interface recommandée: SATA ou SCSI",
+        "Minimum RAM: 4 GB (8 GB+ recommandé pour ZFS)",
+        "Noyaux minimum CPU: 2",
+        "Démarrage UEFI (OVMF) recommandé",
+        "Adaptateur réseau VirtIO pour le meilleur débit"
+      ]
+    },
+    "rockstor": {
+      "id": "rockstor",
+      "title": "Rockstor",
+      "icon": "HardDrive",
+      "officialName": "rockstor.com",
+      "officialUrl": "https://rockstor.com",
+      "description": "openSUSE Leap-based NAS construit autour de Btrfs. Snapshots, sous-volumes et le framework de l'application Rock-ons (Docker) pour les médias, le partage de fichiers et la sauvegarde.",
+      "specs": [
+        "Interface recommandée: SATA ou VirtIO",
+        "Minimum RAM: 2 GB (4 GB+ recommandé)",
+        "Noyaux minimum CPU: 2",
+        "Démarrage UEFI (OVMF) recommandé",
+        "Adaptateur réseau VirtIO pour le meilleur débit"
+      ],
+      "shellImg": "/vm/rockstor/rockstor-shell.png",
+      "webImg": "/vm/rockstor/rockstor-web.png",
+      "shellAlt": "Interface shell Rockstor",
+      "webAlt": "Interface web Rockstor"
+    },
+    "zimaos": {
+      "id": "zimaos",
+      "title": "ZimaOS",
+      "icon": "MonitorIcon",
+      "officialName": "zimaspace.com",
+      "officialUrl": "https://www.zimaspace.com/zimaos",
+      "description": "Système NAS/serveur domestique léger construit avec Buildroot, issu de CasaOS, pour les médias, applications Docker et domotique. Son installateur ProxMenux dédié (vm/zimaos.sh) télécharge une image prête et propose les réglages CPU, RAM et stockage.",
+      "specs": [
+        "Interface recommandée: SATA ou VirtIO",
+        "RAM par défaut : 4 Go, pour médias et applications auto-hébergées",
+        "Noyaux minimum CPU: 2",
+        "Démarrage UEFI (OVMF)",
+        "Adaptateur réseau VirtIO pour le meilleur débit"
+      ]
+    },
+    "fygoos": {
+      "id": "fygoos",
+      "title": "FygoOS",
+      "icon": "Server",
+      "officialName": "fygonas.com",
+      "officialUrl": "https://fygonas.com",
+      "description": "Édition internationale de fnOS, un NAS basé sur Debian. ProxMenux télécharge le dernier installateur ISO publié sur fygonas.com et le monte dans le VM. L'installateur met le système sur un disque; l'espace laissé sur ce disque peut contenir des volumes pour les applications et les fichiers. Après l'installation, la console affiche l'adresse de l'interface web, sur le port 5666 (le port 80 redirige vers elle): ouvrez-le dans un navigateur pour nommer l'appareil et créer le compte administrateur.",
+      "specs": [
+        "Disque système: FygoOS propose une partition système 64 GB, qui peut être plus petite dans un VM",
+        "Installation : Graphical Install, ou Rescuing Install si le mode graphique échoue",
+        "Démarrage UEFI (OVMF) sans clés Secure Boot, comme l’exige l’installateur",
+        "Réseau: Ethernet avec DHCP par défaut",
+        "Adaptateur réseau VirtIO pour le meilleur débit"
+      ]
+    }
+  },
+  "related": {
+    "heading": "Voir aussi",
+    "itemsRich": [
+      {
+        "href": "/docs/create-vm/system-nas",
+        "label": "Aperçu du NAS système",
+        "tail": "— comparaison rapide entre toutes les options du NAS."
+      },
+      {
+        "href": "/docs/create-vm/system-nas/synology",
+        "label": "VM Synology",
+        "tail": " — procédure Synology DSM (Xpenology)."
+      },
+      {
+        "href": "/docs/disk-manager/import-disk-vm",
+        "label": "Importer le disque vers la VM",
+        "tail": "— recommandé pour les cas d'utilisation du NAS (vrais disques > disques virtuels)."
+      },
+      {
+        "href": "/docs/help-info/zfs-commands",
+        "label": "Commandes de gestion ZFS",
+        "tail": "— si vous choisissez TrueNAS ou une autre distribution appuyée par ZFS."
+      },
+      {
+        "href": "/docs/create-vm",
+        "label": "Vue d’ensemble de la création de VM",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/fr/docs/create-vm/system-windows.json b/web/messages/fr/docs/create-vm/system-windows.json
new file mode 100644
index 00000000..cd15d655
--- /dev/null
+++ b/web/messages/fr/docs/create-vm/system-windows.json
@@ -0,0 +1,259 @@
+{
+  "meta": {
+    "title": "Créer une VM : système Windows | Documentation ProxMenux",
+    "description": "Créez et configurez des machines virtuelles Windows sur Proxmox VE avec ProxMenux. ISO via UUP Dump ou fichier local, configuration par défaut ou avancée, plan de stockage commun, passthrough GPU facultatif, TPM 2.0 et installation des pilotes VirtIO.",
+    "ogTitle": "Créer une VM : système Windows | Documentation ProxMenux",
+    "ogDescription": "Créez des VM Windows sur Proxmox VE avec ProxMenux : UUP Dump ou ISO locale, plan de stockage commun, passthrough GPU facultatif, TPM 2.0 et pilotes VirtIO.",
+    "ogImageAlt": "Menu ProxMenux Windows VM"
+  },
+  "header": {
+    "title": "Créer une VM : système Windows",
+    "description": "Créez une VM Windows sur Proxmox VE. ProxMenux gère le choix de l’ISO (UUP Dump ou locale), CPU, RAM, type de machine, plan de stockage commun, passthrough GPU facultatif, TPM 2.0 et installation des pilotes VirtIO.",
+    "section": "Machines virtuelles"
+  },
+  "intro": {
+    "title": "Ce que ce script fait",
+    "body": "Le parcours Windows demande la source de l’ISO : UUP Dump ou copie locale dans <code>/var/lib/vz/template/iso</code>. L’assistant VM commun utilise ensuite les réglages Windows : <code>q35</code>, OVMF et TPM 2.0. L’ISO des pilotes VirtIO est connectée comme second CD-ROM ; la VM est prête à lancer l’installateur Windows."
+  },
+  "image": {
+    "alt": "Options d'installation de ProxMenux Windows",
+    "caption": "Options d'installation de Windows"
+  },
+  "config": {
+    "heading": "Configuration par défaut vs Configuration avancée",
+    "intro": "Une fois l'ISO sélectionné, ProxMenux demande s'il faut utiliser le profil VM par défaut ou ouvrir l'assistant avancé. Le profil par défaut est accordé pour les éditions de bureau et de serveur Windows modernes.",
+    "defaultHeading": "Configuration par défaut",
+    "headerParam": "Paramètre",
+    "headerValue": "Valeur par défaut",
+    "defaultRows": [
+      {
+        "param": "Type de machine",
+        "valueRich": "<code>q35</code>"
+      },
+      {
+        "param": "BIOS",
+        "value": "OVMF (UEFI)"
+      },
+      {
+        "param": "Type CPU",
+        "value": "Host"
+      },
+      {
+        "param": "Cœurs",
+        "value": "4"
+      },
+      {
+        "param": "RAM",
+        "value": "8192 MB"
+      },
+      {
+        "param": "Pont",
+        "valueRich": "<code>vmbr0</code>"
+      },
+      {
+        "param": "Adresse MAC",
+        "value": "Généré automatiquement"
+      },
+      {
+        "param": "TPM",
+        "value": "Activé (v2.0)"
+      },
+      {
+        "param": "Démarrer à la fin",
+        "value": "Non"
+      }
+    ],
+    "advancedHeading": "Configuration avancée",
+    "advancedIntro": "L’assistant avancé présente chaque paramètre séparément :",
+    "headerOptions": "Possibilités",
+    "advancedRows": [
+      {
+        "param": "Type de machine",
+        "optionsRich": "<code>q35</code> ou <code>i440fx</code>"
+      },
+      {
+        "param": "BIOS",
+        "options": "OVMF (UEFI) ou SeaBIOS (Légacy)"
+      },
+      {
+        "param": "Type CPU",
+        "options": "Host, KVM64 et autres modèles CPU proposés"
+      },
+      {
+        "param": "Cœurs",
+        "options": "Nombre de cœurs CPU"
+      },
+      {
+        "param": "RAM",
+        "options": "Mémoire attribuée à la VM"
+      },
+      {
+        "param": "Pont",
+        "options": "Pont réseau"
+      },
+      {
+        "param": "Adresse MAC",
+        "options": "MAC personnalisée"
+      },
+      {
+        "param": "VLAN",
+        "options": "Étiquette VLAN (facultatif)"
+      },
+      {
+        "param": "MTU",
+        "options": "Taille MTU"
+      },
+      {
+        "param": "TPM",
+        "options": "TPM 2.0 est ajouté automatiquement pour Windows ; cet assistant ne permet pas de le désactiver."
+      }
+    ],
+    "tpmWarnTitle": "Les exigences TPM dépendent de l’édition Windows",
+    "tpmWarnBody": "Windows 11 nécessite normalement TPM 2.0. Windows Server 2022 l’exige pour certaines fonctions de sécurité, pas pour toutes les installations. ProxMenux ajoute un TPM virtuel pour Windows ; l’assistant avancé ne propose pas de réglage pour le désactiver."
+  },
+  "storagePlan": {
+    "heading": "Plan de stockage",
+    "body": "Après CPU / RAM, ProxMenux ouvre le menu <strong>Plan de stockage</strong>, où vous pouvez combiner des disques virtuels, des disques importés et des périphériques PCI passants dans le même VM, ajoutant des éléments un à la fois et finissant lorsque vous avez terminé.",
+    "virtualDiskTitle": "a. Ajouter un disque virtuel",
+    "virtualDiskItems": [
+      "Liste les volumes de stockage Proxmox disponibles sur l'hôte.",
+      "Vous choisissez le stockage cible et la taille en GB.",
+      "Le disque utilise le bus choisi : SCSI (par défaut), SATA, VirtIO ou IDE. SATA offre six emplacements numérotés de 0 à 5 : <code>sata0</code>, <code>sata1</code>, …."
+    ],
+    "importDiskTitle": "b. Ajouter un disque d'importation",
+    "importDiskItems": [
+      "Détecte les disques physiques qui sont sûrs à importer (le système et les disques protégés sont cachés).",
+      "Vous sélectionnez un ou plusieurs disques via une liste de contrôle.",
+      "Les disques importés utilisent le bus choisi et sont connectés par <code>qm set</code>."
+    ],
+    "pciTitle": "c. Ajouter un contrôleur ou NVMe (passthrough PCI)",
+    "pciItems": [
+      "Détecte les appareils HBA SATA/SAS et NVMe sur l'hôte et vous permet de passer un contrôleur <em>entier</em> dans le VM. IOMMU doit être activé ; le script offre de l'activer et de redémarrer si nécessaire.",
+      "Une étape de confirmation met en garde contre le risque à l'échelle du contrôleur (la carte entière, y compris chaque disque sur elle, quitte l'hôte).",
+      "Les périphériques PCI sont affectés avec des commandes comme <code>qm set VMID --hostpci0 PCI_ADDRESS,pcie=1</code>. Remplacez VMID et PCI_ADDRESS par l’ID de VM et l’adresse PCI, et utilisez un indice hostpci libre pour chaque périphérique."
+    ],
+    "resetTitle": "Réinitialiser et terminer",
+    "resetBody": "Le menu offre également <strong>r</strong> (réinitialiser la sélection actuelle et recommencer) et <strong>d</strong> (finir et poursuivre). Vous ne pouvez pas finir avec un plan vide."
+  },
+  "gpu": {
+    "heading": "Passage facultatif de GPU",
+    "body": "Après le plan de stockage, si un GPU compatible est détecté sur l'hôte ProxMenux offre de lancer l'assistant de passage GPU. Voir <gpuLink>Ajouter GPU à un VM (Passthrough)</gpuLink> pour savoir comment fonctionne l'assistant — un redémarrage d'hôte peut être nécessaire."
+  },
+  "autoFeatures": {
+    "heading": "Fonctions automatiques VM",
+    "efiTitle": "disque EFI",
+    "efiBody": "Lorsque OVMF (UEFI) est sélectionné, ProxMenux crée un disque système EFI 4 MB sur le stockage que vous choisissez et le fixe au VM de sorte que le firmware UEFI a un endroit pour stocker ses variables.",
+    "tpmTitle": "TPM 2.0",
+    "tpmBody": "ProxMenux ajoute un TPM 2.0 virtuel aux VM Windows. Il satisfait l’exigence TPM de Windows 11 et permet les fonctions Windows Server qui dépendent de TPM.",
+    "isoTitle": "Montage ISO",
+    "isoBody": "L’ISO d’installation est connectée à <code>ide2</code>. L’ISO des pilotes VirtIO est téléchargée si nécessaire et connectée à <code>ide3</code> pour l’étape <em>Charger un pilote</em>.",
+    "guestTitle": "QEMU Agent invité",
+    "guestBody": "Le canal d'agent invité est activé dans la configuration VM. L'agent lui-même est installé dans Windows en exécutant <code>virtio-win-guest-tools.exe</code> après configuration."
+  },
+  "installOptions": {
+    "heading": "Options d'installation de Windows",
+    "intro": "ProxMenux propose deux méthodes pour obtenir les supports d'installation Windows:",
+    "uupTitle": "Créateur d’ISO UUP Dump",
+    "uupLogoAlt": "Logo UUP Dump",
+    "uupBody": "Le script <strong>UUP Dump ISO Creator</strong> est un utilitaire ProxMenux qui crée une ISO Windows à la demande à partir des serveurs Windows Update de Microsoft. Il récupère les fichiers d’installation officiels, y compris les versions Insider Preview.",
+    "uupItems": [
+      "Accès aux dernières versions Windows.",
+      "Prend en charge les versions d'Insider Preview.",
+      "Fichiers d’installation Microsoft officiels et non modifiés.",
+      "Création et montage automatique ISO dans le VM.",
+      "Supporte les éditions Home, Pro et Enterprise."
+    ],
+    "uupLearnMore": "En savoir plus sur UUP Dump ISO Creator",
+    "localTitle": "Installation avec ISO local",
+    "localBody": "Utilise une ISO Windows que vous avez déjà téléchargée sur le stockage local de l'hôte (<code>/var/lib/vz/template/iso</code>). Le script liste chaque ISO non-VirtIO qu'il trouve et vous permet de le choisir.",
+    "localImageAlt": "Menu local de sélection ISO",
+    "localImageCaption": "Menu local de sélection ISO"
+  },
+  "endToEnd": {
+    "heading": "Ce que fait le script de bout en bout",
+    "items": [
+      "Obtient l'ISO Windows (UUP Dump build ou copie locale).",
+      "Applique la configuration par défaut ou avancée CPU / RAM / BIOS / type machine.",
+      "Ouvre le plan de stockage et fixe les disques virtuels sélectionnés, les disques importés et les périphériques PCI.",
+      "Crée le disque EFI pour les installations UEFI et connecte le TPM 2.0.",
+      "Monte l'ISO Windows sur <code>ide2</code>.",
+      "Télécharge l’ISO des pilotes VirtIO et la monte sur <code>ide3</code>.",
+      "Définit l'ordre de démarrage (disque d'abord, puis ISO).",
+      "Active le canal QEMU Guest Agent.",
+      "En option, exécute l'assistant de passage GPU.",
+      "Génère une description HTML de style jointe au VM.",
+      "Démarre la VM si vous l’avez choisi."
+    ]
+  },
+  "virtio": {
+    "heading": "Pilotes VirtIO pendant l'installation",
+    "body": "Le créateur de VM utilise par défaut des disques SCSI avec contrôleur VirtIO SCSI et un adaptateur réseau VirtIO. Une ISO Windows standard peut nécessiter leurs pilotes depuis l’ISO VirtIO montée sur <code>ide3</code>. Les disques SATA fonctionnent généralement avec les pilotes Windows intégrés ; choisir SATA ne change pas l’adaptateur réseau VirtIO.",
+    "warnTitle": "Chargez le pilote réseau VirtIO si Windows n’a pas de réseau",
+    "warnBody": "La VM utilise un adaptateur réseau VirtIO (<code>virtio</code>). Si Windows ne contient pas son pilote, chargez-le pendant l’installation pour accéder au réseau. Sinon, l’activation et Windows Update peuvent être indisponibles au premier démarrage.",
+    "stepLabel": "Étape",
+    "steps": [
+      {
+        "title": "Accédez à l'écran \"Où voulez-vous installer Windows?\"",
+        "body": "Lors de la configuration de Windows, si aucun disque n'est affiché, le pilote de stockage de votre interface sélectionnée (SCSI ou VirtIO) n'est pas encore chargé. Chargez-le manuellement depuis l'ISO VirtIO monté.",
+        "img": "/vm/windows/virtio-step-1.png",
+        "caption": "Configuration Windows sans disque affiché"
+      },
+      {
+        "title": "Cliquez sur « Charger un pilote »",
+        "bodyRich": "Cliquez sur <strong>Load driver</strong> pour parcourir le VirtIO ISO monté et choisir le pilote de stockage qui correspond à l'interface que vous avez choisie.",
+        "img": "/vm/windows/virtio-step-2.png",
+        "caption": "Cliquez sur Charger le pilote pour parcourir l'ISO VirtIO"
+      },
+      {
+        "title": "Parcourir dans le dossier du pilote correct",
+        "bodyRich": "Sur l’ISO VirtIO, choisissez <code>vioscsi</code> pour le contrôleur VirtIO SCSI ou <code>viostor</code> pour les disques blocs VirtIO. Choisissez ensuite le sous-dossier de votre version Windows et de votre architecture.",
+        "img": "/vm/windows/virtio-step-3.png",
+        "caption": "Parcourir dans le dossier du pilote approprié"
+      },
+      {
+        "title": "Sélectionnez le pilote",
+        "bodyRich": "Windows liste les pilotes disponibles. Choisissez celui qui correspond à votre configuration (généralement <strong>Red Hat VirtIO contrôleur SCSI</strong>) et cliquez sur <strong>Suivant</strong>.",
+        "img": "/vm/windows/virtio-step-4.png",
+        "caption": "Sélectionnez le pilote VirtIO qui correspond à votre interface disque"
+      },
+      {
+        "title": "(Facultatif) Installez le pilote réseau",
+        "bodyRich": "Si vous avez également choisi VirtIO comme interface réseau, chargez le pilote réseau dans le dossier <code>NetKVM</code> de la même ISO, en sélectionnant le sous-dossier pour votre version Windows. Sans cette étape, Windows s'installe sans accès à Internet.",
+        "img": "/vm/windows/virtio-step-5.png",
+        "caption": "Charger le pilote réseau VirtIO pour activer Internet pendant l'installation"
+      }
+    ],
+    "tipTitle": "Après l’installation : exécuter virtio-win-guest-tools.exe",
+    "tipBody": "Après l’installation de Windows, ouvrez l’ISO VirtIO dans l’Explorateur de fichiers et lancez <code>virtio-win-guest-tools.exe</code>. Il installe les pilotes restants (réseau, affichage, entrée, ballooning) et l’agent invité QEMU en une seule opération."
+  },
+  "related": {
+    "heading": "Voir aussi",
+    "items": [
+      {
+        "href": "/docs/utils/UUp-Dump-ISO-Creator",
+        "label": "Créateur d’ISO UUP Dump",
+        "tail": "— générer des ISO d'installation Windows à jour sur l'hôte Proxmox."
+      },
+      {
+        "href": "/docs/disk-manager/import-disk-image-vm",
+        "label": "Importer l'image disque vers la VM",
+        "tail": " — importer une image disque Windows existante (.vmdk, .qcow2, .img ou .raw) dans une VM existante ; convertir d’abord les images .vhdx dans un format pris en charge."
+      },
+      {
+        "href": "/docs/hardware/gpu-vm-passthrough",
+        "label": "Ajouter GPU à VM (Passthrough)",
+        "tail": "— pour Windows VMs avec GPU accéléré matériellement."
+      },
+      {
+        "href": "/docs/help-info/vm-ct-commands",
+        "label": "Commandes de gestion VM et CT",
+        "tail": "— qm CLI référence."
+      },
+      {
+        "href": "/docs/create-vm",
+        "label": "Vue d’ensemble de la création de VM",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/fr/docs/disk-manager/add-controller-nvme-vm.json b/web/messages/fr/docs/disk-manager/add-controller-nvme-vm.json
new file mode 100644
index 00000000..c4f048a2
--- /dev/null
+++ b/web/messages/fr/docs/disk-manager/add-controller-nvme-vm.json
@@ -0,0 +1,128 @@
+{
+  "meta": {
+    "title": "Ajouter un contrôleur ou un NVMe à une VM | Documentation ProxMenux",
+    "description": "Attribuez un contrôleur de stockage SATA/SAS HBA ou un périphérique NVMe à une VM Proxmox par passthrough PCI avec ProxMenux. L’outil gère l’activation d’IOMMU, la détection des conflits et l’affectation avec qm set --hostpci.",
+    "ogTitle": "Ajouter un contrôleur ou un NVMe à une VM | Documentation ProxMenux",
+    "ogDescription": "Attribuez un HBA SATA/SAS complet ou un périphérique NVMe à une VM Proxmox. ProxMenux gère IOMMU, la détection des conflits et l’affectation hostpci."
+  },
+  "header": {
+    "title": "Ajouter un contrôleur ou un NVMe à une VM",
+    "description": "Attribuez un adaptateur de bus SATA/SAS (HBA) complet ou un périphérique NVMe à une VM Proxmox par passthrough PCI. ProxMenux vérifie IOMMU et l’active avec votre accord, recense les périphériques compatibles, écarte les conflits et configure l’affectation avec qm set --hostpci.",
+    "section": "Gestionnaire de disque · VM"
+  },
+  "intro": {
+    "title": "Ce que cela fait (et ne fait pas)",
+    "body": "Il s’agit d’un <strong>passthrough au niveau du périphérique</strong> : la carte PCIe quitte le contrôle du noyau de l’hôte et est liée à <code>vfio-pci</code>. La VM voit le contrôleur lui-même, au lieu de disques transmis individuellement, et charge son propre pilote pour ce modèle précis. Tous les disques qui y sont raccordés suivent automatiquement, avec les données SMART natives, toutes les fonctions du firmware et aucune couche Proxmox intermédiaire."
+  },
+  "howRuns": {
+    "heading": "Comment fonctionne le script",
+    "body": "Le flux a deux phases avec une séparation claire entre \"collecter l'information, vérifier IOMMU et lister les candidats\" et \"en fait fixer l'appareil PCI\". Jusqu'à la confirmation finale rien n'est écrit à la config VM."
+  },
+  "iommu": {
+    "heading": "Les groupes IOMMU — pourquoi la carte entière part à la fois",
+    "body": "La limite d’isolation du passthrough PCI est le <strong>groupe IOMMU</strong>, la plus petite unité que l’IOMMU du CPU peut isoler. Les périphériques d’un même groupe ne peuvent pas être isolés les uns des autres. Si un contrôleur SATA partage son groupe avec un contrôleur USB, le passthrough SATA peut exiger de libérer aussi l’USB de l’hôte, ou être impossible. Il n’attribue pas automatiquement tous les périphériques du groupe à la VM.",
+    "outro": "ProxMenux montre le groupe IOMMU à côté de chaque appareil et vous avertit lorsqu'un groupe porte plus que le contrôleur que vous voulez. Vous pouvez toujours procéder si les périphériques supplémentaires du groupe sont acceptables (tous les contrôleurs de disque, par exemple), ou revenir en arrière s'ils ne le sont pas."
+  },
+  "prereqs": {
+    "heading": "Préalables",
+    "items": [
+      "<strong>Le CPU et la carte mère prennent en charge</strong> VT-d (Intel) ou AMD-Vi, et la fonction est activée dans le firmware (BIOS/UEFI). ProxMenux peut activer la partie noyau, mais ne peut pas modifier le réglage du firmware.",
+      "La VM cible est <strong>éteinte</strong> avant l’affectation de périphériques PCI.",
+      "Le contrôleur/NVMe <strong> n'est pas celui qui détient le système de fichiers racine Proxmox</strong>. Le script cache tout ce qui est utilisé par l'hôte.",
+      "Le système invité dispose des pilotes du contrôleur. Linux prend en charge presque tous les HBA sans ajout de pilote ; sous Windows, le pilote du fabricant doit être installé <em>avant</em> le démarrage avec le contrôleur affecté."
+    ],
+    "warnTitle": "La migration à chaud est impossible",
+    "warnBody": "Un VM avec PCI passethrough est lié au noeud qui détient physiquement la carte. La migration en direct à travers les nœuds échouera. Planifiez les sauvegardes / réplication en conséquence."
+  },
+  "steps": {
+    "heading": "Étape par étape",
+    "stepLabel": "Étape",
+    "list": [
+      {
+        "title": "Choisir la VM cible",
+        "bodyRich": "ProxMenux lit <code>qm list</code> et affiche chaque VM. Choisissez celui qui recevra le contrôleur.",
+        "img": "/disk/nvme-passthrough/vm-selection.png",
+        "alt": "Boîte de dialogue de sélection VM",
+        "caption": "Boîte de dialogue de sélection VM"
+      },
+      {
+        "title": "Vérification IOMMU",
+        "bodyRich": "Si IOMMU n’est pas activé dans la ligne de commande du noyau, ProxMenux propose de l’activer. Il modifie <code>/etc/kernel/cmdline</code> pour systemd-boot ou <code>/etc/default/grub</code> pour GRUB et ajoute le paramètre adapté au CPU :",
+        "items": [
+          "<code>intel_iommu=on</code> pour les processeurs Intel.",
+          "<code>amd_iommu=on</code> pour processeurs AMD."
+        ],
+        "outro": "Un redémarrage est nécessaire après cette modification. Le script propose de redémarrer maintenant ou plus tard ; le passthrough ne peut continuer que lorsque la nouvelle ligne de commande du noyau est active.",
+        "img": "/disk/nvme-passthrough/iommu-warning.png",
+        "alt": "Boîte de dialogue IOMMU requis",
+        "caption": "IOMMU requis : proposition d’activation et de redémarrage"
+      },
+      {
+        "title": "Énumération du périphérique",
+        "body": "ProxMenux liste tous les contrôleurs de stockage (SATA / SAS HBA) et tous les périphériques NVMe du bus PCI. Pour chaque appareil, il affiche :",
+        "items": [
+          "Adresse PCI (<code>00:17.0</code>, <code>01:00.0</code>, ...).",
+          "Description du fournisseur / de l'appareil.",
+          "Groupe IOMMU, avec un avertissement ⚠ s’il est partagé avec d’autres périphériques sans rapport.",
+          "Les disques actuellement derrière le contrôleur (pour que vous sachiez ce qui va le suivre au VM)."
+        ],
+        "img": "/disk/nvme-passthrough/device-list.png",
+        "alt": "Liste des contrôleurs et périphériques NVMe",
+        "caption": "Liste des contrôleurs et périphériques NVMe avec les groupes IOMMU"
+      },
+      {
+        "title": "Détection des conflits",
+        "bodyRich": "Le script bloque les périphériques manifestement dangereux : ceux déjà attribués à une autre VM via <code>hostpci</code> dans sa configuration, ceux utilisés par l’hôte comme le contrôleur du disque racine, ou ceux d’un groupe IOMMU dont les autres membres ne peuvent pas être identifiés de façon sûre. Les périphériques admissibles sont proposés à la sélection.",
+        "img": "/disk/nvme-passthrough/conflict-warning.png",
+        "alt": "Avertissement de détection des conflits",
+        "caption": "Détection des conflits — dispositif bloqué avec raison"
+      },
+      {
+        "title": "Affecter et terminer",
+        "bodyRich": "Pour chaque appareil sélectionné ProxMenux exécute <code>qm set &lt;VMID&gt; --hostpciN &lt;pci-addr&gt;,pcie=1</code>, en choisissant la prochaine fente libre <code>hostpci</code>. Si IOMMU a été activé pendant cette session, on vous rappelle de redémarrer avant de démarrer le VM.",
+        "img": "/disk/nvme-passthrough/assignment.png",
+        "alt": "Résumé de l'attribution",
+        "caption": "Résumé de l’affectation : emplacements hostpciN et adresses PCI attribuées"
+      }
+    ]
+  },
+  "manual": {
+    "heading": "Équivalent manuel"
+  },
+  "troubleshoot": {
+    "heading": "Dépannage",
+    "noGroupsTitle": "IOMMU activé, mais aucun groupe dans /sys/kernel/iommu_groups/",
+    "noGroupsBody": "Redémarrer est nécessaire pour que le noyau cmdline prenne effet. Si les groupes sont encore manquants après le redémarrage, VT-d / AMD-Vi est probablement désactivé dans le firmware — vérifiez la configuration BIOS/UEFI.",
+    "busyTitle": "La VM ne démarre pas : \"hostpciN: device busy\"",
+    "busyBody": "Un autre processus utilise encore le périphérique PCI. Les causes courantes sont une VM ayant planté sans le libérer ou le noyau de l’hôte l’ayant repris au dernier démarrage. Exécutez <code>lspci -nnk -s &lt;addr&gt;</code> pour identifier le pilote associé ; il devrait s’agir de <code>vfio-pci</code>. Un redémarrage complet de l’hôte résout généralement le problème.",
+    "noDisksTitle": "Invité voit le contrôleur mais pas les disques",
+    "noDisksBody": "Le système invité ne dispose pas du pilote de ce contrôleur. Ce cas est rare sous Linux, mais se présente sous Windows : installez le pilote du fabricant, par exemple LSI/Broadcom pour les anciens HBA SAS, lorsque la carte n’est pas affectée, puis redémarrez avec la carte affectée.",
+    "sharedTitle": "Le groupe IOMMU contient un périphérique sans rapport",
+    "sharedBody": "Options : (a) déplacer la carte vers un autre emplacement PCIe pour changer son groupe, (b) activer <em>ACS override</em> dans le noyau pour diviser les groupes (compromis de sécurité : se renseigner avant de l’appliquer), ou (c) choisir une autre carte dans un groupe mieux isolé."
+  },
+  "related": {
+    "heading": "Voir aussi",
+    "items": [
+      {
+        "href": "/docs/disk-manager/import-disk-vm",
+        "label": "Importer le disque vers la VM",
+        "tail": "— modèle alternatif: attachez un disque physique via Proxmox sans passage PCIe complet."
+      },
+      {
+        "href": "/docs/hardware/gpu-vm-passthrough",
+        "label": "Ajouter GPU à VM (Passthrough)",
+        "tail": "— les mêmes concepts IOMMU/VFIO appliqués à un GPU."
+      },
+      {
+        "href": "/docs/help-info/gpu-commands",
+        "label": "commandes GPU Passthrough",
+        "tail": "— Les commandes de vérification IOMMU s'appliquent également au contrôleur / NVMe passant."
+      },
+      {
+        "href": "/docs/disk-manager",
+        "label": "Aperçu du gestionnaire de disque",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/fr/docs/disk-manager/format-disk.json b/web/messages/fr/docs/disk-manager/format-disk.json
new file mode 100644
index 00000000..711986c0
--- /dev/null
+++ b/web/messages/fr/docs/disk-manager/format-disk.json
@@ -0,0 +1,142 @@
+{
+  "meta": {
+    "title": "Formater ou effacer un disque physique | Documentation ProxMenux",
+    "description": "Effacez et formatez les disques physiques sur Proxmox VE avec ProxMenux. Quatre modes, des filtres stricts excluant les disques système, montés ou utilisés, et une double confirmation avec saisie du chemin complet.",
+    "ogTitle": "Formater ou effacer un disque physique | Documentation ProxMenux",
+    "ogDescription": "Effacez ou formatez un disque physique sur Proxmox. Filtres de sécurité, quatre modes et double confirmation."
+  },
+  "header": {
+    "title": "Formater ou effacer un disque physique",
+    "description": "Effacez ou formatez un disque physique sur l’hôte Proxmox. ProxMenux ne montre que les disques entièrement libres : aucun usage par le système, aucune référence dans les invités et aucun montage. Il impose une double confirmation, oui/non puis saisie du chemin complet du disque, avant toute destruction de données.",
+    "section": "Gestionnaire de disques · Utilitaires"
+  },
+  "danger": {
+    "title": "Outil destructif",
+    "body": "Chaque opération ici écrit sur le disque. Il n'y a pas d'annulation. ProxMenux applique des filtres de sécurité stricts et des confirmations, mais la responsabilité de choisir le bon disque est à vous. Lisez le chemin du disque deux fois avant de le taper."
+  },
+  "howRuns": {
+    "heading": "Comment fonctionne le script",
+    "body": "Le processus comporte deux phases séparées par un filtre de sécurité à trois contrôles. La première recueille le choix du disque, le mode et les détails du système de fichiers. Aucune écriture n’a lieu avant la validation finale de la seconde phase, juste avant l’exécution."
+  },
+  "visibility": {
+    "heading": "Règles de visibilité",
+    "intro": "Avant même que le menu apparaisse, ProxMenux filtre la liste des disques. Seuls les candidats qui sont en sécurité sont présentés :",
+    "items": [
+      "<strong>Affichés</strong> : les disques <em>non</em> utilisés par l’hôte (pool racine, swap, montages, ZFS/LVM/RAID actifs) et <em>non</em> référencés dans une configuration VM/LXC, que l’invité soit démarré ou arrêté.",
+      "<strong>Masqués</strong> : disques de l’hôte et du système.",
+      "<strong>Masqués</strong> : disques référencés dans une configuration VM/LXC."
+    ],
+    "safetyTitle": "Sécurité lors de la confirmation et de l'exécution",
+    "safetyItems": [
+      "Les disques contenant des métadonnées anciennes ou actives déclenchent des avertissements détaillés <em>avant</em> la confirmation.",
+      "Les disques utilisés par une VM <strong>en cours d’exécution</strong> sont <strong>strictement bloqués</strong> à la confirmation.",
+      "Les disques comportant des partitions montées sont <strong>strictement bloqués</strong> à l’exécution. Une nouvelle validation a lieu juste avant toute écriture.",
+      "Deux confirmations sont toujours nécessaires : un dialogue <em>oui/non</em> et la saisie exacte du chemin complet du disque."
+    ]
+  },
+  "modes": {
+    "heading": "Modes de fonctionnement",
+    "intro": "Après avoir choisi un disque, vous choisissez l'un des quatre modes. Ils diffèrent dans ce qu'ils détruisent et ce qu'ils laissent derrière eux:",
+    "headerMode": "Mode",
+    "headerPart": "Table de partitions",
+    "headerData": "Données",
+    "headerUseCase": "Cas d'utilisation",
+    "rows": [
+      {
+        "mode": "1. Tout effacer",
+        "part": "Détruite",
+        "data": "Signatures effacées",
+        "useCase": "Supprime la table de partitions et les métadonnées de système de fichiers et RAID, met à zéro les 16 premiers et derniers Mio et, sur les disques qui prennent en charge discard, applique un TRIM à tout le disque. Le reste des données n’est pas écrasé et peut encore être récupérable sur un HDD ; ce n’est pas un effacement sécurisé."
+      },
+      {
+        "mode": "2. Supprimer les étiquettes FS",
+        "part": "Préservé",
+        "data": "Préservé",
+        "useCase": "Supprime les anciennes signatures ZFS / LVM / RAID pour empêcher la prise en charge automatique du disque. Les données utilisateur ne sont pas écrasées en bloc, mais la suppression des signatures peut les rendre inaccessibles."
+      },
+      {
+        "mode": "3. Écraser les données avec des zéros",
+        "part": "Préservé",
+        "data": "Détruites (écrasées par des zéros)",
+        "useCase": "Écraser les partitions existantes avec des zéros en conservant la table de partitions. Les espaces non alloués et les zones de réserve des SSD ne sont pas couverts ; cela ne garantit pas un assainissement complet du périphérique."
+      },
+      {
+        "mode": "4. Format complet",
+        "part": "Nouvelle GPT",
+        "data": "Détruite",
+        "useCase": "Disque prêt à utiliser avec une seule nouvelle partition et un nouveau système de fichiers."
+      }
+    ],
+    "fullFormatOutro": "<strong>Format complet</strong> continue avec deux dialogues supplémentaires:",
+    "fullFormatItems": [
+      "<strong>Système de fichiers</strong> : <code>ext4</code>, <code>xfs</code>, <code>exfat</code> (portable) ou <code>btrfs</code>. Si un outil manque, par exemple <code>mkfs.btrfs</code>, l’opération s’arrête avec un message explicite.",
+      "<strong>Étiquette</strong> : nom facultatif du système de fichiers pour l’identifier."
+    ]
+  },
+  "steps": {
+    "heading": "Étape par étape",
+    "stepLabel": "Étape",
+    "list": [
+      {
+        "title": "Choisir un disque libre",
+        "body": "ProxMenux liste les disques qui passent les filtres ci-dessus. Ceux marqués ⚠ contiennent d’anciennes métadonnées dont les détails sont affichés pour vous indiquer ce que vous allez écraser."
+      },
+      {
+        "title": "Choisir un mode d'opération",
+        "bodyRich": "Choisissez <strong>Tout effacer</strong>, <strong>Supprimer les étiquettes FS</strong>, <strong>Écraser les données avec des zéros</strong> ou <strong>Format complet</strong> selon le tableau ci-dessus."
+      },
+      {
+        "title": "(Format complet seulement) Choisir le système de fichiers et l'étiquette",
+        "body": "ext4 / xfs / exfat / btrfs, plus une étiquette en option."
+      },
+      {
+        "title": "Confirmer deux fois",
+        "bodyRich": "ProxMenux présente un résumé de ce qui va se passer. Vous acceptez avec une boîte de dialogue oui/non et <strong> tapez le chemin complet du disque</strong> exactement comme indiqué (par exemple <code>/dev/sdc</code>). Tout le reste avorte."
+      },
+      {
+        "title": "Revalidation et exécution",
+        "body": "Juste avant d'écrire, le script revérifie l'état du disque. Si une partition a été montée ou un VM a commencé dans l'intervalle, l'exécution est interrompue. Sinon, l'opération choisie tourne et un résumé est imprimé à la fin."
+      }
+    ]
+  },
+  "manual": {
+    "heading": "Équivalents manuels",
+    "body": "Si vous préférez exécuter les commandes équivalentes à la main :"
+  },
+  "troubleshoot": {
+    "notListedTitle": "Disque non listé dans le menu",
+    "notListedBody": "Il a été filtré pour la sécurité. Raisons courantes : il est monté (même à <code>/mnt/tmp</code>), il est un membre actif ZFS / LVM / RAID, il est référencé par une config VM ou LXC, ou c'est votre disque racine Proxmox. Exécutez <code>lsblk -f</code> et <code>cat /proc/mdstat</code> sur l'hôte pour comprendre pourquoi.",
+    "busyTitle": "\"Disk may be busy\" / échec du démontage",
+    "busyBody": "Quelque chose tient toujours un fichier ouvert sur une partition de ce disque — le plus souvent un conteneur ou un shell dont cwd est à l'intérieur d'un point de montage. Identifiez-le avec <code>lsof | grep /dev/sdX</code> ou <code>fuser -vm /dev/sdX1</code>, arrêtez-le, puis lancez l'outil."
+  },
+  "related": {
+    "heading": "Voir aussi",
+    "items": [
+      {
+        "href": "/docs/disk-manager/smart-disk-test",
+        "label": "Santé et test du disque SMART",
+        "tail": "— vérifier un disque avant / après l'essuyage pour confirmer qu'il est sain."
+      },
+      {
+        "href": "/docs/disk-manager/import-disk-vm",
+        "label": "Importer le disque vers la VM",
+        "tail": "— passer un disque fraîchement formaté à un VM."
+      },
+      {
+        "href": "/docs/storage-share/host-local-disk",
+        "label": "Ajouter le disque local comme stockage Proxmox",
+        "tail": " — enregistrer un disque essuyé comme stockage Proxmox pool."
+      },
+      {
+        "href": "/docs/help-info/storage-commands",
+        "label": "Commandes de stockage et de disques",
+        "tail": " — référence de lsblk, blkid et parted."
+      },
+      {
+        "href": "/docs/disk-manager",
+        "label": "Aperçu du gestionnaire de disque",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/fr/docs/disk-manager/import-disk-image-vm.json b/web/messages/fr/docs/disk-manager/import-disk-image-vm.json
new file mode 100644
index 00000000..769f0b5f
--- /dev/null
+++ b/web/messages/fr/docs/disk-manager/import-disk-image-vm.json
@@ -0,0 +1,110 @@
+{
+  "meta": {
+    "title": "Importer une image disque dans une VM | Documentation ProxMenux",
+    "description": "Importez un fichier image disque (.img / .qcow2 / .vmdk / .raw) dans une VM Proxmox existante avec ProxMenux. Interface, émulation SSD et option de démarrage par image, avec qm importdisk en arrière-plan.",
+    "ogTitle": "Importer une image disque dans une VM | Documentation ProxMenux",
+    "ogDescription": "Importer des images disque .img / .qcow2 / .vmdk / .raw dans un VM existant avec ProxMenux. Utilise qm importdisk sous le capot."
+  },
+  "header": {
+    "title": "Importer l'image disque vers la VM",
+    "description": "Importer un fichier image disque (.img, .qcow2, .vmdk ou .raw) dans un Proxmox VM existant. ProxMenux recueille toutes les décisions dès le départ — cible VM, stockage Proxmox, répertoire source, interface, émulation SSD, ordre de démarrage — et exécute ensuite qm importdisk pour chaque image sélectionnée.",
+    "section": "Gestionnaire de disque · VM"
+  },
+  "intro": {
+    "title": "Ce que ça fait",
+    "body": "Contrairement à <em>Importer le disque vers la VM</em>, qui affecte un disque physique brut, ce processus utilise un <strong>fichier</strong> sur l’hôte, exporté d’un autre hyperviseur, téléchargé comme image cloud ou extrait d’une sauvegarde. Il le convertit en disque de VM Proxmox sur le stockage choisi. L’original est conservé : ProxMenux le copie sans le déplacer."
+  },
+  "howRuns": {
+    "heading": "Comment fonctionne le script",
+    "body": "Le flux a deux phases. La phase 1 recueille toutes les décisions (VM, stockage, répertoire source, images, options par image) directement via des dialogues. La phase 2 exécute <code>qm importdisk</code> pour chaque image sélectionnée. Jusqu'à ce que la phase 2 commence, rien n'est copié et la configuration VM n'est pas touchée."
+  },
+  "prereqs": {
+    "heading": "Préalables",
+    "items": [
+      "Au moins une VM est définie sur l’hôte. La VM cible doit être <strong>éteinte</strong>.",
+      "Au moins un fichier image d'un format pris en charge dans le répertoire source. Prise en charge: <code>.img</code>, <code>.qcow2</code>, <code>.vmdk</code>, <code>.raw</code>.",
+      "Assez d'espace libre sur le stockage Proxmox cible pour tenir chaque disque importé.",
+      "ProxMenux recherche des images dans <code>/var/lib/vz/template/iso</code> par défaut. Vous pouvez le pointer vers n'importe quel autre répertoire de l'hôte quand il le demande."
+    ]
+  },
+  "steps": {
+    "heading": "Étape par étape",
+    "stepLabel": "Étape",
+    "list": [
+      {
+        "title": "Choisir la VM cible",
+        "bodyRich": "ProxMenux lit <code>qm list</code> et affiche chaque VM. Choisissez celui qui recevra le ou les disques importés."
+      },
+      {
+        "title": "Choisir le stockage Proxmox",
+        "bodyRich": "La liste contient chaque stockage qui a le type de contenu <code>images</code> activé. S'il n'y a qu'un seul candidat, il est sélectionné automatiquement et le dialogue est ignoré."
+      },
+      {
+        "title": "Choisir le répertoire source",
+        "bodyRich": "Choisissez le répertoire par défaut (<code>/var/lib/vz/template/iso</code>) ou saisissez un autre chemin, généralement celui où vous avez téléchargé ou envoyé l’image. Le script refuse les chemins inexistants."
+      },
+      {
+        "title": "Choisissez une ou plusieurs images",
+        "bodyRich": "Le répertoire est scanné pour les fichiers <code>.img</code> / <code>.qcow2</code> / <code>.vmdk</code> / <code>.raw</code>. Vous pouvez en sélectionner plusieurs à la fois; chacun d'eux passera par les options par image dans la prochaine étape."
+      },
+      {
+        "title": "Options par image",
+        "intro": "Pour chaque image sélectionnée ProxMenux demande:",
+        "items": [
+          "<strong>Interface</strong> — <code>scsi</code> (par défaut), <code>virtio</code>, <code>sata</code> ou <code>ide</code>. Correspond à la façon dont l'invité verra le disque.",
+          "<strong>Émulation SSD</strong> : proposée uniquement pour les interfaces autres que VirtIO. Ajoute <code>ssd=1</code> pour que l’invité reconnaisse un disque SSD. La prise en charge de discard/TRIM doit être configurée séparément.",
+          "<strong>Amorçable</strong> : si vous répondez oui, ProxMenux place le disque en tête de l’ordre de démarrage de la VM."
+        ]
+      },
+      {
+        "title": "Importer et connecter",
+        "bodyRich": "ProxMenux exécute <code>qm importdisk</code> pour chaque image, en convertissant le format si nécessaire. Il connecte le disque au prochain emplacement libre (<code>scsiN</code>, <code>sataN</code>, …) avec les options choisies et met à jour l’ordre de démarrage si un disque a été marqué comme amorçable. La progression s’affiche dans le terminal."
+      }
+    ]
+  },
+  "manual": {
+    "heading": "Équivalent manuel",
+    "body": "L’importation d’une seule image correspond à trois commandes <code>qm</code> :",
+    "warnTitle": "Conversion du format d'image",
+    "warnBody": "Lorsque le stockage cible ne peut pas contenir le format source nativement (par exemple, le stockage LVM ne peut pas contenir <code>.qcow2</code>), <code>qm importdisk</code> convertit l'image de manière transparente. Cela peut prendre plusieurs minutes pour les images multi-GB; planifier en conséquence et ne pas interrompre le script."
+  },
+  "troubleshoot": {
+    "heading": "Dépannage",
+    "noImagesTitle": "\"Aucune image disque compatible trouvée\"",
+    "noImagesBody": "Le script n’a trouvé aucun fichier <code>.img</code>, <code>.qcow2</code>, <code>.vmdk</code> ou <code>.raw</code>. Vérifiez la casse de l’extension, la présence du fichier directement dans le répertoire choisi (les sous-répertoires ne sont pas parcourus) et les droits de lecture de root.",
+    "slowTitle": "L'importation est lente",
+    "slowBody": "Les conversions entre VMDK, QCOW2 et raw peuvent être limitées par le CPU et les entrées-sorties. La vitesse dépend des lectures à la source, des écritures à destination et de la décompression éventuelle. Préférez des sources raw ou qcow2 si possible.",
+    "uefiTitle": "Le disque importé démarre dans le shell UEFI",
+    "uefiBody": "L’image a été créée pour le mode hérité (SeaBIOS), mais la VM utilise OVMF, ou inversement. Changez le BIOS de la VM dans Proxmox pour correspondre à l’image, ou recréez l’image dans le bon mode avant l’importation."
+  },
+  "related": {
+    "heading": "Voir aussi",
+    "items": [
+      {
+        "href": "/docs/disk-manager/import-disk-vm",
+        "label": "Importer le disque vers la VM",
+        "tail": "— même flux mais pour les disques physiques bruts (passthrough)."
+      },
+      {
+        "href": "/docs/utils/import-vm",
+        "label": "Importer VM de OVA / OVF",
+        "tail": "— lorsque vous avez un paquet complet VM, pas seulement une image de disque."
+      },
+      {
+        "href": "/docs/utils/UUp-Dump-ISO-Creator",
+        "label": "Créateur d’ISO UUP Dump",
+        "tail": "— générer une ISO Windows si vous en avez besoin pour une nouvelle installation."
+      },
+      {
+        "href": "/docs/help-info/storage-commands",
+        "label": "Commandes de stockage et de disques",
+        "tail": " — référence de qm importdisk et qemu-img convert."
+      },
+      {
+        "href": "/docs/disk-manager",
+        "label": "Aperçu du gestionnaire de disque",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/fr/docs/disk-manager/import-disk-lxc.json b/web/messages/fr/docs/disk-manager/import-disk-lxc.json
new file mode 100644
index 00000000..b98a47f2
--- /dev/null
+++ b/web/messages/fr/docs/disk-manager/import-disk-lxc.json
@@ -0,0 +1,115 @@
+{
+  "meta": {
+    "title": "Importer le disque vers LXC | ProxMenux Documentation",
+    "description": "Joindre un disque physique à un conteneur LXC existant sur Proxmox VE en utilisant ProxMenux. Gestion de la détection de système de fichiers / formatage, point de montage, non privilégié → conversion privilégiée et chemins de périphériques persistants.",
+    "ogTitle": "Importer le disque vers LXC | ProxMenux Documentation",
+    "ogDescription": "Connectez un disque physique à un conteneur LXC existant. Gestion du système de fichiers, du point de montage et de la conversion de non privilégié à privilégié."
+  },
+  "header": {
+    "title": "Importer un disque vers LXC",
+    "description": "Connectez un disque physique à un conteneur LXC existant sur l’hôte Proxmox. ProxMenux détecte les disques libres, propose de les formater avec un système de fichiers pris en charge, puis relie la partition à un point de montage dans le conteneur à l’aide de chemins de périphériques persistants.",
+    "section": "Gestionnaire de disque · LXC"
+  },
+  "intro": {
+    "title": "Passthrough VM vs Passthrough LXC",
+    "body": "Ce passthrough LXC <strong>ne fournit pas un périphérique bloc brut</strong>. Le conteneur reçoit un <em>point de montage</em>, c’est-à-dire un répertoire reposant sur une partition choisie sur l’hôte. Contrairement à une VM, il utilise le noyau de l’hôte ; le système de fichiers (ext4/xfs/btrfs) est donc lu et géré par l’hôte Proxmox puis exposé au conteneur."
+  },
+  "howRuns": {
+    "heading": "Comment fonctionne le script",
+    "body": "Le processus comporte deux phases distinctes : collecte des informations et des choix, puis modification effective de la configuration du conteneur. Rien n’est monté dans le CT avant la confirmation finale.",
+    "summary": "ProxMenux exclut le disque racine, les disques montés et ceux référencés dans une configuration VM/LXC. Les membres actifs de ZFS/LVM/RAID sont masqués ; les anciennes signatures portent un symbole ⚠ pour pouvoir les effacer avant le formatage."
+  },
+  "prereqs": {
+    "heading": "Préalables",
+    "items": [
+      "Au moins un conteneur LXC défini sur l'hôte.",
+      "Le conteneur est <strong>privilégié</strong>, ou vous acceptez la conversion proposée par le script.",
+      "Au moins un disque physique non utilisé par l'hôte ou tout autre invité."
+    ],
+    "warnTitle": "Conteneur privilégié requis",
+    "warnBody": "Ce script exige un conteneur <strong>privilégié</strong> pour connecter directement le disque. S’il détecte <code>unprivileged: 1</code>, il propose de modifier <code>/etc/pve/lxc/&lt;CTID&gt;.conf</code> sur place. Cela change le modèle de sécurité sans remapper les propriétaires des fichiers existants. Sauvegardez le conteneur et vérifiez les propriétaires avant d’accepter, ou recréez-le en mode privilégié."
+  },
+  "steps": {
+    "heading": "Étape par étape",
+    "stepLabel": "Étape",
+    "list": [
+      {
+        "title": "Choisir le conteneur cible",
+        "img": "/disk/select-container.png",
+        "caption": "Menu de sélection des conteneurs",
+        "bodyRich": "ProxMenux liste tous les conteneurs LXC de l’hôte (<code>pct list</code>). Choisissez celui qui recevra le disque. S’il est non privilégié, le script propose de le convertir maintenant."
+      },
+      {
+        "title": "Choisir le disque physique",
+        "img": "/disk/disk-selection-ct.png",
+        "caption": "Disques libres détectés sur l’hôte, avec ⚠ pour les anciennes métadonnées",
+        "bodyRich": "Seuls les candidats sûrs sont affichés. Contrairement au processus pour VM, ce script connecte <strong>un disque par exécution</strong>. Relancez-le pour chaque disque supplémentaire."
+      },
+      {
+        "title": "Formater ou réutiliser",
+        "intro": "Le script inspecte le disque :",
+        "items": [
+          "S'il porte déjà un système de fichiers supporté (ext4 / xfs / btrfs), vous pouvez le réutiliser tel quel (les fichiers existants sont conservés).",
+          "S'il n'a pas de système de fichiers pris en charge, vous êtes offert pour le formater. Choisir ext4 / xfs / btrfs."
+        ]
+      },
+      {
+        "title": "Choisir le point de montage",
+        "bodyRich": "Tapez le chemin où le conteneur doit voir le disque, par exemple. <code>/mnt/data</code> ou <code>/mnt/disk_passthrough</code>. C'est le chemin <em>dans le conteneur</em> ; l'hôte voit déjà la partition sous <code>/dev/disk/by-id/…</code>."
+      },
+      {
+        "title": "Connecter et vérifier",
+        "img": "/disk/assignment-ct.png",
+        "caption": "Attribution à CT",
+        "bodyRich": "ProxMenux ajoute une nouvelle entrée <code>mpN:</code> à la configuration du conteneur, saute les index déjà utilisés et relise la configuration pour la confirmer. Si le conteneur est en cours d'exécution, le montage est en direct; sinon, il prend effet au prochain départ.",
+        "extraImg": "/disk/result-point.png",
+        "extraAlt": "Point de montage créé avec succès",
+        "extraCaption": "Point de montage créé et vérifié"
+      }
+    ]
+  },
+  "manual": {
+    "heading": "Équivalent manuel",
+    "body": "Le script enveloppe <code>pct set</code>. Une invocation directe pour un seul disque ressemble à :"
+  },
+  "important": {
+    "heading": "Considérations importantes",
+    "items": [
+      "<strong>Un disque par exécution</strong>. Relancez le script pour chaque disque supplémentaire.",
+      "Ne connectez <strong>pas</strong> la même partition à plusieurs conteneurs susceptibles de la monter simultanément : les écritures concurrentes corrompent le système de fichiers.",
+      "<strong>Les anciennes métadonnées</strong> (signature RAID / ZFS / LVM) doivent être effacées manuellement avant que le script ne vous laisse formater, sinon <code>mkfs</code> refuse d'écraser. Utilisez l'outil <wipeLink>Format / Wipe Physical Disk</wipeLink> pour cela."
+    ]
+  },
+  "troubleshoot": {
+    "heading": "Dépannage",
+    "unprivTitle": "\"Ne peut pas continuer avec un conteneur non privilégié\"",
+    "unprivBody": "Vous avez refusé la conversion : le script s’est arrêté sans rien modifier. Pour continuer, relancez-le et acceptez : le script arrête le conteneur, sauvegarde sa configuration dans <code>/etc/pve/lxc/&lt;CTID&gt;.conf.bak</code> et remplace <code>unprivileged: 1</code> par <code>unprivileged: 0</code>. Ce changement ne convertit pas à lui seul les UID/GID des fichiers existants ; sauvegardez donc d’abord le conteneur et corrigez les propriétaires, ou restaurez ou recréez-le en mode privilégié.",
+    "permsTitle": "Les autorisations à l'intérieur du conteneur sont erronées",
+    "permsBody": "Le montage dans un conteneur privilégié conserve les propriétaires des fichiers existants ; un système de fichiers neuf appartient souvent à <code>root:root</code>. Si le service utilise un autre compte, par exemple <code>www-data</code> pour Nextcloud, vérifiez son UID/GID et ajustez les fichiers nécessaires avec <code>chown</code>/<code>chmod</code>. Ces changements affectent aussi le disque sous-jacent."
+  },
+  "related": {
+    "heading": "Voir aussi",
+    "items": [
+      {
+        "href": "/docs/disk-manager/import-disk-vm",
+        "label": "Importer le disque vers la VM",
+        "tail": " — processus équivalent pour les VM."
+      },
+      {
+        "href": "/docs/storage-share/lxc-mount-points",
+        "label": "Points de montage LXC (hôte ↔ CT)",
+        "tail": "— partager les répertoires hôtes avec un CT au lieu de fixer un disque entier."
+      },
+      {
+        "href": "/docs/help-info/vm-ct-commands",
+        "label": "Commandes de gestion VM et CT",
+        "tail": "— pct config / push / pull reference."
+      },
+      {
+        "href": "/docs/disk-manager",
+        "label": "Aperçu du gestionnaire de disque",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/fr/docs/disk-manager/import-disk-vm.json b/web/messages/fr/docs/disk-manager/import-disk-vm.json
new file mode 100644
index 00000000..483ca8b4
--- /dev/null
+++ b/web/messages/fr/docs/disk-manager/import-disk-vm.json
@@ -0,0 +1,113 @@
+{
+  "meta": {
+    "title": "Importer le disque vers VM | ProxMenux Documentation",
+    "description": "Connectez un disque physique à une VM Proxmox existante avec ProxMenux. Détection excluant les disques système, montés, utilisés ou membres actifs ZFS/RAID/LVM, chemins persistants /dev/disk/by-id et interfaces SATA / SCSI / VirtIO / IDE.",
+    "ogTitle": "Importer le disque vers VM | ProxMenux Documentation",
+    "ogDescription": "Joindre un disque physique à un Proxmox VM existant. Utilise des chemins de /dev/disk/by-id persistants et prend en charge SATA / SCSI / VirtIO / IDE."
+  },
+  "header": {
+    "title": "Importer le disque vers la VM",
+    "description": "Joindre un disque physique qui existe déjà sur l'hôte Proxmox à une machine virtuelle existante. ProxMenux détecte les disques libres, vous permet de choisir la cible VM, le type de bus (SATA / SCSI / VirtIO / IDE) et fixe tout en utilisant des chemins de /dev/disk/by-id persistants afin que la cartographie survive aux reboots et aux changements d'ordre des appareils.",
+    "section": "Gestionnaire de disque · VM"
+  },
+  "intro": {
+    "title": "Ce que ça fait",
+    "body": "Cette méthode utilise un disque physique brut comme support d’une interface de disque virtuel. L’invité ne reçoit pas automatiquement les données SMART natives ni les fonctions du contrôleur physique ; utilisez le passthrough PCI du contrôleur si elles sont nécessaires. Le disque est connecté via son chemin <code>/dev/disk/by-id/…</code> lorsqu’il existe, pour préserver l’affectation si l’ordre des périphériques change au démarrage ; sinon, <code>/dev/sdX</code> est utilisé."
+  },
+  "howRuns": {
+    "heading": "Comment fonctionne le script",
+    "body": "Le processus comporte deux phases distinctes : collecte des informations et des choix, puis connexion des disques à la VM. La configuration reste inchangée jusqu’à la confirmation finale.",
+    "summary": "ProxMenux exclut les candidats non sûrs : disque racine, disques montés sur l’hôte, membres actifs ZFS/LVM/RAID et disques référencés dans une configuration VM/LXC. Ceux comportant d’<em>anciennes</em> métadonnées ZFS/RAID/LVM inutilisées sont marqués ⚠, sans être bloqués."
+  },
+  "prereqs": {
+    "heading": "Préalables",
+    "items": [
+      "Au moins un VM défini sur l'hôte (le script envoie directement à <code>qm list</code>).",
+      "La <strong>VM cible est éteinte</strong>. Si elle fonctionne, le script s’arrête avec un message ; l’ajout à chaud de disques n’est pas pris en charge par ce processus.",
+      "Au moins un disque physique sur l'hôte qui n'est pas utilisé par l'hôte ou tout autre invité."
+    ]
+  },
+  "steps": {
+    "heading": "Étape par étape",
+    "stepLabel": "Étape",
+    "list": [
+      {
+        "title": "Choisir la VM cible",
+        "bodyRich": "ProxMenux liste toutes les VM de l’hôte avec <code>qm list</code>. Choisissez celle qui recevra le disque. Si elle fonctionne, le script s’arrête et demande de l’éteindre d’abord."
+      },
+      {
+        "title": "Choisissez le ou les disques physiques à attacher",
+        "img": "/disk/disk-selection.png",
+        "caption": "Disques libres détectés sur l’hôte, avec ⚠ pour les anciennes métadonnées",
+        "body": "Le script examine les disques de l’hôte et ne propose que ceux pouvant être connectés sans conflit. La liste permet d’en sélectionner plusieurs. Les disques avec d’anciennes signatures ZFS/LVM/RAID restent affichés avec ⚠ pour indiquer qu’il faut effacer ces signatures avant leur formatage par l’invité."
+      },
+      {
+        "title": "Choisissez l'interface du bus",
+        "img": "/disk/disk-assigment.png",
+        "caption": "Sélection de l'interface de bus",
+        "intro": "Choisissez comment l'invité devrait voir le disque:",
+        "items": [
+          "<strong>SCSI</strong> — par défaut moderne pour Linux et Windows avec les pilotes VirtIO-SCSI installés.",
+          "<strong>SATA</strong> — large compatibilité, fonctionne hors de la boîte sur presque tous les invités.",
+          "<strong>VirtIO</strong> : périphérique bloc paravirtualisé efficace ; nécessite des pilotes dans l’invité.",
+          "<strong>IDE</strong> — pour les anciens clients qui n'ont aucun des pilotes ci-dessus."
+        ]
+      },
+      {
+        "title": "Connecter et vérifier",
+        "bodyRich": "ProxMenux attache chaque disque sélectionné avec son meilleur chemin <code>/dev/disk/by-id/</code>, saute les index des fentes qui sont déjà utilisés dans la config VM (<code>scsi0</code>, <code>sata0</code>, ...) et relis la config pour confirmer l'assignation. Un résumé est imprimé à la fin."
+      }
+    ]
+  },
+  "manual": {
+    "heading": "Équivalent manuel",
+    "body": "Le script est un wrapper autour de <code>qm set</code>. La commande exacte pour un seul disque ressemble à ceci :",
+    "migrationTitle": "La migration à chaud est impossible",
+    "migrationBody": "Une VM avec un disque physique connecté directement est <strong>liée à l’hôte qui expose ce disque</strong>. Un autre nœud ne dispose généralement ni du même chemin <code>/dev/disk/by-id/…</code> ni des données. Sauvegardez et transférez ces données séparément, ou utilisez des disques virtuels gérés sur stockage partagé ou avec réplication prise en charge. Ne supposez pas que la réplication Proxmox couvre ce périphérique.",
+    "shareTitle": "Ne partagez pas de disque physique entre VMs",
+    "shareBody": "La fixation du même disque physique à deux VMs en même temps corrompra les données sur l'écriture suivante. ProxMenux détecte cette situation et la bloque, mais si vous contournez le script (direct <code>qm set</code>), assurez-vous qu'un seul invité monte le disque."
+  },
+  "troubleshoot": {
+    "heading": "Dépannage",
+    "noDisksTitle": "\"Aucun disque disponible pour ce VM\"",
+    "noDisksIntro": "Le script a trouvé des disques, mais chaque candidat a été filtré. Raisons communes:",
+    "noDisksItems": [
+      "Chaque disque restant est déjà référencé dans la configuration de la cible VM.",
+      "Chaque disque restant est monté sur l'hôte ou fait partie d'un ZFS / LVM / RAID actif.",
+      "L'hôte a seulement le disque racine installé."
+    ],
+    "noDisksOutro": "Exécutez <code>lsblk -f</code> sur l'hôte pour examiner l'état de chaque disque.",
+    "noVisibleTitle": "VM ne voit pas le disque après le démarrage",
+    "noVisibleBody": "Si vous avez choisi <strong>SCSI</strong> ou <strong>VirtIO</strong>, l'invité a besoin du pilote correspondant. Sur Linux qui est natif du noyau; sur Windows vous avez besoin de l'ISO VirtIO et d'un pilote d'installation (voir la page <winLink>Créer VM: Système Windows</winLink>). Le passage à SATA dans l'onglet matériel du VM est une solution rapide pour confirmer que le disque est physiquement attaché."
+  },
+  "related": {
+    "heading": "Voir aussi",
+    "items": [
+      {
+        "href": "/docs/disk-manager/import-disk-image-vm",
+        "label": "Importer l'image disque vers la VM",
+        "tail": " — même processus pour les fichiers image (qcow2 / vmdk / raw / img)."
+      },
+      {
+        "href": "/docs/disk-manager/import-disk-lxc",
+        "label": "Importer un disque vers LXC",
+        "tail": " — processus équivalent pour les conteneurs LXC."
+      },
+      {
+        "href": "/docs/disk-manager/add-controller-nvme-vm",
+        "label": "Ajouter un contrôleur ou un NVMe à une VM",
+        "tail": "— lorsque vous avez besoin d'un PCIe complet / NVMe passthrough plutôt que le disque attaché."
+      },
+      {
+        "href": "/docs/help-info/storage-commands",
+        "label": "Commandes de stockage et de disques",
+        "tail": " — référence de qm importdisk et des commandes shell associées."
+      },
+      {
+        "href": "/docs/disk-manager",
+        "label": "Aperçu du gestionnaire de disque",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/fr/docs/disk-manager/index.json b/web/messages/fr/docs/disk-manager/index.json
new file mode 100644
index 00000000..a8ca828c
--- /dev/null
+++ b/web/messages/fr/docs/disk-manager/index.json
@@ -0,0 +1,135 @@
+{
+  "meta": {
+    "title": "Gestionnaire de disques Proxmox : VM/LXC, tests SMART et effacement | ProxMenux",
+    "description": "Gérez les disques physiques d’un hôte Proxmox VE avec ProxMenux : connexion aux VM ou LXC (qm set scsi/sata/virtio, pct mp), import d’images img / qcow2 / vmdk / raw, passthrough de HBA ou contrôleurs NVMe complets, effacement avec contrôles de sécurité et autotests SMART.",
+    "ogTitle": "Gestionnaire de disques Proxmox : VM/LXC, tests SMART et effacement",
+    "ogDescription": "Connecter des disques aux VM/LXC, importer des images, utiliser le passthrough PCI des contrôleurs, effacer avec contrôles de sécurité et lancer des tests SMART sur Proxmox VE.",
+    "twitterTitle": "Gestionnaire de disques Proxmox | ProxMenux",
+    "twitterDescription": "Connexion de disques aux VM/LXC, import d’images, passthrough PCI, effacement avec contrôles de sécurité et tests SMART."
+  },
+  "header": {
+    "title": "Gestionnaire de disque",
+    "description": "Le menu Gestionnaire de disques regroupe les outils ProxMenux pour les disques physiques de l’hôte : connexion aux VM et LXC, import d’images, passthrough d’un contrôleur complet ou d’un périphérique NVMe, effacement avec contrôles de sécurité et tests SMART.",
+    "section": "Gestionnaire de disque"
+  },
+  "intro": {
+    "title": "Ce menu sert à",
+    "body": "Ces outils utilisent les <strong>disques physiques visibles par l’hôte Proxmox et les fichiers image qui y sont stockés</strong>. Le menu comporte trois groupes : <strong>VM</strong> (connexion de disques ou import d’images), <strong>LXC</strong> (connexion à un conteneur) et <strong>Utilitaires</strong> (formatage et état SMART). Les opérations de connexion et d’effacement masquent ou bloquent les disques système et utilisés ; SMART peut les examiner sans les effacer."
+  },
+  "opening": {
+    "heading": "Ouverture du menu",
+    "body": "Dans le menu principal de ProxMenux, sélectionnez <strong>Disk Manager</strong>. Vous verrez ceci :",
+    "imageAlt": "Menu Gestionnaire de disque avec blocs VM, LXC et Utilitaires"
+  },
+  "groups": {
+    "heading": "Trois groupes d'outils",
+    "intro": "Le menu est organisé en trois groupes : <strong>VM</strong>, <strong>LXC</strong> et <strong>Utilitaires</strong>. Cliquez sur une carte pour accéder directement aux outils du groupe.",
+    "vmTitle": "VM",
+    "vmBody": "Outils qui fonctionnent sur des machines virtuelles existantes. Le VM doit être éteint; ProxMenux le valide avant de toucher la configuration.",
+    "vmItems": [
+      "Importer le disque vers la VM",
+      "Importer l'image disque vers la VM",
+      "Ajouter un contrôleur ou un NVMe à une VM"
+    ],
+    "lxcTitle": "LXC",
+    "lxcBody": "Outils pour conteneurs LXC existants. Ce script exige un conteneur privilégié et propose de changer le paramètre si nécessaire. Lisez d’abord les précautions sur la conversion et les propriétaires des fichiers sur la page de l’outil.",
+    "lxcItems": [
+      "Importer un disque vers LXC"
+    ],
+    "utilitiesTitle": "Utilitaires",
+    "utilitiesBody": "Outils côté hôte qui fonctionnent sur les disques eux-mêmes, indépendamment de tout VM ou conteneur.",
+    "utilitiesItems": [
+      "Formater ou effacer un disque physique",
+      "Santé et test du disque SMART"
+    ]
+  },
+  "vm": {
+    "heading": "VM",
+    "intro": "Outils qui fonctionnent sur des machines virtuelles existantes. Le VM doit être éteint; ProxMenux le valide avant de toucher la configuration.",
+    "options": [
+      {
+        "icon": "HardDrive",
+        "href": "/docs/disk-manager/import-disk-vm",
+        "title": "Importer le disque vers la VM",
+        "description": "Joindre un disque physique non assigné à un VM existant. Prend en charge SATA / SCSI / VirtIO / IDE, utilise des chemins de /dev/disk/by-id persistants."
+      },
+      {
+        "icon": "FileDown",
+        "href": "/docs/disk-manager/import-disk-image-vm",
+        "title": "Importer l'image disque vers la VM",
+        "description": "Importez des images disque (.img / .qcow2 / .vmdk / .raw) dans une VM existante. Processus en deux phases utilisant qm importdisk."
+      },
+      {
+        "icon": "Cpu",
+        "href": "/docs/disk-manager/add-controller-nvme-vm",
+        "title": "Ajouter un contrôleur ou un NVMe à une VM",
+        "description": "Passthrough PCI d’un HBA SATA/SAS complet ou d’un périphérique NVMe à une VM. Gestion de l’activation d’IOMMU et de la détection des conflits."
+      }
+    ]
+  },
+  "lxc": {
+    "heading": "LXC",
+    "intro": "Outils pour conteneurs LXC existants. Ce script exige un conteneur privilégié et propose de changer le paramètre si nécessaire. Lisez d’abord les précautions sur la conversion et les propriétaires des fichiers sur la page de l’outil.",
+    "options": [
+      {
+        "icon": "Boxes",
+        "href": "/docs/disk-manager/import-disk-lxc",
+        "title": "Importer un disque vers LXC",
+        "description": "Joindre un disque physique non assigné à un conteneur LXC existant comme point de montage. Gérer la détection de système de fichiers / format et la conversion privilégiée."
+      }
+    ]
+  },
+  "utilities": {
+    "heading": "Utilitaires",
+    "intro": "Outils côté hôte qui fonctionnent sur les disques eux-mêmes, indépendamment de tout VM ou conteneur.",
+    "options": [
+      {
+        "icon": "Eraser",
+        "href": "/docs/disk-manager/format-disk",
+        "title": "Formater/effacer le disque physique (sûr)",
+        "description": "Effacement de disques avec des contrôles stricts : seuls les disques entièrement libres sont affichés et une double confirmation est toujours requise."
+      },
+      {
+        "icon": "Activity",
+        "href": "/docs/disk-manager/smart-disk-test",
+        "title": "Santé et test du disque SMART",
+        "description": "Exécutez des contrôles de santé SMART et des auto-tests courts/longs sur les disques SATA, SAS et NVMe. Exporte JSON pour le moniteur."
+      }
+    ]
+  },
+  "safety": {
+    "title": "Règles de sécurité pour la connexion et l’effacement des disques",
+    "intro": "Les opérations de connexion et d’effacement excluent les périphériques susceptibles de nuire à l’hôte :",
+    "items": [
+      "Le <strong>disque système</strong> et les membres actifs du pool racine, du swap et de ZFS/LVM/RAID sont toujours masqués.",
+      "Les disques <strong> montés</strong> n'importe où sur l'hôte sont cachés ou bloqués lors de l'exécution.",
+      "Les disques <strong> référencés par un VM ou LXC</strong> en cours d'exécution ne peuvent pas être réaffectés ou effacés.",
+      "Les opérations qui peuvent modifier l'état hôte (activer IOMMU, effacer) nécessitent une confirmation explicite."
+    ]
+  },
+  "related": {
+    "heading": "Voir aussi",
+    "items": [
+      {
+        "href": "/docs/storage-share",
+        "label": "Gestionnaire de stockage et de partage",
+        "tail": "— enregistrer le stockage dans Proxmox lui-même (NFS / Samba / iSCSI / local) et partager les dossiers entre hôte et CT."
+      },
+      {
+        "href": "/docs/help-info/storage-commands",
+        "label": "Commandes de stockage et de disques",
+        "tail": " — référence des périphériques bloc, LVM, pvesm et SMART."
+      },
+      {
+        "href": "/docs/help-info/zfs-commands",
+        "label": "Commandes de gestion ZFS",
+        "tail": "— pour les pools et ensembles de données ZFS."
+      },
+      {
+        "href": "/docs/hardware/gpu-vm-passthrough",
+        "label": "Ajouter GPU à VM (Passthrough)",
+        "tail": "— les mêmes concepts IOMMU/VFIO appliqués aux GPU."
+      }
+    ]
+  }
+}
diff --git a/web/messages/fr/docs/disk-manager/smart-disk-test.json b/web/messages/fr/docs/disk-manager/smart-disk-test.json
new file mode 100644
index 00000000..2f7381a6
--- /dev/null
+++ b/web/messages/fr/docs/disk-manager/smart-disk-test.json
@@ -0,0 +1,146 @@
+{
+  "meta": {
+    "title": "État et tests SMART des disques | Documentation ProxMenux",
+    "description": "Effectuez des contrôles SMART et des tests de disques sur Proxmox VE avec ProxMenux. Prise en charge de SATA/SAS avec smartmontools et de NVMe avec nvme-cli, autotests courts et longs et export JSON pour ProxMenux Monitor.",
+    "ogTitle": "État et tests SMART des disques | Documentation ProxMenux",
+    "ogDescription": "SMART contrôles de santé et auto-tests pour les disques SATA / SAS et NVMe sur Proxmox. Exportation de JSON pour le moniteur."
+  },
+  "header": {
+    "title": "Santé et test du disque SMART",
+    "description": "Lisez les données SMART et lancez des autotests sur les disques physiques de l’hôte Proxmox. ProxMenux installe automatiquement smartmontools pour SATA/SAS et nvme-cli pour NVMe, lance les tests dans le firmware du disque (les tests longs continuent après la fermeture du terminal) et exporte les résultats JSON pour ProxMenux Monitor.",
+    "section": "Gestionnaire de disques · Utilitaires"
+  },
+  "intro": {
+    "title": "C'est pour quoi ?",
+    "body": "SMART (Autosurveillance, analyse et technologie de rapport) permet au lecteur lui-même de signaler sa santé et de faire des auto-tests. Cet outil expose ces données sans que vous ayez besoin de vous souvenir de la bonne invocation <code>smartctl</code> / <code>nvme</code> et persiste la sortie en tant que JSON afin que le moniteur puisse grapher les tendances au fil du temps."
+  },
+  "howRuns": {
+    "heading": "Comment fonctionne le script",
+    "body": "Toutes les actions ici sont non destructives — SMART lit les compteurs de firmware de disque, et les auto-tests sont en attente dans le lecteur lui-même. Aucune séparation de phase n'est nécessaire. Le flux est: vérification de dépendance → sélection de disque → sélection d'action → invocation d'outil (smartctl ou nvme-cli selon le bus disque) → sortie imprimée plus l'exportation de JSON pour le moniteur."
+  },
+  "deps": {
+    "heading": "Dépendances",
+    "body": "L'outil installe automatiquement ce dont il a besoin à la première fois. Les lecteurs SATA / SAS dépendent de <code>smartmontools</code>; les lecteurs NVMe dépendent de <code>nvme-cli</code>. Les deux :"
+  },
+  "actions": {
+    "heading": "Actions disponibles",
+    "headerAction": "Action",
+    "headerWhat": "Ce qu'il lit / exécute",
+    "headerDur": "Durée",
+    "rows": [
+      {
+        "action": "État de santé rapide",
+        "whatRich": "État global PASSED/FAILED et attributs clés.<br /><code>smartctl -H</code> + <code>-A</code> (SATA/SAS) ou <code>nvme smart-log</code> (NVMe).",
+        "dur": "Instantané"
+      },
+      {
+        "action": "Rapport complet",
+        "whatRich": "Données complètes SMART, scrollable. <code>smartctl -x</code> pour SATA/SAS ou <code>nvme smart-log</code> + <code>id-ctrl</code> pour NVMe.",
+        "dur": "Instantané"
+      },
+      {
+        "action": "Essai court",
+        "what": "Contrôle élémentaire de la surface et des circuits, lancé dans le firmware du disque.",
+        "dur": "~2 minutes"
+      },
+      {
+        "action": "Essai long",
+        "what": "Analyse complète de la surface. Elle s’exécute sur le disque et continue même si vous fermez le terminal.",
+        "dur": "Heures (selon la taille du disque)"
+      },
+      {
+        "action": "Vérifier la progression du test",
+        "what": "Statut de l'auto-essai actif ou le plus récent.",
+        "dur": "Instantané"
+      }
+    ],
+    "tipTitle": "Les longs essais survivent à la fermeture du terminal",
+    "tipBody": "Un test long s’exécute <em>dans le disque</em> sans dépendre du maintien du processus ProxMenux. Vous pouvez fermer le terminal et revenir à <strong>Vérifier la progression du test</strong>. Un redémarrage de l’hôte, une réinitialisation du contrôleur ou une coupure de courant peut interrompre le test et la collecte des résultats ; ne présumez pas d’une reprise automatique."
+  },
+  "json": {
+    "heading": "Exportation de JSON pour le moniteur",
+    "intro": "Les actions d’état, de test court et de progression écrivent un JSON horodaté dans <code>/usr/local/share/proxmenux/smart/&lt;disk&gt;/</code> ; les résultats des tests longs sont collectés en arrière-plan. Le rapport complet est uniquement affiché. Structure :",
+    "outro": "ProxMenux Monitor utilise ces fichiers pour afficher l’évolution de l’état de chaque disque. Les anciens fichiers sont supprimés automatiquement lorsque la limite de conservation est atteinte."
+  },
+  "steps": {
+    "heading": "Étape par étape",
+    "stepLabel": "Étape",
+    "list": [
+      {
+        "title": "Choisir un disque",
+        "body": "ProxMenux répertorie chaque disque physique de l'hôte avec son modèle et sa taille. Contrairement à l'outil Format, cette liste n'est pas filtrée par sécurité — lire SMART est une opération non destructive.",
+        "img": "/disk/smart/disk-selection.png",
+        "alt": "Menu de sélection de disque SMART",
+        "caption": "Menu de sélection de disque SMART"
+      },
+      {
+        "title": "Choisir une action",
+        "body": "Choisissez entre état de santé rapide, rapport complet, test court, test long ou vérifier les progrès. Le menu reste ouvert après chaque action afin que vous puissiez enchaîner plusieurs requêtes contre le même disque.",
+        "img": "/disk/smart/action-menu.png",
+        "alt": "Menu d'action SMART",
+        "caption": "Menu d'action SMART (actions 5 + annulation)"
+      },
+      {
+        "title": "(Test long seulement) Confirmer l'exécution de fond",
+        "body": "ProxMenux indique que le test continuera après la fermeture du terminal et montre où sera enregistré le résultat JSON. Confirmez pour lancer le test.",
+        "img": "/disk/smart/long-test-warning.png",
+        "alt": "Boîte de dialogue de confirmation de test longue",
+        "caption": "Confirmation de test longue — fonctionne en arrière-plan, résultat enregistré en JSON"
+      },
+      {
+        "title": "Examen des résultats",
+        "bodyRich": "L’état, les tests et la progression s’affichent dans le terminal ; <strong>Rapport complet</strong> s’ouvre dans une boîte de dialogue défilante. Le JSON est exporté pour les actions décrites plus haut, sauf Rapport complet. Pour les tests longs, revenez à <strong>Vérifier la progression du test</strong> sur le même disque.",
+        "img": "/disk/smart/quick-status.png",
+        "alt": "État de santé rapide",
+        "caption": "État de santé rapide (SATA — smartctl -H + -A)"
+      }
+    ]
+  },
+  "manual": {
+    "heading": "Équivalents manuels",
+    "nvmeWarnTitle": "Les autotests NVMe dépendent du firmware du disque",
+    "nvmeWarnBody": "Chaque lecteur NVMe ne supporte pas la commande d'auto-test courte/long. Si un lecteur refuse le test, le journal SMART et les données du contrôleur ID (<code>nvme smart-log</code> + <code>id-ctrl</code>) sont toujours le signal de santé le plus fiable."
+  },
+  "troubleshoot": {
+    "heading": "Dépannage",
+    "noSmartTitle": "\"Ne pouvait pas lire les données SMART de /dev/sdX\"",
+    "noSmartBody": "Le disque est probablement derrière un contrôleur RAID / SAS qui ne passe pas SMART à travers. Avec des cartes à base de megaraid, essayez <code>smartctl -d megaraid,N /dev/sdX</code>. Pour les HBA en mode IT, l'invocation directe fonctionne.",
+    "longTitle": "Un long test ne se termine jamais",
+    "longBody": "Le disque exécute le test dans son firmware et une forte activité peut le retarder. Essayez pendant une période calme, par exemple la nuit. Pour SATA, <code>smartctl -c</code> indique le pourcentage restant, et pour SAS, <code>smartctl -l selftest</code> ; le journal des autotests contient l’état final et les éventuels LBA en erreur. Une erreur de lecture doit être examinée ; la lenteur seule ne prouve pas un secteur défectueux."
+  },
+  "related": {
+    "heading": "Voir aussi",
+    "items": [
+      {
+        "href": "/docs/disk-manager/format-disk",
+        "label": "Formater ou effacer un disque physique",
+        "tail": "— réutiliser un disque après avoir confirmé sa santé."
+      },
+      {
+        "href": "/docs/help-info/storage-commands",
+        "label": "Commandes de stockage et de disques → État SMART",
+        "tail": "— référence smartctl / nvme."
+      },
+      {
+        "href": "/docs/help-info/zfs-commands",
+        "label": "Commandes de gestion ZFS",
+        "tail": " — zpool scrub vérifie les sommes de contrôle des données ZFS et complète les tests matériels SMART."
+      },
+      {
+        "href": "/docs/monitor/dashboard/storage",
+        "label": "ProxMenux Monitor — onglet de stockage",
+        "tail": " — vue détaillée du disque utilisant le JSON exporté ici : table SMART complète, historique et rapport PDF."
+      },
+      {
+        "href": "/docs/monitor/dashboard/hardware",
+        "label": "ProxMenux Monitor — Onglet matériel",
+        "tail": "— Sommaire de stockage avec modèle, capacité et vitesse de liaison négociée (courant vs maximum sur NVMe)."
+      },
+      {
+        "href": "/docs/disk-manager",
+        "label": "Aperçu du gestionnaire de disque",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/fr/docs/external-repositories.json b/web/messages/fr/docs/external-repositories.json
new file mode 100644
index 00000000..fa4ded52
--- /dev/null
+++ b/web/messages/fr/docs/external-repositories.json
@@ -0,0 +1,58 @@
+{
+  "meta": {
+    "title": "Dépôts externes | Documentation ProxMenux",
+    "description": "ProxMenux intègre certains dépôts de scripts externes, notamment community-scripts et ZimaOS, comme alternatives dans ses menus. La source de chaque script est indiquée ; les bogues sont à signaler à son responsable d’origine.",
+    "ogTitle": "Dépôts externes | Documentation ProxMenux",
+    "ogDescription": "Dépôts de scripts externes intégrés comme alternatives dans les menus de ProxMenux."
+  },
+  "header": {
+    "title": "Dépôts externes",
+    "description": "ProxMenux intègre certains dépôts de scripts externes comme alternatives dans ses menus. Ces scripts proviennent de sources tierces de confiance, clairement indiquées lors de leur affichage dans le menu.",
+    "section": "Dépôts externes"
+  },
+  "practice": {
+    "title": "Ce que cela signifie dans la pratique",
+    "body": "Lorsqu’une option utilise un script externe plutôt que du code propre à ProxMenux, le menu indique son origine et le dépôt chargé. ProxMenux sert de lanceur et ne modifie pas ces scripts. Les problèmes liés à leur fonctionnement relèvent du responsable du dépôt d’origine."
+  },
+  "integrated": {
+    "heading": "Dépôts actuellement intégrés",
+    "usedInLabel": "Utilisé dans:",
+    "items": [
+      {
+        "name": "community-scripts / ProxmoxVE",
+        "url": "https://community-scripts.github.io/ProxmoxVE/",
+        "description": "Successeur spirituel des scripts d’aide de tteck. Vaste catalogue de scripts qui déploient en une seule exécution des LXC (Home Assistant, Plex, Frigate…), des VM, des extensions et des réglages PVE.",
+        "usedIn": "Lanceur de Helper Scripts et Réseau (correction de l’offloading réseau pour Intel e1000e)"
+      }
+    ]
+  },
+  "attribution": {
+    "heading": "Attribution et reconnaissance",
+    "items": [
+      "Les auteurs d’origine sont toujours cités dans le menu et sur la page qui documente l’intégration du script.",
+      "Un lien vers le dépôt source est affiché avant l’exécution du script et sur la page de documentation correspondante.",
+      "Soutenez les développeurs de ces projets externes avec une ⭐, un parrainage ou des rapports de bogues bien documentés."
+    ]
+  },
+  "report": {
+    "title": "Où signaler les problèmes avec les scripts externes",
+    "body": "Si un script externe ne fonctionne pas comme prévu, <strong>signalez-le directement dans son dépôt</strong>, pas à ProxMenux. ProxMenux le télécharge et l’exécute sans modifier son code. Son responsable d’origine pourra analyser et corriger le problème. Les issues de ProxMenux concernent le lanceur ou l’intégration du script."
+  },
+  "suggest": {
+    "heading": "Proposer de nouveaux dépôts externes",
+    "intro": "Vous avez trouvé un script ou un dépôt qui s'intégrerait bien dans un menu ProxMenux ? Suggérez-le via:",
+    "discussionTitle": "💬 Ouvrir une discussion",
+    "discussionBody": "Idéal pour les idées : recueillez l’avis de la communauté avant d’en faire une demande de fonctionnalité.",
+    "issueTitle": "🐛 Ouvrir une issue",
+    "issueBody": "Pour les demandes de fonctionnalités précises, au périmètre clairement défini."
+  },
+  "candidate": {
+    "title": "Ce qui fait un bon candidat à l'intégration",
+    "items": [
+      "Code source ouvert et responsable actif.",
+      "Idempotent : peut être exécuté plusieurs fois sans risque.",
+      "Ne modifie pas la configuration principale de Proxmox sans le signaler.",
+      "Résout un problème que ProxMenux ne couvre pas encore, sans dupliquer les fonctionnalités."
+    ]
+  }
+}
diff --git a/web/messages/fr/docs/glossary.json b/web/messages/fr/docs/glossary.json
new file mode 100644
index 00000000..b4d4103e
--- /dev/null
+++ b/web/messages/fr/docs/glossary.json
@@ -0,0 +1,677 @@
+{
+  "meta": {
+    "title": "Glossaire | Documentation ProxMenux",
+    "description": "Définitions des termes employés dans la documentation ProxMenux : Proxmox, stockage, réseau et virtualisation.",
+    "ogTitle": "Glossaire | Documentation ProxMenux",
+    "ogDescription": "Référence rapide pour les termes techniques utilisés dans la documentation ProxMenux."
+  },
+  "header": {
+    "title": "Glossaire",
+    "description": "Définitions courtes des termes utilisés dans ProxMenux et pour décrire le fonctionnement de Proxmox.",
+    "section": "Glossaire"
+  },
+  "callout": {
+    "title": "Comment utiliser cette page",
+    "bodyRich": "Chaque entrée comporte une catégorie et une courte définition. Les liens <em>Voir aussi</em> ouvrent la documentation correspondante. Utilisez la navigation A–Z pour accéder directement à une lettre."
+  },
+  "jumpHeading": "Aller à la lettre",
+  "seeAlsoLabel": "Voir aussi:",
+  "aliasesLabel": "aussi:",
+  "missingCallout": {
+    "title": "Il manque un terme ?",
+    "leadRich": "Si un terme manque, ouvrez une issue ou une PR sur <ext>GitHub</ext>. Le glossaire se trouve dans <code>web/messages/en/docs/glossary.json</code>, avec les catalogues correspondants pour chaque langue."
+  },
+  "entries": [
+    {
+      "term": "ACS",
+      "aliases": [
+        "Access Control Services",
+        "Contournement ACS"
+      ],
+      "category": "Virtualisation",
+      "definitionRich": "Fonctions de contrôle d’accès PCIe contribuant à isoler le trafic entre périphériques. Les groupes IOMMU dépendent du matériel et de la topologie. Le correctif <em>ACS override</em> peut diviser les groupes signalés par Linux, sans ajouter d’isolation matérielle ; les attribuer à des VM distinctes présente un risque de sécurité.",
+      "seeAlso": [
+        {
+          "label": "Ajouter le contrôleur ou NVMe au VM",
+          "href": "/docs/disk-manager/add-controller-nvme-vm"
+        }
+      ]
+    },
+    {
+      "term": "ARC",
+      "aliases": [
+        "Adaptive Replacement Cache"
+      ],
+      "category": "Stockage",
+      "definitionRich": "Cache de lecture ZFS en RAM de l’hôte, contenant les blocs récemment et fréquemment utilisés. Sa limite par défaut dépend de la version et de l’installation de Proxmox. Les options de post-installation ProxMenux permettent de la plafonner.",
+      "seeAlso": [
+        {
+          "label": "Après installation : stockage",
+          "href": "/docs/post-install/storage"
+        },
+        {
+          "label": "Commandes ZFS",
+          "href": "/docs/help-info/zfs-commands"
+        }
+      ]
+    },
+    {
+      "term": "Montage bind",
+      "category": "Linux",
+      "definitionRich": "Fonction Linux rendant une partie du système de fichiers accessible depuis un autre chemin. ProxMenux utilise ces montages pour partager des répertoires de l’hôte avec les conteneurs LXC via <code>pct set -mpN</code>.",
+      "seeAlso": [
+        {
+          "label": "Points de montage LXC",
+          "href": "/docs/storage-share/lxc-mount-points"
+        }
+      ]
+    },
+    {
+      "term": "Agrégat réseau",
+      "aliases": [
+        "Regroupement d’interfaces réseau",
+        "Agrégation de liens"
+      ],
+      "category": "Réseau",
+      "definitionRich": "Regroupe plusieurs interfaces physiques en une interface logique pour la redondance (active-backup), le débit agrégé (LACP / 802.3ad), ou les deux. Configuration dans <code>/etc/network/interfaces</code>."
+    },
+    {
+      "term": "Pont",
+      "aliases": [
+        "vmbrX",
+        "vmbr0",
+        "Pont Linux"
+      ],
+      "category": "Réseau",
+      "definitionRich": "Commutateur virtuel de couche 2 sur l’hôte. <code>vmbr0</code> relie généralement les invités au réseau physique. D’autres ponts (<code>vmbr1</code>, <code>vmbr2</code>...) permettent de séparer les réseaux selon leurs liaisons physiques et leur configuration.",
+      "seeAlso": [
+        {
+          "label": "Analyse des ponts et réparation guidée",
+          "href": "/docs/network/bridge-analysis"
+        }
+      ]
+    },
+    {
+      "term": "Ceph",
+      "category": "Stockage",
+      "definitionRich": "Stockage distribué intégré à Proxmox pour les clusters hyperconvergés. Les OSD (Object Storage Daemons) constituent la base du stockage objet, bloc et fichier. La version Ceph requise dépend de la version Proxmox et du parcours de mise à niveau ; consultez le guide correspondant.",
+      "seeAlso": [
+        {
+          "label": "Mettre à niveau le PVE 8 vers le PVE 9",
+          "href": "/docs/utils/upgrade-pve8-pve9"
+        }
+      ]
+    },
+    {
+      "term": "CT",
+      "aliases": [
+        "Conteneur",
+        "Conteneur LXC"
+      ],
+      "category": "Proxmox",
+      "definitionRich": "Abréviation de « conteneur » dans Proxmox pour une instance LXC. Son CTID numérique correspond à <code>/etc/pve/lxc/&lt;CTID&gt;.conf</code>. Voir aussi <strong>LXC</strong>.",
+      "seeAlso": [
+        {
+          "label": "Gestion des VM et conteneurs",
+          "href": "/docs/help-info/vm-ct-commands"
+        }
+      ]
+    },
+    {
+      "term": "deb822",
+      "category": "Linux",
+      "definitionRich": "Format moderne des sources APT : fichiers <code>.sources</code> en blocs structurés avec les champs Types, URIs, Suites, Components et Signed-By. Remplace le format à une ligne <code>.list</code> et devient la norme à partir de PVE 9 / Debian Trixie.",
+      "seeAlso": [
+        {
+          "label": "Mettre à niveau le PVE 8 vers le PVE 9",
+          "href": "/docs/utils/upgrade-pve8-pve9"
+        }
+      ]
+    },
+    {
+      "term": "dGPU",
+      "aliases": [
+        "GPU dédié"
+      ],
+      "category": "Virtualisation",
+      "definitionRich": "Carte graphique distincte, généralement reliée en PCIe, contrairement à un <strong>iGPU</strong>. Elle peut être attribuée à une VM via VFIO ou utilisée par plusieurs conteneurs LXC via les fichiers de périphérique et le pilote hôte, selon la compatibilité matérielle et applicative.",
+      "seeAlso": [
+        {
+          "label": "Ajouter un GPU à une VM (passthrough)",
+          "href": "/docs/hardware/gpu-vm-passthrough"
+        }
+      ]
+    },
+    {
+      "term": "Dialog",
+      "category": "Linux",
+      "definitionRich": "Outil basé sur ncurses pour afficher menus, invites et barres de progression dans le terminal. Les menus ProxMenux utilisent dialog."
+    },
+    {
+      "term": "DKMS",
+      "aliases": [
+        "Prise en charge du module de noyau dynamique"
+      ],
+      "category": "Linux",
+      "definitionRich": "Infrastructure de recompilation des modules externes enregistrés, comme NVIDIA ou ZFS, lors d’un changement de noyau. La compilation nécessite des sources compatibles et les en-têtes correspondants.",
+      "seeAlso": [
+        {
+          "label": "Installer le Coral TPU (Host)",
+          "href": "/docs/hardware/install-coral-tpu-host"
+        }
+      ]
+    },
+    {
+      "term": "Fail2Ban",
+      "category": "Linux",
+      "definitionRich": "Service qui détecte les échecs d’authentification répétés dans les journaux et bloque les IP concernées via le pare-feu. ProxMenux fournit des jails préconfigurées pour SSH, l’interface Proxmox et Monitor.",
+      "seeAlso": [
+        {
+          "label": "Fail2Ban",
+          "href": "/docs/security/fail2ban"
+        }
+      ]
+    },
+    {
+      "term": "Fastfetch",
+      "category": "Linux",
+      "definitionRich": "Outil d’information système avec dessin ASCII affiché à l’ouverture d’une session shell. Remplace <code>neofetch</code> et peut être activé dans les options de post-installation ProxMenux.",
+      "seeAlso": [
+        {
+          "label": "Après installation : options",
+          "href": "/docs/post-install/optional"
+        }
+      ]
+    },
+    {
+      "term": "GRUB",
+      "aliases": [
+        "GRand Unified Bootloader"
+      ],
+      "category": "Linux",
+      "definitionRich": "Chargeur d’amorçage des installations Linux utilisant GRUB. Configuration dans <code>/etc/default/grub</code> et <code>/boot/grub/</code> ; appliquez les modifications avec <code>update-grub</code>. Proxmox peut aussi utiliser systemd-boot : vérifiez le chargeur actif avant de modifier les paramètres du noyau.",
+      "seeAlso": [
+        {
+          "label": "commandes GPU Passthrough",
+          "href": "/docs/help-info/gpu-commands"
+        }
+      ]
+    },
+    {
+      "term": "iGPU",
+      "aliases": [
+        "GPU intégré"
+      ],
+      "category": "Virtualisation",
+      "definitionRich": "Processeur graphique intégré au boîtier du CPU, comme Intel UHD / Iris ou Radeon dans les APU Ryzen. Il est souvent partagé entre plusieurs LXC via <code>/dev/dri</code>, plutôt qu’attribué exclusivement à une VM.",
+      "seeAlso": [
+        {
+          "label": "Ajouter un GPU à LXC",
+          "href": "/docs/hardware/igpu-acceleration-lxc"
+        }
+      ]
+    },
+    {
+      "term": "ifupdown / ifupdown2",
+      "category": "Réseau",
+      "definitionRich": "Système classique de configuration réseau Debian, basé sur <code>/etc/network/interfaces</code>. Proxmox utilise par défaut sa réécriture <code>ifupdown2</code>, qui permet le rechargement à chaud avec <code>ifreload -a</code>."
+    },
+    {
+      "term": "initramfs",
+      "category": "Linux",
+      "definitionRich": "Système de fichiers initial en RAM utilisé avant le montage de la racine réelle. Il contient les pilotes nécessaires au démarrage. Après modification de VFIO, de l’IOMMU ou des pilotes de stockage, reconstruisez-le avec <code>update-initramfs -u -k all</code>."
+    },
+    {
+      "term": "IOMMU",
+      "aliases": [
+        "Unité de gestion de la mémoire d ' entrée/sortie",
+        "VT-d",
+        "AMD-Vi"
+      ],
+      "category": "Virtualisation",
+      "definitionRich": "Fonction matérielle (Intel VT-d / AMD-Vi) nécessaire au passthrough PCIe vers les VM. Activez-la dans le firmware et vérifiez son activation dans le noyau. Selon la plateforme et les valeurs par défaut, les paramètres <code>intel_iommu=on</code> ou <code>amd_iommu=on</code> peuvent être nécessaires.",
+      "seeAlso": [
+        {
+          "label": "Post-Installation : Virtualisation",
+          "href": "/docs/post-install/virtualization"
+        },
+        {
+          "label": "Ajouter un GPU à une VM (passthrough)",
+          "href": "/docs/hardware/gpu-vm-passthrough"
+        }
+      ]
+    },
+    {
+      "term": "Groupe IOMMU",
+      "category": "Virtualisation",
+      "definitionRich": "Ensemble de périphériques constituant la plus petite unité d’isolation IOMMU. Ses membres ne sont pas nécessairement isolés entre eux ; vérifiez-les tous avant une attribution VFIO. Liste : <code>find /sys/kernel/iommu_groups/ -type l | sort -V</code>."
+    },
+    {
+      "term": "iSCSI",
+      "aliases": [
+        "Internet SCSI"
+      ],
+      "category": "Stockage",
+      "definitionRich": "Protocole de stockage bloc sur IP : un disque distant apparaît comme un périphérique SCSI local. Ajout dans Proxmox via <code>pvesm add iscsi</code>.",
+      "seeAlso": [
+        {
+          "label": "Ajouter la cible iSCSI comme stockage Proxmox",
+          "href": "/docs/storage-share/host-iscsi"
+        }
+      ]
+    },
+    {
+      "term": "KVM",
+      "aliases": [
+        "Machine virtuelle à noyau"
+      ],
+      "category": "Virtualisation",
+      "definitionRich": "Module du noyau Linux transformant l’hôte en hyperviseur. Associé à <strong>QEMU</strong> pour l’émulation des périphériques, il constitue la base des VM Proxmox."
+    },
+    {
+      "term": "LVM",
+      "aliases": [
+        "Logical Volume Manager"
+      ],
+      "category": "Stockage",
+      "definitionRich": "Gestionnaire de volumes Linux regroupant le stockage physique en groupes (VG) contenant des volumes logiques (LV). Les installations Proxmox basées sur LVM utilisent souvent LVM-thin pour les disques invités ; d’autres solutions existent. Outils : <code>pvs</code>, <code>vgs</code> et <code>lvs</code>.",
+      "seeAlso": [
+        {
+          "label": "Commandes de stockage et de disques",
+          "href": "/docs/help-info/storage-commands"
+        }
+      ]
+    },
+    {
+      "term": "LXC",
+      "aliases": [
+        "Linux Containers"
+      ],
+      "category": "Linux",
+      "definitionRich": "Virtualisation au niveau du système : des espaces utilisateur isolés partagent le noyau hôte. Généralement moins de surcoût que les VM, avec une frontière d’isolation différente. Proxmox gère les LXC via <code>pct</code>.",
+      "seeAlso": [
+        {
+          "label": "Gestion des VM et conteneurs",
+          "href": "/docs/help-info/vm-ct-commands"
+        }
+      ]
+    },
+    {
+      "term": "Lynis",
+      "category": "Linux",
+      "definitionRich": "Outil d’audit de sécurité libre de CISOfy. Analyse l’hôte et fournit un score de durcissement ainsi que des recommandations concrètes. ProxMenux installe la version du dépôt GitHub d’origine plutôt que le paquet Debian plus ancien.",
+      "seeAlso": [
+        {
+          "label": "Lynis",
+          "href": "/docs/security/lynis"
+        }
+      ]
+    },
+    {
+      "term": "Adresse MAC",
+      "aliases": [
+        "Adresse matérielle"
+      ],
+      "category": "Réseau",
+      "definitionRich": "Identifiant d’interface Ethernet, généralement sur 48 bits, attribué par le matériel ou le logiciel. Les <em>Noms réseau persistants</em> de ProxMenux associent les MAC à des noms stables (<code>eno1</code>, <code>enp3s0</code>) malgré une nouvelle énumération PCI.",
+      "seeAlso": [
+        {
+          "label": "Noms d'interface persistants",
+          "href": "/docs/network/persistent-names"
+        }
+      ]
+    },
+    {
+      "term": "MOTD",
+      "aliases": [
+        "Message du jour"
+      ],
+      "category": "Linux",
+      "definitionRich": "Texte affiché après connexion SSH, stocké dans <code>/etc/motd</code>. ProxMenux peut ajouter une bannière après installation ; la désinstallation restaure le fichier précédent si une sauvegarde existe."
+    },
+    {
+      "term": "NFS",
+      "aliases": [
+        "Système de fichiers réseau"
+      ],
+      "category": "Stockage",
+      "definitionRich": "Protocole de partage de fichiers réseau issu d’Unix. Ajout comme stockage Proxmox via <code>pvesm add nfs</code> ; ProxMenux propose aussi des assistants pour clients et serveurs NFS en LXC.",
+      "seeAlso": [
+        {
+          "label": "Gestionnaire de stockage et de partage",
+          "href": "/docs/storage-share"
+        }
+      ]
+    },
+    {
+      "term": "nftables / iptables",
+      "category": "Réseau",
+      "definitionRich": "Outils de pare-feu Linux. <code>nftables</code> est l’infrastructure moderne ; <code>iptables</code> peut utiliser un moteur classique ou compatible nft. Le service classique <code>pve-firewall</code> utilise iptables ; l’alternative proxmox-firewall utilise nftables.",
+      "seeAlso": [
+        {
+          "label": "Commandes réseau",
+          "href": "/docs/help-info/network-commands"
+        }
+      ]
+    },
+    {
+      "term": "nouveau",
+      "category": "Linux",
+      "definitionRich": "Pilote graphique NVIDIA libre inclus dans Linux. Pour installer le pilote propriétaire, empêchez nouveau de prendre en charge le même GPU, généralement en bloquant son chargement et en reconstruisant l’initramfs.",
+      "seeAlso": [
+        {
+          "label": "Guide d'installation NVIDIA",
+          "href": "/guides/nvidia"
+        }
+      ]
+    },
+    {
+      "term": "Dépôt no-subscription",
+      "category": "Proxmox",
+      "definitionRich": "Dépôt de paquets Proxmox accessible sans abonnement entreprise. Les paquets sont moins validés que dans le dépôt enterprise, recommandé par Proxmox en production. Les options de post-installation ProxMenux permettent de configurer les dépôts.",
+      "seeAlso": [
+        {
+          "label": "Post-Install: Paramètres de base",
+          "href": "/docs/post-install/basic-settings"
+        }
+      ]
+    },
+    {
+      "term": "OVA / OVF",
+      "aliases": [
+        "Open Virtualization Format"
+      ],
+      "category": "Virtualisation",
+      "definitionRich": "Formats DMTF pour distribuer des VM portables. <strong>OVA</strong> regroupe les fichiers dans une archive TAR ; <strong>OVF</strong> décrit la VM en XML avec ses fichiers disque, souvent VMDK. La prise en charge de l’import dépend de l’hyperviseur cible et de la configuration.",
+      "seeAlso": [
+        {
+          "label": "Exportation de VM vers OVA / OVF",
+          "href": "/docs/utils/export-vm"
+        },
+        {
+          "label": "Importer VM de OVA / OVF",
+          "href": "/docs/utils/import-vm"
+        }
+      ]
+    },
+    {
+      "term": "OVMF",
+      "aliases": [
+        "firmware UEFI",
+        "Open Virtual Machine Firmware"
+      ],
+      "category": "Virtualisation",
+      "definitionRich": "Firmware UEFI pour VM, sélectionné avec <code>qm set &lt;vmid&gt; -bios ovmf</code>. Utilisé pour les invités UEFI, notamment Windows 11 et les configurations Secure Boot. <code>efidisk0</code> conserve les variables EFI ; beaucoup d’autres invités acceptent encore le BIOS classique.",
+      "seeAlso": [
+        {
+          "label": "Ajouter un GPU à une VM (passthrough)",
+          "href": "/docs/hardware/gpu-vm-passthrough"
+        }
+      ]
+    },
+    {
+      "term": "PBS",
+      "aliases": [
+        "Proxmox Backup Server"
+      ],
+      "category": "Proxmox",
+      "definitionRich": "Produit de sauvegarde Proxmox distinct avec transferts incrémentaux, déduplication et chiffrement côté client facultatif pour VM et CT. Utilisable comme destination vzdump ; un serveur séparé est préférable au stockage des sauvegardes sur l’hôte protégé."
+    },
+    {
+      "term": "pct",
+      "category": "Proxmox",
+      "definitionRich": "Outil en ligne de commande pour gérer les conteneurs LXC dans Proxmox : <code>pct list / start / stop / shutdown / config / enter / exec / push / pull / destroy</code>.",
+      "seeAlso": [
+        {
+          "label": "Gestion des VM et conteneurs",
+          "href": "/docs/help-info/vm-ct-commands"
+        }
+      ]
+    },
+    {
+      "term": "pmxcfs",
+      "aliases": [
+        "Proxmox Cluster Filesystem"
+      ],
+      "category": "Proxmox",
+      "definitionRich": "Système de fichiers virtuel basé sur FUSE, monté dans <code>/etc/pve/</code>. Réplique la configuration entre les nœuds du cluster : les modifications sous <code>/etc/pve/</code> sont propagées automatiquement."
+    },
+    {
+      "term": "pveam",
+      "aliases": [
+        "Gestionnaire d'appliances Proxmox VE"
+      ],
+      "category": "Proxmox",
+      "definitionRich": "Outil du catalogue local de modèles CT. <code>pveam update</code> actualise l’index ; <code>pveam available</code> liste les modèles et <code>pveam download &lt;storage&gt; &lt;template&gt;</code> en télécharge un."
+    },
+    {
+      "term": "pveproxy",
+      "category": "Proxmox",
+      "definitionRich": "Service HTTPS de l’interface et du terminal web Proxmox, sur le port 8006. Il redémarre pendant les mises à niveau majeures ; ProxMenux refuse donc de lancer PVE 8 → 9 depuis le terminal web."
+    },
+    {
+      "term": "pvesm",
+      "aliases": [
+        "Gestionnaire de stockage Proxmox"
+      ],
+      "category": "Proxmox",
+      "definitionRich": "Outil CLI pour la gestion du stockage Proxmox. <code>pvesm status</code> affiche tous les stockages configurés; <code>pvesm add &lt;type&gt;</code> enregistre de nouveaux stockages (NFS, Samba, iSCSI, dir, ZFS, LVM, ...).",
+      "seeAlso": [
+        {
+          "label": "Commandes de stockage et de disques",
+          "href": "/docs/help-info/storage-commands"
+        }
+      ]
+    },
+    {
+      "term": "Conteneur privilégié",
+      "category": "Linux",
+      "definitionRich": "Conteneur LXC dont root <em>correspond à l’UID 0 de l’hôte</em>, avec toujours des espaces de noms et d’autres restrictions. Moins isolé qu’un conteneur non privilégié. GPU, USB et Samba ne nécessitent pas systématiquement ce mode ; les droits et les correspondances UID comptent."
+    },
+    {
+      "term": "ProxMenux Monitor",
+      "category": "ProxMenux",
+      "definitionRich": "Tableau de bord web facultatif de ProxMenux. Affiche les statistiques hôte en temps réel (CPU, RAM, disques, réseau), une vue des VM et LXC, et une connexion avec 2FA, sur le port TCP <code>8008</code>.",
+      "seeAlso": [
+        {
+          "label": "ProxMenux Monitor",
+          "href": "/docs/settings/proxmenux-monitor"
+        }
+      ]
+    },
+    {
+      "term": "qcow2",
+      "aliases": [
+        "QEMU Copy-On-Write v2"
+      ],
+      "category": "Stockage",
+      "definitionRich": "Format d’image disque VM courant sur le stockage de type répertoire. Prend en charge l’allocation à la demande, les instantanés et la copie sur écriture. Conversion : <code>qemu-img convert -O qcow2 ...</code>."
+    },
+    {
+      "term": "qm",
+      "aliases": [
+        "Gestionnaire QEMU"
+      ],
+      "category": "Proxmox",
+      "definitionRich": "Outil de gestion des VM Proxmox : <code>qm list / start / stop / shutdown / config / set / destroy / importdisk / migrate</code>. Équivalent de <code>pct</code> pour les conteneurs.",
+      "seeAlso": [
+        {
+          "label": "Gestion des VM et conteneurs",
+          "href": "/docs/help-info/vm-ct-commands"
+        }
+      ]
+    },
+    {
+      "term": "Q35",
+      "category": "Virtualisation",
+      "definitionRich": "Type de machine QEMU émulant le chipset Intel Q35 avec PCIe. Préférable à i440FX pour le passthrough PCIe et les systèmes invités modernes. Configuration : <code>qm set &lt;vmid&gt; -machine q35</code>."
+    },
+    {
+      "term": "QEMU",
+      "category": "Virtualisation",
+      "definitionRich": "Émulateur de machines et outil de virtualisation libre. Proxmox l’associe à KVM pour exécuter des VM avec des performances proches du matériel natif."
+    },
+    {
+      "term": "rclone",
+      "category": "Linux",
+      "definitionRich": "Outil en ligne de commande compatible avec de nombreux services, dont Google Drive, Dropbox, OneDrive, Mega et S3. Le guide de sauvegarde cloud l’utilise pour monter un stockage distant en répertoire destiné aux archives vzdump.",
+      "seeAlso": [
+        {
+          "label": "Sauvegarder vers un cloud personnel",
+          "href": "/guides/backup_cloud"
+        }
+      ]
+    },
+    {
+      "term": "Samba / SMB / CIFS",
+      "category": "Stockage",
+      "definitionRich": "Famille de protocoles de partage de fichiers Microsoft. <strong>SMB</strong> est le protocole, <strong>Samba</strong> son implémentation libre sous Linux et <strong>CIFS</strong> un ancien dialecte SMB. Ajout dans Proxmox avec <code>pvesm add cifs</code>.",
+      "seeAlso": [
+        {
+          "label": "Gestionnaire de stockage et de partage",
+          "href": "/docs/storage-share"
+        }
+      ]
+    },
+    {
+      "term": "SeaBIOS",
+      "category": "Virtualisation",
+      "definitionRich": "Implémentation libre du BIOS classique utilisée par QEMU. Firmware par défaut des nouvelles VM sauf choix d’OVMF. Adapté aux systèmes anciens et aux installations Linux ne nécessitant pas UEFI."
+    },
+    {
+      "term": "smartctl / SMART",
+      "aliases": [
+        "Self-Monitoring, Analysis and Reporting Technology"
+      ],
+      "category": "Stockage",
+      "definitionRich": "Diagnostic intégré aux disques indiquant leur état, les erreurs et les résultats des autotests. L’outil est <code>smartctl</code>, du paquet <code>smartmontools</code> ; <code>nvme-cli</code> ajoute les commandes propres aux NVMe.",
+      "seeAlso": [
+        {
+          "label": "Santé et test du disque SMART",
+          "href": "/docs/disk-manager/smart-disk-test"
+        },
+        {
+          "label": "Commandes de stockage → Section SMART",
+          "href": "/docs/help-info/storage-commands"
+        }
+      ]
+    },
+    {
+      "term": "systemd / systemctl / journalctl",
+      "category": "Linux",
+      "definitionRich": "Système d’initialisation Debian / Proxmox. <code>systemctl</code> gère les services : démarrage, arrêt, activation et état. <code>journalctl</code> lit le journal binaire produit par <code>systemd-journald</code>."
+    },
+    {
+      "term": "sysctl",
+      "category": "Linux",
+      "definitionRich": "Outil de lecture et modification des paramètres du noyau. Les réglages persistants vont généralement dans <code>/etc/sysctl.d/*.conf</code> ; la lecture de <code>/etc/sysctl.conf</code> dépend du service de chargement. ProxMenux propose un profil sysctl après installation.",
+      "seeAlso": [
+        {
+          "label": "Post-Installation: Réseau",
+          "href": "/docs/post-install/network"
+        }
+      ]
+    },
+    {
+      "term": "trixie",
+      "category": "Linux",
+      "definitionRich": "Nom de code pour Debian 13, la base OS pour Proxmox VE 9. Prédécesseur: <em>bookworm</em> (Debian 12 / PVE 8).",
+      "seeAlso": [
+        {
+          "label": "Mettre à niveau le PVE 8 vers le PVE 9",
+          "href": "/docs/utils/upgrade-pve8-pve9"
+        }
+      ]
+    },
+    {
+      "term": "udev",
+      "category": "Linux",
+      "definitionRich": "Gestionnaire de périphériques Linux. Réagit aux événements matériels et crée ou supprime les entrées sous <code>/dev</code>. Les règles de <code>/etc/udev/rules.d/</code> peuvent fixer les noms d’interface par MAC, créer les périphériques NVIDIA au chargement du pilote, etc."
+    },
+    {
+      "term": "UID / GID idmap",
+      "aliases": [
+        "Déplacement UID"
+      ],
+      "category": "Linux",
+      "definitionRich": "Avec la correspondance par défaut des LXC <strong>non privilégiés</strong>, les UID et GID hôtes sont décalés de <code>+100000</code> : UID 0 correspond à 100000 et 1000 à 101000. Les correspondances personnalisées peuvent différer ; les propriétaires des montages bind doivent être cohérents.",
+      "seeAlso": [
+        {
+          "label": "Points de montage LXC",
+          "href": "/docs/storage-share/lxc-mount-points"
+        }
+      ]
+    },
+    {
+      "term": "Conteneur non privilégié",
+      "category": "Linux",
+      "definitionRich": "Conteneur LXC dont root correspond à un UID hôte non privilégié, normalement 100000. Cela réduit les droits sur l’hôte tout en partageant son noyau. L’accès matériel reste possible avec les droits et correspondances adaptés ; le mode privilégié n’est pas systématiquement nécessaire."
+    },
+    {
+      "term": "VFIO",
+      "aliases": [
+        "Fonction virtuelle E/S"
+      ],
+      "category": "Virtualisation",
+      "definitionRich": "Infrastructure du noyau Linux pour des pilotes sécurisés en espace utilisateur, utilisée pour attribuer directement des périphériques PCIe aux VM. Elle utilise <code>vfio</code>, <code>vfio_iommu_type1</code> et <code>vfio_pci</code>, configurés dans <code>/etc/modprobe.d/vfio.conf</code>.",
+      "seeAlso": [
+        {
+          "label": "Post-Installation : Virtualisation",
+          "href": "/docs/post-install/virtualization"
+        }
+      ]
+    },
+    {
+      "term": "VirtIO",
+      "category": "Virtualisation",
+      "definitionRich": "Famille de pilotes paravirtualisés pour réseau, stockage, mémoire dynamique et GPU. Évite le surcoût du matériel ancien émulé, comme e1000 ou IDE. L’invité doit disposer des pilotes : intégrés à Linux, disponibles sur ISO séparée pour Windows."
+    },
+    {
+      "term": "VLAN",
+      "aliases": [
+        "Réseau local virtuel"
+      ],
+      "category": "Réseau",
+      "definitionRich": "Étiquettes 802.1Q divisant un réseau physique en plusieurs réseaux logiques. Configuration par pont ou interface dans <code>/etc/network/interfaces</code>."
+    },
+    {
+      "term": "VM",
+      "aliases": [
+        "Machine virtuelle"
+      ],
+      "category": "Proxmox",
+      "definitionRich": "Machine virtuelle gérée par Proxmox avec QEMU/KVM, disposant de son propre noyau invité. Son VMID numérique correspond à <code>/etc/pve/qemu-server/&lt;VMID&gt;.conf</code>. Généralement plus de surcoût que LXC, avec une frontière d’isolation reposant sur un noyau distinct.",
+      "seeAlso": [
+        {
+          "label": "Gestion des VM et conteneurs",
+          "href": "/docs/help-info/vm-ct-commands"
+        }
+      ]
+    },
+    {
+      "term": "vzdump",
+      "category": "Proxmox",
+      "definitionRich": "Outil de sauvegarde Proxmox pour VM et CT. Les archives fichier <strong>ne sont pas incrémentales</strong> ; les destinations PBS permettent des transferts incrémentaux. Les tâches configurent mode (snapshot / suspend / stop), compression (zstd, gzip ou lzo, par exemple), rétention et notifications.",
+      "seeAlso": [
+        {
+          "label": "Commandes de sauvegarde et de restauration",
+          "href": "/docs/help-info/backup-commands"
+        }
+      ]
+    },
+    {
+      "term": "ZFS",
+      "aliases": [
+        "Zettabyte File System"
+      ],
+      "category": "Stockage",
+      "definitionRich": "Système de fichiers et gestionnaire de volumes avec instantanés, réplication send/receive, sommes de contrôle et compression. Peut réparer les données corrompues si une copie redondante valide existe. Le cache <strong>ARC</strong> utilise de la RAM et peut être limité.",
+      "seeAlso": [
+        {
+          "label": "Commandes de gestion ZFS",
+          "href": "/docs/help-info/zfs-commands"
+        }
+      ]
+    }
+  ]
+}
diff --git a/web/messages/fr/docs/hardware/coral-tpu-lxc.json b/web/messages/fr/docs/hardware/coral-tpu-lxc.json
new file mode 100644
index 00000000..f93f60c7
--- /dev/null
+++ b/web/messages/fr/docs/hardware/coral-tpu-lxc.json
@@ -0,0 +1,120 @@
+{
+  "meta": {
+    "title": "Ajouter un Coral TPU à LXC | Documentation ProxMenux",
+    "description": "Partagez un Google Coral TPU USB ou M.2 / PCIe avec un LXC Proxmox. ProxMenux configure périphériques, droits et montages, démarre le conteneur et installe l’environnement Edge TPU sur les distributions compatibles."
+  },
+  "header": {
+    "title": "Ajouter un Coral TPU à LXC",
+    "description": "Partagez un Coral USB Accelerator ou M.2 / Mini-PCIe avec un LXC. ProxMenux configure le conteneur et l’environnement Edge TPU. Cette option concerne uniquement le TPU ; pour Quick Sync, VA-API ou NVENC, utilisez aussi Ajouter un GPU à LXC.",
+    "section": "Matériel : GPU et Coral-TPU"
+  },
+  "intro": {
+    "title": "Fonctionnement",
+    "body": "Écrit la configuration dans <code>/etc/pve/lxc/&lt;ctid&gt;.conf</code> pour <strong>USB Accelerator</strong>, <strong>Coral M.2 / PCIe</strong> ou les deux. Démarre le conteneur et installe <code>libedgetpu</code> de Google. Le GPU se configure séparément avec <lxcGpuLink>Ajouter un GPU à LXC</lxcGpuLink>."
+  },
+  "whenUse": {
+    "heading": "Quand l’utiliser",
+    "body": "Pour <frigateLink>Frigate</frigateLink> ou une autre application Linux compatible en LXC. Coral exécute l’inférence ML prise en charge à la place du CPU. Les performances dépendent du modèle et du matériel ; le décodage vidéo et les autres tâches consomment toujours des ressources."
+  },
+  "prereqs": {
+    "title": "Avant de commencer",
+    "drivers": "<strong>Préparez le périphérique Coral sur l’hôte</strong>. M.2 / PCIe nécessite le pilote hôte chargé ; USB nécessite l’accès au périphérique et les droits adaptés. Voir <hostLink>Installer Coral TPU sur l’hôte</hostLink>. Le script installe l’environnement d’exécution de l’application dans les conteneurs Debian/Ubuntu ; les autres distributions doivent le fournir séparément.",
+    "driversCheck": "ls /dev/apex_* 2>/dev/null ; lsusb | grep -E '1a6e:089a|18d1:9302'",
+    "container": "<strong>Un LXC existant</strong>, idéalement basé sur <strong>Debian / Ubuntu</strong> : l’installation utilise <code>apt-get</code>. Les <strong>conteneurs d’autres distributions</strong> peuvent choisir le <strong>mode passthrough uniquement</strong>, sans installation APT de <code>libedgetpu</code>. Utile si l’application inclut déjà cet environnement, comme l’image Docker Frigate.",
+    "downtime": "<strong>Prévoyez une courte interruption</strong> du conteneur. Le script l’arrête pour modifier sa configuration puis le démarre pour installer l’environnement d’exécution. Ces modifications ne nécessitent pas de redémarrage de l’hôte."
+  },
+  "hostPrep": {
+    "title": "L'hôte doit être préparé en premier",
+    "body": "M.2 / PCIe nécessite <code>gasket</code>/<code>apex</code> sur l’hôte et un périphérique fonctionnel. USB nécessite le périphérique connecté et les droits ; l’application ne doit pas nécessairement tourner sur l’hôte. <code>libedgetpu</code> doit être disponible là où elle s’exécute. Ordre : <strong>préparer l’hôte → accès LXC → configurer l’application</strong>."
+  },
+  "running": {
+    "heading": "Exécuter le script",
+    "body": "Dans ProxMenux, ouvrez <strong>Matériel : GPU et Coral-TPU → Ajouter un Coral TPU à LXC</strong>.",
+    "imageAlt": "Option Ajouter un Coral TPU à LXC dans le menu matériel"
+  },
+  "howRuns": {
+    "heading": "Déroulement du script",
+    "body": "Choisissez le conteneur. Le script configure l’accès USB même sans Coral USB connecté, puis ajoute M.2 / PCIe si ce matériel est détecté."
+  },
+  "walkthrough": {
+    "heading": "Étapes de la procédure",
+    "pick": {
+      "title": "Choisir le conteneur LXC",
+      "body": "Le sélecteur affiche les conteneurs admissibles de <code>pct list</code> ; les conteneurs OCI sont masqués et gérés dans Apps du gestionnaire OCI. Choisissez-en un, démarré ou arrêté. Le script l’arrête si nécessaire, le configure puis le démarre pour installer l’environnement d’exécution."
+    },
+    "gpuHint": {
+      "title": "Suggestion facultative pour l’accès GPU",
+      "body": "Si un GPU est détecté mais non configuré pour ce conteneur, un dialogue recommande <lxcGpuLink>Ajouter un GPU à LXC</lxcGpuLink> pour le décodage vidéo matériel, par exemple Quick Sync, VA-API ou NVENC. Il demande s’il faut continuer avec Coral uniquement : Oui poursuit la configuration du TPU ; Non quitte pour vous permettre de configurer d’abord le GPU."
+    },
+    "usb": {
+      "title": "Configurer l’accès USB du LXC",
+      "body": "Crée une règle udev hôte pour <code>/dev/coral</code> et monte l’arborescence <strong>entière</strong> <code>/dev/bus/usb</code> dans le conteneur. La configuration est écrite même sans Coral USB connecté et expose d’autres périphériques que le Coral.",
+      "whyTitle": "Pourquoi monter /dev/bus/usb au lieu de /dev/coral ?",
+      "whyBody": "Le chemin USB, par exemple <code>/dev/bus/usb/001/005</code>, change après reconnexion. Les anciennes versions montaient le lien <code>/dev/coral</code> et pouvaient conserver un chemin périmé. Monter toute l’arborescence USB rend le nœud actuel visible. L’application peut encore devoir le rouvrir."
+    },
+    "pcie": {
+      "title": "Configurer l’accès M.2 / PCIe du LXC",
+      "body1": "Si un Coral M.2 / PCIe est détecté et que <code>/dev/apex_0</code> existe, le script utilise l’API Proxmox <code>dev</code> pour gérer cgroup2 dans les LXC privilégiés et non privilégiés :",
+      "body2": "Si <code>/dev/apex_0</code> est absent après <hostLink>Installer Coral sur l’hôte</hostLink>, le script écrit un montage bind avec <code>create=file</code> et, uniquement lorsque le numéro majeur apex figure dans <code>/proc/devices</code>, une règle cgroup2 classique. Aucun des deux ne crée un périphérique fonctionnel :",
+      "rebootTitle": "Redémarrez l'hôte d'abord si vous venez d'installer des pilotes Coral",
+      "rebootBody": "Le montage de secours ne charge pas <code>apex</code> sur l’hôte. Chargez le pilote ou redémarrez après installation, puis vérifiez le périphérique. Relancez ensuite le script pour appliquer l’entrée moderne et redémarrez le conteneur."
+    },
+    "drivers": {
+      "title": "Démarrer le LXC et installer l’environnement Coral",
+      "body": "Démarre le conteneur et attend jusqu’à 15 secondes son état running, puis utilise <code>pct exec</code> pour lancer l’installation à l’intérieur. L’installateur :",
+      "items": [
+        "Exécute <code>apt-get update</code>.",
+        "Installe les prérequis du dépôt Coral : <code>gnupg</code>, <code>curl</code>, <code>ca-certificates</code>.",
+        "Importe la clé GPG Coral de Google sur <code>/etc/apt/keyrings/coral-edgetpu.gpg</code> (chemin moderne, comme l'installateur hôte utilise) et ajoute le dépôt APT <code>coral-edgetpu-stable</code> avec <code>signed-by=</code>.",
+        "Installe <code>libedgetpu1-std</code> par défaut. Si un Coral M.2 est détecté, propose <code>libedgetpu1-std</code> ou <code>libedgetpu1-max</code>. Ce choix ne configure pas à lui seul la détection dans l’application."
+      ],
+      "noIgpuTitle": "Pourquoi pas de pilotes iGPU ici ?",
+      "noIgpuBody": "Auparavant, il installait aussi <code>va-driver-all</code>, <code>intel-opencl-icd</code> et d’autres paquets Intel pour associer Quick Sync à Coral. Ce mélange causait des erreurs lorsqu’on souhaitait uniquement Coral. L’iGPU se configure désormais avec <lxcGpuLink>Ajouter un GPU à LXC</lxcGpuLink> ; utilisez-le d’abord pour le décodage vidéo matériel.",
+      "debianTitle": "Autres distributions : accès au périphérique uniquement",
+      "debianBody": "Utilise <code>apt-get</code> sous Debian/Ubuntu. Pour <strong>Alpine, Arch, RHEL ou SUSE</strong>, détectés via <code>/etc/os-release</code>, propose <em>continuer avec le seul accès matériel</em> ou <em>annuler</em>. Le premier choix configure <code>/etc/pve/lxc/&lt;ctid&gt;.conf</code> sans installer <code>libedgetpu</code>. Ce mode convient si l’application inclut déjà cet environnement, comme Frigate Docker. Sinon, installez <code>libedgetpu</code> selon le <coralLink>guide officiel Google</coralLink>."
+    },
+    "summary": {
+      "title": "Résumé",
+      "body": "À la fin, une liste affiche Coral USB et M.2 avec ✓ ou ⚠ selon la détection matérielle. Le conteneur reste démarré pour configurer Frigate, CodeProject.AI ou votre application."
+    }
+  },
+  "manual": {
+    "heading": "Procédure manuelle équivalente",
+    "body": "Si vous voulez voir exactement ce qui va dans la config LXC, ou l'appliquer à la main:",
+    "usbHeading": "USB Coral",
+    "pcieHeading": "M.2 / PCIe Coral",
+    "runtimeHeading": "Dans le conteneur : environnement Coral"
+  },
+  "verification": {
+    "heading": "Vérification",
+    "body": "Ouvrez un shell dans le conteneur et vérifiez que Coral est visible :"
+  },
+  "troubleshoot": {
+    "heading": "Dépannage",
+    "apexTitle": "LXC démarré, mais /dev/apex_0 absent",
+    "apexBody": "Vérifiez d’abord le pilote hôte : <code>lsmod | grep apex</code>. S’il manque, essayez <code>modprobe apex</code> ou redémarrez après l’installation du pilote. Une fois <code>/dev/apex_0</code> présent sur l’hôte, vérifiez l’entrée de périphérique LXC (relancez le script si seules les entrées de secours ont été écrites) puis redémarrez le conteneur avec <code>pct stop &lt;ctid&gt; &amp;&amp; pct start &lt;ctid&gt;</code>.",
+    "replugTitle": "Coral USB disparaît après reconnexion sur un autre port",
+    "replugBody": "Vérifiez que le LXC monte <code>/dev/bus/usb</code> plutôt que le lien <code>/dev/coral</code>. Sa configuration doit contenir <code>lxc.mount.entry: /dev/bus/usb dev/bus/usb ...</code> sans dépendre directement de <code>/dev/coral</code>. Relancez le script si la configuration est ancienne.",
+    "alpineTitle": "Alpine / Arch / RHEL / SUSE : environnement non installé",
+    "alpineBody": "Le <em>mode passthrough uniquement</em> configure le périphérique sans installer <code>libedgetpu</code>. Utilisez un paquet compatible ou compilez les sources ; vérifiez sa disponibilité avant une commande comme <code>apk add</code> sous Alpine. Frigate peut inclure cet environnement. Avec Docker dans le LXC, transmettez aussi M.2 via <code>--device /dev/apex_0:/dev/apex_0</code> ou montez USB dans Docker ; le montage LXC seul ne suffit pas.",
+    "frigateTitle": "Frigate affiche « Coral EdgeTPU detected but not available »",
+    "frigateBody": "Vérifiez environnement, visibilité et droits de lecture/écriture du processus réel. Pour USB, examinez les droits et l’éventuel groupe <code>plugdev</code>. Pour M.2, inspectez <code>/dev/apex_0</code> avec <code>ls -l /dev/apex_0</code>. Un nom comme <code>apex</code> dans <code>/etc/group</code> ne suffit pas : GID numériques et correspondances LXC doivent coïncider. Vérifiez aussi si un autre processus utilise déjà le TPU ; ne passez pas d’abord en mode privilégié.",
+    "logsTitle": "Vérifier les journaux de l'hôte et du conteneur",
+    "logsBody": "Sur l’hôte, examinez les messages noyau avec <code>journalctl -k | grep -i -e apex -e gasket -e usb</code>. Dans le LXC, consultez les journaux applicatifs ; avec Docker imbriqué, utilisez <code>docker logs &lt;container&gt;</code>. Droits, environnement absent, connexion USB ou autre processus utilisant le TPU peuvent provoquer l’échec."
+  },
+  "related": {
+    "heading": "Voir aussi",
+    "items": [
+      {
+        "label": "Installer Coral TPU sur l’hôte",
+        "href": "/docs/hardware/install-coral-tpu-host",
+        "tail": " — préalable nécessaire pour utiliser une carte Coral M.2 / PCIe dans un CT."
+      },
+      {
+        "label": "Ajouter un GPU à LXC",
+        "href": "/docs/hardware/igpu-acceleration-lxc",
+        "tail": " — accès GPU, souvent associé à Coral dans Frigate."
+      }
+    ]
+  }
+}
diff --git a/web/messages/fr/docs/hardware/gpu-vm-passthrough.json b/web/messages/fr/docs/hardware/gpu-vm-passthrough.json
new file mode 100644
index 00000000..1833df31
--- /dev/null
+++ b/web/messages/fr/docs/hardware/gpu-vm-passthrough.json
@@ -0,0 +1,178 @@
+{
+  "meta": {
+    "title": "Ajouter un GPU à une VM | Documentation ProxMenux",
+    "description": "Attribuez un GPU physique à une VM Proxmox. ProxMenux vérifie IOMMU, configure VFIO et les périphériques VM et détecte les conflits avec d’autres VM ou LXC."
+  },
+  "header": {
+    "title": "Ajouter un GPU à une VM (passthrough)",
+    "description": "Détecte les GPU Intel, AMD ou NVIDIA pour l’accès direct depuis une VM. Vérifie IOMMU et les périphériques associés, configure VFIO et la VM et applique ses règles de compatibilité. Vérifiez tous les périphériques concernés.",
+    "section": "Matériel : GPU et Coral-TPU"
+  },
+  "intro": {
+    "title": "Fonctionnement",
+    "body": "Automatise la configuration hôte et <code>hostpci</code> décrite dans la <pveLink>documentation PCI passthrough Proxmox</pveLink>. Vérifie les attributions aux <em>autres</em> invités et propose de résoudre les conflits. Ne garantit pas toute combinaison GPU, réinitialisation et pilote invité."
+  },
+  "who": {
+    "heading": "C'est pour qui ?",
+    "body": "Pour qu’une <strong>machine virtuelle</strong> utilise directement un GPU via VFIO. Tant qu’il est lié à VFIO, le pilote hôte ne peut pas l’utiliser, même VM arrêtée. Pour le partager avec <em>LXC</em>, utilisez <lxcLink>Ajouter un GPU à LXC</lxcLink>."
+  },
+  "prereqs": {
+    "title": "Avant de commencer",
+    "gpu": "<strong>GPU compatible</strong> physiquement installé. Le script détecte Intel, AMD et NVIDIA via <code>lspci</code>.",
+    "gpuCheck": "lspci | grep -iE 'VGA|3D|Display'",
+    "iommu": "<strong>Prise en charge IOMMU</strong> matérielle et activation dans le micrologiciel si nécessaire (Intel VT-d ou AMD-Vi). Vérifie le système et peut configurer Linux ; ne modifie pas BIOS/UEFI et ne prouve pas qu’un IOMMU inactif y est désactivé.",
+    "q35": "Cet assistant exige <strong>q35</strong> et refuse <code>i440fx</code>. Le type de machine est distinct du micrologiciel BIOS/UEFI. Changer le chipset d’une VM existante se planifie et n’est pas automatique.",
+    "q35Check": "qm config VMID | grep machine",
+    "moreGpus": "Prévoyez <strong>un autre GPU ou accès alternatif</strong> via SSH, IPMI ou série. Réserver le GPU principal peut couper l’affichage local. Pour <em>NVIDIA</em>, une carte hors du groupe IOMMU concerné peut rester sur l’hôte.",
+    "nvidiaInstalled": "Après <nvidiaLink>installation NVIDIA sur l’hôte</nvidiaLink>, les fonctions sélectionnées sont réservées à <code>vfio-pci</code> plutôt qu’à <code>nvidia</code>. Le module <code>nvidia</code> peut rester disponible pour les <strong>autres</strong> cartes hors du groupe IOMMU concerné. Vérifiez avec <code>nvidia-smi</code>."
+  },
+  "pickOne": {
+    "title": "Attribution exclusive VM ou partage LXC",
+    "body": "Un GPU lié à <code>vfio-pci</code> pour la transmission VM ne peut pas être utilisé simultanément par l'hôte ou un LXC. Si vous avez deux GPU, vous pouvez en consacrer un à chaque chemin. Si vous n'en avez qu'une, choisissez :",
+    "vmItem": "<strong>VM :</strong> accès direct et exclusif pour cette VM.",
+    "lxcItem": "<strong>LXC (<lxcLink>Ajouter un GPU à LXC</lxcLink>) :</strong> partage le périphérique avec l’hôte et d’autres conteneurs via le pilote natif."
+  },
+  "running": {
+    "heading": "Exécuter l’installateur",
+    "body": "Ouvrez ProxMenux et choisissez <strong>Matériel : GPU et Coral-TPU → Ajouter un GPU à une VM</strong>.",
+    "imageAlt": "Option du menu pour ajouter un GPU à une VM"
+  },
+  "howRuns": {
+    "heading": "Déroulement du script",
+    "body": "Détection et sélection précèdent les changements principaux, confirmés par un résumé final. L’activation IOMMU possède une confirmation préalable et peut déjà modifier le démarrage. Le nettoyage audio ultérieur peut aussi demander un choix."
+  },
+  "walkthrough": {
+    "heading": "Étapes de la procédure",
+    "detect": {
+      "title": "Détecter les GPU et vérifier IOMMU",
+      "body": "Considère IOMMU comme actif uniquement si le noyau en cours a <code>intel_iommu=on</code> ou <code>amd_iommu=on</code> et que des groupes IOMMU existent. Si le paramètre est déjà enregistré pour le prochain démarrage, il continue en mode redémarrage en attente ; sinon, une étape confirmée séparément peut l’ajouter avec <code>iommu=pt</code>. Son heuristique de fichier d’amorçage utilise <code>/etc/kernel/cmdline</code> lorsqu’un marqueur de racine ZFS comme <code>root=ZFS=</code> s’y trouve ; sinon, elle utilise <code>/etc/default/grub</code>. Cette heuristique ne prouve pas le chargeur d’amorçage réellement utilisé. Un IOMMU nouvellement configuré prend effet après redémarrage ; vérifiez ensuite les groupes réels.",
+      "tipTitle": "Post-installation déjà configurée ?",
+      "tipBody": "Si la <postLink>prise en charge VFIO IOMMU</postLink> est configurée et active dans le noyau, le contrôle passe. Un réglage prévu pour le prochain démarrage ne prouve pas son activation actuelle.",
+      "imageAlt": "Liste des GPU détectés avec l'adresse du fournisseur et du PCI"
+    },
+    "preflight": {
+      "title": "Choisir un GPU et lancer les contrôles préalables",
+      "intro": "Une fois que vous choisissez le GPU, le script exécute une série de vérifications qui peuvent chaque bloquer les progrès suivants:",
+      "items": [
+        "<strong>Contrôle SR-IOV.</strong> Refuse VF et PF avec VF actives : cette procédure configure des périphériques complets, pas SR-IOV. Configurez SR-IOV séparément sur du matériel compatible.",
+        "<strong>Un seul GPU.</strong> La console locale peut perdre son affichage lorsque VFIO le réserve. Vérifiez d’abord l’accès SSH ou web depuis un autre ordinateur.",
+        "<strong>Politique de réinitialisation AMD.</strong> Lit <code>/sys/bus/pci/devices/&lt;pci&gt;/reset_method</code>. APU ou carte dédiée sans FLR est <em>bloquée par la politique de l’assistant</em> ; un sous-type inconnu sans FLR exige confirmation. Cela ne prouve pas une impossibilité universelle.",
+        "<strong>État D3cold.</strong> L’assistant bloque les cartes AMD signalant <code>D3cold</code> en raison du risque d’échec d’activation. Vérifiez alimentation et micrologiciel.",
+        "<strong>Analyse du groupe IOMMU.</strong> Lit <code>/sys/kernel/iommu_groups/</code> et inclut dans le plan de la VM <em>tous les membres sauf les ponts</em>, éventuellement des contrôleurs réseau ou de stockage. Si le groupe contient des périphériques d’un autre slot, le script les liste avant le résumé ; vérifiez que l’hôte n’en a pas besoin. Si IOMMU attend un redémarrage, les groupes réels ne sont pas disponibles et le plan ne contient initialement que la fonction GPU sélectionnée ; vérifiez l’isolation après le redémarrage."
+      ],
+      "audioIntro": "<strong>Audio associé.</strong> Deux cas selon l’emplacement du contrôleur :",
+      "audioDgpu": "<strong>GPU dédié :</strong> l’audio HDMI occupe souvent la fonction <code>.1</code> du même emplacement PCI et est inclus si détecté. Si l’hôte l’utilisait, il en perd l’accès lors de la réservation à la VM.",
+      "audioIgpu": "<strong>Sans fonction audio <code>.1</code> :</strong> l’audio peut être sur un autre périphérique comme <code>00:1f.3</code>. Liste les contrôleurs et pilotes, par exemple <code>snd_hda_intel</code>. Par défaut <strong>aucun</strong> n’est sélectionné ; choisissez seulement le nécessaire."
+    },
+    "pickVm": {
+      "title": "Choisir la VM cible",
+      "body": "Choisissez la VM. Exige q35 et réutilise les entrées GPU existantes si possible. BIOS/UEFI est un réglage distinct, pas un type de machine. Ne change pas automatiquement chipset ou mode de démarrage du système installé.",
+      "imageAlt": "Sélection de VM par nom, ID et état"
+    },
+    "switchMode": {
+      "title": "Gérer les attributions existantes",
+      "intro": "Le script scanne chaque config VM et chaque config LXC sur l'hôte à la recherche du GPU que vous avez choisi. Trois résultats possibles :",
+      "items": [
+        "<strong>GPU disponible.</strong> Continue sans retirer d’attribution.",
+        "<strong>Attribué à une autre VM.</strong> Arrêtez d’abord la source. Vous pouvez <em>garder ses entrées et désactiver le démarrage automatique</em> ou <em>retirer les entrées en conservant le démarrage automatique</em>. Avec <code>vfio-pci</code> déjà actif et sans changement hôte, le transfert VM→VM peut éviter un redémarrage hôte.",
+        "<strong>GPU utilisé par LXC.</strong> Pour les conteneurs ordinaires, choisissez <em>garder la configuration GPU et désactiver le démarrage automatique</em> ou <em>retirer la configuration du périphérique GPU en conservant le démarrage automatique</em>. Le retrait supprime les entrées <code>devN</code> et, pour AMD/Intel, aussi les anciennes règles <code>/dev/dri</code> <code>lxc.mount.entry</code> et <code>lxc.cgroup2.devices.allow</code>. Les conteneurs OCI conservent leur configuration et sont arrêtés avec le démarrage automatique désactivé ; retirez leur GPU via OCI manager Apps. La détection des conflits se fait par famille de périphériques GPU et peut inclure d’autres cartes de cette famille."
+      ],
+      "imageAlt": "Boîte de dialogue offrant de supprimer le GPU d'un LXC avant de l'assigner au VM",
+      "smartTitle": "Vérifier l’audio associé au retrait du GPU",
+      "smartBody": "Propose ensuite une liste d’<strong>audio potentiellement inutilisé</strong> dans la VM source. Décochez ce qui reste nécessaire. Par exemple, peut conserver <code>02:00.1</code> et proposer de retirer <code>00:1f.3</code>. La liste détermine les suppressions supplémentaires, sans garantie universelle d’association audio/affichage."
+    },
+    "audioPick": {
+      "title": "Sans audio .1, sélectionner les contrôleurs nécessaires",
+      "body": "Pour les GPU dont l’audio est séparé, une liste présente les contrôleurs audio PCI et leurs pilotes, hors groupe IOMMU déjà inclus. Choisissez seulement ceux nécessaires à la VM, ou aucun.",
+      "imageAlt": "Boîte de dialogue de liste de contrôle avec chaque contrôleur audio PCI hôte (BDF + pilote) lorsque le GPU n'a pas d'audio associé .1",
+      "warnTitle": "Ne sélectionnez pas l’audio nécessaire à l’hôte",
+      "warnBody": "Attribuer l’audio peut retirer l’accès à l’hôte ; le contrôleur ne peut pas appartenir à une autre VM active simultanément. Laissez l’audio facultatif non sélectionné si inutile et vérifiez ses attributions. Le bip de console ne vient pas nécessairement du PCI audio."
+    },
+    "summary": {
+      "title": "Examiner le résumé de la confirmation",
+      "body": "Vérifiez le plan final de l’hôte et de la VM, et annulez s’il est incorrect. Il affiche le groupe IOMMU et son nombre de périphériques ; les membres d’un autre slot sont listés à l’étape précédente. L’annulation empêche les changements principaux, sans annuler une modification de la configuration d’amorçage IOMMU confirmée séparément auparavant.",
+      "imageAlt": "Résumé des modifications prévues sur hôte et VM"
+    },
+    "hostApply": {
+      "title": "Les changements d'hôte sont appliqués",
+      "intro": "La phase d’application modifie hôte et VM. Le nettoyage audio peut encore demander un choix. Modifications possibles :",
+      "items": [
+        "<code>/etc/modules</code> — ajoute <code>vfio</code>, <code>vfio_iommu_type1</code>, <code>vfio_pci</code> (plus <code>vfio_virqfd</code> sur les noyaux &lt; 6.2).",
+        "<code>/etc/modprobe.d/vfio.conf</code> — AMD/Intel : <code>options vfio-pci ids=&lt;vendor:device,...&gt; disable_vga=1</code>. NVIDIA : <code>softdep nvidia pre: vfio-pci</code> (<code>_drm</code>/<code>_modeset</code>/<code>_uvm</code>) ; la liaison réelle se fait par BDF. AMD ajoute l’ordre de chargement <code>softdep</code>: <code>vfio-pci</code> → <code>radeon</code>/<code>amdgpu</code>.",
+        "Écrit <code>/etc/modprobe.d/iommu_unsafe_interrupts.conf</code> et <code>kvm.conf</code> avec <code>allow_unsafe_interrupts=1</code> et <code>ignore_msrs=1</code>. Réglages du script, pas des exigences universelles Windows/macOS ; les interruptions non sûres réduisent la protection du remappage.",
+        "<code>/etc/modprobe.d/blacklist.conf</code>: NVIDIA — <code>nouveau</code>/<code>lbm-nouveau</code>; AMD — <code>radeon</code> + <code>amdgpu</code>; Intel — <code>i915</code>. Ces règles globales au fabricant peuvent toucher d’autres cartes utilisant le même pilote. Le module <code>nvidia</code> est bloqué <strong>uniquement</strong> via <code>/etc/modprobe.d/proxmenux-nvidia-vfio-blacklist.conf</code> lorsque <em>toutes</em> les NVIDIA de l’hôte sont réservées à VFIO.",
+        "<code>/etc/udev/rules.d/10-proxmenux-vfio-bind.rules</code> + <code>/etc/proxmenux/vfio-bind.bdfs</code> — <strong>NVIDIA seulement.</strong> Applique <code>ATTR'{'driver_override'}'=\"vfio-pci\"</code> au PCI ADD des BDF enregistrés, y compris les fonctions du groupe IOMMU concerné. Hors de ces groupes, <code>nvidia</code> peut rester actif. La politique BDF ne divise pas les groupes matériels.",
+        "<strong>AMD seulement.</strong> Tente d’extraire la ROM de <code>/sys/bus/pci/.../rom</code> ou ACPI VFCT vers <code>/usr/share/kvm/vbios_&lt;vendor&gt;_&lt;device&gt;.bin</code>. En cas de réussite, la VM utilise <code>romfile=</code>. Une extraction valide ne garantit pas la réussite de l’initialisation du GPU.",
+        "<strong>NVIDIA seulement.</strong> Arrête et désactive <code>nvidia-persistenced</code>, <code>nvidia-powerd</code>, <code>nvidia-fabricmanager</code> seulement si toutes les NVIDIA sont réservées à VFIO. En usage mixte, conserve les services et <code>nvidia</code> pour les cartes natives.",
+        "<code>update-initramfs -u -k all</code> — ne fonctionne que si l'un des éléments ci-dessus a réellement changé."
+      ]
+    },
+    "vmApply": {
+      "title": "La configuration VM est appliquée via qm set",
+      "body": "La configuration VM à <code>/etc/pve/qemu-server/&lt;vmid&gt;.conf</code> est mise à jour via <code>qm set</code> (jamais par <code>sed</code>):",
+      "after1": "Ajoute <code>x-vga=1</code> pour AMD et NVIDIA, <strong>pas</strong> Intel. C’est la politique du script, pas la preuve que tous les iGPU Intel manquent de micrologiciel ou que ce réglage bloque toujours.",
+      "after2": "D'autres lignes <code>hostpciN</code> sont jointes si le groupe IOMMU du GPU contient d'autres appareils que vous devez transmettre ensemble."
+    },
+    "reboot": {
+      "title": "Redémarrer si la modification hôte l’exige",
+      "body": "Suivez le redémarrage demandé si démarrage ou pilotes changent et vérifiez la liaison active avant de lancer la VM. La configuration enregistrée ne prouve pas son activation. VM→VM avec VFIO correct peut éviter de redémarrer l’hôte.",
+      "imageAlt": "Écran sommaire montrant ce qui a été changé, suivi d'une invite de redémarrage"
+    }
+  },
+  "vendors": {
+    "heading": "Notes par fabricant",
+    "nvidiaHeading": "NVIDIA",
+    "nvidiaBody": "Conserve un ancien contournement <em>Code 43</em> : <code>hidden=1</code>, ID <code>NV43FIX</code> dans <code>args</code>, <code>kvm=off</code>. Pas une exigence universelle des GeForce actuels : NVIDIA a activé le passthrough Windows avec R465. Le code peut avoir d’autres causes ; vérifiez GPU et pilote.",
+    "nvidiaMultiHeading": "Prise en charge multi-GPU NVIDIA",
+    "nvidiaMultiBody": "Usage mixte NVIDIA <strong>par BDF</strong>. Enregistre les fonctions <code>vfio-pci</code> par adresse plutôt que seulement par ID <code>vendor:device</code>. Hors des groupes concernés, peut conserver <code>nvidia</code> ; vérifiez avec <code>nvidia-smi</code>. N’isole pas deux cartes du même groupe.",
+    "amdHeading": "AMD",
+    "amdBody": "Certains GPU AMD échouent à se réinitialiser après arrêt VM. L’assistant vérifie les capacités annoncées, pas tous les cycles réels. <vendorResetLink>vendor-reset</vendorResetLink> prend en charge une liste limitée et exige noyau compatible et chargement précoce ; il n’est pas installé. <em>RadeonResetBugFix</em> sous Windows dépend aussi du matériel, sans garantie générale.",
+    "intelHeading": "Intel iGPU",
+    "intelBody": "L’attribution Intel iGPU complète et SR-IOV sont distincts. Cet assistant réserve le périphérique à une VM sans <code>x-vga=1</code>. <sriovLink>i915-sriov-dkms</sriovLink> exige matériel et noyau pris en charge ; « UHD 630+ » n’est pas une règle de compatibilité. Prévoyez un autre accès hôte."
+  },
+  "verification": {
+    "heading": "Vérification"
+  },
+  "troubleshoot": {
+    "heading": "Dépannage",
+    "code43Title": "Code 43 dans Windows (NVIDIA)",
+    "code43Body": "Code 43 ne prouve pas un échec du masquage. Consultez <code>qm config VMID | grep -E \"cpu|args\"</code> avec la vraie VMID, puis <code>hidden=1</code> et <code>hv_vendor_id=NV43FIX</code>. Vérifiez aussi pilote invité, micrologiciel et attribution. Relancer peut quitter si déjà attribué.",
+    "amdResetTitle": "AMD GPU fonctionne une fois, échoue sur le redémarrage VM",
+    "amdResetBody": "Un échec de réinitialisation est une cause possible. Redémarrer ou couper/rétablir l’alimentation peut aider temporairement. Vérifiez la compatibilité et le chargement précoce de <code>vendor-reset</code> ; <code>softdep amdgpu pre: vendor-reset</code> seul ne garantit pas un chargement avant VFIO. <em>RadeonResetBugFix</em> exige aussi un GPU compatible.",
+    "stuckBootTitle": "VM démarrage bloqué / GPU non détecté",
+    "stuckBootBody": "Consultez l’adresse réelle avec <code>lspci -nnk -s PCI_ADDRESS</code> ; attendez <code>Kernel driver in use: vfio-pci</code>. Remplacez PCI_ADDRESS. Si le pilote natif reste actif, vérifiez la politique de liaison, pas seulement <code>/etc/modprobe.d/blacklist.conf</code> ; NVIDIA utilise les BDF. Lisez <code>dmesg | grep vfio</code>. Après correction, <code>update-initramfs -u -k all</code> puis redémarrage prévu.",
+    "darkTitle": "La console d'hôte devient sombre après le redémarrage et je ne peux pas SSH",
+    "darkBody": "Un écran noir ne prouve pas l’arrêt de l’hôte. Si SSH échoue aussi, vérifiez réseau et contrôleurs inclus dans le groupe IOMMU. Récupérez l’accès via IPMI, série ou environnement de secours ; examinez <code>/etc/pve/qemu-server/&lt;vmid&gt;.conf</code> et annulez seulement les attributions/règles concernées. Ne supprimez pas les autres réglages.",
+    "logTitle": "Vérifiez le journal d'installation",
+    "logBody": "Chaque exécution écrit <code>/tmp/add_gpu_vm.log</code>. Joignez le journal aux demandes d’aide."
+  },
+  "revert": {
+    "heading": "Annuler manuellement les modifications",
+    "intro": "Arrêtez la VM et retirez seulement ses attributions PCI concernées dans Matériel ou avec l’index explicite ci-dessous. Cela ne rend pas encore le GPU au pilote hôte. Utilisez Changer le mode GPU pour cette transition et vérifiez les invités concernés."
+  },
+  "related": {
+    "heading": "Voir aussi",
+    "items": [
+      {
+        "label": "Installer les pilotes NVIDIA (host)",
+        "href": "/docs/hardware/nvidia-host",
+        "tail": " — préparer le pilote des cartes gardées sur l’hôte ; un GPU lié à VFIO ne peut pas l’utiliser simultanément."
+      },
+      {
+        "label": "Ajouter un GPU à LXC",
+        "href": "/docs/hardware/igpu-acceleration-lxc",
+        "tail": "— modèle alternatif: partager le GPU avec plusieurs conteneurs au lieu de le consacrer à un VM."
+      },
+      {
+        "label": "Changer le mode GPU (VM ↔ LXC)",
+        "href": "/docs/hardware/switch-gpu-mode",
+        "tail": " — basculer le même GPU entre partage et attribution exclusive."
+      },
+      {
+        "label": "commandes GPU Passthrough",
+        "href": "/docs/help-info/gpu-commands",
+        "tail": " — lspci, vérification d’IOMMU et référence de qm set hostpci."
+      }
+    ]
+  }
+}
diff --git a/web/messages/fr/docs/hardware/igpu-acceleration-lxc.json b/web/messages/fr/docs/hardware/igpu-acceleration-lxc.json
new file mode 100644
index 00000000..437226db
--- /dev/null
+++ b/web/messages/fr/docs/hardware/igpu-acceleration-lxc.json
@@ -0,0 +1,185 @@
+{
+  "meta": {
+    "title": "Ajouter un GPU à LXC | Documentation ProxMenux",
+    "description": "Partagez un GPU Intel, AMD ou NVIDIA avec LXC. ProxMenux configure périphériques, groupes et bibliothèques selon la distribution ; l’application doit prendre en charge et configurer l’accélération."
+  },
+  "header": {
+    "title": "Ajouter un GPU à LXC",
+    "description": "Partage l’accès GPU avec LXC via les périphériques de l’hôte. Le pilote reste sur l’hôte ; les applications nécessitent des bibliothèques compatibles et leur propre configuration.",
+    "section": "Matériel : GPU et Coral-TPU"
+  },
+  "intro": {
+    "title": "Fonctionnement",
+    "body": "Ajoute des entrées <code>dev&lt;N&gt;</code> à <code>/etc/pve/lxc/&lt;ctid&gt;.conf</code> pour les nœuds <code>/dev/dri/*</code>, <code>/dev/kfd</code> ou <code>/dev/nvidia*</code> concernés. Démarre le conteneur, installe les paquets userspace de sa distribution et, pour Intel/AMD, aligne les groupes <code>video</code> et <code>render</code>. L’accélération des applications exige toujours matériel, bibliothèques et configuration d’application compatibles."
+  },
+  "compare": {
+    "heading": "Partage LXC ou attribution directe à une VM",
+    "intro": "LXC partage le noyau et peut <em>partager</em> le GPU entre hôte et conteneurs. Avec une <vmLink>attribution complète à une VM</vmLink>, le périphérique est réservé à cette VM et indisponible pour le pilote de l’hôte.",
+    "headerFeature": "Fonctionnalité",
+    "headerLxc": "LXC (cette page)",
+    "headerVm": "VM",
+    "rows": [
+      {
+        "feature": "L'hôte utilise toujours le GPU?",
+        "lxc": "Oui",
+        "vm": "Non — exclusivement au VM"
+      },
+      {
+        "feature": "Plusieurs conteneurs partageant un GPU?",
+        "lxc": "Oui",
+        "vm": "Non"
+      },
+      {
+        "feature": "Nécessite IOMMU / VFIO sur l'hôte?",
+        "lxc": "Non",
+        "vm": "Oui"
+      },
+      {
+        "feature": "Redémarrer nécessaire ?",
+        "lxc": "Habituellement non (relancez simplement le CT)",
+        "vm": "Lors de modifications du pilote hôte ou de l’IOMMU ; pas à chaque attribution"
+      },
+      {
+        "feature": "Systèmes d’exploitation invités",
+        "lxc": "Seul Linux (LXC est uniquement Linux)",
+        "vm": "Système invité pris en charge avec pilote GPU compatible"
+      }
+    ]
+  },
+  "prereqs": {
+    "title": "Avant de commencer",
+    "gpu": "<strong>GPU sur l’hôte</strong> Intel, AMD ou NVIDIA, détecté via <code>lspci</code>.",
+    "gpuCheck": "lspci | grep -iE 'VGA|3D|Display'",
+    "vfio": "<strong>Le GPU ne doit pas être lié à vfio-pci.</strong> Il nécessite le pilote natif de l’hôte. S’il est attribué à une VM, le script propose <switchLink>Changer le mode GPU</switchLink>.",
+    "nvidia": "<strong>Pour NVIDIA :</strong> installez d’abord le pilote hôte. Les bibliothèques du conteneur doivent correspondre à sa version. Voir <nvidiaLink>Installer les pilotes NVIDIA sur l’hôte</nvidiaLink>.",
+    "nvidiaCheck": "nvidia-smi",
+    "container": "<strong>Un LXC existant.</strong> Le script n’en crée pas. Les deux modes sont pris en charge ; un conteneur <strong>privilégié</strong> n’est pas toujours requis. Périphériques et droits numériques de l’application doivent correspondre."
+  },
+  "unpriv": {
+    "title": "Compatible avec les conteneurs privilégiés et non privilégiés",
+    "body": "Le script écrit les entrées <code>dev&lt;N&gt;</code> dans la configuration LXC et, sur les conteneurs non privilégiés, aligne les GIDs <code>video</code> et <code>render</code> entre l'hôte et le conteneur de sorte que les nœuds de périphérique GPU soient accessibles de l'intérieur sans que vous ayez à éditer manuellement <code>lxc.idmap</code>."
+  },
+  "running": {
+    "heading": "Exécuter l’installateur",
+    "body": "Ouvrez ProxMenux et choisissez <strong>Matériel : GPU et Coral-TPU → Ajouter un GPU à LXC</strong>.",
+    "imageAlt": "Option du menu pour ajouter un GPU à LXC"
+  },
+  "howRuns": {
+    "heading": "Déroulement du script",
+    "body": "Choisissez conteneur et familles GPU, puis passez les contrôles. Le traitement arrête et modifie ensuite le conteneur sans confirmation finale supplémentaire. Le nettoyage VFIO facultatif est confirmé séparément et peut modifier l’hôte auparavant."
+  },
+  "walkthrough": {
+    "heading": "Étapes de la procédure",
+    "detect": {
+      "title": "Détecter les GPU hôtes",
+      "body": "Cherche les contrôleurs GPU avec <code>lspci</code>. Pour NVIDIA, vérifie le module <code>nvidia</code> et <code>nvidia-smi</code> ; la version détectée détermine l’installateur <code>.run</code> du conteneur.",
+      "tipTitle": "NVIDIA pas prêt?",
+      "tipBody": "Si le module ou NVIDIA ne fonctionne pas sur l’hôte, utilisez d’abord <nvidiaLink>Installer les pilotes NVIDIA sur l’hôte</nvidiaLink>, puis vérifiez le pilote."
+    },
+    "pickCt": {
+      "title": "Choisir un conteneur LXC",
+      "body": "Liste les conteneurs LXC admissibles par ID et nom ; les conteneurs OCI sont exclus et utilisent OCI manager Apps pour leurs périphériques. Le conteneur est arrêté s’il est en cours d’exécution, démarré pour l’installation des pilotes, puis retrouve normalement son état initial (en marche/arrêté).",
+      "imageAlt": "Sélection d’un conteneur LXC existant"
+    },
+    "selectGpu": {
+      "title": "Sélectionner les familles de GPU",
+      "body": "La liste choisit des familles de fabricants, pas un périphérique PCI isolé. Intel/AMD ajoutent les nœuds DRI prévus ; NVIDIA ses périphériques disponibles, pouvant couvrir plusieurs cartes. Une seule famille est choisie automatiquement. Vérifiez la liste finale, surtout avec plusieurs GPU.",
+      "imageAlt": "Liste des familles GPU détectées avec nom et adresse PCI"
+    },
+    "preflight": {
+      "title": "Vérifications préalables",
+      "imageAlt": "Proposition de changement de mode d’un GPU lié à vfio-pci",
+      "intro": "Trois contrôles, qui peuvent vous bloquer ou vous rediriger :",
+      "items": [
+        "<strong>Contrôle SR-IOV.</strong> L’assistant bloque une VF ou une PF avec VF actives. C’est une limite de sa sélection large de périphériques, pas une interdiction générale dans LXC. Configurez-les séparément.",
+        "<strong>Lié à vfio-pci.</strong> Le pilote natif ne peut pas créer <code>/dev/dri/*</code> ou <code>/dev/nvidia*</code>. Propose <switchLink>Changer le mode GPU</switchLink> ; suivez les indications de redémarrage avant de revenir.",
+        "<strong>Déjà configuré.</strong> Si tous les périphériques sont présents, quitte sans réinstaller les bibliothèques. Continue seulement pour les familles sélectionnées manquantes."
+      ]
+    },
+    "applyConfig": {
+      "title": "Appliquer les modifications de configuration LXC",
+      "body1": "Arrête le conteneur s’il est en cours d’exécution et modifie <code>/etc/pve/lxc/&lt;ctid&gt;.conf</code>. Les entrées numérotées <code>dev&lt;N&gt;</code> portent le GID hôte de <code>video</code> ou <code>render</code>. Les lignes bind <code>lxc.mount.entry</code> existantes pour <code>/dev/dri</code> sont remplacées par des entrées <code>dev:</code> ; vérifiez la configuration et les droits obtenus.",
+      "body2": "Exemple après Intel + NVIDIA sur le même conteneur:"
+    },
+    "installDrivers": {
+      "title": "Démarrer le conteneur et installer les pilotes à l'intérieur",
+      "body": "Démarre le conteneur et attend environ 30 secondes au maximum que <code>pct exec</code> réponde. Détecte la distribution via <code>/etc/os-release</code> et installe les paquets adaptés.",
+      "headerDistro": "Distribution",
+      "headerInt": "Intel / AMD",
+      "headerNvidia": "NVIDIA",
+      "rows": [
+        {
+          "distro": "Alpine",
+          "intel": "apk add mesa-va-gallium intel-media-driver libva-utils",
+          "nvidia": "apk add nvidia-utils"
+        },
+        {
+          "distro": "Arch / Manjaro",
+          "intel": "pacman -Sy intel-media-driver mesa libva-utils",
+          "nvidia": "pacman -Sy nvidia-utils"
+        }
+      ],
+      "debianDistro": "Debian / Ubuntu / autres",
+      "debianIntel": "apt-get install va-driver-all intel-opencl-icd vainfo",
+      "debianNvidia": "Extrait <code>.run</code> sur l’hôte → <code>pct push</code> → installe avec <code>--no-kernel-modules --no-dkms</code>.",
+      "whyTitle": "Pourquoi utiliser l’installateur NVIDIA .run sous Debian",
+      "whyBody": "Les paquets peuvent ne pas correspondre à l’hôte. Les bibliothèques <strong>doivent correspondre au module hôte chargé</strong> pour NVML et <code>nvidia-smi</code>. Debian/glibc utilise le <code>.run</code> de cette version en cache, l’extrait et l’archive sur l’hôte, le transfère avec <code>pct push</code> et installe avec <code>--no-kernel-modules --no-dkms</code>. Alpine et Arch utilisent leurs dépôts ; vérifiez les versions."
+    },
+    "alignGids": {
+      "title": "Aligner les GID et restaurer l'état",
+      "body1": "Pour Intel/AMD, lit les GID hôte de <code>video</code> et <code>render</code>, avec 44/104 uniquement comme valeurs de secours, puis modifie <code>/etc/group</code> dans le conteneur pour qu’ils correspondent ; les exécutions NVIDIA seul sautent cette étape. Des entrées comme <code>video:44</code> et <code>render:104</code> sont des exemples, pas des ID universels. Vérifiez l’appartenance de l’application aux groupes et les droits effectifs sur les périphériques.",
+      "body2": "À la fin normale, un conteneur initialement arrêté est de nouveau arrêté ; un conteneur actif reste actif. En cas d’échec de démarrage ou d’installation, vérifiez l’état final et le journal."
+    }
+  },
+  "vendors": {
+    "heading": "Notes par fabricant",
+    "intelHeading": "Intel iGPU",
+    "intelBody": "L’accélération multimédia Intel, dont <em>Quick Sync</em>, dépend de la génération du GPU, des codecs et de la configuration de l’application. Le script partage ceux de <code>/dev/dri/card0</code>, <code>card1</code>, <code>renderD128</code> et <code>renderD129</code> qui existent ; les autres numéros de nœud ne sont pas ajoutés. L’hôte doit déjà les fournir via son pilote natif, par exemple <code>i915</code>.",
+    "amdHeading": "AMD",
+    "amdBody": "AMD utilise DRI pour Mesa/VA-API. Si <code>/dev/kfd</code> existe sur l’hôte, le partage aussi. ROCm/OpenCL exige matériel et bibliothèques compatibles ; partager le périphérique n’installe pas toute la pile ROCm.",
+    "nvidiaHeading": "NVIDIA",
+    "nvidiaBody": "Partage les périphériques <code>/dev/nvidia*</code>. <strong>La concordance des versions</strong> est essentielle pour <code>nvidia-smi</code>. Debian/glibc utilise le <code>.run</code> de la version hôte, Alpine/Arch leurs dépôts. Sous 2048 MiB de RAM configurée, la procédure Debian propose une hausse temporaire puis restaure la valeur ; exige aussi 1500 MiB libres sur disque.",
+    "updateTitle": "Après mise à jour NVIDIA sur l’hôte, vérifiez les bibliothèques LXC",
+    "updateBody": "D’anciennes bibliothèques peuvent provoquer une erreur dans <code>nvidia-smi</code>. L’<nvidiaLink>installateur NVIDIA de l’hôte</nvidiaLink> propose de mettre à jour les conteneurs. Relancer l’ajout peut quitter si les périphériques existent déjà : cela ne garantit pas la mise à jour. Vérifiez les versions et actualisez les paquets ou l’installation utilisateur adaptée."
+  },
+  "verification": {
+    "heading": "Vérification",
+    "body": "Dans le conteneur, vérifiez que le GPU est visible et utilisable."
+  },
+  "troubleshoot": {
+    "heading": "Dépannage",
+    "mismatchTitle": "nvidia-smi: Failed to initialize NVML: Driver/library version mismatch",
+    "mismatchBody": "Les bibliothèques ne correspondent pas au module chargé. Vérifiez les versions et mettez à jour l’espace utilisateur LXC. Le <code>.run</code> en cache sert à Debian/glibc, mais l’ajout peut quitter si tous les périphériques existent déjà.",
+    "denyTitle": "Autorisation refusée sur /dev/dri/renderD128 à l'intérieur du conteneur",
+    "denyBody": "Vérifiez périphérique et droits numériques de <code>render</code>, puis l’appartenance de l’utilisateur à <code>render</code>. Si disponible, ajoutez-le à <code>render</code> avec <code>usermod -aG render &lt;user&gt;</code> en remplaçant le marqueur par le compte réel. Redémarrez sa session. Changer de privilèges n’est pas une solution générale.",
+    "vainfoTitle": "vainfo dit: VA-API version 1.xx; a échoué à initialiser",
+    "vainfoBody": "Vérifiez accès et pilote VA-API. Les noms varient selon la distribution : par exemple <code>intel-media-driver</code> pour les Intel récents pris en charge, <code>i965-va-driver</code> pour les anciens compatibles, <code>mesa-va-drivers</code> pour AMD. Le message seul ne prouve pas un paquet manquant.",
+    "logTitle": "Journal d’installation",
+    "logBody": "Chaque exécution écrit <code>/tmp/add_gpu_lxc.log</code> sur l’hôte. Joignez le journal aux demandes d’aide."
+  },
+  "related": {
+    "heading": "Voir aussi",
+    "items": [
+      {
+        "label": "Installer les pilotes NVIDIA (host)",
+        "href": "/docs/hardware/nvidia-host",
+        "tail": " — installez le pilote hôte avant de partager NVIDIA."
+      },
+      {
+        "label": "Ajouter GPU à VM (Passthrough)",
+        "href": "/docs/hardware/gpu-vm-passthrough",
+        "tail": " — solution pour réserver un GPU à une VM."
+      },
+      {
+        "label": "Changer le mode GPU (VM ↔ LXC)",
+        "href": "/docs/hardware/switch-gpu-mode",
+        "tail": " — basculer le GPU entre partage LXC et attribution VM."
+      },
+      {
+        "label": "commandes GPU Passthrough",
+        "href": "/docs/help-info/gpu-commands",
+        "tail": "— référence rapide pour les commandes shell connexes."
+      }
+    ]
+  }
+}
diff --git a/web/messages/fr/docs/hardware/install-coral-tpu-host.json b/web/messages/fr/docs/hardware/install-coral-tpu-host.json
new file mode 100644
index 00000000..82ea0831
--- /dev/null
+++ b/web/messages/fr/docs/hardware/install-coral-tpu-host.json
@@ -0,0 +1,203 @@
+{
+  "meta": {
+    "title": "Installer Coral TPU sur l’hôte | Documentation ProxMenux",
+    "description": "Installe les composants Coral sur Proxmox VE selon le matériel détecté : gasket/apex avec DKMS pour M.2 / Mini-PCIe, libedgetpu1-std pour USB. Exécute les deux procédures si les deux types sont détectés."
+  },
+  "header": {
+    "title": "Installer Coral TPU sur l’hôte",
+    "description": "Préparez l’hôte Proxmox pour Coral et le partage LXC. Détecte M.2 / Mini-PCIe, USB ou les deux, puis installe les modules DKMS pour PCIe et l’environnement Google Edge TPU pour USB.",
+    "section": "Matériel : GPU et Coral-TPU"
+  },
+  "intro": {
+    "title": "Fonctionnement",
+    "body": "Un <strong>installateur unique détectant le matériel</strong>. PCIe utilise <code>gasket</code> et <code>apex</code> avec DKMS ; les compilations futures nécessitent sources et en-têtes compatibles. USB utilise <code>libedgetpu1-std</code>. Les deux procédures s’exécutent si les deux types sont détectés. L’environnement USB doit être là où tourne l’application ; il n’est pas nécessairement requis sur l’hôte pour un usage LXC seul."
+  },
+  "which": {
+    "heading": "Quel Coral ai-je ?",
+    "body": "Les modèles PCIe et USB diffèrent par leur format et leurs besoins. Le script gère les deux ; identifiez votre périphérique avant de le lancer.",
+    "headerForm": "Facteur de forme",
+    "headerDetect": "Détection",
+    "headerInstall": "Type d’installation",
+    "headerReboot": "Redémarrer ?",
+    "pcieForm": "M.2 / Mini-PCIe",
+    "pcieFormSub": "(cartes M.2 avec un ou deux Edge TPU)",
+    "pcieDetect": "Identifiant fabricant PCI <code>1ac1</code>",
+    "pcieInstall": "Module noyau (gasket + apex) via DKMS",
+    "pcieReboot": "Oui",
+    "usbForm": "Accélérateur USB",
+    "usbFormSub": "(petit dongle en plastique)",
+    "usbDetect": "USB <code>1a6e:089a</code> (non programmé) / <code>18d1:9302</code> (programmé)",
+    "usbInstall": "Environnement utilisateur <code>libedgetpu1-std</code> du dépôt APT Google",
+    "usbReboot": "Non"
+  },
+  "prereqs": {
+    "title": "Avant de commencer",
+    "coral": "<strong>Un Coral connecté</strong> (M.2, Mini-PCIe ou USB) pour installer. Sans matériel détecté, le script peut nettoyer ou retirer une installation existante, mais n’installe pas de nouvelle prise en charge matérielle.",
+    "coralCheck": "lspci -d 1ac1: ; lsusb | grep -E '1a6e:089a|18d1:9302'",
+    "internet": "<strong>Accès à Internet</strong> sur l’hôte pour cloner le pilote PCIe depuis GitHub ou télécharger <code>libedgetpu1-std</code> depuis le dépôt APT Google pour USB.",
+    "headers": "<strong>En-têtes du noyau disponibles via APT</strong> : <code>proxmox-headers-$(uname -r)</code>. Requis seulement pour PCIe/M.2 ; le script les installe.",
+    "reboot": "<strong>Prévoyez un redémarrage</strong> pour PCIe. Le script tente de charger les modules compilés ; redémarrer vérifie aussi leur chargement automatique."
+  },
+  "hostPrepTip": {
+    "title": "Cela ne prépare que l'hôte",
+    "body": "Prépare l’hôte pour <em>accéder au périphérique</em>, sans configurer ni tester l’application. Pour <em>utiliser</em> Coral dans une application compatible comme Frigate, suivez <lxcLink>Ajouter Coral TPU à un LXC</lxcLink>."
+  },
+  "running": {
+    "heading": "Exécuter l’installateur",
+    "body": "Ouvrez ProxMenux sur l’hôte et choisissez <strong>Matériel : GPU et Coral-TPU → Installer/mettre à jour Coral TPU sur l’hôte</strong>.",
+    "imageAlt": "Option du menu pour installer ou mettre à jour Coral TPU sur l’hôte"
+  },
+  "howRuns": {
+    "heading": "Déroulement du script",
+    "body": "Détecte d’abord le matériel et prépare le plan adapté. L’installation nécessite une confirmation."
+  },
+  "walkthrough": {
+    "heading": "Étapes de la procédure",
+    "detect": {
+      "title": "Détection du matériel",
+      "body": "Cherche le fabricant <code>0x1ac1</code> dans <code>/sys/bus/pci/devices/*/vendor</code> et utilise <code>lsusb</code> pour USB. Il existe <strong>deux</strong> identifiants USB selon l’état du micrologiciel :",
+      "items": [
+        "<code>1a6e:089a</code> — Global Unichip, état <em>non programmé</em>, avant le chargement du micrologiciel par l’environnement d’exécution.",
+        "<code>18d1:9302</code> — Google, état <em>programmé</em>, après chargement du micrologiciel."
+      ],
+      "outro": "Sans Coral détecté ni installation existante, le script affiche un message et se termine. Des composants présents peuvent ouvrir le menu de nettoyage ou de suppression."
+    },
+    "prompt": {
+      "title": "Confirmation de l’installation",
+      "body": "Avant l’installation, une boîte de dialogue présente les périphériques et composants prévus. Annuler ignore l’installation. Le nettoyage facultatif des anciens composants possède sa propre confirmation préalable.",
+      "imageAlt": "Résumé des périphériques Coral et des étapes d’installation"
+    },
+    "pcie": {
+      "title": "PCIe : modules gasket et apex via DKMS",
+      "body": "Exécuté uniquement pour un Coral PCIe/M.2 détecté. Compile les modules pour le noyau actuellement exécuté sur l’hôte.",
+      "items": [
+        "<strong>Nettoyage.</strong> Tout paquet <code>gasket-dkms</code> existant est supprimé avant la recompilation ; s’il est dans un état de paquet défectueux, le script force sa suppression et sa purge.",
+        "<strong>Dépendances de compilation :</strong> <code>git</code>, <code>dkms</code>, <code>build-essential</code>, <code>proxmox-headers-$(uname -r)</code>."
+      ],
+      "cloneIntro": "<strong>Clone les sources du pilote.</strong> Préfère <feranickLink>feranick/gasket-driver</feranickLink>, sinon utilise <googleLink>google/gasket-driver</googleLink>. La compilation dépend de la compatibilité du noyau. Les sources Google reçoivent ces correctifs selon la version :",
+      "kernelPatches": [
+        "À partir du noyau 6.5, le correctif remplace <code>no_llseek</code> par <code>noop_llseek</code> dans les sources de secours.",
+        "Noyau 6.13 ou supérieur : transforme l’argument de <code>MODULE_IMPORT_NS(DMA_BUF)</code> en chaîne littérale."
+      ],
+      "afterItems": [
+        "<strong>Copie les sources dans <code>/usr/src/gasket-1.0/</code>,</strong> génère <code>dkms.conf</code> et les enregistre avec <code>dkms add</code>.",
+        "<strong>Compile et installe :</strong> <code>dkms build</code>, puis <code>dkms install</code>. En cas d’échec, affiche les 50 dernières lignes de <code>make.log</code> si disponible.",
+        "<strong>Crée le groupe <code>apex</code> et les règles udev</strong> (<code>/etc/udev/rules.d/99-coral-apex.rules</code>) pour attribuer le groupe à <code>/dev/apex_*</code>.",
+        "<strong>Tente de charger les modules :</strong> <code>modprobe gasket</code> et <code>modprobe apex</code>."
+      ],
+      "imageAlt": "Compilation DKMS et chargement des modules gasket/apex"
+    },
+    "usb": {
+      "title": "USB : environnement Edge TPU de Google",
+      "body": "Ne fonctionne que si un accélérateur USB a été détecté. Bien plus simple :",
+      "items": [
+        "<strong>Ajoute la clé GPG Google</strong> dans <code>/etc/apt/keyrings/coral-edgetpu.gpg</code>.",
+        "<strong>Ajoute le dépôt APT</strong> dans <code>/etc/apt/sources.list.d/coral-edgetpu.list</code> ; <code>signed-by=</code> limite la vérification à son trousseau. Il s’agit du format .list sur une ligne, pas du format deb822 .sources.",
+        "<strong>Installe <code>libedgetpu1-std</code></strong>, l’environnement Edge TPU aux performances standard.",
+        "<strong>Recharge udev</strong> et applique les règles du paquet au périphérique USB."
+      ],
+      "stdTitle": "Pourquoi libedgetpu1-std et pas libedgetpu1-max ?",
+      "stdBody": "Le paquet <code>max</code> active la fréquence maximale prise en charge, avec davantage de performances, de consommation et de chaleur. Vérifiez le refroidissement et les conditions d’utilisation. Les paquets sont mutuellement exclusifs ; changez avec <code>apt install libedgetpu1-max</code>."
+    },
+    "reboot": {
+      "title": "Redémarrage proposé après l’installation PCIe",
+      "body": "Après PCIe, propose un redémarrage. Le script a tenté <code>modprobe</code> ; vérifiez les modules et <code>/dev/apex_0</code> avec le groupe <code>apex</code>. Un redémarrage planifié vérifie le chargement automatique. USB seul ne demande pas de redémarrer l’hôte.",
+      "imageAlt": "Résumé et proposition de redémarrage après installation PCIe"
+    }
+  },
+  "legacyCleanup": {
+    "heading": "Nettoyer l’ancien gasket-dkms sur les hôtes utilisant seulement USB",
+    "intro": "Si <strong>aucun Coral PCIe/M.2 n’est détecté</strong> mais qu’une ancienne installation de <code>gasket-dkms</code> existe, propose un nettoyage facultatif avec confirmation.",
+    "items": [
+      "Si un Coral PCIe/M.2 est détecté, suit la procédure normale de recompilation DKMS et ne propose pas ce nettoyage.",
+      "Purge <code>gasket-dkms</code>, supprime les anciennes entrées DKMS et sources gasket, puis répare l’état en attente de <code>dpkg</code>/APT.",
+      "Conserve les paquets USB <code>libedgetpu1-std</code> et <code>libedgetpu1-max</code>, donc le Coral USB garde son environnement d’exécution.",
+      "Le script vérifie que le paquet héritage a disparu et que la gestion du paquet est saine avant de signaler le succès."
+    ],
+    "warningTitle": "Confirmez d'abord le matériel",
+    "warningBody": "Si un Coral PCIe/M.2 attendu n’apparaît pas, annulez le nettoyage et vérifiez carte, emplacement et micrologiciel."
+  },
+  "reinstallUninstall": {
+    "heading": "Réinstaller ou désinstaller",
+    "intro": "Si une installation PCIe avec <code>gasket-dkms</code>, USB avec <code>libedgetpu1-std</code>/<code>libedgetpu1-max</code> ou les deux est détectée, affiche un menu d’actions.",
+    "imageAlt": "Menu pour réinstaller, mettre à jour ou désinstaller Coral",
+    "imageCaption": "Le menu apparaît si un composant existe : entrée DKMS gasket, paquet <code>libedgetpu1-*</code> ou périphériques <code>/dev/apex_*</code>.",
+    "reinstallHeading": "Réinstaller / mettre à jour",
+    "reinstallBody": "Suit l’installation normale : recompile après changement de noyau ou met à jour <code>libedgetpu1-*</code> depuis Google. Nettoie d’abord l’ancien état DKMS pour qu’une installation échouée ne bloque pas la compilation.",
+    "uninstallHeading": "Désinstaller — ce qui est enlevé",
+    "uninstallIntro": "Nécessite une confirmation. Les applications LXC utilisant <code>/dev/apex_*</code> peuvent perdre l’accès pendant la suppression ou après redémarrage. Étapes :",
+    "uninstallItems": [
+      "Tente de décharger <code>apex</code> et <code>gasket</code> ; leur utilisation peut empêcher le retrait.",
+      "Supprime chaque entrée DKMS enregistrée <code>gasket/&lt;version&gt;</code> afin que les modules ne reviennent pas sur le prochain noyau installé.",
+      "Purge <code>gasket-dkms</code>, <code>libedgetpu1-std</code> et <code>libedgetpu1-max</code>, puis exécute <code>apt-get autoremove --purge</code>.",
+      "Supprime <code>/etc/udev/rules.d/99-coral-apex.rules</code> et restaure le groupe par défaut de <code>60-gasket-dkms.rules</code> si ce fichier existe encore.",
+      "Vérifie les membres supplémentaires de <code>apex</code>. <strong>Si la liste est vide</strong>, tente de supprimer le groupe ; sinon conserve <code>apex</code> et liste ses membres. Ce n’est pas une vérification complète des utilisateurs dont c’est le groupe principal.",
+      "Supprime la liste de dépôts <code>/etc/apt/sources.list.d/coral-edgetpu.list</code>, l’ancien <code>coral-cloud.list</code> et les anciens trousseaux nommés <code>coral-edgetpu-archive-keyring.gpg</code>. Le trousseau actuel <code>/etc/apt/keyrings/coral-edgetpu.gpg</code> n’est pas supprimé par cette séquence.",
+      "Propose un redémarrage <strong>seulement si PCIe était installé</strong> pour retirer les modules encore actifs. USB seul ne nécessite pas de redémarrage."
+    ],
+    "lxcWarnTitle": "Récipients LXC avec passage apex",
+    "lxcWarnBody": "Retirer les composants de l’hôte peut interrompre l’accès LXC. Prévoyez une maintenance si des applications compatibles comme Frigate dépendent de ce Coral."
+  },
+  "updates": {
+    "heading": "Notifications de mise à jour",
+    "intro": "ProxMenux recense les composants Coral et vérifie PCIe/M.2 et USB séparément. Si les deux sont présents, chaque variante utilise sa propre source de versions :",
+    "headerVariant": "Variante",
+    "headerTracked": "Version enregistrée",
+    "headerUpstream": "Source des versions",
+    "pcieVariant": "PCIe / M.2",
+    "pcieTracked": "D’abord l’étiquette enregistrée après installation, puis la version d’un paquet <code>gasket-dkms</code> sain, sinon celle du module DKMS. Cette dernière n’indique pas le niveau de correctifs du fork.",
+    "pcieUpstream": "Dernière étiquette GitHub de <code>feranick/gasket-driver</code> ; cache de sept jours et comparaison du numéro de compilation.",
+    "usbVariant": "USB",
+    "usbTracked": "<code>libedgetpu1-std</code> ou <code>libedgetpu1-max</code> version apt",
+    "usbUpstream": "Candidat local <code>apt-cache policy</code> (Google Coral apt repo)",
+    "outro": "Si une nouvelle version est détectée, Monitor envoie <code>coral_driver_update_available</code> sur les canaux activés. La notification renvoie à l’installateur : choisissez <strong>Réinstaller / mettre à jour</strong>.",
+    "antiTitle": "Sans notifications répétitives",
+    "antiBody": "Une notification par variante lorsque la version disponible change. Pas de répétition à chaque contrôle quotidien ; un nouvel avis attend une version ultérieure.",
+    "rebootTitle": "Mises à jour PCIe : prévoyez un redémarrage",
+    "rebootBody": "Le module PCIe recompilé doit être chargé ; un redémarrage planifié vérifie aussi le chargement automatique. La bibliothèque USB ne nécessite pas de redémarrer l’hôte, mais les applications utilisant l’ancienne version peuvent devoir redémarrer."
+  },
+  "manual": {
+    "heading": "Procédure manuelle équivalente",
+    "intro": "Ces commandes présentent les principales étapes de chaque procédure pour consultation ou exécution manuelle.",
+    "pcieHeading": "PCIe / M.2 (gasket + apex via DKMS)",
+    "usbHeading": "USB (environnement libedgetpu)"
+  },
+  "verification": {
+    "heading": "Vérification",
+    "pcieHeading": "PCIe / M.2",
+    "usbHeading": "USB"
+  },
+  "troubleshoot": {
+    "heading": "Dépannage",
+    "dkmsFailTitle": "Échec de compilation DKMS après mise à jour du noyau",
+    "dkmsFailBody": "Des en-têtes manquants sont une cause possible. Vérifiez <code>proxmox-headers-$(uname -r)</code> avec <code>dpkg -l proxmox-headers-$(uname -r)</code> et installez-les si nécessaire. Consultez le journal pour les incompatibilités du noyau. Relancer appelle <code>cleanup_broken_gasket_dkms</code>, sans garantir la compatibilité avec tout noyau.",
+    "apexMissTitle": "/dev/apex_0 manquant après redémarrage",
+    "apexMissBody": "Vérifiez la détection PCIe et la correspondance module/noyau actif. Essayez <code>modprobe apex</code> et consultez <code>dmesg | grep -iE \"apex|gasket\"</code>. Compilation, chargement ou configuration de l’emplacement/du micrologiciel peuvent empêcher la création du périphérique.",
+    "lxcMissTitle": "L’hôte voit /dev/apex_0, mais pas le LXC",
+    "lxcMissBody": "Un nœud visible ne prouve pas le fonctionnement. Vérifiez l’accès sur l’hôte, le montage LXC, les règles cgroup et les droits UID/GID. Voir <lxcLink>Ajouter Coral TPU à un LXC</lxcLink>.",
+    "usbUnreachTitle": "Accélérateur USB détecté mais Frigate / TFLite ne peut pas l'atteindre",
+    "usbUnreachBody": "Vérifiez les règles de <code>libedgetpu1-std</code> et les droits avec <code>ls -l /dev/bus/usb/*/*</code>. L’utilisateur/groupe mappé de l’application doit pouvoir lire et écrire ; root propriétaire n’est pas une erreur en soi. Après modification, exécutez <code>udevadm control --reload-rules &amp;&amp; udevadm trigger</code> puis reconnectez si nécessaire.",
+    "logTitle": "Journal d’installation",
+    "logBody": "Chaque exécution écrit <code>/tmp/coral_install.log</code>. En cas d’échec DKMS, ajoute les 50 dernières lignes de <code>/var/lib/dkms/gasket/1.0/build/make.log</code> si disponible. Joignez le journal à la demande d’aide."
+  },
+  "related": {
+    "heading": "Voir aussi",
+    "items": [
+      {
+        "label": "Ajouter un Coral TPU à LXC",
+        "href": "/docs/hardware/coral-tpu-lxc",
+        "tail": " — donner accès au Coral de l’hôte à un conteneur avec une application compatible."
+      },
+      {
+        "label": "Installer les pilotes NVIDIA (host)",
+        "href": "/docs/hardware/nvidia-host",
+        "tail": " — la même démarche pour les GPU NVIDIA."
+      },
+      {
+        "label": "ProxMenux Monitor — Onglet matériel",
+        "href": "/docs/monitor/dashboard/hardware",
+        "tail": " — le panneau Coral présente pilote, modules, périphériques et environnement d’exécution, plus la température si un capteur pris en charge la fournit."
+      }
+    ]
+  }
+}
diff --git a/web/messages/fr/docs/hardware/nvidia-host.json b/web/messages/fr/docs/hardware/nvidia-host.json
new file mode 100644
index 00000000..0488c75c
--- /dev/null
+++ b/web/messages/fr/docs/hardware/nvidia-host.json
@@ -0,0 +1,175 @@
+{
+  "meta": {
+    "title": "Installer NVIDIA sur l’hôte | Documentation ProxMenux",
+    "description": "Installez les pilotes propriétaires NVIDIA sur Proxmox VE avec ProxMenux : filtrage GPU, vérifications de compilation et DKMS, persistance, correctif NVENC facultatif et mise à jour des bibliothèques LXC."
+  },
+  "header": {
+    "title": "Installer les pilotes NVIDIA sur l'hôte",
+    "description": "Installez NVIDIA sur l’hôte Proxmox VE. Filtre les branches maintenues selon l’ID PCI du GPU, vérifie la compilation, utilise DKMS, gère nouveau et installe la persistance. Peut aussi actualiser les bibliothèques des LXC utilisant NVIDIA.",
+    "section": "Matériel : GPU et Coral-TPU"
+  },
+  "intro": {
+    "title": "Fonctionnement",
+    "body": "ProxMenux détecte le GPU et propose des branches NVIDIA maintenues incluant son ID PCI. Il bloque <code>nouveau</code>, télécharge l’installateur officiel <code>.run</code>, utilise DKMS, installe <code>nvidia-persistenced</code>, les règles udev et le NVIDIA Container Toolkit, et propose un correctif NVENC facultatif. Les vérifications de compilation portent sur le noyau en cours ; une compilation réussie ne garantit pas que toutes les applications fonctionnent. Les LXC NVIDIA existants se voient proposer une mise à jour des bibliothèques userspace, de version correspondante sauf sous Arch."
+  },
+  "who": {
+    "heading": "C'est pour qui ?",
+    "body": "Pour le traitement vidéo ou le calcul GPU avec Plex, Jellyfin, Frigate, Immich ou Stable Diffusion <strong>dans LXC</strong>, installez d’abord NVIDIA sur l’<em>hôte</em> Proxmox. L’attribution directe à une <strong>VM</strong> utilise la procédure VFIO distincte."
+  },
+  "prereqs": {
+    "title": "Avant de commencer",
+    "gpu": "<strong>Un GPU NVIDIA</strong> installé dans l’hôte. Détection automatique ; cette option ne gère ni AMD ni Intel.",
+    "gpuCheck": "lspci | grep -i nvidia",
+    "notVm": "Le GPU <strong>ne doit pas être réservé à une VM via VFIO</strong>. L’installateur refuse ce cas pour ne pas perturber l’affectation.",
+    "internet": "Accès Internet sur l’hôte. Télécharge le pilote depuis <code>download.nvidia.com</code> et peut cloner <code>nvidia-persistenced</code> et <code>nvidia-patch</code> depuis GitHub.",
+    "space": "Prévoyez de l’espace dans <code>/opt/nvidia</code> pour <code>.run</code> et de la RAM pour compiler. Le parcours LXC hors Arch vérifie 1500 MiB libres et peut demander temporairement 2048 MiB de RAM si nécessaire, puis restaure la limite précédente. Prévoyez le redémarrage hôte."
+  },
+  "vmWarn": {
+    "title": "GPU réservé à une VM ? Arrêtez ici",
+    "body": "Si un périphérique NVIDIA est lié à <code>vfio-pci</code>, l’installateur quitte, même VM arrêtée. Une réservation n’implique pas une utilisation active. Planifiez le retour au pilote hôte et retirez les anciennes affectations VM/VFIO avant redémarrage et installation."
+  },
+  "running": {
+    "heading": "Exécution de l'installateur",
+    "body": "Ouvrez <strong>Hardware Graphics → NVIDIA GPU Driver Installer</strong> dans ProxMenux. Le menu dépend de la présence d’un pilote actif.",
+    "imageAlt": "Menu matériel avec l’installateur NVIDIA sélectionné"
+  },
+  "howRuns": {
+    "heading": "Déroulement du script",
+    "body": "Détecte les périphériques, choisit une version et installe. Un nettoyage VFIO confirmé séparément peut précéder l’aperçu. La préparation des dépôts/en-têtes et le téléchargement précèdent le remplacement du pilote ; une seule confirmation finale ne marque pas le début de tous les changements."
+  },
+  "walkthrough": {
+    "detect": {
+      "title": "Détection et aperçu de GPU",
+      "body1": "Affiche les contrôleurs vidéo NVIDIA, l’état du pilote ou <em>« Aucun pilote NVIDIA installé »</em>, et les LXC configurés pour NVIDIA avec leur version interne.",
+      "body2": "Vérifiez GPU et versions hôte/conteneurs. Annulez dans l’aperçu si la sélection est inattendue ; un nettoyage VFIO confirmé auparavant a déjà été effectué.",
+      "imageAlt": "Aperçu avant installation : GPU, pilote et LXC configurés pour NVIDIA"
+    },
+    "version": {
+      "title": "Choisissez la version du pilote",
+      "body1": "Filtre les versions de <code>nvidia.com</code> qui <strong>incluent l’ID PCI du GPU dans la table des puces compatibles</strong> et écarte les versions bêta/développement par heuristiques. <em>&lt;version&gt; — Recommandée</em> privilégie la dernière version de la branche installée, puis Production Branch, puis le numéro compatible le plus élevé.",
+      "body2": "Si le pilote est enregistré comme corrigé via keylase, le sélecteur se limite à la table NVENC. <em>Réinstaller / mettre à jour</em> comporte toujours les confirmations et le choix du correctif ; vérifiez le résultat.",
+      "whyTitle": "Comment la compatibilité du noyau est validée",
+      "whyBody": "Filtre selon les branches maintenues et l’ID PCI, sans matrice noyau/pilote fixe. Une compilation préalable teste le noyau actuel. Un échec confirmé revient au sélecteur ; un test indisponible peut avertir puis continuer. Installation finale et vérification du fonctionnement restent nécessaires.",
+      "imageAlt": "Sélecteur des branches compatibles GPU avec recommandation en premier"
+    },
+    "uninstall": {
+      "title": "Retirer l’ancien pilote avant réinstallation",
+      "body": "Après téléchargement et vérification de l’installateur choisi, retire le pilote précédent. Arrête les services NVIDIA, décharge les modules, retire les entrées DKMS et purge <code>nvidia-*</code> / <code>libnvidia-*</code> / <code>cuda-*</code>. Cela vaut aussi pour une réinstallation confirmée de la même version."
+    },
+    "prepare": {
+      "title": "Préparer le système",
+      "body": "Pendant la préparation, le script :",
+      "items": [
+        "Vérifie les dépôts avant suppression ou installation. Sans abonnement et avec Enterprise uniquement, demande l’accord pour passer à no-subscription ; un refus arrête l’installation.",
+        "Installe <code>pve-headers-$(uname -r)</code> (ou <code>proxmox-headers-$(uname -r)</code>), <code>build-essential</code> et <code>dkms</code>.",
+        "Crée le fichier géré par ProxMenux <code>/etc/modprobe.d/proxmenux-nouveau-blacklist.conf</code> avec <code>blacklist nouveau</code> et <code>options nouveau modeset=0</code>. Enregistre l’éventuel ajout dans <code>blacklist.conf</code> et tente de décharger nouveau.",
+        "Ecrit <code>/etc/modules-load.d/nvidia-vfio.conf</code> avec <code>nvidia</code> et <code>nvidia_uvm</code> afin que les modules se chargent tôt au démarrage."
+      ]
+    },
+    "download": {
+      "title": "Téléchargez et exécutez l'installateur NVIDIA",
+      "body": "Télécharge <code>NVIDIA-Linux-x86_64-&lt;version&gt;.run</code> dans <code>/opt/nvidia</code> et vérifie taille et type exécutable. Ces contrôles de format ne vérifient pas une signature cryptographique. Enregistre DKMS pour les changements de noyau ; sources et noyau doivent rester compatibles.",
+      "imageAlt": "Progression du téléchargement et compilation DKMS de l’installateur NVIDIA"
+    },
+    "persist": {
+      "title": "Service de persistance et règles udev",
+      "body": "Installe <persistLink>nvidia-persistenced</persistLink> et écrit <code>/etc/udev/rules.d/70-nvidia.rules</code> pour créer <code>/dev/nvidia*</code> au démarrage. Cela évite qu’un LXC cherche le GPU avant la création des périphériques."
+    },
+    "nvenc": {
+      "title": "Optionnel : appliquer le patch NVENC",
+      "body": "Les limites de sessions NVENC dépendent du GPU et du pilote. <patchLink>keylase/nvidia-patch</patchLink> peut retirer la limite du pilote pour les versions prises en charge. Choisissez <strong>Oui</strong> si vous avez besoin de ce changement d’encodage et si votre version est compatible. Cela n’accélère pas le décodage ni ne supprime les limites matérielles.",
+      "supportTitle": "Vérifier la compatibilité du correctif",
+      "supportBody": "Vérifiez la version exacte dans la <patchTableLink>table des correctifs</patchTableLink>. Si elle manque, gardez le pilote sans correctif ou choisissez une autre version maintenue compatible GPU, noyau et correctif ; sa proximité dans la liste ne suffit pas."
+    },
+    "propagate": {
+      "title": "Facultatif : actualiser les bibliothèques NVIDIA des LXC",
+      "body1": "Propose les bibliothèques du pilote aux LXC détectés. Elles et le module hôte <strong>doivent avoir des versions correspondantes</strong> ; sinon <code>nvidia-smi</code> peut signaler « version mismatch ».",
+      "body2": "Debian / Ubuntu et les autres conteneurs glibc reçoivent l’installateur <code>.run</code> extrait avec <code>--no-kernel-modules --no-dkms --no-install-compat32-libs</code> ; la RAM peut temporairement passer à 2 GiB puis être restaurée. <strong>Arch, Manjaro et EndeavourOS</strong> utilisent <code>pacman -Syu nvidia-utils</code> depuis leurs dépôts, sans fixer la version hôte : vérifiez le résultat. <strong>Alpine</strong> reçoit le contenu <code>.run</code> extrait via <code>pct push</code>, installe <code>gcompat</code> et <code>binutils</code> avec <code>apk</code> et crée les liens SONAME via <code>readelf</code>. Vérifiez le fonctionnement ; la couche de compatibilité ne garantit pas toutes les bibliothèques sous musl.",
+      "imageAlt": "Dialogue des LXC NVIDIA et de leurs versions pour confirmer la mise à jour"
+    },
+    "reboot": {
+      "title": "Redémarrer",
+      "body": "Après l’installation du pilote, le script reconstruit <code>initramfs</code> pour tous les noyaux ; sa dernière étape propose un redémarrage. <strong>Prévoyez ce redémarrage</strong> pour vérifier la configuration persistante des modules et la configuration nouveau lors d’un nouveau démarrage, même si le nouveau pilote répond déjà avant le redémarrage."
+    }
+  },
+  "reinstallUninstall": {
+    "heading": "Réinstaller ou désinstaller",
+    "intro": "Si <code>nvidia</code> est chargé et que <code>nvidia-smi</code> renvoie une version, affiche un menu d’actions. Ce critère détecte un pilote actif ; des fichiers peuvent être installés sans module chargé.",
+    "imageAlt": "Menu d'action NVIDIA offert lorsqu'un pilote est déjà installé — deux choix: réinstaller / mettre à jour le pilote, ou désinstaller complètement le pilote NVIDIA",
+    "imageCaption": "Le menu action n'apparaît que lorsqu'un pilote NVIDIA est actuellement actif sur l'hôte.",
+    "reinstallHeading": "Réinstaller / mettre à jour",
+    "reinstallBody": "Choisit une version, prépare dépôts/en-têtes, télécharge et teste la compilation avant le remplacement du pilote. Permet une mise à jour dans la branche maintenue ou un autre choix compatible. Les options de bibliothèques LXC et de correctif NVENC réapparaissent ensuite.",
+    "uninstallHeading": "Désinstaller — ce qui est enlevé",
+    "uninstallIntro": "Après confirmation Oui/Non, retire les composants suivants :",
+    "uninstallItems": [
+      "Arrête et désactive <code>nvidia-persistenced</code> et <code>nvidia-powerd</code>, tente de décharger <code>nvidia_uvm</code>, <code>nvidia_drm</code>, <code>nvidia_modeset</code> et <code>nvidia</code>, puis exécute <code>nvidia-uninstall --silent</code> pour l’installation <code>.run</code>. Les charges de travail LXC dépendant de NVIDIA sont affectées ; des clients actifs peuvent empêcher le déchargement.",
+      "Exécute <code>apt purge</code> sur <code>nvidia-*</code>, <code>libnvidia-*</code>, <code>cuda-*</code> et <code>libcudnn*</code>, supprime l'arborescence des sources DKMS et les dossiers <code>nvidia-persistenced</code> et <code>nvidia-patch</code> sous <code>/opt/nvidia</code>.",
+      "Supprime la configuration de chargement des modules (<code>/etc/modules-load.d/nvidia-vfio.conf</code>) et les entrées de liste noire de nouveau gérées par ProxMenux. Les anciens fichiers ProxMenux de liste noire à deux lignes sont également migrés puis supprimés. Les fichiers modifiés ou indépendants de l’administrateur sont conservés.",
+      "Retire <code>/etc/udev/rules.d/70-nvidia.rules</code> et marque NVENC <em>removed</em> dans le registre des installations gérées ; aucun fichier d’état séparé.",
+      "Reconstruit <code>initramfs</code> pour tous les noyaux, exécute <code>proxmox-boot-tool refresh</code> selon l’amorçage et propose un redémarrage."
+    ],
+    "lxcWarnTitle": "LXC avec accès NVIDIA",
+    "lxcWarnBody": "Retirer le pilote hôte interrompt les applications LXC NVIDIA même si leurs bibliothèques restent installées. Prévoyez une maintenance pour Frigate, Plex, Jellyfin, Ollama et autres applications GPU."
+  },
+  "updates": {
+    "heading": "Notifications de mises à jour",
+    "body": "Le pilote NVIDIA est suivi dans le registre des installations gérées. Au démarrage et toutes les 24 heures, Monitor compare les versions de <code>download.nvidia.com/XFree86/Linux-x86_64/</code> à celle indiquée par <code>nvidia-smi</code>. Il notifie uniquement les nouvelles versions de maintenance de la branche installée.",
+    "kindsHeading": "Message de mise à jour",
+    "kindsItems": [
+      "<strong>Maintenance de la même branche.</strong> Exemple : 580.65.06 installée → 580.105.08 disponible. Monitor ne déduit pas la compatibilité noyau entre branches."
+    ],
+    "antiTitle": "Éviter les notifications répétées",
+    "antiBody": "Une notification par nouvelle version, pas à chaque contrôle quotidien. Aucune notification sans version plus récente dans la branche installée.",
+    "applyTitle": "Appliquer la mise à jour",
+    "applyBody": "Monitor signale les mises à jour sans les installer automatiquement. Ouvrez l’installateur, choisissez <strong>Réinstaller / mettre à jour</strong> et une version compatible, puis terminez compilation et installation. Prévoyez le redémarrage proposé et vérifiez ensuite hôte et bibliothèques LXC."
+  },
+  "verify": {
+    "heading": "Vérification de l'installation",
+    "intro": "Après redémarrage de l’hôte, connectez-vous via SSH ou le shell Proxmox et exécutez :",
+    "after": "Vérifiez le GPU et la version attendue. Des processus peuvent déjà apparaître si des services hôte ou conteneurs démarrés automatiquement utilisent le GPU. Vérifiez ensuite la persistance :",
+    "imageAlt": "Sortie de nvidia-smi sur l'hôte montrant le GPU détecté et la version du pilote installé"
+  },
+  "troubleshoot": {
+    "heading": "Dépannage",
+    "smiFailTitle": "nvidia-smi affiche « NVIDIA-SMI has failed »",
+    "smiFailBody": "Causes possibles : <strong>nouveau</strong>, <strong>en-têtes absents ou incompatibles</strong>, sources du pilote incompatibles ou autres erreurs de chargement. Examinez <code>lsmod | grep nouveau</code>, <code>dmesg | grep -i nvidia</code> et les journaux installateur/DKMS. Si la règle nouveau doit être corrigée, vérifiez <code>/etc/modprobe.d/proxmenux-nouveau-blacklist.conf</code> avant <code>update-initramfs -u -k all</code> et redémarrage. Tout échec de compilation ne vient pas des en-têtes.",
+    "lxcMissTitle": "Le conteneur LXC ne peut pas voir le GPU après la mise à jour de l'hôte",
+    "lxcMissBody": "Avant de réinstaller, vérifiez périphériques hôte, droits LXC et version des bibliothèques. Un conflit de versions peut nécessiter le pilote utilisateur correspondant, selon la distribution ; sous glibc, avec <code>--no-kernel-modules</code>. Réinstaller les bibliothèques ne corrige pas les montages ou droits manquants.",
+    "logTitle": "Vérifiez le journal d'installation",
+    "logBody": "L’installation écrit dans <code>/tmp/nvidia_install.log</code>. En cas d’échec, examinez téléchargement, compilation DKMS et services. Joignez le journal au signalement GitHub."
+  },
+  "manualSteps": {
+    "heading": "Vous cherchez les étapes manuelles?",
+    "body": "Voir <guideLink>Guides → NVIDIA</guideLink> pour les étapes manuelles, dont <code>wget</code> et <code>./NVIDIA-Linux-...run</code>. Le guide explique les composants sans reproduire exactement l’installateur. La procédure maintenue ProxMenux apporte filtrage GPU, vérification de compilation, mises à jour LXC et contrôles VFIO."
+  },
+  "related": {
+    "heading": "Voir aussi",
+    "items": [
+      {
+        "label": "Ajouter GPU à VM (Passthrough)",
+        "href": "/docs/hardware/gpu-vm-passthrough",
+        "tail": " — attribuer NVIDIA directement à une VM via VFIO."
+      },
+      {
+        "label": "Ajouter un GPU à LXC",
+        "href": "/docs/hardware/igpu-acceleration-lxc",
+        "tail": " — partager NVIDIA avec un ou plusieurs conteneurs."
+      },
+      {
+        "label": "Changer de mode GPU (VM ↔ LXC)",
+        "href": "/docs/hardware/switch-gpu-mode",
+        "tail": " — basculer entre passthrough VM et partage LXC."
+      },
+      {
+        "label": "ProxMenux Monitor — Onglet matériel",
+        "href": "/docs/monitor/dashboard/hardware",
+        "tail": " — fenêtre GPU ouvrant cet installateur et affichant le suivi en temps réel."
+      },
+      {
+        "label": "Commandes de passthrough GPU",
+        "href": "/docs/help-info/gpu-commands",
+        "tail": "— lspci / dmesg / IOMMU / nvidia-smi référence."
+      }
+    ]
+  }
+}
diff --git a/web/messages/fr/docs/hardware/switch-gpu-mode.json b/web/messages/fr/docs/hardware/switch-gpu-mode.json
new file mode 100644
index 00000000..5367aaec
--- /dev/null
+++ b/web/messages/fr/docs/hardware/switch-gpu-mode.json
@@ -0,0 +1,172 @@
+{
+  "meta": {
+    "title": "Changer de mode GPU (VM ↔ LXC) | Documentation ProxMenux",
+    "description": "Basculez un GPU entre VFIO pour VM et pilote natif pour LXC. ProxMenux détecte le pilote, propose des choix pour les invités concernés, retire les affectations audio associées et reconstruit initramfs si la configuration hôte change."
+  },
+  "header": {
+    "title": "Changer de mode GPU (VM ↔ LXC)",
+    "description": "Basculez un GPU attribué entre passthrough VM et partage LXC. ProxMenux gère pilote, VFIO, modules et initramfs, puis demande comment traiter les invités concernés. Vérifiez les choix et la configuration obtenue après redémarrage.",
+    "section": "Matériel : GPU et Coral-TPU"
+  },
+  "intro": {
+    "title": "Fonctionnement",
+    "body": "Avec <code>vfio-pci</code>, le GPU est réservé à une VM. Avec le pilote natif <em>(i915 / amdgpu / nvidia)</em>, l’hôte et les LXC peuvent le partager. <strong>Changer de mode GPU</strong> gère <code>vfio.conf</code>, les blocages de modules et les références des invités, et signale les affectations restantes."
+  },
+  "graphics": {
+    "lxcTitle": "Prêt pour les conteneurs LXC",
+    "lxcDesc": "Pilote natif actif",
+    "vmTitle": "Prêt pour le passthrough VM",
+    "vmDesc": "Pilote VFIO-PCI actif"
+  },
+  "when": {
+    "heading": "Quand devrais-je utiliser ça ?",
+    "intro": "À utiliser si le GPU est <strong>déjà attribué</strong> et que vous souhaitez changer son usage :",
+    "headerSituation": "Situation actuelle",
+    "headerUse": "Vous utilisez cette page ?",
+    "rows": [
+      {
+        "situation": "GPU libre, jamais attribué : l’utiliser dans une VM.",
+        "useRich": "Non — utilisez <vmLink>Ajouter un GPU à VM</vmLink>"
+      },
+      {
+        "situation": "GPU libre, jamais attribué : l’utiliser dans un LXC.",
+        "useRich": "Non — utilisez <lxcLink>Ajouter un GPU à LXC</lxcLink>"
+      },
+      {
+        "situationRich": "Le GPU est attribué à une VM via <code>vfio-pci</code> ; je veux plutôt l’utiliser dans un LXC.",
+        "useRich": "<strong>Oui — cette page.</strong>"
+      },
+      {
+        "situation": "Le GPU est partagé avec un LXC ; je veux le réserver à une VM.",
+        "useRich": "<strong>Oui — cette page.</strong>"
+      },
+      {
+        "situation": "Je veux retirer toutes les affectations de ce GPU.",
+        "use": "Le mode LXC rend le GPU au pilote hôte ; la politique de conflit VM peut retirer les entrées hostpci, mais les entrées de périphérique LXC doivent être retirées séparément. Le GPU reste associé à un pilote."
+      }
+    ]
+  },
+  "prereqs": {
+    "title": "Avant de commencer",
+    "assigned": "<strong>Un GPU déjà attribué</strong> à une VM via VFIO ou à un LXC. Pour la première affectation, utilisez Ajouter un GPU à VM / LXC.",
+    "iommu": "<strong>IOMMU doit être actif sur l’hôte</strong> pour passer <em>au</em> mode VM. Les réglages du firmware et la prise en charge par le noyau comptent tous les deux. Si <code>intel_iommu=on</code> ou <code>amd_iommu=on</code> manque dans le noyau en cours, le script l’ajoute avec <code>iommu=pt</code> à <code>/etc/kernel/cmdline</code> (marqueur de racine ZFS) ou à <code>/etc/default/grub</code>, puis exécute <code>proxmox-boot-tool refresh</code> ou <code>update-grub</code>. Vérifiez les éventuels avertissements et redémarrez si demandé.",
+    "iommuCheck": "dmesg | grep -i 'IOMMU enabled' | head -1",
+    "reboot": "<strong>Prévoyez un redémarrage.</strong> Les changements persistants de pilote et d’amorçage peuvent nécessiter de reconstruire initramfs puis de redémarrer. Le script le demande à la fin.",
+    "knowList": "<strong>Identifiez les VM et LXC utilisant le GPU.</strong> Le script détecte les références et demande quoi faire pour chaque invité ; connaître la liste facilite la vérification."
+  },
+  "blocklist": {
+    "title": "Tous les GPU ne sont pas sûrs de passer à un VM",
+    "body": "Le script bloque le mode VM pour les identifiants de périphérique <code>8086:5a84</code> et <code>8086:5a85</code> selon sa politique de compatibilité. Si un GPU sélectionné correspond, il interrompt le passage en mode VM et revient à la sélection du GPU, ou quitte s’il s’agit du seul GPU. Cette liste de blocage n’empêche pas de passer <em>au</em> mode LXC ; d’autres contrôles peuvent encore s’appliquer."
+  },
+  "running": {
+    "heading": "Exécuter le script",
+    "body": "Ouvrez <strong>Matériel : GPU et Coral-TPU → Changer de mode GPU (VM ↔ LXC)</strong> dans ProxMenux.",
+    "imageAlt": "Option Changer de mode GPU (VM ↔ LXC) du menu matériel"
+  },
+  "howRuns": {
+    "heading": "Déroulement du script",
+    "body": "Le choix du GPU et du sens précède le changement principal. Un nettoyage VFIO séparé peut demander confirmation plus tôt ; les invités concernés ont leurs propres dialogues. Lisez chaque confirmation : une seule validation finale ne couvre pas tous les changements."
+  },
+  "walkthrough": {
+    "heading": "Étapes de la procédure",
+    "detect": {
+      "title": "Détecter les GPU et leur pilote actuel",
+      "body": "Examine les contrôleurs VGA, 3D et Display de l’hôte et consulte <code>/sys/bus/pci/devices/*/driver</code>. Affiche nom, adresse PCI et pilote actuel de chaque GPU pour identifier son mode.",
+      "imageAlt": "Liste de contrôle GPU montrant chaque GPU détecté avec son pilote actuel (vfio-pci / nvidia / amdgpu / i915) et emplacement PCI"
+    },
+    "pickGpu": {
+      "title": "Choisir les GPU à basculer",
+      "body": "Un seul GPU est sélectionné automatiquement. Avec plusieurs, vous pouvez en cocher plusieurs, à condition qu’ils soient dans le <em>même</em> mode. Un mélange de modes demande de restreindre la sélection.",
+      "tipTitle": "Basculer plusieurs GPU ensemble",
+      "tipBody": "Exemple : passer trois NVIDIA en mode VM, puis rendre l’iGPU aux LXC. Deux exécutions avec chacune une cible commune, plutôt qu’une opération par carte."
+    },
+    "direction": {
+      "title": "Examiner l'orientation proposée",
+      "intro": "Basé sur le mode actuel, le script propose le contraire comme cible:",
+      "items": [
+        "<strong>VM → LXC :</strong> retire l’affectation à <code>vfio-pci</code> pour permettre au pilote natif (<code>nvidia</code>, <code>amdgpu</code>, <code>i915</code>) de prendre en charge le GPU. Pour NVIDIA, supprime les entrées BDF correspondantes de <code>/etc/udev/rules.d/10-proxmenux-vfio-bind.rules</code> au prochain démarrage.",
+        "<strong>LXC → VM :</strong> prépare l’affectation à <code>vfio-pci</code>. AMD / Intel bloquent le pilote natif et utilisent <code>options vfio-pci ids=…</code>. Pour NVIDIA, <code>nvidia</code> n’est bloqué globalement que si chaque GPU NVIDIA de l’hôte est en VFIO ; sinon, des règles par BDF appliquent <code>driver_override=vfio-pci</code> aux périphériques des groupes IOMMU concernés, et les GPU NVIDIA hors de ces groupes conservent <code>nvidia</code>. Vérifiez chaque membre du groupe avant de basculer."
+      ],
+      "outro": "Confirmez la direction ou annulez."
+    },
+    "conflict": {
+      "title": "Choix pour chaque VM ou LXC concerné",
+      "body": "Vérifie <code>/etc/pve/lxc/*.conf</code> selon les familles de pilotes GPU et <code>/etc/pve/qemu-server/*.conf</code> pour les affectations PCI. La détection LXC ne correspond pas exactement à chaque carte par BDF. Vérifiez les invités détectés et choisissez quoi faire pour chacun :",
+      "headerPolicy": "Politique",
+      "headerEffect": "Effet",
+      "headerWhen": "Quand choisir",
+      "keepPolicy": "Conserver la configuration, désactiver le démarrage automatique",
+      "keepEffect": "<code>pct set CTID -onboot 0</code> ou <code>qm set VMID -onboot 0</code>. Les entrées GPU sont conservées.",
+      "keepWhen": "Si vous comptez réutiliser l’invité après retour au mode GPU initial. Choix prudent par défaut.",
+      "removePolicy": "Supprimer GPU de la configuration",
+      "removeEffect": "Retire les entrées <code>hostpci</code> / <code>dev</code> identifiées et les références anciennes prises en charge.",
+      "removeWhen": "Pour utiliser l’invité sans GPU. Vérifiez d’abord l’application : le repli sur CPU dépend d’elle, et retirer le périphérique ne la reconfigure pas automatiquement.",
+      "imageAlt": "Dialogue de choix pour chaque VM ou LXC concerné"
+    },
+    "audio": {
+      "title": "Retirer les affectations audio associées en quittant le mode VM",
+      "body1": "De nombreux GPU NVIDIA / AMD proposent l’audio HDMI sur la fonction <code>.1</code> du même emplacement ; d’autres périphériques audio peuvent être attribués. Retirer le GPU peut laisser des entrées audio <code>hostpci</code> obsolètes. Vérifiez les affectations à conserver.",
+      "body2": "Identifie les adresses BDF audio et propose une liste des affectations à retirer. Supprime aussi leurs identifiants vendor:device de <code>/etc/modprobe.d/vfio.conf</code>, uniquement si aucune autre VM ne les utilise."
+    },
+    "apply": {
+      "title": "Appliquer les changements à l’hôte et aux invités",
+      "body": "Une fois que vous confirmez, le script écrit les modifications côté hôte — <code>vfio.conf</code>, liste noire, modules, et (pour NVIDIA) la règle par BDF udev à <code>/etc/udev/rules.d/10-proxmenux-vfio-bind.rules</code> plus l'état BDF à <code>/etc/proxmenux/vfio-bind.bdfs</code>. Elle applique également la politique de conflit choisie à chaque VM/LXC. Si la configuration de l'hôte a réellement changé, il exécute <code>update-initramfs -u -k all</code> suivi de <code>proxmox-boot-tool refresh</code>; sinon, les deux sont ignorés."
+    },
+    "reboot": {
+      "title": "Redémarrer",
+      "body": "Redémarrez l’hôte pour appliquer la nouvelle affectation persistante. Vous pouvez différer le redémarrage, mais vérifiez le pilote actif avant de lancer l’invité cible : l’ancien peut rester actif jusque-là.",
+      "imageAlt": "Boîte de dialogue résumé listant ce qui a changé, suivie de l'invite de redémarrage"
+    }
+  },
+  "manual": {
+    "heading": "Inspection manuelle",
+    "intro": "Avant <strong>VM → LXC</strong>, examinez le pilote et la politique BDF. Cet exemple NVIDIA utilise <code>10de:2204</code> ; adaptez-le à votre carte. Ces commandes consultent l’état ; le script gère aussi les invités et les membres du groupe IOMMU.",
+    "lxcToVm": "Avant <strong>LXC → VM</strong>, examinez l’adresse PCI et son groupe IOMMU. Remplacez l’adresse d’exemple et vérifiez tous les membres avant attribution.",
+    "oneVmTitle": "Un GPU physique attribué par VFIO ne peut servir qu’à une VM à la fois",
+    "oneVmBody": "Mettre plusieurs entrées <code>hostpci</code> avec la même fente PCI dans deux VMs est valide config, mais seulement une des VMs peut commencer avec le GPU — la seconde échouera. La politique de conflit ProxMenux vise précisément à éviter ce piège."
+  },
+  "verification": {
+    "heading": "Vérification après redémarrage"
+  },
+  "troubleshoot": {
+    "heading": "Dépannage",
+    "stillVfioTitle": "GPU affiche toujours vfio-pci après le passage au mode LXC",
+    "stillVfioBody": "Un module VFIO chargé ne prouve pas quel pilote utilise ce GPU. Vérifiez l’affectation, l’exécution de <code>update-initramfs</code> et le redémarrage. <code>lsmod | grep vfio</code> liste seulement les modules. Pour AMD / Intel, inspectez <code>vfio.conf</code> ; pour NVIDIA, <code>/etc/proxmenux/vfio-bind.bdfs</code> et <code>/etc/udev/rules.d/10-proxmenux-vfio-bind.rules</code>. Corrigez les règles avant <code>update-initramfs -u -k all</code> et redémarrage.",
+    "vmFailTitle": "Une VM ne démarre plus après passage du GPU en mode LXC",
+    "vmFailBody": "Vérifiez les références <code>hostpci</code> obsolètes. Le choix <em>Retirer le GPU de la configuration</em> peut les supprimer pendant le changement prévu. Avant de relancer le script, vérifiez le sens proposé pour ne pas inverser le mode par erreur. Sinon, retirez l’affectation dans Proxmox, VM arrêtée.",
+    "smiFailTitle": "nvidia-smi affiche « Driver/library version mismatch » après retour à LXC",
+    "smiFailBody": "Comparez le module NVIDIA chargé aux bibliothèques installées, y compris dans les LXC. Alignez les versions : redémarrer charge le module installé sans corriger des paquets incompatibles. Recharger via <code>modprobe -r nvidia</code> puis <code>modprobe nvidia</code> nécessite l’arrêt des clients GPU et peut échouer si des modules dépendants sont utilisés.",
+    "logTitle": "Journal d’exécution",
+    "logBody": "Chaque exécution écrit dans <code>/tmp/proxmenux_gpu_switch_mode.log</code> sur l’hôte. Joignez le journal à votre demande d’aide GitHub."
+  },
+  "related": {
+    "heading": "Voir aussi",
+    "items": [
+      {
+        "label": "Ajouter GPU à VM (Passthrough)",
+        "href": "/docs/hardware/gpu-vm-passthrough",
+        "tail": " — configuration initiale du mode VM."
+      },
+      {
+        "label": "Ajouter un GPU à LXC",
+        "href": "/docs/hardware/igpu-acceleration-lxc",
+        "tail": " — configuration initiale du mode LXC."
+      },
+      {
+        "label": "Installer les pilotes NVIDIA (host)",
+        "href": "/docs/hardware/nvidia-host",
+        "tail": " — requis pour le mode LXC avec les GPU NVIDIA."
+      },
+      {
+        "label": "ProxMenux Monitor — Onglet matériel",
+        "href": "/docs/monitor/dashboard/hardware",
+        "tail": " — section Cartes graphiques, avec le mode actuel et la commande de changement."
+      },
+      {
+        "label": "Commandes de passthrough GPU",
+        "href": "/docs/help-info/gpu-commands",
+        "tail": " — référence rapide des commandes."
+      }
+    ]
+  }
+}
diff --git a/web/messages/fr/docs/help-info/backup-commands.json b/web/messages/fr/docs/help-info/backup-commands.json
new file mode 100644
index 00000000..a149b4d5
--- /dev/null
+++ b/web/messages/fr/docs/help-info/backup-commands.json
@@ -0,0 +1,235 @@
+{
+  "meta": {
+    "title": "Commandes de sauvegarde Proxmox — vzdump, qmrestore, pct restore | ProxMenux",
+    "description": "Référence des commandes de sauvegarde et de restauration Proxmox VE : vzdump pour les VM et les conteneurs LXC, qmrestore pour les VM, pct restore pour les conteneurs, sauvegardes planifiées dans /etc/pve/jobs.cfg, scripts de hook et chemins à exclure.",
+    "ogTitle": "Commandes de sauvegarde Proxmox — vzdump, qmrestore, pct restore",
+    "ogDescription": "Référence des commandes vzdump, qmrestore et pct restore pour sauvegarder et restaurer les VM et conteneurs LXC de Proxmox.",
+    "twitterTitle": "Commandes de sauvegarde Proxmox | ProxMenux",
+    "twitterDescription": "Commandes vzdump, qmrestore et pct restore pour sauvegarder et restaurer les VM et conteneurs Proxmox."
+  },
+  "header": {
+    "title": "Sauvegarde et restauration",
+    "description": "Référence commentée des commandes vzdump, qmrestore et pct restore pour les sauvegardes Proxmox. Comprend la planification, les options avancées comme les hook scripts, les chemins à exclure et la priorité des E/S, ainsi que la gestion des fichiers de sauvegarde.",
+    "section": "Aide et informations"
+  },
+  "intro": {
+    "title": "Trois modes de sauvegarde",
+    "body": "Pour les VM, <strong>snapshot</strong> effectue une sauvegarde à chaud sans nécessiter d’instantanés du stockage. <strong>suspend</strong> suspend la VM auparavant, sans nécessairement améliorer la cohérence. <strong>stop</strong> l’arrête d’abord ; une VM auparavant active peut reprendre après le début de la sauvegarde. Pour LXC, snapshot exige un stockage compatible avec les instantanés, suspend utilise deux passes rsync et stop maintient le conteneur arrêté pendant toute la sauvegarde."
+  },
+  "commandGroups": [
+    {
+      "title": "Sauvegarde VM",
+      "commands": [
+        {
+          "command": "vzdump <vmid>",
+          "description": "Créer une sauvegarde d’une VM ou d’un CT donné"
+        },
+        {
+          "command": "vzdump <vmid> --storage <storage>",
+          "description": "Sauvegarder la VM vers un stockage donné"
+        },
+        {
+          "command": "vzdump <vmid> --mode snapshot",
+          "description": "Créer une sauvegarde instantané (pour les VM)"
+        },
+        {
+          "command": "vzdump <vmid> --mode suspend",
+          "description": "Suspendre la VM avant la sauvegarde à chaud, ancien mode suspend"
+        },
+        {
+          "command": "vzdump <vmid> --mode stop",
+          "description": "Arrêter la VM avant de lancer la sauvegarde"
+        },
+        {
+          "command": "vzdump --all",
+          "description": "Sauvegarder toutes les VM et tous les conteneurs"
+        },
+        {
+          "command": "vzdump --all --exclude <vmid1>,<vmid2>",
+          "description": "Sauvegarde tous sauf les VM spécifiés"
+        }
+      ]
+    },
+    {
+      "title": "Options de sauvegarde",
+      "commands": [
+        {
+          "command": "vzdump <vmid> --compress zstd",
+          "description": "Utiliser la compression zstd pour la sauvegarde"
+        },
+        {
+          "command": "vzdump <vmid> --compress gzip --pigz <threads>",
+          "description": "Utiliser pigz avec plusieurs threads"
+        },
+        {
+          "command": "vzdump <vmid> --storage <storage> --notes-template <text>",
+          "description": "Ajouter des notes à la sauvegarde"
+        },
+        {
+          "command": "vzdump <vmid> --mailto <email>",
+          "description": "Envoyer un courriel de notification"
+        },
+        {
+          "command": "vzdump <vmid> --prune-backups keep-last=<n>",
+          "description": "Conserver seulement n sauvegardes par VM"
+        },
+        {
+          "command": "vzdump <vmid> --stdexcludes 0",
+          "description": "N'excluez pas les fichiers temporaires"
+        },
+        {
+          "command": "vzdump <vmid> --quiet 1",
+          "description": "Suppression des messages de sortie"
+        }
+      ]
+    },
+    {
+      "title": "Restaurer les sauvegardes",
+      "commands": [
+        {
+          "command": "qmrestore <backup-file> <vmid>",
+          "description": "Restaurer VM depuis la sauvegarde"
+        },
+        {
+          "command": "qmrestore <backup-file> <vmid> --storage <storage>",
+          "description": "Restaurer vers un stockage donné"
+        },
+        {
+          "command": "qmrestore <backup-file> <vmid> --unique",
+          "description": "Restaurer la VM avec de nouvelles adresses MAC aléatoires"
+        },
+        {
+          "command": "pct restore <vmid> <backup-file>",
+          "description": "Restaurer le conteneur de la sauvegarde"
+        },
+        {
+          "command": "pct restore <vmid> <backup-file> --storage <storage>",
+          "description": "Restaurer le conteneur vers un stockage donné"
+        },
+        {
+          "command": "pct restore <vmid> <backup-file> --rootfs <storage>:<size-GiB>",
+          "description": "Restaurer avec un disque racine alloué sur le stockage et avec la taille choisis"
+        },
+        {
+          "command": "pct restore <vmid> <backup-file> --unprivileged 1",
+          "description": "Restaurer en tant que CT non privilégié"
+        }
+      ]
+    },
+    {
+      "title": "Gestion des sauvegardes",
+      "commands": [
+        {
+          "command": "ls -la /var/lib/vz/dump/",
+          "description": "Lister les sauvegardes dans l'emplacement par défaut"
+        },
+        {
+          "command": "find /var/lib/vz/dump/ -name \"*.vma*\"",
+          "description": "Trouver des sauvegardes VM"
+        },
+        {
+          "command": "find /var/lib/vz/dump/ -name \"*.tar*\"",
+          "description": "Trouver des sauvegardes de conteneurs"
+        },
+        {
+          "command": "pvesm list <storage> --content backup",
+          "description": "Lister les sauvegardes dans le stockage spécifique"
+        },
+        {
+          "command": "rm /var/lib/vz/dump/<backup-file>",
+          "description": "Supprimer un fichier de sauvegarde"
+        },
+        {
+          "command": "cat /etc/vzdump.conf",
+          "description": "Afficher la configuration de sauvegarde"
+        }
+      ]
+    },
+    {
+      "title": "Sauvegardes programmées",
+      "commands": [
+        {
+          "command": "cat /etc/pve/jobs.cfg",
+          "description": "Afficher le calendrier de sauvegarde"
+        },
+        {
+          "command": "nano /etc/vzdump.conf",
+          "description": "Modifier la configuration de sauvegarde"
+        },
+        {
+          "command": "systemctl list-timers",
+          "description": "Lister les minuteurs systemd"
+        },
+        {
+          "command": "systemctl status cron",
+          "description": "Vérifier l'état du service cron"
+        },
+        {
+          "command": "pvenode task list --typefilter vzdump",
+          "description": "Lister les tâches de sauvegarde terminées"
+        },
+        {
+          "command": "pvenode task log <upid>",
+          "description": "Afficher le journal d’une tâche de sauvegarde à partir de son UPID"
+        }
+      ]
+    },
+    {
+      "title": "Opérations avancées",
+      "commands": [
+        {
+          "command": "qmrestore <backup> <vmid> --force",
+          "description": "Forcer la restauration en écrasant la VM existante"
+        },
+        {
+          "command": "vzdump <vmid> --dumpdir <directory>",
+          "description": "Spécifier le répertoire de sauvegarde personnalisé"
+        },
+        {
+          "command": "vzdump <vmid> --script <script>",
+          "description": "Exécuter un script de hook pendant la sauvegarde"
+        },
+        {
+          "command": "vzdump <vmid> --exclude-path <path>",
+          "description": "Exclure les chemins spécifiques de la sauvegarde"
+        },
+        {
+          "command": "vzdump <vmid> --ionice <priority>",
+          "description": "Définir la priorité E/S pour le processus de sauvegarde"
+        },
+        {
+          "command": "vzdump <vmid> --lockwait <minutes>",
+          "description": "Attendez le verrou"
+        },
+        {
+          "command": "qm importdisk <vmid> <disk-image> <storage>",
+          "description": "Importer un fichier image disque (par exemple raw, qcow2 ou vmdk) comme disque inutilisé, pas une archive de sauvegarde vzdump"
+        }
+      ]
+    }
+  ],
+  "testRestores": {
+    "title": "Testez vos restaurations",
+    "bodyRich": "Restaurez régulièrement une sauvegarde vers un VMID de test libre avec <code>qmrestore --unique</code>, démarrez la VM dans un réseau de test isolé et vérifiez son contenu. L’option unique génère de nouvelles adresses MAC ; elle ne change ni les IP statiques ni les paramètres des applications. Testez les conteneurs de même avec <code>pct restore</code>."
+  },
+  "related": {
+    "heading": "Rubriques connexes",
+    "items": [
+      {
+        "href": "/docs/help-info/vm-ct-commands",
+        "label": "Gestion VM et CT",
+        "tail": "— commandes du cycle de vie qm et pct."
+      },
+      {
+        "href": "/docs/help-info/storage-commands",
+        "label": "Stockage et disques",
+        "tail": "— gestion du stockage pvesm."
+      },
+      {
+        "href": "/docs/help-info",
+        "label": "Vue d’ensemble de l’aide et des informations",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/fr/docs/help-info/gpu-commands.json b/web/messages/fr/docs/help-info/gpu-commands.json
new file mode 100644
index 00000000..1f93dd43
--- /dev/null
+++ b/web/messages/fr/docs/help-info/gpu-commands.json
@@ -0,0 +1,162 @@
+{
+  "meta": {
+    "title": "Commandes de passthrough GPU dans Proxmox — lspci, VFIO, IOMMU, qm set hostpci | ProxMenux",
+    "description": "Référence du passthrough GPU sur Proxmox VE : identification des périphériques avec lspci, modules VFIO, groupes IOMMU (intel_iommu / amd_iommu), mises à jour GRUB et initramfs, qm set hostpci0 et configuration NVIDIA / AMD / Intel.",
+    "ogTitle": "Commandes de passthrough GPU dans Proxmox — lspci, VFIO, IOMMU, qm set hostpci",
+    "ogDescription": "Référence pour inspecter et configurer le passthrough GPU dans Proxmox VE : périphériques PCI, modules VFIO, groupes IOMMU, paramètres de démarrage du noyau et qm set hostpci.",
+    "twitterTitle": "Commandes de passthrough GPU dans Proxmox | ProxMenux",
+    "twitterDescription": "Inspectez les périphériques PCI, configurez VFIO et IOMMU et attachez des GPU aux VM sur Proxmox VE."
+  },
+  "header": {
+    "title": "Passthrough GPU",
+    "description": "Référence pour l'inspection et la configuration de GPU / TPU passthrough sur Proxmox: identification du périphérique (lspci), configuration du module VFIO, validation IOMMU, mises à jour initramfs / GRUB et config passthrough par VM (qm set hostpci, machine q35, bios ovmf).",
+    "section": "Aide et informations"
+  },
+  "intro": {
+    "title": "IOMMU doit être activé en BIOS / UEFI",
+    "body": "Activez d’abord IOMMU dans le firmware : cherchez <em>VT-d</em>, <em>AMD-Vi</em> ou <em>IOMMU</em> dans le BIOS/UEFI. Sous Linux, il est activé par défaut sur AMD et sur Intel avec les noyaux Proxmox 6.8 et ultérieurs. Les anciens noyaux Intel peuvent nécessiter <code>intel_iommu=on</code>. L’option <code>iommu=pt</code> contrôle le mode passthrough d’IOMMU ; elle ne justifie pas de désactiver systématiquement le framebuffer de l’hôte."
+  },
+  "commandGroups": [
+    {
+      "title": "Identification du périphérique",
+      "commands": [
+        {
+          "command": "lspci -nn | grep -i nvidia",
+          "description": "Liste des périphériques NVIDIA PCI"
+        },
+        {
+          "command": "lspci -nn | grep -i vga",
+          "description": "Lister tous les appareils compatibles VGA"
+        },
+        {
+          "command": "lspci -nn | grep -i amd",
+          "description": "Liste des périphériques AMD PCI"
+        },
+        {
+          "command": "lspci -nnk | grep -A3 VGA",
+          "description": "Lister les périphériques VGA avec les pilotes du noyau"
+        },
+        {
+          "command": "lspci -v -s <PCI_ID>",
+          "description": "Afficher les informations détaillées pour un appareil PCI spécifique"
+        }
+      ]
+    },
+    {
+      "title": "Configuration VFIO",
+      "commands": [
+        {
+          "command": "dmesg | grep -i vfio",
+          "description": "Vérifiez les messages du module VFIO"
+        },
+        {
+          "command": "cat /etc/modprobe.d/vfio.conf",
+          "description": "Consultez la configuration de passage VFIO"
+        },
+        {
+          "command": "ls -la /etc/modprobe.d/",
+          "description": "Liste tous les fichiers de configuration modprobe"
+        },
+        {
+          "command": "cat /etc/modules",
+          "description": "Afficher les modules chargés au démarrage"
+        },
+        {
+          "command": "lsmod | grep vfio",
+          "description": "Vérifier si les modules VFIO sont chargés"
+        }
+      ]
+    },
+    {
+      "title": "Configuration IOMMU",
+      "commands": [
+        {
+          "command": "cat /etc/default/grub",
+          "description": "Vérifier les options GRUB pour IOMMU"
+        },
+        {
+          "command": "update-grub",
+          "description": "Appliquer les modifications GRUB"
+        },
+        {
+          "command": "dmesg | grep -i iommu",
+          "description": "Vérifiez les messages IOMMU dans le journal du noyau"
+        },
+        {
+          "command": "dmesg | grep -e DMAR -e IOMMU",
+          "description": "Vérifier les messages DMAR et IOMMU"
+        },
+        {
+          "command": "find /sys/kernel/iommu_groups/ -type l | sort -V",
+          "description": "Liste des groupes IOMMU"
+        }
+      ]
+    },
+    {
+      "title": "Mises à jour du système",
+      "commands": [
+        {
+          "command": "update-initramfs -u",
+          "description": "Appliquer les modifications d'initramfs (VFIO)"
+        },
+        {
+          "command": "update-initramfs -u -k all",
+          "description": "Mettre à jour initramfs pour tous les noyaux"
+        },
+        {
+          "command": "cat /proc/cmdline",
+          "description": "Afficher les paramètres actuels de démarrage du noyau"
+        }
+      ]
+    },
+    {
+      "title": "Configuration VM",
+      "commands": [
+        {
+          "command": "qm config <vmid> | grep hostpci",
+          "description": "Afficher la configuration de passthrough PCI d’une VM"
+        },
+        {
+          "command": "qm set <vmid> -hostpci0 <PCI_ID>,pcie=1,x-vga=1",
+          "description": "Ajouter un passthrough GPU à une VM"
+        },
+        {
+          "command": "cat /etc/pve/qemu-server/<vmid>.conf",
+          "description": "Afficher le fichier de configuration VM"
+        },
+        {
+          "command": "qm set <vmid> -machine q35",
+          "description": "Définissez VM pour utiliser le jeu de puces Q35 (recommandé pour passer)"
+        },
+        {
+          "command": "qm set <vmid> -bios ovmf",
+          "description": "Configurer la VM en UEFI/OVMF, recommandé si la ROM du GPU prend en charge UEFI"
+        }
+      ]
+    }
+  ],
+  "afterChangesTip": {
+    "title": "Après modification des configurations GRUB ou modprobe",
+    "bodyRich": "Sur les hôtes utilisant GRUB, appliquez les paramètres de démarrage avec <code>update-grub</code>. Actualisez les modules avec <code>update-initramfs -u -k all</code>, puis redémarrez. Les autres chargeurs d’amorçage ont leur propre procédure. Vérifiez <code>cat /proc/cmdline</code> (paramètres du noyau), <code>dmesg | grep -i iommu</code> (IOMMU initialisé) et <code>find /sys/kernel/iommu_groups/ -type l | sort -V</code> (groupes présents)."
+  },
+  "related": {
+    "heading": "Rubriques connexes",
+    "items": [
+      {
+        "href": "/docs/hardware/gpu-vm-passthrough",
+        "label": "Ajouter GPU à VM (Passthrough)",
+        "tail": "— flux interactif ProxMenux."
+      },
+      {
+        "href": "/docs/hardware/igpu-acceleration-lxc",
+        "label": "Ajouter un GPU à LXC",
+        "tail": " — partager l’accès aux périphériques GPU de l’hôte avec un conteneur LXC."
+      },
+      {
+        "href": "/docs/help-info",
+        "label": "Vue d’ensemble de l’aide et des informations",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/fr/docs/help-info/index.json b/web/messages/fr/docs/help-info/index.json
new file mode 100644
index 00000000..068fe2fe
--- /dev/null
+++ b/web/messages/fr/docs/help-info/index.json
@@ -0,0 +1,87 @@
+{
+  "meta": {
+    "title": "Référence des commandes Proxmox — qm, pct, vzdump, zpool, pveversion | ProxMenux",
+    "description": "Sélection de commandes essentielles de Proxmox VE et Linux, classées par thème : inspection du système, gestion des VM et LXC (qm / pct), stockage et disques, réseau, mises à jour, passthrough GPU, ZFS, sauvegarde et restauration, et outils de terminal au quotidien.",
+    "ogTitle": "Référence des commandes Proxmox — qm, pct, vzdump, zpool",
+    "ogDescription": "Sélection de commandes utiles de Proxmox VE et Linux par thème : système, VM/CT, stockage, réseau, mises à jour, passthrough GPU, ZFS, sauvegarde et outils CLI.",
+    "twitterTitle": "Référence des commandes Proxmox | ProxMenux",
+    "twitterDescription": "Sélection de commandes utiles de Proxmox VE et Linux, regroupées par thème."
+  },
+  "header": {
+    "title": "Aide et informations",
+    "description": "Sélection de commandes utiles de Linux et Proxmox VE par thème. Les neuf catégories vont d’une simple vérification avec pveversion à une séquence multiligne de zfs send/receive. Cette référence complète les sections GPU, disques et partages de ProxMenux.",
+    "section": "Aide et informations"
+  },
+  "intro": {
+    "title": "Ce que c'est",
+    "body": "Un catalogue des commandes utilisées au quotidien sur un hôte Proxmox, regroupées par thème. Dans ProxMenux, choisissez un numéro pour exécuter directement une commande ou collez la vôtre à l’invite. Sur ce site, chaque catégorie est présentée dans un tableau prêt à copier."
+  },
+  "opening": {
+    "heading": "Ouverture du menu",
+    "body": "À partir du menu principal de ProxMenux, appuyez sur <kbd>h</kbd>. Vous verrez ceci :",
+    "imageAlt": "Menu Aide et informations avec neuf catégories de commandes"
+  },
+  "categories": {
+    "heading": "Les neuf catégories",
+    "options": [
+      {
+        "icon": "Terminal",
+        "href": "/docs/help-info/system-commands",
+        "title": "Commandes système utiles",
+        "description": "pveversion, uptime, free, journalctl, hostnamectl, informations sur l’utilisateur courant, audit lynis et fastfetch."
+      },
+      {
+        "icon": "Cpu",
+        "href": "/docs/help-info/vm-ct-commands",
+        "title": "Gestion VM et CT",
+        "description": "qm list / config / start / stop / migrate, pct list / config / enter, instantanés et clonage."
+      },
+      {
+        "icon": "HardDrive",
+        "href": "/docs/help-info/storage-commands",
+        "title": "Stockage et disques",
+        "description": "lsblk, blkid, smartctl, informations sur les montages, pvesm status et commandes LVM."
+      },
+      {
+        "icon": "Network",
+        "href": "/docs/help-info/network-commands",
+        "title": "Commandes réseau",
+        "description": "ip / ss / nmcli, inspection des ponts réseau, ping / traceroute, requêtes DNS et fail2ban-client."
+      },
+      {
+        "icon": "Package",
+        "href": "/docs/help-info/update-commands",
+        "title": "Mises à jour et paquets",
+        "description": "apt update / dist-upgrade, apt-cache policy, requêtes dpkg et vérification des fichiers de dépôts."
+      },
+      {
+        "icon": "Cpu",
+        "href": "/docs/help-info/gpu-commands",
+        "title": "Passthrough GPU",
+        "description": "Vérifications avec lspci / dmesg, contrôle de l’activation d’IOMMU, liaison à vfio-pci et utilisation du GPU depuis l’hôte."
+      },
+      {
+        "icon": "Database",
+        "href": "/docs/help-info/zfs-commands",
+        "title": "Gestion ZFS",
+        "description": "Commandes zpool / zfs pour l’état, les datasets, les instantanés, send/receive, le réglage d’ARC et TRIM."
+      },
+      {
+        "icon": "Archive",
+        "href": "/docs/help-info/backup-commands",
+        "title": "Sauvegarde et restauration",
+        "description": "vzdump, qmrestore / pct restore, outils pour Proxmox Backup Server et opérations sur les instantanés."
+      },
+      {
+        "icon": "Wrench",
+        "href": "/docs/help-info/tools-commands",
+        "title": "Outils CLI système",
+        "description": "tmux, screen, htop / btop, ncdu, jq, dig, lsof, watch — outils d’administration au quotidien."
+      }
+    ]
+  },
+  "tip": {
+    "title": "Recherche à partir de la recherche globale",
+    "body": "Toutes les commandes de ces pages sont indexées par la recherche de la documentation. Si vous vous souvenez d’une option ou d’un fragment, mais pas de la page, utilisez la barre de recherche en haut pour retrouver directement la bonne entrée."
+  }
+}
diff --git a/web/messages/fr/docs/help-info/network-commands.json b/web/messages/fr/docs/help-info/network-commands.json
new file mode 100644
index 00000000..cd3999fa
--- /dev/null
+++ b/web/messages/fr/docs/help-info/network-commands.json
@@ -0,0 +1,174 @@
+{
+  "meta": {
+    "title": "Commandes réseau Proxmox — ip, ping, ss, pve-firewall, iptables | ProxMenux",
+    "description": "Référence des commandes réseau de l’hôte Proxmox VE : ip / ip link / ip addr, ping, traceroute, mtr, ss, ethtool, dig, nslookup, ainsi que pve-firewall, iptables et nftables pour le filtrage. Inspection des ponts, des agrégations de liens et des VLAN.",
+    "ogTitle": "Commandes réseau Proxmox — ip, ping, ss, pve-firewall, iptables",
+    "ogDescription": "Commandes réseau pour Proxmox VE : inspection des interfaces, tests de connectivité, surveillance, pare-feu (pve-firewall, iptables, nftables) et requêtes DNS.",
+    "twitterTitle": "Commandes réseau Proxmox | ProxMenux",
+    "twitterDescription": "Commandes d'inspection, de test, de configuration et de pare-feu réseau pour Proxmox VE."
+  },
+  "header": {
+    "title": "Commandes réseau",
+    "description": "Sélection de commandes réseau pour l’hôte Proxmox : informations sur les interfaces, tests de connectivité, configuration, surveillance du trafic et gestion du pare-feu. Inclut ip / ss / nmcli / ethtool / tcpdump / pve-firewall.",
+    "section": "Aide et informations"
+  },
+  "intro": {
+    "title": "Inventaire rapide des interfaces",
+    "body": "<code>ip a</code> affiche chaque interface avec ses IP et MAC. <code>ip r</code> affiche la table de routage. Ensemble, ils répondent à la plupart des questions « cette interface est-elle configurée correctement ? » en quelques secondes."
+  },
+  "commandGroups": [
+    {
+      "title": "Information réseau",
+      "commands": [
+        {
+          "command": "ip a",
+          "description": "Afficher les interfaces réseau et les adresses IP"
+        },
+        {
+          "command": "ip r",
+          "description": "Afficher la table de routage"
+        },
+        {
+          "command": "ip -s link",
+          "description": "Afficher les statistiques de trafic par interface"
+        },
+        {
+          "command": "brctl show",
+          "description": "Afficher les ponts réseau configurés"
+        },
+        {
+          "command": "cat /etc/network/interfaces",
+          "description": "Afficher la configuration réseau brute"
+        }
+      ]
+    },
+    {
+      "title": "Essais en réseau",
+      "commands": [
+        {
+          "command": "ping <host>",
+          "description": "Vérifiez la connectivité avec un autre hôte"
+        },
+        {
+          "command": "traceroute <host>",
+          "description": "Tracer la route vers un hôte"
+        },
+        {
+          "command": "mtr <host>",
+          "description": "Combiner ping et traceroute en temps réel"
+        },
+        {
+          "command": "dig <domain>",
+          "description": "Recherche DNS pour un domaine"
+        },
+        {
+          "command": "nslookup <domain>",
+          "description": "Autre recherche DNS"
+        }
+      ]
+    },
+    {
+      "title": "Configuration réseau",
+      "commands": [
+        {
+          "command": "ifreload -a",
+          "description": "Recharger la configuration réseau (ifupdown2)"
+        },
+        {
+          "command": "ethtool <iface>",
+          "description": "Afficher les informations sur le périphérique Ethernet"
+        },
+        {
+          "command": "resolvectl status",
+          "description": "Afficher l'état de la résolution DNS"
+        },
+        {
+          "command": "nmcli device show",
+          "description": "Afficher les détails du périphérique réseau (si NetworkManager est utilisé)"
+        },
+        {
+          "command": "ip link set <iface> up",
+          "description": "Activer une interface réseau"
+        },
+        {
+          "command": "ip link set <iface> down",
+          "description": "Désactiver une interface réseau"
+        }
+      ]
+    },
+    {
+      "title": "Surveillance des réseaux",
+      "commands": [
+        {
+          "command": "ss -tuln",
+          "description": "Afficher les ports d'écoute (TCP/UDP)"
+        },
+        {
+          "command": "netstat -tuln",
+          "description": "Autre commande pour afficher les ports en écoute"
+        },
+        {
+          "command": "lsof -i",
+          "description": "Liste des fichiers et connexions réseau ouverts"
+        },
+        {
+          "command": "tcpdump -i <iface>",
+          "description": "Capturer les paquets sur l'interface"
+        },
+        {
+          "command": "iftop -i <iface>",
+          "description": "Surveiller l'utilisation de la bande passante sur l'interface"
+        }
+      ]
+    },
+    {
+      "title": "Gestion du pare-feu",
+      "commands": [
+        {
+          "command": "iptables -L -n -v",
+          "description": "Afficher les règles de pare-feu actives (iptables)"
+        },
+        {
+          "command": "nft list ruleset",
+          "description": "Afficher les règles nftables"
+        },
+        {
+          "command": "pve-firewall status",
+          "description": "Vérifier l'état du pare-feu Proxmox"
+        },
+        {
+          "command": "pve-firewall compile",
+          "description": "Compiler les règles de pare-feu pour tous les nœuds"
+        },
+        {
+          "command": "pve-firewall reload",
+          "description": "Recharger les règles du pare-feu Proxmox"
+        }
+      ]
+    }
+  ],
+  "iptablesTip": {
+    "title": "iptables vs nftables",
+    "bodyRich": "Le service classique <code>pve-firewall</code> génère des règles iptables. Le service alternatif proxmox-firewall utilise <strong>nftables</strong>. Inspectez le moteur iptables avec <code>iptables -L -n -v</code> et le moteur nftables avec <code>nft list ruleset</code>. Utilisez les outils du moteur activé : ces listes ne sont pas interchangeables."
+  },
+  "related": {
+    "heading": "Rubriques connexes",
+    "items": [
+      {
+        "href": "/docs/network",
+        "label": "Gestion du réseau",
+        "tail": "— outils de réseau interactifs ProxMenux (analyse des ponts, noms persistants, surveillance)."
+      },
+      {
+        "href": "/docs/help-info/tools-commands",
+        "label": "Outils CLI système",
+        "tail": "— davantage d'outils de surveillance des réseaux."
+      },
+      {
+        "href": "/docs/help-info",
+        "label": "Vue d’ensemble de l’aide et des informations",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/fr/docs/help-info/storage-commands.json b/web/messages/fr/docs/help-info/storage-commands.json
new file mode 100644
index 00000000..9b46c835
--- /dev/null
+++ b/web/messages/fr/docs/help-info/storage-commands.json
@@ -0,0 +1,232 @@
+{
+  "meta": {
+    "title": "Commandes de stockage et de disques Proxmox — lsblk, LVM, pvesm, qm importdisk | ProxMenux",
+    "description": "Référence des commandes de stockage et de disque sous Proxmox VE : lsblk, blkid, parted, lvdisplay, vgdisplay, pvs, mount, df, du, ncdu et pvesm status, ainsi que qm importdisk et qemu-img convert pour les disques de VM.",
+    "ogTitle": "Commandes de stockage et de disques Proxmox — lsblk, LVM, pvesm, qm importdisk",
+    "ogDescription": "Référence des commandes de stockage et de disque sur Proxmox VE — inspection du disque, LVM, montages, gestion du stockage Proxmox, importation de disque VM et conversion d'image.",
+    "twitterTitle": "Commandes de stockage Proxmox | ProxMenux",
+    "twitterDescription": "Inspection de disque, informations de montage, gestion LVM, stockage Proxmox et commandes d'importation / conversion de disque VM."
+  },
+  "header": {
+    "title": "Stockage et disques",
+    "description": "Sélection de commandes pour inspecter le stockage des hôtes Proxmox : périphériques blocs, partitions, montages, volumes LVM, configuration du stockage et opérations sur les disques VM (importdisk, qemu-img convert).",
+    "section": "Aide et informations"
+  },
+  "intro": {
+    "title": "Inventaire rapide du disque",
+    "body": "<code>lsblk</code> affiche les périphériques blocs et leurs partitions en arborescence. Consultez leurs identifiants persistants avec <code>ls -lh /dev/disk/by-id/</code> : pour un même disque, ils restent généralement stables après un redémarrage ou un changement d’ordre des périphériques. Remplacer le disque ou modifier la façon dont le contrôleur expose son identité peut changer le chemin by-id."
+  },
+  "commandGroups": [
+    {
+      "title": "Informations sur le disque",
+      "commands": [
+        {
+          "command": "lsblk",
+          "description": "Lister les périphériques blocs et les partitions"
+        },
+        {
+          "command": "fdisk -l",
+          "description": "Répertorier les disques avec des informations détaillées"
+        },
+        {
+          "command": "blkid",
+          "description": "Afficher l'UUID et le type de système de fichiers des périphériques de bloc"
+        },
+        {
+          "command": "ls -lh /dev/disk/by-id/",
+          "description": "Répertorier les identifiants persistants du disque"
+        },
+        {
+          "command": "parted -l",
+          "description": "Disposition détaillée des partitions avec informations GPT"
+        }
+      ]
+    },
+    {
+      "title": "Utilisation du stockage",
+      "commands": [
+        {
+          "command": "df -h",
+          "description": "Afficher l'utilisation du disque par point de montage"
+        },
+        {
+          "command": "du -sh /path",
+          "description": "Afficher la taille d'un répertoire"
+        },
+        {
+          "command": "mount | grep ^/dev",
+          "description": "Afficher les périphériques de stockage montés"
+        },
+        {
+          "command": "cat /proc/mounts",
+          "description": "Afficher tous les montages actifs du noyau"
+        }
+      ]
+    },
+    {
+      "title": "Gestion de LVM",
+      "commands": [
+        {
+          "command": "pvdisplay",
+          "description": "Afficher les volumes physiques (LVM)"
+        },
+        {
+          "command": "vgdisplay",
+          "description": "Afficher les groupes de volumes (LVM)"
+        },
+        {
+          "command": "lvdisplay",
+          "description": "Afficher les volumes logiques (LVM)"
+        },
+        {
+          "command": "pvs",
+          "description": "Sortie concise des volumes physiques"
+        },
+        {
+          "command": "vgs",
+          "description": "Sortie concise des groupes de volumes"
+        },
+        {
+          "command": "lvs",
+          "description": "Sortie concise des volumes logiques"
+        }
+      ]
+    },
+    {
+      "title": "Stockage Proxmox",
+      "commands": [
+        {
+          "command": "cat /etc/pve/storage.cfg",
+          "description": "Afficher la configuration du stockage Proxmox"
+        },
+        {
+          "command": "pvesm status",
+          "description": "Afficher l'état de tous les pools de stockage"
+        },
+        {
+          "command": "pvesm status --enabled 1",
+          "description": "Lister les stockages configurés et activés"
+        },
+        {
+          "command": "pvesm list <storage>",
+          "description": "Répertorier le contenu d'un stockage spécifique"
+        },
+        {
+          "command": "pvesm scan nfs <server>",
+          "description": "Découvrir les exports NFS d’un serveur"
+        }
+      ]
+    },
+    {
+      "title": "Actions du disque",
+      "commands": [
+        {
+          "command": "qm importdisk <vmid> <image_path> <storage>",
+          "description": "Importer l’image comme disque inutilisé de la VM, puis l’attacher séparément"
+        },
+        {
+          "command": "qm set <vmid> -<bus><index> <disk_path>",
+          "description": "Attribuer le disque physique au VM (mode passant)"
+        },
+        {
+          "command": "qemu-img convert -O <format> <input> <output>",
+          "description": "Convertir le format d’une image disque hors ligne"
+        }
+      ]
+    },
+    {
+      "title": "Santé des disques SMART",
+      "commands": [
+        {
+          "command": "smartctl --scan",
+          "description": "Liste des périphériques compatibles SMART sur l'hôte"
+        },
+        {
+          "command": "smartctl -i /dev/<disk>",
+          "description": "Informations de base sur l'appareil (modèle, firmware, série)"
+        },
+        {
+          "command": "smartctl -H /dev/<disk>",
+          "description": "Vérification rapide de l’état général : PASSED / FAILED"
+        },
+        {
+          "command": "smartctl -A /dev/<disk>",
+          "description": "Attributs SMART uniquement (valeurs brutes, seuils)"
+        },
+        {
+          "command": "smartctl -a /dev/<disk>",
+          "description": "Informations SMART complètes : appareil, attributs et journal des autotests"
+        },
+        {
+          "command": "smartctl -t short /dev/<disk>",
+          "description": "Lancer un autotest court, environ deux minutes en arrière-plan"
+        },
+        {
+          "command": "smartctl -t long /dev/<disk>",
+          "description": "Lancer un autotest long, plusieurs heures en arrière-plan"
+        },
+        {
+          "command": "smartctl -l selftest /dev/<disk>",
+          "description": "Voir le journal d'auto-essai (résultats des tests passés)"
+        },
+        {
+          "command": "smartctl -X /dev/<disk>",
+          "description": "Interrompre l’autotest en cours"
+        }
+      ]
+    },
+    {
+      "title": "Santé des disques NVMe",
+      "commands": [
+        {
+          "command": "nvme list",
+          "description": "Liste des dispositifs NVMe visibles au noyau"
+        },
+        {
+          "command": "nvme smart-log /dev/<nvme>",
+          "description": "NVMe-spécifique SMART log (température, usure, erreurs)"
+        },
+        {
+          "command": "nvme id-ctrl /dev/<nvme>",
+          "description": "Informations de contrôleur (modèle, firmware, capacités)"
+        },
+        {
+          "command": "nvme error-log /dev/<nvme>",
+          "description": "Entrées récentes du journal des erreurs NVMe"
+        }
+      ]
+    }
+  ],
+  "lvmTip": {
+    "title": "LVM commandes courtes vs longues",
+    "bodyRich": "Les deux formes sont disponibles. <code>pvs</code> / <code>vgs</code> / <code>lvs</code> produisent des tableaux compacts avec une ligne par volume physique, groupe de volumes ou volume logique, respectivement. <code>pvdisplay</code> / <code>vgdisplay</code> / <code>lvdisplay</code> fournissent davantage de détails sur plusieurs lignes. Les formes courtes sont pratiques au quotidien."
+  },
+  "smartInfo": {
+    "title": "SMART pour SATA/SAS et NVMe",
+    "bodyRich": "<strong>Les disques SATA / SAS, y compris les SSD,</strong> peuvent être inspectés avec <code>smartctl</code> de <code>smartmontools</code>, installé par défaut sur Proxmox. Indiquez le périphérique, par exemple <code>/dev/sda</code> ou <code>/dev/sdb</code>. <strong>Les disques NVMe</strong> utilisent un autre protocole natif. <code>smartctl</code> les prend aussi en charge ; <code>nvme</code> de <code>nvme-cli</code> fournit des requêtes propres aux contrôleurs, espaces de noms et informations de santé NVMe. Installez-le avec <code>apt install nvme-cli</code> s’il manque."
+  },
+  "selfTestWarn": {
+    "title": "Les auto-tests se déroulent en arrière-plan",
+    "bodyRich": "Sur les disques compatibles, <code>smartctl -t short /dev/&lt;disk&gt;</code> et <code>smartctl -t long /dev/&lt;disk&gt;</code> lancent des tests en arrière-plan et rendent immédiatement la main. Vérifiez la progression avec <code>smartctl -a /dev/&lt;disk&gt;</code>, en cherchant \"Self-test routine in progress\", ou attendez et lisez <code>smartctl -l selftest /dev/&lt;disk&gt;</code>. Les tests courts durent souvent deux minutes, les longs peuvent prendre des heures. Le disque reste utilisable, avec une baisse possible des performances d’E/S."
+  },
+  "related": {
+    "heading": "Rubriques connexes",
+    "items": [
+      {
+        "href": "/docs/help-info/zfs-commands",
+        "label": "Gestion ZFS",
+        "tail": "— commandes zpool / zfs pour le stockage soutenu par ZFS."
+      },
+      {
+        "href": "/docs/disk-manager",
+        "label": "Gestionnaire de disque",
+        "tail": "— flux interactifs ProxMenux pour la transmission du disque, l'importation, le formatage, SMART."
+      },
+      {
+        "href": "/docs/help-info",
+        "label": "Vue d’ensemble de l’aide et des informations",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/fr/docs/help-info/system-commands.json b/web/messages/fr/docs/help-info/system-commands.json
new file mode 100644
index 00000000..bb66a05e
--- /dev/null
+++ b/web/messages/fr/docs/help-info/system-commands.json
@@ -0,0 +1,158 @@
+{
+  "meta": {
+    "title": "Commandes système Proxmox VE — pveversion, uptime, journalctl, systemctl | ProxMenux",
+    "description": "Commandes système Proxmox VE et Linux pour les versions, la durée de fonctionnement, la mémoire, les services, les journaux et les utilisateurs, avec des outils d’audit et de synthèse. Une commande redémarre un service : tous les exemples ne sont pas en lecture seule.",
+    "ogTitle": "Commandes système Proxmox VE — pveversion, uptime, journalctl, systemctl",
+    "ogDescription": "Commandes système Proxmox VE et Linux pour la version, la durée de fonctionnement, les services, les journaux et les utilisateurs, avec gestion des services et outils d’audit.",
+    "twitterTitle": "Commandes système Proxmox VE | ProxMenux",
+    "twitterDescription": "Commandes essentielles d'inspection du système pour Proxmox VE — version, état, services, journaux, informations utilisateur."
+  },
+  "header": {
+    "title": "Commandes système utiles",
+    "description": "Commandes d’inspection de l’hôte Proxmox : version, noyau, durée de fonctionnement, mémoire, état de l’interface web, journaux récents et utilisateurs connectés, avec des outils d’audit et de synthèse. La plupart consultent l’état, mais systemctl restart pveproxy redémarre le proxy web et les audits peuvent écrire des rapports et des journaux.",
+    "section": "Aide et informations"
+  },
+  "intro": {
+    "title": "Ce que c'est",
+    "body": "La même liste numérotée que dans <em>Commandes système utiles</em> dans ProxMenux. Utilisez le bouton Copier pour récupérer une commande ou consultez la liste pour retrouver l’option exacte."
+  },
+  "commandGroups": [
+    {
+      "title": "Informations système",
+      "commands": [
+        {
+          "command": "pveversion",
+          "description": "Afficher la version de Proxmox"
+        },
+        {
+          "command": "pveversion -v",
+          "description": "Informations détaillées sur la version Proxmox"
+        },
+        {
+          "command": "hostnamectl",
+          "description": "Nom d'hôte du système et informations sur le noyau"
+        },
+        {
+          "command": "uname -a",
+          "description": "Informations sur le noyau et l'architecture"
+        },
+        {
+          "command": "cat /etc/os-release",
+          "description": "Détails de la version du système d'exploitation"
+        }
+      ]
+    },
+    {
+      "title": "État du système",
+      "commands": [
+        {
+          "command": "uptime",
+          "description": "Durée de fonctionnement du système"
+        },
+        {
+          "command": "uptime -p",
+          "description": "Durée de fonctionnement dans un format lisible"
+        },
+        {
+          "command": "free -h",
+          "description": "Utilisation de la RAM et du swap"
+        },
+        {
+          "command": "who -b",
+          "description": "Heure du dernier démarrage du système"
+        },
+        {
+          "command": "last -x | grep shutdown",
+          "description": "Arrêts précédents"
+        }
+      ]
+    },
+    {
+      "title": "Gestion des services",
+      "commands": [
+        {
+          "command": "systemctl status pveproxy",
+          "description": "Vérifier l'état de l'interface utilisateur Web de Proxmox"
+        },
+        {
+          "command": "systemctl restart pveproxy",
+          "description": "Redémarrer le proxy de l'interface utilisateur Web"
+        },
+        {
+          "command": "journalctl -xe",
+          "description": "Erreurs système et journaux"
+        },
+        {
+          "command": "dmesg -T | tail -n 50",
+          "description": "50 dernières lignes de journal du noyau"
+        }
+      ]
+    },
+    {
+      "title": "Informations utilisateur",
+      "commands": [
+        {
+          "command": "whoami",
+          "description": "Utilisateur actuel"
+        },
+        {
+          "command": "id",
+          "description": "UID, GID et groupes de l'utilisateur actuel"
+        },
+        {
+          "command": "who",
+          "description": "Utilisateurs connectés"
+        },
+        {
+          "command": "w",
+          "description": "Activité des utilisateurs et durée de fonctionnement"
+        },
+        {
+          "command": "uptime && w",
+          "description": "Durée de fonctionnement et utilisateurs connectés"
+        },
+        {
+          "command": "cut -d: -f1,3,4 /etc/passwd",
+          "description": "Tous les utilisateurs avec UID et GID"
+        },
+        {
+          "command": "getent passwd | column -t -s :",
+          "description": "Table utilisateur lisible (UID, shell, etc.)"
+        }
+      ]
+    },
+    {
+      "title": "Outils de vérification et de résumé",
+      "commands": [
+        {
+          "command": "lynis audit system",
+          "description": "Exécuter un audit complet de la sécurité du système"
+        },
+        {
+          "command": "fastfetch",
+          "description": "Afficher le résumé du système au format ASCII"
+        }
+      ]
+    }
+  ],
+  "related": {
+    "heading": "Rubriques connexes",
+    "items": [
+      {
+        "href": "/docs/help-info/update-commands",
+        "label": "Mises à jour et paquets",
+        "tail": " — commandes apt et de mise à niveau de PVE."
+      },
+      {
+        "href": "/docs/help-info/tools-commands",
+        "label": "Outils CLI système",
+        "tail": " — htop, btop, ncdu et outils similaires."
+      },
+      {
+        "href": "/docs/help-info",
+        "label": "Vue d’ensemble de l’aide et des informations",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/fr/docs/help-info/tools-commands.json b/web/messages/fr/docs/help-info/tools-commands.json
new file mode 100644
index 00000000..7082e296
--- /dev/null
+++ b/web/messages/fr/docs/help-info/tools-commands.json
@@ -0,0 +1,276 @@
+{
+  "meta": {
+    "title": "Outils CLI Linux pour Proxmox — htop, iftop, journalctl, rsync, tmux | ProxMenux",
+    "description": "Outils CLI Linux pour administrer Proxmox VE au quotidien : surveillance (htop, atop, glances, iotop), réseau (iftop, nmap, mtr, ss), fichiers et texte (find, grep, journalctl), performances (iostat, perf, strace), sécurité (fail2ban, lynis, lsof) et administration à distance (ssh, rsync, tmux).",
+    "ogTitle": "Outils CLI Linux pour Proxmox — htop, iftop, journalctl, rsync, tmux",
+    "ogDescription": "Outils quotidiens CLI pour l'administration Proxmox VE regroupés par fonction : surveillance, réseau, fichier/texte, performance, sécurité et administration à distance.",
+    "twitterTitle": "Outils CLI Linux pour Proxmox | ProxMenux",
+    "twitterDescription": "Outils CLI pour administrer Proxmox VE au quotidien, regroupés par fonction."
+  },
+  "header": {
+    "title": "Outils CLI système",
+    "description": "Outils CLI pour administrer l’hôte Proxmox au quotidien, classés par fonction : surveillance, réseau, fichiers et texte, analyse des performances, sécurité, administration à distance et configuration du système.",
+    "section": "Aide et informations"
+  },
+  "intro": {
+    "title": "La plupart sont installés par le script de post-installation",
+    "body": "Si vous avez exécuté le script de post-installation avec les choix par défaut, la plupart de ces outils sont déjà installés. Pour les outils manquants, l’<utilsLink>installateur d’utilitaires système</utilsLink> de ProxMenux propose des groupes prédéfinis : base, développement, réseau, analyse, etc."
+  },
+  "commandGroups": [
+    {
+      "title": "Surveillance du système",
+      "commands": [
+        {
+          "command": "htop",
+          "description": "Visualiseur interactif des processus avec utilisation du CPU et de la mémoire"
+        },
+        {
+          "command": "top",
+          "description": "Afficher les processus Linux en temps réel"
+        },
+        {
+          "command": "atop",
+          "description": "Moniteur avancé du système et des processus"
+        },
+        {
+          "command": "glances",
+          "description": "Outil de surveillance du système avec interface web"
+        },
+        {
+          "command": "nmon",
+          "description": "Outil de surveillance des performances"
+        },
+        {
+          "command": "iotop",
+          "description": "Surveiller les entrées-sorties disque des processus"
+        },
+        {
+          "command": "vmstat 1",
+          "description": "Signaler des statistiques de mémoire virtuelle chaque seconde"
+        }
+      ]
+    },
+    {
+      "title": "Outils réseau",
+      "commands": [
+        {
+          "command": "iftop",
+          "description": "Affichage de l'utilisation de la bande passante sur une interface"
+        },
+        {
+          "command": "nmap <host>",
+          "description": "Exploration du réseau et balayage de sécurité"
+        },
+        {
+          "command": "tcpdump -i <interface>",
+          "description": "Capturer le trafic réseau"
+        },
+        {
+          "command": "netstat -tuln",
+          "description": "Afficher les connexions réseau"
+        },
+        {
+          "command": "ss -tuln",
+          "description": "Autre utilitaire pour étudier les sockets"
+        },
+        {
+          "command": "mtr <host>",
+          "description": "Outil de diagnostic réseau combinant ping et traceroute"
+        },
+        {
+          "command": "iperf3 -s",
+          "description": "Lancer le serveur iperf pour tester la bande passante"
+        }
+      ]
+    },
+    {
+      "title": "Outils de fichiers et de texte",
+      "commands": [
+        {
+          "command": "find / -name <filename>",
+          "description": "Rechercher des fichiers par nom"
+        },
+        {
+          "command": "grep -r 'pattern' /path",
+          "description": "Rechercher le modèle dans les fichiers"
+        },
+        {
+          "command": "sed -i 's/old/new/g' file",
+          "description": "Remplacer le texte dans les fichiers"
+        },
+        {
+          "command": "awk '{print $1}' file",
+          "description": "Outil de traitement de texte"
+        },
+        {
+          "command": "tail -f /var/log/syslog",
+          "description": "Suivre le fichier journal en temps réel"
+        },
+        {
+          "command": "less /var/log/messages",
+          "description": "Afficher le fichier avec pagination"
+        },
+        {
+          "command": "journalctl -f",
+          "description": "Suivre les journaux de systemd"
+        }
+      ]
+    },
+    {
+      "title": "Analyse des performances",
+      "commands": [
+        {
+          "command": "iostat -x 1",
+          "description": "Rapports statistiques CPU et E/S"
+        },
+        {
+          "command": "mpstat -P ALL 1",
+          "description": "Rapport sur l'utilisation des CPU"
+        },
+        {
+          "command": "perf top",
+          "description": "Outil de profilage du système"
+        },
+        {
+          "command": "strace <command>",
+          "description": "Tracez les appels et signaux du système"
+        },
+        {
+          "command": "lsof",
+          "description": "Liste des fichiers ouverts"
+        },
+        {
+          "command": "pstree",
+          "description": "Affichage de l'arborescence du processus"
+        },
+        {
+          "command": "slabtop",
+          "description": "Afficher les informations du cache slab du noyau"
+        }
+      ]
+    },
+    {
+      "title": "Outils de sécurité",
+      "commands": [
+        {
+          "command": "fail2ban-client status",
+          "description": "Afficher le statut de fail2ban"
+        },
+        {
+          "command": "chage -l <username>",
+          "description": "Afficher les informations d'expiration du mot de passe"
+        },
+        {
+          "command": "lastlog",
+          "description": "Afficher la dernière connexion de tous les utilisateurs"
+        },
+        {
+          "command": "last",
+          "description": "Afficher la liste des derniers utilisateurs connectés"
+        },
+        {
+          "command": "w",
+          "description": "Afficher qui est connecté et ce qu'ils font"
+        },
+        {
+          "command": "lynis audit system",
+          "description": "Outil de vérification de sécurité"
+        },
+        {
+          "command": "openssl s_client -connect host:port",
+          "description": "Tester les connexions SSL/TLS"
+        }
+      ]
+    },
+    {
+      "title": "Administration à distance",
+      "commands": [
+        {
+          "command": "ssh <user>@<host>",
+          "description": "Connexion shell sécurisée"
+        },
+        {
+          "command": "scp <file> <user>@<host>:<path>",
+          "description": "Copier des fichiers de manière sécurisée"
+        },
+        {
+          "command": "rsync -avz <src> <dest>",
+          "description": "Synchroniser les fichiers/dossiers"
+        },
+        {
+          "command": "screen",
+          "description": "Multiplexeur terminal"
+        },
+        {
+          "command": "tmux",
+          "description": "Autre multiplexeur de terminal"
+        },
+        {
+          "command": "ssh-keygen -t rsa -b 4096",
+          "description": "Générer une paire de clés SSH"
+        },
+        {
+          "command": "ssh-copy-id <user>@<host>",
+          "description": "Copier la clé SSH sur le serveur"
+        }
+      ]
+    },
+    {
+      "title": "Configuration du système",
+      "commands": [
+        {
+          "command": "systemctl status <service>",
+          "description": "Vérifier l'état du service"
+        },
+        {
+          "command": "journalctl -u <service>",
+          "description": "Consulter les journaux de service"
+        },
+        {
+          "command": "timedatectl",
+          "description": "Gérer la date et l’heure du système"
+        },
+        {
+          "command": "hostnamectl",
+          "description": "Gérer le nom d’hôte du système"
+        },
+        {
+          "command": "localectl",
+          "description": "Gérer les paramètres régionaux et le clavier du système"
+        },
+        {
+          "command": "update-alternatives --config <name>",
+          "description": "Configuration des solutions de remplacement du système"
+        },
+        {
+          "command": "dpkg-reconfigure <package>",
+          "description": "Reconfigurer un paquet installé"
+        }
+      ]
+    }
+  ],
+  "tmuxTip": {
+    "title": "Utiliser tmux / screen pour les commandes longues",
+    "bodyRich": "Exécutez les tâches longues, comme une sauvegarde, une mise à niveau ou un gros transfert rsync, dans <code>tmux</code> ou <code>screen</code> afin qu’une déconnexion SSH ne termine pas la session du terminal. Pour une session tmux, reconnectez-vous au même hôte avec le même utilisateur, puis lancez <code>tmux attach</code>. Les sessions screen ont leur propre commande de rattachement."
+  },
+  "related": {
+    "heading": "Rubriques connexes",
+    "items": [
+      {
+        "href": "/docs/utils/system-utils",
+        "label": "Installateur des utilitaires système",
+        "tail": "— installer tous ces outils manquants."
+      },
+      {
+        "href": "/docs/help-info/system-commands",
+        "label": "Commandes système utiles",
+        "tail": "— commandes d'inspection spécifiques à Proxmox."
+      },
+      {
+        "href": "/docs/help-info",
+        "label": "Vue d’ensemble de l’aide et des informations",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/fr/docs/help-info/update-commands.json b/web/messages/fr/docs/help-info/update-commands.json
new file mode 100644
index 00000000..ccd08323
--- /dev/null
+++ b/web/messages/fr/docs/help-info/update-commands.json
@@ -0,0 +1,170 @@
+{
+  "meta": {
+    "title": "Commandes de mise à jour et de gestion des paquets Proxmox — apt, pveupgrade, dpkg | ProxMenux",
+    "description": "Commandes de mise à jour et de gestion des paquets Proxmox VE : apt update, apt upgrade, apt dist-upgrade, pveupgrade, dpkg -l, informations sur les paquets et configuration des dépôts dans /etc/apt/sources.list.d/.",
+    "ogTitle": "Commandes de mise à jour et de gestion des paquets Proxmox — apt, pveupgrade, dpkg",
+    "ogDescription": "commandes apt, pveupgrade et dpkg pour garder Proxmox VE à jour — mises à jour du système, gestion des paquets, configuration du dépôt.",
+    "twitterTitle": "Commandes de mise à jour Proxmox | ProxMenux",
+    "twitterDescription": "Commandes apt et pveupgrade pour gérer les mises à jour et les paquets sur les hôtes Proxmox VE."
+  },
+  "header": {
+    "title": "Mises à jour et paquets",
+    "description": "Sélection de commandes apt et de mise à niveau Proxmox : mises à jour du système, installation, suppression et purge des paquets, requêtes avec apt-cache policy et dpkg -l, et inspection des dépôts.",
+    "section": "Aide et informations"
+  },
+  "intro": {
+    "title": "Toujours mettre à jour l'index en premier",
+    "body": "<code>apt update</code> actualise l’index local des paquets depuis les dépôts configurés. Sans cette étape, <code>apt install</code> peut utiliser des versions obsolètes ou échouer avec « Unable to locate package »."
+  },
+  "commandGroups": [
+    {
+      "title": "Mises à jour du système",
+      "commands": [
+        {
+          "command": "apt update && apt upgrade -y",
+          "description": "Actualiser les listes et mettre à jour les paquets installés (apt upgrade)"
+        },
+        {
+          "command": "apt dist-upgrade -y",
+          "description": "Mise à niveau complète du système, y compris les dépendances"
+        },
+        {
+          "command": "apt update",
+          "description": "Mettre à jour uniquement les listes de paquets"
+        },
+        {
+          "command": "apt upgrade",
+          "description": "Mettre à jour uniquement les paquets (interactifs)"
+        },
+        {
+          "command": "apt full-upgrade",
+          "description": "Mettre à niveau les paquets avec la gestion de la dépendance (interactive)"
+        }
+      ]
+    },
+    {
+      "title": "Mises à jour de Proxmox",
+      "commands": [
+        {
+          "command": "pveupdate",
+          "description": "Mettre à jour les listes de packages Proxmox"
+        },
+        {
+          "command": "pveupgrade",
+          "description": "Lancer la mise à niveau interactive des paquets Proxmox"
+        },
+        {
+          "command": "pve8to9 --full",
+          "description": "Vérifier la préparation au passage de PVE 8 à 9, sans effectuer la mise à niveau"
+        },
+        {
+          "command": "ceph versions",
+          "description": "Afficher les versions des démons Ceph avant de planifier une mise à niveau"
+        }
+      ]
+    },
+    {
+      "title": "Gestion des paquets",
+      "commands": [
+        {
+          "command": "apt autoremove --purge",
+          "description": "Supprimer les packages inutilisés et leur configuration"
+        },
+        {
+          "command": "apt clean",
+          "description": "Effacer le dépôt local des fichiers de paquets récupérés"
+        },
+        {
+          "command": "apt autoclean",
+          "description": "Effacer uniquement les fichiers de paquets périmés"
+        },
+        {
+          "command": "apt install <package>",
+          "description": "Installer un paquet spécifique"
+        },
+        {
+          "command": "apt remove <package>",
+          "description": "Supprimer un package"
+        },
+        {
+          "command": "apt purge <package>",
+          "description": "Supprimer un paquet et ses fichiers de configuration"
+        }
+      ]
+    },
+    {
+      "title": "Informations sur les paquets",
+      "commands": [
+        {
+          "command": "apt list --installed",
+          "description": "Liste de tous les paquets installés"
+        },
+        {
+          "command": "apt search <keyword>",
+          "description": "Rechercher les paquets par mot-clé"
+        },
+        {
+          "command": "apt show <package>",
+          "description": "Afficher les informations détaillées sur un paquet"
+        },
+        {
+          "command": "dpkg -l",
+          "description": "Liste de tous les paquets installés (alternative)"
+        },
+        {
+          "command": "dpkg -l | grep <keyword>",
+          "description": "Rechercher les paquets installés par mot-clé"
+        },
+        {
+          "command": "apt-cache policy <package>",
+          "description": "Afficher les versions et les priorités des paquets"
+        }
+      ]
+    },
+    {
+      "title": "Gestion des dépôts",
+      "commands": [
+        {
+          "command": "cat /etc/apt/sources.list",
+          "description": "Afficher les principales sources de dépôt APT"
+        },
+        {
+          "command": "ls -la /etc/apt/sources.list.d/",
+          "description": "Liste des fichiers sources supplémentaires du dépôt"
+        },
+        {
+          "command": "cat /etc/apt/sources.list.d/pve-enterprise.list",
+          "description": "Afficher la configuration du dépôt Proxmox Enterprise dans le fichier .list de PVE 8"
+        },
+        {
+          "command": "apt-key list",
+          "description": "Lister les anciennes clés de signature des dépôts si apt-key est disponible"
+        }
+      ]
+    }
+  ],
+  "backupWarn": {
+    "title": "Créer une sauvegarde avant les mises à niveau majeures",
+    "bodyRich": "Pour les mises à jour courantes, Proxmox recommande <code>apt update &amp;&amp; apt full-upgrade</code> ; examinez les changements de paquets avant de confirmer. Pour les <strong>mises à niveau majeures</strong> (PVE 8 → 9), utilisez la procédure ProxMenux <upgradeLink>Mettre à niveau PVE 8 vers PVE 9</upgradeLink>. Elle ajoute des vérifications préalables, la migration des dépôts et une validation finale. Créez d’abord une sauvegarde."
+  },
+  "related": {
+    "heading": "Rubriques connexes",
+    "items": [
+      {
+        "href": "/docs/utils/system-update",
+        "label": "Mise à jour du système Proxmox (interactive)",
+        "tail": "— wrapper qui fait tout cela avec une boîte de dialogue de confirmation, une reconstruction automatique de DKMS des pilotes gérés par ProxMenux lorsqu'un nouveau noyau est installé, et une invite de redémarrage. Également disponible à partir du bouton Mettre à jour maintenant du tableau de bord ProxMenux Monitor."
+      },
+      {
+        "href": "/docs/utils/upgrade-pve8-pve9",
+        "label": "Mettre à niveau le PVE 8 vers le PVE 9",
+        "tail": "— pour les mises à niveau en version majeure."
+      },
+      {
+        "href": "/docs/help-info",
+        "label": "Vue d’ensemble de l’aide et des informations",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/fr/docs/help-info/vm-ct-commands.json b/web/messages/fr/docs/help-info/vm-ct-commands.json
new file mode 100644
index 00000000..9ea91c46
--- /dev/null
+++ b/web/messages/fr/docs/help-info/vm-ct-commands.json
@@ -0,0 +1,182 @@
+{
+  "meta": {
+    "title": "Commandes qm et pct de Proxmox — gestion des VM et des conteneurs LXC | ProxMenux",
+    "description": "Commandes qm et pct de Proxmox VE pour les VM et conteneurs LXC : list, config, start, stop, shutdown, reboot, destroy, clone, migrate, snapshot, resize, ainsi que pct exec / enter / push / pull pour les conteneurs.",
+    "ogTitle": "Commandes qm et pct de Proxmox — gestion des VM et des conteneurs LXC",
+    "ogDescription": "Commandes qm et pct de Proxmox VE pour gérer les machines virtuelles et conteneurs LXC en ligne de commande : démarrage, arrêt, configuration, instantanés, migration, clonage et suppression.",
+    "twitterTitle": "Commandes qm / pct de Proxmox | ProxMenux",
+    "twitterDescription": "Sélection de commandes qm / pct pour gérer les machines virtuelles et conteneurs LXC dans Proxmox VE."
+  },
+  "header": {
+    "title": "Gestion VM et CT",
+    "description": "Sélection de commandes qm pour les VM et pct pour les conteneurs LXC : listes, cycle de vie (start / stop / shutdown / destroy), inspection de configuration et opérations de conteneur avec exec, enter, push et pull.",
+    "section": "Aide et informations"
+  },
+  "intro": {
+    "title": "Trouver d'abord un VMID ou un CTID",
+    "body": "Presque chaque commande demande un identifiant numérique. Utilisez <code>qm list</code> pour les VM et <code>pct list</code> pour les conteneurs. Remplacez <code>&lt;vmid&gt;</code> / <code>&lt;ctid&gt;</code> dans les exemples par l’identifiant réel avant de les exécuter."
+  },
+  "commandGroups": [
+    {
+      "title": "Liste et renseignements",
+      "commands": [
+        {
+          "command": "qm list",
+          "description": "Lister toutes les machines virtuelles"
+        },
+        {
+          "command": "pct list",
+          "description": "Lister tous les conteneurs LXC"
+        },
+        {
+          "command": "qm config <vmid>",
+          "description": "Afficher la configuration de la VM interprétée par qm"
+        },
+        {
+          "command": "pct config <ctid>",
+          "description": "Afficher la configuration du conteneur interprétée par pct"
+        }
+      ]
+    },
+    {
+      "title": "Fichiers de configuration (brut)",
+      "commands": [
+        {
+          "command": "cat /etc/pve/qemu-server/<vmid>.conf",
+          "description": "Afficher le fichier de configuration brut de la VM"
+        },
+        {
+          "command": "cat /etc/pve/lxc/<ctid>.conf",
+          "description": "Afficher le fichier de configuration CT brut"
+        },
+        {
+          "command": "nano /etc/pve/qemu-server/<vmid>.conf",
+          "description": "Modifier le fichier de configuration brut VM (nano)"
+        },
+        {
+          "command": "nano /etc/pve/lxc/<ctid>.conf",
+          "description": "Modifier le fichier de configuration brut CT (nano)"
+        },
+        {
+          "command": "vi /etc/pve/qemu-server/<vmid>.conf",
+          "description": "Modifier le fichier de configuration brut VM (vi)"
+        },
+        {
+          "command": "vi /etc/pve/lxc/<ctid>.conf",
+          "description": "Modifier le fichier de configuration brut CT (vi)"
+        }
+      ]
+    },
+    {
+      "title": "Gestion VM",
+      "commands": [
+        {
+          "command": "qm start <vmid>",
+          "description": "Démarrez une machine virtuelle. Utilisez le bon <vmid>"
+        },
+        {
+          "command": "qm stop <vmid>",
+          "description": "Forcer l'arrêt d'une machine virtuelle. Utilisez le bon <vmid>"
+        },
+        {
+          "command": "qm shutdown <vmid>",
+          "description": "Arrêter proprement une machine virtuelle"
+        },
+        {
+          "command": "qm reset <vmid>",
+          "description": "Réinitialiser une machine virtuelle (redémarrage dur)"
+        },
+        {
+          "command": "qm suspend <vmid>",
+          "description": "Suspendre une machine virtuelle"
+        },
+        {
+          "command": "qm resume <vmid>",
+          "description": "Reprendre une machine virtuelle suspendue"
+        },
+        {
+          "command": "qm destroy <vmid>",
+          "description": "Supprimer une VM (irréversible). Utilisez le bon <vmid>"
+        }
+      ]
+    },
+    {
+      "title": "Gestion des conteneurs",
+      "commands": [
+        {
+          "command": "pct start <ctid>",
+          "description": "Démarrez un conteneur. Utilisez le bon <ctid>"
+        },
+        {
+          "command": "pct stop <ctid>",
+          "description": "Forcer l'arrêt d'un conteneur. Utilisez le bon <ctid>"
+        },
+        {
+          "command": "pct shutdown <ctid>",
+          "description": "Arrêter proprement un conteneur"
+        },
+        {
+          "command": "pct reboot <ctid>",
+          "description": "Redémarrer un conteneur"
+        },
+        {
+          "command": "pct destroy <ctid>",
+          "description": "Supprimer un CT (irréversible). Utilisez le bon <ctid>"
+        }
+      ]
+    },
+    {
+      "title": "Exploitation des conteneurs",
+      "commands": [
+        {
+          "command": "pct exec <ctid> -- getent passwd | column -t -s :",
+          "description": "Afficher les utilisateurs CT sous forme de tableau"
+        },
+        {
+          "command": "pct exec <ctid> -- ps aux --sort=-%mem | head",
+          "description": "Processus consommant le plus de mémoire dans le CT"
+        },
+        {
+          "command": "pct enter <ctid>",
+          "description": "Ouvrir le shell du conteneur"
+        },
+        {
+          "command": "pct push <ctid> <source> <dest>",
+          "description": "Copier le fichier de l'hôte vers le conteneur"
+        },
+        {
+          "command": "pct pull <ctid> <source> <dest>",
+          "description": "Copier le fichier du conteneur vers l'hôte"
+        }
+      ]
+    }
+  ],
+  "destroyWarn": {
+    "title": "La destruction est irréversible",
+    "bodyRich": "<code>qm destroy</code> et <code>pct destroy</code> suppriment la configuration de l’invité et ses volumes de disque gérés. Ne supposez pas que les données externes ou montées par bind mount sont effacées. La CLI ne demande pas confirmation par défaut. Sauvegardez d’abord les données utiles ; voir <backupLink>Sauvegarde et restauration</backupLink>."
+  },
+  "qmConfigTip": {
+    "title": "qm config ou modification directe du fichier .conf",
+    "bodyRich": "<code>qm config &lt;vmid&gt;</code> et <code>pct config &lt;ctid&gt;</code> affichent la configuration via les analyseurs Proxmox. Pour les modifications courantes, préférez <code>qm set</code> ou l’équivalent pct. Modifier directement <code>/etc/pve/qemu-server/&lt;vmid&gt;.conf</code> ou <code>/etc/pve/lxc/&lt;ctid&gt;.conf</code> contourne les validations et verrous des commandes de gestion ; le fichier doit rester interprétable. Arrêtez l’invité et gardez une copie avant une réparation manuelle. <code>pmxcfs</code> synchronise les configurations entre les nœuds du cluster, pas les données des disques invités."
+  },
+  "related": {
+    "heading": "Rubriques connexes",
+    "items": [
+      {
+        "href": "/docs/help-info/backup-commands",
+        "label": "Sauvegarde et restauration",
+        "tail": " — vzdump et qmrestore / pct restore."
+      },
+      {
+        "href": "/docs/help-info/storage-commands",
+        "label": "Stockage et disques",
+        "tail": "— qm importdisk et gestion du disque."
+      },
+      {
+        "href": "/docs/help-info",
+        "label": "Vue d’ensemble de l’aide et des informations",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/fr/docs/help-info/zfs-commands.json b/web/messages/fr/docs/help-info/zfs-commands.json
new file mode 100644
index 00000000..4acbb5c6
--- /dev/null
+++ b/web/messages/fr/docs/help-info/zfs-commands.json
@@ -0,0 +1,227 @@
+{
+  "meta": {
+    "title": "Commandes ZFS sur Proxmox — zpool, zfs snapshot, send/receive, scrub | ProxMenux",
+    "description": "Commandes de gestion ZFS sur Proxmox VE : zpool create / status / history, zfs list / get / set, instantanés, clone, zfs send et receive, scrub, clear, replace, zpool iostat et résumé d’ARC.",
+    "ogTitle": "Commandes ZFS sur Proxmox — zpool, zfs snapshot, send/receive, scrub",
+    "ogDescription": "Référence des commandes zpool et zfs sur Proxmox VE — pools, ensembles de données, instantanés, réplication, maintenance.",
+    "twitterTitle": "Commandes ZFS sur Proxmox | ProxMenux",
+    "twitterDescription": "commandes zpool et zfs pour Proxmox VE : pools, datasets, snapshots, réplication, maintenance."
+  },
+  "header": {
+    "title": "Gestion ZFS",
+    "description": "Sélection de commandes zpool et zfs : inspection des pools, création, lecture, modification et suppression de datasets, instantanés, clone et send/receive incrémental ou récursif, maintenance avec scrub / clear / replace, statistiques d’E/S et résumé d’ARC.",
+    "section": "Aide et informations"
+  },
+  "intro": {
+    "title": "Deux familles de commandes",
+    "body": "<code>zpool *</code> gère les pools de stockage, la couche physique : disques, vdevs et redondance. <code>zfs *</code> gère les datasets et les instantanés de ces pools, la couche logique : systèmes de fichiers, volumes, instantanés et propriétés."
+  },
+  "commandGroups": [
+    {
+      "title": "Informations sur le pool",
+      "commands": [
+        {
+          "command": "zpool list",
+          "description": "Lister tous les pools ZFS"
+        },
+        {
+          "command": "zpool status",
+          "description": "Afficher l'état et la santé du pool détaillé"
+        },
+        {
+          "command": "zpool status -v",
+          "description": "Afficher l'état du pool avec les erreurs"
+        },
+        {
+          "command": "zpool history",
+          "description": "Afficher l'historique des commandes pour tous les pools"
+        },
+        {
+          "command": "zpool history <pool>",
+          "description": "Afficher l'historique des commandes pour un pool spécifique"
+        },
+        {
+          "command": "zpool get all <pool>",
+          "description": "Afficher toutes les propriétés d'un pool"
+        }
+      ]
+    },
+    {
+      "title": "Gestion des datasets",
+      "commands": [
+        {
+          "command": "zfs list",
+          "description": "Lister tous les ensembles de données ZFS"
+        },
+        {
+          "command": "zfs list -r <pool>",
+          "description": "Lister tous les ensembles de données dans un pool récursivement"
+        },
+        {
+          "command": "zfs create <pool>/<dataset>",
+          "description": "Créer un nouvel ensemble de données"
+        },
+        {
+          "command": "zfs destroy <pool>/<dataset>",
+          "description": "Détruire un ensemble de données"
+        },
+        {
+          "command": "zfs rename <pool>/<dataset> <pool>/<new-name>",
+          "description": "Renommer un ensemble de données"
+        },
+        {
+          "command": "zfs get all <pool>/<dataset>",
+          "description": "Afficher toutes les propriétés d'un ensemble de données"
+        },
+        {
+          "command": "zfs set compression=on <pool>/<dataset>",
+          "description": "Activer la compression sur un jeu de données"
+        }
+      ]
+    },
+    {
+      "title": "Gestion des instantanés",
+      "commands": [
+        {
+          "command": "zfs list -t snapshot",
+          "description": "Liste de tous les instantanés"
+        },
+        {
+          "command": "zfs list -t snapshot -r <pool>",
+          "description": "Liste tous les instantanés dans un pool"
+        },
+        {
+          "command": "zfs snapshot <pool>/<dataset>@<snapshot-name>",
+          "description": "Créer un instantané"
+        },
+        {
+          "command": "zfs destroy <pool>/<dataset>@<snapshot-name>",
+          "description": "Supprimer un instantané"
+        },
+        {
+          "command": "zfs rollback <pool>/<dataset>@<snapshot-name>",
+          "description": "Retour à un instantané"
+        },
+        {
+          "command": "zfs hold <tag> <pool>/<dataset>@<snapshot-name>",
+          "description": "Protéger un instantané contre la suppression avec un hold"
+        },
+        {
+          "command": "zfs release <tag> <pool>/<dataset>@<snapshot-name>",
+          "description": "Lever la protection hold d’un instantané"
+        }
+      ]
+    },
+    {
+      "title": "Clone et envoi/réception",
+      "commands": [
+        {
+          "command": "zfs clone <pool>/<dataset>@<snapshot> <pool>/<clone-name>",
+          "description": "Créer un clone à partir d'un instantané"
+        },
+        {
+          "command": "zfs send <pool>/<dataset>@<snapshot> > backup.zfs",
+          "description": "Envoyer un instantané dans un fichier"
+        },
+        {
+          "command": "zfs receive <pool>/<dataset> < backup.zfs",
+          "description": "Recevez un instantané à partir d'un fichier"
+        },
+        {
+          "command": "zfs send -i <pool>/<dataset>@<snap1> <pool>/<dataset>@<snap2> > incr.zfs",
+          "description": "Envoyer un instantané incrémental"
+        },
+        {
+          "command": "zfs send -R <pool>/<dataset>@<snapshot> > full-recursive.zfs",
+          "description": "Envoyer un instantané récursif"
+        }
+      ]
+    },
+    {
+      "title": "Entretien et réparation",
+      "commands": [
+        {
+          "command": "zpool scrub <pool>",
+          "description": "Lancer une vérification scrub d’un pool"
+        },
+        {
+          "command": "zpool scrub -s <pool>",
+          "description": "Arrêter le scrub en cours"
+        },
+        {
+          "command": "zpool clear <pool>",
+          "description": "Réinitialiser les compteurs d’erreurs d’un pool"
+        },
+        {
+          "command": "zpool clear <pool> <device>",
+          "description": "Effacer les erreurs sur un périphérique spécifique"
+        },
+        {
+          "command": "zpool replace <pool> <old-device> <new-device>",
+          "description": "Remplacer un dispositif défectueux"
+        },
+        {
+          "command": "zpool offline <pool> <device>",
+          "description": "Prenez un appareil hors ligne"
+        },
+        {
+          "command": "zpool online <pool> <device>",
+          "description": "Apportez un appareil en ligne"
+        }
+      ]
+    },
+    {
+      "title": "Performances et surveillance",
+      "commands": [
+        {
+          "command": "zpool iostat",
+          "description": "Afficher les statistiques E/S pour les pools"
+        },
+        {
+          "command": "zpool iostat -v",
+          "description": "Afficher les statistiques détaillées des E/S"
+        },
+        {
+          "command": "zpool iostat 5",
+          "description": "Afficher les statistiques d'E/S toutes les 5 secondes"
+        },
+        {
+          "command": "arc_summary",
+          "description": "Afficher les statistiques ARC (si installé)"
+        },
+        {
+          "command": "zfs get compressratio <pool>/<dataset>",
+          "description": "Afficher le rapport de compression"
+        },
+        {
+          "command": "zfs get used,available,referenced <pool>/<dataset>",
+          "description": "Afficher l'utilisation de l'espace"
+        }
+      ]
+    }
+  ],
+  "bestPractices": {
+    "title": "Meilleures pratiques opérationnelles",
+    "bodyRich": "Planifiez régulièrement <code>zpool scrub</code> pour vérifier les sommes de contrôle et examinez le résultat. Gardez de l’espace libre : l’effet d’un pool presque plein dépend de la charge et de sa structure. Utilisez <code>zpool replace</code> pour remplacer un périphérique défaillant, en suivant la procédure de son type de vdev. Detach + add n’est pas équivalent et peut modifier la topologie ou supprimer la redondance."
+  },
+  "related": {
+    "heading": "Rubriques connexes",
+    "items": [
+      {
+        "href": "/docs/help-info/storage-commands",
+        "label": "Stockage et disques",
+        "tail": "— commandes génériques de block-device et LVM."
+      },
+      {
+        "href": "/docs/help-info/backup-commands",
+        "label": "Sauvegarde et restauration",
+        "tail": " — vzdump, qmrestore."
+      },
+      {
+        "href": "/docs/help-info",
+        "label": "Vue d’ensemble de l’aide et des informations",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/fr/docs/installation.json b/web/messages/fr/docs/installation.json
new file mode 100644
index 00000000..46cbbbf9
--- /dev/null
+++ b/web/messages/fr/docs/installation.json
@@ -0,0 +1,93 @@
+{
+  "meta": {
+    "title": "Installer ProxMenux | Documentation ProxMenux",
+    "description": "Installez ProxMenux en une commande sur les hôtes Proxmox VE 8 et ultérieurs. Les catalogues JSON préconstruits couvrent huit langues : anglais, espagnol, français, allemand, italien, portugais, slovaque et suédois. Choisissez la langue à l’installation ou modifiez-la ensuite dans les paramètres. Le canal bêta permet d’essayer les nouveautés en avance.",
+    "ogTitle": "Installer ProxMenux | Documentation ProxMenux",
+    "ogDescription": "Installez ProxMenux sur Proxmox VE 8 ou ultérieur en une commande. Canaux stable et bêta disponibles."
+  },
+  "header": {
+    "title": "Installation de ProxMenux",
+    "description": "Un installateur à lancer en une ligne sur un hôte Proxmox VE 8 ou ultérieur. Il installe automatiquement les dépendances, télécharge les scripts, configure le lanceur du menu et demande la langue au premier lancement. Deux canaux : stable par défaut et bêta.",
+    "section": "Installation"
+  },
+  "stable": {
+    "heading": "Installer",
+    "intro": "Exécutez ceci dans le terminal de votre hôte Proxmox :",
+    "code": "bash -c \"$(wget -qLO - https://raw.githubusercontent.com/MacRimi/ProxMenux/main/install_proxmenux.sh)\""
+  },
+  "during": {
+    "heading": "Pendant l'installation",
+    "intro": "ProxMenux installe et configure automatiquement les dépendances dont il a besoin :",
+    "tablePackage": "Paquet",
+    "tablePurpose": "Utilité",
+    "rows": [
+      {
+        "package": "dialog",
+        "purpose": "Menus interactifs dans le terminal"
+      },
+      {
+        "package": "curl",
+        "purpose": "Téléchargements et contrôles de connectivité"
+      },
+      {
+        "package": "jq",
+        "purpose": "Traitement JSON"
+      },
+      {
+        "package": "git",
+        "purpose": "Clonage et mise à jour des dépôts"
+      }
+    ],
+    "outro": "L’installateur télécharge aussi les scripts dans <code>/usr/local/share/proxmenux/</code> et crée le lanceur <code>/usr/local/bin/menu</code>. Le tableau de bord web <strong>ProxMenux Monitor</strong> est enregistré comme service <code>proxmenux-monitor.service</code>.",
+    "imageAlt": "Installation ProxMenux en cours"
+  },
+  "first": {
+    "heading": "Premier lancement",
+    "intro": "Une fois installé, exécutez :",
+    "code": "menu",
+    "outro": "ProxMenux s’ouvre sur le menu principal. Vous pouvez y lancer toutes les procédures documentées sur ce site. Sur un hôte Proxmox fraîchement installé, commencez par <postlink>Après l’installation</postlink>."
+  },
+  "beta": {
+    "heading": "Canal bêta",
+    "calloutTitle": "Qu'est-ce que le programme Beta?",
+    "calloutBody": "Vous souhaitez essayer les nouveautés avant leur sortie officielle et contribuer à la version finale ? Le programme bêta de ProxMenux donne accès aux nouvelles fonctionnalités, dont les dernières compilations de Monitor, depuis la branche <code>develop</code>. Les versions bêta peuvent contenir des bogues ou des fonctions incomplètes. Vos retours aident à les corriger avant la version stable.",
+    "intro": "Installez la version bêta au lieu de la version stable avec :",
+    "code": "bash -c \"$(wget -qLO - https://raw.githubusercontent.com/MacRimi/ProxMenux/develop/install_proxmenux_beta.sh)\"",
+    "outro": "La bêta est facultative : vous devez lancer explicitement son installateur. Lorsqu’une version stable est publiée, ProxMenux vous avertit au prochain lancement de <code>menu</code> et propose de basculer automatiquement. Pour quitter la bêta plus tôt, choisissez <betalink>Désactiver le programme bêta</betalink> dans les paramètres."
+  },
+  "updating": {
+    "heading": "Mise à jour",
+    "body": "ProxMenux gère ses mises à jour. Si une nouvelle version est disponible, le prochain lancement de <code>menu</code> propose de l’installer. En acceptant, vous remplacez les fichiers et la configuration de l’outil dans l’installation existante, sans téléchargement manuel. Le canal stable reçoit les versions stables, et la bêta les versions bêta, avec la proposition de bascule décrite ci-dessus. L’affichage dépend de l’endroit où vous lancez <code>menu</code> : via SSH ou dans la console Proxmox, une boîte oui/non permet d’appliquer immédiatement la mise à jour. Dans le terminal WebSocket de ProxMenux Monitor, un message informatif la remplace, car ce terminal serait interrompu pendant l’opération. Il affiche l’installateur en une ligne (<code>bash -c \"$(wget -qLO - https://raw.githubusercontent.com/MacRimi/ProxMenux/main/install_proxmenux.sh)\"</code> pour stable, ou l’URL correspondante de <code>install_proxmenux_beta.sh</code> pour bêta), à exécuter via SSH ou dans la console."
+  },
+  "uninstall": {
+    "heading": "Désinstallation",
+    "body": "Dans ProxMenux : <strong>Paramètres → Désinstaller ProxMenux</strong>. La désinstallation supprime l’arborescence des scripts, le lanceur et le service Monitor, ainsi que les dépendances sélectionnées si vous le souhaitez. Elle restaure <code>/root/.bashrc</code> et <code>/etc/motd</code> depuis les sauvegardes créées par Post-Install, si elles existent (sinon, elle supprime la ligne ProxMenux du MOTD). Procédure complète : <uninstalllink>Désinstaller ProxMenux</uninstalllink>."
+  },
+  "troubleshoot": {
+    "heading": "Dépannage",
+    "virustotalTitle": "VirusTotal signale l’URL d’installation comme suspecte",
+    "virustotalBody": "Le résultat de 1/95 attribué à <em>Chong Lua Dao</em> et signalé dans l’issue #162 a été identifié par le mainteneur comme un faux positif. L’installateur est lancé par une commande qui télécharge puis exécute le script (<code>bash -c \"$(wget -qLO - …)\"</code>) et peut télécharger <code>jq</code> depuis sa version officielle sur GitHub. Ce <em>comportement</em> peut déclencher des analyses heuristiques ; ce rapport historique ne préjuge pas de tous les téléchargements futurs. Le code de l’installateur est ouvert et vérifiable. Plus de contexte dans l’<issuelink>issue #162</issuelink>.",
+    "aptTitle": "L'installation échoue avec les erreurs apt",
+    "aptBody": "Il s’agit généralement d’un dépôt Proxmox absent ou mal configuré. L’installateur utilise apt pour obtenir ses dépendances ; une mauvaise configuration des dépôts fait échouer apt. Cela arrive notamment sur des installations minimales de Proxmox 8 non encore mises à jour. Exécutez d’abord <code>apt-get update</code> manuellement, corrigez les erreurs, puis relancez l’installateur.",
+    "menuTitle": "`menu: command not found` après installation",
+    "menuBody": "Le lanceur se trouve dans <code>/usr/local/bin/menu</code>. Vérifiez sa présence avec <code>ls -lh /usr/local/bin/menu</code>. S’il manque, l’installation s’est arrêtée trop tôt : relancez-la. S’il existe mais que la commande est introuvable, PATH ne contient pas <code>/usr/local/bin</code>. Corrigez PATH ou lancez directement <code>/usr/local/bin/menu</code>.",
+    "stuckTitle": "L’installation se bloque ou ne progresse pas",
+    "stuckBody": "Si une installation, une réinstallation ou une mise à jour est bloquée en raison d'un problème de connexion, annulez avec <strong>Ctrl + C</strong> et réexécutez l'installateur manuellement.",
+    "otherTitle": "Autres problèmes",
+    "otherBody": "Consultez <issueslink>GitHub Issues</issueslink> pour les problèmes connus, ou ouvrez une issue avec les journaux utiles. Si vous utilisez la bêta et que le problème concerne Monitor, ajoutez la sortie de <code>journalctl -u proxmenux-monitor -n 50</code>."
+  },
+  "next": {
+    "heading": "Suivant",
+    "postInstall": "<postlink>Script de post-installation</postlink> — réglages et renforcement de la sécurité d’un hôte Proxmox fraîchement installé.",
+    "introduction": "<introlink>Introduction</introlink> — présentation complète des fonctionnalités.",
+    "monitor": "<monitorlink>ProxMenux Monitor</monitorlink> — tableau de bord web pour l'hôte (auto-installé à côté du menu)."
+  },
+  "requirements": {
+    "heading": "Exigences et bonnes pratiques",
+    "reqTitle": "Exigences",
+    "reqBody": "Proxmox VE <strong>8.x ou ultérieur</strong>. PVE 7 et les versions antérieures ne sont pas pris en charge. L’hôte doit avoir accès à Internet pour télécharger les scripts, les dépendances et l’AppImage de ProxMenux Monitor. Exécutez l’installateur en tant que <strong>root</strong> sur l’hôte Proxmox.",
+    "inspectTitle": "Inspectez toujours les scripts que vous utilisez depuis Internet",
+    "inspectReview": "<sourcelink>Examinez le code source de l’installateur</sourcelink> avant de le lancer.",
+    "inspectCoc": "Tous les liens exécutables suivent le <coclink>code de conduite de ProxMenux</coclink>."
+  }
+}
diff --git a/web/messages/fr/docs/introduction.json b/web/messages/fr/docs/introduction.json
new file mode 100644
index 00000000..2bba4cb5
--- /dev/null
+++ b/web/messages/fr/docs/introduction.json
@@ -0,0 +1,206 @@
+{
+  "meta": {
+    "title": "ProxMenux — Gérer Proxmox VE par menus | Open source",
+    "description": "Outil open source de gestion de Proxmox VE par menus. ProxMenux réunit deux composants : une CLI/TUI pour les réglages après installation, les VM et conteneurs LXC, le passthrough GPU et Coral TPU, les disques, le stockage et le réseau ; et un tableau de bord web auto-hébergé avec surveillance proactive, notifications Telegram, Discord ou e-mail, reformulation par IA et API REST.",
+    "ogTitle": "ProxMenux — Gérer Proxmox VE par menus",
+    "ogDescription": "CLI/TUI open source et tableau de bord web pour Proxmox VE : réglages après installation, VM, GPU, disques, réseau, stockage et sécurité. Un Monitor distinct ajoute la surveillance, les notifications, la reformulation par IA et une API REST.",
+    "twitterTitle": "ProxMenux — Gérer Proxmox VE par menus",
+    "twitterDescription": "CLI/TUI open source et tableau de bord web pour Proxmox VE. Surveillance, notifications, reformulation par IA et API REST."
+  },
+  "header": {
+    "title": "Présentation",
+    "description": "ProxMenux est un outil open source de gestion de Proxmox VE par menus. Le projet réunit deux composants : une CLI/TUI pour les tâches courantes liées à l’hôte, aux VM, aux conteneurs, au stockage, au réseau et à la sécurité ; et un tableau de bord web auto-hébergé avec surveillance proactive, notifications, reformulation facultative par IA et API REST.",
+    "section": "Présentation"
+  },
+  "hero": {
+    "tagline": "<strong>Un menu pour toutes les tâches.</strong> Ce qui demande habituellement un onglet wiki, deux discussions de forum et une suite de commandes à copier-coller devient une option numérotée à lancer en quelques secondes.",
+    "audience": "Conçu pour les utilisateurs <em>débutants</em> de Proxmox, avec des réglages par défaut sûrs et prédéfinis, et les administrateurs <em>expérimentés</em>, qui gagnent du temps sur les tâches répétitives. Gratuit et open source, avec une communauté active sur <github>GitHub</github>."
+  },
+  "twoProducts": {
+    "heading": "Deux produits, un projet",
+    "intro": "ProxMenux comprend deux composants dans le même arbre de sources. L’installateur déploie les deux sur l’hôte : Scripts fournit l’interface de terminal et Monitor le tableau de bord web :",
+    "scripts": {
+      "title": "ProxMenux Scripts",
+      "body": "La CLI/TUI d’origine, à lancer avec <code>menu</code>. Neuf domaines couvrent les optimisations après installation, les VM et conteneurs LXC, le passthrough GPU et Coral TPU, les disques, le stockage, le réseau, la sécurité et les utilitaires, avec une sélection de commandes de référence. Fonctionne dans un terminal local, SSH ou web."
+    },
+    "monitor": {
+      "title": "ProxMenux Monitor",
+      "body": "Tableau de bord web auto-hébergé, distribué en AppImage. Métriques de l’hôte en temps réel, surveillance proactive, notifications, reformulation facultative par IA avec six fournisseurs, terminal web intégré et API REST. À activer dans le menu Scripts, sous Paramètres → ProxMenux Monitor."
+    },
+    "calloutTitle": "Sur quoi ProxMenux intervient",
+    "calloutIntro": "Trois couches, toutes accessibles du même projet :",
+    "layers": [
+      "<strong>L’hôte Proxmox</strong> — dépôts, paquets, réseau, ZFS, Ceph, noyau et observabilité.",
+      "<strong>Les machines virtuelles (VM)</strong> — création, passthrough GPU, import et export OVA/OVF, accès direct aux disques.",
+      "<strong>Les conteneurs LXC</strong> — création, points de montage, passthrough GPU/TPU, clients et serveurs NFS/Samba."
+    ]
+  },
+  "scriptsSection": {
+    "heading": "ProxMenux Scripts — ce que vous obtenez",
+    "intro": "Neuf zones fonctionnelles, chacune avec son propre menu à l'intérieur de <code>menu</code> et une page de détail dans la documentation. Cliquez sur n'importe quelle carte pour sauter directement à l'aperçu de cette section.",
+    "items": [
+      {
+        "title": "Après l'installation",
+        "description": "Optimisations d’une nouvelle installation Proxmox : dépôts, noyau, synchronisation horaire, sécurité de base et performances, avec des options réversibles.",
+        "icon": "Server",
+        "href": "/docs/post-install"
+      },
+      {
+        "title": "GPU et Coral TPU",
+        "description": "Passthrough des GPU NVIDIA, Intel iGPU, AMD et des Coral TPU vers les VM et conteneurs LXC, avec basculement entre les modes VM et LXC.",
+        "icon": "Cpu",
+        "href": "/docs/hardware/nvidia-host"
+      },
+      {
+        "title": "Créer VM",
+        "description": "Assistants pour les systèmes NAS, Windows et Linux, avec des valeurs par défaut adaptées au matériel, au stockage et au réseau.",
+        "icon": "Server",
+        "href": "/docs/create-vm"
+      },
+      {
+        "title": "Gestionnaire de disque",
+        "description": "Accès aux disques physiques depuis les VM et LXC, formatage et effacement, tests SMART et import d’images qcow2, vmdk ou vdi, depuis un menu.",
+        "icon": "HardDrive",
+        "href": "/docs/disk-manager"
+      },
+      {
+        "title": "Stockage et partage",
+        "description": "Déclarer des stockages NFS, Samba/CIFS, iSCSI et locaux dans Proxmox ; partager des dossiers entre l’hôte et les conteneurs LXC via des montages bind ou des protocoles réseau.",
+        "icon": "Boxes",
+        "href": "/docs/storage-share"
+      },
+      {
+        "title": "Réseau",
+        "description": "Diagnostics sans modification, analyse suivie de suggestions et réparations guidées de /etc/network/interfaces. Des sauvegardes sont créées avant les changements.",
+        "icon": "Network",
+        "href": "/docs/network"
+      },
+      {
+        "title": "Sécurité",
+        "description": "Fail2Ban pour protéger SSH et les interfaces web contre les tentatives d’intrusion, et Lynis pour auditer le durcissement du système : installation et gestion avec des valeurs par défaut adaptées.",
+        "icon": "Shield",
+        "href": "/docs/security"
+      },
+      {
+        "title": "Utilitaires",
+        "description": "Créer des ISO Windows avec UUP Dump, installer des outils CLI, effectuer une mise à jour système guidée ou passer de PVE 8 à 9, et exporter ou importer des VM OVA/OVF.",
+        "icon": "Wrench",
+        "href": "/docs/utils"
+      },
+      {
+        "title": "Référence des commandes",
+        "description": "Une sélection de commandes Linux et Proxmox classées par thème : système, VM/CT avec qm et pct, stockage, réseau, ZFS, passthrough GPU, sauvegarde et outils CLI du quotidien.",
+        "icon": "BookOpen",
+        "href": "/docs/help-info"
+      }
+    ]
+  },
+  "monitorSection": {
+    "heading": "ProxMenux Monitor — ce que vous obtenez",
+    "intro": "Le tableau de bord web est hébergé sur l’hôte Proxmox, sur le port TCP 8008. Cliquez sur une carte pour ouvrir la page correspondante ou commencez par la <link>présentation de Monitor</link>.",
+    "items": [
+      {
+        "title": "Surveillance de l’état du système",
+        "description": "Dix catégories sont vérifiées toutes les cinq minutes : CPU, mémoire, stockage, disques/SMART, réseau, VM, services, journaux, mises à jour et sécurité. Avec niveaux de gravité et désactivation des alertes par catégorie.",
+        "icon": "Activity",
+        "href": "/docs/monitor/health-monitor"
+      },
+      {
+        "title": "Notifications",
+        "description": "Telegram, Discord, e-mail, Gotify, Pushover et Apprise multicanal : dédoublonnage, délai minimal entre envois, regroupement des alertes rapprochées, plages de silence et historique complet.",
+        "icon": "Bell",
+        "href": "/docs/monitor/notifications"
+      },
+      {
+        "title": "Assistant AI",
+        "description": "Reformulation facultative des notifications en langage clair. Six fournisseurs : OpenAI, Anthropic Claude, Google Gemini, Groq, OpenRouter et Ollama en local. Treize langues dans le sélecteur de langue de l’IA.",
+        "icon": "Sparkles",
+        "href": "/docs/monitor/ai-assistant"
+      },
+      {
+        "title": "Terminal Web",
+        "description": "Un shell interactif sur l’hôte Proxmox depuis le navigateur, ainsi qu’un terminal ProxMenux Scripts distinct pour exécuter le menu dans l’interface web.",
+        "icon": "Terminal",
+        "href": "/docs/monitor/dashboard/terminal"
+      },
+      {
+        "title": "REST API",
+        "description": "Points de terminaison HTTP pour le système, son état, le stockage/SMART, le réseau, les VM, les notifications et la sécurité, utilisables avec Homepage, Home Assistant, Prometheus ou des scripts personnalisés.",
+        "icon": "Code2",
+        "href": "/docs/monitor/api"
+      },
+      {
+        "title": "Intégrations",
+        "description": "Webhook natif Proxmox VE, collecte de métriques par Prometheus, sondes Uptime Kuma, widgets Homepage, Home Assistant et Glance, automatisations n8n/Zapier et Tailscale Secure Gateway.",
+        "icon": "Plug",
+        "href": "/docs/monitor/integrations"
+      }
+    ]
+  },
+  "installPaths": {
+    "heading": "Options d’installation",
+    "intro": "Les deux installateurs déploient Scripts et Monitor. Scripts utilise des catalogues JSON préétablis en huit langues, sans traduction en ligne. Choisissez le canal stable ou bêta ; Monitor est distribué en AppImage et s’exécute depuis son environnement extrait :",
+    "headerPath": "Install path",
+    "headerBundles": "Ce qui est inclus",
+    "headerWhen": "Quand le choisir",
+    "rows": [
+      {
+        "pathRich": "<strong>Scripts : stable</strong>",
+        "bundles": "CLI/TUI avec traductions JSON préétablies en huit langues, sans environnement virtuel ni service de traduction en ligne.",
+        "when": "Utilisation courante avec le canal stable."
+      },
+      {
+        "pathRich": "<strong>Scripts : bêta</strong>",
+        "bundles": "La même interface multilingue, installée depuis la branche develop pour tester les prochaines évolutions.",
+        "when": "Test anticipé de nouvelles fonctions, avec un risque accru de bugs."
+      },
+      {
+        "pathRich": "<strong>Monitor</strong>",
+        "bundles": "AppImage autonome avec tableau de bord web sur le port TCP 8008. L’installateur extrait son environnement d’exécution et gère le service ; Monitor se contrôle depuis les paramètres.",
+        "when": "Pour consulter l’hôte depuis un tableau de bord web sur téléphone, tablette ou navigateur."
+      }
+    ],
+    "outro": "Les commandes et prérequis détaillés figurent sur la <link>page d’installation</link>."
+  },
+  "warnSource": {
+    "title": "Vérifiez toujours les scripts provenant d’Internet avant de les exécuter",
+    "body": "ProxMenux est open source et chaque script peut être examiné sur GitHub. Consultez le code source avant d’exécuter la commande d’installation. Faites de même avec les autres outils d’automatisation.",
+    "sourceLabel": "Afficher la source ProxMenux",
+    "cocLabel": "Code de conduite"
+  },
+  "next": {
+    "heading": "Pour continuer",
+    "items": [
+      {
+        "lead": "<strong>Vous découvrez ProxMenux ?</strong> ",
+        "linkHref": "/docs/installation",
+        "linkLabel": "Installez-le avec une seule commande",
+        "tailRich": " puis lancez <code>menu</code>."
+      },
+      {
+        "lead": "<strong>Vous venez d’installer Proxmox ?</strong> Commencez par le ",
+        "linkHref": "/docs/post-install",
+        "linkLabel": "script de post-installation",
+        "tail": "."
+      },
+      {
+        "lead": "<strong>Vous souhaitez un tableau de bord web ?</strong> ",
+        "linkHref": "/docs/monitor",
+        "linkLabel": "ProxMenux Monitor",
+        "tail": " dispose d’une documentation qui présente son contenu, son architecture et sa sécurisation."
+      },
+      {
+        "lead": "<strong>Vous cherchez une commande précise ?</strong> La ",
+        "linkHref": "/docs/help-info",
+        "linkLabel": "référence des commandes",
+        "tail": " propose une sélection classée par thème, avec des boutons de copie."
+      },
+      {
+        "lead": "<strong>Vous souhaitez des guides plus détaillés ?</strong> La ",
+        "linkHref": "/guides",
+        "linkLabel": "section des guides",
+        "tail": " couvre Coral TPU, le passthrough NVIDIA, Kodi dans LXC et d’autres sujets."
+      }
+    ]
+  }
+}
diff --git a/web/messages/fr/docs/network/backup-restore.json b/web/messages/fr/docs/network/backup-restore.json
new file mode 100644
index 00000000..5273c0c9
--- /dev/null
+++ b/web/messages/fr/docs/network/backup-restore.json
@@ -0,0 +1,110 @@
+{
+  "meta": {
+    "title": "Sauvegarde et redémarrage des interfaces | Documentation ProxMenux",
+    "description": "Capture manuelle, navigation et restauration des sauvegardes /etc/network/interfaces stockées sous /var/backups/proxmenux/. Comprend un redémarrage du service réseau avec confirmation et une vue rapide de la configuration en direct.",
+    "ogTitle": "Sauvegarde et redémarrage des interfaces | Documentation ProxMenux",
+    "ogDescription": "Créez un instantané de la configuration réseau Proxmox et restaurez-la ; redémarrez le service réseau avec confirmation."
+  },
+  "header": {
+    "title": "Sauvegarde et redémarrage des interfaces",
+    "description": "Quatre utilitaires qui tournent autour de /etc/network/interfaces: prennent un instantané manuel, visualisent la configuration en direct, restaurent une sauvegarde précédente avec prévisualisation optionnelle et redémarrent le service de réseautage avec un consentement explicite. Même répertoire de sauvegarde utilisé par les flux de réparation guidés.",
+    "section": "Réseau"
+  },
+  "intro": {
+    "title": "Ce que ça fait",
+    "body": "Gère le même répertoire de sauvegarde utilisé par les flux de réparation guidés (<code>/var/backups/proxmenux/</code>). Permet de prendre un instantané supplémentaire avant tout changement manuel, de parcourir toutes les sauvegardes existantes, et de revenir à l'une d'entre elles — toujours avec une nouvelle sauvegarde pré-restauration prise automatiquement comme deuxième filet de sécurité."
+  },
+  "shared": {
+    "heading": "Le répertoire de sauvegarde partagé",
+    "intro": "Chaque sauvegarde prise n'importe où dans le menu Réseau atterrit au même endroit :",
+    "outro": "Les noms de fichiers sont horodatés, triés par date et jamais écrasés. Le répertoire est créé lors de la première utilisation."
+  },
+  "show": {
+    "heading": "Afficher le fichier de configuration réseau",
+    "body": "Affiche le contenu exact de <code>/etc/network/interfaces</code> dans le terminal. En lecture seule. Utile pour vérifier la configuration avant une sauvegarde ou après une restauration. Il n’existe pas d’outil distinct pour comparer avec la sauvegarde précédente ; examiner le fichier actuel est donc le moyen le plus simple de confirmer son contenu."
+  },
+  "create": {
+    "heading": "Créer une sauvegarde réseau",
+    "body": "Copie le <code>/etc/network/interfaces</code> actuel dans le répertoire de sauvegarde avec un nouvel horodatage. C'est tout — pas d'analyse, pas d'invite, juste un instantané.",
+    "whenTitle": "Quand prendre une sauvegarde manuelle",
+    "whenBody": "Avant de modifier <code>/etc/network/interfaces</code> à la main, d’installer un paquet pouvant toucher la pile réseau (par exemple NetworkManager ou Open vSwitch), ou de changer le matériel. Les réparations guidées créent déjà automatiquement un instantané — cette option sert aux opérations <em>manuelles</em>."
+  },
+  "restore": {
+    "heading": "Restaurer la sauvegarde réseau",
+    "intro": "Liste les sauvegardes de <code>/var/backups/proxmenux/</code>, de la plus récente à la plus ancienne, et guide une restauration avec des garde-fous :",
+    "steps": [
+      {
+        "title": "1. Choisir une sauvegarde",
+        "body": "Un menu liste chaque sauvegarde par son horodatage. S'il n'y a pas de sauvegardes, le flux sort avec un message clair.",
+        "tone": "blue"
+      },
+      {
+        "title": "2. Aperçu facultatif",
+        "body": "Offre d'ouvrir la sauvegarde sélectionnée dans une vue défilante avant de s'engager. Oui par défaut — ne le sautez pas sur un hôte distant.",
+        "tone": "blue"
+      },
+      {
+        "title": "3. Sauvegarde avant restauration",
+        "body": "Avant d'écraser <code>/etc/network/interfaces</code>, prend <strong> une autre sauvegarde </strong> de l'état actuel. La restauration d'une sauvegarde est elle-même une action destructrice, de sorte que le nouvel instantané pré-restauration vous permet de revenir si la sauvegarde choisie s'avère être la mauvaise.",
+        "tone": "amber"
+      },
+      {
+        "title": "4. Appliquer la restauration",
+        "body": "Copie la sauvegarde choisie sur <code>/etc/network/interfaces</code>. Le changement de fichier est sur disque; l'état du noyau en direct reflète toujours la configuration précédente.",
+        "tone": "amber"
+      },
+      {
+        "title": "5. Redémarrage facultatif",
+        "body": "Demande s’il faut exécuter <code>systemctl restart networking</code> maintenant. Refusez pour reporter l’application au prochain redémarrage.",
+        "tone": "emerald"
+      }
+    ],
+    "autoBackupTitle": "Une restauration prend sa propre sauvegarde automatiquement",
+    "autoBackupBody": "Sélectionner <em>Restaurer la sauvegarde réseau</em> crée toujours un nouvel instantané de la configuration <em>actuelle</em> avant de l’écraser. Si vous restaurez la mauvaise sauvegarde, le fichier le plus récent dans <code>/var/backups/proxmenux/</code> contient l’état précédent."
+  },
+  "restart": {
+    "heading": "Redémarrer le service réseau",
+    "body": "Exécute <code>systemctl restart networking</code> après confirmation oui/non. Affiche le résultat avec <code>msg_ok</code> / <code>msg_error</code>. La plupart des procédures de ce menu proposent déjà un redémarrage à la fin ; cette option sert après une modification manuelle ou si vous avez refusé le redémarrage proposé auparavant.",
+    "warnTitle": "Brève déconnexion garantie; possibilité de déconnexion permanente",
+    "warnBody": "Redémarrer <code>networking</code> désactive puis reconfigure chaque interface déclarée dans <code>/etc/network/interfaces</code>. Les sessions SSH passant par ces interfaces sont interrompues. Si la nouvelle configuration est invalide, le réseau ne revient pas. N’exécutez cette opération que si :",
+    "warnItems": [
+      "Vous avez la console / IPMI / accès iKVM prêt, <em>ou</em>",
+      "Vous êtes physiquement à côté de la machine, <em> ou</em>",
+      "Vous venez de restaurer avec succès une configuration dont le bon fonctionnement est connu et souhaitez l’appliquer."
+    ]
+  },
+  "manualRollback": {
+    "heading": "Retour manuel depuis une console",
+    "intro": "Si vous ne pouvez pas accéder au menu (pas de SSH, plantage de dialog, …) mais disposez d’une console, deux commandes suffisent pour revenir en arrière :",
+    "outro": "C’est la <em>même</em> opération que celle du menu, simplement saisie à la main. Si <code>networking</code> ne démarre toujours pas, consultez <code>journalctl -u networking -b</code> pour identifier l’erreur de syntaxe ou de pilote."
+  },
+  "troubleshoot": {
+    "heading": "Dépannage",
+    "noneTitle": "« Aucune sauvegarde trouvée » lors de la restauration",
+    "noneBody": "Le répertoire <code>/var/backups/proxmenux/</code> n’existe pas ou ne contient aucun fichier <code>interfaces_backup_*</code>. Exécutez <em>Créer une sauvegarde réseau</em> au moins une fois ou lancez une réparation guidée, qui crée automatiquement une sauvegarde. Vérifiez avec <code>ls /var/backups/proxmenux/</code>.",
+    "unreachTitle": "Le redémarrage du réseau réussit, mais l’hôte reste inaccessible",
+    "unreachBody": "La nouvelle configuration est incorrecte ou n’attribue pas votre adresse IP de gestion. Revenez en arrière depuis la console (voir ci-dessus). Utilisez ensuite <bridgeLink>l’analyse des ponts</bridgeLink> et <configLink>l’analyse de configuration</configLink> pour comprendre le problème avant de réappliquer la configuration.",
+    "emptyTitle": "L’aperçu de restauration affiche un fichier vide",
+    "emptyBody": "Le fichier de sauvegarde est vide (0 octet). Cela arrive si une copie a échoué silencieusement lors d’une exécution précédente. Choisissez une sauvegarde plus ancienne ou relancez <em>Créer une sauvegarde réseau</em> maintenant si la configuration actuelle fonctionne."
+  },
+  "related": {
+    "heading": "Voir aussi",
+    "items": [
+      {
+        "label": "Analyse des ponts et réparation guidée",
+        "href": "/docs/network/bridge-analysis",
+        "tail": "— la raison la plus courante pour laquelle une sauvegarde se termine ici."
+      },
+      {
+        "label": "Analyse de configuration et nettoyage guidé",
+        "href": "/docs/network/config-analysis",
+        "tailRich": "— écrit également à <code>/var/backups/proxmenux/</code> automatiquement."
+      },
+      {
+        "label": "Diagnostic",
+        "href": "/docs/network/diagnostics",
+        "tail": " — pour vérifier l’état actuel après une restauration."
+      }
+    ]
+  }
+}
diff --git a/web/messages/fr/docs/network/bridge-analysis.json b/web/messages/fr/docs/network/bridge-analysis.json
new file mode 100644
index 00000000..7a5a5903
--- /dev/null
+++ b/web/messages/fr/docs/network/bridge-analysis.json
@@ -0,0 +1,132 @@
+{
+  "meta": {
+    "title": "Analyse des ponts et réparation guidée | Documentation ProxMenux",
+    "description": "Détecte les ponts vmbrX dont les ports physiques sont absents ou invalides, généralement après une réénumération PCI. Les signale avec des commandes shell proposées et offre une réparation guidée en 5 étapes avec sauvegarde obligatoire.",
+    "ogTitle": "Analyse des ponts et réparation guidée | Documentation ProxMenux",
+    "ogDescription": "Vérifiez et réparez les ports des ponts Proxmox après des changements matériels, avec une procédure guidée permettant un retour en arrière sûr."
+  },
+  "header": {
+    "title": "Analyse des ponts et réparation guidée",
+    "description": "Examine chaque pont vmbrX déclaré dans /etc/network/interfaces, vérifie l’existence de ses ports physiques et propose une réparation étape par étape s’ils sont absents. L’analyse est en lecture seule ; la réparation nécessite un accord, présente un aperçu et crée une sauvegarde.",
+    "section": "Réseau"
+  },
+  "intro": {
+    "title": "Ce que ça fait",
+    "body": "Lit chaque pont dans <code>/etc/network/interfaces</code>, examine sa ligne <code>bridge-ports</code> et vérifie l’existence de chaque port déclaré, par exemple <code>enp3s0</code>, sur l’hôte. Si un port manque, propose un remplacement et applique la modification avec un consentement explicite selon la procédure <strong>sauvegarder, prévisualiser, appliquer, vérifier</strong>."
+  },
+  "when": {
+    "heading": "Quand vous en avez besoin",
+    "intro": "Linux attribue des noms d'interface prévisibles à partir de la topologie PCI et de l'ordre des fentes. Plusieurs événements les mélangent et laissent <code>/etc/network/interfaces</code> se référant à des noms qui n'existent plus :",
+    "items": [
+      "Ajouter ou retirer une carte PCIe (une carte NIC, un GPU, un HBA, un support NVMe).",
+      "Déplacement d'une carte existante vers une autre fente PCIe.",
+      "Mises à jour du BIOS / UEFI qui réénumèrent les périphériques PCI.",
+      "Migrer le disque de démarrage vers différents matériels."
+    ],
+    "outro": "Après le prochain démarrage, le pont tente de se fixer à un port qui n'existe plus, ne parvient pas à monter, et l'hôte perd son réseau. <link>Les noms d'interface persistants</link> empêchent cela de se reproduire — mais si vous êtes déjà verrouillé, cette page est le chemin de récupération."
+  },
+  "bigPicture": {
+    "heading": "La situation générale",
+    "diagram1": {
+      "arrowLabel": "étape 1",
+      "nodes": {
+        "sourceLabel": "/etc/network/interfaces",
+        "sourceDetail": "auto vmbr0\niface vmbr0 inet static\n  bridge-ports enp3s0",
+        "bridgeLabel": "Analyser (lecture seule)",
+        "bridgeDetail": "ip link show enp3s0\n→ n’existe pas",
+        "targetLabel": "Rapport + suggestion",
+        "targetDetail": "❌ enp3s0 : INTROUVABLE\nRemplacer par : eno1\n(pas encore de modification)"
+      }
+    },
+    "diagram2": {
+      "arrowLabel": "appliquer avec sauvegarde",
+      "nodes": {
+        "sourceLabel": "Réparation guidée",
+        "sourceDetail": "1. Sauvegarder\n2. Afficher l’état actuel\n3. Prévisualiser les modifications\n4. Appliquer\n5. Vérifier",
+        "targetLabel": "/etc/network/interfaces (nouveau)",
+        "targetDetail": "auto vmbr0\niface vmbr0 inet static\n  bridge-ports eno1"
+      }
+    }
+  },
+  "step1": {
+    "heading": "Étape 1: analyse (lecture seule)",
+    "intro": "Sélectionner <strong>Analyser la configuration des ponts</strong> arrête immédiatement l’outil si l’hôte n’utilise pas la pile classique Debian/Proxmox. Sinon, il examine chaque pont et indique :",
+    "items": [
+      "Nom du pont, état actuel (UP / DOWN), IP assigné.",
+      "Chaque port déclaré et s'il existe actuellement (<code>ip link show &lt;port&gt;</code>).",
+      "Pour chaque port invalide : un remplacement proposé (la première interface physique disponible) plus la commande exacte <code>sed</code> pour l'appliquer manuellement.",
+      "Ponts sans <code>bridge-ports</code> du tout et entrées orphelines <code>auto</code> (pas de bloc correspondant <code>iface</code>)."
+    ],
+    "readonlyTitle": "Garantie en lecture seule",
+    "readonlyBody": "Jusqu'à ce point, le script n'a pas exécuté une seule commande de modification. Vous pouvez laisser l'analyse ouverte, copier les commandes <code>sed</code> suggérées et les appliquer manuellement si vous préférez — ou accepter l'invite suivante pour entrer dans la réparation guidée."
+  },
+  "step2": {
+    "heading": "Étape 2 : réparation guidée (5 étapes)",
+    "intro": "Accessible uniquement si vous acceptez la proposition à la fin de l’analyse. Chaque étape présente l’action prévue et demande une confirmation avant de continuer.",
+    "steps": [
+      {
+        "title": "1. Sauvegarde de sécurité",
+        "body": "Copie <code>/etc/network/interfaces</code> vers <code>/var/backups/proxmenux/interfaces_backup_&lt;TIMESTAMP&gt;</code>. Le chemin exact de sauvegarde est affiché avant la copie et à nouveau après, avec la commande rollback.",
+        "tone": "blue"
+      },
+      {
+        "title": "2. Examiner la configuration actuelle",
+        "body": "Ouvre le fichier actuel <code>/etc/network/interfaces</code> dans une boîte de dialogue avec défilement pour voir exactement ce qui va être modifié.",
+        "tone": "blue"
+      },
+      {
+        "title": "3. Aperçu des modifications proposées",
+        "body": "Liste précisément les ponts concernés et les remplacements de ports prévus. Si aucune réparation n’est plus nécessaire parce que le port est réapparu entre les vérifications, la procédure se termine avec <em>« Aucune modification nécessaire. »</em>",
+        "tone": "blue"
+      },
+      {
+        "title": "4. Appliquer les modifications",
+        "body": "Pour chaque pont touché, exécute <code>sed -i \"/iface $bridge/,/bridge-ports/ s/bridge-ports.*/bridge-ports $new_ports/\"</code> contre <code>/etc/network/interfaces</code>. Si un pont n'avait pas de remplacement valide disponible, la substitution est ignorée et signalée à l'étape 5.",
+        "tone": "amber"
+      },
+      {
+        "title": "5. Vérification",
+        "body": "Relit le fichier et confirme l’existence du nouveau port de chaque pont. Affiche la commande de retour en arrière (<code>cp &lt;backup&gt; /etc/network/interfaces</code>). Propose enfin <strong>Redémarrer le réseau</strong> : n’acceptez que si vous disposez d’un accès de secours à la console.",
+        "tone": "emerald"
+      }
+    ],
+    "restartTitle": "Redémarrer le réseau ≠ annuler sans risque",
+    "restartBody": "La réparation est écrite sur le disque, même si vous ne redémarrez pas le service. <code>systemctl restart networking</code> applique la modification <em>maintenant</em>, ce qui peut interrompre votre session SSH si le nouveau port est incorrect. En cas de refus, la modification prendra quand même effet au prochain redémarrage : vérifiez d’abord la configuration ou revenez en arrière avec la commande affichée."
+  },
+  "edits": {
+    "heading": "Ce qui est édité (exactement)",
+    "body": "Uniquement la ligne <code>bridge-ports</code> de chaque pont concerné. Les autres directives (<code>address</code>, <code>netmask</code>, <code>gateway</code>, <code>bridge-stp</code>, …) restent intactes. Le script ne crée ni ne supprime de blocs <code>iface</code> dans cette procédure : c’est le rôle de <link>l’analyse de configuration &amp; du nettoyage</link>."
+  },
+  "troubleshoot": {
+    "heading": "Dépannage",
+    "unsupportedTitle": "L’analyse s’arrête avec « Pile réseau non prise en charge »",
+    "unsupportedBody": "L'hôte exécute netplan, systemd-networkd ou NetworkManager. L'outil ne prend en charge que <code>/etc/network/interfaces</code>. Passez d'abord l'hôte à la pile classique ou modifiez la configuration avec l'outil natif du gestionnaire (p. ex. <code>netplan apply</code>).",
+    "noSuggestTitle": "Aucune suggestion n'est imprimée pour un port invalide",
+    "noSuggestBody": "L'hôte a zéro interfaces physiques libres (tout est déjà dans un autre pont ou n'existe pas). L'analyse revient à suggérer <code>bridge-ports none</code> afin que le pont puisse au moins monter sans port. Ajouter un NIC ou migrer les ports entre les ponts manuellement avant de recommencer.",
+    "stillDownTitle": "La réparation s'achève mais le pont est toujours DOWN",
+    "stillDownBody": "<code>sed</code> a mis à jour le fichier, mais <code>systemctl restart networking</code> a été refusé. Exécutez-le manuellement une fois que la nouvelle configuration est vérifiée, ou redémarrez. Si le redémarrage a été accepté et que le pont est toujours DOWN, exécutez <code>ip link show</code> pour confirmer l'existence du nouveau port, puis vérifiez <code>journalctl -u networking</code> pour l'erreur réelle (câble débranché, lien non négocié, port déjà membre d'un autre pont).",
+    "lostSshTitle": "J'ai perdu l'accès SSH juste après le redémarrage du réseau",
+    "lostSshIntro": "Utilisez console / IPMI / iKVM pour atteindre l'hôte. Restaurer la sauvegarde :",
+    "lostSshOutro": "Relancez ensuite l’analyse depuis la console pour comprendre pourquoi la suggestion n’a pas fonctionné, généralement parce que le port de remplacement n’est pas branché."
+  },
+  "related": {
+    "heading": "Voir aussi",
+    "items": [
+      {
+        "label": "Noms d'interface persistants",
+        "href": "/docs/network/persistent-names",
+        "tail": "— épingler les noms aux adresses MAC afin que ce scénario cesse de se produire."
+      },
+      {
+        "label": "Analyse de configuration et nettoyage guidé",
+        "href": "/docs/network/config-analysis",
+        "tailRich": "— pour les blocs orphelins de <code>iface</code> (l'autre moitié du même problème)."
+      },
+      {
+        "label": "Sauvegarde et redémarrage des interfaces",
+        "href": "/docs/network/backup-restore",
+        "tail": "— les instantanés manuels et le navigateur de restauration."
+      }
+    ]
+  }
+}
diff --git a/web/messages/fr/docs/network/config-analysis.json b/web/messages/fr/docs/network/config-analysis.json
new file mode 100644
index 00000000..1ada39d6
--- /dev/null
+++ b/web/messages/fr/docs/network/config-analysis.json
@@ -0,0 +1,122 @@
+{
+  "meta": {
+    "title": "Analyse de configuration et nettoyage guidé | Documentation ProxMenux",
+    "description": "Détecte les blocs iface de /etc/network/interfaces qui font référence à des cartes réseau physiques absentes de l’hôte. Les signale et propose une suppression guidée en 5 étapes avec sauvegarde obligatoire et aperçu de chaque bloc.",
+    "ogTitle": "Analyse de configuration et nettoyage guidé | Documentation ProxMenux",
+    "ogDescription": "Trouver et supprimer les blocs d'interface orphelins laissés derrière par les changements matériels, avec prévisualisation complète et retour."
+  },
+  "header": {
+    "title": "Analyse de configuration et nettoyage guidé",
+    "description": "Examine chaque bloc iface de /etc/network/interfaces et vérifie que la carte réseau physique correspondante existe toujours. Signale les blocs orphelins laissés par des changements matériels et propose une suppression guidée avec sauvegarde, aperçu et confirmation de chaque bloc.",
+    "section": "Réseau"
+  },
+  "intro": {
+    "title": "Ce que ça fait",
+    "body": "Identifie les déclarations <code>iface</code> dont le support NIC n'est plus présent sur l'hôte (typique après le remplacement ou la suppression d'une carte réseau). Ensuite, offre un nettoyage guidé qui supprime <em>seulement</em> les blocs orphelins, avec une sauvegarde, un aperçu par section et une confirmation finale explicite."
+  },
+  "differs": {
+    "heading": "Comment il diffère de l'analyse de pont",
+    "headerAspect": "Aspect",
+    "headerBridge": "Analyse des ponts",
+    "headerConfig": "Analyse de la configuration",
+    "rows": [
+      {
+        "aspect": "Regarde",
+        "bridge": "Ponts (<code>vmbrX</code>) et leur ligne <code>bridge-ports</code>",
+        "config": "Chaque bloc <code>iface</code>, sauf loopback, ponts et agrégations"
+      },
+      {
+        "aspect": "Détecte",
+        "bridge": "Ponts faisant référence à un port inexistant",
+        "config": "Blocs d'interface autonomes pour les NIC qui n'existent pas"
+      },
+      {
+        "aspect": "Action de réparation",
+        "bridge": "Remplace le nom du port dans <code>bridge-ports</code>",
+        "config": "Supprime tout le bloc <code>iface</code>"
+      },
+      {
+        "aspect": "Non compris",
+        "bridge": "Rien — chaque pont est analysé",
+        "config": "Les ponts (<code>vmbrX</code>) et agrégations (<code>bondX</code>) sont toujours conservés : ils sont virtuels et leur absence peut être normale au démarrage"
+      }
+    ],
+    "outro": "En pratique, on utilise souvent les deux dans cet ordre : <strong>analyse de configuration</strong> pour supprimer les blocs orphelins, puis <link>analyse des ponts</link> pour réaffecter tout pont qui dépendait de l’interface supprimée."
+  },
+  "step1": {
+    "heading": "Étape 1: analyse (lecture seule)",
+    "intro": "Avorte immédiatement si l'hôte n'est pas sur la pile classique. Sinon, liste toutes les interfaces non loopback configurées et indique son état :",
+    "virtTitle": "Les interfaces virtuelles sont protégées",
+    "virtBody": "Les ponts (<code>vmbrX</code>) et agrégations (<code>bondX</code>) sont virtuels. Leur absence peut être normale au moment de l’inspection, par exemple pour un pont sans port. L’analyse ne propose donc jamais de les supprimer, seulement les cartes réseau physiques."
+  },
+  "step2": {
+    "heading": "Étape 2 : nettoyage guidé (5 étapes)",
+    "intro": "Accessible uniquement si vous acceptez la proposition à la fin de l’analyse. Chaque étape exige une confirmation ; annuler à tout moment quitte sans écrire.",
+    "steps": [
+      {
+        "title": "1. Sauvegarde de sécurité",
+        "body": "Copie <code>/etc/network/interfaces</code> vers <code>/var/backups/proxmenux/interfaces_backup_&lt;TIMESTAMP&gt;</code>. Chemin montré avant et après.",
+        "tone": "blue"
+      },
+      {
+        "title": "2. Confirmer la liste de suppression",
+        "body": "Liste précisément les blocs d’interface physique à supprimer. Si les cartes réseau réapparaissent entre l’analyse et le nettoyage, par exemple après avoir réinséré une carte, la procédure se termine avec <em>« Aucun nettoyage nécessaire. »</em>",
+        "tone": "blue"
+      },
+      {
+        "title": "3. Aperçu du ou des blocs exacts",
+        "body": "Ouvre une vue défilante de chaque bloc <code>iface</code> qui serait supprimé, mot à mot du fichier. C'est le moment de repérer par exemple un crochet <code>up</code> intéressant que vous voulez préserver.",
+        "tone": "blue"
+      },
+      {
+        "title": "4. Appliquer la suppression",
+        "body": "Pour chaque interface orpheline, exécute <code>sed -i \"/^iface $iface/,/^$/d\" /etc/network/interfaces</code>. Cela supprime de la ligne correspondante <code>iface</code> jusqu'à la ligne blanche suivante.",
+        "tone": "amber"
+      },
+      {
+        "title": "5. Vérification",
+        "body": "Relit le fichier, répertorie ce qui a été supprimé et revérifie les interfaces restantes. Imprime la commande de restauration. <strong>ne redémarre pas</strong> automatiquement le réseau : la suppression d'un bloc inutilisé peut être appliquée en toute sécurité au prochain redémarrage et évite de toucher à l'état actif.",
+        "tone": "emerald"
+      }
+    ],
+    "noRestartTitle": "Ne redémarre pas automatiquement le réseau",
+    "noRestartBody": "Contrairement à la réparation de pont, le flux de nettoyage n'offre pas de redémarrer le service. L'élimination d'un bloc d'interface inutilisé n'a aucun effet immédiat sur la configuration en cours d'exécution, de sorte qu'un redémarrage est inutile et serait un risque inutile de connectivité. Le changement prend effet sur le prochain manuel <code>systemctl restart networking</code> ou au prochain redémarrage."
+  },
+  "caveats": {
+    "heading": "Mises en garde importantes",
+    "boundaryTitle": "La limite du bloc est la première ligne vide",
+    "boundaryBody": "Le motif <code>sed</code> supprime de <code>iface &lt;name&gt;</code> jusqu’à la ligne vide suivante. Si <code>/etc/network/interfaces</code> ne contient pas de ligne vide entre les blocs, ce qui est rare mais possible après une modification manuelle, le bloc suivant peut aussi être supprimé. C’est pourquoi <strong>l’étape 3 est obligatoire</strong> : examinez l’aperçu avant de confirmer.",
+    "tandemTitle": "Un bloc iface orphelin utilisé par un pont est détecté ici, pas dans l’analyse des ponts",
+    "tandemBody": "Si <code>vmbr0</code> déclare <code>bridge-ports enp3s0</code> et qu’<code>enp3s0</code> a aussi son propre bloc <code>iface enp3s0 inet manual</code>, supprimer <code>enp3s0</code> ici laisse une référence invalide dans <code>vmbr0</code>. Après le nettoyage, lancez <link>l’analyse des ponts</link> pour réaffecter ou retirer le port du pont. Les deux procédures sont conçues pour être utilisées ensemble."
+  },
+  "troubleshoot": {
+    "heading": "Dépannage",
+    "notFoundTitle": "L’analyse indique « INTROUVABLE » pour ma nouvelle carte réseau",
+    "notFoundBody": "Le noyau voit le périphérique sous un autre nom que celui du fichier. Lancez <code>ip link show</code> pour connaître son nom réel. C’est précisément un cas où les <link>noms d’interface persistants</link> éviteraient le problème à l’avenir.",
+    "tooMuchTitle": "Le nettoyage a trop supprimé, dont un bloc que je voulais garder",
+    "tooMuchBody": "Restaurer à partir de la sauvegarde imprimée dans l'étape 5:",
+    "tooMuchOutro": "Modifier le fichier à la main pour ajouter une ligne blanche claire entre les blocs avant de ré-exécuter le nettoyage, ou supprimer le bloc problématique manuellement.",
+    "bridgeBreakTitle": "Un pont s'arrête après le nettoyage",
+    "bridgeBreakBody": "Le pont utilisait un port dont le bloc <code>iface</code> vient d’être supprimé. Lancez <link>l’analyse des ponts</link> ; la suggestion associera le pont à une interface physique existante."
+  },
+  "related": {
+    "heading": "Voir aussi",
+    "items": [
+      {
+        "label": "Analyse des ponts et réparation guidée",
+        "href": "/docs/network/bridge-analysis",
+        "tail": "— le suivi naturel après un nettoyage."
+      },
+      {
+        "label": "Noms d'interface persistants",
+        "href": "/docs/network/persistent-names",
+        "tail": "— empêche les blocs orphelins de s'accumuler après chaque changement matériel."
+      },
+      {
+        "label": "Sauvegarde et redémarrage des interfaces",
+        "href": "/docs/network/backup-restore",
+        "tail": "— les instantanés manuels et le navigateur de restauration."
+      }
+    ]
+  }
+}
diff --git a/web/messages/fr/docs/network/diagnostics.json b/web/messages/fr/docs/network/diagnostics.json
new file mode 100644
index 00000000..8560be31
--- /dev/null
+++ b/web/messages/fr/docs/network/diagnostics.json
@@ -0,0 +1,94 @@
+{
+  "meta": {
+    "title": "Diagnostic | Documentation ProxMenux",
+    "description": "Trois diagnostics ponctuels en lecture seule : Afficher la table de routage, Tester la connectivité et Diagnostic avancé. Inspection uniquement — n’écrit jamais dans /etc/network/interfaces et n’exécute aucune commande de modification, à une exception explicite près : la purge de NetworkManager, s’il est détecté, nécessite votre accord.",
+    "ogTitle": "Diagnostic | Documentation ProxMenux",
+    "ogDescription": "Diagnostic réseau en lecture seule pour l'hôte Proxmox : routage, accessibilité, statistiques avancées."
+  },
+  "header": {
+    "title": "Diagnostic",
+    "description": "Trois contrôles ponctuels en lecture seule de l’état actuel du réseau : table de routage, test de connectivité et statistiques avancées. Aucun n’écrit dans /etc/network/interfaces — utilisables en toute sécurité à tout moment, y compris via SSH. Pour la surveillance interactive en direct, consultez Outils de surveillance en direct.",
+    "section": "Réseau"
+  },
+  "intro": {
+    "title": "Ce que ça fait",
+    "body": "Présente le routage, l’accessibilité et les statistiques agrégées <strong>sans rien modifier</strong>. Permet de vérifier le bon fonctionnement du réseau ou de repérer des adresses IP en double. Pour observer le trafic en continu, voir <monitoringLink>Outils de surveillance en direct</monitoringLink> ; pour consulter le fichier de configuration brut, voir <backupLink>Sauvegarde et redémarrage des interfaces</backupLink>."
+  },
+  "routing": {
+    "heading": "Afficher la table de routage",
+    "body": "Liste chaque route que le noyau utilise actuellement (<code>ip route show</code>) et souligne la passerelle par défaut. Utile pour confirmer que le trafic vers Internet passe par l'interface prévue et qu'aucune route restante n'a priorité."
+  },
+  "connectivity": {
+    "heading": "Tester la connectivité",
+    "intro": "Envoie deux sondes ICMP à trois cibles dans l'ordre et signale chacune. Ensuite, exécute un <code>nslookup google.com</code> pour vérifier la résolution DNS indépendamment de ICMP.",
+    "headerTest": "Essai",
+    "headerTarget": "Cible",
+    "headerConfirms": "Ce qu'il confirme",
+    "rows": [
+      {
+        "test": "Google DNS",
+        "target": "8.8.8.8",
+        "confirms": "Accessibilité externe via une adresse IP anycast connue"
+      },
+      {
+        "test": "Cloudflare DNS",
+        "target": "1.1.1.1",
+        "confirms": "Deuxième avis indépendant si Google bloque ICMP"
+      },
+      {
+        "test": "Passerelle",
+        "target": "(route par défaut)",
+        "confirms": "Connectivité L2 / L3 au routeur local"
+      },
+      {
+        "test": "Résolution DNS",
+        "target": "google.com",
+        "confirms": "Le serveur DNS est accessible et répond"
+      }
+    ],
+    "readingTitle": "Lecture du résultat",
+    "readingBody": "Si le test de la passerelle réussit mais que les cibles DNS publiques ne répondent pas, vous avez une connectivité locale mais pas d’accès Internet : vérifiez la connexion en amont de la passerelle. Si la résolution DNS échoue mais que les pings vers <code>8.8.8.8</code> réussissent, le problème vient du résolveur, pas du réseau : vérifiez <code>/etc/resolv.conf</code>."
+  },
+  "advanced": {
+    "heading": "Diagnostic avancé",
+    "intro": "Agrège les statistiques du réseau et effectue une série de vérifications des problèmes courants. Affiche le nombre de connexions actives, les ports en écoute et le nombre total d’interfaces, et signale explicitement deux configurations problématiques :",
+    "items": [
+      "<strong>NetworkManager fonctionne sur un hôte Proxmox.</strong> NetworkManager et <code>ifupdown</code> de Proxmox entrent en conflit : tous deux tentent de gérer les interfaces, ce qui rend les ponts instables ou les empêche de s’activer. Si NetworkManager est détecté, l’outil propose une confirmation interactive pour l’arrêter, le désactiver et le purger (c’est le <em>seul</em> diagnostic pouvant modifier le système, et uniquement après consentement explicite).",
+      "<strong>Adresses IP en double sur différentes interfaces.</strong> Deux interfaces utilisant la même adresse IPv4 provoquent des problèmes de connexion intermittents très difficiles à diagnostiquer depuis la VM. Détection via <code>ip -4 addr show | sort | uniq -d</code>."
+    ],
+    "nmTitle": "L'invite NetworkManager est la seule action de modification ici",
+    "nmBody": "Toutes les autres vérifications du diagnostic avancé sont en lecture seule. La suppression de NetworkManager nécessite une confirmation oui/non et exécute <code>systemctl stop / disable</code> + <code>apt-get purge -y network-manager</code>. Si vous refusez, rien ne change."
+  },
+  "troubleshoot": {
+    "heading": "Dépannage",
+    "gwTitle": "Tester la connectivité signale un échec de la passerelle, mais l’hôte a accès à Internet",
+    "gwBody": "Certains routeurs ne répondent pas aux requêtes ICMP sur leur interface interne même s’ils acheminent correctement le trafic. Testez avec <code>traceroute 8.8.8.8</code> depuis une console : si le deuxième saut correspond à votre FAI et que le test DNS public a réussi, la passerelle fonctionne malgré l’échec du ping.",
+    "dupTitle": "Le diagnostic avancé signale toujours des adresses IP en double après que j’en ai supprimé une",
+    "dupBody": "La vérification examine l'état du noyau en direct, et non le fichier de configuration. Exécutez <code>ip -4 addr show</code> pour confirmer ; si le duplicata est toujours présent, une interface le tient toujours. Utilisez <code>ip addr del &lt;IP&gt;/&lt;mask&gt; dev &lt;iface&gt;</code> pour le supprimer de l'état en direct, puis modifiez <code>/etc/network/interfaces</code> si elle est aussi persistante."
+  },
+  "related": {
+    "heading": "Voir aussi",
+    "items": [
+      {
+        "label": "Outils de surveillance en direct",
+        "href": "/docs/network/monitoring",
+        "tail": "— les lanceurs interactifs iftop / iptraf-ng / iperf3."
+      },
+      {
+        "label": "Analyse des ponts et réparation guidée",
+        "href": "/docs/network/bridge-analysis",
+        "tail": " — lorsqu’un vmbrX n’a plus de port physique."
+      },
+      {
+        "label": "Analyse de configuration et nettoyage guidé",
+        "href": "/docs/network/config-analysis",
+        "tail": " — lorsqu’une ancienne carte réseau est toujours déclarée mais n’est plus présente."
+      },
+      {
+        "label": "Sauvegarde et redémarrage des interfaces",
+        "href": "/docs/network/backup-restore",
+        "tail": " — pour créer un instantané de la configuration avant toute modification."
+      }
+    ]
+  }
+}
diff --git a/web/messages/fr/docs/network/index.json b/web/messages/fr/docs/network/index.json
new file mode 100644
index 00000000..b6eaf6d6
--- /dev/null
+++ b/web/messages/fr/docs/network/index.json
@@ -0,0 +1,107 @@
+{
+  "meta": {
+    "title": "Gestion réseau Proxmox — Ponts, agrégations, diagnostic, réparation | ProxMenux",
+    "description": "Diagnostics en lecture seule, analyses suivies de suggestions et réparations guidées pour la pile réseau Debian / Proxmox (/etc/network/interfaces). Inspectez les ponts et les agrégations, lancez des outils de surveillance en direct, rendez les noms d’interface persistants, sauvegardez et redémarrez le réseau en toute sécurité — avec sauvegardes obligatoires et aperçus étape par étape.",
+    "ogTitle": "Gestion réseau Proxmox — Ponts, agrégations, diagnostic, réparation",
+    "ogDescription": "Diagnostics, analyses et réparations guidées pour la pile réseau Proxmox avec sauvegardes obligatoires et prévisualisations étape par étape.",
+    "twitterTitle": "Gestion réseau Proxmox | ProxMenux",
+    "twitterDescription": "Ponts, agrégations, diagnostics et réparations guidées pour la pile réseau Proxmox avec sauvegardes obligatoires."
+  },
+  "header": {
+    "title": "Gestion du réseau",
+    "description": "Diagnostics en lecture seule, rapports d’analyse suivis de suggestions et réparations guidées pour la pile réseau classique Debian/Proxmox. Toute opération destructive crée d’abord une sauvegarde et affiche les modifications exactes avant de les appliquer.",
+    "section": "Réseau"
+  },
+  "intro": {
+    "title": "À quoi sert ce menu",
+    "body": "Inspectez, diagnostiquez et, au besoin, réparez la configuration réseau de l’hôte Proxmox sans perdre l’accès à distance. Les outils suivent un principe : <strong>lire d’abord, proposer, puis appliquer uniquement avec un consentement explicite et une sauvegarde de sécurité</strong>. Il n’existe pas de bouton « Tout réparer automatiquement »."
+  },
+  "openingMenu": {
+    "heading": "Ouverture du menu",
+    "intro": "Dans le menu principal de ProxMenux, sélectionnez <strong>Réseau</strong>. Vous verrez ceci :",
+    "imageAlt": "Menu de gestion de réseau avec diagnostic, suivi, analyse, réparation, noms persistants et options de sauvegarde"
+  },
+  "safety": {
+    "heading": "Le modèle de sécurité",
+    "body": "Modifier la configuration réseau d’un hôte Proxmox distant est l’un des moyens les plus faciles de perdre son accès. ProxMenux en tient compte pour chaque action. Les outils se répartissent en trois niveaux de comportement : choisissez la carte correspondant à votre objectif :"
+  },
+  "tiers": {
+    "readOnly": {
+      "title": "Lecture seule",
+      "body": "Contrôle pur. Impossible de modifier le système en aucune circonstance.",
+      "items": [
+        "Tableau d'acheminement, tests de connectivité, statistiques avancées",
+        "Surveillance du trafic en temps réel (iftop, iptraf-ng)",
+        "Test de bande passante (iperf3)"
+      ]
+    },
+    "analyze": {
+      "title": "Analysez, puis suggérez",
+      "body": "Détecte les problèmes, affiche un rapport avec les commandes shell proposées, puis s’arrête. Vous décidez ensuite de lancer ou non la réparation guidée.",
+      "items": [
+        "Analyse de la configuration des ponts",
+        "Analyse de la configuration du réseau"
+      ]
+    },
+    "apply": {
+      "title": "Appliquer avec sauvegarde",
+      "body": "Modifie le système. Crée toujours d’abord une sauvegarde horodatée du fichier concerné et affiche un aperçu avant l’écriture.",
+      "items": [
+        "Noms d’interface persistants (fichiers .link)",
+        "Sauvegarde manuelle, restauration et redémarrage du service"
+      ]
+    }
+  },
+  "classicTitle": "Pile classique seulement",
+  "classicBody": "Chaque fonction d'analyse et de réparation vérifie le gestionnaire de réseau actif avant de toucher quoi que ce soit. Si l'hôte exécute <strong>netplan</strong>, <strong>systemd-networkd</strong> ou <strong>NetworkManager</strong>, l'outil avorte immédiatement avec un message clair — le menu ne prend en charge que la pile classique Debian/Proxmox à <code>/etc/network/interfaces</code>. Ceci est intentionnel : l'édition d'un fichier netplan avec des règles écrites pour <code>ifupdown</code> corromprait silencieusement la configuration.",
+  "backups": {
+    "heading": "Où vont les sauvegardes",
+    "intro": "Chaque réparation guidée, restauration ou sauvegarde manuelle écrit une copie horodatée de <code>/etc/network/interfaces</code> à <code>/var/backups/proxmenux/</code> :",
+    "rollbackIntro": "Pour revenir manuellement à la configuration précédente depuis une console :"
+  },
+  "readOnlySection": {
+    "heading": "Contrôle en lecture seule",
+    "body": "Le point de départ lorsque quelque chose semble anormal. Inspection uniquement — n’écrit jamais dans <code>/etc/network/interfaces</code> et n’exécute aucune commande de modification, à une exception explicite près : la purge de NetworkManager, s’il est détecté, nécessite votre accord. Utilisable en toute sécurité via SSH à tout moment.",
+    "options": [
+      {
+        "title": "Diagnostic",
+        "description": "Trois vérifications en lecture seule : Afficher la table d'acheminement, tester la connectivité et les diagnostics avancés. L'inspection pure n'écrit jamais au système."
+      },
+      {
+        "title": "Outils de surveillance en direct",
+        "description": "Trois lanceurs interactifs : iftop (bande passante en temps réel par paire d'hôtes), iptraf-ng (moniteur de trafic multimode) et iperf3 (test de bande passante, serveur / mode client)."
+      }
+    ]
+  },
+  "analyzeSection": {
+    "heading": "Analysez, puis suggérez",
+    "body": "À utiliser lorsqu’une inspection ou une panne réelle révèle un problème de configuration. Chaque outil examine la partie concernée de <code>/etc/network/interfaces</code>, affiche un rapport détaillé avec la commande shell exacte qui corrigerait chaque problème, puis <strong>s’arrête</strong>. Si vous acceptez ensuite la réparation guidée facultative, chaque modification est sauvegardée et prévisualisée avant d’être écrite.",
+    "options": [
+      {
+        "title": "Analyse des ponts et réparation guidée",
+        "description": "Détecte les ponts vmbrX dont les ports sont absents ou invalides, par exemple après une réénumération PCI. Affiche d’abord un rapport et ne répare que si vous acceptez la procédure guidée en 5 étapes."
+      },
+      {
+        "title": "Analyse de configuration et nettoyage guidé",
+        "description": "Repère les interfaces physiques déclarées dans /etc/network/interfaces qui n’existent plus, c’est-à-dire les configurations orphelines laissées par des changements matériels. Les signale et propose une suppression guidée."
+      }
+    ]
+  },
+  "applySection": {
+    "heading": "Appliquer avec sauvegarde",
+    "body": "Ces outils écrivent sur le disque par leur fonctionnement même. Chacun crée une sauvegarde horodatée du fichier concerné avant l’écriture, et les options destructives, comme la restauration et le redémarrage, exigent une confirmation explicite oui/non. Les <em>noms d’interface persistants</em> prennent effet au prochain redémarrage, pas immédiatement ; leur mise en place peut donc être planifiée en toute sécurité même sur un hôte distant.",
+    "options": [
+      {
+        "title": "Noms d'interface persistants",
+        "description": "Associe les noms d’interface (eno1, enp3s0, …) aux adresses MAC au moyen de fichiers .link de systemd. Les noms restent stables après un changement d’emplacement PCI, une mise à niveau du noyau ou l’ajout ou le retrait d’autres cartes réseau."
+      },
+      {
+        "title": "Sauvegarde et redémarrage des interfaces",
+        "description": "Un instantané manuel de /etc/network/interfaces, parcourir et restaurer les sauvegardes précédentes, afficher la configuration en direct et redémarrer le service de réseautage au besoin."
+      }
+    ]
+  },
+  "consoleTitle": "Préparez l'accès à la console",
+  "consoleSubTitle": "Avant toute réparation sur un hôte distant",
+  "consoleBody": "Si vous êtes connecté via SSH et ne disposez que d’un seul accès à l’hôte, prévoyez une solution de secours avant toute modification réseau : console physique / IPMI / iKVM ou autre machine sur le même réseau local. Les réparations guidées sont sûres et proposent toujours une commande de retour en arrière, mais un pont mal configuré ou une liaison interrompue peut tout de même vous priver d’accès jusqu’à ce que vous puissiez atteindre la console."
+}
diff --git a/web/messages/fr/docs/network/monitoring.json b/web/messages/fr/docs/network/monitoring.json
new file mode 100644
index 00000000..33f652a2
--- /dev/null
+++ b/web/messages/fr/docs/network/monitoring.json
@@ -0,0 +1,136 @@
+{
+  "meta": {
+    "title": "Outils de surveillance en direct | Documentation ProxMenux",
+    "description": "Trois lanceurs interactifs de surveillance du réseau : iftop (bande passante en temps réel par paire d'hôtes), iptraf-ng (moniteur de trafic multimode) et iperf3 (test de bande passante, serveur / mode client). Chacun est installé lors de la première utilisation.",
+    "ogTitle": "Outils de surveillance en direct | Documentation ProxMenux",
+    "ogDescription": "Surveillance réseau interactive et test de bande passante pour l'hôte Proxmox : iftop, iptraf-ng, iperf3."
+  },
+  "header": {
+    "title": "Outils de surveillance en direct",
+    "description": "Trois lanceurs interactifs pour observer le réseau en temps réel et mesurer la bande passante : iftop, iptraf-ng et iperf3. Chaque outil est installé automatiquement via apt au premier usage, fonctionne au premier plan et se quitte avec la touche indiquée. Ils ne modifient pas la configuration réseau de l’hôte ; iperf3 génère du trafic de test.",
+    "section": "Réseau"
+  },
+  "intro": {
+    "title": "Ce que ça fait",
+    "body": "Trois outils de suivi interactifs, chacun derrière sa propre entrée de menu. La première fois que vous en lancez un, le paquet est installé silencieusement via <code>apt-get</code>. Les lancements suivants commencent instantanément. Aucun de ces outils ne modifie la configuration du réseau hôte."
+  },
+  "when": {
+    "heading": "Quel outil utiliser selon le besoin",
+    "headerQuestion": "Question",
+    "headerUse": "Utiliser",
+    "rows": [
+      {
+        "question": "Qui sature le lien <em> maintenant</em> ?",
+        "use": "iftop"
+      },
+      {
+        "question": "Quelle est la répartition par protocole, quelles tailles de paquets et quels flux TCP circulent ?",
+        "use": "iptraf-ng"
+      },
+      {
+        "question": "Combien de bande passante est disponible entre deux hôtes ?",
+        "use": "iperf3"
+      }
+    ]
+  },
+  "iftop": {
+    "heading": "Utilisation du réseau en temps réel (iftop)",
+    "body": "Bande passante en direct par paire d’hôtes (source ↔ destination) — comme <code>top</code> pour le trafic. Affiche les flux les plus importants en haut, avec des moyennes glissantes sur 2/10/40 secondes. L’outil idéal pour savoir <em>« pourquoi ma liaison montante est saturée »</em>.",
+    "exit": "<strong>Quitter :</strong> appuyez sur <kbd>q</kbd>. ProxMenux affiche un rappel avant le lancement.",
+    "keysTitle": "Touches utiles dans iftop",
+    "keysBody": "<kbd>n</kbd> active ou désactive les recherches DNS, <kbd>p</kbd> affiche les numéros de port, <kbd>P</kbd> fige l’affichage, <kbd>t</kbd> change le sens des lignes (envoi / réception / les deux), <kbd>1</kbd>/<kbd>2</kbd>/<kbd>3</kbd> trie par moyenne sur 2 s / 10 s / 40 s. Liste complète dans <code>man iftop</code>."
+  },
+  "iptraf": {
+    "heading": "Outil de surveillance du réseau (iptraf-ng)",
+    "intro": "Un outil de surveillance du trafic à plusieurs modes, piloté par menu. iftop répond à <em>« qui »</em>, tandis qu’iptraf-ng répond à <em>« quoi »</em> : compteurs d’octets et de paquets par protocole, suivi de l’état des connexions TCP, histogrammes de taille des paquets et activité LAN par station.",
+    "menuIntro": "Au lancement, vous obtenez un menu à cinq options :",
+    "headerMode": "Mode",
+    "headerUseFor": "Utilisez-le pour",
+    "rows": [
+      {
+        "mode": "IP traffic monitor",
+        "useFor": "Liste de flux en direct TCP / UDP / ICMP / autre-IP avec compteurs d'octets et état de connexion"
+      },
+      {
+        "mode": "General interface stats",
+        "useFor": "Nombre total de paquets IPv4 / IPv6 / TCP / UDP / ICMP / non IP par carte réseau"
+      },
+      {
+        "mode": "Detailed interface stats",
+        "useFor": "Comme ci-dessus, mais pour une interface, avec la taille du paquet et le détail du taux"
+      },
+      {
+        "mode": "Statistical breakdowns",
+        "useFor": "Histogramme de distribution de la taille du paquet, par port TCP / UDP"
+      },
+      {
+        "mode": "LAN station monitor",
+        "useFor": "Statistiques du trafic par adresse MAC pour le domaine de diffusion local"
+      }
+    ],
+    "exit": "<strong>Quitter :</strong> appuyez sur <kbd>x</kbd> depuis n’importe quelle vue ou sur <kbd>Q</kbd> depuis le menu principal. ProxMenux affiche un rappel avant le lancement.",
+    "logTitle": "Enregistrer les captures dans un fichier",
+    "logBody": "Chaque mode propose d’enregistrer les statistiques capturées dans <code>/var/log/iptraf-ng/</code>. Pour conserver une trace d’un pic de trafic, laissez l’outil tourner, enregistrez dans un fichier et examinez-le ensuite plutôt que d’essayer de suivre l’écran en direct."
+  },
+  "iperf3": {
+    "heading": "Test de bande passante (iperf3)",
+    "intro1": "Mesure le débit TCP réel entre deux hôtes. Contrairement à iftop / iptraf-ng, qui observent le trafic existant, iperf3 génère du trafic synthétique pour tester la liaison en charge. Indispensable pour répondre à <em>« Ma liaison 10 GbE atteint-elle vraiment 10 GbE ? »</em> ou <em>« Le goulot d’étranglement vient-il de la carte réseau, du commutateur ou du stockage ? »</em>.",
+    "intro2": "iperf3 est un <strong>outil à deux hôtes</strong> : l’un est le serveur, en écoute sur le port TCP 5201 ; l’autre est le client, qui se connecte, envoie les données et affiche le débit. Le lanceur ProxMenux demande le mode souhaité :",
+    "headerMode": "Mode",
+    "headerBehaviour": "Comportement",
+    "headerCli": "Commande CLI équivalente",
+    "rows": [
+      {
+        "mode": "Serveur",
+        "behaviour": "Écoute sur TCP 5201 et imprime les résultats pour chaque test entrant. Arrête sur Ctrl+C.",
+        "cli": "iperf3 -s"
+      },
+      {
+        "mode": "Client",
+        "behaviour": "Demande l’adresse IP ou le nom d’hôte du serveur, se connecte, lance le test par défaut de 10 secondes et affiche le rapport.",
+        "cli": "iperf3 -c <target>"
+      }
+    ],
+    "workflowIntro": "Typiquement pour tester un lien 10 GbE entre deux hôtes Proxmox :",
+    "workflow": [
+      "Sur l’hôte A, ouvrez le menu Réseau → <em>Test de bande passante (iperf3)</em> → choisissez <strong>Serveur</strong>.",
+      "Sur l'hôte B, ouvrez la même entrée de menu → choisissez <strong>Client</strong> → saisissez l'IP de l'hôte A.",
+      "Attendez 10 secondes. Comparez le taux déclaré au maximum théorique du lien."
+    ],
+    "sample": "Exemple de sortie client :",
+    "flagsTitle": "Options utiles à utiliser manuellement depuis un shell",
+    "flagsBody": "<code>-t 60</code> test plus long (60 s au lieu de 10 s), <code>-P 4</code> 4 flux parallèles (saturation plus rapide), <code>-R</code> sens inverse (serveur → client), <code>-u -b 100M</code> test UDP à 100 Mbit/s (mesure de la gigue et des pertes de paquets), <code>-p 5202</code> autre port (plusieurs tests en parallèle). Liste complète dans <code>man iperf3</code>.",
+    "firewallTitle": "Ouvrez le port pare-feu sur le serveur",
+    "firewallBody": "Le serveur écoute sur TCP <strong>5201</strong> par défaut. Si vous exécutez le serveur à l'intérieur d'un hôte Proxmox avec un pare-feu strict (datacenter ou niveau hôte), autorisez TCP 5201 entrant à partir de l'IP du client pour la durée du test, puis fermez-le à nouveau. Il en va de même pour <code>nftables</code> / <code>iptables</code> sur les hôtes nus."
+  },
+  "install": {
+    "heading": "Le premier lancement installe le paquet",
+    "body": "Les trois lanceurs vérifient le binaire et exécutent <code>apt-get update -qq &amp;&amp; apt-get install -y &lt;pkg&gt;</code> s'il manque. L'installation est silencieuse : le menu peut apparaître gelé pour 10–30 secondes la première fois. Les lancements suivants commencent instantanément."
+  },
+  "troubleshoot": {
+    "heading": "Dépannage",
+    "hangTitle": "L’installation reste bloquée au premier lancement",
+    "hangBody": "L'hôte n'a pas d'internet ou les repos apt sont inaccessibles. Annuler avec <kbd>Ctrl</kbd>+<kbd>C</kbd>, exécuter <code>apt-get update</code> manuellement pour voir l'erreur réelle (DNS, repo signature, proxy ...), puis revenir au menu.",
+    "refusedTitle": "Client iperf3 : « unable to connect to server: Connection refused »",
+    "refusedBody": "Soit le serveur ne fonctionne pas, soit son pare-feu bloque TCP 5201. Confirmer sur le serveur: <code>ss -tlnp | grep 5201</code> — doit afficher l'écoute iperf3. Si l'écoute, mais que le client échoue, vérifiez le chemin du pare-feu entre les deux hôtes.",
+    "slowTitle": "iperf3 indique un débit bien inférieur à la vitesse attendue de la liaison",
+    "slowBody": "Causes courantes par ordre de probabilité : (1) le processeur d’un hôte limite le débit — essayez <code>iperf3 -c &lt;target&gt; -P 4</code> pour utiliser plusieurs cœurs ; (2) le trajet passe par une liaison plus lente, par exemple un commutateur gigabit entre deux cartes 10 GbE ; (3) MTU différents — vérifiez <code>ip link show</code> aux deux extrémités ; (4) offloading de la carte réseau désactivé — voir le script communautaire <em>Disable NIC Offloading</em> pour une carte Intel e1000e.",
+    "noTrafficTitle": "iftop / iptraf-ng ne montre aucun trafic pour un hôte occupé",
+    "noTrafficBody": "La capture par défaut est sur la première interface détectée. Spécifiez le bon explicitement depuis le shell : <code>iftop -i vmbr0</code> ou <code>iptraf-ng -i vmbr0</code>. Le lanceur de menu utilise la valeur par défaut; pour les interfaces non par défaut, exécuter à partir d'une console."
+  },
+  "related": {
+    "heading": "Voir aussi",
+    "items": [
+      {
+        "label": "Diagnostic",
+        "href": "/docs/network/diagnostics",
+        "tail": "— les contrôles en lecture seule (routage, connectivité, statistiques avancées)."
+      },
+      {
+        "label": "Analyse des ponts et réparation guidée",
+        "href": "/docs/network/bridge-analysis",
+        "tail": "— lorsque la surveillance révèle qu'une interface ou un pont ne fait pas ce qu'il faut."
+      }
+    ]
+  }
+}
diff --git a/web/messages/fr/docs/network/persistent-names.json b/web/messages/fr/docs/network/persistent-names.json
new file mode 100644
index 00000000..26472165
--- /dev/null
+++ b/web/messages/fr/docs/network/persistent-names.json
@@ -0,0 +1,130 @@
+{
+  "meta": {
+    "title": "Noms d’interface persistants | Documentation ProxMenux",
+    "description": "Associez les noms d’interface Proxmox (eno1, enp3s0, …) aux adresses MAC via des fichiers .link de systemd pour les conserver après une réénumération PCI, une mise à niveau du noyau ou l’ajout ou le retrait d’autres cartes réseau.",
+    "ogTitle": "Noms d’interface persistants | Documentation ProxMenux",
+    "ogDescription": "Empêchez les noms d’interface Proxmox de changer lors des modifications matérielles. Utilise des fichiers .link de systemd associés aux adresses MAC."
+  },
+  "header": {
+    "title": "Noms d'interface persistants",
+    "description": "Génère un fichier .link de systemd par carte réseau physique pour associer le nom attribué par le noyau à son adresse MAC. Après application au prochain redémarrage, les noms d’interface restent stables lorsque vous ajoutez, retirez ou déplacez des cartes PCIe.",
+    "section": "Réseau"
+  },
+  "intro": {
+    "title": "Ce que ça fait",
+    "body": "Pour chaque NIC physique sur l'hôte, écrit un petit fichier sous <code>/etc/systemd/network/10-&lt;iface&gt;.link</code> qui dit : <em>\"le périphérique avec ce MAC doit toujours être appelé ce nom\"</em>. systemd-udevd applique la règle à chaque démarrage, avant que <code>ifupdown</code> ne lise <code>/etc/network/interfaces</code>."
+  },
+  "problem": {
+    "heading": "Le problème que cela résout",
+    "intro": "Linux déduit les noms d’interface par défaut de la topologie PCI — <code>eno1</code> = intégrée à la carte mère, <code>enp3s0</code> = carte sur le bus PCI 3, emplacement 0, etc. Le nommage est déterministe <em>pour une même disposition matérielle</em>. Si cette disposition change, les noms changent :",
+    "items": [
+      "Ajoutez un GPU devant un NIC existant → le numéro de bus NIC peut changer → changement de nom.",
+      "Déplacer une carte vers une autre fente PCIe → nom change.",
+      "BIOS / UEFI mise à jour qui réénumère les appareils → noms peuvent changer.",
+      "Remplacer une carte défectueuse par le même modèle dans une autre fente → nom change."
+    ],
+    "outro": "Après un tel changement, <code>/etc/network/interfaces</code> fait toujours référence à l’<em>ancien</em> nom ; le pont ne s’active pas et l’hôte perd le réseau. Les noms persistants évitent que cette situation se reproduise."
+  },
+  "howWorks": {
+    "heading": "Comment ça marche",
+    "arrowLabel": "par NIC",
+    "nodes": {
+      "detectLabel": "Détecter les cartes réseau physiques",
+      "detectDetail": "ls /sys/class/net/\nexclure vmbr / bond /\ndocker / veth / wireguard …",
+      "readLabel": "Lire chaque MAC",
+      "readDetail": "cat /sys/class/net/\n  '<'iface'>'/address",
+      "writeLabel": "Écrivez le fichier .link",
+      "writeDetail": "/etc/systemd/network/\n  10-'<'iface'>'.link"
+    },
+    "minimalIntro": "Chaque fichier généré est volontairement minimal :",
+    "minimalOutro": "Au démarrage, systemd-udevd identifie le périphérique par son adresse MAC et lui attribue le nom demandé <em>avant</em> l’intervention d’autres composants (ifupdown, nommage par défaut du noyau). Le préfixe <code>10-</code> garantit le chargement précoce de ces règles, avant le fichier par défaut <code>99-default.link</code>."
+  },
+  "scope": {
+    "heading": "Ce qui est écrit, ce qui est ignoré",
+    "headerType": "Type",
+    "headerBehaviour": "Comportement",
+    "headerWhy": "Pourquoi",
+    "rows": [
+      {
+        "type": "Carte réseau intégrée / PCIe",
+        "behaviour": "fichier <code>.link</code> écrit",
+        "why": "Repose sur un véritable périphérique PCI — le cas auquel l’outil est destiné"
+      },
+      {
+        "type": "Wi-Fi (phy80211)",
+        "behaviour": "fichier <code>.link</code> écrit",
+        "why": "A une vraie MAC et bénéficie de la stabilité des noms"
+      },
+      {
+        "type": "Ponts (vmbrX)",
+        "behaviour": "Ignoré",
+        "why": "Virtuel; le nom vient de <code>/etc/network/interfaces</code>"
+      },
+      {
+        "type": "Agrégations (bondX)",
+        "behaviour": "Ignoré",
+        "why": "Virtuel ; le nom de l’agrégation est défini par ifupdown"
+      },
+      {
+        "type": "veth / docker0 / br-XXXX",
+        "behaviour": "Ignoré",
+        "why": "Créé sur demande par Docker / LXC — matériel non persistant"
+      },
+      {
+        "type": "tap / fwpr / fwln",
+        "behaviour": "Ignoré",
+        "why": "Créé sur demande par Proxmox par VM/CT"
+      },
+      {
+        "type": "WireGuard / Cilium / Tailscale",
+        "behaviour": "Ignoré",
+        "why": "Interfaces logicielles gérées par leurs propres démons"
+      }
+    ]
+  },
+  "safety": {
+    "heading": "Filet de sécurité : les fichiers .link précédents sont sauvegardés",
+    "intro": "Si <code>/etc/systemd/network/</code> contient déjà des fichiers <code>.link</code> (à partir d'une exécution précédente ou d'un autre outil), ils sont copiés dans un répertoire de sauvegarde horodaté avant que les nouveaux fichiers ne soient générés :",
+    "outro": "Pour revenir en arrière : copiez les fichiers à partir du répertoire de sauvegarde et redémarrez.",
+    "rebootTitle": "Prend effet sur le prochain redémarrage, pas immédiatement",
+    "rebootBody": "Les modifications des fichiers <code>.link</code> ne s’appliquent qu’au démarrage, lorsque udev réénumère les périphériques. L’outil indique donc <em>« Les modifications s’appliqueront après le redémarrage »</em>. Renommer une interface en cours de fonctionnement est risqué et n’est pas tenté : un <code>vmbr0</code> actif avec des interfaces membres devrait être reconfiguré de manière atomique. L’opération est donc reportée au prochain démarrage propre."
+  },
+  "afterReboot": {
+    "heading": "Après le redémarrage",
+    "intro": "Une fois les noms épinglés, le flux de travail des futurs changements matériels est simple :",
+    "items": [
+      "Éteignez, modifiez le matériel (ajout de carte, changement d’emplacement, …), puis démarrez.",
+      "Chaque NIC conserve son nom précédent car son MAC correspond à un fichier <code>.link</code>.",
+      "Si un NIC est remplacé (différent MAC), il obtient un nom de noyau par défaut (<code>enp&lt;bus&gt;s&lt;slot&gt;</code>); ré-exécutez ce menu pour ajouter une entrée <code>.link</code> pour le MAC de la nouvelle carte."
+    ]
+  },
+  "troubleshoot": {
+    "heading": "Dépannage",
+    "emptyTitle": "\"Aucune interface physique trouvée\" après avoir lancé l'outil",
+    "emptyBody": "Aucune interface reposant sur PCI ou phy80211 n’est visible par le noyau sur l’hôte. Vérifiez avec <code>ls -l /sys/class/net/</code> : chaque entrée doit avoir soit un lien symbolique <code>device</code> (PCI), soit une entrée <code>phy80211</code> (Wi-Fi). Si les deux sont absents pour une véritable carte réseau, le pilote n’est pas chargé.",
+    "noChangeTitle": "Après le redémarrage, les noms n'ont pas changé comme prévu",
+    "noChangeBody": "Vérifiez que le fichier est présent et correctement formé : <code>cat /etc/systemd/network/10-&lt;iface&gt;.link</code>. Consultez ensuite les journaux udev : <code>journalctl -u systemd-udevd -b | grep -i link</code>. Un ancien paramètre du noyau <code>net.ifnames=0</code> désactive entièrement le nommage prévisible : supprimez-le de <code>/etc/default/grub</code>, exécutez <code>update-grub</code>, puis redémarrez.",
+    "undoTitle": "Je veux annuler les noms persistants",
+    "undoBody": "Supprimez les fichiers <code>.link</code> (<code>rm /etc/systemd/network/10-*.link</code>) ou restaurez-les depuis le répertoire de sauvegarde créé lors de l’exécution précédente. Redémarrez pour appliquer les modifications."
+  },
+  "related": {
+    "heading": "Voir aussi",
+    "items": [
+      {
+        "label": "Analyse des ponts et réparation guidée",
+        "href": "/docs/network/bridge-analysis",
+        "tailRich": " — la solution de récupération lorsque les noms ont <em>déjà</em> changé."
+      },
+      {
+        "label": "Analyse de configuration et nettoyage guidé",
+        "href": "/docs/network/config-analysis",
+        "tail": " — pour supprimer les blocs orphelins laissés par les changements de noms."
+      },
+      {
+        "label": "Diagnostic",
+        "href": "/docs/network/diagnostics",
+        "tailRich": "— confirmer les nouveaux noms avec <em>Afficher la table d'acheminement</em> après le redémarrage."
+      }
+    ]
+  }
+}
diff --git a/web/messages/fr/docs/oci-manager/architecture.json b/web/messages/fr/docs/oci-manager/architecture.json
new file mode 100644
index 00000000..215730e8
--- /dev/null
+++ b/web/messages/fr/docs/oci-manager/architecture.json
@@ -0,0 +1,171 @@
+{
+  "meta": {
+    "title": "Comment une image OCI est adaptée | ProxMenux",
+    "description": "Du dépôt de l’image et de son fichier Compose à un modèle vérifiable, un plan de déploiement et un LXC natif de Proxmox VE, sans Docker à l’intérieur."
+  },
+  "header": {
+    "title": "Comment une image OCI est adaptée",
+    "description": "Du dépôt de l’image et de son fichier Compose à un modèle vérifiable, un plan de déploiement et un LXC natif, sans installer Docker à l’intérieur.",
+    "section": "OCI manager Apps"
+  },
+  "sections": [
+    {
+      "id": "pipeline",
+      "title": "Le processus d’adaptation",
+      "blocks": [
+        {
+          "mermaid": {
+            "chartCode": "flowchart LR\n A[\"{{repo}}\"] --> B[\"Compose + README\"]\n B --> C[\"{{converter}}\"]\n C --> D[\"{{template}}\"]\n D --> E{\"{{blockers}}\"}\n E -- \"{{no}}\" --> F[\"{{review}}\"]\n F --> D\n E -- \"{{yes}}\" --> G[\"{{plan}}\"]\n G --> H[\"pct create\"]\n H --> I[\"{{lxc}}\"]",
+            "labels": {
+              "repo": "Dépôt de l’image",
+              "converter": "Convertisseur",
+              "template": "Modèle JSON",
+              "blockers": "Aucun point bloquant ?",
+              "no": "Non",
+              "yes": "Oui",
+              "review": "Révision / overlay",
+              "plan": "Plan de déploiement",
+              "lxc": "LXC natif"
+            }
+          }
+        },
+        {
+          "p": "Le convertisseur lit l’image et le fichier Compose publiés par le projet, puis produit un modèle JSON. Si des exigences n’ont pas pu être adaptées et bloquent l’installation, le modèle est révisé avant sa publication dans le catalogue. Un fichier d’ajustements vérifiés, appelé overlay, permet de résoudre ces points. Seuls les modèles sans point bloquant sont proposés à l’installation."
+        }
+      ]
+    },
+    {
+      "id": "template",
+      "title": "Ce que conserve le modèle",
+      "blocks": [
+        {
+          "cards": {
+            "items": [
+              {
+                "icon": "archive",
+                "title": "Identité de l’image",
+                "body": "Dépôt, tag mis à jour en continu, architecture, digest résolu et révision de la source."
+              },
+              {
+                "icon": "braces",
+                "title": "Contrat du conteneur",
+                "body": "Entrypoint, Cmd, environnement, utilisateur, répertoire de travail, signal d’arrêt, ports et volumes."
+              },
+              {
+                "icon": "layers",
+                "title": "Adaptation à Proxmox VE",
+                "body": "Ressources, sécurité, points de montage, périphériques, sysctls, contrôles de bon fonctionnement et adaptations nécessaires pour chacun, avec leur justification."
+              },
+              {
+                "icon": "shield",
+                "title": "Compatibilité",
+                "body": "Clés prises en charge, exigences non adaptées qui bloquent l’installation et état de chaque validation."
+              }
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "sources",
+      "title": "OCI fournit le processus ; Compose fournit l’environnement",
+      "blocks": [
+        {
+          "table": {
+            "headers": [
+              "Source",
+              "Exemple",
+              "Résultat natif"
+            ],
+            "rows": [
+              [
+                "Métadonnées OCI",
+                "<code>Entrypoint</code>, <code>Cmd</code>, <code>User</code>",
+                "Proxmox VE les importe à la création du CT"
+              ],
+              [
+                "Docker Compose",
+                "<code>environment</code>, <code>volumes</code>, <code>devices</code>",
+                "Entrées d’environnement LXC, <code>mpN</code> et <code>devN</code>"
+              ],
+              [
+                "Profil ProxMenux",
+                "GPU, contrôle de bon fonctionnement, identifiants",
+                "Questions et adaptations vérifiées"
+              ],
+              [
+                "Utilisateur",
+                "VMID, stockage, réseau",
+                "Le contrat de l’instance"
+              ]
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "install",
+      "title": "Ce qui se passe pendant l’installation",
+      "blocks": [
+        {
+          "steps": {
+            "items": [
+              {
+                "title": "Résoudre la référence",
+                "body": "Le registre est interrogé, l’architecture de l’hôte est sélectionnée et le digest exact désigné par le tag mis à jour en continu est fixé."
+              },
+              {
+                "title": "Télécharger et vérifier",
+                "body": "Skopeo télécharge l’image sous forme d’archive OCI. Avant toute création, chaque couche est vérifiée à l’aide de son digest, puis décompressée. Si le téléchargement est endommagé, il est tenté une seconde fois avant l’arrêt de l’installation."
+              },
+              {
+                "title": "Créer le système de fichiers",
+                "body": "<code>pct create</code> crée le rootfs à partir de l’archive et conserve les métadonnées officielles du processus de l’image."
+              },
+              {
+                "title": "Raccorder les ressources",
+                "body": "Les volumes, le réseau, l’environnement, les périphériques et les profils de sécurité déclarés sont appliqués."
+              },
+              {
+                "title": "Console",
+                "body": "La sortie console du conteneur est conservée sur l’hôte. La console de Proxmox VE ouvre un shell si l’image en contient un."
+              },
+              {
+                "title": "Vérifier",
+                "body": "Au premier démarrage, l’installation attend l’attribution d’une adresse et la réponse du service. En cas d’échec, elle n’est pas signalée comme réussie."
+              },
+              {
+                "title": "Enregistrer la configuration",
+                "body": "La configuration effective est enregistrée dans le contrat de l’instance utilisé lors des mises à jour et des recréations."
+              }
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "example",
+      "title": "Exemple : une image avec /config et /downloads",
+      "intro": "Une définition Compose courante et la configuration Proxmox VE qui en résulte. Les chemins attendus par l’application ne changent pas.",
+      "blocks": [
+        {
+          "codeGrid": {
+            "items": [
+              {
+                "title": "Docker Compose",
+                "code": "image: lscr.io/linuxserver/example:latest\nenvironment:\n  - PUID=1000\n  - PGID=1000\nvolumes:\n  - config:/config\n  - /srv/downloads:/downloads\nports:\n  - 8080:8080"
+              },
+              {
+                "title": "/etc/pve/lxc/VMID.conf (extrait)",
+                "code": "entrypoint: /init\nmp0: local-lvm:vm-VMID-disk-1,mp=/config,backup=1,size=8G\nmp1: /srv/downloads,mp=/downloads\nnet0: name=eth0,bridge=vmbr0,ip=dhcp,type=veth\nlxc.environment.runtime: PUID=1000\nlxc.environment.runtime: PGID=1000"
+              }
+            ]
+          }
+        },
+        {
+          "p": "<code>mp0</code> est un second disque appartenant au conteneur, nommé <code>vm-VMID-disk-N</code> sur le stockage sélectionné. Il est monté dans <code>/config</code> et, avec <code>backup=1</code>, inclus dans la sauvegarde du conteneur. <code>mp1</code> ne crée aucun disque : il monte le répertoire de l’hôte <code>/srv/downloads</code> dans <code>/downloads</code> à l’intérieur du LXC. Le port 8080 n’est pas redirigé : le LXC possède sa propre adresse et le service y répond."
+        }
+      ]
+    }
+  ]
+}
diff --git a/web/messages/fr/docs/oci-manager/custom-image.json b/web/messages/fr/docs/oci-manager/custom-image.json
new file mode 100644
index 00000000..6817b296
--- /dev/null
+++ b/web/messages/fr/docs/oci-manager/custom-image.json
@@ -0,0 +1,278 @@
+{
+  "meta": {
+    "title": "Installer une image absente du catalogue | ProxMenux",
+    "description": "Adaptez une image OCI à partir d’un fichier Compose, d’une URL, d’une commande docker run ou d’une référence d’image, puis vérifiez ce que ProxMenux peut reproduire avant l’installation."
+  },
+  "header": {
+    "title": "Installer une image absente du catalogue",
+    "description": "Votre image est adaptée à partir de son fichier Compose, d’une commande docker run ou de sa seule référence. Le résultat est présenté pour vérification avant la création du moindre LXC.",
+    "section": "OCI manager Apps"
+  },
+  "sections": [
+    {
+      "id": "intro",
+      "blocks": [
+        {
+          "calloutInfo": {
+            "title": "Le même convertisseur et le même installateur",
+            "body": "L’option <strong>Installer une image absente du catalogue</strong> utilise le même convertisseur et le même installateur que les modèles du catalogue. Le contrat est simplement généré à ce moment-là à partir de la définition fournie, puis validé avant toute création de LXC."
+          }
+        }
+      ]
+    },
+    {
+      "id": "sources",
+      "title": "Comment décrire l’image",
+      "intro": "Le premier écran demande comment l’image est décrite. Quatre possibilités fournissent une définition à adapter, une cinquième utilise uniquement le nom de l’image et trois autres lisent un oci-compose déjà rédigé.",
+      "blocks": [
+        {
+          "table": {
+            "headers": [
+              "Option",
+              "Contenu lu"
+            ],
+            "rows": [
+              [
+                "Coller son fichier Compose dans le terminal",
+                "Collez le contenu YAML dans le terminal et terminez avec Ctrl+D."
+              ],
+              [
+                "Lire son fichier Compose depuis cet hôte",
+                "Un chemin sur le nœud, <code>/root/docker-compose.yml</code> par défaut. Le fichier doit exister et ne pas dépasser 256 KiB."
+              ],
+              [
+                "Télécharger son fichier Compose depuis une adresse",
+                "Une adresse <code>http://</code> ou <code>https://</code> qui fournit le YAML brut. Le téléchargement est limité à 256 KiB."
+              ],
+              [
+                "Coller sa commande docker run dans le terminal",
+                "La commande publiée par le projet. Les ports, l’environnement, les volumes, les périphériques, les capabilities, l’utilisateur, la mémoire partagée et les autres options prises en charge sont adaptés."
+              ],
+              [
+                "Uniquement la référence de l’image, sans fichier Compose",
+                "Une référence comme <code>ghcr.io/user/application:latest</code>. Le registre est interrogé et les métadonnées OCI de l’image sont conservées."
+              ],
+              [
+                "Coller un oci-compose dans le terminal",
+                "Collez le JSON dans le terminal et terminez avec Ctrl+D. Il n’est pas converti : il est vérifié puis installé tel qu’il est rédigé."
+              ],
+              [
+                "Lire un oci-compose depuis cet hôte",
+                "Un fichier JSON sur le nœud, <code>/root/oci-compose.json</code> par défaut, de 2 MiB au maximum."
+              ],
+              [
+                "Télécharger un oci-compose depuis une adresse",
+                "Une adresse <code>http://</code> ou <code>https://</code> qui fournit le fichier JSON. Le téléchargement est limité à 2 MiB."
+              ]
+            ]
+          }
+        },
+        {
+          "figure": {
+            "src": "/oci-manager/custom-source-menu.png",
+            "alt": "Menu de choix de la description d’une image absente du catalogue",
+            "caption": "Les façons de décrire une image absente du catalogue."
+          }
+        }
+      ]
+    },
+    {
+      "id": "reference-only",
+      "title": "Ce que fournit la seule référence de l’image",
+      "intro": "L’image contient les métadonnées de son processus, mais pas tout l’environnement habituellement ajouté par un fichier Compose.",
+      "blocks": [
+        {
+          "table": {
+            "headers": [
+              "Lu depuis l’image",
+              "Absent de l’image",
+              "Conséquence"
+            ],
+            "rows": [
+              [
+                "<code>Entrypoint</code>, <code>Cmd</code>, <code>User</code>, <code>WorkingDir</code> et l’environnement intégré",
+                "Variables présentes uniquement dans la documentation",
+                "Ajoutées pendant l’installation ou avec Modifier"
+              ],
+              [
+                "Volumes déclarés par l’image",
+                "Répertoires de l’hôte indiqués uniquement dans le fichier Compose",
+                "Les chemins supplémentaires sont ajoutés avant l’installation"
+              ],
+              [
+                "Ports <code>EXPOSE</code>",
+                "L’URL, le protocole ou le contrôle de bon fonctionnement",
+                "Le port et la méthode de vérification du service sont confirmés"
+              ],
+              [
+                "Architectures et digest dans le registre",
+                "Périphériques, privilèges ou dépendances externes",
+                "Ils ne sont pas activés sans une définition qui les demande"
+              ]
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "review",
+      "title": "Vérifier avant l’installation",
+      "intro": "Après adaptation de la définition, ProxMenux présente ce qu’il en a compris avant de demander le VMID, les ressources ou le stockage.",
+      "blocks": [
+        {
+          "steps": {
+            "items": [
+              {
+                "title": "Analyser",
+                "body": "Les services, l’image, les ports, les chemins, l’environnement, les périphériques, la sécurité et le contrôle de bon fonctionnement sont lus."
+              },
+              {
+                "title": "Interroger le registre",
+                "body": "L’image doit exister dans le registre et les architectures publiées sont affichées. Un registre privé est consulté avec le compte enregistré pour celui-ci."
+              },
+              {
+                "title": "Lister les options non appliquées",
+                "body": "Les labels, réseaux Docker, paramètres Swarm et autres clés sans effet sur un LXC sont répertoriés."
+              },
+              {
+                "title": "Bloquer les options sans équivalent sûr",
+                "body": "Les clés sans équivalent sûr apparaissent sous <strong>Options sans équivalent</strong> et empêchent la poursuite de l’installation. Aucune n’est ignorée silencieusement."
+              },
+              {
+                "title": "Demander les secrets",
+                "body": "Les variables dont le nom évoque un mot de passe, un jeton ou une clé sont demandées comme données sensibles pendant l’installation."
+              }
+            ]
+          }
+        },
+        {
+          "figure": {
+            "src": "/oci-manager/custom-review.png",
+            "alt": "Récapitulatif de l’interprétation du fichier Compose par ProxMenux",
+            "caption": "Récapitulatif affiché avant la demande du VMID et des ressources."
+          }
+        },
+        {
+          "p": "Après validation du récapitulatif, le parcours est celui du catalogue : nom, mode par défaut ou avancé, VMID, CPU, mémoire, réseau, démarrage avec le nœud, chemins persistants et supplémentaires, périphériques compatibles et récapitulatif final."
+        }
+      ]
+    },
+    {
+      "id": "examples",
+      "title": "Exemples de saisie",
+      "blocks": [
+        {
+          "codeGrid": {
+            "items": [
+              {
+                "title": "Compose",
+                "code": "services:\n  app:\n    image: ghcr.io/example/app:latest\n    ports:\n      - \"8080:8080\"\n    volumes:\n      - ./config:/config\n      - /srv/media:/media\n    environment:\n      TZ: Europe/Madrid"
+              },
+              {
+                "title": "docker run",
+                "code": "docker run -d \\\n  --name app \\\n  -p 8080:8080 \\\n  -e TZ=Europe/Madrid \\\n  -v app-config:/config \\\n  -v /srv/media:/media \\\n  ghcr.io/example/app:latest"
+              }
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "oci-compose",
+      "title": "Un oci-compose rédigé à la main",
+      "intro": "Un oci-compose est le fichier JSON à partir duquel une application est installée. Le catalogue en conserve un par application. Le même format peut être rédigé à la main et installé avec cette option.",
+      "blocks": [
+        {
+          "p": "Dans un fichier rédigé à la main, l’auteur définit l’image, les ports, les variables, les volumes et les questions de l’installation. ProxMenux complète le reste à la lecture. Le format permet d’exprimer ce que Compose ne prévoit pas : texte d’une question, mot de passe généré à l’installation, profil GPU, propriétaire de chaque volume, contrôle du premier démarrage ou identifiants affichés à la fin."
+        },
+        {
+          "steps": {
+            "items": [
+              {
+                "title": "Vérifier",
+                "body": "Un fichier contenant des erreurs n’est pas installé. Chaque erreur indique le champ concerné ; un JSON invalide signale la ligne et la colonne."
+              },
+              {
+                "title": "Examiner",
+                "body": "Un fichier valide affiche ce qu’il installe : image, adresse web, ports, chemins persistants, variables demandées et fichiers écrits pendant l’installation."
+              },
+              {
+                "title": "Installer",
+                "body": "L’installation suit le même parcours que pour toute application du catalogue, avec les paramètres par défaut ou avancés."
+              }
+            ]
+          }
+        },
+        {
+          "calloutWarning": {
+            "title": "Un fichier qui détermine les privilèges",
+            "body": "Un oci-compose détermine ce qui est monté dans le conteneur et avec quels privilèges. La vérification le précise avant l’installation : n’installez que des fichiers de sources fiables."
+          }
+        },
+        {
+          "p": "Le <readmeLink>README du moteur OCI</readmeLink> décrit le format bloc par bloc avec deux exemples complets. Un enregistrement d’installation peut aussi être lu de cette façon : seul le modèle d’origine est utilisé, sans aucune des réponses de cette installation."
+        }
+      ]
+    },
+    {
+      "id": "private-registries",
+      "title": "Images de registres privés",
+      "intro": "Une image d’un registre privé, comme un paquet privé GitHub ou un dépôt privé Docker Hub, est lue avec un compte enregistré dans ProxMenux.",
+      "blocks": [
+        {
+          "steps": {
+            "items": [
+              {
+                "title": "Le registre refuse l’accès à l’image",
+                "body": "Si le registre indique que l’image nécessite un compte, la vérification propose de s’y connecter, puis lit à nouveau l’image."
+              },
+              {
+                "title": "Se connecter",
+                "body": "Un nom d’utilisateur et un mot de passe ou jeton autorisé à télécharger l’image. Le registre les vérifie ; ils ne sont enregistrés que s’il les accepte."
+              },
+              {
+                "title": "Installer et maintenir à jour",
+                "body": "Ce compte sert au téléchargement pendant l’installation, ainsi qu’aux mises à jour, à Modifier, à Recréer, au watchdog et à la recherche de mises à jour du Monitor, sur chaque nœud du cluster."
+              }
+            ]
+          }
+        },
+        {
+          "p": "<strong>Comptes de registres</strong>, dans le menu principal d’OCI manager Apps, affiche les comptes enregistrés par registre et utilisateur, jamais leurs secrets. Chaque compte permet de vérifier, télécharger ou installer une image, ainsi que de mettre à jour ou supprimer les identifiants."
+        },
+        {
+          "list": {
+            "items": [
+              "GitHub (<code>ghcr.io</code>) : l’utilisateur est le compte GitHub et le mot de passe un jeton d’accès personnel avec l’autorisation <code>read:packages</code>.",
+              "Docker Hub (<code>docker.io</code>) : l’utilisateur est le compte Docker Hub et le mot de passe un jeton d’accès avec autorisation de lecture.",
+              "Autres registres, y compris avec un port propre comme <code>registry.example.com:5000</code> : l’utilisateur et le mot de passe ou jeton fournis par ce registre."
+            ]
+          }
+        },
+        {
+          "calloutInfo": {
+            "title": "Où les comptes sont conservés",
+            "body": "Dans <code>/etc/pve/priv/proxmenux/registry-auth.json</code>, lisible uniquement par root, dans le même dossier que les mots de passe de stockage de Proxmox. <code>/etc/pve</code> est partagé entre tous les nœuds du cluster : un compte ajouté sur un nœud est donc utilisé partout. La sauvegarde de l’hôte inclut ce fichier et la désinstallation de ProxMenux le supprime de tous les nœuds."
+          }
+        }
+      ]
+    },
+    {
+      "id": "limits",
+      "title": "Définitions qui ne sont pas installées",
+      "blocks": [
+        {
+          "list": {
+            "items": [
+              "Un Dockerfile sans image publiée : l’image doit d’abord être construite et publiée dans un registre OCI.",
+              "Un fichier Compose à plusieurs services : cette option installe un seul service par conteneur, même si plusieurs services utilisent la même image.",
+              "<code>configs</code>, secrets externes ou formats de périphériques impossibles à adapter sans ambiguïté.",
+              "Substitutions shell comme <code>$(command)</code> : il faut saisir directement la valeur résultante.",
+              "Options <code>docker run</code> non reconnues et <code>--env-file</code> : utilisez plutôt un fichier Compose aux valeurs explicites."
+            ]
+          }
+        }
+      ]
+    }
+  ]
+}
diff --git a/web/messages/fr/docs/oci-manager/hardware.json b/web/messages/fr/docs/oci-manager/hardware.json
new file mode 100644
index 00000000..e1bf73c0
--- /dev/null
+++ b/web/messages/fr/docs/oci-manager/hardware.json
@@ -0,0 +1,392 @@
+{
+  "meta": {
+    "title": "Dispositifs et accélération ProxMenux",
+    "description": "Comment OCI manager Apps rend les GPU, NVIDIA, Coral, USB, FUSE et autres périphériques accessibles à un conteneur OCI sous forme de ressources natives Proxmox VE validées."
+  },
+  "header": {
+    "title": "Dispositifs et accélération",
+    "description": "GPU, NVIDIA, Coral, USB, FUSE et les dispositifs de blocs deviennent des ressources natives validées Proxmox VE du conteneur.",
+    "section": "OCI manager Apps"
+  },
+  "sections": [
+    {
+      "id": "principle",
+      "title": "L'appareil dont l'application a besoin, pas l'hôte entier",
+      "blocks": [
+        {
+          "p": "Un appareil demandé par le fichier Compose ou par le profil d'application devient une entrée concrète <code>devN</code> ou un montage LXC. Demander un GPU, un périphérique USB ou un Coral ne rend pas le conteneur privilégié."
+        },
+        {
+          "flow": {
+            "nodes": [
+              {
+                "label": "Inventaire des hôtes",
+                "detail": "/dev/dri/renderD128\nGID 993 · Intel"
+              },
+              {
+                "label": "ProxMenux",
+                "detail": "fournisseur et\npermissions vérifiées"
+              },
+              {
+                "label": "LXC",
+                "detail": "même périphérique\nGID effectif"
+              }
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "origin",
+      "title": "D'où vient la demande de l'appareil",
+      "blocks": [
+        {
+          "table": {
+            "headers": [
+              "Source",
+              "Ce qui est lu",
+              "Ce que fait l'installateur"
+            ],
+            "rows": [
+              [
+                "Docker Compose",
+                "Demandes <code>devices</code>, <code>group_add</code>, <code>deploy.resources</code> et NVIDIA",
+                "Chaque exigence devient une demande d'appareil présentée pour examen"
+              ],
+              [
+                "Profil du catalogue",
+                "La prise en charge réelle des GPU, de Coral, d’OpenCL, d’USB ou de FUSE par l’application",
+                "Seules les options validées pour cette image sont proposées"
+              ],
+              [
+                "métadonnées d'images et documentation",
+                "VA-API, Selkies, LinuxServer mods ou le NVIDIA runtime",
+                "Les variables documentées et la préparation sont ajoutées"
+              ],
+              [
+                "Sélection de l'utilisateur",
+                "CPU uniquement, Intel/AMD, OpenCL, NVIDIA ou un appareil optionnel",
+                "La sélection est stockée dans le contrat d'instance"
+              ]
+            ]
+          }
+        },
+        {
+          "calloutWarning": {
+            "title": "Les périphériques détectés ne sont pas ajoutés automatiquement",
+            "body": "L'hôte est inventorié, mais seuls les appareils déclarés par le fichier Compose ou par un profil compatible sont proposés et attachés. Un GPU, un dongle USB ou un Coral présent sur l'hôte n'est pas exposé à tous les LXC."
+          }
+        }
+      ]
+    },
+    {
+      "id": "identify",
+      "title": "Comment le périphérique hôte est identifié",
+      "intro": "Avant que le LXC ne soit modifié, l'appareil est lu sur l'hôte et correspond au profil choisi.",
+      "blocks": [
+        {
+          "table": {
+            "headers": [
+              "Type",
+              "Identité",
+              "Validation"
+            ],
+            "rows": [
+              [
+                "Intel/AMD DRM",
+                "<code>/dev/dri/renderD*</code> et <code>/sys/class/drm/NODE/device/vendor</code>",
+                "Dispositif de caractères avec fournisseur <code>0x8086</code> (Intel) ou <code>0x1002</code> (AMD)"
+              ],
+              [
+                "AMD OpenCL",
+                "Le nœud de rendu, plus <code>/dev/kfd</code> lorsque le profil en a besoin",
+                "Existence, type, fournisseur, autorisations et compatibilité déclarée"
+              ],
+              [
+                "AMD ROCm",
+                "Le nœud de rendu, <code>/dev/kfd</code> et la génération indiquée par le pilote de calcul dans <code>/sys/class/kfd/kfd/topology/nodes/*/properties</code>",
+                "Une génération pour laquelle l’image ROCm de l’application contient des noyaux de calcul — les GPU RDNA2 cités et les plus récents — est proposée telle quelle. Les autres GPU de ces familles, comme les Radeon 680M et 780M, sont proposés à titre expérimental et jamais présélectionnés : ROCm ne les prend pas officiellement en charge, l’application les présente comme la génération de leur famille (<code>HSA_OVERRIDE_GFX_VERSION</code>) et l’installateur demande confirmation avant de télécharger l’image plus volumineuse. Une GPU plus ancienne, telle que la partie graphique intégrée d’un Ryzen 5000U, n’est pas proposée et Immich conserve la reconnaissance sur le CPU."
+              ],
+              [
+                "NVIDIA",
+                "<code>nvidia-smi</code> et <code>nvidia-container-cli</code>",
+                "GPU, UUID, PCI bus, version pilote, Toolkit, <code>/dev/nvidia*</code> nœuds, binaires et bibliothèques"
+              ],
+              [
+                "Coral PCIe/M.2",
+                "<code>/dev/apex_N</code> et son lien dans <code>/sys/dev/char/MAJOR:MINOR</code>",
+                "Nœud de caractère, majeur/mineur, propriétaire, GID et permissions"
+              ],
+              [
+                "USB et série",
+                "<code>/dev/ttyUSB*</code>, <code>/dev/ttyACM*</code> ou <code>/dev/bus/usb/BBB/DDD</code>",
+                "Nœud de caractère; pour USB aussi fournisseur, produit et série lorsque sysfs les publie"
+              ],
+              [
+                "KVM, TUN, FUSE, vidéo et SCSI générique",
+                "<code>/dev/kvm</code>, <code>/dev/net/tun</code>, <code>/dev/fuse</code>, <code>/dev/videoN</code> ou <code>/dev/sgN</code>",
+                "Chemin pris en charge, type de nœud et permissions effectives"
+              ],
+              [
+                "Lecteur optique",
+                "<code>/dev/srN</code>",
+                "Un périphérique bloc"
+              ]
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "install",
+      "title": "Ce qui se passe pendant l'installation",
+      "blocks": [
+        {
+          "steps": {
+            "items": [
+              {
+                "title": "Le modèle offre ses profils",
+                "body": "Par exemple CPU seulement, Intel/AMD VA-API, AMD OpenCL, Intel OpenCL ou NVIDIA. Les options appartiennent à l'image, pas à un menu commun."
+              },
+              {
+                "title": "Un profil est choisi",
+                "body": "Il définit les nœuds de périphérique, l'environnement, les mods ou l'exécution dont l'application a besoin."
+              },
+              {
+                "title": "Un chemin est proposé",
+                "body": "Pour DRM, <code>/dev/dri/renderD128</code>, qui peut être modifié sur un hôte avec plusieurs nœuds de rendu. Pour USB ou série, le nœud précis est sélectionné."
+              },
+              {
+                "title": "Validation",
+                "body": "L'existence, le type, le fournisseur autorisé, les autorisations et le GID sont vérifiés. Une inadéquation arrête l'opération."
+              },
+              {
+                "title": "Le contrat est écrit",
+                "body": "Chemin, mode, GID, accès à l'écriture et profil sont enregistrés pour les mises à jour et les recréations de conteneurs."
+              },
+              {
+                "title": "Ajout et vérification",
+                "body": "<code>pct set</code> ajoute l'entrée <code>devN</code> et l'accès est ensuite vérifié à l'intérieur du LXC. Les images LinuxServer sont également vérifiées en tant qu'utilisateur <code>abc</code>."
+              }
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "config",
+      "title": "Comment il apparaît dans la configuration LXC",
+      "intro": "Valeurs indicatives : <code>dev0</code> et <code>dev1</code> sont les emplacements libres attribués par Proxmox VE ; <code>renderD128</code>, <code>apex_0</code> et le GID dépendent du matériel du nœud.",
+      "blocks": [
+        {
+          "codeGrid": {
+            "items": [
+              {
+                "title": "Intel/AMD VA-API",
+                "code": "dev0: path=/dev/dri/renderD128,mode=0660,gid=993,deny-write=0"
+              },
+              {
+                "title": "Coral PCIe/M.2",
+                "code": "dev0: path=/dev/apex_0,mode=0660,gid=GID,deny-write=0"
+              },
+              {
+                "title": "Un périphérique USB spécifique",
+                "code": "dev0: path=/dev/bus/usb/003/004,mode=0660,gid=GID,deny-write=0"
+              },
+              {
+                "title": "AMD OpenCL",
+                "code": "dev0: path=/dev/dri/renderD128,mode=0660,gid=GID,deny-write=0\ndev1: path=/dev/kfd,mode=0660,gid=GID,deny-write=0"
+              }
+            ]
+          }
+        },
+        {
+          "p": "Le GID est lu avec <code>stat</code> sur l'hôte et écrit à l'entrée <code>devN</code>; les groupes <code>render</code> et <code>video</code> ne sont pas supposés avoir un nombre fixe. L'appareil conserve le même chemin <code>/dev</code> à l'intérieur du LXC, où les propres mécanismes de l'application le recherchent."
+        }
+      ]
+    },
+    {
+      "id": "profiles",
+      "title": "Profils qu'une image peut offrir",
+      "blocks": [
+        {
+          "table": {
+            "headers": [
+              "Profil",
+              "Configuration résultante",
+              "Proposé quand"
+            ],
+            "rows": [
+              [
+                "Intel/AMD VA-API",
+                "Le noeud de rendu <code>/dev/dri</code>",
+                "L'application prend en charge l'accélération vidéo"
+              ],
+              [
+                "OpenCL",
+                "Noeud Render, <code>/dev/kfd</code> au besoin et le mod officiel",
+                "L'image ou le profil le documente"
+              ],
+              [
+                "NVIDIA",
+                "Dispositifs pilotes et bibliothèques de l'hôte",
+                "L’hôte dispose d’un pilote fonctionnel et de NVIDIA Container Toolkit"
+              ],
+              [
+                "Coral",
+                "<code>/dev/apex_0</code> ou le bus USB",
+                "Le profil déclare la prise en charge de Coral (Frigate)"
+              ],
+              [
+                "USB, série, FUSE",
+                "Un seul appareil, un arbre validé ou une fonction LXC",
+                "Le contrat le demande"
+              ]
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "nvidia",
+      "title": "NVIDIA",
+      "blocks": [
+        {
+          "calloutWarning": {
+            "title": "Prérequis sur le nœud : NVIDIA Container Toolkit",
+            "body": "Un pilote fonctionnel sur Proxmox VE ne suffit pas à donner une GPU NVIDIA à une image OCI. OCI Manager Apps utilise <code>nvidia-container-cli</code>, de NVIDIA Container Toolkit, pour identifier les appareils et obtenir les binaires et les bibliothèques qui correspondent au pilote chargé."
+          }
+        },
+        {
+          "p": "Le <nvidiaLink>installateur NVIDIA de ProxMenux</nvidiaLink> installe NVIDIA Container Toolkit du dépôt officiel NVIDIA avec le pilote. Il vérifie ses quatre paquets, valide <code>nvidia-container-cli</code> et enregistre le résultat dans le journal de changement de <auditLink>Audit & Report</auditLink>."
+        },
+        {
+          "p": "Ces deux commandes sur l'hôte montrent si le pilote et le Toolkit sont disponibles :"
+        },
+        {
+          "shell": {
+            "code": "nvidia-smi -L\nnvidia-container-cli --version"
+          }
+        },
+        {
+          "p": "Sur un hôte où le pilote a été installé par d'autres moyens, le Toolkit est installé à partir du dépôt stable officiel:"
+        },
+        {
+          "shell": {
+            "code": "apt-get update\napt-get install -y --no-install-recommends ca-certificates curl gnupg2\n\ncurl -fsSL https://nvidia.github.io/libnvidia-container/gpgkey \\\n  | gpg --dearmor -o /usr/share/keyrings/nvidia-container-toolkit-keyring.gpg\n\ncurl -s -L https://nvidia.github.io/libnvidia-container/stable/deb/nvidia-container-toolkit.list \\\n  | sed 's#deb https://#deb [signed-by=/usr/share/keyrings/nvidia-container-toolkit-keyring.gpg] https://#g' \\\n  > /etc/apt/sources.list.d/nvidia-container-toolkit.list\n\napt-get update\napt-get install -y nvidia-container-toolkit libnvidia-container-tools"
+          }
+        },
+        {
+          "p": "L’inventaire utilisé par OCI manager Apps provient de la sortie de :"
+        },
+        {
+          "shell": {
+            "code": "nvidia-container-cli list --device all --libraries --binaries --firmwares --ipcs"
+          }
+        },
+        {
+          "calloutInfo": {
+            "title": "La configuration d'exécution Docker n'est pas impliquée",
+            "body": "Les conteneurs sont des LXC natifs sans démon Docker : <code>nvidia-ctk runtime configure --runtime=docker</code> ne joue donc aucun rôle. ProxMenux interroge directement <code>nvidia-container-cli</code> et écrit les périphériques et montages LXC. Les commandes et plateformes prises en charge sont maintenues dans le <toolkitLink>guide d’installation de NVIDIA Container Toolkit</toolkitLink>."
+          }
+        },
+        {
+          "cards": {
+            "items": [
+              {
+                "icon": "cpu",
+                "title": "Inventaire issu du pilote",
+                "body": "<code>nvidia-container-cli</code> énumère les nœuds de périphérique, les binaires, les micrologiciels et les bibliothèques du pilote installé."
+              },
+              {
+                "icon": "refresh",
+                "title": "Pas de version fixe",
+                "body": "Le modèle ne nomme pas les fichiers de bibliothèque. Le profil est généré à partir de l'hôte actuel."
+              },
+              {
+                "icon": "shield",
+                "title": "Montages en lecture seule",
+                "body": "Les bibliothèques hôtes sont montées en lecture seule au lieu d'être copiées dans le conteneur."
+              },
+              {
+                "icon": "hardDrive",
+                "title": "Changements de pilote",
+                "body": "Après un changement de pilote, l'inventaire est généré à nouveau avant le démarrage des LXC touchés."
+              }
+            ]
+          }
+        },
+        {
+          "code": {
+            "title": "Résultat NVIDIA (simplifié)",
+            "code": "devN: path=/dev/nvidia0,...\ndevN: path=/dev/nvidiactl,...\ndevN: path=/dev/nvidia-uvm,...\nlxc.mount.entry: HOST_LIBRARY CONTAINER_LIBRARY none ro,bind,create=file 0 0"
+          }
+        },
+        {
+          "p": "Passer uniquement <code>/dev/nvidia0</code> ne suffit pas. Les composants espace utilisateur du pilote chargé sont montés en lecture seule, et <code>nvidia-smi</code> fonctionne ensuite à l'intérieur du LXC pour comparer GPU, UUID, PCI bus et version avec l'inventaire hôte."
+        }
+      ]
+    },
+    {
+      "id": "usb",
+      "title": "Coral USB, série et USB",
+      "blocks": [
+        {
+          "calloutWarning": {
+            "title": "La numérotation USB peut changer",
+            "body": "Un chemin tel que <code>/dev/bus/usb/003/004</code> peut changer lorsque le périphérique est reconnecté ou que l'hôte redémarre. Le profil enregistre le fournisseur, le produit et la série lorsqu'ils sont disponibles, mais une nouvelle adresse de bus n'est pas automatiquement réaffectée."
+          }
+        },
+        {
+          "p": "Un périphérique est donné par son nœud concret : <code>/dev/ttyUSB0</code>, <code>/dev/ttyACM0</code>, <code>/dev/apex_0</code> ou <code>/dev/bus/usb/BBB/DDD</code>. Passer l'intégralité de <code>/dev</code> n'est pas accepté. Coral est proposé uniquement aux applications dont le profil le déclare."
+        }
+      ]
+    },
+    {
+      "id": "trees",
+      "title": "Arbres de périphériques et fonctionnalités LXC",
+      "blocks": [
+        {
+          "table": {
+            "headers": [
+              "Demande",
+              "Configuration résultante",
+              "Portée"
+            ],
+            "rows": [
+              [
+                "<code>/dev/dvb</code>, <code>/dev/snd</code> ou <code>/dev/bus/usb</code>",
+                "Chaque noeud de caractère de l'arbre obtient sa propre entrée <code>devN</code> avec le mode hôte et GID",
+                "Seulement l'arbre demandé, pas le reste de <code>/dev</code>"
+              ],
+              [
+                "<code>/dev/fuse</code>",
+                "Le nœud et, lorsque le profil en a besoin, la fonction <code>fuse=1</code>",
+                "FUSE seul ne publie pas de montages sur d'autres LXC"
+              ],
+              [
+                "<code>/dev/net/tun</code>",
+                "Une entrée <code>devN</code> sur le même chemin à l'intérieur du LXC",
+                "La configuration VPN ou réseau reste dans l'application"
+              ],
+              [
+                "<code>/dev/kvm</code>",
+                "Une entrée <code>devN</code> validée",
+                "Offert seulement lorsque le contrat le demande"
+              ]
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "security",
+      "title": "Confirmations par niveau de risque",
+      "blocks": [
+        {
+          "p": "Les périphériques concrets, les privilèges facultatifs, les privilèges requis, la relaxation AppArmor ou seccomp et l'accès à l'espace de noms PID hôte sont traités comme des cas distincts, et non sous une seule étiquette privilégiée générique. Chaque option présentant un risque est expliquée et confirmée lors de l'installation."
+        }
+      ]
+    }
+  ]
+}
diff --git a/web/messages/fr/docs/oci-manager/index.json b/web/messages/fr/docs/oci-manager/index.json
new file mode 100644
index 00000000..9a82d408
--- /dev/null
+++ b/web/messages/fr/docs/oci-manager/index.json
@@ -0,0 +1,213 @@
+{
+  "meta": {
+    "title": "OCI manager Apps | ProxMenux",
+    "description": "Exécutez des images OCI officielles dans des conteneurs LXC natifs de Proxmox VE, avec des données persistantes, l’accès aux périphériques, des applications à plusieurs conteneurs et des mises à jour transactionnelles."
+  },
+  "header": {
+    "title": "OCI manager Apps",
+    "description": "Les images OCI officielles s’exécutent dans des conteneurs LXC natifs de Proxmox VE. L’image reste celle publiée par son mainteneur ; ProxMenux reproduit l’environnement que Docker Compose aurait créé autour d’elle.",
+    "section": "OCI manager Apps"
+  },
+  "sections": [
+    {
+      "id": "model",
+      "blocks": [
+        {
+          "calloutInfo": {
+            "title": "Une image OCI, un LXC natif",
+            "body": "Aucun moteur Docker ne s’exécute dans les conteneurs. Proxmox VE importe le système de fichiers de l’image et ses métadonnées OCI. L’application devient le processus principal d’un LXC natif, administré avec les mêmes outils que les autres conteneurs du nœud."
+          }
+        },
+        {
+          "flow": {
+            "nodes": [
+              {
+                "label": "Source",
+                "detail": "Image OCI\nCompose et documentation"
+              },
+              {
+                "label": "ProxMenux",
+                "detail": "Contrat JSON\nvalidation et planification"
+              },
+              {
+                "label": "Proxmox VE",
+                "detail": "LXC natif\nvolumes et périphériques"
+              }
+            ],
+            "caption": "L’application d’origine est conservée : son environnement est décrit de façon déclarative, puis reproduit."
+          }
+        }
+      ]
+    },
+    {
+      "id": "where",
+      "title": "Où le trouver",
+      "intro": "Sur le nœud Proxmox, en tant que root, ouvrez <strong>OCI manager Apps (Technology Preview)</strong> dans le menu principal de ProxMenux. Le premier écran propose :",
+      "blocks": [
+        {
+          "list": {
+            "items": [
+              "<strong>Rechercher des applications</strong> : rechercher par nom dans tout le catalogue.",
+              "<strong>Toutes les applications</strong> : afficher le catalogue complet et le nombre d’applications.",
+              "<strong>Gérer les applications OCI installées</strong> : mettre à jour, modifier, supprimer ou récupérer les applications déjà installées.",
+              "<strong>Comptes de registres</strong> : gérer les comptes utilisés pour installer et mettre à jour des images provenant de registres privés.",
+              "<strong>Installer une image absente du catalogue</strong> : adapter un fichier Compose, une commande <code>docker run</code> ou une référence d’image.",
+              "Les catégories du catalogue, chacune avec son nombre d’applications."
+            ]
+          }
+        },
+        {
+          "figure": {
+            "src": "/oci-manager/main-menu.png",
+            "alt": "Écran principal d’OCI manager Apps avec recherche, catalogue complet, gestion des applications, images hors catalogue et catégories.",
+            "caption": "Écran principal d’OCI manager Apps."
+          }
+        },
+        {
+          "p": "La sélection d’une application affiche sa description, l’image utilisée et deux modes d’installation. <strong>Installer avec les paramètres par défaut</strong> ne application que les choix essentiels : stockage, emplacement des données, adresse et démarrage. <strong>Installer avec les paramètres avancés</strong> présente toutes les décisions dans l’ordre : VMID et ressources, stockage de chaque chemin, pont réseau et périphériques."
+        },
+        {
+          "p": "Les applications effectivement testées affichent <strong>Vérifié</strong> dans cette vue et portent un ✓ dans les listes, que le test ait été effectué dans le laboratoire ProxMenux ou par la communauté."
+        }
+      ]
+    },
+    {
+      "id": "beta",
+      "title": "Pourquoi le label Technology Preview est conservé",
+      "blocks": [
+        {
+          "p": "OCI manager Apps conserve le label <strong>Technology Preview</strong> que Proxmox VE attribue aux conteneurs d’applications créés à partir d’images OCI, dont la prise en charge a été introduite dans Proxmox VE 9.1. Ce label concerne la technologie sur laquelle repose OCI manager Apps, et non le moteur de ProxMenux : le comportement de ces conteneurs peut encore changer entre les versions de Proxmox VE. Le label restera en place jusqu’à ce que Proxmox VE considère cette prise en charge comme stable."
+        },
+        {
+          "p": "Le moteur d’OCI manager Apps est testé dans le laboratoire ProxMenux : installation, mise à jour, modification, recréation, sauvegarde, restauration, migration et watchdog. Chaque application est vérifiée séparément. Celles qui ont été effectivement testées affichent <strong>Vérifié</strong> et portent un ✓ dans les listes."
+        }
+      ]
+    },
+    {
+      "id": "translation",
+      "title": "Comment Docker décrit les besoins et comment OCI manager Apps les applique",
+      "blocks": [
+        {
+          "table": {
+            "headers": [
+              "Besoin",
+              "Expression dans Docker",
+              "Mise en œuvre par OCI manager Apps"
+            ],
+            "rows": [
+              [
+                "Exécuter l’application",
+                "<code>image</code>, <code>entrypoint</code>, <code>command</code>",
+                "Le rootfs OCI et le processus principal du LXC"
+              ],
+              [
+                "Conserver la configuration",
+                "<code>volumes: /config</code>",
+                "Un volume persistant <code>mpN</code> inclus dans la sauvegarde, ou un répertoire de l’hôte."
+              ],
+              [
+                "Rendre le service accessible",
+                "<code>ports</code>",
+                "Une adresse propre au LXC et l’URL d’accès au service."
+              ],
+              [
+                "Utiliser du matériel",
+                "<code>devices</code>, <code>group_add</code>",
+                "Des entrées <code>devN</code> avec le GID effectif de l’hôte et un profil validé."
+              ],
+              [
+                "Relier les dépendances",
+                "<code>networks</code>, <code>depends_on</code>",
+                "Un pont réseau privé, des adresses fixes, un ordre de démarrage et des contrôles de bon fonctionnement."
+              ],
+              [
+                "Mettre à jour",
+                "Télécharger avec <code>pull</code> et recréer",
+                "Un nouveau rootfs avec le même contrat de persistance."
+              ]
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "kept",
+      "title": "Ce qui est conservé et ce qui change",
+      "blocks": [
+        {
+          "cards": {
+            "items": [
+              {
+                "icon": "archive",
+                "title": "Conservé",
+                "body": "L’image officielle, ses chemins internes, son environnement, son processus de démarrage et sa documentation d’utilisation."
+              },
+              {
+                "icon": "boxes",
+                "title": "Adapté",
+                "body": "L’environnement d’exécution : le réseau, la persistance, les périphériques, les permissions et les dépendances utilisent les mécanismes LXC natifs de Proxmox VE."
+              },
+              {
+                "icon": "shield",
+                "title": "Sans équivalent",
+                "body": "Une option Compose sans équivalent sûr est signalée comme un point bloquant. Les modèles comportant des points bloquants ne sont pas proposés à l’installation, et les options sensibles doivent être confirmées pendant l’assistant."
+              },
+              {
+                "icon": "refresh",
+                "title": "Enregistré",
+                "body": "Le digest de l’image, les ressources, les chemins, le réseau, les périphériques et l’appartenance à une pile sont enregistrés dans le contrat de l’instance. Les mises à jour et les recréations reproduisent ce contrat."
+              }
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "pages",
+      "title": "Pages de cette section",
+      "blocks": [
+        {
+          "next": {
+            "items": [
+              {
+                "label": "Comment une image OCI est adaptée",
+                "href": "/docs/oci-manager/architecture",
+                "tail": "De l’image et de son fichier Compose à un LXC natif."
+              },
+              {
+                "label": "Installer une image absente du catalogue",
+                "href": "/docs/oci-manager/custom-image",
+                "tail": "Un fichier Compose, une commande docker run ou une référence d’image."
+              },
+              {
+                "label": "Données, chemins et réseau",
+                "href": "/docs/oci-manager/storage-network",
+                "tail": "Volumes du conteneur, répertoires de l’hôte, montages rclone et adresses."
+              },
+              {
+                "label": "Périphériques et accélération",
+                "href": "/docs/oci-manager/hardware",
+                "tail": "GPU, NVIDIA, Coral, USB et autres périphériques."
+              },
+              {
+                "label": "Applications à plusieurs conteneurs",
+                "href": "/docs/oci-manager/stacks",
+                "tail": "Application, base de données et cache dans des LXC coordonnés."
+              },
+              {
+                "label": "Installer, mettre à jour et modifier",
+                "href": "/docs/oci-manager/lifecycle",
+                "tail": "Le contrat de l’instance et ses opérations."
+              },
+              {
+                "label": "Dans ProxMenux Monitor",
+                "href": "/docs/oci-manager/monitor",
+                "tail": "Versions, mises à jour, sortie console et terminal."
+              }
+            ]
+          }
+        }
+      ]
+    }
+  ]
+}
diff --git a/web/messages/fr/docs/oci-manager/lifecycle.json b/web/messages/fr/docs/oci-manager/lifecycle.json
new file mode 100644
index 00000000..5030ebcc
--- /dev/null
+++ b/web/messages/fr/docs/oci-manager/lifecycle.json
@@ -0,0 +1,499 @@
+{
+  "meta": {
+    "title": "Installer, mettre à jour et modifier | ProxMenux",
+    "description": "Le contrat d'instance d'un conteneur OCI et les opérations qui s'appuient dessus : mise à jour, modification, suppression, reprise d'une opération interrompue et remise en service après une restauration sur cet hôte ou un autre."
+  },
+  "header": {
+    "title": "Installer, mettre à jour et modifier",
+    "description": "Chaque instance conserve un contrat reproductible, ce qui permet de remplacer son rootfs sans perdre sa configuration ni ses données persistantes.",
+    "section": "OCI manager Apps"
+  },
+  "sections": [
+    {
+      "id": "contract",
+      "title": "Le contrat d'instance",
+      "blocks": [
+        {
+          "p": "Après l'installation, la configuration effective est enregistrée dans <code>/usr/local/share/proxmenux/oci/instances/VMID/oci-compose.json</code>. Il ne s'agit pas d'une copie du fichier Compose d'origine : c'est le contrat reproductible du LXC présent sur cet hôte."
+        },
+        {
+          "code": {
+            "code": "instances/\n└── 105/\n    └── oci-compose.json\n        ├── image and resolved digest\n        ├── resources and network\n        ├── environment (secrets protected)\n        ├── container disks and host directories\n        ├── hardware profile and devices\n        ├── console log and terminal mode\n        └── stack membership and lifecycle"
+          }
+        },
+        {
+          "p": "Une copie du contrat est conservée dans le conteneur, dans <code>/.proxmenux/oci-record.json</code>, et seul l'utilisateur root du conteneur peut la lire. Une sauvegarde du conteneur emporte donc toujours le contrat en vigueur au moment de la sauvegarde. Une seconde copie est conservée dans <code>/etc/pve/priv/proxmenux/oci</code>, un emplacement partagé par tous les nœuds du cluster et lisible uniquement par root sur l'hôte. Les deux copies sont écrites après chaque installation, mise à jour et modification."
+        }
+      ]
+    },
+    {
+      "id": "manage",
+      "title": "Gérer les applications OCI installées",
+      "intro": "Cette option de l'écran principal liste les instances enregistrées avec leur application et image. Chacun d'eux est vérifié par rapport à son contrat avant toute action; un CT qui ne correspond plus à son enregistrement n'est ni modifié ni supprimé. La même mise à jour et le même éditeur sont proposés dans l'onglet Mises à jour de <monitorLink>ProxMenux Monitor</monitorLink>.",
+      "blocks": [
+        {
+          "table": {
+            "headers": [
+              "Option",
+              "Ce qui change",
+              "Ce qui est gardé"
+            ],
+            "rows": [
+              [
+                "Mettre à jour l'image avec la configuration enregistrée",
+                "Le rootfs est remplacé par l'image actuellement publiée sur le canal enregistré",
+                "Contrat, disques de conteneur, répertoires hôtes, réseau et appareils"
+              ],
+              [
+                "Modifier : éditer les ressources, le réseau, les chemins et le GPU",
+                "L'éditeur s'ouvre avec le contrat actuel; le CT est reconstruit avec les modifications",
+                "Les données des disques de conteneur et des répertoires hôtes"
+              ],
+              [
+                "Watchdog : redémarrer l'application lorsqu'elle plante",
+                "Détermine si l'application est relancée lorsqu'elle s'arrête d'elle-même. Rien n'est reconstruit",
+                "L'ensemble de l'installation ; seul le choix est sauvegardé dans le contrat"
+              ],
+              [
+                "Supprimer: supprimer l'application et ses conteneurs",
+                "Le LXC, ou chaque membre d'une pile, et leurs contrats sont supprimés",
+                "Répertoires hôtes, avec leur contenu"
+              ]
+            ]
+          }
+        },
+        {
+          "p": "Pour une application à plusieurs conteneurs, le menu propose <strong>Mettre à jour tous les conteneurs de l'application</strong>, <strong>Modifier les chemins et périphériques supplémentaires</strong>, <strong>Recréer tous les conteneurs avec leur configuration enregistrée</strong>, le watchdog et la suppression. Modifier ajoute ou supprime les chemins et périphériques supplémentaires du conteneur applicatif sans rien reconstruire et, pour Immich, change le composant qui exécute la reconnaissance. Recréer reconstruit chaque conteneur à partir de l'image utilisée lors de son installation, sans en chercher une plus récente."
+        },
+        {
+          "figure": {
+            "src": "/oci-manager/manage-menu.png",
+            "alt": "Liste des applications OCI installées, avec les options de mise à jour, de modification et de suppression",
+            "caption": "Gérer les applications OCI installées."
+          }
+        }
+      ]
+    },
+    {
+      "id": "update",
+      "title": "Une mise à jour transactionnelle",
+      "blocks": [
+        {
+          "mermaid": {
+            "chartCode": "sequenceDiagram\n participant U as {{user}}\n participant P as ProxMenux\n participant R as {{registry}}\n participant X as Proxmox VE\n U->>P: {{update}}\n P->>R: {{resolve}}\n R-->>P: digest\n P->>P: {{verify}}\n P->>X: {{backup}}\n P->>X: {{import}}\n P->>X: {{reapply}}\n X-->>P: healthcheck\n alt {{healthy}}\n  P-->>U: {{commit}}\n else {{failure}}\n  P->>X: Rollback\n  P-->>U: {{restored}}\n end",
+            "labels": {
+              "user": "Utilisateur",
+              "registry": "Registre OCI",
+              "update": "Mettre à jour l'instance",
+              "resolve": "Résoudre la balise",
+              "verify": "Vérifier l’archive et effectuer les contrôles préalables",
+              "backup": "Arrêter et sauvegarder le CT",
+              "import": "Importer le nouveau rootfs",
+              "reapply": "Appliquer à nouveau le contrat",
+              "healthy": "sain",
+              "failure": "défaillance",
+              "commit": "Contrat publié avec le nouveau digest",
+              "restored": "instance précédente restaurée"
+            }
+          }
+        },
+        {
+          "list": {
+            "items": [
+              "Lorsque le registre sert encore le digest installé, rien n'est téléchargé et l'instance n'est pas touchée.",
+              "La nouvelle image est vérifiée couche par couche avant l'arrêt du CT. Un téléchargement qui arrive endommagé est récupéré une deuxième fois ; une image déjà mise en cache qui échoue la vérification est à nouveau téléchargée.",
+              "Les paramètres modifiés dans Proxmox VE après l'installation (mémoire, swap, cœurs, limite et priorité du CPU, démarrage avec le nœud) sont conservés et intégrés au nouveau contrat.",
+              "L'interface LAN ajoutée par la suite Arr et les applications à plusieurs conteneurs (<code>net1</code>), ainsi que l'ordre de démarrage (<code>startup</code>), sont réappliqués tels quels au nouveau conteneur.",
+              "Toute autre différence entre le CT et son contrat arrête la mise à jour avant que le CT ne soit arrêté."
+            ]
+          }
+        },
+        {
+          "flow": {
+            "nodes": [
+              {
+                "label": "Avant",
+                "detail": "rootfs A\n/config mp0\n/media répertoire de l’hôte"
+              },
+              {
+                "label": "Mise à jour",
+                "detail": "remplace uniquement\nle rootfs"
+              },
+              {
+                "label": "Après",
+                "detail": "rootfs B\n/config mp0\n/media répertoire de l’hôte"
+              }
+            ]
+          }
+        },
+        {
+          "p": "Avant tout arrêt, l'opération vérifie l'espace nécessaire à la sauvegarde : les données utilisées sur les volumes inclus, plus une marge. La sauvegarde est écrite à côté de l'enregistrement de l'application, sur le disque système de l'hôte. Si l'espace y est insuffisant, le menu demande un autre stockage de l'hôte acceptant les sauvegardes. La sauvegarde y est créée puis supprimée à la fin de l'opération. Ce choix est mémorisé pour l'application, y compris pour les mises à jour planifiées. Si aucun stockage n'a assez de place, l'opération est refusée et l'application reste inchangée. L'espace nécessaire à la nouvelle image est également vérifié avant son téléchargement."
+        }
+      ]
+    },
+    {
+      "id": "recovery",
+      "title": "Récupération d'une opération interrompue",
+      "intro": "Une mise à jour et un changement utilisent une transaction persistante. Si le processus, le terminal ou le nœud est interrompu après l'arrêt du CT, l'opération n'est pas prise comme terminée.",
+      "blocks": [
+        {
+          "steps": {
+            "items": [
+              {
+                "title": "Marqueur en attente",
+                "body": "À l'ouverture de Gérer les applications OCI installées, l'état enregistré indique que le remplacement n'a jamais été publié."
+              },
+              {
+                "title": "Afficher l’état",
+                "body": "Affiche la phase qui a été atteinte sans changer de conteneur ou de données."
+              },
+              {
+                "title": "Récupérer l'installation précédente",
+                "body": "Restaure la sauvegarde native vérifiée réalisée avant le remplacement, ainsi que le contrat précédent."
+              },
+              {
+                "title": "Piles traitées comme une unité",
+                "body": "Pour une application multi-conteneurs, chaque membre est récupéré du même point de transaction, pas seulement celui sélectionné."
+              }
+            ]
+          }
+        },
+        {
+          "calloutWarning": {
+            "title": "Les répertoires de l’hôte sont exclus du retour arrière",
+            "body": "La sauvegarde couvre le rootfs et les disques du conteneur qui y sont inclus. Un répertoire de l’hôte n’est pas rétabli à son état précédent, car d’autres LXC peuvent utiliser ses données."
+          }
+        }
+      ]
+    },
+    {
+      "id": "watchdog",
+      "title": "Watchdog: redémarrer une application qui s'arrête",
+      "intro": "Proxmox n'a pas de politique de redémarrage : quand le processus d'un conteneur applicatif se termine, le conteneur reste arrêté. Si le watchdog est activé, une application qui s'arrête d'elle-même est relancée. Il joue pour une application OCI le rôle de <code>restart: unless-stopped</code> dans un fichier Compose.",
+      "blocks": [
+        {
+          "table": {
+            "headers": [
+              "Ce qui se passe",
+              "Avec le watchdog activé"
+            ],
+            "rows": [
+              [
+                "L’application plante ou son processus se termine",
+                "Le conteneur est relancé en quelques secondes"
+              ],
+              [
+                "Il est arrêté ou éteint depuis Proxmox, depuis le Monitor ou avec <code>pct</code>",
+                "Il reste arrêté jusqu’à ce que quelqu’un le démarre"
+              ],
+              [
+                "Une sauvegarde, une migration ou une opération ProxMenux travaille dessus",
+                "Rien n'est fait jusqu'à la fin"
+              ],
+              [
+                "Il était déjà arrêté au démarrage de l’hôte",
+                "Il reste arrêté ; cela dépend de <strong>Démarrer avec Proxmox</strong>"
+              ],
+              [
+                "Il s’arrête systématiquement juste après son démarrage",
+                "Pour une application qui s’arrête quelques secondes après son démarrage ou qui ne démarre pas, cinq tentatives sont effectuées, séparées par des délais de 30 secondes, 1, 2 et 5 minutes. Elle reste ensuite arrêtée et une notification est envoyée"
+              ]
+            ]
+          }
+        },
+        {
+          "p": "L'installateur pose la question dans les deux modes d'installation et propose la valeur déclarée par la recette de l'application. Ce réglage peut ensuite être modifié dans <strong>Gérer les applications OCI installées</strong> ou avec le commutateur <strong>Watchdog</strong> du conteneur dans <monitorLink>ProxMenux Monitor</monitorLink>. Il s'applique à tous les conteneurs d'une application à plusieurs conteneurs. Un seul service de l'hôte, <code>proxmenux-oci-watchdog.service</code>, surveille les applications pour lesquelles il est activé ; son installation figure dans l'onglet Modifications d'Audit & Report."
+        },
+        {
+          "calloutInfo": {
+            "title": "Ce que l'hôte ne peut pas dire",
+            "body": "Le code de sortie de l'application ne parvient pas à l'hôte. Un arrêt normal et un plantage sont donc indiscernables et entraînent tous deux un redémarrage, comme avec <code>always</code> et <code>unless-stopped</code> dans Docker. Un arrêt demandé en dehors de Proxmox, avec <code>lxc-stop</code> ou <code>systemctl</code>, ne laisse aucune tâche d'arrêt et est interprété comme un arrêt spontané."
+          }
+        }
+      ]
+    },
+    {
+      "id": "restore",
+      "title": "Sauvegarde, restauration et un autre hôte",
+      "intro": "Une sauvegarde réalisée avec vzdump ou Proxmox Backup Server contient le conteneur, les disques du conteneur sélectionnés pour la sauvegarde et la copie de son contrat. Les éléments conservés par l'installation sur l'hôte n'en font pas partie. <strong>Gérer les applications OCI installées</strong> détecte les conteneurs restaurés sur un hôte dépourvu de leur contrat, après une nouvelle installation de Proxmox ou sur un autre hôte, et propose de les enregistrer à nouveau.",
+      "blocks": [
+        {
+          "steps": {
+            "items": [
+              {
+                "title": "Restaurer les conteneurs dans Proxmox",
+                "body": "Depuis le stockage de sauvegarde, avec l’ID d’origine ou tout autre ID libre. Une application à plusieurs conteneurs nécessite tous ses conteneurs."
+              },
+              {
+                "title": "Ouvrir la gestion des applications OCI installées",
+                "body": "Les conteneurs restaurés sont listés et la récupération est proposée. Le bouton <strong>Récupérer</strong> de l’onglet Mises à jour de <monitorLink>ProxMenux Monitor</monitorLink> ouvre la même récupération."
+              },
+              {
+                "title": "Vérifier avant de changer",
+                "body": "La récupération vérifie que l'hôte a tout ce dont chaque application a besoin. Une application qui ne peut pas être récupérée entière est laissée comme elle a été trouvée, avec la raison."
+              },
+              {
+                "title": "Enregistrer et démarrer",
+                "body": "Le contrat est enregistré sur cet hôte et les éléments que l'installation y conservait sont réécrits. Le démarrage des applications fait l'objet d'une question distincte, à laquelle il faut répondre Non si les conteneurs d'origine fonctionnent encore sur un autre hôte."
+              }
+            ]
+          }
+        },
+        {
+          "figure": {
+            "src": "/oci-manager/restore-offer.png",
+            "alt": "Boîte de dialogue qui énumère les conteneurs restaurés et propose de les récupérer",
+            "caption": "La récupération offerte lors de l'ouverture de la gestion des applications OCI installées."
+          }
+        },
+        {
+          "table": {
+            "headers": [
+              "Ce que l'hôte a gardé",
+              "Après la récupération"
+            ],
+            "rows": [
+              [
+                "Contrat d’instance",
+                "Enregistré à partir de la copie conservée dans le conteneur et vérifié par rapport à la configuration restaurée par Proxmox"
+              ],
+              [
+                "Réseau privé d'une application multiconteneurs",
+                "Recréé avec le même pont et sous-réseau ; les adresses fixes des conteneurs ne changent pas"
+              ],
+              [
+                "Ordre de démarrage d'une application multi-conteneurs",
+                "Le hookscript de dépendance et son contrat sont à nouveau installés ; les extraits sont activés sur le stockage <code>local</code> quand aucun stockage ne les accepte"
+              ],
+              [
+                "Sysctls réseau et fichier host-monitor",
+                "Ecrit à nouveau en <code>/etc/pve/proxmenux</code>"
+              ],
+              [
+                "Environnement d’exécution NVIDIA",
+                "Le hook d’un conteneur non privilégié est réinstallé. Un conteneur privilégié reçoit les fichiers de pilote de cet hôte à la place de ceux de son hôte d’origine"
+              ],
+              [
+                "Rclone montage",
+                "Le hookscript et les programmes qui publient le montage sont à nouveau écrits, avec les mêmes vues sur l'hôte"
+              ],
+              [
+                "Règle du pare-feu d'un moniteur hôte",
+                "Une nouvelle confirmation est demandée pour son port web et le sous-réseau du pont sur cet hôte"
+              ],
+              [
+                "<code>lost+found</code> de chaque disque restauré",
+                "Supprimé s’il est vide ; une restauration le crée et certaines applications ne démarrent pas s’il figure dans leurs données"
+              ],
+              [
+                "Disques restaurés sur un autre stockage",
+                "Le contrat est mis à jour pour refléter le stockage sur lequel ils se trouvent maintenant"
+              ]
+            ]
+          }
+        },
+        {
+          "p": "Un conteneur restauré avec un autre ID conserve son application. Le contrat, son journal de console, ses paramètres sysctl réseau, le hookscript d'un montage Rclone et l'ordre de démarrage d'une application à plusieurs conteneurs sont enregistrés avec les ID des conteneurs sur cet hôte."
+        },
+        {
+          "table": {
+            "headers": [
+              "Ce qui empêche une récupération",
+              "Que faire"
+            ],
+            "rows": [
+              [
+                "Il manque un conteneur d'une application multiconteneurs",
+                "Restaurer aussi; l'application est récupérée entière"
+              ],
+              [
+                "Le sous-réseau privé est déjà utilisé sur cet hôte",
+                "La récupération est annulée et rien n’est modifié : les adresses des conteneurs sont fixes et ne sont pas déplacées vers un autre sous-réseau"
+              ],
+              [
+                "Un répertoire hôte n'existe pas",
+                "Monter ou créer avec ses données; une sauvegarde du conteneur n'inclut pas les répertoires hôtes"
+              ],
+              [
+                "Un périphérique n'existe pas sur cet hôte",
+                "Connectez-le ou retirez-le du conteneur dans Proxmox"
+              ],
+              [
+                "Une application avec NVIDIA sur un hôte sans pilote",
+                "Installez le pilote NVIDIA et le Container Toolkit"
+              ],
+              [
+                "La sauvegarde a été effectuée avant l'existence de la copie du contrat",
+                "Le conteneur reste en tant que LXC ordinaire et n'est pas offert à nouveau"
+              ]
+            ]
+          }
+        },
+        {
+          "calloutInfo": {
+            "title": "Un conteneur qui revient",
+            "body": "Un conteneur restauré sur lui-même à partir d'une ancienne sauvegarde, retourné à un instantané ou retourné d'un autre noeud porte le contrat de l'état dans lequel il est. Lorsqu'il est sélectionné pour une opération et que son contrat diffère de celui de cet hôte, l'opération ne démarre pas et le conteneur est offert pour récupération."
+          }
+        },
+        {
+          "figure": {
+            "src": "/oci-manager/restore-result.png",
+            "alt": "Résultat de la récupération avec le réseau privé, l’ordre de démarrage et les conteneurs enregistrés",
+            "caption": "Résultat d'une reprise, étape par étape."
+          }
+        }
+      ]
+    },
+    {
+      "id": "remove",
+      "title": "Supprimer une application OCI",
+      "blocks": [
+        {
+          "p": "Avant la confirmation, un résumé est établi à partir de la configuration réelle : les conteneurs supprimés, les données supprimées avec eux, le réseau privé libéré et les répertoires de l’hôte conservés. La réponse par défaut est <strong>Non</strong>, car les données des disques supprimés ne pourront pas être récupérées ensuite."
+        },
+        {
+          "table": {
+            "headers": [
+              "Ressource",
+              "À la suppression",
+              "Motifs"
+            ],
+            "rows": [
+              [
+                "rootfs et disques du conteneur",
+                "Supprimés",
+                "Ils appartiennent seulement au conteneur"
+              ],
+              [
+                "Répertoire de l'hôte",
+                "Conservé, avec son contenu",
+                "D'autres applications peuvent l'utiliser"
+              ],
+              [
+                "Fichiers hôtes du conteneur",
+                "Supprimés",
+                "Son journal de console, ses paramètres sysctl réseau, le hookscript du montage Rclone et son inscription dans l’onglet App de ProxMenux Monitor ne servent à aucun autre conteneur"
+              ],
+              [
+                "Fichiers partagés par plusieurs installations",
+                "Supprimé avec la dernière installation qui les utilise",
+                "Le fichier de surveillance de l’hôte et le hookscript des dépendances des applications à plusieurs conteneurs"
+              ],
+              [
+                "Contrat d’instance",
+                "Supprimé après une suppression réussie",
+                "Aucun CT ne lui est plus associé"
+              ],
+              [
+                "Pont privé d'une pile",
+                "Relâché avec la pile",
+                "Il n'y a plus de membres pour se connecter"
+              ],
+              [
+                "Réseau partagé par la suite Arr",
+                "Libéré lors de la suppression de la dernière application de la suite",
+                "Chaque application de la suite est indépendante et se supprime séparément"
+              ],
+              [
+                "Un seul membre d'une pile",
+                "Non enlevé seul",
+                "Toute l'application est retirée, donc aucune pile n'est laissée incomplète"
+              ],
+              [
+                "Un conteneur sur un autre noeud du cluster",
+                "Non enlevé",
+                "Son enregistrement et ses fichiers sur l’hôte se trouvent sur le nœud où il a été installé : il faut le supprimer là-bas, après l’y avoir remigré"
+              ]
+            ]
+          }
+        },
+        {
+          "figure": {
+            "src": "/oci-manager/remove-summary.png",
+            "alt": "Résumé de suppression avec les conteneurs, les données et les répertoires hôtes touchés",
+            "caption": "Le résumé de suppression, construit à partir de la configuration réelle."
+          }
+        }
+      ]
+    },
+    {
+      "id": "archives",
+      "title": "Images téléchargées et espace hôte",
+      "blocks": [
+        {
+          "p": "L’archive OCI sert à construire le rootfs ; le CT en cours d’exécution ne la lit pas. Après une installation ou une mise à jour, les archives téléchargées pendant cette opération sont listées avec leur taille et leur suppression est proposée. Les supprimer libère de l’espace sans affecter le conteneur ni ses données."
+        },
+        {
+          "calloutInfo": {
+            "title": "Les mises à jour ne nécessitent pas l'archive",
+            "body": "Sans l'archive, une mise à jour résout le canal enregistré et télécharge le nouveau digest. Avec elle, une archive n'est réutilisée que lorsque sa référence et son intégrité correspondent à ce qui est demandé."
+          }
+        }
+      ]
+    },
+    {
+      "id": "registry",
+      "title": "Registre et nettoyage",
+      "blocks": [
+        {
+          "p": "À l'ouverture de <strong>Gérer les applications OCI installées</strong>, les restes des conteneurs absents de tous les nœuds du cluster sont d'abord supprimés : l'enregistrement conservé comme historique après une suppression depuis l'interface Proxmox, et les fichiers de l'hôte laissés par une suppression. Un enregistrement lié à une opération interrompue est conservé, car sa sauvegarde peut encore être nécessaire. Les volumes et répertoires de l'hôte ne sont jamais supprimés par déduction."
+        }
+      ]
+    },
+    {
+      "id": "cluster",
+      "title": "Dans un cluster : migration et haute disponibilité",
+      "intro": "Un conteneur OCI est un LXC Proxmox ordinaire : il peut être migré ou géré par HA comme les autres, avec les mêmes limites. Les éléments nécessaires à son démarrage sont conservés à un emplacement accessible à tous les nœuds du cluster.",
+      "blocks": [
+        {
+          "table": {
+            "headers": [
+              "Partie",
+              "Sur un autre noeud du cluster"
+            ],
+            "rows": [
+              [
+                "Journal de console",
+                "Le conteneur crée <code>/var/log/proxmenux/oci</code> avant de démarrer, quel que soit le nœud qui l’exécute. Chaque nœud conserve le journal des démarrages qu’il a effectués."
+              ],
+              [
+                "Paramètres sysctl réseau et surveillance de l’hôte",
+                "Conservés dans <code>/etc/pve/proxmenux</code>, partagé par tous les nœuds du cluster, afin qu’un conteneur migré les retrouve."
+              ],
+              [
+                "Disques du conteneur",
+                "Proxmox les déplace avec le conteneur. HA nécessite que leurs données soient disponibles sur le nœud cible, via un stockage partagé ou une configuration de réplication prise en charge."
+              ],
+              [
+                "Répertoires et périphériques de l'hôte",
+                "Les mêmes règles que n'importe quel LXC : un répertoire hôte doit exister sur le nœud cible et être marqué comme partagé, et un GPU, Coral ou NPU doit y être présent."
+              ],
+              [
+                "Enregistrement ProxMenux",
+                "Le contrat reste sur le nœud où l'application a été installée, et chaque nœud lit la copie conservée dans <code>/etc/pve/priv/proxmenux/oci</code>. Une application à un seul conteneur est enregistrée sur son nœud de destination après migration lors de l'ouverture de <strong>Gérer les applications OCI installées</strong> ou du lancement d'une opération la concernant. Une application à plusieurs conteneurs y est proposée à la récupération, car son réseau privé doit être créé sur ce nœud."
+              ]
+            ]
+          }
+        },
+        {
+          "calloutWarning": {
+            "title": "Pas pour une disponibilité élevée",
+            "body": "Une application à plusieurs conteneurs relie ses membres par un pont privé du nœud sur lequel elle a été installée ; ses membres restent donc sur ce nœud. Un outil de surveillance de l’hôte, comme Glances en mode hôte ou Netdata, surveille le nœud qui l’exécute ; le déplacer reviendrait à surveiller un autre nœud."
+          }
+        },
+        {
+          "p": "Une sauvegarde restaurée à l'extérieur du cluster obtient les fichiers de <code>/etc/pve/proxmenux</code> que le conteneur utilise lorsque l'application est récupérée."
+        }
+      ]
+    },
+    {
+      "id": "channel",
+      "title": "Une étiquette évolutive n’est pas une mise à jour sans surveillance",
+      "blocks": [
+        {
+          "p": "Le catalogue installe l’étiquette évolutive publiée par son responsable, mais le digest effectif est résolu et enregistré, puis modifié uniquement lors d’une mise à jour explicite avec contrôles préalables et retour arrière. <monitorLink>ProxMenux Monitor</monitorLink> compare le digest installé à celui publié par le registre et affiche une indication et une notification lorsqu’une nouvelle image est disponible."
+        }
+      ]
+    }
+  ]
+}
diff --git a/web/messages/fr/docs/oci-manager/monitor.json b/web/messages/fr/docs/oci-manager/monitor.json
new file mode 100644
index 00000000..bf77e449
--- /dev/null
+++ b/web/messages/fr/docs/oci-manager/monitor.json
@@ -0,0 +1,213 @@
+{
+  "meta": {
+    "title": "Conteneurs OCI dans ProxMenux Monitor | ProxMenux",
+    "description": "Ce que ProxMenux Monitor montre pour un conteneur installé par OCI Manager Apps : versions d'applications et d'images, nouvelles images, sortie console et terminal Proxmox VE."
+  },
+  "header": {
+    "title": "Dans ProxMenux Monitor",
+    "description": "Un conteneur installé par OCI Manager Apps apparaît dans VMs & LXCs comme n'importe quel autre LXC. Sa fenêtre modale lit l'enregistrement d'installation : versions d'application et d'image, nouvelles images, sortie console et terminal.",
+    "section": "OCI manager Apps"
+  },
+  "sections": [
+    {
+      "id": "intro",
+      "blocks": [
+        {
+          "calloutInfo": {
+            "title": "L'enregistrement est la source",
+            "body": "OCI manager Apps connaît l’application installée et sa provenance. Le Monitor lit cet enregistrement d’installation au lieu de rechercher l’application dans le conteneur. Ces informations restent donc disponibles que le conteneur fonctionne ou soit arrêté."
+          }
+        },
+        {
+          "table": {
+            "headers": [
+              "onglet",
+              "Ce qui change pour un conteneur OCI"
+            ],
+            "rows": [
+              [
+                "État",
+                "Un commutateur <strong>Watchdog</strong> sous Démarrer au démarrage: l'application est redémarrée quand elle s'arrête seule"
+              ],
+              [
+                "Application",
+                "L'application est identifiée à partir du dossier et les mises à jour sont suivies par l'image"
+              ],
+              [
+                "Mises à jour",
+                "L'image est mise à jour ou l'application modifiée, avec le même flux que le menu OCI"
+              ],
+              [
+                "Montages",
+                "Disques de conteneurs et répertoires hôtes, avec leur utilisation"
+              ],
+              [
+                "Journaux",
+                "Uniquement pour les conteneurs OCI : la sortie console de l'application"
+              ]
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "app",
+      "title": "Application",
+      "intro": "L'onglet <appLink>App</appLink> offre l'application installée comme détection, avec le nom, le logo, le port et le schéma de l'enregistrement. L'enregistrer ouvre l'éditeur avec la méthode <strong>OCI image (installée par ProxMenux)</strong>, qui ne nécessite aucune configuration.",
+      "blocks": [
+        {
+          "cards": {
+            "items": [
+              {
+                "icon": "boxes",
+                "title": "Application",
+                "body": "La version de l'application à l'intérieur de l'image, lue à partir de l'image elle-même : son environnement ou son étiquette <code>org.opencontainers.image.version</code>. Cette information est indicative."
+              },
+              {
+                "icon": "archive",
+                "title": "Image",
+                "body": "La date de construction et le digest de l'image installée. La mise à jour est décidée ici: le digest installé est comparé à celui que le registre publie aujourd'hui pour le même tag."
+              }
+            ]
+          }
+        },
+        {
+          "list": {
+            "items": [
+              "Lorsque le registre publie un nouveau digest, la carte affiche <strong>Nouvelle image</strong> avec sa date et son digest, même si la version de l'application à l'intérieur n'a pas changé: une reconstruction sur une base mise à jour est une mise à jour.",
+              "Lorsque les digests correspondent, la carte lit <strong>Version</strong>.",
+              "La carte relie au dépôt de l'image : son projet GitHub, ou sa page Docker Hub pour une image officielle.",
+              "Le lien d'accès utilise l'adresse LAN du conteneur, également pour le membre principal d'une application multi-conteneurs, qui a une deuxième adresse sur son réseau privé.",
+              "Le bouton <strong>Actualiser les données</strong> relit l’enregistrement et le registre des images. Les options de recherche ou d’enregistrement d’une autre application ne sont pas proposées : le conteneur contient exactement l’application de son enregistrement."
+            ]
+          }
+        },
+        {
+          "figure": {
+            "src": "/oci-manager/monitor-app-tab.png",
+            "alt": "Onglet App d'un conteneur OCI avec la version de l'application, l'image et le lien du dépôt",
+            "caption": "Onglet Application d’un conteneur installé par OCI manager Apps."
+          }
+        },
+        {
+          "p": "La vérification s'effectue une fois par jour avec les vérifications de mise à jour du moniteur, et <strong>Actualiser les données</strong> l'exécute immédiatement. Une nouvelle image est envoyée sous forme de notification via les canaux configurés dans <notificationsLink>Notifications</notificationsLink>. La mise à jour est appliquée depuis l'onglet Mises à jour."
+        }
+      ]
+    },
+    {
+      "id": "updates",
+      "title": "Mises à jour",
+      "intro": "Pour un conteneur installé par OCI manager Apps, l’onglet Mises à jour présente l’application avec son image installée et, si le registre en publie une, la nouvelle image, au même format que les autres applications. Les outils de mise à jour des paquets et applications d’un LXC ordinaire ne sont pas proposés.",
+      "blocks": [
+        {
+          "table": {
+            "headers": [
+              "Bouton",
+              "Ce qu'il ouvre"
+            ],
+            "rows": [
+              [
+                "Mise à jour",
+                "La mise à jour de <lifecycleLink>Gérer les applications OCI installées</lifecycleLink> pour ce conteneur, dans le terminal de Monitor. Elle peut être lancée avec ou sans nouvelle image ; sans nouvelle image, rien ne change. Pour une application multiconteneur, elle met à jour tous les membres."
+              ],
+              [
+                "Modifier",
+                "L'éditeur de l'application (ressources, réseau, chemins et GPU). Dans une application multi-conteneurs, il ajoute ou supprime les chemins et périphériques supplémentaires du conteneur d'application et, dans Immich, modifie ce qui exécute la reconnaissance."
+              ],
+              [
+                "Récupérer",
+                "Remplace Mise à jour quand une opération sur le conteneur a été interrompue, et ouvre sa récupération."
+              ],
+              [
+                "Récupérer (conteneur restauré)",
+                "Affiché pour un conteneur restauré depuis une sauvegarde sans contrat sur cet hôte, sous <strong>Application OCI restaurée</strong>. Ouvre la <lifecycleLink>récupération</lifecycleLink> dans le terminal de Monitor ; Mettre à jour et Modifier apparaissent après son enregistrement."
+              ]
+            ]
+          }
+        },
+        {
+          "p": "Les modifications externes, les répertoires hôtes et les applications multiconteneurs sont traités comme dans le menu OCI. Dans une application multi-conteneurs, les boutons et les options apparaissent uniquement sur le conteneur principal; les autres membres montrent leur image, une note qu'ils sont mis à jour à partir du conteneur principal et un bouton qui l'ouvre. Lorsque le terminal se ferme, l'image, l'enregistrement et les montages sont à nouveau lus."
+        },
+        {
+          "table": {
+            "headers": [
+              "Option",
+              "Comportement"
+            ],
+            "rows": [
+              [
+                "Conserver la sauvegarde prise avant la mise à jour",
+                "Chaque mise à jour sauvegarde le conteneur pour le restaurer si la mise à jour échoue. Avec cette option, la même sauvegarde est conservée dans le stockage choisi et apparaît parmi les sauvegardes du CT; sur Proxmox Backup Server une sauvegarde est écrite avant la mise à jour."
+              ],
+              [
+                "Mises à jour programmées",
+                "L’image n’est mise à jour à l’heure choisie que si le registre en publie une nouvelle, avec la possibilité d’attendre qu’elle ait 1, 3, 7 ou 14 jours. Un conteneur modifié en dehors de ProxMenux est ignoré et signalé."
+              ]
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "logs",
+      "title": "Journaux",
+      "intro": "L'onglet Logs n'apparaît que pour les conteneurs installés par l'OCI Manager Apps, entre Montages et Sauvegardes. Il montre la sortie standard et l'erreur du processus principal de l'image, la même sortie <code>docker logs</code> affiche pour un conteneur Docker.",
+      "blocks": [
+        {
+          "list": {
+            "items": [
+              "La sortie est conservée sur l'hôte dans <code>/var/log/proxmenux/oci/VMID.console.log</code> (mode 0600), dès le premier démarrage et sur les redémarrages, de sorte qu'il peut être lu avec le conteneur arrêté.",
+              "Le fichier est tourné à 10 MB, en conservant trois copies compressées (<code>/etc/logrotate.d/proxmenux-oci</code>).",
+              "Chaque démarrage du conteneur est marqué dans la sortie. L'onglet affiche la sortie depuis le dernier démarrage par défaut; <strong>L'historique complet</strong> montre également les précédents.",
+              "Lorsque l'application est supprimée, sa sortie est supprimée avec elle.",
+              "Les 100, 500 ou 1000 dernières lignes sont affichées. Quand le conteneur fonctionne, les nouvelles lignes sont suivies en direct ; faire défiler vers le haut met le suivi en pause et <strong>Suivre</strong> le reprend.",
+              "Un filtre n'indique que les lignes qui contiennent un texte, et <strong>Télécharger</strong> enregistre les lignes chargées.",
+              "Les codes de couleur sont supprimés et une ligne qu'une barre de progression redessine est affichée dans son état final.",
+              "L’onglet relit le fichier à chaque ouverture, sans mise en cache."
+            ]
+          }
+        },
+        {
+          "calloutInfo": {
+            "title": "Identifiants du premier démarrage",
+            "body": "Les images qui impriment un mot de passe généré sur leur premier démarrage le laissent dans cette sortie, comme le fait <code>docker logs</code>. L'installateur le lit à partir de là pour le montrer dans son résumé."
+          }
+        },
+        {
+          "figure": {
+            "src": "/oci-manager/monitor-logs-tab.png",
+            "alt": "Onglet Logs avec la sortie console d'un conteneur OCI, le sélecteur de ligne, le filtre et le bouton suivant",
+            "caption": "Sortie de console d'un conteneur OCI."
+          }
+        }
+      ]
+    },
+    {
+      "id": "terminal",
+      "title": "Console Proxmox VE",
+      "blocks": [
+        {
+          "p": "Une image OCI exécute son propre processus comme PID 1 et aucun service de connexion, de sorte que la console par défaut d'un LXC ouvrirait un terminal où rien ne répond. Les conteneurs installés par OCI Manager Apps sont créés avec <code>cmode: shell</code> : la console Proxmox VE ouvre un shell avec <code>lxc-attach</code>, l'équivalent de <code>docker exec</code>, avec l'application en cours d'exécution intacte."
+        },
+        {
+          "list": {
+            "items": [
+              "Le shell est celui attribué à root dans l’image par <code>/etc/passwd</code>. Si root n’a pas de shell ou si l’image n’en contient aucun, la console par défaut est conservée.",
+              "Le shell s’exécute en tant que root dans le conteneur, sans mot de passe. Qui peut l'ouvrir est décidé par la permission <code>VM.Console</code> de Proxmox VE.",
+              "Le terminal du moniteur entre dans le conteneur avec <code>pct enter</code>, qui fonctionne de la même manière."
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "mounts",
+      "title": "Montages",
+      "blocks": [
+        {
+          "p": "L'onglet <mountsLink>Mounts</mountsLink> énumère les disques de conteneur et les répertoires hôtes du conteneur. L'utilisation d'un disque de conteneur sur le stockage de blocs comme LVM-thin est lue à partir du système de fichiers du disque, qui est monté uniquement à l'intérieur du conteneur."
+        }
+      ]
+    }
+  ]
+}
diff --git a/web/messages/fr/docs/oci-manager/stacks.json b/web/messages/fr/docs/oci-manager/stacks.json
new file mode 100644
index 00000000..5a1dfd4c
--- /dev/null
+++ b/web/messages/fr/docs/oci-manager/stacks.json
@@ -0,0 +1,404 @@
+{
+  "meta": {
+    "title": "Applications multiconteneurs ProxMenux",
+    "description": "Comment OCI manager Apps transforme une application avec sa base de données et cache en LXC natifs coordonnés: plan, réseau privé, crochet de dépendance, validation et mises à jour transactionnelles."
+  },
+  "header": {
+    "title": "Applications à plusieurs conteneurs",
+    "description": "Une application avec sa base de données, cache et d'autres services devient plusieurs LXC natifs coordonnés, installés et mis à jour comme un seul.",
+    "section": "OCI manager Apps"
+  },
+  "sections": [
+    {
+      "id": "intro",
+      "blocks": [
+        {
+          "calloutInfo": {
+            "title": "Une application pour l'utilisateur, plusieurs LXC pour Proxmox VE",
+            "body": "Une définition multi-conteneurs est une entrée du catalogue. L'installateur crée un LXC natif par service et garde leurs dépendances explicites. Immich, Nextcloud, Paperless-ngx et Tandoor sont installés de cette façon."
+          }
+        },
+        {
+          "mermaid": {
+            "chartCode": "flowchart LR\n C[\"Docker Compose\"] --> O[\"{{plan}}\"]\n O --> A[\"{{app}}<br/>{{appNet}}\"]\n O --> D[\"{{db}}<br/>{{private}}\"]\n O --> R[\"{{cache}}<br/>{{private}}\"]\n V1[(\"config\")] --> A\n V2[(\"database\")] --> D\n V3[(\"cache\")] --> R\n D --> A\n R --> A",
+            "labels": {
+              "plan": "Plan de la pile",
+              "app": "Application LXC",
+              "appNet": "LAN + privé",
+              "db": "PostgreSQL LXC",
+              "cache": "Valkey LXC",
+              "private": "privé"
+            }
+          }
+        }
+      ]
+    },
+    {
+      "id": "plan",
+      "title": "1. Le plan, avant l'existence d'un conteneur",
+      "blocks": [
+        {
+          "p": "Aucun LXC n'est créé pendant que la définition Compose est interprétée. Un plan complet vient en premier, avec chaque membre, image, VMID, réseau, chemin, secret, ordre et bilan de santé. Si le plan n'est pas cohérent, l'installation ne démarre pas."
+        },
+        {
+          "table": {
+            "headers": [
+              "Élément du plan",
+              "Contenu",
+              "Vérification avant de créer quelque chose"
+            ],
+            "rows": [
+              [
+                "Membres",
+                "Application principale, base de données, cache, apprentissage automatique et autres dépendances",
+                "VMID uniques, rôles connus et exactement un membre principal"
+              ],
+              [
+                "Images",
+                "Référence roulante, architecture et digest résolu de chaque service",
+                "Toutes existent, prennent en charge l’architecture et réussissent la vérification d’intégrité OCI"
+              ],
+              [
+                "Réseau",
+                "Pont privé, sous-net, une adresse fixe par service et accès au réseau local pour le membre principal",
+                "Aucune collision avec des ponts ou sous-réseaux existants et aucune adresse répétée"
+              ],
+              [
+                "Persistance",
+                "Disques de conteneur, répertoires hôtes, propriétaires et sauvegarde",
+                "Aucun chemin de chevauchement, stockage disponible et autorisations déclarées"
+              ],
+              [
+                "Secrets",
+                "Mot de passe de la base de données, clés d'application et identifiants initiaux",
+                "Généré une fois et donné seulement aux membres qui les utilisent"
+              ],
+              [
+                "Cycle de vie",
+                "Ordre de départ, ordre d'arrêt et bilan de santé par membre",
+                "L'application principale démarre en dernier et s'arrête en premier"
+              ]
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "create",
+      "title": "2. Création, membre par membre",
+      "blocks": [
+        {
+          "steps": {
+            "items": [
+              {
+                "title": "Réserve tous les VMID",
+                "body": "L'inventaire Proxmox VE et le registre des instances sont vérifiés. Un CT existant n'est pas adopté et un contrat qui appartient encore à une autre instance n'est pas réutilisé."
+              },
+              {
+                "title": "Préparer chaque image",
+                "body": "Toutes les images sont résolues, téléchargées et vérifiées avant la création du premier conteneur."
+              },
+              {
+                "title": "Créer chaque rootfs",
+                "body": "Les métadonnées OCI officielles sont importées, puis l’identité de l’instance ProxMenux et le rôle du membre sont ajoutés."
+              },
+              {
+                "title": "Réseau privé",
+                "body": "Un bridge et un sous-net sont créés et chaque membre obtient son adresse fixe; seul le membre principal obtient également l'interface LAN."
+              },
+              {
+                "title": "Persistance",
+                "body": "Chaque base de données et configuration obtient son propre disque conteneur ; seules les données destinées à être partagées utilisent des répertoires hôtes."
+              },
+              {
+                "title": "Environnement",
+                "body": "Les points d’accès internes, les secrets partagés et les variables de service sont écrits. L’application accède à ses dépendances via leurs adresses privées réservées."
+              },
+              {
+                "title": "Enregistrement",
+                "body": "Chaque membre enregistre sa configuration native, les changements rootfs que les mises à jour doivent reproduire et sa relation avec la pile."
+              }
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "checks",
+      "title": "3. Démarrer et vérifier chaque conteneur",
+      "intro": "Un LXC créé ne signifie pas un service prêt. Les dépendances commencent dans l'ordre et chacune passe un contrôle spécifique à son service.",
+      "blocks": [
+        {
+          "table": {
+            "headers": [
+              "Services",
+              "Vérification",
+              "Ce qu'il montre"
+            ],
+            "rows": [
+              [
+                "PostgreSQL",
+                "<code>pg_isready</code> dans le CT avec l'hôte, l'utilisateur et la base de données attendus",
+                "Le serveur accepte les connexions pour la base de données configurée"
+              ],
+              [
+                "Redis / Valkey",
+                "<code>redis-cli</code> ou <code>valkey-cli</code> <code>PING</code> contre son adresse privée",
+                "Le broker écoute et répond"
+              ],
+              [
+                "Immich apprentissage automatique",
+                "HTTP <code>GET /ping</code>, avec vérification de l’environnement d’exécution GPU sélectionné",
+                "Le service répond et l’accélération demandée n’a pas basculé vers le CPU"
+              ],
+              [
+                "Nextcloud",
+                "<code>GET /status.php</code> avec <code>installed=true</code>, <code>maintenance=false</code> et <code>needsDbUpgrade=false</code>",
+                "Initialisation terminée sans aucune migration en attente"
+              ],
+              [
+                "Paperless-ngx / Tandoor",
+                "HTTP sur l'adresse LAN et le port réel du service",
+                "La façade et ses dépendances servent l’application"
+              ],
+              [
+                "Application principale",
+                "L'extrémité de son modèle, par exemple <code>/api/server/ping</code> dans Immich",
+                "La pile entière fonctionne à travers l'application qui utilise les dépendances"
+              ]
+            ]
+          }
+        },
+        {
+          "calloutWarning": {
+            "title": "En cours d’exécution ne signifie pas opérationnel",
+            "body": "L’état en cours d’exécution indique seulement que le processus LXC existe. Si le service propose une meilleure vérification, un contrôle exec ou HTTP avec délai maximal est utilisé. Si un membre s’arrête ou échoue à son contrôle, la pile n’est pas déclarée installée."
+          }
+        }
+      ]
+    },
+    {
+      "id": "hook",
+      "title": "4. Le crochet de dépendance",
+      "blocks": [
+        {
+          "p": "Le crochet est placé uniquement sur le conteneur principal d'une pile dépendante. Proxmox VE conserve le script comme un extrait et l'exécute comme le <code>hookscript</code> de ce CT. La recette de pile n'est pas écrite dans le script : elle vit dans un contrat privé séparé."
+        },
+        {
+          "codeGrid": {
+            "items": [
+              {
+                "title": "Configuration principale CT",
+                "code": "hookscript: local:snippets/proxmenux-stack-dependencies.sh"
+              },
+              {
+                "title": "Contrat privé (exemple)",
+                "code": "/etc/pve/priv/proxmenux-stack-VMID.json\n{\n  \"schema\": 1,\n  \"stack\": \"immich\",\n  \"dependencies\": [\n    {\"vmid\": 107, \"label\": \"PostgreSQL\", \"healthcheck\": {...}},\n    {\"vmid\": 108, \"label\": \"Valkey\", \"healthcheck\": {...}},\n    {\"vmid\": 106, \"label\": \"Machine Learning\", \"healthcheck\": {...}}\n  ]\n}"
+              }
+            ]
+          }
+        },
+        {
+          "snippet": {
+            "summary": "Source complète de proxmenux-stack-dependencies.sh",
+            "pathCode": "local:snippets/proxmenux-stack-dependencies.sh",
+            "snippetCode": "stackDependencyHook"
+          }
+        },
+        {
+          "p": "Le script est le même pour chaque pile. Les VMID, noms, types de vérifications et délais proviennent du contrat privé <code>/etc/pve/priv/proxmenux-stack-VMID.json</code> de chaque pile."
+        },
+        {
+          "steps": {
+            "items": [
+              {
+                "title": "Proxmox VE appelle pre-start",
+                "body": "Avant le démarrage du CT principal, le crochet fonctionne avec son VMID et la phase du cycle de vie."
+              },
+              {
+                "title": "Un verrou par pile",
+                "body": "<code>flock</code> sur <code>/run/lock/proxmenux-stack-VMID.lock</code> empêche deux séquences de démarrage en même temps."
+              },
+              {
+                "title": "Le contrat est lu et validé",
+                "body": "Un schéma connu, des dépendances numériques, des étiquettes, un contrôle exec, http ou running et un délai maximal positif sont requis."
+              },
+              {
+                "title": "Dépendances dans l'ordre",
+                "body": "Chaque CT doit exister ; un CT arrêté est démarré, tandis qu’un CT déjà actif n’est pas redémarré."
+              },
+              {
+                "title": "Attendre que le service soit prêt",
+                "body": "Le contrôle est effectué toutes les deux secondes, et le CT est également confirmé être toujours en cours d'exécution."
+              },
+              {
+                "title": "Le principal CT démarre",
+                "body": "Lorsque chaque dépendance est prête, prédémarrage se termine et Proxmox VE démarre l'application."
+              }
+            ]
+          }
+        },
+        {
+          "calloutInfo": {
+            "title": "Le crochet n'arrête pas les dépendances",
+            "body": "Les phases post-démarrage, pré-stop et post-stop ne font rien. L'arrêt du principal CT laisse tourner PostgreSQL, Redis, Valkey ou l'apprentissage automatique. Le crochet commande le démarrage; il ne transforme pas plusieurs LXC en un seul processus."
+          }
+        },
+        {
+          "table": {
+            "headers": [
+              "Type",
+              "Exemple",
+              "Démarrages suivants"
+            ],
+            "rows": [
+              [
+                "Pile dépendante",
+                "Immich, Nextcloud, application avec PostgreSQL",
+                "Le crochet du CT principal commence les dépendances et les attend"
+              ],
+              [
+                "Suite d'application",
+                "Suite Arr",
+                "Aucun membre principal: chaque LXC suit son propre <code>onboot</code>"
+              ],
+              [
+                "Application unique",
+                "Jellyfin",
+                "Proxmox VE commence directement ce LXC"
+              ]
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "stack-checks",
+      "title": "5. Contrôle de la pile dans son ensemble",
+      "blocks": [
+        {
+          "list": {
+            "items": [
+              "Chaque VMID existe, est unique et conserve l'identité d'instance attendue.",
+              "Chaque contrat appartient à la même pile, conserve son rôle et sa configuration native enregistrée.",
+              "Le membre principal est le dernier en <code>start_order</code> et le premier en <code>stop_order</code>.",
+              "Aucun membre, volume ou ajustement du rootfs ne manque.",
+              "Le crochet pointe vers l'extrait officiel, son contenu est inchangé et son contrat correspond à la recette de la pile.",
+              "Les images et les digests observés correspondent aux archives OCI préparées.",
+              "Les appareils, les profils GPU, les montages, les secrets et les paramètres correspondent encore aux contrats.",
+              "Une fois toutes les dépendances validées, le point d’accès de l’application principale vérifie l’intégration entre les membres."
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "manage",
+      "title": "Gestion d'une pile installée",
+      "intro": "Dans <strong>Gérer les applications OCI installées</strong>, chaque membre mène à toute la pile. Le menu propose <strong>Mettre à jour tous les conteneurs de l’application</strong>, <strong>Modifier les chemins et périphériques supplémentaires</strong>, <strong>Recréer tous les conteneurs avec leur configuration enregistrée</strong> et <strong>Retirer : supprimer l’application et ses conteneurs</strong>. La recréation reconstruit chaque conteneur depuis son image d’origine, identifiée par le digest enregistré, sans chercher d’image plus récente. Elle suit les mêmes étapes qu’une mise à jour et est proposée pour les piles pouvant être mises à jour.",
+      "blocks": [
+        {
+          "steps": {
+            "items": [
+              {
+                "title": "Tout membre",
+                "body": "Le contrat du membre nomme le VMID principal et la liste complète des membres."
+              },
+              {
+                "title": "La pile est reproductible",
+                "body": "Les identités, les contrats, le crochet, les adaptations et un replay coordonné pour cette recette sont validés."
+              },
+              {
+                "title": "Images d'abord",
+                "body": "L'application n'est pas arrêtée avant que chaque digest ait été résolu, téléchargé et vérifié."
+              },
+              {
+                "title": "Arrêter les membres et sauvegarder l’ensemble",
+                "body": "Les sauvegardes natives vérifiées sont prises avec la pile arrêtée, de sorte que l'application et les bases de données appartiennent au même moment."
+              },
+              {
+                "title": "Mettre à jour et vérifier chaque membre",
+                "body": "Adaptation, réseau, montages, secrets et dispositifs sont appliqués à nouveau avant le contrôle de santé de chaque membre."
+              },
+              {
+                "title": "Publier ou récupérer tout",
+                "body": "Les nouveaux contrats ne sont publiés que lorsque chaque membre passe. Si on échoue, chaque membre est rétabli."
+              }
+            ]
+          }
+        },
+        {
+          "table": {
+            "headers": [
+              "Modifier",
+              "Ce qui change",
+              "Ce qui est gardé"
+            ],
+            "rows": [
+              [
+                "Chemins et périphériques supplémentaires",
+                "Ils sont ajoutés ou retirés du conteneur d'application, qui redémarre. Rien n'est reconstruit",
+                "Les données de l'application, sa base de données et les autres conteneurs"
+              ],
+              [
+                "Ce qui exécute la reconnaissance (Immich)",
+                "Le conteneur d'apprentissage de la machine prend l'image et les appareils du CPU ou d'un GPU de l'hôte. Toute l'application est arrêtée et mise à jour, comme dans une mise à jour",
+                "Le cache modèle, la bibliothèque et la base de données. Si quelque chose échoue, les conteneurs précédents et le choix précédent sont restaurés"
+              ]
+            ]
+          }
+        },
+        {
+          "calloutWarning": {
+            "title": "Une pile sans replay coordonné n'est pas mise à jour",
+            "body": "Si la préparation d'une pile ne peut pas être reproduite, la mise à jour est refusée avant l'arrêt de la pile. L'application continue à fonctionner comme elle est."
+          }
+        }
+      ]
+    },
+    {
+      "id": "failure",
+      "title": "6. Quand quelque chose échoue",
+      "blocks": [
+        {
+          "p": "Pendant une installation, une erreur s'arrête et enlève les conteneurs incomplets que l'opération a créés, et le pont privé si l'opération l'a créé. Une pile n'est pas publiée comme valide jusqu'à ce que la séquence entière se termine."
+        },
+        {
+          "p": "Une mise à jour est transactionnelle: toutes les images sont préparées d'abord, puis la pile s'arrête, chaque membre est sauvegardé et la sauvegarde vérifiée, et seulement alors chaque rootfs est remplacé. Les membres commencent un par un avec leur bilan de santé; si on échoue, chaque membre est restauré à partir du même ensemble de sauvegardes, de sorte que la base de données et l'application n'appartiennent jamais à différents moments."
+        },
+        {
+          "mermaid": {
+            "chartCode": "flowchart LR\n P[\"{{prepare}}\"] --> S[\"{{stop}}\"]\n S --> B[\"{{backup}}\"]\n B --> R[\"{{replace}}\"]\n R --> H{\"{{healthy}}\"}\n H -- \"{{yes}}\" --> C[\"{{commit}}\"]\n H -- \"{{no}}\" --> X[\"{{rollback}}\"]",
+            "labels": {
+              "prepare": "Préparer chaque image",
+              "stop": "Stop, membre principal d'abord",
+              "backup": "Sauvegarde vérifiée de chaque CT",
+              "replace": "Remplacer le rootfs",
+              "healthy": "Tous opérationnels ?",
+              "yes": "Oui",
+              "no": "Non",
+              "commit": "Publier les contrats",
+              "rollback": "Restaurer chaque membre"
+            }
+          }
+        }
+      ]
+    },
+    {
+      "id": "not-assumed",
+      "title": "Ce qu'une pile ne comprend pas",
+      "blocks": [
+        {
+          "list": {
+            "items": [
+              "Une suite installée dans un flux, comme la suite Arr, n'est pas une pile dépendante : ses conteneurs n'ont pas d'ordre de départ entre eux.",
+              "Le réseau privé ne remplace pas l'authentification, TLS ou la configuration de chaque application.",
+              "La sauvegarde d'un LXC ne contient pas le pont, le crochet ou les contrats du reste de la pile.",
+              "Prowlarr, Sonarr ou Radarr ne reçoivent aucun indexeur, profil ou fournisseur de ProxMenux."
+            ]
+          }
+        }
+      ]
+    }
+  ]
+}
diff --git a/web/messages/fr/docs/oci-manager/storage-network.json b/web/messages/fr/docs/oci-manager/storage-network.json
new file mode 100644
index 00000000..8f7f3649
--- /dev/null
+++ b/web/messages/fr/docs/oci-manager/storage-network.json
@@ -0,0 +1,305 @@
+{
+  "meta": {
+    "title": "Données, chemins et réseau | ProxMenux",
+    "description": "Comment OCI manager Apps conserve les données d’un conteneur OCI : disques du conteneur, répertoires de l’hôte, montages rclone, adresses et réseaux privés."
+  },
+  "header": {
+    "title": "Données, chemins et réseau",
+    "description": "Ce qui se trouve dans le rootfs, ce qui subsiste après son remplacement, comment les données sont partagées entre conteneurs et comment chacun obtient son adresse.",
+    "section": "OCI manager Apps"
+  },
+  "sections": [
+    {
+      "id": "intro",
+      "blocks": [
+        {
+          "calloutInfo": {
+            "title": "La persistance se décide avant la création du LXC",
+            "body": "Les volumes déclarés par l’image et son fichier Compose sont lus avant la création du conteneur. Chaque chemin à conserver après une mise à jour devient un point de montage indépendant du rootfs. Celui-ci ne contient donc que les fichiers appartenant à l’image et peut être remplacé."
+          }
+        }
+      ]
+    },
+    {
+      "id": "questions",
+      "title": "Ce que demande l’installateur",
+      "intro": "Le modèle fournit les chemins nécessaires à l’application. Chacun est placé sur un disque du conteneur ou dans un répertoire de l’hôte. D’autres chemins peuvent être ajoutés avant le récapitulatif.",
+      "blocks": [
+        {
+          "steps": {
+            "items": [
+              {
+                "title": "Chemins nécessaires",
+                "body": "<code>/config</code>, <code>/data</code>, les bibliothèques, les téléchargements et tous les volumes déclarés par l’application sont répertoriés."
+              },
+              {
+                "title": "Emplacement",
+                "body": "Chaque chemin est placé sur un disque du conteneur ou dans un répertoire existant de l’hôte."
+              },
+              {
+                "title": "Stockage et taille",
+                "body": "Un disque du conteneur est créé sur un stockage Proxmox VE avec la taille indiquée. L’installation par défaut utilise <code>local-lvm</code>. L’installation avancée demande le stockage de chaque chemin juste avant sa taille et propose celui du rootfs. Le disque apparaît sous le nom <code>vm-VMID-disk-N</code> et est rattaché comme <code>mpN</code>."
+              },
+              {
+                "title": "Répertoire de l’hôte",
+                "body": "Le répertoire de l’hôte est indiqué par son chemin. S’il n’existe pas, il est créé avec pour propriétaire l’utilisateur de l’hôte correspondant à celui du conteneur."
+              },
+              {
+                "title": "Chemins supplémentaires",
+                "body": "Avant l’installation, d’autres associations entre un chemin ou un volume de l’hôte et un chemin du conteneur peuvent être ajoutées."
+              },
+              {
+                "title": "Récapitulatif",
+                "body": "La correspondance complète des chemins est affichée avant la création du CT et enregistrée dans le contrat de l’instance."
+              }
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "options",
+      "title": "Les deux emplacements persistants",
+      "blocks": [
+        {
+          "table": {
+            "headers": [
+              "Propriété",
+              "Disque du conteneur",
+              "Répertoire de l’hôte"
+            ],
+            "rows": [
+              [
+                "Dans la configuration",
+                "<code>mpN: STORAGE:vm-VMID-disk-N,mp=/config,backup=1,size=16G</code>",
+                "<code>mpN: /mnt/oci-shared/media,mp=/data/media</code>"
+              ],
+              [
+                "Sauvegarde du conteneur (vzdump)",
+                "Inclus avec <code>backup=1</code>",
+                "Non inclus"
+              ],
+              [
+                "Taille",
+                "Fixe ; extensible en redimensionnant le point de montage",
+                "L’espace libre du système de fichiers ou du dataset de l’hôte"
+              ],
+              [
+                "Autres conteneurs",
+                "Monté uniquement par son propre conteneur",
+                "Le même répertoire peut être monté dans plusieurs conteneurs"
+              ],
+              [
+                "Snapshots et restauration",
+                "Gérés par Proxmox VE avec le CT",
+                "Gérés sur le stockage de l’hôte"
+              ],
+              [
+                "Lors de la suppression de l’application",
+                "Supprimé avec le conteneur",
+                "Conservé avec son contenu"
+              ],
+              [
+                "Lors du déplacement du CT vers un autre nœud",
+                "Déplacé avec le CT",
+                "Le même chemin doit exister sur l’autre nœud"
+              ]
+            ]
+          }
+        },
+        {
+          "p": "Le rootfs est réservé aux binaires et au contenu de l’image. Une mise à jour ou une recréation le remplace sans toucher à l’un ou l’autre type de point de montage."
+        }
+      ]
+    },
+    {
+      "id": "example",
+      "title": "Exemple : un conteneur avec les deux emplacements",
+      "blocks": [
+        {
+          "code": {
+            "title": "Jellyfin installé comme CT 151 sur local-lvm (extrait)",
+            "code": "rootfs: local-lvm:vm-151-disk-0,size=8G\n# Container disk, part of the CT backup\nmp0: local-lvm:vm-151-disk-1,mp=/config,backup=1,size=16G\n\n# Host directory, outside the CT backup\nmp1: /mnt/oci-shared/media,mp=/data/media"
+          }
+        },
+        {
+          "p": "Une mise à jour ou une recréation remplace uniquement le rootfs : <code>mp0</code> conserve les utilisateurs, les bibliothèques et les paramètres, tandis que <code>mp1</code> donne toujours accès aux mêmes médias. Restaurer la sauvegarde du CT rétablit <code>/config</code>. Le répertoire des médias est restauré, si nécessaire, depuis la sauvegarde du stockage de l’hôte."
+        },
+        {
+          "flow": {
+            "nodes": [
+              {
+                "label": "Contrat",
+                "detail": "/config"
+              },
+              {
+                "label": "Emplacement",
+                "detail": "Disque du conteneur\nou répertoire de l’hôte"
+              },
+              {
+                "label": "LXC",
+                "detail": "Toujours /config\npour l’application"
+              }
+            ],
+            "caption": "L’application voit le chemin déclaré par l’image ; seul son emplacement de stockage change."
+          }
+        }
+      ]
+    },
+    {
+      "id": "shared",
+      "title": "Un répertoire de l’hôte, plusieurs conteneurs",
+      "blocks": [
+        {
+          "mermaid": {
+            "chartCode": "flowchart TB\n H[\"{{host}}<br/>/mnt/oci-shared/media\"]\n H --> Q[\"qBittorrent<br/>/data\"]\n H --> J[\"Jellyfin<br/>/data\"]\n H --> R[\"Radarr / Sonarr<br/>/data\"]\n Q -. \"{{config}}\" .-> QV[(\"/config mpN\")]\n J -. \"{{config}}\" .-> JV[(\"/config mpN\")]\n R -. \"{{config}}\" .-> RV[(\"/config mpN\")]",
+            "labels": {
+              "host": "Répertoire de l’hôte",
+              "config": "Configuration propre"
+            }
+          }
+        },
+        {
+          "p": "Chaque conteneur conserve sa configuration sur son propre disque. La bibliothèque ou les téléchargements se trouvent dans un unique répertoire de l’hôte, monté au même chemin interne dans chaque conteneur. Ainsi, le chemin dans lequel une application écrit est celui depuis lequel une autre lit."
+        }
+      ]
+    },
+    {
+      "id": "rclone",
+      "title": "Stockage cloud avec l’application rclone",
+      "intro": "Outre son installation, la fiche rclone du catalogue propose <strong>Activer un montage dans un conteneur OCI rclone existant</strong>. Un stockage distant déjà créé et autorisé dans l’interface web de rclone est monté et rendu accessible sur l’hôte. D’autres conteneurs peuvent alors l’utiliser comme un répertoire de l’hôte.",
+      "blocks": [
+        {
+          "steps": {
+            "items": [
+              {
+                "title": "Conteneur et stockage distant",
+                "body": "Le VMID du conteneur rclone, le nom exact du stockage distant et, éventuellement, un chemin à l’intérieur de celui-ci."
+              },
+              {
+                "title": "Nom du montage et cache",
+                "body": "Le nom du montage et le mode du cache VFS : <code>off</code>, <code>minimal</code>, <code>writes</code> ou <code>full</code> (par défaut)."
+              },
+              {
+                "title": "Vues exposées",
+                "body": "Une racine commune, <code>/mnt/oci-shared</code> par défaut, contient une vue en lecture-écriture dans <code>/mnt/oci-shared/remotes/NAME</code> et une vue en lecture seule dans <code>/mnt/oci-shared/remotes-ro/NAME</code>."
+              },
+              {
+                "title": "Activation",
+                "body": "Après confirmation, le CT est arrêté, sa commande de démarrage et un hookscript Proxmox VE sont configurés, puis il est redémarré. L’opération attend que les deux vues soient montées sur l’hôte."
+              }
+            ]
+          }
+        },
+        {
+          "calloutInfo": {
+            "title": "Si le montage ne s’active pas",
+            "body": "La configuration précédente du conteneur est restaurée, puis celui-ci est redémarré. Ainsi, un échec d’activation laisse rclone dans son état initial."
+          }
+        }
+      ]
+    },
+    {
+      "id": "network",
+      "title": "Adresses et réseaux",
+      "intro": "Une application à un seul conteneur a besoin d’une adresse. Une application à plusieurs conteneurs nécessite aussi un réseau stable entre ses membres.",
+      "blocks": [
+        {
+          "cards": {
+            "items": [
+              {
+                "icon": "network",
+                "title": "Application à un seul conteneur",
+                "body": "Le pont réseau est choisi, ainsi que DHCP ou une adresse fixe au format CIDR. Le LXC possède sa propre adresse et le récapitulatif affiche les URL complètes des services."
+              },
+              {
+                "icon": "waypoints",
+                "title": "Application à plusieurs conteneurs",
+                "body": "Un sous-réseau libre est recherché et un pont privé persistant est créé. Chaque membre — application, base de données et cache — y reçoit une adresse fixe."
+              }
+            ]
+          }
+        },
+        {
+          "flow": {
+            "nodes": [
+              {
+                "label": "LAN",
+                "detail": "Adresse accessible\nservice principal uniquement"
+              },
+              {
+                "label": "LXC principal",
+                "detail": "Web / API\nLAN + réseau privé"
+              },
+              {
+                "label": "Réseau privé",
+                "detail": "PostgreSQL · Valkey · ML\nadresses fixes"
+              }
+            ],
+            "caption": "Les dépendances communiquent sur le réseau privé et n’ont pas d’adresse sur le LAN."
+          }
+        },
+        {
+          "p": "Le contrat de la pile enregistre le pont, le sous-réseau, les adresses et les relations entre services. La mise à jour de l’application réutilise la même topologie pour tous les membres. ProxMenux Monitor ouvre le conteneur principal à son adresse LAN, et non à celle du réseau privé."
+        }
+      ]
+    },
+    {
+      "id": "ownership",
+      "title": "Propriétaires des fichiers et répertoires",
+      "blocks": [
+        {
+          "list": {
+            "items": [
+              "Les nouveaux répertoires sont créés avec les UID et GID auxquels le LXC non privilégié est mappé.",
+              "Le propriétaire des répertoires existants n’est pas modifié récursivement.",
+              "Les sockets, fichiers système et chemins sensibles ne sont pas proposés comme répertoires génériques de l’hôte."
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "backup",
+      "title": "Ce que contient une sauvegarde du conteneur",
+      "blocks": [
+        {
+          "table": {
+            "headers": [
+              "Élément",
+              "Dans la sauvegarde vzdump du CT",
+              "Lieu de conservation"
+            ],
+            "rows": [
+              [
+                "Rootfs OCI",
+                "Oui",
+                "Dans la sauvegarde du CT ; il peut aussi être recréé à partir de l’image et du contrat"
+              ],
+              [
+                "Disque du conteneur avec <code>backup=1</code>",
+                "Oui",
+                "La sauvegarde du CT"
+              ],
+              [
+                "Répertoire de l’hôte",
+                "Non",
+                "La sauvegarde du stockage de l’hôte"
+              ],
+              [
+                "Contrat de l’instance",
+                "Oui, la copie conservée dans le CT",
+                "<code>/.proxmenux/oci-record.json</code> dans le CT ; les copies supplémentaires de l’hôte et du cluster sont conservées séparément"
+              ],
+              [
+                "Application à plusieurs conteneurs",
+                "Chaque membre dans sa propre sauvegarde",
+                "Les sauvegardes de tous les membres, ainsi que le contrat de la pile et son pont réseau sur l’hôte"
+              ]
+            ]
+          }
+        }
+      ]
+    }
+  ]
+}
diff --git a/web/messages/fr/docs/post-install/automated.json b/web/messages/fr/docs/post-install/automated.json
new file mode 100644
index 00000000..08183f4a
--- /dev/null
+++ b/web/messages/fr/docs/post-install/automated.json
@@ -0,0 +1,172 @@
+{
+  "meta": {
+    "title": "Script de post-installation automatisé | Documentation ProxMenux",
+    "description": "Le script de post-installation automatisé ProxMenux exécute 14 optimisations prédéfinies adaptées au matériel sur un nouvel hôte Proxmox VE. Il n’a pas de liste de fonctions à sélectionner, mais peut demander confirmation pour la mise à jour du système, pour masquer l’avertissement d’abonnement, installer Log2RAM dans certains cas et redémarrer. Les changements réversibles sont enregistrés.",
+    "ogTitle": "Script de post-installation automatisé | Documentation ProxMenux",
+    "ogDescription": "14 optimisations prédéfinies adaptées au matériel pour un nouvel hôte Proxmox VE, avec confirmation de certaines actions et suivi des changements réversibles."
+  },
+  "header": {
+    "title": "Script de post-installation automatisé",
+    "description": "ProxMenux exécute 14 optimisations de base prédéfinies sans liste de fonctions à sélectionner. Certaines actions demandent confirmation. Les changements réversibles sont enregistrés pour Désinstaller les optimisations ; les mises à niveau de paquets ne sont pas présentées comme réversibles.",
+    "section": "Post-installation · Automatisée"
+  },
+  "intro": {
+    "title": "Quand choisir Automatisé",
+    "body": "Exécutez-le sur un hôte Proxmox fraîchement installé pour obtenir une configuration de base raisonnable sans choisir chaque fonction. Le script est idempotent : une deuxième exécution réapplique les mêmes paramètres. Les fonctions optionnelles (Fastfetch, IOMMU, dépôt Ceph, HA, correctifs AMD…) ne font volontairement <strong>pas</strong> partie de ce parcours ; choisissez-les dans <link>Personnalisable</link> au besoin."
+  },
+  "applies": {
+    "heading": "Ce que le script applique",
+    "intro": "Les optimisations sont appliquées dans cet ordre exact. La colonne <em>Catégorie</em> permet de consulter la documentation détaillée de chaque changement dans la référence personnalisable.",
+    "headerNum": "#",
+    "headerTool": "Outil",
+    "headerWhat": "Ce qu'il fait",
+    "headerCategory": "Catégorie"
+  },
+  "optimizations": [
+    {
+      "tool": "Dépôts APT + mise à jour complète",
+      "what": "Désactive les dépôts Enterprise pve-enterprise.sources et ceph.sources, crée une source sans abonnement pour le nom de code Debian de l’hôte, puis lance apt update && apt full-upgrade -y (commande officielle de mise à niveau Proxmox).",
+      "category": "Paramètres de base",
+      "categorySlug": "basic-settings"
+    },
+    {
+      "tool": "Suppression de la bannière d'abonnement",
+      "what": "Modifie l’interface web pour masquer l’avertissement « Aucun abonnement valide ». Demande confirmation avant application ; réversible via Désinstaller les optimisations.",
+      "category": "Personnalisation",
+      "categorySlug": "customization"
+    },
+    {
+      "tool": "Forcer IPv4",
+      "what": "Écrit /etc/apt/apt.conf.d/99-force-ipv4 pour que apt utilise uniquement IPv4 et contourne les liaisons IPv6 instables vers les miroirs.",
+      "category": "Réseau",
+      "categorySlug": "network"
+    },
+    {
+      "tool": "Sauter les paquets de langue",
+      "what": "Écrit /etc/apt/apt.conf.d/99-disable-translations pour ne plus télécharger les index de descriptions de paquets traduites et réduire les données des mises à jour apt.",
+      "category": "Paramètres de base",
+      "categorySlug": "basic-settings"
+    },
+    {
+      "tool": "Augmentation des limites du système",
+      "what": "Augmente le nombre de surveillances inotify, les limites nofile/nproc, celles du trousseau du noyau et fs.file-max via sysctl.d, limits.d, pam et systemd, pour les hôtes avec de nombreux conteneurs.",
+      "category": "Système",
+      "categorySlug": "system"
+    },
+    {
+      "tool": "Réglage de la mémoire",
+      "what": "Définit vm.swappiness=10, des ratios équilibrés de pages modifiées non écrites, vm.max_map_count=262144 et la proactivité du compactage si disponible. La politique de surallocation mémoire du noyau reste celle de Proxmox par défaut.",
+      "category": "Système",
+      "categorySlug": "system"
+    },
+    {
+      "tool": "Comportement en cas de panique du noyau",
+      "what": "Configure l’hôte pour redémarrer 10 secondes après un panic / oops / hardlockup au lieu de rester bloqué indéfiniment.",
+      "category": "Système",
+      "categorySlug": "system"
+    },
+    {
+      "tool": "Réglage de la pile réseau",
+      "what": "Taille des tampons TCP, durcissement IPv4 (redirections désactivées, rp_filter=2, journalisation martian désactivée), ports locaux 1024-65535, détection MTU TCP, RFC 1337 et script /usr/local/sbin/proxmenux-fwbr-tune lié à une unité systemd à exécution unique et une règle udev. Ainsi, rp_filter=0 / log_martians=0 sont réappliqués aux interfaces fwbr*/fwln*/fwpr*/tap* à chaque recréation par Proxmox au démarrage/arrêt des VM, au redémarrage ou à la migration à chaud.",
+      "category": "Réseau",
+      "categorySlug": "network"
+    },
+    {
+      "tool": "Personnalisation du bashrc (root)",
+      "what": "PS1 coloré, alias courants (l/la/ll/ls/grep), historique horodaté et chargement de bash-completion, dans un bloc délimité PMX_CORE_BASHRC facile à retirer.",
+      "category": "Personnalisation",
+      "categorySlug": "customization"
+    },
+    {
+      "tool": "Log2RAM (adapté aux SSD, automatique)",
+      "what": "Réduit l’usure SSD/NVMe en déplaçant /var/log dans un disque RAM tmpfs synchronisé régulièrement vers le disque. Installation depuis le projet amont si le disque racine est SSD ou NVMe. Taille selon la RAM de l’hôte (128M / 256M / 512M), synchronisation périodique et protection automatique qui purge les anciens journaux à 80% et tronque les journaux très actifs à 92% avant écriture. Adapte les limites journald au disque RAM. Détails dans <link>Log2RAM</link>.",
+      "category": "Stockage",
+      "categorySlug": "storage"
+    },
+    {
+      "tool": "ZFS autotrim (SSD seulement)",
+      "what": "Active zpool autotrim=on sur chaque pool ZFS dont tous les vdevs sont des SSD ou NVMe compatibles TRIM, après vérification de /sys/block/[dev]/queue/rotational et discard_granularity. Les pools sur HDD sont ignorés. Seuls les pools effectivement modifiés par ProxMenux sont mémorisés pour la désinstallation ; ceux sur lesquels vous avez activé autotrim manuellement restent inchangés.",
+      "category": "Stockage",
+      "categorySlug": "storage"
+    },
+    {
+      "tool": "Limites de taille de journald",
+      "what": "Force le stockage persistant, limite SystemMaxUse=64M / RuntimeMaxUse=60M, active la compression et les journaux de niveau info requis par Monitor. Ignoré si Log2RAM est actif, car il effectue son propre réglage.",
+      "category": "Système",
+      "categorySlug": "system"
+    },
+    {
+      "tool": "Réglage du logrotate",
+      "what": "Définit globalement daily puis size 10M, conserve 7 rotations et active compression et copytruncate. Le critère de taille placé après prévaut ; les règles propres aux journaux peuvent le remplacer. Adapté à Log2RAM, mais la fréquence dépend des règles et du minuteur.",
+      "category": "Système",
+      "categorySlug": "system"
+    },
+    {
+      "tool": "Noms d'interface persistants",
+      "what": "Écrit un <code>/etc/systemd/network/10-proxmenux-&lt;iface&gt;.link</code> par NIC physique (chacun commençant par un en-tête 'Managed by ProxMenux') qui épingle le MAC au nom courant, de sorte que les noms <code>eth0</code> / <code>enp…</code> restent stables à travers les reboots et les nouveaux ajouts NIC.",
+      "category": "Réseau",
+      "categorySlug": "network"
+    }
+  ],
+  "hardwareTitle": "Valeurs par défaut adaptées au matériel",
+  "hardwareBody": "Le script examine le matériel avant de configurer l’hôte. Par défaut, Log2RAM s’installe uniquement si le disque racine est SSD ou NVMe ; il demande confirmation sinon. La taille du disque RAM dépend de la RAM totale (<code>≤ 8 GB → 128M</code>, <code>≤ 16 GB → 256M</code>, <code>'>' 16 GB → 512M</code>). Quand Log2RAM est actif, les limites journald sont adaptées au disque RAM pour éviter de le remplir.",
+  "upgrade": {
+    "heading": "Mettre à jour les listes de paquets et le système",
+    "intro": "La première étape du parcours automatisé est la mise à niveau Proxmox. Pour un hôte en fonctionnement au sein de la même version majeure, Proxmox recommande :",
+    "after": "Cette ligne est la commande officielle des versions actuelles de Proxmox. Le script automatisé l’exécute <strong>exactement</strong> et ajoute le nettoyage des dépôts et les tâches après mise à niveau recommandés par le guide — comme l’utilitaire autonome <link>Mise à jour du système Proxmox</link> :",
+    "items": [
+      "Désactive les sources Enterprise <code>pve-enterprise.sources</code> / <code>ceph.sources</code>, supprime les anciens fichiers de dépôts et crée une source sans abonnement pour le nom de code de l’hôte.",
+      "Exécute la mise à jour non interactive avec <code>DEBIAN_FRONTEND=noninteractive</code> et <code>--force-confdef --force-confold</code> — les fichiers de configuration que vous avez personnalisés restent les vôtres lorsque l'amont les a également modifiés.",
+      "Installe les paquets Proxmox essentiels s’ils manquent (<code>zfsutils-linux</code>, <code>proxmox-backup-restore-image</code>, <code>chrony</code>).",
+      "Vérification de cohérence des métadonnées LVM, <code>apt-get autoremove -y</code> + <code>apt-get autoclean -y</code> et demande de redémarrage seulement si le noyau a changé."
+    ],
+    "sameTitle": "Même mise à jour, deux points d'entrée",
+    "sameBody": "Le paquet automatisé et l'utilitaire autonome <link>Proxmox System Update</link> partagent les mêmes scripts sous-jacents (<code>update-pve8.sh</code> / <code>update-pve9_2.sh</code>). Utilisez l'utilitaire seul quand vous voulez seulement mettre à niveau l'hôte sans appliquer le reste des optimisations."
+  },
+  "endResult": {
+    "heading": "Résultat final escompté",
+    "body": "À la fin, un message de réussite et les sorties de chaque étape s’affichent, avec une demande de redémarrage pour les paramètres du noyau qui en ont besoin. Vous pouvez le reporter ; ces paramètres s’appliqueront au prochain démarrage.",
+    "imageAlt": "script automatisé post-installation — sortie finale du terminal montrant chaque optimisation appliquée avec succès"
+  },
+  "notDoes": {
+    "heading": "Ce que ce script ne fait PAS",
+    "items": [
+      "Détection automatique par fuseau horaire (commenté en amont; utiliser Personnalisable si vous le souhaitez).",
+      "Désactiver portmapper / rpcbind (voir <secLink>Sécurité</secLink>).",
+      "Activer IOMMU / VFIO (voir <virtLink>Virtualisation</virtLink>).",
+      "Installer Fastfetch / Figurine / le dépôt Ceph / HA / les correctifs CPU AMD (voir <optLink>Options</optLink>).",
+      "Installer pigz ou ajuster ZFS ARC (voir <perfLink>Performances</perfLink> / <storLink>Stockage</storLink>)."
+    ]
+  },
+  "xshokTitle": "détection xshok-proxmox",
+  "xshokBody": "Si l'hôte a déjà lancé le script <code>xshok-proxmox</code>, ProxMenux détecte le fichier marqueur et vous avertit avant de continuer. Certains changements peuvent se chevaucher. Le script compagnon est déprécié — si vous décidez de continuer de toute façon, consultez <link>la vue d'ensemble</link> pour le contexte.",
+  "revert": {
+    "heading": "Annuler les changements",
+    "body": "Chaque outil du tableau est enregistré dans <code>/usr/local/share/proxmenux/installed_tools.json</code>. Ouvrez <link>Désinstaller les optimisations</link> pour choisir les éléments à rétablir. Les sauvegardes des fichiers modifiés se trouvent à côté des originaux avec le suffixe <code>.bak</code>."
+  },
+  "related": {
+    "heading": "Voir aussi",
+    "items": [
+      {
+        "label": "Post-installation personnalisable",
+        "href": "/docs/post-install/customizable",
+        "tail": "— choisissez exactement ce que vous voulez dans le même catalogue."
+      },
+      {
+        "label": "Désinstaller les optimisations",
+        "href": "/docs/post-install/uninstall",
+        "tail": "— de revenir sur tout sous-ensemble de ce qui a été appliqué ici."
+      },
+      {
+        "label": "Commandes système utiles",
+        "href": "/docs/help-info/system-commands",
+        "tail": "— vérifier les changements (uptime, free, journalctl, etc.)."
+      },
+      {
+        "label": "Aperçu après l'installation",
+        "href": "/docs/post-install",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/fr/docs/post-install/basic-settings.json b/web/messages/fr/docs/post-install/basic-settings.json
new file mode 100644
index 00000000..135ec717
--- /dev/null
+++ b/web/messages/fr/docs/post-install/basic-settings.json
@@ -0,0 +1,240 @@
+{
+  "meta": {
+    "title": "Post-installation : Paramètres de base | Documentation ProxMenux",
+    "description": "Options de base après installation : passer aux dépôts Proxmox sans abonnement et mettre à niveau le système, détecter le fuseau horaire et activer NTP, ignorer les traductions APT et choisir parmi 25 utilitaires courants à installer."
+  },
+  "header": {
+    "title": "Post-Install: Paramètres de base",
+    "section": "Paramètres post-installation de Proxmox"
+  },
+  "intro": {
+    "title": "Ce que cette catégorie couvre",
+    "body": "Cinq options de base pour un hôte Proxmox neuf : passer aux dépôts communautaires sans abonnement, mettre à niveau tout le système, configurer automatiquement le fuseau horaire et NTP, supprimer les traductions APT pour économiser bande passante et espace disque et choisir parmi 25 utilitaires courants."
+  },
+  "upgrade": {
+    "heading": "Mettre à jour les listes de paquets et le système",
+    "intro": "Reconfigure APT pour utiliser le dépôt gratuit <em>pve-no-subscription</em> (au lieu de la repo d'entreprise qui nécessite un abonnement) et exécute une mise à niveau complète du système. Les étapes exactes dépendent de la version majeure de Proxmox VE : ProxMenux la détecte et envoie vers le bon script.",
+    "headerVersion": "Version PVE",
+    "headerScript": "Script de sélection par version",
+    "headerCodename": "Nom de code Debian",
+    "rows": [
+      {
+        "version": "9.x",
+        "script": "update-pve9_2.sh",
+        "codename": "trixie"
+      },
+      {
+        "version": "8.x",
+        "script": "update-pve8.sh",
+        "codename": "bookworm"
+      }
+    ],
+    "officialTitle": "La recommandation officielle de Proxmox",
+    "officialBody": "Le guide de mise à niveau de Proxmox est à exécuter, dans cet ordre exact:",
+    "officialOutro": "C’est la commande habituelle pour les mises à jour au sein de la version majeure installée de Proxmox VE. Vérifiez les dépôts et les changements de paquets proposés <em>avant</em> de continuer. Un changement de version majeure exige la procédure officielle de migration.",
+    "doesTitle": "Ce que fait l'option ProxMenux — vérifié par rapport au script",
+    "doesIntro": "La mise à jour ProxMenux exécute les commandes apt ci-dessus et ajoute des étapes avant et après que vous devriez autrement gérer manuellement. Les éléments suivants correspondent au script de sélection ; voir <link>Mise à jour du système Proxmox</link> pour le détail complet.",
+    "doesItems": [
+      "<strong>D’abord, nettoyer les dépôts.</strong> Désactive les dépôts Enterprise <code>pve-enterprise.sources</code> / <code>ceph.sources</code>, supprime les anciens fichiers de dépôt laissés par les versions précédentes de PVE et écrit un fichier <code>proxmox.sources</code> propre pointant vers le canal gratuit <em>pve-no-subscription</em>, adapté au nom de code Debian de l’hôte : trixie pour PVE 9, bookworm pour PVE 8.",
+      "<strong>Réécrit les dépôts Debian</strong> avec main / updates / security et <code>non-free-firmware</code>, pour éliminer l’avertissement du firmware pendant la mise à niveau.",
+      "<strong>Exécute la mise à niveau officielle.</strong> <code>apt-get update</code> suivi de <code>apt full-upgrade -y</code> (PVE 9) ou <code>apt dist-upgrade -y</code> (PVE 8), sans interaction avec <code>--force-confdef --force-confold</code> pour conserver vos fichiers de configuration personnalisés.",
+      "<strong>Installe les paquets essentiels</strong> s'ils manquent: <code>zfsutils-linux</code>, <code>proxmox-backup-restore-image</code>, <code>chrony</code>.",
+      "<strong>Vérifie les métadonnées LVM.</strong> Recherche les VM avec accès direct aux disques qui ont pu laisser d’anciens en-têtes de volumes physiques sur les disques bruts. Signale les anomalies sans correction automatique.",
+      "<strong>Nettoye ensuite :</strong> <code>apt-get autoremove -y</code> + <code>apt-get autoclean -y</code>, puis demande un redémarrage si le noyau a été mis à jour ou si <code>/var/run/reboot-required</code> est présent."
+    ],
+    "shortTitle": "Bref",
+    "shortBody": "L’option exécute <code>apt update && apt full-upgrade -y</code> comme recommandé par Proxmox, avec le nettoyage des dépôts et les étapes finales mentionnés dans le guide officiel, puis propose un redémarrage. Voir <link>Mise à jour du système Proxmox</link> pour le diagramme complet ; le même outil est disponible seul dans le menu principal.",
+    "subTitle": "Ne pas appliquer à un hôte avec abonnement",
+    "subBody": "Si vous avez un abonnement Proxmox et souhaitez garder les dépôts Enterprise, ignorez cette option. Elle désactive Enterprise et passe au canal communautaire. La mise à niveau des paquets et la réécriture des dépôts ne sont pas réversibles dans Désinstaller les optimisations ; reconfigurez explicitement les dépôts pour changer de canal plus tard.",
+    "safetyTitle": "Contrôle de sécurité après mise à jour",
+    "safetyBody": "Après la mise à niveau, le script cherche d’anciennes métadonnées de volume physique (PV) sur les disques. Cela peut arriver lorsqu’une VM avec accès direct écrit des en-têtes LVM sur un disque brut. Toute anomalie produit un avertissement suggérant <code>pvs</code> pour l’inspection. Aucune action automatique."
+  },
+  "time": {
+    "heading": "Synchroniser l'heure automatiquement",
+    "intro": "Détecte l'IP public du serveur via <code>dig myip.opendns.com @resolver1.opendns.com</code>, puis interroge <code>ipapi.co/'{'ip'}'/timezone</code> pour rechercher le fuseau horaire IANA correspondant, et l'applique avec <code>timedatectl set-timezone</code>. Enfin permet NTP avec <code>timedatectl set-ntp true</code>.",
+    "depTitle": "Dépend de deux services externes",
+    "depBody": "La recherche repose sur OpenDNS et <code>ipapi.co</code> étant accessibles, et leurs réponses étant correctes. Si vous exécutez Proxmox derrière un VPN ou sur un VLAN qui s'échappe d'une autre région, le fuseau horaire détecté automatiquement peut être erroné. Dans ce cas, sautez cette option et définissez le fuseau horaire à la main:",
+    "revertTitle": "Réversible depuis le menu Désinstaller",
+    "revertBody": "<link>Désinstaller les optimisations</link> remet le fuseau horaire à UTC, une valeur par défaut sûre. NTP reste actif : l’horloge continue de se synchroniser et affiche UTC jusqu’au réglage manuel d’un autre fuseau."
+  },
+  "languages": {
+    "heading": "ignorer le téléchargement de langues supplémentaires",
+    "intro": "Pendant <code>apt update</code>, APT peut télécharger des descriptions de paquets traduites en plus des métadonnées principales. Cette option les désactive pour économiser bande passante et espace. Avant cela, ProxMenux <strong>vérifie que les paramètres régionaux de l’hôte sont générés</strong> : lit <code>/etc/default/locale</code> ou <code>/etc/environment</code>, ajoute à <code>/etc/locale.gen</code> si nécessaire et lance <code>locale-gen</code>. Les paramètres régionaux du shell sont ainsi conservés.",
+    "writtenTitle": "Ce qui est écrit",
+    "revertTitle": "Réversible depuis le menu Désinstaller",
+    "revertBody": "Suppression de <code>/etc/apt/apt.conf.d/99-disable-translations</code> (soit manuellement soit à partir du menu Désinstaller) restaure le comportement par défaut et APT télécharge à nouveau les fichiers linguistiques."
+  },
+  "utilities": {
+    "heading": "Installer les utilitaires système courants",
+    "intro": "Ouvre une liste groupée de <strong>25 utilitaires sélectionnés</strong>. Choisissez et confirmez ; ProxMenux les installe via <code>apt</code>, vérifie le résultat et affiche un résumé final.",
+    "imageAlt": "Sélecteur des utilitaires ProxMenux : Espace pour sélectionner, Entrée pour confirmer",
+    "reuseTitle": "La même liste est réutilisée ailleurs",
+    "reuseBody": "Le catalogue des 25 utilitaires est défini à un seul endroit : <code>PROXMENUX_UTILS</code> dans <code>scripts/global/utils-install-functions.sh</code>. Le menu <em>Utilitaires et outils → Utilitaires système</em> présente la même liste pour en ajouter plus tard sans refaire la post-installation.",
+    "listTitle": "Ce qui est dans la liste",
+    "groups": [
+      {
+        "group": "Moniteurs système",
+        "items": [
+          {
+            "pkg": "htop",
+            "desc": "Affichage interactif des processus"
+          },
+          {
+            "pkg": "btop",
+            "desc": "Moniteur de ressources modernes (CPU, RAM, disques, net, processus)"
+          },
+          {
+            "pkg": "s-tui",
+            "desc": "Interface terminal pour les tests de charge CPU et la surveillance"
+          },
+          {
+            "pkg": "iftop",
+            "desc": "Utilisation de bande passante par connexion en direct"
+          },
+          {
+            "pkg": "iotop",
+            "desc": "E/S disque par processus"
+          },
+          {
+            "pkg": "iptraf-ng",
+            "desc": "Moniteur IP LAN interactif"
+          }
+        ]
+      },
+      {
+        "group": "Réseau",
+        "items": [
+          {
+            "pkg": "iperf3",
+            "desc": "Mesurer la bande passante maximale réalisable entre les hôtes"
+          },
+          {
+            "pkg": "net-tools",
+            "desc": "Anciens outils (ifconfig, netstat, route). Toujours utiles pour les vérifications rapides"
+          },
+          {
+            "pkg": "ipset",
+            "desc": "Gérer les grands ensembles IP dans le noyau — utile avec les règles iptables/nftables."
+          }
+        ]
+      },
+      {
+        "group": "Téléchargement et archive",
+        "items": [
+          {
+            "pkg": "axel",
+            "desc": "accélérateur de téléchargement parallèle léger"
+          },
+          {
+            "pkg": "aria2",
+            "desc": "Téléchargeur multisource / multiprotocole (HTTP, FTP, BitTorrent, Metalink)"
+          },
+          {
+            "pkg": "unzip",
+            "desc": "Extraire les archives ZIP"
+          },
+          {
+            "pkg": "zip",
+            "desc": "Créer des archives ZIP"
+          },
+          {
+            "pkg": "cabextract",
+            "desc": "Extraire les archives Microsoft CAB (utile avec les ISO Windows)"
+          },
+          {
+            "pkg": "wimtools",
+            "desc": "Manipuler les images WIM Windows (extraire, fractionner, monter, appliquer)"
+          },
+          {
+            "pkg": "genisoimage",
+            "desc": "Construire des images ISO 9660 à partir d'un arbre de répertoires"
+          }
+        ]
+      },
+      {
+        "group": "Texte et fichiers",
+        "items": [
+          {
+            "pkg": "dos2unix",
+            "desc": "Convertir les fins de ligne CRLF (Windows) en LF (Unix)"
+          },
+          {
+            "pkg": "grc",
+            "desc": "Coloration générique : applique une coloration syntaxique aux sorties de ping, traceroute, dig, tail, etc."
+          },
+          {
+            "pkg": "plocate",
+            "desc": "Recherche rapide de fichiers (indexée). Exécutez `updatedb` après l'installation pour construire l'index."
+          }
+        ]
+      },
+      {
+        "group": "Accès distant et sessions",
+        "items": [
+          {
+            "pkg": "sshpass",
+            "desc": "Authentification SSH par mot de passe sans interaction (pour les scripts, pas pour l’usage quotidien)"
+          },
+          {
+            "pkg": "tmux",
+            "desc": "Multiplexeur de terminal : détacher les sessions, diviser les panneaux et conserver les sessions après une déconnexion"
+          }
+        ]
+      },
+      {
+        "group": "Matériel et bas niveau",
+        "items": [
+          {
+            "pkg": "msr-tools",
+            "desc": "Registres spécifiques au modèle CPU de lecture/écriture (rdmsr, wrmsr)"
+          },
+          {
+            "pkg": "intel-gpu-tools",
+            "desc": "utilitaires de diagnostic Intel GPU y compris `intel_gpu_top`"
+          }
+        ]
+      },
+      {
+        "group": "Virtualisation",
+        "items": [
+          {
+            "pkg": "libguestfs-tools",
+            "desc": "Inspecter et modifier les images de disque VM (virt-ls, virt-cat, guestmount...)"
+          },
+          {
+            "pkg": "chntpw",
+            "desc": "Modifier Windows SAM — utile pour la récupération de mot de passe sur Windows VMs que vous héritez"
+          }
+        ]
+      }
+    ],
+    "actionTitle": "Quelques-uns en action",
+    "noBulkTitle": "Seuls les utilitaires installés par ProxMenux sont supprimés",
+    "noBulkBody": "ProxMenux enregistre uniquement les paquets sélectionnés qui n’étaient pas déjà installés. Désinstaller les optimisations les supprime complètement et conserve les paquets présents auparavant. Une mise à niveau APT n’a pas de retour arrière atomique sûr : désinstaller les utilitaires n’annule pas la mise à niveau du système."
+  },
+  "related": {
+    "heading": "Voir aussi",
+    "items": [
+      {
+        "label": "Mise à jour du système Proxmox",
+        "href": "/docs/utils/system-update",
+        "tail": "— relance le cycle apt update + dist-upgrade sur demande."
+      },
+      {
+        "label": "Installateur des utilitaires système",
+        "href": "/docs/utils/system-utils",
+        "tail": "— installer (ou réinstaller) les utilitaires individuellement après l'installation."
+      },
+      {
+        "label": "Commandes de mises à jour et de paquets",
+        "href": "/docs/help-info/update-commands",
+        "tail": " — Référence apt pour le shell."
+      },
+      {
+        "label": "Post-installation personnalisable",
+        "href": "/docs/post-install/customizable",
+        "tail": "— retour au menu parent."
+      }
+    ]
+  }
+}
diff --git a/web/messages/fr/docs/post-install/customizable.json b/web/messages/fr/docs/post-install/customizable.json
new file mode 100644
index 00000000..7590e504
--- /dev/null
+++ b/web/messages/fr/docs/post-install/customizable.json
@@ -0,0 +1,106 @@
+{
+  "meta": {
+    "title": "Script post-installation personnalisable | Documentation ProxMenux",
+    "description": "Choisissez précisément les optimisations à appliquer à un hôte Proxmox VE avec ProxMenux. 10 catégories, environ 35 outils et une interface à cases à cocher. Inclut tout le script Automatisé, plus des options à activer explicitement (IOMMU, Fastfetch, Figurine, Ceph, HA, correctifs AMD…).",
+    "ogTitle": "Script post-installation personnalisable | Documentation ProxMenux",
+    "ogDescription": "10 catégories, environ 35 optimisations individuelles. Choisissez précisément ce que vous voulez sur un hôte Proxmox VE. Les modifications réversibles sont suivies."
+  },
+  "header": {
+    "title": "Script post-installation personnalisable",
+    "description": "Choisissez précisément les optimisations à appliquer à un hôte Proxmox VE. ProxMenux regroupe environ 35 outils dans 10 catégories au sein d’une seule boîte de dialogue à cases à cocher. Même moteur qu’Automatisé, avec un contrôle complet.",
+    "section": "Post-Installation · Personnalisable"
+  },
+  "intro": {
+    "title": "Quand choisir Personnalisable",
+    "body": "Choisissez cette voie si vous connaissez déjà les réglages souhaités ou à éviter. Une liste à cases à cocher, groupée par catégorie, permet de sélectionner, désélectionner et combiner les optimisations. Vous pouvez les réappliquer plus tard ; les modifications réversibles sont suivies pour <link>Désinstaller les optimisations</link>. Les mises à niveau de paquets ne sont pas présentées comme réversibles."
+  },
+  "compare": {
+    "heading": "Comment il se compare à Automatisé",
+    "body": "Personnalisable inclut tout le <link>script Automatisé</link> : les mêmes 14 optimisations de base et de nombreuses options volontairement omises par Automatisé, utiles à certains matériels (correctifs AMD), hébergeurs (OVH RTM) ou usages (IOMMU/VFIO, dépôt Ceph, haute disponibilité, Fastfetch, Figurine, réglage de l’ARC ZFS, pigz, instantanés ZFS automatiques, limites de vitesse vzdump, Open vSwitch, TCP BBR…)."
+  },
+  "categoriesSection": {
+    "heading": "Les 10 catégories",
+    "body": "Le script Personnalisable regroupe les optimisations en 10 catégories dans une seule boîte de dialogue à cases à cocher. Chaque catégorie a sa propre page de documentation : ouvrez une carte pour consulter la justification, les valeurs par défaut et les vérifications de chaque option."
+  },
+  "categories": [
+    {
+      "name": "Paramètres de base",
+      "description": "Nettoyer les sources APT, lancer la mise à niveau officielle Proxmox et définir le fuseau horaire, les paramètres régionaux et les utilitaires courants. La base de toutes les autres catégories."
+    },
+    {
+      "name": "Système",
+      "description": "Règle la journalisation et les limites du noyau pour un hôte hébergeant de nombreuses VM et conteneurs. Couvre journald, logrotate, sysctl (mémoire, limites de fichiers), le comportement en cas de kernel panic et les redémarrages rapides."
+    },
+    {
+      "name": "Virtualisation",
+      "description": "Prépare l’hôte à la virtualisation avancée. Installe l’agent invité adapté lorsque Proxmox lui-même fonctionne dans une VM prise en charge et active IOMMU/VFIO pour l’accès direct PCI des GPU, contrôleurs et TPU."
+    },
+    {
+      "name": "Réseau",
+      "description": "Renforce et règle la pile réseau de l’hôte. Force APT sur IPv4, applique des réglages de sécurité sysctl et des tampons TCP, propose Open vSwitch, TCP BBR et TCP Fast Open et associe les noms d’interface persistants aux adresses MAC."
+    },
+    {
+      "name": "Stockage",
+      "description": "Configure les sous-systèmes de stockage courants de Proxmox : taille de l’ARC ZFS, instantanés ZFS automatiques, autotrim ZFS pour les pools SSD/NVMe et limites de vitesse vzdump pour éviter de saturer les disques pendant les sauvegardes."
+    },
+    {
+      "name": "Sécurité",
+      "description": "Réduit la surface d’attaque exposée par défaut. Désactive les services RPC portmapper/rpcbind dont Proxmox n’a pas besoin mais qu’il laisse en écoute."
+    },
+    {
+      "name": "Personnalisation",
+      "description": "Changer l'expérience visuelle et shell de l'hôte: couleurs et alias dans bashrc, bannière MOTD et suppression de l'avis d'abonnement dans l'interface utilisateur web."
+    },
+    {
+      "name": "Surveillance",
+      "description": "Intègre l’hôte à OVH Real-Time Monitoring. Installe RTM uniquement si ProxMenux détecte un serveur OVH ; l’option ne modifie rien sur les autres hôtes."
+    },
+    {
+      "name": "Performances",
+      "description": "Accélère la compression (sauvegardes, transferts) en remplaçant gzip par son équivalent parallèle pigz."
+    },
+    {
+      "name": "Facultatif",
+      "description": "Options spécialisées dont tous les hôtes n’ont pas besoin : correctifs CPU AMD, bannière Fastfetch, nom d’hôte 3D Figurine, actualisation de l’index PVE Appliance Manager, dépôt Ceph, services haute disponibilité, Log2RAM pour limiter l’usure des SSD et profil de swap ZRAM."
+    }
+  ],
+  "mixTip": {
+    "title": "Combiner Automatisé et Personnalisable",
+    "body": "Un usage courant : commencez par <strong>Automatisé</strong> pour établir une base raisonnable, puis ouvrez <strong>Personnalisable</strong> et choisissez seulement les options utiles, comme IOMMU pour l’accès direct à un GPU. Les modifications sont suivies séparément ; Désinstaller affiche tout ce qui a été appliqué, quelle que soit la voie utilisée."
+  },
+  "related": {
+    "heading": "Voir aussi",
+    "items": [
+      {
+        "label": "Post-installation automatisée",
+        "href": "/docs/post-install/automated",
+        "tail": " — valeurs par défaut raisonnables appliquées sans question."
+      },
+      {
+        "label": "Désinstaller les optimisations",
+        "href": "/docs/post-install/uninstall",
+        "tail": " — annuler proprement les éléments sélectionnés."
+      },
+      {
+        "label": "Paramètres de base",
+        "href": "/docs/post-install/basic-settings",
+        "tail": "— repos, temps, langue, utilitaires."
+      },
+      {
+        "label": "Virtualisation",
+        "href": "/docs/post-install/virtualization",
+        "tail": "— IOMMU + VFIO pour transmission."
+      },
+      {
+        "label": "Sécurité",
+        "href": "/docs/post-install/security",
+        "tailRich": " · <storageLink>Stockage</storageLink> · <networkLink>Réseau</networkLink> · <customLink>Personnalisation</customLink> — autres catégories."
+      },
+      {
+        "label": "Aperçu après l'installation",
+        "href": "/docs/post-install",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/fr/docs/post-install/customization.json b/web/messages/fr/docs/post-install/customization.json
new file mode 100644
index 00000000..5b84af4b
--- /dev/null
+++ b/web/messages/fr/docs/post-install/customization.json
@@ -0,0 +1,74 @@
+{
+  "meta": {
+    "title": "Post-installation : Personnalisation | Documentation ProxMenux",
+    "description": "Options de personnalisation du script post-installation personnalisable de ProxMenux : invite bash colorée avec des alias utiles, bannière ProxMenux dans le MOTD et suppression du rappel d’abonnement de l’interface web Proxmox."
+  },
+  "header": {
+    "title": "Après installation : personnalisation",
+    "description": "Réglages visuels et pratiques de l’hôte Proxmox. Ils rendent le shell plus agréable et masquent le rappel d’abonnement de l’interface web. Bashrc, MOTD et la bannière sont suivis et réversibles depuis Désinstaller.",
+    "section": "Paramètres post-installation de Proxmox"
+  },
+  "intro": {
+    "title": "Ce que cette catégorie couvre",
+    "body": "Trois petites options indépendantes : une <strong>invite bash colorée avec alias</strong> pour le shell root, une <strong>bannière MOTD</strong> d’une ligne à la connexion SSH et la suppression de la <strong>fenêtre « Aucun abonnement valide »</strong> affichée à chaque connexion web Proxmox."
+  },
+  "bashrc": {
+    "heading": "Personnaliser bashrc",
+    "intro": "Insère dans <code>/root/.bashrc</code> un bloc préparé avec une invite colorée, un historique horodaté, les alias habituels de <code>ls</code> / <code>grep</code> et un <code>source</code> pour l’autocomplétion bash. Rend le travail via SSH plus agréable et permet d’identifier facilement l’hôte lorsque plusieurs onglets sont ouverts.",
+    "writesTitle": "Ce que ProxMenux ajoute à .bashrc",
+    "writesOutro": "Le bloc est délimité par les marqueurs <code>PMX_CORE_BASHRC</code>. Exécuter le script remplace à nouveau le bloc précédent au lieu de le dupliquer. Le <code>.bashrc</code> original est sauvegardé une fois sur <code>/root/.bashrc.bak</code>, et une ligne <code>source /root/.bashrc</code> est annexée au <code>/root/.bash_profile</code> de sorte que l'invite s'applique également sur les shells de connexion (par exemple après <code>su -</code>).",
+    "rootTitle": "S’applique uniquement à root",
+    "rootBody": "La personnalisation concerne le shell du compte root. Les autres utilisateurs gardent leurs propres réglages par défaut. Si vous administrez Proxmox uniquement par l’interface web sans utiliser le shell, vous pouvez ignorer cette option purement esthétique."
+  },
+  "motd": {
+    "heading": "Configurer une bannière MOTD personnalisée",
+    "intro": "Ajoute <em>\"This system is optimised by: ProxMenux\"</em> au début de <code>/etc/motd</code>, le message après une connexion SSH réussie, au-dessus de l’invite et avant les scripts <code>update-motd</code>. Sans danger et purement informatif : confirme visuellement que ProxMenux a été appliqué sur l’hôte.",
+    "writesTitle": "Ce que ProxMenux écrit",
+    "writesOutro": "À la première application, ProxMenux enregistre si <code>/etc/motd</code> existait et conserve son contenu original sous <code>/usr/local/share/proxmenux</code>. L’opération est idempotente : si la ligne de repère existe déjà, rien n’est ajouté. Les anciennes installations avec <code>/etc/motd.bak</code> sont migrées vers le même état réversible."
+  },
+  "banner": {
+    "heading": "Supprimer la bannière d'abonnement",
+    "intro": "Supprime la fenêtre <em>« Vous n’avez pas d’abonnement valide pour ce serveur »</em> affichée à chaque connexion web Proxmox sans abonnement Enterprise. ProxMenux tient compte de la version et lance le script adapté aux différents fichiers d’interface des versions majeures.",
+    "versionTitle": "Choix du script selon la version",
+    "versionItems": [
+      "<strong>PVE 9.x</strong> → exécute <code>remove-banner-pve-v3.sh</code>, qui modifie <code>proxmoxlib.js</code> pour le bureau et la nouvelle interface mobile basée sur Yew.",
+      "<strong>PVE 8.x</strong> → exécute <code>remove-banner-pve8.sh</code>, uniquement pour l’interface de bureau."
+    ],
+    "versionOutro": "Avant le patching, ProxMenux sauvegarde les fichiers JS/template originaux vers <code>/usr/local/share/proxmenux/backups/</code> avec un horodatage. Le flux Désinstaller utilise ces sauvegardes pour restaurer les fichiers originaux, et revient à réinstaller les paquets de l'interface utilisateur Proxmox si la sauvegarde est manquante ou corrompue.",
+    "breakTitle": "Peut se casser après les mises à jour Proxmox",
+    "breakBody": "Les mises à jour de l’interface Proxmox écrasent régulièrement <code>proxmoxlib.js</code>, ce qui peut faire revenir le rappel. Vous pouvez réappliquer l’option pour modifier le fichier ou garder le rappel jusque-là. ProxMenux installe aussi un hook APT qui réapplique la modification après les mises à niveau de paquets ; voir <link>Désinstaller les optimisations</link> pour sa suppression.",
+    "legalTitle": "Note juridique (il vaut toujours la peine de répéter)",
+    "legalBody": "Cette option masque seulement le rappel de l’interface. Elle ne donne <strong>pas</strong> droit au support Enterprise ni au dépôt Enterprise et ne change pas la licence du logiciel. Proxmox VE est publié sous GNU AGPLv3. Un abonnement soutient le projet et donne accès au canal de mises à jour Enterprise ; choisissez le niveau de support adapté à votre environnement."
+  },
+  "verify": {
+    "heading": "Vérification",
+    "intro": "Après avoir appliqué les trois :",
+    "reversibleTitle": "Les trois changements de personnalisation sont suivis",
+    "reversibleBody": "<link>Désinstaller les optimisations</link> restaure <code>/root/.bashrc</code>, remet MOTD dans son état exact d’avant ProxMenux ou supprime le fichier s’il n’existait pas, et restaure les fichiers d’interface modifiés depuis la sauvegarde ou réinstalle les paquets concernés si nécessaire."
+  },
+  "related": {
+    "heading": "Voir aussi",
+    "items": [
+      {
+        "label": "Facultatif",
+        "href": "/docs/post-install/optional",
+        "tail": "— Fastfetch et Figurine (autres personnalisations visuelles)."
+      },
+      {
+        "label": "Afficher les informations sur la version",
+        "href": "/docs/settings/show-version-information",
+        "tail": "— confirme que les personnalisations sont suivies comme installées."
+      },
+      {
+        "label": "Désinstaller les optimisations",
+        "href": "/docs/post-install/uninstall",
+        "tail": " — restaurer bashrc, motd et le rappel d’abonnement."
+      },
+      {
+        "label": "Post-installation personnalisable",
+        "href": "/docs/post-install/customizable",
+        "tail": "— retour au menu parent."
+      }
+    ]
+  }
+}
diff --git a/web/messages/fr/docs/post-install/index.json b/web/messages/fr/docs/post-install/index.json
new file mode 100644
index 00000000..937e0797
--- /dev/null
+++ b/web/messages/fr/docs/post-install/index.json
@@ -0,0 +1,106 @@
+{
+  "meta": {
+    "title": "Script post-installation de Proxmox VE — Automatisé et personnalisable | ProxMenux",
+    "description": "Présentation des scripts post-installation de ProxMenux pour Proxmox VE. Le script Automatisé applique des valeurs par défaut raisonnables sans question ; le script Personnalisable permet de choisir précisément parmi 10 catégories ; Désinstaller les optimisations restaure les modifications réversibles prises en charge.",
+    "ogTitle": "Proxmox VE Script post-installation — automatisé et personnalisable",
+    "ogDescription": "Appliquez les optimisations courantes après installation de Proxmox VE dans 10 catégories, automatiquement ou à la carte, avec des options réversibles.",
+    "twitterTitle": "Script post-installation de Proxmox VE | ProxMenux",
+    "twitterDescription": "Optimisations automatisées et personnalisables post-installation pour Proxmox VE — avec options réversibles."
+  },
+  "header": {
+    "title": "Scripts post-installation",
+    "description": "Configurez un hôte Proxmox VE fraîchement installé avec les optimisations post-installation de ProxMenux. Appliquez automatiquement la configuration de base, choisissez des options individuelles, mettez à jour les fonctions installées ou restaurez les modifications réversibles prises en charge. Les mises à niveau de paquets ne sont pas présentées comme réversibles.",
+    "section": "Paramètres post-installation de Proxmox"
+  },
+  "intro": {
+    "title": "À quoi sert ce menu",
+    "body": "Après l’installation de Proxmox VE, des dizaines de petites modifications rendent l’hôte plus rapide et plus facile à entretenir : dépôts sans abonnement, limites journald raisonnables, tampons TCP adaptés, stockage des journaux ménageant les SSD, améliorations de bashrc et plus encore. ProxMenux les automatise et suit les modifications de configuration réversibles prises en charge."
+  },
+  "openingMenu": {
+    "heading": "Ouverture du menu",
+    "body": "Dans le menu principal de ProxMenux, sélectionnez <strong>Paramètres après l'installation Proxmox</strong>. Vous verrez ceci :",
+    "imageAlt": "Menu des scripts post-installation : Automatisé, Personnalisable, l’entrée conditionnelle Appliquer les mises à jour disponibles (uniquement si des mises à jour sont en attente) et Désinstaller, suivis de la section Scripts communautaires"
+  },
+  "threeWays": {
+    "heading": "Quatre façons d'appliquer les optimisations",
+    "body": "Les quatre entrées ProxMenux partagent le même code et le même registre d’outils installés, mais offrent différents niveaux de contrôle. <em>Appliquer les mises à jour disponibles</em> n’apparaît que si la version sur disque d’au moins une optimisation installée est plus récente que la version enregistrée ; l’entrée reste masquée juste après la configuration de l’hôte."
+  },
+  "routes": [
+    {
+      "title": "Automatisé",
+      "description": "Une sélection de 14 optimisations sûres et toujours utiles, appliquées successivement sans question. Un bon choix par défaut pour la plupart des utilisateurs.",
+      "bullets": [
+        "Dépôts sans abonnement + mise à niveau du système",
+        "Mémoire, noyau, réglage réseau",
+        "Log2RAM (détecté automatiquement sur SSD/NVMe)",
+        "Limites de taille pour journald + logrotate",
+        "Noms d'interface persistants"
+      ]
+    },
+    {
+      "title": "Personnalisable",
+      "description": "Environ 35 optimisations individuelles dans 10 catégories. Vous choisissez précisément lesquelles appliquer. Même moteur qu’Automatisé, avec un contrôle complet.",
+      "bullets": [
+        "Interface à cases à cocher par catégorie",
+        "Inclut tout ce que fait Automatisé, plus des options à activer explicitement (IOMMU, Fastfetch, Figurine, Ceph, HA, correctifs AMD…)",
+        "Exécutez-le autant de fois que voulu : les modifications sont idempotentes"
+      ]
+    },
+    {
+      "title": "Appliquer les mises à jour disponibles",
+      "description": "Si une optimisation post-installation (Log2Ram, paramètres de mémoire, Logrotate…) a une version sur disque plus récente que celle enregistrée sur l’hôte, cette entrée affiche uniquement les optimisations concernées. Elle relance leur fonction et actualise le registre, sans rien toucher d’autre.",
+      "bullets": [
+        "Activation individuelle par optimisation, uniquement celles modifiées",
+        "Même sélecteur disponible dans le tableau de bord Monitor",
+        "Une seule notification groupée lorsque de nouvelles mises à jour sont disponibles"
+      ]
+    },
+    {
+      "title": "Désinstaller les optimisations",
+      "description": "Les modifications réversibles prises en charge sont suivies dans un registre JSON et associées à une fonction de restauration. Les actions sans retour en arrière sûr, comme une mise à niveau complète des paquets, sont volontairement exclues.",
+      "bullets": [
+        "Détecte automatiquement les optimisations précédemment appliquées",
+        "Choisit le retour adapté à chaque élément : restaurer une sauvegarde .bak si elle existe, supprimer le fragment de configuration sysctl.d si rien ne nécessitait de sauvegarde, ou réinstaller le paquet d’origine avec --force-confnew (par exemple pour la bannière d’abonnement)",
+        "Demande de redémarrage si nécessaire (VFIO, noms persistants, etc.)"
+      ]
+    }
+  ],
+  "whichTitle": "Lequel choisir ?",
+  "whichBody": "Pour une nouvelle installation de Proxmox avec une configuration de base raisonnable sans décisions à prendre : <autoLink><strong>Automatisé</strong></autoLink>. Si vous connaissez déjà les réglages souhaités ou à éviter : <customLink><strong>Personnalisable</strong></customLink>. Pour ne mettre à jour qu’une optimisation déjà appliquée dont une version plus récente est sur disque : <updatesLink><strong>Appliquer les mises à jour disponibles</strong></updatesLink>. Pour annuler proprement une modification précédente : <uninstallLink><strong>Désinstaller les optimisations</strong></uninstallLink>. Vous pouvez combiner ces modes : commencez par Automatisé, ajoutez Fastfetch ou IOMMU avec Personnalisable, puis annulez des éléments individuels plus tard.",
+  "mixing": {
+    "heading": "Mélange avec d'autres scripts post-installation",
+    "stackTitle": "Ne pas empiler plusieurs scripts post-installation",
+    "stackBody": "Exécuter plusieurs scripts post-installation sur le même hôte peut créer des fichiers de configuration en double, des entrées sysctl contradictoires ou même casser le réseau après redémarrage. Si vous avez déjà appliqué <strong>Helper-Scripts Post Install</strong>, certaines optimisations ProxMenux peuvent recouper sa configuration. Utilisez un seul outil post-installation par hôte.",
+    "xshokTitle": "xshok-proxmox: déprécié",
+    "xshokBody": "Les anciennes versions de ProxMenux présentaient <a>xshok-proxmox</a> comme outil post-installation complémentaire. Ce projet est désormais obsolète et n’est plus proposé dans ProxMenux. Si une ancienne exécution a laissé des marqueurs sur l’hôte, ProxMenux les détecte toujours et vous avertit. Ce n’est toutefois plus un outil à installer aux côtés de ProxMenux."
+  },
+  "community": {
+    "heading": "Scripts communautaires",
+    "body": "Le menu propose aussi deux scripts tiers du projet <a>community-scripts</a> : <em>Proxmox VE Post Install</em> et <em>Proxmox VE Microcode</em>. Ces enveloppes téléchargent et exécutent les scripts originaux via <code>wget | bash</code>. ProxMenux ne les maintient pas. Consultez <link>Dépôts externes</link> pour les détails et les questions de confiance avant de les lancer."
+  },
+  "related": {
+    "heading": "Voir aussi",
+    "items": [
+      {
+        "label": "Mise à jour du système Proxmox",
+        "href": "/docs/utils/system-update",
+        "tail": "— tient l'hôte à jour une fois qu'il a été installé."
+      },
+      {
+        "label": "Sécurité",
+        "href": "/docs/security",
+        "tail": "— Fail2Ban + Lynis au-dessus du durcissement post-installation."
+      },
+      {
+        "label": "Afficher les informations sur la version",
+        "href": "/docs/settings/show-version-information",
+        "tail": "— voir quels composants post-installation sont suivis comme installés."
+      },
+      {
+        "label": "Commandes de mises à jour et de paquets",
+        "href": "/docs/help-info/update-commands",
+        "tail": "— référence pour apt / pveupgrade."
+      }
+    ]
+  }
+}
diff --git a/web/messages/fr/docs/post-install/monitoring.json b/web/messages/fr/docs/post-install/monitoring.json
new file mode 100644
index 00000000..44fc2a5b
--- /dev/null
+++ b/web/messages/fr/docs/post-install/monitoring.json
@@ -0,0 +1,56 @@
+{
+  "meta": {
+    "title": "Post-installation : Surveillance | Documentation ProxMenux",
+    "description": "Options de surveillance dans le script de post-installation personnalisable ProxMenux. Actuellement une seule option : installer OVH Real-Time Monitoring (RTM), qui ne s'active que si l'hôte est détecté comme serveur OVH."
+  },
+  "header": {
+    "title": "Après installation : surveillance",
+    "description": "Options de surveillance dans le script de post-installation personnalisable. Cette catégorie est petite et spécifique au fournisseur, elle installe l'agent de surveillance en temps réel OVH sur des serveurs OVH dédiés et ne fait rien ailleurs.",
+    "section": "Paramètres post-installation de Proxmox"
+  },
+  "intro": {
+    "title": "Un périmètre volontairement limité",
+    "body": "La surveillance post-installation se limite à <strong>un agent propre à un fournisseur</strong>. Les outils généraux (Prometheus, Grafana, node_exporter) sont hors périmètre, car leurs choix d’architecture — hôte séparé, conservation des données, destinataires des alertes — dépassent une étape en un clic. ProxMenux Monitor, inclus dans ProxMenux, remplit l’essentiel de ce rôle sans agent externe."
+  },
+  "ovh": {
+    "heading": "Installer la surveillance en temps réel OVH (RTM)",
+    "intro": "Si votre hôte Proxmox est un serveur dédié loué à partir de <a>OVHcloud</a>, vous pouvez permettre à RTM d'exposer la télémétrie matérielle (température CPU, statut PSU, disque SMART, état contrôleur RAID, etc.) au panneau de contrôle OVH. C'est le même agent OVH utilise pour leur propre fonction \"Surveillance du serveur\".",
+    "decisionsTitle": "La décision de ProxMenux",
+    "decisionsItems": [
+      "Obtenez l'IP public de l'hôte via <code>curl ipinfo.io/ip</code>.",
+      "Examine le FAI propriétaire avec une requête <code>whois</code> sur <code>v4.whois.cymru.com</code>.",
+      "Si le résultat mentionne OVH, télécharge <code>last-public-ovh-infra-yak.snap.mirrors.ovh.net/yak/archives/apply.sh</code> et le transmet à <code>bash</code> avec le manifeste Puppet de RTM v2.",
+      "Si le résultat ne mentionne <em>pas</em> OVH, rien n'est installé. L'option est sans opération."
+    ],
+    "remoteTitle": "Le script distant est passé à bash",
+    "remoteBody": "L’installation exécute <code>wget -qO - https://…apply.sh | bash</code>. Si le miroir OVH est compromis, le script s’exécute en root sur votre hôte. Avant d’activer l’option, mettez en balance la confiance dans la chaîne de miroirs OVH et le bénéfice de surveillance. Pour la plupart des utilisateurs de laboratoires domestiques ou hors OVH, l’option devrait rester désactivée.",
+    "noOpTitle": "Activer uniquement si l'hôte est effectivement à OVH",
+    "noOpBody": "L'option est un non-op sur les serveurs non-OVH, donc cochez-le sur un Proxmox home-lab ne casse rien. Sur un hôte non-OVH le script imprime <em>\"Pas un serveur OVH, sauter l'installation RTM\"</em> et sortir proprement; aucun paquet n'est installé.",
+    "runsTitle": "Ce que ProxMenux exécute",
+    "verifyTitle": "Vérification",
+    "verifyBody": "Sur un véritable hôte OVH, après un redémarrage, vous devriez voir le tableau de bord <a>RTM</a> dans votre gestionnaire OVH peuplé de données en direct pour l'hôte. Du côté Proxmox, le capteur RTM est un service systemd — vérifiez-le directement:",
+    "troubleTitle": "Dépannage",
+    "revertTitle": "Supprimer RTM depuis le menu Désinstaller",
+    "revertBody": "Si RTM est enregistré comme installé, Désinstaller les optimisations propose une entrée OVH Real-Time Monitoring. Elle exécute <code>apt-get purge -y ''ovh-rtm*'' ''rtm'' ''rtm-*''</code>, supprime /etc/rtm et marque RTM comme désinstallé. Des éléments Puppet peuvent encore nécessiter un nettoyage manuel ; examinez les manifestes propres à RTM dans <code>/etc/puppet/</code>. Sur un hôte hors OVH, aucun paquet RTM n’a été installé, donc rien n’est à supprimer."
+  },
+  "related": {
+    "heading": "Voir aussi",
+    "items": [
+      {
+        "label": "ProxMenux Monitor",
+        "href": "/docs/settings/proxmenux-monitor",
+        "tail": "— tableau de bord web local pour l'hôte (travaille sur n'importe quel fournisseur, pas seulement OVH)."
+      },
+      {
+        "label": "Commandes système utiles",
+        "href": "/docs/help-info/system-commands",
+        "tail": "— référence de surveillance des hôtes locaux."
+      },
+      {
+        "label": "Post-installation personnalisable",
+        "href": "/docs/post-install/customizable",
+        "tail": "— retour au menu parent."
+      }
+    ]
+  }
+}
diff --git a/web/messages/fr/docs/post-install/network.json b/web/messages/fr/docs/post-install/network.json
new file mode 100644
index 00000000..4b1cd33c
--- /dev/null
+++ b/web/messages/fr/docs/post-install/network.json
@@ -0,0 +1,128 @@
+{
+  "meta": {
+    "title": "Post-installation : Réseau | Documentation ProxMenux",
+    "description": "Options réseau du script de post-installation personnalisable ProxMenux : forcer APT sur IPv4, appliquer un profil sysctl sélectionné, installer Open vSwitch, activer TCP BBR + Fast Open et associer les noms d’interfaces aux adresses MAC."
+  },
+  "header": {
+    "title": "Post-Installation: Réseau",
+    "section": "Paramètres post-installation de Proxmox"
+  },
+  "intro": {
+    "title": "Ce que cette catégorie couvre",
+    "body": "Cinq options réseau indépendantes. Deux sont simples (<strong>APT sur IPv4</strong>, <strong>installation d’Open vSwitch</strong>), deux règlent le comportement TCP (<strong>profil sysctl réseau</strong>, <strong>BBR + Fast Open</strong>) et une résout un problème courant : <strong>fixer les noms d’interfaces</strong> pour qu’une nouvelle carte réseau ou une mise à jour du BIOS ne renomme pas <code>enp3s0</code> en <code>enp4s0</code> et ne casse pas vos ponts."
+  },
+  "ipv4": {
+    "heading": "Forcer APT à utiliser IPv4",
+    "intro": "Écrit <code>Acquire::ForceIPv4 \"true\";</code> à <code>/etc/apt/apt.conf.d/99-force-ipv4</code>. APT refuse alors d'utiliser IPv6 pour les téléchargements de paquets, même si l'hôte a une connectivité IPv6.",
+    "tipTitle": "Bénéficiaires",
+    "tipBody": "Utile si la connexion IPv6 est instable, plus lente qu’IPv4 ou si le miroir Debian/Proxmox échoue parfois en IPv6. Sans effet indésirable sur les hôtes sans IPv6. Sur un réseau double pile sain, le comportement devient prévisible : apt ne vous surprendra pas avec un délai d’attente IPv6 dépassé."
+  },
+  "sysctl": {
+    "heading": "Appliquer les optimisations réseau",
+    "intro": "Écrit un profil sysctl sélectionné dans <code>/etc/sysctl.d/99-network.conf</code> : tampons de sockets du noyau, durcissement ICMP, protection de base contre l’usurpation d’adresse et tailles de tampons TCP adaptées à un hyperviseur avec de nombreux flux simultanés.",
+    "tunedTitle": "Paramètres ajustés",
+    "headerArea": "Domaine",
+    "headerSettings": "Paramètres clés",
+    "rows": [
+      {
+        "area": "Tampons de sockets du noyau",
+        "settings": "<code>netdev_max_backlog=8192</code>, <code>rmem_max=16M</code>, <code>wmem_max=16M</code>, <code>somaxconn=8192</code>"
+      },
+      {
+        "area": "durcissement ICMP",
+        "settings": "<code>icmp_echo_ignore_broadcasts=1</code>, <code>icmp_ignore_bogus_error_responses=1</code>"
+      },
+      {
+        "area": "Sécurité du routage",
+        "settings": "<code>accept_redirects=0</code>, <code>accept_source_route=0</code>, <code>secure_redirects=0</code>, <code>send_redirects=0</code>, <code>log_martians=0</code>"
+      },
+      {
+        "area": "Filtre de chemin inversé",
+        "settings": "<code>rp_filter=2</code> (mode souple, voir la note ci-dessous)"
+      },
+      {
+        "area": "TCP",
+        "settings": "<code>tcp_mtu_probing=1</code>, <code>tcp_rfc1337=1</code>, <code>tcp_sack=1</code>, <code>tcp_rmem=8K/87K/16M</code>, <code>tcp_wmem=8K/64K/16M</code>"
+      },
+      {
+        "area": "Ports",
+        "settings": "<code>ip_local_port_range=1024 65535</code> (plage de ports éphémères)"
+      },
+      {
+        "area": "Sockets Unix",
+        "settings": "<code>net.unix.max_dgram_qlen=4096</code>"
+      }
+    ],
+    "sourceOutro": "Il ajoute également <code>source /etc/network/interfaces.d/*</code> à <code>/etc/network/interfaces</code> si ce n'est déjà présent — pratique standard pour que vous puissiez déposer des extraits d'interface modulaires sans modifier le fichier principal.",
+    "fwbrTitle": "Réglage automatique des ponts pare-feu virtuels",
+    "fwbrBody": "En plus du profil sysctl, ProxMenux installe le script auxiliaire <code>/usr/local/sbin/proxmenux-fwbr-tune</code>, qui applique <code>rp_filter=0</code> et <code>log_martians=0</code> aux interfaces <code>fwbr*</code> / <code>fwln*</code> / <code>fwpr*</code> / <code>tap*</code> créées par Proxmox pour les VM et conteneurs. L’unité à exécution unique <code>proxmenux-fwbr-tune.service</code> le lance au démarrage, et la règle <code>/etc/udev/rules.d/99-zz-proxmenux-fwbr-tune.rules</code> à chaque événement <code>net add</code> correspondant à ces préfixes. Cela couvre les interfaces recréées au démarrage ou à l’arrêt des VM, au redémarrage et à la migration à chaud. Le script traite aussi les interfaces existantes immédiatement après l’installation.",
+    "rpFilterTitle": "Pourquoi rp_filter=2 (souple) plutôt que 1 (strict)",
+    "rpFilterBody": "Le filtrage strict du chemin inverse rejette les paquets dont l’adresse source serait accessible par une interface <em>différente</em>. C’est une valeur par défaut adaptée aux clients, mais problématique sur un hôte Proxmox où le trafic VM arrive souvent par un pont et repart par une liaison montante avec des routes asymétriques. <code>rp_filter=2</code> (souple) ne rejette que les paquets dont la source est réellement injoignable par routage. Le compromis réduit légèrement la détection de l’usurpation d’IP locale pour préserver le réseau des VM."
+  },
+  "ovs": {
+    "heading": "Installer Open vSwitch",
+    "intro": "Installe <code>openvswitch-switch</code> + <code>openvswitch-common</code>. Ces paquets ajoutent OVS comme alternative aux ponts Linux utilisés par défaut par Proxmox. L’installation seule ne modifie pas le réseau : les ponts <code>vmbrX</code> existants continuent de fonctionner. Lorsque vous <em>créez</em> un nouveau pont dans Proxmox, OVS devient disponible dans la liste des types.",
+    "tipTitle": "Quand OVS a du sens",
+    "tipBody": "Envisagez OVS pour <strong>des trunks VLAN avec des ID non contigus</strong>, <strong>LACP avec LLDP dans certains modes</strong>, <strong>la programmation fine des flux</strong> (OpenFlow) ou l’interopérabilité avec les contrôleurs SDN. Pour un laboratoire domestique avec quelques VLAN et une seule liaison montante LACP, les ponts Linux + <code>vmbrX.VID</code> sont plus simples et tout à fait adaptés.",
+    "revertTitle": "Réversible depuis le menu Désinstaller",
+    "revertBody": "OVS est enregistré. <link>Désinstaller les optimisations</link> lance <code>apt purge</code> pour <code>openvswitch-switch</code> et <code>openvswitch-common</code>. Migrez les ponts OVS vers des ponts Linux <em>avant</em> la désinstallation, sinon leurs VM perdront le réseau au prochain démarrage. Équivalent manuel :"
+  },
+  "bbr": {
+    "heading": "Activer TCP BBR + TCP Fast Open",
+    "intro": "Écrit deux fichiers sysctl et les recharge. BBR remplace CUBIC par l’algorithme de congestion de Google fondé sur la bande passante, qui gère mieux les liaisons à forte capacité et latence ou avec pertes. TCP Fast Open (TFO) économise un aller-retour sur les connexions TCP répétées en envoyant des données dans le SYN.",
+    "verifyTitle": "Vérification",
+    "impactTitle": "L'impact dépend de la charge de travail",
+    "impactBody": "BBR brille sur des liaisons à haute latence ou à perte (réplication transcontinentale, tunnels VPN, clients mobiles). Sur un LAN entre deux machines sur le même commutateur, la différence est souvent dans le bruit. TFO aide les connexions courtes et répétées HTTP le plus.",
+    "revertTitle": "Réversible depuis le menu Désinstaller",
+    "revertBody": "BBR/TFO sont enregistrés. <link>Désinstaller les optimisations</link> supprime les deux fichiers sysctl (<code>/etc/sysctl.d/99-kernel-bbr.conf</code> et <code>99-tcp-fastopen.conf</code>) et recharge la configuration restante. Supprimer un fichier ne réinitialise pas ses valeurs actives dans le noyau. Les valeurs par défaut comme <code>cubic</code> et <code>tcp_fastopen=1</code> reviennent après un redémarrage, sauf si une autre configuration les remplace. Équivalent manuel :"
+  },
+  "names": {
+    "heading": "Noms d’interfaces persistants",
+    "intro": "Parcourt les cartes réseau physiques de l’hôte, en excluant loopback, les veth Docker, les ponts, les périphériques TAP, les bonds, Cilium, ZeroTier et WireGuard. Écrit un fichier systemd <code>.link</code> associant le nom actuel à l’adresse MAC actuelle. Cette association prend alors le pas sur le nommage automatique du noyau.",
+    "whyTitle": "Pourquoi cela est important",
+    "whyItems": [
+      "L'ajout ou la suppression de périphériques PCIe peut déplacer la numérotation du bus, transformer <code>enp3s0</code> en <code>enp4s0</code>. Si votre <code>/etc/network/interfaces</code> fait référence à l'ancien nom, le pont disparaît sur le redémarrage.",
+      "Les mises à jour du BIOS ou du firmware changent parfois l’énumération des périphériques, avec le même effet.",
+      "Le script écrit des fichiers <code>.link</code> pour les cartes physiques, y compris les ports des bonds, avec la MAC indiquée par sysfs à ce moment ; pour les ports d’un bond, il peut s’agir de la MAC partagée du bond, vérifiez donc leurs noms après un redémarrage. Il ignore les interfaces virtuelles, comme les veth LXC et les bonds eux-mêmes ; il ne corrige pas les courses au nommage des cartes virtuelles <code>hotplug</code>."
+    ],
+    "writtenTitle": "Ce qui est écrit",
+    "writtenIntro": "Un fichier par NIC physique, au <code>/etc/systemd/network/10-proxmenux-&lt;iface&gt;.link</code>. Chaque fichier commence par l'en-tête <code># Managed by ProxMenux — do not edit</code> de sorte que ProxMenux puisse distinguer ses propres fichiers des fichiers <code>.link</code> fournis par l'utilisateur ou le paquet.",
+    "writtenOutro": "Les fichiers <code>.link</code> d’autres paquets ou écrits par l’utilisateur sont conservés ; seuls ceux portant l’en-tête ProxMenux sont gérés. À chaque nouvelle exécution, la fonction vérifie ses fichiers : elle relit <code>MACAddress=</code> dans chaque <code>10-proxmenux-*.link</code> et supprime ceux dont la MAC n’apparaît plus sous <code>/sys/class/net/</code>. Les fichiers d’anciennes versions ProxMenux au format <code>10-&lt;iface&gt;.link</code> sont migrés automatiquement la première fois.",
+    "pveTitle": "PVE 9 vs PVE 8",
+    "pveBody": "Le script utilise des fichiers systemd <code>.link</code> pour les noms persistants. Sur Proxmox VE 9, il recharge aussi les règles udev après écriture afin qu’une carte déjà fixée qui est rebranchée ou redétectée applique sa règle sans redémarrage. Vérifiez les interfaces existantes après un redémarrage sur PVE 8 comme sur PVE 9. Cela ne remplace pas <code>ifupdown2</code> sur l’hôte. Le script demande un redémarrage dans les deux cas via la post-installation personnalisable.",
+    "reviewTitle": "Examiner d'abord les /etc/network/interfaces existants",
+    "reviewBody": "Si l’ancienne configuration dans <code>/etc/network/interfaces</code> utilise des noms de cartes générés par le noyau, fixer les noms <em>actuels</em> est le résultat souhaité. Si vous avez déjà adapté la configuration à des noms précis, vérifiez soigneusement que les noms fixés correspondent au fichier interfaces avant de redémarrer.",
+    "revertTitle": "Réversible depuis le menu Désinstaller",
+    "revertBody": "<link>Désinstaller les optimisations</link> supprime uniquement les fichiers <code>10-proxmenux-*.link</code> portant l’en-tête ProxMenux dans <code>/etc/systemd/network/</code>. Les fichiers <code>.link</code> de l’utilisateur ou d’autres paquets sont conservés. Le nommage par défaut de systemd revient au prochain redémarrage."
+  },
+  "related": {
+    "heading": "Voir aussi",
+    "items": [
+      {
+        "label": "Gestion du réseau",
+        "href": "/docs/network",
+        "tail": "— diagnostic, analyse des ponts, réparations guidées."
+      },
+      {
+        "label": "Noms d'interface persistants",
+        "href": "/docs/network/persistent-names",
+        "tail": " — la même fonction dans un menu distinct pour plus tard ; utilisez l’une ou l’autre option, pas les deux."
+      },
+      {
+        "label": "Référence des commandes réseau",
+        "href": "/docs/help-info/network-commands",
+        "tail": " — ip, ss, ethtool, sysctl."
+      },
+      {
+        "label": "Désinstaller les optimisations",
+        "href": "/docs/post-install/uninstall",
+        "tail": " — annuler ces changements réseau."
+      },
+      {
+        "label": "Post-installation personnalisable",
+        "href": "/docs/post-install/customizable",
+        "tail": "— retour au menu parent."
+      }
+    ]
+  }
+}
diff --git a/web/messages/fr/docs/post-install/optional.json b/web/messages/fr/docs/post-install/optional.json
new file mode 100644
index 00000000..c4f06e38
--- /dev/null
+++ b/web/messages/fr/docs/post-install/optional.json
@@ -0,0 +1,177 @@
+{
+  "meta": {
+    "title": "ProxMenux Post-Installation: Paramètres optionnels",
+    "description": "Guide des paramètres optionnels dans le script ProxMenux post-installation pour les fonctionnalités et optimisations supplémentaires de Proxmox VE.",
+    "ogTitle": "ProxMenux Post-Installation: Paramètres optionnels",
+    "ogDescription": "Guide des paramètres optionnels dans le script ProxMenux post-installation pour les fonctionnalités et optimisations supplémentaires de Proxmox VE.",
+    "ogImageAlt": "Paramètres optionnels après l'installation de ProxMenux"
+  },
+  "title": "Paramètres optionnels",
+  "intro": "La catégorie <strong>Paramètres optionnels</strong> fournit des fonctions et optimisations supplémentaires à appliquer à Proxmox VE. Elles ne sont pas essentielles, mais peuvent améliorer les possibilités du système dans certains cas.",
+  "available": "Fonctions optionnelles disponibles",
+  "stepLabel": "Étape",
+  "ceph": {
+    "title": "Ajouter le dernier support Ceph",
+    "intro": "Cette option installe la dernière prise en charge du système de stockage Ceph pour Proxmox VE. Ceph est un système de stockage distribué qui offre des performances élevées, la fiabilité et l'évolutivité.",
+    "doesIntro": "Ce qu'il fait:",
+    "doesItems": [
+      "Ajoute le dépôt Ceph à votre système",
+      "Mise à jour des listes de paquets",
+      "Installe les paquets Ceph en utilisant la commande 'pveceph install'",
+      "Vérification de l'installation"
+    ],
+    "howUse": "Comment utiliser : Après l'installation, vous pouvez configurer et gérer le stockage Ceph en utilisant l'interface web ou les outils en ligne de commande Proxmox VE.",
+    "automates": "Ce réglage automatise les commandes suivantes :"
+  },
+  "amd": {
+    "title": "Appliquer les correctifs AMD CPU",
+    "intro": "Cette option applique des corrections spécifiques pour les processeurs AMD EPYC et Ryzen pour améliorer la stabilité et la compatibilité.",
+    "doesIntro": "Ce qu'il fait:",
+    "doesItems": [
+      "Détecte si un AMD EPYC ou Ryzen CPU est présent",
+      "Applique le paramètre du noyau idle=nomwait pour prévenir les plantages aléatoires (via /etc/kernel/cmdline sur les hôtes systemd-boot ou /etc/default/grub sur les hôtes GRUB, avec une copie .bak de l’original).",
+      "Configure KVM pour ignorer certains MSR (Registres spécifiques au modèle) pour une meilleure compatibilité des clients Windows"
+    ],
+    "howUse": "Comment utiliser: Ces corrections sont appliquées automatiquement et nécessitent un redémarrage du système pour prendre effet.",
+    "automates": "Ce réglage automatise les commandes suivantes :"
+  },
+  "ha": {
+    "title": "Activer les services à haute disponibilité",
+    "intro": "Cette option active les services de haute disponibilité (HA) de Proxmox VE, permettant la reprise automatique des VM et conteneurs sur un autre nœud en cas de panne.",
+    "doesIntro": "Ce qu'il fait:",
+    "doesItems": [
+      "Active et démarre le service pve-ha-lrm (gestionnaire des ressources locales)",
+      "Active et démarre le service pve-ha-crm (Gestionnaire des ressources de la grappe)",
+      "Active et démarre le service Corosync pour la communication cluster"
+    ],
+    "howUse": "Comment utiliser: Après avoir activé ces services, vous pouvez configurer des groupes et des ressources HA dans l'interface web Proxmox VE.",
+    "automates": "Ce réglage automatise les commandes suivantes :"
+  },
+  "pveam": {
+    "title": "Mettre à jour le gestionnaire d'appliances Proxmox VE",
+    "intro": "Actualise l’index local des modèles de conteneurs exposé par <code>pveam</code> dans Proxmox, afin que les appliances logicielles disponibles soient à jour à la prochaine création d’un LXC.",
+    "doesIntro": "Ce qu'il fait:",
+    "doesItems": [
+      "Exécute <code>pveam update</code> sur les miroirs Proxmox pour récupérer le catalogue actuel des appliances logicielles",
+      "Remplit la liste des appliances logicielles affichée lors de la création d’un conteneur"
+    ],
+    "howUse": "Utilisation : exécutez-le si la liste des appliances logicielles semble ancienne ou après un changement de miroir. Il télécharge uniquement l’index du catalogue, pas les modèles eux-mêmes.",
+    "automates": "Ce réglage automatise la commande suivante :"
+  },
+  "fastfetch": {
+    "title": "Installer et configurer Fastfetch",
+    "intro": "Cette option installe et configure en silence Fastfetch, un outil d'information système qui affiche les spécifications du système et un logo personnalisé lors de la connexion.",
+    "doesLabel": "Ce qu'il fait:",
+    "doesItems": [
+      "Télécharge et installe silencieusement la dernière version de Fastfetch",
+      "Vous permet de choisir un logo personnalisé (<strong>ProxMenux, Proxmox, Helper-Scripts, Home-Labs-Club, Proxmology</strong>, ou un logo personnalisé)",
+      "Configure Fastfetch pour afficher <em>\"Système optimisé par ProxMenux\"</em>",
+      "Configure Fastfetch pour fonctionner automatiquement à la connexion de la console"
+    ],
+    "importantLabel": "Important:",
+    "importantBody": "Si vous vous connectez à Proxmox via SSH, sélectionnez le logo <strong>Proxmox</strong> ou créez un logo personnalisé en utilisant <code>jp2a</code> ou <code>img2txt</code>. Les autres logos sont générés en utilisant <code>chafa</code> et peuvent ne pas s'afficher correctement dans une session standard SSH.",
+    "customLabel": "Logos personnalisés :",
+    "customBody1": "Pour utiliser un logo personnalisé, placez votre fichier texte art ASCII dans : <code>/usr/local/share/fastfetch/logos/</code>",
+    "customBody2": "Vous pouvez créer des logos personnalisés en utilisant des outils tels que <code>chafa</code>, <code>jp2a</code> ou <code>img2txt</code>.",
+    "customBody3": "Pour de meilleurs résultats:",
+    "customItems": [
+      "Limitez la hauteur du logo à 35 lignes pour conserver les proportions et tenir dans le terminal",
+      "Utilisez <code>chafa</code> pour les logos couleur (peut ne pas s'afficher correctement dans les sessions SSH)",
+      "Utiliser <code>jp2a</code> ou <code>img2txt</code> pour les logos compatibles SSH"
+    ],
+    "examplesLabel": "Exemple de logos :",
+    "logos": [
+      {
+        "name": "ProxMenux",
+        "alt": "Logo ProxMenux",
+        "src": "https://macrimi.github.io/ProxMenux/fastfetch/proxmenux.png"
+      },
+      {
+        "name": "Proxmox",
+        "alt": "Logo Proxmox",
+        "src": "https://macrimi.github.io/ProxMenux/fastfetch/proxmox.png"
+      },
+      {
+        "name": "JC Channel",
+        "alt": "Logo JC Channel",
+        "src": "/fastfetch/jc-channel.png"
+      },
+      {
+        "name": "Helper-Scripts",
+        "alt": "Logo Helper-Scripts",
+        "src": "https://macrimi.github.io/ProxMenux/fastfetch/helper-scripts.png"
+      },
+      {
+        "name": "Home-Labs-Club",
+        "alt": "Logo Home-Labs-Club",
+        "src": "https://macrimi.github.io/ProxMenux/fastfetch/home-labs-club.png"
+      },
+      {
+        "name": "Proxmology",
+        "alt": "Logo Proxmology",
+        "src": "https://macrimi.github.io/ProxMenux/fastfetch/proxmology.png"
+      }
+    ],
+    "automates": "Ce réglage automatise les commandes suivantes :"
+  },
+  "figurine": {
+    "title": "Installer et configurer Figurine",
+    "intro": "Cette option installe et configure Figurine, un outil qui crée des bannières texte ASCII élégantes pour votre terminal, affichant votre nom d'hôte dans un format 3D attrayant visuellement.",
+    "doesLabel": "Ce qu'il fait:",
+    "doesItems": [
+      "Télécharge et installe Figurine v2.1.1 depuis GitHub pour l’architecture de l’hôte (AMD64, ARM64 ou ARMv7)",
+      "Crée un message de bienvenue qui affiche votre nom d'hôte dans l'art 3D ASCII lorsque vous vous connectez",
+      "Met à jour le binaire Figurine existant une fois le téléchargement et l’extraction terminés avec succès",
+      "Configure le message de bienvenue à exécuter automatiquement à la connexion"
+    ],
+    "practicalLabel": "Utilisation pratique:",
+    "practicalBody": "Lors de la gestion de plusieurs nœuds Proxmox dans un cluster, Figurine fournit une indication visuelle immédiate du noeud dans lequel vous êtes actuellement connecté. Cela permet d'éviter les commandes accidentelles sur le mauvais noeud et améliore votre workflow lors de la gestion de plusieurs serveurs.",
+    "exampleLabel": "Exemple de sortie :",
+    "imageAlt": "Figurine Exemple de sortie",
+    "automates": "Ce réglage automatise le processus suivant :",
+    "outro": "Après l'installation, vous verrez votre nom d'hôte affiché dans l'art 3D ASCII chaque fois que vous vous connectez, rendant immédiatement clair sur quel noeud Proxmox vous travaillez."
+  },
+  "log2ram": {
+    "title": "Installer Log2RAM (SSD/NVMe réduction de l'usure)",
+    "intro": "Log2RAM monte <code>/var/log</code> sur un disque RAM tmpfs et le synchronise régulièrement vers le disque. Mettre en mémoire les écritures journald fréquentes peut réduire l’usure SSD et les E/S. La synchronisation et un arrêt propre sauvegardent les journaux ; une coupure brutale peut perdre les entrées depuis la dernière synchronisation.",
+    "upstreamLabel": "Projet en amont:",
+    "upstreamUrl": "https://github.com/azlux/log2ram",
+    "upstreamLinkLabel": "azlux/log2ram sur GitHub",
+    "doesLabel": "Que fait ProxMenux:",
+    "doesItems": [
+      "Détecte si le disque racine est SSD/NVMe en lisant <code>/sys/block/&lt;dev&gt;/queue/rotational</code>. Sur un disque rotatif, le flux automatisé demande d'abord avant d'installer.",
+      "Clone le dépôt original (<code>azlux/log2ram</code>) dans <code>/tmp/log2ram</code> et modifie <code>install.sh</code> en remplaçant <code>rsync -aAXv</code> par <code>rsync -aXv --no-acls</code>. Cela évite l’erreur <em>set_acl: Operation not supported</em> avec code de sortie 23, déclenchée par le script original lors du déplacement de /var/log sur un système sans ACL. L’unité systemd <code>log2ram</code> est activée après installation.",
+      "Dimensionne le disque RAM selon la mémoire de l’hôte : <code>≤ 8 GB → 128M</code>, <code>≤ 16 GB → 256M</code>, <code>&gt; 16 GB → 512M</code>. Écrit la valeur dans <code>SIZE=</code> de <code>/etc/log2ram.conf</code>.",
+      "Planifie une synchronisation périodique du disque via <code>/etc/cron.d/log2ram</code> : toutes les 1h / 3h / 6h selon le même niveau RAM.",
+      "Installe <code>/usr/local/bin/log2ram-check.sh</code>, lancé toutes les 10 minutes par <code>/etc/cron.d/log2ram-auto-sync</code>. Quand <code>/var/log</code> atteint 80% du disque RAM, il purge les anciens journaux journald. À 92%, il lance d’abord <code>logrotate -f /etc/logrotate.d/proxmox-backup-api</code> si le fichier existe : les journaux API PBS occupent souvent le plus d’espace sur un hôte PBS. Il tronque ensuite <code>pveproxy access/error</code> et <code>pveam.log</code> avant synchronisation. <code>log2ram write</code> seul copie tmpfs sur disque sans le réduire. Cette protection aide à éviter un arrêt de PVE avec <em>No space left on device</em> lorsque les journaux grossissent sans contrôle.",
+      "Détecte le service <code>proxmox-backup-server</code> sur l’hôte. S’il est présent, crée <code>/etc/logrotate.d/proxmox-backup-api</code> (20 Mo × 3 rotations) et <code>/etc/cron.hourly/proxmox-backup-logrotate</code> pour limiter les journaux API PBS, souvent à l’origine de la croissance, même entre les synchronisations Log2RAM. Sans PBS, cette étape ne change rien.",
+      "Ajuste les limites systemd-journald (<code>SystemMaxUse</code>, <code>RuntimeMaxUse</code>) pour qu'elles s'adaptent au disque virtuel afin qu'une seule rafale ne puisse pas le remplir.",
+      "S’enregistre dans <code>installed_tools.json</code> pour pouvoir être annulé via Désinstaller les optimisations."
+    ],
+    "howUseLabel": "Comment utiliser:",
+    "howUseBody": "Le parcours automatisé installe Log2RAM sans intervention si le disque racine est SSD/NVMe. Le parcours personnalisable demande taille, intervalle et activation de la protection. L’invite indique actuellement 90%, mais le script généré utilise les seuils de nettoyage à 80% et intensif à 92% décrits plus haut.",
+    "verifyLabel": "Vérifier et gérer à partir du shell:",
+    "verifyCode": "# Service state and configured timers\nsystemctl status log2ram\nsystemctl list-timers log2ram*\n\n# Current ramdisk usage — /var/log IS the tmpfs itself\ndf -h /var/log\n\n# Force a sync now (tmpfs → disk); does NOT shrink the tmpfs\nlog2ram write\n\n# Trigger the auto-sync guard on demand (vacuum + sync when usage is high)\n/usr/local/bin/log2ram-check.sh\n\n# Current config: SIZE, mail settings, path\ncat /etc/log2ram.conf\n\n# ProxMenux-specific cron jobs\ncat /etc/cron.d/log2ram /etc/cron.d/log2ram-auto-sync\n\n# Recent Log2RAM activity\njournalctl -u log2ram -n 50 --no-pager"
+  },
+  "zram": {
+    "title": "Activer le profil d'échange ZRAM",
+    "intro": "Crée un périphérique swap compressé en RAM, <code>/dev/zram0</code>, avec <code>systemd-zram-generator</code>. Les pages déplacées vers le swap sont compressées par zstd et conservées en mémoire avant l’utilisation du swap sur disque.",
+    "doesLabel": "Ce qu'il fait:",
+    "doesItems": [
+      "Installe <code>systemd-zram-generator</code> s'il manque, et enregistre si ProxMenux l'a installé.",
+      "Écrit <code>/etc/systemd/zram-generator.conf.d/90-proxmenux.conf</code> : un périphérique <code>zram0</code> d’un dixième de la RAM de l’hôte, compression zstd (<code>zstd(level=9)</code> avec systemd-zram-generator 1.2.0 ou ultérieur) et priorité swap 32767.",
+      "Avec cette priorité, le noyau remplit d'abord ZRAM. Un swap existant sur disque conserve sa propre priorité et prend les pages qui ne correspondent plus à ZRAM.",
+      "Avant de changer quoi que ce soit, recherche une autre configuration ZRAM: un swap zram actif, une ligne zram dans <code>/etc/fstab</code>, une unité systemd ou un autre fichier générateur. Si elle en trouve un, l'option s'arrête et laisse cette configuration telle qu'elle est.",
+      "Démarre <code>dev-zram0.swap</code> et vérifie que l'appareil actif correspond au profil. Sinon, l'état précédent est rétabli.",
+      "S’enregistre dans <code>installed_tools.json</code> pour pouvoir être annulé via Désinstaller les optimisations."
+    ],
+    "howUseLabel": "Comment utiliser:",
+    "howUseBody": "Cette option appartient uniquement au parcours personnalisable ; le parcours automatisé ne l’applique pas. Le périphérique est recréé à chaque démarrage. Lorsqu’il est actif, le panneau Mémoire de ProxMenux Monitor affiche capacité, swap utilisé, algorithme, taux de compression et mémoire physique occupée.",
+    "verifyLabel": "Vérifier depuis le shell :",
+    "verifyCode": "# Active swap devices and their priority\nswapon --show\n\n# ZRAM device: algorithm, size and compressed data\nzramctl\n\n# Profile written by ProxMenux\ncat /etc/systemd/zram-generator.conf.d/90-proxmenux.conf\n\n# State of the swap unit\nsystemctl status dev-zram0.swap"
+  },
+  "autoApplication": {
+    "title": "Application automatique",
+    "body": "Dans le parcours personnalisable, choisissez les fonctions selon vos besoins. Log2RAM appartient aussi au parcours automatisé avec détection matérielle ; ZRAM reste réservé au personnalisable. Consultez chaque section pour les confirmations et prérequis."
+  }
+}
diff --git a/web/messages/fr/docs/post-install/performance.json b/web/messages/fr/docs/post-install/performance.json
new file mode 100644
index 00000000..29f96090
--- /dev/null
+++ b/web/messages/fr/docs/post-install/performance.json
@@ -0,0 +1,61 @@
+{
+  "meta": {
+    "title": "Post-installation : Performances | Documentation ProxMenux",
+    "description": "Options de performance du script post-installation personnalisable de ProxMenux. Remplace gzip à un seul thread par pigz (gzip parallèle) pour accélérer les sauvegardes et la compression sur les hôtes multicœurs."
+  },
+  "header": {
+    "title": "Après installation : performances",
+    "description": "Options de performance du script post-installation personnalisable. Cette catégorie contient une seule optimisation : remplacer gzip par pigz pour que les sauvegardes et la compression utilisent tous les cœurs du processeur au lieu d’un seul.",
+    "section": "Paramètres post-installation de Proxmox"
+  },
+  "intro": {
+    "title": "Ce que cette catégorie couvre",
+    "body": "La seule option de performance ici redirige gzip vers une implémentation parallèle. Les autres réglages de performance (mémoire, ordonnancement des E/S, taille de l’ARC ZFS, limites du noyau) se trouvent dans leurs catégories (<em>Système</em>, <em>Stockage</em>), car ils concernent d’autres sous-systèmes."
+  },
+  "pigz": {
+    "heading": "Utilisez pigz pour une compression gzip plus rapide",
+    "intro": "<code>gzip</code> standard compresse avec <strong>un seul cœur de processeur</strong>. Sur les hôtes Proxmox modernes à 8, 16 ou 32 cœurs, cela limite fortement les sauvegardes VM/CT avec <code>vzdump</code>, la rotation des journaux et tout ce qui passe par <code>gzip</code>. <a>pigz</a> est un remplacement parallèle directement compatible : même sortie compatible gzip, mais travail réparti sur tous les cœurs.",
+    "doesTitle": "Ce que fait ProxMenux",
+    "doesIntro": "Cinq étapes, toutes idempotentes :",
+    "doesItems": [
+      "Définit <code>pigz: 1</code> dans <code>/etc/vzdump.conf</code> pour que l’outil de sauvegarde Proxmox utilise pigz nativement.",
+      "Installe le paquet apt <code>pigz</code> s’il est absent.",
+      "Écrit un script wrapper dans <code>/bin/pigzwrapper</code> qui transmet tous les arguments à <code>/usr/bin/pigz</code>.",
+      "Enregistre un détournement dpkg du binaire système <code>gzip</code> (<code>/usr/bin/gzip</code> sur Proxmox VE 9, <code>/bin/gzip</code> sur Proxmox VE 8). Le binaire original est conservé à côté sous <code>gzip.distrib</code> et le wrapper prend sa place. Désormais, <em>tout</em> ce qui appelle <code>gzip</code> — logrotate, <code>tar czf</code>, scripts, vzdump — utilise pigz de façon transparente.",
+      "Vérifie que le fichier conservé sous <code>gzip.distrib</code> est un gzip fonctionnel avant de placer le wrapper ; sinon, réinstalle d’abord le paquet <code>gzip</code>. Un hôte utilisant encore l’ancien remplacement <code>/bin/gzip.original</code> passe au détournement lors de la prochaine application."
+    ],
+    "replacesTitle": "Cela remplace un binaire système",
+    "replacesBody": "Placer un wrapper à la place de <code>gzip</code> est inhabituel. C’est sûr, car il produit une sortie compatible gzip, mais les scripts à chemins codés en dur, exécutés dans des chroots restrictifs ou vérifiant les empreintes des binaires peuvent se comporter différemment. Le binaire original reste sous <code>gzip.distrib</code>. Grâce au détournement dpkg, une mise à jour du paquet <code>gzip</code> ou le passage de Proxmox VE 8 à 9 met à jour ce fichier et laisse le wrapper en place.",
+    "revertTitle": "Réversible depuis le menu Désinstaller",
+    "revertBody": "Cette optimisation est suivie. <link>Désinstaller les optimisations</link> remet le binaire original de <code>gzip.distrib</code> à la place du wrapper, supprime le détournement et <code>pigzwrapper</code>, commente la ligne <code>pigz</code> dans <code>/etc/vzdump.conf</code>, puis exécute <code>apt purge pigz</code> après vérification du fonctionnement de gzip. Équivalent manuel sur Proxmox VE 9 :",
+    "verifyTitle": "Vérification",
+    "verifyBody": "Après application, <code>gzip --version</code> doit mentionner pigz. Un test rapide montre aussi la différence de vitesse sur un hôte multicœur :",
+    "whenTitle": "Quand cela importe le plus",
+    "whenBody": "Le gain dépend du <strong>nombre de cœurs de l’hôte</strong> et de la <strong>fréquence des sauvegardes</strong>. Sur un serveur de laboratoire domestique à 2 cœurs avec un vzdump quotidien, le gain est faible. Sur un hôte de production à 16 cœurs sauvegardant une douzaine de VM chaque nuit, pigz peut réduire la fenêtre de sauvegarde à une fraction du temps de gzip à un seul thread."
+  },
+  "related": {
+    "heading": "Voir aussi",
+    "items": [
+      {
+        "label": "Commandes de sauvegarde et de restauration",
+        "href": "/docs/help-info/backup-commands",
+        "tailRich": " — référence CLI de vzdump, dont l’option de nombre de threads <code>--pigz</code>."
+      },
+      {
+        "label": "Stockage",
+        "href": "/docs/post-install/storage",
+        "tail": "— limites de vitesse vzdump et réglage ARC ZFS."
+      },
+      {
+        "label": "Système",
+        "href": "/docs/post-install/system",
+        "tail": "— descripteur de fichiers et réglage de mémoire."
+      },
+      {
+        "label": "Post-installation personnalisable",
+        "href": "/docs/post-install/customizable",
+        "tail": "— retour au menu parent."
+      }
+    ]
+  }
+}
diff --git a/web/messages/fr/docs/post-install/security.json b/web/messages/fr/docs/post-install/security.json
new file mode 100644
index 00000000..9953d1d8
--- /dev/null
+++ b/web/messages/fr/docs/post-install/security.json
@@ -0,0 +1,57 @@
+{
+  "meta": {
+    "title": "Post-installation : Sécurité | Documentation ProxMenux",
+    "description": "Options de sécurité disponibles dans le script de post-installation personnalisable ProxMenux. Actuellement une seule option : désactiver le service portmapper/rpcbind pour réduire la surface d'attaque de l'hôte."
+  },
+  "header": {
+    "title": "Post-Installation: Sécurité",
+    "section": "Paramètres post-installation de Proxmox"
+  },
+  "intro": {
+    "title": "Ce que cette catégorie couvre",
+    "body": "La sécurité post-installation se limite au <strong>renforcement de l’hôte applicable sans surveillance en toute sécurité</strong> : désactiver des services rarement nécessaires et pouvoir l’annuler dans Désinstaller. Les outils actifs (Fail2Ban pour prévenir les intrusions, Lynis pour les audits) se trouvent dans <em>Sécurité</em> du menu principal de ProxMenux, hors de la post-installation."
+  },
+  "rpcbind": {
+    "heading": "Désactiver le portmapper / rpcbind",
+    "intro": "<code>rpcbind</code> (anciennement <code>portmap</code>) associe les numéros de programmes RPC aux ports réseau. NFS et certains anciens outils RPC en dépendent. Sur un hôte Proxmox typique qui ne sert pas de serveur NFS, <strong>rien ne l’utilise</strong> ; le laisser actif maintient le port <code>111/tcp</code> en écoute sur toutes les interfaces.",
+    "whyTitle": "Pourquoi ça vaut la peine d'être désactivé",
+    "whyItems": [
+      "Réduit la surface d'attaque de l'hôte — un service d'écoute de moins pour s'inquiéter.",
+      "Historiquement utilisé comme vecteur de réflexion/amplification dans les attaques DDoS. Désactiver <code>rpcbind</code> supprime ce facteur d'amplification pour votre hôte.",
+      "Supprime le bruit qu’il génère dans les journaux et les sorties de <code>netstat</code> / <code>ss</code>, pour repérer plus facilement l’activité réelle."
+    ],
+    "nfsTitle": "Ne pas désactiver cela si vous utilisez NFS",
+    "nfsBody": "Le serveur NFS <strong>et</strong> le client NFS utilisent <code>rpcbind</code> pour négocier les ports de <code>mountd</code>, <code>statd</code>, <code>lockd</code>, etc. N’appliquez pas cette option si l’hôte Proxmox <em>exporte</em> des partages NFS vers d’autres machines ou <em>monte</em> des partages NFS d’un NAS. Les montages échoueront avec <code>mount.nfs: rpc.statd is not running</code> ou une erreur similaire.",
+    "runsTitle": "Ce que ProxMenux exécute",
+    "runsOutro": "Le paquet reste installé. ProxMenux enregistre les états d’activation et d’exécution d’origine de rpcbind.service et rpcbind.socket, puis désactive et arrête les deux unités pour empêcher la réactivation du service par le socket.",
+    "verifyTitle": "Vérification",
+    "verifyBody": "Après application, vérifiez que <code>rpcbind</code> est arrêté et que rien n’écoute sur le port 111 :",
+    "reversibleTitle": "Restaurer l'état de service original",
+    "reversibleBody": "Cette modification est enregistrée dans <code>installed_tools.json</code>. <link>Désinstaller les optimisations</link> restaure chaque unité rpcbind à ses états d’activation et d’exécution relevés avant la modification par ProxMenux. L’outil ne suppose pas que rpcbind était activé sur tous les hôtes."
+  },
+  "related": {
+    "heading": "Voir aussi",
+    "items": [
+      {
+        "label": "Menu de sécurité",
+        "href": "/docs/security",
+        "tail": " — des outils plus poussés : Fail2Ban (prévention des intrusions) et Lynis (audit)."
+      },
+      {
+        "label": "Lynis",
+        "href": "/docs/security/lynis",
+        "tail": " — pour auditer l’hôte et trouver d’autres possibilités de renforcer la sécurité."
+      },
+      {
+        "label": "Commandes système utiles",
+        "href": "/docs/help-info/system-commands",
+        "tail": "— état de service, journalctl, référence d'audit lynis."
+      },
+      {
+        "label": "Post-installation personnalisable",
+        "href": "/docs/post-install/customizable",
+        "tail": "— retour au menu parent."
+      }
+    ]
+  }
+}
diff --git a/web/messages/fr/docs/post-install/storage.json b/web/messages/fr/docs/post-install/storage.json
new file mode 100644
index 00000000..fece9c00
--- /dev/null
+++ b/web/messages/fr/docs/post-install/storage.json
@@ -0,0 +1,167 @@
+{
+  "meta": {
+    "title": "Post-Installation: Stockage - Documentation ProxMenux",
+    "description": "Optimisations de stockage du script de post-installation personnalisable ProxMenux : taille ZFS ARC selon la RAM de l’hôte, instantanés périodiques avec zfs-auto-snapshot et suppression des limites de vitesse des sauvegardes vzdump."
+  },
+  "header": {
+    "title": "Post-Installation: Stockage",
+    "section": "Paramètres post-installation de Proxmox"
+  },
+  "intro": {
+    "title": "Ce que cette catégorie couvre",
+    "body": "Quatre optimisations de stockage : régler <strong>ZFS ARC</strong> sur une part raisonnable de la RAM, installer et programmer <strong>les instantanés ZFS automatiques</strong>, activer <strong>ZFS autotrim</strong> sur les pools SSD/NVMe et retirer les limitations de <strong>vzdump</strong> pour accélérer les sauvegardes. Choisissez chaque option indépendante selon votre configuration. Une cinquième option, <link>Log2RAM</link>, réduit l’usure SSD/NVMe en déplaçant <code>/var/log</code> en RAM. Elle figure dans Options car le menu personnalisable la classe ainsi."
+  },
+  "trackedTitle": "Les quatre sont suivis dans le menu Désinstaller",
+  "trackedBody": "Chaque option s’enregistre dans <code>installed_tools.json</code> pour <link>Désinstaller les optimisations</link>. <code>zfs_arc</code> supprime <code>/etc/modprobe.d/99-zfsarc.conf</code> et reconstruit initramfs ; <code>zfs_auto_snapshot</code> annule le calendrier cron et propose de purger le paquet ; <code>zfs_autotrim</code> définit <code>autotrim=off</code> sur les pools activés ; <code>vzdump_speed</code> restaure <code>/etc/vzdump.conf</code> depuis le <code>.bak</code> créé à l’installation.",
+  "arc": {
+    "heading": "Optimiser la taille de ZFS ARC",
+    "intro": "Le <strong>Adaptive Replacement Cache (ARC)</strong> est le cache de lecture ZFS en mémoire. Les installations Proxmox VE depuis 8.1 fixent 10% de RAM, au maximum 16 GiB ; les hôtes anciens ou mis à niveau peuvent différer. Cette option écrit explicitement cette même règle (RAM/10, au maximum 16 GiB, au minimum 64 MiB) dans son propre fichier, ce qui couvre aussi les hôtes anciens ou mis à niveau. Vérifiez les réglages et la charge : un cache plus petit n’est pas toujours plus rapide.",
+    "sizingTitle": "Règles de calibrage",
+    "headerRam": "RAM de l'hôte",
+    "headerMax": "Plafond ARC",
+    "rows": [
+      {
+        "ram": "Formule",
+        "max": "RAM / 10, plafonné à 16 GiB, avec un plancher 64 MiB"
+      },
+      {
+        "ram": "Hôte 8 GB",
+        "max": "≈ 819 MiB (RAM/10)"
+      },
+      {
+        "ram": "Hôte 16 GB",
+        "max": "≈ 1.6 GiB (RAM/10)"
+      },
+      {
+        "ram": "Hôte 64 GB",
+        "max": "≈ 6.4 GiB (RAM/10)"
+      },
+      {
+        "ram": "≥ 160 GB hôte",
+        "max": "16 GiB (plafond)"
+      }
+    ],
+    "after": "Le fichier <code>/etc/modprobe.d/99-zfsarc.conf</code> contient uniquement <code>options zfs zfs_arc_max=…</code>. Les autres paramètres ZFS (<code>zfs_arc_min</code>, prélecture/limitation des écritures L2ARC, délai TXG) ne sont pas ajustés. Au préalable, une vérification recherche les autres <code>*.conf</code> de <code>/etc/modprobe.d/</code> définissant <code>zfs_arc_min</code> / <code>zfs_arc_max</code>, les sauvegarde avec manifeste dans <code>/usr/local/share/proxmenux/backups/zfs_arc/</code> et en retire les valeurs <code>zfs_arc_min</code> / <code>zfs_arc_max</code> conflictuelles (les autres options de ces lignes sont conservées), pour que seul le fichier ARC ProxMenux fixe la limite. Puis <code>update-initramfs -u -k all</code> et, si nécessaire, <code>proxmox-boot-tool refresh</code> intègrent la limite à l’initramfs des systèmes avec racine ZFS.",
+    "rebootTitle": "Nécessite un redémarrage pour prendre effet",
+    "rebootBody": "Les réglages ARC sont lus au chargement du module <code>zfs</code>. Pour les hôtes avec racine ZFS, ProxMenux régénère initramfs avec <code>update-initramfs -u -k all</code> et actualise si nécessaire le chargeur avec <code>proxmox-boot-tool refresh</code>. Le nouveau paramètre exige toujours un redémarrage, signalé automatiquement.",
+    "safeTitle": "Sans effet indésirable sur les hôtes sans ZFS",
+    "safeBody": "La fonction n’écrit la configuration que si <code>zpool list</code> signale au moins un pool ZFS importé. Sur un hôte Proxmox ext4/LVM uniquement, ou avec outils ZFS mais sans pool importé, cocher cette option ne fait rien : aucun fichier n’est écrit.",
+    "verifyTitle": "Vérification et retour arrière manuel"
+  },
+  "autoSnap": {
+    "heading": "Installer l'instantané automatique ZFS",
+    "intro": "Installe le paquet <a>zfs-auto-snapshot</a> et réécrit ses horaires cron afin que les instantanés soient pris automatiquement à plusieurs intervalles. Un grand filet de sécurité sans effort en plus de vos sauvegardes Vzdump régulières.",
+    "cadenceTitle": "Fréquence des instantanés configurée par ProxMenux",
+    "headerLabel": "Étiquette",
+    "headerRuns": "Exécution",
+    "headerKept": "Captures instantanées conservées",
+    "rows": [
+      {
+        "label": "fréquent",
+        "runs": "chaque 15 min",
+        "kept": "4"
+      },
+      {
+        "label": "horaire",
+        "runs": "toutes les heures",
+        "kept": "1"
+      },
+      {
+        "label": "quotidiennement",
+        "runs": "une fois par jour",
+        "kept": "1"
+      },
+      {
+        "label": "hebdomadaire",
+        "runs": "une fois par semaine",
+        "kept": "1"
+      },
+      {
+        "label": "mensuel",
+        "runs": "une fois par mois",
+        "kept": "1"
+      }
+    ],
+    "conservativeTitle": "Rétention limitée",
+    "conservativeBody": "ProxMenux est livré avec une rétention prudente (juste 4 fréquent + 1 de chaque intervalle plus long) de sorte que le stockage des instantanés ZFS ne ballonne pas. Si vous souhaitez une conservation plus longue, modifiez les numéros dans <code>/etc/cron.d/zfs-auto-snapshot</code>, <code>/etc/cron.hourly/zfs-auto-snapshot</code>, etc. après le script.",
+    "onlyZfsTitle": "Utile uniquement sur les pools ZFS",
+    "onlyZfsBody": "Installer le paquet sur un hôte ext4 seulement est inoffensif mais inutile — il n'y a pas d'ensembles de données ZFS pour qu'il snapshot. Passez cette option si vous n'utilisez pas ZFS.",
+    "verifyTitle": "Vérification et retour arrière manuel"
+  },
+  "autotrim": {
+    "heading": "Activer ZFS autotrim (pools SSD/NVMe)",
+    "intro": "Active <code>autotrim</code> sur les pools ZFS composés uniquement de SSD ou NVMe compatibles TRIM. Le script ignore par précaution les pools avec un disque rotatif. Les pools déjà en <code>autotrim=on</code> restent inchangés.",
+    "trimTitle": "Ce que TRIM fait, et pourquoi il importe sur ZFS",
+    "trimBody1": "Les SSD et NVMe utilisent des blocs d’effacement internes plus grands que les secteurs logiques du système de fichiers. Après suppression d’un fichier, le disque ne sait pas encore que les secteurs sont libres ; son nettoyage interne peut donc recopier des données obsolètes pour libérer d’autres blocs. <strong>TRIM</strong> lui signale les secteurs libres pour permettre leur effacement anticipé.",
+    "trimBody2": "Sans TRIM, les performances de SSD se dégradent au fil du temps car le lecteur n'a plus de blocs pré-effacés et doit faire effacer-à-écrire, et l'amplification de l'écriture augmente — les deux raccourcissant la vie utile du lecteur. Avec TRIM activé, le lecteur peut garder un bassin sain de blocs vides prêts à écrire.",
+    "trimBody3": "Avec <code>autotrim=on</code>, ZFS traite en arrière-plan l’espace récemment libéré en regroupant les plages. Un <code>zpool trim &lt;pool&gt;</code> périodique est une alternative. Autotrim évite un calendrier séparé, mais son impact dépend des disques ; le TRIM manuel périodique peut mieux convenir à certains modèles modestes.",
+    "practicalTitle": "Pourquoi est-ce pratique?",
+    "practicalItems": [
+      "<strong>Performances d’écriture durables.</strong> TRIM peut aider le disque à récupérer efficacement les blocs inutilisés. Le bénéfice et l’impact sur la latence dépendent du matériel et de la charge.",
+      "<strong>Longévité du disque.</strong> Éviter des copies internes inutiles peut réduire l’amplification d’écriture et l’usure NAND, sans garantir une durée de vie supplémentaire précise.",
+      "<strong>Pas de tâche cron à prévoir.</strong> Contrairement à un <code>zpool trim</code> périodique, autotrim est géré automatiquement par le pool."
+    ],
+    "whenTitle": "Quand est-ce nécessaire ?",
+    "whenIntro1": "<strong>Envisagez de l’activer</strong> sur les pools ZFS uniquement en SSD/NVMe compatibles TRIM. Vérifiez le comportement et la latence ; un TRIM manuel planifié peut mieux convenir.",
+    "whenIntro2": "<strong>Le script le saute automatiquement</strong> sur:",
+    "whenSkipItems": [
+      "Pools avec un vdev sur disque dur rotatif : filtre matériel prudent de ce script.",
+      "Disques sans <code>discard_granularity</code> exposé dans sysfs : anciens SSD sans TRIM ou accès direct ne permettant pas au système de voir le périphérique sous-jacent.",
+      "Pools où ZFS lui-même signale la propriété non supportée (rare; très vieux pools).",
+      "Pools déjà mis à <code>autotrim=on</code> (non-op)."
+    ],
+    "whenIntro3": "<strong>Non pertinent sur les hôtes ext4 seulement</strong> — il n'y a rien pour ZFS à découper. La fonction sort avec un message amical dans ce cas.",
+    "recordedTitle": "Pourquoi seuls les pools ProxMenux modifiés sont enregistrés",
+    "recordedBody": "La fonction n'écrit un pool à son fichier d'état interne (<code>/usr/local/share/proxmenux/zfs_autotrim_pools</code>) que lorsqu'elle a activement retourné ce pool de <code>off</code> à <code>on</code>. Les pools que vous aviez sur autotrim avant d'exécuter le script sont laissés en dehors de la liste, de sorte qu'un futur désinstallation ne désactive pas les paramètres que vous avez configurés vous-même — seuls les changements de ProxMenux sont retournés.",
+    "manualTitle": "Équivalent manuel (exécutez sur votre serveur)",
+    "manualIntro": "La séquence complète du script s'exécute contre chaque pool est reproductible à la main. C'est ce que vous taperiez si vous vouliez faire la même chose sur un seul pool sans ProxMenux:",
+    "verifyTitle": "Vérification et retour arrière manuel",
+    "oneShotTitle": "Besoin d’un TRIM ponctuel plutôt que continu ?",
+    "oneShotBody": "Certains administrateurs préfèrent un TRIM manuel aux heures creuses. Désactivez autotrim et programmez une tâche cron exécutant <code>zpool trim &lt;pool&gt;</code> : même objectif, fréquence différente."
+  },
+  "vzdump": {
+    "heading": "Augmenter la vitesse de sauvegarde de vzdump",
+    "intro": "Écrit bwlimit: 0 et ionice: 5 dans la configuration globale vzdump. Proxmox n’a déjà pas de limite de bande passante par défaut : seul un plafond configuré est retiré. Par rapport à ionice: 7, la valeur 5 augmente la priorité E/S best-effort si l’ordonnanceur la respecte. Cela peut affecter les invités sans garantir des sauvegardes plus rapides.",
+    "changedTitle": "Ce qui est changé dans /etc/vzdump.conf",
+    "backupTitle": "La première exécution crée un .bak de vzdump.conf",
+    "backupBody": "Au premier passage, ProxMenux copie <code>/etc/vzdump.conf</code> vers <code>/etc/vzdump.conf.bak</code> avant modification. Les exécutions suivantes conservent cette sauvegarde pour récupérer la configuration antérieure. <code>bwlimit</code> et <code>ionice</code> sont modifiés par <code>sed</code> ; les autres options comme compress, pigz, tmpdir et exclude-path sont conservées.",
+    "skipTitle": "Quand sauter ça",
+    "skipBody": "Sur un hôte à stockage local lent avec des VM sensibles à la latence, retirer la limite de bande passante peut causer des ralentissements pendant les sauvegardes. Si vous avez défini un <code>bwlimit</code> pour cela, conservez-le et ignorez cette option.",
+    "verifyTitle": "Vérification et retour arrière manuel"
+  },
+  "related": {
+    "heading": "Voir aussi",
+    "items": [
+      {
+        "label": "Commandes de gestion ZFS",
+        "href": "/docs/help-info/zfs-commands",
+        "tail": " — référence zpool / zfs pour ARC, instantanés et scrub."
+      },
+      {
+        "label": "Commandes de stockage et de disques",
+        "href": "/docs/help-info/storage-commands",
+        "tail": " — référence des périphériques de blocs et du stockage Proxmox."
+      },
+      {
+        "label": "Commandes de sauvegarde et restauration",
+        "href": "/docs/help-info/backup-commands",
+        "tail": " — référence CLI vzdump pour la bande passante et la priorité E/S."
+      },
+      {
+        "label": "Désinstaller les optimisations",
+        "href": "/docs/post-install/uninstall",
+        "tail": " — annuler les modifications ARC / vzdump."
+      },
+      {
+        "label": "Log2RAM",
+        "href": "/docs/post-install/optional#log2ram",
+        "tail": "— réduit l'usure du SSD/NVMe par le support de ramdisque /var/log; documenté sous Facultatif."
+      },
+      {
+        "label": "Post-installation personnalisable",
+        "href": "/docs/post-install/customizable",
+        "tail": "— retour au menu parent."
+      }
+    ]
+  }
+}
diff --git a/web/messages/fr/docs/post-install/system.json b/web/messages/fr/docs/post-install/system.json
new file mode 100644
index 00000000..427d28cf
--- /dev/null
+++ b/web/messages/fr/docs/post-install/system.json
@@ -0,0 +1,133 @@
+{
+  "meta": {
+    "title": "Post-installation : Système | Documentation ProxMenux",
+    "description": "Optimisations système du script de post-installation personnalisable ProxMenux : limites de taille journald et logrotate, limites du noyau et des descripteurs de fichiers relevées, réglage équilibré de la mémoire, redémarrages rapides par kexec et récupération après panique du noyau."
+  },
+  "header": {
+    "title": "Après installation : système",
+    "section": "Paramètres post-installation de Proxmox"
+  },
+  "intro": {
+    "title": "Ce que cette catégorie couvre",
+    "body": "Six optimisations système indépendantes. Elles règlent <strong>journald</strong> et <strong>logrotate</strong> pour éviter de remplir le disque, relèvent <strong>les limites du noyau et des descripteurs de fichiers</strong> pour les applications ouvrant beaucoup de fichiers, <strong>équilibrent la mémoire</strong> d’un hôte de virtualisation, ajoutent <strong>kexec</strong> pour redémarrer sans passer par le BIOS et configurent <strong>la récupération automatique</strong> après panique du noyau. Les six sont enregistrées et réversibles depuis le menu de désinstallation."
+  },
+  "journald": {
+    "heading": "Optimiser journald",
+    "intro": "Réécrit <code>/etc/systemd/journald.conf</code> avec des valeurs raisonnables pour éviter que le journal systemd remplisse progressivement la partition racine, puis redémarre <code>systemd-journald</code> et purge les anciens journaux.",
+    "keyTitle": "Valeurs clés",
+    "keyItems": [
+      "<code>Storage=persistent</code> — tenir des journaux sur le disque à travers les reboots.",
+      "<code>SystemMaxUse=64M</code> / <code>RuntimeMaxUse=60M</code> — plafonds d’utilisation du disque et de la mémoire par le journal.",
+      "<code>Compress=yes</code>, <code>Seal=no</code> — compresser les journaux, désactiver le scellement à sécurité persistante (économise du CPU).",
+      "<code>MaxLevelStore=info</code> — conserver les niveaux info et supérieurs, nécessaires au lecteur de journaux ProxMenux Monitor et à la détection des échecs d’authentification SSH/Proxmox par Fail2Ban dans le journal.",
+      "Limite de débit : <code>1000 events / 30 s</code> pour éviter un afflux excessif de journaux.",
+      "<code>ForwardToSyslog=no</code>, <code>ForwardToWall=no</code> — ne dupliquez pas les messages au syslog ou ne les diffusez pas sur des consoles."
+    ],
+    "tipTitle": "Pourquoi MaxLevelStore=info compte",
+    "tipBody": "Un seuil plus strict comme <code>warning</code> fait afficher presque les mêmes entrées à ProxMenux Monitor sur toutes les périodes, car la plupart des activités sont de niveau info, et empêche Fail2Ban de voir les échecs de connexion. Réduisez plutôt le volume avec <code>SystemMaxUse</code> et <code>RateLimitBurst</code> sans restreindre les niveaux conservés."
+  },
+  "logrotate": {
+    "heading": "Optimiser logrotate",
+    "intro": "Réécrit <code>/etc/logrotate.conf</code> avec des réglages globaux quotidiens et de taille, 7 rotations conservées, compression et <code>copytruncate</code> pour que les services continuent d’écrire sans rouvrir les fichiers. Le critère de taille, placé après le critère quotidien, prévaut sauf règle propre au journal. Le <code>logrotate.conf</code> original est sauvegardé en <code>.bak</code> à la première application.",
+    "tipTitle": "Compatible avec Log2RAM",
+    "tipBody": "La directive <code>size 10M</code> prévaut sur le réglage quotidien précédent ; elle ne signifie <em>pas</em> le premier des deux critères. Logrotate vérifie le seuil à son exécution, et les règles propres aux journaux peuvent remplacer les valeurs globales. Pour <code>/var/log</code> en RAM avec Log2RAM, vérifiez les règles et la fréquence du minuteur afin de contrôler l’espace."
+  },
+  "limits": {
+    "heading": "Augmenter diverses limites du système",
+    "intro": "Relève des limites du noyau, de systemd et de PAM dont les valeurs par défaut peuvent être trop faibles pour un hôte exécutant de nombreuses VM, conteneurs et services réseau.",
+    "headerFile": "Fichier",
+    "headerSets": "Ce qu'il définit",
+    "rows": [
+      {
+        "file": "/etc/sysctl.d/99-maxwatches.conf",
+        "sets": "<code>fs.inotify.max_user_watches / max_user_instances / max_queued_events = 1048576</code>"
+      },
+      {
+        "file": "/etc/sysctl.d/99-maxkeys.conf",
+        "sets": "<code>kernel.keys.maxkeys / root_maxkeys = 1000000</code>"
+      },
+      {
+        "file": "/etc/sysctl.d/99-swap.conf",
+        "sets": "<code>vm.swappiness = 10</code>, <code>vm.vfs_cache_pressure = 100</code>"
+      },
+      {
+        "file": "/etc/sysctl.d/99-fs.conf",
+        "sets": "<code>fs.nr_open / file-max = 2097152</code>, <code>fs.aio-max-nr = 1048576</code>"
+      },
+      {
+        "file": "/etc/security/limits.d/99-limits.conf",
+        "sets": "<code>nofile</code> et <code>nproc</code> à 1 048 576 (illimités pour root)"
+      },
+      {
+        "file": "/etc/systemd/system.conf + user.conf",
+        "sets": "<code>DefaultLimitNOFILE=1048576</code> pour les services systemd"
+      },
+      {
+        "file": "/etc/pam.d/common-session + runuser-l",
+        "sets": "<code>session required pam_limits.so</code> donc ce qui précède s'applique aux shells de connexion"
+      },
+      {
+        "file": "/root/.profile",
+        "sets": "<code>ulimit -n 1048576</code> pour le shell root"
+      }
+    ],
+    "tipTitle": "Pourquoi inotify est important",
+    "tipBody": "Docker, Syncthing, les surveillances de fichiers Node.js et les analyses Plex peuvent épuiser <code>max_user_watches</code>. La valeur par défaut dépend du noyau et de la mémoire ; elle n’est pas toujours 8192. Un plafond de 1M autorise davantage de surveillances sans les préallouer. Les surveillances actives consomment de la mémoire du noyau : vérifiez l’usage si la RAM est limitée."
+  },
+  "memory": {
+    "heading": "Optimiser les paramètres de la mémoire",
+    "intro": "Écrit un profil de sysctl équilibré à <code>/etc/sysctl.d/99-memory.conf</code>. Conçu pour un hôte hyperviseur — préfère garder les ensembles de travail VM dans RAM et libère les pages de manière proactive afin que les éclats d'allocation ne s'arrêtent pas.",
+    "warnTitle": "swappiness=10 sur les hôtes avec peu de mémoire",
+    "warnBody": "Sur un hôte de 16 Go de RAM exécutant de nombreuses VM, réduire swappiness peut conduire le noyau à tuer des processus par manque de mémoire plutôt qu’à utiliser le swap. Si les événements OOM sont fréquents, remontez swappiness à 30–60 dans <code>/etc/sysctl.d/99-memory.conf</code> après le script."
+  },
+  "kexec": {
+    "heading": "Activer les redémarrages rapides (kexec)",
+    "intro": "Installe <code>kexec-tools</code> et le branche pour que vous puissiez redémarrer l'hôte directement dans un nouveau noyau <em> sans passer par BIOS/UEFI firmware</em>. Sur les grands serveurs où POST prend 45 – 90 secondes, cela transforme un redémarrage d'une pause café en quelques secondes d'arrêt.",
+    "installsTitle": "Ce que ProxMenux installe",
+    "installsItems": [
+      "Paquet <code>kexec-tools</code> (debconf pré-réponse avec <code>kexec-tools/load_kexec boolean false</code> donc apt n'invite pas et le chargement automatique à l'arrêt reste désactivé).",
+      "Unité systemd <code>/etc/systemd/system/kexec-pve.service</code> — charge le noyau Proxmox et initrd en mémoire au démarrage en réutilisant la ligne de commande actuelle du noyau.",
+      "Un alias dans <code>/root/.bash_profile</code>: <code>reboot-quick</code> → <code>systemctl kexec</code>."
+    ],
+    "usageIntro": "Utilisation après le prochain redémarrage (ou manuel <code>systemctl start kexec-pve</code>):",
+    "warnTitle": "Quand ne pas utiliser kexec",
+    "warnBody": "kexec saute l’initialisation du firmware. Si vous dépendez de BIOS/UEFI pour réinitialiser le matériel, par exemple un GPU en passthrough nécessitant un POST complet ou un firmware HBA problématique, ces redémarrages peuvent laisser les appareils partiellement initialisés. Utilisez un <code>reboot</code> normal après une mise à niveau du noyau ou pour appliquer des changements BIOS/UEFI. <code>reboot-quick</code> sert aux redémarrages courants."
+  },
+  "panic": {
+    "heading": "Activer le redémarrage en cas de panique du noyau",
+    "intro": "Fait <strong>redémarrer automatiquement</strong> le noyau au lieu de rester bloqué sur l’écran de panique. Essentiel pour les hôtes Proxmox distants ou sans console locale : un noyau bloqué arrête toutes les VM jusqu’à ce que vous puissiez couper puis rétablir l’alimentation.",
+    "tipTitle": "Combinez ceci avec l'accès à la console à distance",
+    "tipBody": "Le redémarrage automatique sert à récupérer le système, pas à le déboguer. Pour <em>analyser</em> une panique plutôt que simplement redémarrer, utilisez <link>l’option kexec</link> ci-dessus avec kdump du noyau, non configuré par ProxMenux, ou enregistrez une console série sur un autre hôte avant d’activer le redémarrage automatique."
+  },
+  "verify": {
+    "heading": "Vérification",
+    "intro": "Après l'application des optimisations système:",
+    "tipTitle": "Restauration et limites",
+    "tipBody": "Les six options figurent dans <code>installed_tools.json</code> et <link>Désinstaller les optimisations</link>. La restauration retire les fichiers de configuration, l’unité et l’alias kexec, réécrit journald.conf avec les valeurs par défaut de systemd et rétablit logrotate.conf depuis sa sauvegarde. Certaines limites actives nécessitent une nouvelle session ou un redémarrage."
+  },
+  "related": {
+    "heading": "Voir aussi",
+    "items": [
+      {
+        "label": "Commandes système utiles",
+        "href": "/docs/help-info/system-commands",
+        "tail": " — vérifier les modifications (free -h, journalctl, ulimit -a)."
+      },
+      {
+        "label": "Performances",
+        "href": "/docs/post-install/performance",
+        "tail": "— réglage supplémentaire au niveau du système (pigz)."
+      },
+      {
+        "label": "Désinstaller les optimisations",
+        "href": "/docs/post-install/uninstall",
+        "tail": "— revenir à l'un de ces changements."
+      },
+      {
+        "label": "Post-installation personnalisable",
+        "href": "/docs/post-install/customizable",
+        "tail": "— retour au menu parent."
+      }
+    ]
+  }
+}
diff --git a/web/messages/fr/docs/post-install/uninstall.json b/web/messages/fr/docs/post-install/uninstall.json
new file mode 100644
index 00000000..b61db8ae
--- /dev/null
+++ b/web/messages/fr/docs/post-install/uninstall.json
@@ -0,0 +1,271 @@
+{
+  "meta": {
+    "title": "Désinstaller les optimisations | Documentation ProxMenux",
+    "description": "Restaurer les modifications de configuration réversibles après l'installation appliquées par ProxMenux. Les outils enregistrés utilisent des désinstallateurs dédiés qui préservent l'état d'hôte préexistant lorsque c'est possible."
+  },
+  "header": {
+    "title": "Désinstaller les optimisations",
+    "description": "Restaurer les modifications réversibles apportées par les scripts de post-installation automatisés ou personnalisables. ProxMenux enregistre chaque optimisation supportée avec sa fonction de restauration dédiée; les mises à jour de paquets sont intentionnellement exclues.",
+    "section": "Paramètres post-installation de Proxmox"
+  },
+  "intro": {
+    "title": "Pourquoi cela existe",
+    "body": "Chaque réglage réversible pris en charge est <strong>enregistré</strong> dans <code>/usr/local/share/proxmenux/installed_tools.json</code>. Ce registre liste les optimisations actives et appelle la fonction de restauration correspondante. Les actions sans retour arrière sûr, comme une mise à niveau complète des paquets, ne sont pas ajoutées."
+  },
+  "openMenu": {
+    "heading": "Comment l'ouvrir",
+    "body": "Depuis le menu principal, ouvrez <strong>Paramètres post-installation Proxmox → Désinstaller les optimisations</strong>. La liste propose les optimisations <em>actuellement appliquées</em> ; celles non appliquées n’apparaissent pas.",
+    "imageAlt": "Liste de désinstallation montrant les optimisations actives sur l’hôte, avec cases de sélection pour les annuler"
+  },
+  "howWorks": {
+    "heading": "Comment fonctionne le retour arrière",
+    "steps": [
+      {
+        "title": "Registre et détection automatique",
+        "body1": "Au premier passage, ProxMenux recherche des marqueurs sur l’hôte : <code>/etc/sysctl.d/99-memory.conf</code>, <code>/etc/apt/apt.conf.d/99-force-ipv4</code>, paquet <code>haveged</code> installé, service Log2RAM actif, etc. Les éléments reconnus sont enregistrés comme réversibles, même s’ils viennent d’une version antérieure au registre.",
+        "body2": "Cette migration ne dure qu'une seule fois. Ensuite, chaque application/réversion met à jour le registre directement."
+      },
+      {
+        "title": "Choisir les changements à annuler",
+        "body1": "La liste de vérification présente une étiquette lisible par l'homme par article (p. ex. <em>Optimisation des paramètres de mémoire</em>, <em>IOMMU/VFIO PCI Passthrough</em>, <em>Log2RAM (SSD Protection)</em>). Cochez ceux que vous voulez inverser. Rien de ce que vous ne cochez ne sera touché."
+      },
+      {
+        "title": "Exécution de la restauration",
+        "body1": "Pour chaque élément sélectionné, ProxMenux appelle sa fonction de désinstallation correspondante. La plupart des renversements suivent l'un des trois modèles suivants :",
+        "items": [
+          "<strong>Basé sur la sauvegarde</strong> — restaurer un <code>.bak</code> capturé au moment de l'application (bashrc, logrotate.conf, journald.conf, GRUB/kernel cmdline).",
+          "<strong>Suppression de configuration</strong> — retire les fichiers ProxMenux <code>/etc/sysctl.d/99-*.conf</code>, <code>/etc/apt/apt.conf.d/99-*</code> ou l’unité systemd, puis recharge.",
+          "<strong>Réinstallation de paquets</strong> — pour les modifications d’interface comme l’avertissement d’abonnement, réinstalle les paquets originaux avec <code>--force-confnew</code> pour rétablir les réglages fournis."
+        ],
+        "body2": "Chaque renversement enregistre ses progrès. Les éléments qui nécessitent un redémarrage (VFIO, noms d'interface persistants) définissent un drapeau qui déclenche l'invite de redémarrage à la fin."
+      },
+      {
+        "title": "Demande de redémarrage à la fin",
+        "body1": "Une fois l'inversion terminée, le menu affiche une invite de redémarrage. Les éléments qui ont modifié les paramètres du noyau, les modules du noyau ou le nom de réseau (VFIO, noms d'interface persistants) ont besoin du redémarrage pour prendre effet; d'autres éléments ne le font pas, et l'invite est une sécurité par défaut plutôt qu'une vérification par item."
+      }
+    ]
+  },
+  "reversible": {
+    "heading": "Ce qui est réversible",
+    "intro": "Les optimisations réversibles enregistrées et leurs désinstallateurs correspondants sont regroupés ici par domaine:",
+    "groups": [
+      {
+        "title": "Dépôts & APT",
+        "items": [
+          {
+            "tool": "Suppression de la bannière d'abonnement",
+            "restores": "D'abord essayer de restaurer les fichiers d'interface utilisateur à partir des sauvegardes de ProxMenux (/usr/local/share/proxmenux/backups/proxmoxlib.js.backup.* et, lorsque l'interface utilisateur mobile est patchée, index.html.tpl.backup.*). Seulement si une sauvegarde est manquante ou corrompue, revient à réinstaller pve-manager, proxmox-widget-toolkit, libjs-extjs et libpve-http-server-perl avec force-confnew. Efface également les copies en cache .js / .gz."
+          },
+          {
+            "tool": "Ignorer les langues APT",
+            "restores": "Supprime /etc/apt/apt.conf.d/99-disable-translations pour permettre les index de descriptions de paquets traduites selon les autres réglages linguistiques APT."
+          },
+          {
+            "tool": "Forcer IPv4 pour APT",
+            "restores": "Supprime /etc/apt/apt.conf.d/99-force-ipv4."
+          },
+          {
+            "tool": "Utilitaires système",
+            "restores": "Purge seulement les paquets utilitaires sélectionnés que ProxMenux enregistré comme nouvellement installé. Les paquets déjà présents avant l'action ne sont jamais ajoutés à cette liste et restent intacts."
+          }
+        ]
+      },
+      {
+        "title": "Limites du noyau, de la mémoire et du système",
+        "items": [
+          {
+            "tool": "Paramètres de la mémoire",
+            "restores": "Supprime /etc/sysctl.d/99-memory.conf et recharge sysctl."
+          },
+          {
+            "tool": "Configuration de la panique du noyau",
+            "restores": "Supprime /etc/sysctl.d/99-kernelpanic.conf."
+          },
+          {
+            "tool": "Augmentation des limites du système",
+            "restores": "Supprime /etc/sysctl.d/99-maxwatches.conf, 99-maxkeys.conf, 99-swap.conf, 99-fs.conf et /etc/security/limits.d/99-limits.conf. Rétablit les limites PAM et DefaultLimitNOFILE systemd. Dans /root/.profile, seul l’ancien ulimit -n 256000 est retiré ; ulimit -n 1048576 de l’installateur actuel peut rester et nécessiter une suppression manuelle."
+          },
+          {
+            "tool": "Profil d'échange ZRAM",
+            "restores": "Désactive le swap /dev/zram0, arrête dev-zram0.swap et supprime /etc/systemd/zram-generator.conf.d/90-proxmenux.conf. Le paquet systemd-zram-generator n’est purgé que si ProxMenux l’a installé et qu’aucune autre configuration ZRAM n’existe. Si les pages ne peuvent pas être évacuées, le profil reste actif et rien n’est supprimé."
+          }
+        ]
+      },
+      {
+        "title": "Réseautage",
+        "items": [
+          {
+            "tool": "Optimisations du réseau",
+            "restores": "Supprime /etc/sysctl.d/99-network.conf, 97-proxmenux-fwbr.conf et 98-proxmenux-rpf.conf, l’unité proxmenux-fwbr-tune.service, le script /usr/local/sbin/proxmenux-fwbr-tune et la règle udev /etc/udev/rules.d/99-zz-proxmenux-fwbr-tune.rules. Retire aussi la ligne source /etc/network/interfaces.d/* de /etc/network/interfaces. Recharge sysctl, systemd et les règles udev."
+          },
+          {
+            "tool": "Open vSwitch",
+            "restores": "Exécute apt purge pour openvswitch-switch et openvswitch-common. Migrez les ponts OVS vers Linux avant la désinstallation, sinon leurs VM perdront le réseau au prochain démarrage."
+          },
+          {
+            "tool": "TCP BBR + TCP Fast Open",
+            "restores": "Supprime /etc/sysctl.d/99-kernel-bbr.conf et 99-tcp-fastopen.conf, puis recharge le reste de sysctl. Supprimer les fichiers ne réinitialise pas les valeurs actives ; les valeurs par défaut comme cubic et tcp_fastopen=1 reviennent au redémarrage sauf autre configuration."
+          },
+          {
+            "tool": "Noms d'interface persistants",
+            "restores": "Supprime uniquement les fichiers 10-proxmenux-*.link contenant l'en-tête ProxMenux de /etc/systemd/network/. Tout fichier .link fourni par un autre paquet ou écrit par l'utilisateur est laissé en place. Les noms d'interface retournent au comportement par défaut de systemd lors du prochain redémarrage."
+          }
+        ]
+      },
+      {
+        "title": "Journalisation",
+        "items": [
+          {
+            "tool": "Optimisation de journald",
+            "restores": "Réécrit /etc/systemd/journald.conf par défaut et redémarre systemd-journald."
+          },
+          {
+            "tool": "Optimisation du logrotate",
+            "restores": "Restaurer /etc/logrotate.conf à partir du fichier .bak capturé avant le changement."
+          },
+          {
+            "tool": "Log2RAM",
+            "restores": "Arrête et désactive le service et le minuteur. Supprime tâches cron, unités systemd, binaires, configuration et /var/log.hdd. Désinstalle aussi le paquet apt si cette méthode a été utilisée."
+          },
+          {
+            "tool": "TRIM automatique ZFS",
+            "restores": "Lit /usr/local/share/proxmenux/zfs_autotrim_pools, la liste des pools réellement modifiés, et lance zpool set autotrim=off sur chacun. Les pools activés manuellement avant ProxMenux restent intacts."
+          }
+        ]
+      },
+      {
+        "title": "Shell & apparence",
+        "items": [
+          {
+            "tool": "Personnalisation de Bashrc",
+            "restores": "Restaurer /root/.bashrc à partir de la sauvegarde .bak. Si aucune sauvegarde n'existe, supprime le bloc PMX_CORE_BASHRC par des marqueurs."
+          },
+          {
+            "tool": "Bannière MOTD personnalisée",
+            "restores": "Restaurer le contenu original exact /etc/motd conservé sous /usr/local/share/proxmenux, supprime le fichier lorsqu'il n'existait pas avant, ou supprime en toute sécurité le marqueur existant lors de la migration d'une ancienne installation."
+          },
+          {
+            "tool": "Fastfetch",
+            "restores": "Supprime le binaire, le répertoire de configuration, le hook update-motd et le bloc délimité BEGIN FASTFETCH / END FASTFETCH de /root/.bashrc, ~/.profile, /etc/profile et /etc/profile.d/fastfetch.sh. Purge le paquet apt s’il est installé."
+          },
+          {
+            "tool": "Figurine",
+            "restores": "Supprime le binaire, l’entrée profile.d et le bloc d’alias de bashrc/profile."
+          }
+        ]
+      },
+      {
+        "title": "Matériel & virtualisation",
+        "items": [
+          {
+            "tool": "IOMMU / VFIO",
+            "restores": "Supprime les modules vfio de /etc/modules, les entrées de blocage nouveau / radeon / nvidia et les paramètres intel_iommu=on / amd_iommu=on / iommu=pt / pcie_acs_override de /etc/kernel/cmdline (ZFS) ou GRUB. Reconstruit initramfs."
+          },
+          {
+            "tool": "Corrections AMD CPU (Ryzen/EPYC)",
+            "restores": "Supprime idle=nomwait de la ligne de commande du noyau (ZFS) ou GRUB, et les options ignore_msrs / report_ignored_msrs de /etc/modprobe.d/kvm.conf."
+          },
+          {
+            "tool": "Agent invité pour un hôte Proxmox virtualisé",
+            "restores": "Lit /usr/local/share/proxmenux/guest_agent.pkg et purge le paquet hôte enregistré. L’installateur choisit qemu-guest-agent, open-vm-tools ou virtualbox-guest-utils selon l’hyperviseur. Sans enregistrement, la désinstallation essaie ces trois paquets. Cela agit sur l’hôte Proxmox imbriqué, pas sur les modèles invités."
+          }
+        ]
+      },
+      {
+        "title": "Stockage",
+        "items": [
+          {
+            "tool": "Dimensionnement de l'ARC ZFS",
+            "restores": "Supprime /etc/modprobe.d/99-zfsarc.conf, restaure les *.conf externes en conflit sauvegardés dans /usr/local/share/proxmenux/backups/zfs_arc/, reconstruit initramfs et lance proxmox-boot-tool refresh sur les hôtes systemd-boot."
+          },
+          {
+            "tool": "Instantanés automatiques ZFS",
+            "restores": "Supprime les tâches cron écrites par le script et propose apt purge zfs-auto-snapshot. Les instantanés existants sur les pools restent intacts ; supprimez-les séparément si nécessaire."
+          },
+          {
+            "tool": "Limites de vitesse vzdump",
+            "restores": "Restaure /etc/vzdump.conf depuis le .bak créé à l’installation pour rétablir bwlimit et ionice à leurs valeurs avant ProxMenux."
+          }
+        ]
+      },
+      {
+        "title": "Services et suppléments",
+        "items": [
+          {
+            "tool": "Synchronisation du temps",
+            "restores": "Rétablit le fuseau UTC, valeur par défaut sûre, via timedatectl."
+          },
+          {
+            "tool": "Génération d’entropie (haveged)",
+            "restores": "Arrête, désactive et purge le paquet haveged."
+          },
+          {
+            "tool": "kexec (redémarrages rapides)",
+            "restores": "Désactive kexec-pve.service, supprime l’unité et l’alias reboot-quick de /root/.bash_profile, puis purge kexec-tools."
+          },
+          {
+            "tool": "RPC / rpcbind Désactiver",
+            "restores": "Rétablit séparément rpcbind.service et rpcbind.socket dans leurs états activé/désactivé et actif/inactif enregistrés avant ProxMenux."
+          },
+          {
+            "tool": "pigz (parallèle gzip)",
+            "restores": "Rétablit le vrai gzip depuis gzip.distrib, supprime le détournement dpkg et /bin/pigzwrapper, commente la ligne pigz de /etc/vzdump.conf puis lance apt purge pigz après vérification de gzip."
+          },
+          {
+            "tool": "Services à haute disponibilité",
+            "restores": "Arrête et désactive pve-ha-lrm, pve-ha-crm et corosync. Les groupes HA existants et les définitions de ressources ne sont pas supprimés — les supprimer de l'interface utilisateur Web si vous n'en avez plus besoin."
+          },
+          {
+            "tool": "Dépôt Ceph",
+            "restores": "Purge les paquets Ceph installés par cette option, supprime le deb822 /etc/apt/sources.list.d/ceph.sources sur PVE 9 (ou la liste de Ceph sur PVE 8), et rafraîchit le cache APT."
+          },
+          {
+            "tool": "OVH RTM (surveillance)",
+            "restores": "Purge les paquets correspondant à ovh-rtm*, rtm et rtm-*, supprime /etc/rtm et retire l’entrée RTM du registre. Les restes Puppet dans /etc/puppet/ peuvent nécessiter une vérification et un nettoyage manuels ; le répertoire n’est pas supprimé. Hors OVH, l’installateur ne change normalement rien."
+          }
+        ]
+      }
+    ]
+  },
+  "edge": {
+    "heading": "Cas particuliers et précautions",
+    "packageTitle": "La réinstallation touche des paquets Proxmox en cours d’utilisation",
+    "packageBody": "Si les sauvegardes ProxMenux ne peuvent pas annuler <strong>Suppression de l’avertissement d’abonnement</strong>, la solution de repli réinstalle <code>pve-manager</code>, <code>proxmox-widget-toolkit</code>, <code>libjs-extjs</code> et <code>libpve-http-server-perl</code> avec <code>--force-confnew</code>. Cela touche l’interface active : actualisez le navigateur et attendez la reconnexion. Évitez les migrations et clonages en cours.",
+    "rebootTitle": "Les noms persistants et VFIO ont besoin d'un redémarrage",
+    "rebootBody": "Suppression ProxMenux's <code>10-proxmenux-*.link</code> fichiers (<em>Noms d'interface persistants</em>) et retour <em>IOMMU/VFIO</em> n'affectent pas le système d'exécution — ils ne comptent qu'après un redémarrage. ProxMenux définit le drapeau de redémarrage automatiquement pour ceux-ci.",
+    "perItemTitle": "Vous pouvez annuler une modification et garder les autres",
+    "perItemBody": "Le désinstallateur fonctionne par élément. Si vous voulez seulement supprimer Log2RAM mais garder le réglage réseau et les changements de bashrc, cochez uniquement <em>Log2RAM</em>. Rien d'autre n'est touché et le registre est mis à jour en conséquence."
+  },
+  "inspect": {
+    "heading": "Inspection manuelle du registre",
+    "intro": "Si vous voulez voir ce qui est suivi sans ouvrir le menu:",
+    "outro": "Chaque entrée <code>\"tool\": true</code> correspond à quelque chose de ProxMenux appliqué et peut inverser. L'élimination manuelle d'une entrée n'est pas recommandée — utilisez toujours le menu, qui exécute également la fonction d'inversion au lieu de simplement oublier le changement.",
+    "reinstallTitle": "Réinstaller après désinstallation",
+    "reinstallBody": "La réversion d'une optimisation ne vous empêche pas de la réappliquer plus tard. Ouvrez <link>le menu Post-Installer</link> à nouveau et exécutez soit Automatique ou Personnalisable — le registre suivra le nouvel état."
+  },
+  "related": {
+    "heading": "Voir aussi",
+    "items": [
+      {
+        "label": "Système automatisé de post-installation",
+        "href": "/docs/post-install/automated",
+        "tail": "— réappliquer le niveau de référence par défaut."
+      },
+      {
+        "label": "Post-installation personnalisable",
+        "href": "/docs/post-install/customizable",
+        "tail": "— choisir un sous-ensemble différent."
+      },
+      {
+        "label": "Désinstaller ProxMenux",
+        "href": "/docs/settings/uninstall-proxmenux",
+        "tail": "— fonctionnement différent: supprime ProxMenux lui-même, et non ses optimisations appliquées."
+      },
+      {
+        "label": "Aperçu après l'installation",
+        "href": "/docs/post-install",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/fr/docs/post-install/updates.json b/web/messages/fr/docs/post-install/updates.json
new file mode 100644
index 00000000..bab56dc7
--- /dev/null
+++ b/web/messages/fr/docs/post-install/updates.json
@@ -0,0 +1,112 @@
+{
+  "meta": {
+    "title": "Appliquer les mises à jour disponibles — Optimisations post-installation | Documentation ProxMenux",
+    "description": "Comment ProxMenux détecte lorsqu'une optimisation post-installation (Log2Ram, Paramètres de mémoire, Limites du système, Logrotate, réglage réseau...) a été mise à jour en amont, et comment appliquer la nouvelle version — depuis le menu Post-Install ou depuis le tableau de bord de Monitor."
+  },
+  "header": {
+    "title": "Appliquer les mises à jour disponibles",
+    "description": "Si une optimisation post-installation (Log2Ram, paramètres de mémoire, limites système, Logrotate…) a une version sur disque plus récente que celle enregistrée sur l’hôte, ProxMenux la signale comme mise à jour disponible. Vous pouvez l’appliquer depuis le menu post-installation des scripts ou le tableau de bord Monitor. Les deux relancent la même fonction et actualisent le registre.",
+    "section": "Paramètres post-installation de Proxmox"
+  },
+  "intro": {
+    "title": "Ce que c'est",
+    "body": "Les optimisations post-installation ProxMenux ont des versions, par exemple <code>Log2ram SSD Protection v1.2</code>. L’hôte enregistre les optimisations actives et leurs versions dans <code>/usr/local/share/proxmenux/installed_tools.json</code>. Lorsqu’une version ProxMenux fournit une optimisation plus récente, l’écart est détecté et seule celle-ci est proposée à la réapplication, sans relancer toute la post-installation."
+  },
+  "why": {
+    "heading": "Pourquoi cela existe",
+    "body": "Les optimisations après installation peuvent être améliorées : meilleur réglage sysctl, limite Logrotate plus stricte, nouvelle méthode de dimensionnement de Log2RAM ou correction d’un cas particulier signalé par un testeur. Sans mécanisme de mise à jour, il fallait relancer manuellement le script après installation, qui réapplique <em>toutes</em> les optimisations, ou renoncer à l’amélioration. Appliquer les mises à jour disponibles permet de relancer volontairement chaque optimisation dont la version a changé."
+  },
+  "detection": {
+    "heading": "Comment les mises à jour sont détectées",
+    "steps": [
+      {
+        "title": "Scripts versionnés sur disque",
+        "body": "Chaque fonction post-installation déclare sa version dans le script (<code>scripts/post_install/auto_post_install.sh</code> et <code>scripts/post_install/customizable_post_install.sh</code>). Un scanner extrait ces versions de la source sur le disque."
+      },
+      {
+        "title": "Registre des versions sur l’hôte",
+        "body": "Lorsque l'opérateur a appliqué chaque optimisation, l'appel <code>register_tool</code> correspondant a écrit la version active dans <code>/usr/local/share/proxmenux/installed_tools.json</code>. Ce fichier est la source de la vérité pour \"ce qui est actif sur cet hôte en ce moment\"."
+      },
+      {
+        "title": "Monitor compare les deux versions",
+        "body": "Au démarrage et toutes les 24 h, Monitor compare les versions sur disque aux versions enregistrées. Chaque écart crée une entrée dans <code>/usr/local/share/proxmenux/updates_available.json</code>. Ce fichier alimente l’entrée du menu post-installation et la carte du tableau de bord Monitor."
+      },
+      {
+        "title": "Une notification par nouvelle version",
+        "body": "Dès qu’une optimisation a une mise à jour en attente, Monitor envoie une notification groupée, par exemple <em>« 4 mises à jour d’optimisations ProxMenux disponibles »</em>, avec une ligne par outil au format <code>name (vX → vY)</code>, comme pour les paquets Proxmox. Elle ne se répète pas chaque jour pour le même ensemble : seule une nouvelle version ou un nouvel outil dans la liste la déclenche à nouveau."
+      }
+    ]
+  },
+  "pathA": {
+    "heading": "Chemin A — À partir du menu Post-Installation",
+    "intro": "À partir du menu principal de ProxMenux, ouvrez <strong>Paramètres après l'installation Proxmox</strong>. Lorsqu'il y a des mises à jour en attente, une nouvelle entrée <strong>Appliquer les mises à jour disponibles (N)</strong> apparaît juste au-dessus de <em>Désinstaller les optimisations</em>. Le nombre reflète combien d'optimisations ont une version plus récente sur disque que ce que l'hôte a actuellement enregistré. Lorsque tout est à jour, l'entrée n'apparaît tout simplement pas, donc le menu reste propre.",
+    "menuAlt": "Menu des scripts post-installation montrant Appliquer les mises à jour disponibles (N) au-dessus de Désinstaller les optimisations ; le compteur indique les optimisations dont une version plus récente est sur disque",
+    "menuCaption": "<em>Appliquer les mises à jour disponibles (N)</em> apparaît seulement si une optimisation a une mise à jour en attente ; l’entrée est masquée quand l’hôte est à jour.",
+    "checklistBody": "Sélectionner l'entrée ouvre une liste de contrôle avec chaque mise à jour en attente, chaque ligne formatée en <code>name (vX → vY)</code>. Toutes les lignes sont pré-cochées par défaut; décochez toutes les lignes que vous ne voulez pas appliquer ce tour.",
+    "checklistAlt": "Sélecteur Appliquer les mises à jour disponibles avec une ligne par optimisation en attente, son nom et le changement de version (actuelle → disponible). Toutes les lignes sont cochées.",
+    "checklistCaption": "Sélection individuelle des optimisations à mettre à jour. Le même moteur qu’Automatisé et Personnalisable réapplique chaque fonction en arrière-plan et actualise sa version enregistrée."
+  },
+  "pathB": {
+    "heading": "Voie B — Depuis le tableau de bord Monitor",
+    "intro": "Les mêmes mises à jour apparaissent dans Monitor sous <link>Paramètres → Optimisations ProxMenux</link>. La carte affiche un <strong>compteur des mises à jour</strong> en attente qui ouvre le sélecteur par optimisation. Chaque outil propose aussi sa propre action de mise à jour.",
+    "imageAlt": "Carte Optimisations ProxMenux dans les paramètres Monitor avec un compteur ouvrant le sélecteur par optimisation et des actions de mise à jour par outil",
+    "imageCaption": "La carte Optimisations de Monitor donne accès aux mises à jour via son compteur dès qu’une version plus récente est sur disque, sans accès au shell."
+  },
+  "applying": {
+    "heading": "Ce qui se passe lors de l’application",
+    "steps": [
+      {
+        "title": "Réexécute la fonction post-installation",
+        "body": "La fonction de l’optimisation sélectionnée est réexécutée sur l’hôte. Comme chaque fonction après installation est <strong>idempotente</strong>, la relancer ne duplique pas la configuration : elle remplace la version précédente par la nouvelle, notamment les fichiers sysctl, les fichiers complémentaires et les unités de service."
+      },
+      {
+        "title": "Actualise le registre",
+        "body": "L'appel <code>register_tool</code> à l'intérieur de la fonction écrit la nouvelle version dans <code>installed_tools.json</code>. Le scan suivant ne voit plus d'inadéquation et l'entrée mise à jour disparaît du menu et de la carte Monitor."
+      },
+      {
+        "title": "Pas de redémarrage sauf si la fonction le dit",
+        "body": "La plupart des mises à jour prennent effet immédiatement. Les mises à jour qui touchent les modules du noyau, les noms d'interface persistants ou VFIO affichent la même invitation de redémarrage qu'une nouvelle installation."
+      },
+      {
+        "title": "Mise à jour du registre envoyée au moniteur",
+        "body": "Après le lot, le menu envoie une requête POST à <code>http://127.0.0.1:8008/api/updates/post-install/scan</code> pour reconstruire <code>/usr/local/share/proxmenux/updates_available.json</code>. Une fois toutes les mises à jour appliquées, leur compteur et l’entrée conditionnelle du menu shell disparaissent sans attendre le prochain scan. La carte Optimisations reste disponible."
+      }
+    ],
+    "jqTitle": "jq est nécessaire",
+    "jqBody": "La liste de contrôle Path A repose sur <code>jq</code> pour analyser les mises à jour en attente JSON. Si le <code>jq</code> manque, le flux s'éteint silencieusement — vous verrez l'entrée du menu avec un nombre mais rien ne se produirait après avoir sélectionné les lignes. Sur n'importe quelle installation Proxmox moderne <code>jq</code> est présente; si dans le doute exécuter <code>apt install -y jq</code>."
+  },
+  "differs": {
+    "heading": "Comment il diffère des autres chemins",
+    "headerPath": "Path",
+    "headerScope": "Portée",
+    "headerWhen": "Quand ça a du sens",
+    "rows": [
+      {
+        "pathLabel": "Automatisé",
+        "pathHref": "/docs/post-install/automated",
+        "scope": "Ré-applique <em> chaque optimisation </em> dans le paquet.",
+        "when": "Hôte neuf ou réapplication complète de la configuration de base d’un nœud entièrement géré."
+      },
+      {
+        "pathLabel": "Personnalisable",
+        "pathHref": "/docs/post-install/customizable",
+        "scope": "Choisissez parmi le catalogue complet.",
+        "when": "Choisir précisément les optimisations actives sur l’hôte."
+      },
+      {
+        "pathLabel": "appliquer les mises à jour disponibles",
+        "pathHref": null,
+        "scope": "Uniquement les optimisations dont la version sur disque a augmenté.",
+        "when": "Garder les optimisations installées à jour sans toucher au reste."
+      },
+      {
+        "pathLabel": "Désinstaller les optimisations",
+        "pathHref": "/docs/post-install/uninstall",
+        "scope": "Inverser l'optimisation et supprimer son entrée de registre.",
+        "when": "Annuler une modification précise."
+      }
+    ]
+  },
+  "notifTitle": "Contrôle de la notification",
+  "notifBody": "L’événement <em>Mises à jour d’optimisations ProxMenux disponibles</em> annonce les mises à jour en attente. Activé par défaut sur chaque canal, il peut être désactivé par canal dans <link>Paramètres → Notifications</link>. Il ne se déclenche qu’une fois par ensemble distinct de mises à jour, pas à chaque scan de 24 h."
+}
diff --git a/web/messages/fr/docs/post-install/virtualization.json b/web/messages/fr/docs/post-install/virtualization.json
new file mode 100644
index 00000000..0f2d1bf8
--- /dev/null
+++ b/web/messages/fr/docs/post-install/virtualization.json
@@ -0,0 +1,116 @@
+{
+  "meta": {
+    "title": "Post-installation : Virtualisation | Documentation ProxMenux",
+    "description": "Options de virtualisation dans le script post-installation personnalisable ProxMenux : installer automatiquement le bon agent invité si Proxmox fonctionne à l'intérieur d'un VM, et activer IOMMU / VFIO afin que vous puissiez passer les périphériques PCI (GPU, NIC, HBAs) à vos propres VM."
+  },
+  "header": {
+    "title": "Post-Installation : Virtualisation",
+    "section": "Paramètres post-installation de Proxmox"
+  },
+  "intro": {
+    "title": "Ce que cette catégorie couvre",
+    "body": "Deux options indépendantes. <strong>Installer l’agent invité adapté</strong> aide lorsque Proxmox fonctionne lui-même dans un autre hyperviseur. <strong>Activer la prise en charge de VFIO IOMMU</strong> intéresse la plupart des utilisateurs : active les fonctions du noyau pour attribuer directement un GPU, HBA ou une carte réseau à une VM avec des performances quasi natives."
+  },
+  "guestAgent": {
+    "heading": "installer l'agent invité approprié",
+    "intro": "Détecte l'environnement de virtualisation sur lequel s'exécute l'hôte Proxmox (en utilisant <code>systemd-detect-virt</code> et <code>dmidecode</code>) et installe le paquet d'outils invités correspondant afin que l'hyperviseur externe puisse communiquer avec Proxmox de manière propre (arrêt progressif, synchronisation d'horloge, reportage IP, etc.).",
+    "headerDetected": "Hôte détecté",
+    "headerPackage": "Paquet installé",
+    "rows": [
+      {
+        "detected": "QEMU / KVM",
+        "package": "qemu-guest-agent"
+      },
+      {
+        "detected": "VMware (ESXi, Workstation)",
+        "package": "open-vm-tools"
+      },
+      {
+        "detected": "VirtualBox",
+        "package": "virtualbox-guest-utils"
+      },
+      {
+        "detected": "Matériel physique (aucun)",
+        "package": "— non-op, rien installé"
+      }
+    ],
+    "skipTitle": "Ignorez cette option si Proxmox fonctionne sur du matériel physique",
+    "skipBody": "Si Proxmox fonctionne directement sur le matériel, le cas habituel, cocher cette option ne change rien : le détecteur retourne <code>none</code> et le script quitte sans modification. L’option concerne seulement les installations où Proxmox fonctionne <em>en tant qu’invité</em> pour des tests ou des laboratoires."
+  },
+  "vfio": {
+    "heading": "Activer la prise en charge de VFIO IOMMU",
+    "intro": "Active IOMMU sur l’hôte et charge les modules permettant l’accès direct PCI (<code>vfio</code>, <code>vfio_iommu_type1</code>, <code>vfio_pci</code>). Vous pouvez alors attribuer un périphérique physique à une VM, qui y accède directement avec des performances proches du matériel natif.",
+    "whoTitle": "Qui en a besoin ?",
+    "whoItems": [
+      "Vous voulez attribuer directement un GPU à une VM Windows de jeu ou à une VM macOS.",
+      "Vous avez un 10G NIC dédié pour un pare-feu/routeur VM (OPNsense, pfSense).",
+      "Vous souhaitez passer un HBA directement à un TrueNAS/Unraid VM pour ZFS sur disques nus.",
+      "Vous prévoyez utiliser <em>Coral TPU</em>, une carte de capture, ou un dongle SDR dans un VM."
+    ],
+    "whoOutro": "Si aucun de ces éléments ne s'applique, vous pouvez ignorer cette option en toute sécurité. Pour le relais vers un <strong>LXC</strong> (et non un VM), IOMMU n'est <em>pas</em> requis.",
+    "doesTitle": "Ce que fait ProxMenux",
+    "doesIntro": "La fonction tient compte du chargeur de démarrage : elle détecte ZFS (systemd-boot) ou LVM/ext4 (GRUB) et écrit dans le bon fichier. Elle est idempotente : les paramètres déjà présents ne sont pas ajoutés une seconde fois.",
+    "headerBoot": "Type de démarrage",
+    "headerFile": "Fichier touché",
+    "headerPost": "Étape postérieure à la mise à jour",
+    "bootRows": [
+      {
+        "boot": "systemd-boot (ZFS)",
+        "file": "/etc/kernel/cmdline",
+        "post": "proxmox-boot-tool refresh"
+      },
+      {
+        "boot": "GRUB (LVM/ext4)",
+        "file": "/etc/default/grub",
+        "post": "update-grub"
+      }
+    ],
+    "kernelIntro": "Paramètres du noyau ajoutés:",
+    "modulesIntro": "Modules de noyau ajoutés au <code>/etc/modules</code>:",
+    "blacklistIntro": "Pilotes en conflit bloqués dans <code>/etc/modprobe.d/blacklist.conf</code> :",
+    "blacklistTitle": "Bloquer les pilotes GPU empêche l’utilisation du GPU par l’hôte",
+    "blacklistBody": "La liste de blocage empêche le noyau hôte de lier <em>tout</em> pilote GPU, pour que VFIO puisse prendre le contrôle du GPU. C’est souhaitable pour l’attribution directe à une VM, mais c’est l’<strong>opposé</strong> de ce qu’il faut pour <link>installer les pilotes NVIDIA sur l’hôte</link>, par exemple pour le transcodage LXC. Choisissez une voie par GPU :",
+    "pathItems": [
+      "<strong>GPU → VM:</strong> activez VFIO/IOMMU ici, laissez les pilotes GPU sur la liste noire.",
+      "<strong>GPU → LXC (ou hôte) :</strong> ignorez cette option, utilisez l’installation NVIDIA sur l’hôte et ne bloquez pas nvidia/nouveau.",
+      "<strong>Deux GPU :</strong> l’un peut aller à une VM, l’autre à un LXC, mais une configuration plus précise est nécessaire : lier une seule carte à <code>vfio-pci</code> par son identifiant PCI. La liste de blocage par défaut est trop large ; modifiez ensuite <code>blacklist.conf</code>."
+    ],
+    "acsTitle": "À propos de pcie_acs_override — comprenez ce que vous activez",
+    "acsBody": "<code>pcie_acs_override=downstream,multifunction</code> assouplit la vérification PCIe Access Control Services. Le noyau peut alors séparer des groupes IOMMU signalés comme indivisibles par le firmware, parfois seul moyen d’attribuer un périphérique sans tout le groupe. En contrepartie, <strong>l’isolation entre périphériques est réduite</strong> : une VM malveillante ou compromise avec accès direct dispose d’une plus grande surface d’attaque via DMA. Acceptable en laboratoire domestique, à bien évaluer pour des charges non fiables. Si inutile, retirez le paramètre de <code>/etc/kernel/cmdline</code> ou <code>/etc/default/grub</code> après le script et relancez la mise à jour du chargeur de démarrage.",
+    "rebootTitle": "Redémarrage nécessaire",
+    "rebootBody": "IOMMU, les modules VFIO et la liste de blocage prennent effet après régénération d’initramfs et redémarrage. Le script exécute <code>update-initramfs -u -k all</code>, actualise le chargeur de démarrage et indique qu’un redémarrage est nécessaire pour que Personnalisable le propose à la fin.",
+    "verifyTitle": "Vérification après redémarrage",
+    "revertTitle": "Réversible depuis le menu Désinstaller",
+    "revertBody": "<link>Désinstaller les optimisations</link> annule toutes les modifications : retire les paramètres IOMMU de <code>/etc/kernel/cmdline</code> ou GRUB, les modules VFIO de <code>/etc/modules</code> et les entrées de blocage des pilotes, puis reconstruit initramfs. Un redémarrage applique le retour en arrière."
+  },
+  "related": {
+    "heading": "Voir aussi",
+    "items": [
+      {
+        "label": "Ajouter GPU à VM (Passthrough)",
+        "href": "/docs/hardware/gpu-vm-passthrough",
+        "tail": "— l'étape suivante naturelle une fois IOMMU + VFIO activé."
+      },
+      {
+        "label": "Ajouter le contrôleur ou NVMe au VM",
+        "href": "/docs/disk-manager/add-controller-nvme-vm",
+        "tail": "— la même infrastructure de transmission pour les contrôleurs de stockage."
+      },
+      {
+        "label": "commandes GPU Passthrough",
+        "href": "/docs/help-info/gpu-commands",
+        "tail": "— Référence de vérification IOMMU."
+      },
+      {
+        "label": "Désinstaller les optimisations",
+        "href": "/docs/post-install/uninstall",
+        "tail": " — annuler proprement IOMMU / VFIO."
+      },
+      {
+        "label": "Post-installation personnalisable",
+        "href": "/docs/post-install/customizable",
+        "tail": "— retour au menu parent."
+      }
+    ]
+  }
+}
diff --git a/web/messages/fr/docs/security/fail2ban.json b/web/messages/fr/docs/security/fail2ban.json
new file mode 100644
index 00000000..8c313a04
--- /dev/null
+++ b/web/messages/fr/docs/security/fail2ban.json
@@ -0,0 +1,152 @@
+{
+  "meta": {
+    "title": "Fail2Ban | Documentation ProxMenux",
+    "description": "Installez Fail2Ban avec trois jails optimisés pour Proxmox (SSH agressif, Proxmox UI 8006, ProxMenux Monitor 8008). Inclut le correctif journald MaxLevelStore, des services de journalisation personnalisés pour plus de fiabilité, un backend nftables/iptables détecté automatiquement et le renforcement SSH MaxAuthTries.",
+    "ogTitle": "Fail2Ban | Documentation ProxMenux",
+    "ogDescription": "Protection contre la force brute pour SSH et les interfaces web Proxmox, avec des correctifs journald et backend propres à Proxmox."
+  },
+  "header": {
+    "title": "Fail2Ban",
+    "description": "Installe Fail2Ban pour Proxmox : trois jails (SSH agressif, interface Proxmox sur 8006, ProxMenux Monitor sur 8008 et proxy inverse), correction du niveau journald pour conserver les événements SSH, deux services copiant le journal vers des fichiers afin de contourner un problème connu du backend systemd, détection du backend de pare-feu et durcissement SSH avec MaxAuthTries.",
+    "section": "Sécurité"
+  },
+  "intro": {
+    "title": "Ce que ça fait",
+    "body": "Installe Fail2Ban depuis les dépôts Debian et écrit une configuration Proxmox protégeant immédiatement SSH, l'interface web Proxmox et ProxMenux Monitor. Une installation existante est détectée et un menu de gestion propose de réinstaller ou de supprimer."
+  },
+  "firstLaunch": {
+    "heading": "Boîte de dialogue Premier lancement",
+    "body": "Sans Fail2Ban installé, le script résume dans un dialogue ce qu'il va installer et configurer. Annuler quitte sans modification ; confirmer lance l'installation.",
+    "imageAlt": "Confirmation de Fail2Ban avec les trois jails, correction de journald et durcissement SSH"
+  },
+  "jails": {
+    "heading": "Les trois jails",
+    "headerJail": "Jail",
+    "headerProtects": "Protège",
+    "headerRetries": "Tentatives / Fenêtre",
+    "headerBan": "Durée de blocage",
+    "rows": [
+      {
+        "jail": "[sshd]",
+        "protects": "SSH (mode agressif — couvre ddos, mode, normal)",
+        "retries": "2 / 60 min",
+        "ban": "9 heures"
+      },
+      {
+        "jail": "[proxmox]",
+        "protects": "UI web Proxmox (port 8006)",
+        "retries": "3 / 10 min",
+        "ban": "1 heure"
+      },
+      {
+        "jail": "[proxmenux]",
+        "protects": "ProxMenux Monitor (port 8008 + http/https proxy inverse)",
+        "retries": "3 / 10 min",
+        "ban": "1 heure"
+      }
+    ],
+    "outro": "Par défaut mondial à partir de <code>jail.local</code>: <code>ignoreip = 127.0.0.1/8 ::1</code>, <code>ignoreself = true</code>,<code> bantime = 86400</code> (24h pour les prisons qui ne le remplacent pas), <code>maxretry = 2</code>, <code>findtime = 1800</code>."
+  },
+  "journald": {
+    "heading": "Pourquoi la correction de journald est importante",
+    "intro": "Proxmox fournit <code>/etc/systemd/journald.conf</code> avec <codeNw>MaxLevelStore=warning</codeNw>. journald supprime les messages de niveau <em>inférieur</em> à warning avant de les stocker. SSH et PAM signalent les échecs d'authentification aux niveaux <em>info</em> / <em>notice</em>, donc :",
+    "diagram": {
+      "sshLabel": "SSH / PAM",
+      "sshDetail": "échec d'authentification\n(niveau info / notice)",
+      "journaldLabel": "journald",
+      "journaldDetail": "MaxLevelStore=warning\n→ événement ignoré sans avertissement",
+      "fail2banLabel": "Fail2Ban",
+      "fail2banDetail": "ne voit rien\n→ n'interdit jamais rien",
+      "arrowLabel": "Proxmox par défaut"
+    },
+    "afterDiagram": "L'installateur détecte cela et écrit un drop-in à <codeXs>/etc/systemd/journald.conf.d/proxmenux-loglevel.conf</codeXs> élevant à la fois <code>MaxLevelStore</code> et <code>MaxLevelSyslog</code> à <code>info</code>:",
+    "code": "[Journal]\nMaxLevelStore=info\nMaxLevelSyslog=info",
+    "outro": "Puis redémarre <code>systemd-journald</code>. Le drop-in est supprimé lors de la désinstallation, ce qui restaure le Proxmox original par défaut."
+  },
+  "loggers": {
+    "heading": "Pourquoi deux services d'enregistreur personnalisé",
+    "intro1": "Fail2Ban peut lire directement le journal systemd (<code>backend = systemd</code>), mais ce backend présente sur Proxmox des problèmes connus avec les processus de travail de <code>pvedaemon</code> : les événements d'authentification apparaissent dans le journal sans être toujours détectés. Le problème concerne aussi parfois <code>sshd</code>.",
+    "intro2": "ProxMenux crée deux petits services systemd qui suivent les unités concernées avec <code>journalctl -f</code> et ajoutent chaque ligne à un fichier. Fail2Ban lit ces fichiers avec le fiable <code>backend = auto</code> (mode fichier) :",
+    "headerService": "Services",
+    "headerSource": "Unité source",
+    "headerOutput": "Fichier de sortie",
+    "rows": [
+      {
+        "service": "proxmox-auth-logger.service",
+        "source": "pvedaemon.service",
+        "output": "/var/log/proxmox-auth.log"
+      },
+      {
+        "service": "ssh-auth-logger.service",
+        "source": "ssh.service",
+        "output": "/var/log/ssh-auth.log"
+      }
+    ],
+    "outro": "Les deux services sont déclarés <code>PartOf=fail2ban.service</code> donc ils redémarrent avec Fail2Ban et s'arrêtent avec elle. Mode 640 appartenant à <code>root:adm</code> dans les fichiers journaux. Le troisième journal utilisé par la prison <code>[proxmenux]</code> (<code>/var/log/proxmenux-auth.log</code>) est écrit directement par l'application ProxMenux Monitor Flask — aucun service d'enregistreur nécessaire pour celui-ci."
+  },
+  "backend": {
+    "heading": "Détection du backend de pare-feu",
+    "intro": "L'installateur sonde l'hôte : si <code>nft list ruleset</code> fonctionne, il choisit <code>nftables</code> comme mesure d'interdiction. Sinon, il revient à <code>iptables-multiport</code> / <code>iptables-allports</code>. Le choix est écrit dans <code>jail.local</code> :",
+    "code": "# nftables host\nbanaction = nftables\nbanaction_allports = nftables[type=allports]\n\n# iptables host (fallback)\nbanaction = iptables-multiport\nbanaction_allports = iptables-allports"
+  },
+  "hardening": {
+    "heading": "Durcissement SSH : MaxAuthTries",
+    "intro": "Le contrôle Lynis <strong>SSH-7408</strong> recommande <code>MaxAuthTries 3</code> dans <code>sshd_config</code>. La jail SSH utilise <code>maxretry = 2</code> pour bloquer après des échecs répétés ; MaxAuthTries limite les tentatives dans une connexion. Ce réglage SSH ajoute une défense en profondeur, y compris lorsque Fail2Ban est arrêté pour maintenance.",
+    "installerIntro": "L'installateur:",
+    "items": [
+      "Lit la valeur actuelle <code>MaxAuthTries</code> (ou par défaut 6 si elle est absente).",
+      "Enregistre-le dans <code>/usr/local/share/proxmenux/sshd_maxauthtries_backup</code>.",
+      "Modifie <code>sshd_config</code> sur place : remplace la ligne existante, décommente une ligne commentée ou ajoute une nouvelle ligne.",
+      "Recharge <code>sshd</code> (recharger, pas redémarrer, pour garder les sessions existantes en vie)."
+    ],
+    "outro": "Lors de la désinstallation, la valeur originale enregistrée est restaurée et <code>sshd</code> est rechargée."
+  },
+  "manage": {
+    "heading": "Gérer une installation existante",
+    "intro": "Si Fail2Ban est déjà installé lorsque vous ouvrez le menu, le script le détecte et affiche un menu de gestion au lieu de ré-exécuter l'installateur:",
+    "headerAction": "Décision",
+    "headerWhat": "Ce qu'il fait",
+    "rows": [
+      {
+        "action": "Réinstaller",
+        "what": "Relance l'installation complète et réécrit toutes les jails avec les valeurs actuelles de ProxMenux. À utiliser lorsqu'une mise à jour modifie les recommandations."
+      },
+      {
+        "action": "Supprimer",
+        "what": "Arrête fail2ban et les deux services d'enregistrement, purge le package apt, supprime tous les fichiers jail/filtre, supprime le drop-in journald (restauration de la valeur par défaut de Proxmox) et restaure l'original SSH MaxAuthTries."
+      }
+    ]
+  },
+  "verify": {
+    "heading": "Vérifiez que ça marche.",
+    "intro": "Après l'installation, commandes utiles de l'hôte:",
+    "code": "# Service status and version\nsystemctl status fail2ban\nfail2ban-client --version\n\n# All active jails\nfail2ban-client status\n\n# Detail on one jail\nfail2ban-client status sshd\nfail2ban-client status proxmox\nfail2ban-client status proxmenux\n\n# Currently banned IPs in a jail\nfail2ban-client status sshd | grep \"Banned IP\"\n\n# Manually unban an IP (use this if you ban yourself)\nfail2ban-client unban 192.0.2.10\n\n# Tail the auth logs Fail2Ban watches\ntail -f /var/log/ssh-auth.log\ntail -f /var/log/proxmox-auth.log\ntail -f /var/log/fail2ban.log"
+  },
+  "troubleshoot": {
+    "heading": "Dépannage",
+    "neverBansTitle": "Fail2Ban fonctionne mais n'interdit jamais rien",
+    "neverBansBody": "Vérifiez que <code>tail -f /var/log/ssh-auth.log</code> reçoit une entrée après une tentative SSH avec un mauvais mot de passe depuis une autre machine. Sinon, examinez <code>systemctl status ssh-auth-logger.service</code>. Si le service est actif, consultez les événements récents avec <code>journalctl -u ssh.service -n 50 --no-pager -p info</code> et vérifiez que le complément journald autorise le niveau <em>info</em>.",
+    "monitorEmptyTitle": "La jail ProxMenux Monitor ne contient aucune entrée malgré des connexions échouées",
+    "monitorEmptyBody": "Le <code>[proxmenux]</code> jail lit <code>/var/log/proxmenux-auth.log</code>, qui est écrit par l'application ProxMenux Monitor Flask — et non par un enregistreur journald. Si vous n'exécutez pas le moniteur, le fichier reste vide et le jail ne se déclenche jamais. C'est prévu ; la configuration jail est inoffensive. Si vous exécutez le moniteur et que le journal est vide, vérifiez la configuration de journalisation Flask.",
+    "selfBanTitle": "Je me suis bloqué moi-même",
+    "selfBanIntro": "À partir d'une console / IPMI / iKVM (ou d'une autre IP sur liste blanche):",
+    "selfBanCode": "fail2ban-client unban '<'YOUR_IP'>'\n\n# To prevent it next time, edit /etc/fail2ban/jail.local and add your IP:\nignoreip = 127.0.0.1/8 ::1 192.168.1.0/24 203.0.113.42\n\n# Then reload\nfail2ban-client reload",
+    "aptFailTitle": "Échec d'apt-get : ''Unable to locate package fail2ban''",
+    "aptFailBody": "Les dépôts Debian manquent sur l'hôte (fréquent sur les installations Proxmox minimales). L'installateur crée <code>/etc/apt/sources.list.d/debian.sources</code> avec le bon nom de code (<code>bookworm</code> / <code>trixie</code>), puis réessaie. Si cela échoue encore, vérifiez <code>VERSION_CODENAME</code> dans <code>/etc/os-release</code> et l'accessibilité du dépôt.",
+    "lockoutTitle": "SSH me verrouille après l'installation",
+    "lockoutBody": "L'installateur définit <code>MaxAuthTries=3</code>. Si votre gestionnaire de mot de passe / agent récupère plusieurs clés, vous pouvez dépasser cela sur une seule tentative de connexion. Limiter les clés offertes : <code>ssh -o IdentitiesOnly=yes -i ~/.ssh/specific_key user@host</code>. Ou augmenter temporairement <code>MaxAuthTries</code> en <code>sshd_config</code> pendant le débogage."
+  },
+  "files": {
+    "heading": "Fichiers écrits",
+    "code": "/etc/fail2ban/jail.local                              # global defaults + [sshd]\n/etc/fail2ban/jail.d/proxmox.conf                     # [proxmox]\n/etc/fail2ban/jail.d/proxmenux.conf                   # [proxmenux]\n/etc/fail2ban/filter.d/proxmox.conf                   # auth-failure regex for pvedaemon\n/etc/fail2ban/filter.d/proxmenux.conf                 # auth-failure regex for Monitor\n/etc/systemd/system/proxmox-auth-logger.service       # journal → file (pvedaemon)\n/etc/systemd/system/ssh-auth-logger.service           # journal → file (sshd)\n/etc/systemd/journald.conf.d/proxmenux-loglevel.conf  # MaxLevelStore=info\n/etc/ssh/sshd_config                                  # MaxAuthTries=3 (in-place edit)\n/var/log/proxmox-auth.log                             # written by logger service\n/var/log/ssh-auth.log                                 # written by logger service\n/var/log/proxmenux-auth.log                           # written by Monitor Flask app\n/usr/local/share/proxmenux/sshd_maxauthtries_backup   # for restore on uninstall"
+  },
+  "related": {
+    "heading": "Autres",
+    "monitorLabel": "ProxMenux Monitor → Onglet Sécurité",
+    "monitorTail": " — installation depuis le tableau de bord, état des jails en direct, IP bloquées et réglage des tentatives et de la durée de blocage par jail dans le navigateur.",
+    "lynisLabel": "Lynis",
+    "lynisTail": " — lancer un audit avant et après pour vérifier que le contrôle SSH-7408 est satisfait.",
+    "securityLabel": "Aperçu de la sécurité",
+    "securityTail": "— retour à l'aperçu de la section."
+  }
+}
diff --git a/web/messages/fr/docs/security/index.json b/web/messages/fr/docs/security/index.json
new file mode 100644
index 00000000..a1d70fe2
--- /dev/null
+++ b/web/messages/fr/docs/security/index.json
@@ -0,0 +1,70 @@
+{
+  "meta": {
+    "title": "Sécurité Proxmox — Fail2Ban et audit de durcissement Lynis | ProxMenux",
+    "description": "Deux outils de sécurité installables pour Proxmox VE : Fail2Ban (prévention des intrusions pour SSH, l'interface web Proxmox et ProxMenux Monitor) et Lynis (audit de sécurité et de durcissement installé depuis le dépôt officiel GitHub).",
+    "ogTitle": "Sécurité Proxmox — Fail2Ban et audit de durcissement Lynis",
+    "ogDescription": "Fail2Ban et Lynis pour Proxmox VE : prévention des intrusions et audit de durcissement, installés et gérés par ProxMenux.",
+    "twitterTitle": "Sécurité Proxmox | ProxMenux",
+    "twitterDescription": "Fail2Ban et Lynis pour Proxmox VE : prévention des intrusions et audit de durcissement."
+  },
+  "header": {
+    "title": "Sécurité",
+    "description": "Deux outils complémentaires pour Proxmox VE : défense active (Fail2Ban bloque les IP attaquant SSH ou les interfaces web) et audit local (Lynis cherche les lacunes de durcissement et donne un score de 0 à 100). Chaque outil possède son menu d'installation et de gestion, qui détecte une installation existante avant toute action.",
+    "section": "Sécurité"
+  },
+  "intro": {
+    "title": "Défense active et audit local",
+    "body": "Ils répondent à des questions différentes. <strong>Fail2Ban</strong> répond à <em>« Sommes-nous attaqués en ce moment ? »</em> en surveillant les journaux d'authentification et en bloquant les IP responsables. <strong>Lynis</strong> répond à <em>« Quel est le niveau de durcissement de cet hôte ? »</em> par un audit ponctuel avec des recommandations concrètes. Utilisez les deux : Lynis indique les améliorations, Fail2Ban réagit aux attaques en cours."
+  },
+  "opening": {
+    "heading": "Ouverture du menu",
+    "body": "Dans le menu principal ProxMenux, sélectionnez <strong>Sécurité</strong>. Voici ce qui apparaît :",
+    "imageAlt": "Menu de sécurité avec options Fail2Ban et Lynis"
+  },
+  "pick": {
+    "heading": "Choisissez votre outil",
+    "body": "Les deux outils sont indépendants : installez-en un, les deux ou aucun. Chaque carte ci-dessous mène à la section détaillant cet outil."
+  },
+  "cards": {
+    "fail2ban": {
+      "title": "Fail2Ban",
+      "body": "Prévention active des intrusions. Surveille les journaux d'authentification SSH et web et bloque les IP après des échecs répétés.",
+      "bullets": [
+        "Trois jails : SSH, interface Proxmox (8006), ProxMenux Monitor (8008)",
+        "Corrige les paramètres journald de Proxmox qui bloquent les journaux d'authentification",
+        "Auto-détecte nftables / iptables",
+        "SSH durcissement: MaxAuthTries=3 (recommandation Lynis)"
+      ]
+    },
+    "lynis": {
+      "title": "Lynis",
+      "body": "Auditeur de sécurité local. Analyse l'hôte et affiche un score de durcissement et des conseils concrets pour corriger les problèmes.",
+      "bullets": [
+        "Installé depuis le dépôt officiel CISOfy sur GitHub (dernière version)",
+        "Score de durcissement 0–100 et liste des avertissements et suggestions",
+        "Audit et mise à jour depuis le menu",
+        "Conçu en lecture seule : ne modifie jamais le système"
+      ]
+    }
+  },
+  "workflowTip": {
+    "title": "Flux de travail qui utilise les deux",
+    "body": "Lancez d'abord Lynis pour connaître le score initial et les recommandations principales. Appliquez les corrections souhaitées. Installez ensuite Fail2Ban : il met automatiquement en place la protection SSH contre la force brute et ajuste <code>MaxAuthTries</code> dans <code>sshd_config</code> pour satisfaire le contrôle SSH-7408. Relancez Lynis pour vérifier l'amélioration."
+  },
+  "fail2banSection": {
+    "heading": "Fail2Ban",
+    "body": "ProxMenux installe Fail2Ban avec une configuration adaptée à Proxmox. En plus de la jail SSH standard, il protège l'interface web Proxmox et ProxMenux Monitor. Il contourne deux problèmes spécifiques : un paramètre journald supprimant les événements d'authentification et un problème du backend systemd empêchant la lecture fiable de certaines sources du journal. La page détaillée explique l'installation, les trois jails, la correction de journald, le durcissement SSH et le dépannage.",
+    "optionTitle": "Fail2Ban — installer et gérer",
+    "optionDescription": "Trois jails préconfigurées (sshd agressif, interface Proxmox sur 8006, ProxMenux Monitor sur 8008 et proxy inverse), détection de nftables/iptables, correction de journald et durcissement SSH avec MaxAuthTries."
+  },
+  "lynisSection": {
+    "heading": "Lynis",
+    "body": "ProxMenux clone Lynis depuis <code>github.com/CISOfy/lynis</code> dans <code>/opt/lynis</code> et le rend accessible par <code>/usr/local/bin/lynis</code>. Le paquet Debian est volontairement évité car il accuse plusieurs versions majeures de retard sur le projet original. La page détaillée explique installation, audit, mise à jour, désinstallation, lecture du rapport et traitement des résultats.",
+    "optionTitle": "Lynis — installation, audit et gestion",
+    "optionDescription": "Installe le dernier Lynis de la repo officielle CISOfy GitHub (pas l'ancien paquet Debian), exécute des audits système avec score de durcissement, et des mises à jour via git pull."
+  },
+  "componentStatus": {
+    "heading": "État des composantes",
+    "body": "Les deux installateurs enregistrent leur état en <code>/usr/local/share/proxmenux/components_status.json</code> dans la catégorie <code>security</code>. ProxMenux utilise ce fichier pour décider s'il faut afficher l'installation ou le menu de gestion lors d'exécutions ultérieures, et les mêmes données alimentent les tableaux de bord dans le ProxMenux Monitor lorsqu'elles sont présentes."
+  }
+}
diff --git a/web/messages/fr/docs/security/lynis.json b/web/messages/fr/docs/security/lynis.json
new file mode 100644
index 00000000..5b9a5b43
--- /dev/null
+++ b/web/messages/fr/docs/security/lynis.json
@@ -0,0 +1,170 @@
+{
+  "meta": {
+    "title": "Lynis | Documentation ProxMenux",
+    "description": "Installez la dernière version de Lynis depuis le dépôt officiel CISOfy sur GitHub, lancez un audit avec score de durcissement de 0 à 100 et mettez à jour par git pull. Auditeur en lecture seule, sans modification du système.",
+    "ogTitle": "Lynis | Documentation ProxMenux",
+    "ogDescription": "Installez et exécutez Lynis sur Proxmox VE. Installation depuis le dépôt GitHub officiel, audit et mise à jour."
+  },
+  "header": {
+    "title": "Lynis",
+    "description": "Clone la dernière version de Lynis depuis le dépôt officiel CISOfy sur GitHub, la rend disponible par /usr/local/bin/lynis et propose audit, mise à jour, réinstallation et désinstallation dans le menu. L'auditeur est en lecture seule : il rapporte sans modifier le système.",
+    "section": "Sécurité"
+  },
+  "intro": {
+    "title": "Ce que ça fait",
+    "body": "Installe Lynis, l'auditeur de sécurité libre de CISOfy, depuis son dépôt GitHub dans <code>/opt/lynis</code> et crée un script de lancement dans <code>/usr/local/bin/lynis</code> pour le rendre accessible dans <code>PATH</code>. Une installation existante ouvre un menu d'audit, mise à jour, réinstallation ou suppression."
+  },
+  "manageMenu": {
+    "heading": "Menu de gestion (après installation)",
+    "intro": "Une fois que Lynis est installé, chaque invocation subséquente ouvre le menu de gestion au lieu de relancer l'installateur. De là vous lancez un audit, mise à jour via git pull, réinstaller ou désinstaller:",
+    "imageAlt": "Lynis menu de gestion avec audit, mise à jour, réinstaller et supprimer les options"
+  },
+  "whyUpstream": {
+    "heading": "Pourquoi le dépôt officiel GitHub plutôt qu'apt",
+    "intro": "Debian fournit Lynis via apt, mais le paquet accuse généralement plusieurs versions majeures de retard. Les nouveaux contrôles, correctifs pour de nouveaux vecteurs d'attaque et recommandations améliorées arrivent d'abord sur GitHub. Lynis est un script shell autonome, sans compilation ni dépendance d'installation au-delà de <code>git</code> ; cloner le dépôt est donc la méthode recommandée par CISOfy.",
+    "headerSource": "Source",
+    "headerPath": "Install path",
+    "headerUpdate": "Méthode de mise à jour",
+    "headerFresh": "Actualité de la version",
+    "rows": [
+      {
+        "sourceRich": "<strong>ProxMenux (ce script)</strong>",
+        "path": "/opt/lynis/",
+        "update": "git pull (depuis le menu)",
+        "fresh": "Dernière version du projet original"
+      },
+      {
+        "sourceRich": "<strong>Debian apt</strong>",
+        "path": "/usr/bin/lynis",
+        "update": "apt upgrade",
+        "fresh": "Souvent mois / années de retard"
+      }
+    ]
+  },
+  "install": {
+    "heading": "Comment fonctionne l'installation",
+    "node1Label": "github.com/CISOfy/lynis",
+    "node1Detail": "git clone\n(installer git d'abord si nécessaire)",
+    "node2Label": "/opt/lynis/",
+    "node2Detail": "dépôt complet\ny compris le script ./lynis",
+    "node3Label": "/usr/local/bin/lynis",
+    "node3Detail": "script de lancement :\ncd /opt/lynis && ./lynis $@",
+    "outro": "Le lanceur est nécessaire : Lynis doit être exécuté depuis son propre répertoire pour charger les chemins relatifs des plugins et des profils. Le lanceur masque ce détail et permet à <code>lynis audit system</code> de fonctionner depuis n'importe quel répertoire."
+  },
+  "detection": {
+    "heading": "Voies de détection",
+    "intro": "Avant d'afficher le menu, le script vérifie trois emplacements pour déterminer si Lynis est déjà présent :",
+    "items": [
+      "<code>/usr/local/bin/lynis</code> — enveloppe installée par ProxMenux",
+      "<code>/opt/lynis/lynis</code> — chemin direct (au cas où l'emballage serait enlevé)",
+      "<code>/usr/bin/lynis</code> — version apt-installée, si l'utilisateur l'a installé de cette façon précédemment"
+    ],
+    "outro": "Si un de ces chemins existe, le menu de gestion s'ouvre. Le script ne désinstalle <strong>pas</strong> un Lynis installé par apt, uniquement celui qu'il gère dans <code>/opt/lynis</code> et son lanceur."
+  },
+  "audit": {
+    "heading": "Exécuter un audit",
+    "intro": "Dans le menu de gestion, choisissez <strong>Lancer l'audit de sécurité maintenant</strong>. Cela revient à exécuter :",
+    "code": "lynis audit system --no-colors",
+    "outro": "L'audit prend de 30 secondes à quelques minutes selon la taille de l'hôte. La sortie apparaît directement dans le terminal, sans animation d'attente. Lynis classe les contrôles par catégorie et marque chaque test <ok>[ OK ]</ok>, <warn>[ WARNING ]</warn> ou <sugg>[ SUGGESTION ]</sugg>. Le résumé final affiche les chiffres principaux :",
+    "summary": "================================================================================\n\n  Lynis security scan details:\n\n  Hardening index : 76 [############        ]\n  Tests performed : 247\n  Plugins enabled : 0\n\n  Components:\n  - Firewall               [V]\n  - Malware scanner        [X]\n\n  Lynis modules:\n  - Compliance status      [?]\n  - Security audit         [V]\n  - Vulnerability scan     [V]\n\n================================================================================"
+  },
+  "report": {
+    "heading": "Lire le rapport",
+    "intro": "Les deux sections importantes sont <strong>Avertissements</strong> (les choses que vous devriez fixer bientôt) et <strong>Suggestions</strong> (recommandations pour améliorer le durcissement). Chaque élément porte un ID de contrôle comme <code>SSH-7408</code> — utile lors de la recherche des documents Lynis pour la justification et la correction.",
+    "headerMarker": "Marqueur",
+    "headerMeaning": "Signification",
+    "headerAction": "Décision",
+    "rows": [
+      {
+        "markerRich": "<strong>OK</strong>",
+        "meaning": "Essai réussi",
+        "action": "Rien"
+      },
+      {
+        "markerRich": "<strong>WARNING</strong>",
+        "meaning": "Problème réel, correction recommandée",
+        "action": "Lire la description du contrôle, planifier une correction"
+      },
+      {
+        "markerRich": "<strong>SUGGESTION</strong>",
+        "meaning": "Amélioration du durcissement disponible",
+        "action": "Appliquer si elle correspond à votre modèle de menace"
+      }
+    ],
+    "outro": "Le rapport complet et les données lisibles par machine sont écrits à <code>/var/log/lynis.log</code> et <code>/var/log/lynis-report.dat</code> par Lynis lui-même."
+  },
+  "pairFail2ban": {
+    "title": "À combiner avec Fail2Ban",
+    "body": "SSH-7408 (MaxAuthTries) est l'un des avertissements les plus courants. L'installation de <link>Fail2Ban</link> à partir de ProxMenux l'élimine automatiquement parce que l'installateur définit <code>MaxAuthTries=3</code> dans le cadre de son processus de durcissement SSH. Lancez Lynis pour confirmer que l'avertissement a disparu."
+  },
+  "update": {
+    "heading": "Mettre à jour Lynis",
+    "body": "Dans le menu, <strong>Mettre Lynis à jour vers la dernière version</strong> exécute <code>git pull --quiet</code> dans <code>/opt/lynis</code>. Si le répertoire n'est pas une copie de travail Git, par exemple après une copie manuelle des fichiers, le script réinstalle entièrement."
+  },
+  "reinstall": {
+    "heading": "Réinstaller / désinstaller",
+    "headerAction": "Décision",
+    "headerWhat": "Ce qu'il fait",
+    "rows": [
+      {
+        "actionRich": "<strong>Réinstaller</strong>",
+        "whatRich": "Supprime <code>/opt/lynis</code>, clone à nouveau depuis GitHub et recrée le lanceur. À utiliser si la copie locale est endommagée."
+      },
+      {
+        "actionRich": "<strong>Supprimer</strong>",
+        "whatRich": "Supprime <code>/opt/lynis</code> et <code>/usr/local/bin/lynis</code>. Conserve les journaux <code>/var/log/lynis*</code> comme historique des audits. Un Lynis installé par apt dans <code>/usr/bin/lynis</code> reste intact."
+      }
+    ]
+  },
+  "cli": {
+    "heading": "Options utiles CLI",
+    "intro": "Une fois installé, Lynis peut être invoqué directement à partir d'un shell avec des options supplémentaires non exposées par le menu:",
+    "code": "lynis show version            # version + build date\nlynis show commands           # list every available command\nlynis show details TEST-ID    # explain a specific control\nlynis audit system --quick    # skip slow tests (e.g. malware scan)\nlynis audit system --pentest  # treat host as untrusted (more aggressive)\nlynis update info             # check if a newer Lynis is available\n\n# Filter the report log for just the warnings\ngrep \"Warning\" /var/log/lynis.log\n\n# Same, for suggestions only\ngrep \"Suggestion\" /var/log/lynis.log"
+  },
+  "troubleshoot": {
+    "heading": "Dépannage",
+    "cloneTitle": "git clone échoue lors de l'installation",
+    "cloneBody": "L'hôte a besoin d'un accès réseau et DNS pour atteindre <code>github.com</code>. Depuis une console : <code>curl -sI https://github.com</code> et <code>git ls-remote https://github.com/CISOfy/lynis.git</code> révèlent l'erreur réelle (DNS, TLS, proxy, repo URL). Si un proxy est requis, définissez <code>https_proxy</code> dans l'environnement avant de ré-exécuter le menu.",
+    "notFoundTitle": "lynis: commande introuvable après installation",
+    "notFoundIntro": "Le lanceur <code>/usr/local/bin/lynis</code> n'a pas été créé ou a été supprimé. La solution la plus rapide est de réinstaller depuis le menu. Correction manuelle :",
+    "notFoundCode": "cat > /usr/local/bin/lynis <<'EOF'\n#!/bin/bash\ncd /opt/lynis && ./lynis \"$@\"\nEOF\nchmod +x /usr/local/bin/lynis",
+    "sshTitle": "L'audit affiche \"Warning: Test SSH-7408 — MaxAuthTries set incorrectly\"",
+    "sshIntro": "Le démon SSH permet trop de tentatives d'auth par connexion. Soit installer <link>Fail2Ban</link> à partir de ProxMenux (qui définit <code>MaxAuthTries=3</code> automatiquement) soit éditer <code>/etc/ssh/sshd_config</code> à la main:",
+    "sshCode": "sed -i 's/^#?MaxAuthTries.*/MaxAuthTries 3/' /etc/ssh/sshd_config\nsystemctl reload sshd",
+    "scoreTitle": "Le score a baissé après une mise à niveau Proxmox",
+    "scoreBody": "Exécutez <code>lynis update info</code> d'abord — une mise à jour de Lynis peut avoir ajouté de nouvelles commandes qui annoncent la configuration existante. Mettre à jour Lynis dans le menu, revérifier et traiter des nouvelles constatations."
+  },
+  "files": {
+    "heading": "Fichiers écrits",
+    "code": "/opt/lynis/                   # full Lynis git checkout\n/usr/local/bin/lynis          # wrapper script (cd + exec)\n/var/log/lynis.log            # human-readable audit log (Lynis itself)\n/var/log/lynis-report.dat     # machine-readable report (Lynis itself)"
+  },
+  "sample": {
+    "heading": "Exemple de rapport",
+    "intro": "ProxMenux Monitor produit pour chaque exécution de Lynis un PDF de plusieurs pages depuis l'<link>onglet Sécurité</link>. La première page résume score de durcissement, informations système et état de sécurité. Les suivantes détaillent les avertissements, les suggestions classées par impact et l'inventaire des paquets utilisé lors de l'audit.",
+    "imageAlt": "Première page du rapport d'audit de sécurité de Lynis PDF — résumé avec l'index de durcissement 71/100, bloc d'information système, et vue d'ensemble de la posture de sécurité avec pare-feu, scanner de malware et les paquets installés",
+    "captionPrefix": "Première page d'un exemple de rapport. Le PDF complet (",
+    "captionLink": "échantillon",
+    "captionSuffix": ") continue avec des avertissements détaillés, des suggestions et la liste des paquets installés.",
+    "cli": "Sur le côté CLI les mêmes données sont dans <code>/var/log/lynis-report.dat</code> (fichier plat lisible par machine) et <code>/var/log/lynis.log</code> (le journal d'exécution lisible par l'homme). Le PDF est généré sur demande par ProxMenux Monitor — l'exécution de <code>lynis</code> à partir de la ligne de commande n'en produit pas."
+  },
+  "related": {
+    "heading": "Autres",
+    "items": [
+      {
+        "href": "/docs/monitor/dashboard/security",
+        "label": "ProxMenux Monitor → Onglet Sécurité",
+        "tail": "— exécuter l'audit, parcourir les rapports historiques et télécharger le PDF directement à partir du tableau de bord."
+      },
+      {
+        "href": "/docs/security/fail2ban",
+        "label": "Fail2Ban",
+        "tailRich": "— met en œuvre la protection de la force brute SSH que recommande Lynis."
+      },
+      {
+        "href": "/docs/security",
+        "label": "Aperçu de la sécurité",
+        "tail": "— retour à l'aperçu de la section."
+      }
+    ]
+  }
+}
diff --git a/web/messages/fr/docs/security/ssl-letsencrypt.json b/web/messages/fr/docs/security/ssl-letsencrypt.json
new file mode 100644
index 00000000..7ee2fe14
--- /dev/null
+++ b/web/messages/fr/docs/security/ssl-letsencrypt.json
@@ -0,0 +1,169 @@
+{
+  "meta": {
+    "title": "HTTPS pour ProxMenux Monitor — certificat de l'hôte Proxmox ou chemins personnalisés | ProxMenux",
+    "description": "Servez ProxMenux Monitor en HTTPS avec le certificat de l'hôte Proxmox (détecté automatiquement, y compris le certificat Let’s Encrypt installé via ACME de Proxmox) ou un certificat personnalisé à un emplacement quelconque sur disque.",
+    "ogTitle": "HTTPS pour ProxMenux Monitor — Hôte Proxmox ou certificat personnalisé",
+    "ogDescription": "Activer HTTPS sur le port 8008 avec le certificat hôte Proxmox ou toute paire de .pem / .key personnalisée."
+  },
+  "header": {
+    "title": "HTTPS pour ProxMenux Monitor",
+    "description": "Activez HTTPS pour Monitor sur le port 8008 avec le certificat de l'hôte Proxmox détecté automatiquement ou un certificat personnalisé sur disque. L'option Proxmox privilégie le certificat ACME, s'il existe, et réutilise Let’s Encrypt géré par Proxmox sans tâche de renouvellement supplémentaire.",
+    "section": "Sécurité"
+  },
+  "intro": {
+    "title": "Ce que cette page couvre",
+    "body": "Comment changer le moniteur de HTTP à HTTPS dans le panneau Paramètres → Sécurité, ce que chaque source de certificat pointe en fait sur le disque, comment l'option Proxmox se comporte quand l'hôte a un cert Let's Encrypt et comment définir des chemins personnalisés si vous gérez des certs en dehors de Proxmox."
+  },
+  "wheresetting": {
+    "heading": "Emplacement du réglage",
+    "body": "Ouvrez Monitor et allez dans <strong>Paramètres → Sécurité → HTTPS / SSL</strong>. Le panneau affiche HTTP ou HTTPS et, si HTTPS est désactivé, les sources de certificats détectées.",
+    "imageAlt": "Paramètres → Sécurité → Panneau HTTPS / SSL dans le moniteur montrant l'état HTTPS-off, le certificat Proxmox détecté automatiquement (sujet, émetteur, expiration) et l'option Utiliser un certificat personnalisé",
+    "caption": "Panneau Paramètres → Sécurité → HTTPS / SSL avant activation. Monitor affiche le certificat utilisé par Proxmox et permet de le choisir en un clic."
+  },
+  "twoways": {
+    "heading": "Deux façons d'activer HTTPS",
+    "proxmox": {
+      "title": "Utiliser le certificat Proxmox",
+      "summary": "Un clic : Monitor réutilise le certificat présenté par Proxmox VE sur le port 8006.",
+      "items": [
+        "Détecté automatiquement, aucun chemin à saisir",
+        "Privilégie le certificat ACME s'il existe, sinon le certificat autosigné par défaut",
+        "Proxmox renouvelle ; Monitor valide et charge le certificat à la prochaine nouvelle connexion TLS"
+      ]
+    },
+    "custom": {
+      "title": "Utiliser un certificat personnalisé",
+      "summaryRich": "Pointez le moniteur sur une paire <code>.pem</code> / <code>.key</code> n'importe où sur le disque.",
+      "items": [
+        "Chemins absolus seulement (le processus Monitor doit pouvoir lire les deux)",
+        "Utile lorsque les certificats proviennent de <code>certbot</code>, <code>acme.sh</code> ou d'un wildcard",
+        "Vous gérez le renouvellement : redémarrez Monitor après modification des fichiers"
+      ]
+    }
+  },
+  "proxmoxCert": {
+    "heading": "Certificat Proxmox — ce qu'il indique en réalité à",
+    "intro": "Proxmox VE conserve deux paires de certificats dans <code>/etc/pve/local/</code> :",
+    "table": {
+      "headers": {
+        "file": "Fichier",
+        "origin": "Origine",
+        "when": "Lorsque le moniteur l'utilise"
+      },
+      "rows": [
+        {
+          "fileRich": "<code>pveproxy-ssl.pem</code><br /><code>pveproxy-ssl.key</code>",
+          "originRich": "Certificat personnalisé téléchargé via l'interface utilisateur Proxmox — y compris le certificat Let's Encrypt émis sous <em>Datacenter → Node → Certificats → ACME</em>.",
+          "when": "Préféré si les deux fichiers existent ; Monitor utilise le certificat présenté par Proxmox."
+        },
+        {
+          "fileRich": "<code>pve-ssl.pem</code><br /><code>pve-ssl.key</code>",
+          "originRich": "Certificat autosigné généré au moment de l'installation par l'ICP Proxmox.",
+          "whenRich": "Certificat de repli en l'absence de <code>pveproxy-ssl.pem</code>."
+        }
+      ]
+    },
+    "callout": {
+      "title": "Même priorité que Proxmox",
+      "bodyRich": "<code>pveproxy</code> applique la même sélection. Avec l'option Proxmox, Monitor utilise le certificat présenté par l'interface Proxmox sur 8006, sans copie ni processus de renouvellement séparé."
+    }
+  },
+  "letsencrypt": {
+    "heading": "Obtenir un certificat Let's Encrypt via Proxmox ACME",
+    "intro": "Proxmox VE inclut son client ACME. <em>« Order Certificate Now »</em> enregistre le résultat dans <code>/etc/pve/local/pveproxy-ssl.pem</code>, lu par Monitor. Les cinq étapes suivantes résument le <extlink1>guide officiel Proxmox</extlink1> avec les commandes nécessaires.",
+    "prereqs": {
+      "title": "Préalables",
+      "items": [
+        "Le noeud a un vrai nom DNS (pas seulement un IP) pointant dessus.",
+        "<strong>Soit</strong> le port 80 accessible depuis Internet (validation HTTP-01, la plus simple), <strong>soit</strong> un fournisseur DNS avec identifiants API (DNS-01, fonctionne derrière NAT et accepte les certificats génériques).",
+        "Une adresse email pour le compte ACME."
+      ]
+    },
+    "step1": {
+      "heading": "Étape 1 — Enregistrer le compte ACME",
+      "introRich": "Remplacer le courriel par le vôtre. Le nom de compte <code>default</code> n'est qu'une étiquette — vous pouvez utiliser n'importe quelle chaîne.",
+      "code": "pvenode acme account register default you@example.com",
+      "afterRich": "Proxmox vous invite à accepter les termes de service Let's Encrypt. Après cela, le compte est maintenu sous <code>/etc/pve/priv/acme/</code> et l'onglet ACME dans l'interface graphique l'affichera."
+    },
+    "step2": {
+      "heading": "Étape 2 — Choisir un type de défi",
+      "http01Rich": "<strong>HTTP-01</strong> est le plus facile : il est intégré, pas de plugin supplémentaire. Let's Encrypt se connecte à <code>http://&lt;your-host&gt;/.well-known/acme-challenge/...</code> sur le port 80, de sorte que le port 80 doit être ouvert de l'Internet public à votre noeud — généralement un port vers l'avant sur votre routeur.",
+      "dns01Rich": "<strong>DNS-01</strong> fonctionne sans exposer le port 80 (bon pour les homelabs derrière CG-NAT) et est la seule option pour les certificats wildcard. Vous ajoutez un plugin DNS une fois avec le jeton API de votre fournisseur. Exemple Cloudflare:",
+      "code": "pvenode acme plugin add dns cf \\\n  --api cloudflare \\\n  --data CF_Token=YOUR_CLOUDFLARE_API_TOKEN",
+      "outroRich": "Pour d'autres fournisseurs (Gandi, OVH, AWS Route 53, etc.), consultez <code>pvenode acme plugin add dns --help</code>. Proxmox inclut <extlink2>tous les plugins DNS acme.sh</extlink2>."
+    },
+    "step3": {
+      "heading": "Étape 3 — Relier le domaine à votre nœud",
+      "http01Rich": "Pour HTTP-01 (utilise le plugin <code>standalone</code> intégré):",
+      "code1": "pvenode config set --acme domains=host.example.com,account=default",
+      "dns01": "Pour DNS-01 avec le plugin Cloudflare de l'étape 2 :",
+      "code2": "pvenode config set --acmedomain0 domain=host.example.com,plugin=cf\npvenode config set --acme account=default",
+      "wildcardRich": "Certificat générique ? Ajoutez <code>domain=*.example.com</code> dans une entrée séparée <code>--acmedomainN</code>. Les certificats génériques nécessitent DNS-01."
+    },
+    "step4": {
+      "heading": "Étape 4 — Commander le certificat",
+      "code": "pvenode acme cert order",
+      "afterRich": "Le premier tour prend généralement 30–60 secondes pendant que le défi se propage. Sur succès Proxmox écrit <code>/etc/pve/local/pveproxy-ssl.pem</code> + <code>.key</code>, redémarre <code>pveproxy</code>, et une cron de renouvellement est programmée automatiquement (Let's Encrypt certs sont valides 90 jours; Proxmox renouvelle à 60)."
+    },
+    "step5": {
+      "heading": "Étape 5 — Vérifier l'émetteur",
+      "code": "openssl x509 -in /etc/pve/local/pveproxy-ssl.pem -noout -issuer",
+      "afterRich": "devrait imprimer un émetteur commençant par <code>O = Let's Encrypt</code>. S'il lit plutôt <code>CN = Proxmox Virtual Environment</code> l'ordre a échoué et le fichier est toujours le certificat PVE autosigné — re-exécuter <code>pvenode acme cert order --debug 1</code> pour voir pourquoi."
+    },
+    "gui": {
+      "title": "Vous préférez l'interface utilisateur ? Mêmes cinq étapes",
+      "bodyRich": "<em>Datacenter → ACME</em> enregistre le compte ; <em>Datacenter → ACME → Plugins</em> ajoute le plugin DNS ; <em>Node → Certificates → ACME</em> associe le domaine ; <em>Order Certificates Now</em> exécute l'étape 4. Les commandes précédentes servent à automatiser et à travailler sans interface graphique."
+    }
+  },
+  "switchToHttps": {
+    "heading": "Changez le moniteur en HTTPS",
+    "bodyRich": "Une fois <code>/etc/pve/local/pveproxy-ssl.pem</code> signé par Let's Encrypt, ouvrez <strong>Paramètres → Sécurité → HTTPS / SSL</strong>, vérifiez que l'émetteur est <em>Let's Encrypt</em> et non l'AC locale de Proxmox, puis cliquez sur <strong>Utiliser le certificat Proxmox</strong>. Monitor redémarre et le prochain chargement utilise HTTPS sur 8008 avec une chaîne de confiance publique. Les renouvellements ACME suivants sont validés et sélectionnés à la prochaine nouvelle connexion TLS, sans interrogation périodique ni redémarrage à chaque renouvellement. <strong>Actualiser le certificat</strong> reste disponible dans Sécurité pour le diagnostic et la récupération."
+  },
+  "custom": {
+    "heading": "Certificat personnalisé — quand l'utiliser",
+    "intro": "Cliquez sur <strong>Utiliser un certificat personnalisé</strong> et saisissez deux chemins absolus :",
+    "items": [
+      "<strong>Certificat</strong> — chaîne complète en PEM (<code>.pem</code> ou <code>.crt</code>).",
+      "<strong>Clé privée</strong> : clé correspondante en PEM (<code>.key</code>)."
+    ],
+    "outro": "Les deux fichiers sont lus par le processus Monitor au démarrage. Assurez-vous qu'ils restent lisibles par l'utilisateur que l'unité systemd fonctionne comme (root par défaut). Emplacements communs lorsque l'ACME est géré à l'extérieur de Proxmox:",
+    "code": "# certbot\n/etc/letsencrypt/live/<your-host>/fullchain.pem\n/etc/letsencrypt/live/<your-host>/privkey.pem\n\n# acme.sh\n~/.acme.sh/<your-host>_ecc/fullchain.cer\n~/.acme.sh/<your-host>_ecc/<your-host>.key",
+    "symlinkCallout": {
+      "title": "Symlink cibles vs fichiers",
+      "bodyRich": "<code>certbot</code> stocke les fichiers réels dans <code>/etc/letsencrypt/archive/</code> et le chemin <code>live/</code> est un lien symbolique. Pointez le moniteur sur le lien symbolique <code>live/</code> et non sur le fichier <code>archive/</code> — de cette façon, chaque cycle de renouvellement réécrit simplement la cible de lien symbolique et le moniteur récupère le nouveau certificat au début du service suivant."
+    }
+  },
+  "afterHttps": {
+    "heading": "Après avoir activé HTTPS",
+    "bodyRich": "Enregistrer le changement écrit <code>/etc/proxmenux/ssl_config.json</code> et déclenche un redémarrage de l'unité <code>proxmenux-monitor</code> systemd. L'onglet navigateur perdra sa connexion actuelle — rechargez-la sur <code>https://&lt;host&gt;:8008/</code>. La première charge avec un certificat Let's Encrypt ne doit montrer aucun avertissement; avec le certificat Proxmox autosigné, le navigateur aura besoin d'une exception, la même que pour le port 8006.",
+    "reverse": {
+      "heading": "Proxies inverses et webhooks",
+      "bodyRich": "Lorsque le moniteur passe à HTTPS, les URL Proxmox VE webhook enregistrées pour les notifications retournent automatiquement de <code>http://</code> à <code>https://</code>. Les entrées existantes de webhook sont réécrites la prochaine fois qu'une règle de notification est enregistrée ou redétectée, de sorte qu'aucune modification manuelle de la configuration de notification Proxmox n'est nécessaire."
+    }
+  },
+  "trustCa": {
+    "heading": "Faites confiance à l'AC autosignée Proxmox",
+    "intro1Rich": "Pour conserver le certificat Proxmox par défaut sans ACME, importez l'AC racine du cluster dans le magasin de confiance du système ou du navigateur. Monitor détecte <code>/etc/pve/local/pve-ssl.pem</code> comme certificat de repli. Le client fait alors confiance à l'émetteur ; l'URL doit toujours correspondre à un nom du certificat.",
+    "intro2Rich": "Le fichier CA vit à <code>/etc/pve/pve-root-ca.pem</code> sur chaque nœud. Dans un cluster, le chemin est sur le système de fichiers partagé <code>pmxcfs</code> de sorte que tous les nœuds partagent la même racine, et une seule importation couvre l'ensemble du datacenter. Copiez-le sur votre machine :",
+    "code": "scp root@<your-host>:/etc/pve/pve-root-ca.pem ./pve-root-ca.pem",
+    "thenImport": "Importez-le du côté client :",
+    "items": [
+      "<strong>Linux (tout le système) :</strong> exécutez <code>sudo cp pve-root-ca.pem /usr/local/share/ca-certificates/pve-root-ca.crt</code>, puis <code>sudo update-ca-certificates</code>. Les navigateurs utilisant le magasin système (Chromium, Edge) la reconnaissent après redémarrage ; Firefox utilise son propre magasin et nécessite l'importation manuelle ci-dessous.",
+      "<strong>macOS :</strong> ouvrez le fichier <code>.pem</code> par double-clic dans Trousseaux d'accès, ajoutez-le au trousseau <em>Système</em>, puis choisissez <em>Se fier → Toujours approuver</em>.",
+      "<strong>Windows :</strong> clic droit sur le fichier → <em>Installer le certificat</em> → placez-le dans <em>Autorités de certification racines de confiance</em>.",
+      "<strong>Firefox (tout OS) :</strong> <em>Paramètres → Vie privée et sécurité → Certificats → Afficher les certificats → Autorités → Importer</em> ; cochez <em>Faire confiance à cette AC pour identifier les sites web</em>."
+    ],
+    "standalone": {
+      "title": "Nœuds autonomes en dehors d'un cluster",
+      "bodyRich": "Chaque hôte Proxmox non clustered possède son propre <code>pve-root-ca.pem</code>. Si vous gérez plusieurs hôtes autonomes, répétez la copie/import pour chacun, ou rejoignez-les à un cluster afin qu'ils partagent une seule racine."
+    }
+  },
+  "disable": {
+    "heading": "Désactivation de HTTPS",
+    "bodyRich": "Cliquez sur <strong>Désactiver HTTPS</strong> dans le même panneau. Monitor redémarre en HTTP non chiffré, utile si un certificat personnalisé illisible empêche le démarrage. Aucune désinstallation supplémentaire n'est nécessaire ; les fichiers de certificats restent intacts.",
+    "stateCallout": {
+      "title": "Emplacement de l'état",
+      "bodyRich": "<code>/etc/proxmenux/ssl_config.json</code> stocke les chemins de cert actif et la source (<code>none</code>, <code>proxmox</code>, <code>custom</code>). La suppression du fichier équivaut à la désactivation de HTTPS — le prochain démarrage du moniteur revient à HTTP."
+    }
+  }
+}
diff --git a/web/messages/fr/docs/settings/beta-program.json b/web/messages/fr/docs/settings/beta-program.json
new file mode 100644
index 00000000..b0904365
--- /dev/null
+++ b/web/messages/fr/docs/settings/beta-program.json
@@ -0,0 +1,113 @@
+{
+  "meta": {
+    "title": "Changer le canal de publication | Documentation ProxMenux",
+    "description": "Passez entre les canaux Stable (main) et Beta (develop) de ProxMenux dans un seul dialogue. Bidirectionnel et idempotent ; exécute l'installateur officiel du canal choisi et normalise le service Monitor.",
+    "ogTitle": "Changer le canal de publication | Documentation ProxMenux",
+    "ogDescription": "Une option des Paramètres pour passer entre Stable et Beta sans relancer manuellement les installateurs."
+  },
+  "header": {
+    "title": "Changer le canal de publication",
+    "description": "Une option unique des Paramètres permet de passer entre Stable (branche main) et Beta (branche develop). L'ancienne option à sens unique « Désactiver le programme bêta » est remplacée par un dialogue bidirectionnel proposant les deux sens et exécutant l'installateur officiel du canal choisi.",
+    "section": "Paramètres"
+  },
+  "intro": {
+    "title": "Ce qui a changé",
+    "body": "Les versions précédentes proposaient « Désactiver le programme bêta », visible uniquement en bêta, et une relance manuelle de l'installateur bêta pour y revenir. Ces deux procédures sont réunies dans <strong>Changer le canal de publication</strong>, toujours disponible, qui affiche le canal actuel et permet de passer entre Stable et Beta dans les deux sens."
+  },
+  "why": {
+    "heading": "Pourquoi cette option existe",
+    "intro": "ProxMenux est distribué depuis deux branches Git :",
+    "items": [
+      "<strong>Stable</strong> : la branche <code>main</code>, indiquée par le README et adaptée à la plupart des administrateurs. Les versions sont moins fréquentes et ne contiennent que des changements déjà validés en bêta.",
+      "<strong>Beta</strong> : la branche <code>develop</code>. Fonctions et versions de Monitor plus récentes, avec l'étiquette de la prochaine version stable. Certaines fonctions peuvent présenter des défauts : en choisissant ce canal, vous participez aux tests avant publication."
+    ],
+    "outro": "Auparavant, changer de canal nécessitait de retrouver la bonne URL dans le README et de modifier <code>config.json</code> manuellement en cas de désynchronisation. L'option unifiée réalise tout le processus en une seule action guidée."
+  },
+  "dialog": {
+    "heading": "La boîte de dialogue",
+    "intro": "Dans le menu principal : <strong>Paramètres → Changer le canal de publication</strong>. Un menu à deux lignes apparaît :",
+    "options": [
+      "<code>stable</code> — Stable (branche main)",
+      "<code>beta</code> — Beta (branche develop)"
+    ],
+    "behaviour": "Le canal actuel est présélectionné et affiché en haut. Choisir le même affiche « Ce canal de publication est déjà actif » : le dialogue est idempotent. Choisir un autre canal affiche une confirmation spécifique :",
+    "directions": [
+      "<strong>Stable → Beta:</strong> avertit que les versions bêta peuvent contenir des bogues ou des fonctions incomplètes.",
+      "<strong>Beta → Stable:</strong> avertit que les contrôles de mise à jour bêta s'arrêteront et l'installateur stable réinstallera les composants du canal Stable."
+    ]
+  },
+  "confirm": {
+    "heading": "Que se passe-t-il lorsque vous confirmez",
+    "items": [
+      "<strong>Télécharge l'installateur officiel</strong> du canal cible :<ul><li>Stable : <code>install_proxmenux.sh</code> depuis <code>main</code></li><li>Beta : <code>install_proxmenux_beta.sh</code> depuis <code>develop</code></li></ul>La présence du fichier téléchargé est vérifiée et il est rendu exécutable avant de continuer.",
+      "<strong>Exécute l'installateur complet</strong>, le même que celui indiqué dans le README. La détection des composants, les sauvegardes, les dépendances et la conservation de la langue suivent la procédure officielle d'installation du canal choisi.",
+      "Lors du passage à <strong>Stable</strong>, le menu supprime les métadonnées bêta restantes de <code>config.json</code> : <code>beta_program</code>, <code>beta_version</code>, <code>install_branch</code> et <code>update_available.beta*</code>. <code>proxmenux_monitor.status = beta_updated</code> devient <code>updated</code>. Le fichier résiduel <code>beta_version.txt</code> et les installateurs bêta téléchargés sont supprimés.",
+      "Lors du passage à Stable, le fichier systemd de Monitor est réécrit depuis le modèle Stable : le suffixe « Beta » est retiré de la description et <code>ExecStart</code> pointe vers le répertoire d'exécution. Une nouvelle commande <code>systemctl status</code> reflète ainsi le canal actuel.",
+      "Recharge le menu de configuration. <em>Afficher les informations sur la version</em> indiquera le nouveau canal."
+    ]
+  },
+  "switching": {
+    "heading": "Passage en allers et retours",
+    "intro": "Les deux directions passent par le même programme d'installation – il ne s'agit <strong>pas</strong> de flux de désinstallation et de réinstallation dans des cas particuliers. Chaque direction exécute simplement le propre programme d'installation du canal, qui est conçu pour être idempotent et pouvoir être réexécuté en toute sécurité sur une installation existante. Conséquences pratiques :",
+    "items": [
+      "Votre configuration existante, votre login ProxMenux Monitor (<code>auth.json</code>), les canaux de notification, le registre post-installation, les seuils personnalisés — aucun de ceux-ci n'est touché. Le commutateur de canal échange uniquement l'arborescence de script et le binaire AppImage.",
+      "Un moniteur qui était actif avant que l'interrupteur reste actif après; un moniteur qui a été désactivé reste désactivé.",
+      "Les jetons ProxMenux Monitor <code>auth.json</code>, API et le secret JWT sont conservés à travers les changements de canaux. Les séances ne sont pas déconnectées.",
+      "Vous pouvez retourner les canaux autant de fois que vous le souhaitez — le dialogue l'acceptera à chaque fois et relancera l'installateur. Aucun redémarrage de Proxmox n'est nécessaire.",
+      "Le changement de canal remplace les scripts ProxMenux et ne peut donc pas être exécuté depuis le terminal du navigateur de Monitor : le PTY serait fermé pendant la mise à jour et laisserait le dialogue bloqué. Dans ce terminal, un message affiche à la place la commande officielle en une ligne pour le canal choisi. Exécutez-la depuis SSH ou la console de l'hôte Proxmox."
+    ]
+  },
+  "feedback": {
+    "heading": "Signaler des problèmes de la bêta",
+    "intro": "Si quelque chose se comporte de manière inattendue pendant que vous êtes sur le canal Beta, ouvrir un problème avec suffisamment de contexte est ce qui comble l'écart à une version stable. Le rapport le plus utile comprend:",
+    "items": [
+      "Ce que tu as fait et ce que tu pensais arriver.",
+      "Tout message d'erreur affiché à l'écran.",
+      "Les journaux de surveillance pertinents:"
+    ],
+    "logsCommand": "journalctl -u proxmenux-monitor -n 50 --no-pager",
+    "versionLine": "La version actuelle de ProxMenux (Paramètres → <link>Afficher les informations sur la version</link>).",
+    "issueLine": "Ouvrez un <ghlink>ticket GitHub</ghlink> avec ces informations pour faciliter la correction."
+  },
+  "manual": {
+    "heading": "Équivalent manuel",
+    "intro": "Si vous préférez le shell ou automatisez le changement de canal, le dialogue exécute ces commandes :"
+  },
+  "unifiedCallout": {
+    "title": "Pourquoi les deux directions sont maintenant une option",
+    "body": "L'ancienne option « Désactiver le programme bêta » apparaissait seulement après une participation à la bêta. Pour <em>rejoindre</em> la bêta, il fallait chercher l'installateur ailleurs ; pour la <em>quitter</em>, il fallait parfois nettoyer manuellement les métadonnées <code>beta_*</code>. <strong>Changer le canal de publication</strong> apparaît toujours, indique le canal actuel et traite les deux sens comme une opération exécutable, répétable et idempotente."
+  },
+  "troubleshoot": {
+    "heading": "Dépannage",
+    "downloadTitle": "Impossible de télécharger l'installateur.",
+    "downloadBody": "Le HTTPS à <code>raw.githubusercontent.com</code> a échoué. Vérifiez la connectivité et DNS de l'hôte:",
+    "downloadCmd": "curl -fsSL -o /tmp/test https://raw.githubusercontent.com/MacRimi/ProxMenux/main/install_proxmenux.sh && head -1 /tmp/test",
+    "downloadOutro": "Si cela échoue en dehors de ProxMenux, c'est un problème réseau / proxy sur l'hôte.",
+    "errorsTitle": "L'installation est terminée par des erreurs.",
+    "errorsBody": "L'installateur a renvoyé un code de sortie non nul. Aucun retour arrière automatique n'est prévu : certains fichiers ou composants peuvent déjà avoir changé. Lisez la sortie de l'installateur affichée au-dessus de l'erreur avant d'appuyer sur Entrée et vérifiez l'état actuel, puis réessayez depuis le menu ou lancez l'installateur manuellement par SSH ou depuis la console de l'hôte.",
+    "configTitle": "Impossible de mettre à jour le fichier de configuration après le passage à Stable",
+    "configBody": "Le nettoyage post-installation des métadonnées bêta a échoué — généralement parce que <code>config.json</code> a une erreur de syntaxe d'une modification manuelle. Valider :",
+    "configCmd": "jq . /usr/local/share/proxmenux/config.json",
+    "configOutro": "Corrigez ou restaurez le fichier, puis relancez l'option."
+  },
+  "related": {
+    "heading": "Autres",
+    "items": [
+      {
+        "href": "/docs/settings/show-version-information",
+        "label": "Afficher les informations sur la version",
+        "tail": "— confirmer quel canal est actif maintenant."
+      },
+      {
+        "href": "/docs/settings/proxmenux-monitor",
+        "label": "ProxMenux Monitor",
+        "tail": " — le service Monitor recréé lors du changement de canal."
+      },
+      {
+        "href": "/docs/settings",
+        "label": "Aperçu des paramètres",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/fr/docs/settings/change-language.json b/web/messages/fr/docs/settings/change-language.json
new file mode 100644
index 00000000..001a2fa9
--- /dev/null
+++ b/web/messages/fr/docs/settings/change-language.json
@@ -0,0 +1,108 @@
+{
+  "meta": {
+    "title": "Changer de langue | Documentation ProxMenux",
+    "description": "Choisissez parmi huit langues pour ProxMenux. Chaque installation inclut des catalogues JSON de traductions prégénérés ; aucun service de traduction ni environnement Python n'est nécessaire sur l'hôte. Le menu se recharge automatiquement.",
+    "ogTitle": "Changer de langue | Documentation ProxMenux",
+    "ogDescription": "Choisissez une des huit langues de ProxMenux dans les Paramètres. Disponible sur chaque installation."
+  },
+  "header": {
+    "title": "Changer de langue",
+    "description": "Changez la langue de ProxMenux parmi huit langues prises en charge. Le choix est enregistré dans config.json et le menu redémarre dans la nouvelle langue. Chaque installation comprend les catalogues de traductions.",
+    "section": "Paramètres"
+  },
+  "intro": {
+    "title": "Ce que c'est",
+    "body": "Un dialogue répertorie les huit langues prises en charge. ProxMenux enregistre votre choix dans <code>config.json</code> sous <code>.language</code>, puis relance <code>config_menu.sh</code> pour l'appliquer immédiatement."
+  },
+  "warn": {
+    "title": "Disponible sur chaque installation",
+    "body": "Les Paramètres affichent toujours Changer de langue. Les catalogues sont installés dans <code>/usr/local/share/proxmenux/lang/</code> <em>et</em> la langue choisie est enregistrée dans <code>config.json</code>. L'ancien environnement Python de traduction n'est pas nécessaire."
+  },
+  "supported": {
+    "heading": "Langues prises en charge",
+    "headerCode": "Code",
+    "headerLang": "Langue",
+    "headerNotes": "Remarques",
+    "rows": [
+      {
+        "code": "en",
+        "lang": "Anglais",
+        "notes": "Langue source — la plus précise"
+      },
+      {
+        "code": "es",
+        "lang": "Espagnol",
+        "notes": "Catalogue JSON prégénéré"
+      },
+      {
+        "code": "fr",
+        "lang": "Français",
+        "notes": "Catalogue JSON prégénéré"
+      },
+      {
+        "code": "de",
+        "lang": "Allemand",
+        "notes": "Catalogue JSON prégénéré"
+      },
+      {
+        "code": "it",
+        "lang": "italien",
+        "notes": "Catalogue JSON prégénéré"
+      },
+      {
+        "code": "pt",
+        "lang": "portugais",
+        "notes": "Catalogue JSON prégénéré"
+      },
+      {
+        "code": "sk",
+        "lang": "Slovaque",
+        "notes": "Catalogue JSON prégénéré"
+      },
+      {
+        "code": "sv",
+        "lang": "Suédois",
+        "notes": "Catalogue JSON prégénéré"
+      }
+    ]
+  },
+  "englishTip": {
+    "title": "L'anglais est le plus précis",
+    "body": "Les textes dans les autres langues proviennent des catalogues JSON prégénérés inclus avec ProxMenux. Les traductions manquantes sont remplacées par l'anglais ; aucun appel de traduction en direct n'est effectué sur l'hôte. L'anglais reste la référence en cas de traduction douteuse."
+  },
+  "underHood": {
+    "heading": "Comment ça marche sous le capot",
+    "items": [
+      "Le dialogue propose huit codes de langue ; choisissez-en un.",
+      "Si <code>config.json</code> existe : <code>jq --arg lang \"$new_language\" '.language = $lang''</code> met à jour le champ en place.",
+      "Si <code>config.json</code> n'existe pas : un nouveau est créé avec le code de langue dans un objet à champ unique.",
+      "Boîte de dialogue de confirmation : <em>\"Langue changée en [code]\"</em>.",
+      "<code>exec bash config_menu.sh</code> recharge le menu Paramètres avec la nouvelle langue active."
+    ]
+  },
+  "manual": {
+    "heading": "Équivalent manuel"
+  },
+  "troubleshoot": {
+    "heading": "Dépannage",
+    "noOptionTitle": "L'option n'apparaît pas dans les paramètres",
+    "noOptionBody": "Changer de langue est toujours disponible dans les versions actuelles. Si cette option manque, mettez ProxMenux à jour avec l'installateur officiel, puis rouvrez les Paramètres.",
+    "stillEnglishTitle": "La langue a changé mais l'interface utilisateur affiche toujours l'anglais",
+    "stillEnglishBody": "Le menu se relance après le changement. Si vous avez ouvert un nouveau shell et lancé un autre point d'entrée ProxMenux, exécutez à nouveau <code>menu</code> pour appliquer la nouvelle langue. Vérifiez avec <code>jq -r '.language' /usr/local/share/proxmenux/config.json</code>."
+  },
+  "related": {
+    "heading": "Autres",
+    "items": [
+      {
+        "href": "/docs/settings/show-version-information",
+        "label": "Afficher les informations sur la version",
+        "tail": " — confirme le canal de publication, les fichiers de traduction et la langue actuelle."
+      },
+      {
+        "href": "/docs/settings",
+        "label": "Aperçu des paramètres",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/fr/docs/settings/index.json b/web/messages/fr/docs/settings/index.json
new file mode 100644
index 00000000..55f0ca56
--- /dev/null
+++ b/web/messages/fr/docs/settings/index.json
@@ -0,0 +1,81 @@
+{
+  "meta": {
+    "title": "Paramètres ProxMenux — Activation de Monitor, canal de publication, langues | ProxMenux",
+    "description": "Paramètres ProxMenux : service Monitor et réinitialisation du mot de passe, canal Stable/Beta, huit langues d'interface, diagnostic de version et désinstallation. Les options Monitor apparaissent si le service est installé.",
+    "ogTitle": "Paramètres ProxMenux — Activation de Monitor, canal de publication, langues",
+    "ogDescription": "Configurez ProxMenux : service Monitor, canal de publication, langue, informations de version et désinstallation.",
+    "twitterTitle": "Paramètres ProxMenux",
+    "twitterDescription": "Activation de Monitor, changement de canal de publication, langues, version et désinstallation."
+  },
+  "header": {
+    "title": "Paramètres",
+    "description": "Configurez ProxMenux : activez ou désactivez Monitor, réinitialisez ses identifiants, passez entre Stable et Beta dans les deux sens, choisissez une des huit langues, consultez le diagnostic de version et désinstallez. Les actions Monitor nécessitent son service installé ; le choix de langue est toujours disponible.",
+    "section": "Paramètres"
+  },
+  "intro": {
+    "title": "Ce menu sert à",
+    "body": "Administration de ProxMenux lui-même : service Monitor, sortie du canal bêta, langue, diagnostic de version et désinstallation. Aucune option de ce menu ne modifie vos VM, conteneurs ou votre stockage."
+  },
+  "opening": {
+    "heading": "Ouverture du menu",
+    "body": "Dans le menu principal de ProxMenux, appuyez sur <kbd>s</kbd>. Les actions Monitor apparaissent si son service est installé ; les autres paramètres sont toujours disponibles :",
+    "imageAlt": "Menu Paramètres ProxMenux avec actions Monitor conditionnelles"
+  },
+  "installTypes": {
+    "heading": "Une installation, toutes les langues",
+    "intro": "Les versions actuelles incluent les catalogues JSON statiques dans chaque installation. Les anciennes versions proposaient des modes distincts avec traduction et normal :",
+    "headerType": "Type d'installation",
+    "headerBundles": "Composants inclus",
+    "headerMenu": "Affichage du menu",
+    "rows": [
+      {
+        "type": "Installation actuelle",
+        "bundles": "Catalogues JSON statiques pour sept langues, plus l’anglais intégré ; aucun environnement Python de traduction",
+        "menuRich": "<strong>Changer de langue</strong> + Afficher la version + Désinstaller"
+      },
+      {
+        "type": "Anciens modes avec traduction / normal",
+        "bundles": "Ancienne séparation entre environnement de traduction et installation uniquement en anglais",
+        "menu": "Mettez à jour avec le programme officiel pour utiliser le menu unifié actuel"
+      }
+    ],
+    "detectionTitle": "Le choix de langue est toujours disponible",
+    "detectionBody": "Le menu ne vérifie plus la présence d'un environnement de traduction. Chaque installation inclut <code>/usr/local/share/proxmenux/lang/</code> et enregistre la <code>language</code> choisie dans <code>config.json</code>."
+  },
+  "options": {
+    "heading": "Options du menu",
+    "intro": "Ces outils gèrent ProxMenux lui-même. <em>Conditionnel</em> signifie que les actions Monitor apparaissent uniquement si son service systemd est installé. Le canal de publication, la langue, le diagnostic de version et la désinstallation sont toujours disponibles.",
+    "list": [
+      {
+        "icon": "Activity",
+        "href": "/docs/settings/proxmenux-monitor",
+        "title": "ProxMenux Monitor",
+        "description": "Activer / désactiver l'unité proxmenux-monitor.service systemd, vérifier son état actuel et réinitialiser le mot de passe de connexion du tableau de bord s'il a été perdu. UI Web disponible sur TCP 8008.",
+        "badge": "Conditionnel"
+      },
+      {
+        "icon": "TestTube",
+        "href": "/docs/settings/beta-program",
+        "title": "Changer le canal de publication",
+        "description": "Passez de Stable (main) à Beta (develop) et inversement dans un seul dialogue. Exécute l'installateur officiel du canal choisi ; idempotent et toujours visible.",
+        "badge": "Toujours disponible"
+      },
+      {
+        "icon": "Info",
+        "href": "/docs/settings/show-version-information",
+        "title": "Afficher les informations sur la version",
+        "description": "Version de ProxMenux, canal de publication, composants installés, chemins des fichiers, fichiers de traduction et langue actuelle."
+      },
+      {
+        "icon": "Trash2",
+        "href": "/docs/settings/uninstall-proxmenux",
+        "title": "Désinstaller ProxMenux",
+        "description": "Supprimer ProxMenux et (facultativement) ses dépendances. restaure également les sauvegardes /root/.bashrc et /etc/motd créées au moment de l'installation."
+      }
+    ]
+  },
+  "configTip": {
+    "title": "Emplacement de la configuration",
+    "bodyRich": "La plupart des états gérés par ce menu sont stockés dans <code>/usr/local/share/proxmenux/config.json</code> : <code>language</code>, <code>beta_program.status</code> et les indicateurs d'installation de chaque composant. L'état du service Monitor est géré dans systemd (<code>proxmenux-monitor.service</code>), pas ici. La version est lue dans <code>/usr/local/share/proxmenux/version.txt</code>."
+  }
+}
diff --git a/web/messages/fr/docs/settings/proxmenux-monitor.json b/web/messages/fr/docs/settings/proxmenux-monitor.json
new file mode 100644
index 00000000..7ac354bd
--- /dev/null
+++ b/web/messages/fr/docs/settings/proxmenux-monitor.json
@@ -0,0 +1,119 @@
+{
+  "meta": {
+    "title": "ProxMenux Monitor | Documentation ProxMenux",
+    "description": "Activer ou désactiver l'unité proxmenux-monitor.service systemd et inspecter son état actuel. Le moniteur expose une interface utilisateur web sur TCP 8008 pour la surveillance visuelle des hôtes.",
+    "ogTitle": "ProxMenux Monitor | Documentation ProxMenux",
+    "ogDescription": "Activez ou désactivez le service systemd proxmenux-monitor et vérifiez son état dans les Paramètres."
+  },
+  "header": {
+    "title": "ProxMenux Monitor",
+    "description": "Deux actions connexes dans le menu Paramètres : basculer l'unité proxmenux-monitor.service systemd (démarrer / arrêter et activer / désactiver en un seul clic), et afficher son état actuel détaillé. Le moniteur expose une interface utilisateur web sur TCP 8008 pour la surveillance visuelle des hôtes.",
+    "section": "Paramètres"
+  },
+  "intro": {
+    "title": "Qu'est-ce que ProxMenux Monitor?",
+    "body": "ProxMenux Monitor est un tableau de bord web intégré qui fournit une visibilité en temps réel dans votre infrastructure Proxmox – accessible depuis n'importe quel navigateur de votre réseau, sans avoir besoin d'un terminal."
+  },
+  "offers": {
+    "heading": "Ce qu'il offre",
+    "items": [
+      "Surveillance en temps réel de CPU, RAM, utilisation du disque et trafic réseau.",
+      "Aperçu des conteneurs VM et LXC fonctionnant avec des indicateurs d'état.",
+      "Authentification pour protéger l'accès.",
+      "Authentification à deux facteurs (2FA) avec support TOTP.",
+      "Prise en charge par proxy inverse (Nginx / Traefik).",
+      "Conçu pour fonctionner sur les appareils de bureau et mobiles."
+    ]
+  },
+  "access": {
+    "heading": "Accès",
+    "intro": "Une fois installé, le tableau de bord est disponible à :",
+    "url": "http://<your-proxmox-ip>:8008",
+    "outro": "Le moniteur est installé automatiquement dans le cadre de l'installation standard ProxMenux et fonctionne comme un service systemd (<code>proxmenux-monitor.service</code>) qui démarre automatiquement au démarrage."
+  },
+  "warnConditional": {
+    "title": "Options de configuration uniquement visibles lorsque Monitor est installé",
+    "body": "Les deux entrées de menu décrites ci-dessous apparaissent seulement dans Paramètres si <code>proxmenux-monitor.service</code> est enregistré avec systemd. Si vous ne les voyez pas, le moniteur n'a pas été installé (il est optionnel pendant l'installation de ProxMenux). Pour l'ajouter plus tard, réinstallez ProxMenux avec la dernière version et choisissez l'option Monitor."
+  },
+  "toggle": {
+    "heading": "Activer / Désactiver",
+    "intro": "La première entrée de menu est une bascule unique qui bascule entre deux états selon que le service fonctionne actuellement :",
+    "headerState": "État actuel",
+    "headerLabel": "Étiquette de menu affichée",
+    "headerAction": "Décision sur confirmation",
+    "rows": [
+      {
+        "state": "actif",
+        "label": "Désactiver le ProxMenux Monitor",
+        "action": "systemctl stop + disable"
+      },
+      {
+        "state": "inactif",
+        "label": "Activer le ProxMenux Monitor",
+        "action": "systemctl enable + start"
+      }
+    ],
+    "outro": "Chaque changement demande une confirmation oui/non. Désactiver arrête le service <em>et</em> désactive son démarrage automatique ; activer autorise le démarrage automatique <em>et</em> lance le service immédiatement."
+  },
+  "status": {
+    "heading": "Afficher l'état du service de surveillance",
+    "intro": "La deuxième entrée de menu est en lecture seule. Il efface l'écran, affiche le logo ProxMenux et le titre <em>\"ProxMenux Monitor Vérification de service\"</em>, puis déclare:",
+    "items": [
+      "<strong>État du service:</strong> actif, inactif ou not_installed.",
+      "<strong>Web UI URL</strong> (uniquement lorsqu'il est actif): <code>http://&lt;host_ip&gt;:8008</code> — dérivé de <code>hostname -I | awk '''{print $1}'''</code>.",
+      "<strong>Détaillé systemd sortie:</strong> <code>systemctl status proxmenux-monitor.service --no-pager -l</code> — montre les lignes de log récentes, ExecStart, MainPID, etc."
+    ]
+  },
+  "manual": {
+    "title": "Équivalents manuels",
+    "intro": "Depuis n'importe quel shell :",
+    "code": "systemctl status proxmenux-monitor.service       # detailed status\nsystemctl is-active proxmenux-monitor.service    # one-word status\nsystemctl enable --now proxmenux-monitor.service # enable + start\nsystemctl disable --now proxmenux-monitor.service # stop + disable\njournalctl -u proxmenux-monitor.service -f       # follow live logs"
+  },
+  "reset": {
+    "heading": "Réinitialiser le mot de passe du ProxMenux Monitor",
+    "intro": "Chemin de récupération pour l'opérateur qui a perdu le mot de passe du tableau de bord (ou périphérique 2FA). L'option n'apparaît que lorsque le moniteur est installé sur l'hôte. Sélection :",
+    "items": [
+      "Demande confirmation avec un dialogue oui/non — l'action est destructrice pour les identifiants de connexion.",
+      "Sauvegarde le <code>/root/.config/proxmenux-monitor/auth.json</code> existant à <code>auth.json.bak-&lt;UTC timestamp&gt;</code> (mode <code>0600</code>) afin que l'état précédent puisse être restauré manuellement si la réinitialisation était une erreur.",
+      "Arrête le service <code>proxmenux-monitor</code> pour éviter un conflit entre la modification du fichier et une connexion en cours.",
+      "Efface les champs d'identité dans <code>auth.json</code>: <code>enabled=false</code>, <code>configured=false</code>, vide <code>username</code>, <code>password_hash</code>, <code>totp_secret</code> et le tableau des codes de sauvegarde.",
+      "<strong>Conserve</strong> <code>jwt_secret</code> et les <code>api_tokens</code> / <code>revoked_tokens</code> enregistrés pour que les jetons de longue durée de Home Assistant ou d'autres scripts <em>continuent à permettre l'authentification</em> après la réinitialisation.",
+      "Redémarre le service. La prochaine visite sur <code>http://&lt;host&gt;:8008</code> affiche l'assistant de configuration initiale pour créer un nouveau compte administrateur."
+    ],
+    "preservedTitle": "Ce qui est conservé et ce qui est effacé",
+    "preservedBody": "<strong>Effacés :</strong> nom d'utilisateur, empreinte du mot de passe, secret TOTP 2FA et codes de secours. <strong>Conservés :</strong> <code>jwt_secret</code>, métadonnées <code>api_tokens</code> et liste <code>revoked_tokens</code>. Pour invalider aussi tous les jetons API et repartir de zéro, supprimez <code>auth.json</code> manuellement au lieu de cette option. Au prochain démarrage, le service régénère le secret JWT et toutes les autres données.",
+    "trustTitle": "L'accès physique-hôte est l'ancre de confiance",
+    "trustBody": "Ce chemin de réinitialisation nécessite un shell racine sur l'hôte. Quiconque peut exécuter la commande <code>menu</code> en tant que root contrôle déjà la boîte, donc leur donner la récupération de mot de passe n'est pas une escalade de privilège — il est cohérent avec la façon dont chaque autre outil d'administration sur Proxmox fonctionne. Le corollaire : la connexion Monitor ne protégera rien de quelqu'un que vous avez déjà laissé entrer dans le shell Proxmox.",
+    "seeAlso": "Consultez aussi <link>Monitor → Accès et authentification → Récupérer un mot de passe perdu</link> pour ce processus vu du tableau de bord et les détails sur les empreintes des mots de passe et la génération du secret JWT."
+  },
+  "files": {
+    "heading": "Fichiers concernés",
+    "code": "/etc/systemd/system/proxmenux-monitor.service       # systemd unit\n/root/.config/proxmenux-monitor/                    # runtime config dir\n/var/log/proxmenux-auth.log                         # Flask app auth log\n                                                    # (read by Fail2Ban [proxmenux] jail)"
+  },
+  "troubleshoot": {
+    "heading": "Dépannage",
+    "missingTitle": "Les deux options du menu sont manquantes",
+    "missingBody": "Le moniteur n'est pas enregistré avec systemd. Confirmez avec <code>systemctl list-unit-files | grep proxmenux-monitor</code> — s'il n'y a pas de sortie, réinstallez ProxMenux depuis l'installateur officiel avec la dernière version et choisissez l'option Monitor pendant l'installation.",
+    "unreachableTitle": "Service activé mais l'URL est inaccessible",
+    "unreachableBody": "La sortie d'état de paramètres vous donne l'IP. Confirmer :",
+    "unreachableCmd": "ss -tlnp | grep 8008                # is anything listening?\njournalctl -u proxmenux-monitor -n 100 --no-pager  # recent errors\ncurl -sI http://localhost:8008      # local reachability",
+    "unreachableOutro": "Si localhost fonctionne mais n'est pas externe, vérifiez votre pare-feu hôte (<code>pve-firewall</code> ou nftables) pour TCP 8008.",
+    "stopsTitle": "Active le service mais il s'arrête quelques secondes plus tard",
+    "stopsBody": "Le plus souvent, il s'agit d'un conflit sur le port 8008 ou d'un échec de vérification des dépendances. Le journal système indique la cause : <code>journalctl -u proxmenux-monitor.service -b</code>."
+  },
+  "related": {
+    "heading": "Autres",
+    "items": [
+      {
+        "href": "/docs/security/fail2ban",
+        "label": "Fail2Ban",
+        "tailRich": "— la prison <code>[proxmenux]</code> protège le moniteur sur TCP 8008."
+      },
+      {
+        "href": "/docs/settings",
+        "label": "Aperçu des paramètres",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/fr/docs/settings/show-version-information.json b/web/messages/fr/docs/settings/show-version-information.json
new file mode 100644
index 00000000..9748450f
--- /dev/null
+++ b/web/messages/fr/docs/settings/show-version-information.json
@@ -0,0 +1,81 @@
+{
+  "meta": {
+    "title": "Afficher les informations de version | Documentation ProxMenux",
+    "description": "Diagnostic ProxMenux en lecture seule : version, canal de publication, composants enregistrés dans config.json, chemins des fichiers, catalogues de traductions et langue actuelle.",
+    "ogTitle": "Afficher les informations de version | Documentation ProxMenux",
+    "ogDescription": "Diagnostic de la version de ProxMenux, du canal de publication, des composants, des fichiers et de la langue."
+  },
+  "header": {
+    "title": "Afficher les informations sur la version",
+    "description": "Diagnostic en lecture seule. Lit version.txt, config.json et les chemins connus, puis affiche une zone de texte défilante avec la version, le canal de publication, les composants installés, la présence des fichiers, les fichiers de traduction et la langue actuelle.",
+    "section": "Paramètres"
+  },
+  "intro": {
+    "title": "Ce que c'est",
+    "body": "Un autodiagnostic. Utile pour signaler un problème (coller le contenu de la boîte de dialogue dans le rapport de bogue) ou confirmer une installation effectuée proprement. Ne modifie rien."
+  },
+  "reports": {
+    "heading": "Ce qu'il rapporte",
+    "headerSection": "Chapitre",
+    "headerSource": "Source",
+    "headerContent": "Contenu",
+    "rows": [
+      {
+        "section": "Version actuelle",
+        "source": "version.txt",
+        "contentRich": "Numéro de version sur une seule ligne ; <code>Unknown</code> si le fichier manque"
+      },
+      {
+        "section": "Canal de publication",
+        "source": "État du programme bêta dans config.json",
+        "content": "Stable (main) ou Beta (develop) ; version bêta si disponible"
+      },
+      {
+        "section": "Composants installés",
+        "source": "config.json",
+        "content": "État de chaque composant (✓ installé / créé / mis à jour, ✗ absent)"
+      },
+      {
+        "section": "Fichiers ProxMenux",
+        "source": "contrôle du système de fichiers",
+        "contentRich": "<code>menu</code>, <code>utils.sh</code>, <code>config.json</code>, <code>version.txt</code> présence + chemins"
+      },
+      {
+        "section": "Fichiers de traduction",
+        "source": "/usr/local/share/proxmenux/lang/",
+        "content": "Présence du répertoire lang/ inclus avec chaque installation"
+      },
+      {
+        "section": "Langue actuelle",
+        "source": "config.json",
+        "contentRich": "Code de langue de <code>.language</code> ; <code>en</code> par défaut si non défini"
+      }
+    ]
+  },
+  "sampleHeading": "Exemple de sortie",
+  "manualHeading": "Équivalents manuels",
+  "troubleshoot": {
+    "heading": "Dépannage",
+    "unknownTitle": "La version affiche \"Unknown\"",
+    "unknownBody": "<code>/usr/local/share/proxmenux/version.txt</code> est manquant ou illisible. Le plus souvent causé par une installation partielle. Réinstaller à partir de la source officielle ProxMenux.",
+    "noConfigTitle": "Aucune information disponible sur l'installation",
+    "noConfigBody": "<code>config.json</code> manque. Sans ce fichier, le script ne peut pas énumérer les composants. Réinstallez pour le recréer.",
+    "wrongStatusTitle": "Un composant affiche ✗ alors que je suis sûr de l'avoir installé",
+    "wrongStatusBody": "Cela signifie que <code>config.json</code> ne répertorie pas ce composant comme installé : il peut s'agir d'un script qui ne s'enregistre pas encore, ou d'une installation manuelle effectuée sans ProxMenux. Le dialogue reflète le contenu de <code>config.json</code>, pas l'état réel du disque."
+  },
+  "related": {
+    "heading": "Autres",
+    "items": [
+      {
+        "href": "/docs/settings/uninstall-proxmenux",
+        "label": "Désinstaller ProxMenux",
+        "tail": "— supprimer tous ces fichiers."
+      },
+      {
+        "href": "/docs/settings",
+        "label": "Aperçu des paramètres",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/fr/docs/settings/uninstall-proxmenux.json b/web/messages/fr/docs/settings/uninstall-proxmenux.json
new file mode 100644
index 00000000..2602ba09
--- /dev/null
+++ b/web/messages/fr/docs/settings/uninstall-proxmenux.json
@@ -0,0 +1,92 @@
+{
+  "meta": {
+    "title": "Désinstaller ProxMenux | Documentation ProxMenux",
+    "description": "Désinstallation propre de ProxMenux avec suppression facultative de jq et dialog, nettoyage des anciens fichiers de traduction et du service Monitor, et restauration des sauvegardes système.",
+    "ogTitle": "Désinstaller ProxMenux | Documentation ProxMenux",
+    "ogDescription": "Supprimer complètement ProxMenux d'un hôte Proxmox avec nettoyage de dépendance optionnel."
+  },
+  "header": {
+    "title": "Désinstaller ProxMenux",
+    "description": "Supprime ProxMenux de l'hôte Proxmox par un processus interactif : confirmation, suppression facultative des dépendances, nettoyage du service ProxMenux Monitor et restauration des sauvegardes de /root/.bashrc et /etc/motd. Une barre de progression est affichée tout au long du processus.",
+    "section": "Paramètres"
+  },
+  "scopeWarn": {
+    "title": "affecte uniquement l'installation de ProxMenux — pas vos VM / CT / stockage",
+    "body": "La désinstallation supprime les scripts ProxMenux, le lanceur de menu, le service Monitor facultatif et les sauvegardes de fichiers système créées par ProxMenux lors de son installation. <strong>Elle ne modifie pas vos VM, conteneurs, stockage, configuration réseau, Fail2Ban, pilote NVIDIA ni aucun autre élément installé via ProxMenux.</strong> Ces éléments restent en place."
+  },
+  "flow": {
+    "heading": "Déroulement de la désinstallation",
+    "items": [
+      "<strong>Dialogue de confirmation.</strong> Oui/non : « Voulez-vous vraiment désinstaller ProxMenux ? »",
+      "<strong>Liste des dépendances à supprimer.</strong> Propose jq et dialog. Les deux cases sont décochées par défaut ; sélectionnez uniquement les dépendances dont aucune autre application n'a besoin.",
+      "<strong>La suppression affiche une barre de progression.</strong> Supprime un éventuel ancien environnement de traduction, le lanceur <code>menu</code>, l'arborescence <code>/usr/local/share/proxmenux/</code>, le service ProxMenux Monitor s'il est présent avec la cible de notification enregistrée dans Proxmox VE (<code>proxmenux-webhook</code> et sa règle de correspondance), ainsi que les dépendances cochées. Restaure enfin les sauvegardes des fichiers système (voir ci-dessous).",
+      "<strong>Dialogue de fin.</strong> Répertorie les dépendances supprimées, puis quitte le programme."
+    ]
+  },
+  "deps": {
+    "heading": "Suppression de la dépendance : ce qui est offert",
+    "intro": "La liste propose jq et dialog. <strong>Aucune case n'est cochée par défaut</strong> : d'autres applications peuvent utiliser ces paquets système ; il est donc plus sûr de les conserver.",
+    "headerType": "Installation",
+    "headerOffered": "Proposé à la suppression",
+    "rows": [
+      {
+        "type": "Versions actuelles",
+        "offeredRich": "<code>dialog</code>, <code>jq</code>"
+      },
+      {
+        "type": "Anciennes installations après mise à jour",
+        "offeredRich": "<code>dialog</code>, <code>jq</code>"
+      }
+    ],
+    "warnTitle": "Paquets à l'échelle du système — réfléchir deux fois",
+    "warnBody": "La liste actuelle propose <code>jq</code> et <code>dialog</code>, pas <code>python3</code>. Ces paquets système peuvent être nécessaires à d'autres outils. Leur suppression peut aussi retirer des paquets dépendants ou des dépendances inutilisées. Conservez les paquets nécessaires et examinez toute proposition de suppression avant d'exécuter apt manuellement."
+  },
+  "removed": {
+    "heading": "Ce qui est enlevé",
+    "code": "/usr/local/bin/menu                                  # the launcher\n/usr/local/share/proxmenux/                          # everything: scripts, config, cache, version\n/opt/googletrans-env/                                # leftover legacy translation environment\n/etc/systemd/system/proxmenux-monitor.service        # Monitor service unit\n/root/.config/proxmenux-monitor/                     # Monitor config dir\n                                                     # + dependencies you ticked in the checklist"
+  },
+  "restored": {
+    "heading": "Ce qui est restauré",
+    "items": [
+      "Si <code>/root/.bashrc.bak</code> existe → rebaptisé <code>/root/.bashrc</code> (votre bashrc original retourne).",
+      "Si <code>/etc/motd.bak</code> existe, ce fichier est renommé en <code>/etc/motd</code>. Sinon, sed supprime la ligne ProxMenux (<em>“This system is optimised by: ProxMenux”</em>) du motd existant."
+    ]
+  },
+  "othersCallout": {
+    "title": "Les autres composants installés par ProxMenux sont conservés",
+    "body": "Tout ce qui est ProxMenux installé via d'autres menus — Fail2Ban, Lynis, les pilotes NVIDIA, les ajustements post-installation — n'est <strong>pas</strong> touché par ce programme de désinstallation. Chacun a son propre flux de désinstallation dans son menu respectif (ou vous pouvez le supprimer directement avec apt). Regardez d'abord <em>Afficher les informations sur la version</em> pour voir ce qui est enregistré."
+  },
+  "manual": {
+    "heading": "Désinstaller manuellement",
+    "intro": "Si pour une raison quelconque le désinstallateur de menu ne peut pas exécuter (par exemple, <code>dialog</code> déjà manquant), la séquence manuelle équivalente:",
+    "code": "# 1. Stop and remove the Monitor service (if installed)\nsystemctl stop proxmenux-monitor.service 2>/dev/null\nsystemctl disable proxmenux-monitor.service 2>/dev/null\nrm -f /etc/systemd/system/proxmenux-monitor.service\nrm -rf /root/.config/proxmenux-monitor\nsystemctl daemon-reload\nsystemctl reset-failed 2>/dev/null\n\n# 2. Remove a leftover legacy translation environment\nrm -rf /opt/googletrans-env\n\n# 3. Remove ProxMenux files\nrm -f /usr/local/bin/menu\nrm -rf /usr/local/share/proxmenux\n\n# 4. Restore backups\n[ -f /root/.bashrc.bak ] && mv /root/.bashrc.bak /root/.bashrc\n[ -f /etc/motd.bak ] && mv /etc/motd.bak /etc/motd \\\n    || sed -i '/This system is optimised by: ProxMenux/d' /etc/motd"
+  },
+  "reinstall": {
+    "heading": "Réinstaller plus tard",
+    "body": "Exécutez à nouveau l'installateur officiel ProxMenux. Les versions actuelles utilisent un seul mode d'installation incluant les huit langues de l'interface."
+  },
+  "troubleshoot": {
+    "heading": "Dépannage",
+    "hangTitle": "La désinstallation se bloque lors de la suppression d'un ancien environnement de traduction",
+    "hangBody": "Les versions actuelles suppriment un environnement résiduel avec <code>rm -rf /opt/googletrans-env</code> ; elles n'exécutent pas <code>pip uninstall</code>. Si cette étape se bloque, examinez-la depuis un autre shell et vérifiez le système de fichiers de l'hôte avant de réessayer.",
+    "aptTitle": "apt signale des paquets encore utilisés lors de la suppression des dépendances",
+    "aptBody": "Les paquets sélectionnés sont marqués comme automatiques et transmis à <code>apt-get -y --purge autoremove</code>. Cela ne garantit pas la protection des services dépendants. Laissez les dépendances décochées si d'autres outils les utilisent et examinez les suppressions proposées par apt avant tout nettoyage manuel.",
+    "motdTitle": "MOTD affiche toujours la ligne ProxMenux après désinstallation",
+    "motdBody": "Il se peut que <code>/etc/motd.bak</code> n'existe pas et que sed n'ait pas trouvé la ligne (par exemple, si elle a été modifiée). Modifiez <code>/etc/motd</code> manuellement et supprimez toute ligne ProxMenux restante."
+  },
+  "related": {
+    "heading": "Autres",
+    "items": [
+      {
+        "href": "/docs/settings/show-version-information",
+        "label": "Afficher les informations sur la version",
+        "tail": "— voir ce qui serait enlevé avant de désinstaller."
+      },
+      {
+        "href": "/docs/settings",
+        "label": "Aperçu des paramètres",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/fr/docs/storage-share/host-iscsi.json b/web/messages/fr/docs/storage-share/host-iscsi.json
new file mode 100644
index 00000000..d98b2130
--- /dev/null
+++ b/web/messages/fr/docs/storage-share/host-iscsi.json
@@ -0,0 +1,123 @@
+{
+  "meta": {
+    "title": "Hôte : ajouter une cible iSCSI comme stockage Proxmox | Documentation ProxMenux",
+    "description": "Enregistrez une cible iSCSI comme stockage Proxmox avec ProxMenux. L’outil installe open-iscsi, découvre le portail via sendtargets, permet de choisir la cible et exécute pvesm add iscsi. Il fournit des périphériques bloc bruts pour les images disque des VM.",
+    "ogTitle": "Hôte : ajouter une cible iSCSI comme stockage Proxmox | Documentation ProxMenux",
+    "ogDescription": "Enregistrer une cible iSCSI comme stockage Proxmox avec découverte guidée. Utilise pvesm add iscsi et fournit des périphériques de blocs bruts pour les disques VM."
+  },
+  "header": {
+    "title": "Hôte : Ajouter une cible iSCSI comme stockage Proxmox",
+    "description": "Enregistrez une cible iSCSI (à partir d'un SAN, TrueNAS / FreeNAS, Synology, une cible Windows Server, n'importe quel baie compatible avec iSCSI) comme stockage Proxmox. Les LUN exportés apparaissent comme des périphériques de blocs et peuvent héberger des images de disque VM à des performances quasi locales sur le réseau.",
+    "section": "Stockage et partage · Hôte"
+  },
+  "intro": {
+    "title": "Ce que ça fait",
+    "body": "ProxMenux enveloppe <code>pvesm add iscsi</code> avec un flux guidé: il installe <code>open-iscsi</code> si nécessaire, demande le portail iSCSI (IP:port), exécute <code>iscsiadm --mode discovery --type sendtargets</code> contre lui, vous permet de choisir une cible IQN, et enregistre le stockage iSCSI dans Proxmox. Le service <code>iscsid</code> maintient ensuite la session iSCSI en vie à travers les reboots."
+  },
+  "vocab": {
+    "heading": "vocabulaire iSCSI (référence rapide)",
+    "headerTerm": "Terme",
+    "headerMeaning": "Signification",
+    "rows": [
+      {
+        "term": "Portail",
+        "meaningRich": "Le point d’accès du service iSCSI sur le serveur cible : une adresse IP (ou un nom d’hôte) et un port TCP. Le port par défaut est <code>3260</code> ; ProxMenux l’utilise si aucun autre n’est indiqué."
+      },
+      {
+        "term": "Cible",
+        "meaningRich": "Un seul \"serveur\" exporté à l'intérieur du portail, identifié par son IQN (<em>iSCSI Nom qualifié</em>). Un portail peut accueillir de nombreuses cibles."
+      },
+      {
+        "term": "IQN",
+        "meaningRich": "La forme canonique est <code>iqn.YYYY-MM.reverse.domain:identifier</code>, par exemple <code>iqn.2024-08.com.truenas:proxmox-pool</code>. La cible et l'initiateur ont leur propre IQN."
+      },
+      {
+        "term": "LUN",
+        "meaningRich": "Un périphérique bloc à l'intérieur d'une cible (numéro d'unité logique). Une seule cible peut exposer plusieurs LUN ; chaque LUN apparaît comme son propre disque dans Proxmox et peut devenir un disque VM."
+      },
+      {
+        "term": "Initiateur",
+        "meaningRich": "Le client qui se connecte à une cible — dans ce cas, votre hôte Proxmox. L'initiateur a son propre IQN stocké dans <code>/etc/iscsi/initiatorname.iscsi</code>. Les cibles n'acceptent généralement que les sessions des IQN des initiateurs préautorisés."
+      }
+    ]
+  },
+  "opening": {
+    "heading": "Ouverture de l'outil",
+    "body": "Depuis le menu principal de ProxMenux, ouvrez <strong>Storage &amp; Share Manager → Ajouter iSCSI Target comme Proxmox Storage</strong>. Vous verrez ce menu sub avec quatre options :",
+    "imageAlt": "Menu du gestionnaire d'hôtes iSCSI — Ajouter / Afficher / Supprimer / Tester la connectivité"
+  },
+  "howRuns": {
+    "heading": "Comment fonctionne le script (Ajouter le flux)",
+    "body": "Le flux a deux phases avec une séparation claire entre \"la mise en place de l'initiateur, la découverte des cibles\" et \"l'enregistrement effectif du stockage dans Proxmox\". Contrairement à NFS / Samba, il n'y a pas d'auto-découverte sur le sous-réseau — vous devez connaître l'adresse du portail (iSCSI n'est pas convivial pour la diffusion)."
+  },
+  "add": {
+    "heading": "Ajouter la cible iSCSI comme stockage Proxmox",
+    "items": [
+      "<strong>Saisie du portail</strong> — tapez l'IP ou le nom d'hôte du serveur cible iSCSI. Port <code>3260</code> est supposé sauf si vous tapez <code>host:port</code>.",
+      "<strong>Découverte des cibles</strong> — ProxMenux appelle <code>iscsiadm --mode discovery --type sendtargets --portal &lt;ip:port&gt;</code>. Le serveur répond avec chaque IQN qu'il permet à cet initiateur de voir. Si la découverte échoue, le script affiche l'erreur exacte de <code>iscsiadm</code> et énumère les causes courantes (mauvaise IP, pare-feu, initiateur IQN non autorisé).",
+      "<strong>Sélection des cibles</strong> — une seule cible est sélectionnée automatiquement; plusieurs cibles affichent un menu.",
+      "<strong>Storage ID</strong> — par défaut <code>iscsi-&lt;last IQN segment, 20 chars max&gt;</code>. Seulement lettres, chiffres, <code>-</code> et <code>_</code>.",
+      "<strong>Type de contenu</strong> — contrairement à NFS / Samba, le contenu iSCSI est <strong>fixé à <code>images</code></strong>. iSCSI expose les périphériques de blocs bruts, pas un système de fichiers, donc Proxmox vous permet seulement d'héberger des disques VM sur lui."
+    ],
+    "authTitle": "Autoriser l'initiateur Proxmox sur la cible",
+    "authBody1": "Avant que le flux Add ne fonctionne de bout en bout, la cible iSCSI doit connaître votre hôte Proxmox. Obtenez votre initiateur IQN:",
+    "authBody2": "Ajoutez cet IQN à la liste d’accès de la cible (TrueNAS : <em>Sharing → Block → Initiators Groups</em> ; Synology : <em>SAN Manager → iSCSI → Target → Edit → Initiators</em> ; etc.). Si l’initiateur n’est pas autorisé, la découverte avec <code>iscsiadm</code> renvoie une liste vide ou une erreur d’authentification."
+  },
+  "manual": {
+    "heading": "Équivalent manuel",
+    "body": "La procédure complète correspond aux commandes suivantes :"
+  },
+  "view": {
+    "heading": "Affichage des stockages iSCSI configurés",
+    "body": "Liste toutes les entrées iSCSI dans Proxmox (<code>pvesm status | awk ''$2 == \"iscsi\"''</code>) avec portail, cible IQN, type de contenu et statut en direct."
+  },
+  "remove": {
+    "heading": "Supprimer le stockage iSCSI",
+    "body": "Exécute <code>pvesm remove &lt;storage-id&gt;</code> après avoir confirmé portail, cible et contenu. Seul l’enregistrement Proxmox est supprimé — <strong>la cible iSCSI elle-même n'est pas touchée</strong> et les sessions existantes du côté noyau peuvent durer jusqu'au prochain redémarrage.",
+    "warnTitle": "Vérifiez d’abord les disques VM existants sur cet iSCSI",
+    "warnBody": "Supprimer un stockage iSCSI alors que des VM y possèdent encore des disques laisse ces VM pointer vers un stockage absent. Proxmox signale l’erreur, mais les données LUN restent intactes sur la cible : vous pouvez réenregistrer le stockage pour retrouver les disques. Déplacez ou sauvegardez toutefois les VM au préalable par précaution."
+  },
+  "test": {
+    "heading": "Tester la connectivité iSCSI",
+    "body": "Exécute une passe de diagnostic : vérifie que <code>iscsiadm</code> est installé, imprime votre initiateur IQN, confirme que <code>iscsid</code> fonctionne, pinge chaque portail enregistré, sonde son port, et signale <code>pvesm status</code> plus si une session iSCSI est actuellement active (<code>iscsiadm --mode session</code>). Session active plus portail accessible, mais \"inactive\" dans Proxmox signifie généralement un état obsolète — essayez <code>pvesm set &lt;id&gt; --disable 0</code>."
+  },
+  "troubleshoot": {
+    "heading": "Dépannage",
+    "portalTitle": "\"Impossible d'atteindre le portail\" mais l'IP du serveur répond ailleurs",
+    "portalBody": "Ping a échoué sur l'adresse du portail. Vérifiez que vous atteignez l'interface <em>réseau de stockage</em> (iSCSI vit souvent sur un réseau VLAN / sous-net séparé du réseau de gestion). Vérifiez également DNS si vous avez tapé un nom d'hôte.",
+    "discoverTitle": "\"la découverte iSCSI a échoué\" de l'iscsiadm",
+    "discoverIntro": "Le script montre l'erreur exacte. Causes les plus courantes:",
+    "discoverItems": [
+      "Portal IP / port incorrect (double vérification, par défaut est 3260).",
+      "Le service iSCSI ne fonctionne pas sur le serveur cible.",
+      "Pare-feu bloque 3260 entre Proxmox et la cible.",
+      "<strong>L’IQN de l’initiateur n’est pas autorisé sur la cible.</strong> Cause la plus fréquente sur les baies professionnelles. Ajoutez d’abord l’IQN Proxmox à l’ACL des initiateurs de la cible."
+    ],
+    "noTargetTitle": "Aucune cible trouvée mais la découverte a réussi",
+    "noTargetBody": "Le serveur a accepté votre initiateur mais ne lui expose aucune cible. Vérifiez les contrôles d’authentification et d’accès : certaines baies autorisent la découverte pour tous les IQN mais filtrent les cibles visibles par chacun.",
+    "noLunTitle": "Les LUNs n'apparaissent pas dans /dev/disk/by-path après enregistrement",
+    "noLunBody": "<code>pvesm add iscsi</code> a réussi mais le noyau ne voit pas les périphériques de blocs. Vérifiez <code>iscsiadm --mode session</code> — Si aucune session n'est active, démarrez manuellement avec <code>iscsiadm --mode node --login</code>. Si une session existe mais qu'aucun LUN n'apparaît, forcez un rescan : <code>iscsiadm --mode session --rescan</code>. Si rien n'est encore fait, la cible n'a probablement pas encore de LUN assigné à cet IQN (configurer la cartographie LUN sur la cible).",
+    "chapTitle": "Authentification CHAP",
+    "chapBody": "ProxMenux ne propose pas de champs utilisateur/mot de passe CHAP dans le processus interactif. Si la découverte échoue, le script s’arrête avant <code>pvesm add</code> ; le stockage n’est pas enregistré malgré l’échec. Configurez séparément les exigences CHAP de la cible dans <code>open-iscsi</code>, y compris l’authentification de découverte si nécessaire, puis réessayez. Vérifiez la configuration avec <code>iscsiadm</code> et les sessions actives avec <code>iscsiadm --mode session</code>."
+  },
+  "related": {
+    "heading": "Autres",
+    "items": [
+      {
+        "href": "/docs/storage-share/host-nfs",
+        "label": "Partage NFS comme stockage Proxmox",
+        "tail": "— alternative au niveau des fichiers. Plus simple à configurer, plus flexible (backup / ISO / tmpl / images), légèrement plus lent pour les disques en direct VM."
+      },
+      {
+        "href": "/docs/storage-share/host-samba",
+        "label": "Samba / CIFS comme stockage Proxmox",
+        "tail": " — une autre option au niveau des fichiers ; à éviter pour les disques des VM actives en raison de la sémantique des verrous."
+      },
+      {
+        "href": "/docs/storage-share/host-local-disk",
+        "label": "Ajouter le disque local comme stockage Proxmox",
+        "tail": "— lorsque le disque est local à l'hôte Proxmox, pas sur une autre boîte sur le réseau."
+      }
+    ]
+  }
+}
diff --git a/web/messages/fr/docs/storage-share/host-local-disk.json b/web/messages/fr/docs/storage-share/host-local-disk.json
new file mode 100644
index 00000000..cc173c72
--- /dev/null
+++ b/web/messages/fr/docs/storage-share/host-local-disk.json
@@ -0,0 +1,186 @@
+{
+  "meta": {
+    "title": "Hôte : Ajouter le disque local comme stockage Proxmox ProxMenux Documentation",
+    "description": "Formatez un disque SATA, SAS ou NVMe local sur un hôte Proxmox et enregistrez-le comme stockage de type répertoire ou pool ZFS. L’outil vérifie les disques, exige une confirmation avant les opérations destructives, configure fstab par UUID, crée les pools ZFS et utilise pvesm add dir / zfspool.",
+    "ogTitle": "Hôte : Ajouter le disque local comme stockage Proxmox ProxMenux Documentation",
+    "ogDescription": "Formatez un disque local et enregistrez-le comme stockage répertoire ou pool ZFS dans Proxmox avec une procédure guidée et des filtres de sécurité."
+  },
+  "header": {
+    "title": "Hôte : Ajouter un disque local comme stockage Proxmox",
+    "description": "Choisissez un disque physique sur l’hôte Proxmox, formatez-le si nécessaire en ext4, xfs, btrfs ou zfs, puis enregistrez-le comme stockage répertoire avec pvesm add dir ou comme pool ZFS avec pvesm add zfspool. ProxMenux écarte le disque système et les disques utilisés, et annonce chaque opération destructive avant de l’exécuter.",
+    "section": "Stockage et partage · Hôte"
+  },
+  "intro": {
+    "title": "Ce que ça fait",
+    "body": "D'autres outils <em>Host</em> dans cette section traitent du stockage <strong>réseau</strong> (NFS / Samba / iSCSI). Celui-ci traite des disques <strong>locaux</strong> — disques de rechange physiquement attachés à votre hôte Proxmox que vous souhaitez utiliser pour les disques, sauvegardes, ISO ou modèles VM. ProxMenux prépare le disque (partitionnement + formatage + montage) et l'enregistre dans Proxmox afin que l'interface utilisateur puisse y placer du contenu."
+  },
+  "destructive": {
+    "title": "Outil destructif pour le chemin 'format'",
+    "body": "L’option <em>Formater</em> <strong>détruit les partitions et données existantes du disque sélectionné</strong>. ProxMenux affiche un avertissement, filtre les disques utilisés et exige une confirmation avant <code>wipefs</code> / <code>sgdisk</code> / <code>mkfs</code>. Ce n’est pas un écrasement sécurisé de chaque octet. Vérifiez deux fois le chemin du périphérique avant de confirmer."
+  },
+  "compare": {
+    "heading": "Répertoire ou pool ZFS — que choisir ?",
+    "headerDir": "Répertoire (ext4 / xfs / btrfs)",
+    "headerZfs": "Pool ZFS",
+    "rows": [
+      {
+        "label": "Type de stockage Proxmox",
+        "dirRich": "<code>dir</code>",
+        "zfsRich": "<code>zfspool</code>"
+      },
+      {
+        "label": "Format du disque VM",
+        "dir": "Fichier qcow2 / raw dans un système de fichiers",
+        "zfs": "Ensemble de données Native ZFS (zvol) par disque"
+      },
+      {
+        "label": "Instantanés",
+        "dir": "qcow2 snapshots; btrfs snapshots si fs=btrfs",
+        "zfs": "Natif, instantané, copie à l'écriture"
+      },
+      {
+        "label": "Allocation fine",
+        "dir": "Oui (par défaut qcow2)",
+        "zfs": "Oui (ZFS par défaut)"
+      },
+      {
+        "label": "Besoins en RAM",
+        "dir": "Faible",
+        "zfs": "Élevés — ZFS utilise la RAM disponible comme cache ARC"
+      },
+      {
+        "label": "Prend en charge les types de contenu",
+        "dir": "images, backup, iso, vztmpl, snippets, rootdir",
+        "zfs": "images et rootdir uniquement (stockage en blocs)"
+      },
+      {
+        "label": "Meilleur pour",
+        "dir": "Disque à usage général: mélange de disques VM, sauvegardes, ISO",
+        "zfs": "Pure disque de données VM / LXC avec instantané + besoins d'intégrité"
+      }
+    ]
+  },
+  "opening": {
+    "heading": "Ouverture de l'outil",
+    "body": "Dans le menu principal de ProxMenux, ouvrez <strong>Storage &amp; Share Manager → Add Local Disk as Proxmox Storage</strong>. Le sous-menu comporte quatre options :",
+    "imageAlt": "Menu Local Disk Manager — Ajouter / Afficher / Supprimer / Liste des disques disponibles"
+  },
+  "howRuns": {
+    "heading": "Comment fonctionne le script (Ajouter le flux)",
+    "body": "La procédure comporte deux phases avec un filtre de sécurité à trois vérifications. Phase 1 découvre les disques sûrs, décide ce qu'il faut faire avec celui choisi et recueille les paramètres de stockage; Phase 2 fait le travail destructeur. Jusqu'à la confirmation finale, le disque est intact."
+  },
+  "format": {
+    "heading": "Formater un disque vide",
+    "intro": "Le chemin pour un disque frais ou un disque dont le contenu ne vous intéresse pas.",
+    "items": [
+      "Choisissez le disque (système / disques en usage sont cachés).",
+      "Choisissez \"Format disque (ERASE toutes les données)\".",
+      "Choisissez le système de fichiers — voir le tableau ci-dessus pour les compromis.",
+      "ID de stockage (<code>disk-&lt;device&gt;</code> par défaut), chemin de montage, préréglage de type contenu.",
+      "Confirmez dans le dialogue <strong>CONFIRMATION FINALE — LES DONNÉES SERONT EFFACÉES</strong>.",
+      "ProxMenux efface la table de partitions et crée une partition sur tout le disque. Il exécute <code>mkfs.&lt;fs&gt;</code> ou <code>zpool create</code>, puis monte le résultat. Les systèmes de fichiers classiques reçoivent une entrée UUID dans <code>/etc/fstab</code> avec <code>defaults,nofail</code> ; ZFS utilise la configuration de montage du pool. Si <em>Comme stockage Proxmox</em> est coché (toujours le cas pour ZFS), il est ensuite enregistré avec <code>pvesm add dir</code> ou <code>pvesm add zfspool</code> ; sinon, il reste un simple montage de l’hôte."
+    ],
+    "tipTitle": "Pourquoi UUID + nofail dans /etc/fstab",
+    "tipBody": "Le script écrit <code>UUID=… /mnt/&lt;id&gt; &lt;fs&gt; defaults,nofail 0 2</code>. UUID survit à la réorganisation de l'appareil à travers les reboots (ainsi <code>/dev/sdc</code> devenir <code>/dev/sdd</code> ne casse pas le démarrage). <code>nofail</code> signifie que si le disque disparaît un jour (défaut de matériel, débranché), Proxmox démarre quand même — le stockage se montrera comme inactif jusqu'à ce que le disque revienne."
+  },
+  "reuse": {
+    "heading": "Réutiliser un système de fichiers existant",
+    "intro": "Le chemin pour un disque sur lequel vous souhaitez conserver les données — peut-être l'avez-vous déplacé d'un autre hôte Proxmox, ou le disque a déjà des sauvegardes / ISO que vous voulez garder accessible.",
+    "items": [
+      "Choisissez le disque.",
+      "Choisir « Utiliser le système de fichiers existant ».",
+      "ID de stockage, chemin de montage, préréglage de type contenu.",
+      "ProxMenux ne touche <strong>pas</strong> aux données : il crée le point de montage, monte le disque, ajoute une entrée UUID à <code>/etc/fstab</code> et l'enregistre en tant que stockage Proxmox <code>dir</code>."
+    ],
+    "warnTitle": "Le chemin de réutilisation ne gère pas ZFS pools",
+    "warnBody": "Si le disque contient déjà un pool ZFS, le chemin <em>reuse</em> essaie ici de le monter en tant que système de fichiers régulier — qui échoue. Pour importer un pool ZFS existant, utilisez <code>zpool import &lt;name&gt;</code> sur la ligne de commande, puis enregistrez-le manuellement avec <code>pvesm add zfspool</code>."
+  },
+  "presets": {
+    "heading": "Préréglages de type contenu",
+    "intro": "ProxMenux propose trois préréglages et une option personnalisée. La liste de contenu choisie est transmise à <code>pvesm add … --content &lt;csv&gt;</code> :",
+    "headerPreset": "Préréglage",
+    "headerContent": "Chaîne de contenu",
+    "headerUse": "Cas d'utilisation",
+    "rows": [
+      {
+        "preset": "Stockage VM",
+        "content": "images,backup",
+        "use": "Un magasin de disques VM dédié qui conserve également les sauvegardes de ces VMs à proximité."
+      },
+      {
+        "preset": "NAS standard",
+        "content": "backup,iso,vztmpl",
+        "use": "Une archive / disque multimédia — sauvegardes, ISOs et modèles LXC. Pas de disques VM en direct ici."
+      },
+      {
+        "preset": "Tous types",
+        "content": "images,backup,iso,vztmpl,snippets",
+        "use": "Ce préréglage étendu active images, sauvegardes, ISO, modèles LXC et snippets. Ajoutez d’autres types pris en charge, comme rootdir, via Personnalisé si nécessaire."
+      },
+      {
+        "preset": "Personnalisé",
+        "content": "(saisie libre)",
+        "useRich": "Tapez le CSV exact vous-même, par exemple. <code>images</code> seul ou <code>rootdir,images</code>."
+      }
+    ],
+    "zfsTitle": "ZFS pool le contenu est plus étroit",
+    "zfsBody": "Avec <strong>zfs</strong>, un <code>zfspool</code> accepte uniquement <code>images</code> et <code>rootdir</code>, pas les fichiers ISO ou de sauvegarde. Saisissez une liste compatible via Personnalisé. Le script la transmet sans modification ; des types non pris en charge peuvent faire échouer l’enregistrement. Vérifiez ensuite <code>pvesm status</code>."
+  },
+  "manual": {
+    "heading": "Équivalent manuel",
+    "extIntro": "Format + enregistrer un disque comme stockage de répertoire ext4 :",
+    "zfsIntro": "Ou comme un pool ZFS:"
+  },
+  "view": {
+    "heading": "Afficher les stockages de disques",
+    "body": "Liste tous les stockages Proxmox soutenus par un disque (les deux <code>dir</code> et <code>zfspool</code> qui sont créés par l'utilisateur — système pools comme <code>rpool</code> sont cachés). Affiche le chemin de montage / pool nom, types de contenu et statut en direct."
+  },
+  "remove": {
+    "heading": "Supprimer le stockage du disque",
+    "body": "Désenregistre le stockage de Proxmox (<code>pvesm remove</code>) et propose de nettoyer l'entrée correspondante dans <code>/etc/fstab</code>. Pour ZFS pools, le script <strong>ne détruit pas</strong> automatiquement le pool — il s'agit d'une étape <code>zpool destroy &lt;name&gt;</code> distincte que vous effectuez manuellement lorsque vous êtes sûr.",
+    "warnTitle": "Données et dépendances existantes VM",
+    "warnBody": "La suppression du stockage ne touche pas le système de fichiers ou le pool — les données restent sur le disque. Mais VMs / CTs qui font référence à ce stockage par ID échouera à démarrer après la suppression. Déplacez ces disques VM vers un autre stockage (ou prenez une sauvegarde) avant de les supprimer."
+  },
+  "list": {
+    "heading": "Liste des disques disponibles",
+    "body": "Une vue diagnostique en lecture seule : imprime la sortie de <code>lsblk -o NAME,SIZE,TYPE,FSTYPE,MOUNTPOINT,MODEL</code> suivie des stockages <code>dir</code> / <code>zfspool</code> Proxmox en est déjà au courant. Bon premier arrêt lorsque vous ouvrez l'outil et que vous voulez voir \"ce qui est sur cet hôte?\" avant d'ajouter quelque chose."
+  },
+  "troubleshoot": {
+    "heading": "Dépannage",
+    "noDisksTitle": "\"Aucun disque disponible trouvé\"",
+    "noDisksIntro": "Le filtre de sécurité a caché chaque disque. Raisons communes:",
+    "noDisksItems": [
+      "Seul le disque racine est présent.",
+      "Tous les autres disques font partie d'un tableau actif ZFS / LVM / RAID.",
+      "Chaque disque est référencé par une config VM ou LXC (passthrough).",
+      "Le disque est en lecture seule (défaillance matérielle ou dispositif de blocage des écritures)."
+    ],
+    "noDisksOutro": "Utiliser <em>List Disques disponibles</em> dans le menu pour voir la sortie brute <code>lsblk</code> et comprendre ce qui se passe.",
+    "mountedTitle": "Le format échoue avec \"le dispositif est monté\"",
+    "mountedBody": "Quelque chose a monté automatiquement le disque (udisksd, un gestionnaire de bureau, une unité de systemd persistante). Démonter : <code>umount /dev/sdX?*</code> ou <code>systemctl stop &lt;whatever-mounts-it&gt;</code>, puis réessayer. Le filtre de sécurité du script devrait avoir des disques cachés montés, donc si vous avez atteint cette erreur, le montage s'est produit entre le menu montrant et vous confirmant.",
+    "zpoolTitle": "Échec de zpool create : « invalid vdev specification »",
+    "zpoolBody": "En général, le disque a encore des signatures GPT/LVM/ZFS que <code>zpool</code> refuse d'écraser sans force. Le script exécute <code>wipefs</code> et <code>sgdisk --zap-all</code> avant le format, mais un disque très têtu peut encore avoir une étiquette obstinée. Forcez un nettoyage manuellement : <code>zpool labelclear -f /dev/sdX</code> ou <code>dd if=/dev/zero of=/dev/sdX bs=1M count=10</code> et réessayez.",
+    "inactiveTitle": "Le stockage s'affiche comme inactif après redémarrage",
+    "inactiveBody": "Vérifiez <code>findmnt &lt;mount-path&gt;</code> — si le montage est manquant, quelque chose dans <code>/etc/fstab</code> a échoué. <code>dmesg | tail</code> pointe habituellement à la raison (inadéquation UUID, corruption du système de fichiers, <code>nofail</code> a abandonné la réessayer). Un <code>mount -a</code> réactive habituellement le stockage une fois la cause réglée."
+  },
+  "related": {
+    "heading": "Autres",
+    "items": [
+      {
+        "href": "/docs/disk-manager/format-disk",
+        "label": "Gestionnaire de disques : formater / effacer un disque physique",
+        "tail": "— alternative de bas niveau lorsque vous voulez simplement préparer un disque sans l'enregistrer comme stockage Proxmox."
+      },
+      {
+        "href": "/docs/storage-share/host-iscsi",
+        "label": "Ajouter la cible iSCSI comme stockage Proxmox",
+        "tail": " — équivalent réseau lorsque le périphérique bloc se trouve sur une autre machine."
+      },
+      {
+        "href": "/docs/storage-share/host-local-shared",
+        "label": "Ajouter un répertoire partagé sur l'hôte",
+        "tail": " — prépare un répertoire sur l’hôte pour les bind mounts LXC, sans l’enregistrer comme stockage Proxmox."
+      }
+    ]
+  }
+}
diff --git a/web/messages/fr/docs/storage-share/host-local-shared.json b/web/messages/fr/docs/storage-share/host-local-shared.json
new file mode 100644
index 00000000..39379c60
--- /dev/null
+++ b/web/messages/fr/docs/storage-share/host-local-shared.json
@@ -0,0 +1,103 @@
+{
+  "meta": {
+    "title": "Hôte : ajouter un répertoire partagé | Documentation ProxMenux",
+    "description": "Créez un répertoire hôte prêt pour les bind mounts LXC, avec des permissions adaptées aux conteneurs privilégiés et non privilégiés. Sticky bit, rwx pour tous et ACL par défaut pour l’héritage.",
+    "ogTitle": "Hôte : ajouter un répertoire partagé | Documentation ProxMenux",
+    "ogDescription": "Préparer un répertoire hôte pour les bind mounts LXC avec des permissions compatibles avec des CT privilégiés et non privilégiés."
+  },
+  "header": {
+    "title": "Host : Ajouter un répertoire partagé sur Host",
+    "description": "Créer un répertoire hôte conçu pour être monté sur un ou plusieurs conteneurs LXC. ProxMenux applique un ensemble de permissions qui fonctionne à la fois pour les CT privilégiés et non privilégiés à la fois — pas de maux de tête UID décalés, pas de chowns par conteneur — et enregistre le répertoire afin que le gestionnaire de montage LXC puisse le récupérer plus tard.",
+    "section": "Stockage et partage · Hôte"
+  },
+  "intro": {
+    "title": "Ce que c'est (et n'est PAS)",
+    "body": "Cet outil n'enregistre <strong>pas</strong> quoi que ce soit dans Proxmox (pas de <code>pvesm add</code> ici). Il prépare simplement un répertoire sur l'hôte — <code>/mnt/shared</code>, par défaut — avec des autorisations que tout conteneur LXC peut lire et écrire, que le CT soit privilégié ou non. L'étape suivante habituelle consiste à le monter en liaison dans chaque CT avec le <mountLink>LXC Mount Manager</mountLink>."
+  },
+  "why": {
+    "heading": "Pourquoi un outil dédié à cette tâche",
+    "intro": "Lorsque vous liez un répertoire hôte dans un conteneur LXC, les permissions dépendent de :",
+    "items": [
+      "Si le CT est <strong>privilégié</strong> (UID 0 du CT = UID 0 de l’hôte) ou <strong>non privilégié</strong> (UID 0 du CT = UID 100000 de l’hôte — tout est décalé de +100000).",
+      "Le propriétaire du répertoire hôte (un fichier appartenant à l’UID 1000 sur l’hôte relève des permissions « autres » pour un CT non privilégié, car aucun utilisateur du CT ne correspond à cet UID hôte).",
+      "Indique si plusieurs CT partagent le même répertoire (différents CT peuvent avoir des plages UID différentes)."
+    ],
+    "outro": "ProxMenux choisit ici une solution pratique : <strong>donner accès à tout le monde</strong> au niveau du système de fichiers, avec rwx pour tous, le sticky bit et des ACL pour l’héritage des permissions. Tout UID mappé peut lire et écrire ; aucun alignement des UID/GID n’est nécessaire."
+  },
+  "howRuns": {
+    "heading": "Comment fonctionne le script",
+    "body": "Le script n'a pas de menu principal — il exécute une seule action, <strong>Créer répertoire partagé</strong>. Phase 1 recueille le chemin cible; Phase 2 crée le répertoire et applique les permissions."
+  },
+  "bits": {
+    "heading": "Ce que chaque bit de permission fait",
+    "intro": "Le numéro <strong>1777</strong> n'est pas arbitraire — c'est le même mode que Linux utilise pour <code>/tmp</code>. Trois propriétés combinées:",
+    "headerBit": "Bit",
+    "headerEffect": "Effet",
+    "headerWhy": "Pourquoi c'est important ici",
+    "rows": [
+      {
+        "bit": "1 (sticky bit)",
+        "effect": "Seuls le propriétaire du fichier, celui du répertoire ou un processus suffisamment privilégié peuvent supprimer ou renommer le fichier.",
+        "why": "Limite la suppression des fichiers d’autres utilisateurs ayant des UID mappés différents. N’isole pas les CT partageant un UID mappé ou un accès root privilégié."
+      },
+      {
+        "bit": "777 (rwx-rwx-rwx)",
+        "effect": "Tout le monde peut lire, écrire et traverser.",
+        "why": "Les UIDs CT non privilégiés (100000+) apparaissent comme des \"autres\" de l'hôte, de sorte que world-rwx leur donne accès."
+      },
+      {
+        "bit": "ACL (par défaut)",
+        "effect": "Hérité sur chaque fichier / sous-dir nouvellement créé.",
+        "why": "Le nouveau contenu hérite des ACL par défaut sans réexécuter le script. Les applications peuvent toutefois demander des modes restrictifs ou modifier les permissions ensuite."
+      }
+    ],
+    "privTitle": "Les CT privilégiés voient la même chose, juste sans le changement",
+    "privBody": "Pour un CT privilégié, UID 0 dans le CT est UID 0 sur l'hôte, de sorte que <code>root</code> à l'intérieur du CT peut lire / écrire le répertoire hôte directement. Le <code>1777</code> est toujours bien — cela signifie simplement que les utilisateurs non root à l'intérieur du CT peuvent également utiliser le répertoire. Les mêmes autorisations couvrent les deux cas."
+  },
+  "where": {
+    "heading": "Où mettre le répertoire partagé",
+    "intro": "Le localisateur offre quatre options :",
+    "opt1Title": "1. Créer un nouveau dossier dans /mnt",
+    "opt1Body": "Le choix habituel. Le ProxMenux suggère automatiquement la première dénomination libre (<code>shared</code>, <code>shared2</code>, <code>shared3</code>, ...). Il suffit de confirmer ou de taper un nom différent.",
+    "opt2Title": "2. Saisissez le chemin personnalisé",
+    "opt2Body": "Pour les répertoires hors <code>/mnt</code>. Tout chemin absolu fonctionne (par exemple : <code>/srv/media</code>, <code>/data/family</code>). Le script applique les mêmes permissions.",
+    "opt3Title": "3. Afficher les dossiers existants dans /mnt",
+    "opt3Body": "Diagnostic en lecture seule : liste chaque répertoire sous <code>/mnt</code> avec ses permissions, son propriétaire et son espace disponible. Utile avant de créer un nouveau pour éviter les collisions de noms.",
+    "opt4Title": "4. Annuler",
+    "opt4Body": "Quitte sans rien créer, comme la touche <kbd>Esc</kbd>.",
+    "tipTitle": "Où vit /mnt ?",
+    "tipBody": "Par défaut, <code>/mnt</code> se trouve sur le système de fichiers racine Proxmox. Si vous voulez le répertoire partagé sur un disque différent (un disque de données, un pool ZFS), montez ce disque sous <code>/mnt/&lt;name&gt;</code> d'abord (Disk Manager ou <diskLink>Ajouter le disque local comme stockage Proxmox</diskLink>), puis créez le répertoire partagé comme sous-dossier à l'intérieur — ou choisissez \"Entrer le chemin personnalisé\" ici et pointez sur le disque monté."
+  },
+  "manual": {
+    "heading": "Équivalent manuel",
+    "body": "Tout le flux peut être rejoué à la main:"
+  },
+  "next": {
+    "heading": "Étape suivante : bind mount dans les conteneurs",
+    "body": "La création du répertoire ne fait que le préparer — aucun conteneur ne le voit encore. Pour le rendre visible à l'intérieur d'un ou plusieurs LXC, utilisez le <mountLink>LXC Mount Manager</mountLink> pour lier le montage de <code>/mnt/&lt;name&gt;</code> dans les CT. Étant donné que les autorisations sont déjà ouvertes, Mount Manager <strong>ne proposera pas</strong> de les modifier : le répertoire est prêt à être utilisé tel quel."
+  },
+  "troubleshoot": {
+    "heading": "Dépannage",
+    "mkdirTitle": "\"Failed to create directory\"",
+    "mkdirBody": "Habituellement un problème de système de fichiers: <code>/mnt</code> est sur un système de fichiers en lecture seule, le chemin contient un composant qui n'est pas un répertoire (par exemple, vous avez tapé <code>/etc/passwd/sub</code>), ou le disque est plein. Vérifiez avec <code>df -h /mnt</code> et <code>mount | grep /mnt</code>.",
+    "writeTitle": "Conteneur ne peut pas écrire malgré les autorisations ouvertes",
+    "writeBody": "Vérifiez que le CT utilise bien le bind mount (<code>pct config &lt;ctid&gt; | grep ^mp</code>). À l'intérieur du CT, exécutez <code>touch /mnt/data/test-$(date +%s)</code> — si cela échoue avec la permission refusée, le montage peut être sur un système de fichiers hôte qui n'honore pas les ACL (certaines anciennes <code>ext3</code> ou <code>vfat</code> montures). Déplacez le répertoire partagé vers un support ext4 / xfs / btrfs / zfs.",
+    "aclTitle": "ACL commande silencieusement indisponible",
+    "aclBody": "Sur une installation Proxmox minimale <code>setfacl</code> / <code>getfacl</code> peuvent ne pas être installés. Le script tombe gracieusement (contrôle <code>command -v setfacl</code>) et n'applique que les permissions POSIX — ce qui est souvent suffisant, mais les nouveaux fichiers n'hériteront pas automatiquement du profil permissif. Installez <code>acl</code> avec <code>apt-get install -y acl</code> et réexécutez le script dans le répertoire."
+  },
+  "related": {
+    "heading": "Autres",
+    "items": [
+      {
+        "href": "/docs/storage-share/lxc-mount-points",
+        "label": "Gestionnaire de montage LXC",
+        "tail": "— l'étape suivante naturelle: lier ce répertoire dans un ou plusieurs conteneurs."
+      },
+      {
+        "href": "/docs/storage-share/host-local-disk",
+        "label": "Ajouter le disque local comme stockage Proxmox",
+        "tailRich": "— si vous voulez le répertoire partagé sur un disque dédié, préparez le disque d'abord, montez-le sous <code>/mnt</code>, puis créez le sous-dossier partagé ici."
+      }
+    ]
+  }
+}
diff --git a/web/messages/fr/docs/storage-share/host-nfs.json b/web/messages/fr/docs/storage-share/host-nfs.json
new file mode 100644
index 00000000..f6371e5f
--- /dev/null
+++ b/web/messages/fr/docs/storage-share/host-nfs.json
@@ -0,0 +1,174 @@
+{
+  "meta": {
+    "title": "Hôte : monter un partage NFS | Documentation ProxMenux",
+    "description": "Montez une exportation externe de NFS sur l'hôte Proxmox — soit sous forme de stockage Proxmox (pvesm add nfs), soit sous forme de montage fstab (NON visible dans Datacenter > Storage), ou les deux. La méthode fstab est idéale pour lier le partage dans les conteneurs LXC sans l'exposer comme stockage Proxmox.",
+    "ogTitle": "Hôte : monter un partage NFS | Documentation ProxMenux",
+    "ogDescription": "Montez un export NFS externe sur l’hôte Proxmox via pvesm, fstab ou les deux. La méthode fstab convient aux bind mounts LXC."
+  },
+  "header": {
+    "title": "Hôte : monter un partage NFS sur l’hôte",
+    "description": "Montez une exportation externe de NFS (à partir d'un NAS, d'un autre serveur, d’un partage homelab...) sur l'hôte Proxmox. Choisissez une ou les deux méthodes : enregistrez-la en tant que stockage Proxmox (visible dans Datacenter > Storage) et/ou ajoutez un montage simple /etc/fstab sur un chemin que vous choisissez (utile pour lier le partage dans des conteneurs LXC sans l'exposer comme stockage Proxmox).",
+    "section": "Stockage et partage · Hôte"
+  },
+  "intro": {
+    "title": "Ce que ça fait",
+    "body": "ProxMenux propose deux méthodes de montage pour toute exportation de NFS : <strong>(1) Stockage Proxmox</strong> via <code>pvesm add nfs</code> — le partage apparaît dans Datacenter > Stockage et Proxmox gère le montage à <code>/mnt/pve/&lt;id&gt;</code>; <strong>(2) Montage fstab sur l’hôte</strong> sur un chemin que vous choisissez — persistant via <code>/etc/fstab</code>, NON visible comme stockage Proxmox, idéal pour le montage au niveau des conteneurs LXC (l'UI Proxmox reste propre). Vous pouvez exécuter une méthode, l'autre, ou les deux."
+  },
+  "opening": {
+    "heading": "Ouverture de l'outil",
+    "body": "Dans le menu principal de ProxMenux, ouvrez <strong>Storage &amp; Share Manager → Mount NFS Share on Host</strong>. Le sous-menu comporte quatre options :",
+    "imageAlt": "Menu NFS Host Manager — Monter / Afficher / Supprimer / Tester la connectivité"
+  },
+  "howRuns": {
+    "heading": "Comment fonctionne le script",
+    "body": "Le flux a deux phases avec une séparation claire entre \"découvrir, valider et choisir\" et \"en fait monter / écrire config\". Après avoir sélectionné une exportation, vous choisissez les méthodes de montage via une liste de contrôle; le reste des dialogues ne demandent que des paramètres pour les méthodes que vous avez sélectionnées. Jusqu'à la confirmation finale, ni <code>/etc/pve/storage.cfg</code> ni <code>/etc/fstab</code> ne sont touchés."
+  },
+  "modes": {
+    "heading": "Choix de la méthode de montage (une ou deux options)",
+    "intro": "Après avoir sélectionné et validé l'exportation, ProxMenux affiche une liste de contrôle avec les deux méthodes de montage. Vous pouvez marquer l'un ou l'autre, ou les deux. Si vous appuyez sur OK sans marquer quoi que ce soit, la boîte de dialogue réapparaît jusqu'à ce que vous choisissiez au moins une option ou appuyez sur Annuler pour quitter le flux.",
+    "imageAlt": "Liste de contrôle des méthodes de montage avec options pvesm et fstab",
+    "headerMethod": "Méthode",
+    "headerMount": "Chemin de montage",
+    "headerUi": "Visible dans Datacenter > Stockage",
+    "headerUseCase": "Cas d'utilisation typique",
+    "rows": [
+      {
+        "method": "<strong>Comme stockage Proxmox (pvesm)</strong>",
+        "mountRich": "<code>/mnt/pve/&lt;storage-id&gt;</code> (géré par Proxmox)",
+        "ui": "Oui",
+        "useCase": "VM images de disque, sauvegardes, ISOs, modèles LXC — tout ce qui doit apparaître dans l'interface utilisateur Proxmox."
+      },
+      {
+        "method": "<strong>Uniquement le fstab de l'hôte</strong>",
+        "mountRich": "<code>/mnt/&lt;path&gt;</code> (vous choisissez le chemin)",
+        "ui": "Non",
+        "useCaseRich": "Rendre le partage accessible dans un ou plusieurs LXC par bind mount <em>sans</em> l’enregistrer comme stockage Proxmox. Garde l’interface Datacenter claire."
+      },
+      {
+        "method": "<strong>Les deux</strong>",
+        "mount": "Les deux chemins ci-dessus (deux points de montage du même export NFS)",
+        "ui": "Oui",
+        "useCase": "Intégration à l’interface et chemin stable séparé sur l’hôte avec permissions ouvertes pour les bind mounts LXC."
+      }
+    ],
+    "bothTitle": "\"Les deux\" crée deux supports indépendants NFS",
+    "bothBody": "Les deux méthodes sont exécutées séparément : pvesm monte sur <code>/mnt/pve/&lt;id&gt;</code> et fstab sur <code>/mnt/&lt;path&gt;</code>. Cela fournit un montage géré par Proxmox avec ses options par défaut et un montage hôte séparé pour les bind mounts LXC. Deux points de montage ne garantissent pas deux connexions TCP ; le client NFS peut réutiliser les connexions de transport."
+  },
+  "pvesmBranch": {
+    "heading": "Méthode A — En tant que stockage Proxmox (pvesm)",
+    "intro": "Si <em>Comme stockage Proxmox</em> est marqué, ProxMenux exécute le flux pvesm d'origine:",
+    "items": [
+      "<strong>Storage ID</strong> — ce que Proxmox appellera ce stockage. La valeur par défaut est <code>nfs-&lt;server-ip-with-dashes&gt;</code>. Seules les lettres, chiffres, <code>-</code> et <code>_</code> sont acceptés.",
+      "<strong>Types de contenu</strong> — Proxmox relie les catégories de contenu aux volumes de stockage; choisissez ce que ce NFS peut contenir:"
+    ],
+    "headerType": "Type de contenu",
+    "headerAllows": "Ce qu'il permet",
+    "rows": [
+      {
+        "type": "import",
+        "allowsRich": "Importations d'images de disque (sélectionnées par défaut). Nécessaire pour <em>Importer l'image disque vers VM</em>."
+      },
+      {
+        "type": "backup",
+        "allowsRich": "Fichiers de sauvegarde VM et CT (<code>vzdump</code>)."
+      },
+      {
+        "type": "iso",
+        "allows": "Installation des images ISO."
+      },
+      {
+        "type": "vztmpl",
+        "allows": "Modèles LXC."
+      },
+      {
+        "type": "images",
+        "allows": "Images disque des VM en cours d’utilisation (ce NFS sert alors au stockage des disques VM)."
+      },
+      {
+        "type": "rootdir",
+        "allows": "Systèmes de fichiers racine LXC (rare pour NFS – lire la note ci-dessous)."
+      },
+      {
+        "type": "snippets",
+        "allows": "Scripts de hook et snippets cloud-init."
+      }
+    ],
+    "warnTitle": "images et rootdir sur NFS",
+    "warnBody": "Sélectionner <code>images</code> permet de stocker les disques VM sur NFS. Les performances dépendent du réseau, du serveur et de la charge ; une panne peut bloquer les E/S dépendant du montage. <code>rootdir</code> place les systèmes de fichiers racine LXC sur NFS, où les conteneurs non privilégiés peuvent rencontrer des limites de mappage UID, d’overlay et de propriété. Évaluez ces besoins avant d’y placer <code>images</code> / <code>rootdir</code> ; NFS convient aussi à <code>backup</code> / <code>iso</code> / <code>vztmpl</code>.",
+    "result": "Le résultat est <code>pvesm add nfs &lt;id&gt; --server &lt;srv&gt; --export &lt;path&gt; --content &lt;csv&gt;</code> et Proxmox se monte automatiquement à <code>/mnt/pve/&lt;id&gt;</code>."
+  },
+  "fstabBranch": {
+    "heading": "Méthode B — Montage fstab de l'hôte uniquement",
+    "intro": "Si <em>En tant que montage hôte fstab seulement</em> est marqué, ProxMenux demande un chemin de montage hôte et des options persistantes, puis monte et écrit l'entrée à <code>/etc/fstab</code>:",
+    "items": [
+      "<strong>Chemin de montage sur l’hôte</strong> — par défaut <code>/mnt/&lt;export-basename&gt;</code>. Ça doit être un chemin absolu. Si quelque chose y est déjà monté, ou si une entrée fstab existe pour le même chemin, ProxMenux vous avertit et vous propose de la remplacer.",
+      "<strong>Options de montage</strong> — <em>Lecture/écriture</em> (par défaut: <code>rw,hard,nofail,_netdev,rsize=131072,wsize=131072,timeo=600,retrans=2</code>), <em>Lecture seule</em>, <em>Personnalisé</em> (saisissez vos propres options)."
+    ],
+    "appliesIntro": "Une fois que vous avez confirmé, le script :",
+    "applies": [
+      "<code>mkdir -p</code> le chemin de montage.",
+      "<code>mount -t nfs -o &lt;opts&gt; &lt;srv&gt;:&lt;export&gt; &lt;path&gt;</code>.",
+      "Écrit une entrée d'une ligne à <code>/etc/fstab</code>: <code>&lt;srv&gt;:&lt;export&gt; &lt;path&gt; nfs &lt;opts&gt; 0 0</code>.",
+      "Exécute <code>systemctl daemon-reload</code> donc systemd prend la nouvelle entrée fstab.",
+      "Tente <code>chmod 1777</code> et <code>setfacl o::rwx</code> sur le point de montage, sans signaler l’échec éventuel. Ne réussit que si le serveur NFS le permet ; beaucoup d’exports NAS permettent déjà l’écriture à tous les utilisateurs."
+    ],
+    "lxcTitle": "Utilisation du montage fstab d'un LXC",
+    "lxcBody": "Le script affiche une commande <code>pct set</code> pour un bind mount, par exemple <code>pct set &lt;ctid&gt; -mp0 /mnt/&lt;path&gt;,mp=/mnt/&lt;ct-path&gt;,shared=1,backup=0</code>. Vous pouvez aussi utiliser le <mountLink>LXC Mount Manager</mountLink>, qui détecte les montages fstab. <strong>Rien n’est modifié dans le conteneur</strong>. L’accès depuis un CT non privilégié dépend des permissions serveur pour ses UID/GID mappés. Le script tente seulement des changements de permissions depuis l’hôte ; il ne garantit ni export accessible en écriture ni réglages par défaut des fabricants. En cas d’échec, consultez Dépannage.",
+    "noUiTitle": "Le montage fstab n'est PAS un stockage Proxmox",
+    "noUiBody": "Le support fstab hôte est invisible à l'interface web Proxmox — par conception. Il n'apparaît pas dans <em>Datacenter > Storage</em>, vous ne pouvez pas le sélectionner dans le créateur VM / CT et les tâches de sauvegarde Proxmox ne peuvent pas le cibler. C'est simplement un chemin du système de fichiers hôte. Si vous voulez aussi intégrer l'interface utilisateur, marquez les méthodes <em>les deux</em> dans le sélecteur."
+  },
+  "manual": {
+    "heading": "Équivalent manuel",
+    "pvesmIntro": "Méthode A (pvesm) :",
+    "fstabIntro": "Méthode B (fstab) :"
+  },
+  "view": {
+    "heading": "Affichage configuré NFS stockages",
+    "body": "Liste toutes les entrées NFS dans Proxmox (<code>pvesm status | awk ''$2 == \"nfs\"''</code>) avec serveur, exportation, types de contenu, chemin de montage et statut en direct. <strong>Note:</strong> cette vue affiche uniquement les stockages enregistrés par pvesm — les montages uniquement par fstab ne sont pas listés ici. Vérifiez ceux avec <code>findmnt -t nfs</code> ou <code>grep nfs /etc/fstab</code>."
+  },
+  "remove": {
+    "heading": "Supprimer le stockage NFS",
+    "body": "Exécute <code>pvesm remove &lt;storage-id&gt;</code> après une confirmation qui affiche le serveur / export / contenu. Seul l'enregistrement côté Proxmox est supprimé — <strong>le serveur NFS distant lui-même n'est jamais touché</strong>, aucun fichier n'est supprimé. Pour supprimer un montage uniquement fstab, modifiez <code>/etc/fstab</code> à la main et exécutez <code>umount &lt;path&gt;</code>.",
+    "warnTitle": "Sauvegarder les dépendances d'abord",
+    "warnBody": "Si les VM, les CT ou les tâches de sauvegarde renvoient encore à ce stockage (par ID), l'enlever les laisse pointer vers un magasin disparu. Proxmox va signaler l'erreur mais pas nettoyer. Déplacez ou supprimez ces références d'abord, puis supprimez le stockage."
+  },
+  "test": {
+    "heading": "Tester la connectivité NFS",
+    "body": "Exécute une passe diagnostique sur chaque stockage NFS enregistré dans Proxmox : vérifie que <code>showmount</code> est disponible, que <code>rpcbind</code> est en cours d'exécution, pinge chaque serveur, sonde le port 2049, appelle <code>showmount -e</code>, et enfin rapporte la propre vue de Proxmox (<code>pvesm status</code>). Bon premier arrêt quand un stockage affiche comme <em>inactive</em> dans l'interface utilisateur Proxmox."
+  },
+  "troubleshoot": {
+    "heading": "Dépannage",
+    "noServersTitle": "\"Aucun serveur NFS trouvé sur le réseau\"",
+    "noServersBody": "Auto-découverte utilise <code>nmap -p 2049 --open &lt;subnet&gt;/24</code>. Le serveur peut ne pas répondre si : il est sur un sous-réseau VLAN /, ses pare-feu bloquent les sondes nmap (beaucoup font) ou le port 2049 est intentionnellement fermé sur cette interface. Utilisez l'option <em>Manual</em> avec l'IP ou le nom d'hôte du serveur.",
+    "portTitle": "« Le port NFS (2049) est inaccessible »",
+    "portBody": "Ping a réussi, mais <code>nc -z -w 3 &lt;server&gt; 2049</code> a échoué. Vérifiez que le service NFS fonctionne sur le serveur (<code>systemctl status nfs-server</code> sous Linux, Panneau de configuration → Services de fichiers sur Synology, plugin NFS sur OMV / TrueNAS), et que le pare-feu permet 2049 depuis l'hôte Proxmox.",
+    "showmountTitle": "« Impossible de se connecter » depuis showmount",
+    "showmountBody": "Le serveur a refusé la requête de la liste d'exportation. Causes communes : le serveur fait respecter les CLA du client (votre IP Proxmox n'est pas sur la liste autorisée), <code>rpcbind</code> ne fonctionne pas sur le serveur, ou le serveur n'expose que NFSv4 avec <code>showmount</code> désactivé. Le chemin d'exportation peut encore être ajouté manuellement si vous le connaissez.",
+    "inactiveTitle": "Le stockage est inactif dans l'UI Proxmox",
+    "inactiveBody": "Lancez d’abord <em>Tester la connectivité NFS</em> : il vérifie que le serveur répond au ping, que le port 2049 est ouvert et que la liste des exports (<code>showmount -e</code>) est disponible. Si la connexion fonctionne mais que le stockage reste inactif, consultez <code>journalctl -u pvestatd</code> et la configuration serveur/export. Rétablissez d’abord connexion ou permissions. <code>pvesm set &lt;id&gt; --disable 0</code> active un stockage désactivé ; ce n’est pas une réparation générale de NFS.",
+    "lxcNoWriteTitle": "Le montage fstab fonctionne mais le LXC non privilégié ne peut pas écrire à travers un montage de liaison",
+    "lxcNoWriteBody": "L’accès NFS dépend des propriétaires, ACL et réglages de squash du serveur. Les options CIFS <code>uid=</code> et <code>file_mode=</code> ne s’appliquent <strong>pas</strong> à NFS. Avec le mappage LXC par défaut, root dans le CT devient l’UID 100000 de l’hôte, pas l’UID distant 0. Autorisez l’UID/GID réellement mappé ou l’identité anonyme du serveur. <code>no_root_squash</code> concerne seulement l’UID distant 0 et ne résout pas tous les cas d’UID 100000. Le script tente <code>chmod 1777</code> sans pouvoir contourner les permissions serveur.",
+    "fstabBootTitle": "fstab mount ne vient pas après le redémarrage",
+    "fstabBootBody": "Le script ajoute <code>nofail,_netdev</code> de sorte qu'une part manquante au démarrage ne bloque pas le démarrage. Si le montage n'arrive jamais : confirmez que le réseau est accessible (<code>ping &lt;server&gt;</code>), vérifiez <code>journalctl -u remote-fs.target</code>, et vérifiez que l'entrée est valide avec <code>mount -fav | grep nfs</code>. <code>mount -a</code> après le démarrage monte tout ce qui manque actuellement."
+  },
+  "related": {
+    "heading": "Autres",
+    "items": [
+      {
+        "href": "/docs/storage-share/host-samba",
+        "label": "Samba / CIFS comme stockage Proxmox",
+        "tail": "— même schéma de flux (méthode A pvesm + méthode B fstab) pour les partages SMB/CIFS."
+      },
+      {
+        "href": "/docs/storage-share/lxc-mount-points",
+        "label": "Gestionnaire de montage LXC",
+        "tailRich": "— lier le chemin <code>/mnt/&lt;path&gt;</code> dans un ou plusieurs conteneurs."
+      },
+      {
+        "href": "/docs/storage-share/lxc-nfs-client",
+        "label": "Client NFS dans LXC",
+        "tail": "— alternative: monter NFS directement de l'intérieur d'un conteneur privilégié (sans passer par l’hôte)."
+      }
+    ]
+  }
+}
diff --git a/web/messages/fr/docs/storage-share/host-samba.json b/web/messages/fr/docs/storage-share/host-samba.json
new file mode 100644
index 00000000..2c5d06d9
--- /dev/null
+++ b/web/messages/fr/docs/storage-share/host-samba.json
@@ -0,0 +1,172 @@
+{
+  "meta": {
+    "title": "Hôte : monter un partage Samba | Documentation ProxMenux",
+    "description": "Monter un partage externe de Samba / CIFS sur l'hôte Proxmox — soit sous forme de stockage Proxmox (pvesm add cifs), soit sous forme de montage fstab d'hôte uni avec uid/gid/file_mode ouvert (NON visible dans Datacenter > Storage), ou les deux. La méthode fstab ouvre les permissions afin qu'un montage non privilégié LXC liant le chemin puisse lire/écrire sans aucun changement à l'intérieur du conteneur.",
+    "ogTitle": "Hôte : monter un partage Samba | Documentation ProxMenux",
+    "ogDescription": "Montez un partage Samba / CIFS externe sur l’hôte Proxmox via pvesm, fstab avec permissions ouvertes pour les bind mounts LXC, ou les deux."
+  },
+  "header": {
+    "title": "Hôte : monter un partage Samba sur l’hôte",
+    "description": "Monter un partage externe de Samba (SMB / CIFS) — depuis un NAS, une boîte Windows, une exportation de TrueNAS SMB — sur l'hôte Proxmox. Choisissez une ou les deux méthodes : enregistrez-la en tant que stockage Proxmox (visible dans Datacenter > Storage) et/ou ajoutez un montage simple /etc/fstab sur un chemin que vous choisissez, avec ouvert uid/gid/file_mode afin que les LXC non privilégiés puissent fixer et écrire sans aucun changement à l'intérieur du conteneur.",
+    "section": "Stockage et partage · Hôte"
+  },
+  "intro": {
+    "title": "Ce que ça fait",
+    "body": "ProxMenux propose deux méthodes pour un partage Samba : <strong>(1) Stockage Proxmox</strong> via <code>pvesm add cifs</code>, visible dans Datacenter > Storage et monté sur <code>/mnt/pve/&lt;id&gt;</code>. Le mot de passe est conservé en clair dans <code>/etc/pve/priv/storage/&lt;id&gt;.pw</code>, protégé par le répertoire privé accessible uniquement à root : il s’agit d’un contrôle d’accès, pas d’un chiffrement. <strong>(2) Montage fstab de l’hôte</strong> à un chemin choisi, persistant via <code>/etc/fstab</code> avec <code>uid=0,gid=0,file_mode=0777,dir_mode=0777</code> pour permettre l’écriture depuis les montages liés des LXC non privilégiés. Les identifiants se trouvent dans un fichier réservé à root sous <code>/etc/samba/credentials/</code>, jamais directement dans <code>fstab</code>. Vous pouvez utiliser l’une des méthodes ou les deux."
+  },
+  "opening": {
+    "heading": "Ouverture de l'outil",
+    "body": "Dans le menu principal de ProxMenux, ouvrez <strong>Storage &amp; Share Manager → Mount Samba Share on Host</strong>. Le sous-menu comporte quatre options :",
+    "imageAlt": "Menu Samba Host Manager — Monter / Afficher / Supprimer / Tester la connectivité"
+  },
+  "howRuns": {
+    "heading": "Comment fonctionne le script",
+    "body": "Le flux a deux phases. Phase 1: découvrez le serveur, validez les identifiants, choisissez le partage, puis choisissez les méthodes de montage via une liste de contrôle. Phase 2 : seules les méthodes que vous avez marquées sont exécutées. Les identifiants sont nécessaires dès le départ parce que <code>smbclient</code> a besoin de ceux-ci pour lister les partages. Jusqu'à la confirmation finale, ni <code>/etc/pve/storage.cfg</code> ni <code>/etc/fstab</code> ne sont touchés."
+  },
+  "modes": {
+    "heading": "Choix de la méthode de montage (une ou deux options)",
+    "intro": "Après avoir sélectionné le partage et validé les identifiants, ProxMenux affiche une liste de contrôle avec les deux méthodes de montage. Vous pouvez marquer l'un ou l'autre, ou les deux. Si vous appuyez sur OK sans marquer quoi que ce soit, la boîte de dialogue réapparaît jusqu'à ce que vous choisissiez au moins une option ou appuyez sur Annuler pour quitter le flux.",
+    "headerMethod": "Méthode",
+    "headerMount": "Chemin de montage",
+    "headerUi": "Visible dans Datacenter > Stockage",
+    "headerUseCase": "Cas d'utilisation typique",
+    "rows": [
+      {
+        "method": "<strong>Comme stockage Proxmox (pvesm)</strong>",
+        "mountRich": "<code>/mnt/pve/&lt;storage-id&gt;</code> (géré par Proxmox)",
+        "ui": "Oui",
+        "useCase": "Sauvegardes, ISOs, modèles LXC — tout ce qui doit apparaître dans l'interface utilisateur Proxmox. Les disques en direct VM sont techniquement pris en charge mais découragés sur CIFS (blocage sémantique)."
+      },
+      {
+        "method": "<strong>Uniquement le fstab de l'hôte</strong>",
+        "mountRich": "<code>/mnt/&lt;path&gt;</code> avec uid/gid/file_mode ouverts",
+        "ui": "Non",
+        "useCaseRich": "Montez le partage dans des LXC par bind mount <em>sans</em> enregistrer de stockage Proxmox. Les permissions locales ouvertes facilitent l’accès des CT non privilégiés, mais le serveur SMB doit toujours autoriser l’utilisateur authentifié à écrire."
+      },
+      {
+        "method": "<strong>Les deux</strong>",
+        "mount": "Les deux chemins ci-dessus (deux points de montage du même export CIFS)",
+        "ui": "Oui",
+        "useCase": "Vous voulez l'intégration de l'interface utilisateur ET un chemin stable côté hôte avec des permissions ouvertes pour les montants de liaison LXC. Le montage pvesm utilise les valeurs par défaut de Proxmox; le montage fstab applique séparément l'uid/gid/file_mode."
+      }
+    ],
+    "bothTitle": "« Les deux » crée deux points de montage CIFS",
+    "bothBody": "pvesm monte sur <code>/mnt/pve/&lt;id&gt;</code> avec les options Proxmox par défaut. fstab monte sur <code>/mnt/&lt;path&gt;</code> avec <code>uid=0,gid=0,file_mode=0777,dir_mode=0777</code> pour l’accès local par bind mounts LXC. Le serveur SMB applique toujours les permissions de l’utilisateur du montage. Deux points de montage ne garantissent pas deux connexions TCP distinctes."
+  },
+  "pvesmBranch": {
+    "heading": "Méthode A — En tant que stockage Proxmox (pvesm)",
+    "intro": "Si <em>Comme stockage Proxmox</em> est marqué, ProxMenux exécute le flux pvesm d'origine:",
+    "items": [
+      "<strong>Storage ID</strong> — par défaut <code>cifs-&lt;server-ip-with-dashes&gt;</code>. Seulement lettres, chiffres, <code>-</code> et <code>_</code>.",
+      "<strong>Types de contenu</strong> — ce sélecteur ProxMenux propose <strong>6</strong> choix. Il omet <code>rootdir</code> par rapport à NFS ; c’est un choix du script, pas une interdiction des systèmes de fichiers racine LXC dans toutes les versions du backend CIFS Proxmox :"
+    ],
+    "headerType": "Type de contenu",
+    "headerAllows": "Ce qu'il permet",
+    "rows": [
+      {
+        "type": "import",
+        "allows": "Importations d'images de disque (sélectionnées par défaut)."
+      },
+      {
+        "type": "backup",
+        "allowsRich": "Fichiers de sauvegarde VM et CT (<code>vzdump</code>)."
+      },
+      {
+        "type": "iso",
+        "allows": "Installation des images ISO."
+      },
+      {
+        "type": "vztmpl",
+        "allows": "Modèles LXC."
+      },
+      {
+        "type": "images",
+        "allowsRich": "Images disque des VM en cours d’utilisation — <strong>avertissement dans le dialogue</strong>, voir ci-dessous."
+      },
+      {
+        "type": "snippets",
+        "allows": "Scripts de hook et snippets cloud-init."
+      }
+    ],
+    "warnTitle": "Live VM disques sur CIFS",
+    "warnBody": "Sélectionner <code>images</code> déclenche un avertissement ProxMenux : CIFS/SMB peut poser des problèmes de verrouillage lors des opérations sur disques VM. Le script recommande NFS mais permet de continuer. Sauvegardes et ISO sont des usages courants de CIFS. Évaluez verrouillage, instantanés, migration et charge avant d’utiliser CIFS pour <code>images</code>.",
+    "credsTitle": "Où pvesm stocke les identifiants",
+    "credsBody": "Le mot de passe n’est pas écrit dans <code>/etc/pve/storage.cfg</code>. Proxmox écrit les identifiants en clair dans <code>/etc/pve/priv/storage/&lt;storage-id&gt;.pw</code>, dans la zone privée du système de fichiers du cluster, lisible uniquement par <code>root</code> (mode <code>0600</code>) ; ils sont protégés par les droits d’accès, pas par un chiffrement. Après un changement de mot de passe serveur, utilisez <code>pvesm set &lt;id&gt; --password &lt;new&gt;</code> ou supprimez puis ajoutez le stockage via ProxMenux."
+  },
+  "fstabBranch": {
+    "heading": "Méthode B — Montage fstab de l'hôte uniquement",
+    "intro": "Si <em>Montage fstab sur l’hôte uniquement</em> est sélectionné, ProxMenux demande le chemin et les options persistantes, crée un fichier d’identifiants réservé à root en mode utilisateur, puis monte le partage et écrit l’entrée dans <code>/etc/fstab</code> :",
+    "items": [
+      "<strong>Chemin de montage sur l’hôte</strong> — par défaut <code>/mnt/&lt;share-name&gt;</code>. Ça doit être un chemin absolu. Si quelque chose y est déjà monté, ou si une entrée fstab existe, ProxMenux propose de la remplacer.",
+      "<strong>Options de montage</strong> — <em>Lecture/écriture</em> (par défaut: <code>rw,uid=0,gid=0,file_mode=0777,dir_mode=0777,iocharset=utf8,nofail,_netdev</code>), <em>Lecture seule</em> (<code>file_mode=0555,dir_mode=0555</code>), <em>Personnalisé</em> (saisissez vos options). Le script recommande des uid/gid/file_mode ouverts pour les écritures via bind mounts LXC."
+    ],
+    "credsTitle": "Fichier d’identifiants (mode utilisateur)",
+    "credsBody": "En mode utilisateur, ProxMenux crée un fichier d’identifiants réservé à root dans <code>/etc/samba/credentials/&lt;server&gt;_&lt;share&gt;.cred</code> (mode <code>0600</code>) avec des lignes <code>username=</code> et <code>password=</code>. L’entrée fstab le référence par l’option <code>credentials=</code> : le mot de passe en clair ne figure pas dans <code>/etc/fstab</code>. En mode invité, l’option <code>guest</code> remplace ce fichier, qui n’est pas créé.",
+    "appliesIntro": "Une fois que vous avez confirmé, le script :",
+    "applies": [
+      "<code>mkdir -p</code> le chemin de montage.",
+      "<code>mount -t cifs -o &lt;opts&gt;,credentials=&lt;file&gt;</code> (ou <code>guest</code>) <code>//&lt;srv&gt;/&lt;share&gt; &lt;path&gt;</code>.",
+      "Écrit une entrée d'une ligne à <code>/etc/fstab</code>: <code>//&lt;srv&gt;/&lt;share&gt; &lt;path&gt; cifs &lt;opts&gt; 0 0</code>.",
+      "Exécute <code>systemctl daemon-reload</code> donc systemd prend la nouvelle entrée fstab."
+    ],
+    "lxcTitle": "Utilisation du montage fstab d'un LXC non privilégié",
+    "lxcBody": "Les options CIFS <code>uid=0,gid=0,file_mode=0777,dir_mode=0777</code> ouvrent les permissions locales pour les bind mounts LXC. Les ACL serveur et la sémantique Unix/POSIX négociée peuvent encore limiter l’accès. <strong>Rien n’est modifié dans le conteneur</strong> : ni <code>chown</code> dans le CT, ni groupes, ni édition de <code>/etc/lxc</code>. La ligne <code>mp</code> est gérée dans la configuration Proxmox du CT. Utilisez la commande <code>pct set</code> affichée ou le <mountLink>LXC Mount Manager</mountLink>.",
+    "noUiTitle": "Le montage fstab n'est PAS un stockage Proxmox",
+    "noUiBody": "Le support fstab hôte est invisible à l'interface web Proxmox — par conception. Il n'apparaît pas dans <em>Datacenter > Storage</em>, vous ne pouvez pas le sélectionner dans le créateur VM / CT et les tâches de sauvegarde Proxmox ne peuvent pas le cibler. C'est simplement un chemin du système de fichiers hôte. Si vous voulez aussi intégrer l'interface utilisateur, marquez les méthodes <em>les deux</em> dans le sélecteur."
+  },
+  "manual": {
+    "heading": "Équivalent manuel",
+    "pvesmIntro": "Méthode A (pvesm) :",
+    "fstabUserIntro": "Méthode B (fstab, auth utilisateur) — fichier d'identification + montage:",
+    "fstabGuestIntro": "Méthode B (fstab, guest auth) — pas de dossier d'identification:"
+  },
+  "view": {
+    "heading": "Voir les stockages CIFS et montages de l’hôte",
+    "body": "Affiche les stockages CIFS enregistrés (<code>pvesm status | awk ''$2 == \"cifs\"''</code>) avec serveur, partage, contenu, utilisateur ou <em>Invité</em>, chemin et état. Les mots de passe ne sont <strong>jamais affichés</strong>. <strong>Note :</strong> une seconde section liste les montages fstab de l’hôte, leurs options, le chemin du fichier d’identifiants et leur état actif/inactif. Vérification manuelle avec <code>findmnt -t cifs</code> ou <code>grep cifs /etc/fstab</code>."
+  },
+  "remove": {
+    "heading": "Supprimer un stockage CIFS ou un montage hôte",
+    "body": "Le sélecteur propose les stockages pvesm et les montages fstab de l’hôte. Pour pvesm, il exécute <code>pvesm remove &lt;storage-id&gt;</code> et Proxmox retire les identifiants associés. Pour fstab, il tente <code>umount &lt;path&gt;</code>, retire l’entrée de <code>/etc/fstab</code> et les identifiants sous <code>/etc/samba/credentials/</code>, puis le répertoire vide si possible. Un échec du démontage exige un démontage manuel ou un redémarrage. <strong>Le serveur Samba distant et ses fichiers restent inchangés</strong>.",
+    "warnTitle": "Sauvegarder les dépendances d'abord",
+    "warnBody": "VMs, CTs ou tâches de sauvegarde qui renvoient à ce stockage par ID échoueront après la suppression. Déplacer / laisser tomber ces références avant de supprimer le stockage."
+  },
+  "test": {
+    "heading": "Tester la connectivité Samba",
+    "body": "Diagnostic de chaque stockage CIFS enregistré dans Proxmox : vérifie la présence de <code>smbclient</code>, teste ping et les ports 445/139, tente de lister les partages en invité et affiche l’état selon Proxmox (<code>pvesm status</code>). « Authentification requise » lors du test invité signifie que le serveur réserve les partages aux utilisateurs authentifiés, ce qui est normal pour la plupart des NAS."
+  },
+  "troubleshoot": {
+    "heading": "Dépannage",
+    "noServersTitle": "\"Aucun serveur Samba trouvé sur le réseau\"",
+    "noServersBody": "Auto-découverte utilise <code>nmap -p 139,445</code>. Le serveur peut être sur un sous-réseau différent, pare-feu, ou seulement accessible par hostname (mDNS / WINS). Utilisez l'option <em>Manual</em> avec l'IP ou le nom d'hôte à la place.",
+    "noSharesTitle": "« Aucun partage accessible trouvé »",
+    "noSharesBody": "<code>smbclient -L</code> n'a rien retourné pour ces références. Causes : l'utilisateur n'a pas la permission de lister des partages (essayez avec les identifiants d'administrateur une fois, ou entrez le nom du partage manuellement), le serveur a désactivé la visibilité du partage, ou les identifiants sont erronés. Le script vous permet de saisir le nom du partage à la main dans ce cas.",
+    "denyTitle": "Le montage Proxmox échoue avec NT_STATUS_ACCESS_DENIED",
+    "denyBody": "Les identifiants pvesm stockés sont hors de synchronisation avec le serveur Samba (mot de passe modifié, compte désactivé, domaine / groupe de travail incorrect). Rentrer les identifiants avec <code>pvesm set &lt;id&gt; --username &lt;u&gt; --password &lt;p&gt;</code> ou supprimer et réajouter de ProxMenux. Si le serveur est dans un domaine AD, ajoutez <code>--domain &lt;DOMAIN&gt;</code> à l'appel <code>pvesm set</code>.",
+    "sleepTitle": "\"l'hôte est en panne\" ou le statut de stockage est inactif la nuit",
+    "sleepBody": "Certains appareils NAS mettent SMB à dormir agressivement. <code>pvestatd</code> voit alors le stockage comme inactif jusqu'à ce que le premier accès réveille le NAS. Si c'est cosmétique, rien n'est cassé. Si cela provoque des défaillances de sauvegarde, désactivez la déconnexion au ralenti de SMB sur le NAS ou planifiez des sauvegardes à l'extérieur de la fenêtre de veille.",
+    "lxcNoWriteTitle": "Le bind mount du LXC non privilégié ne permet pas d’écrire dans le chemin fstab",
+    "lxcNoWriteBody": "Vérifiez les options voulues avec <code>findmnt /mnt/&lt;path&gt;</code>, par exemple <code>uid=0,gid=0,file_mode=0777,dir_mode=0777</code>. Des permissions locales insuffisantes peuvent bloquer les UID LXC mappés. Réappliquez le profil RW ou adaptez les options personnalisées. Vérifiez aussi les droits serveur de l’utilisateur SMB et si les extensions Unix/POSIX fournissent les modes serveur ; les modes locaux ouverts ne contournent pas les ACL serveur.",
+    "fstabBootTitle": "fstab mount ne vient pas après le redémarrage",
+    "fstabBootBody": "Le script ajoute <code>nofail,_netdev</code> de sorte qu'un partage manquant au démarrage ne bloque pas le démarrage. Si le montage n'arrive jamais : confirmez que le réseau est accessible (<code>ping &lt;server&gt;</code>), vérifiez <code>journalctl -u remote-fs.target</code>, vérifiez que le fichier d'identification existe toujours (<code>ls -l /etc/samba/credentials/</code>) et est lisible, et essayez <code>mount -a</code> manuellement."
+  },
+  "related": {
+    "heading": "Autres",
+    "items": [
+      {
+        "href": "/docs/storage-share/host-nfs",
+        "label": "Partage NFS comme stockage Proxmox",
+        "tail": "— page soeur avec le même schéma de flux (méthode A pvesm + méthode B fstab) et compromis côte à côte."
+      },
+      {
+        "href": "/docs/storage-share/lxc-mount-points",
+        "label": "Gestionnaire de montage LXC",
+        "tailRich": "— lier le chemin <code>/mnt/&lt;path&gt;</code> dans un ou plusieurs conteneurs."
+      },
+      {
+        "href": "/docs/storage-share/lxc-samba-client",
+        "label": "Client Samba en LXC",
+        "tail": "— alternative: monter Samba directement de l'intérieur d'un conteneur privilégié (sans passer par l’hôte)."
+      }
+    ]
+  }
+}
diff --git a/web/messages/fr/docs/storage-share/index.json b/web/messages/fr/docs/storage-share/index.json
new file mode 100644
index 00000000..4dc0a5b6
--- /dev/null
+++ b/web/messages/fr/docs/storage-share/index.json
@@ -0,0 +1,135 @@
+{
+  "meta": {
+    "title": "NFS, Samba, iSCSI et points de montage LXC dans Proxmox — Stockage et partage | ProxMenux",
+    "description": "Intégrez le stockage externe et local dans Proxmox VE et partagez des dossiers entre l’hôte et les conteneurs LXC. Ajoutez des partages NFS, Samba (CIFS) et des cibles iSCSI comme stockage Proxmox, configurez les bind mounts LXC avec Mount Manager et exécutez des clients et serveurs NFS ou Samba dans les conteneurs.",
+    "ogTitle": "Proxmox NFS, Samba, iSCSI et LXC Points de montage — Stockage et partage",
+    "ogDescription": "Intégrez le stockage externe / local dans Proxmox VE — NFS, Samba, enregistrement iSCSI plus les bind mounts LXC et le partage de réseau.",
+    "twitterTitle": "Proxmox NFS, Samba, iSCSI | ProxMenux",
+    "twitterDescription": "Ajouter NFS / Samba / iSCSI comme stockage Proxmox et partager des dossiers entre hôte et LXC."
+  },
+  "header": {
+    "title": "Gestionnaire de stockage et de partage",
+    "description": "Intégrez le stockage externe ou local dans Proxmox VE et partagez des dossiers entre l’hôte et les conteneurs LXC. Trois groupes d’outils : intégration du stockage de l’hôte (enregistrement dans Proxmox), LXC Mount Manager (bind mounts avec gestion pratique des permissions) et partage réseau LXC (procédures client et serveur NFS ou Samba pour des besoins précis).",
+    "section": "Stockage et partage"
+  },
+  "intro": {
+    "title": "Ce menu sert à",
+    "body": "Le gestionnaire de disques agit au niveau des <em>disques physiques individuels</em>. Storage &amp; Share Manager agit au niveau supérieur : il <strong>enregistre les pools de stockage et les partages réseau dans Proxmox</strong> (pour que l’interface et l’outil de création de VM puissent les utiliser) et <strong>configure le partage de fichiers entre l’hôte et vos conteneurs</strong>."
+  },
+  "opening": {
+    "heading": "Ouverture du menu",
+    "body": "Dans le menu principal de ProxMenux, sélectionnez <strong>Storage &amp; Share Manager</strong>. Vous verrez ceci :",
+    "imageAlt": "Menu Storage & Share Manager avec blocs HOST et LXC"
+  },
+  "groups": {
+    "heading": "Trois groupes d'outils",
+    "intro": "Le menu se divise en trois groupes. <strong>Intégration du stockage de l’hôte</strong> enregistre le stockage externe ou local dans Proxmox. Le <strong>LXC Mount Manager</strong> est l’outil principal pour partager des dossiers avec les conteneurs : une procédure de bind mount qui gère la correspondance des UID non privilégiés côté hôte. <strong>Partage réseau LXC</strong> couvre quatre scénarios supplémentaires dans lesquels un conteneur doit directement <em>utiliser</em> ou <em>exposer</em> des partages NFS ou Samba.",
+    "hostTitle": "Stockage de l'hôte",
+    "hostBody": "Enregistrer le stockage externe et local dans Proxmox via <code>pvesm add …</code>. Une fois enregistré, le stockage apparaît dans l'interface utilisateur Proxmox et est disponible pour les créateurs VM et CT.",
+    "hostItems": [
+      "NFS / Samba / iSCSI externes → stockage Proxmox",
+      "Disque local → Répertoire Proxmox ou stockage ZFS",
+      "Répertoire local partagé (pour les bind mounts entre CT)"
+    ],
+    "lxcMountTitle": "Gestionnaire de montage LXC",
+    "lxcMountBody": "L’outil principal de partage LXC. Il monte les répertoires de l’hôte dans les conteneurs par bind mount via <code>pct set -mpN</code> et gère les particularités des permissions des CT non privilégiés, sans créer de groupe ni d’utilisateur dans le conteneur.",
+    "lxcMountItems": [
+      "Fonctionne avec des CT privilégiés et non privilégiés",
+      "Propose <code>o+rwx</code> sur le répertoire hôte pour les UID non privilégiés",
+      "Correction des montages CIFS / NFS existants si nécessaire"
+    ],
+    "lxcNetTitle": "Partage de réseau LXC",
+    "lxcNetBody": "Quatre procédures supplémentaires pour les conteneurs qui doivent utiliser ou exposer directement des partages NFS ou Samba. Toutes exigent un conteneur <strong>privilégié</strong>.",
+    "lxcNetItems": [
+      "<strong>Client</strong> NFS / Samba (utiliser des partages externes)",
+      "NFS / Samba <strong>serveur</strong> (exposer les dossiers CT)"
+    ]
+  },
+  "host": {
+    "heading": "Intégration du stockage de l'hôte",
+    "intro": "Enregistrer le stockage dans Proxmox. Chaque option appelle <code>pvesm add …</code> sous le capot, de sorte que le stockage apparaît dans <strong>Datacenter → Storage</strong> et devient disponible pour les créateurs VM / CT.",
+    "options": [
+      {
+        "href": "/docs/storage-share/host-nfs",
+        "icon": "Network",
+        "title": "Ajouter un partage NFS comme stockage Proxmox",
+        "description": "Enregistrez un export NFS externe comme stockage Proxmox avec pvesm add nfs. Proxmox gère le montage, sans ajout dans fstab."
+      },
+      {
+        "href": "/docs/storage-share/host-samba",
+        "icon": "Share2",
+        "title": "Ajouter un partage Samba comme stockage Proxmox",
+        "description": "Enregistrez un partage Samba ou CIFS externe comme stockage Proxmox avec pvesm add cifs. Proxmox gère le montage et les identifiants."
+      },
+      {
+        "href": "/docs/storage-share/host-iscsi",
+        "icon": "Database",
+        "title": "Ajouter la cible iSCSI comme stockage Proxmox",
+        "description": "Connectez-vous à une cible externe iSCSI et enregistrez-la en tant que stockage Proxmox (périphérique bloc) pour les images de disque VM."
+      },
+      {
+        "href": "/docs/storage-share/host-local-disk",
+        "icon": "HardDrive",
+        "title": "Ajouter le disque local comme stockage Proxmox",
+        "description": "Formatez un disque local SATA / SAS / NVMe et enregistrez-le comme stockage de type répertoire ou pool ZFS dans Proxmox."
+      },
+      {
+        "href": "/docs/storage-share/host-local-shared",
+        "icon": "FolderOpen",
+        "title": "Ajouter un répertoire partagé sur Host",
+        "description": "Créer un répertoire hôte destiné à être monté sur plusieurs CT. Pas un stockage Proxmox — purement une ressource côté hôte pour les bind mounts LXC."
+      }
+    ]
+  },
+  "lxcMount": {
+    "heading": "Gestionnaire de montage LXC",
+    "intro": "L'outil principal pour le partage des dossiers entre l'hôte Proxmox et les conteneurs LXC. Il utilise <code>pct set -mpN</code> pour relier un répertoire hôte dans le conteneur, et gère les quirks de permission des CT non privilégiés du côté hôte (aucun groupe ou utilisateur ne sont créés à l'intérieur du conteneur).",
+    "card": {
+      "title": "Points de montage LXC (hôte ↔ CT)",
+      "description": "Bind-mount n'importe quel répertoire hôte dans un conteneur LXC via pct set -mpN. Fonctionne avec des CT privilégiés et non privilégiés; offre chmod o+rwx / ACLs sur le répertoire hôte et corrige les montages CIFS / NFS existants au besoin."
+    }
+  },
+  "lxcNet": {
+    "heading": "Partage de réseau LXC",
+    "intro": "Utilisez ces procédures quand le conteneur doit <em>être</em> un point d’accès NFS ou Samba : utiliser un partage externe (client) ou exposer ses propres dossiers (serveur). Pour la plupart des partages de fichiers (bind mounts hôte ↔ CT), le <mountLink>LXC Mount Manager</mountLink> est plus simple et ne nécessite pas de conteneurs privilégiés.",
+    "options": [
+      {
+        "href": "/docs/storage-share/lxc-nfs-client",
+        "icon": "Download",
+        "title": "Client NFS dans LXC",
+        "description": "Montez des partages NFS externes depuis un conteneur LXC privilégié. Détection automatique, persistance dans /etc/fstab et démontages propres pris en charge."
+      },
+      {
+        "href": "/docs/storage-share/lxc-samba-client",
+        "icon": "Download",
+        "title": "Client Samba en LXC",
+        "description": "Montez des partages Samba / CIFS depuis un conteneur LXC privilégié. Identifiants stockés de manière protégée et détection automatique disponible."
+      },
+      {
+        "href": "/docs/storage-share/lxc-nfs-server",
+        "icon": "Upload",
+        "title": "Serveur NFS dans LXC",
+        "description": "Exporter des dossiers sur NFS à partir d'un conteneur LXC privilégié."
+      },
+      {
+        "href": "/docs/storage-share/lxc-samba-server",
+        "icon": "Upload",
+        "title": "Serveur Samba en LXC",
+        "description": "Exposer les dossiers sur SMB / CIFS de l'intérieur d'un conteneur privilégié LXC."
+      }
+    ]
+  },
+  "privReq": {
+    "title": "Exigences concernant les conteneurs privilégiés",
+    "body": "Les quatre procédures de <strong>partage réseau LXC</strong> ci-dessus exigent un conteneur <strong>privilégié</strong>. Les scripts imposent ce mode pris en charge avant de configurer les services et outils de montage (<code>nfs-kernel-server</code>, <code>smbd</code>, <code>mount.nfs</code>, <code>mount.cifs</code>). Pour partager des fichiers entre l’hôte et un CT non privilégié, utilisez le <mountLink>LXC Mount Manager</mountLink> : il réalise les bind mounts et ajuste les permissions côté hôte pour permettre la lecture et l’écriture sans configurer ces services ou outils dans le conteneur."
+  },
+  "unprivExplain": {
+    "title": "Comment ProxMenux gère les autorisations de CT non privilégiées",
+    "body": "Les conteneurs LXC non privilégiés décalent leurs UID de <strong>+100000</strong> sur l’hôte (UID 0 du conteneur = UID 100000 de l’hôte, UID 1000 du conteneur = UID 101000 de l’hôte, …). Un fichier créé par un utilisateur du conteneur apparaît donc comme appartenant aux <em>autres</em> sur l’hôte, sans utilisateur ni groupe hôte ordinaire correspondant. LXC Mount Manager propose une solution pratique : plutôt que d’aligner les UID/GID entre hôte et CT, il propose <code>chmod o+rwx</code> et les ACL correspondantes sur le répertoire hôte pour que tout UID mappé puisse lire et écrire. Pour CIFS, il remonte avec <code>uid=0,gid=0,file_mode=0777,dir_mode=0777</code> ; pour NFS, il configure un répertoire accessible en écriture à tous avec sticky bit et, si le serveur applique root squash, indique la correction à effectuer côté serveur."
+  },
+  "scripts": {
+    "heading": "Scripts concernés",
+    "intro": "Chaque page se connecte au script qui conduit son flux. Le fichier ci-dessous est un helper partagé qui n'est pas documenté comme sa propre page mais est utilisé par plusieurs flux de partage de réseau LXC:",
+    "itemTail": "— validation CT, sélection de points de montage, contrôle privilégié et helpers de configuration de groupe universels partagés sur les flux client/serveur LXC."
+  }
+}
diff --git a/web/messages/fr/docs/storage-share/lxc-mount-points.json b/web/messages/fr/docs/storage-share/lxc-mount-points.json
new file mode 100644
index 00000000..1cee1453
--- /dev/null
+++ b/web/messages/fr/docs/storage-share/lxc-mount-points.json
@@ -0,0 +1,174 @@
+{
+  "meta": {
+    "title": "Points de montage LXC (hôte ↔ conteneur) | Documentation ProxMenux",
+    "description": "Le gestionnaire de montages LXC rend tout répertoire de l’hôte accessible dans un ou plusieurs conteneurs LXC par bind mount via pct set -mpN. Il gère les particularités des permissions des conteneurs non privilégiés, corrige les montages CIFS / NFS sur l’hôte et ne modifie rien dans le conteneur.",
+    "ogTitle": "Points de montage LXC (hôte ↔ conteneur) | Documentation ProxMenux",
+    "ogDescription": "Montez les répertoires de l’hôte dans les conteneurs LXC par bind mount. Gestion pratique du mappage UID non privilégié et correction des accès CIFS / NFS sur l’hôte."
+  },
+  "header": {
+    "title": "Points de montage LXC (hôte ↔ conteneur)",
+    "description": "L'outil principal pour le partage des dossiers entre l'hôte Proxmox et les conteneurs LXC. Bind-mount n'importe quel répertoire hôte dans un ou plusieurs conteneurs en utilisant la syntaxe native pct set -mpN de Proxmox. Le point fort : il résout les maux de tête d'autorisation des conteneurs non privilégiés du côté hôte – il ne modifie jamais rien à l'intérieur du conteneur.",
+    "section": "Stockage et partage · LXC"
+  },
+  "intro": {
+    "title": "Ce que ça fait",
+    "body": "Prenez un répertoire qui vit sur l'hôte Proxmox (un dossier local, un NAS partagé, un stockage géré par Proxmox...) et faites-le apparaître à l'intérieur d'un conteneur LXC sur un chemin que vous choisissez, avec des permissions qui fonctionnent même pour des conteneurs non privilégiés — sans rien toucher à l'intérieur du conteneur."
+  },
+  "bigPicture": {
+    "heading": "Comment ça marche (la grande image)",
+    "intro": "Un bind mount demande au noyau de rendre le répertoire <code>X</code> de l’hôte également accessible au chemin <code>Y</code> du conteneur. Aucune copie, synchronisation ou transmission réseau : les deux côtés voient les <em>mêmes fichiers</em> en même temps.",
+    "sourceLabel": "Hôte Proxmox",
+    "sourceDetail": "/mnt/data\n(votre dossier)",
+    "targetLabel": "Conteneur LXC",
+    "targetDetail": "/mnt/data\n(apparaît ici)",
+    "arrowLabel": "bind mount",
+    "outro": "Le chemin de l'hôte à gauche et le chemin du conteneur à droite peuvent être différents — par exemple, <code>/mnt/nas-films</code> sur l'hôte peut devenir <code>/media/films</code> à l'intérieur du conteneur. Le script ajoute l'entrée à la configuration du conteneur (<code>/etc/pve/lxc/&lt;ctid&gt;.conf</code>) en utilisant le prochain index libre <code>mpN</code>, avec deux paramètres de sécurité par défaut:",
+    "items": [
+      "<code>shared=1</code> — indique à Proxmox que les données sont partagées et ne doivent pas être migrées avec le CT. Ce drapeau ne réplique rien : le même chemin et les mêmes données doivent déjà être disponibles sur le nœud cible.",
+      "<code>backup=0</code> — exclut le montage de liaison des sauvegardes <code>vzdump</code> (les données vivent sur l'hôte, vous les sauvegardez séparément)."
+    ]
+  },
+  "perms": {
+    "heading": "Gestion des autorisations — la partie smart",
+    "intro": "Les bind mounts sont faciles en principe. La partie dure est permissions : un conteneur <strong>non privilégié</strong> LXC déplace chaque UID par <strong>+100000</strong>, donc un fichier créé à l'intérieur du conteneur par l'utilisateur 1000 apparaît sur l'hôte sous le nom d'UID 101000 — un UID que personne ne possède sur l'hôte. Pour que cela fonctionne sans aligner les UIDs sur les hôtes et les conteneurs, ProxMenux applique le bon \"ouvrir les permissions\" sur le côté <em>hôte</em>, selon le type de répertoire que vous avez choisi:",
+    "headerType": "Type de répertoire hôte",
+    "headerAction": "Ce que le script offre à faire",
+    "localType": "Dossier local",
+    "localTypeSub": "Par exemple /mnt/data",
+    "localActionRich": "<code>chmod o+rwx</code> + <code>setfacl o::rwx</code> dans le répertoire hôte. Seulement offert si le CT n'est pas privilégié et que les autorisations actuelles sont insuffisantes.",
+    "cifsType": "CIFS monté / SMB",
+    "cifsTypeSub": "Par exemple /mnt/pve/cifs-…",
+    "cifsActionRich": "Remonter avec <code>uid=0, gid=0, file_mode=0777, dir_mode=0777</code> afin que le CT (tout UID) puisse lire et écrire le partage. <code>/etc/fstab</code> est mis à jour.",
+    "nfsType": "NFS monté",
+    "nfsTypeSub": "Par exemple /mnt/pve/nfs-…",
+    "nfsActionRich": "<code>chmod 1777</code> + <code>setfacl o::rwx</code> sur le support NFS. Impossible de surcharger le squashing côté serveur — si même l'hôte root ne peut pas écrire, vous êtes guidé pour corriger l'exportation sur le serveur NFS.",
+    "privTitle": "Les conteneurs privilégiés n'ont pas besoin de ça",
+    "privBody": "Pour les conteneurs privilégiés, UID 0 dans le CT est UID 0 sur l'hôte — root à l’intérieur du CT peut lire et écrire le répertoire hôte directement sans aucun tour de permission. Le script détecte cela et saute l'étape \"ouvrir les permissions\" entièrement.",
+    "noCtTitle": "Le script ne modifie jamais rien à l'intérieur du conteneur",
+    "noCtBody": "Toutes les modifications d'autorisation se produisent sur le système de fichiers <strong>host</strong>. Pas de chowns <code>pct exec</code>, pas de groupes créés dans le CT, pas de fstab à l'intérieur du conteneur. Si vous réutilisez le répertoire relié dans un autre CT plus tard, les mêmes permissions s'appliquent automatiquement — pas de configuration par conteneur."
+  },
+  "writes": {
+    "heading": "Ce que ProxMenux écrit — et ce qu'il ne fait pas",
+    "intro": "Une confusion fréquente lors du montage de la liaison dans un CT non privilégié: les gens supposent que ProxMenux doit écrire des entrées <code>lxc.idmap</code> dans <code>/etc/pve/lxc/&lt;CTID&gt;.conf</code>. <strong>Il ne le fait pas.</strong> Une seule ligne est annexée à ce fichier — le montage de liaison lui-même:",
+    "outro": "La ligne de sortie que vous voyez à la fin de l'exécution, <em>\"Conteneur non privilégié — Offset UID: 100000\"</em>, est purement informative — elle vous indique simplement que le CT utilise la cartographie non privilégiée par défaut de Proxmox (root dans CT = UID 100000 sur l'hôte). Le script ne configure rien autour.",
+    "twoWaysHeading": "Les deux façons de faire fonctionner les permissions — et pourquoi ProxMenux en choisit une",
+    "headerApproach": "Approche",
+    "headerChanges": "Ce que ça change",
+    "headerWhen": "Quand ça va",
+    "hostType": "Permissions côté hôte",
+    "hostTypeSub": "(ce que ce script fait)",
+    "hostChangesRich": "<code>chmod o+rwx</code> + <code>setfacl o::rwx</code> dans le répertoire hôte. Les UIDs cartographiés du CT (100000+) tombent dans le seau \"autres\", donc ouvrir le <em>autres</em> suffit.",
+    "hostWhen": "Accès à dossier partagé générique depuis n'importe quel CT. Plusieurs CT partageant le même répertoire hôte. Simple et réutilisable.",
+    "idmapTypeRich": "<code>lxc.idmap</code>",
+    "idmapTypeSub": "(non utilisé par ce script)",
+    "idmapChangesRich": "Carte UID/GID personnalisée dans <code>/etc/pve/lxc/&lt;CTID&gt;.conf</code> plus les entrées correspondantes <code>/etc/subuid</code> + <code>/etc/subgid</code> sur l'hôte. Le CT doit être redémarré sur chaque changement.",
+    "idmapWhenRich": "Vous avez besoin d'un UID <em>spécifique</em> à l'intérieur du CT pour cartographier un UID <em>spécifique</em> sur l'hôte (p. ex. <code>media:1000</code> dans le CT doit posséder des fichiers comme <code>media:1000</code> sur l'hôte de sorte que NFS ne squash). Une configuration plus rigide, normalement ne vaut que pour ce scénario exact.",
+    "idmapTipTitle": "Lorsque vous avez réellement besoin de lxc.idmap",
+    "idmapTipBody": "Utilisez le mappage manuel si les fichiers écrits dans le CT doivent avoir un UID/GID numérique précis sur l’hôte, par exemple pour partager le propriétaire avec un utilisateur de l’hôte. Il ne contourne pas <code>all_squash</code> de NFS : le serveur décide toujours de l’identité anonyme et des permissions. Ajoutez au besoin des entrées <code>lxc.idmap</code> manuellement. La ligne de bind mount en est indépendante."
+  },
+  "opening": {
+    "heading": "Ouverture de l'outil",
+    "body": "Dans le menu principal de ProxMenux, ouvrez <strong>Storage &amp; Share Manager → Configure LXC Mount Points (Host ↔ Container)</strong>. Le sous-menu comporte trois options :",
+    "imageAlt": "Menu LXC Mount Manager — Ajouter / Afficher / Supprimer"
+  },
+  "addFlow": {
+    "heading": "Ajouter un montage — procédure complète",
+    "intro": "La vue technique, pour savoir exactement ce que fait chaque boîte de dialogue :"
+  },
+  "sources": {
+    "heading": "Ce que vous pouvez choisir comme répertoire hôte",
+    "intro": "Le sélectionneur de répertoire hôte est le plus complet de la section Stockage &amp; Share. Il scanne quatre sources et présente une liste dédoublée :",
+    "headerSource": "Source",
+    "headerWhere": "D'où ça vient",
+    "headerLabel": "Étiquette dans le menu",
+    "rows": [
+      {
+        "source": "Montages en réseau actifs",
+        "whereRich": "Partages CIFS / NFS actuellement montés, lus dans <code>/proc/mounts</code>.",
+        "labelRich": "<code>NFS [used/size]</code> ou <code>CIFS/SMB [used/size]</code>"
+      },
+      {
+        "source": "Montages fstab inactifs",
+        "whereRich": "Défini dans <code>/etc/fstab</code> mais pas actuellement monté.",
+        "labelRich": "<code>fstab(off)-NFS</code> / <code>fstab(off)-CIFS/SMB</code>"
+      },
+      {
+        "source": "Répertoires locaux",
+        "whereRich": "Les répertoires Sub sous <code>/mnt</code> qui ne sont pas des montages réseau.",
+        "labelRich": "<code>Local [size]</code>"
+      },
+      {
+        "source": "Stockages Proxmox",
+        "whereRich": "Voies de stockage sous <code>/mnt/pve/*</code> (NFS / CIFS enregistrées via <code>pvesm</code>).",
+        "labelRich": "<code>PVE-NFS</code> / <code>PVE-CIFS/SMB</code> / <code>Proxmox-Storage</code>"
+      },
+      {
+        "source": "Entrée manuelle",
+        "where": "N'importe quoi d'autre — tapez le chemin absolu vous-même.",
+        "labelRich": "<em>Saisir le chemin manuellement</em>"
+      }
+    ],
+    "tipTitle": "Les chemins internes Proxmox sont filtrés",
+    "tipBody": "Le sélecteur saute explicitement les chemins Proxmox internes (<code>/mnt/pve/local</code>, <code>/mnt/pve/local-lvm</code>, <code>/mnt/pve/backup</code>, ...) — ceux-ci sont réservés aux internes Proxmox et vous ne devriez pas les fixer. Seuls les stockages ajoutés par l'utilisateur apparaissent."
+  },
+  "manual": {
+    "heading": "Équivalent manuel",
+    "privIntro": "Pour un conteneur privilégié — le cas le plus simple, pas de tours de permission:",
+    "unprivLocalIntro": "Pour un conteneur non privilégié avec un répertoire d'hôte local — ouvrir les permissions sur l'hôte d'abord:",
+    "unprivCifsIntro": "Pour un conteneur non privilégié avec un partage CIFS déjà montée sur l'hôte:"
+  },
+  "view": {
+    "heading": "Afficher les points de montage",
+    "body": "Liste toutes les entrées <code>mpN</code> sur chaque conteneur de cet hôte Proxmox, regroupées par CT id et montrant le chemin hôte → chemin conteneur plus toutes les options supplémentaires. En lecture seule — utile comme vérification de cohérence avant d'ajouter ou de supprimer quoi que ce soit."
+  },
+  "remove": {
+    "heading": "Supprimer un point de montage",
+    "body": "Choisissez le contenant, choisissez l'entrée <code>mpN</code>, confirmez. Le script lance <code>pct set --delete mpN</code> pour supprimer l'entrée de la configuration CT et propose de redémarrer le conteneur s'il est en cours d'exécution. Le répertoire hôte et son contenu sont <strong>non touché</strong> — vous pouvez rajouter le montage plus tard (ou attacher le même répertoire à un autre CT).",
+    "warnTitle": "Les conteneurs en cours d’exécution doivent redémarrer pour appliquer les changements",
+    "warnBody": "L'ajout et la suppression de points de montage ne deviennent visibles à l'intérieur du conteneur qu'après un redémarrage. Le script offre un <code>pct reboot</code> en un clic à la fin de chaque opération ; vous pouvez décliner et redémarrer manuellement plus tard."
+  },
+  "troubleshoot": {
+    "heading": "Dépannage",
+    "noMountTitle": "Mont apparaît en pct config mais pas dans le conteneur",
+    "noMountBody": "Les bind mounts ne sont attachés que lorsque le conteneur démarre. Si vous avez ajouté le montage pendant que le CT était en cours d'exécution, redémarrez-le (<code>pct reboot &lt;ctid&gt;</code>). Si elle est déjà redémarrée et manquante, vérifiez que <code>pct config &lt;ctid&gt;</code> confirme que l'entrée existe et que le chemin hôte contient un répertoire.",
+    "noWriteTitle": "Le conteneur peut voir le répertoire mais ne peut pas écrire",
+    "noWriteBody": "Presque toujours un problème de permissions. Pour les conteneurs non privilégiés, lancez à nouveau la correction de l'autorisation du script — les ACL du répertoire hôte peuvent avoir été réinitialisés par un autre outil (rsync, restauration de sauvegarde, manuel <code>chmod</code>). Pour CIFS, double-vérifiez les options de montage sur l'hôte : <code>findmnt /mnt/pve/cifs-…</code>, recherchez les valeurs <code>uid=</code> / <code>gid=</code> / <code>file_mode=</code>.",
+    "alreadyTitle": "\"Ce chemin est déjà utilisé comme point de montage dans ce conteneur\"",
+    "alreadyBody": "Vous avez choisi le même chemin de conteneur qui est déjà connecté à un autre répertoire hôte. Soit choisir un chemin de conteneur différent, soit enlever le point de montage existant en premier.",
+    "nfsTitle": "L'accès NFS est bloqué même après l'application de la correction hôte",
+    "nfsIntro": "Votre serveur NFS est un squashing root ou toutes les connexions. Le script peut détecter cela (il essaie d'écrire un fichier de test à partir de l'hôte) et affiche des conseils côté serveur. Deux corrections communes côté serveur pour l'exportation:",
+    "nfsItems": [
+      "<code>no_root_squash</code> — les CT privilégiés peuvent écrire directement.",
+      "<code>all_squash,anonuid=65534,anongid=65534</code> — pour les CT non privilégiés."
+    ],
+    "nfsOutro": "Ces changements se produisent sur le serveur NFS (TrueNAS, Synology, votre exportation personnalisée, ...), pas sur Proxmox.",
+    "fstabOffTitle": "Le montage des entrées \"fstab(off)\" ne fait rien",
+    "fstabOffBody": "Le sélecteur affiche les entrées <code>fstab(off)-</code> lorsqu'un montage réseau est défini dans fstab mais pas actuellement monté. Le script vous permet de lier le chemin, mais le répertoire sera vide jusqu'à ce que vous montez réellement le partage (<code>mount &lt;path&gt;</code> sur l'hôte). Montez-le d'abord, puis liez-le au CT."
+  },
+  "related": {
+    "heading": "Autres",
+    "items": [
+      {
+        "href": "/docs/storage-share/host-local-shared",
+        "label": "Ajouter un répertoire partagé sur l'hôte",
+        "tailRich": "— première étape typique: préparer un <code>/mnt/shared</code> sur l'hôte avant de le fixer dans un ou plusieurs CTs ici."
+      },
+      {
+        "href": "/docs/storage-share/host-nfs",
+        "label": "Ajouter un partage NFS comme stockage Proxmox",
+        "extraHref": "/docs/storage-share/host-samba",
+        "extraLabel": "Ajouter un partage Samba comme stockage Proxmox",
+        "joiner": " / ",
+        "tailRich": "— enregistrer d'abord un partage externe dans Proxmox, puis fixer son chemin <code>/mnt/pve/&lt;id&gt;</code> dans le CT ici."
+      },
+      {
+        "href": "/docs/storage-share/lxc-nfs-client",
+        "label": "Client NFS dans LXC",
+        "extraHref": "/docs/storage-share/lxc-samba-client",
+        "extraLabel": "Client Samba en LXC",
+        "joiner": " / ",
+        "tail": "— l'alternative lorsque vous voulez que le CT lui-même monte le partage (exige un conteneur privilégié)."
+      }
+    ]
+  }
+}
diff --git a/web/messages/fr/docs/storage-share/lxc-nfs-client.json b/web/messages/fr/docs/storage-share/lxc-nfs-client.json
new file mode 100644
index 00000000..4111b639
--- /dev/null
+++ b/web/messages/fr/docs/storage-share/lxc-nfs-client.json
@@ -0,0 +1,128 @@
+{
+  "meta": {
+    "title": "NFS client en LXC | ProxMenux Documentation",
+    "description": "Montez des partages NFS directement dans un conteneur LXC Proxmox avec ProxMenux. Installation automatique de nfs-common, découverte sur le LAN, montages persistants via /etc/fstab et paramètres de démarrage sûrs. Nécessite un conteneur privilégié.",
+    "ogTitle": "NFS client en LXC | ProxMenux Documentation",
+    "ogDescription": "Montez des partages NFS dans un conteneur LXC privilégié. Découverte automatique, persistance dans /etc/fstab et paramètres de démarrage sûrs."
+  },
+  "header": {
+    "title": "Client NFS dans LXC",
+    "description": "Montez des partages NFS directement dans un conteneur LXC Proxmox. Le conteneur devient un véritable client NFS : il communique avec le serveur par le réseau, exécute mount.nfs et écrit dans /etc/fstab. ProxMenux installe nfs-common, aide à trouver les serveurs et exports et applique des paramètres de démarrage sûrs.",
+    "section": "Stockage et partage · LXC"
+  },
+  "privReq": {
+    "title": "Conteneur privilégié requis",
+    "body": "Le client du noyau <code>mount.nfs</code> a besoin de capacités (<code>SYS_ADMIN</code> au minimum) que les conteneurs non privilégiés LXC n'exposent pas. Le script force cela — il vous demande de choisir un CT et <strong>s’arrête s'il n'est pas privilégié</strong>. Si vous avez besoin du partage à l'intérieur d'un CT non privilégié, montez-la d'abord sur l'hôte Proxmox (avec <hostNfsLink>NFS en tant que stockage Proxmox</hostNfsLink>) et montez-la par bind mount dans le CT avec le <mountLink>LXC Mount Manager</mountLink>."
+  },
+  "what": {
+    "heading": "Ce que ça fait",
+    "body": "Contrairement au gestionnaire de montage LXC — ce qui fait que le CT voit quelque chose <em>via</em> l'hôte Proxmox — ce script donne au conteneur son <strong>propre client NFS</strong>: il parle NFS sur le réseau, monte des partages directement du serveur NFS et stocke le montage dans le <code>/etc/fstab</code> du conteneur. L'hôte Proxmox n'est pas dans le chemin de données.",
+    "diagramServerLabel": "Serveur NFS",
+    "diagramServerDetail": "/export/data",
+    "diagramHostLabel": "Hôte Proxmox",
+    "diagramHostDetail": "(seulement un\npont réseau)",
+    "diagramCtLabel": "LXC (privilégié)",
+    "diagramCtDetail": "/mnt/data\nmount.nfs dans le CT",
+    "diagramArrow": "NFS",
+    "twoWaysTitle": "Deux façons de donner un accès CT NFS — choisissez une",
+    "twoWaysBind": "<strong>Montage par host</strong> (<mountLink>LXC Mount Manager</mountLink>) : l'hôte monte le NFS une fois, chaque CT reçoit le même chemin par bind mount. Fonctionne avec des CT non privilégiés. Recommandé lorsque plusieurs CT ont besoin de le même partage.",
+    "twoWaysDirect": "<strong>Montage NFS direct dans le CT</strong> (cette page) : le CT monte NFS lui-même. Exige un CT privilégié. Utile si le CT doit gérer sa propre connexion et ses identifiants ou si chaque CT utilise un serveur différent."
+  },
+  "opening": {
+    "heading": "Ouverture de l'outil",
+    "body": "Dans le menu principal de ProxMenux, ouvrez <strong>Storage &amp; Share Manager → Configurer le client NFS dans LXC (privilégié uniquement)</strong>. Choisissez d’abord <strong>le CT cible</strong> ; ProxMenux le démarre s’il est arrêté et abandonne s’il n’est pas privilégié. Le sous-menu suivant s’affiche ensuite :",
+    "imageAlt": "Menu NFS Client Manager — Montage / Vue / Démonter / Tester la connectivité"
+  },
+  "howRuns": {
+    "heading": "Comment fonctionne le script (mount flow)"
+  },
+  "fstabFlags": {
+    "heading": "Pourquoi ces drapeaux fstab",
+    "intro": "Pour les montages permanents, le script ajoute trois drapeaux au-delà des options standard NFS : <code>_netdev,x-systemd.automount,noauto</code>. Chacun résout un vrai problème de démarrage :",
+    "headerFlag": "Drapeau",
+    "headerEffect": "Ce qu'il fait",
+    "rows": [
+      {
+        "flag": "_netdev",
+        "effect": "Indique au système d’initialisation que ce montage nécessite le réseau. Le démarrage n’attend pas ce montage avant que le réseau soit disponible."
+      },
+      {
+        "flag": "x-systemd.automount",
+        "effectRich": "Crée une unité de montage automatique systemd : le montage n'arrive que la première fois que quelque chose accède à <code>/mnt/&lt;path&gt;</code>. Le serveur NFS inaccessible au démarrage ne bloque pas le CT."
+      },
+      {
+        "flag": "noauto",
+        "effect": "Évite le montage immédiat au démarrage. Avec l’unité automount ci-dessus, le montage n’a lieu qu’au premier accès."
+      }
+    ],
+    "netEffectTitle": "Effet net",
+    "netEffectBody": "Le système de fichiers NFS est monté au <em>premier accès</em> plutôt qu’immédiatement au démarrage. Si le serveur est hors ligne, cet accès peut attendre ou échouer et affecter les services qui dépendent du chemin. Automount réduit la dépendance au démarrage, sans garantir que tous les services du CT restent épargnés."
+  },
+  "manual": {
+    "heading": "Équivalent manuel",
+    "body": "Répliquez l'ensemble du flux à la main — chaque commande exécute <strong> à l'intérieur du CT</strong> via <code>pct exec &lt;ctid&gt; --</code> ou directement via <code>pct enter &lt;ctid&gt;</code>:"
+  },
+  "view": {
+    "heading": "Afficher les montages actuels",
+    "body": "Liste tous les points de montage NFS actifs à l'intérieur du CT (<code>mount | grep nfs</code>) plus toutes les lignes NFS du CT du <code>/etc/fstab</code>. Pour chaque entrée fstab, l'état de montage en direct est affiché — utile pour repérer les montages permanents qui ne sont pas apparus au démarrage."
+  },
+  "unmount": {
+    "heading": "Démonter le partage NFS",
+    "body": "Combine les montages live et les entrées fstab dans une seule liste, vous permet d'en choisir une et <strong>supprime la ligne correspondante de <code>/etc/fstab</code></strong>. Le script <em>n'exécute pas</em> <code>umount</code> sur le montage en direct ; à la place, il vous indique qu'un redémarrage CT est nécessaire pour que le démontage prenne effet.",
+    "warnTitle": "Le script supprime les entrées fstab, pas les montages en direct",
+    "warnBody": "C'est un choix de conception délibéré : <code>umount</code> sur une monture occupée échoue avec \"appareil occupé\" quand quelque chose à l'intérieur du CT l'utilise encore. La suppression de l'entrée fstab garantit que le montage disparaît proprement lors du prochain démarrage CT. Si vous voulez que le montage soit parti <em>maintenant</em> et vous êtes sûr que rien ne l'utilise, exécutez <code>pct exec &lt;ctid&gt; -- umount /mnt/&lt;path&gt;</code> à la main après la fin du script."
+  },
+  "test": {
+    "heading": "Tester la connectivité NFS",
+    "body": "Pass diagnostique à l'intérieur du CT: confirme que le <code>nfs-common</code> est installé, <code>rpcbind</code> est en cours d'exécution, liste les montages NFS, puis itération sur chaque serveur NFS référencé dans fstab et vérifie ping → port 2049 → <code>showmount -e</code>. Bon premier arrêt quand une monture permanente n'arrive pas."
+  },
+  "troubleshoot": {
+    "heading": "Dépannage",
+    "privTitle": "Conteneur privilégié requis (le script s’arrête)",
+    "privBody": "Le CT sélectionné n'est pas privilégié. Le client du noyau NFS a besoin de la capacité <code>SYS_ADMIN</code> que les CT non privilégiés n'exposent pas. Soit convertir le CT en privilège (la conversion du gestionnaire de disque &amp; est documentée dans le disque <importLink>Importer en LXC</importLink> page) soit utiliser le chemin alternatif décrit dans l'avertissement en haut de cette page.",
+    "aptTitle": "apt-get install nfs-common fails",
+    "aptIntro": "Le script suppose une famille Debian CT (<code>apt-get</code>). Si le CT tourne Alpine / Arch / Rocky / Alma, l'étape d'installation échoue silencieusement. Installez le client NFS à la main pour cette distribution :",
+    "aptItems": [
+      "Alpine: <code>apk add nfs-utils</code>",
+      "Arch: <code>pacman -S nfs-utils</code>",
+      "Rocky / Alma: <code>dnf install nfs-utils</code>"
+    ],
+    "aptOutro": "Ensuite, lancez le script ProxMenux — l'étape d'installation saute lorsque les outils sont déjà présents.",
+    "portTitle": "\"NFS port (2049) is not accessible\"",
+    "portBody": "Ping a réussi, mais <code>nc -z &lt;server&gt; 2049</code> a échoué de l'intérieur du CT. Vérifiez que le service NFS fonctionne sur le serveur, que le pare-feu permet 2049 à partir du réseau de CT et que le CT a en fait une route réseau valide (essayez <code>pct exec &lt;ctid&gt; -- ip route</code>).",
+    "bootTitle": "Le montage permanent réussit mais ne vient pas au démarrage",
+    "bootBody": "Presque toujours : le réseau n'est pas prêt lorsque le CT monte (les drapeaux du script <code>_netdev,x-systemd.automount,noauto</code> corrigent cela – rajouter le montage via le script si vous avez écrit la ligne fstab à la main sans ces derniers), le serveur est inaccessible au démarrage (le montage automatique attend le premier accès, c'est normal), ou le DNS n'est pas résolu au démarrage (utiliser l'IP du serveur, pas son nom d'hôte).",
+    "squashTitle": "Serveur squashes root, aucun accès d'écriture à partir de l'intérieur CT",
+    "squashIntro": "L'exportation de NFS utilise <code>root_squash</code> (par défaut) et le CT écrit comme racine. Deux options :",
+    "squashItems": [
+      "Côté serveur : changez l'exportation en <code>no_root_squash</code> (seulement si vous faites confiance au CT).",
+      "Côté CT : écrivez avec un utilisateur non root accepté par le serveur ou ajustez le propriétaire du partage avec chown."
+    ],
+    "squashOutro": "ProxMenux ne peut pas corriger cela — c'est la politique du serveur."
+  },
+  "related": {
+    "heading": "Autres",
+    "items": [
+      {
+        "href": "/docs/storage-share/lxc-mount-points",
+        "label": "Points de montage LXC (hôte ↔ conteneur)",
+        "tail": "— l'alternative pour les CT non privilégiés: monter sur l'hôte, lier dans CT."
+      },
+      {
+        "href": "/docs/storage-share/lxc-samba-client",
+        "label": "Client Samba en LXC",
+        "tail": " — page associée avec la même approche pour les partages SMB / CIFS."
+      },
+      {
+        "href": "/docs/storage-share/lxc-nfs-server",
+        "label": "Serveur NFS dans LXC",
+        "tailRich": "— l'inverse: exposer les dossiers <em>de</em> un CT sur NFS."
+      },
+      {
+        "href": "/docs/storage-share/host-nfs",
+        "label": "Partage NFS comme stockage Proxmox",
+        "tail": " — enregistrer le partage dans Proxmox lui-même plutôt que dans un seul CT."
+      }
+    ]
+  }
+}
diff --git a/web/messages/fr/docs/storage-share/lxc-nfs-server.json b/web/messages/fr/docs/storage-share/lxc-nfs-server.json
new file mode 100644
index 00000000..ce16cb23
--- /dev/null
+++ b/web/messages/fr/docs/storage-share/lxc-nfs-server.json
@@ -0,0 +1,159 @@
+{
+  "meta": {
+    "title": "NFS serveur dans LXC | ProxMenux Documentation",
+    "description": "Partagez des dossiers via NFS depuis un conteneur LXC Proxmox avec ProxMenux. Installation automatique de nfs-kernel-server, groupe commun sharedfiles, configuration de /etc/exports, ACL réseau et désinstallation complète. Nécessite un conteneur privilégié.",
+    "ogTitle": "NFS serveur dans LXC | ProxMenux Documentation",
+    "ogDescription": "Exécutez un serveur NFS dans un LXC privilégié avec le groupe commun sharedfiles, des ACL réseau et une désinstallation complète."
+  },
+  "header": {
+    "title": "Serveur NFS dans LXC",
+    "description": "Exécutez un serveur NFS du noyau dans un conteneur LXC Proxmox et exposez des dossiers aux autres machines du réseau. ProxMenux installe nfs-kernel-server, configure le groupe commun sharedfiles pour faciliter le partage entre plusieurs CT privilégiés, gère /etc/exports et propose une désinstallation complète.",
+    "section": "Stockage et partage · LXC"
+  },
+  "privReq": {
+    "title": "Conteneur privilégié requis",
+    "body": "<code>nfs-kernel-server</code> doit monter le système de fichiers du noyau <code>nfsd</code> sur <code>/proc/fs/nfsd</code>. Cela exige <code>CAP_SYS_ADMIN</code> dans l’espace de noms du noyau hôte, pas seulement dans celui des utilisateurs du conteneur. Les LXC non privilégiés n’ont pas cette capacité : <code>rpc.nfsd: Unable to access /proc/fs/nfsd errno 2 (No such file or directory)</code> ; systemd signale un échec de dépendance pour <code>nfs-server.service</code>. Le script exige donc un CT privilégié et <strong>s’arrête si le CT n’est pas privilégié</strong>. Une autre possibilité consiste à placer le serveur NFS dans une VM."
+  },
+  "what": {
+    "heading": "Ce que ça fait",
+    "body": "C’est l’inverse de la page <em>client NFS</em> : le CT devient un <strong>serveur NFS</strong> et expose son propre dossier à d’autres CT, à l’hôte Proxmox, à des VM ou à des machines physiques.",
+    "diagramServerLabel": "LXC (privilégié) — Serveur NFS",
+    "diagramServerDetail": "/mnt/data\n(dossier exposé)\n\nchown root:sharedfiles\nchmod 2775 (SGID)\n\nnfs-kernel-server\n+ rpcbind en cours d’exécution",
+    "diagramClientLabel": "Tout client sur le réseau",
+    "diagramClientDetail": "un autre CT, l'hôte,\nun VM, une machine physique...",
+    "diagramArrow": "Exportation NFS"
+  },
+  "shared": {
+    "heading": "Le groupe commun « sharedfiles »",
+    "body": "Avant d'exporter le dossier, ProxMenux crée un groupe appelé <code>sharedfiles</code> avec <strong>GID 101000</strong> à l'intérieur du conteneur, y ajoute chaque utilisateur régulier, puis définit le répertoire d'exportation à <code>root:sharedfiles</code> avec le mode <code>2775</code>. Le <code>2</code> à l'avant est le bit SGID — chaque fichier ou dossier créé à l'intérieur hérite automatiquement du groupe <code>sharedfiles</code>.",
+    "gidTitle": "Pourquoi GID 101000 spécifiquement",
+    "gidBody": "Avec le mappage LXC par défaut (+100000), le GID 101000 de l’hôte apparaît comme GID <strong>1000</strong> dans un CT non privilégié. Ce serveur utilise un CT <strong>privilégié</strong>, sans décalage. Deux CT privilégiés utilisant <code>sharedfiles</code> avec le GID 101000 partagent donc le même identifiant numérique de groupe.",
+    "remapTitle": "La création héritée des utilisateurs « remap_* » est ignorée pour les CT privilégiés",
+    "remapBody": "L’ancienne branche pour les CT non privilégiés créerait des utilisateurs <code>remap_&lt;uid&gt;</code> avec l’UID <code>&lt;uid&gt; + 100000</code>, tous dans <code>sharedfiles</code>, pour les utilisateurs ordinaires et les UID courants (33, 1000, 1001, 1002). Ce décalage de <code>+100000</code> ne s’applique pas aux CT <strong>privilégiés</strong> exigés ici ; le script ignore donc cette branche. L’absence de comptes <code>remap_*</code> dans <code>getent passwd</code> est normale et n’indique pas une erreur."
+  },
+  "defaults": {
+    "heading": "Options d'exportation par défaut — lire cette première",
+    "warnTitle": "Les options par défaut incluent no_root_squash",
+    "warnBody": "ProxMenux utilise par défaut <code>rw,sync,no_subtree_check,'<'strong'>'no_root_squash'<'/strong'>'</code>. <strong>Tout utilisateur root d’un client peut écrire comme root sur l’export.</strong> Réservez cette option à un réseau local de confiance. Si le CT est accessible depuis un réseau non fiable (VPS ou VLAN non fiable), <strong>remplacez l’option par <code>root_squash</code></strong> dans le dialogue des options personnalisées."
+  },
+  "opening": {
+    "heading": "Ouverture de l'outil",
+    "body": "Dans le menu principal, ouvrez <strong>Storage & Share Manager → Configure NFS Server in LXC</strong>. Seuls les CT privilégiés sont proposés. Choisissez le CT cible ; le script le démarre s’il est arrêté et refuse les CT non privilégiés. Le menu comporte cinq options.",
+    "imageAlt": "Menu NFS Server Manager — Créer / Afficher / Supprimer / Statut / Désinstaller"
+  },
+  "howRuns": {
+    "heading": "Comment fonctionne le script (Créer le flux)"
+  },
+  "network": {
+    "heading": "Réseau ACL — qui peut monter le partage",
+    "intro": "<code>/etc/exports</code> détermine quels clients peuvent monter l’export. Le dialogue propose trois modes :",
+    "headerMode": "Mode",
+    "headerValue": "Valeur écrite pour /etc/exports",
+    "headerWhen": "Quand le choisir",
+    "rows": [
+      {
+        "mode": "Réseau local",
+        "value": "192.168.0.0/16",
+        "whenRich": "Pour les réseaux domestiques ou de petite entreprise habituels. Couvre toutes les adresses <code>192.168.*.*</code>."
+      },
+      {
+        "mode": "Sous-réseau personnalisé",
+        "value": "votre CIDR (par exemple 10.0.0.0/24)",
+        "when": "Lorsque votre LAN n'est pas dans 192.168.x.x ou que vous voulez une portée plus étroite."
+      },
+      {
+        "mode": "Un seul hôte",
+        "value": "votre IP (par exemple 10.0.0.42)",
+        "when": "Seule une machine précise peut monter l’export. Option la plus restrictive."
+      }
+    ]
+  },
+  "options": {
+    "heading": "Options d'exportation expliquées",
+    "headerOption": "Option",
+    "headerEffect": "Ce qu'il fait",
+    "rows": [
+      {
+        "option": "rw / ro",
+        "effect": "Autoriser les clients à lire et écrire, ou à lire uniquement."
+      },
+      {
+        "option": "sync",
+        "effectRich": "Ne répond aux écritures qu’une fois les données sur disque. Plus sûr que <code>async</code>, au prix d’un débit réduit."
+      },
+      {
+        "option": "no_subtree_check",
+        "effect": "Évite de vérifier à chaque requête que le fichier appartient encore au sous-arbre exporté. Plus rapide et évite les problèmes si des fichiers sont renommés pendant l’opération."
+      },
+      {
+        "option": "no_root_squash",
+        "effectRich": "<strong>Faire confiance à root sur le client.</strong> Un client monté par root écrit comme root sur le serveur. Convient aux LAN de confiance, par exemple pour préserver les propriétaires lors des sauvegardes. Remplacez cette option par <code>root_squash</code> si vous ne faites pas entièrement confiance à chaque machine autorisée par l’ACL réseau."
+      }
+    ]
+  },
+  "manual": {
+    "heading": "Équivalent manuel",
+    "body": "Reproduisez toute la procédure manuellement. Chaque commande s’exécute <strong>dans le CT</strong> via <code>pct exec &lt;ctid&gt; --</code> ou <code>pct enter &lt;ctid&gt;</code> :"
+  },
+  "view": {
+    "heading": "Voir les exportations actuelles",
+    "body": "Affiche <code>/etc/exports</code> depuis le CT en ignorant commentaires et lignes vides, puis présente chaque export avec son ACL réseau et ses options. Utile pour vérifier les dossiers exposés avant de communiquer l’IP du CT."
+  },
+  "delete": {
+    "heading": "Supprimer une exportation",
+    "body": "Liste chaque ligne dans <code>/etc/exports</code> pour la sélection, supprime la ligne choisie (<code>sed -i</code>), exécute <code>exportfs -ra</code> et redémarre <code>nfs-kernel-server</code>. Le dossier lui-même et son contenu restent intacts."
+  },
+  "status": {
+    "heading": "Vérifier l'état NFS",
+    "body": "Pass diagnostique : confirme que <code>nfs-kernel-server</code> et <code>rpcbind</code> sont installés et actifs, imprime la sortie <code>exportfs -v</code>, liste les sessions NFS actives (<code>showmount -a</code>) et les connexions client actuelles."
+  },
+  "uninstall": {
+    "heading": "Désinstaller le serveur NFS",
+    "body": "Nettoyage complet après confirmation : arrête et désactive <code>nfs-kernel-server</code> et <code>rpcbind</code>, vide <code>/etc/exports</code>, supprime les paquets NFS avec <code>apt-get purge</code>, retire le groupe <code>sharedfiles</code> et les utilisateurs <code>remap_*</code>, puis termine les processus restants. Les <strong>dossiers exportés eux-mêmes ne sont pas supprimés</strong> ; seules la configuration NFS et les paquets le sont.",
+    "warnTitle": "Le script s'arrête à la ligne d'exportation, pas aux données",
+    "warnBody": "<em>Supprimer un export</em> et <em>Désinstaller le serveur NFS</em> retirent la configuration d’export. Les données du dossier sont conservées. Pour les supprimer aussi, utilisez explicitement <code>rm -rf</code> après la fin du script et sauvegardez-les d’abord si quelqu’un peut encore en avoir besoin."
+  },
+  "troubleshoot": {
+    "heading": "Dépannage",
+    "privTitle": "Conteneur privilégié requis (le script s’arrête)",
+    "privBody": "Le CT sélectionné n'est pas privilégié. <code>nfs-kernel-server</code> ne peut pas démarrer là parce que le montage <code>/proc/fs/nfsd</code> nécessite <code>CAP_SYS_ADMIN</code> dans l'espace nominatif du noyau hôte, et le module <code>nfsd</code> n'est pas non plus exposé à l'espace nominatif du conteneur (<code>modprobe nfsd</code> de l'intérieur renvoie <code>FATAL: Module nfsd not found</code>). Si vous contournez le contrôle, vous verrez <code>rpc.nfsd: Unable to access /proc/fs/nfsd errno 2 (No such file or directory)</code> dans le journal et aucun port NFS n'ouvrira jamais. Les seules options utilisables sont : convertir le CT en privilégié, ou déplacer le serveur NFS vers une VM.",
+    "aptTitle": "Échec de apt-get install",
+    "aptIntro": "Le script suppose une famille Debian CT. Sur Alpine / Arch / Rocky / Alma, installez les paquets du serveur NFS à la main:",
+    "aptItems": [
+      "Alpine: <code>apk add nfs-utils</code>",
+      "Arch: <code>pacman -S nfs-utils</code>",
+      "Rocky / Alma: <code>dnf install nfs-utils</code>"
+    ],
+    "aptOutro": "Relancez ensuite le script ProxMenux ; l’installation est ignorée si les outils sont déjà présents.",
+    "aclTitle": "Le client ne peut pas monter : 'accès refusé par le serveur'",
+    "aclBody": "L’IP du client n’est pas autorisée par l’ACL réseau. Recréez l’export avec un sous-réseau plus large ou ajoutez l’IP exacte du client. Attention : via un routeur NAT, le client peut apparaître avec l’IP WAN du routeur au lieu de son IP LAN. Vérifiez sur le serveur avec <code>tcpdump -n port 2049</code>.",
+    "ownTitle": "Les fichiers écrits par le client apparaissent avec une propriété bizarre sur le serveur",
+    "ownIntro": "Deux possibilités :",
+    "ownItems": [
+      "Avec <code>no_root_squash</code> (par défaut), le client root écrit comme root sur le serveur. Les fichiers sont détenus par <code>root:sharedfiles</code> grâce au SGID du dossier.",
+      "Les utilisateurs non-racines de clients écrivent comme leur propre UID/GID. Si leur UID n'existe pas sur le serveur, les fichiers apparaissent avec des nombres bruts (par exemple : <code>1234:1234</code>). Utilisez également le groupe <code>sharedfiles</code> sur le client, ou alignez les UID sur les systèmes qui partagent des fichiers."
+    ],
+    "noShowTitle": "Serveur accessible mais showmount ne renvoie rien",
+    "noShowBody": "Après avoir édité <code>/etc/exports</code>, vous devez recharger la table d'exportation avec <code>exportfs -ra</code> et redémarrer <code>nfs-kernel-server</code> — le script fait les deux, mais si vous avez édité le fichier à la main, faites-le vous-même. Confirmez également le pare-feu sur le CT (et sur l'hôte Proxmox) permet TCP/UDP 2049 et le port rpcbind (111)."
+  },
+  "related": {
+    "heading": "Autres",
+    "items": [
+      {
+        "href": "/docs/storage-share/lxc-nfs-client",
+        "label": "Client NFS dans LXC",
+        "tail": " — l’inverse : monter des partages NFS externes dans un CT."
+      },
+      {
+        "href": "/docs/storage-share/lxc-samba-server",
+        "label": "Serveur Samba en LXC",
+        "tail": "— page soeur, même motif avec SMB / CIFS au lieu de NFS."
+      },
+      {
+        "href": "/docs/storage-share/host-nfs",
+        "label": "Partage NFS comme stockage Proxmox",
+        "tailRich": " — une fois que le CT expose un export, enregistrez ce partage NFS dans Proxmox pour le voir sous <em>Datacenter → Storage</em>."
+      }
+    ]
+  }
+}
diff --git a/web/messages/fr/docs/storage-share/lxc-samba-client.json b/web/messages/fr/docs/storage-share/lxc-samba-client.json
new file mode 100644
index 00000000..f32413e2
--- /dev/null
+++ b/web/messages/fr/docs/storage-share/lxc-samba-client.json
@@ -0,0 +1,155 @@
+{
+  "meta": {
+    "title": "Client Samba en LXC | ProxMenux Documentation",
+    "description": "Montez des partages Samba / CIFS dans un conteneur LXC Proxmox avec ProxMenux. Installation automatique de cifs-utils et smbclient, découverte des serveurs, stockage protégé des identifiants et montages persistants via /etc/fstab. Nécessite un conteneur privilégié.",
+    "ogTitle": "Client Samba en LXC | ProxMenux Documentation",
+    "ogDescription": "Montez des partages Samba / CIFS dans un conteneur LXC privilégié. Découverte automatique, fichier d’identifiants protégé et persistance dans /etc/fstab."
+  },
+  "header": {
+    "title": "Client Samba en LXC",
+    "description": "Le montage Samba (SMB / CIFS) se fait directement à l'intérieur d'un conteneur Proxmox LXC. Le conteneur devient un vrai client CIFS — parle au serveur Samba sur le réseau, exécute mount.cifs, stocke les identifiants en toute sécurité, et écrit à /etc/fstab. ProxMenux installe cifs-utils + smbclient pour vous et valide les identifiants sur le serveur avant le montage.",
+    "section": "Stockage et partage · LXC"
+  },
+  "privReq": {
+    "title": "Conteneur privilégié requis",
+    "body": "Le client du noyau <code>mount.cifs</code> a besoin de capacités (<code>SYS_ADMIN</code> au minimum) que les conteneurs non privilégiés LXC n'exposent pas. Le script force cela — il vous demande de choisir un CT et <strong>s’arrête s'il n'est pas privilégié</strong>. Si vous avez besoin du partage à l'intérieur d'un CT non privilégié, montez-la d'abord sur l'hôte Proxmox (avec <hostSambaLink>Samba / CIFS en tant que stockage Proxmox</hostSambaLink>) et montez-la par bind mount dans le CT avec le <mountLink>LXC Mount Manager</mountLink>."
+  },
+  "what": {
+    "heading": "Ce que ça fait",
+    "body": "Le conteneur parle CIFS sur le réseau et monte le partage lui-même. L'hôte Proxmox n'est que le pont réseau — il ne voit ni ne gère le montage.",
+    "diagramServerLabel": "Serveur Samba",
+    "diagramServerDetail": "//srv/share",
+    "diagramHostLabel": "Hôte Proxmox",
+    "diagramHostDetail": "(seulement un\npont réseau)",
+    "diagramCtLabel": "LXC (privilégié)",
+    "diagramCtDetail": "/mnt/share\nmount.cifs à l'intérieur de CT",
+    "diagramArrow": "CIFS",
+    "twoWaysTitle": "Deux façons de donner un CT une part de Samba — choisissez une",
+    "twoWaysBind": "<strong>Montage par host</strong> (<mountLink>LXC Mount Manager</mountLink>) : l'hôte monte le CIFS une fois, chaque CT reçoit le même chemin par bind mount. Fonctionne avec des CT non privilégiés. Recommandé lorsque plusieurs CT ont besoin de le même partage.",
+    "twoWaysDirect": "<strong>Montage CIFS direct dans le CT</strong> (cette page) : le CT monte CIFS lui-même. Exige un CT privilégié. Utile si chaque CT doit gérer ses identifiants ou accéder à un serveur différent."
+  },
+  "opening": {
+    "heading": "Ouverture de l'outil",
+    "body": "Dans le menu principal de ProxMenux, ouvrez <strong>Storage &amp; Share Manager → Configurer le client Samba dans LXC (privilégié uniquement)</strong>. Choisissez d’abord <strong>le CT cible</strong> ; ProxMenux le démarre s’il est arrêté et abandonne s’il n’est pas privilégié. Le sous-menu suivant s’affiche ensuite :",
+    "imageAlt": "Menu Samba Client Manager — Montage / Affichage / Démontage / Test de connectivité"
+  },
+  "howRuns": {
+    "heading": "Comment fonctionne le script (mount flow)"
+  },
+  "creds": {
+    "heading": "Où vit le mot de passe",
+    "body": "ProxMenux <strong>ne place pas le mot de passe dans la commande de montage</strong> ni dans <code>/etc/fstab</code>. Il crée un fichier d’identifiants dans le CT. Ce fichier contient les identifiants en clair, protégés par des permissions réservées à root ; il n’est pas chiffré :",
+    "whyTitle": "Pourquoi un fichier séparé plutôt que fstab",
+    "whyBody": "Le module CIFS accepte les options <code>username=</code> / <code>password=</code> en ligne dans fstab, mais quiconque peut lire <code>/etc/fstab</code> voit le mot de passe en clair. Mettre des identifiants dans un fichier root-only et pointer fstab dessus (<code>credentials=</code>) maintient le mot de passe hors de config lisible dans le monde."
+  },
+  "options": {
+    "heading": "Options de montage expliquées",
+    "headerOption": "Option",
+    "headerEffect": "Ce qu'il fait",
+    "rows": [
+      {
+        "option": "rw / ro",
+        "effect": "Mode lecture-écriture ou lecture seule pour l'ensemble du montage."
+      },
+      {
+        "option": "file_mode=0664",
+        "effect": "Permissions présentées pour les fichiers via CIFS. Par défaut, le propriétaire et le groupe peuvent écrire, les autres lire."
+      },
+      {
+        "option": "dir_mode=0775",
+        "effect": "Autorisations signalées pour les répertoires. Par défaut, le propriétaire+groupe entre et crée, d'autres traversent."
+      },
+      {
+        "option": "iocharset=utf8",
+        "effect": "Impose UTF-8 pour les noms de fichiers transmis par le réseau. Évite les caractères illisibles dans les noms non ASCII."
+      },
+      {
+        "option": "credentials=file",
+        "effect": "Lisez le nom d'utilisateur / mot de passe du fichier (ajouté automatiquement pour l'auth utilisateur)."
+      },
+      {
+        "option": "guest",
+        "effect": "Authentifier en tant qu'invité, aucune identification requise (ajoutée automatiquement lorsque l'invité est choisi)."
+      },
+      {
+        "option": "_netdev",
+        "effect": "Indique que le système d'initialisation de ce montage a besoin du réseau. Boot ne bloque pas l'attente."
+      },
+      {
+        "option": "x-systemd.automount",
+        "effect": "Montage paresseux : ne monte que sur le premier accès. Le serveur CIFS inaccessible au démarrage ne bloque pas le CT."
+      },
+      {
+        "option": "noauto",
+        "effect": "Évite le montage immédiat au démarrage. Avec l’unité automount, le montage n’a lieu qu’au premier accès."
+      }
+    ],
+    "netEffectTitle": "Effet net des drapeaux fstab",
+    "netEffectBody": "Le système de fichiers CIFS est monté au <em>premier accès</em> plutôt qu’immédiatement au démarrage. Si le serveur est hors ligne, cet accès peut attendre ou échouer et affecter les services qui dépendent du chemin. Automount réduit la dépendance au démarrage, sans garantir que tous les services du CT restent épargnés."
+  },
+  "manual": {
+    "heading": "Équivalent manuel",
+    "body": "Répliquez l'ensemble du flux à la main — chaque commande exécute <strong> à l'intérieur du CT</strong> via <code>pct exec &lt;ctid&gt; --</code> ou directement via <code>pct enter &lt;ctid&gt;</code>:",
+    "guestIntro": "Variante d'invité — aucun fichier d'identification nécessaire:"
+  },
+  "view": {
+    "heading": "Afficher les montages actuels",
+    "body": "Liste tous les points de montage CIFS actifs à l'intérieur du CT (<code>mount -t cifs</code>) plus toutes les lignes CIFS du CT <code>/etc/fstab</code>. Pour chaque entrée fstab, l'état de montage en direct est affiché — utile pour repérer les montages permanents qui ne sont pas apparus au démarrage."
+  },
+  "unmount": {
+    "heading": "Démonter le partage Samba",
+    "body": "Combine les montages live et les entrées fstab dans une seule liste, vous permet de choisir une, et <strong> retire la ligne correspondante de <code>/etc/fstab</code></strong> plus le fichier d'identification correspondant. Le script n'exécute pas <code>umount</code> sur le montage en direct — il vous indique plutôt qu'un redémarrage CT est nécessaire pour que le démontage prenne effet.",
+    "warnTitle": "Le script supprime les entrées fstab, pas les montages en direct",
+    "warnBody": "Même conception que le client NFS : <code>umount</code> sur une monture occupée échoue avec \"dispositif occupé\". La suppression de l'entrée fstab garantit que le montage disparaît proprement lors du prochain démarrage CT. Si vous voulez que le montage soit parti <em>maintenant</em>, exécutez <code>pct exec &lt;ctid&gt; -- umount /mnt/&lt;path&gt;</code> à la main après la fin du script."
+  },
+  "test": {
+    "heading": "Tester la connectivité Samba",
+    "body": "Diagnostic dans le CT : vérifie que <code>cifs-utils</code> est installé, liste les montages CIFS actifs puis teste, pour chaque serveur de fstab, ping → ports 139/445 → liste des partages en invité. « Authentification requise » lors du test invité est normal si le serveur ne propose pas de partage public."
+  },
+  "troubleshoot": {
+    "heading": "Dépannage",
+    "privTitle": "Conteneur privilégié requis (le script s’arrête)",
+    "privBody": "Le CT sélectionné n'est pas privilégié. Le client du noyau CIFS a besoin de la capacité <code>SYS_ADMIN</code> que les CT non privilégiés n'exposent pas. Convertissez le CT en privilégié, ou utilisez le chemin alternatif décrit dans l'avertissement en haut de cette page.",
+    "aptTitle": "apt-get install fails",
+    "aptIntro": "Le script suppose une famille Debian CT (<code>apt-get</code>). Sur Alpine / Arch / Rocky / Alma, installez le client CIFS à la main:",
+    "aptItems": [
+      "Alpine: <code>apk add cifs-utils samba-client</code>",
+      "Arch: <code>pacman -S cifs-utils smbclient</code>",
+      "Rocky / Alma: <code>dnf install cifs-utils samba-client</code>"
+    ],
+    "aptOutro": "Ensuite, lancez le script ProxMenux — l'étape d'installation saute lorsque les outils sont déjà présents.",
+    "guestFallbackTitle": "\"Le serveur vous a connecté en tant qu'invité au lieu de l'utilisateur spécifié\"",
+    "guestFallbackBody": "La validation active du script a attrapé un vrai problème d'auth. Le serveur a accepté la connexion mais l'a rétrogradée à invité parce que les identifiants sont erronés. Causes communes : faute de frappe dans le nom d'utilisateur / mot de passe, l'utilisateur n'existe pas sur le serveur, l'utilisateur est verrouillé, ou le groupe de travail / domaine est mal adapté. Réexécutez soigneusement le flux et entrez les identifiants (le mot de passe est caché dans la boîte de dialogue).",
+    "denyTitle": "\"NT_STATUS_ACCESS_DENIED\" lors du montage",
+    "denyBody": "Les identifiants sont valides mais le partage refuse l’accès. Vérifiez côté serveur les permissions de l’utilisateur pour ce partage précis : la validation confirme la connexion, pas les ACL de chaque partage. Vérifiez aussi si le serveur exige une version SMB particulière ; ajoutez <code>vers=3.0</code> (ou <code>2.1</code>, <code>2.0</code>) aux options de montage.",
+    "utf8Title": "Noms de fichiers UTF-8 / non ASCII mal affichés",
+    "utf8Body": "Les options par défaut incluent <code>iocharset=utf8</code>, mais certaines configurations de serveur signalent une page de code inattendue. Si les noms de fichiers avec des accents / symboles semblent mal, essayez également <code>nounix</code> (certains serveurs Linux Samba en ont besoin lorsque le client est également Linux) ou placez le côté serveur sur <code>unix extensions = no</code>.",
+    "bootTitle": "Le montage permanent réussit mais ne vient pas au démarrage",
+    "bootBody": "Presque toujours : le réseau n'est pas prêt lorsque le CT monte (les drapeaux du script <code>_netdev,x-systemd.automount,noauto</code> corrigent cela), le serveur est inaccessible au démarrage (le montage automatique attend le premier accès — c'est normal) ou le DNS n'est pas résolu au démarrage (utiliser l'IP du serveur, pas son nom d'hôte)."
+  },
+  "related": {
+    "heading": "Autres",
+    "items": [
+      {
+        "href": "/docs/storage-share/lxc-mount-points",
+        "label": "Points de montage LXC (hôte ↔ conteneur)",
+        "tail": "— l'alternative pour les CT non privilégiés: monter sur l'hôte, lier dans CT."
+      },
+      {
+        "href": "/docs/storage-share/lxc-nfs-client",
+        "label": "Client NFS dans LXC",
+        "tail": " — page associée avec la même approche pour les partages NFS."
+      },
+      {
+        "href": "/docs/storage-share/lxc-samba-server",
+        "label": "Serveur Samba en LXC",
+        "tailRich": "— l'inverse: exposer les dossiers <em>de</em> un CT sur Samba."
+      },
+      {
+        "href": "/docs/storage-share/host-samba",
+        "label": "Samba / CIFS comme stockage Proxmox",
+        "tail": " — enregistrer le partage dans Proxmox lui-même plutôt que dans un seul CT."
+      }
+    ]
+  }
+}
diff --git a/web/messages/fr/docs/storage-share/lxc-samba-server.json b/web/messages/fr/docs/storage-share/lxc-samba-server.json
new file mode 100644
index 00000000..63e6c8ae
--- /dev/null
+++ b/web/messages/fr/docs/storage-share/lxc-samba-server.json
@@ -0,0 +1,132 @@
+{
+  "meta": {
+    "title": "Serveur Samba en LXC | ProxMenux Documentation",
+    "description": "Exécutez un serveur Samba (SMB / CIFS) dans un conteneur LXC Proxmox avec ProxMenux. Installation automatique de samba, gestion de /etc/samba/smb.conf, des utilisateurs smbpasswd et du groupe sharedfiles pour les dossiers montés par bind mount. Nécessite un conteneur privilégié.",
+    "ogTitle": "Serveur Samba en LXC | ProxMenux Documentation",
+    "ogDescription": "Exposez des dossiers via SMB/CIFS depuis un LXC privilégié. Installation automatique, utilisateur smbpasswd et permissions adaptées aux bind mounts."
+  },
+  "header": {
+    "title": "Serveur Samba en LXC",
+    "description": "Exécutez un serveur Samba (SMB / CIFS) à l'intérieur d'un conteneur Proxmox LXC et exposez des dossiers aux clients Windows / macOS / Linux sur le réseau. ProxMenux installe samba, crée un utilisateur Samba avec smbpasswd, gère /etc/samba/smb.conf et applique des permissions adaptées aux bind mounts lorsque le dossier partagé vient de l'hôte.",
+    "section": "Stockage et partage · LXC"
+  },
+  "privReq": {
+    "title": "Conteneur privilégié requis",
+    "body": "Samba prend l’identité de l’utilisateur qui se connecte avec <code>setgroups()</code> sur chaque connexion arborescente (le moment où un client ouvre un partage). Dans un LXC non privilégié, le noyau rejette ce syscall parce que l'espace de nom d'utilisateur du conteneur est créé avec <code>setgroups=deny</code> — et <code>smbd</code> répond en arrêtant le processus de travail avec <code>PANIC: sys_setgroups failed</code>. Le résultat est que <code>smbd</code> démarre et lie les ports 139/445, mais chaque connexion client échoue avec <code>NT_STATUS_CONNECTION_DISCONNECTED</code>. Le script impose un CT privilégié pour cette raison et <strong>s’arrête si le CT n’est pas privilégié</strong>. Il n'y a pas de correctif propre du côté serveur; utilisez un CT privilégié ou lancez Samba à l'intérieur d’une VM."
+  },
+  "what": {
+    "heading": "Ce que ça fait",
+    "body": "Le conteneur devient un serveur SMB/CIFS : il exécute <code>smbd</code>, expose un dossier via <code>/etc/samba/smb.conf</code> et accepte les connexions clientes sur les ports <code>139</code> / <code>445</code>. Les clients voient le partage à <code>\\\\&lt;ct-ip&gt;\\&lt;share-name&gt;</code> dans Windows Explorer, <code>smb://&lt;ct-ip&gt;/&lt;share-name&gt;</code> dans macOS Finder, ou via <code>mount.cifs</code> sur Linux.",
+    "diagramServerLabel": "LXC (privilégié) — Serveur Samba",
+    "diagramServerDetail": "/mnt/data\n(dossier exposé)\n\nsmbd + nmbd en cours d’exécution\n\nUtilisateur: <username>\n(via smbpasswd)\n\nGroupe imposé:\nsharedfiles",
+    "diagramClientLabel": "Tout client sur le réseau",
+    "diagramClientDetail": "Windows: \\\\<ip>\\<share>\nmacOS:   smb://<ip>/<share>\nLinux:   mount.cifs",
+    "diagramArrow": "SMB / CIFS"
+  },
+  "perms": {
+    "heading": "Deux chemins d'autorisation selon le type de dossier",
+    "body": "Avant d'ajouter la part à <code>smb.conf</code>, le script vérifie si le dossier choisi est un montage <strong>bind de l'hôte</strong> ou un dossier local normal <strong> à l'intérieur du CT</strong> — et applique des droits de propriété différents en conséquence:",
+    "headerType": "Type de dossier",
+    "headerAction": "Ce que fait le script",
+    "bindType": "Bind-mount de l'hôte",
+    "bindTypeSubRich": "détecté par la sortie <code>mount</code>",
+    "bindActionRich": "Crée le groupe <code>sharedfiles</code> (par défaut GID 999, dynamique si pris), y ajoute l'utilisateur Samba, puis <code>chown root:sharedfiles</code> + <code>chmod 2775</code> (SGID — nouveaux fichiers héritent du groupe). Si l'utilisateur ne peut toujours pas écrire, applique <code>setfacl -m u:&lt;user&gt;:rwx</code>.",
+    "localType": "Dossier local à l'intérieur de CT",
+    "localTypeSub": "aucun montage de liaison détecté",
+    "localActionRich": "Propriété standard: <code>chown -R &lt;user&gt;:&lt;user&gt;</code> + <code>chmod -R 755</code>. Aucun groupe partagé n'est nécessaire car aucun autre CT n'écrit dans ce dossier. Retourne à <code>setfacl</code> si l'accès à l'écriture est toujours manquant.",
+    "gidTitle": "GID pour 'sharedfiles' diffère du flux du serveur NFS",
+    "gidBody": "Le script serveur Samba utilise GID <strong>999</strong> pour <code>sharedfiles</code>, tandis que le flux du serveur <nfsLink>NFS</nfsLink> utilise GID <strong>101000</strong>. Si vous exécutez les deux serveurs dans le même CT et que vous voulez un seul groupe partagé dans les deux protocoles, modifiez l'un d'eux pour correspondre à l'autre après l'installation (p. ex. <code>groupmod -g 101000 sharedfiles</code>) et ré-appliquer la propriété sur les dossiers touchés. C'est une incohérence connue dans les scripts actuels."
+  },
+  "opening": {
+    "heading": "Ouverture de l'outil",
+    "body": "Dans le menu principal, ouvrez <strong>Storage & Share Manager → Configure Samba Server in LXC</strong>. Seuls les CT privilégiés sont proposés. Choisissez le CT cible ; le script le démarre s’il est arrêté et refuse les CT non privilégiés. Le menu comporte cinq options.",
+    "imageAlt": "Menu Samba Server Manager — Créer / Afficher / Supprimer / Statut / Désinstaller"
+  },
+  "howRuns": {
+    "heading": "Comment fonctionne le script (Créer le flux)"
+  },
+  "modes": {
+    "heading": "Les trois modes de partage",
+    "intro": "Chaque mode écrit une stanza différente à <code>smb.conf</code>. Tous les trois comprennent le <code>valid users = &lt;username&gt;</code> (pas d'anonymat), le <code>force group = sharedfiles</code> (ainsi les nouveaux fichiers appartiennent au groupe partagé) et le <code>veto files = /lost+found/</code> (le cache des clients).",
+    "headerMode": "Mode",
+    "headerBlock": "Bloc écrit en smb.conf",
+    "rwMode": "Lecture et écriture",
+    "roMode": "Lecture seule",
+    "customMode": "Personnalisé",
+    "customBodyRich": "Vous tapez vos propres directives dans une boîte en texte libre. Le ProxMenux les enveloppe toujours dans un bloc <code>[share]</code> avec les <code>path</code>, <code>valid users</code>, <code>force group</code> et <code>veto files</code>."
+  },
+  "manual": {
+    "heading": "Équivalent manuel",
+    "body": "Reproduisez toute la procédure manuellement. Chaque commande s’exécute <strong>dans le CT</strong> via <code>pct exec &lt;ctid&gt; --</code> ou <code>pct enter &lt;ctid&gt;</code> :"
+  },
+  "connect": {
+    "heading": "Connexion des clients",
+    "headerOs": "Système d'exploitation du client",
+    "headerHow": "Comment se connecter",
+    "windowsOs": "Windows",
+    "windowsHowRich": "Explorateur de fichiers → barre d’adresse : <code>\\\\&lt;ct-ip&gt;\\&lt;share-name&gt;</code>. Ou <em>Connecter un lecteur réseau</em> → cocher « Se connecter à l’aide d’informations d’identification différentes ».",
+    "macosOs": "macOS",
+    "macosHowRich": "Finder → <em>Aller → Se connecter au serveur...</em> → <code>smb://&lt;ct-ip&gt;/&lt;share-name&gt;</code>. Ou <code>mount_smbfs //user@&lt;ct-ip&gt;/&lt;share&gt; /mountpoint</code>.",
+    "linuxOs": "Linux",
+    "linuxHowRich": "<code>mount -t cifs //&lt;ct-ip&gt;/&lt;share&gt; /mnt/x -o username=&lt;u&gt;,password=&lt;p&gt;,iocharset=utf8</code>. Ou utilisez le client <clientLink>Samba dans la page LXC</clientLink> si le client est un autre client Proxmox CT."
+  },
+  "view": {
+    "heading": "Voir les partages actuels",
+    "body": "Analyse <code>/etc/samba/smb.conf</code> à l'intérieur du CT et liste tous les blocs <code>[share]</code> (en ignorant <code>[global]</code>, <code>[homes]</code>, <code>[printers]</code>) avec son chemin. Utile comme un inventaire rapide."
+  },
+  "delete": {
+    "heading": "Supprimer un partage",
+    "body": "Permet de choisir un partage par nom, supprime le bloc de <code>smb.conf</code> (<code>sed</code> supprime de <code>[share]</code> jusqu'à la prochaine ligne blanche), et redémarre <code>smbd</code>. Le dossier lui-même et son contenu restent intacts."
+  },
+  "status": {
+    "heading": "Vérifier l'état de Samba",
+    "body": "Indique si <code>smbd</code> et <code>nmbd</code> sont installés et actifs, liste les utilisateurs de Samba (<code>pdbedit -L</code>) et imprime les sessions actives (<code>smbstatus</code>)."
+  },
+  "uninstall": {
+    "heading": "Désinstaller le serveur Samba",
+    "body": "Nettoyage complet après confirmation : arrête et désactive <code>smbd</code> et <code>nmbd</code>, sauvegarde <code>smb.conf</code> dans <code>smb.conf.backup.YYYYMMDD_HHMMSS</code>, supprime les utilisateurs Samba avec <code>smbpasswd -x</code> et les paquets Samba avec <code>apt-get purge</code>. Les <strong>dossiers exportés eux-mêmes ne sont pas supprimés</strong>.",
+    "warnTitle": "Les dossiers survivent — sauvegarde des données séparément",
+    "warnBody": "<em>Supprimer un partage</em> et <em>Désinstaller le serveur Samba</em> retirent la configuration de partage. Les données des dossiers exportés sont conservées. Pour les supprimer aussi, utilisez explicitement <code>rm -rf</code> après la fin du script."
+  },
+  "troubleshoot": {
+    "heading": "Dépannage",
+    "privTitle": "Conteneur privilégié requis (le script s’arrête)",
+    "privBody": "Le CT sélectionné n'est pas privilégié et <code>smbd</code> ne peut pas y servir de fichiers. Si vous contournez le contrôle et configurez Samba à la main, <code>smbd</code> démarre et les ports s'ouvrent, mais la première connexion client panique avec <code>PANIC: sys_setgroups failed</code> dans <code>/var/log/samba/log.&lt;client&gt;</code> et le client voit <code>NT_STATUS_CONNECTION_DISCONNECTED</code>. La cause est l'espace de noms d'utilisateur non privilégié ayant <code>setgroups=deny</code>, qui bloque l’adoption de l’identité de l’utilisateur par Samba à chaque connexion. Ni le <code>features=keyctl=1</code> ni la suppression du <code>force user</code> / <code>force group</code> ne changent cela. Les seules options utilisables sont : convertir le CT en privilégié, ou déplacer Samba vers une VM.",
+    "aptTitle": "Échec de apt-get install",
+    "aptIntro": "Le script suppose une famille Debian CT. Sur Alpine / Arch / Rocky / Alma, installer Samba à la main:",
+    "aptItems": [
+      "Alpine: <code>apk add samba</code>",
+      "Arch: <code>pacman -S samba</code>",
+      "Rocky / Alma: <code>dnf install samba</code>"
+    ],
+    "aptOutro": "Relancez ensuite le script ProxMenux ; l’installation est ignorée si les outils sont déjà présents.",
+    "noShareTitle": "Le client se connecte mais ne voit pas le partage",
+    "noShareBody": "Vérifiez que <code>browseable = yes</code> est défini dans le bloc de partage (par défaut pour les modes rw / ro; peut être manquant en mode personnalisé). Vérifiez également le pare-feu CT et le pare-feu hôte Proxmox permettent TCP 445 (SMB) et 139 (NetBIOS). Certains clients Windows nécessitent également une résolution de nom — essayez d'abord directement l'IP.",
+    "authTitle": "Défauts d'authentification (NT_STATUS_LOGON_FAILURE)",
+    "authBody": "Le mot de passe est incorrect (les mots de passe Samba sont <em>distincts</em> de ceux du système ; listez les utilisateurs Samba avec <code>pdbedit -L</code>) ou l’utilisateur ne figure pas dans <code>valid users</code> pour ce partage. Réinitialisez le mot de passe dans le CT avec <code>smbpasswd &lt;user&gt;</code>.",
+    "groupTitle": "Les fichiers écrits par le client apparaissent avec un mauvais groupe sur le serveur",
+    "groupBody": "Le script définit <code>force group = sharedfiles</code> dans le bloc de partage, de sorte que les nouveaux fichiers doivent être du groupe <code>sharedfiles</code>. S'ils ne le sont pas, le bit SGID du répertoire parent peut avoir été perdu (quelqu'un a exécuté <code>chmod</code> à la main). Réappliquer : <code>chmod 2775 /mnt/&lt;share&gt;</code>.",
+    "bothTitle": "Partage du même dossier sur NFS et Samba",
+    "bothBody": "Le ProxMenux utilise différents GID pour le <code>sharedfiles</code> dans chaque script (Samba: 999, NFS: 101000). Si vous servez le même dossier via les deux, choisissez un seul GID et alignez les deux. La correction la plus simple : après avoir exécuté les deux scripts, modifiez le GID plus petit :"
+  },
+  "related": {
+    "heading": "Autres",
+    "items": [
+      {
+        "href": "/docs/storage-share/lxc-samba-client",
+        "label": "Client Samba en LXC",
+        "tail": " — l’inverse : monter des partages Samba externes dans un CT."
+      },
+      {
+        "href": "/docs/storage-share/lxc-nfs-server",
+        "label": "Serveur NFS dans LXC",
+        "tail": "— page soeur, même motif avec NFS au lieu de CIFS."
+      },
+      {
+        "href": "/docs/storage-share/host-samba",
+        "label": "Samba / CIFS comme stockage Proxmox",
+        "tailRich": " — une fois que le CT expose un export, enregistrez ce partage Samba dans Proxmox pour le voir sous <em>Datacenter → Storage</em>."
+      }
+    ]
+  }
+}
diff --git a/web/messages/fr/docs/utils/export-vm.json b/web/messages/fr/docs/utils/export-vm.json
new file mode 100644
index 00000000..a085445f
--- /dev/null
+++ b/web/messages/fr/docs/utils/export-vm.json
@@ -0,0 +1,145 @@
+{
+  "meta": {
+    "title": "Exporter une VM en OVA / OVF | Documentation ProxMenux",
+    "description": "Exportez une VM Proxmox vers une archive OVA portable ou un répertoire OVF avec le schéma DMTF standard. Disques VMDK au format streamOptimized et manifeste SHA1. Importable dans VMware ESXi / Workstation / Fusion, VirtualBox et à nouveau dans Proxmox.",
+    "ogTitle": "Exporter une VM en OVA / OVF | Documentation ProxMenux",
+    "ogDescription": "Convertissez une VM Proxmox en paquet OVA / OVF portable compatible avec VMware et VirtualBox."
+  },
+  "header": {
+    "title": "Exportation de VM vers OVA / OVF",
+    "description": "Convertit une VM Proxmox en paquet OVA portable (archive TAR unique) ou OVF (descripteur et fichiers VMDK) avec le schéma OVF standard de DMTF. Les disques sont convertis avec qemu-img en VMDK au format streamOptimized. Le résultat peut être importé dans VMware (ESXi / Workstation / Fusion), VirtualBox et à nouveau dans Proxmox avec l’outil d’importation.",
+    "section": "Utilitaires"
+  },
+  "intro": {
+    "title": "Ce que ça fait",
+    "body": "Lit la configuration d’une VM arrêtée, convertit chaque disque en VMDK au format streamOptimized, génère un descripteur OVF et un manifeste SHA1, puis regroupe le tout dans un fichier <code>.ova</code> unique ou un répertoire <code>-ovf</code>. La VM source n’est jamais modifiée."
+  },
+  "picker": {
+    "heading": "Sélecteur de VM",
+    "body": "Au lancement, le script affiche toutes les VM de <code>qm list</code> avec leur VMID, leur nom et leur état. Choisissez celle à exporter :",
+    "imgAlt": "Boîte de dialogue de sélection de la VM à exporter, avec la liste de toutes les VM"
+  },
+  "stopped": {
+    "heading": "La VM doit être arrêtée",
+    "intro": "Une image disque cohérente nécessite une VM arrêtée. Si la VM sélectionnée est en cours d’exécution, ProxMenux propose de l’arrêter :",
+    "items": [
+      "Arrêt normal via <code>qm shutdown $VMID --timeout 120</code> (attend 2 minutes l’arrêt ACPI du système invité).",
+      "Si le délai expire, propose un arrêt forcé : <code>qm stop $VMID</code> (équivalent à une coupure d’alimentation).",
+      "Si vous refusez les deux, l’export est annulé et aucune donnée n’est modifiée."
+    ],
+    "warnTitle": "L’arrêt forcé équivaut à une coupure d’alimentation",
+    "warnBody": "<code>qm stop</code> équivaut à débrancher l’alimentation. Le système invité peut nécessiter une réparation du système de fichiers au prochain démarrage. Privilégiez l’arrêt normal et réservez l’arrêt forcé aux systèmes invités qui ne répondent plus."
+  },
+  "format": {
+    "heading": "Sélecteur de format : OVA vs OVF",
+    "headerFormat": "Format",
+    "headerOutput": "Sortie",
+    "headerPros": "Avantages",
+    "headerCons": "Inconvénients",
+    "rows": [
+      {
+        "format": "OVA",
+        "output": "name-vmid-ts.ova",
+        "pros": "Un seul fichier autonome, facile à déplacer, à transférer par sftp ou à joindre à un ticket.",
+        "cons": "Nécessite ~220 % de la taille virtuelle du disque (espace supplémentaire pour l’archive TAR pendant sa création)."
+      },
+      {
+        "format": "OVF",
+        "output": "name-vmid-ts-ovf/",
+        "pros": "~120 % de la taille virtuelle du disque. Plus facile à examiner, car le descripteur est en XML texte. Modifiable avant l’import.",
+        "cons": "Plusieurs fichiers, à transférer tous ensemble."
+      }
+    ]
+  },
+  "destination": {
+    "heading": "Répertoire de destination",
+    "body": "Choisissez un chemin prédéfini (<code>/var/lib/vz/dump</code>, <code>/var/lib/vz/template/iso</code>) ou saisissez un chemin personnalisé. Le script vérifie que le répertoire est accessible en écriture et avertit si l’espace libre semble insuffisant avant de commencer.",
+    "calloutTitle": "Estimation de l’espace libre nécessaire",
+    "calloutBody": "Pour exporter en OVF une VM dont les disques totalisent 100 Go virtuels, prévoyez ~120 Go libres ; pour OVA, ~220 Go. L’espace réellement utilisé peut être inférieur pour des disques presque vides. L’archive OVA est créée en TAR non compressé alors que les fichiers VMDK temporaires sont encore présents : prévoyez donc de la place pour les deux. Si l’espace manque pendant l’export, le gestionnaire EXIT nettoie le répertoire temporaire et vous devez recommencer."
+  },
+  "package": {
+    "heading": "Ce qui finit dans le paquet",
+    "intro": "Pour une OVA / OVF nommée <code>myvm-100-2026-04-26_18-30-15</code>:",
+    "code": "# OVA mode (single .ova file is a TAR of):\nmyvm-100-2026-04-26_18-30-15.ovf      # XML descriptor (DMTF OVF 1.0 + RASD + VSSD)\nmyvm-100-2026-04-26_18-30-15.mf       # SHA1 manifest\nmyvm-100-2026-04-26_18-30-15-disk0.vmdk\nmyvm-100-2026-04-26_18-30-15-disk1.vmdk\n...\n\n# OVF mode (a directory):\nmyvm-100-2026-04-26_18-30-15-ovf/\n├── myvm-100-2026-04-26_18-30-15.ovf\n├── myvm-100-2026-04-26_18-30-15.mf\n├── myvm-100-2026-04-26_18-30-15-disk0.vmdk\n└── myvm-100-2026-04-26_18-30-15-disk1.vmdk"
+  },
+  "exported": {
+    "heading": "Ce qui est exporté",
+    "items": [
+      "<strong>Disques :</strong> toutes les entrées <code>scsi*</code>, <code>sata*</code>, <code>virtio*</code> et <code>ide*</code> de la configuration de la VM, converties en VMDK au format streamOptimized.",
+      "<strong>Nombre de vCPU</strong> (RASD ResourceType 3) et <strong>mémoire</strong> en MiB (ResourceType 4).",
+      "<strong>Nombre de cartes réseau</strong> (ResourceType 10 : uniquement le nombre, sans le pont ni le modèle).",
+      "<strong>Nom de la VM</strong> et indication du type de système d’exploitation."
+    ],
+    "notTitle": "Ce qui n'est pas exporté",
+    "notItems": [
+      "Montages CD-ROM / ISO (volontairement exclus).",
+      "Lecteurs cloud-init (volontairement exclus).",
+      "Pont et modèle précis de carte réseau (seul le nombre est conservé).",
+      "Choix BIOS / UEFI, à configurer à nouveau lors de l’import.",
+      "Configuration du passthrough PCI.",
+      "Snapshots — seul l'état actuel est capturé.",
+      "Options de niveau VM (NUMA, pages géantes, hotplug, ...)."
+    ]
+  },
+  "conversion": {
+    "heading": "Conversion du disque",
+    "intro": "Chaque disque est converti avec :",
+    "code": "qemu-img convert -p -O vmdk -o subformat=streamOptimized \\\n    \"$source_path\" \\\n    \"$work_dir/<base_name>-disk<N>.vmdk\"",
+    "outro": "<code>streamOptimized</code> est le format VMware lisible en une seule passe, pris en charge par ESXi 6.7+, VMware Workstation, VirtualBox et Proxmox lui-même. C’est le sous-format VMDK le plus largement compatible, adapté à la portabilité. En contrepartie, il ne permet pas l’accès aléatoire et ne peut donc pas être monté directement sans conversion."
+  },
+  "manifest": {
+    "heading": "Manifeste SHA1",
+    "intro": "Chaque paquet contient un fichier <code>.mf</code> avec les empreintes SHA1 du descripteur OVF et de chaque VMDK :",
+    "code": "SHA1(myvm-100-2026-04-26_18-30-15.ovf)= 3a7bd3e2360a3d29eea436fcfb7e44c735d117c9\nSHA1(myvm-100-2026-04-26_18-30-15-disk0.vmdk)= b7e23ec29af22b0b4e41da31e868d57226121c84\nSHA1(myvm-100-2026-04-26_18-30-15-disk1.vmdk)= a87ff679a2f3e71d9181a67b7542122c",
+    "outro": "Facultatif dans la spécification OVF et ignoré par de nombreux outils, le manifeste permet toutefois de vérifier que le paquet a été transféré intact. Vérifiez-le manuellement avec <code>sha1sum -c file.mf</code>."
+  },
+  "import": {
+    "heading": "Importation du résultat",
+    "intro": "Le paquet exporté peut être importé dans :",
+    "items": [
+      {
+        "href": "/docs/utils/import-vm",
+        "preRich": "<strong>Proxmox</strong> — utilisez l’outil correspondant ",
+        "linkLabel": "Importer une VM depuis OVA / OVF",
+        "tailRich": "."
+      },
+      {
+        "tailRich": "<strong>VMware ESXi</strong> — Datacenter → Deploy OVF Template ; sélectionnez le fichier .ova ou .ovf."
+      },
+      {
+        "tailRich": "<strong>VMware Workstation / Fusion</strong> — File → Open ; sélectionnez le fichier .ova ou .ovf."
+      },
+      {
+        "tailRich": "<strong>VirtualBox</strong> — File → Import Appliance ; sélectionnez le fichier .ova ou .ovf."
+      }
+    ]
+  },
+  "troubleshoot": {
+    "heading": "Dépannage",
+    "noSpaceTitle": "qemu-img convert échoue en cours de conversion avec \"No space left on device\"",
+    "noSpaceBody": "Le répertoire de destination n’a plus d’espace libre. Le gestionnaire EXIT nettoie automatiquement le répertoire temporaire. Choisissez une destination avec davantage d’espace libre (voir l’estimation ci-dessus) et relancez l’export.",
+    "unsupportedHwTitle": "L’export se termine, mais VMware refuse l’import : \"Unsupported hardware family\"",
+    "unsupportedHwBody": "Certaines versions d’ESXi rejettent les descripteurs OVF qui déclarent une famille matérielle inconnue. Ouvrez le .ovf dans un éditeur de texte, ou extrayez d’abord le .ova, repérez <code>&lt;vssd:VirtualSystemType&gt;</code> et choisissez une valeur acceptée par ESXi, par exemple <code>vmx-13</code> pour ESXi 6.5+. Pour contourner rapidement le problème, essayez VirtualBox, qui est plus permissif.",
+    "nicTitle": "La VM importée utilise une carte réseau ou un contrôleur SCSI différent",
+    "nicBody": "L’OVF conserve le nombre de cartes réseau, pas leur modèle d’origine. Vérifiez les paramètres réseau de la VM importée dans l’hyperviseur de destination. L’export déclare un contrôleur SCSI lsilogic pour la compatibilité VMware. Lors d’un retour dans Proxmox avec ProxMenux, la VM est créée avec un contrôleur LSI et des cartes e1000 ; passez ensuite à <code>VirtIO SCSI</code> et VirtIO si le système invité possède les pilotes adaptés.",
+    "runningTitle": "La VM était en cours d’exécution et j’ai refusé de l’arrêter : export annulé",
+    "runningBody": "Le script ne peut pas produire une image cohérente pendant l’écriture sur les disques. Acceptez la demande d’arrêt la prochaine fois, ou arrêtez d’abord la VM manuellement (<code>qm shutdown $VMID</code>), puis relancez l’export.",
+    "slowTitle": "La conversion du disque est lente",
+    "slowBody": "<code>qemu-img convert</code> utilise un seul thread et lit la source à pleine vitesse. Pour un disque de 100 Go sur un disque dur mécanique, comptez 15 à 30 minutes. Un transfert de NVMe à NVMe est 5 à 10 fois plus rapide. Les disques d’une VM sont convertis l’un après l’autre ; la durée augmente linéairement avec la taille virtuelle totale."
+  },
+  "related": {
+    "heading": "Voir aussi",
+    "items": [
+      {
+        "href": "/docs/utils/import-vm",
+        "label": "Importer une VM depuis OVA / OVF",
+        "tail": " — l’outil complémentaire pour réimporter la VM."
+      },
+      {
+        "href": "/docs/utils",
+        "label": "Présentation des utilitaires",
+        "tail": " — retour à la présentation de la section."
+      }
+    ]
+  }
+}
diff --git a/web/messages/fr/docs/utils/import-vm.json b/web/messages/fr/docs/utils/import-vm.json
new file mode 100644
index 00000000..dc31389c
--- /dev/null
+++ b/web/messages/fr/docs/utils/import-vm.json
@@ -0,0 +1,218 @@
+{
+  "meta": {
+    "title": "Importer une VM depuis OVA / OVF | Documentation ProxMenux",
+    "description": "Importez une VM VMware ESXi / Workstation / Fusion / VirtualBox / ProxMenux dans Proxmox VE. Extrait automatiquement OVA, analyse les métadonnées OVF, crée la VM et importe chaque disque au format natif du stockage (qcow2 / raw).",
+    "ogTitle": "Importer une VM depuis OVA / OVF | Documentation ProxMenux",
+    "ogDescription": "Importez dans Proxmox des VM exportées depuis VMware, VirtualBox ou ProxMenux. Les disques sont convertis automatiquement au format natif du stockage."
+  },
+  "header": {
+    "title": "Importer une VM depuis OVA / OVF",
+    "description": "Importe un paquet OVA / OVF dans Proxmox VE : extrait les archives OVA, lit le descripteur OVF pour obtenir le nombre de vCPU, la mémoire, le nombre de cartes réseau et les références des disques, puis crée la VM et importe chaque disque avec qm importdisk vers le stockage choisi. Compatible avec les exports VMware (ESXi / Workstation / Fusion), VirtualBox et ProxMenux.",
+    "section": "Utilitaires"
+  },
+  "intro": {
+    "title": "Ce que ça fait",
+    "body": "Crée une VM complète dans Proxmox depuis un paquet portable. Après l’import, elle est prête à démarrer. Quelques vérifications et réglages du modèle réseau, du firmware et du type de système sont recommandés pour les performances et la compatibilité."
+  },
+  "picker": {
+    "heading": "Sélection de fichiers",
+    "intro": "Au lancement, le script propose deux répertoires prédéfinis ou un chemin manuel :",
+    "items": [
+      "<code>/var/lib/vz/dump</code> — le répertoire de sauvegarde par défaut Proxmox vzdump.",
+      "<code>/var/lib/vz/template/iso</code> — utile si vous y avez transféré l’OVA par sftp.",
+      "Chemin manuel — pour les fichiers OVA / OVF n'importe où ailleurs sur l'hôte."
+    ],
+    "outro": "Il énumère ensuite chaque fichier <code>.ova</code> et <code>.ovf</code> dans le répertoire choisi.",
+    "imageAlt": "Dialogue de sélection du fichier de VM à importer"
+  },
+  "flow": {
+    "heading": "Comment fonctionne l'importation",
+    "nodes": [
+      {
+        "label": "Entrée OVA / OVF",
+        "detail": ".ova → tar xf vers\n /tmp/.proxmenux-import-*\n.ovf → utiliser sur place",
+        "variant": "source"
+      },
+      {
+        "label": "Analyse et dialogues",
+        "detail": "AWK lit OVF\n(nom, vCPU, RAM, NIC,\nles disques). Choix de l'utilisateur\nVMID / stockage / pont",
+        "variant": "bridge"
+      },
+      {
+        "label": "qm create + importdisk",
+        "detail": "qm create $VMID\nqm importdisk\n(VMDK → format du stockage)\nqm set --scsiN",
+        "variant": "target"
+      }
+    ]
+  },
+  "ovf": {
+    "heading": "Analyse OVF",
+    "intro": "Un analyseur <strong>gawk</strong> lit le descripteur OVF et retire les métadonnées VM. L'analyseur utilise la forme d'argument 3 de <code>match()</code> spécifique à gawk (mawk, le <code>awk</code> par défaut sur Debian / Proxmox, ne le supporte pas). Lors de la première importation, le script auto-installe gawk via la paire canonique <code>ensure_repositories</code> + <code>install_single_package</code> s'il manque; les importations subséquentes commencent instantanément. Champs extraits:",
+    "headerField": "Champ",
+    "headerSource": "Source en OVF",
+    "headerDefault": "Par défaut si manquant",
+    "rows": [
+      {
+        "field": "Nom VM",
+        "source": "<Name> (première correspondance)",
+        "default": "imported-vm"
+      },
+      {
+        "field": "Nombre de vCPU",
+        "source": "RASD ResourceType 3 → VirtualQuantity",
+        "default": "1"
+      },
+      {
+        "field": "Mémoire (MiB)",
+        "source": "RASD ResourceType 4 → VirtualQuantity",
+        "default": "1024"
+      },
+      {
+        "field": "Nombre de NIC",
+        "source": "Nombre de ResourceType 10",
+        "default": "1"
+      },
+      {
+        "field": "Type de système d’exploitation",
+        "source": "/Linux/ ou /Windows/ dans la description",
+        "default": "other"
+      },
+      {
+        "field": "Références des disques",
+        "source": "attributs href se terminant par .vmdk / .qcow2 / .img / .raw",
+        "default": "aucun (importation avortée)"
+      }
+    ]
+  },
+  "memWarn": {
+    "title": "Ambiguité de l'unité de mémoire",
+    "body": "L’analyseur convertit les unités mémoire reconnues en <strong>MiB</strong>, notamment les octets, KiB, MiB, GiB et les libellés textuels pris en charge. Les unités absentes ou inconnues sont <em>traitées comme des MiB</em>. Après l’import, comparez <code>qm config $VMID | grep memory</code> à la RAM documentée de la VM source et corrigez-la si nécessaire avec <code>qm set $VMID --memory &lt;MiB&gt;</code>."
+  },
+  "dialog": {
+    "heading": "Étapes des dialogues d’importation",
+    "items": [
+      "<strong>VMID</strong> — propose le prochain identifiant disponible (<code>pvesh get /cluster/nextid</code>).",
+      "<strong>Nom de la VM</strong> — reprend le nom lu dans l’OVF ; vous pouvez le modifier.",
+      "<strong>Stockage de destination</strong> — liste des stockages acceptant le contenu <code>images</code>, obtenue par <code>pvesm status -content images</code>.",
+      "<strong>Pont réseau</strong> — liste des ponts issue de <code>ip link show type bridge</code>. Un pont unique est choisi automatiquement ; la valeur par défaut est <code>vmbr0</code>.",
+      "<strong>Confirmation</strong> — boîte de dialogue sommaire avec VMID, nom, vCPU, mémoire, NIC, stockage, pont et la liste des disques à importer. Annuler ici = rien ne change."
+    ]
+  },
+  "create": {
+    "heading": "Création de VM",
+    "intro": "Après confirmation, le script s'exécute :",
+    "code": "qm create $VMID \\\n    --name \"$NAME\" \\\n    --memory $MEMORY \\\n    --cores $VCPU \\\n    --ostype $OSTYPE \\\n    --scsihw lsi \\\n    --net0 e1000,bridge=$BRIDGE\n\n# For each additional NIC:\nqm set $VMID --netN e1000,bridge=$BRIDGE",
+    "outro": "Le contrôleur SCSI par défaut est <code>lsi</code> (LSI Logic) pour la compatibilité VMDK. NICs par défaut à <code>e1000</code> (compatibilité universelle) sur le pont choisi."
+  },
+  "diskLoop": {
+    "heading": "Boucle d'importation de disque",
+    "intro": "Pour chaque référence disque dans l'OVF:",
+    "items": [
+      "<code>qm importdisk $VMID $disk_path $STORAGE</code> — importe le disque dans un format accepté par le stockage de destination et crée une entrée <code>unusedN:</code> dans la configuration de la VM.",
+      "Le script recherche avec grep la référence <code>unusedN</code> qui vient d’être créée dans la configuration.",
+      "<code>qm set $VMID --scsiN $unused_disk</code> — fixe le disque comme <code>scsi0</code>, <code>scsi1</code>, ...",
+      "<code>qm set $VMID --delete unusedN</code> — efface le marqueur maintenant inutilisé."
+    ],
+    "outro": "Le démarrage est réglé sur le premier disque SCSI : <code>qm set $VMID --boot c --bootdisk scsi0</code>."
+  },
+  "postImport": {
+    "heading": "Réglages recommandés après l’import",
+    "intro": "L’import utilise des réglages largement compatibles pour favoriser un premier démarrage réussi. Après l’avoir confirmé, choisissez des réglages plus performants depuis l’interface Proxmox ou la CLI :",
+    "headerSetting": "Réglage",
+    "headerDefault": "Par défaut après l'importation",
+    "headerRecommended": "Recommandé si le système invité le prend en charge",
+    "rows": [
+      {
+        "setting": "Modèle NIC",
+        "default": "e1000",
+        "recommended": "VirtIO (bien plus rapide, nécessite un pilote dans le système invité)"
+      },
+      {
+        "setting": "Contrôleur SCSI",
+        "default": "LSI",
+        "recommended": "VirtIO SCSI single (Linux récent ou Windows avec pilotes VirtIO)"
+      },
+      {
+        "setting": "Micrologiciel (BIOS / UEFI)",
+        "default": "Par défaut Proxmox (BIOS)",
+        "recommended": "Reprendre le firmware de la VM source ; un mauvais choix empêche le démarrage"
+      },
+      {
+        "setting": "QEMU agent invité",
+        "default": "Désactivé",
+        "recommendedRich": "Activer et installer <code>qemu-guest-agent</code> dans le système invité (meilleures sauvegardes, remontée des IP)"
+      },
+      {
+        "setting": "Type de système d’exploitation",
+        "default": "l26 / win10 / other (heuristique)",
+        "recommended": "Vérifier par rapport à l'OS client réel"
+      },
+      {
+        "setting": "Affichage",
+        "default": "Par défaut",
+        "recommended": "VirtIO-GPU ou SPICE (meilleure performance de la console)"
+      }
+    ]
+  },
+  "fwWarn": {
+    "title": "Erreur de firmware = pas de démarrage",
+    "body": "Si la source VM était UEFI mais Proxmox la crée comme BIOS (ou vice-versa), l'invité ne trouvera pas de disque amorçable. Vérifiez les paramètres OVF ou VM d'origine pour <em>FirmwareType / firmware</em> et définissez la même chose dans Proxmox: <code>qm set $VMID --bios ovmf</code> pour UEFI; par défaut, <code>seabios</code> pour BIOS."
+  },
+  "notImported": {
+    "heading": "Ce qui n'est pas importé",
+    "items": [
+      "<strong>Ponts réseau précis</strong> — seul le nombre de cartes est conservé. Toutes utilisent le pont choisi lors de l’import.",
+      "<strong>Modèle NIC</strong> — par défaut pour e1000.",
+      "<strong>Type de firmware BIOS / UEFI</strong> — utilise la valeur Proxmox par défaut, BIOS.",
+      "<strong>Configuration du passthrough PCI</strong>.",
+      "<strong>TPM</strong> (vTPM).",
+      "Lecteurs <strong>cloud-init</strong>.",
+      "<strong>Snapshots</strong> — seul l'état actuel.",
+      "<strong>USB / série / dispositifs parallèles</strong> déclaré dans l'OVF.",
+      "<strong>VM tags / notes / options de démarrage</strong>."
+    ]
+  },
+  "troubleshoot": {
+    "heading": "Dépannage",
+    "orphanTitle": "La VM est créée, mais l’import des disques échoue et laisse une VM partielle",
+    "orphanIntro": "Si l’import échoue, le script propose de supprimer la VM partielle et ses disques importés. Si vous avez refusé ou si la suppression automatique a échoué, examinez la VM et supprimez-la manuellement avec :",
+    "orphanCode": "qm destroy $VMID --destroy-unreferenced-disks 1",
+    "orphanOutro": "Ensuite, corrigez la cause sous-jacente (probablement l'espace disque sur le stockage cible) et réimportez.",
+    "memTitle": "La VM importée dispose de 8 Mo de RAM, ou de 8 To",
+    "memIntro": "L’analyseur convertit les AllocationUnits reconnues en MiB. Les unités absentes ou inconnues sont traitées comme des MiB. Examinez l’OVF et comparez la mémoire importée à celle de la VM source. Corrigez-la si nécessaire :",
+    "memCode": "qm set $VMID --memory 8192    # 8 GiB",
+    "bootTitle": "La VM importée ne démarre pas : \"No bootable device\"",
+    "bootIntro": "Cause fréquente : un mauvais choix BIOS / UEFI. La VM source utilisait UEFI, mais Proxmox l’a créée avec BIOS. Choisissez le firmware correspondant :",
+    "bootCode": "qm set $VMID --bios ovmf       # UEFI\n# also add an EFI disk for the EFI vars:\nqm set $VMID --efidisk0 $STORAGE:1,format=qcow2,efitype=4m,pre-enrolled-keys=1",
+    "bootOutro": "Autre cause fréquente : l’ordre de démarrage vise scsi0 alors que le système est sur scsi1. Modifiez l’ordre dans l’onglet Options de la VM.",
+    "bsodTitle": "Une VM Windows exportée de VMware affiche un écran bleu au premier démarrage",
+    "bsodBody": "Windows est sensible au changement de contrôleur de disque. Installez les pilotes VirtIO <em>avant</em> l’export depuis VMware, ou conservez le contrôleur <code>lsi</code> par défaut. Passez à VirtIO SCSI seulement après un démarrage réussi et l’installation des pilotes VirtIO dans Windows.",
+    "zeroTitle": "L’analyseur OVF indique 0 disque",
+    "zeroBody": "L’OVF peut utiliser des références de disque inconnues de l’analyseur. Ouvrez-le et cherchez pour chaque disque une entrée <code>&lt;File ovf:href=\"...vmdk\" ...&gt;</code>. Si le disque est réellement VMDK, mais porte une extension inhabituelle comme <code>.dat</code>, renommez-le en <code>.vmdk</code> et actualisez la référence OVF. Le renommage ne convertit pas le format.",
+    "awkTitle": "awk: erreur de syntaxe à ou près , — l'analyseur échoue sur chaque OVA / OVF",
+    "awkIntro": "L’analyseur OVF utilise la syntaxe gawk de <code>match()</code> à trois arguments, absente de mawk, le <code>awk</code> par défaut sur Debian / Proxmox. Les versions récentes installent gawk automatiquement au premier usage via <code>ensure_repositories</code> + <code>install_single_package</code>. Avec une ancienne copie, installez-le manuellement :",
+    "awkCode": "apt-get install -y gawk",
+    "awkOutro": "Relancez ensuite l’import.",
+    "netTitle": "Réseau ne fonctionnant pas après le premier démarrage",
+    "netBody": "Le système invité peut ne pas avoir les pilotes du modèle réseau e1000, ou le pont choisi peut être incorrect. Dans l’onglet Hardware de la VM, changez Network Device → Model. Vérifiez aussi <code>ip a</code> dans le système invité : l’interface peut avoir changé de nom, par exemple ens18 au lieu d’eth0, alors que sa configuration utilise encore l’ancien."
+  },
+  "files": {
+    "heading": "Fichiers concernés",
+    "code": "scripts/utilities/import_vm_ova_ovf.sh       # this script\n/tmp/.proxmenux-import-*/                    # temp extraction dir for OVA\n/etc/pve/nodes/<node>/qemu-server/<vmid>.conf  # created by qm create\n<storage>/<vmid>/<vmid>-disk-<n>.<fmt>        # disk images, format depends on storage"
+  },
+  "related": {
+    "heading": "Voir aussi",
+    "items": [
+      {
+        "href": "/docs/utils/export-vm",
+        "label": "Exportation de VM vers OVA / OVF",
+        "tail": " — l’outil complémentaire pour exporter la VM."
+      },
+      {
+        "href": "/docs/utils",
+        "label": "Présentation des utilitaires",
+        "tail": " — retour à la présentation de la section."
+      }
+    ]
+  }
+}
diff --git a/web/messages/fr/docs/utils/index.json b/web/messages/fr/docs/utils/index.json
new file mode 100644
index 00000000..29fa3a50
--- /dev/null
+++ b/web/messages/fr/docs/utils/index.json
@@ -0,0 +1,115 @@
+{
+  "meta": {
+    "title": "Utilitaires Proxmox — UUP Dump, migration de PVE 8 vers 9, export/import OVA | ProxMenux",
+    "description": "Utilitaires du quotidien pour Proxmox VE : créer des ISO Windows avec UUP Dump, installer une sélection d’outils CLI, mettre à jour le système Proxmox en toute sécurité, passer de PVE 8 à PVE 9, exporter des VM en OVA / OVF et importer des VM OVA / OVF depuis VMware ou VirtualBox.",
+    "ogTitle": "Utilitaires Proxmox — UUP Dump, migration de PVE 8 vers 9, export/import OVA",
+    "ogDescription": "Créez des ISO Windows, installez des outils CLI, lancez une mise à jour sûre, passez de PVE 8 à PVE 9 et exportez ou importez des VM OVA / OVF.",
+    "twitterTitle": "Utilitaires Proxmox | ProxMenux",
+    "twitterDescription": "Création d’ISO, outils CLI, mise à jour Proxmox, migration PVE 8→9 et portabilité des VM OVA / OVF."
+  },
+  "header": {
+    "title": "Utilitaires et outils",
+    "description": "Six outils complètent les tâches quotidiennes dans Proxmox VE : création d’ISO, maintenance du système et portabilité des VM. Chaque option est indépendante : choisissez celle qui vous convient ; rien n’est installé sans votre demande.",
+    "section": "Utilitaires"
+  },
+  "intro": {
+    "title": "À quoi sert ce menu",
+    "body": "Trois groupes d’outils indépendants mais souvent utiles : <strong>créer une ISO Windows</strong> avec UUP Dump, <strong>entretenir l’hôte Proxmox</strong> (outils CLI, mises à jour et changement de version majeure) et <strong>importer et exporter des VM</strong> dans Proxmox au format standard OVA / OVF."
+  },
+  "opening": {
+    "heading": "Ouverture du menu",
+    "body": "Dans le menu principal de ProxMenux, sélectionnez <strong>Utilities</strong>. Voici ce qui s’affiche :",
+    "imageAlt": "Menu des utilitaires avec UUP Dump, outils système, mise à jour, changement de version, export et import"
+  },
+  "groups": {
+    "heading": "Trois groupes d'outils",
+    "intro": "Les six outils se divisent en trois groupes indépendants. Cliquez sur une carte ci-dessous pour passer à la section correspondante.",
+    "iso": {
+      "title": "Création ISO",
+      "body": "Créez des ISO Windows officielles avec UUP Dump directement sur l’hôte Proxmox.",
+      "bullets": [
+        "Lien partagé UUP Dump → ISO amorçable",
+        "Dépendances installées automatiquement",
+        "Le résultat est enregistré dans le répertoire des modèles ISO de Proxmox"
+      ]
+    },
+    "maintenance": {
+      "title": "Entretien du système",
+      "body": "Maintenez l’hôte en bon état : outils CLI, mises à jour régulières et passage à la version majeure suivante le moment venu.",
+      "bullets": [
+        "Installateur d’utilitaires système (25 outils CLI)",
+        "Mise à jour du système Proxmox (apt + dist-upgrade)",
+        "PVE 8 → PVE 9 mise à jour majeure"
+      ]
+    },
+    "portability": {
+      "title": "Portabilité des VM",
+      "body": "Importez et exportez des VM dans Proxmox au format standard OVA / OVF.",
+      "bullets": [
+        "Exporter une VM Proxmox → OVA / OVF",
+        "Importer OVA / OVF → VM Proxmox",
+        "Compatible avec VMware et VirtualBox"
+      ]
+    }
+  },
+  "upgradeWarn": {
+    "title": "La mise à jour PVE 8 → 9 est destructrice et non réversible",
+    "body": "Un changement de version majeure remplace sur place la base Debian (Bookworm → Trixie) et les composants Proxmox. Aucun retour arrière n’est prévu : vous devez disposer de <strong>sauvegardes vérifiées</strong> de chaque VM et CT et d’un <strong>accès console / IPMI / iKVM</strong> avant de commencer. C’est pourquoi l’outil refuse de s’exécuter depuis le terminal web Proxmox."
+  },
+  "isoSection": {
+    "heading": "Création ISO",
+    "body": "Créez une nouvelle ISO d’installation de Windows à jour directement sur l’hôte Proxmox. Le script automatise tout le processus UUP Dump : installation des dépendances (aria2c, cabextract, wimlib-imagex, …), téléchargement parallèle des fichiers de mise à jour avec aria2 et conversion en une ISO amorçable. Elle est enregistrée dans <code>/var/lib/vz/template/iso</code>, prête à être associée à une VM.",
+    "options": [
+      {
+        "title": "Créateur d’ISO UUP Dump",
+        "description": "Créez une ISO d’installation de Windows à jour depuis un lien partagé UUP Dump. Les dépendances, le téléchargement et la conversion sont entièrement automatisés ; l’ISO obtenue est enregistrée dans /var/lib/vz/template/iso, prête pour la création d’une VM.",
+        "href": "/docs/utils/UUp-Dump-ISO-Creator"
+      }
+    ]
+  },
+  "maintenanceSection": {
+    "heading": "Entretien du système",
+    "body": "Trois outils couvrent les tâches quotidiennes et occasionnelles sur l’hôte. L’<strong>Installateur d’utilitaires système</strong> installe les outils CLI utiles après une nouvelle installation. La <strong>Mise à jour du système Proxmox</strong> assure l’entretien hebdomadaire ou mensuel. Le <strong>Passage de PVE 8 à PVE 9</strong> est le grand changement de chaque cycle de version majeure, avec des contrôles de sécurité supplémentaires car il n’est pas réversible.",
+    "options": [
+      {
+        "title": "Installateur des utilitaires système",
+        "description": "Sélecteur de 25 outils CLI choisis (htop, btop, iperf3, tmux, ...) avec sélection personnalisée ou groupes prédéfinis (base, développement, compression, multiplexeurs, analyse, réseau). Utilise le processus standard avec dépôt et commande de vérification.",
+        "href": "/docs/utils/system-utils"
+      },
+      {
+        "title": "Mise à jour du système Proxmox",
+        "description": "Vérification des dépôts + apt update + apt dist-upgrade, avec confirmation avant le redémarrage. Détecte la version majeure de PVE (8 ou 9), conserve les dépôts configurés et demande confirmation avant de faire passer un hôte sans abonnement au dépôt no-subscription, puis exécute autoremove.",
+        "href": "/docs/utils/system-update"
+      },
+      {
+        "title": "Mettre à niveau le PVE 8 vers le PVE 9",
+        "description": "Changement de version majeure (Debian Bookworm → Trixie + PVE 8 → 9). Vérifications préalables, migration des dépôts, mode automatisé ou interactif, validation après la migration et redémarrage. Refuse de s’exécuter depuis le terminal web.",
+        "href": "/docs/utils/upgrade-pve8-pve9"
+      }
+    ]
+  },
+  "portabilitySection": {
+    "heading": "Portabilité VM (OVA / OVF)",
+    "body": "OVA et OVF sont des formats de paquetage entre hyperviseurs définis par la norme DMTF et pris en charge par VMware, VirtualBox et Proxmox. Les deux outils permettent un aller-retour : une VM exportée de Proxmox peut y être réimportée, et inversement. Utilisez-les pour migrer des charges depuis ESXi, créer une sauvegarde portable d’une VM ou partager une VM préparée avec un utilisateur de VirtualBox.",
+    "options": [
+      {
+        "title": "Exportation de VM vers OVA / OVF",
+        "description": "Convertissez une VM Proxmox en archive OVA portable ou en répertoire OVF. Schéma DMTF standard, manifeste SHA1 et disques VMDK au format streamOptimized. Importable dans VMware (ESXi / Workstation / Fusion), VirtualBox et à nouveau dans Proxmox.",
+        "href": "/docs/utils/export-vm"
+      },
+      {
+        "title": "Importer une VM depuis OVA / OVF",
+        "description": "Importez dans Proxmox une exportation VMware / VirtualBox / ProxMenux. L’outil extrait automatiquement l’archive OVA, analyse les métadonnées OVF, crée la VM et importe chaque disque au format natif du stockage.",
+        "href": "/docs/utils/import-vm"
+      }
+    ]
+  },
+  "diskSpaceCallout": {
+    "title": "Une note sur l'espace disque pour l'exportation / l'importation",
+    "body": "Les deux outils convertissent les formats de disque : l’export utilise <code>qemu-img convert -O vmdk -o subformat=streamOptimized</code> et l’import utilise <code>qm importdisk</code> pour revenir au format natif du stockage (qcow2 / raw). Pour l’export, prévoyez <strong>~120 % de la taille virtuelle du disque</strong> pour OVF et <strong>~220 %</strong> pour OVA. L’archive OVA utilise un TAR non compressé et est créée alors que les fichiers VMDK temporaires sont encore présents. Vérifiez que le répertoire de destination dispose de suffisamment d’espace avant de commencer."
+  },
+  "fitsTogether": {
+    "heading": "Organisation du menu",
+    "body": "Chaque outil possède un script dédié dans <code>scripts/utilities/</code>. La mise à jour du système Proxmox appelle un seul script sécurisé dans <code>scripts/global/</code>, update-pve-safe.sh, qui détecte la version majeure et gère PVE 8 et PVE 9. Le passage PVE 8 → 9 propose deux actions supplémentaires dans son propre menu : une <em>Vérification avant migration</em> indépendante (exécute <code>pve8to9 --full</code>) et un <em>Guide de migration manuelle</em> en lecture seule (procédure en 17 étapes), pour contrôler le processus ou l’effectuer manuellement."
+  }
+}
diff --git a/web/messages/fr/docs/utils/system-update.json b/web/messages/fr/docs/utils/system-update.json
new file mode 100644
index 00000000..5888fd02
--- /dev/null
+++ b/web/messages/fr/docs/utils/system-update.json
@@ -0,0 +1,168 @@
+{
+  "meta": {
+    "title": "Mise à jour du système Proxmox | Documentation ProxMenux",
+    "description": "Met à jour les paquets dans la version majeure actuelle de Proxmox avec apt-get update et apt full-upgrade -y. Vérifie l’espace disque et les dépôts configurés, tente de récupérer les clés GPG, vérifie et répare les anciens en-têtes PV LVM, reconstruit les pilotes DKMS gérés si nécessaire, exécute autoremove/autoclean et propose un redémarrage lorsque nécessaire.",
+    "ogTitle": "Mise à jour du système Proxmox | Documentation ProxMenux",
+    "ogDescription": "apt full-upgrade avec vérification des dépôts, autoremove/autoclean et proposition de redémarrage si nécessaire."
+  },
+  "header": {
+    "title": "Mise à jour du système Proxmox",
+    "description": "Appelle un seul script d’exécution (<code>update-pve-safe.sh</code>) qui détecte la version majeure de Proxmox. Les dépôts configurés sont lus via l’API Proxmox et conservés ; un hôte sans abonnement utilisant uniquement Enterprise doit confirmer avant le passage à no-subscription. Le script met à jour les paquets et reconstruit les pilotes DKMS gérés par ProxMenux pour un noyau en attente de démarrage. Le script principal propose un redémarrage si le marqueur système existe ou si le dernier noyau installé diffère du noyau en cours. Le processus est aussi accessible depuis <em>Update Now</em> dans l’en-tête de ProxMenux Monitor lorsque des mises à jour sont détectées.",
+    "section": "Utilitaires"
+  },
+  "calloutWhat": {
+    "title": "Ce que ça fait",
+    "body": "Met l’hôte au dernier niveau de correctifs de sa version majeure actuelle. Il ne change <strong>pas</strong> de version majeure ; pour PVE 8 → PVE 9, consultez <link>Passer de PVE 8 à PVE 9</link>."
+  },
+  "official": {
+    "heading": "La recommandation officielle de Proxmox",
+    "intro": "Pour mettre à jour un hôte dans la même version majeure, Proxmox recommande d’exécuter :",
+    "code": "apt update && apt full-upgrade -y",
+    "outro": "Cette ligne est la commande officielle pour les versions actuelles de Proxmox. Il faut également vérifier que les dépôts sont propres, que les bons sont activés et que l’hôte reste dans un état cohérent après la mise à jour."
+  },
+  "onTop": {
+    "heading": "Ce que ProxMenux ajoute : vérifié dans le script",
+    "intro": "Utilise <strong>la même opération apt full-upgrade</strong>, avec vérification des dépôts, reconstruction DKMS et nettoyage après mise à jour. Les étapes suivantes correspondent à <code>scripts/utilities/proxmox_update.sh</code> et à son unique script d’exécution <code>scripts/global/update-pve-safe.sh</code> :",
+    "items": [
+      "<strong>Détecte la version majeure de PVE</strong> dans le script d’exécution (<code>pveversion | grep -oP ''pve-manager/\\K[0-9]+''</code>). Un seul script gère PVE 8 et PVE 9 ; les dépôts configurés sont conservés, sauf si un hôte sans abonnement accepte le changement proposé.",
+      "<strong>Conserve les dépôts configurés.</strong> <code>ensure_repositories</code> lit les dépôts via l’API Proxmox et vérifie l’abonnement. Avec un abonnement actif ou un dépôt no-subscription ou test déjà utilisé, rien ne change. Un hôte sans abonnement actif utilisant uniquement Enterprise doit confirmer le passage à no-subscription. Un refus arrête la mise à jour sans modifier les sources.",
+      "<strong>Exécute la mise à jour sans interaction</strong> avec <code>DEBIAN_FRONTEND=noninteractive</code> et <code>--force-confdef --force-confold</code>. Pour les fichiers de configuration dpkg, l’action par défaut est acceptée si elle existe ; sinon, le fichier actuel est conservé.",
+      "<strong>N’impose pas les utilitaires facultatifs.</strong> Le script n’installe pas de force <code>zfsutils-linux</code>, <code>chrony</code>, <code>ifupdown2</code> ou des paquets similaires. Une installation Proxmox qui a choisi de s’en passer conserve ce choix. Les paquets manquants sont signalés dans les processus d’installation supérieurs, pas lors de la mise à jour.",
+      "<strong>Vérification et réparation des métadonnées LVM.</strong> Détecte les anciens en-têtes PV et exécute vgck --updatemetadata et vgchange -ay sur les groupes de volumes concernés. Cela peut modifier les métadonnées LVM ; il ne s’agit pas d’une simple vérification avec avertissement.",
+      "<strong>Nettoye ensuite:</strong> <code>apt-get autoremove -y</code> + <code>apt-get autoclean -y</code>.",
+      "<strong>Reconstruction DKMS avant la proposition de redémarrage.</strong> Le script d’exécution appelle <code>pmx_rebuild_dkms_after_kernel</code> lorsqu’un noyau installé plus récent est en attente. Le script principal vérifie <code>/var/run/reboot-required</code> et utilise <code>dpkg-query</code> pour comparer le noyau indiqué par <code>uname -r</code> avec le dernier paquet <code>proxmox-kernel-*-pve-signed</code> / <code>pve-kernel-*-pve</code> installé. Le marqueur peut manquer sur les hôtes sans <code>needrestart</code> ; la comparaison des noyaux fonctionne tout de même."
+    ]
+  },
+  "calloutOneSentence": {
+    "title": "En une phrase",
+    "body": "Met à jour les paquets de l’hôte, conserve les dépôts sauf changement accepté, vérifie les métadonnées LVM, reconstruit les pilotes DKMS gérés, nettoie avec autoremove/autoclean et propose un redémarrage si nécessaire."
+  },
+  "confirm": {
+    "heading": "Boîte de dialogue de confirmation",
+    "intro": "La sélection de l’option ouvre un résumé des actions prévues et demande une confirmation explicite :",
+    "imageAlt": "Boîte de dialogue de confirmation de mise à jour Proxmox avec vérification des dépôts, mise à jour des paquets et nettoyage"
+  },
+  "routes": {
+    "heading": "Comment le script principal délègue l’exécution",
+    "nodes": {
+      "source": {
+        "label": "proxmox_update.sh",
+        "detail": "pveversion |\ngrep -oP ''pve-manager/\\K[0-9]+''"
+      },
+      "bridge": {
+        "label": "Un seul script d’exécution",
+        "detail": "update-pve-safe.sh\n(détecte PVE 8 / 9\nen interne)"
+      },
+      "target": {
+        "label": "Après la mise à jour",
+        "detail": "apt-get autoremove\napt-get autoclean\nRedémarrage proposé si nécessaire"
+      }
+    }
+  },
+  "worker": {
+    "heading": "Ce que fait le script d’exécution",
+    "intro": "Un seul script (<code>scripts/global/update-pve-safe.sh</code>) gère PVE 8 (<code>bookworm</code>) et PVE 9 (<code>trixie</code>). Il détecte la version majeure et vérifie les dépôts existants sans réécrire les sources Debian de base. Les étapes sont les suivantes :",
+    "items": [
+      "<strong>Vérifications préalables.</strong> Vérifie qu’il reste au moins ~1 Go dans <code>/var/cache/apt/archives</code>. Sinon, le processus s’arrête immédiatement avec un message clair afin d’éviter un échec au milieu d’une opération apt.",
+      "<strong>Vérification des dépôts.</strong> <code>ensure_repositories</code> lit les dépôts et l’état de l’abonnement. Avec un dépôt Proxmox utilisable, rien ne change. Sur un hôte sans abonnement actif utilisant uniquement Enterprise, le passage à no-subscription doit être confirmé ; un refus arrête la mise à jour.",
+      "<strong>apt update avec récupération automatique GPG.</strong> En cas de <code>NO_PUBKEY</code> pour un dépôt, y compris tiers, le script importe la clé manquante et réessaie automatiquement avant de signaler un échec.",
+      "<strong>Mises à jour en attente et de sécurité.</strong> Indique combien de paquets vont changer et combien proviennent de la suite de sécurité, afin d’afficher des chiffres concrets dans le dialogue de confirmation.",
+      "<strong>Boîte de dialogue de confirmation.</strong> Après l’actualisation des listes de paquets, le script demande un oui explicite avant de mettre à jour les paquets.",
+      "<strong>apt full-upgrade.</strong> Utilise <code>DEBIAN_FRONTEND=noninteractive</code> et <code>--force-confdef --force-confold</code>. Dpkg suit son action par défaut pour les fichiers de configuration lorsqu’elle existe ; sinon, il conserve le fichier actuel.",
+      "<strong>Vérification LVM.</strong> <code>lvm_repair_check</code> actualise les métadonnées des groupes de volumes lorsque des disques transmis directement à des VM invitées (DSM, TrueNAS ou appliances de stockage) reviennent avec d’anciens en-têtes PV.",
+      "<strong>Reconstruction DKMS des pilotes gérés par ProxMenux.</strong> Lorsqu’un nouveau noyau est en attente de démarrage, <code>pmx_rebuild_dkms_after_kernel</code> lit les pilotes installés par ProxMenux dans <code>components_status.json</code> (actuellement <code>nvidia_driver</code> → module <code>nvidia</code> et <code>coral_driver</code> → module <code>gasket</code>), installe les en-têtes correspondants (<code>proxmox-headers-&lt;newkver&gt;</code> si disponible, sinon <code>pve-headers-&lt;newkver&gt;</code>) et exécute <code>dkms autoinstall -k &lt;newkver&gt;</code>. Si <code>dkms status</code> ne montre pas les modules construits pour le nouveau noyau, les installateurs sont relancés avec <code>--auto-reinstall</code>. Les échecs sont consignés sans interrompre la mise à jour, qui atteint tout de même la proposition de redémarrage.",
+      "<strong>Nettoyage final.</strong> <code>apt-get autoremove</code> + <code>apt-get autoclean</code> avant de rendre la main au script principal."
+    ]
+  },
+  "post": {
+    "heading": "Nettoyage et redémarrage après mise à jour",
+    "intro": "Après la fin du script d’exécution, le script principal exécute :",
+    "code": "apt-get autoremove -y    # drop unused dependencies pulled in by old packages\napt-get autoclean        # drop downloaded .deb files no longer in the index",
+    "afterCode": "Le script principal vérifie aussi si un redémarrage est nécessaire. Chacun de ces signaux déclenche la proposition :",
+    "items": [
+      "<code>/var/run/reboot-required</code> existe : un paquet ou un outil système a indiqué qu’un redémarrage est nécessaire.",
+      "Le dernier paquet de noyau Proxmox installé diffère du noyau en cours, selon <code>dpkg-query</code> et uname -r."
+    ],
+    "outro": "Si l’une des conditions est remplie, une boîte de dialogue whiptail demande <em>« Certains changements nécessitent un redémarrage. Voulez-vous redémarrer maintenant ? »</em>. Refusez pour continuer avec le noyau en cours jusqu’au redémarrage manuel, par exemple pendant une fenêtre de maintenance prévue."
+  },
+  "end": {
+    "heading": "Ce que vous voyez à la fin",
+    "intro": "À la fin du script d’exécution, le terminal affiche le résultat du nettoyage et, si nécessaire, la proposition de redémarrage :",
+    "imageAlt": "Résumé final de la mise à jour Proxmox avec résultat du nettoyage et proposition de redémarrage"
+  },
+  "calloutDeclineReboot": {
+    "title": "Reportez le redémarrage seulement pour une raison précise",
+    "body": "Installer un nouveau paquet <code>proxmox-kernel-*</code> ne remplace pas le noyau en cours avant le redémarrage. Le nouveau noyau et ses modules correspondants deviennent actifs au démarrage suivant. Prévoyez une fenêtre de maintenance adaptée et examinez auparavant les avertissements de compilation DKMS."
+  },
+  "noSub": {
+    "heading": "Traitement du dépôt Enterprise par le script",
+    "intro": "Proxmox active par défaut le dépôt Enterprise. Sans abonnement actif, ce dépôt renvoie 401 lors de <code>apt-get update</code>. Le script ne modifie les dépôts que dans ce cas et après confirmation, via l’API Proxmox utilisée par <em>Node → Updates → Repositories</em>. Voici les différents cas :",
+    "items": [
+      "Avec un <strong>abonnement actif</strong>, les dépôts sont conservés et Enterprise fournit les mises à jour.",
+      "Si le <strong>dépôt no-subscription ou test est déjà activé</strong>, les dépôts sont conservés, quelles que soient les autres sources configurées.",
+      "Avec <strong>aucun abonnement actif et uniquement le dépôt Enterprise</strong>, un dialogue propose le changement. Accepter désactive Enterprise, active no-subscription et actualise les listes de paquets. Le changement est consigné dans la vue <em>Changes</em> d’Audit & Report. Refuser arrête la mise à jour sans modifier les sources.",
+      "Les <strong>sources Ceph Enterprise</strong> présentes sont désactivées lors du même changement, sans choisir un autre canal Ceph. Sur un hôte utilisant Ceph, son canal se configure séparément.",
+      "Si <strong>aucun terminal ne permet de demander confirmation</strong>, aucune source n’est modifiée et la mise à jour s’arrête avec un message renvoyant à <em>Node → Updates → Repositories</em>."
+    ],
+    "outro": "Les sources Debian et tous les autres fichiers de dépôts ne sont jamais modifiés par ce processus. Une entrée mêlant Enterprise à d’autres composants n’est pas changée : la mise à jour s’arrête et demande de séparer cette entrée depuis la vue des dépôts Proxmox."
+  },
+  "cluster": {
+    "heading": "Précautions pour les clusters",
+    "calloutTitle": "Sur les clusters : mettre à jour un noeud à la fois",
+    "calloutBody": "Dans un cluster Proxmox, exécutez cette option sur <strong>un nœud à la fois</strong> et attendez la fin du redémarrage avant de passer au suivant. Migrez d’abord les systèmes invités hors du nœud pour éviter une interruption de service dans le cluster. Des versions mineures différentes, comme 8.4.1 et 8.4.5, peuvent cohabiter pendant quelques heures ; des noyaux en cours différents peuvent entraîner un comportement inattendu pour les systèmes invités gérés par HA."
+  },
+  "doesnt": {
+    "heading": "Ce qu'il ne fait pas",
+    "items": [
+      "<strong>Changement de version majeure.</strong> Le passage 8 → 9 est une opération distincte ; voir <link>Passer de PVE 8 à PVE 9</link>.",
+      "<strong>Sauvegarde.</strong> Aucune capture d’état ni retour arrière. Les opérations apt ne sont pas transactionnelles. Conservez vos sauvegardes habituelles (PBS, vzdump, instantanés ZFS).",
+      "<strong>Mises à jour des conteneurs / VM.</strong> Seul l’hôte est mis à jour ; les systèmes invités restent inchangés.",
+      "<strong>Écriture dédiée de firmware.</strong> Cet outil ne sert pas à flasher le BIOS ou le firmware des appareils. Les paquets de firmware ou de microcode CPU déjà installés peuvent néanmoins être mis à jour par apt."
+    ]
+  },
+  "troubleshooting": {
+    "heading": "Dépannage",
+    "items": [
+      {
+        "title": "apt update échoue avec 401 Unauthorized",
+        "body": "Le dépôt Enterprise est activé sans abonnement actif. Avant <code>apt-get update</code>, le script propose le passage à no-subscription. Si vous avez refusé, relancez la mise à jour et acceptez, ou désactivez Enterprise dans <em>Node → Updates → Repositories</em> et activez no-subscription."
+      },
+      {
+        "title": "dist-upgrade reste bloqué sur \"Configuring grub-pc\"",
+        "body": "Si une question interactive GRUB est visible, elle demande les appareils où installer le chargeur de démarrage. L’option <code>--force-confold</code> concerne les fichiers de configuration, pas ce choix d’appareils. Sélectionnez les disques de démarrage appropriés avec <kbd>Tab</kbd> + <kbd>Space</kbd>, puis OK. Vous pouvez configurer ce choix à l’avance avec <code>dpkg-reconfigure grub-pc</code>."
+      },
+      {
+        "title": "Le noyau a été mis à jour, mais les nouveaux modules d’un pilote externe manquent",
+        "body": "Pour les pilotes gérés (<code>nvidia_driver</code> et <code>coral_driver</code>), la fonction exécute <code>dkms autoinstall -k &lt;newkver&gt;</code> et peut relancer leurs installateurs avec <code>--auto-reinstall</code>. Vérifiez le résultat avec <code>dkms status</code>. La commande autoinstall peut aussi reconstruire d’autres modules DKMS enregistrés ; la relance des installateurs se limite aux entrées gérées de <code>components_status.json</code>. Examinez les modules tiers encore manquants et reconstruisez-les si nécessaire avec <code>dkms autoinstall</code>."
+      },
+      {
+        "title": "L'invite de redémarrage n'est pas apparue mais je suis sûr que le noyau a changé",
+        "body": "Les signaux sont alternatifs : <code>/var/run/reboot-required</code> ou une différence entre le noyau en cours et le dernier noyau Proxmox installé. Le script principal ne recherche pas les entrées linux-image dans le journal apt. Vérifiez la version en cours avec <code>uname -r</code> et les paquets de noyau installés avec <code>dpkg-query</code>. Prévoyez le redémarrage nécessaire ou exécutez <code>shutdown -r now</code> au moment voulu."
+      }
+    ]
+  },
+  "files": {
+    "heading": "Fichiers concernés",
+    "code": "scripts/utilities/proxmox_update.sh              # this script (wrapper)\nscripts/global/update-pve-safe.sh                # single safe worker (PVE 8 + PVE 9)\nscripts/global/repository-functions.sh           # ensure_repositories\nscripts/global/repository_policy.py              # reads and switches repositories through the Proxmox API\nscripts/global/utils-install-functions.sh        # pmx_rebuild_dkms_after_kernel\n/usr/local/share/proxmenux/components_status.json # ProxMenux-managed DKMS driver registry\n/etc/apt/sources.list.d/proxmox.sources          # no-subscription source, written by Proxmox when the switch is accepted\n/var/run/reboot-required                         # read to decide on reboot prompt\n# Reboot fallback when needrestart isn't installed:\n# dpkg-query -W 'proxmox-kernel-*-pve-signed' 'pve-kernel-*-pve' vs. uname -r"
+  },
+  "related": {
+    "heading": "Voir aussi",
+    "items": [
+      {
+        "href": "/docs/utils/upgrade-pve8-pve9",
+        "label": "Mettre à niveau le PVE 8 vers le PVE 9",
+        "tail": "— pour la mise à niveau de la version majeure (outil différent, modèle de sécurité différent)."
+      },
+      {
+        "href": "/docs/utils/system-utils",
+        "label": "Installateur des utilitaires système",
+        "tail": " — pour installer des outils CLI utiles pendant les mises à jour (htop / btop / ncdu)."
+      },
+      {
+        "href": "/docs/utils",
+        "label": "Présentation des utilitaires",
+        "tail": " — retour à la présentation de la section."
+      }
+    ]
+  }
+}
diff --git a/web/messages/fr/docs/utils/system-utils.json b/web/messages/fr/docs/utils/system-utils.json
new file mode 100644
index 00000000..fa6bbe54
--- /dev/null
+++ b/web/messages/fr/docs/utils/system-utils.json
@@ -0,0 +1,252 @@
+{
+  "meta": {
+    "title": "Installateur d’utilitaires système | Documentation ProxMenux",
+    "description": "Installateur d’outils CLI pour Proxmox VE, avec 25 paquets dans la liste de référence (htop, btop, iperf3, tmux, ...). Sélection personnalisée, installation complète et groupes prédéfinis (base, développement, compression, multiplexeurs, analyse, réseau). Les groupes peuvent inclure d’autres paquets. Utilise ensure_repositories + install_single_package.",
+    "ogTitle": "Installateur d’utilitaires système | Documentation ProxMenux",
+    "ogDescription": "Installez une sélection d’outils CLI sur Proxmox VE en un clic ou par sélection personnalisée."
+  },
+  "header": {
+    "title": "Installateur des utilitaires système",
+    "description": "Sélecteur des 25 utilitaires CLI de la liste de référence PROXMENUX_UTILS. Propose une sélection personnalisée, une installation complète, six groupes prédéfinis et une vérification des installations. Les groupes peuvent inclure des outils hors de la liste. Utilise les fonctions communes ensure_repositories() + install_single_package() pour une gestion cohérente des dépôts et des messages par paquet.",
+    "section": "Utilitaires"
+  },
+  "info": {
+    "title": "Ce que ça fait",
+    "body": "Installe des outils CLI depuis une liste de 25 paquets. Chaque installation suit le même processus : <code>ensure_repositories</code> vérifie que l’hôte dispose d’un dépôt Proxmox utilisable pour sa version majeure de PVE, puis <code>install_single_package</code> installe le paquet et vérifie que sa commande est dans PATH."
+  },
+  "opening": {
+    "heading": "Ouverture de l'installateur",
+    "intro": "Dans le menu Utilities, choisissez <strong>System Utilities Installer</strong>. Le menu principal propose neuf options :",
+    "imageAlt": "Menu d’installation des utilitaires système avec sélection personnalisée, ALL, groupes prédéfinis et vérification"
+  },
+  "actions": {
+    "heading": "Les 9 actions du menu",
+    "headerOption": "Option",
+    "headerBehaviour": "Comportement",
+    "rows": [
+      {
+        "option": "1. Sélection personnalisée",
+        "behaviourRich": "Liste de sélection des 25 paquets. Utilisez SPACE pour cocher et ENTER pour confirmer ; seuls les paquets sélectionnés sont installés."
+      },
+      {
+        "option": "2. Installer TOUS les utilitaires",
+        "behaviourRich": "Installe en une fois tous les paquets de <code>PROXMENUX_UTILS</code>. À utiliser après une nouvelle installation Proxmox."
+      },
+      {
+        "option": "3. Niveau de base",
+        "behaviourRich": "<code>grc</code>, <code>htop</code>, <code>tree</code>, <code>curl</code>, <code>wget</code>"
+      },
+      {
+        "option": "4. Développement",
+        "behaviourRich": "<code>git</code>, <code>vim</code>, <code>nano</code>"
+      },
+      {
+        "option": "5. Compression",
+        "behaviourRich": "<code>zip</code>, <code>unzip</code>, <code>rsync</code>"
+      },
+      {
+        "option": "6. Multiplexeurs terminaux",
+        "behaviourRich": "<code>screen</code>, <code>tmux</code>"
+      },
+      {
+        "option": "7. Analyse",
+        "behaviourRich": "<code>jq</code>, <code>ncdu</code>, <code>iotop</code>"
+      },
+      {
+        "option": "8. Réseau",
+        "behaviourRich": "<code>iperf3</code>, <code>nethogs</code>, <code>nmap</code>, <code>tcpdump</code>, <code>lsof</code>"
+      },
+      {
+        "option": "9. Vérifier les installations",
+        "behaviourRich": "Parcourt chaque entrée de <code>PROXMENUX_UTILS</code>, vérifie la présence de la commande dans PATH et affiche un résumé Disponible / Manquant."
+      }
+    ]
+  },
+  "packages": {
+    "heading": "Les 25 paquets",
+    "intro": "Définis dans le fichier commun <code>scripts/global/utils-install-functions.sh</code> sous le nom <code>PROXMENUX_UTILS</code> (format : <code>package:verify_command:description</code>). Les autres scripts ProxMenux, notamment les lanceurs réseau iftop / iptraf-ng / iperf3, réutilisent ces entrées pour garder les paquets et leurs commandes de vérification synchronisés.",
+    "headerPackage": "Paquet",
+    "headerVerify": "Commande de vérification",
+    "headerDescription": "Description",
+    "rows": [
+      {
+        "package": "axel",
+        "verify": "axel",
+        "description": "Accélérateur de téléchargement"
+      },
+      {
+        "package": "aria2",
+        "verify": "aria2c",
+        "description": "Téléchargeur multisource"
+      },
+      {
+        "package": "btop",
+        "verify": "btop",
+        "description": "Outil moderne de suivi des ressources"
+      },
+      {
+        "package": "cabextract",
+        "verify": "cabextract",
+        "description": "Extraire les fichiers CAB"
+      },
+      {
+        "package": "chntpw",
+        "verify": "chntpw",
+        "description": "Modifier le registre Windows / mots de passe"
+      },
+      {
+        "package": "dos2unix",
+        "verify": "dos2unix",
+        "description": "Convertir les fichiers texte DOS / Unix"
+      },
+      {
+        "package": "genisoimage",
+        "verify": "genisoimage",
+        "description": "Créer des images ISO"
+      },
+      {
+        "package": "grc",
+        "verify": "grc",
+        "description": "Coloriseur de journal générique"
+      },
+      {
+        "package": "htop",
+        "verify": "htop",
+        "description": "Affichage interactif des processus"
+      },
+      {
+        "package": "iftop",
+        "verify": "iftop",
+        "description": "Utilisation en temps réel du réseau"
+      },
+      {
+        "package": "intel-gpu-tools",
+        "verify": "intel_gpu_top",
+        "description": "Outils Intel GPU"
+      },
+      {
+        "package": "iotop",
+        "verify": "iotop",
+        "description": "Surveillance des entrées/sorties disque"
+      },
+      {
+        "package": "iperf3",
+        "verify": "iperf3",
+        "description": "Essai de bande passante réseau"
+      },
+      {
+        "package": "ipset",
+        "verify": "ipset",
+        "description": "Gérer les ensembles IP"
+      },
+      {
+        "package": "iptraf-ng",
+        "verify": "iptraf-ng",
+        "description": "Outil de surveillance du réseau"
+      },
+      {
+        "package": "libguestfs-tools",
+        "verify": "virt-filesystems",
+        "description": "Utilitaires de disque VM"
+      },
+      {
+        "package": "msr-tools",
+        "verify": "rdmsr",
+        "description": "Accès aux MSR du CPU"
+      },
+      {
+        "package": "net-tools",
+        "verify": "netstat",
+        "description": "Outils de réseautage hérités"
+      },
+      {
+        "package": "plocate",
+        "verify": "locate",
+        "description": "Localiser les fichiers rapidement"
+      },
+      {
+        "package": "s-tui",
+        "verify": "s-tui",
+        "description": "Stress-Terminal UI"
+      },
+      {
+        "package": "sshpass",
+        "verify": "sshpass",
+        "description": "Connexion SSH non interactive"
+      },
+      {
+        "package": "tmux",
+        "verify": "tmux",
+        "description": "Multiplexeur terminal"
+      },
+      {
+        "package": "unzip",
+        "verify": "unzip",
+        "description": "Extraire les fichiers ZIP"
+      },
+      {
+        "package": "wimtools",
+        "verify": "wimlib-imagex",
+        "description": "Gérer les images WIM"
+      },
+      {
+        "package": "zip",
+        "verify": "zip",
+        "description": "Créer des fichiers ZIP"
+      }
+    ]
+  },
+  "howItWorks": {
+    "heading": "Comment fonctionne l’installation d’un paquet",
+    "items": [
+      "<code>ensure_repositories</code> détecte PVE 8 ou 9 et lit les dépôts via l’API Proxmox. Avec un dépôt Proxmox utilisable, rien ne change. Un hôte sans abonnement actif utilisant uniquement Enterprise doit confirmer le passage à no-subscription ; <code>apt-get update</code> s’exécute après le changement accepté.",
+      "<code>install_single_package \"pkg\" \"verify_cmd\" \"description\"</code> exécute <code>apt-get install -y \"$pkg\"</code> avec rétroaction (<code>msg_info</code> / <code>msg_ok</code> / <code>msg_error</code>)."
+    ],
+    "verifyIntro": "Après l’installation, la commande est vérifiée avec <code>command -v \"$verify_cmd\"</code>. Trois résultats possibles :",
+    "verifyOutcomes": [
+      "<strong>0 (succès):</strong> commande disponible, paquet compté comme <em>Succès</em>.",
+      "<strong>1 (échec):</strong> apt a échoué, compté comme <em> Échec</em>.",
+      "<strong>2 (avertissement) :</strong> apt a réussi, mais la commande attendue n’a pas été trouvée dans PATH ; le paquet est compté comme <em>Avec avertissements</em>."
+    ],
+    "summary": "À la fin d’une installation personnalisée ou par groupe, un dialogue affiche les nombres de paquets <em>Réussis / Avec avertissements / En échec</em>."
+  },
+  "verify": {
+    "heading": "Vérifier les installations",
+    "intro": "L’option 9 est en lecture seule : elle parcourt <code>PROXMENUX_UTILS</code> et exécute <code>command -v</code> pour chaque commande de vérification. Voici la sortie :",
+    "code": "Total: 25\nAvailable: 18\nMissing: 8\n\n✓ axel - Download accelerator\n✓ aria2c - Multi-source downloader\n✓ btop - Modern resource monitor\n✗ cabextract - Extract CAB files\n✓ dos2unix - Convert DOS / Unix text files\n✗ genisoimage - Create ISO images\n✓ grc - Generic log colorizer\n...",
+    "outro": "Utile avant d’exécuter des scripts qui dépendent de ces outils. Par exemple, <code>uup_dump_iso_creator.sh</code> nécessite <code>aria2c</code> + <code>cabextract</code> + <code>wimlib-imagex</code>. S’il manque un outil, installez le groupe correspondant ou sélectionnez les paquets manquants."
+  },
+  "troubleshoot": {
+    "heading": "Dépannage",
+    "reposTitle": "« Impossible de configurer les dépôts. Installation annulée. »",
+    "reposBody": "La vérification des dépôts a échoué : le passage à no-subscription a été refusé, l’état de l’abonnement est illisible ou une entrée nécessite une intervention. Le message précédent indique la cause. Consultez <em>Node → Updates → Repositories</em> et lancez <code>apt-get update</code> dans une console pour voir l’erreur apt.",
+    "warningsTitle": "Un paquet est signalé \"Avec avertissements\" mais la commande fonctionne après que je ferme le menu",
+    "warningsBody": "Après <code>apt-get install</code>, la fonction exécute <code>hash -r</code>, attend brièvement et vérifie la commande attendue avec <code>command -v</code>. Un avertissement signifie que la vérification échoue encore, sans en identifier la cause. Essayez un nouveau shell, puis vérifiez le paquet installé et PATH si la commande manque toujours.",
+    "hangsTitle": "Une installation apt reste bloquée",
+    "hangsBody": "Il est fort probable que l'invite debconf soit bloquée derrière la sortie silencieuse. Le script enveloppe tous les appels apt avec <code>DEBIAN_FRONTEND=noninteractive</code>, ce qui supprime généralement les invites, mais quelques paquets nécessitent toujours une entrée utilisateur. Annuler avec <kbd>Ctrl</kbd>+<kbd>C</kbd>, exécuter <code>apt-get install -y &lt;pkg&gt;</code> manuellement à partir d'un shell pour voir l'invite et décider."
+  },
+  "files": {
+    "heading": "Fichiers concernés",
+    "code": "scripts/utilities/system_utils.sh                    # this script\nscripts/global/utils-install-functions.sh            # PROXMENUX_UTILS, install_single_package\nscripts/global/repository-functions.sh               # ensure_repositories\nscripts/global/repository_policy.py                  # reads and switches repositories through the Proxmox API\n/etc/apt/sources.list.d/proxmox.sources              # no-subscription source, written by Proxmox when the switch is accepted"
+  },
+  "related": {
+    "heading": "Voir aussi",
+    "items": [
+      {
+        "href": "/docs/utils/system-update",
+        "label": "Mise à jour du système Proxmox",
+        "tailRich": "— pour le <code>apt dist-upgrade</code> réel sur l'hôte."
+      },
+      {
+        "href": "/docs/network/monitoring",
+        "label": "Outils de surveillance en direct (réseau)",
+        "tailRich": "— utilise iftop / iptraf-ng / iperf3 de cette même liste."
+      },
+      {
+        "href": "/docs/utils",
+        "label": "Présentation des utilitaires",
+        "tailRich": " — retour à la présentation de la section."
+      }
+    ]
+  }
+}
diff --git a/web/messages/fr/docs/utils/upgrade-pve8-pve9.json b/web/messages/fr/docs/utils/upgrade-pve8-pve9.json
new file mode 100644
index 00000000..4f90f710
--- /dev/null
+++ b/web/messages/fr/docs/utils/upgrade-pve8-pve9.json
@@ -0,0 +1,335 @@
+{
+  "meta": {
+    "title": "Passer de PVE 8 à PVE 9 | Documentation ProxMenux",
+    "description": "Trois méthodes pour passer de Proxmox VE 8 à 9 (Debian Bookworm vers Trixie et PVE 8 vers 9) : automatique, interactive ou manuelle, selon la procédure officielle Proxmox. Contrôle pve8to9, migration des dépôts, dist-upgrade et vérification finale. Refuse de démarrer depuis le terminal web.",
+    "ogTitle": "Passer de PVE 8 à PVE 9 | Documentation ProxMenux",
+    "ogDescription": "Trois méthodes (automatique, interactive, manuelle) pour passer de Proxmox VE 8 à 9."
+  },
+  "header": {
+    "title": "Mettre à niveau le PVE 8 vers le PVE 9",
+    "description": "Effectue le passage de Proxmox VE 8 à 9 selon la procédure officielle : Debian Bookworm vers Trixie et PVE 8 vers 9. Trois méthodes sont disponibles, ainsi qu’un contrôle préalable indépendant. Le terminal web est refusé, car une déconnexion pendant l’opération peut laisser l’hôte inutilisable.",
+    "section": "Utilitaires"
+  },
+  "dangerCallout": {
+    "title": "Un changement de version majeure est irréversible",
+    "intro": "Cette opération remplace sur place la base Debian (Bookworm → Trixie) et les composants Proxmox. Il n’existe <strong>aucune procédure de retour en arrière</strong>. Avant de commencer :",
+    "items": [
+      "<strong>Sauvegardes vérifiées</strong> de chaque VM et CT (PBS, vzdump, instantanés ZFS — vérifiez aussi leur restauration).",
+      "<strong>Accès console / IPMI / iKVM</strong> à l’hôte en cas de coupure SSH pendant la mise à niveau.",
+      "L'hôte déjà mis à jour sur PVE 8.4.x (le script l'applique).",
+      "Ceph (le cas échéant) sur la version 19.x Squid.",
+      "Au moins <strong>5 Go libres</strong> sur le système de fichiers racine."
+    ]
+  },
+  "modeMenu": {
+    "heading": "Le menu mode",
+    "intro": "L’option ouvre un menu à quatre entrées : Automatique, Interactif, Contrôle préalable et Guide manuel. Trois choix <em>effectuent</em> la mise à niveau ou expliquent comment procéder ; le contrôle indépendant <em>vérifie</em> les prérequis et peut proposer des réparations.",
+    "imageAlt": "Menu de passage de PVE 8 à 9 : Automatique, Interactif, Contrôle préalable et Guide manuel"
+  },
+  "threeWays": {
+    "heading": "Trois façons de mettre à niveau",
+    "intro": "Les modes Automatique et Interactif suivent le même déroulement, avec contrôles préalables et vérification finale. Ils diffèrent dans les réponses aux questions de dpkg pendant <code>dist-upgrade</code>. Le guide manuel affiche les commandes et les contrôles ; vous devez exécuter chaque étape.",
+    "auto": {
+      "title": "Automatique / Sans surveillance",
+      "summary": "Définit <code>ASSUME_YES=1</code> + <code>DEBIAN_FRONTEND=noninteractive</code>. Pour les fichiers de configuration modifiés, dpkg utilise son action par défaut si elle existe ; sinon, il <strong>conserve le fichier actuel</strong> (<code>--force-confold</code>).",
+      "items": [
+        "Le plus rapide — aucune question dpkg pendant la mise à niveau",
+        "Adapté aux installations standard sans fichiers de configuration personnalisés",
+        "Risque : une configuration personnalisée est conservée sans question et peut masquer les nouvelles valeurs par défaut"
+      ]
+    },
+    "interactive": {
+      "title": "Interactif",
+      "summary": "Même déroulement, mais vous répondez à chaque question de dpkg sur les conflits de configuration. Plus lent, avec une visibilité maximale.",
+      "items": [
+        "Vous voyez chaque conflit de config et décidez",
+        "Meilleure quand vous avez personnalisé <code>/etc/lvm</code>, <code>/etc/ssh</code>, etc.",
+        "Consulter le tableau des réponses recommandées dans la procédure manuelle ci-dessous"
+      ]
+    },
+    "manual": {
+      "title": "Guide de mise à jour manuelle",
+      "summary": "Affiche la procédure en 17 étapes conforme au wiki officiel Proxmox, sans l’exécuter. Lancez vous-même les commandes dans un autre shell.",
+      "items": [
+        "Contrôle maximal — vous tapez chaque commande",
+        "Mieux quand vous voulez apprendre la procédure ou vous ne faites confiance à rien",
+        "Le script affiche les étapes; rien n'est exécuté automatiquement"
+      ]
+    }
+  },
+  "precheckCallout": {
+    "title": "Plus une vérification préalable séparée",
+    "body": "L’option 3 — <strong>Exécuter le contrôle PVE 8 vers 9</strong> — lance l’outil officiel <code>pve8to9 --full</code>, propose des réparations guidées pour les problèmes courants, puis <strong>s’arrête</strong>. Utilisez-la avant la mise à niveau ou après des réparations manuelles. Les modes Automatique et Interactif la lancent aussi ; le guide manuel vous indique de l’exécuter."
+  },
+  "webTerminal": {
+    "heading": "Pourquoi le terminal web est bloqué",
+    "body": "Les trois modes détectent <code>termproxy</code> / <code>vncshell</code> dans la chaîne des processus parents et refusent de démarrer. Le terminal web dépend de <code>pveproxy</code>, un service mis à jour pendant l’opération. Au redémarrage de <code>pveproxy</code>, la session se ferme, ainsi que le script lancé dedans. L’hôte peut rester partiellement mis à niveau.",
+    "warningTitle": "Utilisez SSH ou une console physique / IPMI / iKVM",
+    "warningBody": "SSH est le choix habituel. Lancez-le dans <code>tmux</code> ou <code>screen</code> pour résister aux brèves coupures réseau. Si le script détecte un simple shell SSH, il affiche d’abord un rappel concernant tmux/screen."
+  },
+  "auto": {
+    "heading": "Mode automatique / sans surveillance",
+    "intro": "Les questions sur les paquets et les fichiers de configuration utilisent les valeurs par défaut du tableau ci-dessous, et un 401 du dépôt Enterprise bascule vers no-subscription sans demander. La confirmation de la mise à niveau, le résumé de la mise à jour PVE 8, les réparations du contrôle préalable et la demande de redémarrage restent affichés.",
+    "behaviourHeading": "Comportement propre au mode automatique",
+    "behaviourTable": {
+      "settingHeader": "Réglage",
+      "effectHeader": "Effet",
+      "rows": [
+        {
+          "settingRich": "<code>ASSUME_YES=1</code>",
+          "effectRich": "Option interne — le script répond oui à ses propres questions, comme le passage à no-subscription après un 401"
+        },
+        {
+          "settingRich": "<code>DEBIAN_FRONTEND=noninteractive</code>",
+          "effectRich": "apt / dpkg s’exécutent sans ouvrir de question debconf"
+        },
+        {
+          "settingRich": "<code>--force-confdef</code>",
+          "effectRich": "Pour les fichiers de configuration intacts: installez la nouvelle version du responsable"
+        },
+        {
+          "settingRich": "<code>--force-confold</code>",
+          "effectRich": "Pour les fichiers modifiés : action par défaut de dpkg si elle existe ; sinon, <strong>conservation de votre version</strong>."
+        }
+      ]
+    },
+    "flowHeading": "Déroulement du mode automatique",
+    "flowIntro": "Six phases successives. La phase 2 met à jour les paquets PVE 8 et la phase 3 écrit la configuration des dépôts PVE 9. Un échec arrête le déroulement sans annuler ces modifications ; si la mise à jour PVE 8 échoue ou est annulée, les dépôts restent inchangés. La phase 5 lance <code>dist-upgrade</code> vers PVE 9.",
+    "flowDiagram": "1. CONTRÔLES\nBloque termproxy / vncshell ; confirme la mise à niveau ; refuse PVE 9.\n\n2. PRÉPARER PVE 8\nscripts/global/update-pve8.sh\nMet à jour les paquets PVE 8 ; arrêt si la mise à jour échoue ou est annulée.\npve8to9 --full (peut proposer des réparations).\nVérifie espace et connectivité ; Ceph 19.x Squid sur les nœuds hyperconvergés.\n\n3. MIGRER LES DÉPÔTS\nBookworm → Trixie ; écrit les fichiers deb822 .sources.\nCommente les anciens fichiers .list ; apt-get update.\n\n4. VALIDER LE CANDIDAT PVE 9\napt-cache policy proxmox-ve\napt-get -s dist-upgrade\nArrêt si le candidat n’est pas 9.x ou si proxmox-ve serait supprimé.\n\n5. METTRE À NIVEAU\napt-get -y -o Dpkg::Options::='--force-confdef' -o Dpkg::Options::='--force-confold' dist-upgrade\nSans abonnement : désactive pve-enterprise.sources.\nJournal : /var/log/pve8-a-pve9-'<'timestamp'>'.log\n\n6. VÉRIFIER ET REDÉMARRER\nEFI : apt install grub-efi-amd64\npve8to9 --full ; examiner le résultat et la demande de redémarrage.",
+    "preflightHeading": "Contrôles avant la mise à niveau",
+    "preflightTable": {
+      "checkHeader": "Vérifier",
+      "whyHeader": "Pourquoi ça compte ?",
+      "rows": [
+        {
+          "checkRich": "<strong>Blocage du terminal web</strong>",
+          "whyRich": "Empêche la mise à niveau de fermer le shell qui l’exécute"
+        },
+        {
+          "checkRich": "<strong>Déjà sur 9.x</strong>",
+          "whyRich": "Avorte si l'hôte exécute déjà PVE 9 (rien à faire)"
+        },
+        {
+          "checkRich": "<strong>Dernière version de PVE 8.4.x</strong>",
+          "whyRich": "Met d’abord PVE 8 à jour avec son script dédié ; les anciennes versions 8.x ont des prérequis différents"
+        },
+        {
+          "checkRich": "<strong>pve8to9 --full</strong>",
+          "whyRich": "Contrôle des prérequis fourni par Proxmox ; les erreurs FAIL bloquent la mise à niveau jusqu’à leur correction"
+        },
+        {
+          "checkRich": "<strong>Espace disque</strong>",
+          "whyRich": "≥ 1024 Mo libres dans <code>/var/cache/apt/archives</code> pour les fichiers .deb téléchargés"
+        },
+        {
+          "checkRich": "<strong>Connectivité</strong>",
+          "whyRich": "Ping vers <code>download.proxmox.com</code> — en cas d’échec, l’opération ne démarre pas"
+        },
+        {
+          "checkRich": "<strong>Ceph 19.x Squid</strong>",
+          "whyRich": "Si Ceph est installé, il doit déjà être en 19.x. PVE 9 ne fonctionne pas avec Ceph 17/18. Les options <code>--ignore-ceph-check</code> et <code>--warn-ceph-check</code> contournent le contrôle ; utilisez-les seulement en connaissance de cause."
+        }
+      ]
+    },
+    "distUpgradeHeading": "La commande dist-upgrade (mode automatique)",
+    "distUpgradeCode": "apt-get -y \\\n    -o Dpkg::Options::='--force-confdef' \\\n    -o Dpkg::Options::='--force-confold' \\\n    dist-upgrade",
+    "distUpgradeOutro": "La sortie apparaît en temps réel sur stdout et est aussi enregistrée dans <code>/var/log/pve8-a-pve9-&lt;timestamp&gt;.log</code>. Tout reste visible ; seules les questions sont supprimées.",
+    "postHeading": "Tâches après mise à niveau (mode automatique)",
+    "postItems": [
+      "<strong>Hôtes EFI :</strong> installe <code>grub-efi-amd64</code>, conformément au problème connu décrit par Proxmox. La mise à niveau ne l’installe pas automatiquement et il peut être nécessaire au prochain démarrage.",
+      "<strong>Dépôt Enterprise sans abonnement.</strong> pve-manager 9 ajoute <code>pve-enterprise.sources</code> pendant la mise à niveau ; en mode no-subscription, le script le règle sur <code>Enabled: false</code>.",
+      "<strong>Relance <code>pve8to9 --full</code>.</strong> Signale les problèmes restants. Des erreurs FAIL affichent le même menu de réparation que le contrôle préalable.",
+      "<strong>Demande de redémarrage.</strong> Il est recommandé de redémarrer pour charger le nouveau noyau et les services. Ne refusez que pour une raison précise : garder l’ancien noyau après un changement de version majeure présente un risque."
+    ]
+  },
+  "interactive": {
+    "heading": "Mode interactif",
+    "intro": "Même déroulement que le <autolink>mode automatique</autolink> : mêmes contrôles, migration des dépôts et vérification finale. La différence concerne <code>dist-upgrade</code> : <strong>vous répondez vous-même à chaque conflit de configuration signalé par dpkg</strong>. ProxMenux lance <code>apt-get dist-upgrade</code> sans les options <code>--force-conf*</code>.",
+    "distUpgradeHeading": "La commande dist-upgrade (mode interactif)",
+    "distUpgradeCode": "apt-get dist-upgrade\n# (user answers each dpkg config-file conflict prompt as it appears)",
+    "whenHeading": "Quand interactif est le bon choix",
+    "whenItems": [
+      "Vous avez personnalisé <code>/etc/lvm/lvm.conf</code>, <code>/etc/ssh/sshd_config</code>, <code>/etc/default/grub</code> ou tout autre fichier de configuration qui est touché par la mise à jour.",
+      "Vous souhaitez voir les paquets responsables des conflits et décider pour chaque fichier.",
+      "Vous mettez à niveau un hôte de production où tout changement caché est inacceptable."
+    ],
+    "promptCalloutTitle": "Que répondre à chaque fois",
+    "promptCalloutBody": "Les mêmes recommandations que pour la procédure manuelle s’appliquent : voir <dpkglink>Réponses recommandées aux questions de dpkg</dpkglink> ci-dessous. Saisissez <strong>D</strong> pour examiner les différences, ou <strong>Z</strong> pour ouvrir un shell."
+  },
+  "manual": {
+    "heading": "Procédure de mise à niveau manuelle",
+    "intro": "Voici ce qu’affiche l’option <strong>Guide de mise à niveau manuelle</strong> : le <wikilink>wiki officiel Proxmox de passage de 8 à 9</wikilink>, organisé en quatre phases. Le script <em>affiche</em> les commandes ; vous les exécutez dans un autre shell root. Chaque étape reste visible.",
+    "rootCalloutTitle": "Toutes les commandes ont besoin de root",
+    "rootCalloutBody": "Utilisez un shell root pour ces commandes, y compris les redirections et les documents here-document. Avec <code>sudo</code>, assurez-vous que la commande entière bénéficie des privilèges root.",
+    "phase1Heading": "Phase 1 — Préparation",
+    "phase1Intro": "Mettez l’hôte à jour vers la dernière PVE 8.4.x, vérifiez la version et Ceph si utilisé, lancez le contrôle Proxmox, puis un multiplexeur de terminal pour résister aux déconnexions.",
+    "phase1Code": "# Step 1 — Update PVE 8 to the latest 8.4+\napt update && apt dist-upgrade -y\n\n# Step 2 — Verify version (must be 8.4.1 or newer)\npveversion\n\n# Step 2.1 — Hyper-converged Ceph: must already be on 19.x Squid\nceph --version\n# If older, follow https://pve.proxmox.com/wiki/Ceph_Reef_to_Squid\n\n# Step 3 — Run the official upgrade-readiness check\npve8to9 --full\n# If it warns about systemd-boot meta-package, remove it:\n#   apt remove systemd-boot\n\n# Step 4 — Start tmux or screen (so SSH disconnect doesn't kill the upgrade)\ntmux new-session -s upgrade\n# or\nscreen -S upgrade",
+    "phase2Heading": "Phase 2 — Migration des dépôts",
+    "phase2Intro": "Remplacez Bookworm par Trixie dans tous les dépôts Debian et Proxmox, puis convertissez les sources Proxmox au format deb822. <strong>Choisissez l’étape 7 OU 8</strong> selon votre abonnement Enterprise. Ignorez l’étape 9 sans Ceph.",
+    "phase2Code": "# Step 5 — Debian: bookworm → trixie\nsed -i 's/bookworm/trixie/g' /etc/apt/sources.list\n\n# Step 6 — Same for the legacy enterprise list (only if you use enterprise)\nsed -i 's/bookworm/trixie/g' /etc/apt/sources.list.d/pve-enterprise.list\n\n# Step 7 — Add the new PVE 9 enterprise repo (deb822) — Enterprise users only\ncat > /etc/apt/sources.list.d/pve-enterprise.sources << EOF\nTypes: deb\nURIs: https://enterprise.proxmox.com/debian/pve\nSuites: trixie\nComponents: pve-enterprise\nSigned-By: /usr/share/keyrings/proxmox-archive-keyring.gpg\nEOF\n\n# Step 8 — OR add the no-subscription repo (most home / lab users)\ncat > /etc/apt/sources.list.d/proxmox.sources << EOF\nTypes: deb\nURIs: http://download.proxmox.com/debian/pve\nSuites: trixie\nComponents: pve-no-subscription\nSigned-By: /usr/share/keyrings/proxmox-archive-keyring.gpg\nEOF\n\n# Step 8.1 — Refresh and verify proxmox-ve candidate is 9.x\napt update && apt policy | sed -n '1,120p'\n\n# Step 9 — Update Ceph repo (only if you run Ceph)\ncat > /etc/apt/sources.list.d/ceph.sources << EOF\nTypes: deb\nURIs: http://download.proxmox.com/debian/ceph-squid\nSuites: trixie\nComponents: no-subscription\nSigned-By: /usr/share/keyrings/proxmox-archive-keyring.gpg\nEOF\n\n# Step 10 — Remove old .list files now superseded by deb822 .sources\nrm -f /etc/apt/sources.list.d/pve-enterprise.list /etc/apt/sources.list.d/ceph.list\n\n# Step 11 — Final apt update\napt update",
+    "phase3Heading": "Phase 3 — Le dist-upgrade",
+    "phase3Intro": "La mise à niveau elle-même. L’étape 12, facultative mais recommandée, réduit les messages d’audit. L’étape 13 est longue : répondez aux questions de dpkg avec le tableau ci-dessous. L’étape 13.1 concerne uniquement EFI et suit les problèmes connus officiels.",
+    "phase3Code": "# Step 12 — Disable kernel audit messages (optional)\nsystemctl disable --now systemd-journald-audit.socket\n\n# Step 13 — The main upgrade (this takes a while)\napt dist-upgrade\n# (answer prompts using the table below)\n\n# Step 13.1 — EFI hosts: install grub for EFI (per known issues)\n[ -d /sys/firmware/efi ] && apt install grub-efi-amd64",
+    "dpkgHeading": "Réponses recommandées pour les invites dpkg",
+    "dpkgIntro": "Réponses préconisées par Proxmox : <strong>Y</strong> installe le nouveau fichier du responsable du paquet et remplace le vôtre ; <strong>N</strong> conserve votre fichier. En cas de doute, examinez d’abord les différences :",
+    "dpkgTable": {
+      "fileHeader": "Fichier / invite",
+      "answerHeader": "Réponse recommandée",
+      "whyHeader": "Pourquoi",
+      "rows": [
+        {
+          "fileRich": "/etc/issue",
+          "answerRich": "<strong>N</strong> (conserver le fichier actuel)",
+          "whyRich": "Bannière que vous voyez habituellement",
+          "fileFont": true
+        },
+        {
+          "fileRich": "/etc/lvm/lvm.conf",
+          "answerRich": "<strong>Y</strong> (version du responsable du paquet)",
+          "whyRich": "PVE 9 a besoin des nouvelles valeurs LVM par défaut",
+          "fileFont": true
+        },
+        {
+          "fileRich": "/etc/ssh/sshd_config",
+          "answerRich": "<strong>Y</strong> pour les seuls changements par défaut ; examinez les fichiers personnalisés",
+          "whyRich": "Vérifiez les réglages SSH locaux et préservez l’accès avant de remplacer le fichier. Les changements par défaut incluent des options renommées et des commentaires.",
+          "fileFont": true
+        },
+        {
+          "fileRich": "/etc/default/grub",
+          "answerRich": "<strong>N</strong> si personnalisé",
+          "whyRich": "Contient les paramètres de démarrage, notamment IOMMU et le passthrough PCI",
+          "fileFont": true
+        },
+        {
+          "fileRich": "/etc/chrony/chrony.conf",
+          "answerRich": "<strong>Y</strong> si non modifié ; préservez d’abord vos réglages locaux",
+          "whyRich": "Trixie actualise les réglages de synchronisation horaire. Déplacez les réglages locaux dans conf.d / sources.d de chrony avant d’accepter le nouveau fichier.",
+          "fileFont": true
+        },
+        {
+          "fileRich": "Redémarrages de services pendant la mise à niveau",
+          "answerRich": "<strong>Oui</strong> (par défaut)",
+          "whyRich": "Relance la plupart des services sans redémarrer l’hôte",
+          "fileFont": false
+        },
+        {
+          "fileRich": "<code>apt-listchanges</code>",
+          "answerRich": "Appuyez sur <kbd>q</kbd>",
+          "whyRich": "Quitte uniquement le pager ; les informations affichées résument le journal des modifications",
+          "fileFont": false
+        }
+      ]
+    },
+    "inspectCalloutTitle": "Inspection d'un conflit dpkg spécifique",
+    "inspectCalloutBody": "À une question de dpkg sur un fichier de configuration, saisissez <strong>D</strong> pour comparer les versions ou <strong>Z</strong> pour ouvrir un shell et examiner le problème. Cela permet de décider plutôt que de deviner.",
+    "phase4Heading": "Phase 4 — après la mise à niveau",
+    "phase4Intro": "Vérifiez la réussite de la mise à niveau, redémarrez sur le noyau PVE 9 et confirmez la version. Vous pouvez ensuite convertir les anciens fichiers <code>.list</code> restants au format deb822.",
+    "phase4Code": "# Step 14 — Re-run the readiness check (should be much cleaner now)\npve8to9 --full\n\n# Step 15 — Reboot to load the new kernel and PVE 9 daemons\nreboot\n\n# Step 16 — After reboot, confirm PVE 9.x\npveversion\n# Should show pve-manager/9.x.x\n\n# Step 17 — Optional: modernise the remaining legacy .list files to deb822\napt modernize-sources\n# (keeps .list backups as .bak)"
+  },
+  "clusterCeph": {
+    "heading": "Cluster & Ceph",
+    "clusterCalloutTitle": "Cluster: mise à niveau des nœuds un à la fois",
+    "clusterCalloutBody": "Détecté par <code>pvecm status</code>. <strong>Ne mettez pas</strong> plusieurs nœuds à niveau simultanément. Déplacez les invités, mettez le nœud à niveau, redémarrez et vérifiez son appartenance au cluster avant de continuer. Pendant l’opération, la migration à chaud d’une ancienne version de PVE vers une plus récente fonctionne ; le sens inverse n’est généralement pas pris en charge. Les groupes HA deviennent automatiquement des règles HA lorsque tous les nœuds utilisent PVE 9.",
+    "cephCalloutTitle": "Ceph : mettre Ceph à niveau D’ABORD, puis Proxmox",
+    "cephCalloutBody": "Ceph doit déjà utiliser 19.x Squid avant la mise à niveau Proxmox. Suivez l’ordre officiel Quincy 17 → Reef 18 → Squid 19, avec mise à jour des paquets et redémarrages échelonnés des démons Ceph dans l’ordre documenté. Vérifiez <code>ceph --version</code> avant chaque nœud Proxmox. Procédure complète : <cephlink>wiki de passage de Ceph Reef à Squid</cephlink>."
+  },
+  "troubleshooting": {
+    "heading": "Dépannage",
+    "items": [
+      {
+        "title": "Le script s’arrête : \"This script cannot be executed from the Proxmox web terminal\"",
+        "bodyRich": "Utilisez une connexion SSH ou une console / IPMI / iKVM, puis relancez le script. Lancez d’abord <code>tmux new -s pveupgrade</code> pour résister aux courtes coupures réseau."
+      },
+      {
+        "title": "pve8to9 signale FAIL et l’option 1 de réparation produit \"command not found\"",
+        "bodyRich": "Si l’erreur mentionne <code>configure_repositories</code>, la copie du script est ancienne : la réparation actuelle utilise cleanup_duplicate_repos et ensure_repositories. Actualisez-la ou examinez les commandes manuelles avec l’option 2. <code>apt-get update</code> actualise les listes de paquets sans résoudre tous les contrôles bloquants."
+      },
+      {
+        "title": "La simulation apt signale \"proxmox-ve will be REMOVED\"",
+        "bodyRich": "Les nouveaux dépôts sont inaccessibles ou le nom de version n’a pas changé. Vérifiez <code>cat /etc/apt/sources.list.d/proxmox.sources</code> : la ligne <code>Suites:</code> doit contenir <code>trixie</code>, et non <code>bookworm</code>. <code>apt-cache policy proxmox-ve</code> doit proposer une version 9.x du nouveau dépôt."
+      },
+      {
+        "title": "dist-upgrade échoue en cours d’exécution",
+        "bodyRich": "Exécutez <code>apt-get -f install</code> pour résoudre les dépendances cassées, puis réexécutez la mise à jour. Si cela échoue, vérifiez le journal à <code>/var/log/pve8-a-pve9-&lt;timestamp&gt;.log</code> — les dernières lignes indiquent habituellement le paquet offensif. Ne redémarrez pas avant que <code>dpkg -l | grep ^iU</code> ne retourne vide (pas de paquets semi-installés)."
+      },
+      {
+        "title": "L'hôte EFI ne démarre pas après le redémarrage",
+        "bodyRich": "L’installation de <code>grub-efi-amd64</code> après la mise à niveau traite ce problème. Si elle a été omise ou a échoué, démarrez sur l’ISO Proxmox en mode secours, montez la racine, utilisez chroot et lancez <code>apt-get install grub-efi-amd64 &amp;&amp; update-grub</code>."
+      },
+      {
+        "title": "GUI ne se charge pas après la mise à niveau",
+        "bodyRich": "Exécutez <code>systemctl status pveproxy</code> et <code>systemctl restart pveproxy</code>. Si le problème persiste, cherchez l’erreur dans <code>journalctl -u pveproxy -b</code>."
+      },
+      {
+        "title": "Le réseau ne fonctionne pas après le redémarrage",
+        "bodyRich": "Vérifiez que <code>/etc/network/interfaces</code> référence des périphériques existants et que <code>ifupdown2</code> est installé : <code>apt install ifupdown2</code>. Si les noms ont changé, voir <netlink>Noms d’interfaces persistants</netlink>."
+      },
+      {
+        "title": "Split-brain du cluster après la mise à niveau d’un nœud",
+        "bodyRich": "Les clusters mixtes PVE 8 / PVE 9 sont pris en charge pendant la mise à niveau. La migration à chaud d’une ancienne version vers une plus récente fonctionne ; le sens inverse n’est généralement pas pris en charge. Si un nœud apparaît hors ligne, vérifiez <code>corosync</code> et la configuration QDevice / réseau. Exécutez <code>pvecm status</code> sur chaque nœud pour confirmer le quorum."
+      }
+    ]
+  },
+  "files": {
+    "heading": "Fichiers concernés",
+    "code": "scripts/utilities/upgrade_pve8_to_pve9.sh                         # main upgrade orchestrator\nscripts/utilities/pve8to9_check.sh                                # pre-check (separate menu option)\nscripts/utilities/proxmox-upgrade-pve8-to-pve9-manual-guide.sh    # 17-step runbook\nscripts/global/update-pve8.sh                                     # PVE 8 worker (final patches)\n/etc/apt/sources.list                                             # bookworm → trixie sed\n/etc/apt/sources.list.d/proxmox.sources                           # created (deb822 PVE 9)\n/etc/apt/sources.list.d/debian.sources                            # created (deb822 trixie)\n/etc/apt/sources.list.d/ceph.sources                              # created if Ceph\n/etc/apt/sources.list.d/*.list                                    # legacy files commented out / removed\n/var/log/pve8-a-pve9-'<'timestamp'>'.log                              # full upgrade log"
+  },
+  "references": {
+    "heading": "Références officielles",
+    "intro": "La procédure manuelle du script suit ces sources officielles. En cas de doute pendant une mise à niveau, suivez le wiki officiel : ProxMenux facilite l’exécution, Proxmox fait référence.",
+    "items": [
+      {
+        "href": "https://pve.proxmox.com/wiki/Upgrade_from_8_to_9",
+        "title": "Mise à niveau de 8 à 9",
+        "desc": "La page wiki Proxmox principale pour la mise à jour 8 → 9. Source de vérité pour chaque commande dans la procédure manuelle ci-dessus."
+      },
+      {
+        "href": "https://pve.proxmox.com/wiki/Ceph_Reef_to_Squid",
+        "title": "Mise à niveau vers Ceph Squid (19.x)",
+        "desc": "Étape préalable obligatoire pour les nœuds Ceph hyperconvergés. Ceph doit être en 19.x Squid avant PVE 9."
+      },
+      {
+        "href": "https://pve.proxmox.com/wiki/Roadmap",
+        "title": "Feuille de route Proxmox VE",
+        "desc": "Notes de version PVE 9 et changements depuis 8.x : à lire avant la mise à niveau."
+      },
+      {
+        "href": "https://www.debian.org/releases/trixie/releasenotes",
+        "title": "Notes de publication de Debian Trixie",
+        "desc": "PVE 9 repose sur Debian Trixie. Consultez les notes Debian pour les changements du système d’exploitation qui concernent aussi votre hôte."
+      },
+      {
+        "href": "https://forum.proxmox.com/forums/proxmox-ve-installation-and-configuration.16/",
+        "title": "Forum d'installation Proxmox VE",
+        "desc": "En cas de problème pendant la mise à niveau, cherchez d’abord dans ce forum : le même cas a peut-être déjà été rencontré."
+      },
+      {
+        "href": "https://pve.proxmox.com/wiki/Backup_and_Restore",
+        "title": "Sauvegarde et restauration",
+        "desc": "Une mise à jour en version majeure n'est pas réversible. Vérifiez votre discipline de sauvegarde avant de commencer."
+      }
+    ]
+  },
+  "video": {
+    "heading": "Visite vidéo",
+    "intro": "Vous préférez regarder la mise à jour de bout en bout avant de le faire vous-même ? Ce parcours démontre le flux de mise à niveau ProxMenux en temps réel.",
+    "title": "ProxMenux — Mise à niveau de Proxmox VE 8 à 9",
+    "caption": "Vidéo externe YouTube. Lecture en mode de confidentialité avancée ; aucun cookie avant de lancer la lecture."
+  },
+  "related": {
+    "heading": "Voir aussi",
+    "items": [
+      {
+        "href": "/docs/utils/system-update",
+        "label": "Mise à jour du système Proxmox",
+        "tail": " — pour les mises à jour ordinaires au sein d’une même version majeure (8.4.1 → 8.4.5, etc.)."
+      },
+      {
+        "href": "/docs/utils",
+        "label": "Présentation des utilitaires",
+        "tail": " — retour à la présentation de la section."
+      }
+    ]
+  }
+}
diff --git a/web/messages/fr/docs/utils/uup-dump-iso-creator.json b/web/messages/fr/docs/utils/uup-dump-iso-creator.json
new file mode 100644
index 00000000..ad302029
--- /dev/null
+++ b/web/messages/fr/docs/utils/uup-dump-iso-creator.json
@@ -0,0 +1,161 @@
+{
+  "meta": {
+    "title": "Créateur d’ISO UUP Dump | Documentation ProxMenux",
+    "description": "Créez une ISO d’installation de Windows à jour sur l’hôte Proxmox avec le créateur d’ISO UUP Dump de ProxMenux. Il automatise l’installation des dépendances, le téléchargement et la conversion des fichiers UUP en ISO amorçable pour créer une VM.",
+    "ogTitle": "Créateur d’ISO UUP Dump | Documentation ProxMenux",
+    "ogDescription": "Créez une ISO Windows à jour avec UUP Dump et ProxMenux. Dépendances, téléchargement et conversion entièrement automatisés.",
+    "ogImageAlt": "ProxMenux — Créateur d’ISO UUP Dump"
+  },
+  "header": {
+    "title": "Créateur d’ISO UUP Dump",
+    "description": "Créez une ISO d’installation de Windows à jour sur l’hôte Proxmox avec UUP Dump. ProxMenux gère les dépendances, télécharge les fichiers UUP en parallèle, exécute le convertisseur UUP Dump et déplace l’ISO vers le répertoire de sortie choisi. Par défaut, il s’agit du stockage ISO Proxmox détecté.",
+    "section": "Utilitaires"
+  },
+  "intro": {
+    "title": "Ce que ce script fait",
+    "body": "Fournissez l’URL générée par uupdump.net après le choix de la version, de la langue et de l’édition. Le script installe les dépendances manquantes, télécharge le convertisseur UUP Dump et les fichiers UUP, crée une ISO Windows amorçable et la déplace vers le répertoire de sortie choisi. Le stockage ISO Proxmox détecté est proposé par défaut."
+  },
+  "hero": {
+    "imageAlt": "UUP Dump ISO Creator entrée dans ProxMenux",
+    "caption": "UUP Dump ISO Creator entrée dans ProxMenux"
+  },
+  "what": {
+    "heading": "Qu'est-ce que UUP Dump?",
+    "intro": "UUP Dump est un service communautaire qui permet de télécharger les fichiers bruts de la plateforme Unified Update Platform (UUP), utilisés par Windows Update pour distribuer Windows. Ces fichiers peuvent être assemblés en une ISO amorçable standard. Vous pouvez ainsi obtenir :",
+    "items": [
+      "La toute dernière version de Windows (y compris les canaux Insider Preview).",
+      "Une version précise plus ancienne qui n’apparaît plus sur la page de téléchargement Microsoft.",
+      "Des fichiers intacts et non modifiés, provenant directement des serveurs Microsoft.",
+      "La combinaison exacte d'éditions et de langues que vous voulez en une seule ISO."
+    ],
+    "learnMore": "En savoir plus sur la page de projet <extlink>UUP Dump</extlink>."
+  },
+  "automates": {
+    "heading": "Ce que le script automatise"
+  },
+  "dependencies": {
+    "heading": "Dépendances",
+    "intro": "La première chose que le script fait est de vérifier les outils nécessaires pour télécharger les charges utiles UUP et assembler l'ISO. Tous ceux qui manquent sont installés avec <code>apt-get</code>:",
+    "headerPackage": "Paquet",
+    "headerRole": "Rôle",
+    "rows": [
+      {
+        "pkg": "curl",
+        "roleRich": "Téléchargements HTTP pour initialiser le convertisseur."
+      },
+      {
+        "pkg": "aria2",
+        "roleRich": "Téléchargeur parallèle utilisé pour chaque charge utile UUP."
+      },
+      {
+        "pkg": "cabextract",
+        "roleRich": "Extrait les paquets Microsoft CAB."
+      },
+      {
+        "pkg": "wimtools",
+        "roleRich": "Construit <code>install.wim</code> (wimlib-imagex)."
+      },
+      {
+        "pkg": "genisoimage",
+        "roleRich": "Écrit l’ISO amorçable finale (ou <code>mkisofs</code>)."
+      },
+      {
+        "pkg": "chntpw",
+        "roleRich": "Modifie les ruches du registre Windows pendant la création."
+      }
+    ],
+    "manualIntro": "Équivalent manuel — si vous avez besoin de les installer vous-même:",
+    "manualCode": "apt-get install curl aria2 cabextract wimtools genisoimage chntpw"
+  },
+  "flow": {
+    "heading": "Téléchargement et conversion",
+    "steps": [
+      "Détecte le stockage ISO Proxmox via <code>pvesm status -content iso</code>, ou utilise <code>/var/lib/vz/template/iso</code> en repli.",
+      "Demande un dossier de base pour les fichiers temporaires (<code>/root/uup-temp</code> par défaut).",
+      "Téléchargez le convertisseur UUP Dump de <code>git.uupdump.net</code>.",
+      "Extrait <code>id</code>, <code>pack</code> et <code>edition</code> de l’URL collée.",
+      "Appelle <code>https://uupdump.net/get.php?…&aria2=2</code> pour générer une liste de téléchargement aria2.",
+      "Télécharge tous les fichiers UUP dans <code>UUPs/</code> avec aria2, en parallèle et avec reprise possible.",
+      "Exécute <code>convert.sh wim UUPs 1</code> à partir du convertisseur pour produire l'ISO finale.",
+      "Déplace l’ISO vers le répertoire de sortie choisi et nettoie les fichiers temporaires."
+    ]
+  },
+  "aria2": {
+    "heading": "Options de téléchargement aria2 utilisées",
+    "code": "aria2c --no-conf --console-log-level=warn --log-level=info \\\n  --log=aria2_download.log \\\n  -x16 -s16 -j5 -c -R \\\n  -d\"$destDir\" -i\"$tempScript\"",
+    "flags": [
+      "<code>-x16</code> — jusqu'à 16 connexions par serveur.",
+      "<code>-s16</code> — divise chaque fichier en 16 segments.",
+      "<code>-j5</code> — télécharge 5 fichiers en parallèle.",
+      "<code>-c</code> — reprend les téléchargements partiels.",
+      "<code>-R</code> — applique au fichier téléchargé l’horodatage du fichier distant, s’il est disponible."
+    ],
+    "runtime": "La durée habituelle est d’environ 10 minutes et dépend surtout du débit Internet et de la charge des serveurs de téléchargement UUP Dump."
+  },
+  "step1": {
+    "heading": "Étape 1 · Obtenez une URL UUP Dump",
+    "intro": "Avant d'exécuter le script, vous avez besoin d'une URL UUP Dump qui inclut les paramètres de requête <code>id</code>, <code>pack</code> et <code>edition</code>. Générer sur <extlink>uupdump.net</extlink>:",
+    "stepBadge": "Étape",
+    "items": [
+      {
+        "title": "Choisissez une version Windows",
+        "img": "/iso-creator/step-1-select-version-windows.png",
+        "caption": "UUP Dump page principale — choisissez une version Windows",
+        "body": "Ouvrez la page d'accueil UUP Dump et choisissez la version Windows que vous voulez."
+      },
+      {
+        "title": "Choisissez une version précise",
+        "img": "/iso-creator/step-2-select-version-windows.png",
+        "caption": "Choisissez une version précise",
+        "body": "Choisissez la version : la plus récente, un canal Insider Preview ou une version plus ancienne encore répertoriée."
+      },
+      {
+        "title": "Choisir une langue",
+        "img": "/iso-creator/step-3-select-version-windows.png",
+        "caption": "Choisir une langue",
+        "body": "Choisissez la langue à inclure dans l’ISO."
+      },
+      {
+        "title": "Choisir les éditions",
+        "img": "/iso-creator/step-4-select-version-windows.png",
+        "caption": "Choisissez les éditions à inclure",
+        "body": "Choisissez les éditions à regrouper dans l'ISO (Home, Pro, Enterprise, ...). Vous pouvez en combiner plusieurs."
+      },
+      {
+        "title": "Copier l'URL",
+        "img": "/iso-creator/step-5-select-version-windows.png",
+        "caption": "Copier l'URL de la barre d'adresses",
+        "bodyRich": "Sur la dernière page, copiez l’URL <em>depuis la barre d’adresse du navigateur</em>. Elle doit contenir <code>id=…</code>, <code>pack=…</code> et <code>edition=…</code>. C’est cette chaîne que le script analyse."
+      }
+    ]
+  },
+  "step2": {
+    "heading": "Étape 2 · Exécuter le créateur",
+    "intro": "Avec l'URL en main, ouvrez ProxMenux et lancez le créateur :",
+    "stepBadge": "Étape",
+    "items": [
+      {
+        "title": "Démarrer UUP Dump ISO Creator",
+        "img": "/iso-creator/start-uupdump-iso-creator.png",
+        "caption": "Démarrer UUP Dump ISO Creator à partir de ProxMenux",
+        "bodyRich": "Dans ProxMenux, ouvrez <strong>Utilities → UUP Dump ISO Creator</strong>. Le script vérifie les dépendances et le répertoire ISO avant de demander les informations."
+      },
+      {
+        "title": "Coller l'URL UUP Dump",
+        "img": "/iso-creator/add-url-iso-creator.png",
+        "caption": "Coller l'URL que vous avez copiée depuis uupdump.net",
+        "body": "Collez l’URL dans le champ de saisie. Le script vérifie la présence des trois paramètres requis et s’arrête proprement s’il en manque un."
+      },
+      {
+        "title": "Attendez la fin de la création",
+        "img": "/iso-creator/end-uupdump-iso-creator.png",
+        "caption": "Création terminée : l’ISO est prête dans le stockage ISO Proxmox",
+        "bodyRich": "La console affiche la progression aria2 puis la sortie du convertisseur. L’ISO terminée est déplacée vers le répertoire de sortie choisi. Si elle se trouve dans un stockage ISO Proxmox configuré, vous pouvez la sélectionner dans <strong>Créer une VM Windows → Installer avec une ISO personnelle</strong>."
+      }
+    ]
+  },
+  "tempFiles": {
+    "title": "Fichiers temporaires",
+    "body": "Le dossier temporaire par défaut est <code>/root/uup-temp</code>, avec les téléchargements dans <code>UUPs/</code> et le convertisseur dans <code>converter/</code>. Un chemin de base personnalisé reçoit un sous-dossier de session distinct. Les branches de création réussie et d’absence d’ISO générée suppriment la session temporaire. Une erreur ou une annulation plus tôt peut laisser des fichiers temporaires."
+  }
+}
diff --git a/web/messages/fr/guides/backup-cloud.json b/web/messages/fr/guides/backup-cloud.json
new file mode 100644
index 00000000..70db9548
--- /dev/null
+++ b/web/messages/fr/guides/backup-cloud.json
@@ -0,0 +1,119 @@
+{
+  "meta": {
+    "title": "Sauvegarder Proxmox dans un stockage cloud personnel | ProxMenux",
+    "description": "Monter un stockage cloud personnel, comme Google Drive, Mega, Dropbox ou OneDrive, avec rclone sur l’hôte Proxmox VE, le déclarer comme stockage de sauvegarde pour vzdump et y sauvegarder directement les VM et conteneurs, sans script de sauvegarde supplémentaire.",
+    "ogTitle": "Sauvegarder Proxmox dans un stockage cloud personnel",
+    "ogDescription": "Monter un stockage cloud avec rclone sur l’hôte Proxmox VE et l’utiliser comme destination vzdump pour les VM et conteneurs."
+  },
+  "header": {
+    "title": "Sauvegarder Proxmox dans un stockage cloud personnel",
+    "description": "Monter un stockage cloud personnel, comme Google Drive, Mega, Dropbox ou OneDrive, avec rclone sur l’hôte Proxmox VE, le déclarer comme stockage de sauvegarde pour vzdump et y sauvegarder directement les VM et conteneurs, sans script de sauvegarde supplémentaire.",
+    "section": "Guides"
+  },
+  "intro": {
+    "pbsCalloutTitle": "Envisagez d’abord Proxmox Backup Server",
+    "pbsCalloutBody": "Sur une seconde machine répondant aux exigences x86-64, <pbsLink>Proxmox Backup Server</pbsLink> propose des sauvegardes incrémentales et dédupliquées, avec chiffrement facultatif côté client. Il est conçu pour les VM. Ce guide explique plutôt comment monter un stockage cloud personnel, comme Google Drive, Mega, OneDrive ou Dropbox, comme destination de sauvegarde.",
+    "stepsTitle": "Ce que vous allez faire",
+    "steps": [
+      "Créer un répertoire sur l’hôte Proxmox et le déclarer comme stockage de sauvegarde vzdump.",
+      "Installez et configurez rclone pour votre fournisseur de cloud.",
+      "Montez le dossier cloud sur le répertoire.",
+      "Rétablir le montage après chaque redémarrage avec une unité systemd."
+    ],
+    "vzdumpCalloutTitle": "À propos des sauvegardes vzdump de Proxmox",
+    "vzdumpCalloutBody": "Les archives vzdump de Proxmox sont des <strong>sauvegardes complètes, pas incrémentielles</strong>. Leur taille dépend des données incluses et de la compression, pas seulement de la capacité du disque virtuel. Si une archive occupe 30 GB, en conserver cinq nécessite environ 150 GB. Définissez une politique de rétention pour éviter de remplir le cloud."
+  },
+  "createDir": {
+    "heading": "1. Créer le répertoire sur l’hôte et le déclarer comme stockage de sauvegarde",
+    "body": "Connectez-vous à l’hôte par SSH ou ouvrez le shell Proxmox, puis créez un point de montage dans <code>/mnt/</code>. Choisissez un nom qui identifie le fournisseur :",
+    "mkdirCode": "mkdir -p /mnt/gdrive",
+    "afterMkdir": "Dans l'interface web Proxmox: <strong>Datacenter → Stockage → Ajouter → Directory</strong>.",
+    "image1Alt": "Ajouter un nouveau stockage dans Proxmox",
+    "configIntro": "Configurez-le comme ceci :",
+    "configItems": [
+      "<strong>ID:</strong> <code>gdrive</code> (ou tout ce que vous avez utilisé pour le nom du répertoire)",
+      "<strong>Répertoire:</strong> <code>/mnt/gdrive</code>",
+      "<strong>Contenu :</strong> sélectionnez <strong>Fichier de sauvegarde VZDump</strong>."
+    ],
+    "image2Alt": "Configuration du nouveau stockage dans Proxmox",
+    "afterConfig": "Cliquez sur <strong>Ajouter</strong> :",
+    "image3Alt": "Nouveau stockage ajouté dans Proxmox",
+    "afterAdd": "Le répertoire est déclaré comme stockage Proxmox, mais il reste vide : le cloud n’y est pas encore monté."
+  },
+  "installRclone": {
+    "heading": "2. Installer et configurer rclone",
+    "body": "<rcloneLink>rclone</rcloneLink> communique avec les services de stockage cloud. Installez-le depuis les dépôts Debian :",
+    "installCode": "apt-get update\napt-get install -y rclone",
+    "newerCalloutTitle": "Si vous avez besoin d'un nouveau rclone",
+    "newerCalloutBody": "Si vous avez besoin d’une version plus récente que celle proposée par Debian, utilisez l’installateur officiel :",
+    "newerCode": "curl https://rclone.org/install.sh | bash",
+    "tunnelHeading": "2.1 Authentification par navigateur via le tunnel SSH",
+    "tunnelBody": "Pour les fournisseurs utilisant une connexion web, l’hôte Proxmox n’a généralement pas de navigateur. Suivez la <remoteSetupLink>procédure de configuration distante de rclone</remoteSetupLink> : utilisez le navigateur du portable et transférez sa connexion de retour localhost par SSH vers rclone sur l’hôte.",
+    "tunnelFrom": "Sur votre <strong>ordinateur portable</strong>, en remplaçant <code>ip_proxmox</code> par l’adresse IP de Proxmox :",
+    "tunnelCode": "ssh -L localhost:53682:localhost:53682 root@ip_proxmox",
+    "tunnelAfter": "Cette session SSH ouvre le port localhost 53682 sur le portable et transfère les connexions vers le même port de l’hôte Proxmox. Gardez-la ouverte pendant la configuration de rclone.",
+    "runHeading": "2.2 Exécuter rclone config",
+    "runBody": "Dans la session SSH que vous venez d’ouvrir, exécutez :",
+    "runCode": "rclone config",
+    "runAfter": "Suivez les instructions pour ajouter une nouvelle configuration distante, ou « remote ». Les réponses dépendent du fournisseur ; consultez la <providerDocsLink>documentation des fournisseurs rclone</providerDocsLink> pour Google Drive, Mega, Dropbox, OneDrive, etc. L’étape clé est la question d’authentification :",
+    "authPrompt": "Use web browser to automatically authenticate rclone with remote?\n * Say Y if the machine running rclone has a web browser you can use\n * Say N if running rclone on a (remote) machine without web browser access\nIf not sure try Y. If Y failed, try N.\ny) Yes\nn) No\ny/n> y",
+    "authAfter": "Répondez <strong>Y</strong>. rclone affiche une URL locale. Ouvrez-la dans le <strong>navigateur du portable</strong> ; le tunnel SSH transfère la connexion. Autorisez rclone auprès du fournisseur cloud pour terminer la configuration.",
+    "nameRemote": "Pour le nom de la configuration distante, choisissez un nom correspondant au répertoire, par exemple <code>gdrive</code>."
+  },
+  "mount": {
+    "heading": "3. Monter le dossier cloud",
+    "body": "Créez un dossier dans votre cloud pour les sauvegardes, par exemple <code>PBC</code>, pour Proxmox Backup Cloud.",
+    "mountIntro": "Montez-le dans le répertoire de l’hôte :",
+    "mountCode": "rclone mount gdrive:/PBC /mnt/gdrive --allow-other --allow-non-empty --vfs-cache-mode writes",
+    "mountItems": [
+      "<code>gdrive:/PBC</code> — le dossier dans votre cloud.",
+      "<code>/mnt/gdrive</code> — le répertoire hôte que vous avez enregistré comme datastore."
+    ],
+    "mountFootnote": "<strong>Cette commande reste au premier plan.</strong> Laissez-la tourner dans un terminal pour tester une sauvegarde. Pour rétablir le montage à chaque démarrage, créez une unité systemd dans la section suivante."
+  },
+  "systemd": {
+    "heading": "4. Montage automatique à chaque démarrage avec systemd",
+    "body": "Une unité systemd offre plus de contrôle que <code>crontab @reboot</code> : elle peut attendre le démarrage du réseau, redémarrer en cas d’échec et fournir des journaux via <code>journalctl</code>.",
+    "createIntro": "Créez le fichier de l’unité :",
+    "createCode": "nano /etc/systemd/system/rclone-gdrive.service",
+    "pasteIntro": "Collez :",
+    "unitCode": "[Unit]\nDescription=rclone mount for Proxmox cloud backups\nWants=network-online.target\nAfter=network-online.target\n\n[Service]\nType=notify\nExecStart=/usr/bin/rclone mount \\\n    gdrive:/PBC /mnt/gdrive \\\n    --allow-other \\\n    --allow-non-empty \\\n    --vfs-cache-mode writes \\\n    --log-level INFO \\\n    --log-file /var/log/rclone-gdrive.log\nExecStop=/bin/fusermount -uz /mnt/gdrive\nRestart=on-failure\nRestartSec=10\n\n[Install]\nWantedBy=multi-user.target",
+    "adjust": "Adaptez <code>gdrive:/PBC</code> et <code>/mnt/gdrive</code> si vous avez choisi d’autres noms. Enregistrez, quittez l’éditeur avec <code>Ctrl+X</code>, puis activez et démarrez le service :",
+    "enableCode": "systemctl daemon-reload\nsystemctl enable --now rclone-gdrive.service",
+    "verifyIntro": "Vérifier :",
+    "verifyCode": "systemctl status rclone-gdrive.service\nmount | grep /mnt/gdrive",
+    "verifyAfter": "L’unité demande un redémarrage après 10 secondes si le processus rclone se termine en échec. Cela ne répare pas les identifiants expirés et ne garantit pas la résolution de tout problème réseau ou fournisseur. Consultez <code>/var/log/rclone-gdrive.log</code> et <code>journalctl -u rclone-gdrive.service -f</code>.",
+    "vfsCalloutTitle": "Pourquoi utiliser --vfs-cache-mode writes ?",
+    "vfsCalloutBody": "Avec le cache d’écriture, les opérations comme <code>fwrite</code> écrivent dans un cache disque local. rclone envoie le fichier après sa fermeture et le délai d’écriture différée. Prévoyez assez d’espace local pour les sauvegardes en cours et vérifiez la fin de l’envoi avant de considérer la copie distante comme disponible."
+  },
+  "configureBackup": {
+    "heading": "5. Configurer le cloud comme destination de sauvegarde",
+    "body": "Dans Proxmox, pour une sauvegarde planifiée ou manuelle, choisissez le stockage déclaré comme <strong>destination</strong> :",
+    "image5Alt": "Sélection de la destination de sauvegarde dans Proxmox",
+    "after": "Une fois vzdump terminé, attendez la fin de l’envoi rclone en arrière-plan et vérifiez l’archive dans l’interface du fournisseur cloud :",
+    "image6Alt": "Fichier de sauvegarde dans le stockage en nuage"
+  },
+  "retention": {
+    "heading": "6. Rétention : maîtriser le quota cloud",
+    "body": "Les archives vzdump de Proxmox sont des <strong>sauvegardes complètes, pas incrémentielles</strong>. Leur taille dépend des données incluses et de la compression, pas seulement de la capacité du disque virtuel. Si une archive occupe 30 GB, en conserver cinq nécessite environ 150 GB. Définissez une politique de rétention pour éviter de remplir le cloud.",
+    "uiPath": "Dans l’interface Proxmox : <strong>Centre de données → Sauvegarde → [votre tâche] → Rétention</strong> :",
+    "image7Alt": "Paramètres de rétention de sauvegarde dans Proxmox",
+    "starterIntro": "Valeurs de départ possibles pour une installation personnelle ou de test :",
+    "starterItems": [
+      "Conserver les 5 dernières sauvegardes quotidiennes",
+      "Conserver les 4 dernières sauvegardes hebdomadaires",
+      "Conserver les 6 dernières sauvegardes mensuelles"
+    ],
+    "adjust": "Adaptez les valeurs au quota cloud et à la fréquence des modifications des VM."
+  },
+  "troubleshoot": {
+    "heading": "Dépannage",
+    "items": [
+      "<strong><code>Mount point /mnt/gdrive is itself on a fuse.rclone filesystem</code> :</strong> le répertoire est déjà monté, éventuellement par une autre instance rclone. Vérifiez qu’aucune sauvegarde n’est en cours avant de supprimer l’ancien montage avec <code>fusermount -uz /mnt/gdrive</code>, puis redémarrez l’unité systemd.",
+      "<strong>La sauvegarde est très lente :</strong> vérifiez <code>--vfs-cache-mode writes</code> sur la ligne <code>ExecStart</code>, les performances du cache local, le débit montant et les limites du fournisseur. L’envoi peut continuer après la fin de vzdump.",
+      "<strong>La sauvegarde échoue avec No space left on device :</strong> vérifiez l’espace du cache local et le quota cloud. Le cache utilise généralement <code>~/.cache/rclone/</code>. S’il est plein, choisissez par exemple <code>--cache-dir /var/cache/rclone</code> sur un système de fichiers disposant d’espace. Changer de chemin sur le même système plein ne suffit pas.",
+      "<strong>Le jeton d’authentification rclone a expiré :</strong> reconnectez-vous par SSH avec le tunnel (<code>ssh -L localhost:53682:localhost:53682 root@ip_proxmox</code>) et exécutez <code>rclone config reconnect gdrive:</code> pour renouveler l’autorisation.",
+      "<strong>Les sauvegardes sont présentes dans le cloud, mais leur restauration échoue :</strong> n’utilisez pas le cloud comme <strong>seule</strong> destination. Ajoutez des sauvegardes PBS ou vzdump locales sur un autre disque."
+    ]
+  }
+}
diff --git a/web/messages/fr/guides/index.json b/web/messages/fr/guides/index.json
new file mode 100644
index 00000000..c2802c1f
--- /dev/null
+++ b/web/messages/fr/guides/index.json
@@ -0,0 +1,118 @@
+{
+  "meta": {
+    "title": "Guides Proxmox VE — Coral TPU, NVIDIA, Kodi dans LXC, Samba et sauvegarde cloud | ProxMenux",
+    "description": "Tutoriels détaillés pour Proxmox VE : Kodi dans LXC avec accélération GPU, pilotes NVIDIA sur PVE 9, disque USB partagé par Samba dans un conteneur et sauvegardes vzdump vers Google Drive, Mega, Dropbox ou OneDrive. Avec une sélection de ressources communautaires, un glossaire et une référence des commandes.",
+    "ogTitle": "Guides Proxmox VE — Coral TPU, NVIDIA, Kodi dans LXC, Samba et sauvegarde cloud",
+    "ogDescription": "Tutoriels détaillés pour Proxmox VE : passthrough GPU, centre multimédia Kodi dans LXC, disque USB partagé par Samba, sauvegarde cloud avec rclone et ressources communautaires sélectionnées.",
+    "twitterTitle": "Guides Proxmox VE | ProxMenux",
+    "twitterDescription": "Tutoriels détaillés pour Proxmox VE : GPU, Kodi dans LXC, Samba, sauvegarde cloud et autres sujets.",
+    "ogImageAlt": "Guides ProxMenux — tutoriels détaillés pour Proxmox VE"
+  },
+  "header": {
+    "title": "Guides ProxMenux",
+    "tagline": "Tutoriels approfondis, références rapides et ressources communautaires sélectionnées pour tirer le meilleur parti de Proxmox VE."
+  },
+  "inDepth": {
+    "heading": "Guides détaillés",
+    "intro": "Tutoriels détaillés pour des tâches précises dans Proxmox. Chacun présente les étapes manuelles d’un processus automatisé par ProxMenux, pour comprendre ce qui se passe à chaque étape.",
+    "items": [
+      {
+        "slug": "kodi-lxc",
+        "title": "Installer Kodi dans LXC avec accélération GPU et le relier à un écran ou téléviseur",
+        "description": "Exécuter Kodi dans un conteneur LXC privilégié sur Proxmox VE, lui donner accès à l’iGPU et aux périphériques d’entrée USB de l’hôte, et transformer le serveur en centre multimédia directement relié au téléviseur."
+      },
+      {
+        "slug": "backup-cloud",
+        "title": "Sauvegarder Proxmox dans un stockage cloud personnel",
+        "description": "Monter un stockage cloud personnel, comme Google Drive, Mega, Dropbox ou OneDrive, avec rclone sur l’hôte Proxmox VE, le déclarer comme stockage de sauvegarde pour vzdump et y sauvegarder directement les VM et conteneurs, sans script de sauvegarde supplémentaire."
+      },
+      {
+        "slug": "lxc-samba",
+        "title": "Ajouter un disque ou une clé USB à LXC et le partager sur le réseau avec Samba",
+        "description": "Rendre un disque dur ou une clé USB accessible dans un conteneur LXC privilégié sur Proxmox VE, y installer Samba et partager son contenu sur le réseau."
+      },
+      {
+        "slug": "nvidia-manual",
+        "title": "Installation des pilotes de cartes graphiques NVIDIA sur Proxmox VE 9 (procédure manuelle)",
+        "description": "Installer et configurer manuellement les pilotes NVIDIA sur un hôte Proxmox VE 9, puis donner accès au GPU à un ou plusieurs conteneurs LXC. Couvre les pilotes, le service de persistance, le correctif NVENC facultatif et la configuration de chaque conteneur."
+      }
+    ]
+  },
+  "references": {
+    "heading": "Références ProxMenux",
+    "intro": "Matériel de référence rapide de la documentation ProxMenux elle-même.",
+    "cards": {
+      "glossary": {
+        "title": "Glossaire",
+        "description": "Plus de 60 définitions des termes techniques de ProxMenux : Proxmox, virtualisation, stockage, réseau et Linux. Consultation rapide avec étiquettes de catégorie et liens croisés."
+      },
+      "helpInfo": {
+        "title": "Aide et information — Catalogue des commandes",
+        "description": "Une sélection de commandes Linux et Proxmox classées par thème, avec copie dans le presse-papiers. Reprend la référence disponible dans le menu ProxMenux."
+      },
+      "linuxResources": {
+        "title": "Ressources Linux",
+        "description": "Ressources externes pour apprendre la ligne de commande Linux, les bonnes pratiques de sécurité, les outils de surveillance et ZFS, en complément du catalogue de commandes ProxMenux."
+      },
+      "externalRepos": {
+        "title": "Dépôts externes",
+        "description": "Dépôts de scripts tiers intégrés dans ProxMenux comme options de menu alternatives (community-scripts/ProxmoxVE, etc.)."
+      }
+    }
+  },
+  "official": {
+    "heading": "Ressources officielles Proxmox",
+    "intro": "Documentation publiée par Proxmox Server Solutions, la référence officielle de la plateforme.",
+    "cards": {
+      "pveDocs": {
+        "title": "Documentation Proxmox VE",
+        "description": "Le guide officiel d’administration : une référence complète sur l’installation, le réseau, le stockage, les clusters, la haute disponibilité et l’API."
+      },
+      "pbsDocs": {
+        "title": "Documentation Proxmox Backup Server",
+        "description": "Documentation PBS : sauvegardes incrémentales, dédupliquées et chiffrées pour Proxmox VE."
+      },
+      "videoTraining": {
+        "title": "Formation vidéo officielle",
+        "description": "Tutoriels vidéo et formations officiels de Proxmox."
+      },
+      "forum": {
+        "title": "Proxmox Forum",
+        "description": "Forum communautaire officiel pour les questions, le dépannage et le partage d’expériences, suivi par les responsables du projet."
+      }
+    }
+  },
+  "community": {
+    "heading": "Projets et ressources communautaires",
+    "intro": "Projets open source et listes sélectionnées dans la communauté Proxmox. Ils ne sont affiliés ni à Proxmox Server Solutions ni à ProxMenux ; ils figurent ici pour leur utilité.",
+    "cards": {
+      "helperScripts": {
+        "title": "Proxmox VE Helper-Scripts",
+        "description": "Catalogue maintenu par la communauté de scripts pour déployer simplement des conteneurs LXC, des VM et des réglages PVE, par exemple pour Home Assistant, Plex ou Frigate. Il reprend l’esprit des scripts de tteck."
+      },
+      "awesome": {
+        "title": "awesome-proxmox-ve (liste de ressources sélectionnées)",
+        "description": "Vaste sélection communautaire de ressources Proxmox VE : outils, bibliothèques, intégrations, blogs et vidéos. Un bon point de départ pour en découvrir davantage."
+      }
+    },
+    "suggestRich": "Vous connaissez une ressource de qualité à ajouter ? Ouvrez une issue ou une PR sur <link>GitHub</link>. Cette liste doit rester une sélection pertinente plutôt qu’un inventaire exhaustif."
+  },
+  "discussion": {
+    "heading": "Débat communautaire",
+    "intro": "Où les gens parlent de Proxmox et ProxMenux.",
+    "cards": {
+      "proxmenuxDiscussions": {
+        "title": "ProxMenux Discussions",
+        "description": "Discussions GitHub dédiées à ProxMenux : idées de fonctions, questions-réponses et partage de configurations. L’endroit adapté aux sujets liés au menu, à Monitor et à la documentation."
+      },
+      "proxmoxForum": {
+        "title": "Proxmox Forum",
+        "description": "Forum Proxmox officiel (également lié ci-dessus). Le bon endroit pour le dépannage en profondeur et les problèmes spécifiques à la configuration."
+      },
+      "reddit": {
+        "title": "r/Proxmox sur Reddit",
+        "description": "Subreddit actif pour les discussions, conseils et questions techniques. Plus accessible que le forum, avec des réponses souvent plus rapides aux questions informelles."
+      }
+    }
+  }
+}
diff --git a/web/messages/fr/guides/kodi-lxc.json b/web/messages/fr/guides/kodi-lxc.json
new file mode 100644
index 00000000..58e663ab
--- /dev/null
+++ b/web/messages/fr/guides/kodi-lxc.json
@@ -0,0 +1,70 @@
+{
+  "meta": {
+    "title": "Installer Kodi dans LXC avec accélération GPU | Guides ProxMenux",
+    "description": "Exécuter Kodi dans un conteneur LXC privilégié sur Proxmox VE, lui donner accès à l’iGPU et aux périphériques d’entrée USB de l’hôte, et transformer le serveur en centre multimédia directement relié au téléviseur.",
+    "ogTitle": "Installer Kodi dans LXC avec accélération GPU",
+    "ogDescription": "Exécuter Kodi dans un conteneur LXC privilégié sur Proxmox VE, avec accès à l’iGPU et aux périphériques d’entrée USB de l’hôte, pour transformer le serveur en centre multimédia."
+  },
+  "header": {
+    "title": "Installer Kodi dans LXC avec accélération GPU et le relier à un écran ou téléviseur",
+    "description": "Exécuter Kodi dans un conteneur LXC privilégié sur Proxmox VE, lui donner accès à l’iGPU et aux périphériques d’entrée USB de l’hôte, et transformer le serveur en centre multimédia directement relié au téléviseur.",
+    "section": "Guides"
+  },
+  "intro": {
+    "calloutTitle": "Attention",
+    "calloutBody": "Ce guide utilise un script communautaire externe pour préparer le conteneur Kodi. ProxMenux peut également lui donner accès à l’iGPU de l’hôte : <strong>GPU et Coral-TPU → Ajouter un GPU à LXC</strong> configure <code>/dev/dri</code> et installe les pilotes dans le conteneur. Le script ci-dessous installe aussi Kodi et son démarrage automatique sur <code>tty7</code>. Utilisez-le pour un centre multimédia LXC prêt à l’emploi ; choisissez la <gpuLink>procédure ProxMenux</gpuLink> si vous souhaitez seulement donner accès au GPU à un conteneur déjà configuré.",
+    "credit": "Le script Kodi LXC original a été créé par <authorLink>mrrudy</authorLink>.",
+    "stepsTitle": "Ce que vous allez faire",
+    "steps": [
+      "Créer un conteneur LXC privilégié avec Kodi à l’aide du script.",
+      "Donner au conteneur accès au clavier, à la souris ou à la manette USB.",
+      "Facultatif : mettre à jour Kodi depuis les dépôts configurés dans le conteneur."
+    ]
+  },
+  "createCt": {
+    "heading": "1. Créer le Kodi LXC",
+    "body": "Pour cette procédure, sélectionnez <strong>Privileged</strong> dans les réglages avancés du script. Par défaut, il crée des conteneurs non privilégiés, qui nécessitent des droits sur les périphériques et une correspondance des identifiants adaptés. Il configure l’accès au GPU, Kodi et son démarrage sur <code>tty7</code> :",
+    "code": "bash -c \"$(wget -qLO - https://raw.githubusercontent.com/mrrudy/proxmoxHelper/main/ct/kodi-v1.sh)\"",
+    "after": "L’installation prend un peu de temps. Lorsque Kodi démarre sur <code>tty7</code>, reliez l’écran ou le téléviseur à la sortie HDMI/DisplayPort de l’hôte. L’interface de Kodi devrait s’afficher."
+  },
+  "addInput": {
+    "heading": "2. Ajouter un clavier, une souris ou une manette USB",
+    "body": "Les périphériques d’entrée se trouvent dans <code>/dev/input/</code> sur l’hôte. Repérez leur numéro majeur :",
+    "listCode": "ls -l /dev/input",
+    "imageAlt": "Liste des périphériques d'entrée",
+    "afterList": "Pour les périphériques de caractères, prenez le numéro majeur avant la virgule, ici <code>13</code>. Sur l’hôte, modifiez la configuration du conteneur Kodi, en remplaçant <code>'<'CTID'>'</code> par son identifiant, par exemple <code>102</code> :",
+    "editCode": "nano /etc/pve/lxc/CTID.conf",
+    "addLines": "Ajoutez les lignes suivantes en adaptant <code>13</code> au numéro relevé sur <strong>votre</strong> hôte :",
+    "configCode": "lxc.cgroup2.devices.allow: c 13:* rwm\nlxc.mount.entry: /dev/input dev/input none bind,optional,create=dir",
+    "imageConfigAlt": "Configuration LXC",
+    "save": "Enregistrez le fichier, quittez l’éditeur avec <code>Ctrl+X</code> et redémarrez <strong>uniquement le conteneur</strong>. Inutile de redémarrer l’hôte Proxmox :",
+    "restartCode": "pct reboot CTID",
+    "plug": "Branchez le clavier, la souris ou la manette USB. Kodi devrait réagir."
+  },
+  "updateKodi": {
+    "heading": "3. Facultatif : mettre à jour Kodi depuis les dépôts configurés",
+    "calloutTitle": "Important",
+    "calloutBody": "Le PPA team-xbmc est <strong>réservé à Ubuntu</strong> et Kodi indique qu’il n’est plus maintenu. L’absence de <code>add-apt-repository</code> ne permet pas d’identifier la distribution. Vérifiez <code>cat /etc/os-release</code> et recherchez <code>NAME=\"Ubuntu\"</code> ; n’ajoutez pas de PPA Ubuntu à Debian. Les commandes ci-dessous mettent à jour les paquets depuis les dépôts configurés dans le conteneur.",
+    "body": "Dans le conteneur (<code>pct enter '<'CTID'>'</code>) :",
+    "code": "apt update\napt install --only-upgrade kodi kodi-bin",
+    "after": "Redémarrez le conteneur après la mise à jour. Kodi utilisera la version disponible dans ses dépôts configurés, qui peut différer de la dernière version du projet."
+  },
+  "screenshots": {
+    "heading": "Captures d'écran",
+    "image1Alt": "Interface Kodi 1",
+    "image2Alt": "Interface Kodi 2"
+  },
+  "troubleshoot": {
+    "heading": "Dépannage",
+    "items": [
+      "<strong>Le conteneur Kodi démarre, mais rien ne s’affiche sur le téléviseur :</strong> il n’a peut-être pas accès à l’iGPU. Vérifiez <code>ls /dev/dri</code> dans le conteneur : <code>card0</code> et <code>renderD128</code> devraient apparaître. Si le répertoire est vide, vérifiez le passthrough GPU ou utilisez <strong>Ajouter un GPU à LXC</strong> dans ProxMenux.",
+      "<strong>Clavier ou souris non détecté après redémarrage :</strong> vérifiez que <code>/dev/input</code> est monté et que Kodi peut lire les périphériques. Exécutez <code>ls -l /dev/input</code> sur l’hôte et dans le conteneur, puis vérifiez la règle <code>lxc.cgroup2.devices.allow</code>.",
+      "<strong>La lecture avec accélération matérielle utilise le CPU au lieu du GPU :</strong> installez ou mettez à jour les pilotes VA-API dans le conteneur : <code>intel-media-va-driver</code> pour les iGPU Intel récents, <code>i965-va-driver</code> pour les anciens et <code>mesa-va-drivers</code> pour AMD.",
+      "<strong><code>add-apt-repository: command not found</code> :</strong> la commande n’est pas installée ; cela ne prouve pas que le conteneur utilise Debian. Vérifiez la distribution et les paquets disponibles. Sur Debian, utilisez ses paquets Kodi sans ajouter le PPA Ubuntu."
+    ]
+  },
+  "further": {
+    "heading": "Pour en savoir plus",
+    "konpatRich": "<konpatLink>Article de Konpat</konpatLink> pour en savoir plus sur l’accès à l’iGPU Intel depuis LXC."
+  }
+}
diff --git a/web/messages/fr/guides/lxc-samba.json b/web/messages/fr/guides/lxc-samba.json
new file mode 100644
index 00000000..365e500e
--- /dev/null
+++ b/web/messages/fr/guides/lxc-samba.json
@@ -0,0 +1,119 @@
+{
+  "meta": {
+    "title": "Ajouter un disque USB à LXC et le partager avec Samba | ProxMenux",
+    "description": "Rendre un disque dur ou une clé USB accessible dans un conteneur LXC privilégié sur Proxmox VE, y installer Samba et partager son contenu sur le réseau.",
+    "ogTitle": "Ajouter un disque USB à LXC et le partager avec Samba",
+    "ogDescription": "Donner accès à un disque USB dans un conteneur LXC privilégié sur Proxmox VE, y installer Samba et partager son contenu sur le réseau local."
+  },
+  "header": {
+    "title": "Ajouter un disque ou une clé USB à LXC et le partager sur le réseau avec Samba",
+    "description": "Rendre un disque dur ou une clé USB accessible dans un conteneur LXC privilégié sur Proxmox VE, y installer Samba et partager son contenu sur le réseau.",
+    "section": "Guides"
+  },
+  "recommended": {
+    "calloutTitle": "Recommandé",
+    "calloutIntro": "ProxMenux propose les deux parties de cette procédure sous forme de menus guidés :",
+    "items": [
+      "<strong>Gestion des disques → Formater/effacer un disque physique</strong> pour le formatage.",
+      "<strong>Stockage et partage → Partage réseau LXC → Serveur Samba dans LXC</strong> pour l’installation dans le conteneur privilégié et la configuration de Samba."
+    ],
+    "calloutOutro": "Les procédures guidées gèrent les particularités des droits des conteneurs non privilégiés, les profils de partage en lecture-écriture, lecture seule ou personnalisés, ainsi que le groupe sharedfiles. Ce guide présente les étapes manuelles pour les comprendre ou les configurer vous-même."
+  },
+  "intro": {
+    "body": "Un disque dur ou une clé USB peut être utile sur un hôte Proxmox, surtout sur un mini-PC offrant peu de possibilités d’extension interne. Ce guide explique :",
+    "stepsTitle": "Ce que vous allez faire",
+    "steps": [
+      "Fixation du disque USB à un LXC privilégié.",
+      "Installation de Samba à l'intérieur du conteneur.",
+      "Partage du contenu du disque sur le réseau local."
+    ],
+    "useCasesTitle": "Cas d'utilisation",
+    "useCases": [
+      "Héberger des fichiers torrent et les partager sur le réseau.",
+      "Fournir du stockage à un serveur multimédia comme Plex, Jellyfin ou Emby.",
+      "Stocker des documents que Paperless traite automatiquement.",
+      "Stockage générique de type NAS pour le réseau domestique."
+    ],
+    "privilegedCalloutTitle": "Conteneur privilégié pour cette procédure",
+    "privilegedCalloutBody": "Cette procédure utilise un conteneur LXC privilégié avec un périphérique de bloc comme <code>mp0</code>. Pour un conteneur non privilégié, vous pouvez monter le système de fichiers sur l’hôte puis partager son répertoire par montage bind, avec les droits et correspondances d’identifiants adaptés. Voir <strong>Stockage et partage → Points de montage LXC</strong> dans ProxMenux."
+  },
+  "attach": {
+    "heading": "1. Rendre le disque USB accessible dans LXC",
+    "identifyHeading": "1.1 Identifier l'appareil",
+    "identifyBody": "Comparez la liste des disques <strong>avant</strong> et <strong>après</strong> le branchement USB. Le nouveau périphérique est le disque recherché.",
+    "beforeLabel": "Avant:",
+    "afterLabel": "Après:",
+    "imageBeforeAlt": "Liste de disques avant d'ajouter un lecteur USB",
+    "imageAfterAlt": "Liste de disques après l'ajout du lecteur USB",
+    "lsblkBody": "Utilisez aussi <code>lsblk -o NAME,SIZE,MODEL,SERIAL</code> pour afficher les périphériques de bloc avec leur modèle et numéro de série.",
+    "stableCalloutTitle": "Important — utilisez un identifiant stable",
+    "stableCalloutBody": "Le nom <code>/dev/sdb1</code> peut changer après un redémarrage, surtout avec plusieurs disques USB. Recherchez l’identifiant persistant :",
+    "stableCalloutCode": "ls -l /dev/disk/by-id/",
+    "stableCalloutAfter": "Utilisez l’entrée <code>/dev/disk/by-id/usb-...</code> de la partition choisie dans la configuration LXC, au lieu de <code>/dev/sdb1</code>. Choisissez la partition, pas le disque entier : elle restera identifiable si l’ordre des périphériques change.",
+    "formatHeading": "1.2 Formater le disque",
+    "formatBody": "ext4 convient aux partages sous Linux : distinction des majuscules, ACL POSIX et fichiers volumineux. Le formatage détruit le contenu du système de fichiers existant. Vérifiez la partition puis exécutez la commande sur <strong>l’hôte Proxmox</strong> :",
+    "formatCode": "mkfs.ext4 /dev/sdb1",
+    "formatAfter": "Remplacez <code>/dev/sdb1</code> par la partition réelle ou son chemin persistant <code>/dev/disk/by-id/usb-...-part1</code>.",
+    "mkdirHeading": "1.3 Créer le point de montage dans le conteneur LXC",
+    "mkdirBody": "À l'intérieur du LXC, créez le répertoire où le disque apparaîtra (tout nom fonctionne):",
+    "mkdirCode": "mkdir /mnt/lxc_USB",
+    "wireHeading": "1.4 Déclarer le périphérique dans LXC",
+    "wireBody": "Sur <strong>l’hôte Proxmox</strong>, modifiez la configuration du conteneur. Remplacez <code>'<'CTID'>'</code> par son identifiant :",
+    "wireEditCode": "nano /etc/pve/lxc/CTID.conf",
+    "wireAddLine": "Ajouter cette ligne:",
+    "wireConfigCode": "mp0: /dev/disk/by-id/usb-VENDOR_MODEL_SERIAL-part1,mp=/mnt/lxc_USB,backup=0",
+    "wireShortForm": "Vous pouvez aussi utiliser l’entrée courte <code>mp0: /dev/sdb1,mp=/mnt/lxc_USB,backup=0</code> si vous acceptez le risque de changement du nom du périphérique.",
+    "wireBackupNote": "Cet exemple utilise <code>backup=0</code>. Le contenu des montages de périphériques et des montages bind n’est pas inclus dans les sauvegardes <code>vzdump</code> du conteneur. Prévoyez une sauvegarde distincte des données du disque externe.",
+    "restartHeading": "1.5 Redémarrez le LXC et définissez les permissions",
+    "restartBody": "Redémarrer le CT pour appliquer le point de montage:",
+    "restartCode": "pct reboot CTID",
+    "permsBody": "Dans le conteneur LXC, créez le compte de partage avant de lui attribuer le répertoire, puis définissez les droits :",
+    "permsCode": "adduser --system --group --no-create-home --shell /usr/sbin/nologin proxmenux\nmkdir -p /mnt/lxc_USB\nchown -R proxmenux:proxmenux /mnt/lxc_USB\nchmod 770 /mnt/lxc_USB",
+    "permsNoteTitle": "Remarque",
+    "permsNote": "Remplacez <code>proxmenux</code> par le nom choisi. Le mode <code>770</code> autorise le propriétaire et le groupe, sans accès pour les autres ; il est plus restrictif que <code>chmod -R 777</code>. Le compte est créé ici puis enregistré dans Samba à l’étape 2.2."
+  },
+  "samba": {
+    "heading": "2. Installer Samba",
+    "installHeading": "2.1 Installez le paquet à l'intérieur du LXC",
+    "installCode": "apt-get update\napt-get install -y samba",
+    "confirmBody": "Confirmez que le service fonctionne :",
+    "confirmCode": "systemctl status smbd.service",
+    "userHeading": "2.2 Vérifier le compte de partage",
+    "userBody": "Le compte système <code>proxmenux</code> a été créé sans shell de connexion à l’étape 1.5. Vérifiez-le avant de définir son mot de passe Samba et utilisez le nom choisi à chaque étape :",
+    "userCode": "id proxmenux",
+    "passwordBody": "Définissez le mot de passe Samba. Il est distinct du mot de passe système, car Samba possède son propre stockage d’identifiants :",
+    "passwordCode": "smbpasswd -a proxmenux",
+    "aclHeading": "2.3 Définir le propriétaire et les ACL",
+    "aclBody": "Si le <code>chown</code> de l’étape 1.5 suffit, les droits sont prêts. Pour plusieurs utilisateurs ayant des droits différents sur le même chemin, utilisez des ACL :",
+    "aclCode": "apt-get install -y acl\nsetfacl -R -m \"u:proxmenux:rwx\" /mnt/lxc_USB\nsetfacl -d -R -m \"u:proxmenux:rwx\" /mnt/lxc_USB    # default ACL — applies to new files"
+  },
+  "configure": {
+    "heading": "3. Configurer le partage Samba",
+    "editHeading": "3.1 Modifier smb.conf",
+    "editCode": "nano /etc/samba/smb.conf",
+    "appendBody": "Ajoutez une définition de partage à la fin du fichier :",
+    "shareCode": "[lxc_usb]\n    comment = Shared USB storage\n    path = /mnt/lxc_USB\n    read only = no\n    writable = yes\n    browseable = yes\n    guest ok = no\n    valid users = proxmenux\n    create mask = 0660\n    directory mask = 0770",
+    "validUsersNoteTitle": "Remarque",
+    "validUsersNote": "La ligne <code>valid users = proxmenux</code> limite l'accès à ce seul utilisateur Samba. Pour l'accès par groupe, utilisez <code>valid users = @samba_users</code> après avoir ajouté les utilisateurs à un groupe nommé <code>samba_users</code>.",
+    "reloadHeading": "3.2 Recharger Samba",
+    "reloadCode": "systemctl restart smbd"
+  },
+  "verify": {
+    "heading": "4. Vérifier l'accès",
+    "body": "Depuis n'importe quel client LAN, naviguez vers <code>\\\\'<'CT_IP'>'</code> (Windows) ou <code>smb://'<'CT_IP'>'</code> (gestionnaires de fichiers macOS / Linux). Authentifier avec l'utilisateur Samba (<code>proxmenux</code>) et le mot de passe que vous définissez avec <code>smbpasswd</code>.",
+    "image1Alt": "Accès au serveur Samba depuis un client",
+    "image2Alt": "Demande d'authentification Samba",
+    "usageBody": "Vous pouvez utiliser le partage dans le conteneur et sur le réseau :",
+    "image3Alt": "Utilisation du disque USB via le partage"
+  },
+  "troubleshoot": {
+    "heading": "Dépannage",
+    "items": [
+      "<strong><code>pct reboot</code> échoue avec « device not found » :</strong> vérifiez que le chemin dans <code>mp0</code> existe sur l’hôte. Consultez <code>ls -l /dev/disk/by-id/</code> et corrigez le chemin.",
+      "<strong>Le conteneur démarre, mais <code>/mnt/lxc_USB</code> est vide :</strong> le disque peut ne pas être monté, ou son système de fichiers peut être vide. Vérifiez depuis l’hôte avec <code>pct exec '<'CTID'>' -- mount | grep lxc_USB</code>. Si le montage est absent, contrôlez sa configuration, le chemin du périphérique et les erreurs de démarrage.",
+      "<strong>L’authentification Samba réussit, mais l’écriture échoue avec « Permission denied » :</strong> vérifiez les droits Linux du répertoire et les réglages d’écriture du partage. Consultez <code>chown</code> et <code>setfacl</code> dans les sections 1.5 et 2.3.",
+      "<strong>Le partage reste invisible, mais <code>smb://'<'ip'>'/lxc_usb</code> fonctionne :</strong> l’ancienne découverte NetBIOS utilise <code>nmbd</code>. Windows moderne utilise WS-Discovery ; sur Debian 12, installez <code>apt-get install -y wsdd</code> ; sur Debian 13, où <code>wsdd</code> n’est pas dans l’archive stable, utilisez <code>apt-get install -y wsdd2</code>. Vérifiez le service et le pare-feu. Activer uniquement <code>nmbd</code> ne fournit pas WS-Discovery.",
+      "<strong>Pour ajouter un autre utilisateur au partage :</strong> créez le compte avec <code>adduser</code>, enregistrez-le avec <code>smbpasswd -a</code> et ajoutez-le à la liste <code>valid users =</code>, séparée par des virgules. Accordez aussi les droits ou ACL nécessaires sur le système de fichiers."
+    ]
+  }
+}
diff --git a/web/messages/fr/guides/nvidia-manual.json b/web/messages/fr/guides/nvidia-manual.json
new file mode 100644
index 00000000..e793e333
--- /dev/null
+++ b/web/messages/fr/guides/nvidia-manual.json
@@ -0,0 +1,165 @@
+{
+  "meta": {
+    "title": "Installer les pilotes NVIDIA sur Proxmox VE 9 — procédure manuelle | Guides ProxMenux",
+    "description": "Installer et configurer manuellement les pilotes NVIDIA sur un hôte Proxmox VE 9, puis donner accès au GPU à un ou plusieurs conteneurs LXC. Couvre les pilotes, le service de persistance, le correctif NVENC facultatif et la configuration de chaque conteneur.",
+    "ogTitle": "Installation des pilotes NVIDIA sur Proxmox VE 9 (procédure manuelle)",
+    "ogDescription": "Installer manuellement NVIDIA sur PVE 9 : pilote hôte, service de persistance, correctif NVENC facultatif et accès au GPU pour chaque conteneur LXC."
+  },
+  "header": {
+    "title": "Installation des pilotes de cartes graphiques NVIDIA sur Proxmox VE 9 (procédure manuelle)",
+    "description": "Installer et configurer manuellement les pilotes NVIDIA sur un hôte Proxmox VE 9, puis donner accès au GPU à un ou plusieurs conteneurs LXC. Couvre les pilotes, le service de persistance, le correctif NVENC facultatif et la configuration de chaque conteneur.",
+    "section": "Guides"
+  },
+  "intro": {
+    "calloutTitle": "Remarque",
+    "calloutBody": "Cette procédure manuelle est conservée comme référence. Pour la plupart des utilisateurs, préférez l’assistant ProxMenux : <strong>Installer les pilotes NVIDIA sur l’hôte</strong> dans <em>GPU et Coral-TPU</em>, puis <strong>Ajouter un GPU à LXC</strong> ou <strong>Ajouter un GPU à une VM</strong> pour configurer l’invité. L’assistant effectue ces étapes avec des vérifications supplémentaires des en-têtes du noyau, d’IOMMU et des conflits VFIO. Cette page aide à comprendre chaque commande ou à adapter la configuration.",
+    "targetNote": "Cible à <strong>Proxmox VE 9</strong> (Debian Trixie). PVE 7 (Bullseye) et PVE 8 (Bookworm) ne sont plus couverts.",
+    "stepsTitle": "Ce que vous allez faire",
+    "steps": [
+      "Préparer l’hôte Proxmox VE 9 : bloquer nouveau, vérifier les dépôts et les prérequis.",
+      "Installez le pilote NVIDIA sur l'hôte.",
+      "Installez le service de persistance NVIDIA.",
+      "Facultatif : appliquer le correctif keylase pour lever la limite de sessions NVENC simultanées sur les GPU grand public.",
+      "Donner accès au GPU à un ou plusieurs conteneurs LXC et installer la version du pilote correspondante dans chacun."
+    ]
+  },
+  "prepareHost": {
+    "heading": "1. Préparer l'hôte (PVE 9)",
+    "blacklistHeading": "1.1 Bloquer nouveau",
+    "blacklistBody": "Vérifiez si le pilote open source <code>nouveau</code> est déjà sur la liste noire:",
+    "blacklistCheckCode": "cat /etc/modprobe.d/blacklist.conf",
+    "blacklistAdd": "Si <code>blacklist nouveau</code> n'apparaît pas, ajoutez-le et redémarrez :",
+    "blacklistAddCode": "echo \"blacklist nouveau\" >> /etc/modprobe.d/blacklist.conf\nupdate-initramfs -u -k all\nreboot",
+    "blacklistImageAlt": "Vérification de la liste noire",
+    "reposHeading": "1.2 Vérifier les dépôts (PVE 9 / Trixie)",
+    "reposBody": "Les outils de post-installation ont peut-être déjà configuré les dépôts. Vérifiez d’abord les sources existantes et ignorez les modifications déjà effectuées ; ne créez pas de doublons.",
+    "reposOtherwise": "Sinon, sur une installation PVE 9 d’origine sans abonnement Enterprise :",
+    "reposEditCode": "nano /etc/apt/sources.list.d/proxmox.sources",
+    "reposPveBody": "Assurez-vous qu'il contient la source sans abonnement pour Trixie:",
+    "reposPveCode": "Types: deb\nURIs: http://download.proxmox.com/debian/pve\nSuites: trixie\nComponents: pve-no-subscription\nSigned-By: /usr/share/keyrings/proxmox-archive-keyring.gpg",
+    "reposDebianBody": "Et les sources Debian à <code>/etc/apt/sources.list.d/debian.sources</code> :",
+    "reposDebianCode": "Types: deb\nURIs: http://deb.debian.org/debian/\nSuites: trixie trixie-updates\nComponents: main contrib non-free non-free-firmware\nSigned-By: /usr/share/keyrings/debian-archive-keyring.gpg\n\nTypes: deb\nURIs: http://security.debian.org/debian-security/\nSuites: trixie-security\nComponents: main contrib non-free non-free-firmware\nSigned-By: /usr/share/keyrings/debian-archive-keyring.gpg",
+    "updateHeading": "1.3 Mettre à jour le système et installer les conditions préalables",
+    "updateCode": "apt update && apt dist-upgrade -y",
+    "buildToolsBody": "Installez les outils de compilation et les en-têtes du noyau nécessaires pour compiler le module du noyau NVIDIA:",
+    "buildToolsCode": "apt-get install -y git\napt-get install -qqy pve-headers-$(uname -r) gcc make"
+  },
+  "installDriver": {
+    "heading": "2. Installez le pilote NVIDIA sur l'hôte",
+    "pickHeading": "2.1 Choisir une version du pilote",
+    "pickBody": "Choisissez une branche de pilote compatible avec le GPU et le noyau utilisé. La plus récente peut exclure les anciens GPU ; vérifiez les produits pris en charge pour la version NVIDIA choisie :",
+    "pickUrlCode": "https://download.nvidia.com/XFree86/Linux-x86_64/latest.txt",
+    "nvencCallout": "Si vous prévoyez d'appliquer le correctif NVENC (étape 4), vérifiez que le correctif prend en charge la version du pilote choisie en premier: <patchLink>github.com/keylase/nvidia-patch</patchLink>",
+    "nvencCalloutTitle": "Attention",
+    "pickReplace": "Remplacez <code>latest.txt</code> dans l’URL par le numéro de version pour trouver l’installateur se terminant par <code>.run</code>. Liste complète des pilotes :",
+    "pickListCode": "https://download.nvidia.com/XFree86/Linux-x86_64/",
+    "pickImageAlt": "Téléchargement du pilote NVIDIA",
+    "pickVersionNote": "Dans le reste de ce guide, remplacer <code>'<'VERSION'>'</code> par la version actuelle (par exemple <code>580.95.05</code>).",
+    "downloadHeading": "2.2 Téléchargez et exécutez l'installateur",
+    "downloadCode": "mkdir -p /opt/nvidia\ncd /opt/nvidia\nwget https://download.nvidia.com/XFree86/Linux-x86_64/VERSION/NVIDIA-Linux-x86_64-VERSION.run\nchmod +x NVIDIA-Linux-x86_64-VERSION.run",
+    "firstPassBody": "Lancez l’installateur. L’option suivante peut désactiver <code>nouveau</code> si nécessaire ; un redémarrage peut être requis avant de terminer :",
+    "firstPassCode": "./NVIDIA-Linux-x86_64-VERSION.run --no-questions --ui=none --disable-nouveau\nreboot",
+    "secondPassBody": "Après le retour de l'hôte, exécutez à nouveau l'installateur pour compiler et installer le module noyau:",
+    "secondPassCode": "/opt/nvidia/NVIDIA-Linux-x86_64-VERSION.run --no-questions --ui=none",
+    "modulesHeading": "2.3 Charger les modules NVIDIA au démarrage",
+    "modulesBody": "Modifiez la configuration de chargement des modules :",
+    "modulesEditCode": "nano /etc/modules-load.d/modules.conf",
+    "modulesAddBody": "Ajoutez les modules NVIDIA pour l’hôte et LXC. Les modules VFIO servent au passthrough vers les VM et ne sont pas nécessaires ici :",
+    "modulesAddCode": "nvidia\nnvidia_uvm",
+    "modulesSaveBody": "Enregistrer (<code>Ctrl+X</code>) et reconstruire initramfs:",
+    "modulesSaveCode": "update-initramfs -u -k all",
+    "udevHeading": "2.4 Créer des règles udev",
+    "udevBody": "Pour créer les nœuds de périphérique <code>/dev/nvidia*</code> au chargement des modules :",
+    "udevEditCode": "nano /etc/udev/rules.d/70-nvidia.rules",
+    "udevRulesCode": "# /etc/udev/rules.d/70-nvidia.rules\nKERNEL==\"nvidia\", RUN+=\"/bin/bash -c '/usr/bin/nvidia-smi -L'\"\nKERNEL==\"nvidia_uvm\", RUN+=\"/bin/bash -c '/usr/bin/nvidia-modprobe -c0 -u'\"",
+    "udevSaveBody": "Enregistrer (<code>Ctrl+X</code>)."
+  },
+  "persistence": {
+    "heading": "3. Service de persistance NVIDIA",
+    "body": "Le service de persistance garde le GPU initialisé lorsqu’aucune autre application ne l’utilise. Il réduit la latence de réinitialisation et conserve cet état entre les clients :",
+    "installCode": "cd /opt/nvidia\ngit clone https://github.com/NVIDIA/nvidia-persistenced.git\ncd nvidia-persistenced/init\n./install.sh\nreboot",
+    "verifyBody": "Après redémarrage, vérifiez que le pilote est chargé et le service actif :",
+    "verifySmiCode": "nvidia-smi",
+    "smiImageAlt": "Sortie NVIDIA SMI",
+    "verifyServiceCode": "systemctl status nvidia-persistenced",
+    "serviceImageAlt": "État du service de persistance NVIDIA"
+  },
+  "nvenc": {
+    "heading": "4. Facultatif : lever la limite de sessions NVENC simultanées",
+    "body": "La limite de sessions NVENC dépend du GPU et du pilote. Consultez la matrice NVIDIA plutôt que de supposer un nombre par génération. Le correctif keylase supprime la limite logicielle pour les pilotes pris en charge et peut aider le transcodage Plex ou Jellyfin.",
+    "code": "cd /opt/nvidia\ngit clone https://github.com/keylase/nvidia-patch.git\ncd nvidia-patch\n./patch.sh",
+    "imageAlt": "Application du patch NVIDIA",
+    "after": "Réappliquez le correctif après chaque mise à jour du pilote. Le dépôt keylase contient aussi <code>patch-fbc.sh</code> pour FBC, la capture du tampon d’image."
+  },
+  "lxcSetup": {
+    "heading": "5. Configurer l’accès au GPU dans un conteneur LXC",
+    "identifyHeading": "5.1 Identifier les numéros d'appareil",
+    "identifyBody": "Sur l'hôte:",
+    "identifyCode": "ls -l /dev/nv*",
+    "identifyImageAlt": "Liste des appareils NVIDIA",
+    "identifyNote": "Notez les numéros majeurs des périphériques ; ils peuvent varier selon le système. Valeurs typiques :",
+    "tableHeaders": {
+      "device": "Appareil",
+      "major": "Numéro majeur typique"
+    },
+    "tableRows": [
+      {
+        "device": "<code>/dev/nvidia0</code>, <code>/dev/nvidiactl</code>",
+        "major": "195"
+      },
+      {
+        "device": "<code>/dev/nvidia-uvm</code>, <code>/dev/nvidia-uvm-tools</code>",
+        "major": "509 (variable)"
+      },
+      {
+        "device": "<code>/dev/dri/*</code>",
+        "major": "226"
+      },
+      {
+        "device": "<code>/dev/nvidia-modeset</code>",
+        "major": "195 (partagé avec nvidia)"
+      }
+    ],
+    "editHeading": "5.2 Modifier la configuration de LXC",
+    "editBody": "Arrêtez le conteneur s’il est actif. Ouvrez sa configuration en remplaçant <code>'<'CTID'>'</code> par son identifiant :",
+    "editCode": "nano /etc/pve/lxc/CTID.conf",
+    "editConfigBody": "Commentez uniquement les lignes <code>lxc.cgroup2.devices.allow</code> ou <code>/dev/dri</code> réellement conflictuelles. Ajoutez la configuration NVIDIA et adaptez les numéros majeurs aux périphériques NVIDIA affichés par <code>ls -l /dev/nv*</code> sur <strong>votre</strong> hôte :",
+    "editConfigCode": "lxc.cgroup2.devices.allow: c 195:* rwm\nlxc.cgroup2.devices.allow: c 509:* rwm\nlxc.mount.entry: /dev/nvidia0 dev/nvidia0 none bind,optional,create=file\nlxc.mount.entry: /dev/nvidiactl dev/nvidiactl none bind,optional,create=file\nlxc.mount.entry: /dev/nvidia-uvm dev/nvidia-uvm none bind,optional,create=file\nlxc.mount.entry: /dev/nvidia-modeset dev/nvidia-modeset none bind,optional,create=file\nlxc.mount.entry: /dev/nvidia-uvm-tools dev/nvidia-uvm-tools none bind,optional,create=file",
+    "editConfigImageAlt": "Configuration LXC",
+    "editSave": "Enregistrer (<code>Ctrl+X</code>) et démarrer le conteneur.",
+    "installCtHeading": "5.3 Installez le pilote dans le conteneur",
+    "installCtCalloutTitle": "Important",
+    "installCtCalloutBody": "Cette partie s’exécute <strong>dans le conteneur</strong>, pas sur l’hôte.",
+    "installCtBody": "Le module du noyau est déjà chargé sur l’hôte. Le conteneur a seulement besoin des bibliothèques de l’espace utilisateur correspondant à la même version du pilote :",
+    "installCtCode": "mkdir -p /opt/nvidia\ncd /opt/nvidia\nwget https://download.nvidia.com/XFree86/Linux-x86_64/VERSION/NVIDIA-Linux-x86_64-VERSION.run\nchmod +x NVIDIA-Linux-x86_64-VERSION.run\n./NVIDIA-Linux-x86_64-VERSION.run --no-kernel-module",
+    "installCtAfter": "Lisez les demandes et limitez cette installation aux bibliothèques de l’espace utilisateur. Ne compilez ni n’installez de module du noyau dans LXC.",
+    "installCtImageAlt": "Installation du pilote NVIDIA",
+    "verifyCtHeading": "5.4 Vérifier dans le conteneur",
+    "verifyCtSmiCode": "nvidia-smi",
+    "verifyCtSmiImageAlt": "NVIDIA SMI dans LXC",
+    "verifyCtLsCode": "ls -l /dev/nv*",
+    "verifyCtLsImageAlt": "Dispositifs NVIDIA dans LXC",
+    "verifyCtAfter": "Le GPU devrait être listé et ses nœuds de périphérique présents dans le système de fichiers du conteneur.",
+    "workloadHeading": "5.5 Vérifier l’utilisation du GPU avec une charge réelle",
+    "workloadBody": "Activez l’accélération NVIDIA dans Plex ou Jellyfin, lancez un transcodage et vérifiez l’utilisation réelle du GPU dans le tableau de bord ou les journaux. Installer le pilote ne l’active pas automatiquement dans l’application.",
+    "workloadImage1Alt": "Plex utilisant NVIDIA GPU",
+    "workloadImage2Alt": "Plex utilisant NVIDIA GPU - session active",
+    "repeatNote": "Répétez la <strong>section 5</strong> pour chaque conteneur ayant besoin du GPU. Lors d’une mise à jour du pilote hôte, maintenez les bibliothèques de chaque conteneur à la version correspondante."
+  },
+  "docker": {
+    "heading": "6. (facultatif) NVIDIA Docker à l'intérieur d'un LXC",
+    "body": "Si Docker fonctionne déjà dans LXC, installez-y <code>nvidia-container-toolkit</code> pour donner accès au GPU à ses conteneurs Docker. L’accès au GPU depuis LXC doit déjà fonctionner. Ces commandes concernent Docker exécuté avec les droits root :",
+    "code": "apt-get update\napt-get install -y ca-certificates curl gnupg\ncurl -fsSL https://nvidia.github.io/libnvidia-container/gpgkey | gpg --dearmor --yes -o /usr/share/keyrings/nvidia-container-toolkit-keyring.gpg\ncurl -fsSL https://nvidia.github.io/libnvidia-container/stable/deb/nvidia-container-toolkit.list | sed 's#deb https://#deb [signed-by=/usr/share/keyrings/nvidia-container-toolkit-keyring.gpg] https://#g' > /etc/apt/sources.list.d/nvidia-container-toolkit.list\napt-get update\napt-get install -y nvidia-container-toolkit\nnvidia-ctk runtime configure --runtime=docker\nsystemctl restart docker",
+    "after": "Ces commandes configurent le dépôt NVIDIA, installent le toolkit, configurent le runtime Docker et redémarrent Docker. Les droits sur les périphériques et restrictions cgroup de LXC restent applicables ; vérifiez le GPU avec une charge de test."
+  },
+  "troubleshoot": {
+    "heading": "Dépannage",
+    "items": [
+      "<strong><code>nvidia-smi</code> fonctionne sur l’hôte, mais affiche « No devices found » dans le conteneur :</strong> vérifiez les montages, droits et versions des bibliothèques. Si elles diffèrent, installez la même <code>'<'VERSION'>'</code> que l’hôte avec <code>--no-kernel-module</code>.",
+      "<strong>La compilation du pilote échoue :</strong> consultez le journal. « No precompiled kernel interface was found » peut simplement annoncer une compilation locale. Installez les en-têtes correspondant à <code>uname -r</code> avec <code>apt-get install pve-headers-$(uname -r)</code>, ou le paquet proxmox-headers équivalent.",
+      "<strong>Les sessions NVENC restent limitées :</strong> vérifiez que le correctif prend en charge le pilote actif. Une mise à jour peut l’écraser. Pour une version compatible, réappliquez <code>./patch.sh</code> depuis <code>/opt/nvidia/nvidia-patch</code> et consultez sa sortie.",
+      "<strong>Le GPU ne répond plus après une période d’inactivité :</strong> vérifiez <code>systemctl status nvidia-persistenced</code> et activez le service si nécessaire. Consultez aussi les journaux du noyau et du pilote : ce n’est pas la seule cause possible.",
+      "<strong>Le conteneur démarre, mais <code>ls /dev/nv*</code> n’affiche aucun périphérique NVIDIA :</strong> vérifiez les montages bind et chemins sur l’hôte. Utilisez <code>ls -l /dev/nv*</code> pour vérifier les numéros majeurs NVIDIA, puis les règles <code>lxc.cgroup2.devices.allow</code> et les droits."
+    ]
+  }
+}
diff --git a/web/messages/it/common.json b/web/messages/it/common.json
new file mode 100644
index 00000000..659c356d
--- /dev/null
+++ b/web/messages/it/common.json
@@ -0,0 +1,254 @@
+{
+  "site": {
+    "name": "ProxMenux",
+    "tagline": "Menu interattivo e dashboard web per Proxmox VE"
+  },
+  "nav": {
+    "home": "Home",
+    "docs": "Documentazione",
+    "documentation": "Documentazione",
+    "guides": "Guide",
+    "changelog": "Registro delle modifiche",
+    "github": "GitHub",
+    "rss": "RSS",
+    "rssTitle": "Feed RSS",
+    "menuOpen": "Apri menu"
+  },
+  "footer": {
+    "sponsorHeading": "Sostieni il progetto",
+    "sponsorBody": "Se desideri sostenere il progetto.",
+    "sponsorAlt": "Sostienimi su Ko-fi",
+    "connectHeading": "Community",
+    "connectBody": "Partecipa alle discussioni della community su GitHub per ricevere aiuto, condividere idee e contribuire al progetto. Ogni idea è benvenuta!",
+    "joinDiscussion": "Partecipa alla discussione",
+    "copyrightPrefix": "ProxMenux, un progetto collaborativo e open source di",
+    "copyrightSuffix": "."
+  },
+  "language": {
+    "switcher": "Lingua",
+    "en": "English",
+    "es": "Español",
+    "sk": "Slovenčina",
+    "de": "Deutsch",
+    "fr": "Français",
+    "it": "Italiano",
+    "pt": "Português",
+    "sv": "Svenska"
+  },
+  "resources": {
+    "documentation": {
+      "title": "Documentazione",
+      "description": "Descrizione del sistema e guide per l’utente"
+    },
+    "changelog": {
+      "title": "Registro delle modifiche",
+      "description": "Informazioni sugli ultimi aggiornamenti"
+    },
+    "guides": {
+      "title": "Guide",
+      "description": "Tutorial e guide passo passo per le attività più comuni"
+    },
+    "github": {
+      "title": "Repository GitHub",
+      "description": "Esplora il codice sorgente."
+    }
+  },
+  "docSidebar": {
+    "documentation": "Documentazione",
+    "items": {
+      "introduction": "Introduzione",
+      "installation": "Installazione",
+      "proxmenuxMonitor": "ProxMenux Monitor",
+      "monitorOverview": "Panoramica",
+      "architecture": "Architettura",
+      "accessAuth": "Accesso e autenticazione",
+      "dashboard": "Dashboard",
+      "dashboardSystemOverview": "Scheda Panoramica del sistema",
+      "dashboardApps": "Scheda App",
+      "dashboardStorage": "Scheda Archiviazione",
+      "dashboardNetwork": "Scheda Rete",
+      "dashboardVmsLxcs": "Scheda VM e LXC",
+      "dashboardVmsLxcsApp": "App",
+      "dashboardVmsLxcsUpdates": "Aggiornamenti",
+      "dashboardHardware": "Scheda Hardware",
+      "dashboardSystemLogs": "Scheda Log di sistema",
+      "dashboardTerminal": "Scheda Terminale",
+      "dashboardSecurity": "Scheda Sicurezza",
+      "dashboardSettings": "Scheda Impostazioni",
+      "healthMonitor": "Monitoraggio dello stato",
+      "auditReport": "Verifica e report",
+      "auditReportOverview": "Panoramica",
+      "auditReportAssessment": "Valutazione e inventario",
+      "auditReportPolicy": "Criteri",
+      "auditReportChanges": "Modifiche",
+      "auditReportReports": "Report e confronti",
+      "auditReportScope": "Ambito e garanzie",
+      "notifications": "Notifiche",
+      "aiAssistant": "Assistente IA",
+      "apiReference": "Riferimento API",
+      "integrations": "Integrazioni",
+      "ociManager": "OCI manager Apps",
+      "ociOverview": "Panoramica",
+      "ociArchitecture": "Come viene adattata un’immagine OCI",
+      "ociCustomImage": "Immagine non presente nel catalogo",
+      "ociStorageNetwork": "Dati, percorsi e rete",
+      "ociHardware": "Dispositivi e accelerazione",
+      "ociStacks": "Applicazioni con più container",
+      "ociLifecycle": "Installazione, aggiornamento e modifica",
+      "ociMonitor": "In ProxMenux Monitor",
+      "proxmenuxScripts": "ProxMenux Scripts",
+      "postInstallScript": "Script di post-installazione",
+      "postInstallOverview": "Panoramica",
+      "postInstallAutomated": "Automatico",
+      "postInstallCustomizable": "Personalizzabile",
+      "postInstallBasicSettings": "Impostazioni di base",
+      "postInstallSystem": "Sistema",
+      "postInstallVirtualization": "Virtualizzazione",
+      "postInstallNetwork": "Rete",
+      "postInstallStorage": "Archiviazione",
+      "postInstallSecurity": "Sicurezza",
+      "postInstallCustomization": "Personalizzazione",
+      "postInstallMonitoring": "Monitoraggio",
+      "postInstallPerformance": "Prestazioni",
+      "postInstallOptional": "Facoltativo",
+      "postInstallUpdates": "Applica gli aggiornamenti disponibili",
+      "postInstallUninstall": "Rimuovi le ottimizzazioni",
+      "gpusCoralTpu": "GPU e Coral TPU",
+      "nvidiaHost": "Installa i driver NVIDIA sull’host",
+      "coralHost": "Installa Coral TPU sull’host",
+      "addGpuLxc": "Abilita una GPU in un LXC",
+      "addCoralLxc": "Abilita Coral TPU in un LXC",
+      "addGpuVm": "Assegna una GPU a una VM (passthrough)",
+      "switchGpuMode": "Cambia modalità GPU (VM ↔ LXC)",
+      "createVm": "Crea una VM",
+      "createVmOverview": "Panoramica",
+      "createVmSystemNas": "Sistemi NAS",
+      "createVmSynology": "VM Synology",
+      "createVmNasOthers": "Altri sistemi NAS",
+      "createVmSystemWindows": "Sistemi Windows",
+      "createVmSystemLinux": "Sistemi Linux",
+      "diskManager": "Gestione dischi",
+      "diskManagerOverview": "Panoramica",
+      "diskImportVm": "Importa un disco in una VM",
+      "diskImportImageVm": "Importa un’immagine disco in una VM",
+      "diskAddController": "Aggiungi un controller o un dispositivo NVMe a una VM",
+      "diskImportLxc": "Importa un disco in un LXC",
+      "diskFormat": "Formatta o cancella un disco fisico",
+      "diskSmart": "Stato SMART e test del disco",
+      "storageShareManager": "Gestione archiviazione e condivisioni",
+      "storageShareOverview": "Panoramica",
+      "hostStorage": "Integrazione dell’archiviazione nell’host",
+      "hostNfs": "Aggiungi una condivisione NFS come storage Proxmox",
+      "hostSamba": "Aggiungi una condivisione Samba come storage Proxmox",
+      "hostIscsi": "Aggiungi una destinazione iSCSI come storage Proxmox",
+      "hostLocalDisk": "Aggiungi un disco locale come storage Proxmox",
+      "hostLocalShared": "Crea una directory condivisa sull’host",
+      "lxcMountPoints": "Punti di montaggio LXC (host ↔ CT)",
+      "lxcNetworkSharing": "Condivisioni di rete in LXC",
+      "lxcNfsClient": "Client NFS in LXC",
+      "lxcSambaClient": "Client Samba in LXC",
+      "lxcNfsServer": "Server NFS in LXC",
+      "lxcSambaServer": "Server Samba in LXC",
+      "network": "Rete",
+      "networkOverview": "Panoramica",
+      "networkDiagnostics": "Diagnostica",
+      "networkMonitoring": "Strumenti di monitoraggio in tempo reale",
+      "networkBridge": "Analisi e riparazione dei bridge di rete",
+      "networkConfig": "Analisi e pulizia della configurazione",
+      "networkPersistent": "Nomi persistenti delle interfacce",
+      "networkBackup": "Backup e riavvio delle interfacce",
+      "security": "Sicurezza",
+      "securityOverview": "Panoramica",
+      "securityFail2ban": "Fail2Ban",
+      "securityLynis": "Lynis",
+      "utilities": "Utilità",
+      "utilsOverview": "Panoramica",
+      "utilsUupDump": "Creazione di ISO con UUP Dump",
+      "utilsSystemUtils": "Installazione di utilità di sistema",
+      "utilsSystemUpdate": "Aggiornamento del sistema Proxmox",
+      "utilsUpgradePve": "Passaggio da PVE 8 a PVE 9",
+      "utilsExportVm": "Esporta una VM in OVA/OVF",
+      "utilsImportVm": "Importa una VM da OVA/OVF",
+      "settingsProxmenux": "Impostazioni di ProxMenux",
+      "settingsOverview": "Panoramica",
+      "settingsMonitor": "ProxMenux Monitor",
+      "settingsBeta": "Cambia canale di rilascio",
+      "settingsVersion": "Mostra informazioni sulla versione",
+      "settingsUninstall": "Disinstalla ProxMenux",
+      "commandsReference": "Riferimento dei comandi",
+      "commandsOverview": "Panoramica",
+      "commandsSystem": "Comandi di sistema utili",
+      "commandsVmCt": "Gestione di VM e CT",
+      "commandsStorage": "Archiviazione e dischi",
+      "commandsNetwork": "Comandi di rete",
+      "commandsUpdates": "Aggiornamenti e pacchetti",
+      "commandsGpu": "Passthrough GPU",
+      "commandsZfs": "Gestione di ZFS",
+      "commandsBackup": "Backup e ripristino",
+      "commandsTools": "Strumenti di sistema da riga di comando",
+      "glossary": "Glossario",
+      "about": "Informazioni sul progetto",
+      "aboutOverview": "Panoramica",
+      "aboutFaq": "FAQ",
+      "aboutContributors": "Collaboratori",
+      "aboutContributing": "Come contribuire",
+      "aboutCodeOfConduct": "Codice di condotta",
+      "externalRepositories": "Repository esterni",
+      "backupRestore": "Backup e ripristino",
+      "backupRestoreOverview": "Panoramica",
+      "backupRestoreHowItWorks": "Come funziona",
+      "backupRestoreDestinations": "Destinazioni",
+      "backupRestoreDestOverview": "Panoramica",
+      "backupRestoreDestLocal": "Archivio locale",
+      "backupRestoreDestPbs": "Proxmox Backup Server",
+      "backupRestoreDestBorg": "Borg",
+      "backupRestoreCreating": "Creare backup",
+      "backupRestoreJobs": "Attività pianificate",
+      "backupRestoreRestoring": "Ripristino",
+      "backupRestoreCrossKernel": "Ripristino tra versioni del kernel",
+      "backupRestoreGlossary": "Glossario"
+    }
+  },
+  "hero": {
+    "title": "ProxMenux",
+    "tagline": "Un menu interattivo e una dashboard web per Proxmox VE",
+    "description": "ProxMenux unisce un menu interattivo e una dashboard web per Proxmox VE. Esegui comandi, script e procedure guidate dal terminale oppure controlla lo stato dell’host, le metriche e le notifiche dal browser.",
+    "installButton": "Installa ora",
+    "whatIsButton": "Che cos’è ProxMenux?",
+    "logoAlt": "Logo di ProxMenux"
+  },
+  "docNav": {
+    "previous": "Precedente",
+    "next": "Successivo"
+  },
+  "tocPanel": {
+    "onThisPage": "In questa pagina"
+  },
+  "supportProject": {
+    "heading": "Sostieni il progetto!",
+    "body": "Se <strong>ProxMenux</strong> ti è utile, lascia una ⭐ su GitHub per aiutare altre persone a scoprirlo.",
+    "button": "Lascia una stella su GitHub"
+  },
+  "rssLink": {
+    "heading": "Resta aggiornato!",
+    "body": "Iscriviti al feed RSS per ricevere le novità.",
+    "copy": "Copia",
+    "copied": "Copiato!",
+    "copyTitle": "Copia l’URL del feed RSS",
+    "openFeed": "Apri il feed RSS",
+    "openTitle": "Apri il feed RSS"
+  },
+  "changelog": {
+    "pageTitle": "Registro delle modifiche",
+    "meta": {
+      "title": "Registro delle modifiche di ProxMenux",
+      "titleSuffix": "Note di rilascio",
+      "latest": "Ultima versione",
+      "mostRecent": "Versione più recente",
+      "description": "Note di rilascio e cronologia degli aggiornamenti di ProxMenux, lo script a menu per gestire Proxmox VE.",
+      "descriptionTail": "Nuove funzionalità, correzioni di bug, aggiornamenti di sicurezza, miglioramenti di ProxMenux Monitor, compatibilità con i fornitori IA, maggiore sicurezza del passthrough GPU e altro.",
+      "ogDescription": "Note di rilascio di ProxMenux.",
+      "ogTail": "Iscriviti al feed RSS o torna su questa pagina per le nuove versioni."
+    }
+  }
+}
diff --git a/web/messages/it/docs/about/code-of-conduct.json b/web/messages/it/docs/about/code-of-conduct.json
new file mode 100644
index 00000000..e452eda3
--- /dev/null
+++ b/web/messages/it/docs/about/code-of-conduct.json
@@ -0,0 +1,13 @@
+{
+  "meta": {
+    "title": "Codice di condotta | Documentazione ProxMenux",
+    "description": "Codice di condotta e buone pratiche di ProxMenux per collaboratori, tester e utenti.",
+    "ogTitle": "Codice di condotta | Documentazione ProxMenux",
+    "ogDescription": "Aspettative sulla responsabilità del codice, sulla segnalazione delle vulnerabilità e sull’ambito delle PR nel progetto ProxMenux."
+  },
+  "errors": {
+    "notFound": "Errore: file CODE_OF_CONDUCT.md non trovato.",
+    "loadFailed": "Errore: impossibile caricare il contenuto del codice di condotta."
+  },
+  "contentMarkdown": "# 📝 Codice di condotta e buone pratiche\n\nQuesto documento definisce i **principi e le linee guida** per l’uso di **ProxMenux**, promuovendo **rispetto, collaborazione e sicurezza** nello sviluppo.\n\n## 📌 1. Attribuzione del codice e riconoscimenti\n\n- Se si usano **script, frammenti di codice o idee** di altri repository o sviluppatori, l’autore originale verrà sempre citato.\n- Un commento nel codice o nella documentazione indicherà la fonte e, se possibile, un collegamento al repository originale.\n- Quando si utilizza codice con una **licenza** specifica, occorre rispettarne le condizioni.\n\n### ✅ Esempio di attribuzione corretta nel codice:\n\n```bash\n# Script basato sul lavoro di [Autore] in [Link al repository]\n```\n\n## 🔒 2. Sicurezza e responsabilità del codice\n\n- Tutto il codice di questo repository segue le buone pratiche di sviluppo sicuro.\n- Non sono ammessi contributi che introducano vulnerabilità intenzionali o pratiche non sicure.\n- Gli script non devono mai compromettere la sicurezza del sistema o i dati degli utenti.\n- Prima dell’implementazione, i contributi vanno revisionati per verificarne sicurezza e stabilità.\n\n### ⚠️ Divulgazione responsabile delle vulnerabilità\n\nSe scopri una vulnerabilità di sicurezza, NON segnalarla in issue o forum pubblici.\n\nComunicala invece in privato tramite e-mail:\n\n📧 proxmenux@macrimi.pro\n\nPer maggiori informazioni sulle vulnerabilità e su come segnalarle, consulta la nostra [politica di sicurezza](./SECURITY.md).\n\n## 🤝 3. Regole della comunità\n\nPer mantenere un ambiente rispettoso e professionale, tutti gli utenti devono seguire queste regole:\n\n- ✅ Mantieni un atteggiamento rispettoso e costruttivo nelle discussioni.\n- ❌ Non saranno tollerati molestie, discorsi d’odio o comportamenti offensivi.\n- ✅ Fornisci riscontri in modo professionale, evitando attacchi personali.\n- ❌ Le violazioni possono comportare avvertimenti o esclusioni, in base alla gravità.\n\n##\n\nQuesto documento promuove l’uso etico del codice, la consapevolezza della sicurezza e una comunità rispettosa.\n\n📢 Costruiamo insieme qualcosa di straordinario!\n"
+}
diff --git a/web/messages/it/docs/about/contributing.json b/web/messages/it/docs/about/contributing.json
new file mode 100644
index 00000000..58d394ec
--- /dev/null
+++ b/web/messages/it/docs/about/contributing.json
@@ -0,0 +1,293 @@
+{
+  "meta": {
+    "title": "Contributo a ProxMenux | Documentazione ProxMenux",
+    "description": "Come contribuire a ProxMenux: modello dei rami (main / develop / feature/*), procedura delle pull request, intestazione con autore e link di sostegno facoltativo, interfaccia in due fasi, funzioni dei messaggi e passaggio da un ramo di funzionalità a una versione stabile.",
+    "ogTitle": "Contributi a ProxMenux",
+    "ogDescription": "Modello dei rami, procedura, attribuzione nell’intestazione e regola dell’interfaccia in due fasi per chi contribuisce."
+  },
+  "header": {
+    "title": "Contributi a ProxMenux",
+    "description": "ProxMenux è aperto ai contributi comunitari — nuovi script, correzioni per quelli esistenti, miglioramenti di dialogo, traduzioni, integrazioni. Questa pagina è la porta formale: come il repository è strutturato, il modello di ramificazione e il flusso di lavoro di pull-request, l'intestazione dello script con attribuzione dell'autore e link di sponsor opzionale, e le convenzioni di progettazione ogni contributo deve seguire.",
+    "section": "Informazioni"
+  },
+  "twoPagesCallout": {
+    "title": "Due pagine correlate, un progetto",
+    "body": "Non confondere questa pagina con <contributorsLink>Collaboratori</contributorsLink>, che riconosce il lavoro di tester, revisori e sviluppatori già coinvolti. Questa pagina è per <em>te</em>, futuro collaboratore, e spiega come preparare una pull request da integrare."
+  },
+  "branching": {
+    "heading": "Modello di ramificazione",
+    "intro": "ProxMenux utilizza un modello di ramificazione a tre livelli:",
+    "headerBranch": "Ramo",
+    "headerPurpose": "Scopo",
+    "rows": [
+      {
+        "branch": "main",
+        "purposeRich": "Codice stabile, pronto per la produzione. Qui vengono integrate solo modifiche pronte per il rilascio. È la versione ricevuta con un’installazione normale di ProxMenux."
+      },
+      {
+        "branch": "develop",
+        "purposeRich": "Ramo di sviluppo attivo. Il nuovo lavoro viene integrato prima qui: è il canale beta. Quando una versione stabile è pronta, viene trasferita da qui a <code>main</code>."
+      },
+      {
+        "branch": "feature/*",
+        "purposeRich": "Rami temporanei per una funzionalità, una correzione o un miglioramento. Creati da <code>develop</code> e reintegrati in <code>develop</code> tramite pull request dopo la revisione."
+      }
+    ],
+    "calloutTitle": "Ciò significa per gli utenti",
+    "calloutBody": "Chi segue <code>main</code> riceve versioni testate. Chi vuole prima le novità e accetta qualche imperfezione può seguire <code>develop</code>. Le nuove funzioni passano sempre prima da <code>develop</code>; nulla arriva in <code>main</code> senza questo ciclo."
+  },
+  "workflow": {
+    "heading": "Procedura delle pull request",
+    "intro": "Dall'idea alla fusione del rilascio in cinque fasi:",
+    "step1Lead": "<strong>Crea un ramo per la funzionalità da <code>develop</code></strong>:",
+    "step1Code": "git clone https://github.com/MacRimi/ProxMenux.git\ncd ProxMenux\ngit checkout develop\ngit pull origin develop\ngit checkout -b feature/your-feature-name",
+    "step1Trail": "Utilizzare un nome di ramo descrittivo: <code>feature/zfs-arc-tuning</code>, <code>feature/fix-iommu-detection</code>, <code>feature/add-tailscale-script</code>.",
+    "step2Lead": "<strong>Lavora alle modifiche e pubblica il ramo:</strong>",
+    "step2Code": "# Make your changes, then:\ngit add scripts/...\ngit commit -m \"Add ZFS ARC tuning script\"\ngit push -u origin feature/your-feature-name",
+    "step3": "<strong>Apri una pull request verso <code>develop</code></strong>, non verso <code>main</code>. Su GitHub verifica che il ramo di base sia <code>develop</code>. Descrivi cosa fa e modifica lo script e su quali versioni di Proxmox VE è stato testato.",
+    "step4": "<strong>Dopo la revisione le modifiche vengono integrate in <code>develop</code>.</strong> Un manutentore verifica codice, intestazione e interfaccia in due fasi. Se richiede modifiche, aggiungi commit allo stesso ramo: la PR si aggiorna automaticamente.",
+    "step5": "<strong>Le versioni stabili passano da <code>develop</code> a <code>main</code>.</strong> Al rilascio, <code>main</code> viene portato a <code>develop</code> con un fast-forward e riceve un tag. Il tuo contributo entra nella prossima versione stabile."
+  },
+  "scriptHeader": {
+    "heading": "Intestazione script — metadati & descrizione",
+    "intro": "Ogni script ProxMenux inizia con due blocchi di commenti adiacenti che formano l’intestazione. Sono <strong>entrambi obbligatori</strong>: indicano autore e scopo senza dover leggere il corpo del codice.",
+    "bullets": [
+      "<strong>Blocco superiore: metadati.</strong> Autore, link GitHub/di sostegno facoltativi, manutentore, copyright, licenza, versione e data di aggiornamento. Qui avviene il <em>riconoscimento dei collaboratori</em>: per un nuovo script inserisci il tuo nome e, facoltativamente, la pagina GitHub e un profilo come Ko-fi, GitHub Sponsors o Buy Me a Coffee.",
+      "<strong>Blocco inferiore: descrizione.</strong> Un breve paragrafo in inglese semplice spiega il compito dello script. Si legge <em>prima</em> del codice e deve chiarire da solo scopo, azioni principali, risorse coinvolte e prerequisiti."
+    ],
+    "licenseCalloutTitle": "La linea di licenza è fissa — GPL-3.0",
+    "licenseCalloutBody": "ProxMenux è pubblicato sotto <strong>GNU General Public License v3.0</strong>. Tutti gli script usano la stessa licenza: la riga <code>License</code> nell’intestazione deve essere il riferimento GPL-3.0 dell’esempio seguente, non una scelta per singolo script. Contribuendo accetti il rilascio sotto GPL-3.0: chiunque può leggere, modificare e ridistribuire lo script e le modifiche mantenendo la stessa licenza. Testo completo: <licenseLink>MacRimi/ProxMenux/LICENSE</licenseLink>.",
+    "templateCode": "#!/bin/bash\n\n# ==========================================================\n# ProxMenux - A menu-driven script for Proxmox VE management\n# ==========================================================\n# Author      : Your Name\n# GitHub      : github.com/yourhandle\n# Sponsor     : ko-fi.com/yourhandle\n# Maintainer  : MacRimi\n# Copyright   : (c) 2026 MacRimi & contributors\n# License     : (GPL-3.0) (https://github.com/MacRimi/ProxMenux/blob/main/LICENSE)\n# Version     : 1.0\n# Last Updated: DD/MM/YYYY\n# ==========================================================\n# Description:\n# Short paragraph explaining what the script does.\n# Mention the main actions (e.g. \"creates a ZFS pool\",\n# \"configures IOMMU and reboots\", \"imports an ISO into a VM\"),\n# the resources it touches, and any prerequisites the user\n# should be aware of before running it.\n# ==========================================================",
+    "optionalNote": "Le linee <code>GitHub</code> e <code>Sponsor</code> sono facoltative: lasciatele fuori se non volete pubblicarle. Tutto il resto è richiesto.",
+    "whyCalloutTitle": "Perché questo è importante",
+    "whyCalloutBody": "Contribuire all’open source è un lavoro volontario. Il nome e l’eventuale link di sostegno nel codice rendono visibile l’autore a ogni lettura, senza nasconderlo dietro il progetto. La descrizione ha un altro scopo: è la prima cosa letta da un futuro manutentore o utente curioso. La sua chiarezza spesso determina se ci si fida dello script o lo si evita."
+  },
+  "structure": {
+    "heading": "Struttura del progetto",
+    "intro": "Dove ogni tipo di script vive nel repository:",
+    "treeCode": "scripts/\n├── menus/              # Top-level menu scripts (entry points)\n├── storage/            # Disk, storage and passthrough scripts\n├── share/              # NFS, Samba, local share scripts\n├── vm/                 # VM creation and configuration scripts\n├── gpu_tpu/            # GPU / TPU passthrough scripts\n├── post_install/       # Post-install automation scripts\n├── backup_restore/     # Backup and restore scripts\n├── utilities/          # System utility scripts\n├── global/             # Shared helper libraries (sourced by other scripts)\n├── utils.sh            # Shared utility functions and message helpers\n└── help_info_menu.sh   # Interactive help and command reference",
+    "outro": "Ogni script carica <code>utils.sh</code> all’avvio tramite source per avere funzioni dei messaggi, indicatore di attesa, colori e sistema di traduzione. Le librerie condivise in <code>scripts/global/</code> vengono caricate esplicitamente dagli script che ne hanno bisogno."
+  },
+  "twoPhase": {
+    "heading": "La politica di progettazione dell'interfaccia utente bifase",
+    "intro": "È la convenzione più importante di ProxMenux e quella per cui vengono richieste più spesso correzioni alle PR. Ogni script è diviso in <strong>esattamente due fasi</strong>:",
+    "headerPhase": "Fase",
+    "headerPurpose": "Scopo",
+    "headerScreen": "Stato dello schermo",
+    "rows": [
+      {
+        "phaseRich": "<strong>Phase 1 — Selezione</strong>",
+        "purposeRich": "Raccogliere ogni decisione dell'utente. Eseguire qualsiasi lavoro preparatorio necessario (sonde, scansioni, controlli).",
+        "screenRich": "Finestre <code>dialog</code>. Se una verifica tra due menu richiede più di uno o due secondi, mostra l’indicatore di attesa <code>msg_info</code> perché l’utente sappia che lo script non è bloccato, poi chiama <code>stop_spinner</code> subito prima del prossimo dialogo."
+      },
+      {
+        "phaseRich": "<strong>Phase 2 — Esecuzione</strong>",
+        "purposeRich": "Eseguire ogni operazione. Visualizza la storia del progresso completo che si accumula sullo schermo.",
+        "screenRich": "Messaggi <code>msg_info</code> / <code>msg_ok</code> visibili; mai <code>dialog</code>."
+      }
+    ],
+    "principle": "Il principio è <strong>raccogliere prima tutte le scelte, poi eseguire tutto</strong>. L’utente vede prima menu ordinati con dialoghi (fase 1), poi una vista di esecuzione come un log (fase 2). Le fasi non si mescolano: niente dialoghi durante l’esecuzione né messaggi di avanzamento durante la selezione.",
+    "phase1Heading": "Fase 1 — modello tipico",
+    "phase1Code": "# Silent preparatory work between dialogs\nmsg_info \"$(translate \"Checking disk assignments...\")\"\nASSIGNED_TO=$(check_assignments \"$DISK\")\nstop_spinner   # ← clears line silently, result saved in variable\n\n# Next dialog can now use ASSIGNED_TO\nif [ -n \"$ASSIGNED_TO\" ]; then\n    dialog --yesno \"$(translate \"Disk already assigned. Continue?\")\" $UI_YESNO_H $UI_YESNO_W\nfi\n\n# Collect multiple decisions per item with parallel arrays\ndeclare -a DISK_LIST=()\ndeclare -a DISK_FORMAT_TYPES=()\ndeclare -a DISK_MOUNT_POINTS=()\nfor DISK in $SELECTED; do\n    msg_info \"$(translate \"Analyzing disk...\")\"\n    CURRENT_FS=$(lsblk -no FSTYPE \"$DISK\" | xargs)\n    stop_spinner\n\n    FORMAT=$(dialog --backtitle \"$BACKTITLE\" \\\n        --title \"$(translate \"Select Filesystem\")\" \\\n        --menu \"...\" $UI_SHORT_MENU_H $UI_SHORT_MENU_W $UI_SHORT_MENU_LIST_H \\\n        \"ext4\" \"...\" \"xfs\" \"...\" \"btrfs\" \"...\" \\\n        2>&1 >/dev/tty)\n    [ -z \"$FORMAT\" ] && continue\n\n    DISK_LIST+=(\"$DISK\")\n    DISK_FORMAT_TYPES+=(\"$FORMAT\")\ndone",
+    "phase1RulesIntro": "<strong>Regole per la fase 1:</strong>",
+    "phase1Rules": [
+      "Se è attivo un indicatore <code>msg_info</code> e devi aprire un menu <code>dialog</code> o <code>whiptail</code>, chiama prima <code>stop_spinner</code>: l’indicatore non può convivere con l’overlay dei due strumenti. Se nessun indicatore è attivo, la chiamata non serve.",
+      "Usa <code>show_proxmenux_logo</code> + <code>msg_title</code> + <code>msg_info</code> per dare un contesto visivo a un’operazione lunga nella fase 1, ad esempio una verifica di oltre cinque secondi. La funzione pulisce già lo schermo: non chiamare prima <code>clear</code>.",
+      "Non chiamare <code>show_proxmenux_logo</code> tra i menu di dialogo in cui non c'è nulla da mostrare — cancellare lo schermo per un terminale vuoto è solo rumore visivo.",
+      "Conservare tutte le decisioni e i risultati della sonda in variabili o array paralleli. Il recap visibile avviene all'inizio della fase 2, non in fase 1."
+    ],
+    "phase2Heading": "Fase 2 — modello tipico",
+    "phase2Code": "# ── PHASE 2 — EXECUTION ─────────────────────────────\nshow_proxmenux_logo\nmsg_title \"$(translate \"My Script Title\")\"\n\n# Recap Phase 1 preparatory results — show what was already done\nmsg_ok \"$(translate \"CT $CTID selected.\")\"\nmsg_ok \"$(translate \"Repositories verified.\")\"\nmsg_ok \"$(translate \"Disks to process: ${#DISK_LIST[@]}\")\"\n\n# Now execute operations\nfor i in \"${!DISK_LIST[@]}\"; do\n    DISK=\"${DISK_LIST[$i]}\"\n    FORMAT=\"${DISK_FORMAT_TYPES[$i]}\"\n\n    msg_info \"$(translate \"Formatting\") $DISK $(translate \"as\") $FORMAT...\"\n    mkfs.\"$FORMAT\" \"$DISK\" >/dev/null 2>&1\n    msg_ok \"$(translate \"Formatted.\")\"\ndone\n\nmsg_ok \"$(translate \"Completed. ${#DISK_LIST[@]} disk(s) processed.\")\"\nmsg_success \"$(translate \"Press Enter to return to menu...\")\"\nread -r",
+    "phase2Rules": "<strong>Regole per la fase 2:</strong> inizia con <code>show_proxmenux_logo + msg_title</code> e riepiloga subito la fase 1 con righe <code>msg_ok</code>. Non richiamare <code>show_proxmenux_logo</code>, perché cancellerebbe il progresso accumulato. Non usare <code>dialog</code>; se una scelta durante l’esecuzione è inevitabile, usa <code>whiptail</code> come spiegato nella sezione seguente."
+  },
+  "dialogVsWhiptail": {
+    "headingRich": "Quando utilizzare <code>dialog</code> vs <code>whiptail</code>",
+    "intro": "Entrambi gli strumenti disegnano interfacce utente in modalità testo, ma si comportano molto diversamente sullo schermo — e ProxMenux li utilizza in due fasi distinte per un motivo.",
+    "headerTool": "Strumento",
+    "headerWhen": "Quando usarlo",
+    "headerEffect": "Effetti sullo schermo",
+    "rows": [
+      {
+        "toolRich": "<strong><code>dialog</code></strong>",
+        "whenRich": "<strong> Sempre in Fase 1.</strong> Ogni selezione interattiva — raccogliendo un VM, un disco, un filesystem, confermando un'azione — utilizza <code>dialog</code>. Questo è lo strumento UI predefinito di ProxMenux.",
+        "effectRich": "Prende il controllo del terminale: pulisce lo schermo, disegna l’interfaccia e alla chiusura ripristina lo stato precedente. Va bene nella fase 1, quando non ci sono ancora risultati utili da mostrare."
+      },
+      {
+        "toolRich": "<strong><code>whiptail</code></strong>",
+        "whenRich": "<strong>Solo in Fase 2, solo quando inevitabile.</strong> Il caso tipico è un prompt di riavvio alla fine dell'esecuzione. Non raggiungere <code>whiptail</code> per chiedere “continua?” mid-execution — tale decisione dovrebbe essere presa in fase 1.",
+        "effectRich": "Overlay più leggero che <em>non cancella</em> il contesto del terminale. La cronologia <code>msg_ok</code>/<code>msg_info</code> della fase 2 resta visibile dietro il dialogo. È quindi adatto quando l’avanzamento è già sullo schermo."
+      }
+    ],
+    "calloutTitle": "Perché la divisione conta",
+    "calloutBody": "Se si chiama <code>dialog</code> nel mezzo della fase 2, ogni linea <code>msg_ok</code> l'utente sta guardando scompare. Tu pulisci la pista di controllo. <code>whiptail</code> lo evita. Quindi la regola non è arbitraria — si tratta di preservare la vista dell'utente di ciò che lo script ha fatto finora.",
+    "rebootHeading": "Richiesta di riavvio: il caso tipico di whiptail nella fase 2",
+    "rebootIntro": "Quando uno script termina e un riavvio può essere richiesto (ad es. IOMMU abilitato, parametri del kernel modificati), il prompt alla fine della fase 2 utilizza <code>whiptail</code>. Sempre includere un ramo “No” che avverte l’utente di non utilizzare la risorsa interessata fino al riavvio:",
+    "rebootCode": "if [[ \"$HOST_REBOOT_REQUIRED\" == \"yes\" ]]; then\n  echo \"\"\n  if whiptail --title \"$(translate \"Reboot Required\")\" --yesno \\\n    \"\\n$(translate \"A host reboot is required before starting the VM. Reboot now?\")\" \\\n    13 78; then\n      msg_warn \"$(translate \"Rebooting the system...\")\"\n      reboot\n  else\n      echo \"\"\n      msg_info2 \"$(translate \"Do not start the VM until the system has been rebooted.\")\"\n  fi\nfi\n\nmsg_success \"$(translate \"Press Enter to return to menu...\")\"\nread -r"
+  },
+  "messageFunctions": {
+    "heading": "Funzioni di messaggio",
+    "intro": "Tutti definiti in <code>utils.sh</code>. Utilizzarli come predefinito per qualsiasi output visibile dall'utente — visuali coerenti tra gli script è l'intero punto. Se il tuo script ha bisogno di una nuova funzione che non si adatta al set esistente (un nuovo livello di gravità, un nuovo aiutante di layout, ecc.), proporlo nella tua richiesta di pull — sarà rivisto e aggiunto a <code>utils.sh</code> se è ampiamente utile.",
+    "headerFunction": "Funzione",
+    "headerWhen": "Quando usare",
+    "headerSpinner": "Indicatore di avanzamento",
+    "rows": [
+      {
+        "function": "msg_info \"text\"",
+        "whenRich": "Operazione in corso.",
+        "spinner": "Inizia"
+      },
+      {
+        "function": "stop_spinner",
+        "whenRich": "Fine del lavoro preparatorio silenzioso in Fase 1 — uccide spinner, cancella la linea.",
+        "spinner": "Arresta"
+      },
+      {
+        "function": "msg_ok \"text\"",
+        "whenRich": "L'operazione è riuscita. Utilizzare anche per “funzione abilitata” anche quando è richiesto un riavvio.",
+        "spinner": "Arresta"
+      },
+      {
+        "function": "msg_warn \"text\"",
+        "whenRich": "Avvertenza effettiva o stato degradato.",
+        "spinner": "Arresta"
+      },
+      {
+        "function": "msg_error \"text\"",
+        "whenRich": "Errore fatale.",
+        "spinner": "Arresta"
+      },
+      {
+        "function": "msg_info2 \"text\"",
+        "whenRich": "Avviso non bloccante, su una riga informativa ciano.",
+        "spinner": "Arresta"
+      },
+      {
+        "function": "msg_success \"text\"",
+        "whenRich": "Messaggio finale «Premi Invio per tornare» alla fine della fase 2.",
+        "spinner": "Arresta"
+      },
+      {
+        "function": "msg_title \"text\"",
+        "whenRich": "Titolo in grassetto con spaziatura integrata. Usato all’inizio della fase 2.",
+        "spinner": "—"
+      },
+      {
+        "function": "show_proxmenux_logo",
+        "whenRich": "Pulisce lo schermo e mostra il logo. Da chiamare <em>una sola volta</em> all’inizio della fase 2.",
+        "spinner": "—"
+      }
+    ]
+  },
+  "dialogConventions": {
+    "heading": "convenzioni di dialogo",
+    "bullets": [
+      "Passa sempre <code>--backtitle \"$BACKTITLE\"</code> ad ogni chiamata <code>dialog</code> e <code>whiptail</code>. <code>$BACKTITLE</code> è sempre <code>\"ProxMenux\"</code> — impostato una volta all'intestazione dello script e mai sovrascritto. L'utente deve sempre vedere il nome del progetto come il contesto di inquadramento, mai il titolo dello script.",
+      "Avvolgi sempre titoli e messaggi con <code>$(translate \"...\")</code>.",
+      "Reindirizza sempre l'output <code>dialog</code> con <code>2&gt;&amp;1 &gt;/dev/tty</code> — lo stdout catturato diventa la selezione dell'utente, mentre la finestra di dialogo si disegna sul terminale.",
+      "Utilizzare le variabili standard di dimensione dell'interfaccia utente (<code>$UI_MENU_H</code>, <code>$UI_MSG_W</code>, ecc.) per un dimensionamento coerente tra gli script.",
+      "Controlla sempre le selezioni vuote o annullate e gestiscile correttamente."
+    ],
+    "exampleIntro": "Esempio completo: creare un menu di selezione della VM e gestire l’annullamento.",
+    "exampleCode": "# 1) Build the list of VMs as alternating \"ID  NAME\" pairs.\n#    dialog --menu expects this exact shape: tag1 description1 tag2 description2 ...\nVM_LIST=\"\"\nfor vmid in $(qm list | awk 'NR>1 {print $1}'); do\n    vm_name=$(qm config \"$vmid\" | awk -F': ' '/^name:/ {print $2}')\n    VM_LIST=\"$VM_LIST $vmid \\\"$vm_name\\\"\"\ndone\n\n# 2) Show the dialog. Captured stdout is the user's selection (the VMID).\nVMID=$(eval \"dialog --backtitle \\\"\\$BACKTITLE\\\" \\\n    --title \\\"\\$(translate \\\"Select VM\\\")\\\" \\\n    --menu \\\"\\$(translate \\\"Choose a VM from the list:\\\")\\\" \\\n    \\$UI_MENU_H \\$UI_MENU_W \\$UI_MENU_LIST_H \\\n    $VM_LIST \\\n    2>&1 >/dev/tty\")\n\n# 3) Empty result means the user pressed Cancel or Esc — exit silently.\nif [ -z \"$VMID\" ]; then\n    exit 0\nfi\n\n# 4) Continue with the rest of Phase 1, knowing VMID is now set.\necho \"User selected VMID=$VMID\""
+  },
+  "translation": {
+    "heading": "Politica di traduzione",
+    "intro": "Tutte le stringhe visualizzabili dall'utente devono essere avvolte con la funzione <code>translate</code>. ProxMenux li traduce automaticamente in tutte le lingue supportate — scrivi inglese, l'utente legge la loro lingua madre.",
+    "code": "msg_ok \"$(translate \"Operation completed successfully.\")\"\nmsg_error \"$(translate \"Failed to start container\") $CTID.\"\ndialog --title \"$(translate \"Select Storage\")\" ...",
+    "bullets": [
+      "Scrivere stringhe in inglese — la traduzione viene gestita automaticamente dalla build.",
+      "Mantieni concise le stringhe. Evita, se possibile, variabili all’interno di frasi lunghe.",
+      "<strong>non</strong> tradurre nomi di variabili, percorsi o identificatori tecnici."
+    ]
+  },
+  "variableStyle": {
+    "heading": "Convenzioni variabili e di stile",
+    "bullets": [
+      "Utilizzare <code>UPPER_CASE</code> per le variabili a livello di script.",
+      "Utilizzare <code>lower_case</code> per le variabili di funzione locali (dichiarazione con <code>local</code>).",
+      "Quotare tutte le espansioni variabili: <code>\"$VAR\"</code> — non <code>$VAR</code>.",
+      "Utilizzare <code>[[ ]]</code> per condizionali, non <code>[ ]</code> (eccetto dove è richiesto il POSIX).",
+      "<code>show_proxmenux_logo</code> è il modo previsto per pulire lo schermo: lo cancella e mostra il logo del progetto per dare un contesto visivo. Chiamalo una volta all’inizio della fase 2, e facoltativamente prima di una lunga attesa nella fase 1."
+    ],
+    "standardNamesIntro": "Nomi variabili standard nel progetto:",
+    "standardNamesCode": "CTID         # container ID\nVMID         # virtual machine ID\nDISK         # device path (e.g. /dev/sdb)\nPARTITION    # partition path (e.g. /dev/sdb1)\nSTORAGE      # Proxmox storage name\nMOUNT_POINT  # filesystem mount path",
+    "redirectHeading": "Reindirizza l'output dello strumento durante la fase 2",
+    "redirectIntro": "La fase 2 mostra un log di righe <code>msg_info → msg_ok</code>. Se uno strumento chiamato, come apt, mkfs, qm, pct o dd, scrive su stdout/stderr, il suo output fa scorrere i messaggi e confonde la vista. L’utente non distingue più l’avanzamento dello script dai dettagli dello strumento.",
+    "withoutRedirectIntro": "<strong>Senza reindirizzare</strong> — ciò che l'utente vede se non si gestisce il rumore:",
+    "withoutRedirectCode": "ℹ Installing kernel package...\nReading package lists... Done\nBuilding dependency tree... Done\nReading state information... Done\nThe following NEW packages will be installed:\n  proxmox-kernel-6.5\n0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded.\nNeed to get 12.5 MB of archives.\nAfter this operation, 47.2 MB of additional disk space will be used.\nGet:1 http://download.proxmox.com/debian/pve trixie/pve-no-subscription amd64 ...\n... [200+ more lines of dpkg output] ...\n✓ Kernel installed.",
+    "withRedirectIntro": "<strong>Con redirect</strong> — quale sia la stessa operazione quando il rumore viene inviato altrove:",
+    "withRedirectCode": "ℹ Installing kernel package...\n✓ Kernel installed.\nℹ Configuring kernel command line...\n✓ Configured.\nℹ Refreshing boot loader...\n✓ Boot loader updated.",
+    "twoPatternsIntro": "Due modelli tra cui scegliere:",
+    "discardLead": "<strong>Scarta l’output</strong> quando non serve: è la soluzione più semplice e rapida.",
+    "discardCode": "DEBIAN_FRONTEND=noninteractive apt-get install -y \"$package\" >/dev/null 2>&1",
+    "logLead": "<strong>Inviare l'output a un file di registro</strong> quando si può desiderare di ispezionare in seguito (debugging un'installazione fallita, controllando ciò che dpkg effettivamente fatto). Questo è il modello preferito per qualsiasi operazione apt:",
+    "logCode": "apt-get install -y \"$package\" >> \"$log_file\" 2>&1",
+    "referenceOutro": "Lo script <code>scripts/global/update-pve9_2.sh</code> è un'implementazione di riferimento — ogni chiamata <code>apt-get</code> invia l'output a un file di registro in modo che l'utente vede solo il flusso <code>msg_info → msg_ok</code> pulito, mentre il log su disco consente di ricostruire esattamente ciò che ha fatto apt se qualcosa va storto."
+  },
+  "dosAndDonts": {
+    "heading": "Cosa fare e cosa non fare",
+    "doHeading": "✅ Da fare",
+    "doBullets": [
+      "<code>stop_spinner</code> prima di un <code>dialog</code> in Fase 1 solo quando un girante <code>msg_info</code> è in esecuzione.",
+      "La fase 2 inizia con <code>show_proxmenux_logo + msg_title + msg_ok</code> per riepilogare i risultati della fase 1.",
+      "Utilizzare <code>msg_ok</code> per funzioni abilitate con successo, anche se è necessario un riavvio.",
+      "Utilizzare <code>whiptail</code> (non <code>dialog</code>) per qualsiasi prompt post-esecuzione che deve apparire in Fase 2.",
+      "Sempre includere un ramo “No” nelle finestre di dialogo di riavvio che avverte l’utente di non avviare la risorsa interessata fino al riavvio.",
+      "Limita la logica riservata alle VM verificando <code>[[ -f \"/etc/pve/qemu-server/$'{'vmid'}'.conf\" ]]</code>: controller e NVMe PCIe non possono essere assegnati a LXC con passthrough PCI.",
+      "Utilizzare <code>ensure_repositories</code> da <code>utils-install-functions.sh</code> invece di <code>apt-get update</code> incondizionato.",
+      "Utilizzare array paralleli in Fase 1 quando ogni elemento ha bisogno di finestre di dialogo multiple."
+    ],
+    "dontHeading": "❌ Da evitare",
+    "dontBullets": [
+      "Chiama <code>dialog</code> mentre uno spinner è attivo.",
+      "Saltare la fase 1 recap all'inizio della fase 2.",
+      "Chiama <code>show_proxmenux_logo</code> una seconda volta — cancella tutto Fase 2 ha stampato.",
+      "Utilizzare <code>dialog</code> in Fase 2 (usare <code>whiptail</code> per il raro caso inevitabile).",
+      "Usare il solo <code>clear</code>.",
+      "Avvolgere <code>msg_title</code> in linee vuote <code>echo \"\"</code> — include già spaziatura.",
+      "Utilizzare <code>msg_warn</code> per segnalare una funzione abilitata con successo: è un <code>msg_ok</code>.",
+      "Eseguire <code>apt-get update</code> incondizionato — utilizzare <code>ensure_repositories</code>."
+    ]
+  },
+  "submitting": {
+    "heading": "Inviare il tuo contributo",
+    "steps": [
+      "Crea un fork di <code>MacRimi/ProxMenux</code> su GitHub e clonalo.",
+      "Crea un ramo <code>feature/*</code> da <code>develop</code> (vedi <em>Modello dei rami</em> sopra).",
+      "Segui questa guida per qualsiasi script nuovo o modificato. Scrivi l'intestazione con il tuo nome; aggiungi la linea di sponsor opzionale se vuoi.",
+      "Prova lo script su una vera istanza Proxmox VE: fase 1 con tutti i rami dei dialoghi e fase 2 con ogni operazione e il ripristino pulito in caso di errore.",
+      "Apri una pull request <strong>verso <code>develop</code></strong> con una descrizione chiara: cosa fa lo script, cosa è cambiato e su quale versione di Proxmox VE è stato testato.",
+      "Assicurati che il contributo rispetti il <cocLink>Codice di condotta</cocLink>."
+    ],
+    "securityOutro": "Per problemi di sicurezza sensibili, segui la procedura di divulgazione in <securityLink>SECURITY.md</securityLink> invece di aprire una segnalazione pubblica."
+  },
+  "whereNext": {
+    "heading": "Come proseguire",
+    "items": [
+      {
+        "kind": "external",
+        "url": "https://github.com/MacRimi/ProxMenux/blob/main/CONTRIBUTING.md",
+        "label": "CONTRIBUTING.md (guida completa)",
+        "tail": "— la fonte di verità per ogni convenzione, compresi i modelli hardware avanzati."
+      },
+      {
+        "kind": "internal",
+        "href": "/docs/about/contributors",
+        "label": "Contributori",
+        "tail": "— le persone il cui lavoro ha plasmato le versioni ProxMenux (pagina diversa da questa)."
+      },
+      {
+        "kind": "internal",
+        "href": "/docs/about/code-of-conduct",
+        "label": "Codice di condotta",
+        "tail": "— gli standard che ogni collaboratore accetta di seguire."
+      },
+      {
+        "kind": "external",
+        "url": "https://github.com/MacRimi/ProxMenux/discussions",
+        "label": "GitHub Discussions",
+        "tail": "— chiedere prima di costruire se non sei sicuro se un'idea si adatta, o trovare collaboratori su una caratteristica più grande."
+      }
+    ]
+  }
+}
diff --git a/web/messages/it/docs/about/contributors.json b/web/messages/it/docs/about/contributors.json
new file mode 100644
index 00000000..3704a329
--- /dev/null
+++ b/web/messages/it/docs/about/contributors.json
@@ -0,0 +1,38 @@
+{
+  "meta": {
+    "title": "Contributori | Documentazione ProxMenux",
+    "description": "Un riconoscimento alle persone che rendono possibile ProxMenux: tester, revisori e sviluppatori che contribuiscono a ogni versione.",
+    "ogTitle": "Contributori | Documentazione ProxMenux",
+    "ogDescription": "Incontra i contributori dietro ProxMenux."
+  },
+  "header": {
+    "title": "Contributori",
+    "description": "Il progetto ProxMenux cresce grazie ai suoi collaboratori. Questa pagina riconosce il loro lavoro: provare le versioni prima della pubblicazione, individuare regressioni, esaminare le PR e orientare le nuove funzionalità.",
+    "section": "Informazioni"
+  },
+  "beyond": {
+    "title": "Oltre questa lista",
+    "body": "Molte altre persone contribuiscono segnalando bug, proponendo funzionalità in Discussions, provando le versioni beta e traducendo il progetto. L’elenco completo dei collaboratori al codice si trova nel <extlink>grafico dei contributori di GitHub</extlink>. Questa pagina presenta chi partecipa più attivamente ai test e alla revisione delle versioni di ProxMenux."
+  },
+  "testers": {
+    "heading": "Tester e recensori",
+    "intro": "Queste persone sono state tra le prime a contribuire al progetto. I loro test, le segnalazioni di problemi e le proposte di miglioramento hanno aiutato ProxMenux a diventare ciò che è oggi.",
+    "roles": {
+      "testing": "Test",
+      "testingReviewer": "Test e revisione"
+    },
+    "youtube": "YouTube"
+  },
+  "contribute": {
+    "heading": "Vuoi contribuire?",
+    "intro": "Ogni contributo è benvenuto: codice, test, design, documentazione o anche solo la condivisione delle tue idee:",
+    "tester": "<strong>Tester</strong> — prova il canale <beta>beta</beta> e segnala ciò che funziona e ciò che non funziona prima delle versioni stabili.",
+    "developer": "<strong>Sviluppatore</strong> — Bash, Next.js (TypeScript) e un po’ di Python per l’ambiente virtuale di traduzione (venv). Le PR sono benvenute su <gh>GitHub</gh>.",
+    "designer": "<strong>Designer</strong> — Miglioramenti dell'interfaccia utente, icone, screenshot per la documentazione.",
+    "ideas": "<strong>Idee</strong> — apri una discussione in <disc>GitHub Discussions</disc> prima di creare una issue per richiedere una funzionalità."
+  },
+  "coc": {
+    "title": "Leggi prima il codice di condotta",
+    "body": "Prima di proporre codice o segnalare problemi, leggi il <coclink>Codice di condotta e le buone pratiche</coclink>. Descrive le aspettative sulla responsabilità del codice, sulla segnalazione delle vulnerabilità e sull’ambito delle PR."
+  }
+}
diff --git a/web/messages/it/docs/about/faq.json b/web/messages/it/docs/about/faq.json
new file mode 100644
index 00000000..078002c8
--- /dev/null
+++ b/web/messages/it/docs/about/faq.json
@@ -0,0 +1,94 @@
+{
+  "meta": {
+    "title": "FAQ | Documentazione ProxMenux",
+    "description": "Domande frequenti su ProxMenux: funzionalità, installazione, compatibilità da PVE 8, personalizzazione, aggiornamenti, sicurezza, uso in produzione, file di sistema, contributi e disinstallazione.",
+    "ogTitle": "FAQ | Documentazione ProxMenux",
+    "ogDescription": "Domande frequenti su installazione, compatibilità, sicurezza e modi per contribuire a ProxMenux."
+  },
+  "header": {
+    "title": "Domande frequenti",
+    "description": "Domande comuni su ProxMenux: che cos’è, a chi serve, installazione, aggiornamento, disinstallazione, compatibilità, personalizzazione, sicurezza e contributi. Se non trovi la tua domanda, consulta GitHub Discussions o apri una issue.",
+    "section": "Informazioni"
+  },
+  "quickLinks": {
+    "title": "Collegamenti rapidi",
+    "installationLabel": "Installazione",
+    "installationSuffix": " — il comando di installazione su una sola riga e le dipendenze.",
+    "introductionLabel": "Introduzione",
+    "introductionSuffix": " — cosa fa ProxMenux, in cinque minuti.",
+    "uninstallLabel": "Disinstalla",
+    "uninstallSuffix": "— rimozione pulita.",
+    "issuesLabel": "GitHub Issues",
+    "discussionsLabel": "Discussioni"
+  },
+  "q1": {
+    "question": "Che cosa è ProxMenux, e per cosa è usato?",
+    "p1Rich": "<strong>ProxMenux</strong> è uno strumento interattivo a menu che rende <strong>Proxmox VE</strong> accessibile a tutti, a prescindere dall’esperienza tecnica. Semplifica l’esecuzione dei comandi e consente di gestire il sistema senza conoscenze avanzate di Linux.",
+    "p2": "Gli utenti meno esperti possono eseguire comandi da menu strutturati, riducendo ciò che devono digitare nel terminale. Gli amministratori esperti risparmiano passaggi nelle attività ripetitive: protezione dopo l’installazione, passthrough GPU, importazione di VM OVF e rotazione degli snapshot ZFS.",
+    "p3": "Proxmox VE è ampiamente usato per:",
+    "items": [
+      "Virtualizzazione di livello aziendale",
+      "HomeLab e soluzioni cloud personali",
+      "Server multimediali, automazione e altro ancora"
+    ]
+  },
+  "q2": {
+    "question": "Come posso installare ProxMenux?",
+    "p1Rich": "Segui la <installlink>guida all’installazione</installlink>. In breve:",
+    "stableInstall": "bash -c \"$(wget -qLO - https://raw.githubusercontent.com/MacRimi/ProxMenux/main/install_proxmenux.sh)\"",
+    "p2": "Una volta installato, basta avviarlo con:",
+    "menuCmd": "menu"
+  },
+  "q3": {
+    "question": "ProxMenux è compatibile con tutte le versioni Proxmox?",
+    "bodyRich": "<strong>No — ProxMenux richiede Proxmox VE 8 o successivo.</strong> PVE 7 e le versioni precedenti non sono supportati. Se usi ancora PVE 7, passa prima a 8.x seguendo la procedura ufficiale Proxmox. Puoi poi gestire il passaggio da 8 a 9 con ProxMenux da <upgradelink>Utilità → Aggiorna PVE 8 a PVE 9</upgradelink>."
+  },
+  "q4": {
+    "question": "Posso personalizzare ProxMenux?",
+    "p1Rich": "Gli aggiornamenti possono sovrascrivere le modifiche locali agli script principali: evita quindi di modificare direttamente questi file. Ecco cosa <em>puoi</em> personalizzare:",
+    "items": [
+      "Il banner della console tramite lo strumento <strong>FastFetch</strong> nelle opzioni Post-Install.",
+      "Quali componenti opzionali sono installati (Monitor, Fail2Ban, Lynis...) — scegliere durante l'installazione o tramite il menu pertinente in seguito."
+    ]
+  },
+  "q5": {
+    "question": "Come posso aggiornare ProxMenux?",
+    "p1Rich": "Quando è disponibile una nuova versione, ProxMenux la rileva al successivo avvio di <code>menu</code> e propone l’aggiornamento. Se accetti, sostituisce i file e la configurazione dello strumento nell’installazione esistente, senza richiedere download manuali.",
+    "p2Rich": "Chi usa la versione stabile riceve aggiornamenti stabili; chi usa la beta riceve quelli beta. Quando viene pubblicata una versione stabile, la beta lo segnala alla successiva apertura del menu e propone il passaggio automatico. Consulta il <betalink>programma beta</betalink>."
+  },
+  "q6": {
+    "question": "Dove posso segnalare i problemi?",
+    "p1Rich": "Segnala i bug su <issueslink>GitHub Issues</issueslink>. Includi i passaggi per riprodurli, il messaggio di errore e, se pertinente, l’output di Monitor ottenuto con <code>journalctl -u proxmenux-monitor -n 50</code>.",
+    "p2Rich": "Per i problemi di <strong>sicurezza</strong>, <strong>non pubblicare i dettagli</strong>. Segui la procedura di segnalazione responsabile nel <coclink>codice di condotta e nelle buone pratiche</coclink>."
+  },
+  "q7": {
+    "question": "Posso contribuire a ProxMenux?",
+    "p1Rich": "<strong>Certamente.</strong> ProxMenux è un progetto collaborativo e open source. Puoi contribuire con codice (Bash, Next.js/TypeScript e strumenti di traduzione in Python), test, documentazione, design o idee.",
+    "item1Rich": "Discuti le idee in <discusslink>GitHub Discussions</discusslink> prima di aprire una richiesta di funzionalità.",
+    "item2Rich": "Prima di inviare una pull request, leggi il <coclink>codice di condotta e le buone pratiche</coclink>.",
+    "item3Rich": "Consulta la <contriblink>pagina dei collaboratori</contriblink> per conoscere chi si occupa attualmente di test e revisioni."
+  },
+  "q8": {
+    "question": "ProxMenux modifica i file di sistema critici?",
+    "p1Rich": "<strong>L’installazione di ProxMenux aggiunge i seguenti componenti.</strong>",
+    "item1Rich": "Dipendenze tramite apt: <code>dialog</code>, <code>curl</code>, <code>jq</code> e <code>git</code>. Le traduzioni usano cataloghi JSON già generati; l’installazione non aggiunge all’host un ambiente virtuale per la traduzione.",
+    "item2Rich": "L'albero di script a <code>/usr/local/share/proxmenux/</code>.",
+    "item3Rich": "Il comando di avvio in <code>/usr/local/bin/menu</code>.",
+    "item4Rich": "Facoltativo: il servizio systemd di Monitor, <code>proxmenux-monitor.service</code>.",
+    "p2Rich": "ProxMenux <em>non</em> modifica la configurazione principale di Proxmox, a meno che tu non lo richieda esplicitamente da un menu dedicato. Per esempio, la riparazione della rete modifica <code>/etc/network/interfaces</code>, ma solo dopo la tua conferma e la creazione di un backup."
+  },
+  "q9": {
+    "question": "È sicuro usare ProxMenux in produzione?",
+    "bodyRich": "<strong>Sì.</strong> Poiché ProxMenux modifica i file principali di Proxmox solo su richiesta esplicita, può essere usato in produzione. Come per ogni automazione, provalo prima in un ambiente controllato e prepara i backup prima delle operazioni distruttive: aggiornamento da PVE 8 a 9, formattazione di dischi, eliminazione di VM e simili."
+  },
+  "q10": {
+    "question": "Come posso disinstallare ProxMenux?",
+    "p1Rich": "Da ProxMenux: <strong>Impostazioni → Disinstalla ProxMenux</strong>. La disinstallazione rimuove gli script, il comando di avvio e il servizio Monitor, oltre alle dipendenze selezionate se richiesto. Ripristina <code>/root/.bashrc</code> e <code>/etc/motd</code> dalle copie create da Post-Install, se presenti (altrimenti rimuove la riga di ProxMenux dal MOTD).",
+    "p2Rich": "Procedura completa: <uninstalllink>Disinstallare ProxMenux</uninstalllink>."
+  },
+  "q11": {
+    "question": "VirusTotal contrassegna l'URL di installazione — è sicuro?",
+    "p1Rich": "Il risultato di 1/95 del motore <em>Chong Lua Dao</em>, riportato nella issue #162, è stato identificato dal manutentore come falso positivo. L’installazione si avvia con un comando che scarica ed esegue lo script (<code>bash -c \"$(wget -qLO - …)\"</code>) e può scaricare <code>jq</code> dalla sua release ufficiale su GitHub. Questo <em>comportamento</em> può attivare gli scanner euristici; il rapporto storico non costituisce una valutazione di ogni download futuro.",
+    "p2Rich": "ProxMenux è completamente open source e puoi esaminare lo script di installazione riga per riga: <scriptlink>install_proxmenux.sh</scriptlink>. Altri dettagli nella <issuelink>issue #162</issuelink>."
+  }
+}
diff --git a/web/messages/it/docs/about/index.json b/web/messages/it/docs/about/index.json
new file mode 100644
index 00000000..1be9dc8d
--- /dev/null
+++ b/web/messages/it/docs/about/index.json
@@ -0,0 +1,67 @@
+{
+  "meta": {
+    "title": "Informazioni su | Documentazione ProxMenux",
+    "description": "Informazioni su ProxMenux: obiettivi del progetto, collaboratori, FAQ e codice di condotta. Uno strumento di gestione open source a menu per Proxmox VE 8+, sviluppato e mantenuto da MacRimi con un piccolo gruppo di tester e collaboratori.",
+    "ogTitle": "Informazioni su | Documentazione ProxMenux",
+    "ogDescription": "Informazioni su ProxMenux — strumento di gestione a menu open source per Proxmox VE 8+."
+  },
+  "header": {
+    "title": "Informazioni",
+    "description": "Informazioni sul progetto, FAQ, contributori e codice di condotta. ProxMenux è uno strumento di gestione a menu open source per Proxmox VE 8+, costruito e mantenuto da MacRimi con l'aiuto di un piccolo team di tester e collaboratori.",
+    "section": "Informazioni"
+  },
+  "callout": {
+    "title": "Open source, sviluppato dalla comunità",
+    "body": "ProxMenux è distribuito con licenza GPL-3.0 e sviluppato pubblicamente su GitHub. Ogni script può essere esaminato e ogni modifica tracciata. Sono benvenuti segnalazioni di bug, idee, codice e test."
+  },
+  "section": {
+    "heading": "In questa sezione",
+    "options": [
+      {
+        "icon": "HelpCircle",
+        "href": "/docs/about/faq",
+        "title": "FAQ",
+        "description": "Domande frequenti: che cos’è ProxMenux, installazione, compatibilità, personalizzazione, aggiornamenti, sicurezza, uso in produzione e disinstallazione."
+      },
+      {
+        "icon": "Users",
+        "href": "/docs/about/contributors",
+        "title": "Contributori",
+        "description": "Un riconoscimento alle persone che rendono possibile ProxMenux: tester, revisori e sviluppatori che contribuiscono a ogni versione."
+      },
+      {
+        "icon": "ScrollText",
+        "href": "/docs/about/code-of-conduct",
+        "title": "Codice di condotta",
+        "description": "Valori del progetto, responsabilità del codice e linee guida per contribuire. Da leggere prima di aprire una PR o segnalare un problema."
+      }
+    ]
+  },
+  "involved": {
+    "heading": "Partecipa",
+    "intro": "Tre modi per partecipare al progetto:",
+    "cards": [
+      {
+        "href": "https://github.com/MacRimi/ProxMenux/issues/new",
+        "title": "🐛 Segnala un bug",
+        "description": "GitHub Issues — includi i log e i passaggi per riprodurre il problema."
+      },
+      {
+        "href": "https://github.com/MacRimi/ProxMenux/discussions",
+        "title": "💡 Suggerisci una funzionalità",
+        "description": "GitHub Discussions — condividi le tue idee prima di aprire una PR."
+      },
+      {
+        "href": "https://github.com/MacRimi/ProxMenux/pulls",
+        "title": "🔀 Invia una PR",
+        "description": "GitHub Pull Requests — leggere prima il codice di condotta."
+      }
+    ]
+  },
+  "support": {
+    "heading": "Sostieni il progetto",
+    "introRich": "Se ProxMenux ti fa risparmiare tempo, il modo più semplice per farlo conoscere è <starlink>assegnare una ⭐ al repository su GitHub</starlink>. Se vuoi fare di più:",
+    "kofiLabel": "Supporto su Ko-fi",
+    "kofiOutro": " — offri un caffè al manutentore e contribuisci a portare avanti lo sviluppo."
+  }
+}
diff --git a/web/messages/it/docs/backup-restore/creating-backups.json b/web/messages/it/docs/backup-restore/creating-backups.json
new file mode 100644
index 00000000..a7fd47c4
--- /dev/null
+++ b/web/messages/it/docs/backup-restore/creating-backups.json
@@ -0,0 +1,220 @@
+{
+  "meta": {
+    "title": "Creazione di backup — flusso di backup interattivo | ProxMenux",
+    "description": "Il flusso di backup interattivo di ProxMenux: due punti di accesso (il menu TUI di Scripts e l’interfaccia web di Monitor), tre destinazioni, due modalità di profilo, una fase di preparazione temporanea e una finestra di conferma. La pagina descrive la matrice con sei opzioni, i profili predefinito e personalizzato e ciò che vede l’utente dalla scelta del backup fino al salvataggio dell’archivio a destinazione.",
+    "ogTitle": "ProxMenux Backup — creazione di backup",
+    "ogDescription": "Il flusso di backup interattivo con tre destinazioni, due profili e una fase di staging comune.",
+    "twitterTitle": "Creazione di backup | ProxMenux",
+    "twitterDescription": "Flusso di backup interattivo con tre destinazioni e due modalità di profilo."
+  },
+  "header": {
+    "title": "Creazione di backup",
+    "description": "Il flusso di backup interattivo: scegli una destinazione e un profilo, controlla il riepilogo di conferma e segui il salvataggio dell’archivio. I due punti di accesso condividono lo stesso backend e producono archivi identici.",
+    "section": "Backup e ripristino"
+  },
+  "intro": {
+    "title": "Due punti di ingresso, funzionalità identiche",
+    "body": "La TUI di Scripts e l’interfaccia web di Monitor offrono <strong>esattamente le stesse funzionalità</strong>. Ogni backup — manuale o pianificato — usa la stessa matrice di scelta (tre destinazioni × due profili) e richiama la stessa funzione backend per ogni cella (<code>_bk_pbs</code>, <code>_bk_borg</code> o <code>_bk_local</code>). Gli archivi prodotti dai due punti di accesso sono indistinguibili. La scelta dipende dalle preferenze: la TUI è adatta a SSH e agli script; Monitor offre il controllo con il mouse insieme alle viste delle notifiche e del monitoraggio dei log."
+  },
+  "entryPoints": {
+    "heading": "I due punti di ingresso",
+    "rows": [
+      {
+        "entry": "ProxMenux Scripts (TUI)",
+        "path": "menu → Utilities → Host Config Backup",
+        "detail": "Flusso basato sul dialogo, SSH-friendly. Il menu principale presenta le sei opzioni direttamente. Utilizza <code>backup_menu</code> in <code>backup_host.sh</code>."
+      },
+      {
+        "entry": "ProxMenux Monitor (interfaccia web)",
+        "path": "Backups tab → Create backup",
+        "detail": "Flusso guidato da una procedura assistita. Le stesse sei opzioni sono presentate in un modulo in due passaggi (destinazione → profilo). Le stesse funzioni backend vengono richiamate tramite l’API Flask."
+      }
+    ]
+  },
+  "modes": {
+    "heading": "Backup manuali e pianificati",
+    "body": "I backup possono essere prodotti in due modi: <strong>manuale</strong> (il flusso interattivo descritto in questa pagina - l'utente sceglie una destinazione e un profilo da un menu e segue il salvataggio dell’archivio) o <strong>pianificato</strong> (un lavoro non assistito che funziona su un timer in stile cron e applica la ritenzione configurata sul lavoro). Entrambe le modalità supportano le stesse tre destinazioni e gli stessi due profili, ed entrambe sono disponibili da entrambi i punti di ingresso — il menu Script TUI e la scheda Monitor Backups. I lavori programmati utilizzano le stesse funzioni backend del flusso manuale attraverso <code>run_scheduled_backup.sh</code>; gli archivi prodotti sono indistinguibili.",
+    "seeAlso": "La pagina dei lavori programmati copre il flusso completo, incluso come creare un lavoro, collegarlo a un timer PVE vzdump esistente e configurare i valori di ritenzione.",
+    "monitorAlt": "Scheda di backup ProxMenux Monitor che mostra la Nuova finestra di dialogo di backup programmata con i campi di destinazione, profilo, pianificazione e ritenzione.",
+    "monitorCaption": "Backup pianificato — ProxMenux Monitor. La stessa finestra guidata che crea un backup manuale contiene in basso i campi di pianificazione e conservazione per l’esecuzione senza intervento."
+  },
+  "matrix": {
+    "heading": "La matrice con sei opzioni",
+    "intro": "La scelta determina sia il backend eseguito sia la strategia di selezione dei percorsi. Consulta le pagine delle singole destinazioni per i dettagli di configurazione di ogni cella.",
+    "rows": [
+      {
+        "combo": "1",
+        "destination": "PBS",
+        "profile": "Predefinito",
+        "action": "Carica il profilo predefinito e gli extra persistenti su un repository PBS configurato."
+      },
+      {
+        "combo": "2",
+        "destination": "Borg",
+        "profile": "Predefinito",
+        "action": "Crea un archivio con il profilo predefinito più extra persistenti nel repository Borg selezionato."
+      },
+      {
+        "combo": "3",
+        "destination": "Locale",
+        "profile": "Predefinito",
+        "action": "Scrive un archivio <code>.tar.zst</code> con il profilo predefinito più extra persistenti al target locale configurato."
+      },
+      {
+        "combo": "4",
+        "destination": "PBS",
+        "profile": "Personalizzato",
+        "action": "Apre il selettore dei percorsi prima del caricamento su PBS; l’utente seleziona i percorsi e può aggiungerne di nuovi."
+      },
+      {
+        "combo": "5",
+        "destination": "Borg",
+        "profile": "Personalizzato",
+        "action": "Apre il selettore dei percorsi prima di creare l’archivio Borg."
+      },
+      {
+        "combo": "6",
+        "destination": "Locale",
+        "profile": "Personalizzato",
+        "action": "Apre il selettore dei percorsi prima di scrivere il file <code>.tar.zst</code> locale."
+      }
+    ]
+  },
+  "profiles": {
+    "heading": "Profilo predefinito e personalizzato",
+    "defaultTitle": "Profilo predefinito",
+    "defaultBody": "Il profilo predefinito è l'elenco curato da <code>hb_default_profile_paths</code> (documentato in <em>Come funziona</em> sotto <em>Categorie di percorsi</em>) più ogni voce nel file extra persistente <code>/usr/local/share/proxmenux/backup-extra-paths.txt</code>. L'utente conferma le opzioni di destinazione e crittografia e il backup procede senza ulteriori selezioni dei percorsi.",
+    "customTitle": "Profilo personalizzato",
+    "customBody": "Il profilo personalizzato apre un elenco con tutti i percorsi del profilo predefinito (non selezionati) e tutti gli extra persistenti (già selezionati, con il prefisso <code>[+]</code>). L’utente seleziona i percorsi per questa esecuzione e può premere <em>Aggiungi percorso personalizzato</em> per aggiungere un nuovo percorso assoluto. I percorsi aggiunti vengono salvati in <code>backup-extra-paths.txt</code>, così i backup futuri li includono automaticamente senza doverli aggiungere di nuovo. Deselezionare un extra persistente lo esclude da questa esecuzione ma non lo elimina dal file — l’eliminazione avviene con l’azione separata <em>Gestisci percorsi personalizzati</em>, al di fuori del flusso di backup.",
+    "customPickerAlt": "Elenco di controllo del profilo personalizzato che mostra i percorsi di predefinito (non selezionati) e gli extra persistenti (già selezionati con un prefisso [+]), più pulsanti per aggiungere un nuovo percorso o confermare la selezione.",
+    "customPickerCaption": "Profilo personalizzato — il selettore dei percorsi. I percorsi del profilo predefinito non sono selezionati; gli extra persistenti sono già selezionati con il prefisso [+]. L’utente seleziona i percorsi per questa esecuzione.",
+    "manageCustomAlt": "Menu di gestione dei percorsi personalizzati con l’elenco degli extra persistenti e le opzioni per aggiungerli, rimuoverli o modificarli.",
+    "manageCustomCaption": "Gestisci percorsi personalizzati — il punto di ingresso dove vengono aggiunti o rimossi gli extra persistenti. Ogni percorso elencato qui è incluso automaticamente nei backup in modalità predefinita senza dover aprire il selettore personalizzato."
+  },
+  "commonPipeline": {
+    "heading": "Cosa funziona indipendentemente dalla destinazione",
+    "intro": "Una volta definito il profilo, ogni backend esegue la stessa procedura di preparazione temporanea prima di passare al proprio metodo di caricamento. <code>hb_prepare_staging</code> assembla l’albero dell’archivio in <code>/tmp/proxmenux-DESTINATION-stage.XXXXXX</code> e compila ciascuno dei tre blocchi di dati.",
+    "steps": [
+      {
+        "step": "1",
+        "name": "Assemblaggio del rootfs",
+        "detail": "Esegue <code>rsync -a</code> per ogni percorso selezionato verso <code>staging_root/rootfs/</code>. Il database pmxcfs in <code>/var/lib/pve-cluster/config.db</code> viene acquisito separatamente tramite <code>sqlite3 .backup</code> per ottenere un’istantanea coerente senza arrestare il cluster; i file ausiliari <code>.db-wal</code> / <code>.db-shm</code> sono esclusi da rsync. Se <code>sqlite3</code> non è disponibile, viene invece salvato un file <code>config.db.raw-fallback</code>, che il ripristino adotta come database durante l’importazione. Da <code>/root/</code> sono esclusi i sottopercorsi volatili (cronologia bash, cache, cestino). I percorsi assenti nell’origine vengono registrati in <code>metadata/missing_paths.txt</code> senza interrompere il backup."
+      },
+      {
+        "step": "2",
+        "name": "Generazione manifesto",
+        "detail": "<code>build_manifest.sh</code> coordina i sei moduli di raccolta e scrive <code>manifest.json</code> nella radice della directory temporanea. Se un modulo non riesce, la sezione interessata assume un valore predefinito vuoto documentato; il manifest resta valido."
+      },
+      {
+        "step": "3",
+        "name": "Inventario dei pacchetti",
+        "detail": "<code>apt-mark showmanual</code> viene catturato verbatim in <code>metadata/packages.manual.list</code>. Lo stato dei componenti è già all'interno del rootfs ripristinato (<code>components_status.json</code>) perché <code>/usr/local/share/proxmenux/</code> fa parte del profilo predefinito."
+      },
+      {
+        "step": "4",
+        "name": "Informazioni sull’esecuzione",
+        "detail": "<code>metadata/run_info.env</code> registra l'identità di esecuzione di backup — hostname, timestamp, versione del kernel — utilizzata dal controllo di compatibilità del ripristino per determinare la direzione del cross-kernel."
+      },
+      {
+        "step": "5",
+        "name": "Notifica (start)",
+        "detail": "Viene eseguito <code>hb_notify_lifecycle \"start\"</code>. Se le notifiche sono configurate in Monitor, viene inviato all’utente l’evento <em>Backup dell’host avviato</em>. Non viene inviato nulla se non sono configurati canali."
+      }
+    ]
+  },
+  "included": {
+    "heading": "Cosa entra e cosa rimane fuori",
+    "intro": "Ogni percorso nel profilo risolto (predefinito + extra persistenti + selezione personalizzata) viene copiato con <code>rsync -aAXH --numeric-ids</code>. Un elenco di esclusione condiviso si applica a ogni percorso, e due directory portano ulteriori esclusioni specifiche del percorso.",
+    "globalTitle": "Esclusioni globali (applicate ad ogni percorso)",
+    "globalItems": [
+      "<code>images/</code> — dump immagine.",
+      "<code>dump/</code> — output di vzdump.",
+      "<code>tmp/</code> — file temporanei.",
+      "<code>*.log</code> — file di registro."
+    ],
+    "rootTitle": "<code>/root/</code> esclusioni",
+    "rootBody": "<code>/root/</code> fa parte del profilo predefinito per includere nell’archivio gli script e la configurazione dell’utente. Sono esclusi i sottopercorsi volatili:",
+    "rootItems": [
+      "<code>.bash_history</code>",
+      "<code>.cache/</code>",
+      "<code>tmp/</code>",
+      "<code>.local/share/Trash/</code>"
+    ],
+    "proxmenuxTitle": "<code>/usr/local/share/proxmenux/</code> esclusioni",
+    "proxmenuxBody": "Questa directory spedisce solo stato utente — <code>components_status.json</code>, preferenze, cache post-installazione. Codice che la destinazione avrà già dalla propria installazione ProxMenux è escluso quindi un ripristino non sovrascrive i binari attuali dell'obiettivo con quelli più vecchi:",
+    "proxmenuxItems": [
+      "<code>restore-pending/</code>, <code>scripts/</code>, <code>web/</code>",
+      "<code>monitor-app/</code>, <code>monitor-app.*/</code>, <code>AppImage/</code>",
+      "<code>images/</code>, <code>json/</code>",
+      "<code>utils.sh</code>, <code>helpers_cache.json</code>",
+      "<code>ProxMenux-Monitor.AppImage*</code>, <code>install_proxmenux*.sh</code>"
+    ],
+    "notInProfileTitle": "Percorsi fuori dal profilo",
+    "notInProfileBody": "Qualsiasi cosa non elencata in <code>hb_default_profile_paths</code> e non aggiunta come un extra personalizzato o persistente non fa parte del backup. Esempi notevoli:",
+    "notInProfileItems": [
+      "<strong>VM e dischi LXC</strong> — gestiti da <code>vzdump</code>, non da questa funzione. I file di configurazione degli ospiti sotto <code>/etc/pve/nodes/*/qemu-server/*.conf</code> e <code>lxc/*.conf</code> vengono catturati (vivono sotto <code>/etc/pve</code>) in modo che il ripristino riproduca l'inventario; i dischi stessi vengono riattaccati da un backup vzdump/PBS esistente.",
+      "<strong><code>/boot</code> e <code>/boot/efi</code></strong> — binari del kernel, initramfs e la partizione UEFI ESP sono rigenerati dal proprio <code>update-initramfs</code>, <code>update-grub</code> o <code>proxmox-boot-tool refresh</code> dopo il ripristino. Il bootloader non è mai copiato verbatim.",
+      "<strong>Filesystem del kernel e dello stato di esecuzione del sistema</strong> — <code>/proc</code>, <code>/sys</code>, <code>/dev</code> e <code>/run</code> sono pseudo-filesystem generati dal kernel e da udev; non vengono salvati in modo persistente.",
+      "<strong>Binari dei pacchetti in <code>/usr/bin</code>, <code>/usr/lib</code>, <code>/lib</code>, <code>/sbin</code></strong> — reinstallati da APT sul sistema di destinazione a partire da <code>packages.manual.list</code>.",
+      "<strong><code>/var/log/</code>, <code>/var/tmp/</code>, <code>/var/cache/</code></strong> — stato runtime per host, non restaurato.",
+      "<strong><code>/home/USER</code></strong> — non nel profilo predefinito. Aggiungilo come un percorso personalizzato quando un sistema porta directory home degli utenti che devono sopravvivere a un ripristino."
+    ],
+    "customPathsTitle": "Come vengono gestiti i percorsi personalizzati",
+    "customPathsBody": "Un percorso personalizzato aggiunto in linea in modalità personalizzata o persistito in <code>backup-extra-paths.txt</code> passa attraverso la stessa pipeline <code>rsync</code> come percorsi di default-profile. Si applicano esclusioni globali. Se il percorso personalizzato avviene sotto <code>/root/</code> o <code>/usr/local/share/proxmenux/</code>, si applicano ancora le esclusioni specifiche del percorso. Ogni percorso archiviato — predefinito o personalizzato — viene registrato in <code>metadata/paths_archived.txt</code>. I percorsi che non esistono sulla sorgente sono registrati in <code>metadata/missing_paths.txt</code> senza interrompere il backup."
+  },
+  "archiveStructure": {
+    "heading": "Struttura dell'archivio",
+    "intro": "La directory di staging prodotta da ogni backend segue lo stesso layout indipendentemente dalla destinazione. Il tarball, PBS <code>.pxar</code> o Borg archivio memorizza questo albero verbatim.",
+    "tree": "backup-[timestamp]/\n├── manifest.json                  # structured host state (kernel_params, hardware, storage, guests, components, source_host)\n├── metadata/\n│   ├── packages.manual.list       # output of apt-mark showmanual\n│   ├── run_info.env               # hostname, timestamp, kernel version, pmxcfs method\n│   ├── paths_archived.txt         # exact list of paths that reached rootfs/\n│   └── missing_paths.txt          # paths from the profile absent on source\n└── rootfs/\n    ├── etc/                       # /etc/pve, /etc/network, /etc/systemd/network, /etc/ssh, /etc/apt, ...\n    ├── root/                      # /root without volatile subpaths\n    ├── usr/local/                 # /usr/local/bin, /usr/local/sbin, /usr/local/share/proxmenux (state only)\n    └── var/                       # /var/lib/pve-cluster (config.db via sqlite3 .backup), /var/spool/cron/crontabs"
+  },
+  "confirmation": {
+    "heading": "Riepilogo conferma",
+    "body": "Prima che il backend scriva qualcosa alla destinazione, ProxMenux mostra una finestra di dialogo sommaria con la destinazione, l'ID di backup o il nome dell'archivio, lo stato di crittografia e l'elenco dei percorsi da copiare. Cancellando qui interrompe il backup in modo pulito — la directory di staging viene rimossa dal gancio <code>trap</code> impostato sulla funzione backend e nessun dato parziale raggiunge la destinazione."
+  },
+  "writing": {
+    "heading": "Scrivere alla destinazione",
+    "intro": "Dopo la conferma, ogni backend esegue la propria fase di scrittura. Le pagine delle destinazioni ne descrivono il funzionamento; gli elementi comuni sono il log, il file ausiliario e la notifica di completamento.",
+    "rows": [
+      {
+        "topic": "File di registro",
+        "detail": "Ogni backend scrive il suo output completo a <code>/tmp/proxmenux-DESTINATION-backup-YYYYMMDD_HHMMSS.log</code> e, in caso di guasto, offre di aprirlo in una finestra di dialogo scorrevole. Il percorso di log è stampato nel sommario di completamento solo quando il file ha contenuto."
+      },
+      {
+        "topic": "Sidecar (solo locale)",
+        "detail": "<code>hb_write_archive_sidecar</code> scrive un <code>*.proxmenux.json</code> accanto all'archivio locale, quindi il Monitor lo identifica come backup host ProxMenux anche dopo mosse o rinominazioni."
+      },
+      {
+        "topic": "Notifica (completamento/errore)",
+        "detail": "Viene eseguito <code>hb_notify_lifecycle \"complete\"</code> o <code>\"fail\"</code> con durata, dimensione dell’archivio e — in caso di errore — l’ultima riga del log che sembra indicare un errore."
+      }
+    ]
+  },
+  "finishedScreens": {
+    "heading": "Che aspetto ha un backup finito",
+    "intro": "Lo stesso evento di completamento viene mostrato da entrambi i punti di accesso. La TUI scrive un riepilogo nel terminale; la scheda Backups di Monitor mostra l’esecuzione nell’elenco degli archivi con dimensione, durata e indicatori di stato.",
+    "scriptsAlt": "ProxMenux Scripts TUI che mostra un backup host finito — destinazione, ID di backup, percorso snapshot, dimensione dei dati, durata e stato di crittografia.",
+    "scriptsCaption": "Backup finito — ProxMenux Scripts (TUI). Il blocco di completamento stampa la destinazione, l'ID di backup, il nome dell'istantanea o dell'archivio risultante, la dimensione dei dati, la durata e lo stato di crittografia.",
+    "monitorAlt": "Scheda di backup ProxMenux Monitor che mostra una voce di backup host finita con dimensioni, durata, indicatore del metodo e indicatore di crittografia.",
+    "monitorCaption": "Backup finito — scheda di backup ProxMenux Monitor. Il nuovo backup appare nell'elenco di archivio con il badge metodo di destinazione, dimensione, durata e - quando applicabile - l'indicatore di blocco di crittografia."
+  },
+  "whereNext": {
+    "heading": "Dove andare dopo",
+    "items": [
+      {
+        "label": "Destinazioni",
+        "href": "/docs/backup-restore/destinations",
+        "tail": "— dettagli di configurazione per Local, PBS e Borg."
+      },
+      {
+        "label": "Lavori programmati",
+        "href": "/docs/backup-restore/scheduled-jobs",
+        "tail": "— eseguire lo stesso backup incustodito su un programma invece di interattivamente."
+      },
+      {
+        "label": "Ripristino",
+        "href": "/docs/backup-restore/restoring",
+        "tail": "— il flusso che consuma ciò che questa pagina produce."
+      }
+    ]
+  }
+}
diff --git a/web/messages/it/docs/backup-restore/cross-kernel.json b/web/messages/it/docs/backup-restore/cross-kernel.json
new file mode 100644
index 00000000..b784fc2f
--- /dev/null
+++ b/web/messages/it/docs/backup-restore/cross-kernel.json
@@ -0,0 +1,170 @@
+{
+  "meta": {
+    "title": "Ripristino tra versioni del kernel — direzione, filtro sicuro e idratazione | ProxMenux",
+    "description": "Come ProxMenux ripristina un backup host con una versione principale diversa del kernel. Rileva la direzione della differenza, esclude percorsi critici per l’avvio se il kernel di destinazione è più recente e riapplica in quattro fasi IOMMU, ID VFIO e parametri personalizzati senza ricopiare i file legati al kernel.",
+    "ogTitle": "ProxMenux Backup — ripristino tra versioni del kernel e idratazione",
+    "ogDescription": "Ripristino tra versioni del kernel che considera la direzione del cambiamento, con filtro sicuro e idratazione indipendente dal kernel.",
+    "twitterTitle": "Ripristino tra versioni del kernel | ProxMenux",
+    "twitterDescription": "Come ProxMenux gestisce un ripristino quando il kernel di destinazione differisce dal backup."
+  },
+  "header": {
+    "title": "Ripristino tra versioni del kernel",
+    "description": "Come ProxMenux gestisce un ripristino quando l'host di destinazione esegue un kernel diverso da quello registrato nel backup — soprattutto quando il target esegue un kernel più recente. Spiega come viene rilevata la differenza, come i percorsi boot-critical che potrebbero rompere il bersaglio sono filtrati e come la configurazione dell'utente viene riapplicata senza copiare i file legati al kernel verbatim.",
+    "section": "Backup e ripristino"
+  },
+  "intro": {
+    "title": "Ogni salto del kernel viene gestito in modo diverso",
+    "body": "Il kernel di un host Proxmox è identificato da una stringa di versione come <code>6.17.13-2-pve</code>. I primi due numeri (<strong>6.17</strong> in questo esempio) definiscono la versione principale: quando cambiano, alcuni file di configurazione scritti per il kernel precedente potrebbero non essere validi sul nuovo. Quando il ripristino rileva che il backup e l'obiettivo hanno diverse versioni principali del kernel, i rami di flusso in base alla direzione del salto — se il backup è più vecchio o più recente del bersaglio — perché i due casi hanno modalità di guasto opposte. I backup più recenti rispetto al target ripristinano in modo pulito come-è (bench-verified attraverso salti multipli del kernel). I backup più vecchi del target hanno bisogno di un filtro per evitare di rompere il boot del target con la configurazione scritta per un kernel che è cambiato da allora."
+  },
+  "directionCheck": {
+    "heading": "Il controllo della direzione",
+    "intro": "Durante la verifica della compatibilità, <code>hb_compat_check</code> confronta il kernel registrato nel manifesto del backup contro il kernel corrente dell'obiettivo (<code>uname -r</code>) e classifica il ripristino in uno dei tre casi, memorizzato nella variabile interna <code>HB_COMPAT_KERNEL_DIRECTION</code>:",
+    "rows": [
+      {
+        "direction": "same",
+        "condition": "La versione principale del kernel corrisponde tra backup e target.",
+        "behavior": "Il flusso di ripristino completo scorre invariato. Nessun filtro extra, nessuna idratazione, nessun avviso speciale nell'interfaccia utente."
+      },
+      {
+        "direction": "bk_newer",
+        "condition": "Il kernel del backup è PIÙ RECENTE di quello di destinazione (ad esempio: backup su 7.0, destinazione su 6.17).",
+        "behavior": "Il flusso di ripristino completo scorre invariato, esattamente come <code>same</code>. Nessun filtro viene applicato. Verificato empiricamente: i driver auto-reinstallano contro il kernel del target, IOMMU config si applica in modo pulito, le VM con passthrough GPU arrivano senza problemi."
+      },
+      {
+        "direction": "bk_older",
+        "condition": "Il kernel del backup è PIÙ VECCHIO di quello di destinazione (ad esempio: backup su 6.17, destinazione su 7.0).",
+        "behavior": "Il filtro sicuro-sottoset e l'idratazione di quattro fasi qui sotto sono attivati. Il ripristino prosegue — il bersaglio riproduce la fonte, ma i file boot-critical non sono copiati verbatim."
+      }
+    ]
+  },
+  "whyBkNewerIsSafe": {
+    "heading": "Perché un backup con un kernel più recente rispetto al target ripristina invariato",
+    "body": "Quando il ripristino viene eseguito contro un obiettivo con un kernel <em>più vecchio</em> rispetto a quello registrato nel backup, ogni meccanismo che il ripristino dipende è indipendente dalla versione del kernel. Gli installatori di driver GPU e altri installatori PCI-device rilevano il kernel in esecuzione con <code>uname -r</code> e compilano DKMS contro qualunque sia l'obiettivo. Il pacchetto APT install tira binari costruiti per la distribuzione del bersaglio. I gettoni cmdline IOMMU come <code>intel_iommu=on</code> sono stabili nelle principali versioni del kernel. Il backup trasporta i percorsi scritti sotto un kernel più recente, ma quei percorsi (module blacklists, GRUB defaults, initramfs config) sono ancora validi sintassi sul vecchio — i kernel ignorano i token che non riconoscono invece di fallire. Questo caso è equivalente in pratica a un ripristino dello stesso kernel, e ProxMenux lo tratta come tale."
+  },
+  "safeSubsetFilter": {
+    "heading": "Il filtro safe-subset (solo quando il kernel di destinazione è più recente)",
+    "intro": "Quando il kernel di destinazione è più recente di quello del backup, il controllo di compatibilità aggiunge percorsi critici di avvio 16 da <code>hb_unsafe_paths_cross_version</code> a <code>RS_SKIP_PATHS</code>. Questi percorsi sono esclusi dal ripristino perché la scrittura di una versione di loro da un kernel più vecchio su un obiettivo che esegue un nuovo ha causato il panico del kernel nei test di panca. I percorsi coprono cinque categorie:",
+    "categoryRows": [
+      {
+        "category": "Caricatore di avvio",
+        "paths": "<code>/etc/default/grub</code>, <code>/etc/kernel</code>",
+        "reason": "GRUB default legati all'ordine del kernel precedente e allo stato proxmox-boot-tool (cmdline, UUID ESP, ganci) che richiama i percorsi e gli identificatori dall'installazione precedente."
+      },
+      {
+        "category": "Moduli del kernel e artefatti del boot",
+        "paths": "<code>/etc/modules-load.d</code>, <code>/etc/modprobe.d</code>, <code>/etc/initramfs-tools</code>",
+        "reason": "Le liste di carico automatico che possono riferire i moduli rinominati tra le major del kernel, le opzioni del modulo che potrebbero non essere applicate, initramfs hooks scritto per il kernel più vecchio."
+      },
+      {
+        "category": "Identità dello stack di stoccaggio e del filesystem",
+        "paths": "<code>/etc/fstab</code>, <code>/etc/multipath</code>, <code>/etc/iscsi</code>, <code>/etc/udev/rules.d</code>, <code>/etc/zfs</code>",
+        "reason": "UUID che potrebbero non esistere su questa installazione, driver multipath che cambiano tra i kernel, iSCSI parametri che si evolvono, regole udev che possono legare a sottosistemi non esistenti, ZFS Stato (<code>zpool.cache</code> + <code>hostid</code>) che può bloccare pool come straniero."
+      },
+      {
+        "category": "Fonti APT",
+        "paths": "<code>/etc/apt</code>",
+        "reason": "Le suite sorgente APT possono attivare un downgrade di pacchetti critici sul prossimo aggiornamento."
+      },
+      {
+        "category": "systemd",
+        "paths": "<code>/etc/systemd/system</code>, <code>/etc/systemd/journald.conf</code>, <code>/etc/systemd/logind.conf</code>, <code>/etc/systemd/system.conf</code>, <code>/etc/systemd/user.conf</code>",
+        "reason": "Override delle unità e collegamenti .wants legati alla precedente versione principale di systemd; chiavi di configurazione che potrebbero non essere valide in una versione più recente."
+      }
+    ],
+    "outroBody": "Il filtro viene eseguito PRIMA della finestra di dialogo di conferma in modo che l'utente veda l'elenco esatto dei percorsi che verranno saltati, categorizzati per ragione. Il ripristino continua — tutto il resto (configurazione VM/LXC, rete, /etc/pve, utenti, cron, stato ProxMenux, pacchetti, driver, /root) viene ripristinato normalmente."
+  },
+  "hydration": {
+    "heading": "Idratazione Kernel-agnostic",
+    "intro": "Il filtro omette file critici; l’idratazione riapplica impostazioni selezionate: cmdline IOMMU, ID VFIO, <code>GRUB_TIMEOUT</code> personalizzato e blacklist nvidia. Si esegue se il kernel di destinazione è più recente. La fusione cmdline conserva le chiavi di destinazione e i moduli mancanti vengono aggiunti. Valori GRUB e file consentiti possono sostituire contenuti diversi sul target. Ripetere gli stessi input è idempotente.",
+    "phaseRows": [
+      {
+        "phase": "1a — Via GRUB",
+        "detail": "Per host GRUB (installazioni ext4/lvm). <code>_rs_hyd_grub</code> unisce i parametri di <code>manifest.kernel_params.cmdline_extra</code> del backup in <code>GRUB_CMDLINE_LINUX_DEFAULT</code> del target, saltando le chiavi già presenti. Ripristina poi le chiavi consentite <code>GRUB_*</code> (<code>GRUB_TIMEOUT</code>, <code>GRUB_TIMEOUT_STYLE</code>, <code>GRUB_DEFAULT</code>, <code>GRUB_TERMINAL</code>, <code>GRUB_DISABLE_OS_PROBER</code>, <code>GRUB_SERIAL_COMMAND</code>, <code>GRUB_GFXMODE</code>, <code>GRUB_GFXPAYLOAD_LINUX</code>) da <code>/etc/default/grub</code> del backup se i valori differiscono dal target."
+      },
+      {
+        "phase": "1b — systemd-boot / ZFS",
+        "detail": "Per systemd-boot (tipicamente ZFS alla radice). <code>_rs_hyd_kernel_cmdline</code> unisce i parametri utente di <code>cmdline_extra</code> in <code>/etc/kernel/cmdline</code> del target, mantenendo intatti i parametri di avvio <code>root=</code>, <code>boot=</code> e <code>rootflags=</code> del target."
+      },
+      {
+        "phase": "2 — fusione /etc/modules",
+        "detail": "<code>_rs_hyd_modules</code> aggiunge moduli da <code>manifest.kernel_params.modules_loaded_at_boot</code> che sono nella lista bianca (<code>vfio</code>, <code>vfio_pci</code>, <code>vfio_iommu_type1</code>, <code>vfio_virqfd</code>, <code>kvm</code>, <code>kvm_intel</code>, <code>kvm_amd</code>, <code>nvidia</code>, <code>nvidia_drm</code>, <code>nvidia_modeset</code>, <code>nvidia_uvm</code>, <code>i915</code>, <code>xe</code>) E non già presente nell'obiettivo <code>/etc/modules</code>."
+      },
+      {
+        "phase": "3 — Copia di file whitelist",
+        "detail": "<code>_rs_hyd_files</code> copia i file scritti dall’utente dai rootf di staging al target live quando il contenuto differisce. La whitelist copre i file VFIO/nvidia/blacklist sotto le regole <code>/etc/modprobe.d</code>, <code>/etc/modules-load.d</code>, e la regola di legatura ProxMenux VFIO + le regole nvidia udev sotto le regole <code>/etc/udev/rules.d</code>. I file distribuiti (<code>pve-blacklist.conf</code>, <code>mdadm.conf</code>, <code>nvme.conf</code>) sono intenzionalmente esclusi: i loro contenuti si evolvono tra le versioni."
+      },
+      {
+        "phase": "4 — Forza rigenerazione dopo l’avvio",
+        "detail": "Le quattro fasi scrivono direttamente sul target attivo AL DI FUORI DEL il normale processo di ripristino. Per rendere i gettoni/moduli/file fusi effetto sul prossimo avvio, <code>HB_HYDRATION_APPLIED=1</code> si propaga attraverso <code>plan.env</code> a <code>apply_pending_restore.sh</code>, che forza <code>NEEDS_INITRAMFS=1</code> e <code>NEEDS_GRUB=1</code> indipendentemente da quello che era nell'elenco di applicazione. Il dispatcher post-avvio poi rigenera initramfs e rinfresca il bootloader."
+      }
+    ]
+  },
+  "planCommit": {
+    "heading": "Plan vs commit — l'utente vede prima un'anteprima",
+    "body": "L'idratazione scorre in due modi. Prima della finestra di dialogo di conferma, ProxMenux funziona <code>_rs_apply_bk_older_hydration</code> in modalità <code>plan</code>: calcola esattamente ciò che sarebbe stato unito, popola <code>RS_HYDRATION_SUMMARY</code> con un blocco verde che elenca ogni azione, e restituisce senza scrivere. La finestra di dialogo di conferma mostra che il blocco verde accanto all'elenco arancione dei percorsi esclusi, così l'utente vede IN ANTICIPO ciò che verrà riapplicato automaticamente. Dopo la conferma dell'utente, ProxMenux replica lo stesso helper in modalità <code>commit</code> — stesse fasi, stessa logica, ma questa volta ogni fase scrive al target live. Cancellare la finestra di dialogo di conferma lascia il bersaglio intatto."
+  },
+  "flowDiagram": {
+    "heading": "Il flusso quando il kernel di destinazione è più recente di quello del backup",
+    "intro": "I passaggi aggiunti quando il kernel di destinazione è più recente siedono all'interno del normale flusso di ripristino. Tutto il resto — caldo applicare, in attesa di preparare, pacchetto di installazione, post-boot speditore — funziona identicamente a un ripristino dello stesso-kernel.",
+    "diagram": "  ┌────────────────────────────────────────────────────────────┐\n  │ hb_compat_check                                             │\n  │   HB_COMPAT_KERNEL_DIRECTION = bk_older                     │\n  └───────────────────────────┬────────────────────────────────┘\n                              │\n                              ▼\n  ┌────────────────────────────────────────────────────────────┐\n  │ Add 16 boot-critical paths to RS_SKIP_PATHS                 │\n  │   /etc/default/grub, /etc/kernel, /etc/modules-load.d, ...  │\n  └───────────────────────────┬────────────────────────────────┘\n                              │\n                              ▼\n  ┌────────────────────────────────────────────────────────────┐\n  │ _rs_apply_bk_older_hydration \"plan\"                         │\n  │   Compute what would be merged                              │\n  │   Populate RS_HYDRATION_SUMMARY (green block)               │\n  │   No writes                                                 │\n  └───────────────────────────┬────────────────────────────────┘\n                              │\n                              ▼\n  ┌────────────────────────────────────────────────────────────┐\n  │ Confirmation dialog                                         │\n  │   Amber: paths skipped by safe-subset filter                │\n  │   Green: tokens/files reapplied by hydration                │\n  │   User accepts or cancels                                   │\n  └───────────────────────────┬────────────────────────────────┘\n                              │ (accepted)\n                              ▼\n  ┌────────────────────────────────────────────────────────────┐\n  │ _rs_apply_bk_older_hydration \"commit\"                       │\n  │   Phase 1a/1b: merge cmdline tokens + GRUB keys             │\n  │   Phase 2: append modules to /etc/modules                   │\n  │   Phase 3: copy whitelisted vfio/nvidia files               │\n  │   Set HB_HYDRATION_APPLIED=1                                │\n  └───────────────────────────┬────────────────────────────────┘\n                              │\n                              ▼\n  ┌────────────────────────────────────────────────────────────┐\n  │ Rest of the restore runs normally                           │\n  │   _rs_apply hot (skips RS_SKIP_PATHS)                       │\n  │   _rs_prepare_pending_restore (writes plan.env with         │\n  │     HB_HYDRATION_APPLIED=1)                                 │\n  │   packages.manual.list install                              │\n  │   Reboot                                                    │\n  │   apply_pending_restore.sh (forces NEEDS_INITRAMFS=1,       │\n  │     NEEDS_GRUB=1 because of the hydration flag)             │\n  │   apply_cluster_postboot.sh                                 │\n  │     update-initramfs -u -k all                              │\n  │     update-grub / proxmox-boot-tool refresh                 │\n  │     component --auto-reinstall                              │\n  └────────────────────────────────────────────────────────────┘"
+  },
+  "concreteExamples": {
+    "heading": "Esempi concreti",
+    "intro": "Il passaggio di idratazione non è astratto — produce risultati osservabili, corretti per scenari comuni. Due esempi che l'idratazione gestisce automaticamente:",
+    "rows": [
+      {
+        "scenario": "GPU passante (VFIO)",
+        "detail": "Fonte aveva <code>intel_iommu=on iommu=pt</code> nel cmdline, <code>vfio</code>/<code>vfio_pci</code>/<code>vfio_iommu_type1</code> in <code>/etc/modules</code>, un <code>/etc/modprobe.d/vfio.conf</code> con <code>options vfio-pci ids=10de:2216</code>, e un <code>/etc/modprobe.d/blacklist-nvidia.conf</code>. L'idratazione fonde i token cmdline nel GRUB o nella cmdline del kernel, aggiunge i moduli vfio a <code>/etc/modules</code> e copia i due file modprobe scritti dall’utente. Sul prossimo avvio, IOMMU è attivo, modulo VFIO carico, il GPU è legato a vfio-pci e il VM viene fornito con il funzionamento passante."
+      },
+      {
+        "scenario": "Predefinizioni personalizzate GRUB",
+        "detail": "Fonte aveva <code>GRUB_TIMEOUT=1</code> e <code>GRUB_DISABLE_OS_PROBER=true</code>. Hydration legge entrambe le chiavi del backup <code>/etc/default/grub</code>, vede che differiscono dalle impostazioni di installazione fresche, e riscrive quelle due linee nel file del bersaglio (lasciando tutto il resto, incluso <code>GRUB_DISTRIBUTOR</code>, intatto)."
+      }
+    ]
+  },
+  "callout": {
+    "warningTitle": "Ciò che l'idratazione non riapplica quando il kernel di destinazione è più recente",
+    "warningBody": "L'idratazione si applica solo alla configurazione ProxMenux sa essere sicura nelle versioni del kernel: IOMMU tokens, VFIO IDs, whitelist GRUB chiavi, e moduli da un elenco fisso (<code>vfio*</code>, <code>nvidia*</code>, <code>i915</code>, <code>xe</code>, <code>kvm*</code>). Qualsiasi cosa al di fuori di quel set — initramfs personalizzato ganci sotto <code>/etc/initramfs-tools/hooks/</code>, file non whitelist sotto <code>/etc/modprobe.d/</code>, override unità systemd scritte dall’utente — rimane esclusa. Il motivo è concreto: questi file possono chiamare interfacce kernel-internal (module APIs, <code>/sys</code> layout, <code>udev</code> hooks) che cambiano tra le principali versioni, e applicandoli verbatim sopra il kernel più recente può impedire al bersaglio di avviare. Quando è richiesta la riproduzione esatta della catena di avvio, il ripristino deve essere eseguito su un host con la stessa versione del kernel principale del backup."
+  },
+  "codeReference": {
+    "heading": "Dove vivono i meccanismi",
+    "intro": "Per gli sviluppatori che cercano di tracciare o estendere il comportamento cross-kernel:",
+    "rows": [
+      {
+        "component": "Rilevamento della direzione",
+        "location": "<code>hb_compat_check</code> in <code>lib_host_backup_common.sh</code>. Imposta <code>HB_COMPAT_KERNEL_DIRECTION</code>."
+      },
+      {
+        "component": "Elenco dei percorsi Safe-subset",
+        "location": "<code>hb_unsafe_paths_cross_version</code> in <code>lib_host_backup_common.sh</code>. Emette linee <code>path\\treason</code> utilizzate sia dal filtro CLI che dal endpoint Web <code>/api/host-backups/restore/prepare</code>."
+      },
+      {
+        "component": "Fasi di idratazione",
+        "location": "<code>_rs_hyd_grub</code>, <code>_rs_hyd_kernel_cmdline</code>, <code>_rs_hyd_modules</code>, <code>_rs_hyd_files</code> in <code>backup_host.sh</code>. Orchestrata da <code>_rs_apply_bk_older_hydration</code>."
+      },
+      {
+        "component": "Rigenerazione forzata dopo l’avvio",
+        "location": "<code>apply_pending_restore.sh</code> legge <code>HB_HYDRATION_APPLIED</code> da <code>plan.env</code> e forza <code>NEEDS_INITRAMFS=1</code>/<code>NEEDS_GRUB=1</code>."
+      },
+      {
+        "component": "Anteprima web",
+        "location": "<code>/api/host-backups/restore/prepare</code> in <code>flask_server.py</code>. Carica la libreria helper, esegue <code>_rs_apply_bk_older_hydration</code> in modalità piano, restituisce le azioni al Web modal."
+      }
+    ]
+  },
+  "whereNext": {
+    "heading": "Dove andare dopo",
+    "items": [
+      {
+        "label": "Ripristino",
+        "href": "/docs/backup-restore/restoring",
+        "tail": " — il processo completo di ripristino che integra i meccanismi di questa pagina."
+      },
+      {
+        "label": "Come funziona",
+        "href": "/docs/backup-restore/how-it-works",
+        "tail": " — manifesto e raccoglitori che producono il blocco <code>kernel_params</code> letto dall’idratazione."
+      }
+    ]
+  }
+}
diff --git a/web/messages/it/docs/backup-restore/destinations/borg.json b/web/messages/it/docs/backup-restore/destinations/borg.json
new file mode 100644
index 00000000..61f341ae
--- /dev/null
+++ b/web/messages/it/docs/backup-restore/destinations/borg.json
@@ -0,0 +1,234 @@
+{
+  "meta": {
+    "title": "Destinazione Borg — tipi di repository, autenticazione SSH, crittografia | ProxMenux",
+    "description": "La destinazione Borg salva i backup host ProxMenux in un repository locale, su un disco esterno montato o su un server remoto via SSH. Descrive la ricerca dell’eseguibile borg, le quattro opzioni iniziali per le chiavi SSH, la crittografia repokey, le destinazioni salvate e la conservazione per attività pianificata.",
+    "ogTitle": "ProxMenux Backup — Destinazione Borg",
+    "ogDescription": "Come ProxMenux salva i backup host nei repository Borg con autenticazione SSH e crittografia repokey.",
+    "twitterTitle": "Destinazione di backup Borg | ProxMenux",
+    "twitterDescription": "Repository Borg locali, su USB e accessibili via SSH per i backup host."
+  },
+  "header": {
+    "title": "Borg",
+    "description": "La destinazione Borg scrive i backup host a un repository Borg. Sono supportati tre tipi di repository: percorso filesystem locale, disco esterno montato o server remoto tramite SSH. Deduplicazione a livello di Chunk in tutti gli archivi del repository e crittografia repokey opzionale.",
+    "section": "Backup e ripristino"
+  },
+  "aboutBorg": {
+    "heading": "Quello che Borg è",
+    "body": "Borg (anche scritto BorgBackup) è uno strumento di backup deduplicante open source mantenuto dalla comunità di Borg Backup. Memorizza ogni archivio come un insieme di blocchi di lunghezza variabile all'interno di un repository; i pezzi sono condivisi in archivi in modo da ri-back up dati invariati ha un costo di archiviazione quasi zero. Borg non è legato a Proxmox — è uno strumento di backup generale utilizzato in molti ambienti. ProxMenux lo utilizza come una delle tre destinazioni per i backup host; ogni meccanismo specifico Borg descritto in questa pagina (tipo di repository, borg-serve su SSH, crittografia di repokey, prune) è il comportamento standard Borg."
+  },
+  "intro": {
+    "title": "Deduplicazione per blocchi con repository locali o accessibili via SSH",
+    "body": "Un repository Borg conserva blocchi condivisi tra tutti i suoi archivi: ripetere il backup di un file invariato non trasferisce né memorizza nuovi dati. ProxMenux usa <code>borg create</code> per il backup e <code>borg extract</code> per il ripristino. Il repository può trovarsi sullo stesso filesystem dell’origine, su un disco esterno montato o su un host remoto accessibile via SSH."
+  },
+  "binarySourcing": {
+    "heading": "Il binario di borg",
+    "intro": "Borg non è una dipendenza di base dell'installatore ProxMenux. Quando un backup viene eseguito, <code>hb_ensure_borg</code> risolve il binario da quattro fonti in ordine e restituisce il primo che funziona:",
+    "rows": [
+      {
+        "priority": "1",
+        "source": "Sistema <code>borg</code>",
+        "detail": "Se l'host ha già installato <code>borg</code> tramite APT (<code>which borg</code> risolve), questo binario viene utilizzato."
+      },
+      {
+        "priority": "2",
+        "source": "cache di stato",
+        "detail": "<code>/usr/local/share/proxmenux/borg</code> — tenuto da un precedente download GitHub su questo host."
+      },
+      {
+        "priority": "3",
+        "source": "Pacchetto AppImage del Monitor",
+        "detail": "<code>/usr/local/share/proxmenux/monitor-app/usr/bin/borg</code> — il AppImage fa un borg-linux64 firmato. Questo è il percorso offline: un host senza internet ha ancora un <code>borg</code> funzionante."
+      },
+      {
+        "priority": "4",
+        "source": "Scarica GitHub",
+        "detail": "<code>wget</code> contro l'URL pinned <code>borg-linux64</code> sotto <code>github.com/borgbackup/borg/releases/</code>, verificatosi contro una costante SHA-256 in <code>lib_host_backup_common.sh</code> (<code>HB_BORG_LINUX64_SHA256</code>). Su checksum sbagliato il binario viene scartato e il backup si interrompe. Il file scaricato viene memorizzato nella cache dello stato, quindi i backup successivi utilizzano il percorso 2."
+      }
+    ]
+  },
+  "repoTypes": {
+    "heading": "Tipi di repository",
+    "intro": "Il tipo di repository viene scelto quando viene aggiunto un obiettivo. Ogni tipo si risolve in un altro URL di repository che Borg capisce.",
+    "rows": [
+      {
+        "type": "remote",
+        "url": "ssh://USER@HOST/RPATH",
+        "detail": "Repository vive su un server remoto che esegue <code>borg serve</code>. Richiede una connessione SSH a quel server."
+      },
+      {
+        "type": "usb",
+        "url": "/mnt/MOUNTPOINT/borgbackup",
+        "detail": "Il repository vive su un disco esterno montato (tipicamente USB). Il montaggio viene risolto tramite <code>hb_prompt_mounted_path</code>, che rileva, monta o formatta le partizioni USB come necessario."
+      },
+      {
+        "type": "local",
+        "url": "/backup/borgbackup (any absolute path)",
+        "detail": "Repository vive su una directory locale. Significativo solo quando la directory di destinazione è su un disco fisico separato — un repository sullo stesso disco della fonte protegge dall'errore dell'operatore, ma non dall'errore del disco."
+      }
+    ]
+  },
+  "serverSetup": {
+    "heading": "Preparazione del server Borg (lato server)",
+    "intro": "Il tipo di repository <code>remote</code> richiede un server Borg funzionante e accessibile via SSH. ProxMenux non configura il server: autorizza soltanto una chiave per un account esistente. Questa sezione descrive i requisiti del server prima della connessione.",
+    "hostChoicesTitle": "Dove il server può vivere",
+    "hostChoicesBody": "Qualsiasi host Linux con accesso SSH si qualifica. Configurazioni comuni:",
+    "hostChoicesItems": [
+      "Un NAS dedicato o una scatola di backup (Debian, Ubuntu, TrueNAS SCALE con una shell).",
+      "Un contenitore LXC all'interno di un nodo Proxmox. Piccola impronta, isolata dall'host che esegue i backup.",
+      "Un altro host Proxmox sulla stessa LAN, o un VM ovunque raggiungibile tramite SSH."
+    ],
+    "lxcWarningTitle": "LXC come server Borg",
+    "lxcWarningBody": "Se il server Borg è in un LXC, generate-auto richiede un account che accetti l’autenticazione SSH con password per installare la chiave. In alternativa, usa l’installazione manuale o generate-pct tramite l’host PVE.",
+    "requirementsTitle": "Requisiti sul server",
+    "requirementsRows": [
+      {
+        "requirement": "Eseguibile borg in <code>/usr/bin/borg</code>",
+        "detail": "La riga <code>command=\"/usr/bin/borg serve ...\"</code> scritta da ProxMenux in <code>authorized_keys</code> usa questo percorso fisso. APT (<code>apt install borgbackup</code>) installa lì l’eseguibile. Per un binario autonomo occorre un collegamento simbolico in <code>/usr/bin/borg</code>."
+      },
+      {
+        "requirement": "Un account utente dedicato (tipicamente <code>borg</code>)",
+        "detail": "Possiede la directory del repository e riceve connessioni SSH in arrivo. Non ha bisogno di sudo o di accesso alla shell — la linea authorized_keys disabilita comunque le shell interattive."
+      },
+      {
+        "requirement": "Una directory di repository writable",
+        "detail": "Il percorso che l'operatore dà a ProxMenux (ad esempio <code>/backup/borgbackup</code>) deve esistere sul server ed essere di proprietà dell'utente borg."
+      },
+      {
+        "requirement": "SSH daemon accetta l'utente borg",
+        "detail": "<code>PubkeyAuthentication yes</code> (default). L'autenticazione della password è necessaria solo per il flusso <em>generate-auto</em> di un colpo — dopo l'installazione della chiave, il server può disabilitare completamente la password."
+      }
+    ],
+    "minimalSetupTitle": "Configurazione server Minimal",
+    "minimalSetupBody": "Su un server Debian o Ubuntu Borg, una linea base di lavoro è quattro comandi come root:",
+    "minimalSetupCmd": "apt install borgbackup\nuseradd -m -d /home/borg -s /bin/bash borg\nmkdir -p /backup/borgbackup\nchown borg:borg /backup/borgbackup",
+    "minimalSetupNote": "Con il server pronto e l’autenticazione SSH con password disponibile, <code>generate-auto</code> installa la chiave tramite un account che possa scrivere in authorized_keys dell’utente borg. I backup successivi usano questa chiave, limitata a <code>borg serve</code> sul percorso configurato. Senza accesso con password, installala manualmente o tramite l’host PVE."
+  },
+  "sshAuth": {
+    "heading": "Autenticazione SSH (lato cliente)",
+    "intro": "I repository Borg remoti sono accessibili su SSH. La connessione viene eseguita dall'host ProxMenux a un account utente sul server Borg che esegue <code>borg serve</code>. Questo utente è tipicamente chiamato <code>borg</code>, NON l'utente admin/root del server — la linea di comando borg-serve blocca la connessione a quel percorso di repository specifico (vedere le strategie chiave qui sotto).",
+    "strategiesTitle": "Strategie per le chiavi SSH",
+    "strategiesIntro": "Aggiungendo una destinazione remota, ProxMenux chiede utente SSH, host, porta e percorso remoto, poi offre quattro opzioni di autenticazione. Se l’accesso con password viene rifiutato, propone anche generate-pct. Le modalità sono descritte di seguito:",
+    "strategyRows": [
+      {
+        "mode": "generate-auto",
+        "label": "Consigliato",
+        "detail": "ProxMenux genera o riutilizza una coppia di chiavi ed25519 in <code>~/.ssh/borg_proxmenux_HOST_ed25519</code>, poi usa <code>sshpass</code> per verificare l’accesso e installare la chiave pubblica in <code>~borg/.ssh/authorized_keys</code>. La password appartiene a un account che possa scrivere il file, solitamente root o borg. Serve durante la configurazione e non viene salvata."
+      },
+      {
+        "mode": "generate-manual",
+        "label": "Nessuna password di amministratore su questo host",
+        "detail": "ProxMenux genera il keypair come sopra ma visualizza la linea completa <code>authorized_keys</code> per l'operatore di incollare manualmente nel server. La password di amministratore non lascia mai l'host ProxMenux perché non viene mai chiesto."
+      },
+      {
+        "mode": "generate-pct",
+        "label": "Il server Borg è un PVE LXC",
+        "detail": "Il server Borg viene eseguito all'interno di un LXC su un nodo PVE. ProxMenux autorizza la chiave tramite <code>pct exec</code> dall'host PVE — root sull'host PVE scrive nel LXC <code>~borg/.ssh/authorized_keys</code> senza bisogno di SSH nel LXC stesso."
+      },
+      {
+        "mode": "existing",
+        "label": "Utilizzare una chiave esistente",
+        "detail": "ProxMenux scansiona <code>/root/.ssh/</code> e <code>$HOME/.ssh/</code> per le chiavi private parseable ed25519/RSA e le elenca. L'operatore sceglie uno o naviga manualmente su un percorso non standard."
+      },
+      {
+        "mode": "none",
+        "label": "Configurazione predefinita SSH",
+        "detail": "Nessuna chiave personalizzata — Borg si basa sulla configurazione predefinita SSH dell'host (tipicamente <code>~/.ssh/id_rsa</code> o un agente SSH)."
+      }
+    ],
+    "restrictTitle": "La linea authorized_keys",
+    "restrictBody": "Per ogni chiave generata, la riga <code>authorized_keys</code> scritta da ProxMenux sul server limita la chiave a questa invocazione di borg-serve sul percorso configurato del repository:",
+    "restrictLine": "command=\"/usr/bin/borg serve --restrict-to-path RPATH\",restrict PUBKEY",
+    "restrictNote": "Il <code>command=</code> costringe ogni sessione SSH utilizzando questa chiave per eseguire solo il comando borg-serve; <code>restrict</code> disabilita l'inoltro della porta, l'inoltro dell'agente, l'inoltro di X11 e l'allocazione di PTY. La chiave non può essere utilizzata per aprire una shell interattiva sul server o per accedere a qualsiasi altro percorso di repository, anche se l'account ha privilegi più ampi."
+  },
+  "savedTargets": {
+    "heading": "Obiettivi salvati",
+    "intro": "Una destinazione salvata conserva la configurazione del repository con un nome riconoscibile, evitando di reinserire i dati. File nella directory di stato di ProxMenux:",
+    "rows": [
+      {
+        "file": "borg-targets.txt",
+        "content": "Una riga per destinazione: <code>NAME|REPO|SSH_KEY_PATH|ENCRYPT_MODE</code>. <code>hb_collect_borg_configs</code> la legge per compilare il menu di selezione delle destinazioni."
+      },
+      {
+        "file": "borg-pass-NAME.txt",
+        "content": "Passphrase della destinazione indicata sopra come NAME (<code>chmod 600</code>). Presente soltanto se è stata scelta la crittografia repokey."
+      }
+    ],
+    "outro": "Salvare la destinazione è facoltativo. Rifiutando non si salva la configurazione con nome, ma una chiave SSH generata non viene eliminata. Se si attiva repokey senza salvare la destinazione, ProxMenux conserva comunque la passphrase nel file preesistente borg-pass.txt."
+  },
+  "encryption": {
+    "heading": "Crittografia",
+    "body": "I repository sono inizializzati con una modalità di crittografia tramite <code>hb_borg_init_if_needed</code>: il moderno <code>borg repo-create -e MODE</code> quando disponibile, o il <code>borg init --encryption=MODE</code> legacy. ProxMenux espone due modalità: <code>repokey</code> (default) e <code>none</code>. In modalità <code>repokey</code> Borg memorizza la chiave di cifratura all'interno del repository stesso; l'accesso richiede una passphrase, che ProxMenux richiede due volte con verifica della corrispondenza e salva in <code>borg-pass-NAME.txt</code> per le destinazioni salvate, altrimenti nel file precedente descritto sopra. Una finestra di dialogo di riconoscimento obbligatoria viene mostrata dopo che il passphrase viene salvato: il passphrase è l'unico modo per accedere agli archivi crittografati, e perderlo rende ogni archivio nel repository non recuperabile."
+  },
+  "runtimeEnv": {
+    "heading": "Ambiente runtime",
+    "intro": "ProxMenux esporta le seguenti variabili ambientali prima di invocare <code>borg</code>. Configurano la connessione e sbloccano il repository senza inserire segreti nella riga di comando.",
+    "rows": [
+      {
+        "var": "BORG_RSH",
+        "value": "ssh -i SSH_KEY_PATH -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new [-p PORT]",
+        "purpose": "Comando remoto usato da Borg per i repository SSH. Una chiave selezionata aggiunge le opzioni di identità. Quando una destinazione viene aggiunta con una porta non standard, ProxMenux aggiunge anche -p PORT; le destinazioni salvate, i processi pianificati e il Monitor usano invece la porta dell’URL ssh://. Senza chiave personalizzata, e per una nuova destinazione con la porta predefinita, la variabile resta non impostata e Borg usa la configurazione SSH dell’host."
+      },
+      {
+        "var": "BORG_PASSPHRASE",
+        "value": "(passphrase da borg-pass-NAME.txt)",
+        "purpose": "Sblocca il repokey. Impostare solo quando il target utilizza la crittografia <code>repokey</code>. Non compare mai nell'elenco degli argomenti di processo."
+      },
+      {
+        "var": "BORG_ENCRYPT_MODE",
+        "value": "repokey | none",
+        "purpose": "Utilizzato da <code>hb_borg_init_if_needed</code> quando inizializza un repository che non esiste ancora. Ignorato da <code>borg create</code> su repository esistenti."
+      },
+      {
+        "var": "BORG_RELOCATED_REPO_ACCESS_IS_OK",
+        "value": "yes",
+        "purpose": "Supprime il prompt interattivo Borg solleva quando l'URL del repository differisce dall'URL che originariamente è stato raggiunto da (comune dopo un rinominamento del punto di montaggio o SSH-host raggiungibile tramite nuovo indirizzo)."
+      },
+      {
+        "var": "BORG_UNKNOWN_UNENCRYPTED_REPO_ACCESS_IS_OK",
+        "value": "yes",
+        "purpose": "Suppresse il prompt interattivo Borg solleva la prima volta che un repository non crittografato è accessibile da un nuovo client."
+      }
+    ]
+  },
+  "archiveFormat": {
+    "heading": "Archivio denominazione e ritenzione",
+    "intro": "Ogni backup crea un nuovo archivio all'interno del repository.",
+    "namePattern": "hostcfg-HOSTNAME-YYYYMMDD_HHMMSS",
+    "retentionBody": "Per i lavori programmati, <code>run_scheduled_backup.sh</code> esegue <code>borg prune</code> contro il repository dopo ogni backup di successo con i valori di ritenzione configurati sul lavoro (<code>--keep-last</code>, <code>--keep-daily</code>, <code>--keep-weekly</code>). I backup interattivi non eliminano le vecchie copie."
+  },
+  "restoreAccess": {
+    "heading": "Recuperare sul lato del ripristino",
+    "body": "Il flusso di ripristino elenca gli archivi con <code>borg list REPO</code> ed estrae quello selezionato con <code>borg extract REPO::ARCHIVE-NAME</code> in una directory di staging che <code>_rs_check_layout</code> si alimenta alla pipeline di ripristino standard. Per il recupero manuale al di fuori di ProxMenux gli stessi comandi funzionano; l'albero estratto è il layout standard a tre payload descritto in <em>Come funziona </em>."
+  },
+  "references": {
+    "heading": "Referenze",
+    "intro": "Documentazione ufficiale di Borg per i componenti usati da ProxMenux.",
+    "items": [
+      {
+        "label": "Documentazione del Borg",
+        "href": "https://borgbackup.readthedocs.io/",
+        "tail": "— punto di ingresso principale che copre concetti, distribuzione, avvio rapido e ogni comando."
+      },
+      {
+        "label": "borg create",
+        "href": "https://borgbackup.readthedocs.io/en/stable/usage/create.html",
+        "tail": " — il comando usato da ProxMenux per ogni backup, con tutte le opzioni supportate."
+      },
+      {
+        "label": "Crittografia del repository",
+        "href": "https://borgbackup.readthedocs.io/en/stable/usage/init.html#encryption-mode",
+        "tail": "— le modalità di crittografia Borg supporta, incluso il repokey che ProxMenux utilizza per impostazione predefinita."
+      },
+      {
+        "label": "borg serve e configurazione tramite SSH",
+        "href": "https://borgbackup.readthedocs.io/en/stable/deployment/central-backup-server.html",
+        "tail": " — configurazione di un server Borg centrale accessibile via SSH, con il comando borg-serve e l’opzione restrict-to-path che ProxMenux scrive in authorized_keys."
+      },
+      {
+        "label": "borg prune",
+        "href": "https://borgbackup.readthedocs.io/en/stable/usage/prune.html",
+        "tail": " — il modello di conservazione di --keep-last / --keep-daily / --keep-weekly che ProxMenux applica a ogni attività pianificata."
+      }
+    ]
+  }
+}
diff --git a/web/messages/it/docs/backup-restore/destinations/index.json b/web/messages/it/docs/backup-restore/destinations/index.json
new file mode 100644
index 00000000..3e80c055
--- /dev/null
+++ b/web/messages/it/docs/backup-restore/destinations/index.json
@@ -0,0 +1,110 @@
+{
+  "meta": {
+    "title": "Destinazioni di backup — Locale, Proxmox Backup Server, Borg | ProxMenux",
+    "description": "Tre backend di storage ricevono lo stesso payload di backup ProxMenux: un archivio locale .tar.zst su qualsiasi filesystem scrivibile, un backup PBS in un datastore Proxmox Backup Server o un archivio Borg in un repository Borg locale o remoto. Ogni backend ha le proprie caratteristiche di compressione, deduplicazione, crittografia e rete.",
+    "ogTitle": "Destinazioni di backup ProxMenux",
+    "ogDescription": "Locale, Proxmox Backup Server e Borg — tre backend di archiviazione per lo stesso carico di backup host.",
+    "twitterTitle": "Destinazioni di backup ProxMenux | ProxMenux",
+    "twitterDescription": "Archivio locale, backend Proxmox Backup Server e Borg per i backup host."
+  },
+  "header": {
+    "title": "Destinazioni",
+    "description": "Tre backend di storage supportati da ProxMenux Backup: archivio locale, Proxmox Backup Server (consigliato) e Borg. Ognuno riceve lo stesso archivio con tre blocchi di dati; differiscono in formato di archiviazione, deduplicazione, modello di crittografia e requisiti di rete.",
+    "section": "Backup e ripristino"
+  },
+  "intro": {
+    "title": "Stesso contenuto, tre backend",
+    "body": "Ogni backup produce gli stessi tre payload (rootfs, manifest, applicazioni). Ciò che cambia tra le destinazioni è il modo in cui questi carichi sono memorizzati e come l'operatore li recupera per un ripristino. Ogni backend viene implementato come funzione separata in <code>backup_host.sh</code> — <code>_bk_local</code>, <code>_bk_pbs</code>, <code>_bk_borg</code> — ma tutti e tre condividono lo stesso passo di staging (<code>hb_prepare_staging</code>) e lo stesso percorso del codice di ripristino. La scelta della destinazione colpisce solo la scrittura e il recupero; non cambia ciò che un ripristino fa o come consuma l'archivio."
+  },
+  "comparison": {
+    "heading": "Confronto delle caratteristiche",
+    "intro": "La tabella seguente elenca le differenze concrete tra i tre backend come si comportano oggi in ProxMenux. Tutti i valori descrivono il comportamento osservato del backend stesso, non raccomandazioni editoriali.",
+    "rows": [
+      {
+        "feature": "Formato di archiviazione",
+        "local": "File <code>.tar.zst</code> singolo (o <code>.tar.gz</code> se <code>zstd</code> è assente).",
+        "pbs": "Backup PBS (blocchi <code>.pxar</code> nel datastore).",
+        "borg": "Archivio Borg all'interno di un repository Borg (file di segmento)."
+      },
+      {
+        "feature": "Compressione",
+        "local": "zstd (livello predefinito) tramite <code>tar --zstd</code>. gzip fallback.",
+        "pbs": "Gestita da proxmox-backup-client. ProxMenux non modifica le impostazioni di compressione.",
+        "borg": "Compressione integrata di Borg. ProxMenux richiama borg create senza modificare le impostazioni di compressione."
+      },
+      {
+        "feature": "Deduplicazione",
+        "local": "Nessuno. Ogni backup è un archivio completamente indipendente.",
+        "pbs": "Deduplicazione completa a livello di blocchi tra tutti i backup nel datastore.",
+        "borg": "Deduplicazione completa a livello di blocchi tra tutti gli archivi del repository."
+      },
+      {
+        "feature": "Crittografia a riposo",
+        "local": "Nessuno (si basa sulla protezione a livello di filesystem).",
+        "pbs": "Crittografia opzionale lato client mediante un file di chiave. Se abilitata, il blob di recupero viene caricato in un gruppo di backup separato.",
+        "borg": "Crittografia repokey opzionale (chiave memorizzata nel repo, sbloccata da una passphrase)."
+      },
+      {
+        "feature": "Conservazione / eliminazione delle vecchie copie",
+        "local": "Applicata a ogni attività pianificata tramite <code>KEEP_LAST</code>. I vecchi archivi vengono eliminati insieme ai file ausiliari e ai log di esecuzione. I backup interattivi non eliminano le vecchie copie.",
+        "pbs": "Applicato per lavoro programmato tramite <code>proxmox-backup-client prune --keep-last / --keep-daily / --keep-weekly</code>. I backup interattivi non eliminano le vecchie copie.",
+        "borg": "Applicato per lavoro programmato tramite <code>borg prune --keep-last / --keep-daily / --keep-weekly</code>. I backup interattivi non eliminano le vecchie copie."
+      },
+      {
+        "feature": "Rete",
+        "local": "Nessuno. Scrive a un punto di montaggio locale (tipicamente un disco interno o un'unità USB).",
+        "pbs": "TCP al server PBS (porta di default 8007). Richiede credenziali PBS + impronta digitale.",
+        "borg": "percorso filesystem locale o tunnel SSH a un host Borg remoto."
+      },
+      {
+        "feature": "Dipendenze",
+        "local": "<code>tar</code>, <code>zstd</code> (presente su Proxmox per impostazione predefinita).",
+        "pbs": "Pacchetto <code>proxmox-backup-client</code> (incluso in Proxmox VE 8+).",
+        "borg": "binario <code>borg</code>. Auto-provisionato da ProxMenux dal pacchetto Monitor AppImage quando manca."
+      },
+      {
+        "feature": "Accesso per il ripristino",
+        "local": "Qualsiasi host con tar+zstd può estrarre l'archivio. Non è necessario PBS/Borg.",
+        "pbs": "Richiede <code>proxmox-backup-client</code>, le credenziali PBS e il file di chiave (se il backup è crittografato).",
+        "borg": "Richiede <code>borg</code> + il percorso del repository + la passphrase (se crittografato)."
+      }
+    ],
+    "captionCode": "feature",
+    "captionLocal": "Locale",
+    "captionPbs": "Proxmox Backup Server (consigliato)",
+    "captionBorg": "Borg"
+  },
+  "sameArchive": {
+    "heading": "Il layout dell'archivio non cambia con la destinazione",
+    "body": "All'interno di una delle tre destinazioni, lo stesso layout <code>rootfs/</code> + <code>metadata/</code> + <code>manifest.json</code> descritto in <em>Come funziona</em> è presente. Un <code>.tar.zst</code> estratto da un archivio locale, un <code>.pxar</code> restaurato da PBS, e un archivio Borg estratto con <code>borg extract</code> producono tutti un albero di directory identico. Il percorso del codice di ripristino (<code>_rs_check_layout</code>, <code>_rs_apply</code>, <code>_rs_prepare_pending_restore</code>) legge gli stessi tre blocchi di dati senza sapere da quale destinazione provenivano."
+  },
+  "extractStandalone": {
+    "heading": "Estrazione di un backup al di fuori di ProxMenux",
+    "intro": "Tutti i tre formati di archivio possono essere letti con strumenti standard senza ProxMenux installati sull'host di lettura. I comandi sottostanti producono lo stesso albero di directory che un ripristino consuma internamente.",
+    "localCmd": "# From a local .tar.zst archive:\ntar --zstd -xf hostcfg-HOST-TIMESTAMP.tar.zst\n\n# From a .tar.gz fallback:\ntar -xzf hostcfg-HOST-TIMESTAMP.tar.gz",
+    "pbsCmd": "# From a PBS backup (requires proxmox-backup-client):\nproxmox-backup-client restore \\\n    --repository USER@REALM@HOST:DATASTORE \\\n    host/hostcfg-HOST/BACKUP-TIME \\\n    hostcfg.pxar /tmp/hostcfg\n\n# Add --keyfile KEY-PATH when the backup is encrypted.",
+    "borgCmd": "# Da un archivio Borg (richiede borg e la passphrase per i repository crittografati):\nborg extract REPO-PATH::ARCHIVE-NAME\n\n# Su un repository remoto accessibile via SSH:\nborg extract ssh://USER@HOST:PORT/REPO-PATH::ARCHIVE-NAME",
+    "note": "L'albero estratto può quindi essere ispezionato manualmente o alimentato a un ripristino manuale. Vedere le singole pagine di destinazione per l'esatto flusso di recupero ProxMenux utilizza sotto il cofano."
+  },
+  "whereNext": {
+    "heading": "Dettagli per destinazione",
+    "intro": "Ogni destinazione ha una propria pagina che copre il flusso di configurazione, il formato on-disk e il comando di recupero utilizzato dal ripristino.",
+    "items": [
+      {
+        "label": "Archivio locale",
+        "href": "/docs/backup-restore/destinations/local",
+        "tail": "— preconfigurazione di un target locale, montaggio dell'unità USB, controllo di sicurezza contro la scrittura dell'archivio in sé, la sidecar JSON che consente al Monitor di identificare il file."
+      },
+      {
+        "label": "Proxmox Backup Server (consigliato)",
+        "href": "/docs/backup-restore/destinations/pbs",
+        "tail": "— selezione di datastore, credenziali e impronte digitali, ciclo di vita del keyfile di crittografia, passphrase di recupero, caricando il blob di recupero a PBS per il recupero di installazione fresca."
+      },
+      {
+        "label": "Borg",
+        "href": "/docs/backup-restore/destinations/borg",
+        "tail": " — repository locali o accessibili via SSH, provenienza del binario Borg (sistema / cache / pacchetto AppImage di Monitor / download GitHub), inizializzazione del repository, gestione delle passphrase e configurazione delle chiavi SSH per i repository remoti."
+      }
+    ]
+  }
+}
diff --git a/web/messages/it/docs/backup-restore/destinations/local.json b/web/messages/it/docs/backup-restore/destinations/local.json
new file mode 100644
index 00000000..0bf1d672
--- /dev/null
+++ b/web/messages/it/docs/backup-restore/destinations/local.json
@@ -0,0 +1,75 @@
+{
+  "meta": {
+    "title": "Destinazione dell'archivio locale — tar.zst su un filesystem o unità USB | ProxMenux",
+    "description": "La destinazione di backup locale scrive un singolo archivio .tar.zst a qualsiasi directory scrivibile: un disco interno, un punto di montaggio Proxmox, una condivisione NFS o un'unità USB. Documenta il flusso di configurazione, la logica di rilevamento e montaggio USB, il controllo di sicurezza contro la scrittura dell'archivio in un percorso incluso nel backup, e il file ausiliario JSON che identifica il file.",
+    "ogTitle": "ProxMenux Backup — Destinazione dell'archivio locale",
+    "ogDescription": "Come ProxMenux scrive i backup locali come archivi .tar.zst e come configurare la directory di destinazione o unità USB.",
+    "twitterTitle": "Destinazione di backup locale | ProxMenux",
+    "twitterDescription": "Come ProxMenux scrive i backup locali come archivi .tar.zst su un filesystem o unità USB."
+  },
+  "header": {
+    "title": "Archivio locale",
+    "description": "La destinazione locale scrive un unico archivio tar compresso in una directory scrivibile sull’host: su un disco interno, un filesystem NFS o SMB montato oppure un’unità USB.",
+    "section": "Backup e ripristino"
+  },
+  "intro": {
+    "title": "Un file, autocontenuto",
+    "body": "Un backup locale produce un singolo file <code>hostcfg-HOST-TIMESTAMP.tar.zst</code> (o <code>.tar.gz</code> quando <code>zstd</code> è assente). Il file contiene l'intero albero di archivio — <code>manifest.json</code>, <code>metadata/</code> e <code>rootfs/</code> — e può essere ripristinato su qualsiasi host Proxmox con il flusso di ripristino ProxMenux o estratto manualmente con <code>tar --zstd -xf</code> su qualsiasi sistema Linux. Nessun server, nessuna inizializzazione del repository, nessuna dipendenza esterna. Questa è la destinazione con il percorso di recupero più breve quando non è disponibile né PBS né Borg."
+  },
+  "targetConfig": {
+    "heading": "Configurazione della directory target",
+    "intro": "La destinazione locale è una <strong>unica directory di destinazione salvata in modo persistente</strong> — non un elenco. ProxMenux memorizza la scelta dell'operatore su <code>/usr/local/share/proxmenux/local-target.conf</code> e la legge su ogni backup. Quando non è stato configurato alcun obiettivo, viene utilizzato il <code>HB_LOCAL_TARGET_DEFAULT = /var/lib/vz/dump</code> predefinito (la stessa directory Proxmox utilizza per le proprie uscite <code>vzdump</code>). L'obiettivo è configurato da <em>Configura destinazioni di backup → Destinazioni locali</em>:",
+    "options": [
+      "<strong>Utilizzo predefinito (<code>/var/lib/vz/dump</code>).</strong> Lo storage locale Proxmox. Presente su ogni installazione Proxmox; l'archivio si trova accanto alle uscite vzdump e viene ritirato dalla scheda Monitor Backups automaticamente.",
+      "<strong>Inserisci un percorso personalizzato.</strong> Puoi usare qualsiasi percorso assoluto del filesystem: un montaggio NFS, una condivisione SMB montata tramite <code>fstab</code>, un dataset ZFS dedicato o un secondo disco interno. Prima di salvarlo, ProxMenux verifica che il percorso esista e sia una directory.",
+      "<strong>Scegli un’unità USB.</strong> Apre il sottomenu USB (sotto), che rileva dispositivi rimovibili e offre di montare o formattarne uno."
+    ]
+  },
+  "usbFlow": {
+    "heading": "Rilevamento dell'unità USB e montaggio",
+    "intro": "Il sottomenu USB elenca le partizioni su dispositivi rimovibili segnalate da <code>lsblk</code>. Ogni partizione è presentata con la sua dimensione, l'etichetta del filesystem e lo stato corrente. Lo stato determina l’azione proposta da ProxMenux.",
+    "statesTitle": "I tre stati del dispositivo",
+    "stateRows": [
+      {
+        "state": "montato",
+        "shown": "Dimensione · etichetta · [fstype] · → /mount/point",
+        "action": "La partizione è già montata da qualche parte. La selezione salva il punto di montaggio corrente come obiettivo locale. Nessun montaggio viene eseguito."
+      },
+      {
+        "state": "non montato",
+        "shown": "Dimensione · etichetta · [fstype] · (non montato — sarà montato)",
+        "action": "Un filesystem è presente ma non montato. A conferma, ProxMenux gestisce <code>hb_mount_usb_partition</code>: crea <code>/mnt/backup-LABEL</code> (o un percorso basato su UUID se non c'è etichetta), monta la partizione e persiste il punto di montaggio come obiettivo locale."
+      },
+      {
+        "state": "vuoto",
+        "shown": "Dimensione · disco USB grezzo — nessun filesystem (verrà FORMATTATO)",
+        "action": "Il dispositivo non ha un filesystem. Questa operazione distruttiva è protetta da due conferme. Prima una finestra Sì/No spiega che il disco verrà cancellato. Poi una casella di input richiede di <strong>digitare il percorso esatto del dispositivo</strong> (ad esempio <code>/dev/sdb</code>) prima che ProxMenux crei una nuova tabella GPT con una partizione ext4 e la monti."
+      }
+    ],
+    "notMountedFallback": "Quando non viene rilevato alcun dispositivo USB, il submenu rientra in una semplice casella di input. L'operatore può immettere un percorso di mount point arbitrario; se il percorso non è un punto di montaggio registrato, una finestra di dialogo di conferma avvisa prima di procedere."
+  },
+  "safetyCheck": {
+    "heading": "Controllo di sicurezza — destinazione all'interno di un percorso di backup",
+    "body": "Prima di scrivere l'archivio, <code>_bk_local</code> verifica che la directory di destinazione sia <strong>non</strong> un sottopercorso di qualsiasi directory di cui viene eseguito il backup. Un errore comune sarebbe aggiungere <code>/root</code> al profilo e scegliere <code>/root/backups</code> come destinazione: l'archivio quindi includerebbe se stesso, producendo un archivio corrotto o crescendo senza limiti finché il disco non si riempie. Il controllo risolve entrambi i percorsi con <code>readlink -m</code>, li confronta e, in caso di conflitto, interrompe il backup con una finestra di dialogo che nomina il percorso in conflitto ed elenca tre modi per risolverlo: scegliere una destinazione al di fuori del percorso in conflitto, rimuovere la voce personalizzata che contiene la destinazione o utilizzare la modalità personalizzata per deselezionare il percorso in conflitto per questa esecuzione."
+  },
+  "archiveFormat": {
+    "heading": "Formato archivio e compressione",
+    "intro": "Il nome del file di output include il nome host di origine e la data e ora del backup, per consentire l’ordinamento cronologico delle varie copie nella directory e identificare ogni file.",
+    "namePattern": "hostcfg-HOSTNAME-YYYYMMDD_HHMMSS.tar.zst",
+    "compressionTitle": "Compressione",
+    "compressionBody": "Il metodo principale usa <code>tar --zstd -cf</code>: un singolo comando che comprime al livello predefinito di zstd. Se <code>zstd</code> non è presente sull’origine (raro su Proxmox, ma possibile nelle installazioni minime), ProxMenux ripiega su <code>gzip</code>. In questo caso, se <code>pv</code> è disponibile, viene aggiunta una barra di avanzamento per mostrare la crescita dell’archivio in tempo reale; senza <code>pv</code>, viene usato il semplice <code>tar -czf</code> senza output di avanzamento.",
+    "sourceTitle": "Cosa viene incluso nell’archivio",
+    "sourceBody": "Il comando tar viene richiamato con <code>-C \"$staging_root\" .</code> e archivia <strong>l’intera radice della directory temporanea</strong>: <code>rootfs/</code>, <code>metadata/</code> e <code>manifest.json</code>. I tre blocchi di dati si trovano affiancati al livello superiore dell’archivio tar. L’estrazione produce esattamente lo stesso albero utilizzato dal codice di ripristino."
+  },
+  "sidecar": {
+    "heading": "Il sidecar JSON",
+    "intro": "Ogni backup locale di successo produce un file compagno: <code>HOSTNAME-TIMESTAMP.tar.zst.proxmenux.json</code>, scritto accanto all'archivio da <code>hb_write_archive_sidecar</code>. Questo piccolo file JSON consente a ProxMenux Monitor di identificare l'archivio come ProxMenux backup host anche se in seguito viene spostato, rinominato o archiviato altrove.",
+    "contentTitle": "Contenuto del sidecar",
+    "contentBody": "Il sidecar memorizza la versione schema, se il backup proveniva da un run interattivo o da un lavoro programmato (<code>kind</code>), l'ID di lavoro per le esecuzioni pianificate, la modalità profilo utilizzata (<code>default</code> o <code>custom</code>), il nome host sorgente, il nome base originale dell'archivio, un timestamp di creazione ISO-8601 e la dimensione dell'archivio in byte.",
+    "whyBody": "La scheda Backups di Monitor cerca i file ausiliari <code>*.proxmenux.json</code> nelle directory locali configurate, non i file <code>*.tar.zst</code>, perché un <code>.tar.zst</code> senza file ausiliario potrebbe non essere un backup ProxMenux. La scansione è veloce (i file JSON sono piccoli) e l’associazione resta valida quando l’archivio viene rinominato, purché anche il file ausiliario venga rinominato di conseguenza."
+  },
+  "restoreAccess": {
+    "heading": "Ripristino da un archivio locale",
+    "body": "Il flusso di ripristino ProxMenux scopre gli archivi locali scansionando l'obiettivo locale configurato per sidecars e visualizzandoli nell'elenco Archivi. Selezionando uno si attiva <code>_rs_check_layout</code>, che estrae il tarball in una directory di staging e conferma il layout a tre payload prima di procedere. Per estrazione manuale al di fuori di ProxMenux, <code>tar --zstd -xf hostcfg-HOSTNAME-TIMESTAMP.tar.zst -C /tmp/hostcfg</code> produce lo stesso albero che il codice di ripristino consuma."
+  }
+}
diff --git a/web/messages/it/docs/backup-restore/destinations/pbs.json b/web/messages/it/docs/backup-restore/destinations/pbs.json
new file mode 100644
index 00000000..6cc1e51e
--- /dev/null
+++ b/web/messages/it/docs/backup-restore/destinations/pbs.json
@@ -0,0 +1,113 @@
+{
+  "meta": {
+    "title": "destinazione Proxmox Backup Server — repository, crittografia, ripristino | ProxMenux",
+    "description": "La destinazione PBS salva i backup host di ProxMenux come backup PBS. Descrive il rilevamento dei repository da /etc/pve/storage.cfg, la configurazione manuale, il caricamento .pxar, la crittografia lato client con file di chiave e la sua copia di recupero facoltativa protetta da passphrase, e il recupero della chiave da più fonti su un host appena installato.",
+    "ogTitle": "ProxMenux Backup — destinazione Proxmox Backup Server",
+    "ogDescription": "Come ProxMenux scrive i backup host a Proxmox Backup Server con la crittografia del keyfile lato client e l'escrow di recupero.",
+    "twitterTitle": "Destinazione di backup PBS | ProxMenux",
+    "twitterDescription": "Destinazione Proxmox Backup Server con crittografia tramite file di chiave e copia di recupero protetta da passphrase."
+  },
+  "header": {
+    "title": "Proxmox Backup Server",
+    "description": "La destinazione PBS carica l’intera directory di preparazione come un unico backup .pxar in un datastore Proxmox Backup Server, con crittografia facoltativa lato client tramite file di chiave. Facoltativamente, accanto a ogni backup viene caricata anche una copia della chiave protetta da passphrase per il recupero.",
+    "section": "Backup e ripristino"
+  },
+  "recommendedBadge": "Destinazione consigliata",
+  "aboutPbs": {
+    "heading": "Ciò che Proxmox Backup Server è",
+    "body": "Proxmox Backup Server (PBS) è il prodotto server di backup di Proxmox, sviluppato e mantenuto dallo stesso team che gli autori Proxmox VE. È un server di backup dedicato progettato per ricevere i backup da host Proxmox VE (VMs, LXCs e - via <code>proxmox-backup-client</code> - directory host arbitrari) con deduplicazione basata su blocchi, crittografia lato client e politiche di conservazione applicate lato server. ProxMenux utilizza PBS come una delle tre destinazioni per i backup host; ogni meccanismo specifico PBS descritto in questa pagina (gruppi di backup, archivi <code>.pxar</code>, <code>--backup-id</code>, crittografia keyfile) è un comportamento standard PBS."
+  },
+  "intro": {
+    "title": "Un backup per esecuzione, deduplicazione a livello di blocchi",
+    "body": "Un backup PBS crea una sola voce nel datastore, sotto l’ID <code>host/hostcfg-HOSTNAME/BACKUP-TIME</code>. I dati sono un archivio <code>.pxar</code> con la stessa struttura in tre blocchi descritta in <em>Come funziona</em>. PBS deduplica i blocchi tra tutti i backup del datastore: i backup successivi dello stesso host trasferiscono e memorizzano soltanto i blocchi modificati. Per le attività pianificate, ProxMenux applica direttamente la conservazione: dopo ogni esecuzione riuscita, <code>run_scheduled_backup.sh</code> esegue <code>proxmox-backup-client prune</code> con <code>--keep-last</code> / <code>--keep-daily</code> / <code>--keep-weekly</code> usando i valori configurati nell’attività."
+  },
+  "repoSelection": {
+    "heading": "Selezione dei repository",
+    "intro": "ProxMenux scopre i repository PBS da due fonti su ogni backup. L'operatore sceglie uno da un menu unificato; la scelta determina <code>HB_PBS_REPOSITORY</code>, <code>HB_PBS_SECRET</code> e <code>HB_PBS_FINGERPRINT</code> per l'esecuzione.",
+    "sourceRows": [
+      {
+        "source": "storage.cfg di Proxmox (rilevamento automatico)",
+        "path": "/etc/pve/storage.cfg + /etc/pve/priv/storage/NAME.pw",
+        "content": "Ogni strofa <code>pbs:</code> nella configurazione di storage di Proxmox viene rilevata automaticamente. Server, datastore, nome utente e impronta digitale provengono dalla stanza. La password viene letta dalla directory delle credenziali di Proxmox. Nessun rientro necessario sul lato ProxMenux — il repository è disponibile non appena è configurato in Proxmox."
+      },
+      {
+        "source": "Configurazione manuale ProxMenux",
+        "path": "/usr/local/share/proxmenux/pbs-manual-configs.txt + pbs-pass-NAME.txt + pbs-fingerprint-NAME.txt",
+        "content": "Aggiunto da <em>Configure destinazioni di backup → PBS destinazioni → Aggiungi PBS</em>. Prompts per un nome, nome utente (<code>root@pam</code> o <code>user@pbs!token</code>), host o IP, datastore e password. I re-prompt password su input vuoto — un salvataggio vuoto altrimenti persisterebbe silenziosamente e ogni backup successivo fallirebbe con un errore di autenticazione opaco. Questo percorso viene utilizzato quando il target PBS non è registrato come storage Proxmox."
+      }
+    ],
+    "menuTitle": "Menu di selezione",
+    "menuBody": "Entrambe le fonti sono mostrate in un unico menu, ciascuna riga contrassegnata con la sua origine (<code>[proxmox]</code> o <code>[manual]</code>). Le voci di cui la password non poteva essere risolta sono contrassegnate con un avviso <code>⚠ no password</code> — selezionando uno attiva un rientro password prima dell'avvio del backup. L'impronta digitale viene passata a <code>proxmox-backup-client</code> tramite la variabile di ambiente <code>PBS_FINGERPRINT</code>; quando assente, il client chiede all'operatore di accettare il certificato del server in modo interattivo sul primo backup."
+  },
+  "backupCommand": {
+    "heading": "Il comando di backup",
+    "intro": "Il caricamento avviene con una sola invocazione di <code>proxmox-backup-client backup</code>. ProxMenux usa <code>env</code> per passare al client password, password di crittografia e impronta digitale come variabili d’ambiente.",
+    "cmd": "env \\\n    PBS_PASSWORD=\"$HB_PBS_SECRET\" \\\n    PBS_ENCRYPTION_PASSWORD=\"$HB_PBS_ENC_PASS\" \\\n    PBS_FINGERPRINT=\"$HB_PBS_FINGERPRINT\" \\\n    proxmox-backup-client backup \\\n        hostcfg.pxar:$staging_root \\\n        --repository USER@REALM@HOST:DATASTORE \\\n        --backup-type host \\\n        --backup-id  hostcfg-HOSTNAME \\\n        --backup-time BACKUP-EPOCH \\\n        [--keyfile /usr/local/share/proxmenux/pbs-key.conf]",
+    "backupIdTitle": "Nome ID di backup",
+    "backupIdBody": "L’ID di backup predefinito è <code>hostcfg-HOSTNAME</code>. Prima del caricamento, l’operatore lo conferma o modifica; vengono eliminati i caratteri non compresi in <code>[A-Za-z0-9_-]</code> e i trattini finali. Riutilizzare lo stesso ID è intenzionale: PBS lo tratta come un <em>gruppo</em> e ogni backup successivo compare come nuova voce al suo interno, condividendo la deduplicazione con i precedenti.",
+    "pxarTitle": "Perché la fonte è la radice di staging completa",
+    "pxarBody": "La sorgente <code>.pxar</code> è l'intero <code>staging_root</code> — <code>rootfs/</code>, <code>metadata/</code> e <code>manifest.json</code> insieme. Le versioni precedenti hanno superato <code>$staging_root/rootfs</code> come fonte; che ha lasciato <code>metadata/</code> fuori dall'archivio e il controllo di compatibilità del ripristino non aveva nulla da leggere, degradando a avvisi cross-host anche su ristabilimenti dello stesso host. I vecchi backup creati con la fonte rootfs-solo ripristinano ancora correttamente tramite il ramo case-<code>_rs_check_layout</code> di 3, che avvolge un albero <code>etc/var/root/usr</code> piatto di nuovo in una gerarchia <code>rootfs/</code>."
+  },
+  "encryption": {
+    "heading": "Crittografia lato cliente",
+    "glossaryHint": "Questa sezione usa i termini <em>file di chiave</em>, <em>passphrase</em> e <em>involucro di recupero</em>. Il <glosarioLink>glossario</glosarioLink> ne riassume le differenze con una frase per termine.",
+    "intro": "La crittografia PBS lato client con file di chiave cifra i blocchi sull’host di origine prima del caricamento. In ProxMenux è facoltativa. Se attivata, durante la configurazione l’operatore sceglie esplicitamente sì o no se caricare su PBS anche una copia di recupero del file di chiave protetta da passphrase; la scelta è modificabile in seguito dal Monitor. Il file di chiave risiede sempre nel percorso canonico <code>/usr/local/share/proxmenux/pbs-key.conf</code> e viene riutilizzato senza nuove richieste per ogni backup crittografato successivo.",
+    "keyfileTitle": "Impostazione del keyfile",
+    "keyfileBody": "Il dialogo di crittografia compare al primo backup crittografato dell’host. Prima chiede se crittografare il backup: <em>No</em> prosegue senza crittografia, <em>Sì</em> passa alla seconda fase. Questa dipende dalla presenza di un file di chiave in <code>/usr/local/share/proxmenux/pbs-key.conf</code>. Se esiste, viene riutilizzato senza altre domande e il backup prosegue; i backup successivi non lo chiedono più. Altrimenti, un menu offre due opzioni. <em>Genera un nuovo file di chiave</em> esegue <code>proxmox-backup-client key create --kdf none</code>. <em>Usa un file di chiave esistente</em> rileva automaticamente una chiave gestita da PVE: se il repository PBS scelto è registrato in Proxmox con una chiave di crittografia in <code>/etc/pve/priv/storage/&lt;NAME&gt;.enc</code>, il file viene copiato senza altre domande nel percorso canonico di ProxMenux. Se nessuna chiave PVE corrisponde al repository, viene richiesto il percorso assoluto dove l’operatore ha già collocato il file sull’host. In entrambi i casi, il file viene installato nel percorso canonico con <code>chmod 600</code>.",
+    "modesTitle": "Per-host o keyfile condiviso",
+    "modesIntro": "Entrambi i modelli sono supportati e nessuno è obbligatorio: l’operatore sceglie in base all’organizzazione dei propri host.",
+    "modesPerHostTitle": "File di chiave per host (predefinito)",
+    "modesPerHostBody": "Ogni host genera un proprio keyfile la prima volta che consente la crittografia PBS. L'isolamento è il massimo: compromettere il keyfile di un host non espone i backup di qualsiasi altro. Consigliato per flotte di produzione e per ambienti in cui gli host hanno diversi proprietari o confini di conformità.",
+    "modesSharedTitle": "Keyfile condiviso (importa su ogni host)",
+    "modesSharedBody": "Un master keyfile generato una volta e installato su ogni host tramite l’opzione <em>Usa un file di chiave esistente</em>. La gestione è più semplice: un singolo segreto per salvaguardare, e qualsiasi host può decifrare gli archivi di qualsiasi altro (utile per il consolidamento, le esercitazioni di ripristino cross-host o la verifica centralizzata di backup). Il trade-off è che una perdita del keyfile condiviso espone ogni host contemporaneamente. Raccomandato per homelabs e per flotte dove tutti gli host hanno lo stesso proprietario e il limite di fiducia.",
+    "recoveryTitle": "Caricare la chiave su PBS: decide l’operatore",
+    "recoveryBody": "Subito dopo la scelta del file di chiave, ProxMenux pone la domanda esplicita <em>Caricare la chiave su PBS?</em>, con due risposte. <strong>Nessun artefatto di recupero viene caricato su PBS finché l’operatore non risponde Sì.</strong> L’opzione predefinita è <em>No, conserva solo in locale</em>: la chiave resta nel percorso canonico locale, ProxMenux non carica artefatti di recupero su PBS e l’operatore gestisce personalmente la copia esterna. Il pulsante <em>Scarica il file di chiave</em> del Monitor, nella riga della destinazione PBS, la fornisce su richiesta. Scegliendo <em>Sì, carica</em>, viene chiesta due volte una passphrase di recupero, verificandone la corrispondenza. ProxMenux protegge il file con AES-256-CBC e PBKDF2 (600.000 iterazioni, salt casuale), producendo <code>pbs-key.recovery.enc</code>. Ogni backup crittografato successivo carica questo involucro su PBS in un gruppo di backup associato. Questi caricamenti non inviano a PBS né la passphrase né il file di chiave in chiaro. La scelta può essere modificata in qualsiasi momento nel Monitor: il controllo nella riga PBS permette Sì o No e applica subito Avvia caricamento, Interrompi caricamento o Aggiorna passphrase in base allo stato corrente.",
+    "blobUploadTitle": "Gruppo di backup abbinato su PBS",
+    "blobUploadBody1": "Quando la modalità escrow è <em>Sì, carica</em>, ProxMenux carica la busta di recupero a PBS dopo ogni backup crittografato come secondo, gruppo di backup abbinato con lo stesso nome del gruppo host ma terminando in <code>-keyrecovery</code>. I due gruppi siedono l'uno accanto all'altro nella lista datastore — uno per i backup host, uno per le buste di recupero. <strong>La busta non lascia mai l'host in plaintext</strong>: la crittografia avviene sull'host stesso con AES-256-CBC e PBKDF2 prima che i byte vadano sul filo (<code>openssl enc -aes-256-cbc -pbkdf2 -iter 600000 -salt</code>). PBS riceve solo la busta già crittografata.",
+    "envelopeSecurityTitle": "Caricare il file keyrecovery a PBS è un rischio di sicurezza?",
+    "envelopeSecurityBody": "Il file keyrecovery è crittografato in transito e a riposo. Il passphrase di recupero non lascia mai l'host: la crittografia avviene localmente prima del caricamento, e PBS vede solo il risultato già crittografato. Un amministratore PBS — o chiunque abbia accesso al datastore — può scaricare il file di keyrecovery, ma senza la passphrase di recupero non può leggere il keyfile all'interno: è un codice opaco. Ricostruire il keyfile richiede entrambi i pezzi contemporaneamente, il file keyrecovery e la passphrase, e solo l'operatore tiene entrambi.",
+    "blobUploadConstraintTitle": "Perché servono due gruppi anziché un unico gruppo crittografato",
+    "blobUploadConstraintBody": "Una singola invocazione di <code>proxmox-backup-client backup</code> cifra tutti i suoi archivi con lo stesso file di chiave oppure nessuno: non è possibile mescolare i due casi. Il backup host deve essere cifrato con la chiave dell’host, ma l’involucro di recupero non può accompagnarlo nello stesso caricamento, perché verrebbe cifrato con la chiave che contiene. Su un host appena reinstallato non sarebbe possibile aprirlo: servirebbe la chiave per decifrare la chiave stessa. Per questo i due elementi vengono caricati indipendentemente e appaiono in due gruppi. Il client PBS cifra il backup host con il file di chiave, mentre ProxMenux cifra l’involucro con la passphrase prima del caricamento. Due livelli di crittografia diversi proteggono due elementi distinti.",
+    "blobUploadImageAlt": "PBS UI che mostra i gruppi di backup hostcfg-HOSTNAME e hostcfg-HOSTNAME-keyrecovery adiacenti nell'elenco dei datastore.",
+    "blobUploadImageCaption": "PBS UI — i gruppi di backup accoppiati. Il gruppo principale contiene i backup host; il gruppo -keyrecovery detiene il keyfile passphrase-wrapped.",
+    "recoverTitle": "Recupero su un host fresco",
+    "recoverBody": "Quando il file di chiave manca nel percorso canonico, dopo una reinstallazione o una rimozione esplicita, il ripristino prova tre fonti in ordine e si ferma alla prima che fornisce una chiave utilizzabile. Prima, se il repository PBS selezionato ha una chiave corrispondente gestita da PVE in <code>/etc/pve/priv/storage/&lt;NAME&gt;.enc</code>, questa viene copiata senza domande nel percorso canonico. Poi, se su PBS esiste un gruppo <code>-keyrecovery</code>, viene scaricata la sua istantanea più recente e viene chiesta la passphrase di recupero per decifrarla. Infine, se le prime due opzioni non funzionano o vengono rifiutate, il dialogo chiede il percorso assoluto del file di chiave sull’host e lo copia nel percorso canonico. Il Monitor offre lo stesso flusso di importazione nella finestra dei dettagli del backup. In alto compare un pannello ambra quando Ripristina, Scarica o Visualizza contenuto richiede una chiave assente. Se la chiave installata non corrisponde a quella usata per cifrare il backup, PBS restituisce <code>wrong key — manifest's key XX does not match provided key YY</code>. Le stesse tre azioni mostrano allora un pannello strutturato con l’impronta richiesta dal manifesto in evidenza, per identificare quale chiave importare per aprire quel backup.",
+    "monitorManagementTitle": "Gestione del keyfile dal Monitor",
+    "monitorManagementBody": "Il Monitor mostra i controlli del file di chiave direttamente in ogni riga di destinazione PBS nella configurazione dei backup. Sono disponibili tre azioni: <em>Scarica</em> esporta il file attuale nel browser; <em>Carica</em> sostituisce il file installato con quello fornito dall’operatore, sovrascrivendo il precedente solo dopo l’installazione riuscita del nuovo nel percorso canonico; <em>Elimina</em> rimuove il file dall’host. Accanto si trova il controllo della copia di recupero: una scelta Sì/No per <em>Caricare la chiave su PBS?</em>, un campo passphrase se si sceglie Sì e un pulsante di applicazione contestuale con <em>Avvia caricamento</em>, <em>Interrompi caricamento</em> o <em>Aggiorna passphrase</em>. Ogni azione usa gli stessi endpoint Flask dell’interfaccia di terminale, quindi gli effetti su disco e lo stato su PBS sono identici dalle due interfacce."
+  },
+  "restoreAccess": {
+    "heading": "Recuperare sul lato del ripristino",
+    "body": "Il ripristino individua i backup host ProxMenux su PBS elencando i gruppi del repository configurato e filtrandoli per modello dell’ID. La scheda Backup del Monitor mostra lo stesso elenco. Scegliere un backup esegue <code>proxmox-backup-client restore</code> con gli stessi repository, password e impronta, oltre a <code>--keyfile</code> se il backup è crittografato. L’archivio <code>.pxar</code> viene estratto in una directory di preparazione che <code>_rs_check_layout</code> passa al normale processo di ripristino. Fuori da ProxMenux, lo stesso comando estrae l’archivio nel percorso desiderato per esaminare l’albero o procedere a un ripristino manuale."
+  },
+  "references": {
+    "heading": "Referenze",
+    "intro": "Documentazione ufficiale di Proxmox Backup Server per i componenti usati da ProxMenux.",
+    "items": [
+      {
+        "label": "Documentazione Proxmox Backup Server",
+        "href": "https://pbs.proxmox.com/docs/",
+        "tail": "— punto di ingresso principale che copre l'installazione, l'amministrazione, lo stoccaggio, gli utenti e i ruoli."
+      },
+      {
+        "label": "proxmox-backup-client",
+        "href": "https://pbs.proxmox.com/docs/backup-client.html",
+        "tail": " — lo strumento da riga di comando che ProxMenux usa per ogni backup e ripristino. Descrive ID e tipi di backup, archivi, sintassi dei repository e variabili d’ambiente."
+      },
+      {
+        "label": "Crittografia lato cliente",
+        "href": "https://pbs.proxmox.com/docs/backup-client.html#encryption",
+        "tail": " — creazione del file di chiave, modalità --kdf e modello di crittografia che ProxMenux estende con una copia di recupero protetta da passphrase."
+      },
+      {
+        "label": "Gestione dei datastore",
+        "href": "https://pbs.proxmox.com/docs/storage.html",
+        "tail": "— la creazione e la gestione dei datastores che ricevono i backup degli host, incluso il layout di chunk-store e le autorizzazioni."
+      },
+      {
+        "label": "Eliminazione delle vecchie copie e garbage collection",
+        "href": "https://pbs.proxmox.com/docs/maintenance.html#pruning",
+        "tail": " — il modello di conservazione di --keep-last / --keep-daily / --keep-weekly che ProxMenux applica a ogni attività pianificata, e il recupero dei blocchi inutilizzati da parte di PBS dopo l’eliminazione delle vecchie copie."
+      }
+    ]
+  }
+}
diff --git a/web/messages/it/docs/backup-restore/glossary.json b/web/messages/it/docs/backup-restore/glossary.json
new file mode 100644
index 00000000..40a59b8d
--- /dev/null
+++ b/web/messages/it/docs/backup-restore/glossary.json
@@ -0,0 +1,230 @@
+{
+  "meta": {
+    "title": "Glossario — Backup & Ripristino | ProxMenux",
+    "description": "Glossario di termini e definizioni per lo stack di backup e ripristino ProxMenux: crittografia, keyfile, passphrase, busta di recupero, PBS, chunks, rootfs, manifesto, runner e cross-kernel idratazione.",
+    "ogTitle": "Backup & ripristino glossario | ProxMenux",
+    "ogDescription": "Definizioni chiare per il vocabolario utilizzato attraverso la documentazione di backup e ripristino ProxMenux.",
+    "twitterTitle": "Backup & ripristino glossario | ProxMenux",
+    "twitterDescription": "Passphrase, keyfile, busta di recupero, rootfs, manifesto, PBS, chunks — tutto definito in un unico luogo."
+  },
+  "header": {
+    "title": "Glossario",
+    "description": "Termini utilizzati attraverso la documentazione di backup e ripristino, con la loro definizione.",
+    "section": "Backup e ripristino"
+  },
+  "intro": {
+    "body": "I termini sono raggruppati per tema. Ogni voce dà il termine e una breve definizione."
+  },
+  "groups": [
+    {
+      "title": "Crittografia e recupero chiave",
+      "intro": "Vocabolario per il blocco di crittografia PBS. Si tratta di due segreti distinti: un keyfile binario e un passphrase scritto.",
+      "entries": [
+        {
+          "id": "passphrase-recuperacion",
+          "term": "Passphrase di ripristino",
+          "def": "Password di testo che l'utente sceglie per proteggere la <a href=\"#sobre-recuperacion\">busta di recupero</a>. Viene richiesto due volte con un controllo match, ed è utilizzato solo per crittografare la busta e decifrarla se il keyfile ha bisogno di essere recuperato. <strong>Non è la passphrase che sblocca il keyfile stesso</strong>, e non viene mai inviata a PBS. Durante un backup normale non lascia mai l'host."
+        },
+        {
+          "id": "clave-cifrado",
+          "term": "Keyfile (chiave di crittografia)",
+          "def": "File di chiave usato da proxmox-backup-client per cifrare i <a href=\"#chunk\">blocchi</a> prima dell’invio a PBS. Senza la chiave corrispondente i dati cifrati non sono leggibili. ProxMenux lo salva in <code>/usr/local/share/proxmenux/pbs-key.conf</code> con modalità <code>600</code>. Proteggilo: la <a href=\"#sobre-recuperacion\">busta di recupero</a> serve a recuperarlo in caso di perdita."
+        },
+        {
+          "id": "contrasena-keyfile",
+          "term": "Passphrase Keyfile (KDF passphrase)",
+          "def": "Passphrase opzionale che il keyfile stesso può trasportare, distinto dal <a href=\"#passphrase-recuperacion\">passphrase di recupero</a>. Esiste solo quando il keyfile è stato creato con <code>--kdf scrypt</code> (tipicamente un keyfile importato). Senza di esso, il keyfile non può essere sbloccato per l'uso. ProxMenux persiste in forma crittografata sull'host in modo che i backup programmati possano funzionare senza un prompt interattivo."
+        },
+        {
+          "id": "sobre-recuperacion",
+          "term": "Busta di recupero",
+          "def": "Il <a href=\"#clave-cifrado\">keyfile</a> avvolto in uno strato aggiuntivo: viene crittografato con il <a href=\"#passphrase-recuperacion\">passphrase di recupero</a> utilizzando <a href=\"#aes-256-cbc\">AES-256-CBC</a> e <a href=\"#pbkdf2\">PBKDF2</a> prima che lasci l'host. È ciò che viene caricato su PBS come gruppo <code>-keyrecovery</code>. Senza la passphrase, la busta è opaca: scaricarla da PBS non rivela il keyfile."
+        },
+        {
+          "id": "cifrado-cliente",
+          "term": "Crittografia lato cliente",
+          "def": "Modello di crittografia in cui i dati vengono crittografati sull'host sorgente prima di essere caricati. PBS riceve solo e memorizza il testo cifrario; nemmeno un amministratore PBS con accesso al datastore può leggerlo senza il keyfile. ProxMenux si basa su questo modello e aggiunge la <a href=\"#sobre-recuperacion\">busta di recupero</a> in cima."
+        },
+        {
+          "id": "kdf-none",
+          "term": "--kdf none",
+          "def": "Opzione a <code>proxmox-backup-client key create</code> che produce un keyfile senza passphrase allegato. Il keyfile può essere utilizzato direttamente senza un prompt, che è essenziale per i lavori programmati in esecuzione incustodito. Questo è ciò che ProxMenux utilizza per impostazione predefinita quando si genera un nuovo keyfile."
+        },
+        {
+          "id": "kdf-scrypt",
+          "term": "--kdf scrypt",
+          "def": "Opzione a <code>proxmox-backup-client key create</code> che produce un keyfile protetto da un <a href=\"#contrasena-keyfile\">passphrase del file di chiave</a>. Ogni utilizzo del keyfile richiede di sbloccarlo con quel passphrase. ProxMenux accetta questo stile di keyfile sull'importazione e memorizza il passphrase crittografato in modo che i backup programmati possano ancora essere eseguiti incustoditi."
+        },
+        {
+          "id": "aes-256-cbc",
+          "term": "AES-256-CBC",
+          "def": "Cifra simmetrica standard. ProxMenux lo utilizza (tramite <code>openssl enc -aes-256-cbc</code>) per avvolgere il <a href=\"#clave-cifrado\">keyfile</a> con il <a href=\"#passphrase-recuperacion\">passphrase di recupero</a> e produrre il <a href=\"#sobre-recuperacion\">busta</a>."
+        },
+        {
+          "id": "pbkdf2",
+          "term": "PBKDF2",
+          "def": "Funzione crittografica che trasforma un passphrase di tipo umano in una chiave binaria adatta alla crittografia. Rallenta i tentativi di forza bruta applicando molte iterazioni. ProxMenux lo utilizza con iterazioni 600 000 e un sale casuale durante la crittografia della busta di recupero."
+        }
+      ]
+    },
+    {
+      "title": "Struttura di backup",
+      "intro": "Termini che descrivono cosa vive all'interno di un backup, indipendentemente dalla destinazione.",
+      "entries": [
+        {
+          "id": "rootfs",
+          "term": "rootfs / filesystem radice",
+          "def": "Copia dei file dell’host sorgente prodotta da <code>rsync</code> secondo il <a href=\"#perfil-defecto\">profilo predefinito</a> e i <a href=\"#rutas-personalizadas\">percorsi personalizzati</a>. Non è un’immagine dell’intero disco: vengono copiati solo percorsi con configurazione o stato che Proxmox non può rigenerare da sé."
+        },
+        {
+          "id": "manifiesto",
+          "term": "Manifesto (manifest.json)",
+          "def": "Documento strutturato JSON che descrive l'host sorgente in tempo di backup: hardware, storage, kernel, componenti ProxMenux installati e inventario di VM e LXC. È prodotto da sei raccoglitori di dati indipendenti. Il flusso di ripristino lo utilizza per confrontare sorgente e obiettivo."
+        },
+        {
+          "id": "staging",
+          "term": "Directory di preparazione",
+          "def": "directory temporanea in cui ProxMenux assembla i tre blocchi (rootfs, metadati e manifest) prima di imballarli e caricare alla destinazione. Viene rimosso automaticamente quando il backup termina, anche abortito."
+        },
+        {
+          "id": "perfil-defecto",
+          "term": "Profilo predefinito",
+          "def": "Set di percorsi che ProxMenux copia per impostazione predefinita in ogni backup. Copre PVE config, rete, SSH, kernel, apt, strumenti ProxMenux e altro ancora. È definito in codice e documentato sul <em>Come funziona</em> pagina."
+        },
+        {
+          "id": "rutas-personalizadas",
+          "term": "Percorsi personalizzati",
+          "def": "Percorsi extra l'utente aggiunge in cima al profilo <a href=\"#perfil-defecto\">default</a>. O persistente (conservato in <code>backup-extra-paths.txt</code>) o per-run (in modalità personalizzata)."
+        }
+      ]
+    },
+    {
+      "title": "Destinazioni e stoccaggio",
+      "intro": "Termini legati a dove il backup atterra — server PBS, archivio locale o repository Borg — e come PBS organizza i dati.",
+      "entries": [
+        {
+          "id": "repositorio-pbs",
+          "term": "Repository PBS",
+          "def": "Combinazione di Proxmox Backup Server + <a href=\"#datastore\">datastore</a> + utente che riceve il backup. Identificata dalla stringa <code>user@realm@host:datastore</code>. Un singolo server PBS può ospitare diversi repository."
+        },
+        {
+          "id": "datastore",
+          "term": "Datastore",
+          "def": "Spazio di archiviazione specifico su un server PBS che contiene backup e relativi blocchi. Ogni datastore risiede su un file system del server PBS con propri permessi e criteri."
+        },
+        {
+          "id": "chunk",
+          "term": "Blocco (chunk) / deduplicazione dei blocchi",
+          "def": "PBS divide ogni backup in blocchi di dimensioni variabili, identifica ogni pezzo dal suo hash e memorizza ogni pezzo solo una volta, anche se appare in molti backup diversi. Ciò significa backup successivi dello stesso host — o attraverso host simili — prendere molto poco spazio aggiuntivo."
+        },
+        {
+          "id": "fingerprint",
+          "term": "Impronta digitale",
+          "def": "Impronte crittografica del certificato PBS del server TLS. Consente al client di verificare che stia parlando con il server previsto senza affidarsi a un'autorità di certificazione pubblica. ProxMenux passa a <code>proxmox-backup-client</code> tramite la variabile ambiente <code>PBS_FINGERPRINT</code>."
+        },
+        {
+          "id": "grupo-copia",
+          "term": "Gruppo backup",
+          "def": "Contenitore logico all'interno di PBS in cui si accumulano backup successivi dello stesso asset. Ogni nuovo backup condivide la deduplica con quelli precedenti nello stesso gruppo. ProxMenux utilizza due gruppi per host quando la crittografia è abilitata: uno per il backup host e uno con un suffisso <code>-keyrecovery</code> per la <a href=\"#sobre-recuperacion\">busta di recupero</a>."
+        },
+        {
+          "id": "backup-id",
+          "term": "ID backup",
+          "def": "Nome del gruppo <a href=\"#grupo-copia\">backup</a>. ProxMenux predefinisce <code>hostcfg-HOSTNAME</code> e consente all'utente di modificarlo prima del caricamento; i caratteri non supportati vengono rimossi automaticamente."
+        },
+        {
+          "id": "pxar",
+          "term": ".pxar",
+          "def": "Formato di archivio nativo di PBS per directory. Si comporta come un archivio tar ottimizzato per la deduplicazione del pezzo: piuttosto che memorizzare un file opaco, PBS rompe il suo contenuto in pezzi riutilizzabili."
+        }
+      ]
+    },
+    {
+      "title": "Esecuzione e pianificazione",
+      "intro": "Termini utilizzati dal sistema di lavoro programmato ProxMenux.",
+      "entries": [
+        {
+          "id": "runner",
+          "term": "Processo di esecuzione",
+          "def": "Lo script <code>run_scheduled_backup.sh</code> che esegue un backup programmato. Legge la configurazione del lavoro, lancia il backend corrispondente (Local, PBS o Borg), applica la ritenzione sul successo e invia le notifiche configurate."
+        },
+        {
+          "id": "trabajo-programado",
+          "term": "Lavoro programmato",
+          "def": "Configurazione persistente di un backup ricorrente. Contiene destinazione, credenziali, crittografia, pianificazione e conservazione. È salvata in <code>/var/lib/proxmenux/backup-jobs/&lt;id&gt;.env</code>."
+        },
+        {
+          "id": "modo-adjunto",
+          "term": "Modalità allegato",
+          "def": "Processo senza timer proprio. Un hook job-end PVE di <code>vzdump</code> lo avvia dopo i backup dei guest se lo storage corrisponde. Il processo padre fornisce destinazione e conservazione, riletta dal processo padre a ogni esecuzione, ma il hook confronta lo storage, non l’ID padre. Anche un altro processo sullo stesso storage può attivarlo. Solo Local e PBS."
+        },
+        {
+          "id": "timer-systemd",
+          "term": "Timer di systemd",
+          "def": "Meccanismo standard systemd che accende un comando su un calendario. ProxMenux crea un timer per <em>indipendente</em> lavoro programmato; <a href=\"#modo-adjunto\">attach-mode</a> posti di lavoro non utilizzano timer, vengono eseguiti tramite lo script-hook PVE."
+        },
+        {
+          "id": "retencion",
+          "term": "Retenzione (keep-last, keep-daily...)",
+          "def": "Politica che decide quali backup più vecchi mantenere e quali prune. Definito per lavoro con parametri come <code>keep-last</code>, <code>keep-daily</code>, <code>keep-weekly</code>, <code>keep-monthly</code>. Applicato dal processo di esecuzione dopo ogni backup di successo."
+        }
+      ]
+    },
+    {
+      "title": "Ripristina",
+      "intro": "Termini dal flusso di ripristino.",
+      "entries": [
+        {
+          "id": "restauracion-universal",
+          "term": "Ripristino universale",
+          "def": "Il flusso di ripristino ProxMenux non si limita a estrarre il filesystem: legge il manifesto per individuare le differenze tra sorgente e obiettivo, riproduce la configurazione del sistema e riattiva gli installatori per i componenti gestiti da ProxMenux. L'obiettivo è quello di riprodurre l'host sorgente, non solo l'archivio."
+        },
+        {
+          "id": "hidratacion",
+          "term": "Idratazione (cross-kernel)",
+          "def": "Passo di ripristino che fonde la propria configurazione dell'utente dalla sorgente (token IOMMU, ID dispositivo VFIO, quirk personalizzati, chiavi GRUB) in cima alla configurazione di avvio fresco del bersaglio, senza copiare i file legati al kernel della fonte verbatim. Esegue quando il kernel di destinazione è più nuovo di quello del backup."
+        },
+        {
+          "id": "cross-kernel",
+          "term": "Ripristino tra versioni del kernel",
+          "def": "Ripristino in cui il kernel di destinazione è diverso, di solito più recente, da quello sorgente. Il passaggio di <a href=\"#hidratacion\">idratazione</a> evita di trascinare file incompatibili con il kernel di destinazione."
+        },
+        {
+          "id": "instalador-postboot",
+          "term": "Installatore post-boot",
+          "def": "Componenti reinstallati dopo il primo avvio dell'host ripristinato ( driver NVIDIA, driver Coral TPU, strumenti AMD GPU, strumenti Intel GPU). Ogni installatore viene eseguito contro il kernel del bersaglio, quindi l'host ripristinato non dipende dal kernel della sorgente presente."
+        },
+        {
+          "id": "compatibility-check",
+          "term": "Controllo di compatibilità",
+          "def": "Confronto tra il manifesto sorgente e lo stato del bersaglio che ProxMenux esegue all'inizio del ripristino. Decide quali parti sono copiate verbatim, che hanno bisogno di idratazione e che sono ricreati da un installatore."
+        },
+        {
+          "id": "equipo-recien-instalado",
+          "term": "Installazione da zero",
+          "def": "Host appena reinstallato da zero, senza <a href=\"#clave-cifrado\">keyfile</a> locale. Ripristino di un backup crittografato richiede prima di recuperare il file chiave dal <a href=\"#sobre-recuperacion\">busta</a> memorizzato su PBS, utilizzando il <a href=\"#passphrase-recuperacion\">passphrase di recupero</a>."
+        }
+      ]
+    }
+  ],
+  "whereNext": {
+    "heading": "Dove proseguire",
+    "items": [
+      {
+        "label": "Come funziona",
+        "href": "/docs/backup-restore/how-it-works",
+        "tail": " — come rootfs, manifesto e inventario applicazioni si inseriscono nel backup."
+      },
+      {
+        "label": "Destinazione Proxmox Backup Server",
+        "href": "/docs/backup-restore/destinations/pbs",
+        "tail": "— in cui la crittografia lato client, keyfile, passphrase di recupero e busta sono documentati in profondità."
+      },
+      {
+        "label": "Ripristino",
+        "href": "/docs/backup-restore/restoring",
+        "tail": " — procedura di ripristino e uso del manifesto."
+      }
+    ]
+  }
+}
diff --git a/web/messages/it/docs/backup-restore/how-it-works.json b/web/messages/it/docs/backup-restore/how-it-works.json
new file mode 100644
index 00000000..78a4d54c
--- /dev/null
+++ b/web/messages/it/docs/backup-restore/how-it-works.json
@@ -0,0 +1,205 @@
+{
+  "meta": {
+    "title": "Come funziona il backup ProxMenux internamente — rootfs, manifesto, applicazioni",
+    "description": "Contenuto dettagliato di un backup ProxMenux: il rootfs copiato con rsync secondo il profilo di percorsi predefinito, il manifesto strutturato creato da sei moduli di raccolta indipendenti e l’inventario delle applicazioni che guida la reinstallazione automatica di pacchetti e componenti dopo il ripristino.",
+    "ogTitle": "Come funziona ProxMenux Backup internamente",
+    "ogDescription": "Le tre parti di un backup ProxMenux: rootfs, manifesto e applicazioni.",
+    "twitterTitle": "Come funziona ProxMenux Backup | ProxMenux",
+    "twitterDescription": "I tre payload di un backup ProxMenux e come il ripristino riproduce l'host sorgente da loro."
+  },
+  "header": {
+    "title": "Come funziona",
+    "description": "La ripartizione interna di un backup ProxMenux — filesystem, inventario manifesto e di applicazione — e come il ripristino consuma tutti e tre per riprodurre l'host sorgente su un obiettivo che potrebbe non condividere lo stesso kernel.",
+    "section": "Backup e ripristino"
+  },
+  "intro": {
+    "title": "Un archivio, tre parti",
+    "body": "Ogni backup crea tre parti definite sotto un’unica directory di preparazione. L’archivio caricato sulla destinazione (<code>.tar.zst</code> locale, backup PBS o archivio Borg) conserva questa struttura. Il ripristino usa tutte e tre: <strong>il manifesto</strong> viene consultato prima delle modifiche per rilevare differenze e decidere cosa escludere; <strong>rootfs</strong> fornisce i file di configurazione, applicati subito o dopo il riavvio; <strong>l’inventario delle applicazioni</strong> guida l’installazione dei pacchetti e la reinstallazione dei componenti dopo l’avvio. Ogni parte può essere esaminata o estratta indipendentemente."
+  },
+  "layout": {
+    "heading": "Disposizione dell'archivio",
+    "intro": "Ogni archivio segue lo stesso layout albero indipendentemente dalla destinazione. La sottodirectory <code>metadata/</code> contiene i dati strutturati; la sottodirectory <code>rootfs/</code> contiene la copia del filesystem.",
+    "treeCaption": "La directory di preparazione creata durante il backup. Tutte le destinazioni ricevono lo stesso albero nel proprio formato nativo: tar per i backup locali, blocchi PBS per PBS e segmenti Borg per Borg.",
+    "tree": "backup-[timestamp]/\n├── manifest.json                  # structured host state\n├── metadata/\n│   ├── packages.manual.list       # apt-mark showmanual\n│   ├── run_info.env               # backup run identity + kernel version + pmxcfs method\n│   ├── paths_archived.txt         # exact list of paths that reached rootfs/\n│   └── missing_paths.txt          # paths from the profile absent on source\n└── rootfs/\n    ├── etc/                       # /etc/pve, /etc/network, /etc/systemd/network, /etc/ssh, …\n    ├── root/                      # /root (with volatile subdirs excluded)\n    ├── usr/local/                 # /usr/local/bin, /usr/local/share/proxmenux, …\n    └── var/                       # /var/lib/pve-cluster (config.db via sqlite3 .backup), /var/spool/cron/…"
+  },
+  "rootfs": {
+    "heading": "La parte rootfs",
+    "intro": "L’albero <code>rootfs/</code> è una <strong>semplice copia del filesystem</strong> prodotta da <code>rsync</code> dall’host di origine. Contiene un <strong>profilo predefinito</strong> di percorsi scelti per il ripristino Proxmox e gli eventuali <strong>percorsi personalizzati</strong> aggiunti all’attività o alla sessione interattiva. La selezione è volutamente limitata ai percorsi che <em>contengono configurazione</em> o <em>conservano uno stato che Proxmox non può rigenerare da solo</em>.",
+    "defaultProfileTitle": "Il profilo predefinito",
+    "defaultProfileBody": "Il profilo predefinito è definito da <code>hb_default_profile_paths</code> in <code>lib_host_backup_common.sh</code>. Copre otto categorie fisse e, se necessario, lo stato ZFS, che insieme descrivono un host Proxmox operativo:",
+    "categoriesTitle": "Categorie dei percorsi",
+    "categoryRows": [
+      {
+        "category": "Nucleo PVE",
+        "paths": "/etc/pve, /var/lib/pve-cluster, /etc/vzdump.conf",
+        "why": "Contenuto del filesystem Cluster e default vzdump. Il database PMxcfs (<code>config.db</code>) viene catturato come un'istantanea coerente tramite <code>sqlite3 .backup</code> senza interrompere il cluster, e i sidecar <code>.db-wal</code> / <code>.db-shm</code> sono esclusi dal rsync. Quando <code>sqlite3</code> non è disponibile, viene creato <code>config.db.raw-fallback</code>, che il ripristino usa automaticamente come database."
+      },
+      {
+        "category": "Identità e rete host",
+        "paths": "/etc/hostname, /etc/hosts, /etc/timezone, /etc/resolv.conf, /etc/network, /etc/systemd/network",
+        "why": "Tutto ciò che serve all’host per tornare in rete con la stessa identità. I file <code>.link</code> in <code>/etc/systemd/network</code> associano i nomi delle schede alle rispettive MAC, mantenendo i nomi durante reinstallazioni e modifiche hardware."
+      },
+      {
+        "category": "Accesso e autenticazione",
+        "paths": "/etc/ssh, /etc/sudoers, /etc/sudoers.d, /etc/pam.d, /etc/security",
+        "why": "Chiavi SSH, regole sudo e configurazione PAM. Perderle impedisce all’utente di accedere all’host ripristinato."
+      },
+      {
+        "category": "Kernel e avvio",
+        "paths": "/etc/default/grub, /etc/kernel, /etc/modules, /etc/modules-load.d, /etc/modprobe.d, /etc/sysctl.conf, /etc/sysctl.d, /etc/udev/rules.d, /etc/fstab, /etc/iscsi, /etc/multipath",
+        "why": "Parametri IOMMU, blacklist dei moduli, ID dei dispositivi VFIO, tabella dei montaggi e configurazione dello stack di archiviazione."
+      },
+      {
+        "category": "Shell e impostazioni locali",
+        "paths": "/etc/environment, /etc/bash.bashrc, /etc/inputrc, /etc/profile, /etc/profile.d, /etc/locale.gen, /etc/locale.conf",
+        "why": "Configurazione di shell a livello di sistema, variabili di ambiente, configurazione di generazione locale."
+      },
+      {
+        "category": "Gestione pacchetti e cron",
+        "paths": "/etc/apt, /etc/cron.d, /etc/cron.{daily,hourly,weekly,monthly}, /etc/cron.allow, /etc/cron.deny, /var/spool/cron/crontabs",
+        "why": "Fonti APT per una risoluzione coerente dei pacchetti, attività pianificate definite dall'utente."
+      },
+      {
+        "category": "ProxMenux stati e strumenti",
+        "paths": "/etc/proxmenux, /etc/systemd/system, /etc/log2ram.conf, /etc/logrotate.conf, /etc/logrotate.d, /etc/lm-sensors, /etc/sensors3.conf, /etc/fail2ban, /etc/snmp, /etc/postfix, /etc/wireguard, /etc/openvpn, /etc/grafana, /etc/influxdb, /etc/prometheus, /etc/telegraf, /etc/zabbix",
+        "why": "Utensili Proxmox opzionali ma comuni. I percorsi mancanti sono segnalati in <code>metadata/missing_paths.txt</code> senza interrompere il backup."
+      },
+      {
+        "category": "ProxMenux binari e root",
+        "paths": "/usr/local/bin, /usr/local/sbin, /usr/local/share/proxmenux, /var/lib/proxmenux, /root (sottodiri volatili esclusi)",
+        "why": "File binari ProxMenux e configurazione per utente sotto <code>/root</code>. I percorsi volatili (<code>.bash_history</code>, <code>.cache/</code>, <code>tmp/</code>, <code>.local/share/Trash/</code>) sono esclusi dalla copia. <code>/var/lib/proxmenux</code> detiene i lavori di backup programmati e lo stato dell’host tenuto da ProxMenux; la messa in scena di ripristino, le copie rollback e i marcatori post-restore sono esclusi, perché appartengono all'host che gestisce un ripristino."
+      },
+      {
+        "category": "Stato ZFS (condizionato)",
+        "paths": "/etc/zfs",
+        "why": "Solo incluso quando l'host sorgente esegue ZFS. Contiene <code>zpool.cache</code> e <code>hostid</code>."
+      }
+    ],
+    "customTitle": "Estendere il profilo con percorsi personalizzati",
+    "customBody": "Oltre al profilo predefinito, ProxMenux offre due modi per includere ulteriori percorsi in un backup. Si compone senza conflitti ed entrambi si applicano a backup interattivi e lavori programmati.",
+    "customExtrasTitle": "1. Extra persistenti (file per host)",
+    "customExtrasBody": "Un file di testo a <code>/usr/local/share/proxmenux/backup-extra-paths.txt</code> contiene un elenco di percorsi assoluti che l'utente ha contrassegnato come \"sempre includere\" su questo host. Quando un backup viene eseguito in modalità <strong>Default</strong>, ProxMenux aggiunge questi percorsi al profilo predefinito automaticamente senza chiedere. Il file viene modificato dall'interfaccia — nessuna modifica manuale necessaria — e persiste attraverso riavvimenti e aggiornamenti. Un percorso assoluto per linea; sono consentiti commenti <code>#</code>.",
+    "customModeTitle": "2. Modalità personalizzata (per-run)",
+    "customModeBody": "Avviare un backup in modalità <strong>Custom</strong> sostituisce l'applicazione automatica del profilo predefinito con una lista di controllo che mostra ogni percorso: le voci del profilo predefinito e gli extra persistenti (prefissati con <code>[+]</code> e già selezionati). L'utente seleziona o deseleziona le voci per tale esecuzione specifica, e può anche premere <em>Aggiungi percorso personalizzato</em> per inserire un nuovo percorso — che viene poi persistito al file extra per i backup futuri.",
+    "customMissingTitle": "Sentieri assenti dalla fonte",
+    "customMissingBody": "Qualsiasi percorso dal profilo (default o aggiunto) che non esiste sull'host sorgente viene registrato in <code>metadata/missing_paths.txt</code> all'interno dell'archivio. Il backup non fallisce né si ferma — l'utente vede un riassunto di percorsi archiviati e percorsi mancanti alla fine. In pratica questo accade per percorsi di utensile opzionali come <code>/etc/wireguard</code> o <code>/etc/prometheus</code> quando questi strumenti non sono installati."
+  },
+  "manifest": {
+    "heading": "La parte manifesto",
+    "intro": "<code>manifest.json</code> è un documento strutturato JSON che descrive l'host sorgente al momento del backup. È prodotto da <strong>sei moduli di raccolta indipendenti</strong> orchestrati da <code>build_manifest.sh</code>. Ogni collettore è in sola lettura, produce un frammento JSON ben definito, e rientra in un default vuoto sicuro se non riesce — il manifesto è ancora utilizzabile se una sezione è incompleta.",
+    "orchestratorCaption": "I sei moduli di raccolta compongono il manifesto. Ogni collettore funziona nel proprio sottoprocesso; un guasto in uno rientra in un documento di default sicuro e avverte ma non interrompe il backup.",
+    "collectorRows": [
+      {
+        "collector": "collect_source_host.sh",
+        "produces": "source_host",
+        "content": "Hostname, versione PVE (<code>pveversion</code>), versione PBS se l'host esegue il ruolo di backup-server, kernel (<code>uname -r</code>), modalità boot (efi/bios), tipo filesystem root, modello CPU + architettura, memoria in KB."
+      },
+      {
+        "collector": "collect_hardware.sh",
+        "produces": "hardware_inventory",
+        "content": "GPU (con il fornitore e la mappatura dell'installatore ProxMenux), TPU (Coral USB + M.2 con il rilevamento di <code>lsusb</code>/<code>lspci</code>), NIC (con MAC, slot PCI e ponti), dispositivi wireless. Le voci GPU portano un'euristica <code>passthrough_eligible</code>."
+      },
+      {
+        "collector": "collect_storage.sh",
+        "produces": "storage_inventory",
+        "content": "Pool ZFS con relativo tipo e dischi membri identificati tramite <code>/dev/disk/by-id/*</code>, <code>/dev/disk/by-partuuid/*</code> o percorsi diretti <code>/dev/sdX</code>, a seconda di come il pool è stato creato; gruppi di volumi e thin pool LVM; dischi fisici con supporto SMART; voci PVE di <code>storage.cfg</code>; montaggi esterni."
+      },
+      {
+        "collector": "collect_kernel.sh",
+        "produces": "kernel_params",
+        "content": "Parametri aggiunti dall’operatore in <code>/proc/cmdline</code>, esclusi quelli standard come <code>BOOT_IMAGE=</code>, <code>root=</code>, <code>ro/rw</code>, <code>quiet</code> e <code>splash</code>; moduli caricati all’avvio da <code>/etc/modules</code>; percorsi dei file <code>/etc/modprobe.d/*.conf</code> con direttive effettive (<code>options</code>, <code>blacklist</code>, <code>install</code>, <code>alias</code>, <code>softdep</code>)."
+      },
+      {
+        "collector": "collect_proxmenux_state.sh",
+        "produces": "proxmenux_installed_components",
+        "content": "Leggi <code>/usr/local/share/proxmenux/managed_installs.json</code> (registry di tutto ciò che ProxMenux ha installato) e <code>installed_tools.json</code>. Ogni voce mantiene il percorso di installazione (<code>menu_script</code>) in modo che il ripristino possa attivare lo stesso flusso di installazione."
+      },
+      {
+        "collector": "collect_guests.sh",
+        "produces": "vms_lxcs_at_backup",
+        "content": "Elenca le VM (<code>qm list</code>) e i container LXC (<code>pct list</code>) presenti al momento del backup: VMID, nome e stato. È soltanto l’inventario; il backup dei dati effettivi dei guest spetta a <code>vzdump</code> / PBS."
+      }
+    ],
+    "schemaTitle": "Validazione schema",
+    "schemaBody": "Il manifesto convalida contro <code>scripts/backup_restore/schema/manifest.schema.json</code>. L'esecuzione di <code>build_manifest.sh --validate</code> attiva una validazione dello schema JSON (richiede <code>python3</code> + <code>jsonschema</code>). Se il modulo non è presente, il controllo è saltato silenziosamente — la validazione è principalmente un aiuto sviluppatore, non una dipendenza runtime."
+  },
+  "applications": {
+    "heading": "inventario delle applicazioni",
+    "intro": "Due inventari elencano il software aggiunto ai pacchetti base di Proxmox VE: la lista dei pacchetti in <code>metadata/</code> e il registro dei componenti in rootfs, descritti di seguito. Il ripristino usa APT o gli installatori ProxMenux per riprodurre il software dell’utente secondo il metodo originale di installazione.",
+    "packagesTitle": "packages.manual.list",
+    "packagesBody": "Una lista alfabetica in testo semplice prodotta da <code>apt-mark showmanual</code> con tutti i pacchetti APT <em>installati esplicitamente</em> sull’host di origine. Sono escluse le dipendenze del sistema Proxmox VE di base, che APT installa automaticamente sul destinatario. Durante il ripristino, <code>_rs_run_complete_extras</code> legge la lista e applica un <em>filtro contro le rimozioni a cascata</em> in tre passaggi: <code>dpkg -s</code> rileva i pacchetti già installati, vengono rilevate altre versioni principali delle librerie e <code>apt-get install --simulate</code> verifica il rischio di rimozioni a cascata. Infine usa <code>apt-get install -y</code> per i pacchetti rimasti.",
+    "componentsTitle": "components_status.json (parte di rootfs)",
+    "componentsBody": "Un registro JSON sotto <code>/usr/local/share/proxmenux/</code> che registra ogni componente ProxMenux installato con il suo stato esatto: versione, bandiere ProxMenux-specifiche (per NVIDIA: <code>patched</code> boolean; per Coral: versione DKMS). Questo file vive all'interno dei rootfs — non in <code>metadata/</code> — perché è <em>letto dopo</em> la copia di rootfs al bersaglio. Il distaccatore post-boot (<code>apply_cluster_postboot.sh</code>) itera sulle sue voci ed esegue il gancio <code>--auto-reinstall</code> di ciascun componente, che legge lo stato registrato e riproduce l'installazione contro il kernel corrente dell'obiettivo.",
+    "componentInstallersTitle": "Installatori di componenti",
+    "componentInstallersBody": "Quattro installatori ProxMenux attualmente espongono un punto di ingresso <code>--auto-reinstall</code>:",
+    "installerRows": [
+      {
+        "component": "nvidia_driver",
+        "installer": "gpu_tpu/nvidia_installer.sh",
+        "action": "Leggi <code>version</code> + <code>patched</code>. Scarica lo stesso runfile NVIDIA, costruisce moduli DKMS contro il kernel dell'obiettivo, riapplica la patch ProxMenux se la sorgente lo avesse."
+      },
+      {
+        "component": "coral_driver",
+        "installer": "gpu_tpu/install_coral.sh",
+        "action": "Legge la versione del driver Coral. Compili il modulo DKMS contro il kernel dell'obiettivo."
+      },
+      {
+        "component": "amdgpu_top",
+        "installer": "gpu_tpu/amd_gpu_tools.sh",
+        "action": "Legge la versione registrata. Ricarica l'esatta <code>.deb</code> dalla versione GitHub."
+      },
+      {
+        "component": "intel_gpu_tools",
+        "installer": "gpu_tpu/intel_gpu_tools.sh",
+        "action": "APT-installa il pacchetto. Idemponte se già presente da <code>packages.manual.list</code>."
+      }
+    ]
+  },
+  "restoreFlow": {
+    "heading": "Come il ripristino usa le tre parti",
+    "intro": "Il restauro e' una pipeline di sei stadi. Ogni fase legge un sottoinsieme specifico dell'archivio e aggiorna l'host di destinazione. Nessuna fase richiede che l'host sorgente sia raggiungibile — l'archivio è completamente autonomo.",
+    "stagesCaption": "La fase 1 usa il manifesto per decidere cosa modificare. La fase 2 copia i percorsi rootfs applicabili al sistema in esecuzione. La fase 3 prepara quelli rischiosi per il prossimo avvio. La fase 3b importa i pool ZFS di dati che non contengono la radice e hanno tutti i dischi presenti. La fase 4 gestisce i pacchetti. La fase 5 reinstalla i componenti dopo il riavvio per il kernel di destinazione.",
+    "stageRows": [
+      {
+        "stage": "1",
+        "name": "Controllo di compatibilità",
+        "reads": "manifest.json",
+        "action": "Esegue <code>hb_compat_check</code>. Confronta sorgente vs. hardware target (NIC, ID di archiviazione), versione PVE e versione kernel principale. Imposta <code>HB_COMPAT_KERNEL_DIRECTION</code> (<code>same</code>, <code>bk_newer</code> o <code>bk_older</code>) e popola <code>RS_SKIP_PATHS</code> con esclusione hardware-drift e cross-kernel."
+      },
+      {
+        "stage": "2",
+        "name": "Applicazione a sistema avviato",
+        "reads": "rootfs/ (solo percorsi sicuri)",
+        "action": "<code>_rs_apply … hot</code> copia le voci <code>hb_classify_path</code>=<code>hot</code> direttamente al target live. Qualsiasi cosa sotto <code>/etc/pve</code>, <code>/etc/network</code> o percorsi classificati come <em>reboot</em>/<em>dangerous</em> è differita."
+      },
+      {
+        "stage": "3",
+        "name": "Preparazione delle modifiche differite",
+        "reads": "rootfs/ (riavvio + percorsi pericolosi)",
+        "action": "<code>_rs_prepare_pending_restore</code> prepara i percorsi rischiosi in <code>/var/lib/proxmenux/pending-restore/</code>, scrive <code>plan.env</code>, <code>apply-on-boot.list</code> e <code>rs-skip-paths.txt</code> e abilita <code>proxmenux-restore-onboot.service</code> per il prossimo avvio."
+      },
+      {
+        "stage": "3b",
+        "name": "Importazione dei pool di dati",
+        "reads": "manifest.storage_inventory + target ZFS stato",
+        "action": "<code>_rs_import_data_pools</code> tenta di importare ogni pool ZFS che non contiene la radice e ha tutti i dischi presenti sul destinatario. Se il pool ha un hostid estraneo, riprova con <code>zpool import -f</code>. Se manca un disco, il pool viene saltato con un avviso. Il risultato per pool è registrato in <code>/var/log/proxmenux/restore-datapools-&lt;timestamp&gt;.log</code>."
+      },
+      {
+        "stage": "4",
+        "name": "Installazione del pacchetto",
+        "reads": "metadata/packages.manual.list",
+        "action": "<code>_rs_run_complete_extras</code> gestisce il filtro a cascata e chiama <code>apt-get install -y</code> con l'elenco dei pacchetti sopravvissuti. L'uscita completa va a <code>/var/log/proxmenux/restore-apt-*.log</code>."
+      },
+      {
+        "stage": "5",
+        "name": "Dopo l'avvio",
+        "reads": "rootfs (già applicato) + components_status.json",
+        "action": "Dopo il riavvio, <code>apply_pending_restore.sh</code> riprende i percorsi differiti e <code>apply_cluster_postboot.sh</code> corre <code>update-initramfs</code>, <code>update-grub</code> (o <code>proxmox-boot-tool refresh</code>) e itera oltre <code>components_status.json</code> sparando il gancio <code>--auto-reinstall</code> di ogni componente."
+      }
+    ]
+  },
+  "whyItWorks": {
+    "heading": "Perché suddividere il backup in tre parti",
+    "body": "La suddivisione segue il <strong>ciclo di vita</strong> dei dati. Il filesystem viene trasferito con <code>rsync</code>: rapidamente, in modo trasparente e atomico per file. Lo stato di configurazione da interpretare prima delle modifiche è <strong>JSON strutturato</strong>, leggibile separatamente, versionabile tramite schema e confrontabile automaticamente con lo stato di destinazione. Il software da reinstallare è descritto in un <strong>inventario</strong> di nomi e versioni; il gestore dei pacchetti e gli installatori ProxMenux scelgono i binari adatti. Ogni parte svolge il proprio compito. Insieme mirano a un ripristino coerente ma tollerante agli errori: un manifesto corrotto lascia rootfs ripristinabile, un pacchetto mancante non impedisce l’installazione dei componenti e un errore su una voce non ferma l’installazione della successiva."
+  }
+}
diff --git a/web/messages/it/docs/backup-restore/index.json b/web/messages/it/docs/backup-restore/index.json
new file mode 100644
index 00000000..0e1015af
--- /dev/null
+++ b/web/messages/it/docs/backup-restore/index.json
@@ -0,0 +1,93 @@
+{
+  "meta": {
+    "title": "ProxMenux Backup e ripristino — Panoramica | Backup e ripristino completo dell'host per Proxmox VE",
+    "description": "ProxMenux Backup e ripristino acquisisce lo stato completo di un host Proxmox (file system, manifest di configurazione strutturata e pacchetti/componenti installati) e lo riproduce sullo stesso host o su un host diverso. Il backup e il ripristino sono autonomi: nessuna dipendenza esterna e i ripristini tra kernel sono supportati tramite un filtro di sottoinsieme sicuro sensibile alla direzione e un'idratazione indipendente dal kernel.",
+    "ogTitle": "ProxMenux Backup e ripristino - Panoramica",
+    "ogDescription": "Backup e ripristino completo dell'host per Proxmox VE con manifest strutturato, elenco di pacchetti e programmi di reinstallazione dei componenti.",
+    "twitterTitle": "ProxMenux Backup e ripristino | ProxMenux",
+    "twitterDescription": "Backup e ripristino completo dell'host per Proxmox VE con manifest strutturato, elenco di pacchetti e programmi di reinstallazione dei componenti."
+  },
+  "header": {
+    "title": "Backup e ripristino",
+    "description": "Backup e ripristino dell'intero host per Proxmox VE. Cattura filesystem, configurazione e componenti installati in un unico archivio e riproduce l'host sulla stessa o su una diversa installazione Proxmox senza dipendenze esterne.",
+    "section": "Backup e ripristino"
+  },
+  "intro": {
+    "title": "Che cos'è, in un paragrafo",
+    "body": "Un backup di ProxMenux acquisisce lo stato completo di un host Proxmox: <strong>il filesystem</strong>, con le directory pertinenti in <code>/etc</code>, <code>/root</code> e <code>/var/lib/pve-cluster</code> e gli eventuali percorsi personalizzati; <strong>un manifesto strutturato</strong> in JSON con hardware rilevato, parametri del kernel, configurazione di rete, stato di ZFS, utenti e voci cron; e <strong>un inventario delle applicazioni</strong>, con i pacchetti contrassegnati da APT come installati manualmente e i componenti installati da ProxMenux, completi delle versioni esatte. Le tre destinazioni supportate — archivio locale, Proxmox Backup Server (consigliato) e Borg — ricevono lo stesso contenuto autonomo. Ognuna consente di ricostruire l’host di destinazione senza che l’host di origine debba essere raggiungibile durante il ripristino."
+  },
+  "video": {
+    "heading": "Video tutorial",
+    "intro": "Preferisci guardare Backup e ripristino in azione prima di configurarlo? Questa procedura dettagliata copre una demo completa end-to-end della funzionalità in ProxMenux.",
+    "title": "ProxMenux — Procedura dettagliata di backup e ripristino",
+    "caption": "Video esterno su YouTube. Riproduce in modalità di privacy avanzata (nessun cookie finché non premi Riproduci)."
+  },
+  "whatItIsNot": {
+    "heading": "Cosa non è",
+    "intro": "Questa sezione riguarda il backup e il ripristino <strong>dell’host</strong>: l’installazione di Proxmox, non le applicazioni e i sistemi guest che vi vengono eseguiti.",
+    "items": [
+      "<strong>Non è uno strumento di backup delle VM/CT.</strong> Questa funzione non acquisisce i dischi o lo stato della RAM dei guest: a questo serve <code>vzdump</code>. I <strong>file di configurazione</strong> dei guest (<code>/etc/pve/nodes/&lt;node&gt;/qemu-server/*.conf</code> e <code>lxc/*.conf</code>) vengono <strong>invece</strong> salvati. Dopo il ripristino ricompare l’inventario e i dischi possono essere ripristinati o ricollegati da un backup esistente su PBS o in locale.",
+      "<strong>Non è un’operazione sull’intero cluster.</strong> Ogni nodo salva il proprio backup. L’appartenenza al cluster è inclusa in <code>/etc/pve</code>, così un nodo ripristinato può esservi reintegrato; il ripristino di tutto il cluster richiede però il coordinamento dei singoli nodi.",
+      "<strong>Non è un’immagine completa del disco.</strong> Non vengono salvati i binari del kernel, l’initramfs o la partizione di avvio. Durante il ripristino ProxMenux usa i file di avvio dell’host di destinazione, rigenerati automaticamente da <code>update-initramfs</code> e dallo strumento del bootloader, e installa i driver compatibili con il kernel in esecuzione sulla destinazione."
+    ]
+  },
+  "threePillars": {
+    "heading": "I tre pilastri di un backup",
+    "intro": "Un archivio ProxMenux è strutturato attorno a tre payload autonomi. Il ripristino li utilizza tutti e tre insieme per riprodurre l'host di origine su una destinazione che potrebbe non avere nemmeno lo stesso kernel installato.",
+    "diagramCaption": "Ogni backup spedisce gli stessi tre payload indipendentemente dalla destinazione. Il ripristino utilizza tutti e tre: rootfs per depositare i file, manifest per rilevare deviazioni e differenze tra kernel e inventario delle applicazioni per reinstallare pacchetti e componenti sul kernel della destinazione.",
+    "pillar1Label": "Filesystem",
+    "pillar1Detail": "rootfs/\n(rsync di /etc,\n/etc/systemd/network,\n/root, più uno\nsnapshot sqlite3\ndi /var/lib/pve-cluster,\n+ percorsi opzionali)",
+    "pillar2Label": "Manifesto",
+    "pillar2Detail": "manifest.json\n(hardware, parametri\ndel kernel, rete,\nZFS, utenti, cron,\npool ZFS, archiviazione)",
+    "pillar3Label": "Applicazioni",
+    "pillar3Detail": "packages.manual.list\n+ components_status.json\n(pacchetti APT manuali + programmi\ndi installazione ProxMenux con versioni)"
+  },
+  "restoreIsUniversal": {
+    "heading": "Il ripristino riproduce l'host di origine, non l'archivio",
+    "body": "Il ripristino di un backup ProxMenux non si limita ad estrarre il filesystem. Il flusso di ripristino legge il manifest per rilevare la deviazione tra l'origine e la destinazione (differenze hardware, rinomina della scheda NIC, versione del kernel, identità del pool ZFS), riproduce il file system, quindi attiva il programma di installazione del componente corretto per ogni servizio installato sull'origine (driver NVIDIA, Coral TPU, strumenti GPU AMD, strumenti Intel GPU). Ogni programma di installazione viene eseguito sul <strong>kernel corrente della destinazione</strong>, quindi l'host ripristinato non dipende dalla presenza del kernel di origine. Quando il kernel della destinazione è più recente di quello del backup, un passaggio di <strong>idratazione</strong> indipendente dal kernel unisce l'ottimizzazione dell'utente (token IOMMU, ID dispositivo VFIO, quirk personalizzati, chiavi GRUB) nella nuova configurazione di avvio della destinazione senza copiare testualmente i file legati al kernel."
+  },
+  "twoInterfaces": {
+    "heading": "Due interfacce, un backend",
+    "intro": "Ogni fase del flusso di lavoro di backup e ripristino è disponibile da due punti di ingresso. Entrambi chiamano la stessa libreria di shell, producono archivi identici e leggono lo stesso registro dei lavori.",
+    "cliLabel": "ProxMenux Scripts (TUI)",
+    "cliDetail": "menu → Utilità →\nBackup/Ripristino dell'host\n\nFlusso basato su dialoghi,\nSSH-friendly, scriptabile\nper uso non presidiato.",
+    "webLabel": "ProxMenux Monitor (Web UI)",
+    "webDetail": "Scheda Backups\nnell’interfaccia web di Monitor.\n\nRipristino con un clic, log\nin tempo reale, integrazione con\nle notifiche e il visualizzatore\ndelle differenze di rollback."
+  },
+  "whereNext": {
+    "heading": "Dove andare da qui",
+    "intro": "Ogni sottosezione seguente copre in modo approfondito un aspetto del flusso di lavoro. Inizia con <em>Come funziona</em> se l'obiettivo è capire cosa contiene l'archivio e perché. Vai a <em>Destinazioni</em> per configurare la destinazione per la copia. Leggi <em>Ripristino</em> e <em>Ripristino cross-kernel</em> per la parte di ripristino.",
+    "items": [
+      {
+        "label": "Come funziona",
+        "href": "/docs/backup-restore/how-it-works",
+        "tail": "— i tre payload (rootfs, manifest, applicazioni) in dettaglio, con i raccoglitori che li producono e il formato di ciascun file."
+      },
+      {
+        "label": "Destinazioni",
+        "href": "/docs/backup-restore/destinations",
+        "tail": " — confronto tra locale, Proxmox Backup Server (consigliato) e Borg e come configurarli."
+      },
+      {
+        "label": "Creazione di backup",
+        "href": "/docs/backup-restore/creating-backups",
+        "tail": " — backup una tantum, profilo di percorso predefinito, aggiunta di percorsi personalizzati, crittografia per PBS."
+      },
+      {
+        "label": "Lavori pianificati",
+        "href": "/docs/backup-restore/scheduled-jobs",
+        "tail": " — nuovi lavori rispetto al collegamento a un lavoro vzdump PVE esistente, formati di pianificazione, finestra dei dettagli del lavoro."
+      },
+      {
+        "label": "Ripristino",
+        "href": "/docs/backup-restore/restoring",
+        "tail": " — le tre azioni su un archivio (visualizzazione, download, ripristino), ripristino completo e personalizzato, il dispatcher post-avvio e perché gli ultimi dieci minuti sono importanti."
+      },
+      {
+        "label": "Ripristino tra kernel",
+        "href": "/docs/backup-restore/cross-kernel",
+        "tail": " — comportamento che tiene conto della direzione del cambio di versione quando il kernel di destinazione è diverso da quello del backup, filtro del sottoinsieme sicuro e quattro fasi di idratazione."
+      }
+    ]
+  }
+}
diff --git a/web/messages/it/docs/backup-restore/restoring.json b/web/messages/it/docs/backup-restore/restoring.json
new file mode 100644
index 00000000..2f53b1e3
--- /dev/null
+++ b/web/messages/it/docs/backup-restore/restoring.json
@@ -0,0 +1,282 @@
+{
+  "meta": {
+    "title": "Ripristino di un backup — flussi completi e personalizzati | ProxMenux",
+    "description": "Il flusso di lavoro completo di ripristino. Documenta le tre azioni disponibili su qualsiasi backup (visualizzazione, download, ripristino), il controllo di compatibilità e i suoi risultati, le modalità di ripristino completo e personalizzato, la classificazione del percorso che decide cosa si applica dal vivo e cosa aspetta per il prossimo avvio, il dispacciatore di avvio, e il passaggio di reinstallazione del componente post-boot.",
+    "ogTitle": "ProxMenux Backup — ripristino",
+    "ogDescription": "Flussi di ripristino completi e personalizzati con il controllo di compatibilità, la classificazione del percorso, il dispacciatore on-boot e la reinstallazione post-boot.",
+    "twitterTitle": "Ripristino di un backup | ProxMenux",
+    "twitterDescription": "Come un backup host ProxMenux viene trasformato in un host Proxmox funzionante."
+  },
+  "header": {
+    "title": "Ripristino di un backup",
+    "description": "L’intero ripristino, dalla scelta dell’archivio a un host operativo: controllo della compatibilità, due modalità di ripristino, elaborazione all’avvio e reinstallazione dei componenti dopo l’avvio, con i meccanismi per ripristinare su host e kernel diversi.",
+    "section": "Backup e ripristino"
+  },
+  "intro": {
+    "title": "Il ripristino riproduce la fonte, non solo i file",
+    "body": "Ripristinare un backup ProxMenux richiede più della semplice estrazione. Prima delle modifiche, il manifesto rileva le differenze tra origine e destinazione, vengono esclusi i percorsi che potrebbero impedire l’avvio e adattate le impostazioni dell’utente non copiabili alla lettera. Dopo il riavvio necessario, viene tentata la reinstallazione dei componenti supportati registrati (driver NVIDIA, Coral TPU, strumenti GPU) per il kernel attivo della destinazione. Un solo archivio guida controllo della compatibilità, classificazione dei percorsi e operazioni all’avvio e successive. Verifica risultati dei componenti e log per confermare l’esito."
+  },
+  "threeActions": {
+    "heading": "Tre azioni su un backup",
+    "intro": "Selezionando un backup dall'elenco si apre un menu con tre azioni.",
+    "actionRows": [
+      {
+        "action": "Vista",
+        "detail": "Consente di visualizzare in sola lettura l'archivio: contenuti manifest.json (nome host sorgente, versione PVE, kernel, hardware, componenti installati), l'elenco dei percorsi all'interno di <code>rootfs/</code> e un diff di ciò che cambierebbe sull'host corrente se il backup fosse applicato."
+      },
+      {
+        "action": "Scarica",
+        "detail": "Esporta l'archivio come file portatile <code>.tar.zst</code> (tar compresso con zstd). Può essere estratto su qualsiasi sistema Linux con <code>tar --zstd -xf FILE.tar.zst</code>, o su macOS/Windows con qualsiasi strumento che supporta zstd (7-Zip, PeaZip, Keka...). L'albero estratto contiene <code>manifest.json</code>, <code>metadata/</code> e <code>rootfs/</code> — esattamente lo stesso layout che il ripristino consuma. Utile per l'ispezione offline o per il ripristino su un host senza accesso alla destinazione originale (PBS, Borg)."
+      },
+      {
+        "action": "Ripristina",
+        "detail": "Il percorso di scrittura. Estrae l'archivio in una directory di staging, esegue il controllo di compatibilità e presenta il raccoglitore di modalità (Full o Custom)."
+      }
+    ]
+  },
+  "compatibilityCheck": {
+    "heading": "Il controllo della compatibilità",
+    "intro": "Prima che qualsiasi file sia scritto, <code>hb_compat_check</code> confronta lo stato descritto nel manifesto contro l'host di destinazione. Il controllo viene eseguito in sola lettura e produce quattro uscite indipendenti che guidano il resto del ripristino.",
+    "outputRows": [
+      {
+        "output": "Indicatore della direzione",
+        "detail": "<code>HB_COMPAT_KERNEL_DIRECTION</code> vale <code>same</code>, <code>bk_newer</code> o <code>bk_older</code> in base al confronto delle versioni principali del kernel del backup e della destinazione. Guida il filtro dei percorsi compatibili, attivo solo per <code>bk_older</code>, e l’adattamento delle impostazioni descritto nella pagina sul ripristino tra kernel diversi."
+      },
+      {
+        "output": "Elenco dei percorsi Skip-paths",
+        "detail": "<code>RS_SKIP_PATHS</code> — ogni percorso che il ripristino non deve applicarsi. Populate da due meccanismi: deriva dell'hardware (mancando NIC, ID di archiviazione mancante, straniero ZFS pool) e — quando la direzione è <code>bk_older</code> — l'elenco dei percorsi non sicuri per il cross-kernel."
+      },
+      {
+        "output": "Piano di rimappatura delle schede di rete",
+        "detail": "Quando un NIC sul bersaglio ha lo stesso MAC come uno sulla fonte ma un nome diverso (tipico dopo uno scambio di schede madri), il controllo di compatibilità registra un piano di rinomina (<code>HB_NIC_REMAP</code>) che riscriverà <code>/etc/network/interfaces</code> durante il ripristino."
+      },
+      {
+        "output": "Piano di rollback",
+        "detail": "Calcolato da <code>compute_rollback_plan.sh</code>. Elenca VM, LXC e componenti presenti sulla destinazione ma assenti dal backup. La conferma offre la rimozione facoltativa dei guest aggiuntivi prima del riavvio. I componenti vanno rimossi manualmente e l’eliminazione dei guest può fallire: non è garantita una corrispondenza esatta."
+      }
+    ],
+    "reportBody": "Il controllo emette anche un rapporto strutturato (<code>HB_COMPAT_RESULTS</code>) classificato come PASS / INFO / WARN / FAIL. Le voci WARN e FAIL sono di superficie nel pannello pre-restore; il ripristino si rifiuta di procedere solo quando un FAIL è presente che l'utente non può risolvere facendo clic su Continua."
+  },
+  "twoModes": {
+    "heading": "Ripristino completo vs ripristino personalizzato",
+    "intro": "Dopo il controllo della compatibilità compare la scelta della modalità. Determina <em>cosa</em> applicare e non <em>come</em>: entrambe usano lo stesso processo.",
+    "modeRows": [
+      {
+        "mode": "Ripristino completo",
+        "detail": "Applica ogni percorso dell'archivio che sopravvive alla deriva e ai filtri cross-kernel. Esegue anche il pacchetto di installazione e il componente auto-reinstall pass. Questa è la scelta predefinita e raccomandata — l'obiettivo è quello di riprodurre la fonte, non selezionare i pezzi."
+      },
+      {
+        "mode": "Ripristino personalizzato",
+        "detail": "Apre una lista di controllo che mostra ogni percorso che l'archivio porta. L'utente segna un sottoinsieme. I percorsi bloccati dal filtro cross-kernel appaiono grigiati e non possono essere selezionati. L'installazione del pacchetto e la reinstallazione automatica del componente sono saltati per impostazione predefinita in modalità personalizzata — l'utente sta segnalando che vogliono applicazione parziale, non una riproduzione completa."
+      }
+    ]
+  },
+  "pathClassification": {
+    "heading": "Come si classificano i percorsi",
+    "intro": "Ogni percorso selezionato per il ripristino è classificato da <code>hb_classify_path</code> in una delle tre categorie. La categoria determina quando il percorso viene applicato al sistema e perché.",
+    "rows": [
+      {
+        "class": "hot",
+        "detail": "Percorsi applicati <strong>immediatamente</strong> al sistema di esecuzione. Il servizio che li consuma raccoglie il cambiamento da solo o al successivo ricarico — nessun riavvio richiesto. Queste sono la maggior parte di un backup: <code>/etc/ssh</code>, <code>/etc/apt</code>, <code>/etc/cron.*</code>, <code>/root</code>, <code>/usr/local/bin</code>, file di configurazione di servizio generale, ecc."
+      },
+      {
+        "class": "reboot",
+        "detail": "Percorsi rimandati al <strong>prossimo avvio</strong> anziché applicati <strong>immediatamente</strong> da questo processo. Riguardano la configurazione di avvio: la generazione del bootloader legge <code>/etc/default/grub</code>, i montaggi usano <code>/etc/fstab</code> e il caricamento dei moduli usa <code>/etc/modules</code>. I file differiti vengono applicati dopo il riavvio, poi vengono rigenerati gli elementi di avvio necessari. Esempi: <code>/etc/default/grub</code>, <code>/etc/kernel</code>, <code>/etc/modules</code>, <code>/etc/fstab</code>, <code>/etc/zfs</code>, <code>/etc/modprobe.d</code>."
+      },
+      {
+        "class": "dangerous",
+        "detail": "Percorsi <strong>NON applicati sul sistema in esecuzione</strong>: una scrittura a caldo potrebbe corrompere lo stato o interrompere la connessione attiva. Vengono messi nell’insieme in attesa: <code>/etc/network</code> viene scritto all’inizio del riavvio successivo, prima dell’avvio della rete, e <code>/etc/pve</code> viene scritto dal dispatcher post-avvio quando il file system del cluster è disponibile. Esempi: <code>/etc/pve</code> (pmxcfs è un montaggio FUSE con la configurazione attiva del cluster), <code>/var/lib/pve-cluster</code> (dati attivi del cluster, conservati nella directory di ripristino solo per il recupero manuale), <code>/etc/network</code> (potrebbe riconfigurare proprio l’interfaccia usata dalla connessione SSH e interrompere la sessione)."
+      }
+    ]
+  },
+  "fullFlow": {
+    "heading": "Il flusso di lavoro di ripristino completo",
+    "intro": "La pipeline completa dalla selezione di archivi a un host restaurato funzionante. Ogni fase alimenta il successivo; lo stato scritto da fasi precedenti è consumato da quelli successivi.",
+    "diagram": "┌─────────────────────────────────────────────────────────────────┐\n│  Archive → staging_root/                                        │\n│    manifest.json   metadata/   rootfs/                          │\n└──────────────────────────────┬──────────────────────────────────┘\n                               │\n                               ▼\n   ┌─────────────────────────────────────────────────────────┐\n   │  1. hb_compat_check                                     │\n   │     · hardware drift → RS_SKIP_PATHS                    │\n   │     · kernel direction → same / bk_newer / bk_older     │\n   │     · NIC remap plan                                    │\n   │     · hydration plan (bk_older only)                    │\n   │     · rollback plan                                     │\n   └──────────────────────────────┬──────────────────────────┘\n                                  │\n                                  ▼\n   ┌─────────────────────────────────────────────────────────┐\n   │  2. Confirmation dialog                                 │\n   │     Shows: hot count, pending count, drift, hydration,  │\n   │     NIC remap, cross-kernel note, reinstalls preview    │\n   └──────────────────────────────┬──────────────────────────┘\n                                  │ (accepted)\n                                  ▼\n   ┌─────────────────────────────────────────────────────────┐\n   │  3. Apply hot paths → LIVE                              │\n   │     _rs_apply rsyncs each hot path                      │\n   │     from staging_root/rootfs to /                       │\n   │     (skips paths in RS_SKIP_PATHS)                      │\n   └──────────────────────────────┬──────────────────────────┘\n                                  │\n                                  ▼\n   ┌─────────────────────────────────────────────────────────┐\n   │  4. _rs_prepare_pending_restore                         │\n   │     /var/lib/proxmenux/pending-restore/                 │\n   │       ├── apply-on-boot.list                            │\n   │       ├── plan.env                                      │\n   │       ├── rs-skip-paths.txt                             │\n   │       └── rootfs/ (deferred paths)                      │\n   │     Enable proxmenux-restore-onboot.service             │\n   └──────────────────────────────┬──────────────────────────┘\n                                  │\n                                  ▼\n   ┌─────────────────────────────────────────────────────────┐\n   │  4b. _rs_import_data_pools                              │\n   │      Imports non-root ZFS pools whose disks are all     │\n   │      present; retries with -f on foreign hostid;        │\n   │      skips with a warning when disks are missing.       │\n   │      Log: /var/log/proxmenux/restore-datapools-*.log    │\n   └──────────────────────────────┬──────────────────────────┘\n                                  │\n                                  ▼\n   ┌─────────────────────────────────────────────────────────┐\n   │  5. _rs_run_complete_extras                             │\n   │     packages.manual.list                                │\n   │       → cascade-safe filter                             │\n   │       → apt-get install                                 │\n   └──────────────────────────────┬──────────────────────────┘\n                                  │\n                                  ▼\n   ┌─────────────────────────────────────────────────────────┐\n   │  6. REBOOT                                              │\n   └──────────────────────────────┬──────────────────────────┘\n                                  │\n                                  ▼\n   ┌─────────────────────────────────────────────────────────┐\n   │  7. apply_pending_restore.sh (on early boot)            │\n   │     Reads plan.env                                      │\n   │     Applies apply-on-boot.list (filtered)               │\n   │     Installs the postboot systemd unit                  │\n   └──────────────────────────────┬──────────────────────────┘\n                                  │\n                                  ▼\n   ┌─────────────────────────────────────────────────────────┐\n   │  8. apply_cluster_postboot.sh (~10 minutes)             │\n   │     Runs after pve-cluster is up                        │\n   │     · Applies /etc/pve entries to pmxcfs                │\n   │     · update-initramfs -u -k all                        │\n   │     · update-grub / proxmox-boot-tool refresh           │\n   │     · component --auto-reinstall (nvidia, coral, ...)   │\n   │     · Boot sanity check                                 │\n   │     · Notification: \"Host restore finished\"             │\n   └─────────────────────────────────────────────────────────┘"
+  },
+  "pendingMachinery": {
+    "heading": "Il meccanismo di ripristino differito",
+    "intro": "I percorsi classificati come <code>reboot</code> o <code>dangerous</code>, e le scritture di idratazione, sono in scena per il prossimo avvio invece di essere applicati in diretta. Questo viene fatto attraverso un piccolo set autocontenuto di file sotto <code>/var/lib/proxmenux/pending-restore/</code>:",
+    "rows": [
+      {
+        "file": "apply-on-boot.list",
+        "content": "Un percorso relativo per linea — l'esatto insieme di percorsi <code>apply_pending_restore.sh</code> si applicherà dai rootfs in fase. Leggere questo file dice all'utente esattamente ciò che cambierà sul boot successivo."
+      },
+      {
+        "file": "plan.env",
+        "content": "Variabili d’ambiente caricate dallo script di avvio: ID del ripristino, indicatori di compatibilità (<code>HB_COMPAT_CROSS_VERSION</code>, <code>HB_COMPAT_KERNEL_DIRECTION</code>, <code>HB_HYDRATION_APPLIED</code>), consenso al rollback e opzioni del cluster."
+      },
+      {
+        "file": "rs-skip-paths.txt",
+        "content": "La lista finale <code>RS_SKIP_PATHS</code>, salvata affinché <code>apply_pending_restore.sh</code> mantenga dopo il riavvio le esclusioni calcolate nella fase interattiva. Impedisce di ripristinare all’avvio percorsi incompatibili con l’hardware o il kernel."
+      },
+      {
+        "file": "rootfs/",
+        "content": "I file in scena stessi — i byte esatti che saranno stabiliti. Tenuto sullo stesso filesystem di <code>/</code> così il rsync on-boot è veloce e non dipende dallo storage esterno ancora raggiungibile al boot."
+      }
+    ],
+    "unitBody": "L’unità systemd <code>proxmenux-restore-onboot.service</code> viene abilitata alla fine della fase interattiva. Il servizio viene eseguito una sola volta, all’inizio del prossimo avvio, richiama <code>apply_pending_restore.sh</code> e poi si disabilita. La condizione <code>ConditionPathExists=/var/lib/proxmenux/pending-restore/state</code> evita l’esecuzione quando non esiste un ripristino in sospeso."
+  },
+  "postbootDispatcher": {
+    "heading": "Il processo dopo l’avvio — apply_cluster_postboot.sh",
+    "intro": "Dove finisce il passo interattivo e dove avviene la riproduzione reale dell'ospite. <code>apply_cluster_postboot.sh</code> è installato come una seconda unità systemd (<code>proxmenux-apply-cluster-postboot.service</code>) la cui destinazione <code>After=</code>/<code>Wants=</code> assicura che funzioni solo dopo l'apertura di pve-cluster e network-online. Questo è dove le azioni di ripristino visibile dell'ospite atterrare.",
+    "tasks": [
+      {
+        "task": "Applicare /etc/pve",
+        "detail": "<code>/etc/pve</code> è un live pmxcfs FUSE mount — non può essere scritto su avvio precoce. Il dispacciatore copia i file dai rootf in sospeso al live <code>/etc/pve</code> una volta che il filesystem del cluster è in funzione, un file alla volta, senza riavviare pve-cluster. Il <code>/var/lib/pve-cluster/config.db</code> catturato dal backup (o il <code>config.db.raw-fallback</code>) promosso è materializzato con il <code>systemctl stop pve-cluster</code> → copia di file atomico → modello <code>systemctl start pve-cluster</code>, quindi pmxcfs rilegge lo stato ripristinato sulla via del ritorno."
+      },
+      {
+        "task": "Ricostruire initramfs e bootloader",
+        "detail": "Esegue <code>update-initramfs -u -k all</code> per tutti i kernel installati, poi <code>update-grub</code> per GRUB oppure <code>proxmox-boot-tool refresh</code> per systemd-boot/ZFS. Il passaggio viene saltato se la fase interattiva ha rilevato che nessun percorso pertinente è cambiato."
+      },
+      {
+        "task": "Reinstallazione automatica dei componenti",
+        "detail": "Legge <code>components_status.json</code> ripristinato e scorre gli installatori supportati (nvidia_driver, coral_driver, amdgpu_top, intel_gpu_tools). Ogni installatore selezionato usa <code>--auto-reinstall</code>, legge lo stato registrato e reinstalla per l’ambiente di destinazione, ricompilando i moduli se necessario. Attende il riavvio per usare il kernel allora attivo. Gli errori individuali vengono registrati senza fermare il componente successivo."
+      },
+      {
+        "task": "Controllo preliminare dell'avvio",
+        "detail": "Prima di eseguire la notifica di completamento, verifica che <code>proxmox-boot-tool status</code> mostra un ESP configurato, ogni <code>/boot/vmlinuz-*</code> ha una directory corrispondente <code>/lib/modules/&lt;ver&gt;</code> e risolve <code>/vmlinuz</code>. Qualsiasi incoerenza viene visualizzata nella notifica invece di essere nascosta."
+      },
+      {
+        "task": "Notifica di completamento",
+        "detail": "Invia l'evento <code>Host restore finished</code> tramite <code>hb_notify_lifecycle</code>. Include la durata totale, il conteggio del percorso applicato, le avvertenze di controllo della sanità se presenti, e un collegamento al registro a <code>/var/log/proxmenux/proxmenux-cluster-postboot-*.log</code>. Se le notifiche non sono configurate, l'evento è silenzioso — il registro registra tutto."
+      }
+    ]
+  },
+  "liveProgress": {
+    "heading": "Avanzamento in tempo reale nella scheda Backup del Monitor",
+    "body": "Dopo il riavvio, la scheda Backup di ProxMenux Monitor mostra l’avanzamento di <code>proxmenux-apply-cluster-postboot.service</code>. Legge <code>/var/lib/proxmenux/restore-state.json</code>, aggiornato a ogni fase: configurazione del cluster, initramfs, bootloader, reinstallazione di ciascun componente, verifica dell’avvio e conclusione.",
+    "fields": [
+      {
+        "name": "Indicatore di stato",
+        "detail": "Uno degli stati <em>Ripristino in corso</em>, <em>Ripristino completato</em> o <em>Ripristino non riuscito</em>. La scheda legge lo stato ogni 2 secondi durante l’esecuzione e ogni 30 secondi dopo la fine."
+      },
+      {
+        "name": "Barra di avanzamento e contatore dei passaggi",
+        "detail": "Mostra <code>N/M steps</code> e il nome della fase corrente. Durante il ripristino, il <em>tempo stimato</em> viene calcolato dai passaggi completati e dal tempo trascorso."
+      },
+      {
+        "name": "Elenco dei componenti",
+        "detail": "Viene reinstallata una riga per driver (NVIDIA, strumenti Intel GPU, strumenti AMD, Coral TPU) con <code>installing</code> / <code>ok</code> / <code>failed</code> più un collegamento al log per-component a <code>/var/log/proxmenux/component-*.log</code>."
+      },
+      {
+        "name": "Importazione dei pool di dati",
+        "detail": "Il blocco <code>data_pools_import</code> mostra cinque righe colorate: <em>Importati</em>, <em>Forzati</em> (con <code>-f</code> per un hostid estraneo), <em>Saltati, dischi parziali</em> (solo alcuni dischi presenti), <em>Saltati, dischi assenti</em> (nessun disco presente) ed <em>Errori</em>. Lo stato è salvato in <code>/var/lib/proxmenux/restore-state.json</code> e il log completo dell’esecuzione in <code>/var/log/proxmenux/restore-datapools-&lt;timestamp&gt;.log</code>."
+      },
+      {
+        "name": "Avvisi controllo avvio",
+        "detail": "Il processo controlla le directory <code>/lib/modules/&lt;kernel&gt;</code> mancanti, la configurazione ESP assente e i collegamenti simbolici <code>/vmlinuz</code> senza destinazione. Gli avvisi appaiono qui in un riquadro colorato."
+      },
+      {
+        "name": "Delta di rollback",
+        "detail": "Elenca VM, LXC e componenti che esistono sul bersaglio, ma non sono stati nel backup ripristinato — le stesse voci sono emerse nella finestra di dialogo di rollback distruttivo pre-restore. Ogni riga porta il comando di pulizia manuale."
+      },
+      {
+        "name": "coda di log",
+        "detail": "Le ultime linee 600 di <code>proxmenux-cluster-postboot-&lt;ts&gt;.log</code>, con un filtro <em>Solo problemi</em> che mantiene solo le linee corrispondenti a <code>error</code>, <code>warning</code>, <code>failed</code>, <code>✗</code> o <code>traceback</code>."
+      }
+    ],
+    "dismissBody": "Quando il ripristino è <em>completato</em> o <em>non riuscito</em>, il pulsante Nascondi chiude la scheda. Il file di stato resta disponibile e Cronologia riapre questo ripristino e quelli precedenti. Le ultime 20 esecuzioni sono archiviate in <code>/var/lib/proxmenux/restore-history/</code>.",
+    "imageAlt": "Finestra Dettagli del ripristino in ProxMenux Monitor durante l’esecuzione: indicatore blu, fase Ricostruzione initramfs, tempo residuo stimato, barra parzialmente piena e ultime righe del log in tempo reale.",
+    "imageCaption": "Finestra Dettagli mentre il processo dopo l’avvio è ancora attivo: stato, fase corrente, tempo residuo e ultime righe del log in tempo reale.",
+    "detailsImageAlt": "La stessa finestra Dettagli al termine del ripristino, con indicatore verde Ripristino completato, durata totale 0m53s, barra piena 6/6, sezione delle differenze di rollback vuota e log dopo l’avvio archiviato.",
+    "detailsImageCaption": "Lo stesso modale una volta che l’esecuzione è terminata — il distintivo, la durata totale, la barra di avanzamento riempita e il registro postboot archiviato."
+  },
+  "postbootExample": {
+    "heading": "Che aspetto ha il post-boot sulla console",
+    "body": "Sulla console fisica, un processo terminato correttamente mostra <code>[ OK ] Finished proxmenux-apply-cluster-postboot.service</code>, spesso vicino agli <code>OK</code> di <code>multi-user.target</code> e <code>graphical.target</code>. La riga indica la fine del processo. Possono comunque essere stati registrati errori di singoli componenti o avvisi di avvio: verifica stati e log nel Monitor prima di considerare l’host completamente ripristinato.",
+    "imageAlt": "Console fisica Proxmox con '[ OK ] Finished proxmenux-apply-cluster-postboot.service - ProxMenux Apply Cluster Configs (post-boot).', seguito da OK per multi-user.target e graphical.target e dal prompt di accesso in alto.",
+    "imageCaption": "Console fisica al termine del processo. 'Finished proxmenux-apply-cluster-postboot.service' ne indica la conclusione, segnalata anche da 'Host restore finished' nel Monitor. Occorre comunque verificare risultati dei componenti e avvisi."
+  },
+  "tenMinutes": {
+    "heading": "Perché gli ultimi dieci minuti sono importanti",
+    "intro": "Il riavvio stesso richiede secondi, ma il processo dopo l’avvio passa circa dieci minuti terminando il ripristino. Durante questa finestra l'host è raggiungibile e funziona di login, ma alcuni servizi (principalmente GPU-driver-dipendenti) non sono ancora disponibili. Ripartizione del tempo per un tipico host Proxmox con NVIDIA + Coral installato:",
+    "rows": [
+      {
+        "stage": "Boot + pve-cluster pronto",
+        "time": "~30 s",
+        "detail": "Avvio standard di Proxmox. SSH, interfaccia web e accesso sono disponibili al termine della fase."
+      },
+      {
+        "stage": "Applicare /etc/pve a PMxcfs",
+        "time": "~10 s",
+        "detail": "Veloce — piccoli file di configurazione copiati uno per uno al filesystem live cluster."
+      },
+      {
+        "stage": "Ricostruire initramfs attraverso i kernel",
+        "time": "3–5 min",
+        "detail": "<code>update-initramfs -u -k all</code> ricostruisce un'immagine initramfs per kernel installato. La maggior parte dell’attesa."
+      },
+      {
+        "stage": "Ricostruisci la configurazione del bootloader",
+        "time": "10–30 s",
+        "detail": "<code>update-grub</code> o <code>proxmox-boot-tool refresh</code>. Veloce anche su ZFS."
+      },
+      {
+        "stage": "Reinstallazione del driver NVIDIA (se applicabile)",
+        "time": "5–10 min",
+        "detail": "Scarica la versione del driver registrato, compila i moduli DKMS contro il kernel corrente, applica la patch ProxMenux se la sorgente lo avesse. Il compito più lungo."
+      },
+      {
+        "stage": "Reinstallazione di Coral e degli altri componenti",
+        "time": "3–5 min",
+        "detail": "Compilazioni DKMS per Coral, apt install per intel-gpu-tools, .deb download + install per amdgpu_top."
+      },
+      {
+        "stage": "Controllo di sicurezza + notifica",
+        "time": "~2 s",
+        "detail": "Richiede poche risorse. La notifica informa l’utente appena l’esecuzione termina."
+      }
+    ],
+    "outroBody": "In questo intervallo possono mancare strumenti dopo l’accesso (<code>nvidia-smi</code> non trovato, <code>coral</code> non rilevato), perché la reinstallazione continua in background. La notifica segna la fine del processo: controlla risultati dei componenti, avvisi e log per distinguere successi ed errori individuali."
+  },
+  "destructiveRollback": {
+    "heading": "Il rollback distruttivo opzionale",
+    "body": "Il ripristino è additivo per impostazione predefinita: VM, LXC e componenti aggiuntivi restano presenti. In caso di differenze, il dialogo offre <em>Eseguire il rollback distruttivo?</em>, con No predefinito. Accettare richiama <code>_rs_execute_rollback</code> prima del riavvio per tentare di eliminare le VM e gli LXC aggiuntivi elencati. I componenti vengono segnalati per la disinstallazione manuale, perché quella automatica non è implementata. Gli errori di eliminazione vengono riportati e il processo continua: non è garantita una corrispondenza esatta. Verifica nomi e VMID/CTID prima di questa scelta distruttiva."
+  },
+  "logs": {
+    "heading": "Dove vivono i registri",
+    "rows": [
+      {
+        "log": "/var/log/proxmenux/restore-YYYYMMDD_HHMMSS.log",
+        "detail": "Scritto nella fase interattiva: risultati di compatibilità, filtro delle differenze, piano di adattamento, output dell’applicazione diretta e della preparazione differita, installazione dei pacchetti."
+      },
+      {
+        "log": "/var/log/proxmenux/apply-pending-YYYYMMDD_HHMMSS.log",
+        "detail": "Scritto da <code>apply_pending_restore.sh</code> all’inizio dell’avvio: caricamento di plan.env, elaborazione di apply-on-boot e filtro dei percorsi esclusi."
+      },
+      {
+        "log": "/var/log/proxmenux/proxmenux-cluster-postboot-YYYYMMDD_HHMMSS.log",
+        "detail": "Scritto da <code>apply_cluster_postboot.sh</code>: applicazione della configurazione pve-cluster, output di initramfs e bootloader, output degli installatori dei componenti, verifica dell’avvio e contenuto della notifica."
+      },
+      {
+        "log": "/var/log/proxmenux/component-<name>-YYYYMMDD_HHMMSS.log",
+        "detail": "Un log per componente installer (nvidia, coral, ecc.) che ha eseguito nel passaggio post-boot. Utile quando la reinstallazione di un componente specifico è fallita e l'utente ha bisogno dell'output dello strumento."
+      },
+      {
+        "log": "/var/log/proxmenux/restore-datapools-YYYYMMDD_HHMMSS.log",
+        "detail": "Scritto da <code>_rs_import_data_pools</code>. Contiene: enumerazione di non-root pools dal manifesto, per-pool esito (importato in modo pulito, importato con <code>-f</code> per hostid straniero, saltato a causa di dischi mancanti, o fallito), e l'uscita grezza di ogni <code>zpool import</code> Chiama."
+      }
+    ]
+  },
+  "whereNext": {
+    "heading": "Dove andare dopo",
+    "items": [
+      {
+        "label": "Ripristino tra kernel diversi",
+        "href": "/docs/backup-restore/cross-kernel",
+        "tail": "— il filtro safe-subset direzionale e il passaggio di idratazione invocato quando il kernel di destinazione differisce dal backup."
+      },
+      {
+        "label": "Come funziona",
+        "href": "/docs/backup-restore/how-it-works",
+        "tail": "— il layout dell'archivio, l'inventario manifesto e dell'applicazione che il ripristino consuma."
+      },
+      {
+        "label": "Lavori programmati",
+        "href": "/docs/backup-restore/scheduled-jobs",
+        "tail": " — il processo automatico che produce gli archivi usati da questo ripristino."
+      }
+    ]
+  }
+}
diff --git a/web/messages/it/docs/backup-restore/scheduled-jobs.json b/web/messages/it/docs/backup-restore/scheduled-jobs.json
new file mode 100644
index 00000000..6a851dc3
--- /dev/null
+++ b/web/messages/it/docs/backup-restore/scheduled-jobs.json
@@ -0,0 +1,152 @@
+{
+  "meta": {
+    "title": "Attività pianificate — timer, modalità di collegamento, conservazione | ProxMenux",
+    "description": "Attività pianificate di backup dell’host ProxMenux. Due modalità di creazione (timer systemd dedicato o collegamento a un’attività vzdump PVE esistente), regole di conservazione applicate per attività tramite proxmox-backup-client, Borg o pulizia locale, file in /var/lib/proxmenux/backup-jobs e script di esecuzione che produce gli stessi archivi del flusso interattivo.",
+    "ogTitle": "ProxMenux Backup — lavori programmati",
+    "ogDescription": "Backup host programmati non presidiati con modalità di aggancio, ritenzione e le stesse tre destinazioni del flusso interattivo.",
+    "twitterTitle": "Lavori programmati | ProxMenux",
+    "twitterDescription": "Attività pianificate di backup dell’host senza intervento, con modalità di collegamento e conservazione."
+  },
+  "header": {
+    "title": "Lavori programmati",
+    "description": "Lavori di backup incustoditi. Due modelli di creazione: un nuovo lavoro indipendente con il proprio programma, o un lavoro collegato ad un'attività PVE vzdump esistente che eredita il programma e la ritenzione di tale attività. Entrambi producono archivi identici al flusso interattivo.",
+    "section": "Backup e ripristino"
+  },
+  "intro": {
+    "title": "I due modelli di lavoro programmati",
+    "body": "Un lavoro programmato può essere creato seguendo uno dei due modelli:",
+    "modelsList": [
+      "<strong>Nuovo lavoro indipendente</strong> — ProxMenux definisce il programma di lavoro stesso con il proprio timer systemd, indipendente da qualsiasi altra attività sull'host. Compatibile con tutte e tre le destinazioni: Locale, PBS e Borg.",
+      "<strong>Collega a un’attività vzdump PVE esistente</strong> — l’attività non ha una pianificazione propria; viene eseguita automaticamente quando si attiva l’attività vzdump PVE principale che già esegue il backup di VM e LXC sull’host. Ne eredita pianificazione e conservazione. Compatibile con Locale e PBS (Borg non è supportato perché PVE non ha un pianificatore nativo per Borg)."
+    ]
+  },
+  "attachBadge": {
+    "title": "Modalità di aggancio — consigliato quando esiste già un compito PVE vzdump",
+    "body": "Se esiste già un’attività vzdump PVE per VM e LXC del nodo, collegare il backup dell’host lo fa eseguire dopo il backup dei guest, nello <strong>stesso ciclo di backup</strong>. Nel ripristino, le configurazioni dei guest provengono dal backup dell’host (in <code>/etc/pve</code>) e i dischi dai backup vzdump dello stesso ciclo. Questo aiuta a coordinare il recupero dell’intero nodo, ma non è uno snapshot atomico: modifiche durante il ciclo possono lasciare differenze tra configurazione dell’host e stato dei dischi dei guest."
+  },
+  "frequencyBadge": {
+    "title": "Frequenza raccomandata",
+    "body": "Per massimizzare la compatibilità tra backup dell’host e ripristino futuro, esegui backup frequenti. Più la copia è vicina allo stato attuale dell’host, meno differenze di configurazione, pacchetti e componenti dovrà riconciliare il ripristino."
+  },
+  "modes": {
+    "heading": "Le due modalità",
+    "rows": [
+      {
+        "mode": "Nuova attività pianificata",
+        "backends": "Locale, PBS, Borg",
+        "schedule": "Espressione <code>OnCalendar</code> propria (sintassi del calendario systemd, ad esempio <code>daily</code> o <code>Mon..Fri 03:00</code>).",
+        "retention": "Richiesti separatamente: <code>keep-last</code>, <code>keep-hourly</code>, <code>keep-daily</code>, <code>keep-weekly</code>, <code>keep-monthly</code>, <code>keep-yearly</code>. Applicato dallo script di esecuzione dopo ogni backup di successo."
+      },
+      {
+        "mode": "Attaccare a un lavoro PVE vzdump",
+        "backends": "Locale, PBS (Borg non ha pianificatore lato PVE)",
+        "schedule": "Ereditata dall’attività PVE principale. Non viene installato alcun timer systemd sul lato ProxMenux.",
+        "retention": "Ereditata dalla configurazione <code>prune-backups</code> dell’attività principale (mappata uno a uno alle variabili <code>KEEP_*</code> dello script di esecuzione tramite <code>hb_pve_prune_to_keep_env</code>)."
+      }
+    ]
+  },
+  "attachDetail": {
+    "heading": "Come funziona la modalità di collegamento",
+    "intro": "PVE scrive le attività <code>vzdump</code> in <code>/etc/pve/jobs.cfg</code>, con una sezione per attività che indica lo storage dei backup VM e LXC. La modalità di collegamento richiede un backend supportato da ProxMenux (Locale o PBS). Il backup dell’host parte dall’hook job-end dopo il completamento dell’attività di backup dei guest.",
+    "steps": [
+      {
+        "step": "1",
+        "detail": "Durante la creazione dell’attività, ProxMenux elenca le attività PVE genitoriali compatibili tramite <code>hb_pve_list_vzdump_jobs_for_backend</code>. L'utente ne sceglie uno."
+      },
+      {
+        "step": "2",
+        "detail": "Il file <code>.env</code> dell’attività è scritto con <code>PVE_PARENT_JOB</code>, <code>PVE_STORAGE</code> e i valori ereditati <code>KEEP_*</code>; non viene creato alcun timer systemd."
+      },
+      {
+        "step": "3",
+        "detail": "<code>hb_install_vzdump_hook</code> registra un hook in <code>/etc/vzdump.conf</code>. Nella fase job-end di qualsiasi attività vzdump confronta il <code>$STOREID</code> ricevuto con il <code>PVE_STORAGE</code> di ogni attività collegata e abilitata, avviando lo script di esecuzione per quelle corrispondenti. Il confronto usa lo storage, non l’ID dell’attività principale selezionata."
+      },
+      {
+        "step": "4",
+        "detail": "L’archivio viene salvato nello stesso storage dei backup vzdump: <code>path/dump/</code> per Locale oppure il repository PBS configurato nella voce di storage PVE."
+      }
+    ],
+    "outroBody": "La modalità di collegamento non ha un timer proprio. Disabilitare o eliminare l’attività PVE principale selezionata ferma quel trigger, ma un’altra attività vzdump sullo stesso storage può ancora avviare il backup dell’host. Per impedirlo, disabilita o elimina l’attività ProxMenux stessa. Se disabilitata, la voce resta su disco e può essere riabilitata o ricollegata."
+  },
+  "storageLayout": {
+    "heading": "File che compongono un lavoro",
+    "intro": "Ogni lavoro programmato è completamente descritto da tre o quattro file sul disco. Leggerli dà la configurazione completa del lavoro senza fare affidamento sull'interfaccia.",
+    "rows": [
+      {
+        "path": "/var/lib/proxmenux/backup-jobs/JOB_ID.env",
+        "content": "Backend, ID di backup o destinazione, pianificazione (Nuova modalità) o genitore PVE (Modalità allegato), abilitato flag, ritenzione valori <code>KEEP_*</code>, puntatori di credenziali."
+      },
+      {
+        "path": "/var/lib/proxmenux/backup-jobs/JOB_ID.paths",
+        "content": "Un percorso assoluto per riga: la selezione ricavata dal profilo e fissata alla creazione dell’attività. Modificare il file fa usare la nuova selezione alla successiva attivazione del timer."
+      },
+      {
+        "path": "/etc/systemd/system/proxmenux-backup-JOB_ID.timer + .service",
+        "content": "Solo modalità nuova attività. Il servizio invoca <code>run_scheduled_backup.sh JOB_ID</code>. Il timer lo programma con <code>Persistent=true</code> (esecuzioni saltate recuperate al prossimo avvio) e un piccolo <code>RandomizedDelaySec=120</code> per diffondere il carico quando più attività condividono la stessa espressione OnCalendar."
+      },
+      {
+        "path": "/etc/vzdump.conf script-hook",
+        "content": "Solo modalità di collegamento. Installato una volta da <code>hb_install_vzdump_hook</code>; confronta <code>PVE_STORAGE</code> di ogni attività collegata con <code>$STOREID</code>, passato da PVE allo script hook."
+      }
+    ]
+  },
+  "runner": {
+    "heading": "Cosa fa un’attività quando si avvia",
+    "intro": "Ogni lavoro — se nuovo modello o allegato — esegue la stessa sequenza a tre fasi:",
+    "steps": [
+      "<strong>Prepara il backup.</strong> Legge la configurazione del lavoro (destinazione, profilo, percorsi) e assembla l'albero dell'archivio esattamente come fa il flusso interattivo. Il risultato è lo stesso archivio un backup manuale con quelle impostazioni produrrebbe.",
+      "<strong>Scrivi nella destinazione.</strong> Carica o scrive l'archivio alla destinazione configurata — un file <code>.tar.zst</code> locale, un backup PBS o un archivio Borg — utilizzando esattamente gli stessi strumenti e le credenziali che un backup manuale alla stessa destinazione avrebbe utilizzato.",
+      "<strong>Applica la conservazione.</strong> Rimuove i vecchi backup dalla destinazione, mantenendo i conti <code>keep-last</code> / <code>keep-daily</code> / <code>keep-weekly</code> configurati sul lavoro. La potatura viene eseguita dalla destinazione stessa: PBS applica la propria ritenzione, Borg esegue <code>borg prune</code>, e per Local ProxMenux elimina i file che cadono fuori dalla finestra <code>keep-last</code>."
+    ]
+  },
+  "management": {
+    "heading": "Gestione dei lavori",
+    "intro": "Il menu scheduler (Script TUI) e la scheda Monitor Backups espongono le stesse azioni su qualsiasi lavoro.",
+    "rows": [
+      {
+        "action": "Esegui ora",
+        "detail": "Richiama subito lo script di esecuzione, senza attendere il timer o l’hook vzdump. Utile per verificare la configurazione senza aspettare la prossima esecuzione pianificata."
+      },
+      {
+        "action": "Attivare / disattivare",
+        "detail": "Nuova modalità: <code>systemctl enable/disable --now</code> il timer. Modalità di aggancio: cambia il flag <code>ENABLED</code> nel job env — lo script gancio lo onora alla prossima esecuzione PVE."
+      },
+      {
+        "action": "Modifica",
+        "detail": "Riapre le richieste di destinazione, pianificazione, profilo e ritenzione e riscrive i file di lavoro. Conserva l'ID del lavoro."
+      },
+      {
+        "action": "Elimina",
+        "detail": "Rimuove il job env, il file dei percorsi, il timer + servizio systemd (Nuova modalità), e disabilita il binding del gancio (Modalità allegato). Non tocca archivi già sulla destinazione."
+      },
+      {
+        "action": "Visualizza log",
+        "detail": "Mostra in tempo reale <code>/var/log/proxmenux/backup-jobs/JOB_ID-YYYYMMDD_HHMMSS.log</code>: un file di registro per esecuzione. Lo script di esecuzione emette anche una riga di stato compatta a journald sotto il servizio systemd."
+      }
+    ]
+  },
+  "notifications": {
+    "heading": "Notifiche",
+    "body": "Ogni esecuzione programmata genera gli stessi eventi <code>hb_notify_lifecycle</code> del flusso interattivo (<code>start</code>, <code>complete</code>, <code>fail</code>). Se i canali di notifica sono configurati nel Monitor, i lavori incustoditi mostrano i risultati come fanno i backup manuali — un utente non ha bisogno di controllare il registro per sapere se un lavoro è riuscito."
+  },
+  "whereNext": {
+    "heading": "Dove andare dopo",
+    "items": [
+      {
+        "label": "Creazione di backup",
+        "href": "/docs/backup-restore/creating-backups",
+        "tail": "— il flusso interattivo che condivide il backend con il pianificatore."
+      },
+      {
+        "label": "Destinazioni",
+        "href": "/docs/backup-restore/destinations",
+        "tail": "— configurazione per-backend utilizzata sia dal flusso interattivo che dal pianificatore."
+      },
+      {
+        "label": "Ripristino",
+        "href": "/docs/backup-restore/restoring",
+        "tail": " — il flusso che utilizza i backup prodotti dalle attività."
+      }
+    ]
+  }
+}
diff --git a/web/messages/it/docs/create-vm/index.json b/web/messages/it/docs/create-vm/index.json
new file mode 100644
index 00000000..fa3b2ca5
--- /dev/null
+++ b/web/messages/it/docs/create-vm/index.json
@@ -0,0 +1,175 @@
+{
+  "meta": {
+    "title": "Creare VM su Proxmox VE: assistenti Synology, Windows, Linux e NAS | ProxMenux",
+    "description": "Crea e configura VM su Proxmox VE con ProxMenux. Procedure guidate per NAS (Synology DSM, TrueNAS, OpenMediaVault, XigmaNAS, ecc.), Windows, distribuzioni Linux e un installatore macOS esterno. Impostazioni adatte per hardware, storage e rete.",
+    "ogTitle": "Creare VM su Proxmox VE: assistenti Synology, Windows, Linux e NAS",
+    "ogDescription": "Procedure guidate ProxMenux per creare VM Synology DSM, TrueNAS, OMV, XigmaNAS, Windows e Linux su Proxmox VE.",
+    "ogImageAlt": "Menu Crea VM di ProxMenux",
+    "twitterTitle": "Creare VM su Proxmox VE | ProxMenux",
+    "twitterDescription": "Procedure guidate per VM Synology, TrueNAS, OMV, XigmaNAS, Windows e Linux su Proxmox VE."
+  },
+  "header": {
+    "title": "Creare VM",
+    "description": "ProxMenux riunisce la creazione delle VM in un menu interattivo. Scegli la famiglia del sistema operativo e la procedura corrispondente gestisce ISO, CPU, RAM, BIOS, rete, storage e, facoltativamente, passthrough GPU.",
+    "section": "Macchine virtuali"
+  },
+  "intro": {
+    "title": "A cosa serve questo menu",
+    "body": "Il menu Crea VM indirizza a più procedure guidate. Chiede la famiglia del sistema operativo e carica selettore ISO e configuratore adatti. Il percorso predefinito usa impostazioni ragionevoli; quello avanzato mostra tutte le opzioni disponibili prima della creazione."
+  },
+  "opening": {
+    "heading": "Apertura del menu",
+    "body": "Nel menu principale di ProxMenux seleziona <strong>Crea VM</strong>. Vedrai:",
+    "imageAlt": "Menu Crea VM con tre opzioni ProxMenux (NAS/Windows/Linux) e la sezione Community Scripts sotto (macOS/Altri)"
+  },
+  "families": {
+    "heading": "Tre famiglie OS",
+    "intro": "Le tre voci ProxMenux nella parte superiore del menu condividono lo stesso motore sottostante e il flusso post-ISO — si indirizzano a diversi selettori ISO e applicano i default sintonizzati per ogni famiglia. Scegli quello che corrisponde all'ospite che vuoi installare.",
+    "routes": [
+      {
+        "key": "nas",
+        "title": "Sistema NAS",
+        "icon": "HardDrive",
+        "href": "/docs/create-vm/system-nas",
+        "accent": "border-emerald-300 bg-emerald-50",
+        "iconBg": "bg-emerald-100 text-emerald-700",
+        "description": "Otto sistemi NAS come VM dedicate. La maggior parte usa il flusso ISO automatico; Synology DSM ha una procedura specializzata con loader.",
+        "bullets": [
+          "Synology DSM (Arc / RR / Alpine RedPill M-shell caricatori)",
+          "TrueNAS SCALE e CORE (ZFS)",
+          "OpenMediaVault (basato su Debian)",
+          "XigmaNAS (FreeBSD ZFS)",
+          "Rockstor (openSUSE / Btrfs), ZimaOS, FygoOS"
+        ]
+      },
+      {
+        "key": "windows",
+        "title": "Sistema Windows",
+        "icon": "MonitorCog",
+        "href": "/docs/create-vm/system-windows",
+        "accent": "border-blue-300 bg-blue-50",
+        "iconBg": "bg-blue-100 text-blue-700",
+        "description": "Edizioni Windows 10, 11 e Server con default Windows (q35 + OVMF + TPM 2.0) e driver VirtIO pre-montati.",
+        "bullets": [
+          "UUP Dump per le ISO aggiornate",
+          "O ISO locale da /var/lib/vz/template/iso",
+          "TPM 2.0 aggiunto automaticamente",
+          "ISO dei driver VirtIO collegata a ide3",
+          "Canale agente ospite abilitato"
+        ]
+      },
+      {
+        "key": "linux",
+        "title": "Sistema Linux",
+        "icon": "Laptop",
+        "href": "/docs/create-vm/system-linux",
+        "accent": "border-amber-300 bg-amber-50",
+        "iconBg": "bg-amber-100 text-amber-700",
+        "description": "Catalogo selezionato di ISO Linux ufficiali scaricate automaticamente dai progetti originali, più un selettore di ISO locali per le altre immagini.",
+        "bullets": [
+          "Ubuntu (Desktop / Server, 20.04–25.10)",
+          "Debian (Desktop / Netinst, 11–13)",
+          "Fedora, Arch, Rocky, Mint, openSUSE",
+          "Alpine, Kali, Manjaro",
+          "Percorso ISO locale per immagini personalizzate"
+        ]
+      }
+    ]
+  },
+  "community": {
+    "title": "Script della comunità (non documentati qui)",
+    "intro": "Le due voci sotto il separatore <em>Community Scripts</em> eseguono codice che <strong>non fa parte di ProxMenux</strong>, quindi sono volutamente escluse da questa documentazione:",
+    "macosRich": "<strong>Sistema macOS</strong>: esegue l’installatore esterno <osxLink>OSX-PROXMOX</osxLink>. Clona il repository originale, prepara l’host e <strong>lo riavvia automaticamente al termine</strong>. Consulta la documentazione del progetto.",
+    "othersRich": "<strong>Altri sistemi (basati su Linux)</strong>: carica una selezione di installatori della comunità per server domestici, router, firewall e simili. Ogni script viene mantenuto fuori da ProxMenux."
+  },
+  "afterPick": {
+    "heading": "Cosa succede dopo aver scelto un sistema operativo",
+    "intro": "Dopo la scelta dell’ISO, il menu segue lo stesso percorso per ogni famiglia di sistemi:",
+    "items": [
+      "<strong>Predefinito o avanzato.</strong> Un dialogo consente di accettare le impostazioni ProxMenux o aprire il configuratore completo: modello e core CPU, RAM, BIOS/UEFI, scheda di rete e tipo di macchina.",
+      "<strong>Piano di archiviazione.</strong> Combina dischi virtuali, importati e dispositivi PCI passthrough come interi controller o NVMe nella stessa VM.",
+      "<strong>Passthrough GPU facoltativo.</strong> Se viene rilevata una GPU compatibile, ProxMenux propone l’assistente GPU dopo la creazione della VM. Può servire un riavvio.",
+      "<strong>Creazione della VM.</strong> La VM viene creata, taggata e dotata di una descrizione HTML formattata per consultarla nell’interfaccia Proxmox."
+    ],
+    "tipTitle": "Preferisci Advanced per le VM che intendi mantenere",
+    "tipBody": "Preimpostazioni predefinite funzionano bene per i test rapidi. Per un VM si intende mantenere, il percorso Avanzato consente di prendere il giusto BIOS (SeaBIOS vs OVMF/UEFI), tipo di macchina (<code>i440fx</code> vs <code>q35</code>) e controller disco (VirtIO SCSI singolo vs SATA) davanti — questi sono dolorosi di cambiare in seguito."
+  },
+  "scripts": {
+    "heading": "Scripts coinvolti",
+    "intro": "Il menu carica tramite source vari script condivisi senza una pagina dedicata. Sono elencati qui come riferimento. Ogni sottopagina collega lo script principale della propria procedura.",
+    "headerScript": "Script",
+    "headerRole": "Ruolo",
+    "rows": [
+      {
+        "path": "menus/create_vm_menu.sh",
+        "role": "Punto di ingresso e instradamento."
+      },
+      {
+        "path": "vm/select_nas_iso.sh",
+        "role": "Selettore ISO e sistemi NAS (Synology, TrueNAS, OMV, Rockstor, XigmaNAS, ZimaOS, FygoOS)."
+      },
+      {
+        "path": "vm/select_windows_iso.sh",
+        "role": "Selettore ISO Windows. Delega al costruttore UUP Dump quando necessario."
+      },
+      {
+        "path": "vm/select_linux_iso.sh",
+        "role": "Selettore ISO Linux per il flusso Linux (distribuzioni mainstream)."
+      },
+      {
+        "path": "vm/synology.sh",
+        "role": "Procedura Synology DSM: scarica loader e immagine DSM e prepara il profilo della VM."
+      },
+      {
+        "path": "vm/zimaos.sh",
+        "role": "Flusso ZimaOS: scarica l'immagine e la collega nella definizione VM."
+      },
+      {
+        "path": "vm/vm_configurator.sh",
+        "role": "Default vs Advanced wizard: modello/core CPU, RAM, BIOS, NIC, tipo di macchina."
+      },
+      {
+        "path": "vm/disk_selector.sh",
+        "role": "Piano di stoccaggio: disco virtuale, importazione disco, o passaggio Controller/NVMe."
+      },
+      {
+        "path": "vm/vm_creator.sh",
+        "role": "Creazione finale VM: applica la configurazione, allega lo storage, scrive la descrizione HTML."
+      },
+      {
+        "path": "vm/guest_agent_config.sh",
+        "role": "aggancio opzionale QEMU agente ospite, utilizzato da diversi flussi."
+      }
+    ]
+  },
+  "related": {
+    "heading": "Correlati",
+    "items": [
+      {
+        "href": "/docs/disk-manager",
+        "label": "Gestione disco",
+        "tail": "— allegare dischi fisici esistenti o importare immagini disco nelle VM."
+      },
+      {
+        "href": "/docs/utils/UUp-Dump-ISO-Creator",
+        "label": "Creatore di ISO UUP Dump",
+        "tail": " — crea ISO di installazione Windows pronte come supporto di avvio."
+      },
+      {
+        "href": "/docs/utils/import-vm",
+        "label": "Importa VM da OVA / OVF",
+        "tail": "— portare le VM pre-costruite dalle esportazioni VMware / VirtualBox / ProxMenux."
+      },
+      {
+        "href": "/docs/hardware/gpu-vm-passthrough",
+        "label": "Aggiungi GPU a VM (Passthrough)",
+        "tail": "— passare un GPU in un VM appena creato."
+      },
+      {
+        "href": "/docs/help-info/vm-ct-commands",
+        "label": "Comandi di gestione VM e CT",
+        "tail": "— riferimento qm per il lato CLI."
+      }
+    ]
+  }
+}
diff --git a/web/messages/it/docs/create-vm/synology.json b/web/messages/it/docs/create-vm/synology.json
new file mode 100644
index 00000000..910a194e
--- /dev/null
+++ b/web/messages/it/docs/create-vm/synology.json
@@ -0,0 +1,453 @@
+{
+  "title": "Script per creare una VM Synology",
+  "stepLabel": "Passaggio",
+  "intro": {
+    "heading": "Introduzione",
+    "intro": "ProxMenux fornisce uno script automatizzato che crea e configura una macchina virtuale (VM) per installare Synology DSM (DiskStation Manager) su Proxmox VE. Questo script semplifica il processo scaricando e aggiungendo uno dei caricatori disponibili al boot VM, dando l'opzione tra quattro diverse scelte:",
+    "loaders": [
+      {
+        "name": "AuxXxilium Arc",
+        "url": "https://github.com/AuxXxilium/arc",
+        "extra": ""
+      },
+      {
+        "name": "RedPill RR",
+        "url": "https://github.com/RROrg/rr",
+        "extra": ""
+      },
+      {
+        "name": "Alpine RedPill M-shell (progetto TinyCore)",
+        "url": "https://github.com/PeterSuh-Q3/tinycore-redpill",
+        "extra": ""
+      }
+    ],
+    "customLoader": "Custom Loader – opzione per utilizzare un caricatore personalizzato se si preferisce modificare o creare la propria configurazione",
+    "simplifiesIntro": "Lo script semplifica il processo di creazione VM offrendo le seguenti opzioni:",
+    "simplifies": [
+      "Selezione di configurazione predefinita o avanzata",
+      "Configurazione di CPU, RAM, BIOS, e tipo di macchina",
+      "Scelta tra disco virtuale o passaggio del disco fisico"
+    ]
+  },
+  "config": {
+    "heading": "Configurazione predefinita e avanzata",
+    "intro": "Lo script offre due modalità di configurazione:",
+    "defaultHeading": "Configurazione predefinita",
+    "defaultIntro": "Se si seleziona la configurazione predefinita, lo script applicherà automaticamente i seguenti valori:",
+    "headerParam": "Parametro",
+    "headerValue": "Valore predefinito",
+    "defaultRows": [
+      {
+        "param": "Tipo macchina",
+        "value": "q35"
+      },
+      {
+        "param": "Tipo BIOS",
+        "value": "OVMF (UEFI)"
+      },
+      {
+        "param": "Tipo CPU",
+        "value": "Host"
+      },
+      {
+        "param": "Numero di core",
+        "value": "2"
+      },
+      {
+        "param": "Dimensione RAM",
+        "value": "4096 MB"
+      },
+      {
+        "param": "Ponte",
+        "value": "vmbr0"
+      },
+      {
+        "param": "Indirizzo MAC",
+        "value": "Generazione automatica"
+      },
+      {
+        "param": "Avvia la VM al termine",
+        "value": "No"
+      }
+    ],
+    "defaultOutro": "Se si desidera personalizzare la configurazione, selezionare l'opzione Impostazioni avanzate nel menu.",
+    "advancedHeading": "Configurazione avanzata",
+    "advancedIntro": "Se si seleziona la configurazione avanzata, lo script vi permetterà di personalizzare ogni parametro:",
+    "headerOptions": "Opzioni",
+    "advancedRows": [
+      {
+        "param": "Tipo macchina",
+        "options": "q35 o i440fx"
+      },
+      {
+        "param": "Tipo BIOS",
+        "options": "OVMF (UEFI) o SeaBIOS (Legacy)"
+      },
+      {
+        "param": "Tipo CPU",
+        "options": "Host o KVM64"
+      },
+      {
+        "param": "Numero di core",
+        "options": "Numero di core CPU"
+      },
+      {
+        "param": "Dimensione RAM",
+        "options": "Quantità di memoria assegnata alla VM"
+      },
+      {
+        "param": "Ponte",
+        "options": "Ponte di rete per il collegamento"
+      },
+      {
+        "param": "Indirizzo MAC",
+        "options": "Indirizzo MAC personalizzato"
+      },
+      {
+        "param": "VLAN",
+        "options": "VLAN tag (se usato)"
+      },
+      {
+        "param": "MTU",
+        "options": "Dimensione massima dell'unità di trasmissione"
+      }
+    ]
+  },
+  "diskSelection": {
+    "heading": "Selezione disco",
+    "intro": "Il piano di archiviazione permette di aggiungere dischi virtuali, dischi fisici e controller PCI o dispositivi NVMe. Le opzioni dei dischi sono illustrate di seguito.",
+    "virtualHeading": "Disco virtuale",
+    "virtualItems": [
+      "Lo script elenca le opzioni di archiviazione disponibili in Proxmox",
+      "L'utente seleziona il disco e le dimensioni in GB",
+      "I dischi virtuali vengono collegati come <strong>SATA</strong> (sata0, sata1, ecc.). I dischi dati virtuali e fisici condividono le sei posizioni SATA numerate da 0 a 5; il loader usa una posizione IDE separata."
+    ],
+    "physicalHeading": "Passaggio del disco fisico",
+    "physicalItems": [
+      "Lo script rileva tutti i dischi fisici disponibili",
+      "L'utente seleziona il disco fisico o i dischi che desidera utilizzare.",
+      "I dischi fisici vengono collegati come dispositivi <strong>SATA</strong>. Condividono le sei posizioni SATA numerate da 0 a 5 con i dischi dati virtuali; non ci sono altre sei posizioni riservate ai dischi fisici."
+    ]
+  },
+  "loaderInstall": {
+    "heading": "Installazione Loader",
+    "intro1": "Lo script scarica automaticamente ed estrae il caricatore dal repository dello sviluppatore. Se il download fallisce, lo script visualizzerà un messaggio di errore.",
+    "intro2Rich": "<strong>AuxXxilium Arc</strong>, <strong>RedPill RR</strong> e <strong>Alpine RedPill M-shell</strong> vengono scaricati ed estratti automaticamente.",
+    "customRich": "Per <strong>Custom Loader</strong>, lo script cerca i file in <code>/var/lib/vz/template/iso</code>. Se si trovano più file, verrà richiesto di selezionare il file desiderato.",
+    "uploadIntro": "È possibile caricare caricatori personalizzati dalle opzioni di archiviazione locali:",
+    "imageAlt": "Aggiungi Loader personalizzato",
+    "imageCaption": "Aggiungi Loader personalizzato"
+  },
+  "vmCreation": {
+    "heading": "Creazione della VM",
+    "intro": "Una volta scaricato il caricatore, lo script crea il VM utilizzando i seguenti comandi:",
+    "items": [
+      "<code>qm create</code> – Crea la macchina virtuale con i parametri configurati",
+      "<code>qm importdisk</code> importa l’immagine del loader nello storage Proxmox. Lo script la collega poi alla VM come ide0 per compatibilità.",
+      "<code>qm set</code> – Assegna valori di configurazione come CPU, RAM, e storage",
+      "<code>qm set VMID --boot order=ide0</code> imposta il loader come dispositivo di avvio. Sostituisci VMID con l’ID della VM."
+    ]
+  },
+  "stepGuide": {
+    "heading": "Guida di configurazione del boot Loader passo-passo",
+    "intro": "Ogni loader ha menu e metodi di configurazione propri. I sei passaggi seguenti spiegano il processo comune; segui le indicazioni del loader attuale se differiscono. Le schermate M-shell mostrano una precedente interfaccia TinyCore, mentre lo script attuale scarica Alpine RedPill M-shell.",
+    "selectorHeading": "Seleziona il tipo di loader:",
+    "loaderButtons": {
+      "arc": "Arc Loader",
+      "rr": "RR Loader",
+      "tinycore": "TinyCore Loader"
+    }
+  },
+  "steps": [
+    {
+      "id": "step1",
+      "title": "Avvia la VM e accedi al menu principale",
+      "intro": "Dopo aver creato la VM, avviala. Al primo avvio si apre il menu principale del loader per scegliere e configurare il modello DSM. Dopo la creazione del loader, questo passaggio viene saltato salvo una riconfigurazione forzata dal menu di avvio. Tutti i loader offrono anche una configurazione tramite interfaccia web.",
+      "loaders": {
+        "arc": [
+          {
+            "htmlBefore": "<strong>Interfaccia web</strong>: apri un browser e inserisci l’indirizzo IP mostrato nella console della VM. Nel nostro esempio: http://192.169.0.32.",
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/arc/arc_1_0_1.png",
+            "alt": "Interfaccia web di Arc Loader",
+            "caption": "Interfaccia web di Arc Loader"
+          },
+          {
+            "htmlBefore": "<strong>Interfaccia terminale</strong>: accedi direttamente dalla console della VM.",
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/arc/arc_1_1_1.png",
+            "alt": "Interfaccia del terminale di Arc Loader",
+            "caption": "Interfaccia del terminale di Arc Loader"
+          }
+        ],
+        "rr": [
+          {
+            "htmlBefore": "<strong>Interfaccia web</strong>: apri un browser e inserisci l’indirizzo IP mostrato nella console della VM, seguito dalla porta <strong>7681</strong>. Nel nostro esempio: <code>http://192.169.0.33:7681</code>.",
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/rr/rr_2_0_2.png",
+            "alt": "Esempio di comando RR",
+            "caption": "Interfaccia web RR Loader"
+          },
+          {
+            "htmlBefore": "<strong>Interfaccia terminale</strong>: digita <strong>menu.sh</strong> nella console della VM per aprirla.",
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/rr/rr_2_1_1.png",
+            "alt": "Interfaccia RR Loader",
+            "caption": "Interfaccia RR Loader Terminal"
+          }
+        ],
+        "tinycore": [
+          {
+            "htmlBefore": "<strong>Interfaccia web</strong>: apri un browser e inserisci l’indirizzo IP mostrato nella console della VM, seguito dalla porta <strong>7681</strong>. Nel nostro esempio: <code>http://192.169.0.35:7681</code>.",
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/tinycore/tinycore_3_0_1.png",
+            "alt": "Interfaccia di TinyCore Loader",
+            "caption": "Interfaccia web di Loader di TinyCore"
+          },
+          {
+            "htmlBefore": "<strong>Interfaccia terminale</strong>: accedi direttamente dalla console della VM. Osserva lo schermo: potrebbe chiederti di premere un tasto per continuare o di cambiare lingua.",
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/tinycore/tinycore_3_1_1.png",
+            "alt": "Interfaccia di TinyCore Loader",
+            "caption": "Interfaccia terminale di TinyCore Loader"
+          }
+        ]
+      }
+    },
+    {
+      "id": "step2",
+      "title": "Selezionare il modello",
+      "intro": "Dopo aver caricato il menu, selezionare il modello Synology DSM che si desidera installare. A seconda del caricatore, a volte è necessario espandere le opzioni per vedere più modelli.",
+      "outro": "Nel nostro esempio, sceglieremo il modello SA6400.",
+      "loaders": {
+        "arc": [
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/arc/arc_1_2_1.png",
+            "alt": "Selezione del modello in Arc",
+            "caption": "Selezione del modello in Arc"
+          }
+        ],
+        "rr": [
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/rr/rr_2_2_1.png",
+            "alt": "Selezione modello RR",
+            "caption": "Selezione modello RR"
+          }
+        ],
+        "tinycore": [
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/tinycore/tinycore_3_2_1.png",
+            "alt": "Selezione modello TinyCore",
+            "caption": "Selezione modello TinyCore"
+          }
+        ]
+      }
+    },
+    {
+      "id": "step3",
+      "title": "Selezionare la versione DSM",
+      "intro": "Dopo aver selezionato il modello, è necessario scegliere la versione DSM che si desidera installare.",
+      "loaders": {
+        "arc": [
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/arc/arc_1_3_1.png",
+            "alt": "Selezione versione Arc - Passo 1",
+            "caption": "Selezione versione Arc - Passo 1"
+          },
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/arc/arc_1_3_2.png",
+            "alt": "Selezione versione Arc - Passo 2",
+            "caption": "Selezione versione Arc - Passo 2"
+          }
+        ],
+        "rr": [
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/rr/rr_2_3_1.png",
+            "alt": "Selezione versione RR - Passo 1",
+            "caption": "Selezione versione RR - Passo 1"
+          },
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/rr/rr_2_3_2.png",
+            "alt": "Selezione versione RR - Passo 2",
+            "caption": "Selezione versione RR - Passo 2"
+          },
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/rr/rr_2_3_3.png",
+            "alt": "Selezione versione RR - Passo 3",
+            "caption": "Selezione versione RR - Passo 3"
+          }
+        ],
+        "tinycore": [
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/tinycore/tinycore_3_3_1.png",
+            "alt": "Selezione versione TinyCore - Passo 1",
+            "caption": "Selezione versione TinyCore - Passo 1"
+          },
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/tinycore/tinycore_3_3_2.png",
+            "alt": "Selezione versione TinyCore - Passo 2",
+            "caption": "Selezione versione TinyCore - Passo 2"
+          }
+        ]
+      }
+    },
+    {
+      "id": "step4",
+      "title": "Selezionare Addons",
+      "intro": "Questo passaggio consente di aggiungere funzionalità aggiuntive o configurazioni personalizzate al caricatore.",
+      "loaders": {
+        "arc": [
+          {
+            "htmlBefore": "<strong>Arc</strong> consente di configurare automaticamente o manualmente le impostazioni. Se viene selezionata la configurazione automatica, il caricatore inizierà ad applicare le impostazioni necessarie e riavvierà automaticamente una volta che il processo sarà completato.",
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/arc/arc_1_4_1.png",
+            "alt": "Configurazione automatica di Arc",
+            "caption": "Configurazione automatica di Arc"
+          },
+          {
+            "htmlBefore": "Se scegliamo di non usare la modalità automatica, entriamo nel menu per configurare diverse opzioni necessarie per il caricatore:",
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/arc/arc_1_4_2.png",
+            "alt": "Configurazione manuale di Arc",
+            "caption": "Configurazione manuale di Arc"
+          },
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/arc/arc_1_4_3.png",
+            "alt": "Configurazione Arc SN/Mac",
+            "caption": "Configurazione Arc SN/Mac"
+          },
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/arc/arc_1_4_4.png",
+            "alt": "Arc Sata Portmap",
+            "caption": "Arc Sata Portmap (usare l'opzione consigliata)"
+          },
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/arc/arc_1_4_5.png",
+            "alt": "Selezione dei componenti aggiuntivi in Arc",
+            "caption": "Selezione dei componenti aggiuntivi in Arc"
+          }
+        ],
+        "rr": [
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/rr/rr_2_4_1.png",
+            "alt": "RR Addon passo 1",
+            "caption": "RR Addon passo 1"
+          },
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/rr/rr_2_4_2.png",
+            "alt": "RR Addon passo 2",
+            "caption": "Componente aggiuntivo RR — passo 2: fai clic per aggiungerlo."
+          },
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/rr/rr_2_4_3.png",
+            "alt": "RR Addon passo 3",
+            "caption": "Componente aggiuntivo RR — passo 3: fai clic su quello desiderato. Per aggiungerne altri, ripeti le operazioni delle immagini 2.4.2 e 2.4.3."
+          }
+        ],
+        "tinycore": [
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/tinycore/tinycore_3_4_1.png",
+            "alt": "Configurazione TinyCore SN",
+            "caption": "Configurazione TinyCore SN"
+          },
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/tinycore/tinycore_3_4_2.png",
+            "alt": "TinyCore Opzione casuale",
+            "caption": "TinyCore Opzione casuale - Si raccomanda l'opzione casuale"
+          },
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/tinycore/tinycore_3_4_3.png",
+            "alt": "Configurazione MAC TinyCore",
+            "caption": "Configurazione MAC TinyCore"
+          },
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/tinycore/tinycore_3_4_4.png",
+            "alt": "TinyCore VM MAC",
+            "caption": "TinyCore VM MAC - Scegli di utilizzare il MAC di VM o uno casuale"
+          }
+        ]
+      }
+    },
+    {
+      "id": "step5",
+      "title": "Costruisci il Loader",
+      "intro": "Una volta selezionato il modello, la versione DSM e gli addons, procedere alla costruzione del caricatore. Questo processo potrebbe richiedere alcuni minuti a seconda del caricatore e della configurazione selezionata. Per iniziare, selezionare l'opzione \"Build the Loader\".",
+      "loaders": {
+        "arc": [
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/arc/arc_1_5_1.png",
+            "alt": "Creazione del loader in Arc",
+            "caption": "Creazione del loader in Arc"
+          }
+        ],
+        "rr": [
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/rr/rr_2_5_1.png",
+            "alt": "Creazione del loader in RR",
+            "caption": "Creazione del loader in RR"
+          }
+        ],
+        "tinycore": [
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/tinycore/tinycore_3_5_1.png",
+            "alt": "Creazione del loader in TinyCore",
+            "caption": "Creazione del loader in TinyCore"
+          }
+        ]
+      }
+    },
+    {
+      "id": "step6",
+      "title": "Avvia il loader",
+      "intro": "Una volta che il caricatore è stato costruito, ti chiederà di avviare. Il VM riavvia con la configurazione che hai creato e avvia l'installazione DSM.",
+      "loaders": {
+        "arc": [
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/arc/arc_1_6_1.png",
+            "alt": "Avvio del loader in Arc",
+            "caption": "Avvio del loader in Arc"
+          }
+        ],
+        "rr": [
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/rr/rr_2_6_1.png",
+            "alt": "Avvio del loader in RR",
+            "caption": "Avvio del loader in RR"
+          }
+        ],
+        "tinycore": [
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/tinycore/tinycore_3_6_1.png",
+            "alt": "Avvio del loader in TinyCore",
+            "caption": "Avvio del loader in TinyCore"
+          }
+        ]
+      }
+    }
+  ],
+  "dsmInstall": {
+    "heading": "Avvio dell'installazione DSM",
+    "intro": "Una volta avviato il caricatore, è possibile trovare il dispositivo Synology utilizzando:",
+    "afterCode": "Segui i passaggi sullo schermo per completare l'installazione di DSM.",
+    "setupAlt": "Configurazione di DSM",
+    "setupCaption": "Schermata di configurazione DSM",
+    "patience": "Si prega di essere paziente – Il processo può richiedere alcuni minuti per completare. La percentuale di progresso si aggiornerà automaticamente mentre la configurazione progredisce. Un conto alla rovescia inizierà una volta che l'installazione si sta avvicinando al completamento.",
+    "finishAlt": "Installazione completata",
+    "finishCaption": "Installazione completata"
+  },
+  "tips": {
+    "heading": "Consigli",
+    "introItem": "Tenete a mente che le opzioni disponibili possono cambiare a seconda della versione del caricatore e degli aggiornamenti dello sviluppatore. Se incontri problemi durante il processo di creazione del caricatore, consulta la documentazione del caricatore:",
+    "docLinks": [
+      {
+        "label": "Documentazione Arc",
+        "url": "https://github.com/AuxXxilium/arc"
+      },
+      {
+        "label": "Documentazione RR",
+        "url": "https://github.com/RROrg/rr"
+      },
+      {
+        "label": "Documentazione TinyCore",
+        "url": "https://github.com/PeterSuh-Q3/tinycore-redpill"
+      }
+    ],
+    "olderModels": "Alcuni modelli DSM vecchi possono avere problemi di riconoscimento dei dischi o della scheda di rete. Si consiglia di utilizzare modelli più recenti.",
+    "updateLabel": "Aggiornamento:",
+    "updateBody": "Alcuni caricatori offrono la possibilità di aggiornare il caricatore direttamente dal menu.",
+    "importantLabel": "Importante:",
+    "importantBody": "ProxMenux non fornisce supporto per i diversi caricatori."
+  }
+}
diff --git a/web/messages/it/docs/create-vm/system-linux.json b/web/messages/it/docs/create-vm/system-linux.json
new file mode 100644
index 00000000..455f9598
--- /dev/null
+++ b/web/messages/it/docs/create-vm/system-linux.json
@@ -0,0 +1,292 @@
+{
+  "meta": {
+    "title": "Crea VM: sistema Linux | Documentazione ProxMenux",
+    "description": "Crea macchine virtuali Linux su Proxmox VE con ProxMenux. La guida descrive il catalogo di ISO ufficiali (Ubuntu, Debian, Fedora, Arch, Rocky, Mint, openSUSE, Alpine, Kali, Manjaro), il piano di archiviazione comune, il passthrough GPU facoltativo e i consigli dopo l’installazione.",
+    "ogTitle": "Crea VM: sistema Linux | Documentazione ProxMenux",
+    "ogDescription": "Crea VM Linux su Proxmox VE: catalogo di ISO ufficiali, archiviazione, passthrough GPU e consigli dopo l’installazione.",
+    "ogImageAlt": "Menu ProxMenux Linux VM"
+  },
+  "header": {
+    "title": "Crea VM: sistema Linux",
+    "description": "Crea una VM Linux su Proxmox VE. ProxMenux offre un catalogo di ISO Linux ufficiali da scaricare e un selettore di ISO locali. Tutti i percorsi usano la procedura guidata VM comune, il piano di archiviazione e l’assistente facoltativo per il passthrough GPU.",
+    "section": "Macchine virtuali"
+  },
+  "intro": {
+    "title": "Cosa fa questo script",
+    "body": "Scegli una ISO Linux ufficiale da scaricare automaticamente o una ISO locale già caricata. La procedura guidata comune passa quindi per CPU, RAM e BIOS, piano di archiviazione, passthrough GPU facoltativo e creazione della VM."
+  },
+  "image": {
+    "alt": "Opzioni di installazione ProxMenux Linux",
+    "caption": "Opzioni di installazione Linux"
+  },
+  "config": {
+    "heading": "Configurazione predefinita vs Avanzata",
+    "intro": "Dopo la selezione dell'ISO, ProxMenux chiede se utilizzare il profilo predefinito VM o aprire la procedura guidata avanzata.",
+    "defaultHeading": "Configurazione predefinita",
+    "headerParam": "Parametro",
+    "headerValue": "Valore predefinito",
+    "defaultRows": [
+      {
+        "param": "Tipo di macchina",
+        "valueRich": "<code>q35</code>"
+      },
+      {
+        "param": "BIOS",
+        "value": "OVMF (UEFI)"
+      },
+      {
+        "param": "Tipo di CPU",
+        "value": "Host"
+      },
+      {
+        "param": "Core",
+        "value": "2"
+      },
+      {
+        "param": "RAM",
+        "value": "4096 MB"
+      },
+      {
+        "param": "Ponte",
+        "valueRich": "<code>vmbr0</code>"
+      },
+      {
+        "param": "Indirizzo MAC",
+        "value": "Autogenerata"
+      },
+      {
+        "param": "Avvia al termine",
+        "value": "No"
+      }
+    ],
+    "advancedHeading": "Configurazione avanzata",
+    "advancedIntro": "La procedura guidata avanzata espone ogni parametro singolarmente:",
+    "headerOptions": "Opzioni",
+    "advancedRows": [
+      {
+        "param": "Tipo di macchina",
+        "optionsRich": "<code>q35</code> o <code>i440fx</code>"
+      },
+      {
+        "param": "BIOS",
+        "options": "OVMF (UEFI) o SeaBIOS (Legacy)"
+      },
+      {
+        "param": "Tipo di CPU",
+        "options": "Host, KVM64 e altri modelli CPU elencati"
+      },
+      {
+        "param": "Core",
+        "options": "Numero di core CPU"
+      },
+      {
+        "param": "RAM",
+        "options": "Memoria assegnata al VM"
+      },
+      {
+        "param": "Ponte",
+        "options": "Bridge di rete"
+      },
+      {
+        "param": "Indirizzo MAC",
+        "options": "MAC personalizzato"
+      },
+      {
+        "param": "VLAN",
+        "options": "Tag VLAN (opzionale)"
+      },
+      {
+        "param": "MTU",
+        "options": "MTU misura"
+      }
+    ]
+  },
+  "storagePlan": {
+    "heading": "Piano di archiviazione",
+    "body": "Dopo CPU / RAM, ProxMenux apre il menu <strong>Storage Plan</strong>, dove è possibile combinare dischi virtuali, dischi importati e dispositivi passanti PCI nello stesso VM, aggiungendo elementi uno alla volta e terminando quando si è fatto.",
+    "virtualDiskTitle": "a. Aggiungere disco virtuale",
+    "virtualDiskItems": [
+      "Elenca i volumi di archiviazione Proxmox disponibili sull'host.",
+      "Scegli lo storage di destinazione e la dimensione in GB.",
+      "Il disco usa il bus scelto: SCSI (predefinito), SATA, VirtIO o IDE. SATA offre sei posizioni numerate da 0 a 5: <code>sata0</code>, <code>sata1</code>, …."
+    ],
+    "importDiskTitle": "b. Aggiungere disco di importazione",
+    "importDiskItems": [
+      "Rileva i dischi fisici che sono sicuri da importare (sistema e dischi protetti sono nascosti).",
+      "Seleziona uno o più dischi tramite una lista di controllo.",
+      "I dischi importati usano il bus scelto e vengono collegati tramite <code>qm set</code>."
+    ],
+    "pciTitle": "C. Aggiungi controller o NVMe (passthrough PCI)",
+    "pciItems": [
+      "Rileva HBA SATA/SAS e dispositivi NVMe e consente di assegnare un <em>intero controller</em> alla VM. IOMMU deve essere attivo; lo script propone l’attivazione e un riavvio se necessario.",
+      "Un passo di conferma avverte il rischio a livello del controller (l'intera carta, compreso ogni disco su di esso, lascia l'host).",
+      "I dispositivi PCI vengono assegnati con comandi come <code>qm set VMID --hostpci0 PCI_ADDRESS,pcie=1</code>. Sostituisci VMID e PCI_ADDRESS con ID della VM e indirizzo PCI e usa un indice hostpci libero per ogni dispositivo."
+    ],
+    "resetTitle": "Azzera e termina",
+    "resetBody": "Il menu offre anche <strong>r</strong> (riimpostare la selezione attuale e ricominciare da capo) e <strong>d</strong> (finire e continuare). Non puoi finire con un piano vuoto."
+  },
+  "gpu": {
+    "heading": "Passaggio opzionale GPU",
+    "body": "Dopo il piano di archiviazione, se viene rilevato un GPU compatibile sull'host ProxMenux offre di lanciare l'assistente passthrough GPU. Vedere <gpuLink>Add GPU a un VM (Passthrough)</gpuLink> per come funziona l'assistente - un riavvio host può essere richiesto."
+  },
+  "autoFeatures": {
+    "heading": "Caratteristiche automatiche VM",
+    "efiTitle": "Disco EFI",
+    "efiBody": "Quando scegli OVMF (UEFI), ProxMenux crea un disco EFI da 4 MB sullo storage scelto per conservare le variabili del firmware.",
+    "isoTitle": "Montaggio ISO",
+    "isoBody": "L'installazione ISO è collegata a <code>ide2</code> come CD-ROM, pronto per il primo avvio.",
+    "guestTitle": "Agente ospite QEMU",
+    "guestBody": "Il canale dell'agente ospite è abilitato nella configurazione VM. È ancora necessario installare l'agente all'interno dell'ospite — vedere i suggerimenti qui sotto."
+  },
+  "installOptions": {
+    "heading": "Opzioni di installazione Linux",
+    "officialHeading": "ISO ufficiale (installazione tradizionale)",
+    "officialBody": "ProxMenux offre una selezione di ISO Linux ufficiali. Scegline una: lo script la scarica dal mirror del progetto in <code>/var/lib/vz/template/iso</code> e la collega alla VM.",
+    "officialImageAlt": "Selezione di distribuzione Linux",
+    "officialImageCaption": "Selezione di distribuzione Linux",
+    "localHeading": "ISO locale",
+    "localBody": "Utilizza qualsiasi ISO Linux già presente in <code>/var/lib/vz/template/iso</code>. Lo script elenca ogni <code>*.iso</code> che trova e ti permette di sceglierne uno.",
+    "localImageAlt": "Menu di selezione ISO locale",
+    "localImageCaption": "Menu di selezione ISO locale",
+    "distros": [
+      {
+        "name": "Ubuntu",
+        "variants": [
+          "25.10 Desktop",
+          "24.04 Desktop",
+          "22.04 Desktop",
+          "20.04 Desktop",
+          "25.10 Server",
+          "24.04 Server",
+          "22.04 Server",
+          "20.04 Server"
+        ]
+      },
+      {
+        "name": "Debian",
+        "variants": [
+          "13 Desktop",
+          "12 Desktop",
+          "11 Desktop",
+          "13 Netinst",
+          "12 Netinst",
+          "11 Netinst"
+        ]
+      },
+      {
+        "name": "Fedora",
+        "variants": [
+          "Workstation 42"
+        ]
+      },
+      {
+        "name": "Arch Linux",
+        "variants": [
+          "versione più recente"
+        ]
+      },
+      {
+        "name": "Rocky Linux",
+        "variants": [
+          "9"
+        ]
+      },
+      {
+        "name": "Linux Mint",
+        "variants": [
+          "22.1 Cinnamon"
+        ]
+      },
+      {
+        "name": "openSUSE",
+        "variants": [
+          "Leap 15.6"
+        ]
+      },
+      {
+        "name": "Alpine Linux",
+        "variants": [
+          "3.21"
+        ]
+      },
+      {
+        "name": "Kali Linux",
+        "variants": [
+          "2026.1"
+        ]
+      },
+      {
+        "name": "Manjaro",
+        "variants": [
+          "25.0 GNOME"
+        ]
+      }
+    ]
+  },
+  "endToEnd": {
+    "heading": "Cosa fa lo script end-to-end",
+    "items": [
+      "Ottiene l’ISO Linux tramite download ufficiale o da un file locale.",
+      "Applica le impostazioni predefinite o avanzate di CPU, RAM, BIOS e tipo di macchina.",
+      "Apre il piano di archiviazione e allega i dischi virtuali selezionati, i dischi importati e i dispositivi PCI.",
+      "Crea il disco EFI quando viene selezionato UEFI.",
+      "Monta l'ISO Linux su <code>ide2</code>.",
+      "Imposta l'ordine di avvio (disco prima, poi ISO).",
+      "Abilita il canale Agente Ospite QEMU.",
+      "Opzionalmente gestisce l'assistente passante GPU.",
+      "Genera una descrizione HTML stilizzata collegata al VM.",
+      "Avvia la VM se hai scelto di farlo."
+    ]
+  },
+  "postInstall": {
+    "heading": "Consigli di post-installazione",
+    "guestAgentHeading": "Installa il QEMU Guest Agent nella VM",
+    "guestAgentBody": "ProxMenux abilita il canale dell’agente nella configurazione VM, ma devi installare l’agente nel sistema ospite. Supporta l’arresto controllato e il congelamento dei filesystem durante i backup per migliorare la coerenza dei dati.",
+    "debian": "Debian / Ubuntu",
+    "fedora": "Fedora / Rocky / RHEL",
+    "arch": "Arch Linux",
+    "opensuse": "openSUSE",
+    "virtioHeading": "Supporto VirtIO in Linux",
+    "virtioBody": "Le distribuzioni Linux moderne includono normalmente i driver VirtIO per dischi e rete. Scegli <code>virtio</code> per dischi a blocchi VirtIO oppure <code>scsi</code> con il controller VirtIO SCSI configurato; anche la scheda di rete usa <code>virtio</code>. Verifica il supporto dei driver negli installatori più vecchi.",
+    "virtioWarnTitle": "Distribuzioni molto vecchie",
+    "virtioWarnBody": "Gli installatori molto vecchi potrebbero non includere i driver VirtIO necessari. Usa quindi un controller SATA / SCSI emulato o fornisci driver adatti.",
+    "trimHeading": "Abilita TRIM / discard sullo storage SSD",
+    "trimBody": "Se la VM risiede su storage Proxmox basato su SSD e il disco è stato collegato con l’opzione <code>discard</code>, puoi inoltrare i comandi TRIM dal sistema ospite. Due possibilità:",
+    "trimItems": [
+      "Eseguire <code>fstrim -av</code> periodicamente (o abilitare l'unità <code>fstrim.timer</code> sulle distribuzioni systemd).",
+      "Oppure montare filesystem con l'opzione <code>discard</code> in <code>/etc/fstab</code>."
+    ],
+    "balloonHeading": "Memoria dinamica (ballooning)",
+    "balloonBody": "I kernel Linux moderni includono normalmente il driver <code>virtio_balloon</code>. Con il dispositivo balloon abilitato, Proxmox può raccogliere statistiche sulla memoria. Il recupero dinamico richiede inoltre una memoria minima inferiore al massimo configurato; valori uguali mantengono l’allocazione fissa."
+  },
+  "related": {
+    "heading": "Correlati",
+    "items": [
+      {
+        "href": "/docs/disk-manager/import-disk-image-vm",
+        "label": "Importa immagine disco nella VM",
+        "tail": " — collega un’immagine Linux esistente .qcow2 / .img / .raw a una nuova VM."
+      },
+      {
+        "href": "/docs/utils/import-vm",
+        "label": "Importa VM da OVA / OVF",
+        "tail": " — importa una VM Linux esportata da VMware / VirtualBox / Proxmox."
+      },
+      {
+        "href": "/docs/hardware/gpu-vm-passthrough",
+        "label": "Aggiungi GPU a VM (Passthrough)",
+        "tail": "— per le VM Linux che hanno bisogno di accelerazione GPU."
+      },
+      {
+        "href": "/docs/help-info/vm-ct-commands",
+        "label": "Comandi di gestione VM e CT",
+        "tail": "— riferimento qm CLI."
+      },
+      {
+        "href": "/docs/create-vm",
+        "label": "Panoramica della creazione di VM",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/it/docs/create-vm/system-nas/index.json b/web/messages/it/docs/create-vm/system-nas/index.json
new file mode 100644
index 00000000..82bc6b64
--- /dev/null
+++ b/web/messages/it/docs/create-vm/system-nas/index.json
@@ -0,0 +1,147 @@
+{
+  "meta": {
+    "title": "Creare VM: Sistema NAS | Documentazione ProxMenux",
+    "description": "Crea VM NAS su Proxmox VE con ProxMenux: Synology DSM con loader, TrueNAS SCALE/CORE, OpenMediaVault, XigmaNAS, Rockstor, ZimaOS e FygoOS. Umbrel OS è disponibile tramite uno script della comunità.",
+    "ogTitle": "Creare VM: Sistema NAS | Documentazione ProxMenux",
+    "ogDescription": "Creare macchine virtuali NAS su Proxmox VE con ProxMenux. Supporta Synology DSM (loader), TrueNAS SCALE / CORE, OpenMediaVault, XigmaNAS, Rockstor, ZimaOS e FygoOS.",
+    "ogImageAlt": "Menu NAS di sistema ProxMenux"
+  },
+  "header": {
+    "title": "Crea VM: sistema NAS",
+    "description": "ProxMenux supporta otto sistemi NAS come VM dedicate, più un percorso Umbrel OS tramite script della comunità. La maggior parte usa il flusso automatico ISO; Synology DSM ha una procedura specializzata con loader.",
+    "section": "Macchine virtuali"
+  },
+  "intro": {
+    "title": "Come funziona il selettore NAS",
+    "body": "Nel flusso ISO generico, il selettore cerca l’ultima versione stabile sul mirror del progetto, usa una versione di ripiego se necessario, scarica l’ISO e apre il configuratore comune per CPU, RAM, dischi e rete. Synology DSM e ZimaOS hanno procedure dedicate."
+  },
+  "image": {
+    "alt": "Selettore NAS di sistema ProxMenux",
+    "caption": "Selettore NAS di sistema"
+  },
+  "flowBadges": {
+    "loader": "Procedura con loader",
+    "auto-iso": "Flusso auto-ISO",
+    "dedicated": "script dedicato"
+  },
+  "labels": {
+    "base": "Base",
+    "fileSystem": "Filesystem",
+    "viewDetails": "Visualizza dettagli"
+  },
+  "supported": {
+    "heading": "Sistemi NAS supportati",
+    "cards": [
+      {
+        "name": "Synology DSM",
+        "tagline": "DiskStation Manager con caricatore ARC / RR. Richiede la configurazione del caricatore prima del primo avvio.",
+        "icon": "HardDrive",
+        "base": "Linux (personalizzato)",
+        "fileSystem": "Btrfs, ext4",
+        "href": "/docs/create-vm/system-nas/synology",
+        "flow": "loader"
+      },
+      {
+        "name": "TrueNAS SCALE",
+        "tagline": "TrueNAS basato su Debian con app Docker nelle versioni attuali e ZFS come filesystem principale. Le vecchie versioni SCALE usavano Kubernetes.",
+        "icon": "Database",
+        "base": "Debian Linux",
+        "fileSystem": "ZFS",
+        "href": "/docs/create-vm/system-nas/system-nas-others#truenas-scale",
+        "flow": "auto-iso"
+      },
+      {
+        "name": "TrueNAS CORE",
+        "tagline": "TrueNAS basato su FreeBSD e dedicato allo storage ZFS. Jail e plugin di CORE 13.3 sono obsoleti e non supportati.",
+        "icon": "Database",
+        "base": "FreeBSD",
+        "fileSystem": "ZFS",
+        "href": "/docs/create-vm/system-nas/system-nas-others#truenas-core",
+        "flow": "auto-iso"
+      },
+      {
+        "name": "OpenMediaVault",
+        "tagline": "NAS basato su Debian leggero con un'architettura modulare del plugin. Ottimo per l'hardware più vecchio.",
+        "icon": "Server",
+        "base": "Debian Linux",
+        "fileSystem": "ext4, XFS, Btrfs",
+        "href": "/docs/create-vm/system-nas/system-nas-others#openmediavault",
+        "flow": "auto-iso"
+      },
+      {
+        "name": "XigmaNAS",
+        "tagline": "NAS basato su FreeBSD — il successore originale di FreeNAS, focalizzato su ZFS e semplicità.",
+        "icon": "Database",
+        "base": "FreeBSD",
+        "fileSystem": "ZFS, UFS",
+        "href": "/docs/create-vm/system-nas/system-nas-others#xigmanas",
+        "flow": "auto-iso"
+      },
+      {
+        "name": "Rockstor",
+        "tagline": "NAS basato su openSUSE e costruito attorno a Btrfs. I Rock-on, app Docker, ne estendono le funzioni.",
+        "icon": "HardDrive",
+        "base": "openSUSE Leap",
+        "fileSystem": "Btrfs",
+        "href": "/docs/create-vm/system-nas/system-nas-others#rockstor",
+        "flow": "auto-iso"
+      },
+      {
+        "name": "ZimaOS",
+        "tagline": "Sistema NAS leggero per contenuti multimediali, app Docker e domotica. Usa un installatore dedicato.",
+        "icon": "MonitorIcon",
+        "base": "Buildroot (evoluzione di CasaOS)",
+        "fileSystem": "ext4",
+        "href": "/docs/create-vm/system-nas/system-nas-others#zimaos",
+        "flow": "dedicated"
+      },
+      {
+        "name": "FygoOS",
+        "tagline": "Edizione internazionale di fnOS: un NAS basato su Debian con volumi di archiviazione, app e streaming multimediale, gestito dalla sua interfaccia web e dalle app Fygo.",
+        "icon": "Server",
+        "base": "Debian Linux",
+        "fileSystem": "Btrfs, ext4",
+        "href": "/docs/create-vm/system-nas/system-nas-others#fygoos",
+        "flow": "auto-iso"
+      }
+    ]
+  },
+  "umbrel": {
+    "title": "Opzione della comunità: Umbrel OS",
+    "bodyRich": "La nona voce del menu NAS è <strong>Umbrel OS</strong>. Avvia un <umbrelLink>installatore community-scripts</umbrelLink> mantenuto fuori da ProxMenux e non documentato qui. L’installatore gestisce l’intero processo e mostra alla fine le credenziali predefinite."
+  },
+  "zfsMem": {
+    "title": "Indicazione pratica sulla memoria ZFS",
+    "bodyRich": "Per TrueNAS assegna almeno <strong>8 GB di RAM</strong> per l’uso di base, di più per carichi intensi. ZFS usa RAM per la cache ARC, ma non esiste una soglia universale di 8 GB per ogni NAS ZFS. Controlla i requisiti della distribuzione e dimensiona secondo dischi, servizi e app; configurazioni leggere OMV o Rockstor possono richiedere meno."
+  },
+  "related": {
+    "heading": "Correlati",
+    "items": [
+      {
+        "href": "/docs/create-vm/system-nas/synology",
+        "label": "VM Synology",
+        "tail": "— installatore dedicato per Synology DSM (Xpenology) su Proxmox."
+      },
+      {
+        "href": "/docs/create-vm/system-nas/system-nas-others",
+        "label": "Altri NAS di sistema",
+        "tail": "— TrueNAS, OpenMediaVault, Rockstor, XigmaNAS, FygoOS e simili."
+      },
+      {
+        "href": "/docs/disk-manager/import-disk-vm",
+        "label": "Importa disco nella VM",
+        "tail": " — collega dischi fisici alla VM NAS, preferibili ai dischi virtuali per un uso in produzione."
+      },
+      {
+        "href": "/docs/help-info/zfs-commands",
+        "label": "Comandi di gestione ZFS",
+        "tail": "— utile se la distribuzione del NAS utilizza ZFS sotto."
+      },
+      {
+        "href": "/docs/create-vm",
+        "label": "Panoramica della creazione di VM",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/it/docs/create-vm/system-nas/synology.json b/web/messages/it/docs/create-vm/system-nas/synology.json
new file mode 100644
index 00000000..52e1b924
--- /dev/null
+++ b/web/messages/it/docs/create-vm/system-nas/synology.json
@@ -0,0 +1,400 @@
+{
+  "meta": {
+    "title": "Crea VM: Synology DSM | Documentazione ProxMenux",
+    "description": "Crea una VM Synology DSM su Proxmox VE. ProxMenux scarica il loader scelto (Arc, RR, Alpine RedPill M-shell o un’immagine personalizzata), lo importa come disco di avvio e configura CPU, RAM e storage con la procedura guidata predefinita o avanzata.",
+    "ogTitle": "Crea VM: Synology DSM | Documentazione ProxMenux",
+    "ogDescription": "Creare una macchina virtuale Synology DSM su Proxmox VE con ProxMenux."
+  },
+  "header": {
+    "title": "Creare VM: Synology DSM",
+    "description": "Crea una VM Synology DSM su Proxmox VE. ProxMenux scarica il loader scelto (Arc, RR, Alpine RedPill M-shell o un’immagine personalizzata), lo importa come disco di avvio e configura CPU, RAM e storage con la procedura guidata predefinita o avanzata.",
+    "section": "Macchine virtuali · NAS"
+  },
+  "loaderLabels": {
+    "arc": "Arc Loader",
+    "rr": "RR Loader",
+    "tinycore": "TinyCore Loader"
+  },
+  "whatThisDoes": {
+    "title": "Cosa fa questo script",
+    "bodyRich": "ProxMenux automatizza la preparazione della VM per Synology DSM: scarica un loader supportato, lo importa come disco di avvio IDE e applica le impostazioni scelte per CPU, RAM, rete e storage. La creazione del loader, la scelta del modello e l’installazione DSM avvengono <strong>nella VM</strong> tramite l’interfaccia web o terminale del loader. Questi passaggi sono mantenuti dalla comunità e cambiano spesso; la pagina offre una base di partenza."
+  },
+  "supportedLoaders": {
+    "heading": "Caricatori supportati",
+    "intro": "Lo script permette di scegliere tra quattro origini del loader:",
+    "loaders": [
+      {
+        "name": "AuxXxilium Arc",
+        "url": "https://github.com/AuxXxilium/arc"
+      },
+      {
+        "name": "RedPill RR",
+        "url": "https://github.com/RROrg/rr"
+      },
+      {
+        "name": "Alpine RedPill M-shell (progetto TinyCore)",
+        "url": "https://github.com/PeterSuh-Q3/tinycore-redpill"
+      }
+    ],
+    "customRich": "<strong>Custom Loader</strong> — salva la tua immagine del loader in <code>/var/lib/vz/template/iso</code> e lo script la rileverà."
+  },
+  "config": {
+    "heading": "Configurazione predefinita vs Avanzata",
+    "intro": "Quando si esegue lo script si chiede se utilizzare il profilo ProxMenux predefinito VM o aprire la procedura guidata avanzata. I valori di default sono sintonizzati per DSM e lavorano per la maggior parte delle installazioni.",
+    "defaultHeading": "Configurazione predefinita",
+    "headerParam": "Parametro",
+    "headerValue": "Valore predefinito",
+    "defaultRowsRich": [
+      {
+        "param": "Tipo di macchina",
+        "valueRich": "<code>q35</code>"
+      },
+      {
+        "param": "BIOS",
+        "valueRich": "OVMF (UEFI)"
+      },
+      {
+        "param": "Tipo di CPU",
+        "valueRich": "Host"
+      },
+      {
+        "param": "Core",
+        "valueRich": "2"
+      },
+      {
+        "param": "RAM",
+        "valueRich": "4096 MB"
+      },
+      {
+        "param": "Ponte",
+        "valueRich": "<code>vmbr0</code>"
+      },
+      {
+        "param": "Indirizzo MAC",
+        "valueRich": "Autogenerata"
+      },
+      {
+        "param": "Avvia al termine",
+        "valueRich": "No"
+      }
+    ],
+    "advancedHeading": "Configurazione avanzata",
+    "advancedIntro": "La procedura guidata avanzata mostra ogni impostazione separatamente. Puoi modificare i seguenti valori:",
+    "headerOptions": "Opzioni",
+    "advancedRowsRich": [
+      {
+        "param": "Tipo di macchina",
+        "optionsRich": "<code>q35</code> o <code>i440fx</code>"
+      },
+      {
+        "param": "BIOS",
+        "optionsRich": "OVMF (UEFI) o SeaBIOS (Legacy)"
+      },
+      {
+        "param": "Tipo di CPU",
+        "optionsRich": "Host o KVM64"
+      },
+      {
+        "param": "Core",
+        "optionsRich": "Numero di core CPU"
+      },
+      {
+        "param": "RAM",
+        "optionsRich": "Memoria assegnata alla VM"
+      },
+      {
+        "param": "Ponte",
+        "optionsRich": "Bridge di rete"
+      },
+      {
+        "param": "Indirizzo MAC",
+        "optionsRich": "MAC personalizzato"
+      },
+      {
+        "param": "VLAN",
+        "optionsRich": "Tag VLAN (opzionale)"
+      },
+      {
+        "param": "MTU",
+        "optionsRich": "MTU misura"
+      }
+    ]
+  },
+  "storagePlan": {
+    "heading": "Piano di archiviazione",
+    "introRich": "Dopo CPU e RAM, ProxMenux apre il menu <strong>Piano di archiviazione</strong>. Puoi <strong>combinare</strong> dischi virtuali, dischi importati e dispositivi PCI passthrough nella stessa VM. Aggiungi gli elementi uno alla volta e termina quando hai finito.",
+    "virtualHeading": "a. Aggiungere disco virtuale",
+    "virtualItemsRich": [
+      "Elenca i volumi di archiviazione Proxmox disponibili sull'host.",
+      "Scegli lo storage di destinazione e la dimensione in GB.",
+      "Il disco viene collegato come SATA (<code>sata0</code>, <code>sata1</code>, …). I dischi dati virtuali e fisici condividono le sei posizioni SATA numerate da 0 a 5."
+    ],
+    "importHeading": "b. Aggiungere disco di importazione",
+    "importItemsRich": [
+      "Rileva i dischi fisici che sono sicuri da importare (sistema e dischi protetti sono nascosti).",
+      "Seleziona uno o più dischi tramite una lista di controllo.",
+      "I dischi importati sono collegati come SATA tramite <code>qm set</code>."
+    ],
+    "pciHeading": "C. Aggiungi controller o NVMe (passthrough PCI)",
+    "pciItemsRich": [
+      "Rileva HBA SATA/SAS e dispositivi NVMe e consente di assegnare un <em>intero controller</em> alla VM. IOMMU deve essere attivo; lo script propone l’attivazione e un riavvio se necessario.",
+      "Un passo di conferma avverte il rischio a livello del controller (l'intera carta, compreso ogni disco su di esso, lascia l'host).",
+      "I dispositivi PCI vengono assegnati con comandi come <code>qm set VMID --hostpci0 PCI_ADDRESS,pcie=1</code>. Sostituisci VMID e PCI_ADDRESS con ID della VM e indirizzo PCI e usa un indice hostpci libero per ogni dispositivo."
+    ],
+    "resetCalloutTitle": "Azzera e termina",
+    "resetCalloutBodyRich": "Il menu offre <strong>r</strong> per azzerare la selezione e ricominciare e <strong>d</strong> per terminare e continuare. Il piano non può essere vuoto: Synology richiede almeno un disco per installare DSM."
+  },
+  "gpu": {
+    "heading": "Passaggio opzionale GPU",
+    "bodyRich": "Dopo il piano di archiviazione, se lo script rileva un GPU compatibile sull'host chiede se si desidera passare a questo VM. Vedere <link>Add GPU a un VM (Passthrough)</link> per il modo in cui l'assistente funziona — un riavvio host può essere richiesto."
+  },
+  "loaderInstall": {
+    "heading": "Installazione Loader",
+    "intro1Rich": "<strong>Arc</strong>, <strong>RR</strong> e <strong>Alpine RedPill M-shell</strong> vengono scaricati ed estratti automaticamente dai repository GitHub originali. Se il download fallisce, lo script si interrompe con un messaggio chiaro.",
+    "intro2Rich": "Per l'opzione <strong>Custom Loader</strong> lo script scansiona <code>/var/lib/vz/template/iso</code>. Se si trova più di un candidato si viene invitati a scegliere quello che si desidera.",
+    "uploadIntro": "È possibile caricare caricatori personalizzati dallo storage locale Proxmox:",
+    "imageAlt": "Aggiungi loader personalizzato",
+    "imageCaption": "Aggiungi loader personalizzato"
+  },
+  "vmCreation": {
+    "heading": "Creazione VM — che cosa esegue lo script",
+    "introRich": "Una volta confermato il caricatore, ProxMenux esegue l'equivalente di questi comandi <code>qm</code>:",
+    "itemsRich": [
+      "<code>qm create</code> — crea la VM con CPU, RAM, BIOS e tipo di macchina scelti.",
+      "<code>qm importdisk</code> importa l’immagine del loader nello storage Proxmox. Lo script la collega poi alla VM come disco <strong>IDE</strong> su ide0 per compatibilità.",
+      "<code>qm set VMID --sata0 DISK_REFERENCE</code> collega un disco dati del piano. Sostituisci VMID e DISK_REFERENCE con ID della VM e riferimento del disco; usa un indice SATA libero da 0 a 5. La rete viene configurata da qm create.",
+      "<code>qm set VMID --hostpci0 PCI_ADDRESS,pcie=1</code> assegna un controller PCI o dispositivo NVMe selezionato. Sostituisci VMID e PCI_ADDRESS con ID della VM e indirizzo PCI e usa un indice hostpci libero per ogni dispositivo.",
+      "<code>qm set VMID --boot order=ide0</code> imposta il loader come dispositivo di avvio. Sostituisci VMID con l’ID della VM."
+    ]
+  },
+  "stepByStep": {
+    "heading": "Configurazione del caricatore passo-passo",
+    "intro": "I sei passaggi comuni sono: avviare la VM, scegliere modello, versione DSM e componenti aggiuntivi, creare e avviare il loader. Menu e opzioni variano per versione. Le schermate M-shell mostrano una vecchia interfaccia TinyCore; lo script attuale scarica Alpine RedPill M-shell, quindi segui le sue indicazioni attuali.",
+    "warnCalloutTitle": "I loader non sono mantenuti da ProxMenux",
+    "warnCalloutBody": "Arc, RR e Alpine RedPill M-shell sono progetti comuni con la loro cadenza di rilascio. Se un passo sembra diverso dagli screenshot qui sotto, il caricatore è probabilmente aggiornato — controlla la documentazione del caricatore (link in fondo a questa pagina)."
+  },
+  "stepBadge": "Passaggio",
+  "step1": {
+    "title": "Avvia la VM e accedi al menu principale",
+    "intro": "Avvia la VM creata. Al primo avvio si apre la configurazione del loader per scegliere e creare il modello DSM. Gli avvii successivi saltano questo passaggio, salvo una riconfigurazione forzata dal menu di avvio del loader. Tutti e tre i loader offrono un’interfaccia terminale e una web.",
+    "arc": {
+      "webRich": "<strong>Interfaccia web.</strong> Apri un browser e inserisci l’IP mostrato nella console della VM (nel nostro esempio: <code>http://192.168.0.32</code>).",
+      "webAlt": "Interfaccia web Arc loader",
+      "webCaption": "Interfaccia web Arc loader",
+      "termRich": "<strong>Interfaccia terminale</strong>: accedi direttamente dalla console della VM.",
+      "termAlt": "Interfaccia terminale Arc loader",
+      "termCaption": "Interfaccia terminale Arc loader"
+    },
+    "rr": {
+      "webRich": "<strong>Interfaccia web.</strong> Apri un browser e inserisci l’IP della console VM seguito dalla porta <strong>7681</strong> (esempio: <code>http://192.168.0.33:7681</code>).",
+      "webAlt": "Interfaccia web del caricatore RR",
+      "webCaption": "Interfaccia web del caricatore RR",
+      "termRich": "<strong>Interfaccia terminale.</strong> Digita <code>menu.sh</code> nella console della VM per aprirla.",
+      "termAlt": "Interfaccia terminale caricatore RR",
+      "termCaption": "Interfaccia terminale caricatore RR"
+    },
+    "tinycore": {
+      "webRich": "<strong>Interfaccia web.</strong> Apri un browser e inserisci l’IP della console VM seguito dalla porta <strong>7681</strong> (esempio: <code>http://192.168.0.35:7681</code>).",
+      "webAlt": "Interfaccia web del caricatore TinyCore",
+      "webCaption": "Interfaccia web del caricatore TinyCore",
+      "termRich": "<strong>Interfaccia terminale</strong>: accedi direttamente dalla console della VM. Osserva lo schermo: potrebbe chiederti di premere un tasto per continuare o di cambiare lingua.",
+      "termAlt": "Interfaccia terminale di TinyCore Loader",
+      "termCaption": "Interfaccia terminale di TinyCore Loader"
+    }
+  },
+  "step2": {
+    "title": "Seleziona modello",
+    "introRich": "Scegli il modello Synology DSM che vuoi installare. A seconda del caricatore potrebbe essere necessario espandere le opzioni per visualizzare l'elenco completo. Negli screenshot qui sotto utilizziamo il modello <strong>SA6400</strong> come esempio.",
+    "arc": {
+      "alt": "Selezione del modello in Arc",
+      "caption": "Selezione del modello in Arc"
+    },
+    "rr": {
+      "alt": "Selezione modello RR",
+      "caption": "Selezione modello RR"
+    },
+    "tinycore": {
+      "alt": "Selezione modello TinyCore",
+      "caption": "Selezione modello TinyCore"
+    }
+  },
+  "step3": {
+    "title": "Selezionare la versione DSM",
+    "intro": "Dopo aver scelto il modello, scegliere la versione DSM da installare.",
+    "arc": [
+      {
+        "alt": "Selezione versione Arc - Passo 1",
+        "caption": "Selezione versione Arc - Passo 1"
+      },
+      {
+        "alt": "Selezione versione Arc - Passo 2",
+        "caption": "Selezione versione Arc - Passo 2"
+      }
+    ],
+    "rr": [
+      {
+        "alt": "Selezione versione RR - Passo 1",
+        "caption": "Selezione versione RR - Passo 1"
+      },
+      {
+        "alt": "Selezione versione RR - Passo 2",
+        "caption": "Selezione versione RR - Passo 2"
+      },
+      {
+        "alt": "Selezione versione RR - Passo 3",
+        "caption": "Selezione versione RR - Passo 3"
+      }
+    ],
+    "tinycore": [
+      {
+        "alt": "Selezione versione TinyCore - Passo 1",
+        "caption": "Selezione versione TinyCore - Passo 1"
+      },
+      {
+        "alt": "Selezione versione TinyCore - Passo 2",
+        "caption": "Selezione versione TinyCore - Passo 2"
+      }
+    ]
+  },
+  "step4": {
+    "title": "Selezionare addons",
+    "intro": "Questo passaggio consente di aggiungere funzionalità extra o configurazione personalizzata al caricatore.",
+    "arc": {
+      "autoRich": "<strong>Arc</strong> offre una modalità automatica (consigliata) e una modalità manuale. In modalità automatica il caricatore applica predefinizioni ragionevoli e riavvia da solo quando fatto.",
+      "autoAlt": "Configurazione auto Arc",
+      "autoCaption": "Configurazione auto Arc",
+      "manualRich": "In modalità manuale, imposti le opzioni una alla volta:",
+      "manualAlt": "Configurazione manuale Arc",
+      "manualCaption": "Configurazione manuale Arc",
+      "snMacAlt": "Arc SN/MAC",
+      "snMacCaption": "Configurazione Arc SN / MAC",
+      "portmapAlt": "Arc SATA portmap",
+      "portmapCaption": "Arc SATA portmap (usare l'opzione consigliata)",
+      "addonsAlt": "Componenti aggiuntivi di Arc",
+      "addonsCaption": "Selezione dei componenti aggiuntivi in Arc"
+    },
+    "rr": [
+      {
+        "alt": "RR addon - passo 1",
+        "caption": "RR addon - passo 1"
+      },
+      {
+        "alt": "RR addon - passo 2",
+        "caption": "RR addon — passo 2: premere per aggiungere un addon"
+      },
+      {
+        "alt": "RR addon - passo 3",
+        "caption": "RR addon — passo 3: fare clic sull'addon che si desidera. Ripetere i due screenshot precedenti per aggiungere di più."
+      }
+    ],
+    "tinycore": [
+      {
+        "alt": "Configurazione TinyCore SN",
+        "caption": "Configurazione TinyCore SN"
+      },
+      {
+        "alt": "TinyCore opzione casuale",
+        "caption": "TinyCore opzione casuale (consigliato)"
+      },
+      {
+        "alt": "Configurazione MAC TinyCore",
+        "caption": "Configurazione MAC TinyCore"
+      },
+      {
+        "alt": "TinyCore VM MAC",
+        "caption": "TinyCore — scegli il MAC di VM o uno casuale"
+      }
+    ]
+  },
+  "step5": {
+    "title": "Costruisci il caricatore",
+    "introRich": "Dopo aver scelto modello, versione DSM e componenti aggiuntivi, seleziona <strong>Build the Loader</strong>. Potrebbe richiedere alcuni minuti, secondo il loader e le opzioni scelte.",
+    "arc": {
+      "alt": "Creazione del loader in Arc",
+      "caption": "Creazione del loader in Arc"
+    },
+    "rr": {
+      "alt": "Creazione del loader in RR",
+      "caption": "Creazione del loader in RR"
+    },
+    "tinycore": {
+      "alt": "Creazione del loader in TinyCore",
+      "caption": "Creazione del loader in TinyCore"
+    }
+  },
+  "step6": {
+    "title": "Avvia il loader",
+    "intro": "Una volta costruito il caricatore, il VM si riavvia con la configurazione creata e inizia l'installazione DSM.",
+    "arc": {
+      "alt": "Avvio del loader in Arc",
+      "caption": "Avvio del loader in Arc"
+    },
+    "rr": {
+      "alt": "Avvio del loader in RR",
+      "caption": "Avvio del loader in RR"
+    },
+    "tinycore": {
+      "alt": "Avvio del loader in TinyCore",
+      "caption": "Avvio del loader in TinyCore"
+    }
+  },
+  "dsmInstall": {
+    "heading": "Avviare l'installazione DSM",
+    "intro": "Dopo aver avviato il loader, puoi trovare la VM DSM aprendo:",
+    "afterCode": "Segui i passaggi sullo schermo per completare l'installazione di DSM.",
+    "setupAlt": "Configurazione DSM",
+    "setupCaption": "Schermo di configurazione DSM",
+    "patience": "Attendi qualche minuto. L’avanzamento si aggiorna automaticamente e appare un conto alla rovescia quando l’installazione sta per terminare.",
+    "finishAlt": "Installazione completa",
+    "finishCaption": "Installazione completa"
+  },
+  "tips": {
+    "heading": "Consigli",
+    "recentTitle": "Utilizzare i modelli DSM recenti",
+    "recentBody": "Alcuni modelli DSM più vecchi hanno difficoltà a riconoscere i dischi o la scheda di rete. Preferire modelli recenti (ad es. SA6400) per un'esperienza di primo avvio più liscia.",
+    "updateTitle": "Aggiornare il caricatore",
+    "updateBody": "Alcuni caricatori offrono la possibilità di aggiornarsi direttamente dal loro menu di configurazione — non è necessario distruggere e ricreare il VM.",
+    "warnTitle": "ProxMenux non supporta i caricatori",
+    "warnBody": "ProxMenux automatizza la preparazione della VM. Per problemi del loader, come modello assente, componenti aggiuntivi non installabili o DSM che non si avvia, consulta il sistema di segnalazione problemi e la documentazione del loader.",
+    "docsHeading": "Documentazione Loader",
+    "docLinks": [
+      {
+        "label": "Documentazione di Arc",
+        "url": "https://github.com/AuxXxilium/arc"
+      },
+      {
+        "label": "Documentazione RR",
+        "url": "https://github.com/RROrg/rr"
+      },
+      {
+        "label": "Documentazione TinyCore",
+        "url": "https://github.com/PeterSuh-Q3/tinycore-redpill"
+      }
+    ]
+  },
+  "related": {
+    "heading": "Correlati",
+    "itemsRich": [
+      {
+        "href": "/docs/create-vm/system-nas",
+        "label": "Panoramica del NAS di sistema",
+        "tail": "— confronto di Synology vs TrueNAS / OMV / Rockstor / XigmaNAS."
+      },
+      {
+        "href": "/docs/create-vm/system-nas/system-nas-others",
+        "label": "Altri NAS di sistema",
+        "tail": " — distribuzioni NAS diverse da Synology."
+      },
+      {
+        "href": "/docs/disk-manager/import-disk-vm",
+        "label": "Importa disco nella VM",
+        "tail": " — assegna dischi fisici alla VM Synology, consigliato per le prestazioni di archiviazione."
+      },
+      {
+        "href": "/docs/create-vm",
+        "label": "Panoramica della creazione di VM",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/it/docs/create-vm/system-nas/system-nas-others.json b/web/messages/it/docs/create-vm/system-nas/system-nas-others.json
new file mode 100644
index 00000000..99786532
--- /dev/null
+++ b/web/messages/it/docs/create-vm/system-nas/system-nas-others.json
@@ -0,0 +1,312 @@
+{
+  "meta": {
+    "title": "Creare VM: Altri sistemi NAS | Documentazione ProxMenux",
+    "description": "Creare TrueNAS SCALE, TrueNAS CORE, OpenMediaVault, XigmaNAS, Rockstor, ZimaOS e FygoOS macchine virtuali su Proxmox VE con ProxMenux. Copre la configurazione predefinita / avanzata, il nuovo piano di archiviazione, passthrough opzionale GPU e specifiche consigliate per sistema.",
+    "ogTitle": "Creare VM: Altri sistemi NAS | Documentazione ProxMenux",
+    "ogDescription": "Creare TrueNAS SCALE / CORE, OpenMediaVault, XigmaNAS, Rockstor, ZimaOS e FygoOS VM su Proxmox VE con ProxMenux.",
+    "ogImageAlt": "Selettore NAS ProxMenux"
+  },
+  "header": {
+    "title": "Creare VM: Altri sistemi NAS",
+    "description": "ProxMenux può creare un VM pronto per l'installazione per TrueNAS SCALE, TrueNAS CORE, OpenMediaVault, XigmaNAS, Rockstor, ZimaOS e FygoOS. Questa pagina copre il flusso di creazione condiviso (configurazione predefinita / avanzata, il nuovo piano di archiviazione, passthrough opzionale GPU) più note per sistema e specifiche consigliate.",
+    "section": "Macchine virtuali · NAS"
+  },
+  "intro": {
+    "title": "Come vengono creati questi sistemi",
+    "bodyRich": "Tutti e sette i sistemi condividono lo stesso wizard ProxMenux. Il selettore NAS sceglie l'installatore corrispondente (rilevando automaticamente l'ultima versione stabile per TrueNAS, OMV, XigmaNAS, Rockstor e FygoOS) e poi consegna al configuratore generico VM e al piano di archiviazione. ZimaOS utilizza il proprio script di installazione (<code>vm/zimaos.sh</code>) ma segue la stessa sequenza CPU / RAM / storage / optional-GPU."
+  },
+  "config": {
+    "heading": "Configurazione predefinita vs Avanzata",
+    "intro": "Quando viene selezionato un NAS, ProxMenux chiede se utilizzare il profilo predefinito VM o aprire la procedura guidata avanzata. I default sono sintonizzati per i carichi di lavoro NAS — più RAM di un normale Linux VM perché i sistemi basati su ZFS ne hanno bisogno per la cache ARC.",
+    "defaultHeading": "Configurazione predefinita",
+    "headerParam": "Parametro",
+    "headerValue": "Valore predefinito",
+    "defaultRowsRich": [
+      {
+        "param": "Tipo di macchina",
+        "valueRich": "<code>q35</code>"
+      },
+      {
+        "param": "BIOS",
+        "valueRich": "OVMF (UEFI)<note> — SeaBIOS per OpenMediaVault</note>"
+      },
+      {
+        "param": "Tipo di CPU",
+        "valueRich": "Host"
+      },
+      {
+        "param": "Core",
+        "valueRich": "2"
+      },
+      {
+        "param": "RAM",
+        "valueRich": "8192 MB<note> — 4096 MB per ZimaOS</note>"
+      },
+      {
+        "param": "Ponte",
+        "valueRich": "<code>vmbr0</code>"
+      },
+      {
+        "param": "Indirizzo MAC",
+        "valueRich": "Autogenerata"
+      },
+      {
+        "param": "Avvia al termine",
+        "valueRich": "No"
+      }
+    ],
+    "advancedHeading": "Configurazione avanzata",
+    "advancedIntro": "La procedura guidata avanzata espone ogni parametro singolarmente:",
+    "headerOptions": "Opzioni",
+    "advancedRowsRich": [
+      {
+        "param": "Tipo di macchina",
+        "optionsRich": "<code>q35</code> o <code>i440fx</code>"
+      },
+      {
+        "param": "BIOS",
+        "optionsRich": "OVMF (UEFI) o SeaBIOS (Legacy)"
+      },
+      {
+        "param": "Tipo di CPU",
+        "optionsRich": "Host, KVM64 e altri modelli CPU elencati (ZimaOS: Host o KVM64)"
+      },
+      {
+        "param": "Core",
+        "optionsRich": "Numero di core CPU"
+      },
+      {
+        "param": "RAM",
+        "optionsRich": "Memoria assegnata al VM"
+      },
+      {
+        "param": "Ponte",
+        "optionsRich": "Bridge di rete"
+      },
+      {
+        "param": "Indirizzo MAC",
+        "optionsRich": "MAC personalizzato"
+      },
+      {
+        "param": "VLAN",
+        "optionsRich": "Tag VLAN (opzionale)"
+      },
+      {
+        "param": "MTU",
+        "optionsRich": "MTU misura"
+      }
+    ],
+    "zfsCalloutTitle": "ZFS e RAM",
+    "zfsCalloutBody": "TrueNAS SCALE/CORE e XigmaNAS usano ZFS, la cui cache ARC beneficia della RAM. TrueNAS richiede almeno 8 GB per l’uso di base; 16 GB o più aiutano con servizi e app impegnativi. Dimensiona la VM secondo distribuzione e carico: 8 GB non è un minimo universale di ZFS. Configurazioni leggere OMV, Rockstor o ZimaOS possono richiedere meno."
+  },
+  "storagePlan": {
+    "heading": "Piano di archiviazione",
+    "intro": "Dopo CPU / RAM, ProxMenux apre il menu Storage Plan, dove è possibile combinare dischi virtuali, dischi importati e dispositivi passanti PCI nello stesso VM, aggiungendo elementi uno alla volta e terminando quando si è fatto.",
+    "virtualHeading": "a. Aggiungere disco virtuale",
+    "virtualItemsRich": [
+      "Elenca i volumi di archiviazione Proxmox disponibili sull'host.",
+      "Scegli lo storage di destinazione e la dimensione in GB.",
+      "Il disco usa il bus scelto: SCSI (predefinito), SATA, VirtIO o IDE (ZimaOS: SCSI o SATA). SATA offre sei posizioni numerate da 0 a 5: <code>sata0</code>, <code>sata1</code>, …."
+    ],
+    "importHeading": "b. Aggiungere disco di importazione",
+    "importItemsRich": [
+      "Rileva i dischi fisici che sono sicuri da importare (sistema e dischi protetti sono nascosti).",
+      "Seleziona uno o più dischi tramite una lista di controllo.",
+      "I dischi importati usano il bus scelto e vengono collegati tramite <code>qm set</code>."
+    ],
+    "pciHeading": "C. Aggiungi controller o NVMe (passthrough PCI)",
+    "pciItemsRich": [
+      "Rileva HBA SATA/SAS e dispositivi NVMe e consente di assegnare un <em>intero controller</em> alla VM. IOMMU deve essere attivo; lo script propone l’attivazione e un riavvio se necessario.",
+      "Un passo di conferma avverte il rischio a livello del controller (l'intera carta, compreso ogni disco su di esso, lascia l'host).",
+      "I dispositivi PCI vengono assegnati con comandi come <code>qm set VMID --hostpci0 PCI_ADDRESS,pcie=1</code>. Sostituisci VMID e PCI_ADDRESS con ID della VM e indirizzo PCI e usa un indice hostpci libero per ogni dispositivo."
+    ],
+    "resetCalloutTitle": "Azzera e termina",
+    "resetCalloutBodyRich": "Il menu offre anche <strong>r</strong> (riimpostare la selezione attuale e ricominciare da capo) e <strong>d</strong> (finire e continuare). Non puoi finire con un piano vuoto."
+  },
+  "gpu": {
+    "heading": "Passaggio opzionale GPU",
+    "bodyRich": "Dopo il piano di archiviazione, se viene rilevato un GPU compatibile sull'host, ProxMenux offre di lanciare l'assistente passthrough GPU. Vedere <link>Add GPU a un VM (Passthrough)</link> per come funziona l'assistente - un riavvio host può essere richiesto."
+  },
+  "autoFeatures": {
+    "heading": "Caratteristiche automatiche VM",
+    "efiTitle": "Disco EFI",
+    "efiBody": "Con OVMF (UEFI), ProxMenux crea automaticamente un disco EFI da 4 MB sullo storage scelto, nel formato adatto al tipo di storage: raw per quello basato su directory.",
+    "isoTitle": "Montaggio ISO",
+    "isoBodyRich": "L'installazione ISO viene scaricata (se necessario) e attaccata a <code>ide2</code> come CD-ROM, pronta per il primo avvio.",
+    "guestTitle": "Agente ospite QEMU",
+    "guestBody": "Il canale dell'agente ospite è abilitato nella configurazione VM. È ancora necessario installare l'agente all'interno dell'ospite dopo che il sistema operativo NAS è in funzione."
+  },
+  "endToEnd": {
+    "heading": "Cosa fa lo script end-to-end",
+    "itemsRich": [
+      "Rileva e scarica l'ultima ISO stabile (o utilizza la versione fallback se il upstream non è raggiungibile).",
+      "Applica le impostazioni predefinite o avanzate di CPU, RAM, BIOS e tipo di macchina.",
+      "Apre il piano di archiviazione e allega i dischi virtuali selezionati, i dischi importati e i dispositivi PCI.",
+      "Crea un disco EFI se viene selezionato UEFI.",
+      "Monta l'installazione ISO su <code>ide2</code>.",
+      "Imposta l'ordine di avvio (disco prima, poi ISO).",
+      "Abilita il canale Agente Ospite QEMU.",
+      "Opzionalmente gestisce l'assistente passante GPU.",
+      "Genera una descrizione HTML stilizzata collegata al VM.",
+      "Avvia il VM se hai scelto di farlo."
+    ]
+  },
+  "perSystem": {
+    "heading": "Note per sistema",
+    "shellLabel": "Interfaccia di Shell",
+    "webLabel": "Interfaccia web"
+  },
+  "systems": {
+    "truenasScale": {
+      "id": "truenas-scale",
+      "title": "TrueNAS SCALE",
+      "icon": "Database",
+      "officialName": "TrueNAS SCALE",
+      "officialUrl": "https://www.truenas.com/truenas-scale/",
+      "description": "TrueNAS basato su Debian con app Docker nelle versioni attuali, Linux KVM e ZFS come filesystem principale. Le vecchie versioni SCALE usavano Kubernetes. Combina storage ZFS e un ecosistema di contenitori.",
+      "specs": [
+        "Interfaccia consigliata: SATA o SCSI, entrambe con supporto discard/TRIM",
+        "Minimo RAM: 8 GB (16 GB+ consigliato per carichi di lavoro reali)",
+        "Minimo CPU core: 2 (4+ consigliato)",
+        "UEFI (OVMF) boot consigliato",
+        "Scheda di rete VirtIO per una maggiore velocità di trasferimento"
+      ],
+      "shellImg": "/vm/truenas/truenas-scale-shell.png",
+      "webImg": "/vm/truenas/truenas-scale-web.png",
+      "shellAlt": "TrueNAS Interfaccia shell SCALE",
+      "webAlt": "Interfaccia web SCALE TrueNAS"
+    },
+    "truenasCore": {
+      "id": "truenas-core",
+      "title": "TrueNAS CORE",
+      "icon": "Database",
+      "officialName": "TrueNAS CORE",
+      "officialUrl": "https://www.truenas.com/truenas-core/",
+      "description": "TrueNAS basato su FreeBSD, in precedenza FreeNAS, dedicato a ZFS. Jail, plugin e virtualizzazione di CORE 13.3 sono obsoleti e non supportati; lo sviluppo attuale si concentra sulle edizioni Linux.",
+      "specs": [
+        "Interfaccia consigliata: SATA",
+        "Minimo RAM: 8 GB (16 GB+ consigliato)",
+        "Minimo CPU core: 2 (4+ consigliato)",
+        "UEFI (OVMF) boot consigliato",
+        "Scheda di rete VirtIO per una maggiore velocità di trasferimento"
+      ],
+      "shellImg": "/vm/truenas/truenas-core-shell.png",
+      "webImg": "/vm/truenas/truenas-core-web.png",
+      "shellAlt": "Interfaccia con shell CORE TrueNAS",
+      "webAlt": "Interfaccia web TrueNAS CORE"
+    },
+    "openmediavault": {
+      "id": "openmediavault",
+      "title": "OpenMediaVault",
+      "icon": "Server",
+      "officialName": "openmediavault.org",
+      "officialUrl": "https://www.openmediavault.org",
+      "description": "NAS basato su Debian con plugin modulari. Richiede poche risorse e funziona su hardware modesto, adatto quando non serve ZFS.",
+      "specs": [
+        "Interfaccia consigliata: SATA o VirtIO",
+        "Minimo RAM: 2 GB (4 GB+ consigliato)",
+        "Minimo CPU core: 1 (2+ consigliato)",
+        "BIOS: ProxMenux predefinito a SeaBIOS per OMV (override in Advanced se necessario)",
+        "Scheda di rete VirtIO per una maggiore velocità di trasferimento"
+      ],
+      "shellImg": "/vm/openmediavault/openmediavault-shell.png",
+      "webImg": "/vm/openmediavault/openmediavault-web.png",
+      "shellAlt": "Interfaccia shell di OpenMediaVault",
+      "webAlt": "Interfaccia web OpenMediaVault"
+    },
+    "xigmanas": {
+      "id": "xigmanas",
+      "title": "XigmaNAS",
+      "icon": "Database",
+      "officialName": "xigmanas.com",
+      "officialUrl": "https://www.xigmanas.com",
+      "description": "NAS basato su FreeBSD — la continuazione diretta della base di codice originale FreeNAS (0.7). Concentrato su ZFS e semplicità, con un'impronta più leggera di TrueNAS.",
+      "specs": [
+        "Interfaccia consigliata: SATA o SCSI",
+        "Minimo RAM: 4 GB (8 GB+ consigliato per ZFS)",
+        "Nuclei CPU minimi: 2",
+        "UEFI (OVMF) boot consigliato",
+        "Scheda di rete VirtIO per una maggiore velocità di trasferimento"
+      ]
+    },
+    "rockstor": {
+      "id": "rockstor",
+      "title": "Rockstor",
+      "icon": "HardDrive",
+      "officialName": "rockstor.com",
+      "officialUrl": "https://rockstor.com",
+      "description": "NAS basato su openSUSE Leap e costruito attorno a Btrfs. Snapshot, sottovolumi e piattaforma Rock-on con app Docker per contenuti multimediali, condivisione e backup.",
+      "specs": [
+        "Interfaccia consigliata: SATA o VirtIO",
+        "Minimo RAM: 2 GB (4 GB+ consigliato)",
+        "Nuclei CPU minimi: 2",
+        "UEFI (OVMF) boot consigliato",
+        "Scheda di rete VirtIO per una maggiore velocità di trasferimento"
+      ],
+      "shellImg": "/vm/rockstor/rockstor-shell.png",
+      "webImg": "/vm/rockstor/rockstor-web.png",
+      "shellAlt": "Interfaccia della shell Rockstor",
+      "webAlt": "Interfaccia web Rockstor"
+    },
+    "zimaos": {
+      "id": "zimaos",
+      "title": "ZimaOS",
+      "icon": "MonitorIcon",
+      "officialName": "zimaspace.com",
+      "officialUrl": "https://www.zimaspace.com/zimaos",
+      "description": "Sistema NAS/server domestico leggero costruito con Buildroot, evoluto da CasaOS, per contenuti multimediali, app Docker e domotica. L’installatore ProxMenux dedicato (vm/zimaos.sh) scarica un’immagine pronta e offre impostazioni CPU, RAM e storage.",
+      "specs": [
+        "Interfaccia consigliata: SATA o VirtIO",
+        "RAM predefinita: 4 GB, per contenuti multimediali e app ospitate in proprio",
+        "Nuclei CPU minimi: 2",
+        "Avvio UEFI (OVMF)",
+        "Scheda di rete VirtIO per una maggiore velocità di trasferimento"
+      ]
+    },
+    "fygoos": {
+      "id": "fygoos",
+      "title": "FygoOS",
+      "icon": "Server",
+      "officialName": "fygonas.com",
+      "officialUrl": "https://fygonas.com",
+      "description": "Edizione internazionale di fnOS, un NAS basato su Debian. ProxMenux scarica l'ultimo installatore ISO pubblicato su fygonas.com e lo monta nel VM. L'installatore mette il sistema su un disco; lo spazio lasciato su quel disco può contenere volumi per applicazioni e file. Dopo l'installazione, la console mostra l'indirizzo dell'interfaccia web, sulla porta 5666 (porta 80 reindirizza ad essa): aprirlo in un browser per nominare il dispositivo e creare l'account amministratore.",
+      "specs": [
+        "Disco di sistema: FygoOS propone una partizione di sistema 64 GB, che può essere più piccola in un VM",
+        "Installazione: Graphical Install, oppure Rescuing Install se la modalità grafica non funziona",
+        "UEFI (OVMF) boot senza chiavi Secure Boot, come richiede l'installatore",
+        "Rete: Ethernet con DHCP per impostazione predefinita",
+        "Scheda di rete VirtIO per una maggiore velocità di trasferimento"
+      ]
+    }
+  },
+  "related": {
+    "heading": "Correlati",
+    "itemsRich": [
+      {
+        "href": "/docs/create-vm/system-nas",
+        "label": "Panoramica del NAS di sistema",
+        "tail": "— un rapido confronto tra tutte le opzioni NAS."
+      },
+      {
+        "href": "/docs/create-vm/system-nas/synology",
+        "label": "VM Synology",
+        "tail": " — procedura Synology DSM (Xpenology)."
+      },
+      {
+        "href": "/docs/disk-manager/import-disk-vm",
+        "label": "Importa disco nella VM",
+        "tail": "— consigliata per i casi di utilizzo del NAS (dischi reali > dischi virtuali)."
+      },
+      {
+        "href": "/docs/help-info/zfs-commands",
+        "label": "Comandi di gestione ZFS",
+        "tail": " — se scegli TrueNAS o un’altra distribuzione basata su ZFS."
+      },
+      {
+        "href": "/docs/create-vm",
+        "label": "Panoramica della creazione di VM",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/it/docs/create-vm/system-windows.json b/web/messages/it/docs/create-vm/system-windows.json
new file mode 100644
index 00000000..115a1665
--- /dev/null
+++ b/web/messages/it/docs/create-vm/system-windows.json
@@ -0,0 +1,259 @@
+{
+  "meta": {
+    "title": "Crea VM: sistema Windows | Documentazione ProxMenux",
+    "description": "Creare e configurare macchine virtuali Windows su Proxmox VE con ProxMenux. Include UUP Dump ISO e percorsi ISO locali, configurazione predefinita / avanzata, piano di archiviazione unificato, passthrough GPU opzionale, configurazione TPM 2.0 e installazione driver VirtIO.",
+    "ogTitle": "Crea VM: sistema Windows | Documentazione ProxMenux",
+    "ogDescription": "Crea VM Windows su Proxmox VE con ProxMenux. UUP Dump o ISO locale, piano di archiviazione unificato, passthrough opzionale GPU, driver TPM 2.0 e VirtIO.",
+    "ogImageAlt": "ProxMenux menu Windows VM"
+  },
+  "header": {
+    "title": "Crea VM: sistema Windows",
+    "description": "Crea una VM Windows su Proxmox VE. ProxMenux gestisce la scelta dell’ISO (UUP Dump o locale), CPU, RAM, tipo di macchina, piano di archiviazione comune, passthrough GPU facoltativo, TPM 2.0 e installazione dei driver VirtIO.",
+    "section": "Macchine virtuali"
+  },
+  "intro": {
+    "title": "Cosa fa questo script",
+    "body": "Il percorso Windows chiede l’origine dell’ISO: UUP Dump o copia locale in <code>/var/lib/vz/template/iso</code>. Avvia poi la procedura guidata VM comune con impostazioni adatte a Windows: <code>q35</code>, OVMF e TPM 2.0. L’ISO dei driver VirtIO viene collegata come secondo CD-ROM e la VM è pronta ad avviare l’installatore Windows."
+  },
+  "image": {
+    "alt": "ProxMenux Opzioni di installazione di Windows",
+    "caption": "Opzioni di installazione di Windows"
+  },
+  "config": {
+    "heading": "Configurazione predefinita vs Avanzata",
+    "intro": "Dopo la selezione dell'ISO, ProxMenux chiede se utilizzare il profilo predefinito VM o aprire la procedura guidata avanzata. Il profilo predefinito è sintonizzato per le moderne edizioni desktop e server Windows.",
+    "defaultHeading": "Configurazione predefinita",
+    "headerParam": "Parametro",
+    "headerValue": "Valore predefinito",
+    "defaultRows": [
+      {
+        "param": "Tipo di macchina",
+        "valueRich": "<code>q35</code>"
+      },
+      {
+        "param": "BIOS",
+        "value": "OVMF (UEFI)"
+      },
+      {
+        "param": "Tipo di CPU",
+        "value": "Host"
+      },
+      {
+        "param": "Core",
+        "value": "4"
+      },
+      {
+        "param": "RAM",
+        "value": "8192 MB"
+      },
+      {
+        "param": "Ponte",
+        "valueRich": "<code>vmbr0</code>"
+      },
+      {
+        "param": "Indirizzo MAC",
+        "value": "Autogenerata"
+      },
+      {
+        "param": "TPM",
+        "value": "Abilitato (v2.0)"
+      },
+      {
+        "param": "Avvia al termine",
+        "value": "No"
+      }
+    ],
+    "advancedHeading": "Configurazione avanzata",
+    "advancedIntro": "La procedura guidata avanzata mostra ogni impostazione separatamente:",
+    "headerOptions": "Opzioni",
+    "advancedRows": [
+      {
+        "param": "Tipo di macchina",
+        "optionsRich": "<code>q35</code> o <code>i440fx</code>"
+      },
+      {
+        "param": "BIOS",
+        "options": "OVMF (UEFI) o SeaBIOS (Legacy)"
+      },
+      {
+        "param": "Tipo di CPU",
+        "options": "Host, KVM64 e altri modelli CPU elencati"
+      },
+      {
+        "param": "Core",
+        "options": "Numero di core CPU"
+      },
+      {
+        "param": "RAM",
+        "options": "Memoria assegnata alla VM"
+      },
+      {
+        "param": "Ponte",
+        "options": "Bridge di rete"
+      },
+      {
+        "param": "Indirizzo MAC",
+        "options": "MAC personalizzato"
+      },
+      {
+        "param": "VLAN",
+        "options": "Tag VLAN (opzionale)"
+      },
+      {
+        "param": "MTU",
+        "options": "MTU misura"
+      },
+      {
+        "param": "TPM",
+        "options": "TPM 2.0 viene aggiunto automaticamente per Windows; la procedura guidata non offre un interruttore TPM."
+      }
+    ],
+    "tpmWarnTitle": "I requisiti TPM dipendono dall’edizione Windows",
+    "tpmWarnBody": "Windows 11 richiede normalmente TPM 2.0. Windows Server 2022 lo richiede per alcune funzioni di sicurezza, non per ogni installazione. ProxMenux aggiunge un TPM virtuale per Windows; la procedura guidata avanzata non consente di disattivarlo."
+  },
+  "storagePlan": {
+    "heading": "Piano di archiviazione",
+    "body": "Dopo CPU / RAM, ProxMenux apre il menu <strong>Storage Plan</strong>, dove è possibile combinare dischi virtuali, dischi importati e dispositivi passanti PCI nello stesso VM, aggiungendo elementi uno alla volta e terminando quando si è fatto.",
+    "virtualDiskTitle": "a. Aggiungere disco virtuale",
+    "virtualDiskItems": [
+      "Elenca i volumi di archiviazione Proxmox disponibili sull'host.",
+      "Scegli lo storage di destinazione e la dimensione in GB.",
+      "Il disco usa il bus scelto: SCSI (predefinito), SATA, VirtIO o IDE. SATA offre sei posizioni numerate da 0 a 5: <code>sata0</code>, <code>sata1</code>, …."
+    ],
+    "importDiskTitle": "b. Aggiungere disco di importazione",
+    "importDiskItems": [
+      "Rileva i dischi fisici che sono sicuri da importare (sistema e dischi protetti sono nascosti).",
+      "Seleziona uno o più dischi tramite una lista di controllo.",
+      "I dischi importati usano il bus scelto e vengono collegati tramite <code>qm set</code>."
+    ],
+    "pciTitle": "C. Aggiungi controller o NVMe (passthrough PCI)",
+    "pciItems": [
+      "Rileva HBA SATA/SAS e dispositivi NVMe e consente di assegnare un <em>intero controller</em> alla VM. IOMMU deve essere attivo; lo script propone l’attivazione e un riavvio se necessario.",
+      "Un passo di conferma avverte il rischio a livello del controller (l'intera carta, compreso ogni disco su di esso, lascia l'host).",
+      "I dispositivi PCI vengono assegnati con comandi come <code>qm set VMID --hostpci0 PCI_ADDRESS,pcie=1</code>. Sostituisci VMID e PCI_ADDRESS con ID della VM e indirizzo PCI e usa un indice hostpci libero per ogni dispositivo."
+    ],
+    "resetTitle": "Azzera e termina",
+    "resetBody": "Il menu offre anche <strong>r</strong> (riimpostare la selezione attuale e ricominciare da capo) e <strong>d</strong> (finire e continuare). Non puoi finire con un piano vuoto."
+  },
+  "gpu": {
+    "heading": "Passaggio opzionale GPU",
+    "body": "Dopo il piano di archiviazione, se viene rilevato un GPU compatibile sull'host ProxMenux offre di lanciare l'assistente passthrough GPU. Vedere <gpuLink>Add GPU a un VM (Passthrough)</gpuLink> per come funziona l'assistente - un riavvio host può essere richiesto."
+  },
+  "autoFeatures": {
+    "heading": "Caratteristiche automatiche VM",
+    "efiTitle": "Disco EFI",
+    "efiBody": "Quando OVMF (UEFI) viene selezionato, ProxMenux crea un disco di sistema EFI 4 MB sullo storage scelto e lo collega al VM in modo che il firmware UEFI abbia un posto per memorizzare le sue variabili.",
+    "tpmTitle": "TPM 2.0",
+    "tpmBody": "ProxMenux aggiunge un TPM 2.0 virtuale alle VM Windows. Soddisfa il requisito TPM di Windows 11 e supporta le funzioni Windows Server che dipendono da TPM.",
+    "isoTitle": "Montaggio ISO",
+    "isoBody": "L’ISO di installazione viene collegata a <code>ide2</code>. L’ISO dei driver VirtIO viene scaricata se necessario e collegata a <code>ide3</code> per il passaggio <em>Carica driver</em>.",
+    "guestTitle": "Agente ospite QEMU",
+    "guestBody": "Il canale dell'agente ospite è abilitato nella configurazione VM. L'agente stesso è installato all'interno di Windows eseguendo <code>virtio-win-guest-tools.exe</code> dopo l'installazione."
+  },
+  "installOptions": {
+    "heading": "Opzioni di installazione di Windows",
+    "intro": "ProxMenux offre due metodi per ottenere il supporto di installazione di Windows:",
+    "uupTitle": "Creatore di ISO UUP Dump",
+    "uupLogoAlt": "logo UUP Dump",
+    "uupBody": "Lo script <strong>UUP Dump ISO Creator</strong> è un’utilità ProxMenux che crea una ISO Windows al momento dai server Windows Update di Microsoft. Scarica file di installazione ufficiali, incluse le build Insider Preview.",
+    "uupItems": [
+      "Accesso alle ultime versioni di Windows.",
+      "Supporta le versioni Insider Preview.",
+      "File di installazione Microsoft ufficiali e non modificati.",
+      "Creazione e montaggio automatico ISO nel VM.",
+      "Supporta le edizioni Home, Pro e Enterprise."
+    ],
+    "uupLearnMore": "Scopri di più su UUP Dump ISO Creator",
+    "localTitle": "Installare con ISO locale",
+    "localBody": "Utilizza una ISO di Windows che hai già caricato sullo storage locale dell'host (<code>/var/lib/vz/template/iso</code>). Lo script elenca ogni ISO non-VirtIO che trova e ti permette di sceglierne uno.",
+    "localImageAlt": "Menu di selezione ISO locale",
+    "localImageCaption": "Menu di selezione ISO locale"
+  },
+  "endToEnd": {
+    "heading": "Cosa fa lo script end-to-end",
+    "items": [
+      "Ottiene l’ISO Windows tramite UUP Dump o da una copia locale.",
+      "Applica le impostazioni predefinite o avanzate di CPU, RAM, BIOS e tipo di macchina.",
+      "Apre il piano di archiviazione e allega i dischi virtuali selezionati, i dischi importati e i dispositivi PCI.",
+      "Crea il disco EFI per le installazioni UEFI e collega il dispositivo TPM 2.0.",
+      "Monta l'ISO di Windows su <code>ide2</code>.",
+      "Scarica e monta i driver VirtIO ISO su <code>ide3</code>.",
+      "Imposta l'ordine di avvio (disco prima, poi ISO).",
+      "Abilita il canale Agente Ospite QEMU.",
+      "Opzionalmente gestisce l'assistente passante GPU.",
+      "Genera una descrizione HTML stilizzata collegata al VM.",
+      "Avvia la VM se hai scelto di farlo."
+    ]
+  },
+  "virtio": {
+    "heading": "Driver VirtIO durante l'installazione",
+    "body": "Il creatore di VM usa per impostazione predefinita dischi SCSI con controller VirtIO SCSI e una scheda di rete VirtIO. Una ISO Windows standard può richiedere i relativi driver dall’ISO VirtIO montata su <code>ide3</code>. I dischi SATA funzionano normalmente con i driver inclusi in Windows; scegliere SATA non cambia la scheda di rete VirtIO.",
+    "warnTitle": "Carica il driver di rete VirtIO se Windows non ha rete",
+    "warnBody": "La VM usa una scheda di rete VirtIO (<code>virtio</code>). Se Windows non include il driver, caricalo durante l’installazione per accedere alla rete. Altrimenti attivazione e Windows Update potrebbero non essere disponibili al primo avvio.",
+    "stepLabel": "Passaggio",
+    "steps": [
+      {
+        "title": "Accedi alla schermata \"Dove vuoi installare Windows?\"",
+        "body": "Durante la configurazione di Windows, se non vengono mostrati dischi, il driver di archiviazione per l'interfaccia selezionata (SCSI o VirtIO) non è ancora caricato. Caricarlo manualmente dalla ISO VirtIO montata.",
+        "img": "/vm/windows/virtio-step-1.png",
+        "caption": "Configurazione di Windows senza dischi mostrati"
+      },
+      {
+        "title": "Fare clic su \"Carica driver\"",
+        "bodyRich": "Fai clic su <strong>Carica driver</strong>, sfoglia l’ISO VirtIO montata e scegli il driver di archiviazione adatto all’interfaccia selezionata.",
+        "img": "/vm/windows/virtio-step-2.png",
+        "caption": "Fai clic su Carica driver per sfogliare l’ISO VirtIO"
+      },
+      {
+        "title": "Sfoglia nella cartella corretta del driver",
+        "bodyRich": "Nell’ISO VirtIO scegli <code>vioscsi</code> per il controller VirtIO SCSI oppure <code>viostor</code> per i dischi a blocchi VirtIO. Scegli poi la sottocartella per versione Windows e architettura.",
+        "img": "/vm/windows/virtio-step-3.png",
+        "caption": "Sfoglia la cartella driver appropriata"
+      },
+      {
+        "title": "Selezionare il driver",
+        "bodyRich": "Windows elenca i driver disponibili. Scegliere quello che corrisponde alla configurazione (tipicamente <strong>Red Hat VirtIO SCSI controller</strong>) e fare clic su <strong>Next</strong>.",
+        "img": "/vm/windows/virtio-step-4.png",
+        "caption": "Selezionare il driver VirtIO che corrisponde all'interfaccia del disco"
+      },
+      {
+        "title": "(Opzionale) Installare il driver di rete",
+        "bodyRich": "Se hai anche scelto VirtIO come interfaccia di rete, carica il driver di rete dalla cartella <code>NetKVM</code> della stessa ISO, selezionando la sottocartella per la tua versione di Windows. Senza questo passaggio Windows installa senza accesso a Internet.",
+        "img": "/vm/windows/virtio-step-5.png",
+        "caption": "Caricare il driver di rete VirtIO per abilitare internet durante l'installazione"
+      }
+    ],
+    "tipTitle": "Post-installazione: eseguire virtio-win-guest-tools.exe",
+    "tipBody": "Dopo aver installato Windows, apri l’ISO VirtIO in Esplora file ed esegui <code>virtio-win-guest-tools.exe</code>. Installa i driver rimanenti (rete, schermo, input, ballooning) e QEMU Guest Agent in un’unica operazione."
+  },
+  "related": {
+    "heading": "Correlati",
+    "items": [
+      {
+        "href": "/docs/utils/UUp-Dump-ISO-Creator",
+        "label": "Creatore di ISO UUP Dump",
+        "tail": "— generare ISO di installazione di Windows aggiornate sull'host Proxmox."
+      },
+      {
+        "href": "/docs/disk-manager/import-disk-image-vm",
+        "label": "Importa immagine disco nella VM",
+        "tail": " — importa un’immagine disco Windows esistente (.vmdk, .qcow2, .img o .raw) in una VM esistente; converti prima le immagini .vhdx in un formato supportato."
+      },
+      {
+        "href": "/docs/hardware/gpu-vm-passthrough",
+        "label": "Aggiungi GPU a VM (Passthrough)",
+        "tail": "— per le VM Windows con GPU ad accelerazione hardware."
+      },
+      {
+        "href": "/docs/help-info/vm-ct-commands",
+        "label": "Comandi di gestione VM e CT",
+        "tail": "— riferimento qm CLI."
+      },
+      {
+        "href": "/docs/create-vm",
+        "label": "Panoramica della creazione di VM",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/it/docs/disk-manager/add-controller-nvme-vm.json b/web/messages/it/docs/disk-manager/add-controller-nvme-vm.json
new file mode 100644
index 00000000..3af536f0
--- /dev/null
+++ b/web/messages/it/docs/disk-manager/add-controller-nvme-vm.json
@@ -0,0 +1,128 @@
+{
+  "meta": {
+    "title": "Aggiungi controller o NVMe a VM | Documentazione ProxMenux",
+    "description": "Passthrough PCI di un controller di archiviazione (HBA SATA/SAS) o di un dispositivo NVMe a una VM Proxmox con ProxMenux. Gestisce l’attivazione di IOMMU, il rilevamento dei conflitti e l’assegnazione con qm set --hostpci.",
+    "ogTitle": "Aggiungi controller o NVMe a VM | Documentazione ProxMenux",
+    "ogDescription": "Assegna un intero HBA SATA/SAS o un dispositivo NVMe a una VM Proxmox. ProxMenux gestisce IOMMU, il rilevamento dei conflitti e l’assegnazione hostpci."
+  },
+  "header": {
+    "title": "Aggiungi controller o NVMe a VM",
+    "description": "Assegna un intero adattatore bus host SATA/SAS (HBA) o un dispositivo NVMe a una VM Proxmox tramite passthrough PCI. ProxMenux verifica IOMMU e, con il tuo consenso, lo abilita, elenca i dispositivi idonei, esclude i conflitti e configura l’assegnazione con qm set --hostpci.",
+    "section": "Gestione del disco · VM"
+  },
+  "intro": {
+    "title": "Ciò che fa (e non fa)",
+    "body": "Si tratta di <strong>passthrough a livello di dispositivo</strong>: la scheda PCIe esce dal controllo del kernel dell’host e viene associata a <code>vfio-pci</code>. La VM vede il controller stesso, anziché singoli dischi passati separatamente, e carica il proprio driver per quel modello. Tutti i dischi collegati lo seguono automaticamente, con dati SMART nativi, tutte le funzioni del firmware e nessuno strato Proxmox intermedio."
+  },
+  "howRuns": {
+    "heading": "Come funziona lo script",
+    "body": "Il flusso ha due fasi distinte: raccolta delle informazioni, verifica di IOMMU ed elenco dei candidati; poi assegnazione effettiva del dispositivo PCI. Fino alla conferma finale non viene scritto nulla nella configurazione della VM."
+  },
+  "iommu": {
+    "heading": "Gruppi IOMMU: perché occorre considerare l’intera scheda",
+    "body": "Il confine di isolamento del passthrough PCI è il <strong>gruppo IOMMU</strong>, la più piccola unità isolabile dall’IOMMU della CPU. I dispositivi nello stesso gruppo non possono essere isolati tra loro. Se un controller SATA condivide il gruppo con un controller USB, il passthrough SATA può richiedere di liberare anche l’USB dall’host oppure risultare impossibile. Non assegna automaticamente alla VM tutti i dispositivi del gruppo.",
+    "outro": "ProxMenux mostra il gruppo IOMMU accanto a ogni dispositivo e avvisa se il gruppo comprende altri dispositivi oltre al controller desiderato. Puoi procedere se gli altri dispositivi sono accettabili, ad esempio se sono tutti controller disco, oppure annullare."
+  },
+  "prereqs": {
+    "heading": "Prerequisiti",
+    "items": [
+      "<strong>CPU e scheda madre supportano</strong> VT-d (Intel) o AMD-Vi, e la funzione è abilitata nel firmware (BIOS/UEFI). ProxMenux può abilitare la parte kernel, ma non modificare l’impostazione del firmware.",
+      "La VM di destinazione è <strong>spenta</strong> prima di collegare dispositivi PCI.",
+      "Il controller/NVMe <strong>non ospita il filesystem root di Proxmox</strong>. Lo script nasconde tutto ciò che è in uso dall’host.",
+      "Il sistema operativo guest dispone dei driver per il modello del controller. Linux supporta quasi tutti gli HBA senza driver aggiuntivi; Windows richiede il driver del produttore installato <em>prima</em> di avviare con il controller collegato."
+    ],
+    "warnTitle": "La migrazione dal vivo non è possibile",
+    "warnBody": "Un VM con passante PCI è legato al nodo che tiene fisicamente la scheda. La migrazione dal vivo attraverso i nodi fallirà. Pianifica backup / replica di conseguenza."
+  },
+  "steps": {
+    "heading": "Passo dopo passo",
+    "stepLabel": "Passaggio",
+    "list": [
+      {
+        "title": "Scegli la VM di destinazione",
+        "bodyRich": "ProxMenux legge <code>qm list</code> e mostra tutte le VM. Scegli quella che riceverà il controller.",
+        "img": "/disk/nvme-passthrough/vm-selection.png",
+        "alt": "dialogo di selezione VM",
+        "caption": "dialogo di selezione VM"
+      },
+      {
+        "title": "Controllo IOMMU",
+        "bodyRich": "Se IOMMU non è abilitato sul kernel cmdline, ProxMenux offre per abilitarlo. Modifica <code>/etc/kernel/cmdline</code> (per systemd-boot) o <code>/etc/default/grub</code> (per GRUB) e aggiunge il parametro corretto per il tuo CPU:",
+        "items": [
+          "<code>intel_iommu=on</code> per CPU Intel.",
+          "<code>amd_iommu=on</code> per CPU AMD."
+        ],
+        "outro": "Un riavvio è richiesto dopo questo cambiamento. Lo script richiede di riavviare ora o più tardi; il passthrough non può continuare fino a quando il nuovo kernel cmdline è attivo.",
+        "img": "/disk/nvme-passthrough/iommu-warning.png",
+        "alt": "Finestra IOMMU richiesto",
+        "caption": "IOMMU richiesto — offerta per abilitare e riavviare"
+      },
+      {
+        "title": "Enumerazione del dispositivo",
+        "body": "ProxMenux elenca ogni controller di archiviazione (SATA / SAS HBA) e ogni dispositivo NVMe sul bus PCI. Per ogni dispositivo mostra:",
+        "items": [
+          "Indirizzo PCI (<code>00:17.0</code>, <code>01:00.0</code>, ...).",
+          "Descrizione del produttore e del dispositivo.",
+          "gruppo IOMMU — e un avviso ⚠ se il gruppo è condiviso con altri dispositivi non correlati.",
+          "I dischi attualmente dietro il controller (quindi sai cosa lo seguirà al VM)."
+        ],
+        "img": "/disk/nvme-passthrough/device-list.png",
+        "alt": "Elenco dei controller e dei dispositivi NVMe",
+        "caption": "Elenco dei controller e dei dispositivi NVMe con informazioni sui gruppi IOMMU"
+      },
+      {
+        "title": "Rilevamento dei conflitti",
+        "bodyRich": "Lo script blocca i dispositivi chiaramente non sicuri: quelli già assegnati a un’altra VM tramite <code>hostpci</code> nella relativa configurazione, quelli in uso dall’host come il controller del disco root e quelli in un gruppo IOMMU i cui altri membri non possono essere identificati con sicurezza. I dispositivi idonei sono disponibili per la selezione.",
+        "img": "/disk/nvme-passthrough/conflict-warning.png",
+        "alt": "Avvertenza di rilevamento conflitti",
+        "caption": "Rilevamento di conflitti — dispositivo bloccato con ragione"
+      },
+      {
+        "title": "Assegna e concludi",
+        "bodyRich": "Per ogni dispositivo selezionato ProxMenux esegue <code>qm set &lt;VMID&gt; --hostpciN &lt;pci-addr&gt;,pcie=1</code>, scegliendo il successivo slot <code>hostpci</code> libero. Se IOMMU è stato abilitato durante questa sessione, viene ricordato di riavviare l’host prima di avviare la VM.",
+        "img": "/disk/nvme-passthrough/assignment.png",
+        "alt": "Riepilogo delle assegnazioni",
+        "caption": "Riepilogo delle assegnazioni — slot hostpciN e indirizzi PCI allegati"
+      }
+    ]
+  },
+  "manual": {
+    "heading": "Equivalente manuale"
+  },
+  "troubleshoot": {
+    "heading": "Risoluzione dei problemi",
+    "noGroupsTitle": "IOMMU abilitato ma nessun gruppo sotto /sys/kernel/iommu_groups/",
+    "noGroupsBody": "È necessario riavviare perché la nuova riga di comando del kernel abbia effetto. Se i gruppi mancano ancora dopo il riavvio, VT-d/AMD-Vi è probabilmente disabilitato nel firmware: controlla le impostazioni BIOS/UEFI.",
+    "busyTitle": "La VM non si avvia: \"hostpciN: device busy\"",
+    "busyBody": "Un altro processo mantiene occupato il dispositivo PCI. Le cause più comuni sono una VM arrestatasi in modo anomalo senza liberarlo o il kernel dell’host che lo ha ripreso all’ultimo avvio. Esegui <code>lspci -nnk -s &lt;addr&gt;</code> per vedere il driver associato: dovrebbe essere <code>vfio-pci</code>. Un riavvio completo dell’host solitamente risolve il problema.",
+    "noDisksTitle": "Guest vede il controller ma non i dischi",
+    "noDisksBody": "Nel guest manca il driver per il modello del controller. Su Linux succede raramente, su Windows sì: installa il driver del produttore, ad esempio LSI/Broadcom per i vecchi HBA SAS, mentre la scheda non è assegnata, poi riavvia con la scheda assegnata.",
+    "sharedTitle": "Il gruppo IOMMU include un dispositivo non correlato",
+    "sharedBody": "Opzioni: (a) spostare la scheda in una diversa slot PCIe per cambiare il suo gruppo, (b) abilitare <em>ACS override</em> nel kernel per dividere i gruppi (sicurezza trade-off - ricerca prima di applicare), o (c) scegliere una scheda diversa in un gruppo più pulito."
+  },
+  "related": {
+    "heading": "Correlati",
+    "items": [
+      {
+        "href": "/docs/disk-manager/import-disk-vm",
+        "label": "Importa disco nella VM",
+        "tail": "— modello alternativo: collegare un disco fisico tramite Proxmox senza passante PCIe completo."
+      },
+      {
+        "href": "/docs/hardware/gpu-vm-passthrough",
+        "label": "Aggiungi GPU a VM (Passthrough)",
+        "tail": "— stessi concetti IOMMU / VFIO applicati a un GPU."
+      },
+      {
+        "href": "/docs/help-info/gpu-commands",
+        "label": "Comandi di passaggio GPU",
+        "tail": "— I comandi di verifica IOMMU si applicano anche al controller / passthrough NVMe."
+      },
+      {
+        "href": "/docs/disk-manager",
+        "label": "Panoramica di Disk Manager",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/it/docs/disk-manager/format-disk.json b/web/messages/it/docs/disk-manager/format-disk.json
new file mode 100644
index 00000000..a83bcf38
--- /dev/null
+++ b/web/messages/it/docs/disk-manager/format-disk.json
@@ -0,0 +1,142 @@
+{
+  "meta": {
+    "title": "Formatta o cancella un disco fisico | Documentazione ProxMenux",
+    "description": "Cancella e formatta dischi fisici su Proxmox VE con ProxMenux. Quattro modalità, filtri rigorosi che escludono i dischi di sistema, montati o in uso e doppia conferma con inserimento del percorso completo.",
+    "ogTitle": "Formatta o cancella un disco fisico | Documentazione ProxMenux",
+    "ogDescription": "Pulire in modo sicuro o formattare un disco fisico su Proxmox. Regole di visibilità sicure, modalità di funzionamento 4, doppia conferma."
+  },
+  "header": {
+    "title": "Formatta o cancella un disco fisico",
+    "description": "Cancella in modo sicuro o formatta un disco fisico sull’host Proxmox. ProxMenux mostra solo i dischi completamente liberi: nessun uso da parte del sistema, nessun riferimento nei guest e nessun filesystem montato. Prima di distruggere i dati richiede una doppia conferma: sì/no e inserimento del percorso completo del disco.",
+    "section": "Disk Manager · Utilità"
+  },
+  "danger": {
+    "title": "Strumento distruttivo",
+    "body": "Ogni operazione scrive sul disco e non può essere annullata. ProxMenux applica filtri e conferme rigorosi, ma la responsabilità di scegliere il disco corretto è tua. Leggi il percorso del disco ad alta voce due volte prima di digitarlo."
+  },
+  "howRuns": {
+    "heading": "Come funziona lo script",
+    "body": "Il flusso ha due fasi con un filtro di sicurezza a tripla porta in mezzo. L'elenco dei dischi, la modalità di funzionamento e i dettagli del file system sono tutti raccolti in Fase 1; nulla è scritto fino a quando la Fase 2 passa una ri-validazione finale prima di eseguire."
+  },
+  "visibility": {
+    "heading": "Regole di visibilità",
+    "intro": "Prima che il menu venga visualizzato, ProxMenux filtra l'elenco dei dischi. Solo i candidati che sono provabilmente sicuri sono mostrati:",
+    "items": [
+      "<strong>Mostrati</strong>: dischi <em>non</em> usati dall’host (pool root, swap, filesystem montati, ZFS/LVM/RAID attivi) e <em>non</em> citati in configurazioni VM/LXC, sia avviate sia arrestate.",
+      "<strong>Nascosti</strong>: dischi dell’host e di sistema.",
+      "<strong>Nascosti</strong>: dischi citati in una configurazione VM/LXC."
+    ],
+    "safetyTitle": "Sicurezza alla conferma e all'esecuzione",
+    "safetyItems": [
+      "I dischi con metadati obsoleti o attivi mostrano avvisi dettagliati <em>prima</em> della conferma.",
+      "I dischi usati da una VM <strong>in esecuzione</strong> sono <strong>bloccati senza possibilità di procedere</strong> alla conferma.",
+      "I dischi con partizioni montate sono <strong>bloccati senza possibilità di procedere</strong> all’esecuzione. Una nuova verifica avviene subito prima di qualsiasi scrittura.",
+      "Sono sempre necessarie due conferme: una finestra <em>sì/no</em> e l’inserimento esatto del percorso completo del disco."
+    ]
+  },
+  "modes": {
+    "heading": "Modalità di funzionamento",
+    "intro": "Dopo aver scelto un disco si sceglie una delle quattro modalità. Essi differiscono in quello che distruggono e ciò che lasciano dietro:",
+    "headerMode": "Modalità",
+    "headerPart": "Tabella delle partizioni",
+    "headerData": "Dati",
+    "headerUseCase": "Caso di utilizzo",
+    "rows": [
+      {
+        "mode": "1. Pulisci tutto",
+        "part": "Distrutto",
+        "data": "Firme cancellate",
+        "useCase": "Rimuove la tabella delle partizioni e i metadati di file system e RAID, azzera i primi e gli ultimi 16 MiB e, sulle unità che supportano discard, esegue il TRIM dell’intero disco. Il resto dei dati non viene sovrascritto e su un HDD potrebbe essere ancora recuperabile; non è una cancellazione sicura."
+      },
+      {
+        "mode": "2. Rimuovere le etichette FS",
+        "part": "Conservato",
+        "data": "Conservato",
+        "useCase": "Rimuove le vecchie firme ZFS / LVM / RAID per evitare l’acquisizione automatica del disco. I dati utente non vengono sovrascritti in massa, ma la rimozione delle firme può renderli inaccessibili."
+      },
+      {
+        "mode": "3. Sovrascrivi i dati con zeri",
+        "part": "Conservato",
+        "data": "Distrutti (sovrascritti con zeri)",
+        "useCase": "Sovrascrive con zeri le partizioni esistenti conservando la tabella delle partizioni. Non comprende lo spazio non allocato e le aree di riserva degli SSD; non garantisce una sanificazione completa del dispositivo."
+      },
+      {
+        "mode": "4. Formattazione completa",
+        "part": "Nuovo GPT",
+        "data": "Distrutto",
+        "useCase": "Disco pronto all'uso con una singola nuova partizione e un filesystem fresco."
+      }
+    ],
+    "fullFormatOutro": "<strong>Formattazione completa</strong> prosegue con altre due finestre:",
+    "fullFormatItems": [
+      "<strong>Filesystem</strong>: <code>ext4</code>, <code>xfs</code>, <code>exfat</code> (portabile) o <code>btrfs</code>. Se mancano strumenti come <code>mkfs.btrfs</code>, l’operazione si interrompe con un messaggio chiaro.",
+      "<strong>Etichetta</strong>: etichetta facoltativa del filesystem per identificarlo."
+    ]
+  },
+  "steps": {
+    "heading": "Passo dopo passo",
+    "stepLabel": "Passaggio",
+    "list": [
+      {
+        "title": "Scegli un disco libero",
+        "body": "ProxMenux elenca ogni disco che passa i filtri di visibilità sopra. I dischi con marcatori ⚠ portano metadati stanti e vengono mostrati con i dettagli in modo da sapere cosa stai per sovrascrivere."
+      },
+      {
+        "title": "Scegli una modalità di funzionamento",
+        "bodyRich": "Scegli <strong>Pulisci tutto</strong>, <strong>Rimuovere le etichette FS</strong>, <strong>Sovrascrivi i dati con zeri</strong> o <strong>Formattazione completa</strong> secondo la tabella sopra."
+      },
+      {
+        "title": "(Solo formattazione completa) Scegli filesystem ed etichetta",
+        "body": "ext4 / xfs / exfat / btrfs, più un'etichetta opzionale."
+      },
+      {
+        "title": "Confermare due volte",
+        "bodyRich": "ProxMenux mostra un riassunto di ciò che accadrà. Si accetta con una finestra di dialogo sì/no e <strong> digitare il percorso completo del disco</strong> esattamente come mostrato (ad esempio <code>/dev/sdc</code>). Tutto il resto si interrompe."
+      },
+      {
+        "title": "Nuova verifica ed esecuzione",
+        "body": "Subito prima di scrivere, lo script ricontrolla lo stato del disco. Se nel frattempo è stata montata una partizione o avviata una VM, l’esecuzione viene annullata. Altrimenti viene eseguita l’operazione scelta e mostrato un riepilogo finale."
+      }
+    ]
+  },
+  "manual": {
+    "heading": "Equivalenti manuali",
+    "body": "Se si preferisce eseguire i comandi equivalenti a mano:"
+  },
+  "troubleshoot": {
+    "notListedTitle": "Disco non elencato nel menu",
+    "notListedBody": "È stato filtrato per la sicurezza. Motivi comuni: è montato (anche a <code>/mnt/tmp</code>), è un membro attivo ZFS / LVM / RAID, è riferito da una configurazione VM o LXC, o è il disco radice Proxmox. Eseguire <code>lsblk -f</code> e <code>cat /proc/mdstat</code> sull'host per capire perché.",
+    "busyTitle": "\"Disk may be busy\" / smontaggio non riuscito",
+    "busyBody": "Un processo mantiene aperto un file in una partizione del disco, spesso un contenitore o una shell la cui directory corrente si trova nel punto di mount. Identificalo con <code>lsof | grep /dev/sdX</code> o <code>fuser -vm /dev/sdX1</code>, arrestalo e riesegui lo strumento."
+  },
+  "related": {
+    "heading": "Correlati",
+    "items": [
+      {
+        "href": "/docs/disk-manager/smart-disk-test",
+        "label": "Integrità e test disco SMART",
+        "tail": "— controllare un disco prima / dopo aver pulito per confermare che è sano."
+      },
+      {
+        "href": "/docs/disk-manager/import-disk-vm",
+        "label": "Importa disco nella VM",
+        "tail": "— passare un disco appena formattato a un VM."
+      },
+      {
+        "href": "/docs/storage-share/host-local-disk",
+        "label": "Aggiungere disco locale come archiviazione Proxmox",
+        "tail": "— registrare un disco cancellato come un pool di archiviazione Proxmox."
+      },
+      {
+        "href": "/docs/help-info/storage-commands",
+        "label": "Comandi di archiviazione e dischi",
+        "tail": " — riferimento per lsblk, blkid e parted."
+      },
+      {
+        "href": "/docs/disk-manager",
+        "label": "Panoramica di Disk Manager",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/it/docs/disk-manager/import-disk-image-vm.json b/web/messages/it/docs/disk-manager/import-disk-image-vm.json
new file mode 100644
index 00000000..bd8c3cc0
--- /dev/null
+++ b/web/messages/it/docs/disk-manager/import-disk-image-vm.json
@@ -0,0 +1,110 @@
+{
+  "meta": {
+    "title": "Importa immagine del disco a VM | Documentazione ProxMenux",
+    "description": "Importa un file immagine disco (.img / .qcow2 / .vmdk / .raw) in una VM Proxmox esistente con ProxMenux. Interfaccia, emulazione SSD e opzione di avvio per ogni immagine, tramite qm importdisk.",
+    "ogTitle": "Importa immagine del disco a VM | Documentazione ProxMenux",
+    "ogDescription": "Importare .img / .qcow2 / .vmdk / .raw immagini disco in un VM esistente con ProxMenux. Utilizza qm importdisk sotto il cofano."
+  },
+  "header": {
+    "title": "Importa immagine disco nella VM",
+    "description": "Importa un file immagine disco (.img, .qcow2, .vmdk o .raw) in una VM Proxmox esistente. ProxMenux raccoglie prima tutte le scelte: VM di destinazione, storage Proxmox, directory sorgente, interfaccia, emulazione SSD e ordine di avvio. Poi esegue qm importdisk per ogni immagine selezionata.",
+    "section": "Gestione del disco · VM"
+  },
+  "intro": {
+    "title": "Che cosa fa",
+    "body": "A differenza di <em>Importa disco nella VM</em>, che collega un disco fisico direttamente, questa procedura usa un <strong>file</strong> sull’host, esportato da un altro hypervisor, scaricato come immagine cloud o estratto da un backup. Lo converte in un disco di VM Proxmox sullo storage scelto. Il file originale viene conservato: ProxMenux lo copia senza spostarlo."
+  },
+  "howRuns": {
+    "heading": "Come funziona lo script",
+    "body": "Il flusso ha due fasi. La prima raccoglie tutte le scelte tramite finestre di dialogo: VM, storage, directory sorgente, immagini e opzioni per ciascuna immagine. La seconda esegue <code>qm importdisk</code> per ogni immagine selezionata. Prima della seconda fase non viene copiato nulla né modificata la configurazione della VM."
+  },
+  "prereqs": {
+    "heading": "Prerequisiti",
+    "items": [
+      "Almeno una VM è definita sull’host. La VM di destinazione dovrebbe essere <strong>spenta</strong>.",
+      "Almeno un file di immagine di un formato supportato nella directory sorgente. Supportato: <code>.img</code>, <code>.qcow2</code>, <code>.vmdk</code>, <code>.raw</code>.",
+      "Abbastanza spazio libero sullo storage Proxmox di destinazione per tenere ogni disco importato.",
+      "ProxMenux cerca le immagini in <code>/var/lib/vz/template/iso</code> per impostazione predefinita. È possibile indicarlo a qualsiasi altra directory sull'host quando chiede."
+    ]
+  },
+  "steps": {
+    "heading": "Passo dopo passo",
+    "stepLabel": "Passaggio",
+    "list": [
+      {
+        "title": "Scegli la VM di destinazione",
+        "bodyRich": "ProxMenux legge <code>qm list</code> e mostra tutte le VM. Scegli quella che riceverà i dischi importati."
+      },
+      {
+        "title": "Scegli lo storage Proxmox",
+        "bodyRich": "L'elenco contiene ogni archiviazione che ha il tipo di contenuto <code>images</code> abilitato. Se c'è solo un candidato è selezionato automaticamente e la finestra di dialogo è saltata."
+      },
+      {
+        "title": "Scegli la directory sorgente",
+        "bodyRich": "Scegliere la directory predefinita (<code>/var/lib/vz/template/iso</code>) o digitare un percorso personalizzato — in genere dove hai scaricato / caricato l'immagine. Lo script rifiuta i percorsi che non esistono."
+      },
+      {
+        "title": "Scegli una o più immagini",
+        "bodyRich": "La directory viene scansionata per i file <code>.img</code> / <code>.qcow2</code> / <code>.vmdk</code> / <code>.raw</code>. È possibile selezionare diversi in una sola volta; ognuno passerà attraverso le opzioni per-immagine nella fase successiva."
+      },
+      {
+        "title": "Opzioni per immagine",
+        "intro": "Per ogni immagine selezionata ProxMenux chiede:",
+        "items": [
+          "<strong>Interface</strong> — <code>scsi</code> (default), <code>virtio</code>, <code>sata</code> o <code>ide</code>. Corrisponde a come l'ospite vedrà il disco.",
+          "<strong>Emulazione SSD</strong>: disponibile solo per interfacce diverse da VirtIO. Aggiunge <code>ssd=1</code> affinché il guest riconosca un disco a stato solido. Il supporto discard/TRIM va configurato separatamente.",
+          "<strong>Avviabile</strong>: scegliendo sì, ProxMenux aggiunge il disco all’ordine di avvio come dispositivo principale della VM."
+        ]
+      },
+      {
+        "title": "Importa e collega",
+        "bodyRich": "ProxMenux esegue <code>qm importdisk</code> per ogni immagine, convertendo il formato se necessario, e collega il disco al successivo slot libero (<code>scsiN</code>, <code>sataN</code>, …) con le opzioni scelte. Se hai segnato un disco come avviabile, aggiorna l’ordine di avvio. L’avanzamento compare nel terminale."
+      }
+    ]
+  },
+  "manual": {
+    "heading": "Equivalente manuale",
+    "body": "L’importazione di una singola immagine corrisponde a tre comandi <code>qm</code>:",
+    "warnTitle": "Conversione formato immagine",
+    "warnBody": "Quando lo storage di destinazione non può contenere il formato sorgente in modo nativo (ad esempio, lo storage LVM non può contenere <code>.qcow2</code>), <code>qm importdisk</code> converte l'immagine in modo trasparente. Questo può richiedere diversi minuti per immagini multi-GB; pianificare di conseguenza e non interrompere lo script."
+  },
+  "troubleshoot": {
+    "heading": "Risoluzione dei problemi",
+    "noImagesTitle": "\"Non sono state trovate immagini disco compatibili\"",
+    "noImagesBody": "Lo script non ha trovato file <code>.img</code>, <code>.qcow2</code>, <code>.vmdk</code> o <code>.raw</code>. Controlla l’estensione, distinguendo maiuscole e minuscole, che il file sia direttamente nella directory scelta (le sottodirectory non vengono cercate) e che root possa leggerlo.",
+    "slowTitle": "L'importazione è lenta",
+    "slowBody": "Le conversioni tra VMDK, QCOW2 e raw possono essere limitate da CPU e I/O. La velocità dipende dalle letture all’origine, dalle scritture a destinazione e dall’eventuale decompressione. Preferisci sorgenti raw o qcow2 quando possibile.",
+    "uefiTitle": "Il disco importato si avvia nella shell UEFI",
+    "uefiBody": "L'immagine è stata costruita per legacy (SeaBIOS) ma il VM utilizza OVMF (o viceversa). O commutare il VM di BIOS in Proxmox per abbinare l'immagine, o ricostruire l'immagine nella modalità corretta prima dell'importazione."
+  },
+  "related": {
+    "heading": "Correlati",
+    "items": [
+      {
+        "href": "/docs/disk-manager/import-disk-vm",
+        "label": "Importa disco nella VM",
+        "tail": "— stesso flusso ma per dischi fisici grezzi (passthrough)."
+      },
+      {
+        "href": "/docs/utils/import-vm",
+        "label": "Importa VM da OVA / OVF",
+        "tail": "— quando hai un pacchetto completo VM, non solo un'immagine del disco."
+      },
+      {
+        "href": "/docs/utils/UUp-Dump-ISO-Creator",
+        "label": "Creatore di ISO UUP Dump",
+        "tail": "— generare una ISO di Windows se ne avete bisogno per una nuova installazione."
+      },
+      {
+        "href": "/docs/help-info/storage-commands",
+        "label": "Comandi di archiviazione e dischi",
+        "tail": " — riferimento per qm importdisk e qemu-img convert."
+      },
+      {
+        "href": "/docs/disk-manager",
+        "label": "Panoramica di Disk Manager",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/it/docs/disk-manager/import-disk-lxc.json b/web/messages/it/docs/disk-manager/import-disk-lxc.json
new file mode 100644
index 00000000..c8221ee9
--- /dev/null
+++ b/web/messages/it/docs/disk-manager/import-disk-lxc.json
@@ -0,0 +1,115 @@
+{
+  "meta": {
+    "title": "Importa disco in LXC | Documentazione ProxMenux",
+    "description": "Collega un disco fisico a un contenitore LXC esistente su Proxmox VE con ProxMenux. Gestisce rilevamento e formattazione del filesystem, punto di mount, conversione da non privilegiato a privilegiato e percorsi persistenti dei dispositivi.",
+    "ogTitle": "Importa disco in LXC | Documentazione ProxMenux",
+    "ogDescription": "Collega un disco fisico a un contenitore LXC esistente. Gestisce filesystem, punto di mount e conversione da non privilegiato a privilegiato."
+  },
+  "header": {
+    "title": "Importa disco su LXC",
+    "description": "Collegare un disco fisico a un contenitore LXC esistente sull'host Proxmox. ProxMenux rileva dischi liberi, li formatta facoltativamente con un filesystem supportato, e collega la partizione a un punto di montaggio all'interno del contenitore utilizzando percorsi di dispositivo persistenti.",
+    "section": "Gestione del disco · LXC"
+  },
+  "intro": {
+    "title": "Passthrough VM e passthrough LXC",
+    "body": "Questo passthrough LXC <strong>non fornisce un dispositivo a blocchi grezzo</strong>. Il contenitore riceve un <em>punto di mount</em>, cioè una directory su una partizione scelta nell’host. A differenza di una VM, usa il kernel dell’host: il filesystem (ext4/xfs/btrfs) viene quindi letto e gestito dall’host Proxmox ed esposto al contenitore."
+  },
+  "howRuns": {
+    "heading": "Come funziona lo script",
+    "body": "Il flusso ha due fasi distinte: raccolta di informazioni e scelte, poi modifica effettiva della configurazione del contenitore. Fino alla conferma finale non viene montato nulla nel CT.",
+    "summary": "ProxMenux esclude il disco root, i dischi montati e quelli citati in configurazioni VM/LXC. I membri attivi ZFS/LVM/RAID sono nascosti; le vecchie firme sono segnalate con ⚠ per poterle cancellare prima della formattazione."
+  },
+  "prereqs": {
+    "heading": "Prerequisiti",
+    "items": [
+      "Almeno un contenitore LXC definito sull'host.",
+      "Il contenitore è <strong>privilegiato</strong> oppure accetti la conversione proposta dallo script.",
+      "Almeno un disco fisico non in uso dall'host o da qualsiasi altro ospite."
+    ],
+    "warnTitle": "Contenitore privilegiato richiesto",
+    "warnBody": "Questo script richiede un contenitore <strong>privilegiato</strong> per collegare direttamente il disco. Se rileva <code>unprivileged: 1</code>, propone di modificare <code>/etc/pve/lxc/&lt;CTID&gt;.conf</code> sul posto. Ciò cambia il modello di sicurezza senza rimappare i proprietari dei file esistenti. Salva un backup e verifica i proprietari prima di accettare, oppure ricrea il contenitore come privilegiato."
+  },
+  "steps": {
+    "heading": "Passo dopo passo",
+    "stepLabel": "Passaggio",
+    "list": [
+      {
+        "title": "Scegli il contenitore di destinazione",
+        "img": "/disk/select-container.png",
+        "caption": "Menu di selezione del contenitore",
+        "bodyRich": "ProxMenux elenca tutti i contenitori LXC sull’host (<code>pct list</code>). Scegli quello che riceverà il disco. Se non è privilegiato, viene proposta la conversione."
+      },
+      {
+        "title": "Scegli il disco fisico",
+        "img": "/disk/disk-selection-ct.png",
+        "caption": "Dischi liberi rilevati sull’host, con ⚠ per i metadati obsoleti",
+        "bodyRich": "Vengono mostrati solo candidati sicuri. A differenza della procedura per VM, questo script collega <strong>un disco per esecuzione</strong>. Rieseguilo per ogni disco aggiuntivo."
+      },
+      {
+        "title": "Formatta o riutilizza",
+        "intro": "Lo script ispeziona il disco:",
+        "items": [
+          "Se già trasporta un filesystem supportato (ext4 / xfs / btrfs) è possibile riutilizzarlo come-è (i file esistenti sono conservati).",
+          "Se non ha un filesystem supportato, ti viene offerto di formattarlo. Scegli ext4 / xfs / btrfs."
+        ]
+      },
+      {
+        "title": "Scegli il punto di montaggio",
+        "bodyRich": "Inserisci il percorso in cui il contenitore vedrà il disco, ad esempio <code>/mnt/data</code> o <code>/mnt/disk_passthrough</code>. È il percorso <em>all’interno</em> del contenitore; l’host vede già la partizione in <code>/dev/disk/by-id/…</code>."
+      },
+      {
+        "title": "Collega e verifica",
+        "img": "/disk/assignment-ct.png",
+        "caption": "Assegnazione a CT",
+        "bodyRich": "ProxMenux aggiunge una nuova voce <code>mpN:</code> alla configurazione del container, evitando gli indici già in uso, quindi rilegge la configurazione per verificarla. Se il container è in esecuzione, il montaggio viene applicato subito; altrimenti entrerà in funzione al prossimo avvio.",
+        "extraImg": "/disk/result-point.png",
+        "extraAlt": "Punto di montaggio creato con successo",
+        "extraCaption": "Punto di montaggio creato e verificato"
+      }
+    ]
+  },
+  "manual": {
+    "heading": "Equivalente manuale",
+    "body": "Lo script avvolge <code>pct set</code>. Un'invocazione diretta per un singolo disco sembra:"
+  },
+  "important": {
+    "heading": "Considerazioni importanti",
+    "items": [
+      "<strong>Un disco per esecuzione</strong>. Riesegui lo script per ogni disco aggiuntivo.",
+      "<strong>non</strong> collegare la stessa partizione a diversi contenitori che potrebbero montarla simultaneamente: le scritture simultanee corrompono il filesystem.",
+      "<strong>I vecchi metadati</strong> (firme RAID/ZFS/LVM) vanno cancellati manualmente prima che lo script consenta di formattare, altrimenti <code>mkfs</code> rifiuta di sovrascrivere. Usa <wipeLink>Formatta o cancella un disco fisico</wipeLink>."
+    ]
+  },
+  "troubleshoot": {
+    "heading": "Risoluzione dei problemi",
+    "unprivTitle": "\"Impossibile proseguire con un contenitore non privilegiato\"",
+    "unprivBody": "Hai rifiutato la conversione, quindi lo script si è fermato senza modificare nulla. Per continuare, eseguilo di nuovo e accetta: lo script arresta il contenitore, salva la sua configurazione in <code>/etc/pve/lxc/&lt;CTID&gt;.conf.bak</code> e sostituisce <code>unprivileged: 1</code> con <code>unprivileged: 0</code>. Questa modifica da sola non converte la proprietà UID/GID dei file esistenti: esegui prima un backup del contenitore e correggi i proprietari, oppure ripristina o ricrea il contenitore come privilegiato.",
+    "permsTitle": "Le autorizzazioni all'interno del contenitore sono sbagliate",
+    "permsBody": "Montare una partizione in un contenitore privilegiato conserva i proprietari esistenti; un filesystem appena formattato appartiene spesso a <code>root:root</code>. Se il servizio usa un altro utente, ad esempio <code>www-data</code> per Nextcloud, controlla UID/GID e modifica i file necessari con <code>chown</code>/<code>chmod</code>. Le modifiche agiscono anche sul disco sottostante."
+  },
+  "related": {
+    "heading": "Correlati",
+    "items": [
+      {
+        "href": "/docs/disk-manager/import-disk-vm",
+        "label": "Importa disco nella VM",
+        "tail": "— flusso equivalente per le VM."
+      },
+      {
+        "href": "/docs/storage-share/lxc-mount-points",
+        "label": "Punti di montaggio LXC (Host ↔ CT)",
+        "tail": "— condividere directory host con un CT invece di allegare un disco intero."
+      },
+      {
+        "href": "/docs/help-info/vm-ct-commands",
+        "label": "Comandi di gestione VM e CT",
+        "tail": "— pct config / push / pull reference."
+      },
+      {
+        "href": "/docs/disk-manager",
+        "label": "Panoramica di Disk Manager",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/it/docs/disk-manager/import-disk-vm.json b/web/messages/it/docs/disk-manager/import-disk-vm.json
new file mode 100644
index 00000000..44df1ca3
--- /dev/null
+++ b/web/messages/it/docs/disk-manager/import-disk-vm.json
@@ -0,0 +1,113 @@
+{
+  "meta": {
+    "title": "Importa disco in una VM | Documentazione ProxMenux",
+    "description": "Collegare un disco fisico a un Proxmox VM esistente con ProxMenux. Rilevamento sicuro del disco (esclude il sistema, montato, in-uso, ZFS/RAID/LVM), persistenti percorsi /dev/disk/by-id e interfacce SATA / SCSI / VirtIO / IDE.",
+    "ogTitle": "Importa disco in una VM | Documentazione ProxMenux",
+    "ogDescription": "Collegare un disco fisico a un Proxmox VM esistente. Utilizza percorsi /dev/disk/by-id persistenti e supporta SATA / SCSI / VirtIO / IDE."
+  },
+  "header": {
+    "title": "Importa disco nella VM",
+    "description": "Collegare un disco fisico che esiste già sull'host Proxmox ad una macchina virtuale esistente. ProxMenux rileva dischi liberi, consente di scegliere il target VM, il tipo di bus (SATA / SCSI / VirtIO / IDE) e allega tutto utilizzando percorsi /dev/disk/by-id persistenti in modo che la mappatura sopravviva ai riavvimenti e alle modifiche dell'ordine del dispositivo.",
+    "section": "Gestione del disco · VM"
+  },
+  "intro": {
+    "title": "Che cosa fa",
+    "body": "Collega un disco fisico grezzo come supporto di un’interfaccia disco virtuale. Il guest non riceve automaticamente i dati SMART nativi o le funzioni del controller fisico; usa il passthrough PCI del controller se servono. Il disco viene collegato tramite il suo percorso <code>/dev/disk/by-id/…</code> quando esiste, così un diverso ordine di enumerazione all’avvio non interrompe l’assegnazione; altrimenti si usa <code>/dev/sdX</code>."
+  },
+  "howRuns": {
+    "heading": "Come funziona lo script",
+    "body": "Il flusso ha due fasi distinte: raccolta delle informazioni e delle scelte, poi collegamento effettivo dei dischi alla VM. La configurazione resta invariata fino alla conferma finale.",
+    "summary": "ProxMenux esclude i candidati non sicuri: disco root, dischi montati sull’host, membri attivi ZFS/LVM/RAID e dischi citati in configurazioni VM/LXC. I dischi con metadati <em>obsoleti</em>, cioè vecchie firme ZFS/RAID/LVM non più in uso, sono segnalati con ⚠ ma non bloccati."
+  },
+  "prereqs": {
+    "heading": "Prerequisiti",
+    "items": [
+      "Almeno un VM definito sull'host (lo script invia direttamente a <code>qm list</code>).",
+      "La <strong>VM di destinazione è spenta</strong>. Se è in esecuzione, lo script si interrompe con un messaggio; l’aggiunta a caldo dei dischi non rientra in questa procedura.",
+      "Almeno un disco fisico sull'host che non è in uso dall'host o da qualsiasi altro ospite."
+    ]
+  },
+  "steps": {
+    "heading": "Passo dopo passo",
+    "stepLabel": "Passaggio",
+    "list": [
+      {
+        "title": "Scegli la VM di destinazione",
+        "bodyRich": "ProxMenux elenca tutte le VM dell’host con <code>qm list</code>. Scegli quella che riceverà il disco. Se è in esecuzione, lo script si interrompe e chiede di spegnerla prima."
+      },
+      {
+        "title": "Scegli i dischi fisici da collegare",
+        "img": "/disk/disk-selection.png",
+        "caption": "Dischi liberi rilevati sull’host, con ⚠ per i metadati obsoleti",
+        "body": "Lo script esamina i dischi dell’host e propone solo quelli collegabili senza conflitti. Puoi selezionarne più di uno. I dischi con vecchie firme ZFS/LVM/RAID restano visibili con ⚠, per indicare che occorre cancellare le firme prima che il guest li formatti."
+      },
+      {
+        "title": "Scegli l’interfaccia bus",
+        "img": "/disk/disk-assigment.png",
+        "caption": "Selezione dell'interfaccia bus",
+        "intro": "Scegliere come l'ospite dovrebbe vedere il disco:",
+        "items": [
+          "<strong>SCSI</strong> — default moderno per Linux e Windows con driver VirtIO-SCSI installati.",
+          "<strong>SATA</strong> — ampia compatibilità, funziona fuori dalla scatola praticamente ogni ospite.",
+          "<strong>VirtIO</strong>: dispositivo a blocchi paravirtualizzato efficiente; richiede driver nel guest.",
+          "<strong>IDE</strong> — per ospiti legacy che non hanno nessuno dei driver di cui sopra."
+        ]
+      },
+      {
+        "title": "Collega e verifica",
+        "bodyRich": "ProxMenux collega ogni disco selezionato con il suo migliore percorso <code>/dev/disk/by-id/</code>, salta gli indici di slot che sono già in uso nella configurazione VM (<code>scsi0</code>, <code>sata0</code>, ...) e rilegge la configurazione per confermare l'assegnazione. Alla fine viene stampato un riassunto."
+      }
+    ]
+  },
+  "manual": {
+    "heading": "Equivalente manuale",
+    "body": "Lo script è un wrapper intorno a <code>qm set</code>. Il comando esatto per un singolo disco sembra questo:",
+    "migrationTitle": "La migrazione dal vivo non è possibile",
+    "migrationBody": "Una VM con un disco fisico collegato direttamente è <strong>legata all’host che espone quel disco</strong>. Un altro nodo normalmente non ha lo stesso percorso <code>/dev/disk/by-id/…</code> né i dati. Salva e trasferisci i dati separatamente, oppure usa dischi virtuali gestiti su storage condiviso o con replica supportata. Non presumere che la replica storage di Proxmox includa questo dispositivo.",
+    "shareTitle": "Non condividere un disco fisico tra VM",
+    "shareBody": "Attaccare lo stesso disco fisico a due VM allo stesso tempo corromperà i dati sulla prossima scrittura. ProxMenux rileva questa situazione e lo blocca, ma se si bypassa lo script (diretto <code>qm set</code>), assicurarsi che solo un ospite monta mai il disco."
+  },
+  "troubleshoot": {
+    "heading": "Risoluzione dei problemi",
+    "noDisksTitle": "\"Nessun disco disponibile per questo VM\"",
+    "noDisksIntro": "Lo script ha trovato dei dischi, ma ogni candidato è stato filtrato. Motivi comuni:",
+    "noDisksItems": [
+      "Ogni disco rimanente è già citato nella configurazione di destinazione VM.",
+      "Ogni disco rimanente è montato sull'host o fa parte di un ZFS attivo / LVM / RAID.",
+      "L'host ha installato solo il disco root."
+    ],
+    "noDisksOutro": "Eseguire <code>lsblk -f</code> sull'host per rivedere lo stato di ogni disco.",
+    "noVisibleTitle": "VM non vede il disco dopo il boot",
+    "noVisibleBody": "Con <strong>SCSI</strong> o <strong>VirtIO</strong> il guest richiede il driver corrispondente. Linux lo include nel kernel; su Windows installalo dall’ISO VirtIO (vedi <winLink>Crea VM: Windows</winLink>). Passare a SATA nella scheda Hardware della VM è una prova rapida per verificare l’assegnazione del disco."
+  },
+  "related": {
+    "heading": "Correlati",
+    "items": [
+      {
+        "href": "/docs/disk-manager/import-disk-image-vm",
+        "label": "Importa immagine disco nella VM",
+        "tail": "— stesso flusso ma per file di immagine (qcow2 / vmdk / raw / img)."
+      },
+      {
+        "href": "/docs/disk-manager/import-disk-lxc",
+        "label": "Importa disco su LXC",
+        "tail": "— flusso equivalente per contenitori LXC."
+      },
+      {
+        "href": "/docs/disk-manager/add-controller-nvme-vm",
+        "label": "Aggiungi controller o NVMe a VM",
+        "tail": "— quando è necessario PCIe completo / NVMe passante piuttosto che attaccare disco."
+      },
+      {
+        "href": "/docs/help-info/storage-commands",
+        "label": "Comandi di archiviazione e dischi",
+        "tail": "— qm importdisk e relativo riferimento shell."
+      },
+      {
+        "href": "/docs/disk-manager",
+        "label": "Panoramica di Disk Manager",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/it/docs/disk-manager/index.json b/web/messages/it/docs/disk-manager/index.json
new file mode 100644
index 00000000..c67de00d
--- /dev/null
+++ b/web/messages/it/docs/disk-manager/index.json
@@ -0,0 +1,135 @@
+{
+  "meta": {
+    "title": "Gestione dischi Proxmox: VM/LXC, test SMART e cancellazione | ProxMenux",
+    "description": "Gestisci i dischi fisici di un host Proxmox VE con ProxMenux: collega dischi a VM o LXC (qm set scsi/sata/virtio, pct mp), importa immagini img / qcow2 / vmdk / raw, assegna interi HBA o controller NVMe, cancella dischi con controlli di sicurezza ed esegui autotest SMART.",
+    "ogTitle": "Proxmox Disk Manager — Collegare dischi a VM / LXC, SMART Test, Wipe",
+    "ogDescription": "Collega dischi a VM/LXC, importa immagini, usa il passthrough PCI dei controller, cancella con controlli di sicurezza ed esegui test SMART su Proxmox VE.",
+    "twitterTitle": "Gestore dischi Proxmox | ProxMenux",
+    "twitterDescription": "Collega dischi a VM/LXC, importa immagini, usa passthrough PCI, cancella con controlli di sicurezza ed esegui test SMART."
+  },
+  "header": {
+    "title": "Gestione disco",
+    "description": "Il menu Disk Manager raggruppa gli strumenti ProxMenux per la gestione di dischi fisici su un host Proxmox: collegare dischi a VM e contenitori LXC, importare immagini disco, passare attraverso un intero controller o dispositivo NVMe, pulire i dischi in modo sicuro ed eseguire test di salute SMART.",
+    "section": "Gestione disco"
+  },
+  "intro": {
+    "title": "A cosa serve questo menu",
+    "body": "Questi strumenti operano su <strong>dischi fisici visibili all’host Proxmox e file immagine conservati su di esso</strong>. Il menu ha tre gruppi: <strong>VM</strong> (collegare dischi o importare immagini), <strong>LXC</strong> (collegare dischi a contenitori) e <strong>Utilità</strong> (formattazione e stato SMART). Collegamento e cancellazione nascondono o bloccano i dischi di sistema e in uso; SMART può esaminarli senza cancellarli."
+  },
+  "opening": {
+    "heading": "Apertura del menu",
+    "body": "Dal menu principale di ProxMenux, selezionare <strong>Disk Manager</strong>. Vedrai questo:",
+    "imageAlt": "Menu Gestione disco con blocchi VM, LXC e Utilities"
+  },
+  "groups": {
+    "heading": "Tre gruppi di utensili",
+    "intro": "Il menu Disk Manager è organizzato in tre gruppi — <strong>VM</strong>, <strong>LXC</strong> e <strong>Utilities</strong>. Fare clic su una scheda per saltare dritto agli strumenti in quel gruppo.",
+    "vmTitle": "VM",
+    "vmBody": "Strumenti che operano su macchine virtuali esistenti. Il VM deve essere spento; ProxMenux lo convalida prima di toccare la configurazione.",
+    "vmItems": [
+      "Importa disco nella VM",
+      "Importa immagine disco nella VM",
+      "Aggiungi controller o NVMe a VM"
+    ],
+    "lxcTitle": "LXC",
+    "lxcBody": "Strumenti per contenitori LXC esistenti. Questo script richiede un contenitore privilegiato e propone di cambiare l’impostazione se necessario. Leggi prima le indicazioni su conversione e proprietari dei file nella pagina dello strumento.",
+    "lxcItems": [
+      "Importa disco su LXC"
+    ],
+    "utilitiesTitle": "Utilità",
+    "utilitiesBody": "Strumenti lato host che operano sui dischi stessi, indipendentemente da qualsiasi VM o contenitore.",
+    "utilitiesItems": [
+      "Formatta o cancella un disco fisico",
+      "Integrità e test disco SMART"
+    ]
+  },
+  "vm": {
+    "heading": "VM",
+    "intro": "Strumenti che operano su macchine virtuali esistenti. Il VM deve essere spento; ProxMenux lo convalida prima di toccare la configurazione.",
+    "options": [
+      {
+        "icon": "HardDrive",
+        "href": "/docs/disk-manager/import-disk-vm",
+        "title": "Importa disco nella VM",
+        "description": "Collega un disco fisico non assegnato a una VM esistente. Supporta SATA/SCSI/VirtIO/IDE e usa percorsi persistenti /dev/disk/by-id."
+      },
+      {
+        "icon": "FileDown",
+        "href": "/docs/disk-manager/import-disk-image-vm",
+        "title": "Importa immagine disco nella VM",
+        "description": "Importa file di immagine del disco (.img / .qcow2 / .vmdk / .raw) in un VM esistente. Flusso bifase, qm importdisk sotto il cappuccio."
+      },
+      {
+        "icon": "Cpu",
+        "href": "/docs/disk-manager/add-controller-nvme-vm",
+        "title": "Aggiungi controller o NVMe a VM",
+        "description": "Passthrough PCI di un intero HBA SATA/SAS o dispositivo NVMe a una VM. Gestisce l’attivazione di IOMMU e il rilevamento dei conflitti."
+      }
+    ]
+  },
+  "lxc": {
+    "heading": "LXC",
+    "intro": "Strumenti per contenitori LXC esistenti. Questo script richiede un contenitore privilegiato e propone di cambiare l’impostazione se necessario. Leggi prima le indicazioni su conversione e proprietari dei file nella pagina dello strumento.",
+    "options": [
+      {
+        "icon": "Boxes",
+        "href": "/docs/disk-manager/import-disk-lxc",
+        "title": "Importa disco su LXC",
+        "description": "Collega un disco fisico non assegnato a un contenitore LXC come punto di mount. Gestisce rilevamento e formattazione del filesystem e il passaggio alla modalità privilegiata."
+      }
+    ]
+  },
+  "utilities": {
+    "heading": "Utilità",
+    "intro": "Strumenti lato host che operano sui dischi stessi, indipendentemente da qualsiasi VM o contenitore.",
+    "options": [
+      {
+        "icon": "Eraser",
+        "href": "/docs/disk-manager/format-disk",
+        "title": "Formatta/Cancella disco fisico (sicuro)",
+        "description": "Cancella dischi con controlli rigorosi: vengono mostrati solo dischi completamente liberi ed è sempre richiesta una doppia conferma."
+      },
+      {
+        "icon": "Activity",
+        "href": "/docs/disk-manager/smart-disk-test",
+        "title": "Integrità e test disco SMART",
+        "description": "Eseguire controlli sanitari SMART e test brevi / lunghi su drive SATA, SAS e NVMe. Esporta JSON per il Monitor."
+      }
+    ]
+  },
+  "safety": {
+    "title": "Regole di sicurezza per collegamento e cancellazione dei dischi",
+    "intro": "Le operazioni di collegamento e cancellazione escludono i dispositivi che potrebbero danneggiare l’host:",
+    "items": [
+      "Il <strong>disco di sistema</strong>, il pool root, lo swap e i membri attivi ZFS/LVM/RAID sono sempre nascosti.",
+      "I dischi <strong>montati</strong> in qualsiasi punto dell’host sono nascosti o bloccati all’esecuzione.",
+      "I dischi <strong>riferiti da un VM in esecuzione o LXC</strong> non possono essere riassegnati o cancellati.",
+      "Le operazioni che modificano lo stato dell’host, come attivare IOMMU o cancellare dischi, richiedono una conferma esplicita."
+    ]
+  },
+  "related": {
+    "heading": "Correlati",
+    "items": [
+      {
+        "href": "/docs/storage-share",
+        "label": "Gestore storage e condivisioni",
+        "tail": "— registrare lo storage in Proxmox stesso (NFS / Samba / iSCSI / locale) e condividere le cartelle tra host e CT."
+      },
+      {
+        "href": "/docs/help-info/storage-commands",
+        "label": "Comandi di archiviazione e dischi",
+        "tail": "— dispositivi di blocco, LVM, pvesm, riferimento SMART."
+      },
+      {
+        "href": "/docs/help-info/zfs-commands",
+        "label": "Comandi di gestione ZFS",
+        "tail": " — per ZFS pools e set di dati."
+      },
+      {
+        "href": "/docs/hardware/gpu-vm-passthrough",
+        "label": "Aggiungi GPU a VM (Passthrough)",
+        "tail": "— stessi concetti IOMMU / VFIO applicati alle GPU."
+      }
+    ]
+  }
+}
diff --git a/web/messages/it/docs/disk-manager/smart-disk-test.json b/web/messages/it/docs/disk-manager/smart-disk-test.json
new file mode 100644
index 00000000..f42b8ae1
--- /dev/null
+++ b/web/messages/it/docs/disk-manager/smart-disk-test.json
@@ -0,0 +1,146 @@
+{
+  "meta": {
+    "title": "Stato e test SMART del disco | Documentazione ProxMenux",
+    "description": "Esegui controlli SMART e test dei dischi su Proxmox VE con ProxMenux. Supporta SATA/SAS con smartmontools e NVMe con nvme-cli, autotest brevi e lunghi ed esportazione JSON per ProxMenux Monitor.",
+    "ogTitle": "Stato e test SMART del disco | Documentazione ProxMenux",
+    "ogDescription": "SMART controlli di salute e auto-test per unità SATA / SAS e NVMe su Proxmox. Esportazione JSON per il Monitor."
+  },
+  "header": {
+    "title": "Integrità e test disco SMART",
+    "description": "Leggi i dati SMART e avvia autotest sui dischi fisici dell’host Proxmox. ProxMenux installa automaticamente smartmontools per SATA/SAS e nvme-cli per NVMe, avvia i test nel firmware del disco (i test lunghi continuano dopo la chiusura del terminale) ed esporta risultati JSON per ProxMenux Monitor.",
+    "section": "Disk Manager · Utilità"
+  },
+  "intro": {
+    "title": "A cosa serve",
+    "body": "SMART (Self-Monitoring, Analysis and Reporting Technology) consente al disco di segnalare il proprio stato ed eseguire autotest. Lo strumento mostra questi dati senza dover ricordare il comando <code>smartctl</code> o <code>nvme</code> corretto e conserva l’output in JSON perché il Monitor possa mostrare le tendenze nel tempo."
+  },
+  "howRuns": {
+    "heading": "Come funziona lo script",
+    "body": "Tutte le azioni qui non distruttive — SMART legge i contatori del firmware dell'unità, e i test di auto sono in coda all'interno dell'unità stessa. Non è necessaria alcuna separazione di fase. Il flusso è: controllo di dipendenza → selezione del disco → selezione di azione → invocazione degli strumenti (smartctl o nvme-cli a seconda del bus del disco) → uscita stampata più esportazione JSON per il monitor."
+  },
+  "deps": {
+    "heading": "Dipendenze",
+    "body": "Lo strumento installa automaticamente ciò di cui ha bisogno in prima esecuzione. Le unità SATA / SAS si basano su <code>smartmontools</code>; le unità NVMe si basano su <code>nvme-cli</code>. Entrambi:"
+  },
+  "actions": {
+    "heading": "Azioni disponibili",
+    "headerAction": "Azione",
+    "headerWhat": "Che cosa legge o esegue",
+    "headerDur": "Durata",
+    "rows": [
+      {
+        "action": "Situazione rapida della salute",
+        "whatRich": "Complessivamente PASSED/FAILED + attributi chiave.<br /><code>smartctl -H</code> + <code>-A</code> (SATA/SAS) o <code>nvme smart-log</code> (NVMe).",
+        "dur": "istantaneamente"
+      },
+      {
+        "action": "Rapporto completo",
+        "whatRich": "Dati SMART completi, scorrevoli. <code>smartctl -x</code> per SATA/SAS o <code>nvme smart-log</code> + <code>id-ctrl</code> per NVMe.",
+        "dur": "istantaneamente"
+      },
+      {
+        "action": "Test breve",
+        "what": "Superficie di base e controllo elettrico, in coda all'interno del firmware dell'unità.",
+        "dur": "~2 minuti"
+      },
+      {
+        "action": "Test lungo",
+        "what": "Controllo completo dell'intera superficie. Funziona sull'hardware dell'unità — persiste anche se si chiude il terminale.",
+        "dur": "Ore (dipendenti dalle dimensioni del disco)"
+      },
+      {
+        "action": "Verificare i progressi dei test",
+        "what": "Stato dell'autotest attivo o più recente.",
+        "dur": "istantaneamente"
+      }
+    ],
+    "tipTitle": "I test lunghi sopravvivono alla chiusura del terminale",
+    "tipBody": "Un test lungo viene eseguito <em>nel disco</em> e non dipende dal processo ProxMenux. Puoi chiudere il terminale e tornare a <strong>Verifica avanzamento test</strong>. Un riavvio dell’host, un reset del controller o una perdita di alimentazione può interrompere il test e la raccolta dei risultati; non presumere che riprenda automaticamente."
+  },
+  "json": {
+    "heading": "JSON export per il Monitor",
+    "intro": "Le azioni di stato, test breve e avanzamento scrivono un JSON con data e ora in <code>/usr/local/share/proxmenux/smart/&lt;disk&gt;/</code>; i risultati dei test lunghi sono raccolti in background. Il rapporto completo viene solo visualizzato. La struttura è:",
+    "outro": "ProxMenux Monitor usa questi file per mostrare l’andamento dello stato dei dischi. I vecchi file vengono rimossi automaticamente al raggiungimento del limite di conservazione."
+  },
+  "steps": {
+    "heading": "Passo dopo passo",
+    "stepLabel": "Passaggio",
+    "list": [
+      {
+        "title": "Scegli un disco",
+        "body": "ProxMenux elenca ogni disco fisico sull'host con il suo modello e dimensione. A differenza dello strumento Formato, questo elenco non è filtrato dalla sicurezza — la lettura SMART è un'operazione non distruttiva.",
+        "img": "/disk/smart/disk-selection.png",
+        "alt": "Menu di selezione del disco SMART",
+        "caption": "Menu di selezione del disco SMART"
+      },
+      {
+        "title": "Scegli un'azione",
+        "body": "Scegliere tra stato di salute rapido, rapporto completo, test breve, test lungo o verifica progressi. Il menu rimane aperto dopo ogni azione in modo da poter incatenare diverse query contro lo stesso disco.",
+        "img": "/disk/smart/action-menu.png",
+        "alt": "Menu di azione SMART",
+        "caption": "SMART menu di azione (5 azioni + cancellazione)"
+      },
+      {
+        "title": "(Solo test lungo) Conferma l’esecuzione in background",
+        "body": "ProxMenux avvisa che il test continuerà dopo la chiusura del terminale e mostra dove verrà salvato il risultato JSON. Accetta per avviarlo.",
+        "img": "/disk/smart/long-test-warning.png",
+        "alt": "Finestra di conferma di prova lunga",
+        "caption": "Conferma di prova lunga — corre in background, risultato salvato a JSON"
+      },
+      {
+        "title": "Controlla i risultati",
+        "bodyRich": "Stato, test e avanzamento compaiono nel terminale; <strong>Rapporto completo</strong> si apre in una finestra scorrevole. L’esportazione JSON avviene per le azioni indicate sopra, non per Rapporto completo. Per i test lunghi torna a <strong>Verifica avanzamento test</strong> sullo stesso disco.",
+        "img": "/disk/smart/quick-status.png",
+        "alt": "Uscita rapida dello stato di salute",
+        "caption": "Uscita rapida dello stato di salute (SATA — smartctl -H + -A)"
+      }
+    ]
+  },
+  "manual": {
+    "heading": "Equivalenti manuali",
+    "nvmeWarnTitle": "Gli autotest NVMe dipendono dal firmware del disco",
+    "nvmeWarnBody": "Non ogni unità NVMe supporta il comando breve/lungo self-test. Se un'unità rifiuta il test, il registro SMART e i dati del controller ID (<code>nvme smart-log</code> + <code>id-ctrl</code>) sono ancora il segnale sanitario più affidabile."
+  },
+  "troubleshoot": {
+    "heading": "Risoluzione dei problemi",
+    "noSmartTitle": "\"Impossibile leggere i dati SMART da /dev/sdX\"",
+    "noSmartBody": "Il disco è probabilmente dietro un controller RAID / SAS che non passa SMART attraverso. Con le carte a base di megaraid, prova a <code>smartctl -d megaraid,N /dev/sdX</code>. Per HBA in modalità IT l'invocazione diretta funziona.",
+    "longTitle": "Il lungo test non completa mai",
+    "longBody": "Il test viene eseguito nel firmware e un carico I/O elevato può ritardarlo. Prova in un periodo di inattività, ad esempio di notte. Su SATA, <code>smartctl -c</code> mostra la percentuale rimanente, su SAS <code>smartctl -l selftest</code>; il log degli autotest indica esito ed eventuali LBA difettosi. Un errore di lettura va indagato; la lentezza da sola non prova un settore danneggiato."
+  },
+  "related": {
+    "heading": "Correlati",
+    "items": [
+      {
+        "href": "/docs/disk-manager/format-disk",
+        "label": "Formatta o cancella un disco fisico",
+        "tail": "— riutilizzare un disco dopo aver confermato che è sano."
+      },
+      {
+        "href": "/docs/help-info/storage-commands",
+        "label": "Comandi di archiviazione e dischi → Stato SMART",
+        "tail": "— riferimento copiabile smartctl / nvme."
+      },
+      {
+        "href": "/docs/help-info/zfs-commands",
+        "label": "Comandi di gestione ZFS",
+        "tail": " — zpool scrub verifica i checksum dei dati ZFS e affianca i test SMART dell’hardware."
+      },
+      {
+        "href": "/docs/monitor/dashboard/storage",
+        "label": "ProxMenux Monitor — scheda Archiviazione",
+        "tail": " — vista dettagliata del disco che usa il JSON esportato qui: tabella SMART completa, cronologia e rapporto PDF."
+      },
+      {
+        "href": "/docs/monitor/dashboard/hardware",
+        "label": "ProxMenux Monitor — Scheda hardware",
+        "tail": "— Riepilogo di stoccaggio con modello, capacità e velocità di collegamento negoziata (corrente vs massima su NVMe)."
+      },
+      {
+        "href": "/docs/disk-manager",
+        "label": "Panoramica di Disk Manager",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/it/docs/external-repositories.json b/web/messages/it/docs/external-repositories.json
new file mode 100644
index 00000000..16215bec
--- /dev/null
+++ b/web/messages/it/docs/external-repositories.json
@@ -0,0 +1,58 @@
+{
+  "meta": {
+    "title": "Repository esterni | Documentazione ProxMenux",
+    "description": "ProxMenux integra repository di script esterni selezionati, come community-scripts e ZimaOS, come alternative in alcune sezioni del menu. Ogni script indica la propria origine; i bug vanno segnalati al manutentore originale.",
+    "ogTitle": "Repository esterni | Documentazione ProxMenux",
+    "ogDescription": "Repository di script esterni integrati come alternative nei menu di ProxMenux."
+  },
+  "header": {
+    "title": "Repository esterni",
+    "description": "ProxMenux integra repository di script esterni selezionati come alternative in alcune sezioni del menu. Gli script provengono da fonti di terze parti attendibili, indicate chiaramente nel menu.",
+    "section": "Repository esterni"
+  },
+  "practice": {
+    "title": "Ciò che significa in pratica",
+    "body": "Quando un’opzione usa uno script esterno anziché codice proprio di ProxMenux, il menu ne indica l’origine e il repository caricato. ProxMenux avvia questi script senza modificarli. I problemi relativi al loro funzionamento competono al manutentore del repository originale."
+  },
+  "integrated": {
+    "heading": "Repository attualmente integrati",
+    "usedInLabel": "Usato in:",
+    "items": [
+      {
+        "name": "community-scripts / ProxmoxVE",
+        "url": "https://community-scripts.github.io/ProxmoxVE/",
+        "description": "Erede dei helper script di tteck. Ampio catalogo di script per distribuire in una sola esecuzione LXC (Home Assistant, Plex, Frigate…), VM, componenti aggiuntivi e modifiche a PVE.",
+        "usedIn": "Avvio di Helper Scripts e Rete (correzione dell’offloading della scheda Intel e1000e)"
+      }
+    ]
+  },
+  "attribution": {
+    "heading": "Attribuzione e riconoscimenti",
+    "items": [
+      "Gli autori originali sono sempre citati nel menu e nella pagina che documenta l’integrazione dello script.",
+      "Il collegamento al repository originale viene mostrato prima di eseguire lo script e nella relativa pagina di documentazione.",
+      "Puoi sostenere gli sviluppatori di questi progetti esterni con una ⭐, una sponsorizzazione o segnalazioni di bug ben documentate."
+    ]
+  },
+  "report": {
+    "title": "Dove segnalare problemi con gli script esterni",
+    "body": "Se uno script esterno non funziona come previsto, <strong>segnalalo direttamente nel suo repository</strong>, non in ProxMenux. ProxMenux lo scarica e lo esegue senza modificarne il codice. Il manutentore originale può analizzare e correggere il problema. Usa le issue di ProxMenux per problemi del comando di avvio o dell’integrazione dello script."
+  },
+  "suggest": {
+    "heading": "Suggerimento di nuovi repository esterni",
+    "intro": "Trovato uno script o un repository che si adatta bene a un menu ProxMenux? Suggeriscilo via:",
+    "discussionTitle": "💬 Apri una discussione",
+    "discussionBody": "Ideale per le idee: raccogli i pareri della comunità prima di trasformarle in una richiesta di funzionalità.",
+    "issueTitle": "🐛 Apri una issue",
+    "issueBody": "Per richieste di funzionalità specifiche con un ambito ben definito."
+  },
+  "candidate": {
+    "title": "Cosa rende un buon candidato di integrazione",
+    "items": [
+      "Codice aperto con un manutentore attivo.",
+      "Idempotente: può essere eseguito più volte in sicurezza.",
+      "Non modifica la configurazione principale di Proxmox senza avvisare.",
+      "Risolve un problema non ancora coperto da ProxMenux, evitando di duplicare le funzionalità."
+    ]
+  }
+}
diff --git a/web/messages/it/docs/glossary.json b/web/messages/it/docs/glossary.json
new file mode 100644
index 00000000..9ed0f3f3
--- /dev/null
+++ b/web/messages/it/docs/glossary.json
@@ -0,0 +1,677 @@
+{
+  "meta": {
+    "title": "Glossario | Documentazione ProxMenux",
+    "description": "Definizioni dei termini usati nella documentazione ProxMenux: Proxmox, archiviazione, reti e virtualizzazione.",
+    "ogTitle": "Glossario | Documentazione ProxMenux",
+    "ogDescription": "Breve riferimento per i termini tecnici utilizzati nella documentazione ProxMenux."
+  },
+  "header": {
+    "title": "Glossario",
+    "description": "Brevi definizioni dei termini usati in ProxMenux e per descrivere il funzionamento di Proxmox.",
+    "section": "Glossario"
+  },
+  "callout": {
+    "title": "Come utilizzare questa pagina",
+    "bodyRich": "Ogni voce include una categoria e una breve definizione. I collegamenti <em>Vedi anche</em> aprono la documentazione pertinente. Usa la navigazione A–Z per passare direttamente a una lettera."
+  },
+  "jumpHeading": "Vai alla lettera",
+  "seeAlsoLabel": "Vedi anche:",
+  "aliasesLabel": "anche:",
+  "missingCallout": {
+    "title": "Manca un termine?",
+    "leadRich": "Se manca un termine, apri una issue o una PR su <ext>GitHub</ext>. Il glossario si trova in <code>web/messages/en/docs/glossary.json</code>, con i cataloghi corrispondenti per ogni lingua."
+  },
+  "entries": [
+    {
+      "term": "ACS",
+      "aliases": [
+        "Access Control Services",
+        "Sovrascrittura ACS"
+      ],
+      "category": "Virtualizzazione",
+      "definitionRich": "Funzioni di controllo degli accessi PCIe che aiutano a isolare il traffico tra dispositivi. I gruppi IOMMU dipendono da hardware e topologia. La patch <em>ACS override</em> può suddividere i gruppi rilevati da Linux, ma non aggiunge isolamento hardware; assegnarli a VM diverse comporta un rischio di sicurezza.",
+      "seeAlso": [
+        {
+          "label": "Aggiungi controller o NVMe a VM",
+          "href": "/docs/disk-manager/add-controller-nvme-vm"
+        }
+      ]
+    },
+    {
+      "term": "ARC",
+      "aliases": [
+        "Adaptive Replacement Cache"
+      ],
+      "category": "Archiviazione",
+      "definitionRich": "Cache di lettura ZFS nella RAM dell’host, per i blocchi usati di recente o frequentemente. Il limite predefinito dipende dalla versione e dall’installazione di Proxmox. Le opzioni successive all’installazione di ProxMenux permettono di limitarla.",
+      "seeAlso": [
+        {
+          "label": "Dopo l’installazione: archiviazione",
+          "href": "/docs/post-install/storage"
+        },
+        {
+          "label": "Comandi ZFS",
+          "href": "/docs/help-info/zfs-commands"
+        }
+      ]
+    },
+    {
+      "term": "Bind mount",
+      "category": "Linux",
+      "definitionRich": "Funzione Linux che rende accessibile una parte del file system da un altro percorso. ProxMenux usa i bind mount per condividere directory dell’host con i container LXC tramite <code>pct set -mpN</code>.",
+      "seeAlso": [
+        {
+          "label": "Punti di montaggio LXC",
+          "href": "/docs/storage-share/lxc-mount-points"
+        }
+      ]
+    },
+    {
+      "term": "Bond di rete",
+      "aliases": [
+        "Aggregazione di interfacce di rete",
+        "Aggregazione dei collegamenti"
+      ],
+      "category": "Rete",
+      "definitionRich": "Raggruppa più interfacce fisiche in una logica per offrire ridondanza (active-backup), maggiore capacità complessiva (LACP / 802.3ad) o entrambe. Si configura in <code>/etc/network/interfaces</code>."
+    },
+    {
+      "term": "Ponte",
+      "aliases": [
+        "vmbrX",
+        "vmbr0",
+        "Bridge Linux"
+      ],
+      "category": "Rete",
+      "definitionRich": "Switch virtuale di livello 2 sull’host. <code>vmbr0</code> collega normalmente le macchine ospiti alla rete fisica. Altri bridge (<code>vmbr1</code>, <code>vmbr2</code>...) possono separare le reti in base ai collegamenti fisici e alla configurazione.",
+      "seeAlso": [
+        {
+          "label": "Analisi ponte e riparazione guidata",
+          "href": "/docs/network/bridge-analysis"
+        }
+      ]
+    },
+    {
+      "term": "Ceph",
+      "category": "Archiviazione",
+      "definitionRich": "Sistema di archiviazione distribuito integrato con Proxmox per cluster iperconvergenti. Gli OSD (Object Storage Daemons) sono alla base dell’archiviazione a oggetti, a blocchi e di file. La versione Ceph richiesta dipende dalla versione Proxmox e dal percorso di aggiornamento: consulta la guida corrispondente.",
+      "seeAlso": [
+        {
+          "label": "Aggiorna PVE 8 a PVE 9",
+          "href": "/docs/utils/upgrade-pve8-pve9"
+        }
+      ]
+    },
+    {
+      "term": "CT",
+      "aliases": [
+        "contenitore",
+        "Container LXC"
+      ],
+      "category": "Proxmox",
+      "definitionRich": "Abbreviazione di «container» usata da Proxmox per un’istanza LXC. Il CTID numerico corrisponde a <code>/etc/pve/lxc/&lt;CTID&gt;.conf</code>. Vedi anche <strong>LXC</strong>.",
+      "seeAlso": [
+        {
+          "label": "Gestione di VM e container",
+          "href": "/docs/help-info/vm-ct-commands"
+        }
+      ]
+    },
+    {
+      "term": "deb822",
+      "category": "Linux",
+      "definitionRich": "Formato moderno delle sorgenti APT: file <code>.sources</code> con blocchi strutturati e campi Types, URIs, Suites, Components e Signed-By. Sostituisce il formato a riga singola <code>.list</code>; è lo standard da PVE 9 / Debian Trixie.",
+      "seeAlso": [
+        {
+          "label": "Aggiorna PVE 8 a PVE 9",
+          "href": "/docs/utils/upgrade-pve8-pve9"
+        }
+      ]
+    },
+    {
+      "term": "dGPU",
+      "aliases": [
+        "GPU dedicata"
+      ],
+      "category": "Virtualizzazione",
+      "definitionRich": "Scheda grafica separata, normalmente collegata tramite PCIe, diversamente da una <strong>iGPU</strong>. Può essere assegnata a una VM con VFIO o utilizzata da più container LXC tramite i nodi di dispositivo e il driver dell’host, se hardware e applicazioni lo supportano.",
+      "seeAlso": [
+        {
+          "label": "Aggiungere GPU a VM (passthrough)",
+          "href": "/docs/hardware/gpu-vm-passthrough"
+        }
+      ]
+    },
+    {
+      "term": "Dialog",
+      "category": "Linux",
+      "definitionRich": "Strumento basato su ncurses per mostrare menu, richieste e barre di avanzamento nel terminale. ProxMenux usa i menu di dialog."
+    },
+    {
+      "term": "DKMS",
+      "aliases": [
+        "Supporto del modulo del kernel dinamico"
+      ],
+      "category": "Linux",
+      "definitionRich": "Sistema per ricompilare moduli esterni registrati, come NVIDIA o ZFS, quando cambia il kernel. Servono sorgenti del modulo compatibili e gli header del kernel corrispondenti.",
+      "seeAlso": [
+        {
+          "label": "Installare Coral TPU (Host)",
+          "href": "/docs/hardware/install-coral-tpu-host"
+        }
+      ]
+    },
+    {
+      "term": "Fail2Ban",
+      "category": "Linux",
+      "definitionRich": "Servizio che rileva errori di autenticazione ripetuti nei registri e blocca gli IP responsabili tramite il firewall. ProxMenux include jail preconfigurate per SSH, l’interfaccia Proxmox e Monitor.",
+      "seeAlso": [
+        {
+          "label": "Fail2Ban",
+          "href": "/docs/security/fail2ban"
+        }
+      ]
+    },
+    {
+      "term": "Fastfetch",
+      "category": "Linux",
+      "definitionRich": "Strumento di informazioni di sistema con grafica ASCII mostrata all’accesso alla shell. Sostituisce <code>neofetch</code> ed è attivabile nelle opzioni successive all’installazione di ProxMenux.",
+      "seeAlso": [
+        {
+          "label": "Dopo l'installazione: opzioni",
+          "href": "/docs/post-install/optional"
+        }
+      ]
+    },
+    {
+      "term": "GRUB",
+      "aliases": [
+        "GRand Unified Bootloader"
+      ],
+      "category": "Linux",
+      "definitionRich": "Boot loader delle installazioni Linux basate su GRUB. Configurazione in <code>/etc/default/grub</code> e <code>/boot/grub/</code>; applica le modifiche con <code>update-grub</code>. Proxmox può anche usare systemd-boot: verifica il boot loader attivo prima di modificare i parametri del kernel.",
+      "seeAlso": [
+        {
+          "label": "Comandi di passaggio GPU",
+          "href": "/docs/help-info/gpu-commands"
+        }
+      ]
+    },
+    {
+      "term": "iGPU",
+      "aliases": [
+        "GPU integrata"
+      ],
+      "category": "Virtualizzazione",
+      "definitionRich": "Processore grafico integrato nel package della CPU, come Intel UHD / Iris o Radeon nelle APU Ryzen. Spesso viene condiviso tra più LXC tramite <code>/dev/dri</code>, anziché assegnato esclusivamente a una VM.",
+      "seeAlso": [
+        {
+          "label": "Aggiungi GPU a LXC",
+          "href": "/docs/hardware/igpu-acceleration-lxc"
+        }
+      ]
+    },
+    {
+      "term": "ifupdown / ifupdown2",
+      "category": "Rete",
+      "definitionRich": "Sistema classico di configurazione di rete Debian, basato su <code>/etc/network/interfaces</code>. Proxmox usa normalmente la versione riscritta <code>ifupdown2</code>, che permette di ricaricare la configurazione senza riavviare con <code>ifreload -a</code>."
+    },
+    {
+      "term": "initramfs",
+      "category": "Linux",
+      "definitionRich": "File system iniziale in RAM usato dal kernel prima di montare la radice reale. Contiene i driver necessari all’avvio. Dopo modifiche a VFIO, IOMMU o driver di archiviazione, si rigenera con <code>update-initramfs -u -k all</code>."
+    },
+    {
+      "term": "IOMMU",
+      "aliases": [
+        "Unità di gestione della memoria di input/output",
+        "VT-d",
+        "AMD-Vi"
+      ],
+      "category": "Virtualizzazione",
+      "definitionRich": "Funzione hardware (Intel VT-d / AMD-Vi) necessaria per assegnare dispositivi PCIe alle VM. Attivala nel firmware e verifica il supporto nel kernel. A seconda della piattaforma e delle impostazioni predefinite, possono servire <code>intel_iommu=on</code> o <code>amd_iommu=on</code>.",
+      "seeAlso": [
+        {
+          "label": "Post-Install: Virtualizzazione",
+          "href": "/docs/post-install/virtualization"
+        },
+        {
+          "label": "Aggiungere GPU a VM (passthrough)",
+          "href": "/docs/hardware/gpu-vm-passthrough"
+        }
+      ]
+    },
+    {
+      "term": "Gruppo IOMMU",
+      "category": "Virtualizzazione",
+      "definitionRich": "Gruppo di dispositivi che costituisce l’unità minima di isolamento IOMMU. I membri non sono necessariamente isolati tra loro: controllali tutti prima di assegnare dispositivi con VFIO. Elenco con <code>find /sys/kernel/iommu_groups/ -type l | sort -V</code>."
+    },
+    {
+      "term": "iSCSI",
+      "aliases": [
+        "Internet SCSI"
+      ],
+      "category": "Archiviazione",
+      "definitionRich": "Protocollo di archiviazione a blocchi su IP: un disco remoto appare come un dispositivo SCSI locale. Si aggiunge a Proxmox con <code>pvesm add iscsi</code>.",
+      "seeAlso": [
+        {
+          "label": "Aggiungere l'obiettivo iSCSI come storage Proxmox",
+          "href": "/docs/storage-share/host-iscsi"
+        }
+      ]
+    },
+    {
+      "term": "KVM",
+      "aliases": [
+        "Macchina virtuale a base di Kernel"
+      ],
+      "category": "Virtualizzazione",
+      "definitionRich": "Modulo del kernel Linux che trasforma l’host in un hypervisor. Insieme a <strong>QEMU</strong> per l’emulazione dei dispositivi, costituisce la base delle VM Proxmox."
+    },
+    {
+      "term": "LVM",
+      "aliases": [
+        "Logical Volume Manager"
+      ],
+      "category": "Archiviazione",
+      "definitionRich": "Gestione dei volumi Linux che raggruppa lo spazio fisico in gruppi (VG) contenenti volumi logici (LV). Le installazioni Proxmox basate su LVM usano spesso LVM-thin per i dischi ospiti; esistono altri sistemi di archiviazione. Strumenti: <code>pvs</code>, <code>vgs</code> e <code>lvs</code>.",
+      "seeAlso": [
+        {
+          "label": "Comandi per archiviazione e dischi",
+          "href": "/docs/help-info/storage-commands"
+        }
+      ]
+    },
+    {
+      "term": "LXC",
+      "aliases": [
+        "Linux Containers"
+      ],
+      "category": "Linux",
+      "definitionRich": "Virtualizzazione a livello di sistema operativo: istanze isolate dello spazio utente condividono il kernel dell’host. Generalmente comporta meno overhead delle VM, con un diverso isolamento. Proxmox gestisce i container LXC con <code>pct</code>.",
+      "seeAlso": [
+        {
+          "label": "Gestione di VM e container",
+          "href": "/docs/help-info/vm-ct-commands"
+        }
+      ]
+    },
+    {
+      "term": "Lynis",
+      "category": "Linux",
+      "definitionRich": "Strumento di audit di sicurezza open source di CISOfy. Analizza l’host e mostra un punteggio di sicurezza e suggerimenti concreti. ProxMenux installa la versione dal repository GitHub originale al posto del pacchetto Debian più vecchio.",
+      "seeAlso": [
+        {
+          "label": "Lynis",
+          "href": "/docs/security/lynis"
+        }
+      ]
+    },
+    {
+      "term": "Indirizzo MAC",
+      "aliases": [
+        "Indirizzo hardware"
+      ],
+      "category": "Rete",
+      "definitionRich": "Identificatore di un’interfaccia Ethernet, normalmente a 48 bit, assegnato da hardware o software. I <em>Nomi di rete persistenti</em> di ProxMenux associano le MAC a nomi stabili (<code>eno1</code>, <code>enp3s0</code>) anche dopo una nuova enumerazione PCI.",
+      "seeAlso": [
+        {
+          "label": "Nomi di interfaccia persistenti",
+          "href": "/docs/network/persistent-names"
+        }
+      ]
+    },
+    {
+      "term": "MOTD",
+      "aliases": [
+        "Messaggio del Giorno"
+      ],
+      "category": "Linux",
+      "definitionRich": "Testo mostrato dopo l’accesso SSH, memorizzato in <code>/etc/motd</code>. ProxMenux può aggiungere un banner dopo l’installazione; la disinstallazione ripristina il file precedente se ne esiste una copia."
+    },
+    {
+      "term": "NFS",
+      "aliases": [
+        "Sistema di file di rete"
+      ],
+      "category": "Archiviazione",
+      "definitionRich": "Protocollo di condivisione file in rete nato su Unix. Si aggiunge come archiviazione Proxmox con <code>pvesm add nfs</code>; ProxMenux offre anche procedure per client e server NFS in LXC.",
+      "seeAlso": [
+        {
+          "label": "Gestore storage e condivisioni",
+          "href": "/docs/storage-share"
+        }
+      ]
+    },
+    {
+      "term": "nftables / iptables",
+      "category": "Rete",
+      "definitionRich": "Strumenti firewall Linux. <code>nftables</code> è l’infrastruttura moderna; <code>iptables</code> può usare backend classici o compatibili con nft. Il servizio classico <code>pve-firewall</code> usa iptables, mentre l’alternativa proxmox-firewall usa nftables.",
+      "seeAlso": [
+        {
+          "label": "Comandi di rete",
+          "href": "/docs/help-info/network-commands"
+        }
+      ]
+    },
+    {
+      "term": "nouveau",
+      "category": "Linux",
+      "definitionRich": "Driver grafico NVIDIA open source incluso in Linux. Installando il driver proprietario, impedisci che nouveau gestisca la stessa GPU, normalmente bloccandone il caricamento e rigenerando initramfs.",
+      "seeAlso": [
+        {
+          "label": "Guida all'installazione NVIDIA",
+          "href": "/guides/nvidia"
+        }
+      ]
+    },
+    {
+      "term": "Repository no-subscription",
+      "category": "Proxmox",
+      "definitionRich": "Repository di pacchetti Proxmox disponibile senza abbonamento enterprise. I pacchetti ricevono meno verifiche rispetto al repository enterprise, consigliato da Proxmox per la produzione. ProxMenux offre la configurazione dei repository dopo l’installazione.",
+      "seeAlso": [
+        {
+          "label": "Post-Install: Impostazioni di base",
+          "href": "/docs/post-install/basic-settings"
+        }
+      ]
+    },
+    {
+      "term": "OVA / OVF",
+      "aliases": [
+        "Open Virtualization Format"
+      ],
+      "category": "Virtualizzazione",
+      "definitionRich": "Formati DMTF per distribuire VM portabili. <strong>OVA</strong> raccoglie i file in un archivio TAR; <strong>OVF</strong> descrive la VM in XML con file disco associati, spesso VMDK. Il supporto all’importazione dipende dall’hypervisor di destinazione e dalla configurazione.",
+      "seeAlso": [
+        {
+          "label": "Esportazione VM a OVA / OVF",
+          "href": "/docs/utils/export-vm"
+        },
+        {
+          "label": "Importa VM da OVA / OVF",
+          "href": "/docs/utils/import-vm"
+        }
+      ]
+    },
+    {
+      "term": "OVMF",
+      "aliases": [
+        "firmware UEFI",
+        "Open Virtual Machine Firmware"
+      ],
+      "category": "Virtualizzazione",
+      "definitionRich": "Firmware UEFI per VM, selezionato con <code>qm set &lt;vmid&gt; -bios ovmf</code>. Si usa per ospiti UEFI, inclusi Windows 11 e configurazioni Secure Boot. <code>efidisk0</code> conserva le variabili EFI; molti altri ospiti possono ancora usare il BIOS tradizionale.",
+      "seeAlso": [
+        {
+          "label": "Aggiungere GPU a VM (passthrough)",
+          "href": "/docs/hardware/gpu-vm-passthrough"
+        }
+      ]
+    },
+    {
+      "term": "PBS",
+      "aliases": [
+        "Proxmox Backup Server"
+      ],
+      "category": "Proxmox",
+      "definitionRich": "Prodotto di backup Proxmox separato con trasferimenti incrementali, deduplicazione e crittografia facoltativa lato client per VM e CT. Può essere una destinazione vzdump; è preferibile un server separato al salvataggio sullo stesso host protetto."
+    },
+    {
+      "term": "pct",
+      "category": "Proxmox",
+      "definitionRich": "Strumento da riga di comando per gestire container LXC in Proxmox: <code>pct list / start / stop / shutdown / config / enter / exec / push / pull / destroy</code>.",
+      "seeAlso": [
+        {
+          "label": "Gestione di VM e container",
+          "href": "/docs/help-info/vm-ct-commands"
+        }
+      ]
+    },
+    {
+      "term": "pmxcfs",
+      "aliases": [
+        "Proxmox Cluster Filesystem"
+      ],
+      "category": "Proxmox",
+      "definitionRich": "File system virtuale basato su FUSE, montato in <code>/etc/pve/</code>. Replica la configurazione tra i nodi del cluster: le modifiche in <code>/etc/pve/</code> vengono propagate automaticamente."
+    },
+    {
+      "term": "pveam",
+      "aliases": [
+        "Gestore delle appliance Proxmox VE"
+      ],
+      "category": "Proxmox",
+      "definitionRich": "Strumento per il catalogo locale dei modelli CT. <code>pveam update</code> aggiorna l’indice; <code>pveam available</code> elenca i modelli e <code>pveam download &lt;storage&gt; &lt;template&gt;</code> ne scarica uno."
+    },
+    {
+      "term": "pveproxy",
+      "category": "Proxmox",
+      "definitionRich": "Servizio HTTPS dell’interfaccia e del terminale web Proxmox, sulla porta 8006. Viene riavviato durante gli aggiornamenti principali; per questo ProxMenux impedisce l’aggiornamento PVE 8 → 9 dal terminale web."
+    },
+    {
+      "term": "pvesm",
+      "aliases": [
+        "Gestore dello spazio di archiviazione Proxmox"
+      ],
+      "category": "Proxmox",
+      "definitionRich": "Strumento CLI per la gestione dello storage Proxmox. <code>pvesm status</code> mostra tutti gli storage configurati; <code>pvesm add &lt;type&gt;</code> registra quelli nuovi (NFS, Samba, iSCSI, dir, ZFS, LVM, ...).",
+      "seeAlso": [
+        {
+          "label": "Comandi per archiviazione e dischi",
+          "href": "/docs/help-info/storage-commands"
+        }
+      ]
+    },
+    {
+      "term": "Container privilegiato",
+      "category": "Linux",
+      "definitionRich": "Container LXC il cui root <em>corrisponde all’UID 0 dell’host</em>, pur mantenendo namespace e altre restrizioni. È meno isolato di un container non privilegiato. GPU, USB e Samba non richiedono sempre questa modalità: contano permessi e mappature UID."
+    },
+    {
+      "term": "ProxMenux Monitor",
+      "category": "ProxMenux",
+      "definitionRich": "Pannello web facoltativo di ProxMenux. Mostra statistiche dell’host in tempo reale (CPU, RAM, dischi e rete), una panoramica di VM e LXC e accesso con 2FA, sulla porta TCP <code>8008</code>.",
+      "seeAlso": [
+        {
+          "label": "ProxMenux Monitor",
+          "href": "/docs/settings/proxmenux-monitor"
+        }
+      ]
+    },
+    {
+      "term": "qcow2",
+      "aliases": [
+        "QEMU Copy-On-Write v2"
+      ],
+      "category": "Archiviazione",
+      "definitionRich": "Formato di immagine disco VM comune nelle archiviazioni di tipo directory. Supporta allocazione su richiesta, snapshot e copy-on-write. Conversione con <code>qemu-img convert -O qcow2 ...</code>."
+    },
+    {
+      "term": "qm",
+      "aliases": [
+        "Gestore QEMU"
+      ],
+      "category": "Proxmox",
+      "definitionRich": "Strumento per gestire VM in Proxmox: <code>qm list / start / stop / shutdown / config / set / destroy / importdisk / migrate</code>. Equivale a <code>pct</code> per i container.",
+      "seeAlso": [
+        {
+          "label": "Gestione di VM e container",
+          "href": "/docs/help-info/vm-ct-commands"
+        }
+      ]
+    },
+    {
+      "term": "Q35",
+      "category": "Virtualizzazione",
+      "definitionRich": "Tipo di macchina QEMU che emula il chipset Intel Q35 con PCIe. Consigliato rispetto a i440FX per passthrough PCIe e sistemi ospiti moderni. Si imposta con <code>qm set &lt;vmid&gt; -machine q35</code>."
+    },
+    {
+      "term": "QEMU",
+      "category": "Virtualizzazione",
+      "definitionRich": "Emulatore di macchine e virtualizzatore open source. Proxmox lo combina con KVM per eseguire VM con prestazioni vicine a quelle native."
+    },
+    {
+      "term": "rclone",
+      "category": "Linux",
+      "definitionRich": "Strumento da riga di comando compatibile con numerosi servizi, tra cui Google Drive, Dropbox, OneDrive, Mega e S3. La guida ai backup cloud lo usa per montare uno spazio remoto come directory per gli archivi vzdump.",
+      "seeAlso": [
+        {
+          "label": "Backup su cloud personale",
+          "href": "/guides/backup_cloud"
+        }
+      ]
+    },
+    {
+      "term": "Samba / SMB / CIFS",
+      "category": "Archiviazione",
+      "definitionRich": "Famiglia di protocolli Microsoft per condividere file. <strong>SMB</strong> è il protocollo, <strong>Samba</strong> l’implementazione open source per Linux e <strong>CIFS</strong> un vecchio dialetto SMB. Si aggiunge a Proxmox con <code>pvesm add cifs</code>.",
+      "seeAlso": [
+        {
+          "label": "Gestore storage e condivisioni",
+          "href": "/docs/storage-share"
+        }
+      ]
+    },
+    {
+      "term": "SeaBIOS",
+      "category": "Virtualizzazione",
+      "definitionRich": "Implementazione open source del BIOS tradizionale usata da QEMU. Firmware predefinito delle nuove VM, salvo scelta di OVMF. Adatto a sistemi datati e installazioni Linux che non richiedono UEFI."
+    },
+    {
+      "term": "smartctl / SMART",
+      "aliases": [
+        "Self-Monitoring, Analysis and Reporting Technology"
+      ],
+      "category": "Archiviazione",
+      "definitionRich": "Diagnostica integrata nei dischi per stato, errori e risultati degli autotest. Lo strumento è <code>smartctl</code>, del pacchetto <code>smartmontools</code>; <code>nvme-cli</code> aggiunge comandi specifici per NVMe.",
+      "seeAlso": [
+        {
+          "label": "Integrità e test disco SMART",
+          "href": "/docs/disk-manager/smart-disk-test"
+        },
+        {
+          "label": "Comandi di archiviazione → sezione SMART",
+          "href": "/docs/help-info/storage-commands"
+        }
+      ]
+    },
+    {
+      "term": "systemd / systemctl / journalctl",
+      "category": "Linux",
+      "definitionRich": "Sistema di inizializzazione Debian / Proxmox. <code>systemctl</code> gestisce i servizi: avvio, arresto, abilitazione e stato. <code>journalctl</code> legge il registro binario prodotto da <code>systemd-journald</code>."
+    },
+    {
+      "term": "sysctl",
+      "category": "Linux",
+      "definitionRich": "Strumento per leggere e modificare parametri del kernel. Le impostazioni persistenti risiedono normalmente in <code>/etc/sysctl.d/*.conf</code>; il supporto a <code>/etc/sysctl.conf</code> dipende dal servizio di caricamento. ProxMenux offre un profilo sysctl dopo l’installazione.",
+      "seeAlso": [
+        {
+          "label": "Post-Install: Rete",
+          "href": "/docs/post-install/network"
+        }
+      ]
+    },
+    {
+      "term": "trixie",
+      "category": "Linux",
+      "definitionRich": "Nome in codice di Debian 13, base di Proxmox VE 9. Il predecessore è <em>bookworm</em> (Debian 12 / PVE 8).",
+      "seeAlso": [
+        {
+          "label": "Aggiorna PVE 8 a PVE 9",
+          "href": "/docs/utils/upgrade-pve8-pve9"
+        }
+      ]
+    },
+    {
+      "term": "udev",
+      "category": "Linux",
+      "definitionRich": "Gestore dei dispositivi Linux. Risponde agli eventi hardware e crea o rimuove voci in <code>/dev</code>. Le regole in <code>/etc/udev/rules.d/</code> possono fissare nomi di interfaccia tramite MAC, creare dispositivi NVIDIA al caricamento del driver e altro."
+    },
+    {
+      "term": "UID / GID idmap",
+      "aliases": [
+        "Cambio UID"
+      ],
+      "category": "Linux",
+      "definitionRich": "Con la mappatura predefinita dei LXC <strong>non privilegiati</strong>, UID e GID sull’host sono traslati di <code>+100000</code>: UID 0 corrisponde a 100000 e 1000 a 101000. Le mappature personalizzate possono differire; i proprietari dei file nei bind mount devono essere coerenti.",
+      "seeAlso": [
+        {
+          "label": "Punti di montaggio LXC",
+          "href": "/docs/storage-share/lxc-mount-points"
+        }
+      ]
+    },
+    {
+      "term": "Container non privilegiato",
+      "category": "Linux",
+      "definitionRich": "Container LXC il cui root corrisponde a un UID non privilegiato sull’host, normalmente 100000. Riduce i privilegi sull’host pur condividendone il kernel. L’accesso hardware resta configurabile con permessi e mappature adeguati; la modalità privilegiata non è sempre necessaria."
+    },
+    {
+      "term": "VFIO",
+      "aliases": [
+        "Funzione virtuale I/O"
+      ],
+      "category": "Virtualizzazione",
+      "definitionRich": "Infrastruttura del kernel Linux per driver sicuri nello spazio utente, usata per assegnare direttamente dispositivi PCIe alle VM. Coinvolge <code>vfio</code>, <code>vfio_iommu_type1</code> e <code>vfio_pci</code>, configurati in <code>/etc/modprobe.d/vfio.conf</code>.",
+      "seeAlso": [
+        {
+          "label": "Post-Install: Virtualizzazione",
+          "href": "/docs/post-install/virtualization"
+        }
+      ]
+    },
+    {
+      "term": "VirtIO",
+      "category": "Virtualizzazione",
+      "definitionRich": "Famiglia di driver paravirtualizzati per rete, archiviazione, memoria dinamica e GPU. Evitano l’overhead dell’hardware emulato tradizionale, come e1000 o IDE. L’ospite richiede i driver corrispondenti: integrati in Linux e disponibili su ISO separata per Windows."
+    },
+    {
+      "term": "VLAN",
+      "aliases": [
+        "Rete locale virtuale"
+      ],
+      "category": "Rete",
+      "definitionRich": "Tag 802.1Q che suddividono una rete fisica in più reti logiche. Si configurano per bridge o interfaccia in <code>/etc/network/interfaces</code>."
+    },
+    {
+      "term": "VM",
+      "aliases": [
+        "Macchina virtuale"
+      ],
+      "category": "Proxmox",
+      "definitionRich": "Macchina virtuale gestita da Proxmox con QEMU/KVM, dotata di kernel proprio. Il VMID numerico corrisponde a <code>/etc/pve/qemu-server/&lt;VMID&gt;.conf</code>. Generalmente comporta più overhead di LXC, con isolamento tramite un kernel separato.",
+      "seeAlso": [
+        {
+          "label": "Gestione di VM e container",
+          "href": "/docs/help-info/vm-ct-commands"
+        }
+      ]
+    },
+    {
+      "term": "vzdump",
+      "category": "Proxmox",
+      "definitionRich": "Strumento di backup Proxmox per VM e CT. Gli archivi su file <strong>non sono incrementali</strong>; le destinazioni PBS supportano trasferimenti incrementali. Ogni attività configura modalità (snapshot / suspend / stop), compressione (come zstd, gzip o lzo), conservazione e notifiche.",
+      "seeAlso": [
+        {
+          "label": "Comandi di backup e ripristino",
+          "href": "/docs/help-info/backup-commands"
+        }
+      ]
+    },
+    {
+      "term": "ZFS",
+      "aliases": [
+        "Zettabyte File System"
+      ],
+      "category": "Archiviazione",
+      "definitionRich": "File system e gestore di volumi con snapshot, replica send/receive, checksum e compressione. Può riparare dati corrotti se esiste una copia ridondante valida. La cache <strong>ARC</strong> usa RAM e può essere limitata.",
+      "seeAlso": [
+        {
+          "label": "Comandi di gestione ZFS",
+          "href": "/docs/help-info/zfs-commands"
+        }
+      ]
+    }
+  ]
+}
diff --git a/web/messages/it/docs/hardware/coral-tpu-lxc.json b/web/messages/it/docs/hardware/coral-tpu-lxc.json
new file mode 100644
index 00000000..f730c27b
--- /dev/null
+++ b/web/messages/it/docs/hardware/coral-tpu-lxc.json
@@ -0,0 +1,120 @@
+{
+  "meta": {
+    "title": "Aggiungi Coral TPU a LXC | Documentazione ProxMenux",
+    "description": "Condividi un Google Coral TPU USB o M.2 / PCIe con un LXC Proxmox. ProxMenux configura dispositivi, permessi e montaggi, avvia il container e installa il runtime Edge TPU nelle distribuzioni compatibili."
+  },
+  "header": {
+    "title": "Aggiungi Coral TPU a LXC",
+    "description": "Condividi un Coral USB Accelerator o M.2 / Mini-PCIe con un LXC. ProxMenux configura il container e il runtime Edge TPU. Questa opzione gestisce solo la TPU: per Quick Sync, VA-API o NVENC, esegui anche Aggiungi GPU a LXC.",
+    "section": "Hardware: GPU e Coral-TPU"
+  },
+  "intro": {
+    "title": "Cosa fa",
+    "body": "Scrive la configurazione in <code>/etc/pve/lxc/&lt;ctid&gt;.conf</code> per <strong>USB Accelerator</strong>, <strong>Coral M.2 / PCIe</strong> o entrambi. Avvia il container e installa il runtime Google <code>libedgetpu</code>. Il GPU si configura separatamente con <lxcGpuLink>Aggiungi GPU a LXC</lxcGpuLink>."
+  },
+  "whenUse": {
+    "heading": "Quando usarlo",
+    "body": "Per <frigateLink>Frigate</frigateLink> o altre applicazioni Linux compatibili in LXC. Coral esegue l’inferenza ML supportata al posto della CPU. Le prestazioni dipendono da modello e hardware; decodifica video e altre attività consumano comunque risorse."
+  },
+  "prereqs": {
+    "title": "Prima di iniziare",
+    "drivers": "<strong>Prepara il dispositivo Coral sull’host</strong>. M.2 / PCIe richiede il driver host caricato; USB richiede accesso al dispositivo e permessi adeguati. Vedi <hostLink>Installa Coral TPU sull’host</hostLink>. Lo script installa il runtime dell’applicazione nei container Debian/Ubuntu; le altre distribuzioni devono fornirlo separatamente.",
+    "driversCheck": "ls /dev/apex_* 2>/dev/null ; lsusb | grep -E '1a6e:089a|18d1:9302'",
+    "container": "<strong>Un LXC esistente</strong>, preferibilmente basato su <strong>Debian / Ubuntu</strong>: l’installazione usa <code>apt-get</code>. I <strong>container di altre distribuzioni</strong> possono usare la <strong>modalità solo passthrough</strong>, che salta l’installazione APT di <code>libedgetpu</code>. Utile se l’applicazione include già il runtime, come l’immagine Docker Frigate.",
+    "downtime": "<strong>Prevedi una breve interruzione</strong> del container. Lo script lo ferma per configurarlo e lo avvia per installare il runtime. Queste modifiche non richiedono il riavvio dell’host."
+  },
+  "hostPrep": {
+    "title": "Prepara prima l’host",
+    "body": "M.2 / PCIe richiede <code>gasket</code>/<code>apex</code> sull’host e un dispositivo funzionante. USB richiede dispositivo collegato e permessi; l’app non deve essere eseguita sull’host. <code>libedgetpu</code> deve essere disponibile dove gira l’app. Ordine: <strong>preparare l’host → accesso LXC → configurare l’app</strong>."
+  },
+  "running": {
+    "heading": "Eseguire lo script",
+    "body": "In ProxMenux, apri <strong>Hardware: GPU e Coral-TPU → Aggiungi Coral TPU a LXC</strong>.",
+    "imageAlt": "Voce Aggiungi Coral TPU a LXC nel menu hardware"
+  },
+  "howRuns": {
+    "heading": "Come funziona lo script",
+    "body": "Scegli il container. Lo script configura l’accesso USB anche senza Coral USB collegato e aggiunge M.2 / PCIe se rileva quel dispositivo."
+  },
+  "walkthrough": {
+    "heading": "Procedura passo per passo",
+    "pick": {
+      "title": "Scegli il container LXC",
+      "body": "La selezione mostra i container idonei di <code>pct list</code>; quelli OCI sono nascosti e gestiti da Apps nel gestore OCI. Scegli il container, avviato o fermo. Lo script lo arresta se necessario, lo configura e lo avvia per installare il runtime."
+    },
+    "gpuHint": {
+      "title": "Suggerimento facoltativo per l’accesso GPU",
+      "body": "Se viene rilevato un GPU non configurato per questo container, un dialogo consiglia <lxcGpuLink>Aggiungi GPU a LXC</lxcGpuLink> per la decodifica video hardware, come Quick Sync, VA-API o NVENC. Chiede se proseguire solo con Coral: Sì continua la configurazione del TPU; No esce per permetterti di configurare prima il GPU."
+    },
+    "usb": {
+      "title": "Configurare l’accesso USB del LXC",
+      "body": "Crea una regola udev sull’host per <code>/dev/coral</code> e monta l’albero <strong>completo</strong> <code>/dev/bus/usb</code> nel container. La configurazione viene scritta anche senza Coral USB collegato ed espone più di quel solo dispositivo.",
+      "whyTitle": "Perché montare /dev/bus/usb invece di /dev/coral?",
+      "whyBody": "Il percorso USB, ad esempio <code>/dev/bus/usb/001/005</code>, cambia alla riconnessione. Le versioni precedenti montavano il link <code>/dev/coral</code> e potevano conservare un percorso obsoleto. Montare tutto l’albero USB rende visibile il nodo attuale. L’app potrebbe comunque dover riaprire il dispositivo."
+    },
+    "pcie": {
+      "title": "Configurare l’accesso M.2 / PCIe del LXC",
+      "body1": "Se rileva Coral M.2 / PCIe ed esiste <code>/dev/apex_0</code>, usa l’API Proxmox <code>dev</code> per gestire cgroup2 nei LXC privilegiati e non privilegiati:",
+      "body2": "Se <code>/dev/apex_0</code> è assente dopo <hostLink>Installa Coral sull’host</hostLink>, lo script scrive un bind mount con <code>create=file</code> e, solo quando il numero major di apex è elencato in <code>/proc/devices</code>, una regola cgroup2 classica. Nessuno dei due crea un dispositivo funzionante:",
+      "rebootTitle": "Riavviare l'host prima se hai appena installato i driver Coral",
+      "rebootBody": "Il montaggio alternativo non carica <code>apex</code> sull’host. Carica il driver o riavvia dopo l’installazione e verifica il dispositivo. Poi riesegui lo script per applicare la voce moderna e riavvia il container."
+    },
+    "drivers": {
+      "title": "Avviare il LXC e installare il runtime Coral",
+      "body": "Avvia il container e attende fino a 15 secondi lo stato running, poi usa <code>pct exec</code> per eseguire l’installazione al suo interno. L’installer:",
+      "items": [
+        "Esegue <code>apt-get update</code>.",
+        "Installa i prerequisiti del repository Coral: <code>gnupg</code>, <code>curl</code>, <code>ca-certificates</code>.",
+        "Importa la chiave GPG Coral di Google per <code>/etc/apt/keyrings/coral-edgetpu.gpg</code> (percorso moderno, come l'installatore host) e aggiunge il repository APT <code>coral-edgetpu-stable</code> con <code>signed-by=</code>.",
+        "Installa <code>libedgetpu1-std</code> come predefinito. Se rileva Coral M.2, propone <code>libedgetpu1-std</code> o <code>libedgetpu1-max</code>. La scelta del pacchetto non configura da sola il rilevamento nell’applicazione."
+      ],
+      "noIgpuTitle": "Perché nessun driver iGPU qui?",
+      "noIgpuBody": "Prima installava anche <code>va-driver-all</code>, <code>intel-opencl-icd</code> e altri pacchetti Intel per combinare Quick Sync e Coral. Ciò causava errori poco chiari quando serviva solo Coral. Ora l’iGPU si configura con <lxcGpuLink>Aggiungi GPU a LXC</lxcGpuLink>; eseguilo prima se serve decodifica video hardware.",
+      "debianTitle": "Altre distribuzioni: solo accesso al dispositivo",
+      "debianBody": "Usa <code>apt-get</code> in Debian/Ubuntu. Per <strong>Alpine, Arch, RHEL o SUSE</strong>, rilevati tramite <code>/etc/os-release</code>, propone <em>continuare solo con l’accesso al dispositivo</em> oppure <em>annullare</em>. Il primo configura <code>/etc/pve/lxc/&lt;ctid&gt;.conf</code> senza installare <code>libedgetpu</code>. Se l’app include già il runtime, come Frigate Docker, basta questa modalità. Altrimenti installa <code>libedgetpu</code> seguendo la <coralLink>guida ufficiale Google</coralLink>."
+    },
+    "summary": {
+      "title": "Riepilogo",
+      "body": "Al termine mostra Coral USB e M.2 con ✓ o ⚠ in base al rilevamento hardware. Il container resta avviato per configurare Frigate, CodeProject.AI o l’applicazione."
+    }
+  },
+  "manual": {
+    "heading": "Procedura manuale equivalente",
+    "body": "Se si desidera vedere esattamente cosa va nella configurazione LXC, o applicarla a mano:",
+    "usbHeading": "USB Coral",
+    "pcieHeading": "M.2 / PCIe Coral",
+    "runtimeHeading": "Nel container: runtime Coral"
+  },
+  "verification": {
+    "heading": "Verifica",
+    "body": "Apri una shell nel container e verifica che Coral sia visibile:"
+  },
+  "troubleshoot": {
+    "heading": "Risoluzione dei problemi",
+    "apexTitle": "LXC avviato, ma manca /dev/apex_0",
+    "apexBody": "Verifica prima il driver host: <code>lsmod | grep apex</code>. Se manca, prova <code>modprobe apex</code> o riavvia dopo l’installazione del driver. Quando <code>/dev/apex_0</code> esiste sull’host, verifica la voce del dispositivo LXC (riesegui lo script se sono state scritte solo le voci di ripiego) e riavvia il container con <code>pct stop &lt;ctid&gt; &amp;&amp; pct start &lt;ctid&gt;</code>.",
+    "replugTitle": "Coral USB scompare dopo la riconnessione a un’altra porta",
+    "replugBody": "Verifica che il LXC monti <code>/dev/bus/usb</code> anziché il link <code>/dev/coral</code>. La configurazione deve contenere <code>lxc.mount.entry: /dev/bus/usb dev/bus/usb ...</code> senza dipendere direttamente da <code>/dev/coral</code>. Riesegui lo script se la configurazione è vecchia.",
+    "alpineTitle": "Alpine / Arch / RHEL / SUSE: runtime non installato",
+    "alpineBody": "La <em>modalità solo passthrough</em> configura il dispositivo senza installare <code>libedgetpu</code>. Usa un pacchetto compatibile o compila i sorgenti; verifica la disponibilità prima di comandi come <code>apk add</code> in Alpine. Frigate può includere il runtime. Con Docker nel LXC, inoltra anche M.2 con <code>--device /dev/apex_0:/dev/apex_0</code> oppure monta USB in Docker: il solo montaggio LXC non basta.",
+    "frigateTitle": "Frigate mostra «Coral EdgeTPU detected but not available»",
+    "frigateBody": "Verifica runtime, visibilità e accesso in lettura/scrittura del processo reale. Per USB, controlla permessi ed eventuale gruppo <code>plugdev</code>. Per M.2, ispeziona <code>/dev/apex_0</code> con <code>ls -l /dev/apex_0</code>. Un nome come <code>apex</code> in <code>/etc/group</code> non basta: GID numerici e mappature LXC devono coincidere. Controlla se altri processi occupano la TPU; non passare subito alla modalità privilegiata.",
+    "logsTitle": "Controllare entrambi i registri host e container",
+    "logsBody": "Sull’host controlla i messaggi del kernel con <code>journalctl -k | grep -i -e apex -e gasket -e usb</code>. Nel LXC leggi i registri dell’app; con Docker annidato usa <code>docker logs &lt;container&gt;</code>. Permessi, runtime assente, connessione USB o un altro processo sulla TPU possono causare errori."
+  },
+  "related": {
+    "heading": "Vedi anche",
+    "items": [
+      {
+        "label": "Installa Coral TPU sull’host",
+        "href": "/docs/hardware/install-coral-tpu-host",
+        "tail": " — requisito per usare schede Coral M.2 / PCIe in un CT."
+      },
+      {
+        "label": "Aggiungi GPU a LXC",
+        "href": "/docs/hardware/igpu-acceleration-lxc",
+        "tail": " — accesso GPU, spesso abbinato a Coral in Frigate."
+      }
+    ]
+  }
+}
diff --git a/web/messages/it/docs/hardware/gpu-vm-passthrough.json b/web/messages/it/docs/hardware/gpu-vm-passthrough.json
new file mode 100644
index 00000000..6579eca6
--- /dev/null
+++ b/web/messages/it/docs/hardware/gpu-vm-passthrough.json
@@ -0,0 +1,178 @@
+{
+  "meta": {
+    "title": "Aggiungi GPU a VM | Documentazione ProxMenux",
+    "description": "Assegna una GPU fisica a una VM Proxmox. ProxMenux verifica IOMMU, configura VFIO e dispositivi VM e rileva conflitti con altre VM o LXC."
+  },
+  "header": {
+    "title": "Aggiungi GPU a VM (Passthrough)",
+    "description": "Rileva GPU Intel, AMD o NVIDIA per l’accesso diretto da una VM. Verifica IOMMU e dispositivi associati, configura VFIO e VM e applica le regole di compatibilità. Controlla tutti i dispositivi interessati.",
+    "section": "Hardware: GPU e Coral-TPU"
+  },
+  "intro": {
+    "title": "Cosa fa",
+    "body": "Automatizza i passaggi host e <code>hostpci</code> della <pveLink>documentazione PCI passthrough Proxmox</pveLink>. Controlla assegnazioni ad <em>altri</em> guest e propone soluzioni ai conflitti. Non garantisce supporto per ogni GPU, metodo di reset o driver guest."
+  },
+  "who": {
+    "heading": "Per chi è questo?",
+    "body": "Per l’accesso diretto di una <strong>macchina virtuale</strong> alla GPU tramite VFIO. Finché è associata a VFIO, il driver host non può usarla, anche con VM ferma. Per condividerla con <em>LXC</em>, usa <lxcLink>Aggiungi GPU a LXC</lxcLink>."
+  },
+  "prereqs": {
+    "title": "Prima di iniziare",
+    "gpu": "<strong>GPU compatibile</strong> installata fisicamente. Lo script rileva Intel, AMD e NVIDIA con <code>lspci</code>.",
+    "gpuCheck": "lspci | grep -iE 'VGA|3D|Display'",
+    "iommu": "<strong>Supporto IOMMU</strong> hardware e attivazione firmware se richiesta (Intel VT-d o AMD-Vi). Verifica il sistema e può configurare Linux; non cambia BIOS/UEFI né prova che IOMMU inattivo sia disabilitato nel firmware.",
+    "q35": "L’assistente richiede <strong>q35</strong> e rifiuta <code>i440fx</code>. Il tipo di macchina è distinto dal firmware BIOS/UEFI. Cambiare chipset a una VM esistente richiede pianificazione e non è automatico.",
+    "q35Check": "qm config VMID | grep machine",
+    "moreGpus": "Prepara <strong>un’altra GPU o accesso alternativo</strong> via SSH, IPMI o seriale. Riservare la GPU principale può togliere l’immagine locale. Per <em>NVIDIA</em>, una scheda fuori dal gruppo IOMMU interessato può restare sull’host.",
+    "nvidiaInstalled": "Dopo l’<nvidiaLink>installazione NVIDIA sull’host</nvidiaLink>, le funzioni scelte sono riservate a <code>vfio-pci</code> anziché <code>nvidia</code>. Il modulo <code>nvidia</code> può restare disponibile per <strong>altre</strong> schede fuori dal gruppo IOMMU interessato. Verifica con <code>nvidia-smi</code>."
+  },
+  "pickOne": {
+    "title": "Assegnazione esclusiva VM o condivisione LXC",
+    "body": "Un GPU legato a <code>vfio-pci</code> per il passaggio VM non può essere utilizzato simultaneamente dall'host o da un LXC. Se hai due GPU, puoi dedicarne uno ad ogni percorso. Se ne hai uno solo, scegli:",
+    "vmItem": "<strong>VM:</strong> accesso diretto ed esclusivo per quella VM.",
+    "lxcItem": "<strong>LXC (<lxcLink>Aggiungi GPU a LXC</lxcLink>):</strong> condivide il dispositivo con host e altri container tramite il driver nativo."
+  },
+  "running": {
+    "heading": "Eseguire l’installer",
+    "body": "Apri ProxMenux e scegli <strong>Hardware: GPU e Coral-TPU → Aggiungi GPU a VM</strong>.",
+    "imageAlt": "Voce del menu per aggiungere GPU a VM"
+  },
+  "howRuns": {
+    "heading": "Come funziona lo script",
+    "body": "Rilevamento e selezione precedono le modifiche principali, confermate da un riepilogo finale. Attivare IOMMU ha una conferma precedente e può già modificare l’avvio. La successiva pulizia audio può chiedere un’altra scelta."
+  },
+  "walkthrough": {
+    "heading": "Procedura passo per passo",
+    "detect": {
+      "title": "Rileva GPU e controlla IOMMU",
+      "body": "Considera IOMMU attivo solo quando il kernel in esecuzione ha <code>intel_iommu=on</code> o <code>amd_iommu=on</code> ed esistono gruppi IOMMU. Se il parametro è già salvato per il prossimo avvio, prosegue in modalità riavvio in sospeso; altrimenti un passaggio confermato separatamente può aggiungerlo con <code>iommu=pt</code>. La sua euristica per il file di avvio usa <code>/etc/kernel/cmdline</code> quando vi si trova un marcatore di root ZFS come <code>root=ZFS=</code>; altrimenti usa <code>/etc/default/grub</code>. Questa euristica non prova quale sia il bootloader effettivo. L’IOMMU appena configurato ha effetto dopo il riavvio; verifica poi i gruppi reali.",
+      "tipTitle": "Hai già configurato la post-installazione?",
+      "tipBody": "Se il <postLink>supporto VFIO IOMMU</postLink> è già configurato e attivo nel kernel, il controllo passa. Un’impostazione per il prossimo avvio non prova che sia attivo ora.",
+      "imageAlt": "Elenco delle GPU rilevate con indirizzo fornitore e PCI"
+    },
+    "preflight": {
+      "title": "Scegli GPU ed esegui i controlli preliminari",
+      "intro": "Una volta scelto il GPU, lo script esegue una serie di controlli che possono ogni blocco ulteriori progressi:",
+      "items": [
+        "<strong>Controllo SR-IOV.</strong> Rifiuta VF e PF con VF attive perché configura dispositivi interi, non SR-IOV. Configura SR-IOV separatamente su hardware supportato.",
+        "<strong>Una sola GPU.</strong> La console locale può perdere l’uscita quando VFIO la riserva. Verifica prima l’accesso SSH o web da un altro computer.",
+        "<strong>Politica di reset AMD.</strong> Legge <code>/sys/bus/pci/devices/&lt;pci&gt;/reset_method</code>. APU o scheda dedicata senza FLR viene <em>bloccata dalla politica dell’assistente</em>; un sottotipo sconosciuto senza FLR richiede conferma. Non prova un’impossibilità universale.",
+        "<strong>Stato D3cold.</strong> Blocca schede AMD che indicano <code>D3cold</code> per il rischio di mancata attivazione. Verifica alimentazione e firmware.",
+        "<strong>Analisi del gruppo IOMMU.</strong> Legge <code>/sys/kernel/iommu_groups/</code> e include nel piano della VM <em>tutti i membri non bridge</em>, eventualmente controller di rete o di archiviazione. Se il gruppo contiene dispositivi di un altro slot, lo script li elenca prima del riepilogo; verifica che l’host non ne abbia bisogno. Se IOMMU attende un riavvio, i gruppi reali non sono disponibili e il piano contiene inizialmente solo la funzione GPU selezionata; verifica l’isolamento dopo il riavvio."
+      ],
+      "audioIntro": "<strong>Audio associato.</strong> Due casi secondo la posizione del controller:",
+      "audioDgpu": "<strong>GPU dedicata:</strong> l’audio HDMI occupa spesso la funzione <code>.1</code> dello stesso slot PCI ed è incluso se rilevato. Se l’host lo usava, perde l’accesso riservandolo alla VM.",
+      "audioIgpu": "<strong>Senza funzione audio <code>.1</code>:</strong> può trovarsi altrove, per esempio <code>00:1f.3</code>. Elenca controller e driver come <code>snd_hda_intel</code>. Per impostazione predefinita <strong>nessuno</strong> è selezionato; scegli solo quelli necessari."
+    },
+    "pickVm": {
+      "title": "Scegli la VM di destinazione",
+      "body": "Scegli la VM. Richiede q35 e riutilizza le voci GPU esistenti dove possibile. BIOS/UEFI è un’impostazione separata, non un tipo di macchina. Non cambia automaticamente chipset o avvio del guest installato.",
+      "imageAlt": "Selezione VM per nome, ID e stato"
+    },
+    "switchMode": {
+      "title": "Gestire assegnazioni esistenti",
+      "intro": "Lo script scansiona ogni configurazione VM e ogni configurazione LXC sull'host alla ricerca del GPU selezionato. Tre possibili risultati:",
+      "items": [
+        "<strong>GPU disponibile.</strong> Prosegue senza rimuovere assegnazioni.",
+        "<strong>Assegnata a un’altra VM.</strong> Arresta prima la sorgente. Puoi <em>mantenere le voci disattivando l’avvio automatico</em> oppure <em>rimuoverle mantenendo l’avvio automatico</em>. Con <code>vfio-pci</code> già attivo e nessuna modifica host necessaria, il trasferimento VM→VM può evitare il riavvio host.",
+        "<strong>GPU usata da LXC.</strong> Nei container normali scegli <em>mantenere la configurazione GPU e disattivare l’avvio automatico</em> o <em>rimuovere la configurazione del dispositivo GPU mantenendo l’avvio automatico</em>. La rimozione elimina le voci <code>devN</code> e, per AMD/Intel, anche le vecchie regole <code>/dev/dri</code> <code>lxc.mount.entry</code> e <code>lxc.cgroup2.devices.allow</code>. I container OCI conservano la configurazione e vengono fermati con l’avvio automatico disattivato; rimuovi la loro GPU tramite OCI manager Apps. Il rilevamento dei conflitti avviene per famiglia di dispositivi GPU e può includere altre schede della stessa famiglia."
+      ],
+      "imageAlt": "Offerta di dialogo per rimuovere il GPU da un LXC prima di assegnarlo al VM",
+      "smartTitle": "Verificare l’audio associato rimuovendo la GPU",
+      "smartBody": "Poi può proporre un elenco di <strong>dispositivi audio forse inutilizzati</strong> nella VM sorgente. Deseleziona quelli ancora necessari. Per esempio può mantenere <code>02:00.1</code> e proporre di rimuovere <code>00:1f.3</code>. La scelta determina la rimozione; non garantisce ogni associazione audio/video."
+    },
+    "audioPick": {
+      "title": "Senza audio .1, scegli i controller necessari",
+      "body": "Succede solo per Intel iGPU e simili configurazioni split-audio. Una lista di controllo mostra ogni controller audio PCI sull'host (escluso qualsiasi già nel gruppo IOMMU di GPU), etichettato con il suo driver corrente. Selezionare quelli che si desidera - o nessuno, se il VM non ha bisogno di audio dall'hardware host.",
+      "imageAlt": "finestra di dialogo con ogni controller audio PCI host (BDF + driver) quando il GPU non ha un audio di sibling .1",
+      "warnTitle": "Non selezionare audio necessario all’host",
+      "warnBody": "Assegnare l’audio può togliere accesso all’host; il controller non può appartenere anche a un’altra VM attiva. Non selezionare audio superfluo e verifica le assegnazioni. Il segnale acustico della console non proviene necessariamente dall’audio PCI."
+    },
+    "summary": {
+      "title": "Riepilogo della conferma",
+      "body": "Verifica il piano finale dell’host e della VM e annulla se è errato. Mostra il gruppo IOMMU e il numero dei suoi dispositivi; i membri di un altro slot sono elencati nel passaggio precedente. L’annullamento ferma le modifiche principali, ma non annulla una modifica della configurazione di avvio IOMMU confermata separatamente in precedenza.",
+      "imageAlt": "Riepilogo delle modifiche previste a host e VM"
+    },
+    "hostApply": {
+      "title": "Le modifiche degli host sono applicate",
+      "intro": "La fase applicativa modifica host e VM. La pulizia audio può ancora richiedere una scelta. Possibili modifiche:",
+      "items": [
+        "<code>/etc/modules</code> — aggiunge <code>vfio</code>, <code>vfio_iommu_type1</code>, <code>vfio_pci</code> (più <code>vfio_virqfd</code> sui kernel &lt; 6.2).",
+        "<code>/etc/modprobe.d/vfio.conf</code> — AMD/Intel: <code>options vfio-pci ids=&lt;vendor:device,...&gt; disable_vga=1</code>. NVIDIA: <code>softdep nvidia pre: vfio-pci</code> (<code>_drm</code>/<code>_modeset</code>/<code>_uvm</code>); l’associazione effettiva è per BDF. AMD aggiunge l’ordine di caricamento <code>softdep</code>: <code>vfio-pci</code> → <code>radeon</code>/<code>amdgpu</code>.",
+        "Scrive <code>/etc/modprobe.d/iommu_unsafe_interrupts.conf</code> e <code>kvm.conf</code> con <code>allow_unsafe_interrupts=1</code> e <code>ignore_msrs=1</code>. Sono impostazioni dello script, non requisiti universali Windows/macOS; gli interrupt non sicuri riducono la protezione del remapping.",
+        "<code>/etc/modprobe.d/blacklist.conf</code>: NVIDIA — <code>nouveau</code>/<code>lbm-nouveau</code>; AMD — <code>radeon</code> + <code>amdgpu</code>; Intel — <code>i915</code>. Queste regole per produttore possono influire su altre schede con lo stesso driver. Il modulo <code>nvidia</code> è bloccato <strong>solo</strong> tramite <code>/etc/modprobe.d/proxmenux-nvidia-vfio-blacklist.conf</code> quando <em>tutte</em> le NVIDIA host sono riservate a VFIO.",
+        "<code>/etc/udev/rules.d/10-proxmenux-vfio-bind.rules</code> + <code>/etc/proxmenux/vfio-bind.bdfs</code> — <strong>Solo NVIDIA.</strong> Applica <code>ATTR'{'driver_override'}'=\"vfio-pci\"</code> al PCI ADD dei BDF registrati, incluse le funzioni del gruppo IOMMU interessato. Fuori da quei gruppi può restare <code>nvidia</code>. La politica BDF non divide gruppi IOMMU hardware.",
+        "<strong>Solo AMD.</strong> Tenta un dump della ROM da <code>/sys/bus/pci/.../rom</code> o ACPI VFCT in <code>/usr/share/kvm/vbios_&lt;vendor&gt;_&lt;device&gt;.bin</code>. Se riesce, la VM usa <code>romfile=</code>. Un dump valido non garantisce la corretta inizializzazione della GPU.",
+        "<strong>Solo NVIDIA.</strong> Ferma e disattiva <code>nvidia-persistenced</code>, <code>nvidia-powerd</code>, <code>nvidia-fabricmanager</code> solo se tutte le NVIDIA sono riservate a VFIO. In uso misto mantiene servizi e <code>nvidia</code> per le schede native.",
+        "<code>update-initramfs -u -k all</code> — funziona solo se uno dei suddetti effettivamente cambiato."
+      ]
+    },
+    "vmApply": {
+      "title": "La configurazione della VM viene applicata tramite qm set",
+      "body": "La configurazione in <code>/etc/pve/qemu-server/&lt;vmid&gt;.conf</code> viene aggiornata tramite <code>qm set</code>, non modificata direttamente con <code>sed</code>.",
+      "after1": "Aggiunge <code>x-vga=1</code> per AMD e NVIDIA, <strong>non</strong> Intel. È la politica dello script, non prova che ogni iGPU Intel sia priva di firmware o che il flag causi sempre blocchi.",
+      "after2": "Ulteriori linee <code>hostpciN</code> sono allegate se il gruppo IOMMU di GPU contiene altri dispositivi che è necessario passare insieme."
+    },
+    "reboot": {
+      "title": "Riavvia se richiesto dalle modifiche host",
+      "body": "Segui il riavvio richiesto se cambiano avvio o driver e verifica l’associazione attiva prima di avviare la VM. La configurazione salvata non prova che sia attiva. VM→VM con VFIO corretto può evitare il riavvio host.",
+      "imageAlt": "Riepilogo schermo che mostra ciò che è stato cambiato, seguito da un prompt di riavvio"
+    }
+  },
+  "vendors": {
+    "heading": "Note per produttore",
+    "nvidiaHeading": "NVIDIA",
+    "nvidiaBody": "Mantiene un vecchio accorgimento per <em>Code 43</em>: <code>hidden=1</code>, ID <code>NV43FIX</code> in <code>args</code> e <code>kvm=off</code>. Non è un requisito universale delle GeForce attuali: NVIDIA ha abilitato il passthrough Windows da R465. L’errore può avere altre cause; verifica GPU e driver.",
+    "nvidiaMultiHeading": "Supporto Multi-GPU NVIDIA",
+    "nvidiaMultiBody": "Uso misto NVIDIA <strong>per BDF</strong>. Registra funzioni <code>vfio-pci</code> per indirizzo, non solo ID <code>vendor:device</code>. Fuori dai gruppi interessati può mantenere <code>nvidia</code>; verifica con <code>nvidia-smi</code>. Non isola due schede dello stesso gruppo.",
+    "amdHeading": "AMD",
+    "amdBody": "Alcune GPU AMD non si resettano dopo l’arresto VM. L’assistente verifica capacità dichiarate, non tutti i cicli reali. <vendorResetLink>vendor-reset</vendorResetLink> supporta dispositivi limitati e richiede kernel compatibile e caricamento anticipato; non viene installato. Anche <em>RadeonResetBugFix</em> su Windows dipende dall’hardware, senza garanzia universale.",
+    "intelHeading": "Intel iGPU",
+    "intelBody": "Passthrough completo Intel iGPU e SR-IOV sono distinti. L’assistente riserva il dispositivo a una VM senza <code>x-vga=1</code>. <sriovLink>i915-sriov-dkms</sriovLink> richiede hardware/kernel supportati; «UHD 630+» non è una regola di compatibilità. Prevedi accesso alternativo all’host."
+  },
+  "verification": {
+    "heading": "Verifica"
+  },
+  "troubleshoot": {
+    "heading": "Risoluzione dei problemi",
+    "code43Title": "Codice 43 in Windows (NVIDIA)",
+    "code43Body": "Code 43 non prova un errore di mascheramento. Controlla <code>qm config VMID | grep -E \"cpu|args\"</code> con VMID reale, poi <code>hidden=1</code> e <code>hv_vendor_id=NV43FIX</code>. Verifica anche driver guest, firmware e assegnazione. Ripetere può terminare se già assegnata.",
+    "amdResetTitle": "AMD GPU funziona una volta, fallisce sul riavvio di VM",
+    "amdResetBody": "Un reset fallito è una possibile causa. Riavvio o spegnimento completo possono aiutare temporaneamente. Verifica compatibilità e caricamento anticipato di <code>vendor-reset</code>; <code>softdep amdgpu pre: vendor-reset</code> da solo non garantisce caricamento prima di VFIO. Anche <em>RadeonResetBugFix</em> richiede una GPU compatibile.",
+    "stuckBootTitle": "Avvio bloccato VM / GPU non rilevato",
+    "stuckBootBody": "Controlla l’indirizzo reale con <code>lspci -nnk -s PCI_ADDRESS</code>; atteso <code>Kernel driver in use: vfio-pci</code>. Sostituisci PCI_ADDRESS. Se resta il driver nativo, verifica la politica di associazione, non solo <code>/etc/modprobe.d/blacklist.conf</code>; NVIDIA usa stato BDF. Leggi <code>dmesg | grep vfio</code>. Dopo correzioni, <code>update-initramfs -u -k all</code> e riavvio pianificato.",
+    "darkTitle": "Consolle Host va scuro dopo il riavvio e non posso SSH in",
+    "darkBody": "Lo schermo nero non prova che l’host sia spento. Se fallisce anche SSH, controlla rete e controller inclusi nel gruppo IOMMU. Recupera accesso via IPMI, seriale o ambiente di ripristino; verifica <code>/etc/pve/qemu-server/&lt;vmid&gt;.conf</code> e annulla solo assegnazioni/regole pertinenti. Non eliminare altra configurazione.",
+    "logTitle": "Controlla il registro di installazione",
+    "logBody": "Ogni esecuzione scrive <code>/tmp/add_gpu_vm.log</code>. Allegalo alle richieste di assistenza."
+  },
+  "revert": {
+    "heading": "Annullare le modifiche manualmente",
+    "intro": "Arresta la VM e rimuovi solo le assegnazioni PCI pertinenti da Hardware o con l’indice esplicito sotto. Non restituisce ancora la GPU al driver host. Usa Cambia modalità GPU per questa transizione e verifica i guest interessati."
+  },
+  "related": {
+    "heading": "Vedi anche",
+    "items": [
+      {
+        "label": "Installare driver NVIDIA (Host)",
+        "href": "/docs/hardware/nvidia-host",
+        "tail": " — prepara il driver per schede rimaste sull’host; una GPU in VFIO non può usarlo contemporaneamente."
+      },
+      {
+        "label": "Aggiungi GPU a LXC",
+        "href": "/docs/hardware/igpu-acceleration-lxc",
+        "tail": "— modello alternativo: condividere il GPU con più contenitori invece di dedicarlo a un VM."
+      },
+      {
+        "label": "Cambia modalità GPU (VM ↔ LXC)",
+        "href": "/docs/hardware/switch-gpu-mode",
+        "tail": " — passa la stessa GPU fra condivisione e assegnazione esclusiva."
+      },
+      {
+        "label": "Comandi di passaggio GPU",
+        "href": "/docs/help-info/gpu-commands",
+        "tail": "— lspci, IOMMU verifica, qm set hostpci riferimento."
+      }
+    ]
+  }
+}
diff --git a/web/messages/it/docs/hardware/igpu-acceleration-lxc.json b/web/messages/it/docs/hardware/igpu-acceleration-lxc.json
new file mode 100644
index 00000000..4a2e48b6
--- /dev/null
+++ b/web/messages/it/docs/hardware/igpu-acceleration-lxc.json
@@ -0,0 +1,185 @@
+{
+  "meta": {
+    "title": "Aggiungi GPU a LXC | Documentazione ProxMenux",
+    "description": "Condividi GPU Intel, AMD o NVIDIA con LXC. ProxMenux configura dispositivi, gruppi e librerie secondo la distribuzione; l’app deve supportare e configurare l’accelerazione."
+  },
+  "header": {
+    "title": "Aggiungi GPU a LXC",
+    "description": "Condivide l’accesso GPU con LXC tramite i dispositivi dell’host. Il driver resta sull’host; le app richiedono librerie compatibili e una configurazione propria.",
+    "section": "Hardware: GPU e Coral-TPU"
+  },
+  "intro": {
+    "title": "Cosa fa",
+    "body": "Aggiunge voci <code>dev&lt;N&gt;</code> a <code>/etc/pve/lxc/&lt;ctid&gt;.conf</code> per i nodi <code>/dev/dri/*</code>, <code>/dev/kfd</code> o <code>/dev/nvidia*</code> pertinenti. Avvia il container, installa i pacchetti userspace della sua distribuzione e, per Intel/AMD, allinea i gruppi <code>video</code> e <code>render</code>. L’accelerazione delle applicazioni richiede comunque hardware e librerie compatibili e configurazione dell’app."
+  },
+  "compare": {
+    "heading": "Condivisione LXC e passthrough VM a confronto",
+    "intro": "LXC condivide il kernel e può <em>condividere</em> la GPU fra host e container. Con il <vmLink>passthrough completo a una VM</vmLink>, il dispositivo è riservato alla VM e non è disponibile al driver dell’host.",
+    "headerFeature": "Caratteristica",
+    "headerLxc": "LXC (questa pagina)",
+    "headerVm": "VM",
+    "rows": [
+      {
+        "feature": "L’host può continuare a usare la GPU?",
+        "lxc": "Sì",
+        "vm": "No — esclusiva della VM"
+      },
+      {
+        "feature": "Più container possono condividere una GPU?",
+        "lxc": "Sì",
+        "vm": "No"
+      },
+      {
+        "feature": "Richiede IOMMU / VFIO sull'host?",
+        "lxc": "No",
+        "vm": "Sì"
+      },
+      {
+        "feature": "Riavvio richiesto?",
+        "lxc": "Di solito no (solo riavviare il CT)",
+        "vm": "Se cambia la configurazione di driver o IOMMU sull’host; non a ogni assegnazione"
+      },
+      {
+        "feature": "Sistemi operativi guest",
+        "lxc": "Solo Linux (LXC è Linux-solo)",
+        "vm": "Sistema guest supportato con driver GPU compatibile"
+      }
+    ]
+  },
+  "prereqs": {
+    "title": "Prima di iniziare",
+    "gpu": "<strong>GPU sull’host</strong> Intel, AMD o NVIDIA, rilevata tramite <code>lspci</code>.",
+    "gpuCheck": "lspci | grep -iE 'VGA|3D|Display'",
+    "vfio": "<strong>La GPU non deve essere associata a vfio-pci.</strong> Serve il driver nativo dell’host. Se assegnata a una VM, lo script propone <switchLink>Cambia modalità GPU</switchLink>.",
+    "nvidia": "<strong>Per NVIDIA:</strong> installa prima il driver sull’host. Le librerie del container devono corrispondere alla sua versione. Usa <nvidiaLink>Installa driver NVIDIA sull’host</nvidiaLink>.",
+    "nvidiaCheck": "nvidia-smi",
+    "container": "<strong>Un LXC esistente.</strong> Lo script non lo crea. Supporta entrambi i modi; un container <strong>privilegiato</strong> non è sempre necessario. Dispositivi e permessi numerici dell’app devono corrispondere."
+  },
+  "unpriv": {
+    "title": "Supporta container privilegiati e non privilegiati",
+    "body": "Lo script usa le voci <code>dev&lt;N&gt;</code> e allinea i GID <code>video</code> e <code>render</code> fra host e container. Questo evita di modificare manualmente <code>lxc.idmap</code> per il normale accesso ai dispositivi; verifica comunque i permessi dell’utente dell’app."
+  },
+  "running": {
+    "heading": "Eseguire l’installer",
+    "body": "Apri ProxMenux e scegli <strong>Hardware: GPU e Coral-TPU → Aggiungi GPU a LXC</strong>.",
+    "imageAlt": "Voce del menu per aggiungere GPU a LXC"
+  },
+  "howRuns": {
+    "heading": "Come funziona lo script",
+    "body": "Scegli container e famiglie GPU e supera i controlli. Poi il processo arresta e modifica il container senza un’ulteriore conferma finale. La pulizia VFIO facoltativa ha conferma separata e può modificare prima l’host."
+  },
+  "walkthrough": {
+    "heading": "Procedura passo per passo",
+    "detect": {
+      "title": "Rilevamento GPU host",
+      "body": "Cerca controller GPU con <code>lspci</code>. Per NVIDIA verifica il modulo <code>nvidia</code> e <code>nvidia-smi</code>; la versione rilevata determina l’installer <code>.run</code> del container.",
+      "tipTitle": "NVIDIA non pronto?",
+      "tipBody": "Se manca il modulo o NVIDIA non funziona sull’host, usa prima <nvidiaLink>Installa driver NVIDIA sull’host</nvidiaLink> e verifica il driver."
+    },
+    "pickCt": {
+      "title": "Scegli un container LXC",
+      "body": "Elenca i container LXC idonei per ID e nome; i container OCI sono esclusi e usano OCI manager Apps per i dispositivi. Il container viene arrestato se è in esecuzione, avviato per l’installazione dei driver e normalmente riportato allo stato iniziale (in esecuzione/arrestato).",
+      "imageAlt": "Selezione di un container LXC esistente"
+    },
+    "selectGpu": {
+      "title": "Scegli le famiglie GPU",
+      "body": "L’elenco seleziona famiglie di produttori, non un dispositivo PCI isolato. Intel/AMD aggiungono i nodi DRI previsti; NVIDIA i dispositivi disponibili, anche di più schede. Una sola famiglia viene selezionata automaticamente. Verifica l’elenco finale, soprattutto con più GPU.",
+      "imageAlt": "Elenco delle famiglie GPU rilevate con nome e indirizzo PCI"
+    },
+    "preflight": {
+      "title": "Controlli preliminari",
+      "imageAlt": "Proposta di cambio modalità per una GPU associata a vfio-pci",
+      "intro": "Tre controlli, uno dei quali può bloccare o reindirizzare:",
+      "items": [
+        "<strong>Controllo SR-IOV.</strong> L’assistente blocca VF o PF con VF attive. È un limite della selezione ampia dei dispositivi, non un divieto generale per LXC. Configurali separatamente.",
+        "<strong>Associata a vfio-pci.</strong> Il driver nativo non può creare <code>/dev/dri/*</code> o <code>/dev/nvidia*</code>. Propone <switchLink>Cambia modalità GPU</switchLink>; segui le indicazioni sul riavvio e poi torna.",
+        "<strong>Già configurata.</strong> Se tutti i dispositivi sono presenti, esce senza reinstallare le librerie. Prosegue solo con le famiglie selezionate mancanti."
+      ]
+    },
+    "applyConfig": {
+      "title": "Applicare le modifiche di configurazione LXC",
+      "body1": "Arresta il container se è in esecuzione e modifica <code>/etc/pve/lxc/&lt;ctid&gt;.conf</code>. Le voci numerate <code>dev&lt;N&gt;</code> includono il GID host di <code>video</code> o <code>render</code>. Le righe bind <code>lxc.mount.entry</code> esistenti per <code>/dev/dri</code> vengono sostituite da voci <code>dev:</code>; verifica la configurazione e i permessi risultanti.",
+      "body2": "Esempio dopo Intel + NVIDIA sullo stesso contenitore:"
+    },
+    "installDrivers": {
+      "title": "Avviare il contenitore e installare i driver all'interno",
+      "body": "Avvia il container e attende fino a circa 30 secondi la risposta di <code>pct exec</code>. Rileva la distribuzione da <code>/etc/os-release</code> e installa i pacchetti adatti.",
+      "headerDistro": "Distribuzione",
+      "headerInt": "Intel / AMD",
+      "headerNvidia": "NVIDIA",
+      "rows": [
+        {
+          "distro": "Alpine",
+          "intel": "apk add mesa-va-gallium intel-media-driver libva-utils",
+          "nvidia": "apk add nvidia-utils"
+        },
+        {
+          "distro": "Arch / Manjaro",
+          "intel": "pacman -Sy intel-media-driver mesa libva-utils",
+          "nvidia": "pacman -Sy nvidia-utils"
+        }
+      ],
+      "debianDistro": "Debian / Ubuntu / altri",
+      "debianIntel": "apt-get install va-driver-all intel-opencl-icd vainfo",
+      "debianNvidia": "Estrae <code>.run</code> sull’host → <code>pct push</code> → installa con <code>--no-kernel-modules --no-dkms</code>.",
+      "whyTitle": "Perché usa l’installer NVIDIA .run su Debian",
+      "whyBody": "I pacchetti possono non corrispondere all’host. Le librerie <strong>devono corrispondere al modulo host caricato</strong> per NVML e <code>nvidia-smi</code>. Debian/glibc usa il <code>.run</code> della versione host in cache, lo estrae e archivia sull’host, trasferisce con <code>pct push</code> e installa con <code>--no-kernel-modules --no-dkms</code>. Alpine e Arch usano i repository: verifica le versioni."
+    },
+    "alignGids": {
+      "title": "Allineare GID e ripristinare lo stato",
+      "body1": "Per Intel/AMD legge i GID host di <code>video</code> e <code>render</code>, usando 44/104 solo come ripiego, poi modifica <code>/etc/group</code> nel container perché corrispondano; le esecuzioni solo NVIDIA saltano questo passaggio. Voci come <code>video:44</code> e <code>render:104</code> sono esempi, non ID universali. Verifica l’appartenenza dell’app ai gruppi e i permessi effettivi sui dispositivi.",
+      "body2": "Al termine normale, arresta di nuovo il container se inizialmente era fermo; se era attivo lo lascia attivo. In caso di errore di avvio o installazione, verifica stato finale e log."
+    }
+  },
+  "vendors": {
+    "heading": "Note per produttore",
+    "intelHeading": "Intel iGPU",
+    "intelBody": "L’accelerazione multimediale Intel, incluso <em>Quick Sync</em>, dipende da generazione del GPU, codec e configurazione dell’app. Lo script condivide quelli tra <code>/dev/dri/card0</code>, <code>card1</code>, <code>renderD128</code> e <code>renderD129</code> che esistono; altri numeri di nodo non vengono aggiunti. L’host deve già fornirli tramite il proprio driver nativo, per esempio <code>i915</code>.",
+    "amdHeading": "AMD",
+    "amdBody": "AMD usa DRI per Mesa/VA-API. Se l’host espone <code>/dev/kfd</code>, lo condivide. ROCm/OpenCL richiede hardware e librerie compatibili; condividere il dispositivo non installa l’intero stack ROCm.",
+    "nvidiaHeading": "NVIDIA",
+    "nvidiaBody": "Condivide i dispositivi <code>/dev/nvidia*</code>. <strong>Le versioni del driver devono corrispondere</strong> per <code>nvidia-smi</code>. Debian/glibc usa il <code>.run</code> della versione host; Alpine/Arch i repository. Sotto 2048 MiB di RAM configurata propone un aumento temporaneo poi ripristinato; richiede anche 1500 MiB liberi su disco.",
+    "updateTitle": "Dopo un aggiornamento NVIDIA host, controlla le librerie LXC",
+    "updateBody": "Vecchie librerie possono causare errori in <code>nvidia-smi</code>. L’<nvidiaLink>installer NVIDIA dell’host</nvidiaLink> propone aggiornamenti dei container. Ripetere l’aggiunta può terminare se i dispositivi esistono già: non garantisce l’aggiornamento delle librerie. Verifica versioni e aggiorna i pacchetti o l’installazione utente adatta."
+  },
+  "verification": {
+    "heading": "Verifica",
+    "body": "Nel container verifica che la GPU sia visibile e utilizzabile."
+  },
+  "troubleshoot": {
+    "heading": "Risoluzione dei problemi",
+    "mismatchTitle": "nvidia-smi: Failed to initialize NVML: Driver/library version mismatch",
+    "mismatchBody": "Le librerie non corrispondono al modulo caricato. Verifica le versioni e aggiorna lo spazio utente LXC. Il <code>.run</code> in cache serve per Debian/glibc, ma l’aggiunta può terminare se tutti i dispositivi esistono già.",
+    "denyTitle": "Permesso negato su /dev/dri/renderD128 all'interno del contenitore",
+    "denyBody": "Verifica dispositivo e permessi numerici di <code>render</code>, poi che l’utente appartenga a <code>render</code>. Se disponibile, aggiungilo a <code>render</code> con <code>usermod -aG render &lt;user&gt;</code>, sostituendo il segnaposto con l’account reale. Riavvia la sessione. Cambiare privilegi non è una soluzione generale.",
+    "vainfoTitle": "vainfo dice: VA-API versione 1.xx; non inizializzare",
+    "vainfoBody": "Verifica accesso e driver VA-API. I nomi variano per distribuzione: per esempio <code>intel-media-driver</code> per Intel recenti supportate, <code>i965-va-driver</code> per quelle vecchie compatibili e <code>mesa-va-drivers</code> per AMD. Il messaggio da solo non prova che manchi un pacchetto.",
+    "logTitle": "Registro d’installazione",
+    "logBody": "Ogni esecuzione scrive <code>/tmp/add_gpu_lxc.log</code> sull’host. Allegalo alle richieste di assistenza."
+  },
+  "related": {
+    "heading": "Vedi anche",
+    "items": [
+      {
+        "label": "Installare driver NVIDIA (Host)",
+        "href": "/docs/hardware/nvidia-host",
+        "tail": " — installa il driver host prima di condividere NVIDIA."
+      },
+      {
+        "label": "Aggiungi GPU a VM (Passthrough)",
+        "href": "/docs/hardware/gpu-vm-passthrough",
+        "tail": " — alternativa per dedicare una GPU a una VM."
+      },
+      {
+        "label": "Cambia modalità GPU (VM ↔ LXC)",
+        "href": "/docs/hardware/switch-gpu-mode",
+        "tail": " — passa la GPU fra condivisione LXC e assegnazione VM."
+      },
+      {
+        "label": "Comandi di passaggio GPU",
+        "href": "/docs/help-info/gpu-commands",
+        "tail": "— rapido riferimento per i relativi comandi shell."
+      }
+    ]
+  }
+}
diff --git a/web/messages/it/docs/hardware/install-coral-tpu-host.json b/web/messages/it/docs/hardware/install-coral-tpu-host.json
new file mode 100644
index 00000000..e602999b
--- /dev/null
+++ b/web/messages/it/docs/hardware/install-coral-tpu-host.json
@@ -0,0 +1,203 @@
+{
+  "meta": {
+    "title": "Installa Coral TPU sull’host | Documentazione ProxMenux",
+    "description": "Installa componenti Coral su Proxmox VE secondo l’hardware rilevato: gasket/apex con DKMS per M.2 / Mini-PCIe e libedgetpu1-std per USB. Se rileva entrambi esegue entrambe le procedure."
+  },
+  "header": {
+    "title": "Installa Coral TPU sull’host",
+    "description": "Prepara l’host Proxmox per Coral e condivisione LXC. Rileva M.2 / Mini-PCIe, USB o entrambi ed esegue la procedura appropriata: moduli DKMS per PCIe e runtime Google Edge TPU per USB.",
+    "section": "Hardware: GPU e Coral-TPU"
+  },
+  "intro": {
+    "title": "Cosa fa",
+    "body": "Un <strong>installer unico che rileva l’hardware</strong>. PCIe usa <code>gasket</code> e <code>apex</code> con DKMS; le compilazioni future richiedono sorgenti e header compatibili. USB usa <code>libedgetpu1-std</code>. Se rileva entrambi esegue entrambi i percorsi. Il runtime USB deve essere dove gira l’app; per l’uso solo in LXC non è necessariamente richiesto sull’host."
+  },
+  "which": {
+    "heading": "Quale Coral ho?",
+    "body": "I modelli PCIe e USB hanno formato e requisiti diversi. Lo script gestisce entrambi; identifica il dispositivo prima di eseguirlo.",
+    "headerForm": "Fattore di forma",
+    "headerDetect": "Rilevazione",
+    "headerInstall": "Tipo di installazione",
+    "headerReboot": "Riavvio?",
+    "pcieForm": "M.2 / Mini-PCIe",
+    "pcieFormSub": "(schede M.2 con una o due Edge TPU)",
+    "pcieDetect": "ID produttore PCI <code>1ac1</code>",
+    "pcieInstall": "Modulo Kernel (gasket + apex) tramite DKMS",
+    "pcieReboot": "Sì",
+    "usbForm": "Acceleratore USB",
+    "usbFormSub": "(piccolo dongle di plastica)",
+    "usbDetect": "USB <code>1a6e:089a</code> (non programmato) / <code>18d1:9302</code> (programmato)",
+    "usbInstall": "Runtime utente <code>libedgetpu1-std</code> dal repository APT Google",
+    "usbReboot": "No"
+  },
+  "prereqs": {
+    "title": "Prima di iniziare",
+    "coral": "<strong>Un Coral collegato</strong> (M.2, Mini-PCIe o USB) per installare. Senza hardware rilevato può pulire o rimuovere componenti esistenti, ma non installa un nuovo percorso hardware.",
+    "coralCheck": "lspci -d 1ac1: ; lsusb | grep -E '1a6e:089a|18d1:9302'",
+    "internet": "<strong>Accesso a Internet</strong> sull’host per clonare il driver PCIe da GitHub o scaricare <code>libedgetpu1-std</code> dal repository APT Google per USB.",
+    "headers": "<strong>Header del kernel disponibili tramite APT</strong>: <code>proxmox-headers-$(uname -r)</code>. Servono solo per PCIe/M.2; lo script li installa.",
+    "reboot": "<strong>Pianifica un riavvio</strong> per PCIe. Lo script tenta di caricare i moduli compilati; il riavvio verifica anche il caricamento automatico."
+  },
+  "hostPrepTip": {
+    "title": "Questo prepara soltanto l’host",
+    "body": "Prepara l’host per <em>accedere al dispositivo</em>, senza configurare o verificare l’applicazione. Per <em>usare</em> Coral con un’app compatibile come Frigate, prosegui con <lxcLink>Aggiungere Coral TPU a un LXC</lxcLink>."
+  },
+  "running": {
+    "heading": "Eseguire l’installer",
+    "body": "Apri ProxMenux sull’host e scegli <strong>Hardware: GPU e Coral-TPU → Installa/aggiorna Coral TPU sull’host</strong>.",
+    "imageAlt": "Voce del menu per installare o aggiornare Coral TPU sull’host"
+  },
+  "howRuns": {
+    "heading": "Come funziona lo script",
+    "body": "Rileva prima l’hardware e prepara il piano adatto. L’installazione richiede conferma."
+  },
+  "walkthrough": {
+    "heading": "Procedura passo per passo",
+    "detect": {
+      "title": "Rilevamento hardware",
+      "body": "Cerca il produttore <code>0x1ac1</code> in <code>/sys/bus/pci/devices/*/vendor</code> e usa <code>lsusb</code> per USB. Esistono <strong>due</strong> ID USB secondo lo stato del firmware:",
+      "items": [
+        "<code>1a6e:089a</code> — Global Unichip, stato <em>non programmato</em>, prima che il runtime carichi il firmware.",
+        "<code>18d1:9302</code> — Google, stato <em>programmato</em>, dopo il caricamento del firmware."
+      ],
+      "outro": "Senza Coral rilevato né installazione esistente, mostra un avviso ed esce. I componenti già presenti possono aprire il menu di pulizia o rimozione."
+    },
+    "prompt": {
+      "title": "Conferma dell’installazione",
+      "body": "Prima dell’installazione, una finestra elenca dispositivi e componenti previsti. Annullando si salta l’installazione. La pulizia facoltativa dei vecchi componenti ha una conferma precedente separata.",
+      "imageAlt": "Riepilogo dei dispositivi Coral e dei passaggi d’installazione"
+    },
+    "pcie": {
+      "title": "PCIe: moduli gasket e apex tramite DKMS",
+      "body": "Eseguito solo se rileva un Coral PCIe/M.2. Compila i moduli per il kernel attualmente in esecuzione sull’host.",
+      "items": [
+        "<strong>Pulizia.</strong> Qualsiasi pacchetto <code>gasket-dkms</code> esistente viene rimosso prima della ricompilazione; se è in uno stato incoerente, lo script ne forza la rimozione e la purga.",
+        "<strong>Dipendenze di compilazione:</strong> <code>git</code>, <code>dkms</code>, <code>build-essential</code>, <code>proxmox-headers-$(uname -r)</code>."
+      ],
+      "cloneIntro": "<strong>Clona i sorgenti del driver.</strong> Preferisce <feranickLink>feranick/gasket-driver</feranickLink>, altrimenti usa <googleLink>google/gasket-driver</googleLink>. La compilazione dipende dalla compatibilità del kernel. Applica queste patch ai sorgenti Google secondo la versione:",
+      "kernelPatches": [
+        "Da kernel 6.5, la patch sostituisce <code>no_llseek</code> con <code>noop_llseek</code> nei sorgenti alternativi.",
+        "Kernel 6.13 o superiore: converte l’argomento di <code>MODULE_IMPORT_NS(DMA_BUF)</code> in una stringa letterale."
+      ],
+      "afterItems": [
+        "<strong>Copia i sorgenti in <code>/usr/src/gasket-1.0/</code>,</strong> genera <code>dkms.conf</code> e li registra con <code>dkms add</code>.",
+        "<strong>Compila e installa:</strong> <code>dkms build</code>, poi <code>dkms install</code>. In caso di errore mostra le ultime 50 righe di <code>make.log</code>, se disponibile.",
+        "<strong>Crea il gruppo <code>apex</code> e le regole udev</strong> (<code>/etc/udev/rules.d/99-coral-apex.rules</code>) per assegnare il gruppo a <code>/dev/apex_*</code>.",
+        "<strong>Tenta di caricare i moduli:</strong> <code>modprobe gasket</code> e <code>modprobe apex</code>."
+      ],
+      "imageAlt": "Compilazione DKMS e caricamento dei moduli gasket/apex"
+    },
+    "usb": {
+      "title": "USB: runtime Edge TPU di Google",
+      "body": "Funziona solo se è stato rilevato un acceleratore USB. Molto più semplice:",
+      "items": [
+        "<strong>Aggiunge la chiave GPG Google</strong> in <code>/etc/apt/keyrings/coral-edgetpu.gpg</code>.",
+        "<strong>Aggiunge il repository APT</strong> in <code>/etc/apt/sources.list.d/coral-edgetpu.list</code>; <code>signed-by=</code> limita la verifica al suo portachiavi. Usa sintassi .list su una riga, non .sources deb822.",
+        "<strong>Installa <code>libedgetpu1-std</code></strong>, il runtime Edge TPU con prestazioni standard.",
+        "<strong>Ricarica udev</strong> e applica le regole del pacchetto al dispositivo USB."
+      ],
+      "stdTitle": "Perché libedgetpu1-std e non libedgetpu1-max?",
+      "stdBody": "Il pacchetto <code>max</code> attiva la frequenza massima supportata, aumentando prestazioni, consumo e calore. Verifica raffreddamento e condizioni operative dell’acceleratore. I pacchetti si escludono a vicenda; passa all’altro con <code>apt install libedgetpu1-max</code>."
+    },
+    "reboot": {
+      "title": "Riavvio facoltativo dopo l’installazione PCIe",
+      "body": "Dopo PCIe propone un riavvio. Ha tentato <code>modprobe</code>; verifica i moduli e <code>/dev/apex_0</code> con gruppo <code>apex</code>. Un riavvio pianificato controlla il caricamento automatico. Con solo USB non propone il riavvio dell’host.",
+      "imageAlt": "Riepilogo e proposta di riavvio dopo l’installazione PCIe"
+    }
+  },
+  "legacyCleanup": {
+    "heading": "Rimuovere il vecchio gasket-dkms dagli host che usano solo USB",
+    "intro": "Se <strong>non rileva Coral PCIe/M.2</strong> ma esiste una precedente installazione di <code>gasket-dkms</code>, propone una pulizia facoltativa con conferma.",
+    "items": [
+      "Se rileva un Coral PCIe/M.2, usa il normale percorso di ricompilazione DKMS e non propone questa pulizia.",
+      "Elimina <code>gasket-dkms</code>, registrazioni DKMS e vecchi sorgenti gasket, poi ripara lo stato in sospeso di <code>dpkg</code>/APT.",
+      "Mantiene i pacchetti USB <code>libedgetpu1-std</code> e <code>libedgetpu1-max</code>, quindi il Coral USB conserva il runtime.",
+      "Lo script verifica che il pacchetto legacy è andato e che la gestione dei pacchetti è sana prima di segnalare il successo."
+    ],
+    "warningTitle": "Confermare l'hardware prima",
+    "warningBody": "Se un Coral PCIe/M.2 previsto non appare, annulla la pulizia e controlla scheda, slot e firmware."
+  },
+  "reinstallUninstall": {
+    "heading": "Reinstallare o disinstallare",
+    "intro": "Se rileva un’installazione PCIe con <code>gasket-dkms</code>, USB con <code>libedgetpu1-std</code>/<code>libedgetpu1-max</code> o entrambe, mostra un menu di azioni.",
+    "imageAlt": "Menu per reinstallare, aggiornare o disinstallare Coral",
+    "imageCaption": "Il menu appare se esiste un componente: registrazione DKMS gasket, pacchetto <code>libedgetpu1-*</code> o dispositivi <code>/dev/apex_*</code>.",
+    "reinstallHeading": "Reinstallare / aggiornare",
+    "reinstallBody": "Segue l’installazione normale: ricompila dopo un cambio di kernel o aggiorna <code>libedgetpu1-*</code> da Google. Prima pulisce lo stato DKMS precedente per evitare che un tentativo fallito blocchi la compilazione.",
+    "uninstallHeading": "Disinstallare — ciò che viene rimosso",
+    "uninstallIntro": "Richiede conferma. Le app LXC che usano <code>/dev/apex_*</code> possono perdere l’accesso durante la rimozione o dopo il riavvio. Procedura:",
+    "uninstallItems": [
+      "Tenta di scaricare <code>apex</code> e <code>gasket</code>; l’uso da parte di processi attivi può impedirlo.",
+      "Rimuove ogni voce DKMS-registrato <code>gasket/&lt;version&gt;</code> in modo che i moduli non ritornino sul prossimo kernel install.",
+      "Elimina completamente <code>gasket-dkms</code>, <code>libedgetpu1-std</code> e <code>libedgetpu1-max</code>, poi esegue <code>apt-get autoremove --purge</code>.",
+      "Elimina <code>/etc/udev/rules.d/99-coral-apex.rules</code> e ripristina il gruppo predefinito in <code>60-gasket-dkms.rules</code>, se esiste ancora.",
+      "Controlla i membri supplementari di <code>apex</code>. <strong>Se l’elenco è vuoto</strong>, tenta di rimuovere il gruppo; altrimenti mantiene <code>apex</code> ed elenca i membri. Non verifica completamente gli utenti che lo hanno come gruppo principale.",
+      "Rimuove l’elenco dei repository <code>/etc/apt/sources.list.d/coral-edgetpu.list</code>, il vecchio <code>coral-cloud.list</code> e i vecchi portachiavi chiamati <code>coral-edgetpu-archive-keyring.gpg</code>. Il portachiavi attuale in <code>/etc/apt/keyrings/coral-edgetpu.gpg</code> non viene rimosso da questa sequenza.",
+      "Propone un riavvio <strong>solo se PCIe era installato</strong> per scaricare i moduli ancora attivi. Rimuovere solo USB non richiede riavvio."
+    ],
+    "lxcWarnTitle": "LXC contenitori con apex passthrough",
+    "lxcWarnBody": "Rimuovere i componenti dell’host può interrompere l’accesso LXC. Pianifica una manutenzione se app compatibili come Frigate dipendono da questo Coral."
+  },
+  "updates": {
+    "heading": "Notifiche di aggiornamento",
+    "intro": "ProxMenux registra i componenti Coral e verifica PCIe/M.2 e USB separatamente. Se sono presenti entrambi, ogni variante usa la propria fonte delle versioni:",
+    "headerVariant": "Variante",
+    "headerTracked": "Versione registrata",
+    "headerUpstream": "Fonte delle versioni",
+    "pcieVariant": "PCIe / M.2",
+    "pcieTracked": "Prima il tag registrato dopo l’installazione riuscita, poi la versione del pacchetto <code>gasket-dkms</code> integro, altrimenti quella DKMS. Quest’ultima non identifica il livello di patch del fork.",
+    "pcieUpstream": "Ultimo tag GitHub di <code>feranick/gasket-driver</code>; cache di sette giorni e confronto del numero di build.",
+    "usbVariant": "USB",
+    "usbTracked": "<code>libedgetpu1-std</code> o <code>libedgetpu1-max</code> versione apt",
+    "usbUpstream": "Candidato locale <code>apt-cache policy</code> (Google Coral apt repo)",
+    "outro": "Se rileva una nuova versione, Monitor invia <code>coral_driver_update_available</code> sui canali abilitati. La notifica rimanda all’installer: scegli <strong>Reinstalla / aggiorna</strong>.",
+    "antiTitle": "Niente notifiche ripetute",
+    "antiBody": "Una notifica per variante quando cambia la versione disponibile. Non la ripete a ogni controllo giornaliero; avvisa di nuovo con una versione successiva.",
+    "rebootTitle": "Aggiornamenti PCIe: pianifica un riavvio",
+    "rebootBody": "Il modulo PCIe ricompilato deve essere caricato; un riavvio pianificato verifica anche il caricamento automatico. Aggiornare la libreria USB non richiede il riavvio dell’host, ma può richiedere quello delle app che usavano la precedente."
+  },
+  "manual": {
+    "heading": "Procedura manuale equivalente",
+    "intro": "Questi comandi mostrano i passaggi principali di ogni percorso per consultarli o eseguirli manualmente.",
+    "pcieHeading": "PCIe / M.2 (gasket + apex tramite DKMS)",
+    "usbHeading": "USB (runtime libedgetpu)"
+  },
+  "verification": {
+    "heading": "Verifica",
+    "pcieHeading": "PCIe / M.2",
+    "usbHeading": "USB"
+  },
+  "troubleshoot": {
+    "heading": "Risoluzione dei problemi",
+    "dkmsFailTitle": "Compilazione DKMS fallita dopo un aggiornamento del kernel",
+    "dkmsFailBody": "Gli header mancanti sono una possibile causa. Verifica <code>proxmox-headers-$(uname -r)</code> con <code>dpkg -l proxmox-headers-$(uname -r)</code> e installali se assenti. Controlla le incompatibilità nel log. Ripetere esegue <code>cleanup_broken_gasket_dkms</code>, senza garantire compatibilità con ogni kernel.",
+    "apexMissTitle": "/dev/apex_0 mancante dopo il riavvio",
+    "apexMissBody": "Verifica rilevamento PCIe e compatibilità del modulo con il kernel attivo. Prova <code>modprobe apex</code> e controlla <code>dmesg | grep -iE \"apex|gasket\"</code>. Errori di compilazione, caricamento o configurazione slot/firmware possono impedire la creazione del dispositivo.",
+    "lxcMissTitle": "L’host vede /dev/apex_0, ma il LXC no",
+    "lxcMissBody": "Un nodo visibile non prova il funzionamento. Verifica accesso sull’host, montaggio LXC, regole cgroup e permessi UID/GID. Vedi <lxcLink>Aggiungere Coral TPU a un LXC</lxcLink>.",
+    "usbUnreachTitle": "Acceleratore USB rilevato ma Frigate / TFLite non può raggiungerlo",
+    "usbUnreachBody": "Verifica le regole di <code>libedgetpu1-std</code> e i permessi con <code>ls -l /dev/bus/usb/*/*</code>. L’utente/gruppo mappato dell’app deve poter leggere e scrivere; root come proprietario non è di per sé un errore. Dopo modifiche esegui <code>udevadm control --reload-rules &amp;&amp; udevadm trigger</code> e ricollega se necessario.",
+    "logTitle": "Registro d’installazione",
+    "logBody": "Ogni esecuzione scrive <code>/tmp/coral_install.log</code>. Se DKMS fallisce e il log esiste, aggiunge le ultime 50 righe di <code>/var/lib/dkms/gasket/1.0/build/make.log</code>. Allegalo alle richieste di assistenza."
+  },
+  "related": {
+    "heading": "Vedi anche",
+    "items": [
+      {
+        "label": "Aggiungi Coral TPU a LXC",
+        "href": "/docs/hardware/coral-tpu-lxc",
+        "tail": " — rendere disponibile il Coral dell’host a un container con un’app compatibile."
+      },
+      {
+        "label": "Installare driver NVIDIA (Host)",
+        "href": "/docs/hardware/nvidia-host",
+        "tail": "— stessa idea per le GPU NVIDIA."
+      },
+      {
+        "label": "ProxMenux Monitor — Scheda hardware",
+        "href": "/docs/monitor/dashboard/hardware",
+        "tail": " — il pannello Coral mostra driver, moduli, dispositivi e runtime, oltre alla temperatura se disponibile tramite un sensore supportato."
+      }
+    ]
+  }
+}
diff --git a/web/messages/it/docs/hardware/nvidia-host.json b/web/messages/it/docs/hardware/nvidia-host.json
new file mode 100644
index 00000000..728b1725
--- /dev/null
+++ b/web/messages/it/docs/hardware/nvidia-host.json
@@ -0,0 +1,175 @@
+{
+  "meta": {
+    "title": "Installa NVIDIA sull’host | Documentazione ProxMenux",
+    "description": "Installa i driver proprietari NVIDIA su Proxmox VE con ProxMenux: filtro GPU, verifiche di compilazione e DKMS, persistenza, patch NVENC facoltativa e aggiornamento delle librerie LXC."
+  },
+  "header": {
+    "title": "Installare driver NVIDIA sull'host",
+    "description": "Installa NVIDIA sull’host Proxmox VE. Filtra i rami mantenuti per ID PCI del GPU, verifica la compilazione, usa DKMS, gestisce nouveau e installa la persistenza. Può anche aggiornare le librerie dei LXC con accesso NVIDIA.",
+    "section": "Hardware: GPU e Coral-TPU"
+  },
+  "intro": {
+    "title": "Cosa fa",
+    "body": "ProxMenux rileva il GPU e propone rami NVIDIA mantenuti che includono il suo ID PCI. Blocca <code>nouveau</code>, scarica l’installer ufficiale <code>.run</code>, usa DKMS, installa <code>nvidia-persistenced</code>, le regole udev e NVIDIA Container Toolkit e propone una patch NVENC facoltativa. I controlli di compilazione riguardano il kernel in esecuzione; una compilazione riuscita non garantisce che ogni app funzioni. Ai LXC NVIDIA esistenti viene proposto un aggiornamento delle librerie userspace, con versione corrispondente tranne su Arch."
+  },
+  "who": {
+    "heading": "Per chi è questo?",
+    "body": "Per video o calcolo accelerato con Plex, Jellyfin, Frigate, Immich o Stable Diffusion <strong>in LXC</strong>, installa prima NVIDIA sull’<em>host</em> Proxmox. L’assegnazione diretta a una <strong>VM</strong> usa la procedura VFIO separata."
+  },
+  "prereqs": {
+    "title": "Prima di iniziare",
+    "gpu": "<strong>Un GPU NVIDIA</strong> installato nell’host. Il rilevamento è automatico; questa opzione non gestisce AMD o Intel.",
+    "gpuCheck": "lspci | grep -i nvidia",
+    "notVm": "Il GPU <strong>non deve essere riservato a una VM tramite VFIO</strong>. L’installer rifiuta questo caso per non interferire con l’assegnazione.",
+    "internet": "Accesso Internet sull’host. Scarica il driver da <code>download.nvidia.com</code> e può clonare <code>nvidia-persistenced</code> e <code>nvidia-patch</code> da GitHub.",
+    "space": "Prevedi spazio in <code>/opt/nvidia</code> per <code>.run</code> e RAM per compilare. Il percorso LXC non-Arch verifica 1500 MiB liberi e può richiedere temporaneamente 2048 MiB di RAM se inferiore, ripristinando poi il limite precedente. Prevedi il riavvio dell’host."
+  },
+  "vmWarn": {
+    "title": "GPU riservato a una VM? Fermati qui",
+    "body": "Se un dispositivo NVIDIA è associato a <code>vfio-pci</code>, l’installer esce anche con VM ferma. Una riserva non implica utilizzo attivo. Pianifica il ritorno al driver host e rimuovi assegnazioni VM/VFIO obsolete prima di riavviare e installare."
+  },
+  "running": {
+    "heading": "Eseguire l'installatore",
+    "body": "Apri <strong>Hardware Graphics → NVIDIA GPU Driver Installer</strong> in ProxMenux. Il menu dipende dalla presenza di un driver attivo.",
+    "imageAlt": "Menu hardware con installer NVIDIA evidenziato"
+  },
+  "howRuns": {
+    "heading": "Come funziona lo script",
+    "body": "Rileva dispositivi, seleziona una versione e installa. Una pulizia VFIO con conferma separata può precedere la panoramica. Preparazione di repository/header e download precedono la sostituzione del driver; non tutte le modifiche iniziano dopo un’unica conferma finale."
+  },
+  "walkthrough": {
+    "detect": {
+      "title": "GPU rilevamento e panoramica",
+      "body1": "Mostra controller video NVIDIA, stato del driver o <em>«Nessun driver NVIDIA installato»</em> e i LXC configurati per NVIDIA con la loro versione interna.",
+      "body2": "Verifica GPU e versioni di host/container. Annulla nella panoramica se la scelta non è quella prevista; una pulizia VFIO confermata prima è già stata applicata.",
+      "imageAlt": "Panoramica prima dell’installazione: GPU, driver e LXC NVIDIA"
+    },
+    "version": {
+      "title": "Scegli la versione del driver",
+      "body1": "Filtra le versioni di <code>nvidia.com</code> che <strong>includono l’ID PCI del GPU nella tabella dei chip supportati</strong> ed esclude versioni beta/sviluppo tramite euristiche. <em>&lt;versione&gt; — Consigliata</em> privilegia l’ultima della branca installata, poi Production Branch e infine il numero di versione supportato più alto.",
+      "body2": "Se il driver risulta modificato con keylase, la selezione si limita alla tabella NVENC. <em>Reinstalla / aggiorna</em> mantiene conferme e scelta della patch; verifica il risultato finale.",
+      "whyTitle": "Come viene validata la compatibilità del kernel",
+      "whyBody": "Filtra per rami mantenuti e ID PCI, senza matrice fissa kernel/driver. Una compilazione preliminare verifica il kernel attuale. Un errore confermato riporta alla selezione; se il test non è disponibile può avvisare e continuare. Restano necessarie installazione e verifica del funzionamento.",
+      "imageAlt": "Selettore dei rami compatibili GPU con versione consigliata in cima"
+    },
+    "uninstall": {
+      "title": "Rimuovere il driver precedente prima di reinstallare",
+      "body": "Dopo download e verifica dell’installer scelto, rimuove il driver precedente. Ferma servizi NVIDIA, scarica moduli, rimuove voci DKMS e disinstalla <code>nvidia-*</code> / <code>libnvidia-*</code> / <code>cuda-*</code>. Vale anche per la reinstallazione confermata della stessa versione."
+    },
+    "prepare": {
+      "title": "Preparare il sistema",
+      "body": "Durante la preparazione, lo script:",
+      "items": [
+        "Controlla i repository prima di rimuovere o installare componenti. Senza abbonamento e con solo Enterprise, chiede di passare a no-subscription; se rifiuti, ferma l’installazione.",
+        "Installa <code>pve-headers-$(uname -r)</code> (o <code>proxmox-headers-$(uname -r)</code>), <code>build-essential</code> e <code>dkms</code>.",
+        "Crea il file gestito da ProxMenux <code>/etc/modprobe.d/proxmenux-nouveau-blacklist.conf</code> con <code>blacklist nouveau</code> e <code>options nouveau modeset=0</code>. Registra l’eventuale riga aggiunta a <code>blacklist.conf</code> e tenta di scaricare nouveau.",
+        "Scrive <code>/etc/modules-load.d/nvidia-vfio.conf</code> con <code>nvidia</code> e <code>nvidia_uvm</code> così i moduli caricano presto al boot."
+      ]
+    },
+    "download": {
+      "title": "Scaricare ed eseguire l'installatore NVIDIA",
+      "body": "Scarica <code>NVIDIA-Linux-x86_64-&lt;version&gt;.run</code> in <code>/opt/nvidia</code> e verifica dimensione e tipo eseguibile. Sono controlli di formato, non della firma crittografica. Registra DKMS per ricompilare ai cambi di kernel; sorgenti e kernel devono restare compatibili.",
+      "imageAlt": "Avanzamento del download e compilazione DKMS dell’installer NVIDIA"
+    },
+    "persist": {
+      "title": "Servizio di persistenza e regole udev",
+      "body": "Installa <persistLink>nvidia-persistenced</persistLink> e scrive <code>/etc/udev/rules.d/70-nvidia.rules</code> per creare <code>/dev/nvidia*</code> all’avvio. Aiuta a evitare accessi LXC prima che i dispositivi siano disponibili."
+    },
+    "nvenc": {
+      "title": "Opzionale: applicare la patch NVENC",
+      "body": "I limiti di sessioni NVENC dipendono da GPU e driver. <patchLink>keylase/nvidia-patch</patchLink> può rimuovere il limite del driver per versioni supportate. Scegli <strong>Sì</strong> se serve questa modifica alla codifica e la versione è compatibile. Non accelera la decodifica né elimina i limiti hardware.",
+      "supportTitle": "Verifica il supporto della patch",
+      "supportBody": "Cerca la versione esatta nella <patchTableLink>tabella delle patch</patchTableLink>. Se manca, usa il driver senza patch o scegli un’altra versione mantenuta compatibile con GPU, kernel e patch; non basta che sia vicina nell’elenco."
+    },
+    "propagate": {
+      "title": "Facoltativo: aggiorna librerie NVIDIA nei LXC",
+      "body1": "Propone di aggiornare le librerie del driver nei LXC rilevati. Queste e il modulo host <strong>devono avere versioni corrispondenti</strong>; altrimenti <code>nvidia-smi</code> può mostrare «version mismatch».",
+      "body2": "Debian / Ubuntu e altri container glibc ricevono l’installer <code>.run</code> estratto con <code>--no-kernel-modules --no-dkms --no-install-compat32-libs</code>; la RAM può salire temporaneamente a 2 GiB e poi essere ripristinata. <strong>Arch, Manjaro ed EndeavourOS</strong> usano <code>pacman -Syu nvidia-utils</code> dai repository, senza fissare la versione host: verifica il risultato. <strong>Alpine</strong> riceve il contenuto <code>.run</code> estratto tramite <code>pct push</code>, installa <code>gcompat</code> e <code>binutils</code> con <code>apk</code> e crea link SONAME con <code>readelf</code>. Verifica il funzionamento: la compatibilità non garantisce ogni libreria su musl.",
+      "imageAlt": "Dialogo con LXC NVIDIA e versioni per confermare l’aggiornamento"
+    },
+    "reboot": {
+      "title": "Riavvia",
+      "body": "Dopo l’installazione del driver, lo script rigenera <code>initramfs</code> per tutti i kernel; il suo ultimo passaggio propone il riavvio. <strong>Prevedi questo riavvio</strong> per verificare la configurazione persistente dei moduli e di nouveau a un nuovo avvio, anche se il nuovo driver risponde già prima del riavvio."
+    }
+  },
+  "reinstallUninstall": {
+    "heading": "Reinstallare o disinstallare",
+    "intro": "Se <code>nvidia</code> è caricato e <code>nvidia-smi</code> restituisce una versione, mostra un menu di azioni. Rileva così un driver attivo; possono esserci file installati anche senza modulo caricato.",
+    "imageAlt": "Menu di azione NVIDIA offerto quando un driver è già installato — due scelte: Reinstallare / aggiornare il driver, o disinstallare completamente il driver NVIDIA",
+    "imageCaption": "Il menu di azione appare solo quando un driver NVIDIA è attualmente attivo sull'host.",
+    "reinstallHeading": "Reinstallare / aggiornare",
+    "reinstallBody": "Seleziona la versione, prepara repository/header, scarica e verifica la compilazione prima di sostituire il driver. Permette aggiornamenti nel ramo mantenuto o un altro ramo supportato. Dopo ripropone le opzioni per librerie LXC e patch NVENC.",
+    "uninstallHeading": "Disinstallare — ciò che viene rimosso",
+    "uninstallIntro": "Dopo conferma Sì/No, rimuove i seguenti componenti:",
+    "uninstallItems": [
+      "Ferma e disabilita <code>nvidia-persistenced</code> e <code>nvidia-powerd</code>, tenta di scaricare <code>nvidia_uvm</code>, <code>nvidia_drm</code>, <code>nvidia_modeset</code> e <code>nvidia</code>, poi esegue <code>nvidia-uninstall --silent</code> per l’installazione <code>.run</code>. I carichi di lavoro LXC che dipendono da NVIDIA sono coinvolti; client attivi possono impedire lo scaricamento.",
+      "Esegue <code>apt purge</code> su <code>nvidia-*</code>, <code>libnvidia-*</code>, <code>cuda-*</code> e <code>libcudnn*</code>, rimuove l'albero sorgente DKMS e le cartelle <code>nvidia-persistenced</code> e <code>nvidia-patch</code> in <code>/opt/nvidia</code>.",
+      "Rimuove la configurazione di caricamento moduli <code>/etc/modules-load.d/nvidia-vfio.conf</code> e le regole nouveau gestite da ProxMenux. Migra e rimuove anche i vecchi file ProxMenux con le due righe note; conserva i file modificati o estranei dell’amministratore.",
+      "Rimuove <code>/etc/udev/rules.d/70-nvidia.rules</code> e imposta NVENC su <em>removed</em> nel registro delle installazioni gestite; non esiste un file di stato separato.",
+      "Rigenera <code>initramfs</code> per tutti i kernel, esegue <code>proxmox-boot-tool refresh</code> secondo la configurazione di avvio e chiede di riavviare."
+    ],
+    "lxcWarnTitle": "LXC con accesso NVIDIA",
+    "lxcWarnBody": "Rimuovere il driver host interrompe le app LXC NVIDIA anche se restano installate le librerie. Pianifica manutenzione per Frigate, Plex, Jellyfin, Ollama e altre app GPU."
+  },
+  "updates": {
+    "heading": "Notifiche sugli aggiornamenti",
+    "body": "Il driver NVIDIA installato viene registrato nell’elenco delle installazioni gestite da ProxMenux. All’avvio e ogni 24 ore, il Monitor confronta le versioni disponibili su <code>download.nvidia.com/XFree86/Linux-x86_64/</code> con la versione indicata da <code>nvidia-smi</code>. La notifica viene inviata solo quando è disponibile una versione di manutenzione più recente nello stesso ramo del driver installato.",
+    "kindsHeading": "Messaggio di aggiornamento",
+    "kindsItems": [
+      "<strong>Manutenzione nello stesso ramo.</strong> Esempio: 580.65.06 installata → 580.105.08 disponibile. Monitor non deduce compatibilità del kernel tra rami."
+    ],
+    "antiTitle": "Evitare notifiche ripetute",
+    "antiBody": "Una notifica per nuova versione, non a ogni controllo giornaliero. Nessuna notifica se non esistono versioni più recenti nel ramo installato.",
+    "applyTitle": "Applicare l'aggiornamento",
+    "applyBody": "Monitor segnala gli aggiornamenti senza installarli automaticamente. Apri l’installer, scegli <strong>Reinstalla / aggiorna</strong> e una versione supportata, poi completa compilazione e installazione. Prevedi il riavvio proposto e verifica poi host e librerie LXC."
+  },
+  "verify": {
+    "heading": "Verifica dell'installazione",
+    "intro": "Dopo il riavvio dell’host, accedi tramite SSH o shell Proxmox ed esegui:",
+    "after": "Verifica GPU e versione prevista. Possono già comparire processi se servizi host o container avviati automaticamente usano il GPU. Poi controlla la persistenza:",
+    "imageAlt": "Output di nvidia-smi sull’host con GPU rilevato e versione del driver installata"
+  },
+  "troubleshoot": {
+    "heading": "Risoluzione dei problemi",
+    "smiFailTitle": "nvidia-smi mostra «NVIDIA-SMI has failed»",
+    "smiFailBody": "Possibili cause: <strong>nouveau</strong>, <strong>header assenti o incompatibili</strong>, sorgenti del driver incompatibili o altri errori di caricamento. Controlla <code>lsmod | grep nouveau</code>, <code>dmesg | grep -i nvidia</code> e registri installer/DKMS. Se serve correggere nouveau, verifica <code>/etc/modprobe.d/proxmenux-nouveau-blacklist.conf</code> prima di <code>update-initramfs -u -k all</code> e del riavvio. Non ogni errore di compilazione riguarda gli header.",
+    "lxcMissTitle": "Il contenitore LXC non può vedere il GPU dopo l'aggiornamento dell'host",
+    "lxcMissBody": "Prima di reinstallare controlla dispositivi host, permessi LXC e versione delle librerie. Un conflitto richiede eventualmente il driver utente corrispondente tramite il percorso supportato della distribuzione; su glibc usa <code>--no-kernel-modules</code>. Le librerie non correggono montaggi o permessi mancanti.",
+    "logTitle": "Controlla il registro di installazione",
+    "logBody": "L’installazione scrive in <code>/tmp/nvidia_install.log</code>. In caso di errore controlla download, compilazione DKMS e servizi. Allega il registro alla segnalazione GitHub."
+  },
+  "manualSteps": {
+    "heading": "Cerchi i passaggi manuali?",
+    "body": "Vedi <guideLink>Guide → NVIDIA</guideLink> per le basi manuali, inclusi <code>wget</code> e <code>./NVIDIA-Linux-...run</code>. Spiega i componenti senza riprodurre esattamente l’installer. La procedura mantenuta ProxMenux offre filtro GPU, verifica di compilazione, aggiornamenti LXC e controlli VFIO."
+  },
+  "related": {
+    "heading": "Vedi anche",
+    "items": [
+      {
+        "label": "Aggiungi GPU a VM (Passthrough)",
+        "href": "/docs/hardware/gpu-vm-passthrough",
+        "tail": " — assegnare NVIDIA direttamente a una VM tramite VFIO."
+      },
+      {
+        "label": "Aggiungi GPU a LXC",
+        "href": "/docs/hardware/igpu-acceleration-lxc",
+        "tail": " — condividere NVIDIA con uno o più container."
+      },
+      {
+        "label": "Cambia modalità GPU (VM ↔ LXC)",
+        "href": "/docs/hardware/switch-gpu-mode",
+        "tail": " — passare da passthrough VM a condivisione LXC e viceversa."
+      },
+      {
+        "label": "ProxMenux Monitor — Scheda hardware",
+        "href": "/docs/monitor/dashboard/hardware",
+        "tail": " — finestra GPU che apre questo installer e mostra il monitoraggio in tempo reale."
+      },
+      {
+        "label": "Comandi per passthrough GPU",
+        "href": "/docs/help-info/gpu-commands",
+        "tail": "— lspci / dmesg / IOMMU / nvidia-smi riferimento."
+      }
+    ]
+  }
+}
diff --git a/web/messages/it/docs/hardware/switch-gpu-mode.json b/web/messages/it/docs/hardware/switch-gpu-mode.json
new file mode 100644
index 00000000..49a8ee5b
--- /dev/null
+++ b/web/messages/it/docs/hardware/switch-gpu-mode.json
@@ -0,0 +1,172 @@
+{
+  "meta": {
+    "title": "Cambia modalità GPU (VM ↔ LXC) | Documentazione ProxMenux",
+    "description": "Passa un GPU da VFIO per VM al driver nativo per LXC o viceversa. ProxMenux rileva il driver, propone come gestire gli ospiti coinvolti, rimuove l’audio associato e rigenera initramfs se cambia la configurazione dell’host."
+  },
+  "header": {
+    "title": "Cambia modalità GPU (VM ↔ LXC)",
+    "description": "Passa un GPU assegnato tra passthrough VM e condivisione LXC. ProxMenux gestisce driver, VFIO, moduli e initramfs e chiede come trattare gli ospiti coinvolti. Controlla le scelte e verifica il risultato dopo il riavvio.",
+    "section": "Hardware: GPU e Coral-TPU"
+  },
+  "intro": {
+    "title": "Cosa fa",
+    "body": "Con <code>vfio-pci</code> il GPU è riservato a una VM. Con il driver nativo <em>(i915 / amdgpu / nvidia)</em>, host e LXC possono condividerlo. <strong>Cambia modalità GPU</strong> gestisce <code>vfio.conf</code>, blocchi dei moduli e riferimenti negli ospiti, segnalando le assegnazioni residue."
+  },
+  "graphics": {
+    "lxcTitle": "Pronto per container LXC",
+    "lxcDesc": "Driver nativo attivo",
+    "vmTitle": "Pronto per passthrough VM",
+    "vmDesc": "Driver VFIO-PCI attivo"
+  },
+  "when": {
+    "heading": "Quando dovrei usarlo?",
+    "intro": "Usalo se il GPU è <strong>già assegnato</strong> e vuoi cambiarne l’utilizzo:",
+    "headerSituation": "Situazione",
+    "headerUse": "Usa questa pagina?",
+    "rows": [
+      {
+        "situation": "GPU libero, mai assegnato: usarlo in una VM.",
+        "useRich": "No — usa <vmLink>Aggiungi GPU a VM</vmLink>"
+      },
+      {
+        "situation": "GPU libero, mai assegnato: usarlo in un LXC.",
+        "useRich": "No — usa <lxcLink>Aggiungi GPU a LXC</lxcLink>"
+      },
+      {
+        "situationRich": "Il GPU è assegnato a una VM tramite <code>vfio-pci</code>, ma voglio usarlo in un LXC.",
+        "useRich": "<strong>Sì — questa pagina.</strong>"
+      },
+      {
+        "situation": "Il GPU è condiviso con un LXC; voglio dedicarlo a una VM.",
+        "useRich": "<strong>Sì — questa pagina.</strong>"
+      },
+      {
+        "situation": "Voglio rimuovere tutte le assegnazioni di questo GPU.",
+        "use": "La modalità LXC restituisce il GPU al driver host; la politica di conflitto VM può rimuovere le voci hostpci, ma le voci dei dispositivi LXC vanno rimosse separatamente. Il GPU resta associato a un driver."
+      }
+    ]
+  },
+  "prereqs": {
+    "title": "Prima di iniziare",
+    "assigned": "<strong>Un GPU già assegnato</strong> a una VM tramite VFIO o a un LXC. Per la prima assegnazione usa Aggiungi GPU a VM / LXC.",
+    "iommu": "<strong>IOMMU deve essere attivo sull’host</strong> passando <em>alla</em> modalità VM. Contano sia le impostazioni del firmware sia il supporto del kernel. Se <code>intel_iommu=on</code> o <code>amd_iommu=on</code> manca nel kernel in esecuzione, lo script lo aggiunge con <code>iommu=pt</code> a <code>/etc/kernel/cmdline</code> (marcatore di root ZFS) o a <code>/etc/default/grub</code>, poi esegue <code>proxmox-boot-tool refresh</code> o <code>update-grub</code>. Controlla eventuali avvisi e riavvia quando richiesto.",
+    "iommuCheck": "dmesg | grep -i 'IOMMU enabled' | head -1",
+    "reboot": "<strong>Prevedi un riavvio.</strong> Le modifiche persistenti a driver e avvio possono richiedere la rigenerazione di initramfs e un riavvio. Lo script lo propone al termine.",
+    "knowList": "<strong>Identifica VM e LXC che usano il GPU.</strong> Lo script rileva i riferimenti e chiede come trattare ogni ospite; conoscere l’elenco facilita la verifica."
+  },
+  "blocklist": {
+    "title": "Non tutte le GPU sono sicure per passare a un VM",
+    "body": "Lo script blocca la modalità VM per gli ID dispositivo <code>8086:5a84</code> e <code>8086:5a85</code> secondo la propria politica di compatibilità. Se un GPU selezionato corrisponde, interrompe il passaggio alla modalità VM e torna alla selezione del GPU, oppure esce se è l’unico GPU. Questa blocklist non impedisce il passaggio <em>alla</em> modalità LXC; altri controlli possono comunque applicarsi."
+  },
+  "running": {
+    "heading": "Eseguire lo script",
+    "body": "Apri <strong>Hardware: GPU e Coral-TPU → Cambia modalità GPU (VM ↔ LXC)</strong> in ProxMenux.",
+    "imageAlt": "Voce Cambia modalità GPU (VM ↔ LXC) nel menu hardware"
+  },
+  "howRuns": {
+    "heading": "Come funziona lo script",
+    "body": "La scelta del GPU e della direzione precede il cambio principale. Una pulizia VFIO separata può chiedere conferma prima; gli ospiti coinvolti hanno dialoghi propri. Leggi ogni conferma: non esiste un’unica conferma finale per tutte le modifiche."
+  },
+  "walkthrough": {
+    "heading": "Procedura passo per passo",
+    "detect": {
+      "title": "Rilevare GPU e driver attuale",
+      "body": "Esamina i controller VGA, 3D e Display dell’host e consulta <code>/sys/bus/pci/devices/*/driver</code>. Mostra nome, indirizzo PCI e driver attuale di ogni GPU per identificarne la modalità.",
+      "imageAlt": "Elenco di controllo GPU che mostra ogni GPU rilevato con il suo driver corrente (vfio-pci / nvidia / amdgpu / i915) e slot PCI"
+    },
+    "pickGpu": {
+      "title": "Scegli i GPU da cambiare",
+      "body": "Un solo GPU viene selezionato automaticamente. Con più GPU puoi selezionarne diversi, purché siano nella <em>stessa</em> modalità. Se le modalità sono miste, devi restringere la selezione.",
+      "tipTitle": "Cambiare più GPU insieme",
+      "tipBody": "Esempio: passare tre NVIDIA alla modalità VM, poi riportare l’iGPU a LXC. Due esecuzioni, ciascuna con destinazione comune, anziché cambiare ogni scheda separatamente."
+    },
+    "direction": {
+      "title": "Rivedere la direzione proposta",
+      "intro": "Sulla base della modalità corrente, lo script propone il contrario come obiettivo:",
+      "items": [
+        "<strong>VM → LXC:</strong> rimuove l’associazione a <code>vfio-pci</code> affinché il driver nativo (<code>nvidia</code>, <code>amdgpu</code>, <code>i915</code>) possa usare il GPU. Per NVIDIA elimina le voci BDF corrispondenti da <code>/etc/udev/rules.d/10-proxmenux-vfio-bind.rules</code> per il prossimo avvio.",
+        "<strong>LXC → VM:</strong> prepara l’associazione a <code>vfio-pci</code>. AMD / Intel bloccano il driver nativo e usano <code>options vfio-pci ids=…</code>. Per NVIDIA, <code>nvidia</code> viene bloccato globalmente solo quando ogni GPU NVIDIA dell’host è in VFIO; altrimenti regole per BDF applicano <code>driver_override=vfio-pci</code> ai dispositivi dei gruppi IOMMU coinvolti, e i GPU NVIDIA esterni a questi gruppi conservano <code>nvidia</code>. Controlla ogni membro del gruppo prima del passaggio."
+      ],
+      "outro": "Confermare la direzione o annullare."
+    },
+    "conflict": {
+      "title": "Scelte per ogni VM o LXC coinvolto",
+      "body": "Controlla <code>/etc/pve/lxc/*.conf</code> per riferimenti alla famiglia del driver GPU e <code>/etc/pve/qemu-server/*.conf</code> per assegnazioni PCI. Il rilevamento LXC non identifica ogni scheda tramite BDF esatto. Verifica gli ospiti rilevati e scegli come trattarli:",
+      "headerPolicy": "Politica",
+      "headerEffect": "Effetto",
+      "headerWhen": "Quando scegliere",
+      "keepPolicy": "Mantieni la configurazione, disattiva l’avvio automatico",
+      "keepEffect": "<code>pct set CTID -onboot 0</code> o <code>qm set VMID -onboot 0</code>. Conserva le voci GPU.",
+      "keepWhen": "Se vuoi riutilizzare l’ospite quando il GPU tornerà alla modalità iniziale. Scelta predefinita prudente.",
+      "removePolicy": "Rimuovere GPU da config",
+      "removeEffect": "Rimuove le voci <code>hostpci</code> / <code>dev</code> identificate e i riferimenti precedenti supportati.",
+      "removeWhen": "Se l’ospite deve funzionare senza GPU. Controlla prima l’app: il ripiego sulla CPU dipende dall’applicazione e rimuovere il dispositivo non la riconfigura automaticamente.",
+      "imageAlt": "Dialogo per scegliere come gestire ogni VM o LXC coinvolto"
+    },
+    "audio": {
+      "title": "Rimuovere l’audio associato uscendo dalla modalità VM",
+      "body1": "Molti GPU NVIDIA / AMD espongono audio HDMI nella funzione <code>.1</code> dello stesso slot; possono esserci altri dispositivi audio assegnati. Rimuovendo il GPU possono restare voci audio <code>hostpci</code> obsolete. Verifica le assegnazioni da mantenere.",
+      "body2": "Identifica gli indirizzi BDF audio e mostra un elenco delle assegnazioni da rimuovere. Elimina anche gli ID vendor:device da <code>/etc/modprobe.d/vfio.conf</code>, solo se nessun’altra VM li usa."
+    },
+    "apply": {
+      "title": "Applicare modifiche a host e ospiti",
+      "body": "Una volta confermato, lo script scrive i cambiamenti di lato host — <code>vfio.conf</code>, blacklist, moduli e (per NVIDIA) la regola per-BDF udev a <code>/etc/udev/rules.d/10-proxmenux-vfio-bind.rules</code> più lo stato BDF a <code>/etc/proxmenux/vfio-bind.bdfs</code>. Esso applica anche la politica di conflitto scelta per ogni VM/LXC interessato. Se l'host config è effettivamente cambiato, viene eseguito <code>update-initramfs -u -k all</code> seguito da <code>proxmox-boot-tool refresh</code>; altrimenti entrambi sono saltati."
+    },
+    "reboot": {
+      "title": "Riavvia",
+      "body": "Riavvia l’host per applicare la nuova associazione persistente. Puoi rimandare, ma verifica il driver attivo prima di avviare l’ospite di destinazione: fino al riavvio può restare quello precedente.",
+      "imageAlt": "Riepilogo finestra di dialogo che cosa è cambiato, seguito dal prompt di riavvio"
+    }
+  },
+  "manual": {
+    "heading": "Verifica manuale",
+    "intro": "Prima di <strong>VM → LXC</strong>, controlla driver e regole BDF. L’esempio NVIDIA usa <code>10de:2204</code>: adattalo alla tua scheda. I comandi leggono lo stato; lo script gestisce anche ospiti e membri del gruppo IOMMU.",
+    "lxcToVm": "Prima di <strong>LXC → VM</strong>, controlla indirizzo PCI e gruppo IOMMU. Sostituisci l’indirizzo di esempio e verifica tutti i membri prima dell’assegnazione.",
+    "oneVmTitle": "Un GPU fisico assegnato con VFIO può essere usato da una sola VM alla volta",
+    "oneVmBody": "Mettere più voci <code>hostpci</code> con lo stesso slot PCI in due VM è valida configurazione ma solo una delle VM può iniziare con la GPU — la seconda fallirà. Il passo della politica di conflitto ProxMenux è esattamente quello di evitare questa trappola."
+  },
+  "verification": {
+    "heading": "Verifica dopo il riavvio"
+  },
+  "troubleshoot": {
+    "heading": "Risoluzione dei problemi",
+    "stillVfioTitle": "GPU mostra ancora vfio-pci dopo il passaggio alla modalità LXC",
+    "stillVfioBody": "Un modulo VFIO caricato non dimostra quale driver usi il GPU. Verifica associazione, completamento di <code>update-initramfs</code> e riavvio. <code>lsmod | grep vfio</code> elenca solo moduli. Per AMD / Intel controlla <code>vfio.conf</code>; per NVIDIA, <code>/etc/proxmenux/vfio-bind.bdfs</code> e <code>/etc/udev/rules.d/10-proxmenux-vfio-bind.rules</code>. Correggi le regole obsolete prima di <code>update-initramfs -u -k all</code> e del riavvio.",
+    "vmFailTitle": "Una VM non si avvia dopo il passaggio del GPU a LXC",
+    "vmFailBody": "Verifica i riferimenti <code>hostpci</code> obsoleti. L’opzione <em>Rimuovi GPU dalla configurazione</em> può eliminarli durante il cambio previsto. Prima di rieseguire lo script controlla la direzione per non invertire la modalità per errore. In alternativa rimuovi l’assegnazione in Proxmox con la VM ferma.",
+    "smiFailTitle": "nvidia-smi mostra «Driver/library version mismatch» tornando a LXC",
+    "smiFailBody": "Confronta il modulo NVIDIA caricato con le librerie installate, anche nei LXC. Allinea le versioni: riavviare carica il modulo installato ma non corregge pacchetti incompatibili. Ricaricare con <code>modprobe -r nvidia</code> e <code>modprobe nvidia</code> richiede di fermare i client GPU e può fallire se sono usati moduli dipendenti.",
+    "logTitle": "Registro di esecuzione",
+    "logBody": "Ogni esecuzione scrive in <code>/tmp/proxmenux_gpu_switch_mode.log</code> sull’host. Allega il registro quando chiedi aiuto su GitHub."
+  },
+  "related": {
+    "heading": "Vedi anche",
+    "items": [
+      {
+        "label": "Aggiungi GPU a VM (Passthrough)",
+        "href": "/docs/hardware/gpu-vm-passthrough",
+        "tail": " — configurazione iniziale della modalità VM."
+      },
+      {
+        "label": "Aggiungi GPU a LXC",
+        "href": "/docs/hardware/igpu-acceleration-lxc",
+        "tail": " — configurazione iniziale della modalità LXC."
+      },
+      {
+        "label": "Installare driver NVIDIA (Host)",
+        "href": "/docs/hardware/nvidia-host",
+        "tail": "— necessario per la modalità LXC su GPU NVIDIA."
+      },
+      {
+        "label": "ProxMenux Monitor — Scheda hardware",
+        "href": "/docs/monitor/dashboard/hardware",
+        "tail": " — sezione Schede grafiche, con modalità attuale e comando per cambiarla."
+      },
+      {
+        "label": "Comandi per passthrough GPU",
+        "href": "/docs/help-info/gpu-commands",
+        "tail": " — riferimento rapido ai comandi."
+      }
+    ]
+  }
+}
diff --git a/web/messages/it/docs/help-info/backup-commands.json b/web/messages/it/docs/help-info/backup-commands.json
new file mode 100644
index 00000000..15390865
--- /dev/null
+++ b/web/messages/it/docs/help-info/backup-commands.json
@@ -0,0 +1,235 @@
+{
+  "meta": {
+    "title": "Comandi di backup Proxmox — vzdump, qmrestore, pct restore | ProxMenux",
+    "description": "Riferimento dei comandi di backup e ripristino Proxmox VE: vzdump per VM e container LXC, qmrestore per VM, pct restore per container, backup pianificati in /etc/pve/jobs.cfg, hook script e percorsi da escludere.",
+    "ogTitle": "Comandi di backup Proxmox — vzdump, qmrestore, pct restore",
+    "ogDescription": "Riferimento dei comandi vzdump, qmrestore e pct restore per salvare e ripristinare VM e container LXC Proxmox.",
+    "twitterTitle": "Comandi di backup Proxmox | ProxMenux",
+    "twitterDescription": "Comandi vzdump, qmrestore e pct restore per salvare e ripristinare VM e container Proxmox."
+  },
+  "header": {
+    "title": "Backup e ripristino",
+    "description": "Riferimento ragionato dei comandi vzdump, qmrestore e pct restore per i backup Proxmox. Include pianificazione, opzioni avanzate come hook script, percorsi da escludere e priorità I/O, oltre alla gestione dei file di backup.",
+    "section": "Aiuto e informazioni"
+  },
+  "intro": {
+    "title": "Tre modalità di backup",
+    "body": "Per le VM, <strong>snapshot</strong> esegue un backup a caldo senza richiedere snapshot dello storage. <strong>suspend</strong> sospende prima la VM, senza necessariamente migliorare la coerenza. <strong>stop</strong> la spegne prima; se era attiva, può riprendere dopo l’inizio del backup. In LXC è diverso: snapshot richiede uno storage con snapshot, suspend usa due passaggi rsync e stop mantiene il container fermo per tutto il backup."
+  },
+  "commandGroups": [
+    {
+      "title": "Backup VM",
+      "commands": [
+        {
+          "command": "vzdump <vmid>",
+          "description": "Creare un backup di una specifica VM/CT"
+        },
+        {
+          "command": "vzdump <vmid> --storage <storage>",
+          "description": "Backup VM per lo storage specifico"
+        },
+        {
+          "command": "vzdump <vmid> --mode snapshot",
+          "description": "Crea backup snapshot (per VM)"
+        },
+        {
+          "command": "vzdump <vmid> --mode suspend",
+          "description": "Sospendi la VM prima del backup a caldo, modalità suspend precedente"
+        },
+        {
+          "command": "vzdump <vmid> --mode stop",
+          "description": "Spegni la VM prima di iniziare il backup"
+        },
+        {
+          "command": "vzdump --all",
+          "description": "Backup di tutte le VM e contenitori"
+        },
+        {
+          "command": "vzdump --all --exclude <vmid1>,<vmid2>",
+          "description": "Backup tutti tranne VM specificate"
+        }
+      ]
+    },
+    {
+      "title": "Opzioni di backup",
+      "commands": [
+        {
+          "command": "vzdump <vmid> --compress zstd",
+          "description": "Utilizzare la compressione zstd per il backup"
+        },
+        {
+          "command": "vzdump <vmid> --compress gzip --pigz <threads>",
+          "description": "Usa pigz con più thread"
+        },
+        {
+          "command": "vzdump <vmid> --storage <storage> --notes-template <text>",
+          "description": "Aggiungi note al backup"
+        },
+        {
+          "command": "vzdump <vmid> --mailto <email>",
+          "description": "Invia email di notifica"
+        },
+        {
+          "command": "vzdump <vmid> --prune-backups keep-last=<n>",
+          "description": "Mantenere solo n backup per VM"
+        },
+        {
+          "command": "vzdump <vmid> --stdexcludes 0",
+          "description": "Non escludere i file temporanei"
+        },
+        {
+          "command": "vzdump <vmid> --quiet 1",
+          "description": "Sopprimi i messaggi di output"
+        }
+      ]
+    },
+    {
+      "title": "Ripristinare i backup",
+      "commands": [
+        {
+          "command": "qmrestore <backup-file> <vmid>",
+          "description": "Ripristinare VM da backup"
+        },
+        {
+          "command": "qmrestore <backup-file> <vmid> --storage <storage>",
+          "description": "Ripristinare lo storage specifico"
+        },
+        {
+          "command": "qmrestore <backup-file> <vmid> --unique",
+          "description": "Ripristina la VM generando nuovi indirizzi MAC casuali"
+        },
+        {
+          "command": "pct restore <vmid> <backup-file>",
+          "description": "Ripristinare container da backup"
+        },
+        {
+          "command": "pct restore <vmid> <backup-file> --storage <storage>",
+          "description": "Ripristina il container su uno storage specifico"
+        },
+        {
+          "command": "pct restore <vmid> <backup-file> --rootfs <storage>:<size-GiB>",
+          "description": "Ripristina allocando il disco radice sullo storage e con la dimensione scelti"
+        },
+        {
+          "command": "pct restore <vmid> <backup-file> --unprivileged 1",
+          "description": "Ripristina come container non privilegiato"
+        }
+      ]
+    },
+    {
+      "title": "Gestione dei backup",
+      "commands": [
+        {
+          "command": "ls -la /var/lib/vz/dump/",
+          "description": "Elenca i backup nella posizione predefinita"
+        },
+        {
+          "command": "find /var/lib/vz/dump/ -name \"*.vma*\"",
+          "description": "Trova i backup VM"
+        },
+        {
+          "command": "find /var/lib/vz/dump/ -name \"*.tar*\"",
+          "description": "Trova i backup dei container"
+        },
+        {
+          "command": "pvesm list <storage> --content backup",
+          "description": "Elenca i backup in archiviazione specifica"
+        },
+        {
+          "command": "rm /var/lib/vz/dump/<backup-file>",
+          "description": "Eliminare un file di backup"
+        },
+        {
+          "command": "cat /etc/vzdump.conf",
+          "description": "Mostra configurazione di backup"
+        }
+      ]
+    },
+    {
+      "title": "Backup programmati",
+      "commands": [
+        {
+          "command": "cat /etc/pve/jobs.cfg",
+          "description": "Mostra gli orari di backup"
+        },
+        {
+          "command": "nano /etc/vzdump.conf",
+          "description": "Modifica della configurazione di backup"
+        },
+        {
+          "command": "systemctl list-timers",
+          "description": "Elenca i timer systemd"
+        },
+        {
+          "command": "systemctl status cron",
+          "description": "Controlla lo stato del servizio cron"
+        },
+        {
+          "command": "pvenode task list --typefilter vzdump",
+          "description": "Elenca le attività di backup completate"
+        },
+        {
+          "command": "pvenode task log <upid>",
+          "description": "Mostra il log di un’attività di backup tramite il suo UPID"
+        }
+      ]
+    },
+    {
+      "title": "Operazioni avanzate",
+      "commands": [
+        {
+          "command": "qmrestore <backup> <vmid> --force",
+          "description": "Forza il ripristino sovrascrivendo la VM esistente"
+        },
+        {
+          "command": "vzdump <vmid> --dumpdir <directory>",
+          "description": "Specificare la directory di backup personalizzata"
+        },
+        {
+          "command": "vzdump <vmid> --script <script>",
+          "description": "Esegui uno script hook durante il backup"
+        },
+        {
+          "command": "vzdump <vmid> --exclude-path <path>",
+          "description": "Escludere percorsi specifici da backup"
+        },
+        {
+          "command": "vzdump <vmid> --ionice <priority>",
+          "description": "Impostare la priorità I/O per il processo di backup"
+        },
+        {
+          "command": "vzdump <vmid> --lockwait <minutes>",
+          "description": "Attendi il rilascio del blocco"
+        },
+        {
+          "command": "qm importdisk <vmid> <disk-image> <storage>",
+          "description": "Importare un file immagine disco (ad esempio raw, qcow2 o vmdk) come disco non utilizzato, non un archivio di backup vzdump"
+        }
+      ]
+    }
+  ],
+  "testRestores": {
+    "title": "Verifica i ripristini",
+    "bodyRich": "Ripristina periodicamente un backup su un VMID di prova libero con <code>qmrestore --unique</code>, avvia la VM su una rete isolata e controllane il contenuto. L’opzione unique genera nuovi indirizzi MAC, ma non cambia gli IP statici o le impostazioni delle applicazioni. Verifica allo stesso modo i container con <code>pct restore</code>."
+  },
+  "related": {
+    "heading": "Correlati",
+    "items": [
+      {
+        "href": "/docs/help-info/vm-ct-commands",
+        "label": "Gestione VM e CT",
+        "tail": "— comandi del ciclo di vita qm e pct."
+      },
+      {
+        "href": "/docs/help-info/storage-commands",
+        "label": "Archiviazione e dischi",
+        "tail": "— gestione dello storage pvesm."
+      },
+      {
+        "href": "/docs/help-info",
+        "label": "Panoramica degli aiuti e delle informazioni",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/it/docs/help-info/gpu-commands.json b/web/messages/it/docs/help-info/gpu-commands.json
new file mode 100644
index 00000000..1d4745ae
--- /dev/null
+++ b/web/messages/it/docs/help-info/gpu-commands.json
@@ -0,0 +1,162 @@
+{
+  "meta": {
+    "title": "Comandi per il passthrough GPU in Proxmox — lspci, VFIO, IOMMU, qm set hostpci | ProxMenux",
+    "description": "Riferimento per il passthrough GPU in Proxmox VE: identificazione dei dispositivi con lspci, moduli VFIO, gruppi IOMMU (intel_iommu / amd_iommu), aggiornamenti GRUB e initramfs, qm set hostpci0 e configurazione NVIDIA / AMD / Intel.",
+    "ogTitle": "Comandi per il passthrough GPU in Proxmox — lspci, VFIO, IOMMU, qm set hostpci",
+    "ogDescription": "Riferimento per ispezionare e configurare il passthrough GPU su Proxmox VE — dispositivi PCI, moduli VFIO, gruppi IOMMU, param di avvio del kernel, qm set hostpci.",
+    "twitterTitle": "Comandi per il passthrough GPU in Proxmox | ProxMenux",
+    "twitterDescription": "Ispezionare i dispositivi PCI, configurare VFIO e IOMMU e collegare GPU alle VM su Proxmox VE."
+  },
+  "header": {
+    "title": "Passthrough GPU",
+    "description": "Riferimento per controllare e configurare il passthrough GPU / TPU in Proxmox: identificazione dei dispositivi (lspci), moduli VFIO, verifica di IOMMU, aggiornamenti initramfs / GRUB e configurazione per VM (qm set hostpci, machine q35, bios ovmf).",
+    "section": "Aiuto e informazioni"
+  },
+  "intro": {
+    "title": "IOMMU deve essere abilitato in BIOS / UEFI",
+    "body": "Abilita prima IOMMU nel firmware: cerca <em>VT-d</em>, <em>AMD-Vi</em> o <em>IOMMU</em> nel BIOS/UEFI. In Linux è attivo per impostazione predefinita su AMD e su Intel con kernel Proxmox 6.8 o successivi. I kernel Intel precedenti possono richiedere <code>intel_iommu=on</code>. L’opzione <code>iommu=pt</code> controlla la modalità passthrough di IOMMU e non richiede di disabilitare indiscriminatamente il framebuffer dell’host."
+  },
+  "commandGroups": [
+    {
+      "title": "Identificazione del dispositivo",
+      "commands": [
+        {
+          "command": "lspci -nn | grep -i nvidia",
+          "description": "Elenco dispositivi NVIDIA PCI"
+        },
+        {
+          "command": "lspci -nn | grep -i vga",
+          "description": "Elenca tutti i dispositivi compatibili VGA"
+        },
+        {
+          "command": "lspci -nn | grep -i amd",
+          "description": "Elenco dispositivi PCI AMD"
+        },
+        {
+          "command": "lspci -nnk | grep -A3 VGA",
+          "description": "Elenca dispositivi VGA con driver kernel"
+        },
+        {
+          "command": "lspci -v -s <PCI_ID>",
+          "description": "Mostra informazioni dettagliate per dispositivo PCI specifico"
+        }
+      ]
+    },
+    {
+      "title": "Configurazione VFIO",
+      "commands": [
+        {
+          "command": "dmesg | grep -i vfio",
+          "description": "Controllare i messaggi del modulo VFIO"
+        },
+        {
+          "command": "cat /etc/modprobe.d/vfio.conf",
+          "description": "Controlla la configurazione del passthrough VFIO"
+        },
+        {
+          "command": "ls -la /etc/modprobe.d/",
+          "description": "Elenca tutti i file di configurazione modprobe"
+        },
+        {
+          "command": "cat /etc/modules",
+          "description": "Mostra i moduli caricati al boot time"
+        },
+        {
+          "command": "lsmod | grep vfio",
+          "description": "Controlla se i moduli VFIO sono caricati"
+        }
+      ]
+    },
+    {
+      "title": "Configurazione IOMMU",
+      "commands": [
+        {
+          "command": "cat /etc/default/grub",
+          "description": "Controlla le opzioni GRUB per IOMMU"
+        },
+        {
+          "command": "update-grub",
+          "description": "Applicare le modifiche GRUB"
+        },
+        {
+          "command": "dmesg | grep -i iommu",
+          "description": "Controlla i messaggi IOMMU nel registro del kernel"
+        },
+        {
+          "command": "dmesg | grep -e DMAR -e IOMMU",
+          "description": "Controlla i messaggi DMAR e IOMMU"
+        },
+        {
+          "command": "find /sys/kernel/iommu_groups/ -type l | sort -V",
+          "description": "Elenco gruppi IOMMU"
+        }
+      ]
+    },
+    {
+      "title": "Aggiornamenti di sistema",
+      "commands": [
+        {
+          "command": "update-initramfs -u",
+          "description": "Applicare i cambiamenti initramfs (VFIO)"
+        },
+        {
+          "command": "update-initramfs -u -k all",
+          "description": "Aggiorna initramfs per tutti i kernel"
+        },
+        {
+          "command": "cat /proc/cmdline",
+          "description": "Mostra i parametri di avvio del kernel attuali"
+        }
+      ]
+    },
+    {
+      "title": "Configurazione VM",
+      "commands": [
+        {
+          "command": "qm config <vmid> | grep hostpci",
+          "description": "Mostra la configurazione del passthrough PCI di una VM"
+        },
+        {
+          "command": "qm set <vmid> -hostpci0 <PCI_ID>,pcie=1,x-vga=1",
+          "description": "Aggiungi il passthrough GPU a una VM"
+        },
+        {
+          "command": "cat /etc/pve/qemu-server/<vmid>.conf",
+          "description": "Visualizza il file di configurazione VM"
+        },
+        {
+          "command": "qm set <vmid> -machine q35",
+          "description": "Impostare VM per utilizzare il chipset Q35 (consigliato per il passaggio)"
+        },
+        {
+          "command": "qm set <vmid> -bios ovmf",
+          "description": "Imposta la VM su UEFI/OVMF, consigliato se la ROM della GPU supporta UEFI"
+        }
+      ]
+    }
+  ],
+  "afterChangesTip": {
+    "title": "Dopo aver modificato le configurazioni GRUB o modprobe",
+    "bodyRich": "Sugli host con GRUB, applica i parametri di avvio con <code>update-grub</code>. Aggiorna i moduli con <code>update-initramfs -u -k all</code>, poi riavvia. Gli altri bootloader richiedono la propria procedura. Verifica <code>cat /proc/cmdline</code> (parametri del kernel), <code>dmesg | grep -i iommu</code> (IOMMU inizializzato) e <code>find /sys/kernel/iommu_groups/ -type l | sort -V</code> (gruppi presenti)."
+  },
+  "related": {
+    "heading": "Correlati",
+    "items": [
+      {
+        "href": "/docs/hardware/gpu-vm-passthrough",
+        "label": "Aggiungi GPU a VM (Passthrough)",
+        "tail": "— flusso ProxMenux interattivo."
+      },
+      {
+        "href": "/docs/hardware/igpu-acceleration-lxc",
+        "label": "Aggiungi GPU a LXC",
+        "tail": " — condividere l’accesso ai dispositivi GPU dell’host con un container LXC."
+      },
+      {
+        "href": "/docs/help-info",
+        "label": "Panoramica degli aiuti e delle informazioni",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/it/docs/help-info/index.json b/web/messages/it/docs/help-info/index.json
new file mode 100644
index 00000000..d9dafff9
--- /dev/null
+++ b/web/messages/it/docs/help-info/index.json
@@ -0,0 +1,87 @@
+{
+  "meta": {
+    "title": "Riferimento dei comandi Proxmox — qm, pct, vzdump, zpool, pveversion | ProxMenux",
+    "description": "Selezione di comandi essenziali di Proxmox VE e Linux per argomento: controllo del sistema, gestione di VM e LXC (qm / pct), archiviazione e dischi, rete, aggiornamenti, passthrough GPU, ZFS, backup e ripristino e strumenti da terminale per l’uso quotidiano.",
+    "ogTitle": "Riferimento dei comandi Proxmox — qm, pct, vzdump, zpool",
+    "ogDescription": "Selezione di comandi utili di Proxmox VE e Linux per argomento: sistema, VM/CT, archiviazione, rete, aggiornamenti, passthrough GPU, ZFS, backup e strumenti CLI.",
+    "twitterTitle": "Riferimento dei comandi Proxmox | ProxMenux",
+    "twitterDescription": "Selezione di comandi utili di Proxmox VE e Linux, raggruppati per argomento."
+  },
+  "header": {
+    "title": "Aiuto e informazioni",
+    "description": "Selezione di comandi utili di Linux e Proxmox VE per argomento. Le nove categorie vanno da un rapido controllo con pveversion a sequenze su più righe con zfs send/receive. È un riferimento unico da affiancare alle sezioni GPU, dischi e condivisioni di ProxMenux.",
+    "section": "Aiuto e informazioni"
+  },
+  "intro": {
+    "title": "Che cosa è questo",
+    "body": "Un catalogo di riferimento dei comandi che si utilizzano effettivamente su un host Proxmox, raggruppati per argomento. All'interno di ProxMenux è possibile selezionare un numero per eseguire un comando direttamente o incollare il proprio al prompt; su questo sito ogni categoria è una tabella di copia-incolla."
+  },
+  "opening": {
+    "heading": "Apertura del menu",
+    "body": "Dal menu principale di ProxMenux, premi <kbd>h</kbd>. Vedrai questo:",
+    "imageAlt": "Menu Aiuto e informazioni con nove categorie di comandi"
+  },
+  "categories": {
+    "heading": "Le nove categorie",
+    "options": [
+      {
+        "icon": "Terminal",
+        "href": "/docs/help-info/system-commands",
+        "title": "Comandi di sistema utili",
+        "description": "pveversion, uptime, free, journalctl, hostnamectl, informazioni sull’utente corrente, audit con lynis e fastfetch."
+      },
+      {
+        "icon": "Cpu",
+        "href": "/docs/help-info/vm-ct-commands",
+        "title": "Gestione VM e CT",
+        "description": "qm list / config / start / stop / migrate, pct list / config / enter, snapshot e clonazione."
+      },
+      {
+        "icon": "HardDrive",
+        "href": "/docs/help-info/storage-commands",
+        "title": "Archiviazione e dischi",
+        "description": "lsblk, blkid, smartctl, informazioni sui montaggi, pvesm status e comandi LVM."
+      },
+      {
+        "icon": "Network",
+        "href": "/docs/help-info/network-commands",
+        "title": "Comandi rete",
+        "description": "ip / ss / nmcli, controllo dei bridge, ping / traceroute, query DNS e fail2ban-client."
+      },
+      {
+        "icon": "Package",
+        "href": "/docs/help-info/update-commands",
+        "title": "Aggiornamenti e pacchetti",
+        "description": "apt update / dist-upgrade, apt-cache policy, query dpkg e verifica dei file dei repository."
+      },
+      {
+        "icon": "Cpu",
+        "href": "/docs/help-info/gpu-commands",
+        "title": "Passthrough GPU",
+        "description": "Controlli con lspci / dmesg, verifica dell’attivazione di IOMMU, associazione a vfio-pci e uso della GPU dall’host."
+      },
+      {
+        "icon": "Database",
+        "href": "/docs/help-info/zfs-commands",
+        "title": "Gestione ZFS",
+        "description": "Comandi zpool / zfs per stato, dataset, snapshot, send/receive, regolazione di ARC e TRIM."
+      },
+      {
+        "icon": "Archive",
+        "href": "/docs/help-info/backup-commands",
+        "title": "Backup e ripristino",
+        "description": "vzdump, qmrestore / pct restore, strumenti Proxmox Backup Server e operazioni sugli snapshot."
+      },
+      {
+        "icon": "Wrench",
+        "href": "/docs/help-info/tools-commands",
+        "title": "Strumenti CLI di sistema",
+        "description": "tmux, screen, htop / btop, ncdu, jq, dig, lsof, watch — strumenti di amministrazione quotidiana."
+      }
+    ]
+  },
+  "tip": {
+    "title": "Ricercabile dalla ricerca globale",
+    "body": "La ricerca della documentazione indicizza tutti i comandi di queste pagine. Se ricordi un’opzione o un frammento ma non la pagina, usa la barra di ricerca in alto per raggiungere direttamente la voce giusta."
+  }
+}
diff --git a/web/messages/it/docs/help-info/network-commands.json b/web/messages/it/docs/help-info/network-commands.json
new file mode 100644
index 00000000..8eae7687
--- /dev/null
+++ b/web/messages/it/docs/help-info/network-commands.json
@@ -0,0 +1,174 @@
+{
+  "meta": {
+    "title": "Comandi di rete Proxmox — ip, ping, ss, pve-firewall, iptables | ProxMenux",
+    "description": "Riferimento dei comandi di rete dell’host Proxmox VE: ip / ip link / ip addr, ping, traceroute, mtr, ss, ethtool, dig, nslookup, oltre a pve-firewall, iptables e nftables per il filtraggio. Controllo di bridge, bond e VLAN.",
+    "ogTitle": "Comandi di rete Proxmox — ip, ping, ss, pve-firewall, iptables",
+    "ogDescription": "Comandi di rete per Proxmox VE: controllo delle interfacce, test di connettività, monitoraggio, firewall (pve-firewall, iptables, nftables) e query DNS.",
+    "twitterTitle": "Comandi di rete Proxmox | ProxMenux",
+    "twitterDescription": "Controlli di rete, test, configurazione e firewall per Proxmox VE."
+  },
+  "header": {
+    "title": "Comandi rete",
+    "description": "Referenza curata per la rete host Proxmox: informazioni sull'interfaccia, test di connettività, configurazione, monitoraggio del traffico e gestione del firewall. Combina ip / ss / nmcli / ethtool / tcpdump / pve-firewall.",
+    "section": "Aiuto e informazioni"
+  },
+  "intro": {
+    "title": "Inventario rapido delle interfacce",
+    "body": "<code>ip a</code> mostra ogni interfaccia con i relativi indirizzi IP e MAC. <code>ip r</code> mostra la tabella di routing. Insieme permettono di verificare in pochi secondi gran parte della configurazione di un’interfaccia."
+  },
+  "commandGroups": [
+    {
+      "title": "Informazioni sulla rete",
+      "commands": [
+        {
+          "command": "ip a",
+          "description": "Mostra interfacce di rete e IP"
+        },
+        {
+          "command": "ip r",
+          "description": "Mostra tabella di routing"
+        },
+        {
+          "command": "ip -s link",
+          "description": "Mostra statistiche traffico per interfaccia"
+        },
+        {
+          "command": "brctl show",
+          "description": "Mostra i bridge di rete configurati"
+        },
+        {
+          "command": "cat /etc/network/interfaces",
+          "description": "Mostra la configurazione di rete grezza"
+        }
+      ]
+    },
+    {
+      "title": "Test di rete",
+      "commands": [
+        {
+          "command": "ping <host>",
+          "description": "Controlla la connettività con un altro host"
+        },
+        {
+          "command": "traceroute <host>",
+          "description": "Tracciare il percorso verso un host"
+        },
+        {
+          "command": "mtr <host>",
+          "description": "Combina ping e traceroute in tempo reale"
+        },
+        {
+          "command": "dig <domain>",
+          "description": "Ricerca DNS per un dominio"
+        },
+        {
+          "command": "nslookup <domain>",
+          "description": "Ricerca alternativa DNS"
+        }
+      ]
+    },
+    {
+      "title": "Configurazione rete",
+      "commands": [
+        {
+          "command": "ifreload -a",
+          "description": "Ricarica la configurazione di rete (ifupdown2)"
+        },
+        {
+          "command": "ethtool <iface>",
+          "description": "Mostra informazioni dispositivo Ethernet"
+        },
+        {
+          "command": "resolvectl status",
+          "description": "Mostra stato risoluzione DNS"
+        },
+        {
+          "command": "nmcli device show",
+          "description": "Mostra i dettagli del dispositivo di rete (se viene utilizzato NetworkManager)"
+        },
+        {
+          "command": "ip link set <iface> up",
+          "description": "Attiva un’interfaccia di rete"
+        },
+        {
+          "command": "ip link set <iface> down",
+          "description": "Disattiva un’interfaccia di rete"
+        }
+      ]
+    },
+    {
+      "title": "Monitoraggio della rete",
+      "commands": [
+        {
+          "command": "ss -tuln",
+          "description": "Mostra porte di ascolto (TCP/UDP)"
+        },
+        {
+          "command": "netstat -tuln",
+          "description": "Alternativa per mostrare le porte di ascolto"
+        },
+        {
+          "command": "lsof -i",
+          "description": "Elenca i file di rete aperti e le connessioni"
+        },
+        {
+          "command": "tcpdump -i <iface>",
+          "description": "Cattura i pacchetti sull'interfaccia"
+        },
+        {
+          "command": "iftop -i <iface>",
+          "description": "Monitorare l'utilizzo della larghezza di banda sull'interfaccia"
+        }
+      ]
+    },
+    {
+      "title": "Gestione del firewall",
+      "commands": [
+        {
+          "command": "iptables -L -n -v",
+          "description": "Mostra regole firewall attive (iptables)"
+        },
+        {
+          "command": "nft list ruleset",
+          "description": "Mostra regole nftables"
+        },
+        {
+          "command": "pve-firewall status",
+          "description": "Controlla stato firewall Proxmox"
+        },
+        {
+          "command": "pve-firewall compile",
+          "description": "Compila le regole firewall per tutti i nodi"
+        },
+        {
+          "command": "pve-firewall reload",
+          "description": "Ricarica regole firewall Proxmox"
+        }
+      ]
+    }
+  ],
+  "iptablesTip": {
+    "title": "iptables vs nftables",
+    "bodyRich": "Il servizio classico <code>pve-firewall</code> genera regole iptables. Il servizio alternativo proxmox-firewall usa <strong>nftables</strong>. Controlla il backend iptables con <code>iptables -L -n -v</code> e quello nftables con <code>nft list ruleset</code>. Usa gli strumenti del backend attivo: gli elenchi non sono intercambiabili."
+  },
+  "related": {
+    "heading": "Correlati",
+    "items": [
+      {
+        "href": "/docs/network",
+        "label": "Gestione rete",
+        "tail": "— strumenti di rete interattivi ProxMenux (analisi del ponte, nomi persistenti, monitoraggio)."
+      },
+      {
+        "href": "/docs/help-info/tools-commands",
+        "label": "Strumenti CLI di sistema",
+        "tail": "— più strumenti di monitoraggio della rete."
+      },
+      {
+        "href": "/docs/help-info",
+        "label": "Panoramica degli aiuti e delle informazioni",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/it/docs/help-info/storage-commands.json b/web/messages/it/docs/help-info/storage-commands.json
new file mode 100644
index 00000000..fb14111b
--- /dev/null
+++ b/web/messages/it/docs/help-info/storage-commands.json
@@ -0,0 +1,232 @@
+{
+  "meta": {
+    "title": "Comandi per storage e dischi Proxmox — lsblk, LVM, pvesm, qm importdisk | ProxMenux",
+    "description": "Riferimento dei comandi per storage e dischi in Proxmox VE: lsblk, blkid, parted, lvdisplay, vgdisplay, pvs, mount, df, du, ncdu e pvesm status, oltre a qm importdisk e qemu-img convert per i dischi delle VM.",
+    "ogTitle": "Comandi per storage e dischi Proxmox — lsblk, LVM, pvesm, qm importdisk",
+    "ogDescription": "Comandi per storage e dischi Proxmox VE: controllo dei dischi, LVM, filesystem montati, gestione dello storage Proxmox, importazione dei dischi VM e conversione delle immagini.",
+    "twitterTitle": "Comandi di stoccaggio Proxmox | ProxMenux",
+    "twitterDescription": "ispezione disco, informazioni di montaggio, gestione LVM, archiviazione Proxmox e comandi di importazione/conversione del disco VM."
+  },
+  "header": {
+    "title": "Archiviazione e dischi",
+    "description": "Riferimento ragionato per controllare lo storage sugli host Proxmox: dispositivi a blocchi, partizioni, filesystem montati, volumi LVM, configurazione dello storage Proxmox e alcune operazioni sui dischi delle VM (importdisk, qemu-img convert).",
+    "section": "Aiuto e informazioni"
+  },
+  "intro": {
+    "title": "Inventario rapido dei dischi",
+    "body": "<code>lsblk</code> mostra i dispositivi a blocchi e le partizioni ad albero. Controlla gli identificatori persistenti con <code>ls -lh /dev/disk/by-id/</code>: per lo stesso disco restano normalmente stabili dopo riavvii o cambi nell’ordine dei dispositivi. Sostituire il disco o cambiare il modo in cui il controller ne espone l’identità può modificare il percorso by-id."
+  },
+  "commandGroups": [
+    {
+      "title": "Informazioni disco",
+      "commands": [
+        {
+          "command": "lsblk",
+          "description": "Elenca i dispositivi a blocchi e le partizioni"
+        },
+        {
+          "command": "fdisk -l",
+          "description": "Elenca i dischi con informazioni dettagliate"
+        },
+        {
+          "command": "blkid",
+          "description": "Mostra l'UUID e il tipo di file system dei dispositivi a blocchi"
+        },
+        {
+          "command": "ls -lh /dev/disk/by-id/",
+          "description": "Elenca gli identificatori persistenti del disco"
+        },
+        {
+          "command": "parted -l",
+          "description": "Layout dettagliato delle partizioni con dati GPT"
+        }
+      ]
+    },
+    {
+      "title": "Utilizzo dello storage",
+      "commands": [
+        {
+          "command": "df -h",
+          "description": "Mostra utilizzo disco per punto di montaggio"
+        },
+        {
+          "command": "du -sh /path",
+          "description": "Mostra dimensione directory"
+        },
+        {
+          "command": "mount | grep ^/dev",
+          "description": "Mostra dispositivi di storage montati"
+        },
+        {
+          "command": "cat /proc/mounts",
+          "description": "Mostra tutti i montaggi attivi dal kernel"
+        }
+      ]
+    },
+    {
+      "title": "Gestione LVM",
+      "commands": [
+        {
+          "command": "pvdisplay",
+          "description": "Visualizza volumi fisici (LVM)"
+        },
+        {
+          "command": "vgdisplay",
+          "description": "Visualizza gruppi di volumi (LVM)"
+        },
+        {
+          "command": "lvdisplay",
+          "description": "Visualizza volumi logici (LVM)"
+        },
+        {
+          "command": "pvs",
+          "description": "Output conciso di volumi fisici"
+        },
+        {
+          "command": "vgs",
+          "description": "Output conciso dei gruppi di volumi"
+        },
+        {
+          "command": "lvs",
+          "description": "Output conciso di volumi logici"
+        }
+      ]
+    },
+    {
+      "title": "Storage Proxmox",
+      "commands": [
+        {
+          "command": "cat /etc/pve/storage.cfg",
+          "description": "Mostra configurazione storage Proxmox"
+        },
+        {
+          "command": "pvesm status",
+          "description": "Mostra lo stato di tutti gli storage pool"
+        },
+        {
+          "command": "pvesm status --enabled 1",
+          "description": "Elenca gli storage configurati e abilitati"
+        },
+        {
+          "command": "pvesm list <storage>",
+          "description": "Elenca il contenuto di uno storage specifico"
+        },
+        {
+          "command": "pvesm scan nfs <server>",
+          "description": "Rileva le esportazioni NFS di un server"
+        }
+      ]
+    },
+    {
+      "title": "Azioni disco",
+      "commands": [
+        {
+          "command": "qm importdisk <vmid> <image_path> <storage>",
+          "description": "Importa l’immagine come disco inutilizzato della VM, da collegare in seguito"
+        },
+        {
+          "command": "qm set <vmid> -<bus><index> <disk_path>",
+          "description": "Assegnare disco fisico a VM (modalità passante)"
+        },
+        {
+          "command": "qemu-img convert -O <format> <input> <output>",
+          "description": "Converti il formato di un’immagine disco non in uso"
+        }
+      ]
+    },
+    {
+      "title": "Salute del disco SMART",
+      "commands": [
+        {
+          "command": "smartctl --scan",
+          "description": "Elenca dispositivi SMART-capable sull'host"
+        },
+        {
+          "command": "smartctl -i /dev/<disk>",
+          "description": "Informazioni di base del dispositivo (modello, firmware, seriale)"
+        },
+        {
+          "command": "smartctl -H /dev/<disk>",
+          "description": "Controllo rapido della salute — complessivamente PASSED / FAILED"
+        },
+        {
+          "command": "smartctl -A /dev/<disk>",
+          "description": "Solo attributi SMART: valori grezzi e soglie"
+        },
+        {
+          "command": "smartctl -a /dev/<disk>",
+          "description": "Informazioni complete SMART — info + attributi + log autotest"
+        },
+        {
+          "command": "smartctl -t short /dev/<disk>",
+          "description": "Avviare breve auto-test (~2 minuti, funziona in background)"
+        },
+        {
+          "command": "smartctl -t long /dev/<disk>",
+          "description": "Avvia un autotest lungo, anche di ore, in background"
+        },
+        {
+          "command": "smartctl -l selftest /dev/<disk>",
+          "description": "Visualizza il registro di prova (risultati dei test precedenti)"
+        },
+        {
+          "command": "smartctl -X /dev/<disk>",
+          "description": "Interrompi l'autotest in esecuzione"
+        }
+      ]
+    },
+    {
+      "title": "Salute del disco NVMe",
+      "commands": [
+        {
+          "command": "nvme list",
+          "description": "Elenca dispositivi NVMe visibili al kernel"
+        },
+        {
+          "command": "nvme smart-log /dev/<nvme>",
+          "description": "log NVMe-specific SMART (temperatura, usura, errori)"
+        },
+        {
+          "command": "nvme id-ctrl /dev/<nvme>",
+          "description": "Controller info (modello, firmware, funzionalità)"
+        },
+        {
+          "command": "nvme error-log /dev/<nvme>",
+          "description": "Ultime entrate del registro di errore NVMe"
+        }
+      ]
+    }
+  ],
+  "lvmTip": {
+    "title": "LVM comandi brevi e lunghi",
+    "bodyRich": "Entrambe le forme sono disponibili. <code>pvs</code> / <code>vgs</code> / <code>lvs</code> producono tabelle compatte con una riga per volume fisico, gruppo di volumi o volume logico, rispettivamente. <code>pvdisplay</code> / <code>vgdisplay</code> / <code>lvdisplay</code> forniscono più dettagli su diverse righe. Le forme brevi sono pratiche per i controlli quotidiani."
+  },
+  "smartInfo": {
+    "title": "SMART per SATA/SAS e NVMe",
+    "bodyRich": "<strong>I dischi SATA / SAS, inclusi gli SSD,</strong> si possono controllare con <code>smartctl</code> di <code>smartmontools</code>, installato di serie in Proxmox. Specifica il dispositivo, per esempio <code>/dev/sda</code> o <code>/dev/sdb</code>. <strong>I dischi NVMe</strong> usano un protocollo nativo diverso. Anche <code>smartctl</code> li supporta, mentre <code>nvme</code> di <code>nvme-cli</code> offre query specifiche su controller, namespace e stato NVMe. Installalo con <code>apt install nvme-cli</code> se manca."
+  },
+  "selfTestWarn": {
+    "title": "Le auto-test funzionano in background",
+    "bodyRich": "Sui dischi supportati, <code>smartctl -t short /dev/&lt;disk&gt;</code> e <code>smartctl -t long /dev/&lt;disk&gt;</code> avviano test in background e restituiscono subito il controllo. Verifica l’avanzamento con <code>smartctl -a /dev/&lt;disk&gt;</code>, cercando \"Self-test routine in progress\", oppure attendi e leggi <code>smartctl -l selftest /dev/&lt;disk&gt;</code>. I test brevi durano spesso circa due minuti; quelli lunghi possono richiedere ore. Il disco resta utilizzabile, ma le prestazioni I/O possono diminuire."
+  },
+  "related": {
+    "heading": "Correlati",
+    "items": [
+      {
+        "href": "/docs/help-info/zfs-commands",
+        "label": "Gestione ZFS",
+        "tail": "— comandi zpool / zfs per lo storage supportato da ZFS."
+      },
+      {
+        "href": "/docs/disk-manager",
+        "label": "Gestione disco",
+        "tail": "— flussi interattivi ProxMenux per il passaggio del disco, l'importazione, la formattazione, SMART."
+      },
+      {
+        "href": "/docs/help-info",
+        "label": "Panoramica degli aiuti e delle informazioni",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/it/docs/help-info/system-commands.json b/web/messages/it/docs/help-info/system-commands.json
new file mode 100644
index 00000000..8181e1c3
--- /dev/null
+++ b/web/messages/it/docs/help-info/system-commands.json
@@ -0,0 +1,158 @@
+{
+  "meta": {
+    "title": "Comandi di sistema Proxmox VE — pveversion, uptime, journalctl, systemctl | ProxMenux",
+    "description": "Comandi di sistema Proxmox VE e Linux per versioni, tempo di attività, memoria, servizi, log e utenti, con strumenti di audit e riepilogo. È incluso il riavvio di un servizio: non tutti gli esempi sono di sola lettura.",
+    "ogTitle": "Comandi di sistema Proxmox VE — pveversion, uptime, journalctl, systemctl",
+    "ogDescription": "Comandi di sistema Proxmox VE e Linux per versione, tempo di attività, servizi, log e informazioni sugli utenti, con gestione dei servizi e strumenti di audit.",
+    "twitterTitle": "Comandi di sistema Proxmox VE | ProxMenux",
+    "twitterDescription": "Comandi di ispezione di sistema essenziali per Proxmox VE — versione, stato, servizi, registri, informazioni utente."
+  },
+  "header": {
+    "title": "Comandi di sistema utili",
+    "description": "Comandi per controllare l’host Proxmox: versione, kernel, tempo di attività, memoria, stato dell’interfaccia web, log recenti e utenti connessi, con strumenti di audit e riepilogo. La maggior parte consulta lo stato, ma systemctl restart pveproxy riavvia il proxy web e gli strumenti di audit possono scrivere rapporti e log.",
+    "section": "Aiuto e informazioni"
+  },
+  "intro": {
+    "title": "Che cosa è questo",
+    "body": "Lo stesso elenco numerato mostrato da ProxMenux in <em>Comandi di sistema utili</em>. Usa il pulsante Copia per copiare un comando o consulta l’elenco per ricordare l’opzione esatta."
+  },
+  "commandGroups": [
+    {
+      "title": "Informazioni sistema",
+      "commands": [
+        {
+          "command": "pveversion",
+          "description": "Mostra versione Proxmox"
+        },
+        {
+          "command": "pveversion -v",
+          "description": "Informazioni dettagliate sulla versione Proxmox"
+        },
+        {
+          "command": "hostnamectl",
+          "description": "Nome host e informazioni kernel"
+        },
+        {
+          "command": "uname -a",
+          "description": "Informazioni kernel e architettura"
+        },
+        {
+          "command": "cat /etc/os-release",
+          "description": "Dettagli versione sistema operativo"
+        }
+      ]
+    },
+    {
+      "title": "Stato di sistema",
+      "commands": [
+        {
+          "command": "uptime",
+          "description": "Tempo di attività sistema"
+        },
+        {
+          "command": "uptime -p",
+          "description": "Formato leggibile del tempo di attività"
+        },
+        {
+          "command": "free -h",
+          "description": "Utilizzo RAM e swap"
+        },
+        {
+          "command": "who -b",
+          "description": "Ora ultimo avvio sistema"
+        },
+        {
+          "command": "last -x | grep shutdown",
+          "description": "Arresti precedenti"
+        }
+      ]
+    },
+    {
+      "title": "Gestione dei servizi",
+      "commands": [
+        {
+          "command": "systemctl status pveproxy",
+          "description": "Controlla stato interfaccia web Proxmox"
+        },
+        {
+          "command": "systemctl restart pveproxy",
+          "description": "Riavvia proxy interfaccia web"
+        },
+        {
+          "command": "journalctl -xe",
+          "description": "Errori e registri di sistema"
+        },
+        {
+          "command": "dmesg -T | tail -n 50",
+          "description": "Ultime 50 righe del registro kernel"
+        }
+      ]
+    },
+    {
+      "title": "Informazioni utente",
+      "commands": [
+        {
+          "command": "whoami",
+          "description": "Utente attuale"
+        },
+        {
+          "command": "id",
+          "description": "UID, GID e gruppi dell'utente corrente"
+        },
+        {
+          "command": "who",
+          "description": "Utenti connessi"
+        },
+        {
+          "command": "w",
+          "description": "Attività utenti e tempo di attività"
+        },
+        {
+          "command": "uptime && w",
+          "description": "Tempo di attività e utenti connessi"
+        },
+        {
+          "command": "cut -d: -f1,3,4 /etc/passwd",
+          "description": "Tutti gli utenti con UID e GID"
+        },
+        {
+          "command": "getent passwd | column -t -s :",
+          "description": "Tabella utenti leggibile (UID, shell, ecc.)"
+        }
+      ]
+    },
+    {
+      "title": "Strumenti di controllo e di sintesi",
+      "commands": [
+        {
+          "command": "lynis audit system",
+          "description": "Eseguire un controllo completo della sicurezza del sistema"
+        },
+        {
+          "command": "fastfetch",
+          "description": "Visualizza il riepilogo del sistema in formato ASCII"
+        }
+      ]
+    }
+  ],
+  "related": {
+    "heading": "Correlati",
+    "items": [
+      {
+        "href": "/docs/help-info/update-commands",
+        "label": "Aggiornamenti e pacchetti",
+        "tail": " — comandi apt e di aggiornamento di PVE."
+      },
+      {
+        "href": "/docs/help-info/tools-commands",
+        "label": "Strumenti CLI di sistema",
+        "tail": " — htop, btop, ncdu e strumenti simili."
+      },
+      {
+        "href": "/docs/help-info",
+        "label": "Panoramica degli aiuti e delle informazioni",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/it/docs/help-info/tools-commands.json b/web/messages/it/docs/help-info/tools-commands.json
new file mode 100644
index 00000000..813eb443
--- /dev/null
+++ b/web/messages/it/docs/help-info/tools-commands.json
@@ -0,0 +1,276 @@
+{
+  "meta": {
+    "title": "Strumenti CLI Linux per Proxmox — htop, iftop, journalctl, rsync, tmux | ProxMenux",
+    "description": "Strumenti CLI Linux per amministrare Proxmox VE ogni giorno: monitoraggio (htop, atop, glances, iotop), rete (iftop, nmap, mtr, ss), file e testo (find, grep, journalctl), prestazioni (iostat, perf, strace), sicurezza (fail2ban, lynis, lsof) e amministrazione remota (ssh, rsync, tmux).",
+    "ogTitle": "Strumenti CLI Linux per Proxmox — htop, iftop, journalctl, rsync, tmux",
+    "ogDescription": "Strumenti CLI per l’amministrazione quotidiana di Proxmox VE, suddivisi per funzione: monitoraggio, rete, file e testo, prestazioni, sicurezza e amministrazione remota.",
+    "twitterTitle": "Strumenti CLI Linux per Proxmox | ProxMenux",
+    "twitterDescription": "Strumenti quotidiani CLI per l'amministrazione Proxmox VE raggruppati per scopo."
+  },
+  "header": {
+    "title": "Strumenti CLI di sistema",
+    "description": "Strumenti quotidiani CLI per l'amministrazione degli host Proxmox, raggruppati per scopo: monitoraggio, rete, file e testo, analisi delle prestazioni, sicurezza, amministrazione remota e configurazione di sistema.",
+    "section": "Aiuto e informazioni"
+  },
+  "intro": {
+    "title": "La maggior parte viene installata dopo l’installazione",
+    "body": "Se hai eseguito lo script di post-installazione con le scelte predefinite, la maggior parte degli strumenti è già installata. Per quelli mancanti, l’<utilsLink>installazione delle utilità di sistema</utilsLink> di ProxMenux offre gruppi predefiniti: base, sviluppo, rete, analisi e altri."
+  },
+  "commandGroups": [
+    {
+      "title": "Monitoraggio del sistema",
+      "commands": [
+        {
+          "command": "htop",
+          "description": "Visualizzatore interattivo dei processi con uso di CPU e memoria"
+        },
+        {
+          "command": "top",
+          "description": "Visualizzazione di processi Linux in tempo reale"
+        },
+        {
+          "command": "atop",
+          "description": "Monitor avanzato del sistema e dei processi"
+        },
+        {
+          "command": "glances",
+          "description": "Strumento di monitoraggio del sistema con interfaccia web"
+        },
+        {
+          "command": "nmon",
+          "description": "Strumento di monitoraggio delle prestazioni"
+        },
+        {
+          "command": "iotop",
+          "description": "Monitorare l'utilizzo del disco I/O da processi"
+        },
+        {
+          "command": "vmstat 1",
+          "description": "Segnala le statistiche della memoria virtuale ogni secondo"
+        }
+      ]
+    },
+    {
+      "title": "Strumenti rete",
+      "commands": [
+        {
+          "command": "iftop",
+          "description": "Visualizzazione dell'utilizzo della larghezza di banda su un'interfaccia"
+        },
+        {
+          "command": "nmap <host>",
+          "description": "esplorazione della rete e scansione della sicurezza"
+        },
+        {
+          "command": "tcpdump -i <interface>",
+          "description": "Cattura il traffico di rete"
+        },
+        {
+          "command": "netstat -tuln",
+          "description": "Visualizza le connessioni di rete"
+        },
+        {
+          "command": "ss -tuln",
+          "description": "Un’altra utilità per esaminare i socket di rete"
+        },
+        {
+          "command": "mtr <host>",
+          "description": "Strumento diagnostico di rete che combina ping e traceroute"
+        },
+        {
+          "command": "iperf3 -s",
+          "description": "Eseguire server iperf per test di larghezza di banda"
+        }
+      ]
+    },
+    {
+      "title": "Strumenti di file e testo",
+      "commands": [
+        {
+          "command": "find / -name <filename>",
+          "description": "Trova file per nome"
+        },
+        {
+          "command": "grep -r 'pattern' /path",
+          "description": "Ricerca di modello in file"
+        },
+        {
+          "command": "sed -i 's/old/new/g' file",
+          "description": "Sostituire il testo nei file"
+        },
+        {
+          "command": "awk '{print $1}' file",
+          "description": "Strumento di elaborazione testi"
+        },
+        {
+          "command": "tail -f /var/log/syslog",
+          "description": "Seguire il file di log in tempo reale"
+        },
+        {
+          "command": "less /var/log/messages",
+          "description": "Visualizza file con paginazione"
+        },
+        {
+          "command": "journalctl -f",
+          "description": "Segui i log del journal di systemd"
+        }
+      ]
+    },
+    {
+      "title": "Analisi delle prestazioni",
+      "commands": [
+        {
+          "command": "iostat -x 1",
+          "description": "Mostra statistiche di CPU e I/O"
+        },
+        {
+          "command": "mpstat -P ALL 1",
+          "description": "Mostra l’utilizzo della CPU"
+        },
+        {
+          "command": "perf top",
+          "description": "Strumento di profilazione del sistema"
+        },
+        {
+          "command": "strace <command>",
+          "description": "Tracciare chiamate e segnali di sistema"
+        },
+        {
+          "command": "lsof",
+          "description": "Elenca i file aperti"
+        },
+        {
+          "command": "pstree",
+          "description": "Mostra l’albero dei processi"
+        },
+        {
+          "command": "slabtop",
+          "description": "Mostra informazioni sulla cache slab del kernel"
+        }
+      ]
+    },
+    {
+      "title": "Strumenti di sicurezza",
+      "commands": [
+        {
+          "command": "fail2ban-client status",
+          "description": "Mostra lo stato fail2ban"
+        },
+        {
+          "command": "chage -l <username>",
+          "description": "Mostra informazioni sulla scadenza della password"
+        },
+        {
+          "command": "lastlog",
+          "description": "Mostra ultimo login di tutti gli utenti"
+        },
+        {
+          "command": "last",
+          "description": "Mostra l’elenco degli ultimi utenti che hanno effettuato l’accesso"
+        },
+        {
+          "command": "w",
+          "description": "Mostra chi è collegato e cosa stanno facendo"
+        },
+        {
+          "command": "lynis audit system",
+          "description": "Strumento di controllo della sicurezza"
+        },
+        {
+          "command": "openssl s_client -connect host:port",
+          "description": "Test connessioni SSL/TLS"
+        }
+      ]
+    },
+    {
+      "title": "Amministrazione remota",
+      "commands": [
+        {
+          "command": "ssh <user>@<host>",
+          "description": "Collegamento sicuro della shell"
+        },
+        {
+          "command": "scp <file> <user>@<host>:<path>",
+          "description": "Copia i file in modo sicuro"
+        },
+        {
+          "command": "rsync -avz <src> <dest>",
+          "description": "Sincronizza file/cartelle"
+        },
+        {
+          "command": "screen",
+          "description": "Multiplexer del terminale"
+        },
+        {
+          "command": "tmux",
+          "description": "Multiplexer di terminale alternativo"
+        },
+        {
+          "command": "ssh-keygen -t rsa -b 4096",
+          "description": "Generare coppia chiave SSH"
+        },
+        {
+          "command": "ssh-copy-id <user>@<host>",
+          "description": "Copia chiave SSH per server"
+        }
+      ]
+    },
+    {
+      "title": "Configurazione del sistema",
+      "commands": [
+        {
+          "command": "systemctl status <service>",
+          "description": "Controlla stato servizio"
+        },
+        {
+          "command": "journalctl -u <service>",
+          "description": "Visualizza i registri dei servizi"
+        },
+        {
+          "command": "timedatectl",
+          "description": "Gestisci data e ora del sistema"
+        },
+        {
+          "command": "hostnamectl",
+          "description": "Gestisci il nome host del sistema"
+        },
+        {
+          "command": "localectl",
+          "description": "Gestisci le impostazioni locali e la tastiera del sistema"
+        },
+        {
+          "command": "update-alternatives --config <name>",
+          "description": "Configurare alternative di sistema"
+        },
+        {
+          "command": "dpkg-reconfigure <package>",
+          "description": "Riconfigurare un pacchetto installato"
+        }
+      ]
+    }
+  ],
+  "tmuxTip": {
+    "title": "Usa tmux / screen per i comandi di lunga durata",
+    "bodyRich": "Esegui le attività lunghe, come backup, aggiornamenti o grandi trasferimenti rsync, in <code>tmux</code> o <code>screen</code>, così una disconnessione SSH non termina la sessione del terminale. Per una sessione tmux, riconnettiti allo stesso host con lo stesso utente ed esegui <code>tmux attach</code>. Le sessioni screen hanno un proprio comando di riconnessione."
+  },
+  "related": {
+    "heading": "Correlati",
+    "items": [
+      {
+        "href": "/docs/utils/system-utils",
+        "label": "Installazione utilità di sistema",
+        "tail": "— installare uno di questi strumenti mancanti."
+      },
+      {
+        "href": "/docs/help-info/system-commands",
+        "label": "Comandi di sistema utili",
+        "tail": "— Comandi di ispezione specifici di Proxmox."
+      },
+      {
+        "href": "/docs/help-info",
+        "label": "Panoramica degli aiuti e delle informazioni",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/it/docs/help-info/update-commands.json b/web/messages/it/docs/help-info/update-commands.json
new file mode 100644
index 00000000..a9468f0e
--- /dev/null
+++ b/web/messages/it/docs/help-info/update-commands.json
@@ -0,0 +1,170 @@
+{
+  "meta": {
+    "title": "Comandi per aggiornamenti e pacchetti Proxmox — apt, pveupgrade, dpkg | ProxMenux",
+    "description": "Comandi di aggiornamento e gestione dei pacchetti Proxmox VE: apt update, apt upgrade, apt dist-upgrade, pveupgrade, dpkg -l, informazioni sui pacchetti e configurazione dei repository in /etc/apt/sources.list.d/.",
+    "ogTitle": "Comandi per aggiornamenti e pacchetti Proxmox — apt, pveupgrade, dpkg",
+    "ogDescription": "Comandi apt, pveupgrade e dpkg per mantenere aggiornato Proxmox VE: aggiornamenti di sistema, gestione dei pacchetti e configurazione dei repository.",
+    "twitterTitle": "Comandi di aggiornamento Proxmox | ProxMenux",
+    "twitterDescription": "Comandi apt e pveupgrade per gestire aggiornamenti e pacchetti sugli host Proxmox VE."
+  },
+  "header": {
+    "title": "Aggiornamenti e pacchetti",
+    "description": "Selezione di comandi apt e di aggiornamento Proxmox: aggiornamenti del sistema, installazione, rimozione e rimozione completa dei pacchetti, query con apt-cache policy e dpkg -l e controllo dei repository.",
+    "section": "Aiuto e informazioni"
+  },
+  "intro": {
+    "title": "Aggiorna sempre l'indice prima",
+    "body": "<code>apt update</code> aggiorna l’indice locale dei pacchetti dai repository configurati. Senza questo passaggio, <code>apt install</code> può usare versioni obsolete o fallire con \"Unable to locate package\"."
+  },
+  "commandGroups": [
+    {
+      "title": "Aggiornamenti di sistema",
+      "commands": [
+        {
+          "command": "apt update && apt upgrade -y",
+          "description": "Aggiorna gli elenchi e i pacchetti installati (apt upgrade)"
+        },
+        {
+          "command": "apt dist-upgrade -y",
+          "description": "Aggiornamento completo del sistema, comprese le dipendenze"
+        },
+        {
+          "command": "apt update",
+          "description": "Aggiorna solo gli elenchi dei pacchetti"
+        },
+        {
+          "command": "apt upgrade",
+          "description": "Aggiorna solo i pacchetti (interattivo)"
+        },
+        {
+          "command": "apt full-upgrade",
+          "description": "Aggiorna i pacchetti gestendo le dipendenze (interattivo)"
+        }
+      ]
+    },
+    {
+      "title": "Aggiornamenti Proxmox",
+      "commands": [
+        {
+          "command": "pveupdate",
+          "description": "Aggiorna elenchi pacchetti Proxmox"
+        },
+        {
+          "command": "pveupgrade",
+          "description": "Avvia l’aggiornamento interattivo dei pacchetti Proxmox"
+        },
+        {
+          "command": "pve8to9 --full",
+          "description": "Verifica la preparazione al passaggio da PVE 8 a 9, senza eseguire l’aggiornamento"
+        },
+        {
+          "command": "ceph versions",
+          "description": "Mostra le versioni dei demoni Ceph prima di pianificare un aggiornamento"
+        }
+      ]
+    },
+    {
+      "title": "Gestione dei pacchetti",
+      "commands": [
+        {
+          "command": "apt autoremove --purge",
+          "description": "Rimuovi i pacchetti non utilizzati e la loro configurazione"
+        },
+        {
+          "command": "apt clean",
+          "description": "Cancellare il repository locale di file di pacchetto recuperati"
+        },
+        {
+          "command": "apt autoclean",
+          "description": "Cancellare solo i file di pacchetto obsoleti"
+        },
+        {
+          "command": "apt install <package>",
+          "description": "Installare un pacchetto specifico"
+        },
+        {
+          "command": "apt remove <package>",
+          "description": "Rimuovi un pacchetto"
+        },
+        {
+          "command": "apt purge <package>",
+          "description": "Rimuovere un pacchetto e i suoi file di configurazione"
+        }
+      ]
+    },
+    {
+      "title": "Informazioni sul pacchetto",
+      "commands": [
+        {
+          "command": "apt list --installed",
+          "description": "Elenca tutti i pacchetti installati"
+        },
+        {
+          "command": "apt search <keyword>",
+          "description": "Ricerca di pacchetti per parola chiave"
+        },
+        {
+          "command": "apt show <package>",
+          "description": "Mostra informazioni dettagliate su un pacchetto"
+        },
+        {
+          "command": "dpkg -l",
+          "description": "Elenca tutti i pacchetti installati (alternativo)"
+        },
+        {
+          "command": "dpkg -l | grep <keyword>",
+          "description": "Cerca pacchetti installati per parola chiave"
+        },
+        {
+          "command": "apt-cache policy <package>",
+          "description": "Mostra le versioni e le priorità dei pacchetti"
+        }
+      ]
+    },
+    {
+      "title": "Gestione dei repository",
+      "commands": [
+        {
+          "command": "cat /etc/apt/sources.list",
+          "description": "Visualizza principali fonti di repository APT"
+        },
+        {
+          "command": "ls -la /etc/apt/sources.list.d/",
+          "description": "Elenca altri file sorgente repository"
+        },
+        {
+          "command": "cat /etc/apt/sources.list.d/pve-enterprise.list",
+          "description": "Mostra la configurazione del repository Proxmox Enterprise nel file .list di PVE 8"
+        },
+        {
+          "command": "apt-key list",
+          "description": "Elenca le vecchie chiavi di firma dei repository, se apt-key è disponibile"
+        }
+      ]
+    }
+  ],
+  "backupWarn": {
+    "title": "Crea un backup prima degli aggiornamenti principali",
+    "bodyRich": "Per gli aggiornamenti ordinari, Proxmox raccomanda <code>apt update &amp;&amp; apt full-upgrade</code>: controlla le modifiche ai pacchetti prima di confermare. Per gli <strong>aggiornamenti a una nuova versione principale</strong> (PVE 8 → 9), usa la procedura ProxMenux <upgradeLink>Aggiorna PVE 8 a PVE 9</upgradeLink>. Include controlli preliminari, migrazione dei repository e verifica finale. Crea prima un backup."
+  },
+  "related": {
+    "heading": "Correlati",
+    "items": [
+      {
+        "href": "/docs/utils/system-update",
+        "label": "Aggiornamento del sistema Proxmox (interattivo)",
+        "tail": "— wrapper che fa tutto questo con una finestra di dialogo di conferma, una ricostruzione automatica DKMS di driver gestiti da ProxMenux quando viene installato un nuovo kernel e un prompt di riavvio. Avviabile anche dal pulsante Update Now della dashboard ProxMenux Monitor."
+      },
+      {
+        "href": "/docs/utils/upgrade-pve8-pve9",
+        "label": "Aggiorna PVE 8 a PVE 9",
+        "tail": " — per gli aggiornamenti a una nuova versione principale."
+      },
+      {
+        "href": "/docs/help-info",
+        "label": "Panoramica degli aiuti e delle informazioni",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/it/docs/help-info/vm-ct-commands.json b/web/messages/it/docs/help-info/vm-ct-commands.json
new file mode 100644
index 00000000..7adf0986
--- /dev/null
+++ b/web/messages/it/docs/help-info/vm-ct-commands.json
@@ -0,0 +1,182 @@
+{
+  "meta": {
+    "title": "Comandi qm e pct di Proxmox — gestione di VM e container LXC | ProxMenux",
+    "description": "Comandi qm e pct di Proxmox VE per VM e container LXC: list, config, start, stop, shutdown, reboot, destroy, clone, migrate, snapshot, resize, oltre a pct exec / enter / push / pull per i container.",
+    "ogTitle": "Comandi qm e pct di Proxmox — gestione di VM e container LXC",
+    "ogDescription": "Riferimento dei comandi Proxmox VE qm e pct — gestire macchine virtuali e contenitori LXC dal CLI: avviare, arrestare, configurare, snapshot, migrare, clone, distruggere.",
+    "twitterTitle": "Comandi qm / pct di Proxmox | ProxMenux",
+    "twitterDescription": "Comandi qm / pct per la gestione di macchine virtuali e contenitori LXC in Proxmox VE."
+  },
+  "header": {
+    "title": "Gestione VM e CT",
+    "description": "Selezione di comandi qm per le VM e pct per i container LXC: elenchi, ciclo di vita (start / stop / shutdown / destroy), controllo della configurazione e operazioni sui container come exec, enter, push e pull.",
+    "section": "Aiuto e informazioni"
+  },
+  "intro": {
+    "title": "Trova prima un VMID o un CTID",
+    "body": "Quasi ogni comando ha bisogno di un ID numerico. Utilizzare <code>qm list</code> per VM e <code>pct list</code> per contenitori. Sostituisci <code>&lt;vmid&gt;</code> / <code>&lt;ctid&gt;</code> nei frammenti con l'ID effettivo prima di eseguire."
+  },
+  "commandGroups": [
+    {
+      "title": "Elenco e Informazioni",
+      "commands": [
+        {
+          "command": "qm list",
+          "description": "Elenca tutte le VM"
+        },
+        {
+          "command": "pct list",
+          "description": "Elenca tutti i container LXC"
+        },
+        {
+          "command": "qm config <vmid>",
+          "description": "Mostra la configurazione della VM interpretata da qm"
+        },
+        {
+          "command": "pct config <ctid>",
+          "description": "Mostra la configurazione del container interpretata da pct"
+        }
+      ]
+    },
+    {
+      "title": "File di configurazione (raw)",
+      "commands": [
+        {
+          "command": "cat /etc/pve/qemu-server/<vmid>.conf",
+          "description": "Visualizza file configurazione VM non elaborato"
+        },
+        {
+          "command": "cat /etc/pve/lxc/<ctid>.conf",
+          "description": "Visualizza file configurazione CT non elaborato"
+        },
+        {
+          "command": "nano /etc/pve/qemu-server/<vmid>.conf",
+          "description": "Modifica file di configurazione VM grezzo (nano)"
+        },
+        {
+          "command": "nano /etc/pve/lxc/<ctid>.conf",
+          "description": "Modifica file di configurazione CT grezzo (nano)"
+        },
+        {
+          "command": "vi /etc/pve/qemu-server/<vmid>.conf",
+          "description": "Modifica file di configurazione VM grezzo (vi)"
+        },
+        {
+          "command": "vi /etc/pve/lxc/<ctid>.conf",
+          "description": "Modifica file di configurazione CT grezzo (vi)"
+        }
+      ]
+    },
+    {
+      "title": "Gestione VM",
+      "commands": [
+        {
+          "command": "qm start <vmid>",
+          "description": "Avvia una VM. Usa il <vmid> corretto"
+        },
+        {
+          "command": "qm stop <vmid>",
+          "description": "Forza l'arresto di una macchina virtuale. Usa il <vmid> corretto"
+        },
+        {
+          "command": "qm shutdown <vmid>",
+          "description": "Spegni una macchina virtuale in modo ordinato"
+        },
+        {
+          "command": "qm reset <vmid>",
+          "description": "Reimpostare una macchina virtuale (hard reboot)"
+        },
+        {
+          "command": "qm suspend <vmid>",
+          "description": "Sospendere una macchina virtuale"
+        },
+        {
+          "command": "qm resume <vmid>",
+          "description": "Riprendi una macchina virtuale sospesa"
+        },
+        {
+          "command": "qm destroy <vmid>",
+          "description": "Elimina una VM (irreversibile). Usa il <vmid> corretto"
+        }
+      ]
+    },
+    {
+      "title": "Gestione del contenitore",
+      "commands": [
+        {
+          "command": "pct start <ctid>",
+          "description": "Avvia un container. Usa il <ctid> corretto"
+        },
+        {
+          "command": "pct stop <ctid>",
+          "description": "Forza l’arresto di un container. Usa il <ctid> corretto"
+        },
+        {
+          "command": "pct shutdown <ctid>",
+          "description": "Arresta un container in modo ordinato"
+        },
+        {
+          "command": "pct reboot <ctid>",
+          "description": "Riavviare un contenitore"
+        },
+        {
+          "command": "pct destroy <ctid>",
+          "description": "Elimina un CT (irreversibile). Usa il <ctid> corretto"
+        }
+      ]
+    },
+    {
+      "title": "Operazioni del contenitore",
+      "commands": [
+        {
+          "command": "pct exec <ctid> -- getent passwd | column -t -s :",
+          "description": "Mostra utenti CT in tabella"
+        },
+        {
+          "command": "pct exec <ctid> -- ps aux --sort=-%mem | head",
+          "description": "Processi CT con maggior consumo memoria"
+        },
+        {
+          "command": "pct enter <ctid>",
+          "description": "Entra nella shell del container"
+        },
+        {
+          "command": "pct push <ctid> <source> <dest>",
+          "description": "Copia file da host a container"
+        },
+        {
+          "command": "pct pull <ctid> <source> <dest>",
+          "description": "Copia file da contenitore per host"
+        }
+      ]
+    }
+  ],
+  "destroyWarn": {
+    "title": "La distruzione è irreversibile",
+    "bodyRich": "<code>qm destroy</code> e <code>pct destroy</code> rimuovono la configurazione del guest e i volumi disco gestiti. Non presumere che eliminino anche i dati esterni o montati tramite bind mount. La CLI non chiede conferma per impostazione predefinita. Salva prima i dati utili: <backupLink>Backup e ripristino</backupLink>."
+  },
+  "qmConfigTip": {
+    "title": "qm config e modifica diretta del file .conf",
+    "bodyRich": "<code>qm config &lt;vmid&gt;</code> e <code>pct config &lt;ctid&gt;</code> mostrano la configurazione tramite i parser di Proxmox. Per le modifiche ordinarie, preferisci <code>qm set</code> o il comando pct equivalente. Le modifiche dirette a <code>/etc/pve/qemu-server/&lt;vmid&gt;.conf</code> o <code>/etc/pve/lxc/&lt;ctid&gt;.conf</code> saltano convalida e blocchi dei comandi di gestione; il file deve restare interpretabile. Ferma il guest e conserva una copia prima delle riparazioni manuali. <code>pmxcfs</code> sincronizza le configurazioni tra nodi, non i dati dei dischi guest."
+  },
+  "related": {
+    "heading": "Correlati",
+    "items": [
+      {
+        "href": "/docs/help-info/backup-commands",
+        "label": "Backup e ripristino",
+        "tail": " — vzdump e qmrestore / pct restore."
+      },
+      {
+        "href": "/docs/help-info/storage-commands",
+        "label": "Archiviazione e dischi",
+        "tail": "— qm importdisk e gestione del disco."
+      },
+      {
+        "href": "/docs/help-info",
+        "label": "Panoramica degli aiuti e delle informazioni",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/it/docs/help-info/zfs-commands.json b/web/messages/it/docs/help-info/zfs-commands.json
new file mode 100644
index 00000000..d29fd247
--- /dev/null
+++ b/web/messages/it/docs/help-info/zfs-commands.json
@@ -0,0 +1,227 @@
+{
+  "meta": {
+    "title": "Comandi ZFS in Proxmox — zpool, zfs snapshot, send/receive, scrub | ProxMenux",
+    "description": "Comandi di gestione ZFS in Proxmox VE: zpool create / status / history, zfs list / get / set, snapshot, clone, zfs send e receive, scrub, clear, replace, zpool iostat e riepilogo ARC.",
+    "ogTitle": "Comandi ZFS in Proxmox — zpool, zfs snapshot, send/receive, scrub",
+    "ogDescription": "Riferimento dei comandi zpool e zfs su Proxmox VE — pool, dataset, snapshot, replica, manutenzione.",
+    "twitterTitle": "Comandi ZFS in Proxmox | ProxMenux",
+    "twitterDescription": "comandi zpool e zfs per Proxmox VE: pool, dataset, snapshot, replica, manutenzione."
+  },
+  "header": {
+    "title": "Gestione ZFS",
+    "description": "Selezione di comandi zpool e zfs: controllo dei pool, creazione, lettura, modifica ed eliminazione dei dataset, snapshot, clone e send/receive incrementale o ricorsivo, manutenzione con scrub / clear / replace, statistiche I/O e riepilogo ARC.",
+    "section": "Aiuto e informazioni"
+  },
+  "intro": {
+    "title": "Due famiglie di comando",
+    "body": "<code>zpool *</code> gestisce i pool di archiviazione (strato fisico — dischi, vdevs, ridondanza). <code>zfs *</code> gestisce i dataset e le istantanee che vivono all'interno di tali pool (strato logico — filesystems, volumi, snapshot, proprietà)."
+  },
+  "commandGroups": [
+    {
+      "title": "Informazioni sui pool",
+      "commands": [
+        {
+          "command": "zpool list",
+          "description": "Elenca tutti i pool ZFS"
+        },
+        {
+          "command": "zpool status",
+          "description": "Mostra lo stato e la salute del pool in dettaglio"
+        },
+        {
+          "command": "zpool status -v",
+          "description": "Mostra lo stato dettagliato del pool con gli errori"
+        },
+        {
+          "command": "zpool history",
+          "description": "Mostra cronologia dei comandi per tutti pools"
+        },
+        {
+          "command": "zpool history <pool>",
+          "description": "Mostra cronologia dei comandi per specifiche pool"
+        },
+        {
+          "command": "zpool get all <pool>",
+          "description": "Mostra tutte le proprietà di un pool"
+        }
+      ]
+    },
+    {
+      "title": "Gestione dei dataset",
+      "commands": [
+        {
+          "command": "zfs list",
+          "description": "Elenca tutti i set di dati ZFS"
+        },
+        {
+          "command": "zfs list -r <pool>",
+          "description": "Elenca tutti i set di dati in un pool ricorsivamente"
+        },
+        {
+          "command": "zfs create <pool>/<dataset>",
+          "description": "Crea un nuovo set di dati"
+        },
+        {
+          "command": "zfs destroy <pool>/<dataset>",
+          "description": "Distruggere un set di dati"
+        },
+        {
+          "command": "zfs rename <pool>/<dataset> <pool>/<new-name>",
+          "description": "Rinominare un set di dati"
+        },
+        {
+          "command": "zfs get all <pool>/<dataset>",
+          "description": "Mostra tutte le proprietà di un set di dati"
+        },
+        {
+          "command": "zfs set compression=on <pool>/<dataset>",
+          "description": "Abilitare la compressione su un set di dati"
+        }
+      ]
+    },
+    {
+      "title": "Gestione snapshot",
+      "commands": [
+        {
+          "command": "zfs list -t snapshot",
+          "description": "Elenca tutte le snapshot"
+        },
+        {
+          "command": "zfs list -t snapshot -r <pool>",
+          "description": "Elenca tutte le istantanee in un pool"
+        },
+        {
+          "command": "zfs snapshot <pool>/<dataset>@<snapshot-name>",
+          "description": "Creare una snapshot"
+        },
+        {
+          "command": "zfs destroy <pool>/<dataset>@<snapshot-name>",
+          "description": "Eliminare un'istantanea"
+        },
+        {
+          "command": "zfs rollback <pool>/<dataset>@<snapshot-name>",
+          "description": "Rollback a una snapshot"
+        },
+        {
+          "command": "zfs hold <tag> <pool>/<dataset>@<snapshot-name>",
+          "description": "Proteggi uno snapshot dall’eliminazione con un hold"
+        },
+        {
+          "command": "zfs release <tag> <pool>/<dataset>@<snapshot-name>",
+          "description": "Rimuovi la protezione hold da uno snapshot"
+        }
+      ]
+    },
+    {
+      "title": "Clone e Invia/Riceve",
+      "commands": [
+        {
+          "command": "zfs clone <pool>/<dataset>@<snapshot> <pool>/<clone-name>",
+          "description": "Creare un clone da una snapshot"
+        },
+        {
+          "command": "zfs send <pool>/<dataset>@<snapshot> > backup.zfs",
+          "description": "Invia una snapshot a un file"
+        },
+        {
+          "command": "zfs receive <pool>/<dataset> < backup.zfs",
+          "description": "Ricevi un'istantanea da un file"
+        },
+        {
+          "command": "zfs send -i <pool>/<dataset>@<snap1> <pool>/<dataset>@<snap2> > incr.zfs",
+          "description": "Invia istantanee incrementali"
+        },
+        {
+          "command": "zfs send -R <pool>/<dataset>@<snapshot> > full-recursive.zfs",
+          "description": "Invia istantanee ricorsive"
+        }
+      ]
+    },
+    {
+      "title": "Manutenzione e riparazione",
+      "commands": [
+        {
+          "command": "zpool scrub <pool>",
+          "description": "Avvia una verifica scrub del pool"
+        },
+        {
+          "command": "zpool scrub -s <pool>",
+          "description": "Interrompi lo scrub in corso"
+        },
+        {
+          "command": "zpool clear <pool>",
+          "description": "Azzera i contatori degli errori del pool"
+        },
+        {
+          "command": "zpool clear <pool> <device>",
+          "description": "Azzera gli errori di un dispositivo specifico"
+        },
+        {
+          "command": "zpool replace <pool> <old-device> <new-device>",
+          "description": "Sostituire un dispositivo fallito"
+        },
+        {
+          "command": "zpool offline <pool> <device>",
+          "description": "Prendere un dispositivo offline"
+        },
+        {
+          "command": "zpool online <pool> <device>",
+          "description": "Portare un dispositivo online"
+        }
+      ]
+    },
+    {
+      "title": "Performance e monitoraggio",
+      "commands": [
+        {
+          "command": "zpool iostat",
+          "description": "Mostra le statistiche I/O dei pool"
+        },
+        {
+          "command": "zpool iostat -v",
+          "description": "Visualizza statistiche dettagliate I/O"
+        },
+        {
+          "command": "zpool iostat 5",
+          "description": "Mostra statistiche I/O ogni 5 secondi"
+        },
+        {
+          "command": "arc_summary",
+          "description": "Mostra statistiche ARC (se installato)"
+        },
+        {
+          "command": "zfs get compressratio <pool>/<dataset>",
+          "description": "Mostra rapporto di compressione"
+        },
+        {
+          "command": "zfs get used,available,referenced <pool>/<dataset>",
+          "description": "Mostra l'uso dello spazio"
+        }
+      ]
+    }
+  ],
+  "bestPractices": {
+    "title": "Migliori pratiche operative",
+    "bodyRich": "Pianifica regolarmente <code>zpool scrub</code> per verificare le checksum e controlla i risultati. Mantieni spazio libero: l’effetto di un pool quasi pieno dipende dal carico e dalla struttura. Usa <code>zpool replace</code> per un dispositivo guasto e segui la procedura del relativo tipo di vdev. Detach + add non è una sostituzione equivalente e può cambiare la topologia o eliminare la ridondanza."
+  },
+  "related": {
+    "heading": "Correlati",
+    "items": [
+      {
+        "href": "/docs/help-info/storage-commands",
+        "label": "Archiviazione e dischi",
+        "tail": "— comandi generici block-device e LVM."
+      },
+      {
+        "href": "/docs/help-info/backup-commands",
+        "label": "Backup e ripristino",
+        "tail": " — vzdump, qmrestore."
+      },
+      {
+        "href": "/docs/help-info",
+        "label": "Panoramica degli aiuti e delle informazioni",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/it/docs/installation.json b/web/messages/it/docs/installation.json
new file mode 100644
index 00000000..84c3791b
--- /dev/null
+++ b/web/messages/it/docs/installation.json
@@ -0,0 +1,93 @@
+{
+  "meta": {
+    "title": "Installazione di ProxMenux | Documentazione ProxMenux",
+    "description": "Installa ProxMenux con un comando su host Proxmox VE 8 o successivi. Include cataloghi JSON già generati in otto lingue: inglese, spagnolo, francese, tedesco, italiano, portoghese, slovacco e svedese. Scegli la lingua durante l’installazione o cambiala in seguito nelle impostazioni. Il canale beta offre accesso anticipato alle nuove funzionalità.",
+    "ogTitle": "Installazione di ProxMenux | Documentazione ProxMenux",
+    "ogDescription": "Installare ProxMenux su Proxmox VE 8+ in un unico comando. Canali stabili e beta disponibili."
+  },
+  "header": {
+    "title": "Installazione di ProxMenux",
+    "description": "Un programma di installazione da avviare con una sola riga su qualsiasi host Proxmox VE 8 o successivo. Installa automaticamente le dipendenze, scarica gli script, configura il comando di avvio del menu e chiede la lingua alla prima esecuzione. Due canali: stabile (predefinito) e beta.",
+    "section": "Installazione"
+  },
+  "stable": {
+    "heading": "Installa",
+    "intro": "Esegui questo comando nel terminale del tuo host Proxmox:",
+    "code": "bash -c \"$(wget -qLO - https://raw.githubusercontent.com/MacRimi/ProxMenux/main/install_proxmenux.sh)\""
+  },
+  "during": {
+    "heading": "Durante l'installazione",
+    "intro": "ProxMenux installa automaticamente e configura le dipendenze di cui ha bisogno:",
+    "tablePackage": "Pacchetto",
+    "tablePurpose": "Funzione",
+    "rows": [
+      {
+        "package": "dialog",
+        "purpose": "Menu interattivi nel terminale"
+      },
+      {
+        "package": "curl",
+        "purpose": "Download e controlli di connettività"
+      },
+      {
+        "package": "jq",
+        "purpose": "Elaborazione JSON"
+      },
+      {
+        "package": "git",
+        "purpose": "Clonazione e aggiornamento dei repository"
+      }
+    ],
+    "outro": "L’installazione scarica anche gli script in <code>/usr/local/share/proxmenux/</code> e crea il comando di avvio <code>/usr/local/bin/menu</code>. Il pannello web <strong>ProxMenux Monitor</strong> viene registrato come servizio <code>proxmenux-monitor.service</code>.",
+    "imageAlt": "Installazione ProxMenux in corso"
+  },
+  "first": {
+    "heading": "Primo lancio",
+    "intro": "Una volta installato, eseguire:",
+    "code": "menu",
+    "outro": "ProxMenux si apre sul menu principale, da cui puoi avviare tutte le procedure documentate in questo sito. Su un host Proxmox appena installato, <postlink>Post-installazione</postlink> è un buon punto di partenza."
+  },
+  "beta": {
+    "heading": "Canale beta",
+    "calloutTitle": "Che cos’è il programma beta?",
+    "calloutBody": "Vuoi provare le novità prima dell’uscita ufficiale e contribuire alla versione finale? Il programma beta di ProxMenux offre accesso anticipato alle nuove funzionalità, incluse le ultime build di Monitor, dal ramo <code>develop</code>. Le versioni beta possono contenere bug o funzioni incomplete. I tuoi commenti aiutano a correggerli prima della versione stabile.",
+    "intro": "Installare la versione beta invece di quella stabile con:",
+    "code": "bash -c \"$(wget -qLO - https://raw.githubusercontent.com/MacRimi/ProxMenux/develop/install_proxmenux_beta.sh)\"",
+    "outro": "La beta è facoltativa: devi avviarne esplicitamente il programma di installazione. Quando esce una versione stabile, ProxMenux avvisa al successivo avvio di <code>menu</code> e propone il passaggio automatico. Per uscire prima dalla beta, scegli <betalink>Disattiva programma beta</betalink> nelle impostazioni."
+  },
+  "updating": {
+    "heading": "Aggiornamento",
+    "body": "ProxMenux gestisce i propri aggiornamenti. Se è disponibile una nuova versione, il successivo avvio di <code>menu</code> propone di installarla. Accettando, vengono sostituiti i file e la configurazione dello strumento nell’installazione esistente, senza download manuali. Il canale stabile riceve versioni stabili e la beta riceve versioni beta, con la proposta di passaggio descritta sopra. Il messaggio dipende da dove esegui <code>menu</code>: via SSH o dalla console Proxmox appare una finestra sì/no e, accettando, l’aggiornamento viene applicato subito. Nel terminale WebSocket di ProxMenux Monitor appare invece un messaggio informativo, perché il terminale verrebbe interrotto durante l’operazione. Il messaggio mostra l’installazione in una riga (<code>bash -c \"$(wget -qLO - https://raw.githubusercontent.com/MacRimi/ProxMenux/main/install_proxmenux.sh)\"</code> per il canale stabile, oppure l’URL equivalente di <code>install_proxmenux_beta.sh</code> per la beta), da eseguire via SSH o dalla console."
+  },
+  "uninstall": {
+    "heading": "Disinstallare",
+    "body": "Da ProxMenux: <strong>Impostazioni → Disinstalla ProxMenux</strong>. La disinstallazione rimuove gli script, il comando di avvio e il servizio Monitor, oltre alle dipendenze selezionate se richiesto. Ripristina <code>/root/.bashrc</code> e <code>/etc/motd</code> dalle copie create da Post-Install, se presenti (altrimenti rimuove la riga di ProxMenux dal MOTD). Procedura completa: <uninstalllink>Disinstallare ProxMenux</uninstalllink>."
+  },
+  "troubleshoot": {
+    "heading": "Risoluzione dei problemi",
+    "virustotalTitle": "VirusTotal contrassegna l'URL di installazione",
+    "virustotalBody": "Il risultato di 1/95 del motore <em>Chong Lua Dao</em>, riportato nella issue #162, è stato identificato dal manutentore come falso positivo. L’installazione si avvia con un comando che scarica ed esegue lo script (<code>bash -c \"$(wget -qLO - …)\"</code>) e può scaricare <code>jq</code> dalla sua release ufficiale su GitHub. Questo <em>comportamento</em> può attivare gli scanner euristici; il rapporto storico non costituisce una valutazione di ogni download futuro. Il codice dell’installazione è aperto e verificabile. Altri dettagli nella <issuelink>issue #162</issuelink>.",
+    "aptTitle": "L’installazione non riesce a causa di errori di apt",
+    "aptBody": "Di solito manca un repository Proxmox o è configurato male. L’installazione ottiene le dipendenze tramite apt, che non riesce a procedere se i repository sono configurati male. Può accadere su installazioni minime di Proxmox 8 non ancora aggiornate. Esegui prima <code>apt-get update</code> manualmente, correggi tutti gli errori e riavvia l’installazione.",
+    "menuTitle": "`menu: command not found` dopo l'installazione",
+    "menuBody": "Il comando di avvio si trova in <code>/usr/local/bin/menu</code>. Verificane la presenza con <code>ls -lh /usr/local/bin/menu</code>. Se manca, l’installazione si è interrotta: eseguila di nuovo. Se il file esiste ma il comando non viene trovato, PATH non include <code>/usr/local/bin</code>. Correggi PATH o esegui direttamente <code>/usr/local/bin/menu</code>.",
+    "stuckTitle": "L'installazione si blocca o non procede",
+    "stuckBody": "Se un’installazione, una reinstallazione o un aggiornamento si blocca per un problema di connessione, interrompi con <strong>Ctrl + C</strong> e riavvia manualmente l’installazione.",
+    "otherTitle": "Altri problemi",
+    "otherBody": "Consulta <issueslink>GitHub Issues</issueslink> per i problemi noti oppure apri una issue con i log pertinenti. Se usi la beta e il problema riguarda Monitor, includi l’output di <code>journalctl -u proxmenux-monitor -n 50</code>."
+  },
+  "next": {
+    "heading": "Come proseguire",
+    "postInstall": "<postlink>Script di post-installazione</postlink> — modifiche e protezione di un host Proxmox appena installato.",
+    "introduction": "<introlink>Introduzione</introlink> — panoramica completa delle funzionalità.",
+    "monitor": "<monitorlink>ProxMenux Monitor</monitorlink> — cruscotto web per l'host (auto-installato accanto al menu)."
+  },
+  "requirements": {
+    "heading": "Requisiti e buone pratiche",
+    "reqTitle": "Requisiti",
+    "reqBody": "Proxmox VE <strong>8.x o successivo</strong>. PVE 7 e le versioni precedenti non sono supportati. L’host deve poter accedere a Internet per scaricare script, dipendenze e l’AppImage di ProxMenux Monitor. Esegui l’installazione come <strong>root</strong> sull’host Proxmox.",
+    "inspectTitle": "Ispezionare sempre gli script che si esegue da internet",
+    "inspectReview": "<sourcelink>Esamina il codice sorgente dell’installazione</sourcelink> prima di eseguirla.",
+    "inspectCoc": "Tutti i collegamenti eseguibili rispettano il <coclink>codice di condotta di ProxMenux</coclink>."
+  }
+}
diff --git a/web/messages/it/docs/introduction.json b/web/messages/it/docs/introduction.json
new file mode 100644
index 00000000..024aeed4
--- /dev/null
+++ b/web/messages/it/docs/introduction.json
@@ -0,0 +1,206 @@
+{
+  "meta": {
+    "title": "ProxMenux — Gestione di Proxmox VE tramite menu | Open source",
+    "description": "Strumento open source per gestire Proxmox VE tramite menu. ProxMenux riunisce due componenti: una CLI/TUI per ottimizzazioni dopo l’installazione, VM e container LXC, passthrough di GPU e Coral TPU, dischi, archiviazione e rete; e una dashboard web ospitata sul proprio server, con monitoraggio proattivo, notifiche Telegram, Discord o e-mail, riformulazione tramite IA e API REST.",
+    "ogTitle": "ProxMenux — Gestione di Proxmox VE tramite menu",
+    "ogDescription": "CLI/TUI open source e dashboard web per Proxmox VE: configurazione dopo l’installazione, VM, GPU, dischi, rete, archiviazione e sicurezza. Monitor offre controlli sullo stato del sistema, notifiche, riformulazione tramite IA e API REST.",
+    "twitterTitle": "ProxMenux — Gestione di Proxmox VE tramite menu",
+    "twitterDescription": "CLI/TUI open source e dashboard web per Proxmox VE. Monitoraggio del sistema, notifiche, riformulazione tramite IA e API REST."
+  },
+  "header": {
+    "title": "Introduzione",
+    "description": "ProxMenux è uno strumento open source per Proxmox VE basato su menu. Il progetto comprende una CLI/TUI per le attività più comuni su host, VM, container, archiviazione, rete e sicurezza, e una dashboard web sul proprio server con monitoraggio proattivo, notifiche, riformulazione facoltativa tramite IA e API REST.",
+    "section": "Introduzione"
+  },
+  "hero": {
+    "tagline": "<strong>Un menu per ogni attività.</strong> Le operazioni che di solito richiedono una scheda del wiki, due discussioni sul forum e una sequenza di comandi da copiare diventano un’opzione numerata da avviare in pochi secondi.",
+    "audience": "Pensato per chi usa Proxmox <em>per la prima volta</em>, con impostazioni predefinite sicure e già selezionate, e per gli amministratori <em>esperti</em>, che possono svolgere le attività abituali con meno comandi. Gratuito e open source, con una comunità attiva su <github>GitHub</github>."
+  },
+  "twoProducts": {
+    "heading": "Due prodotti, un progetto",
+    "intro": "ProxMenux comprende due componenti nello stesso albero dei sorgenti. Il programma di installazione li distribuisce entrambi sull’host: Scripts offre l’interfaccia da terminale e Monitor la dashboard web:",
+    "scripts": {
+      "title": "ProxMenux Scripts",
+      "body": "La CLI/TUI originale, da avviare con <code>menu</code>. Nove aree coprono ottimizzazioni dopo l’installazione, VM e container LXC, passthrough di GPU e Coral TPU, dischi, archiviazione, rete, sicurezza e utilità, con una raccolta di comandi di riferimento. Funziona nei terminali locali, SSH e web."
+    },
+    "monitor": {
+      "title": "ProxMenux Monitor",
+      "body": "Dashboard web sul proprio server, distribuita come AppImage. Metriche dell’host in tempo reale, monitoraggio proattivo, notifiche, riformulazione facoltativa tramite IA con sei fornitori, terminale web integrato e API REST. Si attiva dal menu Scripts, in Impostazioni → ProxMenux Monitor."
+    },
+    "calloutTitle": "Cosa gestisce ProxMenux",
+    "calloutIntro": "Tre strati, tutti raggiungibili dallo stesso progetto:",
+    "layers": [
+      "<strong>L’host Proxmox</strong> — repository, pacchetti, rete, ZFS, Ceph, kernel e osservabilità.",
+      "<strong>Le macchine virtuali (VM)</strong> — creazione, passthrough GPU, importazione ed esportazione OVA/OVF e accesso diretto ai dischi.",
+      "<strong>I container LXC</strong> — creazione, punti di montaggio, passthrough GPU/TPU, client e server NFS/Samba."
+    ]
+  },
+  "scriptsSection": {
+    "heading": "ProxMenux Scripts — che cosa si ottiene",
+    "intro": "Nove aree funzionali, ognuna con il proprio sottomenu in <code>menu</code> e una pagina dedicata nella documentazione. Seleziona una scheda per aprire direttamente la panoramica della sezione.",
+    "items": [
+      {
+        "title": "Dopo l'installazione",
+        "description": "Ottimizzazioni per una nuova installazione di Proxmox: repository, kernel, sincronizzazione dell’ora, sicurezza di base e prestazioni, con opzioni reversibili.",
+        "icon": "Server",
+        "href": "/docs/post-install"
+      },
+      {
+        "title": "GPU e Coral TPU",
+        "description": "Passthrough di NVIDIA, iGPU Intel, AMD e Coral TPU a VM e container LXC, con cambio di modalità tra VM e LXC.",
+        "icon": "Cpu",
+        "href": "/docs/hardware/nvidia-host"
+      },
+      {
+        "title": "Creare VM",
+        "description": "Procedure guidate per sistemi NAS, Windows e Linux, con impostazioni predefinite ragionevoli per hardware, archiviazione e rete.",
+        "icon": "Server",
+        "href": "/docs/create-vm"
+      },
+      {
+        "title": "Gestione disco",
+        "description": "Accesso ai dischi fisici da VM e LXC, formattazione e cancellazione, test SMART e importazione di immagini qcow2, vmdk o vdi, tutto da un menu.",
+        "icon": "HardDrive",
+        "href": "/docs/disk-manager"
+      },
+      {
+        "title": "Archiviazione e condivisione",
+        "description": "Registrare in Proxmox archivi NFS, Samba/CIFS, iSCSI e locali; condividere cartelle tra host e container LXC tramite bind mount o protocolli di rete.",
+        "icon": "Boxes",
+        "href": "/docs/storage-share"
+      },
+      {
+        "title": "Rete",
+        "description": "Diagnostica senza modifiche, analisi con suggerimenti e riparazioni guidate di /etc/network/interfaces. Le modifiche sono precedute da una copia di sicurezza.",
+        "icon": "Network",
+        "href": "/docs/network"
+      },
+      {
+        "title": "Sicurezza",
+        "description": "Fail2Ban per prevenire intrusioni tramite SSH e interfacce web e Lynis per verificare il rafforzamento della sicurezza, con installazione e gestione tramite impostazioni predefinite ragionevoli.",
+        "icon": "Shield",
+        "href": "/docs/security"
+      },
+      {
+        "title": "Utilità",
+        "description": "Creare ISO Windows con UUP Dump, installare strumenti CLI, eseguire aggiornamenti guidati del sistema o passare da PVE 8 a 9 ed esportare e importare VM OVA/OVF.",
+        "icon": "Wrench",
+        "href": "/docs/utils"
+      },
+      {
+        "title": "Riferimento dei comandi",
+        "description": "Una raccolta di comandi Linux e Proxmox organizzata per argomento: sistema, VM/CT con qm e pct, archiviazione, rete, ZFS, passthrough GPU, backup e strumenti CLI di uso quotidiano.",
+        "icon": "BookOpen",
+        "href": "/docs/help-info"
+      }
+    ]
+  },
+  "monitorSection": {
+    "heading": "ProxMenux Monitor — che cosa si ottiene",
+    "intro": "La dashboard web è ospitata sull’host Proxmox, sulla porta TCP 8008. Seleziona una scheda per aprire la pagina della sezione, oppure leggi prima la <link>panoramica di Monitor</link>.",
+    "items": [
+      {
+        "title": "Monitoraggio dello stato del sistema",
+        "description": "Dieci categorie controllate ogni cinque minuti: CPU, memoria, archiviazione, dischi/SMART, rete, VM, servizi, log, aggiornamenti e sicurezza. Con livelli di gravità e possibilità di disattivare gli avvisi per categoria.",
+        "icon": "Activity",
+        "href": "/docs/monitor/health-monitor"
+      },
+      {
+        "title": "Notifiche",
+        "description": "Telegram, Discord, e-mail, Gotify, Pushover e Apprise multicanale, con eliminazione dei duplicati, intervallo minimo tra gli invii, raggruppamento degli avvisi ravvicinati, orari silenziosi e cronologia completa.",
+        "icon": "Bell",
+        "href": "/docs/monitor/notifications"
+      },
+      {
+        "title": "Assistente AI",
+        "description": "Riformulazione facoltativa delle notifiche in un linguaggio chiaro. Sei fornitori: OpenAI, Anthropic Claude, Google Gemini, Groq, OpenRouter e Ollama locale. Tredici lingue nel selettore della lingua dell’IA.",
+        "icon": "Sparkles",
+        "href": "/docs/monitor/ai-assistant"
+      },
+      {
+        "title": "Terminal Web",
+        "description": "Una shell interattiva sull’host Proxmox dal browser e un terminale ProxMenux Scripts separato che esegue il menu nell’interfaccia web.",
+        "icon": "Terminal",
+        "href": "/docs/monitor/dashboard/terminal"
+      },
+      {
+        "title": "REST API",
+        "description": "Endpoint HTTP per sistema, stato, archiviazione/SMART, rete, VM, notifiche e sicurezza, utili per Homepage, Home Assistant, Prometheus o script personalizzati.",
+        "icon": "Code2",
+        "href": "/docs/monitor/api"
+      },
+      {
+        "title": "Integrazioni",
+        "description": "Webhook nativo Proxmox VE, raccolta di metriche con Prometheus, sonde Uptime Kuma, widget Homepage, Home Assistant e Glance, flussi n8n/Zapier e Tailscale Secure Gateway.",
+        "icon": "Plug",
+        "href": "/docs/monitor/integrations"
+      }
+    ]
+  },
+  "installPaths": {
+    "heading": "Opzioni di installazione",
+    "intro": "Entrambi i programmi di installazione distribuiscono Scripts e Monitor. Scripts usa cataloghi JSON già preparati in otto lingue, senza traduzione online. Puoi scegliere il canale stabile o beta; Monitor è distribuito come AppImage ed eseguito dal suo ambiente estratto:",
+    "headerPath": "Install path",
+    "headerBundles": "Cosa include",
+    "headerWhen": "Quando sceglierla",
+    "rows": [
+      {
+        "pathRich": "<strong>Scripts: stabile</strong>",
+        "bundles": "CLI/TUI con traduzioni JSON già preparate in otto lingue, senza ambiente virtuale o servizio di traduzione online.",
+        "when": "Uso normale con il canale delle versioni stabili."
+      },
+      {
+        "pathRich": "<strong>Scripts: beta</strong>",
+        "bundles": "La stessa interfaccia multilingue, installata dal ramo develop per provare le modifiche in arrivo.",
+        "when": "Prove anticipate delle nuove funzioni, con un rischio maggiore di problemi."
+      },
+      {
+        "pathRich": "<strong>Monitor</strong>",
+        "bundles": "AppImage autonoma con dashboard web sulla porta TCP 8008. Il programma di installazione estrae l’ambiente di esecuzione e gestisce il servizio; Monitor si controlla dalle impostazioni.",
+        "when": "Quando serve una dashboard web per l’host, da telefono, tablet o browser."
+      }
+    ],
+    "outro": "I comandi e i requisiti dettagliati sono nella <link>pagina di installazione</link>."
+  },
+  "warnSource": {
+    "title": "Controlla sempre gli script da Internet prima di eseguirli",
+    "body": "ProxMenux è open source e puoi esaminare ogni script su GitHub. Controlla il codice sorgente prima di eseguire il comando di installazione, come per qualsiasi altro strumento di automazione.",
+    "sourceLabel": "Visualizza sorgente ProxMenux",
+    "cocLabel": "Codice di condotta"
+  },
+  "next": {
+    "heading": "Come proseguire",
+    "items": [
+      {
+        "lead": "<strong>È la prima volta che usi ProxMenux?</strong> ",
+        "linkHref": "/docs/installation",
+        "linkLabel": "Installalo con un solo comando",
+        "tailRich": " e avvia <code>menu</code>."
+      },
+      {
+        "lead": "<strong>Hai appena installato Proxmox?</strong> Inizia dallo ",
+        "linkHref": "/docs/post-install",
+        "linkLabel": "script di post-installazione",
+        "tail": "."
+      },
+      {
+        "lead": "<strong>Vuoi una dashboard web?</strong> ",
+        "linkHref": "/docs/monitor",
+        "linkLabel": "ProxMenux Monitor",
+        "tail": " ha una documentazione che spiega cosa mostra, come è realizzato e come proteggerlo."
+      },
+      {
+        "lead": "<strong>Cerchi un comando specifico?</strong> La ",
+        "linkHref": "/docs/help-info",
+        "linkLabel": "guida ai comandi",
+        "tail": " raccoglie una selezione organizzata per argomento, con pulsanti per copiare."
+      },
+      {
+        "lead": "<strong>Vuoi guide più dettagliate?</strong> La ",
+        "linkHref": "/guides",
+        "linkLabel": "sezione delle guide",
+        "tail": " tratta Coral TPU, passthrough NVIDIA, Kodi in LXC e altri argomenti."
+      }
+    ]
+  }
+}
diff --git a/web/messages/it/docs/network/backup-restore.json b/web/messages/it/docs/network/backup-restore.json
new file mode 100644
index 00000000..721be2b8
--- /dev/null
+++ b/web/messages/it/docs/network/backup-restore.json
@@ -0,0 +1,110 @@
+{
+  "meta": {
+    "title": "Backup e riavvio delle interfacce | Documentazione ProxMenux",
+    "description": "Crea istantanee manuali, sfoglia e ripristina i backup di /etc/network/interfaces salvati in /var/backups/proxmenux/. Include il riavvio del servizio di rete con conferma e una vista rapida della configurazione attuale.",
+    "ogTitle": "Backup e riavvio delle interfacce | Documentazione ProxMenux",
+    "ogDescription": "Crea un’istantanea e ripristina la configurazione di rete Proxmox; riavvia il servizio di rete con conferma."
+  },
+  "header": {
+    "title": "Backup e riavvio delle interfacce",
+    "description": "Quattro utility che ruotano intorno a /etc/network/interfaces: scattano un'istantanea manuale, visualizzano la configurazione live, ripristinano un backup precedente con un'anteprima facoltativa e riavviano il servizio di rete con esplicito consenso. Stessa directory di backup utilizzata dai flussi di riparazione guidati.",
+    "section": "Rete"
+  },
+  "intro": {
+    "title": "Cosa fa",
+    "body": "Gestisce la stessa directory di backup utilizzata dai flussi di riparazione guidati (<code>/var/backups/proxmenux/</code>). Consente di scattare un'istantanea aggiuntiva prima di qualsiasi cambiamento manuale, sfogliare tutti i backup esistenti e tornare a uno qualsiasi di essi — sempre con un backup pre-restore fresco preso automaticamente come una seconda rete di sicurezza."
+  },
+  "shared": {
+    "heading": "La directory di backup condivisa",
+    "intro": "Ogni backup preso ovunque nel menu di rete atterra nello stesso posto:",
+    "outro": "I nomi dei file contengono data e ora, sono ordinati per data e non vengono mai sovrascritti. La directory viene creata al primo utilizzo."
+  },
+  "show": {
+    "heading": "Mostra file di configurazione di rete",
+    "body": "Mostra il contenuto esatto di <code>/etc/network/interfaces</code> nel terminale. Sola lettura. Utile come controllo prima di un backup o dopo un ripristino. Non esiste uno strumento separato per confrontare il file con il backup precedente: esaminare il file attuale è quindi il modo più semplice per verificarne il contenuto."
+  },
+  "create": {
+    "heading": "Crea backup di rete",
+    "body": "Copia l'attuale <code>/etc/network/interfaces</code> nella directory di backup con un timestamp fresco. Questo è tutto — nessuna analisi, nessun prompt, solo un'istantanea.",
+    "whenTitle": "Quando creare un backup manuale",
+    "whenBody": "Prima di modificare <code>/etc/network/interfaces</code> a mano, di installare un pacchetto che può alterare lo stack di rete (ad esempio NetworkManager o Open vSwitch) o di cambiare l’hardware. Le riparazioni guidate creano già un’istantanea automaticamente: questa opzione serve per gli interventi <em>manuali</em>."
+  },
+  "restore": {
+    "heading": "Ripristina backup di rete",
+    "intro": "Elenca tutti i backup in <code>/var/backups/proxmenux/</code> dal più recente al più vecchio e guida un ripristino protetto:",
+    "steps": [
+      {
+        "title": "1. Scegli un backup",
+        "body": "Un menu elenca ogni backup dal suo timestamp. Se non esistono backup, il flusso esce con un messaggio chiaro.",
+        "tone": "blue"
+      },
+      {
+        "title": "2. Anteprima opzionale",
+        "body": "Propone di aprire il backup selezionato in una vista scorrevole prima di confermare il ripristino. Sì è l’opzione predefinita: non saltare questo passaggio su un host remoto.",
+        "tone": "blue"
+      },
+      {
+        "title": "3. Backup prima del ripristino",
+        "body": "Prima di sovrascrivere <code>/etc/network/interfaces</code>, crea <strong>un altro</strong> backup dello stato attuale. Il ripristino è esso stesso un’operazione distruttiva: la nuova istantanea precedente al ripristino permette di tornare indietro se il backup scelto era quello sbagliato.",
+        "tone": "amber"
+      },
+      {
+        "title": "4. Applicare il ripristino",
+        "body": "Copia il backup scelto su <code>/etc/network/interfaces</code>. La modifica del file è su disco; lo stato del kernel live riflette ancora la configurazione precedente.",
+        "tone": "amber"
+      },
+      {
+        "title": "5. Riavvio opzionale",
+        "body": "Chiede se eseguire <code>systemctl restart networking</code> ora. Rifiuta per rimandare l’applicazione al prossimo riavvio.",
+        "tone": "emerald"
+      }
+    ],
+    "autoBackupTitle": "Il ripristino crea automaticamente un proprio backup",
+    "autoBackupBody": "Selezionare <em>Ripristina backup di rete</em> crea sempre una nuova istantanea della configurazione <em>attuale</em> prima di sovrascriverla. Se ripristini il backup sbagliato, il file più recente in <code>/var/backups/proxmenux/</code> contiene lo stato precedente."
+  },
+  "restart": {
+    "heading": "Riavvia servizio di rete",
+    "body": "Esegue <code>systemctl restart networking</code> dopo una conferma sì/no. Mostra il risultato con <code>msg_ok</code> / <code>msg_error</code>. La maggior parte delle procedure di questo menu propone già un riavvio finale: questa opzione serve dopo una modifica manuale o se hai rifiutato il riavvio proposto in precedenza.",
+    "warnTitle": "Breve disconnessione garantita; possibile disconnessione permanente",
+    "warnBody": "Riavviare <code>networking</code> disattiva e riconfigura tutte le interfacce dichiarate in <code>/etc/network/interfaces</code>. Le sessioni SSH su queste interfacce si interrompono. Se la nuova configurazione non è valida, la rete non torna disponibile. Esegui questa operazione solo quando:",
+    "warnItems": [
+      "Hai un accesso alla console / IPMI / iKVM pronto, <em>oppure</em>",
+      "Sei fisicamente accanto alla macchina, <em>oppure</em>",
+      "Hai appena ripristinato con successo una configurazione sicuramente funzionante e vuoi applicarla."
+    ]
+  },
+  "manualRollback": {
+    "heading": "Ripristino manuale da una console",
+    "intro": "Se non riesci ad accedere al menu (SSH non disponibile, dialog che si arresta, …) ma puoi usare una console, il ripristino richiede due comandi:",
+    "outro": "È la <em>stessa</em> operazione eseguita dal menu, semplicemente digitata a mano. Se <code>networking</code> continua a non avviarsi, controlla <code>journalctl -u networking -b</code> per individuare l’errore di sintassi o del driver."
+  },
+  "troubleshoot": {
+    "heading": "Risoluzione dei problemi",
+    "noneTitle": "\"Nessun backup trovato\" in Ripristino",
+    "noneBody": "La directory <code>/var/backups/proxmenux/</code> non esiste o non contiene file <code>interfaces_backup_*</code>. Esegui <em>Crea backup di rete</em> almeno una volta oppure una riparazione guidata, che ne crea uno automaticamente. Verifica con <code>ls /var/backups/proxmenux/</code>.",
+    "unreachTitle": "Riavviare la rete riesce, ma l'host è ancora irraggiungibile",
+    "unreachBody": "La nuova configurazione è errata oppure non assegna il tuo IP di gestione. Ripristina la configurazione dalla console (vedi sopra). Poi usa <bridgeLink>l’analisi dei bridge</bridgeLink> e <configLink>l’analisi della configurazione</configLink> per capire il problema prima di applicarla nuovamente.",
+    "emptyTitle": "L'anteprima del ripristino mostra un file vuoto",
+    "emptyBody": "Il file di backup è vuoto (0 byte). Succede se una copia è fallita senza segnalazioni in un’esecuzione precedente. Scegli un backup più vecchio oppure esegui di nuovo <em>Crea backup di rete</em> adesso, se la configurazione attuale funziona."
+  },
+  "related": {
+    "heading": "Correlati",
+    "items": [
+      {
+        "label": "Analisi dei bridge e riparazione guidata",
+        "href": "/docs/network/bridge-analysis",
+        "tail": "— il motivo più comune per cui un backup finisce qui."
+      },
+      {
+        "label": "Analisi della configurazione e pulizia guidata",
+        "href": "/docs/network/config-analysis",
+        "tailRich": "— scrive anche a <code>/var/backups/proxmenux/</code> automaticamente."
+      },
+      {
+        "label": "Diagnostica",
+        "href": "/docs/network/diagnostics",
+        "tail": " — per verificare lo stato attuale dopo un ripristino."
+      }
+    ]
+  }
+}
diff --git a/web/messages/it/docs/network/bridge-analysis.json b/web/messages/it/docs/network/bridge-analysis.json
new file mode 100644
index 00000000..23bf0ee1
--- /dev/null
+++ b/web/messages/it/docs/network/bridge-analysis.json
@@ -0,0 +1,132 @@
+{
+  "meta": {
+    "title": "Analisi dei bridge e riparazione guidata | Documentazione ProxMenux",
+    "description": "Rileva bridge vmbrX con porte fisiche mancanti o non valide, tipicamente dopo la rinumerazione PCI. Li segnala con comandi shell proposti e offre una riparazione guidata in 5 passaggi con backup obbligatorio.",
+    "ogTitle": "Analisi dei bridge e riparazione guidata | Documentazione ProxMenux",
+    "ogDescription": "Controlla e ripara le porte dei bridge Proxmox dopo modifiche hardware, con una procedura guidata che consente un ripristino sicuro."
+  },
+  "header": {
+    "title": "Analisi dei bridge e riparazione guidata",
+    "description": "Controlla ogni bridge vmbrX dichiarato in /etc/network/interfaces, verifica che le porte fisiche esistano e propone una riparazione passo passo se mancano. L’analisi è di sola lettura; la riparazione richiede conferma, mostra un’anteprima e crea un backup.",
+    "section": "Rete"
+  },
+  "intro": {
+    "title": "Cosa fa",
+    "body": "Legge ogni bridge in <code>/etc/network/interfaces</code>, esamina la riga <code>bridge-ports</code> e verifica che ogni porta dichiarata, ad esempio <code>enp3s0</code>, esista sull’host. Se una porta manca, propone una sostituzione e, con consenso esplicito, applica la modifica seguendo la procedura <strong>backup, anteprima, applicazione, verifica</strong>."
+  },
+  "when": {
+    "heading": "Quando hai bisogno di questo",
+    "intro": "Linux assegna nomi prevedibili alle interfacce in base alla topologia PCI e all’ordine degli slot. Diversi eventi possono modificarli, lasciando in <code>/etc/network/interfaces</code> riferimenti a nomi non più esistenti:",
+    "items": [
+      "Aggiungere o rimuovere una scheda PCIe (scheda di rete, GPU, HBA o adattatore NVMe).",
+      "Spostare una scheda esistente in un'altra slot PCIe.",
+      "Aggiornamenti BIOS / UEFI che rinumerano i dispositivi PCI.",
+      "Migrare il disco di avvio su hardware diverso."
+    ],
+    "outro": "Dopo il prossimo avvio, il ponte cerca di attaccare a una porta che non esiste più, non riesce a salire, e l'host perde la sua rete. <link>Nomi di interfaccia persistenti</link> impedisce che questo accada di nuovo — ma se sei già bloccato fuori, questa pagina è il percorso di recupero."
+  },
+  "bigPicture": {
+    "heading": "Quadro generale",
+    "diagram1": {
+      "arrowLabel": "passo 1",
+      "nodes": {
+        "sourceLabel": "/etc/network/interfaces",
+        "sourceDetail": "auto vmbr0\niface vmbr0 inet static\n  bridge-ports enp3s0",
+        "bridgeLabel": "Analizzare (solo lettura)",
+        "bridgeDetail": "ip link show enp3s0\n→ non esiste",
+        "targetLabel": "Report + suggerimento",
+        "targetDetail": "❌ enp3s0: NON TROVATA\nSostituisci con: eno1\n(ancora nessuna modifica)"
+      }
+    },
+    "diagram2": {
+      "arrowLabel": "applicare con il backup",
+      "nodes": {
+        "sourceLabel": "Riparazione guidata",
+        "sourceDetail": "1. Backup\n2. Mostra configurazione attuale\n3. Anteprima delle modifiche\n4. Applica\n5. Verifica",
+        "targetLabel": "/etc/network/interfaces (nuovo)",
+        "targetDetail": "auto vmbr0\niface vmbr0 inet static\n  bridge-ports eno1"
+      }
+    }
+  },
+  "step1": {
+    "heading": "Passo 1: analisi (solo lettura)",
+    "intro": "Selezionando <strong>Analizza configurazione dei bridge</strong>, lo strumento si interrompe se l’host non usa lo stack classico Debian/Proxmox. Altrimenti esamina ogni bridge e mostra:",
+    "items": [
+      "Nome del ponte, stato corrente (UP / DOWN), IP assegnato.",
+      "Ogni porta dichiarata e la sua effettiva presenza (<code>ip link show &lt;port&gt;</code>).",
+      "Per ogni porta non valida: una sostituzione proposta (la prima interfaccia fisica disponibile) più il comando esatto <code>sed</code> per applicarla manualmente.",
+      "Bridge senza alcuna riga <code>bridge-ports</code> e voci <code>auto</code> orfane senza un blocco <code>iface</code> corrispondente."
+    ],
+    "readonlyTitle": "Garanzia di sola lettura",
+    "readonlyBody": "Fino a questo punto lo script non ha eseguito un singolo comando di modifica. È possibile lasciare l'analisi aperta, copiare i comandi <code>sed</code> suggeriti e applicarli manualmente se si preferisce — o accettare il prompt successivo per inserire la riparazione guidata."
+  },
+  "step2": {
+    "heading": "Passo 2: riparazione guidata (5 passi)",
+    "intro": "Solo se accetti il prompt alla fine dell'analisi. Ogni passo mostra cosa accadrà e chiederà la conferma prima di continuare.",
+    "steps": [
+      {
+        "title": "1. Backup di sicurezza",
+        "body": "Copia <code>/etc/network/interfaces</code> in <code>/var/backups/proxmenux/interfaces_backup_&lt;TIMESTAMP&gt;</code>. Il percorso esatto del backup viene mostrato prima e dopo la copia, insieme al comando di ripristino.",
+        "tone": "blue"
+      },
+      {
+        "title": "2. Controlla la configurazione attuale",
+        "body": "Apre l’attuale <code>/etc/network/interfaces</code> in una finestra scorrevole per vedere esattamente cosa verrà modificato.",
+        "tone": "blue"
+      },
+      {
+        "title": "3. Anteprima delle modifiche proposte",
+        "body": "Elenca esattamente i bridge interessati e le sostituzioni delle porte previste. Se non serve più alcuna riparazione perché la porta è ricomparsa tra i controlli, la procedura termina con <em>«Nessuna modifica necessaria.»</em>",
+        "tone": "blue"
+      },
+      {
+        "title": "4. Applicare le modifiche",
+        "body": "Per ogni ponte interessato, viene eseguito <code>sed -i \"/iface $bridge/,/bridge-ports/ s/bridge-ports.*/bridge-ports $new_ports/\"</code> contro <code>/etc/network/interfaces</code>. Se un ponte non ha una sostituzione valida disponibile, la sostituzione è saltata e riportata nella fase 5.",
+        "tone": "amber"
+      },
+      {
+        "title": "5. Verifica",
+        "body": "Rilegge il file e verifica che la nuova porta di ogni bridge esista. Mostra il comando di ripristino (<code>cp &lt;backup&gt; /etc/network/interfaces</code>). Infine propone <strong>Riavvia la rete</strong>: accetta solo se hai un accesso di riserva alla console.",
+        "tone": "emerald"
+      }
+    ],
+    "restartTitle": "Riavviare la rete ≠ annullare senza rischi",
+    "restartBody": "La riparazione viene scritta su disco anche se non riavvii il servizio. <code>systemctl restart networking</code> applica la modifica <em>ora</em> e può interrompere la sessione SSH se la nuova porta è errata. Se rifiuti, la modifica avrà comunque effetto al prossimo avvio: verifica prima la configurazione oppure annulla con il comando mostrato."
+  },
+  "edits": {
+    "heading": "Cosa viene modificato (esattamente)",
+    "body": "Solo la riga <code>bridge-ports</code> di ogni bridge interessato. Le altre direttive (<code>address</code>, <code>netmask</code>, <code>gateway</code>, <code>bridge-stp</code>, …) restano invariate. In questa procedura lo script non crea né rimuove blocchi <code>iface</code>: se ne occupa <link>Analisi della configurazione &amp; pulizia</link>."
+  },
+  "troubleshoot": {
+    "heading": "Risoluzione dei problemi",
+    "unsupportedTitle": "L’analisi si interrompe con «Stack di rete non supportato»",
+    "unsupportedBody": "L'host esegue netplan, systemd-networkd o NetworkManager. Lo strumento supporta solo <code>/etc/network/interfaces</code>. Passare l'host al classico stack prima, o modificare la configurazione con il tooling nativo del manager (ad es. <code>netplan apply</code>).",
+    "noSuggestTitle": "Non viene mostrato alcun suggerimento per una porta non valida",
+    "noSuggestBody": "L’host non ha interfacce fisiche libere: sono già tutte in un altro bridge oppure non esistono. L’analisi suggerisce come alternativa <code>bridge-ports none</code>, così il bridge può almeno attivarsi senza una porta. Aggiungi una scheda di rete o sposta manualmente le porte tra i bridge prima di riprovare.",
+    "stillDownTitle": "La riparazione completa ma il ponte è ancora DOWN",
+    "stillDownBody": "<code>sed</code> ha aggiornato il file, ma <code>systemctl restart networking</code> è stato rifiutato. Eseguilo manualmente dopo aver verificato la nuova configurazione oppure riavvia. Se il riavvio è stato accettato e il bridge è ancora DOWN, esegui <code>ip link show</code> per verificare che la nuova porta esista e controlla <code>journalctl -u networking</code> per l’errore effettivo: cavo scollegato, collegamento non negoziato o porta già appartenente a un altro bridge.",
+    "lostSshTitle": "Ho perso l'accesso SSH subito dopo il riavvio della rete",
+    "lostSshIntro": "Utilizzare la console / IPMI / iKVM per raggiungere l'host. Ripristinare il backup:",
+    "lostSshOutro": "Esegui poi di nuovo l’analisi dalla console per capire perché il suggerimento non ha funzionato, in genere perché la porta sostitutiva non è collegata."
+  },
+  "related": {
+    "heading": "Correlati",
+    "items": [
+      {
+        "label": "Nomi di interfaccia persistenti",
+        "href": "/docs/network/persistent-names",
+        "tail": " — associa i nomi agli indirizzi MAC per evitare che il problema si ripeta."
+      },
+      {
+        "label": "Analisi della configurazione e pulizia guidata",
+        "href": "/docs/network/config-analysis",
+        "tailRich": "— per i blocchi <code>iface</code> orfani (l'altra metà dello stesso problema)."
+      },
+      {
+        "label": "Backup e riavvio delle interfacce",
+        "href": "/docs/network/backup-restore",
+        "tail": "— snapshot manuali e browser di ripristino."
+      }
+    ]
+  }
+}
diff --git a/web/messages/it/docs/network/config-analysis.json b/web/messages/it/docs/network/config-analysis.json
new file mode 100644
index 00000000..42961b94
--- /dev/null
+++ b/web/messages/it/docs/network/config-analysis.json
@@ -0,0 +1,122 @@
+{
+  "meta": {
+    "title": "Analisi della configurazione e pulizia guidata | Documentazione ProxMenux",
+    "description": "Rileva i blocchi iface in /etc/network/interfaces che fanno riferimento a schede di rete fisiche non più presenti sull’host. Li segnala e offre una rimozione guidata in 5 passaggi con backup obbligatorio e anteprima di ogni blocco.",
+    "ogTitle": "Analisi della configurazione e pulizia guidata | Documentazione ProxMenux",
+    "ogDescription": "Trovare e rimuovere i blocchi di interfaccia orfano lasciati dietro da modifiche hardware, con anteprima completa e rollback."
+  },
+  "header": {
+    "title": "Analisi della configurazione e pulizia guidata",
+    "description": "Esamina ogni blocco iface in /etc/network/interfaces e verifica che la scheda di rete fisica corrispondente esista ancora. Segnala i blocchi orfani rimasti dopo modifiche hardware e offre una rimozione guidata con backup, anteprima e conferma per ogni blocco.",
+    "section": "Rete"
+  },
+  "intro": {
+    "title": "Cosa fa",
+    "body": "Identifica le dichiarazioni <code>iface</code> il cui supporto NIC non è più presente sull'host (tipico dopo aver sostituito o rimosso una scheda di rete). Poi offre una pulizia guidata che rimuove <em>solo</em> i blocchi orfani, con un backup, un'anteprima per sezione e una conferma finale esplicita."
+  },
+  "differs": {
+    "heading": "Come differisce dall'analisi del ponte",
+    "headerAspect": "Aspetto",
+    "headerBridge": "Analisi del ponte",
+    "headerConfig": "Analisi della configurazione",
+    "rows": [
+      {
+        "aspect": "Esamina",
+        "bridge": "Ponti (<code>vmbrX</code>) e la loro linea <code>bridge-ports</code>",
+        "config": "Ogni blocco <code>iface</code>, esclusi loopback, bridge e bond"
+      },
+      {
+        "aspect": "Rilevamento",
+        "bridge": "Bridge che fanno riferimento a una porta inesistente",
+        "config": "Blocchi di interfaccia standalone per NIC che non esistono"
+      },
+      {
+        "aspect": "Azione di riparazione",
+        "bridge": "Sostituisce il nome della porta in <code>bridge-ports</code>",
+        "config": "Rimuove l'intero blocco <code>iface</code>"
+      },
+      {
+        "aspect": "Esclusi",
+        "bridge": "Nulla — ogni ponte viene analizzato",
+        "config": "Bridge (<code>vmbrX</code>) e bond (<code>bondX</code>) vengono sempre mantenuti: sono virtuali e la loro assenza durante l’avvio può essere normale"
+      }
+    ],
+    "outro": "In pratica si usano spesso entrambi in quest’ordine: prima <strong>analisi della configurazione</strong> per rimuovere i blocchi orfani, poi <link>analisi dei bridge</link> per riassegnare i bridge che dipendevano dall’interfaccia rimossa."
+  },
+  "step1": {
+    "heading": "Passo 1: analisi (solo lettura)",
+    "intro": "Interrompe immediatamente se l'host non è sulla pila classica. Altrimenti elenca ogni interfaccia non-loopback configurata e segnala il suo stato:",
+    "virtTitle": "Le interfacce virtuali sono protette",
+    "virtBody": "Bridge (<code>vmbrX</code>) e bond (<code>bondX</code>) sono strutture virtuali. È possibile che non esistano al momento dell’ispezione, ad esempio un bridge ancora senza porte. L’analisi non propone mai di rimuoverli, ma solo le schede di rete fisiche."
+  },
+  "step2": {
+    "heading": "Passo 2: pulizia guidata (5 passi)",
+    "intro": "Solo se accetti il prompt alla fine dell'analisi. Ogni passo richiede la conferma; la cancellazione in qualsiasi punto esce senza scrivere.",
+    "steps": [
+      {
+        "title": "1. Backup di sicurezza",
+        "body": "Copia <code>/etc/network/interfaces</code> in <code>/var/backups/proxmenux/interfaces_backup_&lt;TIMESTAMP&gt;</code>. Il percorso viene mostrato prima e dopo.",
+        "tone": "blue"
+      },
+      {
+        "title": "2. Confermare la lista di rimozione",
+        "body": "Elenca esattamente i blocchi delle interfacce fisiche da rimuovere. Se le schede di rete riappaiono tra analisi e pulizia, ad esempio dopo aver reinserito una scheda, la procedura termina con <em>«Nessuna pulizia necessaria.»</em>",
+        "tone": "blue"
+      },
+      {
+        "title": "3. Visualizza in anteprima i blocchi esatti",
+        "body": "Apre una vista scorrevole di ogni blocco <code>iface</code> che verrebbe eliminato, esattamente come appare nel file. È il momento di individuare, ad esempio, un hook <code>up</code> che vuoi conservare.",
+        "tone": "blue"
+      },
+      {
+        "title": "4. Applicare la rimozione",
+        "body": "Per ogni interfaccia orfano, funziona <code>sed -i \"/^iface $iface/,/^$/d\" /etc/network/interfaces</code>. Questo elimina dalla linea <code>iface</code> corrispondente fino alla riga vuota successiva.",
+        "tone": "amber"
+      },
+      {
+        "title": "5. Verifica",
+        "body": "Rilegge il file, elenca ciò che è stato rimosso e ricontrolla le restanti interfacce. Stampa il comando di rollback. <strong>non</strong> riavvia automaticamente la rete: la rimozione di un blocco inutilizzato è sicura da applicare al riavvio successivo ed evita di toccare lo stato live.",
+        "tone": "emerald"
+      }
+    ],
+    "noRestartTitle": "Non riavvia automaticamente la rete",
+    "noRestartBody": "A differenza della riparazione del ponte, il flusso di pulizia non offre di riavviare il servizio. Rimuovere un blocco di interfaccia non utilizzato non ha alcun effetto immediato sulla configurazione in esecuzione, quindi un riavvio è inutile e sarebbe un rischio di connettività inutile. La modifica ha effetto sul successivo manuale <code>systemctl restart networking</code> o al successivo riavvio."
+  },
+  "caveats": {
+    "heading": "Osservazioni importanti",
+    "boundaryTitle": "Il confine del blocco è la prima linea vuota",
+    "boundaryBody": "Il pattern <code>sed</code> elimina da <code>iface &lt;name&gt;</code> fino alla riga vuota successiva. Se in <code>/etc/network/interfaces</code> manca una riga vuota tra i blocchi, cosa rara ma possibile dopo modifiche manuali, può essere eliminato anche il blocco successivo. Per questo <strong>il passaggio 3 è obbligatorio</strong>: controlla l’anteprima prima di confermare.",
+    "tandemTitle": "Un blocco iface orfano usato da un bridge viene rilevato qui, non nell’analisi dei bridge",
+    "tandemBody": "Se <code>vmbr0</code> dichiara <code>bridge-ports enp3s0</code> e <code>enp3s0</code> ha anche un blocco <code>iface enp3s0 inet manual</code>, rimuovere <code>enp3s0</code> qui lascia un riferimento non valido in <code>vmbr0</code>. Dopo la pulizia, esegui <link>l’analisi dei bridge</link> per riassegnare o rimuovere la porta del bridge. Le due procedure sono pensate per essere usate insieme."
+  },
+  "troubleshoot": {
+    "heading": "Risoluzione dei problemi",
+    "notFoundTitle": "L’analisi indica «NON TROVATA» per la mia nuova scheda di rete",
+    "notFoundBody": "Il kernel vede il dispositivo con un nome diverso da quello nel file. Esegui <code>ip link show</code> per trovare il nome effettivo. È proprio il caso in cui i <link>nomi persistenti delle interfacce</link> eviterebbero il problema in futuro.",
+    "tooMuchTitle": "La pulizia ha rimosso troppo (un blocco che volevo mantenere)",
+    "tooMuchBody": "Ripristino dal backup stampato nella fase 5:",
+    "tooMuchOutro": "Modificare il file a mano per aggiungere una linea vuota chiara tra i blocchi prima di eseguire la pulizia, o rimuovere il blocco problematico manualmente.",
+    "bridgeBreakTitle": "Un ponte smette di funzionare dopo la pulizia",
+    "bridgeBreakBody": "Il bridge dipendeva da una porta il cui blocco <code>iface</code> è stato appena rimosso. Esegui <link>l’analisi dei bridge</link>: il suggerimento assegnerà al bridge un’interfaccia fisica esistente."
+  },
+  "related": {
+    "heading": "Correlati",
+    "items": [
+      {
+        "label": "Analisi dei bridge e riparazione guidata",
+        "href": "/docs/network/bridge-analysis",
+        "tail": "— il follow-up naturale dopo una pulizia."
+      },
+      {
+        "label": "Nomi di interfaccia persistenti",
+        "href": "/docs/network/persistent-names",
+        "tail": "— blocca i blocchi orfani dall'accumulo dopo ogni cambio hardware."
+      },
+      {
+        "label": "Backup e riavvio delle interfacce",
+        "href": "/docs/network/backup-restore",
+        "tail": "— snapshot manuali e browser di ripristino."
+      }
+    ]
+  }
+}
diff --git a/web/messages/it/docs/network/diagnostics.json b/web/messages/it/docs/network/diagnostics.json
new file mode 100644
index 00000000..9d5f54e0
--- /dev/null
+++ b/web/messages/it/docs/network/diagnostics.json
@@ -0,0 +1,94 @@
+{
+  "meta": {
+    "title": "Diagnostica | Documentazione ProxMenux",
+    "description": "Tre controlli diagnostici puntuali di sola lettura: Mostra tabella di routing, Test di connettività e Diagnostica avanzata. Semplice ispezione: non scrive mai in /etc/network/interfaces e non esegue comandi di modifica, con un’unica eccezione esplicita: la rimozione completa di NetworkManager, se rilevato, richiede il tuo consenso.",
+    "ogTitle": "Diagnostica | Documentazione ProxMenux",
+    "ogDescription": "Diagnostica di rete di sola lettura per l'host Proxmox: routing, raggiungibilità, statistiche avanzate."
+  },
+  "header": {
+    "title": "Diagnostica",
+    "description": "Tre controlli puntuali di sola lettura dello stato attuale della rete: tabella di routing, test di connettività e statistiche avanzate. Nessuno scrive in /etc/network/interfaces: sono utilizzabili in sicurezza in qualsiasi momento, anche via SSH. Per il monitoraggio interattivo in tempo reale, vedi Strumenti di monitoraggio in tempo reale.",
+    "section": "Rete"
+  },
+  "intro": {
+    "title": "Cosa fa",
+    "body": "Mostra informazioni su routing, raggiungibilità e statistiche aggregate <strong>senza modificare nulla</strong>. Usalo per verificare che la rete funzioni o individuare IP duplicati. Per osservare il traffico in modo continuo, vedi <monitoringLink>Strumenti di monitoraggio in tempo reale</monitoringLink>; per visualizzare il file di configurazione grezzo, vedi <backupLink>Backup e riavvio delle interfacce</backupLink>."
+  },
+  "routing": {
+    "heading": "Mostra tabella di routing",
+    "body": "Elenca tutte le rotte attualmente usate dal kernel (<code>ip route show</code>) ed evidenzia il gateway predefinito. Utile per verificare che il traffico verso Internet esca dall’interfaccia prevista e che nessuna vecchia rotta abbia la precedenza."
+  },
+  "connectivity": {
+    "heading": "Test connettività",
+    "intro": "Invia due sonde ICMP a tre obiettivi in sequenza e segnala ciascuno. Poi viene eseguito un <code>nslookup google.com</code> per verificare la risoluzione DNS indipendentemente da ICMP.",
+    "headerTest": "Test",
+    "headerTarget": "Destinazione",
+    "headerConfirms": "Cosa conferma",
+    "rows": [
+      {
+        "test": "DNS Google",
+        "target": "8.8.8.8",
+        "confirms": "Raggiungibilità esterna tramite un indirizzo IP anycast noto"
+      },
+      {
+        "test": "Cloudflare DNS",
+        "target": "1.1.1.1",
+        "confirms": "Seconda opzione indipendente se Google blocca ICMP"
+      },
+      {
+        "test": "Gateway",
+        "target": "(percorso di default)",
+        "confirms": "Connettività L2 / L3 al router locale"
+      },
+      {
+        "test": "Risoluzione DNS",
+        "target": "google.com",
+        "confirms": "Il server DNS è raggiungibile e risponde"
+      }
+    ],
+    "readingTitle": "Leggere il risultato",
+    "readingBody": "Se il test del gateway riesce ma i server DNS pubblici non rispondono, la connettività locale funziona ma non hai accesso a Internet: controlla la connessione a monte del gateway. Se la risoluzione DNS fallisce ma i ping verso <code>8.8.8.8</code> riescono, il problema è il resolver, non la rete: controlla <code>/etc/resolv.conf</code>."
+  },
+  "advanced": {
+    "heading": "Diagnostica avanzata",
+    "intro": "Aggrega le statistiche dell’intera rete ed esegue una serie di controlli sui problemi comuni. Mostra il numero di connessioni attive, le porte in ascolto e il totale delle interfacce, e segnala esplicitamente due configurazioni problematiche:",
+    "items": [
+      "<strong>NetworkManager in esecuzione su un host Proxmox.</strong> NetworkManager e <code>ifupdown</code> di Proxmox entrano in conflitto: entrambi tentano di gestire le interfacce, rendendo i bridge instabili o impedendone l’attivazione. Se viene rilevato, lo strumento propone una conferma interattiva per arrestarlo, disabilitarlo e rimuoverlo completamente (è l’<em>unica</em> diagnostica che può modificare il sistema, e solo dopo un consenso esplicito).",
+      "<strong>Indirizzi IP duplicati su interfacce diverse.</strong> Due interfacce con lo stesso indirizzo IPv4 causano problemi di connettività intermittenti molto difficili da diagnosticare dall’interno della VM. Rilevamento tramite <code>ip -4 addr show | sort | uniq -d</code>."
+    ],
+    "nmTitle": "Il prompt NetworkManager è l'unica azione di modifica qui",
+    "nmBody": "Tutti gli altri controlli della diagnostica avanzata sono di sola lettura. La rimozione di NetworkManager richiede una conferma sì/no ed esegue <code>systemctl stop / disable</code> + <code>apt-get purge -y network-manager</code>. Se rifiuti, non cambia nulla."
+  },
+  "troubleshoot": {
+    "heading": "Risoluzione dei problemi",
+    "gwTitle": "Il test di connettività segnala un errore del gateway, ma l’host ha accesso a Internet",
+    "gwBody": "Alcuni router non rispondono a ICMP sulla loro interfaccia interna anche se inoltrano correttamente il traffico. Prova <code>traceroute 8.8.8.8</code> da una console: se il secondo hop è il tuo ISP e il test del DNS pubblico è riuscito, il gateway funziona nonostante il ping fallito.",
+    "dupTitle": "La diagnostica avanzata continua a segnalare IP duplicati dopo che ne ho rimosso uno",
+    "dupBody": "Il controllo guarda lo stato del kernel dal vivo, non il file di configurazione. Eseguire <code>ip -4 addr show</code> per confermare; se il duplicato è ancora presente, un'interfaccia lo tiene ancora. Utilizzare <code>ip addr del &lt;IP&gt;/&lt;mask&gt; dev &lt;iface&gt;</code> per rimuoverlo dallo stato in tempo reale, quindi modificare <code>/etc/network/interfaces</code> se è anche persistente."
+  },
+  "related": {
+    "heading": "Correlati",
+    "items": [
+      {
+        "label": "Strumenti di monitoraggio dal vivo",
+        "href": "/docs/network/monitoring",
+        "tail": "— lanciatori interattivi iftop / iptraf-ng / iperf3."
+      },
+      {
+        "label": "Analisi dei bridge e riparazione guidata",
+        "href": "/docs/network/bridge-analysis",
+        "tail": " — quando a un vmbrX manca la porta fisica."
+      },
+      {
+        "label": "Analisi della configurazione e pulizia guidata",
+        "href": "/docs/network/config-analysis",
+        "tail": " — quando una vecchia scheda di rete è ancora dichiarata ma non è più presente."
+      },
+      {
+        "label": "Backup e riavvio delle interfacce",
+        "href": "/docs/network/backup-restore",
+        "tail": " — per creare un’istantanea della configurazione prima di qualsiasi modifica."
+      }
+    ]
+  }
+}
diff --git a/web/messages/it/docs/network/index.json b/web/messages/it/docs/network/index.json
new file mode 100644
index 00000000..725ea79e
--- /dev/null
+++ b/web/messages/it/docs/network/index.json
@@ -0,0 +1,107 @@
+{
+  "meta": {
+    "title": "Gestione della rete Proxmox — Bridge, bond, diagnostica, riparazione | ProxMenux",
+    "description": "Diagnostica di sola lettura, analisi con suggerimenti e riparazioni guidate per lo stack di rete Debian / Proxmox (/etc/network/interfaces). Ispeziona bridge e bond, avvia strumenti di monitoraggio in tempo reale, rendi persistenti i nomi delle interfacce, crea backup e riavvia la rete in sicurezza, con backup obbligatori e anteprime passo passo.",
+    "ogTitle": "Gestione della rete Proxmox — Bridge, bond, diagnostica, riparazione",
+    "ogDescription": "Diagnostica, analisi e riparazioni guidate per lo stack di rete Proxmox con backup obbligatori e anteprime passo-passo.",
+    "twitterTitle": "Gestione della rete Proxmox | ProxMenux",
+    "twitterDescription": "Bridge, bond, diagnostica e riparazioni guidate per lo stack di rete Proxmox con backup obbligatori."
+  },
+  "header": {
+    "title": "Gestione rete",
+    "description": "Diagnostica di sola lettura, rapporti di analisi con suggerimenti e riparazioni guidate per il classico stack di rete Debian/Proxmox. Ogni operazione distruttiva crea prima un backup e mostra in anteprima le modifiche esatte prima di applicarle.",
+    "section": "Rete"
+  },
+  "intro": {
+    "title": "A cosa serve questo menu",
+    "body": "Ispeziona, diagnostica e, quando necessario, ripara la configurazione di rete dell’host Proxmox senza perdere l’accesso remoto. Gli strumenti seguono un principio: <strong>prima leggere, poi proporre e infine applicare solo con consenso esplicito e un backup di sicurezza</strong>. Non esiste un pulsante «Correggi tutto automaticamente»."
+  },
+  "openingMenu": {
+    "heading": "Apertura del menu",
+    "intro": "Dal menu principale di ProxMenux, seleziona <strong>Rete</strong>. Vedrai questo:",
+    "imageAlt": "Menù Gestione rete con diagnostica, monitoraggio, analisi, riparazione, nomi persistenti e opzioni di backup"
+  },
+  "safety": {
+    "heading": "Il modello di sicurezza",
+    "body": "Modificare la configurazione di rete di un host Proxmox remoto è uno dei modi più semplici per perdere l’accesso. ProxMenux ne tiene conto per ogni azione. Gli strumenti si dividono in tre livelli di comportamento: scegli la scheda che corrisponde al tuo obiettivo:"
+  },
+  "tiers": {
+    "readOnly": {
+      "title": "Sola lettura",
+      "body": "Ispezione pura. Non può modificare il sistema in nessuna circostanza.",
+      "items": [
+        "Tabella di routing, test di connettività, statistiche avanzate",
+        "Monitoraggio del traffico dal vivo (iftop, iptraf-ng)",
+        "Test della larghezza di banda (iperf3)"
+      ]
+    },
+    "analyze": {
+      "title": "Analizzare, quindi suggerire",
+      "body": "Rileva i problemi, stampa un rapporto con i comandi di shell proposti e si ferma. Si decide se entrare nella riparazione guidata dopo.",
+      "items": [
+        "Analisi della configurazione del ponte",
+        "Analisi della configurazione di rete"
+      ]
+    },
+    "apply": {
+      "title": "Applicare con backup",
+      "body": "Modifica il sistema. Crea sempre prima un backup del file interessato con data e ora e mostra un’anteprima prima di scrivere.",
+      "items": [
+        "Nomi persistenti delle interfacce (file .link)",
+        "Backup manuale, ripristino e riavvio del servizio"
+      ]
+    }
+  },
+  "classicTitle": "Solo pila classica",
+  "classicBody": "Ogni funzione di analisi e riparazione controlla il gestore di rete attivo prima di toccare qualsiasi cosa. Se l'host esegue <strong>netplan</strong>, <strong>systemd-networkd</strong> o <strong>NetworkManager</strong>, lo strumento si interrompe immediatamente con un messaggio chiaro — il menu supporta solo il classico stack Debian/Proxmox a <code>/etc/network/interfaces</code>. Questo è intenzionale: la modifica di un file netplan con regole scritte per <code>ifupdown</code> avrebbe corrotto silenziosamente la configurazione.",
+  "backups": {
+    "heading": "Dove vengono salvati i backup",
+    "intro": "Ogni riparazione guidata, ripristino o backup manuale scrive una copia di <code>/etc/network/interfaces</code> con data e ora in <code>/var/backups/proxmenux/</code>:",
+    "rollbackIntro": "Per ripristinare manualmente la configurazione precedente da una console:"
+  },
+  "readOnlySection": {
+    "heading": "Ispezione di sola lettura",
+    "body": "Il punto di partenza quando qualcosa non va. Semplice ispezione: non scrive mai in <code>/etc/network/interfaces</code> e non esegue comandi che modificano il sistema, con un’unica eccezione esplicita: la rimozione completa di NetworkManager, se rilevato, richiede il tuo consenso. Utilizzabile in sicurezza via SSH in qualsiasi momento.",
+    "options": [
+      {
+        "title": "Diagnostica",
+        "description": "Tre controlli puntuali di sola lettura: Mostra tabella di routing, Test di connettività e Diagnostica avanzata. Semplice ispezione: non scrive mai nel sistema."
+      },
+      {
+        "title": "Strumenti di monitoraggio dal vivo",
+        "description": "Tre strumenti avviabili in modo interattivo: iftop (larghezza di banda in tempo reale per coppia di host), iptraf-ng (monitor del traffico con più modalità) e iperf3 (test della larghezza di banda, modalità server / client)."
+      }
+    ]
+  },
+  "analyzeSection": {
+    "heading": "Analizzare, quindi suggerire",
+    "body": "Da usare quando un’ispezione o un’effettiva interruzione del servizio indica un problema di configurazione. Ogni strumento esamina la parte pertinente di <code>/etc/network/interfaces</code>, stampa un rapporto dettagliato con l’esatto comando shell che risolverebbe ogni problema e <strong>si ferma</strong>. Se in seguito accetti la riparazione guidata facoltativa, ogni modifica viene preceduta da un backup e mostrata in anteprima prima della scrittura.",
+    "options": [
+      {
+        "title": "Analisi dei bridge e riparazione guidata",
+        "description": "Rileva bridge vmbrX con porte mancanti o non valide, situazione tipica dopo la rinumerazione PCI. Mostra prima un rapporto e ripara solo se accetti la procedura guidata in 5 passaggi."
+      },
+      {
+        "title": "Analisi della configurazione e pulizia guidata",
+        "description": "Trova le interfacce fisiche dichiarate in /etc/network/interfaces che non esistono più, ossia configurazioni orfane rimaste dopo modifiche hardware. Le segnala e propone una rimozione guidata."
+      }
+    ]
+  },
+  "applySection": {
+    "heading": "Applicare con backup",
+    "body": "Questi strumenti scrivono su disco per loro natura. Ciascuno crea un backup del file interessato con data e ora prima della scrittura e le opzioni distruttive, come ripristino e riavvio, richiedono una conferma esplicita sì/no. I <em>nomi persistenti delle interfacce</em> diventano effettivi al prossimo riavvio, non subito: puoi quindi pianificarne l’impostazione in sicurezza anche su un host remoto.",
+    "options": [
+      {
+        "title": "Nomi di interfaccia persistenti",
+        "description": "Associa i nomi delle interfacce (eno1, enp3s0, …) agli indirizzi MAC tramite file .link di systemd. I nomi restano invariati dopo cambi di slot PCI, aggiornamenti del kernel e aggiunta o rimozione di altre schede di rete."
+      },
+      {
+        "title": "Backup e riavvio delle interfacce",
+        "description": "snapshot manuale di /etc/network/interfaces, sfoglia e ripristina i backup precedenti, visualizza la configurazione live e riavvia il servizio di rete quando necessario."
+      }
+    ]
+  },
+  "consoleTitle": "Prepara un accesso alla console",
+  "consoleSubTitle": "Prima di qualsiasi riparazione su un host remoto",
+  "consoleBody": "Se sei connesso via SSH e hai un solo percorso di accesso all’host, prepara un’alternativa prima di applicare modifiche alla rete: console fisica / IPMI / iKVM oppure un’altra macchina sulla stessa LAN. Le riparazioni guidate sono sicure e offrono sempre un comando per annullare le modifiche, ma un bridge configurato male o una connessione interrotta può comunque lasciarti senza accesso finché non raggiungi la console."
+}
diff --git a/web/messages/it/docs/network/monitoring.json b/web/messages/it/docs/network/monitoring.json
new file mode 100644
index 00000000..1998637f
--- /dev/null
+++ b/web/messages/it/docs/network/monitoring.json
@@ -0,0 +1,136 @@
+{
+  "meta": {
+    "title": "Strumenti di monitoraggio in tempo reale | Documentazione ProxMenux",
+    "description": "Tre strumenti interattivi di monitoraggio della rete: iftop (larghezza di banda in tempo reale per coppia di host), iptraf-ng (monitor del traffico con più modalità) e iperf3 (test della larghezza di banda, modalità server / client). Ciascuno viene installato al primo utilizzo.",
+    "ogTitle": "Strumenti di monitoraggio in tempo reale | Documentazione ProxMenux",
+    "ogDescription": "Monitoraggio interattivo della rete e test di larghezza di banda per l'host Proxmox: iftop, iptraf-ng, iperf3."
+  },
+  "header": {
+    "title": "Strumenti di monitoraggio dal vivo",
+    "description": "Tre strumenti avviabili in modo interattivo per osservare la rete in tempo reale e misurare la larghezza di banda: iftop, iptraf-ng e iperf3. Ogni strumento viene installato automaticamente tramite apt al primo utilizzo, viene eseguito in primo piano e si chiude con il tasto indicato. Non modificano la configurazione di rete dell’host; iperf3 genera traffico di prova.",
+    "section": "Rete"
+  },
+  "intro": {
+    "title": "Cosa fa",
+    "body": "Tre strumenti di monitoraggio interattivo, ciascuno dietro la propria voce menu. La prima volta che si lancia uno, il pacchetto viene installato silenziosamente tramite <code>apt-get</code>. I lanci successivi iniziano immediatamente. Nessuno di questi strumenti modifica la configurazione della rete host."
+  },
+  "when": {
+    "heading": "Quando usare quale",
+    "headerQuestion": "Domanda",
+    "headerUse": "Usa",
+    "rows": [
+      {
+        "question": "Chi sta saturando il collegamento <em>in questo momento</em>?",
+        "use": "iftop"
+      },
+      {
+        "question": "Qual è la ripartizione per protocollo e quali dimensioni dei pacchetti e flussi TCP sono presenti?",
+        "use": "iptraf-ng"
+      },
+      {
+        "question": "Quanta larghezza di banda è effettivamente disponibile tra due host?",
+        "use": "iperf3"
+      }
+    ]
+  },
+  "iftop": {
+    "heading": "Utilizzo rete in tempo reale (iftop)",
+    "body": "Larghezza di banda in tempo reale per coppia di host (origine ↔ destinazione), come <code>top</code> per il traffico. Mostra in alto i flussi più intensi con medie mobili su 2/10/40 secondi. Lo strumento ideale per rispondere a <em>«perché il mio uplink è saturo?»</em>.",
+    "exit": "<strong>Esci:</strong> premi <kbd>q</kbd>. ProxMenux mostra un promemoria prima dell’avvio.",
+    "keysTitle": "Tasti utili dentro iftop",
+    "keysBody": "<kbd>n</kbd> attiva o disattiva le ricerche DNS, <kbd>p</kbd> mostra i numeri di porta, <kbd>P</kbd> mette in pausa la visualizzazione, <kbd>t</kbd> cambia la direzione delle righe (inviato / ricevuto / entrambi), <kbd>1</kbd>/<kbd>2</kbd>/<kbd>3</kbd> ordina per media su 2 s / 10 s / 40 s. Elenco completo in <code>man iftop</code>."
+  },
+  "iptraf": {
+    "heading": "Strumento monitoraggio rete (iptraf-ng)",
+    "intro": "Un monitor del traffico con più modalità, gestito tramite menu. iftop risponde a <em>«chi»</em>, mentre iptraf-ng risponde a <em>«cosa»</em>: contatori di byte e pacchetti per protocollo, monitoraggio dello stato delle connessioni TCP, istogrammi delle dimensioni dei pacchetti e attività LAN per stazione.",
+    "menuIntro": "Al lancio si ottiene un menu a cinque opzioni:",
+    "headerMode": "Modalità",
+    "headerUseFor": "Usalo per",
+    "rows": [
+      {
+        "mode": "IP traffic monitor",
+        "useFor": "Elenco in tempo reale dei flussi TCP / UDP / ICMP / altri protocolli IP con contatori di byte e stato della connessione"
+      },
+      {
+        "mode": "General interface stats",
+        "useFor": "Conteggi aggregati dei pacchetti IPv4 / IPv6 / TCP / UDP / ICMP / non IP per scheda di rete"
+      },
+      {
+        "mode": "Detailed interface stats",
+        "useFor": "Come sopra, ma per una sola interfaccia, con dettagli sulle dimensioni e sulla frequenza dei pacchetti"
+      },
+      {
+        "mode": "Statistical breakdowns",
+        "useFor": "Istogramma della distribuzione delle dimensioni dei pacchetti, per porta TCP / UDP"
+      },
+      {
+        "mode": "LAN station monitor",
+        "useFor": "Per-MAC statistiche del traffico per il dominio broadcast locale"
+      }
+    ],
+    "exit": "<strong>Esci:</strong> premi <kbd>x</kbd> da qualsiasi vista oppure <kbd>Q</kbd> dal menu principale. ProxMenux mostra un promemoria prima dell’avvio.",
+    "logTitle": "Salvataggio delle acquisizioni su file",
+    "logBody": "Ogni modalità offre di registrare le statistiche catturate a <code>/var/log/iptraf-ng/</code>. Utile se avete bisogno di un record di un picco di traffico — lasciare in esecuzione, registrare a file, rivedere il file dopo invece di cercare di leggere lo schermo dal vivo."
+  },
+  "iperf3": {
+    "heading": "Test della larghezza di banda (iperf3)",
+    "intro1": "Misura la velocità TCP effettiva tra due host. A differenza di iftop / iptraf-ng, che osservano il traffico esistente, iperf3 genera traffico sintetico per una prova di carico del collegamento. Indispensabile per domande come <em>«la mia rete 10 GbE raggiunge davvero 10 GbE?»</em> oppure <em>«il collo di bottiglia è la scheda di rete, lo switch o lo storage?»</em>.",
+    "intro2": "iperf3 è uno <strong>strumento per due host</strong>: uno funge da server e ascolta sulla porta TCP 5201; l’altro funge da client, si connette, invia dati e mostra la velocità. Il lanciatore di ProxMenux chiede quale modalità vuoi:",
+    "headerMode": "Modalità",
+    "headerBehaviour": "Comportamento",
+    "headerCli": "Comando CLI equivalente",
+    "rows": [
+      {
+        "mode": "Server",
+        "behaviour": "Ascolta sulla porta TCP 5201 e mostra i risultati di ogni test in arrivo. Si arresta con Ctrl+C.",
+        "cli": "iperf3 -s"
+      },
+      {
+        "mode": "Cliente",
+        "behaviour": "Chiede l’indirizzo IP o il nome host del server, si connette, esegue il test predefinito di 10 secondi e mostra il rapporto.",
+        "cli": "iperf3 -c <target>"
+      }
+    ],
+    "workflowIntro": "Flusso di lavoro tipico per testare un collegamento 10 GbE tra due host Proxmox:",
+    "workflow": [
+      "Sull’host A, apri il menu Rete → <em>Test della larghezza di banda (iperf3)</em> → scegli <strong>Server</strong>.",
+      "Su host B, apri la stessa voce del menu → scegli <strong>Client</strong> → inserisci l'IP dell'host A.",
+      "Attendere 10 secondi. Confrontare il tasso riportato al massimo teorico del link."
+    ],
+    "sample": "Esempio di output del client:",
+    "flagsTitle": "Opzioni utili da usare manualmente dalla shell",
+    "flagsBody": "<code>-t 60</code> test più lungo (60 s invece di 10 s), <code>-P 4</code> 4 flussi paralleli (saturano prima il collegamento), <code>-R</code> direzione inversa (server → client), <code>-u -b 100M</code> test UDP a 100 Mbit/s (misurazione di jitter e perdita di pacchetti), <code>-p 5202</code> porta diversa (più test in parallelo). Elenco completo in <code>man iperf3</code>.",
+    "firewallTitle": "Aprire la porta firewall sul server",
+    "firewallBody": "Il server ascolta TCP <strong>5201</strong> per impostazione predefinita. Se si esegue il server all'interno di un host Proxmox con un firewall rigoroso (datacenter o livello host), consentire TCP 5201 in entrata dall'IP del client per la durata del test, quindi chiudere di nuovo. Lo stesso vale per <code>nftables</code> / <code>iptables</code> su host nudi."
+  },
+  "install": {
+    "heading": "Il primo lancio installa il pacchetto",
+    "body": "Tutti e tre i lanciatori controllano il binario ed eseguono <code>apt-get update -qq &amp;&amp; apt-get install -y &lt;pkg&gt;</code> se manca. L'installazione è silenziosa: il menu può apparire congelato per 10–30 secondi la prima volta. I lanci successivi iniziano immediatamente."
+  },
+  "troubleshoot": {
+    "heading": "Risoluzione dei problemi",
+    "hangTitle": "L’installazione resta bloccata al primo avvio",
+    "hangBody": "L’host non ha accesso a Internet oppure i repository apt sono irraggiungibili. Annulla con <kbd>Ctrl</kbd>+<kbd>C</kbd>, esegui <code>apt-get update</code> manualmente per vedere l’errore effettivo (DNS, firma del repository, proxy, …), poi torna al menu.",
+    "refusedTitle": "Client iperf3: «unable to connect to server: Connection refused»",
+    "refusedBody": "Il server non è in esecuzione oppure il suo firewall blocca TCP 5201. Verifica sul server con <code>ss -tlnp | grep 5201</code>: dovrebbe mostrare iperf3 in ascolto. Se è in ascolto ma il client continua a fallire, controlla i firewall lungo il percorso tra i due host.",
+    "slowTitle": "iperf3 mostra una velocità molto inferiore a quella prevista per il collegamento",
+    "slowBody": "Cause comuni in ordine di probabilità: (1) la CPU di uno degli host limita la velocità: prova <code>iperf3 -c &lt;target&gt; -P 4</code> per usare più core; (2) il percorso passa per un collegamento più lento, come uno switch gigabit tra due schede 10 GbE; (3) MTU diversi: controlla <code>ip link show</code> su entrambi i lati; (4) offloading della scheda di rete disabilitato: vedi lo script della community <em>Disable NIC Offloading</em> se hai una scheda Intel e1000e.",
+    "noTrafficTitle": "iftop / iptraf-ng non mostrano traffico per un host occupato",
+    "noTrafficBody": "La cattura predefinita è sulla prima interfaccia rilevata. Specificare quello giusto esplicitamente dalla shell: <code>iftop -i vmbr0</code> o <code>iptraf-ng -i vmbr0</code>. Il menu launcher utilizza il default; per le interfacce non di default, viene eseguito da una console."
+  },
+  "related": {
+    "heading": "Correlati",
+    "items": [
+      {
+        "label": "Diagnostica",
+        "href": "/docs/network/diagnostics",
+        "tail": "— i controlli di sola lettura (routing, connettività, statistiche avanzate)."
+      },
+      {
+        "label": "Analisi dei bridge e riparazione guidata",
+        "href": "/docs/network/bridge-analysis",
+        "tail": "— quando il monitoraggio rivela un'interfaccia o un ponte non sta facendo ciò che dovrebbe."
+      }
+    ]
+  }
+}
diff --git a/web/messages/it/docs/network/persistent-names.json b/web/messages/it/docs/network/persistent-names.json
new file mode 100644
index 00000000..37fd520c
--- /dev/null
+++ b/web/messages/it/docs/network/persistent-names.json
@@ -0,0 +1,130 @@
+{
+  "meta": {
+    "title": "Nomi di interfaccia persistenti | Documentazione ProxMenux",
+    "description": "Associa i nomi delle interfacce Proxmox (eno1, enp3s0, …) agli indirizzi MAC tramite file .link di systemd per mantenerli dopo la rinumerazione PCI, aggiornamenti del kernel e aggiunta o rimozione di altre schede di rete.",
+    "ogTitle": "Nomi di interfaccia persistenti | Documentazione ProxMenux",
+    "ogDescription": "Evita che i nomi delle interfacce Proxmox cambino quando modifichi l’hardware. Usa file .link di systemd basati sull’indirizzo MAC."
+  },
+  "header": {
+    "title": "Nomi di interfaccia persistenti",
+    "description": "Genera un file .link di systemd per ogni scheda di rete fisica, associando il nome assegnato dal kernel all’indirizzo MAC della scheda. Dopo l’applicazione al prossimo riavvio, i nomi delle interfacce rimangono stabili quando aggiungi, rimuovi o sposti schede PCIe.",
+    "section": "Rete"
+  },
+  "intro": {
+    "title": "Cosa fa",
+    "body": "Per ogni NIC fisico sull'host, scrive un piccolo file sotto <code>/etc/systemd/network/10-&lt;iface&gt;.link</code> che dice: <em>\"il dispositivo con questo MAC deve sempre essere chiamato questo nome\"</em>. systemd-udevd applica la regola ad ogni avvio, prima che <code>ifupdown</code> legga <code>/etc/network/interfaces</code>."
+  },
+  "problem": {
+    "heading": "Il problema che risolve",
+    "intro": "Linux ricava i nomi predefiniti delle interfacce dalla topologia PCI: <code>eno1</code> = integrata, <code>enp3s0</code> = scheda sul bus PCI 3, slot 0, ecc. Lo schema dei nomi è deterministico <em>a parità di disposizione hardware</em>. Se la disposizione cambia, cambiano anche i nomi:",
+    "items": [
+      "Aggiungere un GPU di fronte a un NIC esistente → il numero di bus NIC può cambiare → cambi di nome.",
+      "Spostare una scheda in una diversa slot PCIe → cambia nome.",
+      "Aggiornamento BIOS / UEFI che rienumera i dispositivi → i nomi possono cambiare.",
+      "Sostituire una scheda difettosa con lo stesso modello in una slot diversa → cambia nome."
+    ],
+    "outro": "Dopo una modifica simile, <code>/etc/network/interfaces</code> fa ancora riferimento al nome <em>precedente</em>; il bridge non si attiva e l’host perde la rete. Impostare nomi persistenti impedisce che la situazione si ripeta."
+  },
+  "howWorks": {
+    "heading": "Come funziona",
+    "arrowLabel": "per scheda di rete",
+    "nodes": {
+      "detectLabel": "Rileva le schede di rete fisiche",
+      "detectDetail": "ls /sys/class/net/\nescludi vmbr / bond /\ndocker / veth / wireguard …",
+      "readLabel": "Leggi ogni MAC",
+      "readDetail": "cat /sys/class/net/\n  '<'iface'>'/address",
+      "writeLabel": "Scrivi file .link",
+      "writeDetail": "/etc/systemd/network/\n  10-'<'iface'>'.link"
+    },
+    "minimalIntro": "Ogni file generato è intenzionalmente minimo:",
+    "minimalOutro": "All’avvio, systemd-udevd identifica il dispositivo tramite MAC e assegna il nome richiesto <em>prima</em> che intervengano altri componenti (ifupdown, denominazione predefinita del kernel). Il prefisso <code>10-</code> fa caricare queste regole in anticipo, prima del file predefinito <code>99-default.link</code>."
+  },
+  "scope": {
+    "heading": "Quello che viene scritto, quello che viene saltato",
+    "headerType": "Tipo",
+    "headerBehaviour": "Comportamento",
+    "headerWhy": "Perché?",
+    "rows": [
+      {
+        "type": "Scheda di rete integrata / PCIe",
+        "behaviour": "File <code>.link</code> scritto",
+        "why": "Corrisponde a un dispositivo PCI reale: il caso per cui è pensato lo strumento"
+      },
+      {
+        "type": "Wi-Fi (phy80211)",
+        "behaviour": "File <code>.link</code> scritto",
+        "why": "Ha un MAC reale e benefici dalla stabilità dei nomi"
+      },
+      {
+        "type": "Ponti (vmbrX)",
+        "behaviour": "Ignorato",
+        "why": "Virtuale; il nome viene da <code>/etc/network/interfaces</code>"
+      },
+      {
+        "type": "Bond (bondX)",
+        "behaviour": "Ignorato",
+        "why": "Virtuale; il nome del bond è impostato da ifupdown"
+      },
+      {
+        "type": "veth / docker0 / br-XXXX",
+        "behaviour": "Ignorato",
+        "why": "Creato su richiesta da Docker / LXC — hardware non persistente"
+      },
+      {
+        "type": "tap / fwpr / fwln",
+        "behaviour": "Ignorato",
+        "why": "Creato su richiesta da Proxmox per VM/CT"
+      },
+      {
+        "type": "WireGuard / Cilium / Tailscale",
+        "behaviour": "Ignorato",
+        "why": "Interfacce software gestite dai propri demoni"
+      }
+    ]
+  },
+  "safety": {
+    "heading": "Rete di sicurezza: backup dei file .link precedenti",
+    "intro": "Se <code>/etc/systemd/network/</code> contiene già file <code>.link</code> da un’esecuzione precedente o da altri strumenti, questi vengono copiati in una directory di backup con data e ora prima di generare i nuovi file:",
+    "outro": "Per tornare indietro: copiare i file dalla directory di backup e riavviare.",
+    "rebootTitle": "Prende effetto sul prossimo riavvio, non immediatamente",
+    "rebootBody": "Le modifiche ai file <code>.link</code> si applicano solo all’avvio, quando udev enumera nuovamente i dispositivi. Per questo lo strumento mostra <em>«Le modifiche saranno applicate dopo il riavvio»</em>. Rinominare un’interfaccia in uso è rischioso e non viene tentato: un <code>vmbr0</code> attivo con interfacce membro andrebbe riconfigurato atomicamente, quindi l’operazione è rimandata al prossimo avvio pulito."
+  },
+  "afterReboot": {
+    "heading": "Dopo il riavvio",
+    "intro": "Una volta che i nomi sono bloccati, il flusso di lavoro per le future modifiche hardware è semplice:",
+    "items": [
+      "Spegni, modifica l’hardware (aggiungi una scheda, cambia slot, …), poi avvia.",
+      "Ogni NIC mantiene il suo nome precedente perché il suo MAC corrisponde a un file <code>.link</code>.",
+      "Se una scheda di rete viene sostituita e ha un MAC diverso, riceve un nome predefinito del kernel (<code>enp&lt;bus&gt;s&lt;slot&gt;</code>); esegui di nuovo questo menu per aggiungere una voce <code>.link</code> per il MAC della nuova scheda."
+    ]
+  },
+  "troubleshoot": {
+    "heading": "Risoluzione dei problemi",
+    "emptyTitle": "\"Nessuna interfaccia fisica trovata\" dopo aver eseguito lo strumento",
+    "emptyBody": "Il kernel non vede interfacce basate su PCI / phy80211 sull’host. Verifica con <code>ls -l /sys/class/net/</code>: ogni voce dovrebbe avere un collegamento simbolico <code>device</code> (PCI) oppure una voce <code>phy80211</code> (Wi-Fi). Se mancano entrambi per una scheda di rete reale, il driver non è caricato.",
+    "noChangeTitle": "Dopo il riavvio, i nomi non sono cambiati come previsto",
+    "noChangeBody": "Verifica che il file esista e sia ben formato: <code>cat /etc/systemd/network/10-&lt;iface&gt;.link</code>. Poi controlla i log di udev: <code>journalctl -u systemd-udevd -b | grep -i link</code>. Una causa comune è un vecchio parametro del kernel <code>net.ifnames=0</code> che disabilita del tutto i nomi prevedibili: rimuovilo da <code>/etc/default/grub</code>, esegui <code>update-grub</code> e riavvia.",
+    "undoTitle": "Voglio annullare la denominazione persistente",
+    "undoBody": "Elimina i file <code>.link</code> (<code>rm /etc/systemd/network/10-*.link</code>) oppure ripristinali dalla directory di backup creata nell’esecuzione precedente. Riavvia per applicare."
+  },
+  "related": {
+    "heading": "Correlati",
+    "items": [
+      {
+        "label": "Analisi dei bridge e riparazione guidata",
+        "href": "/docs/network/bridge-analysis",
+        "tailRich": " — il percorso di ripristino quando i nomi sono <em>già</em> cambiati."
+      },
+      {
+        "label": "Analisi della configurazione e pulizia guidata",
+        "href": "/docs/network/config-analysis",
+        "tail": "— rimuovere i blocchi orfani lasciati alle spalle con i cambi di nome."
+      },
+      {
+        "label": "Diagnostica",
+        "href": "/docs/network/diagnostics",
+        "tailRich": " — verifica i nuovi nomi con <em>Mostra tabella di routing</em> dopo il riavvio."
+      }
+    ]
+  }
+}
diff --git a/web/messages/it/docs/oci-manager/architecture.json b/web/messages/it/docs/oci-manager/architecture.json
new file mode 100644
index 00000000..3723eb23
--- /dev/null
+++ b/web/messages/it/docs/oci-manager/architecture.json
@@ -0,0 +1,171 @@
+{
+  "meta": {
+    "title": "Come viene adattata un’immagine OCI | ProxMenux",
+    "description": "Dal repository dell’immagine e dal suo file Compose a un modello verificabile, un piano di distribuzione e un LXC nativo di Proxmox VE, senza Docker al suo interno."
+  },
+  "header": {
+    "title": "Come viene adattata un’immagine OCI",
+    "description": "Dal repository dell’immagine e dal suo file Compose a un modello verificabile, un piano di distribuzione e un LXC nativo, senza installare Docker al suo interno.",
+    "section": "OCI manager Apps"
+  },
+  "sections": [
+    {
+      "id": "pipeline",
+      "title": "Il processo di adattamento",
+      "blocks": [
+        {
+          "mermaid": {
+            "chartCode": "flowchart LR\n A[\"{{repo}}\"] --> B[\"Compose + README\"]\n B --> C[\"{{converter}}\"]\n C --> D[\"{{template}}\"]\n D --> E{\"{{blockers}}\"}\n E -- \"{{no}}\" --> F[\"{{review}}\"]\n F --> D\n E -- \"{{yes}}\" --> G[\"{{plan}}\"]\n G --> H[\"pct create\"]\n H --> I[\"{{lxc}}\"]",
+            "labels": {
+              "repo": "Repository dell’immagine",
+              "converter": "Convertitore",
+              "template": "Modello JSON",
+              "blockers": "Nessun requisito bloccante?",
+              "no": "No",
+              "yes": "Sì",
+              "review": "Revisione / overlay",
+              "plan": "Piano di distribuzione",
+              "lxc": "LXC nativo"
+            }
+          }
+        },
+        {
+          "p": "Il convertitore legge l’immagine e il file Compose pubblicati dal progetto e genera un modello JSON. Se alcuni requisiti non possono ancora essere adattati e impediscono l’installazione, il modello viene revisionato prima della pubblicazione nel catalogo. Un file di modifiche verificate, chiamato overlay, risolve questi problemi. Solo i modelli senza requisiti bloccanti vengono proposti per l’installazione."
+        }
+      ]
+    },
+    {
+      "id": "template",
+      "title": "Cosa conserva il modello",
+      "blocks": [
+        {
+          "cards": {
+            "items": [
+              {
+                "icon": "archive",
+                "title": "Identità dell’immagine",
+                "body": "Repository, tag ad aggiornamento continuo, architettura, digest risolto e revisione di origine."
+              },
+              {
+                "icon": "braces",
+                "title": "Contratto del container",
+                "body": "Entrypoint, Cmd, ambiente, utente, directory di lavoro, segnale di arresto, porte e volumi."
+              },
+              {
+                "icon": "layers",
+                "title": "Adattamento a Proxmox VE",
+                "body": "Risorse, sicurezza, punti di mount, dispositivi, sysctls, controlli di stato e adattamenti necessari per ciascuno, con la relativa motivazione."
+              },
+              {
+                "icon": "shield",
+                "title": "Compatibilità",
+                "body": "Chiavi supportate, requisiti non adattati che impediscono l’installazione e stato di ogni verifica."
+              }
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "sources",
+      "title": "OCI fornisce il processo, Compose l’ambiente",
+      "blocks": [
+        {
+          "table": {
+            "headers": [
+              "Origine",
+              "Esempio",
+              "Risultato nativo"
+            ],
+            "rows": [
+              [
+                "Metadati OCI",
+                "<code>Entrypoint</code>, <code>Cmd</code>, <code>User</code>",
+                "Proxmox VE li importa durante la creazione del CT"
+              ],
+              [
+                "Docker Compose",
+                "<code>environment</code>, <code>volumes</code>, <code>devices</code>",
+                "Voci dell’ambiente LXC, <code>mpN</code> e <code>devN</code>"
+              ],
+              [
+                "Profilo ProxMenux",
+                "GPU, controllo di stato, credenziali",
+                "Domande e adattamenti verificati"
+              ],
+              [
+                "Utente",
+                "VMID, storage, rete",
+                "Il contratto dell’istanza"
+              ]
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "install",
+      "title": "Cosa succede durante l’installazione",
+      "blocks": [
+        {
+          "steps": {
+            "items": [
+              {
+                "title": "Risolvere il riferimento",
+                "body": "Viene interrogato il registro, viene scelta l’architettura dell’host e viene fissato il digest esatto a cui punta il tag ad aggiornamento continuo."
+              },
+              {
+                "title": "Scaricare e verificare",
+                "body": "Skopeo scarica l’immagine come archivio OCI. Prima di creare qualsiasi risorsa, ogni livello viene verificato rispetto al suo digest e decompresso. Se il download è danneggiato, viene ripetuto una volta prima di interrompere l’installazione."
+              },
+              {
+                "title": "Creare il filesystem",
+                "body": "<code>pct create</code> crea il rootfs a partire dall’archivio e conserva i metadati ufficiali del processo dell’immagine."
+              },
+              {
+                "title": "Collegare le risorse",
+                "body": "Vengono applicati i volumi, la rete, l’ambiente, i dispositivi e i profili di sicurezza dichiarati."
+              },
+              {
+                "title": "Console",
+                "body": "L’output della console del container viene conservato sull’host. La console di Proxmox VE apre una shell se l’immagine ne include una."
+              },
+              {
+                "title": "Verificare",
+                "body": "Al primo avvio si attende che il container riceva un indirizzo e che il servizio risponda. In caso di errore, l’installazione non viene indicata come riuscita."
+              },
+              {
+                "title": "Registrare la configurazione",
+                "body": "La configurazione effettiva viene salvata nel contratto dell’istanza usato per gli aggiornamenti e le ricreazioni."
+              }
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "example",
+      "title": "Esempio: un’immagine con /config e /downloads",
+      "intro": "Una definizione Compose comune e la configurazione Proxmox VE che ne deriva. I percorsi attesi dall’applicazione non cambiano.",
+      "blocks": [
+        {
+          "codeGrid": {
+            "items": [
+              {
+                "title": "Docker Compose",
+                "code": "image: lscr.io/linuxserver/example:latest\nenvironment:\n  - PUID=1000\n  - PGID=1000\nvolumes:\n  - config:/config\n  - /srv/downloads:/downloads\nports:\n  - 8080:8080"
+              },
+              {
+                "title": "/etc/pve/lxc/VMID.conf (estratto)",
+                "code": "entrypoint: /init\nmp0: local-lvm:vm-VMID-disk-1,mp=/config,backup=1,size=8G\nmp1: /srv/downloads,mp=/downloads\nnet0: name=eth0,bridge=vmbr0,ip=dhcp,type=veth\nlxc.environment.runtime: PUID=1000\nlxc.environment.runtime: PGID=1000"
+              }
+            ]
+          }
+        },
+        {
+          "p": "<code>mp0</code> è un secondo disco appartenente al container, denominato <code>vm-VMID-disk-N</code> sullo storage selezionato. Viene montato in <code>/config</code> e, con <code>backup=1</code>, incluso nel backup del container. <code>mp1</code> non crea alcun disco: monta la directory dell’host <code>/srv/downloads</code> in <code>/downloads</code> all’interno dell’LXC. La porta 8080 non viene mappata: l’LXC ha un proprio indirizzo e il servizio risponde su quello."
+        }
+      ]
+    }
+  ]
+}
diff --git a/web/messages/it/docs/oci-manager/custom-image.json b/web/messages/it/docs/oci-manager/custom-image.json
new file mode 100644
index 00000000..7d48a5b7
--- /dev/null
+++ b/web/messages/it/docs/oci-manager/custom-image.json
@@ -0,0 +1,278 @@
+{
+  "meta": {
+    "title": "Installare un’immagine non presente nel catalogo | ProxMenux",
+    "description": "Adatta un’immagine OCI da un file Compose, un URL, un comando docker run o un riferimento all’immagine e verifica cosa può riprodurre ProxMenux prima di installarla."
+  },
+  "header": {
+    "title": "Installa un’immagine non presente nel catalogo",
+    "description": "L’immagine viene adattata dal suo file Compose, da un comando docker run o dal solo riferimento. Il risultato viene mostrato per la revisione prima di creare qualsiasi LXC.",
+    "section": "OCI manager Apps"
+  },
+  "sections": [
+    {
+      "id": "intro",
+      "blocks": [
+        {
+          "calloutInfo": {
+            "title": "Lo stesso convertitore e lo stesso installer",
+            "body": "L’opzione <strong>Installa un’immagine non presente nel catalogo</strong> usa il convertitore e l’installer dei modelli del catalogo. La differenza è che il contratto viene generato al momento dalla definizione fornita e verificato prima di creare qualsiasi LXC."
+          }
+        }
+      ]
+    },
+    {
+      "id": "sources",
+      "title": "Come viene descritta l’immagine",
+      "intro": "La prima schermata chiede come viene descritta l’immagine. Quattro opzioni forniscono una definizione da adattare, una quinta usa solo il nome dell’immagine e altre tre leggono un oci-compose già scritto.",
+      "blocks": [
+        {
+          "table": {
+            "headers": [
+              "Opzione",
+              "Cosa legge"
+            ],
+            "rows": [
+              [
+                "Incolla il file Compose nel terminale",
+                "Incolla il contenuto YAML nel terminale e termina con Ctrl+D."
+              ],
+              [
+                "Leggi il file Compose da questo host",
+                "Un percorso sul nodo, <code>/root/docker-compose.yml</code> per impostazione predefinita. Il file deve esistere e non superare 256 KiB."
+              ],
+              [
+                "Scarica il file Compose da un indirizzo",
+                "Un indirizzo <code>http://</code> o <code>https://</code> che fornisce il contenuto YAML grezzo. Vengono scaricati al massimo 256 KiB."
+              ],
+              [
+                "Incolla il comando docker run nel terminale",
+                "Il comando pubblicato dal progetto. Vengono adattati porte, ambiente, volumi, dispositivi, capability, utente, memoria condivisa e le altre opzioni supportate."
+              ],
+              [
+                "Solo il riferimento all’immagine, senza file Compose",
+                "Un riferimento come <code>ghcr.io/user/application:latest</code>. Viene interrogato il registro e vengono conservati i metadati OCI dell’immagine."
+              ],
+              [
+                "Incolla un oci-compose nel terminale",
+                "Incolla il JSON nel terminale e termina con Ctrl+D. Non viene convertito: viene verificato e installato così come è scritto."
+              ],
+              [
+                "Leggi un oci-compose da questo host",
+                "Un file JSON sul nodo, <code>/root/oci-compose.json</code> per impostazione predefinita, di massimo 2 MiB."
+              ],
+              [
+                "Scarica un oci-compose da un indirizzo",
+                "Un indirizzo <code>http://</code> o <code>https://</code> che fornisce il file JSON. Vengono scaricati al massimo 2 MiB."
+              ]
+            ]
+          }
+        },
+        {
+          "figure": {
+            "src": "/oci-manager/custom-source-menu.png",
+            "alt": "Menu per scegliere come descrivere un’immagine non presente nel catalogo",
+            "caption": "Modi per descrivere un’immagine non presente nel catalogo."
+          }
+        }
+      ]
+    },
+    {
+      "id": "reference-only",
+      "title": "Cosa fornisce il solo riferimento all’immagine",
+      "intro": "L’immagine contiene i metadati del processo, ma non tutto l’ambiente che normalmente aggiunge un file Compose.",
+      "blocks": [
+        {
+          "table": {
+            "headers": [
+              "Letto dall’immagine",
+              "Non presente nell’immagine",
+              "Conseguenza"
+            ],
+            "rows": [
+              [
+                "<code>Entrypoint</code>, <code>Cmd</code>, <code>User</code>, <code>WorkingDir</code> e l’ambiente incorporato",
+                "Variabili presenti solo nella documentazione",
+                "Vengono aggiunte durante l’installazione o con Modifica"
+              ],
+              [
+                "Volumi dichiarati dall’immagine",
+                "Directory dell’host indicate solo nel file Compose",
+                "I percorsi aggiuntivi vengono inseriti prima dell’installazione"
+              ],
+              [
+                "Porte <code>EXPOSE</code>",
+                "L’URL, il protocollo o il controllo funzionale del servizio",
+                "Vengono confermati la porta e il metodo di verifica del servizio"
+              ],
+              [
+                "Architetture e digest nel registro",
+                "Dispositivi, privilegi o dipendenze esterne",
+                "Non vengono abilitati senza una definizione che li richieda"
+              ]
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "review",
+      "title": "Verifica prima di installare",
+      "intro": "Dopo aver adattato la definizione, ProxMenux mostra come l’ha interpretata prima di chiedere VMID, risorse o storage.",
+      "blocks": [
+        {
+          "steps": {
+            "items": [
+              {
+                "title": "Analizza",
+                "body": "Vengono letti servizi, immagine, porte, percorsi, ambiente, dispositivi, sicurezza e controllo di stato."
+              },
+              {
+                "title": "Interroga il registro",
+                "body": "L’immagine deve esistere nel registro e vengono elencate le architetture pubblicate. Per un registro privato viene usato l’account salvato per quel registro."
+              },
+              {
+                "title": "Elenca ciò che non viene applicato",
+                "body": "Vengono elencati label, reti Docker, impostazioni Swarm e altre chiavi che non hanno effetto su un LXC."
+              },
+              {
+                "title": "Blocca le opzioni senza equivalente sicuro",
+                "body": "Le chiavi senza un equivalente sicuro compaiono in <strong>Opzioni senza equivalente</strong> e impediscono di proseguire con l’installazione. Non vengono ignorate senza avviso."
+              },
+              {
+                "title": "Richiedi i segreti",
+                "body": "Le variabili il cui nome indica una password, un token o una chiave vengono richieste come dati sensibili durante l’installazione."
+              }
+            ]
+          }
+        },
+        {
+          "figure": {
+            "src": "/oci-manager/custom-review.png",
+            "alt": "Riepilogo di come ProxMenux ha interpretato il file Compose",
+            "caption": "Riepilogo mostrato prima che l’installer chieda VMID e risorse."
+          }
+        },
+        {
+          "p": "Dopo aver accettato il riepilogo, il flusso è quello del catalogo: nome, modalità predefinita o avanzata, VMID, CPU, memoria, rete, avvio con il nodo, percorsi persistenti e aggiuntivi, dispositivi compatibili e riepilogo finale."
+        }
+      ]
+    },
+    {
+      "id": "examples",
+      "title": "Esempi di input",
+      "blocks": [
+        {
+          "codeGrid": {
+            "items": [
+              {
+                "title": "Compose",
+                "code": "services:\n  app:\n    image: ghcr.io/example/app:latest\n    ports:\n      - \"8080:8080\"\n    volumes:\n      - ./config:/config\n      - /srv/media:/media\n    environment:\n      TZ: Europe/Madrid"
+              },
+              {
+                "title": "docker run",
+                "code": "docker run -d \\\n  --name app \\\n  -p 8080:8080 \\\n  -e TZ=Europe/Madrid \\\n  -v app-config:/config \\\n  -v /srv/media:/media \\\n  ghcr.io/example/app:latest"
+              }
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "oci-compose",
+      "title": "Un oci-compose scritto a mano",
+      "intro": "Un oci-compose è il file JSON da cui viene installata un’applicazione. Il catalogo ne conserva uno per ogni applicazione. Lo stesso formato può essere scritto a mano e installato con questa opzione.",
+      "blocks": [
+        {
+          "p": "In un file scritto a mano l’autore decide immagine, porte, variabili, volumi e domande dell’installazione. ProxMenux completa il resto durante la lettura. Il formato può esprimere ciò che Compose non prevede: il testo di una domanda, una password generata all’installazione, un profilo GPU, il proprietario di ciascun volume, il controllo del primo avvio o le credenziali mostrate alla fine."
+        },
+        {
+          "steps": {
+            "items": [
+              {
+                "title": "Verifica",
+                "body": "I file con errori non vengono installati. Ogni errore indica il campo interessato; se il JSON non è valido, vengono segnalate riga e colonna."
+              },
+              {
+                "title": "Rivedi",
+                "body": "Un file valido mostra cosa installa: immagine, indirizzo web, porte, percorsi persistenti, variabili richieste dall’installer e file che verranno scritti."
+              },
+              {
+                "title": "Installa",
+                "body": "L’installazione è la stessa delle applicazioni del catalogo, con impostazioni predefinite o avanzate."
+              }
+            ]
+          }
+        },
+        {
+          "calloutWarning": {
+            "title": "Un file che determina i privilegi",
+            "body": "Un oci-compose stabilisce cosa viene montato nel container e con quali privilegi. La revisione lo mostra prima dell’installazione: installa solo file provenienti da fonti attendibili."
+          }
+        },
+        {
+          "p": "Il <readmeLink>README del motore OCI</readmeLink> descrive il formato blocco per blocco con due esempi completi. Anche il record di un’installazione può essere letto nello stesso modo: viene usato solo il modello originale, senza alcuna delle risposte di quell’installazione."
+        }
+      ]
+    },
+    {
+      "id": "private-registries",
+      "title": "Immagini in registri privati",
+      "intro": "Un’immagine in un registro privato, come un pacchetto privato su GitHub o un repository privato su Docker Hub, viene letta con un account salvato in ProxMenux.",
+      "blocks": [
+        {
+          "steps": {
+            "items": [
+              {
+                "title": "Il registro nega l’accesso all’immagine",
+                "body": "Quando il registro indica che l’immagine richiede un account, la revisione propone di accedere a quel registro e legge di nuovo l’immagine."
+              },
+              {
+                "title": "Accedi",
+                "body": "Un nome utente e una password o un token autorizzato a scaricare l’immagine. Il registro li verifica e vengono salvati solo se accettati."
+              },
+              {
+                "title": "Installa e mantieni aggiornato",
+                "body": "L’account viene usato per scaricare l’immagine durante l’installazione e anche per aggiornamenti, Modifica, Ricrea, watchdog e ricerca degli aggiornamenti del Monitor, su qualsiasi nodo del cluster."
+              }
+            ]
+          }
+        },
+        {
+          "p": "<strong>Account dei registri</strong>, nel menu principale di OCI manager Apps, elenca gli account salvati per registro e utente, senza mostrarne i segreti. Da ogni account puoi verificare, scaricare o installare un’immagine e aggiornare o rimuovere le credenziali."
+        },
+        {
+          "list": {
+            "items": [
+              "GitHub (<code>ghcr.io</code>): l’utente è l’account GitHub e la password è un token di accesso personale con il permesso <code>read:packages</code>.",
+              "Docker Hub (<code>docker.io</code>): l’utente è l’account Docker Hub e la password è un token di accesso con permesso di lettura.",
+              "Altri registri, anche con una porta propria come <code>registry.example.com:5000</code>: nome utente e password o token forniti da quel registro."
+            ]
+          }
+        },
+        {
+          "calloutInfo": {
+            "title": "Dove vengono salvati gli account",
+            "body": "In <code>/etc/pve/priv/proxmenux/registry-auth.json</code>, leggibile solo da root, nella stessa cartella in cui Proxmox conserva le password degli storage. <code>/etc/pve</code> è condiviso tra tutti i nodi del cluster, quindi un account aggiunto su un nodo viene usato su tutti. Il backup dell’host include il file e la disinstallazione di ProxMenux lo rimuove da tutti i nodi."
+          }
+        }
+      ]
+    },
+    {
+      "id": "limits",
+      "title": "Definizioni che non vengono installate",
+      "blocks": [
+        {
+          "list": {
+            "items": [
+              "Un Dockerfile senza immagine pubblicata: prima occorre creare l’immagine e pubblicarla in un registro OCI.",
+              "Un file Compose con più servizi: viene bloccato perché questa opzione installa un solo servizio per container, anche se più servizi usano la stessa immagine.",
+              "<code>configs</code>, segreti esterni o formati di dispositivi che non possono essere adattati senza ambiguità.",
+              "Sostituzioni della shell come <code>$(command)</code>: occorre inserire direttamente il valore risultante.",
+              "Opzioni <code>docker run</code> non riconosciute e <code>--env-file</code>: usa invece un file Compose con valori espliciti."
+            ]
+          }
+        }
+      ]
+    }
+  ]
+}
diff --git a/web/messages/it/docs/oci-manager/hardware.json b/web/messages/it/docs/oci-manager/hardware.json
new file mode 100644
index 00000000..8a60aa10
--- /dev/null
+++ b/web/messages/it/docs/oci-manager/hardware.json
@@ -0,0 +1,392 @@
+{
+  "meta": {
+    "title": "Dispositivi e accelerazione | ProxMenux",
+    "description": "Come OCI manager Apps passa GPU, NVIDIA, Coral, USB, FUSE e altri dispositivi a un contenitore OCI come risorse native Proxmox VE convalidate."
+  },
+  "header": {
+    "title": "Dispositivi e accelerazione",
+    "description": "I dispositivi GPU, NVIDIA, Coral, USB, FUSE e a blocchi diventano risorse native convalidate Proxmox VE del contenitore.",
+    "section": "OCI manager Apps"
+  },
+  "sections": [
+    {
+      "id": "principle",
+      "title": "Il dispositivo di cui l'applicazione ha bisogno, non l'intero host",
+      "blocks": [
+        {
+          "p": "Un dispositivo richiesto dal file Compose o dal profilo dell’applicazione viene configurato come voce <code>devN</code> specifica o come montaggio LXC. Richiedere una GPU, un dispositivo USB o un acceleratore Coral non rende il container privilegiato."
+        },
+        {
+          "flow": {
+            "nodes": [
+              {
+                "label": "Inventario host",
+                "detail": "/dev/dri/renderD128\nGID 993 · Intel"
+              },
+              {
+                "label": "ProxMenux",
+                "detail": "produttore e\npermessi verificati"
+              },
+              {
+                "label": "LXC",
+                "detail": "stesso dispositivo\nGID effettivo"
+              }
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "origin",
+      "title": "Da dove proviene la richiesta del dispositivo",
+      "blocks": [
+        {
+          "table": {
+            "headers": [
+              "Fonte",
+              "Cosa si legge",
+              "Cosa fa l'installatore"
+            ],
+            "rows": [
+              [
+                "Docker Compose",
+                "<code>devices</code>, <code>group_add</code>, <code>deploy.resources</code> e NVIDIA richieste",
+                "Ogni esigenza diventa una richiesta di dispositivo mostrata per la revisione"
+              ],
+              [
+                "Profilo del catalogo",
+                "Il supporto effettivo dell’applicazione per GPU, Coral, OpenCL, USB o FUSE",
+                "Solo le opzioni convalidate per quell'immagine sono offerte"
+              ],
+              [
+                "Metadati e documentazione dell’immagine",
+                "VA-API, Selkies, mod LinuxServer o runtime NVIDIA",
+                "Vengono aggiunte le variabili documentate e la preparazione"
+              ],
+              [
+                "Selezione utente",
+                "CPU solo, Intel/AMD, OpenCL, NVIDIA o un dispositivo opzionale",
+                "La selezione viene memorizzata nel contratto di istanza"
+              ]
+            ]
+          }
+        },
+        {
+          "calloutWarning": {
+            "title": "I dispositivi rilevati non vengono collegati automaticamente",
+            "body": "Viene creato un inventario dell’host, ma solo i dispositivi dichiarati dal file Compose o da un profilo compatibile sono offerti e allegati. Una GPU, USB dongle o Coral presente sull'host non è esposto ad ogni LXC."
+          }
+        }
+      ]
+    },
+    {
+      "id": "identify",
+      "title": "Come viene identificato il dispositivo host",
+      "intro": "Prima della modifica del LXC, il dispositivo viene letto sull'host e abbinato al profilo scelto.",
+      "blocks": [
+        {
+          "table": {
+            "headers": [
+              "Tipo",
+              "Identità",
+              "Validazione"
+            ],
+            "rows": [
+              [
+                "Intel/AMD DRM",
+                "<code>/dev/dri/renderD*</code> e <code>/sys/class/drm/NODE/device/vendor</code>",
+                "Un dispositivo a caratteri con il fornitore <code>0x8086</code> (Intel) o <code>0x1002</code> (AMD)"
+              ],
+              [
+                "AMD OpenCL",
+                "Il nodo di rendering, più <code>/dev/kfd</code> quando il profilo ne ha bisogno",
+                "Esistenza, tipo, fornitore, autorizzazioni e compatibilità dichiarata"
+              ],
+              [
+                "AMD ROCm",
+                "Il nodo di rendering, <code>/dev/kfd</code> e la generazione indicata dal driver di calcolo in <code>/sys/class/kfd/kfd/topology/nodes/*/properties</code>",
+                "Una generazione per cui l’immagine ROCm dell’applicazione include kernel di calcolo — le GPU RDNA2 indicate e quelle più recenti — viene proposta così com’è. Le altre GPU di queste famiglie, come Radeon 680M e 780M, sono proposte come sperimentali e non sono mai preselezionate: ROCm non le supporta ufficialmente, l’applicazione le presenta come la generazione della rispettiva famiglia (<code>HSA_OVERRIDE_GFX_VERSION</code>) e l’installatore chiede conferma prima di scaricare l’immagine più grande. Una GPU precedente, come la grafica integrata di un Ryzen 5000U, non viene proposta e Immich mantiene il riconoscimento sulla CPU."
+              ],
+              [
+                "NVIDIA",
+                "<code>nvidia-smi</code> e <code>nvidia-container-cli</code>",
+                "GPU, UUID, bus PCI, versione driver, Toolkit, nodi <code>/dev/nvidia*</code>, binari e librerie"
+              ],
+              [
+                "Coral PCIe/M.2",
+                "<code>/dev/apex_N</code> e il suo collegamento in <code>/sys/dev/char/MAJOR:MINOR</code>",
+                "Nodo a caratteri, numeri major/minor, proprietario, GID e permessi"
+              ],
+              [
+                "USB e seriale",
+                "<code>/dev/ttyUSB*</code>, <code>/dev/ttyACM*</code> o <code>/dev/bus/usb/BBB/DDD</code>",
+                "Nodo di carattere; per USB anche produttore, prodotto e seriale quando sysfs li pubblica"
+              ],
+              [
+                "KVM, TUN, FUSE, video e SCSI generici",
+                "<code>/dev/kvm</code>, <code>/dev/net/tun</code>, <code>/dev/fuse</code>, <code>/dev/videoN</code> o <code>/dev/sgN</code>",
+                "Percorso supportato, tipo nodo e permessi effettivi"
+              ],
+              [
+                "Unità ottica",
+                "<code>/dev/srN</code>",
+                "Un dispositivo a blocchi"
+              ]
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "install",
+      "title": "Cosa succede durante l'installazione",
+      "blocks": [
+        {
+          "steps": {
+            "items": [
+              {
+                "title": "Il modello offre i suoi profili",
+                "body": "Ad esempio solo CPU, Intel/AMD VA-API, AMD OpenCL, Intel OpenCL o NVIDIA. Le opzioni appartengono all'immagine, non a un menu comune."
+              },
+              {
+                "title": "Viene scelto un profilo",
+                "body": "Definisce i nodi del dispositivo, ambiente, mod o runtime di cui l'applicazione ha bisogno."
+              },
+              {
+                "title": "Si propone un percorso",
+                "body": "Per DRM, <code>/dev/dri/renderD128</code>, che può essere modificato su un host con diversi nodi di rendering. Per USB o seriale, viene selezionato il nodo specifico."
+              },
+              {
+                "title": "Validazione",
+                "body": "Esistenza, tipo, fornitore consentito, autorizzazioni e GID sono controllati. Un errore blocca l'operazione."
+              },
+              {
+                "title": "Il contratto è scritto",
+                "body": "Percorso, modalità, GID, accesso scrittura e profilo sono registrati per aggiornamenti e ricreazioni."
+              },
+              {
+                "title": "Collega e verifica",
+                "body": "<code>pct set</code> aggiunge l'ingresso <code>devN</code> e l'accesso viene quindi controllato all'interno del LXC. Le immagini LinuxServer vengono anche controllate come utente <code>abc</code>."
+              }
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "config",
+      "title": "Come appare nella configurazione LXC",
+      "intro": "Valori illustrativi: <code>dev0</code> e <code>dev1</code> sono gli slot liberi assegnati da Proxmox VE; <code>renderD128</code>, <code>apex_0</code> e il GID dipendono dall’hardware del nodo.",
+      "blocks": [
+        {
+          "codeGrid": {
+            "items": [
+              {
+                "title": "Intel/AMD VA-API",
+                "code": "dev0: path=/dev/dri/renderD128,mode=0660,gid=993,deny-write=0"
+              },
+              {
+                "title": "Coral PCIe/M.2",
+                "code": "dev0: path=/dev/apex_0,mode=0660,gid=GID,deny-write=0"
+              },
+              {
+                "title": "Un dispositivo USB specifico",
+                "code": "dev0: path=/dev/bus/usb/003/004,mode=0660,gid=GID,deny-write=0"
+              },
+              {
+                "title": "AMD OpenCL",
+                "code": "dev0: path=/dev/dri/renderD128,mode=0660,gid=GID,deny-write=0\ndev1: path=/dev/kfd,mode=0660,gid=GID,deny-write=0"
+              }
+            ]
+          }
+        },
+        {
+          "p": "Il GID è letto con <code>stat</code> sull'host e scritto all'ingresso <code>devN</code>; i gruppi <code>render</code> e <code>video</code> non si presume abbiano un numero fisso. Il dispositivo mantiene lo stesso percorso <code>/dev</code> all'interno del LXC, dove i propri meccanismi dell'applicazione lo cercano."
+        }
+      ]
+    },
+    {
+      "id": "profiles",
+      "title": "Profili che un’immagine può offrire",
+      "blocks": [
+        {
+          "table": {
+            "headers": [
+              "Profilo",
+              "Configurazione risultante",
+              "Offerto quando"
+            ],
+            "rows": [
+              [
+                "Intel/AMD VA-API",
+                "Nodo di rendering <code>/dev/dri</code>",
+                "L'applicazione supporta l'accelerazione video"
+              ],
+              [
+                "OpenCL",
+                "Nodo di rendering, <code>/dev/kfd</code> quando necessario e mod ufficiale",
+                "L'immagine o il profilo lo documentano"
+              ],
+              [
+                "NVIDIA",
+                "Dispositivi driver e librerie dell'host",
+                "L’host dispone di un driver funzionante e di NVIDIA Container Toolkit"
+              ],
+              [
+                "Coral",
+                "<code>/dev/apex_0</code> o il bus USB",
+                "Il profilo dichiara il supporto Coral (Frigate)"
+              ],
+              [
+                "USB, seriale, FUSE",
+                "Un singolo dispositivo, un albero convalidato o una funzione LXC",
+                "Il contratto lo chiede"
+              ]
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "nvidia",
+      "title": "NVIDIA",
+      "blocks": [
+        {
+          "calloutWarning": {
+            "title": "Requisito del nodo: NVIDIA Container Toolkit",
+            "body": "Un driver funzionante su Proxmox VE non è sufficiente per dare un NVIDIA GPU ad un'immagine OCI. OCI manager Apps utilizza <code>nvidia-container-cli</code>, dal NVIDIA Container Toolkit, per identificare i dispositivi e per ottenere i binari e le librerie che corrispondono al driver caricato."
+          }
+        },
+        {
+          "p": "L’<nvidiaLink>installatore NVIDIA di ProxMenux</nvidiaLink> installa NVIDIA Container Toolkit dal repository ufficiale NVIDIA insieme al driver. Controlla i quattro pacchetti, convalida <code>nvidia-container-cli</code> e registra il risultato nel registro delle modifiche di <auditLink>Audit & Report</auditLink>."
+        },
+        {
+          "p": "Questi due comandi sull'host mostrano se il driver e il Toolkit sono disponibili:"
+        },
+        {
+          "shell": {
+            "code": "nvidia-smi -L\nnvidia-container-cli --version"
+          }
+        },
+        {
+          "p": "Su un host dove il driver è stato installato con altri mezzi, il Toolkit è installato dal repository ufficiale stabile:"
+        },
+        {
+          "shell": {
+            "code": "apt-get update\napt-get install -y --no-install-recommends ca-certificates curl gnupg2\n\ncurl -fsSL https://nvidia.github.io/libnvidia-container/gpgkey \\\n  | gpg --dearmor -o /usr/share/keyrings/nvidia-container-toolkit-keyring.gpg\n\ncurl -s -L https://nvidia.github.io/libnvidia-container/stable/deb/nvidia-container-toolkit.list \\\n  | sed 's#deb https://#deb [signed-by=/usr/share/keyrings/nvidia-container-toolkit-keyring.gpg] https://#g' \\\n  > /etc/apt/sources.list.d/nvidia-container-toolkit.list\n\napt-get update\napt-get install -y nvidia-container-toolkit libnvidia-container-tools"
+          }
+        },
+        {
+          "p": "L’inventario utilizzato da OCI manager Apps è l'output di:"
+        },
+        {
+          "shell": {
+            "code": "nvidia-container-cli list --device all --libraries --binaries --firmwares --ipcs"
+          }
+        },
+        {
+          "calloutInfo": {
+            "title": "La configurazione di runtime Docker non è coinvolta",
+            "body": "I container sono LXC nativi e non usano un demone Docker, quindi <code>nvidia-ctk runtime configure --runtime=docker</code> non interviene: ProxMenux interroga direttamente <code>nvidia-container-cli</code> e configura dispositivi e montaggi LXC. I comandi e le piattaforme supportate sono mantenuti nella <toolkitLink>guida di installazione di NVIDIA Container Toolkit</toolkitLink>."
+          }
+        },
+        {
+          "cards": {
+            "items": [
+              {
+                "icon": "cpu",
+                "title": "Inventario dal driver",
+                "body": "<code>nvidia-container-cli</code> elenca i nodi del dispositivo, i binari, il firmware e le librerie del driver installato."
+              },
+              {
+                "icon": "refresh",
+                "title": "Nessuna versione fissa",
+                "body": "Il modello non nomina i file della libreria. Il profilo viene generato dall'host corrente."
+              },
+              {
+                "icon": "shield",
+                "title": "Montaggi in sola lettura",
+                "body": "Le librerie ospitanti sono montate in sola lettura invece di essere copiate nel contenitore."
+              },
+              {
+                "icon": "hardDrive",
+                "title": "Modifiche dei driver",
+                "body": "Dopo che un driver cambia l'inventario viene generato nuovamente prima dell'avvio dei LXC colpiti."
+              }
+            ]
+          }
+        },
+        {
+          "code": {
+            "title": "Risultati NVIDIA (semplificati)",
+            "code": "devN: path=/dev/nvidia0,...\ndevN: path=/dev/nvidiactl,...\ndevN: path=/dev/nvidia-uvm,...\nlxc.mount.entry: HOST_LIBRARY CONTAINER_LIBRARY none ro,bind,create=file 0 0"
+          }
+        },
+        {
+          "p": "Passare solo <code>/dev/nvidia0</code> non è sufficiente. I componenti user-space del driver caricato sono montati in sola lettura e <code>nvidia-smi</code> poi funziona all'interno del LXC per confrontare GPU, UUID, PCI bus e versione con l'inventario host."
+        }
+      ]
+    },
+    {
+      "id": "usb",
+      "title": "USB, seriale e USB Coral",
+      "blocks": [
+        {
+          "calloutWarning": {
+            "title": "Numerazione USB può cambiare",
+            "body": "Un percorso come <code>/dev/bus/usb/003/004</code> può cambiare quando il dispositivo viene ricollegato o l'host si riavvia. Il profilo registra il fornitore, il prodotto e la serie quando sono disponibili, ma un nuovo indirizzo del bus non viene rimappato automaticamente."
+          }
+        },
+        {
+          "p": "Una periferica è data dal suo nodo specifico: <code>/dev/ttyUSB0</code>, <code>/dev/ttyACM0</code>, <code>/dev/apex_0</code> o <code>/dev/bus/usb/BBB/DDD</code>. Passare l'intero <code>/dev</code> non è accettato. Coral è offerto solo a applicazioni il cui profilo lo dichiara."
+        }
+      ]
+    },
+    {
+      "id": "trees",
+      "title": "Alberi dei dispositivi e funzionalità LXC",
+      "blocks": [
+        {
+          "table": {
+            "headers": [
+              "Richiesta",
+              "Configurazione risultante",
+              "Ambito"
+            ],
+            "rows": [
+              [
+                "<code>/dev/dvb</code>, <code>/dev/snd</code> o <code>/dev/bus/usb</code>",
+                "Ogni nodo di carattere dell'albero ottiene il proprio ingresso <code>devN</code> con la modalità host e GID",
+                "Solo l'albero richiesto, non il resto di <code>/dev</code>"
+              ],
+              [
+                "<code>/dev/fuse</code>",
+                "Il nodo e, quando il profilo ne ha bisogno, la funzione <code>fuse=1</code>",
+                "FUSE da solo non rende disponibili i montaggi agli altri LXC"
+              ],
+              [
+                "<code>/dev/net/tun</code>",
+                "Un ingresso <code>devN</code> nello stesso percorso all'interno del LXC",
+                "La configurazione VPN o di rete rimane nell’applicazione"
+              ],
+              [
+                "<code>/dev/kvm</code>",
+                "Una voce valida <code>devN</code>",
+                "Offerto solo quando il contratto lo chiede"
+              ]
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "security",
+      "title": "Conferma per livello di rischio",
+      "blocks": [
+        {
+          "p": "Dispositivi concreti, privilegio facoltativo, privilegio richiesto, allentamento di AppArmor o seccomp e accesso al namespace PID host sono trattati come casi separati, non sotto una generica etichetta privilegiata. Ogni opzione con un rischio viene spiegata e confermata durante l'installazione."
+        }
+      ]
+    }
+  ]
+}
diff --git a/web/messages/it/docs/oci-manager/index.json b/web/messages/it/docs/oci-manager/index.json
new file mode 100644
index 00000000..62358d6c
--- /dev/null
+++ b/web/messages/it/docs/oci-manager/index.json
@@ -0,0 +1,213 @@
+{
+  "meta": {
+    "title": "OCI manager Apps | ProxMenux",
+    "description": "Esegui immagini OCI ufficiali come container LXC nativi di Proxmox VE, con dati persistenti, accesso ai dispositivi, applicazioni composte da più container e aggiornamenti transazionali."
+  },
+  "header": {
+    "title": "OCI manager Apps",
+    "description": "Le immagini OCI ufficiali vengono eseguite come container LXC nativi di Proxmox VE. L’immagine rimane quella pubblicata dal manutentore; ProxMenux ricrea l’ambiente che Docker Compose avrebbe predisposto intorno ad essa.",
+    "section": "OCI manager Apps"
+  },
+  "sections": [
+    {
+      "id": "model",
+      "blocks": [
+        {
+          "calloutInfo": {
+            "title": "Un’immagine OCI, un LXC nativo",
+            "body": "Nei container non viene eseguito Docker Engine. Proxmox VE importa il filesystem dell’immagine e i suoi metadati OCI. L’applicazione diventa il processo principale di un LXC nativo, gestito con gli stessi strumenti degli altri container del nodo."
+          }
+        },
+        {
+          "flow": {
+            "nodes": [
+              {
+                "label": "Origine",
+                "detail": "Immagine OCI\nCompose e documentazione"
+              },
+              {
+                "label": "ProxMenux",
+                "detail": "Contratto JSON\nvalidazione e pianificazione"
+              },
+              {
+                "label": "Proxmox VE",
+                "detail": "LXC nativo\nvolumi e dispositivi"
+              }
+            ],
+            "caption": "Si usa l’applicazione originale: il suo ambiente viene descritto in modo dichiarativo e riprodotto."
+          }
+        }
+      ]
+    },
+    {
+      "id": "where",
+      "title": "Dove si trova",
+      "intro": "Sul nodo Proxmox, come root, apri <strong>OCI manager Apps (Technology Preview)</strong> dal menu principale di ProxMenux. La prima schermata offre:",
+      "blocks": [
+        {
+          "list": {
+            "items": [
+              "<strong>Cerca applicazioni</strong>: cerca per nome nell’intero catalogo.",
+              "<strong>Tutte le applicazioni</strong>: mostra il catalogo completo e il numero di applicazioni.",
+              "<strong>Gestisci le applicazioni OCI installate</strong>: aggiorna, modifica, rimuovi o recupera le applicazioni già installate.",
+              "<strong>Account dei registri</strong>: gestisci gli account usati per installare e aggiornare immagini da registri privati.",
+              "<strong>Installa un’immagine non presente nel catalogo</strong>: adatta un file Compose, un comando <code>docker run</code> o un riferimento a un’immagine.",
+              "Le categorie del catalogo, ciascuna con il numero di applicazioni."
+            ]
+          }
+        },
+        {
+          "figure": {
+            "src": "/oci-manager/main-menu.png",
+            "alt": "Schermata principale di OCI manager Apps con ricerca, catalogo completo, gestione delle applicazioni, immagini fuori catalogo e categorie.",
+            "caption": "Schermata principale di OCI manager Apps."
+          }
+        },
+        {
+          "p": "Selezionando un’applicazione vengono mostrati la descrizione, l’immagine usata e due modalità di installazione. <strong>Installa con le impostazioni predefinite</strong> chiede solo le scelte essenziali: storage, posizione dei dati, indirizzo e avvio. <strong>Installa con le impostazioni avanzate</strong> presenta tutte le decisioni in ordine: VMID e risorse, storage per ogni percorso, bridge di rete e dispositivi."
+        },
+        {
+          "p": "Le applicazioni provate sul campo mostrano <strong>Verificato</strong> in questa schermata e un ✓ negli elenchi, sia per i test del laboratorio ProxMenux sia per quelli della community."
+        }
+      ]
+    },
+    {
+      "id": "beta",
+      "title": "Perché mantiene l’etichetta Technology Preview",
+      "blocks": [
+        {
+          "p": "OCI manager Apps mantiene l’etichetta <strong>Technology Preview</strong> assegnata da Proxmox VE ai container applicativi creati da immagini OCI, il cui supporto è stato introdotto in Proxmox VE 9.1. L’etichetta riguarda la tecnologia su cui si basa OCI manager Apps, non il motore di ProxMenux: il comportamento di questi container può ancora cambiare tra le versioni di Proxmox VE. Rimarrà finché Proxmox VE non considererà stabile tale supporto."
+        },
+        {
+          "p": "Il motore di OCI manager Apps viene testato nel laboratorio ProxMenux: installazione, aggiornamento, modifica, ricreazione, backup, ripristino, migrazione e watchdog. Ogni applicazione viene verificata separatamente. Quelle provate sul campo mostrano <strong>Verificato</strong> e un ✓ negli elenchi."
+        }
+      ]
+    },
+    {
+      "id": "translation",
+      "title": "Come Docker descrive i requisiti e come li realizza OCI manager Apps",
+      "blocks": [
+        {
+          "table": {
+            "headers": [
+              "Requisito",
+              "Come lo esprime Docker",
+              "Come lo realizza OCI manager Apps"
+            ],
+            "rows": [
+              [
+                "Eseguire l’applicazione",
+                "<code>image</code>, <code>entrypoint</code>, <code>command</code>",
+                "Il rootfs OCI e il processo principale dell’LXC"
+              ],
+              [
+                "Conservare la configurazione",
+                "<code>volumes: /config</code>",
+                "Un volume persistente <code>mpN</code> incluso nel backup, oppure una directory dell’host."
+              ],
+              [
+                "Rendere accessibile il servizio",
+                "<code>ports</code>",
+                "Un indirizzo proprio per l’LXC e l’URL di accesso al servizio."
+              ],
+              [
+                "Usare l’hardware",
+                "<code>devices</code>, <code>group_add</code>",
+                "Voci <code>devN</code> con il GID effettivo dell’host e un profilo validato."
+              ],
+              [
+                "Collegare le dipendenze",
+                "<code>networks</code>, <code>depends_on</code>",
+                "Un bridge di rete privato, indirizzi fissi, ordine di avvio e controlli di stato."
+              ],
+              [
+                "Aggiornare",
+                "Scaricare con <code>pull</code> e ricreare",
+                "Un nuovo rootfs che mantiene lo stesso contratto di persistenza."
+              ]
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "kept",
+      "title": "Cosa viene conservato e cosa cambia",
+      "blocks": [
+        {
+          "cards": {
+            "items": [
+              {
+                "icon": "archive",
+                "title": "Conservato",
+                "body": "L’immagine ufficiale, i percorsi interni, l’ambiente, il processo di avvio e la documentazione d’uso."
+              },
+              {
+                "icon": "boxes",
+                "title": "Adattato",
+                "body": "L’ambiente di esecuzione: rete, persistenza, dispositivi, permessi e dipendenze utilizzano i meccanismi LXC nativi di Proxmox VE."
+              },
+              {
+                "icon": "shield",
+                "title": "Senza equivalente",
+                "body": "Un’opzione Compose senza un equivalente sicuro viene segnalata come requisito bloccante. I modelli con requisiti bloccanti non vengono proposti per l’installazione e le opzioni sensibili richiedono conferma durante la procedura."
+              },
+              {
+                "icon": "refresh",
+                "title": "Registrato",
+                "body": "Il digest dell’immagine, le risorse, i percorsi, la rete, i dispositivi e l’appartenenza a uno stack vengono salvati nel contratto dell’istanza. Aggiornamenti e ricreazioni riproducono tale contratto."
+              }
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "pages",
+      "title": "Pagine di questa sezione",
+      "blocks": [
+        {
+          "next": {
+            "items": [
+              {
+                "label": "Come viene adattata un’immagine OCI",
+                "href": "/docs/oci-manager/architecture",
+                "tail": "Dall’immagine e dal suo file Compose a un LXC nativo."
+              },
+              {
+                "label": "Installare un’immagine non presente nel catalogo",
+                "href": "/docs/oci-manager/custom-image",
+                "tail": "Un file Compose, un comando docker run o un riferimento a un’immagine."
+              },
+              {
+                "label": "Dati, percorsi e rete",
+                "href": "/docs/oci-manager/storage-network",
+                "tail": "Volumi del container, directory dell’host, mount con rclone e indirizzi."
+              },
+              {
+                "label": "Dispositivi e accelerazione",
+                "href": "/docs/oci-manager/hardware",
+                "tail": "GPU, NVIDIA, Coral, USB e altri dispositivi."
+              },
+              {
+                "label": "Applicazioni con più container",
+                "href": "/docs/oci-manager/stacks",
+                "tail": "Applicazione, database e cache in LXC coordinati."
+              },
+              {
+                "label": "Installazione, aggiornamento e modifica",
+                "href": "/docs/oci-manager/lifecycle",
+                "tail": "Il contratto dell’istanza e le sue operazioni."
+              },
+              {
+                "label": "In ProxMenux Monitor",
+                "href": "/docs/oci-manager/monitor",
+                "tail": "Versioni, aggiornamenti, output della console e terminale."
+              }
+            ]
+          }
+        }
+      ]
+    }
+  ]
+}
diff --git a/web/messages/it/docs/oci-manager/lifecycle.json b/web/messages/it/docs/oci-manager/lifecycle.json
new file mode 100644
index 00000000..a0271b28
--- /dev/null
+++ b/web/messages/it/docs/oci-manager/lifecycle.json
@@ -0,0 +1,499 @@
+{
+  "meta": {
+    "title": "Installare, aggiornare e modificare | ProxMenux",
+    "description": "Il contratto di istanza di un contenitore OCI e le operazioni che lo utilizzano: aggiornamento, modifica, rimozione, recupero di un'operazione interrotta e recupero dopo un ripristino su questo o un altro host."
+  },
+  "header": {
+    "title": "Installare, aggiornare e modificare",
+    "description": "Ogni istanza conserva un contratto riproducibile, così il suo rootfs può essere sostituito senza perdere la configurazione o i dati persistenti.",
+    "section": "OCI manager Apps"
+  },
+  "sections": [
+    {
+      "id": "contract",
+      "title": "Il contratto di istanza",
+      "blocks": [
+        {
+          "p": "Dopo l'installazione, la configurazione effettiva viene salvata in <code>/usr/local/share/proxmenux/oci/instances/VMID/oci-compose.json</code>. Non è una copia del file Compose originale: è il contratto riproducibile del LXC presente su questo host."
+        },
+        {
+          "code": {
+            "code": "instances/\n└── 105/\n    └── oci-compose.json\n        ├── image and resolved digest\n        ├── resources and network\n        ├── environment (secrets protected)\n        ├── container disks and host directories\n        ├── hardware profile and devices\n        ├── console log and terminal mode\n        └── stack membership and lifecycle"
+          }
+        },
+        {
+          "p": "Una copia del contratto si trova nel contenitore, in <code>/.proxmenux/oci-record.json</code>, ed è leggibile solo dall'utente root del contenitore. Il backup del contenitore include quindi sempre il contratto in uso in quel momento. Una seconda copia si trova in <code>/etc/pve/priv/proxmenux/oci</code>, condiviso da tutti i nodi del cluster e leggibile solo da root dell'host. Entrambe le copie vengono scritte dopo ogni installazione, aggiornamento e modifica."
+        }
+      ]
+    },
+    {
+      "id": "manage",
+      "title": "Gestisci le applicazioni OCI installate",
+      "intro": "Questa opzione della schermata principale elenca le istanze registrate con la relativa applicazione e immagine. Prima di ogni azione, ciascuna istanza viene confrontata con il proprio contratto; un CT che non corrisponde più al proprio record non viene né modificato né eliminato. Lo stesso aggiornamento e lo stesso editor sono disponibili nella scheda Aggiornamenti di <monitorLink>ProxMenux Monitor</monitorLink>.",
+      "blocks": [
+        {
+          "table": {
+            "headers": [
+              "Opzione",
+              "Che cosa cambia",
+              "Che cosa viene conservato"
+            ],
+            "rows": [
+              [
+                "Aggiorna l’immagine mantenendo la configurazione salvata",
+                "Il rootfs viene sostituito dall'immagine attualmente pubblicata dal canale salvato",
+                "Contratto, dischi container, directory host, rete e dispositivi"
+              ],
+              [
+                "Modifica risorse, rete, percorsi e GPU",
+                "L’editor si apre con il contratto attuale; il CT viene ricreato con le modifiche",
+                "I dati dei dischi container e delle directory host"
+              ],
+              [
+                "Watchdog: riavviare l'applicazione quando si blocca",
+                "Determina se l'applicazione viene riavviata quando si arresta da sola. Non viene ricreato nulla",
+                "L'intera installazione; solo la scelta viene salvata nel contratto"
+              ],
+              [
+                "Rimuovi: elimina l'applicazione e i suoi container",
+                "Il LXC, o ogni membro di uno stack, e i loro contratti vengono eliminati",
+                "Directory dell’host, con il loro contenuto"
+              ]
+            ]
+          }
+        },
+        {
+          "p": "Per un'applicazione con più contenitori, il menu offre <strong>Aggiorna tutti i contenitori dell'applicazione</strong>, <strong>Modifica percorsi e dispositivi aggiuntivi</strong>, <strong>Ricrea tutti i contenitori con la configurazione salvata</strong>, il watchdog e la rimozione. Modifica aggiunge o rimuove percorsi e dispositivi aggiuntivi del contenitore applicativo senza ricreare nulla e, in Immich, cambia il componente che esegue il riconoscimento. Ricrea ricostruisce ogni contenitore dall'immagine usata per installarlo, senza cercarne una più recente."
+        },
+        {
+          "figure": {
+            "src": "/oci-manager/manage-menu.png",
+            "alt": "Elenco delle applicazioni OCI installate e delle opzioni di aggiornamento, modifica e rimozione",
+            "caption": "Gestione delle applicazioni OCI installate."
+          }
+        }
+      ]
+    },
+    {
+      "id": "update",
+      "title": "Un aggiornamento transazionale",
+      "blocks": [
+        {
+          "mermaid": {
+            "chartCode": "sequenceDiagram\n participant U as {{user}}\n participant P as ProxMenux\n participant R as {{registry}}\n participant X as Proxmox VE\n U->>P: {{update}}\n P->>R: {{resolve}}\n R-->>P: digest\n P->>P: {{verify}}\n P->>X: {{backup}}\n P->>X: {{import}}\n P->>X: {{reapply}}\n X-->>P: healthcheck\n alt {{healthy}}\n  P-->>U: {{commit}}\n else {{failure}}\n  P->>X: Rollback\n  P-->>U: {{restored}}\n end",
+            "labels": {
+              "user": "Utente",
+              "registry": "Registro OCI",
+              "update": "Aggiorna istanza",
+              "resolve": "Risolvere il tag",
+              "verify": "Verifica archivio e controlli preliminari",
+              "backup": "Arresta e salva un backup del CT",
+              "import": "Importa il nuovo rootfs",
+              "reapply": "Applicare nuovamente il contratto",
+              "healthy": "integro",
+              "failure": "guasto",
+              "commit": "Contratto pubblicato con il nuovo digest",
+              "restored": "Precedente istanza ripristinata"
+            }
+          }
+        },
+        {
+          "list": {
+            "items": [
+              "Se il registro restituisce ancora il digest installato, non viene scaricato nulla e l’istanza rimane invariata.",
+              "La nuova immagine viene verificata livello per livello prima di arrestare il CT. Un download danneggiato viene ripetuto una seconda volta; un’immagine già nella cache che non supera la verifica viene scaricata di nuovo.",
+              "Le impostazioni modificate in Proxmox VE dopo l’installazione (memoria, swap, core, limite e priorità della CPU, avvio con il nodo) vengono conservate e incluse nel nuovo contratto.",
+              "L'interfaccia LAN che la suite Arr e le applicazioni multi-container aggiungono (<code>net1</code>) e l'ordine di avvio (<code>startup</code>) sono restituiti al nuovo contenitore come sono.",
+              "Qualsiasi altra differenza tra il CT e il suo contratto interrompe l’aggiornamento prima che il CT venga arrestato."
+            ]
+          }
+        },
+        {
+          "flow": {
+            "nodes": [
+              {
+                "label": "Prima",
+                "detail": "rootfs A\n/config mp0\ndirectory host /media"
+              },
+              {
+                "label": "Aggiornamento",
+                "detail": "sostituisce solo\nil rootfs"
+              },
+              {
+                "label": "Dopo",
+                "detail": "rootfs B\n/config mp0\ndirectory host /media"
+              }
+            ]
+          }
+        },
+        {
+          "p": "Prima di arrestare qualsiasi cosa, l’operazione verifica lo spazio necessario al backup: i dati in uso nei volumi inclusi, più un margine. Il backup viene scritto accanto al record dell’applicazione, sul disco di sistema dell’host. Se lo spazio non basta, il menu richiede un altro storage dell’host che supporti i backup: il backup viene creato lì ed eliminato al termine dell’operazione. La scelta viene memorizzata per l’applicazione, anche per gli aggiornamenti pianificati. Se nessuno storage ha spazio sufficiente, l’operazione viene rifiutata e l’applicazione resta invariata. Anche lo spazio per la nuova immagine viene verificato prima del download."
+        }
+      ]
+    },
+    {
+      "id": "recovery",
+      "title": "Recuperare un'operazione interrotta",
+      "intro": "L’aggiornamento e la modifica usano una transazione persistente. Se il processo, il terminale o il nodo subisce un’interruzione dopo l’arresto del CT, l’operazione non viene considerata conclusa.",
+      "blocks": [
+        {
+          "steps": {
+            "items": [
+              {
+                "title": "Indicatore di operazione in sospeso",
+                "body": "Aprendo Gestisci le applicazioni OCI installate, lo stato salvato indica che la sostituzione non è mai stata pubblicata."
+              },
+              {
+                "title": "Visualizza stato",
+                "body": "Mostra la fase raggiunta senza cambiare contenitori o dati."
+              },
+              {
+                "title": "Ripristina l’installazione precedente",
+                "body": "Ripristina il backup nativo verificato eseguito prima della sostituzione e il contratto precedente."
+              },
+              {
+                "title": "Stacks come unità",
+                "body": "Per un'applicazione multicontainer, ogni membro viene recuperato dallo stesso punto di transazione, non solo quello selezionato."
+              }
+            ]
+          }
+        },
+        {
+          "calloutWarning": {
+            "title": "Le directory dell’host sono escluse dal rollback",
+            "body": "Il backup comprende il rootfs e i dischi del contenitore inclusi nella copia. Una directory dell’host non viene riportata allo stato precedente, perché altri LXC potrebbero usarne i dati."
+          }
+        }
+      ]
+    },
+    {
+      "id": "watchdog",
+      "title": "Watchdog: riavviare un’applicazione che si arresta",
+      "intro": "Proxmox non ha una politica di riavvio: quando termina il processo di un contenitore applicativo, il contenitore resta arrestato. Con il watchdog attivo, un’applicazione che si arresta da sola viene riavviata. Per un’applicazione OCI svolge il ruolo di <code>restart: unless-stopped</code> in un file Compose.",
+      "blocks": [
+        {
+          "table": {
+            "headers": [
+              "Cosa succede?",
+              "Con il watchdog attivo"
+            ],
+            "rows": [
+              [
+                "L'applicazione si blocca o il suo processo termina",
+                "Il contenitore viene riavviato entro pochi secondi"
+              ],
+              [
+                "Viene fermato o spento da Proxmox, dal Monitor o con <code>pct</code>",
+                "Resta arrestato finché qualcuno non lo avvia"
+              ],
+              [
+                "Un backup, una migrazione o un'operazione ProxMenux sta lavorando su di esso",
+                "Niente è fatto fino a che non finisce"
+              ],
+              [
+                "Era già arrestato all’avvio dell’host",
+                "Resta arrestato; lo decide <strong>Avvia con Proxmox</strong>"
+              ],
+              [
+                "Continua ad arrestarsi subito dopo l’avvio",
+                "Per un’applicazione che si arresta pochi secondi dopo l’avvio o che non si avvia, vengono effettuati cinque tentativi, con attese di 30 secondi, 1, 2 e 5 minuti tra un tentativo e l’altro. Poi viene lasciata arrestata e viene inviata una notifica"
+              ]
+            ]
+          }
+        },
+        {
+          "p": "L’installatore lo chiede in entrambe le modalità e propone il valore dichiarato nella ricetta dell’applicazione. In seguito si può cambiare da <strong>Gestisci le applicazioni OCI installate</strong> o con l’interruttore <strong>Watchdog</strong> del contenitore in <monitorLink>ProxMenux Monitor</monitorLink>; vale per tutti i contenitori di un’applicazione con più contenitori. Un unico servizio dell’host, <code>proxmenux-oci-watchdog.service</code>, sorveglia tutte le applicazioni che lo hanno richiesto; la sua installazione compare nella scheda Modifiche di Audit & Report."
+        },
+        {
+          "calloutInfo": {
+            "title": "Ciò che l’host non può distinguere",
+            "body": "Il codice di uscita dell’applicazione non raggiunge l’host: un’uscita regolare e un arresto anomalo risultano quindi indistinguibili e in entrambi i casi l’applicazione viene riavviata, come con <code>always</code> e <code>unless-stopped</code> in Docker. Un arresto richiesto fuori da Proxmox, con <code>lxc-stop</code> o <code>systemctl</code>, non lascia un’attività di arresto e viene interpretato come un arresto spontaneo."
+          }
+        }
+      ]
+    },
+    {
+      "id": "restore",
+      "title": "Backup, ripristino e un altro host",
+      "intro": "Un backup creato con vzdump o Proxmox Backup Server include il contenitore, i dischi del contenitore selezionati per il backup e la copia del suo contratto. Ciò che l’installazione conserva sull’host non vi è incluso. <strong>Gestisci le applicazioni OCI installate</strong> rileva i contenitori ripristinati su un host privo del loro contratto, dopo una nuova installazione di Proxmox o su un altro host, e propone di registrarli di nuovo.",
+      "blocks": [
+        {
+          "steps": {
+            "items": [
+              {
+                "title": "Ripristinare i contenitori in Proxmox",
+                "body": "Dall'archivio di backup, con l'ID originale o con uno qualsiasi libero. Un'applicazione multi-container ha bisogno di tutti i suoi contenitori."
+              },
+              {
+                "title": "Apri Gestisci applicazioni OCI installate",
+                "body": "Vengono elencati i contenitori ripristinati e viene proposto il recupero. Il pulsante <strong>Recupera</strong> nella scheda Aggiornamenti di <monitorLink>ProxMenux Monitor</monitorLink> apre lo stesso recupero."
+              },
+              {
+                "title": "Controllare prima di cambiare",
+                "body": "Il recupero verifica che l’host disponga di tutto ciò che serve a ciascuna applicazione. Se un’applicazione non può essere recuperata interamente, viene lasciata invariata e viene indicato il motivo."
+              },
+              {
+                "title": "Registra e avvia",
+                "body": "Il contratto viene registrato su questo host e gli elementi che l’installazione vi conservava vengono riscritti. L’avvio delle applicazioni viene chiesto separatamente: rispondi No se i contenitori originali sono ancora in esecuzione su un altro host."
+              }
+            ]
+          }
+        },
+        {
+          "figure": {
+            "src": "/oci-manager/restore-offer.png",
+            "alt": "Finestra di dialogo che elenca i contenitori ripristinati e ne propone il recupero",
+            "caption": "Il recupero offerto quando si apre Gestione applicazioni OCI installate."
+          }
+        },
+        {
+          "table": {
+            "headers": [
+              "Ciò che l’host conservava",
+              "Dopo il recupero"
+            ],
+            "rows": [
+              [
+                "Contratto dell’istanza",
+                "Registrato dalla copia presente nel contenitore, verificata rispetto alla configurazione ripristinata da Proxmox"
+              ],
+              [
+                "Rete privata di un'applicazione multicontainer",
+                "Creato nuovamente con lo stesso ponte e sottorete; gli indirizzi fissi dei contenitori non cambiano"
+              ],
+              [
+                "Ordine di avvio di un’applicazione con più contenitori",
+                "L’hookscript delle dipendenze e il suo contratto vengono reinstallati; gli snippet vengono abilitati nello storage <code>local</code> se nessuno storage li supporta"
+              ],
+              [
+                "Sysctl di rete e file del monitor dell’host",
+                "Scritto di nuovo in <code>/etc/pve/proxmenux</code>"
+              ],
+              [
+                "Runtime NVIDIA",
+                "L’hook di un contenitore non privilegiato viene reinstallato. Un contenitore privilegiato riceve i file del driver di questo host al posto di quelli dell’host di origine"
+              ],
+              [
+                "Montaggio Rclone",
+                "L’hookscript e i programmi che rendono disponibile il mount vengono riscritti, con le stesse viste sull’host"
+              ],
+              [
+                "Regola del firewall host di un monitor host",
+                "Viene chiesto di nuovo, per la sua porta web e la sottorete del bridge su questo host"
+              ],
+              [
+                "<code>lost+found</code> di ogni disco restaurato",
+                "Viene rimosso se vuoto; il ripristino lo crea e alcune applicazioni non si avviano se è presente tra i loro dati"
+              ],
+              [
+                "Dischi ripristinati su un altro storage",
+                "Il contratto viene aggiornato con lo storage su cui si trovano ora"
+              ]
+            ]
+          }
+        },
+        {
+          "p": "Un container ripristinato con un ID diverso conserva la propria applicazione. Il contratto, il log della console, i parametri sysctl di rete, lo hookscript del montaggio Rclone e l’ordine di avvio di un’applicazione composta da più container vengono registrati usando gli ID assegnati ai container su questo host."
+        },
+        {
+          "table": {
+            "headers": [
+              "Cosa ferma un recupero",
+              "Cosa fare"
+            ],
+            "rows": [
+              [
+                "Manca un contenitore di un'applicazione multi-container",
+                "Ripristina anche quello; l’applicazione viene recuperata per intero"
+              ],
+              [
+                "La sottorete privata è già utilizzata su questo host",
+                "Il recupero è annullato e nulla è cambiato: gli indirizzi dei contenitori sono fissi e non vengono spostati in un'altra subnet"
+              ],
+              [
+                "Una directory host non esiste",
+                "Montare o crearlo con i suoi dati; un backup del contenitore non include directory host"
+              ],
+              [
+                "Un dispositivo non esiste su questo host",
+                "Collegarlo o rimuoverlo dal contenitore in Proxmox"
+              ],
+              [
+                "Un'applicazione con NVIDIA su un host senza driver",
+                "Installa il driver NVIDIA e il Container Toolkit"
+              ],
+              [
+                "Il backup è stato fatto prima che la copia del contratto esistesse",
+                "Il contenitore rimane come un normale LXC e non viene offerto di nuovo"
+              ]
+            ]
+          }
+        },
+        {
+          "calloutInfo": {
+            "title": "Un contenitore che ritorna",
+            "body": "Un contenitore ripristinato su se stesso da un backup precedente, riportato a uno snapshot o rientrato da un altro nodo porta il contratto dello stato in cui si trova. Se viene selezionato per un’operazione e il suo contratto differisce da quello dell’host, l’operazione non parte e viene proposto il recupero del contenitore."
+          }
+        },
+        {
+          "figure": {
+            "src": "/oci-manager/restore-result.png",
+            "alt": "Risultato del recupero con la rete privata, l’ordine di avvio e i contenitori registrati",
+            "caption": "Il risultato di un recupero, passo dopo passo."
+          }
+        }
+      ]
+    },
+    {
+      "id": "remove",
+      "title": "Rimozione di un'applicazione OCI",
+      "blocks": [
+        {
+          "p": "Prima della conferma viene creato un riepilogo dalla configurazione effettiva: i contenitori da rimuovere, i dati eliminati insieme a loro, la rete privata liberata e le directory dell’host conservate. La conferma è impostata su <strong>No</strong> per impostazione predefinita, perché i dati dei dischi eliminati non possono essere recuperati in seguito."
+        },
+        {
+          "table": {
+            "headers": [
+              "Risorsa",
+              "Alla rimozione",
+              "Motivo"
+            ],
+            "rows": [
+              [
+                "rootfs e dischi del contenitore",
+                "Eliminati",
+                "Essi appartengono solo al contenitore"
+              ],
+              [
+                "Directory host",
+                "Tenuto, con il suo contenuto",
+                "Altre applicazioni possono utilizzarlo"
+              ],
+              [
+                "File host del contenitore",
+                "Eliminati",
+                "Il log della console, i parametri sysctl di rete, l’hookscript del mount Rclone e la registrazione nella scheda App di ProxMenux Monitor non servono ad altri contenitori"
+              ],
+              [
+                "File condivisi da più installazioni",
+                "Eliminato con l'ultima installazione che li utilizza",
+                "Il file del monitor dell’host e l’hookscript delle dipendenze delle applicazioni con più contenitori"
+              ],
+              [
+                "Contratto dell’istanza",
+                "Eliminato dopo una rimozione di successo",
+                "Non vi è più associato alcun CT"
+              ],
+              [
+                "Ponte privato di una pila",
+                "Rilasciato con lo stack",
+                "Non ha più membri da collegare"
+              ],
+              [
+                "Rete condivisa dalla suite Arr",
+                "Rilasciato con l'ultima applicazione della suite",
+                "Ogni applicazione della suite è indipendente e viene rimossa da sola"
+              ],
+              [
+                "Un singolo membro di una pila",
+                "Non rimosso da solo",
+                "L'intera applicazione viene rimossa, quindi nessun stack viene lasciato incompleto"
+              ],
+              [
+                "Un contenitore su un altro nodo del cluster",
+                "Non rimosso",
+                "I suoi file di registrazione e host sono sul nodo dove è stato installato: viene rimosso lì, dopo la migrazione indietro"
+              ]
+            ]
+          }
+        },
+        {
+          "figure": {
+            "src": "/oci-manager/remove-summary.png",
+            "alt": "Riepilogo di rimozione con i container, i dati e le directory host interessate",
+            "caption": "Il sommario di rimozione, costruito dalla configurazione reale."
+          }
+        }
+      ]
+    },
+    {
+      "id": "archives",
+      "title": "Immagini scaricate e spazio host",
+      "blocks": [
+        {
+          "p": "L’archivio OCI serve a costruire il rootfs; il CT in esecuzione non lo legge. Dopo un’installazione o un aggiornamento, gli archivi scaricati durante l’operazione vengono elencati con le loro dimensioni e ne viene proposta l’eliminazione. Eliminarli libera spazio senza influire sul contenitore o sui suoi dati."
+        },
+        {
+          "calloutInfo": {
+            "title": "Gli aggiornamenti non hanno bisogno dell'archivio",
+            "body": "Senza l'archivio, un aggiornamento risolve il canale salvato e scarica il nuovo digest. Con esso, un archivio viene riutilizzato solo quando il suo riferimento e l'integrità corrispondono a ciò che è richiesto."
+          }
+        }
+      ]
+    },
+    {
+      "id": "registry",
+      "title": "Registro e pulizia",
+      "blocks": [
+        {
+          "p": "Aprendo <strong>Gestisci le applicazioni OCI installate</strong>, vengono prima rimossi i resti dei contenitori che non esistono su alcun nodo del cluster: il record conservato come cronologia dopo l’eliminazione dall’interfaccia Proxmox e i file sull’host lasciati da una rimozione. Un record con un’operazione incompleta viene conservato, perché il relativo backup potrebbe ancora servire. Volumi e directory dell’host non vengono mai eliminati per deduzione."
+        }
+      ]
+    },
+    {
+      "id": "cluster",
+      "title": "In un cluster: migrazione e elevata disponibilità",
+      "intro": "Un contenitore OCI è un normale LXC Proxmox: può essere migrato o gestito da HA come gli altri, con gli stessi limiti. Ciò che gli serve per avviarsi viene conservato dove ogni nodo del cluster può trovarlo.",
+      "blocks": [
+        {
+          "table": {
+            "headers": [
+              "Parte",
+              "Su un altro nodo del cluster"
+            ],
+            "rows": [
+              [
+                "Registro della console",
+                "Il contenitore crea <code>/var/log/proxmenux/oci</code> prima di avviarsi, su qualunque nodo lo esegua. Ogni nodo conserva il log degli avvii eseguiti su quel nodo."
+              ],
+              [
+                "Sysctl di rete e monitor dell’host",
+                "Tenuto in <code>/etc/pve/proxmenux</code>, che ogni nodo del cluster condivide, quindi un contenitore migrato li trova."
+              ],
+              [
+                "Dischi del contenitore",
+                "Proxmox li sposta con il contenitore. HA richiede che i dati siano disponibili sul nodo di destinazione tramite storage condiviso o una configurazione di replica supportata."
+              ],
+              [
+                "directory e dispositivi host",
+                "Valgono le stesse regole degli altri LXC: una directory dell’host deve esistere sul nodo di destinazione ed essere contrassegnata come condivisa, e una GPU, un Coral o una NPU deve essere presente su quel nodo."
+              ],
+              [
+                "Record ProxMenux",
+                "Il contratto resta sul nodo in cui l’applicazione è stata installata e ogni nodo legge la copia conservata in <code>/etc/pve/priv/proxmenux/oci</code>. Dopo la migrazione, un’applicazione con un solo contenitore viene registrata sul nodo di destinazione quando si apre <strong>Gestisci le applicazioni OCI installate</strong> o si avvia un’operazione su di essa. Per un’applicazione con più contenitori viene proposto il recupero, perché la rete privata deve essere creata su quel nodo."
+              ]
+            ]
+          }
+        },
+        {
+          "calloutWarning": {
+            "title": "Non per alta disponibilità",
+            "body": "Un'applicazione multicontainer raggiunge i suoi membri attraverso un ponte privato del nodo su cui è stato installato, quindi i suoi membri rimangono su quel nodo. Un monitor host, come Glances in modalità host o Netdata, monitora il nodo su cui corre; spostandolo monitorerebbe un altro nodo."
+          }
+        },
+        {
+          "p": "Quando si recupera l’applicazione, un backup ripristinato fuori dal cluster riceve i file di <code>/etc/pve/proxmenux</code> usati dal contenitore."
+        }
+      ]
+    },
+    {
+      "id": "channel",
+      "title": "Un rolling tag non è un aggiornamento incustodito",
+      "blocks": [
+        {
+          "p": "Il catalogo installa il rolling tag pubblicato dal manutentore, ma il digest effettivo viene risolto e registrato e cambia solo con un aggiornamento esplicito, dotato di controlli preliminari e rollback. <monitorLink>ProxMenux Monitor</monitorLink> confronta il digest installato con quello pubblicato dal registro e segnala, anche con una notifica, la disponibilità di una nuova immagine."
+        }
+      ]
+    }
+  ]
+}
diff --git a/web/messages/it/docs/oci-manager/monitor.json b/web/messages/it/docs/oci-manager/monitor.json
new file mode 100644
index 00000000..ca107f84
--- /dev/null
+++ b/web/messages/it/docs/oci-manager/monitor.json
@@ -0,0 +1,213 @@
+{
+  "meta": {
+    "title": "Contenitori OCI in ProxMenux Monitor | ProxMenux",
+    "description": "Ciò che ProxMenux Monitor mostra per un contenitore installato da OCI manager Apps: versioni di applicazione e immagine, nuove immagini, uscita console e terminale Proxmox VE."
+  },
+  "header": {
+    "title": "In ProxMenux Monitor",
+    "description": "Un contenitore installato da OCI manager Apps appare in VMs & LXCs come qualsiasi altro LXC. Il suo modal legge il record di installazione: versioni di applicazione e immagine, nuove immagini, uscita console e terminale.",
+    "section": "OCI manager Apps"
+  },
+  "sections": [
+    {
+      "id": "intro",
+      "blocks": [
+        {
+          "calloutInfo": {
+            "title": "Il record è la fonte",
+            "body": "OCI manager Apps sa cosa ha installato e da dove viene. Il Monitor legge quel record di installazione invece di interrogare il container, quindi i dati sono gli stessi se il contenitore è in esecuzione o interrotto."
+          }
+        },
+        {
+          "table": {
+            "headers": [
+              "Scheda",
+              "Quali cambiamenti per un contenitore OCI"
+            ],
+            "rows": [
+              [
+                "Stato",
+                "Un commutatore <strong>Watchdog</strong> sotto Start al boot: l'applicazione viene riavviata quando si ferma da sola"
+              ],
+              [
+                "App",
+                "L'applicazione è identificata dal record, e gli aggiornamenti sono tracciati dall'immagine"
+              ],
+              [
+                "Aggiornamenti",
+                "L'immagine viene aggiornata o l'applicazione modificata, con lo stesso flusso del menu OCI"
+              ],
+              [
+                "Montaggi",
+                "Dischi del container e directory dell’host, con il relativo utilizzo"
+              ],
+              [
+                "Log",
+                "Solo per contenitori OCI: l'uscita della console dell'applicazione"
+              ]
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "app",
+      "title": "App",
+      "intro": "La scheda <appLink>App</appLink> offre l'applicazione installata come rilevamento, con il nome, il logo, la porta e lo schema del record. Registrandolo si apre l'editor con il metodo <strong>Immagine OCI (installata da ProxMenux)</strong>, che non ha bisogno di configurazione.",
+      "blocks": [
+        {
+          "cards": {
+            "items": [
+              {
+                "icon": "boxes",
+                "title": "Applicazione",
+                "body": "La versione dell'applicazione all'interno dell'immagine, letta dall'immagine stessa: il suo ambiente o la sua etichetta <code>org.opencontainers.image.version</code>. È informativo."
+              },
+              {
+                "icon": "archive",
+                "title": "Immagine",
+                "body": "La data di creazione e digest dell'immagine installata. L'aggiornamento si decide qui: il digest installato viene confrontato con quello che il registro pubblica oggi per lo stesso tag."
+              }
+            ]
+          }
+        },
+        {
+          "list": {
+            "items": [
+              "Quando il registro pubblica un nuovo digest, la scheda mostra <strong>Nuova immagine</strong> con la sua data e digest, anche se la versione dell'applicazione al suo interno non è cambiata: una ricostruzione su una base aggiornata è un aggiornamento.",
+              "Quando i digest coincidono, la scheda mostra <strong>Versione</strong>.",
+              "La scheda si collega al repository dell'immagine: il suo progetto GitHub, o la sua pagina Hub Docker per un'immagine ufficiale.",
+              "Il collegamento di accesso utilizza l'indirizzo LAN del contenitore, anche per il membro principale di un'applicazione multi-container, che ha un secondo indirizzo sulla sua rete privata.",
+              "Il pulsante <strong>Aggiorna dati</strong> rilegge il record dell’installazione e il registro delle immagini. Non vengono proposte opzioni per cercare o registrare altre applicazioni: il container contiene esattamente l’applicazione descritta nel suo record."
+            ]
+          }
+        },
+        {
+          "figure": {
+            "src": "/oci-manager/monitor-app-tab.png",
+            "alt": "Scheda App di un contenitore OCI con la versione dell'applicazione, l'immagine e il link del repository",
+            "caption": "Scheda app di un contenitore installato da OCI manager Apps."
+          }
+        },
+        {
+          "p": "Il controllo viene eseguito una volta al giorno con i controlli di aggiornamento del Monitor e <strong>Aggiorna dati</strong> lo esegue subito. Una nuova immagine viene inviata come notifica attraverso i canali configurati in <notificationsLink>Notifiche</notificationsLink>. L'aggiornamento viene applicato dalla scheda Aggiornamenti."
+        }
+      ]
+    },
+    {
+      "id": "updates",
+      "title": "Aggiornamenti",
+      "intro": "Per un contenitore installato da OCI manager Apps la scheda Aggiornamenti mostra l'applicazione con la sua immagine installata e, quando il registro pubblica una, la nuova immagine, nello stesso formato di qualsiasi altra applicazione. Gli strumenti di aggiornamento di pacchetti e applicazioni di un normale LXC non appaiono.",
+      "blocks": [
+        {
+          "table": {
+            "headers": [
+              "Pulsante",
+              "Che cosa si apre"
+            ],
+            "rows": [
+              [
+                "Aggiornamento",
+                "L’aggiornamento di <lifecycleLink>Gestisci applicazioni OCI installate</lifecycleLink> per questo container, nel terminale di Monitor. Può essere eseguito anche senza una nuova immagine; in quel caso non cambia nulla. In un’applicazione composta da più container aggiorna tutti i membri."
+              ],
+              [
+                "Modifica",
+                "L'editor dell'applicazione (risorse, rete, percorsi e GPU). In un'applicazione multi-container aggiunge o rimuove i percorsi e i dispositivi aggiuntivi del contenitore di applicazione e, in Immich, cambia ciò che esegue il riconoscimento."
+              ],
+              [
+                "Recupera",
+                "Sostituisce l'aggiornamento quando un'operazione sul contenitore è stata interrotta e apre il suo recupero."
+              ],
+              [
+                "Recupera (container ripristinato)",
+                "Mostrato per un container ripristinato da un backup che non ha un contratto su questo host, sotto <strong>Applicazione OCI ripristinata</strong>. Apre il <lifecycleLink>recupero</lifecycleLink> nel terminale di Monitor; Aggiorna e Modifica compaiono dopo la registrazione."
+              ]
+            ]
+          }
+        },
+        {
+          "p": "Modifiche esterne, directory dell’host e applicazioni composte da più container vengono gestite come nel menu OCI. Per queste applicazioni, pulsanti e opzioni compaiono solo nel container principale. Gli altri membri mostrano la propria immagine, una nota che rimanda al principale per gli aggiornamenti e un pulsante per aprirlo. Alla chiusura del terminale vengono riletti l’immagine, il record e i montaggi."
+        },
+        {
+          "table": {
+            "headers": [
+              "Opzione",
+              "Comportamento"
+            ],
+            "rows": [
+              [
+                "Conserva il backup eseguito prima dell'aggiornamento",
+                "Ogni aggiornamento esegue il backup del container per ripristinarlo se l'aggiornamento non riesce. Con questa opzione, lo stesso backup viene mantenuto nello storage scelto e compare tra i backup del CT; su Proxmox Backup Server viene scritto un backup prima dell'aggiornamento."
+              ],
+              [
+                "Aggiornamenti pianificati",
+                "L’immagine viene aggiornata all’ora scelta solo se il registro ne pubblica una nuova, con la possibilità di attendere che abbia 1, 3, 7 o 14 giorni. Un container modificato al di fuori di ProxMenux viene saltato e segnalato."
+              ]
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "logs",
+      "title": "Log",
+      "intro": "La scheda Logs appare solo per i contenitori installati da OCI manager Apps, tra Mounts e Backups. Mostra l'uscita standard e l'errore del processo principale dell'immagine, la stessa uscita mostra <code>docker logs</code> per un contenitore Docker.",
+      "blocks": [
+        {
+          "list": {
+            "items": [
+              "L'output viene mantenuto sull'host in <code>/var/log/proxmenux/oci/VMID.console.log</code> (mode 0600), dal primo avvio e attraverso riavviamenti, in modo da poter essere letto con il contenitore fermato.",
+              "Il file viene ruotato a 10 MB, mantenendo tre copie compresse (<code>/etc/logrotate.d/proxmenux-oci</code>).",
+              "Ogni avvio del contenitore è contrassegnato nell'uscita. La scheda mostra l'output dall'ultimo avvio per impostazione predefinita; <strong>Cronologia completa</strong> mostra anche quelli precedenti.",
+              "Quando l'applicazione viene rimossa, la sua uscita viene rimossa con essa.",
+              "Vengono mostrate le ultime 100, 500 o 1000 righe. Mentre il container è in esecuzione, le nuove righe sono seguite in tempo reale; scorrere verso l’alto mette in pausa il seguito e <strong>Segui</strong> lo riprende.",
+              "Un filtro mostra solo le linee che contengono un testo e <strong>Scarica</strong> salva le linee caricate.",
+              "I codici a colori sono rimossi e una linea che una barra di avanzamento ridisegna è mostrata nel suo stato finale.",
+              "La scheda legge il file a ogni apertura; non usa una copia in cache."
+            ]
+          }
+        },
+        {
+          "calloutInfo": {
+            "title": "credenziali di primo avviamento",
+            "body": "Le immagini che stampano una password generata sul loro primo inizio lo lasciano in questa uscita, come fa <code>docker logs</code>. L'installatore lo legge da lì per mostrarlo nel suo riassunto."
+          }
+        },
+        {
+          "figure": {
+            "src": "/oci-manager/monitor-logs-tab.png",
+            "alt": "Scheda di log con l'uscita della console di un contenitore OCI, il selettore della linea, il filtro e il pulsante seguente",
+            "caption": "Uscita console di un contenitore OCI."
+          }
+        }
+      ]
+    },
+    {
+      "id": "terminal",
+      "title": "Console Proxmox VE",
+      "blocks": [
+        {
+          "p": "Un'immagine OCI esegue il proprio processo come PID 1 e nessun servizio di login, quindi la console predefinita di un LXC aprirebbe un terminale in cui nulla risponde. I contenitori installati da OCI manager Apps sono creati con <code>cmode: shell</code>: la console Proxmox VE apre una shell con <code>lxc-attach</code>, l'equivalente di <code>docker exec</code>, con l'applicazione in esecuzione intatta."
+        },
+        {
+          "list": {
+            "items": [
+              "La shell è quella assegnata a root nell’immagine da <code>/etc/passwd</code>. Se root non ha una shell o l’immagine non ne include alcuna, viene mantenuta la console predefinita.",
+              "La shell viene eseguita come root all'interno del contenitore, senza una password. Chi può aprirlo è deciso dal permesso <code>VM.Console</code> di Proxmox VE.",
+              "Il terminale del Monitor entra nel contenitore con <code>pct enter</code>, che funziona allo stesso modo."
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "mounts",
+      "title": "Montaggi",
+      "blocks": [
+        {
+          "p": "La scheda <mountsLink>Mounts</mountsLink> elenca i dischi container e le directory host del contenitore. L'uso di un disco contenitore su blocco di archiviazione come LVM-thin è letto dal filesystem del disco, che è montato solo all'interno del contenitore."
+        }
+      ]
+    }
+  ]
+}
diff --git a/web/messages/it/docs/oci-manager/stacks.json b/web/messages/it/docs/oci-manager/stacks.json
new file mode 100644
index 00000000..78160aba
--- /dev/null
+++ b/web/messages/it/docs/oci-manager/stacks.json
@@ -0,0 +1,404 @@
+{
+  "meta": {
+    "title": "Applicazioni multicontainer | ProxMenux",
+    "description": "Come OCI manager Apps trasforma un'applicazione con il suo database e la cache in LXCs nativi coordinati: piano, rete privata, gancio di dipendenza, convalida e aggiornamenti transazionali."
+  },
+  "header": {
+    "title": "Applicazioni con più container",
+    "description": "Un'applicazione con il suo database, la cache e altri servizi diventa diversi LXC nativi coordinati, installati e aggiornati come uno.",
+    "section": "OCI manager Apps"
+  },
+  "sections": [
+    {
+      "id": "intro",
+      "blocks": [
+        {
+          "calloutInfo": {
+            "title": "Un'applicazione per l'utente, diversi LXC per Proxmox VE",
+            "body": "Una definizione multi-container è una voce del catalogo. L'installatore crea un LXC nativo per servizio e mantiene esplicite le proprie dipendenze. Immich, Nextcloud, Paperless-ngx e Tandoor sono installati in questo modo."
+          }
+        },
+        {
+          "mermaid": {
+            "chartCode": "flowchart LR\n C[\"Docker Compose\"] --> O[\"{{plan}}\"]\n O --> A[\"{{app}}<br/>{{appNet}}\"]\n O --> D[\"{{db}}<br/>{{private}}\"]\n O --> R[\"{{cache}}<br/>{{private}}\"]\n V1[(\"config\")] --> A\n V2[(\"database\")] --> D\n V3[(\"cache\")] --> R\n D --> A\n R --> A",
+            "labels": {
+              "plan": "Piano di stack",
+              "app": "Applicazione LXC",
+              "appNet": "LAN + privato",
+              "db": "PostgreSQL LXC",
+              "cache": "Valkey LXC",
+              "private": "privato"
+            }
+          }
+        }
+      ]
+    },
+    {
+      "id": "plan",
+      "title": "1. Il piano, prima che esista un contenitore",
+      "blocks": [
+        {
+          "p": "Nessun LXC viene creato mentre la definizione Compose viene interpretata. Un piano completo arriva prima, con ogni membro, immagine, VMID, rete, percorso, segreto, ordine e controllo sanitario. Se il piano non è coerente, l'installazione non inizia."
+        },
+        {
+          "table": {
+            "headers": [
+              "Elemento di piano",
+              "Contenuto",
+              "Controllato prima di creare qualcosa"
+            ],
+            "rows": [
+              [
+                "Membri",
+                "Applicazione principale, database, cache, machine learning e altre dipendenze",
+                "VMID unici, ruoli noti e esattamente un membro principale"
+              ],
+              [
+                "Immagini",
+                "Riferimento rolling, architettura e digest risolto di ogni servizio",
+                "Tutte esistono, supportano l’architettura e superano il controllo di integrità OCI"
+              ],
+              [
+                "Rete",
+                "Ponte privato, subnet, indirizzo fisso per servizio e accesso LAN per il membro principale",
+                "Nessuna collisione con ponti o sottorete esistenti e nessun indirizzo ripetuto"
+              ],
+              [
+                "Persistenza",
+                "Dischi dei container, directory dell’host, proprietari e backup",
+                "Nessun percorso sovrapposto, deposito disponibile e permessi dichiarati"
+              ],
+              [
+                "Segreti",
+                "password del database, chiavi dell'applicazione e credenziali iniziali",
+                "Generati una volta e forniti solo ai membri che li usano"
+              ],
+              [
+                "Ciclo di vita",
+                "Ordine di inizio, ordine di arresto e un controllo sanitario per membro",
+                "L'applicazione principale inizia l'ultima e si ferma prima"
+              ]
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "create",
+      "title": "2. Creazione, membro per membro",
+      "blocks": [
+        {
+          "steps": {
+            "items": [
+              {
+                "title": "Prenota ogni VMID",
+                "body": "L'inventario Proxmox VE e il registro delle istanze sono controllati. Un CT esistente non è adottato e un contratto che appartiene ancora ad un'altra istanza non viene riutilizzato."
+              },
+              {
+                "title": "Preparare ogni immagine",
+                "body": "Tutte le immagini vengono risolte, scaricate e verificate prima che venga creato il primo contenitore."
+              },
+              {
+                "title": "Creare ogni rootfs",
+                "body": "I metadati OCI ufficiali sono importati, e l'identità di istanza ProxMenux e il ruolo membro sono aggiunti."
+              },
+              {
+                "title": "Rete privata",
+                "body": "Viene creato un ponte e una subnet e ogni membro riceve il suo indirizzo fisso; solo il membro principale riceve anche l'interfaccia LAN."
+              },
+              {
+                "title": "Persistenza",
+                "body": "Ogni database e configurazione ottiene il proprio disco contenitore; solo i dati destinati ad essere condivisi utilizzano directory host."
+              },
+              {
+                "title": "Ambiente",
+                "body": "Vengono scritti endpoint interni, segreti condivisi e variabili di servizio. L'applicazione raggiunge le sue dipendenze nei loro indirizzi privati riservati."
+              },
+              {
+                "title": "Registrazione",
+                "body": "Ogni membro registra la sua configurazione nativa, le modifiche rootfs che gli aggiornamenti devono riprodurre e la sua relazione con lo stack."
+              }
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "checks",
+      "title": "3. Avviare e controllare ogni contenitore",
+      "intro": "Un LXC creato non significa un servizio pronto. Le dipendenze iniziano in ordine e ognuno passa un controllo specifico al suo servizio.",
+      "blocks": [
+        {
+          "table": {
+            "headers": [
+              "Servizio",
+              "Controllo",
+              "Cosa mostra"
+            ],
+            "rows": [
+              [
+                "PostgreSQL",
+                "<code>pg_isready</code> nel CT con l'host previsto, l'utente e il database",
+                "Il server accetta le connessioni per il database configurato"
+              ],
+              [
+                "Redis / Valkey",
+                "<code>redis-cli</code> o <code>valkey-cli</code> <code>PING</code> contro il suo indirizzo privato",
+                "Il broker ascolta e risponde"
+              ],
+              [
+                "Machine learning Immich",
+                "HTTP <code>GET /ping</code>, oltre a un controllo del runtime GPU selezionato",
+                "Il servizio risponde e l’accelerazione richiesta non è passata alla CPU"
+              ],
+              [
+                "Nextcloud",
+                "<code>GET /status.php</code> con <code>installed=true</code>, <code>maintenance=false</code> e <code>needsDbUpgrade=false</code>",
+                "Inizializzazione terminata senza migrazione in sospeso"
+              ],
+              [
+                "Paperless-ngx / Tandoor",
+                "HTTP sull'indirizzo LAN e vera porta del servizio",
+                "Il frontend e le sue dipendenze servono l'applicazione"
+              ],
+              [
+                "Applicazione principale",
+                "Il punto finale del suo modello, ad esempio <code>/api/server/ping</code> in Immich",
+                "L'intero stack funziona attraverso l'applicazione che utilizza le dipendenze"
+              ]
+            ]
+          }
+        },
+        {
+          "calloutWarning": {
+            "title": "In esecuzione non significa funzionante",
+            "body": "Lo stato in esecuzione dice solo che esiste il processo LXC. Se il servizio offre un controllo migliore, viene utilizzato un controllo exec o HTTP con un timeout. Se un membro si ferma o non supera la verifica, lo stack non viene dichiarato installato."
+          }
+        }
+      ]
+    },
+    {
+      "id": "hook",
+      "title": "4. Il gancio di dipendenza",
+      "blocks": [
+        {
+          "p": "Il gancio è impostato solo sul contenitore principale di uno stack dipendente. Proxmox VE mantiene lo script come snippet e lo gestisce come <code>hookscript</code> di quel CT. La ricetta dello stack non è scritta nello script: vive in un contratto privato separato."
+        },
+        {
+          "codeGrid": {
+            "items": [
+              {
+                "title": "Configurazione principale CT",
+                "code": "hookscript: local:snippets/proxmenux-stack-dependencies.sh"
+              },
+              {
+                "title": "Contratto privato (esempio)",
+                "code": "/etc/pve/priv/proxmenux-stack-VMID.json\n{\n  \"schema\": 1,\n  \"stack\": \"immich\",\n  \"dependencies\": [\n    {\"vmid\": 107, \"label\": \"PostgreSQL\", \"healthcheck\": {...}},\n    {\"vmid\": 108, \"label\": \"Valkey\", \"healthcheck\": {...}},\n    {\"vmid\": 106, \"label\": \"Machine Learning\", \"healthcheck\": {...}}\n  ]\n}"
+              }
+            ]
+          }
+        },
+        {
+          "snippet": {
+            "summary": "Fonte completa di proxmenux-stack-dependencies.sh",
+            "pathCode": "local:snippets/proxmenux-stack-dependencies.sh",
+            "snippetCode": "stackDependencyHook"
+          }
+        },
+        {
+          "p": "Lo script è lo stesso per ogni stack. VMID, nomi, tipi di controllo e timeout provengono dal contratto privato <code>/etc/pve/priv/proxmenux-stack-VMID.json</code> di ogni stack."
+        },
+        {
+          "steps": {
+            "items": [
+              {
+                "title": "Proxmox VE chiama pre-start",
+                "body": "Prima dell'avvio principale di CT, il gancio viene eseguito con il VMID e la fase del ciclo di vita."
+              },
+              {
+                "title": "Un blocco per stack",
+                "body": "<code>flock</code> su <code>/run/lock/proxmenux-stack-VMID.lock</code> previene due sequenze di avvio contemporaneamente."
+              },
+              {
+                "title": "Il contratto viene letto e convalidato",
+                "body": "Uno schema noto, dipendenze numeriche, etichette, un exec, http o controllo in esecuzione e un timeout positivo sono necessari."
+              },
+              {
+                "title": "Dipendenze in ordine",
+                "body": "Ogni CT deve esistere; se è fermo viene avviato, se è già in esecuzione non viene riavviato."
+              },
+              {
+                "title": "Attendi che il servizio sia pronto",
+                "body": "Il controllo viene eseguito ogni due secondi, e il CT è confermato anche di essere ancora in esecuzione."
+              },
+              {
+                "title": "Il principale CT inizia",
+                "body": "Quando ogni dipendenza è pronta, pre-start termina e Proxmox VE avvia l'applicazione."
+              }
+            ]
+          }
+        },
+        {
+          "calloutInfo": {
+            "title": "Il gancio non ferma le dipendenze",
+            "body": "Le fasi post-start, pre-stop e post-stop non fanno nulla. Arrestare il CT principale lascia in esecuzione PostgreSQL, Redis, Valkey o il machine learning. L’hook ordina l’avvio; non trasforma diversi LXC in un unico processo."
+          }
+        },
+        {
+          "table": {
+            "headers": [
+              "Tipo",
+              "Esempio",
+              "Avvii successivi"
+            ],
+            "rows": [
+              [
+                "stack dipendente",
+                "Immich, Nextcloud, applicazione con PostgreSQL",
+                "L’hook del CT principale avvia le dipendenze e attende che siano pronte."
+              ],
+              [
+                "Suite di applicazione",
+                "Suite Arr",
+                "Nessun membro principale: ogni LXC segue il proprio <code>onboot</code>"
+              ],
+              [
+                "Applicazione singola",
+                "Jellyfin",
+                "Proxmox VE avvia direttamente LXC"
+              ]
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "stack-checks",
+      "title": "5. Controlla sullo stack nel suo complesso",
+      "blocks": [
+        {
+          "list": {
+            "items": [
+              "Ogni VMID esiste, è unico e mantiene l'identità di istanza prevista.",
+              "Ogni contratto appartiene allo stesso stack, mantiene il suo ruolo e la sua configurazione nativa registrata.",
+              "Il membro principale è l’ultimo in <code>start_order</code> e il primo in <code>stop_order</code>.",
+              "Nessun membro, volume o adattamento rootfs manca.",
+              "Il gancio punta al snippet ufficiale, il suo contenuto è invariato e il suo contratto corrisponde alla ricetta stack.",
+              "Le immagini e i digest osservati corrispondono agli archivi OCI preparati.",
+              "Dispositivi, profili GPU, montaggi, segreti ed endpoint corrispondono ancora ai contratti.",
+              "Quando tutte le dipendenze superano i controlli, l’endpoint dell’applicazione principale verifica l’integrazione fra i membri."
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "manage",
+      "title": "Gestione di uno stack installato",
+      "intro": "In <strong>Gestisci applicazioni OCI installate</strong>, qualsiasi membro porta all’intero stack. Il menu offre <strong>Aggiorna tutti i container dell’applicazione</strong>, <strong>Modifica percorsi e dispositivi aggiuntivi</strong>, <strong>Ricrea tutti i container con la configurazione salvata</strong> e <strong>Rimuovi: elimina l’applicazione e i suoi container</strong>. Ricrea ricostruisce ogni container dall’immagine originale tramite il digest salvato, senza cercarne una più recente, seguendo gli stessi passaggi di un aggiornamento. È disponibile per gli stack aggiornabili.",
+      "blocks": [
+        {
+          "steps": {
+            "items": [
+              {
+                "title": "Qualsiasi membro",
+                "body": "Il contratto dei membri nomina il VMID principale e l'elenco completo dei membri."
+              },
+              {
+                "title": "Lo stack è riproducibile",
+                "body": "Identità, contratti, gancio, adattamenti e una ripetizione coordinata per quella ricetta sono convalidati."
+              },
+              {
+                "title": "Immagini prima",
+                "body": "L'applicazione non viene fermata fino a quando ogni digest è stato risolto, scaricato e verificato."
+              },
+              {
+                "title": "Arresta i componenti e crea un backup dell'insieme",
+                "body": "I backup nativi verificati sono presi con lo stack fermato, quindi l'applicazione e i database appartengono allo stesso momento."
+              },
+              {
+                "title": "Aggiornare e controllare ogni membro",
+                "body": "Adattamento, rete, montaggi, segreti e dispositivi vengono applicati nuovamente prima del controllo di integrità di ciascun membro."
+              },
+              {
+                "title": "Pubblica o recupera tutto",
+                "body": "I nuovi contratti sono pubblicati solo quando ogni membro passa. Se uno fallisce, ogni membro viene ripristinato."
+              }
+            ]
+          }
+        },
+        {
+          "table": {
+            "headers": [
+              "Modifica",
+              "Quali cambiamenti",
+              "Cosa viene conservato"
+            ],
+            "rows": [
+              [
+                "Percorsi e dispositivi aggiuntivi",
+                "Vengono aggiunti o rimossi dal contenitore di applicazione, che si riavvia. Nulla è ricostruito",
+                "I dati dell'applicazione, il suo database e gli altri contenitori"
+              ],
+              [
+                "Che cosa esegue il riconoscimento (Immich)",
+                "Il contenitore di apprendimento automatico prende l'immagine e i dispositivi del CPU o di un GPU dell'host. L'intera applicazione viene interrotta e aggiornata, come in un aggiornamento",
+                "La cache del modello, la libreria e il database. Se qualcosa fallisce, i contenitori precedenti e la scelta precedente vengono ripristinati"
+              ]
+            ]
+          }
+        },
+        {
+          "calloutWarning": {
+            "title": "Una pila senza un replay coordinato non è aggiornata",
+            "body": "Se la preparazione di uno stack non può essere riprodotta, l'aggiornamento viene rifiutato prima che lo stack venga interrotto. L'applicazione continua a funzionare come è."
+          }
+        }
+      ]
+    },
+    {
+      "id": "failure",
+      "title": "6. Quando qualcosa fallisce",
+      "blocks": [
+        {
+          "p": "Durante un'installazione, un errore si ferma e rimuove i contenitori incompleti che l'operazione ha creato, e il ponte privato se l'operazione l'ha creata. Una pila non viene pubblicata come valida fino al termine dell'intera sequenza."
+        },
+        {
+          "p": "Un aggiornamento è transazionale: tutte le immagini sono preparate prima, poi lo stack si ferma, viene eseguito e verificato il backup di ogni membro, e solo allora è sostituito ogni rootfs. I membri iniziano uno per uno con il loro controllo sanitario; se uno fallisce, ogni membro viene ripristinato dalla stessa serie di backup, quindi il database e l'applicazione non appartengono mai a momenti diversi."
+        },
+        {
+          "mermaid": {
+            "chartCode": "flowchart LR\n P[\"{{prepare}}\"] --> S[\"{{stop}}\"]\n S --> B[\"{{backup}}\"]\n B --> R[\"{{replace}}\"]\n R --> H{\"{{healthy}}\"}\n H -- \"{{yes}}\" --> C[\"{{commit}}\"]\n H -- \"{{no}}\" --> X[\"{{rollback}}\"]",
+            "labels": {
+              "prepare": "Preparare ogni immagine",
+              "stop": "Stop, primo membro principale",
+              "backup": "Backup verificato di ogni CT",
+              "replace": "Sostituisci il rootfs",
+              "healthy": "Tutti funzionanti?",
+              "yes": "Sì",
+              "no": "No",
+              "commit": "Pubblica i contratti",
+              "rollback": "Ripristinare ogni membro"
+            }
+          }
+        }
+      ]
+    },
+    {
+      "id": "not-assumed",
+      "title": "Che cosa uno stack non include",
+      "blocks": [
+        {
+          "list": {
+            "items": [
+              "Una suite installata in un unico flusso, come la suite Arr, non è uno stack dipendente: i suoi contenitori non hanno ordine di partenza tra di loro.",
+              "La rete privata non sostituisce l'autenticazione, TLS o la configurazione di ogni applicazione.",
+              "Il backup di un LXC non contiene il ponte, il gancio o i contratti del resto dello stack.",
+              "Prowlarr, Sonarr o Radarr non ricevono indici, profili o fornitori da ProxMenux."
+            ]
+          }
+        }
+      ]
+    }
+  ]
+}
diff --git a/web/messages/it/docs/oci-manager/storage-network.json b/web/messages/it/docs/oci-manager/storage-network.json
new file mode 100644
index 00000000..60b32b16
--- /dev/null
+++ b/web/messages/it/docs/oci-manager/storage-network.json
@@ -0,0 +1,305 @@
+{
+  "meta": {
+    "title": "Dati, percorsi e rete | ProxMenux",
+    "description": "Come OCI manager Apps conserva i dati di un container OCI: dischi del container, directory dell’host, mount con rclone, indirizzi e reti private."
+  },
+  "header": {
+    "title": "Dati, percorsi e rete",
+    "description": "Cosa risiede nel rootfs, cosa viene conservato quando lo si sostituisce, come si condividono i dati tra container e come ciascuno ottiene il proprio indirizzo.",
+    "section": "OCI manager Apps"
+  },
+  "sections": [
+    {
+      "id": "intro",
+      "blocks": [
+        {
+          "calloutInfo": {
+            "title": "La persistenza si decide prima di creare l’LXC",
+            "body": "I volumi dichiarati dall’immagine e dal suo file Compose vengono letti prima di creare il container. Ogni percorso da conservare dopo un aggiornamento diventa un punto di mount indipendente dal rootfs. In questo modo, il rootfs contiene solo ciò che appartiene all’immagine e può essere sostituito."
+          }
+        }
+      ]
+    },
+    {
+      "id": "questions",
+      "title": "Cosa chiede l’installer",
+      "intro": "Il modello fornisce i percorsi necessari all’applicazione. Ciascuno viene collocato su un disco del container o in una directory dell’host; prima del riepilogo si possono aggiungere altri percorsi.",
+      "blocks": [
+        {
+          "steps": {
+            "items": [
+              {
+                "title": "Percorsi necessari",
+                "body": "Vengono elencati <code>/config</code>, <code>/data</code>, librerie, download e tutti i volumi dichiarati dall’applicazione."
+              },
+              {
+                "title": "Posizione",
+                "body": "Ogni percorso viene collocato su un disco del container o in una directory già esistente sull’host."
+              },
+              {
+                "title": "Storage e dimensione",
+                "body": "Viene creato un disco del container su uno storage Proxmox VE con la dimensione indicata. L’installazione predefinita usa <code>local-lvm</code>; quella avanzata chiede lo storage di ogni percorso subito prima della dimensione e propone quello del rootfs. Il disco appare come <code>vm-VMID-disk-N</code> e viene collegato come <code>mpN</code>."
+              },
+              {
+                "title": "Directory dell’host",
+                "body": "La directory dell’host viene indicata tramite il suo percorso. Se non esiste, viene creata e assegnata all’utente dell’host a cui viene mappato quello del container."
+              },
+              {
+                "title": "Percorsi aggiuntivi",
+                "body": "Prima dell’installazione si possono aggiungere altre coppie formate da un percorso o volume dell’host e dal relativo percorso nel container."
+              },
+              {
+                "title": "Riepilogo",
+                "body": "La mappatura completa viene mostrata prima della creazione del CT e salvata nel contratto dell’istanza."
+              }
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "options",
+      "title": "Le due posizioni persistenti",
+      "blocks": [
+        {
+          "table": {
+            "headers": [
+              "Proprietà",
+              "Disco del container",
+              "Directory dell’host"
+            ],
+            "rows": [
+              [
+                "Nella configurazione",
+                "<code>mpN: STORAGE:vm-VMID-disk-N,mp=/config,backup=1,size=16G</code>",
+                "<code>mpN: /mnt/oci-shared/media,mp=/data/media</code>"
+              ],
+              [
+                "Backup del container (vzdump)",
+                "Incluso con <code>backup=1</code>",
+                "Non incluso"
+              ],
+              [
+                "Dimensione",
+                "Fissa; si aumenta ridimensionando il punto di mount",
+                "Lo spazio libero del filesystem o del dataset dell’host"
+              ],
+              [
+                "Altri container",
+                "Montato solo dal container a cui appartiene",
+                "La stessa directory può essere montata in più container"
+              ],
+              [
+                "Snapshot e ripristino",
+                "Gestiti da Proxmox VE insieme al CT",
+                "Gestiti sullo storage dell’host"
+              ],
+              [
+                "Rimozione dell’applicazione",
+                "Eliminato con il container",
+                "Conservato con il suo contenuto"
+              ],
+              [
+                "Spostamento del CT su un altro nodo",
+                "Si sposta con il CT",
+                "Lo stesso percorso deve esistere sull’altro nodo"
+              ]
+            ]
+          }
+        },
+        {
+          "p": "Il rootfs è riservato ai binari e al contenuto dell’immagine. Un aggiornamento o una ricreazione lo sostituisce senza toccare nessuno dei due tipi di punto di mount."
+        }
+      ]
+    },
+    {
+      "id": "example",
+      "title": "Esempio: un container con entrambe le posizioni",
+      "blocks": [
+        {
+          "code": {
+            "title": "Jellyfin installato come CT 151 su local-lvm (estratto)",
+            "code": "rootfs: local-lvm:vm-151-disk-0,size=8G\n# Container disk, part of the CT backup\nmp0: local-lvm:vm-151-disk-1,mp=/config,backup=1,size=16G\n\n# Host directory, outside the CT backup\nmp1: /mnt/oci-shared/media,mp=/data/media"
+          }
+        },
+        {
+          "p": "Un aggiornamento o una ricreazione sostituisce solo il rootfs: <code>mp0</code> conserva utenti, librerie e impostazioni, mentre <code>mp1</code> continua a mostrare gli stessi contenuti multimediali. Il ripristino del backup del CT recupera <code>/config</code>; se necessario, la directory dei contenuti multimediali viene ripristinata dal backup dello storage dell’host."
+        },
+        {
+          "flow": {
+            "nodes": [
+              {
+                "label": "Contratto",
+                "detail": "/config"
+              },
+              {
+                "label": "Posizione",
+                "detail": "Disco del container\no directory dell’host"
+              },
+              {
+                "label": "LXC",
+                "detail": "Sempre /config\nper l’applicazione"
+              }
+            ],
+            "caption": "L’applicazione vede il percorso dichiarato dall’immagine; cambia solo dove viene memorizzato."
+          }
+        }
+      ]
+    },
+    {
+      "id": "shared",
+      "title": "Una directory dell’host, più container",
+      "blocks": [
+        {
+          "mermaid": {
+            "chartCode": "flowchart TB\n H[\"{{host}}<br/>/mnt/oci-shared/media\"]\n H --> Q[\"qBittorrent<br/>/data\"]\n H --> J[\"Jellyfin<br/>/data\"]\n H --> R[\"Radarr / Sonarr<br/>/data\"]\n Q -. \"{{config}}\" .-> QV[(\"/config mpN\")]\n J -. \"{{config}}\" .-> JV[(\"/config mpN\")]\n R -. \"{{config}}\" .-> RV[(\"/config mpN\")]",
+            "labels": {
+              "host": "Directory dell’host",
+              "config": "Configurazione propria"
+            }
+          }
+        },
+        {
+          "p": "Ogni container conserva la propria configurazione sul suo disco. La libreria o i download si trovano in un’unica directory dell’host, montata nello stesso percorso interno in tutti i container. Così il percorso in cui scrive un’applicazione è lo stesso da cui legge un’altra."
+        }
+      ]
+    },
+    {
+      "id": "rclone",
+      "title": "Storage cloud tramite l’applicazione rclone",
+      "intro": "Oltre all’installazione, la scheda di rclone nel catalogo offre <strong>Abilita un mount in un container OCI rclone esistente</strong>. Viene montato un remote già creato e autorizzato nell’interfaccia web di rclone, che viene poi reso disponibile sull’host. Gli altri container possono usarlo come una directory dell’host.",
+      "blocks": [
+        {
+          "steps": {
+            "items": [
+              {
+                "title": "Container e remote",
+                "body": "Il VMID del container rclone, il nome esatto del remote e, facoltativamente, un percorso al suo interno."
+              },
+              {
+                "title": "Nome del mount e cache",
+                "body": "Il nome del mount e la modalità della cache VFS: <code>off</code>, <code>minimal</code>, <code>writes</code> o <code>full</code> (predefinita)."
+              },
+              {
+                "title": "Viste pubblicate",
+                "body": "Una radice comune, <code>/mnt/oci-shared</code> per impostazione predefinita, contiene una vista in lettura e scrittura in <code>/mnt/oci-shared/remotes/NAME</code> e una in sola lettura in <code>/mnt/oci-shared/remotes-ro/NAME</code>."
+              },
+              {
+                "title": "Attivazione",
+                "body": "Dopo la conferma, il CT viene arrestato, vengono configurati il suo comando di avvio e un hookscript di Proxmox VE, quindi viene riavviato. L’operazione attende che entrambe le viste siano montate sull’host."
+              }
+            ]
+          }
+        },
+        {
+          "calloutInfo": {
+            "title": "Se il mount non viene attivato",
+            "body": "Viene ripristinata la configurazione precedente del container, che viene quindi riavviato. In questo modo, se l’attivazione fallisce, rclone resta com’era."
+          }
+        }
+      ]
+    },
+    {
+      "id": "network",
+      "title": "Indirizzi e reti",
+      "intro": "Un’applicazione con un solo container ha bisogno di un indirizzo. Un’applicazione con più container richiede anche una rete stabile tra i suoi componenti.",
+      "blocks": [
+        {
+          "cards": {
+            "items": [
+              {
+                "icon": "network",
+                "title": "Applicazione con un solo container",
+                "body": "Si sceglie il bridge di rete e si imposta DHCP oppure un indirizzo fisso in formato CIDR. L’LXC ha un proprio indirizzo e il riepilogo mostra gli URL completi dei servizi."
+              },
+              {
+                "icon": "waypoints",
+                "title": "Applicazione con più container",
+                "body": "Viene individuata una sottorete libera e creato un bridge privato persistente. Ogni componente — applicazione, database e cache — riceve un indirizzo fisso su quella rete."
+              }
+            ]
+          }
+        },
+        {
+          "flow": {
+            "nodes": [
+              {
+                "label": "LAN",
+                "detail": "Indirizzo raggiungibile\nsolo per il servizio principale"
+              },
+              {
+                "label": "LXC principale",
+                "detail": "Web / API\nLAN + rete privata"
+              },
+              {
+                "label": "Rete privata",
+                "detail": "PostgreSQL · Valkey · ML\nindirizzi fissi"
+              }
+            ],
+            "caption": "Le dipendenze comunicano sulla rete privata e non hanno un indirizzo sulla LAN."
+          }
+        },
+        {
+          "p": "Il contratto dello stack conserva bridge, sottorete, indirizzi e relazioni tra i servizi. L’aggiornamento dell’applicazione riutilizza la stessa topologia per tutti i componenti. ProxMenux Monitor apre il container principale al suo indirizzo LAN, non a quello della rete privata."
+        }
+      ]
+    },
+    {
+      "id": "ownership",
+      "title": "Proprietà di file e directory",
+      "blocks": [
+        {
+          "list": {
+            "items": [
+              "Le nuove directory vengono create con UID e GID a cui viene mappato l’LXC non privilegiato.",
+              "Il proprietario delle directory esistenti non viene modificato ricorsivamente.",
+              "Socket, file di sistema e percorsi sensibili non vengono proposti come directory generiche dell’host."
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "backup",
+      "title": "Cosa contiene un backup del container",
+      "blocks": [
+        {
+          "table": {
+            "headers": [
+              "Elemento",
+              "Nel backup vzdump del CT",
+              "Dove viene conservato"
+            ],
+            "rows": [
+              [
+                "Rootfs OCI",
+                "Sì",
+                "Nel backup del CT; può anche essere ricreato dall’immagine e dal contratto"
+              ],
+              [
+                "Disco del container con <code>backup=1</code>",
+                "Sì",
+                "Il backup del CT"
+              ],
+              [
+                "Directory dell’host",
+                "No",
+                "Il backup dello storage dell’host"
+              ],
+              [
+                "Contratto dell’istanza",
+                "Sì, la copia conservata nel CT",
+                "<code>/.proxmenux/oci-record.json</code> nel CT; le copie aggiuntive dell’host e del cluster sono conservate separatamente"
+              ],
+              [
+                "Applicazione con più container",
+                "Ogni componente nel proprio backup",
+                "I backup di tutti i componenti, più il contratto dello stack e il suo bridge di rete sull’host"
+              ]
+            ]
+          }
+        }
+      ]
+    }
+  ]
+}
diff --git a/web/messages/it/docs/post-install/automated.json b/web/messages/it/docs/post-install/automated.json
new file mode 100644
index 00000000..c41c700a
--- /dev/null
+++ b/web/messages/it/docs/post-install/automated.json
@@ -0,0 +1,172 @@
+{
+  "meta": {
+    "title": "Script post-installazione automatizzato | Documentazione ProxMenux",
+    "description": "Lo script post-installazione automatizzato ProxMenux esegue 14 ottimizzazioni predefinite in base all’hardware su un nuovo host Proxmox VE. Non presenta una lista di funzioni da selezionare, ma può chiedere conferma per l’aggiornamento del sistema, la rimozione dell’avviso di abbonamento, alcune installazioni Log2RAM e il riavvio. Le modifiche reversibili vengono registrate.",
+    "ogTitle": "Script post-installazione automatizzato | Documentazione ProxMenux",
+    "ogDescription": "14 ottimizzazioni predefinite in base all’hardware per un nuovo host Proxmox VE, con conferme per alcune azioni e registrazione delle modifiche reversibili."
+  },
+  "header": {
+    "title": "Script post-installazione automatizzato",
+    "description": "ProxMenux esegue 14 ottimizzazioni di base predefinite senza lista di funzioni da selezionare. Alcune azioni chiedono conferma. Le modifiche reversibili vengono registrate per Disinstalla ottimizzazioni; gli aggiornamenti dei pacchetti non sono descritti come reversibili.",
+    "section": "Post-Install · Automatizzato"
+  },
+  "intro": {
+    "title": "Quando scegliere l’installazione automatizzata",
+    "body": "Eseguilo su un host Proxmox appena installato per ottenere una configurazione di base senza scegliere ogni funzione. Lo script è idempotente: una seconda esecuzione riapplica le stesse impostazioni. Le funzioni opzionali (Fastfetch, IOMMU, repository Ceph, HA, correzioni AMD…) <strong>non</strong> fanno parte di questo percorso; sceglile da <link>Personalizzabile</link> se ti servono."
+  },
+  "applies": {
+    "heading": "Cosa applica lo script",
+    "intro": "Le ottimizzazioni vengono applicate in questo ordine preciso. La colonna <em>Categoria</em> rimanda alla documentazione dettagliata di ogni modifica nella guida personalizzabile.",
+    "headerNum": "#",
+    "headerTool": "Strumento",
+    "headerWhat": "Che cosa fa",
+    "headerCategory": "Categoria"
+  },
+  "optimizations": [
+    {
+      "tool": "Repository APT + aggiornamento completo",
+      "what": "Disabilita le sorgenti Enterprise pve-enterprise.sources e ceph.sources, crea una sorgente no-subscription per il nome in codice Debian dell’host, quindi esegue apt update && apt full-upgrade -y (comando ufficiale di aggiornamento Proxmox).",
+      "category": "Impostazioni di base",
+      "categorySlug": "basic-settings"
+    },
+    {
+      "tool": "Rimozione dell’avviso di abbonamento",
+      "what": "Modifica l’interfaccia web per nascondere l’avviso «Nessun abbonamento valido». Chiede conferma prima di applicare; reversibile da Disinstalla ottimizzazioni.",
+      "category": "Personalizzazione",
+      "categorySlug": "customization"
+    },
+    {
+      "tool": "Forza IPv4",
+      "what": "Scrive /etc/apt/apt.conf.d/99-force-ipv4 affinché apt usi solo IPv4, evitando collegamenti IPv6 instabili ai mirror.",
+      "category": "Rete",
+      "categorySlug": "network"
+    },
+    {
+      "tool": "Salta i pacchetti di lingua",
+      "what": "Scrive /etc/apt/apt.conf.d/99-disable-translations per non scaricare più gli indici delle descrizioni tradotte dei pacchetti, riducendo i dati degli aggiornamenti apt.",
+      "category": "Impostazioni di base",
+      "categorySlug": "basic-settings"
+    },
+    {
+      "tool": "Aumentare i limiti del sistema",
+      "what": "Aumenta le risorse di monitoraggio inotify, i limiti nofile/nproc, quelli del portachiavi del kernel e fs.file-max tramite sysctl.d, limits.d, pam e systemd, per host con molti container.",
+      "category": "Sistema",
+      "categorySlug": "system"
+    },
+    {
+      "tool": "Regolazione della memoria",
+      "what": "Imposta vm.swappiness=10, rapporti bilanciati di pagine modificate non ancora scritte, vm.max_map_count=262144 e compattazione proattiva se supportata. La politica di overcommit della memoria del kernel resta quella predefinita di Proxmox.",
+      "category": "Sistema",
+      "categorySlug": "system"
+    },
+    {
+      "tool": "Comportamento in caso di kernel panic",
+      "what": "Configura l’host per riavviarsi 10 secondi dopo un panic / oops / hardlockup invece di restare bloccato indefinitamente.",
+      "category": "Sistema",
+      "categorySlug": "system"
+    },
+    {
+      "tool": "Regolazione dello stack di rete",
+      "what": "Dimensioni dei buffer TCP, rafforzamento IPv4 (redirect disattivati, rp_filter=2, registrazione martian disattivata), porte locali 1024-65535, rilevamento MTU TCP, RFC 1337 e script /usr/local/sbin/proxmenux-fwbr-tune collegato a un’unità systemd a esecuzione singola e una regola udev. Così rp_filter=0 / log_martians=0 vengono riapplicati alle interfacce fwbr*/fwln*/fwpr*/tap* ogni volta che Proxmox le ricrea all’avvio/arresto delle VM, al riavvio o alla migrazione live.",
+      "category": "Rete",
+      "categorySlug": "network"
+    },
+    {
+      "tool": "Personalizzazione Bashrc (root)",
+      "what": "PS1 colorato, alias comuni (l/la/ll/ls/grep), cronologia con data e ora e caricamento di bash-completion, dentro un blocco delimitato PMX_CORE_BASHRC facile da rimuovere.",
+      "category": "Personalizzazione",
+      "categorySlug": "customization"
+    },
+    {
+      "tool": "Log2RAM (ottimizzato per SSD, automatico)",
+      "what": "Riduce l’usura SSD/NVMe spostando /var/log in un ramdisk tmpfs sincronizzato periodicamente sul disco. Installazione dal progetto upstream quando il disco root è SSD o NVMe. Dimensione in base alla RAM dell’host (128M / 256M / 512M), sincronizzazione periodica e protezione automatica che elimina vecchi journal all’80% e tronca i log molto attivi al 92% prima della scrittura. Adatta i limiti journald al ramdisk. Dettagli su <link>Log2RAM</link>.",
+      "category": "Archiviazione",
+      "categorySlug": "storage"
+    },
+    {
+      "tool": "Autotrim ZFS (solo SSD)",
+      "what": "Attiva zpool autotrim=on su ogni pool ZFS i cui vdev siano tutti SSD o NVMe con supporto TRIM, controllando /sys/block/[dev]/queue/rotational e discard_granularity. I pool su HDD vengono saltati. Per la disinstallazione registra solo i pool realmente modificati da ProxMenux; quelli su cui hai attivato autotrim manualmente restano invariati.",
+      "category": "Archiviazione",
+      "categorySlug": "storage"
+    },
+    {
+      "tool": "Limiti di dimensione di journald",
+      "what": "Forza l’archiviazione persistente, limita SystemMaxUse=64M / RuntimeMaxUse=60M e abilita compressione e log di livello info richiesti da Monitor. Viene saltato se Log2RAM è attivo, perché esegue la propria regolazione.",
+      "category": "Sistema",
+      "categorySlug": "system"
+    },
+    {
+      "tool": "Regolazione di logrotate",
+      "what": "Imposta globalmente daily seguito da size 10M, conserva 7 rotazioni e abilita compressione e copytruncate. Il criterio di dimensione successivo prevale; le regole specifiche possono sovrascriverlo. Adatto a Log2RAM, ma la frequenza dipende da regole e timer.",
+      "category": "Sistema",
+      "categorySlug": "system"
+    },
+    {
+      "tool": "Nomi di interfaccia persistenti",
+      "what": "Scrive un file <code>/etc/systemd/network/10-proxmenux-&lt;iface&gt;.link</code> per scheda fisica, con intestazione «Managed by ProxMenux», che associa il MAC al nome attuale. I nomi <code>eth0</code> / <code>enp…</code> restano stabili dopo riavvii e aggiunte di schede.",
+      "category": "Rete",
+      "categorySlug": "network"
+    }
+  ],
+  "hardwareTitle": "Impostazioni predefinite in base all’hardware",
+  "hardwareBody": "Lo script legge l'hardware dell'host prima di applicare le impostazioni. Log2RAM è installato solo su dischi SSD/root NVMe per impostazione predefinita (richiede se il rilevamento indica diversamente). La dimensione del disco ram Log2RAM viene scelta dal totale RAM (<code>≤ 8 GB → 128M</code>, <code>≤ 16 GB → 256M</code>, <code>'>' 16 GB → 512M</code>). I limiti del journald vengono adattati alla dimensione del ramdisk quando Log2RAM è attivo, per evitare di riempirlo.",
+  "upgrade": {
+    "heading": "Aggiorna gli elenchi dei pacchetti e il sistema",
+    "intro": "Il primo passo del pacchetto automatizzato è l'aggiornamento Proxmox. La guida di aggiornamento di Proxmox per un host in esecuzione (nella stessa versione principale) è quella di eseguire:",
+    "after": "Questa riga è il comando ufficiale delle versioni attuali di Proxmox. Lo script automatizzato esegue <strong>esattamente</strong> questo e aggiunge la pulizia dei repository e le operazioni successive consigliate dalla guida — come l’utilità separata <link>Aggiornamento del sistema Proxmox</link>:",
+    "items": [
+      "Disabilita le sorgenti Enterprise <code>pve-enterprise.sources</code> / <code>ceph.sources</code>, rimuove i vecchi file dei repository e crea una sorgente no-subscription per il nome in codice dell’host.",
+      "Esegue l’aggiornamento senza interazione con <code>DEBIAN_FRONTEND=noninteractive</code> e <code>--force-confdef --force-confold</code>: conserva i file personalizzati anche quando sono cambiati nel progetto originale.",
+      "Installa pacchetti Proxmox essenziali se mancanti (<code>zfsutils-linux</code>, <code>proxmox-backup-restore-image</code>, <code>chrony</code>).",
+      "Controllo di coerenza dei metadati LVM, <code>apt-get autoremove -y</code> + <code>apt-get autoclean -y</code> e richiesta di riavvio solo se il kernel è cambiato."
+    ],
+    "sameTitle": "Stesso aggiornamento, due punti di ingresso",
+    "sameBody": "Il bundle automatizzato e l'utilità standalone <link>Proxmox System Update</link> condividono gli stessi script sottostanti (<code>update-pve8.sh</code> / <code>update-pve9_2.sh</code>). Utilizzare l'utilità da solo quando si desidera aggiornare l'host solo senza applicare il resto delle ottimizzazioni."
+  },
+  "endResult": {
+    "heading": "Risultato finale previsto",
+    "body": "Al termine vedrai un messaggio di successo con l’output di ogni passaggio e una richiesta di riavvio, necessario per alcune impostazioni del kernel. Puoi rimandarlo: le impostazioni si applicheranno al prossimo avvio.",
+    "imageAlt": "Script post-installazione automatizzato — output finale del terminale con ogni ottimizzazione applicata correttamente"
+  },
+  "notDoes": {
+    "heading": "Che cosa questo script NON fa",
+    "items": [
+      "Rilevamento automatico del fuso orario (commentato nel sorgente; usa Personalizzabile se ti serve).",
+      "Disattivare portmapper / rpcbind (vedi <secLink>Sicurezza</secLink>).",
+      "Abilitare IOMMU / VFIO (vedi <virtLink>Virtualizzazione</virtLink>).",
+      "Installare Fastfetch / Figurine / repository Ceph / HA / correzioni CPU AMD (vedi <optLink>Opzionali</optLink>).",
+      "Installare pigz o regolare ZFS ARC (vedi <perfLink>Prestazioni</perfLink> / <storLink>Archiviazione</storLink>)."
+    ]
+  },
+  "xshokTitle": "rilevamento xshok-proxmox",
+  "xshokBody": "Se l'host ha precedentemente eseguito lo script <code>xshok-proxmox</code>, ProxMenux rileva il file marcatore e ti avvisa prima di continuare. Alcune modifiche possono sovrapporsi. Lo script compagno è deprecato — se si decide di continuare comunque, rivedere <link> la panoramica</link> per contesto.",
+  "revert": {
+    "heading": "Ripristino",
+    "body": "Ogni strumento della tabella viene registrato in <code>/usr/local/share/proxmenux/installed_tools.json</code>. Apri <link>Disinstalla ottimizzazioni</link> per scegliere quali elementi ripristinare. Le copie dei file modificati sono accanto agli originali con suffisso <code>.bak</code>."
+  },
+  "related": {
+    "heading": "Correlati",
+    "items": [
+      {
+        "label": "Post-installazione personalizzabile",
+        "href": "/docs/post-install/customizable",
+        "tail": "— scegli esattamente quello che vuoi dallo stesso catalogo."
+      },
+      {
+        "label": "Disinstalla ottimizzazioni",
+        "href": "/docs/post-install/uninstall",
+        "tail": "— ripristinare qualsiasi sottoinsieme di ciò che è stato applicato qui."
+      },
+      {
+        "label": "Comandi di sistema utili",
+        "href": "/docs/help-info/system-commands",
+        "tail": " — verifica le modifiche (uptime, free, journalctl, ecc.)."
+      },
+      {
+        "label": "Panoramica post-install",
+        "href": "/docs/post-install",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/it/docs/post-install/basic-settings.json b/web/messages/it/docs/post-install/basic-settings.json
new file mode 100644
index 00000000..331ee23a
--- /dev/null
+++ b/web/messages/it/docs/post-install/basic-settings.json
@@ -0,0 +1,240 @@
+{
+  "meta": {
+    "title": "Post-Install: Impostazioni di base | Documentazione ProxMenux",
+    "description": "Opzioni di base post-installazione: passare ai repository Proxmox senza abbonamento e aggiornare il sistema, rilevare il fuso orario e attivare NTP, saltare le traduzioni APT e scegliere tra 25 utilità comuni da installare."
+  },
+  "header": {
+    "title": "Post-Install: Impostazioni di base",
+    "section": "Impostazioni post-installazione Proxmox"
+  },
+  "intro": {
+    "title": "Che cosa copre questa categoria",
+    "body": "Cinque opzioni di base per un host Proxmox nuovo: passare ai repository della community senza abbonamento, aggiornare tutto il sistema, configurare automaticamente fuso orario e NTP, disattivare le traduzioni APT per risparmiare banda e spazio e scegliere tra 25 utilità comuni."
+  },
+  "upgrade": {
+    "heading": "Aggiorna gli elenchi dei pacchetti e il sistema",
+    "intro": "Riconfigura APT per utilizzare il repository gratuito <em>pve-no-subscription</em> (invece del repo aziendale che richiede un abbonamento) e gestisce un aggiornamento completo del sistema. I passaggi esatti dipendono dalla versione principale di Proxmox VE: ProxMenux lo rileva e invia allo script giusto.",
+    "headerVersion": "Versione PVE",
+    "headerScript": "Script di selezione per versione",
+    "headerCodename": "Nome in codice Debian",
+    "rows": [
+      {
+        "version": "9.x",
+        "script": "update-pve9_2.sh",
+        "codename": "trixie"
+      },
+      {
+        "version": "8.x",
+        "script": "update-pve8.sh",
+        "codename": "bookworm"
+      }
+    ],
+    "officialTitle": "Raccomandazione ufficiale Proxmox",
+    "officialBody": "La guida ufficiale Proxmox consiglia questi comandi in quest’ordine:",
+    "officialOutro": "È il comando usuale per aggiornare all’interno della stessa versione principale di Proxmox VE. Controlla i repository e le modifiche proposte ai pacchetti <em>prima</em> di procedere. Il passaggio a un’altra versione principale richiede la procedura ufficiale di migrazione.",
+    "doesTitle": "Ciò che l'opzione ProxMenux fa — verificata contro lo script",
+    "doesIntro": "L’aggiornamento ProxMenux esegue i comandi apt indicati e aggiunge passaggi preliminari e finali che altrimenti dovresti gestire manualmente. L’elenco seguente corrisponde allo script di selezione; vedi <link>Aggiornamento del sistema Proxmox</link> per tutti i dettagli.",
+    "doesItems": [
+      "<strong>Prima di tutto, sistemare i repository.</strong> Disabilita i repository enterprise <code>pve-enterprise.sources</code> / <code>ceph.sources</code>, elimina i vecchi file dei repository rimasti dalle precedenti versioni di PVE e scrive un file <code>proxmox.sources</code> pulito che punta al canale gratuito <em>pve-no-subscription</em>, corrispondente al nome in codice Debian dell'host: trixie per PVE 9, bookworm per PVE 8.",
+      "<strong>Riscrive i repository Debian</strong> con main / updates / security e <code>non-free-firmware</code>, eliminando l’avviso del firmware durante l’aggiornamento.",
+      "<strong>Esegue l’aggiornamento ufficiale.</strong> <code>apt-get update</code> seguito da <code>apt full-upgrade -y</code> (PVE 9) oppure <code>apt dist-upgrade -y</code> (PVE 8), senza interazione con <code>--force-confdef --force-confold</code> per mantenere i file di configurazione personalizzati.",
+      "<strong>Installa i pacchetti essenziali</strong> se mancanti: <code>zfsutils-linux</code>, <code>proxmox-backup-restore-image</code>, <code>chrony</code>.",
+      "<strong>Controlla i metadati LVM.</strong> Cerca VM con passthrough dei dischi che potrebbero aver lasciato vecchie intestazioni di volumi fisici sui dischi grezzi. Segnala anomalie senza correzioni automatiche.",
+      "<strong>Pulisce al termine:</strong> <code>apt-get autoremove -y</code> + <code>apt-get autoclean -y</code>, poi chiede il riavvio se il kernel è stato aggiornato o esiste <code>/var/run/reboot-required</code>."
+    ],
+    "shortTitle": "In breve",
+    "shortBody": "L’opzione esegue il comando consigliato <code>apt update && apt full-upgrade -y</code>, aggiunge la sistemazione dei repository e la pulizia finale indicate nella guida ufficiale e chiede il riavvio al termine. Vedi <link>Aggiornamento del sistema Proxmox</link> per il diagramma completo: lo stesso strumento è disponibile separatamente nel menu principale.",
+    "subTitle": "Non applicare a un host con abbonamento",
+    "subBody": "Se hai un abbonamento Proxmox e vuoi mantenere i repository Enterprise, salta l’opzione. Disabilita Enterprise e passa al canale della community. L’aggiornamento dei pacchetti e la riscrittura dei repository non sono reversibili da Disinstalla ottimizzazioni; riconfigura esplicitamente i repository per cambiare canale in seguito.",
+    "safetyTitle": "Controllo di sicurezza post-update",
+    "safetyBody": "Dopo l’aggiornamento, lo script cerca vecchi metadati di volumi fisici (PV) sui dischi. Può accadere quando una VM con passthrough scrive intestazioni LVM su un disco grezzo. Se rileva qualcosa di sospetto, avvisa e suggerisce <code>pvs</code> per l’ispezione. Nessuna azione automatica."
+  },
+  "time": {
+    "heading": "Sincronizza l’ora automaticamente",
+    "intro": "Rileva l'IP pubblico del server tramite <code>dig myip.opendns.com @resolver1.opendns.com</code>, quindi chiede a <code>ipapi.co/'{'ip'}'/timezone</code> di cercare il fuso orario IANA corrispondente e applicarlo con <code>timedatectl set-timezone</code>. Infine consente NTP con <code>timedatectl set-ntp true</code>.",
+    "depTitle": "Dipende da due servizi esterni",
+    "depBody": "La ricerca si basa su OpenDNS e <code>ipapi.co</code> raggiungibile, e sulle loro risposte sono corrette. Se si esegue Proxmox dietro una VPN o su un VLAN che evade da una regione diversa, il fuso orario auto-detected potrebbe essere sbagliato. In questo caso saltare questa opzione e impostare il fuso orario a mano:",
+    "revertTitle": "Reversibile dal menu Disinstalla",
+    "revertBody": "<link>Disinstalla ottimizzazioni</link> reimposta il fuso orario su UTC, un valore sicuro. NTP resta attivo: l’orologio continua a sincronizzarsi e mostra UTC finché non imposti un altro fuso."
+  },
+  "languages": {
+    "heading": "Salta il download di lingue aggiuntive",
+    "intro": "Durante <code>apt update</code>, APT può scaricare descrizioni tradotte dei pacchetti oltre ai metadati principali. L’opzione le disattiva per risparmiare banda e spazio. Prima, ProxMenux <strong>verifica che la locale dell’host sia generata</strong>: legge <code>/etc/default/locale</code> o <code>/etc/environment</code>, aggiunge a <code>/etc/locale.gen</code> se manca ed esegue <code>locale-gen</code>. Le impostazioni locali della shell restano quindi intatte.",
+    "writtenTitle": "Cosa si scrive",
+    "revertTitle": "Reversibile dal menu Disinstalla",
+    "revertBody": "Cancellare <code>/etc/apt/apt.conf.d/99-disable-translations</code> (sia manualmente che dal menu Disinstalla) ripristina il comportamento predefinito e APT scarica nuovamente i file di lingua."
+  },
+  "utilities": {
+    "heading": "Installa utilità di sistema comuni",
+    "intro": "Apre una lista di <strong>25 utilità selezionate</strong> in gruppi. Scegli e conferma: ProxMenux le installa con <code>apt</code>, verifica il risultato e mostra un riepilogo finale.",
+    "imageAlt": "Selettore delle utilità ProxMenux: Spazio per selezionare, Invio per confermare",
+    "reuseTitle": "La stessa lista viene riutilizzata altrove",
+    "reuseBody": "Il catalogo di 25 utilità è definito in un solo punto: <code>PROXMENUX_UTILS</code> in <code>scripts/global/utils-install-functions.sh</code>. Il menu <em>Utilità e strumenti → Utilità di sistema</em> mostra la stessa lista per aggiungerne altre in seguito senza ripetere la post-installazione.",
+    "listTitle": "Cosa c'è nella lista",
+    "groups": [
+      {
+        "group": "Monitor di sistema",
+        "items": [
+          {
+            "pkg": "htop",
+            "desc": "Visualizzatore interattivo dei processi"
+          },
+          {
+            "pkg": "btop",
+            "desc": "Monitor di risorse moderne (CPU, RAM, dischi, rete, processi)"
+          },
+          {
+            "pkg": "s-tui",
+            "desc": "Interfaccia terminale per stress test e monitoraggio CPU"
+          },
+          {
+            "pkg": "iftop",
+            "desc": "Uso della larghezza di banda per connessione in tempo reale"
+          },
+          {
+            "pkg": "iotop",
+            "desc": "I/O disco per processo"
+          },
+          {
+            "pkg": "iptraf-ng",
+            "desc": "Monitor LAN IP interattivo"
+          }
+        ]
+      },
+      {
+        "group": "Rete",
+        "items": [
+          {
+            "pkg": "iperf3",
+            "desc": "Misura la larghezza di banda massima raggiungibile tra gli host"
+          },
+          {
+            "pkg": "net-tools",
+            "desc": "Strumenti legacy (ifconfig, netstat, route). Ancora utile per i controlli rapidi."
+          },
+          {
+            "pkg": "ipset",
+            "desc": "Gestire grandi set IP nel kernel — utile con le regole iptables/nftables."
+          }
+        ]
+      },
+      {
+        "group": "Download e archivi",
+        "items": [
+          {
+            "pkg": "axel",
+            "desc": "Acceleratore di download parallelo leggero"
+          },
+          {
+            "pkg": "aria2",
+            "desc": "Downloader multi-source / multi-protocollo (HTTP, FTP, BitTorrent, Metalink)"
+          },
+          {
+            "pkg": "unzip",
+            "desc": "Estrarre archivi ZIP"
+          },
+          {
+            "pkg": "zip",
+            "desc": "Crea archivi ZIP"
+          },
+          {
+            "pkg": "cabextract",
+            "desc": "Estrarre archivi Microsoft CAB (utile con le ISO di Windows)"
+          },
+          {
+            "pkg": "wimtools",
+            "desc": "Gestire immagini WIM di Windows (estrarre, dividere, montare, applicare)"
+          },
+          {
+            "pkg": "genisoimage",
+            "desc": "Costruisci immagini ISO 9660 da un albero di directory"
+          }
+        ]
+      },
+      {
+        "group": "Testo e file",
+        "items": [
+          {
+            "pkg": "dos2unix",
+            "desc": "Convertire i terminatori di riga CRLF (Windows) in LF (Unix)"
+          },
+          {
+            "pkg": "grc",
+            "desc": "Colorazione generica: applica l’evidenziazione della sintassi all’output di ping, traceroute, dig, tail e altri comandi"
+          },
+          {
+            "pkg": "plocate",
+            "desc": "Ricerca file veloce (indicizzata). Eseguire `updatedb` dopo l'installazione per costruire l'indice."
+          }
+        ]
+      },
+      {
+        "group": "Accesso remoto e sessioni",
+        "items": [
+          {
+            "pkg": "sshpass",
+            "desc": "Autenticazione SSH con password senza interazione (utile negli script, non nell’uso quotidiano)"
+          },
+          {
+            "pkg": "tmux",
+            "desc": "Multiplexer di terminale: scollegare sessioni, dividere pannelli e mantenere le sessioni dopo una disconnessione"
+          }
+        ]
+      },
+      {
+        "group": "Hardware e basso livello",
+        "items": [
+          {
+            "pkg": "msr-tools",
+            "desc": "Lettura/scrittura dei registri specifici del modello CPU (rdmsr, wrmsr)"
+          },
+          {
+            "pkg": "intel-gpu-tools",
+            "desc": "Utilità diagnostiche Intel GPU tra cui `intel_gpu_top`"
+          }
+        ]
+      },
+      {
+        "group": "Virtualizzazione",
+        "items": [
+          {
+            "pkg": "libguestfs-tools",
+            "desc": "Ispezionare e modificare immagini disco VM (virt-ls, virt-cat, guestmount...)"
+          },
+          {
+            "pkg": "chntpw",
+            "desc": "Modifica SAM di Windows — utile per il recupero di password su VM Windows che eredite"
+          }
+        ]
+      }
+    ],
+    "actionTitle": "Alcuni di loro in azione",
+    "noBulkTitle": "Vengono rimosse solo le utilità installate da ProxMenux",
+    "noBulkBody": "ProxMenux registra solo i pacchetti selezionati che non erano già installati. Disinstalla ottimizzazioni li rimuove completamente e conserva quelli già presenti. Gli aggiornamenti APT non hanno un ripristino atomico sicuro: disinstallare le utilità non annulla l’aggiornamento del sistema."
+  },
+  "related": {
+    "heading": "Correlati",
+    "items": [
+      {
+        "label": "Aggiornamento sistema Proxmox",
+        "href": "/docs/utils/system-update",
+        "tail": " — Riesegue il ciclo apt update + dist-upgrade su richiesta."
+      },
+      {
+        "label": "Installatore delle utilità di sistema",
+        "href": "/docs/utils/system-utils",
+        "tail": "— installare (o reinstallare) le utilità singolarmente dopo l'installazione."
+      },
+      {
+        "label": "Comandi aggiornamenti e pacchetti",
+        "href": "/docs/help-info/update-commands",
+        "tail": " — Riferimento apt per la shell."
+      },
+      {
+        "label": "Post-installazione personalizzabile",
+        "href": "/docs/post-install/customizable",
+        "tail": " — torna al menu superiore."
+      }
+    ]
+  }
+}
diff --git a/web/messages/it/docs/post-install/customizable.json b/web/messages/it/docs/post-install/customizable.json
new file mode 100644
index 00000000..1526a3b9
--- /dev/null
+++ b/web/messages/it/docs/post-install/customizable.json
@@ -0,0 +1,106 @@
+{
+  "meta": {
+    "title": "Script post-installazione personalizzabile | Documentazione ProxMenux",
+    "description": "Scegli esattamente quali ottimizzazioni applicare a un host Proxmox VE con ProxMenux. 10 categorie, circa 35 strumenti e un’interfaccia con caselle di selezione. Include tutto lo script Automatizzato, più opzioni esplicite (IOMMU, Fastfetch, Figurine, Ceph, HA, correzioni AMD…).",
+    "ogTitle": "Script post-installazione personalizzabile | Documentazione ProxMenux",
+    "ogDescription": "10 categorie, circa 35 ottimizzazioni individuali. Scegli esattamente cosa vuoi su un host Proxmox VE. Le modifiche reversibili sono registrate."
+  },
+  "header": {
+    "title": "Script post-installazione personalizzabile",
+    "description": "Scegli esattamente quali ottimizzazioni applicare a un host Proxmox VE. ProxMenux raggruppa circa 35 strumenti in 10 categorie in un’unica finestra con caselle di selezione. Lo stesso motore di Automatizzato, con controllo completo sulle modifiche.",
+    "section": "Post-installazione · Personalizzabile"
+  },
+  "intro": {
+    "title": "Quando scegliere Personalizzabile",
+    "body": "Scegli questa opzione se sai già quali regolazioni vuoi o non vuoi sull’host. Una lista con caselle raggruppate per categoria permette di selezionare, deselezionare e combinare le ottimizzazioni. Puoi riapplicarle in seguito; le modifiche reversibili sono registrate per <link>Disinstalla ottimizzazioni</link>. Gli aggiornamenti dei pacchetti non sono presentati come reversibili."
+  },
+  "compare": {
+    "heading": "Confronto con Automatizzato",
+    "body": "Personalizzabile include tutto lo <link>script Automatizzato</link>: le stesse 14 ottimizzazioni di base e molte opzioni che Automatizzato omette intenzionalmente, utili per hardware specifico (correzioni AMD), hosting specifico (OVH RTM) o carichi particolari (IOMMU/VFIO, repository Ceph, alta disponibilità, Fastfetch, Figurine, regolazione dell’ARC ZFS, pigz, istantanee ZFS automatiche, limiti di velocità vzdump, Open vSwitch, TCP BBR…)."
+  },
+  "categoriesSection": {
+    "heading": "Le 10 categorie",
+    "body": "Lo script Personalizzabile raggruppa le ottimizzazioni in 10 categorie in un’unica finestra con caselle di selezione. Ogni categoria ha una pagina di documentazione: apri una scheda per motivazioni, valori predefiniti e verifiche di ogni opzione."
+  },
+  "categories": [
+    {
+      "name": "Impostazioni di base",
+      "description": "Pulisce le sorgenti APT, esegue l’aggiornamento ufficiale Proxmox e imposta fuso orario, impostazioni locali e utilità comuni. La base di tutte le altre categorie."
+    },
+    {
+      "name": "Sistema",
+      "description": "Regola i log e i limiti del kernel per un host che ospita molte VM e container. Include journald, logrotate, sysctl (memoria, limiti dei file), comportamento in caso di kernel panic e riavvii rapidi."
+    },
+    {
+      "name": "Virtualizzazione",
+      "description": "Prepara l’host per la virtualizzazione avanzata. Installa l’agente guest adatto quando Proxmox stesso gira in una VM supportata e abilita IOMMU/VFIO per il passthrough PCI di GPU, controller e TPU."
+    },
+    {
+      "name": "Rete",
+      "description": "Rafforza e regola lo stack di rete dell’host. Forza APT su IPv4, applica impostazioni di sicurezza sysctl e buffer TCP, offre Open vSwitch, TCP BBR e TCP Fast Open e associa nomi persistenti delle interfacce agli indirizzi MAC."
+    },
+    {
+      "name": "Archiviazione",
+      "description": "Configura i comuni sottosistemi di archiviazione Proxmox: dimensione dell’ARC ZFS, istantanee ZFS automatiche, autotrim ZFS per pool SSD/NVMe e limiti di velocità vzdump per evitare di saturare i dischi durante i backup."
+    },
+    {
+      "name": "Sicurezza",
+      "description": "Riduce la superficie di attacco esposta per impostazione predefinita. Disattiva i servizi RPC portmapper/rpcbind che Proxmox non richiede ma lascia in ascolto."
+    },
+    {
+      "name": "Personalizzazione",
+      "description": "Modificare l'esperienza visiva e shell dell'ospite: colori e alias in bashrc, banner MOTD e rimozione dell'avviso di abbonamento nell'interfaccia utente web."
+    },
+    {
+      "name": "Monitoraggio",
+      "description": "Integra l’host con OVH Real-Time Monitoring. Installa RTM solo se ProxMenux rileva un server OVH; sugli altri host non apporta modifiche."
+    },
+    {
+      "name": "Prestazioni",
+      "description": "Accelerare le operazioni di compressione (backup, trasferimenti) sostituendo gzip con la sua controparte parallela pigz."
+    },
+    {
+      "name": "Opzionale",
+      "description": "Opzioni specializzate non necessarie a tutti gli host: correzioni CPU AMD, banner Fastfetch, nome host 3D con Figurine, aggiornamento dell’indice PVE Appliance Manager, repository Ceph, servizi di alta disponibilità, Log2RAM per ridurre l’usura degli SSD e profilo swap ZRAM."
+    }
+  ],
+  "mixTip": {
+    "title": "Combina Automatizzato e Personalizzabile",
+    "body": "Un uso comune: esegui prima <strong>Automatizzato</strong> per la configurazione di base, poi apri <strong>Personalizzabile</strong> e scegli solo gli strumenti opzionali utili, come IOMMU per il passthrough GPU. Le modifiche sono registrate separatamente; Disinstalla mostra tutto ciò che hai applicato, indipendentemente dalla modalità usata."
+  },
+  "related": {
+    "heading": "Correlati",
+    "items": [
+      {
+        "label": "Post-installazione automatizzata",
+        "href": "/docs/post-install/automated",
+        "tail": " — impostazioni predefinite ragionevoli applicate senza domande."
+      },
+      {
+        "label": "Disinstalla ottimizzazioni",
+        "href": "/docs/post-install/uninstall",
+        "tail": " — annulla in modo pulito le opzioni selezionate."
+      },
+      {
+        "label": "Impostazioni di base",
+        "href": "/docs/post-install/basic-settings",
+        "tail": "— repos, tempo, lingua, utilità."
+      },
+      {
+        "label": "Virtualizzazione",
+        "href": "/docs/post-install/virtualization",
+        "tail": "— IOMMU + VFIO per il passaggio."
+      },
+      {
+        "label": "Sicurezza",
+        "href": "/docs/post-install/security",
+        "tailRich": " · <storageLink>Archiviazione</storageLink> · <networkLink>Rete</networkLink> · <customLink>Personalizzazione</customLink> — altre categorie."
+      },
+      {
+        "label": "Panoramica post-installazione",
+        "href": "/docs/post-install",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/it/docs/post-install/customization.json b/web/messages/it/docs/post-install/customization.json
new file mode 100644
index 00000000..6bc72270
--- /dev/null
+++ b/web/messages/it/docs/post-install/customization.json
@@ -0,0 +1,74 @@
+{
+  "meta": {
+    "title": "Post-Install: Personalizzazione | Documentazione ProxMenux",
+    "description": "Opzioni di personalizzazione nello script post-installazione personalizzabile di ProxMenux: prompt bash colorato con alias utili, banner ProxMenux nel MOTD e rimozione dell’avviso di abbonamento dall’interfaccia web Proxmox."
+  },
+  "header": {
+    "title": "Dopo l'installazione: personalizzazione",
+    "description": "Regolazioni estetiche e pratiche per l’host Proxmox. Rendono la shell più piacevole e nascondono l’avviso di abbonamento nell’interfaccia web. Bashrc, MOTD e banner sono registrati e reversibili dal menu Disinstalla.",
+    "section": "Impostazioni post-installazione Proxmox"
+  },
+  "intro": {
+    "title": "Che cosa copre questa categoria",
+    "body": "Tre piccole opzioni indipendenti: un <strong>prompt bash colorato con alias</strong> per la shell root, un <strong>banner MOTD</strong> di una riga visibile all’accesso SSH e la rimozione della <strong>finestra «Nessun abbonamento valido»</strong> mostrata a ogni accesso all’interfaccia web Proxmox."
+  },
+  "bashrc": {
+    "heading": "Personalizza bashrc",
+    "intro": "Inserisce in <code>/root/.bashrc</code> un blocco con prompt colorato, cronologia con data e ora, alias standard di <code>ls</code> / <code>grep</code> e un <code>source</code> per il completamento bash. Migliora il lavoro via SSH e rende chiaro su quale host ti trovi quando hai molte schede aperte.",
+    "writesTitle": "Ciò che ProxMenux aggiunge a .bashrc",
+    "writesOutro": "Il blocco è delimitato dai marcatori <code>PMX_CORE_BASHRC</code>. Eseguire di nuovo lo script sostituisce il blocco precedente senza duplicarlo. L’originale <code>.bashrc</code> viene salvato una volta in <code>/root/.bashrc.bak</code> e una riga <code>source /root/.bashrc</code> viene aggiunta a <code>/root/.bash_profile</code> per applicare il prompt anche alle shell di login, ad esempio dopo <code>su -</code>.",
+    "rootTitle": "Si applica solo a root",
+    "rootBody": "La personalizzazione si applica alla shell dell’account root. Gli altri utenti creati sull’host mantengono le proprie impostazioni predefinite. Se amministri Proxmox esclusivamente dall’interfaccia web e non usi mai la shell, questa opzione ha solo un effetto estetico e puoi saltarla."
+  },
+  "motd": {
+    "heading": "Imposta un banner MOTD personalizzato",
+    "intro": "Antepone <em>\"This system is optimised by: ProxMenux\"</em> a <code>/etc/motd</code>, il messaggio dopo un accesso SSH riuscito, sopra il prompt e prima degli script <code>update-motd</code>. Innocuo e puramente informativo: conferma a colpo d’occhio che ProxMenux è stato applicato sull’host.",
+    "writesTitle": "Cosa scrive ProxMenux",
+    "writesOutro": "Alla prima applicazione, ProxMenux registra se <code>/etc/motd</code> esisteva e ne salva il contenuto originale in <code>/usr/local/share/proxmenux</code>. L’operazione è idempotente: se la riga identificativa è già presente, non viene aggiunta. Le installazioni precedenti con <code>/etc/motd.bak</code> vengono migrate allo stesso stato reversibile."
+  },
+  "banner": {
+    "heading": "Rimuovi il banner di abbonamento",
+    "intro": "Rimuove la finestra <em>«Non hai un abbonamento valido per questo server»</em> che appare a ogni accesso web Proxmox senza abbonamento Enterprise. ProxMenux tiene conto della versione e avvia lo script adatto ai diversi pacchetti dell’interfaccia delle versioni principali.",
+    "versionTitle": "Scelta dello script in base alla versione",
+    "versionItems": [
+      "<strong>PVE 9.x</strong> → esegue <code>remove-banner-pve-v3.sh</code>, che modifica <code>proxmoxlib.js</code> per desktop e la nuova interfaccia mobile basata su Yew.",
+      "<strong>PVE 8.x</strong> → esegue <code>remove-banner-pve8.sh</code>, solo per l’interfaccia desktop."
+    ],
+    "versionOutro": "Prima della modifica, ProxMenux salva i file JS/template originali in <code>/usr/local/share/proxmenux/backups/</code> con data e ora. Disinstalla usa queste copie per ripristinarli; se il backup manca o è danneggiato, reinstalla i pacchetti dell’interfaccia Proxmox.",
+    "breakTitle": "Può rompersi dopo gli aggiornamenti di Proxmox",
+    "breakBody": "Gli aggiornamenti dell’interfaccia Proxmox sovrascrivono spesso <code>proxmoxlib.js</code> e possono far tornare l’avviso. Puoi riapplicare l’opzione per modificare il file oppure accettare l’avviso fino ad allora. ProxMenux installa anche un hook APT che riapplica la modifica dopo gli aggiornamenti dei pacchetti: vedi <link>Disinstalla ottimizzazioni</link> per rimuoverlo.",
+    "legalTitle": "Nota legale (sempre vale la pena ripetere)",
+    "legalBody": "Questa opzione nasconde solo l’avviso dell’interfaccia. <strong>Non</strong> concede supporto Enterprise o accesso al repository Enterprise e non cambia la licenza del software. Proxmox VE è distribuito sotto GNU AGPLv3. Un abbonamento sostiene il progetto e dà accesso al canale di aggiornamento Enterprise: scegli il supporto adatto al tuo ambiente."
+  },
+  "verify": {
+    "heading": "Verifica",
+    "intro": "Dopo aver applicato tutti e tre:",
+    "reversibleTitle": "Tutti e tre i cambiamenti di personalizzazione sono tracciati",
+    "reversibleBody": "<link>Disinstalla ottimizzazioni</link> ripristina <code>/root/.bashrc</code>, riporta MOTD al contenuto esatto precedente a ProxMenux o elimina il file se prima non esisteva e ripristina i file dell’interfaccia modificati dal backup oppure reinstalla i pacchetti necessari."
+  },
+  "related": {
+    "heading": "Correlati",
+    "items": [
+      {
+        "label": "Opzionale",
+        "href": "/docs/post-install/optional",
+        "tail": " — Fastfetch e Figurine, altre personalizzazioni visive."
+      },
+      {
+        "label": "Mostra informazioni sulla versione",
+        "href": "/docs/settings/show-version-information",
+        "tail": " — conferma che le personalizzazioni sono registrate come installate."
+      },
+      {
+        "label": "Disinstalla ottimizzazioni",
+        "href": "/docs/post-install/uninstall",
+        "tail": " — ripristina bashrc, motd e l’avviso di abbonamento."
+      },
+      {
+        "label": "Post-installazione personalizzabile",
+        "href": "/docs/post-install/customizable",
+        "tail": " — torna al menu superiore."
+      }
+    ]
+  }
+}
diff --git a/web/messages/it/docs/post-install/index.json b/web/messages/it/docs/post-install/index.json
new file mode 100644
index 00000000..cdb0054b
--- /dev/null
+++ b/web/messages/it/docs/post-install/index.json
@@ -0,0 +1,106 @@
+{
+  "meta": {
+    "title": "Script post-installazione di Proxmox VE — Automatizzato e personalizzabile | ProxMenux",
+    "description": "Panoramica degli script post-installazione di ProxMenux per Proxmox VE. Automatizzato applica impostazioni predefinite ragionevoli senza domande; Personalizzabile permette di scegliere esattamente cosa applicare in 10 categorie; Disinstalla ottimizzazioni ripristina le modifiche reversibili supportate.",
+    "ogTitle": "Script post-installazione di Proxmox VE — Automatizzato e personalizzabile",
+    "ogDescription": "Applica le comuni ottimizzazioni post-installazione di Proxmox VE in 10 categorie, automaticamente o a scelta, con opzioni reversibili.",
+    "twitterTitle": "Script dopo l'installazione di Proxmox VE | ProxMenux",
+    "twitterDescription": "Ottimizzazione post-installazione automatizzata e personalizzabile per Proxmox VE — con opzioni reversibili."
+  },
+  "header": {
+    "title": "Script dopo l'installazione",
+    "description": "Configura un host Proxmox VE appena installato con le ottimizzazioni post-installazione di ProxMenux. Applica automaticamente la configurazione di base, scegli le singole opzioni, aggiorna le funzioni installate o ripristina le modifiche reversibili supportate. Gli aggiornamenti dei pacchetti non sono presentati come reversibili.",
+    "section": "Impostazioni post-installazione Proxmox"
+  },
+  "intro": {
+    "title": "A cosa serve questo menu",
+    "body": "Dopo l’installazione di Proxmox VE, decine di piccole modifiche rendono l’host più veloce e più facile da mantenere: repository senza abbonamento, limiti ragionevoli per journald, buffer TCP adeguati, salvataggio dei log che preserva gli SSD, miglioramenti di bashrc e altro. ProxMenux le automatizza e registra le modifiche di configurazione reversibili supportate."
+  },
+  "openingMenu": {
+    "heading": "Apertura del menu",
+    "body": "Dal menu principale di ProxMenux, selezionare <strong>Impostazioni post-installazione Proxmox</strong>. Vedrai questo:",
+    "imageAlt": "Menu degli script post-installazione: Automatizzato, Personalizzabile, la voce condizionale Applica aggiornamenti disponibili (solo se ci sono aggiornamenti in attesa) e Disinstalla, seguiti dalla sezione Script della community"
+  },
+  "threeWays": {
+    "heading": "Quattro modi per applicare le ottimizzazioni",
+    "body": "Le quattro voci ProxMenux condividono lo stesso codice e registro degli strumenti installati, offrendo diversi livelli di controllo. <em>Applica aggiornamenti disponibili</em> compare solo se almeno un’ottimizzazione installata ha una versione su disco più recente di quella registrata; resta nascosta su un host appena configurato."
+  },
+  "routes": [
+    {
+      "title": "Automatizzato",
+      "description": "Una serie curata di 14 ottimizzazioni sicure e sempre utili applicate in sequenza con zero prompt. Buon default per la maggior parte degli utenti.",
+      "bullets": [
+        "Repository senza abbonamento + aggiornamento del sistema",
+        "Memoria, kernel, rete tuning",
+        "Log2RAM (rilevamento automatico su SSD/NVMe)",
+        "Limiti di dimensione Journald + logrotate",
+        "Nomi di interfaccia persistenti"
+      ]
+    },
+    {
+      "title": "Personalizzabile",
+      "description": "Circa 35 ottimizzazioni individuali in 10 categorie. Scegli esattamente quali applicare. Lo stesso motore di Automatizzato, con controllo completo.",
+      "bullets": [
+        "Interfaccia con caselle di selezione per categoria",
+        "Include tutto ciò che fa Automatizzato, più opzioni da attivare esplicitamente (IOMMU, Fastfetch, Figurine, Ceph, HA, correzioni AMD…)",
+        "Eseguilo quante volte vuoi: le modifiche sono idempotenti"
+      ]
+    },
+    {
+      "title": "Applica aggiornamenti disponibili",
+      "description": "Quando un’ottimizzazione post-installazione (Log2Ram, impostazioni della memoria, Logrotate…) ha una versione su disco più recente di quella registrata sull’host, questa voce mostra solo quelle cambiate. Esegue di nuovo la funzione corrispondente e aggiorna il registro, senza toccare altro.",
+      "bullets": [
+        "Scelta esplicita per ogni ottimizzazione, solo quelle cambiate",
+        "Lo stesso selettore è disponibile nella dashboard di Monitor",
+        "Un’unica notifica raggruppata quando arrivano nuovi aggiornamenti"
+      ]
+    },
+    {
+      "title": "Disinstalla ottimizzazioni",
+      "description": "Le modifiche reversibili supportate sono registrate in un registro JSON e associate a una funzione di ripristino. Le azioni senza un ripristino sicuro, come un aggiornamento completo dei pacchetti, sono escluse intenzionalmente.",
+      "bullets": [
+        "Rileva automaticamente le ottimizzazioni precedentemente applicate",
+        "Sceglie il ripristino adatto a ogni voce: ripristina il backup .bak, se creato, elimina il frammento di configurazione sysctl.d se non serviva alcun backup oppure reinstalla il pacchetto originale con --force-confnew (ad esempio per il banner dell’abbonamento)",
+        "Richiesta di riavvio se necessario (VFIO, nomi persistenti, ecc.)"
+      ]
+    }
+  ],
+  "whichTitle": "Quale dovrebbe scegliere?",
+  "whichBody": "Per una nuova installazione Proxmox con una configurazione di base ragionevole senza decisioni: <autoLink><strong>Automatizzato</strong></autoLink>. Se sai già quali regolazioni vuoi o non vuoi: <customLink><strong>Personalizzabile</strong></customLink>. Per aggiornare solo un’ottimizzazione già applicata di cui esiste una versione più recente su disco: <updatesLink><strong>Applica aggiornamenti disponibili</strong></updatesLink>. Per annullare in modo pulito modifiche precedenti: <uninstallLink><strong>Disinstalla ottimizzazioni</strong></uninstallLink>. Puoi combinarli: prima Automatizzato, poi aggiungi opzioni come Fastfetch o IOMMU con Personalizzabile e annulla singole voci in seguito.",
+  "mixing": {
+    "heading": "Combinare con altri script post-installazione",
+    "stackTitle": "Non impilare più script post-installazione",
+    "stackBody": "Eseguire più script post-installazione sullo stesso host può creare file di configurazione duplicati, voci sysctl in conflitto o persino interrompere la rete dopo il riavvio. Se hai già applicato <strong>Helper-Scripts Post Install</strong>, alcune ottimizzazioni ProxMenux possono sovrapporsi alla sua configurazione. Usa un solo strumento post-installazione per host.",
+    "xshokTitle": "xshok-proxmox: deprecato",
+    "xshokBody": "Le versioni precedenti di ProxMenux indicavano <a>xshok-proxmox</a> come strumento post-installazione complementare. Il progetto è ora deprecato e non è più offerto da ProxMenux. Se una vecchia esecuzione ha lasciato marcatori sull’host, ProxMenux li rileva ancora e avvisa. Oggi non è però uno strumento da installare accanto a ProxMenux."
+  },
+  "community": {
+    "heading": "Script della community",
+    "body": "Il menu offre anche due script di terze parti del progetto <a>community-scripts</a>: <em>Proxmox VE Post Install</em> e <em>Proxmox VE Microcode</em>. Sono wrapper che scaricano ed eseguono gli script originali tramite <code>wget | bash</code>. ProxMenux non li mantiene. Vedi <link>Repository esterni</link> per dettagli e valutazioni sull’affidabilità prima di eseguirli."
+  },
+  "related": {
+    "heading": "Correlati",
+    "items": [
+      {
+        "label": "Aggiornamento sistema Proxmox",
+        "href": "/docs/utils/system-update",
+        "tail": "— mantiene l'host aggiornato una volta che è stato post-installato."
+      },
+      {
+        "label": "Sicurezza",
+        "href": "/docs/security",
+        "tail": " — Fail2Ban + Lynis oltre alle misure di sicurezza post-installazione."
+      },
+      {
+        "label": "Mostra informazioni sulla versione",
+        "href": "/docs/settings/show-version-information",
+        "tail": "— vedere quali componenti post-installazione vengono tracciati come installati."
+      },
+      {
+        "label": "Comandi aggiornamenti e pacchetti",
+        "href": "/docs/help-info/update-commands",
+        "tail": "— riferimento per apt / pveupgrade."
+      }
+    ]
+  }
+}
diff --git a/web/messages/it/docs/post-install/monitoring.json b/web/messages/it/docs/post-install/monitoring.json
new file mode 100644
index 00000000..59891a2c
--- /dev/null
+++ b/web/messages/it/docs/post-install/monitoring.json
@@ -0,0 +1,56 @@
+{
+  "meta": {
+    "title": "Post-Install: Monitoraggio | Documentazione ProxMenux",
+    "description": "Opzioni di monitoraggio nello script ProxMenux Personalizzabile post-installazione. Attualmente un'unica opzione: installare OVH Real-Time Monitoring (RTM), che si attiva solo se l'host viene rilevato come server OVH."
+  },
+  "header": {
+    "title": "Dopo l'installazione: monitoraggio",
+    "description": "Opzioni di monitoraggio all'interno dello script di installazione post personalizzabile. Questa categoria è piccola e specifica del fornitore — installa l'agente di monitoraggio OVH in tempo reale su server OVH dedicati e non fa nulla altrove.",
+    "section": "Impostazioni post-installazione Proxmox"
+  },
+  "intro": {
+    "title": "Ambito volutamente limitato",
+    "body": "Il monitoraggio post-installazione si limita a <strong>un agente specifico di un fornitore</strong>. Gli strumenti generici (Prometheus, Grafana, node_exporter) sono esclusi perché richiedono scelte architetturali — host separato, conservazione dei dati, destinazioni degli avvisi — che non si adattano a un passaggio con un clic. ProxMenux Monitor, incluso in ProxMenux, svolge gran parte di quel ruolo senza agenti esterni."
+  },
+  "ovh": {
+    "heading": "Installare il monitoraggio in tempo reale OVH (RTM)",
+    "intro": "Se il vostro host Proxmox è un server dedicato affittato da <a>OVHcloud</a>, è possibile attivare RTM per esporre la telemetria hardware (CPU temperatura, stato PSU, disco SMART, stato del controller RAID, ecc.) al pannello di controllo OVH. Questo è lo stesso agente OVH utilizza per la propria funzione \"Server Monitoring\".",
+    "decisionsTitle": "Come decide ProxMenux",
+    "decisionsItems": [
+      "Ottiene l'IP pubblico dell'host tramite <code>curl ipinfo.io/ip</code>.",
+      "Cerca il provider proprietario tramite una query <code>whois</code> a <code>v4.whois.cymru.com</code>.",
+      "Se il risultato menziona OVH, scarica <code>last-public-ovh-infra-yak.snap.mirrors.ovh.net/yak/archives/apply.sh</code> e lo passa a <code>bash</code> con il manifest Puppet di RTM v2.",
+      "Se il risultato <em>non</em> menziona OVH, non è installato nulla. L'opzione è una no-op."
+    ],
+    "remoteTitle": "Script remoto passato a bash tramite pipe",
+    "remoteBody": "L’installazione esegue <code>wget -qO - https://…apply.sh | bash</code>. Se il mirror OVH viene compromesso, lo script viene eseguito come root sull’host. Prima di attivare l’opzione, valuta la fiducia nella catena dei mirror OVH rispetto al beneficio del monitoraggio. Per la maggior parte degli utenti domestici o non OVH, l’opzione dovrebbe restare disattivata.",
+    "noOpTitle": "Attiva solo se l'host è effettivamente in OVH",
+    "noOpBody": "L’opzione non modifica i server non OVH, quindi selezionarla su un Proxmox domestico non rompe nulla. Su un host non OVH lo script mostra <em>«Non è un server OVH, installazione RTM saltata»</em> e termina senza installare pacchetti.",
+    "runsTitle": "Cosa esegue ProxMenux",
+    "verifyTitle": "Verifica",
+    "verifyBody": "Su un vero host OVH, dopo il riavvio dovresti vedere la <a>dashboard RTM</a> in OVH Manager con dati dell’host in tempo reale. Sul lato Proxmox, il raccoglitore RTM è un servizio systemd: controllalo direttamente:",
+    "troubleTitle": "Risoluzione dei problemi",
+    "revertTitle": "Rimuovi RTM dal menu Disinstalla",
+    "revertBody": "Se RTM è registrato come installato, Disinstalla ottimizzazioni offre una voce OVH Real-Time Monitoring. Esegue <code>apt-get purge -y ''ovh-rtm*'' ''rtm'' ''rtm-*''</code>, elimina /etc/rtm e registra RTM come disinstallato. I residui Puppet possono richiedere pulizia manuale: controlla i manifest specifici di RTM in <code>/etc/puppet/</code>. Su un host non OVH non sono stati installati pacchetti RTM, quindi non c’è nulla da rimuovere."
+  },
+  "related": {
+    "heading": "Correlati",
+    "items": [
+      {
+        "label": "ProxMenux Monitor",
+        "href": "/docs/settings/proxmenux-monitor",
+        "tail": "— dashboard web locale per l'host (lavora su qualsiasi fornitore, non solo OVH)."
+      },
+      {
+        "label": "Comandi di sistema utili",
+        "href": "/docs/help-info/system-commands",
+        "tail": " — riferimento per il monitoraggio dell’host locale."
+      },
+      {
+        "label": "Post-installazione personalizzabile",
+        "href": "/docs/post-install/customizable",
+        "tail": " — torna al menu superiore."
+      }
+    ]
+  }
+}
diff --git a/web/messages/it/docs/post-install/network.json b/web/messages/it/docs/post-install/network.json
new file mode 100644
index 00000000..0c988d22
--- /dev/null
+++ b/web/messages/it/docs/post-install/network.json
@@ -0,0 +1,128 @@
+{
+  "meta": {
+    "title": "Post-installazione: Rete | Documentazione ProxMenux",
+    "description": "Opzioni di rete dello script post-installazione personalizzabile ProxMenux: forzare APT su IPv4, applicare un profilo sysctl selezionato, installare Open vSwitch, abilitare TCP BBR + Fast Open e associare i nomi delle interfacce ai loro indirizzi MAC."
+  },
+  "header": {
+    "title": "Post-Install: Rete",
+    "section": "Impostazioni post-installazione Proxmox"
+  },
+  "intro": {
+    "title": "Che cosa copre questa categoria",
+    "body": "Cinque opzioni di rete indipendenti. Due sono semplici (<strong>APT su IPv4</strong>, <strong>installazione di Open vSwitch</strong>), due regolano il comportamento TCP (<strong>profilo sysctl di rete</strong>, <strong>BBR + Fast Open</strong>) e una risolve un problema comune: <strong>fissare i nomi delle interfacce</strong>, affinché una nuova scheda di rete o un aggiornamento BIOS non rinomini <code>enp3s0</code> in <code>enp4s0</code> e non interrompa i bridge."
+  },
+  "ipv4": {
+    "heading": "Forza APT a usare IPv4",
+    "intro": "Scrive <code>Acquire::ForceIPv4 \"true\";</code> a <code>/etc/apt/apt.conf.d/99-force-ipv4</code>. APT si rifiuta quindi di utilizzare IPv6 per i download dei pacchetti, anche se l'host ha connettività IPv6.",
+    "tipTitle": "Chi beneficia",
+    "tipBody": "Utile se la connessione IPv6 è instabile, più lenta di IPv4 o se il mirror Debian/Proxmox a volte non funziona su IPv6. Non crea problemi sugli host senza IPv6. Su una rete dual stack funzionante rende il comportamento prevedibile: apt non ti sorprenderà con un timeout IPv6."
+  },
+  "sysctl": {
+    "heading": "Applica ottimizzazioni di rete",
+    "intro": "Scrive un profilo sysctl selezionato in <code>/etc/sysctl.d/99-network.conf</code>: buffer dei socket del kernel, rafforzamento di ICMP, protezione di base dallo spoofing e dimensioni dei buffer TCP adatte a un hypervisor con molti flussi simultanei.",
+    "tunedTitle": "Cosa viene regolato",
+    "headerArea": "Settore",
+    "headerSettings": "Impostazioni chiave",
+    "rows": [
+      {
+        "area": "Buffer dei socket del kernel",
+        "settings": "<code>netdev_max_backlog=8192</code>, <code>rmem_max=16M</code>, <code>wmem_max=16M</code>, <code>somaxconn=8192</code>"
+      },
+      {
+        "area": "Rafforzamento di ICMP",
+        "settings": "<code>icmp_echo_ignore_broadcasts=1</code>, <code>icmp_ignore_bogus_error_responses=1</code>"
+      },
+      {
+        "area": "Sicurezza del routing",
+        "settings": "<code>accept_redirects=0</code>, <code>accept_source_route=0</code>, <code>secure_redirects=0</code>, <code>send_redirects=0</code>, <code>log_martians=0</code>"
+      },
+      {
+        "area": "Filtro percorso inverso",
+        "settings": "<code>rp_filter=2</code> (modalità permissiva, vedi nota sotto)"
+      },
+      {
+        "area": "TCP",
+        "settings": "<code>tcp_mtu_probing=1</code>, <code>tcp_rfc1337=1</code>, <code>tcp_sack=1</code>, <code>tcp_rmem=8K/87K/16M</code>, <code>tcp_wmem=8K/64K/16M</code>"
+      },
+      {
+        "area": "Porte",
+        "settings": "<code>ip_local_port_range=1024 65535</code> (insieme delle porte effimere)"
+      },
+      {
+        "area": "Socket Unix",
+        "settings": "<code>net.unix.max_dgram_qlen=4096</code>"
+      }
+    ],
+    "sourceOutro": "Aggiunge anche <code>source /etc/network/interfaces.d/*</code> a <code>/etc/network/interfaces</code> se non già presente — pratica standard in modo da poter rilasciare frammenti di interfaccia modulare senza modificare il file principale.",
+    "fwbrTitle": "Regolazione automatica dei bridge del firewall virtuale",
+    "fwbrBody": "Insieme al profilo sysctl, ProxMenux installa lo script ausiliario <code>/usr/local/sbin/proxmenux-fwbr-tune</code>, che applica <code>rp_filter=0</code> e <code>log_martians=0</code> alle interfacce <code>fwbr*</code> / <code>fwln*</code> / <code>fwpr*</code> / <code>tap*</code> create da Proxmox per VM e container. L’unità a esecuzione singola <code>proxmenux-fwbr-tune.service</code> lo avvia al boot; la regola <code>/etc/udev/rules.d/99-zz-proxmenux-fwbr-tune.rules</code> a ogni evento <code>net add</code> corrispondente a questi prefissi. Copre quindi le interfacce ricreate all’avvio o all’arresto delle VM, al riavvio e durante la migrazione live. Lo script elabora anche le interfacce già presenti subito dopo l’installazione.",
+    "rpFilterTitle": "Perché rp_filter=2 (permissivo) invece di 1 (rigoroso)",
+    "rpFilterBody": "Il filtro del percorso inverso rigoroso scarta i pacchetti la cui sorgente sarebbe raggiungibile tramite un’interfaccia <em>diversa</em>. È un’impostazione predefinita adatta ai client, ma problematica su un host Proxmox dove il traffico VM spesso arriva su un bridge ed esce da un uplink con percorsi asimmetrici. <code>rp_filter=2</code> (permissivo) scarta solo pacchetti con sorgenti realmente non raggiungibili tramite routing. Il compromesso riduce leggermente il rilevamento dello spoofing IP locale per non interrompere la rete delle VM."
+  },
+  "ovs": {
+    "heading": "Installa Open vSwitch",
+    "intro": "Installa <code>openvswitch-switch</code> + <code>openvswitch-common</code>. I pacchetti aggiungono OVS come alternativa ai bridge Linux predefiniti di Proxmox. La sola installazione non cambia la rete: i bridge <code>vmbrX</code> esistenti continuano a funzionare. Quando <em>crei</em> un nuovo bridge nell’interfaccia Proxmox, puoi scegliere OVS dall’elenco dei tipi.",
+    "tipTitle": "Quando OVS ha senso",
+    "tipBody": "Valuta OVS se ti servono <strong>trunk VLAN con ID non contigui</strong>, <strong>LACP con LLDP in modalità specifiche</strong>, <strong>programmazione dettagliata dei flussi</strong> (OpenFlow) o interoperabilità con controller SDN. Per un laboratorio domestico con poche VLAN e un solo uplink LACP, i bridge Linux + <code>vmbrX.VID</code> sono più semplici e adeguati.",
+    "revertTitle": "Reversibile dal menu Disinstalla",
+    "revertBody": "OVS viene registrato. <link>Disinstalla ottimizzazioni</link> esegue <code>apt purge</code> su <code>openvswitch-switch</code> e <code>openvswitch-common</code>. Migra i bridge OVS a bridge Linux <em>prima</em> della disinstallazione, altrimenti le VM su quei bridge perderanno la rete al prossimo avvio. Equivalente manuale:"
+  },
+  "bbr": {
+    "heading": "Abilita TCP BBR + TCP Fast Open",
+    "intro": "Scrive due file sysctl e li ricarica. BBR sostituisce CUBIC con l’algoritmo di congestione di Google basato sulla banda, che gestisce meglio collegamenti ad alta capacità e latenza o con perdite. TCP Fast Open (TFO) elimina un’andata e ritorno sulle connessioni TCP ripetute inviando dati nel SYN.",
+    "verifyTitle": "Verifica",
+    "impactTitle": "L'impatto è dipendente dal carico di lavoro",
+    "impactBody": "BBR è efficace su collegamenti ad alta latenza o con perdite (replica intercontinentale, tunnel VPN, client mobili). In una LAN tra due macchine sullo stesso switch, la differenza spesso rientra nelle oscillazioni di misura. TFO aiuta soprattutto le connessioni HTTP brevi e ripetute.",
+    "revertTitle": "Reversibile dal menu Disinstalla",
+    "revertBody": "BBR/TFO vengono registrati. <link>Disinstalla ottimizzazioni</link> elimina i due file sysctl (<code>/etc/sysctl.d/99-kernel-bbr.conf</code> e <code>99-tcp-fastopen.conf</code>) e ricarica la configurazione restante. Eliminare un file non reimposta i valori attivi del kernel. Valori predefiniti come <code>cubic</code> e <code>tcp_fastopen=1</code> tornano dopo un riavvio, salvo altre configurazioni che li sovrascrivano. Equivalente manuale:"
+  },
+  "names": {
+    "heading": "Nomi interfacce (persistenti)",
+    "intro": "Esamina ogni scheda di rete fisica dell’host, saltando loopback, veth Docker, bridge, dispositivi TAP, bond, Cilium, ZeroTier e WireGuard. Scrive un file systemd <code>.link</code> che associa il nome attuale all’indirizzo MAC attuale. L’associazione MAC prevale quindi sulla logica di denominazione del kernel.",
+    "whyTitle": "Perché questo è importante",
+    "whyItems": [
+      "Aggiungere o rimuovere dispositivi PCIe può cambiare la numerazione del bus, trasformando <code>enp3s0</code> in <code>enp4s0</code>. Se <code>/etc/network/interfaces</code> fa riferimento al vecchio nome, il bridge scompare al riavvio.",
+      "Gli aggiornamenti BIOS o firmware a volte cambiano l’enumerazione dei dispositivi, con lo stesso effetto.",
+      "Lo script scrive file <code>.link</code> per le schede fisiche, incluse le porte dei bond, con il MAC riportato da sysfs in quel momento; per le porte di un bond può essere il MAC condiviso del bond, quindi controllane i nomi dopo un riavvio. Salta le interfacce virtuali, come veth LXC e i dispositivi bond stessi; non risolve le condizioni di gara nei nomi delle schede virtuali <code>hotplug</code>."
+    ],
+    "writtenTitle": "Cosa si scrive",
+    "writtenIntro": "Un file per NIC fisico, a <code>/etc/systemd/network/10-proxmenux-&lt;iface&gt;.link</code>. Ogni file inizia con l'intestazione <code># Managed by ProxMenux — do not edit</code> così ProxMenux può distinguere i propri file da file <code>.link</code> forniti dall'utente o dal pacchetto.",
+    "writtenOutro": "I file <code>.link</code> di altri pacchetti o scritti dall’utente vengono conservati; sono gestiti solo quelli con l’intestazione ProxMenux. A ogni esecuzione successiva la funzione verifica i propri file: rilegge <code>MACAddress=</code> da ogni <code>10-proxmenux-*.link</code> ed elimina quelli la cui MAC non compare più in <code>/sys/class/net/</code>. I file delle versioni precedenti nel formato <code>10-&lt;iface&gt;.link</code> vengono migrati automaticamente la prima volta.",
+    "pveTitle": "PVE 9 vs PVE 8",
+    "pveBody": "Lo script usa file systemd <code>.link</code> per i nomi persistenti. Su Proxmox VE 9 ricarica anche le regole udev dopo la scrittura, affinché una scheda già fissata che viene ricollegata o rilevata di nuovo applichi la sua regola senza riavvio. Controlla le interfacce esistenti dopo un riavvio sia su PVE 8 sia su PVE 9. Questo non sostituisce <code>ifupdown2</code> sull’host. In entrambi i casi lo script segnala la necessità di riavvio alla post-installazione personalizzabile.",
+    "reviewTitle": "Controlla prima il file /etc/network/interfaces esistente",
+    "reviewBody": "Se la configurazione precedente in <code>/etc/network/interfaces</code> usa nomi delle schede generati dal kernel, fissare quelli <em>attuali</em> è il risultato voluto. Se hai già adattato manualmente la configurazione a nomi specifici, verifica prima del riavvio che i nomi fissati corrispondano al file interfaces.",
+    "revertTitle": "Reversibile dal menu Disinstalla",
+    "revertBody": "<link>Disinstalla ottimizzazioni</link> elimina solo i file <code>10-proxmenux-*.link</code> con intestazione ProxMenux da <code>/etc/systemd/network/</code>. Conserva ogni file <code>.link</code> aggiunto dall’utente o da altri pacchetti. Al prossimo riavvio torna la denominazione predefinita di systemd."
+  },
+  "related": {
+    "heading": "Correlati",
+    "items": [
+      {
+        "label": "Gestione rete",
+        "href": "/docs/network",
+        "tail": "— diagnostica, analisi del ponte, riparazioni guidate."
+      },
+      {
+        "label": "Nomi di interfaccia persistenti",
+        "href": "/docs/network/persistent-names",
+        "tail": " — la stessa funzione disponibile in un menu dedicato per un secondo momento; usa una delle due opzioni, non entrambe."
+      },
+      {
+        "label": "Riferimento dei comandi di rete",
+        "href": "/docs/help-info/network-commands",
+        "tail": " — ip, ss, ethtool, sysctl."
+      },
+      {
+        "label": "Disinstalla ottimizzazioni",
+        "href": "/docs/post-install/uninstall",
+        "tail": " — annulla queste modifiche di rete."
+      },
+      {
+        "label": "Post-installazione personalizzabile",
+        "href": "/docs/post-install/customizable",
+        "tail": " — torna al menu superiore."
+      }
+    ]
+  }
+}
diff --git a/web/messages/it/docs/post-install/optional.json b/web/messages/it/docs/post-install/optional.json
new file mode 100644
index 00000000..576b0b13
--- /dev/null
+++ b/web/messages/it/docs/post-install/optional.json
@@ -0,0 +1,177 @@
+{
+  "meta": {
+    "title": "ProxMenux Post-Install: Impostazioni opzionali",
+    "description": "Guida a Impostazioni opzionali nello script post-install ProxMenux per ulteriori funzioni e ottimizzazioni Proxmox VE.",
+    "ogTitle": "ProxMenux Post-Install: Impostazioni opzionali",
+    "ogDescription": "Guida a Impostazioni opzionali nello script post-install ProxMenux per ulteriori funzioni e ottimizzazioni Proxmox VE.",
+    "ogImageAlt": "Impostazioni opzionali ProxMenux Post-Install"
+  },
+  "title": "Impostazioni opzionali",
+  "intro": "La categoria <strong>Impostazioni opzionali</strong> offre funzioni e ottimizzazioni aggiuntive per Proxmox VE. Non sono essenziali, ma possono migliorare le capacità del sistema in situazioni specifiche.",
+  "available": "Funzioni opzionali disponibili",
+  "stepLabel": "Passaggio",
+  "ceph": {
+    "title": "Aggiungi l'ultimo supporto Ceph",
+    "intro": "Questa opzione installa l'ultimo supporto del sistema di archiviazione Ceph per Proxmox VE. Ceph è un sistema di archiviazione distribuito che offre elevate prestazioni, affidabilità e scalabilità.",
+    "doesIntro": "Cosa fa:",
+    "doesItems": [
+      "Aggiunge il repository Ceph al sistema",
+      "Aggiorna gli elenchi dei pacchetti",
+      "Installa i pacchetti Ceph utilizzando il comando 'pveceph install'",
+      "Verifica l'installazione"
+    ],
+    "howUse": "Come utilizzare: Dopo l'installazione, è possibile configurare e gestire lo storage Ceph utilizzando l'interfaccia web Proxmox VE o gli strumenti di riga di comando.",
+    "automates": "Questa regolazione automatizza i seguenti comandi:"
+  },
+  "amd": {
+    "title": "Applicare correzioni per CPU AMD",
+    "intro": "Questa opzione applica correzioni specifiche per le CPU AMD EPYC e Ryzen per migliorare la stabilità e la compatibilità.",
+    "doesIntro": "Cosa fa:",
+    "doesItems": [
+      "Rileva se è presente un EPYC AMD o Ryzen CPU",
+      "Applica il parametro kernel 'idle=nomwait' per prevenire crash casuali (tramite /etc/kernel/cmdline su host systemd-boot, o /etc/default/grub su host GRUB — con un .bak dell'originale)",
+      "Configura KVM per ignorare alcuni MSR (Model Specific Registers) per una migliore compatibilità degli ospiti di Windows"
+    ],
+    "howUse": "Come usare: Queste correzioni vengono applicate automaticamente e richiedono un riavvio del sistema per avere effetto.",
+    "automates": "Questa regolazione automatizza i seguenti comandi:"
+  },
+  "ha": {
+    "title": "Abilita servizi di alta disponibilità",
+    "intro": "Questa opzione consente servizi High Availability (HA) in Proxmox VE, consentendo il failover automatico di VM e container in caso di guasto del nodo.",
+    "doesIntro": "Cosa fa:",
+    "doesItems": [
+      "Attiva e avvia il servizio pve-ha-lrm (Local Resource Manager)",
+      "Attiva e avvia il servizio pve-ha-crm (Cluster Resource Manager)",
+      "Attiva e avvia il servizio corosync per la comunicazione cluster"
+    ],
+    "howUse": "Come utilizzare: Dopo aver abilitato questi servizi, è possibile configurare gruppi HA e risorse nell'interfaccia web Proxmox VE.",
+    "automates": "Questa regolazione automatizza i seguenti comandi:"
+  },
+  "pveam": {
+    "title": "Aggiorna Proxmox VE Appliance Manager",
+    "intro": "Aggiorna l’indice locale dei modelli di container esposto da <code>pveam</code> in Proxmox, così l’elenco delle appliance software è aggiornato alla prossima creazione di un LXC.",
+    "doesIntro": "Cosa fa:",
+    "doesItems": [
+      "Esegue <code>pveam update</code> sui mirror Proxmox per recuperare il catalogo attuale delle appliance software",
+      "Popola l’elenco delle appliance software mostrato quando si crea un container"
+    ],
+    "howUse": "Uso: eseguilo se l’elenco delle appliance software sembra datato o dopo un cambio di mirror. Scarica solo l’indice del catalogo, non i modelli stessi.",
+    "automates": "Questa regolazione automatizza il seguente comando:"
+  },
+  "fastfetch": {
+    "title": "Installare e configurare Fastfetch",
+    "intro": "Questa opzione installa silenziosamente e configura Fastfetch, uno strumento di informazioni di sistema che visualizza specifiche di sistema e un logo personalizzato al login.",
+    "doesLabel": "Cosa fa:",
+    "doesItems": [
+      "Scarica e installa silenziosamente l’ultima versione di Fastfetch",
+      "Consente di scegliere un logo personalizzato (<strong>ProxMenux, Proxmox, Helper-Scripts, Home-Labs-Club, Proxmology</strong>, o uno personalizzato)",
+      "Configura Fastfetch per visualizzare <em>\"Sistema ottimizzato da ProxMenux\"</em>",
+      "Configura Fastfetch per avviarsi automaticamente all’accesso in console"
+    ],
+    "importantLabel": "Importante:",
+    "importantBody": "Se ti connetti a Proxmox tramite SSH, scegli il logo <strong>Proxmox</strong> o creane uno con <code>jp2a</code> o <code>img2txt</code>. Gli altri loghi vengono generati con <code>chafa</code> e potrebbero non essere visualizzati correttamente in una normale sessione SSH.",
+    "customLabel": "Loghi personalizzati:",
+    "customBody1": "Per utilizzare un logo personalizzato, posizionare il file di testo ASCII in: <code>/usr/local/share/fastfetch/logos/</code>",
+    "customBody2": "È possibile creare loghi personalizzati utilizzando strumenti come <code>chafa</code>, <code>jp2a</code>, o <code>img2txt</code>.",
+    "customBody3": "Per i migliori risultati:",
+    "customItems": [
+      "Mantieni l’altezza del logo entro 35 righe per conservare le proporzioni e rientrare nel terminale",
+      "Utilizzare <code>chafa</code> per loghi a colori (può non visualizzare correttamente in sessioni SSH)",
+      "Utilizzare <code>jp2a</code> o <code>img2txt</code> per loghi compatibili con SSH"
+    ],
+    "examplesLabel": "Loghi di esempio:",
+    "logos": [
+      {
+        "name": "ProxMenux",
+        "alt": "Logo ProxMenux",
+        "src": "https://macrimi.github.io/ProxMenux/fastfetch/proxmenux.png"
+      },
+      {
+        "name": "Proxmox",
+        "alt": "Logo Proxmox",
+        "src": "https://macrimi.github.io/ProxMenux/fastfetch/proxmox.png"
+      },
+      {
+        "name": "JC Channel",
+        "alt": "Logo di JC Channel",
+        "src": "/fastfetch/jc-channel.png"
+      },
+      {
+        "name": "Helper-Scripts",
+        "alt": "Logo di Helper-Scripts",
+        "src": "https://macrimi.github.io/ProxMenux/fastfetch/helper-scripts.png"
+      },
+      {
+        "name": "Home-Labs-Club",
+        "alt": "Logo di Home-Labs-Club",
+        "src": "https://macrimi.github.io/ProxMenux/fastfetch/home-labs-club.png"
+      },
+      {
+        "name": "Proxmology",
+        "alt": "Logo Proxmology",
+        "src": "https://macrimi.github.io/ProxMenux/fastfetch/proxmology.png"
+      }
+    ],
+    "automates": "Questa regolazione automatizza i seguenti comandi:"
+  },
+  "figurine": {
+    "title": "Installare e configurare Figurine",
+    "intro": "Questa opzione installa e configura Figurine, uno strumento che crea eleganti banner di testo ASCII per il tuo terminale, visualizzando il tuo nome host in un formato 3D visivamente accattivante.",
+    "doesLabel": "Cosa fa:",
+    "doesItems": [
+      "Scarica e installa Figurine v2.1.1 da GitHub per l’architettura dell’host (AMD64, ARM64 o ARMv7)",
+      "Crea un messaggio di benvenuto che visualizza il tuo hostname in 3D ASCII art quando accedi",
+      "Aggiorna il binario Figurine esistente solo dopo aver completato correttamente il download e l’estrazione",
+      "Imposta il messaggio di benvenuto da eseguire automaticamente al login"
+    ],
+    "practicalLabel": "Uso pratico:",
+    "practicalBody": "Quando gestisci più nodi Proxmox in un cluster, Figurine mostra subito a quale nodo sei connesso. Aiuta a evitare comandi accidentali sul nodo sbagliato e migliora il flusso di lavoro con più server.",
+    "exampleLabel": "Esempio di output:",
+    "imageAlt": "Output di esempio di Figurine",
+    "automates": "Questa regolazione automatizza il seguente processo:",
+    "outro": "Dopo l'installazione, vedrai il tuo nome host visualizzato nell'arte 3D ASCII ogni volta che accedi, rendendo immediatamente chiaro su quale nodo Proxmox stai lavorando."
+  },
+  "log2ram": {
+    "title": "Installare Log2RAM (SSD/NVMe riduzione dell'usura)",
+    "intro": "Log2RAM monta <code>/var/log</code> su un ramdisk tmpfs e lo sincronizza periodicamente sul disco. Accumulare in RAM le frequenti scritture journald può ridurre usura SSD e I/O. Sincronizzazione e arresto regolare salvano i log, ma una perdita improvvisa di alimentazione può perdere le voci dall’ultima sincronizzazione.",
+    "upstreamLabel": "Progetto a monte:",
+    "upstreamUrl": "https://github.com/azlux/log2ram",
+    "upstreamLinkLabel": "azlux/log2ram su GitHub",
+    "doesLabel": "Cosa fa ProxMenux:",
+    "doesItems": [
+      "Rileva se il disco root è SSD/NVMe leggendo <code>/sys/block/&lt;dev&gt;/queue/rotational</code>. Su un disco rotazionale il flusso automatizzato chiede prima di installare.",
+      "Clona il repository originale (<code>azlux/log2ram</code>) in <code>/tmp/log2ram</code> e modifica <code>install.sh</code>, sostituendo <code>rsync -aAXv</code> con <code>rsync -aXv --no-acls</code>. Evita l’errore <em>set_acl: Operation not supported</em> con codice di uscita 23, che lo script originale genera spostando /var/log su filesystem senza ACL. L’unità systemd <code>log2ram</code> viene abilitata dopo l’installazione.",
+      "Dimensiona il ramdisk in base alla RAM dell’host: <code>≤ 8 GB → 128M</code>, <code>≤ 16 GB → 256M</code>, <code>&gt; 16 GB → 512M</code>. Scrive il valore in <code>SIZE=</code> di <code>/etc/log2ram.conf</code>.",
+      "Pianifica una sincronizzazione periodica del disco tramite <code>/etc/cron.d/log2ram</code>: ogni 1h / 3h / 6h secondo lo stesso livello RAM.",
+      "Installa <code>/usr/local/bin/log2ram-check.sh</code>, eseguito ogni 10 minuti da <code>/etc/cron.d/log2ram-auto-sync</code>. Quando <code>/var/log</code> raggiunge l’80% del ramdisk, pulisce i vecchi journal. Al 92% esegue prima <code>logrotate -f /etc/logrotate.d/proxmox-backup-api</code> se il file esiste: i log API PBS sono spesso i maggiori consumatori di spazio su un host PBS. Poi tronca <code>pveproxy access/error</code> e <code>pveam.log</code> prima della sincronizzazione. <code>log2ram write</code> da solo copia tmpfs sul disco senza ridurlo. La protezione aiuta a evitare arresti di PVE con <em>No space left on device</em> per crescita incontrollata dei log.",
+      "Rileva il servizio <code>proxmox-backup-server</code> sull’host. Se presente, crea <code>/etc/logrotate.d/proxmox-backup-api</code> (20 MB × 3 rotazioni) e <code>/etc/cron.hourly/proxmox-backup-logrotate</code> per limitare i log API PBS, abituale fonte di crescita, anche tra le sincronizzazioni Log2RAM. Senza PBS non modifica nulla.",
+      "Regola i limiti systemd-journald (<code>SystemMaxUse</code>, <code>RuntimeMaxUse</code>) per adattarsi all'interno del ramdisk in modo che un singolo scoppio non possa riempirlo.",
+      "Si registra in <code>installed_tools.json</code> per consentire il ripristino da Disinstalla ottimizzazioni."
+    ],
+    "howUseLabel": "Come usare:",
+    "howUseBody": "Il percorso automatizzato installa Log2RAM senza intervento se rileva un disco root SSD/NVMe. Quello personalizzabile chiede dimensione, intervallo e attivazione della protezione. Il messaggio indica 90%, ma lo script generato usa le soglie di pulizia all’80% e intensiva al 92% descritte sopra.",
+    "verifyLabel": "Verificare e gestire dalla shell:",
+    "verifyCode": "# Service state and configured timers\nsystemctl status log2ram\nsystemctl list-timers log2ram*\n\n# Current ramdisk usage — /var/log IS the tmpfs itself\ndf -h /var/log\n\n# Force a sync now (tmpfs → disk); does NOT shrink the tmpfs\nlog2ram write\n\n# Trigger the auto-sync guard on demand (vacuum + sync when usage is high)\n/usr/local/bin/log2ram-check.sh\n\n# Current config: SIZE, mail settings, path\ncat /etc/log2ram.conf\n\n# ProxMenux-specific cron jobs\ncat /etc/cron.d/log2ram /etc/cron.d/log2ram-auto-sync\n\n# Recent Log2RAM activity\njournalctl -u log2ram -n 50 --no-pager"
+  },
+  "zram": {
+    "title": "Abilita il profilo di scambio ZRAM",
+    "intro": "Crea un dispositivo swap compresso in RAM, <code>/dev/zram0</code>, con <code>systemd-zram-generator</code>. Le pagine spostate dal kernel nello swap vengono compresse con zstd e tenute in memoria prima di usare lo swap su disco.",
+    "doesLabel": "Cosa fa:",
+    "doesItems": [
+      "Installa <code>systemd-zram-generator</code> se manca e registra se è stato installato da ProxMenux.",
+      "Scrive <code>/etc/systemd/zram-generator.conf.d/90-proxmenux.conf</code>: un dispositivo <code>zram0</code> dimensionato ad un decimo dell'host RAM, compressione zstd (<code>zstd(level=9)</code> con systemd-zram-generator 1.2.0 o versioni successive) e priorità swap 32767.",
+      "Con questa priorità il kernel riempie prima ZRAM. Uno swap esistente su disco mantiene la propria priorità e prende le pagine che non si adattano più a ZRAM.",
+      "Prima di cambiare qualcosa, cerca un'altra configurazione ZRAM: uno swap zram attivo, una linea zram in <code>/etc/fstab</code>, un'unità systemd o un altro file generatore. Se ne trova una, l'opzione si ferma e lascia quella configurazione così com'è.",
+      "Avvia <code>dev-zram0.swap</code> e controlla che il dispositivo attivo corrisponda al profilo. Se non lo fa, lo stato precedente viene ripristinato.",
+      "Si registra in <code>installed_tools.json</code> per consentire il ripristino da Disinstalla ottimizzazioni."
+    ],
+    "howUseLabel": "Come usare:",
+    "howUseBody": "L’opzione è disponibile solo nel percorso personalizzabile, non in quello automatizzato. Il dispositivo viene ricreato a ogni avvio. Quando è attivo, il riquadro Memoria di ProxMenux Monitor mostra capacità, swap usato, algoritmo, rapporto di compressione e memoria fisica occupata.",
+    "verifyLabel": "Verificare dalla shell:",
+    "verifyCode": "# Active swap devices and their priority\nswapon --show\n\n# ZRAM device: algorithm, size and compressed data\nzramctl\n\n# Profile written by ProxMenux\ncat /etc/systemd/zram-generator.conf.d/90-proxmenux.conf\n\n# State of the swap unit\nsystemctl status dev-zram0.swap"
+  },
+  "autoApplication": {
+    "title": "Applicazione automatica",
+    "body": "Nel percorso personalizzabile seleziona ogni funzione in base alle necessità. Log2RAM fa parte anche di quello automatizzato con rilevamento hardware; ZRAM resta esclusivo di Personalizzabile. Consulta le sezioni per conferme e prerequisiti."
+  }
+}
diff --git a/web/messages/it/docs/post-install/performance.json b/web/messages/it/docs/post-install/performance.json
new file mode 100644
index 00000000..f8e4efdb
--- /dev/null
+++ b/web/messages/it/docs/post-install/performance.json
@@ -0,0 +1,61 @@
+{
+  "meta": {
+    "title": "Post-installazione: Prestazioni | Documentazione ProxMenux",
+    "description": "Opzioni di prestazioni nello script post-installazione personalizzabile di ProxMenux. Sostituisce gzip a thread singolo con pigz (gzip parallelo) per accelerare backup e compressione sugli host multicore."
+  },
+  "header": {
+    "title": "Dopo l'installazione: prestazioni",
+    "description": "Opzioni di prestazioni dello script post-installazione Personalizzabile. La categoria contiene una sola ottimizzazione: sostituire gzip con pigz affinché backup e compressione usino tutti i core della CPU invece di uno solo.",
+    "section": "Impostazioni post-installazione Proxmox"
+  },
+  "intro": {
+    "title": "Che cosa copre questa categoria",
+    "body": "L’unica opzione di prestazioni qui reindirizza gzip a un’implementazione parallela. Le altre regolazioni (memoria, scheduling I/O, dimensione dell’ARC ZFS, limiti del kernel) sono nelle rispettive categorie (<em>Sistema</em>, <em>Archiviazione</em>), perché riguardano sottosistemi diversi."
+  },
+  "pigz": {
+    "heading": "Usa pigz per una compressione gzip più rapida",
+    "intro": "<code>gzip</code> standard comprime usando <strong>un solo core della CPU</strong>. Sugli host Proxmox moderni con 8, 16 o 32 core, ciò limita molto i backup VM/CT con <code>vzdump</code>, la rotazione dei log e ogni operazione che passa per <code>gzip</code>. <a>pigz</a> è un sostituto parallelo immediatamente compatibile: stesso output compatibile gzip, ma lavoro distribuito su tutti i core.",
+    "doesTitle": "Cosa fa ProxMenux",
+    "doesIntro": "Cinque passaggi, tutti idempotenti:",
+    "doesItems": [
+      "Imposta <code>pigz: 1</code> in <code>/etc/vzdump.conf</code> quindi lo strumento di backup di Proxmox utilizza pigz in modo nativo.",
+      "Installa il pacchetto <code>pigz</code> apt se non già presente.",
+      "Scrive uno script wrapper a <code>/bin/pigzwrapper</code> che inoltra ogni argomento a <code>/usr/bin/pigz</code>.",
+      "Registra una diversione dpkg per il binario di sistema <code>gzip</code> (<code>/usr/bin/gzip</code> su Proxmox VE 9, <code>/bin/gzip</code> su Proxmox VE 8). Il binario originale resta accanto come <code>gzip.distrib</code> e il wrapper lo sostituisce. Da quel momento <em>qualsiasi programma</em> che chiama <code>gzip</code>, come logrotate, <code>tar czf</code>, script e vzdump, usa pigz in modo trasparente.",
+      "Controlla che il file mantenuto come <code>gzip.distrib</code> sia un gzip funzionante prima che l'involucro sia messo in atto e reinstalla il pacchetto <code>gzip</code> prima quando non lo è. Un host che ha ancora il precedente swap <code>/bin/gzip.original</code> viene spostato alla diversione quando l'opzione viene applicata di nuovo."
+    ],
+    "replacesTitle": "Sostituisce un binario di sistema",
+    "replacesBody": "Mettere un wrapper al posto di <code>gzip</code> è insolito. È sicuro perché produce output compatibile gzip, ma gli script con percorsi fissi, eseguiti in chroot restrittivi o che verificano gli hash dei binari possono comportarsi diversamente. Il binario originale resta come <code>gzip.distrib</code>. Grazie alla diversione dpkg, un aggiornamento del pacchetto <code>gzip</code> o il passaggio da Proxmox VE 8 a 9 aggiorna quel file e mantiene il wrapper.",
+    "revertTitle": "Reversibile dal menu Disinstalla",
+    "revertBody": "Questa ottimizzazione è registrata. <link>Disinstalla ottimizzazioni</link> copia il binario originale da <code>gzip.distrib</code> al posto del wrapper, rimuove la diversione e <code>pigzwrapper</code>, commenta la riga <code>pigz</code> in <code>/etc/vzdump.conf</code> ed esegue <code>apt purge pigz</code> dopo aver verificato che gzip funziona. Equivalente manuale su Proxmox VE 9:",
+    "verifyTitle": "Verifica",
+    "verifyBody": "Dopo l'applicazione, <code>gzip --version</code> dovrebbe menzionare pigz. Un rapido benchmark mostra anche la differenza di velocità su un host multi-core:",
+    "whenTitle": "Quando questo è più importante",
+    "whenBody": "Il vantaggio cresce con il <strong>numero di core dell’host</strong> e la <strong>frequenza dei backup</strong>. Su un server domestico a 2 core con un vzdump al giorno è marginale. Su un host di produzione a 16 core che salva una dozzina di VM ogni notte, pigz può ridurre la finestra di backup a una frazione del tempo richiesto da gzip a thread singolo."
+  },
+  "related": {
+    "heading": "Correlati",
+    "items": [
+      {
+        "label": "Comandi di backup e ripristino",
+        "href": "/docs/help-info/backup-commands",
+        "tailRich": " — riferimento CLI di vzdump, inclusa l’opzione <code>--pigz</code> per i thread."
+      },
+      {
+        "label": "Archiviazione",
+        "href": "/docs/post-install/storage",
+        "tail": "— limiti di velocità di vzdump e sintonizzazione ZFS ARC."
+      },
+      {
+        "label": "Sistema",
+        "href": "/docs/post-install/system",
+        "tail": " — regolazione dei descrittori di file e della memoria."
+      },
+      {
+        "label": "Post-installazione personalizzabile",
+        "href": "/docs/post-install/customizable",
+        "tail": " — torna al menu superiore."
+      }
+    ]
+  }
+}
diff --git a/web/messages/it/docs/post-install/security.json b/web/messages/it/docs/post-install/security.json
new file mode 100644
index 00000000..2a745162
--- /dev/null
+++ b/web/messages/it/docs/post-install/security.json
@@ -0,0 +1,57 @@
+{
+  "meta": {
+    "title": "Post-Install: Sicurezza | Documentazione ProxMenux",
+    "description": "Opzioni di sicurezza disponibili nello script ProxMenux Personalizzabile post-installazione. Attualmente un'unica opzione: disabilitare il servizio portmapper/rpcbind per ridurre la superficie di attacco dell'host."
+  },
+  "header": {
+    "title": "Post-Install: Sicurezza",
+    "section": "Impostazioni post-installazione Proxmox"
+  },
+  "intro": {
+    "title": "Che cosa copre questa categoria",
+    "body": "La sicurezza post-installazione si limita al <strong>rafforzamento dell’host applicabile in sicurezza senza supervisione</strong>: disattivare servizi che quasi nessuno usa, con possibilità di annullamento dal menu Disinstalla. Gli strumenti attivi (Fail2Ban per prevenire intrusioni, Lynis per gli audit) si trovano nella voce <em>Sicurezza</em> del menu principale di ProxMenux, fuori dalla post-installazione."
+  },
+  "rpcbind": {
+    "heading": "Disattivare il portmapper / rpcbind",
+    "intro": "<code>rpcbind</code> (in precedenza <code>portmap</code>) associa i numeri dei programmi RPC alle porte di rete. È una dipendenza di NFS e di alcuni vecchi strumenti RPC. Su un tipico host Proxmox che non funge da server NFS, <strong>nulla lo usa</strong>; lasciarlo attivo mantiene la porta <code>111/tcp</code> in ascolto su ogni interfaccia.",
+    "whyTitle": "Perché conviene disattivarlo",
+    "whyItems": [
+      "Riduce la superficie di attacco ospite — un servizio di ascolto in meno di preoccuparsi.",
+      "Storicamente abusato come vettore di riflessione/amplificazione in attacchi DDoS. Disabilitare <code>rpcbind</code> rimuove quel fattore di amplificazione per il vostro host.",
+      "Rimuove il rumore generato nei log e nell’output di <code>netstat</code> / <code>ss</code>, rendendo più facile individuare l’attività reale."
+    ],
+    "nfsTitle": "Non disabilitarlo se si utilizza NFS",
+    "nfsBody": "Sia il server NFS <strong>sia</strong> il client NFS dipendono da <code>rpcbind</code> per negoziare le porte usate da <code>mountd</code>, <code>statd</code>, <code>lockd</code> e altri servizi. Se il tuo host Proxmox <em>esporta</em> condivisioni NFS verso altri dispositivi oppure <em>monta</em> condivisioni NFS da un NAS, non applicare questa opzione. I montaggi fallirebbero con <code>mount.nfs: rpc.statd is not running</code> o errori simili.",
+    "runsTitle": "Cosa esegue ProxMenux",
+    "runsOutro": "Il pacchetto resta installato. ProxMenux registra lo stato originale di abilitazione e attività di rpcbind.service e rpcbind.socket, poi disabilita e arresta entrambe le unità per impedire che l’attivazione tramite socket riavvii il servizio.",
+    "verifyTitle": "Verifica",
+    "verifyBody": "Dopo l'applicazione, confermare <code>rpcbind</code> è spento e nulla sta ascoltando sulla porta 111:",
+    "reversibleTitle": "Ripristinare lo stato di servizio originale",
+    "reversibleBody": "La modifica è registrata in <code>installed_tools.json</code>. <link>Disinstalla ottimizzazioni</link> riporta ogni unità rpcbind agli stati abilitato/disabilitato e attivo/inattivo rilevati prima della modifica di ProxMenux; non presume che rpcbind fosse abilitato su tutti gli host."
+  },
+  "related": {
+    "heading": "Correlati",
+    "items": [
+      {
+        "label": "Menu di sicurezza",
+        "href": "/docs/security",
+        "tail": " — strumenti più avanzati: Fail2Ban (prevenzione delle intrusioni) e Lynis (audit)."
+      },
+      {
+        "label": "Lynis",
+        "href": "/docs/security/lynis",
+        "tail": " — per controllare l’host e trovare altri modi di rafforzarne la sicurezza."
+      },
+      {
+        "label": "Comandi di sistema utili",
+        "href": "/docs/help-info/system-commands",
+        "tail": "— stato di servizio, journalctl, riferimento di audit lynis."
+      },
+      {
+        "label": "Post-installazione personalizzabile",
+        "href": "/docs/post-install/customizable",
+        "tail": " — torna al menu superiore."
+      }
+    ]
+  }
+}
diff --git a/web/messages/it/docs/post-install/storage.json b/web/messages/it/docs/post-install/storage.json
new file mode 100644
index 00000000..3ee9ca36
--- /dev/null
+++ b/web/messages/it/docs/post-install/storage.json
@@ -0,0 +1,167 @@
+{
+  "meta": {
+    "title": "Post-installazione: Archiviazione | Documentazione ProxMenux",
+    "description": "Ottimizzazioni di archiviazione dello script post-installazione personalizzabile ProxMenux: dimensione ZFS ARC in base alla RAM, snapshot periodici con zfs-auto-snapshot e rimozione dei limiti di velocità dei backup vzdump."
+  },
+  "header": {
+    "title": "Post-installazione: Archiviazione",
+    "section": "Impostazioni post-installazione Proxmox"
+  },
+  "intro": {
+    "title": "Che cosa copre questa categoria",
+    "body": "Quattro ottimizzazioni di archiviazione: regolare <strong>ZFS ARC</strong> su una parte ragionevole della RAM, installare e pianificare <strong>snapshot automatici ZFS</strong>, abilitare <strong>ZFS autotrim</strong> su pool SSD/NVMe e rimuovere i limiti di <strong>vzdump</strong> per velocizzare i backup. Le opzioni sono indipendenti: scegli quelle adatte al sistema. Una quinta, <link>Log2RAM</link>, riduce l’usura SSD/NVMe spostando <code>/var/log</code> su ramdisk. È nella pagina Opzionali perché il menu personalizzabile la raggruppa lì."
+  },
+  "trackedTitle": "Tutti e quattro sono tracciati nel menu Disinstalla",
+  "trackedBody": "Ogni opzione si registra in <code>installed_tools.json</code> per <link>Disinstalla ottimizzazioni</link>. <code>zfs_arc</code> rimuove <code>/etc/modprobe.d/99-zfsarc.conf</code> e ricrea initramfs; <code>zfs_auto_snapshot</code> annulla la pianificazione cron e offre la rimozione completa del pacchetto; <code>zfs_autotrim</code> imposta <code>autotrim=off</code> sui pool che ha abilitato; <code>vzdump_speed</code> ripristina <code>/etc/vzdump.conf</code> dal <code>.bak</code> creato all’installazione.",
+  "arc": {
+    "heading": "Ottimizza dimensione ZFS ARC",
+    "intro": "La <strong>Adaptive Replacement Cache (ARC)</strong> è la cache di lettura ZFS in RAM. Le installazioni Proxmox VE dalla 8.1 impostano il 10% di RAM, massimo 16 GiB; host precedenti o aggiornati possono differire. Questa opzione scrive esplicitamente la stessa regola (RAM/10, massimo 16 GiB, minimo 64 MiB) in un proprio file, coprendo anche host precedenti o aggiornati. Controlla impostazioni e carico: una cache più piccola non è sempre più veloce.",
+    "sizingTitle": "Regole di dimensionamento",
+    "headerRam": "RAM dell'host",
+    "headerMax": "Limite ARC",
+    "rows": [
+      {
+        "ram": "Formula",
+        "max": "RAM / 10, massimo 16 GiB e minimo 64 MiB"
+      },
+      {
+        "ram": "host 8 GB",
+        "max": "≈ 819 MiB (RAM/10)"
+      },
+      {
+        "ram": "host 16 GB",
+        "max": "≈ 1.6 GiB (RAM/10)"
+      },
+      {
+        "ram": "host 64 GB",
+        "max": "≈ 6.4 GiB (RAM/10)"
+      },
+      {
+        "ram": "≥ host 160 GB",
+        "max": "16 GiB (limite)"
+      }
+    ],
+    "after": "Il file <code>/etc/modprobe.d/99-zfsarc.conf</code> contiene solo <code>options zfs zfs_arc_max=…</code>. Gli altri parametri ZFS (<code>zfs_arc_min</code>, prelettura/limite scritture L2ARC, timeout TXG) non vengono regolati. Prima, una verifica cerca altri <code>*.conf</code> in <code>/etc/modprobe.d/</code> che impostano <code>zfs_arc_min</code> / <code>zfs_arc_max</code>, li salva con manifesto in <code>/usr/local/share/proxmenux/backups/zfs_arc/</code> e ne rimuove i valori <code>zfs_arc_min</code> / <code>zfs_arc_max</code> in conflitto (le altre opzioni di quelle righe restano), così solo il file ARC ProxMenux imposta il limite. Poi <code>update-initramfs -u -k all</code> e, se necessario, <code>proxmox-boot-tool refresh</code> portano il limite nell’initramfs dei sistemi con root ZFS.",
+    "rebootTitle": "Richiede un riavvio per prendere effetto",
+    "rebootBody": "Le impostazioni ARC vengono lette caricando il modulo <code>zfs</code>. Per gli host con root ZFS, ProxMenux rigenera initramfs con <code>update-initramfs -u -k all</code> e aggiorna se necessario il bootloader con <code>proxmox-boot-tool refresh</code>. Il nuovo parametro richiede comunque un riavvio, segnalato automaticamente.",
+    "safeTitle": "Sicuro su host non-ZFS",
+    "safeBody": "La funzione scrive la configurazione solo se <code>zpool list</code> segnala almeno un pool ZFS importato. Su host Proxmox con solo ext4/LVM o con strumenti ZFS ma nessun pool importato, selezionare questa opzione non modifica nulla.",
+    "verifyTitle": "Verifica e rollback manuale"
+  },
+  "autoSnap": {
+    "heading": "Installa ZFS auto-snapshot",
+    "intro": "Installa il pacchetto <a>zfs-auto-snapshot</a> e riscrive i suoi programmi di cron in modo che le snapshot vengano prese automaticamente a diversi intervalli. Una grande rete di sicurezza senza sforzo sopra i vostri backup vzdump regolari.",
+    "cadenceTitle": "Frequenza degli snapshot configurata da ProxMenux",
+    "headerLabel": "Etichetta",
+    "headerRuns": "Esecuzione",
+    "headerKept": "Istantanee tenute",
+    "rows": [
+      {
+        "label": "frequente",
+        "runs": "ogni 15 min",
+        "kept": "4"
+      },
+      {
+        "label": "oraria",
+        "runs": "ogni ora",
+        "kept": "1"
+      },
+      {
+        "label": "ogni giorno",
+        "runs": "una volta al giorno",
+        "kept": "1"
+      },
+      {
+        "label": "settimanale",
+        "runs": "una volta alla settimana",
+        "kept": "1"
+      },
+      {
+        "label": "mensile",
+        "runs": "una volta al mese",
+        "kept": "1"
+      }
+    ],
+    "conservativeTitle": "Conservazione limitata",
+    "conservativeBody": "ProxMenux mantiene una conservazione limitata: 4 snapshot frequenti e 1 per ciascun intervallo più lungo, per contenere lo spazio ZFS. Per conservarne di più modifica i numeri in <code>/etc/cron.d/zfs-auto-snapshot</code>, <code>/etc/cron.hourly/zfs-auto-snapshot</code> ecc. dopo lo script.",
+    "onlyZfsTitle": "Utile solo sui pool ZFS",
+    "onlyZfsBody": "Installare il pacchetto su un host ext4-solo è innocuo ma inutile — non ci sono set di dati ZFS per esso di snapshot. Salta questa opzione se non si utilizza ZFS.",
+    "verifyTitle": "Verifica e rollback manuale"
+  },
+  "autotrim": {
+    "heading": "Abilita ZFS autotrim (pool SSD/NVMe)",
+    "intro": "Abilita <code>autotrim</code> sui pool ZFS composti solo da SSD o NVMe con supporto TRIM. Per prudenza salta i pool con dispositivi rotanti. Quelli già impostati su <code>autotrim=on</code> restano invariati.",
+    "trimTitle": "Cosa fa TRIM e perché conta su ZFS",
+    "trimBody1": "SSD e NVMe gestiscono blocchi interni di cancellazione più grandi dei settori logici del filesystem. Quando si elimina un file, l’unità non sa ancora che i settori sono liberi e la pulizia interna può continuare a spostare dati obsoleti per liberare blocchi. <strong>TRIM</strong> indica all’unità i settori liberi per consentirne la cancellazione anticipata.",
+    "trimBody2": "Senza TRIM, esaurire i blocchi già cancellati può degradare le prestazioni SSD e aumentare le scritture interne, riducendo la vita utile. Con TRIM, l’unità può mantenere blocchi vuoti pronti alla scrittura.",
+    "trimBody3": "Con <code>autotrim=on</code>, ZFS esegue TRIM in background sullo spazio liberato di recente, raggruppando gli intervalli. Un <code>zpool trim &lt;pool&gt;</code> periodico è un’alternativa. Autotrim evita una pianificazione separata, ma l’impatto dipende dai dispositivi; il TRIM manuale periodico può essere migliore su alcune unità economiche.",
+    "practicalTitle": "Perché questo è pratico da abilitare?",
+    "practicalItems": [
+      "<strong>Prestazioni di scrittura sostenute.</strong> TRIM può aiutare a recuperare blocchi inutilizzati. Benefici e impatto sulla latenza dipendono da dispositivo e carico.",
+      "<strong>Durata dell’unità.</strong> Evitare copie interne inutili può ridurre amplificazione di scrittura e usura NAND, senza garantire una durata aggiuntiva specifica.",
+      "<strong>Nessun processo cron da pianificare.</strong> A differenza di un <code>zpool trim</code> periodico, autotrim viene gestito automaticamente dal pool."
+    ],
+    "whenTitle": "Quando è necessario?",
+    "whenIntro1": "<strong>Valuta l’attivazione</strong> sui pool ZFS solo con SSD/NVMe compatibili TRIM. Controlla comportamento e latenza; su alcuni dispositivi è preferibile TRIM manuale pianificato.",
+    "whenIntro2": "<strong>Lo script lo ignora automaticamente</strong> su:",
+    "whenSkipItems": [
+      "Pool con vdev HDD rotanti: filtro hardware prudente di questo script.",
+      "Drive senza <code>discard_granularity</code> esposti in sysfs — solitamente vecchi SSD senza TRIM, o percorsi passanti dove il sistema operativo non può vedere il dispositivo sottostante.",
+      "Pools dove ZFS riporta la proprietà non supportato (raro; molto vecchio pools).",
+      "Pools già predisposto per <code>autotrim=on</code> (no-op)."
+    ],
+    "whenIntro3": "<strong>Non pertinente su host ext4-solo</strong> — non c'è nulla per ZFS da tagliare. La funzione esce con un messaggio amichevole in quel caso.",
+    "recordedTitle": "Perché vengono registrati solo i pool modificati da ProxMenux",
+    "recordedBody": "La funzione registra un pool nel file di stato interno (<code>/usr/local/share/proxmenux/zfs_autotrim_pools</code>) solo se lo ha cambiato da <code>off</code> a <code>on</code>. I pool già con autotrim prima dello script restano fuori elenco: una futura disinstallazione annulla solo le modifiche di ProxMenux, non quelle impostate da te.",
+    "manualTitle": "Equivalente manuale (in esecuzione sul server)",
+    "manualIntro": "La sequenza completa che lo script corre contro ogni pool è replicabile a mano. Questo è quello che si digiterebbe se si desidera fare la stessa cosa su un singolo pool senza ProxMenux:",
+    "verifyTitle": "Verifica e rollback manuale",
+    "oneShotTitle": "Preferisci un TRIM singolo invece di quello continuo?",
+    "oneShotBody": "Alcuni amministratori preferiscono TRIM manuale nelle ore di minor carico. Disabilita autotrim e pianifica un processo cron con <code>zpool trim &lt;pool&gt;</code>: stesso obiettivo, frequenza diversa."
+  },
+  "vzdump": {
+    "heading": "Aumenta la velocità di backup di vzdump",
+    "intro": "Scrive bwlimit: 0 e ionice: 5 nella configurazione globale vzdump. Proxmox non ha già limiti di banda predefiniti: rimuove un limite solo se configurato. Rispetto a ionice: 7, il valore 5 aumenta la priorità I/O best-effort se lo scheduler la rispetta. Può influire sugli ospiti e non garantisce backup più rapidi.",
+    "changedTitle": "Cosa cambia in /etc/vzdump.conf",
+    "backupTitle": "Prima esecuzione crea un .bak di vzdump.conf",
+    "backupBody": "Alla prima esecuzione ProxMenux copia <code>/etc/vzdump.conf</code> in <code>/etc/vzdump.conf.bak</code> prima di modificarlo. Le esecuzioni successive non sovrascrivono la copia, lasciando recuperabile la configurazione precedente. <code>bwlimit</code> e <code>ionice</code> vengono modificati con <code>sed</code>; altre opzioni come compress, pigz, tmpdir ed exclude-path sono conservate.",
+    "skipTitle": "Quando saltare questo",
+    "skipBody": "Su un host con storage locale lento e VM sensibili alla latenza, togliere il limite di banda può causare rallentamenti durante i backup. Se hai impostato un <code>bwlimit</code> per questo motivo, conservalo e salta questa opzione.",
+    "verifyTitle": "Verifica e rollback manuale"
+  },
+  "related": {
+    "heading": "Correlati",
+    "items": [
+      {
+        "label": "Comandi di gestione ZFS",
+        "href": "/docs/help-info/zfs-commands",
+        "tail": "— zpool / zfs riferimento per ARC, snapshot, scrub."
+      },
+      {
+        "label": "Comandi di archiviazione e dischi",
+        "href": "/docs/help-info/storage-commands",
+        "tail": "— riferimento generico di blocco-dispositivo e di stoccaggio Proxmox."
+      },
+      {
+        "label": "Comandi di backup e ripristino",
+        "href": "/docs/help-info/backup-commands",
+        "tail": " — riferimento CLI vzdump per banda e priorità I/O."
+      },
+      {
+        "label": "Disinstalla ottimizzazioni",
+        "href": "/docs/post-install/uninstall",
+        "tail": " — annulla le modifiche ARC / vzdump."
+      },
+      {
+        "label": "Log2RAM",
+        "href": "/docs/post-install/optional#log2ram",
+        "tail": " — riduce l’usura SSD/NVMe tenendo /var/log su ramdisk; documentato in Opzionali."
+      },
+      {
+        "label": "Post-installazione personalizzabile",
+        "href": "/docs/post-install/customizable",
+        "tail": " — torna al menu superiore."
+      }
+    ]
+  }
+}
diff --git a/web/messages/it/docs/post-install/system.json b/web/messages/it/docs/post-install/system.json
new file mode 100644
index 00000000..3e925bd7
--- /dev/null
+++ b/web/messages/it/docs/post-install/system.json
@@ -0,0 +1,133 @@
+{
+  "meta": {
+    "title": "Post-Install: Sistema | Documentazione ProxMenux",
+    "description": "Ottimizzazioni a livello di sistema nello script post-installazione personalizzabile ProxMenux: journald e limiti di dimensione logrotate, limiti più elevati del kernel e dei descrittori di file, ottimizzazione della memoria bilanciata, kexec per riavvii rapidi e ripristino dal kernel panico."
+  },
+  "header": {
+    "title": "Dopo l'installazione: sistema",
+    "section": "Impostazioni post-installazione Proxmox"
+  },
+  "intro": {
+    "title": "Che cosa copre questa categoria",
+    "body": "Sei ottimizzazioni di sistema indipendenti. Regolano <strong>journald</strong> e <strong>logrotate</strong> per evitare che i log riempiano il disco, aumentano <strong>i limiti del kernel e dei descrittori di file</strong> per le applicazioni con molti file aperti, <strong>bilanciano la memoria</strong> su un host di virtualizzazione, aggiungono <strong>kexec</strong> per riavviare senza BIOS e configurano <strong>il ripristino automatico</strong> in caso di kernel panic. Tutte e sei sono registrate e reversibili dal menu Disinstalla."
+  },
+  "journald": {
+    "heading": "Ottimizza journald",
+    "intro": "Riscrive <code>/etc/systemd/journald.conf</code> con valori ragionevoli affinché il journal di systemd non riempia gradualmente la partizione root, poi riavvia <code>systemd-journald</code> e ripulisce i log esistenti.",
+    "keyTitle": "Valori chiave",
+    "keyItems": [
+      "<code>Storage=persistent</code> — tenere i registri sul disco attraverso i reboots.",
+      "<code>SystemMaxUse=64M</code> / <code>RuntimeMaxUse=60M</code> — limiti all’uso di disco e memoria del journal.",
+      "<code>Compress=yes</code>, <code>Seal=no</code> — comprime i log, disabilita la sigillatura con sicurezza in avanti (risparmia CPU).",
+      "<code>MaxLevelStore=info</code> — salva il livello info e quelli superiori, necessari al visualizzatore log ProxMenux Monitor e a Fail2Ban per rilevare gli accessi SSH/Proxmox falliti dal journal.",
+      "Limite di frequenza: <code>1000 events / 30 s</code> per evitare un flusso eccessivo di log.",
+      "<code>ForwardToSyslog=no</code>, <code>ForwardToWall=no</code> — non duplicare messaggi a syslog o trasmettere a console."
+    ],
+    "tipTitle": "Perché MaxLevelStore=info conta",
+    "tipBody": "Una soglia più rigorosa come <code>warning</code> fa mostrare a ProxMenux Monitor voci quasi identiche in tutti gli intervalli, perché gran parte dell’attività è di livello info, e impedisce a Fail2Ban di vedere gli accessi falliti. Per ridurre i log usa <code>SystemMaxUse</code> e <code>RateLimitBurst</code> senza restringere i livelli salvati."
+  },
+  "logrotate": {
+    "heading": "Ottimizza logrotate",
+    "intro": "Riscrive <code>/etc/logrotate.conf</code> con impostazioni globali giornaliere e di dimensione, 7 rotazioni conservate, compressione e <code>copytruncate</code> per consentire ai servizi di scrivere senza riaprire i log. La dimensione, indicata dopo la frequenza giornaliera, prevale salvo regole specifiche del log. Il <code>logrotate.conf</code> originale viene copiato in <code>.bak</code> alla prima applicazione.",
+    "tipTitle": "Compatibile con Log2RAM",
+    "tipBody": "La direttiva <code>size 10M</code> prevale sull’impostazione giornaliera precedente; <em>non</em> significa il primo dei due criteri. Logrotate controlla la soglia quando viene eseguito, e le regole specifiche possono sovrascrivere quelle globali. Con <code>/var/log</code> nella RAM di Log2RAM, verifica regole e frequenza del timer per controllare lo spazio."
+  },
+  "limits": {
+    "heading": "Aumenta i vari limiti del sistema",
+    "intro": "Aumenta i limiti di kernel, systemd e PAM che possono essere troppo bassi per un host con molte VM, container e servizi di rete.",
+    "headerFile": "File",
+    "headerSets": "Che cosa imposta",
+    "rows": [
+      {
+        "file": "/etc/sysctl.d/99-maxwatches.conf",
+        "sets": "<code>fs.inotify.max_user_watches / max_user_instances / max_queued_events = 1048576</code>"
+      },
+      {
+        "file": "/etc/sysctl.d/99-maxkeys.conf",
+        "sets": "<code>kernel.keys.maxkeys / root_maxkeys = 1000000</code>"
+      },
+      {
+        "file": "/etc/sysctl.d/99-swap.conf",
+        "sets": "<code>vm.swappiness = 10</code>, <code>vm.vfs_cache_pressure = 100</code>"
+      },
+      {
+        "file": "/etc/sysctl.d/99-fs.conf",
+        "sets": "<code>fs.nr_open / file-max = 2097152</code>, <code>fs.aio-max-nr = 1048576</code>"
+      },
+      {
+        "file": "/etc/security/limits.d/99-limits.conf",
+        "sets": "<code>nofile</code> e <code>nproc</code> a 1.048.576 (illimitati per root)"
+      },
+      {
+        "file": "/etc/systemd/system.conf + user.conf",
+        "sets": "<code>DefaultLimitNOFILE=1048576</code> per servizi systemd"
+      },
+      {
+        "file": "/etc/pam.d/common-session + runuser-l",
+        "sets": "<code>session required pam_limits.so</code> così il suddetto si applica alle shell di login"
+      },
+      {
+        "file": "/root/.profile",
+        "sets": "<code>ulimit -n 1048576</code> per la shell root"
+      }
+    ],
+    "tipTitle": "Perché inotify è importante",
+    "tipBody": "Docker, Syncthing, gli osservatori di file Node.js e le scansioni Plex possono esaurire <code>max_user_watches</code>. Il valore predefinito dipende dal kernel e dalla RAM; non è sempre 8192. Il limite di 1M consente più osservatori senza preallocarli. Quelli attivi consumano memoria del kernel: controlla l’uso sugli host con poca RAM."
+  },
+  "memory": {
+    "heading": "Ottimizzare le impostazioni di memoria",
+    "intro": "Scrive un profilo sysctl bilanciato in <code>/etc/sysctl.d/99-memory.conf</code>. È pensato per un host hypervisor: preferisce tenere in RAM la memoria attivamente usata dalle VM e libera pagine in anticipo per evitare blocchi durante picchi di allocazione.",
+    "warnTitle": "swappiness=10 sugli host con poca memoria",
+    "warnBody": "Su un host con 16 GB di RAM e molte VM, abbassare swappiness può portare il kernel a terminare processi per memoria esaurita invece di usare lo swap. Se gli eventi OOM sono frequenti, riporta swappiness a 30–60 in <code>/etc/sysctl.d/99-memory.conf</code> dopo lo script."
+  },
+  "kexec": {
+    "heading": "Attiva reboot veloci (kexec)",
+    "intro": "Installa <code>kexec-tools</code> e lo collega in modo da poter riavviare l'host direttamente in un nuovo kernel <em> senza passare attraverso il firmware BIOS/UEFI</em>. Su grandi server dove POST prende 45 – 90 secondi, questo trasforma un riavvio da una pausa caffè in pochi secondi di downtime.",
+    "installsTitle": "Cosa installa ProxMenux",
+    "installsItems": [
+      "Pacchetto <code>kexec-tools</code> (debconf preimpostato con <code>kexec-tools/load_kexec boolean false</code> per evitare domande di apt e lasciare disattivato il caricamento automatico allo spegnimento).",
+      "Unità systemd <code>/etc/systemd/system/kexec-pve.service</code> — carica kernel Proxmox e initrd in memoria all’avvio, riutilizzando la riga di comando attuale del kernel.",
+      "Un alias in <code>/root/.bash_profile</code>: <code>reboot-quick</code> → <code>systemctl kexec</code>."
+    ],
+    "usageIntro": "Utilizzo dopo il riavvio successivo (o manuale <code>systemctl start kexec-pve</code>):",
+    "warnTitle": "Quando non usare kexec",
+    "warnBody": "kexec salta l’inizializzazione del firmware. Se BIOS/UEFI deve ripristinare lo stato hardware, per esempio una GPU in passthrough che si reimposta solo con POST completo o un firmware HBA problematico, i riavvii kexec possono lasciare i dispositivi parzialmente inizializzati. Usa un <code>reboot</code> normale dopo aggiornamenti del kernel o per applicare modifiche BIOS/UEFI. <code>reboot-quick</code> serve ai riavvii quotidiani."
+  },
+  "panic": {
+    "heading": "Abilita riavvio in caso di kernel panic",
+    "intro": "Fa <strong>riavviare automaticamente</strong> il kernel invece di lasciarlo bloccato sulla schermata di panic. Essenziale per host Proxmox remoti o senza console locale: un kernel bloccato ferma tutte le VM finché non puoi spegnere e riaccendere l’host.",
+    "tipTitle": "Abbina questo con accesso remoto alla console",
+    "tipBody": "Il riavvio automatico serve al recupero, non al debug. Per <em>indagare</em> su un panic invece di ripartire soltanto, usa <link>l’opzione kexec</link> con il supporto kdump del kernel, non configurato da ProxMenux, oppure registra una console seriale su un altro host prima di abilitare il riavvio automatico."
+  },
+  "verify": {
+    "heading": "Verifica",
+    "intro": "Dopo aver applicato le ottimizzazioni del sistema:",
+    "tipTitle": "Ripristino e limiti",
+    "tipBody": "Le sei opzioni sono registrate in <code>installed_tools.json</code> e disponibili in <link>Disinstalla ottimizzazioni</link>. Il ripristino rimuove i file di configurazione, l’unità e l’alias kexec, riscrive journald.conf con i valori predefiniti di systemd e ripristina logrotate.conf dal backup. Alcuni limiti attivi richiedono una nuova sessione o un riavvio."
+  },
+  "related": {
+    "heading": "Correlati",
+    "items": [
+      {
+        "label": "Comandi di sistema utili",
+        "href": "/docs/help-info/system-commands",
+        "tail": "— verificare le modifiche (free -h, journalctl, ulimit -a)."
+      },
+      {
+        "label": "Prestazioni",
+        "href": "/docs/post-install/performance",
+        "tail": "— regolazione supplementare del livello di sistema (pigz)."
+      },
+      {
+        "label": "Disinstalla ottimizzazioni",
+        "href": "/docs/post-install/uninstall",
+        "tail": "— annullare qualsiasi modifica."
+      },
+      {
+        "label": "Post-installazione personalizzabile",
+        "href": "/docs/post-install/customizable",
+        "tail": " — torna al menu superiore."
+      }
+    ]
+  }
+}
diff --git a/web/messages/it/docs/post-install/uninstall.json b/web/messages/it/docs/post-install/uninstall.json
new file mode 100644
index 00000000..e0ffc8d6
--- /dev/null
+++ b/web/messages/it/docs/post-install/uninstall.json
@@ -0,0 +1,271 @@
+{
+  "meta": {
+    "title": "Disinstalla ottimizzazioni | Documentazione ProxMenux",
+    "description": "Ripristina le modifiche di configurazione post-installazione reversibili applicate da ProxMenux. Gli strumenti registrati utilizzano disinstallatori dedicati che conservano lo stato host preesistente, laddove possibile."
+  },
+  "header": {
+    "title": "Disinstalla ottimizzazioni",
+    "description": "Ripristina le modifiche reversibili apportate dagli script post-installazione automatizzati o personalizzabili. ProxMenux registra ogni ottimizzazione supportata con la sua funzione di restauro dedicata; gli aggiornamenti dei pacchetti sono intenzionalmente esclusi.",
+    "section": "Impostazioni post-installazione Proxmox"
+  },
+  "intro": {
+    "title": "Perché questo esiste",
+    "body": "Ogni modifica reversibile supportata viene <strong>registrata</strong> in <code>/usr/local/share/proxmenux/installed_tools.json</code>. Il registro elenca le ottimizzazioni attive e richiama la funzione di ripristino corrispondente. Le azioni senza ripristino sicuro, come l’aggiornamento completo dei pacchetti, non vengono aggiunte."
+  },
+  "openMenu": {
+    "heading": "Come aprirlo",
+    "body": "Dal menu principale apri <strong>Impostazioni post-installazione Proxmox → Disinstalla ottimizzazioni</strong>. La lista mostra le ottimizzazioni <em>attualmente applicate</em>; quelle non applicate non compaiono.",
+    "imageAlt": "Lista Disinstalla ottimizzazioni con modifiche attive sull’host e caselle per scegliere quali annullare"
+  },
+  "howWorks": {
+    "heading": "Come funziona il ripristino",
+    "steps": [
+      {
+        "title": "Registro e rilevamento automatico",
+        "body1": "Alla prima esecuzione ProxMenux cerca indicatori sull’host: <code>/etc/sysctl.d/99-memory.conf</code>, <code>/etc/apt/apt.conf.d/99-force-ipv4</code>, pacchetto <code>haveged</code> installato, servizio Log2RAM attivo e simili. Gli elementi riconosciuti vengono registrati come reversibili anche se applicati da una versione precedente al registro.",
+        "body2": "Questa migrazione funziona solo una volta. Dopo di che, ogni applicazione/ritorno aggiorna il registro direttamente."
+      },
+      {
+        "title": "Scegli cosa ripristinare",
+        "body1": "La lista mostra un nome comprensibile per ogni elemento, come <em>Ottimizzazione della memoria</em>, <em>Passthrough PCI IOMMU/VFIO</em> o <em>Log2RAM (protezione SSD)</em>. Seleziona quelli da annullare; gli altri non vengono modificati."
+      },
+      {
+        "title": "Esecuzione del ripristino",
+        "body1": "Per ogni elemento selezionato, ProxMenux chiama la sua funzione disinstallazione corrispondente. La maggior parte delle inversioni seguono uno dei tre modelli:",
+        "items": [
+          "<strong>Da backup</strong> — ripristina un <code>.bak</code> creato all’applicazione (bashrc, logrotate.conf, journald.conf, riga di comando GRUB/kernel).",
+          "<strong>Rimozione della configurazione</strong> — elimina i file ProxMenux <code>/etc/sysctl.d/99-*.conf</code>, <code>/etc/apt/apt.conf.d/99-*</code> o l’unità systemd, poi ricarica.",
+          "<strong>Reinstallazione dei pacchetti</strong> — per modifiche all’interfaccia come l’avviso di abbonamento, reinstalla i pacchetti originali con <code>--force-confnew</code> per ripristinare le impostazioni distribuite."
+        ],
+        "body2": "Ogni inversione registra i suoi progressi. Gli elementi che richiedono un riavvio (VFIO, nomi di interfaccia persistenti) impostano una bandiera che attiva il prompt di riavvio alla fine."
+      },
+      {
+        "title": "Richiesta di riavvio finale",
+        "body1": "Dopo l'inversione il menu mostra un prompt di riavvio. Gli elementi che hanno cambiato i parametri del kernel, i moduli del kernel o la denominazione di rete (VFIO, i nomi di interfaccia persistenti) hanno bisogno del riavvio per prendere effetto; altri elementi non lo fanno, e il prompt è un default di sicurezza piuttosto che un controllo per-item."
+      }
+    ]
+  },
+  "reversible": {
+    "heading": "Che cosa è reversibile",
+    "intro": "Le ottimizzazioni reversibili registrate e i loro disinstallatori corrispondenti sono raggruppati qui per area:",
+    "groups": [
+      {
+        "title": "Repositori & APT",
+        "items": [
+          {
+            "tool": "Rimozione dell’avviso di abbonamento",
+            "restores": "Prima cerca di ripristinare i file UI da backup propri di ProxMenux (/usr/local/share/proxmenux/backups/proxmoxlib.js.backup.* e, quando l'interfaccia utente mobile viene patchata, index.html.tpl.backup.*). Solo se un backup è mancante o danneggiato, torna a reinstallare pve-manager, proxmox-widget-toolkit, libjs-extjs e libpve-http-server-perl con force-confnew. Inoltre cancella le copie cache .js / .gz."
+          },
+          {
+            "tool": "Salta le lingue APT",
+            "restores": "Rimuove /etc/apt/apt.conf.d/99-disable-translations, consentendo gli indici delle descrizioni tradotte secondo le altre impostazioni linguistiche APT."
+          },
+          {
+            "tool": "Forza IPv4 per APT",
+            "restores": "Rimuove /etc/apt/apt.conf.d/99-force-ipv4."
+          },
+          {
+            "tool": "Utilità del sistema",
+            "restores": "Rimuove completamente solo i pacchetti di utilità selezionati che ProxMenux ha registrato come appena installati. I pacchetti già presenti non entrano nell’elenco e restano intatti."
+          }
+        ]
+      },
+      {
+        "title": "Limiti di Kernel, memoria e sistema",
+        "items": [
+          {
+            "tool": "Impostazioni della memoria",
+            "restores": "Rimuove /etc/sysctl.d/99-memory.conf e ricarica sysctl."
+          },
+          {
+            "tool": "Configurazione del kernel panic",
+            "restores": "Rimuove /etc/sysctl.d/99-kernelpanic.conf."
+          },
+          {
+            "tool": "Aumento dei limiti di sistema",
+            "restores": "Rimuove /etc/sysctl.d/99-maxwatches.conf, 99-maxkeys.conf, 99-swap.conf, 99-fs.conf e /etc/security/limits.d/99-limits.conf. Ripristina limiti PAM e DefaultLimitNOFILE systemd. In /root/.profile rimuove solo il vecchio ulimit -n 256000; ulimit -n 1048576 dell’installatore attuale può restare e richiedere rimozione manuale."
+          },
+          {
+            "tool": "Profilo swap ZRAM",
+            "restores": "Disattiva lo swap /dev/zram0, ferma dev-zram0.swap e rimuove /etc/systemd/zram-generator.conf.d/90-proxmenux.conf. Rimuove completamente systemd-zram-generator solo se installato da ProxMenux e senza altre configurazioni ZRAM. Se non può spostare le pagine fuori da ZRAM, il profilo rimane attivo e non elimina nulla."
+          }
+        ]
+      },
+      {
+        "title": "Rete",
+        "items": [
+          {
+            "tool": "Ottimizzazione della rete",
+            "restores": "Rimuove /etc/sysctl.d/99-network.conf, 97-proxmenux-fwbr.conf e 98-proxmenux-rpf.conf, l’unità proxmenux-fwbr-tune.service, lo script /usr/local/sbin/proxmenux-fwbr-tune e la regola udev /etc/udev/rules.d/99-zz-proxmenux-fwbr-tune.rules. Elimina anche source /etc/network/interfaces.d/* da /etc/network/interfaces. Ricarica sysctl, systemd e le regole udev."
+          },
+          {
+            "tool": "Open vSwitch",
+            "restores": "Esegue apt purge su openvswitch-switch e openvswitch-common. Migrare eventuali ponti OVS indietro ai ponti Linux prima di eseguire questa disinstallazione — altrimenti le VM su quei ponti perdono la rete sul prossimo avvio."
+          },
+          {
+            "tool": "TCP BBR + TCP Fast Open",
+            "restores": "Rimuove /etc/sysctl.d/99-kernel-bbr.conf e 99-tcp-fastopen.conf e ricarica le altre impostazioni sysctl. Eliminare i file non ripristina i valori attivi; valori come cubic e tcp_fastopen=1 tornano al riavvio salvo altre configurazioni."
+          },
+          {
+            "tool": "Nomi di interfaccia persistenti",
+            "restores": "Rimuove solo i file 10-proxmenux-*.link che trasportano l'intestazione ProxMenux da /etc/systemd/network/. Qualsiasi file .link fornito da un altro pacchetto o scritto dall'utente viene lasciato in posizione. I nomi delle interfacce ritornano al comportamento predefinito di systemd nel prossimo riavvio."
+          }
+        ]
+      },
+      {
+        "title": "Registrazione",
+        "items": [
+          {
+            "tool": "Ottimizzazione di journald",
+            "restores": "Riscrive /etc/systemd/journald.conf con i valori predefiniti originali e riavvia systemd-journald."
+          },
+          {
+            "tool": "Ottimizzazione Logrotate",
+            "restores": "Ripristina /etc/logrotate.conf dal file .bak catturato prima della modifica."
+          },
+          {
+            "tool": "Log2RAM",
+            "restores": "Ferma e disabilita servizio e timer. Elimina processi cron, unità systemd, binari, configurazione e /var/log.hdd. Rimuove anche il pacchetto apt se installato in quel modo."
+          },
+          {
+            "tool": "TRIM automatico ZFS",
+            "restores": "Legge /usr/local/share/proxmenux/zfs_autotrim_pools, l’elenco dei pool realmente modificati, ed esegue zpool set autotrim=off su ciascuno. Non tocca autotrim abilitato manualmente prima di ProxMenux."
+          }
+        ]
+      },
+      {
+        "title": "Shell & apparenza",
+        "items": [
+          {
+            "tool": "Personalizzazione di Bashrc",
+            "restores": "Ripristina /root/.bashrc dal backup .bak. Se non esiste alcun backup, rimuove il blocco PMX_CORE_BASHRC da marcatori."
+          },
+          {
+            "tool": "Banner MOTD personalizzato",
+            "restores": "Ripristina l'esatto contenuto originale /etc/motd mantenuto sotto /usr/local/share/proxmenux, rimuove il file quando non esisteva prima, o rimuove in modo sicuro il marcatore legacy durante la migrazione di un'installazione precedente."
+          },
+          {
+            "tool": "Fastfetch",
+            "restores": "Rimuove binario, directory di configurazione, hook update-motd e blocco delimitato BEGIN FASTFETCH / END FASTFETCH da /root/.bashrc, ~/.profile, /etc/profile e /etc/profile.d/fastfetch.sh. Rimuove completamente il pacchetto apt se installato."
+          },
+          {
+            "tool": "Figurine",
+            "restores": "Rimuove il binario, la voce profile.d e il blocco alias in bashrc/profile."
+          }
+        ]
+      },
+      {
+        "title": "Hardware e virtualizzazione",
+        "items": [
+          {
+            "tool": "IOMMU / VFIO",
+            "restores": "Rimuove i moduli vfio da /etc/modules, il nouveau / radeon / nvidia blacklist, e intel_iommu=on / amd_iommu=on / iommu=pt / pcie_acs_override parametri da /etc/kernel/cmdline (ZFS) o GRUB. Ricostruisce initramfs."
+          },
+          {
+            "tool": "AMD CPU correzioni (Ryzen/EPYC)",
+            "restores": "Rimuove idle=nomwait dal kernel cmdline (ZFS) o GRUB, e le opzioni ignore_msrs / report_ignored_msrs da /etc/modprobe.d/kvm.conf."
+          },
+          {
+            "tool": "Agente guest per un host Proxmox virtualizzato",
+            "restores": "Legge /usr/local/share/proxmenux/guest_agent.pkg e rimuove il pacchetto host registrato. L’installatore sceglie qemu-guest-agent, open-vm-tools o virtualbox-guest-utils secondo l’hypervisor. Senza registrazione prova quei tre pacchetti. Agisce sull’host Proxmox annidato, non sui modelli guest."
+          }
+        ]
+      },
+      {
+        "title": "Archiviazione",
+        "items": [
+          {
+            "tool": "Dimensionamento dell'ARC ZFS",
+            "restores": "Rimuove /etc/modprobe.d/99-zfsarc.conf, ripristina i file *.conf esterni in conflitto salvati in /usr/local/share/proxmenux/backups/zfs_arc/, ricrea initramfs ed esegue proxmox-boot-tool refresh sugli host systemd-boot."
+          },
+          {
+            "tool": "Snapshot automatici ZFS",
+            "restores": "Rimuove le voci cron scritte dallo script e propone apt purge zfs-auto-snapshot. Gli snapshot esistenti sui pool restano intatti; eliminali separatamente se necessario."
+          },
+          {
+            "tool": "Limiti di velocità di vzdump",
+            "restores": "Ripristina /etc/vzdump.conf dal .bak l'installazione creata, riportando bwlimit e ionice ai valori pre-ProxMenux."
+          }
+        ]
+      },
+      {
+        "title": "Servizi e extra",
+        "items": [
+          {
+            "tool": "Sincronizzazione del tempo",
+            "restores": "Imposta il fuso orario di ritorno a UTC (impostazione predefinita sicura) tramite timedatectl."
+          },
+          {
+            "tool": "Generazione di entropia (haveged)",
+            "restores": "Ferma, disabilita e rimuove completamente il pacchetto haveged."
+          },
+          {
+            "tool": "kexec (riavvii rapidi)",
+            "restores": "Disabilita kexec-pve.service, rimuove il file dell'unità e gli alias reboot-quick da /root/.bash_profile, purges kexec-tools."
+          },
+          {
+            "tool": "RPC / rpcbind Disabilitazione",
+            "restores": "Ripristina separatamente rpcbind.service e rpcbind.socket negli stati abilitato/disabilitato e attivo/inattivo registrati prima di ProxMenux."
+          },
+          {
+            "tool": "pigz (gzip parallelo)",
+            "restores": "Ripristina il vero gzip da gzip.distrib, rimuove la deviazione dpkg e /bin/pigzwrapper, commenta la riga pigz in /etc/vzdump.conf ed esegue apt purge pigz dopo aver verificato gzip."
+          },
+          {
+            "tool": "Servizi di alta disponibilità",
+            "restores": "Ferma e disabilita pve-ha-lrm, pve-ha-crm e corosync. I gruppi HA esistenti e le definizioni delle risorse non vengono eliminati — rimuoverli dall'interfaccia utente web se non ne hai più bisogno."
+          },
+          {
+            "tool": "repository Ceph",
+            "restores": "Rimuove completamente i pacchetti Ceph installati dall’opzione, elimina il file deb822 /etc/apt/sources.list.d/ceph.sources su PVE 9 o la vecchia lista Ceph su PVE 8 e aggiorna la cache APT."
+          },
+          {
+            "tool": "OVH RTM (monitoraggio)",
+            "restores": "Rimuove i pacchetti corrispondenti a ovh-rtm*, rtm e rtm-*, elimina /etc/rtm e la voce RTM dal registro. I residui Puppet in /etc/puppet/ possono richiedere verifica e pulizia manuale; la directory non viene eliminata. Su host non OVH l’installatore normalmente non modifica nulla."
+          }
+        ]
+      }
+    ]
+  },
+  "edge": {
+    "heading": "Casi particolari e limiti",
+    "packageTitle": "La reinstallazione interessa pacchetti Proxmox in uso",
+    "packageBody": "Se le copie ProxMenux non possono annullare <strong>Rimozione dell’avviso di abbonamento</strong>, il ripiego reinstalla <code>pve-manager</code>, <code>proxmox-widget-toolkit</code>, <code>libjs-extjs</code> e <code>libpve-http-server-perl</code> con <code>--force-confnew</code>. Interessa l’interfaccia web in uso: ricarica il browser e attendi qualche secondo per riconnetterti. Evitalo durante migrazioni o clonazioni.",
+    "rebootTitle": "I nomi persistenti e VFIO hanno bisogno di un riavvio",
+    "rebootBody": "Eliminare i file <code>10-proxmenux-*.link</code> (<em>Nomi persistenti delle interfacce</em>) e annullare <em>IOMMU/VFIO</em> non cambia il sistema già avviato: le modifiche si applicano dopo il riavvio. ProxMenux segnala automaticamente la necessità di riavviare.",
+    "perItemTitle": "Puoi annullare una modifica e conservare le altre",
+    "perItemBody": "Il disinstallatore opera per-item. Se si desidera solo rimuovere Log2RAM ma mantenere il tuning di rete e le modifiche bashrc, selezionare solo <em>Log2RAM</em>. Nient'altro è toccato, e il registro è aggiornato di conseguenza."
+  },
+  "inspect": {
+    "heading": "Ispezione manuale del registro",
+    "intro": "Se volete vedere cosa è tracciato senza aprire il menu:",
+    "outro": "Ogni voce <code>\"tool\": true</code> corrisponde a qualcosa che ProxMenux applicato e può invertire. Rimuovere una voce manualmente non è raccomandato — utilizzare sempre il menu, che esegue anche la funzione inversione invece di semplicemente dimenticando il cambiamento.",
+    "reinstallTitle": "Reinstallare dopo aver disinstallato",
+    "reinstallBody": "Puoi riapplicare in seguito un’ottimizzazione annullata. Apri di nuovo <link>il menu post-installazione</link> ed esegui Automatizzato o Personalizzabile: il registro memorizzerà il nuovo stato."
+  },
+  "related": {
+    "heading": "Correlati",
+    "items": [
+      {
+        "label": "Post-Install automatizzato",
+        "href": "/docs/post-install/automated",
+        "tail": " — riapplica la configurazione di base consigliata."
+      },
+      {
+        "label": "Post-installazione personalizzabile",
+        "href": "/docs/post-install/customizable",
+        "tail": "— scegliere un sottoinsieme diverso."
+      },
+      {
+        "label": "Disinstalla ProxMenux",
+        "href": "/docs/settings/uninstall-proxmenux",
+        "tail": "— operazione diversa: rimuove ProxMenux se stessa, non le sue ottimizzazioni applicate."
+      },
+      {
+        "label": "Panoramica post-install",
+        "href": "/docs/post-install",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/it/docs/post-install/updates.json b/web/messages/it/docs/post-install/updates.json
new file mode 100644
index 00000000..64536f4e
--- /dev/null
+++ b/web/messages/it/docs/post-install/updates.json
@@ -0,0 +1,112 @@
+{
+  "meta": {
+    "title": "Applica aggiornamenti disponibili — Ottimizzazioni post-installazione | Documentazione ProxMenux",
+    "description": "Come ProxMenux rileva quando un'ottimizzazione post-install (Log2Ram, Impostazioni di memoria, Limiti di sistema, Logrotate, tuning di rete...) è stata aggiornata a monte e come applicare la nuova versione — dal menu Post-Install o dal cruscotto Monitor."
+  },
+  "header": {
+    "title": "Applica aggiornamenti disponibili",
+    "description": "Quando sul disco è presente una versione di un’ottimizzazione post-installazione (Log2Ram, impostazioni della memoria, limiti di sistema, Logrotate …) più recente di quella registrata sull’host, ProxMenux la segnala come aggiornamento disponibile. Puoi applicarla dal menu di post-installazione nell’interfaccia degli script oppure dalla dashboard del Monitor. Entrambi i percorsi rieseguono la stessa funzione di post-installazione e ne aggiornano la versione registrata.",
+    "section": "Impostazioni post-installazione Proxmox"
+  },
+  "intro": {
+    "title": "Che cosa è questo",
+    "body": "Le ottimizzazioni post-installazione ProxMenux hanno versioni, ad esempio <code>Log2ram SSD Protection v1.2</code>. L’host registra quelle attive e le relative versioni in <code>/usr/local/share/proxmenux/installed_tools.json</code>. Quando una nuova versione ProxMenux aggiorna un’ottimizzazione, viene rilevata la differenza ed è possibile riapplicare solo quella, senza ripetere tutta la post-installazione."
+  },
+  "why": {
+    "heading": "Perché questo esiste",
+    "body": "Le ottimizzazioni post-installazione ricevono miglioramenti: regolazioni sysctl, limiti Logrotate più severi, nuovi criteri di dimensionamento Log2RAM o correzioni di casi limite. Senza questa modalità occorreva ripetere lo script, che riapplica <em>tutte</em> le ottimizzazioni, oppure rinunciare al miglioramento. Applica aggiornamenti disponibili permette di scegliere solo quelle la cui versione è cambiata."
+  },
+  "detection": {
+    "heading": "Come vengono rilevati gli aggiornamenti",
+    "steps": [
+      {
+        "title": "Script con versione su disco",
+        "body": "Ogni funzione post-installazione dichiara la sua versione all'interno dello script (<code>scripts/post_install/auto_post_install.sh</code> e <code>scripts/post_install/customizable_post_install.sh</code>). Uno scanner estrae queste versioni dalla fonte sul disco."
+      },
+      {
+        "title": "Registro delle versioni sull’host",
+        "body": "Quando l'operatore ha applicato ogni ottimizzazione, la corrispondente chiamata <code>register_tool</code> ha scritto la versione attiva in <code>/usr/local/share/proxmenux/installed_tools.json</code>. Questo file è la fonte della verità per \"che cosa è attivo su questo host in questo momento\"."
+      },
+      {
+        "title": "Monitor confronta entrambi i lati",
+        "body": "All’avvio e ogni 24 ore, Monitor confronta le versioni su disco con quelle registrate. Ogni differenza genera una voce in <code>/usr/local/share/proxmenux/updates_available.json</code>. Il file alimenta la voce del menu post-installazione e la scheda della dashboard Monitor."
+      },
+      {
+        "title": "Una notifica per nuova versione",
+        "body": "Quando almeno un’ottimizzazione ha un aggiornamento in attesa, Monitor invia un’unica notifica raggruppata, ad esempio <em>«4 aggiornamenti delle ottimizzazioni ProxMenux disponibili»</em>, con una riga per strumento nel formato <code>name (vX → vY)</code>, come per i pacchetti Proxmox. Non si ripete ogni giorno per lo stesso insieme: si riattiva solo con una nuova versione o un nuovo strumento nell’elenco."
+      }
+    ]
+  },
+  "pathA": {
+    "heading": "Percorso A — Dal menu post-installazione",
+    "intro": "Dal menu principale ProxMenux, apri <strong>Impostazioni post-installazione Proxmox</strong>. Con aggiornamenti in attesa compare <strong>Applica aggiornamenti disponibili (N)</strong> sopra <em>Disinstalla ottimizzazioni</em>. Il numero indica quante ottimizzazioni hanno una versione su disco più recente di quella registrata. Se tutto è aggiornato, la voce è nascosta.",
+    "menuAlt": "Menu degli script post-installazione con Applica aggiornamenti disponibili (N) sopra Disinstalla ottimizzazioni; il contatore indica quante ottimizzazioni hanno una versione più recente su disco",
+    "menuCaption": "<em>Applica aggiornamenti disponibili (N)</em> compare solo se almeno un’ottimizzazione ha un aggiornamento in attesa; si nasconde quando l’host è aggiornato.",
+    "checklistBody": "Apre una lista con tutti gli aggiornamenti in attesa, nel formato <code>name (vX → vY)</code>. Sono tutti selezionati per impostazione predefinita: deseleziona quelli che non vuoi applicare ora.",
+    "checklistAlt": "Finestra Applica aggiornamenti disponibili con una riga per ottimizzazione in attesa, nome e passaggio di versione (attuale → disponibile). Tutte le righe sono selezionate.",
+    "checklistCaption": "Seleziona le singole ottimizzazioni da aggiornare. Lo stesso motore usato per la post-installazione automatica e personalizzabile riesegue in background ogni funzione selezionata e ne aggiorna la versione registrata."
+  },
+  "pathB": {
+    "heading": "Percorso B — Dalla dashboard Monitor",
+    "intro": "Gli stessi aggiornamenti compaiono in Monitor sotto <link>Impostazioni → Ottimizzazioni ProxMenux</link>. La scheda mostra un <strong>contatore degli aggiornamenti</strong> in attesa che apre il selettore per ottimizzazione. Ogni strumento ha anche la propria azione di aggiornamento.",
+    "imageAlt": "Scheda Ottimizzazioni ProxMenux nelle impostazioni Monitor con contatore degli aggiornamenti che apre il selettore e azioni di aggiornamento per ogni strumento",
+    "imageCaption": "La scheda Ottimizzazioni di Monitor rende accessibili gli aggiornamenti dal contatore quando esiste una versione più recente su disco, senza accedere alla shell."
+  },
+  "applying": {
+    "heading": "Cosa succede quando si applica",
+    "steps": [
+      {
+        "title": "Riesegue la funzione post-installazione",
+        "body": "La funzione scelta viene rieseguita sull’host. Essendo <strong>idempotente</strong>, non duplica la configurazione: sostituisce la versione precedente con la nuova, inclusi file sysctl, configurazioni aggiuntive e unità dei servizi."
+      },
+      {
+        "title": "Aggiorna il registro",
+        "body": "La chiamata <code>register_tool</code> nella funzione scrive la nuova versione in <code>installed_tools.json</code>. La scansione successiva non rileva più differenze e l’aggiornamento scompare dal menu e dalla scheda Monitor."
+      },
+      {
+        "title": "Nessun riavvio a meno che la funzione non lo dica",
+        "body": "La maggior parte degli aggiornamenti hanno effetto immediatamente. Gli aggiornamenti che toccano i moduli del kernel, i nomi di interfaccia persistenti, o VFIO mostrano lo stesso prompt di riavvio di una nuova installazione."
+      },
+      {
+        "title": "Aggiornamento del Registro inviato al Monitor",
+        "body": "Al termine del gruppo, il menu invia una richiesta POST a <code>http://127.0.0.1:8008/api/updates/post-install/scan</code> per ricostruire <code>/usr/local/share/proxmenux/updates_available.json</code>. Dopo tutti gli aggiornamenti scompaiono il contatore nella scheda Ottimizzazioni e la voce condizionale della shell, senza attendere la scansione successiva. La scheda resta disponibile."
+      }
+    ],
+    "jqTitle": "jq è necessario",
+    "jqBody": "La lista del percorso A usa <code>jq</code> per leggere il JSON degli aggiornamenti. Se <code>jq</code> manca, termina senza messaggi: vedresti il menu con il conteggio ma nulla accadrebbe dopo la selezione. Su un’installazione Proxmox moderna <code>jq</code> è presente; in caso di dubbio esegui <code>apt install -y jq</code>."
+  },
+  "differs": {
+    "heading": "Come differisce dagli altri percorsi",
+    "headerPath": "Path",
+    "headerScope": "Ambito",
+    "headerWhen": "Quando ha senso",
+    "rows": [
+      {
+        "pathLabel": "Automatizzato",
+        "pathHref": "/docs/post-install/automated",
+        "scope": "Riapplica <em>tutte</em> le ottimizzazioni del pacchetto.",
+        "when": "Host nuovo o riapplicazione completa della configurazione di base di un nodo interamente gestito."
+      },
+      {
+        "pathLabel": "Personalizzabile",
+        "pathHref": "/docs/post-install/customizable",
+        "scope": "Scegli dal catalogo completo.",
+        "when": "Scegliere esattamente quali ottimizzazioni sono attive sull’host."
+      },
+      {
+        "pathLabel": "Applica aggiornamenti disponibili",
+        "pathHref": null,
+        "scope": "Solo le ottimizzazioni con una versione più recente su disco.",
+        "when": "Mantenere aggiornate le ottimizzazioni installate senza toccare il resto."
+      },
+      {
+        "pathLabel": "Disinstalla ottimizzazioni",
+        "pathHref": "/docs/post-install/uninstall",
+        "scope": "Invertire l'ottimizzazione e rimuovere la sua voce di registro.",
+        "when": "Annullare una modifica specifica."
+      }
+    ]
+  },
+  "notifTitle": "Controllo della notifica",
+  "notifBody": "L’evento <em>Aggiornamenti delle ottimizzazioni ProxMenux disponibili</em> annuncia gli aggiornamenti in attesa. È attivo per impostazione predefinita su ogni canale e può essere silenziato per canale in <link>Impostazioni → Notifiche</link>. Si attiva una sola volta per insieme distinto di aggiornamenti, non a ogni scansione di 24 ore."
+}
diff --git a/web/messages/it/docs/post-install/virtualization.json b/web/messages/it/docs/post-install/virtualization.json
new file mode 100644
index 00000000..7470dc39
--- /dev/null
+++ b/web/messages/it/docs/post-install/virtualization.json
@@ -0,0 +1,116 @@
+{
+  "meta": {
+    "title": "Post-installazione: Virtualizzazione | Documentazione ProxMenux",
+    "description": "Opzioni di virtualizzazione nel ProxMenux Personalizzabile script post-installazione: installare automaticamente l'agente ospite giusto se Proxmox viene eseguito all'interno di un VM e abilitare IOMMU / VFIO in modo da poter passare i dispositivi PCI (GPU, NIC, HBA) attraverso le proprie VM."
+  },
+  "header": {
+    "title": "Post-Install: Virtualizzazione",
+    "section": "Impostazioni post-installazione Proxmox"
+  },
+  "intro": {
+    "title": "Che cosa copre questa categoria",
+    "body": "Due opzioni indipendenti. <strong>Installa il guest agent appropriato</strong> serve quando Proxmox stesso gira dentro un altro hypervisor. <strong>Abilita supporto VFIO IOMMU</strong> interessa la maggior parte degli utenti: attiva le funzioni del kernel per assegnare direttamente GPU, HBA o schede di rete a una VM con prestazioni quasi native."
+  },
+  "guestAgent": {
+    "heading": "Installa il guest agent appropriato",
+    "intro": "Rileva l’ambiente di virtualizzazione dell’host Proxmox tramite <code>systemd-detect-virt</code> e <code>dmidecode</code> e installa gli strumenti guest adatti per comunicare correttamente con l’hypervisor esterno: arresto ordinato, sincronizzazione dell’orologio, informazioni IP, ecc.",
+    "headerDetected": "Host rilevato",
+    "headerPackage": "Pacchetto installato",
+    "rows": [
+      {
+        "detected": "QEMU / KVM",
+        "package": "qemu-guest-agent"
+      },
+      {
+        "detected": "VMware (ESXi, Workstation)",
+        "package": "open-vm-tools"
+      },
+      {
+        "detected": "VirtualBox",
+        "package": "virtualbox-guest-utils"
+      },
+      {
+        "detected": "Bare metal (nessuno)",
+        "package": "— no-op, niente installato"
+      }
+    ],
+    "skipTitle": "Salta questo su bare-metal Proxmox",
+    "skipBody": "Se Proxmox gira direttamente sull’hardware, il caso comune, selezionare l’opzione non cambia nulla: il rilevatore restituisce <code>none</code> e lo script termina senza modifiche. Serve solo alle configurazioni che eseguono Proxmox <em>come guest</em> per test o laboratori."
+  },
+  "vfio": {
+    "heading": "Abilita supporto VFIO IOMMU",
+    "intro": "Attiva IOMMU sull’host e carica i moduli per il passthrough PCI (<code>vfio</code>, <code>vfio_iommu_type1</code>, <code>vfio_pci</code>). Puoi così assegnare un dispositivo fisico a una VM, che vi accede direttamente con prestazioni quasi native.",
+    "whoTitle": "Chi ha bisogno di questo",
+    "whoItems": [
+      "Vuoi assegnare una GPU a una VM Windows per il gaming o a una VM macOS.",
+      "Hai un NIC 10G dedicato per un firewall/router VM (OPNsense, pfSense).",
+      "Si desidera passare un HBA direttamente a un TrueNAS/Unraid VM per ZFS su dischi nudi.",
+      "Prevedi di usare una <em>Coral TPU</em>, una scheda di acquisizione o un dongle SDR in una VM."
+    ],
+    "whoOutro": "Se non ti serve nulla di questo, puoi saltare l’opzione. Per l’accesso ai dispositivi da un <strong>LXC</strong>, invece di una VM, IOMMU <em>non</em> è necessario.",
+    "doesTitle": "Cosa fa ProxMenux",
+    "doesIntro": "La funzione tiene conto del boot loader: rileva ZFS (systemd-boot) o LVM/ext4 (GRUB) e scrive nel file corretto. È idempotente: se i parametri esistono già, non li aggiunge di nuovo.",
+    "headerBoot": "Tipo di avvio",
+    "headerFile": "File modificato",
+    "headerPost": "Passo dopo aggiornamento",
+    "bootRows": [
+      {
+        "boot": "systemd-boot (ZFS)",
+        "file": "/etc/kernel/cmdline",
+        "post": "proxmox-boot-tool refresh"
+      },
+      {
+        "boot": "GRUB (LVM/ext4)",
+        "file": "/etc/default/grub",
+        "post": "update-grub"
+      }
+    ],
+    "kernelIntro": "Parametri del kernel aggiunti:",
+    "modulesIntro": "Moduli Kernel aggiunti a <code>/etc/modules</code>:",
+    "blacklistIntro": "Driver in conflitto inseriti nella blacklist in <code>/etc/modprobe.d/blacklist.conf</code>:",
+    "blacklistTitle": "La blacklist dei driver GPU impedisce l’uso della GPU sull’host",
+    "blacklistBody": "La blacklist impedisce al kernel host di associare <em>qualsiasi</em> driver GPU, permettendo a VFIO di acquisire la GPU. È ciò che serve per il passthrough a una VM, ma è l’<strong>opposto</strong> di quanto necessario per <link>installare i driver NVIDIA sull’host</link>, ad esempio per la transcodifica LXC. Scegli un percorso per ogni GPU:",
+    "pathItems": [
+      "<strong>GPU → VM:</strong> abilita VFIO/IOMMU qui e lascia i driver GPU nella blacklist.",
+      "<strong>GPU → LXC (o host):</strong> salta questa opzione, usa l’installazione NVIDIA sull’host e non inserire nvidia/nouveau nella blacklist.",
+      "<strong>Due GPU:</strong> una può andare a una VM e l’altra a un LXC, ma serve una configurazione più precisa: associare solo una scheda a <code>vfio-pci</code> tramite ID PCI. La blacklist predefinita è troppo ampia: modifica poi <code>blacklist.conf</code>."
+    ],
+    "acsTitle": "Informazioni su pcie_acs_override — sapere cosa stai abilitando",
+    "acsBody": "<code>pcie_acs_override=downstream,multifunction</code> allenta il controllo PCIe Access Control Services. Il kernel può separare gruppi IOMMU che il firmware indica come indivisibili, talvolta l’unico modo per assegnare un dispositivo senza l’intero gruppo. Il compromesso è <strong>un isolamento ridotto tra dispositivi</strong>: una VM malevola o compromessa con passthrough ha una superficie di attacco DMA maggiore. Accettabile in un laboratorio domestico, da valutare bene su host con carichi non attendibili. Se non serve, rimuovi il parametro da <code>/etc/kernel/cmdline</code> o <code>/etc/default/grub</code> dopo lo script e ripeti l’aggiornamento del boot loader.",
+    "rebootTitle": "Riavvio necessario",
+    "rebootBody": "IOMMU, moduli VFIO e blacklist hanno effetto dopo la rigenerazione di initramfs e il riavvio. Lo script esegue <code>update-initramfs -u -k all</code>, aggiorna il boot loader e imposta «riavvio necessario», così Personalizzabile lo propone alla fine.",
+    "verifyTitle": "Verifica dopo il riavvio",
+    "revertTitle": "Reversibile dal menu Disinstalla",
+    "revertBody": "<link>Rimuovi le ottimizzazioni</link> annulla tutte le modifiche: elimina i parametri IOMMU da <code>/etc/kernel/cmdline</code> o da GRUB, rimuove i moduli VFIO da <code>/etc/modules</code>, elimina le voci della blacklist dei driver e ricostruisce initramfs. Per applicare effettivamente il ripristino è necessario riavviare."
+  },
+  "related": {
+    "heading": "Correlati",
+    "items": [
+      {
+        "label": "Aggiungi GPU a VM (Passthrough)",
+        "href": "/docs/hardware/gpu-vm-passthrough",
+        "tail": "— passo successivo naturale una volta abilitato IOMMU + VFIO."
+      },
+      {
+        "label": "Aggiungi controller o NVMe a VM",
+        "href": "/docs/disk-manager/add-controller-nvme-vm",
+        "tail": " — la stessa infrastruttura di passthrough per i controller di archiviazione."
+      },
+      {
+        "label": "Comandi di passaggio GPU",
+        "href": "/docs/help-info/gpu-commands",
+        "tail": "— Riferimento di verifica IOMMU."
+      },
+      {
+        "label": "Disinstalla ottimizzazioni",
+        "href": "/docs/post-install/uninstall",
+        "tail": " — annulla IOMMU / VFIO in modo pulito."
+      },
+      {
+        "label": "Post-installazione personalizzabile",
+        "href": "/docs/post-install/customizable",
+        "tail": " — torna al menu superiore."
+      }
+    ]
+  }
+}
diff --git a/web/messages/it/docs/security/fail2ban.json b/web/messages/it/docs/security/fail2ban.json
new file mode 100644
index 00000000..f7823c8f
--- /dev/null
+++ b/web/messages/it/docs/security/fail2ban.json
@@ -0,0 +1,152 @@
+{
+  "meta": {
+    "title": "Fail2Ban | Documentazione ProxMenux",
+    "description": "Installa Fail2Ban con tre jails ottimizzati per Proxmox (SSH aggressivo, Proxmox UI 8006, ProxMenux Monitor 8008). Include la correzione journald MaxLevelStore, servizi di registro personalizzati per l'affidabilità, backend nftables/iptables rilevati automaticamente e SSH MaxAuthTries rafforzamento.",
+    "ogTitle": "Fail2Ban | Documentazione ProxMenux",
+    "ogDescription": "Protezione contro la forza bruta per SSH e le interfacce web Proxmox, con correzioni di journald e del backend specifiche per Proxmox."
+  },
+  "header": {
+    "title": "Fail2Ban",
+    "description": "Installa Fail2Ban per Proxmox: tre jail (SSH aggressivo, interfaccia Proxmox su 8006, ProxMenux Monitor su 8008 e proxy inverso), correzione del livello journald per salvare gli eventi SSH, due servizi che copiano il journal in file per aggirare un problema del backend systemd, rilevamento del backend firewall e rafforzamento SSH con MaxAuthTries.",
+    "section": "Sicurezza"
+  },
+  "intro": {
+    "title": "Cosa fa",
+    "body": "Installa Fail2Ban dai repository Debian e scrive una configurazione Proxmox che protegge subito SSH, interfaccia web Proxmox e ProxMenux Monitor. Se rileva una installazione esistente, offre invece un menu per reinstallare o rimuovere."
+  },
+  "firstLaunch": {
+    "heading": "dialogo di primo lancio",
+    "body": "Se Fail2Ban non è installato, lo script mostra una conferma con ciò che installerà e configurerà. Annulla termina senza modifiche; confermare avvia l'installazione.",
+    "imageAlt": "Conferma di installazione di Fail2Ban con tre jail, correzione di journald e rafforzamento SSH"
+  },
+  "jails": {
+    "heading": "Le tre jail",
+    "headerJail": "Jail",
+    "headerProtects": "Protegge",
+    "headerRetries": "Tentativi / Finestra",
+    "headerBan": "Durata del blocco",
+    "rows": [
+      {
+        "jail": "[sshd]",
+        "protects": "SSH (modalità aggressive — include ddos, mode, normal)",
+        "retries": "2 / 60 min",
+        "ban": "9 ore"
+      },
+      {
+        "jail": "[proxmox]",
+        "protects": "Proxmox web UI (porta 8006)",
+        "retries": "3 / 10 min",
+        "ban": "1 ora"
+      },
+      {
+        "jail": "[proxmenux]",
+        "protects": "ProxMenux Monitor (porta 8008 + proxy inverso http/https)",
+        "retries": "3 / 10 min",
+        "ban": "1 ora"
+      }
+    ],
+    "outro": "Impostazioni predefinite globali da <code>jail.local</code>: <code>ignoreip = 127.0.0.1/8 ::1</code>, <code>ignoreself = true</code>,<code> bantime = 86400</code> (fallback di 24 ore per jails che non lo sovrascrivono), <code>maxretry = 2</code>, <code>findtime = 1800</code>."
+  },
+  "journald": {
+    "heading": "Perché la correzione journald è importante",
+    "intro": "Proxmox fornisce <code>/etc/systemd/journald.conf</code> con <codeNw>MaxLevelStore=warning</codeNw>. journald scarta i messaggi di livello <em>inferiore</em> a warning prima di salvarli. SSH e PAM segnalano gli errori di autenticazione ai livelli <em>info</em> / <em>notice</em>, quindi:",
+    "diagram": {
+      "sshLabel": "SSH / PAM",
+      "sshDetail": "errore di autenticazione\n(livello info / notice)",
+      "journaldLabel": "journald",
+      "journaldDetail": "MaxLevelStore=warning\n→ evento scartato senza avviso",
+      "fail2banLabel": "Fail2Ban",
+      "fail2banDetail": "non vede niente\n→ non vieta mai nulla",
+      "arrowLabel": "Proxmox predefinito"
+    },
+    "afterDiagram": "L'installatore rileva questo e scrive un drop-in a <codeXs>/etc/systemd/journald.conf.d/proxmenux-loglevel.conf</codeXs> aumentando sia <code>MaxLevelStore</code> che <code>MaxLevelSyslog</code> a <code>info</code>:",
+    "code": "[Journal]\nMaxLevelStore=info\nMaxLevelSyslog=info",
+    "outro": "Poi riavvia <code>systemd-journald</code>. Il drop-in viene rimosso su disinstallazione, ripristinando il default Proxmox originale."
+  },
+  "loggers": {
+    "heading": "Perché due servizi logger personalizzati",
+    "intro1": "Fail2Ban può leggere direttamente il journal systemd (<code>backend = systemd</code>), ma su Proxmox questo backend ha problemi noti con i processi worker di <code>pvedaemon</code>: gli eventi di autenticazione compaiono nel journal ma non sempre vengono rilevati. Il problema riguarda occasionalmente anche <code>sshd</code>.",
+    "intro2": "ProxMenux crea due piccoli servizi systemd che seguono le unità interessate con <code>journalctl -f</code> e aggiungono ogni riga a un file. Fail2Ban legge questi file con il backend affidabile <code>backend = auto</code> (modalità file):",
+    "headerService": "Servizio",
+    "headerSource": "Unità di origine",
+    "headerOutput": "File di uscita",
+    "rows": [
+      {
+        "service": "proxmox-auth-logger.service",
+        "source": "pvedaemon.service",
+        "output": "/var/log/proxmox-auth.log"
+      },
+      {
+        "service": "ssh-auth-logger.service",
+        "source": "ssh.service",
+        "output": "/var/log/ssh-auth.log"
+      }
+    ],
+    "outro": "Entrambi i servizi sono dichiarati <code>PartOf=fail2ban.service</code> in modo da riavviare con Fail2Ban e fermarsi con esso. Modalità 640 di proprietà di <code>root:adm</code> sui file di registro. Il terzo registro utilizzato dalla prigione <code>[proxmenux]</code> (<code>/var/log/proxmenux-auth.log</code>) è scritto direttamente dall'app ProxMenux Monitor Flask — nessun servizio logger necessario per questo."
+  },
+  "backend": {
+    "heading": "Auto-detezione backend Firewall",
+    "intro": "L'installatore sonda l'host: se <code>nft list ruleset</code> funziona, sceglie <code>nftables</code> come l'azione di divieto. In caso contrario torna a <code>iptables-multiport</code> / <code>iptables-allports</code>. La scelta è scritta in <code>jail.local</code>:",
+    "code": "# nftables host\nbanaction = nftables\nbanaction_allports = nftables[type=allports]\n\n# iptables host (fallback)\nbanaction = iptables-multiport\nbanaction_allports = iptables-allports"
+  },
+  "hardening": {
+    "heading": "Rafforzamento SSH: MaxAuthTries",
+    "intro": "Il controllo Lynis <strong>SSH-7408</strong> raccomanda <code>MaxAuthTries 3</code> in <code>sshd_config</code>. La jail SSH usa <code>maxretry = 2</code> per bloccare dopo errori ripetuti; MaxAuthTries limita i tentativi nella stessa connessione. Questa impostazione aggiunge protezione anche quando Fail2Ban è fermo per manutenzione.",
+    "installerIntro": "L'installatore:",
+    "items": [
+      "Legge il valore attuale di <code>MaxAuthTries</code> (o di default a 6 se assente).",
+      "Lo salva a <code>/usr/local/share/proxmenux/sshd_maxauthtries_backup</code>.",
+      "Modifica <code>sshd_config</code> direttamente: sostituisce la riga esistente, rimuove il commento dalla riga commentata o ne aggiunge una nuova.",
+      "Ricarica <code>sshd</code> senza riavviarlo, mantenendo attive le sessioni esistenti."
+    ],
+    "outro": "Su disinstallazione, il valore originale salvato viene ripristinato e <code>sshd</code> viene ricaricato di nuovo."
+  },
+  "manage": {
+    "heading": "Gestire un'installazione esistente",
+    "intro": "Se Fail2Ban è già installato, lo script lo rileva e mostra un menu di gestione invece di ripetere l'installazione.",
+    "headerAction": "Azione",
+    "headerWhat": "Che cosa fa",
+    "rows": [
+      {
+        "action": "Reinstallare",
+        "what": "Esegue nuovamente l'installazione completa e riscrive tutte le jail con i valori attuali di ProxMenux. Usalo quando un aggiornamento modifica le raccomandazioni."
+      },
+      {
+        "action": "Rimuovi",
+        "what": "Arresta fail2ban e i due servizi di logger, elimina il pacchetto apt, rimuove tutti i jail / file filtro, elimina il drop-in journald (ripristinando le impostazioni predefinite di Proxmox) e ripristina il SSH originale MaxAuthTries."
+      }
+    ]
+  },
+  "verify": {
+    "heading": "Verifica che funzioni.",
+    "intro": "Dopo l'installazione, comandi utili dall'host:",
+    "code": "# Service status and version\nsystemctl status fail2ban\nfail2ban-client --version\n\n# All active jails\nfail2ban-client status\n\n# Detail on one jail\nfail2ban-client status sshd\nfail2ban-client status proxmox\nfail2ban-client status proxmenux\n\n# Currently banned IPs in a jail\nfail2ban-client status sshd | grep \"Banned IP\"\n\n# Manually unban an IP (use this if you ban yourself)\nfail2ban-client unban 192.0.2.10\n\n# Tail the auth logs Fail2Ban watches\ntail -f /var/log/ssh-auth.log\ntail -f /var/log/proxmox-auth.log\ntail -f /var/log/fail2ban.log"
+  },
+  "troubleshoot": {
+    "heading": "Risoluzione dei problemi",
+    "neverBansTitle": "Fail2Ban corre ma non vieta mai nulla",
+    "neverBansBody": "Verifica che <code>tail -f /var/log/ssh-auth.log</code> riceva una voce dopo un tentativo SSH con password errata da un'altra macchina. Se rimane vuoto, controlla <code>systemctl status ssh-auth-logger.service</code>. Se il logger è attivo, consulta gli eventi recenti con <code>journalctl -u ssh.service -n 50 --no-pager -p info</code> e verifica che il drop-in journald consenta il livello <em>info</em>.",
+    "monitorEmptyTitle": "ProxMenux Monitor jail non ha voci anche dopo accessi non riusciti",
+    "monitorEmptyBody": "Il <code>[proxmenux]</code> jail legge <code>/var/log/proxmenux-auth.log</code>, che è scritto dall'app ProxMenux Monitor Flask - non da un logger journald. Se non esegui il Monitor, il file rimane vuoto e il jail non si attiva mai. Questo è previsto; la configurazione jail è innocua. Se esegui il Monitor e il registro è vuoto, controlla la configurazione di registrazione Flask.",
+    "selfBanTitle": "Ho bloccato il mio stesso accesso",
+    "selfBanIntro": "Da una console / IPMI / iKVM (o da un altro IP whitelist):",
+    "selfBanCode": "fail2ban-client unban '<'YOUR_IP'>'\n\n# To prevent it next time, edit /etc/fail2ban/jail.local and add your IP:\nignoreip = 127.0.0.1/8 ::1 192.168.1.0/24 203.0.113.42\n\n# Then reload\nfail2ban-client reload",
+    "aptFailTitle": "apt-get non riesce: ''Unable to locate package fail2ban''",
+    "aptFailBody": "L'host manca il repos Debian (comune sulle installazioni di Barebones Proxmox). L'installatore rileva questo e scrive <code>/etc/apt/sources.list.d/debian.sources</code> con il nome giusto in codice (<code>bookworm</code> / <code>trixie</code>) prima di riprovare. Se non riesce ancora, controllare <code>/etc/os-release</code> per <code>VERSION_CODENAME</code> e confermare che l'URL repo è raggiungibile.",
+    "lockoutTitle": "SSH mi blocca dopo l'installazione",
+    "lockoutBody": "L'installatore imposta <code>MaxAuthTries=3</code>. Se il tuo password manager / agente richiama più chiavi, puoi superarlo su un singolo tentativo di connessione. Limitare le chiavi offerte: <code>ssh -o IdentitiesOnly=yes -i ~/.ssh/specific_key user@host</code>. O sollevare temporaneamente <code>MaxAuthTries</code> in <code>sshd_config</code> mentre si debug."
+  },
+  "files": {
+    "heading": "File scritti",
+    "code": "/etc/fail2ban/jail.local                              # global defaults + [sshd]\n/etc/fail2ban/jail.d/proxmox.conf                     # [proxmox]\n/etc/fail2ban/jail.d/proxmenux.conf                   # [proxmenux]\n/etc/fail2ban/filter.d/proxmox.conf                   # auth-failure regex for pvedaemon\n/etc/fail2ban/filter.d/proxmenux.conf                 # auth-failure regex for Monitor\n/etc/systemd/system/proxmox-auth-logger.service       # journal → file (pvedaemon)\n/etc/systemd/system/ssh-auth-logger.service           # journal → file (sshd)\n/etc/systemd/journald.conf.d/proxmenux-loglevel.conf  # MaxLevelStore=info\n/etc/ssh/sshd_config                                  # MaxAuthTries=3 (in-place edit)\n/var/log/proxmox-auth.log                             # written by logger service\n/var/log/ssh-auth.log                                 # written by logger service\n/var/log/proxmenux-auth.log                           # written by Monitor Flask app\n/usr/local/share/proxmenux/sshd_maxauthtries_backup   # for restore on uninstall"
+  },
+  "related": {
+    "heading": "Correlati",
+    "monitorLabel": "ProxMenux Monitor → Scheda di sicurezza",
+    "monitorTail": " — installazione dal pannello, stato delle jail in tempo reale, IP bloccati e regolazione di tentativi e durata del blocco per ogni jail dal browser.",
+    "lynisLabel": "Lynis",
+    "lynisTail": " — esegui un audit prima e dopo per verificare che il controllo SSH-7408 sia soddisfatto.",
+    "securityLabel": "Panoramica della sicurezza",
+    "securityTail": "— di nuovo alla panoramica della sezione."
+  }
+}
diff --git a/web/messages/it/docs/security/index.json b/web/messages/it/docs/security/index.json
new file mode 100644
index 00000000..2f7f44be
--- /dev/null
+++ b/web/messages/it/docs/security/index.json
@@ -0,0 +1,70 @@
+{
+  "meta": {
+    "title": "Sicurezza Proxmox — Fail2Ban e audit di rafforzamento Lynis | ProxMenux",
+    "description": "Due strumenti di sicurezza installabili per Proxmox VE: Fail2Ban (prevenzione delle intrusioni per SSH, interfaccia web Proxmox e ProxMenux Monitor) e Lynis (analisi della sicurezza e del rafforzamento del sistema, installato dal repository ufficiale GitHub).",
+    "ogTitle": "Sicurezza Proxmox — Fail2Ban e audit di rafforzamento Lynis",
+    "ogDescription": "Fail2Ban e Lynis per Proxmox VE: prevenzione delle intrusioni e audit di rafforzamento, installati e gestiti da ProxMenux.",
+    "twitterTitle": "Sicurezza Proxmox | ProxMenux",
+    "twitterDescription": "Fail2Ban e Lynis per Proxmox VE: prevenzione delle intrusioni e audit di rafforzamento."
+  },
+  "header": {
+    "title": "Sicurezza",
+    "description": "Due strumenti complementari per Proxmox VE: difesa attiva (Fail2Ban blocca gli IP che attaccano SSH o le interfacce web) e audit locale (Lynis cerca lacune nel rafforzamento e assegna un punteggio da 0 a 100). Ognuno ha un menu di installazione e gestione che rileva installazioni esistenti prima di ogni azione.",
+    "section": "Sicurezza"
+  },
+  "intro": {
+    "title": "Difesa attiva e audit locale",
+    "body": "Rispondono a domande diverse. <strong>Fail2Ban</strong> risponde a <em>«Ci stanno attaccando ora?»</em> monitorando i log di autenticazione e bloccando gli IP responsabili. <strong>Lynis</strong> risponde a <em>«Quanto è rafforzata la sicurezza di questo host?»</em> con un audit singolo e raccomandazioni concrete. Usali insieme: Lynis indica cosa migliorare e Fail2Ban reagisce agli attacchi in corso."
+  },
+  "opening": {
+    "heading": "Apertura del menu",
+    "body": "Dal menu principale di ProxMenux seleziona <strong>Sicurezza</strong>. Vedrai questo:",
+    "imageAlt": "Menu di sicurezza con opzioni Fail2Ban e Lynis"
+  },
+  "pick": {
+    "heading": "Scegli il tuo strumento",
+    "body": "I due strumenti di sicurezza sono indipendenti — installare uno, entrambi, o nessuno. Ogni scheda qui sotto salta alla sezione che spiega lo strumento in dettaglio."
+  },
+  "cards": {
+    "fail2ban": {
+      "title": "Fail2Ban",
+      "body": "Prevenzione attiva delle intrusioni. Controlla i log di autenticazione SSH e web e blocca gli IP dopo errori ripetuti.",
+      "bullets": [
+        "Tre jails: SSH, Proxmox UI (8006), ProxMenux Monitor (8008)",
+        "Corregge le impostazioni predefinite di Proxmox journald che bloccano i registri di autenticazione",
+        "Rilevamento automatico nftables / iptables",
+        "Indurimento SSH: MaxAuthTries=3 (Consiglio di Lynis)"
+      ]
+    },
+    "lynis": {
+      "title": "Lynis",
+      "body": "Auditor locale di sicurezza. Analizza l'host e mostra un punteggio di rafforzamento e suggerimenti concreti per correggere i problemi.",
+      "bullets": [
+        "Installato dal repository ufficiale CISOfy su GitHub (versione più recente)",
+        "Punteggio di rafforzamento 0–100 ed elenco di avvisi e suggerimenti",
+        "Audit e aggiornamento dal menu",
+        "Progettato in sola lettura: non modifica mai il sistema"
+      ]
+    }
+  },
+  "workflowTip": {
+    "title": "Flusso di lavoro che utilizza entrambi",
+    "body": "Esegui prima Lynis per vedere il punteggio iniziale e le raccomandazioni principali. Applica le correzioni desiderate. Poi installa Fail2Ban: implementa automaticamente la protezione SSH contro la forza bruta e regola <code>MaxAuthTries</code> in <code>sshd_config</code> per soddisfare il controllo SSH-7408. Esegui di nuovo Lynis per verificare il miglioramento."
+  },
+  "fail2banSection": {
+    "heading": "Fail2Ban",
+    "body": "ProxMenux installa Fail2Ban con una configurazione specifica per Proxmox. Oltre alla jail SSH standard protegge l'interfaccia web Proxmox e ProxMenux Monitor. Aggira due problemi specifici: un'impostazione journald che scarta gli eventi di autenticazione e un problema del backend systemd che impedisce la lettura affidabile di alcune fonti del registro. La pagina dettagliata spiega installazione, tre jail, correzione di journald, rafforzamento SSH e risoluzione dei problemi.",
+    "optionTitle": "Fail2Ban — installazione e gestione",
+    "optionDescription": "Tre jail preconfigurate (sshd aggressivo, interfaccia Proxmox su 8006, ProxMenux Monitor su 8008 e proxy inverso), rilevamento di nftables/iptables, correzione di journald e rafforzamento SSH con MaxAuthTries."
+  },
+  "lynisSection": {
+    "heading": "Lynis",
+    "body": "ProxMenux clona Lynis da <code>github.com/CISOfy/lynis</code> in <code>/opt/lynis</code> e lo rende disponibile come <code>/usr/local/bin/lynis</code>. Evita il pacchetto Debian perché è indietro di diverse versioni principali rispetto al progetto originale. La pagina dettagliata spiega installazione, audit, aggiornamento, disinstallazione, lettura del rapporto e azioni sui risultati.",
+    "optionTitle": "Lynis — installazione, audit e gestione",
+    "optionDescription": "Installa l'ultimo Lynis dal repo ufficiale CISOfy GitHub (non il vecchio pacchetto Debian), esegue controlli di sistema con punteggio di indurimento e aggiornamenti tramite git pull."
+  },
+  "componentStatus": {
+    "heading": "Stato del componente",
+    "body": "Entrambi gli installatori registrano il loro stato in <code>/usr/local/share/proxmenux/components_status.json</code> sotto la categoria <code>security</code>. ProxMenux utilizza questo file per decidere se mostrare l'installazione o il menu di gestione delle operazioni successive, e gli stessi dati alimentano le dashboard nel ProxMenux Monitor quando presente."
+  }
+}
diff --git a/web/messages/it/docs/security/lynis.json b/web/messages/it/docs/security/lynis.json
new file mode 100644
index 00000000..35cc85c1
--- /dev/null
+++ b/web/messages/it/docs/security/lynis.json
@@ -0,0 +1,170 @@
+{
+  "meta": {
+    "title": "Lynis | Documentazione ProxMenux",
+    "description": "Installa la versione più recente di Lynis dal repository ufficiale CISOfy su GitHub, esegui un audit con punteggio di rafforzamento 0–100 e aggiorna tramite git pull. Auditor in sola lettura: non modifica il sistema.",
+    "ogTitle": "Lynis | Documentazione ProxMenux",
+    "ogDescription": "Installa ed esegui Lynis su Proxmox VE. Installazione dal repository originale GitHub, audit e aggiornamento."
+  },
+  "header": {
+    "title": "Lynis",
+    "description": "Clona la versione più recente di Lynis dal repository ufficiale CISOfy su GitHub, la rende disponibile come /usr/local/bin/lynis e offre audit, aggiornamento, reinstallazione e disinstallazione dal menu. L'analisi è in sola lettura: produce rapporti senza modificare il sistema.",
+    "section": "Sicurezza"
+  },
+  "intro": {
+    "title": "Cosa fa",
+    "body": "Installa Lynis, auditor di sicurezza open source di CISOfy, dal repository GitHub in <code>/opt/lynis</code> e crea un lanciatore in <code>/usr/local/bin/lynis</code> per renderlo disponibile nel <code>PATH</code>. Se rileva una installazione esistente, mostra un menu per audit, aggiornamento, reinstallazione o rimozione."
+  },
+  "manageMenu": {
+    "heading": "Menu di gestione (dopo l'installazione)",
+    "intro": "Una volta che Lynis è installato, ogni successiva invocazione apre il menu di gestione invece di rifare l'installatore. Da qui si avvia un audit, si aggiorna tramite git pull, reinstalla o disinstalla:",
+    "imageAlt": "Menù di gestione Lynis con controllo, aggiornamento, reinstallare e rimuovere le opzioni"
+  },
+  "whyUpstream": {
+    "heading": "Perché il repository ufficiale GitHub invece di apt",
+    "intro": "Debian distribuisce Lynis tramite apt, ma il pacchetto è spesso indietro di diverse versioni principali. Nuovi controlli, correzioni per nuovi vettori di attacco e raccomandazioni migliorate arrivano prima su GitHub. Lynis è uno script shell autonomo, senza compilazione e senza dipendenze di installazione oltre a <code>git</code>; clonare il repository è quindi il metodo raccomandato da CISOfy.",
+    "headerSource": "Fonte",
+    "headerPath": "Install path",
+    "headerUpdate": "Metodo di aggiornamento",
+    "headerFresh": "Aggiornamento della versione",
+    "rows": [
+      {
+        "sourceRich": "<strong>ProxMenux (questo script)</strong>",
+        "path": "/opt/lynis/",
+        "update": "git pull (dal menu)",
+        "fresh": "Ultima versione del progetto originale"
+      },
+      {
+        "sourceRich": "<strong>Debian apt</strong>",
+        "path": "/usr/bin/lynis",
+        "update": "apt upgrade",
+        "fresh": "Spesso mesi / anni dietro"
+      }
+    ]
+  },
+  "install": {
+    "heading": "Come funziona l'installazione",
+    "node1Label": "github.com/CISOfy/lynis",
+    "node1Detail": "git clone\n(installa prima git se manca)",
+    "node2Label": "/opt/lynis/",
+    "node2Detail": "repository completo\nincluso lo script ./lynis",
+    "node3Label": "/usr/local/bin/lynis",
+    "node3Detail": "wrapper:\ncd /opt/lynis && ./lynis $@",
+    "outro": "Il wrapper è obbligatorio — Lynis insiste per essere eseguito dalla propria directory perché carica percorsi relativi per plugin e dati del profilo. L'involucro nasconde quel dettaglio così <code>lynis audit system</code> funziona da qualsiasi luogo."
+  },
+  "detection": {
+    "heading": "Sentieri di rilevamento",
+    "intro": "Prima di mostrare il menu, lo script controlla tre posizioni per decidere se Lynis è già presente:",
+    "items": [
+      "<code>/usr/local/bin/lynis</code> — wrapper installato da ProxMenux",
+      "<code>/opt/lynis/lynis</code> — percorso diretto (nel caso in cui l'involucro sia stato rimosso)",
+      "<code>/usr/bin/lynis</code> — versione apt-installata, se l'utente l'ha installato in quel modo prima"
+    ],
+    "outro": "Se trova uno di questi percorsi apre il menu di gestione. Lo script <strong>non</strong> disinstalla Lynis installato con apt; rimuove solo quello gestito in <code>/opt/lynis</code> e il relativo lanciatore."
+  },
+  "audit": {
+    "heading": "Eseguire un audit",
+    "intro": "Dal menu di gestione scegli <strong>Esegui audit di sicurezza ora</strong>. Equivale a eseguire:",
+    "code": "lynis audit system --no-colors",
+    "outro": "L'audit richiede da 30 secondi ad alcuni minuti secondo le dimensioni dell'host. Lo output viene mostrato direttamente nel terminale, senza animazione di attesa. Lynis organizza i controlli per categoria e marca ogni test come <ok>[ OK ]</ok>, <warn>[ WARNING ]</warn> o <sugg>[ SUGGESTION ]</sugg>. Il riepilogo finale mostra i dati principali:",
+    "summary": "================================================================================\n\n  Lynis security scan details:\n\n  Hardening index : 76 [############        ]\n  Tests performed : 247\n  Plugins enabled : 0\n\n  Components:\n  - Firewall               [V]\n  - Malware scanner        [X]\n\n  Lynis modules:\n  - Compliance status      [?]\n  - Security audit         [V]\n  - Vulnerability scan     [V]\n\n================================================================================"
+  },
+  "report": {
+    "heading": "Leggere il rapporto",
+    "intro": "Le due sezioni importanti sono <strong>Warnings</strong> (le cose che si devono risolvere presto) e <strong>Suggestions</strong> (raccomandazioni per migliorare l'indurimento). Ogni elemento porta un ID di controllo come <code>SSH-7408</code> — utile quando si cerca i documenti Lynis per la razionalità e la correzione.",
+    "headerMarker": "Marcatore",
+    "headerMeaning": "Significato",
+    "headerAction": "Azione",
+    "rows": [
+      {
+        "markerRich": "<strong>OK</strong>",
+        "meaning": "Test superato",
+        "action": "Niente."
+      },
+      {
+        "markerRich": "<strong>WARNING</strong>",
+        "meaning": "Problema reale, fix consigliato",
+        "action": "Leggi la descrizione del controllo, pianifica una correzione"
+      },
+      {
+        "markerRich": "<strong>SUGGESTION</strong>",
+        "meaning": "Miglioramento dell'indurimento disponibile",
+        "action": "Applica se adatto al modello di minaccia"
+      }
+    ],
+    "outro": "Il rapporto completo e i dati leggibili dalla macchina sono scritti a <code>/var/log/lynis.log</code> e <code>/var/log/lynis-report.dat</code> da Lynis stesso."
+  },
+  "pairFail2ban": {
+    "title": "Combina con Fail2Ban",
+    "body": "SSH-7408 (MaxAuthTries) è uno degli avvisi più comuni. Installazione di <link>Fail2Ban</link> da ProxMenux lo sgombera automaticamente perché l'installatore imposta <code>MaxAuthTries=3</code> come parte della sua fase di indurimento SSH. Eseguire Lynis di nuovo dopo per confermare che l'avvertimento è andato."
+  },
+  "update": {
+    "heading": "Aggiornamento Lynis",
+    "body": "Nel menu, <strong>Aggiorna Lynis all'ultima versione</strong> esegue <code>git pull --quiet</code> in <code>/opt/lynis</code>. Se la directory esiste ma non è una copia di lavoro Git, per esempio dopo una copia manuale dei file, lo script esegue una reinstallazione completa."
+  },
+  "reinstall": {
+    "heading": "Reinstallare / disinstallare",
+    "headerAction": "Azione",
+    "headerWhat": "Che cosa fa",
+    "rows": [
+      {
+        "actionRich": "<strong>Reinstalla</strong>",
+        "whatRich": "Rimuove <code>/opt/lynis</code>, clona nuovamente da GitHub e ricrea il lanciatore. Usalo se la copia locale è danneggiata."
+      },
+      {
+        "actionRich": "<strong>Rimuovi</strong>",
+        "whatRich": "Elimina <code>/opt/lynis</code> e <code>/usr/local/bin/lynis</code>. I registri a <code>/var/log/lynis*</code> sono mantenuti (sono storia dell'audit). Un Lynis apt-installed a <code>/usr/bin/lynis</code> è lasciato intatto."
+      }
+    ]
+  },
+  "cli": {
+    "heading": "Opzioni utili CLI",
+    "intro": "Una volta installato, Lynis può essere invocata direttamente da una shell con opzioni extra non esposte dal menu:",
+    "code": "lynis show version            # version + build date\nlynis show commands           # list every available command\nlynis show details TEST-ID    # explain a specific control\nlynis audit system --quick    # skip slow tests (e.g. malware scan)\nlynis audit system --pentest  # treat host as untrusted (more aggressive)\nlynis update info             # check if a newer Lynis is available\n\n# Filter the report log for just the warnings\ngrep \"Warning\" /var/log/lynis.log\n\n# Same, for suggestions only\ngrep \"Suggestion\" /var/log/lynis.log"
+  },
+  "troubleshoot": {
+    "heading": "Risoluzione dei problemi",
+    "cloneTitle": "git clone non riesce durante l'installazione",
+    "cloneBody": "L'host ha bisogno di accesso alla rete e DNS per raggiungere <code>github.com</code>. Da una console: <code>curl -sI https://github.com</code> e <code>git ls-remote https://github.com/CISOfy/lynis.git</code> riveleranno l'errore effettivo (DNS, TLS, proxy, repo URL). Se è richiesto un proxy, impostare <code>https_proxy</code> nell'ambiente prima di ri-inviare il menu.",
+    "notFoundTitle": "lynis: comando non trovato dopo l'installazione",
+    "notFoundIntro": "L'involucro a <code>/usr/local/bin/lynis</code> non è stato creato o rimosso. Correzione più rapida: reinstallare dal menu. Correzione manuale:",
+    "notFoundCode": "cat > /usr/local/bin/lynis <<'EOF'\n#!/bin/bash\ncd /opt/lynis && ./lynis \"$@\"\nEOF\nchmod +x /usr/local/bin/lynis",
+    "sshTitle": "L'audit mostra \"Warning: Test SSH-7408 — MaxAuthTries set incorrectly\"",
+    "sshIntro": "Il daemon SSH consente troppi tentativi auth per connessione. Installare <link>Fail2Ban</link> da ProxMenux (che imposta automaticamente <code>MaxAuthTries=3</code>) o modificare <code>/etc/ssh/sshd_config</code> a mano:",
+    "sshCode": "sed -i 's/^#?MaxAuthTries.*/MaxAuthTries 3/' /etc/ssh/sshd_config\nsystemctl reload sshd",
+    "scoreTitle": "Score è andato giù dopo un aggiornamento Proxmox",
+    "scoreBody": "Eseguire <code>lynis update info</code> prima — un aggiornamento Lynis potrebbe aver aggiunto nuovi controlli che contrassegnano la configurazione esistente. Aggiornare Lynis dal menu, ri-audit e affrontare i nuovi risultati."
+  },
+  "files": {
+    "heading": "File scritti",
+    "code": "/opt/lynis/                   # full Lynis git checkout\n/usr/local/bin/lynis          # wrapper script (cd + exec)\n/var/log/lynis.log            # human-readable audit log (Lynis itself)\n/var/log/lynis-report.dat     # machine-readable report (Lynis itself)"
+  },
+  "sample": {
+    "heading": "Rapporto di esempio",
+    "intro": "ProxMenux Monitor genera per ogni esecuzione di Lynis un PDF multipagina dalla <link>scheda Sicurezza</link>. La prima pagina riepiloga punteggio di rafforzamento, informazioni di sistema e stato della sicurezza. Le successive spiegano ogni avviso, elencano i suggerimenti per impatto e includono l'inventario dei pacchetti usato nell'audit.",
+    "imageAlt": "Prima pagina del Lynis Security Audit Report PDF — Riepilogo esecutivo con Hardening Index 71/100, blocco informazioni di sistema e panoramica della postura di sicurezza con firewall, malware scanner e pacchetti installati conteggio",
+    "captionPrefix": "Prima pagina di un rapporto campione. Il PDF completo (",
+    "captionLink": "campione",
+    "captionSuffix": ") continua con avvisi dettagliati, suggerimenti e la lista dei pacchetti installati.",
+    "cli": "Sul lato CLI gli stessi dati sono in <code>/var/log/lynis-report.dat</code> (file piatto leggibile dalla macchina) e <code>/var/log/lynis.log</code> (il registro di esecuzione leggibile dall'uomo). Il PDF viene generato su richiesta da ProxMenux Monitor — l'esecuzione di <code>lynis</code> dalla riga di comando non ne produce uno."
+  },
+  "related": {
+    "heading": "Correlati",
+    "items": [
+      {
+        "href": "/docs/monitor/dashboard/security",
+        "label": "ProxMenux Monitor → Scheda di sicurezza",
+        "tail": "— eseguire l'audit, sfogliare i rapporti storici e scaricare il PDF direttamente dal cruscotto."
+      },
+      {
+        "href": "/docs/security/fail2ban",
+        "label": "Fail2Ban",
+        "tailRich": " — attua il SSH protezione brute-force che Lynis raccomanda."
+      },
+      {
+        "href": "/docs/security",
+        "label": "Panoramica della sicurezza",
+        "tail": "— di nuovo alla panoramica della sezione."
+      }
+    ]
+  }
+}
diff --git a/web/messages/it/docs/security/ssl-letsencrypt.json b/web/messages/it/docs/security/ssl-letsencrypt.json
new file mode 100644
index 00000000..19f7938b
--- /dev/null
+++ b/web/messages/it/docs/security/ssl-letsencrypt.json
@@ -0,0 +1,169 @@
+{
+  "meta": {
+    "title": "HTTPS per ProxMenux Monitor — certificato dell'host Proxmox o percorsi personalizzati | ProxMenux",
+    "description": "Fornisce ProxMenux Monitor via HTTPS con il certificato dell'host Proxmox (rilevato automaticamente, incluso quello Let’s Encrypt installato tramite ACME di Proxmox) o con un certificato personalizzato in qualsiasi percorso sul disco.",
+    "ogTitle": "HTTPS per ProxMenux Monitor — Host Proxmox o certificato personalizzato",
+    "ogDescription": "Abilitare HTTPS sulla porta 8008 con il certificato host Proxmox o qualsiasi coppia di .pem / .key personalizzata."
+  },
+  "header": {
+    "title": "HTTPS per ProxMenux Monitor",
+    "description": "Attiva HTTPS per Monitor sulla porta 8008 con il certificato dell'host Proxmox rilevato automaticamente o uno personalizzato sul disco. L'opzione Proxmox preferisce il certificato ACME, se presente, e riutilizza Let’s Encrypt gestito da Proxmox senza un'ulteriore attività di rinnovo.",
+    "section": "Sicurezza"
+  },
+  "intro": {
+    "title": "Che cosa questa pagina copre",
+    "body": "Come cambiare il Monitor da HTTP a HTTPS nel pannello Impostazioni → Sicurezza, ciò che ogni fonte di certificato indica effettivamente sul disco, come l'opzione Proxmox si comporta quando l'host ha un cert Let's Encrypt e come impostare percorsi personalizzati se si gestisce certs al di fuori di Proxmox."
+  },
+  "wheresetting": {
+    "heading": "Dove si trova l'impostazione",
+    "body": "Apri Monitor e vai in <strong>Impostazioni → Sicurezza → HTTPS / SSL</strong>. Il pannello mostra HTTP o HTTPS e, se HTTPS non è attivo, le fonti di certificato rilevate.",
+    "imageAlt": "Impostazioni → Sicurezza → HTTPS / Pannello SSL nel Monitor che mostra lo stato HTTPS-off, il certificato Proxmox auto-determinato (soggetto, emittente, scadenza) e l'opzione Usa Certificato personalizzato",
+    "caption": "Pannello Impostazioni → Sicurezza → HTTPS / SSL prima dell'attivazione. Monitor mostra il certificato usato da Proxmox e permette di sceglierlo con un clic."
+  },
+  "twoways": {
+    "heading": "Due modi per abilitare HTTPS",
+    "proxmox": {
+      "title": "Usa certificato Proxmox",
+      "summary": "Un clic: Monitor riutilizza il certificato presentato da Proxmox VE sulla porta 8006.",
+      "items": [
+        "Rilevato automaticamente, nessun percorso da digitare",
+        "Preferisce il certificato ACME se presente, altrimenti quello autofirmato predefinito",
+        "Proxmox gestisce il rinnovo; Monitor convalida e carica il certificato alla prossima nuova connessione TLS"
+      ]
+    },
+    "custom": {
+      "title": "Usa certificato personalizzato",
+      "summaryRich": "Puntare il Monitor su una coppia <code>.pem</code> / <code>.key</code> ovunque sul disco.",
+      "items": [
+        "Solo percorsi assoluti (il processo Monitor deve essere in grado di leggere entrambi)",
+        "Utile quando i cert vengono da <code>certbot</code>, <code>acme.sh</code> o una wildcard",
+        "Gestisci tu il rinnovo: riavvia Monitor quando cambiano i file"
+      ]
+    }
+  },
+  "proxmoxCert": {
+    "heading": "Certificato di Proxmox — ciò che effettivamente indica",
+    "intro": "Proxmox VE mantiene due coppie di certificati in <code>/etc/pve/local/</code>:",
+    "table": {
+      "headers": {
+        "file": "File",
+        "origin": "Origine",
+        "when": "Quando il Monitor lo usa"
+      },
+      "rows": [
+        {
+          "fileRich": "<code>pveproxy-ssl.pem</code><br /><code>pveproxy-ssl.key</code>",
+          "originRich": "Certificato personalizzato caricato tramite l'UI Proxmox — compreso il certificato Let's Encrypt rilasciato sotto <em>Datacenter → Nodo → Certificati → ACME</em>.",
+          "when": "Preferito se entrambi i file esistono; Monitor usa il certificato presentato da Proxmox."
+        },
+        {
+          "fileRich": "<code>pve-ssl.pem</code><br /><code>pve-ssl.key</code>",
+          "originRich": "Certificato autofirmato generato al momento di installazione dal Proxmox PKI.",
+          "whenRich": "Fallback quando non è presente nessun <code>pveproxy-ssl.pem</code>."
+        }
+      ]
+    },
+    "callout": {
+      "title": "Stessa priorità di Proxmox stesso",
+      "bodyRich": "<code>pveproxy</code> applica la stessa selezione: scegliendo Proxmox, Monitor usa il certificato presentato dall'interfaccia Proxmox su 8006, senza copie né un processo di rinnovo separato."
+    }
+  },
+  "letsencrypt": {
+    "heading": "Ottenere un certificato Let's Encrypt tramite Proxmox ACME",
+    "intro": "Proxmox VE include un client ACME. <em>«Order Certificate Now»</em> salva il risultato in <code>/etc/pve/local/pveproxy-ssl.pem</code>, letto da Monitor. I cinque passi seguenti riassumono la <extlink1>guida ufficiale Proxmox</extlink1> nei comandi necessari.",
+    "prereqs": {
+      "title": "Prerequisiti",
+      "items": [
+        "Il nodo ha un vero nome DNS (non solo un IP) che indica.",
+        "<strong>O</strong> porta 80 raggiungibile da Internet (verifica HTTP-01, la più semplice), <strong>oppure</strong> un provider DNS con credenziali API (DNS-01, funziona dietro NAT e supporta wildcard).",
+        "Un indirizzo email per l'account ACME."
+      ]
+    },
+    "step1": {
+      "heading": "Passo 1 — Registrare l'account ACME",
+      "introRich": "Sostituisci l'email con il tuo. Il nome dell'account <code>default</code> è solo un'etichetta — è possibile utilizzare qualsiasi stringa.",
+      "code": "pvenode acme account register default you@example.com",
+      "afterRich": "Proxmox chiede di accettare i termini di servizio Let's Encrypt. Dopo di che l'account è persistito sotto <code>/etc/pve/priv/acme/</code> e la scheda ACME nella GUI lo mostrerà."
+    },
+    "step2": {
+      "heading": "Passo 2 — Scegli un tipo di sfida",
+      "http01Rich": "<strong>HTTP-01</strong> è il più semplice: è costruito in, nessun plugin aggiuntivo. Let's Encrypt si collega a <code>http://&lt;your-host&gt;/.well-known/acme-challenge/...</code> sulla porta 80, quindi la porta 80 deve essere aperta da internet pubblico al nodo — tipicamente una porta avanti sul router.",
+      "dns01Rich": "<strong>DNS-01</strong> funziona senza esporre la porta 80 (buona per le homelab dietro CG-NAT) ed è l'unica opzione per i certificati jolly. Aggiungi un plugin DNS una volta con il token API del tuo fornitore. Esempio Cloudflare:",
+      "code": "pvenode acme plugin add dns cf \\\n  --api cloudflare \\\n  --data CF_Token=YOUR_CLOUDFLARE_API_TOKEN",
+      "outroRich": "Per altri provider (Gandi, OVH, AWS Route 53, ecc.) consulta <code>pvenode acme plugin add dns --help</code>. Proxmox include <extlink2>tutti i plugin DNS di acme.sh</extlink2>."
+    },
+    "step3": {
+      "heading": "Passo 3 — Legare il dominio al nodo",
+      "http01Rich": "Per HTTP-01 (utilizza il plugin <code>standalone</code> integrato):",
+      "code1": "pvenode config set --acme domains=host.example.com,account=default",
+      "dns01": "Per DNS-01 con il plugin Cloudflare di Step 2:",
+      "code2": "pvenode config set --acmedomain0 domain=host.example.com,plugin=cf\npvenode config set --acme account=default",
+      "wildcardRich": "Certificato wildcard? Aggiungi <code>domain=*.example.com</code> in una voce separata <code>--acmedomainN</code>. I certificati wildcard richiedono DNS-01."
+    },
+    "step4": {
+      "heading": "Passo 4 — Ordinare il certificato",
+      "code": "pvenode acme cert order",
+      "afterRich": "La prima esecuzione richiede tipicamente 30–60 secondi mentre la sfida si propaga. Su successo Proxmox scrive <code>/etc/pve/local/pveproxy-ssl.pem</code> + <code>.key</code>, riavvia <code>pveproxy</code>, e un cron di rinnovo è programmato automaticamente (Let's Encrypt certs sono validi 90 giorni; Proxmox rinnova a 60)."
+    },
+    "step5": {
+      "heading": "Passo 5 — Verificare l'emittente",
+      "code": "openssl x509 -in /etc/pve/local/pveproxy-ssl.pem -noout -issuer",
+      "afterRich": "Dovrebbe stampare un emittente a partire da <code>O = Let's Encrypt</code>. Se invece legge <code>CN = Proxmox Virtual Environment</code> l'ordine non è riuscito e il file è ancora l'auto-firmato PVE cert — eseguire <code>pvenode acme cert order --debug 1</code> per vedere perché."
+    },
+    "gui": {
+      "title": "Preferisci la GUI? Stessi cinque passi",
+      "bodyRich": "<em>Datacenter → ACME</em> registra l'account; <em>Datacenter → ACME → Plugins</em> aggiunge il plugin DNS; <em>Node → Certificates → ACME</em> associa il dominio; <em>Order Certificates Now</em> esegue il passo 4. I comandi precedenti sono utili per script e sistemi senza interfaccia grafica."
+    }
+  },
+  "switchToHttps": {
+    "heading": "Passare il Monitor a HTTPS",
+    "bodyRich": "Quando <code>/etc/pve/local/pveproxy-ssl.pem</code> è firmato da Let's Encrypt, apri <strong>Impostazioni → Sicurezza → HTTPS / SSL</strong>, verifica che l'emittente sia <em>Let's Encrypt</em> e non la CA locale Proxmox, poi fai clic su <strong>Usa certificato Proxmox</strong>. Monitor si riavvia e il caricamento successivo usa HTTPS su 8008 con una catena pubblicamente attendibile. I rinnovi ACME successivi sono convalidati e selezionati alla prossima nuova connessione TLS, senza controlli periodici né riavvio al rinnovo. <strong>Aggiorna certificato</strong> rimane disponibile in Sicurezza per diagnosi e recupero."
+  },
+  "custom": {
+    "heading": "Certificato personalizzato — quando utilizzarlo",
+    "intro": "Fai clic su <strong>Usa certificato personalizzato</strong> e inserisci due percorsi assoluti:",
+    "items": [
+      "<strong>Certificato</strong>: catena completa in PEM (<code>.pem</code> o <code>.crt</code>).",
+      "<strong>Chiave privata</strong>: chiave corrispondente in PEM (<code>.key</code>)."
+    ],
+    "outro": "Entrambi i file sono letti dal processo Monitor all'avvio. Assicurarsi che rimangano leggibili dall'utente l'unità systemd viene eseguita come (root per impostazione predefinita). Località comuni quando ACME è gestito fuori Proxmox:",
+    "code": "# certbot\n/etc/letsencrypt/live/<your-host>/fullchain.pem\n/etc/letsencrypt/live/<your-host>/privkey.pem\n\n# acme.sh\n~/.acme.sh/<your-host>_ecc/fullchain.cer\n~/.acme.sh/<your-host>_ecc/<your-host>.key",
+    "symlinkCallout": {
+      "title": "Obiettivi Symlink vs. file",
+      "bodyRich": "<code>certbot</code> memorizza i file reali in <code>/etc/letsencrypt/archive/</code> e il percorso <code>live/</code> è un symlink. Indirizzi il Monitor al simlink <code>live/</code>, non il file <code>archive/</code> — in questo modo ogni ciclo di rinnovo semplicemente riscrive l'obiettivo di symlink e il Monitor raccoglie il nuovo cert all'inizio del servizio successivo."
+    }
+  },
+  "afterHttps": {
+    "heading": "Dopo aver attivato HTTPS",
+    "bodyRich": "Salvataggio del cambiamento scrive <code>/etc/proxmenux/ssl_config.json</code> e attiva un riavvio dell'unità <code>proxmenux-monitor</code> systemd. La scheda del browser perderà la sua connessione corrente — ricaricarla su <code>https://&lt;host&gt;:8008/</code>. Il primo carico con un cert Let's Encrypt non dovrebbe mostrare alcun avvertimento; con il Proxmox auto-firmato cert il browser richiederà un'eccezione, la stessa che per la porta 8006.",
+    "reverse": {
+      "heading": "Proxy inversi e webhook",
+      "bodyRich": "Quando il Monitor passa a HTTPS, gli URL Proxmox VE webhook registrati per le notifiche girano automaticamente da <code>http://</code> a <code>https://</code>. Le voci webhook esistenti vengono riscritte la prossima volta che viene salvata o ri-detetta una regola di notifica, quindi non è necessaria alcuna modifica manuale della configurazione di notifica Proxmox."
+    }
+  },
+  "trustCa": {
+    "heading": "Considerare attendibile la CA autofirmata di Proxmox",
+    "intro1Rich": "Per mantenere il certificato predefinito Proxmox senza ACME, importa la CA radice del cluster nell'archivio di fiducia del sistema o del browser. Monitor rileva <code>/etc/pve/local/pve-ssl.pem</code> come certificato alternativo. Il client considera attendibile l'emittente; l'URL deve comunque corrispondere a un nome del certificato.",
+    "intro2Rich": "Il file CA vive a <code>/etc/pve/pve-root-ca.pem</code> su ogni nodo. In un cluster il percorso è sul filesystem <code>pmxcfs</code> condiviso in modo che tutti i nodi condividono la stessa radice, e una singol'importazione copre l'intero datacenter. Copialo sulla tua macchina:",
+    "code": "scp root@<your-host>:/etc/pve/pve-root-ca.pem ./pve-root-ca.pem",
+    "thenImport": "Poi importarlo sul lato cliente:",
+    "items": [
+      "<strong>Linux (intero sistema):</strong> esegui <code>sudo cp pve-root-ca.pem /usr/local/share/ca-certificates/pve-root-ca.crt</code> e poi <code>sudo update-ca-certificates</code>. I browser che usano l'archivio di sistema (Chromium, Edge) riconoscono la CA dopo il riavvio; Firefox usa un archivio proprio e richiede l'importazione manuale seguente.",
+      "<strong>macOS:</strong> apri il file <code>.pem</code> con doppio clic in Accesso Portachiavi, aggiungilo al portachiavi <em>Sistema</em> e imposta <em>Attendibilità → Considera sempre attendibile</em>.",
+      "<strong>Windows:</strong> clic destro sul file → <em>Installa certificato</em> → inseriscilo in <em>Autorità di certificazione radice attendibili</em>.",
+      "<strong>Firefox (qualsiasi sistema operativo):</strong> <em>Impostazioni → Privacy e sicurezza → Certificati → Mostra certificati → Autorità → Importa</em>; seleziona <em>Considera attendibile questa CA per identificare siti web</em>."
+    ],
+    "standalone": {
+      "title": "Nodi standalone fuori da un cluster",
+      "bodyRich": "Ogni host Proxmox non incluso ha il proprio <code>pve-root-ca.pem</code>. Se gestisci diversi host standalone, ripeti la copia/importazione per ciascuno, o unisciti a un cluster in modo da condividere una singola radice."
+    }
+  },
+  "disable": {
+    "heading": "Disabilitare HTTPS",
+    "bodyRich": "Fai clic su <strong>Disabilita HTTPS</strong> nello stesso pannello. Monitor si riavvia con HTTP non cifrato, utile se un certificato personalizzato non è leggibile e il servizio non parte. Non serve una disinstallazione separata e i file di certificato non vengono modificati.",
+    "stateCallout": {
+      "title": "Dove viene salvato lo stato",
+      "bodyRich": "<code>/etc/proxmenux/ssl_config.json</code> memorizza i percorsi di cert attivo e la fonte (<code>none</code>, <code>proxmox</code>, <code>custom</code>). Cancellare il file è equivalente a disabilitare HTTPS — il prossimo inizio il Monitor rientra a HTTP."
+    }
+  }
+}
diff --git a/web/messages/it/docs/settings/beta-program.json b/web/messages/it/docs/settings/beta-program.json
new file mode 100644
index 00000000..284cdcd0
--- /dev/null
+++ b/web/messages/it/docs/settings/beta-program.json
@@ -0,0 +1,113 @@
+{
+  "meta": {
+    "title": "Cambia canale di rilascio | Documentazione ProxMenux",
+    "description": "Passa tra i canali Stable (main) e Beta (develop) di ProxMenux in una sola finestra. Bidirezionale e idempotente; esegue il programma di installazione ufficiale del canale scelto e normalizza il servizio Monitor.",
+    "ogTitle": "Cambia canale di rilascio | Documentazione ProxMenux",
+    "ogDescription": "Una opzione delle Impostazioni per passare tra Stable e Beta senza eseguire manualmente i programmi di installazione."
+  },
+  "header": {
+    "title": "Cambia canale di rilascio",
+    "description": "Una opzione unica delle Impostazioni passa tra Stable (ramo main) e Beta (ramo develop). La precedente opzione unidirezionale «Disattiva programma beta» è sostituita da una finestra bidirezionale che offre entrambi i sensi ed esegue il programma di installazione ufficiale del canale scelto.",
+    "section": "Impostazioni"
+  },
+  "intro": {
+    "title": "Che cosa è cambiato",
+    "body": "Prima esistevano due procedure: «Disattiva programma beta», visibile solo con beta attiva, e la riesecuzione manuale del programma beta per rientrare. Ora sono riunite in <strong>Cambia canale di rilascio</strong>, sempre disponibile, che mostra il canale corrente e permette il passaggio tra Stable e Beta in entrambi i sensi."
+  },
+  "why": {
+    "heading": "Perché questa opzione esiste",
+    "intro": "ProxMenux è distribuito da due rami Git:",
+    "items": [
+      "<strong>Stable</strong>: il ramo <code>main</code>, indicato nel README e adatto alla maggior parte degli amministratori. I rilasci sono meno frequenti e includono solo modifiche già passate dalla validazione beta.",
+      "<strong>Beta</strong>: il ramo <code>develop</code>. Funzioni e build di Monitor più recenti, con il tag che erediterà la prossima versione stabile. Alcune funzioni potrebbero avere difetti: scegliendo questo canale partecipi ai test prima del rilascio."
+    ],
+    "outro": "Prima occorreva ricordare l'URL corretto del programma di installazione, copiarlo dal README e modificare <code>config.json</code> manualmente in caso di problemi di sincronizzazione. L'opzione unica esegue tutta la procedura con un'azione guidata."
+  },
+  "dialog": {
+    "heading": "La finestra di dialogo",
+    "intro": "Dal menu principale: <strong>Impostazioni → Cambia canale di rilascio</strong>. Appare un menu con due voci:",
+    "options": [
+      "<code>stable</code> — Stable (ramo main)",
+      "<code>beta</code> — Beta (ramo develop)"
+    ],
+    "behaviour": "Il canale corrente è preselezionato e mostrato in alto. Scegliendo lo stesso appare «Questo canale di rilascio è già attivo»: la finestra è idempotente. Scegliendo un altro canale appare una conferma specifica:",
+    "directions": [
+      "<strong>Stable → Beta:</strong> avverte che le versioni beta possono contenere bug o funzioni incomplete.",
+      "<strong>Beta → Stabile:</strong> avverte che i controlli di aggiornamento beta si fermeranno e l'installatore stabile reinstallerà i componenti del canale stabile."
+    ]
+  },
+  "confirm": {
+    "heading": "Cosa succede quando confermi",
+    "items": [
+      "<strong>Scarica il programma di installazione ufficiale</strong> del canale scelto:<ul><li>Stable: <code>install_proxmenux.sh</code> da <code>main</code></li><li>Beta: <code>install_proxmenux_beta.sh</code> da <code>develop</code></li></ul>Prima di continuare verifica che il file sia presente e lo rende eseguibile.",
+      "<strong>Esegue il programma di installazione completo</strong>, lo stesso indicato nel README. Rilevamento dei componenti, backup dei file, installazione delle dipendenze e conservazione della lingua seguono la procedura ufficiale del canale scelto.",
+      "Passando a <strong>Stable</strong>, il menu elimina i metadati beta rimasti in <code>config.json</code>: <code>beta_program</code>, <code>beta_version</code>, <code>install_branch</code> e <code>update_available.beta*</code>. <code>proxmenux_monitor.status = beta_updated</code> diventa <code>updated</code>. Il file residuo <code>beta_version.txt</code> e i programmi di installazione beta scaricati vengono rimossi.",
+      "Passando a Stable, l'unità systemd di Monitor viene riscritta dal modello Stable: «Beta» viene rimosso dalla descrizione e <code>ExecStart</code> torna a puntare alla directory di esecuzione. Una nuova esecuzione di <code>systemctl status</code> riflette quindi il canale attuale.",
+      "Ricarica il menu di configurazione. <em>Mostra informazioni sulla versione</em> mostrerà il nuovo canale."
+    ]
+  },
+  "switching": {
+    "heading": "Passare avanti e indietro",
+    "intro": "Entrambe le direzioni passano attraverso lo stesso programma di installazione: <strong>non</strong> flussi di disinstallazione e reinstallazione speciali. Ciascuna direzione esegue semplicemente il programma di installazione del canale, progettato per essere idempotente e sicuro da eseguire nuovamente su un'installazione esistente. Conseguenze pratiche:",
+    "items": [
+      "La configurazione esistente, ProxMenux Monitor login (<code>auth.json</code>), canali di notifica, registro post-installazione, soglie personalizzate — nessuno di questi sono toccati. L'interruttore di canale scambia solo l'albero di script e il binario AppImage.",
+      "Un Monitor attivo prima del cambio rimane attivo dopo; uno disattivato rimane disattivato.",
+      "Il file <code>auth.json</code>, i token API e il segreto JWT di ProxMenux Monitor vengono conservati al cambio di canale. Le sessioni non vengono disconnesse.",
+      "Puoi cambiare canale tutte le volte che vuoi: la finestra accetta ogni modifica ed esegue nuovamente il programma di installazione. Non è necessario riavviare Proxmox.",
+      "Il cambio di canale sostituisce gli script di ProxMenux e non può essere eseguito nel terminale del browser di Monitor: il PTY verrebbe chiuso durante l'aggiornamento, bloccando la finestra. In quel terminale appare invece un messaggio con il comando ufficiale di una riga per il canale scelto. Eseguilo da SSH o dalla console dell'host Proxmox."
+    ]
+  },
+  "feedback": {
+    "heading": "Segnalare problemi della beta",
+    "intro": "Se qualcosa si comporta inaspettatamente mentre sei sul canale Beta, aprire un problema con un contesto sufficiente è quello che chiude il divario a un rilascio stabile. Il rapporto più utile comprende:",
+    "items": [
+      "Quello che hai fatto e quello che ti aspettavi.",
+      "Eventuali messaggi di errore visualizzati sullo schermo.",
+      "I relativi registri Monitor:"
+    ],
+    "logsCommand": "journalctl -u proxmenux-monitor -n 50 --no-pager",
+    "versionLine": "La versione attuale di ProxMenux (Impostazioni → <link>Mostra informazioni sulla versione</link>).",
+    "issueLine": "Aprire un <ghlink>GitHub Issue</ghlink> con queste informazioni e arriviamo alla correzione più veloce."
+  },
+  "manual": {
+    "heading": "Equivalente manuale",
+    "intro": "Se preferisci la shell o automatizzi il cambio di canale, la finestra esegue questi comandi:"
+  },
+  "unifiedCallout": {
+    "title": "Perché entrambe le direzioni sono ora un'opzione",
+    "body": "La vecchia opzione «Disattiva programma beta» appariva solo dopo la adesione alla beta. Per <em>aderire</em> occorreva cercare altrove il programma di installazione; per <em>uscire</em> talvolta occorreva pulire manualmente i metadati <code>beta_*</code>. <strong>Cambia canale di rilascio</strong> appare sempre, mostra il canale corrente e tratta entrambe le direzioni come un'operazione eseguibile, ripetibile e idempotente."
+  },
+  "troubleshoot": {
+    "heading": "Risoluzione dei problemi",
+    "downloadTitle": "“Impossibile scaricare l’installatore”",
+    "downloadBody": "HTTPS in uscita a <code>raw.githubusercontent.com</code> fallito. Controllare la connettività e DNS dall'host:",
+    "downloadCmd": "curl -fsSL -o /tmp/test https://raw.githubusercontent.com/MacRimi/ProxMenux/main/install_proxmenux.sh && head -1 /tmp/test",
+    "downloadOutro": "Se questo non funziona al di fuori di ProxMenux, è un problema di rete / proxy sull'host.",
+    "errorsTitle": "“Installer finito con errori”",
+    "errorsBody": "Il programma di installazione ha restituito un codice diverso da zero. Non è previsto un ripristino automatico: alcuni file o componenti potrebbero essere già cambiati. Leggi l'output del programma di installazione mostrato sopra l'errore prima di premere Invio e controlla lo stato attuale, poi riprova dal menu o esegui il programma manualmente via SSH o dalla console dell'host.",
+    "configTitle": "“Impossibile aggiornare il file di configurazione” dopo il passaggio a stabile",
+    "configBody": "La pulizia post-installazione dei metadati beta non è riuscita — di solito perché <code>config.json</code> ha un errore di sintassi da una modifica manuale. Convalidalo:",
+    "configCmd": "jq . /usr/local/share/proxmenux/config.json",
+    "configOutro": "Correggi o ripristina il file ed esegui nuovamente l'opzione."
+  },
+  "related": {
+    "heading": "Correlati",
+    "items": [
+      {
+        "href": "/docs/settings/show-version-information",
+        "label": "Mostra informazioni sulla versione",
+        "tail": "— confermare quale canale è attivo ora."
+      },
+      {
+        "href": "/docs/settings/proxmenux-monitor",
+        "label": "ProxMenux Monitor",
+        "tail": " — il servizio Monitor ricreato durante il cambio di canale."
+      },
+      {
+        "href": "/docs/settings",
+        "label": "Panoramica delle impostazioni",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/it/docs/settings/change-language.json b/web/messages/it/docs/settings/change-language.json
new file mode 100644
index 00000000..2d169b6b
--- /dev/null
+++ b/web/messages/it/docs/settings/change-language.json
@@ -0,0 +1,108 @@
+{
+  "meta": {
+    "title": "Cambia lingua | Documentazione ProxMenux",
+    "description": "Scegli tra otto lingue per ProxMenux. Ogni installazione include cataloghi JSON di traduzioni pregenerati; l'host non richiede un servizio di traduzione né un ambiente Python. Il menu si ricarica automaticamente.",
+    "ogTitle": "Cambia lingua | Documentazione ProxMenux",
+    "ogDescription": "Scegli una delle otto lingue di ProxMenux dalle Impostazioni. Disponibile in ogni installazione."
+  },
+  "header": {
+    "title": "Cambia lingua",
+    "description": "Passa tra le otto lingue supportate da ProxMenux. La scelta viene salvata in config.json e il menu viene riavviato nella nuova lingua. Ogni installazione include i cataloghi di traduzioni.",
+    "section": "Impostazioni"
+  },
+  "intro": {
+    "title": "Che cosa è questo",
+    "body": "Una finestra elenca le otto lingue supportate. ProxMenux salva la scelta in <code>config.json</code> come <code>.language</code>, poi riavvia <code>config_menu.sh</code> per applicarla subito."
+  },
+  "warn": {
+    "title": "Disponibile in ogni installazione",
+    "body": "Le Impostazioni mostrano sempre Cambia lingua. I cataloghi vengono installati in <code>/usr/local/share/proxmenux/lang/</code> <em>e</em> la lingua scelta viene salvata in <code>config.json</code>. Il precedente ambiente Python di traduzione non è necessario."
+  },
+  "supported": {
+    "heading": "Lingue supportate",
+    "headerCode": "Code",
+    "headerLang": "Lingua",
+    "headerNotes": "Note",
+    "rows": [
+      {
+        "code": "en",
+        "lang": "Inglese",
+        "notes": "Lingua sorgente — più accurata"
+      },
+      {
+        "code": "es",
+        "lang": "Spagnolo",
+        "notes": "Catalogo JSON pregenerato"
+      },
+      {
+        "code": "fr",
+        "lang": "Francese",
+        "notes": "Catalogo JSON pregenerato"
+      },
+      {
+        "code": "de",
+        "lang": "Tedesco",
+        "notes": "Catalogo JSON pregenerato"
+      },
+      {
+        "code": "it",
+        "lang": "Italiano",
+        "notes": "Catalogo JSON pregenerato"
+      },
+      {
+        "code": "pt",
+        "lang": "Portoghese",
+        "notes": "Catalogo JSON pregenerato"
+      },
+      {
+        "code": "sk",
+        "lang": "Slovacco",
+        "notes": "Catalogo JSON pregenerato"
+      },
+      {
+        "code": "sv",
+        "lang": "Svedese",
+        "notes": "Catalogo JSON pregenerato"
+      }
+    ]
+  },
+  "englishTip": {
+    "title": "L'inglese è il più accurato",
+    "body": "I testi nelle altre lingue provengono dai cataloghi JSON pregenerati inclusi in ProxMenux. Le traduzioni mancanti usano il testo inglese; non vengono effettuate chiamate di traduzione sull'host. In caso di dubbi, l'inglese resta il riferimento."
+  },
+  "underHood": {
+    "heading": "Come funziona sotto il cofano",
+    "items": [
+      "La finestra elenca otto codici lingua; scegline uno.",
+      "Se esiste <code>config.json</code>: <code>jq --arg lang \"$new_language\" '.language = $lang''</code> aggiorna il campo in posizione.",
+      "Se <code>config.json</code> non esiste, viene creato un nuovo file con il codice della lingua in un oggetto contenente un solo campo.",
+      "Finestra di conferma: <em>\"Lingua cambiata in [code]\"</em>.",
+      "<code>exec bash config_menu.sh</code> ricarica il menu Impostazioni con la nuova lingua attiva."
+    ]
+  },
+  "manual": {
+    "heading": "Equivalente manuale"
+  },
+  "troubleshoot": {
+    "heading": "Risoluzione dei problemi",
+    "noOptionTitle": "L'opzione non appare in Impostazioni",
+    "noOptionBody": "Cambia lingua è sempre disponibile nelle versioni attuali. Se manca, aggiorna ProxMenux con il programma di installazione ufficiale e riapri le Impostazioni.",
+    "stillEnglishTitle": "La lingua è cambiata ma l'interfaccia utente mostra ancora inglese",
+    "stillEnglishBody": "Il menu si riavvia dopo la modifica. Se hai aperto una nuova shell e avviato un altro punto di ingresso di ProxMenux, esegui di nuovo <code>menu</code> per applicare la nuova lingua. Verifica con <code>jq -r '.language' /usr/local/share/proxmenux/config.json</code>."
+  },
+  "related": {
+    "heading": "Correlati",
+    "items": [
+      {
+        "href": "/docs/settings/show-version-information",
+        "label": "Mostra informazioni sulla versione",
+        "tail": " — conferma il canale di rilascio, i file di traduzione e la lingua attuale."
+      },
+      {
+        "href": "/docs/settings",
+        "label": "Panoramica delle impostazioni",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/it/docs/settings/index.json b/web/messages/it/docs/settings/index.json
new file mode 100644
index 00000000..cf2673ec
--- /dev/null
+++ b/web/messages/it/docs/settings/index.json
@@ -0,0 +1,81 @@
+{
+  "meta": {
+    "title": "Impostazioni ProxMenux — Attivazione di Monitor, canale di rilascio, lingue | ProxMenux",
+    "description": "Impostazioni di ProxMenux: servizio Monitor e reimpostazione della password, canale Stable/Beta, otto lingue, diagnostica della versione e disinstallazione. Le opzioni Monitor appaiono quando il servizio è installato.",
+    "ogTitle": "Impostazioni ProxMenux — Attivazione di Monitor, canale di rilascio, lingue",
+    "ogDescription": "Configura ProxMenux: servizio Monitor, canale di rilascio, lingua, informazioni sulla versione e disinstallazione.",
+    "twitterTitle": "Impostazioni ProxMenux",
+    "twitterDescription": "Attivazione di Monitor, cambio del canale di rilascio, lingue, informazioni sulla versione e disinstallazione."
+  },
+  "header": {
+    "title": "Impostazioni",
+    "description": "Configura ProxMenux: attiva o disattiva Monitor, reimposta le credenziali, passa tra Stable e Beta in entrambe le direzioni, scegli una delle otto lingue, consulta la diagnostica della versione e disinstalla. Le azioni di Monitor richiedono il servizio installato; la scelta della lingua è sempre disponibile.",
+    "section": "Impostazioni"
+  },
+  "intro": {
+    "title": "A cosa serve questo menu",
+    "body": "Amministrazione di ProxMenux stesso: servizio Monitor, uscita dal canale beta, lingua, diagnostica della versione e disinstallazione. Nessun'opzione di questo menu modifica VM, container o archiviazione."
+  },
+  "opening": {
+    "heading": "Apertura del menu",
+    "body": "Dal menu principale di ProxMenux premi <kbd>s</kbd>. Le azioni Monitor appaiono se il servizio è installato; le altre impostazioni sono sempre disponibili:",
+    "imageAlt": "Menu Impostazioni di ProxMenux con azioni Monitor condizionali"
+  },
+  "installTypes": {
+    "heading": "Una installazione, tutte le lingue",
+    "intro": "Le versioni attuali includono cataloghi JSON statici in ogni installazione. Le vecchie versioni offrivano modalità separate con traduzione e normale:",
+    "headerType": "Tipo di installazione",
+    "headerBundles": "Componenti inclusi",
+    "headerMenu": "Mostra menu",
+    "rows": [
+      {
+        "type": "Installazione attuale",
+        "bundles": "Cataloghi JSON statici per sette lingue più l’inglese integrato; nessun ambiente Python di traduzione",
+        "menuRich": "<strong>Cambia lingua</strong> + Mostra versione + Disinstalla"
+      },
+      {
+        "type": "Vecchie modalità con traduzione / normale",
+        "bundles": "Vecchia separazione tra ambiente di traduzione e installazione solo in inglese",
+        "menu": "Aggiorna con il programma ufficiale per usare il menu unificato attuale"
+      }
+    ],
+    "detectionTitle": "La scelta della lingua è sempre disponibile",
+    "detectionBody": "Il menu non verifica più un ambiente di traduzione. Ogni installazione include <code>/usr/local/share/proxmenux/lang/</code> e salva il valore <code>language</code> scelto in <code>config.json</code>."
+  },
+  "options": {
+    "heading": "Opzioni menu",
+    "intro": "Questi strumenti gestiscono ProxMenux stesso. <em>Condizionale</em> indica che le azioni Monitor appaiono solo se il servizio systemd è installato. Canale di rilascio, lingua, diagnostica della versione e disinstallazione sono sempre disponibili.",
+    "list": [
+      {
+        "icon": "Activity",
+        "href": "/docs/settings/proxmenux-monitor",
+        "title": "ProxMenux Monitor",
+        "description": "Attiva / disattiva l'unità proxmenux-monitor.service systemd, controlla lo stato attuale e ripristina la password di accesso del cruscotto se è stata persa. UI Web disponibile su TCP 8008.",
+        "badge": "Condizionale"
+      },
+      {
+        "icon": "TestTube",
+        "href": "/docs/settings/beta-program",
+        "title": "Cambia canale di rilascio",
+        "description": "Passa tra Stable (main) e Beta (develop) in entrambe le direzioni da una sola finestra. Esegue il programma di installazione ufficiale del canale scelto; è idempotente e sempre visibile.",
+        "badge": "Sempre disponibile"
+      },
+      {
+        "icon": "Info",
+        "href": "/docs/settings/show-version-information",
+        "title": "Mostra informazioni sulla versione",
+        "description": "Versione di ProxMenux, canale di rilascio, componenti installati, percorsi dei file, file di traduzione e lingua attuale."
+      },
+      {
+        "icon": "Trash2",
+        "href": "/docs/settings/uninstall-proxmenux",
+        "title": "Disinstalla ProxMenux",
+        "description": "Rimuovere ProxMenux e (opzionalmente) le sue dipendenze. Inoltre ripristina i backup /root/.bashrc e /etc/motd creati al momento dell'installazione."
+      }
+    ]
+  },
+  "configTip": {
+    "title": "Dove viene salvata la configurazione",
+    "bodyRich": "La maggior parte dello stato gestito da questo menu è salvata in <code>/usr/local/share/proxmenux/config.json</code>: <code>language</code>, <code>beta_program.status</code> e indicatori di installazione per ciascun componente. Lo stato del servizio Monitor è gestito da systemd (<code>proxmenux-monitor.service</code>), non qui. La versione viene letta da <code>/usr/local/share/proxmenux/version.txt</code>."
+  }
+}
diff --git a/web/messages/it/docs/settings/proxmenux-monitor.json b/web/messages/it/docs/settings/proxmenux-monitor.json
new file mode 100644
index 00000000..8ae9b6ea
--- /dev/null
+++ b/web/messages/it/docs/settings/proxmenux-monitor.json
@@ -0,0 +1,119 @@
+{
+  "meta": {
+    "title": "ProxMenux Monitor | Documentazione ProxMenux",
+    "description": "Attiva o disattiva l'unità systemd proxmenux-monitor.service e verifica il suo stato. Monitor fornisce un'interfaccia web sulla porta TCP 8008 per il monitoraggio visivo dell'host.",
+    "ogTitle": "ProxMenux Monitor | Documentazione ProxMenux",
+    "ogDescription": "Attiva o disattiva il servizio systemd proxmenux-monitor e controllane lo stato dalle Impostazioni."
+  },
+  "header": {
+    "title": "ProxMenux Monitor",
+    "description": "Due azioni correlate nelle Impostazioni: attivare o disattivare l'unità systemd proxmenux-monitor.service (avvio/arresto e abilitazione/disabilitazione insieme) e visualizzarne lo stato dettagliato. Monitor fornisce un'interfaccia web sulla porta TCP 8008 per il monitoraggio visivo dell'host.",
+    "section": "Impostazioni"
+  },
+  "intro": {
+    "title": "Cos'è ProxMenux Monitor?",
+    "body": "ProxMenux Monitor è un cruscotto web integrato che fornisce visibilità in tempo reale nell'infrastruttura Proxmox, accessibile da qualsiasi browser della rete, senza bisogno di un terminale."
+  },
+  "offers": {
+    "heading": "Cosa offre",
+    "items": [
+      "Monitoraggio in tempo reale di CPU, RAM, utilizzo del disco e traffico di rete.",
+      "Panoramica dell'esecuzione di VM e contenitori LXC con indicatori di stato.",
+      "Autenticazione di accesso per proteggere l'interfaccia.",
+      "Autenticazione a due fattori (2FA) con supporto TOTP.",
+      "Supporto proxy inverso (Nginx / Traefik).",
+      "Progettato per lavorare su dispositivi desktop e mobili."
+    ]
+  },
+  "access": {
+    "heading": "Accesso",
+    "intro": "Una volta installato, il cruscotto è disponibile a:",
+    "url": "http://<your-proxmox-ip>:8008",
+    "outro": "Il Monitor viene installato automaticamente nell'ambito dell'installazione standard ProxMenux e viene eseguito come servizio systemd (<code>proxmenux-monitor.service</code>) che inizia automaticamente sul boot."
+  },
+  "warnConditional": {
+    "title": "Opzioni delle impostazioni visibili solo quando Monitor è installato",
+    "body": "Le due voci del menu descritte di seguito appaiono solo in Impostazioni se <code>proxmenux-monitor.service</code> è registrato con systemd. Se non li vedi, il Monitor non è stato installato (è opzionale durante l'installazione ProxMenux). Per aggiungerlo in seguito, reinstallare ProxMenux con l'ultima versione e selezionare l'opzione Monitor."
+  },
+  "toggle": {
+    "heading": "Attivare / disattivare",
+    "intro": "La prima voce del menu alterna tra due stati in base al fatto che il servizio sia in esecuzione:",
+    "headerState": "Stato attuale",
+    "headerLabel": "Etichetta del menu",
+    "headerAction": "Azione sulla conferma",
+    "rows": [
+      {
+        "state": "attivo",
+        "label": "Disattiva ProxMenux Monitor",
+        "action": "systemctl stop + disable"
+      },
+      {
+        "state": "inattivo",
+        "label": "Attiva ProxMenux Monitor",
+        "action": "systemctl enable + start"
+      }
+    ],
+    "outro": "Ogni modifica richiede una conferma sì/no. Disattivare arresta il servizio <em>e</em> disabilita l'avvio automatico; attivare abilita l'avvio automatico <em>e</em> avvia subito il servizio."
+  },
+  "status": {
+    "heading": "Mostra stato servizio Monitor",
+    "intro": "La seconda voce del menu è di sola lettura. Sgombera lo schermo, mostra il logo ProxMenux e il titolo <em>\"ProxMenux Monitor Service Verification\"</em>, poi segnala:",
+    "items": [
+      "<strong>Stato di servizio:</strong> attivo, inattivo o not_installed.",
+      "<strong>Web UI URL</strong> (solo quando attivo): <code>http://&lt;host_ip&gt;:8008</code> — derivato da <code>hostname -I | awk '''{print $1}'''</code>.",
+      "<strong>Dettaglio systemd uscita:</strong> <code>systemctl status proxmenux-monitor.service --no-pager -l</code> — mostra le linee di log recenti, ExecStart, MainPID, ecc."
+    ]
+  },
+  "manual": {
+    "title": "Equivalenti manuali",
+    "intro": "Da qualsiasi shell:",
+    "code": "systemctl status proxmenux-monitor.service       # detailed status\nsystemctl is-active proxmenux-monitor.service    # one-word status\nsystemctl enable --now proxmenux-monitor.service # enable + start\nsystemctl disable --now proxmenux-monitor.service # stop + disable\njournalctl -u proxmenux-monitor.service -f       # follow live logs"
+  },
+  "reset": {
+    "heading": "Reimposta password ProxMenux Monitor",
+    "intro": "Percorso di recupero per l'operatore che ha perso la password del cruscotto (o dispositivo 2FA). L'opzione viene visualizzata solo quando il Monitor viene installato sull'host. Selezione:",
+    "items": [
+      "Chiede la conferma con una finestra di dialogo sì/no — l'azione è distruttiva per le credenziali di accesso.",
+      "Il backup del <code>/root/.config/proxmenux-monitor/auth.json</code> esistente a <code>auth.json.bak-&lt;UTC timestamp&gt;</code> (mode <code>0600</code>) così lo stato precedente può essere ripristinato manualmente se il reset è stato un errore.",
+      "Arresta il servizio <code>proxmenux-monitor</code> per evitare conflitti tra la modifica del file e un accesso in corso.",
+      "Cancella i campi di identità in <code>auth.json</code>: <code>enabled=false</code>, <code>configured=false</code>, svuota <code>username</code>, <code>password_hash</code>, <code>totp_secret</code> e l'array dei codici di backup.",
+      "<strong>Conserva</strong> <code>jwt_secret</code> e i dati registrati <code>api_tokens</code> / <code>revoked_tokens</code>, così i token di lunga durata usati da Home Assistant o altri script <em>continuano ad autenticarsi</em> dopo la reimpostazione.",
+      "Riavvia il servizio. La prossima visita a <code>http://&lt;host&gt;:8008</code> mostra la procedura guidata di configurazione del primo lancio in modo da poter creare un nuovo account di amministrazione."
+    ],
+    "preservedTitle": "Cosa viene conservato e cosa viene cancellato",
+    "preservedBody": "<strong>Cancellati:</strong> nome utente, hash della password, segreto TOTP 2FA e codici di recupero. <strong>Conservati:</strong> <code>jwt_secret</code>, metadati <code>api_tokens</code> e lista <code>revoked_tokens</code>. Per invalidare anche tutti i token API e ripartire da zero, elimina <code>auth.json</code> manualmente invece di usare questa opzione. Al prossimo avvio il servizio rigenera il segreto JWT e tutti gli altri dati.",
+    "trustTitle": "L'accesso fisico-host è l'ancora di fiducia",
+    "trustBody": "Questo percorso di reset richiede shell radice sull'host. Chiunque può eseguire il comando <code>menu</code> come root controlla già la casella, quindi dare loro il recupero password non è un escalation privilegio — è coerente con come ogni altro strumento di amministrazione su Proxmox funziona. Il corollario: il login Monitor non proteggerà nulla da qualcuno che hai già lasciato nel guscio Proxmox.",
+    "seeAlso": "Vedi anche <link>Monitor → Accesso e autenticazione → Recuperare una password persa</link> per la stessa procedura dal pannello e i dettagli sul calcolo degli hash delle password e sulla generazione del segreto JWT."
+  },
+  "files": {
+    "heading": "File coinvolti",
+    "code": "/etc/systemd/system/proxmenux-monitor.service       # systemd unit\n/root/.config/proxmenux-monitor/                    # runtime config dir\n/var/log/proxmenux-auth.log                         # Flask app auth log\n                                                    # (read by Fail2Ban [proxmenux] jail)"
+  },
+  "troubleshoot": {
+    "heading": "Risoluzione dei problemi",
+    "missingTitle": "Entrambe le opzioni di menu mancano",
+    "missingBody": "Il Monitor non è registrato con systemd. Confermare con <code>systemctl list-unit-files | grep proxmenux-monitor</code> — se non c'è uscita, reinstallare ProxMenux dal programma di installazione ufficiale con l'ultima versione e selezionare l'opzione Monitor durante l'installazione.",
+    "unreachableTitle": "Servizio attivato ma l'URL non è raggiungibile",
+    "unreachableBody": "L'uscita di stato delle impostazioni ti dà l'IP. Conferma:",
+    "unreachableCmd": "ss -tlnp | grep 8008                # is anything listening?\njournalctl -u proxmenux-monitor -n 100 --no-pager  # recent errors\ncurl -sI http://localhost:8008      # local reachability",
+    "unreachableOutro": "Se localhost funziona ma non è esterno, controlla il firewall host (<code>pve-firewall</code> o nftables) per TCP 8008 in entrata.",
+    "stopsTitle": "Attivato il servizio ma si ferma pochi secondi dopo",
+    "stopsBody": "Di solito si tratta di un conflitto sulla porta 8008 o di un controllo delle dipendenze non riuscito. Il registro di sistema indica la causa: <code>journalctl -u proxmenux-monitor.service -b</code>."
+  },
+  "related": {
+    "heading": "Correlati",
+    "items": [
+      {
+        "href": "/docs/security/fail2ban",
+        "label": "Fail2Ban",
+        "tailRich": "— la prigione <code>[proxmenux]</code> protegge il Monitor su TCP 8008."
+      },
+      {
+        "href": "/docs/settings",
+        "label": "Panoramica delle impostazioni",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/it/docs/settings/show-version-information.json b/web/messages/it/docs/settings/show-version-information.json
new file mode 100644
index 00000000..4bb619dc
--- /dev/null
+++ b/web/messages/it/docs/settings/show-version-information.json
@@ -0,0 +1,81 @@
+{
+  "meta": {
+    "title": "Mostra informazioni sulla versione | Documentazione ProxMenux",
+    "description": "Diagnostica di ProxMenux in sola lettura: versione, canale di rilascio, componenti registrati in config.json, percorsi dei file, cataloghi di traduzioni e lingua attuale.",
+    "ogTitle": "Mostra informazioni sulla versione | Documentazione ProxMenux",
+    "ogDescription": "Dati diagnostici su versione di ProxMenux, canale di rilascio, componenti, file e lingua."
+  },
+  "header": {
+    "title": "Mostra informazioni sulla versione",
+    "description": "Diagnostica in sola lettura. Legge version.txt, config.json e percorsi di file noti, poi mostra una casella di testo scorrevole con versione, canale di rilascio, componenti installati, presenza dei file, file di traduzione e lingua attuale.",
+    "section": "Impostazioni"
+  },
+  "intro": {
+    "title": "Che cosa è questo",
+    "body": "Un autodiagnostico. Utile quando si segnala un problema (incolla il contenuto di dialogo nel bug report) o per confermare un'installazione completata in modo pulito. Non modifica niente."
+  },
+  "reports": {
+    "heading": "Che cosa riferisce",
+    "headerSection": "Sezione",
+    "headerSource": "Fonte",
+    "headerContent": "Contenuto",
+    "rows": [
+      {
+        "section": "Versione attuale",
+        "source": "version.txt",
+        "contentRich": "Numero di versione su una sola riga; <code>Unknown</code> se il file manca"
+      },
+      {
+        "section": "Canale di rilascio",
+        "source": "Stato del programma beta in config.json",
+        "content": "Stable (main) o Beta (develop); versione beta se disponibile"
+      },
+      {
+        "section": "Componenti installati",
+        "source": "config.json",
+        "content": "Stato di ciascun componente (✓ installato / creato / aggiornato, ✗ assente)"
+      },
+      {
+        "section": "File ProxMenux",
+        "source": "controllo filesystem",
+        "contentRich": "<code>menu</code>, <code>utils.sh</code>, <code>config.json</code>, <code>version.txt</code> presenza + percorsi"
+      },
+      {
+        "section": "File di traduzione",
+        "source": "/usr/local/share/proxmenux/lang/",
+        "content": "Presenza della directory lang/ inclusa in ogni installazione"
+      },
+      {
+        "section": "Lingua attuale",
+        "source": "config.json",
+        "contentRich": "Codice lingua da <code>.language</code>; usa <code>en</code> se non impostato"
+      }
+    ]
+  },
+  "sampleHeading": "Esempio di output",
+  "manualHeading": "Equivalenti manuali",
+  "troubleshoot": {
+    "heading": "Risoluzione dei problemi",
+    "unknownTitle": "La versione mostra \"Unknown\"",
+    "unknownBody": "<code>/usr/local/share/proxmenux/version.txt</code> è mancante o illeggibile. Il più spesso causato da un'installazione parziale. Reinstallare dalla sorgente ufficiale ProxMenux.",
+    "noConfigTitle": "Nessuna informazione di installazione disponibile",
+    "noConfigBody": "<code>config.json</code> manca. Senza questo file lo script non può elencare i componenti. Reinstalla per ricrearlo.",
+    "wrongStatusTitle": "Un componente mostra ✗ anche se sono sicuro di averlo installato",
+    "wrongStatusBody": "Significa che <code>config.json</code> non registra quel componente come installato: potrebbe trattarsi di uno script che non si registra ancora, oppure di una installazione manuale eseguita senza ProxMenux. La finestra riflette il contenuto di <code>config.json</code>, non lo stato effettivo del disco."
+  },
+  "related": {
+    "heading": "Correlati",
+    "items": [
+      {
+        "href": "/docs/settings/uninstall-proxmenux",
+        "label": "Disinstalla ProxMenux",
+        "tail": "— rimuovere tutti questi file."
+      },
+      {
+        "href": "/docs/settings",
+        "label": "Panoramica delle impostazioni",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/it/docs/settings/uninstall-proxmenux.json b/web/messages/it/docs/settings/uninstall-proxmenux.json
new file mode 100644
index 00000000..6a260ee5
--- /dev/null
+++ b/web/messages/it/docs/settings/uninstall-proxmenux.json
@@ -0,0 +1,92 @@
+{
+  "meta": {
+    "title": "Disinstalla ProxMenux | Documentazione ProxMenux",
+    "description": "Disinstallazione pulita di ProxMenux con rimozione facoltativa di jq e dialog, pulizia dei vecchi file di traduzione e del servizio Monitor e ripristino dei backup di sistema.",
+    "ogTitle": "Disinstalla ProxMenux | Documentazione ProxMenux",
+    "ogDescription": "Pulitamente rimuovere ProxMenux da un host Proxmox con pulizia di dipendenza opzionale."
+  },
+  "header": {
+    "title": "Disinstalla ProxMenux",
+    "description": "Rimuove ProxMenux dall'host Proxmox con un processo interattivo: conferma, rimozione facoltativa delle dipendenze, pulizia del servizio ProxMenux Monitor e ripristino dei backup di /root/.bashrc e /etc/motd. Mostra una barra di avanzamento per tutta la durata del processo.",
+    "section": "Impostazioni"
+  },
+  "scopeWarn": {
+    "title": "Riguarda solo l'installazione di ProxMenux, non VM / CT / archiviazione",
+    "body": "La disinstallazione rimuove gli script ProxMenux, il lanciatore del menu, il servizio Monitor facoltativo e i backup dei file di sistema creati da ProxMenux durante l'installazione. <strong>Non modifica VM, container, archiviazione, configurazione di rete, Fail2Ban, driver NVIDIA o qualsiasi altro elemento installato tramite ProxMenux.</strong> Questi rimangono invariati."
+  },
+  "flow": {
+    "heading": "Procedura di disinstallazione",
+    "items": [
+      "<strong>Finestra di conferma.</strong> Sì/no: «Vuoi davvero disinstallare ProxMenux?»",
+      "<strong>Elenco delle dipendenze da rimuovere.</strong> Propone jq e dialog. Entrambe le caselle sono deselezionate; scegli solo le dipendenze che nessun'altra applicazione richiede.",
+      "<strong>La rimozione mostra una barra di avanzamento.</strong> Rimuove ogni vecchio ambiente di traduzione rimasto, il lanciatore <code>menu</code>, la struttura <code>/usr/local/share/proxmenux/</code>, il servizio ProxMenux Monitor se presente insieme alla destinazione di notifica registrata in Proxmox VE (<code>proxmenux-webhook</code> e la relativa regola di corrispondenza), le dipendenze selezionate e infine ripristina i backup dei file di sistema (vedi sotto).",
+      "<strong>Finestra di completamento.</strong> Elenca le dipendenze rimosse e termina."
+    ]
+  },
+  "deps": {
+    "heading": "Rimozione della dipendenza: cosa è offerto",
+    "intro": "La lista propone jq e dialog. <strong>Nessuna casella è selezionata per impostazione predefinita</strong>: altre applicazioni potrebbero usare questi pacchetti di sistema, quindi è più sicuro conservarli.",
+    "headerType": "Installazione",
+    "headerOffered": "Offerto per la rimozione",
+    "rows": [
+      {
+        "type": "Versioni attuali",
+        "offeredRich": "<code>dialog</code>, <code>jq</code>"
+      },
+      {
+        "type": "Vecchie installazioni dopo l'aggiornamento",
+        "offeredRich": "<code>dialog</code>, <code>jq</code>"
+      }
+    ],
+    "warnTitle": "Pacchetti a livello di sistema — pensare due volte",
+    "warnBody": "La lista attuale propone <code>jq</code> e <code>dialog</code>, non <code>python3</code>. Altri strumenti potrebbero richiedere questi pacchetti di sistema. La rimozione può eliminare anche pacchetti dipendenti o dipendenze inutilizzate. Conserva i pacchetti necessari e controlla ogni proposta di rimozione prima di eseguire apt manualmente."
+  },
+  "removed": {
+    "heading": "Cosa viene rimosso",
+    "code": "/usr/local/bin/menu                                  # the launcher\n/usr/local/share/proxmenux/                          # everything: scripts, config, cache, version\n/opt/googletrans-env/                                # leftover legacy translation environment\n/etc/systemd/system/proxmenux-monitor.service        # Monitor service unit\n/root/.config/proxmenux-monitor/                     # Monitor config dir\n                                                     # + dependencies you ticked in the checklist"
+  },
+  "restored": {
+    "heading": "Che cosa viene ripristinato",
+    "items": [
+      "Se <code>/root/.bashrc.bak</code> esiste, viene rinominato in <code>/root/.bashrc</code> (ripristinando il file bashrc originale).",
+      "Se <code>/etc/motd.bak</code> esiste, viene rinominato in <code>/etc/motd</code>. Altrimenti sed rimuove dal motd esistente la riga ProxMenux (<em>“This system is optimised by: ProxMenux”</em>)."
+    ]
+  },
+  "othersCallout": {
+    "title": "Gli altri componenti installati da ProxMenux rimangono",
+    "body": "Tutto ciò che ProxMenux è installato tramite altri menu — Fail2Ban, Lynis, NVIDIA driver, modifiche post-installazione — <strong>non</strong> viene toccato da questo programma di disinstallazione. Ognuno ha il proprio flusso di disinstallazione all'interno del rispettivo menu (oppure puoi rimuoverlo direttamente con apt). Guarda prima <em>Mostra informazioni sulla versione</em> per vedere cosa è registrato."
+  },
+  "manual": {
+    "heading": "Disinstallazione manuale",
+    "intro": "Se per qualche motivo il disinstallatore del menu non può essere eseguito (ad es. <code>dialog</code> già mancante), la sequenza manuale equivalente:",
+    "code": "# 1. Stop and remove the Monitor service (if installed)\nsystemctl stop proxmenux-monitor.service 2>/dev/null\nsystemctl disable proxmenux-monitor.service 2>/dev/null\nrm -f /etc/systemd/system/proxmenux-monitor.service\nrm -rf /root/.config/proxmenux-monitor\nsystemctl daemon-reload\nsystemctl reset-failed 2>/dev/null\n\n# 2. Remove a leftover legacy translation environment\nrm -rf /opt/googletrans-env\n\n# 3. Remove ProxMenux files\nrm -f /usr/local/bin/menu\nrm -rf /usr/local/share/proxmenux\n\n# 4. Restore backups\n[ -f /root/.bashrc.bak ] && mv /root/.bashrc.bak /root/.bashrc\n[ -f /etc/motd.bak ] && mv /etc/motd.bak /etc/motd \\\n    || sed -i '/This system is optimised by: ProxMenux/d' /etc/motd"
+  },
+  "reinstall": {
+    "heading": "Reinstallare più tardi",
+    "body": "Esegui di nuovo il programma di installazione ufficiale di ProxMenux. Le versioni attuali usano un'unica modalità di installazione che include tutte le otto lingue dell'interfaccia."
+  },
+  "troubleshoot": {
+    "heading": "Risoluzione dei problemi",
+    "hangTitle": "La disinstallazione si blocca durante la rimozione di un vecchio ambiente di traduzione",
+    "hangBody": "Le versioni attuali rimuovono un ambiente residuo con <code>rm -rf /opt/googletrans-env</code>; non eseguono <code>pip uninstall</code>. Se questo passaggio si blocca, esaminalo da un'altra shell e verifica il filesystem dell'host prima di riprovare.",
+    "aptTitle": "apt segnala pacchetti ancora in uso durante la rimozione delle dipendenze",
+    "aptBody": "I pacchetti selezionati vengono contrassegnati come automatici e passati a <code>apt-get -y --purge autoremove</code>. Questo non garantisce la protezione dei servizi dipendenti. Lascia deselezionate le dipendenze necessarie ad altri strumenti e controlla le rimozioni proposte da apt prima di qualsiasi pulizia manuale.",
+    "motdTitle": "MOTD mostra ancora la linea ProxMenux dopo la disinstallazione",
+    "motdBody": "Può accadere se <code>/etc/motd.bak</code> non esisteva e sed non ha trovato la riga (per esempio perché era stata modificata). Modifica <code>/etc/motd</code> manualmente e rimuovi ogni riga ProxMenux rimasta."
+  },
+  "related": {
+    "heading": "Correlati",
+    "items": [
+      {
+        "href": "/docs/settings/show-version-information",
+        "label": "Mostra informazioni sulla versione",
+        "tail": " — verifica cosa verrebbe rimosso prima di disinstallare."
+      },
+      {
+        "href": "/docs/settings",
+        "label": "Panoramica delle impostazioni",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/it/docs/storage-share/host-iscsi.json b/web/messages/it/docs/storage-share/host-iscsi.json
new file mode 100644
index 00000000..2d1030ba
--- /dev/null
+++ b/web/messages/it/docs/storage-share/host-iscsi.json
@@ -0,0 +1,123 @@
+{
+  "meta": {
+    "title": "Host: Aggiungi il target iSCSI come storage Proxmox | Documentazione ProxMenux",
+    "description": "Registra un target iSCSI come storage Proxmox con ProxMenux. La procedura installa open-iscsi, rileva il portale tramite sendtargets, consente di scegliere il target ed esegue pvesm add iscsi. Fornisce dispositivi a blocchi raw per le immagini disco delle VM.",
+    "ogTitle": "Host: Aggiungi il target iSCSI come storage Proxmox | Documentazione ProxMenux",
+    "ogDescription": "Registra un target iSCSI come storage Proxmox con rilevamento guidato. Usa pvesm add iscsi e fornisce dispositivi a blocchi raw per i dischi delle VM."
+  },
+  "header": {
+    "title": "Host: Aggiungi il target iSCSI come storage Proxmox",
+    "description": "Registra un target iSCSI (SAN, TrueNAS / FreeNAS, Synology, Windows Server o qualsiasi array compatibile con iSCSI) come storage Proxmox. I LUN esportati appaiono come dispositivi a blocchi e possono ospitare immagini disco VM con prestazioni vicine a quelle locali tramite la rete.",
+    "section": "Archiviazione e condivisione · Host"
+  },
+  "intro": {
+    "title": "Cosa succede?",
+    "body": "ProxMenux offre una procedura guidata per <code>pvesm add iscsi</code>: installa <code>open-iscsi</code> se necessario, chiede il portale iSCSI (IP:porta), esegue <code>iscsiadm --mode discovery --type sendtargets</code> sul portale, permette di scegliere l’IQN del target e registra lo storage iSCSI in Proxmox. Il servizio <code>iscsid</code> mantiene quindi la sessione iSCSI anche dopo i riavvii."
+  },
+  "vocab": {
+    "heading": "Vocabolario iSCSI (riferimento rapido)",
+    "headerTerm": "Termine",
+    "headerMeaning": "Significato",
+    "rows": [
+      {
+        "term": "Portale",
+        "meaningRich": "L'endpoint del servizio iSCSI sul server di destinazione — un IP (o un hostname) più una porta TCP. La porta di default è <code>3260</code>; ProxMenux lo assume se non si specifica uno."
+      },
+      {
+        "term": "Destinazione",
+        "meaningRich": "Un singolo \"server\" esportato all'interno del portale, identificato dal suo IQN (<em>iSCSI Qualified Name</em>). Un portale può ospitare molti obiettivi."
+      },
+      {
+        "term": "IQN",
+        "meaningRich": "La forma canonica è <code>iqn.YYYY-MM.reverse.domain:identifier</code>, ad esempio <code>iqn.2024-08.com.truenas:proxmox-pool</code>. Sia l'obiettivo che l'iniziatore hanno il proprio IQN."
+      },
+      {
+        "term": "LUN",
+        "meaningRich": "Un dispositivo a blocchi all'interno di un target (numero unità logica). Un singolo obiettivo può esporre diversi LUN; ogni LUN appare come un proprio disco in Proxmox e può diventare un disco VM."
+      },
+      {
+        "term": "Iniziatore",
+        "meaningRich": "Il cliente che si collega a un obiettivo — in questo caso, il vostro host Proxmox. L'iniziatore ha il proprio IQN memorizzato in <code>/etc/iscsi/initiatorname.iscsi</code>. Gli obiettivi tipicamente accettano solo sessioni da parte dell'iniziatore pre-autorizzato IQNs."
+      }
+    ]
+  },
+  "opening": {
+    "heading": "Apertura dello strumento",
+    "body": "Dal menu principale di ProxMenux, aprire <strong>Storage &amp; Share Manager → Aggiungi iSCSI Target come Proxmox Storage</strong>. Vedrete questo sub-menu con quattro opzioni:",
+    "imageAlt": "iSCSI Host Manager menu — Aggiungi / Visualizza / Rimuovi / Test connettività"
+  },
+  "howRuns": {
+    "heading": "Come funziona lo script (Aggiungi flusso)",
+    "body": "Il flusso ha due fasi con chiara separazione tra \"impostare l'iniziatore, scoprire gli obiettivi\" e \"registrare effettivamente lo storage in Proxmox\". A differenza di NFS / Samba, non c'è auto-scoperta sulla sottorete — è necessario conoscere l'indirizzo del portale (iSCSI non è broadcast-friendly)."
+  },
+  "add": {
+    "heading": "Aggiungere l'obiettivo iSCSI come storage Proxmox",
+    "items": [
+      "<strong>Inserimento del portale</strong> — digitare il nome IP o host del server di destinazione iSCSI. Port <code>3260</code> è assunto a meno che non si digita <code>host:port</code>.",
+      "<strong>Rilevamento dei target</strong> — ProxMenux chiama <code>iscsiadm --mode discovery --type sendtargets --portal &lt;ip:port&gt;</code>. Il server risponde con ogni IQN che consente a questo iniziatore di vedere. Se la scoperta fallisce, lo script mostra l'errore esatto da <code>iscsiadm</code> e elenca cause comuni (IP errato, firewall, iniziatore IQN non autorizzato).",
+      "<strong>Selezione del target</strong> — un solo target viene selezionato automaticamente; con più target viene mostrato un menu.",
+      "<strong>Storage ID</strong> — default è <code>iscsi-&lt;last IQN segment, 20 chars max&gt;</code>. Solo lettere, cifre, <code>-</code> e <code>_</code>.",
+      "<strong>Tipo di contenuto</strong> — a differenza di NFS / Samba, il contenuto di iSCSI è <strong>fissato a <code>images</code></strong>. iSCSI espone dispositivi a blocchi raw, non un filesystem, quindi Proxmox consente solo di ospitare dischi VM su di esso."
+    ],
+    "authTitle": "Autorizzare l'iniziatore Proxmox sul bersaglio",
+    "authBody1": "Prima che il flusso Add funzioni end-to-end, l'obiettivo iSCSI deve conoscere il vostro host Proxmox. Ottieni il tuo iniziatore IQN:",
+    "authBody2": "Quindi aggiungere che IQN alla lista di accesso dell'obiettivo (in TrueNAS: <em>Sharing → Block → Gruppi Iniziatori</em>; in Synology: <em>SAN Manager → iSCSI → Target → Modifica → Initiators</em>; ecc.). Se l'iniziatore non è autorizzato, la scoperta di <code>iscsiadm</code> restituisce un elenco vuoto o un errore di autenticazione."
+  },
+  "manual": {
+    "heading": "Equivalente manuale",
+    "body": "L'intero flusso mappa a questi comandi:"
+  },
+  "view": {
+    "heading": "Visualizzare gli archivi iSCSI configurati",
+    "body": "Elenca ogni voce iSCSI in Proxmox (<code>pvesm status | awk ''$2 == \"iscsi\"''</code>) con portale, target IQN, tipo di contenuto e stato live."
+  },
+  "remove": {
+    "heading": "Rimuovere lo storage iSCSI",
+    "body": "Esegue <code>pvesm remove &lt;storage-id&gt;</code> dopo aver confermato il portale, l'obiettivo e il contenuto. Solo la registrazione Proxmox viene rimossa — <strong> l'obiettivo iSCSI stesso non è toccato</strong> e le sessioni esistenti sul lato del kernel possono indugiare fino al prossimo riavvio.",
+    "warnTitle": "Prima controlla i dischi VM presenti su questo iSCSI",
+    "warnBody": "La rimozione di uno storage iSCSI mentre le VM hanno ancora dischi su di esso lascia quelle VM che puntano in un storage non più registrato. Proxmox segnalerà l'errore, ma i dati LUN sono intatti sul bersaglio — è possibile re-registrare lo storage più tardi per ottenere i dischi indietro. Tuttavia, spostare o eseguire il backup delle VM prima di essere al sicuro."
+  },
+  "test": {
+    "heading": "Test di connettività iSCSI",
+    "body": "Esegue un passaggio diagnostico: controlla che <code>iscsiadm</code> è installato, stampa il tuo iniziatore IQN, conferma che <code>iscsid</code> è in esecuzione, pings ogni portale registrato, sonde la sua porta, e segnala <code>pvesm status</code> più se una sessione iSCSI è attualmente attiva (<code>iscsiadm --mode session</code>). Sessione attiva più il portale raggiungibile ma \"inattiva\" in Proxmox di solito significa uno stato obsoleto - prova <code>pvesm set &lt;id&gt; --disable 0</code>."
+  },
+  "troubleshoot": {
+    "heading": "Risoluzione dei problemi",
+    "portalTitle": "\"Impossibile raggiungere il portale\" ma il server IP risponde altrove",
+    "portalBody": "Il ping all’indirizzo del portale non è riuscito. Controlla di raggiungere l’interfaccia della <em>rete di storage</em> (iSCSI spesso usa una VLAN o subnet separata dalla rete di gestione). Verifica anche il DNS se hai indicato un nome host.",
+    "discoverTitle": "\"iSCSI scoperta fallita\" da iscsiadm",
+    "discoverIntro": "Lo script mostra l'errore esatto. Cause più comuni:",
+    "discoverItems": [
+      "Portale IP / porta sbagliato (doppio controllo, default è 3260).",
+      "Il servizio iSCSI non viene eseguito sul server di destinazione.",
+      "Firewall blocca 3260 tra Proxmox e l'obiettivo.",
+      "<strong>L’IQN dell’iniziatore non è autorizzato sul target.</strong> Causa più frequente negli array aziendali. Aggiungi prima l’IQN Proxmox all’ACL degli iniziatori del target."
+    ],
+    "noTargetTitle": "Nessun obiettivo trovato ma la scoperta è riuscita",
+    "noTargetBody": "Il server ha accettato l’iniziatore ma non gli espone alcun target. Controlla autenticazione e accessi: alcuni array consentono il rilevamento a tutti gli IQN ma filtrano i target visibili a ciascuno.",
+    "noLunTitle": "I LUN non appaiono in /dev/disk/by-path dopo la registrazione",
+    "noLunBody": "<code>pvesm add iscsi</code> è riuscito ma il kernel non vede dispositivi a blocchi. Controlla <code>iscsiadm --mode session</code>: se non esistono sessioni attive, avviane una con <code>iscsiadm --mode node --login</code>. Se una sessione esiste ma mancano i LUN, forza una nuova scansione: <code>iscsiadm --mode session --rescan</code>. Se non appare ancora nulla, il target probabilmente non ha LUN assegnati a questo IQN; configura la mappatura LUN sul target.",
+    "chapTitle": "autenticazione CHAP",
+    "chapBody": "ProxMenux non offre campi utente/password CHAP nella procedura interattiva. Se il rilevamento fallisce, lo script si ferma prima di <code>pvesm add</code> e non registra comunque lo storage. Configura separatamente i requisiti CHAP del target in <code>open-iscsi</code>, inclusa l’autenticazione del rilevamento se necessaria, poi riprova. Controlla la configurazione con <code>iscsiadm</code> e verifica le sessioni attive con <code>iscsiadm --mode session</code>."
+  },
+  "related": {
+    "heading": "Correlati",
+    "items": [
+      {
+        "href": "/docs/storage-share/host-nfs",
+        "label": "Condivisione NFS come storage Proxmox",
+        "tail": "— alternativa a livello di file. Più semplice da configurare, più flessibile (backup / ISO / tmpl / immagini), leggermente più lento per dischi VM dal vivo."
+      },
+      {
+        "href": "/docs/storage-share/host-samba",
+        "label": "Samba / CIFS come storage Proxmox",
+        "tail": " — un’altra opzione a livello di file; da evitare per i dischi delle VM in esecuzione a causa della semantica dei blocchi."
+      },
+      {
+        "href": "/docs/storage-share/host-local-disk",
+        "label": "Aggiungere disco locale come archiviazione Proxmox",
+        "tail": " — quando il disco è locale all’host Proxmox anziché su un’altra macchina in rete."
+      }
+    ]
+  }
+}
diff --git a/web/messages/it/docs/storage-share/host-local-disk.json b/web/messages/it/docs/storage-share/host-local-disk.json
new file mode 100644
index 00000000..ebc56176
--- /dev/null
+++ b/web/messages/it/docs/storage-share/host-local-disk.json
@@ -0,0 +1,186 @@
+{
+  "meta": {
+    "title": "Host: Aggiungere disco locale come archiviazione Proxmox | Documentazione ProxMenux",
+    "description": "Formatta un disco SATA, SAS o NVMe locale sull’host Proxmox e registralo come storage di tipo directory o pool ZFS. Include selezione sicura del disco, conferma delle operazioni distruttive, fstab basato su UUID, creazione del pool ZFS e uso di pvesm add dir / zfspool.",
+    "ogTitle": "Host: Aggiungere disco locale come archiviazione Proxmox | Documentazione ProxMenux",
+    "ogDescription": "Formatta un disco locale e registralo come storage directory o pool ZFS in Proxmox con una procedura guidata e filtri di sicurezza."
+  },
+  "header": {
+    "title": "Host: Aggiungi disco locale come archiviazione Proxmox",
+    "description": "Scegli un disco fisico sull’host Proxmox, formattalo se necessario in ext4, xfs, btrfs o zfs e registralo come storage directory con pvesm add dir oppure come pool ZFS con pvesm add zfspool. ProxMenux esclude il disco di sistema e quelli in uso e descrive ogni operazione distruttiva prima di eseguirla.",
+    "section": "Archiviazione e condivisione · Host"
+  },
+  "intro": {
+    "title": "Cosa succede?",
+    "body": "Altri strumenti <em>Host</em> in questa sezione affrontano lo storage <strong>di rete</strong> (NFS / Samba / iSCSI). Questo si occupa di dischi <strong>locali</strong> — unità di ricambio fisicamente attaccate al vostro host Proxmox che si desidera utilizzare per dischi, backup, ISO o modelli VM. ProxMenux prepara il disco (partizione + formato + montaggio) e lo registra in Proxmox in modo che l'interfaccia utente possa inserire il contenuto lì."
+  },
+  "destructive": {
+    "title": "Strumento distruttivo per il percorso 'format'",
+    "body": "La procedura <em>Formatta</em> <strong>distrugge le partizioni e i dati esistenti sul disco selezionato</strong>. ProxMenux mostra un avviso, esclude i dischi in uso e richiede conferma prima di eseguire <code>wipefs</code> / <code>sgdisk</code> / <code>mkfs</code>. Non è una sovrascrittura sicura di ogni byte. Controlla due volte il percorso del dispositivo prima di confermare."
+  },
+  "compare": {
+    "heading": "Directory o pool ZFS — quale scegliere?",
+    "headerDir": "Directory (ext4 / xfs / btrfs)",
+    "headerZfs": "Pool ZFS",
+    "rows": [
+      {
+        "label": "Tipo di stoccaggio Proxmox",
+        "dirRich": "<code>dir</code>",
+        "zfsRich": "<code>zfspool</code>"
+      },
+      {
+        "label": "Formato del disco VM",
+        "dir": "File qcow2 / raw su un file system",
+        "zfs": "Nativo ZFS dataset (zvol) per disco"
+      },
+      {
+        "label": "Istantanee",
+        "dir": "snapshot qcow2; btrfs snapshots se fs=btrfs",
+        "zfs": "Nativo, istantaneo, copia su scrittura"
+      },
+      {
+        "label": "Provisioning sottile",
+        "dir": "Sì (qcow2 default)",
+        "zfs": "Sì (ZFS default)"
+      },
+      {
+        "label": "RAM esigenze",
+        "dir": "Basso",
+        "zfs": "Elevati — ZFS usa la RAM libera come cache ARC"
+      },
+      {
+        "label": "Supporta i tipi di contenuti",
+        "dir": "images, backup, iso, vztmpl, snippets, rootdir",
+        "zfs": "solo images e rootdir (storage a blocchi)"
+      },
+      {
+        "label": "Il meglio per",
+        "dir": "Disco generico: mix di dischi VM, backup, ISO",
+        "zfs": "Pure VM / LXC disco dati con istantanee + esigenze di integrità"
+      }
+    ]
+  },
+  "opening": {
+    "heading": "Apertura dello strumento",
+    "body": "Dal menu principale di ProxMenux, aprire <strong>Storage &amp; Share Manager → Aggiungi disco locale come Proxmox Storage</strong>. Vedrete questo sub-menu con quattro opzioni:",
+    "imageAlt": "Menu Local Disk Manager — Aggiungi / Visualizza / Rimuovi / Elenca dischi disponibili"
+  },
+  "howRuns": {
+    "heading": "Come funziona lo script (Aggiungi flusso)",
+    "body": "Il flusso ha due fasi con un filtro di sicurezza con tre controlli. Fase 1 scopre dischi sicuri, decide cosa fare con quello scelto e raccoglie i parametri di archiviazione; Fase 2 fa il lavoro distruttivo. Fino alla conferma finale il disco è intatto."
+  },
+  "format": {
+    "heading": "Formattare un disco vuoto",
+    "intro": "Il percorso per un disco fresco o uno il cui contenuto non ti interessa.",
+    "items": [
+      "Scegliere il disco (sistema / dischi in uso sono nascosti).",
+      "Scegliere \"Format disk (ERASE tutti i dati)\".",
+      "Scegli il filesystem — vedi la tabella sopra per i trade-off.",
+      "ID di archiviazione (default <code>disk-&lt;device&gt;</code>), percorso di montaggio, preimpostazione del tipo di contenuto.",
+      "Conferma nel dialogo <strong>CONFERMA FINALE — I DATI SARANNO CANCELLATI</strong>.",
+      "ProxMenux cancella la tabella delle partizioni e crea una partizione sull’intero disco. Esegue <code>mkfs.&lt;fs&gt;</code> o <code>zpool create</code> e monta il risultato. I file system normali ricevono una voce UUID in <code>/etc/fstab</code> con <code>defaults,nofail</code>; ZFS usa la configurazione di montaggio del pool. Se <em>Come storage Proxmox</em> è selezionato (sempre per ZFS), viene poi registrato con <code>pvesm add dir</code> o <code>pvesm add zfspool</code>; altrimenti resta solo un montaggio dell’host."
+    ],
+    "tipTitle": "Perché UUID + nofail in /etc/fstab",
+    "tipBody": "Lo script scrive <code>UUID=… /mnt/&lt;id&gt; &lt;fs&gt; defaults,nofail 0 2</code>. UUID sopravvive al riordino del dispositivo attraverso i reboots (così <code>/dev/sdc</code> diventando <code>/dev/sdd</code> non rompe l'avvio). <code>nofail</code> significa che se il disco scomparirà mai (guasto hardware, scollegamento), Proxmox si avvia comunque — lo storage mostra solo come inattivo fino a quando il disco torna indietro."
+  },
+  "reuse": {
+    "heading": "Riutilizzare un filesystem esistente",
+    "intro": "Il percorso per un disco che si desidera mantenere i dati su — forse si è spostato da un altro host Proxmox, o il disco ha già backup / ISO che si desidera mantenere accessibile.",
+    "items": [
+      "Scegli il disco.",
+      "Scegliere \"Usa filesystem esistente\".",
+      "ID di archiviazione, percorso di montaggio, preimpostazione di tipo di contenuto.",
+      "ProxMenux <strong>non</strong> tocca i dati: crea il punto di montaggio, monta il disco, aggiunge una voce UUID a <code>/etc/fstab</code> e lo registra come archivio <code>dir</code> Proxmox."
+    ],
+    "warnTitle": "Il riutilizzo non gestisce i pool ZFS",
+    "warnBody": "Se il disco contiene già un ZFS pool, il percorso di <em>riutilizzo</em> qui cerca solo di montarlo come un filesystem regolare — che non riesce. Importare un esistente ZFS pool uso <code>zpool import &lt;name&gt;</code> sulla riga di comando e quindi registrarlo manualmente con <code>pvesm add zfspool</code>."
+  },
+  "presets": {
+    "heading": "Preimpostazioni di tipo contenuto",
+    "intro": "ProxMenux offre tre preimpostazioni e un’opzione personalizzata. La stringa di contenuto scelta viene passata a <code>pvesm add … --content &lt;csv&gt;</code>:",
+    "headerPreset": "Preimpostazione",
+    "headerContent": "stringa di contenuti",
+    "headerUse": "Caso di utilizzo",
+    "rows": [
+      {
+        "preset": "Storage VM",
+        "content": "images,backup",
+        "use": "Uno storage dedicato ai dischi delle VM che conserva anche i backup delle stesse VM."
+      },
+      {
+        "preset": "NAS standard",
+        "content": "backup,iso,vztmpl",
+        "use": "Un disco di archivio / media — backup, ISO e modelli LXC. Qui non ci sono dischi VM."
+      },
+      {
+        "preset": "Tutti i tipi",
+        "content": "images,backup,iso,vztmpl,snippets",
+        "use": "Questa preimpostazione ampia abilita immagini, backup, ISO, modelli LXC e snippet. Aggiungi altri tipi supportati, come rootdir, tramite Personalizzato se necessario."
+      },
+      {
+        "preset": "Personalizzato",
+        "content": "(ingresso libero)",
+        "useRich": "Digitare il CSV esatto da soli, ad esempio. <code>images</code> da solo, o <code>rootdir,images</code>."
+      }
+    ],
+    "zfsTitle": "ZFS pool il contenuto è più stretto",
+    "zfsBody": "Con <strong>zfs</strong>, uno <code>zfspool</code> supporta solo <code>images</code> e <code>rootdir</code>, non file ISO o backup. Inserisci una lista supportata tramite Personalizzato. Lo script la inoltra invariata; tipi non supportati possono far fallire la registrazione. Controlla poi <code>pvesm status</code>."
+  },
+  "manual": {
+    "heading": "Equivalente manuale",
+    "extIntro": "Formato + registra un disco come archiviazione directory ext4:",
+    "zfsIntro": "O come una ZFS pool:"
+  },
+  "view": {
+    "heading": "Visualizza gli archivi del disco",
+    "body": "Elenca ogni archiviazione Proxmox su disco (entrambi <code>dir</code> e <code>zfspool</code> che sono creati dall'utente — i pool di sistema come <code>rpool</code> sono nascosti). Mostra il percorso di montaggio / pool nome, tipi di contenuti e stato dal vivo."
+  },
+  "remove": {
+    "heading": "Rimuovi storage su disco",
+    "body": "Rimuove lo storage da Proxmox (<code>pvesm remove</code>) e offre la pulizia della voce corrispondente in <code>/etc/fstab</code>. Lo script <strong>non</strong> distrugge automaticamente i pool ZFS: è un passaggio separato con <code>zpool destroy &lt;name&gt;</code> da eseguire manualmente quando sei sicuro.",
+    "warnTitle": "Dati e dipendenze VM esistenti",
+    "warnBody": "La rimozione dello storage non modifica il file system o il pool: i dati restano sul disco. Tuttavia, VM e CT che lo usano tramite ID non potranno avviarsi. Prima di rimuoverlo, sposta i dischi delle VM su un altro storage o esegui un backup."
+  },
+  "list": {
+    "heading": "Elenca i dischi disponibili",
+    "body": "Una visione diagnostica di sola lettura: stampa l'output di <code>lsblk -o NAME,SIZE,TYPE,FSTYPE,MOUNTPOINT,MODEL</code> seguito dagli storage <code>dir</code> / <code>zfspool</code> già noti a Proxmox. Buona prima fermata quando si apre lo strumento e si desidera vedere \"che cosa è su questo host?\" prima di aggiungere qualcosa."
+  },
+  "troubleshoot": {
+    "heading": "Risoluzione dei problemi",
+    "noDisksTitle": "\"Nessun disco disponibile trovato\"",
+    "noDisksIntro": "Il filtro di sicurezza ha nascosto ogni disco. Motivi comuni:",
+    "noDisksItems": [
+      "Solo il disco radice è presente.",
+      "Ogni altro disco fa parte di un array attivo ZFS / LVM / RAID.",
+      "Ogni altro disco è riferito da una configurazione VM o LXC (passthrough).",
+      "Il disco è in sola lettura (guasto hardware o blocco delle scritture)."
+    ],
+    "noDisksOutro": "Usa <em>Elenca dischi disponibili</em> nel menu per vedere l’output grezzo di <code>lsblk</code> e capire cosa sta accadendo.",
+    "mountedTitle": "Formato fallisce con \"il dispositivo è montato\"",
+    "mountedBody": "Qualcosa ha montato automaticamente il disco (udisksd, un desktop manager, un'unità systemd persistente). Smontare: <code>umount /dev/sdX?*</code> o <code>systemctl stop &lt;whatever-mounts-it&gt;</code>, poi riprovare. Il filtro di sicurezza dello script dovrebbe aver nascosto i dischi montati, quindi se avete raggiunto questo errore il montaggio è avvenuto tra il menu che mostra e si conferma.",
+    "zpoolTitle": "zpool create fallisce con «invalid vdev specification»",
+    "zpoolBody": "Di solito significa che il disco ha ancora le firme GPT / LVM / ZFS stanti che <code>zpool</code> rifiuta di sovrascrivere senza forza. Lo script esegue <code>wipefs</code> e <code>sgdisk --zap-all</code> prima del formato, ma un disco molto testardo può ancora avere un'etichetta stante. Forzare una pulizia pulita manualmente: <code>zpool labelclear -f /dev/sdX</code> o <code>dd if=/dev/zero of=/dev/sdX bs=1M count=10</code> e riprovare.",
+    "inactiveTitle": "Mostra come inattivo dopo il riavvio",
+    "inactiveBody": "Controlla <code>findmnt &lt;mount-path&gt;</code>. Se il montaggio manca, qualcosa in <code>/etc/fstab</code> non ha funzionato. <code>dmesg | tail</code> di solito indica la causa: UUID non corrispondente, filesystem danneggiato o tentativo saltato in presenza di <code>nofail</code>. Dopo aver corretto la causa, <code>mount -a</code> in genere rende nuovamente disponibile lo storage."
+  },
+  "related": {
+    "heading": "Correlati",
+    "items": [
+      {
+        "href": "/docs/disk-manager/format-disk",
+        "label": "Disk Manager: Formato / Pulisci disco fisico",
+        "tail": "— alternativa di basso livello quando si desidera solo preparare un disco senza registrarlo come archiviazione Proxmox."
+      },
+      {
+        "href": "/docs/storage-share/host-iscsi",
+        "label": "Aggiungere l'obiettivo iSCSI come storage Proxmox",
+        "tail": " — equivalente di rete se il dispositivo a blocchi si trova su un’altra macchina."
+      },
+      {
+        "href": "/docs/storage-share/host-local-shared",
+        "label": "Aggiungi Directory condivisa su host",
+        "tail": " — prepara una directory sull’host per i bind mount LXC, senza registrarla come storage Proxmox."
+      }
+    ]
+  }
+}
diff --git a/web/messages/it/docs/storage-share/host-local-shared.json b/web/messages/it/docs/storage-share/host-local-shared.json
new file mode 100644
index 00000000..67338e0a
--- /dev/null
+++ b/web/messages/it/docs/storage-share/host-local-shared.json
@@ -0,0 +1,103 @@
+{
+  "meta": {
+    "title": "Host: Aggiungi directory condivisa su Host | ProxMenux Documentazione",
+    "description": "Crea una directory sull’host pronta per i bind mount LXC, con permessi compatibili sia con i container privilegiati sia con quelli non privilegiati. Usa sticky bit, permessi rwx per tutti e ACL per l’ereditarietà predefinita.",
+    "ogTitle": "Host: Aggiungi directory condivisa su Host | ProxMenux Documentazione",
+    "ogDescription": "Prepara una directory sull’host per i bind mount LXC con permessi compatibili con CT privilegiati e non privilegiati."
+  },
+  "header": {
+    "title": "Host: Aggiungi directory condivisa su Host",
+    "description": "Crea una directory sull’host da rendere accessibile a uno o più container LXC tramite bind mount. ProxMenux applica permessi compatibili con CT privilegiati e non privilegiati, senza dover allineare gli UID spostati o eseguire chown per ogni container, e registra la directory per renderla disponibile a LXC Mount Manager.",
+    "section": "Archiviazione e condivisione · Host"
+  },
+  "intro": {
+    "title": "Ciò che è (e NON è)",
+    "body": "Questo strumento <strong>non</strong> registra nulla in Proxmox (nessun <code>pvesm add</code> qui). Prepara semplicemente una directory sull'host — <code>/mnt/shared</code>, per impostazione predefinita — con autorizzazioni che qualsiasi contenitore LXC può leggere e scrivere, indipendentemente dal fatto che il CT sia privilegiato o non privilegiato. Il solito passaggio successivo è collegarlo al montaggio in ogni CT con <mountLink>LXC Mount Manager</mountLink>."
+  },
+  "why": {
+    "heading": "Perché uno strumento dedicato per questo",
+    "intro": "Quando si esegue il bind mount di una directory host in un contenitore LXC, le autorizzazioni dipendono da:",
+    "items": [
+      "Se il CT è <strong>privilegiato</strong> (UID 0 nel CT = UID 0 sull’host) o <strong>non privilegiato</strong> (UID 0 nel CT = UID 100000 sull’host, con uno spostamento di +100000).",
+      "La proprietà della directory host (un file dell’UID 1000 sull’host usa i permessi per «altri» dal punto di vista di un CT non privilegiato, poiché nessun utente del CT corrisponde a quell’UID host).",
+      "Se più CT condividono la stessa directory (le TC differenti possono avere diversi intervalli UID)."
+    ],
+    "outro": "ProxMenux usa una soluzione pratica: <strong>dare accesso a tutti</strong> a livello di filesystem, con rwx per tutti, sticky bit e ACL per l’ereditarietà dei permessi. Qualsiasi UID mappato può leggere e scrivere; non serve allineare UID/GID."
+  },
+  "howRuns": {
+    "heading": "Come funziona lo script",
+    "body": "Lo script non ha menu principale — esegue una singola azione, <strong>Crea directory condivisa</strong>. Fase 1 raccoglie il percorso di destinazione; Fase 2 crea la directory e applica autorizzazioni."
+  },
+  "bits": {
+    "heading": "Che ogni bit di autorizzazione fa",
+    "intro": "Il numero <strong>1777</strong> non è arbitrario: è la stessa modalità che utilizza Linux per <code>/tmp</code>. Tre proprietà combinate:",
+    "headerBit": "Bit",
+    "headerEffect": "Effetto",
+    "headerWhy": "Perché è importante qui",
+    "rows": [
+      {
+        "bit": "1 (sticky bit)",
+        "effect": "Solo il proprietario del file, quello della directory o un processo con privilegi sufficienti può eliminare o rinominare il file.",
+        "why": "Aiuta a impedire agli utenti con UID mappati diversi di eliminare i file altrui. Non isola CT con lo stesso UID mappato o accesso root privilegiato."
+      },
+      {
+        "bit": "777 (rwx-rwx-rwx)",
+        "effect": "Tutti possono leggere, scrivere e attraversare.",
+        "why": "Gli UID dei CT non privilegiati (100000+) usano i permessi per “altri” sull’host; rwx per tutti concede loro accesso."
+      },
+      {
+        "bit": "ACL (predefinite)",
+        "effect": "Ereditate su ogni nuovo file / subdir creato.",
+        "why": "I nuovi contenuti ereditano le ACL predefinite senza rieseguire lo script. Le applicazioni possono comunque richiedere modalità restrittive o modificare i permessi in seguito."
+      }
+    ],
+    "privTitle": "I CT privilegiati vedono lo stesso risultato, senza lo spostamento degli UID",
+    "privBody": "Per un CT privilegiato, UID 0 nel CT è UID 0 sull'host, così <code>root</code> all'interno del CT può leggere / scrivere direttamente la directory host. <code>1777</code> è ancora bene — significa solo che gli utenti non-root all'interno del CT possono anche usare la directory. Gli stessi permessi coprono entrambi i casi."
+  },
+  "where": {
+    "heading": "Dove mettere la directory condivisa",
+    "intro": "Il localizzatore offre quattro opzioni:",
+    "opt1Title": "1. Crea una nuova cartella in /mnt",
+    "opt1Body": "La solita scelta. ProxMenux suggerisce automaticamente il primo nome libero (<code>shared</code>, <code>shared2</code>, <code>shared3</code>, ...). Basta confermare o digitare un nome diverso.",
+    "opt2Title": "2. Inserisci il percorso personalizzato",
+    "opt2Body": "Per le directory al di fuori di <code>/mnt</code>. Qualsiasi percorso assoluto funziona (ad es. <code>/srv/media</code>, <code>/data/family</code>). Lo script applica le stesse autorizzazioni.",
+    "opt3Title": "3. Visualizza le cartelle esistenti in /mnt",
+    "opt3Body": "Diagnostica di sola lettura: elenca ogni directory sotto <code>/mnt</code> con le sue autorizzazioni, proprietario e spazio disponibile. Utile prima di creare un nuovo per evitare collisioni di nome.",
+    "opt4Title": "4. Annulla",
+    "opt4Body": "Esce senza creare nulla, come premendo <kbd>Esc</kbd>.",
+    "tipTitle": "Dove vive /mnt?",
+    "tipBody": "Per impostazione predefinita <code>/mnt</code> siede sul filesystem Proxmox root. Se si desidera la directory condivisa su un disco diverso (un disco di dati, un ZFS pool), montare il disco sotto <code>/mnt/&lt;name&gt;</code> primo (Disk Manager o <diskLink>Aggiungere il disco locale come archiviazione Proxmox</diskLink>), e quindi creare la directory condivisa come una sottocartella all'interno di esso — o scegliere \"Inserisci percorso personalizzato\" qui e puntare al disco montato."
+  },
+  "manual": {
+    "heading": "Equivalente manuale",
+    "body": "L'intero flusso può essere riprodotto a mano:"
+  },
+  "next": {
+    "heading": "Passaggio successivo: bind mount nei container",
+    "body": "La creazione della directory la prepara solo: nessun contenitore la vede ancora. Per renderlo visibile all'interno di uno o più LXC, utilizzare <mountLink>LXC Mount Manager</mountLink> per collegare il montaggio <code>/mnt/&lt;name&gt;</code> ai CT. Poiché i permessi sono già aperti, Mount Manager <strong>non</strong> offrirà di modificarli: la directory è pronta per l'uso così com'è."
+  },
+  "troubleshoot": {
+    "heading": "Risoluzione dei problemi",
+    "mkdirTitle": "\"Failed to create directory\"",
+    "mkdirBody": "Di solito un problema filesystem: <code>/mnt</code> è su un filesystem di sola lettura, il percorso contiene un componente che non è una directory (ad esempio digitato <code>/etc/passwd/sub</code>), o disco è pieno. Controllare con <code>df -h /mnt</code> e <code>mount | grep /mnt</code>.",
+    "writeTitle": "Container non può scrivere nonostante le autorizzazioni aperte",
+    "writeBody": "Verifica che il CT stia realmente usando il bind mount con <code>pct config &lt;ctid&gt; | grep ^mp</code>. Nel CT esegui <code>touch /mnt/data/test-$(date +%s)</code>. Se ricevi un errore di accesso negato, la directory potrebbe trovarsi su un filesystem dell’host che non rispetta le ACL, come alcune vecchie configurazioni <code>ext3</code> o <code>vfat</code>. Sposta la directory condivisa su un filesystem ext4, xfs, btrfs o zfs.",
+    "aclTitle": "ACL comanda silenziosamente non disponibile",
+    "aclBody": "In un’installazione minima di Proxmox, <code>setfacl</code> / <code>getfacl</code> potrebbero non essere installati. Lo script ricade con grazia (controllo <code>command -v setfacl</code>) e applica solo le autorizzazioni POSIX — che è spesso abbastanza, ma i nuovi file non erediteranno automaticamente il profilo permissivo. Installare <code>acl</code> con <code>apt-get install -y acl</code> e eseguire nuovamente lo script nella directory."
+  },
+  "related": {
+    "heading": "Correlati",
+    "items": [
+      {
+        "href": "/docs/storage-share/lxc-mount-points",
+        "label": "Gestore montaggi LXC",
+        "tail": "— il passo successivo naturale: legare-montare questa directory in uno o più contenitori."
+      },
+      {
+        "href": "/docs/storage-share/host-local-disk",
+        "label": "Aggiungere disco locale come archiviazione Proxmox",
+        "tailRich": "— se si desidera la directory condivisa su un disco dedicato, preparare il disco prima, montarlo sotto <code>/mnt</code>, quindi creare la sottocartella condivisa qui."
+      }
+    ]
+  }
+}
diff --git a/web/messages/it/docs/storage-share/host-nfs.json b/web/messages/it/docs/storage-share/host-nfs.json
new file mode 100644
index 00000000..47dd3b19
--- /dev/null
+++ b/web/messages/it/docs/storage-share/host-nfs.json
@@ -0,0 +1,174 @@
+{
+  "meta": {
+    "title": "Host: monta condivisione NFS sull’host | Documentazione ProxMenux",
+    "description": "Monta un’esportazione NFS esterna sull’host Proxmox come storage Proxmox tramite pvesm add nfs, come semplice montaggio fstab sull’host non visibile in Datacenter > Storage oppure in entrambi i modi. Il metodo fstab è adatto a condividere il percorso con i container LXC tramite bind mount senza registrarlo come storage Proxmox.",
+    "ogTitle": "Host: monta condivisione NFS sull’host | Documentazione ProxMenux",
+    "ogDescription": "Monta un’esportazione NFS esterna sull’host Proxmox tramite pvesm, fstab o entrambi. La modalità fstab è adatta ai bind mount LXC."
+  },
+  "header": {
+    "title": "Host: monta condivisione NFS sull’host",
+    "description": "Monta sull’host Proxmox un’esportazione NFS proveniente da un NAS, un altro server o una condivisione del tuo homelab. Puoi registrarla come storage Proxmox visibile in Datacenter > Storage, aggiungere un montaggio tramite /etc/fstab in un percorso a scelta oppure usare entrambi i metodi. Il percorso separato è utile per i bind mount nei container LXC senza registrare uno storage Proxmox.",
+    "section": "Archiviazione e condivisione · Host"
+  },
+  "intro": {
+    "title": "Cosa succede?",
+    "body": "ProxMenux offre due metodi per montare un’esportazione NFS: <strong>(1) Storage Proxmox</strong> tramite <code>pvesm add nfs</code>. La condivisione compare in Datacenter > Storage e Proxmox gestisce il montaggio in <code>/mnt/pve/&lt;id&gt;</code>. <strong>(2) Montaggio fstab sull’host</strong> in un percorso a scelta, reso permanente tramite <code>/etc/fstab</code>. Non compare come storage Proxmox ed è adatto ai bind mount nei container LXC, senza aggiungere voci nell’interfaccia Proxmox. Puoi usare uno dei due metodi oppure entrambi."
+  },
+  "opening": {
+    "heading": "Apertura dello strumento",
+    "body": "Dal menu principale di ProxMenux, apri <strong>Storage &amp; Share Manager → Mount NFS Share on Host</strong>. Il sottomenu presenta quattro opzioni:",
+    "imageAlt": "Menu NFS host — Monta / Visualizza / Rimuovi / Testa connettività"
+  },
+  "howRuns": {
+    "heading": "Come funziona lo script",
+    "body": "Il flusso ha due fasi con chiara separazione tra \"scoprire, validare e scegliere\" e \"montare effettivamente e scrivere la configurazione\". Dopo aver selezionato un'esportazione, scegli il metodo di montaggio (s) tramite una lista di controllo; il resto delle finestre di dialogo chiede solo params per i metodi selezionati. Fino alla conferma finale, non si toccano né <code>/etc/pve/storage.cfg</code> né <code>/etc/fstab</code>."
+  },
+  "modes": {
+    "heading": "Selezione del metodo di montaggio (una o entrambe le opzioni)",
+    "intro": "Dopo aver selezionato e convalidato l'esportazione, ProxMenux mostra una lista di controllo con i due metodi di montaggio. Puoi selezionare uno o entrambi. Se si preme OK senza marcare nulla, la finestra di dialogo riappare fino a quando si sceglie almeno una opzione o premere Annulla per uscire dal flusso.",
+    "imageAlt": "Elenco di controllo del metodo di montaggio con opzioni pvesm e fstab",
+    "headerMethod": "Metodo",
+    "headerMount": "Percorso di montaggio",
+    "headerUi": "Visibile in Datacenter > Storage",
+    "headerUseCase": "Caso di uso tipico",
+    "rows": [
+      {
+        "method": "<strong>Come storage Proxmox (pvesm)</strong>",
+        "mountRich": "<code>/mnt/pve/&lt;storage-id&gt;</code> (gestito da Proxmox)",
+        "ui": "Sì",
+        "useCase": "VM immagini disco, backup, ISO, modelli LXC — tutto ciò che deve apparire nell'interfaccia utente Proxmox."
+      },
+      {
+        "method": "<strong>Solo fstab dell'host</strong>",
+        "mountRich": "<code>/mnt/&lt;path&gt;</code> (si sceglie il percorso)",
+        "ui": "No",
+        "useCaseRich": "Collega la condivisione a uno o più LXC tramite bind mount <em>senza</em> registrarla come storage Proxmox. Mantiene ordinata l’interfaccia Datacenter."
+      },
+      {
+        "method": "<strong>Entrambi</strong>",
+        "mount": "Entrambi i percorsi sopra (due punti di montaggio della stessa esportazione NFS)",
+        "ui": "Sì",
+        "useCase": "Integrazione nell’interfaccia e percorso stabile separato sull’host con permessi aperti per bind mount LXC."
+      }
+    ],
+    "bothTitle": "“Entrambi” crea due montaggi NFS indipendenti",
+    "bothBody": "I due metodi vengono eseguiti separatamente: pvesm monta in <code>/mnt/pve/&lt;id&gt;</code> e fstab in <code>/mnt/&lt;path&gt;</code>. Si ottiene un montaggio gestito da Proxmox con opzioni predefinite e un montaggio host separato per bind mount LXC. Due punti di montaggio non garantiscono due connessioni TCP: il client NFS può riutilizzare le connessioni di trasporto."
+  },
+  "pvesmBranch": {
+    "heading": "Metodo A — Come stoccaggio Proxmox (pvesm)",
+    "intro": "Se è selezionato <em>Come storage Proxmox</em>, ProxMenux esegue la procedura pvesm originale:",
+    "items": [
+      "<strong>Storage ID</strong> — ciò che Proxmox chiamerà questo storage. Predefinito è <code>nfs-&lt;server-ip-with-dashes&gt;</code>. Sono accettate solo lettere, cifre, <code>-</code> e <code>_</code>.",
+      "<strong>Content type</strong> — Proxmox lega le categorie di contenuti ai volumi di archiviazione; selezionare ciò che questo NFS è permesso di tenere:"
+    ],
+    "headerType": "Tipo di contenuto",
+    "headerAllows": "Cosa permette",
+    "rows": [
+      {
+        "type": "import",
+        "allowsRich": "Importazioni dell'immagine del disco (selezionate per impostazione predefinita). Necessità di <em>Import Disk Image a VM</em>."
+      },
+      {
+        "type": "backup",
+        "allowsRich": "File di backup VM e CT (<code>vzdump</code>)."
+      },
+      {
+        "type": "iso",
+        "allows": "Installazione immagini ISO."
+      },
+      {
+        "type": "vztmpl",
+        "allows": "Modelli LXC."
+      },
+      {
+        "type": "images",
+        "allows": "Immagini disco delle VM in uso: rende NFS uno storage per dischi VM."
+      },
+      {
+        "type": "rootdir",
+        "allows": "File system radice LXC (rari su NFS — leggi la nota sotto)."
+      },
+      {
+        "type": "snippets",
+        "allows": "Script hook e frammenti cloud-init."
+      }
+    ],
+    "warnTitle": "images e rootdir su NFS",
+    "warnBody": "Selezionando <code>images</code> puoi archiviare dischi VM su NFS. Le prestazioni dipendono da rete, server e carico; un’interruzione può bloccare l’I/O che dipende dal montaggio. <code>rootdir</code> archivia file system radice LXC su NFS, dove i container non privilegiati possono incontrare limiti di mappatura UID, overlay e proprietà. Valuta questi requisiti prima di collocarvi <code>images</code> / <code>rootdir</code>; NFS è utile anche per <code>backup</code> / <code>iso</code> / <code>vztmpl</code>.",
+    "result": "Il risultato è <code>pvesm add nfs &lt;id&gt; --server &lt;srv&gt; --export &lt;path&gt; --content &lt;csv&gt;</code> e Proxmox auto-mount a <code>/mnt/pve/&lt;id&gt;</code>."
+  },
+  "fstabBranch": {
+    "heading": "Metodo B — solo montaggio tramite fstab sull’host",
+    "intro": "Se <em>Solo montaggio fstab sull’host</em> è contrassegnato, ProxMenux chiede un percorso di montaggio host e opzioni persistenti, quindi monta e scrive l'ingresso a <code>/etc/fstab</code>:",
+    "items": [
+      "<strong>Percorso di montaggio sull’host</strong> — default <code>/mnt/&lt;export-basename&gt;</code>. Dev'essere un percorso assoluto. Se qualcosa è già montato là, o una voce fstab esiste per lo stesso percorso, ProxMenux vi avverte e le offerte per sostituirlo.",
+      "<strong>Opzioni di montaggio</strong> — <em>Lettura/scrittura</em> (predefinito: <code>rw,hard,nofail,_netdev,rsize=131072,wsize=131072,timeo=600,retrans=2</code>), <em>Sola lettura</em>, <em>Personalizzato</em> (inserisci le tue opzioni)."
+    ],
+    "appliesIntro": "Dopo la conferma, lo script:",
+    "applies": [
+      "<code>mkdir -p</code> il percorso di montaggio.",
+      "<code>mount -t nfs -o &lt;opts&gt; &lt;srv&gt;:&lt;export&gt; &lt;path&gt;</code>.",
+      "Scrive una voce di una linea a <code>/etc/fstab</code>: <code>&lt;srv&gt;:&lt;export&gt; &lt;path&gt; nfs &lt;opts&gt; 0 0</code>.",
+      "Esegue <code>systemctl daemon-reload</code> così systemd raccoglie la nuova voce fstab.",
+      "Tenta <code>chmod 1777</code> e <code>setfacl o::rwx</code> sul punto di montaggio, ignorando gli eventuali errori. Riesce solo se il server NFS lo permette; molte esportazioni NAS consentono già la scrittura a tutti gli utenti."
+    ],
+    "lxcTitle": "Usare da un LXC il filesystem montato tramite fstab",
+    "lxcBody": "Lo script mostra un comando <code>pct set</code> per un bind mount, ad esempio <code>pct set &lt;ctid&gt; -mp0 /mnt/&lt;path&gt;,mp=/mnt/&lt;ct-path&gt;,shared=1,backup=0</code>. In alternativa, <mountLink>LXC Mount Manager</mountLink> rileva i montaggi fstab. <strong>Non viene modificato nulla nel container</strong>. L’accesso di un CT non privilegiato dipende dai permessi sul server per i suoi UID/GID mappati. Lo script tenta solo modifiche ai permessi dall’host e non garantisce esportazioni scrivibili o impostazioni predefinite dei produttori. Se l’accesso fallisce, consulta Risoluzione dei problemi.",
+    "noUiTitle": "Il montaggio tramite fstab NON è uno storage Proxmox",
+    "noUiBody": "Il montaggio tramite fstab sull’host rimane intenzionalmente invisibile nell’interfaccia web Proxmox. Non compare in <em>Datacenter > Storage</em>, non è selezionabile durante la creazione di VM o CT e non può essere scelto come destinazione dei processi di backup Proxmox. È soltanto un percorso nel filesystem dell’host. Per avere anche l’integrazione nell’interfaccia, seleziona <em>entrambi</em> i metodi."
+  },
+  "manual": {
+    "heading": "Equivalente manuale",
+    "pvesmIntro": "Il metodo A (pvesm) corrisponde a:",
+    "fstabIntro": "Il metodo B (fstab) corrisponde a:"
+  },
+  "view": {
+    "heading": "Visualizzare gli archivi NFS configurati",
+    "body": "Elenca tutte le voci NFS registrate in Proxmox (<code>pvesm status | awk ''$2 == \"nfs\"''</code>) con server, esportazione, tipi di contenuto, percorso e stato attuale del montaggio. <strong>Nota:</strong> questa vista mostra solo gli storage registrati tramite pvesm. I montaggi configurati soltanto in fstab non compaiono; controllali con <code>findmnt -t nfs</code> o <code>grep nfs /etc/fstab</code>."
+  },
+  "remove": {
+    "heading": "Rimuovere lo storage NFS",
+    "body": "Esegue <code>pvesm remove &lt;storage-id&gt;</code> dopo una conferma che mostra il server / esportazione / contenuto. Solo la registrazione sul lato Proxmox viene rimossa — <strong> il server NFS remoto non viene mai toccato</strong>, nessun file viene eliminato. Per rimuovere un montaggio solo fstab, modificare <code>/etc/fstab</code> a mano ed eseguire <code>umount &lt;path&gt;</code>.",
+    "warnTitle": "Prima esegui il backup delle dipendenze",
+    "warnBody": "Se VM, CT o lavori di backup fanno ancora riferimento a questo storage (da ID), rimuoverlo li lascia puntare in uno storage non più disponibile. Proxmox segnalerà l’errore ma non ripulirà. Spostare o rilasciare i riferimenti prima, quindi rimuovere lo storage."
+  },
+  "test": {
+    "heading": "Test di connettività NFS",
+    "body": "Esegue un passaggio diagnostico su ogni storage NFS registrato in Proxmox: controlla che <code>showmount</code> è disponibile, che <code>rpcbind</code> è in esecuzione, pings ogni server, sonde porta 2049, chiama <code>showmount -e</code>, e infine segnala la propria vista di Proxmox (<code>pvesm status</code>). Buona prima fermata quando uno storage mostra come <em>inactive</em> nell'interfaccia Proxmox."
+  },
+  "troubleshoot": {
+    "heading": "Risoluzione dei problemi",
+    "noServersTitle": "\"Nessun server NFS trovato sulla rete\"",
+    "noServersBody": "Auto-scoprimento utilizza <code>nmap -p 2049 --open &lt;subnet&gt;/24</code>. Il server non può rispondere se: è su una diversa VLAN / subnet, il suo firewall blocca nmap sonde (molti fanno) o la porta 2049 è volutamente chiusa su quell'interfaccia. Utilizzare l'opzione <em>Manual</em> con IP o hostname del server.",
+    "portTitle": "«La porta NFS (2049) non è accessibile»",
+    "portBody": "Ping riuscì ma <code>nc -z -w 3 &lt;server&gt; 2049</code> fallì. Controllare il servizio NFS è in esecuzione sul server (<code>systemctl status nfs-server</code> su Linux, Pannello di controllo → File Services on Synology, NFS plugin su OMV / TrueNAS), e che il firewall consente 2049 dall'host Proxmox.",
+    "showmountTitle": "\"Failed to connect\" da showmount",
+    "showmountBody": "Il server ha rifiutato la query della lista delle esportazioni. Cause comuni: il server applica il client rigoroso ACLs (il vostro IP Proxmox non è nell'elenco consentito), <code>rpcbind</code> non è in esecuzione sul server, o il server espone solo NFSv4 con <code>showmount</code> disabilitato. Il percorso di esportazione può ancora essere aggiunto manualmente se lo conosci.",
+    "inactiveTitle": "Lo stoccaggio mostra come inattivo nell'UI Proxmox",
+    "inactiveBody": "Esegui prima <em>Testa connettività NFS</em>: verifica che il server risponda al ping, che la porta 2049 sia aperta e che l’elenco delle esportazioni (<code>showmount -e</code>) sia disponibile. Se la connessione funziona ma lo storage rimane inattivo, controlla <code>journalctl -u pvestatd</code> e la configurazione server/esportazione. Ripristina prima connessione o permessi. <code>pvesm set &lt;id&gt; --disable 0</code> abilita uno storage disabilitato; non è una riparazione generica di NFS.",
+    "lxcNoWriteTitle": "Il montaggio fstab funziona ma il LXC non privilegiato non può scrivere tramite bind mount",
+    "lxcNoWriteBody": "L’accesso NFS dipende da proprietari, ACL e squash sul server. Le opzioni CIFS <code>uid=</code> e <code>file_mode=</code> <strong>non</strong> si applicano a NFS. Con la mappatura LXC predefinita, root nel CT diventa UID 100000 sull’host, non UID remoto 0. Configura l’accesso per l’UID/GID mappato effettivo o l’identità anonima del server. <code>no_root_squash</code> riguarda solo l’UID remoto 0 e non risolve ogni caso di UID 100000. Lo script tenta <code>chmod 1777</code> ma non aggira i permessi del server.",
+    "fstabBootTitle": "fstab mount non arriva dopo il riavvio",
+    "fstabBootBody": "Lo script aggiunge <code>nofail,_netdev</code> quindi una parte mancante all'avvio non blocca l'avvio. Se il montaggio non arriva mai: confermare la rete è raggiungibile (<code>ping &lt;server&gt;</code>), controllare <code>journalctl -u remote-fs.target</code>, e verificare che l'ingresso sia valido con <code>mount -fav | grep nfs</code>. <code>mount -a</code> dopo il boot monta tutto ciò che attualmente manca."
+  },
+  "related": {
+    "heading": "Correlati",
+    "items": [
+      {
+        "href": "/docs/storage-share/host-samba",
+        "label": "Samba / CIFS come storage Proxmox",
+        "tail": "— stesso modello di flusso (Method A pvesm + Metodo B fstab) per le condivisioni SMB/CIFS."
+      },
+      {
+        "href": "/docs/storage-share/lxc-mount-points",
+        "label": "Gestore montaggi LXC",
+        "tailRich": "— eseguire il bind mount del percorso <code>/mnt/&lt;path&gt;</code> in uno o più contenitori."
+      },
+      {
+        "href": "/docs/storage-share/lxc-nfs-client",
+        "label": "client NFS in LXC",
+        "tail": "— alternativa: montare NFS direttamente dall'interno di un contenitore privilegiato (senza passare dall’host)."
+      }
+    ]
+  }
+}
diff --git a/web/messages/it/docs/storage-share/host-samba.json b/web/messages/it/docs/storage-share/host-samba.json
new file mode 100644
index 00000000..7d820d08
--- /dev/null
+++ b/web/messages/it/docs/storage-share/host-samba.json
@@ -0,0 +1,172 @@
+{
+  "meta": {
+    "title": "Host: monta condivisione Samba sull’host | Documentazione ProxMenux",
+    "description": "Monta una condivisione Samba o CIFS esterna sull’host Proxmox come storage Proxmox tramite pvesm add cifs, come montaggio fstab con opzioni uid/gid/file_mode aperte non visibile in Datacenter > Storage oppure in entrambi i modi. Il metodo fstab consente a un LXC non privilegiato di leggere e scrivere tramite bind mount, senza modifiche all’interno del container.",
+    "ogTitle": "Host: monta condivisione Samba sull’host | Documentazione ProxMenux",
+    "ogDescription": "Monta una condivisione Samba / CIFS esterna sull’host Proxmox tramite pvesm, fstab con permessi aperti per bind mount LXC o entrambi."
+  },
+  "header": {
+    "title": "Host: monta condivisione Samba sull’host",
+    "description": "Monta sull’host Proxmox una condivisione Samba esterna (SMB / CIFS) proveniente da un NAS, un PC Windows o un’esportazione SMB TrueNAS. Puoi registrarla come storage Proxmox visibile in Datacenter > Storage, aggiungere un montaggio tramite /etc/fstab in un percorso a scelta oppure usare entrambi i metodi. Le opzioni uid/gid/file_mode aperte consentono agli LXC non privilegiati di leggere e scrivere tramite bind mount, senza modifiche nel container.",
+    "section": "Archiviazione e condivisione · Host"
+  },
+  "intro": {
+    "title": "Cosa succede?",
+    "body": "ProxMenux offre due metodi per una condivisione Samba: <strong>(1) Storage Proxmox</strong> tramite <code>pvesm add cifs</code>, visibile in Datacenter > Storage e montato su <code>/mnt/pve/&lt;id&gt;</code>. La password è salvata in chiaro in <code>/etc/pve/priv/storage/&lt;id&gt;.pw</code>, protetta dalla directory privata accessibile solo a root: è controllo degli accessi, non cifratura. <strong>(2) Mount fstab dell’host</strong> su un percorso scelto, persistente tramite <code>/etc/fstab</code> e montato con <code>uid=0,gid=0,file_mode=0777,dir_mode=0777</code> per consentire la scrittura ai bind mount degli LXC non privilegiati. Le credenziali sono in un file riservato a root sotto <code>/etc/samba/credentials/</code>, mai direttamente in <code>fstab</code>. Puoi usare un metodo o entrambi."
+  },
+  "opening": {
+    "heading": "Apertura dello strumento",
+    "body": "Dal menu principale di ProxMenux, apri <strong>Storage &amp; Share Manager → Mount Samba Share on Host</strong>. Il sottomenu presenta quattro opzioni:",
+    "imageAlt": "Menu Samba host — Monta / Visualizza / Rimuovi / Testa connettività"
+  },
+  "howRuns": {
+    "heading": "Come funziona lo script",
+    "body": "Il flusso ha due fasi. Fase 1: scopri il server, convalida le credenziali, scegli la condivisione, quindi scegli il metodo di montaggio (s) tramite una lista di controllo. Fase 2: vengono eseguiti solo i metodi contrassegnati. Le credenziali sono necessarie fin dall’inizio perché <code>smbclient</code> ha bisogno di loro per elencare le condivisioni. Fino alla conferma finale, né <code>/etc/pve/storage.cfg</code> né <code>/etc/fstab</code> sono toccati."
+  },
+  "modes": {
+    "heading": "Selezione del metodo di montaggio (una o entrambe le opzioni)",
+    "intro": "Dopo aver selezionato la condivisione e convalidare le credenziali, ProxMenux mostra una lista di controllo con i due metodi di montaggio. Puoi selezionare uno o entrambi. Se si preme OK senza marcare nulla, la finestra di dialogo riappare fino a quando si sceglie almeno una opzione o premere Annulla per uscire dal flusso.",
+    "headerMethod": "Metodo",
+    "headerMount": "Percorso di montaggio",
+    "headerUi": "Visibile in Datacenter > Storage",
+    "headerUseCase": "Caso di uso tipico",
+    "rows": [
+      {
+        "method": "<strong>Come storage Proxmox (pvesm)</strong>",
+        "mountRich": "<code>/mnt/pve/&lt;storage-id&gt;</code> (gestito da Proxmox)",
+        "ui": "Sì",
+        "useCase": "Backup, ISO, modelli LXC — tutto ciò che deve apparire nell'interfaccia utente Proxmox. Live VM dischi sono tecnicamente supportati ma scoraggiati su CIFS (bloccando semantica)."
+      },
+      {
+        "method": "<strong>Solo fstab dell'host</strong>",
+        "mountRich": "<code>/mnt/&lt;path&gt;</code> con uid aperto/gid/file_mode",
+        "ui": "No",
+        "useCaseRich": "Collega la condivisione ai LXC tramite bind mount <em>senza</em> registrare uno storage Proxmox. I permessi locali aperti facilitano l’accesso dei CT non privilegiati, ma il server SMB deve comunque consentire la scrittura all’utente autenticato."
+      },
+      {
+        "method": "<strong>Entrambi</strong>",
+        "mount": "Entrambi i percorsi sopra (due punti di montaggio della stessa esportazione CIFS)",
+        "ui": "Sì",
+        "useCase": "Vuoi sia l’integrazione nell’interfaccia sia un percorso stabile sull’host con permessi aperti per i bind mount LXC. Il montaggio tramite pvesm usa i valori predefiniti di Proxmox; quello tramite fstab applica separatamente le opzioni uid/gid/file_mode aperte."
+      }
+    ],
+    "bothTitle": "«Entrambi» crea due punti di montaggio CIFS",
+    "bothBody": "pvesm monta in <code>/mnt/pve/&lt;id&gt;</code> con le opzioni Proxmox predefinite. fstab monta in <code>/mnt/&lt;path&gt;</code> con <code>uid=0,gid=0,file_mode=0777,dir_mode=0777</code> per l’accesso locale tramite bind mount LXC. Il server SMB applica comunque i permessi dell’utente del montaggio. Due punti di montaggio non garantiscono due connessioni TCP separate."
+  },
+  "pvesmBranch": {
+    "heading": "Metodo A — Come stoccaggio Proxmox (pvesm)",
+    "intro": "Se è selezionato <em>Come storage Proxmox</em>, ProxMenux esegue la procedura pvesm originale:",
+    "items": [
+      "<strong>Storage ID</strong> — default <code>cifs-&lt;server-ip-with-dashes&gt;</code>. Solo lettere, cifre, <code>-</code> e <code>_</code>.",
+      "<strong>Tipi di contenuto</strong> — questa lista ProxMenux offre <strong>6</strong> opzioni. Omette <code>rootdir</code> rispetto a NFS: è una scelta dello script, non significa che ogni versione del backend CIFS Proxmox vieti i file system radice LXC:"
+    ],
+    "headerType": "Tipo di contenuto",
+    "headerAllows": "Cosa permette",
+    "rows": [
+      {
+        "type": "import",
+        "allows": "Importazioni dell'immagine del disco (selezionate per impostazione predefinita)."
+      },
+      {
+        "type": "backup",
+        "allowsRich": "File di backup VM e CT (<code>vzdump</code>)."
+      },
+      {
+        "type": "iso",
+        "allows": "Installazione immagini ISO."
+      },
+      {
+        "type": "vztmpl",
+        "allows": "Modelli LXC."
+      },
+      {
+        "type": "images",
+        "allowsRich": "Immagini disco delle VM in uso — <strong>avviso nel dialogo</strong>, vedi sotto."
+      },
+      {
+        "type": "snippets",
+        "allows": "Script hook e frammenti cloud-init."
+      }
+    ],
+    "warnTitle": "Live dischi VM su CIFS",
+    "warnBody": "Selezionare <code>images</code> attiva un avviso ProxMenux: CIFS/SMB può causare problemi di blocco nelle operazioni sui dischi VM. Lo script consiglia NFS ma consente di continuare. Backup e ISO sono usi comuni di CIFS. Valuta blocchi, snapshot, migrazione e carico prima di usare CIFS per <code>images</code>.",
+    "credsTitle": "Dove pvesm memorizza le credenziali",
+    "credsBody": "La password non è scritta in <code>/etc/pve/storage.cfg</code>. Proxmox salva credenziali in chiaro in <code>/etc/pve/priv/storage/&lt;storage-id&gt;.pw</code>, nell’area privata del file system del cluster, leggibile solo da <code>root</code> (modalità <code>0600</code>); sono protette dai permessi di accesso, non dalla cifratura. Dopo un cambio password sul server usa <code>pvesm set &lt;id&gt; --password &lt;new&gt;</code> oppure rimuovi e aggiungi lo storage tramite ProxMenux."
+  },
+  "fstabBranch": {
+    "heading": "Metodo B — solo montaggio tramite fstab sull’host",
+    "intro": "Se è selezionato <em>Solo montaggio fstab sull’host</em>, ProxMenux chiede percorso e opzioni persistenti, crea un file di credenziali riservato a root in modalità utente, quindi monta la condivisione e scrive la voce in <code>/etc/fstab</code>:",
+    "items": [
+      "<strong>Percorso di montaggio sull’host</strong> — default <code>/mnt/&lt;share-name&gt;</code>. Dev'essere un percorso assoluto. Se qualcosa è già montato là, o una voce fstab esiste, ProxMenux offre per sostituirla.",
+      "<strong>Opzioni di montaggio</strong> — <em>Lettura/scrittura</em> (predefinito: <code>rw,uid=0,gid=0,file_mode=0777,dir_mode=0777,iocharset=utf8,nofail,_netdev</code>), <em>Sola lettura</em> (<code>file_mode=0555,dir_mode=0555</code>), <em>Personalizzato</em> (inserisci le tue opzioni). Lo script consiglia uid/gid/file_mode aperti per scrivere tramite bind mount LXC."
+    ],
+    "credsTitle": "File Credenziali (Modalità utente)",
+    "credsBody": "In modalità utente, ProxMenux crea un file di credenziali riservato a root in <code>/etc/samba/credentials/&lt;server&gt;_&lt;share&gt;.cred</code> (modalità <code>0600</code>) con righe <code>username=</code> e <code>password=</code>. La voce fstab lo richiama tramite <code>credentials=</code>: la password in chiaro non compare in <code>/etc/fstab</code>. In modalità ospite viene aggiunto <code>guest</code> e non viene creato alcun file di credenziali.",
+    "appliesIntro": "Dopo la conferma, lo script:",
+    "applies": [
+      "<code>mkdir -p</code> il percorso di montaggio.",
+      "<code>mount -t cifs -o &lt;opts&gt;,credentials=&lt;file&gt;</code> (o <code>guest</code>) <code>//&lt;srv&gt;/&lt;share&gt; &lt;path&gt;</code>.",
+      "Scrive una voce di una linea a <code>/etc/fstab</code>: <code>//&lt;srv&gt;/&lt;share&gt; &lt;path&gt; cifs &lt;opts&gt; 0 0</code>.",
+      "Esegue <code>systemctl daemon-reload</code> così systemd raccoglie la nuova voce fstab."
+    ],
+    "lxcTitle": "Usare da un LXC non privilegiato il filesystem montato tramite fstab",
+    "lxcBody": "Le opzioni CIFS <code>uid=0,gid=0,file_mode=0777,dir_mode=0777</code> aprono i controlli locali dei permessi per bind mount LXC. ACL del server e semantica Unix/POSIX negoziata possono ancora influire sull’accesso. <strong>Non viene modificato nulla nel container</strong>: nessun <code>chown</code> nel CT, gruppi o modifiche a <code>/etc/lxc</code>. La riga <code>mp</code> è gestita nella configurazione Proxmox del CT. Usa il comando <code>pct set</code> mostrato o <mountLink>LXC Mount Manager</mountLink>.",
+    "noUiTitle": "Il montaggio tramite fstab NON è uno storage Proxmox",
+    "noUiBody": "Il montaggio tramite fstab sull’host rimane intenzionalmente invisibile nell’interfaccia web Proxmox. Non compare in <em>Datacenter > Storage</em>, non è selezionabile durante la creazione di VM o CT e non può essere scelto come destinazione dei processi di backup Proxmox. È soltanto un percorso nel filesystem dell’host. Per avere anche l’integrazione nell’interfaccia, seleziona <em>entrambi</em> i metodi."
+  },
+  "manual": {
+    "heading": "Equivalente manuale",
+    "pvesmIntro": "Il metodo A (pvesm) corrisponde a:",
+    "fstabUserIntro": "Metodo B (fstab, user auth) — file credenziali + montaggio:",
+    "fstabGuestIntro": "Metodo B (fstab, guest auth) — nessun file di credenziali:"
+  },
+  "view": {
+    "heading": "Visualizza storage CIFS e montaggi host",
+    "body": "Mostra gli storage CIFS registrati (<code>pvesm status | awk ''$2 == \"cifs\"''</code>) con server, condivisione, contenuto, utente o <em>Ospite</em>, percorso e stato. Le password <strong>non vengono mai mostrate</strong>. <strong>Nota:</strong> una seconda sezione elenca montaggi fstab host, opzioni, percorso del file di credenziali e stato attivo/inattivo. Verifica manualmente con <code>findmnt -t cifs</code> o <code>grep cifs /etc/fstab</code>."
+  },
+  "remove": {
+    "heading": "Rimuovi storage CIFS o montaggio host",
+    "body": "Il selettore offre storage pvesm e montaggi fstab host. Per pvesm esegue <code>pvesm remove &lt;storage-id&gt;</code> e Proxmox rimuove le credenziali associate. Per fstab tenta <code>umount &lt;path&gt;</code>, rimuove la voce da <code>/etc/fstab</code> e le credenziali in <code>/etc/samba/credentials/</code>, poi la directory vuota se possibile. Se lo smontaggio fallisce, serve uno smontaggio manuale o un riavvio. <strong>Il server Samba remoto e i suoi file non vengono modificati</strong>.",
+    "warnTitle": "Prima esegui il backup delle dipendenze",
+    "warnBody": "VM, CT o processi di backup che fanno riferimento a questo ID di storage non funzioneranno dopo la rimozione. Sposta o elimina quei riferimenti prima di rimuovere lo storage."
+  },
+  "test": {
+    "heading": "Prova la connettività Samba",
+    "body": "Diagnostica ogni storage CIFS registrato in Proxmox: verifica la presenza di <code>smbclient</code>, prova ping e porte 445/139, tenta un elenco come ospite e mostra lo stato secondo Proxmox (<code>pvesm status</code>). «Autenticazione richiesta» nel test ospite significa che il server espone le condivisioni solo agli utenti autenticati, come nella maggior parte dei NAS."
+  },
+  "troubleshoot": {
+    "heading": "Risoluzione dei problemi",
+    "noServersTitle": "\"Nessun server Samba trovato sulla rete\"",
+    "noServersBody": "Auto-scoprimento utilizza <code>nmap -p 139,445</code>. Il server può essere su una subnet diversa, firewalled, o solo raggiungibile tramite hostname (mDNS / WINS). Utilizzare l'opzione <em>Manual</em> con il nome IP o host.",
+    "noSharesTitle": "«Nessuna condivisione accessibile trovata»",
+    "noSharesBody": "<code>smbclient -L</code> non ha restituito nulla per queste credenziali. Cause: l'utente non ha il permesso di elencare le condivisioni (prova con le credenziali di amministratore una volta, o inserire manualmente il nome della condivisione), il server ha la visibilità condivisa disabilitata, o le credenziali sono errate. Lo script consente di digitare il nome di condivisione a mano in questo caso.",
+    "denyTitle": "Il montaggio Proxmox fallisce con NT_STATUS_ACCESS_DENIED",
+    "denyBody": "Le credenziali memorizzate pvesm non sono sincronizzate con il server Samba (password modificata, disabilitato account, dominio / workgroup mismatch). Reinserire le credenziali con <code>pvesm set &lt;id&gt; --username &lt;u&gt; --password &lt;p&gt;</code> o rimuovere e riadd da ProxMenux. Se il server è in un dominio AD, aggiungere <code>--domain &lt;DOMAIN&gt;</code> alla chiamata <code>pvesm set</code>.",
+    "sleepTitle": "\"host is down\" o lo stato di archiviazione va inattivo di notte",
+    "sleepBody": "Alcuni elettrodomestici NAS messi SMB dormire aggressivamente. <code>pvestatd</code> poi vede l'archiviazione inattiva fino a quando il primo accesso non sveglia il NAS. Se questo è cosmetico, niente è rotto. Se provoca guasti di backup, disabilitare SMB disconnettere il NAS o programmare i backup fuori dalla finestra di sonno.",
+    "lxcNoWriteTitle": "Il LXC non privilegiato non può scrivere nel percorso fstab tramite bind mount",
+    "lxcNoWriteBody": "Controlla le opzioni previste con <code>findmnt /mnt/&lt;path&gt;</code>, ad esempio <code>uid=0,gid=0,file_mode=0777,dir_mode=0777</code>. Permessi locali insufficienti possono bloccare gli UID LXC mappati. Riapplica il profilo RW o adatta le opzioni personalizzate. Verifica anche i diritti dell’utente SMB sul server e se le estensioni Unix/POSIX forniscono modalità server: i permessi locali aperti non aggirano le ACL del server.",
+    "fstabBootTitle": "fstab mount non arriva dopo il riavvio",
+    "fstabBootBody": "Lo script aggiunge <code>nofail,_netdev</code> quindi una parte mancante all'avvio non blocca l'avvio. Se il montaggio non arriva mai: confermare la rete è raggiungibile (<code>ping &lt;server&gt;</code>), controllare <code>journalctl -u remote-fs.target</code>, verificare che il file delle credenziali esista ancora (<code>ls -l /etc/samba/credentials/</code>) ed è leggibile, e provare <code>mount -a</code> manualmente."
+  },
+  "related": {
+    "heading": "Correlati",
+    "items": [
+      {
+        "href": "/docs/storage-share/host-nfs",
+        "label": "Condivisione NFS come storage Proxmox",
+        "tail": " — pagina correlata con lo stesso schema (metodo A pvesm + metodo B fstab) e confronto dei compromessi."
+      },
+      {
+        "href": "/docs/storage-share/lxc-mount-points",
+        "label": "Gestore montaggi LXC",
+        "tailRich": "— eseguire il bind mount del percorso <code>/mnt/&lt;path&gt;</code> in uno o più contenitori."
+      },
+      {
+        "href": "/docs/storage-share/lxc-samba-client",
+        "label": "client Samba in LXC",
+        "tail": "— alternativa: montare Samba direttamente dall'interno di un contenitore privilegiato (senza passare dall’host)."
+      }
+    ]
+  }
+}
diff --git a/web/messages/it/docs/storage-share/index.json b/web/messages/it/docs/storage-share/index.json
new file mode 100644
index 00000000..7eaabefb
--- /dev/null
+++ b/web/messages/it/docs/storage-share/index.json
@@ -0,0 +1,135 @@
+{
+  "meta": {
+    "title": "Proxmox NFS, Samba, iSCSI e punti di montaggio LXC — Storage e condivisioni | ProxMenux",
+    "description": "Integra lo storage esterno e locale in Proxmox VE e condividi cartelle fra l’host e i container LXC. Aggiungi condivisioni NFS, Samba (CIFS) e target iSCSI come storage Proxmox, configura i bind mount LXC con Mount Manager ed esegui client e server NFS o Samba all’interno dei container.",
+    "ogTitle": "Proxmox NFS, Samba, iSCSI e punti di montaggio LXC — Storage e condivisioni",
+    "ogDescription": "Integra storage esterno o locale in Proxmox VE: registrazione di NFS, Samba e iSCSI, bind mount LXC e condivisione in rete.",
+    "twitterTitle": "Proxmox NFS, Samba, iSCSI | ProxMenux",
+    "twitterDescription": "Aggiungere NFS / Samba / iSCSI come Proxmox storage e condividere cartelle tra host e LXC."
+  },
+  "header": {
+    "title": "Gestore storage e condivisioni",
+    "description": "Integra lo storage esterno o locale in Proxmox VE e condividi cartelle tra l’host e i container LXC. Tre gruppi di strumenti: integrazione dello storage sull’host (registrazione in Proxmox), LXC Mount Manager (bind mount con gestione pratica dei permessi) e condivisione di rete LXC (procedure client e server NFS o Samba per casi specifici).",
+    "section": "Storage e condivisioni"
+  },
+  "intro": {
+    "title": "A cosa serve questo menu",
+    "body": "Disk Manager opera al livello dei <em>singoli dischi fisici</em>. Storage &amp; Share Manager opera un livello sopra: <strong>registra pool di storage e condivisioni di rete in Proxmox</strong> (per renderli disponibili all’interfaccia e allo strumento di creazione delle VM) e <strong>configura la condivisione di file tra l’host e i container</strong>."
+  },
+  "opening": {
+    "heading": "Apertura del menu",
+    "body": "Dal menu principale di ProxMenux, selezionare <strong>Storage &amp; Share Manager</strong>. Vedrai questo:",
+    "imageAlt": "Menu Storage & Share Manager con blocchi HOST e LXC"
+  },
+  "groups": {
+    "heading": "Tre gruppi di strumenti",
+    "intro": "Il menu è diviso in tre gruppi. <strong>Integrazione dello storage sull’host</strong> registra lo storage esterno o locale in Proxmox. <strong>LXC Mount Manager</strong> è lo strumento principale per condividere cartelle con i container: una procedura di bind mount che gestisce sul lato host la mappatura degli UID dei CT non privilegiati. <strong>Condivisione di rete LXC</strong> copre quattro scenari aggiuntivi in cui un container deve <em>utilizzare</em> o <em>esporre</em> direttamente condivisioni NFS o Samba.",
+    "hostTitle": "storage host",
+    "hostBody": "Registra lo storage esterno e locale in Proxmox tramite <code>pvesm add …</code>. Una volta registrato, l'archiviazione appare nella UI Proxmox ed è disponibile per i creatori VM e CT.",
+    "hostItems": [
+      "NFS esterno / Samba / iSCSI → storage Proxmox",
+      "Disco locale → Proxmox directory o archiviazione ZFS",
+      "Directory locale condivisa per bind mount fra più CT"
+    ],
+    "lxcMountTitle": "Gestore montaggi LXC",
+    "lxcMountBody": "Lo strumento principale di condivisione LXC. Rende accessibili le directory dell’host nei container tramite bind mount con <code>pct set -mpN</code> e gestisce i permessi particolari dei CT non privilegiati senza creare gruppi o utenti nel container.",
+    "lxcMountItems": [
+      "Funziona con CT privilegiati e non privilegiati",
+      "Propone <code>o+rwx</code> sulla directory host per gli UID non privilegiati",
+      "Corregge, se necessario, i montaggi CIFS e NFS esistenti"
+    ],
+    "lxcNetTitle": "condivisione di rete LXC",
+    "lxcNetBody": "Quattro procedure aggiuntive per i container che devono utilizzare o esporre direttamente condivisioni NFS o Samba. Tutte richiedono un container <strong>privilegiato</strong>.",
+    "lxcNetItems": [
+      "<strong>Client</strong> NFS / Samba (utilizza condivisioni esterne)",
+      "NFS / Samba <strong>server</strong> (esporre cartelle CT)"
+    ]
+  },
+  "host": {
+    "heading": "Integrazione di storage host",
+    "intro": "Registra lo storage in Proxmox. Ogni opzione chiama <code>pvesm add …</code> sotto il cofano, quindi lo storage si presenta in <strong>Datacenter → Storage</strong> e diventa disponibile per i creatori VM / CT.",
+    "options": [
+      {
+        "href": "/docs/storage-share/host-nfs",
+        "icon": "Network",
+        "title": "Aggiungi una condivisione NFS come storage Proxmox",
+        "description": "Registra un’esportazione NFS esterna come storage Proxmox tramite pvesm add nfs. Proxmox gestisce il montaggio, senza voci aggiuntive in fstab."
+      },
+      {
+        "href": "/docs/storage-share/host-samba",
+        "icon": "Share2",
+        "title": "Aggiungi una condivisione Samba come storage Proxmox",
+        "description": "Registra una condivisione Samba o CIFS esterna come storage Proxmox tramite pvesm add cifs. Proxmox gestisce il montaggio e le credenziali."
+      },
+      {
+        "href": "/docs/storage-share/host-iscsi",
+        "icon": "Database",
+        "title": "Aggiungere l'obiettivo iSCSI come storage Proxmox",
+        "description": "Collegati a un obiettivo iSCSI esterno e registralo come storage Proxmox (dispositivo a blocchi) per le immagini disco VM."
+      },
+      {
+        "href": "/docs/storage-share/host-local-disk",
+        "icon": "HardDrive",
+        "title": "Aggiungere disco locale come archiviazione Proxmox",
+        "description": "Formatta un disco locale SATA / SAS / NVMe e registralo come storage Proxmox di tipo directory o pool ZFS."
+      },
+      {
+        "href": "/docs/storage-share/host-local-shared",
+        "icon": "FolderOpen",
+        "title": "Aggiungi directory condivisa su Host",
+        "description": "Crea una directory sull’host da rendere accessibile in più CT tramite bind mount. È una risorsa dell’host per i container LXC e non viene registrata come storage Proxmox."
+      }
+    ]
+  },
+  "lxcMount": {
+    "heading": "Gestore montaggi LXC",
+    "intro": "Lo strumento principale per condividere cartelle tra l’host Proxmox e i container LXC. Usa <code>pct set -mpN</code> per rendere accessibile una directory dell’host nel container tramite bind mount e gestisce sul lato host i permessi dei CT non privilegiati (non vengono creati gruppi o utenti nel container).",
+    "card": {
+      "title": "Punti di montaggio LXC (Host ↔ CT)",
+      "description": "Rendi accessibile una directory dell’host in un container LXC tramite bind mount con pct set -mpN. Funziona con CT privilegiati e non privilegiati; propone chmod o+rwx e ACL per la directory sull’host e corregge, se necessario, i montaggi CIFS o NFS esistenti."
+    }
+  },
+  "lxcNet": {
+    "heading": "condivisione di rete LXC",
+    "intro": "Usa queste procedure quando il container deve <em>essere</em> un endpoint NFS o Samba: può usare una condivisione esterna come client oppure esporre le proprie cartelle come server. Per le comuni esigenze di condivisione tramite bind mount fra host e CT, <mountLink>LXC Mount Manager</mountLink> è più semplice e non richiede container privilegiati.",
+    "options": [
+      {
+        "href": "/docs/storage-share/lxc-nfs-client",
+        "icon": "Download",
+        "title": "client NFS in LXC",
+        "description": "Monta condivisioni NFS esterne dall’interno di un container LXC privilegiato. Supporta rilevamento automatico, persistenza in /etc/fstab e smontaggio pulito."
+      },
+      {
+        "href": "/docs/storage-share/lxc-samba-client",
+        "icon": "Download",
+        "title": "client Samba in LXC",
+        "description": "Monta condivisioni Samba / CIFS dall’interno di un container LXC privilegiato. Credenziali archiviate con protezione e rilevamento automatico disponibile."
+      },
+      {
+        "href": "/docs/storage-share/lxc-nfs-server",
+        "icon": "Upload",
+        "title": "Server NFS in LXC",
+        "description": "Esporta cartelle su NFS dall'interno di un contenitore privilegiato LXC."
+      },
+      {
+        "href": "/docs/storage-share/lxc-samba-server",
+        "icon": "Upload",
+        "title": "Server Samba in LXC",
+        "description": "Esporre cartelle su SMB / CIFS dall'interno di un contenitore privilegiato LXC."
+      }
+    ]
+  },
+  "privReq": {
+    "title": "Requisito di container privilegiato",
+    "body": "Le quattro procedure di <strong>condivisione di rete LXC</strong> sopra richiedono un container <strong>privilegiato</strong>. Gli script impongono questa modalità supportata prima di configurare servizi e strumenti di montaggio (<code>nfs-kernel-server</code>, <code>smbd</code>, <code>mount.nfs</code>, <code>mount.cifs</code>). Per condividere file tra l’host e un CT non privilegiato, usa <mountLink>LXC Mount Manager</mountLink>: esegue i bind mount e regola i permessi sull’host, consentendo al container di leggere e scrivere senza configurare tali servizi o strumenti al suo interno."
+  },
+  "unprivExplain": {
+    "title": "Come ProxMenux gestisce i permessi dei CT non privilegiati",
+    "body": "I container LXC non privilegiati spostano gli UID di <strong>+100000</strong> sull’host (UID 0 nel container = UID 100000 sull’host, UID 1000 nel container = UID 101000 sull’host, …). Un file creato da un utente del container appare quindi sull’host come <em>altri</em>, senza corrispondere a un normale utente o gruppo dell’host. LXC Mount Manager adotta una soluzione pratica: invece di allineare UID/GID fra host e CT, propone <code>chmod o+rwx</code> e le ACL corrispondenti sulla directory dell’host, così ogni UID mappato può leggere e scrivere. Per CIFS rimonta con <code>uid=0,gid=0,file_mode=0777,dir_mode=0777</code>; per NFS imposta una directory scrivibile da tutti con sticky bit e, se il server applica root squash, indica la correzione da eseguire sul server."
+  },
+  "scripts": {
+    "heading": "Scripts coinvolti",
+    "intro": "Ogni singola pagina collega allo script che guida il suo flusso. Il file sottostante è un helper condiviso che non è documentato come propria pagina, ma viene utilizzato da diversi flussi di condivisione della rete LXC:",
+    "itemTail": "— validazione CT, selezione del punto di montaggio, controllo privilegiato e helper di configurazione del gruppo universale condivisi attraverso i flussi client / server LXC."
+  }
+}
diff --git a/web/messages/it/docs/storage-share/lxc-mount-points.json b/web/messages/it/docs/storage-share/lxc-mount-points.json
new file mode 100644
index 00000000..93da89e7
--- /dev/null
+++ b/web/messages/it/docs/storage-share/lxc-mount-points.json
@@ -0,0 +1,174 @@
+{
+  "meta": {
+    "title": "Punti di montaggio LXC (host ↔ container) | Documentazione ProxMenux",
+    "description": "LXC Mount Manager rende accessibile una directory dell’host in uno o più container LXC tramite bind mount con pct set -mpN. Gestisce le particolarità dei permessi nei container non privilegiati, corregge i montaggi CIFS e NFS sul lato host e non modifica nulla all’interno del container.",
+    "ogTitle": "Punti di montaggio LXC (host ↔ container) | Documentazione ProxMenux",
+    "ogDescription": "Monta directory dell’host nei container LXC tramite bind mount. Gestisce la mappatura UID non privilegiata in modo pratico e corregge l’accesso CIFS / NFS sull’host."
+  },
+  "header": {
+    "title": "LXC Punti di montaggio (Host ↔ Contenitore)",
+    "description": "Lo strumento principale per condividere cartelle fra l’host Proxmox e i container LXC. Rende accessibile una directory dell’host in uno o più container tramite bind mount con la sintassi nativa pct set -mpN. Gestisce i permessi dei container non privilegiati sul lato host, senza modificare nulla all’interno del container.",
+    "section": "Archiviazione e condivisione · LXC"
+  },
+  "intro": {
+    "title": "Cosa succede?",
+    "body": "Prendere una directory che vive sull'host Proxmox (una cartella locale, una condivisione NAS montata, un deposito gestito da Proxmox...) e farlo apparire all'interno di un contenitore LXC in un percorso scelto, con autorizzazioni che funzionano anche per contenitori non privilegiati - senza toccare nulla all'interno del contenitore."
+  },
+  "bigPicture": {
+    "heading": "Come funziona (il quadro grande)",
+    "intro": "Con un bind mount, Proxmox chiede al kernel di rendere la directory <code>X</code> dell’host accessibile anche nel percorso <code>Y</code> del container. Non ci sono copie, sincronizzazioni o trasferimenti di rete: entrambi vedono contemporaneamente gli <em>stessi file</em>.",
+    "sourceLabel": "Host Proxmox",
+    "sourceDetail": "/mnt/data\n(la tua cartella)",
+    "targetLabel": "Contenitore LXC",
+    "targetDetail": "/mnt/data\n(vedi qui)",
+    "arrowLabel": "bind mount",
+    "outro": "Il percorso host sulla sinistra e il percorso contenitore sulla destra possono essere diversi — ad esempio, <code>/mnt/nas-films</code> sull'host può diventare <code>/media/films</code> all'interno del contenitore. Lo script aggiunge l'ingresso al contenitore config (<code>/etc/pve/lxc/&lt;ctid&gt;.conf</code>) utilizzando il prossimo indice <code>mpN</code> libero, con due impostazioni di sicurezza integrate:",
+    "items": [
+      "<code>shared=1</code> — indica a Proxmox che i dati sono condivisi e non vanno migrati con il CT. Il flag non replica i dati: lo stesso percorso e gli stessi dati devono essere già disponibili sul nodo di destinazione.",
+      "<code>backup=0</code> — il bind mount resta escluso dai backup <code>vzdump</code>. I dati risiedono sull’host e vanno salvati separatamente."
+    ]
+  },
+  "perms": {
+    "heading": "Gestione delle autorizzazioni — la parte smart",
+    "intro": "Il principio dei bind mount è semplice; la parte delicata sono i permessi. Un container LXC <strong>non privilegiato</strong> applica uno spostamento di <strong>+100000</strong> agli UID. Un file creato dall’utente 1000 nel container appare quindi sull’host con UID 101000, che non appartiene a nessun utente dell’host. Per evitare di dover allineare gli UID, ProxMenux adatta i permessi sul lato <em>host</em> in base al tipo di directory scelto:",
+    "headerType": "Tipo di directory host",
+    "headerAction": "Cosa offre lo script da fare",
+    "localType": "Cartella locale",
+    "localTypeSub": "ad esempio. /mnt/data",
+    "localActionRich": "<code>chmod o+rwx</code> + <code>setfacl o::rwx</code> nella directory host. Solo se il CT non è privilegiato e le autorizzazioni attuali sono insufficienti.",
+    "cifsType": "montato CIFS / SMB",
+    "cifsTypeSub": "ad esempio. /mnt/pve/cifs-…",
+    "cifsActionRich": "Rimontare con <code>uid=0, gid=0, file_mode=0777, dir_mode=0777</code> in modo che il CT (qualsiasi UID) possa leggere e scrivere la condivisione. <code>/etc/fstab</code> è aggiornato.",
+    "nfsType": "NFS montato",
+    "nfsTypeSub": "ad esempio. /mnt/pve/nfs-…",
+    "nfsActionRich": "<code>chmod 1777</code> e <code>setfacl o::rwx</code> sul montaggio NFS. Non possono aggirare lo squashing applicato dal server: se nemmeno root sull’host riesce a scrivere, la procedura ti invita a correggere l’esportazione sul server NFS.",
+    "privTitle": "I container privilegiati non richiedono questi adattamenti",
+    "privBody": "Per contenitori privilegiati, UID 0 nel CT è UID 0 sull'host — root all'interno del CT può leggere e scrivere la directory host direttamente senza alcun trucco di autorizzazione. Lo script rileva e salta completamente il passo \"aprire le autorizzazioni\".",
+    "noCtTitle": "Lo script non modifica mai nulla all'interno del contenitore",
+    "noCtBody": "Tutte le modifiche di autorizzazione avvengono sul filesystem <strong>host</strong>. Nessun chowns <code>pct exec</code>, nessun gruppo creato nel CT, nessun fstab all'interno del contenitore. Se riutilizzate la directory in un altro CT in seguito, le stesse autorizzazioni si applicano automaticamente, nessuna configurazione per-container."
+  },
+  "writes": {
+    "heading": "Che cosa scrive ProxMenux — e che cosa non fa",
+    "intro": "Un equivoco comune sui bind mount nei CT non privilegiati è pensare che ProxMenux debba aggiungere voci <code>lxc.idmap</code> in <code>/etc/pve/lxc/&lt;CTID&gt;.conf</code>. <strong>Non lo fa.</strong> A quel file viene aggiunta una sola riga, quella del bind mount:",
+    "outro": "La linea di uscita che vedi alla fine della corsa, <em>\"Container non privilegiato — UID offset: 100000\"</em>, è puramente informativo — ti dice solo che il CT sta usando la mappatura non privilegiata predefinita di Proxmox (root in CT = UID 100000 sull'host). Lo script non configura nulla intorno a esso.",
+    "twoWaysHeading": "I due modi per far funzionare le autorizzazioni — e perché ProxMenux sceglie uno",
+    "headerApproach": "Approccio",
+    "headerChanges": "Cosa cambia",
+    "headerWhen": "Quando si adatta",
+    "hostType": "Permessi sull’host",
+    "hostTypeSub": "(che cosa fa questo script)",
+    "hostChangesRich": "<code>chmod o+rwx</code> + <code>setfacl o::rwx</code> nella directory host. Gli UID mappati di CT (100000+) cadono nel secchio \"altri\", quindi l'apertura di <em>altri</em> è sufficiente.",
+    "hostWhen": "Accesso generico a cartella condivisa da qualsiasi CT. Multiple CTs che condividono la stessa directory host. Semplice e riutilizzabile.",
+    "idmapTypeRich": "<code>lxc.idmap</code>",
+    "idmapTypeSub": "(non usato da questo script)",
+    "idmapChangesRich": "Mapping UID/GID personalizzato in <code>/etc/pve/lxc/&lt;CTID&gt;.conf</code> più abbinato <code>/etc/subuid</code> + <code>/etc/subgid</code> voci sull'host. CT deve essere riavviata su ogni cambiamento.",
+    "idmapWhenRich": "Hai bisogno di un UID <em>specifico</em> all'interno del CT per mappare un UID <em>specifico</em> sull'host (ad es. <code>media:1000</code> nel CT deve possedere i file come <code>media:1000</code> sull'host in modo che NFS non squash). Una configurazione più rigida, normalmente ne vale solo la pena per quello scenario esatto.",
+    "idmapTipTitle": "Quando hai veramente bisogno lxc.idmap",
+    "idmapTipBody": "Usa la mappatura manuale quando i file scritti nel CT devono avere uno specifico UID/GID numerico sull’host, ad esempio per condividere il proprietario con un utente host. Non aggira <code>all_squash</code> di NFS: il server decide comunque identità anonima e permessi. Aggiungi manualmente voci <code>lxc.idmap</code> se necessario. La riga del bind mount è indipendente da queste voci."
+  },
+  "opening": {
+    "heading": "Apertura dello strumento",
+    "body": "Dal menu principale di ProxMenux, aprire <strong>Storage &amp; Share Manager → Configurare LXC Mount Points (Host ↔ Container)</strong>. Vedrete questo sub-menu con tre opzioni:",
+    "imageAlt": "LXC Mount Manager menu — Aggiungi / Vedi / Rimuovi"
+  },
+  "addFlow": {
+    "heading": "Aggiungere un montaggio — procedura completa",
+    "intro": "La vista tecnica, per quando si desidera sapere esattamente ciò che ogni dialogo fa:"
+  },
+  "sources": {
+    "heading": "Cosa puoi scegliere come directory host",
+    "intro": "Il raccoglitore host-directory è il più accurato nella sezione Storage &amp; Share. Scansiona quattro fonti e presenta una lista deduplicata:",
+    "headerSource": "Fonte",
+    "headerWhere": "Da dove viene",
+    "headerLabel": "Etichetta nel menu",
+    "rows": [
+      {
+        "source": "Montaggi di rete attivi",
+        "whereRich": "Condivisioni CIFS / NFS attualmente montate, lette da <code>/proc/mounts</code>.",
+        "labelRich": "<code>NFS [used/size]</code> o <code>CIFS/SMB [used/size]</code>"
+      },
+      {
+        "source": "Montaggi fstab inattivi",
+        "whereRich": "Definito in <code>/etc/fstab</code> ma non attualmente montato.",
+        "labelRich": "<code>fstab(off)-NFS</code> / <code>fstab(off)-CIFS/SMB</code>"
+      },
+      {
+        "source": "Directory locali",
+        "whereRich": "Sottodirectory di <code>/mnt</code> che non corrispondono a montaggi di rete.",
+        "labelRich": "<code>Local [size]</code>"
+      },
+      {
+        "source": "Stoccaggio Proxmox",
+        "whereRich": "Percorsi di stoccaggio sotto <code>/mnt/pve/*</code> (NFS / CIFS registrati tramite <code>pvesm</code>).",
+        "labelRich": "<code>PVE-NFS</code> / <code>PVE-CIFS/SMB</code> / <code>Proxmox-Storage</code>"
+      },
+      {
+        "source": "Entrata manuale",
+        "where": "Qualsiasi altra cosa — digitare il percorso assoluto da soli.",
+        "labelRich": "<em>Inserisci percorso manualmente</em>"
+      }
+    ],
+    "tipTitle": "I percorsi Proxmox interni sono filtrati",
+    "tipBody": "Il raccoglitore salta esplicitamente i percorsi interni Proxmox (<code>/mnt/pve/local</code>, <code>/mnt/pve/local-lvm</code>, <code>/mnt/pve/backup</code>, ...) — quelli sono riservati per gli interni Proxmox e non è necessario legare-montare. Vengono visualizzati solo gli storage aggiunti dall'utente."
+  },
+  "manual": {
+    "heading": "Equivalente manuale",
+    "privIntro": "Per un contenitore privilegiato — il caso più semplice, nessun trucco di autorizzazione:",
+    "unprivLocalIntro": "Per un contenitore non privilegiato con una directory host locale — aprire le autorizzazioni sull'host prima:",
+    "unprivCifsIntro": "Per un contenitore non privilegiato con una condivisione CIFS già montata sull'host:"
+  },
+  "view": {
+    "heading": "Visualizza i punti di montaggio",
+    "body": "Elenca ogni ingresso <code>mpN</code> su ogni contenitore su questo host Proxmox, raggruppato da CT id e che mostra il percorso host → percorso container più eventuali opzioni extra. sola lettura — utile come controllo di sanità prima di aggiungere o rimuovere nulla."
+  },
+  "remove": {
+    "heading": "Rimuovi un punto di montaggio",
+    "body": "Scegli il contenitore, scegli la voce <code>mpN</code>, conferma. Lo script esegue <code>pct set --delete mpN</code> per rilasciare l'ingresso dalla configurazione CT e offre di riavviare il contenitore se è in esecuzione. La directory host e i suoi contenuti sono <strong>non toccati</strong> — è possibile ri-add il montaggio in seguito (o collegare la stessa directory a un diverso CT).",
+    "warnTitle": "I container in esecuzione richiedono un riavvio per applicare le modifiche",
+    "warnBody": "Sia l'aggiunta che la rimozione dei punti di montaggio diventano visibili solo all'interno del contenitore dopo un riavvio. Lo script offre un <code>pct reboot</code> con un solo clic alla fine di ogni operazione; è possibile declinare e riavviare manualmente in seguito."
+  },
+  "troubleshoot": {
+    "heading": "Risoluzione dei problemi",
+    "noMountTitle": "Il montaggio appare in pct config ma non all'interno del contenitore",
+    "noMountBody": "I bind mount vengono collegati all’avvio del container. Se hai aggiunto il montaggio mentre il CT era in esecuzione, riavvialo con <code>pct reboot &lt;ctid&gt;</code>. Se manca anche dopo il riavvio, controlla con <code>pct config &lt;ctid&gt;</code> che la voce esista e che il percorso sull’host contenga effettivamente una directory.",
+    "noWriteTitle": "Il contenitore può vedere la directory ma non può scrivere",
+    "noWriteBody": "Quasi sempre un problema di autorizzazioni. Per i contenitori non privilegiati, eseguire nuovamente la correzione del permesso dello script — gli ACL della directory host possono essere stati ripristinati da un altro strumento (rsync, ripristino da backup, manuale <code>chmod</code>). Per CIFS, controllare le opzioni di montaggio sull'host: <code>findmnt /mnt/pve/cifs-…</code>, cercare i valori <code>uid=</code> / <code>gid=</code> / <code>file_mode=</code>.",
+    "alreadyTitle": "\"Questo percorso è già utilizzato come punto di montaggio in questo contenitore\"",
+    "alreadyBody": "Hai scelto lo stesso percorso contenitore che è già collegato a una directory host diversa. Scegliere un percorso contenitore diverso o rimuovere prima il punto di montaggio esistente.",
+    "nfsTitle": "L'accesso NFS bloccato anche dopo aver applicato la correzione dell'host",
+    "nfsIntro": "Il server NFS sta schiacciando root o tutte le connessioni. Lo script può rilevare questo (cerca di scrivere un file di prova dall'host) e mostra la guida lato server. Due correzioni lato server comuni per l'esportazione:",
+    "nfsItems": [
+      "<code>no_root_squash</code> — i CT privilegiati possono scrivere direttamente.",
+      "<code>all_squash,anonuid=65534,anongid=65534</code> — per CT non privilegiati."
+    ],
+    "nfsOutro": "Queste modifiche avvengono sul server NFS (TrueNAS, Synology, la tua esportazione personalizzata, ...), non su Proxmox.",
+    "fstabOffTitle": "Il montaggio delle voci \"fstab(off)\" non fa nulla",
+    "fstabOffBody": "La selezione mostra voci <code>fstab(off)-</code> quando un montaggio di rete è definito in fstab ma non è attivo. Lo script consente di collegare il percorso tramite bind mount, ma la directory resterà vuota finché non monterai la condivisione sull’host con <code>mount &lt;path&gt;</code>. Montala prima e poi collegala al CT."
+  },
+  "related": {
+    "heading": "Correlati",
+    "items": [
+      {
+        "href": "/docs/storage-share/host-local-shared",
+        "label": "Aggiungi Directory condivisa su host",
+        "tailRich": "— primo passo tipico: preparare un <code>/mnt/shared</code> sull'host prima di legarlo in una o più CT qui."
+      },
+      {
+        "href": "/docs/storage-share/host-nfs",
+        "label": "Aggiungi condivisione NFS come storage Proxmox",
+        "extraHref": "/docs/storage-share/host-samba",
+        "extraLabel": "Aggiungi condivisione Samba come storage Proxmox",
+        "joiner": " / ",
+        "tailRich": "— registrare una condivisione esterna in Proxmox prima, quindi legare-montare il suo percorso <code>/mnt/pve/&lt;id&gt;</code> nel CT qui."
+      },
+      {
+        "href": "/docs/storage-share/lxc-nfs-client",
+        "label": "client NFS in LXC",
+        "extraHref": "/docs/storage-share/lxc-samba-client",
+        "extraLabel": "client Samba in LXC",
+        "joiner": " / ",
+        "tail": "— l'alternativa quando si desidera che il CT stesso monti la condivisione (richiede un contenitore privilegiato)."
+      }
+    ]
+  }
+}
diff --git a/web/messages/it/docs/storage-share/lxc-nfs-client.json b/web/messages/it/docs/storage-share/lxc-nfs-client.json
new file mode 100644
index 00000000..56461b22
--- /dev/null
+++ b/web/messages/it/docs/storage-share/lxc-nfs-client.json
@@ -0,0 +1,128 @@
+{
+  "meta": {
+    "title": "client NFS in LXC | Documentazione ProxMenux",
+    "description": "Monta condivisioni NFS direttamente in un container LXC Proxmox con ProxMenux. Installa automaticamente nfs-common, rileva i server nella LAN, supporta montaggi persistenti via /etc/fstab e impostazioni di avvio sicure. Richiede un container privilegiato.",
+    "ogTitle": "client NFS in LXC | Documentazione ProxMenux",
+    "ogDescription": "Monta condivisioni NFS in un container LXC privilegiato. Rilevamento automatico, persistenza in /etc/fstab e impostazioni di avvio sicure."
+  },
+  "header": {
+    "title": "client NFS in LXC",
+    "description": "Monta condivisioni NFS direttamente in un container LXC Proxmox. Il container diventa un vero client NFS: comunica con il server in rete, esegue mount.nfs e scrive in /etc/fstab. ProxMenux installa nfs-common, aiuta a trovare server ed esportazioni e applica impostazioni di avvio sicure.",
+    "section": "Archiviazione e condivisione · LXC"
+  },
+  "privReq": {
+    "title": "Contenitore privilegiato richiesto",
+    "body": "Il client NFS che usa <code>mount.nfs</code> richiede capacità (almeno <code>SYS_ADMIN</code>) non disponibili nei container LXC non privilegiati. Lo script chiede di scegliere un CT e <strong>si interrompe se non è privilegiato</strong>. Per usare la condivisione in un CT non privilegiato, montala prima sull’host Proxmox con <hostNfsLink>Condivisione NFS come storage Proxmox</hostNfsLink> e rendila accessibile al CT tramite bind mount con <mountLink>LXC Mount Manager</mountLink>."
+  },
+  "what": {
+    "heading": "Cosa succede?",
+    "body": "A differenza di LXC Mount Manager — che permette al CT di vedere una risorsa <em>tramite</em> l'host Proxmox — questo script dà al contenitore il suo <strong>proprio client NFS</strong>: parla NFS sulla rete, monta condivisioni direttamente dal server NFS, e memorizza il montaggio nel contenitore <code>/etc/fstab</code>. L'host Proxmox non è nel percorso dati.",
+    "diagramServerLabel": "Server NFS",
+    "diagramServerDetail": "/export/data",
+    "diagramHostLabel": "Host Proxmox",
+    "diagramHostDetail": "(solo un\nponte di rete)",
+    "diagramCtLabel": "LXC (privilegiato)",
+    "diagramCtDetail": "/mnt/data\nmount.nfs nel CT",
+    "diagramArrow": "NFS",
+    "twoWaysTitle": "Due modi per dare un accesso CT NFS — scegliere uno",
+    "twoWaysBind": "<strong>Bind mount tramite host</strong> (<mountLink>LXC Mount Manager</mountLink>): l’host monta NFS una volta e ogni CT riceve lo stesso percorso tramite bind mount. Funziona con CT non privilegiati. Consigliato quando più CT usano la stessa condivisione.",
+    "twoWaysDirect": "<strong>Montaggio NFS diretto nel CT</strong> (questa pagina): il CT monta NFS da sé. Richiede un CT privilegiato. Utile se il CT deve gestire la propria connessione e le credenziali o se ciascun CT usa un server diverso."
+  },
+  "opening": {
+    "heading": "Apertura dello strumento",
+    "body": "Dal menu principale apri <strong>Storage &amp; Share Manager → Configura client NFS in LXC (solo privilegiato)</strong>. ProxMenux chiede di <strong>scegliere il CT di destinazione</strong>, lo avvia se è fermo e si interrompe se non è privilegiato. Dopo la selezione compare questo sottomenu:",
+    "imageAlt": "Menu client NFS — Monta / Visualizza / Smonta / Verifica connettività"
+  },
+  "howRuns": {
+    "heading": "Come viene eseguito lo script (Mount flow)"
+  },
+  "fstabFlags": {
+    "heading": "Perché quelle bandiere di fstab",
+    "intro": "Per montare permanente lo script aggiunge tre bandiere oltre le opzioni standard NFS: <code>_netdev,x-systemd.automount,noauto</code>. Ognuno risolve un problema di boot-time reale:",
+    "headerFlag": "Bandiera",
+    "headerEffect": "Che cosa fa",
+    "rows": [
+      {
+        "flag": "_netdev",
+        "effect": "Segnala al sistema di inizializzazione che questo montaggio richiede la rete. L’avvio non resta bloccato in attesa del montaggio prima che la rete sia disponibile."
+      },
+      {
+        "flag": "x-systemd.automount",
+        "effectRich": "Crea un'unità auto-montaggio systemd: il montaggio avviene solo la prima volta che qualcosa accede a <code>/mnt/&lt;path&gt;</code>. Il server NFS non raggiungibile all'avvio non blocca il CT."
+      },
+      {
+        "flag": "noauto",
+        "effect": "Evita il montaggio immediato all’avvio. In combinazione con l’unità automount descritta sopra, il filesystem viene montato solo al primo accesso."
+      }
+    ],
+    "netEffectTitle": "Effetto netto",
+    "netEffectBody": "Il filesystem NFS viene montato al <em>primo accesso</em> anziché subito durante l’avvio. Se il server è offline, l’accesso può attendere o fallire e influire sui servizi che dipendono dal percorso. Automount riduce la dipendenza all’avvio, ma non garantisce che tutti i servizi del CT restino indipendenti da un guasto NFS."
+  },
+  "manual": {
+    "heading": "Equivalente manuale",
+    "body": "Replica l'intero flusso a mano — ogni comando viene eseguito <strong>dentro il CT</strong> tramite <code>pct exec &lt;ctid&gt; --</code> o direttamente tramite <code>pct enter &lt;ctid&gt;</code>:"
+  },
+  "view": {
+    "heading": "Visualizzare i montaggi correnti",
+    "body": "Elenca i punti di montaggio NFS attivi nel CT tramite <code>mount | grep nfs</code> e tutte le righe NFS del suo <code>/etc/fstab</code>. Per ciascuna voce di fstab mostra se il montaggio è attualmente attivo, così puoi individuare quelli permanenti che non sono stati ripristinati all’avvio."
+  },
+  "unmount": {
+    "heading": "Smonta la condivisione NFS",
+    "body": "Combina i montaggi live e le voci fstab in un unico elenco, ti consente di sceglierne uno e <strong>rimuove la riga corrispondente da <code>/etc/fstab</code></strong>. Lo script <em>non</em> esegue <code>umount</code> sul montaggio live, invece ti dice che è necessario un riavvio CT affinché lo smontaggio abbia effetto.",
+    "warnTitle": "Lo script rimuove le voci da fstab, senza smontare i filesystem attivi",
+    "warnBody": "È una scelta voluta: <code>umount</code> fallisce con “device busy” se un processo nel CT usa ancora il montaggio. Rimuovere la voce da fstab impedisce che venga ripristinato al prossimo avvio del CT. Se vuoi smontarlo <em>subito</em> e sei certo che non sia in uso, esegui manualmente <code>pct exec &lt;ctid&gt; -- umount /mnt/&lt;path&gt;</code> dopo la fine dello script."
+  },
+  "test": {
+    "heading": "Test di connettività NFS",
+    "body": "La diagnostica nel CT verifica che <code>nfs-common</code> sia installato e che <code>rpcbind</code> sia in esecuzione, poi elenca i montaggi NFS attivi. Per ogni server NFS indicato in fstab controlla ping, porta 2049 e <code>showmount -e</code>. È un buon primo passo se un montaggio permanente non si attiva."
+  },
+  "troubleshoot": {
+    "heading": "Risoluzione dei problemi",
+    "privTitle": "Container privilegiato richiesto (lo script si interrompe)",
+    "privBody": "Il CT selezionato non è privilegiato. Il client NFS del kernel richiede la capacità <code>SYS_ADMIN</code>, non esposta dai CT non privilegiati. Converti il CT in privilegiato (la conversione con Disk Manager &amp; è descritta in <importLink>Importa disco in LXC</importLink>) oppure usa l’alternativa indicata nell’avviso all’inizio di questa pagina.",
+    "aptTitle": "apt-get install nfs-common fails",
+    "aptIntro": "Lo script assume una famiglia Debian CT (<code>apt-get</code>). Se il CT funziona Alpine / Arch / Rocky / Alma, la fase di installazione non riesce silenziosamente. Installare il client NFS a mano per quella distro:",
+    "aptItems": [
+      "Alpine: <code>apk add nfs-utils</code>",
+      "Arch: <code>pacman -S nfs-utils</code>",
+      "Rocky / Alma: <code>dnf install nfs-utils</code>"
+    ],
+    "aptOutro": "Quindi eseguire nuovamente lo script ProxMenux — il passaggio di installazione salta quando gli strumenti sono già presenti.",
+    "portTitle": "\"NFS port (2049) is not accessible\"",
+    "portBody": "Ping è riuscito ma <code>nc -z &lt;server&gt; 2049</code> non è riuscito da dentro il CT. Controllare che il servizio NFS sia in esecuzione sul server, che il firewall consenta a 2049 dalla rete CT e che il CT abbia effettivamente un percorso di rete valido (prova <code>pct exec &lt;ctid&gt; -- ip route</code>).",
+    "bootTitle": "Il montaggio permanente riesce, ma non viene ripristinato all’avvio",
+    "bootBody": "Quasi sempre uno di: la rete non è pronta quando CT monta (lo script <code>_netdev,x-systemd.automount,noauto</code> le opzioni risolvono il problema — aggiungi di nuovo il montaggio tramite lo script se hai scritto la linea fstab a mano senza quelle), il server è irraggiungibile all'avvio (auto-mount aspetta per il primo accesso — che è normale), o DNS è irrisolto all'avvio (utilizzare l'IP del server, non il suo nome host).",
+    "squashTitle": "Server squash root, nessun accesso di scrittura dall'interno CT",
+    "squashIntro": "L'esportazione NFS utilizza <code>root_squash</code> (il default) e il CT scrive come root. Due opzioni:",
+    "squashItems": [
+      "lato server: cambiare l'esportazione in <code>no_root_squash</code> (solo se ti fidi della CT).",
+      "CT-side: scrivere come utente non-root che il server accetta, o chown la parte in modo appropriato."
+    ],
+    "squashOutro": "ProxMenux non può risolvere questo problema — è la politica del server."
+  },
+  "related": {
+    "heading": "Correlati",
+    "items": [
+      {
+        "href": "/docs/storage-share/lxc-mount-points",
+        "label": "LXC Punti di montaggio (Host ↔ Contenitore)",
+        "tail": " — l'alternativa per le TC non private: montare su host, legare in CT."
+      },
+      {
+        "href": "/docs/storage-share/lxc-samba-client",
+        "label": "client Samba in LXC",
+        "tail": " — pagina correlata con lo stesso schema per le condivisioni SMB / CIFS."
+      },
+      {
+        "href": "/docs/storage-share/lxc-nfs-server",
+        "label": "Server NFS in LXC",
+        "tailRich": " — l’inverso: esporre cartelle <em>da</em> un CT tramite NFS."
+      },
+      {
+        "href": "/docs/storage-share/host-nfs",
+        "label": "Condivisione NFS come storage Proxmox",
+        "tail": " — registrare la condivisione in Proxmox anziché in un singolo CT."
+      }
+    ]
+  }
+}
diff --git a/web/messages/it/docs/storage-share/lxc-nfs-server.json b/web/messages/it/docs/storage-share/lxc-nfs-server.json
new file mode 100644
index 00000000..03413465
--- /dev/null
+++ b/web/messages/it/docs/storage-share/lxc-nfs-server.json
@@ -0,0 +1,159 @@
+{
+  "meta": {
+    "title": "Server NFS in LXC | Documentazione ProxMenux",
+    "description": "Condividi cartelle via NFS da un container LXC Proxmox con ProxMenux. Installa automaticamente nfs-kernel-server e configura il gruppo comune sharedfiles, /etc/exports, ACL di rete e disinstallazione completa. Richiede un container privilegiato.",
+    "ogTitle": "Server NFS in LXC | Documentazione ProxMenux",
+    "ogDescription": "Esegui un server NFS in un LXC privilegiato con il gruppo comune sharedfiles, ACL di rete e disinstallazione completa."
+  },
+  "header": {
+    "title": "Server NFS in LXC",
+    "description": "Esegui un server NFS del kernel in un container LXC Proxmox ed esponi cartelle ad altre macchine della rete. ProxMenux installa nfs-kernel-server, configura il gruppo comune sharedfiles per condividere correttamente i file fra più CT privilegiati, gestisce /etc/exports e offre la disinstallazione completa.",
+    "section": "Archiviazione e condivisione · LXC"
+  },
+  "privReq": {
+    "title": "Contenitore privilegiato richiesto",
+    "body": "<code>nfs-kernel-server</code> deve montare il file system del kernel <code>nfsd</code> in <code>/proc/fs/nfsd</code>. Serve <code>CAP_SYS_ADMIN</code> nello spazio dei nomi del kernel host, non soltanto in quello utente del container. I LXC non privilegiati non hanno questa capacità: <code>rpc.nfsd: Unable to access /proc/fs/nfsd errno 2 (No such file or directory)</code>; systemd segnala un errore di dipendenza per <code>nfs-server.service</code>. Lo script richiede quindi un CT privilegiato e <strong>si interrompe se il CT non è privilegiato</strong>. In alternativa, esegui il server NFS in una VM."
+  },
+  "what": {
+    "heading": "Cosa succede?",
+    "body": "È il caso inverso rispetto alla pagina <em>client NFS</em>: il CT diventa un <strong>server NFS</strong> e condivide una propria cartella con altri CT, l’host Proxmox, VM o macchine fisiche.",
+    "diagramServerLabel": "LXC (privilegiato) — server NFS",
+    "diagramServerDetail": "/mnt/data\n(cartella condivisa)\n\nchown root:sharedfiles\nchmod 2775 (SGID)\n\nnfs-kernel-server\n+ rpcbind in esecuzione",
+    "diagramClientLabel": "Qualsiasi client sulla rete",
+    "diagramClientDetail": "un altro CT, l'host,\nun VM, una macchina fisica...",
+    "diagramArrow": "Esportazione NFS"
+  },
+  "shared": {
+    "heading": "La convenzione di gruppo \"sharedfiles\"",
+    "body": "Prima di esportare la cartella, ProxMenux crea un gruppo chiamato <code>sharedfiles</code> con <strong>GID 101000</strong> all'interno del contenitore, aggiunge ogni utente regolare ad esso, quindi imposta la directory di esportazione a <code>root:sharedfiles</code> con modalità <code>2775</code>. Il <code>2</code> sul davanti è il bit SGID — ogni file o cartella creata all'interno eredita automaticamente il gruppo <code>sharedfiles</code>.",
+    "gidTitle": "Perché GID 101000 specificamente",
+    "gidBody": "Con la mappatura ID predefinita di LXC (+100000), il GID 101000 dell’host appare come GID <strong>1000</strong> in un CT non privilegiato. Questo flusso server usa un CT <strong>privilegiato</strong>, senza spostamento. Due CT privilegiati con <code>sharedfiles</code> al GID 101000 condividono quindi lo stesso ID numerico di gruppo.",
+    "remapTitle": "La creazione dei vecchi utenti «remap_*» viene saltata nei CT privilegiati",
+    "remapBody": "Il vecchio ramo per CT non privilegiati creerebbe utenti <code>remap_&lt;uid&gt;</code> con UID <code>&lt;uid&gt; + 100000</code>, tutti in <code>sharedfiles</code>, per utenti normali e UID comuni (33, 1000, 1001, 1002). Questo spostamento <code>+100000</code> non si applica ai CT <strong>privilegiati</strong> richiesti qui, quindi lo script salta il ramo. L’assenza di account <code>remap_*</code> in <code>getent passwd</code> è prevista e non indica un errore."
+  },
+  "defaults": {
+    "heading": "Opzioni di esportazione predefinite — leggere questo primo",
+    "warnTitle": "Opzioni di default includono no_root_squash",
+    "warnBody": "ProxMenux usa per impostazione predefinita <code>rw,sync,no_subtree_check,'<'strong'>'no_root_squash'<'/strong'>'</code>. <strong>Qualsiasi utente root di un client può scrivere come root sull’esportazione.</strong> Usalo solo in una LAN domestica affidabile. Se il CT è raggiungibile da reti non fidate (VPS o VLAN non fidata), <strong>cambia l’opzione in <code>root_squash</code></strong> nel dialogo delle opzioni personalizzate."
+  },
+  "opening": {
+    "heading": "Apertura dello strumento",
+    "body": "Dal menu principale, apri <strong>Storage & Share Manager → Configure NFS Server in LXC</strong>. Sono elencati solo i CT privilegiati. Scegli il CT di destinazione; lo script lo avvia se è fermo e rifiuta i CT non privilegiati. Il menu presenta cinque opzioni.",
+    "imageAlt": "NFS Server Manager menu — Crea / Visualizza / Elimina / Stato / disinstallare"
+  },
+  "howRuns": {
+    "heading": "Come funziona lo script (Crea flusso)"
+  },
+  "network": {
+    "heading": "Rete ACL — che può montare la quota",
+    "intro": "<code>/etc/exports</code> filtra i client autorizzati a montare l’esportazione. Il dialogo offre tre modalità:",
+    "headerMode": "Modalità",
+    "headerValue": "Valore scritto a /etc/exports",
+    "headerWhen": "Quando scegliere",
+    "rows": [
+      {
+        "mode": "Rete locale",
+        "value": "192.168.0.0/16",
+        "whenRich": "Per reti domestiche o SOHO standard. Include tutti gli indirizzi <code>192.168.*.*</code>."
+      },
+      {
+        "mode": "Sottorete personalizzata",
+        "value": "il tuo CIDR (ad es. 10.0.0.0/24)",
+        "when": "Quando la tua LAN non è in 192.168.x.x o vuoi una portata più stretta."
+      },
+      {
+        "mode": "Singolo host",
+        "value": "il tuo IP (ad es. 10.0.0.42)",
+        "when": "Solo una macchina specifica dovrebbe montare. Molto restrittiva."
+      }
+    ]
+  },
+  "options": {
+    "heading": "Opzioni di esportazione spiegate",
+    "headerOption": "Opzione",
+    "headerEffect": "Che cosa fa",
+    "rows": [
+      {
+        "option": "rw / ro",
+        "effect": "Consente l’accesso in lettura e scrittura o in sola lettura ai client che si connettono."
+      },
+      {
+        "option": "sync",
+        "effectRich": "Risponde alle richieste di scrittura solo dopo che i dati sono sul disco. Più sicuro di <code>async</code>, a scapito delle prestazioni."
+      },
+      {
+        "option": "no_subtree_check",
+        "effect": "Salta il controllo, a ogni richiesta, che il file sia ancora nel sottoalbero esportato. È più veloce ed evita problemi se i file vengono rinominati durante l’operazione."
+      },
+      {
+        "option": "no_root_squash",
+        "effectRich": "<strong>Considera attendibile root sul client.</strong> Un client che monta come root scrive come root sul server. Utile nelle LAN fidate, ad esempio per conservare i proprietari durante i backup. Sostituisci con <code>root_squash</code> se non ti fidi pienamente di ogni macchina ammessa dall’ACL di rete."
+      }
+    ]
+  },
+  "manual": {
+    "heading": "Equivalente manuale",
+    "body": "Riproduci manualmente l’intera procedura. Ogni comando viene eseguito <strong>nel CT</strong> tramite <code>pct exec &lt;ctid&gt; --</code> o <code>pct enter &lt;ctid&gt;</code>:"
+  },
+  "view": {
+    "heading": "Visualizza le esportazioni correnti",
+    "body": "Mostra <code>/etc/exports</code> dal CT saltando commenti e righe vuote, quindi elenca ogni esportazione con ACL di rete e opzioni. Utile per verificare le cartelle esposte prima di comunicare l’IP del CT."
+  },
+  "delete": {
+    "heading": "Eliminare un'esportazione",
+    "body": "Elenca ogni linea in <code>/etc/exports</code> per la selezione, rimuove quella scelta (<code>sed -i</code>), esegue <code>exportfs -ra</code> e riavvia <code>nfs-kernel-server</code>. La cartella stessa e il suo contenuto sono lasciati intatti."
+  },
+  "status": {
+    "heading": "Controlla lo stato NFS",
+    "body": "Passo diagnostico: conferma <code>nfs-kernel-server</code> e <code>rpcbind</code> sono installati e attivi, stampa l'uscita <code>exportfs -v</code>, elenca le sessioni NFS attive (<code>showmount -a</code>) e le connessioni client attuali."
+  },
+  "uninstall": {
+    "heading": "Disinstallare il server NFS",
+    "body": "Pulizia completa dopo conferma: arresta e disabilita <code>nfs-kernel-server</code> e <code>rpcbind</code>, svuota <code>/etc/exports</code>, rimuove i pacchetti NFS con <code>apt-get purge</code>, elimina il gruppo <code>sharedfiles</code> e gli utenti <code>remap_*</code> e termina i processi residui. Le <strong>cartelle esportate non vengono eliminate</strong>; vengono rimossi soltanto configurazione e pacchetti NFS.",
+    "warnTitle": "Lo script si ferma alla linea di esportazione, non ai dati",
+    "warnBody": "<em>Elimina esportazione</em> e <em>Disinstalla server NFS</em> rimuovono la configurazione. I dati della cartella esportata vengono conservati. Per eliminarli, usa esplicitamente <code>rm -rf</code> dopo la fine dello script e prima esegui un backup se potrebbero ancora servire."
+  },
+  "troubleshoot": {
+    "heading": "Risoluzione dei problemi",
+    "privTitle": "Richiesto un container privilegiato (lo script si interrompe)",
+    "privBody": "Il CT selezionato non è privilegiato. <code>nfs-kernel-server</code> non può cominciare perché il montaggio di <code>/proc/fs/nfsd</code> ha bisogno di <code>CAP_SYS_ADMIN</code> nello spazio dei nomi del kernel host, e il modulo <code>nfsd</code> non è esposto allo spazio dei nomi del contenitore (<code>modprobe nfsd</code> dall’interno restituisce <code>FATAL: Module nfsd not found</code>). Se si bypassa il controllo, si vedrà <code>rpc.nfsd: Unable to access /proc/fs/nfsd errno 2 (No such file or directory)</code> nel journal e nessuna porta NFS verrà aperta. Le uniche opzioni praticabili sono: convertire il CT in privilegiato, o spostare il server NFS in una VM.",
+    "aptTitle": "apt-get install non riesce",
+    "aptIntro": "Lo script assume una famiglia Debian CT. Su Alpine / Arch / Rocky / Alma, installare i pacchetti server NFS a mano:",
+    "aptItems": [
+      "Alpine: <code>apk add nfs-utils</code>",
+      "Arch: <code>pacman -S nfs-utils</code>",
+      "Rocky / Alma: <code>dnf install nfs-utils</code>"
+    ],
+    "aptOutro": "Esegui di nuovo lo script ProxMenux; l’installazione viene saltata se gli strumenti sono già presenti.",
+    "aclTitle": "Il client non può montare: 'accesso negato dal server'",
+    "aclBody": "L’IP del client è fuori dall’ACL di rete configurata. Ricrea l’esportazione con una sottorete più ampia o aggiungi l’IP esatto del client. Attenzione: attraverso un router NAT il client può apparire con l’IP WAN del router anziché il proprio IP LAN. Verifica sul server con <code>tcpdump -n port 2049</code>.",
+    "ownTitle": "I file scritti dal client appaiono con strana proprietà sul server",
+    "ownIntro": "Due possibilità:",
+    "ownItems": [
+      "Con <code>no_root_squash</code> (default), root client scrive come root sul server. I file sono di proprietà di <code>root:sharedfiles</code> grazie al SGID nella cartella.",
+      "Gli utenti client non-root scrivono come propri UID/GID. Se il loro UID non esiste sul server, i file appaiono con numeri grezzi (ad es. <code>1234:1234</code>). Utilizzare anche il gruppo <code>sharedfiles</code> sul client o allineare gli UID attraverso i sistemi che condividono i file."
+    ],
+    "noShowTitle": "Server raggiungibile ma showmount non restituisce nulla",
+    "noShowBody": "Dopo aver modificato <code>/etc/exports</code>, è necessario ricaricare la tabella di esportazione con <code>exportfs -ra</code> e riavviare <code>nfs-kernel-server</code> — lo script fa entrambi, ma se hai modificato il file a mano, fai da te. Confermare anche il firewall sul CT (e sull'host Proxmox) consente a TCP/UDP 2049 e alla porta rpcbind (111)."
+  },
+  "related": {
+    "heading": "Correlati",
+    "items": [
+      {
+        "href": "/docs/storage-share/lxc-nfs-client",
+        "label": "client NFS in LXC",
+        "tail": " — il caso inverso: montare condivisioni NFS esterne nel CT."
+      },
+      {
+        "href": "/docs/storage-share/lxc-samba-server",
+        "label": "Server Samba in LXC",
+        "tail": " — pagina correlata, stesso schema con SMB / CIFS al posto di NFS."
+      },
+      {
+        "href": "/docs/storage-share/host-nfs",
+        "label": "Condivisione NFS come storage Proxmox",
+        "tailRich": " — quando il CT espone l’esportazione, registra la condivisione NFS in Proxmox per visualizzarla in <em>Datacenter → Storage</em>."
+      }
+    ]
+  }
+}
diff --git a/web/messages/it/docs/storage-share/lxc-samba-client.json b/web/messages/it/docs/storage-share/lxc-samba-client.json
new file mode 100644
index 00000000..806c08f0
--- /dev/null
+++ b/web/messages/it/docs/storage-share/lxc-samba-client.json
@@ -0,0 +1,155 @@
+{
+  "meta": {
+    "title": "client Samba in LXC | Documentazione ProxMenux",
+    "description": "Monta le condivisioni Samba o CIFS direttamente da un container Proxmox LXC con ProxMenux. Lo script installa cifs-utils e smbclient, rileva automaticamente i server, protegge le credenziali e configura montaggi permanenti tramite /etc/fstab. Richiede un container privilegiato.",
+    "ogTitle": "client Samba in LXC | Documentazione ProxMenux",
+    "ogDescription": "Monta condivisioni Samba / CIFS in un container LXC privilegiato. Rilevamento automatico, file delle credenziali protetto e persistenza in /etc/fstab."
+  },
+  "header": {
+    "title": "client Samba in LXC",
+    "description": "Monta condivisioni Samba (SMB / CIFS) direttamente in un container Proxmox LXC. Il contenitore diventa un vero client CIFS — parla al server Samba sulla rete, esegue mount.cifs, memorizza le credenziali in modo sicuro, e scrive a /etc/fstab. ProxMenux installa cifs-utils + smbclient per voi e valida le credenziali contro il server prima del montaggio.",
+    "section": "Archiviazione e condivisione · LXC"
+  },
+  "privReq": {
+    "title": "Contenitore privilegiato richiesto",
+    "body": "Il client Samba / CIFS che usa <code>mount.cifs</code> richiede capacità (almeno <code>SYS_ADMIN</code>) non disponibili nei container LXC non privilegiati. Lo script chiede di scegliere un CT e <strong>si interrompe se non è privilegiato</strong>. Per usare la condivisione in un CT non privilegiato, montala prima sull’host Proxmox con <hostSambaLink>Condivisione Samba / CIFS come storage Proxmox</hostSambaLink> e rendila accessibile al CT tramite bind mount con <mountLink>LXC Mount Manager</mountLink>."
+  },
+  "what": {
+    "heading": "Cosa succede?",
+    "body": "Il contenitore parla CIFS sulla rete e monta la condivisione da solo. L'host Proxmox è solo il ponte di rete — non vede o gestisce il montaggio.",
+    "diagramServerLabel": "Server Samba",
+    "diagramServerDetail": "//srv/share",
+    "diagramHostLabel": "Host Proxmox",
+    "diagramHostDetail": "(solo un\nponte di rete)",
+    "diagramCtLabel": "LXC (privilegiato)",
+    "diagramCtDetail": "/mnt/share\nmount.cifs all'interno di CT",
+    "diagramArrow": "CIFS",
+    "twoWaysTitle": "Due modi per dare un CT una quota Samba — scegliere uno",
+    "twoWaysBind": "<strong>Bind mount tramite host</strong> (<mountLink>LXC Mount Manager</mountLink>): l’host monta CIFS una volta e ogni CT riceve lo stesso percorso tramite bind mount. Funziona con CT non privilegiati. Consigliato quando più CT usano la stessa condivisione.",
+    "twoWaysDirect": "<strong>Montaggio CIFS diretto nel CT</strong> (questa pagina): il CT monta CIFS da sé. Richiede un CT privilegiato. Utile quando il CT deve gestire le proprie credenziali o ogni CT usa un server diverso."
+  },
+  "opening": {
+    "heading": "Apertura dello strumento",
+    "body": "Dal menu principale apri <strong>Storage &amp; Share Manager → Configura client Samba in LXC (solo privilegiato)</strong>. ProxMenux chiede di <strong>scegliere il CT di destinazione</strong>, lo avvia se è fermo e si interrompe se non è privilegiato. Dopo la selezione compare questo sottomenu:",
+    "imageAlt": "Menu client Samba — Monta / Visualizza / Smonta / Verifica connettività"
+  },
+  "howRuns": {
+    "heading": "Come viene eseguito lo script (Mount flow)"
+  },
+  "creds": {
+    "heading": "Dove vive la password",
+    "body": "ProxMenux <strong>non inserisce la password nel comando di montaggio</strong> o in <code>/etc/fstab</code>. Crea invece un file di credenziali nel CT. Il file contiene credenziali in chiaro protette da permessi riservati a root; non è crittografato:",
+    "whyTitle": "Perché un file separato piuttosto che fstab",
+    "whyBody": "Il modulo CIFS accetta <code>username=</code> / <code>password=</code> opzioni in linea in fstab, ma chiunque può leggere <code>/etc/fstab</code> vede la password in chiaro. Mettere le credenziali in un file root-only e puntare fstab ad esso (<code>credentials=</code>) mantiene la password fuori dalla configurazione leggibile in tutto il mondo."
+  },
+  "options": {
+    "heading": "Opzioni di montaggio spiegato",
+    "headerOption": "Opzione",
+    "headerEffect": "Che cosa fa",
+    "rows": [
+      {
+        "option": "rw / ro",
+        "effect": "Modalità lettura-scrittura o sola lettura per l'intero montaggio."
+      },
+      {
+        "option": "file_mode=0664",
+        "effect": "Permessi riportati per i file tramite CIFS. Default permette al proprietario + gruppo di scrivere, altri leggere."
+      },
+      {
+        "option": "dir_mode=0775",
+        "effect": "Le autorizzazioni riportate per le directory. Default consente al proprietario+gruppo di entrare e creare, altri traversi."
+      },
+      {
+        "option": "iocharset=utf8",
+        "effect": "Forza UTF-8 per i nomi di file ricevuti dalla rete, evitando caratteri illeggibili nei nomi non ASCII."
+      },
+      {
+        "option": "credentials=file",
+        "effect": "Leggi nome utente / password dal file (aggiunto automaticamente per utente auth)."
+      },
+      {
+        "option": "guest",
+        "effect": "Autentica come ospite, nessuna credenziali necessaria (aggiunta automaticamente quando viene scelto l'ospite)."
+      },
+      {
+        "option": "_netdev",
+        "effect": "Segnala al sistema di inizializzazione che questo montaggio richiede la rete. L’avvio non resta bloccato in attesa del montaggio."
+      },
+      {
+        "option": "x-systemd.automount",
+        "effect": "Montaggio al primo accesso: il filesystem viene montato solo quando viene usato. Se il server CIFS non è raggiungibile all’avvio, il CT non resta bloccato."
+      },
+      {
+        "option": "noauto",
+        "effect": "Evita il montaggio immediato all’avvio. In combinazione con l’unità automount, il filesystem viene montato solo quando serve."
+      }
+    ],
+    "netEffectTitle": "Effetto netto delle bandiere fstab",
+    "netEffectBody": "Il filesystem CIFS viene montato al <em>primo accesso</em> anziché subito durante l’avvio. Se il server è offline, l’accesso può attendere o fallire e influire sui servizi che dipendono dal percorso. Automount riduce la dipendenza all’avvio, ma non garantisce che tutti i servizi del CT restino indipendenti da un guasto CIFS."
+  },
+  "manual": {
+    "heading": "Equivalente manuale",
+    "body": "Replica l'intero flusso a mano — ogni comando viene eseguito <strong>dentro il CT</strong> tramite <code>pct exec &lt;ctid&gt; --</code> o direttamente tramite <code>pct enter &lt;ctid&gt;</code>:",
+    "guestIntro": "variante ospite — nessun file di credenziali necessario:"
+  },
+  "view": {
+    "heading": "Visualizzare i montaggi correnti",
+    "body": "Elenca i punti di montaggio CIFS attivi nel CT tramite <code>mount -t cifs</code> e tutte le righe CIFS del suo <code>/etc/fstab</code>. Per ciascuna voce di fstab mostra se il montaggio è attivo, così puoi individuare quelli permanenti che non sono stati ripristinati all’avvio."
+  },
+  "unmount": {
+    "heading": "Smonta la condivisione Samba",
+    "body": "Riunisce i montaggi attivi e le voci di fstab in un elenco. Per l’elemento scelto <strong>rimuove la riga corrispondente da <code>/etc/fstab</code></strong> e il relativo file delle credenziali. Lo script non esegue <code>umount</code> sul filesystem attivo: segnala che occorre riavviare il CT per completare lo smontaggio.",
+    "warnTitle": "Lo script rimuove le voci da fstab, senza smontare i filesystem attivi",
+    "warnBody": "Segue lo stesso criterio del client NFS: <code>umount</code> fallisce con “device busy” se il montaggio è ancora in uso. Rimuovere la voce da fstab impedisce che venga ripristinato al prossimo avvio del CT. Per smontarlo <em>subito</em>, esegui manualmente <code>pct exec &lt;ctid&gt; -- umount /mnt/&lt;path&gt;</code> dopo la fine dello script."
+  },
+  "test": {
+    "heading": "Prova la connettività Samba",
+    "body": "La diagnostica nel CT verifica l’installazione di <code>cifs-utils</code>, elenca i montaggi CIFS attivi e controlla per ogni server indicato in fstab ping, porte 139/445 ed elenco delle condivisioni accessibili come guest. “Autenticazione richiesta” nel test guest è normale se il server non espone condivisioni pubbliche."
+  },
+  "troubleshoot": {
+    "heading": "Risoluzione dei problemi",
+    "privTitle": "Container privilegiato richiesto (lo script si interrompe)",
+    "privBody": "Il CT selezionato non è privilegiato. Il client CIFS del kernel richiede la capacità <code>SYS_ADMIN</code>, non disponibile nei CT non privilegiati. Converti il CT in privilegiato oppure usa l’alternativa indicata nell’avviso all’inizio della pagina.",
+    "aptTitle": "apt-get install fails",
+    "aptIntro": "Lo script assume una famiglia Debian CT (<code>apt-get</code>). Su Alpine / Arch / Rocky / Alma, installare il client CIFS a mano:",
+    "aptItems": [
+      "Alpine: <code>apk add cifs-utils samba-client</code>",
+      "Arch: <code>pacman -S cifs-utils smbclient</code>",
+      "Rocky / Alma: <code>dnf install cifs-utils samba-client</code>"
+    ],
+    "aptOutro": "Quindi eseguire nuovamente lo script ProxMenux — il passaggio di installazione salta quando gli strumenti sono già presenti.",
+    "guestFallbackTitle": "\"Il server ti ha collegato come ospite invece dell'utente specificato\"",
+    "guestFallbackBody": "La validazione attiva dello script ha preso un vero problema auth. Il server ha accettato la connessione ma l'ha degradata agli ospiti perché le credenziali sono sbagliate. Cause comuni: typo nel nome utente / password, l'utente non esiste sul server, l'utente è bloccato, o il gruppo di lavoro / dominio è errato. Ripeti la procedura e reinserisci con attenzione le credenziali (la password è nascosta nella finestra di dialogo).",
+    "denyTitle": "\"NT_STATUS_ACCESS_DENIED\" durante il montaggio",
+    "denyBody": "Le credenziali sono state convalidate ma la quota nega l'accesso. Controllare sul lato server se l'utente ha autorizzazioni su quella specifica quota (validazione conferma solo il login, non per-share ACLs). Verificare anche se il server richiede una specifica versione del protocollo SMB: aggiungere <code>vers=3.0</code> (o <code>2.1</code>, <code>2.0</code>) alle opzioni di montaggio.",
+    "utf8Title": "Nomi di file UTF-8 / non ASCII visualizzati male",
+    "utf8Body": "Le opzioni di default includono <code>iocharset=utf8</code>, ma alcune configurazioni del server segnalano una pagina di codice inaspettata. Se i nomi di file con accenti / simboli sembrano sbagliati, anche provare <code>nounix</code> (alcuni server Samba Linux ne hanno bisogno quando il client è anche Linux) o impostare il lato server a <code>unix extensions = no</code>.",
+    "bootTitle": "Il montaggio permanente riesce, ma non viene ripristinato all’avvio",
+    "bootBody": "Le cause più comuni sono la rete non ancora pronta quando il CT tenta il montaggio, il server non raggiungibile all’avvio oppure DNS non disponibile. Le opzioni <code>_netdev,x-systemd.automount,noauto</code> dello script risolvono il primo caso; automount attende normalmente il primo accesso. Per problemi DNS usa l’IP del server anziché il nome host."
+  },
+  "related": {
+    "heading": "Correlati",
+    "items": [
+      {
+        "href": "/docs/storage-share/lxc-mount-points",
+        "label": "LXC Punti di montaggio (Host ↔ Contenitore)",
+        "tail": " — l'alternativa per le TC non private: montare su host, legare in CT."
+      },
+      {
+        "href": "/docs/storage-share/lxc-nfs-client",
+        "label": "client NFS in LXC",
+        "tail": " — pagina correlata con lo stesso schema per le condivisioni NFS."
+      },
+      {
+        "href": "/docs/storage-share/lxc-samba-server",
+        "label": "Server Samba in LXC",
+        "tailRich": " — l’inverso: esporre cartelle <em>da</em> un CT tramite Samba."
+      },
+      {
+        "href": "/docs/storage-share/host-samba",
+        "label": "Samba / CIFS come storage Proxmox",
+        "tail": " — registrare la condivisione in Proxmox anziché in un singolo CT."
+      }
+    ]
+  }
+}
diff --git a/web/messages/it/docs/storage-share/lxc-samba-server.json b/web/messages/it/docs/storage-share/lxc-samba-server.json
new file mode 100644
index 00000000..b89c587a
--- /dev/null
+++ b/web/messages/it/docs/storage-share/lxc-samba-server.json
@@ -0,0 +1,132 @@
+{
+  "meta": {
+    "title": "Server Samba in LXC | Documentazione ProxMenux",
+    "description": "Esegui un server Samba (SMB / CIFS) in un container LXC Proxmox con ProxMenux. Installa samba automaticamente e gestisce /etc/samba/smb.conf, utenti smbpasswd e il gruppo sharedfiles per cartelle montate tramite bind mount. Richiede un container privilegiato.",
+    "ogTitle": "Server Samba in LXC | Documentazione ProxMenux",
+    "ogDescription": "Condividi cartelle via SMB/CIFS da un LXC privilegiato. Installazione automatica, utente smbpasswd e permessi adatti ai bind mount."
+  },
+  "header": {
+    "title": "Server Samba in LXC",
+    "description": "Eseguire un server Samba (SMB / CIFS) all'interno di un contenitore Proxmox LXC ed esporre le cartelle ai client Windows / macOS / Linux sulla rete. ProxMenux installa samba, crea un utente Samba con smbpasswd, gestisce /etc/samba/smb.conf, e applica permessi adatti ai bind mount quando la cartella condivisa viene dall'host.",
+    "section": "Archiviazione e condivisione · LXC"
+  },
+  "privReq": {
+    "title": "Contenitore privilegiato richiesto",
+    "body": "Samba impersona l'utente di collegamento con <code>setgroups()</code> su ogni connessione albero (il momento in cui un cliente apre una condivisione). In un LXC non privilegiato, il kernel rifiuta la chiamata di sistema perché lo spazio di nome utente del contenitore è creato con <code>setgroups=deny</code> — e <code>smbd</code> risponde interrompendo il processo di lavorazione con <code>PANIC: sys_setgroups failed</code>. Il risultato è che <code>smbd</code> inizia e lega porte 139/445, ma ogni connessione client non funziona con <code>NT_STATUS_CONNECTION_DISCONNECTED</code>. Lo script applica un CT privilegiato per questo motivo e <strong>si interrompe se il CT non è privilegiato</strong>. Non c'è correzione pulita sul lato server; utilizzare un CT privilegiato, o eseguire Samba all'interno di una VM."
+  },
+  "what": {
+    "heading": "Cosa succede?",
+    "body": "Il contenitore diventa un server SMB/CIFS: esegue <code>smbd</code>, espone una cartella tramite <code>/etc/samba/smb.conf</code> e accetta le connessioni client sulle porte <code>139</code> / <code>445</code>. I client vedono la condivisione a <code>\\\\&lt;ct-ip&gt;\\&lt;share-name&gt;</code> in Windows Explorer, <code>smb://&lt;ct-ip&gt;/&lt;share-name&gt;</code> in macOS Finder, o tramite <code>mount.cifs</code> su Linux.",
+    "diagramServerLabel": "LXC (privilegiato) — server Samba",
+    "diagramServerDetail": "/mnt/data\n(cartella condivisa)\n\nsmbd + nmbd in esecuzione\n\nUtente: <username>\n(via smbpasswd)\n\nGruppo imposto:\nsharedfiles",
+    "diagramClientLabel": "Qualsiasi client sulla rete",
+    "diagramClientDetail": "Windows: \\\\<ip>\\<share>\nmacOS:   smb://<ip>/<share>\nLinux: mount.cifs",
+    "diagramArrow": "SMB / CIFS"
+  },
+  "perms": {
+    "heading": "Due percorsi di autorizzazione a seconda del tipo di cartella",
+    "body": "Prima di aggiungere la condivisione a <code>smb.conf</code>, lo script verifica se la cartella scelta è un <strong>bind mount proveniente dall’host</strong> oppure una normale <strong>cartella locale nel CT</strong>. Imposta quindi proprietario e permessi in modo diverso:",
+    "headerType": "Tipo di cartella",
+    "headerAction": "Cosa fa lo script",
+    "bindType": "Bind-mount da host",
+    "bindTypeSubRich": "rilevato tramite uscita <code>mount</code>",
+    "bindActionRich": "Crea gruppo <code>sharedfiles</code> (default GID 999, dinamico se assunto), aggiunge l'utente Samba ad esso, poi <code>chown root:sharedfiles</code> + <code>chmod 2775</code> (SGID — nuovi file ereditano il gruppo). Se l'utente non può ancora scrivere, applica <code>setfacl -m u:&lt;user&gt;:rwx</code>.",
+    "localType": "Cartella locale dentro CT",
+    "localTypeSub": "nessun bind mount rilevato",
+    "localActionRich": "Proprietà standard: <code>chown -R &lt;user&gt;:&lt;user&gt;</code> + <code>chmod -R 755</code>. Nessun gruppo condiviso necessario perché nessun altro CT scrive a questa cartella. Torna a <code>setfacl</code> se manca ancora l'accesso alla scrittura.",
+    "gidTitle": "GID per 'sharedfiles' differisce dal flusso server NFS",
+    "gidBody": "Lo script del server Samba utilizza GID <strong>999</strong> per <code>sharedfiles</code>, mentre il <nfsLink>flusso del server NFS</nfsLink> utilizza GID <strong>101000</strong>. Se si esegue entrambi i server nello stesso CT e desiderare un singolo gruppo condiviso su entrambi i protocolli, modificare uno di loro per abbinare l'altro dopo l'installazione (ad es. <code>groupmod -g 101000 sharedfiles</code>) e riapplicare la proprietà sulle cartelle interessate. Questa è una nota incoerenza negli script attuali."
+  },
+  "opening": {
+    "heading": "Apertura dello strumento",
+    "body": "Dal menu principale, apri <strong>Storage & Share Manager → Configure Samba Server in LXC</strong>. Sono elencati solo i CT privilegiati. Scegli il CT di destinazione; lo script lo avvia se è fermo e rifiuta i CT non privilegiati. Il menu presenta cinque opzioni.",
+    "imageAlt": "Menu Samba Server Manager — Crea / Visualizza / Elimina / Stato / Disinstallare"
+  },
+  "howRuns": {
+    "heading": "Come funziona lo script (Crea flusso)"
+  },
+  "modes": {
+    "heading": "Le tre modalità di condivisione",
+    "intro": "Ogni modalità scrive una sezione diversa in <code>smb.conf</code>. Tutti e tre includono <code>valid users = &lt;username&gt;</code> (non anonimo), <code>force group = sharedfiles</code> (così nuovi file appartengono al gruppo condiviso) e <code>veto files = /lost+found/</code> (nascondere dai clienti).",
+    "headerMode": "Modalità",
+    "headerBlock": "Blocco scritto a smb.conf",
+    "rwMode": "Lettura e scrittura",
+    "roMode": "Sola lettura",
+    "customMode": "Personalizzato",
+    "customBodyRich": "Digita le tue direttive in una scatola di testo libero. ProxMenux li avvolge ancora in un blocco <code>[share]</code> con lo standard <code>path</code>, <code>valid users</code>, <code>force group</code> e <code>veto files</code>."
+  },
+  "manual": {
+    "heading": "Equivalente manuale",
+    "body": "Riproduci manualmente l’intera procedura. Ogni comando viene eseguito <strong>nel CT</strong> tramite <code>pct exec &lt;ctid&gt; --</code> o <code>pct enter &lt;ctid&gt;</code>:"
+  },
+  "connect": {
+    "heading": "Collegamento da clienti",
+    "headerOs": "Sistema operativo del client",
+    "headerHow": "Come collegare",
+    "windowsOs": "Windows",
+    "windowsHowRich": "Esplora file → barra degli indirizzi: <code>\\\\&lt;ct-ip&gt;\\&lt;share-name&gt;</code>. Oppure <em>Connetti unità di rete</em> → seleziona «Connetti con credenziali diverse».",
+    "macosOs": "macOS",
+    "macosHowRich": "Finder → <em>Vai → Connessione al server...</em> → <code>smb://&lt;ct-ip&gt;/&lt;share-name&gt;</code>. O <code>mount_smbfs //user@&lt;ct-ip&gt;/&lt;share&gt; /mountpoint</code>.",
+    "linuxOs": "Linux",
+    "linuxHowRich": "<code>mount -t cifs //&lt;ct-ip&gt;/&lt;share&gt; /mnt/x -o username=&lt;u&gt;,password=&lt;p&gt;,iocharset=utf8</code>. Oppure utilizzare il client <clientLink>Samba nella pagina LXC</clientLink> se il client è un altro Proxmox CT."
+  },
+  "view": {
+    "heading": "Visualizza le condivisioni attuali",
+    "body": "Analizza <code>/etc/samba/smb.conf</code> all'interno del CT e elenca ogni blocco <code>[share]</code> (saltando <code>[global]</code>, <code>[homes]</code>, <code>[printers]</code>) con il suo percorso. Utile come un inventario rapido."
+  },
+  "delete": {
+    "heading": "Elimina una condivisione",
+    "body": "Consente di selezionare una condivisione per nome, rimuove il blocco da <code>smb.conf</code> (<code>sed</code> cancella da <code>[share]</code> fino alla prossima riga vuota), e riavvia <code>smbd</code>. La cartella stessa e il suo contenuto sono lasciati intatti."
+  },
+  "status": {
+    "heading": "Controlla lo stato Samba",
+    "body": "Indica se <code>smbd</code> e <code>nmbd</code> sono installati e attivi, elenca gli utenti Samba (<code>pdbedit -L</code>) e mostra le sessioni attive (<code>smbstatus</code>)."
+  },
+  "uninstall": {
+    "heading": "Disinstallare il server Samba",
+    "body": "Pulizia completa dopo conferma: arresta e disabilita <code>smbd</code> e <code>nmbd</code>, salva <code>smb.conf</code> in <code>smb.conf.backup.YYYYMMDD_HHMMSS</code>, rimuove gli utenti Samba con <code>smbpasswd -x</code> e i pacchetti Samba con <code>apt-get purge</code>. Le <strong>cartelle esportate non vengono eliminate</strong>.",
+    "warnTitle": "Le cartelle rimangono — esegui il backup dei dati separatamente",
+    "warnBody": "<em>Elimina condivisione</em> e <em>Disinstalla server Samba</em> rimuovono la configurazione della condivisione. I dati delle cartelle esportate vengono conservati. Per eliminarli, usa esplicitamente <code>rm -rf</code> dopo la fine dello script."
+  },
+  "troubleshoot": {
+    "heading": "Risoluzione dei problemi",
+    "privTitle": "Richiesto un container privilegiato (lo script si interrompe)",
+    "privBody": "Il CT selezionato non è privilegiato e <code>smbd</code> non può servire i file lì. Se si bypassa il controllo e si configura Samba a mano, <code>smbd</code> inizia e le porte si aprono, ma la prima connessione client provoca un arresto con <code>PANIC: sys_setgroups failed</code> in <code>/var/log/samba/log.&lt;client&gt;</code> e il client vede <code>NT_STATUS_CONNECTION_DISCONNECTED</code>. La causa è lo spazio di nome utente non privilegiato con <code>setgroups=deny</code>, che blocca l'impersonazione per connessione di Samba. Né <code>features=keyctl=1</code> né rimuovere <code>force user</code> / <code>force group</code> cambia questo. Le uniche opzioni praticabili sono: convertire il CT in privilegiato, o spostare Samba in una VM.",
+    "aptTitle": "apt-get install non riesce",
+    "aptIntro": "Lo script assume una famiglia Debian CT. Su Alpine / Arch / Rocky / Alma, installare Samba a mano:",
+    "aptItems": [
+      "Alpine: <code>apk add samba</code>",
+      "Arch: <code>pacman -S samba</code>",
+      "Rocky / Alma: <code>dnf install samba</code>"
+    ],
+    "aptOutro": "Esegui di nuovo lo script ProxMenux; l’installazione viene saltata se gli strumenti sono già presenti.",
+    "noShareTitle": "Il client si connette ma non vede la condivisione",
+    "noShareBody": "Controllare che <code>browseable = yes</code> è impostato nel blocco della condivisione (default per modalità rw / ro; può essere mancante in personalizzato). Controllare anche il firewall CT e il firewall host Proxmox consentire TCP 445 (SMB) e 139 (NetBIOS). Alcuni client Windows richiedono anche la risoluzione dei nomi — prova l'IP direttamente prima.",
+    "authTitle": "L'autenticazione fallisce (NT_STATUS_LOGON_FAILURE)",
+    "authBody": "La password è errata (le password Samba sono <em>separate</em> da quelle di sistema; elenca gli utenti Samba con <code>pdbedit -L</code>) oppure l’utente manca in <code>valid users</code> per la condivisione. Reimposta la password nel CT con <code>smbpasswd &lt;user&gt;</code>.",
+    "groupTitle": "I file scritti dal client appaiono con gruppo sbagliato sul server",
+    "groupBody": "Lo script imposta <code>force group = sharedfiles</code> nel blocco della condivisione, quindi nuovi file dovrebbero essere di gruppo <code>sharedfiles</code>. Se non lo sono, il bit SGID sulla directory principale può essere perso (qualcuno ha eseguito <code>chmod</code> a mano). Riapplica: <code>chmod 2775 /mnt/&lt;share&gt;</code>.",
+    "bothTitle": "Condividere la stessa cartella sia su NFS che su Samba",
+    "bothBody": "ProxMenux utilizza diversi GID per <code>sharedfiles</code> in ogni script (Samba: 999, NFS: 101000). Se si serve la stessa cartella tramite entrambi, decidere su un GID e allineare entrambi. La soluzione più semplice: dopo aver eseguito entrambi gli script, modificare il GID più piccolo:"
+  },
+  "related": {
+    "heading": "Correlati",
+    "items": [
+      {
+        "href": "/docs/storage-share/lxc-samba-client",
+        "label": "client Samba in LXC",
+        "tail": " — il caso inverso: montare condivisioni Samba esterne nel CT."
+      },
+      {
+        "href": "/docs/storage-share/lxc-nfs-server",
+        "label": "Server NFS in LXC",
+        "tail": " — pagina correlata, stesso schema con NFS al posto di CIFS."
+      },
+      {
+        "href": "/docs/storage-share/host-samba",
+        "label": "Samba / CIFS come storage Proxmox",
+        "tailRich": " — quando il CT espone l’esportazione, registra la condivisione Samba in Proxmox per visualizzarla in <em>Datacenter → Storage</em>."
+      }
+    ]
+  }
+}
diff --git a/web/messages/it/docs/utils/export-vm.json b/web/messages/it/docs/utils/export-vm.json
new file mode 100644
index 00000000..4bc97c3a
--- /dev/null
+++ b/web/messages/it/docs/utils/export-vm.json
@@ -0,0 +1,145 @@
+{
+  "meta": {
+    "title": "Esportare una VM in OVA / OVF | Documentazione ProxMenux",
+    "description": "Esporta una VM Proxmox in un archivio OVA portabile o in una directory OVF usando lo schema DMTF standard. Dischi VMDK in formato streamOptimized e manifesto SHA1. Importabile in VMware ESXi / Workstation / Fusion, VirtualBox e nuovamente in Proxmox.",
+    "ogTitle": "Esportare una VM in OVA / OVF | Documentazione ProxMenux",
+    "ogDescription": "Converti una VM Proxmox in un pacchetto OVA / OVF portabile compatibile con VMware e VirtualBox."
+  },
+  "header": {
+    "title": "Esportare una VM in OVA / OVF",
+    "description": "Converte una VM Proxmox in un pacchetto OVA portabile (un unico archivio TAR) o OVF (descrittore e file VMDK) usando lo schema OVF standard di DMTF. I dischi vengono convertiti con qemu-img in VMDK streamOptimized. Il risultato è importabile in VMware (ESXi / Workstation / Fusion), VirtualBox e nuovamente in Proxmox tramite lo strumento di importazione.",
+    "section": "Utilità"
+  },
+  "intro": {
+    "title": "Cosa fa",
+    "body": "Legge la configurazione di una VM arrestata, converte ogni disco in VMDK streamOptimized, genera un descrittore OVF e un manifesto SHA1 e raggruppa tutto in un unico file <code>.ova</code> o in una directory <code>-ovf</code>. La VM di origine non viene mai modificata."
+  },
+  "picker": {
+    "heading": "Selettore di VM",
+    "body": "All’avvio, lo script elenca tutte le VM di <code>qm list</code> con VMID, nome e stato. Scegli quella da esportare:",
+    "imgAlt": "Finestra di selezione della VM da esportare con l’elenco di tutte le VM"
+  },
+  "stopped": {
+    "heading": "La VM deve essere arrestata",
+    "intro": "Per ottenere un’immagine disco coerente la VM deve essere arrestata. Se la VM selezionata è in esecuzione, ProxMenux propone di arrestarla:",
+    "items": [
+      "Arresto regolare tramite <code>qm shutdown $VMID --timeout 120</code> (attende 2 minuti l’arresto ACPI del sistema guest).",
+      "Se scade il tempo di attesa, propone un arresto forzato: <code>qm stop $VMID</code> (equivale a togliere l’alimentazione).",
+      "Se rifiuti entrambe le opzioni, l’esportazione viene annullata senza modificare i dati."
+    ],
+    "warnTitle": "L’arresto forzato equivale a togliere l’alimentazione",
+    "warnBody": "<code>qm stop</code> equivale a staccare la corrente. Al successivo avvio il sistema guest potrebbe richiedere una riparazione del file system. Preferisci l’arresto regolare quando possibile e riserva quello forzato ai sistemi guest che non rispondono."
+  },
+  "format": {
+    "heading": "Selettore del formato: OVA oppure OVF",
+    "headerFormat": "Formato",
+    "headerOutput": "Output",
+    "headerPros": "Vantaggi",
+    "headerCons": "Svantaggi",
+    "rows": [
+      {
+        "format": "OVA",
+        "output": "name-vmid-ts.ova",
+        "pros": "Un unico file autonomo, facile da spostare, trasferire tramite sftp o allegare a un ticket.",
+        "cons": "Richiede ~220% della dimensione virtuale del disco (spazio aggiuntivo per l’archivio TAR durante la creazione)."
+      },
+      {
+        "format": "OVF",
+        "output": "name-vmid-ts-ovf/",
+        "pros": "~120% della dimensione virtuale del disco. Più facile da esaminare, perché il descrittore è XML testuale. Modificabile prima dell’importazione.",
+        "cons": "Più file, da trasferire tutti insieme."
+      }
+    ]
+  },
+  "destination": {
+    "heading": "Directory di destinazione",
+    "body": "Scegli un percorso predefinito (<code>/var/lib/vz/dump</code>, <code>/var/lib/vz/template/iso</code>) oppure inseriscine uno personalizzato. Lo script verifica che la directory sia scrivibile e avvisa se lo spazio libero sembra insufficiente prima di iniziare.",
+    "calloutTitle": "Stima orientativa dello spazio libero",
+    "calloutBody": "Per esportare in OVF una VM con dischi che totalizzano 100 GB virtuali, prevedi ~120 GB liberi; per OVA, ~220 GB. L’utilizzo effettivo può essere inferiore per dischi quasi vuoti. L’archivio OVA viene creato con TAR non compresso mentre esistono ancora i file VMDK temporanei: occorre quindi spazio per entrambi. Se lo spazio termina durante l’esportazione, il gestore di EXIT pulisce la directory temporanea e devi ricominciare."
+  },
+  "package": {
+    "heading": "Cosa finisce nel pacchetto",
+    "intro": "Per un OVA / OVF chiamato <code>myvm-100-2026-04-26_18-30-15</code>:",
+    "code": "# OVA mode (single .ova file is a TAR of):\nmyvm-100-2026-04-26_18-30-15.ovf      # XML descriptor (DMTF OVF 1.0 + RASD + VSSD)\nmyvm-100-2026-04-26_18-30-15.mf       # SHA1 manifest\nmyvm-100-2026-04-26_18-30-15-disk0.vmdk\nmyvm-100-2026-04-26_18-30-15-disk1.vmdk\n...\n\n# OVF mode (a directory):\nmyvm-100-2026-04-26_18-30-15-ovf/\n├── myvm-100-2026-04-26_18-30-15.ovf\n├── myvm-100-2026-04-26_18-30-15.mf\n├── myvm-100-2026-04-26_18-30-15-disk0.vmdk\n└── myvm-100-2026-04-26_18-30-15-disk1.vmdk"
+  },
+  "exported": {
+    "heading": "Cosa viene esportato",
+    "items": [
+      "<strong>Dischi:</strong> tutte le voci <code>scsi*</code>, <code>sata*</code>, <code>virtio*</code> e <code>ide*</code> nella configurazione della VM, convertite in VMDK streamOptimized.",
+      "<strong>Numero di vCPU</strong> (RASD ResourceType 3) e <strong>memoria</strong> in MiB (ResourceType 4).",
+      "<strong>Numero di schede di rete</strong> (ResourceType 10: solo il numero, senza bridge o modello).",
+      "<strong>Nome della VM</strong> e indicazione del tipo di sistema operativo."
+    ],
+    "notTitle": "Che cosa NON è esportato",
+    "notItems": [
+      "Montaggi CD-ROM e ISO, esclusi intenzionalmente.",
+      "Unità cloud-init (escluse intenzionalmente).",
+      "Bridge e modello specifici della scheda di rete (viene conservato solo il numero).",
+      "Scelta BIOS / UEFI, da riconfigurare durante l’importazione.",
+      "Configurazione del passthrough PCI.",
+      "Snapshot: viene acquisito solo lo stato attuale.",
+      "Opzioni di livello VM (NUMA, pagine enormi, hotplug, ...)."
+    ]
+  },
+  "conversion": {
+    "heading": "Conversione del disco",
+    "intro": "Ogni disco viene convertito con:",
+    "code": "qemu-img convert -p -O vmdk -o subformat=streamOptimized \\\n    \"$source_path\" \\\n    \"$work_dir/<base_name>-disk<N>.vmdk\"",
+    "outro": "<code>streamOptimized</code> è il formato VMware leggibile in un solo passaggio, supportato da ESXi 6.7+, VMware Workstation, VirtualBox e dallo stesso Proxmox. È il sottoformato VMDK più ampiamente compatibile e adatto alla portabilità. Lo svantaggio è che non consente l’accesso casuale e quindi non può essere montato direttamente senza conversione."
+  },
+  "manifest": {
+    "heading": "Manifesto SHA1",
+    "intro": "Ogni pacchetto include un file <code>.mf</code> con gli hash SHA1 del descrittore OVF e di ogni VMDK:",
+    "code": "SHA1(myvm-100-2026-04-26_18-30-15.ovf)= 3a7bd3e2360a3d29eea436fcfb7e44c735d117c9\nSHA1(myvm-100-2026-04-26_18-30-15-disk0.vmdk)= b7e23ec29af22b0b4e41da31e868d57226121c84\nSHA1(myvm-100-2026-04-26_18-30-15-disk1.vmdk)= a87ff679a2f3e71d9181a67b7542122c",
+    "outro": "È facoltativo nella specifica OVF e molti programmi lo ignorano, ma serve a verificare che il pacchetto sia stato trasferito integro. Verificalo manualmente con <code>sha1sum -c file.mf</code>."
+  },
+  "import": {
+    "heading": "Importazione del risultato",
+    "intro": "Il pacchetto esportato può essere importato in:",
+    "items": [
+      {
+        "href": "/docs/utils/import-vm",
+        "preRich": "<strong>Proxmox</strong> — usa lo strumento corrispondente ",
+        "linkLabel": "Importa VM da OVA / OVF",
+        "tailRich": "."
+      },
+      {
+        "tailRich": "<strong>VMware ESXi</strong> — Datacenter → Deploy OVF Template; seleziona il file .ova o .ovf."
+      },
+      {
+        "tailRich": "<strong>VMware Workstation / Fusion</strong> — File → Open; seleziona il file .ova o .ovf."
+      },
+      {
+        "tailRich": "<strong>VirtualBox</strong> — File → Import Appliance; seleziona il file .ova o .ovf."
+      }
+    ]
+  },
+  "troubleshoot": {
+    "heading": "Risoluzione dei problemi",
+    "noSpaceTitle": "qemu-img convert si interrompe durante la conversione con \"No space left on device\"",
+    "noSpaceBody": "La destinazione ha esaurito lo spazio. Il gestore di EXIT pulisce automaticamente la directory temporanea. Scegli una destinazione con più spazio libero (vedi la stima precedente) e ripeti l’esportazione.",
+    "unsupportedHwTitle": "L’esportazione termina ma VMware rifiuta l’importazione: \"Unsupported hardware family\"",
+    "unsupportedHwBody": "Alcune versioni di ESXi rifiutano descrittori OVF che dichiarano una famiglia hardware sconosciuta. Apri il .ovf in un editor di testo, oppure estrai prima il .ova, cerca <code>&lt;vssd:VirtualSystemType&gt;</code> e imposta un valore accettato da ESXi, ad esempio <code>vmx-13</code> per ESXi 6.5+. Per aggirare rapidamente il problema, prova VirtualBox, che è più permissivo.",
+    "nicTitle": "La VM importata usa una scheda di rete o un controller SCSI diverso",
+    "nicBody": "L’OVF conserva il numero di schede di rete, non il modello originale. Controlla le impostazioni di rete della VM importata nell’hypervisor di destinazione. L’esportazione dichiara un controller SCSI lsilogic per la compatibilità con VMware. Quando reimporti in Proxmox con ProxMenux, la VM viene creata con un controller LSI e schede e1000; passa poi a <code>VirtIO SCSI</code> e VirtIO se il sistema guest dispone dei driver adatti.",
+    "runningTitle": "La VM era in esecuzione e ho rifiutato di arrestarla: esportazione annullata",
+    "runningBody": "Lo script non può produrre un’immagine coerente mentre vengono scritti dati sui dischi. Accetta la richiesta di arresto la prossima volta, oppure arresta prima la VM manualmente (<code>qm shutdown $VMID</code>) e ripeti l’esportazione.",
+    "slowTitle": "La conversione del disco è lenta",
+    "slowBody": "<code>qemu-img convert</code> usa un solo thread e legge l’origine alla massima velocità. Per un disco da 100 GB su un disco rigido meccanico, prevedi 15–30 minuti. Da NVMe a NVMe è 5–10 volte più veloce. I dischi di una VM vengono convertiti in sequenza; il tempo aumenta linearmente con la dimensione virtuale totale."
+  },
+  "related": {
+    "heading": "Correlati",
+    "items": [
+      {
+        "href": "/docs/utils/import-vm",
+        "label": "Importa VM da OVA / OVF",
+        "tail": " — lo strumento complementare per reimportare la VM."
+      },
+      {
+        "href": "/docs/utils",
+        "label": "Panoramica delle utilità",
+        "tail": " — torna alla panoramica della sezione."
+      }
+    ]
+  }
+}
diff --git a/web/messages/it/docs/utils/import-vm.json b/web/messages/it/docs/utils/import-vm.json
new file mode 100644
index 00000000..4677ef21
--- /dev/null
+++ b/web/messages/it/docs/utils/import-vm.json
@@ -0,0 +1,218 @@
+{
+  "meta": {
+    "title": "Importare una VM da OVA / OVF | Documentazione ProxMenux",
+    "description": "Importa una VM VMware ESXi / Workstation / Fusion / VirtualBox / ProxMenux in Proxmox VE. Estrae automaticamente OVA, analizza i metadati OVF, crea la VM e importa ogni disco nel formato nativo dello storage (qcow2 / raw).",
+    "ogTitle": "Importare una VM da OVA / OVF | Documentazione ProxMenux",
+    "ogDescription": "Importa in Proxmox le VM esportate da VMware, VirtualBox o ProxMenux. I dischi vengono convertiti automaticamente nel formato nativo dello storage."
+  },
+  "header": {
+    "title": "Importa VM da OVA / OVF",
+    "description": "Importa un pacchetto OVA / OVF in Proxmox VE: estrae gli archivi OVA, legge dal descrittore OVF vCPU, memoria, numero di schede di rete e riferimenti ai dischi, poi crea la VM e importa ogni disco con qm importdisk nello storage scelto. Compatibile con le esportazioni VMware (ESXi / Workstation / Fusion), VirtualBox e ProxMenux.",
+    "section": "Utilità"
+  },
+  "intro": {
+    "title": "Cosa fa",
+    "body": "Crea una VM completa in Proxmox da un pacchetto portabile. Dopo l’importazione è pronta per l’avvio; si consigliano alcuni controlli e regolazioni di modello della scheda di rete, firmware e tipo di sistema operativo per prestazioni e compatibilità."
+  },
+  "picker": {
+    "heading": "Selettore di file",
+    "intro": "Al lancio, lo script offre due directory preimpostate o un percorso manuale:",
+    "items": [
+      "<code>/var/lib/vz/dump</code> — la directory di backup Proxmox vzdump predefinita.",
+      "<code>/var/lib/vz/template/iso</code> — utile se vi hai trasferito il file OVA tramite sftp.",
+      "Percorso manuale — per i file OVA / OVF altrove sull'host."
+    ],
+    "outro": "Quindi elenca ogni file <code>.ova</code> e <code>.ovf</code> nella directory selezionata.",
+    "imageAlt": "Finestra di selezione del file della VM da importare"
+  },
+  "flow": {
+    "heading": "Come funziona l'importazione",
+    "nodes": [
+      {
+        "label": "Ingresso OVA / OVF",
+        "detail": ".ova → tar xf in\n /tmp/.proxmenux-import-*\n.ovf → usa il file sul posto",
+        "variant": "source"
+      },
+      {
+        "label": "Analisi e finestre di dialogo",
+        "detail": "AWK legge OVF\n(nome, vCPU, RAM, NIC,\ndischi). Scelta di\nVMID / storage / bridge",
+        "variant": "bridge"
+      },
+      {
+        "label": "qm create + importdisk",
+        "detail": "qm create $VMID\nqm importdisk\n(VMDK → formato dello storage)\nqm set --scsiN",
+        "variant": "target"
+      }
+    ]
+  },
+  "ovf": {
+    "heading": "Analisi OVF",
+    "intro": "Un parser <strong>gawk</strong> legge il descrittore OVF ed estrae i metadati della VM. Usa <code>match()</code> con tre argomenti, una funzione specifica di gawk non supportata da mawk, il <code>awk</code> predefinito in Debian / Proxmox. Se manca, alla prima importazione gawk viene installato con <code>ensure_repositories</code> + <code>install_single_package</code>; le importazioni successive non richiedono questo passaggio. Campi estratti:",
+    "headerField": "Campo",
+    "headerSource": "Fonte in OVF",
+    "headerDefault": "Predefinito se manca",
+    "rows": [
+      {
+        "field": "Nome VM",
+        "source": "<Name> (prima corrispondenza)",
+        "default": "imported-vm"
+      },
+      {
+        "field": "Conteggio vCPU",
+        "source": "RASD ResourceType 3 → VirtualQuantity",
+        "default": "1"
+      },
+      {
+        "field": "Memoria (MiB)",
+        "source": "RASD ResourceType 4 → VirtualQuantity",
+        "default": "1024"
+      },
+      {
+        "field": "Numero di schede di rete",
+        "source": "conteggio di ResourceType 10",
+        "default": "1"
+      },
+      {
+        "field": "Tipo di sistema operativo",
+        "source": "/Linux/ o /Windows/ nella descrizione",
+        "default": "other"
+      },
+      {
+        "field": "Riferimenti del disco",
+        "source": "attributi href che terminano in .vmdk / .qcow2 / .img / .raw",
+        "default": "Nessuno (importazione annullata)"
+      }
+    ]
+  },
+  "memWarn": {
+    "title": "Ambiguità delle unità di memoria",
+    "body": "Il parser converte le unità di memoria riconosciute in <strong>MiB</strong>, inclusi byte, KiB, MiB, GiB e le etichette testuali supportate. Le unità mancanti o sconosciute sono <em>trattate come MiB</em>. Dopo l’importazione, confronta <code>qm config $VMID | grep memory</code> con la RAM documentata della VM di origine e, se serve, correggila con <code>qm set $VMID --memory &lt;MiB&gt;</code>."
+  },
+  "dialog": {
+    "heading": "Sequenza delle finestre di importazione",
+    "items": [
+      "<strong>VMID</strong> — propone il prossimo identificativo disponibile (<code>pvesh get /cluster/nextid</code>).",
+      "<strong>Nome della VM</strong> — usa il nome letto nell’OVF; puoi modificarlo.",
+      "<strong>Storage di destinazione</strong> — elenco degli storage con contenuto <code>images</code>, ottenuto da <code>pvesm status -content images</code>.",
+      "<strong>Bridge di rete</strong> — elenco dei bridge da <code>ip link show type bridge</code>. Se ne esiste uno solo, viene scelto automaticamente; il valore predefinito è <code>vmbr0</code>.",
+      "<strong>Conferma</strong> — riepilogo con VMID, nome, vCPU, memoria, schede di rete, storage, bridge e dischi da importare. Annullando qui non viene modificato nulla."
+    ]
+  },
+  "create": {
+    "heading": "Creazione VM",
+    "intro": "Dopo la conferma, lo script viene eseguito:",
+    "code": "qm create $VMID \\\n    --name \"$NAME\" \\\n    --memory $MEMORY \\\n    --cores $VCPU \\\n    --ostype $OSTYPE \\\n    --scsihw lsi \\\n    --net0 e1000,bridge=$BRIDGE\n\n# For each additional NIC:\nqm set $VMID --netN e1000,bridge=$BRIDGE",
+    "outro": "Il controller SCSI predefinisce <code>lsi</code> (LSI Logic) per la compatibilità VMDK. NIC di default a <code>e1000</code> (compatibilità universale) sul ponte scelto."
+  },
+  "diskLoop": {
+    "heading": "loop di importazione del disco",
+    "intro": "Per ogni riferimento del disco nell'OVF:",
+    "items": [
+      "<code>qm importdisk $VMID $disk_path $STORAGE</code> — importa il disco in un formato supportato dallo storage di destinazione e crea una voce <code>unusedN:</code> nella configurazione della VM.",
+      "Lo script cerca con grep nella configurazione il riferimento <code>unusedN</code> appena creato.",
+      "<code>qm set $VMID --scsiN $unused_disk</code> — collega il disco come <code>scsi0</code>, <code>scsi1</code>, ...",
+      "<code>qm set $VMID --delete unusedN</code> — elimina il marcatore inutilizzato ormai ridondante."
+    ],
+    "outro": "Boot è impostato sul primo disco SCSI: <code>qm set $VMID --boot c --bootdisk scsi0</code>."
+  },
+  "postImport": {
+    "heading": "Regolazioni consigliate dopo l’importazione",
+    "intro": "L’importazione usa impostazioni ampiamente compatibili per favorire l’avvio al primo tentativo. Dopo aver verificato l’avvio, puoi scegliere impostazioni più efficienti dall’interfaccia Proxmox o dalla CLI:",
+    "headerSetting": "Impostazione",
+    "headerDefault": "Predefinito dopo l'importazione",
+    "headerRecommended": "Consigliato se supportato dal sistema guest",
+    "rows": [
+      {
+        "setting": "Modello NIC",
+        "default": "e1000",
+        "recommended": "VirtIO (molto più veloce, richiede un driver nel sistema guest)"
+      },
+      {
+        "setting": "Controller SCSI",
+        "default": "LSI",
+        "recommended": "VirtIO SCSI single (Linux recente o Windows con driver VirtIO)"
+      },
+      {
+        "setting": "Firmware (BIOS / UEFI)",
+        "default": "Predefinizione Proxmox (BIOS)",
+        "recommended": "Usa il firmware della VM di origine; una scelta errata impedisce l’avvio"
+      },
+      {
+        "setting": "QEMU agente ospite",
+        "default": "Disattivato",
+        "recommendedRich": "Attiva e installa <code>qemu-guest-agent</code> nel sistema guest (backup migliori e rilevamento degli IP)"
+      },
+      {
+        "setting": "Tipo di sistema operativo",
+        "default": "l26 / win10 / other (euristica)",
+        "recommended": "Verificare contro il sistema operativo ospite effettivo"
+      },
+      {
+        "setting": "Schermo",
+        "default": "Predefinito",
+        "recommended": "VirtIO-GPU o SPICE (migliori prestazioni della console)"
+      }
+    ]
+  },
+  "fwWarn": {
+    "title": "Firmware mismatch = nessun boot",
+    "body": "Se la VM di origine usava UEFI ma Proxmox la crea con BIOS, o viceversa, il sistema guest non trova un disco avviabile. Controlla <em>FirmwareType / firmware</em> nell’OVF o nella VM originale e usa la stessa scelta in Proxmox: <code>qm set $VMID --bios ovmf</code> per UEFI; il valore predefinito per BIOS è <code>seabios</code>."
+  },
+  "notImported": {
+    "heading": "Cosa NON viene importato",
+    "items": [
+      "<strong>Bridge di rete specifici</strong> — viene conservato solo il numero di schede. Tutte usano il bridge scelto durante l’importazione.",
+      "<strong>Modello della scheda di rete</strong> — usa e1000 come valore predefinito.",
+      "<strong>Tipo di firmware BIOS / UEFI</strong> — usa il valore predefinito Proxmox, BIOS.",
+      "<strong>Configurazione del passthrough PCI</strong>.",
+      "<strong>TPM</strong> (vTPM).",
+      "Unità <strong>cloud-init</strong>.",
+      "<strong>Snapshots</strong> — solo lo stato attuale.",
+      "<strong>USB / dispositivi seriali / paralleli</strong> dichiarati nell'OVF.",
+      "<strong>VM tag / note / start-on-boot</strong> opzioni."
+    ]
+  },
+  "troubleshoot": {
+    "heading": "Risoluzione dei problemi",
+    "orphanTitle": "La VM è stata creata ma l’importazione dei dischi è fallita: rimane una VM parziale",
+    "orphanIntro": "Se l’importazione fallisce, lo script propone di eliminare la VM parziale e i dischi importati. Se hai rifiutato o l’eliminazione automatica è fallita, esamina la VM ed eliminala manualmente con:",
+    "orphanCode": "qm destroy $VMID --destroy-unreferenced-disks 1",
+    "orphanOutro": "Correggi poi la causa, probabilmente lo spazio nello storage di destinazione, e ripeti l’importazione.",
+    "memTitle": "La VM importata ha 8 MB di RAM, oppure 8 TB",
+    "memIntro": "Il parser converte le AllocationUnits riconosciute in MiB. Le unità mancanti o sconosciute sono trattate come MiB. Esamina l’OVF e confronta la memoria importata con quella della VM di origine. Correggila se necessario:",
+    "memCode": "qm set $VMID --memory 8192    # 8 GiB",
+    "bootTitle": "La VM importata non si avvia: \"No bootable device\"",
+    "bootIntro": "Una causa frequente è la mancata corrispondenza BIOS / UEFI. La VM usava UEFI, ma Proxmox l’ha creata con BIOS. Imposta il firmware corrispondente:",
+    "bootCode": "qm set $VMID --bios ovmf       # UEFI\n# also add an EFI disk for the EFI vars:\nqm set $VMID --efidisk0 $STORAGE:1,format=qcow2,efitype=4m,pre-enrolled-keys=1",
+    "bootOutro": "Un’altra causa frequente: l’ordine di avvio indica scsi0, ma il disco del sistema operativo è scsi1. Modifica l’ordine nella scheda Opzioni della VM.",
+    "bsodTitle": "Una VM Windows esportata da VMware mostra una schermata blu al primo avvio",
+    "bsodBody": "Windows è sensibile ai cambiamenti del controller disco. Installa i driver VirtIO <em>prima</em> dell’esportazione da VMware oppure mantieni il controller <code>lsi</code> predefinito. Passa a VirtIO SCSI solo dopo aver avviato il sistema guest e installato i driver VirtIO in Windows.",
+    "zeroTitle": "Il parser OVF rileva 0 dischi",
+    "zeroBody": "L’OVF potrebbe usare riferimenti ai dischi non riconosciuti dal parser. Aprilo e cerca per ogni disco una voce <code>&lt;File ovf:href=\"...vmdk\" ...&gt;</code>. Se il disco è davvero VMDK, ma ha un’estensione insolita come <code>.dat</code>, rinominalo in <code>.vmdk</code> e aggiorna il riferimento OVF. Rinominare non converte il formato.",
+    "awkTitle": "awk: errore sintassi a o vicino , — parser fallisce su ogni OVA / OVF",
+    "awkIntro": "Il parser OVF usa la sintassi gawk di <code>match()</code> con tre argomenti, non supportata da mawk, il <code>awk</code> predefinito di Debian / Proxmox. Le versioni recenti installano gawk al primo utilizzo tramite <code>ensure_repositories</code> + <code>install_single_package</code>. Se usi una copia precedente, installalo manualmente:",
+    "awkCode": "apt-get install -y gawk",
+    "awkOutro": "Poi ripeti l’importazione.",
+    "netTitle": "Rete che non funziona dopo il primo avvio",
+    "netBody": "Il sistema guest potrebbe non avere i driver per il modello e1000, oppure il bridge scelto potrebbe essere errato. Nella scheda Hardware della VM, cambia Network Device → Model. Controlla anche <code>ip a</code> nel sistema guest: l’interfaccia potrebbe chiamarsi ens18 anziché eth0, mentre la configurazione di rete usa ancora il vecchio nome."
+  },
+  "files": {
+    "heading": "File coinvolti",
+    "code": "scripts/utilities/import_vm_ova_ovf.sh       # this script\n/tmp/.proxmenux-import-*/                    # temp extraction dir for OVA\n/etc/pve/nodes/<node>/qemu-server/<vmid>.conf  # created by qm create\n<storage>/<vmid>/<vmid>-disk-<n>.<fmt>        # disk images, format depends on storage"
+  },
+  "related": {
+    "heading": "Correlati",
+    "items": [
+      {
+        "href": "/docs/utils/export-vm",
+        "label": "Esportazione VM a OVA / OVF",
+        "tail": " — lo strumento complementare per esportare la VM."
+      },
+      {
+        "href": "/docs/utils",
+        "label": "Panoramica delle utilità",
+        "tail": " — torna alla panoramica della sezione."
+      }
+    ]
+  }
+}
diff --git a/web/messages/it/docs/utils/index.json b/web/messages/it/docs/utils/index.json
new file mode 100644
index 00000000..def93677
--- /dev/null
+++ b/web/messages/it/docs/utils/index.json
@@ -0,0 +1,115 @@
+{
+  "meta": {
+    "title": "Utilità Proxmox — UUP Dump, aggiornamento da PVE 8 a 9, esportazione/importazione OVA | ProxMenux",
+    "description": "Utilità quotidiane per Proxmox VE: creare ISO di Windows con UUP Dump, installare una selezione di strumenti CLI, aggiornare il sistema Proxmox in sicurezza, passare da PVE 8 a PVE 9, esportare VM in OVA / OVF e importare VM OVA / OVF da VMware o VirtualBox.",
+    "ogTitle": "Utilità Proxmox — UUP Dump, aggiornamento da PVE 8 a 9, esportazione/importazione OVA",
+    "ogDescription": "Crea ISO di Windows, installa strumenti CLI, esegui un aggiornamento sicuro, passa da PVE 8 a PVE 9 ed esporta o importa VM OVA / OVF.",
+    "twitterTitle": "Utilità Proxmox | ProxMenux",
+    "twitterDescription": "Creazione di ISO, strumenti CLI, aggiornamento di Proxmox, passaggio PVE 8→9 e portabilità delle VM OVA / OVF."
+  },
+  "header": {
+    "title": "Utilità e strumenti",
+    "description": "Sei strumenti completano le attività quotidiane in Proxmox VE: creazione di ISO, manutenzione del sistema e portabilità delle VM. Ogni opzione è indipendente: scegli quella che ti serve; non viene installato nulla finché non lo richiedi.",
+    "section": "Utilità"
+  },
+  "intro": {
+    "title": "A cosa serve questo menu",
+    "body": "Tre gruppi di strumenti indipendenti ma spesso utili: <strong>creare una ISO di Windows</strong> con UUP Dump, <strong>gestire la manutenzione dell’host Proxmox</strong> (utilità CLI, aggiornamenti e passaggio di versione principale) e <strong>importare ed esportare VM</strong> in Proxmox nel formato standard OVA / OVF."
+  },
+  "opening": {
+    "heading": "Apertura del menu",
+    "body": "Dal menu principale di ProxMenux, seleziona <strong>Utilities</strong>. Vedrai questa schermata:",
+    "imageAlt": "Menu delle utilità con UUP Dump, utilità di sistema, aggiornamento, passaggio di versione, esportazione e importazione"
+  },
+  "groups": {
+    "heading": "Tre gruppi di strumenti",
+    "intro": "I sei strumenti sono suddivisi in tre gruppi indipendenti. Fai clic su una scheda qui sotto per passare alla sezione corrispondente.",
+    "iso": {
+      "title": "Creazione ISO",
+      "body": "Crea ISO ufficiali di Windows con UUP Dump direttamente sull’host Proxmox.",
+      "bullets": [
+        "Link condiviso di UUP Dump → ISO avviabile",
+        "Dipendenze installate automaticamente",
+        "Il risultato viene salvato nella directory dei modelli ISO di Proxmox"
+      ]
+    },
+    "maintenance": {
+      "title": "Manutenzione del sistema",
+      "body": "Mantieni l’host in buone condizioni con strumenti CLI, aggiornamenti regolari e il passaggio di versione principale quando necessario.",
+      "bullets": [
+        "Installatore di utilità di sistema (25 strumenti CLI)",
+        "Aggiornamento del sistema Proxmox (apt + dist-upgrade)",
+        "Passaggio di versione principale PVE 8 → PVE 9"
+      ]
+    },
+    "portability": {
+      "title": "Portabilità VM",
+      "body": "Spostare le VM dentro e fuori Proxmox utilizzando il formato standard OVA / OVF.",
+      "bullets": [
+        "Esportazione Proxmox VM → OVA / OVF",
+        "Importazione OVA / OVF → Proxmox VM",
+        "Compatibile con VMware e VirtualBox"
+      ]
+    }
+  },
+  "upgradeWarn": {
+    "title": "L'aggiornamento PVE 8 → 9 è distruttivo e non reversibile",
+    "body": "Un aggiornamento di versione principale sostituisce sul posto la base Debian (Bookworm → Trixie) e i componenti Proxmox. Non è previsto un ripristino della versione precedente: prima di iniziare servono <strong>backup verificati</strong> di ogni VM e CT e <strong>accesso tramite console / IPMI / iKVM</strong>. Per questo lo strumento rifiuta l’esecuzione dal terminale web di Proxmox."
+  },
+  "isoSection": {
+    "heading": "Creazione ISO",
+    "body": "Crea una nuova ISO di installazione di Windows aggiornata direttamente sull’host Proxmox. Lo script automatizza l’intero processo UUP Dump: installazione delle dipendenze (aria2c, cabextract, wimlib-imagex, …), download parallelo dei file di aggiornamento tramite aria2 e conversione in una singola ISO avviabile. La ISO viene salvata in <code>/var/lib/vz/template/iso</code>, pronta da collegare a una VM.",
+    "options": [
+      {
+        "title": "Creatore di ISO UUP Dump",
+        "description": "Crea una ISO di installazione di Windows aggiornata da un link condiviso di UUP Dump. Dipendenze, download e conversione sono completamente automatizzati; la ISO risultante viene salvata in /var/lib/vz/template/iso, pronta per creare una VM.",
+        "href": "/docs/utils/UUp-Dump-ISO-Creator"
+      }
+    ]
+  },
+  "maintenanceSection": {
+    "heading": "Manutenzione del sistema",
+    "body": "Tre strumenti coprono le attività quotidiane e occasionali sull’host. L’<strong>Installatore di utilità di sistema</strong> configura gli strumenti CLI utili dopo una nuova installazione. L’<strong>Aggiornamento del sistema Proxmox</strong> esegue la manutenzione settimanale o mensile. Il <strong>Passaggio da PVE 8 a PVE 9</strong> è il grande cambiamento di ogni ciclo di versione principale, con controlli di sicurezza aggiuntivi perché non è reversibile.",
+    "options": [
+      {
+        "title": "Installatore di utilità di sistema",
+        "description": "Selettore di 25 strumenti CLI scelti (htop, btop, iperf3, tmux, ...) con selezione personalizzata o gruppi predefiniti (base, sviluppo, compressione, multiplexer, analisi, rete). Usa il flusso standard con repository e comando di verifica.",
+        "href": "/docs/utils/system-utils"
+      },
+      {
+        "title": "Aggiornamento sistema Proxmox",
+        "description": "Controllo dei repository + apt update + apt dist-upgrade, con conferma prima del riavvio. Rileva la versione principale di PVE (8 o 9), mantiene i repository configurati e chiede conferma prima di passare un host senza abbonamento al repository no-subscription, quindi esegue autoremove.",
+        "href": "/docs/utils/system-update"
+      },
+      {
+        "title": "Aggiorna PVE 8 a PVE 9",
+        "description": "Passaggio di versione principale (Debian Bookworm → Trixie + PVE 8 → 9). Controlli preliminari, migrazione dei repository, modalità automatizzata o interattiva, verifica finale e riavvio. Rifiuta l’esecuzione dal terminale web.",
+        "href": "/docs/utils/upgrade-pve8-pve9"
+      }
+    ]
+  },
+  "portabilitySection": {
+    "heading": "Portabilità VM (OVA / OVF)",
+    "body": "OVA e OVF sono formati di pacchettizzazione tra hypervisor definiti dallo standard DMTF e supportati da VMware, VirtualBox e Proxmox. I due strumenti consentono esportazione e reimportazione: una VM esportata da Proxmox può essere reimportata e viceversa. Usali per migrare carichi di lavoro da ESXi, creare un backup portabile di una VM o condividere una VM preparata con chi usa VirtualBox.",
+    "options": [
+      {
+        "title": "Esportazione VM a OVA / OVF",
+        "description": "Converti una VM Proxmox in un archivio OVA portabile o in una directory OVF. Schema DMTF standard, manifesto SHA1 e dischi VMDK in formato streamOptimized. Importabile in VMware (ESXi / Workstation / Fusion), VirtualBox e nuovamente in Proxmox.",
+        "href": "/docs/utils/export-vm"
+      },
+      {
+        "title": "Importa VM da OVA / OVF",
+        "description": "Importa in Proxmox un’esportazione di VMware / VirtualBox / ProxMenux. Estrae automaticamente OVA, analizza i metadati OVF, crea la VM e importa ogni disco nel formato nativo dello storage.",
+        "href": "/docs/utils/import-vm"
+      }
+    ]
+  },
+  "diskSpaceCallout": {
+    "title": "Una nota sullo spazio su disco per l'esportazione / importazione",
+    "body": "Entrambi gli strumenti convertono i formati dei dischi: l’esportazione usa <code>qemu-img convert -O vmdk -o subformat=streamOptimized</code>; l’importazione usa <code>qm importdisk</code> per tornare al formato nativo dello storage (qcow2 / raw). Per esportare, prevedi <strong>~120% della dimensione virtuale del disco</strong> per OVF e <strong>~220%</strong> per OVA. L’archivio OVA usa TAR non compresso e viene creato mentre esistono ancora i file VMDK temporanei. Verifica che nella directory di destinazione ci sia spazio sufficiente prima di iniziare."
+  },
+  "fitsTogether": {
+    "heading": "Come è organizzato il menu",
+    "body": "Ogni strumento ha uno script dedicato in <code>scripts/utilities/</code>. L’aggiornamento del sistema Proxmox richiama un unico script sicuro in <code>scripts/global/</code>, update-pve-safe.sh, che rileva la versione principale e gestisce PVE 8 e PVE 9. Il passaggio PVE 8 → 9 offre due azioni aggiuntive nel proprio menu: un <em>Controllo preliminare all’aggiornamento</em> indipendente (esegue <code>pve8to9 --full</code>) e una <em>Guida all’aggiornamento manuale</em> in sola lettura (procedura di 17 passaggi), per chi vuole esaminare il processo o eseguirlo a mano."
+  }
+}
diff --git a/web/messages/it/docs/utils/system-update.json b/web/messages/it/docs/utils/system-update.json
new file mode 100644
index 00000000..993dfb6b
--- /dev/null
+++ b/web/messages/it/docs/utils/system-update.json
@@ -0,0 +1,168 @@
+{
+  "meta": {
+    "title": "Aggiornamento del sistema Proxmox | Documentazione ProxMenux",
+    "description": "Aggiorna i pacchetti nella versione principale attuale di Proxmox con apt-get update e apt full-upgrade -y. Controlla spazio su disco e repository, tenta il recupero delle chiavi GPG, controlla e ripara vecchi header PV LVM, ricompila i driver DKMS gestiti quando necessario, esegue autoremove/autoclean e propone il riavvio se serve.",
+    "ogTitle": "Aggiornamento del sistema Proxmox | Documentazione ProxMenux",
+    "ogDescription": "apt full-upgrade con controllo dei repository, autoremove/autoclean e richiesta di riavvio quando necessario."
+  },
+  "header": {
+    "title": "Aggiornamento sistema Proxmox",
+    "description": "Richiama un unico script operativo (<code>update-pve-safe.sh</code>) che rileva la versione principale di Proxmox. I repository vengono letti tramite l’API Proxmox e conservati; un host senza abbonamento con il solo Enterprise deve confermare il passaggio a no-subscription. Lo script aggiorna i pacchetti e ricompila i driver DKMS gestiti da ProxMenux per un kernel pronto per il prossimo avvio. Lo script principale propone il riavvio se esiste il marcatore di sistema o se il kernel installato più recente è diverso da quello in esecuzione. Il processo è disponibile anche da <em>Update Now</em> nell’intestazione di ProxMenux Monitor quando ci sono aggiornamenti in sospeso.",
+    "section": "Utilità"
+  },
+  "calloutWhat": {
+    "title": "Cosa fa",
+    "body": "Porta l'host all'ultimo livello di patch della versione principale corrente. <strong>non</strong> si aggiorna tra le versioni principali: per PVE 8 → PVE 9 vedere <link>Aggiornamento da PVE 8 a PVE 9</link>."
+  },
+  "official": {
+    "heading": "Raccomandazione ufficiale Proxmox",
+    "intro": "La guida di aggiornamento di Proxmox per un host in esecuzione (nella stessa versione principale) è quella di eseguire:",
+    "code": "apt update && apt full-upgrade -y",
+    "outro": "Questa riga è il comando ufficiale per le versioni attuali di Proxmox. Occorre anche verificare che i repository siano corretti, che siano abilitati quelli giusti e che l’host resti in uno stato coerente dopo l’aggiornamento."
+  },
+  "onTop": {
+    "heading": "Cosa aggiunge ProxMenux: verificato nello script",
+    "intro": "Usa <strong>la stessa operazione apt full-upgrade</strong>, con controlli dei repository, ricompilazione DKMS e pulizia finale. I passaggi seguenti corrispondono a <code>scripts/utilities/proxmox_update.sh</code> e al suo unico script operativo <code>scripts/global/update-pve-safe.sh</code>:",
+    "items": [
+      "<strong>Rileva la versione principale di PVE</strong> nello script operativo (<code>pveversion | grep -oP ''pve-manager/\\K[0-9]+''</code>). Un unico script gestisce PVE 8 e PVE 9; i repository vengono conservati, a meno che un host senza abbonamento accetti il cambio proposto.",
+      "<strong>Conserva i repository configurati.</strong> <code>ensure_repositories</code> legge i repository e lo stato dell’abbonamento tramite l’API Proxmox. Con un abbonamento attivo o un repository no-subscription o test già usato, non cambia nulla. Se un host senza abbonamento attivo ha il solo Enterprise, chiede conferma per passare a no-subscription. Rifiutando, l’aggiornamento termina senza modificare le sorgenti.",
+      "<strong>Esegue l’aggiornamento senza interazione</strong> con <code>DEBIAN_FRONTEND=noninteractive</code> e <code>--force-confdef --force-confold</code>. Per le decisioni sui file di configurazione dpkg accetta l’azione predefinita, se presente; altrimenti conserva il file esistente.",
+      "<strong>Non impone le utilità facoltative.</strong> Lo script non forza l’installazione di <code>zfsutils-linux</code>, <code>chrony</code>, <code>ifupdown2</code> o pacchetti simili. Se l’installazione Proxmox ha scelto di farne a meno, mantiene questa scelta. I pacchetti mancanti vengono segnalati dai processi di installazione superiori, non dall’aggiornamento.",
+      "<strong>Controllo e riparazione dei metadati LVM.</strong> Rileva vecchi header PV ed esegue vgck --updatemetadata e vgchange -ay sui gruppi di volumi interessati. Può modificare metadati LVM; non si limita a mostrare avvisi.",
+      "<strong>Pulizia finale:</strong> <code>apt-get autoremove -y</code> + <code>apt-get autoclean -y</code>.",
+      "<strong>Ricompilazione DKMS prima della richiesta di riavvio.</strong> Lo script operativo richiama <code>pmx_rebuild_dkms_after_kernel</code> quando è pronto un kernel installato più recente. Lo script principale controlla <code>/var/run/reboot-required</code> e usa <code>dpkg-query</code> per confrontare il kernel indicato da <code>uname -r</code> con il pacchetto <code>proxmox-kernel-*-pve-signed</code> / <code>pve-kernel-*-pve</code> installato più recente. Il marcatore può mancare sugli host senza <code>needrestart</code>; il confronto dei kernel funziona comunque."
+    ]
+  },
+  "calloutOneSentence": {
+    "title": "In una frase",
+    "body": "Aggiorna i pacchetti dell’host, conserva i repository salvo un cambio accettato, controlla i metadati LVM, ricompila i driver DKMS gestiti, esegue autoremove/autoclean e propone il riavvio se necessario."
+  },
+  "confirm": {
+    "heading": "Finestra di conferma",
+    "intro": "Selezionando l’opzione si apre un riepilogo delle azioni previste e viene richiesta una conferma esplicita:",
+    "imageAlt": "Finestra di conferma dell’aggiornamento Proxmox con controllo dei repository, aggiornamento dei pacchetti e pulizia"
+  },
+  "routes": {
+    "heading": "Come lo script principale delega l’esecuzione",
+    "nodes": {
+      "source": {
+        "label": "proxmox_update.sh",
+        "detail": "pveversion |\ngrep -oP ''pve-manager/\\K[0-9]+''"
+      },
+      "bridge": {
+        "label": "Un unico script operativo",
+        "detail": "update-pve-safe.sh\n(rileva PVE 8 / 9\ninternamente)"
+      },
+      "target": {
+        "label": "Dopo l'aggiornamento",
+        "detail": "apt-get autoremove\napt-get autoclean\nRichiesta di riavvio se necessario"
+      }
+    }
+  },
+  "worker": {
+    "heading": "Cosa fa lo script operativo",
+    "intro": "Un unico script (<code>scripts/global/update-pve-safe.sh</code>) gestisce PVE 8 (<code>bookworm</code>) e PVE 9 (<code>trixie</code>). Rileva la versione principale e controlla i repository esistenti senza riscrivere le sorgenti di base Debian. Le fasi sono:",
+    "items": [
+      "<strong>Controlli preliminari.</strong> Verifica che ci sia almeno ~1 GB libero in <code>/var/cache/apt/archives</code>. In caso contrario si interrompe subito con un messaggio chiaro, per evitare un errore nel mezzo di un’operazione apt.",
+      "<strong>Controllo dei repository.</strong> <code>ensure_repositories</code> legge repository e stato dell’abbonamento. Con un repository Proxmox utilizzabile non cambia nulla. Se un host senza abbonamento attivo usa il solo Enterprise, chiede conferma prima di passare a no-subscription e interrompe l’aggiornamento in caso di rifiuto.",
+      "<strong>apt update con recupero automatico GPG.</strong> In caso di <code>NO_PUBKEY</code> per un repository, anche di terze parti, lo script importa la chiave mancante e riprova automaticamente prima di segnalare l’errore.",
+      "<strong>Aggiornamenti in sospeso e di sicurezza.</strong> Indica quanti pacchetti cambieranno e quanti provengono dalla suite di sicurezza, per mostrare numeri concreti nella finestra di conferma.",
+      "<strong>Finestra di conferma.</strong> Dopo aver aggiornato gli elenchi dei pacchetti, lo script chiede un sì esplicito prima di aggiornarli.",
+      "<strong>apt full-upgrade.</strong> Usa <code>DEBIAN_FRONTEND=noninteractive</code> e <code>--force-confdef --force-confold</code>. Dpkg segue l’azione predefinita per i file di configurazione, se presente; altrimenti conserva il file esistente.",
+      "<strong>Controllo LVM.</strong> <code>lvm_repair_check</code> aggiorna i metadati dei gruppi di volumi quando i dischi assegnati direttamente alle VM guest (DSM, TrueNAS o appliance di storage) tornano con vecchi header PV.",
+      "<strong>Ricompilazione DKMS dei driver gestiti da ProxMenux.</strong> Quando è pronto un nuovo kernel, <code>pmx_rebuild_dkms_after_kernel</code> legge i driver installati da ProxMenux in <code>components_status.json</code> (attualmente <code>nvidia_driver</code> → modulo <code>nvidia</code> e <code>coral_driver</code> → modulo <code>gasket</code>), installa gli header corrispondenti (<code>proxmox-headers-&lt;newkver&gt;</code> se disponibile, altrimenti <code>pve-headers-&lt;newkver&gt;</code>) ed esegue <code>dkms autoinstall -k &lt;newkver&gt;</code>. Se <code>dkms status</code> non mostra i moduli compilati per il nuovo kernel, richiama ogni installatore con <code>--auto-reinstall</code>. Gli errori vengono registrati senza interrompere l’aggiornamento, che arriva comunque alla richiesta di riavvio.",
+      "<strong>Pulizia finale.</strong> <code>apt-get autoremove</code> + <code>apt-get autoclean</code> prima di restituire il controllo allo script principale."
+    ]
+  },
+  "post": {
+    "heading": "Pulizia e riavvio dopo l’aggiornamento",
+    "intro": "Al termine dello script operativo, lo script principale esegue:",
+    "code": "apt-get autoremove -y    # drop unused dependencies pulled in by old packages\napt-get autoclean        # drop downloaded .deb files no longer in the index",
+    "afterCode": "Lo script principale controlla anche se occorre riavviare. Ciascuno di questi segnali fa comparire la richiesta:",
+    "items": [
+      "Esiste <code>/var/run/reboot-required</code>: un pacchetto o uno strumento di sistema ha indicato che l’host deve essere riavviato.",
+      "Il pacchetto del kernel Proxmox installato più recente è diverso dal kernel in esecuzione, secondo <code>dpkg-query</code> e uname -r."
+    ],
+    "outro": "Se una delle condizioni è vera, una finestra whiptail chiede <em>«Alcune modifiche richiedono un riavvio. Vuoi riavviare ora?»</em>. Rifiuta per continuare con il kernel attuale fino al riavvio manuale, ad esempio durante una finestra di manutenzione programmata."
+  },
+  "end": {
+    "heading": "Cosa vedi alla fine",
+    "intro": "Al termine dello script operativo, il terminale mostra il risultato della pulizia e, se necessario, la richiesta di riavvio:",
+    "imageAlt": "Riepilogo del completamento dell'aggiornamento del sistema Proxmox con l'output di pulizia e il prompt di riavvio"
+  },
+  "calloutDeclineReboot": {
+    "title": "Rimanda il riavvio solo per un motivo preciso",
+    "body": "Installare un nuovo pacchetto <code>proxmox-kernel-*</code> non sostituisce il kernel in esecuzione fino al riavvio. Il nuovo kernel e i suoi moduli corrispondenti diventano attivi al prossimo avvio. Programma il riavvio in una finestra di manutenzione adatta e controlla prima gli avvisi di compilazione DKMS."
+  },
+  "noSub": {
+    "heading": "Come lo script gestisce il repository Enterprise",
+    "intro": "Proxmox abilita il repository Enterprise per impostazione predefinita. Senza un abbonamento attivo, questo restituisce 401 durante <code>apt-get update</code>. Lo script modifica i repository solo in questo caso e dopo conferma, tramite l’API Proxmox usata da <em>Node → Updates → Repositories</em>. Ecco i diversi casi:",
+    "items": [
+      "Con un <strong>abbonamento attivo</strong>, i repository restano invariati ed Enterprise fornisce gli aggiornamenti.",
+      "Con il <strong>repository no-subscription o test già abilitato</strong>, i repository restano invariati, qualunque altra sorgente sia configurata.",
+      "Con <strong>nessun abbonamento attivo e il solo repository Enterprise</strong>, una finestra propone il cambio. Accettando, Enterprise viene disabilitato, no-subscription viene abilitato e gli elenchi dei pacchetti vengono aggiornati. La modifica compare nella vista <em>Changes</em> di Audit & Report. Rifiutando, l’aggiornamento termina senza modificare le sorgenti.",
+      "Le <strong>sorgenti Ceph Enterprise</strong> presenti vengono disabilitate durante lo stesso cambio, senza scegliere un altro canale Ceph. Un host che usa Ceph deve configurare il relativo canale separatamente.",
+      "Se <strong>non è disponibile un terminale per chiedere conferma</strong>, nessuna sorgente viene modificata e l’aggiornamento termina con un messaggio che rimanda a <em>Node → Updates → Repositories</em>."
+    ],
+    "outro": "Le sorgenti Debian e tutti gli altri file dei repository non vengono mai modificati da questa procedura. Una voce che mescola Enterprise con altri componenti non viene cambiata: l’aggiornamento si interrompe e chiede di separarla dalla vista dei repository Proxmox."
+  },
+  "cluster": {
+    "heading": "Considerazioni di cluster",
+    "calloutTitle": "Su cluster: aggiornare un nodo alla volta",
+    "calloutBody": "In un cluster Proxmox, esegui questa opzione su <strong>un nodo alla volta</strong> e attendi il completamento del riavvio prima di passare al successivo. Migra prima i sistemi guest dal nodo per evitare interruzioni del servizio nell’intero cluster. Versioni minori diverse, come 8.4.1 e 8.4.5, possono coesistere per alcune ore; kernel in esecuzione diversi possono causare comportamenti imprevisti per i sistemi guest gestiti da HA."
+  },
+  "doesnt": {
+    "heading": "Cosa non fa",
+    "items": [
+      "<strong>Passaggio di versione principale.</strong> Il passaggio 8 → 9 è un’operazione separata; vedi <link>Aggiornamento da PVE 8 a PVE 9</link>.",
+      "<strong>Backup.</strong> Nessuna snapshot, nessun rollback. Le operazioni Apt non sono transazionali. Combina con la tua normale disciplina di backup (PBS, vzdump, snapshot ZFS).",
+      "<strong>Aggiornamenti di container / VM.</strong> Viene aggiornato solo l’host; i sistemi guest restano invariati.",
+      "<strong>Scrittura dedicata del firmware.</strong> Questo strumento non serve a programmare BIOS o firmware dei dispositivi. I pacchetti di firmware o microcodice CPU già installati possono comunque ricevere aggiornamenti tramite apt."
+    ]
+  },
+  "troubleshooting": {
+    "heading": "Risoluzione dei problemi",
+    "items": [
+      {
+        "title": "apt update fallisce con 401 Unauthorized",
+        "body": "Il repository Enterprise è abilitato, ma l’host non ha un abbonamento attivo. Prima di <code>apt-get update</code>, lo script propone il passaggio a no-subscription. Se hai rifiutato, ripeti l’aggiornamento e accetta, oppure disabilita Enterprise in <em>Node → Updates → Repositories</em> e abilita no-subscription."
+      },
+      {
+        "title": "dist-upgrade si blocca su \"Configuring grub-pc\"",
+        "body": "Se compare una richiesta interattiva di GRUB, chiede i dispositivi su cui installare il boot loader. L’opzione <code>--force-confold</code> riguarda i file di configurazione, non questa selezione. Usa <kbd>Tab</kbd> + <kbd>Space</kbd> per scegliere i dischi di avvio appropriati, poi OK. Puoi configurare la scelta in anticipo con <code>dpkg-reconfigure grub-pc</code>."
+      },
+      {
+        "title": "Il kernel è stato aggiornato, ma mancano i nuovi moduli di un driver esterno",
+        "body": "Per i driver gestiti (<code>nvidia_driver</code> e <code>coral_driver</code>), la funzione esegue <code>dkms autoinstall -k &lt;newkver&gt;</code> e può ripetere gli installatori con <code>--auto-reinstall</code>. Controlla il risultato con <code>dkms status</code>. Il comando autoinstall può ricompilare anche altri moduli DKMS registrati; gli installatori alternativi sono limitati alle voci gestite di <code>components_status.json</code>. Esamina eventuali moduli di terze parti ancora mancanti e ricompilali se necessario con <code>dkms autoinstall</code>."
+      },
+      {
+        "title": "Il prompt del riavvio non è apparso ma sono sicuro che il kernel sia cambiato",
+        "body": "I segnali sono alternativi: <code>/var/run/reboot-required</code> oppure una differenza tra il kernel in esecuzione e il kernel Proxmox installato più recente. Lo script principale non analizza le voci linux-image del registro apt. Controlla la versione in esecuzione con <code>uname -r</code> e i pacchetti del kernel installati con <code>dpkg-query</code>. Programma il riavvio necessario o esegui <code>shutdown -r now</code> quando sei pronto."
+      }
+    ]
+  },
+  "files": {
+    "heading": "File coinvolti",
+    "code": "scripts/utilities/proxmox_update.sh              # this script (wrapper)\nscripts/global/update-pve-safe.sh                # single safe worker (PVE 8 + PVE 9)\nscripts/global/repository-functions.sh           # ensure_repositories\nscripts/global/repository_policy.py              # reads and switches repositories through the Proxmox API\nscripts/global/utils-install-functions.sh        # pmx_rebuild_dkms_after_kernel\n/usr/local/share/proxmenux/components_status.json # ProxMenux-managed DKMS driver registry\n/etc/apt/sources.list.d/proxmox.sources          # no-subscription source, written by Proxmox when the switch is accepted\n/var/run/reboot-required                         # read to decide on reboot prompt\n# Reboot fallback when needrestart isn't installed:\n# dpkg-query -W 'proxmox-kernel-*-pve-signed' 'pve-kernel-*-pve' vs. uname -r"
+  },
+  "related": {
+    "heading": "Correlati",
+    "items": [
+      {
+        "href": "/docs/utils/upgrade-pve8-pve9",
+        "label": "Aggiorna PVE 8 a PVE 9",
+        "tail": " — per il passaggio di versione principale, con uno strumento e un modello di sicurezza diversi."
+      },
+      {
+        "href": "/docs/utils/system-utils",
+        "label": "Installatore di utilità di sistema",
+        "tail": " — per installare strumenti CLI utili durante gli aggiornamenti (htop / btop / ncdu)."
+      },
+      {
+        "href": "/docs/utils",
+        "label": "Panoramica delle utilità",
+        "tail": " — torna alla panoramica della sezione."
+      }
+    ]
+  }
+}
diff --git a/web/messages/it/docs/utils/system-utils.json b/web/messages/it/docs/utils/system-utils.json
new file mode 100644
index 00000000..4e693c13
--- /dev/null
+++ b/web/messages/it/docs/utils/system-utils.json
@@ -0,0 +1,252 @@
+{
+  "meta": {
+    "title": "Installatore di utilità di sistema | Documentazione ProxMenux",
+    "description": "Installatore di utilità CLI per Proxmox VE, con 25 pacchetti nell’elenco di riferimento (htop, btop, iperf3, tmux, ...). Selezione personalizzata, installazione completa e gruppi predefiniti (base, sviluppo, compressione, multiplexer, analisi, rete). I gruppi possono includere altri pacchetti. Usa ensure_repositories + install_single_package.",
+    "ogTitle": "Installatore di utilità di sistema | Documentazione ProxMenux",
+    "ogDescription": "Installare strumenti CLI curati su Proxmox VE con un clic o selezione personalizzata."
+  },
+  "header": {
+    "title": "Installatore di utilità di sistema",
+    "description": "Selettore delle 25 utilità CLI nell’elenco di riferimento PROXMENUX_UTILS. Offre selezione personalizzata, installazione completa, sei gruppi predefiniti e verifica delle installazioni. I gruppi possono includere strumenti esterni all’elenco. Usa le funzioni condivise ensure_repositories() + install_single_package() per gestire in modo coerente repository e messaggi sui pacchetti.",
+    "section": "Utilità"
+  },
+  "info": {
+    "title": "Cosa fa",
+    "body": "Installa strumenti CLI da un elenco di 25 pacchetti. Ogni installazione segue lo stesso processo: <code>ensure_repositories</code> verifica che l’host abbia un repository Proxmox utilizzabile per la versione principale di PVE; poi <code>install_single_package</code> installa il pacchetto e controlla che il comando sia in PATH."
+  },
+  "opening": {
+    "heading": "Apertura dell'installatore",
+    "intro": "Dal menu Utilità, scegliere <strong>System Utilities Installer</strong>. Il menu principale offre nove opzioni:",
+    "imageAlt": "Menu di installazione delle utilità di sistema con selezione personalizzata, ALL, gruppi predefiniti e verifica"
+  },
+  "actions": {
+    "heading": "Le 9 azioni del menu",
+    "headerOption": "Opzione",
+    "headerBehaviour": "Comportamento",
+    "rows": [
+      {
+        "option": "1. Selezione personalizzata",
+        "behaviourRich": "Elenco di selezione dei 25 pacchetti. Usa SPACE per selezionare e ENTER per confermare; vengono installati solo i pacchetti selezionati."
+      },
+      {
+        "option": "2. Installa TUTTE le utilità",
+        "behaviourRich": "Installazione one-shot di ogni pacchetto in <code>PROXMENUX_UTILS</code>. Utilizzare dopo una nuova installazione Proxmox."
+      },
+      {
+        "option": "3. Base",
+        "behaviourRich": "<code>grc</code>, <code>htop</code>, <code>tree</code>, <code>curl</code>, <code>wget</code>"
+      },
+      {
+        "option": "4. Sviluppo",
+        "behaviourRich": "<code>git</code>, <code>vim</code>, <code>nano</code>"
+      },
+      {
+        "option": "5. Compressione",
+        "behaviourRich": "<code>zip</code>, <code>unzip</code>, <code>rsync</code>"
+      },
+      {
+        "option": "6. Multiplexer di terminale",
+        "behaviourRich": "<code>screen</code>, <code>tmux</code>"
+      },
+      {
+        "option": "7. Analisi",
+        "behaviourRich": "<code>jq</code>, <code>ncdu</code>, <code>iotop</code>"
+      },
+      {
+        "option": "8. Rete",
+        "behaviourRich": "<code>iperf3</code>, <code>nethogs</code>, <code>nmap</code>, <code>tcpdump</code>, <code>lsof</code>"
+      },
+      {
+        "option": "9. Verifica installazioni",
+        "behaviourRich": "Esamina ogni voce di <code>PROXMENUX_UTILS</code>, controlla se il comando di verifica è in PATH e mostra un riepilogo Disponibile / Mancante."
+      }
+    ]
+  },
+  "packages": {
+    "heading": "I 25 pacchetti",
+    "intro": "Definiti nel file condiviso <code>scripts/global/utils-install-functions.sh</code> come <code>PROXMENUX_UTILS</code> (formato: <code>package:verify_command:description</code>). Altri script ProxMenux, per esempio gli avvii del monitoraggio di rete iftop / iptraf-ng / iperf3, riutilizzano queste voci per mantenere sincronizzati pacchetto e comando di verifica.",
+    "headerPackage": "Pacchetto",
+    "headerVerify": "Comando di verifica",
+    "headerDescription": "Descrizione",
+    "rows": [
+      {
+        "package": "axel",
+        "verify": "axel",
+        "description": "Acceleratore di download"
+      },
+      {
+        "package": "aria2",
+        "verify": "aria2c",
+        "description": "Downloader multi-source"
+      },
+      {
+        "package": "btop",
+        "verify": "btop",
+        "description": "Monitor moderno delle risorse"
+      },
+      {
+        "package": "cabextract",
+        "verify": "cabextract",
+        "description": "Estrarre i file CAB"
+      },
+      {
+        "package": "chntpw",
+        "verify": "chntpw",
+        "description": "Modifica del registro di Windows / password"
+      },
+      {
+        "package": "dos2unix",
+        "verify": "dos2unix",
+        "description": "Converti file di testo DOS / Unix"
+      },
+      {
+        "package": "genisoimage",
+        "verify": "genisoimage",
+        "description": "Crea immagini ISO"
+      },
+      {
+        "package": "grc",
+        "verify": "grc",
+        "description": "Colorazione generica dei log"
+      },
+      {
+        "package": "htop",
+        "verify": "htop",
+        "description": "Visualizzatore interattivo dei processi"
+      },
+      {
+        "package": "iftop",
+        "verify": "iftop",
+        "description": "Utilizzo della rete in tempo reale"
+      },
+      {
+        "package": "intel-gpu-tools",
+        "verify": "intel_gpu_top",
+        "description": "Strumenti Intel GPU"
+      },
+      {
+        "package": "iotop",
+        "verify": "iotop",
+        "description": "Monitoraggio dell’I/O dei dischi"
+      },
+      {
+        "package": "iperf3",
+        "verify": "iperf3",
+        "description": "Test di banda di rete"
+      },
+      {
+        "package": "ipset",
+        "verify": "ipset",
+        "description": "Gestione degli insiemi IP"
+      },
+      {
+        "package": "iptraf-ng",
+        "verify": "iptraf-ng",
+        "description": "Strumento di monitoraggio della rete"
+      },
+      {
+        "package": "libguestfs-tools",
+        "verify": "virt-filesystems",
+        "description": "Utilità del disco VM"
+      },
+      {
+        "package": "msr-tools",
+        "verify": "rdmsr",
+        "description": "Accesso ai registri MSR della CPU"
+      },
+      {
+        "package": "net-tools",
+        "verify": "netstat",
+        "description": "Strumenti di networking legacy"
+      },
+      {
+        "package": "plocate",
+        "verify": "locate",
+        "description": "Individuare i file rapidamente"
+      },
+      {
+        "package": "s-tui",
+        "verify": "s-tui",
+        "description": "Stress-Terminal UI"
+      },
+      {
+        "package": "sshpass",
+        "verify": "sshpass",
+        "description": "Accesso non interattivo SSH"
+      },
+      {
+        "package": "tmux",
+        "verify": "tmux",
+        "description": "Multiplexer del terminale"
+      },
+      {
+        "package": "unzip",
+        "verify": "unzip",
+        "description": "Estrarre i file ZIP"
+      },
+      {
+        "package": "wimtools",
+        "verify": "wimlib-imagex",
+        "description": "Gestione delle immagini WIM"
+      },
+      {
+        "package": "zip",
+        "verify": "zip",
+        "description": "Crea file ZIP"
+      }
+    ]
+  },
+  "howItWorks": {
+    "heading": "Come funziona l’installazione di un pacchetto",
+    "items": [
+      "<code>ensure_repositories</code> rileva PVE 8 o 9 e legge i repository tramite l’API Proxmox. Con un repository Proxmox utilizzabile non cambia nulla. Un host senza abbonamento attivo con il solo Enterprise deve confermare il passaggio a no-subscription; <code>apt-get update</code> viene eseguito dopo il cambio accettato.",
+      "<code>install_single_package \"pkg\" \"verify_cmd\" \"description\"</code> gestisce <code>apt-get install -y \"$pkg\"</code> con feedback (<code>msg_info</code> / <code>msg_ok</code> / <code>msg_error</code>)."
+    ],
+    "verifyIntro": "Dopo l'installazione, il comando di verifica viene controllato con <code>command -v \"$verify_cmd\"</code>. Tre risultati:",
+    "verifyOutcomes": [
+      "<strong>0 (successo):</strong> comando disponibile; il pacchetto è conteggiato come <em>Riuscito</em>.",
+      "<strong>1 (errore):</strong> apt non è riuscito; il pacchetto è conteggiato come <em>Non riuscito</em>.",
+      "<strong>2 (avviso):</strong> apt è riuscito, ma il comando atteso non è stato trovato in PATH; il pacchetto è conteggiato come <em>Con avvisi</em>."
+    ],
+    "summary": "Al termine di un’installazione personalizzata o di gruppo, una finestra mostra i conteggi <em>Riusciti / Con avvisi / Non riusciti</em>."
+  },
+  "verify": {
+    "heading": "Verifica installazioni",
+    "intro": "L’opzione 9 è in sola lettura: esamina <code>PROXMENUX_UTILS</code> ed esegue <code>command -v</code> per ogni comando di verifica. L’output è simile al seguente:",
+    "code": "Total: 25\nAvailable: 18\nMissing: 8\n\n✓ axel - Download accelerator\n✓ aria2c - Multi-source downloader\n✓ btop - Modern resource monitor\n✗ cabextract - Extract CAB files\n✓ dos2unix - Convert DOS / Unix text files\n✗ genisoimage - Create ISO images\n✓ grc - Generic log colorizer\n...",
+    "outro": "Utile prima di eseguire script che dipendono da questi strumenti (ad es. <code>uup_dump_iso_creator.sh</code> ha bisogno di <code>aria2c</code> + <code>cabextract</code> + <code>wimlib-imagex</code>). Se manca qualcosa, eseguire l'installazione del gruppo corrispondente o selezionare i pacchetti mancanti tramite selezione personalizzata."
+  },
+  "troubleshoot": {
+    "heading": "Risoluzione dei problemi",
+    "reposTitle": "«Impossibile configurare i repository. Installazione annullata».",
+    "reposBody": "Il controllo dei repository non è riuscito: il passaggio a no-subscription è stato rifiutato, lo stato dell’abbonamento non è leggibile o una voce richiede attenzione. Il messaggio precedente indica la causa. I repository sono elencati in <em>Node → Updates → Repositories</em>; <code>apt-get update</code> da una console mostra l’errore apt.",
+    "warningsTitle": "Un pacchetto viene segnalato \"Con avvisi\" ma il comando funziona dopo aver chiuso il menu",
+    "warningsBody": "Dopo <code>apt-get install</code>, la funzione esegue <code>hash -r</code>, attende brevemente e verifica il comando atteso con <code>command -v</code>. Un avviso indica che il controllo continua a fallire, senza identificarne la causa. Prova una nuova shell, poi controlla l’installazione del pacchetto e PATH se il comando manca ancora.",
+    "hangsTitle": "Un’installazione apt si blocca",
+    "hangsBody": "Probabilmente una richiesta debconf è nascosta dall’output silenziato. Lo script usa <code>DEBIAN_FRONTEND=noninteractive</code> per le chiamate apt, che di solito evita le domande, ma alcuni pacchetti richiedono comunque dati. Annulla con <kbd>Ctrl</kbd>+<kbd>C</kbd> ed esegui <code>apt-get install -y &lt;pkg&gt;</code> manualmente da una shell per vedere la richiesta e decidere."
+  },
+  "files": {
+    "heading": "File coinvolti",
+    "code": "scripts/utilities/system_utils.sh                    # this script\nscripts/global/utils-install-functions.sh            # PROXMENUX_UTILS, install_single_package\nscripts/global/repository-functions.sh               # ensure_repositories\nscripts/global/repository_policy.py                  # reads and switches repositories through the Proxmox API\n/etc/apt/sources.list.d/proxmox.sources              # no-subscription source, written by Proxmox when the switch is accepted"
+  },
+  "related": {
+    "heading": "Correlati",
+    "items": [
+      {
+        "href": "/docs/utils/system-update",
+        "label": "Aggiornamento sistema Proxmox",
+        "tailRich": "— per il <code>apt dist-upgrade</code> effettivo sull'host."
+      },
+      {
+        "href": "/docs/network/monitoring",
+        "label": "Strumenti di monitoraggio in tempo reale (rete)",
+        "tailRich": "— utilizza iftop / iptraf-ng / iperf3 da questa stessa lista."
+      },
+      {
+        "href": "/docs/utils",
+        "label": "Panoramica delle utilità",
+        "tailRich": " — torna alla panoramica della sezione."
+      }
+    ]
+  }
+}
diff --git a/web/messages/it/docs/utils/upgrade-pve8-pve9.json b/web/messages/it/docs/utils/upgrade-pve8-pve9.json
new file mode 100644
index 00000000..74b96503
--- /dev/null
+++ b/web/messages/it/docs/utils/upgrade-pve8-pve9.json
@@ -0,0 +1,335 @@
+{
+  "meta": {
+    "title": "Aggiornare PVE 8 a PVE 9 | Documentazione ProxMenux",
+    "description": "Tre modi per passare da Proxmox VE 8 a 9 (Debian Bookworm a Trixie e PVE 8 a 9): automatico, interattivo o manuale seguendo la procedura ufficiale. Controllo pve8to9, migrazione dei repository, dist-upgrade e verifica finale. L’avvio dal terminale web è bloccato.",
+    "ogTitle": "Aggiornare PVE 8 a PVE 9 | Documentazione ProxMenux",
+    "ogDescription": "Tre modalità (automatica, interattiva e manuale) per passare da Proxmox VE 8 a 9."
+  },
+  "header": {
+    "title": "Aggiorna PVE 8 a PVE 9",
+    "description": "Esegue il passaggio da Proxmox VE 8 a 9 secondo la procedura ufficiale: Debian Bookworm a Trixie e PVE 8 a 9. Offre modalità automatica, interattiva e manuale, oltre a un controllo preliminare indipendente. Blocca il terminale web: una disconnessione durante l’aggiornamento può lasciare l’host inutilizzabile.",
+    "section": "Utilità"
+  },
+  "dangerCallout": {
+    "title": "Un cambio di versione principale è irreversibile",
+    "intro": "L’operazione sostituisce sul posto la base Debian (Bookworm → Trixie) e i componenti Proxmox. <strong>Non è previsto un ripristino alla versione precedente</strong>. Prima di iniziare:",
+    "items": [
+      "<strong>Backup verificati</strong> di ogni VM e CT (PBS, vzdump, snapshot ZFS — verificare anche il ripristino).",
+      "<strong>Accesso console / IPMI / iKVM</strong> all’host in caso di interruzione SSH durante l’aggiornamento.",
+      "L'host è già aggiornato su PVE 8.4.x (lo script applica questo).",
+      "Ceph (se presente) sulla versione 19.x Squid.",
+      "Almeno <strong>5 GB liberi</strong> nel filesystem root."
+    ]
+  },
+  "modeMenu": {
+    "heading": "Il menu della modalità",
+    "intro": "L’opzione apre quattro voci: Automatico, Interattivo, Controllo preliminare e Guida manuale. Tre scelte <em>eseguono</em> l’aggiornamento o spiegano come procedere; il controllo indipendente <em>verifica</em> i requisiti e può proporre riparazioni.",
+    "imageAlt": "Menu di aggiornamento PVE da 8 a 9 con modalità automatica, interattiva, controllo preliminare e guida manuale"
+  },
+  "threeWays": {
+    "heading": "Tre modi per aggiornare",
+    "intro": "Automatico e Interattivo seguono lo stesso percorso, con controlli preliminari e verifica finale. Cambia la gestione delle domande dpkg durante <code>dist-upgrade</code>. La guida manuale mostra i comandi, inclusi i controlli: occorre eseguire ogni passaggio personalmente.",
+    "auto": {
+      "title": "Automatico / Senza intervento",
+      "summary": "Imposta <code>ASSUME_YES=1</code> + <code>DEBIAN_FRONTEND=noninteractive</code>. Per i file di configurazione modificati, dpkg usa l’azione predefinita se disponibile; altrimenti <strong>conserva il file attuale</strong> (<code>--force-confold</code>).",
+      "items": [
+        "Più veloce — nessuna domanda di dpkg durante l’aggiornamento",
+        "Adatto a installazioni standard senza file di configurazione personalizzati",
+        "Rischio: un file personalizzato viene conservato senza domande e può nascondere i nuovi valori predefiniti"
+      ]
+    },
+    "interactive": {
+      "title": "Interattivo",
+      "summary": "Stesso percorso, ma l’utente risponde a ogni domanda dpkg sui conflitti di configurazione. Più lento, con la massima visibilità.",
+      "items": [
+        "Vedi ogni conflitto di configurazione e decidi",
+        "Migliore quando hai personalizzato <code>/etc/lvm</code>, <code>/etc/ssh</code>, ecc.",
+        "Consultare la tabella delle risposte consigliate nella procedura manuale di seguito"
+      ]
+    },
+    "manual": {
+      "title": "Guida all'aggiornamento manuale",
+      "summary": "Mostra senza eseguirla la procedura in 17 passaggi del wiki ufficiale Proxmox. Esegui manualmente i comandi da una shell separata.",
+      "items": [
+        "Controllo massimo — digita ogni comando",
+        "Meglio quando si desidera imparare la procedura o si fida di nulla",
+        "Lo script visualizza i passaggi; nulla viene eseguito automaticamente"
+      ]
+    }
+  },
+  "precheckCallout": {
+    "title": "Più un pre-check separato",
+    "body": "L’opzione 3 — <strong>Esegui controllo PVE da 8 a 9</strong> — avvia lo strumento ufficiale <code>pve8to9 --full</code>, propone riparazioni guidate per problemi comuni e poi <strong>si ferma</strong>. Usala prima dell’aggiornamento o dopo riparazioni manuali. Le modalità automatica e interattiva eseguono lo stesso controllo; la guida manuale indica di avviarlo personalmente."
+  },
+  "webTerminal": {
+    "heading": "Perché il terminale web è bloccato",
+    "body": "Le tre modalità rilevano <code>termproxy</code> / <code>vncshell</code> nella catena dei processi padre e rifiutano l’avvio. Il terminale web dipende da <code>pveproxy</code>, servizio aggiornato durante l’operazione. Al riavvio di <code>pveproxy</code> termina la sessione e lo script al suo interno. L’host può rimanere aggiornato solo in parte.",
+    "warningTitle": "Usa SSH o una console fisica / IPMI / iKVM",
+    "warningBody": "SSH è la scelta più comune. Avvialo dentro <code>tmux</code> o <code>screen</code> per resistere a brevi interruzioni di rete. Se rileva una normale shell SSH, lo script mostra subito un promemoria su tmux/screen."
+  },
+  "auto": {
+    "heading": "Modalità automatica / Senza intervento",
+    "intro": "Le domande su pacchetti e file di configurazione usano i valori predefiniti della tabella seguente, e un 401 dal repository Enterprise passa a no-subscription senza chiedere. La conferma dell’aggiornamento, il riepilogo dell’aggiornamento di PVE 8, le riparazioni dei controlli e la richiesta di riavvio vengono comunque mostrati.",
+    "behaviourHeading": "Comportamento specifico della modalità automatica",
+    "behaviourTable": {
+      "settingHeader": "Impostazione",
+      "effectHeader": "Effetto",
+      "rows": [
+        {
+          "settingRich": "<code>ASSUME_YES=1</code>",
+          "effectRich": "Opzione interna — lo script risponde sì alle proprie domande, come il passaggio a no-subscription dopo un 401"
+        },
+        {
+          "settingRich": "<code>DEBIAN_FRONTEND=noninteractive</code>",
+          "effectRich": "apt / dpkg vengono eseguiti senza aprire domande debconf"
+        },
+        {
+          "settingRich": "<code>--force-confdef</code>",
+          "effectRich": "Per i file di configurazione intatti: installa la nuova versione del manutentore"
+        },
+        {
+          "settingRich": "<code>--force-confold</code>",
+          "effectRich": "Per i file modificati: azione predefinita di dpkg se disponibile; altrimenti <strong>conserva la tua versione</strong>."
+        }
+      ]
+    },
+    "flowHeading": "Percorso della modalità automatica",
+    "flowIntro": "Sei fasi consecutive. La fase 2 aggiorna i pacchetti PVE 8 e la fase 3 scrive la configurazione dei repository di PVE 9. Un errore interrompe il percorso senza annullare quelle modifiche; se l’aggiornamento di PVE 8 non riesce o viene annullato, i repository restano invariati. La fase 5 esegue <code>dist-upgrade</code> a PVE 9.",
+    "flowDiagram": "1. CONTROLLI\nBlocca termproxy / vncshell; conferma l’aggiornamento; rifiuta PVE 9.\n\n2. PREPARARE PVE 8\nscripts/global/update-pve8.sh\nAggiorna i pacchetti PVE 8; si ferma se l’aggiornamento non riesce o viene annullato.\npve8to9 --full (può proporre riparazioni).\nControlla spazio e connettività; Ceph 19.x Squid sui nodi iperconvergenti.\n\n3. MIGRARE I REPOSITORY\nBookworm → Trixie; scrive file deb822 .sources.\nCommenta i vecchi file .list; apt-get update.\n\n4. VERIFICARE IL CANDIDATO PVE 9\napt-cache policy proxmox-ve\napt-get -s dist-upgrade\nSi ferma se il candidato non è 9.x o se proxmox-ve verrebbe rimosso.\n\n5. AGGIORNARE\napt-get -y -o Dpkg::Options::='--force-confdef' -o Dpkg::Options::='--force-confold' dist-upgrade\nSenza abbonamento: disattiva pve-enterprise.sources.\nRegistro: /var/log/pve8-a-pve9-'<'timestamp'>'.log\n\n6. VERIFICARE E RIAVVIARE\nEFI: apt install grub-efi-amd64\npve8to9 --full; esaminare risultati e richiesta di riavvio.",
+    "preflightHeading": "Controlli prima dell’aggiornamento",
+    "preflightTable": {
+      "checkHeader": "Controllo",
+      "whyHeader": "Perché è importante",
+      "rows": [
+        {
+          "checkRich": "<strong>Blocco del terminale web</strong>",
+          "whyRich": "Evita che l’aggiornamento termini la shell che lo esegue"
+        },
+        {
+          "checkRich": "<strong>Già alla versione 9.x</strong>",
+          "whyRich": "Interrompe se l'host gestisce già PVE 9 (niente da fare)"
+        },
+        {
+          "checkRich": "<strong>Ultima versione di PVE 8.4.x</strong>",
+          "whyRich": "Aggiorna prima PVE 8 all’ultima revisione tramite il relativo script; le vecchie versioni 8.x hanno requisiti diversi"
+        },
+        {
+          "checkRich": "<strong>pve8to9 --full</strong>",
+          "whyRich": "Controllo dei requisiti fornito da Proxmox; gli errori FAIL bloccano l’aggiornamento finché non vengono corretti"
+        },
+        {
+          "checkRich": "<strong>Spazio su disco</strong>",
+          "whyRich": "≥ 1024 MB liberi in <code>/var/cache/apt/archives</code> per i file .deb scaricati"
+        },
+        {
+          "checkRich": "<strong>Connettività</strong>",
+          "whyRich": "Ping a <code>download.proxmox.com</code> — se fallisce, l’operazione non parte"
+        },
+        {
+          "checkRich": "<strong>Ceph 19.x Squid</strong>",
+          "whyRich": "Se Ceph è installato, deve già essere alla versione 19.x. PVE 9 non funziona con Ceph 17/18. Esistono le opzioni <code>--ignore-ceph-check</code> e <code>--warn-ceph-check</code> per ignorare il controllo: usale solo se sai cosa stai facendo."
+        }
+      ]
+    },
+    "distUpgradeHeading": "Il comando dist-upgrade (modalità automatica)",
+    "distUpgradeCode": "apt-get -y \\\n    -o Dpkg::Options::='--force-confdef' \\\n    -o Dpkg::Options::='--force-confold' \\\n    dist-upgrade",
+    "distUpgradeOutro": "L’output appare in tempo reale su stdout e viene anche salvato in <code>/var/log/pve8-a-pve9-&lt;timestamp&gt;.log</code>. È tutto visibile; vengono omesse solo le domande.",
+    "postHeading": "Operazioni successive all’aggiornamento (modalità automatica)",
+    "postItems": [
+      "<strong>Host EFI:</strong> installa <code>grub-efi-amd64</code> come indicato tra i problemi noti di Proxmox. Non viene installato automaticamente durante l’aggiornamento e può essere necessario per il prossimo avvio.",
+      "<strong>Repository Enterprise senza abbonamento.</strong> pve-manager 9 aggiunge <code>pve-enterprise.sources</code> durante l’aggiornamento; in modalità no-subscription lo script lo imposta su <code>Enabled: false</code>.",
+      "<strong>Esegue di nuovo <code>pve8to9 --full</code>.</strong> Segnala i problemi rimasti. In presenza di FAIL compare lo stesso menu di riparazione dei controlli preliminari.",
+      "<strong>Richiesta di riavvio.</strong> Si consiglia di riavviare per caricare il nuovo kernel e i servizi. Rifiuta solo per un motivo preciso: mantenere il vecchio kernel dopo un cambio di versione principale comporta rischi."
+    ]
+  },
+  "interactive": {
+    "heading": "Modalità interattiva",
+    "intro": "Stesso percorso della <autolink>modalità automatica</autolink>: controlli preliminari, migrazione dei repository e verifica finale identici. Cambia il passaggio <code>dist-upgrade</code>: <strong>rispondi personalmente a ogni conflitto di configurazione segnalato da dpkg</strong>. ProxMenux esegue <code>apt-get dist-upgrade</code> senza le opzioni <code>--force-conf*</code>.",
+    "distUpgradeHeading": "Il comando dist-upgrade (modalità interattiva)",
+    "distUpgradeCode": "apt-get dist-upgrade\n# (user answers each dpkg config-file conflict prompt as it appears)",
+    "whenHeading": "Quando interattivo è la scelta giusta",
+    "whenItems": [
+      "Hai personalizzato <code>/etc/lvm/lvm.conf</code>, <code>/etc/ssh/sshd_config</code>, <code>/etc/default/grub</code> o qualsiasi altro file di configurazione che viene toccato dall'aggiornamento.",
+      "Vuoi vedere quali pacchetti causano conflitti e decidere per ogni file.",
+      "Stai aggiornando un host di produzione sul quale non sono accettabili modifiche nascoste."
+    ],
+    "promptCalloutTitle": "Cosa rispondere ad ogni richiesta",
+    "promptCalloutBody": "Valgono le stesse raccomandazioni della procedura manuale: vedi <dpkglink>Risposte consigliate alle domande dpkg</dpkglink> più avanti. Digita <strong>D</strong> per vedere le differenze o <strong>Z</strong> per aprire una shell."
+  },
+  "manual": {
+    "heading": "Procedura di aggiornamento manuale",
+    "intro": "Questo è ciò che mostra l’opzione <strong>Guida all’aggiornamento manuale</strong>: il <wikilink>wiki ufficiale Proxmox per il passaggio da 8 a 9</wikilink>, diviso in quattro fasi. Lo script <em>mostra</em> i comandi; li esegui personalmente in una shell root separata. Ogni passaggio è visibile.",
+    "rootCalloutTitle": "Tutti i comandi hanno bisogno di root",
+    "rootCalloutBody": "Usa una shell root per questi comandi, incluse redirezioni e here-document. Con <code>sudo</code>, assicurati che l’intero comando venga eseguito con privilegi root.",
+    "phase1Heading": "Fase 1 — Preparazione",
+    "phase1Intro": "Aggiorna l’host all’ultima PVE 8.4.x, verifica versione e Ceph se presente, esegui il controllo Proxmox e avvia un multiplexer di terminale per resistere alle disconnessioni.",
+    "phase1Code": "# Step 1 — Update PVE 8 to the latest 8.4+\napt update && apt dist-upgrade -y\n\n# Step 2 — Verify version (must be 8.4.1 or newer)\npveversion\n\n# Step 2.1 — Hyper-converged Ceph: must already be on 19.x Squid\nceph --version\n# If older, follow https://pve.proxmox.com/wiki/Ceph_Reef_to_Squid\n\n# Step 3 — Run the official upgrade-readiness check\npve8to9 --full\n# If it warns about systemd-boot meta-package, remove it:\n#   apt remove systemd-boot\n\n# Step 4 — Start tmux or screen (so SSH disconnect doesn't kill the upgrade)\ntmux new-session -s upgrade\n# or\nscreen -S upgrade",
+    "phase2Heading": "Fase 2 — Migrazione di repository",
+    "phase2Intro": "Passa tutti i repository Debian e Proxmox da Bookworm a Trixie e converti le sorgenti Proxmox al formato deb822. <strong>Scegli il passaggio 7 OPPURE 8</strong> in base all’abbonamento Enterprise. Salta il passaggio 9 se non usi Ceph.",
+    "phase2Code": "# Step 5 — Debian: bookworm → trixie\nsed -i 's/bookworm/trixie/g' /etc/apt/sources.list\n\n# Step 6 — Same for the legacy enterprise list (only if you use enterprise)\nsed -i 's/bookworm/trixie/g' /etc/apt/sources.list.d/pve-enterprise.list\n\n# Step 7 — Add the new PVE 9 enterprise repo (deb822) — Enterprise users only\ncat > /etc/apt/sources.list.d/pve-enterprise.sources << EOF\nTypes: deb\nURIs: https://enterprise.proxmox.com/debian/pve\nSuites: trixie\nComponents: pve-enterprise\nSigned-By: /usr/share/keyrings/proxmox-archive-keyring.gpg\nEOF\n\n# Step 8 — OR add the no-subscription repo (most home / lab users)\ncat > /etc/apt/sources.list.d/proxmox.sources << EOF\nTypes: deb\nURIs: http://download.proxmox.com/debian/pve\nSuites: trixie\nComponents: pve-no-subscription\nSigned-By: /usr/share/keyrings/proxmox-archive-keyring.gpg\nEOF\n\n# Step 8.1 — Refresh and verify proxmox-ve candidate is 9.x\napt update && apt policy | sed -n '1,120p'\n\n# Step 9 — Update Ceph repo (only if you run Ceph)\ncat > /etc/apt/sources.list.d/ceph.sources << EOF\nTypes: deb\nURIs: http://download.proxmox.com/debian/ceph-squid\nSuites: trixie\nComponents: no-subscription\nSigned-By: /usr/share/keyrings/proxmox-archive-keyring.gpg\nEOF\n\n# Step 10 — Remove old .list files now superseded by deb822 .sources\nrm -f /etc/apt/sources.list.d/pve-enterprise.list /etc/apt/sources.list.d/ceph.list\n\n# Step 11 — Final apt update\napt update",
+    "phase3Heading": "Fase 3 — Il dist-upgrade",
+    "phase3Intro": "L’aggiornamento effettivo. Il passaggio 12 è facoltativo ma consigliato per ridurre i messaggi di audit. Il 13 richiede più tempo: rispondi alle domande dpkg usando la tabella. Il 13.1 riguarda solo EFI e segue i problemi noti ufficiali.",
+    "phase3Code": "# Step 12 — Disable kernel audit messages (optional)\nsystemctl disable --now systemd-journald-audit.socket\n\n# Step 13 — The main upgrade (this takes a while)\napt dist-upgrade\n# (answer prompts using the table below)\n\n# Step 13.1 — EFI hosts: install grub for EFI (per known issues)\n[ -d /sys/firmware/efi ] && apt install grub-efi-amd64",
+    "dpkgHeading": "Risposte consigliate per i prompt dpkg",
+    "dpkgIntro": "Risposte raccomandate dalla guida Proxmox: <strong>Y</strong> installa il nuovo file del manutentore, sovrascrivendo il tuo; <strong>N</strong> conserva il file attuale. In caso di dubbio, verifica prima le differenze:",
+    "dpkgTable": {
+      "fileHeader": "File / richiesta",
+      "answerHeader": "Risposta consigliata",
+      "whyHeader": "Perché?",
+      "rows": [
+        {
+          "fileRich": "/etc/issue",
+          "answerRich": "<strong>N</strong> (conserva il file attuale)",
+          "whyRich": "Banner che sei abituato a vedere",
+          "fileFont": true
+        },
+        {
+          "fileRich": "/etc/lvm/lvm.conf",
+          "answerRich": "<strong>Y</strong> (versione del manutentore)",
+          "whyRich": "PVE 9 richiede i nuovi valori LVM predefiniti",
+          "fileFont": true
+        },
+        {
+          "fileRich": "/etc/ssh/sshd_config",
+          "answerRich": "<strong>Y</strong> per sole modifiche predefinite; esamina prima i file personalizzati",
+          "whyRich": "Controlla le impostazioni SSH locali e preserva l’accesso prima di sostituire il file. Le modifiche predefinite includono opzioni rinominate e commenti.",
+          "fileFont": true
+        },
+        {
+          "fileRich": "/etc/default/grub",
+          "answerRich": "<strong>N</strong> se personalizzato",
+          "whyRich": "Contiene i parametri di avvio, come IOMMU e passthrough PCI",
+          "fileFont": true
+        },
+        {
+          "fileRich": "/etc/chrony/chrony.conf",
+          "answerRich": "<strong>Y</strong> se non modificato; conserva prima le impostazioni locali",
+          "whyRich": "Trixie aggiorna i valori per la sincronizzazione oraria. Sposta le impostazioni locali nelle directory conf.d / sources.d di chrony prima di accettare il nuovo file.",
+          "fileFont": true
+        },
+        {
+          "fileRich": "Riavvii dei servizi durante l’aggiornamento",
+          "answerRich": "<strong>Sì</strong> (predefinito)",
+          "whyRich": "Riavvia la maggior parte dei servizi senza riavviare l’host",
+          "fileFont": false
+        },
+        {
+          "fileRich": "<code>apt-listchanges</code>",
+          "answerRich": "Premere <kbd>q</kbd>",
+          "whyRich": "Chiude solo il pager; le informazioni mostrate riassumono il registro delle modifiche",
+          "fileFont": false
+        }
+      ]
+    },
+    "inspectCalloutTitle": "Ispezione di uno specifico conflitto dpkg",
+    "inspectCalloutBody": "Alle domande dpkg sui file di configurazione, <strong>D</strong> mostra le differenze fra il tuo file e quello nuovo; <strong>Z</strong> apre una shell per esaminare il problema. Consentono di decidere senza tirare a indovinare.",
+    "phase4Heading": "Fase 4 — Postupgrade",
+    "phase4Intro": "Verifica che l’aggiornamento sia riuscito, riavvia con il kernel PVE 9 e conferma la versione. Puoi poi convertire i vecchi file <code>.list</code> rimasti nel formato deb822.",
+    "phase4Code": "# Step 14 — Re-run the readiness check (should be much cleaner now)\npve8to9 --full\n\n# Step 15 — Reboot to load the new kernel and PVE 9 daemons\nreboot\n\n# Step 16 — After reboot, confirm PVE 9.x\npveversion\n# Should show pve-manager/9.x.x\n\n# Step 17 — Optional: modernise the remaining legacy .list files to deb822\napt modernize-sources\n# (keeps .list backups as .bak)"
+  },
+  "clusterCeph": {
+    "heading": "Cluster e Ceph",
+    "clusterCalloutTitle": "Cluster: aggiornare i nodi uno alla volta",
+    "clusterCalloutBody": "Rilevato con <code>pvecm status</code>. <strong>Non</strong> aggiornare più nodi contemporaneamente. Sposta gli ospiti, aggiorna il nodo, riavvia e verifica l’appartenenza al cluster prima di proseguire. Durante l’aggiornamento funziona la migrazione live da versioni PVE precedenti a successive; la direzione inversa generalmente non è supportata. I gruppi HA diventano automaticamente regole HA quando tutti i nodi usano PVE 9.",
+    "cephCalloutTitle": "Ceph: aggiornare PRIMA Ceph, poi Proxmox",
+    "cephCalloutBody": "Ceph deve già usare 19.x Squid prima dell’aggiornamento Proxmox. Segui l’ordine ufficiale Quincy 17 → Reef 18 → Squid 19, aggiornando pacchetti e riavviando progressivamente i demoni Ceph nell’ordine documentato. Verifica <code>ceph --version</code> prima di ogni nodo Proxmox. Procedura completa: <cephlink>wiki per il passaggio da Ceph Reef a Squid</cephlink>."
+  },
+  "troubleshooting": {
+    "heading": "Risoluzione dei problemi",
+    "items": [
+      {
+        "title": "Lo script si interrompe: \"This script cannot be executed from the Proxmox web terminal\"",
+        "bodyRich": "Apri una connessione SSH o usa console / IPMI / iKVM e riprova da lì. Avvia prima <code>tmux new -s pveupgrade</code> per resistere a brevi interruzioni di rete."
+      },
+      {
+        "title": "pve8to9 segnala FAIL e l’opzione 1 di riparazione produce \"command not found\"",
+        "bodyRich": "Se l’errore cita <code>configure_repositories</code>, la copia dello script è obsoleta: la riparazione attuale usa cleanup_duplicate_repos e ensure_repositories. Aggiornala o esamina i comandi manuali con l’opzione 2. <code>apt-get update</code> aggiorna le liste dei pacchetti, ma non risolve ogni controllo bloccante."
+      },
+      {
+        "title": "La simulazione apt segnala \"proxmox-ve will be REMOVED\"",
+        "bodyRich": "I nuovi repository non sono raggiungibili o il nome della distribuzione non è stato sostituito. Controlla <code>cat /etc/apt/sources.list.d/proxmox.sources</code>: <code>Suites:</code> deve indicare <code>trixie</code>, non <code>bookworm</code>. <code>apt-cache policy proxmox-ve</code> deve mostrare un candidato 9.x dal nuovo repository."
+      },
+      {
+        "title": "dist-upgrade fallisce durante l’esecuzione",
+        "bodyRich": "Eseguire <code>apt-get -f install</code> per risolvere le dipendenze rotte, quindi eseguire nuovamente l'aggiornamento. Se ciò fallisce, controlla il registro a <code>/var/log/pve8-a-pve9-&lt;timestamp&gt;.log</code> — le ultime righe di solito indicano il pacchetto offensivo. Non riavviare fino a quando <code>dpkg -l | grep ^iU</code> ritorna vuoto (senza pacchetti semiinstallati)."
+      },
+      {
+        "title": "L'host EFI non si avvia dopo il riavvio",
+        "bodyRich": "L’installazione successiva di <code>grub-efi-amd64</code> risolve il problema. Se è stata saltata o è fallita, avvia l’ISO Proxmox in modalità ripristino, monta il filesystem root, esegui chroot e <code>apt-get install grub-efi-amd64 &amp;&amp; update-grub</code>."
+      },
+      {
+        "title": "GUI non si carica dopo l'aggiornamento",
+        "bodyRich": "Esegui <code>systemctl status pveproxy</code> e <code>systemctl restart pveproxy</code>. Se il problema persiste, cerca l’errore con <code>journalctl -u pveproxy -b</code>."
+      },
+      {
+        "title": "La rete non funziona dopo il riavvio",
+        "bodyRich": "Verifica che <code>/etc/network/interfaces</code> faccia riferimento a dispositivi esistenti e che <code>ifupdown2</code> sia installato: <code>apt install ifupdown2</code>. Se i nomi sono cambiati, vedi <netlink>Nomi persistenti delle interfacce</netlink>."
+      },
+      {
+        "title": "Cluster split-brain dopo l'aggiornamento di un nodo",
+        "bodyRich": "I cluster misti PVE 8 / PVE 9 sono supportati durante l’aggiornamento. Funziona la migrazione live da versioni precedenti a successive; la direzione inversa generalmente non è supportata. Se il nodo appare offline, verifica <code>corosync</code> e la configurazione QDevice / rete. Esegui <code>pvecm status</code> su ciascun nodo per confermare il quorum."
+      }
+    ]
+  },
+  "files": {
+    "heading": "File coinvolti",
+    "code": "scripts/utilities/upgrade_pve8_to_pve9.sh                         # main upgrade orchestrator\nscripts/utilities/pve8to9_check.sh                                # pre-check (separate menu option)\nscripts/utilities/proxmox-upgrade-pve8-to-pve9-manual-guide.sh    # 17-step runbook\nscripts/global/update-pve8.sh                                     # PVE 8 worker (final patches)\n/etc/apt/sources.list                                             # bookworm → trixie sed\n/etc/apt/sources.list.d/proxmox.sources                           # created (deb822 PVE 9)\n/etc/apt/sources.list.d/debian.sources                            # created (deb822 trixie)\n/etc/apt/sources.list.d/ceph.sources                              # created if Ceph\n/etc/apt/sources.list.d/*.list                                    # legacy files commented out / removed\n/var/log/pve8-a-pve9-'<'timestamp'>'.log                              # full upgrade log"
+  },
+  "references": {
+    "heading": "Riferimenti ufficiali",
+    "intro": "La procedura manuale dello script segue queste fonti ufficiali. In caso di dubbi durante un aggiornamento, segui il wiki ufficiale: ProxMenux facilita l’esecuzione, Proxmox resta il riferimento.",
+    "items": [
+      {
+        "href": "https://pve.proxmox.com/wiki/Upgrade_from_8_to_9",
+        "title": "Aggiornamento da 8 a 9",
+        "desc": "La principale pagina wiki Proxmox per l'aggiornamento 8 → 9. Fonte di verità per ogni comando nella procedura manuale sopra."
+      },
+      {
+        "href": "https://pve.proxmox.com/wiki/Ceph_Reef_to_Squid",
+        "title": "Aggiornamento a Ceph Squid (19.x)",
+        "desc": "Passaggio preliminare obbligatorio per nodi Ceph iperconvergenti. Ceph deve essere 19.x Squid prima di PVE 9."
+      },
+      {
+        "href": "https://pve.proxmox.com/wiki/Roadmap",
+        "title": "Piano di sviluppo di Proxmox VE",
+        "desc": "Note di rilascio PVE 9 e modifiche rispetto a 8.x: da leggere prima di aggiornare."
+      },
+      {
+        "href": "https://www.debian.org/releases/trixie/releasenotes",
+        "title": "Note di rilascio di Debian Trixie",
+        "desc": "PVE 9 si basa su Debian Trixie. Le note Debian descrivono i cambiamenti del sistema operativo che interessano anche l’host."
+      },
+      {
+        "href": "https://forum.proxmox.com/forums/proxmox-ve-installation-and-configuration.16/",
+        "title": "forum di installazione Proxmox VE",
+        "desc": "Se qualcosa va storto durante l’aggiornamento, cerca prima nel forum: qualcuno potrebbe aver già incontrato lo stesso problema."
+      },
+      {
+        "href": "https://pve.proxmox.com/wiki/Backup_and_Restore",
+        "title": "Backup e ripristino",
+        "desc": "Il cambio di versione principale è irreversibile. Verifica i backup prima di iniziare."
+      }
+    ]
+  },
+  "video": {
+    "heading": "Videoguida",
+    "intro": "Preferisci guardare l'aggiornamento eseguire end-to-end prima di farlo da soli? Questo passaggio dimostra il flusso di aggiornamento ProxMenux in tempo reale.",
+    "title": "ProxMenux — Videoguida al passaggio da Proxmox VE 8 a 9",
+    "caption": "Video esterno su YouTube. Riproduzione in modalità di privacy avanzata, senza cookie finché non avvii il video."
+  },
+  "related": {
+    "heading": "Correlati",
+    "items": [
+      {
+        "href": "/docs/utils/system-update",
+        "label": "Aggiornamento sistema Proxmox",
+        "tail": " — per gli aggiornamenti ordinari all’interno della stessa versione principale (8.4.1 → 8.4.5, ecc.)."
+      },
+      {
+        "href": "/docs/utils",
+        "label": "Panoramica delle utilità",
+        "tail": " — torna alla panoramica della sezione."
+      }
+    ]
+  }
+}
diff --git a/web/messages/it/docs/utils/uup-dump-iso-creator.json b/web/messages/it/docs/utils/uup-dump-iso-creator.json
new file mode 100644
index 00000000..f39d707b
--- /dev/null
+++ b/web/messages/it/docs/utils/uup-dump-iso-creator.json
@@ -0,0 +1,161 @@
+{
+  "meta": {
+    "title": "Creatore di ISO UUP Dump | Documentazione ProxMenux",
+    "description": "Crea una ISO di installazione di Windows aggiornata sull’host Proxmox con il creatore di ISO UUP Dump di ProxMenux. Automatizza l’installazione delle dipendenze, il download e la conversione dei file UUP in una ISO avviabile per creare una VM.",
+    "ogTitle": "Creatore di ISO UUP Dump | Documentazione ProxMenux",
+    "ogDescription": "Crea una ISO di Windows aggiornata con UUP Dump e ProxMenux. Dipendenze, download e conversione sono completamente automatizzati.",
+    "ogImageAlt": "ProxMenux — Creatore di ISO UUP Dump"
+  },
+  "header": {
+    "title": "Creatore di ISO UUP Dump",
+    "description": "Crea una ISO di installazione di Windows aggiornata sull’host Proxmox con UUP Dump. ProxMenux gestisce le dipendenze, scarica i file UUP in parallelo, esegue il convertitore UUP Dump e sposta la ISO nella directory di uscita scelta, che per impostazione predefinita è lo storage ISO Proxmox rilevato.",
+    "section": "Utilità"
+  },
+  "intro": {
+    "title": "Cosa fa questo script",
+    "body": "Fornisci l’URL generato da uupdump.net dopo aver scelto build, lingua ed edizione. Lo script installa le dipendenze mancanti, scarica il convertitore UUP Dump e i file UUP, crea una ISO Windows avviabile e la sposta nella directory di uscita scelta. Lo storage ISO Proxmox rilevato viene proposto come destinazione predefinita."
+  },
+  "hero": {
+    "imageAlt": "UUP Dump ISO Creator voce in ProxMenux",
+    "caption": "UUP Dump ISO Creator voce in ProxMenux"
+  },
+  "what": {
+    "heading": "Cos'è UUP Dump?",
+    "intro": "UUP Dump è un servizio della comunità che consente di scaricare i file originali Unified Update Platform (UUP) usati da Windows Update per distribuire Windows. Questi file possono essere assemblati in una normale ISO avviabile. Permette di ottenere:",
+    "items": [
+      "La build di Windows più recente, compresi i canali Insider Preview.",
+      "Una specifica build precedente non più elencata nella pagina di download Microsoft.",
+      "File puliti e non modificati provenienti direttamente dai server di Microsoft.",
+      "La combinazione desiderata di edizioni e lingue in una sola ISO."
+    ],
+    "learnMore": "Scopri di più nella <extlink>pagina del progetto UUP Dump</extlink>."
+  },
+  "automates": {
+    "heading": "Cosa automatizza lo script"
+  },
+  "dependencies": {
+    "heading": "Dipendenze",
+    "intro": "Lo script controlla innanzitutto gli strumenti necessari per scaricare i file UUP e creare la ISO. Quelli mancanti vengono installati con <code>apt-get</code>:",
+    "headerPackage": "Pacchetto",
+    "headerRole": "Ruolo",
+    "rows": [
+      {
+        "pkg": "curl",
+        "roleRich": "Download HTTP (avvio iniziale del convertitore)."
+      },
+      {
+        "pkg": "aria2",
+        "roleRich": "Downloader parallelo utilizzato per ogni payload UUP."
+      },
+      {
+        "pkg": "cabextract",
+        "roleRich": "Estrae pacchetti Microsoft CAB."
+      },
+      {
+        "pkg": "wimtools",
+        "roleRich": "Costruisce <code>install.wim</code> (wimlib-imagex)."
+      },
+      {
+        "pkg": "genisoimage",
+        "roleRich": "Scrive la ISO avviabile finale (o <code>mkisofs</code>)."
+      },
+      {
+        "pkg": "chntpw",
+        "roleRich": "Modifica gli hive del registro di Windows durante la creazione."
+      }
+    ],
+    "manualIntro": "Equivalente manuale — se avete mai bisogno di installarli voi stessi:",
+    "manualCode": "apt-get install curl aria2 cabextract wimtools genisoimage chntpw"
+  },
+  "flow": {
+    "heading": "Download e conversione",
+    "steps": [
+      "Rileva lo storage ISO Proxmox tramite <code>pvesm status -content iso</code> oppure usa <code>/var/lib/vz/template/iso</code> come alternativa.",
+      "Richiede una cartella di base per i file temporanei (default <code>/root/uup-temp</code>).",
+      "Scarica il convertitore UUP Dump da <code>git.uupdump.net</code>.",
+      "Estrae <code>id</code>, <code>pack</code> ed <code>edition</code> dall’URL incollato.",
+      "Chiama <code>https://uupdump.net/get.php?…&aria2=2</code> per generare un elenco di download di aria2.",
+      "Scarica tutti i file UUP in <code>UUPs/</code> con aria2, in parallelo e con possibilità di ripresa.",
+      "Esegue <code>convert.sh wim UUPs 1</code> dal convertitore per produrre l'ISO finale.",
+      "Sposta la ISO nella directory di uscita scelta ed elimina i file temporanei."
+    ]
+  },
+  "aria2": {
+    "heading": "Opzioni di download aria2 utilizzate",
+    "code": "aria2c --no-conf --console-log-level=warn --log-level=info \\\n  --log=aria2_download.log \\\n  -x16 -s16 -j5 -c -R \\\n  -d\"$destDir\" -i\"$tempScript\"",
+    "flags": [
+      "<code>-x16</code> — fino a 16 connessioni per server.",
+      "<code>-s16</code> — divide ogni file in 16 segmenti.",
+      "<code>-j5</code> — scarica 5 file in parallelo.",
+      "<code>-c</code> — riprende i download parziali.",
+      "<code>-R</code> — applica al file scaricato la data e l’ora del file remoto, quando disponibili."
+    ],
+    "runtime": "La durata tipica è di circa 10 minuti e dipende soprattutto dalla velocità della connessione Internet e dal carico dei server di download UUP Dump."
+  },
+  "step1": {
+    "heading": "Passo 1 · Ottenere un UUP Dump URL",
+    "intro": "Prima di eseguire lo script è necessario un URL UUP Dump che include i parametri di query <code>id</code>, <code>pack</code> e <code>edition</code>. Generarlo su <extlink>uupdump.net</extlink>:",
+    "stepBadge": "Passaggio",
+    "items": [
+      {
+        "title": "Scegli una versione di Windows",
+        "img": "/iso-creator/step-1-select-version-windows.png",
+        "caption": "UUP Dump pagina principale — scegliere una versione di Windows",
+        "body": "Apri la home page di UUP Dump e scegli la versione di Windows che desideri."
+      },
+      {
+        "title": "Scegli una build specifica",
+        "img": "/iso-creator/step-2-select-version-windows.png",
+        "caption": "Scegli una build specifica",
+        "body": "Scegli la build: l’ultima disponibile, un canale Insider Preview o una build precedente ancora elencata."
+      },
+      {
+        "title": "Scegli una lingua",
+        "img": "/iso-creator/step-3-select-version-windows.png",
+        "caption": "Scegli una lingua",
+        "body": "Scegli la lingua da includere nella ISO."
+      },
+      {
+        "title": "Scegli le edizioni",
+        "img": "/iso-creator/step-4-select-version-windows.png",
+        "caption": "Scegli le edizioni da includere",
+        "body": "Scegli le edizioni da includere nella ISO (Home, Pro, Enterprise, …). Puoi combinarne diverse."
+      },
+      {
+        "title": "Copia l'URL",
+        "img": "/iso-creator/step-5-select-version-windows.png",
+        "caption": "Copia l'URL dalla barra degli indirizzi",
+        "bodyRich": "Nella pagina finale, copia l’URL <em>dalla barra degli indirizzi del browser</em>. Deve contenere <code>id=…</code>, <code>pack=…</code> ed <code>edition=…</code>. È la stringa che lo script analizzerà."
+      }
+    ]
+  },
+  "step2": {
+    "heading": "Passo 2 · Eseguire il creatore",
+    "intro": "Con l'URL in mano, aprire ProxMenux e lanciare il creatore:",
+    "stepBadge": "Passaggio",
+    "items": [
+      {
+        "title": "Avviare UUP Dump ISO Creator",
+        "img": "/iso-creator/start-uupdump-iso-creator.png",
+        "caption": "Avviare UUP Dump ISO Creator da ProxMenux",
+        "bodyRich": "In ProxMenux, apri <strong>Utilities → UUP Dump ISO Creator</strong>. Lo script controlla dipendenze e directory ISO prima di chiedere i dati."
+      },
+      {
+        "title": "Incolla l'URL di UUP Dump",
+        "img": "/iso-creator/add-url-iso-creator.png",
+        "caption": "Incolla l'URL copiato da uupdump.net",
+        "body": "Incolla l’URL nella finestra di inserimento. Lo script verifica che i tre parametri richiesti siano presenti e si interrompe correttamente se ne manca uno."
+      },
+      {
+        "title": "Attendi il completamento della creazione",
+        "img": "/iso-creator/end-uupdump-iso-creator.png",
+        "caption": "Creazione completata: la ISO è pronta nello storage ISO Proxmox",
+        "bodyRich": "La console mostra l’avanzamento di aria2 e poi l’output del convertitore. La ISO completata viene spostata nella directory di uscita scelta. Se si trova in uno storage ISO Proxmox configurato, può essere selezionata da <strong>Crea VM con Windows → Installa con ISO personale</strong>."
+      }
+    ]
+  },
+  "tempFiles": {
+    "title": "File temporanei",
+    "body": "La cartella temporanea predefinita è <code>/root/uup-temp</code>, con i download in <code>UUPs/</code> e il convertitore in <code>converter/</code>. Un percorso di base personalizzato riceve una sottocartella di sessione separata. I rami di creazione riuscita e di assenza di ISO generata eliminano la sessione temporanea. Errori o annullamenti precedenti possono lasciare file temporanei."
+  }
+}
diff --git a/web/messages/it/guides/backup-cloud.json b/web/messages/it/guides/backup-cloud.json
new file mode 100644
index 00000000..85d6d058
--- /dev/null
+++ b/web/messages/it/guides/backup-cloud.json
@@ -0,0 +1,119 @@
+{
+  "meta": {
+    "title": "Backup di Proxmox su cloud personale | ProxMenux",
+    "description": "Montare con rclone un cloud personale, come Google Drive, Mega, Dropbox o OneDrive, in una directory dell’host Proxmox VE, registrarlo come archivio di backup per vzdump e salvare direttamente VM e container nel cloud, senza uno script di backup aggiuntivo.",
+    "ogTitle": "Backup di Proxmox su cloud personale",
+    "ogDescription": "Montare un cloud con rclone sull’host Proxmox VE e usarlo come destinazione vzdump per i backup di VM e container."
+  },
+  "header": {
+    "title": "Backup di Proxmox su cloud personale",
+    "description": "Montare con rclone un cloud personale, come Google Drive, Mega, Dropbox o OneDrive, in una directory dell’host Proxmox VE, registrarlo come archivio di backup per vzdump e salvare direttamente VM e container nel cloud, senza uno script di backup aggiuntivo.",
+    "section": "Guide"
+  },
+  "intro": {
+    "pbsCalloutTitle": "Valuta prima Proxmox Backup Server",
+    "pbsCalloutBody": "Su una seconda macchina che soddisfa i requisiti x86-64, <pbsLink>Proxmox Backup Server</pbsLink> offre backup incrementali e deduplicati con cifratura facoltativa lato client. È progettato per i backup delle VM. Questa guida spiega invece come montare un cloud personale, come Google Drive, Mega, OneDrive o Dropbox, come destinazione dei backup.",
+    "stepsTitle": "Cosa farai",
+    "steps": [
+      "Creare una directory sull’host Proxmox e registrarla come archivio per backup vzdump.",
+      "Installare e configurare rclone per il provider cloud.",
+      "Montare la cartella cloud nella directory.",
+      "Ripristinare il montaggio a ogni avvio con un’unità systemd."
+    ],
+    "vzdumpCalloutTitle": "Nota sui backup vzdump di Proxmox",
+    "vzdumpCalloutBody": "Gli archivi vzdump di Proxmox sono <strong>backup completi, non incrementali</strong>. La dimensione reale dipende dai dati inclusi e dalla compressione, non solo dalla capacità del disco virtuale. Se un archivio occupa 30 GB, conservarne cinque richiede circa 150 GB. Imposta una politica di conservazione per evitare di riempire il cloud."
+  },
+  "createDir": {
+    "heading": "1. Creare la directory sull’host e registrarla come archivio di backup",
+    "body": "Collegati all’host tramite SSH o apri la shell Proxmox e crea una directory come punto di montaggio in <code>/mnt/</code>. Scegli un nome che identifichi il fornitore:",
+    "mkdirCode": "mkdir -p /mnt/gdrive",
+    "afterMkdir": "Nel web UI di Proxmox: <strong>Datacenter → Storage → Aggiungere → Directory</strong>.",
+    "image1Alt": "Aggiunta di nuovo storage in Proxmox",
+    "configIntro": "Configuralo così:",
+    "configItems": [
+      "<strong>ID:</strong> <code>gdrive</code> (o qualsiasi cosa tu abbia usato per il nome della directory)",
+      "<strong>Directory:</strong> <code>/mnt/gdrive</code>",
+      "<strong>Contenuto:</strong> seleziona <strong>File di backup VZDump</strong>."
+    ],
+    "image2Alt": "Configurazione di nuovi storage in Proxmox",
+    "afterConfig": "Fai clic su <strong>Aggiungi</strong>:",
+    "image3Alt": "Nuovo storage aggiunto in Proxmox",
+    "afterAdd": "La directory è registrata come archivio Proxmox, ma è ancora vuota: il cloud non è ancora montato."
+  },
+  "installRclone": {
+    "heading": "2. Installare e configurare rclone",
+    "body": "<rcloneLink>rclone</rcloneLink> comunica con i servizi di archiviazione cloud. Installalo dai repository Debian:",
+    "installCode": "apt-get update\napt-get install -y rclone",
+    "newerCalloutTitle": "Se hai bisogno di un nuovo rclone",
+    "newerCalloutBody": "Se ti serve una versione più recente di quella fornita da Debian, usa il programma di installazione ufficiale:",
+    "newerCode": "curl https://rclone.org/install.sh | bash",
+    "tunnelHeading": "2.1 Autenticazione nel browser tramite tunnel SSH",
+    "tunnelBody": "Per i fornitori con accesso via browser, l’host Proxmox di solito non dispone di un browser. Segui la <remoteSetupLink>procedura di configurazione remota di rclone</remoteSetupLink>: usa il browser del portatile e inoltra la connessione di ritorno localhost tramite SSH a rclone sull’host.",
+    "tunnelFrom": "Dal <strong>portatile</strong>, sostituendo <code>ip_proxmox</code> con l’IP di Proxmox:",
+    "tunnelCode": "ssh -L localhost:53682:localhost:53682 root@ip_proxmox",
+    "tunnelAfter": "Questa sessione SSH apre la porta localhost 53682 sul portatile e inoltra le connessioni alla stessa porta dell’host Proxmox. Tienila aperta durante la configurazione di rclone.",
+    "runHeading": "2.2 Esegui rclone config",
+    "runBody": "Nella sessione SSH appena aperta, esegui:",
+    "runCode": "rclone config",
+    "runAfter": "Segui le istruzioni per aggiungere una nuova configurazione remota, o «remote». Le risposte dipendono dal fornitore: consulta la <providerDocsLink>documentazione dei fornitori rclone</providerDocsLink> per Google Drive, Mega, Dropbox, OneDrive e altri. Il passaggio chiave è la domanda sull’autenticazione:",
+    "authPrompt": "Use web browser to automatically authenticate rclone with remote?\n * Say Y if the machine running rclone has a web browser you can use\n * Say N if running rclone on a (remote) machine without web browser access\nIf not sure try Y. If Y failed, try N.\ny) Yes\nn) No\ny/n> y",
+    "authAfter": "Rispondi <strong>Y</strong>. rclone mostra un URL locale. Aprilo nel <strong>browser del portatile</strong>: il tunnel SSH inoltra la connessione. Autorizza rclone presso il fornitore cloud per completare la configurazione.",
+    "nameRemote": "Come nome della configurazione remota usa un nome che corrisponda alla directory, ad esempio <code>gdrive</code>."
+  },
+  "mount": {
+    "heading": "3. Montare la cartella cloud",
+    "body": "Crea nel cloud una cartella per i backup, ad esempio <code>PBC</code>, abbreviazione di Proxmox Backup Cloud.",
+    "mountIntro": "Montala nella directory sull’host:",
+    "mountCode": "rclone mount gdrive:/PBC /mnt/gdrive --allow-other --allow-non-empty --vfs-cache-mode writes",
+    "mountItems": [
+      "<code>gdrive:/PBC</code> — la cartella nel cloud.",
+      "<code>/mnt/gdrive</code> — la directory host registrata come datastore."
+    ],
+    "mountFootnote": "<strong>Questo comando resta in primo piano.</strong> Lascialo in esecuzione in un terminale per provare un backup. Per ripristinare il montaggio a ogni avvio, configura un’unità systemd nella sezione seguente."
+  },
+  "systemd": {
+    "heading": "4. Montaggio automatico a ogni avvio con systemd",
+    "body": "Un’unità systemd offre più controllo di <code>crontab @reboot</code>: può attendere l’avvio della rete, riavviarsi in caso di errore e fornire log tramite <code>journalctl</code>.",
+    "createIntro": "Crea il file dell’unità:",
+    "createCode": "nano /etc/systemd/system/rclone-gdrive.service",
+    "pasteIntro": "Incolla:",
+    "unitCode": "[Unit]\nDescription=rclone mount for Proxmox cloud backups\nWants=network-online.target\nAfter=network-online.target\n\n[Service]\nType=notify\nExecStart=/usr/bin/rclone mount \\\n    gdrive:/PBC /mnt/gdrive \\\n    --allow-other \\\n    --allow-non-empty \\\n    --vfs-cache-mode writes \\\n    --log-level INFO \\\n    --log-file /var/log/rclone-gdrive.log\nExecStop=/bin/fusermount -uz /mnt/gdrive\nRestart=on-failure\nRestartSec=10\n\n[Install]\nWantedBy=multi-user.target",
+    "adjust": "Adatta <code>gdrive:/PBC</code> e <code>/mnt/gdrive</code> se hai scelto nomi diversi. Salva, esci dall’editor con <code>Ctrl+X</code>, poi abilita e avvia il servizio:",
+    "enableCode": "systemctl daemon-reload\nsystemctl enable --now rclone-gdrive.service",
+    "verifyIntro": "Verifica:",
+    "verifyCode": "systemctl status rclone-gdrive.service\nmount | grep /mnt/gdrive",
+    "verifyAfter": "L’unità richiede un riavvio dopo 10 secondi se il processo rclone termina con un errore. Non ripristina credenziali scadute e non garantisce il recupero da ogni errore di rete o del fornitore. Controlla <code>/var/log/rclone-gdrive.log</code> e <code>journalctl -u rclone-gdrive.service -f</code>.",
+    "vfsCalloutTitle": "Perché usare --vfs-cache-mode writes?",
+    "vfsCalloutBody": "Con la cache di scrittura, operazioni come <code>fwrite</code> scrivono in una cache su disco locale. rclone carica il file dopo la chiusura e il ritardo di scrittura differita. Riserva spazio locale per i backup in corso e verifica che il caricamento sia terminato prima di considerare disponibile la copia nel cloud."
+  },
+  "configureBackup": {
+    "heading": "5. Configurare il cloud come destinazione dei backup",
+    "body": "In Proxmox, per un backup pianificato o manuale, scegli l’archivio registrato come <strong>destinazione</strong>:",
+    "image5Alt": "Selezione della destinazione di backup in Proxmox",
+    "after": "Dopo la fine di vzdump, attendi il completamento del caricamento rclone in background e verifica l’archivio nell’interfaccia del fornitore cloud:",
+    "image6Alt": "File di backup in cloud storage"
+  },
+  "retention": {
+    "heading": "6. Conservazione: tenere sotto controllo la quota cloud",
+    "body": "Gli archivi vzdump di Proxmox sono <strong>backup completi, non incrementali</strong>. La dimensione reale dipende dai dati inclusi e dalla compressione, non solo dalla capacità del disco virtuale. Se un archivio occupa 30 GB, conservarne cinque richiede circa 150 GB. Imposta una politica di conservazione per evitare di riempire il cloud.",
+    "uiPath": "Nell’interfaccia Proxmox: <strong>Datacenter → Backup → [la tua attività] → Conservazione</strong>:",
+    "image7Alt": "Impostazioni di conservazione di backup in Proxmox",
+    "starterIntro": "Possibili valori iniziali per un ambiente domestico o di prova:",
+    "starterItems": [
+      "Conservare gli ultimi 5 backup giornalieri",
+      "Conservare gli ultimi 4 backup settimanali",
+      "Conservare gli ultimi 6 backup mensili"
+    ],
+    "adjust": "Adatta i valori alla quota cloud e alla frequenza con cui cambiano le VM."
+  },
+  "troubleshoot": {
+    "heading": "Risoluzione dei problemi",
+    "items": [
+      "<strong><code>Mount point /mnt/gdrive is itself on a fuse.rclone filesystem</code>:</strong> la directory è già montata, forse da un’altra istanza rclone. Controlla che non siano in corso backup prima di rimuovere il vecchio montaggio con <code>fusermount -uz /mnt/gdrive</code>, poi riavvia l’unità systemd.",
+      "<strong>Il backup è molto lento:</strong> verifica che <code>--vfs-cache-mode writes</code> sia nella riga <code>ExecStart</code>. Controlla prestazioni della cache locale, banda di caricamento e limiti del fornitore. Il caricamento può continuare dopo la fine di vzdump.",
+      "<strong>Il backup segnala No space left on device:</strong> controlla spazio della cache locale e quota cloud. La cache usa normalmente <code>~/.cache/rclone/</code>. Se è piena, scegli ad esempio <code>--cache-dir /var/cache/rclone</code> su un filesystem con spazio sufficiente. Un altro percorso sullo stesso filesystem pieno non risolve il problema.",
+      "<strong>Il token di autenticazione rclone è scaduto:</strong> ricollegati tramite SSH con il tunnel (<code>ssh -L localhost:53682:localhost:53682 root@ip_proxmox</code>) ed esegui <code>rclone config reconnect gdrive:</code> per rinnovare l’autorizzazione.",
+      "<strong>I backup sono nel cloud, ma il ripristino fallisce:</strong> non usare il cloud come <strong>unica</strong> destinazione. Affiancagli PBS locale o backup vzdump su un altro disco."
+    ]
+  }
+}
diff --git a/web/messages/it/guides/index.json b/web/messages/it/guides/index.json
new file mode 100644
index 00000000..c16bcc1d
--- /dev/null
+++ b/web/messages/it/guides/index.json
@@ -0,0 +1,118 @@
+{
+  "meta": {
+    "title": "Guide Proxmox VE — Coral TPU, NVIDIA, Kodi in LXC, Samba e backup cloud | ProxMenux",
+    "description": "Tutorial dettagliati per Proxmox VE: Kodi in LXC con accelerazione GPU, driver NVIDIA su PVE 9, dischi USB condivisi tramite Samba in un container e backup vzdump su Google Drive, Mega, Dropbox o OneDrive. Con risorse selezionate della comunità, glossario e guida ai comandi.",
+    "ogTitle": "Guide Proxmox VE — Coral TPU, NVIDIA, Kodi in LXC, Samba e backup cloud",
+    "ogDescription": "Tutorial dettagliati per Proxmox VE: passthrough GPU, centro multimediale Kodi in LXC, dischi USB condivisi tramite Samba, backup cloud con rclone e risorse selezionate della comunità.",
+    "twitterTitle": "Guide Proxmox VE | ProxMenux",
+    "twitterDescription": "Tutorial dettagliati per Proxmox VE: GPU, Kodi in LXC, Samba, backup cloud e altro.",
+    "ogImageAlt": "Guide ProxMenux — tutorial dettagliati per Proxmox VE"
+  },
+  "header": {
+    "title": "Guide ProxMenux",
+    "tagline": "Tutorial approfonditi, riferimenti rapidi e risorse selezionate della comunità per sfruttare al meglio Proxmox VE."
+  },
+  "inDepth": {
+    "heading": "Guide approfondite",
+    "intro": "Tutorial dettagliati per attività specifiche di Proxmox. Ogni guida descrive i passaggi manuali di un processo automatizzato da ProxMenux, per capire cosa avviene in ogni fase.",
+    "items": [
+      {
+        "slug": "kodi-lxc",
+        "title": "Installare Kodi in LXC con accelerazione GPU e collegarlo a un monitor o televisore",
+        "description": "Eseguire Kodi in un container LXC privilegiato su Proxmox VE, rendere accessibili l’iGPU e i dispositivi di input USB dell’host e usare il server come centro multimediale collegato direttamente al televisore."
+      },
+      {
+        "slug": "backup-cloud",
+        "title": "Backup di Proxmox su cloud personale",
+        "description": "Montare con rclone un cloud personale, come Google Drive, Mega, Dropbox o OneDrive, in una directory dell’host Proxmox VE, registrarlo come archivio di backup per vzdump e salvare direttamente VM e container nel cloud, senza uno script di backup aggiuntivo."
+      },
+      {
+        "slug": "lxc-samba",
+        "title": "Aggiungere un disco o una chiavetta USB a LXC e condividerli in rete con Samba",
+        "description": "Rendere accessibile un disco o una chiavetta USB in un container LXC privilegiato su Proxmox VE, installare Samba nel container e condividerne i contenuti in rete."
+      },
+      {
+        "slug": "nvidia-manual",
+        "title": "Installazione dei driver di scheda grafica NVIDIA su Proxmox VE 9 (procedura manuale)",
+        "description": "Installare e configurare manualmente i driver NVIDIA su un host Proxmox VE 9 e rendere la GPU accessibile a uno o più container LXC. Include installazione dei driver, servizio di persistenza, patch NVENC facoltativa e configurazione di ogni container."
+      }
+    ]
+  },
+  "references": {
+    "heading": "Riferimenti ProxMenux",
+    "intro": "Materiale di riferimento rapido dalla documentazione ProxMenux stessa.",
+    "cards": {
+      "glossary": {
+        "title": "Glossario",
+        "description": "Oltre 60 definizioni dei termini tecnici usati in ProxMenux: Proxmox, virtualizzazione, archiviazione, rete e Linux. Consultazione rapida con etichette di categoria e collegamenti."
+      },
+      "helpInfo": {
+        "title": "Aiuto e Info — Catalogo dei comandi",
+        "description": "Una selezione di comandi Linux e Proxmox per argomento, con copia negli appunti. Riprende la guida disponibile nel menu ProxMenux."
+      },
+      "linuxResources": {
+        "title": "Risorse Linux",
+        "description": "Risorse esterne per imparare la riga di comando Linux, le pratiche di sicurezza, gli strumenti di monitoraggio e ZFS, a complemento del catalogo dei comandi ProxMenux."
+      },
+      "externalRepos": {
+        "title": "Repository esterni",
+        "description": "Repository di script di terze parti integrati in ProxMenux come opzioni alternative del menu, come community-scripts/ProxmoxVE."
+      }
+    }
+  },
+  "official": {
+    "heading": "Risorse ufficiali Proxmox",
+    "intro": "Documentazione pubblicata da Proxmox Server Solutions, il riferimento ufficiale per la piattaforma.",
+    "cards": {
+      "pveDocs": {
+        "title": "Documentazione Proxmox VE",
+        "description": "La guida ufficiale di amministrazione: un riferimento completo su installazione, rete, archiviazione, cluster, alta disponibilità e API."
+      },
+      "pbsDocs": {
+        "title": "Documentazione di Proxmox Backup Server",
+        "description": "Documentazione per PBS — backup incrementali, deduplicati, crittografati per Proxmox VE."
+      },
+      "videoTraining": {
+        "title": "Formazione video ufficiale",
+        "description": "Tutorial video e corsi di formazione ufficiali di Proxmox."
+      },
+      "forum": {
+        "title": "Proxmox Forum",
+        "description": "Forum ufficiale della comunità per domande, risoluzione dei problemi e condivisione di esperienze, seguito dai responsabili del progetto."
+      }
+    }
+  },
+  "community": {
+    "heading": "Progetti e risorse comunitarie",
+    "intro": "Progetti open source e raccolte selezionate della comunità Proxmox. Non sono affiliati a Proxmox Server Solutions o a ProxMenux e sono inclusi perché si sono dimostrati utili.",
+    "cards": {
+      "helperScripts": {
+        "title": "Proxmox VE Helper-Scripts",
+        "description": "Catalogo di script mantenuto dalla comunità per distribuire facilmente container LXC, VM e modifiche PVE, ad esempio per Home Assistant, Plex o Frigate. Prosegue l’idea degli helper script di tteck."
+      },
+      "awesome": {
+        "title": "awesome-proxmox-ve (raccolta di risorse selezionate)",
+        "description": "Ampia raccolta di risorse Proxmox VE selezionate dalla comunità: strumenti, librerie, integrazioni, blog e video. Un buon punto di partenza per scoprire altro."
+      }
+    },
+    "suggestRich": "Conosci una risorsa valida da aggiungere? Apri una issue o una PR su <link>GitHub</link>. Vogliamo mantenere una selezione mirata, anziché un elenco esaustivo."
+  },
+  "discussion": {
+    "heading": "Discussione comunitaria",
+    "intro": "Dove la gente parla di Proxmox e ProxMenux.",
+    "cards": {
+      "proxmenuxDiscussions": {
+        "title": "ProxMenux Discussions",
+        "description": "GitHub Discussions dedicato a ProxMenux: idee per nuove funzioni, domande e risposte e condivisione delle configurazioni. Il posto adatto per parlare di menu, Monitor e documentazione."
+      },
+      "proxmoxForum": {
+        "title": "Proxmox Forum",
+        "description": "Forum ufficiale Proxmox (anche collegato sopra). Il posto giusto per risolvere i problemi in profondità e problemi specifici di configurazione."
+      },
+      "reddit": {
+        "title": "r/Proxmox su Reddit",
+        "description": "Subreddit attivo per discussioni, consigli e supporto tecnico. Più accessibile del forum, con risposte spesso più rapide alle domande informali."
+      }
+    }
+  }
+}
diff --git a/web/messages/it/guides/kodi-lxc.json b/web/messages/it/guides/kodi-lxc.json
new file mode 100644
index 00000000..55d05fc5
--- /dev/null
+++ b/web/messages/it/guides/kodi-lxc.json
@@ -0,0 +1,70 @@
+{
+  "meta": {
+    "title": "Installare Kodi in LXC con accelerazione GPU | Guide ProxMenux",
+    "description": "Eseguire Kodi in un container LXC privilegiato su Proxmox VE, rendere accessibili l’iGPU e i dispositivi di input USB dell’host e usare il server come centro multimediale collegato direttamente al televisore.",
+    "ogTitle": "Installare Kodi in LXC con accelerazione GPU",
+    "ogDescription": "Eseguire Kodi in un container LXC privilegiato su Proxmox VE con accesso all’iGPU e ai dispositivi di input USB dell’host e trasformare il server in un centro multimediale."
+  },
+  "header": {
+    "title": "Installare Kodi in LXC con accelerazione GPU e collegarlo a un monitor o televisore",
+    "description": "Eseguire Kodi in un container LXC privilegiato su Proxmox VE, rendere accessibili l’iGPU e i dispositivi di input USB dell’host e usare il server come centro multimediale collegato direttamente al televisore.",
+    "section": "Guide"
+  },
+  "intro": {
+    "calloutTitle": "Attenzione",
+    "calloutBody": "Questa guida usa uno script esterno della comunità per preparare il container Kodi. ProxMenux può configurare l’accesso all’iGPU dell’host: <strong>GPU e Coral-TPU → Aggiungi GPU a LXC</strong> configura <code>/dev/dri</code> e installa i driver nel container. Lo script seguente installa anche Kodi e l’avvio automatico su <code>tty7</code>. Usalo per un centro multimediale LXC già pronto; scegli la <gpuLink>procedura ProxMenux</gpuLink> se serve solo l’accesso alla GPU per un container configurato manualmente.",
+    "credit": "Lo script originale di Kodi per LXC è stato creato da <authorLink>mrrudy</authorLink>.",
+    "stepsTitle": "Cosa farai",
+    "steps": [
+      "Creare un container LXC privilegiato con Kodi tramite lo script.",
+      "Rendere accessibili nel container tastiera, mouse o controller USB.",
+      "Facoltativo: aggiornare Kodi dai repository configurati nel container."
+    ]
+  },
+  "createCt": {
+    "heading": "1. Creare il Kodi LXC",
+    "body": "Per questa procedura seleziona <strong>Privileged</strong> nelle impostazioni avanzate dello script. Per impostazione predefinita crea container non privilegiati, che richiedono permessi sui dispositivi e mappatura degli ID appropriati. Configura l’accesso alla GPU, Kodi e l’avvio automatico su <code>tty7</code>:",
+    "code": "bash -c \"$(wget -qLO - https://raw.githubusercontent.com/mrrudy/proxmoxHelper/main/ct/kodi-v1.sh)\"",
+    "after": "L’installazione richiede un po’ di tempo. Quando Kodi si avvia su <code>tty7</code>, collega il monitor o il televisore all’uscita HDMI/DisplayPort dell’host: dovrebbe comparire l’interfaccia di Kodi."
+  },
+  "addInput": {
+    "heading": "2. Aggiungere tastiera, mouse o controller USB",
+    "body": "I dispositivi di input si trovano in <code>/dev/input/</code> sull’host. Individua il loro numero major:",
+    "listCode": "ls -l /dev/input",
+    "imageAlt": "Elenco dei dispositivi di input",
+    "afterList": "Per i dispositivi a caratteri usa il numero major prima della virgola, nell’esempio <code>13</code>. Sull’host, modifica la configurazione del container Kodi, sostituendo <code>'<'CTID'>'</code> con il suo ID, ad esempio <code>102</code>:",
+    "editCode": "nano /etc/pve/lxc/CTID.conf",
+    "addLines": "Aggiungi le righe seguenti, adattando <code>13</code> al numero rilevato sul <strong>tuo</strong> host:",
+    "configCode": "lxc.cgroup2.devices.allow: c 13:* rwm\nlxc.mount.entry: /dev/input dev/input none bind,optional,create=dir",
+    "imageConfigAlt": "Configurazione LXC",
+    "save": "Salva il file, esci dall’editor con <code>Ctrl+X</code> e riavvia <strong>solo il container</strong>. Non occorre riavviare l’host Proxmox:",
+    "restartCode": "pct reboot CTID",
+    "plug": "Collega tastiera, mouse o controller USB. Kodi dovrebbe rispondere."
+  },
+  "updateKodi": {
+    "heading": "3. Facoltativo: aggiornare Kodi dai repository configurati",
+    "calloutTitle": "Importante",
+    "calloutBody": "Il PPA team-xbmc è <strong>solo per Ubuntu</strong> e Kodi segnala che non è più mantenuto. L’assenza di <code>add-apt-repository</code> non identifica la distribuzione. Controlla <code>cat /etc/os-release</code> e cerca <code>NAME=\"Ubuntu\"</code>; non aggiungere PPA Ubuntu a Debian. I comandi seguenti aggiornano i pacchetti dai repository configurati nel container.",
+    "body": "Nel container (<code>pct enter '<'CTID'>'</code>):",
+    "code": "apt update\napt install --only-upgrade kodi kodi-bin",
+    "after": "Riavvia il container dopo l’aggiornamento. Kodi userà la versione disponibile nei repository configurati, che può differire dall’ultima versione del progetto."
+  },
+  "screenshots": {
+    "heading": "Schermate",
+    "image1Alt": "Interfaccia Kodi 1",
+    "image2Alt": "Interfaccia Kodi 2"
+  },
+  "troubleshoot": {
+    "heading": "Risoluzione dei problemi",
+    "items": [
+      "<strong>Il container Kodi si avvia, ma sul televisore non appare nulla:</strong> potrebbe non avere accesso all’iGPU. Controlla <code>ls /dev/dri</code> nel container: dovrebbero apparire <code>card0</code> e <code>renderD128</code>. Se la directory è vuota, controlla il passthrough GPU o usa <strong>Aggiungi GPU a LXC</strong> in ProxMenux.",
+      "<strong>Tastiera o mouse non rilevati dopo il riavvio:</strong> controlla che <code>/dev/input</code> sia montato e che Kodi possa leggere i dispositivi. Esegui <code>ls -l /dev/input</code> sull’host e nel container e verifica la regola <code>lxc.cgroup2.devices.allow</code>.",
+      "<strong>La riproduzione con accelerazione hardware usa la CPU invece della GPU:</strong> installa o aggiorna i driver VA-API nel container: <code>intel-media-va-driver</code> per le iGPU Intel recenti, <code>i965-va-driver</code> per quelle meno recenti e <code>mesa-va-drivers</code> per AMD.",
+      "<strong><code>add-apt-repository: command not found</code>:</strong> il comando non è installato; questo non dimostra che il container usi Debian. Controlla distribuzione e pacchetti disponibili. Su Debian usa i pacchetti Kodi di Debian senza aggiungere il PPA Ubuntu."
+    ]
+  },
+  "further": {
+    "heading": "Ulteriori informazioni",
+    "konpatRich": "<konpatLink>Articolo di Konpat</konpatLink> per approfondire l’accesso all’iGPU Intel da LXC."
+  }
+}
diff --git a/web/messages/it/guides/lxc-samba.json b/web/messages/it/guides/lxc-samba.json
new file mode 100644
index 00000000..2b41bb07
--- /dev/null
+++ b/web/messages/it/guides/lxc-samba.json
@@ -0,0 +1,119 @@
+{
+  "meta": {
+    "title": "Aggiungere un disco USB a LXC e condividerlo con Samba | ProxMenux",
+    "description": "Rendere accessibile un disco o una chiavetta USB in un container LXC privilegiato su Proxmox VE, installare Samba nel container e condividerne i contenuti in rete.",
+    "ogTitle": "Aggiungere un disco USB a LXC e condividerlo con Samba",
+    "ogDescription": "Rendere accessibile un disco USB in un container LXC privilegiato su Proxmox VE, installare Samba e condividerne il contenuto sulla LAN."
+  },
+  "header": {
+    "title": "Aggiungere un disco o una chiavetta USB a LXC e condividerli in rete con Samba",
+    "description": "Rendere accessibile un disco o una chiavetta USB in un container LXC privilegiato su Proxmox VE, installare Samba nel container e condividerne i contenuti in rete.",
+    "section": "Guide"
+  },
+  "recommended": {
+    "calloutTitle": "Consigliato",
+    "calloutIntro": "ProxMenux offre entrambe le parti della procedura tramite menu guidati:",
+    "items": [
+      "<strong>Gestione dischi → Formatta/cancella disco fisico</strong> per la formattazione.",
+      "<strong>Archiviazione e condivisione → Condivisione di rete LXC → Server Samba in LXC</strong> per l’installazione nel container privilegiato e la configurazione di Samba."
+    ],
+    "calloutOutro": "Le procedure guidate gestiscono i permessi dei container non privilegiati, i profili di condivisione in lettura-scrittura, sola lettura o personalizzati e il gruppo sharedfiles. Questa guida descrive i passaggi manuali per comprenderli o configurarli direttamente."
+  },
+  "intro": {
+    "body": "Un disco o una chiavetta USB può essere utile su un host Proxmox, soprattutto sui mini PC con poche possibilità di espansione interna. Questa guida spiega:",
+    "stepsTitle": "Cosa farai",
+    "steps": [
+      "Collegamento del disco USB a un LXC privilegiato.",
+      "Installare Samba all'interno del contenitore.",
+      "Condivisione del contenuto del disco sulla LAN."
+    ],
+    "useCasesTitle": "Casi di utilizzo",
+    "useCases": [
+      "Archiviare file torrent e renderli disponibili in rete.",
+      "Fornire spazio a un server multimediale come Plex, Jellyfin o Emby.",
+      "Conservare documenti elaborati automaticamente da Paperless.",
+      "Memorizzazione generica in stile NAS per la rete domestica."
+    ],
+    "privilegedCalloutTitle": "Container privilegiato per questa procedura",
+    "privilegedCalloutBody": "Questa procedura usa un container LXC privilegiato con un dispositivo a blocchi come <code>mp0</code>. Per un container non privilegiato puoi montare il filesystem sull’host e condividerne la directory tramite bind mount, con permessi e mappatura degli ID appropriati. Vedi <strong>Archiviazione e condivisione → Punti di montaggio LXC</strong> in ProxMenux."
+  },
+  "attach": {
+    "heading": "1. Collegare il disco USB a LXC",
+    "identifyHeading": "1.1 Identificare il dispositivo",
+    "identifyBody": "Confronta l’elenco dei dischi <strong>prima</strong> e <strong>dopo</strong> il collegamento USB. Il nuovo dispositivo è il disco da usare.",
+    "beforeLabel": "Prima:",
+    "afterLabel": "Dopo:",
+    "imageBeforeAlt": "Lista disco prima di aggiungere l'unità USB",
+    "imageAfterAlt": "Lista disco dopo aver aggiunto l'unità USB",
+    "lsblkBody": "Puoi anche usare <code>lsblk -o NAME,SIZE,MODEL,SERIAL</code> per elencare i dispositivi a blocchi con modello e numero di serie.",
+    "stableCalloutTitle": "Importante — utilizzare un identificatore stabile",
+    "stableCalloutBody": "Il nome <code>/dev/sdb1</code> può cambiare dopo un riavvio, soprattutto con più dischi USB. Cerca l’identificatore persistente:",
+    "stableCalloutCode": "ls -l /dev/disk/by-id/",
+    "stableCalloutAfter": "Usa nella configurazione LXC la voce <code>/dev/disk/by-id/usb-...</code> della partizione scelta, al posto di <code>/dev/sdb1</code>. Scegli la partizione, non l’intero disco: resterà identificabile se cambia l’ordine dei dispositivi.",
+    "formatHeading": "1.2 Formattare il disco",
+    "formatBody": "ext4 è adatto alle condivisioni Linux: distingue maiuscole e minuscole e supporta ACL POSIX e file grandi. La formattazione distrugge il contenuto del filesystem esistente. Verifica la partizione ed esegui il comando sull’<strong>host Proxmox</strong>:",
+    "formatCode": "mkfs.ext4 /dev/sdb1",
+    "formatAfter": "Sostituisci <code>/dev/sdb1</code> con la partizione effettiva o il suo percorso persistente <code>/dev/disk/by-id/usb-...-part1</code>.",
+    "mkdirHeading": "1.3 Creare il punto di montaggio nel container LXC",
+    "mkdirBody": "All'interno del LXC, creare la directory in cui apparirà il disco (qualsiasi nome funziona):",
+    "mkdirCode": "mkdir /mnt/lxc_USB",
+    "wireHeading": "1.4 Configurare il dispositivo in LXC",
+    "wireBody": "Sull’<strong>host Proxmox</strong>, modifica la configurazione del container. Sostituisci <code>'<'CTID'>'</code> con il suo ID:",
+    "wireEditCode": "nano /etc/pve/lxc/CTID.conf",
+    "wireAddLine": "Aggiungi questa linea:",
+    "wireConfigCode": "mp0: /dev/disk/by-id/usb-VENDOR_MODEL_SERIAL-part1,mp=/mnt/lxc_USB,backup=0",
+    "wireShortForm": "Puoi anche usare la voce breve <code>mp0: /dev/sdb1,mp=/mnt/lxc_USB,backup=0</code> se accetti il rischio che il percorso del dispositivo cambi.",
+    "wireBackupNote": "L’esempio usa <code>backup=0</code>. I contenuti dei montaggi di dispositivi e dei bind mount non sono inclusi nei backup <code>vzdump</code> del container. Prevedi un backup separato dei dati sul disco esterno.",
+    "restartHeading": "1.5 Riavviare il LXC e impostare le autorizzazioni",
+    "restartBody": "Riavviare il CT per applicare il punto di montaggio:",
+    "restartCode": "pct reboot CTID",
+    "permsBody": "Nel container LXC crea l’account della condivisione prima di assegnargli la proprietà, poi imposta i permessi della directory:",
+    "permsCode": "adduser --system --group --no-create-home --shell /usr/sbin/nologin proxmenux\nmkdir -p /mnt/lxc_USB\nchown -R proxmenux:proxmenux /mnt/lxc_USB\nchmod 770 /mnt/lxc_USB",
+    "permsNoteTitle": "Nota",
+    "permsNote": "Sostituisci <code>proxmenux</code> con il nome scelto. Il modo <code>770</code> consente l’accesso a proprietario e gruppo, escludendo gli altri; è più restrittivo di <code>chmod -R 777</code>. L’account viene creato qui e registrato in Samba al punto 2.2."
+  },
+  "samba": {
+    "heading": "2. Installare Samba",
+    "installHeading": "2.1 Installare il pacchetto all'interno del LXC",
+    "installCode": "apt-get update\napt-get install -y samba",
+    "confirmBody": "Confermare il servizio in esecuzione:",
+    "confirmCode": "systemctl status smbd.service",
+    "userHeading": "2.2 Verificare l’utente della condivisione",
+    "userBody": "L’account di sistema <code>proxmenux</code> è stato creato senza shell di accesso al punto 1.5. Verificalo prima di impostare la password Samba e usa sempre il nome scelto:",
+    "userCode": "id proxmenux",
+    "passwordBody": "Imposta la password Samba, separata da quella di sistema: Samba mantiene un proprio archivio di credenziali.",
+    "passwordCode": "smbpasswd -a proxmenux",
+    "aclHeading": "2.3 Impostare proprietà e ACL",
+    "aclBody": "Se il <code>chown</code> del punto 1.5 è sufficiente, i permessi sono pronti. Per più utenti con diritti diversi sullo stesso percorso puoi usare le ACL:",
+    "aclCode": "apt-get install -y acl\nsetfacl -R -m \"u:proxmenux:rwx\" /mnt/lxc_USB\nsetfacl -d -R -m \"u:proxmenux:rwx\" /mnt/lxc_USB    # default ACL — applies to new files"
+  },
+  "configure": {
+    "heading": "3. Configurare la condivisione Samba",
+    "editHeading": "3.1 Modifica smb.conf",
+    "editCode": "nano /etc/samba/smb.conf",
+    "appendBody": "Aggiungi una definizione della condivisione alla fine del file:",
+    "shareCode": "[lxc_usb]\n    comment = Shared USB storage\n    path = /mnt/lxc_USB\n    read only = no\n    writable = yes\n    browseable = yes\n    guest ok = no\n    valid users = proxmenux\n    create mask = 0660\n    directory mask = 0770",
+    "validUsersNoteTitle": "Nota",
+    "validUsersNote": "La linea <code>valid users = proxmenux</code> limita l'accesso a quel singolo utente Samba. Per l'accesso basato su gruppo, utilizzare <code>valid users = @samba_users</code> dopo aver aggiunto l'utente(i) a un gruppo chiamato <code>samba_users</code>.",
+    "reloadHeading": "3.2 Ricaricare Samba",
+    "reloadCode": "systemctl restart smbd"
+  },
+  "verify": {
+    "heading": "4. Verificare l'accesso",
+    "body": "Da qualsiasi client LAN, navigare in <code>\\\\'<'CT_IP'>'</code> (Windows) o <code>smb://'<'CT_IP'>'</code> (macOS / Linux file manager). Autentica con l'utente Samba (<code>proxmenux</code>) e la password impostata con <code>smbpasswd</code>.",
+    "image1Alt": "Accesso server Samba da un client",
+    "image2Alt": "Richiesta di autenticazione Samba",
+    "usageBody": "Puoi usare la condivisione sia nel container sia attraverso la rete:",
+    "image3Alt": "Uso del disco USB tramite la condivisione"
+  },
+  "troubleshoot": {
+    "heading": "Risoluzione dei problemi",
+    "items": [
+      "<strong><code>pct reboot</code> segnala “device not found”:</strong> verifica che il percorso in <code>mp0</code> esista sull’host. Controlla <code>ls -l /dev/disk/by-id/</code> e correggi il percorso.",
+      "<strong>Il container si avvia, ma <code>/mnt/lxc_USB</code> è vuoto:</strong> il disco potrebbe non essere montato oppure il filesystem è vuoto. Controlla dall’host con <code>pct exec '<'CTID'>' -- mount | grep lxc_USB</code>. Se il montaggio manca, verifica configurazione, percorso del dispositivo ed errori di avvio.",
+      "<strong>L’autenticazione Samba riesce, ma la scrittura segnala “Permission denied”:</strong> controlla i permessi Linux della directory e le impostazioni di scrittura della condivisione. Rivedi <code>chown</code> e <code>setfacl</code> nelle sezioni 1.5 e 2.3.",
+      "<strong>La condivisione non compare, ma <code>smb://'<'ip'>'/lxc_usb</code> funziona:</strong> il vecchio rilevamento NetBIOS usa <code>nmbd</code>. Windows moderno usa WS-Discovery: su Debian 12 installa <code>apt-get install -y wsdd</code>; su Debian 13, dove <code>wsdd</code> non è nell’archivio stabile, usa <code>apt-get install -y wsdd2</code>. Controlla servizio e firewall. Attivare solo <code>nmbd</code> non fornisce WS-Discovery.",
+      "<strong>Per aggiungere un altro utente alla condivisione:</strong> crea l’account con <code>adduser</code>, registralo con <code>smbpasswd -a</code> e aggiungilo all’elenco <code>valid users =</code>, separato da virgole. Assegna anche i permessi o le ACL necessari sul filesystem."
+    ]
+  }
+}
diff --git a/web/messages/it/guides/nvidia-manual.json b/web/messages/it/guides/nvidia-manual.json
new file mode 100644
index 00000000..5f48b799
--- /dev/null
+++ b/web/messages/it/guides/nvidia-manual.json
@@ -0,0 +1,165 @@
+{
+  "meta": {
+    "title": "Installazione dei driver NVIDIA su Proxmox VE 9 (procedura manuale) | Guide ProxMenux",
+    "description": "Installare e configurare manualmente i driver NVIDIA su un host Proxmox VE 9 e rendere la GPU accessibile a uno o più container LXC. Include installazione dei driver, servizio di persistenza, patch NVENC facoltativa e configurazione di ogni container.",
+    "ogTitle": "Installazione dei driver NVIDIA su Proxmox VE 9 (procedura manuale)",
+    "ogDescription": "Installazione manuale NVIDIA su PVE 9: driver host, servizio di persistenza, patch NVENC facoltativa e accesso alla GPU per ogni container LXC."
+  },
+  "header": {
+    "title": "Installazione dei driver di scheda grafica NVIDIA su Proxmox VE 9 (procedura manuale)",
+    "description": "Installare e configurare manualmente i driver NVIDIA su un host Proxmox VE 9 e rendere la GPU accessibile a uno o più container LXC. Include installazione dei driver, servizio di persistenza, patch NVENC facoltativa e configurazione di ogni container.",
+    "section": "Guide"
+  },
+  "intro": {
+    "calloutTitle": "Nota",
+    "calloutBody": "Questa procedura manuale resta come riferimento. Per la maggior parte degli utenti è consigliato l’assistente ProxMenux: <strong>Installa driver NVIDIA sull’host</strong> in <em>GPU e Coral-TPU</em>, quindi <strong>Aggiungi GPU a LXC</strong> o <strong>Aggiungi GPU a VM</strong> per configurare l’ospite. L’assistente esegue gli stessi passaggi con controlli aggiuntivi su header del kernel, IOMMU e conflitti VFIO. Questa pagina aiuta a capire ogni comando o ad adattare la configurazione.",
+    "targetNote": "Destinato a <strong>Proxmox VE 9</strong> (Debian Trixie). PVE 7 (Bullseye) e PVE 8 (Bookworm) non sono più coperti.",
+    "stepsTitle": "Cosa farai",
+    "steps": [
+      "Preparare l’host Proxmox VE 9: bloccare nouveau e verificare repository e prerequisiti.",
+      "Installare il driver NVIDIA sull'host.",
+      "Installare il servizio di persistenza NVIDIA.",
+      "Facoltativo: applicare la patch keylase per rimuovere il limite di sessioni NVENC simultanee sulle GPU consumer.",
+      "Rendere la GPU accessibile a uno o più container LXC e installare in ognuno la versione corrispondente del driver."
+    ]
+  },
+  "prepareHost": {
+    "heading": "1. Preparare l'host (PVE 9)",
+    "blacklistHeading": "1.1 Bloccare nouveau",
+    "blacklistBody": "Controlla se il driver open source <code>nouveau</code> è già bloccato:",
+    "blacklistCheckCode": "cat /etc/modprobe.d/blacklist.conf",
+    "blacklistAdd": "Se <code>blacklist nouveau</code> non appare, aggiungerlo e riavviare:",
+    "blacklistAddCode": "echo \"blacklist nouveau\" >> /etc/modprobe.d/blacklist.conf\nupdate-initramfs -u -k all\nreboot",
+    "blacklistImageAlt": "Controllo della lista nera",
+    "reposHeading": "1.2 Verificare i repository (PVE 9 / Trixie)",
+    "reposBody": "Gli strumenti di post-installazione potrebbero aver già configurato i repository. Controlla prima le fonti esistenti e salta le modifiche già presenti, senza duplicare le voci.",
+    "reposOtherwise": "Altrimenti, su una nuova installazione PVE 9 senza abbonamento Enterprise:",
+    "reposEditCode": "nano /etc/apt/sources.list.d/proxmox.sources",
+    "reposPveBody": "Assicurarsi che contenga la fonte di non abbonamento per Trixie:",
+    "reposPveCode": "Types: deb\nURIs: http://download.proxmox.com/debian/pve\nSuites: trixie\nComponents: pve-no-subscription\nSigned-By: /usr/share/keyrings/proxmox-archive-keyring.gpg",
+    "reposDebianBody": "E le fonti Debian a <code>/etc/apt/sources.list.d/debian.sources</code>:",
+    "reposDebianCode": "Types: deb\nURIs: http://deb.debian.org/debian/\nSuites: trixie trixie-updates\nComponents: main contrib non-free non-free-firmware\nSigned-By: /usr/share/keyrings/debian-archive-keyring.gpg\n\nTypes: deb\nURIs: http://security.debian.org/debian-security/\nSuites: trixie-security\nComponents: main contrib non-free non-free-firmware\nSigned-By: /usr/share/keyrings/debian-archive-keyring.gpg",
+    "updateHeading": "1.3 Aggiornare il sistema e installare prerequisiti",
+    "updateCode": "apt update && apt dist-upgrade -y",
+    "buildToolsBody": "Installare gli strumenti di compilazione e le intestazioni del kernel necessari per compilare il modulo del kernel NVIDIA:",
+    "buildToolsCode": "apt-get install -y git\napt-get install -qqy pve-headers-$(uname -r) gcc make"
+  },
+  "installDriver": {
+    "heading": "2. Installare il driver NVIDIA sull'host",
+    "pickHeading": "2.1 Scegli una versione del driver",
+    "pickBody": "Scegli un ramo del driver compatibile con GPU e kernel in uso. Il più recente potrebbe non supportare le vecchie GPU: controlla l’elenco dei prodotti della versione NVIDIA scelta.",
+    "pickUrlCode": "https://download.nvidia.com/XFree86/Linux-x86_64/latest.txt",
+    "nvencCallout": "Se si prevede di applicare la patch NVENC (step 4), verificare che la patch supporta prima la versione del driver scelto: <patchLink>github.com/keylase/nvidia-patch</patchLink>",
+    "nvencCalloutTitle": "Attenzione",
+    "pickReplace": "Sostituisci <code>latest.txt</code> nell’URL con il numero di versione per trovare il programma di installazione con estensione <code>.run</code>. Elenco completo dei driver:",
+    "pickListCode": "https://download.nvidia.com/XFree86/Linux-x86_64/",
+    "pickImageAlt": "Scarica il driver NVIDIA",
+    "pickVersionNote": "Durante il resto di questa guida, sostituire <code>'<'VERSION'>'</code> con la versione attuale (ad esempio <code>580.95.05</code>).",
+    "downloadHeading": "2.2 Scaricare ed eseguire l'installatore",
+    "downloadCode": "mkdir -p /opt/nvidia\ncd /opt/nvidia\nwget https://download.nvidia.com/XFree86/Linux-x86_64/VERSION/NVIDIA-Linux-x86_64-VERSION.run\nchmod +x NVIDIA-Linux-x86_64-VERSION.run",
+    "firstPassBody": "Esegui il programma di installazione. L’opzione seguente può disattivare <code>nouveau</code> se necessario; potrebbe servire un riavvio prima di completare l’installazione:",
+    "firstPassCode": "./NVIDIA-Linux-x86_64-VERSION.run --no-questions --ui=none --disable-nouveau\nreboot",
+    "secondPassBody": "Dopo il ritorno dell'host, eseguire nuovamente l'installatore per compilare e installare il modulo del kernel:",
+    "secondPassCode": "/opt/nvidia/NVIDIA-Linux-x86_64-VERSION.run --no-questions --ui=none",
+    "modulesHeading": "2.3 Carica moduli NVIDIA all'avvio",
+    "modulesBody": "Modifica la configurazione di caricamento dei moduli:",
+    "modulesEditCode": "nano /etc/modules-load.d/modules.conf",
+    "modulesAddBody": "Aggiungi i moduli NVIDIA per host e LXC. I moduli VFIO servono al passthrough verso le VM e non sono necessari qui:",
+    "modulesAddCode": "nvidia\nnvidia_uvm",
+    "modulesSaveBody": "Salvare (<code>Ctrl+X</code>) e ricostruire initramfs:",
+    "modulesSaveCode": "update-initramfs -u -k all",
+    "udevHeading": "2.4 Creare regole di udev",
+    "udevBody": "Per creare i nodi dei dispositivi <code>/dev/nvidia*</code> al caricamento dei moduli:",
+    "udevEditCode": "nano /etc/udev/rules.d/70-nvidia.rules",
+    "udevRulesCode": "# /etc/udev/rules.d/70-nvidia.rules\nKERNEL==\"nvidia\", RUN+=\"/bin/bash -c '/usr/bin/nvidia-smi -L'\"\nKERNEL==\"nvidia_uvm\", RUN+=\"/bin/bash -c '/usr/bin/nvidia-modprobe -c0 -u'\"",
+    "udevSaveBody": "Salvare (<code>Ctrl+X</code>)."
+  },
+  "persistence": {
+    "heading": "3. Servizio di persistenza NVIDIA",
+    "body": "Il servizio di persistenza mantiene inizializzata la GPU quando nessun’altra applicazione la usa. Riduce la latenza di reinizializzazione e conserva lo stato di inizializzazione tra i client:",
+    "installCode": "cd /opt/nvidia\ngit clone https://github.com/NVIDIA/nvidia-persistenced.git\ncd nvidia-persistenced/init\n./install.sh\nreboot",
+    "verifyBody": "Dopo il riavvio verifica che il driver sia caricato e il servizio attivo:",
+    "verifySmiCode": "nvidia-smi",
+    "smiImageAlt": "Uscita NVIDIA SMI",
+    "verifyServiceCode": "systemctl status nvidia-persistenced",
+    "serviceImageAlt": "Stato del servizio di persistenza NVIDIA"
+  },
+  "nvenc": {
+    "heading": "4. Facoltativo: rimuovere il limite di sessioni NVENC simultanee",
+    "body": "Il limite di sessioni NVENC dipende da GPU e versione del driver. Consulta la matrice NVIDIA, senza presumere un numero per generazione. La patch keylase rimuove il limite software nei driver supportati e può aiutare nella transcodifica Plex o Jellyfin.",
+    "code": "cd /opt/nvidia\ngit clone https://github.com/keylase/nvidia-patch.git\ncd nvidia-patch\n./patch.sh",
+    "imageAlt": "Applicazione patch NVIDIA",
+    "after": "Riapplica la patch dopo ogni aggiornamento del driver. Il repository keylase include anche <code>patch-fbc.sh</code> per FBC, la cattura del framebuffer."
+  },
+  "lxcSetup": {
+    "heading": "5. Configurare l’accesso alla GPU in un container LXC",
+    "identifyHeading": "5.1 Identificare i numeri del dispositivo",
+    "identifyBody": "Sull'host:",
+    "identifyCode": "ls -l /dev/nv*",
+    "identifyImageAlt": "Elenco dei dispositivi NVIDIA",
+    "identifyNote": "Annota i numeri major dei dispositivi: possono variare tra sistemi. Valori tipici:",
+    "tableHeaders": {
+      "device": "Dispositivo",
+      "major": "Numero major tipico"
+    },
+    "tableRows": [
+      {
+        "device": "<code>/dev/nvidia0</code>, <code>/dev/nvidiactl</code>",
+        "major": "195"
+      },
+      {
+        "device": "<code>/dev/nvidia-uvm</code>, <code>/dev/nvidia-uvm-tools</code>",
+        "major": "509 (variabile)"
+      },
+      {
+        "device": "<code>/dev/dri/*</code>",
+        "major": "226"
+      },
+      {
+        "device": "<code>/dev/nvidia-modeset</code>",
+        "major": "195 (condiviso con nvidia)"
+      }
+    ],
+    "editHeading": "5.2 Modificare la configurazione LXC",
+    "editBody": "Arresta il container se è in esecuzione. Apri la configurazione sostituendo <code>'<'CTID'>'</code> con il suo ID:",
+    "editCode": "nano /etc/pve/lxc/CTID.conf",
+    "editConfigBody": "Commenta solo le righe <code>lxc.cgroup2.devices.allow</code> o <code>/dev/dri</code> effettivamente in conflitto. Aggiungi la configurazione NVIDIA e adatta i numeri major ai dispositivi NVIDIA mostrati da <code>ls -l /dev/nv*</code> sul <strong>tuo</strong> host:",
+    "editConfigCode": "lxc.cgroup2.devices.allow: c 195:* rwm\nlxc.cgroup2.devices.allow: c 509:* rwm\nlxc.mount.entry: /dev/nvidia0 dev/nvidia0 none bind,optional,create=file\nlxc.mount.entry: /dev/nvidiactl dev/nvidiactl none bind,optional,create=file\nlxc.mount.entry: /dev/nvidia-uvm dev/nvidia-uvm none bind,optional,create=file\nlxc.mount.entry: /dev/nvidia-modeset dev/nvidia-modeset none bind,optional,create=file\nlxc.mount.entry: /dev/nvidia-uvm-tools dev/nvidia-uvm-tools none bind,optional,create=file",
+    "editConfigImageAlt": "Configurazione LXC",
+    "editSave": "Salvare (<code>Ctrl+X</code>) e avviare il contenitore.",
+    "installCtHeading": "5.3 Installare il driver all'interno del contenitore",
+    "installCtCalloutTitle": "Importante",
+    "installCtCalloutBody": "Questa parte va eseguita <strong>nel container</strong>, non sull’host.",
+    "installCtBody": "Il modulo del kernel è già caricato sull’host. Il container richiede solo le librerie nello spazio utente della stessa versione del driver:",
+    "installCtCode": "mkdir -p /opt/nvidia\ncd /opt/nvidia\nwget https://download.nvidia.com/XFree86/Linux-x86_64/VERSION/NVIDIA-Linux-x86_64-VERSION.run\nchmod +x NVIDIA-Linux-x86_64-VERSION.run\n./NVIDIA-Linux-x86_64-VERSION.run --no-kernel-module",
+    "installCtAfter": "Leggi le richieste e limita l’installazione alle librerie nello spazio utente. Non compilare né installare moduli del kernel nel container LXC.",
+    "installCtImageAlt": "Installazione driver NVIDIA",
+    "verifyCtHeading": "5.4 Verifica all'interno del contenitore",
+    "verifyCtSmiCode": "nvidia-smi",
+    "verifyCtSmiImageAlt": "NVIDIA SMI in LXC",
+    "verifyCtLsCode": "ls -l /dev/nv*",
+    "verifyCtLsImageAlt": "Dispositivi NVIDIA in LXC",
+    "verifyCtAfter": "La GPU dovrebbe comparire nell’elenco e i nodi dei dispositivi nel filesystem del container.",
+    "workloadHeading": "5.5 Verificare l’uso della GPU con un carico reale",
+    "workloadBody": "Attiva l’accelerazione NVIDIA in Plex o Jellyfin, avvia una transcodifica e verifica l’uso effettivo della GPU nella dashboard o nei log. Installare il driver non la abilita automaticamente nell’applicazione.",
+    "workloadImage1Alt": "Plex usando NVIDIA GPU",
+    "workloadImage2Alt": "Plex con NVIDIA GPU - sessione attiva",
+    "repeatNote": "Ripeti la <strong>sezione 5</strong> per ogni altro container che richiede la GPU. Quando aggiorni il driver host, mantieni allineate le librerie nello spazio utente di tutti i container."
+  },
+  "docker": {
+    "heading": "6. (opzionale) NVIDIA Docker all'interno di un LXC",
+    "body": "Se Docker è già installato nel container LXC, installa al suo interno <code>nvidia-container-toolkit</code> per dare accesso alla GPU ai container Docker. L’accesso alla GPU da LXC deve già funzionare. Questi comandi riguardano Docker eseguito come root:",
+    "code": "apt-get update\napt-get install -y ca-certificates curl gnupg\ncurl -fsSL https://nvidia.github.io/libnvidia-container/gpgkey | gpg --dearmor --yes -o /usr/share/keyrings/nvidia-container-toolkit-keyring.gpg\ncurl -fsSL https://nvidia.github.io/libnvidia-container/stable/deb/nvidia-container-toolkit.list | sed 's#deb https://#deb [signed-by=/usr/share/keyrings/nvidia-container-toolkit-keyring.gpg] https://#g' > /etc/apt/sources.list.d/nvidia-container-toolkit.list\napt-get update\napt-get install -y nvidia-container-toolkit\nnvidia-ctk runtime configure --runtime=docker\nsystemctl restart docker",
+    "after": "I comandi configurano il repository NVIDIA, installano il toolkit, configurano il runtime Docker e riavviano Docker. Restano validi i permessi dei dispositivi e i limiti cgroup di LXC: verifica la GPU con un carico di prova."
+  },
+  "troubleshoot": {
+    "heading": "Risoluzione dei problemi",
+    "items": [
+      "<strong><code>nvidia-smi</code> funziona sull’host, ma segnala “No devices found” nel container:</strong> controlla montaggi, permessi e versioni delle librerie. Se differiscono, installa nel container la stessa <code>'<'VERSION'>'</code> dell’host con <code>--no-kernel-module</code>.",
+      "<strong>La compilazione del driver fallisce:</strong> consulta il log. “No precompiled kernel interface was found” può semplicemente indicare che serve la compilazione locale. Installa gli header corrispondenti a <code>uname -r</code> con <code>apt-get install pve-headers-$(uname -r)</code> o il pacchetto proxmox-headers equivalente.",
+      "<strong>Le sessioni NVENC restano limitate:</strong> verifica che la patch supporti il driver attivo. Un aggiornamento può sovrascriverla. Per una versione compatibile riapplica <code>./patch.sh</code> da <code>/opt/nvidia/nvidia-patch</code> e controlla l’output.",
+      "<strong>La GPU smette di rispondere dopo l’inattività:</strong> controlla <code>systemctl status nvidia-persistenced</code> e abilita il servizio se previsto. Esamina anche i log del kernel e del driver: non è l’unica causa possibile.",
+      "<strong>Il container si avvia, ma <code>ls /dev/nv*</code> non mostra dispositivi NVIDIA:</strong> controlla bind mount e percorsi sull’host. Usa <code>ls -l /dev/nv*</code> per verificare i numeri major NVIDIA, poi controlla le regole <code>lxc.cgroup2.devices.allow</code> e i permessi."
+    ]
+  }
+}
diff --git a/web/messages/pt/common.json b/web/messages/pt/common.json
new file mode 100644
index 00000000..a7cb872c
--- /dev/null
+++ b/web/messages/pt/common.json
@@ -0,0 +1,254 @@
+{
+  "site": {
+    "name": "ProxMenux",
+    "tagline": "Menu interativo e painel web para o Proxmox VE"
+  },
+  "nav": {
+    "home": "Início",
+    "docs": "Documentação",
+    "documentation": "Documentação",
+    "guides": "Guias",
+    "changelog": "Histórico de alterações",
+    "github": "GitHub",
+    "rss": "RSS",
+    "rssTitle": "Feed RSS",
+    "menuOpen": "Abrir menu"
+  },
+  "footer": {
+    "sponsorHeading": "Apoiar o projeto",
+    "sponsorBody": "Se quiser apoiar o projeto.",
+    "sponsorAlt": "Apoie-me no Ko-fi",
+    "connectHeading": "Comunidade",
+    "connectBody": "Participe nas discussões da comunidade no GitHub para obter ajuda, partilhar ideias e contribuir para o projeto. Todas as ideias são bem-vindas!",
+    "joinDiscussion": "Participar na discussão",
+    "copyrightPrefix": "ProxMenux, um projeto colaborativo e de código aberto criado por",
+    "copyrightSuffix": "."
+  },
+  "language": {
+    "switcher": "Idioma",
+    "en": "English",
+    "es": "Español",
+    "sk": "Slovenčina",
+    "de": "Deutsch",
+    "fr": "Français",
+    "it": "Italiano",
+    "pt": "Português",
+    "sv": "Svenska"
+  },
+  "resources": {
+    "documentation": {
+      "title": "Documentação",
+      "description": "Descrição do sistema e guias de utilização"
+    },
+    "changelog": {
+      "title": "Histórico de alterações",
+      "description": "Informações sobre as últimas atualizações"
+    },
+    "guides": {
+      "title": "Guias",
+      "description": "Tutoriais e guias passo a passo para tarefas comuns"
+    },
+    "github": {
+      "title": "Repositório do GitHub",
+      "description": "Explore o código-fonte."
+    }
+  },
+  "docSidebar": {
+    "documentation": "Documentação",
+    "items": {
+      "introduction": "Introdução",
+      "installation": "Instalação",
+      "proxmenuxMonitor": "ProxMenux Monitor",
+      "monitorOverview": "Visão geral",
+      "architecture": "Arquitetura",
+      "accessAuth": "Acesso e autenticação",
+      "dashboard": "Painel",
+      "dashboardSystemOverview": "Separador Visão geral do sistema",
+      "dashboardApps": "Separador Aplicações",
+      "dashboardStorage": "Separador Armazenamento",
+      "dashboardNetwork": "Separador Rede",
+      "dashboardVmsLxcs": "Separador VM e LXC",
+      "dashboardVmsLxcsApp": "Aplicação",
+      "dashboardVmsLxcsUpdates": "Atualizações",
+      "dashboardHardware": "Separador Hardware",
+      "dashboardSystemLogs": "Separador Registos do sistema",
+      "dashboardTerminal": "Separador Terminal",
+      "dashboardSecurity": "Separador Segurança",
+      "dashboardSettings": "Separador Definições",
+      "healthMonitor": "Monitor de estado",
+      "auditReport": "Auditoria e relatórios",
+      "auditReportOverview": "Visão geral",
+      "auditReportAssessment": "Avaliação e inventário",
+      "auditReportPolicy": "Política",
+      "auditReportChanges": "Alterações",
+      "auditReportReports": "Relatórios e comparações",
+      "auditReportScope": "Âmbito e garantias",
+      "notifications": "Notificações",
+      "aiAssistant": "Assistente de IA",
+      "apiReference": "Referência da API",
+      "integrations": "Integrações",
+      "ociManager": "OCI manager Apps",
+      "ociOverview": "Visão geral",
+      "ociArchitecture": "Como é adaptada uma imagem OCI",
+      "ociCustomImage": "Imagem fora do catálogo",
+      "ociStorageNetwork": "Dados, caminhos e rede",
+      "ociHardware": "Dispositivos e aceleração",
+      "ociStacks": "Aplicações com vários contentores",
+      "ociLifecycle": "Instalar, atualizar e modificar",
+      "ociMonitor": "No ProxMenux Monitor",
+      "proxmenuxScripts": "ProxMenux Scripts",
+      "postInstallScript": "Script de pós-instalação",
+      "postInstallOverview": "Visão geral",
+      "postInstallAutomated": "Automático",
+      "postInstallCustomizable": "Personalizável",
+      "postInstallBasicSettings": "Definições básicas",
+      "postInstallSystem": "Sistema",
+      "postInstallVirtualization": "Virtualização",
+      "postInstallNetwork": "Rede",
+      "postInstallStorage": "Armazenamento",
+      "postInstallSecurity": "Segurança",
+      "postInstallCustomization": "Personalização",
+      "postInstallMonitoring": "Monitorização",
+      "postInstallPerformance": "Desempenho",
+      "postInstallOptional": "Opcional",
+      "postInstallUpdates": "Aplicar as atualizações disponíveis",
+      "postInstallUninstall": "Remover otimizações",
+      "gpusCoralTpu": "GPU e Coral TPU",
+      "nvidiaHost": "Instalar controladores NVIDIA no host",
+      "coralHost": "Instalar Coral TPU no host",
+      "addGpuLxc": "Disponibilizar uma GPU num LXC",
+      "addCoralLxc": "Disponibilizar Coral TPU num LXC",
+      "addGpuVm": "Atribuir uma GPU a uma VM (passthrough)",
+      "switchGpuMode": "Alterar o modo da GPU (VM ↔ LXC)",
+      "createVm": "Criar uma VM",
+      "createVmOverview": "Visão geral",
+      "createVmSystemNas": "Sistemas NAS",
+      "createVmSynology": "VM Synology",
+      "createVmNasOthers": "Outros sistemas NAS",
+      "createVmSystemWindows": "Sistemas Windows",
+      "createVmSystemLinux": "Sistemas Linux",
+      "diskManager": "Gestor de discos",
+      "diskManagerOverview": "Visão geral",
+      "diskImportVm": "Importar um disco para uma VM",
+      "diskImportImageVm": "Importar uma imagem de disco para uma VM",
+      "diskAddController": "Adicionar um controlador ou dispositivo NVMe a uma VM",
+      "diskImportLxc": "Importar um disco para um LXC",
+      "diskFormat": "Formatar ou apagar um disco físico",
+      "diskSmart": "Estado SMART e testes do disco",
+      "storageShareManager": "Gestor de armazenamento e partilhas",
+      "storageShareOverview": "Visão geral",
+      "hostStorage": "Integração de armazenamento no host",
+      "hostNfs": "Adicionar uma partilha NFS como armazenamento do Proxmox",
+      "hostSamba": "Adicionar uma partilha Samba como armazenamento do Proxmox",
+      "hostIscsi": "Adicionar um destino iSCSI como armazenamento do Proxmox",
+      "hostLocalDisk": "Adicionar um disco local como armazenamento do Proxmox",
+      "hostLocalShared": "Criar um diretório partilhado no host",
+      "lxcMountPoints": "Pontos de montagem LXC (host ↔ CT)",
+      "lxcNetworkSharing": "Partilhas de rede em LXC",
+      "lxcNfsClient": "Cliente NFS em LXC",
+      "lxcSambaClient": "Cliente Samba em LXC",
+      "lxcNfsServer": "Servidor NFS em LXC",
+      "lxcSambaServer": "Servidor Samba em LXC",
+      "network": "Rede",
+      "networkOverview": "Visão geral",
+      "networkDiagnostics": "Diagnóstico",
+      "networkMonitoring": "Ferramentas de monitorização em tempo real",
+      "networkBridge": "Análise e reparação de bridges de rede",
+      "networkConfig": "Análise e limpeza da configuração",
+      "networkPersistent": "Nomes persistentes das interfaces",
+      "networkBackup": "Cópia de segurança e reinício das interfaces",
+      "security": "Segurança",
+      "securityOverview": "Visão geral",
+      "securityFail2ban": "Fail2Ban",
+      "securityLynis": "Lynis",
+      "utilities": "Utilitários",
+      "utilsOverview": "Visão geral",
+      "utilsUupDump": "Criação de ISO com UUP Dump",
+      "utilsSystemUtils": "Instalação de utilitários do sistema",
+      "utilsSystemUpdate": "Atualização do sistema Proxmox",
+      "utilsUpgradePve": "Atualizar do PVE 8 para o PVE 9",
+      "utilsExportVm": "Exportar uma VM para OVA/OVF",
+      "utilsImportVm": "Importar uma VM a partir de OVA/OVF",
+      "settingsProxmenux": "Definições do ProxMenux",
+      "settingsOverview": "Visão geral",
+      "settingsMonitor": "ProxMenux Monitor",
+      "settingsBeta": "Alterar o canal de versões",
+      "settingsVersion": "Mostrar informações da versão",
+      "settingsUninstall": "Desinstalar o ProxMenux",
+      "commandsReference": "Referência de comandos",
+      "commandsOverview": "Visão geral",
+      "commandsSystem": "Comandos úteis do sistema",
+      "commandsVmCt": "Gestão de VM e CT",
+      "commandsStorage": "Armazenamento e discos",
+      "commandsNetwork": "Comandos de rede",
+      "commandsUpdates": "Atualizações e pacotes",
+      "commandsGpu": "Passthrough de GPU",
+      "commandsZfs": "Gestão do ZFS",
+      "commandsBackup": "Cópia de segurança e restauro",
+      "commandsTools": "Ferramentas de sistema para a linha de comandos",
+      "glossary": "Glossário",
+      "about": "Sobre o projeto",
+      "aboutOverview": "Visão geral",
+      "aboutFaq": "FAQ",
+      "aboutContributors": "Colaboradores",
+      "aboutContributing": "Como contribuir",
+      "aboutCodeOfConduct": "Código de conduta",
+      "externalRepositories": "Repositórios externos",
+      "backupRestore": "Cópia de segurança e restauro",
+      "backupRestoreOverview": "Visão geral",
+      "backupRestoreHowItWorks": "Como funciona",
+      "backupRestoreDestinations": "Destinos",
+      "backupRestoreDestOverview": "Visão geral",
+      "backupRestoreDestLocal": "Arquivo local",
+      "backupRestoreDestPbs": "Proxmox Backup Server",
+      "backupRestoreDestBorg": "Borg",
+      "backupRestoreCreating": "Criar cópias de segurança",
+      "backupRestoreJobs": "Tarefas agendadas",
+      "backupRestoreRestoring": "Restaurar",
+      "backupRestoreCrossKernel": "Restauro entre versões do kernel",
+      "backupRestoreGlossary": "Glossário"
+    }
+  },
+  "hero": {
+    "title": "ProxMenux",
+    "tagline": "Um menu interativo e um painel web para o Proxmox VE",
+    "description": "O ProxMenux reúne um menu interativo e um painel web para o Proxmox VE. Execute comandos, scripts e assistentes a partir do terminal ou consulte o estado do host, as métricas e as notificações no navegador.",
+    "installButton": "Instalar agora",
+    "whatIsButton": "O que é o ProxMenux?",
+    "logoAlt": "Logótipo do ProxMenux"
+  },
+  "docNav": {
+    "previous": "Anterior",
+    "next": "Seguinte"
+  },
+  "tocPanel": {
+    "onThisPage": "Nesta página"
+  },
+  "supportProject": {
+    "heading": "Apoie o projeto!",
+    "body": "Se o <strong>ProxMenux</strong> lhe é útil, dê-lhe uma ⭐ no GitHub para ajudar outras pessoas a descobri-lo.",
+    "button": "Dar uma estrela no GitHub"
+  },
+  "rssLink": {
+    "heading": "Acompanhe as novidades!",
+    "body": "Subscreva o feed RSS para receber as novidades.",
+    "copy": "Copiar",
+    "copied": "Copiado!",
+    "copyTitle": "Copiar o URL do feed RSS",
+    "openFeed": "Abrir o feed RSS",
+    "openTitle": "Abrir o feed RSS"
+  },
+  "changelog": {
+    "pageTitle": "Histórico de alterações",
+    "meta": {
+      "title": "Histórico de alterações do ProxMenux",
+      "titleSuffix": "Notas da versão",
+      "latest": "Última versão",
+      "mostRecent": "Versão mais recente",
+      "description": "Notas de versão e histórico de atualizações do ProxMenux, o script com menus para gerir o Proxmox VE.",
+      "descriptionTail": "Novas funcionalidades, correções de erros, atualizações de segurança, melhorias do ProxMenux Monitor, compatibilidade com fornecedores de IA, reforço de segurança do passthrough de GPU e muito mais.",
+      "ogDescription": "Notas de versão do ProxMenux.",
+      "ogTail": "Subscreva o feed RSS ou volte a esta página para consultar novas versões."
+    }
+  }
+}
diff --git a/web/messages/pt/docs/about/code-of-conduct.json b/web/messages/pt/docs/about/code-of-conduct.json
new file mode 100644
index 00000000..681e28e0
--- /dev/null
+++ b/web/messages/pt/docs/about/code-of-conduct.json
@@ -0,0 +1,13 @@
+{
+  "meta": {
+    "title": "Código de conduta | Documentação ProxMenux",
+    "description": "Código de conduta e boas práticas do ProxMenux para colaboradores, responsáveis pelos testes e utilizadores.",
+    "ogTitle": "Código de conduta | Documentação ProxMenux",
+    "ogDescription": "Expectativas sobre a responsabilidade pelo código, a comunicação de vulnerabilidades e o âmbito dos PR no projeto ProxMenux."
+  },
+  "errors": {
+    "notFound": "Erro: O ficheiro CODE_OF_CONDUCT.md não foi encontrado.",
+    "loadFailed": "Erro: Não foi possível carregar o conteúdo do Código de Conduta."
+  },
+  "contentMarkdown": "# 📝 Código de conduta e boas práticas\n\nEste documento define os **princípios e as orientações** para o uso do **ProxMenux**, promovendo o **respeito, a colaboração e a segurança** no desenvolvimento.\n\n## 📌 1. Autoria do código e reconhecimento\n\n- Se forem usados **scripts, excertos de código ou ideias** de outros repositórios ou programadores, o autor original será sempre reconhecido.\n- Será acrescentado um comentário no código ou na documentação que indique a origem e, se possível, uma ligação para o repositório original.\n- Ao usar código com uma **licença** específica, é obrigatório respeitar as suas condições.\n\n### ✅ Exemplo de atribuição correta no código:\n\n```bash\n# Script baseado no trabalho de [Autor] em [Ligação do repositório]\n```\n\n## 🔒 2. Segurança e responsabilidade pelo código\n\n- Todo o código deste repositório segue boas práticas de desenvolvimento seguro.\n- Não são permitidos contributos que introduzam vulnerabilidades intencionais ou práticas inseguras.\n- Os scripts nunca devem comprometer a segurança do sistema nem os dados dos utilizadores.\n- Antes da implementação, os contributos devem ser revistos para verificar a segurança e a estabilidade.\n\n### ⚠️ Divulgação responsável de vulnerabilidades\n\nSe descobrir uma vulnerabilidade de segurança, NÃO a comunique em issues ou fóruns públicos.\n\nComunique-a em privado por e-mail:\n\n📧 proxmenux@macrimi.pro\n\nPara mais informações sobre vulnerabilidades e como as comunicar, consulte a nossa [política de segurança](./SECURITY.md).\n\n## 🤝 3. Regras da comunidade\n\nPara manter um ambiente respeitador e profissional, todos os utilizadores devem seguir estas regras:\n\n- ✅ Seja respeitador e construtivo nas discussões.\n- ❌ Não serão tolerados assédio, discurso de ódio ou comportamentos ofensivos.\n- ✅ Dê opiniões de forma profissional, evitando ataques pessoais.\n- ❌ O incumprimento pode resultar em avisos ou exclusões, consoante a gravidade.\n\n##\n\nEste documento promove o uso ético do código, a consciência de segurança e uma comunidade respeitadora.\n\n📢 Vamos construir algo extraordinário em conjunto!\n"
+}
diff --git a/web/messages/pt/docs/about/contributing.json b/web/messages/pt/docs/about/contributing.json
new file mode 100644
index 00000000..a18924b9
--- /dev/null
+++ b/web/messages/pt/docs/about/contributing.json
@@ -0,0 +1,293 @@
+{
+  "meta": {
+    "title": "Contribuir para ProxMenux | ProxMenux Documentação",
+    "description": "Como contribuir para o ProxMenux: modelo de ramos (main / develop / feature/*), processo de pull request, cabeçalho com autoria e ligação de apoio opcional, interface em duas fases, funções de mensagens e percurso até uma versão estável.",
+    "ogTitle": "Contribuição para ProxMenux",
+    "ogDescription": "Modelo de ramos, processo, autoria no cabeçalho e regra da interface em duas fases a seguir pelos colaboradores."
+  },
+  "header": {
+    "title": "Contribuição para ProxMenux",
+    "description": "O ProxMenux está aberto a contribuições comunitárias — novos scripts, correções para os existentes, melhorias de diálogo, traduções, integrações. Esta página é a porta formal: como o repositório é estruturado, o modelo de ramificação e fluxo de trabalho pull-request, o cabeçalho do script com atribuição do autor e link de patrocinador opcional, e as convenções de projeto cada contribuição deve seguir.",
+    "section": "Sobre"
+  },
+  "twoPagesCallout": {
+    "title": "Duas páginas relacionadas, um projecto",
+    "body": "Não confunda esta página com <contributorsLink>Colaboradores</contributorsLink>, que reconhece testadores, revisores e programadores já envolvidos. Esta página é para <em>si</em>, futuro colaborador, e explica como preparar uma pull request para integração."
+  },
+  "branching": {
+    "heading": "Modelo de ramificação",
+    "intro": "ProxMenux usa um modelo de ramificação de três camadas:",
+    "headerBranch": "Ramo",
+    "headerPurpose": "Finalidade",
+    "rows": [
+      {
+        "branch": "main",
+        "purposeRich": "Código estável, pronto para produção. Só são integradas aqui alterações prontas para lançamento. É a versão recebida numa instalação normal do ProxMenux."
+      },
+      {
+        "branch": "develop",
+        "purposeRich": "Ramo de desenvolvimento ativo. O trabalho novo é integrado primeiro aqui: é o canal beta. Quando uma versão estável está pronta, passa daqui para <code>main</code>."
+      },
+      {
+        "branch": "feature/*",
+        "purposeRich": "Ramos de curta duração por recurso, correção ou melhoria. Criado a partir de <code>develop</code>, fundiu-se novamente em <code>develop</code> através de um Pull Request após revisão."
+      }
+    ],
+    "calloutTitle": "O que isto significa para os utilizadores",
+    "calloutBody": "Usuários finais rastreando <code>main</code> recebem versões testadas. Usuários que querem os recursos mais recentes cedo — e não se importem com as bordas ásperas ocasionais — podem seguir o <code>develop</code>. Novos recursos sempre passam por <code>develop</code> primeiro; nada atinge <code>main</code> sem passar por esse ciclo."
+  },
+  "workflow": {
+    "heading": "Processo de pull request",
+    "intro": "Da ideia ao lançamento mesclado em cinco etapas:",
+    "step1Lead": "<strong>Criar um ramo de recursos de <code>develop</code></strong>:",
+    "step1Code": "git clone https://github.com/MacRimi/ProxMenux.git\ncd ProxMenux\ngit checkout develop\ngit pull origin develop\ngit checkout -b feature/your-feature-name",
+    "step1Trail": "Use um nome de ramo descritivo: <code>feature/zfs-arc-tuning</code>, <code>feature/fix-iommu-detection</code>, <code>feature/add-tailscale-script</code>.",
+    "step2Lead": "<strong>Trabalhe nas suas alterações e empurre o branch:</strong>",
+    "step2Code": "# Make your changes, then:\ngit add scripts/...\ngit commit -m \"Add ZFS ARC tuning script\"\ngit push -u origin feature/your-feature-name",
+    "step3": "<strong>Abra um pedido de pull contra <code>develop</code></strong> (não contra <code>main</code>). Na página de criação de GitHub PR, verifique novamente se o ramo base está definido como <code>develop</code>. Incluir na descrição: o que o script faz, o que ele muda, e em quais versões Proxmox VE você testou.",
+    "step4": "<strong>Após a revisão, as alterações são integradas em <code>develop</code>.</strong> Um responsável verifica o código, o cabeçalho e a interface em duas fases. Se pedir alterações, envie novos commits para o mesmo ramo: a PR atualiza-se automaticamente.",
+    "step5": "<strong>As versões estáveis passam de <code>develop</code> para <code>main</code>.</strong> No lançamento, <code>main</code> avança até <code>develop</code> por fast-forward e recebe uma etiqueta. A contribuição passa a integrar a próxima versão estável."
+  },
+  "scriptHeader": {
+    "heading": "Cabeçalho do programa — metadados e descrição",
+    "intro": "Cada script em ProxMenux abre com dois blocos de comentários adjacentes que juntos formam o cabeçalho. Eles são <strong> ambos necessários</strong> — juntos eles deixam qualquer leitor saber quem escreveu o script e o que ele faz, tudo sem abrir o próprio código.",
+    "bullets": [
+      "<strong>Bloco superior: metadados.</strong> Autor, ligações GitHub/de apoio opcionais, responsável, copyright, licença, versão e data de atualização. É também o <em>reconhecimento dos colaboradores</em>: num script novo, inclua o seu nome e, se quiser, a página GitHub e um perfil como Ko-fi, GitHub Sponsors ou Buy Me a Coffee.",
+      "<strong>Bloco inferior: descrição.</strong> Um parágrafo curto em inglês simples explica o script. É lido <em>antes</em> do código e deve bastar para compreender o objetivo, ações principais, recursos afetados e requisitos."
+    ],
+    "licenseCalloutTitle": "A linha de licença é fixa — GPL-3.0",
+    "licenseCalloutBody": "ProxMenux é publicado sob a Licença Pública Geral <strong>GNU v3.0</strong>. Cada script no projeto envia sob essa mesma licença; a linha <code>License</code> no cabeçalho é sempre a referência GPL-3.0 mostrada no exemplo abaixo — não é uma escolha por script. Ao contribuir com um script, você concorda em lançá-lo sob GPL-3.0, o que significa que qualquer um pode lê-lo, modificá-lo e redistribuí-lo (incluindo modificações), desde que o mantenha sob a mesma licença. O texto completo vive em <licenseLink>MacRimi/ProxMenux/LICENSE</licenseLink>.",
+    "templateCode": "#!/bin/bash\n\n# ==========================================================\n# ProxMenux - A menu-driven script for Proxmox VE management\n# ==========================================================\n# Author      : Your Name\n# GitHub      : github.com/yourhandle\n# Sponsor     : ko-fi.com/yourhandle\n# Maintainer  : MacRimi\n# Copyright   : (c) 2026 MacRimi & contributors\n# License     : (GPL-3.0) (https://github.com/MacRimi/ProxMenux/blob/main/LICENSE)\n# Version     : 1.0\n# Last Updated: DD/MM/YYYY\n# ==========================================================\n# Description:\n# Short paragraph explaining what the script does.\n# Mention the main actions (e.g. \"creates a ZFS pool\",\n# \"configures IOMMU and reboots\", \"imports an ISO into a VM\"),\n# the resources it touches, and any prerequisites the user\n# should be aware of before running it.\n# ==========================================================",
+    "optionalNote": "As linhas <code>GitHub</code> e <code>Sponsor</code> são opcionais — deixe-as de fora se não quiser publicá-las. Tudo o resto é necessário.",
+    "whyCalloutTitle": "Por que isso importa?",
+    "whyCalloutBody": "A contribuição de código aberto é trabalho voluntário. Colocar o nome do contribuinte e (quando fornecido) o link do patrocinador diretamente na fonte dá às pessoas que constroem os scripts reconhecimento visível cada vez que alguém lê o código — sua autoria é preservada, não escondida sob “o projeto”. O bloco de descrição importa por uma razão diferente: é a primeira coisa que um futuro mantenedor ou usuário curioso lê, e uma descrição clara é muitas vezes a diferença entre um script que as pessoas confiam e uma que elas evitam."
+  },
+  "structure": {
+    "heading": "Estrutura do projecto",
+    "intro": "Onde cada tipo de script vive no repositório:",
+    "treeCode": "scripts/\n├── menus/              # Top-level menu scripts (entry points)\n├── storage/            # Disk, storage and passthrough scripts\n├── share/              # NFS, Samba, local share scripts\n├── vm/                 # VM creation and configuration scripts\n├── gpu_tpu/            # GPU / TPU passthrough scripts\n├── post_install/       # Post-install automation scripts\n├── backup_restore/     # Backup and restore scripts\n├── utilities/          # System utility scripts\n├── global/             # Shared helper libraries (sourced by other scripts)\n├── utils.sh            # Shared utility functions and message helpers\n└── help_info_menu.sh   # Interactive help and command reference",
+    "outro": "Cada script carrega <code>utils.sh</code> no arranque através de source para obter funções de mensagens, indicador de espera, cores e sistema de tradução. As bibliotecas partilhadas em <code>scripts/global/</code> são carregadas explicitamente pelos scripts que delas precisam."
+  },
+  "twoPhase": {
+    "heading": "A política de design de IU em duas fases",
+    "intro": "É a convenção mais importante do ProxMenux e a que mais frequentemente leva a pedidos de correção nas PR. Cada script divide-se em <strong>exatamente duas fases</strong>:",
+    "headerPhase": "Fase",
+    "headerPurpose": "Finalidade",
+    "headerScreen": "Estado da tela",
+    "rows": [
+      {
+        "phaseRich": "<strong>Fase 1 — Selecção</strong>",
+        "purposeRich": "Recolha todas as decisões do utilizador. Executar todos os trabalhos preparatórios necessários (sondas, sondagens, verificações).",
+        "screenRich": "Janelas <code>dialog</code>. Se uma verificação entre dois menus demorar mais de um ou dois segundos, mostre um indicador <code>msg_info</code> para sinalizar que o script não bloqueou, e chame <code>stop_spinner</code> imediatamente antes do próximo diálogo."
+      },
+      {
+        "phaseRich": "<strong>Fase 2 — Execução</strong>",
+        "purposeRich": "Executar todas as operações. Mostra o histórico de progresso completo acumulado na tela.",
+        "screenRich": "Mensagens visíveis <code>msg_info</code> / <code>msg_ok</code>; nunca <code>dialog</code>."
+      }
+    ],
+    "principle": "O princípio: <strong>colha tudo primeiro, depois executa tudo</strong>. O usuário vê um menu de diálogo limpo (Fase 1), em seguida, uma visão de execução de log-style limpo (Fase 2). Nenhuma mistura — nenhuma janela que apareça no meio da execução, nenhum ruído de progresso durante a selecção.",
+    "phase1Heading": "Fase 1 — padrão típico",
+    "phase1Code": "# Silent preparatory work between dialogs\nmsg_info \"$(translate \"Checking disk assignments...\")\"\nASSIGNED_TO=$(check_assignments \"$DISK\")\nstop_spinner   # ← clears line silently, result saved in variable\n\n# Next dialog can now use ASSIGNED_TO\nif [ -n \"$ASSIGNED_TO\" ]; then\n    dialog --yesno \"$(translate \"Disk already assigned. Continue?\")\" $UI_YESNO_H $UI_YESNO_W\nfi\n\n# Collect multiple decisions per item with parallel arrays\ndeclare -a DISK_LIST=()\ndeclare -a DISK_FORMAT_TYPES=()\ndeclare -a DISK_MOUNT_POINTS=()\nfor DISK in $SELECTED; do\n    msg_info \"$(translate \"Analyzing disk...\")\"\n    CURRENT_FS=$(lsblk -no FSTYPE \"$DISK\" | xargs)\n    stop_spinner\n\n    FORMAT=$(dialog --backtitle \"$BACKTITLE\" \\\n        --title \"$(translate \"Select Filesystem\")\" \\\n        --menu \"...\" $UI_SHORT_MENU_H $UI_SHORT_MENU_W $UI_SHORT_MENU_LIST_H \\\n        \"ext4\" \"...\" \"xfs\" \"...\" \"btrfs\" \"...\" \\\n        2>&1 >/dev/tty)\n    [ -z \"$FORMAT\" ] && continue\n\n    DISK_LIST+=(\"$DISK\")\n    DISK_FORMAT_TYPES+=(\"$FORMAT\")\ndone",
+    "phase1RulesIntro": "<strong>Regras para fase 1:</strong>",
+    "phase1Rules": [
+      "Se estiver ativo um indicador <code>msg_info</code> e precisar de abrir um menu <code>dialog</code> ou <code>whiptail</code>, chame primeiro <code>stop_spinner</code>: o indicador não pode coexistir com a sobreposição das ferramentas. Se nenhum estiver ativo, a chamada não é necessária.",
+      "Use <code>show_proxmenux_logo</code> + <code>msg_title</code> + <code>msg_info</code> quando você precisa dar ao usuário contexto visual para uma operação de longa duração em fase 1 (por exemplo, uma sonda que leva 5+ segundos). A função inclui uma tela limpa, então não chame <code>clear</code> antes.",
+      "Não chame o <code>show_proxmenux_logo</code> entre menus de diálogo onde não há nada para exibir — limpar a tela para um terminal vazio é apenas ruído visual.",
+      "Armazene todas as decisões e resultados de sonda em variáveis ou arrays paralelos. A recapitulação visível ocorre no início da Fase 2, não na Fase 1."
+    ],
+    "phase2Heading": "Fase 2 — padrão típico",
+    "phase2Code": "# ── PHASE 2 — EXECUTION ─────────────────────────────\nshow_proxmenux_logo\nmsg_title \"$(translate \"My Script Title\")\"\n\n# Recap Phase 1 preparatory results — show what was already done\nmsg_ok \"$(translate \"CT $CTID selected.\")\"\nmsg_ok \"$(translate \"Repositories verified.\")\"\nmsg_ok \"$(translate \"Disks to process: ${#DISK_LIST[@]}\")\"\n\n# Now execute operations\nfor i in \"${!DISK_LIST[@]}\"; do\n    DISK=\"${DISK_LIST[$i]}\"\n    FORMAT=\"${DISK_FORMAT_TYPES[$i]}\"\n\n    msg_info \"$(translate \"Formatting\") $DISK $(translate \"as\") $FORMAT...\"\n    mkfs.\"$FORMAT\" \"$DISK\" >/dev/null 2>&1\n    msg_ok \"$(translate \"Formatted.\")\"\ndone\n\nmsg_ok \"$(translate \"Completed. ${#DISK_LIST[@]} disk(s) processed.\")\"\nmsg_success \"$(translate \"Press Enter to return to menu...\")\"\nread -r",
+    "phase2Rules": "<strong>Regras para a fase 2:</strong> comece com <code>show_proxmenux_logo + msg_title</code> e resuma de imediato a fase 1 em linhas <code>msg_ok</code>. Não volte a chamar <code>show_proxmenux_logo</code>, pois apagaria o progresso acumulado. Não utilize <code>dialog</code>; se uma decisão durante a execução for inevitável, utilize <code>whiptail</code> como na secção seguinte."
+  },
+  "dialogVsWhiptail": {
+    "headingRich": "Quando usar <code>dialog</code> vs <code>whiptail</code>",
+    "intro": "Ambas as ferramentas desenham interfaces de usuário de modo texto, mas elas se comportam de forma muito diferente na tela — e ProxMenux as usa em duas fases distintas por uma razão.",
+    "headerTool": "Ferramenta",
+    "headerWhen": "Quando usá-lo",
+    "headerEffect": "Efeito no ecrã",
+    "rows": [
+      {
+        "toolRich": "<strong><code>dialog</code></strong>",
+        "whenRich": "<strong>Sempre em fase 1.</strong> Cada seleção interativa — escolhendo um VM, um disco, um sistema de arquivos, confirmando uma ação — usa <code>dialog</code>. Esta é a ferramenta padrão de UI do ProxMenux.",
+        "effectRich": "Assume o terminal: limpa a tela, desenha sua sobreposição, e ao fechar retorna o terminal ao seu estado anterior. Tudo bem na fase 1 porque nada de útil está mostrando ainda."
+      },
+      {
+        "toolRich": "<strong><code>whiptail</code></strong>",
+        "whenRich": "<strong>Apenas na Fase 2, somente quando inevitável.</strong> O caso típico é um prompt de reinicialização no final da execução. Não procure o <code>whiptail</code> para pedir “continuar?” no meio da execução — essa decisão deveria ter sido tomada na Fase 1.",
+        "effectRich": "Sobreposição mais leve que <em>não limpa</em> o contexto do terminal. O histórico <code>msg_ok</code>/<code>msg_info</code> da fase 2 permanece visível atrás do diálogo. É por isso a escolha indicada quando o progresso já está no ecrã."
+      }
+    ],
+    "calloutTitle": "Por que a divisão importa",
+    "calloutBody": "Se você chamar <code>dialog</code> no meio da fase 2, cada linha <code>msg_ok</code> que o usuário tem assistido desaparece. Limpas o rasto da auditoria. <code>whiptail</code> evita isso. Então a regra não é arbitrária — é sobre preservar a visão do usuário sobre o que o script tem feito até agora.",
+    "rebootHeading": "Pedido de reinício: o caso típico de whiptail na fase 2",
+    "rebootIntro": "Quando um script termina e uma reinicialização pode ser necessária (por exemplo: IOMMU habilitado, parâmetros do kernel alterados), o prompt no final da Fase 2 usa <code>whiptail</code>. Sempre inclua um branch “Não” que avisa o usuário para não usar o recurso afetado até que ele reinicie:",
+    "rebootCode": "if [[ \"$HOST_REBOOT_REQUIRED\" == \"yes\" ]]; then\n  echo \"\"\n  if whiptail --title \"$(translate \"Reboot Required\")\" --yesno \\\n    \"\\n$(translate \"A host reboot is required before starting the VM. Reboot now?\")\" \\\n    13 78; then\n      msg_warn \"$(translate \"Rebooting the system...\")\"\n      reboot\n  else\n      echo \"\"\n      msg_info2 \"$(translate \"Do not start the VM until the system has been rebooted.\")\"\n  fi\nfi\n\nmsg_success \"$(translate \"Press Enter to return to menu...\")\"\nread -r"
+  },
+  "messageFunctions": {
+    "heading": "Referência das funções da mensagem",
+    "intro": "Todos definidos em <code>utils.sh</code>. Use-os como padrão para qualquer saída visível pelo usuário — visual consistente entre scripts é o ponto principal. Se seu script precisar de uma nova função que não se encaixe no conjunto existente (um novo nível de gravidade, um novo auxiliar de layout, etc.), proponha-o em seu pedido de pull — ele será revisado e adicionado ao <code>utils.sh</code> se for amplamente útil.",
+    "headerFunction": "Função",
+    "headerWhen": "Quando utilizar",
+    "headerSpinner": "Indicador de progresso",
+    "rows": [
+      {
+        "function": "msg_info \"text\"",
+        "whenRich": "Operação em curso.",
+        "spinner": "Inicia"
+      },
+      {
+        "function": "stop_spinner",
+        "whenRich": "Fim dos trabalhos preparatórios silenciosos na fase 1 — mata spinner, limpa a linha.",
+        "spinner": "Para"
+      },
+      {
+        "function": "msg_ok \"text\"",
+        "whenRich": "Operação concluída. Utilize também para uma funcionalidade ativada, mesmo que ainda seja necessário reiniciar.",
+        "spinner": "Para"
+      },
+      {
+        "function": "msg_warn \"text\"",
+        "whenRich": "Aviso real ou estado degradado.",
+        "spinner": "Para"
+      },
+      {
+        "function": "msg_error \"text\"",
+        "whenRich": "Erro fatal.",
+        "spinner": "Para"
+      },
+      {
+        "function": "msg_info2 \"text\"",
+        "whenRich": "Informação sem bloqueio, numa linha ciano.",
+        "spinner": "Para"
+      },
+      {
+        "function": "msg_success \"text\"",
+        "whenRich": "Final “Pressione Enter para retornar” no final da fase 2.",
+        "spinner": "Para"
+      },
+      {
+        "function": "msg_title \"text\"",
+        "whenRich": "Título negrito com espaçamento embutido. Utilizado no início da fase 2.",
+        "spinner": "—"
+      },
+      {
+        "function": "show_proxmenux_logo",
+        "whenRich": "Limpa o ecrã, mostra o logótipo. Chamado <em> uma vez</em> apenas no início da Fase 2.",
+        "spinner": "—"
+      }
+    ]
+  },
+  "dialogConventions": {
+    "heading": "convenções de diálogo",
+    "bullets": [
+      "Passe sempre <code>--backtitle \"$BACKTITLE\"</code> para cada chamada <code>dialog</code> e <code>whiptail</code>. <code>$BACKTITLE</code> é sempre <code>\"ProxMenux\"</code> — definido uma vez no cabeçalho do script e nunca substituído. O usuário deve sempre ver o nome do projeto como o contexto de enquadramento, nunca o próprio título do script.",
+      "Enrole sempre títulos e mensagens com <code>$(translate \"...\")</code>.",
+      "Sempre redirecionar saída <code>dialog</code> com <code>2&gt;&amp;1 &gt;/dev/tty</code> - o stdout capturado torna-se a seleção do usuário, enquanto o diálogo em si desenha no terminal.",
+      "Use as variáveis de dimensão padrão de UI (<code>$UI_MENU_H</code>, <code>$UI_MSG_W</code>, etc.) para dimensionamento consistente entre scripts.",
+      "Verifique sempre escolhas vazias ou canceladas e trate-as corretamente."
+    ],
+    "exampleIntro": "Exemplo completo: criar um menu de seleção de VM e tratar o cancelamento.",
+    "exampleCode": "# 1) Build the list of VMs as alternating \"ID  NAME\" pairs.\n#    dialog --menu expects this exact shape: tag1 description1 tag2 description2 ...\nVM_LIST=\"\"\nfor vmid in $(qm list | awk 'NR>1 {print $1}'); do\n    vm_name=$(qm config \"$vmid\" | awk -F': ' '/^name:/ {print $2}')\n    VM_LIST=\"$VM_LIST $vmid \\\"$vm_name\\\"\"\ndone\n\n# 2) Show the dialog. Captured stdout is the user's selection (the VMID).\nVMID=$(eval \"dialog --backtitle \\\"\\$BACKTITLE\\\" \\\n    --title \\\"\\$(translate \\\"Select VM\\\")\\\" \\\n    --menu \\\"\\$(translate \\\"Choose a VM from the list:\\\")\\\" \\\n    \\$UI_MENU_H \\$UI_MENU_W \\$UI_MENU_LIST_H \\\n    $VM_LIST \\\n    2>&1 >/dev/tty\")\n\n# 3) Empty result means the user pressed Cancel or Esc — exit silently.\nif [ -z \"$VMID\" ]; then\n    exit 0\nfi\n\n# 4) Continue with the rest of Phase 1, knowing VMID is now set.\necho \"User selected VMID=$VMID\""
+  },
+  "translation": {
+    "heading": "Política de tradução",
+    "intro": "Todas as strings visíveis ao usuário devem ser enroladas com a função <code>translate</code>. ProxMenux traduz-os automaticamente em todas as línguas suportadas — você escreve inglês, o usuário lê sua língua nativa.",
+    "code": "msg_ok \"$(translate \"Operation completed successfully.\")\"\nmsg_error \"$(translate \"Failed to start container\") $CTID.\"\ndialog --title \"$(translate \"Select Storage\")\" ...",
+    "bullets": [
+      "Escreva strings em inglês — a tradução é tratada automaticamente pela compilação.",
+      "Mantenha as cadeias de texto concisas. Evite, se possível, variáveis dentro de frases longas.",
+      "<strong>Não</strong> traduza nomes de variáveis, caminhos ou identificadores técnicos."
+    ]
+  },
+  "variableStyle": {
+    "heading": "Convenções de variáveis e estilo",
+    "bullets": [
+      "Usar <code>UPPER_CASE</code> para variáveis de nível de script.",
+      "Use <code>lower_case</code> para variáveis de função local (declare com <code>local</code>).",
+      "Coloque todas as expansões de variáveis entre aspas: <code>\"$VAR\"</code>, não <code>$VAR</code>.",
+      "Usar <code>[[ ]]</code> para condicionantes, não <code>[ ]</code> (exceto onde POSIX é necessário).",
+      "<code>show_proxmenux_logo</code> é a forma prevista de limpar o ecrã: limpa-o e mostra o logótipo do projeto para manter o contexto visual. Chame-o uma vez no início da fase 2, e opcionalmente antes de uma espera longa na fase 1."
+    ],
+    "standardNamesIntro": "Nomes de variáveis padrão em todo o projeto:",
+    "standardNamesCode": "CTID         # container ID\nVMID         # virtual machine ID\nDISK         # device path (e.g. /dev/sdb)\nPARTITION    # partition path (e.g. /dev/sdb1)\nSTORAGE      # Proxmox storage name\nMOUNT_POINT  # filesystem mount path",
+    "redirectHeading": "Redirecionando a saída da ferramenta durante a fase 2",
+    "redirectIntro": "A fase 2 mostra um registo de linhas <code>msg_info → msg_ok</code>. Se uma ferramenta chamada, como apt, mkfs, qm, pct ou dd, escrever em stdout/stderr, a sua saída desloca as mensagens e confunde o ecrã. O utilizador deixa de distinguir o progresso do script dos detalhes da ferramenta.",
+    "withoutRedirectIntro": "<strong>Sem redirecionar</strong> — o que o usuário vê se você não lidar com o ruído:",
+    "withoutRedirectCode": "ℹ Installing kernel package...\nReading package lists... Done\nBuilding dependency tree... Done\nReading state information... Done\nThe following NEW packages will be installed:\n  proxmox-kernel-6.5\n0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded.\nNeed to get 12.5 MB of archives.\nAfter this operation, 47.2 MB of additional disk space will be used.\nGet:1 http://download.proxmox.com/debian/pve trixie/pve-no-subscription amd64 ...\n... [200+ more lines of dpkg output] ...\n✓ Kernel installed.",
+    "withRedirectIntro": "<strong>Com redirecionamento</strong> — como é a mesma operação quando o ruído é enviado para outro lugar:",
+    "withRedirectCode": "ℹ Installing kernel package...\n✓ Kernel installed.\nℹ Configuring kernel command line...\n✓ Configured.\nℹ Refreshing boot loader...\n✓ Boot loader updated.",
+    "twoPatternsIntro": "Dois padrões para escolher:",
+    "discardLead": "<strong>Descarte a saída</strong> quando você não precisar — mais rápido, mais simples:",
+    "discardCode": "DEBIAN_FRONTEND=noninteractive apt-get install -y \"$package\" >/dev/null 2>&1",
+    "logLead": "<strong>Envie a saída para um arquivo de log</strong> quando você quiser inspeccioná-lo mais tarde (depurando uma instalação falhada, verificando o que o dpkg realmente fez). Este é o padrão preferido para qualquer operação apt:",
+    "logCode": "apt-get install -y \"$package\" >> \"$log_file\" 2>&1",
+    "referenceOutro": "O script <code>scripts/global/update-pve9_2.sh</code> é uma implementação de referência — cada chamada <code>apt-get</code> envia saída para um arquivo de log para que o usuário apenas veja o fluxo limpo <code>msg_info → msg_ok</code>, enquanto o log no disco permite reconstruir exatamente o que o apt fez se algo der errado."
+  },
+  "dosAndDonts": {
+    "heading": "Fazer e Não Fazer",
+    "doHeading": "✅ Fazer",
+    "doBullets": [
+      "<code>stop_spinner</code> antes de um <code>dialog</code> em fase 1 somente quando um spinner <code>msg_info</code> está em execução atualmente.",
+      "Fase 2 começa com <code>show_proxmenux_logo + msg_title + msg_ok</code> recap dos resultados da Fase 1.",
+      "Use <code>msg_ok</code> para recursos habilitados com sucesso — mesmo que seja necessário reiniciar.",
+      "Use <code>whiptail</code> (não <code>dialog</code>) para qualquer prompt pós-execução que deve aparecer na Fase 2.",
+      "Sempre inclua um branch \"Não\" nas janelas de reinicialização que alerta o usuário para não iniciar o recurso afetado até reiniciar.",
+      "Limite a lógica exclusiva de VM verificando <code>[[ -f \"/etc/pve/qemu-server/$'{'vmid'}'.conf\" ]]</code>: controladores e NVMe PCIe não podem ser atribuídos a LXC por passthrough PCI.",
+      "Utilizar <code>ensure_repositories</code> de <code>utils-install-functions.sh</code> em vez de <code>apt-get update</code> incondicional.",
+      "Use arrays paralelos na Fase 1 quando cada item precisar de múltiplas janelas."
+    ],
+    "dontHeading": "❌ Não fazer",
+    "dontBullets": [
+      "Chame <code>dialog</code> enquanto um spinner está ativo.",
+      "Pular a fase 1 recap no início da fase 2.",
+      "Chame o <code>show_proxmenux_logo</code> pela segunda vez — ele apaga tudo que a Fase 2 imprimiu.",
+      "Utilizar <code>dialog</code> na Fase 2 (utilizar <code>whiptail</code> para o caso raro inevitável).",
+      "Utilizar apenas <code>clear</code>.",
+      "Enrole <code>msg_title</code> em linhas em branco <code>echo \"\"</code> — já inclui espaçamento.",
+      "Use o <code>msg_warn</code> para relatar um recurso habilitado com sucesso — que é um <code>msg_ok</code>.",
+      "Executar <code>apt-get update</code> incondicional — utilizar <code>ensure_repositories</code>."
+    ]
+  },
+  "submitting": {
+    "heading": "Submissão da sua contribuição",
+    "steps": [
+      "Crie um fork de <code>MacRimi/ProxMenux</code> no GitHub e clone esse fork.",
+      "Crie um ramo <code>feature/*</code> a partir de <code>develop</code> (veja <em>Modelo de ramos</em> acima).",
+      "Siga este guia para quaisquer scripts novos ou modificados. Escreva o cabeçalho com o seu nome; adicione a linha de patrocinador opcional se quiser.",
+      "Teste o script numa instância real do Proxmox VE: fase 1 com todos os ramos dos diálogos e fase 2 com cada operação e a reversão correta em caso de erro.",
+      "Abra um Pull Request <strong> contra <code>develop</code></strong> com uma descrição clara: o que o script faz, o que mudou, em que versão Proxmox VE foi testado.",
+      "Certifique-se de que sua contribuição respeite o <cocLink>Código de Conduta</cocLink>."
+    ],
+    "securityOutro": "Para questões sensíveis à segurança, siga o fluxo de divulgação em <securityLink>SECURITY.md</securityLink> em vez de abrir um problema público."
+  },
+  "whereNext": {
+    "heading": "Para onde seguir",
+    "items": [
+      {
+        "kind": "external",
+        "url": "https://github.com/MacRimi/ProxMenux/blob/main/CONTRIBUTING.md",
+        "label": "CONTRIBUTING.md (guia completo)",
+        "tail": " — a fonte da verdade para cada convenção, incluindo os padrões avançados de hardware."
+      },
+      {
+        "kind": "internal",
+        "href": "/docs/about/contributors",
+        "label": "Contribuidores",
+        "tail": " — as pessoas cuja obra moldou os lançamentos do ProxMenux (página diferente deste)."
+      },
+      {
+        "kind": "internal",
+        "href": "/docs/about/code-of-conduct",
+        "label": "Código de Conduta",
+        "tail": " — as normas que cada contribuinte aceita respeitar."
+      },
+      {
+        "kind": "external",
+        "url": "https://github.com/MacRimi/ProxMenux/discussions",
+        "label": "GitHub Discussions",
+        "tail": " — pergunte antes de você construir se você não tem certeza se uma ideia se encaixa, ou para encontrar colaboradores em um recurso maior."
+      }
+    ]
+  }
+}
diff --git a/web/messages/pt/docs/about/contributors.json b/web/messages/pt/docs/about/contributors.json
new file mode 100644
index 00000000..c7d3a8e7
--- /dev/null
+++ b/web/messages/pt/docs/about/contributors.json
@@ -0,0 +1,38 @@
+{
+  "meta": {
+    "title": "Colaboradores | Documentação ProxMenux",
+    "description": "Reconhecimento às pessoas que tornam o ProxMenux possível: quem testa, revê e desenvolve cada versão.",
+    "ogTitle": "Colaboradores | Documentação ProxMenux",
+    "ogDescription": "Conheça os colaboradores por trás do ProxMenux."
+  },
+  "header": {
+    "title": "Colaboradores",
+    "description": "O projeto ProxMenux cresce graças aos seus colaboradores. Esta página reconhece o seu trabalho: testar versões antes da publicação, detetar regressões, rever PR e ajudar a orientar novas funcionalidades.",
+    "section": "Sobre"
+  },
+  "beyond": {
+    "title": "Para além desta lista",
+    "body": "Muitas outras pessoas contribuem ao comunicar erros, propor funcionalidades em Discussions, testar versões beta e traduzir o projeto. A lista completa de colaboradores do código está no <extlink>gráfico de colaboradores do GitHub</extlink>. Esta página destaca quem participa mais ativamente nos testes e na revisão das versões do ProxMenux."
+  },
+  "testers": {
+    "heading": "Testadores e revisores",
+    "intro": "Estas pessoas estiveram entre as primeiras a contribuir para o projeto. Os seus testes, relatos de problemas e sugestões de melhoria ajudaram o ProxMenux a tornar-se no que é hoje.",
+    "roles": {
+      "testing": "Teste",
+      "testingReviewer": "Testes e revisão"
+    },
+    "youtube": "YouTube"
+  },
+  "contribute": {
+    "heading": "Queres contribuir?",
+    "intro": "Todos os contributos são bem-vindos: código, testes, design, documentação ou simplesmente partilhar ideias:",
+    "tester": "<strong>Testes</strong> — experimente o <beta>canal beta</beta> e comunique o que funciona ou não antes da publicação das versões estáveis.",
+    "developer": "<strong>Desenvolvimento</strong> — Bash, Next.js (TypeScript) e algum Python para o ambiente virtual de tradução (venv). Os PR são bem-vindos no <gh>GitHub</gh>.",
+    "designer": "<strong>Designer</strong> — Melhorias de interface, ícones, capturas de tela para documentação.",
+    "ideas": "<strong>Ideias</strong> — abra um tópico em <disc>GitHub Discussions</disc> antes de criar uma issue para pedir uma funcionalidade."
+  },
+  "coc": {
+    "title": "Leia primeiro o Código de Conduta",
+    "body": "Antes de propor código ou comunicar problemas, leia o <coclink>Código de conduta e as boas práticas</coclink>. Explica as expectativas sobre a responsabilidade pelo código, a comunicação de vulnerabilidades e o âmbito dos PR."
+  }
+}
diff --git a/web/messages/pt/docs/about/faq.json b/web/messages/pt/docs/about/faq.json
new file mode 100644
index 00000000..71549138
--- /dev/null
+++ b/web/messages/pt/docs/about/faq.json
@@ -0,0 +1,94 @@
+{
+  "meta": {
+    "title": "Perguntas frequentes | Documentação ProxMenux",
+    "description": "Perguntas frequentes sobre o ProxMenux: funcionalidades, instalação, compatibilidade a partir do PVE 8, personalização, atualizações, segurança, uso em produção, ficheiros do sistema, contributos e desinstalação.",
+    "ogTitle": "Perguntas frequentes | Documentação ProxMenux",
+    "ogDescription": "Perguntas frequentes sobre instalação, compatibilidade, segurança e contribuição do ProxMenux."
+  },
+  "header": {
+    "title": "Perguntas frequentes",
+    "description": "Perguntas comuns sobre o ProxMenux: o que é, a quem se destina, instalação, atualização, desinstalação, compatibilidade, personalização, segurança e contributos. Se não encontrar a sua pergunta, consulte GitHub Discussions ou abra uma issue.",
+    "section": "Sobre"
+  },
+  "quickLinks": {
+    "title": "Ligações rápidas",
+    "installationLabel": "Instalação",
+    "installationSuffix": " — o comando de instalação de uma linha + dependências.",
+    "introductionLabel": "Introdução",
+    "introductionSuffix": " — o que faz ProxMenux, em 5 minutos.",
+    "uninstallLabel": "Desinstalar",
+    "uninstallSuffix": " — remoção limpa.",
+    "issuesLabel": "GitHub Issues",
+    "discussionsLabel": "Discussões"
+  },
+  "q1": {
+    "question": "O que é o ProxMenux e para que é utilizado?",
+    "p1Rich": "<strong>ProxMenux</strong> é uma ferramenta de menu interativa projetada para tornar o <strong>Proxmox VE</strong> acessível a todos os usuários, independentemente de sua experiência técnica. Ele simplifica a execução de comandos, permitindo que os usuários executem ações em seu sistema sem exigir conhecimento avançado do Linux.",
+    "p2": "Os utilizadores menos experientes executam comandos através de menus estruturados, reduzindo a escrita manual no terminal. Os administradores experientes poupam passos em tarefas repetitivas: reforço de segurança após a instalação, passthrough de GPU, importação de VM OVF e rotação de snapshots ZFS.",
+    "p3": "Proxmox VE é amplamente utilizado para:",
+    "items": [
+      "Virtualização de nível empresarial",
+      "HomeLab e soluções de nuvem pessoal",
+      "Servidores multimídia, automação e muito mais"
+    ]
+  },
+  "q2": {
+    "question": "Como faço para instalar ProxMenux?",
+    "p1Rich": "Siga o <installlink>guia de instalação</installlink>. Em resumo:",
+    "stableInstall": "bash -c \"$(wget -qLO - https://raw.githubusercontent.com/MacRimi/ProxMenux/main/install_proxmenux.sh)\"",
+    "p2": "Uma vez instalado, basta iniciar com:",
+    "menuCmd": "menu"
+  },
+  "q3": {
+    "question": "O ProxMenux é compatível com todas as versões do Proxmox?",
+    "bodyRich": "<strong>Não — o ProxMenux requer Proxmox VE 8 ou posterior.</strong> O PVE 7 e as versões anteriores não são suportados. Se ainda usa o PVE 7, atualize primeiro para 8.x segundo o procedimento oficial do Proxmox. Depois, o ProxMenux pode tratar da passagem de 8 para 9 em <upgradelink>Utilitários → Atualizar PVE 8 para PVE 9</upgradelink>."
+  },
+  "q4": {
+    "question": "Posso personalizar ProxMenux?",
+    "p1Rich": "As atualizações podem substituir alterações locais aos scripts principais, pelo que deve evitar editar esses ficheiros diretamente. O que <em>pode</em> personalizar:",
+    "items": [
+      "O banner do console através da ferramenta <strong>FastFetch</strong> nas opções de Post-Install.",
+      "Quais componentes opcionais são instalados (Monitor, Fail2Ban, Lynis...) — escolha durante a instalação ou através do menu relevante mais tarde."
+    ]
+  },
+  "q5": {
+    "question": "Como faço para atualizar o ProxMenux?",
+    "p1Rich": "Quando há uma nova versão, o ProxMenux deteta-a na próxima execução de <code>menu</code> e propõe a atualização. Se aceitar, os ficheiros e a configuração da ferramenta são substituídos na instalação existente, sem downloads manuais.",
+    "p2Rich": "Os utilizadores da versão estável recebem atualizações estáveis; os da beta recebem atualizações beta. Quando é publicada uma versão estável, a beta avisa na próxima abertura do menu e propõe a mudança automática. Consulte o <betalink>programa beta</betalink>."
+  },
+  "q6": {
+    "question": "Onde posso comunicar problemas ou sugerir funcionalidades?",
+    "p1Rich": "Comunique erros em <issueslink>GitHub Issues</issueslink>. Inclua os passos para os reproduzir, a mensagem de erro e, quando relevante, a saída do Monitor obtida com <code>journalctl -u proxmenux-monitor -n 50</code>.",
+    "p2Rich": "No caso de problemas de <strong>segurança</strong>, <strong>não publique os detalhes</strong>. Siga o procedimento de divulgação responsável no <coclink>código de conduta e boas práticas</coclink>."
+  },
+  "q7": {
+    "question": "Posso contribuir para o ProxMenux?",
+    "p1Rich": "<strong>Claro.</strong> O ProxMenux é um projeto colaborativo e de código aberto. Pode contribuir com código (Bash, Next.js/TypeScript e ferramentas de tradução em Python), testes, documentação, design ou ideias.",
+    "item1Rich": "Discuta as ideias em <discusslink>GitHub Discussions</discusslink> antes de abrir um pedido de funcionalidade.",
+    "item2Rich": "Antes de enviar uma pull request, leia o <coclink>código de conduta e boas práticas</coclink>.",
+    "item3Rich": "Consulte a <contriblink>página de colaboradores</contriblink> para saber quem participa atualmente nos testes e revisões."
+  },
+  "q8": {
+    "question": "ProxMenux modifica arquivos críticos do sistema?",
+    "p1Rich": "<strong>A instalação do ProxMenux adiciona os seguintes componentes.</strong>",
+    "item1Rich": "Dependências via apt: <code>dialog</code>, <code>curl</code>, <code>jq</code> e <code>git</code>. As traduções usam catálogos JSON pré-gerados; o instalador não adiciona ao anfitrião um ambiente virtual de tradução.",
+    "item2Rich": "A árvore de scripts em <code>/usr/local/share/proxmenux/</code>.",
+    "item3Rich": "O comando de arranque em <code>/usr/local/bin/menu</code>.",
+    "item4Rich": "Opcional: o serviço systemd do Monitor, <code>proxmenux-monitor.service</code>.",
+    "p2Rich": "O ProxMenux <em>não</em> altera a configuração principal do Proxmox, salvo se o pedir explicitamente num menu específico. Por exemplo, a reparação de rede edita <code>/etc/network/interfaces</code>, mas apenas após a sua confirmação e a criação de uma cópia de segurança."
+  },
+  "q9": {
+    "question": "É seguro usar ProxMenux na produção?",
+    "bodyRich": "<strong>Sim.</strong> Como o ProxMenux só altera os ficheiros principais do Proxmox quando solicitado explicitamente, pode ser usado em ambientes de produção. Como em qualquer automação, teste primeiro num ambiente controlado e tenha cópias de segurança antes de operações destrutivas: atualização do PVE 8 para 9, formatação de discos, eliminação de VM, entre outras."
+  },
+  "q10": {
+    "question": "Como faço para desinstalar ProxMenux?",
+    "p1Rich": "No ProxMenux: <strong>Definições → Desinstalar ProxMenux</strong>. A desinstalação remove os scripts, o comando de arranque e o serviço Monitor, além das dependências selecionadas, se assim escolher. Restaura <code>/root/.bashrc</code> e <code>/etc/motd</code> a partir das cópias criadas pelo Post-Install, caso existam (caso contrário, remove a linha do ProxMenux do MOTD).",
+    "p2Rich": "Passo a passo completo: <uninstalllink>Desinstalar ProxMenux</uninstalllink>."
+  },
+  "q11": {
+    "question": "VirusTotal sinaliza o URL de instalação — é seguro?",
+    "p1Rich": "O resultado de 1/95 do motor <em>Chong Lua Dao</em>, comunicado na issue #162, foi identificado pelo responsável do projeto como um falso positivo. O instalador é executado com um comando que descarrega e executa o script (<code>bash -c \"$(wget -qLO - …)\"</code>) e pode descarregar <code>jq</code> da sua versão oficial no GitHub. Este <em>comportamento</em> pode ativar análises heurísticas; esse relatório histórico não avalia todos os downloads futuros.",
+    "p2Rich": "O ProxMenux é totalmente de código aberto e pode analisar o script de instalação linha a linha: <scriptlink>install_proxmenux.sh</scriptlink>. Mais contexto na <issuelink>issue #162</issuelink>."
+  }
+}
diff --git a/web/messages/pt/docs/about/index.json b/web/messages/pt/docs/about/index.json
new file mode 100644
index 00000000..47bd27c2
--- /dev/null
+++ b/web/messages/pt/docs/about/index.json
@@ -0,0 +1,67 @@
+{
+  "meta": {
+    "title": "Sobre o projeto | Documentação ProxMenux",
+    "description": "Sobre o ProxMenux: objetivos do projeto, colaboradores, FAQ e Código de Conduta. Ferramenta de gerenciamento orientada por menus de código aberto para Proxmox VE 8+, construída e mantida pela MacRimi com uma pequena equipe de testadores e colaboradores.",
+    "ogTitle": "Sobre o projeto | Documentação ProxMenux",
+    "ogDescription": "Sobre ProxMenux — ferramenta de gestão orientada por menus de código aberto para Proxmox VE 8+."
+  },
+  "header": {
+    "title": "Sobre",
+    "description": "Informações do projeto, perguntas frequentes, colaboradores e código de conduta. O ProxMenux é uma ferramenta de gestão por menus, de código aberto, para Proxmox VE 8+, desenvolvida e mantida por MacRimi com a ajuda de uma pequena equipa de testes e colaboradores.",
+    "section": "Sobre"
+  },
+  "callout": {
+    "title": "Código aberto, baseado na comunidade",
+    "body": "O ProxMenux é distribuído sob a licença GPL-3.0 e desenvolvido publicamente no GitHub. Cada script pode ser revisto e cada alteração rastreada. São bem-vindos relatos de erros, ideias, código e testes."
+  },
+  "section": {
+    "heading": "Nesta secção",
+    "options": [
+      {
+        "icon": "HelpCircle",
+        "href": "/docs/about/faq",
+        "title": "FAQ",
+        "description": "Perguntas frequentes: o que é o ProxMenux, instalação, compatibilidade, personalização, atualizações, segurança, uso em produção e desinstalação."
+      },
+      {
+        "icon": "Users",
+        "href": "/docs/about/contributors",
+        "title": "Colaboradores",
+        "description": "Reconhecimento às pessoas que tornam o ProxMenux possível: quem testa, revê e desenvolve cada versão."
+      },
+      {
+        "icon": "ScrollText",
+        "href": "/docs/about/code-of-conduct",
+        "title": "Código de Conduta",
+        "description": "Valores do projeto, expectativas de responsabilidade de código e diretrizes de contribuição. Leitura necessária antes de abrir um PR ou relatório."
+      }
+    ]
+  },
+  "involved": {
+    "heading": "Participe",
+    "intro": "Três lugares para se envolver com o projeto:",
+    "cards": [
+      {
+        "href": "https://github.com/MacRimi/ProxMenux/issues/new",
+        "title": "🐛 Comunicar um erro",
+        "description": "GitHub Issues — inclua os registos e os passos para reproduzir o problema."
+      },
+      {
+        "href": "https://github.com/MacRimi/ProxMenux/discussions",
+        "title": "💡 Sugerir uma funcionalidade",
+        "description": "GitHub Discussions — partilhe ideias antes de abrir um PR."
+      },
+      {
+        "href": "https://github.com/MacRimi/ProxMenux/pulls",
+        "title": "🔀 Enviar um PR",
+        "description": "GitHub Pull Requests — leia primeiro o Código de Conduta."
+      }
+    ]
+  },
+  "support": {
+    "heading": "Apoiar o projecto",
+    "introRich": "Se o ProxMenux lhe poupa tempo, a forma mais simples de o dar a conhecer é <starlink>atribuir uma ⭐ ao repositório no GitHub</starlink>. Se quiser ir mais longe:",
+    "kofiLabel": "Apoio em Ko-fi",
+    "kofiOutro": " — compra um café ao mantenedor e mantém o desenvolvimento."
+  }
+}
diff --git a/web/messages/pt/docs/backup-restore/creating-backups.json b/web/messages/pt/docs/backup-restore/creating-backups.json
new file mode 100644
index 00000000..99ed48c1
--- /dev/null
+++ b/web/messages/pt/docs/backup-restore/creating-backups.json
@@ -0,0 +1,220 @@
+{
+  "meta": {
+    "title": "Criação de backups — fluxo de backup interativo ProxMenux",
+    "description": "O fluxo de backup interativo do ProxMenux: dois pontos de entrada (o menu TUI do Scripts e a interface web do Monitor), três destinos, dois modos de perfil, uma etapa de preparação temporária e uma janela de confirmação. A página descreve a matriz de seis opções, os perfis padrão e personalizado e o que o usuário vê desde a seleção do backup até o arquivo ser salvo no destino.",
+    "ogTitle": "Backup ProxMenux — criando backups",
+    "ogDescription": "O fluxo de backup interativo com três destinos, dois perfis e uma etapa comum de preparação temporária.",
+    "twitterTitle": "Criando backups ProxMenux",
+    "twitterDescription": "Fluxo de backup interativo com três destinos e dois modos de perfil."
+  },
+  "header": {
+    "title": "Criando backups",
+    "description": "O fluxo de backup interativo: escolha um destino e um perfil, confira o resumo de confirmação e acompanhe o salvamento do arquivo. Os dois pontos de entrada compartilham o mesmo backend e produzem arquivos idênticos.",
+    "section": "Cópias de segurança e restauro"
+  },
+  "intro": {
+    "title": "Dois pontos de entrada, funcionalidade idêntica",
+    "body": "A TUI do Scripts e a interface web do Monitor oferecem <strong>exatamente as mesmas funções</strong>. Cada backup — manual ou agendado — passa pela mesma matriz de escolha (três destinos × dois perfis) e chama a mesma função do backend em cada célula (<code>_bk_pbs</code>, <code>_bk_borg</code> ou <code>_bk_local</code>). Os arquivos produzidos pelos dois pontos de entrada são indistinguíveis. A escolha depende da preferência: a TUI é adequada para SSH e scripts; o Monitor oferece controle por cliques junto às visualizações de notificações e acompanhamento dos logs."
+  },
+  "entryPoints": {
+    "heading": "Os dois pontos de entrada",
+    "rows": [
+      {
+        "entry": "ProxMenux Scripts (TUI)",
+        "path": "menu → Utilities → Host Config Backup",
+        "detail": "Fluxo baseado em diálogo, SSH-friendly. O menu principal apresenta as seis opções diretamente. Utiliza <code>backup_menu</code> em <code>backup_host.sh</code>."
+      },
+      {
+        "entry": "ProxMenux Monitor (UI Web)",
+        "path": "Backups tab → Create backup",
+        "detail": "Fluxo guiado por um assistente. As mesmas seis opções são apresentadas em um formulário de duas etapas (destino → perfil). As mesmas funções do backend são chamadas pela API Flask."
+      }
+    ]
+  },
+  "modes": {
+    "heading": "Cópias de segurança manuais vs agendadas",
+    "body": "Os backups podem ser produzidos em dois modos: <strong>manual</strong> (o fluxo interativo descrito nesta página — o usuário escolhe um destino e um perfil de um menu e acompanha o salvamento do arquivo) ou <strong>agendado</strong> (um trabalho sem acompanhamento que roda em um temporizador no estilo cron e aplica a retenção configurada no trabalho). Ambos os modos suportam os mesmos três destinos e os mesmos dois perfis, e ambos estão disponíveis em ambos os pontos de entrada — o menu Scripts TUI e a aba Monitor Backups. Trabalhos agendados usam as mesmas funções de infraestrutura que o fluxo manual através do <code>run_scheduled_backup.sh</code>; os arquivos produzidos são indistinguíveis.",
+    "seeAlso": "A página de trabalhos agendados cobre o fluxo completo, incluindo como criar um trabalho, anexá-lo a um temporizador existente PVE vzdump e configurar os valores de retenção.",
+    "monitorAlt": "Página de backups do ProxMenux Monitor que mostra a nova janela de backup agendada com os campos de destino, perfil, agenda e retenção.",
+    "monitorCaption": "Backup agendado — ProxMenux Monitor. A mesma janela do assistente usada para criar um backup manual inclui, na parte inferior, os campos de agendamento e retenção para execução sem acompanhamento."
+  },
+  "matrix": {
+    "heading": "A matriz de seis opções",
+    "intro": "A escolha determina tanto o backend executado quanto a estratégia de seleção de caminhos. Consulte as páginas de cada destino para os detalhes de configuração de cada célula.",
+    "rows": [
+      {
+        "combo": "1",
+        "destination": "PBS",
+        "profile": "Padrão",
+        "action": "Envia o perfil padrão mais extras persistentes para um repositório PBS configurado."
+      },
+      {
+        "combo": "2",
+        "destination": "Borg",
+        "profile": "Padrão",
+        "action": "Cria um arquivo com o perfil padrão mais extras persistentes no repositório Borg selecionado."
+      },
+      {
+        "combo": "3",
+        "destination": "Local",
+        "profile": "Padrão",
+        "action": "Escreve um arquivo <code>.tar.zst</code> com o perfil padrão mais extras persistentes para o alvo local configurado."
+      },
+      {
+        "combo": "4",
+        "destination": "PBS",
+        "profile": "Personalizado",
+        "action": "Abre o seletor de caminhos antes do envio ao PBS; o usuário marca os caminhos e pode adicionar novos."
+      },
+      {
+        "combo": "5",
+        "destination": "Borg",
+        "profile": "Personalizado",
+        "action": "Abre o seletor de caminhos antes de criar o arquivo Borg."
+      },
+      {
+        "combo": "6",
+        "destination": "Local",
+        "profile": "Personalizado",
+        "action": "Abre o selecionador de caminho antes de escrever o <code>.tar.zst</code> local."
+      }
+    ]
+  },
+  "profiles": {
+    "heading": "Perfil padrão vs personalizado",
+    "defaultTitle": "Perfil padrão",
+    "defaultBody": "O perfil padrão é a lista com curadoria de <code>hb_default_profile_paths</code> (documentada em <em>Como funciona</em> sob <em>Categorias de caminho</em>) além de cada entrada no arquivo de extras persistente <code>/usr/local/share/proxmenux/backup-extra-paths.txt</code>. O usuário confirma as opções de destino e criptografia e o backup prossegue sem mais seleção de caminho.",
+    "customTitle": "Perfil personalizado",
+    "customBody": "O perfil personalizado abre uma lista com todos os caminhos do perfil padrão (desmarcados) e todos os extras persistentes (pré-marcados, com o prefixo <code>[+]</code>). O usuário marca os caminhos para esta execução e pode pressionar <em>Adicionar caminho personalizado</em> para incluir um novo caminho absoluto. Todo caminho adicionado durante esse processo é salvo em <code>backup-extra-paths.txt</code>, para que os próximos backups o incluam automaticamente. Desmarcar um extra persistente o exclui apenas desta execução, sem removê-lo do arquivo — a remoção é feita pela ação separada <em>Gerenciar caminhos personalizados</em>, fora do fluxo de backup.",
+    "customPickerAlt": "Lista de verificação de perfil personalizada que mostra os caminhos de perfil padrão (desmarcados) e extras persistentes (pré-marcados com um prefixo [+]), além de botões para adicionar um novo caminho ou confirmar a seleção.",
+    "customPickerCaption": "Perfil personalizado — o seletor de caminhos. Os caminhos do perfil padrão estão desmarcados; os extras persistentes aparecem pré-marcados com o prefixo [+]. O usuário marca os caminhos para esta execução.",
+    "manageCustomAlt": "Menu de gerenciamento de caminhos personalizados com a lista de extras persistentes e opções para adicionar, remover ou editar.",
+    "manageCustomCaption": "Gerencie caminhos personalizados — o ponto de entrada onde extras persistentes são adicionados ou removidos. Cada caminho listado aqui é incluído automaticamente em backups de modo padrão sem precisar abrir o seletor Personalizado."
+  },
+  "commonPipeline": {
+    "heading": "O que é executado independentemente do destino",
+    "intro": "Depois de definir o perfil, cada backend executa o mesmo processo de preparação temporária antes de seguir para seu próprio método de envio. <code>hb_prepare_staging</code> monta a árvore do arquivo em <code>/tmp/proxmenux-DESTINATION-stage.XXXXXX</code> e preenche cada um dos três blocos de dados.",
+    "steps": [
+      {
+        "step": "1",
+        "name": "Montagem do rootfs",
+        "detail": "Executa <code>rsync -a</code> para cada caminho selecionado em <code>staging_root/rootfs/</code>. O banco de dados pmxcfs em <code>/var/lib/pve-cluster/config.db</code> é capturado separadamente via <code>sqlite3 .backup</code> para produzir um instantâneo consistente sem parar o cluster, e os sidecars <code>.db-wal</code> / <code>.db-shm</code> são excluídos do rsync; quando o <code>sqlite3</code> não está disponível é salvo um arquivo <code>config.db.raw-fallback</code>, que a restauração adota como banco de dados durante a importação. Os subcaminhos voláteis (histórico do bash, caches, lixo) são excluídos do <code>/root/</code>. Caminhos ausentes da fonte são registrados em <code>metadata/missing_paths.txt</code> sem parar o backup."
+      },
+      {
+        "step": "2",
+        "name": "Geração do manifesto",
+        "detail": "<code>build_manifest.sh</code> coordena os seis coletores e grava <code>manifest.json</code> na raiz da área de preparação temporária. Se um coletor falhar, a seção afetada usa um valor padrão vazio documentado; o manifesto continua válido."
+      },
+      {
+        "step": "3",
+        "name": "Inventário de pacotes",
+        "detail": "<code>apt-mark showmanual</code> é capturada literalmente em <code>metadata/packages.manual.list</code>. O estado do componente já está dentro do rootfs restaurado (<code>components_status.json</code>) porque o <code>/usr/local/share/proxmenux/</code> faz parte do perfil padrão."
+      },
+      {
+        "step": "4",
+        "name": "Informações da execução",
+        "detail": "<code>metadata/run_info.env</code> registra a identidade de execução de backup — hostname, timestamp, versão do kernel — usada pela verificação de compatibilidade da restauração para determinar a direção do cross-kernel."
+      },
+      {
+        "step": "5",
+        "name": "Notificação (início)",
+        "detail": "<code>hb_notify_lifecycle \"start\"</code> é acionado. Se as notificações estiverem configuradas no Monitor, um evento <em>Backup do host iniciado</em> é enviado ao usuário. Nada é enviado se não houver canais configurados."
+      }
+    ]
+  },
+  "included": {
+    "heading": "O que entra e o que fica fora",
+    "intro": "Cada caminho no perfil resolvido (padrão + extras persistentes + seleção de modo personalizado) é copiado com <code>rsync -aAXH --numeric-ids</code>. Uma lista de exclusão compartilhada aplica-se a cada caminho, e dois diretórios carregam exclusões adicionais específicas do caminho.",
+    "globalTitle": "Exclusões globais (aplicadas a cada caminho)",
+    "globalItems": [
+      "<code>images/</code> — dumps de imagens.",
+      "<code>dump/</code> — saídas vzdump.",
+      "<code>tmp/</code> — ficheiros temporários.",
+      "<code>*.log</code> — ficheiros de registo."
+    ],
+    "rootTitle": "Exclusões <code>/root/</code>",
+    "rootBody": "<code>/root/</code> faz parte do perfil padrão para incluir os scripts e a configuração do usuário no arquivo. Os subcaminhos voláteis são excluídos:",
+    "rootItems": [
+      "<code>.bash_history</code>",
+      "<code>.cache/</code>",
+      "<code>tmp/</code>",
+      "<code>.local/share/Trash/</code>"
+    ],
+    "proxmenuxTitle": "Exclusões <code>/usr/local/share/proxmenux/</code>",
+    "proxmenuxBody": "Este diretório envia apenas o estado do usuário — <code>components_status.json</code>, preferências, cache pós-instalação. O código que o destino já terá a partir de sua própria instalação ProxMenux está excluído para que uma restauração não sobrescreva os binários atuais do alvo com os mais antigos:",
+    "proxmenuxItems": [
+      "<code>restore-pending/</code>, <code>scripts/</code>, <code>web/</code>",
+      "<code>monitor-app/</code>, <code>monitor-app.*/</code>, <code>AppImage/</code>",
+      "<code>images/</code>, <code>json/</code>",
+      "<code>utils.sh</code>, <code>helpers_cache.json</code>",
+      "<code>ProxMenux-Monitor.AppImage*</code>, <code>install_proxmenux*.sh</code>"
+    ],
+    "notInProfileTitle": "Caminhos fora do perfil",
+    "notInProfileBody": "Qualquer coisa não listada no <code>hb_default_profile_paths</code> e não adicionada como um extra personalizado ou persistente não faz parte do backup. Exemplos notáveis:",
+    "notInProfileItems": [
+      "<strong>Discos de VMs e LXC</strong> — manipulado por <code>vzdump</code>, não por esta característica. Os arquivos de configuração de hóspedes sob <code>/etc/pve/nodes/*/qemu-server/*.conf</code> e <code>lxc/*.conf</code> são capturados (eles vivem sob <code>/etc/pve</code>) para que a restauração reproduza o inventário; os próprios discos são re-anexados a partir de um backup existente vzdump/PBS.",
+      "<strong><code>/boot</code> e <code>/boot/efi</code></strong> — binários do kernel, initramfs e a partição UEFI ESP são regeneradas pelo próprio alvo <code>update-initramfs</code>, <code>update-grub</code> ou <code>proxmox-boot-tool refresh</code> após a restauração. O carregador de arranque nunca é copiado na íntegra.",
+      "<strong>Sistemas de arquivos de tempo de execução e sistema</strong> — <code>/proc</code>, <code>/sys</code>, <code>/dev</code> e <code>/run</code> são pseudo-sistemas de arquivos produzidos pelo kernel e udev; eles não são persistidos em nenhum lugar.",
+      "<strong>Binários dos pacotes em <code>/usr/bin</code>, <code>/usr/lib</code>, <code>/lib</code>, <code>/sbin</code></strong> — reinstalados pelo APT do destino a partir de <code>packages.manual.list</code>.",
+      "<strong><code>/var/log/</code>, <code>/var/tmp/</code>, <code>/var/cache/</code></strong> — estado de execução por host, não restaurado.",
+      "<strong><code>/home/USER</code></strong> — não no perfil padrão. Adicione-o como um caminho personalizado quando um sistema carrega diretórios domésticos do usuário que devem sobreviver a uma restauração."
+    ],
+    "customPathsTitle": "Como os caminhos personalizados são tratados",
+    "customPathsBody": "Um caminho personalizado adicionado inline em modo Personalizado ou persistido em <code>backup-extra-paths.txt</code> passa pelo mesmo pipeline <code>rsync</code> como caminhos de perfil padrão. Exclusões globais aplicam-se. Se o caminho personalizado estiver sob <code>/root/</code> ou <code>/usr/local/share/proxmenux/</code>, as exclusões específicas do caminho acima ainda se aplicam. Cada caminho arquivado — padrão ou personalizado — é gravado em <code>metadata/paths_archived.txt</code>. Caminhos que não existem na fonte são gravados em <code>metadata/missing_paths.txt</code> sem parar o backup."
+  },
+  "archiveStructure": {
+    "heading": "Estrutura do arquivo",
+    "intro": "O diretório de preparação temporária produzido por cada infraestrutura segue o mesmo layout, independentemente do destino. O tarball, PBS <code>.pxar</code> ou arquivo Borg armazena esta árvore sem alterações.",
+    "tree": "backup-[timestamp]/\n├── manifest.json                  # structured host state (kernel_params, hardware, storage, guests, components, source_host)\n├── metadata/\n│   ├── packages.manual.list       # output of apt-mark showmanual\n│   ├── run_info.env               # hostname, timestamp, kernel version, pmxcfs method\n│   ├── paths_archived.txt         # exact list of paths that reached rootfs/\n│   └── missing_paths.txt          # paths from the profile absent on source\n└── rootfs/\n    ├── etc/                       # /etc/pve, /etc/network, /etc/systemd/network, /etc/ssh, /etc/apt, ...\n    ├── root/                      # /root without volatile subpaths\n    ├── usr/local/                 # /usr/local/bin, /usr/local/sbin, /usr/local/share/proxmenux (state only)\n    └── var/                       # /var/lib/pve-cluster (config.db via sqlite3 .backup), /var/spool/cron/crontabs"
+  },
+  "confirmation": {
+    "heading": "Resumo da confirmação",
+    "body": "Antes da infra- estrutura escrever qualquer coisa para o destino, o ProxMenux mostra uma janela sumária com o nome do destino, ID de backup ou arquivo, estado de criptografia e a lista de caminhos copiados. Cancelar aqui aborta o backup de forma limpa — o diretório de preparação temporária é removido pelo gancho <code>trap</code> definido na função de infraestrutura e nenhum dado parcial atinge o destino."
+  },
+  "writing": {
+    "heading": "Gravando para o destino",
+    "intro": "Após a confirmação, cada backend executa sua própria etapa de gravação. As páginas dos destinos descrevem o funcionamento; os elementos comuns são o log, o arquivo auxiliar e a notificação de conclusão.",
+    "rows": [
+      {
+        "topic": "Arquivo de registro",
+        "detail": "Cada infra- estrutura escreve sua saída completa para <code>/tmp/proxmenux-DESTINATION-backup-YYYYMMDD_HHMMSS.log</code> e, em caso de falha, oferece abri-la em uma janela de rolagem. O caminho do log é impresso no resumo de conclusão somente quando o arquivo tem conteúdo."
+      },
+      {
+        "topic": "Sidecar (apenas local)",
+        "detail": "<code>hb_write_archive_sidecar</code> solta um <code>*.proxmenux.json</code> ao lado do arquivo local para que o monitor o identifique como um backup de host ProxMenux mesmo depois de mover ou renomear."
+      },
+      {
+        "topic": "Notificação (conclusão/falha)",
+        "detail": "<code>hb_notify_lifecycle \"complete\"</code> ou <code>\"fail\"</code> é acionado com a duração, o tamanho do arquivo e — em caso de falha — a última linha do log que parece indicar um erro."
+      }
+    ]
+  },
+  "finishedScreens": {
+    "heading": "Como é uma cópia de segurança terminada",
+    "intro": "O mesmo evento de conclusão é exibido pelos dois pontos de entrada. O TUI escreve um bloco de resumo para o terminal; a aba Backups do Monitor mostra a execução na lista de arquivos com o tamanho, a duração e os crachás de status.",
+    "scriptsAlt": "ProxMenux Scripts TUI mostrando um backup final do host — destino, ID de backup, caminho de instantâneo, tamanho de dados, duração e estado de criptografia.",
+    "scriptsCaption": "Cópia de segurança terminada — ProxMenux Scripts (TUI). O bloco de conclusão imprime o destino, backup ID, instantâneo resultante ou nome do arquivo, tamanho dos dados, duração e estado de criptografia.",
+    "monitorAlt": "Página de backups ProxMenux Monitor mostrando uma entrada de backup de host terminada com tamanho, duração, crachá de método e indicador de criptografia.",
+    "monitorCaption": "Backup concluído — aba Backups do ProxMenux Monitor. O novo backup aparece na lista de arquivos com o indicador do método de destino, tamanho, duração e — quando aplicável — o ícone de cadeado da criptografia."
+  },
+  "whereNext": {
+    "heading": "Para onde ir a seguir",
+    "items": [
+      {
+        "label": "Destinos",
+        "href": "/docs/backup-restore/destinations",
+        "tail": " — detalhes de configuração para Local, PBS e Borg."
+      },
+      {
+        "label": "Trabalhos agendados",
+        "href": "/docs/backup-restore/scheduled-jobs",
+        "tail": " — executar o mesmo backup sem acompanhamento em um cronograma em vez de interativamente."
+      },
+      {
+        "label": "Restauração",
+        "href": "/docs/backup-restore/restoring",
+        "tail": " — o fluxo que consome o que esta página produz."
+      }
+    ]
+  }
+}
diff --git a/web/messages/pt/docs/backup-restore/cross-kernel.json b/web/messages/pt/docs/backup-restore/cross-kernel.json
new file mode 100644
index 00000000..e20f608e
--- /dev/null
+++ b/web/messages/pt/docs/backup-restore/cross-kernel.json
@@ -0,0 +1,170 @@
+{
+  "meta": {
+    "title": "Restauro entre kernels diferentes — deteção, filtragem segura e adaptação | ProxMenux",
+    "description": "Como ProxMenux restaura um backup de host em um alvo executando uma versão diferente do kernel principal. Documenta como a direção do descompasso é detectada, o filtro seguro-subset que salta caminhos de inicialização-críticos quando o alvo executa um kernel mais novo do que o backup, e a hidratação quatro fases do kernel-agnóstico que reaplica a sintonia do usuário como IOMMU, IDs VFIO e tokens personalizados cmdline sem copiar arquivos de kernel-ligados verbatim.",
+    "ogTitle": "ProxMenux Backup – restauração e hidratação do kernel cruzado",
+    "ogDescription": "Restauração entre versões do kernel que considera a direção da mudança, com filtro seguro e hidratação independente do kernel.",
+    "twitterTitle": "Restauro entre kernels diferentes | ProxMenux",
+    "twitterDescription": "Como ProxMenux lida com uma restauração quando o kernel alvo difere do backup."
+  },
+  "header": {
+    "title": "Restauração do kernel cruzado",
+    "description": "Como o ProxMenux lida com uma restauração quando o host alvo executa um kernel diferente daquele gravado no backup — especialmente quando o alvo executa um kernel mais recente. Documenta como a diferença é detectada, como caminhos críticos de inicialização que podem quebrar o alvo são filtrados, e como a configuração do próprio usuário é reaplicada sem copiar arquivos ligados ao kernel verbatim.",
+    "section": "Cópias de segurança e restauro"
+  },
+  "intro": {
+    "title": "Cada salto do kernel é tratado de forma diferente",
+    "body": "O kernel de um host Proxmox é identificado por uma string de versão como <code>6.17.13-2-pve</code>. Os dois primeiros números (<strong>6.17</strong> neste exemplo) definem a versão principal: quando eles mudam, alguns arquivos de configuração escritos para o kernel anterior podem não ser válidos no novo. Quando a restauração detecta que o backup e o alvo têm diferentes versões principais do kernel, os ramos de fluxo baseados na direção do salto — se o backup é mais antigo ou mais recente do que o alvo — porque os dois casos têm modos de falha opostos. Backups mais recentes do que o destino restaurar limpamente como-is (bench-verified em vários saltos do kernel). Backups mais antigos do que o alvo precisam de um filtro para evitar quebrar a inicialização do alvo com configuração escrita para um kernel que desde então mudou."
+  },
+  "directionCheck": {
+    "heading": "Verificação da direcção",
+    "intro": "Durante a verificação de compatibilidade, <code>hb_compat_check</code> compara o kernel registrado no manifesto do backup com o kernel atual do alvo (<code>uname -r</code>) e classifica a restauração em um dos três casos, armazenados na variável interna <code>HB_COMPAT_KERNEL_DIRECTION</code>:",
+    "rows": [
+      {
+        "direction": "same",
+        "condition": "A versão principal do kernel corresponde entre backup e alvo.",
+        "behavior": "O fluxo total de restauração corre inalterado. Sem filtro extra, sem hidratação, sem aviso especial na UI."
+      },
+      {
+        "direction": "bk_newer",
+        "condition": "O kernel de backup é mais novo do que o do alvo (por exemplo: o backup foi feito no kernel 7.0 e o alvo executa o kernel 6.17).",
+        "behavior": "O fluxo completo permanece inalterado, como em <code>same</code>, sem filtro. Nos testes relatados, os drivers foram reinstalados para o kernel de destino, a configuração IOMMU foi aplicada e as VMs iniciaram com passthrough de GPU."
+      },
+      {
+        "direction": "bk_older",
+        "condition": "O kernel do backup é MAIS ANTIGO que o de destino (por exemplo: backup no 6.17, destino no 7.0).",
+        "behavior": "O filtro seguro e a hidratação em quatro fases abaixo são ativados. A restauração prossegue — o alvo reproduz a fonte, mas os arquivos de inicialização críticos não são copiados literalmente."
+      }
+    ]
+  },
+  "whyBkNewerIsSafe": {
+    "heading": "Por que um backup com um kernel mais novo do que o alvo restaura inalterado",
+    "body": "Quando a restauração corre contra um alvo com um kernel <em>mais antigo</em> do que o registrado no backup, cada mecanismo que a restauração depende é independente da versão do kernel. Os instaladores de driver GPU e outros instaladores de dispositivos PCI detectam o kernel em execução com <code>uname -r</code> e compilam DKMS contra qualquer que seja o alvo. O pacote APT install puxa binários construídos para a distribuição do alvo. Os tokens cmdline IOMMU como <code>intel_iommu=on</code> são estáveis nas principais versões do kernel. O backup carrega caminhos escritos sob um kernel mais recente, mas esses caminhos (listas-negra de módulos, padrões GRUB, configuração initramfs) ainda são sintaxe válida no antigo - kernels ignoram tokens que não reconhecem em vez de falhar. Este caso é, na prática, equivalente a uma restauração do mesmo núcleo, e o ProxMenux trata-o como tal."
+  },
+  "safeSubsetFilter": {
+    "heading": "O filtro de segurança (apenas quando o kernel alvo é mais novo)",
+    "intro": "Quando o kernel alvo é mais novo do que o backup, a verificação de compatibilidade adiciona 16 Caminhos críticos de arranque de <code>hb_unsafe_paths_cross_version</code> para <code>RS_SKIP_PATHS</code>. Estes caminhos são excluídos da restauração porque escrever uma versão deles de um kernel mais antigo sobre um alvo executando um mais recente causou pânico do kernel em testes de banco. Os caminhos abrangem cinco categorias:",
+    "categoryRows": [
+      {
+        "category": "Gestor de arranque",
+        "paths": "<code>/etc/default/grub</code>, <code>/etc/kernel</code>",
+        "reason": "GRUB predefinições ligadas à ordem anterior do kernel, e estado proxmox-boot-tool (cmdline, ESP UUIDs, ganchos) que referencia caminhos e identificadores da instalação mais antiga."
+      },
+      {
+        "category": "Módulos de kernel e artefatos de inicialização",
+        "paths": "<code>/etc/modules-load.d</code>, <code>/etc/modprobe.d</code>, <code>/etc/initramfs-tools</code>",
+        "reason": "Listas de autocarregamento que podem referenciar módulos renomeados entre majors de kernel, opções de módulo que podem não se aplicar, ganchos initramfs escritos para o kernel antigo."
+      },
+      {
+        "category": "Stack de armazenamento e identidade do sistema de arquivos",
+        "paths": "<code>/etc/fstab</code>, <code>/etc/multipath</code>, <code>/etc/iscsi</code>, <code>/etc/udev/rules.d</code>, <code>/etc/zfs</code>",
+        "reason": "UUIDs que podem não existir nesta instalação, drivers multicaminho que mudam entre kernels, parâmetros iSCSI que evoluem, regras udev que podem se ligar a subsistemas inexistentes, estado ZFS (<code>zpool.cache</code> + <code>hostid</code>) que podem bloquear o pool como estrangeiro."
+      },
+      {
+        "category": "Fontes APT",
+        "paths": "<code>/etc/apt</code>",
+        "reason": "As suítes de código fonte APT podem desencadear uma redução de pacotes críticos na próxima atualização."
+      },
+      {
+        "category": "systemd",
+        "paths": "<code>/etc/systemd/system</code>, <code>/etc/systemd/journald.conf</code>, <code>/etc/systemd/logind.conf</code>, <code>/etc/systemd/system.conf</code>, <code>/etc/systemd/user.conf</code>",
+        "reason": "Sobrescritas de unidades e links .wants ligados à versão principal antiga do systemd; chaves de configuração que podem não ser válidas na versão nova."
+      }
+    ],
+    "outroBody": "O filtro é executado ANTES da janela de confirmação para que o utilizador veja a lista exacta dos caminhos que serão ignorados, categorizados pela razão. A restauração continua — tudo o resto (configuração VM/LXC, rede, /etc/pve, usuários, cron, ProxMenux estado, pacotes, drivers, /root) é restaurado normalmente."
+  },
+  "hydration": {
+    "heading": "Hidratação independente do kernel",
+    "intro": "O filtro omite arquivos críticos; a hidratação reaplica ajustes selecionados: cmdline IOMMU, IDs VFIO, <code>GRUB_TIMEOUT</code> personalizado e listas de bloqueio nvidia. Executa se o kernel de destino for mais novo. A mesclagem cmdline preserva chaves do destino e adiciona módulos ausentes. Valores GRUB e arquivos permitidos podem substituir conteúdo diferente no destino. Repetir as mesmas entradas é idempotente.",
+    "phaseRows": [
+      {
+        "phase": "1a — Via GRUB",
+        "detail": "Para hosts GRUB (instalações ext4/lvm). <code>_rs_hyd_grub</code> mescla os parâmetros de <code>manifest.kernel_params.cmdline_extra</code> do backup em <code>GRUB_CMDLINE_LINUX_DEFAULT</code> do destino, ignorando chaves já presentes. Depois restaura as chaves permitidas <code>GRUB_*</code> (<code>GRUB_TIMEOUT</code>, <code>GRUB_TIMEOUT_STYLE</code>, <code>GRUB_DEFAULT</code>, <code>GRUB_TERMINAL</code>, <code>GRUB_DISABLE_OS_PROBER</code>, <code>GRUB_SERIAL_COMMAND</code>, <code>GRUB_GFXMODE</code>, <code>GRUB_GFXPAYLOAD_LINUX</code>) de <code>/etc/default/grub</code> do backup se seus valores diferirem do destino."
+      },
+      {
+        "phase": "1b — systemd-boot / ZFS",
+        "detail": "Para systemd-boot (normalmente ZFS na raiz). <code>_rs_hyd_kernel_cmdline</code> mescla parâmetros do usuário de <code>cmdline_extra</code> em <code>/etc/kernel/cmdline</code> do destino, preservando os parâmetros de inicialização <code>root=</code>, <code>boot=</code> e <code>rootflags=</code> do destino."
+      },
+      {
+        "phase": "2 — fusão /etc/modules",
+        "detail": "<code>_rs_hyd_modules</code> adiciona os módulos de <code>manifest.kernel_params.modules_loaded_at_boot</code> que estão na lista branca (<code>vfio</code>, <code>vfio_pci</code>, <code>vfio_iommu_type1</code>, <code>vfio_virqfd</code>, <code>kvm</code>, <code>kvm_intel</code>, <code>kvm_amd</code>, <code>nvidia</code>, <code>nvidia_drm</code>, <code>nvidia_modeset</code>, <code>nvidia_uvm</code>, <code>i915</code>, <code>xe</code>) E ainda não está presente no objectivo <code>/etc/modules</code>."
+      },
+      {
+        "phase": "3 — Cópia de ficheiros na lista branca",
+        "detail": "<code>_rs_hyd_files</code> copia arquivos criados pelo usuário dos rootfs de estadiamento para o alvo ao vivo quando o conteúdo difere. A lista branca abrange arquivos VFIO/nvidia/blacklist sob <code>/etc/modprobe.d</code>, <code>/etc/modules-load.d</code>, e a regra de ligação ProxMenux VFIO + nvidia regras udev sob <code>/etc/udev/rules.d</code>. Arquivos distro-proprietários (<code>pve-blacklist.conf</code>, <code>mdadm.conf</code>, <code>nvme.conf</code>) são intencionalmente excluídos — seu conteúdo evolui entre lançamentos."
+      },
+      {
+        "phase": "4 — Forçar regeneração após a inicialização",
+        "detail": "As quatro fases escrevem diretamente para o alvo vivo fora do processo de restauração normal. Para fazer com que os tokens/módulos/arquivos fundidos façam efeito na próxima inicialização, o <code>HB_HYDRATION_APPLIED=1</code> propaga-se através do <code>plan.env</code> ao <code>apply_pending_restore.sh</code>, que força o <code>NEEDS_INITRAMFS=1</code> e o <code>NEEDS_GRUB=1</code> independentemente do que estava na lista de aplicações. O expedidor pós-boot regenera initramfs e atualiza o carregador de boot."
+      }
+    ]
+  },
+  "planCommit": {
+    "heading": "Plano vs commit — o utilizador vê uma antevisão primeiro",
+    "body": "A hidratação funciona em dois modos. Antes da janela de confirmação, o ProxMenux executa o <code>_rs_apply_bk_older_hydration</code> no modo <code>plan</code>: calcula exatamente o que seria mesclado, povoa o <code>RS_HYDRATION_SUMMARY</code> com um bloco verde listando cada ação e retorna sem escrever. O diálogo de confirmação mostra que o bloco verde ao lado da lista amarela dos caminhos excluídos, para que o usuário veja ANTES o que será reaplicado automaticamente. Depois que o usuário confirma, o ProxMenux executa novamente o mesmo helper no modo <code>commit</code> — as mesmas fases, a mesma lógica, mas desta vez cada fase escreve para o alvo ao vivo. Cancelar a janela de confirmação deixa o alvo intocado."
+  },
+  "flowDiagram": {
+    "heading": "O fluxo quando o kernel alvo é mais novo do que o backup",
+    "intro": "Os passos adicionados quando o kernel alvo é mais novo sentam-se dentro do fluxo de restauração normal. Tudo o resto — aplicar, preparar, instalar o pacote, enviar pós-boot — é executado de forma idêntica a uma restauração do mesmo kernel.",
+    "diagram": "  ┌────────────────────────────────────────────────────────────┐\n  │ hb_compat_check                                             │\n  │   HB_COMPAT_KERNEL_DIRECTION = bk_older                     │\n  └───────────────────────────┬────────────────────────────────┘\n                              │\n                              ▼\n  ┌────────────────────────────────────────────────────────────┐\n  │ Add 16 boot-critical paths to RS_SKIP_PATHS                 │\n  │   /etc/default/grub, /etc/kernel, /etc/modules-load.d, ...  │\n  └───────────────────────────┬────────────────────────────────┘\n                              │\n                              ▼\n  ┌────────────────────────────────────────────────────────────┐\n  │ _rs_apply_bk_older_hydration \"plan\"                         │\n  │   Compute what would be merged                              │\n  │   Populate RS_HYDRATION_SUMMARY (green block)               │\n  │   No writes                                                 │\n  └───────────────────────────┬────────────────────────────────┘\n                              │\n                              ▼\n  ┌────────────────────────────────────────────────────────────┐\n  │ Confirmation dialog                                         │\n  │   Amber: paths skipped by safe-subset filter                │\n  │   Green: tokens/files reapplied by hydration                │\n  │   User accepts or cancels                                   │\n  └───────────────────────────┬────────────────────────────────┘\n                              │ (accepted)\n                              ▼\n  ┌────────────────────────────────────────────────────────────┐\n  │ _rs_apply_bk_older_hydration \"commit\"                       │\n  │   Phase 1a/1b: merge cmdline tokens + GRUB keys             │\n  │   Phase 2: append modules to /etc/modules                   │\n  │   Phase 3: copy whitelisted vfio/nvidia files               │\n  │   Set HB_HYDRATION_APPLIED=1                                │\n  └───────────────────────────┬────────────────────────────────┘\n                              │\n                              ▼\n  ┌────────────────────────────────────────────────────────────┐\n  │ Rest of the restore runs normally                           │\n  │   _rs_apply hot (skips RS_SKIP_PATHS)                       │\n  │   _rs_prepare_pending_restore (writes plan.env with         │\n  │     HB_HYDRATION_APPLIED=1)                                 │\n  │   packages.manual.list install                              │\n  │   Reboot                                                    │\n  │   apply_pending_restore.sh (forces NEEDS_INITRAMFS=1,       │\n  │     NEEDS_GRUB=1 because of the hydration flag)             │\n  │   apply_cluster_postboot.sh                                 │\n  │     update-initramfs -u -k all                              │\n  │     update-grub / proxmox-boot-tool refresh                 │\n  │     component --auto-reinstall                              │\n  └────────────────────────────────────────────────────────────┘"
+  },
+  "concreteExamples": {
+    "heading": "Exemplos concretos",
+    "intro": "O passe de hidratação não é abstrato — produz resultados observáveis e corretos para cenários comuns. Dois exemplos que a hidratação manuseia automaticamente:",
+    "rows": [
+      {
+        "scenario": "Passagem GPU (VFIO)",
+        "detail": "Fonte: <code>intel_iommu=on iommu=pt</code> no cmdline, <code>vfio</code>/<code>vfio_pci</code>/<code>vfio_iommu_type1</code> no <code>/etc/modules</code>, um <code>/etc/modprobe.d/vfio.conf</code> com <code>options vfio-pci ids=10de:2216</code>, e um <code>/etc/modprobe.d/blacklist-nvidia.conf</code>. A hidração funde os tokens cmdline com o GRUB ou o kernel cmdline do alvo, adiciona os módulos vfio ao <code>/etc/modules</code> e copia os dois arquivos modprobe do usuário. Na próxima inicialização, o IOMMU está ativo, os módulos VFIO são carregados, o GPU está ligado ao vfio-pci e o VM vem com o trabalho de passagem."
+      },
+      {
+        "scenario": "Por omissão personalizada do GRUB",
+        "detail": "Fonte: <code>GRUB_TIMEOUT=1</code> e <code>GRUB_DISABLE_OS_PROBER=true</code>. Hydration lê ambas as chaves do <code>/etc/default/grub</code>, vê que elas diferem dos padrões da instalação recente, e reescreve essas duas linhas no arquivo do alvo (deixando tudo, incluindo o <code>GRUB_DISTRIBUTOR</code>, intocado)."
+      }
+    ]
+  },
+  "callout": {
+    "warningTitle": "O que a hidratação não reaplica quando o kernel alvo é mais novo",
+    "warningBody": "A hidratação reaplica apenas a configuração ProxMenux sabe ser segura em todas as versões do kernel: tokens IOMMU, IDs VFIO, chaves GRUB permitidas e módulos de uma lista fixa (<code>vfio*</code>, <code>nvidia*</code>, <code>i915</code>, <code>xe</code>, <code>kvm*</code>). Qualquer coisa fora desse conjunto — ganchos de initramfs personalizados sob <code>/etc/initramfs-tools/hooks/</code>, arquivos não listados em <code>/etc/modprobe.d/</code>, sobreposições de unidades systemd criadas pelo usuário — permanece excluída. A razão é concreta: esses arquivos podem chamar de interfaces internas do kernel (a APIs de módulo, layout <code>/sys</code>, ganchos <code>udev</code>) que mudam entre as versões principais, e aplicá-las literalmente sobre o kernel mais novo pode impedir que o alvo arranque. Quando a reprodução exata da cadeia de inicialização é necessária, a restauração deve ser executada em um host com a mesma versão principal do kernel que o backup."
+  },
+  "codeReference": {
+    "heading": "Onde vivem os mecanismos",
+    "intro": "Para os desenvolvedores que procuram rastrear ou estender o comportamento do cross-kernel:",
+    "rows": [
+      {
+        "component": "Detecção da direcção",
+        "location": "<code>hb_compat_check</code> em <code>lib_host_backup_common.sh</code>. Define <code>HB_COMPAT_KERNEL_DIRECTION</code>."
+      },
+      {
+        "component": "Lista de caminhos do filtro seguro",
+        "location": "<code>hb_unsafe_paths_cross_version</code> em <code>lib_host_backup_common.sh</code>. Emite <code>path\\treason</code> linhas usadas tanto pelo filtro CLI como pelo endpoint da Web <code>/api/host-backups/restore/prepare</code>."
+      },
+      {
+        "component": "Fases de hidratação",
+        "location": "<code>_rs_hyd_grub</code>, <code>_rs_hyd_kernel_cmdline</code>, <code>_rs_hyd_modules</code>, <code>_rs_hyd_files</code> em <code>backup_host.sh</code>. Orquestrado por <code>_rs_apply_bk_older_hydration</code>."
+      },
+      {
+        "component": "Regeneração forçada após a inicialização",
+        "location": "<code>apply_pending_restore.sh</code> lê <code>HB_HYDRATION_APPLIED</code> de <code>plan.env</code> e força <code>NEEDS_INITRAMFS=1</code>/<code>NEEDS_GRUB=1</code>."
+      },
+      {
+        "component": "Visualização da Web",
+        "location": "<code>/api/host-backups/restore/prepare</code> em <code>flask_server.py</code>. Carrega a biblioteca auxiliar, executa <code>_rs_apply_bk_older_hydration</code> no modo plano, retorna as ações para o modal Web."
+      }
+    ]
+  },
+  "whereNext": {
+    "heading": "Para onde ir a seguir",
+    "items": [
+      {
+        "label": "Restauração",
+        "href": "/docs/backup-restore/restoring",
+        "tail": " — o fluxo completo de restauração que integra os mecanismos desta página."
+      },
+      {
+        "label": "Como funciona",
+        "href": "/docs/backup-restore/how-it-works",
+        "tail": " — manifesto e coletores que produzem o bloco <code>kernel_params</code> lido pela hidratação."
+      }
+    ]
+  }
+}
diff --git a/web/messages/pt/docs/backup-restore/destinations/borg.json b/web/messages/pt/docs/backup-restore/destinations/borg.json
new file mode 100644
index 00000000..fe9ae079
--- /dev/null
+++ b/web/messages/pt/docs/backup-restore/destinations/borg.json
@@ -0,0 +1,234 @@
+{
+  "meta": {
+    "title": "Destino Borg — tipos de repositório, autenticação SSH, criptografia | ProxMenux",
+    "description": "O destino Borg grava backups do host ProxMenux em um repositório local, em disco externo montado ou em servidor remoto via SSH. Descreve a busca pelo executável borg, as quatro opções iniciais de chave SSH, a criptografia repokey, os destinos salvos e a retenção por tarefa agendada.",
+    "ogTitle": "Cópia de segurança do ProxMenux — destino Borg",
+    "ogDescription": "Como ProxMenux escreve backups de host para repositórios Borg, com estratégias de autenticação SSH e criptografia repokey.",
+    "twitterTitle": "Destino de backup Borg | ProxMenux",
+    "twitterDescription": "Repositórios Borg locais, USB e SSH para backups de host."
+  },
+  "header": {
+    "title": "Borg",
+    "description": "O destino Borg escreve backups de host para um repositório Borg. Três tipos de repositório são suportados: caminho local do sistema de arquivos, disco externo montado, ou servidor remoto via SSH. Deduplicação de nível de chunk em todos os arquivos no repositório e criptografia opcional repokey.",
+    "section": "Cópias de segurança e restauro"
+  },
+  "aboutBorg": {
+    "heading": "O que é Borg",
+    "body": "Borg (também escrito BorgBackup) é uma ferramenta de backup de desduplicação de código aberto mantida pela comunidade Borg Backup. Ele armazena todos os arquivos como um conjunto de blocos de comprimento variável dentro de um repositório; blocos são compartilhados entre os arquivos, então fazer o backup de dados inalterados tem custo de armazenamento quase zero. Borg não está ligado ao Proxmox — é uma ferramenta de backup de propósito geral usada em muitos ambientes. ProxMenux usa-o como um dos três destinos para backups de host; cada mecanismo Borg-específico descrito nesta página (tipos de repositório, borg-serve sobre SSH, criptografia repokey, prune) é o comportamento padrão Borg."
+  },
+  "intro": {
+    "title": "Deduplicação por blocos com repositórios locais ou acessíveis via SSH",
+    "body": "Um repositório Borg armazena blocos compartilhados entre todos os seus arquivos de backup. Repetir o backup de um arquivo inalterado não transfere nem armazena novos dados. O ProxMenux usa <code>borg create</code> para o backup e <code>borg extract</code> para a restauração. O repositório pode estar no mesmo sistema de arquivos da origem, em disco externo montado ou em host remoto acessível via SSH."
+  },
+  "binarySourcing": {
+    "heading": "O binário borg",
+    "intro": "Borg não é uma dependência de base do instalador ProxMenux. Quando um backup é executado, o <code>hb_ensure_borg</code> resolve o binário de quatro fontes em ordem e retorna o primeiro que funciona:",
+    "rows": [
+      {
+        "priority": "1",
+        "source": "Sistema <code>borg</code>",
+        "detail": "Se o host já tem <code>borg</code> instalado via APT (<code>which borg</code> resolve), esse binário é usado."
+      },
+      {
+        "priority": "2",
+        "source": "Cache 'State-dir'",
+        "detail": "<code>/usr/local/share/proxmenux/borg</code> — mantido de um anterior download GitHub neste host."
+      },
+      {
+        "priority": "3",
+        "source": "Pacote AppImage do Monitor",
+        "detail": "<code>/usr/local/share/proxmenux/monitor-app/usr/bin/borg</code> — o AppImage agrupa um borg-linux64 assinado. Este é o caminho offline: um host sem internet ainda tem um <code>borg</code> funcionando."
+      },
+      {
+        "priority": "4",
+        "source": "Transferência do GitHub",
+        "detail": "<code>wget</code> contra a URL <code>borg-linux64</code> fixada em <code>github.com/borgbackup/borg/releases/</code>, verificada contra uma constante SHA-256 em <code>lib_host_backup_common.sh</code> (<code>HB_BORG_LINUX64_SHA256</code>). No checksum descompasso o binário é descartado e o backup aborta. O arquivo baixado é armazenado em cache na dir estado para backups subsequentes usar caminho 2."
+      }
+    ]
+  },
+  "repoTypes": {
+    "heading": "Tipos de repositório",
+    "intro": "O tipo de repositório é escolhido quando um alvo é adicionado. Cada tipo resolve para um URL de repositório diferente que Borg entende.",
+    "rows": [
+      {
+        "type": "remote",
+        "url": "ssh://USER@HOST/RPATH",
+        "detail": "O repositório vive em um servidor remoto que executa <code>borg serve</code>. Requer uma conexão SSH para esse servidor."
+      },
+      {
+        "type": "usb",
+        "url": "/mnt/MOUNTPOINT/borgbackup",
+        "detail": "O repositório vive em um disco externo montado (tipicamente USB). A montagem é resolvida via <code>hb_prompt_mounted_path</code>, que detecta, monta ou formata partições USB conforme necessário."
+      },
+      {
+        "type": "local",
+        "url": "/backup/borgbackup (any absolute path)",
+        "detail": "O repositório vive numa pasta local. Significativo apenas quando o diretório alvo está em um disco físico separado — um repositório no mesmo disco que a fonte protege contra o erro do operador, mas não contra a falha do disco."
+      }
+    ]
+  },
+  "serverSetup": {
+    "heading": "Preparando o servidor Borg (lado do servidor)",
+    "intro": "O tipo de repositório <code>remote</code> exige um servidor Borg funcional acessível via SSH. O ProxMenux não configura o servidor; apenas autoriza uma chave em uma conta existente. Esta seção descreve os requisitos antes da conexão.",
+    "hostChoicesTitle": "Onde o servidor pode viver",
+    "hostChoicesBody": "Qualquer host Linux com acesso SSH se qualifica. Configuração comum:",
+    "hostChoicesItems": [
+      "Um NAS dedicado ou caixa de backup (Debian, Ubuntu, TrueNAS SCALE com uma shell).",
+      "Um recipiente LXC dentro de um nó Proxmox. Pegada pequena, isolada do hospedeiro a executar os backups.",
+      "Outro host Proxmox na mesma LAN, ou um VM em qualquer lugar acessível sobre SSH."
+    ],
+    "lxcWarningTitle": "LXC como servidor Borg",
+    "lxcWarningBody": "Se o servidor Borg estiver em um LXC, generate-auto exige uma conta que aceite autenticação SSH por senha para instalar a chave. Caso contrário, use a instalação manual ou a alternativa generate-pct pelo host PVE.",
+    "requirementsTitle": "Requisitos no servidor",
+    "requirementsRows": [
+      {
+        "requirement": "Executável borg em <code>/usr/bin/borg</code>",
+        "detail": "A linha <code>command=\"/usr/bin/borg serve ...\"</code> gravada pelo ProxMenux em <code>authorized_keys</code> usa esse caminho fixo. A instalação via APT (<code>apt install borgbackup</code>) coloca o executável ali. Um binário independente precisa de um link simbólico em <code>/usr/bin/borg</code>."
+      },
+      {
+        "requirement": "Uma conta de usuário dedicada (tipicamente <code>borg</code>)",
+        "detail": "Possui o diretório do repositório e recebe conexões SSH recebidas. Não precisa de acesso sudo ou shell — a linha authorized_keys desativa shells interativos de qualquer maneira."
+      },
+      {
+        "requirement": "Um diretório de repositório com escrita",
+        "detail": "O caminho que o operador dá ProxMenux (por exemplo <code>/backup/borgbackup</code>) deve existir no servidor e ser propriedade do usuário borg."
+      },
+      {
+        "requirement": "O servidor SSH aceita o usuário borg",
+        "detail": "<code>PubkeyAuthentication yes</code> (padrão). A autenticação por senha só é necessária para instalar a chave pelo fluxo <em>generate-auto</em>. Depois disso, o servidor pode desativar completamente a autenticação por senha."
+      }
+    ],
+    "minimalSetupTitle": "Configuração mínima do servidor",
+    "minimalSetupBody": "Em um servidor Debian ou Ubuntu Borg, uma linha de base de trabalho é quatro comandos como root:",
+    "minimalSetupCmd": "apt install borgbackup\nuseradd -m -d /home/borg -s /bin/bash borg\nmkdir -p /backup/borgbackup\nchown borg:borg /backup/borgbackup",
+    "minimalSetupNote": "Com o servidor preparado e a autenticação SSH por senha disponível, <code>generate-auto</code> instala a chave por uma conta que possa gravar em authorized_keys do usuário borg. Os backups seguintes usam essa chave, restrita a <code>borg serve</code> no caminho configurado. Sem acesso por senha, instale-a manualmente ou pelo host PVE."
+  },
+  "sshAuth": {
+    "heading": "Autenticação SSH (lado cliente)",
+    "intro": "Repositórios Borg remotos são acessados sobre SSH. A conexão é executada do host ProxMenux para uma conta de usuário no servidor Borg que executa o <code>borg serve</code>. Este usuário é tipicamente chamado <code>borg</code>, NÃO o administrador/root usuário do servidor — a linha de comando borg-serve bloqueia a conexão com esse caminho específico do repositório (veja as estratégias chave abaixo).",
+    "strategiesTitle": "Estratégias de chave SSH",
+    "strategiesIntro": "Ao adicionar um destino remoto, o ProxMenux pede usuário SSH, host, porta e caminho remoto e oferece quatro opções de autenticação. A alternativa generate-pct é oferecida quando o acesso por senha é recusado. Os modos são descritos abaixo:",
+    "strategyRows": [
+      {
+        "mode": "generate-auto",
+        "label": "Recomendado",
+        "detail": "O ProxMenux gera ou reutiliza um par de chaves ed25519 em <code>~/.ssh/borg_proxmenux_HOST_ed25519</code> e usa <code>sshpass</code> para testar o acesso e instalar a chave pública em <code>~borg/.ssh/authorized_keys</code>. A senha pertence a uma conta com permissão para gravar esse arquivo, normalmente root ou borg. Ela é usada durante a configuração e não é salva."
+      },
+      {
+        "mode": "generate-manual",
+        "label": "Sem senha de administração nesta máquina",
+        "detail": "ProxMenux gera o keypair como acima, mas exibe a linha <code>authorized_keys</code> completa para o operador colar manualmente no servidor. A senha de administrador nunca deixa o host ProxMenux porque nunca é solicitado."
+      },
+      {
+        "mode": "generate-pct",
+        "label": "O servidor Borg é um PVE LXC",
+        "detail": "O servidor Borg é executado dentro de um LXC em um nó PVE. ProxMenux autoriza a chave via <code>pct exec</code> do host PVE — root no host PVE escreve no LXC <code>~borg/.ssh/authorized_keys</code> sem precisar de SSH no próprio LXC."
+      },
+      {
+        "mode": "existing",
+        "label": "Usar uma chave existente",
+        "detail": "O ProxMenux procura em <code>/root/.ssh/</code> e <code>$HOME/.ssh/</code> chaves privadas ed25519/RSA que consiga interpretar e as lista. O operador escolhe uma ou indica manualmente um caminho não padrão."
+      },
+      {
+        "mode": "none",
+        "label": "Configuração padrão do SSH",
+        "detail": "Nenhuma chave personalizada — Borg depende da configuração padrão SSH da máquina (tipicamente <code>~/.ssh/id_rsa</code> ou um agente SSH)."
+      }
+    ],
+    "restrictTitle": "A linha authorized_keys",
+    "restrictBody": "Para cada chave gerada, a linha <code>authorized_keys</code> gravada pelo ProxMenux no servidor restringe a chave a esta chamada de borg-serve no caminho configurado do repositório:",
+    "restrictLine": "command=\"/usr/bin/borg serve --restrict-to-path RPATH\",restrict PUBKEY",
+    "restrictNote": "O <code>command=</code> força cada sessão de SSH usando esta chave para executar apenas o comando borg-serve; <code>restrict</code> desativa o encaminhamento de portas, o encaminhamento de agentes, o encaminhamento de X11 e a alocação de PTY. A chave não pode ser usada para abrir uma shell interativa no servidor ou para acessar qualquer outro caminho do repositório, mesmo que a conta tenha privilégios mais amplos."
+  },
+  "savedTargets": {
+    "heading": "Alvos salvos",
+    "intro": "Um destino salvo mantém a configuração do repositório com um nome reconhecível, evitando digitar os dados novamente. Arquivos no diretório de estado do ProxMenux:",
+    "rows": [
+      {
+        "file": "borg-targets.txt",
+        "content": "Uma linha por destino: <code>NAME|REPO|SSH_KEY_PATH|ENCRYPT_MODE</code>. <code>hb_collect_borg_configs</code> lê o arquivo para preencher o menu de seleção de destinos."
+      },
+      {
+        "file": "borg-pass-NAME.txt",
+        "content": "Frase secreta do destino identificado acima por NAME (<code>chmod 600</code>). Presente somente quando se escolhe criptografia repokey."
+      }
+    ],
+    "outro": "Salvar o destino é opcional. Recusar não grava a configuração com nome, mas não remove uma chave SSH gerada. Se repokey for ativado sem destino salvo, o ProxMenux ainda guarda a frase secreta no arquivo legado borg-pass.txt."
+  },
+  "encryption": {
+    "heading": "Criptografia",
+    "body": "Os repositórios são inicializados com um modo de criptografia via <code>hb_borg_init_if_needed</code>: o moderno <code>borg repo-create -e MODE</code> quando disponível, ou o legado <code>borg init --encryption=MODE</code>. ProxMenux expõe dois modos: <code>repokey</code> (padrão) e <code>none</code>. No modo <code>repokey</code> Borg armazena a chave de criptografia dentro do próprio repositório; o acesso requer uma frase-passe, que ProxMenux pede duas vezes com validação de correspondência e armazena em <code>borg-pass-NAME.txt</code> para destinos salvos, ou no arquivo legado descrito acima. Uma janela de reconhecimento obrigatória é mostrada após a frase- senha ser salva: a frase- senha é a única maneira de acessar os arquivos criptografados, e perdê- la torna cada arquivo no repositório irrecuperável."
+  },
+  "runtimeEnv": {
+    "heading": "Ambiente de execução",
+    "intro": "ProxMenux exporta as seguintes variáveis de ambiente antes de invocar <code>borg</code>. Eles configuram a conexão e desbloqueiam o repositório sem incorporar segredos na linha de comando.",
+    "rows": [
+      {
+        "var": "BORG_RSH",
+        "value": "ssh -i SSH_KEY_PATH -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new [-p PORT]",
+        "purpose": "Comando remoto usado pelo Borg para repositórios SSH. Uma chave selecionada acrescenta as opções de identidade. Quando um destino é adicionado com uma porta diferente da padrão, o ProxMenux acrescenta também -p PORT; os destinos guardados, as tarefas agendadas e o Monitor usam antes a porta do URL ssh://. Sem chave personalizada, e num destino novo com a porta padrão, a variável fica indefinida e o Borg usa a configuração SSH do host."
+      },
+      {
+        "var": "BORG_PASSPHRASE",
+        "value": "(passfrase de borg-pass-NAME.txt)",
+        "purpose": "Desbloqueia a chave repokey. Configure apenas quando o alvo usar criptografia <code>repokey</code>. Nunca aparece na lista de argumentos do processo."
+      },
+      {
+        "var": "BORG_ENCRYPT_MODE",
+        "value": "repokey | none",
+        "purpose": "Usado pelo <code>hb_borg_init_if_needed</code> ao inicializar um repositório que ainda não existe. Ignorado pelo <code>borg create</code> nos repositórios existentes."
+      },
+      {
+        "var": "BORG_RELOCATED_REPO_ACCESS_IS_OK",
+        "value": "yes",
+        "purpose": "Suprime o prompt interativo que Borg levanta quando o URL do repositório difere do URL que foi originalmente alcançado (comum após um renomeamento de ponto de montagem ou SSH-host acessível via novo endereço)."
+      },
+      {
+        "var": "BORG_UNKNOWN_UNENCRYPTED_REPO_ACCESS_IS_OK",
+        "value": "yes",
+        "purpose": "Suprime o prompt interativo Borg levanta a primeira vez que um repositório não criptografado é acessado de um novo cliente."
+      }
+    ]
+  },
+  "archiveFormat": {
+    "heading": "Nome e retenção do arquivo",
+    "intro": "Cada backup cria um novo arquivo dentro do repositório.",
+    "namePattern": "hostcfg-HOSTNAME-YYYYMMDD_HHMMSS",
+    "retentionBody": "Para trabalhos agendados, o <code>run_scheduled_backup.sh</code> executa <code>borg prune</code> contra o repositório após cada backup bem sucedido com os valores de retenção configurados no trabalho (<code>--keep-last</code>, <code>--keep-daily</code>, <code>--keep-weekly</code>). Os backups interativos não removem backups antigos."
+  },
+  "restoreAccess": {
+    "heading": "Obtenção no lado da restauração",
+    "body": "A restauração lista os arquivos com <code>borg list REPO</code> e extrai o selecionado com <code>borg extract REPO::ARCHIVE-NAME</code> em um diretório de preparação. <code>_rs_check_layout</code> o encaminha ao processo padrão de restauração. Os mesmos comandos funcionam manualmente fora do ProxMenux; a árvore extraída tem a estrutura de três blocos descrita em <em>Como funciona</em>."
+  },
+  "references": {
+    "heading": "Referências",
+    "intro": "Documentação oficial do Borg para os componentes usados pelo ProxMenux.",
+    "items": [
+      {
+        "label": "Documentação Borg",
+        "href": "https://borgbackup.readthedocs.io/",
+        "tail": " — ponto de entrada principal que abrange conceitos, implantação, arranque rápido e todos os comandos."
+      },
+      {
+        "label": "borg create",
+        "href": "https://borgbackup.readthedocs.io/en/stable/usage/create.html",
+        "tail": " — o comando usado pelo ProxMenux em cada backup, com todas as opções aceitas."
+      },
+      {
+        "label": "Criptografia do repositório",
+        "href": "https://borgbackup.readthedocs.io/en/stable/usage/init.html#encryption-mode",
+        "tail": " — os modos de criptografia aceitos pelo Borg, incluindo repokey, usado por padrão pelo ProxMenux."
+      },
+      {
+        "label": "borg serve e implantação via SSH",
+        "href": "https://borgbackup.readthedocs.io/en/stable/deployment/central-backup-server.html",
+        "tail": " — configuração de um servidor Borg central acessível via SSH, incluindo o comando borg-serve e a opção restrict-to-path que o ProxMenux grava em authorized_keys."
+      },
+      {
+        "label": "borg prune",
+        "href": "https://borgbackup.readthedocs.io/en/stable/usage/prune.html",
+        "tail": " — o modelo de retenção de --keep-last / --keep-daily / --keep-weekly aplicado pelo ProxMenux em cada tarefa agendada."
+      }
+    ]
+  }
+}
diff --git a/web/messages/pt/docs/backup-restore/destinations/index.json b/web/messages/pt/docs/backup-restore/destinations/index.json
new file mode 100644
index 00000000..0f92be36
--- /dev/null
+++ b/web/messages/pt/docs/backup-restore/destinations/index.json
@@ -0,0 +1,110 @@
+{
+  "meta": {
+    "title": "Destinos das cópias de segurança — arquivo local, Proxmox Backup Server e Borg | ProxMenux",
+    "description": "Três backends de armazenamento recebem a mesma carga útil de backup ProxMenux: um arquivo .tar.zst local em qualquer sistema de arquivos com permissão de gravação, um backup PBS em uma datastore Proxmox Backup Server, ou um arquivo Borg em um repositório Borg local ou remoto. Cada infra-estrutura tem suas próprias características de compressão, desduplicação, criptografia e rede.",
+    "ogTitle": "Destinos de backup do ProxMenux",
+    "ogDescription": "Local, Proxmox Backup Server e Borg — três backends de armazenamento para a mesma carga útil de backup do host.",
+    "twitterTitle": "Destinos de backup do ProxMenux | ProxMenux",
+    "twitterDescription": "Arquivos locais, infraestruturas Proxmox Backup Server e Borg para backups de host."
+  },
+  "header": {
+    "title": "Destinos",
+    "description": "Três backends de armazenamento suportados pelo ProxMenux Backup: arquivo local, Proxmox Backup Server (recomendado) e Borg. Cada um recebe o mesmo arquivo de três blocos de dados; eles diferem em formato de armazenamento, deduplicação, modelo de criptografia e requisitos de rede.",
+    "section": "Cópias de segurança e restauro"
+  },
+  "intro": {
+    "title": "Mesmo conteúdo, três backends",
+    "body": "Cada backup produz as mesmas três cargas (rootfs, manifesto, aplicações). O que muda entre destinos é como essas cargas são armazenadas e como o operador as recupera para uma restauração. Cada infra-estrutura é implementada como uma função separada em <code>backup_host.sh</code> — <code>_bk_local</code>, <code>_bk_pbs</code>, <code>_bk_borg</code> — mas todos os três compartilham a mesma etapa de preparação temporária (<code>hb_prepare_staging</code>) e o mesmo caminho de restauração de código. A escolha de destino apenas afeta a escrita e a recuperação; ela não altera o que uma restauração faz ou como consome o arquivo."
+  },
+  "comparison": {
+    "heading": "Comparação de características",
+    "intro": "A tabela a seguir lista as diferenças concretas entre as três infra-estruturas como se comportam hoje em ProxMenux. Todos os valores descrevem o comportamento observado da própria infra-estrutura, não as recomendações editoriais.",
+    "rows": [
+      {
+        "feature": "Formato de armazenamento",
+        "local": "Um ficheiro <code>.tar.zst</code> (ou <code>.tar.gz</code> se o <code>zstd</code> estiver ausente).",
+        "pbs": "Backup PBS (blocos <code>.pxar</code> no datastore).",
+        "borg": "Arquivo Borg dentro de um repositório Borg (arquivos de segmentos)."
+      },
+      {
+        "feature": "Compressão",
+        "local": "zstd (nível padrão) via <code>tar --zstd</code>. gzip fallback.",
+        "pbs": "Gerenciada pelo proxmox-backup-client. O ProxMenux não altera as configurações de compressão.",
+        "borg": "Compressão integrada do Borg. O ProxMenux chama borg create sem alterar as configurações de compressão."
+      },
+      {
+        "feature": "Desduplicação",
+        "local": "Nenhuma. Cada backup é um arquivo independente completo.",
+        "pbs": "Deduplicação completa por blocos entre todos os backups no datastore.",
+        "borg": "Deduplicação completa por blocos entre todos os arquivos do repositório."
+      },
+      {
+        "feature": "Criptografia em repouso",
+        "local": "Nenhum (depende da proteção do sistema de arquivos).",
+        "pbs": "Criptografia opcional do lado do cliente com um arquivo de chave. Quando ativada, o blob de recuperação é enviado em um grupo de backup separado.",
+        "borg": "Criptografia opcional repokey (chave armazenada no repo, desbloqueada por uma frase- senha)."
+      },
+      {
+        "feature": "Retenção / limpeza",
+        "local": "Aplicada por trabalho agendado via <code>KEEP_LAST</code>. Os arquivos antigos são removidos junto com seus arquivos auxiliares e logs de execução. Os backups interativos não fazem limpeza.",
+        "pbs": "Aplicado por trabalho programado via <code>proxmox-backup-client prune --keep-last / --keep-daily / --keep-weekly</code>. Os backups interativos não fazem limpeza.",
+        "borg": "Aplicado por trabalho programado via <code>borg prune --keep-last / --keep-daily / --keep-weekly</code>. Os backups interativos não fazem limpeza."
+      },
+      {
+        "feature": "Rede",
+        "local": "Nenhuma. Escreve para um ponto de montagem local (tipicamente um disco interno ou uma unidade USB).",
+        "pbs": "TCP para o servidor PBS (porta padrão 8007). Requer credenciais PBS + impressão digital.",
+        "borg": "Localização local do sistema de ficheiros ou túnel SSH para uma máquina Borg remota."
+      },
+      {
+        "feature": "Dependências",
+        "local": "<code>tar</code>, <code>zstd</code> (presente no Proxmox por padrão).",
+        "pbs": "Pacote <code>proxmox-backup-client</code> (incluído no Proxmox VE 8+).",
+        "borg": "binário <code>borg</code>. Auto-fornecido por ProxMenux do pacote Monitor AppImage quando faltando."
+      },
+      {
+        "feature": "Acesso para restauração",
+        "local": "Qualquer máquina com tar+zstd pode extrair o arquivo. Não é necessário PBS/Borg.",
+        "pbs": "Requer <code>proxmox-backup-client</code>, credenciais PBS e o arquivo de chave (se o backup estiver criptografado).",
+        "borg": "Requer <code>borg</code> + o caminho do repositório + a senha (se criptografada)."
+      }
+    ],
+    "captionCode": "feature",
+    "captionLocal": "Local",
+    "captionPbs": "Proxmox Backup Server (recomendado)",
+    "captionBorg": "Borg"
+  },
+  "sameArchive": {
+    "heading": "A disposição do arquivo não muda com o destino",
+    "body": "Dentro de qualquer um dos três destinos, o mesmo <code>rootfs/</code> + <code>metadata/</code> + <code>manifest.json</code> layout descrito em <em>Como funciona</em> está presente. Um <code>.tar.zst</code> extraído de um arquivo local, um <code>.pxar</code> restaurado de PBS, e um arquivo Borg extraído com <code>borg extract</code> todos produzem uma árvore de diretórios idêntica. O caminho do código de restauração (<code>_rs_check_layout</code>, <code>_rs_apply</code>, <code>_rs_prepare_pending_restore</code>) lê as mesmas três cargas úteis sem saber de que destino vieram."
+  },
+  "extractStandalone": {
+    "heading": "Extraindo um backup fora de ProxMenux",
+    "intro": "Qualquer um dos três formatos de arquivo pode ser lido com ferramentas padrão sem ProxMenux instalado no host de leitura. Os comandos abaixo produzem a mesma árvore de diretórios que uma restauração consome internamente.",
+    "localCmd": "# From a local .tar.zst archive:\ntar --zstd -xf hostcfg-HOST-TIMESTAMP.tar.zst\n\n# From a .tar.gz fallback:\ntar -xzf hostcfg-HOST-TIMESTAMP.tar.gz",
+    "pbsCmd": "# From a PBS backup (requires proxmox-backup-client):\nproxmox-backup-client restore \\\n    --repository USER@REALM@HOST:DATASTORE \\\n    host/hostcfg-HOST/BACKUP-TIME \\\n    hostcfg.pxar /tmp/hostcfg\n\n# Add --keyfile KEY-PATH when the backup is encrypted.",
+    "borgCmd": "# De um arquivo Borg (requer borg e a senha dos repositórios criptografados):\nborg extract REPO-PATH::ARCHIVE-NAME\n\n# Em um repositório remoto acessível por SSH:\nborg extract ssh://USER@HOST:PORT/REPO-PATH::ARCHIVE-NAME",
+    "note": "A árvore extraída pode então ser inspecionada manualmente ou alimentada a uma restauração manual. Veja as páginas de destino individuais para o fluxo de recuperação exato que o ProxMenux usa sob o capô."
+  },
+  "whereNext": {
+    "heading": "Detalhes por destino",
+    "intro": "Cada destino tem sua própria página cobrindo o fluxo de configuração, o formato on-disk e o comando de recuperação usado pela restauração.",
+    "items": [
+      {
+        "label": "Arquivo local",
+        "href": "/docs/backup-restore/destinations/local",
+        "tail": " — pré-configurando um alvo local, montagem da unidade USB, a verificação de segurança contra a gravação do arquivo em si, o sidecar JSON que permite ao Monitor identificar o arquivo."
+      },
+      {
+        "label": "Proxmox Backup Server (recomendado)",
+        "href": "/docs/backup-restore/destinations/pbs",
+        "tail": " — seleção de datastore, credenciais e impressão digital, ciclo de vida do arquivo de chave de criptografia, senha de recuperação, carregando o blob de recuperação para PBS para recuperação de nova instalação."
+      },
+      {
+        "label": "Borg",
+        "href": "/docs/backup-restore/destinations/borg",
+        "tail": " — repositórios locais ou acessíveis por SSH, origem do binário Borg (sistema / cache / pacote AppImage do Monitor / download do GitHub), inicialização do repositório, gerenciamento da senha e configuração da chave SSH para repositórios remotos."
+      }
+    ]
+  }
+}
diff --git a/web/messages/pt/docs/backup-restore/destinations/local.json b/web/messages/pt/docs/backup-restore/destinations/local.json
new file mode 100644
index 00000000..01c392f8
--- /dev/null
+++ b/web/messages/pt/docs/backup-restore/destinations/local.json
@@ -0,0 +1,75 @@
+{
+  "meta": {
+    "title": "Destino de arquivo local — tar.zst em um sistema de arquivos ou unidade USB | ProxMenux",
+    "description": "O destino de backup local escreve um único arquivo .tar.zst para qualquer diretório com permissão de gravação: um disco interno, um ponto de montagem Proxmox, uma partilha NFS, ou uma unidade USB. Documenta o fluxo de configuração, a lógica de detecção e montagem USB, a verificação de segurança contra a gravação do arquivo em um caminho que está sendo feito backup, e o sidecar JSON que identifica o arquivo.",
+    "ogTitle": "Cópia de segurança do ProxMenux — Destino do arquivo local",
+    "ogDescription": "Como ProxMenux escreve backups locais como arquivos .tar.zst e como configurar o diretório de destino ou unidade USB.",
+    "twitterTitle": "Destino de backup local | ProxMenux",
+    "twitterDescription": "Como ProxMenux escreve backups locais como arquivos .tar.zst em um sistema de arquivos ou unidade USB."
+  },
+  "header": {
+    "title": "Arquivo local",
+    "description": "O destino local escreve um único arquivo de tar comprimido para qualquer diretório com permissão de gravação no host: um disco interno, uma montagem NFS ou SMB, ou uma unidade USB.",
+    "section": "Cópias de segurança e restauro"
+  },
+  "intro": {
+    "title": "Um arquivo, auto-suficiente",
+    "body": "Um backup local produz um único arquivo <code>hostcfg-HOST-TIMESTAMP.tar.zst</code> (ou <code>.tar.gz</code> quando <code>zstd</code> está ausente). O arquivo contém toda a árvore de arquivos — <code>manifest.json</code>, <code>metadata/</code> e <code>rootfs/</code> — e pode ser restaurado em qualquer host Proxmox com o fluxo de restauração ProxMenux, ou extraído manualmente com <code>tar --zstd -xf</code> em qualquer sistema Linux. Nenhum servidor, nenhuma inicialização de repositório, nenhuma dependência externa. Este é o destino com o caminho de recuperação mais curto quando nem PBS nem Borg está disponível."
+  },
+  "targetConfig": {
+    "heading": "Configurando o diretório alvo",
+    "intro": "O destino local é um <strong>único diretório de destino salvo de forma persistente</strong> — não uma lista. ProxMenux armazena a escolha do operador em <code>/usr/local/share/proxmenux/local-target.conf</code> e lê essa escolha em cada backup. Quando nenhum alvo foi configurado, o <code>HB_LOCAL_TARGET_DEFAULT = /var/lib/vz/dump</code> padrão é usado (o mesmo diretório que o Proxmox usa para suas próprias saídas <code>vzdump</code>). O alvo está configurado a partir de <em>Configure destinos de backup → Destinos locais</em>:",
+    "options": [
+      "<strong>Use o padrão (<code>/var/lib/vz/dump</code>).</strong> O armazenamento local Proxmox. Presente em cada instalação do Proxmox; o arquivo fica ao lado das saídas vzdump e é captado automaticamente pela aba Backups do Monitor.",
+      "<strong>Insira um caminho personalizado.</strong> Qualquer caminho absoluto do sistema de arquivos pode ser usado: uma montagem NFS, uma partilha SMB montada via <code>fstab</code>, um conjunto de dados dedicado ZFS, um segundo disco interno. ProxMenux valida que o caminho existe e é um diretório antes de persisti-lo.",
+      "<strong>Escolha uma unidade USB.</strong> Abre o submenu USB (abaixo), que detecta dispositivos removíveis e oferece para montar ou formatar um."
+    ]
+  },
+  "usbFlow": {
+    "heading": "Detecção e montagem de unidades USB",
+    "intro": "O submenu USB lista partições em dispositivos removíveis relatados pelo <code>lsblk</code>. Cada partição é apresentada com seu tamanho, etiqueta do sistema de arquivos e estado atual. O estado determina a ação que o ProxMenux oferece.",
+    "statesTitle": "Os três estados do dispositivo",
+    "stateRows": [
+      {
+        "state": "montado",
+        "shown": "Tamanho · etiqueta · [fstype] · → /mount/point",
+        "action": "A partição já está montada em algum lugar. Selecioná-la salva o ponto de montagem atual como alvo local. Nenhuma montagem é realizada."
+      },
+      {
+        "state": "desmontado",
+        "shown": "Tamanho · etiqueta · [fstype] · (não montado — será montado)",
+        "action": "Um sistema de ficheiros está presente mas não está montado. Na confirmação, o ProxMenux executa o <code>hb_mount_usb_partition</code>: cria o <code>/mnt/backup-LABEL</code> (ou um caminho baseado em UUID, se não houver rótulo), monta a partição e persiste o ponto de montagem como alvo local."
+      },
+      {
+        "state": "vazia",
+        "shown": "Tamanho · disco USB bruto — sem sistema de arquivos (será FORMATADO)",
+        "action": "O dispositivo não tem sistema de arquivos. Essa operação destrutiva exige duas confirmações. Primeiro, uma janela Sim/Não explica que o disco será apagado. Depois, um campo exige que o usuário <strong>digite o caminho exato do dispositivo</strong> (por exemplo <code>/dev/sdb</code>) antes de o ProxMenux criar uma nova tabela GPT com uma partição ext4 e montá-la."
+      }
+    ],
+    "notMountedFallback": "Quando nenhum dispositivo USB é detectado, o submenu cai de volta para uma caixa de entrada simples. O operador pode indicar uma localização arbitrária do ponto de montagem; se a localização não for um ponto de montagem registado, uma janela de confirmação avisa antes de prosseguir."
+  },
+  "safetyCheck": {
+    "heading": "Verificação de segurança — destino dentro de um caminho de backup",
+    "body": "Antes de gravar o arquivo, <code>_bk_local</code> verifica se o diretório de destino <strong>não</strong> é um subcaminho de qualquer diretório cujo backup está sendo feito. Um erro comum seria adicionar <code>/root</code> ao perfil e escolher <code>/root/backups</code> como destino - o arquivo então se incluiria, produzindo um arquivo corrompido ou crescendo sem limites até que o disco ficasse cheio. A verificação resolve ambos os caminhos com <code>readlink -m</code>, compara-os e, em caso de conflito, aborta o backup com uma caixa de diálogo que nomeia o caminho conflitante e lista três maneiras de resolvê-lo: escolha um destino fora do caminho conflitante, remova a entrada personalizada que contém o destino ou use o modo Personalizado para desmarcar o caminho conflitante para esta execução."
+  },
+  "archiveFormat": {
+    "heading": "Formato de arquivo e compressão",
+    "intro": "O nome do arquivo de saída inclui o nome do host de origem e a data e hora do backup, permitindo ordenar as cópias cronologicamente no diretório e identificar cada arquivo.",
+    "namePattern": "hostcfg-HOSTNAME-YYYYMMDD_HHMMSS.tar.zst",
+    "compressionTitle": "Compressão",
+    "compressionBody": "O caminho primário usa <code>tar --zstd -cf</code> — um pipeline de um único comando que comprime ao nível padrão do zstd. Quando <code>zstd</code> não está presente na fonte (raro em Proxmox, mas possível em instalações mínimas), ProxMenux cai de volta para <code>gzip</code>. No caminho de retorno, se o <code>pv</code> estiver disponível, uma barra de progresso é adicionada ao pipeline para que o operador veja o tamanho do arquivo crescer em tempo real; sem o <code>pv</code>, o <code>tar -czf</code> simples é usado silenciosamente.",
+    "sourceTitle": "O que vai para o arquivo",
+    "sourceBody": "O comando tar é chamado com <code>-C \"$staging_root\" .</code>, incluindo <strong>toda a raiz da área de preparação</strong>: <code>rootfs/</code>, <code>metadata/</code> e <code>manifest.json</code>. Os três blocos de dados ficam lado a lado na raiz do arquivo tar. A extração produz exatamente a árvore usada pelo código de restauração."
+  },
+  "sidecar": {
+    "heading": "O arquivo auxiliar JSON",
+    "intro": "Cada backup local bem sucedido produz um arquivo companheiro: <code>HOSTNAME-TIMESTAMP.tar.zst.proxmenux.json</code>, escrito ao lado do arquivo por <code>hb_write_archive_sidecar</code>. Este pequeno arquivo JSON permite que o ProxMenux Monitor identifique o arquivo como um backup de host ProxMenux mesmo que mais tarde seja movido, renomeado ou arquivado em outro lugar.",
+    "contentTitle": "Conteúdo do sidecar",
+    "contentBody": "O sidecar armazena a versão do esquema, se o backup veio de uma execução interativa ou de uma tarefa agendada (<code>kind</code>), o ID do trabalho para as execuções agendadas, o modo de perfil usado (<code>default</code> ou <code>custom</code>), o nome de máquina de origem, o nome de base do arquivo original, um timestamp de criação ISO-8601 e o tamanho do arquivo em bytes.",
+    "whyBody": "A aba Backups do Monitor procura arquivos auxiliares <code>*.proxmenux.json</code> nos diretórios locais configurados, e não arquivos <code>*.tar.zst</code>, pois um <code>.tar.zst</code> sem arquivo auxiliar pode não ser um backup ProxMenux. A busca é rápida (os arquivos JSON são pequenos) e a associação permanece válida após renomear o arquivo, desde que o auxiliar seja renomeado de forma correspondente."
+  },
+  "restoreAccess": {
+    "heading": "Restaurando de um arquivo local",
+    "body": "O fluxo de restauração ProxMenux descobre arquivos locais digitalizando o alvo local configurado para sidecars e exibindo-os na lista Arquivos. A seleção de um arquivo aciona <code>_rs_check_layout</code>, que extrai o tarball em um diretório de preparação temporária e confirma o layout de três cargas antes de prosseguir. Para extração manual fora de ProxMenux, <code>tar --zstd -xf hostcfg-HOSTNAME-TIMESTAMP.tar.zst -C /tmp/hostcfg</code> produz a mesma árvore que o código de restauração consome."
+  }
+}
diff --git a/web/messages/pt/docs/backup-restore/destinations/pbs.json b/web/messages/pt/docs/backup-restore/destinations/pbs.json
new file mode 100644
index 00000000..1164a2ae
--- /dev/null
+++ b/web/messages/pt/docs/backup-restore/destinations/pbs.json
@@ -0,0 +1,113 @@
+{
+  "meta": {
+    "title": "Proxmox Backup Server destino — repositório, encriptação, recuperação ProxMenux",
+    "description": "O destino PBS grava os backups do host ProxMenux como backups PBS. Documenta a descoberta de repositórios em /etc/pve/storage.cfg, a configuração manual, o envio de .pxar, a criptografia no cliente com arquivo de chave e sua cópia de recuperação opcional protegida por frase secreta, e a recuperação da chave por várias fontes em um host recém-instalado.",
+    "ogTitle": "Cópia de segurança ProxMenux — destino Proxmox Backup Server",
+    "ogDescription": "Como o ProxMenux grava backups do host no Proxmox Backup Server com criptografia por arquivo de chave no cliente e uma cópia da chave para recuperação.",
+    "twitterTitle": "PBS destino de backup □ ProxMenux",
+    "twitterDescription": "Destino Proxmox Backup Server com criptografia por arquivo de chave e cópia de recuperação protegida por frase secreta."
+  },
+  "header": {
+    "title": "Proxmox Backup Server",
+    "description": "O destino PBS envia todo o diretório de preparação como um único backup .pxar para um datastore Proxmox Backup Server. A criptografia no cliente com arquivo de chave é opcional, assim como o envio, junto a cada backup, de uma cópia da chave protegida por frase secreta para recuperação.",
+    "section": "Cópias de segurança e restauro"
+  },
+  "recommendedBadge": "Destino recomendado",
+  "aboutPbs": {
+    "heading": "O que é Proxmox Backup Server",
+    "body": "Proxmox Backup Server (PBS) é o próprio produto do servidor de backup da Proxmox, desenvolvido e mantido pela mesma equipe que o autor Proxmox VE. É um servidor de backup dedicado projetado para receber backups de hosts Proxmox VE (VMs, LXCs e — via <code>proxmox-backup-client</code> — diretórios host arbitrários) com deduplicação baseada em blocos, criptografia do lado do cliente e políticas de retenção aplicadas lado servidor. ProxMenux usa PBS como um dos três destinos para backups de host; cada mecanismo específico PBS descrito nesta página (grupos de backup, arquivos <code>.pxar</code>, criptografia de arquivos de chaves <code>--backup-id</code>) é o comportamento padrão PBS."
+  },
+  "intro": {
+    "title": "Um backup por execução, dedup de nível de blocos",
+    "body": "Um backup PBS cria uma única entrada no datastore, sob o ID <code>host/hostcfg-HOSTNAME/BACKUP-TIME</code>. Os dados formam um arquivo <code>.pxar</code> com a estrutura de três blocos descrita em <em>Como funciona</em>. O PBS deduplica blocos entre todos os backups do datastore, de modo que backups posteriores do mesmo host transferem e armazenam apenas os blocos alterados. Nas tarefas agendadas, o próprio ProxMenux aplica a retenção: após cada execução bem-sucedida, <code>run_scheduled_backup.sh</code> executa <code>proxmox-backup-client prune</code> com <code>--keep-last</code> / <code>--keep-daily</code> / <code>--keep-weekly</code> e os valores configurados na tarefa."
+  },
+  "repoSelection": {
+    "heading": "Selecção do repositório",
+    "intro": "ProxMenux descobre repositórios PBS de duas fontes em cada backup. O operador escolhe um de um menu unificado; a escolha determina <code>HB_PBS_REPOSITORY</code>, <code>HB_PBS_SECRET</code> e <code>HB_PBS_FINGERPRINT</code> para a execução.",
+    "sourceRows": [
+      {
+        "source": "storage.cfg do Proxmox (deteção automática)",
+        "path": "/etc/pve/storage.cfg + /etc/pve/priv/storage/NAME.pw",
+        "content": "Qualquer estrofe <code>pbs:</code> na própria configuração de armazenamento do Proxmox é captada automaticamente. Servidor, datastore, nome de usuário e impressão digital vêm da estrofe. A senha é lida no diretório de credenciais do Proxmox. Nenhuma reentrada necessária no lado ProxMenux — o repositório está disponível assim que estiver configurado no Proxmox."
+      },
+      {
+        "source": "Configuração manual do ProxMenux",
+        "path": "/usr/local/share/proxmenux/pbs-manual-configs.txt + pbs-pass-NAME.txt + pbs-fingerprint-NAME.txt",
+        "content": "Adicionado de <em>Configure destinos de backup → destinos de PBS → Adicione PBS</em>. Pede um nome, nome de usuário (<code>root@pam</code> ou <code>user@pbs!token</code>), host ou IP, datastore e senha. A senha re-prompts na entrada vazia — uma gravação vazia persistiria silenciosamente e cada backup subsequente falharia com um erro de autenticação opaco. Este caminho é usado quando o PBS alvo não é registrado como armazenamento Proxmox."
+      }
+    ],
+    "menuTitle": "Menu de seleção",
+    "menuBody": "Ambas as fontes são mostradas em um único menu, cada linha marcada com sua origem (<code>[proxmox]</code> ou <code>[manual]</code>). As entradas cuja senha não pôde ser resolvida são marcadas com um aviso <code>⚠ no password</code> — selecionando-se um aciona uma reentrada de senha antes do backup começar. A impressão digital é passada para <code>proxmox-backup-client</code> através da variável de ambiente <code>PBS_FINGERPRINT</code>; quando ausente, o cliente pede ao operador para aceitar o certificado do servidor de forma interativa no primeiro backup."
+  },
+  "backupCommand": {
+    "heading": "O comando de backup",
+    "intro": "O envio usa uma única chamada de <code>proxmox-backup-client backup</code>. O ProxMenux usa <code>env</code> para passar ao cliente a senha, a senha de criptografia e a impressão digital como variáveis de ambiente.",
+    "cmd": "env \\\n    PBS_PASSWORD=\"$HB_PBS_SECRET\" \\\n    PBS_ENCRYPTION_PASSWORD=\"$HB_PBS_ENC_PASS\" \\\n    PBS_FINGERPRINT=\"$HB_PBS_FINGERPRINT\" \\\n    proxmox-backup-client backup \\\n        hostcfg.pxar:$staging_root \\\n        --repository USER@REALM@HOST:DATASTORE \\\n        --backup-type host \\\n        --backup-id  hostcfg-HOSTNAME \\\n        --backup-time BACKUP-EPOCH \\\n        [--keyfile /usr/local/share/proxmenux/pbs-key.conf]",
+    "backupIdTitle": "Nome do ID de backup",
+    "backupIdBody": "O ID de backup padrão é <code>hostcfg-HOSTNAME</code>. Pede-se ao operador que o confirme ou edite antes do envio; quaisquer caracteres fora do <code>[A-Za-z0-9_-]</code> são despojados e os traços são aparados. Reutilizar o mesmo ID entre as execuções é intencional — o PBS trata o ID como um <em>group</em>, e cada backup subsequente aparece como um novo backup dentro desse grupo, compartilhando dedup com execuções anteriores.",
+    "pxarTitle": "Por que a fonte é a raiz de estadiamento completa",
+    "pxarBody": "A origem do arquivo <code>.pxar</code> é todo o <code>staging_root</code>: <code>rootfs/</code>, <code>metadata/</code> e <code>manifest.json</code> em conjunto. Versões anteriores usavam <code>$staging_root/rootfs</code> como origem, deixando <code>metadata/</code> fora do arquivo. Sem esses dados, a verificação de compatibilidade emitia avisos de mudança de host mesmo ao restaurar no mesmo host. As cópias antigas continuam a ser restauradas pelo caso 3 de <code>_rs_check_layout</code>, que volta a colocar a árvore simples <code>etc/var/root/usr</code> dentro de uma hierarquia <code>rootfs/</code>."
+  },
+  "encryption": {
+    "heading": "Criptografia do lado do cliente",
+    "glossaryHint": "Esta seção usa os termos <em>arquivo de chave</em>, <em>frase secreta</em> e <em>envelope de recuperação</em>. O <glosarioLink>glossário</glosarioLink> resume as diferenças em uma frase por termo.",
+    "intro": "A criptografia PBS no cliente com arquivo de chave cifra os blocos no host de origem antes do envio. No ProxMenux ela é opcional. Ao ativá-la, o operador escolhe explicitamente sim ou não durante a configuração se deseja enviar ao PBS também uma cópia de recuperação do arquivo de chave protegida por frase secreta; a escolha pode ser alterada depois no Monitor. O arquivo fica sempre no caminho canônico <code>/usr/local/share/proxmenux/pbs-key.conf</code> e é reutilizado sem novas perguntas em todos os backups criptografados posteriores.",
+    "keyfileTitle": "Configurar o arquivo de chaves",
+    "keyfileBody": "O diálogo de criptografia aparece no primeiro backup criptografado do host. Primeiro pergunta se deseja criptografar o backup: <em>Não</em> continua sem criptografia, e <em>Sim</em> passa à segunda etapa. Esta depende da existência de um arquivo de chave em <code>/usr/local/share/proxmenux/pbs-key.conf</code>. Se existir, ele é reutilizado sem novas perguntas e o backup continua; os backups posteriores também não perguntam novamente. Caso contrário, um menu oferece duas opções. <em>Gerar um novo arquivo de chave</em> executa <code>proxmox-backup-client key create --kdf none</code>. <em>Usar um arquivo de chave existente</em> detecta automaticamente uma chave gerenciada pelo PVE: se o repositório PBS selecionado estiver registrado no Proxmox com uma chave de criptografia em <code>/etc/pve/priv/storage/&lt;NAME&gt;.enc</code>, o arquivo será copiado sem perguntas para o caminho canônico do ProxMenux. Se nenhuma chave PVE corresponder ao repositório, será solicitado o caminho absoluto onde o operador já colocou o arquivo neste host. Nos dois casos, o arquivo fica no caminho canônico com <code>chmod 600</code>.",
+    "modesTitle": "Arquivo de chave por host ou compartilhado",
+    "modesIntro": "Os dois modelos são aceitos e nenhum é obrigatório: o operador escolhe conforme a organização dos seus hosts.",
+    "modesPerHostTitle": "Arquivo de chave por host (padrão)",
+    "modesPerHostBody": "Cada host gera seu próprio arquivo de chaves na primeira vez que ele permite criptografia PBS. O isolamento é máximo: comprometer o arquivo de chaves de um host não expõe os backups de nenhum outro. Recomendado para frotas de produção e ambientes onde hospedeiros têm diferentes proprietários ou limites de conformidade.",
+    "modesSharedTitle": "Arquivo de chaves compartilhado (importação em cada máquina)",
+    "modesSharedBody": "Um arquivo-chave mestre gerado uma vez e instalado em cada host por meio da opção <em>Usar um arquivo-chave existente</em>. O gerenciamento é mais simples: um único segredo para proteger e qualquer host pode descriptografar os arquivos de qualquer outro (útil para consolidação, exercícios de restauração entre hosts ou verificação de backup centralizada). A desvantagem é que um vazamento do arquivo-chave compartilhado expõe todos os hosts de uma só vez. Recomendado para homelabs e frotas onde todos os hosts têm o mesmo proprietário e limite de confiança.",
+    "recoveryTitle": "Chave de envio para PBS — o operador decide",
+    "recoveryBody": "Logo após escolher o arquivo de chave, o ProxMenux pergunta explicitamente <em>Enviar a chave para o PBS?</em>, com duas respostas. <strong>Nenhum artefato de recuperação é enviado ao PBS até o operador responder Sim.</strong> O padrão é <em>Não, manter apenas localmente</em>: a chave fica no caminho canônico local, o ProxMenux não envia artefatos de recuperação ao PBS e o operador cuida da cópia externa. O botão <em>Baixar arquivo de chave</em> do Monitor, na linha do destino PBS, fornece essa cópia quando necessário. Ao escolher <em>Sim, enviar</em>, é solicitada duas vezes uma frase secreta de recuperação, verificando se as duas entradas coincidem. O ProxMenux protege o arquivo com AES-256-CBC e PBKDF2 (600.000 iterações, salt aleatório), produzindo <code>pbs-key.recovery.enc</code>. Cada backup criptografado posterior envia esse envelope ao PBS como um grupo de backup associado. Esses envios não transmitem ao PBS a frase secreta nem o arquivo de chave em texto claro. A escolha pode ser alterada a qualquer momento no Monitor: o controle na linha PBS permite Sim ou Não e aplica imediatamente Iniciar envio, Parar envio ou Atualizar frase secreta, conforme o estado atual.",
+    "blobUploadTitle": "Grupo de backup emparelhado no PBS",
+    "blobUploadBody1": "Quando o modo de garantia é <em>Sim, fazer upload</em>, ProxMenux carrega o envelope de recuperação para PBS após cada backup criptografado como um segundo grupo de backup emparelhado com o mesmo nome do grupo host, mas terminando em <code>-keyrecovery</code>. Os dois grupos ficam próximos um do outro na listagem do armazenamento de dados – um para backups de host e outro para envelopes de recuperação. <strong>O envelope nunca sai do host em texto simples</strong>: a criptografia acontece no próprio host com AES-256-CBC e PBKDF2 antes que qualquer byte seja transmitido (<code>openssl enc -aes-256-cbc -pbkdf2 -iter 600000 -salt</code>). PBS recebe apenas o envelope já criptografado.",
+    "envelopeSecurityTitle": "Carregar o arquivo de recuperação de chaves para PBS é um risco de segurança?",
+    "envelopeSecurityBody": "O arquivo de recuperação de chaves está criptografado em trânsito e em repouso. A senha de recuperação nunca deixa o host: criptografia acontece localmente antes do upload, e PBS só vê o resultado já criptografado. Um administrador PBS — ou qualquer pessoa com acesso ao datastore — pode baixar o arquivo keyrecovery, mas sem a frase-passe de recuperação eles não podem ler o arquivo de chave dentro: é cifrar opaco. Reconstruir o arquivo de chaves requer ambas as peças ao mesmo tempo, o arquivo de recuperação de chaves e a frase-passe, e apenas o operador detém ambas.",
+    "blobUploadConstraintTitle": "Por que dois grupos em vez de um único criptografado",
+    "blobUploadConstraintBody": "Uma única chamada de <code>proxmox-backup-client backup</code> criptografa todos os seus arquivos com a mesma chave ou não criptografa nenhum; não permite misturar os dois casos. O backup do host precisa ser criptografado com a chave do host, mas o envelope de recuperação não pode acompanhá-lo no mesmo envio, pois acabaria criptografado com a própria chave que contém. Em um host recém-instalado, seria impossível abri-lo: seria necessária a chave para descriptografar a própria chave. Por isso os dois artefatos são enviados separadamente e aparecem em dois grupos. O cliente PBS criptografa o backup do host com o arquivo de chave, e o ProxMenux criptografa o envelope com a frase secreta antes do envio. Duas camadas de criptografia diferentes protegem dois elementos distintos.",
+    "blobUploadImageAlt": "PBS UI mostrando os grupos de backup hostcfg-HOSTNAME e hostcfg-HOSTNAME-keyrecovery adjacentes na listagem de datastore.",
+    "blobUploadImageCaption": "Interface PBS — os grupos de backup associados. O grupo principal contém os backups do host; o grupo -keyrecovery contém o arquivo de chave protegido por frase secreta.",
+    "recoverTitle": "Recuperação num novo hospedeiro",
+    "recoverBody": "Quando o arquivo de chave falta no caminho canônico, após reinstalar o host ou removê-lo explicitamente, a restauração tenta três fontes em ordem e para na primeira que fornece uma chave utilizável. Primeiro, se houver uma chave gerenciada pelo PVE correspondente ao repositório PBS selecionado em <code>/etc/pve/priv/storage/&lt;NAME&gt;.enc</code>, ela será copiada sem perguntas para o caminho canônico. Segundo, se houver um grupo <code>-keyrecovery</code> no PBS, será baixado o instantâneo mais recente e solicitada a frase secreta de recuperação para descriptografá-lo. Terceiro, se as opções anteriores falharem ou forem recusadas, o diálogo pedirá o caminho absoluto do arquivo de chave neste host e o copiará para o caminho canônico. O Monitor oferece o mesmo fluxo de importação na janela de detalhes do backup. Um painel âmbar aparece no topo quando Restaurar, Baixar ou Ver conteúdo exige uma chave ausente. Se a chave instalada não corresponde à usada no backup, o PBS retorna <code>wrong key — manifest's key XX does not match provided key YY</code>. As mesmas três ações exibem então um painel estruturado com a impressão digital exigida pelo manifesto em destaque, permitindo identificar qual chave importar para abrir o backup.",
+    "monitorManagementTitle": "Gerenciando o arquivo de chaves do Monitor",
+    "monitorManagementBody": "O Monitor mostra os controles do arquivo de chave diretamente em cada linha de destino PBS na configuração dos backups. Há três ações: <em>Baixar</em> exporta o arquivo atual para o navegador; <em>Enviar</em> substitui o arquivo instalado pelo fornecido pelo operador, sobrescrevendo o anterior somente após a instalação bem-sucedida do novo no caminho canônico; <em>Excluir</em> remove o arquivo do host. Ao lado fica o controle da cópia de recuperação: uma opção Sim/Não para <em>Enviar a chave para o PBS?</em>, um campo de frase secreta quando Sim é escolhido e um botão contextual para aplicar <em>Iniciar envio</em>, <em>Parar envio</em> ou <em>Atualizar frase secreta</em>. Todas as ações usam os mesmos endpoints Flask da interface de terminal; portanto, o efeito em disco e o estado no PBS são idênticos nas duas interfaces."
+  },
+  "restoreAccess": {
+    "heading": "Obtenção no lado da restauração",
+    "body": "A restauração localiza os backups do host ProxMenux no PBS listando os grupos do repositório configurado e filtrando pelo padrão do ID. A aba Backups do Monitor exibe a mesma lista. Escolher um backup executa <code>proxmox-backup-client restore</code> com os mesmos repositório, senha e impressão digital, além de <code>--keyfile</code> se estiver criptografado. O arquivo <code>.pxar</code> é extraído em um diretório de preparação que <code>_rs_check_layout</code> encaminha ao processo normal de restauração. Fora do ProxMenux, o mesmo comando extrai o arquivo no caminho desejado para inspecionar a árvore ou realizar uma restauração manual."
+  },
+  "references": {
+    "heading": "Referências",
+    "intro": "Documentação oficial do Proxmox Backup Server para os componentes usados pelo ProxMenux.",
+    "items": [
+      {
+        "label": "Documentação Proxmox Backup Server",
+        "href": "https://pbs.proxmox.com/docs/",
+        "tail": " — o ponto de entrada principal que abrange a instalação, administração, armazenagem, utilizadores e funções."
+      },
+      {
+        "label": "proxmox-backup-client",
+        "href": "https://pbs.proxmox.com/docs/backup-client.html",
+        "tail": " — a ferramenta de linha de comando que o ProxMenux usa em cada backup e restauração. Descreve IDs e tipos de backup, arquivos, sintaxe dos repositórios e variáveis de ambiente."
+      },
+      {
+        "label": "Criptografia do lado do cliente",
+        "href": "https://pbs.proxmox.com/docs/backup-client.html#encryption",
+        "tail": " — criação do arquivo de chave, modos --kdf e modelo de criptografia que o ProxMenux amplia com uma cópia de recuperação protegida por frase secreta."
+      },
+      {
+        "label": "Gestão de armazenamento de dados",
+        "href": "https://pbs.proxmox.com/docs/storage.html",
+        "tail": " — criação e gerenciamento dos datastores que recebem backups do host, incluindo a estrutura do armazenamento de blocos e as permissões."
+      },
+      {
+        "label": "Poda e coleta de lixo",
+        "href": "https://pbs.proxmox.com/docs/maintenance.html#pruning",
+        "tail": " — o modelo de retenção de --keep-last / --keep-daily / --keep-weekly aplicado pelo ProxMenux em cada tarefa agendada e como o PBS libera blocos não usados após a remoção de backups antigos."
+      }
+    ]
+  }
+}
diff --git a/web/messages/pt/docs/backup-restore/glossary.json b/web/messages/pt/docs/backup-restore/glossary.json
new file mode 100644
index 00000000..cbb802b5
--- /dev/null
+++ b/web/messages/pt/docs/backup-restore/glossary.json
@@ -0,0 +1,230 @@
+{
+  "meta": {
+    "title": "Glossário — Cópia de segurança e restauração ProxMenux",
+    "description": "Termos do sistema de backup e restauração ProxMenux: criptografia, arquivo de chaves, frase-senha, envelope de recuperação, PBS, blocos, rootfs, manifesto, executor e hidratação entre versões do kernel.",
+    "ogTitle": "Glossário das cópias de segurança e do restauro | ProxMenux",
+    "ogDescription": "Definições claras dos termos usados na documentação de backup e restauração ProxMenux.",
+    "twitterTitle": "Glossário das cópias de segurança e do restauro | ProxMenux",
+    "twitterDescription": "Senha, arquivo de chaves, envelope de recuperação, rootfs, manifesto, PBS, blocos — todos definidos em um só lugar."
+  },
+  "header": {
+    "title": "Glossário",
+    "description": "Termos usados através da documentação de backup e restauração, com sua definição.",
+    "section": "Cópias de segurança e restauro"
+  },
+  "intro": {
+    "body": "Os termos são agrupados por tema. Cada entrada dá o termo e uma definição curta."
+  },
+  "groups": [
+    {
+      "title": "Criptografia e recuperação de chaves",
+      "intro": "Vocabulário para o bloco de criptografia PBS. Envolve dois segredos distintos: um arquivo binário e uma frase-passe escrita.",
+      "entries": [
+        {
+          "id": "passphrase-recuperacion",
+          "term": "Senha de recuperação",
+          "def": "Senha de texto que o usuário escolhe para proteger o <a href=\"#sobre-recuperacion\">envelope de recuperação</a>. Ele é solicitado duas vezes com uma verificação de correspondência, e só é usado para criptografar o envelope e para decifrá-lo se o arquivo de chaves alguma vez precisa ser recuperado. <strong>Não é a frase-passe que desbloqueia o próprio arquivo de chaves</strong>, e nunca é enviado para PBS. Durante um backup normal, ele nunca deixa o hospedeiro."
+        },
+        {
+          "id": "clave-cifrado",
+          "term": "Arquivo de chaves (chave de criptografia)",
+          "def": "Arquivo de chave usado por proxmox-backup-client para criptografar os <a href=\"#chunk\">blocos</a> antes do envio ao PBS. Sem a chave correspondente, os dados criptografados não podem ser lidos. O ProxMenux o salva em <code>/usr/local/share/proxmenux/pbs-key.conf</code> com modo <code>600</code>. Proteja-o: o <a href=\"#sobre-recuperacion\">envelope de recuperação</a> permite recuperá-lo se for perdido."
+        },
+        {
+          "id": "contrasena-keyfile",
+          "term": "Frase- senha do ficheiro de chaves (frase- senha do KDF)",
+          "def": "Senha opcional que o próprio arquivo de chaves pode carregar, distinta da frase-passe <a href=\"#passphrase-recuperacion\">de recuperação</a>. Ele só existe quando o arquivo de chaves foi criado com <code>--kdf scrypt</code> (normalmente um arquivo de chaves importadas). Sem ele, o arquivo de chaves não pode ser desbloqueado para uso. ProxMenux persiste em forma criptografada no host para que os backups agendados possam ser executados sem um prompt interativo."
+        },
+        {
+          "id": "sobre-recuperacion",
+          "term": "Envelope de recuperação",
+          "def": "O <a href=\"#clave-cifrado\">ficheiro de chaves</a> protegido por uma camada adicional: é encriptado com a <a href=\"#passphrase-recuperacion\">frase-passe de recuperação</a> através de <a href=\"#aes-256-cbc\">AES-256-CBC</a> e <a href=\"#pbkdf2\">PBKDF2</a> antes de sair do host. É esta versão protegida que é enviada para o PBS no grupo <code>-keyrecovery</code>. Sem a frase-passe, o conteúdo permanece inacessível: descarregá-lo do PBS não revela o ficheiro de chaves."
+        },
+        {
+          "id": "cifrado-cliente",
+          "term": "Criptografia do lado do cliente",
+          "def": "Modelo de criptografia em que os dados são criptografados na máquina de origem antes de serem enviados. O PBS só recebe e armazena texto cifrado; nem mesmo um administrador PBS com acesso a datastore pode lê-lo sem o arquivo de chaves. O ProxMenux baseia-se neste modelo e adiciona o <a href=\"#sobre-recuperacion\">envelope de recuperação</a> no topo."
+        },
+        {
+          "id": "kdf-none",
+          "term": "--kdf none",
+          "def": "Opção para <code>proxmox-backup-client key create</code> que produz um arquivo de chaves sem senha anexada. O arquivo de chaves pode ser usado diretamente sem um prompt, o que é essencial para trabalhos agendados sem acompanhamento. Isto é o que o ProxMenux usa por padrão ao gerar um novo arquivo de chaves."
+        },
+        {
+          "id": "kdf-scrypt",
+          "term": "--kdf scrypt",
+          "def": "Opção para <code>proxmox-backup-client key create</code> que produz um arquivo de chaves protegido por uma <a href=\"#contrasena-keyfile\">frase-senha do arquivo de chave</a>. Cada uso do arquivo de chaves requer desbloqueá-lo com essa frase-passe. O ProxMenux aceita este estilo de arquivo de chaves na importação e armazena a frase-passe criptografada para que os backups agendados ainda possam ser executados sem acompanhamento."
+        },
+        {
+          "id": "aes-256-cbc",
+          "term": "AES-256-CBC",
+          "def": "Cifra simétrica padrão. ProxMenux usa-o (via <code>openssl enc -aes-256-cbc</code>) para embrulhar o <a href=\"#clave-cifrado\">keyfile</a> com a <a href=\"#passphrase-recuperacion\">frase-senha de recuperação</a> e produzir o <a href=\"#sobre-recuperacion\">envelope</a>."
+        },
+        {
+          "id": "pbkdf2",
+          "term": "PBKDF2",
+          "def": "Função criptográfica que transforma uma frase-passe tipo humano em uma chave binária adequada para criptografia. Atrasa as tentativas de força bruta aplicando muitas iterações. ProxMenux usa-o com iterações 600 000 e um sal aleatório ao criptografar o envelope de recuperação."
+        }
+      ]
+    },
+    {
+      "title": "Estrutura de backup",
+      "intro": "Termos que descrevem o que vive dentro de um backup, independentemente do destino.",
+      "entries": [
+        {
+          "id": "rootfs",
+          "term": "rootfs / sistema de ficheiros root",
+          "def": "Uma cópia plana do sistema de arquivos do host fonte, produzido pela <code>rsync</code> sobre o perfil <a href=\"#perfil-defecto\">default</a> mais qualquer caminho <a href=\"#rutas-personalizadas\">custom</a>. Não é uma imagem de disco inteiro: apenas caminhos que contêm configuração ou estado Proxmox não pode regenerar por conta própria são copiados."
+        },
+        {
+          "id": "manifiesto",
+          "term": "Manifesto (manifest.json)",
+          "def": "Documento estruturado JSON descrevendo o host fonte no momento do backup: hardware, armazenamento, kernel, componentes instalados ProxMenux e inventário de VMs e LXCs. É produzido por seis coletores de dados independentes. O fluxo de restauração usa-o para comparar fonte e alvo."
+        },
+        {
+          "id": "staging",
+          "term": "Diretório de preparação",
+          "def": "Diretório temporário onde ProxMenux monta os três blocos (rootfs, metadados e manifestos) antes de embalá-los e enviar para o destino. É removido automaticamente quando o backup termina, mesmo ao abortar."
+        },
+        {
+          "id": "perfil-defecto",
+          "term": "Perfil padrão",
+          "def": "Conjunto selecionado de caminhos copiados por padrão em cada backup: configuração PVE, rede, SSH, kernel, apt, ferramentas ProxMenux e outros. É definido no código e documentado na página <em>Como funciona</em>."
+        },
+        {
+          "id": "rutas-personalizadas",
+          "term": "Caminhos personalizados",
+          "def": "Caminhos extras que o usuário adiciona no topo do perfil <a href=\"#perfil-defecto\">default</a>. Persistente (armazenada em <code>backup-extra-paths.txt</code>) ou por execução (escolhida em modo Personalizado)."
+        }
+      ]
+    },
+    {
+      "title": "Destinos e armazenagem",
+      "intro": "Termos ligados ao local onde o backup chega — servidor PBS, arquivo local ou repositório Borg — e como o PBS organiza os dados.",
+      "entries": [
+        {
+          "id": "repositorio-pbs",
+          "term": "Repositório PBS",
+          "def": "Combinação de Proxmox Backup Server + <a href=\"#datastore\">datastore</a> + usuário que recebe o backup. Identificado pela string <code>user@realm@host:datastore</code>. Um único servidor PBS pode hospedar vários repositórios."
+        },
+        {
+          "id": "datastore",
+          "term": "Armazenamento de dados",
+          "def": "Armazenamento específico em um servidor PBS para backups e seus blocos. Cada datastore fica em um sistema de arquivos do servidor PBS e tem permissões e políticas próprias."
+        },
+        {
+          "id": "chunk",
+          "term": "Bloco (chunk) / desduplicação de blocos",
+          "def": "PBS divide cada backup em blocos de tamanho variável, identifica cada pedaço pelo seu hash e armazena cada pedaço apenas uma vez, mesmo que apareça em muitos backups diferentes. Isto significa que os backups sucessivos da mesma máquina — ou através de hosts semelhantes — ocupam muito pouco espaço adicional."
+        },
+        {
+          "id": "fingerprint",
+          "term": "Impressão digital",
+          "def": "Impressões digitais criptográficas do certificado PBS do servidor TLS. Permite ao cliente verificar se está a falar com o servidor pretendido sem depender de uma autoridade pública de certificação. ProxMenux passa para <code>proxmox-backup-client</code> através da variável de ambiente <code>PBS_FINGERPRINT</code>."
+        },
+        {
+          "id": "grupo-copia",
+          "term": "Grupo de backup",
+          "def": "Container lógico dentro do PBS sob o qual se acumulam sucessivos backups do mesmo ativo. Cada novo backup compartilha deduplicação com os anteriores no mesmo grupo. ProxMenux usa dois grupos por host quando a criptografia está habilitada: um para o backup do host e outro com um sufixo <code>-keyrecovery</code> para o <a href=\"#sobre-recuperacion\">envelope de recuperação</a>."
+        },
+        {
+          "id": "backup-id",
+          "term": "ID de backup",
+          "def": "Nome do <a href=\"#grupo-copia\">grupo de backup</a>. ProxMenux padrão para <code>hostcfg-HOSTNAME</code> e permite que o usuário editá-lo antes do upload; caracteres não suportados são despojados automaticamente."
+        },
+        {
+          "id": "pxar",
+          "term": ".pxar",
+          "def": "Formato de arquivo PBS-native para diretórios. Ele se comporta como um arquivo tar otimizado para desduplicação de blocos: ao invés de armazenar um arquivo opaco, PBS quebra seu conteúdo em pedaços reutilizáveis."
+        }
+      ]
+    },
+    {
+      "title": "Execução e agendamento",
+      "intro": "Termos usados pelo sistema ProxMenux-jobs programados.",
+      "entries": [
+        {
+          "id": "runner",
+          "term": "Executor",
+          "def": "O script <code>run_scheduled_backup.sh</code> que executa um backup agendado. Ele lê a configuração do trabalho, lança o backend correspondente (Local, PBS ou Borg), aplica retenção no sucesso e envia as notificações configuradas."
+        },
+        {
+          "id": "trabajo-programado",
+          "term": "Trabalho agendado",
+          "def": "Configuração persistente de uma cópia de segurança recorrente. Mantém o destino, credenciais, criptografia, programação e retenção. Vive em <code>/var/lib/proxmenux/backup-jobs/&lt;id&gt;.env</code>."
+        },
+        {
+          "id": "modo-adjunto",
+          "term": "Anexar modo",
+          "def": "Tarefa sem temporizador próprio. Um hook job-end PVE de <code>vzdump</code> a executa após os backups dos convidados quando o armazenamento coincide. A tarefa pai fornece o destino e a retenção, relida da tarefa pai em cada execução, mas o hook compara armazenamento, não ID pai. Outra tarefa no mesmo armazenamento também pode acioná-la. Somente Local e PBS."
+        },
+        {
+          "id": "timer-systemd",
+          "term": "Temporizador Systemd",
+          "def": "Mecanismo systemd padrão que dispara um comando em um calendário. ProxMenux cria um temporizador por <em>independente</em> trabalho programado; <a href=\"#modo-adjunto\">attach-mode</a> trabalhos não usam temporizador, eles rodam através do script-hook PVE."
+        },
+        {
+          "id": "retencion",
+          "term": "Retenção (keep-last, keep-daily…)",
+          "def": "Política que decide quais backups mais antigos manter e qual podar. Definido por trabalho com parâmetros como <code>keep-last</code>, <code>keep-daily</code>, <code>keep-weekly</code>, <code>keep-monthly</code>. Aplicado pelo executor após cada backup bem sucedido."
+        }
+      ]
+    },
+    {
+      "title": "Restaurar",
+      "intro": "Termos do fluxo de restauração.",
+      "entries": [
+        {
+          "id": "restauracion-universal",
+          "term": "Restauração universal",
+          "def": "O fluxo de restauração ProxMenux não apenas extrai o sistema de arquivos: ele lê o manifesto para detectar diferenças entre fonte e alvo, reproduz a configuração do sistema e executa novamente os instaladores para os componentes gerenciados ProxMenux. O objetivo é reproduzir o host de origem, não apenas o arquivo."
+        },
+        {
+          "id": "hidratacion",
+          "term": "Hidratação entre versões do kernel",
+          "def": "Etapa de restauração que combina as configurações do usuário na origem (parâmetros IOMMU, IDs VFIO, ajustes específicos e chaves GRUB) com a configuração nova de inicialização do destino, sem copiar literalmente arquivos ligados ao kernel de origem. Executa quando o kernel de destino é mais novo que o do backup."
+        },
+        {
+          "id": "cross-kernel",
+          "term": "Restauração do kernel cruzado",
+          "def": "Restaurar onde o kernel do alvo difere (normalmente é mais novo do que) da fonte. Requer o passe <a href=\"#hidratacion\">hydration</a> para evitar arrastar arquivos incompatíveis com o kernel do alvo."
+        },
+        {
+          "id": "instalador-postboot",
+          "term": "Instalador pós-inicial",
+          "def": "Componentes reinstalados após a primeira inicialização do host restaurado ( drivers NVIDIA, drivers Coral TPU, ferramentas AMD GPU, ferramentas Intel GPU). Cada instalador corre contra o kernel do alvo, então o host restaurado não depende do kernel da fonte estar presente."
+        },
+        {
+          "id": "compatibility-check",
+          "term": "Verificação de compatibilidade",
+          "def": "Comparação entre o manifesto da fonte e o estado do alvo que o ProxMenux realiza no início da restauração. Ele decide quais partes são copiadas verbatim, que precisam de hidratação e que são recriadas por um instalador."
+        },
+        {
+          "id": "equipo-recien-instalado",
+          "term": "Instalação fresca",
+          "def": "Host recém-reinstalado do zero, sem <a href=\"#clave-cifrado\">arquivo de chave</a> local. Para restaurar um backup criptografado, primeiro recupere a chave do <a href=\"#sobre-recuperacion\">envelope</a> armazenado no PBS usando a <a href=\"#passphrase-recuperacion\">frase-senha de recuperação</a>."
+        }
+      ]
+    }
+  ],
+  "whereNext": {
+    "heading": "Onde se segue",
+    "items": [
+      {
+        "label": "Como funciona",
+        "href": "/docs/backup-restore/how-it-works",
+        "tail": " — quando o rootfs, o manifesto e o inventário da aplicação se encaixam num backup."
+      },
+      {
+        "label": "Destino Proxmox Backup Server",
+        "href": "/docs/backup-restore/destinations/pbs",
+        "tail": " — quando a criptografia do lado do cliente, o arquivo de chaves, a frase-passe de recuperação e o envelope são documentados em profundidade."
+      },
+      {
+        "label": "Restauração",
+        "href": "/docs/backup-restore/restoring",
+        "tail": " — fluxo de restauração e uso do manifesto."
+      }
+    ]
+  }
+}
diff --git a/web/messages/pt/docs/backup-restore/how-it-works.json b/web/messages/pt/docs/backup-restore/how-it-works.json
new file mode 100644
index 00000000..8f8f7845
--- /dev/null
+++ b/web/messages/pt/docs/backup-restore/how-it-works.json
@@ -0,0 +1,205 @@
+{
+  "meta": {
+    "title": "Como o backup ProxMenux funciona internamente — rootfs, manifestos, aplicativos",
+    "description": "Descrição detalhada do que um backup ProxMenux contém: os rootfs produzidos pelo rsync do perfil de caminho padrão, o manifesto estruturado construído por seis coletores independentes e o inventário de aplicativos que impulsiona a reinstalação automática de pacotes e componentes após uma restauração.",
+    "ogTitle": "Como o backup ProxMenux funciona internamente",
+    "ogDescription": "Os três blocos de um backup ProxMenux: rootfs, manifesto e aplicativos.",
+    "twitterTitle": "Como funcionam as cópias de segurança ProxMenux | ProxMenux",
+    "twitterDescription": "As três cargas de um backup ProxMenux e como a restauração reproduz o host fonte deles."
+  },
+  "header": {
+    "title": "Como funciona",
+    "description": "A estrutura interna de um backup ProxMenux — sistema de arquivos, manifesto e inventário de aplicativos — e como a restauração usa os três para reproduzir o host de origem em um destino que pode ter outro kernel.",
+    "section": "Cópias de segurança e restauro"
+  },
+  "intro": {
+    "title": "Um arquivo, três blocos",
+    "body": "Cada backup cria três blocos bem definidos em um único diretório de preparação. O arquivo enviado ao destino (<code>.tar.zst</code> local, backup PBS ou arquivo Borg) mantém essa estrutura. A restauração usa os três: <strong>o manifesto</strong> é consultado antes das alterações para detectar diferenças e decidir o que excluir; <strong>rootfs</strong> fornece os arquivos de configuração, aplicados em execução ou após reiniciar; <strong>o inventário de aplicativos</strong> orienta a instalação de pacotes e a reinstalação de componentes após o boot. Cada bloco pode ser inspecionado ou extraído separadamente."
+  },
+  "layout": {
+    "heading": "Disposição do arquivo",
+    "intro": "Cada arquivo segue o mesmo layout de árvore, independentemente do destino. O subdiretório <code>metadata/</code> contém as cargas estruturadas; o subdiretório <code>rootfs/</code> contém a cópia do sistema de arquivos.",
+    "treeCaption": "O diretório de preparação criado durante o backup. Todos os destinos recebem a mesma árvore no formato nativo: tar para backups locais, blocos PBS para PBS e segmentos Borg para Borg.",
+    "tree": "backup-[timestamp]/\n├── manifest.json                  # structured host state\n├── metadata/\n│   ├── packages.manual.list       # apt-mark showmanual\n│   ├── run_info.env               # backup run identity + kernel version + pmxcfs method\n│   ├── paths_archived.txt         # exact list of paths that reached rootfs/\n│   └── missing_paths.txt          # paths from the profile absent on source\n└── rootfs/\n    ├── etc/                       # /etc/pve, /etc/network, /etc/systemd/network, /etc/ssh, …\n    ├── root/                      # /root (with volatile subdirs excluded)\n    ├── usr/local/                 # /usr/local/bin, /usr/local/share/proxmenux, …\n    └── var/                       # /var/lib/pve-cluster (config.db via sqlite3 .backup), /var/spool/cron/…"
+  },
+  "rootfs": {
+    "heading": "A carga útil do rootfs",
+    "intro": "A árvore <code>rootfs/</code> é uma <strong>cópia simples do sistema de arquivos</strong> criada pelo <code>rsync</code> a partir do host de origem. Contém um <strong>perfil padrão</strong> de caminhos selecionados para restaurar o Proxmox e os <strong>caminhos personalizados</strong> adicionados à tarefa ou sessão interativa. A seleção é intencionalmente restrita a caminhos que <em>guardam configuração</em> ou <em>guardam um estado que o Proxmox não consegue recriar sozinho</em>.",
+    "defaultProfileTitle": "O perfil por omissão",
+    "defaultProfileBody": "O perfil padrão é definido por <code>hb_default_profile_paths</code> em <code>lib_host_backup_common.sh</code>. Abrange oito categorias fixas e, quando necessário, o estado ZFS, que juntas descrevem um host Proxmox funcional:",
+    "categoriesTitle": "Categorias de localização",
+    "categoryRows": [
+      {
+        "category": "Núcleo PVE",
+        "paths": "/etc/pve, /var/lib/pve-cluster, /etc/vzdump.conf",
+        "why": "Conteúdo do sistema de ficheiros de cluster e valores por omissão do vzdump. O banco de dados pmxcfs (<code>config.db</code>) é capturado como um instantâneo consistente via <code>sqlite3 .backup</code> sem parar o cluster, e os sidecars <code>.db-wal</code> / <code>.db-shm</code> são excluídos do rsync. Quando o <code>sqlite3</code> não está disponível, é criado <code>config.db.raw-fallback</code>, que a restauração usa automaticamente como banco de dados."
+      },
+      {
+        "category": "Identidade do host e rede",
+        "paths": "/etc/hostname, /etc/hosts, /etc/timezone, /etc/resolv.conf, /etc/network, /etc/systemd/network",
+        "why": "Tudo que o host precisa para entrar na rede com a mesma identidade. Os arquivos <code>.link</code> em <code>/etc/systemd/network</code> fixam nomes de NIC em seus MAC, portanto, reinstalações e alterações de hardware não renomeiam interfaces."
+      },
+      {
+        "category": "Acesso e autenticação",
+        "paths": "/etc/ssh, /etc/sudoers, /etc/sudoers.d, /etc/pam.d, /etc/security",
+        "why": "SSH chaves, regras de sudo e configuração PAM. Perder estas trava o usuário fora da máquina restaurada."
+      },
+      {
+        "category": "Kernel e inicialização",
+        "paths": "/etc/default/grub, /etc/kernel, /etc/modules, /etc/modules-load.d, /etc/modprobe.d, /etc/sysctl.conf, /etc/sysctl.d, /etc/udev/rules.d, /etc/fstab, /etc/iscsi, /etc/multipath",
+        "why": "Tokens IOMMU, lista negra do módulo, IDs do dispositivo VFIO, tabela de montagem, configuração da pilha de armazenamento."
+      },
+      {
+        "category": "Shell e definições regionais",
+        "paths": "/etc/environment, /etc/bash.bashrc, /etc/inputrc, /etc/profile, /etc/profile.d, /etc/locale.gen, /etc/locale.conf",
+        "why": "Configuração do shell, variáveis de ambiente, configuração de geração local."
+      },
+      {
+        "category": "Gerenciamento de pacotes e cron",
+        "paths": "/etc/apt, /etc/cron.d, /etc/cron.{daily,hourly,weekly,monthly}, /etc/cron.allow, /etc/cron.deny, /var/spool/cron/crontabs",
+        "why": "Fontes APT para resolução consistente de pacotes, tarefas agendadas definidas pelo usuário."
+      },
+      {
+        "category": "Estado e ferramentas do ProxMenux",
+        "paths": "/etc/proxmenux, /etc/systemd/system, /etc/log2ram.conf, /etc/logrotate.conf, /etc/logrotate.d, /etc/lm-sensors, /etc/sensors3.conf, /etc/fail2ban, /etc/snmp, /etc/postfix, /etc/wireguard, /etc/openvpn, /etc/grafana, /etc/influxdb, /etc/prometheus, /etc/telegraf, /etc/zabbix",
+        "why": "Ferramentas opcionais, mas comuns Proxmox. Caminhos ausentes são observados em <code>metadata/missing_paths.txt</code> sem parar o backup."
+      },
+      {
+        "category": "Binários & root do ProxMenux",
+        "paths": "/usr/local/bin, /usr/local/sbin, /usr/local/share/proxmenux, /var/lib/proxmenux, /root (subdires voláteis excluídos)",
+        "why": "Binários instalados em ProxMenux e configuração por usuário sob <code>/root</code>. Os caminhos voláteis (<code>.bash_history</code>, <code>.cache/</code>, <code>tmp/</code>, <code>.local/share/Trash/</code>) são excluídos da cópia. O <code>/var/lib/proxmenux</code> mantém as tarefas de backup programadas e o estado de host mantido pelo ProxMenux; o estadiamento da restauração, as cópias de rollback e os marcadores pós-restore são excluídos, porque pertencem ao host que executa uma restauração."
+      },
+      {
+        "category": "Estado ZFS (condicional)",
+        "paths": "/etc/zfs",
+        "why": "Apenas incluído quando o host de origem roda ZFS. Contém <code>zpool.cache</code> e <code>hostid</code>."
+      }
+    ],
+    "customTitle": "Estendendo o perfil com caminhos personalizados",
+    "customBody": "Além do perfil padrão, o ProxMenux oferece duas maneiras de incluir caminhos adicionais em um backup. Eles compõem sem conflito e ambos se aplicam a backups interativos e trabalhos agendados.",
+    "customExtrasTitle": "1. Extras persistentes (por máquina)",
+    "customExtrasBody": "Um arquivo de texto no <code>/usr/local/share/proxmenux/backup-extra-paths.txt</code> contém uma lista de caminhos absolutos que o usuário marcou como \"incluir sempre\" nesta máquina. Quando um backup é executado no modo <strong>Default</strong>, o ProxMenux adiciona esses caminhos ao perfil padrão automaticamente sem perguntar. O arquivo é editado a partir da interface — nenhuma edição manual necessária — e persiste através de reiniciais e atualizações. Um caminho absoluto por linha; <code>#</code> comentários são permitidos.",
+    "customModeTitle": "2. Modo personalizado (por execução)",
+    "customModeBody": "O lançamento de um backup no modo <strong>Custom</strong> substitui a aplicação automática do perfil padrão por uma lista de verificação mostrando todos os caminhos: as entradas de perfil padrão e os extras persistentes (prefixados com <code>[+]</code> e pré-selecionados). O usuário seleciona ou desmarca entradas para essa execução específica, e também pode pressionar <em>Adicionar caminho personalizado</em> para inserir um novo caminho — que é então persistido para o arquivo extras para backups futuros.",
+    "customMissingTitle": "Caminhos ausentes da fonte",
+    "customMissingBody": "Qualquer caminho do perfil (padrão ou adicionado) que não exista no host fonte é gravado em <code>metadata/missing_paths.txt</code> dentro do arquivo. O backup não falha nem para — o usuário vê um resumo de caminhos arquivados e caminhos faltando no final. Na prática, isso acontece para caminhos de ferramentas opcionais como <code>/etc/wireguard</code> ou <code>/etc/prometheus</code> quando essas ferramentas não estão instaladas."
+  },
+  "manifest": {
+    "heading": "O bloco do manifesto",
+    "intro": "<code>manifest.json</code> é um documento JSON estruturado que descreve o host de origem no momento do backup. É produzido por <strong>seis coletores independentes</strong> orquestrados por <code>build_manifest.sh</code>. Cada coletor é somente leitura, produz um fragmento JSON bem definido, e cai de volta para um padrão vazio seguro se falhar — o manifesto ainda é utilizável se uma seção estiver incompleta.",
+    "orchestratorCaption": "Os seis coletores compõem o manifesto. Cada colecionador corre em seu próprio subprocesso; uma falha em um cai de volta para um padrão seguro documentado e avisa, mas não aborta o backup.",
+    "collectorRows": [
+      {
+        "collector": "collect_source_host.sh",
+        "produces": "source_host",
+        "content": "Hostname, versão PVE (<code>pveversion</code>), versão PBS se o host executar o papel do servidor de backup, kernel (<code>uname -r</code>), modo de inicialização (efi/bios), tipo de sistema de arquivos raiz, modelo CPU + arquitetura, memória em KB."
+      },
+      {
+        "collector": "collect_hardware.sh",
+        "produces": "hardware_inventory",
+        "content": "GPUs (com o mapeamento do instalador do fornecedor e ProxMenux), TPUs (Coral USB + M.2 com detecção de <code>lsusb</code>/<code>lspci</code>), NICs (com a associação MAC, slot PCI e ponte), dispositivos sem fio. As entradas GPU têm uma heurística <code>passthrough_eligible</code>."
+      },
+      {
+        "collector": "collect_storage.sh",
+        "produces": "storage_inventory",
+        "content": "ZFS pools (com pool disco do tipo + membro resolvido para <code>/dev/disk/by-id/*</code>, <code>/dev/disk/by-partuuid/*</code> ou em bruto <code>/dev/sdX</code> caminhos dependendo de como cada pool foi originalmente criado), LVM grupos de volume + finos pools, discos físicos com SMART capacidade, PVE <code>storage.cfg</code> entradas, montagens externas."
+      },
+      {
+        "collector": "collect_kernel.sh",
+        "produces": "kernel_params",
+        "content": "Parâmetros adicionados pelo operador em <code>/proc/cmdline</code>, sem os itens padrão como <code>BOOT_IMAGE=</code>, <code>root=</code>, <code>ro/rw</code>, <code>quiet</code> e <code>splash</code>; módulos carregados na inicialização de <code>/etc/modules</code>; caminhos dos arquivos <code>/etc/modprobe.d/*.conf</code> com diretivas efetivas (<code>options</code>, <code>blacklist</code>, <code>install</code>, <code>alias</code>, <code>softdep</code>)."
+      },
+      {
+        "collector": "collect_proxmenux_state.sh",
+        "produces": "proxmenux_installed_components",
+        "content": "Lê <code>/usr/local/share/proxmenux/managed_installs.json</code> (registo de tudo que ProxMenux instalou) e <code>installed_tools.json</code>. Cada entrada mantém o caminho do instalador (<code>menu_script</code>) para que a restauração possa desencadear o mesmo fluxo de instalação."
+      },
+      {
+        "collector": "collect_guests.sh",
+        "produces": "vms_lxcs_at_backup",
+        "content": "Enumera VMs (<code>qm list</code>) e LXCs (<code>pct list</code>) presentes na hora de backup — VMID, nome, estado atual. Apenas o inventário: os dados reais dos hóspedes são da responsabilidade do <code>vzdump</code> / PBS."
+      }
+    ],
+    "schemaTitle": "Validação do esquema",
+    "schemaBody": "O manifesto valida contra <code>scripts/backup_restore/schema/manifest.schema.json</code>. Executar o <code>build_manifest.sh --validate</code> desencadeia uma validação do esquema JSON do lado Python (exige o <code>python3</code> + <code>jsonschema</code>). Se o módulo não estiver presente, a verificação é ignorada silenciosamente — a validação é principalmente um auxílio ao desenvolvedor, não uma dependência de execução."
+  },
+  "applications": {
+    "heading": "O inventário de aplicativos",
+    "intro": "Dois inventários catalogam o software acrescentado aos pacotes básicos do Proxmox VE: a lista de pacotes em <code>metadata/</code> e o registro de componentes em rootfs, detalhados abaixo. A restauração usa APT ou os instaladores do ProxMenux para reproduzir o software do usuário conforme o método original de instalação.",
+    "packagesTitle": "packages.manual.list",
+    "packagesBody": "Uma lista alfabética em texto simples produzida por <code>apt-mark showmanual</code> com os pacotes APT <em>instalados explicitamente</em> no host de origem. As dependências do sistema Proxmox VE básico são excluídas; o APT do destino as instala automaticamente. Durante a restauração, <code>_rs_run_complete_extras</code> lê a lista e aplica um <em>filtro contra remoções em cascata</em> em três etapas: <code>dpkg -s</code> identifica pacotes já instalados, outras versões principais de bibliotecas são detectadas e <code>apt-get install --simulate</code> verifica o risco de remoções em cascata. Os pacotes restantes são instalados com <code>apt-get install -y</code>.",
+    "componentsTitle": "components_status.json (parte dos rootfs)",
+    "componentsBody": "Um registro JSON sob <code>/usr/local/share/proxmenux/</code> que registra cada componente ProxMenux instalou com seu estado exato: versão, bandeiras ProxMenux específicas (para NVIDIA: <code>patched</code> booleano; para Coral: versão DKMS). Este arquivo vive dentro dos rootfs — não em <code>metadata/</code> — porque é <em>lido depois</em> que rootfs foi copiado para o alvo. O expedidor pós-boot (<code>apply_cluster_postboot.sh</code>) itera sobre suas entradas e executa o gancho <code>--auto-reinstall</code> de cada componente, que lê o estado gravado e reproduz a instalação contra o kernel atual do alvo.",
+    "componentInstallersTitle": "Instaladores de componentes",
+    "componentInstallersBody": "Quatro instaladores ProxMenux atualmente expõem um ponto de entrada <code>--auto-reinstall</code>:",
+    "installerRows": [
+      {
+        "component": "nvidia_driver",
+        "installer": "gpu_tpu/nvidia_installer.sh",
+        "action": "Lê-se <code>version</code> + <code>patched</code>. Transfere exatamente o mesmo arquivo de execução NVIDIA, constrói módulos DKMS contra o kernel do alvo, reaplica o patch ProxMenux se a fonte o tiver."
+      },
+      {
+        "component": "coral_driver",
+        "installer": "gpu_tpu/install_coral.sh",
+        "action": "Lê a versão do driver Coral. Compila o módulo DKMS contra o kernel do alvo."
+      },
+      {
+        "component": "amdgpu_top",
+        "installer": "gpu_tpu/amd_gpu_tools.sh",
+        "action": "Lê a versão gravada. Baixa novamente o <code>.deb</code> exato da versão GitHub."
+      },
+      {
+        "component": "intel_gpu_tools",
+        "installer": "gpu_tpu/intel_gpu_tools.sh",
+        "action": "O APT instala o pacote. Idempotente se já presente de <code>packages.manual.list</code>."
+      }
+    ]
+  },
+  "restoreFlow": {
+    "heading": "Como a restauração consome as três cargas",
+    "intro": "A restauração é um processo de seis etapas. Cada etapa lê um subconjunto específico do arquivo e atualiza o host alvo. Nenhuma etapa requer que o host de origem seja acessível — o arquivo é totalmente auto-suficiente.",
+    "stagesCaption": "Estágio 1 usa o manifesto para decidir o que tocar. Estágio 2 copia rootfs caminhos que são seguros para aplicar em um sistema em execução. O estágio 3 encena os caminhos arriscados para a próxima inicialização. Fase 3b importa conjuntos de dados ZFS não-root cujos discos estão todos presentes. Estágio 4 lida com pacotes. O estágio 5 é executado após a reinicialização e reinstala componentes contra o kernel do alvo.",
+    "stageRows": [
+      {
+        "stage": "1",
+        "name": "Verificação de compatibilidade",
+        "reads": "manifest.json",
+        "action": "Corre <code>hb_compat_check</code>. Compara hardware fonte vs. alvo (NICs, IDs de armazenamento), versão PVE e versão principal do kernel. Define <code>HB_COMPAT_KERNEL_DIRECTION</code> (<code>same</code>, <code>bk_newer</code> ou <code>bk_older</code>) e povoa <code>RS_SKIP_PATHS</code> com exclusões de hardware-drift e cross-kernel."
+      },
+      {
+        "stage": "2",
+        "name": "Aplicação em execução",
+        "reads": "rootfs/ (somente caminhos seguros)",
+        "action": "<code>_rs_apply … hot</code> copia entradas <code>hb_classify_path</code>=<code>hot</code> diretamente para o alvo ao vivo. Qualquer coisa sob <code>/etc/pve</code>, <code>/etc/network</code> ou caminhos classificados como <em>reboot</em>/<em>dangerous</em> é adiada."
+      },
+      {
+        "stage": "3",
+        "name": "Preparações pendentes",
+        "reads": "rootfs/ (reboot + caminhos perigosos)",
+        "action": "<code>_rs_prepare_pending_restore</code> prepara os caminhos de risco em <code>/var/lib/proxmenux/pending-restore/</code>, grava <code>plan.env</code>, <code>apply-on-boot.list</code> e <code>rs-skip-paths.txt</code> e ativa <code>proxmenux-restore-onboot.service</code> para a próxima inicialização."
+      },
+      {
+        "stage": "3b",
+        "name": "Importação de pools de dados",
+        "reads": "manifest.storage_inventory + estado ZFS do destino",
+        "action": "<code>_rs_import_data_pools</code> tenta importar cada pool ZFS que não contém a raiz e tem todos os discos presentes no destino. Com hostid de outro host, tenta novamente com <code>zpool import -f</code>. Se faltar um disco, o pool é ignorado com aviso. O resultado por pool é registrado em <code>/var/log/proxmenux/restore-datapools-&lt;timestamp&gt;.log</code>."
+      },
+      {
+        "stage": "4",
+        "name": "Instalar pacote",
+        "reads": "metadata/packages.manual.list",
+        "action": "<code>_rs_run_complete_extras</code> executa o filtro de segurança em cascata e chama <code>apt-get install -y</code> com a lista de pacotes sobreviventes. Saída completa vai para <code>/var/log/proxmenux/restore-apt-*.log</code>."
+      },
+      {
+        "stage": "5",
+        "name": "Após o arranque",
+        "reads": "rootfs (já aplicado) + components_status.json",
+        "action": "Após reiniciar, <code>apply_pending_restore.sh</code> reproduz os caminhos diferidos e <code>apply_cluster_postboot.sh</code> executa <code>update-initramfs</code>, <code>update-grub</code> (ou <code>proxmox-boot-tool refresh</code>) e itera sobre <code>components_status.json</code> disparando o gancho <code>--auto-reinstall</code> de cada componente."
+      }
+    ]
+  },
+  "whyItWorks": {
+    "heading": "Por que dividir o backup em três blocos",
+    "body": "A divisão segue o <strong>ciclo de vida</strong> dos dados. O sistema de arquivos é transferido com <code>rsync</code>: rápido, transparente e atômico por arquivo. O estado de configuração a interpretar antes das alterações é <strong>JSON estruturado</strong>, legível separadamente, versionável por esquema e comparável automaticamente com o estado do destino. O software a reinstalar é descrito em um <strong>inventário</strong> de nomes e versões; o gerenciador de pacotes e os instaladores do ProxMenux escolhem os binários adequados. Cada bloco atende ao próprio objetivo. Juntos, buscam uma restauração coerente com tolerância a falhas: um manifesto corrompido deixa rootfs recuperável, um pacote ausente não impede instalar componentes e uma falha em uma entrada não interrompe a seguinte."
+  }
+}
diff --git a/web/messages/pt/docs/backup-restore/index.json b/web/messages/pt/docs/backup-restore/index.json
new file mode 100644
index 00000000..950b34e2
--- /dev/null
+++ b/web/messages/pt/docs/backup-restore/index.json
@@ -0,0 +1,93 @@
+{
+  "meta": {
+    "title": "ProxMenux Backup e restauração — Visão geral | Backup e restauração completos do host para Proxmox VE",
+    "description": "ProxMenux Backup & Restore captura o estado completo de um host Proxmox – sistema de arquivos, manifesto de configuração estruturado e pacotes/componentes instalados – e o reproduz no mesmo host ou em um host diferente. O backup e a restauração são independentes: não há dependências externas e as restaurações entre kernels são suportadas por meio de um filtro de subconjunto seguro com reconhecimento de direção e hidratação independente do kernel.",
+    "ogTitle": "ProxMenux Backup e restauração — Visão geral",
+    "ogDescription": "Backup e restauração completos do host para Proxmox VE com manifesto estruturado, lista de pacotes e reinstaladores de componentes.",
+    "twitterTitle": "ProxMenux Backup e restauração | ProxMenux",
+    "twitterDescription": "Backup e restauração completos do host para Proxmox VE com manifesto estruturado, lista de pacotes e reinstaladores de componentes."
+  },
+  "header": {
+    "title": "Backup e restauração",
+    "description": "Backup e restauração de host completo para Proxmox VE. Captura o sistema de arquivos, a configuração e os componentes instalados em um único arquivo e reproduz o host na mesma instalação do Proxmox ou em uma instalação diferente, sem dependências externas.",
+    "section": "Backup e restauração"
+  },
+  "intro": {
+    "title": "O que é, em um parágrafo",
+    "body": "Uma cópia do ProxMenux guarda o estado completo de um host Proxmox: <strong>o sistema de ficheiros</strong>, com os diretórios relevantes em <code>/etc</code>, <code>/root</code> e <code>/var/lib/pve-cluster</code> e os caminhos personalizados opcionais; <strong>um manifesto estruturado</strong> em JSON com o hardware detetado, parâmetros do kernel, configuração de rede, estado do ZFS, utilizadores e entradas cron; e <strong>um inventário de aplicações</strong>, com os pacotes que o APT marca como instalados manualmente e os componentes instalados pelo ProxMenux, incluindo as versões exatas. Os três destinos suportados — arquivo local, Proxmox Backup Server (recomendado) e Borg — recebem o mesmo conteúdo autónomo. Qualquer um permite reconstruir o host de destino sem que o host de origem tenha de estar acessível durante o restauro."
+  },
+  "video": {
+    "heading": "Vídeo passo a passo",
+    "intro": "Prefere assistir o Backup e Restauração em ação antes de configurá-lo? Este passo a passo abrange uma demonstração completa do recurso em ProxMenux.",
+    "title": "ProxMenux — Passo a passo sobre backup e restauração",
+    "caption": "Vídeo externo em YouTube. Reproduz no modo de privacidade aprimorada (sem cookies até você apertar play)."
+  },
+  "whatItIsNot": {
+    "heading": "O que não é",
+    "intro": "Esta secção abrange a cópia de segurança e o restauro <strong>do host</strong>: a instalação do Proxmox, não as aplicações e os sistemas convidados que nela são executados.",
+    "items": [
+      "<strong>Não é uma ferramenta de backup de VM/CT.</strong> Esta funcionalidade não guarda os discos nem o estado da RAM dos sistemas convidados; essa é a função do <code>vzdump</code>. Os <strong>ficheiros de configuração</strong> dos convidados (<code>/etc/pve/nodes/&lt;node&gt;/qemu-server/*.conf</code> e <code>lxc/*.conf</code>) <strong>são</strong> guardados. Após o restauro, o inventário reaparece e os discos podem ser restaurados ou associados a partir de um backup existente no PBS ou em armazenamento local.",
+      "<strong>Não é uma operação sobre todo o cluster.</strong> Cada nó cria a sua própria cópia. A pertença ao cluster é guardada em <code>/etc/pve</code> para permitir reintegrar um nó restaurado, mas recuperar todo o cluster exige coordenar o restauro dos vários nós.",
+      "<strong>Não é uma imagem completa do disco.</strong> Os binários do kernel, o initramfs e a partição de arranque não são guardados. Durante o restauro, o ProxMenux utiliza os ficheiros de arranque do host de destino, regenerados automaticamente por <code>update-initramfs</code> e pela ferramenta do gestor de arranque, e instala os controladores adequados ao kernel em execução no destino."
+    ]
+  },
+  "threePillars": {
+    "heading": "Os três pilares de um backup",
+    "intro": "Um arquivo ProxMenux é estruturado em torno de três cargas independentes. A restauração usa as três em conjunto para reproduzir o host de origem em um destino que pode nem ter o mesmo kernel instalado.",
+    "diagramCaption": "Cada backup envia as mesmas três cargas, independentemente do destino. A restauração consome todos os três: rootfs para estabelecer arquivos, manifesto para detectar desvios e diferenças entre kernels e inventário de aplicativos para reinstalar pacotes e componentes no próprio kernel do destino.",
+    "pillar1Label": "Sistema de ficheiros",
+    "pillar1Detail": "rootfs/\n(rsync de /etc,\n/etc/systemd/network,\n/root, mais um\ninstantâneo sqlite3\nde /var/lib/pve-cluster,\n+ caminhos opcionais)",
+    "pillar2Label": "Manifesto",
+    "pillar2Detail": "manifest.json\n(hardware, parâmetros\ndo kernel, rede,\nZFS, usuários, cron,\npools ZFS, armazenamento)",
+    "pillar3Label": "Aplicativos",
+    "pillar3Detail": "packages.manual.list\n+ components_status.json\n(pacotes APT manuais + instaladores\nProxMenux com versões)"
+  },
+  "restoreIsUniversal": {
+    "heading": "A restauração reproduz o host de origem, não o arquivo",
+    "body": "A restauração de um backup ProxMenux não extrai apenas o sistema de arquivos. O fluxo de restauração lê o manifesto para detectar desvios entre a origem e o destino (diferenças de hardware, renomeações de NIC, versão do kernel, identidade do pool ZFS), reproduz o sistema de arquivos e aciona o instalador de componente correto para cada serviço que foi instalado na origem (driver NVIDIA, Coral TPU, ferramentas de GPU AMD, ferramentas Intel GPU). Cada instalador é executado no <strong>kernel atual do destino</strong>, portanto, o host restaurado não depende da presença do kernel da origem. Quando o kernel do destino é mais recente que o do backup, um passo de <strong>hidratação</strong> independente do kernel mescla o próprio ajuste do usuário (tokens IOMMU, IDs de dispositivos VFIO, peculiaridades personalizadas, chaves GRUB) na nova configuração de inicialização do destino sem copiar arquivos vinculados ao kernel literalmente."
+  },
+  "twoInterfaces": {
+    "heading": "Duas interfaces, um back-end",
+    "intro": "Cada etapa do fluxo de trabalho de backup e restauração está disponível em dois pontos de entrada. Ambos chamam a mesma biblioteca shell, produzem arquivos idênticos e leem o mesmo registro de tarefas.",
+    "cliLabel": "ProxMenux Scripts (TUI)",
+    "cliDetail": "menu → Utilitários →\nBackup/restauração de host\n\nFluxo baseado em diálogo,\nSSH amigável, programável\npara uso não supervisionado.",
+    "webLabel": "ProxMenux Monitor (Web UI)",
+    "webDetail": "Aba Backups na\ninterface web do Monitor.\n\nRestauração com um clique,\nacompanhamento dos logs ao vivo,\nintegração com notificações e o\nvisualizador de diferenças da reversão."
+  },
+  "whereNext": {
+    "heading": "Para onde ir a partir daqui",
+    "intro": "Cada subseção abaixo aborda detalhadamente um aspecto do fluxo de trabalho. Comece com <em>Como funciona</em> se o objetivo é entender o que o arquivo contém e por quê. Vá para <em>Destinos</em> para configurar o destino da cópia. Leia <em>Restauração</em> e <em>Restauração entre kernels</em> para o lado da recuperação.",
+    "items": [
+      {
+        "label": "Como funciona",
+        "href": "/docs/backup-restore/how-it-works",
+        "tail": "— os três payloads (rootfs, manifesto, aplicações) em detalhes, com os coletores que os produzem e o formato de cada arquivo."
+      },
+      {
+        "label": "Destinos",
+        "href": "/docs/backup-restore/destinations",
+        "tail": "— comparação entre local, Proxmox Backup Server (recomendado) e Borg, e como configurar cada um."
+      },
+      {
+        "label": "Criando backups",
+        "href": "/docs/backup-restore/creating-backups",
+        "tail": "— backups únicos, perfil de caminho padrão, adição de caminhos personalizados, criptografia para PBS."
+      },
+      {
+        "label": "Trabalhos agendados",
+        "href": "/docs/backup-restore/scheduled-jobs",
+        "tail": "— novos trabalhos versus anexação a um trabalho PVE vzdump existente, formatos de agendamento, modal de detalhes do trabalho."
+      },
+      {
+        "label": "Restauração",
+        "href": "/docs/backup-restore/restoring",
+        "tail": "— as três ações em um arquivo (visualizar, baixar, restaurar), restauração completa versus restauração personalizada, o despachante pós-inicialização e por que os últimos dez minutos são importantes."
+      },
+      {
+        "label": "Restauração entre kernels",
+        "href": "/docs/backup-restore/cross-kernel",
+        "tail": " — comportamento que considera a direção da mudança de versão quando o kernel do destino difere do kernel do backup, filtro de subconjunto seguro e quatro fases de hidratação."
+      }
+    ]
+  }
+}
diff --git a/web/messages/pt/docs/backup-restore/restoring.json b/web/messages/pt/docs/backup-restore/restoring.json
new file mode 100644
index 00000000..44ab6673
--- /dev/null
+++ b/web/messages/pt/docs/backup-restore/restoring.json
@@ -0,0 +1,282 @@
+{
+  "meta": {
+    "title": "Restaurando um backup — fluxos completos e personalizados ProxMenux",
+    "description": "O fluxo de trabalho completo de restauração. Documenta as três ações disponíveis em qualquer backup (ver, baixar, restaurar), a verificação de compatibilidade e seus resultados, os modos de restauração Full e Custom, a classificação do caminho que decide o que se aplica ao vivo e o que espera pela próxima inicialização, o expedidor on-boot e o passe de reinstalação do componente pós-boot.",
+    "ogTitle": "Cópia de segurança ProxMenux — restauração",
+    "ogDescription": "Fluxos de restauração completos e personalizados com a verificação de compatibilidade, classificação de caminho, despacho on-boot e reinstalação pós-boot.",
+    "twitterTitle": "Restaurando uma cópia de segurança de ProxMenux",
+    "twitterDescription": "Como um backup de host ProxMenux é transformado de volta em um host Proxmox funcionando."
+  },
+  "header": {
+    "title": "Restaurar uma cópia de segurança",
+    "description": "O fluxo de trabalho completo de restauração: de escolher um arquivo para uma máquina de trabalho. Documenta a verificação de compatibilidade, os dois modos de restauração, o expedidor on-boot, o passe de reinstalação pós-boot, e os mecanismos que tornam previsível o cross-host e o cross-kernel.",
+    "section": "Cópias de segurança e restauro"
+  },
+  "intro": {
+    "title": "A restauração reproduz a fonte, não apenas os arquivos",
+    "body": "Restaurar um backup ProxMenux exige mais que extrair arquivos. Antes das alterações, o manifesto é consultado para detectar diferenças entre origem e destino, caminhos que poderiam impedir o boot são excluídos e ajustes do usuário que não podem ser copiados literalmente são adaptados. Após a reinicialização necessária, tenta-se reinstalar os componentes compatíveis registrados (driver NVIDIA, Coral TPU e ferramentas GPU) para o kernel em execução no destino. Um único arquivo orienta a compatibilidade, a classificação dos caminhos e o trabalho durante e após o boot. Verifique os resultados dos componentes e os logs para confirmar o resultado."
+  },
+  "threeActions": {
+    "heading": "Três ações em um backup",
+    "intro": "A seleção de uma cópia de segurança da lista abre um menu com três ações.",
+    "actionRows": [
+      {
+        "action": "Ver",
+        "detail": "Abre uma visão somente de leitura do arquivo: conteúdo manifest.json (nome do host de origem, versão PVE, kernel, hardware, componentes instalados), a lista de caminhos dentro do <code>rootfs/</code>, e uma diff do que mudaria no host atual se o backup fosse aplicado."
+      },
+      {
+        "action": "Transferir",
+        "detail": "Exporta o arquivo como um arquivo portátil <code>.tar.zst</code> (tar comprimido com zstd). Pode ser extraído em qualquer sistema Linux com <code>tar --zstd -xf FILE.tar.zst</code>, ou em macOS/Windows com qualquer ferramenta que suporte zstd (7-Zip, PeaZip, Keka...). A árvore extraída contém <code>manifest.json</code>, <code>metadata/</code> e <code>rootfs/</code> — exatamente o mesmo layout que a restauração consome. Útil para inspeção offline ou para restauração em um host sem acesso ao destino original (PBS, Borg)."
+      },
+      {
+        "action": "Restaurar",
+        "detail": "O caminho de escrita. Extrai o arquivo em um diretório de encenação, executa a verificação de compatibilidade e apresenta o seletor de modo (Full ou Custom)."
+      }
+    ]
+  },
+  "compatibilityCheck": {
+    "heading": "Verificação da compatibilidade",
+    "intro": "Antes de qualquer arquivo ser escrito, <code>hb_compat_check</code> compara o estado descrito no manifesto contra o host alvo. A verificação executa somente leitura e produz quatro saídas independentes que impulsionam o resto da restauração.",
+    "outputRows": [
+      {
+        "output": "Marca da direcção",
+        "detail": "<code>HB_COMPAT_KERNEL_DIRECTION</code> assume <code>same</code>, <code>bk_newer</code> ou <code>bk_older</code> ao comparar as versões principais do kernel do backup e do destino. Orienta o filtro de caminhos seguros entre kernels, ativo apenas em <code>bk_older</code>, e a adaptação de ajustes descrita na página correspondente."
+      },
+      {
+        "output": "Lista de caminhos excluídos",
+        "detail": "<code>RS_SKIP_PATHS</code> — cada caminho que a restauração não deve aplicar-se. Populado por dois mecanismos: deriva de hardware (falta de NIC, falta de ID de armazenamento, estrangeiro ZFS pool) e — quando a direcção é <code>bk_older</code> — a lista dos caminhos insegura."
+      },
+      {
+        "output": "Plano de remapeamento da NIC",
+        "detail": "Quando um NIC no alvo tem o mesmo MAC que um na fonte, mas um nome diferente (típico após uma troca de placa-mãe), a verificação de compatibilidade registra um plano de renome (<code>HB_NIC_REMAP</code>) que irá reescrever <code>/etc/network/interfaces</code> durante a restauração."
+      },
+      {
+        "output": "Plano de reversão",
+        "detail": "Calculado por <code>compute_rollback_plan.sh</code>. Lista VMs, LXCs e componentes presentes no destino e ausentes do backup. A confirmação permite remover os hóspedes adicionais antes de reiniciar. A remoção dos componentes continua manual e a exclusão dos hóspedes pode falhar, sem garantia de correspondência exata."
+      }
+    ],
+    "reportBody": "A verificação também emite um relatório estruturado (<code>HB_COMPAT_RESULTS</code>) classificado como PASS / INFO / WARN / FAIL. AVISO e entradas de FAIL superfície no painel pré-restaurar; a restauração se recusa a prosseguir apenas quando um FAIL está presente que o usuário não pode resolver clicando em Continuar."
+  },
+  "twoModes": {
+    "heading": "Restauração completa vs Restauração personalizada",
+    "intro": "Após a verificação de compatibilidade, aparece a escolha do modo. Ela determina <em>o que</em> aplicar e não <em>como</em>: os dois modos usam o mesmo processo.",
+    "modeRows": [
+      {
+        "mode": "Restauração completa",
+        "detail": "Aplica cada caminho no arquivo que sobrevive aos filtros de deriva e cross-kernel. Também executa a instalação do pacote e o componente auto-reinstalar passe. Este é o padrão e a escolha recomendada — o objetivo é reproduzir a fonte, não pegar peças."
+      },
+      {
+        "mode": "Restauração personalizada",
+        "detail": "Abre uma lista de verificação mostrando cada caminho que o arquivo carrega. O usuário marca um subconjunto. Os caminhos bloqueados pelo filtro do kernel cruzado aparecem acinzentados e não podem ser selecionados. A instalação do pacote e a auto-reinstalação do componente são ignoradas por padrão no modo Personalizado — o usuário está sinalizando que deseja uma aplicação parcial, não uma reprodução completa."
+      }
+    ]
+  },
+  "pathClassification": {
+    "heading": "Como os caminhos são classificados",
+    "intro": "Cada caminho selecionado para a restauração é classificado por <code>hb_classify_path</code> em uma das três categorias. A categoria determina quando o caminho é aplicado ao sistema e porquê.",
+    "rows": [
+      {
+        "class": "hot",
+        "detail": "Caminhos aplicados <strong>imediatamente</strong> para o sistema de execução. O serviço que os consome capta a mudança por conta própria ou na próxima recarga — não é necessário reiniciar. Estes são a maior parte de um backup: <code>/etc/ssh</code>, <code>/etc/apt</code>, <code>/etc/cron.*</code>, <code>/root</code>, <code>/usr/local/bin</code>, arquivos de configuração de serviço geral, etc."
+      },
+      {
+        "class": "reboot",
+        "detail": "Caminhos adiados para a <strong>próxima inicialização</strong>, em vez de aplicados <strong>imediatamente</strong> por este processo. Afetam a configuração de boot: a geração do carregador lê <code>/etc/default/grub</code>, as montagens usam <code>/etc/fstab</code> e a carga de módulos usa <code>/etc/modules</code>. Os arquivos pendentes são aplicados após reiniciar e os artefatos de boot necessários são então regenerados. Exemplos: <code>/etc/default/grub</code>, <code>/etc/kernel</code>, <code>/etc/modules</code>, <code>/etc/fstab</code>, <code>/etc/zfs</code>, <code>/etc/modprobe.d</code>."
+      },
+      {
+        "class": "dangerous",
+        "detail": "Caminhos <strong>NÃO aplicados no sistema em execução</strong>: uma escrita a quente poderia corromper o estado ou cortar a ligação ativa. Ficam no conjunto pendente: <code>/etc/network</code> é escrito no início do arranque seguinte, antes de a rede arrancar, e <code>/etc/pve</code> é escrito pelo dispatcher pós-arranque quando o sistema de ficheiros do cluster está disponível. Exemplos: <code>/etc/pve</code> (pmxcfs é uma montagem FUSE com a configuração ativa do cluster), <code>/var/lib/pve-cluster</code> (dados ativos do cluster, guardados no diretório de recuperação apenas para recuperação manual), <code>/etc/network</code> (poderia reconfigurar a própria interface usada pela ligação SSH e cortar a sessão)."
+      }
+    ]
+  },
+  "fullFlow": {
+    "heading": "O fluxo de trabalho completo de restauração",
+    "intro": "O pipeline completo da seleção de arquivos para uma máquina de trabalho restaurada. Cada etapa alimenta a seguinte; o estado escrito por fases anteriores é consumido por fases posteriores.",
+    "diagram": "┌─────────────────────────────────────────────────────────────────┐\n│  Archive → staging_root/                                        │\n│    manifest.json   metadata/   rootfs/                          │\n└──────────────────────────────┬──────────────────────────────────┘\n                               │\n                               ▼\n   ┌─────────────────────────────────────────────────────────┐\n   │  1. hb_compat_check                                     │\n   │     · hardware drift → RS_SKIP_PATHS                    │\n   │     · kernel direction → same / bk_newer / bk_older     │\n   │     · NIC remap plan                                    │\n   │     · hydration plan (bk_older only)                    │\n   │     · rollback plan                                     │\n   └──────────────────────────────┬──────────────────────────┘\n                                  │\n                                  ▼\n   ┌─────────────────────────────────────────────────────────┐\n   │  2. Confirmation dialog                                 │\n   │     Shows: hot count, pending count, drift, hydration,  │\n   │     NIC remap, cross-kernel note, reinstalls preview    │\n   └──────────────────────────────┬──────────────────────────┘\n                                  │ (accepted)\n                                  ▼\n   ┌─────────────────────────────────────────────────────────┐\n   │  3. Apply hot paths → LIVE                              │\n   │     _rs_apply rsyncs each hot path                      │\n   │     from staging_root/rootfs to /                       │\n   │     (skips paths in RS_SKIP_PATHS)                      │\n   └──────────────────────────────┬──────────────────────────┘\n                                  │\n                                  ▼\n   ┌─────────────────────────────────────────────────────────┐\n   │  4. _rs_prepare_pending_restore                         │\n   │     /var/lib/proxmenux/pending-restore/                 │\n   │       ├── apply-on-boot.list                            │\n   │       ├── plan.env                                      │\n   │       ├── rs-skip-paths.txt                             │\n   │       └── rootfs/ (deferred paths)                      │\n   │     Enable proxmenux-restore-onboot.service             │\n   └──────────────────────────────┬──────────────────────────┘\n                                  │\n                                  ▼\n   ┌─────────────────────────────────────────────────────────┐\n   │  4b. _rs_import_data_pools                              │\n   │      Imports non-root ZFS pools whose disks are all     │\n   │      present; retries with -f on foreign hostid;        │\n   │      skips with a warning when disks are missing.       │\n   │      Log: /var/log/proxmenux/restore-datapools-*.log    │\n   └──────────────────────────────┬──────────────────────────┘\n                                  │\n                                  ▼\n   ┌─────────────────────────────────────────────────────────┐\n   │  5. _rs_run_complete_extras                             │\n   │     packages.manual.list                                │\n   │       → cascade-safe filter                             │\n   │       → apt-get install                                 │\n   └──────────────────────────────┬──────────────────────────┘\n                                  │\n                                  ▼\n   ┌─────────────────────────────────────────────────────────┐\n   │  6. REBOOT                                              │\n   └──────────────────────────────┬──────────────────────────┘\n                                  │\n                                  ▼\n   ┌─────────────────────────────────────────────────────────┐\n   │  7. apply_pending_restore.sh (on early boot)            │\n   │     Reads plan.env                                      │\n   │     Applies apply-on-boot.list (filtered)               │\n   │     Installs the postboot systemd unit                  │\n   └──────────────────────────────┬──────────────────────────┘\n                                  │\n                                  ▼\n   ┌─────────────────────────────────────────────────────────┐\n   │  8. apply_cluster_postboot.sh (~10 minutes)             │\n   │     Runs after pve-cluster is up                        │\n   │     · Applies /etc/pve entries to pmxcfs                │\n   │     · update-initramfs -u -k all                        │\n   │     · update-grub / proxmox-boot-tool refresh           │\n   │     · component --auto-reinstall (nvidia, coral, ...)   │\n   │     · Boot sanity check                                 │\n   │     · Notification: \"Host restore finished\"             │\n   └─────────────────────────────────────────────────────────┘"
+  },
+  "pendingMachinery": {
+    "heading": "A máquina de restauro pendente",
+    "intro": "Os caminhos classificados como <code>reboot</code> ou <code>dangerous</code>, e a hidratação escreve, são encenados para o próximo boot em vez de serem aplicados ao vivo. Isto é feito através de um pequeno conjunto de arquivos auto-suficientes sob <code>/var/lib/proxmenux/pending-restore/</code>:",
+    "rows": [
+      {
+        "file": "apply-on-boot.list",
+        "content": "Um caminho relativo por linha — o conjunto exato de caminhos <code>apply_pending_restore.sh</code> será aplicado a partir dos rootfs encenados. A leitura deste ficheiro diz ao utilizador exactamente o que irá mudar na próxima inicialização."
+      },
+      {
+        "file": "plan.env",
+        "content": "Variáveis de ambiente carregadas pelo script de inicialização: ID da restauração, indicadores de compatibilidade (<code>HB_COMPAT_CROSS_VERSION</code>, <code>HB_COMPAT_KERNEL_DIRECTION</code>, <code>HB_HYDRATION_APPLIED</code>), consentimento para reversão e opções do cluster."
+      },
+      {
+        "file": "rs-skip-paths.txt",
+        "content": "A lista final <code>RS_SKIP_PATHS</code>, persistiu assim que <code>apply_pending_restore.sh</code> aplica as mesmas exclusões após reinicialização que foram computadas durante a etapa interativa. Impedi que caminhos inseguros sejam restaurados no momento do arranque."
+      },
+      {
+        "file": "rootfs/",
+        "content": "Os próprios arquivos encenados — os bytes exatos que serão estabelecidos. Mantido no mesmo sistema de arquivos que <code>/</code> para que o rsync on-boot é rápido e não depende de armazenamento externo ainda sendo acessível no arranque."
+      }
+    ],
+    "unitBody": "A unidade systemd <code>proxmenux-restore-onboot.service</code> é ativada ao fim da etapa interativa. Esse serviço executa uma vez no início do próximo boot, chama <code>apply_pending_restore.sh</code> e depois se desativa. A condição <code>ConditionPathExists=/var/lib/proxmenux/pending-restore/state</code> impede qualquer ação quando não há restauração pendente."
+  },
+  "postbootDispatcher": {
+    "heading": "O expedidor pós-boot — apply_cluster_postboot.sh",
+    "intro": "Onde termina o passo interativo e onde acontece a reprodução real do hospedeiro. O <code>apply_cluster_postboot.sh</code> é instalado como uma segunda unidade systemd de um tiro (<code>proxmenux-apply-cluster-postboot.service</code>) cujos alvos <code>After=</code>/<code>Wants=</code> garantem que ele seja executado apenas após pve-cluster e network-online estão em cima. Aqui é onde o hospedeiro-visível restaurar ações terra.",
+    "tasks": [
+      {
+        "task": "Aplicar /etc/pve",
+        "detail": "<code>/etc/pve</code> é uma montagem FUSE ao vivo pmxcfs — não pode ser escrita no arranque inicial. O expedidor copia arquivos dos rootfs pendentes para o <code>/etc/pve</code> ao vivo uma vez que o sistema de arquivos de cluster está acima, um arquivo de cada vez, sem reiniciar pve-cluster. O <code>/var/lib/pve-cluster/config.db</code> capturado do backup (ou o <code>config.db.raw-fallback</code>) é materializado com o <code>systemctl stop pve-cluster</code> → cópia de arquivo atômico → <code>systemctl start pve-cluster</code> padrão, então pmxcfs re-ler o estado restaurado no caminho de volta."
+      },
+      {
+        "task": "Reconstruir initramfs e bootloader",
+        "detail": "Executa <code>update-initramfs -u -k all</code> através de cada kernel instalado, em seguida, <code>update-grub</code> (GRUB instala) ou <code>proxmox-boot-tool refresh</code> (systemd-boot / ZFS instala). Pulou se o passo interativo determinou que nada mudou nos caminhos que afetam essas ferramentas."
+      },
+      {
+        "task": "Reinstalar automaticamente o componente",
+        "detail": "Lê <code>components_status.json</code> restaurado e percorre os instaladores compatíveis (nvidia_driver, coral_driver, amdgpu_top, intel_gpu_tools). Cada instalador selecionado usa <code>--auto-reinstall</code>, lê o estado registrado e reinstala para o ambiente de destino, recompilando módulos quando necessário. A operação espera o reboot para usar o kernel então ativo. Falhas individuais são registradas e não interrompem o próximo componente."
+      },
+      {
+        "task": "Verificação da inicialização",
+        "detail": "Antes de iniciar a notificação de conclusão, verifica que <code>proxmox-boot-tool status</code> mostra um ESP configurado, cada <code>/boot/vmlinuz-*</code> tem um diretório <code>/lib/modules/&lt;ver&gt;</code> correspondente, e <code>/vmlinuz</code> resolve. Qualquer inconsistência aparece na notificação em vez de ser escondida."
+      },
+      {
+        "task": "Notificação de conclusão",
+        "detail": "Envia o evento <code>Host restore finished</code> através de <code>hb_notify_lifecycle</code>. Inclui duração total, contagem de caminhos aplicados, avisos de verificação de sanidade, se houver, e um link para o log em <code>/var/log/proxmenux/proxmenux-cluster-postboot-*.log</code>. Se as notificações não forem configuradas, o evento é silencioso — o registro ainda registra tudo."
+      }
+    ]
+  },
+  "liveProgress": {
+    "heading": "Progresso ao vivo na aba Backups do Monitor",
+    "body": "Após a reinicialização da guia Backups do ProxMenux Monitor, um cartão pós-restore ao vivo reflete o estado do <code>proxmenux-apply-cluster-postboot.service</code> enquanto ele é executado. O cartão é conduzido pelo <code>/var/lib/proxmenux/restore-state.json</code>, que o expedidor atualiza em cada marco (aplicar configuração de cluster, reconstruir initramfs, atualizar carregador de boot, reinstalar por componente, verificar sanidade de inicialização, finalizar).",
+    "fields": [
+      {
+        "name": "Emblema de estado",
+        "detail": "Um dos estados <em>Restauração em andamento</em>, <em>Restauração concluída</em> ou <em>Restauração falhou</em>. O cartão consulta o arquivo a cada 2 segundos durante a execução e a cada 30 segundos depois."
+      },
+      {
+        "name": "Barra de progresso + contador de passos",
+        "detail": "Mostra <code>N/M steps</code> e o nome da etapa atual. Durante a restauração, o <em>tempo estimado</em> é calculado com base nas etapas concluídas e no tempo decorrido."
+      },
+      {
+        "name": "Lista de componentes",
+        "detail": "Uma linha por driver sendo reinstalado (NVIDIA, ferramentas Intel GPU, ferramentas AMD, Coral TPU) com <code>installing</code> / <code>ok</code> / <code>failed</code> mais um link para o log por componente em <code>/var/log/proxmenux/component-*.log</code>."
+      },
+      {
+        "name": "Importação de pools de dados",
+        "detail": "O bloco <code>data_pools_import</code> mostra cinco linhas coloridas: <em>Importados</em>, <em>Forçados</em> (com <code>-f</code> por hostid de outro host), <em>Ignorados, discos parciais</em> (apenas alguns discos presentes), <em>Ignorados, discos ausentes</em> (nenhum disco presente) e <em>Falhas</em>. O estado fica em <code>/var/lib/proxmenux/restore-state.json</code> e o log bruto da execução em <code>/var/log/proxmenux/restore-datapools-&lt;timestamp&gt;.log</code>."
+      },
+      {
+        "name": "Avisos de integridade de inicialização",
+        "detail": "O processo verifica diretórios <code>/lib/modules/&lt;kernel&gt;</code> ausentes, falta de configuração ESP e links simbólicos <code>/vmlinuz</code> com destino inexistente. Os avisos aparecem em uma faixa colorida."
+      },
+      {
+        "name": "Delta de reversão",
+        "detail": "Lista VMs, LXCs e componentes que existem no alvo, mas não estavam na cópia de segurança restaurada — as mesmas entradas surgiram na janela de rollback destrutivo pré-restore. Cada linha carrega o comando de limpeza manual."
+      },
+      {
+        "name": "Cauda de log",
+        "detail": "A última 600 linhas de <code>proxmenux-cluster-postboot-&lt;ts&gt;.log</code>, com <em>Apenas questões</em> filtro que mantém apenas linhas correspondentes <code>error</code>, <code>warning</code>, <code>failed</code>, <code>✗</code> ou <code>traceback</code>."
+      }
+    ],
+    "dismissBody": "Uma vez que a restauração é <em>completo</em> ou <em>falhado</em>, um botão de Dispensa colapsa o cartão. O arquivo de estado está preservado e o botão Histórico reabre-o mais qualquer restauração anterior (as últimas execuções 20 são arquivadas sob <code>/var/lib/proxmenux/restore-history/</code>).",
+    "imageAlt": "Janela Detalhes do progresso da restauração no ProxMenux Monitor durante a execução: indicador azul, etapa Reconstruindo initramfs, tempo restante estimado, barra parcialmente preenchida e últimas linhas do log em tempo real.",
+    "imageCaption": "O modal Detalhes enquanto o expedidor pós-boot ainda está em execução — emblema, passo atual, tempo restante e cauda de log ao vivo.",
+    "detailsImageAlt": "O mesmo modo Detalhes após a restauração ter terminado, com o emblema verde Restaurar completo, a duração total de execução (0m53s), uma barra de progresso 6/6, o delta de Rollback vazio e o log de postboot arquivado.",
+    "detailsImageCaption": "O mesmo modal uma vez que a execução tenha terminado — emblema, duração total, barra de progresso preenchida e o log de postboot arquivado."
+  },
+  "postbootExample": {
+    "heading": "Como é o post-boot na consola",
+    "body": "No console físico, um processo encerrado com sucesso mostra <code>[ OK ] Finished proxmenux-apply-cluster-postboot.service</code>, geralmente perto dos <code>OK</code> de <code>multi-user.target</code> e <code>graphical.target</code>. Isso marca o fim do processo. Ainda podem existir falhas de componentes ou avisos de boot registrados; confira os estados e logs no Monitor antes de considerar o host totalmente restaurado.",
+    "imageAlt": "Console físico Proxmox com '[ OK ] Finished proxmenux-apply-cluster-postboot.service - ProxMenux Apply Cluster Configs (post-boot).', seguido de OK para multi-user.target e graphical.target, com a solicitação de login acima.",
+    "imageCaption": "Console físico ao fim do processo. 'Finished proxmenux-apply-cluster-postboot.service' marca a conclusão, também indicada por 'Host restore finished' no Monitor. Os resultados dos componentes e os avisos ainda precisam ser verificados."
+  },
+  "tenMinutes": {
+    "heading": "Por que os últimos dez minutos importam",
+    "intro": "A reinicialização em si leva segundos, mas o expedidor pós-boot passa cerca de dez minutos terminando a restauração. Durante esta janela, o host é acessível e o login funciona, mas alguns serviços (principalmente GPU-driver-dependentes) ainda não estão disponíveis. Discriminação de tempo para um host Proxmox típico com NVIDIA + Coral instalado:",
+    "rows": [
+      {
+        "stage": "Boot + pve-cluster pronto",
+        "time": "~30 s",
+        "detail": "Inicialização padrão do Proxmox. SSH, interface web e login ficam disponíveis ao fim desta etapa."
+      },
+      {
+        "stage": "Aplicar /etc/pve aos pmxcfs",
+        "time": "~10 s",
+        "detail": "Rápido — pequenos arquivos de configuração copiados um por um para o sistema de arquivos de cluster ao vivo."
+      },
+      {
+        "stage": "Reconstruir initramfs entre kernels",
+        "time": "3–5 min",
+        "detail": "<code>update-initramfs -u -k all</code> reconstrói uma imagem initramfs por kernel instalado. O volume da espera."
+      },
+      {
+        "stage": "Reconstruir a configuração do carregador de arranque",
+        "time": "10–30 s",
+        "detail": "<code>update-grub</code> ou <code>proxmox-boot-tool refresh</code>. Rápido mesmo em ZFS."
+      },
+      {
+        "stage": "Reinstalação do controlador NVIDIA (se aplicável)",
+        "time": "5–10 min",
+        "detail": "Baixa a versão gravada do driver, compila os módulos DKMS contra o kernel atual, aplica o patch ProxMenux se a fonte o tiver. Uma tarefa mais longa."
+      },
+      {
+        "stage": "Reinstalação do Coral e de outros componentes",
+        "time": "3–5 min",
+        "detail": "Compilação DKMS para Coral, apt install para intel-gpu-tools e download e instalação do .deb para amdgpu_top."
+      },
+      {
+        "stage": "Verificação de inicialização e notificação",
+        "time": "~2 s",
+        "detail": "Exige poucos recursos. A notificação informa o usuário assim que a execução termina."
+      }
+    ],
+    "outroBody": "Nesse intervalo, ferramentas podem faltar após o login (<code>nvidia-smi</code> não encontrado, <code>coral</code> não detectado) porque a reinstalação continua em segundo plano. A notificação marca o fim do processo; confira resultados dos componentes, avisos e logs para distinguir sucessos de falhas individuais."
+  },
+  "destructiveRollback": {
+    "heading": "O retrocesso destrutivo opcional",
+    "body": "A restauração é aditiva por padrão: VMs, LXCs e componentes adicionais permanecem. Se houver diferenças, a confirmação oferece <em>Executar reversão destrutiva?</em>, com Não por padrão. Aceitar chama <code>_rs_execute_rollback</code> antes do reboot para tentar excluir as VMs e os LXCs adicionais listados. Componentes são indicados para desinstalação manual, pois a automática não foi implementada. Falhas de exclusão são informadas e o processo continua, sem garantia de correspondência exata. Confira nomes e VMIDs/CTIDs antes dessa opção destrutiva."
+  },
+  "logs": {
+    "heading": "Onde ficam os logs",
+    "rows": [
+      {
+        "log": "/var/log/proxmenux/restore-YYYYMMDD_HHMMSS.log",
+        "detail": "Gravado na etapa interativa: resultados de compatibilidade, filtro de diferenças, plano de adaptação, saídas da aplicação em execução e da preparação pendente, instalação de pacotes."
+      },
+      {
+        "log": "/var/log/proxmenux/apply-pending-YYYYMMDD_HHMMSS.log",
+        "detail": "Gravado por <code>apply_pending_restore.sh</code> no início do boot: carregamento de plan.env, processamento de apply-on-boot e filtro dos caminhos excluídos."
+      },
+      {
+        "log": "/var/log/proxmenux/proxmenux-cluster-postboot-YYYYMMDD_HHMMSS.log",
+        "detail": "Escrito por <code>apply_cluster_postboot.sh</code>. Contém: pve-cluster aplicar, initramfs e saída bootloader, por componente saída instalador, verificação de sanidade, carga útil de notificação."
+      },
+      {
+        "log": "/var/log/proxmenux/component-<name>-YYYYMMDD_HHMMSS.log",
+        "detail": "Um log por componente instalador (nvidia, coral, etc.) que correu na passagem pós-boot. Útil quando a reinstalação de um componente específico falhou e o usuário precisa da própria saída da ferramenta."
+      },
+      {
+        "log": "/var/log/proxmenux/restore-datapools-YYYYMMDD_HHMMSS.log",
+        "detail": "Escrito por <code>_rs_import_data_pools</code>. Contém: enumeração de pools não-root do manifesto, resultado por pool (importado de forma limpa, importado com <code>-f</code> para hostida estrangeira, ignorado devido à falta de discos, ou falhou), e a saída bruta de cada chamada <code>zpool import</code>."
+      }
+    ]
+  },
+  "whereNext": {
+    "heading": "Para onde ir a seguir",
+    "items": [
+      {
+        "label": "Restauração do kernel cruzado",
+        "href": "/docs/backup-restore/cross-kernel",
+        "tail": " — o filtro seguro de direcção e o passe de hidratação invocado quando o núcleo alvo difere do do backup."
+      },
+      {
+        "label": "Como funciona",
+        "href": "/docs/backup-restore/how-it-works",
+        "tail": " — a estrutura do arquivo, o manifesto e o inventário de aplicativos usados pela restauração."
+      },
+      {
+        "label": "Trabalhos agendados",
+        "href": "/docs/backup-restore/scheduled-jobs",
+        "tail": " — o fluxo não acompanhado que produz os arquivos que esta página consome."
+      }
+    ]
+  }
+}
diff --git a/web/messages/pt/docs/backup-restore/scheduled-jobs.json b/web/messages/pt/docs/backup-restore/scheduled-jobs.json
new file mode 100644
index 00000000..44f8fe5a
--- /dev/null
+++ b/web/messages/pt/docs/backup-restore/scheduled-jobs.json
@@ -0,0 +1,152 @@
+{
+  "meta": {
+    "title": "Trabalhos agendados — temporizadores, modo de anexação, retenção ProxMenux",
+    "description": "Trabalhos de backup programados do host ProxMenux. Dois modos de criação (horário systemd próprio ou anexar a um trabalho existente PVE vzdump), valores de retenção aplicados por trabalho via proxmox-backup-client/borg/local prune, layout de armazenamento sob /var/lib/proxmenux/backup-jobs, e o script de execução que produz arquivos idênticos ao fluxo interativo.",
+    "ogTitle": "Cópia de segurança ProxMenux — tarefas agendadas",
+    "ogDescription": "Backups de host agendados não vigiados com modo de anexação, retenção e os mesmos três destinos do fluxo interativo.",
+    "twitterTitle": "Trabalhos agendados | ProxMenux",
+    "twitterDescription": "Trabalhos de backup agendados sem acompanhamento com modo de anexação e retenção."
+  },
+  "header": {
+    "title": "Trabalhos agendados",
+    "description": "Trabalhos de backup da máquina não vigiados. Dois modelos de criação: um novo trabalho independente com sua própria programação, ou um trabalho anexado a uma tarefa existente PVE vzdump que herda o cronograma e retenção dessa tarefa. Ambos produzem arquivos idênticos ao fluxo interativo.",
+    "section": "Cópias de segurança e restauro"
+  },
+  "intro": {
+    "title": "Os dois modelos de trabalho programados",
+    "body": "Um trabalho programado pode ser criado seguindo um dos dois modelos:",
+    "modelsList": [
+      "<strong>Novo trabalho independente</strong> — ProxMenux define o horário de trabalho com seu próprio temporizador systemd, independente de qualquer outra tarefa no host. Compatível com os três destinos: Local, PBS e Borg.",
+      "<strong>Anexar a uma tarefa existente PVE vzdump</strong> — o trabalho não tem agendamento próprio; ele é executado automaticamente sempre que a tarefa pai PVE vzdump que já faz backup das VMs e LXCs nesta máquina dispara. Herda a programação e a retenção da tarefa dos pais. Compatível com Local e PBS (Borg não é suportado porque PVE não tem agendador nativo para Borg)."
+    ]
+  },
+  "attachBadge": {
+    "title": "Modo de anexação — recomendado quando já existe uma tarefa PVE vzdump",
+    "body": "Se já existe uma tarefa vzdump PVE para as VMs e LXCs do nó, anexar o backup do host faz com que ele seja executado depois do backup dos convidados, no <strong>mesmo ciclo de backup</strong>. Na restauração, as configurações dos convidados vêm do backup do host (em <code>/etc/pve</code>) e os discos vêm dos backups vzdump desse ciclo. Isso ajuda a coordenar a recuperação do nó inteiro, mas não é um snapshot atômico: alterações durante o ciclo podem deixar diferenças entre a configuração do host e o estado dos discos dos convidados."
+  },
+  "frequencyBadge": {
+    "title": "Frequência recomendada",
+    "body": "Para maximizar a compatibilidade entre um backup do host e sua restauração futura, faça backups frequentes. Quanto mais próxima a cópia estiver do estado atual do host, menos diferenças de configuração, pacotes e componentes a restauração precisará conciliar."
+  },
+  "modes": {
+    "heading": "Os dois modos",
+    "rows": [
+      {
+        "mode": "Novo trabalho agendado",
+        "backends": "Local, PBS, Borg",
+        "schedule": "Expressão <code>OnCalendar</code> própria (sintaxe de calendário systemd, por exemplo <code>daily</code> ou <code>Mon..Fri 03:00</code>).",
+        "retention": "Solicitado separadamente: <code>keep-last</code>, <code>keep-hourly</code>, <code>keep-daily</code>, <code>keep-weekly</code>, <code>keep-monthly</code>, <code>keep-yearly</code>. Aplicado pelo script de execução após cada backup bem sucedido."
+      },
+      {
+        "mode": "Anexar a uma tarefa PVE vzdump",
+        "backends": "Local, PBS (Borg não tem agendador do lado PVE)",
+        "schedule": "Herdado da tarefa PVE principal. Nenhum temporizador systemd é instalado no lado do ProxMenux.",
+        "retention": "Herdada da configuração <code>prune-backups</code> da tarefa principal (mapeada um a um para as variáveis <code>KEEP_*</code> do script de execução via <code>hb_pve_prune_to_keep_env</code>)."
+      }
+    ]
+  },
+  "attachDetail": {
+    "heading": "Como funciona o modo de anexação",
+    "intro": "O PVE grava as tarefas <code>vzdump</code> em <code>/etc/pve/jobs.cfg</code>, com uma seção por tarefa indicando o armazenamento dos backups de VM e LXC. O modo de anexação exige um backend suportado pelo ProxMenux (Local ou PBS). O backup do host é executado pelo hook job-end após o fim da tarefa de backup dos convidados.",
+    "steps": [
+      {
+        "step": "1",
+        "detail": "Durante a criação do trabalho, ProxMenux lista tarefas PVE pai compatíveis via <code>hb_pve_list_vzdump_jobs_for_backend</code>. O utilizador escolhe uma."
+      },
+      {
+        "step": "2",
+        "detail": "O <code>.env</code> do trabalho é escrito com <code>PVE_PARENT_JOB</code>, <code>PVE_STORAGE</code> e os valores herdados <code>KEEP_*</code>; nenhum temporizador systemd é criado."
+      },
+      {
+        "step": "3",
+        "detail": "<code>hb_install_vzdump_hook</code> registra um hook em <code>/etc/vzdump.conf</code>. Na fase job-end de qualquer tarefa vzdump, compara o <code>$STOREID</code> recebido com o <code>PVE_STORAGE</code> de cada trabalho anexado e habilitado, chamando o script de execução para as correspondências. A associação é feita pelo armazenamento, não pelo ID da tarefa principal selecionada."
+      },
+      {
+        "step": "4",
+        "detail": "O arquivo é salvo no mesmo armazenamento dos backups vzdump: <code>path/dump/</code> para Local ou o repositório PBS configurado na entrada de armazenamento PVE."
+      }
+    ],
+    "outroBody": "O modo de anexação não tem temporizador próprio. Desabilitar ou excluir a tarefa PVE principal selecionada interrompe esse disparo, mas outra tarefa vzdump usando o mesmo armazenamento ainda pode acionar o backup do host. Desabilite ou exclua o próprio trabalho ProxMenux para impedir isso. Ao ser desabilitada, a entrada permanece no disco e pode ser reativada ou anexada novamente."
+  },
+  "storageLayout": {
+    "heading": "Arquivos que compõem um trabalho",
+    "intro": "Cada trabalho agendado é totalmente descrito por três ou quatro arquivos no disco. Lendo-os dá a configuração completa do trabalho sem depender da interface.",
+    "rows": [
+      {
+        "path": "/var/lib/proxmenux/backup-jobs/JOB_ID.env",
+        "content": "Infraestrutura, ID de backup ou destino, agenda (novo modo) ou pai PVE (modo de Attach), sinalizador habilitado, valores de retenção <code>KEEP_*</code>, ponteiros de credenciais."
+      },
+      {
+        "path": "/var/lib/proxmenux/backup-jobs/JOB_ID.paths",
+        "content": "Um caminho absoluto por linha — a seleção congelada resolvido a partir do perfil no tempo de criação de emprego. A edição do ficheiro volta a executar o trabalho com a nova selecção no próximo temporizador."
+      },
+      {
+        "path": "/etc/systemd/system/proxmenux-backup-JOB_ID.timer + .service",
+        "content": "Apenas modo novo. O serviço invoca o <code>run_scheduled_backup.sh JOB_ID</code>. O timer agenda-o com <code>Persistent=true</code> (execuções perdidas recuperadas na próxima inicialização) e um pequeno <code>RandomizedDelaySec=120</code> para espalhar carga quando vários trabalhos compartilham a mesma expressão OnCalendar."
+      },
+      {
+        "path": "/etc/vzdump.conf script-hook",
+        "content": "Somente modo de anexação. Instalado uma vez por <code>hb_install_vzdump_hook</code>; compara <code>PVE_STORAGE</code> de cada trabalho anexado com <code>$STOREID</code>, passado pelo PVE ao hook."
+      }
+    ]
+  },
+  "runner": {
+    "heading": "O que um trabalho faz quando dispara",
+    "intro": "Cada trabalho — novo ou anexado — executa a mesma sequência de três passos:",
+    "steps": [
+      "<strong>Prepare o backup.</strong> Lê a configuração do trabalho (destino, perfil, caminhos) e monta a árvore de arquivos exatamente da mesma forma que o fluxo interativo faz. O resultado é o mesmo arquivo que um backup manual com essas configurações produziria.",
+      "<strong>Escreva o destino.</strong> Envia ou escreve o arquivo para o destino configurado — um arquivo <code>.tar.zst</code> local, um backup PBS, ou um arquivo Borg — usando exatamente as mesmas ferramentas e credenciais que um backup manual para o mesmo destino usaria.",
+      "<strong>Aplicar retenção.</strong> Remove backups antigos do destino, mantendo as contagens <code>keep-last</code> / <code>keep-daily</code> / <code>keep-weekly</code> configuradas no trabalho. A poda é realizada pelo próprio destino: PBS aplica sua própria retenção, Borg executa <code>borg prune</code>, e para ProxMenux Local apaga os arquivos que caem fora da janela <code>keep-last</code>."
+    ]
+  },
+  "management": {
+    "heading": "Gestão de tarefas",
+    "intro": "O menu de agendamento (Scripts TUI) e a aba Monitor Backups expõem as mesmas ações em qualquer trabalho.",
+    "rows": [
+      {
+        "action": "Executar agora",
+        "detail": "Chama imediatamente o script de execução, sem esperar o temporizador ou o hook vzdump. Útil para verificar a configuração sem aguardar a próxima execução agendada."
+      },
+      {
+        "action": "Activar / Desactivar",
+        "detail": "Novo modo: <code>systemctl enable/disable --now</code> o temporizador. Modo Anexar: altera o sinalizador <code>ENABLED</code> no env de trabalho — o script gancho honra-o na próxima execução PVE."
+      },
+      {
+        "action": "Editar",
+        "detail": "Abre novamente o destino, agenda, perfil e avisos de retenção e reescreve os arquivos de trabalho. Preserva a identificação do trabalho."
+      },
+      {
+        "action": "Excluir",
+        "detail": "Remove o env do trabalho, o arquivo de caminhos, o temporizador e o serviço systemd (modo novo) e desativa a associação ao hook (modo de anexação). Não altera os arquivos já existentes no destino."
+      },
+      {
+        "action": "Ver registo",
+        "detail": "Mostra em tempo real <code>/var/log/proxmenux/backup-jobs/JOB_ID-YYYYMMDD_HHMMSS.log</code> — um arquivo de log por execução. O executor também emite uma linha de status compacta para journald no serviço systemd."
+      }
+    ]
+  },
+  "notifications": {
+    "heading": "Notificações",
+    "body": "Cada execução programada dispara os mesmos eventos <code>hb_notify_lifecycle</code> que o fluxo interativo (<code>start</code>, <code>complete</code>, <code>fail</code>). Se os canais de notificação estiverem configurados no Monitor, os trabalhos não vigiados mostram seus resultados da mesma forma que backups manuais – um usuário não precisa verificar o log para saber se um trabalho foi bem sucedido."
+  },
+  "whereNext": {
+    "heading": "Para onde ir a seguir",
+    "items": [
+      {
+        "label": "Criando backups",
+        "href": "/docs/backup-restore/creating-backups",
+        "tail": " — o fluxo interactivo que partilha a infra-estrutura com o agendador."
+      },
+      {
+        "label": "Destinos",
+        "href": "/docs/backup-restore/destinations",
+        "tail": " — a configuração por infra-estrutura utilizada tanto pelo fluxo interactivo como pelo agendador."
+      },
+      {
+        "label": "Restauração",
+        "href": "/docs/backup-restore/restoring",
+        "tail": " — o fluxo que utiliza os backups produzidos pelos trabalhos."
+      }
+    ]
+  }
+}
diff --git a/web/messages/pt/docs/create-vm/index.json b/web/messages/pt/docs/create-vm/index.json
new file mode 100644
index 00000000..70d7f50a
--- /dev/null
+++ b/web/messages/pt/docs/create-vm/index.json
@@ -0,0 +1,175 @@
+{
+  "meta": {
+    "title": "Criar VM no Proxmox VE: assistentes Synology, Windows, Linux e NAS | ProxMenux",
+    "description": "Crie e configure VM no Proxmox VE com o ProxMenux. Assistentes para NAS (Synology DSM, TrueNAS, OpenMediaVault, XigmaNAS, etc.), Windows, distribuições Linux e um instalador macOS externo. Predefinições adequadas para hardware, armazenamento e rede.",
+    "ogTitle": "Crie VMs em Proxmox VE — Synology, Windows, Linux, Assistentes NAS",
+    "ogDescription": "Assistentes ProxMenux para criar VM Synology DSM, TrueNAS, OMV, XigmaNAS, Windows e Linux no Proxmox VE.",
+    "ogImageAlt": "ProxMenux Criar o Menu VM",
+    "twitterTitle": "Criar VM no Proxmox VE | ProxMenux",
+    "twitterDescription": "Assistentes para VM Synology, TrueNAS, OMV, XigmaNAS, Windows e Linux no Proxmox VE."
+  },
+  "header": {
+    "title": "Criar VM",
+    "description": "O ProxMenux reúne a criação de VM num menu interativo. Escolha a família do sistema operativo e o assistente trata da ISO, CPU, RAM, BIOS, rede, armazenamento e passthrough GPU opcional.",
+    "section": "Máquinas Virtuais"
+  },
+  "intro": {
+    "title": "Para que serve este menu",
+    "body": "O menu Criar VM encaminha para vários assistentes. Pergunta a família do sistema operativo e carrega o seletor ISO e configurador adequados. O modo predefinido usa definições apropriadas; o avançado apresenta as opções disponíveis antes da criação."
+  },
+  "opening": {
+    "heading": "Abrir o menu",
+    "body": "Do menu principal do ProxMenux, selecione <strong>Criar VM</strong>. Você verá isto:",
+    "imageAlt": "Crie o expedidor VM com opções 3 ProxMenux (NAS / Windows / Linux) seguido da seção de scripts comunitários (macOS / Outros)"
+  },
+  "families": {
+    "heading": "Três famílias OS",
+    "intro": "As três entradas ProxMenux no topo do menu compartilham o mesmo motor subjacente e fluxo pós-ISO — elas apenas encaminham para diferentes seletores ISO e aplicam padrões sintonizados para cada família. Escolha o que corresponde ao hóspede que deseja instalar.",
+    "routes": [
+      {
+        "key": "nas",
+        "title": "Sistema NAS",
+        "icon": "HardDrive",
+        "href": "/docs/create-vm/system-nas",
+        "accent": "border-emerald-300 bg-emerald-50",
+        "iconBg": "bg-emerald-100 text-emerald-700",
+        "description": "Oito sistemas NAS como VM dedicadas. A maioria usa o processo ISO automático; Synology DSM tem um assistente especializado com carregador.",
+        "bullets": [
+          "Synology DSM (Arc / RR / Alpine RedPill M-shell carregadores)",
+          "TrueNAS SCALE e CORE (ZFS)",
+          "OpenMediaVault (baseado em Debian)",
+          "XigmaNAS (FreeBSD ZFS)",
+          "Rockstor (openSUSE / Btrfs), ZimaOS, FygoOS"
+        ]
+      },
+      {
+        "key": "windows",
+        "title": "Sistema Windows",
+        "icon": "MonitorCog",
+        "href": "/docs/create-vm/system-windows",
+        "accent": "border-blue-300 bg-blue-50",
+        "iconBg": "bg-blue-100 text-blue-700",
+        "description": "Windows 10, 11 e edições de servidor com padrões compatíveis com Windows (q35 + OVMF + TPM 2.0) e drivers VirtIO pré-montados.",
+        "bullets": [
+          "UUP Dump para ISOs atualizadas",
+          "Ou ISO local de /var/lib/vz/template/iso",
+          "TPM 2.0 adicionado automaticamente",
+          "VirtIO Controladores ISO ligados ao ide3",
+          "Canal de agente convidado habilitado"
+        ]
+      },
+      {
+        "key": "linux",
+        "title": "Sistema Linux",
+        "icon": "Laptop",
+        "href": "/docs/create-vm/system-linux",
+        "accent": "border-amber-300 bg-amber-50",
+        "iconBg": "bg-amber-100 text-amber-700",
+        "description": "Catálogo com curadoria de ISOs Linux oficiais baixados automaticamente do upstream, além de um coletor ISO local para qualquer outra coisa.",
+        "bullets": [
+          "Ubuntu (Ambiente de trabalho / Servidor, 20.04–25.10)",
+          "Debian (Ambiente de trabalho / Netinst, 11–13)",
+          "Fedora, Arch, Rocky, Mint, openSUSE",
+          "Alpine, Kali, Manjaro",
+          "Localização ISO local para imagens personalizadas"
+        ]
+      }
+    ]
+  },
+  "community": {
+    "title": "Programas comunitários (não documentados aqui)",
+    "intro": "As duas entradas abaixo do separador <em>Community Scripts</em> executam código que <strong>não faz parte do ProxMenux</strong> e ficam, por isso, fora desta documentação:",
+    "macosRich": "<strong>System macOS</strong> — executa o instalador externo <osxLink>OSX-PROXMOX</osxLink>. Ele clona o repositório upstream, prepara o host e o <strong> reinicia automaticamente quando terminado</strong>. Consulte a documentação do próprio projeto.",
+    "othersRich": "<strong>Outros sistemas (baseados em Linux)</strong>: carrega uma seleção de instaladores da comunidade para servidores domésticos, routers, firewalls e semelhantes. Cada script é mantido fora do ProxMenux."
+  },
+  "afterPick": {
+    "heading": "O que acontece depois de escolher um SO",
+    "intro": "Após selecionar a ISO, o menu segue o mesmo percurso para cada família de sistemas:",
+    "items": [
+      "<strong>Predefinido ou avançado.</strong> Um diálogo permite aceitar as predefinições ProxMenux ou abrir o configurador completo: modelo e núcleos CPU, RAM, BIOS/UEFI, placa de rede e tipo de máquina.",
+      "<strong>Plano de armazenamento.</strong> Você combina um ou vários discos virtuais, discos importados e dispositivos de passagem PCI (controlador inteiro / NVMe) no mesmo VM.",
+      "<strong>Passthrough GPU opcional.</strong> Se detetar uma GPU compatível, o ProxMenux oferece o assistente GPU após criar a VM. Pode ser necessário reiniciar.",
+      "<strong>Criação da VM.</strong> A VM é criada, recebe etiquetas e uma descrição HTML formatada para consulta rápida no Proxmox."
+    ],
+    "tipTitle": "Preferir Avançado para VMs que pretende manter",
+    "tipBody": "Predefinições padrão funcionam bem para testes rápidos. Para um VM você pretende manter, o caminho Avançado permite que você escolha o BIOS direito (SeaBIOS vs OVMF/UEFI), tipo de máquina (<code>i440fx</code> vs <code>q35</code>) e controlador de disco (VirtIO SCSI single vs SATA) na frente — estes são dolorosos para mudar mais tarde."
+  },
+  "scripts": {
+    "heading": "Programas envolvidos",
+    "intro": "O menu carrega através de source vários scripts partilhados sem página própria. Estão listados como referência. Cada subpágina liga ao script principal do respetivo processo.",
+    "headerScript": "Script",
+    "headerRole": "Papel",
+    "rows": [
+      {
+        "path": "menus/create_vm_menu.sh",
+        "role": "Central de entrada."
+      },
+      {
+        "path": "vm/select_nas_iso.sh",
+        "role": "Seletor ISO e sistemas NAS (Synology, TrueNAS, OMV, Rockstor, XigmaNAS, ZimaOS, FygoOS)."
+      },
+      {
+        "path": "vm/select_windows_iso.sh",
+        "role": "Selector ISO do Windows. Delega ao construtor UUP Dump quando necessário."
+      },
+      {
+        "path": "vm/select_linux_iso.sh",
+        "role": "Selector ISO Linux para o fluxo Linux (distribuições de mainstream)."
+      },
+      {
+        "path": "vm/synology.sh",
+        "role": "Processo Synology DSM: obtém o carregador e a imagem DSM e prepara o perfil da VM."
+      },
+      {
+        "path": "vm/zimaos.sh",
+        "role": "Fluxo ZimaOS: baixa a imagem e a liga à definição VM."
+      },
+      {
+        "path": "vm/vm_configurator.sh",
+        "role": "Assistente padrão vs Avançado: CPU modelo/cores, RAM, BIOS, NIC, tipo de máquina."
+      },
+      {
+        "path": "vm/disk_selector.sh",
+        "role": "Plano de armazenamento: disco virtual, importação de disco ou passagem Controlador/NVMe."
+      },
+      {
+        "path": "vm/vm_creator.sh",
+        "role": "Criação final do VM: aplica a configuração, liga o armazenamento, escreve a descrição HTML."
+      },
+      {
+        "path": "vm/guest_agent_config.sh",
+        "role": "Opcional QEMU hook de instalação de agente convidado, usado por vários fluxos."
+      }
+    ]
+  },
+  "related": {
+    "heading": "Relacionado",
+    "items": [
+      {
+        "href": "/docs/disk-manager",
+        "label": "Gerenciador de disco",
+        "tail": " — anexar discos físicos existentes ou importar imagens de disco em VMs."
+      },
+      {
+        "href": "/docs/utils/UUp-Dump-ISO-Creator",
+        "label": "Criador de ISO do UUP Dump",
+        "tail": " — crie ISO de instalação Windows prontas como suporte de arranque."
+      },
+      {
+        "href": "/docs/utils/import-vm",
+        "label": "Importar VM de OVA / OVF",
+        "tail": " — introduzir as MV pré-construídas das exportações VMware / VirtualBox / ProxMenux."
+      },
+      {
+        "href": "/docs/hardware/gpu-vm-passthrough",
+        "label": "Adicionar GPU a uma VM (passthrough)",
+        "tail": " — passar um GPU para um VM."
+      },
+      {
+        "href": "/docs/help-info/vm-ct-commands",
+        "label": "Comandos de gestão VM e CT",
+        "tail": " — referência qm para o lado CLI."
+      }
+    ]
+  }
+}
diff --git a/web/messages/pt/docs/create-vm/synology.json b/web/messages/pt/docs/create-vm/synology.json
new file mode 100644
index 00000000..d7629ac5
--- /dev/null
+++ b/web/messages/pt/docs/create-vm/synology.json
@@ -0,0 +1,453 @@
+{
+  "title": "Script de criação de VM Synology",
+  "stepLabel": "Etapa",
+  "intro": {
+    "heading": "Introdução",
+    "intro": "ProxMenux fornece um script automatizado que cria e configura uma máquina virtual (VM) para instalar Synology DSM (DiskStation Manager) em Proxmox VE. Este script simplifica o processo baixando e adicionando um dos carregadores disponíveis à inicialização VM, dando-lhe a opção entre quatro opções diferentes:",
+    "loaders": [
+      {
+        "name": "AuxXxilium Arc",
+        "url": "https://github.com/AuxXxilium/arc",
+        "extra": ""
+      },
+      {
+        "name": "RedPill RR",
+        "url": "https://github.com/RROrg/rr",
+        "extra": ""
+      },
+      {
+        "name": "Alpine RedPill M-shell (projeto TinyCore)",
+        "url": "https://github.com/PeterSuh-Q3/tinycore-redpill",
+        "extra": ""
+      }
+    ],
+    "customLoader": "Carregador personalizado – opção para usar um carregador personalizado se você preferir modificar ou criar sua própria configuração",
+    "simplifiesIntro": "O script simplifica o processo de criação do VM, oferecendo as seguintes opções:",
+    "simplifies": [
+      "Seleção da configuração padrão ou avançada",
+      "Configuração de CPU, RAM, BIOS e tipo de máquina",
+      "Escolha entre disco virtual ou passagem de disco físico"
+    ]
+  },
+  "config": {
+    "heading": "Configuração predefinida e avançada",
+    "intro": "O script oferece dois modos de configuração:",
+    "defaultHeading": "Configuração padrão",
+    "defaultIntro": "Se você selecionar a configuração padrão, o script aplicará automaticamente os seguintes valores:",
+    "headerParam": "Parâmetro",
+    "headerValue": "Valor Padrão",
+    "defaultRows": [
+      {
+        "param": "Tipo de máquina",
+        "value": "q35"
+      },
+      {
+        "param": "Tipo de BIOS",
+        "value": "OVMF (UEFI)"
+      },
+      {
+        "param": "Tipo de CPU",
+        "value": "Host"
+      },
+      {
+        "param": "Número de núcleos",
+        "value": "2"
+      },
+      {
+        "param": "Tamanho da RAM",
+        "value": "4096 MB"
+      },
+      {
+        "param": "Ponte",
+        "value": "vmbr0"
+      },
+      {
+        "param": "Endereço MAC",
+        "value": "Gerado automaticamente"
+      },
+      {
+        "param": "Iniciar a VM após a conclusão",
+        "value": "Não"
+      }
+    ],
+    "defaultOutro": "Se você quiser personalizar a configuração, selecione a opção Configurações avançadas no menu.",
+    "advancedHeading": "Configuração Avançada",
+    "advancedIntro": "Se você selecionar a configuração avançada, o script lhe permitirá personalizar cada parâmetro:",
+    "headerOptions": "Opções",
+    "advancedRows": [
+      {
+        "param": "Tipo de máquina",
+        "options": "q35 ou i440fx"
+      },
+      {
+        "param": "Tipo de BIOS",
+        "options": "OVMF (UEFI) ou SeaBIOS (Legado)"
+      },
+      {
+        "param": "Tipo de CPU",
+        "options": "Host ou KVM64"
+      },
+      {
+        "param": "Número de núcleos",
+        "options": "Número de núcleos CPU"
+      },
+      {
+        "param": "Tamanho da RAM",
+        "options": "Quantidade de memória atribuída à VM"
+      },
+      {
+        "param": "Ponte",
+        "options": "Ponte de rede para conexão"
+      },
+      {
+        "param": "Endereço MAC",
+        "options": "Endereço MAC personalizado"
+      },
+      {
+        "param": "VLAN",
+        "options": "Marca VLAN (se usada)"
+      },
+      {
+        "param": "MTU",
+        "options": "Tamanho máximo da unidade de transmissão"
+      }
+    ]
+  },
+  "diskSelection": {
+    "heading": "Selecção do Disco",
+    "intro": "O plano de armazenamento permite adicionar discos virtuais, discos físicos e controladores PCI ou dispositivos NVMe. As opções de disco são explicadas abaixo.",
+    "virtualHeading": "Disco Virtual",
+    "virtualItems": [
+      "O script lista as opções de armazenamento disponíveis no Proxmox",
+      "O usuário seleciona o disco e tamanho em GB",
+      "Os discos virtuais são ligados como <strong>SATA</strong> (sata0, sata1, etc.). Os discos de dados virtuais e físicos partilham as seis posições SATA numeradas de 0 a 5; o carregador utiliza uma posição IDE separada."
+    ],
+    "physicalHeading": "Passagem de Disco Físico",
+    "physicalItems": [
+      "O programa detecta todos os discos físicos disponíveis",
+      "O usuário seleciona o disco físico ou discos que deseja usar.",
+      "Os discos físicos são ligados como dispositivos <strong>SATA</strong>. Partilham as seis posições SATA numeradas de 0 a 5 com os discos de dados virtuais; não há mais seis posições reservadas para discos físicos."
+    ]
+  },
+  "loaderInstall": {
+    "heading": "Instalação do Carregador",
+    "intro1": "O script baixa automaticamente e extrai o carregador do repositório do desenvolvedor. Se o download falhar, o script exibirá uma mensagem de erro.",
+    "intro2Rich": "<strong>AuxXxilium Arc</strong>, <strong>RedPill RR</strong> e <strong>Alpine RedPill M-shell</strong> são transferidos e extraídos automaticamente.",
+    "customRich": "Para <strong>Carregador personalizado</strong>, o script procura por arquivos em <code>/var/lib/vz/template/iso</code>. Se vários arquivos forem encontrados, você será solicitado a selecionar o arquivo desejado.",
+    "uploadIntro": "Você pode enviar carregadores personalizados das opções de armazenamento local:",
+    "imageAlt": "Adicionar Carregador Personalizado",
+    "imageCaption": "Adicionar Carregador Personalizado"
+  },
+  "vmCreation": {
+    "heading": "Criação da VM",
+    "intro": "Uma vez que o carregador é baixado, o script cria o VM usando os seguintes comandos:",
+    "items": [
+      "<code>qm create</code> – Cria a máquina virtual com os parâmetros configurados",
+      "<code>qm importdisk</code> importa a imagem do carregador para o armazenamento Proxmox. O script liga-a depois à VM como ide0 para compatibilidade.",
+      "<code>qm set</code> – Atribui valores de configuração como CPU, RAM e armazenamento",
+      "<code>qm set VMID --boot order=ide0</code> define o carregador como dispositivo de arranque. Substitua VMID pelo ID da VM."
+    ]
+  },
+  "stepGuide": {
+    "heading": "Guia de configuração do carregador de inicialização passo a passo",
+    "intro": "Cada carregador tem menus e métodos de configuração próprios. Os seis passos abaixo explicam o processo comum; siga as indicações do carregador atual quando forem diferentes. As capturas M-shell mostram uma interface TinyCore anterior, enquanto o script atual transfere Alpine RedPill M-shell.",
+    "selectorHeading": "Selecione seu tipo de carregador:",
+    "loaderButtons": {
+      "arc": "Arc Loader",
+      "rr": "RR Loader",
+      "tinycore": "TinyCore Loader"
+    }
+  },
+  "steps": [
+    {
+      "id": "step1",
+      "title": "Iniciar a VM e abrir o menu principal",
+      "intro": "Assim que o VM for criado, inicie-o. A primeira vez que iniciar o VM, você acessará o menu principal do carregador para selecionar e configurar o modelo DSM que deseja construir. Uma vez criado o carregador, este passo será ignorado a menos que force manualmente uma reconfiguração do monitor de inicialização. Todos os carregadores também têm a opção de configurar o carregador através de uma interface web.",
+      "loaders": {
+        "arc": [
+          {
+            "htmlBefore": "<strong>Interface web</strong>, Para acessar a interface web, basta abrir um navegador web e inserir o endereço IP mostrado na saída do console VM. Por exemplo, no nosso caso: http://192.169.0.32.",
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/arc/arc_1_0_1.png",
+            "alt": "Interface Web Arc Loader",
+            "caption": "Interface Web Arc Loader"
+          },
+          {
+            "htmlBefore": "<strong>Interface de terminal</strong>: aceda diretamente pela consola da VM.",
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/arc/arc_1_1_1.png",
+            "alt": "Interface de Terminal Arc Loader",
+            "caption": "Interface de Terminal Arc Loader"
+          }
+        ],
+        "rr": [
+          {
+            "htmlBefore": "<strong>Interface web</strong>, Para acessar a interface web, basta abrir um navegador da web e digitar o endereço IP mostrado na saída do console VM, seguido pela porta <strong>7681</strong>. Por exemplo, no nosso caso: <code>http://192.169.0.33:7681</code>.",
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/rr/rr_2_0_2.png",
+            "alt": "Exemplo de Comando RR",
+            "caption": "Interface Web do Carregador RR"
+          },
+          {
+            "htmlBefore": "<strong>Interface de terminal</strong>: escreva <strong>menu.sh</strong> na consola da VM para a abrir.",
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/rr/rr_2_1_1.png",
+            "alt": "Interface de Carregador RR",
+            "caption": "Interface de terminal do RR Loader"
+          }
+        ],
+        "tinycore": [
+          {
+            "htmlBefore": "<strong>Interface web</strong>, Para acessar a interface web, basta abrir um navegador da web e digitar o endereço IP mostrado na saída do console VM, seguido pela porta <strong>7681</strong>. Por exemplo, no nosso caso: <code>http://192.169.0.35:7681</code>.",
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/tinycore/tinycore_3_0_1.png",
+            "alt": "Interface do TinyCore Loader",
+            "caption": "Interface Web do Carregador TinyCore"
+          },
+          {
+            "htmlBefore": "<strong>Interface terminal</strong>, Acesse-o diretamente da saída do console VM. Fique de olho na tela, pois em algum momento ela pode pedir que você pressione uma tecla para continuar ou perguntar se deseja mudar o idioma.",
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/tinycore/tinycore_3_1_1.png",
+            "alt": "Interface do TinyCore Loader",
+            "caption": "Interface de terminal do TinyCore Loader"
+          }
+        ]
+      }
+    },
+    {
+      "id": "step2",
+      "title": "Selecionar modelo",
+      "intro": "Depois de carregar o menu, selecione o modelo DSM Synology que você deseja instalar. Dependendo do carregador, você pode às vezes precisar expandir as opções para ver mais modelos.",
+      "outro": "No nosso exemplo, vamos escolher o modelo SA6400.",
+      "loaders": {
+        "arc": [
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/arc/arc_1_2_1.png",
+            "alt": "Seleção do modelo no Arc",
+            "caption": "Seleção do modelo no Arc"
+          }
+        ],
+        "rr": [
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/rr/rr_2_2_1.png",
+            "alt": "Seleção do modelo RR",
+            "caption": "Seleção do modelo RR"
+          }
+        ],
+        "tinycore": [
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/tinycore/tinycore_3_2_1.png",
+            "alt": "Seleção do modelo TinyCore",
+            "caption": "Seleção do modelo TinyCore"
+          }
+        ]
+      }
+    },
+    {
+      "id": "step3",
+      "title": "Selecione a versão do DSM",
+      "intro": "Depois de selecionar o modelo, você precisa escolher a versão DSM que deseja instalar.",
+      "loaders": {
+        "arc": [
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/arc/arc_1_3_1.png",
+            "alt": "Seleção da versão no Arc — passo 1",
+            "caption": "Seleção da versão no Arc — passo 1"
+          },
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/arc/arc_1_3_2.png",
+            "alt": "Seleção da versão no Arc — passo 2",
+            "caption": "Seleção da versão no Arc — passo 2"
+          }
+        ],
+        "rr": [
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/rr/rr_2_3_1.png",
+            "alt": "Seleção da versão RR - Passo 1",
+            "caption": "Seleção da versão RR - Passo 1"
+          },
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/rr/rr_2_3_2.png",
+            "alt": "Seleção da versão RR - Passo 2",
+            "caption": "Seleção da versão RR - Passo 2"
+          },
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/rr/rr_2_3_3.png",
+            "alt": "Seleção da versão RR - Passo 3",
+            "caption": "Seleção da versão RR - Passo 3"
+          }
+        ],
+        "tinycore": [
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/tinycore/tinycore_3_3_1.png",
+            "alt": "Seleção da versão do TinyCore - Passo 1",
+            "caption": "Seleção da versão do TinyCore - Passo 1"
+          },
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/tinycore/tinycore_3_3_2.png",
+            "alt": "Seleção da versão do TinyCore - Passo 2",
+            "caption": "Seleção da versão do TinyCore - Passo 2"
+          }
+        ]
+      }
+    },
+    {
+      "id": "step4",
+      "title": "Selecionar complementos",
+      "intro": "Esta etapa permite adicionar recursos adicionais ou configurações personalizadas ao carregador.",
+      "loaders": {
+        "arc": [
+          {
+            "htmlBefore": "<strong>Arc</strong> dá-lhe a opção de configurar automaticamente ou manualmente ajustar as configurações. Se a configuração automática for selecionada, o carregador começará a aplicar as configurações necessárias e reiniciará automaticamente quando o processo estiver concluído.",
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/arc/arc_1_4_1.png",
+            "alt": "Configuração automática do Arc",
+            "caption": "Configuração automática do Arc"
+          },
+          {
+            "htmlBefore": "Se optarmos por não usar o modo automático, introduzimos o menu para configurar as diferentes opções necessárias para o carregador:",
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/arc/arc_1_4_2.png",
+            "alt": "Configuração manual do Arc",
+            "caption": "Configuração manual do Arc"
+          },
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/arc/arc_1_4_3.png",
+            "alt": "Configuração do Arc SN/Mac",
+            "caption": "Configuração do Arc SN/Mac"
+          },
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/arc/arc_1_4_4.png",
+            "alt": "Arc Sata Portmap",
+            "caption": "Arc Sata Portmap (use a opção recomendada)"
+          },
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/arc/arc_1_4_5.png",
+            "alt": "Seleção de complementos no Arc",
+            "caption": "Seleção de complementos no Arc"
+          }
+        ],
+        "rr": [
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/rr/rr_2_4_1.png",
+            "alt": "Complemento RR — passo 1",
+            "caption": "Complemento RR — passo 1"
+          },
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/rr/rr_2_4_2.png",
+            "alt": "Complemento RR — passo 2",
+            "caption": "Complemento RR — passo 2: clique para adicionar complementos."
+          },
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/rr/rr_2_4_3.png",
+            "alt": "Complemento RR — passo 3",
+            "caption": "Complemento RR — passo 3: clique no que pretende. Para adicionar mais, repita o processo das imagens 2.4.2 e 2.4.3."
+          }
+        ],
+        "tinycore": [
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/tinycore/tinycore_3_4_1.png",
+            "alt": "Configuração do SN TinyCore",
+            "caption": "Configuração do SN TinyCore"
+          },
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/tinycore/tinycore_3_4_2.png",
+            "alt": "Opção aleatória TinyCore",
+            "caption": "Opção aleatória TinyCore - A opção aleatória é recomendada"
+          },
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/tinycore/tinycore_3_4_3.png",
+            "alt": "Configuração do MAC do TinyCore",
+            "caption": "Configuração do MAC do TinyCore"
+          },
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/tinycore/tinycore_3_4_4.png",
+            "alt": "TinyCore VM MAC",
+            "caption": "TinyCore VM MAC - Escolha usar o MAC do seu VM ou um MAC aleatório"
+          }
+        ]
+      }
+    },
+    {
+      "id": "step5",
+      "title": "Compilar o Carregador",
+      "intro": "Uma vez que você tenha selecionado o modelo, versão DSM, e addons, prossiga para construir o carregador. Este processo pode levar alguns minutos dependendo do carregador e da configuração selecionada. Para iniciar, selecione a opção \"Construir o Carregador\".",
+      "loaders": {
+        "arc": [
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/arc/arc_1_5_1.png",
+            "alt": "Construção do carregador no Arc",
+            "caption": "Construção do carregador no Arc"
+          }
+        ],
+        "rr": [
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/rr/rr_2_5_1.png",
+            "alt": "Construção do carregador no RR",
+            "caption": "Construção do carregador no RR"
+          }
+        ],
+        "tinycore": [
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/tinycore/tinycore_3_5_1.png",
+            "alt": "Construção do carregador no TinyCore",
+            "caption": "Construção do carregador no TinyCore"
+          }
+        ]
+      }
+    },
+    {
+      "id": "step6",
+      "title": "Iniciar o Carregador",
+      "intro": "Uma vez que o carregador foi construído, ele irá pedir-lhe para iniciar. O VM reiniciará com a configuração criada e iniciará a instalação do DSM.",
+      "loaders": {
+        "arc": [
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/arc/arc_1_6_1.png",
+            "alt": "Arranque do carregador no Arc",
+            "caption": "Arranque do carregador no Arc"
+          }
+        ],
+        "rr": [
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/rr/rr_2_6_1.png",
+            "alt": "Arranque do carregador no RR",
+            "caption": "Arranque do carregador no RR"
+          }
+        ],
+        "tinycore": [
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/tinycore/tinycore_3_6_1.png",
+            "alt": "Arranque do carregador no TinyCore",
+            "caption": "Arranque do carregador no TinyCore"
+          }
+        ]
+      }
+    }
+  ],
+  "dsmInstall": {
+    "heading": "Iniciando a Instalação DSM",
+    "intro": "Uma vez que o carregador é inicializado, você pode encontrar seu dispositivo Synology usando:",
+    "afterCode": "Siga os passos no ecrã para concluir a instalação do DSM.",
+    "setupAlt": "Configuração do DSM",
+    "setupCaption": "Ecrã de configuração do DSM",
+    "patience": "Por favor, seja paciente – O processo pode levar alguns minutos para ser concluído. A percentagem de progresso será atualizada automaticamente à medida que a configuração progride. Uma contagem regressiva começará assim que a instalação estiver se aproximando da conclusão.",
+    "finishAlt": "Instalação concluída",
+    "finishCaption": "Instalação concluída"
+  },
+  "tips": {
+    "heading": "Dicas",
+    "introItem": "Tenha em mente que as opções disponíveis podem mudar dependendo da versão do carregador e atualizações do desenvolvedor. Se você encontrar problemas durante o processo de criação do carregador, consulte a documentação do carregador:",
+    "docLinks": [
+      {
+        "label": "Documentação do Arc",
+        "url": "https://github.com/AuxXxilium/arc"
+      },
+      {
+        "label": "Documentação RR",
+        "url": "https://github.com/RROrg/rr"
+      },
+      {
+        "label": "Documentação TinyCore",
+        "url": "https://github.com/PeterSuh-Q3/tinycore-redpill"
+      }
+    ],
+    "olderModels": "Alguns modelos DSM mais antigos podem ter problemas em reconhecer discos ou o cartão de rede. Recomenda-se a utilização de modelos mais recentes.",
+    "updateLabel": "Actualização:",
+    "updateBody": "Alguns carregadores oferecem a opção de atualizar o carregador diretamente do menu.",
+    "importantLabel": "Importante:",
+    "importantBody": "ProxMenux não fornece suporte para os diferentes carregadores."
+  }
+}
diff --git a/web/messages/pt/docs/create-vm/system-linux.json b/web/messages/pt/docs/create-vm/system-linux.json
new file mode 100644
index 00000000..af64e689
--- /dev/null
+++ b/web/messages/pt/docs/create-vm/system-linux.json
@@ -0,0 +1,292 @@
+{
+  "meta": {
+    "title": "Criar VM: sistema Linux | Documentação ProxMenux",
+    "description": "Crie máquinas virtuais Linux no Proxmox VE com o ProxMenux. A documentação abrange o catálogo de ISO oficiais (Ubuntu, Debian, Fedora, Arch, Rocky, Mint, openSUSE, Alpine, Kali, Manjaro), o plano de armazenamento comum, o passthrough GPU opcional e dicas após a instalação.",
+    "ogTitle": "Criar VM: sistema Linux | Documentação ProxMenux",
+    "ogDescription": "Crie VMs Linux em Proxmox VE com ProxMenux. Catálogo ISO curado, plano de armazenamento unificado, passthrough opcional GPU e dicas pós-instalação.",
+    "ogImageAlt": "Menu ProxMenux Linux VM"
+  },
+  "header": {
+    "title": "Criar VM: sistema Linux",
+    "description": "Crie uma VM Linux no Proxmox VE. O ProxMenux inclui um catálogo de ISO Linux oficiais para transferência e um seletor de ISO locais. Todos os percursos passam pelo assistente comum de VM, pelo plano de armazenamento e pelo assistente opcional de passthrough GPU.",
+    "section": "Máquinas Virtuais"
+  },
+  "intro": {
+    "title": "O que este script faz",
+    "body": "Escolha uma ISO Linux oficial para transferência automática ou uma ISO local já carregada. O assistente comum passa depois por CPU, RAM e BIOS, plano de armazenamento, passthrough GPU opcional e criação da VM."
+  },
+  "image": {
+    "alt": "Opções de instalação do Linux ProxMenux",
+    "caption": "Opções de instalação do Linux"
+  },
+  "config": {
+    "heading": "Configuração padrão vs avançada",
+    "intro": "Depois que a ISO é selecionada, ProxMenux pergunta se deve usar o perfil padrão VM ou abrir o assistente avançado.",
+    "defaultHeading": "Configuração padrão",
+    "headerParam": "Parâmetro",
+    "headerValue": "Valor padrão",
+    "defaultRows": [
+      {
+        "param": "Tipo de máquina",
+        "valueRich": "<code>q35</code>"
+      },
+      {
+        "param": "BIOS",
+        "value": "OVMF (UEFI)"
+      },
+      {
+        "param": "Tipo CPU",
+        "value": "Host"
+      },
+      {
+        "param": "Núcleos",
+        "value": "2"
+      },
+      {
+        "param": "RAM",
+        "value": "4096 MB"
+      },
+      {
+        "param": "Ponte",
+        "valueRich": "<code>vmbr0</code>"
+      },
+      {
+        "param": "Endereço MAC",
+        "value": "Gerado automaticamente"
+      },
+      {
+        "param": "Iniciar após a conclusão",
+        "value": "Não"
+      }
+    ],
+    "advancedHeading": "Configuração avançada",
+    "advancedIntro": "O assistente avançado expõe cada parâmetro individualmente:",
+    "headerOptions": "Opções",
+    "advancedRows": [
+      {
+        "param": "Tipo de máquina",
+        "optionsRich": "<code>q35</code> ou <code>i440fx</code>"
+      },
+      {
+        "param": "BIOS",
+        "options": "OVMF (UEFI) ou SeaBIOS (Legado)"
+      },
+      {
+        "param": "Tipo CPU",
+        "options": "Host, KVM64 e outros modelos de CPU da lista"
+      },
+      {
+        "param": "Núcleos",
+        "options": "Número de núcleos CPU"
+      },
+      {
+        "param": "RAM",
+        "options": "Memória atribuída ao VM"
+      },
+      {
+        "param": "Ponte",
+        "options": "Ponte de rede"
+      },
+      {
+        "param": "Endereço MAC",
+        "options": "MAC personalizado"
+      },
+      {
+        "param": "VLAN",
+        "options": "Marca VLAN (opcional)"
+      },
+      {
+        "param": "MTU",
+        "options": "Tamanho MTU"
+      }
+    ]
+  },
+  "storagePlan": {
+    "heading": "Plano de armazenamento",
+    "body": "Depois de CPU / RAM, ProxMenux abre o <strong>Plano de armazenamento</strong> menu, onde você pode combinar discos virtuais, discos importados e dispositivos de passagem PCI no mesmo VM, adicionando itens um de cada vez e terminando quando você terminar.",
+    "virtualDiskTitle": "a. Adicionar disco virtual",
+    "virtualDiskItems": [
+      "Lista os volumes de armazenamento Proxmox disponíveis na máquina.",
+      "Você escolhe o armazenamento de destino e o tamanho em GB.",
+      "O disco utiliza o bus escolhido: SCSI (predefinido), SATA, VirtIO ou IDE. SATA tem seis posições numeradas de 0 a 5: <code>sata0</code>, <code>sata1</code>, …."
+    ],
+    "importDiskTitle": "b. Adicionar disco de importação",
+    "importDiskItems": [
+      "Detecta discos físicos que são seguros de importar (sistema e discos protegidos estão escondidos).",
+      "Você seleciona um ou mais discos através de uma lista de verificação.",
+      "Os discos importados utilizam o bus escolhido e são ligados através de <code>qm set</code>."
+    ],
+    "pciTitle": "c. Adicionar Controlador ou NVMe (passagem PCI)",
+    "pciItems": [
+      "Deteta HBA SATA/SAS e dispositivos NVMe e permite atribuir um <em>controlador completo</em> à VM. O IOMMU tem de estar ativo; o script oferece a ativação e um reinício se necessário.",
+      "Um passo de confirmação avisa sobre o risco de todo o controlador (o cartão inteiro, incluindo cada disco nele, deixa o host).",
+      "Os dispositivos PCI são atribuídos com comandos como <code>qm set VMID --hostpci0 PCI_ADDRESS,pcie=1</code>. Substitua VMID e PCI_ADDRESS pelo ID da VM e endereço PCI e utilize um índice hostpci livre para cada dispositivo."
+    ],
+    "resetTitle": "Repor e terminar",
+    "resetBody": "O menu oferece <strong>r</strong> para repor a seleção e recomeçar e <strong>d</strong> para terminar e continuar. Não é possível terminar com um plano vazio."
+  },
+  "gpu": {
+    "heading": "Passagem de GPU opcional",
+    "body": "Após o plano de armazenamento, se um GPU compatível é detectado no host ProxMenux oferece para lançar o assistente de passagem GPU. Veja <gpuLink>Adicionar GPU a um VM (Passthrough)</gpuLink> para como o assistente funciona — pode ser necessário reiniciar uma máquina."
+  },
+  "autoFeatures": {
+    "heading": "Recursos automáticos VM",
+    "efiTitle": "Disco EFI",
+    "efiBody": "Quando o OVMF (UEFI) é selecionado, ProxMenux cria um disco de sistema 4 MB EFI no armazenamento que você escolhe para que o firmware tenha um lugar para armazenar suas variáveis.",
+    "isoTitle": "Montagem ISO",
+    "isoBody": "A instalação ISO é anexada ao <code>ide2</code> como um CD-ROM, pronto para a primeira inicialização.",
+    "guestTitle": "QEMU Agente convidado",
+    "guestBody": "O canal de agente convidado está habilitado na configuração VM. Você ainda precisa instalar o agente dentro do hóspede — veja as dicas abaixo."
+  },
+  "installOptions": {
+    "heading": "Opções de instalação do Linux",
+    "officialHeading": "ISO oficial (instalação tradicional)",
+    "officialBody": "O ProxMenux inclui uma seleção de ISO Linux oficiais. Escolha uma: o script transfere-a do espelho do projeto para <code>/var/lib/vz/template/iso</code> e liga-a à VM.",
+    "officialImageAlt": "Seleção de distribuição Linux",
+    "officialImageCaption": "Seleção de distribuição Linux",
+    "localHeading": "ISO Local",
+    "localBody": "Usa qualquer ISO Linux já presente em <code>/var/lib/vz/template/iso</code>. O script lista cada <code>*.iso</code> que encontrar e permite que você escolha um.",
+    "localImageAlt": "Menu de seleção ISO local",
+    "localImageCaption": "Menu de seleção ISO local",
+    "distros": [
+      {
+        "name": "Ubuntu",
+        "variants": [
+          "25.10 Desktop",
+          "24.04 Desktop",
+          "22.04 Desktop",
+          "20.04 Desktop",
+          "25.10 Server",
+          "24.04 Server",
+          "22.04 Server",
+          "20.04 Server"
+        ]
+      },
+      {
+        "name": "Debian",
+        "variants": [
+          "13 Desktop",
+          "12 Desktop",
+          "11 Desktop",
+          "13 Netinst",
+          "12 Netinst",
+          "11 Netinst"
+        ]
+      },
+      {
+        "name": "Fedora",
+        "variants": [
+          "Workstation 42"
+        ]
+      },
+      {
+        "name": "Arch Linux",
+        "variants": [
+          "mais recente"
+        ]
+      },
+      {
+        "name": "Rocky Linux",
+        "variants": [
+          "9"
+        ]
+      },
+      {
+        "name": "Linux Mint",
+        "variants": [
+          "22.1 Cinnamon"
+        ]
+      },
+      {
+        "name": "openSUSE",
+        "variants": [
+          "Leap 15.6"
+        ]
+      },
+      {
+        "name": "Alpine Linux",
+        "variants": [
+          "3.21"
+        ]
+      },
+      {
+        "name": "Kali Linux",
+        "variants": [
+          "2026.1"
+        ]
+      },
+      {
+        "name": "Manjaro",
+        "variants": [
+          "25.0 GNOME"
+        ]
+      }
+    ]
+  },
+  "endToEnd": {
+    "heading": "O que o script faz de ponta a ponta",
+    "items": [
+      "Obtém a ISO Linux (download oficial ou arquivo local).",
+      "Aplica a configuração padrão ou avançada CPU / RAM / BIOS / tipo de máquina.",
+      "Abre o plano de armazenamento e liga os discos virtuais selecionados, discos importados e dispositivos PCI.",
+      "Cria o disco EFI quando UEFI é selecionado.",
+      "Monta a ISO Linux em <code>ide2</code>.",
+      "Define a ordem de arranque: primeiro disco, depois ISO.",
+      "Habilita o canal QEMU Guest Agent.",
+      "Opcionalmente executa o assistente de passagem GPU.",
+      "Gera uma descrição HTML com estilo anexada ao VM.",
+      "Inicia a VM se tiver escolhido essa opção."
+    ]
+  },
+  "postInstall": {
+    "heading": "Dicas após a instalação",
+    "guestAgentHeading": "Instale o agente convidado QEMU na VM",
+    "guestAgentBody": "O ProxMenux ativa o canal do agente na configuração da VM, mas o agente tem de ser instalado no sistema convidado. Permite o encerramento controlado e congelar os sistemas de ficheiros durante as cópias de segurança para melhorar a consistência dos dados.",
+    "debian": "Debian / Ubuntu",
+    "fedora": "Fedora / Rocky / RHEL",
+    "arch": "Arch Linux",
+    "opensuse": "openSUSE",
+    "virtioHeading": "Suporte para VirtIO no Linux",
+    "virtioBody": "As distribuições Linux modernas normalmente incluem controladores VirtIO para disco e rede. Escolha <code>virtio</code> para discos de blocos VirtIO ou <code>scsi</code> com o controlador VirtIO SCSI configurado; o adaptador de rede também utiliza <code>virtio</code>. Verifique os controladores nos instaladores antigos.",
+    "virtioWarnTitle": "Distribuição muito antiga",
+    "virtioWarnBody": "Os instaladores muito antigos podem não incluir os controladores VirtIO necessários. Nesse caso, utilize um controlador SATA / SCSI emulado ou forneça os controladores adequados.",
+    "trimHeading": "Ativar TRIM / discard no armazenamento SSD",
+    "trimBody": "Se a VM utiliza armazenamento Proxmox baseado em SSD e o disco foi ligado com a opção <code>discard</code>, pode encaminhar comandos TRIM a partir do sistema convidado. Duas opções:",
+    "trimItems": [
+      "Executar <code>fstrim -av</code> periodicamente (ou ativar a unidade <code>fstrim.timer</code> em distribuições systemd).",
+      "Ou monte sistemas de arquivos com a opção <code>discard</code> em <code>/etc/fstab</code>."
+    ],
+    "balloonHeading": "Balonamento de memória",
+    "balloonBody": "Os kernels Linux modernos normalmente incluem o controlador <code>virtio_balloon</code>. Com o dispositivo de ballooning ativo, o Proxmox pode recolher estatísticas de memória. A recuperação dinâmica também exige uma memória mínima inferior ao máximo configurado; valores iguais mantêm a atribuição fixa."
+  },
+  "related": {
+    "heading": "Relacionado",
+    "items": [
+      {
+        "href": "/docs/disk-manager/import-disk-image-vm",
+        "label": "Importar imagem de disco para VM",
+        "tail": " — ligar uma imagem Linux existente .qcow2 / .img / .raw a uma nova VM."
+      },
+      {
+        "href": "/docs/utils/import-vm",
+        "label": "Importar VM de OVA / OVF",
+        "tail": " — importar uma VM Linux exportada de VMware / VirtualBox / Proxmox."
+      },
+      {
+        "href": "/docs/hardware/gpu-vm-passthrough",
+        "label": "Adicionar GPU à VM (Passthrough)",
+        "tail": " — para VMs Linux que necessitam de aceleração GPU."
+      },
+      {
+        "href": "/docs/help-info/vm-ct-commands",
+        "label": "Comandos de gestão VM e CT",
+        "tail": " — referência qm CLI."
+      },
+      {
+        "href": "/docs/create-vm",
+        "label": "Visão geral da criação de VM",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/pt/docs/create-vm/system-nas/index.json b/web/messages/pt/docs/create-vm/system-nas/index.json
new file mode 100644
index 00000000..d7b56799
--- /dev/null
+++ b/web/messages/pt/docs/create-vm/system-nas/index.json
@@ -0,0 +1,147 @@
+{
+  "meta": {
+    "title": "Criar VM: sistema NAS | Documentação ProxMenux",
+    "description": "Crie VM NAS no Proxmox VE com o ProxMenux: Synology DSM com carregador, TrueNAS SCALE/CORE, OpenMediaVault, XigmaNAS, Rockstor, ZimaOS e FygoOS. O Umbrel OS está disponível através de um script comunitário.",
+    "ogTitle": "Criar VM: sistema NAS | Documentação ProxMenux",
+    "ogDescription": "Crie VM NAS no Proxmox VE com o ProxMenux: Synology DSM com carregador, TrueNAS SCALE/CORE, OpenMediaVault, XigmaNAS, Rockstor, ZimaOS e FygoOS.",
+    "ogImageAlt": "Menu NAS do sistema ProxMenux"
+  },
+  "header": {
+    "title": "Criar VM: Sistema NAS",
+    "description": "ProxMenux suporta oito sistemas operacionais NAS como VMs dedicadas, além de um caminho opcional Umbrel OS através de um script comunitário. A maioria dos sistemas compartilham o mesmo fluxo auto-ISO; a Synology DSM usa um assistente de carregador especializado.",
+    "section": "Máquinas Virtuais"
+  },
+  "intro": {
+    "title": "Como funciona o seletor NAS",
+    "body": "No processo ISO genérico, o seletor tenta detetar a última versão estável no espelho do projeto, usa uma versão de recurso se necessário, transfere a ISO e abre o configurador comum de CPU, RAM, discos e rede. Synology DSM e ZimaOS usam instaladores próprios."
+  },
+  "image": {
+    "alt": "Selector NAS de sistema ProxMenux",
+    "caption": "Selector NAS do sistema"
+  },
+  "flowBadges": {
+    "loader": "Fluxo do carregador",
+    "auto-iso": "Fluxo auto- ISO",
+    "dedicated": "Programa dedicado"
+  },
+  "labels": {
+    "base": "Base",
+    "fileSystem": "Sistema de ficheiros",
+    "viewDetails": "Ver detalhes"
+  },
+  "supported": {
+    "heading": "Sistemas NAS suportados",
+    "cards": [
+      {
+        "name": "Synology DSM",
+        "tagline": "DiskStation Manager com carregador ARC/RR. Configure o carregador antes do primeiro arranque.",
+        "icon": "HardDrive",
+        "base": "Linux (personalizado)",
+        "fileSystem": "Btrfs, ext4",
+        "href": "/docs/create-vm/system-nas/synology",
+        "flow": "loader"
+      },
+      {
+        "name": "TrueNAS SCALE",
+        "tagline": "TrueNAS baseado em Debian com aplicações Docker nas versões atuais e ZFS como sistema de ficheiros principal. As versões antigas do SCALE usavam Kubernetes.",
+        "icon": "Database",
+        "base": "Debian Linux",
+        "fileSystem": "ZFS",
+        "href": "/docs/create-vm/system-nas/system-nas-others#truenas-scale",
+        "flow": "auto-iso"
+      },
+      {
+        "name": "TrueNAS CORE",
+        "tagline": "TrueNAS baseado em FreeBSD, focado em armazenamento ZFS. As jails e os plugins do CORE 13.3 estão obsoletos e sem suporte.",
+        "icon": "Database",
+        "base": "FreeBSD",
+        "fileSystem": "ZFS",
+        "href": "/docs/create-vm/system-nas/system-nas-others#truenas-core",
+        "flow": "auto-iso"
+      },
+      {
+        "name": "OpenMediaVault",
+        "tagline": "NAS baseado em Debian leve com uma arquitetura modular de plugins. Ótimo para hardware mais velho.",
+        "icon": "Server",
+        "base": "Debian Linux",
+        "fileSystem": "ext4, XFS, Btrfs",
+        "href": "/docs/create-vm/system-nas/system-nas-others#openmediavault",
+        "flow": "auto-iso"
+      },
+      {
+        "name": "XigmaNAS",
+        "tagline": "NAS baseado em FreeBSD — o sucessor original do FreeNAS, focado em ZFS e simplicidade.",
+        "icon": "Database",
+        "base": "FreeBSD",
+        "fileSystem": "ZFS, UFS",
+        "href": "/docs/create-vm/system-nas/system-nas-others#xigmanas",
+        "flow": "auto-iso"
+      },
+      {
+        "name": "Rockstor",
+        "tagline": "NAS baseado em openSUSE construído em torno de Btrfs. Rock-ons (aplicações Docker) ampliam a funcionalidade.",
+        "icon": "HardDrive",
+        "base": "openSUSE Leap",
+        "fileSystem": "Btrfs",
+        "href": "/docs/create-vm/system-nas/system-nas-others#rockstor",
+        "flow": "auto-iso"
+      },
+      {
+        "name": "ZimaOS",
+        "tagline": "Sistema operacional NAS leve focado em mídia, aplicativos Docker e automação doméstica. Usa o seu próprio instalador.",
+        "icon": "MonitorIcon",
+        "base": "Buildroot (evolução do CasaOS)",
+        "fileSystem": "ext4",
+        "href": "/docs/create-vm/system-nas/system-nas-others#zimaos",
+        "flow": "dedicated"
+      },
+      {
+        "name": "FygoOS",
+        "tagline": "Edição internacional do fnOS: um NAS baseado em Debian com volumes de armazenamento, aplicativos e streaming de mídia, gerenciado a partir de sua interface web e dos aplicativos Fygo.",
+        "icon": "Server",
+        "base": "Debian Linux",
+        "fileSystem": "Btrfs, ext4",
+        "href": "/docs/create-vm/system-nas/system-nas-others#fygoos",
+        "flow": "auto-iso"
+      }
+    ]
+  },
+  "umbrel": {
+    "title": "Opção comunitária: Umbrel OS",
+    "bodyRich": "A 9a entrada no menu NAS é <strong>Umbrel OS</strong>. Ele executa um instalador <umbrelLink>community-scripts</umbrelLink> mantido fora do ProxMenux, por isso não está documentado aqui. O instalador lida com todo o ciclo de vida e imprime suas credenciais padrão no final."
+  },
+  "zfsMem": {
+    "title": "Regra prática de memória ZFS",
+    "bodyRich": "Para TrueNAS, atribua pelo menos <strong>8 GB de RAM</strong> para uso básico e mais para cargas exigentes. O ZFS utiliza RAM para a cache ARC, mas não há um limite universal de 8 GB para todos os NAS ZFS. Consulte os requisitos da distribuição e dimensione segundo discos, serviços e aplicações; configurações leves OMV ou Rockstor podem precisar de menos."
+  },
+  "related": {
+    "heading": "Relacionado",
+    "items": [
+      {
+        "href": "/docs/create-vm/system-nas/synology",
+        "label": "VM Synology",
+        "tail": " — instalador dedicado da Synology DSM (Xpenology) na Proxmox."
+      },
+      {
+        "href": "/docs/create-vm/system-nas/system-nas-others",
+        "label": "Outro NAS de Sistema",
+        "tail": " — TrueNAS, OpenMediaVault, Rockstor, XigmaNAS, FygoOS e semelhantes."
+      },
+      {
+        "href": "/docs/disk-manager/import-disk-vm",
+        "label": "Importar disco para VM",
+        "tail": " — passe discos físicos reais para o NAS VM (recomendado sobre discos virtuais para produção)."
+      },
+      {
+        "href": "/docs/help-info/zfs-commands",
+        "label": "Comandos de gerenciamento ZFS",
+        "tail": " — útil se a sua distribuição NAS usar ZFS por baixo."
+      },
+      {
+        "href": "/docs/create-vm",
+        "label": "Visão geral da criação de VM",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/pt/docs/create-vm/system-nas/synology.json b/web/messages/pt/docs/create-vm/system-nas/synology.json
new file mode 100644
index 00000000..1f342678
--- /dev/null
+++ b/web/messages/pt/docs/create-vm/system-nas/synology.json
@@ -0,0 +1,400 @@
+{
+  "meta": {
+    "title": "Criar VM: Synology DSM | Documentação ProxMenux",
+    "description": "Crie uma VM Synology DSM no Proxmox VE. O ProxMenux transfere o carregador escolhido (Arc, RR, Alpine RedPill M-shell ou uma imagem própria), importa-o como disco de arranque e configura CPU, RAM e armazenamento com o assistente predefinido ou avançado.",
+    "ogTitle": "Criar VM: Synology DSM | Documentação ProxMenux",
+    "ogDescription": "Crie uma máquina virtual DSM Synology em Proxmox VE com ProxMenux."
+  },
+  "header": {
+    "title": "Criar VM: Synology DSM",
+    "description": "Crie uma VM Synology DSM no Proxmox VE. O ProxMenux transfere o carregador escolhido (Arc, RR, Alpine RedPill M-shell ou uma imagem própria), importa-o como disco de arranque e configura CPU, RAM e armazenamento com o assistente predefinido ou avançado.",
+    "section": "Máquinas Virtuais · NAS"
+  },
+  "loaderLabels": {
+    "arc": "Arc Loader",
+    "rr": "RR Loader",
+    "tinycore": "TinyCore Loader"
+  },
+  "whatThisDoes": {
+    "title": "O que isto faz",
+    "bodyRich": "O ProxMenux automatiza a preparação da VM para Synology DSM: transfere um carregador suportado, importa-o como disco de arranque IDE e aplica as definições escolhidas de CPU, RAM, rede e armazenamento. A construção do carregador, a escolha do modelo e a instalação DSM decorrem <strong>dentro da VM</strong>, pela interface web ou de terminal do carregador. Estes passos são mantidos pela comunidade e mudam frequentemente; esta página oferece uma base de trabalho."
+  },
+  "supportedLoaders": {
+    "heading": "Carregadores suportados",
+    "intro": "O script permite- lhe escolher entre quatro fontes do carregador:",
+    "loaders": [
+      {
+        "name": "AuxXxilium Arc",
+        "url": "https://github.com/AuxXxilium/arc"
+      },
+      {
+        "name": "RedPill RR",
+        "url": "https://github.com/RROrg/rr"
+      },
+      {
+        "name": "Alpine RedPill M-shell (projeto TinyCore)",
+        "url": "https://github.com/PeterSuh-Q3/tinycore-redpill"
+      }
+    ],
+    "customRich": "<strong>Carregador personalizado</strong> — solte sua própria imagem do carregador em <code>/var/lib/vz/template/iso</code> e o script irá pegá-lo."
+  },
+  "config": {
+    "heading": "Configuração padrão vs avançada",
+    "intro": "Quando você executa o script, ele pergunta se deve usar o perfil ProxMenux padrão VM ou abrir o assistente avançado. Os valores padrão são sintonizados para DSM e funcionam para a maioria das instalações.",
+    "defaultHeading": "Configuração padrão",
+    "headerParam": "Parâmetro",
+    "headerValue": "Valor padrão",
+    "defaultRowsRich": [
+      {
+        "param": "Tipo de máquina",
+        "valueRich": "<code>q35</code>"
+      },
+      {
+        "param": "BIOS",
+        "valueRich": "OVMF (UEFI)"
+      },
+      {
+        "param": "Tipo CPU",
+        "valueRich": "Host"
+      },
+      {
+        "param": "Núcleos",
+        "valueRich": "2"
+      },
+      {
+        "param": "RAM",
+        "valueRich": "4096 MB"
+      },
+      {
+        "param": "Ponte",
+        "valueRich": "<code>vmbr0</code>"
+      },
+      {
+        "param": "Endereço MAC",
+        "valueRich": "Gerado automaticamente"
+      },
+      {
+        "param": "Iniciar após a conclusão",
+        "valueRich": "Não"
+      }
+    ],
+    "advancedHeading": "Configuração avançada",
+    "advancedIntro": "O assistente avançado apresenta cada definição separadamente. Pode alterar os seguintes valores:",
+    "headerOptions": "Opções",
+    "advancedRowsRich": [
+      {
+        "param": "Tipo de máquina",
+        "optionsRich": "<code>q35</code> ou <code>i440fx</code>"
+      },
+      {
+        "param": "BIOS",
+        "optionsRich": "OVMF (UEFI) ou SeaBIOS (Legado)"
+      },
+      {
+        "param": "Tipo CPU",
+        "optionsRich": "Host ou KVM64"
+      },
+      {
+        "param": "Núcleos",
+        "optionsRich": "Número de núcleos CPU"
+      },
+      {
+        "param": "RAM",
+        "optionsRich": "Memória atribuída à VM"
+      },
+      {
+        "param": "Ponte",
+        "optionsRich": "Ponte de rede"
+      },
+      {
+        "param": "Endereço MAC",
+        "optionsRich": "MAC personalizado"
+      },
+      {
+        "param": "VLAN",
+        "optionsRich": "Marca VLAN (opcional)"
+      },
+      {
+        "param": "MTU",
+        "optionsRich": "Tamanho MTU"
+      }
+    ]
+  },
+  "storagePlan": {
+    "heading": "Plano de armazenamento",
+    "introRich": "Após CPU e RAM, o ProxMenux abre o menu <strong>Plano de armazenamento</strong>. Pode <strong>combinar</strong> discos virtuais, discos importados e dispositivos PCI passthrough na mesma VM. Adicione os elementos um a um e termine quando concluir.",
+    "virtualHeading": "a. Adicionar disco virtual",
+    "virtualItemsRich": [
+      "Lista os volumes de armazenamento Proxmox disponíveis na máquina.",
+      "Você escolhe o armazenamento de destino e o tamanho em GB.",
+      "O disco é ligado como SATA (<code>sata0</code>, <code>sata1</code>, …). Os discos de dados virtuais e físicos partilham as seis posições SATA numeradas de 0 a 5."
+    ],
+    "importHeading": "b. Adicionar disco de importação",
+    "importItemsRich": [
+      "Detecta discos físicos que são seguros de importar (sistema e discos protegidos estão escondidos).",
+      "Você seleciona um ou mais discos através de uma lista de verificação.",
+      "Os discos importados são anexados como SATA via <code>qm set</code>."
+    ],
+    "pciHeading": "c. Adicionar Controlador ou NVMe (passagem PCI)",
+    "pciItemsRich": [
+      "Deteta HBA SATA/SAS e dispositivos NVMe e permite atribuir um <em>controlador completo</em> à VM. O IOMMU tem de estar ativo; o script oferece a ativação e um reinício se necessário.",
+      "Um passo de confirmação avisa sobre o risco de todo o controlador (o cartão inteiro, incluindo cada disco nele, deixa o host).",
+      "Os dispositivos PCI são atribuídos com comandos como <code>qm set VMID --hostpci0 PCI_ADDRESS,pcie=1</code>. Substitua VMID e PCI_ADDRESS pelo ID da VM e endereço PCI e utilize um índice hostpci livre para cada dispositivo."
+    ],
+    "resetCalloutTitle": "Repor e terminar",
+    "resetCalloutBodyRich": "O menu oferece <strong>r</strong> para repor a seleção e recomeçar e <strong>d</strong> para terminar e continuar. Não pode terminar com um plano vazio: o Synology precisa de pelo menos um disco para instalar DSM."
+  },
+  "gpu": {
+    "heading": "Passagem de GPU opcional",
+    "bodyRich": "Após o plano de armazenamento, se o script detecta um GPU compatível no host, ele pergunta se você quer passá-lo para este VM. Veja <link>Adicionar GPU a um VM (Passthrough)</link> para como o assistente funciona — pode ser necessário reiniciar uma máquina."
+  },
+  "loaderInstall": {
+    "heading": "Instalação do carregador",
+    "intro1Rich": "<strong>Arc</strong>, <strong>RR</strong> e <strong>Alpine RedPill M-shell</strong> são transferidos e extraídos automaticamente dos repositórios GitHub originais. Se a transferência falhar, o script termina com uma mensagem clara.",
+    "intro2Rich": "Para a opção <strong>Custom Loader</strong> o script verifica <code>/var/lib/vz/template/iso</code>. Se mais de um candidato for encontrado você é solicitado a escolher o que você quer.",
+    "uploadIntro": "Você pode enviar carregadores personalizados do armazenamento local do Proxmox:",
+    "imageAlt": "Adicionar um carregador personalizado",
+    "imageCaption": "Adicionar um carregador personalizado"
+  },
+  "vmCreation": {
+    "heading": "Criação de VM — o que o script executa",
+    "introRich": "Depois de confirmar o carregador, o ProxMenux executa o equivalente a estes comandos <code>qm</code>:",
+    "itemsRich": [
+      "<code>qm create</code> — cria a VM com CPU, RAM, BIOS e tipo de máquina escolhidos.",
+      "<code>qm importdisk</code> importa a imagem do carregador para o armazenamento Proxmox. O script liga-a depois como disco <strong>IDE</strong> em ide0 para compatibilidade.",
+      "<code>qm set VMID --sata0 DISK_REFERENCE</code> liga um disco de dados do plano. Substitua VMID e DISK_REFERENCE pelo ID da VM e referência do disco; utilize um índice SATA livre de 0 a 5. A rede é configurada por qm create.",
+      "<code>qm set VMID --hostpci0 PCI_ADDRESS,pcie=1</code> atribui um controlador PCI ou dispositivo NVMe selecionado. Substitua VMID e PCI_ADDRESS pelo ID da VM e endereço PCI e utilize um índice hostpci livre por dispositivo.",
+      "<code>qm set VMID --boot order=ide0</code> define o carregador como dispositivo de arranque. Substitua VMID pelo ID da VM."
+    ]
+  },
+  "stepByStep": {
+    "heading": "Configuração do carregador passo a passo",
+    "intro": "Os seis passos comuns são: iniciar a VM, escolher modelo, versão DSM e complementos, construir e arrancar. Os menus e opções variam por versão. As capturas M-shell mostram uma interface TinyCore anterior; o script atual transfere Alpine RedPill M-shell, pelo que deve seguir as indicações atuais.",
+    "warnCalloutTitle": "Os carregadores não são mantidos pelo ProxMenux",
+    "warnCalloutBody": "Arc, RR e Alpine RedPill M-shell são projetos comunitários com sua própria cadência de lançamento. Se um passo parece diferente das capturas de tela abaixo, o carregador provavelmente atualizou — verifique a própria documentação do carregador (links na parte inferior desta página)."
+  },
+  "stepBadge": "Etapa",
+  "step1": {
+    "title": "Iniciar a VM e abrir o menu principal",
+    "intro": "Inicie a VM criada. O primeiro arranque abre a configuração do carregador para escolher e construir o modelo DSM. Os arranques seguintes saltam este passo, salvo se forçar uma nova configuração no menu de arranque do carregador. Os três carregadores oferecem uma interface de terminal e uma interface web.",
+    "arc": {
+      "webRich": "<strong>Interface web.</strong> Abra um navegador e vá para o IP mostrado no console VM (no nosso exemplo: <code>http://192.168.0.32</code>).",
+      "webAlt": "Interface Web Arc Loader",
+      "webCaption": "Interface Web Arc Loader",
+      "termRich": "<strong>Interface de terminal</strong>: aceda diretamente pela consola da VM.",
+      "termAlt": "Interface de Terminal Arc Loader",
+      "termCaption": "Interface de Terminal Arc Loader"
+    },
+    "rr": {
+      "webRich": "<strong>Interface web.</strong> Abra um navegador e indique o IP mostrado na consola da VM seguido da porta <strong>7681</strong> (exemplo: <code>http://192.168.0.33:7681</code>).",
+      "webAlt": "Interface Web do carregador RR",
+      "webCaption": "Interface Web do carregador RR",
+      "termRich": "<strong>Interface de terminal.</strong> Escreva <code>menu.sh</code> na consola da VM para a abrir.",
+      "termAlt": "Interface de terminal do carregador RR",
+      "termCaption": "Interface de terminal do carregador RR"
+    },
+    "tinycore": {
+      "webRich": "<strong>Interface web.</strong> Abra um navegador e indique o IP mostrado na consola da VM seguido da porta <strong>7681</strong> (exemplo: <code>http://192.168.0.35:7681</code>).",
+      "webAlt": "Interface web do carregador TinyCore",
+      "webCaption": "Interface web do carregador TinyCore",
+      "termRich": "<strong>Interface terminal.</strong> Use-o do console VM. Fique de olho nele — em algum momento talvez o faça pressionar uma tecla para continuar ou mudar a língua.",
+      "termAlt": "Interface de terminal TinyCore",
+      "termCaption": "Interface de terminal TinyCore"
+    }
+  },
+  "step2": {
+    "title": "Selecione o modelo",
+    "introRich": "Escolha o modelo Synology DSM que pretende instalar. Conforme o carregador, poderá ter de expandir as opções para ver a lista completa. Nas capturas abaixo utilizamos o modelo <strong>SA6400</strong> como exemplo.",
+    "arc": {
+      "alt": "Seleção do modelo no Arc",
+      "caption": "Seleção do modelo no Arc"
+    },
+    "rr": {
+      "alt": "Seleção do modelo RR",
+      "caption": "Seleção do modelo RR"
+    },
+    "tinycore": {
+      "alt": "Seleção do modelo TinyCore",
+      "caption": "Seleção do modelo TinyCore"
+    }
+  },
+  "step3": {
+    "title": "Selecione a versão DSM",
+    "intro": "Depois de escolher o modelo, escolha a versão DSM a instalar.",
+    "arc": [
+      {
+        "alt": "Seleção da versão no Arc — passo 1",
+        "caption": "Seleção da versão no Arc — passo 1"
+      },
+      {
+        "alt": "Seleção da versão no Arc — passo 2",
+        "caption": "Seleção da versão no Arc — passo 2"
+      }
+    ],
+    "rr": [
+      {
+        "alt": "Seleção da versão RR - Passo 1",
+        "caption": "Seleção da versão RR - Passo 1"
+      },
+      {
+        "alt": "Seleção da versão RR - Passo 2",
+        "caption": "Seleção da versão RR - Passo 2"
+      },
+      {
+        "alt": "Seleção da versão RR - Passo 3",
+        "caption": "Seleção da versão RR - Passo 3"
+      }
+    ],
+    "tinycore": [
+      {
+        "alt": "Seleção da versão do TinyCore - Passo 1",
+        "caption": "Seleção da versão do TinyCore - Passo 1"
+      },
+      {
+        "alt": "Seleção da versão do TinyCore - Passo 2",
+        "caption": "Seleção da versão do TinyCore - Passo 2"
+      }
+    ]
+  },
+  "step4": {
+    "title": "Selecionar complementos",
+    "intro": "Esta etapa permite adicionar recursos extras ou configuração personalizada ao carregador.",
+    "arc": {
+      "autoRich": "<strong>Arc</strong> oferece um modo automático recomendado e um modo manual. No modo automático, o carregador aplica predefinições adequadas e reinicia sozinho quando termina.",
+      "autoAlt": "Configuração automática do Arc",
+      "autoCaption": "Configuração automática do Arc",
+      "manualRich": "No modo manual, percorre as opções uma a uma:",
+      "manualAlt": "Configuração manual do Arc",
+      "manualCaption": "Configuração manual do Arc",
+      "snMacAlt": "Arc SN/MAC",
+      "snMacCaption": "Configuração Arc SN / MAC",
+      "portmapAlt": "Arc SATA portmap",
+      "portmapCaption": "Arc SATA portmap (use a opção recomendada)",
+      "addonsAlt": "Complementos do Arc",
+      "addonsCaption": "Seleção de complementos no Arc"
+    },
+    "rr": [
+      {
+        "alt": "RR addon – passo 1",
+        "caption": "RR addon – passo 1"
+      },
+      {
+        "alt": "RR addon – passo 2",
+        "caption": "RR addon – passo 2: pressione para adicionar um addon"
+      },
+      {
+        "alt": "RR addon – passo 3",
+        "caption": "RR addon — passo 3: clique no addon que você deseja. Repita as duas imagens anteriores para adicionar mais."
+      }
+    ],
+    "tinycore": [
+      {
+        "alt": "Configuração do SN TinyCore",
+        "caption": "Configuração do SN TinyCore"
+      },
+      {
+        "alt": "Opção aleatória TinyCore",
+        "caption": "Opção aleatória TinyCore (recomendada)"
+      },
+      {
+        "alt": "Configuração MAC do TinyCore",
+        "caption": "Configuração MAC do TinyCore"
+      },
+      {
+        "alt": "TinyCore VM MAC",
+        "caption": "TinyCore — escolha o MAC do VM ou um MAC aleatório"
+      }
+    ]
+  },
+  "step5": {
+    "title": "Compilar o carregador",
+    "introRich": "Com o modelo, versão DSM e addons escolhidos, escolha <strong>Construa o Loader</strong>. Isso pode levar alguns minutos dependendo do carregador e das opções selecionadas.",
+    "arc": {
+      "alt": "Construção do carregador no Arc",
+      "caption": "Construção do carregador no Arc"
+    },
+    "rr": {
+      "alt": "Construção do carregador no RR",
+      "caption": "Construção do carregador no RR"
+    },
+    "tinycore": {
+      "alt": "Construção do carregador no TinyCore",
+      "caption": "Construção do carregador no TinyCore"
+    }
+  },
+  "step6": {
+    "title": "Iniciar o carregador",
+    "intro": "Uma vez que o carregador é construído, o VM reinicia com a configuração que você criou e instalação DSM começa.",
+    "arc": {
+      "alt": "Arranque do carregador no Arc",
+      "caption": "Arranque do carregador no Arc"
+    },
+    "rr": {
+      "alt": "Arranque do carregador no RR",
+      "caption": "Arranque do carregador no RR"
+    },
+    "tinycore": {
+      "alt": "Arranque do carregador no TinyCore",
+      "caption": "Arranque do carregador no TinyCore"
+    }
+  },
+  "dsmInstall": {
+    "heading": "Iniciando a instalação do DSM",
+    "intro": "Após o arranque do carregador, pode encontrar a VM DSM abrindo:",
+    "afterCode": "Siga os passos no ecrã para concluir a instalação do DSM.",
+    "setupAlt": "Configuração do DSM",
+    "setupCaption": "Tela de configuração do DSM",
+    "patience": "Aguarde alguns minutos. O progresso atualiza-se automaticamente e surge uma contagem decrescente quando a instalação se aproxima do fim.",
+    "finishAlt": "Instalação concluída",
+    "finishCaption": "Instalação concluída"
+  },
+  "tips": {
+    "heading": "Dicas",
+    "recentTitle": "Usar modelos DSM recentes",
+    "recentBody": "Alguns modelos DSM mais antigos têm dificuldade em reconhecer discos ou o cartão de rede. Prefere modelos recentes (p. ex. SA6400) para uma experiência inicial mais suave.",
+    "updateTitle": "Atualizando o carregador",
+    "updateBody": "Alguns carregadores oferecem a opção de se atualizar diretamente do menu de configuração — você não precisa destruir e recriar o VM.",
+    "warnTitle": "ProxMenux não suporta os carregadores",
+    "warnBody": "ProxMenux automatiza o lado VM. Problemas de carregador (modelo não encontrado, add-on falha em instalar, DSM recusando-se a iniciar) estão fora de alcance aqui — use o rastreador de problemas de cada carregador e documentação.",
+    "docsHeading": "Documentação do carregador",
+    "docLinks": [
+      {
+        "label": "Documentação do Arc",
+        "url": "https://github.com/AuxXxilium/arc"
+      },
+      {
+        "label": "Documentação RR",
+        "url": "https://github.com/RROrg/rr"
+      },
+      {
+        "label": "Documentação TinyCore",
+        "url": "https://github.com/PeterSuh-Q3/tinycore-redpill"
+      }
+    ]
+  },
+  "related": {
+    "heading": "Relacionado",
+    "itemsRich": [
+      {
+        "href": "/docs/create-vm/system-nas",
+        "label": "Visão geral do sistema NAS",
+        "tail": " — comparação entre Synology e TrueNAS / OMV / Rockstor / XigmaNAS."
+      },
+      {
+        "href": "/docs/create-vm/system-nas/system-nas-others",
+        "label": "Outro NAS de Sistema",
+        "tail": " — distribuições NAS diferentes de Synology."
+      },
+      {
+        "href": "/docs/disk-manager/import-disk-vm",
+        "label": "Importar disco para VM",
+        "tail": " — passar discos reais para o Synology VM (recomendado para o desempenho do armazenamento)."
+      },
+      {
+        "href": "/docs/create-vm",
+        "label": "Visão geral da criação de VM",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/pt/docs/create-vm/system-nas/system-nas-others.json b/web/messages/pt/docs/create-vm/system-nas/system-nas-others.json
new file mode 100644
index 00000000..50233755
--- /dev/null
+++ b/web/messages/pt/docs/create-vm/system-nas/system-nas-others.json
@@ -0,0 +1,312 @@
+{
+  "meta": {
+    "title": "Criar VM: outros sistemas NAS | Documentação ProxMenux",
+    "description": "Crie VM TrueNAS SCALE, TrueNAS CORE, OpenMediaVault, XigmaNAS, Rockstor, ZimaOS e FygoOS no Proxmox VE com o ProxMenux. Configuração predefinida ou avançada, plano de armazenamento, passthrough GPU opcional e recursos aconselhados para cada sistema.",
+    "ogTitle": "Criar VM: outros sistemas NAS | Documentação ProxMenux",
+    "ogDescription": "Criar TrueNAS SCALE / CORE, OpenMediaVault, XigmaNAS, Rockstor, ZimaOS e FygoOS VMs em Proxmox VE com ProxMenux.",
+    "ogImageAlt": "Selector NAS ProxMenux"
+  },
+  "header": {
+    "title": "Criar VM: Outros sistemas NAS",
+    "description": "ProxMenux pode criar um pronto para instalar VM para TrueNAS SCALE, TrueNAS CORE, OpenMediaVault, XigmaNAS, Rockstor, ZimaOS e FygoOS. Esta página cobre o fluxo de criação compartilhada (padrão / configuração avançada, o novo plano de armazenamento, passagem opcional GPU) mais notas por sistema e especificações recomendadas.",
+    "section": "Máquinas Virtuais · NAS"
+  },
+  "intro": {
+    "title": "Como estes sistemas são criados",
+    "bodyRich": "Os sete sistemas usam o assistente ProxMenux. O seletor NAS escolhe o instalador, detetando a versão estável mais recente para TrueNAS, OMV, XigmaNAS, Rockstor e FygoOS, e passa ao configurador comum da VM e ao plano de armazenamento. O ZimaOS tem um instalador próprio (<code>vm/zimaos.sh</code>), com a mesma sequência de CPU, RAM, armazenamento e GPU opcional."
+  },
+  "config": {
+    "heading": "Configuração padrão vs avançada",
+    "intro": "Quando um NAS é selecionado, ProxMenux pergunta se deve usar o perfil padrão VM ou abrir o assistente avançado. Os padrões são sintonizados para cargas de trabalho NAS — mais RAM do que um simples Linux VM porque os sistemas baseados em ZFS precisam dele para o cache ARC.",
+    "defaultHeading": "Configuração padrão",
+    "headerParam": "Parâmetro",
+    "headerValue": "Valor padrão",
+    "defaultRowsRich": [
+      {
+        "param": "Tipo de máquina",
+        "valueRich": "<code>q35</code>"
+      },
+      {
+        "param": "BIOS",
+        "valueRich": "OVMF (UEFI)<note> — SeaBIOS para OpenMediaVault</note>"
+      },
+      {
+        "param": "Tipo CPU",
+        "valueRich": "Host"
+      },
+      {
+        "param": "Núcleos",
+        "valueRich": "2"
+      },
+      {
+        "param": "RAM",
+        "valueRich": "8192 MB<note> — 4096 MB para ZimaOS</note>"
+      },
+      {
+        "param": "Ponte",
+        "valueRich": "<code>vmbr0</code>"
+      },
+      {
+        "param": "Endereço MAC",
+        "valueRich": "Gerado automaticamente"
+      },
+      {
+        "param": "Iniciar após a conclusão",
+        "valueRich": "Não"
+      }
+    ],
+    "advancedHeading": "Configuração avançada",
+    "advancedIntro": "O assistente avançado expõe cada parâmetro individualmente:",
+    "headerOptions": "Opções",
+    "advancedRowsRich": [
+      {
+        "param": "Tipo de máquina",
+        "optionsRich": "<code>q35</code> ou <code>i440fx</code>"
+      },
+      {
+        "param": "BIOS",
+        "optionsRich": "OVMF (UEFI) ou SeaBIOS (Legado)"
+      },
+      {
+        "param": "Tipo CPU",
+        "optionsRich": "Host, KVM64 e outros modelos de CPU da lista (ZimaOS: Host ou KVM64)"
+      },
+      {
+        "param": "Núcleos",
+        "optionsRich": "Número de núcleos CPU"
+      },
+      {
+        "param": "RAM",
+        "optionsRich": "Memória atribuída ao VM"
+      },
+      {
+        "param": "Ponte",
+        "optionsRich": "Ponte de rede"
+      },
+      {
+        "param": "Endereço MAC",
+        "optionsRich": "MAC personalizado"
+      },
+      {
+        "param": "VLAN",
+        "optionsRich": "Marca VLAN (opcional)"
+      },
+      {
+        "param": "MTU",
+        "optionsRich": "Tamanho MTU"
+      }
+    ],
+    "zfsCalloutTitle": "ZFS e RAM",
+    "zfsCalloutBody": "TrueNAS SCALE/CORE e XigmaNAS utilizam ZFS, cuja cache ARC beneficia da RAM. O TrueNAS precisa de pelo menos 8 GB para uso básico; 16 GB ou mais ajudam com serviços e aplicações exigentes. Dimensione segundo a distribuição e a carga: 8 GB não é um mínimo universal do ZFS. Configurações leves OMV, Rockstor ou ZimaOS podem precisar de menos."
+  },
+  "storagePlan": {
+    "heading": "Plano de armazenamento",
+    "intro": "Após o CPU / RAM, o ProxMenux abre o menu Plano de Armazenamento, onde você pode combinar discos virtuais, discos importados e dispositivos de passagem PCI no mesmo VM, adicionando itens um de cada vez e terminando quando terminar.",
+    "virtualHeading": "a. Adicionar disco virtual",
+    "virtualItemsRich": [
+      "Lista os volumes de armazenamento Proxmox disponíveis na máquina.",
+      "Você escolhe o armazenamento de destino e o tamanho em GB.",
+      "O disco utiliza o bus escolhido: SCSI (predefinido), SATA, VirtIO ou IDE (ZimaOS: SCSI ou SATA). SATA tem seis posições numeradas de 0 a 5: <code>sata0</code>, <code>sata1</code>, …."
+    ],
+    "importHeading": "b. Adicionar disco de importação",
+    "importItemsRich": [
+      "Detecta discos físicos que são seguros de importar (sistema e discos protegidos estão escondidos).",
+      "Você seleciona um ou mais discos através de uma lista de verificação.",
+      "Os discos importados utilizam o bus escolhido e são ligados através de <code>qm set</code>."
+    ],
+    "pciHeading": "c. Adicionar Controlador ou NVMe (passagem PCI)",
+    "pciItemsRich": [
+      "Deteta HBA SATA/SAS e dispositivos NVMe e permite atribuir um <em>controlador completo</em> à VM. O IOMMU tem de estar ativo; o script oferece a ativação e um reinício se necessário.",
+      "Um passo de confirmação avisa sobre o risco de todo o controlador (o cartão inteiro, incluindo cada disco nele, deixa o host).",
+      "Os dispositivos PCI são atribuídos com comandos como <code>qm set VMID --hostpci0 PCI_ADDRESS,pcie=1</code>. Substitua VMID e PCI_ADDRESS pelo ID da VM e endereço PCI e utilize um índice hostpci livre para cada dispositivo."
+    ],
+    "resetCalloutTitle": "Repor e terminar",
+    "resetCalloutBodyRich": "O menu oferece <strong>r</strong> para repor a seleção e recomeçar e <strong>d</strong> para terminar e continuar. Não é possível terminar com um plano vazio."
+  },
+  "gpu": {
+    "heading": "Passagem de GPU opcional",
+    "bodyRich": "Após o plano de armazenamento, se um GPU compatível for detectado no host, o ProxMenux oferece para lançar o assistente de passagem GPU. Veja <link>Adicionar GPU a um VM (Passthrough)</link> para como o assistente funciona — pode ser necessário reiniciar uma máquina."
+  },
+  "autoFeatures": {
+    "heading": "Recursos automáticos VM",
+    "efiTitle": "Disco EFI",
+    "efiBody": "Quando OVMF (UEFI) é selecionado, ProxMenux cria automaticamente um disco 4 MB EFI no armazenamento que você escolher, formatado para corresponder ao tipo de armazenamento (raw para armazenamento baseado em diretório).",
+    "isoTitle": "Montagem ISO",
+    "isoBodyRich": "A instalação ISO é baixada (se necessário) e anexada ao <code>ide2</code> como um CD-ROM, pronto para a primeira inicialização.",
+    "guestTitle": "QEMU Agente convidado",
+    "guestBody": "O canal de agente convidado está habilitado na configuração VM. Você ainda precisa instalar o agente dentro do convidado depois que o NAS OS estiver pronto."
+  },
+  "endToEnd": {
+    "heading": "O que o script faz de ponta a ponta",
+    "itemsRich": [
+      "Detecta e baixa a ISO estável mais recente (ou usa a versão de retrocesso se o upstream for inacessível).",
+      "Aplica o padrão ou avançado CPU / RAM / BIOS / tipo de máquina.",
+      "Abre o plano de armazenamento e liga os discos virtuais selecionados, discos importados e dispositivos PCI.",
+      "Cria um disco EFI se o UEFI estiver selecionado.",
+      "Monta a instalação ISO em <code>ide2</code>.",
+      "Define a ordem de arranque: primeiro disco, depois ISO.",
+      "Habilita o canal QEMU Guest Agent.",
+      "Opcionalmente executa o assistente de passagem GPU.",
+      "Gera uma descrição HTML com estilo anexada ao VM.",
+      "Inicia o VM se você escolher."
+    ]
+  },
+  "perSystem": {
+    "heading": "Notas por sistema",
+    "shellLabel": "Interface de shell",
+    "webLabel": "Interface Web"
+  },
+  "systems": {
+    "truenasScale": {
+      "id": "truenas-scale",
+      "title": "TrueNAS SCALE",
+      "icon": "Database",
+      "officialName": "TrueNAS SCALE",
+      "officialUrl": "https://www.truenas.com/truenas-scale/",
+      "description": "TrueNAS baseado em Debian com aplicações Docker nas versões atuais, Linux KVM e ZFS como sistema de ficheiros principal. As versões antigas SCALE usavam Kubernetes. Combina armazenamento ZFS e um ecossistema de contentores.",
+      "specs": [
+        "Interface aconselhada: SATA ou SCSI, ambas com suporte de discard/TRIM",
+        "RAM: 8 GB (16 GB+ recomendado para cargas de trabalho reais)",
+        "Mínimo de núcleos CPU: 2 (4 ou mais aconselhados)",
+        "Recomenda-se a inicialização UEFI (OVMF)",
+        "Adaptador de rede VirtIO para melhor rendimento"
+      ],
+      "shellImg": "/vm/truenas/truenas-scale-shell.png",
+      "webImg": "/vm/truenas/truenas-scale-web.png",
+      "shellAlt": "Interface de shell TrueNAS SCALE",
+      "webAlt": "Interface Web TrueNAS SCALE"
+    },
+    "truenasCore": {
+      "id": "truenas-core",
+      "title": "TrueNAS CORE",
+      "icon": "Database",
+      "officialName": "TrueNAS CORE",
+      "officialUrl": "https://www.truenas.com/truenas-core/",
+      "description": "TrueNAS baseado em FreeBSD, anteriormente FreeNAS, focado em ZFS. Jails, plugins e virtualização do CORE 13.3 estão obsoletos e sem suporte; o desenvolvimento atual concentra-se nas edições Linux.",
+      "specs": [
+        "Interface recomendada: SATA",
+        "Mínimo de RAM: 8 GB (16 GB ou mais aconselhados)",
+        "Mínimo de núcleos CPU: 2 (4 ou mais aconselhados)",
+        "Recomenda-se a inicialização UEFI (OVMF)",
+        "Adaptador de rede VirtIO para melhor rendimento"
+      ],
+      "shellImg": "/vm/truenas/truenas-core-shell.png",
+      "webImg": "/vm/truenas/truenas-core-web.png",
+      "shellAlt": "Interface de shell TrueNAS CORE",
+      "webAlt": "Interface Web CORE TrueNAS"
+    },
+    "openmediavault": {
+      "id": "openmediavault",
+      "title": "OpenMediaVault",
+      "icon": "Server",
+      "officialName": "openmediavault.org",
+      "officialUrl": "https://www.openmediavault.org",
+      "description": "NAS baseado em Debian com um sistema de plugin modular. Leve em recursos e fácil de executar em hardware modesto — uma escolha natural quando você não precisa de ZFS.",
+      "specs": [
+        "Interface recomendada: SATA ou VirtIO",
+        "Mínimo de RAM: 2 GB (4 GB ou mais aconselhados)",
+        "Mínimo de núcleos CPU: 1 (2 ou mais aconselhados)",
+        "BIOS: ProxMenux por omissão para SeaBIOS para OMV (substituir em Avançado, se necessário)",
+        "Adaptador de rede VirtIO para melhor rendimento"
+      ],
+      "shellImg": "/vm/openmediavault/openmediavault-shell.png",
+      "webImg": "/vm/openmediavault/openmediavault-web.png",
+      "shellAlt": "Interface de shell OpenMediaVault",
+      "webAlt": "Interface Web OpenMediaVault"
+    },
+    "xigmanas": {
+      "id": "xigmanas",
+      "title": "XigmaNAS",
+      "icon": "Database",
+      "officialName": "xigmanas.com",
+      "officialUrl": "https://www.xigmanas.com",
+      "description": "NAS baseado em FreeBSD — a continuação direta da base de código original FreeNAS (0.7). Focado em ZFS e simplicidade, com uma pegada mais leve do que TrueNAS.",
+      "specs": [
+        "Interface recomendada: SATA ou SCSI",
+        "RAM: 4 GB (8 GB+ recomendado para ZFS)",
+        "Núcleos mínimos CPU: 2",
+        "Recomenda-se a inicialização UEFI (OVMF)",
+        "Adaptador de rede VirtIO para melhor rendimento"
+      ]
+    },
+    "rockstor": {
+      "id": "rockstor",
+      "title": "Rockstor",
+      "icon": "HardDrive",
+      "officialName": "rockstor.com",
+      "officialUrl": "https://rockstor.com",
+      "description": "NAS baseado em openSUSE Leap e construído em torno de Btrfs. Snapshots, subvolumes e plataforma Rock-on com aplicações Docker para multimédia, partilha e cópias de segurança.",
+      "specs": [
+        "Interface recomendada: SATA ou VirtIO",
+        "Mínimo de RAM: 2 GB (4 GB ou mais aconselhados)",
+        "Núcleos mínimos CPU: 2",
+        "Recomenda-se a inicialização UEFI (OVMF)",
+        "Adaptador de rede VirtIO para melhor rendimento"
+      ],
+      "shellImg": "/vm/rockstor/rockstor-shell.png",
+      "webImg": "/vm/rockstor/rockstor-web.png",
+      "shellAlt": "Interface de shell Rockstor",
+      "webAlt": "Interface Web Rockstor"
+    },
+    "zimaos": {
+      "id": "zimaos",
+      "title": "ZimaOS",
+      "icon": "MonitorIcon",
+      "officialName": "zimaspace.com",
+      "officialUrl": "https://www.zimaspace.com/zimaos",
+      "description": "Sistema NAS/servidor doméstico leve construído com Buildroot, evoluído do CasaOS, para multimédia, aplicações Docker e domótica. O instalador ProxMenux próprio (vm/zimaos.sh) transfere uma imagem pronta e oferece configuração de CPU, RAM e armazenamento.",
+      "specs": [
+        "Interface recomendada: SATA ou VirtIO",
+        "RAM padrão: 4 GB (suficiente para aplicativos de mídia/self-hosted)",
+        "Núcleos mínimos CPU: 2",
+        "Arranque UEFI (OVMF)",
+        "Adaptador de rede VirtIO para melhor rendimento"
+      ]
+    },
+    "fygoos": {
+      "id": "fygoos",
+      "title": "FygoOS",
+      "icon": "Server",
+      "officialName": "fygonas.com",
+      "officialUrl": "https://fygonas.com",
+      "description": "Edição internacional do fnOS, um NAS baseado em Debian. O ProxMenux transfere a ISO mais recente de fygonas.com e monta-a na VM. O sistema ocupa um disco; o espaço restante pode alojar volumes para aplicações e ficheiros. Após instalar, a consola mostra a interface web na porta 5666, para onde a porta 80 redireciona. Abra-a para dar nome ao dispositivo e criar a conta de administrador.",
+      "specs": [
+        "Disco do sistema: FygoOS propõe uma partição do sistema 64 GB, que pode ser menor em um VM",
+        "Instalação: Graphical Install, ou Rescuing Install se o modo gráfico falhar",
+        "Iniciar UEFI (OVMF) sem chaves de inicialização seguras, como o instalador requer",
+        "Rede: Ethernet com DHCP por padrão",
+        "Adaptador de rede VirtIO para melhor rendimento"
+      ]
+    }
+  },
+  "related": {
+    "heading": "Relacionado",
+    "itemsRich": [
+      {
+        "href": "/docs/create-vm/system-nas",
+        "label": "Visão geral do sistema NAS",
+        "tail": " — comparação rápida entre todas as opções do NAS."
+      },
+      {
+        "href": "/docs/create-vm/system-nas/synology",
+        "label": "VM Synology",
+        "tail": " — processo Synology DSM (Xpenology)."
+      },
+      {
+        "href": "/docs/disk-manager/import-disk-vm",
+        "label": "Importar disco para VM",
+        "tail": " — recomendado para casos de uso do NAS (discos reais > discos virtuais)."
+      },
+      {
+        "href": "/docs/help-info/zfs-commands",
+        "label": "Comandos de gerenciamento ZFS",
+        "tail": " — se escolher TrueNAS ou outra distribuição com suporte ZFS."
+      },
+      {
+        "href": "/docs/create-vm",
+        "label": "Visão geral da criação de VM",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/pt/docs/create-vm/system-windows.json b/web/messages/pt/docs/create-vm/system-windows.json
new file mode 100644
index 00000000..d3319fee
--- /dev/null
+++ b/web/messages/pt/docs/create-vm/system-windows.json
@@ -0,0 +1,259 @@
+{
+  "meta": {
+    "title": "Criar VM: sistema Windows | Documentação ProxMenux",
+    "description": "Crie e configure máquinas virtuais Windows no Proxmox VE com o ProxMenux. ISO por UUP Dump ou ficheiro local, configuração predefinida ou avançada, plano de armazenamento comum, passthrough GPU opcional, TPM 2.0 e instalação de controladores VirtIO.",
+    "ogTitle": "Criar VM: sistema Windows | Documentação ProxMenux",
+    "ogDescription": "Crie VMs do Windows em Proxmox VE com ProxMenux. UUP Dump ou ISO local, plano de armazenamento unificado, passagem opcional GPU, TPM 2.0 e VirtIO.",
+    "ogImageAlt": "Menu ProxMenux Windows VM"
+  },
+  "header": {
+    "title": "Criar VM: sistema Windows",
+    "description": "Crie uma VM Windows no Proxmox VE. O ProxMenux gere a escolha da ISO (UUP Dump ou local), CPU, RAM, tipo de máquina, plano de armazenamento comum, passthrough GPU opcional, TPM 2.0 e instalação dos controladores VirtIO.",
+    "section": "Máquinas Virtuais"
+  },
+  "intro": {
+    "title": "O que este script faz",
+    "body": "O percurso Windows pergunta a origem da ISO: UUP Dump ou cópia local em <code>/var/lib/vz/template/iso</code>. Inicia depois o assistente comum de VM com predefinições para Windows: <code>q35</code>, OVMF e TPM 2.0. A ISO dos controladores VirtIO é ligada como segundo CD-ROM e a VM fica pronta para iniciar o instalador Windows."
+  },
+  "image": {
+    "alt": "ProxMenux Opções de instalação do Windows",
+    "caption": "Opções de instalação do Windows"
+  },
+  "config": {
+    "heading": "Configuração padrão vs avançada",
+    "intro": "Depois que a ISO é selecionada, ProxMenux pergunta se deve usar o perfil padrão VM ou abrir o assistente avançado. O perfil padrão está sintonizado para as edições modernas do Windows desktop e servidor.",
+    "defaultHeading": "Configuração padrão",
+    "headerParam": "Parâmetro",
+    "headerValue": "Valor padrão",
+    "defaultRows": [
+      {
+        "param": "Tipo de máquina",
+        "valueRich": "<code>q35</code>"
+      },
+      {
+        "param": "BIOS",
+        "value": "OVMF (UEFI)"
+      },
+      {
+        "param": "Tipo CPU",
+        "value": "Host"
+      },
+      {
+        "param": "Núcleos",
+        "value": "4"
+      },
+      {
+        "param": "RAM",
+        "value": "8192 MB"
+      },
+      {
+        "param": "Ponte",
+        "valueRich": "<code>vmbr0</code>"
+      },
+      {
+        "param": "Endereço MAC",
+        "value": "Gerado automaticamente"
+      },
+      {
+        "param": "TPM",
+        "value": "Activado (v2.0)"
+      },
+      {
+        "param": "Iniciar após a conclusão",
+        "value": "Não"
+      }
+    ],
+    "advancedHeading": "Configuração avançada",
+    "advancedIntro": "O assistente avançado apresenta cada definição separadamente:",
+    "headerOptions": "Opções",
+    "advancedRows": [
+      {
+        "param": "Tipo de máquina",
+        "optionsRich": "<code>q35</code> ou <code>i440fx</code>"
+      },
+      {
+        "param": "BIOS",
+        "options": "OVMF (UEFI) ou SeaBIOS (Legado)"
+      },
+      {
+        "param": "Tipo CPU",
+        "options": "Host, KVM64 e outros modelos de CPU da lista"
+      },
+      {
+        "param": "Núcleos",
+        "options": "Número de núcleos CPU"
+      },
+      {
+        "param": "RAM",
+        "options": "Memória atribuída à VM"
+      },
+      {
+        "param": "Ponte",
+        "options": "Ponte de rede"
+      },
+      {
+        "param": "Endereço MAC",
+        "options": "MAC personalizado"
+      },
+      {
+        "param": "VLAN",
+        "options": "Marca VLAN (opcional)"
+      },
+      {
+        "param": "MTU",
+        "options": "Tamanho MTU"
+      },
+      {
+        "param": "TPM",
+        "options": "O TPM 2.0 é adicionado automaticamente para Windows; o assistente não permite ativá-lo ou desativá-lo."
+      }
+    ],
+    "tpmWarnTitle": "Os requisitos TPM dependem da edição Windows",
+    "tpmWarnBody": "O Windows 11 normalmente exige TPM 2.0. O Windows Server 2022 exige-o para certas funções de segurança, não para todas as instalações. O ProxMenux adiciona um TPM virtual para Windows; o assistente avançado não permite desativá-lo."
+  },
+  "storagePlan": {
+    "heading": "Plano de armazenamento",
+    "body": "Depois de CPU / RAM, ProxMenux abre o <strong>Plano de armazenamento</strong> menu, onde você pode combinar discos virtuais, discos importados e dispositivos de passagem PCI no mesmo VM, adicionando itens um de cada vez e terminando quando você terminar.",
+    "virtualDiskTitle": "a. Adicionar disco virtual",
+    "virtualDiskItems": [
+      "Lista os volumes de armazenamento Proxmox disponíveis na máquina.",
+      "Você escolhe o armazenamento de destino e o tamanho em GB.",
+      "O disco utiliza o bus escolhido: SCSI (predefinido), SATA, VirtIO ou IDE. SATA tem seis posições numeradas de 0 a 5: <code>sata0</code>, <code>sata1</code>, …."
+    ],
+    "importDiskTitle": "b. Adicionar disco de importação",
+    "importDiskItems": [
+      "Detecta discos físicos que são seguros de importar (sistema e discos protegidos estão escondidos).",
+      "Você seleciona um ou mais discos através de uma lista de verificação.",
+      "Os discos importados utilizam o bus escolhido e são ligados através de <code>qm set</code>."
+    ],
+    "pciTitle": "c. Adicionar Controlador ou NVMe (passagem PCI)",
+    "pciItems": [
+      "Deteta HBA SATA/SAS e dispositivos NVMe e permite atribuir um <em>controlador completo</em> à VM. O IOMMU tem de estar ativo; o script oferece a ativação e um reinício se necessário.",
+      "Um passo de confirmação avisa sobre o risco de todo o controlador (o cartão inteiro, incluindo cada disco nele, deixa o host).",
+      "Os dispositivos PCI são atribuídos com comandos como <code>qm set VMID --hostpci0 PCI_ADDRESS,pcie=1</code>. Substitua VMID e PCI_ADDRESS pelo ID da VM e endereço PCI e utilize um índice hostpci livre para cada dispositivo."
+    ],
+    "resetTitle": "Repor e terminar",
+    "resetBody": "O menu oferece <strong>r</strong> para repor a seleção e recomeçar e <strong>d</strong> para terminar e continuar. Não é possível terminar com um plano vazio."
+  },
+  "gpu": {
+    "heading": "Passagem de GPU opcional",
+    "body": "Após o plano de armazenamento, se um GPU compatível é detectado no host ProxMenux oferece para lançar o assistente de passagem GPU. Veja <gpuLink>Adicionar GPU a um VM (Passthrough)</gpuLink> para como o assistente funciona — pode ser necessário reiniciar uma máquina."
+  },
+  "autoFeatures": {
+    "heading": "Recursos automáticos VM",
+    "efiTitle": "Disco EFI",
+    "efiBody": "Quando o OVMF (UEFI) é selecionado, ProxMenux cria um disco de sistema 4 MB EFI no armazenamento que você escolhe e o liga ao VM para que o firmware UEFI tenha um lugar para armazenar suas variáveis.",
+    "tpmTitle": "TPM 2.0",
+    "tpmBody": "O ProxMenux adiciona um dispositivo TPM 2.0 virtual às VM Windows. Cumpre o requisito TPM do Windows 11 e suporta funções do Windows Server que dependem de TPM.",
+    "isoTitle": "Montagem ISO",
+    "isoBody": "A ISO de instalação é ligada a <code>ide2</code>. A ISO dos controladores VirtIO é transferida se necessário e ligada a <code>ide3</code>, pronta para o passo <em>Carregar controlador</em>.",
+    "guestTitle": "QEMU Agente convidado",
+    "guestBody": "O canal de agente convidado está habilitado na configuração VM. O próprio agente é instalado dentro do Windows executando <code>virtio-win-guest-tools.exe</code> após a configuração."
+  },
+  "installOptions": {
+    "heading": "Opções de instalação do Windows",
+    "intro": "ProxMenux oferece dois métodos para obter os meios de instalação do Windows:",
+    "uupTitle": "Criador de ISO do UUP Dump",
+    "uupLogoAlt": "Logótipo UUP Dump",
+    "uupBody": "O script <strong>UUP Dump ISO Creator</strong> é um utilitário ProxMenux que constrói uma ISO do Windows em tempo real a partir dos servidores de atualização do Windows da Microsoft. Ele puxa arquivos de instalação oficiais limpos (incluindo Insider Preview builds).",
+    "uupItems": [
+      "Acesso às versões mais recentes do Windows.",
+      "Suporta versões do Insider Preview.",
+      "Ficheiros de instalação Microsoft oficiais e não modificados.",
+      "Criação e montagem automática de ISO no VM.",
+      "Suporta edições Home, Pro e Enterprise."
+    ],
+    "uupLearnMore": "Saiba mais sobre UUP Dump ISO Creator",
+    "localTitle": "Instalar com ISO local",
+    "localBody": "Utiliza uma ISO do Windows que você já enviou para o armazenamento local do host (<code>/var/lib/vz/template/iso</code>). O script lista todos os ISO não-VirtIO que encontrar e permite que você escolha um.",
+    "localImageAlt": "Menu de seleção ISO local",
+    "localImageCaption": "Menu de seleção ISO local"
+  },
+  "endToEnd": {
+    "heading": "O que o script faz de ponta a ponta",
+    "items": [
+      "Obtém a ISO do Windows (UUP Dump build ou cópia local).",
+      "Aplica a configuração padrão ou avançada CPU / RAM / BIOS / tipo de máquina.",
+      "Abre o plano de armazenamento e liga os discos virtuais selecionados, discos importados e dispositivos PCI.",
+      "Cria o disco EFI nas instalações UEFI e liga o dispositivo TPM 2.0.",
+      "Monta a ISO do Windows em <code>ide2</code>.",
+      "Transfere a ISO dos controladores VirtIO e monta-a em <code>ide3</code>.",
+      "Define a ordem de arranque: primeiro disco, depois ISO.",
+      "Habilita o canal QEMU Guest Agent.",
+      "Opcionalmente executa o assistente de passagem GPU.",
+      "Gera uma descrição HTML com estilo anexada ao VM.",
+      "Inicia a VM se tiver escolhido essa opção."
+    ]
+  },
+  "virtio": {
+    "heading": "Drivers VirtIO durante a instalação",
+    "body": "O criador de VM utiliza por predefinição discos SCSI com controlador VirtIO SCSI e um adaptador de rede VirtIO. Uma ISO Windows padrão pode precisar dos respetivos controladores da ISO VirtIO montada em <code>ide3</code>. Os discos SATA normalmente funcionam com os controladores incluídos no Windows; escolher SATA não altera o adaptador de rede VirtIO.",
+    "warnTitle": "Carregue o controlador de rede VirtIO se o Windows não tiver rede",
+    "warnBody": "A VM utiliza um adaptador de rede VirtIO (<code>virtio</code>). Se o Windows não incluir o controlador, carregue-o durante a instalação para obter acesso à rede. Caso contrário, a ativação e o Windows Update podem não estar disponíveis no primeiro arranque.",
+    "stepLabel": "Etapa",
+    "steps": [
+      {
+        "title": "Acesse a tela \"Onde você deseja instalar o Windows?\"",
+        "body": "Durante a configuração do Windows, se nenhum disco for mostrado, o driver de armazenamento para sua interface selecionada (SCSI ou VirtIO) ainda não está carregado. Carregue-o manualmente da ISO VirtIO.",
+        "img": "/vm/windows/virtio-step-1.png",
+        "caption": "Configuração do Windows sem discos mostrados"
+      },
+      {
+        "title": "Clique em \"Carregar driver\"",
+        "bodyRich": "Clique em <strong>Carregar controlador</strong>, abra a ISO VirtIO montada e escolha o controlador de armazenamento correspondente à interface selecionada.",
+        "img": "/vm/windows/virtio-step-2.png",
+        "caption": "Clique em Carregar controlador para abrir a ISO VirtIO"
+      },
+      {
+        "title": "Navegue para a pasta correta do driver",
+        "bodyRich": "Na ISO VirtIO escolha <code>vioscsi</code> para o controlador VirtIO SCSI ou <code>viostor</code> para discos de blocos VirtIO. Escolha depois a subpasta da versão Windows e arquitetura.",
+        "img": "/vm/windows/virtio-step-3.png",
+        "caption": "Navegue para a pasta apropriada do driver"
+      },
+      {
+        "title": "Selecione o driver",
+        "bodyRich": "O Windows lista os drivers disponíveis. Escolha o que corresponde à sua configuração (tipicamente <strong>Red Hat VirtIO controlador SCSI</strong>) e clique em <strong>Next</strong>.",
+        "img": "/vm/windows/virtio-step-4.png",
+        "caption": "Selecione o driver VirtIO que corresponde à sua interface de disco"
+      },
+      {
+        "title": "(Opcional) Instalar o controlador de rede",
+        "bodyRich": "Se você também escolheu VirtIO como a interface de rede, carregue o driver de rede da pasta <code>NetKVM</code> da mesma ISO, selecionando a subpasta para sua versão do Windows. Sem esta etapa, o Windows instala sem acesso à Internet.",
+        "img": "/vm/windows/virtio-step-5.png",
+        "caption": "Carregar o driver de rede VirtIO para permitir a internet durante a instalação"
+      }
+    ],
+    "tipTitle": "Pós-instalação: executar virtio-win-guest-tools.exe",
+    "tipBody": "Após instalar o Windows, abra a ISO VirtIO no Explorador de Ficheiros e execute <code>virtio-win-guest-tools.exe</code>. Instala os restantes controladores (rede, ecrã, entrada, ballooning) e o agente convidado QEMU numa só operação."
+  },
+  "related": {
+    "heading": "Relacionado",
+    "items": [
+      {
+        "href": "/docs/utils/UUp-Dump-ISO-Creator",
+        "label": "Criador de ISO do UUP Dump",
+        "tail": " — gerar ISOs de instalação atualizadas do Windows no host Proxmox."
+      },
+      {
+        "href": "/docs/disk-manager/import-disk-image-vm",
+        "label": "Importar imagem de disco para VM",
+        "tail": " — importar uma imagem de disco Windows existente (.vmdk, .qcow2, .img ou .raw) para uma VM existente; converter primeiro as imagens .vhdx num formato suportado."
+      },
+      {
+        "href": "/docs/hardware/gpu-vm-passthrough",
+        "label": "Adicionar GPU à VM (Passthrough)",
+        "tail": " — para as VM do Windows com GPU acelerado por hardware."
+      },
+      {
+        "href": "/docs/help-info/vm-ct-commands",
+        "label": "Comandos de gestão VM e CT",
+        "tail": " — referência qm CLI."
+      },
+      {
+        "href": "/docs/create-vm",
+        "label": "Visão geral da criação de VM",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/pt/docs/disk-manager/add-controller-nvme-vm.json b/web/messages/pt/docs/disk-manager/add-controller-nvme-vm.json
new file mode 100644
index 00000000..35712be7
--- /dev/null
+++ b/web/messages/pt/docs/disk-manager/add-controller-nvme-vm.json
@@ -0,0 +1,128 @@
+{
+  "meta": {
+    "title": "Adicionar controlador ou NVMe a uma VM | Documentação ProxMenux",
+    "description": "Atribua um controlador de armazenamento SATA/SAS HBA ou dispositivo NVMe a uma VM Proxmox por passthrough PCI com o ProxMenux. A ferramenta trata da ativação do IOMMU, deteta conflitos e configura a atribuição com qm set --hostpci.",
+    "ogTitle": "Adicionar controlador ou NVMe a uma VM | Documentação ProxMenux",
+    "ogDescription": "Atribua um HBA SATA/SAS completo ou um dispositivo NVMe a uma VM Proxmox. O ProxMenux trata do IOMMU, da deteção de conflitos e da atribuição hostpci."
+  },
+  "header": {
+    "title": "Adicionar controlador ou NVMe a uma VM",
+    "description": "Atribua um adaptador de barramento SATA/SAS completo (HBA) ou dispositivo NVMe a uma VM Proxmox por passthrough PCI. O ProxMenux verifica o IOMMU e ativa-o com o seu consentimento, lista os dispositivos elegíveis, exclui conflitos e configura a atribuição com qm set --hostpci.",
+    "section": "Gerenciador de disco · VM"
+  },
+  "intro": {
+    "title": "O que isto faz (e não faz)",
+    "body": "Trata-se de <strong>passthrough ao nível do dispositivo</strong>: a placa PCIe deixa de estar sob controlo do kernel do host e é associada a <code>vfio-pci</code>. A VM vê o próprio controlador, em vez de discos atribuídos individualmente, e carrega o controlador de software para esse modelo. Todos os discos ligados seguem automaticamente, com dados SMART nativos, todas as funções do firmware e sem uma camada Proxmox intermédia."
+  },
+  "howRuns": {
+    "heading": "Como o script é executado",
+    "body": "O fluxo tem duas fases com separação clara entre \"coletar informações, verificar IOMMU e listar candidatos\" e \"realmente anexar o dispositivo PCI\". Até a confirmação final nada é escrito para a configuração VM."
+  },
+  "iommu": {
+    "heading": "Grupos IOMMU: por que é necessário considerar a placa inteira",
+    "body": "O limite de isolamento do passthrough PCI é o <strong>grupo IOMMU</strong>, a menor unidade que o IOMMU da CPU consegue isolar. Os dispositivos do mesmo grupo não podem ser isolados entre si. Se um controlador SATA partilhar o grupo com um controlador USB, o passthrough SATA pode exigir libertar também o USB do host ou ser impossível. Não atribui automaticamente à VM todos os dispositivos do grupo.",
+    "outro": "O ProxMenux mostra o grupo IOMMU ao lado de cada dispositivo e avisa quando um grupo carrega mais do que o controlador que deseja. Você ainda pode prosseguir se os dispositivos extras do grupo são aceitáveis (todos os controladores de disco, por exemplo), ou voltar se eles não forem."
+  },
+  "prereqs": {
+    "heading": "Pré-requisitos",
+    "items": [
+      "<strong>A CPU e a placa-mãe suportam</strong> VT-d (Intel) ou AMD-Vi, e a função está ativa no firmware (BIOS/UEFI). O ProxMenux pode ativar a parte do kernel, mas não alterar a definição do firmware.",
+      "A VM de destino está <strong>desligada</strong> antes de ligar dispositivos PCI.",
+      "O controlador/NVMe <strong> não é aquele que detém o sistema de arquivos raiz Proxmox</strong>. O script esconde qualquer coisa em uso pela máquina.",
+      "O sistema operativo convidado tem os controladores de software para o modelo do controlador. O Linux suporta praticamente todos os HBA de origem; o Windows precisa do controlador do fabricante instalado <em>antes</em> de arrancar com o dispositivo atribuído."
+    ],
+    "warnTitle": "A migração ao vivo não é possível",
+    "warnBody": "Um VM com passagem PCI está ligado ao nó que detém fisicamente o cartão. A migração ao vivo nos nós irá falhar. Planeje backups/replicação em conformidade."
+  },
+  "steps": {
+    "heading": "Passo a passo",
+    "stepLabel": "Etapa",
+    "list": [
+      {
+        "title": "Escolher a VM de destino",
+        "bodyRich": "ProxMenux lê <code>qm list</code> e mostra cada VM. Escolha o que receberá o controlador.",
+        "img": "/disk/nvme-passthrough/vm-selection.png",
+        "alt": "Diálogo de seleção do VM",
+        "caption": "Diálogo de seleção do VM"
+      },
+      {
+        "title": "Verificação IOMMU",
+        "bodyRich": "Se o IOMMU não estiver habilitado na linha cmdline do kernel, o ProxMenux oferece para habilitá-lo. Ele edita <code>/etc/kernel/cmdline</code> (para systemd-boot) ou <code>/etc/default/grub</code> (para GRUB) e adiciona o parâmetro correto para o seu CPU:",
+        "items": [
+          "<code>intel_iommu=on</code> para CPUs Intel.",
+          "<code>amd_iommu=on</code> para CPUs AMD."
+        ],
+        "outro": "Uma reinicialização é necessária após esta alteração. O script pede que você reinicie agora ou mais tarde; a passagem não pode continuar até que o novo kernel cmdline esteja ativo.",
+        "img": "/disk/nvme-passthrough/iommu-warning.png",
+        "alt": "Diálogo IOMMU necessário",
+        "caption": "IOMMU Necessário — oferta para ativar e reiniciar"
+      },
+      {
+        "title": "Enumeração do dispositivo",
+        "body": "ProxMenux lista cada controlador de armazenamento (SATA / SAS HBA) e cada dispositivo NVMe no barramento PCI. Para cada dispositivo, mostra:",
+        "items": [
+          "Endereço PCI (<code>00:17.0</code>, <code>01:00.0</code>, ...).",
+          "Descrição do fornecedor / dispositivo.",
+          "Grupo IOMMU, com um aviso ⚠ se for partilhado com outros dispositivos não relacionados.",
+          "Os discos atualmente por trás do controlador (então você sabe o que irá segui-lo para o VM)."
+        ],
+        "img": "/disk/nvme-passthrough/device-list.png",
+        "alt": "Controlador / enumeração do dispositivo NVMe",
+        "caption": "Controlador / NVMe enumeração do dispositivo com informações do grupo IOMMU"
+      },
+      {
+        "title": "Detecção de conflitos",
+        "bodyRich": "O script bloqueia dispositivos claramente inseguros: já atribuídos a outra VM através de <code>hostpci</code> na respetiva configuração, utilizados pelo host como o controlador do disco raiz, ou num grupo IOMMU cujos outros membros não consegue identificar com segurança. Os dispositivos elegíveis ficam disponíveis para seleção.",
+        "img": "/disk/nvme-passthrough/conflict-warning.png",
+        "alt": "Aviso de detecção de conflitos",
+        "caption": "Detecção de conflitos — dispositivo bloqueado com razão"
+      },
+      {
+        "title": "Anexar e finalizar",
+        "bodyRich": "Para cada dispositivo selecionado ProxMenux roda <code>qm set &lt;VMID&gt; --hostpciN &lt;pci-addr&gt;,pcie=1</code>, escolhendo o próximo slot livre <code>hostpci</code>. Se IOMMU foi habilitado durante esta sessão você é lembrado para reiniciar antes de iniciar o VM.",
+        "img": "/disk/nvme-passthrough/assignment.png",
+        "alt": "Resumo da atribuição",
+        "caption": "Resumo da atribuição — slots hostpciN e endereços PCI anexados"
+      }
+    ]
+  },
+  "manual": {
+    "heading": "Equivalente manual"
+  },
+  "troubleshoot": {
+    "heading": "Resolução de Problemas",
+    "noGroupsTitle": "IOMMU activado, mas sem grupos sob /sys/kernel/iommu_groups/",
+    "noGroupsBody": "É necessário reiniciar para que a linha cmdline do kernel faça efeito. Se os grupos ainda estiverem faltando após o reinício, o VT-d / AMD-Vi provavelmente estará desativado no firmware — verifique a configuração BIOS/UEFI.",
+    "busyTitle": "A VM não inicia: \"hostpciN: device busy\"",
+    "busyBody": "Outro processo mantém o dispositivo PCI ocupado. As causas mais comuns são uma VM que falhou sem o libertar ou o kernel do host que o recuperou no último arranque. Execute <code>lspci -nnk -s &lt;addr&gt;</code> para ver o controlador de software associado; deve ser <code>vfio-pci</code>. Um reinício completo do host costuma resolver o problema.",
+    "noDisksTitle": "Convidado vê o controlador, mas não os discos",
+    "noDisksBody": "Falta no sistema convidado o controlador de software para esse modelo. No Linux é raro, mas acontece no Windows: instale o controlador do fabricante, por exemplo LSI/Broadcom para HBA SAS antigos, com a placa não atribuída, e reinicie depois de a atribuir.",
+    "sharedTitle": "O grupo IOMMU inclui um dispositivo não relacionado",
+    "sharedBody": "Opções: (a) mover a placa para outra ranhura PCIe para alterar o grupo, (b) ativar <em>ACS override</em> no kernel para dividir grupos (compromisso de segurança: informe-se antes de aplicar), ou (c) escolher outra placa num grupo mais isolado."
+  },
+  "related": {
+    "heading": "Relacionado",
+    "items": [
+      {
+        "href": "/docs/disk-manager/import-disk-vm",
+        "label": "Importar disco para VM",
+        "tail": " — modelo alternativo: anexar um disco físico via Proxmox sem passagem PCIe completa."
+      },
+      {
+        "href": "/docs/hardware/gpu-vm-passthrough",
+        "label": "Adicionar GPU a uma VM (passthrough)",
+        "tail": " — os mesmos conceitos IOMMU / VFIO aplicados a um GPU."
+      },
+      {
+        "href": "/docs/help-info/gpu-commands",
+        "label": "Comandos de passagem GPU",
+        "tail": " — Os comandos de verificação IOMMU também se aplicam à passagem do controlador / NVMe."
+      },
+      {
+        "href": "/docs/disk-manager",
+        "label": "Visão geral do Gerenciador de Discos",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/pt/docs/disk-manager/format-disk.json b/web/messages/pt/docs/disk-manager/format-disk.json
new file mode 100644
index 00000000..b3d1ed08
--- /dev/null
+++ b/web/messages/pt/docs/disk-manager/format-disk.json
@@ -0,0 +1,142 @@
+{
+  "meta": {
+    "title": "Formatar ou apagar um disco físico | Documentação ProxMenux",
+    "description": "Apague e formate discos físicos no Proxmox VE com o ProxMenux. Quatro modos, filtros rigorosos que bloqueiam discos de sistema, montados ou em uso e confirmação dupla com introdução do caminho completo.",
+    "ogTitle": "Formatar ou apagar um disco físico | Documentação ProxMenux",
+    "ogDescription": "Limpar ou formatar com segurança um disco físico no Proxmox. Regras de visibilidade seguras, modos de operação 4, dupla confirmação."
+  },
+  "header": {
+    "title": "Formatar ou apagar um disco físico",
+    "description": "Limpar ou formatar com segurança um disco físico no host Proxmox. ProxMenux só mostra discos totalmente livres (sem uso do sistema, sem referência de convidado, sem montagens) e força uma confirmação dupla — sim/não mais digitando o caminho do disco completo — antes de destruir quaisquer dados.",
+    "section": "Gerenciador de disco · Utilitários"
+  },
+  "danger": {
+    "title": "Ferramenta destrutiva",
+    "body": "Cada operação aqui escreve para o disco. Não há nada a desfazer. ProxMenux aplica rigorosos filtros de segurança e confirmações, mas a responsabilidade pela escolha do disco certo é sua. Leia o caminho do disco em voz alta duas vezes antes de digitá-lo."
+  },
+  "howRuns": {
+    "heading": "Como o script é executado",
+    "body": "O fluxo tem duas fases com um filtro de segurança de porta tripla no meio. A lista de discos, o modo de operação e os detalhes do sistema de arquivos são todos coletados na Fase 1; nada é escrito até que a Fase 2 passe uma revalidação final logo antes de executar."
+  },
+  "visibility": {
+    "heading": "Regras de visibilidade",
+    "intro": "Antes mesmo do menu aparecer, o ProxMenux filtra a lista de discos. Apenas os candidatos que são comprovadamente seguros são mostrados:",
+    "items": [
+      "<strong>Mostrados</strong>: discos <em>não</em> utilizados pelo host (pool raiz, swap, montagens, ZFS/LVM/RAID ativos) e <em>não</em> referenciados em configurações de VM/LXC, em execução ou paradas.",
+      "<strong>Ocultos</strong>: discos do host e do sistema.",
+      "<strong>Ocultos</strong>: discos referenciados numa configuração VM/LXC."
+    ],
+    "safetyTitle": "Segurança na confirmação e execução",
+    "safetyItems": [
+      "Os discos com metadados antigos ou ativos mostram avisos detalhados <em>antes</em> da confirmação.",
+      "Os discos utilizados por uma VM <strong>em execução</strong> são <strong>bloqueados sem exceção</strong> na confirmação.",
+      "Os discos com partições montadas são <strong>bloqueados sem exceção</strong> na execução. Uma nova verificação é realizada imediatamente antes de qualquer escrita.",
+      "São sempre necessárias duas confirmações: um diálogo <em>sim/não</em> e a introdução exata do caminho completo do disco."
+    ]
+  },
+  "modes": {
+    "heading": "Modos de operação",
+    "intro": "Depois de escolher um disco você escolhe um dos quatro modos. Divergem no que destroem e no que deixam para trás.",
+    "headerMode": "Modo",
+    "headerPart": "Tabela de partições",
+    "headerData": "Dados",
+    "headerUseCase": "Caso de uso",
+    "rows": [
+      {
+        "mode": "1. Limpar tudo",
+        "part": "Destruído",
+        "data": "Assinaturas apagadas",
+        "useCase": "Remove a tabela de partições e os metadados de sistemas de ficheiros e RAID, preenche com zeros os primeiros e os últimos 16 MiB e, nas unidades que suportam discard, aplica TRIM a todo o disco. O resto dos dados não é sobrescrito e ainda pode ser recuperável num HDD; não é um apagamento seguro."
+      },
+      {
+        "mode": "2. Remover rótulos FS",
+        "part": "Preservado",
+        "data": "Preservado",
+        "useCase": "Remove assinaturas antigas de ZFS / LVM / RAID para evitar a utilização automática do disco. Os dados do utilizador não são sobrescritos em bloco, mas a remoção das assinaturas pode torná-los inacessíveis."
+      },
+      {
+        "mode": "3. Sobrescrever os dados com zeros",
+        "part": "Preservado",
+        "data": "Destruídos (sobrescritos com zeros)",
+        "useCase": "Sobrescreve com zeros as partições existentes, mantendo a tabela de partições. Não abrange espaço não atribuído nem áreas de reserva dos SSD; não garante a sanitização completa do dispositivo."
+      },
+      {
+        "mode": "4. Formato completo",
+        "part": "Novo GPT",
+        "data": "Destruído",
+        "useCase": "Disco pronto a usar com uma nova partição e um novo sistema de ficheiros."
+      }
+    ],
+    "fullFormatOutro": "<strong>Formato completo</strong> continua com duas janelas extras:",
+    "fullFormatItems": [
+      "<strong>Filesystem</strong> — <code>ext4</code>, <code>xfs</code>, <code>exfat</code> (portátil), ou <code>btrfs</code>. As ferramentas em falta (por exemplo, <code>mkfs.btrfs</code>) abortam com uma mensagem clara.",
+      "<strong>Etiqueta</strong>: nome opcional do sistema de ficheiros para identificação."
+    ]
+  },
+  "steps": {
+    "heading": "Passo a passo",
+    "stepLabel": "Etapa",
+    "list": [
+      {
+        "title": "Escolha um disco livre",
+        "body": "O ProxMenux lista os discos que passam nos filtros acima. Os discos marcados com ⚠ contêm metadados antigos, apresentados em detalhe para saber o que vai sobrescrever."
+      },
+      {
+        "title": "Escolha um modo de operação",
+        "bodyRich": "Escolha <strong>Limpar tudo</strong>, <strong>Remover rótulos FS</strong>, <strong>Sobrescrever os dados com zeros</strong> ou <strong>Formato completo</strong> de acordo com a tabela acima."
+      },
+      {
+        "title": "(Apenas formato completo) Escolha o sistema de arquivos e a etiqueta",
+        "body": "ext4 / xfs / exfat / btrfs, além de uma etiqueta opcional."
+      },
+      {
+        "title": "Confirmar duas vezes",
+        "bodyRich": "O ProxMenux mostra um resumo da operação. Aceite no diálogo sim/não e <strong>introduza o caminho completo do disco</strong> exatamente como indicado, por exemplo <code>/dev/sdc</code>. Qualquer outra entrada cancela a operação."
+      },
+      {
+        "title": "Revalidação e execução",
+        "body": "Pouco antes de escrever, o script verifica novamente o estado do disco. Se uma partição tiver sido montada ou uma VM tiver sido iniciada, a execução será interrompida. Caso contrário, a operação escolhida é executada e um resumo é impresso no final."
+      }
+    ]
+  },
+  "manual": {
+    "heading": "Equivalentes manuais",
+    "body": "Se preferir executar os comandos equivalentes à mão:"
+  },
+  "troubleshoot": {
+    "notListedTitle": "Disco não listado no menu",
+    "notListedBody": "Foi filtrado por segurança. Razões comuns: é montado (mesmo em <code>/mnt/tmp</code>), é um ZFS / LVM / RAID membro, é referenciado por um VM ou LXC config, ou é seu disco raiz Proxmox. Execute <code>lsblk -f</code> e <code>cat /proc/mdstat</code> no host para entender o porquê.",
+    "busyTitle": "\"Disk may be busy\" / falha ao desmontar",
+    "busyBody": "Algo ainda está segurando um arquivo aberto em uma partição desse disco — na maioria das vezes um recipiente ou uma shell cujo cwd está dentro de um ponto de montagem. Identifique-o com <code>lsof | grep /dev/sdX</code> ou <code>fuser -vm /dev/sdX1</code>, pare-o e, em seguida, execute novamente a ferramenta."
+  },
+  "related": {
+    "heading": "Relacionado",
+    "items": [
+      {
+        "href": "/docs/disk-manager/smart-disk-test",
+        "label": "Integridade e teste do disco SMART",
+        "tail": " — verificar um disco antes / após limpar para confirmar que é saudável."
+      },
+      {
+        "href": "/docs/disk-manager/import-disk-vm",
+        "label": "Importar disco para VM",
+        "tail": " — passar um disco recém-formatado para um VM."
+      },
+      {
+        "href": "/docs/storage-share/host-local-disk",
+        "label": "Adicionar o disco local como armazenamento Proxmox",
+        "tail": " — registar um disco apagado como conjunto de armazenamento Proxmox."
+      },
+      {
+        "href": "/docs/help-info/storage-commands",
+        "label": "Comandos de armazenamento e discos",
+        "tail": " — referência de lsblk, blkid e parted."
+      },
+      {
+        "href": "/docs/disk-manager",
+        "label": "Visão geral do Gerenciador de Discos",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/pt/docs/disk-manager/import-disk-image-vm.json b/web/messages/pt/docs/disk-manager/import-disk-image-vm.json
new file mode 100644
index 00000000..0bdbe940
--- /dev/null
+++ b/web/messages/pt/docs/disk-manager/import-disk-image-vm.json
@@ -0,0 +1,110 @@
+{
+  "meta": {
+    "title": "Importar imagem de disco para uma VM | Documentação ProxMenux",
+    "description": "Importar um arquivo de imagem de disco (.img / .qcow2 / .vmdk / .raw) para um Proxmox VM existente usando ProxMenux. Interface por imagem, emulação SSD e bandeira inicializável, com qm importdisk sob o capô.",
+    "ogTitle": "Importar imagem de disco para uma VM | Documentação ProxMenux",
+    "ogDescription": "Importar imagens de disco .img / .qcow2 / .vmdk / .raw para um VM existente com ProxMenux. Usa o 'qm importdisk' sob o capô."
+  },
+  "header": {
+    "title": "Importar imagem de disco para VM",
+    "description": "Importar um arquivo de imagem de disco (.img, .qcow2, .vmdk ou .raw) para um Proxmox VM existente. ProxMenux coleta cada decisão inicial — destino VM, armazenamento Proxmox, diretório fonte, interface, emulação SSD, ordem de inicialização — e então executa qm importdisk para cada imagem selecionada.",
+    "section": "Gerenciador de disco · VM"
+  },
+  "intro": {
+    "title": "O que isto faz",
+    "body": "Ao contrário de <em>Importar disco para VM</em>, que atribui um disco físico diretamente, este processo utiliza um <strong>ficheiro</strong> no host, exportado de outro hipervisor, transferido como imagem cloud ou extraído de uma cópia de segurança. Converte-o num disco de VM Proxmox no armazenamento escolhido. O original é preservado: o ProxMenux copia-o, não o move."
+  },
+  "howRuns": {
+    "heading": "Como o script é executado",
+    "body": "O fluxo tem duas fases. A fase 1 recolhe todas as decisões (VM, armazenamento, directório de origem, imagens, opções de imagem) à frente através de diálogos. Fase 2 executa <code>qm importdisk</code> para cada imagem selecionada. Até o início da Fase 2, nada é copiado e a configuração VM não é tocada."
+  },
+  "prereqs": {
+    "heading": "Pré-requisitos",
+    "items": [
+      "Pelo menos uma VM definida no host. A VM de destino deve estar <strong>desligada</strong>.",
+      "Pelo menos um arquivo de imagem de um formato suportado no diretório fonte. Suportado: <code>.img</code>, <code>.qcow2</code>, <code>.vmdk</code>, <code>.raw</code>.",
+      "Espaço livre suficiente no armazenamento Proxmox alvo para segurar cada disco importado.",
+      "ProxMenux procura imagens em <code>/var/lib/vz/template/iso</code> por padrão. Você pode apontá-lo para qualquer outro diretório no host quando ele perguntar."
+    ]
+  },
+  "steps": {
+    "heading": "Passo a passo",
+    "stepLabel": "Etapa",
+    "list": [
+      {
+        "title": "Escolher a VM de destino",
+        "bodyRich": "ProxMenux lê <code>qm list</code> e mostra cada VM. Escolha o que receberá o(s) disco(s) importado(s)."
+      },
+      {
+        "title": "Escolha o armazenamento do Proxmox",
+        "bodyRich": "A lista contém cada armazenamento que tem o tipo de conteúdo <code>images</code> habilitado. Se houver apenas um candidato, ele é selecionado automaticamente e a janela é ignorada."
+      },
+      {
+        "title": "Escolha o diretório de origem",
+        "bodyRich": "Escolha o diretório padrão (<code>/var/lib/vz/template/iso</code>) ou digite um caminho personalizado — normalmente onde você baixou / enviou a imagem. O script rejeita caminhos que não existem."
+      },
+      {
+        "title": "Escolha uma ou várias imagens",
+        "bodyRich": "O diretório é escaneado para arquivos <code>.img</code> / <code>.qcow2</code> / <code>.vmdk</code> / <code>.raw</code>. Você pode selecionar vários de uma vez; cada um irá passar pelas opções por imagem no próximo passo."
+      },
+      {
+        "title": "Opções por imagem",
+        "intro": "Para cada imagem selecionada, o ProxMenux pergunta:",
+        "items": [
+          "<strong>Interface</strong> — <code>scsi</code> (padrão), <code>virtio</code>, <code>sata</code> ou <code>ide</code>. Corresponde à forma como o hóspede vai ver o disco.",
+          "<strong>Emulação SSD</strong>: apenas para interfaces que não sejam VirtIO. Adiciona <code>ssd=1</code> para o sistema convidado reconhecer um disco de estado sólido. O suporte de discard/TRIM tem de ser configurado separadamente.",
+          "<strong>De arranque</strong>: se responder sim, o ProxMenux adiciona o disco à ordem de arranque como dispositivo principal da VM."
+        ]
+      },
+      {
+        "title": "Importar e anexar",
+        "bodyRich": "O ProxMenux executa o <code>qm importdisk</code> para cada imagem (formato de conversão na hora, onde necessário), liga o disco resultante ao próximo slot livre (<code>scsiN</code>, <code>sataN</code>, ...) com as opções escolhidas e — se você marcou qualquer disco como inicializável — atualiza a ordem de inicialização. O progresso mostra-se no terminal."
+      }
+    ]
+  },
+  "manual": {
+    "heading": "Equivalente manual",
+    "body": "A importação de uma única imagem corresponde a três comandos <code>qm</code>:",
+    "warnTitle": "Conversão do formato da imagem",
+    "warnBody": "Quando o armazenamento de destino não pode conter o formato de origem nativamente (por exemplo, o armazenamento LVM não pode conter <code>.qcow2</code>), <code>qm importdisk</code> converte a imagem de forma transparente. Isso pode levar vários minutos para imagens multi-GB; planejar de acordo com isso e não interromper o script."
+  },
+  "troubleshoot": {
+    "heading": "Resolução de Problemas",
+    "noImagesTitle": "\"Nenhuma imagem de disco compatível encontrada\"",
+    "noImagesBody": "O script não encontrou ficheiros <code>.img</code>, <code>.qcow2</code>, <code>.vmdk</code> ou <code>.raw</code>. Verifique a extensão, distinguindo maiúsculas e minúsculas, se o ficheiro está diretamente no diretório escolhido (os subdiretórios não são pesquisados) e se root o pode ler.",
+    "slowTitle": "A importação é lenta",
+    "slowBody": "As conversões entre VMDK, QCOW2 e raw podem ser limitadas pela CPU e E/S. A velocidade depende das leituras na origem, das escritas no destino e da eventual descompressão. Prefira fontes raw ou qcow2 quando possível.",
+    "uefiTitle": "O disco importado arranca na shell UEFI",
+    "uefiBody": "A imagem foi construída para legado (SeaBIOS), mas o VM usa OVMF (ou vice-versa). Alternar o VM do BIOS no Proxmox para corresponder à imagem, ou reconstruir a imagem no modo correto antes de importar."
+  },
+  "related": {
+    "heading": "Relacionado",
+    "items": [
+      {
+        "href": "/docs/disk-manager/import-disk-vm",
+        "label": "Importar disco para VM",
+        "tail": " — mesmo fluxo, mas para discos físicos brutos (passagem)."
+      },
+      {
+        "href": "/docs/utils/import-vm",
+        "label": "Importar VM de OVA / OVF",
+        "tail": " — quando você tem um pacote completo VM, não apenas uma imagem de disco."
+      },
+      {
+        "href": "/docs/utils/UUp-Dump-ISO-Creator",
+        "label": "Criador de ISO do UUP Dump",
+        "tail": " — gerar uma ISO do Windows se necessitar de uma nova instalação."
+      },
+      {
+        "href": "/docs/help-info/storage-commands",
+        "label": "Comandos de armazenamento e discos",
+        "tail": " — referência de qm importdisk e qemu-img convert."
+      },
+      {
+        "href": "/docs/disk-manager",
+        "label": "Visão geral do Gerenciador de Discos",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/pt/docs/disk-manager/import-disk-lxc.json b/web/messages/pt/docs/disk-manager/import-disk-lxc.json
new file mode 100644
index 00000000..e3d2c822
--- /dev/null
+++ b/web/messages/pt/docs/disk-manager/import-disk-lxc.json
@@ -0,0 +1,115 @@
+{
+  "meta": {
+    "title": "Importar o Disco para LXC | ProxMenux Documentação",
+    "description": "Anexar um disco físico a um recipiente LXC existente em Proxmox VE usando ProxMenux. Lida com detecção / formatação do sistema de arquivos, ponto de montagem, sem privilégios → conversões privilegiadas e caminhos persistentes do dispositivo.",
+    "ogTitle": "Importar o Disco para LXC | ProxMenux Documentação",
+    "ogDescription": "Anexar um disco físico a um recipiente LXC existente. Lida com sistema de arquivos, ponto de montagem e sem privilégios → conversão privilegiada."
+  },
+  "header": {
+    "title": "Importar disco para LXC",
+    "description": "Ligue um disco físico a um contentor LXC existente no host Proxmox. O ProxMenux deteta discos livres, permite formatá-los com um sistema de ficheiros suportado e liga a partição a um ponto de montagem dentro do contentor através de caminhos persistentes do dispositivo.",
+    "section": "Gerenciador de disco · LXC"
+  },
+  "intro": {
+    "title": "Passthrough em VM e em LXC",
+    "body": "Este passthrough LXC <strong>não fornece um dispositivo de bloco bruto</strong>. O contentor recebe um <em>ponto de montagem</em>, ou seja, um diretório numa partição escolhida no host. Ao contrário de uma VM, utiliza o kernel do host: o sistema de ficheiros (ext4/xfs/btrfs) é lido e gerido pelo host Proxmox e depois disponibilizado ao contentor."
+  },
+  "howRuns": {
+    "heading": "Como o script é executado",
+    "body": "O fluxo tem duas fases com separação clara entre \"coletar informações e decisões\" e \"na verdade mudar a configuração do recipiente\". Até à confirmação final, nada é montado no CT.",
+    "summary": "O ProxMenux exclui o disco raiz, os discos montados e os referenciados em configurações VM/LXC. Os membros ativos de ZFS/LVM/RAID são ocultos; as assinaturas antigas aparecem com ⚠ para poderem ser apagadas antes da formatação."
+  },
+  "prereqs": {
+    "heading": "Pré-requisitos",
+    "items": [
+      "Pelo menos um recipiente LXC definido no hospedeiro.",
+      "O contentor é <strong>privilegiado</strong> ou aceita a conversão proposta pelo script.",
+      "Pelo menos um disco físico que não está em uso pelo host ou por qualquer outro convidado."
+    ],
+    "warnTitle": "Recipiente privilegiado necessário",
+    "warnBody": "Este script exige um contentor <strong>privilegiado</strong> para ligar diretamente o disco. Se detetar <code>unprivileged: 1</code>, oferece editar <code>/etc/pve/lxc/&lt;CTID&gt;.conf</code> no local. Isso altera o modelo de segurança sem remapear os proprietários dos ficheiros existentes. Faça uma cópia de segurança e verifique os proprietários antes de aceitar, ou recrie o contentor como privilegiado."
+  },
+  "steps": {
+    "heading": "Passo a passo",
+    "stepLabel": "Etapa",
+    "list": [
+      {
+        "title": "Escolher o contentor de destino",
+        "img": "/disk/select-container.png",
+        "caption": "Menu de seleção do contentor",
+        "bodyRich": "ProxMenux lista cada recipiente LXC no host (<code>pct list</code>). Escolha o que vai receber o disco. Se o recipiente não tiver privilégios, é-lhe oferecido converter agora."
+      },
+      {
+        "title": "Escolha o disco físico",
+        "img": "/disk/disk-selection-ct.png",
+        "caption": "Discos livres detetados no host, com ⚠ para metadados antigos",
+        "bodyRich": "Só são mostrados candidatos seguros. Ao contrário do processo para VM, este script liga <strong>um disco por execução</strong>. Execute-o novamente para cada disco adicional."
+      },
+      {
+        "title": "Formatar ou reutilizar",
+        "intro": "O script inspeciona o disco:",
+        "items": [
+          "Se ele já carrega um sistema de arquivos suportado (ext4 / xfs / btrfs) você pode reutilizá-lo como está (os arquivos existentes são preservados).",
+          "Se não tiver nenhum sistema de arquivos suportado, você é oferecido para formatá-lo. Escolha ext4 / xfs / btrfs."
+        ]
+      },
+      {
+        "title": "Escolha o ponto de montagem",
+        "bodyRich": "Introduza o caminho onde o contentor verá o disco, por exemplo <code>/mnt/data</code> ou <code>/mnt/disk_passthrough</code>. É o caminho <em>dentro</em> do contentor; o host já vê a partição em <code>/dev/disk/by-id/…</code>."
+      },
+      {
+        "title": "Anexar e verificar",
+        "img": "/disk/assignment-ct.png",
+        "caption": "Atribuição a CT",
+        "bodyRich": "O ProxMenux adiciona uma entrada <code>mpN:</code> nova à configuração do recipiente, ignorando índices já em uso e re-leia a configuração para confirmar. Se o recipiente estiver rodando, a montagem será executada ao vivo; caso contrário, fará efeito no próximo início.",
+        "extraImg": "/disk/result-point.png",
+        "extraAlt": "Ponto de montagem criado com sucesso",
+        "extraCaption": "Ponto de montagem criado e verificado"
+      }
+    ]
+  },
+  "manual": {
+    "heading": "Equivalente manual",
+    "body": "O script envolve <code>pct set</code>. Uma invocação direta para um único disco parece:"
+  },
+  "important": {
+    "heading": "Considerações importantes",
+    "items": [
+      "<strong>Um disco por execução</strong>. Repita o script para cada disco adicional.",
+      "<strong>Não</strong> ligue a mesma partição a vários contentores que a possam montar simultaneamente: escritas concorrentes corrompem o sistema de ficheiros.",
+      "<strong>Os metadados antigos</strong> (assinaturas RAID/ZFS/LVM) têm de ser apagados manualmente antes de o script permitir a formatação; caso contrário, <code>mkfs</code> recusa sobrescrever. Utilize <wipeLink>Formatar ou apagar um disco físico</wipeLink>."
+    ]
+  },
+  "troubleshoot": {
+    "heading": "Resolução de Problemas",
+    "unprivTitle": "\"Não posso continuar com um contentor sem privilégios\"",
+    "unprivBody": "Recusou a conversão, por isso o script terminou sem alterar nada. Para continuar, execute-o novamente e aceite: o script para o contentor, guarda uma cópia da configuração em <code>/etc/pve/lxc/&lt;CTID&gt;.conf.bak</code> e substitui <code>unprivileged: 1</code> por <code>unprivileged: 0</code>. Essa alteração, por si só, não converte os UID/GID dos ficheiros existentes; faça antes uma cópia de segurança do contentor e corrija os proprietários, ou restaure ou recrie o contentor como privilegiado.",
+    "permsTitle": "Permissões dentro do recipiente estão erradas",
+    "permsBody": "Montar uma partição num contentor privilegiado mantém os proprietários existentes; um sistema de ficheiros novo pertence frequentemente a <code>root:root</code>. Se o serviço usar outro utilizador, por exemplo <code>www-data</code> para Nextcloud, verifique o UID/GID e ajuste os ficheiros necessários com <code>chown</code>/<code>chmod</code>. As alterações também afetam o disco subjacente."
+  },
+  "related": {
+    "heading": "Relacionado",
+    "items": [
+      {
+        "href": "/docs/disk-manager/import-disk-vm",
+        "label": "Importar disco para VM",
+        "tail": " — fluxo equivalente para VMs."
+      },
+      {
+        "href": "/docs/storage-share/lxc-mount-points",
+        "label": "Pontos de montagem LXC (Host ↔ CT)",
+        "tail": " — compartilhar diretórios de host com um CT em vez de anexar um disco inteiro."
+      },
+      {
+        "href": "/docs/help-info/vm-ct-commands",
+        "label": "Comandos de gestão VM e CT",
+        "tail": " — pct config / push / pull referência."
+      },
+      {
+        "href": "/docs/disk-manager",
+        "label": "Visão geral do Gerenciador de Discos",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/pt/docs/disk-manager/import-disk-vm.json b/web/messages/pt/docs/disk-manager/import-disk-vm.json
new file mode 100644
index 00000000..4d386ff8
--- /dev/null
+++ b/web/messages/pt/docs/disk-manager/import-disk-vm.json
@@ -0,0 +1,113 @@
+{
+  "meta": {
+    "title": "Importar o Disco para VM | ProxMenux Documentação",
+    "description": "Anexar um disco físico a um Proxmox VM existente com ProxMenux. Detecção segura de disco (exclui sistema, montado, em uso, ZFS/RAID/LVM), caminhos /dev/disk/by-id persistentes e interfaces SATA / SCSI / VirtIO / IDE.",
+    "ogTitle": "Importar o Disco para VM | ProxMenux Documentação",
+    "ogDescription": "Anexar um disco físico a um Proxmox VM existente. Usa caminhos /dev/disk/by-id persistentes e suporta SATA / SCSI / VirtIO / IDE."
+  },
+  "header": {
+    "title": "Importar disco para VM",
+    "description": "Anexar um disco físico que já existe na máquina Proxmox a uma máquina virtual existente. ProxMenux detecta discos livres, permite que você escolha o alvo VM, o tipo de barramento (SATA / SCSI / VirtIO / IDE) e liga tudo usando caminhos /dev/disk/by-id persistentes para que o mapeamento sobreviva a reinicialização e alterações de ordem do dispositivo.",
+    "section": "Gerenciador de disco · VM"
+  },
+  "intro": {
+    "title": "O que isto faz",
+    "body": "Liga um disco físico bruto como dispositivo subjacente de uma interface de disco virtual. O sistema convidado não recebe automaticamente os dados SMART nativos nem as funções do controlador físico; utilize passthrough PCI do controlador se forem necessários. O disco é ligado pelo seu caminho <code>/dev/disk/by-id/…</code> quando existe, para manter a atribuição se a ordem dos dispositivos mudar no arranque; caso contrário, é usado <code>/dev/sdX</code>."
+  },
+  "howRuns": {
+    "heading": "Como o script é executado",
+    "body": "O fluxo tem duas fases com separação clara entre \"coletar informações e decisões\" e \"realmente anexar discos ao VM\". Até a confirmação final, a configuração VM não é tocada.",
+    "summary": "O ProxMenux exclui candidatos inseguros: disco raiz, discos montados no host, membros ativos ZFS/LVM/RAID e discos referenciados em configurações VM/LXC. Os discos com metadados <em>antigos</em>, ou seja, assinaturas ZFS/RAID/LVM já não utilizadas, aparecem com ⚠ mas não são bloqueados."
+  },
+  "prereqs": {
+    "heading": "Pré-requisitos",
+    "items": [
+      "Pelo menos um VM definido no host (o script envia diretamente para <code>qm list</code>).",
+      "A <strong>VM de destino está desligada</strong>. Se estiver em execução, o script para com uma mensagem; a adição de discos em funcionamento não faz parte deste processo.",
+      "Pelo menos um disco físico no host que não está em uso pelo host ou qualquer outro hóspede."
+    ]
+  },
+  "steps": {
+    "heading": "Passo a passo",
+    "stepLabel": "Etapa",
+    "list": [
+      {
+        "title": "Escolher a VM de destino",
+        "bodyRich": "O ProxMenux lista todas as VM do host com <code>qm list</code>. Escolha a que receberá o disco. Se estiver em execução, o script para e pede que a desligue primeiro."
+      },
+      {
+        "title": "Escolha o( s) disco( s) físico( s) a anexar",
+        "img": "/disk/disk-selection.png",
+        "caption": "Discos livres detetados no host, com ⚠ para metadados antigos",
+        "body": "O script examina os discos do host e mostra apenas os que podem ser ligados sem conflitos. Pode selecionar vários. Os discos com assinaturas antigas ZFS/LVM/RAID continuam visíveis com ⚠ para indicar que as assinaturas devem ser apagadas antes de o sistema convidado os formatar."
+      },
+      {
+        "title": "Escolha a interface de barramento",
+        "img": "/disk/disk-assigment.png",
+        "caption": "Seleção da interface de barramento",
+        "intro": "Escolha como o hóspede deve ver o disco:",
+        "items": [
+          "<strong>SCSI</strong> — padrão moderno para Linux e Windows com drivers VirtIO-SCSI instalados.",
+          "<strong>SATA</strong> — ampla compatibilidade, funciona fora da caixa em praticamente todos os hóspedes.",
+          "<strong>VirtIO</strong>: dispositivo de bloco paravirtualizado eficiente; exige controladores de software no sistema convidado.",
+          "<strong>IDE</strong> — para os hóspedes legados que não possuem nenhum dos drivers acima."
+        ]
+      },
+      {
+        "title": "Anexar e verificar",
+        "bodyRich": "ProxMenux liga cada disco selecionado com seu melhor caminho <code>/dev/disk/by-id/</code>, salta os índices de slot que já estão em uso na configuração VM (<code>scsi0</code>, <code>sata0</code>, ...) e re-ler a configuração para confirmar a atribuição. Um resumo é impresso no final."
+      }
+    ]
+  },
+  "manual": {
+    "heading": "Equivalente manual",
+    "body": "O script é uma embalagem em torno de <code>qm set</code>. O comando exato para um único disco se parece com este:",
+    "migrationTitle": "A migração ao vivo não é possível",
+    "migrationBody": "Uma VM com um disco físico ligado diretamente fica <strong>dependente do host que disponibiliza esse disco</strong>. Outro nó normalmente não tem o mesmo caminho <code>/dev/disk/by-id/…</code> nem os dados. Faça cópias de segurança e transfira os dados separadamente, ou utilize discos virtuais geridos em armazenamento partilhado ou com replicação suportada. Não pressuponha que a replicação do Proxmox abrange este dispositivo.",
+    "shareTitle": "Não compartilhar um disco físico entre VMs",
+    "shareBody": "Anexar o mesmo disco físico a duas VMs ao mesmo tempo irá corromper os dados na próxima gravação. ProxMenux detecta esta situação e bloqueia-a, mas se você ignorar o script (direto <code>qm set</code>), certifique-se de que apenas um convidado monta o disco."
+  },
+  "troubleshoot": {
+    "heading": "Resolução de Problemas",
+    "noDisksTitle": "\"Nenhum disco disponível para este VM\"",
+    "noDisksIntro": "O script encontrou discos, mas todos os candidatos foram filtrados. Razões comuns:",
+    "noDisksItems": [
+      "Cada disco restante já está referenciado na configuração do VM.",
+      "Cada disco restante é montado na máquina ou faz parte de um ZFS / LVM / RAID ativo.",
+      "A máquina só tem o disco raiz instalado."
+    ],
+    "noDisksOutro": "Execute <code>lsblk -f</code> no host para rever o estado de cada disco.",
+    "noVisibleTitle": "O VM não vê o disco após o arranque",
+    "noVisibleBody": "Se você escolheu <strong>SCSI</strong> ou <strong>VirtIO</strong>, o hóspede precisa do driver correspondente. No Linux que é nativo do kernel; no Windows você precisa da ISO VirtIO e de uma instalação de driver (veja a página <winLink>Criar VM: Sistema Windows</winLink>). Mudar para SATA na guia de hardware do VM é uma solução rápida para confirmar que o disco está fisicamente ligado."
+  },
+  "related": {
+    "heading": "Relacionado",
+    "items": [
+      {
+        "href": "/docs/disk-manager/import-disk-image-vm",
+        "label": "Importar imagem de disco para VM",
+        "tail": " — mesmo fluxo mas para arquivos de imagem (qcow2 / vmdk / raw / img)."
+      },
+      {
+        "href": "/docs/disk-manager/import-disk-lxc",
+        "label": "Importar disco para LXC",
+        "tail": " — processo equivalente para contentores LXC."
+      },
+      {
+        "href": "/docs/disk-manager/add-controller-nvme-vm",
+        "label": "Adicionar controlador ou NVMe a uma VM",
+        "tail": " — quando necessitar de uma passagem completa PCIe / NVMe em vez de anexar o disco."
+      },
+      {
+        "href": "/docs/help-info/storage-commands",
+        "label": "Comandos de armazenamento e discos",
+        "tail": " — qm importdisk e referência de shell correspondente."
+      },
+      {
+        "href": "/docs/disk-manager",
+        "label": "Visão geral do Gerenciador de Discos",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/pt/docs/disk-manager/index.json b/web/messages/pt/docs/disk-manager/index.json
new file mode 100644
index 00000000..53d3d344
--- /dev/null
+++ b/web/messages/pt/docs/disk-manager/index.json
@@ -0,0 +1,135 @@
+{
+  "meta": {
+    "title": "Gestor de discos Proxmox: VM/LXC, testes SMART e eliminação | ProxMenux",
+    "description": "Faça a gestão de discos físicos num host Proxmox VE com o ProxMenux: ligue discos a VM ou LXC (qm set scsi/sata/virtio, pct mp), importe imagens img / qcow2 / vmdk / raw, atribua HBA ou controladores NVMe completos, apague discos com verificações de segurança e execute autotestes SMART.",
+    "ogTitle": "Gerenciador de disco Proxmox — Anexar discos a VMs / LXC, testes SMART, limpa",
+    "ogDescription": "Anexar discos a VMs / LXC, importar imagens de disco, passagem PCI para controladores, limpeza segura e testes SMART em Proxmox VE.",
+    "twitterTitle": "Gestor de discos Proxmox | ProxMenux",
+    "twitterDescription": "Anexar discos a VMs / LXC, imagens de importação, passagem PCI, limpeza segura e testes SMART."
+  },
+  "header": {
+    "title": "Gerenciador de disco",
+    "description": "O menu Gerenciador de disco agrupa as ferramentas ProxMenux para lidar com discos físicos em um host Proxmox: anexar discos em recipientes VMs e LXC, importar imagens de disco, passar por um controlador inteiro ou dispositivo NVMe, limpar discos com segurança e executar testes de saúde SMART.",
+    "section": "Gerenciador de disco"
+  },
+  "intro": {
+    "title": "Para que serve este menu",
+    "body": "Estas ferramentas trabalham com <strong>discos físicos visíveis ao host Proxmox e ficheiros de imagem nele guardados</strong>. Há três grupos: <strong>VM</strong> (ligar discos ou importar imagens), <strong>LXC</strong> (ligar discos a um contentor) e <strong>Utilitários</strong> (formatação e estado SMART). As operações de ligação e eliminação ocultam ou bloqueiam discos de sistema e em uso; as verificações SMART podem examiná-los sem os apagar."
+  },
+  "opening": {
+    "heading": "Abrir o menu",
+    "body": "No menu principal do ProxMenux, selecione <strong>Disk Manager</strong>. Você verá isto:",
+    "imageAlt": "Menu Gerenciador de disco com blocos VM, LXC e Utilitários"
+  },
+  "groups": {
+    "heading": "Três grupos de ferramentas",
+    "intro": "O menu está organizado em três grupos: <strong>VM</strong>, <strong>LXC</strong> e <strong>Utilitários</strong>. Clique num cartão para ir diretamente às ferramentas desse grupo.",
+    "vmTitle": "VM",
+    "vmBody": "Ferramentas que operam em máquinas virtuais existentes. O VM deve ser desligado; o ProxMenux valida isto antes de tocar na configuração.",
+    "vmItems": [
+      "Importar disco para VM",
+      "Importar imagem de disco para VM",
+      "Adicionar controlador ou NVMe a uma VM"
+    ],
+    "lxcTitle": "LXC",
+    "lxcBody": "Ferramentas para contentores LXC existentes. Este script exige um contentor privilegiado e oferece alterar a opção quando necessário. Leia primeiro os cuidados sobre conversão e propriedade dos ficheiros na página da ferramenta.",
+    "lxcItems": [
+      "Importar disco para LXC"
+    ],
+    "utilitiesTitle": "Utilitários",
+    "utilitiesBody": "Ferramentas do lado do hospedeiro que operam nos próprios discos, independentemente de qualquer VM ou recipiente.",
+    "utilitiesItems": [
+      "Formatar ou apagar um disco físico",
+      "Integridade e teste do disco SMART"
+    ]
+  },
+  "vm": {
+    "heading": "VM",
+    "intro": "Ferramentas que operam em máquinas virtuais existentes. O VM deve ser desligado; o ProxMenux valida isto antes de tocar na configuração.",
+    "options": [
+      {
+        "icon": "HardDrive",
+        "href": "/docs/disk-manager/import-disk-vm",
+        "title": "Importar disco para VM",
+        "description": "Anexar um disco físico não atribuído a um VM existente. Suporta SATA / SCSI / VirtIO / IDE, usa caminhos /dev/disk/by-id persistentes."
+      },
+      {
+        "icon": "FileDown",
+        "href": "/docs/disk-manager/import-disk-image-vm",
+        "title": "Importar imagem de disco para VM",
+        "description": "Importar arquivos de imagem de disco (.img / .qcow2 / .vmdk / .raw) para um VM existente. Fluxo bifásico, qm importdisk sob o capô."
+      },
+      {
+        "icon": "Cpu",
+        "href": "/docs/disk-manager/add-controller-nvme-vm",
+        "title": "Adicionar controlador ou NVMe a uma VM",
+        "description": "Passagem PCI de um dispositivo inteiro SATA / SAS HBA ou NVMe para um VM. Lida com habilitação IOMMU e detecção de conflitos."
+      }
+    ]
+  },
+  "lxc": {
+    "heading": "LXC",
+    "intro": "Ferramentas para contentores LXC existentes. Este script exige um contentor privilegiado e oferece alterar a opção quando necessário. Leia primeiro os cuidados sobre conversão e propriedade dos ficheiros na página da ferramenta.",
+    "options": [
+      {
+        "icon": "Boxes",
+        "href": "/docs/disk-manager/import-disk-lxc",
+        "title": "Importar disco para LXC",
+        "description": "Anexar um disco físico não atribuído a um recipiente LXC existente como ponto de montagem. Lida com detecção / formato do sistema de arquivos e conversão privilegiada."
+      }
+    ]
+  },
+  "utilities": {
+    "heading": "Utilitários",
+    "intro": "Ferramentas do lado do hospedeiro que operam nos próprios discos, independentemente de qualquer VM ou recipiente.",
+    "options": [
+      {
+        "icon": "Eraser",
+        "href": "/docs/disk-manager/format-disk",
+        "title": "Formatar/limpar disco físico (seguro)",
+        "description": "Limpar o disco seguro com controles de segurança rigorosos: apenas discos totalmente livres são mostrados e uma confirmação dupla é sempre necessária."
+      },
+      {
+        "icon": "Activity",
+        "href": "/docs/disk-manager/smart-disk-test",
+        "title": "Integridade e teste do disco SMART",
+        "description": "Execute verificações de saúde SMART e auto-testes curtos / longos em unidades SATA, SAS e NVMe. Exporta JSON para o Monitor."
+      }
+    ]
+  },
+  "safety": {
+    "title": "Regras de segurança para ligação e eliminação de discos",
+    "intro": "As operações de ligação e eliminação excluem dispositivos que possam prejudicar o host:",
+    "items": [
+      "O <strong>disco de sistema</strong>, o pool raiz, o swap e os membros ativos de ZFS/LVM/RAID ficam sempre ocultos.",
+      "Os discos <strong>montados</strong> em qualquer ponto do host são ocultos ou bloqueados na execução.",
+      "Os discos <strong> referenciados por um VM ou LXC</strong> em execução não podem ser reatribuídos ou apagados.",
+      "Operações que podem alterar o estado host (IOMMU habilitar, limpar) requerem confirmação explícita."
+    ]
+  },
+  "related": {
+    "heading": "Relacionado",
+    "items": [
+      {
+        "href": "/docs/storage-share",
+        "label": "Gerenciador de armazenamento e compartilhamento",
+        "tail": " — registro de armazenamento no próprio Proxmox (NFS / Samba / iSCSI / local) e compartilhar pastas entre host e CTs."
+      },
+      {
+        "href": "/docs/help-info/storage-commands",
+        "label": "Comandos de armazenamento e discos",
+        "tail": " — referência de dispositivos de bloco, LVM, pvesm e SMART."
+      },
+      {
+        "href": "/docs/help-info/zfs-commands",
+        "label": "Comandos de gerenciamento ZFS",
+        "tail": " — para conjuntos e conjuntos de dados ZFS."
+      },
+      {
+        "href": "/docs/hardware/gpu-vm-passthrough",
+        "label": "Adicionar GPU a uma VM (passthrough)",
+        "tail": " — os mesmos conceitos IOMMU / VFIO aplicados às GPU."
+      }
+    ]
+  }
+}
diff --git a/web/messages/pt/docs/disk-manager/smart-disk-test.json b/web/messages/pt/docs/disk-manager/smart-disk-test.json
new file mode 100644
index 00000000..5f4dbcb6
--- /dev/null
+++ b/web/messages/pt/docs/disk-manager/smart-disk-test.json
@@ -0,0 +1,146 @@
+{
+  "meta": {
+    "title": "Estado e testes SMART do disco | Documentação ProxMenux",
+    "description": "Executar SMART controlos de saúde e testes de disco em Proxmox VE com ProxMenux. Suporta SATA / SAS (smartmontools) e NVMe (nvme-cli). Auto-testes curtos e longos, JSON exportação para ProxMenux Monitor integração.",
+    "ogTitle": "Estado e testes SMART do disco | Documentação ProxMenux",
+    "ogDescription": "Verificações de saúde e auto-testes de SMART para unidades SATA / SAS e NVMe em Proxmox. Exportação JSON para o Monitor."
+  },
+  "header": {
+    "title": "Integridade e teste do disco SMART",
+    "description": "Leia dados do SMART e ative auto-testes nos discos físicos ligados ao host Proxmox. ProxMenux auto-instala smartmontools para SATA / SAS e nvme-cli para NVMe, executa a ação dentro do firmware da unidade (os testes longos sobrevivem ao encerramento do terminal) e exporta os resultados JSON para o ProxMenux Monitor.",
+    "section": "Gerenciador de disco · Utilitários"
+  },
+  "intro": {
+    "title": "Para que serve isto?",
+    "body": "SMART (Auto-Monitoramento, Análise e Tecnologia de Relatórios) permite que a própria unidade relate sua saúde e execute auto-testes. Esta ferramenta expõe que os dados sem que você precise se lembrar da invocação correta <code>smartctl</code> / <code>nvme</code>, e persiste a saída como JSON, para que o Monitor possa grafar tendências ao longo do tempo."
+  },
+  "howRuns": {
+    "heading": "Como o script é executado",
+    "body": "Todas as ações aqui são não destrutivas — SMART lê os contadores de firmware da unidade, e os auto-testes estão em fila dentro da própria unidade. Nenhuma separação de fases é necessária. O fluxo é: verificação de dependência → seleção de disco → seleção de ação → invocação de ferramenta (smartctl ou nvme-cli dependendo do barramento de disco) → saída impressa mais exportação de JSON para o Monitor."
+  },
+  "deps": {
+    "heading": "Dependências",
+    "body": "A ferramenta auto-instala o que precisa na primeira execução. As unidades SATA / SAS dependem do <code>smartmontools</code>; as unidades NVMe dependem do <code>nvme-cli</code>. Ambos:"
+  },
+  "actions": {
+    "heading": "Acções disponíveis",
+    "headerAction": "Ação",
+    "headerWhat": "O que lê / roda",
+    "headerDur": "Duração",
+    "rows": [
+      {
+        "action": "Estado de saúde rápido",
+        "whatRich": "Total PASSED/FAILED + atributos-chave.<br /><code>smartctl -H</code> + <code>-A</code> (SATA/SAS) ou <code>nvme smart-log</code> (NVMe).",
+        "dur": "Instantânea"
+      },
+      {
+        "action": "Relatório completo",
+        "whatRich": "Dados SMART completos, com deslocamento. <code>smartctl -x</code> para SATA/SAS ou <code>nvme smart-log</code> + <code>id-ctrl</code> para NVMe.",
+        "dur": "Instantânea"
+      },
+      {
+        "action": "Teste curto",
+        "what": "Verificação básica de superfície e elétrica, em fila dentro do firmware da unidade.",
+        "dur": "~2 minutos"
+      },
+      {
+        "action": "Ensaio longo",
+        "what": "Varredura completa de toda a superfície. Funciona no hardware da unidade — persiste mesmo se você fechar o terminal.",
+        "dur": "Horas (dependentes do tamanho do disco)"
+      },
+      {
+        "action": "Verificar o progresso do teste",
+        "what": "Estado do auto-teste ativo ou mais recente.",
+        "dur": "Instantânea"
+      }
+    ],
+    "tipTitle": "Longos testes sobrevivem ao encerramento do terminal",
+    "tipBody": "Um teste longo corre <em>dentro do disco</em> e não depende do processo ProxMenux continuar ativo. Pode fechar o terminal e voltar a <strong>Verificar o progresso do teste</strong>. Um reinício do host, uma reposição do controlador ou uma falha de energia pode interromper o teste e a recolha de resultados; não pressuponha que retoma automaticamente."
+  },
+  "json": {
+    "heading": "Exportação de JSON para o Monitor",
+    "intro": "As ações de estado, teste curto e progresso guardam um JSON com data e hora em <code>/usr/local/share/proxmenux/smart/&lt;disk&gt;/</code>; os resultados dos testes longos são recolhidos em segundo plano. O relatório completo é apenas apresentado. A estrutura é:",
+    "outro": "O ProxMenux Monitor utiliza estes ficheiros para mostrar a evolução do estado de cada disco. Os ficheiros antigos são eliminados automaticamente ao atingir o limite de retenção."
+  },
+  "steps": {
+    "heading": "Passo a passo",
+    "stepLabel": "Etapa",
+    "list": [
+      {
+        "title": "Escolha um disco",
+        "body": "ProxMenux lista cada disco físico no host com seu modelo e tamanho. Ao contrário da ferramenta Format, esta lista não é filtrada pela segurança — ler SMART é uma operação não destrutiva.",
+        "img": "/disk/smart/disk-selection.png",
+        "alt": "Menu de seleção de disco SMART",
+        "caption": "Menu de seleção de disco SMART"
+      },
+      {
+        "title": "Escolha uma ação",
+        "body": "Escolha entre estado de saúde rápido, relatório completo, teste curto, teste longo ou check progress. O menu fica aberto após cada ação para que você possa encadear várias consultas contra o mesmo disco.",
+        "img": "/disk/smart/action-menu.png",
+        "alt": "Menu de ação SMART",
+        "caption": "Menu de ação SMART (ações 5 + cancelamento)"
+      },
+      {
+        "title": "(Apenas teste longo) Confirmar execução em segundo plano",
+        "body": "O ProxMenux informa que o teste continuará após fechar o terminal e mostra onde será guardado o resultado JSON. Aceite para iniciar o teste.",
+        "img": "/disk/smart/long-test-warning.png",
+        "alt": "Diálogo de confirmação de teste longo",
+        "caption": "Confirmação de teste longa — roda em segundo plano, resultado salvo em JSON"
+      },
+      {
+        "title": "Rever os resultados",
+        "bodyRich": "O estado, os testes e o progresso são apresentados no terminal; <strong>Relatório completo</strong> abre numa caixa de diálogo com deslocamento. O JSON é exportado para as ações descritas acima, exceto Relatório completo. Para testes longos, volte a <strong>Verificar o progresso do teste</strong> no mesmo disco.",
+        "img": "/disk/smart/quick-status.png",
+        "alt": "Saída rápida do estado de saúde",
+        "caption": "Saída rápida do estado de saúde (SATA — smartctl -H + -A)"
+      }
+    ]
+  },
+  "manual": {
+    "heading": "Equivalentes manuais",
+    "nvmeWarnTitle": "Os autotestes NVMe dependem do firmware do disco",
+    "nvmeWarnBody": "Nem toda unidade NVMe suporta o comando de auto-teste curto/longo. Se uma unidade recusar o teste, o log SMART e os dados do controlador de ID (<code>nvme smart-log</code> + <code>id-ctrl</code>) ainda são o sinal de saúde mais confiável."
+  },
+  "troubleshoot": {
+    "heading": "Resolução de Problemas",
+    "noSmartTitle": "\"Não foi possível ler dados SMART de /dev/sdX\"",
+    "noSmartBody": "O disco pode estar ligado a um controlador RAID/SAS que não transmite SMART. Com placas megaraid, tente <code>smartctl -d megaraid,N /dev/sdX</code>. Com HBA em modo IT, a chamada direta funciona.",
+    "longTitle": "O teste longo nunca termina",
+    "longBody": "O teste corre no firmware e uma carga elevada de E/S pode atrasá-lo. Tente num período calmo, como durante a noite. Em SATA, <code>smartctl -c</code> mostra a percentagem restante e, em SAS, <code>smartctl -l selftest</code>; o registo de autotestes indica o resultado e eventuais LBA com erros. Uma falha de leitura exige investigação; a lentidão, por si só, não prova um setor danificado."
+  },
+  "related": {
+    "heading": "Relacionado",
+    "items": [
+      {
+        "href": "/docs/disk-manager/format-disk",
+        "label": "Formatar ou apagar um disco físico",
+        "tail": " — reutilizar um disco após confirmar que é saudável."
+      },
+      {
+        "href": "/docs/help-info/storage-commands",
+        "label": "Comandos de armazenamento e discos → Estado SMART",
+        "tail": " — referência smartctl / nvme."
+      },
+      {
+        "href": "/docs/help-info/zfs-commands",
+        "label": "Comandos de gerenciamento ZFS",
+        "tail": " — zpool scrub verifica as somas de controlo dos dados ZFS e complementa os testes SMART do hardware."
+      },
+      {
+        "href": "/docs/monitor/dashboard/storage",
+        "label": "ProxMenux Monitor — Página de armazenamento",
+        "tail": " — vista detalhada do disco que utiliza o JSON aqui exportado: tabela SMART completa, histórico e relatório PDF."
+      },
+      {
+        "href": "/docs/monitor/dashboard/hardware",
+        "label": "ProxMenux Monitor — Página de hardware",
+        "tail": " — Resumo de armazenamento com modelo, capacidade e velocidade de ligação negociada (atual vs máximo em NVMe)."
+      },
+      {
+        "href": "/docs/disk-manager",
+        "label": "Visão geral do Gerenciador de Discos",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/pt/docs/external-repositories.json b/web/messages/pt/docs/external-repositories.json
new file mode 100644
index 00000000..cf32d728
--- /dev/null
+++ b/web/messages/pt/docs/external-repositories.json
@@ -0,0 +1,58 @@
+{
+  "meta": {
+    "title": "Repositórios externos | Documentação do ProxMenux",
+    "description": "O ProxMenux integra repositórios externos de scripts selecionados, como community-scripts e ZimaOS, como alternativas em algumas secções do menu. Cada script indica a origem; os erros devem ser comunicados ao responsável original.",
+    "ogTitle": "Repositórios externos | Documentação do ProxMenux",
+    "ogDescription": "Repositórios externos de scripts integrados como alternativas nos menus do ProxMenux."
+  },
+  "header": {
+    "title": "Repositórios externos",
+    "description": "O ProxMenux integra repositórios externos de scripts selecionados como alternativas em algumas secções do menu. Estes scripts provêm de terceiros de confiança e a sua origem é claramente indicada no menu.",
+    "section": "Repositórios externos"
+  },
+  "practice": {
+    "title": "O que isto significa na prática",
+    "body": "Quando uma opção usa um script externo em vez de código próprio, o menu indica a sua origem e o repositório carregado. O ProxMenux apenas inicia esses scripts, sem os modificar. Os problemas do seu funcionamento devem ser tratados pelo responsável do repositório original."
+  },
+  "integrated": {
+    "heading": "Atualmente integrados",
+    "usedInLabel": "Usado em:",
+    "items": [
+      {
+        "name": "community-scripts / ProxmoxVE",
+        "url": "https://community-scripts.github.io/ProxmoxVE/",
+        "description": "Sucessor dos helper scripts de tteck. Vasto catálogo de scripts para implementar numa única execução LXC (Home Assistant, Plex, Frigate…), VM, complementos e ajustes ao PVE.",
+        "usedIn": "Arranque de Helper Scripts e Rede (correção de offloading da placa Intel e1000e)"
+      }
+    ]
+  },
+  "attribution": {
+    "heading": "Autoria e reconhecimento",
+    "items": [
+      "Os autores originais são sempre identificados no menu e na página que documenta a integração do script.",
+      "É apresentada uma ligação para o repositório de origem antes de executar o script e na página de documentação correspondente.",
+      "Apoie os programadores destes projetos externos com uma ⭐, um patrocínio ou relatórios de erros bem documentados."
+    ]
+  },
+  "report": {
+    "title": "Onde comunicar problemas com scripts externos",
+    "body": "Se um script externo não funcionar como esperado, <strong>comunique o problema diretamente no respetivo repositório</strong>, não no ProxMenux. O ProxMenux descarrega-o e executa-o sem alterar o código. O responsável original pode analisar e corrigir o problema. As issues do ProxMenux destinam-se a falhas no arranque ou na integração do script."
+  },
+  "suggest": {
+    "heading": "Sugerindo novos repositórios externos",
+    "intro": "Encontrou um script ou repositório que se adequaria a um menu do ProxMenux? Sugira-o através de:",
+    "discussionTitle": "💬 Abrir uma discussão",
+    "discussionBody": "Ideal para ideias: recolha opiniões da comunidade antes de as transformar num pedido de funcionalidade.",
+    "issueTitle": "🐛 Abrir uma issue",
+    "issueBody": "Para pedidos de funcionalidades concretas com um âmbito bem definido."
+  },
+  "candidate": {
+    "title": "O que faz um bom candidato à integração",
+    "items": [
+      "Código aberto com um responsável ativo.",
+      "Idempotente: pode ser executado várias vezes em segurança.",
+      "Não altera a configuração principal do Proxmox sem avisar.",
+      "Resolve um problema que o ProxMenux ainda não cobre, evitando duplicar funcionalidades."
+    ]
+  }
+}
diff --git a/web/messages/pt/docs/glossary.json b/web/messages/pt/docs/glossary.json
new file mode 100644
index 00000000..d1e5c1c3
--- /dev/null
+++ b/web/messages/pt/docs/glossary.json
@@ -0,0 +1,677 @@
+{
+  "meta": {
+    "title": "Glossário | Documentação ProxMenux",
+    "description": "Definições dos termos utilizados na documentação ProxMenux: Proxmox, armazenamento, redes e virtualização.",
+    "ogTitle": "Glossário | Documentação ProxMenux",
+    "ogDescription": "Referência rápida para os termos técnicos utilizados na documentação ProxMenux."
+  },
+  "header": {
+    "title": "Glossário",
+    "description": "Definições breves dos termos utilizados no ProxMenux e para descrever o funcionamento interno do Proxmox.",
+    "section": "Glossário"
+  },
+  "callout": {
+    "title": "Como usar esta página",
+    "bodyRich": "Cada entrada inclui a categoria e uma definição breve. As ligações <em>Ver também</em> abrem a documentação relacionada. Utilize a navegação A–Z para ir diretamente para uma letra."
+  },
+  "jumpHeading": "Saltar para a letra",
+  "seeAlsoLabel": "Ver também:",
+  "aliasesLabel": "também:",
+  "missingCallout": {
+    "title": "Falta um termo?",
+    "leadRich": "Se faltar um termo, abra uma issue ou um PR no <ext>GitHub</ext>. O glossário está em <code>web/messages/en/docs/glossary.json</code>, com os catálogos correspondentes para cada idioma."
+  },
+  "entries": [
+    {
+      "term": "ACS",
+      "aliases": [
+        "Access Control Services",
+        "Substituição ACS"
+      ],
+      "category": "Virtualização",
+      "definitionRich": "Funções de controlo de acesso PCIe que ajudam a isolar o tráfego entre dispositivos. Os grupos IOMMU dependem do hardware e da topologia. A alteração <em>ACS override</em> pode dividir os grupos apresentados pelo Linux, mas não acrescenta isolamento físico; atribuí-los a VM distintas implica um risco de segurança.",
+      "seeAlso": [
+        {
+          "label": "Adicionar Controlador ou NVMe ao VM",
+          "href": "/docs/disk-manager/add-controller-nvme-vm"
+        }
+      ]
+    },
+    {
+      "term": "ARC",
+      "aliases": [
+        "Adaptive Replacement Cache"
+      ],
+      "category": "Armazenamento",
+      "definitionRich": "Cache de leitura ZFS na RAM do anfitrião, com blocos utilizados recentemente ou com frequência. O limite predefinido depende da versão e da instalação do Proxmox. A pós-instalação do ProxMenux permite limitá-la.",
+      "seeAlso": [
+        {
+          "label": "Pós-instalação: armazenamento",
+          "href": "/docs/post-install/storage"
+        },
+        {
+          "label": "Comandos ZFS",
+          "href": "/docs/help-info/zfs-commands"
+        }
+      ]
+    },
+    {
+      "term": "Bind mount",
+      "category": "Linux",
+      "definitionRich": "Funcionalidade Linux que disponibiliza parte do sistema de ficheiros noutro caminho. O ProxMenux utiliza bind mounts para partilhar diretórios do anfitrião com contentores LXC através de <code>pct set -mpN</code>.",
+      "seeAlso": [
+        {
+          "label": "Pontos de montagem LXC",
+          "href": "/docs/storage-share/lxc-mount-points"
+        }
+      ]
+    },
+    {
+      "term": "Bond de rede",
+      "aliases": [
+        "Agregação de interfaces de rede",
+        "Agregação de ligações"
+      ],
+      "category": "Rede",
+      "definitionRich": "Agrupa várias interfaces físicas numa interface lógica para redundância (active-backup), débito agregado (LACP / 802.3ad) ou ambos. Configura-se em <code>/etc/network/interfaces</code>."
+    },
+    {
+      "term": "Ponte",
+      "aliases": [
+        "vmbrX",
+        "vmbr0",
+        "Ponte Linux"
+      ],
+      "category": "Rede",
+      "definitionRich": "Comutador virtual de camada 2 no anfitrião. <code>vmbr0</code> liga normalmente os sistemas convidados à rede física. Outras pontes (<code>vmbr1</code>, <code>vmbr2</code>...) podem separar redes conforme as ligações físicas e a configuração.",
+      "seeAlso": [
+        {
+          "label": "Análise de ponte e reparo guiado",
+          "href": "/docs/network/bridge-analysis"
+        }
+      ]
+    },
+    {
+      "term": "Ceph",
+      "category": "Armazenamento",
+      "definitionRich": "Armazenamento distribuído integrado no Proxmox para clusters hiperconvergentes. Os OSD (Object Storage Daemons) sustentam o armazenamento de objetos, blocos e ficheiros. A versão Ceph necessária depende da versão do Proxmox e do percurso de atualização; consulte o guia correspondente.",
+      "seeAlso": [
+        {
+          "label": "Atualize PVE 8 para PVE 9",
+          "href": "/docs/utils/upgrade-pve8-pve9"
+        }
+      ]
+    },
+    {
+      "term": "CT",
+      "aliases": [
+        "Contentor",
+        "Contentor LXC"
+      ],
+      "category": "Proxmox",
+      "definitionRich": "Abreviatura de «contentor» no Proxmox para uma instância LXC. O CTID numérico corresponde a <code>/etc/pve/lxc/&lt;CTID&gt;.conf</code>. Consulte também <strong>LXC</strong>.",
+      "seeAlso": [
+        {
+          "label": "Gestão de VM e contentores",
+          "href": "/docs/help-info/vm-ct-commands"
+        }
+      ]
+    },
+    {
+      "term": "deb822",
+      "category": "Linux",
+      "definitionRich": "Formato moderno de fontes APT: ficheiros <code>.sources</code> com blocos estruturados e campos Types, URIs, Suites, Components e Signed-By. Substitui o formato de linha única <code>.list</code>; é o padrão desde PVE 9 / Debian Trixie.",
+      "seeAlso": [
+        {
+          "label": "Atualize PVE 8 para PVE 9",
+          "href": "/docs/utils/upgrade-pve8-pve9"
+        }
+      ]
+    },
+    {
+      "term": "dGPU",
+      "aliases": [
+        "GPU dedicada"
+      ],
+      "category": "Virtualização",
+      "definitionRich": "Placa gráfica independente, normalmente ligada por PCIe, ao contrário de um <strong>iGPU</strong>. Pode ser atribuída a uma VM com VFIO ou utilizada por vários contentores LXC através dos dispositivos e do controlador do anfitrião, conforme a compatibilidade do hardware e das aplicações.",
+      "seeAlso": [
+        {
+          "label": "Adicionar GPU a VM (passagem direta)",
+          "href": "/docs/hardware/gpu-vm-passthrough"
+        }
+      ]
+    },
+    {
+      "term": "Dialog",
+      "category": "Linux",
+      "definitionRich": "Ferramenta baseada em ncurses para apresentar menus, perguntas e barras de progresso no terminal. O ProxMenux utiliza menus do dialog."
+    },
+    {
+      "term": "DKMS",
+      "aliases": [
+        "Suporte dinâmico ao módulo Kernel"
+      ],
+      "category": "Linux",
+      "definitionRich": "Sistema para recompilar módulos externos registados, como NVIDIA ou ZFS, quando o kernel muda. A compilação exige código do módulo compatível e os cabeçalhos correspondentes.",
+      "seeAlso": [
+        {
+          "label": "Instalar o Coral TPU (Host)",
+          "href": "/docs/hardware/install-coral-tpu-host"
+        }
+      ]
+    },
+    {
+      "term": "Fail2Ban",
+      "category": "Linux",
+      "definitionRich": "Serviço que deteta falhas repetidas de autenticação nos registos e bloqueia os IP responsáveis através da firewall. O ProxMenux inclui jails pré-configuradas para SSH, a interface Proxmox e o Monitor.",
+      "seeAlso": [
+        {
+          "label": "Fail2Ban",
+          "href": "/docs/security/fail2ban"
+        }
+      ]
+    },
+    {
+      "term": "Fastfetch",
+      "category": "Linux",
+      "definitionRich": "Ferramenta de informação do sistema com arte ASCII apresentada ao iniciar sessão na consola. Substitui o <code>neofetch</code> e pode ser ativada na pós-instalação do ProxMenux.",
+      "seeAlso": [
+        {
+          "label": "Após a instalação: opções",
+          "href": "/docs/post-install/optional"
+        }
+      ]
+    },
+    {
+      "term": "GRUB",
+      "aliases": [
+        "GRand Unified Bootloader"
+      ],
+      "category": "Linux",
+      "definitionRich": "Gestor de arranque das instalações Linux baseadas em GRUB. Configura-se em <code>/etc/default/grub</code> e <code>/boot/grub/</code>; aplique as alterações com <code>update-grub</code>. O Proxmox também pode utilizar systemd-boot: verifique o gestor ativo antes de alterar parâmetros do kernel.",
+      "seeAlso": [
+        {
+          "label": "Comandos de passagem GPU",
+          "href": "/docs/help-info/gpu-commands"
+        }
+      ]
+    },
+    {
+      "term": "iGPU",
+      "aliases": [
+        "GPU integrada"
+      ],
+      "category": "Virtualização",
+      "definitionRich": "Processador gráfico integrado no encapsulamento da CPU, como Intel UHD / Iris ou Radeon nas APU Ryzen. É frequentemente partilhado entre vários LXC através de <code>/dev/dri</code>, em vez de atribuído exclusivamente a uma VM.",
+      "seeAlso": [
+        {
+          "label": "Adicionar GPU ao LXC",
+          "href": "/docs/hardware/igpu-acceleration-lxc"
+        }
+      ]
+    },
+    {
+      "term": "ifupdown / ifupdown2",
+      "category": "Rede",
+      "definitionRich": "Sistema clássico de configuração de rede Debian, baseado em <code>/etc/network/interfaces</code>. O Proxmox utiliza por predefinição a versão reescrita <code>ifupdown2</code>, que permite recarregar a configuração em funcionamento com <code>ifreload -a</code>."
+    },
+    {
+      "term": "initramfs",
+      "category": "Linux",
+      "definitionRich": "Sistema de ficheiros inicial em RAM utilizado antes de montar a raiz real. Contém os controladores necessários ao arranque. Após alterações a VFIO, IOMMU ou controladores de armazenamento, regenera-se com <code>update-initramfs -u -k all</code>."
+    },
+    {
+      "term": "IOMMU",
+      "aliases": [
+        "Unidade de gerenciamento de memória de entrada/saída",
+        "VT-d",
+        "AMD-Vi"
+      ],
+      "category": "Virtualização",
+      "definitionRich": "Funcionalidade de hardware (Intel VT-d / AMD-Vi) necessária para passagem direta de PCIe para VM. Ative-a no firmware e confirme o suporte no kernel. Conforme a plataforma e os valores predefinidos, podem ser necessários <code>intel_iommu=on</code> ou <code>amd_iommu=on</code>.",
+      "seeAlso": [
+        {
+          "label": "Post-Install: Virtualização",
+          "href": "/docs/post-install/virtualization"
+        },
+        {
+          "label": "Adicionar GPU a VM (passagem direta)",
+          "href": "/docs/hardware/gpu-vm-passthrough"
+        }
+      ]
+    },
+    {
+      "term": "Grupo IOMMU",
+      "category": "Virtualização",
+      "definitionRich": "Conjunto de dispositivos que constitui a unidade mínima de isolamento IOMMU. Os membros não estão necessariamente isolados entre si; verifique todos antes da atribuição com VFIO. Liste-os com <code>find /sys/kernel/iommu_groups/ -type l | sort -V</code>."
+    },
+    {
+      "term": "iSCSI",
+      "aliases": [
+        "Internet SCSI"
+      ],
+      "category": "Armazenamento",
+      "definitionRich": "Protocolo de armazenamento em blocos sobre IP: um disco remoto surge como dispositivo SCSI local. Regista-se no Proxmox com <code>pvesm add iscsi</code>.",
+      "seeAlso": [
+        {
+          "label": "Adicionar o alvo iSCSI como armazenamento Proxmox",
+          "href": "/docs/storage-share/host-iscsi"
+        }
+      ]
+    },
+    {
+      "term": "KVM",
+      "aliases": [
+        "Máquina Virtual baseada em Kernel"
+      ],
+      "category": "Virtualização",
+      "definitionRich": "Módulo do kernel Linux que transforma o anfitrião num hipervisor. Em conjunto com o <strong>QEMU</strong> para emulação de dispositivos, constitui a base das VM Proxmox."
+    },
+    {
+      "term": "LVM",
+      "aliases": [
+        "Logical Volume Manager"
+      ],
+      "category": "Armazenamento",
+      "definitionRich": "Gestão de volumes Linux que agrupa armazenamento físico em grupos (VG) com volumes lógicos (LV). As instalações Proxmox baseadas em LVM utilizam frequentemente LVM-thin para discos dos convidados; existem outras opções. Ferramentas: <code>pvs</code>, <code>vgs</code> e <code>lvs</code>.",
+      "seeAlso": [
+        {
+          "label": "Comandos de armazenamento e discos",
+          "href": "/docs/help-info/storage-commands"
+        }
+      ]
+    },
+    {
+      "term": "LXC",
+      "aliases": [
+        "Linux Containers"
+      ],
+      "category": "Linux",
+      "definitionRich": "Virtualização ao nível do sistema operativo: espaços de utilizador isolados partilham o kernel do anfitrião. Geralmente tem menos sobrecarga que as VM, com uma fronteira de isolamento diferente. O Proxmox gere LXC com <code>pct</code>.",
+      "seeAlso": [
+        {
+          "label": "Gestão de VM e contentores",
+          "href": "/docs/help-info/vm-ct-commands"
+        }
+      ]
+    },
+    {
+      "term": "Lynis",
+      "category": "Linux",
+      "definitionRich": "Ferramenta de auditoria de segurança de código aberto da CISOfy. Analisa o anfitrião e apresenta uma pontuação de segurança e recomendações concretas. O ProxMenux instala a versão do repositório GitHub original em vez do pacote Debian mais antigo.",
+      "seeAlso": [
+        {
+          "label": "Lynis",
+          "href": "/docs/security/lynis"
+        }
+      ]
+    },
+    {
+      "term": "Endereço MAC",
+      "aliases": [
+        "Endereço do hardware"
+      ],
+      "category": "Rede",
+      "definitionRich": "Identificador de interface Ethernet, normalmente de 48 bits, atribuído por hardware ou software. Os <em>Nomes de rede persistentes</em> do ProxMenux associam MAC a nomes estáveis (<code>eno1</code>, <code>enp3s0</code>) após alterações na enumeração PCI.",
+      "seeAlso": [
+        {
+          "label": "Nomes de interface persistentes",
+          "href": "/docs/network/persistent-names"
+        }
+      ]
+    },
+    {
+      "term": "MOTD",
+      "aliases": [
+        "Mensagem do Dia"
+      ],
+      "category": "Linux",
+      "definitionRich": "Texto apresentado após iniciar sessão por SSH, guardado em <code>/etc/motd</code>. A pós-instalação do ProxMenux pode adicionar um cabeçalho; o desinstalador restaura o ficheiro anterior se existir uma cópia."
+    },
+    {
+      "term": "NFS",
+      "aliases": [
+        "Sistema de arquivos de rede"
+      ],
+      "category": "Armazenamento",
+      "definitionRich": "Protocolo de partilha de ficheiros em rede originário do Unix. Regista-se como armazenamento Proxmox com <code>pvesm add nfs</code>; o ProxMenux também permite configurar clientes e servidores NFS em LXC.",
+      "seeAlso": [
+        {
+          "label": "Gerenciador de armazenamento e compartilhamento",
+          "href": "/docs/storage-share"
+        }
+      ]
+    },
+    {
+      "term": "nftables / iptables",
+      "category": "Rede",
+      "definitionRich": "Ferramentas de firewall Linux. <code>nftables</code> é o sistema moderno; <code>iptables</code> pode utilizar backends clássicos ou compatíveis com nft. O <code>pve-firewall</code> clássico utiliza iptables; a alternativa proxmox-firewall utiliza nftables.",
+      "seeAlso": [
+        {
+          "label": "Comandos de rede",
+          "href": "/docs/help-info/network-commands"
+        }
+      ]
+    },
+    {
+      "term": "nouveau",
+      "category": "Linux",
+      "definitionRich": "Controlador gráfico NVIDIA de código aberto incluído no Linux. Ao instalar o controlador proprietário, impeça o nouveau de controlar o mesmo GPU, normalmente bloqueando o carregamento e regenerando o initramfs.",
+      "seeAlso": [
+        {
+          "label": "Guia de instalação NVIDIA",
+          "href": "/guides/nvidia"
+        }
+      ]
+    },
+    {
+      "term": "Repositório no-subscription",
+      "category": "Proxmox",
+      "definitionRich": "Repositório de pacotes Proxmox disponível sem subscrição empresarial. Os pacotes passam por menos validação do que no repositório enterprise, recomendado pelo Proxmox para produção. A pós-instalação do ProxMenux permite configurar repositórios.",
+      "seeAlso": [
+        {
+          "label": "Post- Install: Configuração Básica",
+          "href": "/docs/post-install/basic-settings"
+        }
+      ]
+    },
+    {
+      "term": "OVA / OVF",
+      "aliases": [
+        "Open Virtualization Format"
+      ],
+      "category": "Virtualização",
+      "definitionRich": "Formatos DMTF para distribuir VM portáteis. <strong>OVA</strong> reúne os ficheiros num arquivo TAR; <strong>OVF</strong> descreve a VM em XML com ficheiros de disco associados, geralmente VMDK. A compatibilidade de importação depende do hipervisor de destino e da configuração.",
+      "seeAlso": [
+        {
+          "label": "Exportar VM para OVA / OVF",
+          "href": "/docs/utils/export-vm"
+        },
+        {
+          "label": "Importar VM de OVA / OVF",
+          "href": "/docs/utils/import-vm"
+        }
+      ]
+    },
+    {
+      "term": "OVMF",
+      "aliases": [
+        "firmware UEFI",
+        "Open Virtual Machine Firmware"
+      ],
+      "category": "Virtualização",
+      "definitionRich": "Firmware UEFI para VM, selecionado com <code>qm set &lt;vmid&gt; -bios ovmf</code>. Utiliza-se para convidados UEFI, incluindo Windows 11 e configurações Secure Boot. <code>efidisk0</code> conserva variáveis EFI; muitos outros convidados ainda podem utilizar BIOS clássico.",
+      "seeAlso": [
+        {
+          "label": "Adicionar GPU a VM (passagem direta)",
+          "href": "/docs/hardware/gpu-vm-passthrough"
+        }
+      ]
+    },
+    {
+      "term": "PBS",
+      "aliases": [
+        "Proxmox Backup Server"
+      ],
+      "category": "Proxmox",
+      "definitionRich": "Produto de cópias Proxmox separado, com transferências incrementais, desduplicação e encriptação opcional no cliente para VM e CT. Pode ser destino do vzdump; um servidor separado é preferível a guardar cópias no próprio anfitrião protegido."
+    },
+    {
+      "term": "pct",
+      "category": "Proxmox",
+      "definitionRich": "Ferramenta de linha de comandos para gerir contentores LXC no Proxmox: <code>pct list / start / stop / shutdown / config / enter / exec / push / pull / destroy</code>.",
+      "seeAlso": [
+        {
+          "label": "Gestão de VM e contentores",
+          "href": "/docs/help-info/vm-ct-commands"
+        }
+      ]
+    },
+    {
+      "term": "pmxcfs",
+      "aliases": [
+        "Proxmox Cluster Filesystem"
+      ],
+      "category": "Proxmox",
+      "definitionRich": "Sistema de ficheiros virtual baseado em FUSE, montado em <code>/etc/pve/</code>. Replica alterações de configuração entre os nós do cluster: as edições em <code>/etc/pve/</code> são propagadas automaticamente."
+    },
+    {
+      "term": "pveam",
+      "aliases": [
+        "Gestor de dispositivos virtuais Proxmox VE"
+      ],
+      "category": "Proxmox",
+      "definitionRich": "Ferramenta do catálogo local de modelos CT. <code>pveam update</code> atualiza o índice; <code>pveam available</code> lista os modelos e <code>pveam download &lt;storage&gt; &lt;template&gt;</code> descarrega um."
+    },
+    {
+      "term": "pveproxy",
+      "category": "Proxmox",
+      "definitionRich": "Serviço HTTPS da interface e do terminal web Proxmox, na porta 8006. Reinicia durante atualizações de versão principal; por isso o ProxMenux impede a atualização PVE 8 → 9 pelo terminal web."
+    },
+    {
+      "term": "pvesm",
+      "aliases": [
+        "Gestor de armazenamento Proxmox"
+      ],
+      "category": "Proxmox",
+      "definitionRich": "Ferramenta CLI para gerenciar armazenamento Proxmox. O <code>pvesm status</code> mostra todos os armazenamentos configurados; o <code>pvesm add &lt;type&gt;</code> registra os novos (NFS, Samba, iSCSI, dir, ZFS, LVM, ...).",
+      "seeAlso": [
+        {
+          "label": "Comandos de armazenamento e discos",
+          "href": "/docs/help-info/storage-commands"
+        }
+      ]
+    },
+    {
+      "term": "Contêiner privilegiado",
+      "category": "Linux",
+      "definitionRich": "Contentor LXC cujo root <em>corresponde ao UID 0 do anfitrião</em>, mantendo namespaces e outras restrições. Tem menor isolamento do que um contentor sem privilégios. GPU, USB e Samba não exigem sempre este modo: permissões e mapeamentos UID são relevantes."
+    },
+    {
+      "term": "ProxMenux Monitor",
+      "category": "ProxMenux",
+      "definitionRich": "Painel web opcional do ProxMenux. Apresenta estatísticas do anfitrião em tempo real (CPU, RAM, discos e rede), uma vista de VM e LXC e início de sessão com 2FA, na porta TCP <code>8008</code>.",
+      "seeAlso": [
+        {
+          "label": "ProxMenux Monitor",
+          "href": "/docs/settings/proxmenux-monitor"
+        }
+      ]
+    },
+    {
+      "term": "qcow2",
+      "aliases": [
+        "QEMU Copy-On-Write v2"
+      ],
+      "category": "Armazenamento",
+      "definitionRich": "Formato de imagem de disco VM comum em armazenamento de diretório. Suporta alocação a pedido, snapshots e cópia na escrita. Converta com <code>qemu-img convert -O qcow2 ...</code>."
+    },
+    {
+      "term": "qm",
+      "aliases": [
+        "Gestor de QEMU"
+      ],
+      "category": "Proxmox",
+      "definitionRich": "Ferramenta para gerir VM no Proxmox: <code>qm list / start / stop / shutdown / config / set / destroy / importdisk / migrate</code>. Equivale ao <code>pct</code> para contentores.",
+      "seeAlso": [
+        {
+          "label": "Gestão de VM e contentores",
+          "href": "/docs/help-info/vm-ct-commands"
+        }
+      ]
+    },
+    {
+      "term": "Q35",
+      "category": "Virtualização",
+      "definitionRich": "Tipo de máquina QEMU que emula o chipset Intel Q35 com PCIe. Recomendado em vez de i440FX para passagem direta PCIe e sistemas convidados modernos. Configura-se com <code>qm set &lt;vmid&gt; -machine q35</code>."
+    },
+    {
+      "term": "QEMU",
+      "category": "Virtualização",
+      "definitionRich": "Emulador e virtualizador de máquinas de código aberto. O Proxmox combina-o com KVM para executar VM com desempenho próximo do nativo."
+    },
+    {
+      "term": "rclone",
+      "category": "Linux",
+      "definitionRich": "Ferramenta de linha de comandos compatível com vários serviços, incluindo Google Drive, Dropbox, OneDrive, Mega e S3. O guia de cópias na nuvem utiliza-a para montar armazenamento remoto num diretório para arquivos vzdump.",
+      "seeAlso": [
+        {
+          "label": "Cópias para a nuvem pessoal",
+          "href": "/guides/backup_cloud"
+        }
+      ]
+    },
+    {
+      "term": "Samba / SMB / CIFS",
+      "category": "Armazenamento",
+      "definitionRich": "Família de protocolos Microsoft para partilha de ficheiros. <strong>SMB</strong> é o protocolo, <strong>Samba</strong> a implementação aberta para Linux e <strong>CIFS</strong> um dialeto SMB antigo. Regista-se no Proxmox com <code>pvesm add cifs</code>.",
+      "seeAlso": [
+        {
+          "label": "Gerenciador de armazenamento e compartilhamento",
+          "href": "/docs/storage-share"
+        }
+      ]
+    },
+    {
+      "term": "SeaBIOS",
+      "category": "Virtualização",
+      "definitionRich": "Implementação aberta de BIOS clássico utilizada pelo QEMU. Firmware predefinido de novas VM, salvo escolha de OVMF. Adequado a sistemas antigos e instalações Linux que não exigem UEFI."
+    },
+    {
+      "term": "smartctl / SMART",
+      "aliases": [
+        "Self-Monitoring, Analysis and Reporting Technology"
+      ],
+      "category": "Armazenamento",
+      "definitionRich": "Diagnóstico integrado dos discos para estado, erros e resultados dos testes internos. A ferramenta é <code>smartctl</code>, do pacote <code>smartmontools</code>; <code>nvme-cli</code> acrescenta comandos específicos para NVMe.",
+      "seeAlso": [
+        {
+          "label": "Integridade e teste do disco SMART",
+          "href": "/docs/disk-manager/smart-disk-test"
+        },
+        {
+          "label": "Comandos de armazenamento → seção SMART",
+          "href": "/docs/help-info/storage-commands"
+        }
+      ]
+    },
+    {
+      "term": "systemd / systemctl / journalctl",
+      "category": "Linux",
+      "definitionRich": "Sistema de inicialização Debian / Proxmox. <code>systemctl</code> gere serviços: iniciar, parar, ativar e consultar o estado. <code>journalctl</code> lê o registo binário do <code>systemd-journald</code>."
+    },
+    {
+      "term": "sysctl",
+      "category": "Linux",
+      "definitionRich": "Ferramenta para ler e alterar parâmetros do kernel. As definições persistentes ficam normalmente em <code>/etc/sysctl.d/*.conf</code>; o suporte de <code>/etc/sysctl.conf</code> depende do serviço de carregamento. A pós-instalação do ProxMenux oferece um perfil sysctl.",
+      "seeAlso": [
+        {
+          "label": "Pós- instalação: Rede",
+          "href": "/docs/post-install/network"
+        }
+      ]
+    },
+    {
+      "term": "trixie",
+      "category": "Linux",
+      "definitionRich": "Codinome para Debian 13, a base de SO para Proxmox VE 9. Predecessor: <em>bookworm</em> (debian 12 / PVE 8).",
+      "seeAlso": [
+        {
+          "label": "Atualize PVE 8 para PVE 9",
+          "href": "/docs/utils/upgrade-pve8-pve9"
+        }
+      ]
+    },
+    {
+      "term": "udev",
+      "category": "Linux",
+      "definitionRich": "Gestor de dispositivos Linux. Responde a eventos de hardware e cria ou remove entradas em <code>/dev</code>. As regras em <code>/etc/udev/rules.d/</code> podem fixar nomes de interface por MAC, criar dispositivos NVIDIA ao carregar o controlador e outras tarefas."
+    },
+    {
+      "term": "UID / GID idmap",
+      "aliases": [
+        "Mudança UID"
+      ],
+      "category": "Linux",
+      "definitionRich": "Com o mapeamento predefinido dos LXC <strong>sem privilégios</strong>, UID e GID no anfitrião são deslocados em <code>+100000</code>: UID 0 corresponde a 100000 e 1000 a 101000. Mapeamentos personalizados podem diferir; os proprietários nos bind mounts devem corresponder ao mapeamento.",
+      "seeAlso": [
+        {
+          "label": "Pontos de montagem LXC",
+          "href": "/docs/storage-share/lxc-mount-points"
+        }
+      ]
+    },
+    {
+      "term": "Contêiner sem privilégios",
+      "category": "Linux",
+      "definitionRich": "Contentor LXC cujo root corresponde a um UID sem privilégios no anfitrião, normalmente 100000. Reduz os privilégios, embora partilhe o kernel. O acesso ao hardware pode ser configurado com permissões e mapeamentos adequados; o modo privilegiado não é sempre necessário."
+    },
+    {
+      "term": "VFIO",
+      "aliases": [
+        "Função virtual E/S"
+      ],
+      "category": "Virtualização",
+      "definitionRich": "Sistema do kernel Linux para controladores seguros no espaço de utilizador, usado na atribuição direta de dispositivos PCIe a VM. Utiliza <code>vfio</code>, <code>vfio_iommu_type1</code> e <code>vfio_pci</code>, configurados em <code>/etc/modprobe.d/vfio.conf</code>.",
+      "seeAlso": [
+        {
+          "label": "Post-Install: Virtualização",
+          "href": "/docs/post-install/virtualization"
+        }
+      ]
+    },
+    {
+      "term": "VirtIO",
+      "category": "Virtualização",
+      "definitionRich": "Família de controladores paravirtualizados para rede, armazenamento, memória dinâmica e GPU. Evitam a sobrecarga de emular hardware antigo, como e1000 ou IDE. O convidado precisa dos controladores: integrados no Linux e disponíveis numa ISO separada para Windows."
+    },
+    {
+      "term": "VLAN",
+      "aliases": [
+        "Rede local virtual"
+      ],
+      "category": "Rede",
+      "definitionRich": "Etiquetas 802.1Q que dividem uma rede física em várias redes lógicas. Configuram-se por ponte ou interface em <code>/etc/network/interfaces</code>."
+    },
+    {
+      "term": "VM",
+      "aliases": [
+        "Máquina Virtual"
+      ],
+      "category": "Proxmox",
+      "definitionRich": "Máquina virtual gerida pelo Proxmox com QEMU/KVM, com kernel próprio. O VMID numérico corresponde a <code>/etc/pve/qemu-server/&lt;VMID&gt;.conf</code>. Geralmente tem mais sobrecarga que LXC, com isolamento através de um kernel separado.",
+      "seeAlso": [
+        {
+          "label": "Gestão de VM e contentores",
+          "href": "/docs/help-info/vm-ct-commands"
+        }
+      ]
+    },
+    {
+      "term": "vzdump",
+      "category": "Proxmox",
+      "definitionRich": "Ferramenta de cópias Proxmox para VM e CT. Os arquivos em ficheiros <strong>não são incrementais</strong>; os destinos PBS permitem transferências incrementais. As tarefas configuram modo (snapshot / suspend / stop), compressão (como zstd, gzip ou lzo), retenção e notificações.",
+      "seeAlso": [
+        {
+          "label": "Comandos de cópias e restauro",
+          "href": "/docs/help-info/backup-commands"
+        }
+      ]
+    },
+    {
+      "term": "ZFS",
+      "aliases": [
+        "Zettabyte File System"
+      ],
+      "category": "Armazenamento",
+      "definitionRich": "Sistema de ficheiros e gestor de volumes com snapshots, replicação send/receive, somas de verificação e compressão. Pode reparar dados corrompidos se existir uma cópia redundante válida. A cache <strong>ARC</strong> utiliza RAM e pode ser limitada.",
+      "seeAlso": [
+        {
+          "label": "Comandos de gestão ZFS",
+          "href": "/docs/help-info/zfs-commands"
+        }
+      ]
+    }
+  ]
+}
diff --git a/web/messages/pt/docs/hardware/coral-tpu-lxc.json b/web/messages/pt/docs/hardware/coral-tpu-lxc.json
new file mode 100644
index 00000000..c308f707
--- /dev/null
+++ b/web/messages/pt/docs/hardware/coral-tpu-lxc.json
@@ -0,0 +1,120 @@
+{
+  "meta": {
+    "title": "Adicionar Coral TPU ao LXC | Documentação ProxMenux",
+    "description": "Partilhe um Google Coral TPU USB ou M.2 / PCIe com um LXC Proxmox. O ProxMenux configura dispositivos, permissões e montagens, inicia o contentor e instala o runtime Edge TPU em distribuições compatíveis."
+  },
+  "header": {
+    "title": "Adicionar Coral TPU ao LXC",
+    "description": "Partilhe um Coral USB Accelerator ou M.2 / Mini-PCIe com um LXC. O ProxMenux configura o contentor e o runtime Edge TPU. Esta opção trata apenas da TPU: para Quick Sync, VA-API ou NVENC, execute também Adicionar GPU ao LXC.",
+    "section": "Hardware: GPUs e Coral-TPU"
+  },
+  "intro": {
+    "title": "O que faz",
+    "body": "Escreve a configuração em <code>/etc/pve/lxc/&lt;ctid&gt;.conf</code> para <strong>USB Accelerator</strong>, <strong>Coral M.2 / PCIe</strong> ou ambos. Inicia o contentor e instala o runtime Google <code>libedgetpu</code>. O GPU configura-se separadamente em <lxcGpuLink>Adicionar GPU ao LXC</lxcGpuLink>."
+  },
+  "whenUse": {
+    "heading": "Quando utilizar",
+    "body": "Para <frigateLink>Frigate</frigateLink> ou outra aplicação Linux compatível em LXC. O Coral executa a inferência ML suportada em vez da CPU. O desempenho depende do modelo e do hardware; descodificação de vídeo e outras tarefas continuam a consumir recursos."
+  },
+  "prereqs": {
+    "title": "Antes de começar",
+    "drivers": "<strong>Prepare o dispositivo Coral no anfitrião</strong>. M.2 / PCIe exige o controlador do anfitrião carregado; USB exige acesso ao dispositivo e permissões adequadas. Consulte <hostLink>Instalar Coral TPU no anfitrião</hostLink>. O script instala o runtime da aplicação em contentores Debian/Ubuntu; as outras distribuições têm de o disponibilizar separadamente.",
+    "driversCheck": "ls /dev/apex_* 2>/dev/null ; lsusb | grep -E '1a6e:089a|18d1:9302'",
+    "container": "<strong>Um LXC existente</strong>, de preferência baseado em <strong>Debian / Ubuntu</strong>: a instalação utiliza <code>apt-get</code>. Os <strong>contentores de outras distribuições</strong> podem usar o <strong>modo apenas de passagem direta</strong>, que omite a instalação APT de <code>libedgetpu</code>. É útil se a aplicação já incluir o runtime, como a imagem Docker Frigate.",
+    "downtime": "<strong>Preveja uma breve interrupção</strong> do contentor. O script para-o para alterar a configuração e inicia-o para instalar o runtime. Estas alterações não exigem reiniciar o anfitrião."
+  },
+  "hostPrep": {
+    "title": "Prepare primeiro o anfitrião",
+    "body": "M.2 / PCIe exige <code>gasket</code>/<code>apex</code> no anfitrião e um dispositivo funcional. USB exige dispositivo ligado e permissões; a aplicação não precisa de executar no anfitrião. <code>libedgetpu</code> deve estar onde a aplicação executa. Ordem: <strong>preparar anfitrião → acesso LXC → configurar aplicação</strong>."
+  },
+  "running": {
+    "heading": "Executar o script",
+    "body": "No ProxMenux, abra <strong>Hardware: GPU e Coral-TPU → Adicionar Coral TPU ao LXC</strong>.",
+    "imageAlt": "Opção Adicionar Coral TPU ao LXC no menu de hardware"
+  },
+  "howRuns": {
+    "heading": "Como funciona o script",
+    "body": "Escolha o contentor. O script configura o acesso USB mesmo sem Coral USB ligado e acrescenta M.2 / PCIe quando deteta esse hardware."
+  },
+  "walkthrough": {
+    "heading": "Procedimento passo a passo",
+    "pick": {
+      "title": "Escolha o contentor LXC",
+      "body": "O seletor mostra os contentores elegíveis de <code>pct list</code>; os OCI são ocultados e geridos em Apps no gestor OCI. Escolha um, iniciado ou parado. O script para-o se necessário, configura-o e inicia-o para instalar o runtime."
+    },
+    "gpuHint": {
+      "title": "Sugestão opcional de acesso ao GPU",
+      "body": "Se for detetado um GPU não configurado para este contentor, uma caixa de diálogo recomenda <lxcGpuLink>Adicionar GPU ao LXC</lxcGpuLink> para descodificação de vídeo por hardware, como Quick Sync, VA-API ou NVENC. Pergunta se pretende continuar apenas com Coral: Sim continua a configuração do TPU; Não sai para que possa configurar primeiro o GPU."
+    },
+    "usb": {
+      "title": "Configurar acesso USB no LXC",
+      "body": "Cria uma regra udev no anfitrião para <code>/dev/coral</code> e monta a árvore <strong>completa</strong> <code>/dev/bus/usb</code> no contentor. A configuração é escrita mesmo sem Coral USB ligado e expõe outros dispositivos além do Coral.",
+      "whyTitle": "Porquê montar o /dev/bus/usb em vez do /dev/coral?",
+      "whyBody": "O caminho USB, como <code>/dev/bus/usb/001/005</code>, muda ao voltar a ligar o acelerador. As versões antigas montavam a ligação <code>/dev/coral</code> e podiam manter um caminho desatualizado. Montar toda a árvore USB permite ver o dispositivo atual. A aplicação poderá ter de voltar a abrir o dispositivo."
+    },
+    "pcie": {
+      "title": "Configurar acesso M.2 / PCIe no LXC",
+      "body1": "Se detetar Coral M.2 / PCIe e existir <code>/dev/apex_0</code>, utiliza a API Proxmox <code>dev</code> para gerir cgroup2 em LXC com e sem privilégios:",
+      "body2": "Se <code>/dev/apex_0</code> estiver ausente após <hostLink>Instalar Coral no anfitrião</hostLink>, o script escreve um bind mount com <code>create=file</code> e, apenas quando o número major do apex consta de <code>/proc/devices</code>, uma regra cgroup2 clássica. Nenhum dos dois cria um dispositivo funcional:",
+      "rebootTitle": "Reiniciar o host primeiro se você acabou de instalar os drivers Coral",
+      "rebootBody": "A montagem alternativa não carrega <code>apex</code> no anfitrião. Carregue o controlador ou reinicie após a instalação e verifique o dispositivo. Execute novamente o script para aplicar a entrada moderna e reinicie o contentor."
+    },
+    "drivers": {
+      "title": "Iniciar o LXC e instalar o runtime Coral",
+      "body": "Inicia o contentor e aguarda até 15 segundos pelo estado running; depois utiliza <code>pct exec</code> para executar o instalador no interior. O instalador:",
+      "items": [
+        "Corre <code>apt-get update</code>.",
+        "Instala os pré-requisitos do repositório Coral: <code>gnupg</code>, <code>curl</code>, <code>ca-certificates</code>.",
+        "Importa a chave Coral GPG do Google para <code>/etc/apt/keyrings/coral-edgetpu.gpg</code> (caminho moderno, o mesmo que o instalador do host usa) e adiciona o repositório <code>coral-edgetpu-stable</code> APT com <code>signed-by=</code>.",
+        "Instala <code>libedgetpu1-std</code> por predefinição. Se detetar Coral M.2, oferece <code>libedgetpu1-std</code> ou <code>libedgetpu1-max</code>. A escolha do pacote não configura por si só a deteção na aplicação."
+      ],
+      "noIgpuTitle": "Porque não são instalados controladores iGPU aqui?",
+      "noIgpuBody": "Antes instalava também <code>va-driver-all</code>, <code>intel-opencl-icd</code> e outros pacotes Intel para combinar Quick Sync e Coral. Isso causava falhas confusas quando se pretendia apenas Coral. Agora o iGPU configura-se em <lxcGpuLink>Adicionar GPU ao LXC</lxcGpuLink>; execute-o primeiro para descodificação de vídeo por hardware.",
+      "debianTitle": "Outras distribuições: apenas acesso ao dispositivo",
+      "debianBody": "Utiliza <code>apt-get</code> em Debian/Ubuntu. Para <strong>Alpine, Arch, RHEL ou SUSE</strong>, detetados por <code>/etc/os-release</code>, oferece <em>continuar apenas com acesso ao dispositivo</em> ou <em>cancelar</em>. A primeira opção configura <code>/etc/pve/lxc/&lt;ctid&gt;.conf</code> sem instalar <code>libedgetpu</code>. Se a aplicação já incluir o runtime, como Frigate Docker, esse modo basta. Caso contrário, instale <code>libedgetpu</code> seguindo o <coralLink>guia oficial Google</coralLink>."
+    },
+    "summary": {
+      "title": "Resumo",
+      "body": "No final apresenta Coral USB e M.2 com ✓ ou ⚠ conforme a deteção do hardware. O contentor fica iniciado para configurar Frigate, CodeProject.AI ou a sua aplicação."
+    }
+  },
+  "manual": {
+    "heading": "Procedimento manual equivalente",
+    "body": "Se você quiser ver exatamente o que vai para a configuração LXC, ou aplicá-lo à mão:",
+    "usbHeading": "USB Coral",
+    "pcieHeading": "M.2 / PCIe Coral",
+    "runtimeHeading": "No contentor: runtime Coral"
+  },
+  "verification": {
+    "heading": "Verificação",
+    "body": "Abra uma consola no contentor e confirme que o Coral está visível:"
+  },
+  "troubleshoot": {
+    "heading": "Resolução de problemas",
+    "apexTitle": "LXC iniciado, mas falta /dev/apex_0",
+    "apexBody": "Verifique primeiro o controlador do anfitrião: <code>lsmod | grep apex</code>. Se faltar, tente <code>modprobe apex</code> ou reinicie após a instalação do controlador. Quando existir <code>/dev/apex_0</code> no anfitrião, verifique a entrada de dispositivo LXC (volte a executar o script se só foram escritas as entradas alternativas) e reinicie o contentor com <code>pct stop &lt;ctid&gt; &amp;&amp; pct start &lt;ctid&gt;</code>.",
+    "replugTitle": "Coral USB desaparece ao ligar noutra porta",
+    "replugBody": "Confirme que o LXC monta <code>/dev/bus/usb</code> em vez da ligação <code>/dev/coral</code>. A configuração deve incluir <code>lxc.mount.entry: /dev/bus/usb dev/bus/usb ...</code> sem depender diretamente de <code>/dev/coral</code>. Execute novamente o script se a configuração for antiga.",
+    "alpineTitle": "Alpine / Arch / RHEL / SUSE: runtime não instalado",
+    "alpineBody": "O <em>modo apenas de passagem direta</em> configura o dispositivo sem instalar <code>libedgetpu</code>. Use um pacote compatível ou compile o código; verifique a disponibilidade antes de comandos como <code>apk add</code> em Alpine. O Frigate pode incluir o runtime. Com Docker no LXC, encaminhe também M.2 com <code>--device /dev/apex_0:/dev/apex_0</code> ou monte USB no Docker: a montagem LXC não basta.",
+    "frigateTitle": "Frigate apresenta «Coral EdgeTPU detected but not available»",
+    "frigateBody": "Verifique runtime, visibilidade e acesso de leitura/escrita do processo real. Para USB, examine permissões e eventual grupo <code>plugdev</code>. Para M.2, inspecione <code>/dev/apex_0</code> com <code>ls -l /dev/apex_0</code>. Um nome como <code>apex</code> em <code>/etc/group</code> não basta: GID numéricos e mapeamentos LXC devem coincidir. Verifique se outro processo ocupa a TPU; não passe logo para modo privilegiado.",
+    "logsTitle": "Verificar os registos da máquina e do contentor",
+    "logsBody": "No anfitrião, veja as mensagens do kernel com <code>journalctl -k | grep -i -e apex -e gasket -e usb</code>. No LXC, consulte os registos da aplicação; com Docker aninhado use <code>docker logs &lt;container&gt;</code>. Permissões, runtime ausente, ligação USB ou outro processo a utilizar a TPU podem causar falhas."
+  },
+  "related": {
+    "heading": "Relacionados",
+    "items": [
+      {
+        "label": "Instalar Coral TPU no anfitrião",
+        "href": "/docs/hardware/install-coral-tpu-host",
+        "tail": " — requisito para utilizar placas Coral M.2 / PCIe num CT."
+      },
+      {
+        "label": "Adicionar GPU ao LXC",
+        "href": "/docs/hardware/igpu-acceleration-lxc",
+        "tail": " — acesso GPU, frequentemente combinado com Coral no Frigate."
+      }
+    ]
+  }
+}
diff --git a/web/messages/pt/docs/hardware/gpu-vm-passthrough.json b/web/messages/pt/docs/hardware/gpu-vm-passthrough.json
new file mode 100644
index 00000000..fb47b60b
--- /dev/null
+++ b/web/messages/pt/docs/hardware/gpu-vm-passthrough.json
@@ -0,0 +1,178 @@
+{
+  "meta": {
+    "title": "Adicionar GPU a VM | Documentação ProxMenux",
+    "description": "Atribua uma GPU física a uma VM Proxmox. O ProxMenux verifica IOMMU, configura VFIO e dispositivos VM e deteta conflitos com outras VM ou LXC."
+  },
+  "header": {
+    "title": "Adicionar GPU a VM (passthrough)",
+    "description": "Deteta GPU Intel, AMD ou NVIDIA para acesso direto numa VM. Verifica IOMMU e dispositivos associados, configura VFIO e VM e aplica regras de compatibilidade. Verifique todos os dispositivos afetados.",
+    "section": "Hardware: GPUs e Coral-TPU"
+  },
+  "intro": {
+    "title": "O que faz",
+    "body": "Automatiza os passos do anfitrião e <code>hostpci</code> da <pveLink>documentação PCI passthrough Proxmox</pveLink>. Verifica atribuições a <em>outros</em> convidados e propõe soluções para conflitos. Não garante suporte para qualquer GPU, método de reset ou controlador convidado."
+  },
+  "who": {
+    "heading": "Para quem é isto?",
+    "body": "Para uma <strong>máquina virtual</strong> usar diretamente a GPU via VFIO. Enquanto estiver associada a VFIO, o controlador do anfitrião não a pode usar, mesmo com a VM parada. Para partilha com <em>LXC</em>, use <lxcLink>Adicionar GPU ao LXC</lxcLink>."
+  },
+  "prereqs": {
+    "title": "Antes de começar",
+    "gpu": "<strong>GPU compatível</strong> fisicamente instalada. O script deteta Intel, AMD e NVIDIA com <code>lspci</code>.",
+    "gpuCheck": "lspci | grep -iE 'VGA|3D|Display'",
+    "iommu": "<strong>Suporte IOMMU</strong> no hardware e ativação no firmware quando necessária (Intel VT-d ou AMD-Vi). Verifica o sistema e pode configurar Linux; não muda BIOS/UEFI nem prova que IOMMU inativo esteja desativado no firmware.",
+    "q35": "O assistente exige <strong>q35</strong> e recusa <code>i440fx</code>. O tipo de máquina é distinto do firmware BIOS/UEFI. Mudar o chipset de uma VM existente exige planeamento e não é automático.",
+    "q35Check": "qm config VMID | grep machine",
+    "moreGpus": "Prepare <strong>outra GPU ou acesso alternativo</strong> por SSH, IPMI ou série. Reservar a GPU principal pode retirar a imagem local. Em <em>NVIDIA</em>, uma placa fora do grupo IOMMU afetado pode ficar no anfitrião.",
+    "nvidiaInstalled": "Após <nvidiaLink>instalar NVIDIA no anfitrião</nvidiaLink>, as funções escolhidas ficam reservadas a <code>vfio-pci</code> em vez de <code>nvidia</code>. O módulo <code>nvidia</code> pode continuar disponível para <strong>outras</strong> placas fora do grupo IOMMU afetado. Verifique com <code>nvidia-smi</code>."
+  },
+  "pickOne": {
+    "title": "Atribuição exclusiva VM ou partilha LXC",
+    "body": "Um GPU ligado a <code>vfio-pci</code> para a passagem de VM não pode ser usado simultaneamente pelo hospedeiro ou por um LXC. Se você tiver duas GPUs, você pode dedicar uma a cada caminho. Se você tem apenas um, escolha:",
+    "vmItem": "<strong>VM:</strong> acesso direto e exclusivo para essa VM.",
+    "lxcItem": "<strong>LXC (<lxcLink>Adicionar GPU ao LXC</lxcLink>):</strong> partilha o dispositivo com anfitrião e outros contentores pelo controlador nativo."
+  },
+  "running": {
+    "heading": "Executar o instalador",
+    "body": "Abra o ProxMenux e escolha <strong>Hardware: GPU e Coral-TPU → Adicionar GPU a VM</strong>.",
+    "imageAlt": "Opção do menu para adicionar GPU a VM"
+  },
+  "howRuns": {
+    "heading": "Como funciona o script",
+    "body": "Deteção e seleção precedem as alterações principais, confirmadas num resumo final. Ativar IOMMU tem confirmação anterior e pode já alterar o arranque. A limpeza posterior de áudio pode também pedir uma escolha."
+  },
+  "walkthrough": {
+    "heading": "Procedimento passo a passo",
+    "detect": {
+      "title": "Detectar GPUs e verificar IOMMU",
+      "body": "Considera o IOMMU ativo apenas quando o kernel em execução tem <code>intel_iommu=on</code> ou <code>amd_iommu=on</code> e existem grupos IOMMU. Se o parâmetro já estiver guardado para o próximo arranque, continua em modo de reinício pendente; caso contrário, um passo confirmado separadamente pode adicioná-lo com <code>iommu=pt</code>. A sua heurística de ficheiro de arranque utiliza <code>/etc/kernel/cmdline</code> quando aí existe uma marca de raiz ZFS como <code>root=ZFS=</code>; caso contrário, utiliza <code>/etc/default/grub</code>. Essa heurística não é prova do carregador de arranque real. O IOMMU recém-configurado entra em vigor após o reinício; verifique depois os grupos reais.",
+      "tipTitle": "Já configurou a pós-instalação?",
+      "tipBody": "Se o <postLink>suporte VFIO IOMMU</postLink> já estiver configurado e ativo no kernel, passa a verificação. Uma definição para o próximo arranque não prova que esteja ativo agora.",
+      "imageAlt": "Lista de GPUs detectadas com fornecedor e endereço PCI"
+    },
+    "preflight": {
+      "title": "Escolher GPU e executar verificações prévias",
+      "intro": "Uma vez que você escolher o GPU, o script executa uma série de verificações que podem cada bloco mais progresso:",
+      "items": [
+        "<strong>Proteção SR-IOV.</strong> Recusa VF e PF com VF ativas porque configura dispositivos completos, não SR-IOV. Configure SR-IOV separadamente em hardware compatível.",
+        "<strong>Uma só GPU.</strong> A consola local pode perder a imagem ao reservá-la para VFIO. Verifique antes o acesso SSH ou web de outro computador.",
+        "<strong>Política de reset AMD.</strong> Lê <code>/sys/bus/pci/devices/&lt;pci&gt;/reset_method</code>. APU ou dedicada sem FLR fica <em>bloqueada pela política do assistente</em>; subtipo desconhecido sem FLR exige confirmação. Não prova impossibilidade universal.",
+        "<strong>Estado D3cold.</strong> Bloqueia placas AMD que indicam <code>D3cold</code> pelo risco de falha na ativação. Verifique alimentação e firmware.",
+        "<strong>Análise do grupo IOMMU.</strong> Lê <code>/sys/kernel/iommu_groups/</code> e inclui no plano da VM <em>todos os membros exceto pontes</em>, possivelmente controladores de rede ou de armazenamento. Se o grupo contiver dispositivos de outro slot, o script lista-os antes do resumo; verifique se o anfitrião não precisa de nenhum. Se o IOMMU aguardar reinício, os grupos reais não estão disponíveis e o plano contém inicialmente só a função GPU selecionada; verifique o isolamento após o reinício."
+      ],
+      "audioIntro": "<strong>Áudio associado.</strong> Dois casos consoante a localização do controlador:",
+      "audioDgpu": "<strong>GPU dedicada:</strong> o áudio HDMI ocupa frequentemente a função <code>.1</code> da mesma ranhura PCI e é incluído se detetado. Se o anfitrião o usava, perde acesso ao reservá-lo à VM.",
+      "audioIgpu": "<strong>Sem função áudio <code>.1</code>:</strong> pode estar noutro dispositivo como <code>00:1f.3</code>. Lista controladores e drivers como <code>snd_hda_intel</code>. Por predefinição <strong>nenhum</strong> é selecionado; escolha apenas os necessários."
+    },
+    "pickVm": {
+      "title": "Escolha a VM de destino",
+      "body": "Escolha a VM. Exige q35 e reutiliza entradas GPU existentes quando possível. BIOS/UEFI é uma definição separada, não um tipo de máquina. Não muda automaticamente o chipset nem o arranque do convidado instalado.",
+      "imageAlt": "Seleção de VM por nome, ID e estado"
+    },
+    "switchMode": {
+      "title": "Tratar atribuições existentes",
+      "intro": "O script verifica cada configuração do VM e cada configuração do LXC na máquina à procura do GPU que escolheu. Três resultados possíveis:",
+      "items": [
+        "<strong>GPU disponível.</strong> Continua sem remover atribuições.",
+        "<strong>Atribuída a outra VM.</strong> Pare primeiro a origem. Pode <em>manter as entradas e desativar o arranque automático</em> ou <em>removê-las mantendo o arranque automático</em>. Com <code>vfio-pci</code> já ativo e sem alterações necessárias no anfitrião, VM→VM pode evitar reiniciá-lo.",
+        "<strong>GPU usada por LXC.</strong> Nos contentores normais escolha <em>manter a configuração da GPU e desativar o arranque automático</em> ou <em>remover a configuração do dispositivo GPU, mantendo o arranque automático</em>. A remoção elimina as entradas <code>devN</code> e, em AMD/Intel, também as regras antigas <code>/dev/dri</code> <code>lxc.mount.entry</code> e <code>lxc.cgroup2.devices.allow</code>. Os contentores OCI conservam a configuração e são parados com o arranque automático desativado; remova a sua GPU através de OCI manager Apps. A deteção de conflitos é feita por família de dispositivos GPU e pode abranger outras placas dessa família."
+      ],
+      "imageAlt": "Oferecendo diálogo para remover o GPU de um LXC antes de atribuí-lo ao VM",
+      "smartTitle": "Rever áudio associado ao remover a GPU",
+      "smartBody": "Depois pode propor uma lista de <strong>áudio possivelmente sem uso</strong> na VM origem. Desmarque o que ainda precisar. Por exemplo, pode manter <code>02:00.1</code> e propor remover <code>00:1f.3</code>. A lista determina as remoções adicionais, sem garantir todas as associações áudio/imagem."
+    },
+    "audioPick": {
+      "title": "Sem áudio .1, selecione os controladores necessários",
+      "body": "Apenas acontece para configurações de áudio dividido Intel iGPU e semelhantes. Uma lista de verificação mostra cada controlador de áudio PCI no host (excluindo qualquer já no grupo IOMMU do GPU), etiquetado com seu driver atual. Selecione os que você deseja — ou nenhum, se o VM não precisar de áudio do hardware do host.",
+      "imageAlt": "Diálogo de lista de verificação com cada controlador de áudio PCI da máquina (controlador BDF +) quando o GPU não tem áudio .1",
+      "warnTitle": "Não selecione áudio necessário ao anfitrião",
+      "warnBody": "Atribuir áudio pode retirar acesso ao anfitrião; o controlador não pode pertencer também a outra VM ativa. Não selecione áudio desnecessário e verifique as atribuições. O sinal da consola não vem necessariamente do áudio PCI."
+    },
+    "summary": {
+      "title": "Rever o resumo da confirmação",
+      "body": "Verifique o plano final do anfitrião e da VM e cancele se estiver incorreto. Mostra o grupo IOMMU e o número dos seus dispositivos; os membros de outro slot são listados no passo anterior. O cancelamento impede as alterações principais, mas não reverte uma alteração da configuração de arranque IOMMU confirmada separadamente antes.",
+      "imageAlt": "Resumo das alterações previstas no anfitrião e VM"
+    },
+    "hostApply": {
+      "title": "As alterações da máquina são aplicadas",
+      "intro": "A fase de aplicação altera anfitrião e VM. A limpeza áudio pode ainda pedir uma escolha. Pode modificar:",
+      "items": [
+        "<code>/etc/modules</code> — acrescenta <code>vfio</code>, <code>vfio_iommu_type1</code>, <code>vfio_pci</code> (mais <code>vfio_virqfd</code> em kernels &lt; 6.2).",
+        "<code>/etc/modprobe.d/vfio.conf</code> — AMD/Intel: <code>options vfio-pci ids=&lt;vendor:device,...&gt; disable_vga=1</code>. NVIDIA: <code>softdep nvidia pre: vfio-pci</code> (<code>_drm</code>/<code>_modeset</code>/<code>_uvm</code>); a associação efetiva é por BDF. AMD adiciona a ordem de carregamento <code>softdep</code>: <code>vfio-pci</code> → <code>radeon</code>/<code>amdgpu</code>.",
+        "Escreve <code>/etc/modprobe.d/iommu_unsafe_interrupts.conf</code> e <code>kvm.conf</code> com <code>allow_unsafe_interrupts=1</code> e <code>ignore_msrs=1</code>. São definições do script, não requisitos universais Windows/macOS; interrupções inseguras reduzem a proteção do remapeamento.",
+        "<code>/etc/modprobe.d/blacklist.conf</code>: NVIDIA — <code>nouveau</code>/<code>lbm-nouveau</code>; AMD — <code>radeon</code> + <code>amdgpu</code>; Intel — <code>i915</code>. Estas regras por fabricante podem afetar outras placas com o mesmo controlador. O módulo <code>nvidia</code> é bloqueado <strong>apenas</strong> por <code>/etc/modprobe.d/proxmenux-nvidia-vfio-blacklist.conf</code> quando <em>todas</em> as NVIDIA do anfitrião estão reservadas a VFIO.",
+        "<code>/etc/udev/rules.d/10-proxmenux-vfio-bind.rules</code> + <code>/etc/proxmenux/vfio-bind.bdfs</code> — <strong>Apenas NVIDIA.</strong> Aplica <code>ATTR'{'driver_override'}'=\"vfio-pci\"</code> no PCI ADD dos BDF registados, incluindo funções do grupo IOMMU afetado. Fora desses grupos pode manter-se <code>nvidia</code>. A política BDF não divide grupos IOMMU físicos.",
+        "<strong>Apenas AMD.</strong> Tenta extrair a ROM de <code>/sys/bus/pci/.../rom</code> ou ACPI VFCT para <code>/usr/share/kvm/vbios_&lt;vendor&gt;_&lt;device&gt;.bin</code>. Se conseguir, a VM usa <code>romfile=</code>. Uma extração válida não garante a inicialização bem-sucedida da GPU.",
+        "<strong>Apenas NVIDIA.</strong> Para e desativa <code>nvidia-persistenced</code>, <code>nvidia-powerd</code>, <code>nvidia-fabricmanager</code> só quando todas as NVIDIA estão reservadas a VFIO. Em uso misto conserva os serviços e <code>nvidia</code> para as placas nativas.",
+        "<code>update-initramfs -u -k all</code> — só é executado se alguma das acima referidas tiver realmente mudado."
+      ]
+    },
+    "vmApply": {
+      "title": "A configuração do VM é aplicada através de qm set",
+      "body": "A configuração VM em <code>/etc/pve/qemu-server/&lt;vmid&gt;.conf</code> é atualizada via <code>qm set</code> (nunca por <code>sed</code>):",
+      "after1": "Adiciona <code>x-vga=1</code> para AMD e NVIDIA, <strong>não</strong> Intel. É a política do script, não prova de que todas as iGPU Intel não têm firmware ou que a opção causa sempre bloqueios.",
+      "after2": "Linhas adicionais de <code>hostpciN</code> são adicionadas se o grupo IOMMU do GPU contém outros dispositivos que você precisa passar juntos."
+    },
+    "reboot": {
+      "title": "Reinicie se a alteração do anfitrião exigir",
+      "body": "Siga o reinício pedido se mudar arranque ou controladores e verifique a associação ativa antes de iniciar a VM. Configuração guardada não prova ativação. VM→VM com VFIO correto pode evitar reiniciar o anfitrião.",
+      "imageAlt": "Tela de resumo mostrando o que foi alterado, seguido de um prompt de reinicialização"
+    }
+  },
+  "vendors": {
+    "heading": "Notas por fabricante",
+    "nvidiaHeading": "NVIDIA",
+    "nvidiaBody": "Mantém uma solução antiga para <em>Code 43</em>: <code>hidden=1</code>, ID <code>NV43FIX</code> em <code>args</code> e <code>kvm=off</code>. Não é requisito universal das GeForce atuais: NVIDIA ativou passthrough Windows em R465. O erro pode ter outras causas; verifique GPU e controlador.",
+    "nvidiaMultiHeading": "Suporte para multi-GPU NVIDIA",
+    "nvidiaMultiBody": "Uso misto NVIDIA <strong>por BDF</strong>. Regista funções <code>vfio-pci</code> por endereço, não só ID <code>vendor:device</code>. Fora dos grupos afetados pode conservar <code>nvidia</code>; verifique com <code>nvidia-smi</code>. Não isola duas placas do mesmo grupo.",
+    "amdHeading": "AMD",
+    "amdBody": "Algumas AMD falham ao repor após parar uma VM. O assistente verifica capacidades declaradas, não todos os ciclos reais. <vendorResetLink>vendor-reset</vendorResetLink> suporta uma lista limitada e exige kernel compatível e carregamento antecipado; não é instalado. <em>RadeonResetBugFix</em> no Windows também depende do hardware, sem garantia universal.",
+    "intelHeading": "Intel iGPU",
+    "intelBody": "Atribuição completa Intel iGPU e SR-IOV são distintos. O assistente reserva o dispositivo a uma VM sem <code>x-vga=1</code>. <sriovLink>i915-sriov-dkms</sriovLink> exige hardware/kernel suportados; «UHD 630+» não é regra de compatibilidade. Planeie acesso alternativo ao anfitrião."
+  },
+  "verification": {
+    "heading": "Verificação"
+  },
+  "troubleshoot": {
+    "heading": "Resolução de problemas",
+    "code43Title": "Código 43 no Windows (NVIDIA)",
+    "code43Body": "Code 43 não prova falha de ocultação. Consulte <code>qm config VMID | grep -E \"cpu|args\"</code> com VMID real, depois <code>hidden=1</code> e <code>hv_vendor_id=NV43FIX</code>. Verifique também controlador convidado, firmware e atribuição. Repetir pode terminar se já atribuída.",
+    "amdResetTitle": "O AMD GPU funciona uma vez, falha na reinicialização do VM",
+    "amdResetBody": "Falha de reset é uma causa possível. Reiniciar ou desligar e ligar pode ajudar temporariamente. Verifique compatibilidade e carregamento antecipado de <code>vendor-reset</code>; <code>softdep amdgpu pre: vendor-reset</code> só por si não garante carregar antes de VFIO. <em>RadeonResetBugFix</em> também exige GPU compatível.",
+    "stuckBootTitle": "O arranque emperrado do VM / GPU não foi detectado",
+    "stuckBootBody": "Consulte o endereço real com <code>lspci -nnk -s PCI_ADDRESS</code>; esperado <code>Kernel driver in use: vfio-pci</code>. Substitua PCI_ADDRESS. Se permanecer o controlador nativo, verifique a política de associação, não só <code>/etc/modprobe.d/blacklist.conf</code>; NVIDIA usa estado BDF. Leia <code>dmesg | grep vfio</code>. Após corrigir, execute <code>update-initramfs -u -k all</code> e siga o reinício previsto.",
+    "darkTitle": "O console da máquina fica escuro depois de reiniciar e eu não posso SSH em",
+    "darkBody": "Um ecrã preto não prova que o anfitrião esteja parado. Se SSH também falhar, verifique rede e controladores incluídos no grupo IOMMU. Recupere por IPMI, série ou ambiente de recuperação; reveja <code>/etc/pve/qemu-server/&lt;vmid&gt;.conf</code> e reverta só atribuições/regras relacionadas. Não elimine outras configurações.",
+    "logTitle": "Verificar o registo de instalação",
+    "logBody": "Cada execução escreve <code>/tmp/add_gpu_vm.log</code>. Anexe o registo ao pedir ajuda."
+  },
+  "revert": {
+    "heading": "Reverter alterações manualmente",
+    "intro": "Pare a VM e remova só as atribuições PCI relevantes em Hardware ou com o índice explícito abaixo. Isso não devolve a GPU ao controlador nativo. Use Alterar modo da GPU para essa transição e verifique os convidados afetados."
+  },
+  "related": {
+    "heading": "Relacionados",
+    "items": [
+      {
+        "label": "Instalar Drivers NVIDIA (Host)",
+        "href": "/docs/hardware/nvidia-host",
+        "tail": " — prepara o controlador para placas mantidas no anfitrião; uma GPU em VFIO não o pode usar ao mesmo tempo."
+      },
+      {
+        "label": "Adicionar GPU ao LXC",
+        "href": "/docs/hardware/igpu-acceleration-lxc",
+        "tail": " — modelo alternativo: partilhar o GPU com vários contentores em vez de o dedicar a um VM."
+      },
+      {
+        "label": "Alterar modo da GPU (VM ↔ LXC)",
+        "href": "/docs/hardware/switch-gpu-mode",
+        "tail": " — alterna a mesma GPU entre partilha e atribuição exclusiva."
+      },
+      {
+        "label": "Comandos de passagem GPU",
+        "href": "/docs/help-info/gpu-commands",
+        "tail": " — lspci, verificação IOMMU, referência qm set hostpci."
+      }
+    ]
+  }
+}
diff --git a/web/messages/pt/docs/hardware/igpu-acceleration-lxc.json b/web/messages/pt/docs/hardware/igpu-acceleration-lxc.json
new file mode 100644
index 00000000..fe7cbeed
--- /dev/null
+++ b/web/messages/pt/docs/hardware/igpu-acceleration-lxc.json
@@ -0,0 +1,185 @@
+{
+  "meta": {
+    "title": "Adicionar GPU ao LXC | Documentação ProxMenux",
+    "description": "Partilhe GPU Intel, AMD ou NVIDIA com LXC. O ProxMenux configura dispositivos, grupos e bibliotecas conforme a distribuição; a aplicação tem de suportar e configurar a aceleração."
+  },
+  "header": {
+    "title": "Adicionar GPU ao LXC",
+    "description": "Partilha acesso GPU com LXC através dos dispositivos do anfitrião. O controlador permanece no anfitrião; as aplicações exigem bibliotecas compatíveis e configuração própria.",
+    "section": "Hardware: GPUs e Coral-TPU"
+  },
+  "intro": {
+    "title": "O que faz",
+    "body": "Adiciona entradas <code>dev&lt;N&gt;</code> a <code>/etc/pve/lxc/&lt;ctid&gt;.conf</code> para os nós <code>/dev/dri/*</code>, <code>/dev/kfd</code> ou <code>/dev/nvidia*</code> aplicáveis. Inicia o contentor, instala pacotes userspace da sua distribuição e, para Intel/AMD, alinha os grupos <code>video</code> e <code>render</code>. A aceleração das aplicações continua a exigir hardware, bibliotecas e configuração da aplicação compatíveis."
+  },
+  "compare": {
+    "heading": "Partilha LXC ou atribuição direta a uma VM",
+    "intro": "O LXC partilha o kernel e pode <em>partilhar</em> a GPU entre anfitrião e contentores. Com <vmLink>atribuição completa a uma VM</vmLink>, o dispositivo fica dedicado à VM e indisponível para o controlador do anfitrião.",
+    "headerFeature": "Característica",
+    "headerLxc": "LXC (esta página)",
+    "headerVm": "VM",
+    "rows": [
+      {
+        "feature": "O host continua usando o GPU?",
+        "lxc": "Sim",
+        "vm": "Não — exclusiva do VM"
+      },
+      {
+        "feature": "Vários contentores a partilhar um GPU?",
+        "lxc": "Sim",
+        "vm": "Não"
+      },
+      {
+        "feature": "Requer IOMMU / VFIO no host?",
+        "lxc": "Não",
+        "vm": "Sim"
+      },
+      {
+        "feature": "É necessário reiniciar?",
+        "lxc": "Normalmente não (apenas reinicie o CT)",
+        "vm": "Se mudar o controlador ou IOMMU do anfitrião; não a cada atribuição"
+      },
+      {
+        "feature": "Sistemas operativos convidados",
+        "lxc": "Apenas Linux (LXC é somente Linux)",
+        "vm": "SO convidado suportado com controlador GPU compatível"
+      }
+    ]
+  },
+  "prereqs": {
+    "title": "Antes de começar",
+    "gpu": "<strong>GPU no anfitrião</strong> Intel, AMD ou NVIDIA, detetada via <code>lspci</code>.",
+    "gpuCheck": "lspci | grep -iE 'VGA|3D|Display'",
+    "vfio": "<strong>A GPU não deve estar associada a vfio-pci.</strong> Precisa do controlador nativo do anfitrião. Se atribuída a uma VM, o script propõe <switchLink>Alterar modo da GPU</switchLink>.",
+    "nvidia": "<strong>Para NVIDIA:</strong> instale primeiro o controlador no anfitrião. As bibliotecas do contentor têm de corresponder à versão. Use <nvidiaLink>Instalar controladores NVIDIA no anfitrião</nvidiaLink>.",
+    "nvidiaCheck": "nvidia-smi",
+    "container": "<strong>Um LXC existente.</strong> O script não o cria. Suporta ambos os modos; um contentor <strong>privilegiado</strong> não é sempre necessário. Dispositivos e permissões numéricas da aplicação têm de corresponder."
+  },
+  "unpriv": {
+    "title": "Suporta contentores privilegiados e sem privilégios",
+    "body": "O script escreve entradas <code>dev&lt;N&gt;</code> para a configuração LXC e, em recipientes não privilegiados, alinha os GIDs <code>video</code> e <code>render</code> entre o host e o recipiente para que os nós do dispositivo GPU sejam alcançáveis de dentro sem que você tenha que editar manualmente <code>lxc.idmap</code>."
+  },
+  "running": {
+    "heading": "Executar o instalador",
+    "body": "Abra o ProxMenux e escolha <strong>Hardware: GPU e Coral-TPU → Adicionar GPU ao LXC</strong>.",
+    "imageAlt": "Opção do menu para adicionar GPU ao LXC"
+  },
+  "howRuns": {
+    "heading": "Como funciona o script",
+    "body": "Escolha contentor e famílias GPU e passe as verificações. Depois para e altera o contentor sem confirmação final adicional. A limpeza VFIO opcional tem confirmação separada e pode alterar antes o anfitrião."
+  },
+  "walkthrough": {
+    "heading": "Procedimento passo a passo",
+    "detect": {
+      "title": "Detectar GPUs da máquina",
+      "body": "Procura controladores GPU com <code>lspci</code>. Para NVIDIA verifica o módulo <code>nvidia</code> e <code>nvidia-smi</code>; a versão detetada determina o instalador <code>.run</code> do contentor.",
+      "tipTitle": "O NVIDIA não está pronto?",
+      "tipBody": "Se faltar o módulo ou NVIDIA não funcionar no anfitrião, use primeiro <nvidiaLink>Instalar controladores NVIDIA no anfitrião</nvidiaLink> e verifique o controlador."
+    },
+    "pickCt": {
+      "title": "Escolha um contentor LXC",
+      "body": "Lista os contentores LXC elegíveis por ID e nome; os contentores OCI são excluídos e utilizam OCI manager Apps para os dispositivos. O contentor é parado se estiver em execução, iniciado para a instalação dos controladores e normalmente reposto no estado original (em execução/parado).",
+      "imageAlt": "Seleção de um contentor LXC existente"
+    },
+    "selectGpu": {
+      "title": "Selecione as famílias GPU",
+      "body": "A lista seleciona famílias por fabricante, não um dispositivo PCI isolado. Intel/AMD adicionam os nós DRI previstos; NVIDIA os dispositivos disponíveis, eventualmente de várias placas. Uma única família é selecionada automaticamente. Verifique a lista final, sobretudo com várias GPU.",
+      "imageAlt": "Lista de famílias GPU detetadas com nome e endereço PCI"
+    },
+    "preflight": {
+      "title": "Verificações prévias",
+      "imageAlt": "Proposta de alteração de modo de uma GPU associada a vfio-pci",
+      "intro": "Três verificações, qualquer uma das quais pode bloqueá-lo ou redirecioná-lo:",
+      "items": [
+        "<strong>Proteção SR-IOV.</strong> O assistente bloqueia VF ou PF com VF ativas. É uma limitação da seleção ampla de dispositivos, não uma proibição geral em LXC. Configure-os separadamente.",
+        "<strong>Associada a vfio-pci.</strong> O controlador nativo não pode criar <code>/dev/dri/*</code> ou <code>/dev/nvidia*</code>. Propõe <switchLink>Alterar modo da GPU</switchLink>; siga as indicações de reinício e volte depois.",
+        "<strong>Já configurada.</strong> Se todos os dispositivos estiverem presentes, termina sem reinstalar bibliotecas. Continua apenas com as famílias selecionadas em falta."
+      ]
+    },
+    "applyConfig": {
+      "title": "Aplicar as alterações de configuração do LXC",
+      "body1": "Para o contentor, se estiver em execução, e altera <code>/etc/pve/lxc/&lt;ctid&gt;.conf</code>. As entradas numeradas <code>dev&lt;N&gt;</code> incluem o GID do anfitrião de <code>video</code> ou <code>render</code>. As linhas bind <code>lxc.mount.entry</code> existentes para <code>/dev/dri</code> são substituídas por entradas <code>dev:</code>; verifique a configuração e as permissões resultantes.",
+      "body2": "Exemplo após Intel + NVIDIA no mesmo recipiente:"
+    },
+    "installDrivers": {
+      "title": "Iniciar o recipiente e instalar drivers dentro",
+      "body": "Inicia o contentor e espera até cerca de 30 segundos pela resposta de <code>pct exec</code>. Deteta a distribuição por <code>/etc/os-release</code> e instala os pacotes adequados.",
+      "headerDistro": "Distribuição",
+      "headerInt": "Intel / AMD",
+      "headerNvidia": "NVIDIA",
+      "rows": [
+        {
+          "distro": "Alpine",
+          "intel": "apk add mesa-va-gallium intel-media-driver libva-utils",
+          "nvidia": "apk add nvidia-utils"
+        },
+        {
+          "distro": "Arch / Manjaro",
+          "intel": "pacman -Sy intel-media-driver mesa libva-utils",
+          "nvidia": "pacman -Sy nvidia-utils"
+        }
+      ],
+      "debianDistro": "Debian / Ubuntu / outros",
+      "debianIntel": "apt-get install va-driver-all intel-opencl-icd vainfo",
+      "debianNvidia": "Extrai <code>.run</code> no anfitrião → <code>pct push</code> → instala com <code>--no-kernel-modules --no-dkms</code>.",
+      "whyTitle": "Porque utiliza o instalador NVIDIA .run no Debian",
+      "whyBody": "Os pacotes podem não corresponder ao anfitrião. As bibliotecas <strong>têm de corresponder ao módulo carregado</strong> para NVML e <code>nvidia-smi</code>. Debian/glibc usa o <code>.run</code> dessa versão em cache, extrai e arquiva no anfitrião, transfere com <code>pct push</code> e instala com <code>--no-kernel-modules --no-dkms</code>. Alpine e Arch usam repositórios: verifique as versões."
+    },
+    "alignGids": {
+      "title": "Alinhar GIDs e restaurar o estado",
+      "body1": "Para Intel/AMD, lê os GID do anfitrião de <code>video</code> e <code>render</code>, usando 44/104 apenas como alternativa, e depois altera <code>/etc/group</code> no contentor para corresponderem; as execuções apenas com NVIDIA saltam este passo. Entradas como <code>video:44</code> e <code>render:104</code> são exemplos, não ID universais. Verifique a pertença da aplicação aos grupos e as permissões efetivas dos dispositivos.",
+      "body2": "Ao concluir normalmente, volta a parar o contentor se estava parado; se estava ativo mantém-no ativo. Se falhar o arranque ou a instalação, verifique o estado final e o registo."
+    }
+  },
+  "vendors": {
+    "heading": "Notas por fabricante",
+    "intelHeading": "Intel iGPU",
+    "intelBody": "A aceleração multimédia Intel, incluindo <em>Quick Sync</em>, depende da geração do GPU, dos codecs e da configuração da aplicação. O script partilha os que existirem de entre <code>/dev/dri/card0</code>, <code>card1</code>, <code>renderD128</code> e <code>renderD129</code>; outros números de nó não são adicionados. O anfitrião tem de os disponibilizar já através do seu controlador nativo, por exemplo <code>i915</code>.",
+    "amdHeading": "AMD",
+    "amdBody": "AMD usa DRI para Mesa/VA-API. Se existir <code>/dev/kfd</code> no anfitrião, também o partilha. ROCm/OpenCL exige hardware e bibliotecas compatíveis; partilhar o dispositivo não instala toda a pilha ROCm.",
+    "nvidiaHeading": "NVIDIA",
+    "nvidiaBody": "Partilha os dispositivos <code>/dev/nvidia*</code>. <strong>As versões do controlador têm de corresponder</strong> para <code>nvidia-smi</code>. Debian/glibc usa o <code>.run</code> da versão do anfitrião; Alpine/Arch os repositórios. Abaixo de 2048 MiB de RAM configurada propõe um aumento temporário e depois restaura; exige também 1500 MiB livres em disco.",
+    "updateTitle": "Após atualizar NVIDIA no anfitrião, verifique as bibliotecas LXC",
+    "updateBody": "Bibliotecas antigas podem causar erros em <code>nvidia-smi</code>. O <nvidiaLink>instalador NVIDIA do anfitrião</nvidiaLink> propõe atualizar contentores. Repetir a adição pode terminar se já existirem dispositivos: não garante atualizar bibliotecas. Verifique versões e atualize os pacotes ou a instalação de utilizador adequada."
+  },
+  "verification": {
+    "heading": "Verificação",
+    "body": "No contentor verifique se a GPU está visível e utilizável."
+  },
+  "troubleshoot": {
+    "heading": "Resolução de problemas",
+    "mismatchTitle": "nvidia-smi: Failed to initialize NVML: Driver/library version mismatch",
+    "mismatchBody": "As bibliotecas não correspondem ao módulo carregado. Verifique versões e atualize o espaço de utilizador LXC. O <code>.run</code> em cache serve para Debian/glibc, mas a adição pode terminar se todos os dispositivos já existirem.",
+    "denyTitle": "Permissão negada em /dev/dri/renderD128 dentro do recipiente",
+    "denyBody": "Verifique dispositivo e permissões numéricas de <code>render</code>, depois se o utilizador pertence a <code>render</code>. Se disponível, adicione-o a <code>render</code> com <code>usermod -aG render &lt;user&gt;</code>, substituindo o marcador pela conta real. Reinicie a sessão. Mudar privilégios não é uma solução geral.",
+    "vainfoTitle": "vainfo indica: VA-API version 1.xx; failed to initialize",
+    "vainfoBody": "Verifique acesso e controlador VA-API. Os nomes variam por distribuição: por exemplo <code>intel-media-driver</code> para Intel recentes suportadas, <code>i965-va-driver</code> para antigas compatíveis e <code>mesa-va-drivers</code> para AMD. A mensagem só por si não prova que falte um pacote.",
+    "logTitle": "Registo de instalação",
+    "logBody": "Cada execução escreve <code>/tmp/add_gpu_lxc.log</code> no anfitrião. Anexe o registo ao pedir ajuda."
+  },
+  "related": {
+    "heading": "Relacionados",
+    "items": [
+      {
+        "label": "Instalar Drivers NVIDIA (Host)",
+        "href": "/docs/hardware/nvidia-host",
+        "tail": " — instale o controlador do anfitrião antes de partilhar NVIDIA."
+      },
+      {
+        "label": "Adicionar GPU a VM (passthrough)",
+        "href": "/docs/hardware/gpu-vm-passthrough",
+        "tail": " — alternativa para dedicar uma GPU a uma VM."
+      },
+      {
+        "label": "Alterar modo da GPU (VM ↔ LXC)",
+        "href": "/docs/hardware/switch-gpu-mode",
+        "tail": " — alterna a GPU entre partilha LXC e atribuição VM."
+      },
+      {
+        "label": "Comandos de passagem GPU",
+        "href": "/docs/help-info/gpu-commands",
+        "tail": " — referência rápida para comandos de shell relacionados."
+      }
+    ]
+  }
+}
diff --git a/web/messages/pt/docs/hardware/install-coral-tpu-host.json b/web/messages/pt/docs/hardware/install-coral-tpu-host.json
new file mode 100644
index 00000000..b60e4ece
--- /dev/null
+++ b/web/messages/pt/docs/hardware/install-coral-tpu-host.json
@@ -0,0 +1,203 @@
+{
+  "meta": {
+    "title": "Instalar Coral TPU no anfitrião | Documentação ProxMenux",
+    "description": "Instala componentes Coral no Proxmox VE conforme o hardware detetado: gasket/apex com DKMS para M.2 / Mini-PCIe e libedgetpu1-std para USB. Se detetar ambos, executa os dois procedimentos."
+  },
+  "header": {
+    "title": "Instalar Coral TPU no anfitrião",
+    "description": "Prepare o anfitrião Proxmox para Coral e partilha LXC. Deteta M.2 / Mini-PCIe, USB ou ambos e executa o procedimento adequado: módulos DKMS para PCIe e runtime Google Edge TPU para USB.",
+    "section": "Hardware: GPUs e Coral-TPU"
+  },
+  "intro": {
+    "title": "O que faz",
+    "body": "Um <strong>instalador único que deteta o hardware</strong>. PCIe utiliza <code>gasket</code> e <code>apex</code> com DKMS; compilações futuras exigem código e cabeçalhos compatíveis. USB utiliza <code>libedgetpu1-std</code>. Se detetar ambos, executa os dois processos. O runtime USB deve estar onde a aplicação executa; para uso apenas em LXC não é obrigatório no anfitrião."
+  },
+  "which": {
+    "heading": "Qual Coral eu tenho?",
+    "body": "Os modelos PCIe e USB têm formatos e requisitos diferentes. O script trata ambos; identifique o dispositivo antes de executar.",
+    "headerForm": "Factor de forma",
+    "headerDetect": "Detecção",
+    "headerInstall": "Tipo de instalação",
+    "headerReboot": "Reiniciar?",
+    "pcieForm": "M.2 / Mini-PCIe",
+    "pcieFormSub": "(placas M.2 com uma ou duas Edge TPU)",
+    "pcieDetect": "ID de fabricante PCI <code>1ac1</code>",
+    "pcieInstall": "Módulo do kernel (gasket + apex) via DKMS",
+    "pcieReboot": "Sim",
+    "usbForm": "Acelerador USB",
+    "usbFormSub": "(dongle de plástico pequeno)",
+    "usbDetect": "<code>1a6e:089a</code> USB (não programado) / <code>18d1:9302</code> (programado)",
+    "usbInstall": "Runtime <code>libedgetpu1-std</code> do repositório APT Google",
+    "usbReboot": "Não"
+  },
+  "prereqs": {
+    "title": "Antes de começar",
+    "coral": "<strong>Um Coral ligado</strong> (M.2, Mini-PCIe ou USB) para instalar. Sem hardware detetado pode limpar ou remover componentes existentes, mas não instala um novo percurso de hardware.",
+    "coralCheck": "lspci -d 1ac1: ; lsusb | grep -E '1a6e:089a|18d1:9302'",
+    "internet": "<strong>Acesso à Internet</strong> no anfitrião para clonar o controlador PCIe do GitHub ou transferir <code>libedgetpu1-std</code> do repositório APT Google para USB.",
+    "headers": "<strong>Cabeçalhos do kernel disponíveis via APT</strong>: <code>proxmox-headers-$(uname -r)</code>. Necessários apenas para PCIe/M.2; o script instala-os.",
+    "reboot": "<strong>Planeie um reinício</strong> para PCIe. O script tenta carregar os módulos compilados; reiniciar permite verificar o carregamento automático."
+  },
+  "hostPrepTip": {
+    "title": "Isto só prepara a máquina",
+    "body": "Prepara o anfitrião para <em>aceder ao dispositivo</em>, sem configurar nem testar a aplicação. Para <em>usar</em> Coral numa aplicação compatível como Frigate, siga <lxcLink>Adicionar Coral TPU a um LXC</lxcLink>."
+  },
+  "running": {
+    "heading": "Executar o instalador",
+    "body": "Abra o ProxMenux no anfitrião e escolha <strong>Hardware: GPU e Coral-TPU → Instalar/atualizar Coral TPU no anfitrião</strong>.",
+    "imageAlt": "Opção do menu para instalar ou atualizar Coral TPU no anfitrião"
+  },
+  "howRuns": {
+    "heading": "Como funciona o script",
+    "body": "Deteta primeiro o hardware e prepara o plano adequado. A instalação exige confirmação."
+  },
+  "walkthrough": {
+    "heading": "Procedimento passo a passo",
+    "detect": {
+      "title": "Detecção de hardware",
+      "body": "Procura o fabricante <code>0x1ac1</code> em <code>/sys/bus/pci/devices/*/vendor</code> e usa <code>lsusb</code> para USB. Existem <strong>dois</strong> ID USB consoante o estado do firmware:",
+      "items": [
+        "<code>1a6e:089a</code> — Global Unichip, estado <em>não programado</em>, antes de o runtime carregar o firmware.",
+        "<code>18d1:9302</code> — Google, estado <em>programado</em>, após carregar o firmware."
+      ],
+      "outro": "Sem Coral detetado nem instalação existente, apresenta um aviso e termina. Componentes existentes podem abrir o menu de limpeza ou remoção."
+    },
+    "prompt": {
+      "title": "Confirmação da instalação",
+      "body": "Antes da instalação, um diálogo apresenta dispositivos e componentes previstos. Cancelar ignora a instalação. A limpeza opcional de componentes antigos tem uma confirmação anterior independente.",
+      "imageAlt": "Resumo dos dispositivos Coral e passos de instalação"
+    },
+    "pcie": {
+      "title": "PCIe: módulos gasket e apex via DKMS",
+      "body": "Executado apenas se detetar um Coral PCIe/M.2. Compila os módulos para o kernel em execução no anfitrião.",
+      "items": [
+        "<strong>Limpeza.</strong> Qualquer pacote <code>gasket-dkms</code> existente é removido antes de recompilar; se estiver num estado incorreto, o script força a sua remoção e purga.",
+        "<strong>Dependências de compilação:</strong> <code>git</code>, <code>dkms</code>, <code>build-essential</code>, <code>proxmox-headers-$(uname -r)</code>."
+      ],
+      "cloneIntro": "<strong>Clona o código do controlador.</strong> Prefere <feranickLink>feranick/gasket-driver</feranickLink>, recorrendo a <googleLink>google/gasket-driver</googleLink> se indisponível. A compilação depende da compatibilidade do kernel. Aplica estas correções ao código Google conforme a versão:",
+      "kernelPatches": [
+        "Para kernel 6.5 ou superior, substitui <code>no_llseek</code> por <code>noop_llseek</code> no código alternativo.",
+        "Kernel 6.13 ou superior: converte o argumento de <code>MODULE_IMPORT_NS(DMA_BUF)</code> numa cadeia literal."
+      ],
+      "afterItems": [
+        "<strong>Copia o código para <code>/usr/src/gasket-1.0/</code>,</strong> gera <code>dkms.conf</code> e regista-o com <code>dkms add</code>.",
+        "<strong>Compila e instala:</strong> <code>dkms build</code> e depois <code>dkms install</code>. Se falhar, mostra as últimas 50 linhas de <code>make.log</code>, se disponível.",
+        "<strong>Cria o grupo <code>apex</code> e regras udev</strong> (<code>/etc/udev/rules.d/99-coral-apex.rules</code>) para atribuir o grupo a <code>/dev/apex_*</code>.",
+        "<strong>Tenta carregar os módulos:</strong> <code>modprobe gasket</code> e <code>modprobe apex</code>."
+      ],
+      "imageAlt": "Compilação DKMS e carregamento dos módulos gasket/apex"
+    },
+    "usb": {
+      "title": "USB: runtime Edge TPU da Google",
+      "body": "Só é executado se um Acelerador USB foi detectado. Muito mais simples:",
+      "items": [
+        "<strong>Adiciona a chave GPG Google</strong> a <code>/etc/apt/keyrings/coral-edgetpu.gpg</code>.",
+        "<strong>Adiciona o repositório APT</strong> em <code>/etc/apt/sources.list.d/coral-edgetpu.list</code>; <code>signed-by=</code> limita a verificação ao respetivo chaveiro. Usa sintaxe .list numa linha, não .sources deb822.",
+        "<strong>Instala <code>libedgetpu1-std</code></strong>, o runtime Edge TPU de desempenho padrão.",
+        "<strong>Recarrega o udev</strong> e aplica as regras do pacote ao dispositivo USB."
+      ],
+      "stdTitle": "Porquê libedgetpu1-std em vez de libedgetpu1-max?",
+      "stdBody": "O pacote <code>max</code> ativa a frequência máxima suportada, aumentando desempenho, consumo e calor. Verifique a refrigeração e condições de utilização do acelerador. Os pacotes são mutuamente exclusivos; altere com <code>apt install libedgetpu1-max</code>."
+    },
+    "reboot": {
+      "title": "Reinício opcional após a instalação PCIe",
+      "body": "Após PCIe propõe reiniciar. Já tentou <code>modprobe</code>; verifique os módulos e <code>/dev/apex_0</code> com grupo <code>apex</code>. Um reinício planeado verifica o carregamento automático. Só USB não pede reinício do anfitrião.",
+      "imageAlt": "Resumo e proposta de reinício após instalação PCIe"
+    }
+  },
+  "legacyCleanup": {
+    "heading": "Limpar gasket-dkms antigo em anfitriões que só usam USB",
+    "intro": "Se <strong>não detetar Coral PCIe/M.2</strong> mas existir uma instalação antiga de <code>gasket-dkms</code>, propõe uma limpeza opcional com confirmação.",
+    "items": [
+      "Se detetar um Coral PCIe/M.2, utiliza o procedimento normal de recompilação DKMS e não propõe esta limpeza.",
+      "Purga <code>gasket-dkms</code>, remove registos DKMS e código antigo gasket e repara o estado pendente de <code>dpkg</code>/APT.",
+      "Mantém os pacotes USB <code>libedgetpu1-std</code> e <code>libedgetpu1-max</code>, pelo que o Coral USB conserva o runtime.",
+      "O script verifica que o pacote legado desapareceu e que o gerenciamento de pacotes é saudável antes de relatar o sucesso."
+    ],
+    "warningTitle": "Confirmar primeiro o hardware",
+    "warningBody": "Se esperava um Coral PCIe/M.2 e não aparece, cancele a limpeza e verifique placa, ranhura e firmware."
+  },
+  "reinstallUninstall": {
+    "heading": "Reinstalar ou desinstalar",
+    "intro": "Se detetar uma instalação PCIe com <code>gasket-dkms</code>, USB com <code>libedgetpu1-std</code>/<code>libedgetpu1-max</code> ou ambas, apresenta um menu de ações.",
+    "imageAlt": "Menu para reinstalar, atualizar ou desinstalar Coral",
+    "imageCaption": "O menu aparece se existir algum componente: registo DKMS gasket, pacote <code>libedgetpu1-*</code> ou dispositivos <code>/dev/apex_*</code>.",
+    "reinstallHeading": "Reinstalar / atualizar",
+    "reinstallBody": "Segue a instalação normal: recompila após mudar de kernel ou atualiza <code>libedgetpu1-*</code> a partir da Google. Limpa primeiro o estado DKMS anterior para evitar que uma instalação falhada bloqueie a compilação.",
+    "uninstallHeading": "Desinstalar — o que é removido",
+    "uninstallIntro": "Exige confirmação. As aplicações LXC que usam <code>/dev/apex_*</code> podem perder acesso durante a remoção ou após reiniciar. Procedimento:",
+    "uninstallItems": [
+      "Tenta descarregar <code>apex</code> e <code>gasket</code>; a utilização por processos ativos pode impedi-lo.",
+      "Remove a cada DKMS-registrado <code>gasket/&lt;version&gt;</code> entrada para que os módulos não voltem na próxima instalação do kernel.",
+      "Purga <code>gasket-dkms</code>, <code>libedgetpu1-std</code> e <code>libedgetpu1-max</code> e executa <code>apt-get autoremove --purge</code>.",
+      "Elimina <code>/etc/udev/rules.d/99-coral-apex.rules</code> e restaura o grupo predefinido de <code>60-gasket-dkms.rules</code> se ainda existir.",
+      "Verifica os membros suplementares de <code>apex</code>. <strong>Se a lista estiver vazia</strong>, tenta remover o grupo; caso contrário mantém <code>apex</code> e lista os membros. Não verifica completamente os utilizadores que o têm como grupo principal.",
+      "Remove a lista de repositórios <code>/etc/apt/sources.list.d/coral-edgetpu.list</code>, o antigo <code>coral-cloud.list</code> e chaveiros antigos chamados <code>coral-edgetpu-archive-keyring.gpg</code>. O chaveiro atual em <code>/etc/apt/keyrings/coral-edgetpu.gpg</code> não é removido por esta sequência.",
+      "Propõe reiniciar <strong>apenas se PCIe estava instalado</strong> para descarregar os módulos ainda ativos. Remover apenas USB não exige reinício."
+    ],
+    "lxcWarnTitle": "LXC contêineres com apex passagem",
+    "lxcWarnBody": "Remover os componentes do anfitrião pode interromper o acesso LXC. Planeie manutenção se aplicações compatíveis como Frigate dependem deste Coral."
+  },
+  "updates": {
+    "heading": "Notificações de atualização",
+    "intro": "O ProxMenux regista os componentes Coral e verifica PCIe/M.2 e USB separadamente. Se tiver ambos, cada variante usa a sua fonte de versões:",
+    "headerVariant": "Variante",
+    "headerTracked": "Versão registada",
+    "headerUpstream": "Fonte das versões",
+    "pcieVariant": "PCIe / M.2",
+    "pcieTracked": "Primeiro a etiqueta registada após instalar, depois a versão de <code>gasket-dkms</code> se o pacote estiver íntegro, ou a versão DKMS como alternativa. Esta não identifica o nível de correções do fork.",
+    "pcieUpstream": "Última etiqueta GitHub de <code>feranick/gasket-driver</code>; cache de sete dias e comparação do número de compilação.",
+    "usbVariant": "USB",
+    "usbTracked": "Versão apt <code>libedgetpu1-std</code> ou <code>libedgetpu1-max</code>",
+    "usbUpstream": "Candidato local ao <code>apt-cache policy</code> (Google Coral apt repo)",
+    "outro": "Se detetar uma versão nova, o Monitor envia <code>coral_driver_update_available</code> pelos canais ativados. O aviso remete para o instalador: escolha <strong>Reinstalar / atualizar</strong>.",
+    "antiTitle": "Sem avisos repetidos",
+    "antiBody": "Um aviso por variante quando muda a versão disponível. Não repete em cada verificação diária; volta a avisar quando surgir uma versão posterior.",
+    "rebootTitle": "Atualizações PCIe: planeie um reinício",
+    "rebootBody": "O módulo PCIe recompilado tem de ser carregado; um reinício planeado verifica também o carregamento automático. Atualizar a biblioteca USB não exige reiniciar o anfitrião, mas pode exigir reiniciar as aplicações que usavam a anterior."
+  },
+  "manual": {
+    "heading": "Procedimento manual equivalente",
+    "intro": "Estes comandos mostram os principais passos de cada procedimento para consulta ou execução manual.",
+    "pcieHeading": "PCIe / M.2 (gasket + apex via DKMS)",
+    "usbHeading": "USB (runtime libedgetpu)"
+  },
+  "verification": {
+    "heading": "Verificação",
+    "pcieHeading": "PCIe / M.2",
+    "usbHeading": "USB"
+  },
+  "troubleshoot": {
+    "heading": "Resolução de problemas",
+    "dkmsFailTitle": "Falha na compilação DKMS após atualizar o kernel",
+    "dkmsFailBody": "Cabeçalhos ausentes são uma causa possível. Verifique <code>proxmox-headers-$(uname -r)</code> com <code>dpkg -l proxmox-headers-$(uname -r)</code> e instale-os se necessário. Consulte o registo para incompatibilidades com o kernel. Repetir executa <code>cleanup_broken_gasket_dkms</code>, sem garantir compatibilidade com todos os kernels.",
+    "apexMissTitle": "Falta o /dev/apex_0 após reiniciar",
+    "apexMissBody": "Verifique a deteção PCIe e se o módulo corresponde ao kernel ativo. Tente <code>modprobe apex</code> e consulte <code>dmesg | grep -iE \"apex|gasket\"</code>. Falhas de compilação, carregamento ou configuração da ranhura/firmware podem impedir a criação do dispositivo.",
+    "lxcMissTitle": "O anfitrião vê /dev/apex_0, mas o LXC não",
+    "lxcMissBody": "Um nó visível não prova o funcionamento. Verifique acesso no anfitrião, montagem LXC, regras cgroup e permissões UID/GID. Consulte <lxcLink>Adicionar Coral TPU a um LXC</lxcLink>.",
+    "usbUnreachTitle": "Acelerador USB detectado, mas Frigate / TFLite não pode alcançá-lo",
+    "usbUnreachBody": "Verifique as regras de <code>libedgetpu1-std</code> e permissões com <code>ls -l /dev/bus/usb/*/*</code>. O utilizador/grupo mapeado da aplicação precisa de leitura e escrita; root como proprietário não é um erro por si só. Após alterações, execute <code>udevadm control --reload-rules &amp;&amp; udevadm trigger</code> e volte a ligar se necessário.",
+    "logTitle": "Registo de instalação",
+    "logBody": "Cada execução escreve <code>/tmp/coral_install.log</code>. Se DKMS falhar e o registo existir, acrescenta as últimas 50 linhas de <code>/var/lib/dkms/gasket/1.0/build/make.log</code>. Anexe o registo ao pedir ajuda."
+  },
+  "related": {
+    "heading": "Relacionados",
+    "items": [
+      {
+        "label": "Adicionar Coral TPU ao LXC",
+        "href": "/docs/hardware/coral-tpu-lxc",
+        "tail": " — disponibilizar o Coral do anfitrião a um contentor com uma aplicação compatível."
+      },
+      {
+        "label": "Instalar Drivers NVIDIA (Host)",
+        "href": "/docs/hardware/nvidia-host",
+        "tail": " — a mesma ideia para as GPU NVIDIA."
+      },
+      {
+        "label": "ProxMenux Monitor — Página de hardware",
+        "href": "/docs/monitor/dashboard/hardware",
+        "tail": " — o painel Coral mostra controlador, módulos, dispositivos e runtime, além da temperatura se um sensor compatível a disponibilizar."
+      }
+    ]
+  }
+}
diff --git a/web/messages/pt/docs/hardware/nvidia-host.json b/web/messages/pt/docs/hardware/nvidia-host.json
new file mode 100644
index 00000000..9a1daf6d
--- /dev/null
+++ b/web/messages/pt/docs/hardware/nvidia-host.json
@@ -0,0 +1,175 @@
+{
+  "meta": {
+    "title": "Instalar NVIDIA no anfitrião | Documentação ProxMenux",
+    "description": "Instale controladores proprietários NVIDIA no Proxmox VE com ProxMenux: filtragem GPU, verificações de compilação e DKMS, persistência, patch NVENC opcional e atualização de bibliotecas LXC."
+  },
+  "header": {
+    "title": "Instalar controladores NVIDIA no anfitrião",
+    "description": "Instale NVIDIA no anfitrião Proxmox VE. Filtra ramos mantidos pelo ID PCI do GPU, verifica a compilação, utiliza DKMS, gere nouveau e instala persistência. Pode também atualizar bibliotecas dos LXC com acesso NVIDIA.",
+    "section": "Hardware: GPUs e Coral-TPU"
+  },
+  "intro": {
+    "title": "O que faz",
+    "body": "O ProxMenux deteta o GPU e oferece ramos NVIDIA mantidos que incluem o seu ID PCI. Bloqueia <code>nouveau</code>, descarrega o instalador oficial <code>.run</code>, utiliza DKMS, instala <code>nvidia-persistenced</code>, regras udev e o NVIDIA Container Toolkit, e oferece um patch NVENC opcional. As verificações de compilação avaliam o kernel em execução; uma compilação bem-sucedida não garante que todas as aplicações funcionem. Aos LXC NVIDIA existentes é oferecida uma atualização das bibliotecas userspace, com versão correspondente exceto em Arch."
+  },
+  "who": {
+    "heading": "Para quem é isto?",
+    "body": "Para vídeo ou cálculo acelerado com Plex, Jellyfin, Frigate, Immich ou Stable Diffusion <strong>em LXC</strong>, instale primeiro NVIDIA no <em>anfitrião</em> Proxmox. A atribuição direta a uma <strong>VM</strong> utiliza o procedimento VFIO separado."
+  },
+  "prereqs": {
+    "title": "Antes de começar",
+    "gpu": "<strong>Um GPU NVIDIA</strong> instalado no anfitrião. É detetado automaticamente; esta opção não gere AMD nem Intel.",
+    "gpuCheck": "lspci | grep -i nvidia",
+    "notVm": "O GPU <strong>não deve estar reservado para VM através de VFIO</strong>. O instalador recusa esse caso para não interferir na atribuição.",
+    "internet": "Acesso à Internet no host. O instalador baixa o driver de <code>download.nvidia.com</code> e, opcionalmente, clona <code>nvidia-persistenced</code> e <code>nvidia-patch</code> de GitHub.",
+    "space": "Reserve espaço em <code>/opt/nvidia</code> para <code>.run</code> e RAM para compilar. O percurso LXC não-Arch verifica 1500 MiB livres e pode pedir aumento temporário para 2048 MiB de RAM se inferior, restaurando depois o limite anterior. Preveja o reinício do anfitrião."
+  },
+  "vmWarn": {
+    "title": "GPU reservado para VM? Pare aqui",
+    "body": "Se algum dispositivo NVIDIA estiver associado a <code>vfio-pci</code>, o instalador sai mesmo com a VM parada. Estar reservado não implica utilização ativa. Planeie o regresso ao controlador do anfitrião e remova atribuições VM/VFIO antigas antes de reiniciar e instalar."
+  },
+  "running": {
+    "heading": "Executar o instalador",
+    "body": "Abra <strong>Hardware Graphics → NVIDIA GPU Driver Installer</strong> no ProxMenux. O menu depende de existir um controlador ativo.",
+    "imageAlt": "Menu de hardware com o instalador NVIDIA destacado"
+  },
+  "howRuns": {
+    "heading": "Como funciona o script",
+    "body": "Deteta dispositivos, escolhe uma versão e instala. Uma limpeza VFIO com confirmação separada pode ocorrer antes do resumo. Preparação de repositórios/cabeçalhos e descarga precedem a substituição do controlador; nem todas as alterações começam após uma única confirmação final."
+  },
+  "walkthrough": {
+    "detect": {
+      "title": "Detecção e visão geral do GPU",
+      "body1": "Apresenta controladores de vídeo NVIDIA, estado do controlador ou <em>«Nenhum controlador NVIDIA instalado»</em> e os LXC configurados para NVIDIA com a versão interna.",
+      "body2": "Reveja GPU e versões do anfitrião/contentores. Cancele no resumo se a seleção for inesperada; uma limpeza VFIO confirmada anteriormente já terá sido aplicada.",
+      "imageAlt": "Resumo pré-instalação: GPU, controlador e LXC NVIDIA"
+    },
+    "version": {
+      "title": "Escolha a versão do controlador",
+      "body1": "Filtra versões de <code>nvidia.com</code> que <strong>incluem o ID PCI do GPU na tabela de chips suportados</strong> e exclui versões beta/desenvolvimento por heurísticas. <em>&lt;versão&gt; — Recomendada</em> prioriza a última do ramo instalado, depois Production Branch e, por fim, o número de versão compatível mais elevado.",
+      "body2": "Se o controlador estiver registado com patch keylase, o seletor limita as versões à tabela NVENC. <em>Reinstalar / atualizar</em> mantém confirmações e opção de patch; verifique o resultado final.",
+      "whyTitle": "Como a compatibilidade do kernel é validada",
+      "whyBody": "Filtra por ramos mantidos e ID PCI, sem matriz fixa de kernel/controlador. Uma compilação prévia verifica o kernel atual. Uma falha confirmada volta ao seletor; se a verificação não estiver disponível, pode avisar e continuar. Instalação final e testes de funcionamento continuam necessários.",
+      "imageAlt": "Seletor de ramos compatíveis com GPU e recomendação no topo"
+    },
+    "uninstall": {
+      "title": "Remover o controlador anterior ao reinstalar",
+      "body": "Após descarregar e verificar o instalador escolhido, remove o controlador anterior. Para serviços NVIDIA, descarrega módulos, remove entradas DKMS e purga <code>nvidia-*</code> / <code>libnvidia-*</code> / <code>cuda-*</code>. Aplica-se também à reinstalação confirmada da mesma versão."
+    },
+    "prepare": {
+      "title": "Preparar o sistema",
+      "body": "Durante a preparação, o script:",
+      "items": [
+        "Verifica repositórios antes de remover ou instalar componentes. Sem subscrição e apenas com Enterprise, pede autorização para mudar para no-subscription; a recusa para a instalação.",
+        "Instala <code>pve-headers-$(uname -r)</code> (ou <code>proxmox-headers-$(uname -r)</code>), <code>build-essential</code> e <code>dkms</code>.",
+        "Cria o ficheiro gerido pelo ProxMenux <code>/etc/modprobe.d/proxmenux-nouveau-blacklist.conf</code> com <code>blacklist nouveau</code> e <code>options nouveau modeset=0</code>. Regista a eventual linha adicionada a <code>blacklist.conf</code> e tenta descarregar nouveau.",
+        "Escreve <code>/etc/modules-load.d/nvidia-vfio.conf</code> com <code>nvidia</code> e <code>nvidia_uvm</code> para que os módulos carreguem precocemente no arranque."
+      ]
+    },
+    "download": {
+      "title": "Baixe e execute o instalador NVIDIA",
+      "body": "Descarrega <code>NVIDIA-Linux-x86_64-&lt;version&gt;.run</code> para <code>/opt/nvidia</code> e verifica tamanho e tipo executável. São verificações de formato, não de assinatura criptográfica. Regista DKMS para recompilar com alterações do kernel; código e kernel devem continuar compatíveis.",
+      "imageAlt": "Progresso de descarga e compilação DKMS do instalador NVIDIA"
+    },
+    "persist": {
+      "title": "Serviço de persistência e regras de udev",
+      "body": "Instala <persistLink>nvidia-persistenced</persistLink> e escreve <code>/etc/udev/rules.d/70-nvidia.rules</code> para criar <code>/dev/nvidia*</code> no arranque. Evita que um LXC procure o GPU antes de os dispositivos estarem disponíveis."
+    },
+    "nvenc": {
+      "title": "Opcional: aplicar patch NVENC",
+      "body": "Os limites de sessões NVENC dependem do GPU e controlador. <patchLink>keylase/nvidia-patch</patchLink> pode remover o limite do controlador nas versões suportadas. Escolha <strong>Sim</strong> se precisar desta alteração de codificação e a versão for compatível. Não acelera descodificação nem elimina limites físicos.",
+      "supportTitle": "Verificar compatibilidade do patch",
+      "supportBody": "Procure a versão exata na <patchTableLink>tabela de patches</patchTableLink>. Se faltar, use o controlador sem patch ou outra versão mantida compatível com GPU, kernel e patch; a proximidade na lista não basta."
+    },
+    "propagate": {
+      "title": "Opcional: atualizar bibliotecas NVIDIA em LXC",
+      "body1": "Propõe atualizar bibliotecas do controlador nos LXC detetados. Estas e o módulo do anfitrião <strong>devem ter versões correspondentes</strong>; caso contrário <code>nvidia-smi</code> pode indicar «version mismatch».",
+      "body2": "Debian / Ubuntu e outros contentores glibc recebem o instalador <code>.run</code> extraído com <code>--no-kernel-modules --no-dkms --no-install-compat32-libs</code>; a RAM pode subir temporariamente para 2 GiB e ser depois restaurada. <strong>Arch, Manjaro e EndeavourOS</strong> utilizam <code>pacman -Syu nvidia-utils</code> dos repositórios, sem fixar a versão do anfitrião: verifique o resultado. <strong>Alpine</strong> recebe o conteúdo <code>.run</code> extraído por <code>pct push</code>, instala <code>gcompat</code> e <code>binutils</code> com <code>apk</code> e cria ligações SONAME com <code>readelf</code>. Verifique o funcionamento; a compatibilidade não garante todas as bibliotecas sobre musl.",
+      "imageAlt": "Diálogo com LXC NVIDIA e versões para confirmar a atualização"
+    },
+    "reboot": {
+      "title": "Reiniciar",
+      "body": "Após a instalação do controlador, o script regenera <code>initramfs</code> para todos os kernels; o seu último passo oferece reiniciar. <strong>Preveja esse reinício</strong> para verificar a configuração persistente dos módulos e do nouveau num novo arranque, mesmo que o novo controlador já responda antes do reinício."
+    }
+  },
+  "reinstallUninstall": {
+    "heading": "Reinstalar ou desinstalar",
+    "intro": "Se <code>nvidia</code> estiver carregado e <code>nvidia-smi</code> devolver uma versão, apresenta um menu de ações. O critério deteta um controlador ativo; pode haver ficheiros instalados sem o módulo carregado.",
+    "imageAlt": "NVIDIA menu de ação oferecido quando um driver já está instalado — duas opções: Reinstalar / atualizar driver, ou desinstalar o driver NVIDIA completamente",
+    "imageCaption": "O menu de ação só aparece quando um driver NVIDIA está atualmente ativo na máquina.",
+    "reinstallHeading": "Reinstalar / atualizar",
+    "reinstallBody": "Escolhe versão, prepara repositórios/cabeçalhos, descarrega e verifica a compilação antes de substituir o controlador. Permite atualizar no ramo mantido ou escolher outro suportado. Depois reapresenta as opções de bibliotecas LXC e patch NVENC.",
+    "uninstallHeading": "Desinstalar — o que é removido",
+    "uninstallIntro": "Após confirmação Sim/Não, remove os seguintes componentes:",
+    "uninstallItems": [
+      "Para e desativa <code>nvidia-persistenced</code> e <code>nvidia-powerd</code>, tenta descarregar <code>nvidia_uvm</code>, <code>nvidia_drm</code>, <code>nvidia_modeset</code> e <code>nvidia</code> e depois executa <code>nvidia-uninstall --silent</code> para a instalação <code>.run</code>. Afeta as cargas de trabalho LXC dependentes de NVIDIA; clientes ativos podem impedir a descarga.",
+      "Executa <code>apt purge</code> em <code>nvidia-*</code>, <code>libnvidia-*</code>, <code>cuda-*</code> e <code>libcudnn*</code>, remove a árvore fonte DKMS e as pastas <code>nvidia-persistenced</code> e <code>nvidia-patch</code> em <code>/opt/nvidia</code>.",
+      "Remove a configuração de carregamento <code>/etc/modules-load.d/nvidia-vfio.conf</code> e regras nouveau geridas pelo ProxMenux. Migra e remove também os antigos ficheiros ProxMenux com as duas linhas conhecidas; preserva ficheiros modificados ou não relacionados do administrador.",
+      "Remove <code>/etc/udev/rules.d/70-nvidia.rules</code> e marca NVENC como <em>removed</em> no registo de instalações geridas; não existe ficheiro de estado separado.",
+      "Regenera <code>initramfs</code> para todos os kernels, executa <code>proxmox-boot-tool refresh</code> conforme o arranque e pede reinício."
+    ],
+    "lxcWarnTitle": "LXC com acesso NVIDIA",
+    "lxcWarnBody": "Remover o controlador do anfitrião interrompe aplicações LXC NVIDIA mesmo mantendo as bibliotecas instaladas. Agende manutenção para Frigate, Plex, Jellyfin, Ollama e outras aplicações GPU."
+  },
+  "updates": {
+    "heading": "Notificações de atualizações",
+    "body": "O controlador NVIDIA é acompanhado no registo de instalações geridas. No arranque e a cada 24 horas, o Monitor compara as versões em <code>download.nvidia.com/XFree86/Linux-x86_64/</code> com a indicada por <code>nvidia-smi</code>. Notifica apenas novas versões de manutenção do ramo instalado.",
+    "kindsHeading": "Mensagem de atualização",
+    "kindsItems": [
+      "<strong>Manutenção no mesmo ramo.</strong> Exemplo: 580.65.06 instalada → 580.105.08 disponível. O Monitor não deduz compatibilidade do kernel entre ramos."
+    ],
+    "antiTitle": "Evitar notificações repetidas",
+    "antiBody": "Uma notificação por nova versão, não em cada verificação diária. Sem versão mais recente no ramo instalado, não notifica.",
+    "applyTitle": "Aplicando a atualização",
+    "applyBody": "O Monitor avisa sem instalar automaticamente. Abra o instalador, escolha <strong>Reinstalar / atualizar</strong> e uma versão suportada, e conclua compilação e instalação. Preveja o reinício proposto e verifique depois anfitrião e bibliotecas LXC."
+  },
+  "verify": {
+    "heading": "Verificando a instalação",
+    "intro": "Após reiniciar o anfitrião, entre por SSH ou pela consola Proxmox e execute:",
+    "after": "Confirme GPU e versão esperada. Podem existir processos se serviços do anfitrião ou contentores iniciados automaticamente utilizarem o GPU. Depois verifique a persistência:",
+    "imageAlt": "Saída de nvidia-smi no anfitrião com GPU detetado e versão do controlador instalada"
+  },
+  "troubleshoot": {
+    "heading": "Resolução de problemas",
+    "smiFailTitle": "nvidia-smi apresenta «NVIDIA-SMI has failed»",
+    "smiFailBody": "Causas possíveis: <strong>nouveau</strong>, <strong>cabeçalhos ausentes ou incompatíveis</strong>, código do controlador incompatível ou outros erros de carregamento. Veja <code>lsmod | grep nouveau</code>, <code>dmesg | grep -i nvidia</code> e registos do instalador/DKMS. Se precisar de corrigir nouveau, verifique <code>/etc/modprobe.d/proxmenux-nouveau-blacklist.conf</code> antes de <code>update-initramfs -u -k all</code> e reinicie. Nem toda a falha de compilação é de cabeçalhos.",
+    "lxcMissTitle": "O LXC não vê o GPU após a atualização do anfitrião",
+    "lxcMissBody": "Antes de reinstalar, verifique dispositivos do anfitrião, permissões LXC e versão das bibliotecas. Um conflito pode exigir o controlador de utilizador correspondente pelo método suportado da distribuição; em glibc usa <code>--no-kernel-modules</code>. Reinstalar bibliotecas não corrige montagens ou permissões ausentes.",
+    "logTitle": "Verificar o registo de instalação",
+    "logBody": "A instalação escreve em <code>/tmp/nvidia_install.log</code>. Em caso de falha, reveja descarga, compilação DKMS e serviços. Anexe o registo ao comunicar o problema no GitHub."
+  },
+  "manualSteps": {
+    "heading": "Procurando os passos manuais?",
+    "body": "Consulte <guideLink>Guias → NVIDIA</guideLink> para os passos manuais, incluindo <code>wget</code> e <code>./NVIDIA-Linux-...run</code>. Explica componentes sem reproduzir exatamente o instalador. O processo mantido do ProxMenux oferece filtragem GPU, verificação de compilação, atualizações LXC e controlos VFIO."
+  },
+  "related": {
+    "heading": "Relacionados",
+    "items": [
+      {
+        "label": "Adicionar GPU a VM (passagem direta)",
+        "href": "/docs/hardware/gpu-vm-passthrough",
+        "tail": " — atribuir NVIDIA diretamente a uma VM através de VFIO."
+      },
+      {
+        "label": "Adicionar GPU ao LXC",
+        "href": "/docs/hardware/igpu-acceleration-lxc",
+        "tail": " — partilhar NVIDIA com um ou vários contentores."
+      },
+      {
+        "label": "Mudar modo GPU (VM ↔ LXC)",
+        "href": "/docs/hardware/switch-gpu-mode",
+        "tail": " — alternar entre passagem direta para VM e partilha LXC."
+      },
+      {
+        "label": "ProxMenux Monitor — Página de hardware",
+        "href": "/docs/monitor/dashboard/hardware",
+        "tail": " — janela GPU que abre este instalador e mostra monitorização em tempo real."
+      },
+      {
+        "label": "Comandos de passagem direta GPU",
+        "href": "/docs/help-info/gpu-commands",
+        "tail": " — referência lspci / dmesg / IOMMU / nvidia-smi."
+      }
+    ]
+  }
+}
diff --git a/web/messages/pt/docs/hardware/switch-gpu-mode.json b/web/messages/pt/docs/hardware/switch-gpu-mode.json
new file mode 100644
index 00000000..c347520b
--- /dev/null
+++ b/web/messages/pt/docs/hardware/switch-gpu-mode.json
@@ -0,0 +1,172 @@
+{
+  "meta": {
+    "title": "Mudar modo GPU (VM ↔ LXC) | Documentação ProxMenux",
+    "description": "Mude um GPU entre VFIO para VM e controlador nativo para LXC. O ProxMenux deteta o controlador, pergunta como gerir os convidados afetados, remove áudio associado e regenera initramfs se a configuração do anfitrião mudar."
+  },
+  "header": {
+    "title": "Mudar modo GPU (VM ↔ LXC)",
+    "description": "Mude um GPU atribuído entre passagem direta para VM e partilha LXC. O ProxMenux gere controlador, VFIO, módulos e initramfs e pergunta como tratar os convidados afetados. Reveja as opções e verifique o resultado após reiniciar.",
+    "section": "Hardware: GPUs e Coral-TPU"
+  },
+  "intro": {
+    "title": "O que faz",
+    "body": "Com <code>vfio-pci</code>, o GPU fica reservado para uma VM. Com o controlador nativo <em>(i915 / amdgpu / nvidia)</em>, anfitrião e LXC podem partilhá-lo. <strong>Mudar modo GPU</strong> gere <code>vfio.conf</code>, módulos bloqueados e referências dos convidados, avisando de atribuições pendentes."
+  },
+  "graphics": {
+    "lxcTitle": "Pronto para contêineres LXC",
+    "lxcDesc": "Controlador nativo ativo",
+    "vmTitle": "Pronto para passagem de VM",
+    "vmDesc": "Controlador VFIO-PCI ativo"
+  },
+  "when": {
+    "heading": "Quando devo usar isto?",
+    "intro": "Utilize se o GPU <strong>já está atribuído</strong> e pretende mudar a utilização:",
+    "headerSituation": "Situação",
+    "headerUse": "Usar esta página?",
+    "rows": [
+      {
+        "situation": "GPU livre, nunca atribuído: utilizá-lo numa VM.",
+        "useRich": "Não — utilize <vmLink>Adicionar GPU a VM</vmLink>"
+      },
+      {
+        "situation": "GPU livre, nunca atribuído: utilizá-lo num LXC.",
+        "useRich": "Não — utilize <lxcLink>Adicionar GPU a LXC</lxcLink>"
+      },
+      {
+        "situationRich": "O GPU está atribuído a uma VM por <code>vfio-pci</code>; quero utilizá-lo num LXC.",
+        "useRich": "<strong>Sim — esta página.</strong>"
+      },
+      {
+        "situation": "O GPU é partilhado com um LXC; quero dedicá-lo a uma VM.",
+        "useRich": "<strong>Sim — esta página.</strong>"
+      },
+      {
+        "situation": "Quero remover todas as atribuições deste GPU.",
+        "use": "O modo LXC devolve o GPU ao controlador do anfitrião; a política de conflitos da VM pode remover as entradas hostpci, mas as entradas de dispositivo LXC têm de ser removidas separadamente. O GPU continua associado a um controlador."
+      }
+    ]
+  },
+  "prereqs": {
+    "title": "Antes de começar",
+    "assigned": "<strong>Um GPU já atribuído</strong> a uma VM por VFIO ou a um LXC. Para a primeira atribuição utilize Adicionar GPU a VM / LXC.",
+    "iommu": "<strong>IOMMU deve estar ativo no anfitrião</strong> ao passar <em>para</em> modo VM. Tanto as definições do firmware como o suporte do kernel são importantes. Se faltar <code>intel_iommu=on</code> ou <code>amd_iommu=on</code> no kernel em execução, o script adiciona-o com <code>iommu=pt</code> a <code>/etc/kernel/cmdline</code> (marca de raiz ZFS) ou a <code>/etc/default/grub</code> e depois executa <code>proxmox-boot-tool refresh</code> ou <code>update-grub</code>. Reveja eventuais avisos e reinicie quando solicitado.",
+    "iommuCheck": "dmesg | grep -i 'IOMMU enabled' | head -1",
+    "reboot": "<strong>Preveja um reinício.</strong> Alterações persistentes ao controlador e ao arranque podem exigir regenerar initramfs e reiniciar. O script apresenta a opção no final.",
+    "knowList": "<strong>Identifique as VM e LXC que utilizam o GPU.</strong> O script deteta referências e pergunta como tratar cada convidado; conhecer a lista facilita a revisão."
+  },
+  "blocklist": {
+    "title": "Nem todas as GPUs são seguras para passar para um VM",
+    "body": "O script bloqueia o modo VM para os ID de dispositivo <code>8086:5a84</code> e <code>8086:5a85</code>, segundo a sua política de compatibilidade. Se um GPU selecionado corresponder, interrompe a mudança para modo VM e volta à seleção do GPU, ou sai quando é o único GPU. Esta lista de bloqueio não impede passar <em>para</em> modo LXC; outras verificações podem continuar a aplicar-se."
+  },
+  "running": {
+    "heading": "Executar o script",
+    "body": "Abra <strong>Hardware: GPU e Coral-TPU → Mudar modo GPU (VM ↔ LXC)</strong> no ProxMenux.",
+    "imageAlt": "Opção Mudar modo GPU (VM ↔ LXC) no menu de hardware"
+  },
+  "howRuns": {
+    "heading": "Como funciona o script",
+    "body": "A escolha do GPU e da direção precede a mudança principal. Uma limpeza VFIO separada pode pedir confirmação antes; os convidados afetados têm os seus próprios diálogos. Leia cada confirmação: não existe uma única validação final para todas as alterações."
+  },
+  "walkthrough": {
+    "heading": "Procedimento passo a passo",
+    "detect": {
+      "title": "Detetar GPU e controlador atual",
+      "body": "Examina os controladores VGA, 3D e Display do anfitrião e consulta <code>/sys/bus/pci/devices/*/driver</code>. Apresenta nome, endereço PCI e controlador atual de cada GPU para identificar o modo.",
+      "imageAlt": "Lista de verificação GPU que mostra cada GPU detectado com seu driver atual (vfio-pci / nvidia / amdgpu / i915) e slot PCI"
+    },
+    "pickGpu": {
+      "title": "Escolher os GPU a mudar",
+      "body": "Um único GPU é selecionado automaticamente. Com vários, pode marcar mais de um, desde que estejam no <em>mesmo</em> modo. Se misturar modos, terá de reduzir a seleção.",
+      "tipTitle": "Mudar vários GPU de uma vez",
+      "tipBody": "Exemplo: passar três NVIDIA para modo VM e depois devolver o iGPU ao LXC. Duas execuções, cada uma com destino comum, em vez de mudar cada placa separadamente."
+    },
+    "direction": {
+      "title": "Rever a direcção proposta",
+      "intro": "Com base no modo atual, o script propõe o oposto como alvo:",
+      "items": [
+        "<strong>VM → LXC:</strong> remove a associação a <code>vfio-pci</code> para que o controlador nativo (<code>nvidia</code>, <code>amdgpu</code>, <code>i915</code>) possa utilizar o GPU. Para NVIDIA remove as entradas BDF correspondentes de <code>/etc/udev/rules.d/10-proxmenux-vfio-bind.rules</code> para o próximo arranque.",
+        "<strong>LXC → VM:</strong> prepara a associação a <code>vfio-pci</code>. AMD / Intel bloqueiam o controlador nativo e utilizam <code>options vfio-pci ids=…</code>. Em NVIDIA, <code>nvidia</code> só é bloqueado globalmente quando todas as GPU NVIDIA do anfitrião estão em VFIO; caso contrário, regras por BDF aplicam <code>driver_override=vfio-pci</code> aos dispositivos dos grupos IOMMU afetados, e as GPU NVIDIA fora desses grupos mantêm <code>nvidia</code>. Reveja todos os membros do grupo antes de mudar."
+      ],
+      "outro": "Confirme a direção ou cancele."
+    },
+    "conflict": {
+      "title": "Opções para cada VM ou LXC afetado",
+      "body": "Verifica <code>/etc/pve/lxc/*.conf</code> por família do controlador GPU e <code>/etc/pve/qemu-server/*.conf</code> por atribuições PCI. A deteção LXC não identifica cada placa por BDF exato. Reveja os convidados detetados e escolha como tratar cada um:",
+      "headerPolicy": "Política",
+      "headerEffect": "Efeito",
+      "headerWhen": "Quando escolher",
+      "keepPolicy": "Manter configuração e desativar arranque automático",
+      "keepEffect": "<code>pct set CTID -onboot 0</code> ou <code>qm set VMID -onboot 0</code>. Mantém as entradas GPU.",
+      "keepWhen": "Se pretende reutilizar o convidado quando o GPU voltar ao modo anterior. Escolha predefinida conservadora.",
+      "removePolicy": "Remover o GPU da configuração",
+      "removeEffect": "Remove as entradas <code>hostpci</code> / <code>dev</code> identificadas e referências antigas suportadas.",
+      "removeWhen": "Se o convidado deve funcionar sem GPU. Verifique primeiro a aplicação: a alternativa por CPU depende dela e remover o dispositivo não a reconfigura automaticamente.",
+      "imageAlt": "Diálogo para escolher como tratar cada VM ou LXC afetado"
+    },
+    "audio": {
+      "title": "Remover áudio associado ao sair do modo VM",
+      "body1": "Muitos GPU NVIDIA / AMD expõem áudio HDMI na função <code>.1</code> do mesmo slot; pode haver outros dispositivos áudio atribuídos. Remover o GPU pode deixar entradas áudio <code>hostpci</code> obsoletas. Reveja as atribuições a manter.",
+      "body2": "Identifica os endereços BDF áudio e apresenta uma lista para escolher o que remover. Elimina também os ID vendor:device de <code>/etc/modprobe.d/vfio.conf</code>, apenas se nenhuma outra VM os utilizar."
+    },
+    "apply": {
+      "title": "Aplicar alterações ao anfitrião e convidados",
+      "body": "Uma vez que você confirma, o script escreve as mudanças no lado do host — <code>vfio.conf</code>, lista negra, módulos e (para NVIDIA) a regra udev per-BDF em <code>/etc/udev/rules.d/10-proxmenux-vfio-bind.rules</code> mais o estado BDF em <code>/etc/proxmenux/vfio-bind.bdfs</code>. Aplica igualmente a política de conflitos escolhida a cada VM/LXC afectado. Se a configuração do host realmente mudou, ele executa <code>update-initramfs -u -k all</code> seguido por <code>proxmox-boot-tool refresh</code>; caso contrário ambos são ignorados."
+    },
+    "reboot": {
+      "title": "Reiniciar",
+      "body": "Reinicie o anfitrião para aplicar a nova associação persistente. Pode adiar, mas verifique o controlador ativo antes de iniciar o convidado de destino: até reiniciar pode manter-se o anterior.",
+      "imageAlt": "Diálogo de resumo que lista o que mudou, seguido pelo prompt de reinicialização"
+    }
+  },
+  "manual": {
+    "heading": "Inspeção manual",
+    "intro": "Antes de <strong>VM → LXC</strong>, verifique o controlador e a política BDF. Este exemplo NVIDIA utiliza <code>10de:2204</code>; adapte-o à sua placa. Os comandos consultam o estado; o script também gere convidados e membros do grupo IOMMU.",
+    "lxcToVm": "Antes de <strong>LXC → VM</strong>, consulte o endereço PCI e o grupo IOMMU. Substitua o endereço de exemplo e reveja todos os membros antes de atribuir dispositivos.",
+    "oneVmTitle": "Um GPU físico atribuído por VFIO só pode ser utilizado por uma VM de cada vez",
+    "oneVmBody": "Colocar várias entradas <code>hostpci</code> com o mesmo slot PCI em duas VMs é uma configuração válida, mas apenas uma das VMs pode começar com o GPU — a segunda falha. O passo da política de conflitos ProxMenux é exatamente evitar esta armadilha."
+  },
+  "verification": {
+    "heading": "Verificação após reiniciar"
+  },
+  "troubleshoot": {
+    "heading": "Resolução de problemas",
+    "stillVfioTitle": "A GPU continua a mostrar vfio-pci após a mudança para o modo LXC",
+    "stillVfioBody": "Um módulo VFIO carregado não prova qual controlador utiliza este GPU. Verifique a associação, a conclusão de <code>update-initramfs</code> e o reinício. <code>lsmod | grep vfio</code> só lista módulos. Para AMD / Intel veja <code>vfio.conf</code>; para NVIDIA, <code>/etc/proxmenux/vfio-bind.bdfs</code> e <code>/etc/udev/rules.d/10-proxmenux-vfio-bind.rules</code>. Corrija regras antigas antes de <code>update-initramfs -u -k all</code> e reinicie.",
+    "vmFailTitle": "Uma VM não inicia após passar o GPU para LXC",
+    "vmFailBody": "Verifique referências <code>hostpci</code> obsoletas. A opção <em>Remover GPU da configuração</em> pode eliminá-las durante a mudança pretendida. Antes de repetir o script, reveja a direção para não inverter o modo por engano. Em alternativa remova a atribuição no Proxmox com a VM parada.",
+    "smiFailTitle": "nvidia-smi apresenta «Driver/library version mismatch» ao voltar a LXC",
+    "smiFailBody": "Compare o módulo NVIDIA carregado com as bibliotecas instaladas, também nos LXC. Alinhe as versões: reiniciar carrega o módulo instalado, mas não corrige pacotes incompatíveis. Recarregar com <code>modprobe -r nvidia</code> e <code>modprobe nvidia</code> exige parar os clientes GPU e pode falhar com módulos dependentes em utilização.",
+    "logTitle": "Registo de execução",
+    "logBody": "Cada execução escreve em <code>/tmp/proxmenux_gpu_switch_mode.log</code> no anfitrião. Anexe o registo ao pedir ajuda no GitHub."
+  },
+  "related": {
+    "heading": "Relacionados",
+    "items": [
+      {
+        "label": "Adicionar GPU a VM (passagem direta)",
+        "href": "/docs/hardware/gpu-vm-passthrough",
+        "tail": " — configuração inicial do modo VM."
+      },
+      {
+        "label": "Adicionar GPU ao LXC",
+        "href": "/docs/hardware/igpu-acceleration-lxc",
+        "tail": " — configuração inicial do modo LXC."
+      },
+      {
+        "label": "Instalar Drivers NVIDIA (Host)",
+        "href": "/docs/hardware/nvidia-host",
+        "tail": " — exigido para o modo LXC em GPUs NVIDIA."
+      },
+      {
+        "label": "ProxMenux Monitor — Página de hardware",
+        "href": "/docs/monitor/dashboard/hardware",
+        "tail": " — secção Placas gráficas, com o modo atual e o comando para o mudar."
+      },
+      {
+        "label": "Comandos de passagem direta GPU",
+        "href": "/docs/help-info/gpu-commands",
+        "tail": " — referência rápida de comandos."
+      }
+    ]
+  }
+}
diff --git a/web/messages/pt/docs/help-info/backup-commands.json b/web/messages/pt/docs/help-info/backup-commands.json
new file mode 100644
index 00000000..ba0265e1
--- /dev/null
+++ b/web/messages/pt/docs/help-info/backup-commands.json
@@ -0,0 +1,235 @@
+{
+  "meta": {
+    "title": "Comandos de cópia de segurança Proxmox — vzdump, qmrestore, pct restore | ProxMenux",
+    "description": "Referência dos comandos de cópia de segurança e restauro do Proxmox VE: vzdump para VM e contentores LXC, qmrestore para VM, pct restore para contentores, cópias agendadas em /etc/pve/jobs.cfg, scripts de hook e caminhos a excluir.",
+    "ogTitle": "Comandos de cópia de segurança Proxmox — vzdump, qmrestore, pct restore",
+    "ogDescription": "Referência dos comandos vzdump, qmrestore e pct restore para criar e restaurar cópias de VM e contentores LXC Proxmox.",
+    "twitterTitle": "Comandos de cópia de segurança Proxmox | ProxMenux",
+    "twitterDescription": "Comandos vzdump, qmrestore e pct restore para criar e restaurar cópias de VM e contentores Proxmox."
+  },
+  "header": {
+    "title": "Cópias de segurança e restauro",
+    "description": "Referência comentada dos comandos vzdump, qmrestore e pct restore para as cópias de segurança Proxmox. Inclui agendamento, opções avançadas como scripts de hook, caminhos a excluir e prioridade de E/S, além da gestão dos ficheiros de cópia.",
+    "section": "Ajuda e informações"
+  },
+  "intro": {
+    "title": "Três modos de backup",
+    "body": "Nas VM, <strong>snapshot</strong> faz uma cópia em funcionamento sem exigir snapshots do armazenamento. <strong>suspend</strong> suspende primeiro a VM, sem necessariamente melhorar a consistência. <strong>stop</strong> desliga-a primeiro; se estava em execução, pode retomar após o início da cópia. Em LXC é diferente: snapshot exige armazenamento com snapshots, suspend usa duas passagens rsync e stop mantém o contentor parado durante toda a cópia."
+  },
+  "commandGroups": [
+    {
+      "title": "Cópia de segurança de VM",
+      "commands": [
+        {
+          "command": "vzdump <vmid>",
+          "description": "Criar uma cópia de segurança de uma VM ou de um CT específico"
+        },
+        {
+          "command": "vzdump <vmid> --storage <storage>",
+          "description": "Backup VM para armazenamento específico"
+        },
+        {
+          "command": "vzdump <vmid> --mode snapshot",
+          "description": "Criar cópia de segurança de instantâneo (para VMs)"
+        },
+        {
+          "command": "vzdump <vmid> --mode suspend",
+          "description": "Suspender a VM antes da cópia em funcionamento, modo suspend antigo"
+        },
+        {
+          "command": "vzdump <vmid> --mode stop",
+          "description": "Desligar a VM antes de iniciar a cópia"
+        },
+        {
+          "command": "vzdump --all",
+          "description": "Backup de todas as VMs e contentores"
+        },
+        {
+          "command": "vzdump --all --exclude <vmid1>,<vmid2>",
+          "description": "Cópia de segurança de todos, exceto VMs especificadas"
+        }
+      ]
+    },
+    {
+      "title": "Opções de Cópia de Segurança",
+      "commands": [
+        {
+          "command": "vzdump <vmid> --compress zstd",
+          "description": "Usar compressão zstd para backup"
+        },
+        {
+          "command": "vzdump <vmid> --compress gzip --pigz <threads>",
+          "description": "Usar pigz com várias threads"
+        },
+        {
+          "command": "vzdump <vmid> --storage <storage> --notes-template <text>",
+          "description": "Adicionar notas ao backup"
+        },
+        {
+          "command": "vzdump <vmid> --mailto <email>",
+          "description": "Enviar um e- mail de notificação"
+        },
+        {
+          "command": "vzdump <vmid> --prune-backups keep-last=<n>",
+          "description": "Manter apenas n cópias de segurança por VM"
+        },
+        {
+          "command": "vzdump <vmid> --stdexcludes 0",
+          "description": "Não excluir arquivos temporários"
+        },
+        {
+          "command": "vzdump <vmid> --quiet 1",
+          "description": "Suprimir as mensagens de saída"
+        }
+      ]
+    },
+    {
+      "title": "Restaurar backups",
+      "commands": [
+        {
+          "command": "qmrestore <backup-file> <vmid>",
+          "description": "Restaurar VM de backup"
+        },
+        {
+          "command": "qmrestore <backup-file> <vmid> --storage <storage>",
+          "description": "Restaurar para armazenamento específico"
+        },
+        {
+          "command": "qmrestore <backup-file> <vmid> --unique",
+          "description": "Restaurar a VM com novos endereços MAC aleatórios"
+        },
+        {
+          "command": "pct restore <vmid> <backup-file>",
+          "description": "Restaurar um contentor a partir de uma cópia de segurança"
+        },
+        {
+          "command": "pct restore <vmid> <backup-file> --storage <storage>",
+          "description": "Restaurar o contentor para um armazenamento específico"
+        },
+        {
+          "command": "pct restore <vmid> <backup-file> --rootfs <storage>:<size-GiB>",
+          "description": "Restaurar com o disco raiz no armazenamento e tamanho escolhidos"
+        },
+        {
+          "command": "pct restore <vmid> <backup-file> --unprivileged 1",
+          "description": "Restaurar como CT sem privilégios"
+        }
+      ]
+    },
+    {
+      "title": "Gestão de cópias de segurança",
+      "commands": [
+        {
+          "command": "ls -la /var/lib/vz/dump/",
+          "description": "Listar as cópias de segurança na localização padrão"
+        },
+        {
+          "command": "find /var/lib/vz/dump/ -name \"*.vma*\"",
+          "description": "Encontrar cópias de segurança de VM"
+        },
+        {
+          "command": "find /var/lib/vz/dump/ -name \"*.tar*\"",
+          "description": "Procurar backups de contentores"
+        },
+        {
+          "command": "pvesm list <storage> --content backup",
+          "description": "Lista de backups em armazenamento específico"
+        },
+        {
+          "command": "rm /var/lib/vz/dump/<backup-file>",
+          "description": "Apagar um ficheiro de cópia de segurança"
+        },
+        {
+          "command": "cat /etc/vzdump.conf",
+          "description": "Mostrar configuração de backup"
+        }
+      ]
+    },
+    {
+      "title": "Cópias de segurança agendadas",
+      "commands": [
+        {
+          "command": "cat /etc/pve/jobs.cfg",
+          "description": "Mostrar agendamento de backup"
+        },
+        {
+          "command": "nano /etc/vzdump.conf",
+          "description": "Editar configuração de backup"
+        },
+        {
+          "command": "systemctl list-timers",
+          "description": "Listar temporizadores do systemd"
+        },
+        {
+          "command": "systemctl status cron",
+          "description": "Verificar o estado do serviço cron"
+        },
+        {
+          "command": "pvenode task list --typefilter vzdump",
+          "description": "Listar tarefas de cópia de segurança concluídas"
+        },
+        {
+          "command": "pvenode task log <upid>",
+          "description": "Mostrar o registo de uma tarefa de cópia pelo respetivo UPID"
+        }
+      ]
+    },
+    {
+      "title": "Operações Avançadas",
+      "commands": [
+        {
+          "command": "qmrestore <backup> <vmid> --force",
+          "description": "Forçar o restauro, substituindo a VM existente"
+        },
+        {
+          "command": "vzdump <vmid> --dumpdir <directory>",
+          "description": "Especificar diretório de backup personalizado"
+        },
+        {
+          "command": "vzdump <vmid> --script <script>",
+          "description": "Executar um script de hook durante a cópia de segurança"
+        },
+        {
+          "command": "vzdump <vmid> --exclude-path <path>",
+          "description": "Excluir caminhos específicos da cópia de segurança"
+        },
+        {
+          "command": "vzdump <vmid> --ionice <priority>",
+          "description": "Definir a prioridade de E/ S para o processo de backup"
+        },
+        {
+          "command": "vzdump <vmid> --lockwait <minutes>",
+          "description": "Esperar pelo bloqueio"
+        },
+        {
+          "command": "qm importdisk <vmid> <disk-image> <storage>",
+          "description": "Importar um ficheiro de imagem de disco (por exemplo raw, qcow2 ou vmdk) como disco não utilizado, não um arquivo de backup vzdump"
+        }
+      ]
+    }
+  ],
+  "testRestores": {
+    "title": "Teste suas restaurações",
+    "bodyRich": "Restaure periodicamente uma cópia para um VMID de teste livre com <code>qmrestore --unique</code>, inicie a VM numa rede isolada e verifique o conteúdo. A opção unique gera novos endereços MAC, mas não altera IP estáticos nem definições de aplicações. Teste os contentores da mesma forma com <code>pct restore</code>."
+  },
+  "related": {
+    "heading": "Relacionado",
+    "items": [
+      {
+        "href": "/docs/help-info/vm-ct-commands",
+        "label": "Gestão de VM e CT",
+        "tail": " — comandos de ciclo de vida qm e pct."
+      },
+      {
+        "href": "/docs/help-info/storage-commands",
+        "label": "Armazenamento e Discos",
+        "tail": " — gestão de armazenamento de pvesm."
+      },
+      {
+        "href": "/docs/help-info",
+        "label": "Visão geral de ajuda e informações",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/pt/docs/help-info/gpu-commands.json b/web/messages/pt/docs/help-info/gpu-commands.json
new file mode 100644
index 00000000..d687f599
--- /dev/null
+++ b/web/messages/pt/docs/help-info/gpu-commands.json
@@ -0,0 +1,162 @@
+{
+  "meta": {
+    "title": "Comandos de passthrough de GPU no Proxmox — lspci, VFIO, IOMMU, qm set hostpci | ProxMenux",
+    "description": "Referência para passthrough de GPU no Proxmox VE: identificação de dispositivos com lspci, módulos VFIO, grupos IOMMU (intel_iommu / amd_iommu), atualizações de GRUB e initramfs, qm set hostpci0 e configuração de GPUs NVIDIA, AMD e Intel.",
+    "ogTitle": "Comandos de passthrough de GPU no Proxmox — lspci, VFIO, IOMMU, qm set hostpci",
+    "ogDescription": "Referência para inspecionar e configurar a passagem de GPU em Proxmox VE — dispositivos PCI, módulos VFIO, grupos IOMMU, parâmetros de inicialização do kernel, qm set hostpci.",
+    "twitterTitle": "Comandos de passthrough de GPU no Proxmox | ProxMenux",
+    "twitterDescription": "Inspecione dispositivos PCI, configure VFIO e IOMMU e anexe GPUs a VMs em Proxmox VE."
+  },
+  "header": {
+    "title": "Passagem de GPU",
+    "description": "Referência para inspecionar e configurar passthrough de GPU / TPU no Proxmox: identificação de dispositivos (lspci), módulos VFIO, validação de IOMMU, atualizações initramfs / GRUB e configuração por VM (qm set hostpci, machine q35, bios ovmf).",
+    "section": "Ajuda e informações"
+  },
+  "intro": {
+    "title": "IOMMU deve estar activado em BIOS / UEFI",
+    "body": "Ative primeiro IOMMU no firmware: procure <em>VT-d</em>, <em>AMD-Vi</em> ou <em>IOMMU</em> na BIOS/UEFI. No Linux, está ativo por predefinição em AMD e em Intel com kernels Proxmox 6.8 ou posteriores. Os kernels Intel anteriores podem precisar de <code>intel_iommu=on</code>. A opção <code>iommu=pt</code> controla o modo passthrough de IOMMU e não justifica desativar indiscriminadamente o framebuffer do anfitrião."
+  },
+  "commandGroups": [
+    {
+      "title": "Identificação do Dispositivo",
+      "commands": [
+        {
+          "command": "lspci -nn | grep -i nvidia",
+          "description": "Listar dispositivos PCI NVIDIA"
+        },
+        {
+          "command": "lspci -nn | grep -i vga",
+          "description": "Listar todos os dispositivos compatíveis com VGA"
+        },
+        {
+          "command": "lspci -nn | grep -i amd",
+          "description": "Listar os dispositivos PCI AMD"
+        },
+        {
+          "command": "lspci -nnk | grep -A3 VGA",
+          "description": "Listar dispositivos VGA com drivers do kernel"
+        },
+        {
+          "command": "lspci -v -s <PCI_ID>",
+          "description": "Mostrar informações detalhadas para um dispositivo PCI específico"
+        }
+      ]
+    },
+    {
+      "title": "Configuração do VFIO",
+      "commands": [
+        {
+          "command": "dmesg | grep -i vfio",
+          "description": "Verificar as mensagens do módulo VFIO"
+        },
+        {
+          "command": "cat /etc/modprobe.d/vfio.conf",
+          "description": "Reveja a configuração de passagem do VFIO"
+        },
+        {
+          "command": "ls -la /etc/modprobe.d/",
+          "description": "Listar todos os arquivos de configuração de modprobe"
+        },
+        {
+          "command": "cat /etc/modules",
+          "description": "Mostrar os módulos carregados na hora de arranque"
+        },
+        {
+          "command": "lsmod | grep vfio",
+          "description": "Verificar se os módulos VFIO estão carregados"
+        }
+      ]
+    },
+    {
+      "title": "Configuração do IOMMU",
+      "commands": [
+        {
+          "command": "cat /etc/default/grub",
+          "description": "Reveja as opções GRUB para IOMMU"
+        },
+        {
+          "command": "update-grub",
+          "description": "Aplicar as alterações do GRUB"
+        },
+        {
+          "command": "dmesg | grep -i iommu",
+          "description": "Verificar as mensagens IOMMU no registo do kernel"
+        },
+        {
+          "command": "dmesg | grep -e DMAR -e IOMMU",
+          "description": "Verificar as mensagens DMAR e IOMMU"
+        },
+        {
+          "command": "find /sys/kernel/iommu_groups/ -type l | sort -V",
+          "description": "Listar grupos IOMMU"
+        }
+      ]
+    },
+    {
+      "title": "Atualizações do sistema",
+      "commands": [
+        {
+          "command": "update-initramfs -u",
+          "description": "Aplicar alterações no initramfs (VFIO)"
+        },
+        {
+          "command": "update-initramfs -u -k all",
+          "description": "Atualizar initramfs para todos os kernels"
+        },
+        {
+          "command": "cat /proc/cmdline",
+          "description": "Mostrar os parâmetros de arranque do kernel actuais"
+        }
+      ]
+    },
+    {
+      "title": "Configuração da VM",
+      "commands": [
+        {
+          "command": "qm config <vmid> | grep hostpci",
+          "description": "Mostrar a configuração de passthrough PCI de uma VM"
+        },
+        {
+          "command": "qm set <vmid> -hostpci0 <PCI_ID>,pcie=1,x-vga=1",
+          "description": "Adicionar passthrough de GPU a uma VM"
+        },
+        {
+          "command": "cat /etc/pve/qemu-server/<vmid>.conf",
+          "description": "Ver o ficheiro de configuração VM"
+        },
+        {
+          "command": "qm set <vmid> -machine q35",
+          "description": "Configurar a VM para usar o chipset Q35, recomendado para passthrough"
+        },
+        {
+          "command": "qm set <vmid> -bios ovmf",
+          "description": "Configurar a VM com UEFI/OVMF, recomendado se a ROM da GPU suportar UEFI"
+        }
+      ]
+    }
+  ],
+  "afterChangesTip": {
+    "title": "Após alterar as configurações GRUB ou modprobe",
+    "bodyRich": "Em anfitriões com GRUB, aplique os parâmetros de arranque com <code>update-grub</code>. Atualize os módulos com <code>update-initramfs -u -k all</code> e reinicie. Outros gestores de arranque requerem o seu próprio procedimento. Verifique <code>cat /proc/cmdline</code> (parâmetros do kernel), <code>dmesg | grep -i iommu</code> (IOMMU inicializado) e <code>find /sys/kernel/iommu_groups/ -type l | sort -V</code> (grupos presentes)."
+  },
+  "related": {
+    "heading": "Relacionado",
+    "items": [
+      {
+        "href": "/docs/hardware/gpu-vm-passthrough",
+        "label": "Adicionar GPU à VM (passthrough)",
+        "tail": " — fluxo interactivo de ProxMenux."
+      },
+      {
+        "href": "/docs/hardware/igpu-acceleration-lxc",
+        "label": "Adicionar GPU ao LXC",
+        "tail": " — partilhar o acesso aos dispositivos GPU do anfitrião com um contentor LXC."
+      },
+      {
+        "href": "/docs/help-info",
+        "label": "Visão geral de ajuda e informações",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/pt/docs/help-info/index.json b/web/messages/pt/docs/help-info/index.json
new file mode 100644
index 00000000..2cd8b6ac
--- /dev/null
+++ b/web/messages/pt/docs/help-info/index.json
@@ -0,0 +1,87 @@
+{
+  "meta": {
+    "title": "Referência de comandos Proxmox — qm, pct, vzdump, zpool, pveversion | ProxMenux",
+    "description": "Seleção de comandos essenciais do Proxmox VE e Linux por tema: inspeção do sistema, gestão de VM e LXC (qm / pct), armazenamento e discos, rede, atualizações, passthrough de GPU, ZFS, cópias de segurança e restauro, e ferramentas de terminal para o dia a dia.",
+    "ogTitle": "Referência de comandos Proxmox — qm, pct, vzdump, zpool",
+    "ogDescription": "Seleção de comandos úteis do Proxmox VE e Linux por tema: sistema, VM/CT, armazenamento, rede, atualizações, passthrough de GPU, ZFS, cópias de segurança e ferramentas CLI.",
+    "twitterTitle": "Referência de comandos Proxmox | ProxMenux",
+    "twitterDescription": "Seleção de comandos úteis do Proxmox VE e Linux, agrupados por tema."
+  },
+  "header": {
+    "title": "Ajuda e informações",
+    "description": "Seleção de comandos úteis do Linux e Proxmox VE por tema. As nove categorias abrangem desde uma consulta rápida com pveversion até sequências de zfs send/receive com várias linhas. É uma referência central que complementa as secções de GPU, discos e partilhas do ProxMenux.",
+    "section": "Ajuda e informações"
+  },
+  "intro": {
+    "title": "O que é isto?",
+    "body": "Um catálogo de referência dos comandos que você realmente usa em um host Proxmox, agrupados por tópico. Dentro do ProxMenux você pode escolher um número para executar um comando diretamente ou colar o seu próprio no prompt; neste site cada categoria é uma tabela de copy-paste."
+  },
+  "opening": {
+    "heading": "Abrir o menu",
+    "body": "Do menu principal do ProxMenux, pressione <kbd>h</kbd>. Você verá isto:",
+    "imageAlt": "Menu de ajuda e informação com 9 categorias de comandos"
+  },
+  "categories": {
+    "heading": "As nove categorias",
+    "options": [
+      {
+        "icon": "Terminal",
+        "href": "/docs/help-info/system-commands",
+        "title": "Comandos úteis do sistema",
+        "description": "pveversion, uptime, free, journalctl, hostnamectl, informações do utilizador atual, auditoria com lynis e fastfetch."
+      },
+      {
+        "icon": "Cpu",
+        "href": "/docs/help-info/vm-ct-commands",
+        "title": "Gestão de VM e CT",
+        "description": "qm list / config / start / stop / migrate, pct list / config / enter, snapshots e clonagem."
+      },
+      {
+        "icon": "HardDrive",
+        "href": "/docs/help-info/storage-commands",
+        "title": "Armazenamento e Discos",
+        "description": "lsblk, blkid, smartctl, informações de montagem, pvesm status e comandos LVM."
+      },
+      {
+        "icon": "Network",
+        "href": "/docs/help-info/network-commands",
+        "title": "Comandos de rede",
+        "description": "ip / ss / nmcli, inspeção de bridges, ping / traceroute, consultas DNS e fail2ban-client."
+      },
+      {
+        "icon": "Package",
+        "href": "/docs/help-info/update-commands",
+        "title": "Atualizações e pacotes",
+        "description": "apt update / dist-upgrade, apt-cache policy, consultas dpkg e verificação dos ficheiros de repositórios."
+      },
+      {
+        "icon": "Cpu",
+        "href": "/docs/help-info/gpu-commands",
+        "title": "Passagem de GPU",
+        "description": "Verificações com lspci / dmesg, confirmação da ativação de IOMMU, associação a vfio-pci e uso da GPU pelo anfitrião."
+      },
+      {
+        "icon": "Database",
+        "href": "/docs/help-info/zfs-commands",
+        "title": "Gestão de ZFS",
+        "description": "Comandos zpool / zfs para estado, datasets, snapshots, send/receive, ajuste de ARC e TRIM."
+      },
+      {
+        "icon": "Archive",
+        "href": "/docs/help-info/backup-commands",
+        "title": "Cópias de segurança e restauro",
+        "description": "vzdump, qmrestore / pct restore, ferramentas do Proxmox Backup Server e operações com snapshots."
+      },
+      {
+        "icon": "Wrench",
+        "href": "/docs/help-info/tools-commands",
+        "title": "Ferramentas CLI do sistema",
+        "description": "tmux, screen, htop / btop, ncdu, jq, dig, lsof, watch — ferramentas de administração para o dia a dia."
+      }
+    ]
+  },
+  "tip": {
+    "title": "Pesquisada a partir da pesquisa global",
+    "body": "A pesquisa da documentação indexa todos os comandos destas páginas. Se recordar uma opção ou fragmento, mas não a página, use a barra de pesquisa no topo para encontrar diretamente a entrada certa."
+  }
+}
diff --git a/web/messages/pt/docs/help-info/network-commands.json b/web/messages/pt/docs/help-info/network-commands.json
new file mode 100644
index 00000000..0bc07c20
--- /dev/null
+++ b/web/messages/pt/docs/help-info/network-commands.json
@@ -0,0 +1,174 @@
+{
+  "meta": {
+    "title": "Comandos de rede Proxmox — ip, ping, ss, pve-firewall, iptables | ProxMenux",
+    "description": "Referência de comandos de rede do anfitrião Proxmox VE: ip / ip link / ip addr, ping, traceroute, mtr, ss, ethtool, dig, nslookup, além de pve-firewall, iptables e nftables para filtragem. Inspeção de bridges, agregações de ligações e VLAN.",
+    "ogTitle": "Comandos de rede Proxmox — ip, ping, ss, pve-firewall, iptables",
+    "ogDescription": "Referência de comandos de rede para Proxmox VE — inspeção de interface, testes de conectividade, monitoramento, firewall (pve-firewall, iptables, nftables) e pesquisas de DNS.",
+    "twitterTitle": "Comandos de rede Proxmox | ProxMenux",
+    "twitterDescription": "Comandos de inspeção, teste, configuração e firewall de rede para Proxmox VE."
+  },
+  "header": {
+    "title": "Comandos de rede",
+    "description": "Referência para a rede de host Proxmox: informações de interface, testes de conectividade, configuração, monitoramento de tráfego e gerenciamento de firewall. Combina ip / ss / nmcli / ethtool / tcpdump / pve-firewall.",
+    "section": "Ajuda e informações"
+  },
+  "intro": {
+    "title": "Inventário rápido da interface",
+    "body": "<code>ip a</code> mostra cada interface com os respetivos endereços IP e MAC. <code>ip r</code> mostra a tabela de encaminhamento. Em conjunto, respondem em segundos à maioria das dúvidas sobre a configuração de uma interface."
+  },
+  "commandGroups": [
+    {
+      "title": "Informação da Rede",
+      "commands": [
+        {
+          "command": "ip a",
+          "description": "Mostrar interfaces de rede e IPs"
+        },
+        {
+          "command": "ip r",
+          "description": "Mostrar tabela de roteamento"
+        },
+        {
+          "command": "ip -s link",
+          "description": "Mostrar estatísticas de tráfego por interface"
+        },
+        {
+          "command": "brctl show",
+          "description": "Mostrar pontes de rede configuradas"
+        },
+        {
+          "command": "cat /etc/network/interfaces",
+          "description": "Mostrar configuração de rede bruta"
+        }
+      ]
+    },
+    {
+      "title": "Testes em Rede",
+      "commands": [
+        {
+          "command": "ping <host>",
+          "description": "Verifique a conectividade com outro host"
+        },
+        {
+          "command": "traceroute <host>",
+          "description": "Rastrear a rota para uma máquina"
+        },
+        {
+          "command": "mtr <host>",
+          "description": "Combine ping e traceroute em tempo real"
+        },
+        {
+          "command": "dig <domain>",
+          "description": "Pesquisa de DNS para um domínio"
+        },
+        {
+          "command": "nslookup <domain>",
+          "description": "Pesquisa alternativa DNS"
+        }
+      ]
+    },
+    {
+      "title": "Configuração de rede",
+      "commands": [
+        {
+          "command": "ifreload -a",
+          "description": "Recarregar configuração de rede (ifupdown2)"
+        },
+        {
+          "command": "ethtool <iface>",
+          "description": "Mostrar informações do dispositivo Ethernet"
+        },
+        {
+          "command": "resolvectl status",
+          "description": "Mostrar status de resolução DNS"
+        },
+        {
+          "command": "nmcli device show",
+          "description": "Mostrar os detalhes do dispositivo de rede (se for usado o NetworkManager)"
+        },
+        {
+          "command": "ip link set <iface> up",
+          "description": "Ativar uma interface de rede"
+        },
+        {
+          "command": "ip link set <iface> down",
+          "description": "Desativar uma interface de rede"
+        }
+      ]
+    },
+    {
+      "title": "Monitorização da rede",
+      "commands": [
+        {
+          "command": "ss -tuln",
+          "description": "Mostrar portas de escuta (TCP/UDP)"
+        },
+        {
+          "command": "netstat -tuln",
+          "description": "Alternativa para mostrar portas de escuta"
+        },
+        {
+          "command": "lsof -i",
+          "description": "Listar arquivos de rede abertos e conexões"
+        },
+        {
+          "command": "tcpdump -i <iface>",
+          "description": "Capturar pacotes na interface"
+        },
+        {
+          "command": "iftop -i <iface>",
+          "description": "Monitorar a utilização da largura de banda na interface"
+        }
+      ]
+    },
+    {
+      "title": "Gestão da firewall",
+      "commands": [
+        {
+          "command": "iptables -L -n -v",
+          "description": "Mostrar regras de firewall ativas (iptables)"
+        },
+        {
+          "command": "nft list ruleset",
+          "description": "Mostrar regras nftables"
+        },
+        {
+          "command": "pve-firewall status",
+          "description": "Verifique o status do firewall Proxmox"
+        },
+        {
+          "command": "pve-firewall compile",
+          "description": "Compilar regras de firewall para todos os nós"
+        },
+        {
+          "command": "pve-firewall reload",
+          "description": "Recarregar regras de firewall Proxmox"
+        }
+      ]
+    }
+  ],
+  "iptablesTip": {
+    "title": "iptables vs nftables",
+    "bodyRich": "O serviço clássico <code>pve-firewall</code> gera regras iptables. O serviço alternativo proxmox-firewall usa <strong>nftables</strong>. Inspecione o backend iptables com <code>iptables -L -n -v</code> e o backend nftables com <code>nft list ruleset</code>. Use as ferramentas do backend ativo; estas listagens não são intercambiáveis."
+  },
+  "related": {
+    "heading": "Relacionado",
+    "items": [
+      {
+        "href": "/docs/network",
+        "label": "Gerenciamento de rede",
+        "tail": " — ferramentas de rede interactivas ProxMenux (análise de ponte, nomes persistentes, monitorização)."
+      },
+      {
+        "href": "/docs/help-info/tools-commands",
+        "label": "Ferramentas CLI do sistema",
+        "tail": " — mais instrumentos de monitorização da rede."
+      },
+      {
+        "href": "/docs/help-info",
+        "label": "Visão geral de ajuda e informações",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/pt/docs/help-info/storage-commands.json b/web/messages/pt/docs/help-info/storage-commands.json
new file mode 100644
index 00000000..5bded221
--- /dev/null
+++ b/web/messages/pt/docs/help-info/storage-commands.json
@@ -0,0 +1,232 @@
+{
+  "meta": {
+    "title": "Comandos de armazenamento e discos Proxmox — lsblk, LVM, pvesm, qm importdisk | ProxMenux",
+    "description": "Comandos de armazenamento e discos no Proxmox VE: lsblk, blkid, parted, lvdisplay, vgdisplay, pvs, mount, df, du, ncdu, pvesm status, qm importdisk e qemu-img convert para operações em discos de VM.",
+    "ogTitle": "Comandos de armazenamento e discos Proxmox — lsblk, LVM, pvesm, qm importdisk",
+    "ogDescription": "Referência de comandos de armazenamento e disco em Proxmox VE — inspeção de disco, LVM, montagens, gerenciamento de armazenamento Proxmox, importação de disco VM e conversão de imagem.",
+    "twitterTitle": "Comandos de armazenamento Proxmox | ProxMenux",
+    "twitterDescription": "Inspeção de disco, informações de montagem, gerenciamento LVM, armazenamento Proxmox e comandos de importação / conversão de disco VM."
+  },
+  "header": {
+    "title": "Armazenamento e Discos",
+    "description": "Referência para inspeção de armazenamento em hosts Proxmox: dispositivos de bloco, partições, montagens, volumes LVM, configuração de armazenamento Proxmox e algumas operações de disco VM (importdisk, qemu-img convert).",
+    "section": "Ajuda e informações"
+  },
+  "intro": {
+    "title": "Inventário rápido do disco",
+    "body": "<code>lsblk</code> mostra os dispositivos de bloco e partições em árvore. Consulte os identificadores persistentes com <code>ls -lh /dev/disk/by-id/</code>: no mesmo disco, mantêm-se normalmente após reinícios ou alterações na ordem dos dispositivos. Substituir o disco ou alterar como o controlador expõe a identidade pode mudar o caminho by-id."
+  },
+  "commandGroups": [
+    {
+      "title": "Informações do disco",
+      "commands": [
+        {
+          "command": "lsblk",
+          "description": "Listar dispositivos e partições de bloco"
+        },
+        {
+          "command": "fdisk -l",
+          "description": "Listar discos com informações detalhadas"
+        },
+        {
+          "command": "blkid",
+          "description": "Mostrar UUID e tipo de sistema de arquivos de dispositivos de bloco"
+        },
+        {
+          "command": "ls -lh /dev/disk/by-id/",
+          "description": "Listar identificadores persistentes de disco"
+        },
+        {
+          "command": "parted -l",
+          "description": "Layout detalhado da partição com informações GPT"
+        }
+      ]
+    },
+    {
+      "title": "Utilização do Armazenamento",
+      "commands": [
+        {
+          "command": "df -h",
+          "description": "Mostrar o uso do disco por ponto de montagem"
+        },
+        {
+          "command": "du -sh /path",
+          "description": "Mostrar tamanho de um diretório"
+        },
+        {
+          "command": "mount | grep ^/dev",
+          "description": "Mostrar dispositivos de armazenamento montados"
+        },
+        {
+          "command": "cat /proc/mounts",
+          "description": "Mostrar todas as montagens ativas do kernel"
+        }
+      ]
+    },
+    {
+      "title": "Gestão de LVM",
+      "commands": [
+        {
+          "command": "pvdisplay",
+          "description": "Exibir volumes físicos (LVM)"
+        },
+        {
+          "command": "vgdisplay",
+          "description": "Exibir grupos de volumes (LVM)"
+        },
+        {
+          "command": "lvdisplay",
+          "description": "Exibir volumes lógicos (LVM)"
+        },
+        {
+          "command": "pvs",
+          "description": "Saída concisa de volumes físicos"
+        },
+        {
+          "command": "vgs",
+          "description": "Saída concisa de grupos de volumes"
+        },
+        {
+          "command": "lvs",
+          "description": "Saída concisa de volumes lógicos"
+        }
+      ]
+    },
+    {
+      "title": "Armazenamento Proxmox",
+      "commands": [
+        {
+          "command": "cat /etc/pve/storage.cfg",
+          "description": "Mostrar configuração de armazenamento Proxmox"
+        },
+        {
+          "command": "pvesm status",
+          "description": "Mostrar o status de todos os pools de armazenamento"
+        },
+        {
+          "command": "pvesm status --enabled 1",
+          "description": "Listar armazenamentos configurados e ativos"
+        },
+        {
+          "command": "pvesm list <storage>",
+          "description": "Listar o conteúdo do armazenamento específico"
+        },
+        {
+          "command": "pvesm scan nfs <server>",
+          "description": "Descobrir as exportações NFS de um servidor"
+        }
+      ]
+    },
+    {
+      "title": "Acções do Disco",
+      "commands": [
+        {
+          "command": "qm importdisk <vmid> <image_path> <storage>",
+          "description": "Importar a imagem como disco não utilizado da VM e ligá-lo depois"
+        },
+        {
+          "command": "qm set <vmid> -<bus><index> <disk_path>",
+          "description": "Atribuir disco físico ao VM (modo de passagem)"
+        },
+        {
+          "command": "qemu-img convert -O <format> <input> <output>",
+          "description": "Converter o formato de uma imagem de disco sem uso ativo"
+        }
+      ]
+    },
+    {
+      "title": "Estado SMART do disco",
+      "commands": [
+        {
+          "command": "smartctl --scan",
+          "description": "Listar os dispositivos com capacidade SMART na máquina"
+        },
+        {
+          "command": "smartctl -i /dev/<disk>",
+          "description": "Informações básicas do dispositivo (modelo, firmware, série)"
+        },
+        {
+          "command": "smartctl -H /dev/<disk>",
+          "description": "Verificação rápida do estado geral: PASSED / FAILED"
+        },
+        {
+          "command": "smartctl -A /dev/<disk>",
+          "description": "Apenas atributos SMART (valores brutos, limiares)"
+        },
+        {
+          "command": "smartctl -a /dev/<disk>",
+          "description": "Informação SMART completa — info + atributos + log de auto-teste"
+        },
+        {
+          "command": "smartctl -t short /dev/<disk>",
+          "description": "Iniciar o auto-teste curto (~2 minutos, é executado em segundo plano)"
+        },
+        {
+          "command": "smartctl -t long /dev/<disk>",
+          "description": "Iniciar um autoteste longo, que pode demorar horas em segundo plano"
+        },
+        {
+          "command": "smartctl -l selftest /dev/<disk>",
+          "description": "Ver log de auto-teste (resultados de testes anteriores)"
+        },
+        {
+          "command": "smartctl -X /dev/<disk>",
+          "description": "Interromper o auto-teste em execução"
+        }
+      ]
+    },
+    {
+      "title": "Estado do disco NVMe",
+      "commands": [
+        {
+          "command": "nvme list",
+          "description": "Listar os dispositivos NVMe visíveis para o kernel"
+        },
+        {
+          "command": "nvme smart-log /dev/<nvme>",
+          "description": "Log NVMe específico para SMART (temperatura, desgaste, erros)"
+        },
+        {
+          "command": "nvme id-ctrl /dev/<nvme>",
+          "description": "Informação do controlador (modelo, firmware, capacidades)"
+        },
+        {
+          "command": "nvme error-log /dev/<nvme>",
+          "description": "Registro de erro recente do NVMe"
+        }
+      ]
+    }
+  ],
+  "lvmTip": {
+    "title": "LVM comandos curtos vs longos",
+    "bodyRich": "Ambas as formas estão disponíveis. <code>pvs</code> / <code>vgs</code> / <code>lvs</code> apresentam tabelas compactas com uma linha por volume físico, grupo de volumes ou volume lógico, respetivamente. <code>pvdisplay</code> / <code>vgdisplay</code> / <code>lvdisplay</code> mostram mais detalhes em várias linhas. As formas curtas são práticas nas consultas diárias."
+  },
+  "smartInfo": {
+    "title": "SMART em SATA/SAS e NVMe",
+    "bodyRich": "<strong>Os discos SATA / SAS, incluindo SSD,</strong> podem ser inspecionados com <code>smartctl</code> de <code>smartmontools</code>, instalado por predefinição no Proxmox. Indique o dispositivo, por exemplo <code>/dev/sda</code> ou <code>/dev/sdb</code>. <strong>Os discos NVMe</strong> usam outro protocolo nativo. O <code>smartctl</code> também os suporta; o <code>nvme</code> de <code>nvme-cli</code> oferece consultas específicas a controladores, namespaces e estado NVMe. Instale-o com <code>apt install nvme-cli</code> se faltar."
+  },
+  "selfTestWarn": {
+    "title": "Auto-testes executados em segundo plano",
+    "bodyRich": "Em discos compatíveis, <code>smartctl -t short /dev/&lt;disk&gt;</code> e <code>smartctl -t long /dev/&lt;disk&gt;</code> iniciam testes em segundo plano e devolvem logo o controlo. Verifique o progresso com <code>smartctl -a /dev/&lt;disk&gt;</code>, procurando \"Self-test routine in progress\", ou aguarde e leia <code>smartctl -l selftest /dev/&lt;disk&gt;</code>. Os testes curtos costumam demorar dois minutos; os longos podem levar horas. O disco permanece utilizável, mas o desempenho de E/S pode diminuir."
+  },
+  "related": {
+    "heading": "Relacionado",
+    "items": [
+      {
+        "href": "/docs/help-info/zfs-commands",
+        "label": "Gestão de ZFS",
+        "tail": " — comandos zpool / zfs para armazenamento com suporte ZFS."
+      },
+      {
+        "href": "/docs/disk-manager",
+        "label": "Gerenciador de disco",
+        "tail": " — fluxos interativos ProxMenux para passagem de disco, importação, formatação, SMART."
+      },
+      {
+        "href": "/docs/help-info",
+        "label": "Visão geral de ajuda e informações",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/pt/docs/help-info/system-commands.json b/web/messages/pt/docs/help-info/system-commands.json
new file mode 100644
index 00000000..cf0b6e03
--- /dev/null
+++ b/web/messages/pt/docs/help-info/system-commands.json
@@ -0,0 +1,158 @@
+{
+  "meta": {
+    "title": "Comandos de sistema Proxmox VE — pveversion, uptime, journalctl, systemctl | ProxMenux",
+    "description": "Comandos de sistema do Proxmox VE e Linux para versões, tempo de atividade, memória, serviços, registos e utilizadores, além de ferramentas de auditoria e resumo. Inclui o reinício de um serviço; nem todos os exemplos são apenas de leitura.",
+    "ogTitle": "Comandos de sistema Proxmox VE — pveversion, uptime, journalctl, systemctl",
+    "ogDescription": "Comandos de sistema Proxmox VE e Linux para versão, tempo de atividade, serviços, registos e utilizadores, incluindo gestão de serviços e ferramentas de auditoria.",
+    "twitterTitle": "Comandos de sistema Proxmox VE | ProxMenux",
+    "twitterDescription": "Comandos essenciais de inspeção do sistema para Proxmox VE — versão, estado, serviços, logs, informações do usuário."
+  },
+  "header": {
+    "title": "Comandos úteis do sistema",
+    "description": "Comandos para inspecionar o anfitrião Proxmox: versão, kernel, tempo de atividade, memória, estado da interface web, registos recentes e utilizadores ligados, além de ferramentas de auditoria e resumo. A maioria consulta o estado, mas systemctl restart pveproxy reinicia o proxy web e as auditorias podem escrever relatórios e registos.",
+    "section": "Ajuda e informações"
+  },
+  "intro": {
+    "title": "O que é isto?",
+    "body": "A mesma lista numerada apresentada pelo ProxMenux em <em>Comandos úteis do sistema</em>. Use o botão Copiar para copiar um comando ou consulte a lista para recordar a opção exata."
+  },
+  "commandGroups": [
+    {
+      "title": "Informações do sistema",
+      "commands": [
+        {
+          "command": "pveversion",
+          "description": "Mostrar versão do Proxmox"
+        },
+        {
+          "command": "pveversion -v",
+          "description": "Informações detalhadas da versão do Proxmox"
+        },
+        {
+          "command": "hostnamectl",
+          "description": "Nome do host do sistema e informações do kernel"
+        },
+        {
+          "command": "uname -a",
+          "description": "Informações sobre kernel e arquitetura"
+        },
+        {
+          "command": "cat /etc/os-release",
+          "description": "Detalhes da versão do sistema operacional"
+        }
+      ]
+    },
+    {
+      "title": "Estado do sistema",
+      "commands": [
+        {
+          "command": "uptime",
+          "description": "Tempo de atividade do sistema"
+        },
+        {
+          "command": "uptime -p",
+          "description": "Tempo de atividade num formato legível"
+        },
+        {
+          "command": "free -h",
+          "description": "RAM e uso de swap"
+        },
+        {
+          "command": "who -b",
+          "description": "Hora da última inicialização do sistema"
+        },
+        {
+          "command": "last -x | grep shutdown",
+          "description": "Encerramentos anteriores"
+        }
+      ]
+    },
+    {
+      "title": "Gestão de Serviços",
+      "commands": [
+        {
+          "command": "systemctl status pveproxy",
+          "description": "Verifique o status da interface da Web do Proxmox"
+        },
+        {
+          "command": "systemctl restart pveproxy",
+          "description": "Reinicie o proxy da IU da Web"
+        },
+        {
+          "command": "journalctl -xe",
+          "description": "Erros e registros do sistema"
+        },
+        {
+          "command": "dmesg -T | tail -n 50",
+          "description": "Últimas 50 linhas de log do kernel"
+        }
+      ]
+    },
+    {
+      "title": "Informação do Utilizador",
+      "commands": [
+        {
+          "command": "whoami",
+          "description": "Usuário atual"
+        },
+        {
+          "command": "id",
+          "description": "UID, GID e grupos do usuário atual"
+        },
+        {
+          "command": "who",
+          "description": "Usuários logados"
+        },
+        {
+          "command": "w",
+          "description": "Atividade do usuário e tempo de atividade"
+        },
+        {
+          "command": "uptime && w",
+          "description": "Tempo de atividade e quem está logado"
+        },
+        {
+          "command": "cut -d: -f1,3,4 /etc/passwd",
+          "description": "Todos os usuários com UID e GID"
+        },
+        {
+          "command": "getent passwd | column -t -s :",
+          "description": "Tabela de usuário legível (UID, shell, etc.)"
+        }
+      ]
+    },
+    {
+      "title": "Ferramentas de Auditoria e Resumo",
+      "commands": [
+        {
+          "command": "lynis audit system",
+          "description": "Execute uma auditoria completa de segurança do sistema"
+        },
+        {
+          "command": "fastfetch",
+          "description": "Exibir resumo do sistema em formato ASCII"
+        }
+      ]
+    }
+  ],
+  "related": {
+    "heading": "Relacionado",
+    "items": [
+      {
+        "href": "/docs/help-info/update-commands",
+        "label": "Atualizações e pacotes",
+        "tail": " — comandos apt e de atualização do PVE."
+      },
+      {
+        "href": "/docs/help-info/tools-commands",
+        "label": "Ferramentas CLI do sistema",
+        "tail": " — htop, btop, ncdu e ferramentas semelhantes."
+      },
+      {
+        "href": "/docs/help-info",
+        "label": "Visão geral de ajuda e informações",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/pt/docs/help-info/tools-commands.json b/web/messages/pt/docs/help-info/tools-commands.json
new file mode 100644
index 00000000..751feae5
--- /dev/null
+++ b/web/messages/pt/docs/help-info/tools-commands.json
@@ -0,0 +1,276 @@
+{
+  "meta": {
+    "title": "Ferramentas CLI Linux para Proxmox — htop, iftop, journalctl, rsync, tmux | ProxMenux",
+    "description": "Ferramentas CLI Linux para administrar o Proxmox VE no dia a dia: monitorização (htop, atop, glances, iotop), rede (iftop, nmap, mtr, ss), ficheiros e texto (find, grep, journalctl), desempenho (iostat, perf, strace), segurança (fail2ban, lynis, lsof) e administração remota (ssh, rsync, tmux).",
+    "ogTitle": "Ferramentas CLI Linux para Proxmox — htop, iftop, journalctl, rsync, tmux",
+    "ogDescription": "Ferramentas CLI para administrar o Proxmox VE no dia a dia, agrupadas por função: monitorização, rede, ficheiros e texto, desempenho, segurança e administração remota.",
+    "twitterTitle": "Ferramentas CLI Linux para Proxmox | ProxMenux",
+    "twitterDescription": "Ferramentas CLI para a administração diária do Proxmox VE, agrupadas por função."
+  },
+  "header": {
+    "title": "Ferramentas CLI do sistema",
+    "description": "Ferramentas CLI para administrar o anfitrião Proxmox no dia a dia, agrupadas por função: monitorização, rede, ficheiros e texto, análise de desempenho, segurança, administração remota e configuração do sistema.",
+    "section": "Ajuda e informações"
+  },
+  "intro": {
+    "title": "A maioria é instalada pelo script de pós-instalação",
+    "body": "Se executou o script de pós-instalação com as opções predefinidas, a maioria destas ferramentas já está instalada. Para as que faltarem, o <utilsLink>instalador de utilitários de sistema</utilsLink> do ProxMenux oferece grupos predefinidos: base, desenvolvimento, rede, análise, entre outros."
+  },
+  "commandGroups": [
+    {
+      "title": "Monitorização do sistema",
+      "commands": [
+        {
+          "command": "htop",
+          "description": "Visualizador de processo interativo com CPU/uso de memória"
+        },
+        {
+          "command": "top",
+          "description": "Mostrar processos Linux em tempo real"
+        },
+        {
+          "command": "atop",
+          "description": "Monitor avançado de sistema e processo"
+        },
+        {
+          "command": "glances",
+          "description": "Ferramenta de monitoramento de sistema com interface web"
+        },
+        {
+          "command": "nmon",
+          "description": "Ferramenta de monitorização do desempenho"
+        },
+        {
+          "command": "iotop",
+          "description": "Monitorar o uso de E/S do disco por processos"
+        },
+        {
+          "command": "vmstat 1",
+          "description": "Reportar estatísticas de memória virtual a cada segundo"
+        }
+      ]
+    },
+    {
+      "title": "Ferramentas de rede",
+      "commands": [
+        {
+          "command": "iftop",
+          "description": "Mostrar a utilização da largura de banda numa interface"
+        },
+        {
+          "command": "nmap <host>",
+          "description": "Exploração de rede e verificação de segurança"
+        },
+        {
+          "command": "tcpdump -i <interface>",
+          "description": "Capturar tráfego de rede"
+        },
+        {
+          "command": "netstat -tuln",
+          "description": "Exibir conexões de rede"
+        },
+        {
+          "command": "ss -tuln",
+          "description": "Outro utilitário para investigar soquetes"
+        },
+        {
+          "command": "mtr <host>",
+          "description": "Ferramenta de diagnóstico de rede combinando ping e traceroute"
+        },
+        {
+          "command": "iperf3 -s",
+          "description": "Executar o servidor iperf para testes de largura de banda"
+        }
+      ]
+    },
+    {
+      "title": "Ferramentas de Arquivo e Texto",
+      "commands": [
+        {
+          "command": "find / -name <filename>",
+          "description": "Procurar os ficheiros pelo nome"
+        },
+        {
+          "command": "grep -r 'pattern' /path",
+          "description": "Procurar o padrão nos arquivos"
+        },
+        {
+          "command": "sed -i 's/old/new/g' file",
+          "description": "Substituir o texto nos ficheiros"
+        },
+        {
+          "command": "awk '{print $1}' file",
+          "description": "Ferramenta de processamento de texto"
+        },
+        {
+          "command": "tail -f /var/log/syslog",
+          "description": "Seguir o ficheiro de registo em tempo real"
+        },
+        {
+          "command": "less /var/log/messages",
+          "description": "Ver o ficheiro com paginação"
+        },
+        {
+          "command": "journalctl -f",
+          "description": "Acompanhar os registos do journal do systemd"
+        }
+      ]
+    },
+    {
+      "title": "Análise de desempenho",
+      "commands": [
+        {
+          "command": "iostat -x 1",
+          "description": "Apresentar estatísticas de CPU e E/S"
+        },
+        {
+          "command": "mpstat -P ALL 1",
+          "description": "Relatório sobre a utilização do CPU"
+        },
+        {
+          "command": "perf top",
+          "description": "Ferramenta de perfil do sistema"
+        },
+        {
+          "command": "strace <command>",
+          "description": "Rastrear chamadas e sinais do sistema"
+        },
+        {
+          "command": "lsof",
+          "description": "Listar os ficheiros abertos"
+        },
+        {
+          "command": "pstree",
+          "description": "Exibir árvore de processo"
+        },
+        {
+          "command": "slabtop",
+          "description": "Mostrar informações da cache slab do kernel"
+        }
+      ]
+    },
+    {
+      "title": "Ferramentas de Segurança",
+      "commands": [
+        {
+          "command": "fail2ban-client status",
+          "description": "Mostrar o estado do fail2ban"
+        },
+        {
+          "command": "chage -l <username>",
+          "description": "Mostrar a informação de validade da senha"
+        },
+        {
+          "command": "lastlog",
+          "description": "Mostrar o último login de todos os usuários"
+        },
+        {
+          "command": "last",
+          "description": "Mostrar a lista dos últimos utilizadores que iniciaram sessão"
+        },
+        {
+          "command": "w",
+          "description": "Mostrar quem está ligado e o que está a fazer"
+        },
+        {
+          "command": "lynis audit system",
+          "description": "Ferramenta de auditoria de segurança"
+        },
+        {
+          "command": "openssl s_client -connect host:port",
+          "description": "Testar conexões SSL/TLS"
+        }
+      ]
+    },
+    {
+      "title": "Administração remota",
+      "commands": [
+        {
+          "command": "ssh <user>@<host>",
+          "description": "Conexão de shell segura"
+        },
+        {
+          "command": "scp <file> <user>@<host>:<path>",
+          "description": "Copiar ficheiros em segurança"
+        },
+        {
+          "command": "rsync -avz <src> <dest>",
+          "description": "Sincronizar arquivos/pastas"
+        },
+        {
+          "command": "screen",
+          "description": "Multiplexador de terminal"
+        },
+        {
+          "command": "tmux",
+          "description": "Alternativa de multiplexador de terminal"
+        },
+        {
+          "command": "ssh-keygen -t rsa -b 4096",
+          "description": "Gerar par de chaves SSH"
+        },
+        {
+          "command": "ssh-copy-id <user>@<host>",
+          "description": "Copiar a chave SSH para o servidor"
+        }
+      ]
+    },
+    {
+      "title": "Configuração do Sistema",
+      "commands": [
+        {
+          "command": "systemctl status <service>",
+          "description": "Verificar o estado do serviço"
+        },
+        {
+          "command": "journalctl -u <service>",
+          "description": "Ver os registos de serviços"
+        },
+        {
+          "command": "timedatectl",
+          "description": "Gerir a data e a hora do sistema"
+        },
+        {
+          "command": "hostnamectl",
+          "description": "Gerir o nome do anfitrião"
+        },
+        {
+          "command": "localectl",
+          "description": "Gerir as definições regionais e o teclado do sistema"
+        },
+        {
+          "command": "update-alternatives --config <name>",
+          "description": "Configurar alternativas de sistema"
+        },
+        {
+          "command": "dpkg-reconfigure <package>",
+          "description": "Reconfigurar um pacote instalado"
+        }
+      ]
+    }
+  ],
+  "tmuxTip": {
+    "title": "Usar tmux / screen para comandos demorados",
+    "bodyRich": "Execute tarefas demoradas, como cópias de segurança, atualizações ou grandes transferências rsync, em <code>tmux</code> ou <code>screen</code> para uma desconexão SSH não terminar a sessão do terminal. Numa sessão tmux, volte a ligar-se ao mesmo anfitrião com o mesmo utilizador e execute <code>tmux attach</code>. As sessões screen usam o seu próprio comando de reconexão."
+  },
+  "related": {
+    "heading": "Relacionado",
+    "items": [
+      {
+        "href": "/docs/utils/system-utils",
+        "label": "Instalador de utilitários de sistema",
+        "tail": " — instalar qualquer uma destas ferramentas em falta."
+      },
+      {
+        "href": "/docs/help-info/system-commands",
+        "label": "Comandos úteis do sistema",
+        "tail": " — Comandos de inspecção específicos do proxmox."
+      },
+      {
+        "href": "/docs/help-info",
+        "label": "Visão geral de ajuda e informações",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/pt/docs/help-info/update-commands.json b/web/messages/pt/docs/help-info/update-commands.json
new file mode 100644
index 00000000..5e346400
--- /dev/null
+++ b/web/messages/pt/docs/help-info/update-commands.json
@@ -0,0 +1,170 @@
+{
+  "meta": {
+    "title": "Comandos de atualização e pacotes Proxmox — apt, pveupgrade, dpkg | ProxMenux",
+    "description": "Comandos de atualização e gestão de pacotes Proxmox VE: apt update, apt upgrade, apt dist-upgrade, pveupgrade, dpkg -l, informações sobre pacotes e configuração de repositórios em /etc/apt/sources.list.d/.",
+    "ogTitle": "Comandos de atualização e pacotes Proxmox — apt, pveupgrade, dpkg",
+    "ogDescription": "comandos apt, pveupgrade e dpkg para manter o Proxmox VE atualizado — atualizações do sistema, gerenciamento de pacotes, configuração do repositório.",
+    "twitterTitle": "Comandos de atualização Proxmox | ProxMenux",
+    "twitterDescription": "Comandos apt e pveupgrade para gerir atualizações e pacotes em anfitriões Proxmox VE."
+  },
+  "header": {
+    "title": "Atualizações e pacotes",
+    "description": "Seleção de comandos apt e de atualização Proxmox: atualizações do sistema, instalação, remoção e eliminação completa de pacotes, consultas com apt-cache policy e dpkg -l e inspeção dos repositórios.",
+    "section": "Ajuda e informações"
+  },
+  "intro": {
+    "title": "Atualizar sempre o índice primeiro",
+    "body": "O <code>apt update</code> atualiza o índice de pacotes local dos repositórios configurados. Sem ele, <code>apt install</code> pode puxar versões antigas ou falhar com \"Não é possível localizar o pacote\"."
+  },
+  "commandGroups": [
+    {
+      "title": "Atualizações do sistema",
+      "commands": [
+        {
+          "command": "apt update && apt upgrade -y",
+          "description": "Atualizar as listas e os pacotes instalados (apt upgrade)"
+        },
+        {
+          "command": "apt dist-upgrade -y",
+          "description": "Atualização completa do sistema, incluindo dependências"
+        },
+        {
+          "command": "apt update",
+          "description": "Atualizar apenas as listas de pacotes"
+        },
+        {
+          "command": "apt upgrade",
+          "description": "Atualizar apenas pacotes (interativos)"
+        },
+        {
+          "command": "apt full-upgrade",
+          "description": "Atualizar pacotes com tratamento de dependência (interativo)"
+        }
+      ]
+    },
+    {
+      "title": "Atualizações do Proxmox",
+      "commands": [
+        {
+          "command": "pveupdate",
+          "description": "Atualizar listas de pacotes Proxmox"
+        },
+        {
+          "command": "pveupgrade",
+          "description": "Iniciar a atualização interativa dos pacotes Proxmox"
+        },
+        {
+          "command": "pve8to9 --full",
+          "description": "Verificar a preparação para passar do PVE 8 para 9, sem executar a atualização"
+        },
+        {
+          "command": "ceph versions",
+          "description": "Mostrar as versões dos serviços Ceph antes de planear uma atualização"
+        }
+      ]
+    },
+    {
+      "title": "Gestão de Pacotes",
+      "commands": [
+        {
+          "command": "apt autoremove --purge",
+          "description": "Remova pacotes não utilizados e suas configurações"
+        },
+        {
+          "command": "apt clean",
+          "description": "Limpar o repositório local dos arquivos de pacotes recuperados"
+        },
+        {
+          "command": "apt autoclean",
+          "description": "Limpar apenas os ficheiros de pacotes desactualizados"
+        },
+        {
+          "command": "apt install <package>",
+          "description": "Instalar um pacote específico"
+        },
+        {
+          "command": "apt remove <package>",
+          "description": "Remover um pacote"
+        },
+        {
+          "command": "apt purge <package>",
+          "description": "Remover um pacote e os seus ficheiros de configuração"
+        }
+      ]
+    },
+    {
+      "title": "Informação do Pacote",
+      "commands": [
+        {
+          "command": "apt list --installed",
+          "description": "Listar todos os pacotes instalados"
+        },
+        {
+          "command": "apt search <keyword>",
+          "description": "Procurar por pacotes por palavra- chave"
+        },
+        {
+          "command": "apt show <package>",
+          "description": "Mostrar informações detalhadas sobre um pacote"
+        },
+        {
+          "command": "dpkg -l",
+          "description": "Listar todos os pacotes instalados (alternativo)"
+        },
+        {
+          "command": "dpkg -l | grep <keyword>",
+          "description": "Procurar pacotes instalados por palavra- chave"
+        },
+        {
+          "command": "apt-cache policy <package>",
+          "description": "Mostrar as versões e prioridades do pacote"
+        }
+      ]
+    },
+    {
+      "title": "Gestão do Repositório",
+      "commands": [
+        {
+          "command": "cat /etc/apt/sources.list",
+          "description": "Mostrar as fontes principais do repositório APT"
+        },
+        {
+          "command": "ls -la /etc/apt/sources.list.d/",
+          "description": "Listar ficheiros adicionais de configuração de repositórios"
+        },
+        {
+          "command": "cat /etc/apt/sources.list.d/pve-enterprise.list",
+          "description": "Mostrar a configuração do repositório Proxmox Enterprise no ficheiro .list do PVE 8"
+        },
+        {
+          "command": "apt-key list",
+          "description": "Listar as antigas chaves de assinatura dos repositórios onde apt-key esteja disponível"
+        }
+      ]
+    }
+  ],
+  "backupWarn": {
+    "title": "Faça um backup antes das principais atualizações",
+    "bodyRich": "Para atualizações correntes, o Proxmox recomenda <code>apt update &amp;&amp; apt full-upgrade</code>; reveja as alterações de pacotes antes de confirmar. Para <strong>atualizações de versão principal</strong> (PVE 8 → 9), use o procedimento ProxMenux <upgradeLink>Atualizar PVE 8 para PVE 9</upgradeLink>. Inclui verificações prévias, migração de repositórios e validação final. Faça primeiro uma cópia de segurança."
+  },
+  "related": {
+    "heading": "Relacionado",
+    "items": [
+      {
+        "href": "/docs/utils/system-update",
+        "label": "Actualização do Sistema Proxmox (interactiva)",
+        "tail": " — wrapper que faz tudo isso com uma janela de confirmação, uma reconstrução automática DKMS de drivers gerenciados por ProxMenux quando um novo kernel é instalado e um prompt de reinicialização. Também pode ser lançado a partir do botão Atualizar agora do painel ProxMenux Monitor."
+      },
+      {
+        "href": "/docs/utils/upgrade-pve8-pve9",
+        "label": "Atualize PVE 8 para PVE 9",
+        "tail": " — para actualizações de grandes versões."
+      },
+      {
+        "href": "/docs/help-info",
+        "label": "Visão geral de ajuda e informações",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/pt/docs/help-info/vm-ct-commands.json b/web/messages/pt/docs/help-info/vm-ct-commands.json
new file mode 100644
index 00000000..9bca2d27
--- /dev/null
+++ b/web/messages/pt/docs/help-info/vm-ct-commands.json
@@ -0,0 +1,182 @@
+{
+  "meta": {
+    "title": "Comandos qm e pct do Proxmox — gestão de VM e contentores LXC | ProxMenux",
+    "description": "Comandos qm e pct do Proxmox VE para VM e contentores LXC: list, config, start, stop, shutdown, reboot, destroy, clone, migrate, snapshot, resize e pct exec / enter / push / pull para contentores.",
+    "ogTitle": "Comandos qm e pct do Proxmox — gestão de VM e contentores LXC",
+    "ogDescription": "Comandos qm e pct do Proxmox VE para gerir máquinas virtuais e contentores LXC pelo terminal: iniciar, parar, configurar, criar snapshots, migrar, clonar e eliminar.",
+    "twitterTitle": "Comandos qm / pct do Proxmox | ProxMenux",
+    "twitterDescription": "Seleção de comandos qm / pct para gerir máquinas virtuais e contentores LXC no Proxmox VE."
+  },
+  "header": {
+    "title": "Gestão de VM e CT",
+    "description": "Seleção de comandos qm para VM e pct para contentores LXC: listagem, ciclo de vida (start / stop / shutdown / destroy), consulta da configuração e operações de contentor como exec, enter, push e pull.",
+    "section": "Ajuda e informações"
+  },
+  "intro": {
+    "title": "Encontrar primeiro um VMID ou CTID",
+    "body": "Quase todos os comandos precisam de um ID numérico. Use <code>qm list</code> para VM e <code>pct list</code> para contentores. Substitua <code>&lt;vmid&gt;</code> / <code>&lt;ctid&gt;</code> nos exemplos pelo ID real antes de executar."
+  },
+  "commandGroups": [
+    {
+      "title": "Listagem e Informação",
+      "commands": [
+        {
+          "command": "qm list",
+          "description": "Listar todas as máquinas virtuais"
+        },
+        {
+          "command": "pct list",
+          "description": "Listar todos os contentores LXC"
+        },
+        {
+          "command": "qm config <vmid>",
+          "description": "Mostrar a configuração da VM interpretada por qm"
+        },
+        {
+          "command": "pct config <ctid>",
+          "description": "Mostrar a configuração do contentor interpretada por pct"
+        }
+      ]
+    },
+    {
+      "title": "Arquivos de configuração (raw)",
+      "commands": [
+        {
+          "command": "cat /etc/pve/qemu-server/<vmid>.conf",
+          "description": "Ver arquivo de configuração bruto da VM"
+        },
+        {
+          "command": "cat /etc/pve/lxc/<ctid>.conf",
+          "description": "Ver arquivo de configuração CT bruto"
+        },
+        {
+          "command": "nano /etc/pve/qemu-server/<vmid>.conf",
+          "description": "Editar arquivo de configuração VM (nano)"
+        },
+        {
+          "command": "nano /etc/pve/lxc/<ctid>.conf",
+          "description": "Editar arquivo de configuração CT (nano)"
+        },
+        {
+          "command": "vi /etc/pve/qemu-server/<vmid>.conf",
+          "description": "Editar o ficheiro de configuração VM (vi)"
+        },
+        {
+          "command": "vi /etc/pve/lxc/<ctid>.conf",
+          "description": "Editar o ficheiro de configuração CT (vi)"
+        }
+      ]
+    },
+    {
+      "title": "Gestão de VM",
+      "commands": [
+        {
+          "command": "qm start <vmid>",
+          "description": "Inicie uma máquina virtual. Use o <vmid> correto"
+        },
+        {
+          "command": "qm stop <vmid>",
+          "description": "Forçar a parada de uma máquina virtual. Use o <vmid> correto"
+        },
+        {
+          "command": "qm shutdown <vmid>",
+          "description": "Desligar uma máquina virtual de forma ordenada"
+        },
+        {
+          "command": "qm reset <vmid>",
+          "description": "Reiniciar uma máquina virtual (reboot rígido)"
+        },
+        {
+          "command": "qm suspend <vmid>",
+          "description": "Suspender uma máquina virtual"
+        },
+        {
+          "command": "qm resume <vmid>",
+          "description": "Continuar uma máquina virtual suspensa"
+        },
+        {
+          "command": "qm destroy <vmid>",
+          "description": "Exclua uma VM (irreversível). Use o <vmid> correto"
+        }
+      ]
+    },
+    {
+      "title": "Gestão de contentores",
+      "commands": [
+        {
+          "command": "pct start <ctid>",
+          "description": "Inicie um contêiner. Use o <ctid> correto"
+        },
+        {
+          "command": "pct stop <ctid>",
+          "description": "Forçar a parada de um contêiner. Use o <ctid> correto"
+        },
+        {
+          "command": "pct shutdown <ctid>",
+          "description": "Desligar um contentor de forma ordenada"
+        },
+        {
+          "command": "pct reboot <ctid>",
+          "description": "Reiniciar um contentor"
+        },
+        {
+          "command": "pct destroy <ctid>",
+          "description": "Excluir um CT (irreversível). Use o <ctid> correto"
+        }
+      ]
+    },
+    {
+      "title": "Operações de Contentores",
+      "commands": [
+        {
+          "command": "pct exec <ctid> -- getent passwd | column -t -s :",
+          "description": "Mostrar usuários do CT em formato de tabela"
+        },
+        {
+          "command": "pct exec <ctid> -- ps aux --sort=-%mem | head",
+          "description": "Principais processos de memória em CT"
+        },
+        {
+          "command": "pct enter <ctid>",
+          "description": "Entrar na shell do contentor"
+        },
+        {
+          "command": "pct push <ctid> <source> <dest>",
+          "description": "Copiar o ficheiro da máquina para o contentor"
+        },
+        {
+          "command": "pct pull <ctid> <source> <dest>",
+          "description": "Copiar o ficheiro do contentor para a máquina"
+        }
+      ]
+    }
+  ],
+  "destroyWarn": {
+    "title": "Destruir é irreversível.",
+    "bodyRich": "<code>qm destroy</code> e <code>pct destroy</code> removem a configuração do sistema convidado e os seus volumes de disco geridos. Não pressuponha que os dados externos ou em bind mounts são eliminados. A CLI não pede confirmação por predefinição. Guarde primeiro os dados necessários; consulte <backupLink>Cópias de segurança e restauro</backupLink>."
+  },
+  "qmConfigTip": {
+    "title": "qm config ou edição direta do ficheiro .conf",
+    "bodyRich": "<code>qm config &lt;vmid&gt;</code> e <code>pct config &lt;ctid&gt;</code> mostram a configuração através dos analisadores Proxmox. Para alterações normais, prefira <code>qm set</code> ou o comando pct equivalente. Editar diretamente <code>/etc/pve/qemu-server/&lt;vmid&gt;.conf</code> ou <code>/etc/pve/lxc/&lt;ctid&gt;.conf</code> contorna a validação e os bloqueios dos comandos de gestão; o ficheiro tem de continuar interpretável. Pare o sistema convidado e guarde uma cópia antes de reparar manualmente. <code>pmxcfs</code> sincroniza configurações entre nós, não os dados dos discos convidados."
+  },
+  "related": {
+    "heading": "Relacionado",
+    "items": [
+      {
+        "href": "/docs/help-info/backup-commands",
+        "label": "Cópias de segurança e restauro",
+        "tail": " — vzdump e qmrestore / pct restore."
+      },
+      {
+        "href": "/docs/help-info/storage-commands",
+        "label": "Armazenamento e Discos",
+        "tail": " — qm importdisk e gestão de discos."
+      },
+      {
+        "href": "/docs/help-info",
+        "label": "Visão geral de ajuda e informações",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/pt/docs/help-info/zfs-commands.json b/web/messages/pt/docs/help-info/zfs-commands.json
new file mode 100644
index 00000000..159ed9f6
--- /dev/null
+++ b/web/messages/pt/docs/help-info/zfs-commands.json
@@ -0,0 +1,227 @@
+{
+  "meta": {
+    "title": "Comandos ZFS no Proxmox — zpool, zfs snapshot, send/receive, scrub | ProxMenux",
+    "description": "Comandos de gestão ZFS no Proxmox VE: zpool create / status / history, zfs list / get / set, snapshots, clone, zfs send e receive, scrub, clear, replace, zpool iostat e resumo ARC.",
+    "ogTitle": "Comandos ZFS no Proxmox — zpool, zfs snapshot, send/receive, scrub",
+    "ogDescription": "Referência dos comandos zpool e zfs em Proxmox VE — pools, conjuntos de dados, instantâneos, replicação, manutenção.",
+    "twitterTitle": "Comandos ZFS no Proxmox | ProxMenux",
+    "twitterDescription": "Comandos zpool e zfs para Proxmox VE: pools, datasets, snapshots, replicação e manutenção."
+  },
+  "header": {
+    "title": "Gestão de ZFS",
+    "description": "Seleção de comandos zpool e zfs: inspeção de pools, criação, leitura, alteração e eliminação de datasets, snapshots, clone e send/receive incremental ou recursivo, manutenção com scrub / clear / replace, estatísticas de E/S e resumo ARC.",
+    "section": "Ajuda e informações"
+  },
+  "intro": {
+    "title": "Duas famílias de comando",
+    "body": "O <code>zpool *</code> gere os conjuntos de armazenamento (camada física — discos, vdevs, redundância). <code>zfs *</code> gerencia os conjuntos de dados e instantâneos que vivem dentro desses pools (camada lógica — sistemas de arquivos, volumes, instantâneos, propriedades)."
+  },
+  "commandGroups": [
+    {
+      "title": "Informações dos pools",
+      "commands": [
+        {
+          "command": "zpool list",
+          "description": "Listar todos os pools ZFS"
+        },
+        {
+          "command": "zpool status",
+          "description": "Mostrar o estado detalhado e a saúde do pool"
+        },
+        {
+          "command": "zpool status -v",
+          "description": "Mostrar o estado detalhado do pool com os erros"
+        },
+        {
+          "command": "zpool history",
+          "description": "Mostrar o histórico de comandos para todos os grupos"
+        },
+        {
+          "command": "zpool history <pool>",
+          "description": "Mostrar o histórico de comandos de um pool específico"
+        },
+        {
+          "command": "zpool get all <pool>",
+          "description": "Mostrar todas as propriedades de um pool"
+        }
+      ]
+    },
+    {
+      "title": "Gerenciamento de conjuntos de dados",
+      "commands": [
+        {
+          "command": "zfs list",
+          "description": "Listar todos os conjuntos de dados ZFS"
+        },
+        {
+          "command": "zfs list -r <pool>",
+          "description": "Listar todos os conjuntos de dados num pool recursivamente"
+        },
+        {
+          "command": "zfs create <pool>/<dataset>",
+          "description": "Criar um novo conjunto de dados"
+        },
+        {
+          "command": "zfs destroy <pool>/<dataset>",
+          "description": "Destruir um conjunto de dados"
+        },
+        {
+          "command": "zfs rename <pool>/<dataset> <pool>/<new-name>",
+          "description": "Renomear um conjunto de dados"
+        },
+        {
+          "command": "zfs get all <pool>/<dataset>",
+          "description": "Mostrar todas as propriedades de um conjunto de dados"
+        },
+        {
+          "command": "zfs set compression=on <pool>/<dataset>",
+          "description": "Activar a compressão num conjunto de dados"
+        }
+      ]
+    },
+    {
+      "title": "Gestão de Instantâneos",
+      "commands": [
+        {
+          "command": "zfs list -t snapshot",
+          "description": "Listar todos os instantâneos"
+        },
+        {
+          "command": "zfs list -t snapshot -r <pool>",
+          "description": "Listar todos os instantâneos em um pool"
+        },
+        {
+          "command": "zfs snapshot <pool>/<dataset>@<snapshot-name>",
+          "description": "Criar um instantâneo"
+        },
+        {
+          "command": "zfs destroy <pool>/<dataset>@<snapshot-name>",
+          "description": "Apagar um instantâneo"
+        },
+        {
+          "command": "zfs rollback <pool>/<dataset>@<snapshot-name>",
+          "description": "Retroceder para um instantâneo"
+        },
+        {
+          "command": "zfs hold <tag> <pool>/<dataset>@<snapshot-name>",
+          "description": "Proteger um snapshot contra eliminação com um hold"
+        },
+        {
+          "command": "zfs release <tag> <pool>/<dataset>@<snapshot-name>",
+          "description": "Remover a proteção hold de um snapshot"
+        }
+      ]
+    },
+    {
+      "title": "Clonar e Enviar/Receber",
+      "commands": [
+        {
+          "command": "zfs clone <pool>/<dataset>@<snapshot> <pool>/<clone-name>",
+          "description": "Criar um clone a partir de um instantâneo"
+        },
+        {
+          "command": "zfs send <pool>/<dataset>@<snapshot> > backup.zfs",
+          "description": "Enviar um instantâneo para um arquivo"
+        },
+        {
+          "command": "zfs receive <pool>/<dataset> < backup.zfs",
+          "description": "Receber um instantâneo a partir de um ficheiro"
+        },
+        {
+          "command": "zfs send -i <pool>/<dataset>@<snap1> <pool>/<dataset>@<snap2> > incr.zfs",
+          "description": "Enviar instantâneo incremental"
+        },
+        {
+          "command": "zfs send -R <pool>/<dataset>@<snapshot> > full-recursive.zfs",
+          "description": "Enviar instantâneo recursivo"
+        }
+      ]
+    },
+    {
+      "title": "Manutenção e Reparação",
+      "commands": [
+        {
+          "command": "zpool scrub <pool>",
+          "description": "Iniciar uma verificação scrub do pool"
+        },
+        {
+          "command": "zpool scrub -s <pool>",
+          "description": "Parar o scrub em execução"
+        },
+        {
+          "command": "zpool clear <pool>",
+          "description": "Repor os contadores de erros do pool"
+        },
+        {
+          "command": "zpool clear <pool> <device>",
+          "description": "Limpar erros num dispositivo específico"
+        },
+        {
+          "command": "zpool replace <pool> <old-device> <new-device>",
+          "description": "Substituir um dispositivo falhado"
+        },
+        {
+          "command": "zpool offline <pool> <device>",
+          "description": "Colocar um dispositivo offline no pool"
+        },
+        {
+          "command": "zpool online <pool> <device>",
+          "description": "Voltar a colocar um dispositivo online no pool"
+        }
+      ]
+    },
+    {
+      "title": "Desempenho e acompanhamento",
+      "commands": [
+        {
+          "command": "zpool iostat",
+          "description": "Mostrar estatísticas de E/ S para pools"
+        },
+        {
+          "command": "zpool iostat -v",
+          "description": "Mostrar estatísticas de E/S detalhadas"
+        },
+        {
+          "command": "zpool iostat 5",
+          "description": "Mostrar estatísticas de E/ S a cada 5 segundos"
+        },
+        {
+          "command": "arc_summary",
+          "description": "Mostrar as estatísticas ARC (se instaladas)"
+        },
+        {
+          "command": "zfs get compressratio <pool>/<dataset>",
+          "description": "Mostrar a razão de compressão"
+        },
+        {
+          "command": "zfs get used,available,referenced <pool>/<dataset>",
+          "description": "Mostrar a utilização do espaço"
+        }
+      ]
+    }
+  ],
+  "bestPractices": {
+    "title": "Melhores práticas operacionais",
+    "bodyRich": "Agende regularmente <code>zpool scrub</code> para verificar as somas de controlo e analise o resultado. Mantenha capacidade livre: o efeito de um pool quase cheio depende da carga e da estrutura. Use <code>zpool replace</code> para um dispositivo avariado e siga o procedimento do respetivo tipo de vdev. Detach + add não é equivalente e pode alterar a topologia ou eliminar redundância."
+  },
+  "related": {
+    "heading": "Relacionado",
+    "items": [
+      {
+        "href": "/docs/help-info/storage-commands",
+        "label": "Armazenamento e Discos",
+        "tail": " — comandos gerais de dispositivos de bloco e LVM."
+      },
+      {
+        "href": "/docs/help-info/backup-commands",
+        "label": "Cópias de segurança e restauro",
+        "tail": " — vzdump, qmrestore."
+      },
+      {
+        "href": "/docs/help-info",
+        "label": "Visão geral de ajuda e informações",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/pt/docs/installation.json b/web/messages/pt/docs/installation.json
new file mode 100644
index 00000000..16faddf9
--- /dev/null
+++ b/web/messages/pt/docs/installation.json
@@ -0,0 +1,93 @@
+{
+  "meta": {
+    "title": "Instalar o ProxMenux | Documentação do ProxMenux",
+    "description": "Instale o ProxMenux com um comando em anfitriões Proxmox VE 8 ou posteriores. Inclui catálogos JSON pré-gerados em oito idiomas: inglês, espanhol, francês, alemão, italiano, português, eslovaco e sueco. Escolha o idioma na instalação ou altere-o depois nas definições. O canal beta permite experimentar antecipadamente as novas funcionalidades.",
+    "ogTitle": "Instalar o ProxMenux | Documentação do ProxMenux",
+    "ogDescription": "Instale ProxMenux em Proxmox VE 8+ em um comando. Canais estáveis e beta disponíveis."
+  },
+  "header": {
+    "title": "Instalar o ProxMenux",
+    "description": "Um instalador que se inicia numa linha em qualquer anfitrião Proxmox VE 8 ou posterior. Instala automaticamente as dependências, descarrega os scripts, configura o comando de arranque do menu e pede o idioma na primeira execução. Dois canais: estável (predefinido) e beta.",
+    "section": "Instalação"
+  },
+  "stable": {
+    "heading": "Instalar",
+    "intro": "Execute isto no terminal da sua máquina Proxmox:",
+    "code": "bash -c \"$(wget -qLO - https://raw.githubusercontent.com/MacRimi/ProxMenux/main/install_proxmenux.sh)\""
+  },
+  "during": {
+    "heading": "Durante a instalação",
+    "intro": "O ProxMenux instala automaticamente e configura as dependências de que necessita:",
+    "tablePackage": "Pacote",
+    "tablePurpose": "Finalidade",
+    "rows": [
+      {
+        "package": "dialog",
+        "purpose": "Menus de terminal interativos"
+      },
+      {
+        "package": "curl",
+        "purpose": "Transferências e verificações de conectividade"
+      },
+      {
+        "package": "jq",
+        "purpose": "Processamento JSON"
+      },
+      {
+        "package": "git",
+        "purpose": "Clonagem e atualização de repositórios"
+      }
+    ],
+    "outro": "O instalador também descarrega os scripts para <code>/usr/local/share/proxmenux/</code> e cria o comando de arranque <code>/usr/local/bin/menu</code>. O painel web <strong>ProxMenux Monitor</strong> é registado como serviço <code>proxmenux-monitor.service</code>.",
+    "imageAlt": "Instalação ProxMenux em curso"
+  },
+  "first": {
+    "heading": "Primeiro arranque",
+    "intro": "Uma vez instalado, execute:",
+    "code": "menu",
+    "outro": "O ProxMenux abre no menu principal, onde pode iniciar os procedimentos documentados neste site. Num anfitrião Proxmox recém-instalado, <postlink>Pós-instalação</postlink> é um bom ponto de partida."
+  },
+  "beta": {
+    "heading": "Canal Beta",
+    "calloutTitle": "O que é o Programa Beta?",
+    "calloutBody": "Quer experimentar as novidades antes do lançamento oficial e ajudar a definir a versão final? O programa beta do ProxMenux dá acesso antecipado às novas funcionalidades, incluindo as últimas compilações do Monitor, a partir do ramo <code>develop</code>. As versões beta podem conter erros ou funções incompletas. Os seus comentários ajudam a corrigi-los antes da versão estável.",
+    "intro": "Instale a versão beta em vez da estável com:",
+    "code": "bash -c \"$(wget -qLO - https://raw.githubusercontent.com/MacRimi/ProxMenux/develop/install_proxmenux_beta.sh)\"",
+    "outro": "A beta é opcional: tem de executar explicitamente o respetivo instalador. Quando é publicada uma versão estável, o ProxMenux avisa na próxima execução de <code>menu</code> e propõe a mudança automática. Para sair antes da beta, escolha <betalink>Desativar programa beta</betalink> nas definições."
+  },
+  "updating": {
+    "heading": "Actualização",
+    "body": "O ProxMenux gere as suas atualizações. Quando há uma nova versão, a próxima execução de <code>menu</code> propõe a instalação. Ao aceitar, os ficheiros e a configuração da ferramenta são substituídos na instalação existente, sem downloads manuais. O canal estável recebe versões estáveis e a beta recebe versões beta, com a proposta de mudança descrita acima. O aviso depende de onde executa <code>menu</code>: por SSH ou na consola Proxmox, surge um diálogo sim/não e a aceitação aplica a atualização imediatamente. No terminal WebSocket do ProxMenux Monitor surge uma mensagem informativa, porque esse terminal seria interrompido durante a operação. A mensagem apresenta o instalador numa linha (<code>bash -c \"$(wget -qLO - https://raw.githubusercontent.com/MacRimi/ProxMenux/main/install_proxmenux.sh)\"</code> para estável, ou o URL equivalente de <code>install_proxmenux_beta.sh</code> para beta), que deve executar por SSH ou na consola."
+  },
+  "uninstall": {
+    "heading": "Desinstalar",
+    "body": "No ProxMenux: <strong>Definições → Desinstalar ProxMenux</strong>. A desinstalação remove os scripts, o comando de arranque e o serviço Monitor, além das dependências selecionadas, se assim escolher. Restaura <code>/root/.bashrc</code> e <code>/etc/motd</code> a partir das cópias criadas pelo Post-Install, caso existam (caso contrário, remove a linha do ProxMenux do MOTD). Procedimento completo: <uninstalllink>Desinstalar ProxMenux</uninstalllink>."
+  },
+  "troubleshoot": {
+    "heading": "Resolução de Problemas",
+    "virustotalTitle": "VirusTotal sinaliza o URL de instalação",
+    "virustotalBody": "O resultado de 1/95 do motor <em>Chong Lua Dao</em>, comunicado na issue #162, foi identificado pelo responsável do projeto como um falso positivo. O instalador é executado com um comando que descarrega e executa o script (<code>bash -c \"$(wget -qLO - …)\"</code>) e pode descarregar <code>jq</code> da sua versão oficial no GitHub. Este <em>comportamento</em> pode ativar análises heurísticas; esse relatório histórico não avalia todos os downloads futuros. O código do instalador é aberto e pode ser analisado. Mais contexto na <issuelink>issue #162</issuelink>.",
+    "aptTitle": "A instalação falhou com erros apt",
+    "aptBody": "Normalmente falta um repositório Proxmox ou está mal configurado. O instalador obtém as dependências via apt, que falha se a configuração dos repositórios estiver incorreta. É comum em instalações mínimas do Proxmox 8 ainda não atualizadas. Execute primeiro <code>apt-get update</code> manualmente, resolva todos os erros e volte a executar o instalador.",
+    "menuTitle": "`menu: command not found` após a instalação",
+    "menuBody": "O comando de arranque está em <code>/usr/local/bin/menu</code>. Confirme com <code>ls -lh /usr/local/bin/menu</code>. Se faltar, a instalação terminou antes de concluir: execute-a novamente. Se existir mas o comando não for encontrado, PATH não inclui <code>/usr/local/bin</code>. Corrija PATH ou execute diretamente <code>/usr/local/bin/menu</code>.",
+    "stuckTitle": "A instalação trava ou não avança",
+    "stuckBody": "Se uma instalação, reinstalação ou atualização ficar presa por causa de um problema de conexão, cancele com <strong>Ctrl + C</strong> e execute o instalador manualmente.",
+    "otherTitle": "Outros problemas",
+    "otherBody": "Consulte <issueslink>GitHub Issues</issueslink> para problemas conhecidos ou abra uma issue com os registos relevantes. Se usar a beta e o problema estiver relacionado com o Monitor, inclua a saída de <code>journalctl -u proxmenux-monitor -n 50</code>."
+  },
+  "next": {
+    "heading": "E agora?",
+    "postInstall": "<postlink>Script de pós-instalação</postlink> — ajustes e reforço de segurança de um anfitrião Proxmox recém-instalado.",
+    "introduction": "<introlink>Introdução</introlink> — apresentação completa das funcionalidades.",
+    "monitor": "<monitorlink>ProxMenux Monitor</monitorlink> — painel web para o host (instalado automaticamente ao lado do menu)."
+  },
+  "requirements": {
+    "heading": "Requisitos e boas práticas",
+    "reqTitle": "Requisitos",
+    "reqBody": "Proxmox VE <strong>8.x ou posterior</strong>. O PVE 7 e as versões anteriores não são suportados. O anfitrião precisa de acesso à Internet para descarregar scripts, dependências e a AppImage do ProxMenux Monitor. Execute o instalador como <strong>root</strong> no anfitrião Proxmox.",
+    "inspectTitle": "Sempre inspecione scripts que você executa da internet",
+    "inspectReview": "<sourcelink>Reveja o código do instalador</sourcelink> antes de executar.",
+    "inspectCoc": "Todas as ligações executáveis seguem o <coclink>código de conduta do ProxMenux</coclink>."
+  }
+}
diff --git a/web/messages/pt/docs/introduction.json b/web/messages/pt/docs/introduction.json
new file mode 100644
index 00000000..bba7927b
--- /dev/null
+++ b/web/messages/pt/docs/introduction.json
@@ -0,0 +1,206 @@
+{
+  "meta": {
+    "title": "ProxMenux — Gestão do Proxmox VE através de menus | Código aberto",
+    "description": "Ferramenta de código aberto para gerir o Proxmox VE através de menus. O ProxMenux reúne dois componentes: uma CLI/TUI para ajustes após a instalação, VM e contentores LXC, passagem direta de GPU e Coral TPU, discos, armazenamento e rede; e um painel web alojado no próprio servidor, com monitorização proativa, notificações por Telegram, Discord ou e-mail, reformulação por IA e API REST.",
+    "ogTitle": "ProxMenux — Gestão do Proxmox VE através de menus",
+    "ogDescription": "CLI/TUI de código aberto e painel web para Proxmox VE: ajustes após a instalação, VM, GPU, discos, rede, armazenamento e segurança. O Monitor acrescenta verificações de estado, notificações, reformulação por IA e uma API REST.",
+    "twitterTitle": "ProxMenux — Gestão do Proxmox VE através de menus",
+    "twitterDescription": "CLI/TUI de código aberto e painel web para Proxmox VE. Monitorização, notificações, reformulação por IA e API REST."
+  },
+  "header": {
+    "title": "Introdução",
+    "description": "O ProxMenux é uma ferramenta de código aberto para gerir o Proxmox VE através de menus. O projeto inclui uma CLI/TUI para tarefas comuns do anfitrião, VM, contentores, armazenamento, rede e segurança, e um painel web alojado no próprio servidor, com monitorização proativa, notificações, reformulação opcional por IA e API REST.",
+    "section": "Introdução"
+  },
+  "hero": {
+    "tagline": "<strong>Um menu para todas as tarefas.</strong> O que normalmente exige consultar a wiki, duas discussões no fórum e uma sequência de comandos copiada fica disponível numa opção numerada, que pode iniciar em segundos.",
+    "audience": "Concebido para utilizadores <em>principiantes</em> de Proxmox, com predefinições seguras já selecionadas, e administradores <em>experientes</em>, que podem executar tarefas habituais com menos comandos. Gratuito e de código aberto, com uma comunidade ativa no <github>GitHub</github>."
+  },
+  "twoProducts": {
+    "heading": "Dois produtos, um projecto",
+    "intro": "O ProxMenux tem dois componentes na mesma árvore de código-fonte. O instalador coloca ambos no anfitrião: Scripts fornece a interface de terminal e Monitor o painel web:",
+    "scripts": {
+      "title": "ProxMenux Scripts",
+      "body": "A CLI/TUI original, iniciada com <code>menu</code>. Nove áreas abrangem otimizações após a instalação, VM e contentores LXC, passagem direta de GPU e Coral TPU, discos, armazenamento, rede, segurança e utilitários, com uma seleção de comandos de referência. Funciona em terminais locais, por SSH ou na web."
+    },
+    "monitor": {
+      "title": "ProxMenux Monitor",
+      "body": "Painel web alojado no próprio servidor, distribuído como AppImage. Métricas do anfitrião em tempo real, monitorização proativa, notificações, reformulação opcional por IA com seis fornecedores, terminal web integrado e API REST. Ative-o no menu Scripts, em Definições → ProxMenux Monitor."
+    },
+    "calloutTitle": "O que o ProxMenux gere",
+    "calloutIntro": "Três camadas, todas acessíveis a partir do mesmo projeto:",
+    "layers": [
+      "<strong>O anfitrião Proxmox</strong> — repositórios, pacotes, rede, ZFS, Ceph, kernel e observabilidade.",
+      "<strong>As máquinas virtuais (VM)</strong> — criação, passagem direta de GPU, importação e exportação OVA/OVF e acesso direto a discos.",
+      "<strong>Os contentores LXC</strong> — criação, pontos de montagem, passagem direta de GPU/TPU e clientes e servidores NFS/Samba."
+    ]
+  },
+  "scriptsSection": {
+    "heading": "ProxMenux Scripts — o que se obtém",
+    "intro": "Nove áreas funcionais, cada uma com o seu submenu em <code>menu</code> e uma página própria na documentação. Selecione um cartão para abrir diretamente a visão geral dessa secção.",
+    "items": [
+      {
+        "title": "Após a instalação",
+        "description": "Otimizações para uma instalação recente do Proxmox: repositórios, kernel, sincronização horária, segurança básica e desempenho, com opções reversíveis.",
+        "icon": "Server",
+        "href": "/docs/post-install"
+      },
+      {
+        "title": "GPUs e Coral TPU",
+        "description": "Passagem direta de NVIDIA, iGPU Intel, AMD e Coral TPU para VM e contentores LXC, com alternância entre os modos VM e LXC.",
+        "icon": "Cpu",
+        "href": "/docs/hardware/nvidia-host"
+      },
+      {
+        "title": "Criar VM",
+        "description": "Assistentes para sistemas NAS, Windows e Linux, com predefinições adequadas para hardware, armazenamento e rede.",
+        "icon": "Server",
+        "href": "/docs/create-vm"
+      },
+      {
+        "title": "Gerenciador de disco",
+        "description": "Disponibilize discos físicos a VM e LXC, formate e apague discos, execute testes SMART e importe imagens qcow2, vmdk ou vdi, tudo através de um menu.",
+        "icon": "HardDrive",
+        "href": "/docs/disk-manager"
+      },
+      {
+        "title": "Armazenamento e partilha",
+        "description": "Registe armazenamento NFS, Samba/CIFS, iSCSI e local no Proxmox e partilhe pastas entre o anfitrião e os contentores LXC através de bind mounts ou protocolos de rede.",
+        "icon": "Boxes",
+        "href": "/docs/storage-share"
+      },
+      {
+        "title": "Rede",
+        "description": "Diagnóstico sem alterações, análise com sugestões e reparações guiadas de /etc/network/interfaces. São criadas cópias de segurança antes das alterações.",
+        "icon": "Network",
+        "href": "/docs/network"
+      },
+      {
+        "title": "Segurança",
+        "description": "Fail2Ban para prevenir intrusões por SSH e interfaces web e Lynis para auditar o reforço da segurança, com instalação e gestão através de predefinições adequadas.",
+        "icon": "Shield",
+        "href": "/docs/security"
+      },
+      {
+        "title": "Utilitários",
+        "description": "Crie ISO do Windows com o UUP Dump, instale ferramentas CLI, execute atualizações guiadas do sistema ou passe do PVE 8 para o 9 e exporte e importe VM OVA/OVF.",
+        "icon": "Wrench",
+        "href": "/docs/utils"
+      },
+      {
+        "title": "Referência de comandos",
+        "description": "Uma seleção de comandos Linux e Proxmox organizada por tema: sistema, VM/CT com qm e pct, armazenamento, rede, ZFS, passagem direta de GPU, cópias de segurança e ferramentas CLI do dia a dia.",
+        "icon": "BookOpen",
+        "href": "/docs/help-info"
+      }
+    ]
+  },
+  "monitorSection": {
+    "heading": "ProxMenux Monitor — o que se obtém",
+    "intro": "O painel web é alojado no anfitrião Proxmox, na porta TCP 8008. Selecione um cartão para abrir a página da respetiva secção ou leia primeiro a <link>visão geral do Monitor</link>.",
+    "items": [
+      {
+        "title": "Monitorização do estado do sistema",
+        "description": "Dez categorias verificadas a cada cinco minutos: CPU, memória, armazenamento, discos/SMART, rede, VM, serviços, registos, atualizações e segurança. Com níveis de gravidade e supressão de alertas por categoria.",
+        "icon": "Activity",
+        "href": "/docs/monitor/health-monitor"
+      },
+      {
+        "title": "Notificações",
+        "description": "Telegram, Discord, e-mail, Gotify, Pushover e Apprise multicanal, com eliminação de duplicados, intervalo mínimo entre envios, agrupamento de alertas próximos, horários de silêncio e histórico completo.",
+        "icon": "Bell",
+        "href": "/docs/monitor/notifications"
+      },
+      {
+        "title": "Assistente de IA",
+        "description": "Reformulação opcional das notificações em linguagem clara. Seis fornecedores: OpenAI, Anthropic Claude, Google Gemini, Groq, OpenRouter e Ollama local. Treze idiomas no seletor de idioma da IA.",
+        "icon": "Sparkles",
+        "href": "/docs/monitor/ai-assistant"
+      },
+      {
+        "title": "Terminal Web",
+        "description": "Uma shell interativa no anfitrião Proxmox através do navegador e um terminal ProxMenux Scripts separado que executa o menu na interface web.",
+        "icon": "Terminal",
+        "href": "/docs/monitor/dashboard/terminal"
+      },
+      {
+        "title": "REST API",
+        "description": "Endpoints HTTP para sistema, estado, armazenamento/SMART, rede, VM, notificações e segurança, úteis para Homepage, Home Assistant, Prometheus ou scripts personalizados.",
+        "icon": "Code2",
+        "href": "/docs/monitor/api"
+      },
+      {
+        "title": "Integrações",
+        "description": "Webhook nativo do Proxmox VE, recolha de métricas pelo Prometheus, sondas Uptime Kuma, widgets Homepage, Home Assistant e Glance, fluxos n8n/Zapier e Tailscale Secure Gateway.",
+        "icon": "Plug",
+        "href": "/docs/monitor/integrations"
+      }
+    ]
+  },
+  "installPaths": {
+    "heading": "Opções de instalação",
+    "intro": "Ambos os instaladores disponibilizam Scripts e Monitor. Scripts utiliza catálogos JSON previamente preparados em oito idiomas, sem tradução online. Pode escolher o canal estável ou beta; Monitor é distribuído como AppImage e executado a partir do seu ambiente extraído:",
+    "headerPath": "Install path",
+    "headerBundles": "O que inclui",
+    "headerWhen": "Quando escolher",
+    "rows": [
+      {
+        "pathRich": "<strong>Scripts: estável</strong>",
+        "bundles": "CLI/TUI com traduções JSON previamente preparadas em oito idiomas, sem ambiente virtual ou serviço de tradução online.",
+        "when": "Utilização habitual com o canal de versões estáveis."
+      },
+      {
+        "pathRich": "<strong>Scripts: beta</strong>",
+        "bundles": "A mesma interface multilingue, instalada a partir do ramo develop para testar as próximas alterações.",
+        "when": "Teste antecipado de novas funcionalidades, com maior risco de erros."
+      },
+      {
+        "pathRich": "<strong>Monitor</strong>",
+        "bundles": "AppImage autónoma com painel web na porta TCP 8008. O instalador extrai o ambiente de execução e gere o serviço; Monitor pode ser controlado nas definições.",
+        "when": "Quando é útil consultar o anfitrião num painel web, através de telemóvel, tablet ou navegador."
+      }
+    ],
+    "outro": "Os comandos e requisitos detalhados estão na <link>página de instalação</link>."
+  },
+  "warnSource": {
+    "title": "Verifique sempre os scripts da Internet antes de os executar",
+    "body": "O ProxMenux é de código aberto e pode consultar cada script no GitHub. Leia o código-fonte antes de executar o comando de instalação. Faça o mesmo com qualquer outra ferramenta de automação.",
+    "sourceLabel": "Ver fonte ProxMenux",
+    "cocLabel": "Código de Conduta"
+  },
+  "next": {
+    "heading": "Por onde continuar",
+    "items": [
+      {
+        "lead": "<strong>É a primeira vez que utiliza o ProxMenux?</strong> ",
+        "linkHref": "/docs/installation",
+        "linkLabel": "Instale-o com um único comando",
+        "tailRich": " e execute <code>menu</code>."
+      },
+      {
+        "lead": "<strong>Acabou de instalar o Proxmox?</strong> Comece pelo ",
+        "linkHref": "/docs/post-install",
+        "linkLabel": "script de pós-instalação",
+        "tail": "."
+      },
+      {
+        "lead": "<strong>Pretende um painel web?</strong> ",
+        "linkHref": "/docs/monitor",
+        "linkLabel": "ProxMenux Monitor",
+        "tail": " tem documentação que explica o que apresenta, como foi desenvolvido e como o proteger."
+      },
+      {
+        "lead": "<strong>Procura um comando específico?</strong> A ",
+        "linkHref": "/docs/help-info",
+        "linkLabel": "referência de comandos",
+        "tail": " reúne uma seleção organizada por tema, com botões para copiar."
+      },
+      {
+        "lead": "<strong>Pretende guias mais detalhados?</strong> A ",
+        "linkHref": "/guides",
+        "linkLabel": "secção de guias",
+        "tail": " aborda Coral TPU, passagem direta de NVIDIA, Kodi em LXC e outros temas."
+      }
+    ]
+  }
+}
diff --git a/web/messages/pt/docs/network/backup-restore.json b/web/messages/pt/docs/network/backup-restore.json
new file mode 100644
index 00000000..76e2b371
--- /dev/null
+++ b/web/messages/pt/docs/network/backup-restore.json
@@ -0,0 +1,110 @@
+{
+  "meta": {
+    "title": "Cópia de segurança e reinício das interfaces | Documentação ProxMenux",
+    "description": "Snapshot manual, navegar e restaurar backups /etc/network/interfaces armazenados em /var/backups/proxmenux/. Inclui uma reinicialização do serviço de rede com confirmação e uma visão rápida da configuração ao vivo.",
+    "ogTitle": "Cópia de segurança e reinício das interfaces | Documentação ProxMenux",
+    "ogDescription": "Instantâneo e restauração da configuração de rede Proxmox; reinicie o serviço de rede com confirmação."
+  },
+  "header": {
+    "title": "Cópia de segurança e reinício das interfaces",
+    "description": "Quatro utilitários que giram em torno de /etc/network/interfaces: tirar um instantâneo manual, visualizar a configuração ao vivo, restaurar um backup anterior com visualização opcional, e reiniciar o serviço de rede com consentimento explícito. Mesmo diretório de backup usado pelos fluxos de reparo guiados.",
+    "section": "Rede"
+  },
+  "intro": {
+    "title": "O que isto faz",
+    "body": "Gere o mesmo diretório de cópias de segurança usado pelas reparações guiadas (<code>/var/backups/proxmenux/</code>). Permite criar uma cópia extra antes de qualquer alteração manual, consultar todas as cópias existentes e repor qualquer uma delas — sempre com uma nova cópia do estado anterior ao restauro, criada automaticamente como segunda proteção."
+  },
+  "shared": {
+    "heading": "O diretório de backup compartilhado",
+    "intro": "Cada backup feito em qualquer lugar no menu Rede chega no mesmo lugar:",
+    "outro": "Os nomes dos ficheiros contêm data e hora, são ordenados por data e nunca são substituídos. O diretório é criado na primeira utilização."
+  },
+  "show": {
+    "heading": "Mostrar arquivo de configuração de rede",
+    "body": "Imprime <code>/etc/network/interfaces</code> na íntegra para o terminal. Só para leitura. Útil como uma verificação de sanidade antes de fazer um backup ou depois de uma restauração — não há nenhuma ferramenta separada \"diff com backup anterior\", então olhar para o arquivo ao vivo é a maneira mais fácil de confirmar o que você tem."
+  },
+  "create": {
+    "heading": "Criar backup de rede",
+    "body": "Copia o <code>/etc/network/interfaces</code> atual para o diretório de backup com um timestamp fresco. É isso — sem análise, sem prompts, apenas um instantâneo.",
+    "whenTitle": "Quando criar uma cópia de segurança manual",
+    "whenBody": "Antes de editar <code>/etc/network/interfaces</code> à mão, instalar um pacote que possa alterar a pilha de rede (por exemplo NetworkManager ou Open vSwitch) ou fazer qualquer alteração de hardware. As reparações guiadas já criam uma cópia automaticamente — esta opção serve para as operações <em>manuais</em>."
+  },
+  "restore": {
+    "heading": "Restaurar backup de rede",
+    "intro": "Lista todas as cópias em <code>/var/backups/proxmenux/</code> da mais recente à mais antiga e guia um restauro com proteções:",
+    "steps": [
+      {
+        "title": "1. Escolher uma cópia de segurança",
+        "body": "Um menu lista cada backup pelo seu timestamp. Se não existirem backups, o fluxo sai com uma mensagem clara.",
+        "tone": "blue"
+      },
+      {
+        "title": "2. Visualização opcional",
+        "body": "Propõe abrir a cópia selecionada numa vista com deslocamento antes de confirmar o restauro. A opção predefinida é Sim — não ignore este passo num host remoto.",
+        "tone": "blue"
+      },
+      {
+        "title": "3. Cópia de segurança antes do restauro",
+        "body": "Antes de sobrepor <code>/etc/network/interfaces</code>, toma <strong>outro</strong> backup do estado atual. Restaurar um backup é em si uma ação destrutiva, então o novo instantâneo pré-restore permite que você volte se o backup escolhido acabar sendo o errado.",
+        "tone": "amber"
+      },
+      {
+        "title": "4. Aplicar a restauração",
+        "body": "Substitui <code>/etc/network/interfaces</code> pela cópia selecionada. A alteração do ficheiro está no disco; o estado atual do kernel ainda reflete a configuração anterior.",
+        "tone": "amber"
+      },
+      {
+        "title": "5. Reinício opcional",
+        "body": "Pergunta se deve executar o <code>systemctl restart networking</code> agora. Recusar para adiar a alteração para a próxima reinicialização.",
+        "tone": "emerald"
+      }
+    ],
+    "autoBackupTitle": "O restauro cria automaticamente a sua própria cópia de segurança",
+    "autoBackupBody": "Selecionar <em>Restaurar backup de rede</em> cria sempre uma nova cópia da configuração <em>atual</em> antes de a substituir. Se restaurar a cópia errada, o ficheiro mais recente em <code>/var/backups/proxmenux/</code> contém o estado anterior."
+  },
+  "restart": {
+    "heading": "Reinicie o serviço de rede",
+    "body": "Executa <code>systemctl restart networking</code> após uma confirmação sim/não. Relata o resultado com <code>msg_ok</code> / <code>msg_error</code>. A maioria dos fluxos neste menu oferece o seu próprio prompt de reinicialização no final; esta opção é para reiniciar após uma edição manual ou depois de recusar o reinício do fluxo antes.",
+    "warnTitle": "Breve desconexão garantida; desconexão permanente possível",
+    "warnBody": "Reiniciando <code>networking</code> derruba e reaplica cada interface declarada em <code>/etc/network/interfaces</code>. As sessões SSH hospedadas nessas interfaces caem. Se a nova configuração for inválida, a rede nunca voltará. Execute isto apenas quando:",
+    "warnItems": [
+      "Você tem o console / IPMI / iKVM pronto, <em> ou</em>",
+      "Está fisicamente ao lado da máquina, <em>ou</em>",
+      "Você acabou de voltar com sucesso para uma configuração conhecida-boa e quer aplicá-la."
+    ]
+  },
+  "manualRollback": {
+    "heading": "Retroceder manualmente de uma consola",
+    "intro": "Se você não conseguir alcançar o menu (sem SSH, a janela está a falhar, ...) mas pode chegar a uma consola, o rollback são dois comandos:",
+    "outro": "É a <em>mesma</em> operação executada pelo menu, apenas escrita à mão. Se <code>networking</code> continuar sem iniciar, consulte <code>journalctl -u networking -b</code> para identificar o erro de sintaxe ou do controlador."
+  },
+  "troubleshoot": {
+    "heading": "Resolução de Problemas",
+    "noneTitle": "\"Nenhum backup encontrado\" na Restauração",
+    "noneBody": "O diretório <code>/var/backups/proxmenux/</code> não existe ou não contém ficheiros <code>interfaces_backup_*</code>. Execute <em>Criar backup de rede</em> pelo menos uma vez ou faça uma reparação guiada, que cria uma cópia automaticamente. Confirme com <code>ls /var/backups/proxmenux/</code>.",
+    "unreachTitle": "Reiniciar a rede tem sucesso, mas a máquina ainda não está acessível",
+    "unreachBody": "A nova configuração está errada ou não atribui o seu IP de gestão. Reponha a configuração a partir da consola (ver acima). Depois use a <bridgeLink>análise de bridges</bridgeLink> e a <configLink>análise de configuração</configLink> para perceber o problema antes de voltar a aplicar.",
+    "emptyTitle": "A antevisão da restauração mostra um arquivo vazio",
+    "emptyBody": "O ficheiro de backup está vazio (0 bytes). Isto acontece se uma cópia falhar silenciosamente numa execução anterior. Escolha uma cópia mais antiga ou execute novamente <em>Criar backup de rede</em> agora, se a configuração atual funcionar."
+  },
+  "related": {
+    "heading": "Relacionado",
+    "items": [
+      {
+        "label": "Análise de ponte e reparo guiado",
+        "href": "/docs/network/bridge-analysis",
+        "tail": " — a razão mais comum pela qual um backup acaba aqui."
+      },
+      {
+        "label": "Análise de configuração e limpeza guiada",
+        "href": "/docs/network/config-analysis",
+        "tailRich": " — escreve igualmente para o <code>/var/backups/proxmenux/</code> automaticamente."
+      },
+      {
+        "label": "Diagnósticos",
+        "href": "/docs/network/diagnostics",
+        "tail": " — para verificar o estado atual após um restauro."
+      }
+    ]
+  }
+}
diff --git a/web/messages/pt/docs/network/bridge-analysis.json b/web/messages/pt/docs/network/bridge-analysis.json
new file mode 100644
index 00000000..f20eddca
--- /dev/null
+++ b/web/messages/pt/docs/network/bridge-analysis.json
@@ -0,0 +1,132 @@
+{
+  "meta": {
+    "title": "Análise de bridges e reparação guiada | Documentação ProxMenux",
+    "description": "Deteta bridges vmbrX com portas físicas em falta ou inválidas, tipicamente após a reenumeração PCI. Apresenta-os com sugestões de comandos de shell e propõe uma reparação guiada em 5 passos com cópia de segurança obrigatória.",
+    "ogTitle": "Análise de bridges e reparação guiada | Documentação ProxMenux",
+    "ogDescription": "Verifique e repare portas de bridges Proxmox após alterações de hardware, com um procedimento guiado que permite reverter em segurança."
+  },
+  "header": {
+    "title": "Análise de ponte e reparo guiado",
+    "description": "Verifica cada bridge vmbrX declarado em /etc/network/interfaces e se as suas portas físicas existem. Caso faltem, propõe uma reparação passo a passo. A análise é só de leitura; a reparação exige confirmação, apresenta uma pré-visualização e cria uma cópia de segurança.",
+    "section": "Rede"
+  },
+  "intro": {
+    "title": "O que isto faz",
+    "body": "Lê cada ponte em <code>/etc/network/interfaces</code>, olha para sua linha <code>bridge-ports</code> e verifica se cada porta declarada (por exemplo. <code>enp3s0</code>) realmente existe na máquina. Se falta uma porta, propõe um substituto e – com consentimento explícito – aplica a alteração com um <strong>backup, visualização, aplicação, verificação</strong>."
+  },
+  "when": {
+    "heading": "Quando precisares disto",
+    "intro": "Linux atribui nomes de interface previsíveis de topologia PCI e ordem de fenda. Vários eventos os embaralham e deixam o <code>/etc/network/interfaces</code> referindo-se a nomes que já não existem:",
+    "items": [
+      "Adicionar ou remover uma placa PCIe (placa de rede, GPU, HBA ou adaptador NVMe).",
+      "Mudar uma placa existente para outro slot PCIe.",
+      "BIOS / UEFI atualiza que re-enumeram dispositivos PCI.",
+      "Migrando o disco de inicialização para hardware diferente."
+    ],
+    "outro": "Após a próxima inicialização, a ponte tenta anexar a uma porta que já não existe, falha em aparecer, e o host perde sua rede. <link>Nomes de interface persistentes</link> impede que isso aconteça novamente — mas se você já estiver bloqueado, esta página é o caminho de recuperação."
+  },
+  "bigPicture": {
+    "heading": "O quadro geral",
+    "diagram1": {
+      "arrowLabel": "passo 1",
+      "nodes": {
+        "sourceLabel": "/etc/network/interfaces",
+        "sourceDetail": "auto vmbr0\niface vmbr0 inet static\n  bridge-ports enp3s0",
+        "bridgeLabel": "Analisar (somente leitura)",
+        "bridgeDetail": "ip link show enp3s0\n→ não existe",
+        "targetLabel": "Relatório + sugestão",
+        "targetDetail": "❌ enp3s0: NÃO ENCONTRADA\nSubstituir por: eno1\n(ainda sem alterações)"
+      }
+    },
+    "diagram2": {
+      "arrowLabel": "aplicar com backup",
+      "nodes": {
+        "sourceLabel": "Reparação guiada",
+        "sourceDetail": "1. Cópia de Segurança\n2. Mostrar actual\n3. Antevisão das alterações\n4. Aplicar\n5. Verificar",
+        "targetLabel": "/etc/network/interfaces (novo)",
+        "targetDetail": "auto vmbr0\niface vmbr0 inet static\n  bridge-ports eno1"
+      }
+    }
+  },
+  "step1": {
+    "heading": "Passo 1: análise (somente leitura)",
+    "intro": "Ao selecionar <strong>Analisar configuração de bridges</strong>, a ferramenta para imediatamente se o host não usar a pilha clássica Debian/Proxmox. Caso contrário, verifica cada bridge e apresenta:",
+    "items": [
+      "Nome do bridge, estado atual (UP / DOWN) e IP atribuído.",
+      "Cada porta declarada e se existe atualmente (<code>ip link show &lt;port&gt;</code>).",
+      "Para cada porta inválida: uma substituição proposta (a primeira interface física disponível) mais o comando exato <code>sed</code> para aplicá-lo manualmente.",
+      "Bridges sem qualquer linha <code>bridge-ports</code> e entradas <code>auto</code> órfãs sem bloco <code>iface</code> correspondente."
+    ],
+    "readonlyTitle": "Garantia apenas para leitura",
+    "readonlyBody": "Até este ponto o script não executou um único comando modificando. Você pode deixar a análise aberta, copiar os comandos <code>sed</code> sugeridos e aplicá-los manualmente se preferir — ou aceitar o próximo prompt para inserir o reparo guiado."
+  },
+  "step2": {
+    "heading": "Passo 2: reparação guiada (5 passos)",
+    "intro": "Só se inicia se aceitar a proposta no fim da análise. Cada passo mostra o que vai acontecer e pede confirmação antes de continuar.",
+    "steps": [
+      {
+        "title": "1. Cópia de segurança",
+        "body": "Copia <code>/etc/network/interfaces</code> para <code>/var/backups/proxmenux/interfaces_backup_&lt;TIMESTAMP&gt;</code>. O caminho exato de backup é mostrado antes da cópia e novamente depois, com o comando rollback.",
+        "tone": "blue"
+      },
+      {
+        "title": "2. Rever a configuração actual",
+        "body": "Abre o <code>/etc/network/interfaces</code> ao vivo numa janela de rolagem para que possa ver exactamente o que está prestes a ser alterado.",
+        "tone": "blue"
+      },
+      {
+        "title": "3. Antever as alterações propostas",
+        "body": "Lista exatamente os bridges afetados e as substituições de portas previstas. Se já não for necessária reparação porque a porta reapareceu entre as verificações, o processo termina com <em>«Não são necessárias alterações.»</em>",
+        "tone": "blue"
+      },
+      {
+        "title": "4. Aplicar alterações",
+        "body": "Para cada ponte afetada, executa <code>sed -i \"/iface $bridge/,/bridge-ports/ s/bridge-ports.*/bridge-ports $new_ports/\"</code> contra <code>/etc/network/interfaces</code>. Se uma ponte não tiver nenhuma substituição válida disponível, a substituição é ignorada e relatada na etapa 5.",
+        "tone": "amber"
+      },
+      {
+        "title": "5. Verificação",
+        "body": "Lê novamente o ficheiro e confirma a existência da nova porta de cada bridge. Mostra o comando para reverter (<code>cp &lt;backup&gt; /etc/network/interfaces</code>). Por fim propõe <strong>Reiniciar a rede</strong> — aceite apenas se tiver acesso de reserva à consola.",
+        "tone": "emerald"
+      }
+    ],
+    "restartTitle": "Reiniciar a rede ≠ anular sem risco",
+    "restartBody": "A reparação é gravada no disco mesmo que não reinicie o serviço. <code>systemctl restart networking</code> aplica a alteração <em>agora</em> e pode interromper a sessão SSH se a nova porta estiver errada. Se recusar, a alteração entra na mesma em vigor no próximo arranque — confirme primeiro a configuração ou reverta com o comando apresentado."
+  },
+  "edits": {
+    "heading": "O que é editado (exatamente)",
+    "body": "Apenas a linha <code>bridge-ports</code> de cada bridge afetado. As outras diretivas (<code>address</code>, <code>netmask</code>, <code>gateway</code>, <code>bridge-stp</code>, …) ficam intactas. Neste procedimento o script não cria nem remove blocos <code>iface</code> — isso cabe à <link>Análise de configuração &amp; limpeza</link>."
+  },
+  "troubleshoot": {
+    "heading": "Resolução de Problemas",
+    "unsupportedTitle": "A análise para com «Pilha de rede não suportada»",
+    "unsupportedBody": "O host usa netplan, systemd-networkd ou NetworkManager. A ferramenta só suporta <code>/etc/network/interfaces</code>. Mude primeiro o host para a pilha clássica ou altere a configuração com as ferramentas nativas do gestor (por exemplo <code>netplan apply</code>).",
+    "noSuggestTitle": "Nenhuma sugestão é impressa para uma porta inválida",
+    "noSuggestBody": "O host tem zero interfaces físicas livres (tudo já está em outra ponte ou não existe). A análise remonta a sugerir <code>bridge-ports none</code> para que a ponte possa pelo menos subir sem um porto. Adicionar um NIC ou migrar portas entre pontes manualmente antes de repetir.",
+    "stillDownTitle": "O reparo completa, mas a ponte ainda está em baixo",
+    "stillDownBody": "<code>sed</code> atualizou o arquivo, mas <code>systemctl restart networking</code> foi recusado. Execute-o manualmente assim que a nova configuração for verificada, ou reinicie. Se o reinício foi aceito e a ponte ainda estiver baixa, execute <code>ip link show</code> para confirmar a nova porta existe, em seguida, verifique <code>journalctl -u networking</code> para o erro real (cabo desconectado, link não negociado, porto já um membro de outra ponte).",
+    "lostSshTitle": "Perdi o acesso SSH logo após reiniciar a rede",
+    "lostSshIntro": "Use console / IPMI / iKVM para chegar ao host. Restaurar o backup:",
+    "lostSshOutro": "Em seguida, re-execute a análise do console para descobrir por que a sugestão não funcionou (normalmente: a porta de substituição não está realmente conectada)."
+  },
+  "related": {
+    "heading": "Relacionado",
+    "items": [
+      {
+        "label": "Nomes de interface persistentes",
+        "href": "/docs/network/persistent-names",
+        "tail": " — atribuir nomes aos endereços MAC para que este cenário deixe de acontecer."
+      },
+      {
+        "label": "Análise de configuração e limpeza guiada",
+        "href": "/docs/network/config-analysis",
+        "tailRich": " — para os blocos <code>iface</code> órfãos (a outra metade do mesmo problema)."
+      },
+      {
+        "label": "Cópia de segurança e reinício das interfaces",
+        "href": "/docs/network/backup-restore",
+        "tail": " — instantâneos manuais e o navegador de restauração."
+      }
+    ]
+  }
+}
diff --git a/web/messages/pt/docs/network/config-analysis.json b/web/messages/pt/docs/network/config-analysis.json
new file mode 100644
index 00000000..b165f844
--- /dev/null
+++ b/web/messages/pt/docs/network/config-analysis.json
@@ -0,0 +1,122 @@
+{
+  "meta": {
+    "title": "Análise de configuração e limpeza guiada | Documentação ProxMenux",
+    "description": "Deteta blocos iface em /etc/network/interfaces que referem placas de rede físicas já ausentes do host. Apresenta-os e propõe uma remoção guiada em 5 passos com cópia de segurança obrigatória e pré-visualização de cada bloco.",
+    "ogTitle": "Análise de configuração e limpeza guiada | Documentação ProxMenux",
+    "ogDescription": "Encontrar e remover blocos de interface órfão deixados para trás por mudanças de hardware, com visualização completa e rollback."
+  },
+  "header": {
+    "title": "Análise de configuração e limpeza guiada",
+    "description": "Examina cada bloco iface em /etc/network/interfaces e verifica se a placa de rede física correspondente ainda existe. Apresenta os blocos órfãos deixados por alterações de hardware e propõe uma remoção guiada com cópia de segurança, pré-visualização e confirmação de cada bloco.",
+    "section": "Rede"
+  },
+  "intro": {
+    "title": "O que isto faz",
+    "body": "Identifica declarações <code>iface</code> cuja NIC de apoio não está mais presente no host (típico após a substituição ou remoção de uma placa de rede). Em seguida, oferece uma limpeza guiada que remove <em>apenas</em> os blocos órfãos, com um backup, uma visualização por seção e uma confirmação final explícita."
+  },
+  "differs": {
+    "heading": "Como difere da análise da ponte",
+    "headerAspect": "Aspecto",
+    "headerBridge": "Análise da ponte",
+    "headerConfig": "Análise de configuração",
+    "rows": [
+      {
+        "aspect": "Olha para",
+        "bridge": "Pontes (<code>vmbrX</code>) e sua linha <code>bridge-ports</code>",
+        "config": "Cada bloco <code>iface</code>, excluindo loopback, bridges e bonds"
+      },
+      {
+        "aspect": "Detecta",
+        "bridge": "Bridges que referem uma porta inexistente",
+        "config": "Blocos de interface independentes para NICs que não existem"
+      },
+      {
+        "aspect": "Acção de reparação",
+        "bridge": "Substitui o nome do porto em <code>bridge-ports</code>",
+        "config": "Remove todo o bloco <code>iface</code>"
+      },
+      {
+        "aspect": "Exclui",
+        "bridge": "Nada — cada ponte é analisada",
+        "config": "Bridges (<code>vmbrX</code>) e bonds (<code>bondX</code>) são sempre mantidos, pois são virtuais e a sua ausência durante o arranque pode ser normal"
+      }
+    ],
+    "outro": "Na prática, usam-se frequentemente ambas por esta ordem: primeiro a <strong>análise de configuração</strong> para remover blocos órfãos, depois a <link>análise de bridges</link> para reatribuir os bridges que dependiam da interface removida."
+  },
+  "step1": {
+    "heading": "Passo 1: análise (somente leitura)",
+    "intro": "Aborta imediatamente se a máquina não estiver na pilha clássica. Caso contrário, lista todas as interfaces não- loopback configuradas e reporta o seu estado:",
+    "virtTitle": "As interfaces virtuais estão protegidas",
+    "virtBody": "Bridges (<code>vmbrX</code>) e bonds (<code>bondX</code>) são estruturas virtuais. Podem legitimamente não existir no momento da inspeção, como um bridge ainda sem portas. A análise nunca propõe removê-los — apenas placas de rede físicas."
+  },
+  "step2": {
+    "heading": "Passo 2: limpeza guiada (5 passos)",
+    "intro": "Só se inicia se aceitar a proposta no fim da análise. Cada passo exige confirmação; cancelar em qualquer ponto termina sem escrever.",
+    "steps": [
+      {
+        "title": "1. Cópia de segurança",
+        "body": "Copia <code>/etc/network/interfaces</code> para <code>/var/backups/proxmenux/interfaces_backup_&lt;TIMESTAMP&gt;</code>. Caminho mostrado antes e depois.",
+        "tone": "blue"
+      },
+      {
+        "title": "2. Confirmar a lista de remoção",
+        "body": "Lista exatamente os blocos de interfaces físicas a remover. Se as placas de rede reaparecerem entre a análise e a limpeza, por exemplo após voltar a inserir uma placa, o processo termina com <em>«Não é necessária limpeza.»</em>",
+        "tone": "blue"
+      },
+      {
+        "title": "3. Visualizar o( s) bloco( s) exato( s)",
+        "body": "Abre uma vista com deslocamento de cada bloco <code>iface</code> que seria eliminado, exatamente como está no ficheiro. É a altura de identificar, por exemplo, um hook <code>up</code> que queira preservar.",
+        "tone": "blue"
+      },
+      {
+        "title": "4. Aplicar remoção",
+        "body": "Para cada interface órfã, executa <code>sed -i \"/^iface $iface/,/^$/d\" /etc/network/interfaces</code>. Isso apaga da linha <code>iface</code> correspondente até a próxima linha em branco.",
+        "tone": "amber"
+      },
+      {
+        "title": "5. Verificação",
+        "body": "Lê novamente o ficheiro, lista o que foi removido e verifica as interfaces restantes. Mostra o comando para reverter. <strong>Não</strong> reinicia a rede automaticamente — remover um bloco não usado pode ser aplicado em segurança no próximo reinício, evitando alterar o estado ativo.",
+        "tone": "emerald"
+      }
+    ],
+    "noRestartTitle": "Não reinicia automaticamente a rede",
+    "noRestartBody": "Ao contrário do reparo de ponte, o fluxo de limpeza não oferece para reiniciar o serviço. Remover um bloco de interface não utilizado não tem efeito imediato na configuração em execução, então uma reinicialização é desnecessária e seria um risco desnecessário de conectividade. A mudança produz efeito no próximo manual <code>systemctl restart networking</code> ou na próxima reinicialização."
+  },
+  "caveats": {
+    "heading": "Advertências importantes",
+    "boundaryTitle": "O limite do bloco é a primeira linha em branco",
+    "boundaryBody": "O padrão <code>sed</code> elimina desde <code>iface &lt;name&gt;</code> até à próxima linha vazia. Se <code>/etc/network/interfaces</code> não tiver linhas vazias entre blocos, algo raro mas possível após edição manual, o bloco seguinte também pode ser eliminado. Por isso, <strong>o passo 3 é obrigatório</strong>: reveja a pré-visualização antes de confirmar.",
+    "tandemTitle": "Um bloco iface órfão usado por um bridge é detetado aqui, não na análise de bridges",
+    "tandemBody": "Se <code>vmbr0</code> declarar <code>bridge-ports enp3s0</code> e <code>enp3s0</code> também tiver o seu bloco <code>iface enp3s0 inet manual</code>, remover <code>enp3s0</code> aqui deixa uma referência inválida em <code>vmbr0</code>. Após a limpeza, execute a <link>análise de bridges</link> para reatribuir ou remover a porta do bridge. Os dois procedimentos foram concebidos para uso conjunto."
+  },
+  "troubleshoot": {
+    "heading": "Resolução de Problemas",
+    "notFoundTitle": "A análise mostra o meu novo NIC como \"NÃO ENCONTRADO\"",
+    "notFoundBody": "O kernel vê o dispositivo com um nome diferente do que está no ficheiro. Execute <code>ip link show</code> para obter o nome real. É precisamente um caso em que os <link>nomes persistentes das interfaces</link> evitariam o problema no futuro.",
+    "tooMuchTitle": "A limpeza removeu demasiado, incluindo um bloco que queria manter",
+    "tooMuchBody": "Restaurar a partir do backup impresso na etapa 5:",
+    "tooMuchOutro": "Edite o arquivo manualmente para adicionar uma linha em branco clara entre os blocos antes de repetir a limpeza ou remover o bloco problemático manualmente.",
+    "bridgeBreakTitle": "Uma ponte pára de funcionar após a limpeza",
+    "bridgeBreakBody": "O bridge dependia de uma porta cujo bloco <code>iface</code> foi removido. Execute a <link>análise de bridges</link> e a sugestão associará o bridge a uma interface física existente."
+  },
+  "related": {
+    "heading": "Relacionado",
+    "items": [
+      {
+        "label": "Análise de ponte e reparo guiado",
+        "href": "/docs/network/bridge-analysis",
+        "tail": " — o acompanhamento natural após uma limpeza."
+      },
+      {
+        "label": "Nomes de interface persistentes",
+        "href": "/docs/network/persistent-names",
+        "tail": " — impede a acumulação de blocos órfãos após cada mudança de hardware."
+      },
+      {
+        "label": "Cópia de segurança e reinício das interfaces",
+        "href": "/docs/network/backup-restore",
+        "tail": " — instantâneos manuais e o navegador de restauração."
+      }
+    ]
+  }
+}
diff --git a/web/messages/pt/docs/network/diagnostics.json b/web/messages/pt/docs/network/diagnostics.json
new file mode 100644
index 00000000..b7d2abd0
--- /dev/null
+++ b/web/messages/pt/docs/network/diagnostics.json
@@ -0,0 +1,94 @@
+{
+  "meta": {
+    "title": "Diagnósticos | Documentação ProxMenux",
+    "description": "Três diagnósticos pontuais só de leitura: Mostrar tabela de encaminhamento, Testar conectividade e Diagnósticos avançados. Apenas inspeção — nunca escreve em /etc/network/interfaces nem executa comandos de alteração, com uma exceção explícita que exige a sua aceitação: purgar o NetworkManager, caso seja detetado.",
+    "ogTitle": "Diagnósticos | Documentação ProxMenux",
+    "ogDescription": "Diagnósticos de rede somente leitura para o host Proxmox: roteamento, acessibilidade, estatísticas avançadas."
+  },
+  "header": {
+    "title": "Diagnósticos",
+    "description": "Três verificações pontuais só de leitura do estado atual da rede: tabela de encaminhamento, teste de conectividade e estatísticas avançadas. Nenhuma escreve em /etc/network/interfaces — são seguras a qualquer momento, incluindo por SSH. Para monitorização interativa em tempo real, consulte Ferramentas de monitorização em tempo real.",
+    "section": "Rede"
+  },
+  "intro": {
+    "title": "O que isto faz",
+    "body": "Apresenta informações de encaminhamento, acessibilidade e estatísticas agregadas <strong>sem modificar nada</strong>. Use para confirmar que a rede funciona ou identificar IPs duplicados. Para observar o tráfego continuamente, consulte <monitoringLink>Ferramentas de monitorização em tempo real</monitoringLink>; para ver o ficheiro de configuração em bruto, consulte <backupLink>Cópia de segurança e reinício das interfaces</backupLink>."
+  },
+  "routing": {
+    "heading": "Mostrar tabela de roteamento",
+    "body": "Lista todas as rotas que o kernel usa atualmente (<code>ip route show</code>) e destaca o gateway padrão. Útil para confirmar que o tráfego para a internet sai através da interface esperada e que nenhuma rota restante está tendo precedência."
+  },
+  "connectivity": {
+    "heading": "Testar conectividade",
+    "intro": "Envia duas sondas ICMP para três alvos em sequência e reporta cada um. Em seguida, executa um <code>nslookup google.com</code> para verificar a resolução DNS independentemente do ICMP.",
+    "headerTest": "Teste",
+    "headerTarget": "Alvo",
+    "headerConfirms": "O que confirma",
+    "rows": [
+      {
+        "test": "DNS do Google",
+        "target": "8.8.8.8",
+        "confirms": "Alcance externo através de um conhecido IP anycast"
+      },
+      {
+        "test": "Cloudflare DNS",
+        "target": "1.1.1.1",
+        "confirms": "Segunda opinião independente se o Google bloquear ICMP"
+      },
+      {
+        "test": "Gateway",
+        "target": "(rota padrão)",
+        "confirms": "Conectividade L2 / L3 com o roteador local"
+      },
+      {
+        "test": "Resolução DNS",
+        "target": "google.com",
+        "confirms": "O servidor DNS está acessível e responde"
+      }
+    ],
+    "readingTitle": "Lendo o resultado",
+    "readingBody": "Se o teste do gateway passar mas os destinos DNS públicos falharem, tem conectividade local mas não tem Internet — verifique a ligação a montante do gateway. Se a resolução DNS falhar mas os pings para <code>8.8.8.8</code> tiverem sucesso, o problema está no resolvedor, não na rede: verifique <code>/etc/resolv.conf</code>."
+  },
+  "advanced": {
+    "heading": "Diagnóstico Avançado",
+    "intro": "Agrega estatísticas em toda a rede e executa uma bateria de verificações de questões comuns. Relata as contagens de conexão ativa, portas de escuta, interfaces totais e sinaliza dois anti- padrões explicitamente:",
+    "items": [
+      "<strong>NetworkManager em execução num host Proxmox.</strong> O NetworkManager e o <code>ifupdown</code> do Proxmox entram em conflito: ambos tentam gerir as interfaces, tornando os bridges instáveis ou impedindo a sua ativação. Se for detetado, a ferramenta pede confirmação interativa para o parar, desativar e purgar (é o <em>único</em> diagnóstico que pode modificar o sistema, e só após consentimento explícito).",
+      "<strong>Endereços IP duplicados em diferentes interfaces.</strong> Duas interfaces com o mesmo IPv4 causam conectividade intermitente extremamente difícil de depurar de dentro do VM. Detectado através de <code>ip -4 addr show | sort | uniq -d</code>."
+    ],
+    "nmTitle": "O prompt NetworkManager é a única ação modificadora aqui",
+    "nmBody": "Todas as outras verificações dos diagnósticos avançados são só de leitura. A remoção do NetworkManager exige confirmação sim/não e executa <code>systemctl stop / disable</code> + <code>apt-get purge -y network-manager</code>. Se recusar, nada muda."
+  },
+  "troubleshoot": {
+    "heading": "Resolução de Problemas",
+    "gwTitle": "Testar conectividade indica uma falha do gateway, mas o host tem acesso à Internet",
+    "gwBody": "Alguns routers não respondem a ICMP na interface interna mesmo quando encaminham corretamente o tráfego. Teste com <code>traceroute 8.8.8.8</code> numa consola: se o segundo salto for o seu ISP e o teste de DNS público tiver passado, o gateway está a funcionar apesar do ping falhado.",
+    "dupTitle": "Diagnóstico avançado continua sinalizando IPs duplicados depois que eu removi um",
+    "dupBody": "A verificação olha para o estado do kernel ao vivo, não para o arquivo de configuração. Executar <code>ip -4 addr show</code> para confirmar; se a duplicata ainda estiver presente, uma interface ainda está segurando-a. Use <code>ip addr del &lt;IP&gt;/&lt;mask&gt; dev &lt;iface&gt;</code> para removê-lo do estado ao vivo, em seguida, edite <code>/etc/network/interfaces</code> se ele também é persistente."
+  },
+  "related": {
+    "heading": "Relacionado",
+    "items": [
+      {
+        "label": "Ferramentas de monitorização ao vivo",
+        "href": "/docs/network/monitoring",
+        "tail": " — lançadores interativos iftop / iptraf-ng / iperf3."
+      },
+      {
+        "label": "Análise de ponte e reparo guiado",
+        "href": "/docs/network/bridge-analysis",
+        "tail": " — quando um vmbrX não tem a sua porta física."
+      },
+      {
+        "label": "Análise de configuração e limpeza guiada",
+        "href": "/docs/network/config-analysis",
+        "tail": " — quando uma NIC antiga é ainda declarada, mas já não está presente."
+      },
+      {
+        "label": "Cópia de segurança e reinício das interfaces",
+        "href": "/docs/network/backup-restore",
+        "tail": " — para criar uma cópia da configuração antes de qualquer alteração."
+      }
+    ]
+  }
+}
diff --git a/web/messages/pt/docs/network/index.json b/web/messages/pt/docs/network/index.json
new file mode 100644
index 00000000..ab44ee7e
--- /dev/null
+++ b/web/messages/pt/docs/network/index.json
@@ -0,0 +1,107 @@
+{
+  "meta": {
+    "title": "Gestão de rede Proxmox — Bridges, bonds, diagnóstico, reparação | ProxMenux",
+    "description": "Diagnósticos só de leitura, análises seguidas de sugestões e reparações guiadas para a pilha de rede Debian / Proxmox (/etc/network/interfaces). Inspecione bridges e bonds, execute ferramentas de monitorização em tempo real, torne persistentes os nomes das interfaces, crie cópias de segurança e reinicie a rede em segurança — com cópias obrigatórias e pré-visualizações passo a passo.",
+    "ogTitle": "Gestão de rede Proxmox — Bridges, bonds, diagnóstico, reparação",
+    "ogDescription": "Diagnósticos, análise e reparos guiados para a pilha de rede Proxmox com backups obrigatórios e pré-visualizações passo a passo.",
+    "twitterTitle": "Gestão de rede Proxmox | ProxMenux",
+    "twitterDescription": "Bridges, bonds, diagnósticos e reparações guiadas para a pilha de rede Proxmox com cópias de segurança obrigatórias."
+  },
+  "header": {
+    "title": "Gerenciamento de rede",
+    "description": "Diagnósticos só de leitura, relatórios de análise com sugestões e reparações guiadas para a pilha de rede clássica Debian/Proxmox. Cada operação destrutiva cria primeiro uma cópia de segurança e mostra as alterações exatas antes de as aplicar.",
+    "section": "Rede"
+  },
+  "intro": {
+    "title": "Para que serve este menu",
+    "body": "Inspecione, diagnostique e, quando necessário, repare a configuração de rede do host Proxmox sem perder o acesso remoto. As ferramentas seguem um princípio: <strong>ler primeiro, propor e só depois aplicar com consentimento explícito e uma cópia de segurança</strong>. Não existe um botão «Corrigir tudo automaticamente»."
+  },
+  "openingMenu": {
+    "heading": "Abrir o menu",
+    "intro": "No menu principal do ProxMenux, selecione <strong>Rede</strong>. Verá o seguinte:",
+    "imageAlt": "Menu de gerenciamento de rede com diagnósticos, monitoramento, análise, reparo, nomes persistentes e opções de backup"
+  },
+  "safety": {
+    "heading": "O modelo de segurança",
+    "body": "Editar a configuração de rede de um host Proxmox remoto é uma das formas mais fáceis de perder o acesso. O ProxMenux tem isso em conta em cada ação. As ferramentas dividem-se em três níveis de comportamento — escolha o cartão que corresponde ao seu objetivo:"
+  },
+  "tiers": {
+    "readOnly": {
+      "title": "Somente leitura",
+      "body": "Inspecção pura. Não é possível modificar o sistema em nenhuma circunstância.",
+      "items": [
+        "Tabela de roteamento, testes de conectividade, estatísticas avançadas",
+        "Monitorização do tráfego ao vivo (iftop, iptraf-ng)",
+        "Teste de largura de banda (iperf3)"
+      ]
+    },
+    "analyze": {
+      "title": "Analisar, então sugerir",
+      "body": "Detecta problemas, imprime um relatório com comandos de shell propostos e pára. Você decide se deve entrar na reparação guiada depois.",
+      "items": [
+        "Análise de configuração da ponte",
+        "Análise da configuração da rede"
+      ]
+    },
+    "apply": {
+      "title": "Aplicar com backup",
+      "body": "Modifica o sistema. Cria sempre primeiro uma cópia de segurança do ficheiro afetado com data e hora e mostra uma pré-visualização antes de escrever.",
+      "items": [
+        "Nomes de interface persistentes (ficheiros .link)",
+        "Backup manual, restauração e reinício do serviço"
+      ]
+    }
+  },
+  "classicTitle": "Apenas a pilha clássica",
+  "classicBody": "Cada função de análise e reparo verifica o gerenciador de rede ativo antes de tocar em qualquer coisa. Se o host executar <strong>netplan</strong>, <strong>systemd-networkd</strong> ou <strong>NetworkManager</strong>, a ferramenta aborta imediatamente com uma mensagem clara — o menu só suporta a pilha Debian/Proxmox clássica no <code>/etc/network/interfaces</code>. Isto é intencional: editar um arquivo netplan com regras escritas para <code>ifupdown</code> iria silenciosamente corromper a configuração.",
+  "backups": {
+    "heading": "Para onde vão os backups",
+    "intro": "Cada reparação guiada, restauro ou cópia de segurança manual grava uma cópia de <code>/etc/network/interfaces</code> com data e hora em <code>/var/backups/proxmenux/</code>:",
+    "rollbackIntro": "Para repor manualmente a configuração anterior a partir de uma consola:"
+  },
+  "readOnlySection": {
+    "heading": "Inspeção somente de leitura",
+    "body": "O ponto de partida quando algo parece errado. Apenas inspeção — nunca escreve em <code>/etc/network/interfaces</code> nem executa comandos que alterem o sistema, com uma única exceção explícita que exige a sua aceitação: purgar o NetworkManager, caso seja detetado. Pode ser usado em segurança por SSH a qualquer momento.",
+    "options": [
+      {
+        "title": "Diagnósticos",
+        "description": "Três verificações pontuais só de leitura: Mostrar tabela de encaminhamento, Testar conectividade e Diagnósticos avançados. Apenas inspeção — nunca escreve no sistema."
+      },
+      {
+        "title": "Ferramentas de monitorização ao vivo",
+        "description": "Três lançadores interativos: iftop (largura de banda em tempo real por par host), iptraf-ng (monitor de tráfego multimodo) e iperf3 (teste de largura de banda, servidor / modo cliente)."
+      }
+    ]
+  },
+  "analyzeSection": {
+    "heading": "Analisar, então sugerir",
+    "body": "Usadas quando uma inspeção ou uma falha real aponta para um problema de configuração. Cada ferramenta examina a parte relevante de <code>/etc/network/interfaces</code>, apresenta um relatório detalhado com o comando exato de shell que corrigiria cada problema e <strong>para</strong>. Se aceitar depois a reparação guiada opcional, é criada uma cópia de segurança antes de cada alteração, que também é pré-visualizada antes da escrita.",
+    "options": [
+      {
+        "title": "Análise de ponte e reparo guiado",
+        "description": "Deteta bridges vmbrX com portas em falta ou inválidas, algo típico após a reenumeração PCI. Mostra primeiro um relatório e só repara quando aceita o procedimento guiado de 5 passos."
+      },
+      {
+        "title": "Análise de configuração e limpeza guiada",
+        "description": "Encontra interfaces físicas declaradas em /etc/network/interfaces que já não existem (configurações órfãs deixadas por mudanças de hardware). Comunica-os e oferece uma remoção guiada."
+      }
+    ]
+  },
+  "applySection": {
+    "heading": "Aplicar com backup",
+    "body": "Estas ferramentas escrevem no disco por natureza. Cada uma cria primeiro uma cópia de segurança do ficheiro afetado com data e hora, e as opções destrutivas, como restauro e reinício, exigem confirmação explícita sim/não. Os <em>nomes persistentes das interfaces</em> entram em vigor no próximo reinício, não de imediato, pelo que a sua configuração pode ser agendada em segurança mesmo num host remoto.",
+    "options": [
+      {
+        "title": "Nomes de interface persistentes",
+        "description": "Associa os nomes das interfaces (eno1, enp3s0, …) aos endereços MAC através de ficheiros .link do systemd. Os nomes mantêm-se após mudanças de slot PCI, atualizações do kernel e adição ou remoção de outras placas de rede."
+      },
+      {
+        "title": "Cópia de segurança e reinício das interfaces",
+        "description": "Instantâneo manual do /etc/network/interfaces, navegar e restaurar backups anteriores, visualizar a configuração ao vivo e reiniciar o serviço de rede quando necessário."
+      }
+    ]
+  },
+  "consoleTitle": "Tenha acesso à consola preparado",
+  "consoleSubTitle": "Antes de qualquer reparação em uma máquina remota",
+  "consoleBody": "Se estiver ligado por SSH e tiver apenas um caminho de acesso ao host, prepare uma alternativa antes de alterar a rede: consola física / IPMI / iKVM ou outra máquina na mesma LAN. As reparações guiadas são seguras e oferecem sempre um comando para reverter as alterações, mas um bridge mal configurado ou uma ligação interrompida pode deixá-lo sem acesso até conseguir chegar à consola."
+}
diff --git a/web/messages/pt/docs/network/monitoring.json b/web/messages/pt/docs/network/monitoring.json
new file mode 100644
index 00000000..4f279fae
--- /dev/null
+++ b/web/messages/pt/docs/network/monitoring.json
@@ -0,0 +1,136 @@
+{
+  "meta": {
+    "title": "Ferramentas de monitorização em tempo real | Documentação ProxMenux",
+    "description": "Três lançadores interativos de monitoramento de rede: iftop (largura de banda em tempo real por par host), iptraf-ng (monitor de tráfego multimodo) e iperf3 (teste de largura de banda, servidor / modo cliente). Cada um é instalado na primeira utilização.",
+    "ogTitle": "Ferramentas de monitorização em tempo real | Documentação ProxMenux",
+    "ogDescription": "Monitoramento de rede interativo e testes de largura de banda para o host Proxmox: iftop, iptraf-ng, iperf3."
+  },
+  "header": {
+    "title": "Ferramentas de monitorização ao vivo",
+    "description": "Três ferramentas interativas para observar a rede em tempo real e medir a largura de banda: iftop, iptraf-ng e iperf3. Cada uma é instalada automaticamente através do apt na primeira utilização, corre em primeiro plano e termina com a tecla indicada. Não alteram a configuração de rede do host; o iperf3 gera tráfego de teste.",
+    "section": "Rede"
+  },
+  "intro": {
+    "title": "O que isto faz",
+    "body": "Três ferramentas interativas de monitoramento, cada uma atrás de seu próprio menu. A primeira vez que você lança um, o pacote é instalado silenciosamente via <code>apt-get</code>. Lançamentos subsequentes começam instantaneamente. Nenhuma destas ferramentas modifica a configuração da rede host."
+  },
+  "when": {
+    "heading": "Quando utilizar qual",
+    "headerQuestion": "Pergunta",
+    "headerUse": "Usar",
+    "rows": [
+      {
+        "question": "Quem está saturando o link <em> agora</em>?",
+        "use": "iftop"
+      },
+      {
+        "question": "Qual é a distribuição por protocolo e que tamanhos de pacotes e fluxos TCP estão presentes?",
+        "use": "iptraf-ng"
+      },
+      {
+        "question": "Quanta largura de banda está disponível entre duas máquinas?",
+        "use": "iperf3"
+      }
+    ]
+  },
+  "iftop": {
+    "heading": "uso de rede em tempo real (iftop)",
+    "body": "Largura de banda em tempo real por par de hosts (origem ↔ destino) — como o <code>top</code> para o tráfego. Mostra os fluxos mais intensos no topo, com médias móveis de 2/10/40 segundos. A melhor ferramenta para responder a <em>«porque está a minha ligação de saída saturada?»</em>.",
+    "exit": "<strong>Sair:</strong> prima <kbd>q</kbd>. O ProxMenux mostra um lembrete antes de iniciar.",
+    "keysTitle": "Teclas úteis no iftop",
+    "keysBody": "<kbd>n</kbd> alterna a consulta DNS, <kbd>p</kbd> mostra os números das portas, <kbd>P</kbd> pausa a visualização, <kbd>t</kbd> alterna a direção das linhas (enviado / recebido / ambos), <kbd>1</kbd>/<kbd>2</kbd>/<kbd>3</kbd> ordena pela média de 2 s / 10 s / 40 s. Lista completa em <code>man iftop</code>."
+  },
+  "iptraf": {
+    "heading": "ferramenta de monitoramento de rede (iptraf-ng)",
+    "intro": "Um monitor de tráfego com vários modos, controlado por menus. O iftop responde a <em>«quem»</em>, enquanto o iptraf-ng responde a <em>«o quê»</em>: contagens de bytes e pacotes por protocolo, acompanhamento do estado das ligações TCP, histogramas de tamanho dos pacotes e atividade LAN por estação.",
+    "menuIntro": "No lançamento você recebe um menu de cinco opções:",
+    "headerMode": "Modo",
+    "headerUseFor": "Use-o para",
+    "rows": [
+      {
+        "mode": "IP traffic monitor",
+        "useFor": "Lista em tempo real de fluxos TCP / UDP / ICMP / outros protocolos IP, com contadores de bytes e estado da ligação"
+      },
+      {
+        "mode": "General interface stats",
+        "useFor": "Contagens agregadas de pacotes IPv4 / IPv6 / TCP / UDP / ICMP / não IP por placa de rede"
+      },
+      {
+        "mode": "Detailed interface stats",
+        "useFor": "O mesmo que acima, mas para uma interface, com tamanho de pacote e detalhe de taxa"
+      },
+      {
+        "mode": "Statistical breakdowns",
+        "useFor": "Histograma de distribuição do tamanho do pacote, por porta TCP / UDP"
+      },
+      {
+        "mode": "LAN station monitor",
+        "useFor": "Estatísticas de tráfego por MAC para o domínio de transmissão local"
+      }
+    ],
+    "exit": "<strong>Saída:</strong> pressione <kbd>x</kbd> de qualquer vista (ou <kbd>Q</kbd> do menu principal). O ProxMenux mostra uma janela de lembrete antes do lançamento.",
+    "logTitle": "Guardar capturas num ficheiro",
+    "logBody": "Cada modo oferece para registrar estatísticas capturadas para <code>/var/log/iptraf-ng/</code>. Útil se você precisar de um registro de um pico de tráfego — deixe-o em execução, faça log para arquivo, reveja o arquivo depois, em vez de tentar ler a tela ao vivo."
+  },
+  "iperf3": {
+    "heading": "Teste de largura de banda (iperf3)",
+    "intro1": "Mede o débito TCP real entre dois hosts. Ao contrário do iftop / iptraf-ng, que observam o tráfego existente, o iperf3 gera tráfego sintético para testar a ligação sob carga. Indispensável para perguntas como <em>«a minha ligação 10 GbE atinge realmente 10 GbE?»</em> ou <em>«o estrangulamento está na placa de rede, no switch ou no armazenamento?»</em>.",
+    "intro2": "O iperf3 é uma <strong>ferramenta para dois hosts</strong>: um funciona como servidor, à escuta na porta TCP 5201, e o outro como cliente, que se liga, envia dados e mostra o débito. O ProxMenux pergunta qual o modo pretendido:",
+    "headerMode": "Modo",
+    "headerBehaviour": "Comportamento",
+    "headerCli": "CLI equivalente",
+    "rows": [
+      {
+        "mode": "Servidor",
+        "behaviour": "Escuta em TCP 5201 e imprime resultados para cada teste de entrada. Para em Ctrl+C.",
+        "cli": "iperf3 -s"
+      },
+      {
+        "mode": "Cliente",
+        "behaviour": "Pede o IP ou nome do servidor, liga-se, executa o teste predefinido de 10 segundos e mostra o relatório.",
+        "cli": "iperf3 -c <target>"
+      }
+    ],
+    "workflowIntro": "Fluxo de trabalho típico para testar uma ligação 10 GbE entre duas máquinas Proxmox:",
+    "workflow": [
+      "No host A, abra o menu Rede → <em>Teste de largura de banda (iperf3)</em> → escolha <strong>Servidor</strong>.",
+      "No host B, abra a mesma entrada de menu → escolha <strong>Cliente</strong> → introduza o IP do host A.",
+      "Espere 10 segundos. Compare o débito apresentado com o máximo teórico da ligação."
+    ],
+    "sample": "Exemplo de saída do cliente:",
+    "flagsTitle": "Opções úteis para executar manualmente numa shell",
+    "flagsBody": "<code>-t 60</code> teste mais longo (60s em vez de 10s padrão), <code>-P 4</code> 4 fluxos paralelos (satura mais rápido), <code>-R</code> direção reversa (servidor → cliente), <code>-u -b 100M</code> UDP teste em 100 Mbit/s (para medições de jitter / perda de pacotes), <code>-p 5202</code> usar uma porta diferente (testes múltiplos em paralelo). <code>man iperf3</code> para o conjunto completo.",
+    "firewallTitle": "Abrir a porta de firewall no servidor",
+    "firewallBody": "O servidor escuta por predefinição na porta TCP <strong>5201</strong>. Se o executar num host Proxmox com firewall restritiva, ao nível do datacenter ou do host, permita ligações TCP 5201 de entrada a partir do IP do cliente durante o teste e volte a fechar a porta no fim. O mesmo se aplica a <code>nftables</code> / <code>iptables</code> em hosts físicos."
+  },
+  "install": {
+    "heading": "Primeiro lançamento instala o pacote",
+    "body": "Todos os três lançadores verificam o binário e executam o <code>apt-get update -qq &amp;&amp; apt-get install -y &lt;pkg&gt;</code> se estiver em falta. A instalação é silenciosa: o menu pode aparecer congelado para 10–30 segundos na primeira vez. Lançamentos subsequentes começam instantaneamente."
+  },
+  "troubleshoot": {
+    "heading": "Resolução de Problemas",
+    "hangTitle": "A instalação fica bloqueada na primeira execução",
+    "hangBody": "O host não tem Internet ou os repositórios apt estão inacessíveis. Cancele com <kbd>Ctrl</kbd>+<kbd>C</kbd>, execute <code>apt-get update</code> manualmente para ver o erro real (DNS, assinatura do repositório, proxy, …) e volte ao menu.",
+    "refusedTitle": "Cliente iperf3: «unable to connect to server: Connection refused»",
+    "refusedBody": "Ou o servidor não está em execução, ou seu firewall bloqueia TCP 5201. Confirme no servidor: <code>ss -tlnp | grep 5201</code> — deve mostrar iperf3 ouvindo. Se ouvir mas o cliente ainda falhar, verifique o caminho do firewall entre os dois hosts.",
+    "slowTitle": "O iperf3 apresenta um débito muito inferior à velocidade esperada da ligação",
+    "slowBody": "Causas comuns por ordem de probabilidade: (1) a CPU de um host limita o débito — tente <code>iperf3 -c &lt;target&gt; -P 4</code> para usar vários núcleos; (2) o percurso passa por uma ligação mais lenta, como um switch gigabit entre duas placas 10 GbE; (3) MTU diferentes — verifique <code>ip link show</code> nas duas pontas; (4) offloading da placa de rede desativado — consulte o script da comunidade <em>Disable NIC Offloading</em> se tiver uma placa Intel e1000e.",
+    "noTrafficTitle": "iftop / iptraf-ng não mostram tráfego para uma máquina ocupada",
+    "noTrafficBody": "A captura padrão está na primeira interface detectada. Especifique o direito explicitamente a partir do shell: <code>iftop -i vmbr0</code> ou <code>iptraf-ng -i vmbr0</code>. O lançador de menus usa o padrão; para interfaces não padrão, execute a partir de uma consola."
+  },
+  "related": {
+    "heading": "Relacionado",
+    "items": [
+      {
+        "label": "Diagnósticos",
+        "href": "/docs/network/diagnostics",
+        "tail": " — as verificações pontuais só de leitura (encaminhamento, conectividade e estatísticas avançadas)."
+      },
+      {
+        "label": "Análise de ponte e reparo guiado",
+        "href": "/docs/network/bridge-analysis",
+        "tail": " — quando o controlo revela que uma interface ou ponte não está a fazer o que deveria."
+      }
+    ]
+  }
+}
diff --git a/web/messages/pt/docs/network/persistent-names.json b/web/messages/pt/docs/network/persistent-names.json
new file mode 100644
index 00000000..ac215469
--- /dev/null
+++ b/web/messages/pt/docs/network/persistent-names.json
@@ -0,0 +1,130 @@
+{
+  "meta": {
+    "title": "Nomes de interface persistentes | Documentação ProxMenux",
+    "description": "Associe os nomes das interfaces Proxmox (eno1, enp3s0, …) aos endereços MAC através de ficheiros .link do systemd para os manter após a reenumeração PCI, atualizações do kernel e adição ou remoção de outras placas de rede.",
+    "ogTitle": "Nomes de interface persistentes | Documentação ProxMenux",
+    "ogDescription": "Impeça que os nomes das interfaces Proxmox mudem quando altera o hardware. Usa ficheiros .link do systemd associados ao endereço MAC."
+  },
+  "header": {
+    "title": "Nomes de interface persistentes",
+    "description": "Gera um ficheiro .link do systemd por placa de rede física para associar o nome atribuído pelo kernel ao endereço MAC da placa. Após a aplicação no próximo reinício, os nomes das interfaces mantêm-se estáveis ao adicionar, remover ou mudar placas PCIe de lugar.",
+    "section": "Rede"
+  },
+  "intro": {
+    "title": "O que isto faz",
+    "body": "Para cada NIC físico no host, escreve um pequeno arquivo sob <code>/etc/systemd/network/10-&lt;iface&gt;.link</code> que diz: <em>\"o dispositivo com este MAC deve ser sempre chamado este nome\"</em>. systemd-udevd aplica a regra em cada inicialização, antes que <code>ifupdown</code> leia <code>/etc/network/interfaces</code>."
+  },
+  "problem": {
+    "heading": "O problema que isto resolve",
+    "intro": "O Linux deriva os nomes predefinidos das interfaces da topologia PCI — <code>eno1</code> = integrada na placa principal, <code>enp3s0</code> = placa no barramento PCI 3, slot 0, etc. O esquema de nomes é determinístico <em>para a mesma disposição de hardware</em>. Se a disposição mudar, os nomes mudam:",
+    "items": [
+      "Adicione um GPU na frente de um NIC existente → o número de barramento NIC pode mudar → alterações de nome.",
+      "Mudar uma placa para outro slot PCIe → o nome muda.",
+      "BIOS / UEFI atualização que re-enumera dispositivos → nomes podem mudar.",
+      "Substituir uma placa avariada pelo mesmo modelo noutro slot → o nome muda."
+    ],
+    "outro": "Após uma alteração destas, <code>/etc/network/interfaces</code> continua a referir o nome <em>antigo</em>; o bridge não se ativa e o host perde a rede. Configurar nomes persistentes impede que este cenário se repita."
+  },
+  "howWorks": {
+    "heading": "Como funciona",
+    "arrowLabel": "por NIC",
+    "nodes": {
+      "detectLabel": "Detetar placas de rede físicas",
+      "detectDetail": "ls /sys/class/net/\nexcluir vmbr / bond /\ndocker / veth / wireguard …",
+      "readLabel": "Ler cada MAC",
+      "readDetail": "cat /sys/class/net/\n  '<'iface'>'/address",
+      "writeLabel": "Gravar o ficheiro .link",
+      "writeDetail": "/etc/systemd/network/\n  10-'<'iface'>'.link"
+    },
+    "minimalIntro": "Cada arquivo gerado é intencionalmente mínimo:",
+    "minimalOutro": "No arranque, o systemd-udevd identifica o dispositivo pelo MAC e atribui o nome pedido <em>antes</em> da intervenção de outros componentes (ifupdown, nomes predefinidos do kernel). O prefixo <code>10-</code> garante que estas regras carregam cedo, antes do ficheiro predefinido <code>99-default.link</code>."
+  },
+  "scope": {
+    "heading": "O que é escrito, o que é ignorado",
+    "headerType": "Tipo",
+    "headerBehaviour": "Comportamento",
+    "headerWhy": "Porquê?",
+    "rows": [
+      {
+        "type": "Placa de rede integrada / PCIe",
+        "behaviour": "Arquivo <code>.link</code> escrito",
+        "why": "Apoiado por um dispositivo PCI real — o caso em que a ferramenta se destina"
+      },
+      {
+        "type": "Wi-Fi (phy80211)",
+        "behaviour": "Arquivo <code>.link</code> escrito",
+        "why": "Tem um MAC real e beneficia da estabilidade do nome"
+      },
+      {
+        "type": "Pontes (vmbrX)",
+        "behaviour": "Ignorado",
+        "why": "Virtual; o nome vem do <code>/etc/network/interfaces</code>"
+      },
+      {
+        "type": "Bonds (bondX)",
+        "behaviour": "Ignorado",
+        "why": "Virtual; o nome do bond é definido pelo ifupdown"
+      },
+      {
+        "type": "veth / docker0 / br-XXXX",
+        "behaviour": "Ignorado",
+        "why": "Criados a pedido pelo Docker / LXC — não são hardware persistente"
+      },
+      {
+        "type": "tap / fwpr / fwln",
+        "behaviour": "Ignorado",
+        "why": "Criados a pedido pelo Proxmox para cada VM/CT"
+      },
+      {
+        "type": "WireGuard / Cilium / Tailscale",
+        "behaviour": "Ignorado",
+        "why": "Interfaces de software gerenciadas por seus próprios daemons"
+      }
+    ]
+  },
+  "safety": {
+    "heading": "Proteção: são criadas cópias de segurança dos ficheiros .link anteriores",
+    "intro": "Se <code>/etc/systemd/network/</code> já contiver ficheiros <code>.link</code> de uma execução anterior ou de outra ferramenta, são copiados para um diretório de segurança com data e hora antes de gerar os novos:",
+    "outro": "Para voltar atrás: copie os arquivos de volta do diretório de backup e reinicie.",
+    "rebootTitle": "Faz efeito na próxima reinicialização, não imediatamente",
+    "rebootBody": "Alterações nos arquivos <code>.link</code> só se aplicam no arranque, quando o udev re-enumera dispositivos. A ferramenta informa que <em>\"Alterações serão aplicadas após reiniciar\"</em> por esta razão. Renomear uma interface ao vivo é arriscado e não tentado: um <code>vmbr0</code> ativo com membros teria que ser reconfigurado atomicamente, por isso a operação é adiada para a próxima inicialização limpa."
+  },
+  "afterReboot": {
+    "heading": "Após a reinicialização",
+    "intro": "Uma vez que os nomes são fixados, o fluxo de trabalho para futuras mudanças de hardware é simples:",
+    "items": [
+      "Desligue, altere o hardware (adicione uma placa, mude de slot, …) e ligue novamente.",
+      "Cada NIC mantém seu nome anterior porque seu MAC corresponde a um arquivo <code>.link</code>.",
+      "Se um NIC é substituído (MAC diferente), ele recebe um nome padrão do kernel (<code>enp&lt;bus&gt;s&lt;slot&gt;</code>); execute novamente este menu para adicionar uma entrada <code>.link</code> para o MAC do novo cartão."
+    ]
+  },
+  "troubleshoot": {
+    "heading": "Resolução de Problemas",
+    "emptyTitle": "\"Nenhuma interface física encontrada\" após executar a ferramenta",
+    "emptyBody": "O kernel não vê interfaces baseadas em PCI / phy80211 no host. Confirme com <code>ls -l /sys/class/net/</code> — cada entrada deve ter uma ligação simbólica <code>device</code> (PCI) ou uma entrada <code>phy80211</code> (Wi-Fi). Se ambas faltarem numa placa de rede real, o controlador não está carregado.",
+    "noChangeTitle": "Após a reinicialização, os nomes não mudaram como esperado",
+    "noChangeBody": "Verifique se o arquivo está presente e bem formado: <code>cat /etc/systemd/network/10-&lt;iface&gt;.link</code>. Em seguida, verifique registros udev: <code>journalctl -u systemd-udevd -b | grep -i link</code>. Uma causa comum é um parâmetro antigo do kernel <code>net.ifnames=0</code> que desativa inteiramente a nomeação previsível — remova-a do <code>/etc/default/grub</code>, execute o <code>update-grub</code>, reinicie.",
+    "undoTitle": "Quero anular os nomes persistentes",
+    "undoBody": "Ou delete os arquivos <code>.link</code> (<code>rm /etc/systemd/network/10-*.link</code>) ou restaure do diretório de backup gerado na execução anterior. Reiniciar para aplicar."
+  },
+  "related": {
+    "heading": "Relacionado",
+    "items": [
+      {
+        "label": "Análise de ponte e reparo guiado",
+        "href": "/docs/network/bridge-analysis",
+        "tailRich": " — o caminho de recuperação quando os nomes <em>já</em> mudaram."
+      },
+      {
+        "label": "Análise de configuração e limpeza guiada",
+        "href": "/docs/network/config-analysis",
+        "tail": " — para remover blocos órfãos deixados pelas mudanças de nomes."
+      },
+      {
+        "label": "Diagnósticos",
+        "href": "/docs/network/diagnostics",
+        "tailRich": " — confirme os novos nomes com <em>Mostrar tabela de roteamento</em> após reiniciar."
+      }
+    ]
+  }
+}
diff --git a/web/messages/pt/docs/oci-manager/architecture.json b/web/messages/pt/docs/oci-manager/architecture.json
new file mode 100644
index 00000000..3e6229c5
--- /dev/null
+++ b/web/messages/pt/docs/oci-manager/architecture.json
@@ -0,0 +1,171 @@
+{
+  "meta": {
+    "title": "Como é adaptada uma imagem OCI | ProxMenux",
+    "description": "Do repositório da imagem e do respetivo ficheiro Compose a um modelo que pode ser revisto, um plano de implementação e um LXC nativo do Proxmox VE, sem Docker no seu interior."
+  },
+  "header": {
+    "title": "Como é adaptada uma imagem OCI",
+    "description": "Do repositório da imagem e do respetivo ficheiro Compose a um modelo que pode ser revisto, um plano de implementação e um LXC nativo, sem instalar Docker no seu interior.",
+    "section": "OCI manager Apps"
+  },
+  "sections": [
+    {
+      "id": "pipeline",
+      "title": "O processo de adaptação",
+      "blocks": [
+        {
+          "mermaid": {
+            "chartCode": "flowchart LR\n A[\"{{repo}}\"] --> B[\"Compose + README\"]\n B --> C[\"{{converter}}\"]\n C --> D[\"{{template}}\"]\n D --> E{\"{{blockers}}\"}\n E -- \"{{no}}\" --> F[\"{{review}}\"]\n F --> D\n E -- \"{{yes}}\" --> G[\"{{plan}}\"]\n G --> H[\"pct create\"]\n H --> I[\"{{lxc}}\"]",
+            "labels": {
+              "repo": "Repositório da imagem",
+              "converter": "Conversor",
+              "template": "Modelo JSON",
+              "blockers": "Sem impedimentos?",
+              "no": "Não",
+              "yes": "Sim",
+              "review": "Revisão / overlay",
+              "plan": "Plano de implementação",
+              "lxc": "LXC nativo"
+            }
+          }
+        },
+        {
+          "p": "O conversor lê a imagem e o ficheiro Compose publicados pelo projeto e gera um modelo JSON. Se houver requisitos ainda não adaptados que impeçam a instalação, o modelo é revisto antes de ser publicado no catálogo. Um ficheiro de ajustes revistos, chamado overlay, resolve esses impedimentos. Só os modelos sem impedimentos pendentes são propostos para instalação."
+        }
+      ]
+    },
+    {
+      "id": "template",
+      "title": "O que o modelo preserva",
+      "blocks": [
+        {
+          "cards": {
+            "items": [
+              {
+                "icon": "archive",
+                "title": "Identidade da imagem",
+                "body": "Repositório, tag de atualização contínua, arquitetura, digest resolvido e revisão de origem."
+              },
+              {
+                "icon": "braces",
+                "title": "Contrato do contentor",
+                "body": "Entrypoint, Cmd, ambiente, utilizador, diretório de trabalho, sinal de paragem, portas e volumes."
+              },
+              {
+                "icon": "layers",
+                "title": "Adaptação ao Proxmox VE",
+                "body": "Recursos, segurança, pontos de montagem, dispositivos, sysctls, verificações de estado e as adaptações necessárias em cada caso, com a respetiva justificação."
+              },
+              {
+                "icon": "shield",
+                "title": "Compatibilidade",
+                "body": "Chaves suportadas, requisitos por adaptar que impedem a instalação e estado de cada validação."
+              }
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "sources",
+      "title": "O OCI fornece o processo; o Compose fornece o ambiente",
+      "blocks": [
+        {
+          "table": {
+            "headers": [
+              "Origem",
+              "Exemplo",
+              "Resultado nativo"
+            ],
+            "rows": [
+              [
+                "Metadados OCI",
+                "<code>Entrypoint</code>, <code>Cmd</code>, <code>User</code>",
+                "O Proxmox VE importa-os ao criar o CT"
+              ],
+              [
+                "Docker Compose",
+                "<code>environment</code>, <code>volumes</code>, <code>devices</code>",
+                "Entradas de ambiente LXC, <code>mpN</code> e <code>devN</code>"
+              ],
+              [
+                "Perfil do ProxMenux",
+                "GPU, verificação de estado, credenciais",
+                "Perguntas e adaptações revistas"
+              ],
+              [
+                "Utilizador",
+                "VMID, armazenamento, rede",
+                "O contrato da instância"
+              ]
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "install",
+      "title": "O que acontece durante a instalação",
+      "blocks": [
+        {
+          "steps": {
+            "items": [
+              {
+                "title": "Resolver a referência",
+                "body": "O registo é consultado, a arquitetura do host é selecionada e é fixado o digest exato para o qual aponta a tag de atualização contínua."
+              },
+              {
+                "title": "Descarregar e verificar",
+                "body": "O Skopeo descarrega a imagem como um arquivo OCI. Antes de criar qualquer recurso, cada camada é verificada através do respetivo digest e descomprimida. Se a descarga estiver danificada, é repetida uma vez antes de a instalação ser interrompida."
+              },
+              {
+                "title": "Criar o sistema de ficheiros",
+                "body": "O <code>pct create</code> cria o rootfs a partir do arquivo e preserva os metadados oficiais do processo da imagem."
+              },
+              {
+                "title": "Ligar os recursos",
+                "body": "São aplicados os volumes, a rede, o ambiente, os dispositivos e os perfis de segurança declarados."
+              },
+              {
+                "title": "Consola",
+                "body": "A saída da consola do contentor é guardada no host. A consola do Proxmox VE abre uma shell se a imagem incluir uma."
+              },
+              {
+                "title": "Verificar",
+                "body": "No primeiro arranque, aguarda-se que o contentor tenha um endereço e que o serviço responda. Em caso de falha, a instalação não é apresentada como concluída com sucesso."
+              },
+              {
+                "title": "Registar a configuração",
+                "body": "A configuração efetiva é guardada no contrato da instância utilizado nas atualizações e recriações."
+              }
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "example",
+      "title": "Exemplo: uma imagem com /config e /downloads",
+      "intro": "Uma definição Compose habitual e a configuração do Proxmox VE que dela resulta. Os caminhos esperados pela aplicação não mudam.",
+      "blocks": [
+        {
+          "codeGrid": {
+            "items": [
+              {
+                "title": "Docker Compose",
+                "code": "image: lscr.io/linuxserver/example:latest\nenvironment:\n  - PUID=1000\n  - PGID=1000\nvolumes:\n  - config:/config\n  - /srv/downloads:/downloads\nports:\n  - 8080:8080"
+              },
+              {
+                "title": "/etc/pve/lxc/VMID.conf (excerto)",
+                "code": "entrypoint: /init\nmp0: local-lvm:vm-VMID-disk-1,mp=/config,backup=1,size=8G\nmp1: /srv/downloads,mp=/downloads\nnet0: name=eth0,bridge=vmbr0,ip=dhcp,type=veth\nlxc.environment.runtime: PUID=1000\nlxc.environment.runtime: PGID=1000"
+              }
+            ]
+          }
+        },
+        {
+          "p": "O <code>mp0</code> é um segundo disco pertencente ao contentor, com o nome <code>vm-VMID-disk-N</code> no armazenamento selecionado. É montado em <code>/config</code> e, com <code>backup=1</code>, incluído na cópia de segurança do contentor. O <code>mp1</code> não cria um disco: monta o diretório do host <code>/srv/downloads</code> em <code>/downloads</code> dentro do LXC. A porta 8080 não é mapeada: o LXC tem um endereço próprio e o serviço responde nesse endereço."
+        }
+      ]
+    }
+  ]
+}
diff --git a/web/messages/pt/docs/oci-manager/custom-image.json b/web/messages/pt/docs/oci-manager/custom-image.json
new file mode 100644
index 00000000..d8fc1551
--- /dev/null
+++ b/web/messages/pt/docs/oci-manager/custom-image.json
@@ -0,0 +1,278 @@
+{
+  "meta": {
+    "title": "Instalar uma imagem fora do catálogo | ProxMenux",
+    "description": "Adapte uma imagem OCI a partir de um ficheiro Compose, de um URL, de um comando docker run ou de uma referência de imagem e reveja o que o ProxMenux consegue reproduzir antes de a instalar."
+  },
+  "header": {
+    "title": "Instalar uma imagem fora do catálogo",
+    "description": "A sua imagem é adaptada a partir do ficheiro Compose, de um comando docker run ou apenas da referência. O resultado é apresentado para revisão antes de criar qualquer LXC.",
+    "section": "OCI manager Apps"
+  },
+  "sections": [
+    {
+      "id": "intro",
+      "blocks": [
+        {
+          "calloutInfo": {
+            "title": "O mesmo conversor e o mesmo instalador",
+            "body": "A opção <strong>Instalar uma imagem fora do catálogo</strong> utiliza o mesmo conversor e instalador dos modelos do catálogo. A diferença é que o contrato é gerado nesse momento a partir da definição fornecida e validado antes de criar qualquer LXC."
+          }
+        }
+      ]
+    },
+    {
+      "id": "sources",
+      "title": "Como é descrita a imagem",
+      "intro": "O primeiro ecrã pergunta como é descrita a imagem. Quatro opções recebem uma definição a adaptar, uma quinta utiliza apenas o nome da imagem e outras três leem um oci-compose já escrito.",
+      "blocks": [
+        {
+          "table": {
+            "headers": [
+              "Opção",
+              "O que é lido"
+            ],
+            "rows": [
+              [
+                "Colar o ficheiro Compose no terminal",
+                "Cole o conteúdo YAML no terminal e termine com Ctrl+D."
+              ],
+              [
+                "Ler o ficheiro Compose deste host",
+                "Um caminho no nó, <code>/root/docker-compose.yml</code> por predefinição. O ficheiro tem de existir e não ultrapassar 256 KiB."
+              ],
+              [
+                "Descarregar o ficheiro Compose de um endereço",
+                "Um endereço <code>http://</code> ou <code>https://</code> que disponibilize o YAML em bruto. São descarregados no máximo 256 KiB."
+              ],
+              [
+                "Colar o comando docker run no terminal",
+                "O comando publicado pelo projeto. São adaptadas as portas, o ambiente, os volumes, os dispositivos, as capabilities, o utilizador, a memória partilhada e as restantes opções suportadas."
+              ],
+              [
+                "Apenas a referência da imagem, sem ficheiro Compose",
+                "Uma referência como <code>ghcr.io/user/application:latest</code>. O registo é consultado e os metadados OCI da imagem são preservados."
+              ],
+              [
+                "Colar um oci-compose no terminal",
+                "Cole o JSON no terminal e termine com Ctrl+D. Não é convertido: é validado e instalado tal como está escrito."
+              ],
+              [
+                "Ler um oci-compose deste host",
+                "Um ficheiro JSON no nó, <code>/root/oci-compose.json</code> por predefinição, com um máximo de 2 MiB."
+              ],
+              [
+                "Descarregar um oci-compose de um endereço",
+                "Um endereço <code>http://</code> ou <code>https://</code> que disponibilize o ficheiro JSON. São descarregados no máximo 2 MiB."
+              ]
+            ]
+          }
+        },
+        {
+          "figure": {
+            "src": "/oci-manager/custom-source-menu.png",
+            "alt": "Menu para escolher como descrever uma imagem fora do catálogo",
+            "caption": "Formas de descrever uma imagem fora do catálogo."
+          }
+        }
+      ]
+    },
+    {
+      "id": "reference-only",
+      "title": "O que fornece apenas a referência da imagem",
+      "intro": "A imagem contém os metadados do seu processo, mas não todo o ambiente que um ficheiro Compose costuma acrescentar.",
+      "blocks": [
+        {
+          "table": {
+            "headers": [
+              "Lido da imagem",
+              "Ausente da imagem",
+              "Consequência"
+            ],
+            "rows": [
+              [
+                "<code>Entrypoint</code>, <code>Cmd</code>, <code>User</code>, <code>WorkingDir</code> e o ambiente incorporado",
+                "Variáveis presentes apenas na documentação",
+                "São acrescentadas na instalação ou em Modificar"
+              ],
+              [
+                "Volumes declarados pela imagem",
+                "Diretórios do host indicados apenas no ficheiro Compose",
+                "Os caminhos adicionais são acrescentados antes da instalação"
+              ],
+              [
+                "Portas <code>EXPOSE</code>",
+                "O URL, o protocolo ou a verificação funcional do serviço",
+                "São confirmados a porta e o método de verificação do serviço"
+              ],
+              [
+                "Arquiteturas e digest no registo",
+                "Dispositivos, privilégios ou dependências externas",
+                "Não são ativados sem uma definição que os solicite"
+              ]
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "review",
+      "title": "Rever antes de instalar",
+      "intro": "Após adaptar a definição, o ProxMenux apresenta como a interpretou antes de perguntar o VMID, os recursos ou o armazenamento.",
+      "blocks": [
+        {
+          "steps": {
+            "items": [
+              {
+                "title": "Analisar",
+                "body": "São lidos os serviços, a imagem, as portas, os caminhos, o ambiente, os dispositivos, a segurança e a verificação de estado."
+              },
+              {
+                "title": "Consultar o registo",
+                "body": "A imagem tem de existir no registo e são apresentadas as arquiteturas publicadas. Um registo privado é consultado com a conta guardada para ele."
+              },
+              {
+                "title": "Listar o que não é aplicado",
+                "body": "São listados os labels, as redes Docker, as definições Swarm e outras chaves sem efeito num LXC."
+              },
+              {
+                "title": "Bloquear opções sem equivalente seguro",
+                "body": "As chaves sem equivalente seguro aparecem em <strong>Opções sem equivalente</strong> e impedem a continuação da instalação. Nenhuma é descartada sem aviso."
+              },
+              {
+                "title": "Pedir segredos",
+                "body": "As variáveis cujo nome indica uma palavra-passe, token ou chave são pedidas como dados sensíveis durante a instalação."
+              }
+            ]
+          }
+        },
+        {
+          "figure": {
+            "src": "/oci-manager/custom-review.png",
+            "alt": "Resumo da interpretação do ficheiro Compose pelo ProxMenux",
+            "caption": "Resumo apresentado antes de o instalador perguntar o VMID e os recursos."
+          }
+        },
+        {
+          "p": "Após aceitar o resumo, segue-se o mesmo assistente do catálogo: nome, modo predefinido ou avançado, VMID, CPU, memória, rede, arranque com o nó, caminhos persistentes e adicionais, dispositivos compatíveis e resumo final."
+        }
+      ]
+    },
+    {
+      "id": "examples",
+      "title": "Exemplos de entrada",
+      "blocks": [
+        {
+          "codeGrid": {
+            "items": [
+              {
+                "title": "Compose",
+                "code": "services:\n  app:\n    image: ghcr.io/example/app:latest\n    ports:\n      - \"8080:8080\"\n    volumes:\n      - ./config:/config\n      - /srv/media:/media\n    environment:\n      TZ: Europe/Madrid"
+              },
+              {
+                "title": "docker run",
+                "code": "docker run -d \\\n  --name app \\\n  -p 8080:8080 \\\n  -e TZ=Europe/Madrid \\\n  -v app-config:/config \\\n  -v /srv/media:/media \\\n  ghcr.io/example/app:latest"
+              }
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "oci-compose",
+      "title": "Um oci-compose escrito à mão",
+      "intro": "Um oci-compose é o ficheiro JSON a partir do qual se instala uma aplicação. O catálogo guarda um por aplicação. O mesmo formato pode ser escrito à mão e instalado com esta opção.",
+      "blocks": [
+        {
+          "p": "Num ficheiro escrito à mão, o autor define a imagem, as portas, as variáveis, os volumes e as perguntas da instalação. O ProxMenux completa o resto ao ler o ficheiro. O formato permite expressar o que o Compose não prevê: o texto de uma pergunta, uma palavra-passe gerada durante a instalação, um perfil de GPU, o proprietário de cada volume, a verificação do primeiro arranque ou as credenciais apresentadas no fim."
+        },
+        {
+          "steps": {
+            "items": [
+              {
+                "title": "Verificar",
+                "body": "Os ficheiros com erros não são instalados. Cada erro indica o campo afetado; se o JSON for inválido, são indicadas a linha e a coluna."
+              },
+              {
+                "title": "Rever",
+                "body": "Um ficheiro válido apresenta o que instala: imagem, endereço web, portas, caminhos persistentes, variáveis pedidas pelo instalador e ficheiros que serão escritos."
+              },
+              {
+                "title": "Instalar",
+                "body": "A instalação segue o mesmo processo das aplicações do catálogo, com definições predefinidas ou avançadas."
+              }
+            ]
+          }
+        },
+        {
+          "calloutWarning": {
+            "title": "Um ficheiro que define os privilégios",
+            "body": "Um oci-compose determina o que é montado no contentor e com que privilégios. A revisão mostra-o antes da instalação: instale apenas ficheiros de fontes de confiança."
+          }
+        },
+        {
+          "p": "O <readmeLink>README do motor OCI</readmeLink> descreve o formato bloco a bloco, com dois exemplos completos. O registo de uma instalação também pode ser lido desta forma: apenas é utilizado o modelo original, sem nenhuma das respostas dessa instalação."
+        }
+      ]
+    },
+    {
+      "id": "private-registries",
+      "title": "Imagens em registos privados",
+      "intro": "Uma imagem num registo privado, como um pacote privado do GitHub ou um repositório privado do Docker Hub, é consultada com uma conta guardada no ProxMenux.",
+      "blocks": [
+        {
+          "steps": {
+            "items": [
+              {
+                "title": "O registo recusa o acesso à imagem",
+                "body": "Quando o registo indica que a imagem requer uma conta, a revisão propõe iniciar sessão nesse registo e consulta novamente a imagem."
+              },
+              {
+                "title": "Iniciar sessão",
+                "body": "Um utilizador e uma palavra-passe ou token com permissão para descarregar a imagem. O registo verifica-os e só são guardados se forem aceites."
+              },
+              {
+                "title": "Instalar e manter atualizado",
+                "body": "A conta é utilizada para descarregar a imagem na instalação e também nas atualizações, em Modificar, Recriar, no watchdog e na verificação de atualizações do Monitor, em qualquer nó do cluster."
+              }
+            ]
+          }
+        },
+        {
+          "p": "<strong>Contas de registos</strong>, no menu principal do OCI manager Apps, apresenta as contas guardadas por registo e utilizador, nunca os seus segredos. Cada conta permite verificar, descarregar ou instalar uma imagem, atualizar as credenciais ou removê-las."
+        },
+        {
+          "list": {
+            "items": [
+              "GitHub (<code>ghcr.io</code>): o utilizador é a conta GitHub e a palavra-passe é um token de acesso pessoal com a permissão <code>read:packages</code>.",
+              "Docker Hub (<code>docker.io</code>): o utilizador é a conta Docker Hub e a palavra-passe é um token de acesso com permissão de leitura.",
+              "Outros registos, incluindo os que usam uma porta própria como <code>registry.example.com:5000</code>: o utilizador e a palavra-passe ou token fornecidos por esse registo."
+            ]
+          }
+        },
+        {
+          "calloutInfo": {
+            "title": "Onde são guardadas as contas",
+            "body": "Em <code>/etc/pve/priv/proxmenux/registry-auth.json</code>, legível apenas por root, na mesma pasta onde o Proxmox guarda as palavras-passe de armazenamento. <code>/etc/pve</code> é partilhado por todos os nós do cluster, pelo que uma conta adicionada num nó é utilizada em todos. A cópia do host inclui o ficheiro e a desinstalação do ProxMenux remove-o de todos os nós."
+          }
+        }
+      ]
+    },
+    {
+      "id": "limits",
+      "title": "Definições que não são instaladas",
+      "blocks": [
+        {
+          "list": {
+            "items": [
+              "Um Dockerfile sem imagem publicada: primeiro é necessário construir a imagem e publicá-la num registo OCI.",
+              "Um ficheiro Compose com vários serviços: é bloqueado porque esta opção instala um único serviço por contentor, mesmo que vários serviços utilizem a mesma imagem.",
+              "<code>configs</code>, segredos externos ou formatos de dispositivo que não possam ser adaptados sem ambiguidade.",
+              "Substituições de shell como <code>$(command)</code>: é necessário escrever diretamente o valor resultante.",
+              "Opções <code>docker run</code> não reconhecidas e <code>--env-file</code>: utilize antes um ficheiro Compose com valores explícitos."
+            ]
+          }
+        }
+      ]
+    }
+  ]
+}
diff --git a/web/messages/pt/docs/oci-manager/hardware.json b/web/messages/pt/docs/oci-manager/hardware.json
new file mode 100644
index 00000000..7f98c0e9
--- /dev/null
+++ b/web/messages/pt/docs/oci-manager/hardware.json
@@ -0,0 +1,392 @@
+{
+  "meta": {
+    "title": "Dispositivos e aceleração ProxMenux",
+    "description": "Como o OCI Manager Apps passa GPU, NVIDIA, Coral, USB, FUSE e outros dispositivos para um recipiente OCI como recursos Proxmox VE nativos validados."
+  },
+  "header": {
+    "title": "Dispositivos e aceleração",
+    "description": "GPU, NVIDIA, Coral, USB, FUSE e dispositivos de bloco tornam-se os recursos de Proxmox VE nativos validados do recipiente.",
+    "section": "OCI manager Apps"
+  },
+  "sections": [
+    {
+      "id": "principle",
+      "title": "O dispositivo de que a aplicação necessita, não a máquina inteira",
+      "blocks": [
+        {
+          "p": "Um dispositivo solicitado pelo arquivo Compose ou pelo perfil da aplicação torna-se uma entrada de <code>devN</code> ou uma montagem LXC. Pedir um GPU, um dispositivo USB ou um Coral não torna o recipiente privilegiado."
+        },
+        {
+          "flow": {
+            "nodes": [
+              {
+                "label": "Inventário da máquina",
+                "detail": "/dev/dri/renderD128\nGID 993 · Intel"
+              },
+              {
+                "label": "ProxMenux",
+                "detail": "fornecedor e\npermissões verificadas"
+              },
+              {
+                "label": "LXC",
+                "detail": "mesmo dispositivo\nGID efetivo"
+              }
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "origin",
+      "title": "De onde vem o pedido do dispositivo",
+      "blocks": [
+        {
+          "table": {
+            "headers": [
+              "Origem",
+              "O que é lido",
+              "O que o instalador faz"
+            ],
+            "rows": [
+              [
+                "Docker Compose",
+                "Pedidos de <code>devices</code>, <code>group_add</code>, <code>deploy.resources</code> e NVIDIA",
+                "Cada requisito torna-se um pedido de dispositivo mostrado para revisão"
+              ],
+              [
+                "Perfil do catálogo",
+                "O suporte que o aplicativo realmente tem para GPU, Coral, OpenCL, USB ou FUSE",
+                "Apenas são oferecidas as opções validadas para essa imagem"
+              ],
+              [
+                "Metadados e documentação da imagem",
+                "VA-API, Selkies, LinuxServer mods ou o tempo de execução NVIDIA",
+                "As variáveis documentadas e preparação são adicionadas"
+              ],
+              [
+                "Seleção do usuário",
+                "Apenas CPU, Intel/AMD, OpenCL, NVIDIA ou um dispositivo opcional",
+                "A seleção é armazenada no contrato de instância"
+              ]
+            ]
+          }
+        },
+        {
+          "calloutWarning": {
+            "title": "Os dispositivos detectados não são anexados automaticamente",
+            "body": "O host é inventariado, mas apenas dispositivos declarados pelo arquivo Compose ou por um perfil compatível são oferecidos e anexados. Um GPU, dongle USB ou Coral presente no host não é exposto a cada LXC."
+          }
+        }
+      ]
+    },
+    {
+      "id": "identify",
+      "title": "Como o dispositivo da máquina é identificado",
+      "intro": "Antes de o LXC ser modificado, o dispositivo é lido no host e corresponde ao perfil escolhido.",
+      "blocks": [
+        {
+          "table": {
+            "headers": [
+              "Tipo",
+              "Identidade",
+              "Validação"
+            ],
+            "rows": [
+              [
+                "Intel/AMD DRM",
+                "<code>/dev/dri/renderD*</code> e <code>/sys/class/drm/NODE/device/vendor</code>",
+                "Um dispositivo de caracteres com o fornecedor <code>0x8086</code> (Intel) ou <code>0x1002</code> (AMD)"
+              ],
+              [
+                "AMD OpenCL",
+                "O nó de renderização, mais <code>/dev/kfd</code> quando o perfil precisa dele",
+                "Existência, tipo, fornecedor, permissões e compatibilidade declarada"
+              ],
+              [
+                "AMD ROCm",
+                "O nó de renderização, <code>/dev/kfd</code> e a geração que o controlador de computação relata em <code>/sys/class/kfd/kfd/topology/nodes/*/properties</code>",
+                "Uma geração para a qual a imagem ROCm do aplicativo inclui kernels de computação — as GPUs RDNA2 citadas e as mais recentes — é oferecida sem adaptação. As outras GPUs dessas famílias, como Radeon 680M e 780M, são oferecidas como experimentais e nunca são a opção sugerida: o ROCm não as suporta oficialmente, o aplicativo as apresenta como a geração de sua família (<code>HSA_OVERRIDE_GFX_VERSION</code>) e o instalador pede confirmação antes de baixar a imagem maior. Uma GPU mais antiga, como a integrada de um Ryzen 5000U, não é oferecida e o Immich mantém o reconhecimento na CPU."
+              ],
+              [
+                "NVIDIA",
+                "<code>nvidia-smi</code> e <code>nvidia-container-cli</code>",
+                "GPU, UUID, PCI bus, versão driver, Toolkit, <code>/dev/nvidia*</code> nós, binários e bibliotecas"
+              ],
+              [
+                "Coral PCIe/M.2",
+                "<code>/dev/apex_N</code> e sua ligação em <code>/sys/dev/char/MAJOR:MINOR</code>",
+                "Nó de caracteres, major/menor, proprietário, GID e permissões"
+              ],
+              [
+                "USB e serial",
+                "<code>/dev/ttyUSB*</code>, <code>/dev/ttyACM*</code> ou <code>/dev/bus/usb/BBB/DDD</code>",
+                "Nó de caracteres; para USB também fornecedor, produto e série quando sysfs publica-los"
+              ],
+              [
+                "KVM, TUN, FUSE, vídeo e SCSI genérico",
+                "<code>/dev/kvm</code>, <code>/dev/net/tun</code>, <code>/dev/fuse</code>, <code>/dev/videoN</code> ou <code>/dev/sgN</code>",
+                "Caminho suportado, tipo de nó e permissões efetivas"
+              ],
+              [
+                "Unidade óptica",
+                "<code>/dev/srN</code>",
+                "Um dispositivo de bloco"
+              ]
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "install",
+      "title": "O que acontece durante a instalação",
+      "blocks": [
+        {
+          "steps": {
+            "items": [
+              {
+                "title": "O modelo oferece seus perfis",
+                "body": "Por exemplo, CPU apenas, Intel/AMD VA-API, AMD OpenCL, Intel OpenCL ou NVIDIA. As opções pertencem à imagem, não a um menu comum."
+              },
+              {
+                "title": "Um perfil é escolhido",
+                "body": "Ele define os nós do dispositivo, ambiente, mods ou tempo de execução que a aplicação precisa."
+              },
+              {
+                "title": "É proposto um caminho",
+                "body": "Para DRM, <code>/dev/dri/renderD128</code>, que pode ser alterado em um host com vários nós de renderização. Para USB ou serial, o nó específico é selecionado."
+              },
+              {
+                "title": "Validação",
+                "body": "Existência, tipo, fornecedor permitido, permissões e GID são verificados. Um desencontro impede a operação."
+              },
+              {
+                "title": "O contrato está escrito",
+                "body": "Caminho, modo, GID, acesso de escrita e perfil são gravados para atualizações e recriações."
+              },
+              {
+                "title": "Anexar e testar",
+                "body": "<code>pct set</code> adiciona a entrada <code>devN</code> e o acesso é então verificado dentro do LXC. As imagens LinuxServer também são verificadas como usuário <code>abc</code>."
+              }
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "config",
+      "title": "Como aparece na configuração LXC",
+      "intro": "Valores ilustrativos: <code>dev0</code> e <code>dev1</code> são as atribuições de slots livres Proxmox VE, e <code>renderD128</code>, <code>apex_0</code> e o GID dependem do hardware do nó.",
+      "blocks": [
+        {
+          "codeGrid": {
+            "items": [
+              {
+                "title": "Intel/AMD VA-API",
+                "code": "dev0: path=/dev/dri/renderD128,mode=0660,gid=993,deny-write=0"
+              },
+              {
+                "title": "Coral PCIe/M.2",
+                "code": "dev0: path=/dev/apex_0,mode=0660,gid=GID,deny-write=0"
+              },
+              {
+                "title": "Um dispositivo USB específico",
+                "code": "dev0: path=/dev/bus/usb/003/004,mode=0660,gid=GID,deny-write=0"
+              },
+              {
+                "title": "AMD OpenCL",
+                "code": "dev0: path=/dev/dri/renderD128,mode=0660,gid=GID,deny-write=0\ndev1: path=/dev/kfd,mode=0660,gid=GID,deny-write=0"
+              }
+            ]
+          }
+        },
+        {
+          "p": "O GID é lido com <code>stat</code> no host e escrito na entrada <code>devN</code>; os grupos <code>render</code> e <code>video</code> não são assumidos como tendo um número fixo. O dispositivo mantém o mesmo caminho <code>/dev</code> dentro do LXC, onde os próprios mecanismos da aplicação procuram por ele."
+        }
+      ]
+    },
+    {
+      "id": "profiles",
+      "title": "Perfis que uma imagem pode oferecer",
+      "blocks": [
+        {
+          "table": {
+            "headers": [
+              "Perfil",
+              "Configuração resultante",
+              "Oferecido quando"
+            ],
+            "rows": [
+              [
+                "Intel/AMD VA-API",
+                "Nó de renderização <code>/dev/dri</code>",
+                "O aplicativo suporta aceleração de vídeo"
+              ],
+              [
+                "OpenCL",
+                "Nó de renderização, <code>/dev/kfd</code> quando necessário e o mod oficial",
+                "A imagem ou perfil documenta- a"
+              ],
+              [
+                "NVIDIA",
+                "Dispositivos de driver e bibliotecas da máquina",
+                "O host tem um driver funcionando e o NVIDIA Container Toolkit"
+              ],
+              [
+                "Coral",
+                "<code>/dev/apex_0</code> ou o barramento USB",
+                "O perfil declara suporte ao Coral (Frigate)"
+              ],
+              [
+                "USB, série, FUSE",
+                "Um único dispositivo, uma árvore validada ou uma funcionalidade LXC",
+                "O contrato pede-o."
+              ]
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "nvidia",
+      "title": "NVIDIA",
+      "blocks": [
+        {
+          "calloutWarning": {
+            "title": "Requisito do nó: NVIDIA Container Toolkit",
+            "body": "Um driver funcional em Proxmox VE não é suficiente para dar um NVIDIA GPU a uma imagem OCI. O OCI Manager Apps usa <code>nvidia-container-cli</code>, do NVIDIA Container Toolkit, para identificar os dispositivos e obter os binários e bibliotecas que correspondem ao driver carregado."
+          }
+        },
+        {
+          "p": "O <nvidiaLink>ProxMenux NVIDIA instalador</nvidiaLink> instala o NVIDIA Container Toolkit do repositório oficial NVIDIA juntamente com o driver. Ele verifica seus quatro pacotes, valida o <code>nvidia-container-cli</code> e registra o resultado na registro de alterações do <auditLink>Audit & Report</auditLink>."
+        },
+        {
+          "p": "Estes dois comandos na máquina mostram se o driver e o Toolkit estão disponíveis:"
+        },
+        {
+          "shell": {
+            "code": "nvidia-smi -L\nnvidia-container-cli --version"
+          }
+        },
+        {
+          "p": "Em uma máquina onde o driver foi instalado por outros meios, o Toolkit é instalado a partir do repositório estável oficial:"
+        },
+        {
+          "shell": {
+            "code": "apt-get update\napt-get install -y --no-install-recommends ca-certificates curl gnupg2\n\ncurl -fsSL https://nvidia.github.io/libnvidia-container/gpgkey \\\n  | gpg --dearmor -o /usr/share/keyrings/nvidia-container-toolkit-keyring.gpg\n\ncurl -s -L https://nvidia.github.io/libnvidia-container/stable/deb/nvidia-container-toolkit.list \\\n  | sed 's#deb https://#deb [signed-by=/usr/share/keyrings/nvidia-container-toolkit-keyring.gpg] https://#g' \\\n  > /etc/apt/sources.list.d/nvidia-container-toolkit.list\n\napt-get update\napt-get install -y nvidia-container-toolkit libnvidia-container-tools"
+          }
+        },
+        {
+          "p": "O inventário que o OCI manager Apps usa é a saída de:"
+        },
+        {
+          "shell": {
+            "code": "nvidia-container-cli list --device all --libraries --binaries --firmwares --ipcs"
+          }
+        },
+        {
+          "calloutInfo": {
+            "title": "A configuração do tempo de execução do Docker não está envolvida",
+            "body": "Os contêineres são LXC nativos e não usam daemon Docker, portanto <code>nvidia-ctk runtime configure --runtime=docker</code> não faz parte do processo: o ProxMenux consulta <code>nvidia-container-cli</code> diretamente e configura os dispositivos e montagens LXC. Os comandos e as plataformas suportadas são mantidos no <toolkitLink>guia de instalação do NVIDIA Container Toolkit</toolkitLink>."
+          }
+        },
+        {
+          "cards": {
+            "items": [
+              {
+                "icon": "cpu",
+                "title": "Inventário do driver",
+                "body": "<code>nvidia-container-cli</code> lista os nós do dispositivo, binários, firmware e bibliotecas do driver instalado."
+              },
+              {
+                "icon": "refresh",
+                "title": "Nenhuma versão fixa",
+                "body": "O modelo não nomeia arquivos de bibliotecas. O perfil é gerado a partir da máquina atual."
+              },
+              {
+                "icon": "shield",
+                "title": "Montagens somente de leitura",
+                "body": "As bibliotecas host são montadas somente para leitura em vez de serem copiadas para o recipiente."
+              },
+              {
+                "icon": "hardDrive",
+                "title": "Alterações do driver",
+                "body": "Após uma mudança de driver, o inventário é gerado novamente antes do início dos LXCs afetados."
+              }
+            ]
+          }
+        },
+        {
+          "code": {
+            "title": "Resultado NVIDIA (simplificado)",
+            "code": "devN: path=/dev/nvidia0,...\ndevN: path=/dev/nvidiactl,...\ndevN: path=/dev/nvidia-uvm,...\nlxc.mount.entry: HOST_LIBRARY CONTAINER_LIBRARY none ro,bind,create=file 0 0"
+          }
+        },
+        {
+          "p": "Passar apenas <code>/dev/nvidia0</code> não é suficiente. Os componentes de espaço de usuário do driver carregado são montados somente de leitura, e <code>nvidia-smi</code> então é executado dentro do LXC para comparar GPU, UUID, PCI bus e versão com o inventário host."
+        }
+      ]
+    },
+    {
+      "id": "usb",
+      "title": "Coral USB, serial e USB",
+      "blocks": [
+        {
+          "calloutWarning": {
+            "title": "Numeração USB pode mudar",
+            "body": "Um caminho como o <code>/dev/bus/usb/003/004</code> pode mudar quando o dispositivo é reconectado ou a máquina reinicia. O perfil registra fornecedor, produto e série quando estão disponíveis, mas um novo endereço de barramento não é remapeado automaticamente."
+          }
+        },
+        {
+          "p": "Um periférico é dado pelo seu nó específico: <code>/dev/ttyUSB0</code>, <code>/dev/ttyACM0</code>, <code>/dev/apex_0</code> ou <code>/dev/bus/usb/BBB/DDD</code>. Não é aceite passar todo o <code>/dev</code>. O Coral é oferecido apenas para aplicações cujo perfil o declara."
+        }
+      ]
+    },
+    {
+      "id": "trees",
+      "title": "Árvores de dispositivos e recursos LXC",
+      "blocks": [
+        {
+          "table": {
+            "headers": [
+              "Pedido",
+              "Configuração resultante",
+              "Escopo"
+            ],
+            "rows": [
+              [
+                "<code>/dev/dvb</code>, <code>/dev/snd</code> ou <code>/dev/bus/usb</code>",
+                "Cada nó de caracteres da árvore recebe sua própria entrada <code>devN</code> com o modo host e GID",
+                "Apenas a árvore solicitada, e não o resto do <code>/dev</code>"
+              ],
+              [
+                "<code>/dev/fuse</code>",
+                "O nó e, quando o perfil precisa dele, o recurso <code>fuse=1</code>",
+                "O FUSE sozinho não publica montagens para outros LXCs"
+              ],
+              [
+                "<code>/dev/net/tun</code>",
+                "Uma entrada <code>devN</code> no mesmo caminho dentro do LXC",
+                "A configuração VPN ou rede permanece na aplicação"
+              ],
+              [
+                "<code>/dev/kvm</code>",
+                "Uma entrada <code>devN</code> validada",
+                "Oferecido apenas quando o contrato o solicitar"
+              ]
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "security",
+      "title": "Confirmações por nível de risco",
+      "blocks": [
+        {
+          "p": "Dispositivos específicos, privilégio opcional, privilégio exigido, relaxamento AppArmor ou seccomp e acesso ao espaço de nomes PID do hospedeiro são tratados como casos separados, não sob uma etiqueta genérica privilegiada. Cada opção com risco é explicada e confirmada durante a instalação."
+        }
+      ]
+    }
+  ]
+}
diff --git a/web/messages/pt/docs/oci-manager/index.json b/web/messages/pt/docs/oci-manager/index.json
new file mode 100644
index 00000000..8249fc49
--- /dev/null
+++ b/web/messages/pt/docs/oci-manager/index.json
@@ -0,0 +1,213 @@
+{
+  "meta": {
+    "title": "OCI manager Apps | ProxMenux",
+    "description": "Execute imagens OCI oficiais como contentores LXC nativos do Proxmox VE, com dados persistentes, acesso a dispositivos, aplicações com vários contentores e atualizações transacionais."
+  },
+  "header": {
+    "title": "OCI manager Apps",
+    "description": "As imagens OCI oficiais são executadas como contentores LXC nativos do Proxmox VE. A imagem continua a ser a publicada pelo respetivo responsável; o ProxMenux reproduz o ambiente que o Docker Compose teria criado à sua volta.",
+    "section": "OCI manager Apps"
+  },
+  "sections": [
+    {
+      "id": "model",
+      "blocks": [
+        {
+          "calloutInfo": {
+            "title": "Uma imagem OCI, um LXC nativo",
+            "body": "O Docker Engine não é executado dentro dos contentores. O Proxmox VE importa o sistema de ficheiros da imagem e os seus metadados OCI. A aplicação passa a ser o processo principal de um LXC nativo, gerido com as mesmas ferramentas dos restantes contentores do nó."
+          }
+        },
+        {
+          "flow": {
+            "nodes": [
+              {
+                "label": "Origem",
+                "detail": "Imagem OCI\nCompose e documentação"
+              },
+              {
+                "label": "ProxMenux",
+                "detail": "Contrato JSON\nvalidação e planeamento"
+              },
+              {
+                "label": "Proxmox VE",
+                "detail": "LXC nativo\nvolumes e dispositivos"
+              }
+            ],
+            "caption": "É utilizada a aplicação original; o seu ambiente é descrito de forma declarativa e reproduzido."
+          }
+        }
+      ]
+    },
+    {
+      "id": "where",
+      "title": "Onde encontrar",
+      "intro": "No nó Proxmox, como root, abra <strong>OCI manager Apps (Technology Preview)</strong> no menu principal do ProxMenux. O primeiro ecrã apresenta:",
+      "blocks": [
+        {
+          "list": {
+            "items": [
+              "<strong>Pesquisar aplicações</strong>: pesquisar por nome em todo o catálogo.",
+              "<strong>Todas as aplicações</strong>: apresentar o catálogo completo e o número de aplicações.",
+              "<strong>Gerir aplicações OCI instaladas</strong>: atualizar, modificar, remover ou recuperar as aplicações já instaladas.",
+              "<strong>Contas de registos</strong>: gerir as contas utilizadas para instalar e atualizar imagens de registos privados.",
+              "<strong>Instalar uma imagem fora do catálogo</strong>: adaptar um ficheiro Compose, um comando <code>docker run</code> ou uma referência de imagem.",
+              "As categorias do catálogo, cada uma com o respetivo número de aplicações."
+            ]
+          }
+        },
+        {
+          "figure": {
+            "src": "/oci-manager/main-menu.png",
+            "alt": "Ecrã principal do OCI manager Apps com pesquisa, catálogo completo, gestão de aplicações, imagens fora do catálogo e categorias.",
+            "caption": "Ecrã principal do OCI manager Apps."
+          }
+        },
+        {
+          "p": "Ao selecionar uma aplicação, são apresentadas a descrição, a imagem utilizada e duas opções de instalação. <strong>Instalar com as definições predefinidas</strong> pergunta apenas o essencial: armazenamento, localização dos dados, endereço e arranque. <strong>Instalar com as definições avançadas</strong> percorre todas as decisões por ordem: VMID e recursos, armazenamento de cada caminho, bridge de rede e dispositivos."
+        },
+        {
+          "p": "As aplicações efetivamente testadas apresentam <strong>Verificado</strong> nesta vista e um ✓ nas listas, quer o teste tenha sido realizado no laboratório do ProxMenux quer pela comunidade."
+        }
+      ]
+    },
+    {
+      "id": "beta",
+      "title": "Por que mantém a designação Technology Preview",
+      "blocks": [
+        {
+          "p": "O OCI manager Apps mantém a designação <strong>Technology Preview</strong> que o Proxmox VE atribui aos contentores de aplicações criados a partir de imagens OCI, cujo suporte foi introduzido no Proxmox VE 9.1. A designação refere-se à tecnologia em que o OCI manager Apps se baseia, não ao motor do ProxMenux: o comportamento destes contentores ainda pode mudar entre versões do Proxmox VE. Será mantida até que o Proxmox VE considere esse suporte estável."
+        },
+        {
+          "p": "O motor do OCI manager Apps é testado no laboratório do ProxMenux: instalação, atualização, modificação, recriação, cópia de segurança, restauro, migração e watchdog. Cada aplicação é verificada separadamente. As que foram efetivamente testadas apresentam <strong>Verificado</strong> e um ✓ nas listas."
+        }
+      ]
+    },
+    {
+      "id": "translation",
+      "title": "Como o Docker descreve os requisitos e como o OCI manager Apps os concretiza",
+      "blocks": [
+        {
+          "table": {
+            "headers": [
+              "Requisito",
+              "Como é expresso no Docker",
+              "Como é concretizado pelo OCI manager Apps"
+            ],
+            "rows": [
+              [
+                "Executar a aplicação",
+                "<code>image</code>, <code>entrypoint</code>, <code>command</code>",
+                "O rootfs OCI e o processo principal do LXC"
+              ],
+              [
+                "Preservar a configuração",
+                "<code>volumes: /config</code>",
+                "Um volume persistente <code>mpN</code> incluído na cópia de segurança ou um diretório do host."
+              ],
+              [
+                "Disponibilizar o serviço",
+                "<code>ports</code>",
+                "Um endereço próprio para o LXC e o URL de acesso ao serviço."
+              ],
+              [
+                "Utilizar hardware",
+                "<code>devices</code>, <code>group_add</code>",
+                "Entradas <code>devN</code> com o GID efetivo do host e um perfil validado."
+              ],
+              [
+                "Ligar as dependências",
+                "<code>networks</code>, <code>depends_on</code>",
+                "Uma bridge de rede privada, endereços fixos, ordem de arranque e verificações de estado."
+              ],
+              [
+                "Atualizar",
+                "Descarregar com <code>pull</code> e recriar",
+                "Um novo rootfs com o mesmo contrato de persistência."
+              ]
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "kept",
+      "title": "O que é preservado e o que muda",
+      "blocks": [
+        {
+          "cards": {
+            "items": [
+              {
+                "icon": "archive",
+                "title": "Preservado",
+                "body": "A imagem oficial, os caminhos internos, o ambiente, o processo de arranque e a documentação de utilização."
+              },
+              {
+                "icon": "boxes",
+                "title": "Adaptado",
+                "body": "O ambiente de execução: rede, persistência, dispositivos, permissões e dependências utilizam os mecanismos LXC nativos do Proxmox VE."
+              },
+              {
+                "icon": "shield",
+                "title": "Sem equivalente",
+                "body": "Uma opção Compose sem equivalente seguro é identificada como impedimento à instalação. Os modelos com impedimentos não são propostos para instalação e as opções sensíveis exigem confirmação durante o assistente."
+              },
+              {
+                "icon": "refresh",
+                "title": "Registado",
+                "body": "O digest da imagem, os recursos, os caminhos, a rede, os dispositivos e a pertença a uma stack são guardados no contrato da instância. As atualizações e recriações reproduzem esse contrato."
+              }
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "pages",
+      "title": "Páginas desta secção",
+      "blocks": [
+        {
+          "next": {
+            "items": [
+              {
+                "label": "Como é adaptada uma imagem OCI",
+                "href": "/docs/oci-manager/architecture",
+                "tail": "Da imagem e do respetivo ficheiro Compose a um LXC nativo."
+              },
+              {
+                "label": "Instalar uma imagem fora do catálogo",
+                "href": "/docs/oci-manager/custom-image",
+                "tail": "Um ficheiro Compose, um comando docker run ou uma referência de imagem."
+              },
+              {
+                "label": "Dados, caminhos e rede",
+                "href": "/docs/oci-manager/storage-network",
+                "tail": "Volumes do contentor, diretórios do host, montagens com rclone e endereços."
+              },
+              {
+                "label": "Dispositivos e aceleração",
+                "href": "/docs/oci-manager/hardware",
+                "tail": "GPU, NVIDIA, Coral, USB e outros dispositivos."
+              },
+              {
+                "label": "Aplicações com vários contentores",
+                "href": "/docs/oci-manager/stacks",
+                "tail": "Aplicação, base de dados e cache em LXC coordenados."
+              },
+              {
+                "label": "Instalar, atualizar e modificar",
+                "href": "/docs/oci-manager/lifecycle",
+                "tail": "O contrato da instância e as respetivas operações."
+              },
+              {
+                "label": "No ProxMenux Monitor",
+                "href": "/docs/oci-manager/monitor",
+                "tail": "Versões, atualizações, saída da consola e terminal."
+              }
+            ]
+          }
+        }
+      ]
+    }
+  ]
+}
diff --git a/web/messages/pt/docs/oci-manager/lifecycle.json b/web/messages/pt/docs/oci-manager/lifecycle.json
new file mode 100644
index 00000000..ece467a3
--- /dev/null
+++ b/web/messages/pt/docs/oci-manager/lifecycle.json
@@ -0,0 +1,499 @@
+{
+  "meta": {
+    "title": "Instalar, atualizar e modificar | ProxMenux",
+    "description": "O contrato de instância de um contentor OCI e as operações que o utilizam: atualização, modificação, remoção, recuperação de uma operação interrompida e recuperação após um restauro neste ou noutro host."
+  },
+  "header": {
+    "title": "Instalar, atualizar e modificar",
+    "description": "Cada instância mantém um contrato reprodutível, permitindo substituir o seu rootfs sem perder a configuração ou os dados persistentes.",
+    "section": "OCI manager Apps"
+  },
+  "sections": [
+    {
+      "id": "contract",
+      "title": "O contrato de instância",
+      "blocks": [
+        {
+          "p": "Após a instalação, a configuração efetiva é guardada em <code>/usr/local/share/proxmenux/oci/instances/VMID/oci-compose.json</code>. Não é uma cópia do ficheiro Compose original: é o contrato reprodutível do LXC existente neste host."
+        },
+        {
+          "code": {
+            "code": "instances/\n└── 105/\n    └── oci-compose.json\n        ├── image and resolved digest\n        ├── resources and network\n        ├── environment (secrets protected)\n        ├── container disks and host directories\n        ├── hardware profile and devices\n        ├── console log and terminal mode\n        └── stack membership and lifecycle"
+          }
+        },
+        {
+          "p": "Uma cópia do contrato fica dentro do contentor, em <code>/.proxmenux/oci-record.json</code>, e só pode ser lida pelo utilizador root do contentor. Assim, uma cópia de segurança do contentor inclui sempre o contrato que estava em vigor nesse momento. Uma segunda cópia é mantida em <code>/etc/pve/priv/proxmenux/oci</code>, partilhado por todos os nós do cluster e legível apenas por root do host. Ambas são escritas após cada instalação, atualização e alteração."
+        }
+      ]
+    },
+    {
+      "id": "manage",
+      "title": "Gerenciar aplicativos OCI instalados",
+      "intro": "Esta opção da tela principal lista as instâncias registradas com sua aplicação e imagem. Cada um é verificado em relação ao seu contrato antes de qualquer ação; um CT que já não corresponde ao seu registro não é modificado nem excluído. A mesma atualização e o mesmo editor são oferecidos na aba Atualizações do <monitorLink>ProxMenux Monitor</monitorLink>.",
+      "blocks": [
+        {
+          "table": {
+            "headers": [
+              "Opção",
+              "O que muda",
+              "O que é guardado"
+            ],
+            "rows": [
+              [
+                "Atualizar a imagem com a configuração salva",
+                "O rootfs é substituído pela imagem que o canal salvo publica hoje",
+                "Contrato, discos de contêiner, diretórios de host, rede e dispositivos"
+              ],
+              [
+                "Modificar: editar recursos, rede, caminhos e GPU",
+                "O editor abre com o contrato atual; o CT é reconstruído com as alterações",
+                "Os dados dos discos de contentores e pastas da máquina"
+              ],
+              [
+                "Watchdog: reinicie o aplicativo quando ele falhar",
+                "Se o aplicativo é iniciado novamente quando ele pára por conta própria. Nada é reconstruído.",
+                "Toda a instalação; somente a escolha é salva no contrato"
+              ],
+              [
+                "Remover: eliminar a aplicação e os seus contentores",
+                "O LXC, ou cada membro de uma pilha, e seus contratos são excluídos",
+                "Directórios da máquina, com o seu conteúdo"
+              ]
+            ]
+          }
+        },
+        {
+          "p": "Para uma aplicação com vários contentores, o menu oferece <strong>Atualizar todos os contentores da aplicação</strong>, <strong>Modificar caminhos e dispositivos adicionais</strong>, <strong>Recriar todos os contentores com a configuração guardada</strong>, o watchdog e a remoção. Modificar adiciona ou remove caminhos e dispositivos adicionais do contentor da aplicação sem recriar nada e, no Immich, altera o componente que executa o reconhecimento. Recriar reconstrói cada contentor a partir da imagem com que foi instalado, sem procurar uma mais recente."
+        },
+        {
+          "figure": {
+            "src": "/oci-manager/manage-menu.png",
+            "alt": "Lista de aplicativos OCI instalados e as opções de atualização, modificação e remoção",
+            "caption": "Gerencie aplicativos OCI instalados."
+          }
+        }
+      ]
+    },
+    {
+      "id": "update",
+      "title": "Uma atualização transacional",
+      "blocks": [
+        {
+          "mermaid": {
+            "chartCode": "sequenceDiagram\n participant U as {{user}}\n participant P as ProxMenux\n participant R as {{registry}}\n participant X as Proxmox VE\n U->>P: {{update}}\n P->>R: {{resolve}}\n R-->>P: digest\n P->>P: {{verify}}\n P->>X: {{backup}}\n P->>X: {{import}}\n P->>X: {{reapply}}\n X-->>P: healthcheck\n alt {{healthy}}\n  P-->>U: {{commit}}\n else {{failure}}\n  P->>X: Rollback\n  P-->>U: {{restored}}\n end",
+            "labels": {
+              "user": "Usuário",
+              "registry": "Registo de OCI",
+              "update": "Atualizar instância",
+              "resolve": "Resolver a etiqueta",
+              "verify": "Verificar o arquivo e executar as verificações prévias",
+              "backup": "Pare e faça backup do CT",
+              "import": "Importar o novo rootfs",
+              "reapply": "Aplicar o contrato novamente",
+              "healthy": "íntegro",
+              "failure": "falha",
+              "commit": "Contrato publicado com o novo digest",
+              "restored": "A instância anterior foi restaurada"
+            }
+          }
+        },
+        {
+          "list": {
+            "items": [
+              "Quando o registro ainda serve o digest instalado, nada é baixado e a instância não é tocada.",
+              "A nova imagem é verificada camada a camada antes de parar o CT. Uma transferência que chega danificada é repetida uma segunda vez; uma imagem já em cache que não passa na verificação é transferida novamente.",
+              "As definições alteradas no Proxmox VE após a instalação (memória, swap, núcleos, limite e prioridade da CPU, arranque com o nó) são mantidas e incluídas no novo contrato.",
+              "A interface LAN adicionada pela suite Arr e pelas aplicações com vários contentores (<code>net1</code>) e a ordem de arranque (<code>startup</code>) são repostas sem alterações no novo contentor.",
+              "Qualquer outra diferença entre o CT e o seu contrato interrompe a atualização antes de parar o CT."
+            ]
+          }
+        },
+        {
+          "flow": {
+            "nodes": [
+              {
+                "label": "Antes",
+                "detail": "rootfs A\n/config mp0\nDirectório da máquina /media"
+              },
+              {
+                "label": "Atualizar",
+                "detail": "substitui apenas\no rootfs"
+              },
+              {
+                "label": "Após",
+                "detail": "rootfs B\n/config mp0\nDirectório da máquina /media"
+              }
+            ]
+          }
+        },
+        {
+          "p": "Antes de parar seja o que for, a operação verifica o espaço necessário para a cópia de segurança: os dados utilizados nos volumes incluídos, mais uma margem. A cópia é guardada junto ao registo da aplicação, no disco de sistema do host. Se não houver espaço suficiente, o menu pede outro armazenamento do host que aceite cópias de segurança. A cópia é criada aí e eliminada no fim da operação. A escolha fica guardada para essa aplicação, incluindo as atualizações agendadas. Se nenhum armazenamento tiver espaço suficiente, a operação é recusada e a aplicação fica como estava. O espaço necessário para a nova imagem também é verificado antes da transferência."
+        }
+      ]
+    },
+    {
+      "id": "recovery",
+      "title": "Recuperar uma operação interrompida",
+      "intro": "Uma atualização e uma mudança usam uma transação persistente. Se o processo, o terminal ou o nó são interrompidos após a parada do CT, a operação não é tomada como terminada.",
+      "blocks": [
+        {
+          "steps": {
+            "items": [
+              {
+                "title": "Marcador pendente",
+                "body": "Ao abrir Gerir aplicações OCI instaladas, o estado guardado mostra que a substituição nunca chegou a ser publicada."
+              },
+              {
+                "title": "Ver o estado",
+                "body": "Mostra a fase atingida sem alterar contentores ou dados."
+              },
+              {
+                "title": "Recuperar a instalação anterior",
+                "body": "Restaura a cópia de segurança nativa verificada, criada antes da substituição, e o contrato anterior."
+              },
+              {
+                "title": "Pilha como unidade",
+                "body": "Para um aplicativo multi-contentor, cada membro é recuperado do mesmo ponto de transação, não apenas o selecionado."
+              }
+            ]
+          }
+        },
+        {
+          "calloutWarning": {
+            "title": "Os diretórios da máquina estão fora do rollback",
+            "body": "A cópia de segurança abrange o rootfs e os discos do contentor nela incluídos. Um diretório do host não é reposto no estado anterior, pois outros LXC podem utilizar os seus dados."
+          }
+        }
+      ]
+    },
+    {
+      "id": "watchdog",
+      "title": "Watchdog: reiniciar uma aplicação que pára",
+      "intro": "O Proxmox não tem uma política de reinício: quando termina o processo de um contentor de aplicação, o contentor fica parado. Com o watchdog ativo, uma aplicação que para por si própria é iniciada novamente. Para uma aplicação OCI, faz o que <code>restart: unless-stopped</code> faz num ficheiro Compose.",
+      "blocks": [
+        {
+          "table": {
+            "headers": [
+              "O que acontece?",
+              "Com o watchdog ativo"
+            ],
+            "rows": [
+              [
+                "O aplicativo trava ou seu processo termina",
+                "O contentor é iniciado novamente em segundos"
+              ],
+              [
+                "É parado ou desligado do Proxmox, do Monitor ou com <code>pct</code>",
+                "Fica parado até alguém o iniciar"
+              ],
+              [
+                "Um backup, uma migração ou uma operação ProxMenux está trabalhando nele",
+                "Nada é feito até que isso acabe."
+              ],
+              [
+                "Já estava parado quando o host arrancou",
+                "Fica parado; isso é determinado por <strong>Iniciar com o Proxmox</strong>"
+              ],
+              [
+                "Ele continua parando logo após começar",
+                "Uma aplicação que volta a parar segundos depois de arrancar, ou que não arranca, tem cinco tentativas de início, com intervalos de 30 segundos, 1, 2 e 5 minutos. Depois fica parada e é enviada uma notificação"
+              ]
+            ]
+          }
+        },
+        {
+          "p": "O instalador faz esta pergunta nos dois modos de instalação e propõe o valor declarado na receita da aplicação. Mais tarde, a opção pode ser alterada em <strong>Gerir aplicações OCI instaladas</strong> ou no interruptor <strong>Watchdog</strong> do contentor em <monitorLink>ProxMenux Monitor</monitorLink>; aplica-se a todos os contentores de uma aplicação com vários contentores. Um único serviço do host, <code>proxmenux-oci-watchdog.service</code>, vigia todas as aplicações que o pediram; a sua instalação aparece no separador Alterações de Audit & Report."
+        },
+        {
+          "calloutInfo": {
+            "title": "O que a máquina não pode dizer",
+            "body": "O código de saída da aplicação não chega ao host, pelo que uma saída normal e uma falha são indistinguíveis e ambas provocam um reinício, como <code>always</code> e <code>unless-stopped</code> no Docker. Uma paragem pedida fora do Proxmox, com <code>lxc-stop</code> ou <code>systemctl</code>, não deixa uma tarefa de paragem e é interpretada como uma paragem espontânea."
+          }
+        }
+      ]
+    },
+    {
+      "id": "restore",
+      "title": "Backup, restauração e outra máquina",
+      "intro": "Uma cópia de segurança feita com vzdump ou Proxmox Backup Server inclui o contentor, os discos do contentor selecionados para a cópia e a cópia do seu contrato. O que a instalação guarda no host não faz parte dela. <strong>Gerir aplicações OCI instaladas</strong> deteta contentores restaurados num host sem o respetivo contrato, após uma nova instalação do Proxmox ou noutro host, e oferece o novo registo.",
+      "blocks": [
+        {
+          "steps": {
+            "items": [
+              {
+                "title": "Restaurar os contentores no Proxmox",
+                "body": "A partir do armazenamento de cópias de segurança, com o ID original ou qualquer ID livre. Uma aplicação com vários contentores precisa de todos eles."
+              },
+              {
+                "title": "Abrir Gerenciar aplicativos OCI instalados",
+                "body": "Os contentores restaurados são listados e é oferecida a recuperação. O botão <strong>Recuperar</strong> do separador Atualizações de <monitorLink>ProxMenux Monitor</monitorLink> abre a mesma recuperação."
+              },
+              {
+                "title": "Verificar antes de mudar",
+                "body": "A recuperação verifica se o host tem tudo o que cada aplicação precisa. Uma aplicação que não possa ser recuperada por completo fica como estava, com indicação do motivo."
+              },
+              {
+                "title": "Registar e iniciar",
+                "body": "O contrato está registrado neste host e o que a instalação manteve nele é escrito novamente. Iniciar as aplicações é uma pergunta separada, respondida com Não quando os recipientes originais ainda estão em execução em outro host."
+              }
+            ]
+          }
+        },
+        {
+          "figure": {
+            "src": "/oci-manager/restore-offer.png",
+            "alt": "Diálogo que lista os contentores restaurados e oferece a sua recuperação",
+            "caption": "A recuperação oferecida quando Gerenciar aplicativos OCI instalados abre."
+          }
+        },
+        {
+          "table": {
+            "headers": [
+              "O que o host guardava",
+              "Após a recuperação"
+            ],
+            "rows": [
+              [
+                "Contrato de instância",
+                "Registado a partir da cópia no contentor, verificada face à configuração restaurada pelo Proxmox"
+              ],
+              [
+                "Rede privada de uma aplicação multi-contentor",
+                "Criado novamente com a mesma ponte e sub-rede; os endereços fixos dos contentores não mudam"
+              ],
+              [
+                "Ordem de arranque de uma aplicação com vários contentores",
+                "O hookscript de dependências e o seu contrato são instalados novamente; os snippets são ativados no armazenamento <code>local</code> quando nenhum armazenamento os aceita"
+              ],
+              [
+                "Sysctls de rede e ficheiro de monitorização da máquina",
+                "Escrito novamente em <code>/etc/pve/proxmenux</code>"
+              ],
+              [
+                "Ambiente de execução NVIDIA",
+                "O hook de um contentor sem privilégios é instalado novamente. Um contentor privilegiado recebe os ficheiros do controlador deste host em vez dos do host de origem"
+              ],
+              [
+                "Montagem Rclone",
+                "O hookscript e os programas que publicam a montagem são escritos novamente, com as mesmas vistas na máquina"
+              ],
+              [
+                "Regra da firewall do host para um monitor do host",
+                "É pedida novamente, para a porta web e a sub-rede da bridge neste host"
+              ],
+              [
+                "<code>lost+found</code> de cada disco restaurado",
+                "É removido quando está vazio; um restauro cria-o e algumas aplicações não arrancam se estiver presente nos seus dados"
+              ],
+              [
+                "Discos restaurados em outro armazenamento",
+                "O contrato é atualizado para o armazenamento em que eles estão agora"
+              ]
+            ]
+          }
+        },
+        {
+          "p": "Um recipiente restaurado com outro ID mantém sua aplicação. O contrato, seu log de console, seus sysctls de rede, o hookscript de uma montagem Rclone e a ordem de início de uma aplicação multi-contentor são registrados com os IDs que os contêineres têm neste host."
+        },
+        {
+          "table": {
+            "headers": [
+              "O que impede uma recuperação",
+              "O que fazer"
+            ],
+            "rows": [
+              [
+                "Falta um contentor de uma aplicação com vários contentores",
+                "Restaure-o também; o aplicativo é recuperado inteiro"
+              ],
+              [
+                "A sub- rede privada já é usada nesta máquina",
+                "A recuperação é cancelada e nada é alterado: os endereços dos contentores são fixados e não são movidos para outra subrede"
+              ],
+              [
+                "Não existe uma pasta da máquina",
+                "Montar ou criar com os seus dados; uma cópia de segurança do contentor não inclui pastas da máquina"
+              ],
+              [
+                "Não existe um dispositivo nesta máquina",
+                "Ligue-o ou remova-o do contentor no Proxmox"
+              ],
+              [
+                "Um aplicativo com NVIDIA em uma máquina sem o driver",
+                "Instale o controlador NVIDIA e o Container Toolkit"
+              ],
+              [
+                "O backup foi feito antes da cópia do contrato existir",
+                "O recipiente permanece como um LXC normal e não é oferecido novamente"
+              ]
+            ]
+          }
+        },
+        {
+          "calloutInfo": {
+            "title": "Um contentor que volta",
+            "body": "Um contentor restaurado sobre si próprio a partir de uma cópia de segurança anterior, reposto num snapshot ou devolvido de outro nó transporta o contrato do estado em que se encontra. Se for selecionado para uma operação e o seu contrato diferir do deste host, a operação não começa e é oferecida a recuperação do contentor."
+          }
+        },
+        {
+          "figure": {
+            "src": "/oci-manager/restore-result.png",
+            "alt": "Resultado da recuperação com a rede privada, a ordem de início e os contentores registados",
+            "caption": "Resultado de uma recuperação, passo a passo."
+          }
+        }
+      ]
+    },
+    {
+      "id": "remove",
+      "title": "Removendo uma aplicação OCI",
+      "blocks": [
+        {
+          "p": "Antes da confirmação é criado um resumo da configuração real: os contentores removidos, os dados eliminados com eles, a rede privada libertada e os diretórios do host mantidos. A confirmação tem <strong>Não</strong> como resposta predefinida, pois os dados dos discos eliminados não podem ser recuperados depois."
+        },
+        {
+          "table": {
+            "headers": [
+              "Recurso",
+              "Ao remover",
+              "Justificação"
+            ],
+            "rows": [
+              [
+                "rootfs e discos de contentores",
+                "Removido",
+                "Pertencem apenas ao recipiente."
+              ],
+              [
+                "Pasta da máquina",
+                "Mantido, com o seu conteúdo",
+                "Outras aplicações podem utilizá-lo"
+              ],
+              [
+                "Ficheiros do contentor no host",
+                "Removido",
+                "O registo da consola, os parâmetros sysctl de rede, o hookscript da montagem Rclone e o registo no separador App do ProxMenux Monitor não servem outros contentores"
+              ],
+              [
+                "Ficheiros partilhados por várias instalações",
+                "Excluído com a última instalação que os usa",
+                "O arquivo host-monitor e o hookscript de dependência de aplicativos multi-contentor"
+              ],
+              [
+                "Contrato de instância",
+                "Excluído após uma remoção bem- sucedida",
+                "Nenhum CT está mais associado a ele"
+              ],
+              [
+                "Ponte privada de uma pilha",
+                "Libertada com a pilha",
+                "Não tem mais membros para conectar"
+              ],
+              [
+                "Rede partilhada pela suite Arr",
+                "Libertada com a última aplicação da suite",
+                "Cada aplicação da suite é independente e é removida por conta própria"
+              ],
+              [
+                "Um único membro de uma pilha",
+                "Não removido isoladamente",
+                "O aplicativo inteiro é removido, então nenhuma pilha fica incompleta"
+              ],
+              [
+                "Um recipiente em outro nó do cluster",
+                "Não removido",
+                "Seus arquivos de registro e host estão no nó onde foi instalado: ele é removido lá, depois de migrar de volta"
+              ]
+            ]
+          }
+        },
+        {
+          "figure": {
+            "src": "/oci-manager/remove-summary.png",
+            "alt": "Resumo de remoção com os recipientes, dados e diretórios do host afetados",
+            "caption": "O resumo de remoção, construído a partir da configuração real."
+          }
+        }
+      ]
+    },
+    {
+      "id": "archives",
+      "title": "Imagens transferidas e espaço da máquina",
+      "blocks": [
+        {
+          "p": "O arquivo OCI é usado para criar o rootfs; o CT em execução não o lê. Após uma instalação ou atualização, são listados os arquivos transferidos nessa operação, com o respetivo tamanho, e é oferecida a sua eliminação. Eliminá-los liberta espaço sem afetar o contentor ou os seus dados."
+        },
+        {
+          "calloutInfo": {
+            "title": "As atualizações não precisam do arquivo",
+            "body": "Sem o arquivo, uma atualização resolve o canal salvo e baixa o novo digest. Com ele, um arquivo é reutilizado apenas quando sua referência e integridade correspondem ao que é solicitado."
+          }
+        }
+      ]
+    },
+    {
+      "id": "registry",
+      "title": "Registo e limpeza",
+      "blocks": [
+        {
+          "p": "Ao abrir <strong>Gerir aplicações OCI instaladas</strong>, são primeiro removidos os restos de contentores que não existem em nenhum nó do cluster: o registo guardado como histórico após a eliminação na interface do Proxmox e os ficheiros do host deixados por uma remoção. Um registo com uma operação incompleta é mantido, pois a sua cópia de segurança ainda pode ser necessária. Os volumes e diretórios do host nunca são eliminados por dedução."
+        }
+      ]
+    },
+    {
+      "id": "cluster",
+      "title": "Em um cluster: migração e alta disponibilidade",
+      "intro": "Um contentor OCI é um LXC normal do Proxmox: pode ser migrado ou gerido por HA como os restantes, com as mesmas limitações. O que precisa para arrancar é guardado onde todos os nós do cluster o encontram.",
+      "blocks": [
+        {
+          "table": {
+            "headers": [
+              "Parte",
+              "Em outro nó do cluster"
+            ],
+            "rows": [
+              [
+                "Registo da consola",
+                "O contentor cria <code>/var/log/proxmenux/oci</code> antes de arrancar, no nó que o executa. Cada nó mantém o registo dos arranques que executou."
+              ],
+              [
+                "Sysctls de rede e monitor host",
+                "Mantido em <code>/etc/pve/proxmenux</code>, que cada nó do cluster compartilha, então um contêiner migrado os encontra."
+              ],
+              [
+                "Discos de contentores",
+                "O Proxmox move-os com o contentor. O HA precisa dos dados disponíveis no nó de destino, através de armazenamento partilhado ou de uma configuração de replicação suportada."
+              ],
+              [
+                "Directórios e dispositivos da máquina",
+                "As mesmas regras que qualquer LXC: um diretório host deve existir no nó alvo e ser marcado como compartilhado, e um GPU, Coral ou NPU deve estar presente lá."
+              ],
+              [
+                "Registo ProxMenux",
+                "O contrato permanece no nó onde a aplicação foi instalada, e todos os nós leem a cópia mantida em <code>/etc/pve/priv/proxmenux/oci</code>. Uma aplicação com um só contentor que migra é registada no nó de destino ao abrir <strong>Gerir aplicações OCI instaladas</strong> ou ao iniciar uma operação para ela. Uma aplicação com vários contentores é oferecida para recuperação nesse nó, pois a sua rede privada tem de ser criada aí."
+              ]
+            ]
+          }
+        },
+        {
+          "calloutWarning": {
+            "title": "Não para alta disponibilidade",
+            "body": "Uma aplicação multi-contentor atinge seus membros através de uma ponte privada do nó onde foi instalado, então seus membros permanecem nesse nó. Um monitor host, como o Glances no modo host ou o Netdata, monitora o nó em que ele é executado; movendo-o monitoraria outro nó."
+          }
+        },
+        {
+          "p": "Um backup restaurado fora do cluster recebe os arquivos de <code>/etc/pve/proxmenux</code> que o recipiente usa quando o aplicativo é recuperado."
+        }
+      ]
+    },
+    {
+      "id": "channel",
+      "title": "Uma etiqueta rolling não é uma atualização sem supervisão",
+      "blocks": [
+        {
+          "p": "O catálogo instala a etiqueta rolling publicada pelo responsável, mas o digest efetivo é resolvido e registado e só muda através de uma atualização explícita, com verificações prévias e rollback. O <monitorLink>ProxMenux Monitor</monitorLink> compara o digest instalado com o publicado pelo registo e apresenta um aviso e uma notificação quando há uma nova imagem disponível."
+        }
+      ]
+    }
+  ]
+}
diff --git a/web/messages/pt/docs/oci-manager/monitor.json b/web/messages/pt/docs/oci-manager/monitor.json
new file mode 100644
index 00000000..68a4775b
--- /dev/null
+++ b/web/messages/pt/docs/oci-manager/monitor.json
@@ -0,0 +1,213 @@
+{
+  "meta": {
+    "title": "Contêineres OCI no ProxMenux Monitor | ProxMenux",
+    "description": "O que o ProxMenux Monitor mostra para um container instalado pelo OCI Manager Apps: versões de aplicativos e imagens, novas imagens, saída do console e o terminal Proxmox VE."
+  },
+  "header": {
+    "title": "No ProxMenux Monitor",
+    "description": "Um recipiente instalado pelo OCI Manager Apps aparece em VMs & LXCs como qualquer outro LXC. Seu modal lê o registro de instalação: versões de aplicação e imagem, novas imagens, saída de console e terminal.",
+    "section": "OCI manager Apps"
+  },
+  "sections": [
+    {
+      "id": "intro",
+      "blocks": [
+        {
+          "calloutInfo": {
+            "title": "O registro é a fonte",
+            "body": "O OCI Manager Apps sabe o que ele instalou e de onde veio. O Monitor lê esse registro de instalação em vez de sondar o recipiente, por isso os dados são os mesmos se o recipiente está em execução ou parado."
+          }
+        },
+        {
+          "table": {
+            "headers": [
+              "Página",
+              "O que muda para um recipiente OCI"
+            ],
+            "rows": [
+              [
+                "Estado",
+                "Um interruptor <strong>Watchdog</strong> em Iniciar no arranque: o aplicativo é iniciado novamente quando pára por conta própria"
+              ],
+              [
+                "Aplicativo",
+                "O aplicativo é identificado a partir do registro, e as atualizações são monitoradas pela imagem"
+              ],
+              [
+                "Atualizações",
+                "A imagem é atualizada ou a aplicação modificada, com o mesmo fluxo que o menu OCI"
+              ],
+              [
+                "Montagens",
+                "Discos de contentores e pastas de máquinas, com a sua utilização"
+              ],
+              [
+                "Registros",
+                "Apenas para recipientes OCI: a saída do console da aplicação"
+              ]
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "app",
+      "title": "Aplicativo",
+      "intro": "A aba <appLink>App</appLink> oferece o aplicativo instalado como uma detecção, com o nome, logotipo, porta e esquema do registro. Registrando-o abre o editor com o método <strong>Imagem OCI (instalada por ProxMenux)</strong>, que não precisa de configuração.",
+      "blocks": [
+        {
+          "cards": {
+            "items": [
+              {
+                "icon": "boxes",
+                "title": "Aplicação",
+                "body": "A versão da aplicação dentro da imagem, lida a partir da imagem em si: o seu ambiente ou a sua etiqueta <code>org.opencontainers.image.version</code>. É informativo."
+              },
+              {
+                "icon": "archive",
+                "title": "Imagem",
+                "body": "A data de compilação e o digest da imagem instalada. A atualização é decidida aqui: o digest instalado é comparado com o que o registro publica hoje para a mesma tag."
+              }
+            ]
+          }
+        },
+        {
+          "list": {
+            "items": [
+              "Quando o registro publica um novo digest, o cartão mostra <strong>Nova imagem</strong> com sua data e digest, mesmo que a versão do aplicativo dentro não mudou: uma reconstrução em uma base atualizada é uma atualização.",
+              "Quando os digests coincidem, o cartão mostra <strong>Versão</strong>.",
+              "O cartão faz links para o repositório da imagem: seu projeto GitHub, ou sua página Docker Hub para uma imagem oficial.",
+              "O link de acesso usa o endereço LAN do recipiente, também para o principal membro de um aplicativo multi-contentor, que tem um segundo endereço em sua rede privada.",
+              "O botão <strong>Atualizar dados</strong> lê novamente o registro de instalação e o registro de imagens. Não são oferecidas opções para procurar ou registrar outro aplicativo: o contêiner contém exatamente o aplicativo de seu registro."
+            ]
+          }
+        },
+        {
+          "figure": {
+            "src": "/oci-manager/monitor-app-tab.png",
+            "alt": "Página de aplicação de um contentor OCI com a versão da aplicação, a imagem e o link do repositório",
+            "caption": "Página da aplicação de um recipiente instalado pelo OCI Manager Apps."
+          }
+        },
+        {
+          "p": "A verificação é executada uma vez por dia com as verificações de atualização do Monitor e o <strong>Atualizar dados</strong> a executa imediatamente. Uma nova imagem é enviada como uma notificação através dos canais configurados em <notificationsLink>Notificações</notificationsLink>. A atualização é aplicada na aba Atualizações."
+        }
+      ]
+    },
+    {
+      "id": "updates",
+      "title": "Atualizações",
+      "intro": "Para um contêiner instalado pelo OCI Manager Apps a aba Atualizações mostra o aplicativo com sua imagem instalada e, quando o registro publica uma, a nova imagem, no mesmo formato que qualquer outra aplicação. Os atualizadores de pacotes e aplicativos de um LXC comum não aparecem.",
+      "blocks": [
+        {
+          "table": {
+            "headers": [
+              "Botão",
+              "O que abre"
+            ],
+            "rows": [
+              [
+                "Atualizar",
+                "A atualização de <lifecycleLink>Gerenciar aplicativos OCI instalados</lifecycleLink> para este contêiner, no terminal do Monitor. Pode ser executada com ou sem uma nova imagem; sem imagem nova, nada muda. Em um aplicativo com vários contêineres, atualiza todos os membros."
+              ],
+              [
+                "Modificar",
+                "O editor da aplicação (recursos, rede, caminhos e GPU). Em uma aplicação multi-contentor adiciona ou remove os caminhos e dispositivos extras do recipiente de aplicação e, em Immich, altera o que executa o reconhecimento."
+              ],
+              [
+                "Recuperar",
+                "Substitui a atualização quando uma operação no recipiente foi interrompida e abre sua recuperação."
+              ],
+              [
+                "Recuperar (contêiner restaurado)",
+                "Exibido para um contêiner restaurado de backup que não tem contrato neste host, em <strong>Aplicativo OCI restaurado</strong>. Abre a <lifecycleLink>recuperação</lifecycleLink> no terminal do Monitor; Atualizar e Modificar aparecem após o registro."
+              ]
+            ]
+          }
+        },
+        {
+          "p": "Alterações externas, diretórios host e aplicativos multi-contentores são tratados como no menu OCI. Em uma aplicação multi-contentor, os botões e as opções aparecem apenas no recipiente principal; os outros membros mostram sua imagem, uma nota de que eles são atualizados do recipiente principal e um botão que a abre. Quando o terminal fecha, a imagem, o registro e as montagens são lidos novamente."
+        },
+        {
+          "table": {
+            "headers": [
+              "Opção",
+              "Comportamento"
+            ],
+            "rows": [
+              [
+                "Manter o backup feito antes da atualização",
+                "Cada atualização faz backup do recipiente para restaurá-lo se a atualização falhar. Com esta opção, o mesmo backup é mantido no armazenamento escolhido e aparece entre os backups do CT; em Proxmox Backup Server um backup é escrito antes da atualização."
+              ],
+              [
+                "Atualizações agendadas",
+                "A imagem é atualizada no horário escolhido somente se o registro publicar uma nova, com a opção de esperar que ela tenha 1, 3, 7 ou 14 dias. Um contêiner com alterações feitas fora do ProxMenux é ignorado e reportado."
+              ]
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "logs",
+      "title": "Registros",
+      "intro": "A guia Logs aparece apenas para recipientes instalados pelo OCI Manager Apps, entre Mounts e Backups. Ele mostra a saída padrão e erro do processo principal da imagem, a mesma saída <code>docker logs</code> mostra para um recipiente Docker.",
+      "blocks": [
+        {
+          "list": {
+            "items": [
+              "A saída é mantida no host em <code>/var/log/proxmenux/oci/VMID.console.log</code> (modo 0600), desde o primeiro início e através de reinícios, para que possa ser lido com o recipiente parado.",
+              "O arquivo é rodado em 10 MB, mantendo três cópias comprimidas (<code>/etc/logrotate.d/proxmenux-oci</code>).",
+              "Cada início do recipiente é marcado na saída. A aba mostra a saída desde o último início por padrão; <strong>Histórico completo</strong> também mostra as anteriores.",
+              "Quando o aplicativo é removido, sua saída é removida com ele.",
+              "São exibidas as últimas 100, 500 ou 1000 linhas. Enquanto o contêiner está em execução, as novas linhas são acompanhadas ao vivo; rolar para cima pausa o acompanhamento e <strong>Acompanhar</strong> o retoma.",
+              "Um filtro mostra apenas as linhas que contêm um texto, e <strong>Baixar</strong> salva as linhas carregadas.",
+              "Os códigos de cores são removidos e uma linha que uma barra de progresso redesenha é mostrada em seu estado final.",
+              "A aba lê o arquivo a cada abertura, sem usar uma cópia em cache."
+            ]
+          }
+        },
+        {
+          "calloutInfo": {
+            "title": "Credenciais de primeiro início",
+            "body": "Imagens que imprimem uma senha gerada em seu primeiro início deixam-na nesta saída, como <code>docker logs</code> faz. O instalador lê-o de lá para o mostrar em seu resumo."
+          }
+        },
+        {
+          "figure": {
+            "src": "/oci-manager/monitor-logs-tab.png",
+            "alt": "Aba Logs com a saída do console de um contêiner OCI, seletor de linhas, filtro e botão de acompanhamento",
+            "caption": "Saída do console de um recipiente OCI."
+          }
+        }
+      ]
+    },
+    {
+      "id": "terminal",
+      "title": "Consola Proxmox VE",
+      "blocks": [
+        {
+          "p": "Uma imagem OCI executa seu próprio processo como PID 1 e nenhum serviço de login, então o console padrão de um LXC abriria um terminal onde nada responde. Containers instalados pelo OCI Manager Apps são criados com <code>cmode: shell</code>: o console Proxmox VE abre uma shell com <code>lxc-attach</code>, o equivalente a <code>docker exec</code>, com a aplicação em execução intocada."
+        },
+        {
+          "list": {
+            "items": [
+              "O shell é o que <code>/etc/passwd</code> atribui ao root na imagem. Se root não tiver shell ou a imagem não incluir nenhum, o console padrão será mantido.",
+              "O shell é root dentro do recipiente, sem senha. Quem pode abri-lo é decidido pela permissão <code>VM.Console</code> de Proxmox VE.",
+              "O terminal do Monitor entra no recipiente com <code>pct enter</code>, que funciona da mesma forma."
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "mounts",
+      "title": "Montagens",
+      "blocks": [
+        {
+          "p": "A aba <mountsLink>Montagens</mountsLink> lista os discos do contêiner e seus diretórios do host. O uso de um disco em armazenamento de blocos, como LVM-thin, é lido do sistema de arquivos desse disco, montado apenas dentro do contêiner."
+        }
+      ]
+    }
+  ]
+}
diff --git a/web/messages/pt/docs/oci-manager/stacks.json b/web/messages/pt/docs/oci-manager/stacks.json
new file mode 100644
index 00000000..9a1c3625
--- /dev/null
+++ b/web/messages/pt/docs/oci-manager/stacks.json
@@ -0,0 +1,404 @@
+{
+  "meta": {
+    "title": "Aplicações multi-contêineres ProxMenux",
+    "description": "Como o OCI Manager Apps transforma um aplicativo com seu banco de dados e cache em LXCs nativos coordenados: plano, rede privada, gancho de dependência, validação e atualizações transacionais."
+  },
+  "header": {
+    "title": "Aplicações com vários contentores",
+    "description": "Uma aplicação com seu banco de dados, cache e outros serviços torna-se vários LXCs nativos coordenados, instalados e atualizados como um.",
+    "section": "OCI manager Apps"
+  },
+  "sections": [
+    {
+      "id": "intro",
+      "blocks": [
+        {
+          "calloutInfo": {
+            "title": "Um aplicativo para o usuário, vários LXCs para Proxmox VE",
+            "body": "Uma definição multi-contentor é uma entrada do catálogo. O instalador cria um LXC nativo por serviço e mantém suas dependências explícitas. Immich, Nextcloud, Paperless-ngx e Tandoor são instalados desta forma."
+          }
+        },
+        {
+          "mermaid": {
+            "chartCode": "flowchart LR\n C[\"Docker Compose\"] --> O[\"{{plan}}\"]\n O --> A[\"{{app}}<br/>{{appNet}}\"]\n O --> D[\"{{db}}<br/>{{private}}\"]\n O --> R[\"{{cache}}<br/>{{private}}\"]\n V1[(\"config\")] --> A\n V2[(\"database\")] --> D\n V3[(\"cache\")] --> R\n D --> A\n R --> A",
+            "labels": {
+              "plan": "Plano de pilha",
+              "app": "Aplicação LXC",
+              "appNet": "LAN + privado",
+              "db": "PostgreSQL LXC",
+              "cache": "Valkey LXC",
+              "private": "privado"
+            }
+          }
+        }
+      ]
+    },
+    {
+      "id": "plan",
+      "title": "1. O plano, antes de existir qualquer recipiente",
+      "blocks": [
+        {
+          "p": "Nenhum LXC é criado enquanto a definição Compose é interpretada. Um plano completo vem em primeiro lugar, com cada membro, imagem, VMID, rede, caminho, segredo, ordem e verificação de saúde. Se o plano não for consistente, a instalação não começa."
+        },
+        {
+          "table": {
+            "headers": [
+              "Elemento do plano",
+              "Conteúdo",
+              "Verificado antes de criar qualquer coisa"
+            ],
+            "rows": [
+              [
+                "Membros",
+                "Aplicação principal, banco de dados, cache, aprendizado de máquina e outras dependências",
+                "VMIDs exclusivos, papéis conhecidos e exatamente um membro principal"
+              ],
+              [
+                "Imagens",
+                "Referência rolling, arquitetura e digest resolvido de cada serviço",
+                "Todos existem, suportam a arquitetura e passam pela verificação de integridade do OCI"
+              ],
+              [
+                "Rede",
+                "Ponte privada, sub-rede, endereço fixo por serviço e acesso LAN para o membro principal",
+                "Sem colisão com pontes ou subredes existentes e sem endereço repetido"
+              ],
+              [
+                "Persistência",
+                "Discos de container, diretórios de host, proprietários e backup",
+                "Nenhum caminho sobreposto, armazenamento disponível e permissões declaradas"
+              ],
+              [
+                "Segredos",
+                "Senha do banco de dados, chaves do aplicativo e credenciais iniciais",
+                "Gerado uma vez e dado apenas aos membros que os usam"
+              ],
+              [
+                "Ciclo de vida",
+                "Ordem de início, ordem de parada e uma verificação de funcionamento por membro",
+                "A aplicação principal começa por último e pára primeiro"
+              ]
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "create",
+      "title": "2. Criação, membro por membro",
+      "blocks": [
+        {
+          "steps": {
+            "items": [
+              {
+                "title": "Reserve cada VMID",
+                "body": "O inventário Proxmox VE e o registro de instância são verificados. Um CT existente não é adotado e um contrato que ainda pertence a outra instância não é reutilizado."
+              },
+              {
+                "title": "Preparar cada imagem",
+                "body": "Todas as imagens são resolvidas, baixadas e verificadas antes da criação do primeiro container."
+              },
+              {
+                "title": "Criar cada rootfs",
+                "body": "Os metadados oficiais do OCI são importados, e a identidade da instância ProxMenux e o papel de membro são adicionados."
+              },
+              {
+                "title": "Rede privada",
+                "body": "Uma ponte e uma sub-rede são criadas e cada membro recebe seu endereço fixo; apenas o membro principal também recebe a interface LAN."
+              },
+              {
+                "title": "Persistência",
+                "body": "Cada banco de dados e configuração obtém seu próprio disco de contêiner; somente os dados destinados a serem compartilhados usam diretórios de host."
+              },
+              {
+                "title": "Ambiente",
+                "body": "Endpoints internos, segredos compartilhados e variáveis de serviço são escritos. O aplicativo atinge suas dependências em seus endereços privados reservados."
+              },
+              {
+                "title": "Registro",
+                "body": "Cada membro registra sua configuração nativa, as mudanças rootfs que as atualizações têm que reproduzir e sua relação com a pilha."
+              }
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "checks",
+      "title": "3. Iniciar e verificar cada recipiente",
+      "intro": "Um LXC criado não significa um serviço pronto. As dependências começam em ordem e cada um passa uma verificação específica para o seu serviço.",
+      "blocks": [
+        {
+          "table": {
+            "headers": [
+              "Serviço",
+              "Verificação",
+              "O que mostra"
+            ],
+            "rows": [
+              [
+                "PostgreSQL",
+                "<code>pg_isready</code> no CT com o host, usuário e banco de dados esperados",
+                "O servidor aceita conexões para o banco de dados configurado"
+              ],
+              [
+                "Redis / Valkey",
+                "<code>redis-cli</code> ou <code>valkey-cli</code> <code>PING</code> contra o seu endereço privado",
+                "O broker escuta e responde"
+              ],
+              [
+                "aprendizado de máquina Immich",
+                "HTTP <code>GET /ping</code>, mais uma verificação do tempo de execução GPU selecionado",
+                "O serviço responde e a aceleração solicitada não passou a usar a CPU"
+              ],
+              [
+                "Nextcloud",
+                "<code>GET /status.php</code> com <code>installed=true</code>, <code>maintenance=false</code> e <code>needsDbUpgrade=false</code>",
+                "A inicialização terminou sem migração pendente"
+              ],
+              [
+                "Paperless-ngx / Tandoor",
+                "HTTP no endereço LAN e porto real do serviço",
+                "O frontend e suas dependências servem a aplicação"
+              ],
+              [
+                "Aplicação principal",
+                "O ponto final do seu modelo, por exemplo, <code>/api/server/ping</code> em Immich",
+                "A pilha inteira funciona através da aplicação que usa as dependências"
+              ]
+            ]
+          }
+        },
+        {
+          "calloutWarning": {
+            "title": "Em execução não significa funcionando corretamente",
+            "body": "O estado em execução apenas diz que o processo LXC existe. Quando o serviço oferece uma verificação melhor, é utilizado uma verificação exec ou HTTP com tempo limite. Se um membro para ou falha na verificação, a pilha não é declarada instalada."
+          }
+        }
+      ]
+    },
+    {
+      "id": "hook",
+      "title": "4. O gancho de dependência",
+      "blocks": [
+        {
+          "p": "O gancho é definido apenas no recipiente principal de uma pilha dependente. Proxmox VE mantém o script como um trecho e o executa como o <code>hookscript</code> daquele CT. A receita da pilha não é escrita no script: ela vive em um contrato privado separado."
+        },
+        {
+          "codeGrid": {
+            "items": [
+              {
+                "title": "Configuração principal do CT",
+                "code": "hookscript: local:snippets/proxmenux-stack-dependencies.sh"
+              },
+              {
+                "title": "Contrato privado (exemplo)",
+                "code": "/etc/pve/priv/proxmenux-stack-VMID.json\n{\n  \"schema\": 1,\n  \"stack\": \"immich\",\n  \"dependencies\": [\n    {\"vmid\": 107, \"label\": \"PostgreSQL\", \"healthcheck\": {...}},\n    {\"vmid\": 108, \"label\": \"Valkey\", \"healthcheck\": {...}},\n    {\"vmid\": 106, \"label\": \"Machine Learning\", \"healthcheck\": {...}}\n  ]\n}"
+              }
+            ]
+          }
+        },
+        {
+          "snippet": {
+            "summary": "Fonte completa de proxmenux-stack-dependencies.sh",
+            "pathCode": "local:snippets/proxmenux-stack-dependencies.sh",
+            "snippetCode": "stackDependencyHook"
+          }
+        },
+        {
+          "p": "O script é o mesmo para cada pilha. VMIDs, nomes, tipos de verificação e timeouts vêm do contrato privado <code>/etc/pve/priv/proxmenux-stack-VMID.json</code> de cada pilha."
+        },
+        {
+          "steps": {
+            "items": [
+              {
+                "title": "O Proxmox VE chama pre-start",
+                "body": "Antes do início do CT principal, o gancho funciona com o seu VMID e a fase do ciclo de vida."
+              },
+              {
+                "title": "Um bloqueio por pilha",
+                "body": "<code>flock</code> em <code>/run/lock/proxmenux-stack-VMID.lock</code> impede duas sequências de início ao mesmo tempo."
+              },
+              {
+                "title": "O contrato é lido e validado",
+                "body": "São exigidos um esquema conhecido, dependências numéricas, rótulos, uma verificação exec, http ou running e um tempo limite positivo."
+              },
+              {
+                "title": "Dependências em ordem",
+                "body": "Cada CT deve existir; um parado é iniciado e um já em execução não é reiniciado."
+              },
+              {
+                "title": "Esperar o serviço ficar pronto",
+                "body": "A verificação é executada a cada dois segundos, e o CT também é confirmado para estar ainda em execução."
+              },
+              {
+                "title": "O CT principal começa",
+                "body": "Quando cada dependência está pronta, termina pré-inicial e o Proxmox VE inicia a aplicação."
+              }
+            ]
+          }
+        },
+        {
+          "calloutInfo": {
+            "title": "O gancho não para dependências",
+            "body": "As fases pós-início, pré-parar e pós-parar não fazem nada. Parar o CT principal deixa PostgreSQL, Redis, Valkey ou aprendizado de máquina em execução. O gancho ordena o início; ele não transforma vários LXCs em um processo."
+          }
+        },
+        {
+          "table": {
+            "headers": [
+              "Tipo",
+              "Exemplo",
+              "Início posterior"
+            ],
+            "rows": [
+              [
+                "Pilha dependente",
+                "Immich, Nextcloud, aplicação com PostgreSQL",
+                "O gancho do CT principal inicia as dependências e espera por eles"
+              ],
+              [
+                "Conjunto de aplicativos",
+                "Conjunto de aplicações Arr",
+                "Nenhum membro principal: cada LXC segue o seu próprio <code>onboot</code>"
+              ],
+              [
+                "Aplicação única",
+                "Jellyfin",
+                "Proxmox VE inicia esse LXC diretamente"
+              ]
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "stack-checks",
+      "title": "5. Verifica a pilha como um todo",
+      "blocks": [
+        {
+          "list": {
+            "items": [
+              "Cada VMID existe, é único e mantém a identidade de instância esperada.",
+              "Cada contrato pertence à mesma pilha, mantém seu papel e sua configuração nativa gravada.",
+              "O membro principal é o último em <code>start_order</code> e o primeiro em <code>stop_order</code>.",
+              "Nenhum membro, volume ou adaptação rootfs está faltando.",
+              "O gancho aponta para o trecho oficial, seu conteúdo é inalterado e seu contrato corresponde à receita da pilha.",
+              "As imagens e digests observados correspondem aos arquivos OCI preparados.",
+              "Dispositivos, perfis GPU, montagens, segredos e endpoints ainda correspondem aos contratos.",
+              "Após cada dependência passar, o ponto final da aplicação principal verifica a integração entre os membros."
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "manage",
+      "title": "Gerenciando uma pilha instalada",
+      "intro": "Em <strong>Gerenciar aplicativos OCI instalados</strong>, qualquer membro leva à pilha inteira. O menu oferece <strong>Atualizar todos os contêineres do aplicativo</strong>, <strong>Modificar caminhos e dispositivos extras</strong>, <strong>Recriar todos os contêineres com a configuração salva</strong> e <strong>Remover: excluir o aplicativo e seus contêineres</strong>. Recriar reconstrói cada contêiner da imagem original pelo digest salvo, sem procurar uma mais nova, seguindo os mesmos passos de uma atualização. A opção aparece para pilhas que podem ser atualizadas.",
+      "blocks": [
+        {
+          "steps": {
+            "items": [
+              {
+                "title": "Qualquer membro",
+                "body": "O contrato dos membros nomeia o VMID principal e a lista completa de membros."
+              },
+              {
+                "title": "A pilha é reprodutível",
+                "body": "Identificações, contratos, gancho, adaptações e uma repetição coordenada para essa receita são validadas."
+              },
+              {
+                "title": "Primeiro as imagens",
+                "body": "O aplicativo não é parado até que cada digest tenha sido resolvido, baixado e verificado."
+              },
+              {
+                "title": "Parar e fazer backup do conjunto",
+                "body": "Os backups nativos verificados são feitos com a pilha parada, então a aplicação e os bancos de dados pertencem ao mesmo momento."
+              },
+              {
+                "title": "Atualizar e verificar cada membro",
+                "body": "Adaptação, rede, montagens, segredos e dispositivos são novamente aplicados antes do exame de saúde de cada membro."
+              },
+              {
+                "title": "Publicar ou recuperar tudo",
+                "body": "Os novos contratos só são publicados quando todos os membros passam. Se alguém falhar, cada membro é restaurado."
+              }
+            ]
+          }
+        },
+        {
+          "table": {
+            "headers": [
+              "Modificar",
+              "O que muda",
+              "O que é guardado"
+            ],
+            "rows": [
+              [
+                "Caminhos e dispositivos adicionais",
+                "Eles são adicionados ou removidos do recipiente de aplicação, que reinicia. Nada é reconstruído.",
+                "Os dados da aplicação, da sua base de dados e dos outros contentores"
+              ],
+              [
+                "O que executa o reconhecimento (Immich)",
+                "O recipiente de aprendizado de máquina leva a imagem e os dispositivos do CPU ou de um GPU do hospedeiro. Todo o aplicativo é parado e atualizado, como em uma atualização",
+                "O cache do modelo, a biblioteca e o banco de dados. Se algo falhar, os recipientes anteriores e a escolha anterior são restaurados"
+              ]
+            ]
+          }
+        },
+        {
+          "calloutWarning": {
+            "title": "Uma pilha sem uma repetição coordenada não é atualizada",
+            "body": "Se a preparação de uma pilha não puder ser reproduzida, a atualização é recusada antes de a pilha ser parada. A aplicação continua a correr como está."
+          }
+        }
+      ]
+    },
+    {
+      "id": "failure",
+      "title": "6. Quando algo falha",
+      "blocks": [
+        {
+          "p": "Durante uma instalação, um erro para e remove os contêineres incompletos que a operação criou, e a ponte privada se a operação criou. Uma pilha não é publicada como válida até que toda a sequência termine."
+        },
+        {
+          "p": "Uma atualização é transacional: todas as imagens são preparadas primeiro, depois a pilha pára, cada membro é feito backup e o backup verificado, e só então é substituído cada rootfs. Os membros começam um a um com seu exame de saúde; se um falha, cada membro é restaurado a partir do mesmo conjunto de backups, de modo que o banco de dados eo aplicativo nunca pertencem a momentos diferentes."
+        },
+        {
+          "mermaid": {
+            "chartCode": "flowchart LR\n P[\"{{prepare}}\"] --> S[\"{{stop}}\"]\n S --> B[\"{{backup}}\"]\n B --> R[\"{{replace}}\"]\n R --> H{\"{{healthy}}\"}\n H -- \"{{yes}}\" --> C[\"{{commit}}\"]\n H -- \"{{no}}\" --> X[\"{{rollback}}\"]",
+            "labels": {
+              "prepare": "Preparar cada imagem",
+              "stop": "Parar, membro principal primeiro",
+              "backup": "Cópia de segurança verificada de cada CT",
+              "replace": "Substituir rootfs",
+              "healthy": "Todos funcionando corretamente?",
+              "yes": "Sim",
+              "no": "Não",
+              "commit": "Publicar contratos",
+              "rollback": "Restaurar cada membro"
+            }
+          }
+        }
+      ]
+    },
+    {
+      "id": "not-assumed",
+      "title": "O que uma pilha não inclui",
+      "blocks": [
+        {
+          "list": {
+            "items": [
+              "Uma suíte instalada em um fluxo, como a suíte Arr, não é uma pilha dependente: seus recipientes não têm ordem de início entre eles.",
+              "A rede privada não substitui a autenticação, TLS ou a configuração de cada aplicativo.",
+              "O backup de um LXC não contém a ponte, o gancho ou os contratos do resto da pilha.",
+              "Prowlarr, Sonarr ou Radarr não recebem indexadores, perfis ou provedores de ProxMenux."
+            ]
+          }
+        }
+      ]
+    }
+  ]
+}
diff --git a/web/messages/pt/docs/oci-manager/storage-network.json b/web/messages/pt/docs/oci-manager/storage-network.json
new file mode 100644
index 00000000..3fb8a7ee
--- /dev/null
+++ b/web/messages/pt/docs/oci-manager/storage-network.json
@@ -0,0 +1,305 @@
+{
+  "meta": {
+    "title": "Dados, caminhos e rede | ProxMenux",
+    "description": "Como o OCI manager Apps preserva os dados de um contentor OCI: discos do contentor, diretórios do host, montagens com rclone, endereços e redes privadas."
+  },
+  "header": {
+    "title": "Dados, caminhos e rede",
+    "description": "O que fica no rootfs, o que é preservado quando este é substituído, como os dados são partilhados entre contentores e como cada um obtém o seu endereço.",
+    "section": "OCI manager Apps"
+  },
+  "sections": [
+    {
+      "id": "intro",
+      "blocks": [
+        {
+          "calloutInfo": {
+            "title": "A persistência é decidida antes de criar o LXC",
+            "body": "Os volumes declarados pela imagem e pelo respetivo ficheiro Compose são lidos antes de criar o contentor. Cada caminho que deva ser preservado após uma atualização torna-se um ponto de montagem independente do rootfs. Assim, o rootfs contém apenas o que pertence à imagem e pode ser substituído."
+          }
+        }
+      ]
+    },
+    {
+      "id": "questions",
+      "title": "O que o instalador pergunta",
+      "intro": "O modelo fornece os caminhos necessários à aplicação. Cada um é colocado num disco do contentor ou num diretório do host, e podem ser acrescentados mais caminhos antes do resumo.",
+      "blocks": [
+        {
+          "steps": {
+            "items": [
+              {
+                "title": "Caminhos necessários",
+                "body": "São apresentados <code>/config</code>, <code>/data</code>, bibliotecas, descargas e todos os volumes declarados pela aplicação."
+              },
+              {
+                "title": "Localização",
+                "body": "Cada caminho é colocado num disco do contentor ou num diretório já existente no host."
+              },
+              {
+                "title": "Armazenamento e tamanho",
+                "body": "É criado um disco do contentor num armazenamento do Proxmox VE com o tamanho indicado. A instalação predefinida utiliza <code>local-lvm</code>; a avançada pergunta o armazenamento de cada caminho imediatamente antes do tamanho e propõe o do rootfs. O disco aparece como <code>vm-VMID-disk-N</code> e é associado como <code>mpN</code>."
+              },
+              {
+                "title": "Diretório do host",
+                "body": "O diretório do host é indicado pelo seu caminho. Se não existir, é criado e atribuído ao utilizador do host para o qual é mapeado o utilizador do contentor."
+              },
+              {
+                "title": "Caminhos adicionais",
+                "body": "Antes de instalar, podem ser acrescentados mais pares de caminho ou volume do host e caminho dentro do contentor."
+              },
+              {
+                "title": "Resumo",
+                "body": "O mapeamento completo é apresentado antes de criar o CT e guardado no contrato da instância."
+              }
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "options",
+      "title": "As duas localizações persistentes",
+      "blocks": [
+        {
+          "table": {
+            "headers": [
+              "Propriedade",
+              "Disco do contentor",
+              "Diretório do host"
+            ],
+            "rows": [
+              [
+                "Na configuração",
+                "<code>mpN: STORAGE:vm-VMID-disk-N,mp=/config,backup=1,size=16G</code>",
+                "<code>mpN: /mnt/oci-shared/media,mp=/data/media</code>"
+              ],
+              [
+                "Cópia de segurança do contentor (vzdump)",
+                "Incluído, com <code>backup=1</code>",
+                "Não incluído"
+              ],
+              [
+                "Tamanho",
+                "Fixo; aumenta-se redimensionando o ponto de montagem",
+                "O espaço livre do sistema de ficheiros ou dataset do host"
+              ],
+              [
+                "Outros contentores",
+                "Montado apenas pelo contentor a que pertence",
+                "O mesmo diretório pode ser montado em vários contentores"
+              ],
+              [
+                "Snapshots e restauro",
+                "Geridos pelo Proxmox VE juntamente com o CT",
+                "Geridos no armazenamento do host"
+              ],
+              [
+                "Ao remover a aplicação",
+                "Eliminado com o contentor",
+                "Preservado com o seu conteúdo"
+              ],
+              [
+                "Ao mover o CT para outro nó",
+                "É movido com o CT",
+                "O mesmo caminho tem de existir no outro nó"
+              ]
+            ]
+          }
+        },
+        {
+          "p": "O rootfs fica reservado para os binários e o conteúdo da imagem. Uma atualização ou recriação substitui-o sem tocar em nenhum dos dois tipos de ponto de montagem."
+        }
+      ]
+    },
+    {
+      "id": "example",
+      "title": "Exemplo: um contentor com ambas as localizações",
+      "blocks": [
+        {
+          "code": {
+            "title": "Jellyfin instalado como CT 151 em local-lvm (excerto)",
+            "code": "rootfs: local-lvm:vm-151-disk-0,size=8G\n# Container disk, part of the CT backup\nmp0: local-lvm:vm-151-disk-1,mp=/config,backup=1,size=16G\n\n# Host directory, outside the CT backup\nmp1: /mnt/oci-shared/media,mp=/data/media"
+          }
+        },
+        {
+          "p": "Uma atualização ou recriação substitui apenas o rootfs: o <code>mp0</code> preserva utilizadores, bibliotecas e definições, e o <code>mp1</code> continua a apresentar os mesmos ficheiros multimédia. Restaurar a cópia do CT recupera <code>/config</code>; se necessário, o diretório multimédia é restaurado a partir da cópia de segurança do armazenamento do host."
+        },
+        {
+          "flow": {
+            "nodes": [
+              {
+                "label": "Contrato",
+                "detail": "/config"
+              },
+              {
+                "label": "Localização",
+                "detail": "Disco do contentor\nou diretório do host"
+              },
+              {
+                "label": "LXC",
+                "detail": "Sempre /config\npara a aplicação"
+              }
+            ],
+            "caption": "A aplicação vê o caminho declarado pela imagem; só muda o local onde é armazenado."
+          }
+        }
+      ]
+    },
+    {
+      "id": "shared",
+      "title": "Um diretório do host, vários contentores",
+      "blocks": [
+        {
+          "mermaid": {
+            "chartCode": "flowchart TB\n H[\"{{host}}<br/>/mnt/oci-shared/media\"]\n H --> Q[\"qBittorrent<br/>/data\"]\n H --> J[\"Jellyfin<br/>/data\"]\n H --> R[\"Radarr / Sonarr<br/>/data\"]\n Q -. \"{{config}}\" .-> QV[(\"/config mpN\")]\n J -. \"{{config}}\" .-> JV[(\"/config mpN\")]\n R -. \"{{config}}\" .-> RV[(\"/config mpN\")]",
+            "labels": {
+              "host": "Diretório do host",
+              "config": "Configuração própria"
+            }
+          }
+        },
+        {
+          "p": "Cada contentor guarda a sua configuração no respetivo disco. A biblioteca ou as descargas ficam num único diretório do host, montado no mesmo caminho interno em todos os contentores. Assim, o caminho onde uma aplicação escreve é o mesmo de onde outra lê."
+        }
+      ]
+    },
+    {
+      "id": "rclone",
+      "title": "Armazenamento na nuvem através da aplicação rclone",
+      "intro": "Além da instalação, a ficha do rclone no catálogo permite <strong>Ativar uma montagem num contentor OCI de rclone existente</strong>. É montado um armazenamento remoto já criado e autorizado na interface web do rclone e disponibilizado no host. Outros contentores podem utilizá-lo como um diretório do host.",
+      "blocks": [
+        {
+          "steps": {
+            "items": [
+              {
+                "title": "Contentor e armazenamento remoto",
+                "body": "O VMID do contentor de rclone, o nome exato do armazenamento remoto e, opcionalmente, um caminho dentro dele."
+              },
+              {
+                "title": "Nome da montagem e cache",
+                "body": "O nome da montagem e o modo de cache VFS: <code>off</code>, <code>minimal</code>, <code>writes</code> ou <code>full</code> (predefinido)."
+              },
+              {
+                "title": "Vistas disponibilizadas",
+                "body": "Uma raiz comum, <code>/mnt/oci-shared</code> por predefinição, contém uma vista de leitura e escrita em <code>/mnt/oci-shared/remotes/NAME</code> e uma vista só de leitura em <code>/mnt/oci-shared/remotes-ro/NAME</code>."
+              },
+              {
+                "title": "Ativação",
+                "body": "Após confirmação, o CT é parado, o seu comando de arranque e um hookscript do Proxmox VE são configurados e o CT é iniciado novamente. A operação aguarda até ambas as vistas estarem montadas no host."
+              }
+            ]
+          }
+        },
+        {
+          "calloutInfo": {
+            "title": "Se a montagem não for ativada",
+            "body": "A configuração anterior do contentor é restaurada e este é iniciado novamente. Assim, se a ativação falhar, o rclone fica como estava."
+          }
+        }
+      ]
+    },
+    {
+      "id": "network",
+      "title": "Endereços e redes",
+      "intro": "Uma aplicação com um só contentor precisa de um endereço. Uma aplicação com vários contentores também precisa de uma rede estável entre os seus membros.",
+      "blocks": [
+        {
+          "cards": {
+            "items": [
+              {
+                "icon": "network",
+                "title": "Aplicação com um só contentor",
+                "body": "Escolhe-se a bridge de rede e DHCP ou um endereço fixo em formato CIDR. O LXC tem um endereço próprio e o resumo apresenta os URL completos dos serviços."
+              },
+              {
+                "icon": "waypoints",
+                "title": "Aplicação com vários contentores",
+                "body": "É encontrada uma sub-rede livre e criada uma bridge privada persistente. Cada membro — aplicação, base de dados e cache — recebe nela um endereço fixo."
+              }
+            ]
+          }
+        },
+        {
+          "flow": {
+            "nodes": [
+              {
+                "label": "LAN",
+                "detail": "Endereço acessível\napenas para o serviço principal"
+              },
+              {
+                "label": "LXC principal",
+                "detail": "Web / API\nLAN + rede privada"
+              },
+              {
+                "label": "Rede privada",
+                "detail": "PostgreSQL · Valkey · ML\nendereços fixos"
+              }
+            ],
+            "caption": "As dependências comunicam pela rede privada e não têm um endereço na LAN."
+          }
+        },
+        {
+          "p": "O contrato da stack guarda a bridge, a sub-rede, os endereços e as relações entre serviços. Ao atualizar a aplicação, a mesma topologia é reutilizada para todos os membros. O ProxMenux Monitor abre o contentor principal no seu endereço LAN, não no da rede privada."
+        }
+      ]
+    },
+    {
+      "id": "ownership",
+      "title": "Proprietários de ficheiros e diretórios",
+      "blocks": [
+        {
+          "list": {
+            "items": [
+              "Os novos diretórios são criados com o UID e o GID para os quais é mapeado o LXC sem privilégios.",
+              "O proprietário dos diretórios existentes não é alterado de forma recursiva.",
+              "Sockets, ficheiros de sistema e caminhos sensíveis não são propostos como diretórios genéricos do host."
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "backup",
+      "title": "O que contém uma cópia de segurança do contentor",
+      "blocks": [
+        {
+          "table": {
+            "headers": [
+              "Elemento",
+              "Na cópia vzdump do CT",
+              "Onde é guardado"
+            ],
+            "rows": [
+              [
+                "Rootfs OCI",
+                "Sim",
+                "Na cópia do CT; também pode ser reconstruído a partir da imagem e do contrato"
+              ],
+              [
+                "Disco do contentor com <code>backup=1</code>",
+                "Sim",
+                "A cópia do CT"
+              ],
+              [
+                "Diretório do host",
+                "Não",
+                "A cópia de segurança do armazenamento do host"
+              ],
+              [
+                "Contrato da instância",
+                "Sim, a cópia guardada no CT",
+                "<code>/.proxmenux/oci-record.json</code> dentro do CT; as cópias adicionais do host e do cluster são guardadas separadamente"
+              ],
+              [
+                "Aplicação com vários contentores",
+                "Cada membro na sua própria cópia",
+                "As cópias de todos os membros, mais o contrato da stack e a respetiva bridge no host"
+              ]
+            ]
+          }
+        }
+      ]
+    }
+  ]
+}
diff --git a/web/messages/pt/docs/post-install/automated.json b/web/messages/pt/docs/post-install/automated.json
new file mode 100644
index 00000000..96ad54ff
--- /dev/null
+++ b/web/messages/pt/docs/post-install/automated.json
@@ -0,0 +1,172 @@
+{
+  "meta": {
+    "title": "Script pós-instalação automatizado | Documentação ProxMenux",
+    "description": "O script pós-instalação automatizado ProxMenux executa 14 otimizações predefinidas adaptadas ao hardware num host Proxmox VE novo. Não tem lista de funções para selecionar, mas pode pedir confirmação para a atualização do sistema, para ocultar o aviso de subscrição, instalar Log2RAM em certos casos e reiniciar. As alterações reversíveis ficam registadas.",
+    "ogTitle": "Script pós-instalação automatizado | Documentação ProxMenux",
+    "ogDescription": "14 otimizações predefinidas adaptadas ao hardware para um host Proxmox VE novo, com confirmações para algumas ações e registo de alterações reversíveis."
+  },
+  "header": {
+    "title": "Script pós-instalação automatizado",
+    "description": "O ProxMenux executa 14 otimizações de base predefinidas sem lista de funções para selecionar. Algumas ações pedem confirmação. As alterações reversíveis ficam registadas em Desinstalar otimizações; as atualizações de pacotes não são descritas como reversíveis.",
+    "section": "Pós-instalação · Automatizada"
+  },
+  "intro": {
+    "title": "Quando escolher Automatizado",
+    "body": "Execute isso em um host Proxmox recém-instalado quando desejar uma linha de base sensata sem tomar decisões. O script é idempotente – executá-lo duas vezes é seguro, basta reaplicar as mesmas configurações. Recursos opcionais (Fastfetch, IOMMU, repositório Ceph, HA, correções AMD…) intencionalmente <strong>não</strong> fazem parte deste caminho; escolha-os em <link>Personalizáveis</link> se precisar deles."
+  },
+  "applies": {
+    "heading": "O que o script aplica",
+    "intro": "As otimizações são aplicadas nesta ordem exata. A coluna <em>Categoria</em> liga à documentação detalhada de cada alteração na referência personalizável.",
+    "headerNum": "#",
+    "headerTool": "Ferramenta",
+    "headerWhat": "O que ele faz",
+    "headerCategory": "Categoria"
+  },
+  "optimizations": [
+    {
+      "tool": "Repositórios APT + atualização completa",
+      "what": "Desativa as fontes Enterprise pve-enterprise.sources e ceph.sources, cria uma fonte no-subscription para o nome de código Debian do host e executa apt update && apt full-upgrade -y (comando oficial de atualização Proxmox).",
+      "category": "Configurações básicas",
+      "categorySlug": "basic-settings"
+    },
+    {
+      "tool": "Remoção de banner de assinatura",
+      "what": "Aplica patches na interface web para ocultar o banner 'Sem assinatura válida'. Pede confirmação antes de aplicar; reversível de Desinstalar Otimizações.",
+      "category": "Personalização",
+      "categorySlug": "customization"
+    },
+    {
+      "tool": "Forçar IPv4",
+      "what": "Escreve /etc/apt/apt.conf.d/99-force-ipv4 para o apt usar apenas IPv4, contornando ligações IPv6 instáveis aos espelhos.",
+      "category": "Rede",
+      "categorySlug": "network"
+    },
+    {
+      "tool": "Ignorar pacotes de idioma",
+      "what": "Escreve /etc/apt/apt.conf.d/99-disable-translations para deixar de transferir índices de descrições traduzidas de pacotes, reduzindo os dados das atualizações apt.",
+      "category": "Configurações básicas",
+      "categorySlug": "basic-settings"
+    },
+    {
+      "tool": "Aumentar os limites do sistema",
+      "what": "Aumenta as monitorizações inotify, os limites nofile/nproc, os limites do chaveiro do kernel e fs.file-max através de sysctl.d, limits.d, pam e systemd, para hosts com muitos contentores.",
+      "category": "Sistema",
+      "categorySlug": "system"
+    },
+    {
+      "tool": "Ajuste de memória",
+      "what": "Define vm.swappiness=10, proporções equilibradas de páginas modificadas ainda não gravadas, vm.max_map_count=262144 e compactação proativa quando suportada. A política de sobrealocação de memória do kernel mantém a predefinição Proxmox.",
+      "category": "Sistema",
+      "categorySlug": "system"
+    },
+    {
+      "tool": "Comportamento de pânico no Kernel",
+      "what": "Configura o host para reiniciar 10 segundos após um pânico / oops / hardlockup em vez de congelar indefinidamente.",
+      "category": "Sistema",
+      "categorySlug": "system"
+    },
+    {
+      "tool": "Ajuste de pilha de rede",
+      "what": "Dimensionamento dos buffers TCP, reforço IPv4 (redirecionamentos desligados, rp_filter=2, registo martian desligado), portas locais 1024-65535, deteção MTU TCP, RFC 1337 e script /usr/local/sbin/proxmenux-fwbr-tune ligado a uma unidade systemd de execução única e regra udev. Assim, rp_filter=0 / log_martians=0 são reaplicados às interfaces fwbr*/fwln*/fwpr*/tap* sempre que Proxmox as recria ao iniciar/parar VMs, reiniciar ou migrar em funcionamento.",
+      "category": "Rede",
+      "categorySlug": "network"
+    },
+    {
+      "tool": "Personalização de bashrc (root)",
+      "what": "PS1 colorido, aliases comuns (l/la/ll/ls/grep), histórico com datas e horas e carregamento de bash-completion, num bloco delimitado PMX_CORE_BASHRC fácil de remover.",
+      "category": "Personalização",
+      "categorySlug": "customization"
+    },
+    {
+      "tool": "Log2RAM (adaptado a SSD, automático)",
+      "what": "Reduz o desgaste SSD/NVMe movendo /var/log para um ramdisk tmpfs com sincronização periódica para disco. Instalação a partir do projeto original quando o disco raiz é SSD ou NVMe. Dimensiona pela RAM do host (128M / 256M / 512M), agenda sincronização periódica e proteção automática que limpa journals antigos aos 80% e trunca registos muito ativos aos 92% antes de gravar. Ajusta limites journald ao ramdisk. Detalhes em <link>Log2RAM</link>.",
+      "category": "Armazenamento",
+      "categorySlug": "storage"
+    },
+    {
+      "tool": "Autotrim ZFS (apenas SSD)",
+      "what": "Ativa zpool autotrim=on em cada pool ZFS cujos vdevs sejam todos SSD/NVMe com TRIM (verifica /sys/block/[dev]/queue/rotational e discard_granularity). Ignora automaticamente pools com HDDs. Só regista para desinstalação os pools realmente alterados pelo ProxMenux; autotrim ativado manualmente é preservado.",
+      "category": "Armazenamento",
+      "categorySlug": "storage"
+    },
+    {
+      "tool": "Limites de tamanho do journald",
+      "what": "Força armazenamento persistente, limita SystemMaxUse=64M / RuntimeMaxUse=60M e ativa compressão e registos de nível info necessários ao Monitor. É ignorado se Log2RAM estiver ativo, pois faz o seu próprio ajuste.",
+      "category": "Sistema",
+      "categorySlug": "system"
+    },
+    {
+      "tool": "Ajuste de logrotate",
+      "what": "Define globalmente daily e depois size 10M, retém 7 rotações e ativa compressão e copytruncate. O critério de tamanho posterior prevalece; regras específicas podem substituí-lo. Adequado ao Log2RAM, mas a frequência depende das regras e do temporizador.",
+      "category": "Sistema",
+      "categorySlug": "system"
+    },
+    {
+      "tool": "Nomes de interface persistentes",
+      "what": "Escreve um ficheiro <code>/etc/systemd/network/10-proxmenux-&lt;iface&gt;.link</code> por placa física, com cabeçalho «Managed by ProxMenux», associando o MAC ao nome atual. Os nomes <code>eth0</code> / <code>enp…</code> ficam estáveis após reinícios e adição de placas.",
+      "category": "Rede",
+      "categorySlug": "network"
+    }
+  ],
+  "hardwareTitle": "Predefinições adaptadas ao hardware",
+  "hardwareBody": "O script lê o hardware do host antes de aplicar as configurações. Log2RAM é instalado apenas em discos raiz SSD / NVMe por padrão (ele avisa se a detecção indicar o contrário). O tamanho do ramdisk Log2RAM é escolhido do total RAM (<code>≤ 8 GB → 128M</code>, <code>≤ 16 GB → 256M</code>, <code>'>' 16 GB → 512M</code>). Os limites journald correspondem ao tamanho do disco RAM quando Log2RAM está ativo, para evitar preenchê-lo.",
+  "upgrade": {
+    "heading": "Atualizar listas de pacotes e sistema",
+    "intro": "O primeiro passo do percurso automatizado é atualizar o Proxmox. Para um host em funcionamento dentro da mesma versão principal, o Proxmox recomenda:",
+    "after": "Esta linha é o comando oficial das versões atuais do Proxmox. O script automatizado executa <strong>exatamente</strong> isso e acrescenta a limpeza dos repositórios e as tarefas após atualização recomendadas pelo guia — como o utilitário independente <link>Atualização do sistema Proxmox</link>:",
+    "items": [
+      "Desativa as fontes Enterprise <code>pve-enterprise.sources</code> / <code>ceph.sources</code>, remove ficheiros antigos de repositórios e cria uma fonte no-subscription para o nome de código do host.",
+      "Executa a atualização não-interativa com <code>DEBIAN_FRONTEND=noninteractive</code> e <code>--force-confdef --force-confold</code> — os arquivos de configuração que você personalizou permanecem seus quando o upstream também os alterou.",
+      "Instala pacotes essenciais do Proxmox em falta (<code>zfsutils-linux</code>, <code>proxmox-backup-restore-image</code>, <code>chrony</code>).",
+      "Verificação de sanidade de metadados LVM, <code>apt-get autoremove -y</code> + <code>apt-get autoclean -y</code>, e um prompt de reinicialização apenas se o kernel realmente mudou."
+    ],
+    "sameTitle": "Mesmo atualizador, dois pontos de entrada",
+    "sameBody": "O pacote automatizado e o utilitário independente <link>Proxmox System Update</link> compartilham os mesmos scripts subjacentes (<code>update-pve8.sh</code> / <code>update-pve9_2.sh</code>). Use o utilitário por conta própria quando você só quiser atualizar o host sem aplicar o resto das otimizações."
+  },
+  "endResult": {
+    "heading": "Resultado final esperado",
+    "body": "No fim, verá uma mensagem de sucesso com a saída de cada passo e uma pergunta de reinício, necessário para algumas definições do kernel. Pode adiá-lo; as definições aplicam-se no próximo arranque.",
+    "imageAlt": "Programa pós-instalação automatizado — saída final do terminal mostrando cada otimização aplicada com sucesso"
+  },
+  "notDoes": {
+    "heading": "O que este script NÃO faz",
+    "items": [
+      "Deteção automática do fuso horário (comentada no código original; use Personalizável se precisar).",
+      "Desativar portmapper / rpcbind (ver <secLink>Segurança</secLink>).",
+      "Activar IOMMU / VFIO (ver <virtLink>Virtualização</virtLink>).",
+      "Instalar Fastfetch / Figurine / repositório Ceph / HA / correções de CPU AMD (ver <optLink>Opcionais</optLink>).",
+      "Instalar pigz ou ajustar ZFS ARC (ver <perfLink>Desempenho</perfLink> / <storLink>Armazenamento</storLink>)."
+    ]
+  },
+  "xshokTitle": "detecção xshok-proxmox",
+  "xshokBody": "Se o host tiver executado anteriormente o script <code>xshok-proxmox</code>, ProxMenux detecta o arquivo marcador e avisa você antes de continuar. Alguns ajustes podem se sobrepor. O script companheiro está desatualizado — se você decidir continuar de qualquer forma, reveja <link>a visão geral</link> para o contexto.",
+  "revert": {
+    "heading": "Revertendo",
+    "body": "Cada ferramenta da tabela fica registada em <code>/usr/local/share/proxmenux/installed_tools.json</code>. Abra <link>Desinstalar otimizações</link> para escolher os itens a reverter. As cópias dos ficheiros modificados ficam junto dos originais com sufixo <code>.bak</code>."
+  },
+  "related": {
+    "heading": "Relacionado",
+    "items": [
+      {
+        "label": "Pós-instalação personalizável",
+        "href": "/docs/post-install/customizable",
+        "tail": " — escolher exactamente o que pretende do mesmo catálogo."
+      },
+      {
+        "label": "Desinstalar otimizações",
+        "href": "/docs/post-install/uninstall",
+        "tail": " — reverter qualquer subconjunto do que foi aqui aplicado."
+      },
+      {
+        "label": "Comandos úteis do sistema",
+        "href": "/docs/help-info/system-commands",
+        "tail": " — verificar as alterações (uptime, free, journalctl, etc.)."
+      },
+      {
+        "label": "Visão geral da pós-instalação",
+        "href": "/docs/post-install",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/pt/docs/post-install/basic-settings.json b/web/messages/pt/docs/post-install/basic-settings.json
new file mode 100644
index 00000000..852954f2
--- /dev/null
+++ b/web/messages/pt/docs/post-install/basic-settings.json
@@ -0,0 +1,240 @@
+{
+  "meta": {
+    "title": "Pós-instalação: Configurações básicas | Documentação ProxMenux",
+    "description": "Opções de pós-instalação fundamentais: mude para repositórios gratuitos do Proxmox e atualize, detecte automaticamente o fuso horário e habilite o NTP, pule downloads de linguagem APT e escolha os utilitários comuns do sistema 25 para instalar."
+  },
+  "header": {
+    "title": "Pós-instalação: Configurações básicas",
+    "section": "Configurações pós-instalação do Proxmox"
+  },
+  "intro": {
+    "title": "O que esta categoria abrange",
+    "body": "Cinco opções de base para um host Proxmox novo: usar repositórios comunitários sem subscrição, atualizar todo o sistema, configurar automaticamente o fuso horário e NTP, desativar traduções APT para poupar largura de banda e espaço e escolher entre 25 utilitários comuns."
+  },
+  "upgrade": {
+    "heading": "Atualizar listas de pacotes e sistema",
+    "intro": "Reconfigura o APT para usar o repositório <em>pve-no-subscription</em> gratuito (em vez do repositório corporativo que requer uma assinatura) e executa uma atualização completa do sistema. Os passos exatos dependem da versão principal do Proxmox VE: ProxMenux detecta e envia para o script certo.",
+    "headerVersion": "Versão PVE",
+    "headerScript": "Script de seleção por versão",
+    "headerCodename": "Nome de código Debian",
+    "rows": [
+      {
+        "version": "9.x",
+        "script": "update-pve9_2.sh",
+        "codename": "trixie"
+      },
+      {
+        "version": "8.x",
+        "script": "update-pve8.sh",
+        "codename": "bookworm"
+      }
+    ],
+    "officialTitle": "A recomendação oficial da Proxmox",
+    "officialBody": "A própria orientação de atualização da Proxmox é executar, nesta ordem exata:",
+    "officialOutro": "É o comando habitual para atualizações dentro da versão principal instalada do Proxmox VE. Verifique os repositórios e as alterações propostas aos pacotes <em>antes</em> de continuar. A mudança de versão principal exige o procedimento oficial de migração.",
+    "doesTitle": "O que a opção ProxMenux faz — verificado contra o script",
+    "doesIntro": "A atualização ProxMenux executa os comandos apt acima e acrescenta passos prévios e posteriores que teria de gerir manualmente. Cada item abaixo corresponde ao script de seleção; consulte <link>Atualização do sistema Proxmox</link> para o detalhe completo.",
+    "doesItems": [
+      "<strong>Primeiro, organizar os repositórios.</strong> Desativa as fontes Enterprise <code>pve-enterprise.sources</code> / <code>ceph.sources</code>, remove ficheiros antigos de versões PVE anteriores e cria um <code>proxmox.sources</code> limpo para o canal gratuito <em>pve-no-subscription</em>, conforme o nome de código Debian: trixie para PVE 9, bookworm para PVE 8.",
+      "<strong>Reescreve os repositórios Debian</strong> com main / updates / security e <code>non-free-firmware</code>, para eliminar o aviso de firmware durante a atualização.",
+      "<strong>Executa a atualização oficial.</strong> <code>apt-get update</code> seguido por <code>apt full-upgrade -y</code> (PVE 9) ou <code>apt dist-upgrade -y</code> (PVE 8), ambos lançados não-interactivamente com <code>--force-confdef --force-confold</code> para que quaisquer arquivos de configuração que você personalizou permaneçam seus.",
+      "<strong>Instala pacotes essenciais</strong> se estiverem faltando: <code>zfsutils-linux</code>, <code>proxmox-backup-restore-image</code>, <code>chrony</code>.",
+      "<strong>Verifica os metadados LVM.</strong> Procura VMs com passthrough de discos que possam ter deixado cabeçalhos antigos de volumes físicos nos discos em bruto. Avisa sobre anomalias sem as corrigir automaticamente.",
+      "<strong>Limpa depois:</strong> <code>apt-get autoremove -y</code> + <code>apt-get autoclean -y</code>, então pede uma reinicialização se o kernel foi atualizado ou <code>/var/run/reboot-required</code> está presente."
+    ],
+    "shortTitle": "Em suma",
+    "shortBody": "A opção executa o comando recomendado <code>apt update && apt full-upgrade -y</code>, com a organização dos repositórios e a limpeza final indicadas no guia oficial, e pede reinício no fim. Consulte <link>Atualização do sistema Proxmox</link> para o diagrama completo; o mesmo atualizador está disponível separadamente no menu principal.",
+    "subTitle": "Não aplicar a um host com subscrição",
+    "subBody": "Se você realmente tiver uma assinatura Proxmox e quiser continuar usando os repositórios empresariais, pule esta opção. Executando-o desabilita o repositório corporativo e encaminha o host para o canal comunitário. A atualização do pacote e reescrita do repositório não são apresentadas como reversíveis em Desinstalar Otimizações; restaure sua configuração do repositório deliberadamente se você precisar mudar de canal mais tarde.",
+    "safetyTitle": "Controlo de segurança pós-atualização",
+    "safetyBody": "Após a atualização, o script procura metadados antigos de volumes físicos (PV) nos discos. Pode acontecer quando uma VM com passthrough escreve cabeçalhos LVM num disco em bruto. Se detetar algo suspeito, avisa e sugere <code>pvs</code> para inspeção. Não altera nada automaticamente."
+  },
+  "time": {
+    "heading": "Sincronizar a hora automaticamente",
+    "intro": "Detecta o IP público do servidor via <code>dig myip.opendns.com @resolver1.opendns.com</code>, em seguida, consulta o <code>ipapi.co/'{'ip'}'/timezone</code> para procurar o fuso horário IANA correspondente, e aplica-o com o <code>timedatectl set-timezone</code>. Finalmente permite NTP com <code>timedatectl set-ntp true</code>.",
+    "depTitle": "Depende de dois serviços externos",
+    "depBody": "A pesquisa depende de OpenDNS e <code>ipapi.co</code> serem alcançáveis, e de suas respostas serem corretas. Se você executar o Proxmox atrás de uma VPN ou em um VLAN que sai de uma região diferente, o fuso horário detectado automaticamente pode estar errado. Nesse caso, ignore esta opção e defina o fuso- horário à mão:",
+    "revertTitle": "Reversível do menu Desinstalar",
+    "revertBody": "<link>Desinstalar otimizações</link> repõe o fuso horário em UTC, um valor seguro. NTP continua ativo: o relógio sincroniza e mostra UTC até definir outro fuso manualmente."
+  },
+  "languages": {
+    "heading": "ignorar o download de idiomas adicionais",
+    "intro": "Durante <code>apt update</code>, o APT pode transferir descrições de pacotes traduzidas além dos metadados principais. A opção desativa-as para poupar largura de banda e espaço. Antes, o ProxMenux <strong>confirma que as definições regionais do host foram geradas</strong>: lê <code>/etc/default/locale</code> ou <code>/etc/environment</code>, acrescenta a <code>/etc/locale.gen</code> se faltar e executa <code>locale-gen</code>. Assim mantém as definições regionais da shell.",
+    "writtenTitle": "O que é escrito",
+    "revertTitle": "Reversível do menu Desinstalar",
+    "revertBody": "Excluindo <code>/etc/apt/apt.conf.d/99-disable-translations</code> (quer manualmente ou a partir do menu Desinstalar) restaura o comportamento padrão e APT baixa arquivos de idioma novamente."
+  },
+  "utilities": {
+    "heading": "Instale utilitários comuns do sistema",
+    "intro": "Abre uma lista de <strong>25 utilitários selecionados</strong> por grupos. Escolha e confirme; o ProxMenux instala-os pelo <code>apt</code>, verifica o resultado e mostra um resumo final.",
+    "imageAlt": "Seletor de utilitários ProxMenux: Espaço para selecionar, Enter para confirmar",
+    "reuseTitle": "A mesma lista é reutilizada em outro lugar",
+    "reuseBody": "O catálogo dos 25 utilitários tem uma única definição: <code>PROXMENUX_UTILS</code> em <code>scripts/global/utils-install-functions.sh</code>. O menu <em>Utilitários e ferramentas → Utilitários do sistema</em> oferece a mesma lista para instalar mais tarde sem repetir a pós-instalação.",
+    "listTitle": "O que está na lista",
+    "groups": [
+      {
+        "group": "Monitores de sistemas",
+        "items": [
+          {
+            "pkg": "htop",
+            "desc": "Visualizador interativo de processos"
+          },
+          {
+            "pkg": "btop",
+            "desc": "Monitor moderno de recursos (CPU, RAM, discos, rede, processos)"
+          },
+          {
+            "pkg": "s-tui",
+            "desc": "Interface de terminal para testes de esforço e monitorização da CPU"
+          },
+          {
+            "pkg": "iftop",
+            "desc": "Utilização de largura de banda ao vivo por ligação"
+          },
+          {
+            "pkg": "iotop",
+            "desc": "I/O do disco por processo"
+          },
+          {
+            "pkg": "iptraf-ng",
+            "desc": "Monitor Interativo IP LAN"
+          }
+        ]
+      },
+      {
+        "group": "Rede",
+        "items": [
+          {
+            "pkg": "iperf3",
+            "desc": "Medir largura de banda máxima alcançável entre máquinas"
+          },
+          {
+            "pkg": "net-tools",
+            "desc": "Ferramentas antigas (ifconfig, netstat, route). Ainda úteis para verificações rápidas"
+          },
+          {
+            "pkg": "ipset",
+            "desc": "Gerencie grandes conjuntos de IP no kernel — úteis com regras iptables/nftables."
+          }
+        ]
+      },
+      {
+        "group": "Transferências e arquivos",
+        "items": [
+          {
+            "pkg": "axel",
+            "desc": "Acelerador de transferência paralelo leve"
+          },
+          {
+            "pkg": "aria2",
+            "desc": "Downloader multi-fonte / multi-protocolo (HTTP, FTP, BitTorrent, Metalink)"
+          },
+          {
+            "pkg": "unzip",
+            "desc": "Extrair arquivos ZIP"
+          },
+          {
+            "pkg": "zip",
+            "desc": "Criar arquivos ZIP"
+          },
+          {
+            "pkg": "cabextract",
+            "desc": "Extrair arquivos Microsoft CAB (útil com ISOs do Windows)"
+          },
+          {
+            "pkg": "wimtools",
+            "desc": "Manipular imagens WIM do Windows (extrair, dividir, montar, aplicar)"
+          },
+          {
+            "pkg": "genisoimage",
+            "desc": "Compila imagens ISO 9660 de uma árvore de diretórios"
+          }
+        ]
+      },
+      {
+        "group": "Texto e ficheiros",
+        "items": [
+          {
+            "pkg": "dos2unix",
+            "desc": "Converter final de linha CRLF (Windows) para LF (Unix)"
+          },
+          {
+            "pkg": "grc",
+            "desc": "Colorização genérica: aplica realce de sintaxe às saídas de ping, traceroute, dig, tail e outros comandos"
+          },
+          {
+            "pkg": "plocate",
+            "desc": "Pesquisa rápida de arquivos (indexado). Executar `updatedb` após instalar para construir o índice."
+          }
+        ]
+      },
+      {
+        "group": "Remoto e sessões",
+        "items": [
+          {
+            "pkg": "sshpass",
+            "desc": "Autenticação de senha SSH não interativa — útil para scripts, não para uso diário"
+          },
+          {
+            "pkg": "tmux",
+            "desc": "Multiplexador de terminal — desacoplar sessões, dividir painéis, sobreviver a desconexão"
+          }
+        ]
+      },
+      {
+        "group": "Hardware e baixo nível",
+        "items": [
+          {
+            "pkg": "msr-tools",
+            "desc": "Ler/escrever registos específicos do modelo de CPU (rdmsr, wrmsr)"
+          },
+          {
+            "pkg": "intel-gpu-tools",
+            "desc": "Utilitários de diagnóstico Intel GPU incluindo `intel_gpu_top`"
+          }
+        ]
+      },
+      {
+        "group": "Virtualização",
+        "items": [
+          {
+            "pkg": "libguestfs-tools",
+            "desc": "Inspecionar e modificar imagens de disco VM (virt-ls, virt-cat, guestmount...)"
+          },
+          {
+            "pkg": "chntpw",
+            "desc": "Editar Windows SAM — útil para recuperação de senha em Windows VMs você herda"
+          }
+        ]
+      }
+    ],
+    "actionTitle": "Alguns deles em acção",
+    "noBulkTitle": "Apenas os utilitários instalados pelo ProxMenux são removidos",
+    "noBulkBody": "ProxMenux registra apenas os pacotes utilitários selecionados que ainda não estavam instalados antes desta ação. Desinstalar Otimizações pode purgar esses pacotes mais tarde, enquanto utilitários que já estavam presentes no host são deixados intocados. A atualização geral do sistema APT não é intencionalmente rastreada como reversível porque os pacotes atualizados não têm retorno atômico seguro."
+  },
+  "related": {
+    "heading": "Relacionado",
+    "items": [
+      {
+        "label": "Atualização do sistema Proxmox",
+        "href": "/docs/utils/system-update",
+        "tail": " — reexecuta o ciclo apt update + dist-upgrade a pedido."
+      },
+      {
+        "label": "Instalador de utilitários de sistema",
+        "href": "/docs/utils/system-utils",
+        "tail": " — instalar (ou reinstalar) utilitários individualmente após a pós-instalação."
+      },
+      {
+        "label": "Comandos de atualizações e pacotes",
+        "href": "/docs/help-info/update-commands",
+        "tail": " — Referência apt para a shell."
+      },
+      {
+        "label": "Pós-instalação personalizável",
+        "href": "/docs/post-install/customizable",
+        "tail": " — voltar ao menu superior."
+      }
+    ]
+  }
+}
diff --git a/web/messages/pt/docs/post-install/customizable.json b/web/messages/pt/docs/post-install/customizable.json
new file mode 100644
index 00000000..40afe220
--- /dev/null
+++ b/web/messages/pt/docs/post-install/customizable.json
@@ -0,0 +1,106 @@
+{
+  "meta": {
+    "title": "Script pós-instalação personalizável | Documentação ProxMenux",
+    "description": "Escolha exatamente que otimizações aplicar a um host Proxmox VE com ProxMenux. 10 categorias, cerca de 35 ferramentas e uma interface com caixas de seleção. Inclui tudo do script Automatizado, mais opções de ativação explícita (IOMMU, Fastfetch, Figurine, Ceph, HA, correções AMD…).",
+    "ogTitle": "Script pós-instalação personalizável | Documentação ProxMenux",
+    "ogDescription": "10 categorias, cerca de 35 otimizações individuais. Escolha exatamente o que pretende num host Proxmox VE. As alterações reversíveis são registadas."
+  },
+  "header": {
+    "title": "Script pós-instalação personalizável",
+    "description": "Escolha exatamente que otimizações aplicar a um host Proxmox VE. O ProxMenux agrupa cerca de 35 ferramentas em 10 categorias numa única janela com caixas de seleção. O mesmo motor de Automatizado, com controlo total sobre o que é aplicado.",
+    "section": "Pós-instalação · Personalizável"
+  },
+  "intro": {
+    "title": "Quando escolher Personalizável",
+    "body": "Escolha esta opção se já souber os ajustes que quer ou não quer no host. Uma lista com caixas agrupadas por categoria permite selecionar, desmarcar e combinar otimizações. Pode voltar a aplicá-las mais tarde; as alterações reversíveis são registadas para <link>Desinstalar otimizações</link>. As atualizações de pacotes não são apresentadas como reversíveis."
+  },
+  "compare": {
+    "heading": "Comparação com Automatizado",
+    "body": "Personalizável inclui todo o <link>script Automatizado</link>: as mesmas 14 otimizações de base e várias opções deliberadamente omitidas por Automatizado, úteis em hardware específico (correções AMD), alojamento específico (OVH RTM) ou cargas particulares (IOMMU/VFIO, repositório Ceph, alta disponibilidade, Fastfetch, Figurine, ajuste do ARC ZFS, pigz, instantâneos ZFS automáticos, limites de velocidade vzdump, Open vSwitch, TCP BBR…)."
+  },
+  "categoriesSection": {
+    "heading": "As 10 categorias",
+    "body": "O script Personalizável agrupa as otimizações em 10 categorias numa única janela com caixas de seleção. Cada categoria tem a sua página de documentação: abra um cartão para consultar a justificação, os valores predefinidos e as verificações de cada opção."
+  },
+  "categories": [
+    {
+      "name": "Configurações básicas",
+      "description": "Limpa as fontes APT, executa a atualização oficial Proxmox e define o fuso horário, as definições regionais e utilitários comuns. A base de todas as outras categorias."
+    },
+    {
+      "name": "Sistema",
+      "description": "Ajusta os registos e os limites do kernel para um host com muitas VMs e contentores. Abrange journald, logrotate, sysctl (memória, limites de ficheiros), comportamento em caso de kernel panic e reinícios rápidos."
+    },
+    {
+      "name": "Virtualização",
+      "description": "Prepara o host para virtualização avançada. Instala o agente convidado adequado quando o próprio Proxmox corre numa VM suportada e ativa IOMMU/VFIO para passthrough PCI de GPUs, controladores e TPUs."
+    },
+    {
+      "name": "Rede",
+      "description": "Proteja e ajuste a pilha de rede do host. Força o APT sobre IPv4, aplica proteção sysctl + TCP ajuste de buffer, oferece Open vSwitch, TCP BBR + TCP Fast Open e fixa nomes de interface persistentes por MAC."
+    },
+    {
+      "name": "Armazenamento",
+      "description": "Configure os subsistemas comuns de armazenamento do Proxmox: ZFS Dimensionamento do ARC, ZFS auto-snapshot, ZFS Autotrim para SSD/NVMe pools, e vzdump limites de velocidade para evitar saturar o disco durante backups."
+    },
+    {
+      "name": "Segurança",
+      "description": "Reduz a superfície de ataque exposta por predefinição. Desativa os serviços RPC portmapper/rpcbind de que o Proxmox não precisa mas que deixa à escuta."
+    },
+    {
+      "name": "Personalização",
+      "description": "Altera a aparência e a experiência da shell do host: cores e aliases no bashrc, faixa MOTD e remoção do aviso de subscrição na interface web."
+    },
+    {
+      "name": "Monitoramento",
+      "description": "Integra o host com OVH Real-Time Monitoring. Só instala RTM se o ProxMenux detetar um servidor OVH; nos outros hosts não faz alterações."
+    },
+    {
+      "name": "Desempenho",
+      "description": "Acelerar as operações de compressão (backups, transferências) substituindo o gzip por seu equivalente paralelo pigz."
+    },
+    {
+      "name": "Opcional",
+      "description": "Opções especializadas de que nem todos os hosts precisam: correções CPU AMD, faixa Fastfetch, nome 3D com Figurine, atualização do índice PVE Appliance Manager, repositório Ceph, serviços de alta disponibilidade, Log2RAM para reduzir o desgaste dos SSD e perfil swap ZRAM."
+    }
+  ],
+  "mixTip": {
+    "title": "Misturar automatizado e personalizável",
+    "body": "Um uso comum: execute primeiro <strong>Automatizado</strong> para estabelecer uma base sensata, abra depois <strong>Personalizável</strong> e escolha apenas as opções úteis, como IOMMU para passthrough de GPU. As alterações são registadas separadamente; Desinstalar mostra tudo o que foi aplicado, independentemente da opção usada."
+  },
+  "related": {
+    "heading": "Relacionado",
+    "items": [
+      {
+        "label": "Pós-instalação automatizada",
+        "href": "/docs/post-install/automated",
+        "tail": " — valores predefinidos sensatos aplicados sem perguntas."
+      },
+      {
+        "label": "Desinstalar otimizações",
+        "href": "/docs/post-install/uninstall",
+        "tail": " — reverter de forma limpa as opções selecionadas."
+      },
+      {
+        "label": "Configurações básicas",
+        "href": "/docs/post-install/basic-settings",
+        "tail": " — repositórios, hora, idioma e utilitários."
+      },
+      {
+        "label": "Virtualização",
+        "href": "/docs/post-install/virtualization",
+        "tail": " — IOMMU + VFIO para passagem."
+      },
+      {
+        "label": "Segurança",
+        "href": "/docs/post-install/security",
+        "tailRich": " · <storageLink>Armazenamento</storageLink> · <networkLink>Rede</networkLink> · <customLink>Personalização</customLink> — outras categorias."
+      },
+      {
+        "label": "Visão geral pós-instalação",
+        "href": "/docs/post-install",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/pt/docs/post-install/customization.json b/web/messages/pt/docs/post-install/customization.json
new file mode 100644
index 00000000..b1e35ee1
--- /dev/null
+++ b/web/messages/pt/docs/post-install/customization.json
@@ -0,0 +1,74 @@
+{
+  "meta": {
+    "title": "Pós-instalação: Personalização | Documentação ProxMenux",
+    "description": "Opções de personalização no script pós-instalação personalizável do ProxMenux: prompt bash colorido com aliases úteis, faixa ProxMenux no MOTD e remoção do aviso de subscrição da interface web Proxmox."
+  },
+  "header": {
+    "title": "Após a instalação: personalização",
+    "description": "Ajustes visuais e de utilização do host Proxmox. Melhoram a shell e ocultam o aviso de subscrição na interface web. Bashrc, MOTD e a faixa de subscrição são registados e reversíveis pelo menu Desinstalar.",
+    "section": "Configurações pós-instalação do Proxmox"
+  },
+  "intro": {
+    "title": "O que esta categoria abrange",
+    "body": "Três opções pequenas e independentes: um <strong>prompt bash colorido com aliases</strong> para a shell root, uma <strong>faixa MOTD</strong> de uma linha no acesso SSH e remoção da <strong>janela «Sem subscrição válida»</strong> apresentada a cada acesso à interface web Proxmox."
+  },
+  "bashrc": {
+    "heading": "Personalizar bashrc",
+    "intro": "Insere em <code>/root/.bashrc</code> um bloco com prompt colorido, histórico com data e hora, aliases comuns de <code>ls</code> / <code>grep</code> e um <code>source</code> para o preenchimento automático bash. Torna o trabalho por SSH mais agradável e identifica claramente o host quando tem muitos separadores abertos.",
+    "writesTitle": "O que o ProxMenux adiciona ao .bashrc",
+    "writesOutro": "O bloco é delimitado pelos marcadores <code>PMX_CORE_BASHRC</code>. Voltar a executar o script substitui o bloco anterior sem o duplicar. O <code>.bashrc</code> original é guardado uma vez em <code>/root/.bashrc.bak</code> e acrescenta-se a linha <code>source /root/.bashrc</code> a <code>/root/.bash_profile</code> para aplicar o prompt também nas shells de login, por exemplo após <code>su -</code>.",
+    "rootTitle": "Aplica-se apenas ao root",
+    "rootBody": "A personalização visa o shell da conta root. Outros usuários que você cria no host mantêm seus próprios padrões. Se você administrar o Proxmox exclusivamente na interface web e nunca usar o shell, esta opção é estética pura e você pode pular."
+  },
+  "motd": {
+    "heading": "configurar banner MOTD personalizado",
+    "intro": "Acrescenta <em>\"This system is optimised by: ProxMenux\"</em> ao início de <code>/etc/motd</code>, a mensagem após um acesso SSH bem-sucedido, acima do prompt e antes dos scripts <code>update-motd</code>. Inofensivo e apenas informativo: confirma visualmente que o ProxMenux foi aplicado no host.",
+    "writesTitle": "O que o ProxMenux escreve",
+    "writesOutro": "Em primeiro lugar, ProxMenux registra se <code>/etc/motd</code> existia e armazena seu conteúdo original sob <code>/usr/local/share/proxmenux</code>. A operação é idempotente: se a linha do marcador já está presente, nada é adicionado. Instalações antigas com <code>/etc/motd.bak</code> existentes são migradas para o mesmo estado reversível."
+  },
+  "banner": {
+    "heading": "Remover banner de assinatura",
+    "intro": "Remove o <em>\"Você não tem uma assinatura válida para este servidor\"</em> modal que aparece toda vez que alguém entra na interface web do Proxmox sem uma assinatura corporativa. O patch tem conhecimento de versão: diferentes versões principais do Proxmox têm diferentes pacotes de UI, então o ProxMenux envia para o script certo.",
+    "versionTitle": "Escolha do script conforme a versão",
+    "versionItems": [
+      "<strong>PVE 9.x</strong> → executa <code>remove-banner-pve-v3.sh</code>, que altera <code>proxmoxlib.js</code> para desktop e a nova interface móvel baseada em Yew.",
+      "<strong>PVE 8.x</strong> → executa <code>remove-banner-pve8.sh</code> (somente desktop)."
+    ],
+    "versionOutro": "Antes do patch, o ProxMenux faz backup dos arquivos originais JS/template para <code>/usr/local/share/proxmenux/backups/</code> com um timestamp. O fluxo de desinstalação usa esses backups para restaurar os arquivos originais, e cai de volta para reinstalar os pacotes de UI Proxmox se o backup estiver faltando ou corrompido.",
+    "breakTitle": "Pode quebrar após as atualizações do Proxmox",
+    "breakBody": "As atualizações da interface Proxmox substituem regularmente <code>proxmoxlib.js</code> e podem fazer regressar o aviso. Pode voltar a aplicar a opção para alterar o ficheiro ou aceitar o aviso até lá. O ProxMenux também instala um hook APT que reaplica a alteração após atualizações de pacotes; consulte <link>Desinstalar otimizações</link> para o remover.",
+    "legalTitle": "Nota legal (sempre vale a pena repetir)",
+    "legalBody": "Esta opção só oculta o aviso da interface. <strong>Não</strong> dá suporte Enterprise nem acesso ao repositório Enterprise e não altera a licença do software. O Proxmox VE é distribuído sob GNU AGPLv3. Uma subscrição apoia o projeto e dá acesso ao canal de atualizações Enterprise; escolha o suporte adequado ao seu ambiente."
+  },
+  "verify": {
+    "heading": "Verificação",
+    "intro": "Após a aplicação dos três:",
+    "reversibleTitle": "Todas as três alterações de personalização são monitoradas",
+    "reversibleBody": "<link>Desinstalar otimizações</link> repõe <code>/root/.bashrc</code>, devolve ao MOTD o conteúdo exato anterior ao ProxMenux ou remove o ficheiro se antes não existia e restaura os ficheiros de interface alterados a partir das cópias ou reinstala os pacotes necessários."
+  },
+  "related": {
+    "heading": "Relacionado",
+    "items": [
+      {
+        "label": "Opcional",
+        "href": "/docs/post-install/optional",
+        "tail": " — Fastfetch e Figurine (outras personalizações visuais)."
+      },
+      {
+        "label": "Mostrar informações da versão",
+        "href": "/docs/settings/show-version-information",
+        "tail": " — confirma que as personalizações são seguidas como instaladas."
+      },
+      {
+        "label": "Desinstalar otimizações",
+        "href": "/docs/post-install/uninstall",
+        "tail": " — reverter bashrc, motd e o aviso de subscrição."
+      },
+      {
+        "label": "Pós-instalação personalizável",
+        "href": "/docs/post-install/customizable",
+        "tail": " — voltar ao menu superior."
+      }
+    ]
+  }
+}
diff --git a/web/messages/pt/docs/post-install/index.json b/web/messages/pt/docs/post-install/index.json
new file mode 100644
index 00000000..40f74230
--- /dev/null
+++ b/web/messages/pt/docs/post-install/index.json
@@ -0,0 +1,106 @@
+{
+  "meta": {
+    "title": "Script pós-instalação Proxmox VE — Automatizado e personalizável | ProxMenux",
+    "description": "Visão geral dos scripts pós-instalação ProxMenux para Proxmox VE. Automatizado aplica valores predefinidos sensatos sem perguntas; Personalizável permite escolher exatamente o que pretende em 10 categorias; Desinstalar otimizações repõe as alterações reversíveis suportadas.",
+    "ogTitle": "Script pós-instalação Proxmox VE — Automatizado e personalizável",
+    "ogDescription": "Aplique otimizações comuns após a instalação do Proxmox VE em 10 categorias, automaticamente ou à escolha, com opções reversíveis.",
+    "twitterTitle": "Script pós-instalação Proxmox VE | ProxMenux",
+    "twitterDescription": "Otimizações pós-instalação automatizadas e personalizáveis para Proxmox VE — com opções reversíveis."
+  },
+  "header": {
+    "title": "Scripts pós-instalação",
+    "description": "Configure um host Proxmox VE recém-instalado com as otimizações pós-instalação do ProxMenux. Aplique automaticamente a configuração de base, escolha opções individuais, atualize funções instaladas ou reponha as alterações reversíveis suportadas. As atualizações de pacotes não são apresentadas como reversíveis.",
+    "section": "Configurações pós-instalação do Proxmox"
+  },
+  "intro": {
+    "title": "Para que serve este menu",
+    "body": "Após instalar o Proxmox VE, dezenas de pequenas alterações tornam o host mais rápido e fácil de manter: repositórios sem subscrição, limites sensatos para journald, buffers TCP adequados, armazenamento de registos que protege os SSD, melhorias no bashrc e mais. O ProxMenux automatiza-as e acompanha as alterações de configuração reversíveis suportadas."
+  },
+  "openingMenu": {
+    "heading": "Abrir o menu",
+    "body": "No menu principal do ProxMenux, selecione <strong>Configurações pós-instalação Proxmox</strong>. Você verá isto:",
+    "imageAlt": "Menu de Scripts pós-instalação — Automatizado, Personalizável, o condicional Aplicar Atualizações Disponíveis (somente quando as atualizações estão pendentes) e Desinstalar, seguido da seção de scripts comunitários"
+  },
+  "threeWays": {
+    "heading": "Quatro maneiras de aplicar otimizações",
+    "body": "As quatro entradas ProxMenux compartilham o mesmo código subjacente e o mesmo registro de ferramentas instaladas — elas apenas lhe dão diferentes níveis de controle. A entrada <em>Aplicar atualizações disponíveis</em> só mostra quando pelo menos uma otimização instalada tem uma versão mais recente no disco do que o registrado; em um host recém-aplicado ele permanece oculto."
+  },
+  "routes": [
+    {
+      "title": "Automatizado",
+      "description": "Um conjunto curado de 14 otimizações seguras e sempre úteis aplicadas em sequência com zero prompts. Bom padrão para a maioria dos usuários.",
+      "bullets": [
+        "Repositórios sem subscrição + atualização do sistema",
+        "Memória, kernel, ajuste de rede",
+        "Log2RAM (detectado automaticamente em SSD/NVMe)",
+        "Limites de tamanho para journald + logrotate",
+        "Nomes de interface persistentes"
+      ]
+    },
+    {
+      "title": "Personalizável",
+      "description": "Cerca de 35 otimizações individuais em 10 categorias. Escolhe exatamente quais aplicar. O mesmo motor de Automatizado, com controlo total.",
+      "bullets": [
+        "Interface com caixas de seleção por categoria",
+        "Inclui tudo o que Automatizado faz, mais opções de ativação explícita (IOMMU, Fastfetch, Figurine, Ceph, HA, correções AMD…)",
+        "Executar quantas vezes quiser — as alterações são idempotentes"
+      ]
+    },
+    {
+      "title": "Aplicar atualizações disponíveis",
+      "description": "Quando uma otimização pós-instalação (Log2Ram, definições de memória, Logrotate…) tem uma versão no disco mais recente do que a registada no host, esta entrada mostra apenas as que mudaram. Volta a executar a função correspondente e atualiza o registo, sem tocar em mais nada.",
+      "bullets": [
+        "Aceitação por otimização, apenas as que mudaram",
+        "O mesmo seletor disponível no painel do Monitor",
+        "Uma única notificação agrupada quando chegam novas atualizações"
+      ]
+    },
+    {
+      "title": "Desinstalar otimizações",
+      "description": "Alterações reversíveis suportadas são monitoradas em um registro JSON e emparelhadas com uma função de restauração. Ações sem um retorno seguro, como uma atualização completa do pacote, são intencionalmente excluídas.",
+      "bullets": [
+        "Detecta otimizações aplicadas anteriormente automaticamente",
+        "Escolhe a reversão adequada a cada item: repõe a cópia .bak, se existir, elimina o fragmento de configuração sysctl.d se nada precisava de cópia ou reinstala o pacote original com --force-confnew (por exemplo para o aviso de subscrição)",
+        "Pedido de reinício se necessário (VFIO, nomes persistentes, etc.)"
+      ]
+    }
+  ],
+  "whichTitle": "Qual deve escolher?",
+  "whichBody": "Para uma instalação nova do Proxmox com uma base sensata sem decisões: <autoLink><strong>Automatizado</strong></autoLink>. Se já souber os ajustes que quer ou não quer: <customLink><strong>Personalizável</strong></customLink>. Para atualizar apenas uma otimização já aplicada com versão mais recente no disco: <updatesLink><strong>Aplicar atualizações disponíveis</strong></updatesLink>. Para anular alterações anteriores de forma limpa: <uninstallLink><strong>Desinstalar otimizações</strong></uninstallLink>. Pode combiná-los: comece por Automatizado, adicione opções como Fastfetch ou IOMMU com Personalizável e reverta itens individuais mais tarde.",
+  "mixing": {
+    "heading": "Combinar com outros scripts pós-instalação",
+    "stackTitle": "Não empilhar vários scripts pós-instalação",
+    "stackBody": "Executar vários scripts pós-instalação no mesmo host pode causar arquivos de configuração duplicados, entradas de sysctl conflitantes, ou pior — rede quebrada após reinicialização. Se você já aplicou o <strong>Helper-Scripts Post Install</strong>, algumas otimizações ProxMenux podem se sobrepor ao que ele já configurou. Atenha-se a uma ferramenta pós-instalação por máquina.",
+    "xshokTitle": "xshok-proxmox: desactualizado",
+    "xshokBody": "As versões anteriores do ProxMenux indicavam <a>xshok-proxmox</a> como ferramenta pós-instalação complementar. O projeto está obsoleto e já não é oferecido no ProxMenux. Se uma execução antiga tiver deixado marcadores no host, o ProxMenux continua a detetá-los e avisa. Hoje não é uma ferramenta que deva instalar em conjunto com o ProxMenux."
+  },
+  "community": {
+    "heading": "Scripts da comunidade",
+    "body": "O menu também oferece dois scripts de terceiros do projeto <a>community-scripts</a>: <em>Proxmox VE Post Install</em> e <em>Proxmox VE Microcode</em>. São invólucros que transferem e executam os scripts originais através de <code>wget | bash</code>. Não são mantidos pelo ProxMenux. Consulte <link>Repositórios externos</link> para detalhes e questões de confiança antes de os executar."
+  },
+  "related": {
+    "heading": "Relacionado",
+    "items": [
+      {
+        "label": "Atualização do sistema Proxmox",
+        "href": "/docs/utils/system-update",
+        "tail": " — mantém o host atualizado depois de instalado."
+      },
+      {
+        "label": "Segurança",
+        "href": "/docs/security",
+        "tail": " — Fail2Ban + Lynis além do reforço de segurança pós-instalação."
+      },
+      {
+        "label": "Mostrar informações da versão",
+        "href": "/docs/settings/show-version-information",
+        "tail": " — ver que componentes pós-instalação são rastreados como instalados."
+      },
+      {
+        "label": "Comandos de atualizações e pacotes",
+        "href": "/docs/help-info/update-commands",
+        "tail": " — referência para o apt/pveupgrade."
+      }
+    ]
+  }
+}
diff --git a/web/messages/pt/docs/post-install/monitoring.json b/web/messages/pt/docs/post-install/monitoring.json
new file mode 100644
index 00000000..7340c06f
--- /dev/null
+++ b/web/messages/pt/docs/post-install/monitoring.json
@@ -0,0 +1,56 @@
+{
+  "meta": {
+    "title": "Pós-instalação: Monitorização | Documentação ProxMenux",
+    "description": "Opções de monitoramento no script de pós-instalação personalizável ProxMenux. Atualmente uma única opção: instalar OVH Real-Time Monitoring (RTM), que só se ativa se o host for detectado como um servidor OVH."
+  },
+  "header": {
+    "title": "Após a instalação: monitorização",
+    "description": "Opções de monitoramento dentro do script pós-instalação personalizável. Esta categoria é pequena e específica do provedor — instala o agente OVH Real-Time Monitoring em servidores OVH dedicados e não faz nada em nenhum outro lugar.",
+    "section": "Configurações pós-instalação do Proxmox"
+  },
+  "intro": {
+    "title": "Âmbito intencionalmente limitado",
+    "body": "A monitorização pós-instalação limita-se a <strong>um agente específico de um fornecedor</strong>. Ferramentas gerais (Prometheus, Grafana, node_exporter) ficam fora deste âmbito, pois exigem decisões de arquitetura — host separado, retenção de dados e destinos de alertas — que não cabem num passo com um clique. O ProxMenux Monitor, incluído no ProxMenux, cobre grande parte dessa função sem agentes externos."
+  },
+  "ovh": {
+    "heading": "Instalar o Monitoramento em Tempo Real OVH (RTM)",
+    "intro": "Se o host Proxmox for um servidor dedicado alugado à <a>OVHcloud</a>, pode ativar o RTM para apresentar telemetria de hardware (temperatura da CPU, estado da fonte de alimentação, SMART dos discos, estado do controlador RAID, etc.) no painel de controlo OVH. É o mesmo agente usado pela OVH na função «Server Monitoring».",
+    "decisionsTitle": "Como ProxMenux decide",
+    "decisionsItems": [
+      "Obtém o IP público do host via <code>curl ipinfo.io/ip</code>.",
+      "Procura o ISP proprietário com uma consulta <code>whois</code> para <code>v4.whois.cymru.com</code>.",
+      "Se o resultado mencionar OVH, transfere <code>last-public-ovh-infra-yak.snap.mirrors.ovh.net/yak/archives/apply.sh</code> e passa-o para <code>bash</code> com o manifesto Puppet do RTM v2.",
+      "Se o resultado <em>não</em> mencionar OVH, nada é instalado. A opção não faz alterações."
+    ],
+    "remoteTitle": "Script remoto passado para bash através de um pipe",
+    "remoteBody": "A instalação executa <code>wget -qO - https://…apply.sh | bash</code>. Se o espelho OVH for comprometido, o script corre como root no host. Antes de ativar a opção, pondere a confiança na cadeia de espelhos OVH face ao benefício da monitorização. Para a maioria dos utilizadores domésticos ou fora da OVH, a opção deve ficar desativada.",
+    "noOpTitle": "Só activar se a máquina estiver em OVH",
+    "noOpBody": "A opção não altera servidores fora da OVH, pelo que selecioná-la num Proxmox doméstico não causa problemas. Num host não OVH, o script mostra <em>«Não é um servidor OVH, a instalação RTM será ignorada»</em> e termina sem instalar pacotes.",
+    "runsTitle": "O que o ProxMenux executa",
+    "verifyTitle": "Verificação",
+    "verifyBody": "Em um host OVH real, após uma reinicialização você deve ver o painel <a>RTM</a> em seu OVH Manager povoado com dados ao vivo para o host. No lado Proxmox, o coletor RTM é um serviço systemd — verifique-o diretamente:",
+    "troubleTitle": "Resolução de Problemas",
+    "revertTitle": "Remover RTM pelo menu Desinstalar",
+    "revertBody": "Quando RTM está registado como instalado, Desinstalar otimizações oferece uma entrada OVH Real-Time Monitoring. Executa <code>apt-get purge -y ''ovh-rtm*'' ''rtm'' ''rtm-*''</code>, remove /etc/rtm e marca RTM como desinstalado. Os artefactos Puppet podem precisar de limpeza manual; reveja os manifestos específicos do RTM em <code>/etc/puppet/</code>. Num host fora da OVH não foram instalados pacotes RTM, pelo que nada há a remover."
+  },
+  "related": {
+    "heading": "Relacionado",
+    "items": [
+      {
+        "label": "ProxMenux Monitor",
+        "href": "/docs/settings/proxmenux-monitor",
+        "tail": " — painel web local para o host (funciona em qualquer fornecedor, não apenas OVH)."
+      },
+      {
+        "label": "Comandos úteis do sistema",
+        "href": "/docs/help-info/system-commands",
+        "tail": " — referência de monitorização do host local."
+      },
+      {
+        "label": "Pós-instalação personalizável",
+        "href": "/docs/post-install/customizable",
+        "tail": " — voltar ao menu superior."
+      }
+    ]
+  }
+}
diff --git a/web/messages/pt/docs/post-install/network.json b/web/messages/pt/docs/post-install/network.json
new file mode 100644
index 00000000..62519fc4
--- /dev/null
+++ b/web/messages/pt/docs/post-install/network.json
@@ -0,0 +1,128 @@
+{
+  "meta": {
+    "title": "Pós-instalação: Rede | Documentação ProxMenux",
+    "description": "Opções de rede do script de pós-instalação personalizável ProxMenux: forçar APT por IPv4, aplicar um perfil sysctl selecionado, instalar Open vSwitch, ativar TCP BBR + Fast Open e associar os nomes das interfaces aos seus endereços MAC."
+  },
+  "header": {
+    "title": "Pós-instalação: Rede",
+    "section": "Configurações pós-instalação do Proxmox"
+  },
+  "intro": {
+    "title": "O que esta categoria abrange",
+    "body": "Cinco opções de rede independentes. Duas são simples (<strong>APT por IPv4</strong>, <strong>instalação do Open vSwitch</strong>), duas ajustam o comportamento TCP (<strong>perfil sysctl de rede</strong>, <strong>BBR + Fast Open</strong>) e uma resolve um problema comum: <strong>fixar os nomes das interfaces</strong> para que uma nova placa de rede ou atualização do BIOS não mude <code>enp3s0</code> para <code>enp4s0</code> e interrompa as pontes."
+  },
+  "ipv4": {
+    "heading": "Forçar o APT a usar IPv4",
+    "intro": "Escreve <code>Acquire::ForceIPv4 \"true\";</code> para <code>/etc/apt/apt.conf.d/99-force-ipv4</code>. APT então se recusa a usar IPv6 para downloads de pacotes, mesmo que o host tenha conectividade IPv6.",
+    "tipTitle": "Quem beneficia",
+    "tipBody": "Útil se a ligação IPv6 for instável, mais lenta que IPv4 ou se o espelho Debian/Proxmox falhar ocasionalmente por IPv6. Não causa problemas em hosts sem IPv6. Numa rede de pilha dupla funcional, torna o comportamento previsível: apt não o surpreende com um tempo limite de IPv6."
+  },
+  "sysctl": {
+    "heading": "Aplicar otimizações de rede",
+    "intro": "Escreve um perfil sysctl selecionado em <code>/etc/sysctl.d/99-network.conf</code>: buffers de sockets do kernel, reforço do ICMP, proteção básica contra falsificação de endereços e tamanhos de buffers TCP adequados a um hipervisor com muitos fluxos simultâneos.",
+    "tunedTitle": "O que é ajustado",
+    "headerArea": "Área",
+    "headerSettings": "Principais definições",
+    "rows": [
+      {
+        "area": "Buffers de sockets do kernel",
+        "settings": "<code>netdev_max_backlog=8192</code>, <code>rmem_max=16M</code>, <code>wmem_max=16M</code>, <code>somaxconn=8192</code>"
+      },
+      {
+        "area": "Endurecimento do ICMP",
+        "settings": "<code>icmp_echo_ignore_broadcasts=1</code>, <code>icmp_ignore_bogus_error_responses=1</code>"
+      },
+      {
+        "area": "Segurança de roteamento",
+        "settings": "<code>accept_redirects=0</code>, <code>accept_source_route=0</code>, <code>secure_redirects=0</code>, <code>send_redirects=0</code>, <code>log_martians=0</code>"
+      },
+      {
+        "area": "Filtro de caminho inverso",
+        "settings": "<code>rp_filter=2</code> (modo solto, ver nota abaixo)"
+      },
+      {
+        "area": "TCP",
+        "settings": "<code>tcp_mtu_probing=1</code>, <code>tcp_rfc1337=1</code>, <code>tcp_sack=1</code>, <code>tcp_rmem=8K/87K/16M</code>, <code>tcp_wmem=8K/64K/16M</code>"
+      },
+      {
+        "area": "Portas",
+        "settings": "<code>ip_local_port_range=1024 65535</code> (conjunto de portas efémeras)"
+      },
+      {
+        "area": "Soquetes Unix",
+        "settings": "<code>net.unix.max_dgram_qlen=4096</code>"
+      }
+    ],
+    "sourceOutro": "Ele também adiciona <code>source /etc/network/interfaces.d/*</code> ao <code>/etc/network/interfaces</code> se ainda não estiver presente — prática padrão para que você possa soltar trechos de interface modular sem editar o arquivo principal.",
+    "fwbrTitle": "Ajuste automático de pontes de firewall virtuais",
+    "fwbrBody": "Além do perfil sysctl, o ProxMenux instala o script auxiliar <code>/usr/local/sbin/proxmenux-fwbr-tune</code>, que aplica <code>rp_filter=0</code> e <code>log_martians=0</code> às interfaces <code>fwbr*</code> / <code>fwln*</code> / <code>fwpr*</code> / <code>tap*</code> criadas pelo Proxmox para VMs e contentores. A unidade de execução única <code>proxmenux-fwbr-tune.service</code> chama-o no arranque, e a regra <code>/etc/udev/rules.d/99-zz-proxmenux-fwbr-tune.rules</code> a cada evento <code>net add</code> com esses prefixos. Abrange assim interfaces recriadas ao iniciar/parar VMs, reiniciar e migrar em funcionamento. O script também processa as interfaces já presentes imediatamente após a instalação.",
+    "rpFilterTitle": "Porquê rp_filter=2 (permissivo) em vez de 1 (estrito)",
+    "rpFilterBody": "A filtragem estrita do caminho inverso descarta pacotes cuja origem seria alcançada por uma interface <em>diferente</em>. É uma predefinição adequada a clientes, mas problemática num host Proxmox onde o tráfego das VMs chega frequentemente por uma ponte e sai por um uplink com rotas assimétricas. <code>rp_filter=2</code> (permissivo) só descarta pacotes com origens realmente inalcançáveis pelo encaminhamento. É um compromisso: reduz ligeiramente a deteção de falsificação de IP local para preservar a rede das VMs."
+  },
+  "ovs": {
+    "heading": "Instalar Open vSwitch",
+    "intro": "Instala <code>openvswitch-switch</code> + <code>openvswitch-common</code>. Os pacotes acrescentam OVS como alternativa às pontes Linux predefinidas do Proxmox. A instalação por si só não altera a rede: as pontes <code>vmbrX</code> existentes continuam a funcionar. Ao <em>criar</em> uma nova ponte na interface Proxmox, pode escolher OVS na lista de tipos.",
+    "tipTitle": "Quando a OVS faz sentido",
+    "tipBody": "Considere OVS se precisar de <strong>trunks VLAN com IDs não contíguos</strong>, <strong>LACP com LLDP em modos específicos</strong>, <strong>programação detalhada de fluxos</strong> (OpenFlow) ou interoperabilidade com controladores SDN. Num laboratório doméstico com poucas VLANs e um único uplink LACP, pontes Linux + <code>vmbrX.VID</code> são mais simples e adequadas.",
+    "revertTitle": "Reversível do menu Desinstalar",
+    "revertBody": "OVS fica registado. <link>Desinstalar otimizações</link> executa <code>apt purge</code> em <code>openvswitch-switch</code> e <code>openvswitch-common</code>. Migre as pontes OVS para pontes Linux <em>antes</em> de desinstalar; caso contrário, as VMs nessas pontes perderão a rede no próximo arranque. Equivalente manual:"
+  },
+  "bbr": {
+    "heading": "Ativar TCP BBR + TCP Fast Open",
+    "intro": "Escreve dois ficheiros sysctl e recarrega-os. BBR substitui CUBIC pelo algoritmo de congestionamento da Google baseado em largura de banda, que lida melhor com ligações de alta capacidade e latência ou com perdas. TCP Fast Open (TFO) elimina uma ida e volta nas ligações TCP repetidas enviando dados no SYN.",
+    "verifyTitle": "Verificação",
+    "impactTitle": "O impacto depende da carga de trabalho",
+    "impactBody": "BBR destaca-se em ligações de alta latência ou com perdas (replicação intercontinental, túneis VPN, clientes móveis). Numa LAN entre duas máquinas no mesmo switch, a diferença costuma ficar nas variações de medição. TFO ajuda sobretudo em ligações HTTP curtas e repetidas.",
+    "revertTitle": "Reversível do menu Desinstalar",
+    "revertBody": "BBR/TFO ficam registados. <link>Desinstalar otimizações</link> remove os dois ficheiros sysctl (<code>/etc/sysctl.d/99-kernel-bbr.conf</code> e <code>99-tcp-fastopen.conf</code>) e recarrega a configuração restante. Eliminar um ficheiro não repõe os valores ativos do kernel. As predefinições como <code>cubic</code> e <code>tcp_fastopen=1</code> regressam após reiniciar, salvo se outra configuração as substituir. Equivalente manual:"
+  },
+  "names": {
+    "heading": "Nomes de interfaces persistentes",
+    "intro": "Percorre as placas de rede físicas do host, excluindo loopback, veths Docker, pontes, dispositivos TAP, bonds, Cilium, ZeroTier e WireGuard. Escreve um ficheiro systemd <code>.link</code> que associa o nome atual ao endereço MAC atual. A associação MAC passa a prevalecer sobre a lógica de nomes do kernel.",
+    "whyTitle": "Por que isso importa?",
+    "whyItems": [
+      "Adicionar ou remover dispositivos PCIe pode mudar a numeração do barramento, transformando <code>enp3s0</code> em <code>enp4s0</code>. Se <code>/etc/network/interfaces</code> mencionar o nome antigo, a ponte desaparece ao reiniciar.",
+      "As atualizações de BIOS / firmware às vezes alteram como os dispositivos enumeram, com o mesmo efeito.",
+      "O script escreve ficheiros <code>.link</code> para as placas físicas, incluindo as portas dos bonds, com o MAC indicado pelo sysfs nesse momento; nas portas de um bond pode ser o MAC partilhado do bond, por isso verifique os nomes após reiniciar. Ignora interfaces virtuais, como veths LXC e os próprios dispositivos bond; não corrige condições de corrida nos nomes de placas virtuais <code>hotplug</code>."
+    ],
+    "writtenTitle": "O que é escrito",
+    "writtenIntro": "Um ficheiro por NIC físico, em <code>/etc/systemd/network/10-proxmenux-&lt;iface&gt;.link</code>. Cada arquivo começa com o cabeçalho <code># Managed by ProxMenux — do not edit</code> para que ProxMenux possa distinguir seus próprios arquivos de arquivos <code>.link</code> fornecidos pelo usuário ou pacote.",
+    "writtenOutro": "Os ficheiros <code>.link</code> de outros pacotes ou escritos pelo utilizador são preservados; só os que têm o cabeçalho ProxMenux são geridos. Em cada nova execução, a função verifica os seus ficheiros: relê <code>MACAddress=</code> de cada <code>10-proxmenux-*.link</code> e remove os que têm uma MAC ausente de <code>/sys/class/net/</code>. Os ficheiros de versões anteriores no formato <code>10-&lt;iface&gt;.link</code> são migrados automaticamente na primeira execução.",
+    "pveTitle": "PVE 9 vs PVE 8",
+    "pveBody": "O script usa ficheiros systemd <code>.link</code> para os nomes persistentes. No Proxmox VE 9 também recarrega as regras udev após os escrever, para que uma placa já fixada que volte a ser ligada ou detetada aplique a sua regra sem reiniciar. Verifique as interfaces existentes após reiniciar tanto no PVE 8 como no PVE 9. Isto não substitui <code>ifupdown2</code> no host. Em ambos os casos, o script assinala a necessidade de reinício na pós-instalação personalizável.",
+    "reviewTitle": "Reveja primeiro o /etc/network/interfaces existente",
+    "reviewBody": "Se a configuração antiga em <code>/etc/network/interfaces</code> usa nomes de placas gerados pelo kernel, fixar os nomes <em>atuais</em> é o resultado pretendido. Se já adaptou manualmente a configuração a nomes específicos, confirme antes de reiniciar que os nomes fixados correspondem ao ficheiro interfaces.",
+    "revertTitle": "Reversível do menu Desinstalar",
+    "revertBody": "<link>Desinstalar otimizações</link> elimina apenas os ficheiros <code>10-proxmenux-*.link</code> com cabeçalho ProxMenux de <code>/etc/systemd/network/</code>. Preserva todos os ficheiros <code>.link</code> do utilizador ou de outros pacotes. No próximo reinício regressa o comportamento de nomes predefinido do systemd."
+  },
+  "related": {
+    "heading": "Relacionado",
+    "items": [
+      {
+        "label": "Gerenciamento de rede",
+        "href": "/docs/network",
+        "tail": " — diagnóstico, análise da ponte, reparação guiada."
+      },
+      {
+        "label": "Nomes de interface persistentes",
+        "href": "/docs/network/persistent-names",
+        "tail": " — a mesma função num menu próprio para mais tarde; use uma das opções, não ambas."
+      },
+      {
+        "label": "Referência de comandos de rede",
+        "href": "/docs/help-info/network-commands",
+        "tail": " — ip, ss, ethtool, sysctl."
+      },
+      {
+        "label": "Desinstalar otimizações",
+        "href": "/docs/post-install/uninstall",
+        "tail": " — reverte qualquer uma destas alterações de rede."
+      },
+      {
+        "label": "Pós-instalação personalizável",
+        "href": "/docs/post-install/customizable",
+        "tail": " — voltar ao menu superior."
+      }
+    ]
+  }
+}
diff --git a/web/messages/pt/docs/post-install/optional.json b/web/messages/pt/docs/post-install/optional.json
new file mode 100644
index 00000000..923883d7
--- /dev/null
+++ b/web/messages/pt/docs/post-install/optional.json
@@ -0,0 +1,177 @@
+{
+  "meta": {
+    "title": "Pós-instalação ProxMenux: Configurações opcionais",
+    "description": "Guia de configurações opcionais no script pós-instalação ProxMenux para recursos e otimizações adicionais Proxmox VE.",
+    "ogTitle": "Pós-instalação ProxMenux: Configurações opcionais",
+    "ogDescription": "Guia de configurações opcionais no script pós-instalação ProxMenux para recursos e otimizações adicionais Proxmox VE.",
+    "ogImageAlt": "Configurações opcionais da pós-instalação ProxMenux"
+  },
+  "title": "Configurações Opcionais",
+  "intro": "A categoria <strong>Configurações opcionais</strong> oferece funções e otimizações adicionais para Proxmox VE. Não são essenciais, mas podem melhorar as capacidades do sistema em situações específicas.",
+  "available": "Funções opcionais disponíveis",
+  "stepLabel": "Etapa",
+  "ceph": {
+    "title": "Adicionar suporte mais recente ao Ceph",
+    "intro": "Esta opção instala o mais recente suporte ao sistema de armazenamento Ceph para Proxmox VE. O Ceph é um sistema de armazenamento distribuído que oferece alto desempenho, confiabilidade e escalabilidade.",
+    "doesIntro": "O que faz:",
+    "doesItems": [
+      "Adiciona o repositório Ceph ao seu sistema",
+      "Atualiza as listas de pacotes",
+      "Instala pacotes Ceph usando o comando 'pveceph install'",
+      "Verifica a instalação"
+    ],
+    "howUse": "Como usar: Após a instalação, você pode configurar e gerenciar o armazenamento Ceph usando a interface web Proxmox VE ou ferramentas de linha de comando.",
+    "automates": "Este ajuste automatiza os seguintes comandos:"
+  },
+  "amd": {
+    "title": "Aplicar correções AMD CPU",
+    "intro": "Esta opção aplica correções específicas para CPUs AMD EPYC e Ryzen para melhorar a estabilidade e compatibilidade.",
+    "doesIntro": "O que faz:",
+    "doesItems": [
+      "Detecta se está presente um AMD EPYC ou Ryzen CPU",
+      "Aplica o parâmetro 'idle=nomwait' para evitar falhas aleatórias (via /etc/kernel/cmdline em máquinas systemd-boot, ou /etc/default/grub em máquinas GRUB — com um .bak do original)",
+      "Configura o KVM para ignorar certos MSRs (registos específicos do modelo) e melhorar a compatibilidade com máquinas virtuais Windows."
+    ],
+    "howUse": "Como usar: Estas correções são aplicadas automaticamente e requerem uma reinicialização do sistema para fazer efeito.",
+    "automates": "Este ajuste automatiza os seguintes comandos:"
+  },
+  "ha": {
+    "title": "Habilitar serviços de alta disponibilidade",
+    "intro": "Esta opção permite serviços de Alta Disponibilidade (HA) em Proxmox VE, permitindo failover automático de VMs e contêineres em caso de falha de nó.",
+    "doesIntro": "O que faz:",
+    "doesItems": [
+      "Activa e inicia o serviço pve-ha-lrm (Local Resource Manager)",
+      "Activa e inicia o serviço pve-ha-crm (Cluster Resource Manager)",
+      "Activa e inicia o serviço corosync para comunicação de clusters"
+    ],
+    "howUse": "Como usar: Depois de ativar esses serviços, você pode configurar grupos e recursos HA na interface web Proxmox VE.",
+    "automates": "Este ajuste automatiza os seguintes comandos:"
+  },
+  "pveam": {
+    "title": "Atualizar Proxmox VE Appliance Manager",
+    "intro": "Atualiza o índice local dos modelos de contentores apresentado pelo <code>pveam</code> no Proxmox, para que a lista de modelos de software esteja atualizada ao criar o próximo LXC.",
+    "doesIntro": "O que faz:",
+    "doesItems": [
+      "Executa <code>pveam update</code> nos espelhos Proxmox para obter o catálogo atual de modelos de software",
+      "Preenche a lista de modelos de software apresentada ao criar um contentor"
+    ],
+    "howUse": "Utilização: execute se a lista de modelos na interface parecer desatualizada ou após mudar de espelho. Transfere apenas o índice do catálogo, não os próprios modelos.",
+    "automates": "Este ajuste automatiza o seguinte comando:"
+  },
+  "fastfetch": {
+    "title": "Instalar e Configurar o Fastfetch",
+    "intro": "Esta opção instala silenciosamente e configura Fastfetch, uma ferramenta de informação do sistema que exibe especificações do sistema e um logotipo personalizado no login.",
+    "doesLabel": "O que faz:",
+    "doesItems": [
+      "Silenciosamente baixa e instala a versão mais recente do Fastfetch",
+      "Permite-lhe escolher um logotipo personalizado (<strong>ProxMenux, Proxmox, Helper-Scripts, Home-Labs-Club, Proxmology</strong>, ou um personalizado)",
+      "Configura Fastfetch para exibir <em>\"Sistema otimizado por ProxMenux\"</em>",
+      "Configura o Fastfetch para executar automaticamente no login do console"
+    ],
+    "importantLabel": "Importante:",
+    "importantBody": "Se você se conectar ao Proxmox via SSH, você deve selecionar o logotipo <strong>Proxmox</strong> ou criar um personalizado usando <code>jp2a</code> ou <code>img2txt</code>. Os outros logotipos são gerados usando <code>chafa</code> e podem não exibir corretamente em uma sessão padrão SSH.",
+    "customLabel": "Logótipos personalizados:",
+    "customBody1": "Para usar um logotipo personalizado, coloque seu arquivo de texto de arte ASCII em: <code>/usr/local/share/fastfetch/logos/</code>",
+    "customBody2": "Você pode criar logotipos personalizados usando ferramentas como <code>chafa</code>, <code>jp2a</code>, ou <code>img2txt</code>.",
+    "customBody3": "Para melhores resultados:",
+    "customItems": [
+      "Limite a altura do logótipo a 35 linhas para manter as proporções e caber no terminal",
+      "Use <code>chafa</code> para logotipos de cores (pode não exibir corretamente em sessões de SSH)",
+      "Use <code>jp2a</code> ou <code>img2txt</code> para logotipos compatíveis com SSH"
+    ],
+    "examplesLabel": "Logotipos de Exemplo:",
+    "logos": [
+      {
+        "name": "ProxMenux",
+        "alt": "Logótipo do ProxMenux",
+        "src": "https://macrimi.github.io/ProxMenux/fastfetch/proxmenux.png"
+      },
+      {
+        "name": "Proxmox",
+        "alt": "Logótipo do Proxmox",
+        "src": "https://macrimi.github.io/ProxMenux/fastfetch/proxmox.png"
+      },
+      {
+        "name": "JC Channel",
+        "alt": "Logótipo do JC Channel",
+        "src": "/fastfetch/jc-channel.png"
+      },
+      {
+        "name": "Helper-Scripts",
+        "alt": "Logótipo do Helper-Scripts",
+        "src": "https://macrimi.github.io/ProxMenux/fastfetch/helper-scripts.png"
+      },
+      {
+        "name": "Home-Labs-Club",
+        "alt": "Logótipo do Home-Labs-Club",
+        "src": "https://macrimi.github.io/ProxMenux/fastfetch/home-labs-club.png"
+      },
+      {
+        "name": "Proxmology",
+        "alt": "Logótipo Proxmology",
+        "src": "https://macrimi.github.io/ProxMenux/fastfetch/proxmology.png"
+      }
+    ],
+    "automates": "Este ajuste automatiza os seguintes comandos:"
+  },
+  "figurine": {
+    "title": "Instalar e Configurar Figurine",
+    "intro": "Esta opção instala e configura o Figurine, uma ferramenta que cria banners de texto elegantes ASCII para o seu terminal, exibindo o seu nome de máquina em um formato 3D visualmente atraente.",
+    "doesLabel": "O que faz:",
+    "doesItems": [
+      "Descarrega e instala o Figurine v2.1.1 a partir do GitHub para a arquitetura do host (AMD64, ARM64 ou ARMv7)",
+      "Cria uma mensagem de boas- vindas que mostra o seu nome de máquina na arte ASCII 3D quando você entra",
+      "Atualiza o binário existente do Figurine após concluir a transferência e a extração com sucesso",
+      "Configura a mensagem de boas- vindas a executar automaticamente na autenticação"
+    ],
+    "practicalLabel": "Uso prático:",
+    "practicalBody": "Ao gerenciar vários nós Proxmox em um cluster, o Figurine fornece uma indicação visual imediata de qual nó você está conectado atualmente. Isso ajuda a prevenir comandos acidentais no nó errado e melhora seu fluxo de trabalho ao gerenciar vários servidores.",
+    "exampleLabel": "Resultado do Exemplo:",
+    "imageAlt": "Saída de Exemplo Figurine",
+    "automates": "Este ajuste automatiza o seguinte processo:",
+    "outro": "Após a instalação, você verá seu hostname exibido na arte ASCII 3D cada vez que você entrar, deixando imediatamente claro em que nó Proxmox você está trabalhando."
+  },
+  "log2ram": {
+    "title": "Instalar Log2RAM (redução do desgaste de SSD/NVMe)",
+    "intro": "Log2RAM monta <code>/var/log</code> num ramdisk tmpfs e sincroniza-o periodicamente para disco. Guardar temporariamente na RAM as escritas frequentes do journald pode reduzir desgaste SSD e E/S. A sincronização e o encerramento normal guardam os registos; um corte abrupto pode perder entradas desde a última sincronização.",
+    "upstreamLabel": "Projeto a montante:",
+    "upstreamUrl": "https://github.com/azlux/log2ram",
+    "upstreamLinkLabel": "azlux/log2ram em GitHub",
+    "doesLabel": "O que o ProxMenux faz:",
+    "doesItems": [
+      "Detecta se o disco raiz é SSD/NVMe lendo <code>/sys/block/&lt;dev&gt;/queue/rotational</code>. Em um disco rotacional o fluxo automatizado pede primeiro antes de instalar.",
+      "Clona o repositório original (<code>azlux/log2ram</code>) para <code>/tmp/log2ram</code> e modifica <code>install.sh</code>, substituindo <code>rsync -aAXv</code> por <code>rsync -aXv --no-acls</code>. Evita o erro <em>set_acl: Operation not supported</em> com código de saída 23, gerado pelo script original ao mover /var/log em sistemas sem ACL. A unidade systemd <code>log2ram</code> é ativada após instalação.",
+      "Dimensiona o ramdisk pela RAM do host: <code>≤ 8 GB → 128M</code>, <code>≤ 16 GB → 256M</code>, <code>&gt; 16 GB → 512M</code>. Escreve o valor em <code>SIZE=</code> de <code>/etc/log2ram.conf</code>.",
+      "Agenda uma sincronização periódica do disco via <code>/etc/cron.d/log2ram</code>: a cada 1h / 3h / 6h de acordo com o mesmo nível RAM.",
+      "Instala <code>/usr/local/bin/log2ram-check.sh</code>, executado a cada 10 minutos por <code>/etc/cron.d/log2ram-auto-sync</code>. Quando <code>/var/log</code> chega a 80% do ramdisk, limpa journals antigos. Aos 92%, executa primeiro <code>logrotate -f /etc/logrotate.d/proxmox-backup-api</code> se o ficheiro existir: os registos API PBS costumam ocupar mais espaço num host PBS. Depois trunca <code>pveproxy access/error</code> e <code>pveam.log</code> antes de sincronizar. <code>log2ram write</code> apenas copia tmpfs para disco, sem o reduzir. A proteção ajuda a evitar falhas PVE com <em>No space left on device</em> por crescimento descontrolado dos registos.",
+      "Deteta o serviço <code>proxmox-backup-server</code> no host. Se existir, cria <code>/etc/logrotate.d/proxmox-backup-api</code> (20 MB × 3 rotações) e <code>/etc/cron.hourly/proxmox-backup-logrotate</code> para limitar os registos API PBS, fonte habitual de crescimento, mesmo entre sincronizações Log2RAM. Sem PBS não altera nada.",
+      "Ajusta os limites systemd-journald (<code>SystemMaxUse</code>, <code>RuntimeMaxUse</code>) ao ramdisk para que uma rajada de registos não o encha.",
+      "Fica registado em <code>installed_tools.json</code> para poder ser revertido em Desinstalar otimizações."
+    ],
+    "howUseLabel": "Como utilizar:",
+    "howUseBody": "O percurso automatizado instala Log2RAM sem intervenção se detetar disco raiz SSD/NVMe. O personalizável pergunta tamanho, intervalo e ativação da proteção. A pergunta indica 90%, mas o script gerado usa os limiares de limpeza de 80% e intensiva de 92% descritos acima.",
+    "verifyLabel": "Verificar e gerenciar a partir da shell:",
+    "verifyCode": "# Service state and configured timers\nsystemctl status log2ram\nsystemctl list-timers log2ram*\n\n# Current ramdisk usage — /var/log IS the tmpfs itself\ndf -h /var/log\n\n# Force a sync now (tmpfs → disk); does NOT shrink the tmpfs\nlog2ram write\n\n# Trigger the auto-sync guard on demand (vacuum + sync when usage is high)\n/usr/local/bin/log2ram-check.sh\n\n# Current config: SIZE, mail settings, path\ncat /etc/log2ram.conf\n\n# ProxMenux-specific cron jobs\ncat /etc/cron.d/log2ram /etc/cron.d/log2ram-auto-sync\n\n# Recent Log2RAM activity\njournalctl -u log2ram -n 50 --no-pager"
+  },
+  "zram": {
+    "title": "Habilitar perfil de troca ZRAM",
+    "intro": "Cria um dispositivo swap comprimido em RAM, <code>/dev/zram0</code>, com <code>systemd-zram-generator</code>. As páginas movidas pelo kernel para swap são comprimidas com zstd e mantidas em memória antes de usar swap em disco.",
+    "doesLabel": "O que faz:",
+    "doesItems": [
+      "Instala <code>systemd-zram-generator</code> se estiver faltando, e registra se ProxMenux o instalou.",
+      "Escreve <code>/etc/systemd/zram-generator.conf.d/90-proxmenux.conf</code>: um dispositivo <code>zram0</code> de um décimo da RAM do host, compressão zstd (<code>zstd(level=9)</code> com systemd-zram-generator 1.2.0 ou posterior) e prioridade swap 32767.",
+      "Com essa prioridade, o kernel preenche primeiro o ZRAM. Uma troca existente no disco mantém sua própria prioridade e leva as páginas que já não se encaixam no ZRAM.",
+      "Antes de mudar qualquer coisa, procura outra configuração ZRAM: uma troca zram ativa, uma linha zram em <code>/etc/fstab</code>, uma unidade systemd ou outro arquivo gerador. Se encontrar uma, a opção pára e deixa essa configuração como está.",
+      "Inicia o <code>dev-zram0.swap</code> e verifica se o dispositivo ativo corresponde ao perfil. Caso contrário, o estado anterior é restaurado.",
+      "Fica registado em <code>installed_tools.json</code> para poder ser revertido em Desinstalar otimizações."
+    ],
+    "howUseLabel": "Como utilizar:",
+    "howUseBody": "A opção só existe no percurso personalizável, não no automatizado. O dispositivo é recriado em cada arranque. Enquanto estiver ativo, o painel Memória do ProxMenux Monitor mostra capacidade, swap utilizado, algoritmo, relação de compressão e memória física ocupada.",
+    "verifyLabel": "Verificar a partir do shell:",
+    "verifyCode": "# Active swap devices and their priority\nswapon --show\n\n# ZRAM device: algorithm, size and compressed data\nzramctl\n\n# Profile written by ProxMenux\ncat /etc/systemd/zram-generator.conf.d/90-proxmenux.conf\n\n# State of the swap unit\nsystemctl status dev-zram0.swap"
+  },
+  "autoApplication": {
+    "title": "Aplicação automática",
+    "body": "No percurso personalizável, selecione as funções conforme as necessidades. Log2RAM também integra o automatizado com deteção de hardware; ZRAM é exclusivo do personalizável. Consulte cada secção para confirmações e requisitos."
+  }
+}
diff --git a/web/messages/pt/docs/post-install/performance.json b/web/messages/pt/docs/post-install/performance.json
new file mode 100644
index 00000000..40508128
--- /dev/null
+++ b/web/messages/pt/docs/post-install/performance.json
@@ -0,0 +1,61 @@
+{
+  "meta": {
+    "title": "Pós-instalação: Desempenho | Documentação ProxMenux",
+    "description": "Opções de desempenho no script pós-instalação personalizável do ProxMenux. Substitui o gzip de uma só thread pelo pigz (gzip paralelo) para acelerar cópias de segurança e compressão em hosts com vários núcleos."
+  },
+  "header": {
+    "title": "Após a instalação: desempenho",
+    "description": "Opções de desempenho do script pós-instalação Personalizável. Esta categoria contém uma só otimização: substituir gzip por pigz para que as cópias de segurança e a compressão usem todos os núcleos da CPU em vez de um.",
+    "section": "Configurações pós-instalação do Proxmox"
+  },
+  "intro": {
+    "title": "O que esta categoria abrange",
+    "body": "A única opção de desempenho aqui redireciona o gzip para uma implementação paralela. Os outros ajustes de desempenho (memória, escalonamento de E/S, tamanho do ARC ZFS, limites do kernel) ficam nas respetivas categorias (<em>Sistema</em>, <em>Armazenamento</em>), pois afetam subsistemas diferentes."
+  },
+  "pigz": {
+    "heading": "Use pigz para compactação gzip mais rápida",
+    "intro": "O <code>gzip</code> normal comprime usando <strong>um só núcleo da CPU</strong>. Nos hosts Proxmox modernos com 8, 16 ou 32 núcleos, isto limita muito as cópias VM/CT com <code>vzdump</code>, a rotação de registos e tudo o que passa pelo <code>gzip</code>. O <a>pigz</a> é um substituto paralelo diretamente compatível: produz o mesmo formato gzip, mas distribui o trabalho por todos os núcleos.",
+    "doesTitle": "O que o ProxMenux faz",
+    "doesIntro": "Cinco passos, todos idempotentes:",
+    "doesItems": [
+      "Define <code>pigz: 1</code> em <code>/etc/vzdump.conf</code> para que a ferramenta de backup do Proxmox use pigz nativamente.",
+      "Instala o pacote apt <code>pigz</code> se ainda não estiver presente.",
+      "Cria um script wrapper em <code>/bin/pigzwrapper</code> que encaminha todos os argumentos para <code>/usr/bin/pigz</code>.",
+      "Registra um desvio de dpkg para o binário <code>gzip</code> do sistema (<code>/usr/bin/gzip</code> em Proxmox VE 9, <code>/bin/gzip</code> em Proxmox VE 8): o binário real é mantido ao lado dele como <code>gzip.distrib</code> e o invólucro toma o seu lugar. A partir de agora, <em> qualquer coisa</em> que chama <code>gzip</code> — logrotate, <code>tar czf</code>, scripts, vzdump — usa pigz de forma transparente.",
+      "Verifica que o arquivo mantido como <code>gzip.distrib</code> é um gzip funcional antes da embalagem ser colocada no lugar, e reinstala o pacote <code>gzip</code> primeiro quando não estiver. Uma máquina que ainda tenha o swap <code>/bin/gzip.original</code> anterior é movida para o desvio quando a opção é aplicada novamente."
+    ],
+    "replacesTitle": "Substitui um binário do sistema",
+    "replacesBody": "Colocar um wrapper no lugar do <code>gzip</code> é invulgar. É seguro porque produz saída compatível com gzip, mas scripts com caminhos fixos, executados em chroots restritivos ou que verificam hashes dos binários podem comportar-se de forma diferente. O binário original fica em <code>gzip.distrib</code>. Graças ao desvio dpkg, uma atualização do pacote <code>gzip</code> ou a passagem do Proxmox VE 8 para 9 atualiza esse ficheiro e mantém o wrapper.",
+    "revertTitle": "Reversível do menu Desinstalar",
+    "revertBody": "Esta otimização é registada. <link>Desinstalar otimizações</link> copia o binário original de <code>gzip.distrib</code> para o lugar do wrapper, remove o desvio e <code>pigzwrapper</code>, comenta a linha <code>pigz</code> em <code>/etc/vzdump.conf</code> e executa <code>apt purge pigz</code> após confirmar que o gzip funciona. Equivalente manual no Proxmox VE 9:",
+    "verifyTitle": "Verificação",
+    "verifyBody": "Após a aplicação, <code>gzip --version</code> deve mencionar pigz. Um benchmark rápido também mostra a diferença de velocidade em um host multi-core:",
+    "whenTitle": "Quando isto é mais importante",
+    "whenBody": "O benefício aumenta com o <strong>número de núcleos do host</strong> e a <strong>frequência das cópias de segurança</strong>. Num servidor doméstico de 2 núcleos com um vzdump diário, o ganho é marginal. Num host de produção com 16 núcleos que guarda uma dúzia de VMs todas as noites, o pigz pode reduzir a janela de cópia a uma fração do tempo do gzip de uma thread."
+  },
+  "related": {
+    "heading": "Relacionado",
+    "items": [
+      {
+        "label": "Comandos de backup e restauração",
+        "href": "/docs/help-info/backup-commands",
+        "tailRich": " — vzdump CLI, incluindo a opção de threads <code>--pigz</code>."
+      },
+      {
+        "label": "Armazenamento",
+        "href": "/docs/post-install/storage",
+        "tail": " — limites de velocidade vzdump e afinação ZFS ARC."
+      },
+      {
+        "label": "Sistema",
+        "href": "/docs/post-install/system",
+        "tail": " — ajuste de descritores de ficheiros e memória."
+      },
+      {
+        "label": "Pós-instalação personalizável",
+        "href": "/docs/post-install/customizable",
+        "tail": " — voltar ao menu superior."
+      }
+    ]
+  }
+}
diff --git a/web/messages/pt/docs/post-install/security.json b/web/messages/pt/docs/post-install/security.json
new file mode 100644
index 00000000..7431de82
--- /dev/null
+++ b/web/messages/pt/docs/post-install/security.json
@@ -0,0 +1,57 @@
+{
+  "meta": {
+    "title": "Pós-instalação: Segurança | Documentação ProxMenux",
+    "description": "Opções de segurança disponíveis no script pós-instalação personalizável ProxMenux. Atualmente uma única opção: desabilitar o serviço portmapper/rpcbind para reduzir a superfície de ataque do host."
+  },
+  "header": {
+    "title": "Pós-instalação: Segurança",
+    "section": "Configurações pós-instalação do Proxmox"
+  },
+  "intro": {
+    "title": "O que esta categoria abrange",
+    "body": "A segurança pós-instalação limita-se ao <strong>reforço do host que pode ser aplicado em segurança sem supervisão</strong>: desativar serviços raramente necessários, com reversão pelo menu Desinstalar. As ferramentas ativas (Fail2Ban para prevenção de intrusões e Lynis para auditoria) ficam em <em>Segurança</em> no menu principal do ProxMenux, fora da pós-instalação."
+  },
+  "rpcbind": {
+    "heading": "Desactivar o portmapper / rpcbind",
+    "intro": "<code>rpcbind</code> (anteriormente <code>portmap</code>) é um serviço que mapeia números de programas RPC para portas de rede. É uma dependência para NFS e algumas ferramentas baseadas em RPC. Em um host típico do Proxmox que não está atuando como um servidor NFS, o <strong>nada o usa</strong> — e deixando-o habilitado mantém a porta <code>111/tcp</code> ouvindo em cada interface.",
+    "whyTitle": "Porque vale a pena desactivar",
+    "whyItems": [
+      "Reduz a superfície do ataque do hospedeiro — um serviço de escuta a menos para se preocupar.",
+      "Historicamente abusado como vetor de reflexão/amplificação em ataques de DDoS. Desativar o <code>rpcbind</code> remove esse fator de amplificação para o seu host.",
+      "Remove o ruído que gera em logs e saída <code>netstat</code> / <code>ss</code>, tornando a atividade real mais fácil de detectar."
+    ],
+    "nfsTitle": "Não desactivar isto se usar o NFS",
+    "nfsBody": "O servidor NFS <strong>e</strong> o cliente NFS dependem do <code>rpcbind</code> para negociar as portas usadas por <code>mountd</code>, <code>statd</code>, <code>lockd</code>, etc. Se o host Proxmox <em>exportar</em> partilhas NFS para outras máquinas ou <em>montar</em> partilhas NFS de um NAS, não aplique esta opção. As montagens falharão com <code>mount.nfs: rpc.statd is not running</code> ou semelhante.",
+    "runsTitle": "O que o ProxMenux executa",
+    "runsOutro": "O pacote permanece instalado. O ProxMenux regista os estados originais de ativação e execução de rpcbind.service e rpcbind.socket, depois desativa e para ambas as unidades para impedir a reativação do serviço pelo socket.",
+    "verifyTitle": "Verificação",
+    "verifyBody": "Após a aplicação, confirme que o <code>rpcbind</code> está desligado e nada está ouvindo na porta 111:",
+    "reversibleTitle": "Restaura o estado de serviço original",
+    "reversibleBody": "A alteração é registada em <code>installed_tools.json</code>. <link>Desinstalar otimizações</link> repõe cada unidade rpcbind nos estados de ativação e execução registados antes da alteração pelo ProxMenux; não pressupõe que o rpcbind estivesse ativado em todos os hosts."
+  },
+  "related": {
+    "heading": "Relacionado",
+    "items": [
+      {
+        "label": "Menu de segurança",
+        "href": "/docs/security",
+        "tail": " — ferramentas mais completas: Fail2Ban (prevenção de intrusões) e Lynis (auditoria)."
+      },
+      {
+        "label": "Lynis",
+        "href": "/docs/security/lynis",
+        "tail": "— audite o host para encontrar mais oportunidades de proteção."
+      },
+      {
+        "label": "Comandos úteis do sistema",
+        "href": "/docs/help-info/system-commands",
+        "tail": " — estado dos serviços e referência para journalctl e lynis audit."
+      },
+      {
+        "label": "Pós-instalação personalizável",
+        "href": "/docs/post-install/customizable",
+        "tail": " — voltar ao menu superior."
+      }
+    ]
+  }
+}
diff --git a/web/messages/pt/docs/post-install/storage.json b/web/messages/pt/docs/post-install/storage.json
new file mode 100644
index 00000000..c540d8a3
--- /dev/null
+++ b/web/messages/pt/docs/post-install/storage.json
@@ -0,0 +1,167 @@
+{
+  "meta": {
+    "title": "Pós-instalação: Armazenamento | Documentação ProxMenux",
+    "description": "Otimizações de armazenamento do script pós-instalação personalizável ProxMenux: dimensão ZFS ARC pela RAM do host, instantâneos periódicos com zfs-auto-snapshot e remoção dos limites de velocidade dos backups vzdump."
+  },
+  "header": {
+    "title": "Pós-instalação: Armazenamento",
+    "section": "Configurações pós-instalação do Proxmox"
+  },
+  "intro": {
+    "title": "O que esta categoria abrange",
+    "body": "Quatro otimizações de armazenamento: ajustar <strong>ZFS ARC</strong> a uma fração adequada da RAM, instalar e agendar <strong>instantâneos ZFS automáticos</strong>, ativar <strong>ZFS autotrim</strong> em pools SSD/NVMe e retirar limitações de <strong>vzdump</strong> para acelerar backups. Escolha cada opção independente conforme o sistema. Uma quinta, <link>Log2RAM</link>, reduz desgaste SSD/NVMe movendo <code>/var/log</code> para ramdisk. Está em Opcionais porque o menu personalizável a agrupa aí."
+  },
+  "trackedTitle": "Todos os quatro são rastreados no menu Desinstalar",
+  "trackedBody": "Cada uma dessas opções registra uma ferramenta em <code>installed_tools.json</code>, então eles aparecem em <link>Otimizações de Uninstall</link>. Reverter o <code>zfs_arc</code> remove o <code>/etc/modprobe.d/99-zfsarc.conf</code> e reconstrói o initramfs; o <code>zfs_auto_snapshot</code> reverte o cronograma do cron e oferece purgar o pacote; o <code>zfs_autotrim</code> configura o <code>autotrim=off</code> nos pools que ele ativou; o <code>vzdump_speed</code> restaura o <code>/etc/vzdump.conf</code> do <code>.bak</code> a instalação criada.",
+  "arc": {
+    "heading": "Otimizar o tamanho do ZFS ARC",
+    "intro": "A <strong>Adaptive Replacement Cache (ARC)</strong> é a cache de leitura ZFS em RAM. Instalações Proxmox VE desde 8.1 limitam a 10% da RAM, máximo 16 GiB; hosts antigos ou atualizados podem diferir. Esta opção escreve explicitamente essa mesma regra (RAM/10, máximo de 16 GiB, mínimo de 64 MiB) num ficheiro próprio, o que cobre também hosts antigos ou atualizados. Verifique definições e carga: uma cache menor nem sempre é mais rápida.",
+    "sizingTitle": "Regras de dimensionamento",
+    "headerRam": "RAM do host",
+    "headerMax": "Limite ARC",
+    "rows": [
+      {
+        "ram": "Fórmula",
+        "max": "RAM / 10, máximo 16 GiB e mínimo 64 MiB"
+      },
+      {
+        "ram": "Máquina 8 GB",
+        "max": "≈ 819 MiB (RAM/10)"
+      },
+      {
+        "ram": "Máquina 16 GB",
+        "max": "≈ 1.6 GiB (RAM/10)"
+      },
+      {
+        "ram": "Máquina 64 GB",
+        "max": "≈ 6.4 GiB (RAM/10)"
+      },
+      {
+        "ram": "≥ Máquina 160 GB",
+        "max": "16 GiB (limite)"
+      }
+    ],
+    "after": "O ficheiro <code>/etc/modprobe.d/99-zfsarc.conf</code> contém apenas <code>options zfs zfs_arc_max=…</code>. Os outros parâmetros ZFS (<code>zfs_arc_min</code>, pré-leitura/limite de escritas L2ARC, tempo limite TXG) não são ajustados. Antes, procura outros <code>*.conf</code> em <code>/etc/modprobe.d/</code> com <code>zfs_arc_min</code> / <code>zfs_arc_max</code>, copia-os com manifesto para <code>/usr/local/share/proxmenux/backups/zfs_arc/</code> e remove deles os valores <code>zfs_arc_min</code> / <code>zfs_arc_max</code> em conflito (as outras opções dessas linhas mantêm-se), para que só o ficheiro ARC ProxMenux defina o limite. Depois, <code>update-initramfs -u -k all</code> e, quando aplicável, <code>proxmox-boot-tool refresh</code> integram o limite no initramfs dos sistemas com raiz ZFS.",
+    "rebootTitle": "Requer uma reinicialização para fazer efeito",
+    "rebootBody": "As definições ARC são lidas ao carregar o módulo <code>zfs</code>. Para hosts com raiz ZFS, ProxMenux regenera initramfs com <code>update-initramfs -u -k all</code> e atualiza o carregador quando necessário com <code>proxmox-boot-tool refresh</code>. O novo parâmetro continua a exigir reinício, assinalado automaticamente.",
+    "safeTitle": "Seguro em hosts não-ZFS",
+    "safeBody": "A função só escreve a configuração quando <code>zpool list</code> relata pelo menos um pool de ZFS. No ext4 / LVM- only Proxmox hosts, ou em máquinas com as ferramentas ZFS instaladas, mas sem pool importado, assinalar esta opção é um no-op - nada é escrito.",
+    "verifyTitle": "Verificação e retrocesso manual"
+  },
+  "autoSnap": {
+    "heading": "Instale o instantâneo automático do ZFS",
+    "intro": "Instala o pacote <a>zfs-auto-snapshot</a> e reescreve seus agendamentos cron para que instantâneos sejam tomados automaticamente em vários intervalos. Uma grande rede de segurança sem esforço em cima de seus backups regulares vzdump.",
+    "cadenceTitle": "Frequência dos instantâneos configurada pelo ProxMenux",
+    "headerLabel": "Rótulo",
+    "headerRuns": "Execução",
+    "headerKept": "Instantâneos retidos",
+    "rows": [
+      {
+        "label": "frequentes",
+        "runs": "cada 15 min",
+        "kept": "4"
+      },
+      {
+        "label": "horário",
+        "runs": "a cada hora",
+        "kept": "1"
+      },
+      {
+        "label": "diariamente",
+        "runs": "uma vez por dia",
+        "kept": "1"
+      },
+      {
+        "label": "semanalmente",
+        "runs": "uma vez por semana",
+        "kept": "1"
+      },
+      {
+        "label": "mensal",
+        "runs": "uma vez por mês",
+        "kept": "1"
+      }
+    ],
+    "conservativeTitle": "Retenção limitada",
+    "conservativeBody": "ProxMenux usa retenção limitada: 4 instantâneos frequentes e 1 por cada intervalo mais longo, para conter a ocupação ZFS. Para reter mais, altere os números em <code>/etc/cron.d/zfs-auto-snapshot</code>, <code>/etc/cron.hourly/zfs-auto-snapshot</code> etc. após o script.",
+    "onlyZfsTitle": "Útil apenas em pools ZFS",
+    "onlyZfsBody": "Instalar o pacote num host apenas ext4 é inofensivo mas inútil: não há datasets ZFS para criar instantâneos. Ignore a opção se não usa ZFS.",
+    "verifyTitle": "Verificação e retrocesso manual"
+  },
+  "autotrim": {
+    "heading": "Ativar ZFS autotrim (pools SSD/NVMe)",
+    "intro": "Ativa <code>autotrim</code> em pools ZFS só com SSD ou NVMe compatíveis com TRIM. Por precaução, ignora pools com dispositivos rotacionais. Os pools já com <code>autotrim=on</code> ficam inalterados.",
+    "trimTitle": "O que TRIM faz, e por que importa em ZFS",
+    "trimBody1": "SSD e NVMe usam blocos internos de apagamento maiores que os setores lógicos do sistema de ficheiros. Quando um ficheiro é apagado, a unidade ainda não sabe que os setores estão livres e a limpeza interna pode continuar a mover dados obsoletos para libertar blocos. <strong>TRIM</strong> indica os setores livres para permitir o seu apagamento antecipado.",
+    "trimBody2": "Sem TRIM, o desempenho do SSD degrada-se ao longo do tempo, pois a unidade fica sem blocos pré-apagados e tem que fazer apagar-em-escrever, e aumentar a amplificação de gravação — tanto encurtando a vida útil da unidade. Com TRIM ativado, a unidade pode manter um saudável pool de blocos vazios prontos para escrever.",
+    "trimBody3": "Com <code>autotrim=on</code>, ZFS aplica TRIM em segundo plano ao espaço recém-libertado, agrupando intervalos. Um <code>zpool trim &lt;pool&gt;</code> periódico é alternativa. Autotrim evita agendamento separado, mas o impacto depende dos dispositivos; TRIM manual periódico pode ser melhor em algumas unidades modestas.",
+    "practicalTitle": "Por que isso é prático para habilitar?",
+    "practicalItems": [
+      "<strong>Desempenho de escrita sustentado.</strong> TRIM pode ajudar a recuperar blocos sem uso. Benefícios e impacto na latência dependem do dispositivo e da carga.",
+      "<strong>Vida útil da unidade.</strong> Evitar cópias internas desnecessárias pode reduzir amplificação de escrita e desgaste NAND, sem garantir uma duração adicional específica.",
+      "<strong>Sem tarefa cron para agendar.</strong> Ao contrário de um <code>zpool trim</code> periódico, autotrim é gerido automaticamente pelo pool."
+    ],
+    "whenTitle": "Quando é que isto é necessário?",
+    "whenIntro1": "<strong>Considere ativá-lo</strong> em pools ZFS só com SSD/NVMe compatíveis com TRIM. Verifique comportamento e latência; TRIM manual agendado pode ser preferível.",
+    "whenIntro2": "<strong>O programa ignora- o automaticamente</strong> em:",
+    "whenSkipItems": [
+      "Pools com vdev HDD rotacional: filtro conservador de hardware deste script.",
+      "Unidades sem <code>discard_granularity</code> expostas em sysfs — geralmente SSDs antigos sem TRIM, ou caminhos de passagem onde o SO não pode ver o dispositivo subjacente.",
+      "Pools em que ZFS ela mesma relata a propriedade não suportada (raro; muito antigo pools).",
+      "Pools já definidos para <code>autotrim=on</code> (no-op)."
+    ],
+    "whenIntro3": "<strong>Não relevante em hosts somente ext4</strong> — não há nada para ZFS cortar. A função termina com uma mensagem amigável nesse caso.",
+    "recordedTitle": "Por que apenas os pools ProxMenux alterados são registrados",
+    "recordedBody": "A função só escreve um pool para o seu arquivo de estado interno (<code>/usr/local/share/proxmenux/zfs_autotrim_pools</code>) quando ele ativamente virou esse pool de <code>off</code> para <code>on</code>. Pools que você tinha no autotrim antes de executar o script são deixados de fora da lista, então um futuro Desinstalar não desliga as configurações que você mesmo configurou — apenas as próprias alterações do ProxMenux são revertidas.",
+    "manualTitle": "Equivalente manual (executado no seu servidor)",
+    "manualIntro": "A sequência completa que o script executa contra cada pool é replicável à mão. Isto é o que você digitaria se você quisesse fazer a mesma coisa em um único pool sem ProxMenux:",
+    "verifyTitle": "Verificação e retrocesso manual",
+    "oneShotTitle": "Prefere TRIM pontual em vez de contínuo?",
+    "oneShotBody": "Alguns administradores preferem TRIM manual nas horas de menor carga. Desative autotrim e agende uma tarefa cron com <code>zpool trim &lt;pool&gt;</code>: mesmo objetivo, frequência diferente."
+  },
+  "vzdump": {
+    "heading": "Aumentar a velocidade de backup do vzdump",
+    "intro": "Escreve bwlimit: 0 e ionice: 5 na configuração global vzdump. Proxmox já não limita a banda por predefinição: só remove um limite configurado. Face a ionice: 7, o valor 5 aumenta a prioridade E/S best-effort se o escalonador a respeitar. Pode afetar os convidados e não garante backups mais rápidos.",
+    "changedTitle": "O que é alterado em /etc/vzdump.conf",
+    "backupTitle": "Primeira execução cria um .bak de vzdump.conf",
+    "backupBody": "Na primeira execução, ProxMenux copia <code>/etc/vzdump.conf</code> para <code>/etc/vzdump.conf.bak</code> antes de alterar. As seguintes preservam essa cópia para recuperar a configuração anterior. <code>bwlimit</code> e <code>ionice</code> são alterados com <code>sed</code>; outras opções como compress, pigz, tmpdir e exclude-path são preservadas.",
+    "skipTitle": "Quando saltar isto",
+    "skipBody": "Num host com armazenamento local lento e VMs sensíveis à latência, retirar o limite de banda pode causar lentidão durante backups. Se definiu <code>bwlimit</code> por esse motivo, mantenha-o e ignore a opção.",
+    "verifyTitle": "Verificação e retrocesso manual"
+  },
+  "related": {
+    "heading": "Relacionado",
+    "items": [
+      {
+        "label": "Comandos de gerenciamento ZFS",
+        "href": "/docs/help-info/zfs-commands",
+        "tail": " — referência zpool / zfs para ARC, instantâneos e scrub."
+      },
+      {
+        "label": "Comandos de armazenamento e discos",
+        "href": "/docs/help-info/storage-commands",
+        "tail": " — referência de dispositivos de blocos e armazenamento Proxmox."
+      },
+      {
+        "label": "Comandos de backup e restauração",
+        "href": "/docs/help-info/backup-commands",
+        "tail": " — referência CLI vzdump para banda e prioridade E/S."
+      },
+      {
+        "label": "Desinstalar otimizações",
+        "href": "/docs/post-install/uninstall",
+        "tail": " — reverter as alterações ARC / vzdump."
+      },
+      {
+        "label": "Log2RAM",
+        "href": "/docs/post-install/optional#log2ram",
+        "tail": " — reduz o desgaste SSD/NVMe por /var/log ramdisk backing; documentado sob opcional."
+      },
+      {
+        "label": "Pós-instalação personalizável",
+        "href": "/docs/post-install/customizable",
+        "tail": " — voltar ao menu superior."
+      }
+    ]
+  }
+}
diff --git a/web/messages/pt/docs/post-install/system.json b/web/messages/pt/docs/post-install/system.json
new file mode 100644
index 00000000..5165d20b
--- /dev/null
+++ b/web/messages/pt/docs/post-install/system.json
@@ -0,0 +1,133 @@
+{
+  "meta": {
+    "title": "Pós-instalação: Sistema | Documentação ProxMenux",
+    "description": "Otimizações em nível de sistema no ProxMenux Script pós-instalação personalizável: journald e limites de tamanho de rotação de log, limites mais altos de kernel e descritor de arquivo, ajuste de memória balanceado, kexec para reinicializações rápidas e recuperação de kernel panic."
+  },
+  "header": {
+    "title": "Após a instalação: sistema",
+    "section": "Configurações pós-instalação do Proxmox"
+  },
+  "intro": {
+    "title": "O que esta categoria abrange",
+    "body": "Seis otimizações de sistema independentes. Ajustam <strong>journald</strong> e <strong>logrotate</strong> para os registos não encherem o disco, aumentam <strong>os limites do kernel e dos descritores de ficheiros</strong> para aplicações com muitos ficheiros abertos, <strong>equilibram a memória</strong> num host de virtualização, acrescentam <strong>kexec</strong> para reinícios sem BIOS e configuram <strong>a recuperação automática</strong> de kernel panic. As seis ficam registadas e são reversíveis no menu Desinstalar."
+  },
+  "journald": {
+    "heading": "Otimizar journald",
+    "intro": "Reescreve <code>/etc/systemd/journald.conf</code> com valores adequados para o journal systemd não encher gradualmente a partição raiz; depois reinicia <code>systemd-journald</code> e limpa registos antigos.",
+    "keyTitle": "Valores-chave",
+    "keyItems": [
+      "<code>Storage=persistent</code> — manter registros no disco através de reinicialização.",
+      "<code>SystemMaxUse=64M</code> / <code>RuntimeMaxUse=60M</code> — limites de utilização de disco e memória do journal.",
+      "<code>Compress=yes</code>, <code>Seal=no</code> — comprime registos e desativa a selagem com segurança futura (poupa CPU).",
+      "<code>MaxLevelStore=info</code> — guarda nível info e superiores, necessários ao visualizador de registos ProxMenux Monitor e à deteção de falhas de autenticação SSH/Proxmox pelo Fail2Ban no journal.",
+      "Limite de frequência: <code>1000 events / 30 s</code> para evitar um excesso de registos.",
+      "<code>ForwardToSyslog=no</code>, <code>ForwardToWall=no</code> — não duplicar mensagens para syslog ou transmitir para consoles."
+    ],
+    "tipTitle": "Por que o MaxLevelStore=info importa",
+    "tipBody": "Um limiar mais rigoroso como <code>warning</code> faz ProxMenux Monitor mostrar entradas quase iguais em todos os períodos, pois a maioria da atividade é de nível info, e impede Fail2Ban de ver acessos falhados. Reduza o volume com <code>SystemMaxUse</code> e <code>RateLimitBurst</code> sem restringir os níveis guardados."
+  },
+  "logrotate": {
+    "heading": "Otimizar logrotate",
+    "intro": "Reescreve <code>/etc/logrotate.conf</code> com definições globais diárias e de tamanho, 7 rotações retidas, compressão e <code>copytruncate</code>, para os serviços continuarem a escrever sem reabrir os registos. O tamanho aparece após a frequência diária e prevalece, salvo regras específicas de cada registo. O <code>logrotate.conf</code> original é copiado para <code>.bak</code> na primeira aplicação.",
+    "tipTitle": "Compatível com Log2RAM",
+    "tipBody": "A diretiva <code>size 10M</code> prevalece sobre a definição diária anterior; <em>não</em> significa o primeiro dos dois critérios. Logrotate verifica o limiar quando é executado, e regras específicas podem substituir as globais. Com <code>/var/log</code> na RAM do Log2RAM, verifique as regras e a frequência do temporizador para controlar o espaço."
+  },
+  "limits": {
+    "heading": "Aumentar vários limites do sistema",
+    "intro": "Aumenta limites do kernel, systemd e PAM cujas predefinições podem ser baixas para um host com muitas VMs, contentores e serviços de rede.",
+    "headerFile": "Arquivo",
+    "headerSets": "O que define",
+    "rows": [
+      {
+        "file": "/etc/sysctl.d/99-maxwatches.conf",
+        "sets": "<code>fs.inotify.max_user_watches / max_user_instances / max_queued_events = 1048576</code>"
+      },
+      {
+        "file": "/etc/sysctl.d/99-maxkeys.conf",
+        "sets": "<code>kernel.keys.maxkeys / root_maxkeys = 1000000</code>"
+      },
+      {
+        "file": "/etc/sysctl.d/99-swap.conf",
+        "sets": "<code>vm.swappiness = 10</code>, <code>vm.vfs_cache_pressure = 100</code>"
+      },
+      {
+        "file": "/etc/sysctl.d/99-fs.conf",
+        "sets": "<code>fs.nr_open / file-max = 2097152</code>, <code>fs.aio-max-nr = 1048576</code>"
+      },
+      {
+        "file": "/etc/security/limits.d/99-limits.conf",
+        "sets": "<code>nofile</code> e <code>nproc</code> a 1 048 576 (ilimitados para root)"
+      },
+      {
+        "file": "/etc/systemd/system.conf + user.conf",
+        "sets": "<code>DefaultLimitNOFILE=1048576</code> para serviços systemd"
+      },
+      {
+        "file": "/etc/pam.d/common-session + runuser-l",
+        "sets": "<code>session required pam_limits.so</code> então o acima se aplica às shells de login"
+      },
+      {
+        "file": "/root/.profile",
+        "sets": "<code>ulimit -n 1048576</code> para a shell root"
+      }
+    ],
+    "tipTitle": "Por que inotify é importante",
+    "tipBody": "Docker, Syncthing, as monitorizações de ficheiros Node.js e análises Plex podem esgotar <code>max_user_watches</code>. A predefinição depende do kernel e da memória; nem sempre é 8192. O limite de 1M permite mais monitorizações sem as pré-alocar. As ativas consomem memória do kernel: controle a utilização nos hosts com pouca RAM."
+  },
+  "memory": {
+    "heading": "Otimizar as configurações de memória",
+    "intro": "Escreve um perfil sysctl equilibrado para <code>/etc/sysctl.d/99-memory.conf</code>. Projetado para um host de hipervisor — prefere manter conjuntos de trabalho VM em RAM e libera páginas proativamente para que as rajadas de alocação não parem.",
+    "warnTitle": "swappiness=10 em hosts com pouca memória",
+    "warnBody": "Num host com 16 GB de RAM e muitas VMs, reduzir swappiness pode levar o kernel a terminar processos por falta de memória em vez de usar swap. Se os eventos OOM forem frequentes, aumente swappiness para 30–60 em <code>/etc/sysctl.d/99-memory.conf</code> após executar o script."
+  },
+  "kexec": {
+    "heading": "Activar reinicialização rápida (kexec)",
+    "intro": "Instala o <code>kexec-tools</code> e o liga para que você possa reiniciar o host diretamente em um novo kernel <em>sem passar pelo firmware BIOS/UEFI</em>. Em grandes servidores onde POST leva 45 – 90 segundos, isso transforma uma reinicialização de uma pausa de café em alguns segundos de parada.",
+    "installsTitle": "O que o ProxMenux instala",
+    "installsItems": [
+      "Pacote <code>kexec-tools</code> (debconf pré-configurado com <code>kexec-tools/load_kexec boolean false</code> para o apt não pedir confirmação e manter desativado o carregamento automático ao desligar).",
+      "Unidade systemd <code>/etc/systemd/system/kexec-pve.service</code> — carrega o kernel Proxmox e initrd em memória no arranque, reutilizando a linha de comandos atual do kernel.",
+      "Um apelido em <code>/root/.bash_profile</code>: <code>reboot-quick</code> → <code>systemctl kexec</code>."
+    ],
+    "usageIntro": "Uso após a próxima reinicialização (ou manual <code>systemctl start kexec-pve</code>):",
+    "warnTitle": "Quando não usar o kexec",
+    "warnBody": "O kexec ignora o nível de firmware init. Se você confiar em BIOS/UEFI para redefinir o estado de hardware — por exemplo, um GPU fazendo a passagem que só repõe de forma limpa no POST completo, ou um firmware HBA problemático — o reboots do kexec pode deixar esses dispositivos em um estado semi-inicializado. Use um <code>reboot</code> normal após atualizações do kernel ou quando você precisar de alterações BIOS/UEFI para fazer efeito. <code>reboot-quick</code> é para reinícios diários."
+  },
+  "panic": {
+    "heading": "Habilite a reinicialização no kernel panic",
+    "intro": "Faz o kernel <strong>reiniciar automaticamente</strong> em vez de ficar bloqueado no ecrã de panic. Essencial em hosts Proxmox remotos ou sem consola local: um kernel bloqueado para todas as VMs até poder desligar e voltar a ligar a alimentação.",
+    "tipTitle": "Emparelha isto com o acesso remoto à consola",
+    "tipBody": "Auto-reboot é um mecanismo de recuperação, não uma ferramenta de depuração. Se você quiser <em>investigar</em> um pânico em vez de apenas voltar, use <link>a opção kexec</link> acima com o suporte kdump do kernel (não configurado pelo ProxMenux) ou capture um console serial para outro host antes de habilitar o reinício automático."
+  },
+  "verify": {
+    "heading": "Verificação",
+    "intro": "Após a aplicação das otimizações do sistema:",
+    "tipTitle": "Restauro e limitações",
+    "tipBody": "As seis opções ficam em <code>installed_tools.json</code> e <link>Desinstalar otimizações</link>. O restauro remove os ficheiros de configuração, a unidade e o alias kexec, reescreve journald.conf com os valores predefinidos do systemd e repõe logrotate.conf a partir da cópia de segurança. Alguns limites ativos precisam de nova sessão ou reinício."
+  },
+  "related": {
+    "heading": "Relacionado",
+    "items": [
+      {
+        "label": "Comandos úteis do sistema",
+        "href": "/docs/help-info/system-commands",
+        "tail": " — verificar as alterações (free -h, journalctl, ulimit -a)."
+      },
+      {
+        "label": "Desempenho",
+        "href": "/docs/post-install/performance",
+        "tail": " — afinação adicional do nível do sistema (pigz)."
+      },
+      {
+        "label": "Desinstalar otimizações",
+        "href": "/docs/post-install/uninstall",
+        "tail": " — reverter qualquer uma destas alterações."
+      },
+      {
+        "label": "Pós-instalação personalizável",
+        "href": "/docs/post-install/customizable",
+        "tail": " — voltar ao menu superior."
+      }
+    ]
+  }
+}
diff --git a/web/messages/pt/docs/post-install/uninstall.json b/web/messages/pt/docs/post-install/uninstall.json
new file mode 100644
index 00000000..50b1b48e
--- /dev/null
+++ b/web/messages/pt/docs/post-install/uninstall.json
@@ -0,0 +1,271 @@
+{
+  "meta": {
+    "title": "Desinstalar otimizações | Documentação ProxMenux",
+    "description": "Restaurar as alterações reversíveis de configuração pós-instalação aplicadas pelo ProxMenux. Ferramentas registradas usam desinstaladores dedicados que preservam o estado de host pré-existente sempre que possível."
+  },
+  "header": {
+    "title": "Desinstalar otimizações",
+    "description": "Restaurar as alterações reversíveis feitas pelos scripts pós-instalação automatizados ou personalizáveis. ProxMenux registra cada otimização suportada com sua função de restauração dedicada; upgrades de pacotes são intencionalmente excluídos.",
+    "section": "Configurações pós-instalação do Proxmox"
+  },
+  "intro": {
+    "title": "Por que isto existe",
+    "body": "Cada ajuste reversível suportado fica <strong>registado</strong> em <code>/usr/local/share/proxmenux/installed_tools.json</code>. O registo lista otimizações ativas e chama a função de restauro correspondente. Ações sem reversão segura, como uma atualização completa de pacotes, não são acrescentadas."
+  },
+  "openMenu": {
+    "heading": "Como abri-lo",
+    "body": "Do menu principal do ProxMenux, <strong>Configurações pós-instalação Proxmox → Desinstalar otimizações</strong>. Você verá uma lista de verificação das otimizações <em>aplicadas atualmente</em> — itens que você não tenha aplicado não aparecem.",
+    "imageAlt": "Desinstalar Lista de verificação de Otimizações mostrando itens atualmente aplicados no host, com caixas de seleção para selecionar quais reverter"
+  },
+  "howWorks": {
+    "heading": "Como funciona a inversão",
+    "steps": [
+      {
+        "title": "Registro e autodetecção",
+        "body1": "Na primeira execução, ProxMenux procura indicadores no host: <code>/etc/sysctl.d/99-memory.conf</code>, <code>/etc/apt/apt.conf.d/99-force-ipv4</code>, pacote <code>haveged</code> instalado, serviço Log2RAM ativo, etc. Os elementos reconhecidos são registados como reversíveis mesmo se aplicados por uma versão anterior ao registo.",
+        "body2": "Esta migração só funciona uma vez. Depois disso, cada aplicação/reversão atualiza diretamente o registro."
+      },
+      {
+        "title": "Escolha o que reverter",
+        "body1": "A lista de verificação mostra um rótulo legível pelo homem por item (por exemplo, <em>Otimização da Configuração da Memória</em>, <em>IOMMU/VFIO PCI Passthrough</em>, <em>Log2RAM (Proteção SSD)</em>). Assinale os que quiser reverter. Nada que não tiquetes será tocado."
+      },
+      {
+        "title": "Execução da reversão",
+        "body1": "Para cada item selecionado, ProxMenux chama sua função de desinstalação correspondente. A maioria das reversões segue um dos três padrões:",
+        "items": [
+          "<strong>A partir de cópia</strong> — restaura um <code>.bak</code> criado ao aplicar a alteração (bashrc, logrotate.conf, journald.conf, linha de comandos GRUB/kernel).",
+          "<strong>Remoção da configuração</strong> — remove os ficheiros ProxMenux <code>/etc/sysctl.d/99-*.conf</code>, <code>/etc/apt/apt.conf.d/99-*</code> ou a unidade systemd e recarrega.",
+          "<strong>Reinstale o pacote</strong> — para alterações de UI como o banner de assinatura, reinstale os pacotes upstream com <code>--force-confnew</code> para restaurar a configuração enviada."
+        ],
+        "body2": "Cada inversão regista o seu progresso. Itens que requerem uma reinicialização (VFIO, nomes de interface persistentes) definem uma bandeira que ativa o prompt de reinicialização no final."
+      },
+      {
+        "title": "Pedido de reinício no fim",
+        "body1": "Após a reversão terminar, o menu mostra um prompt de reinicialização. Itens que mudaram os parâmetros do kernel, módulos do kernel ou nomes de rede (VFIO, nomes de interface persistentes) precisam da reinicialização para fazer efeito; outros itens não, e o prompt é um padrão de segurança em vez de uma verificação por item."
+      }
+    ]
+  },
+  "reversible": {
+    "heading": "O que é reversível",
+    "intro": "As otimizações reversíveis registradas e seus desinstaladores correspondentes são agrupados aqui por área:",
+    "groups": [
+      {
+        "title": "Repositórios & APT",
+        "items": [
+          {
+            "tool": "Remoção da Banner de Assinatura",
+            "restores": "Primeiro tenta restaurar os ficheiros da interface a partir das cópias ProxMenux (/usr/local/share/proxmenux/backups/proxmoxlib.js.backup.* e index.html.tpl.backup.* se a interface móvel foi modificada). Só quando a cópia falta ou está danificada reinstala pve-manager, proxmox-widget-toolkit, libjs-extjs e libpve-http-server-perl com force-confnew. Também limpa cópias .js / .gz em cache."
+          },
+          {
+            "tool": "Ignorar idiomas do APT",
+            "restores": "Remove /etc/apt/apt.conf.d/99-disable-translations, permitindo os índices de descrições traduzidas segundo as restantes definições de idioma APT."
+          },
+          {
+            "tool": "Forçar IPv4 no APT",
+            "restores": "Remove /etc/apt/apt.conf.d/99-force-ipv4."
+          },
+          {
+            "tool": "Utilitários de Sistema",
+            "restores": "Purga apenas os pacotes utilitários selecionados que o ProxMenux gravou como recém-instalado. Pacotes já presentes antes da ação nunca são adicionados a esta lista e ficam intocados."
+          }
+        ]
+      },
+      {
+        "title": "Limites de Kernel, memória e sistema",
+        "items": [
+          {
+            "tool": "Configuração da Memória",
+            "restores": "Remove o /etc/sysctl.d/99-memory.conf e recarrega o sysctl."
+          },
+          {
+            "tool": "Configuração do Pânico do Kernel",
+            "restores": "Remove /etc/sysctl.d/99-kernelpanic.conf."
+          },
+          {
+            "tool": "Aumento dos limites do sistema",
+            "restores": "Remove /etc/sysctl.d/99-maxwatches.conf, 99-maxkeys.conf, 99-swap.conf, 99-fs.conf e /etc/security/limits.d/99-limits.conf. Repõe limites PAM e DefaultLimitNOFILE systemd. Em /root/.profile só remove o antigo ulimit -n 256000; ulimit -n 1048576 do instalador atual pode permanecer e exigir remoção manual."
+          },
+          {
+            "tool": "Perfil de troca ZRAM",
+            "restores": "Desativa o swap /dev/zram0, para dev-zram0.swap e remove /etc/systemd/zram-generator.conf.d/90-proxmenux.conf. Só purga systemd-zram-generator se instalado pelo ProxMenux e sem outra configuração ZRAM. Se não conseguir evacuar as páginas, o perfil mantém-se ativo e nada é removido."
+          }
+        ]
+      },
+      {
+        "title": "Rede",
+        "items": [
+          {
+            "tool": "Otimizações de Rede",
+            "restores": "Remove /etc/sysctl.d/99-network.conf, 97-proxmenux-fwbr.conf e 98-proxmenux-rpf.conf, a unidade proxmenux-fwbr-tune.service, o script /usr/local/sbin/proxmenux-fwbr-tune e a regra udev /etc/udev/rules.d/99-zz-proxmenux-fwbr-tune.rules. Retira também source /etc/network/interfaces.d/* de /etc/network/interfaces. Recarrega sysctl, systemd e regras udev."
+          },
+          {
+            "tool": "Open vSwitch",
+            "restores": "Executa apt purge para openvswitch-switch e openvswitch-common. Migre antes as pontes OVS para Linux; caso contrário, as VMs nessas pontes perdem a rede no próximo arranque."
+          },
+          {
+            "tool": "TCP BBR + TCP Fast Open",
+            "restores": "Remove /etc/sysctl.d/99-kernel-bbr.conf e 99-tcp-fastopen.conf e recarrega o restante sysctl. Eliminar ficheiros não repõe valores ativos; predefinições como cubic e tcp_fastopen=1 voltam após reiniciar, salvo outra configuração."
+          },
+          {
+            "tool": "Nomes de Interface Persistentes",
+            "restores": "Remove apenas os arquivos 10-proxmenux-*.link carregando o cabeçalho ProxMenux do /etc/systemd/network/. Qualquer arquivo .link fornecido por outro pacote ou escrito pelo usuário é deixado no lugar. Os nomes da interface retornam ao comportamento padrão do systemd na próxima reinicialização."
+          }
+        ]
+      },
+      {
+        "title": "Registo",
+        "items": [
+          {
+            "tool": "Otimização do journald",
+            "restores": "Reescreve /etc/systemd/journald.conf com predefinições originais e reinicia systemd-journald."
+          },
+          {
+            "tool": "Otimização do Logrotate",
+            "restores": "Restaura /etc/logrotate.conf do arquivo .bak capturado antes da mudança."
+          },
+          {
+            "tool": "Log2RAM",
+            "restores": "Para e desativa o serviço e o timer. Purga trabalhos de cron, unidades systemd, binários, arquivos de configuração e o diretório /var/log.hdd. Também desinstala o pacote apt se ele foi instalado dessa forma."
+          },
+          {
+            "tool": "TRIM automático do ZFS",
+            "restores": "Lê /usr/local/share/proxmenux/zfs_autotrim_pools, a lista dos pools realmente alterados, e executa zpool set autotrim=off em cada um. Preserva autotrim ativado manualmente antes do ProxMenux."
+          }
+        ]
+      },
+      {
+        "title": "Shell & aparência",
+        "items": [
+          {
+            "tool": "Personalização do Bashrc",
+            "restores": "Restaura /root/.bashrc do backup .bak. Se não existir backup, remove o bloco PMX_CORE_BASHRC por marcadores."
+          },
+          {
+            "tool": "Banner MOTD personalizado",
+            "restores": "Restaura o conteúdo original exato /etc/motd mantido sob /usr/local/share/proxmenux, remove o arquivo quando ele não existia antes, ou remove com segurança o marcador legado ao migrar uma instalação mais antiga."
+          },
+          {
+            "tool": "Fastfetch",
+            "restores": "Remove binário, diretório de configuração, integração update-motd e bloco delimitado BEGIN FASTFETCH / END FASTFETCH de /root/.bashrc, ~/.profile, /etc/profile e /etc/profile.d/fastfetch.sh. Purga o pacote apt se instalado."
+          },
+          {
+            "tool": "Figurine",
+            "restores": "Remove o binário, a entrada profile.d e o bloco de aliases em bashrc/profile."
+          }
+        ]
+      },
+      {
+        "title": "Hardware e virtualização",
+        "items": [
+          {
+            "tool": "IOMMU / VFIO",
+            "restores": "Remove os módulos vfio de /etc/modules, as entradas de bloqueio dos controladores nouveau / radeon / nvidia e os parâmetros intel_iommu=on / amd_iommu=on / iommu=pt / pcie_acs_override de /etc/kernel/cmdline (ZFS) ou do GRUB. Reconstrói initramfs."
+          },
+          {
+            "tool": "Correcções AMD CPU (Ryzen/EPYC)",
+            "restores": "Remove idle=nomwait da linha de comandos do kernel (ZFS) ou GRUB e as opções ignore_msrs / report_ignored_msrs de /etc/modprobe.d/kvm.conf."
+          },
+          {
+            "tool": "Agente convidado para host Proxmox virtualizado",
+            "restores": "Lê /usr/local/share/proxmenux/guest_agent.pkg e purga o pacote registado do host. O instalador escolhe qemu-guest-agent, open-vm-tools ou virtualbox-guest-utils pelo hipervisor. Sem registo, tenta esses três pacotes. Atua no host Proxmox aninhado, não em modelos de convidados."
+          }
+        ]
+      },
+      {
+        "title": "Armazenamento",
+        "items": [
+          {
+            "tool": "Dimensionamento do ARC do ZFS",
+            "restores": "Remove /etc/modprobe.d/99-zfsarc.conf, restaura *.conf externos em conflito guardados em /usr/local/share/proxmenux/backups/zfs_arc/, reconstrói initramfs e executa proxmox-boot-tool refresh em hosts systemd-boot."
+          },
+          {
+            "tool": "Snapshots automáticos do ZFS",
+            "restores": "Remove as entradas cron escritas pelo script e oferece apt purge zfs-auto-snapshot. Os instantâneos existentes nos pools são preservados; remova-os separadamente se necessário."
+          },
+          {
+            "tool": "Limites de velocidade do vzdump",
+            "restores": "Restaura /etc/vzdump.conf do .bak a instalação criada, trazendo de volta bwlimit e ionice para seus valores pré-ProxMenux."
+          }
+        ]
+      },
+      {
+        "title": "Serviços & extras",
+        "items": [
+          {
+            "tool": "Sincronização do Tempo",
+            "restores": "Define o fuso- horário de volta para UTC (padrão seguro) via timedatectl."
+          },
+          {
+            "tool": "Geração de entropia (haveged)",
+            "restores": "Para, desativa e purga o pacote haveged."
+          },
+          {
+            "tool": "kexec (reiniciações rápidas)",
+            "restores": "Desativa kexec-pve.service, remove o ficheiro da unidade e o alias reboot-quick de /root/.bash_profile e purga kexec-tools."
+          },
+          {
+            "tool": "RPC / rpcbind Desabilitar",
+            "restores": "Restaura rpcbind.service e rpcbind.socket independentemente para os estados ativados/desativados e ativos/inativos registrados antes de ProxMenux os alterar."
+          },
+          {
+            "tool": "pigz (paralelo gzip)",
+            "restores": "Restaura o gzip original de gzip.distrib, remove o desvio dpkg e /bin/pigzwrapper, comenta a linha pigz em /etc/vzdump.conf e executa apt purge pigz após verificar gzip."
+          },
+          {
+            "tool": "Serviços de alta disponibilidade",
+            "restores": "Para e desactiva pve-ha-lrm, pve-ha-crm e corosync. Grupos HA existentes e definições de recursos não são excluídos — remova-os da interface web se você não precisar mais deles."
+          },
+          {
+            "tool": "repositório Ceph",
+            "restores": "Purga os pacotes Ceph instalados por esta opção, remove o deb822 /etc/apt/sources.list.d/ceph.sources no PVE 9 (ou a lista de Ceph no PVE 8) e atualiza o cache APT."
+          },
+          {
+            "tool": "OVH RTM (monitorização)",
+            "restores": "Purga pacotes correspondentes a ovh-rtm*, rtm e rtm-*, remove /etc/rtm e a entrada RTM do registo. Restos Puppet em /etc/puppet/ podem exigir inspeção e limpeza manual; o diretório não é eliminado. Fora da OVH, o instalador normalmente não altera nada."
+          }
+        ]
+      }
+    ]
+  },
+  "edge": {
+    "heading": "Casos particulares e limitações",
+    "packageTitle": "A reinstalação afeta pacotes Proxmox em utilização",
+    "packageBody": "Se as cópias ProxMenux não conseguirem reverter <strong>Remoção do aviso de subscrição</strong>, a alternativa reinstala <code>pve-manager</code>, <code>proxmox-widget-toolkit</code>, <code>libjs-extjs</code> e <code>libpve-http-server-perl</code> com <code>--force-confnew</code>. Afeta a interface em uso: atualize o navegador e aguarde alguns segundos pela reconexão. Evite fazê-lo durante migrações ou clonagens.",
+    "rebootTitle": "Nomes persistentes e VFIO precisam de uma reinicialização",
+    "rebootBody": "Removendo ProxMenux's <code>10-proxmenux-*.link</code> ficheiros (<em>Nomes de Interface Persistentes</em>) e reversão <em>IOMMU/VFIO</em> não afetam o sistema de execução — eles só importam após uma reinicialização. ProxMenux define a bandeira de reinicialização automaticamente para estes.",
+    "perItemTitle": "Podes reverter uma coisa e ficar com o resto.",
+    "perItemBody": "O desinstalador opera por item. Se você só quiser remover Log2RAM, mas manter o ajuste de rede e mudanças bashrc, marque apenas <em>Log2RAM</em>. Nada mais é tocado, e o registro é atualizado em conformidade."
+  },
+  "inspect": {
+    "heading": "Inspecionar o registro manualmente",
+    "intro": "Se você quiser ver o que é rastreado sem abrir o menu:",
+    "outro": "Cada entrada <code>\"tool\": true</code> corresponde a algo ProxMenux aplicado e pode reverter. Remover uma entrada manualmente não é recomendado — use sempre o menu, que também executa a função reversão em vez de apenas esquecer a mudança.",
+    "reinstallTitle": "Reinstalar após desinstalar",
+    "reinstallBody": "Reverter uma otimização não impede que você a aplique mais tarde. Abra <link>o menu Post-Install</link> novamente e execute Automatizado ou Personalizável – o registro irá rastrear o novo estado."
+  },
+  "related": {
+    "heading": "Relacionado",
+    "items": [
+      {
+        "label": "Pós- instalação automatizada",
+        "href": "/docs/post-install/automated",
+        "tail": " — reaplicar a configuração de base recomendada."
+      },
+      {
+        "label": "Pós-instalação personalizável",
+        "href": "/docs/post-install/customizable",
+        "tail": " — escolher um subconjunto diferente."
+      },
+      {
+        "label": "Desinstalar ProxMenux",
+        "href": "/docs/settings/uninstall-proxmenux",
+        "tail": " — operação diferente: remove o ProxMenux em si, não as suas otimizações aplicadas."
+      },
+      {
+        "label": "Visão geral da pós-instalação",
+        "href": "/docs/post-install",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/pt/docs/post-install/updates.json b/web/messages/pt/docs/post-install/updates.json
new file mode 100644
index 00000000..8b856985
--- /dev/null
+++ b/web/messages/pt/docs/post-install/updates.json
@@ -0,0 +1,112 @@
+{
+  "meta": {
+    "title": "Aplicar atualizações disponíveis — Otimizações pós-instalação | Documentação ProxMenux",
+    "description": "Como o ProxMenux detecta quando uma otimização pós-instalação (Log2Ram, Configurações de Memória, Limites de Sistema, Logrotate, Ajuste de Rede...) foi atualizada a montante, e como aplicar a nova versão — do menu Post-Install ou do painel Monitor."
+  },
+  "header": {
+    "title": "Aplicar atualizações disponíveis",
+    "description": "Quando uma otimização pós-instalação (Log2Ram, definições de memória, limites do sistema, Logrotate…) tem uma versão no disco mais recente que a registada no host, o ProxMenux apresenta-a como atualização disponível. Pode aplicá-la pelo menu pós-instalação dos scripts ou pelo painel Monitor. Ambos executam novamente a mesma função e atualizam o registo.",
+    "section": "Configurações pós-instalação do Proxmox"
+  },
+  "intro": {
+    "title": "O que é isto?",
+    "body": "As otimizações pós-instalação ProxMenux têm versões, por exemplo <code>Log2ram SSD Protection v1.2</code>. O host regista as otimizações ativas e as suas versões em <code>/usr/local/share/proxmenux/installed_tools.json</code>. Quando uma nova versão ProxMenux atualiza uma otimização, deteta a diferença e propõe reaplicar só essa, sem repetir toda a pós-instalação."
+  },
+  "why": {
+    "heading": "Por que isto existe",
+    "body": "As otimizações pós-instalação recebem melhorias: ajustes sysctl, limites Logrotate mais rigorosos, novas regras de dimensão Log2RAM ou correções de casos extremos. Sem esta via, era necessário repetir o script, que reaplica <em>todas</em> as otimizações, ou abdicar da melhoria. Aplicar atualizações disponíveis permite escolher individualmente só as que mudaram de versão."
+  },
+  "detection": {
+    "heading": "Como as atualizações são detectadas",
+    "steps": [
+      {
+        "title": "Scripts com versão no disco",
+        "body": "Cada função pós-instalação declara sua versão dentro do script (<code>scripts/post_install/auto_post_install.sh</code> e <code>scripts/post_install/customizable_post_install.sh</code>). Um scanner extrai estas versões da fonte no disco."
+      },
+      {
+        "title": "Registo versionado na máquina",
+        "body": "Quando o operador aplicou cada otimização, a chamada <code>register_tool</code> correspondente escreveu a versão ativa em <code>/usr/local/share/proxmenux/installed_tools.json</code>. Esse arquivo é a fonte da verdade para \"o que está ativo neste host agora\"."
+      },
+      {
+        "title": "Monitor compara ambos os lados",
+        "body": "Na inicialização e a cada 24h, o Monitor compara versões de disco com versões de registro. Qualquer incompatibilidade produz uma entrada em <code>/usr/local/share/proxmenux/updates_available.json</code>. Esse arquivo dirige tanto a entrada de menu Post-Install quanto o cartão de painel Monitor."
+      },
+      {
+        "title": "Uma notificação por nova versão",
+        "body": "Se houver pelo menos uma atualização pendente, Monitor envia uma única notificação agrupada, por exemplo <em>«4 atualizações de otimizações ProxMenux disponíveis»</em>, com uma linha por ferramenta no formato <code>name (vX → vY)</code>, como nos pacotes Proxmox. Não a repete diariamente para o mesmo conjunto: só uma nova versão ou nova ferramenta na lista volta a ativá-la."
+      }
+    ]
+  },
+  "pathA": {
+    "heading": "Caminho A — Do menu pós- instalação",
+    "intro": "No menu principal ProxMenux, abra <strong>Configurações pós-instalação do Proxmox</strong>. Havendo atualizações pendentes, surge <strong>Aplicar atualizações disponíveis (N)</strong> acima de <em>Desinstalar otimizações</em>. O número indica quantas têm versão no disco mais recente que a registada. Se tudo estiver atualizado, a entrada fica oculta.",
+    "menuAlt": "Post-Install Scripts menu mostrando a entrada condicional 'Aplicar atualizações disponíveis (N)' posicionado logo acima 'Desinstalar otimizações', com o crachá de contagem indicando quantas otimizações têm uma versão mais recente no disco",
+    "menuCaption": "A entrada <em>Aplicar atualizações disponíveis (N)</em> só renderiza quando pelo menos uma otimização tem uma atualização pendente — ela esconde quando o host está atual.",
+    "checklistBody": "Abre uma lista com todas as atualizações pendentes no formato <code>name (vX → vY)</code>. Estão todas selecionadas por predefinição; desmarque as que não pretende aplicar agora.",
+    "checklistAlt": "Janela Aplicar atualizações disponíveis com uma linha por otimização pendente, nome e mudança de versão (atual → disponível). Todas as linhas estão selecionadas.",
+    "checklistCaption": "Escolha individualmente as otimizações a atualizar. O mesmo motor de Automatizado e Personalizável reaplica cada função em segundo plano e atualiza a versão registada."
+  },
+  "pathB": {
+    "heading": "Caminho B — Do painel do monitor",
+    "intro": "As mesmas atualizações aparecem em Monitor, em <link>Configurações → Otimizações ProxMenux</link>. A ficha mostra um <strong>contador de atualizações</strong> pendentes que abre o seletor por otimização. Cada ferramenta também tem a sua ação de atualização.",
+    "imageAlt": "Ficha Otimizações ProxMenux nas configurações Monitor com contador de atualizações pendentes que abre o seletor e ações de atualização por ferramenta",
+    "imageCaption": "A ficha Otimizações de Monitor permite aceder às atualizações pelo contador quando existe uma versão mais recente no disco, sem acesso à shell."
+  },
+  "applying": {
+    "heading": "O que acontece ao aplicar",
+    "steps": [
+      {
+        "title": "Repetir a função pós-instalação",
+        "body": "A função escolhida volta a ser executada no host. Como é <strong>idempotente</strong>, não duplica a configuração: substitui a versão anterior pela nova, incluindo ficheiros sysctl, configurações adicionais e unidades de serviços."
+      },
+      {
+        "title": "Atualiza o registro",
+        "body": "A chamada <code>register_tool</code> dentro da função escreve a nova versão em <code>installed_tools.json</code>. A próxima varredura não vê mais um descompasso e a entrada de atualização desaparece tanto do menu quanto do cartão Monitor."
+      },
+      {
+        "title": "Sem reiniciar, a menos que a função o diga",
+        "body": "A maioria das actualizações produz efeitos imediatamente. Atualizações que tocam módulos do kernel, nomes de interface persistentes ou VFIO mostram o mesmo prompt de reinicialização que uma nova instalação seria."
+      },
+      {
+        "title": "Actualizar o registo enviado para o Monitor",
+        "body": "No fim do lote, o menu envia um pedido POST a <code>http://127.0.0.1:8008/api/updates/post-install/scan</code> para reconstruir <code>/usr/local/share/proxmenux/updates_available.json</code>. Após aplicar todas as atualizações, desaparecem o contador da ficha Otimizações e a entrada condicional da shell, sem esperar pelo próximo scan. A ficha continua disponível."
+      }
+    ],
+    "jqTitle": "jq é necessário",
+    "jqBody": "A lista de verificação Caminho A baseia-se em <code>jq</code> para processar as atualizações pendentes JSON. Se o <code>jq</code> estiver faltando, o fluxo sai silenciosamente — você verá a entrada do menu com uma contagem, mas nada aconteceria depois de escolher linhas. Em qualquer instalação moderna Proxmox <code>jq</code> está presente; se em dúvida executar <code>apt install -y jq</code>."
+  },
+  "differs": {
+    "heading": "Como difere dos outros caminhos",
+    "headerPath": "Path",
+    "headerScope": "Escopo",
+    "headerWhen": "Quando faz sentido",
+    "rows": [
+      {
+        "pathLabel": "Automatizado",
+        "pathHref": "/docs/post-install/automated",
+        "scope": "Reaplica <em>todas</em> as otimizações do conjunto.",
+        "when": "Host novo ou reaplicação completa da base de um nó totalmente gerido."
+      },
+      {
+        "pathLabel": "Personalizável",
+        "pathHref": "/docs/post-install/customizable",
+        "scope": "Escolha no catálogo completo.",
+        "when": "Escolher exatamente as otimizações ativas no host."
+      },
+      {
+        "pathLabel": "Aplicar atualizações disponíveis",
+        "pathHref": null,
+        "scope": "Só as otimizações com versão mais recente no disco.",
+        "when": "Mantenha as otimizações já instaladas atuais sem tocar no resto."
+      },
+      {
+        "pathLabel": "Desinstalar otimizações",
+        "pathHref": "/docs/post-install/uninstall",
+        "scope": "Inverta a otimização e remova sua entrada de registro.",
+        "when": "Retroceda uma mudança específica."
+      }
+    ]
+  },
+  "notifTitle": "Controlo da notificação",
+  "notifBody": "O evento <em>Atualizações de otimizações ProxMenux disponíveis</em> anuncia as atualizações pendentes. Está ativo por predefinição em cada canal e pode ser silenciado por canal em <link>Configurações → Notificações</link>. Só dispara uma vez por conjunto diferente de atualizações, não em cada scan de 24 horas."
+}
diff --git a/web/messages/pt/docs/post-install/virtualization.json b/web/messages/pt/docs/post-install/virtualization.json
new file mode 100644
index 00000000..768d5676
--- /dev/null
+++ b/web/messages/pt/docs/post-install/virtualization.json
@@ -0,0 +1,116 @@
+{
+  "meta": {
+    "title": "Pós-instalação: Virtualização | Documentação ProxMenux",
+    "description": "Opções de virtualização no script pós-instalação personalizável ProxMenux: auto-instale o agente convidado certo se o Proxmox correr dentro de um VM, e habilite o IOMMU / VFIO para que você possa passar dispositivos PCI (GPUs, NICs, HBAS) através de suas próprias VMs."
+  },
+  "header": {
+    "title": "Post-Install: Virtualização",
+    "section": "Configurações pós-instalação do Proxmox"
+  },
+  "intro": {
+    "title": "O que esta categoria abrange",
+    "body": "Duas opções independentes. <strong>Instalar o agente convidado adequado</strong> ajuda quando o próprio Proxmox corre dentro de outro hipervisor. <strong>Ativar suporte VFIO IOMMU</strong> interessa à maioria dos utilizadores: ativa as funções do kernel para atribuir diretamente uma GPU, HBA ou placa de rede a uma VM com desempenho quase nativo."
+  },
+  "guestAgent": {
+    "heading": "Instale o agente convidado relevante",
+    "intro": "Deteta o ambiente de virtualização do host Proxmox através de <code>systemd-detect-virt</code> e <code>dmidecode</code> e instala as ferramentas de convidado adequadas para comunicar com o hipervisor externo: encerramento ordenado, sincronização do relógio, informação de IP, etc.",
+    "headerDetected": "Máquina detectada",
+    "headerPackage": "Pacote instalado",
+    "rows": [
+      {
+        "detected": "QEMU / KVM",
+        "package": "qemu-guest-agent"
+      },
+      {
+        "detected": "VMware (ESXi, Workstation)",
+        "package": "open-vm-tools"
+      },
+      {
+        "detected": "VirtualBox",
+        "package": "virtualbox-guest-utils"
+      },
+      {
+        "detected": "Hardware físico (nenhum)",
+        "package": "— no-op, nada instalado"
+      }
+    ],
+    "skipTitle": "Ignore esta opção se o Proxmox correr diretamente no hardware",
+    "skipBody": "Se o Proxmox for executado diretamente no hardware (o caso comum), assinalar esta opção é um no-op — o detector devolve <code>none</code> e o script sai sem alterações. A opção só importa para a minoria de configurações que executam Proxmox <em> como um guest</em> para testes ou laboratórios."
+  },
+  "vfio": {
+    "heading": "Habilitar suporte VFIO IOMMU",
+    "intro": "Ativa IOMMU no host e carrega os módulos para passthrough PCI (<code>vfio</code>, <code>vfio_iommu_type1</code>, <code>vfio_pci</code>). Pode então atribuir um dispositivo físico a uma VM, que terá acesso direto com desempenho quase nativo.",
+    "whoTitle": "Quem precisa disto?",
+    "whoItems": [
+      "Quer atribuir uma GPU a uma VM Windows para jogos ou a uma VM macOS.",
+      "Você tem um NIC de 10G dedicado para um firewall/roteador VM (OPNsense, pfSense).",
+      "Você quer passar um HBA diretamente para um TrueNAS / Unraid VM para ZFS em discos nus.",
+      "Você está planejando usar <em>Coral TPU</em>, uma placa de captura, ou um dongle SDR em um VM."
+    ],
+    "whoOutro": "Se nada disso se aplicar, você pode ignorar esta opção com segurança. Para passagem para um <strong>LXC</strong> (não um VM), o IOMMU <em>não</em> é necessário.",
+    "doesTitle": "O que o ProxMenux faz",
+    "doesIntro": "A função está ciente de boot-loader: detecta se Proxmox está em ZFS (systemd-boot) ou LVM/ext4 (GRUB) e escreve para o arquivo direito. Também é idempotente — se os parâmetros já estão presentes, nada é adicionado.",
+    "headerBoot": "Tipo de arranque",
+    "headerFile": "Ficheiro alterado",
+    "headerPost": "Passo de pós- atualização",
+    "bootRows": [
+      {
+        "boot": "systemd-boot (ZFS)",
+        "file": "/etc/kernel/cmdline",
+        "post": "proxmox-boot-tool refresh"
+      },
+      {
+        "boot": "GRUB (LVM/ext4)",
+        "file": "/etc/default/grub",
+        "post": "update-grub"
+      }
+    ],
+    "kernelIntro": "Parâmetros do kernel adicionados:",
+    "modulesIntro": "Módulos de kernel adicionados ao <code>/etc/modules</code>:",
+    "blacklistIntro": "Conflitantes drivers na lista negra em <code>/etc/modprobe.d/blacklist.conf</code>:",
+    "blacklistTitle": "A lista negra de drivers GPU entra em conflito com o uso do GPU no lado do host",
+    "blacklistBody": "A lista de bloqueio impede o kernel do host de associar <em>qualquer</em> controlador GPU, permitindo ao VFIO assumir a GPU. É o pretendido para passthrough a uma VM, mas é o <strong>oposto</strong> do necessário para <link>instalar controladores NVIDIA no host</link>, por exemplo para transcodificação LXC. Escolha um caminho por GPU:",
+    "pathItems": [
+      "<strong>GPU → VM:</strong> habilite VFIO/IOMMU aqui, deixe os drivers GPU na lista negra.",
+      "<strong>GPU → LXC (ou host):</strong> ignore esta opção, use a instalação NVIDIA no host e não bloqueie nvidia/nouveau.",
+      "<strong>Dois GPUs:</strong> um pode ir para um VM e o outro para um LXC, mas você precisará de uma configuração mais fina (ligar apenas um cartão para <code>vfio-pci</code> por ID PCI). A lista negra padrão é muito ampla para este caso — edite <code>blacklist.conf</code> depois."
+    ],
+    "acsTitle": "Sobre o pcie_acs_override — saiba o que está habilitando",
+    "acsBody": "<code>pcie_acs_override=downstream,multifunction</code> relaxa a verificação dos Serviços de Controle de Acesso PCIe. Ele permite que o kernel divida grupos IOMMU que o firmware reporta como monolítico, que às vezes é a única maneira de passar através de um dispositivo de um grupo sem arrastar o resto. O trade-off é o isolamento reduzido <strong> entre dispositivos</strong>: um VM malicioso ou comprometido com passagem tem uma superfície de ataque maior via DMA. Tudo bem para um laboratório doméstico; pense duas vezes antes de habilitar um host que executa cargas de trabalho não confiáveis. Se você não precisar, remova esse token do <code>/etc/kernel/cmdline</code> ou <code>/etc/default/grub</code> após o script correr e execute novamente a etapa de atualização do carregador de inicialização.",
+    "rebootTitle": "Reinício necessário",
+    "rebootBody": "IOMMU, módulos VFIO e lista de bloqueio entram em vigor após regenerar initramfs e reiniciar. O script executa <code>update-initramfs -u -k all</code>, atualiza o carregador de arranque e indica «reinício necessário» para que Personalizável o proponha no fim.",
+    "verifyTitle": "Verificação após reiniciar",
+    "revertTitle": "Reversível do menu Desinstalar",
+    "revertBody": "<link>Desinstalar otimizações</link> reverte todas as alterações: remove os parâmetros IOMMU de <code>/etc/kernel/cmdline</code> ou GRUB, os módulos VFIO de <code>/etc/modules</code> e as entradas de bloqueio dos controladores, depois reconstrói initramfs. É necessário reiniciar para aplicar a reversão."
+  },
+  "related": {
+    "heading": "Relacionado",
+    "items": [
+      {
+        "label": "Adicionar GPU à VM (passthrough)",
+        "href": "/docs/hardware/gpu-vm-passthrough",
+        "tail": " — passo seguinte natural uma vez activado o IOMMU + VFIO."
+      },
+      {
+        "label": "Adicionar Controlador ou NVMe ao VM",
+        "href": "/docs/disk-manager/add-controller-nvme-vm",
+        "tail": " — a mesma infra-estrutura de passagem para os controladores de armazenamento."
+      },
+      {
+        "label": "Comandos de passagem GPU",
+        "href": "/docs/help-info/gpu-commands",
+        "tail": " — Referência da verificação IOMMU."
+      },
+      {
+        "label": "Desinstalar otimizações",
+        "href": "/docs/post-install/uninstall",
+        "tail": " — reverter IOMMU / VFIO de forma limpa."
+      },
+      {
+        "label": "Pós-instalação personalizável",
+        "href": "/docs/post-install/customizable",
+        "tail": " — voltar ao menu superior."
+      }
+    ]
+  }
+}
diff --git a/web/messages/pt/docs/security/fail2ban.json b/web/messages/pt/docs/security/fail2ban.json
new file mode 100644
index 00000000..2c4c86f6
--- /dev/null
+++ b/web/messages/pt/docs/security/fail2ban.json
@@ -0,0 +1,152 @@
+{
+  "meta": {
+    "title": "Fail2Ban | Documentação do ProxMenux",
+    "description": "Instalar Fail2Ban com três jails sintonizado para Proxmox (SSH agressivo, Proxmox UI 8006, ProxMenux Monitor 8008). Inclui o journald MaxLevelStore correção, serviços de log personalizados para confiabilidade, backend nftables/iptables detectado automaticamente e SSH MaxAuthTries endurecimento.",
+    "ogTitle": "Fail2Ban | Documentação do ProxMenux",
+    "ogDescription": "Proteção contra força bruta para SSH e interfaces web Proxmox, com correções do journald e do backend específicas para Proxmox."
+  },
+  "header": {
+    "title": "Fail2Ban",
+    "description": "Instala Fail2Ban para Proxmox: três jails (SSH agressivo, interface Proxmox em 8006, ProxMenux Monitor em 8008 e proxy inverso), correção do nível do journald para guardar eventos SSH, dois serviços que copiam o journal para ficheiros para contornar um problema do backend systemd, deteção do backend de firewall e reforço SSH com MaxAuthTries.",
+    "section": "Segurança"
+  },
+  "intro": {
+    "title": "O que isto faz",
+    "body": "Instala Fail2Ban dos repositórios Debian e cria uma configuração Proxmox que protege de imediato SSH, interface web Proxmox e ProxMenux Monitor. Se detetar uma instalação existente, oferece um menu de gestão para reinstalar ou remover."
+  },
+  "firstLaunch": {
+    "heading": "Janela de primeiro lançamento",
+    "body": "Sem Fail2Ban instalado, o script resume num diálogo o que vai instalar e configurar. Cancelar termina sem alterações; confirmar inicia a instalação.",
+    "imageAlt": "Confirmação de instalação do Fail2Ban com três jails, correção do journald e reforço SSH"
+  },
+  "jails": {
+    "heading": "As três jails",
+    "headerJail": "Jail",
+    "headerProtects": "Protege",
+    "headerRetries": "Tentativas / Janela",
+    "headerBan": "Duração do bloqueio",
+    "rows": [
+      {
+        "jail": "[sshd]",
+        "protects": "SSH (modo aggressive — inclui ddos, mode, normal)",
+        "retries": "2 / 60 min",
+        "ban": "9 horas"
+      },
+      {
+        "jail": "[proxmox]",
+        "protects": "Interface web do Proxmox (porta 8006)",
+        "retries": "3 / 10 min",
+        "ban": "1 hora"
+      },
+      {
+        "jail": "[proxmenux]",
+        "protects": "ProxMenux Monitor (porta 8008 + proxy inverso http/https)",
+        "retries": "3 / 10 min",
+        "ban": "1 hora"
+      }
+    ],
+    "outro": "Defaults globais de <code>jail.local</code>: <code>ignoreip = 127.0.0.1/8 ::1</code>, <code>ignoreself = true</code>,<code> bantime = 86400</code> (fallback de 24h para prisões que não o sobrepõem), <code>maxretry = 2</code>, <code>findtime = 1800</code>."
+  },
+  "journald": {
+    "heading": "Por que a correção journald é importante",
+    "intro": "O Proxmox fornece <code>/etc/systemd/journald.conf</code> com <codeNw>MaxLevelStore=warning</codeNw>. O journald descarta as mensagens de nível <em>inferior</em> a warning antes de as guardar. SSH e PAM emitem falhas de autenticação nos níveis <em>info</em> / <em>notice</em>, pelo que:",
+    "diagram": {
+      "sshLabel": "SSH / PAM",
+      "sshDetail": "falha de autenticação\n(nível info / notice)",
+      "journaldLabel": "journald",
+      "journaldDetail": "MaxLevelStore=warning\n→ evento descartado sem aviso",
+      "fail2banLabel": "Fail2Ban",
+      "fail2banDetail": "não vê nada\n→ nunca proíbe nada",
+      "arrowLabel": "Proxmox por omissão"
+    },
+    "afterDiagram": "O instalador detecta isso e escreve um drop-in em <codeXs>/etc/systemd/journald.conf.d/proxmenux-loglevel.conf</codeXs> elevando tanto <code>MaxLevelStore</code> quanto <code>MaxLevelSyslog</code> para <code>info</code>:",
+    "code": "[Journal]\nMaxLevelStore=info\nMaxLevelSyslog=info",
+    "outro": "Em seguida, reinicia <code>systemd-journald</code>. O drop-in é removido ao desinstalar, restaurando o padrão original do Proxmox."
+  },
+  "loggers": {
+    "heading": "Porquê dois serviços de registo personalizado",
+    "intro1": "O Fail2Ban pode ler diretamente o journal do systemd (<code>backend = systemd</code>), mas no Proxmox este backend tem problemas conhecidos com processos worker de <code>pvedaemon</code>: os eventos de autenticação aparecem no journal mas nem sempre são detetados. O problema também afeta ocasionalmente <code>sshd</code>.",
+    "intro2": "O ProxMenux cria dois pequenos serviços systemd que acompanham as unidades relevantes com <code>journalctl -f</code> e acrescentam cada linha a um ficheiro. O Fail2Ban lê esses ficheiros com o fiável <code>backend = auto</code> (modo ficheiro):",
+    "headerService": "Serviço",
+    "headerSource": "Unidade de origem",
+    "headerOutput": "Ficheiro de saída",
+    "rows": [
+      {
+        "service": "proxmox-auth-logger.service",
+        "source": "pvedaemon.service",
+        "output": "/var/log/proxmox-auth.log"
+      },
+      {
+        "service": "ssh-auth-logger.service",
+        "source": "ssh.service",
+        "output": "/var/log/ssh-auth.log"
+      }
+    ],
+    "outro": "Ambos os serviços são declarados <code>PartOf=fail2ban.service</code> para que eles reiniciar com Fail2Ban e parar com ele. Modo 640 de propriedade do <code>root:adm</code> nos arquivos de log. O terceiro log usado pela cadeia <code>[proxmenux]</code> (<code>/var/log/proxmenux-auth.log</code>) é escrito diretamente pelo aplicativo ProxMenux Monitor Flask — nenhum serviço de registrador necessário para esse."
+  },
+  "backend": {
+    "heading": "Deteção automática do backend de firewall",
+    "intro": "O instalador sonda o host: se o <code>nft list ruleset</code> funcionar, ele escolhe o <code>nftables</code> como ação de ban. Caso contrário, volta para <code>iptables-multiport</code> / <code>iptables-allports</code>. A escolha é escrita em <code>jail.local</code>:",
+    "code": "# nftables host\nbanaction = nftables\nbanaction_allports = nftables[type=allports]\n\n# iptables host (fallback)\nbanaction = iptables-multiport\nbanaction_allports = iptables-allports"
+  },
+  "hardening": {
+    "heading": "Reforço SSH: MaxAuthTries",
+    "intro": "O controlo Lynis <strong>SSH-7408</strong> recomenda <code>MaxAuthTries 3</code> em <code>sshd_config</code>. A jail SSH utiliza <code>maxretry = 2</code> para bloquear após falhas repetidas; MaxAuthTries limita as tentativas numa ligação. Este ajuste SSH acrescenta defesa em profundidade, mesmo quando Fail2Ban está parado para manutenção.",
+    "installerIntro": "O instalador:",
+    "items": [
+      "Lê o valor atual do <code>MaxAuthTries</code> (ou padrão para 6 se ausente).",
+      "Guarda-o em <code>/usr/local/share/proxmenux/sshd_maxauthtries_backup</code>.",
+      "Edita <code>sshd_config</code> diretamente: substitui a linha existente, remove o comentário da linha comentada ou acrescenta uma nova.",
+      "Recarrega o <code>sshd</code> (recarregar, não reiniciar, para manter as sessões existentes vivas)."
+    ],
+    "outro": "Na desinstalação, o valor original salvo é restaurado e <code>sshd</code> é recarregado novamente."
+  },
+  "manage": {
+    "heading": "Gerenciar uma instalação existente",
+    "intro": "Se o Fail2Ban já estiver instalado quando você abrir o menu, o script detecta-o e mostra um menu de gerenciamento em vez de repetir o instalador:",
+    "headerAction": "Ação",
+    "headerWhat": "O que ele faz",
+    "rows": [
+      {
+        "action": "Reinstalar",
+        "what": "Repete a instalação completa e reescreve todas as jails com os valores atuais do ProxMenux. Utilize quando uma atualização alterar as recomendações."
+      },
+      {
+        "action": "Remover",
+        "what": "Para fail2ban e os dois serviços de registro, limpa o pacote apt, remove todos os jail / arquivos de filtro, exclui o drop-in journald (restaurando o padrão do Proxmox) e restaura o SSH original MaxAuthTries."
+      }
+    ]
+  },
+  "verify": {
+    "heading": "Verifica se está a funcionar.",
+    "intro": "Após a instalação, comandos úteis da máquina:",
+    "code": "# Service status and version\nsystemctl status fail2ban\nfail2ban-client --version\n\n# All active jails\nfail2ban-client status\n\n# Detail on one jail\nfail2ban-client status sshd\nfail2ban-client status proxmox\nfail2ban-client status proxmenux\n\n# Currently banned IPs in a jail\nfail2ban-client status sshd | grep \"Banned IP\"\n\n# Manually unban an IP (use this if you ban yourself)\nfail2ban-client unban 192.0.2.10\n\n# Tail the auth logs Fail2Ban watches\ntail -f /var/log/ssh-auth.log\ntail -f /var/log/proxmox-auth.log\ntail -f /var/log/fail2ban.log"
+  },
+  "troubleshoot": {
+    "heading": "Resolução de Problemas",
+    "neverBansTitle": "O Fail2Ban é executado mas nunca proíbe nada",
+    "neverBansBody": "Verifique se <code>tail -f /var/log/ssh-auth.log</code> recebe uma entrada após uma tentativa SSH com palavra-passe errada a partir de outra máquina. Caso contrário, consulte <code>systemctl status ssh-auth-logger.service</code>. Se o serviço estiver ativo, veja os eventos recentes com <code>journalctl -u ssh.service -n 50 --no-pager -p info</code> e confirme que o complemento journald permite o nível <em>info</em>.",
+    "monitorEmptyTitle": "A jail ProxMenux Monitor não tem entradas mesmo após inícios de sessão falhados",
+    "monitorEmptyBody": "O <code>[proxmenux]</code> jail lê <code>/var/log/proxmenux-auth.log</code>, que é escrito pelo aplicativo ProxMenux Monitor Flask — não por um criador de logs journald. Se você não executar o Monitor, o arquivo permanecerá vazio e o jail nunca será acionado. Isso é esperado; a configuração jail é inofensiva. Se você executar o Monitor e o log estiver vazio, verifique a configuração de registro do Flask.",
+    "selfBanTitle": "Eu bani-me.",
+    "selfBanIntro": "A partir de uma consola / IPMI / iKVM (ou de outro IP autorizado):",
+    "selfBanCode": "fail2ban-client unban '<'YOUR_IP'>'\n\n# To prevent it next time, edit /etc/fail2ban/jail.local and add your IP:\nignoreip = 127.0.0.1/8 ::1 192.168.1.0/24 203.0.113.42\n\n# Then reload\nfail2ban-client reload",
+    "aptFailTitle": "O apt-get falha: ''Unable to locate package fail2ban''",
+    "aptFailBody": "O host está faltando o Debian repos (comum nas instalações do 'barebones' Proxmox). O instalador detecta isso e escreve <code>/etc/apt/sources.list.d/debian.sources</code> com o codinome certo (<code>bookworm</code> / <code>trixie</code>) antes de tentar novamente. Se ainda falhar, verifique <code>/etc/os-release</code> para <code>VERSION_CODENAME</code> e confirme que o URL do repo está acessível.",
+    "lockoutTitle": "SSH me bloqueia depois de instalar",
+    "lockoutBody": "O instalador define <code>MaxAuthTries=3</code>. Se seu gerenciador de senhas / agente repetir várias chaves, você pode exceder isso em uma única tentativa de conexão. Limite as chaves oferecidas: <code>ssh -o IdentitiesOnly=yes -i ~/.ssh/specific_key user@host</code>. Ou aumentar temporariamente o <code>MaxAuthTries</code> em <code>sshd_config</code> enquanto você depura."
+  },
+  "files": {
+    "heading": "Ficheiros gravados",
+    "code": "/etc/fail2ban/jail.local                              # global defaults + [sshd]\n/etc/fail2ban/jail.d/proxmox.conf                     # [proxmox]\n/etc/fail2ban/jail.d/proxmenux.conf                   # [proxmenux]\n/etc/fail2ban/filter.d/proxmox.conf                   # auth-failure regex for pvedaemon\n/etc/fail2ban/filter.d/proxmenux.conf                 # auth-failure regex for Monitor\n/etc/systemd/system/proxmox-auth-logger.service       # journal → file (pvedaemon)\n/etc/systemd/system/ssh-auth-logger.service           # journal → file (sshd)\n/etc/systemd/journald.conf.d/proxmenux-loglevel.conf  # MaxLevelStore=info\n/etc/ssh/sshd_config                                  # MaxAuthTries=3 (in-place edit)\n/var/log/proxmox-auth.log                             # written by logger service\n/var/log/ssh-auth.log                                 # written by logger service\n/var/log/proxmenux-auth.log                           # written by Monitor Flask app\n/usr/local/share/proxmenux/sshd_maxauthtries_backup   # for restore on uninstall"
+  },
+  "related": {
+    "heading": "Relacionado",
+    "monitorLabel": "ProxMenux Monitor → Guia de segurança",
+    "monitorTail": " — instalação pelo painel, estado das jails em direto, IPs bloqueados e ajuste de tentativas e duração do bloqueio por jail no navegador.",
+    "lynisLabel": "Lynis",
+    "lynisTail": " — execute uma auditoria antes e depois para confirmar que o controlo SSH-7408 é cumprido.",
+    "securityLabel": "Visão geral da segurança",
+    "securityTail": " — voltar ao panorama da secção."
+  }
+}
diff --git a/web/messages/pt/docs/security/index.json b/web/messages/pt/docs/security/index.json
new file mode 100644
index 00000000..5dfb80b8
--- /dev/null
+++ b/web/messages/pt/docs/security/index.json
@@ -0,0 +1,70 @@
+{
+  "meta": {
+    "title": "Segurança do Proxmox — Fail2Ban e auditoria de reforço com Lynis | ProxMenux",
+    "description": "Duas ferramentas de segurança para Proxmox VE: Fail2Ban (prevenção de intrusões para SSH, interface web do Proxmox e ProxMenux Monitor) e Lynis (auditoria de segurança e reforço do sistema, instalado a partir do repositório original no GitHub).",
+    "ogTitle": "Segurança do Proxmox — Fail2Ban e auditoria de reforço com Lynis",
+    "ogDescription": "Fail2Ban e Lynis para Proxmox VE: prevenção de intrusões e auditoria de reforço, instalados e geridos pelo ProxMenux.",
+    "twitterTitle": "Segurança do Proxmox | ProxMenux",
+    "twitterDescription": "Fail2Ban e Lynis para Proxmox VE: prevenção de intrusões e auditoria de reforço."
+  },
+  "header": {
+    "title": "Segurança",
+    "description": "Duas ferramentas complementares para Proxmox VE: defesa ativa (Fail2Ban bloqueia IPs que atacam SSH ou interfaces web) e auditoria local (Lynis procura falhas de reforço e dá uma pontuação de 0 a 100). Cada ferramenta tem o seu menu de instalação e gestão, com deteção de instalações existentes antes de agir.",
+    "section": "Segurança"
+  },
+  "intro": {
+    "title": "Defesa ativa e auditoria local",
+    "body": "Respondem a perguntas diferentes. <strong>Fail2Ban</strong> responde a <em>«Estamos a ser atacados agora?»</em> observando os registos de autenticação e bloqueando os IPs responsáveis. <strong>Lynis</strong> responde a <em>«Qual é o nível de reforço deste anfitrião?»</em> através de uma auditoria pontual com recomendações concretas. Utilize ambos: Lynis indica o que melhorar e Fail2Ban reage aos ataques em curso."
+  },
+  "opening": {
+    "heading": "Abrir o menu",
+    "body": "No menu principal do ProxMenux selecione <strong>Segurança</strong>. Verá o seguinte:",
+    "imageAlt": "Menu de segurança com opções Fail2Ban e Lynis"
+  },
+  "pick": {
+    "heading": "Escolha sua ferramenta",
+    "body": "As duas ferramentas de segurança são independentes — instale uma, ambas ou nenhuma. Cada carta abaixo salta para a seção que explica a ferramenta em detalhes."
+  },
+  "cards": {
+    "fail2ban": {
+      "title": "Fail2Ban",
+      "body": "Prevenção ativa de intrusões. Observa os registos de autenticação SSH e web e bloqueia IPs após falhas repetidas.",
+      "bullets": [
+        "Três jails: SSH, interface Proxmox (8006), ProxMenux Monitor (8008)",
+        "Corrige as predefinições do journald no Proxmox que bloqueiam os registos de autenticação",
+        "Detecta automaticamente nftables / iptables",
+        "Endurecimento de SSH: MaxAuthTries=3 (recomendação Lynis)"
+      ]
+    },
+    "lynis": {
+      "title": "Lynis",
+      "body": "Auditor local de segurança. Analisa o anfitrião e apresenta uma pontuação de reforço e sugestões concretas de correção.",
+      "bullets": [
+        "Instalado a partir do repositório original da CISOfy no GitHub (versão mais recente)",
+        "Pontuação de reforço 0–100 e lista de avisos e sugestões",
+        "Auditoria e atualização através do menu",
+        "Concebido apenas para leitura: nunca altera o sistema"
+      ]
+    }
+  },
+  "workflowTip": {
+    "title": "Fluxo de trabalho que utiliza ambos",
+    "body": "Execute primeiro Lynis para conhecer a pontuação inicial e as principais recomendações. Aplique as correções desejadas. Depois instale Fail2Ban: implementa automaticamente a proteção SSH contra força bruta e ajusta <code>MaxAuthTries</code> em <code>sshd_config</code> para cumprir o controlo SSH-7408. Execute Lynis novamente para verificar a melhoria."
+  },
+  "fail2banSection": {
+    "heading": "Fail2Ban",
+    "body": "O ProxMenux instala Fail2Ban com uma configuração específica para Proxmox. Além da jail SSH padrão, protege a interface web Proxmox e o ProxMenux Monitor. Contorna dois problemas específicos: uma predefinição do journald que descarta eventos de autenticação e um problema do backend systemd que impede a leitura fiável de certas fontes do registo. A página detalhada explica a instalação, as três jails, a correção do journald, o reforço SSH e a resolução de problemas.",
+    "optionTitle": "Fail2Ban — instalar e gerenciar",
+    "optionDescription": "Três jails pré-configuradas (sshd agressivo, interface Proxmox em 8006, ProxMenux Monitor em 8008 e proxy inverso), deteção de nftables/iptables, correção do journald e reforço SSH com MaxAuthTries."
+  },
+  "lynisSection": {
+    "heading": "Lynis",
+    "body": "O ProxMenux clona Lynis de <code>github.com/CISOfy/lynis</code> para <code>/opt/lynis</code> e disponibiliza-o como <code>/usr/local/bin/lynis</code>. Evita o pacote Debian porque está várias versões principais atrás do projeto original. A página detalhada explica instalação, auditoria, atualização, desinstalação, leitura do relatório e ações sobre os resultados.",
+    "optionTitle": "Lynis — instalar, auditar e gerenciar",
+    "optionDescription": "Instala a versão mais recente do Lynis a partir do repositório oficial CISOfy no GitHub (em vez do pacote Debian mais antigo), executa auditorias com pontuação de reforço e atualiza através de git pull."
+  },
+  "componentStatus": {
+    "heading": "Estado do componente",
+    "body": "Ambos os instaladores registram seu estado em <code>/usr/local/share/proxmenux/components_status.json</code> na categoria <code>security</code>. ProxMenux usa este arquivo para decidir se deve mostrar a instalação ou o menu de gerenciamento em sequências, e os mesmos dados alimentam os painéis no ProxMenux Monitor quando presente."
+  }
+}
diff --git a/web/messages/pt/docs/security/lynis.json b/web/messages/pt/docs/security/lynis.json
new file mode 100644
index 00000000..4054e6b4
--- /dev/null
+++ b/web/messages/pt/docs/security/lynis.json
@@ -0,0 +1,170 @@
+{
+  "meta": {
+    "title": "Lynis | Documentação do ProxMenux",
+    "description": "Instale a versão mais recente do Lynis do repositório oficial CISOfy no GitHub, execute uma auditoria com pontuação de reforço de 0 a 100 e atualize através de git pull. Auditor apenas de leitura: não altera o sistema.",
+    "ogTitle": "Lynis | Documentação do ProxMenux",
+    "ogDescription": "Instale e execute Lynis no Proxmox VE. Instalação do repositório original GitHub, auditoria e atualização."
+  },
+  "header": {
+    "title": "Lynis",
+    "description": "Clona a versão mais recente do Lynis do repositório oficial CISOfy no GitHub, disponibiliza-a como /usr/local/bin/lynis e oferece auditoria, atualização, reinstalação e desinstalação no menu. O auditor apenas lê e apresenta resultados sem alterar o sistema.",
+    "section": "Segurança"
+  },
+  "intro": {
+    "title": "O que isto faz",
+    "body": "Instala Lynis, o auditor de segurança de código aberto da CISOfy, do repositório GitHub em <code>/opt/lynis</code> e cria um lançador em <code>/usr/local/bin/lynis</code> para o disponibilizar no <code>PATH</code>. Se detetar uma instalação existente, apresenta um menu de auditoria, atualização, reinstalação ou remoção."
+  },
+  "manageMenu": {
+    "heading": "Menu de gestão (após a instalação)",
+    "intro": "Uma vez instalado o Lynis, cada invocação subsequente abre o menu de gerenciamento em vez de repetir o instalador. A partir daqui você inicia uma auditoria, atualização via git pull, reinstalar ou desinstalar:",
+    "imageAlt": "Menu de gerenciamento do Lynis com as opções de auditoria, atualização, reinstalação e remoção"
+  },
+  "whyUpstream": {
+    "heading": "Porquê o repositório oficial GitHub em vez de apt",
+    "intro": "O Debian distribui Lynis através de apt, mas o pacote costuma estar várias versões principais atrás do projeto original. Novos controlos, correções de novos vetores de ataque e recomendações melhoradas chegam primeiro ao GitHub. Lynis é um script shell autónomo, sem compilação nem dependências de instalação além de <code>git</code>; clonar o repositório é o método recomendado pela CISOfy.",
+    "headerSource": "Origem",
+    "headerPath": "Install path",
+    "headerUpdate": "Método de atualização",
+    "headerFresh": "Atualidade da versão",
+    "rows": [
+      {
+        "sourceRich": "<strong>ProxMenux (este programa)</strong>",
+        "path": "/opt/lynis/",
+        "update": "git pull (no menu)",
+        "fresh": "Versão mais recente do projeto original"
+      },
+      {
+        "sourceRich": "<strong>Debian apt</strong>",
+        "path": "/usr/bin/lynis",
+        "update": "apt upgrade",
+        "fresh": "Muitas vezes meses / anos atrás"
+      }
+    ]
+  },
+  "install": {
+    "heading": "Como funciona a instalação",
+    "node1Label": "github.com/CISOfy/lynis",
+    "node1Detail": "git clone\n(instale git primeiro, se faltar)",
+    "node2Label": "/opt/lynis/",
+    "node2Detail": "repositório completo\nincluindo o script ./lynis",
+    "node3Label": "/usr/local/bin/lynis",
+    "node3Detail": "lançador:\ncd /opt/lynis && ./lynis $@",
+    "outro": "O lançador é necessário: Lynis precisa de ser executado no próprio diretório porque utiliza caminhos relativos para plugins e perfis. O lançador esconde esse detalhe e permite que <code>lynis audit system</code> funcione a partir de qualquer diretório."
+  },
+  "detection": {
+    "heading": "Caminhos de detecção",
+    "intro": "Antes de mostrar o menu, o script verifica três locais para decidir se Lynis já está presente:",
+    "items": [
+      "<code>/usr/local/bin/lynis</code> — invólucro instalado por ProxMenux",
+      "<code>/opt/lynis/lynis</code> — caminho direto (caso o invólucro tenha sido removido)",
+      "<code>/usr/bin/lynis</code> — versão apt-instalada, se o usuário a instalou dessa forma anteriormente"
+    ],
+    "outro": "Se encontrar um destes caminhos, abre o menu de gestão. O script <strong>não</strong> desinstala Lynis instalado por apt; remove apenas o que gere em <code>/opt/lynis</code> e o respetivo lançador."
+  },
+  "audit": {
+    "heading": "Executar uma auditoria",
+    "intro": "No menu de gestão escolha <strong>Executar auditoria de segurança agora</strong>. Equivale a executar:",
+    "code": "lynis audit system --no-colors",
+    "outro": "A auditoria demora de 30 segundos a alguns minutos conforme a dimensão do anfitrião. A saída aparece diretamente no terminal, sem animação de espera. Lynis organiza os controlos por categoria e marca cada teste como <ok>[ OK ]</ok>, <warn>[ WARNING ]</warn> ou <sugg>[ SUGGESTION ]</sugg>. O resumo final apresenta os números principais:",
+    "summary": "================================================================================\n\n  Lynis security scan details:\n\n  Hardening index : 76 [############        ]\n  Tests performed : 247\n  Plugins enabled : 0\n\n  Components:\n  - Firewall               [V]\n  - Malware scanner        [X]\n\n  Lynis modules:\n  - Compliance status      [?]\n  - Security audit         [V]\n  - Vulnerability scan     [V]\n\n================================================================================"
+  },
+  "report": {
+    "heading": "Ler o relatório",
+    "intro": "As duas seções importantes são <strong>Avisos</strong> (coisas que você deve corrigir em breve) e <strong>Sugestão</strong> (recomendações para melhorar o endurecimento). Cada item carrega um ID de controle como <code>SSH-7408</code> — útil ao pesquisar os documentos Lynis para a lógica e a correção.",
+    "headerMarker": "Marcador",
+    "headerMeaning": "Significado",
+    "headerAction": "Ação",
+    "rows": [
+      {
+        "markerRich": "<strong>OK</strong>",
+        "meaning": "Passado o teste",
+        "action": "Nada."
+      },
+      {
+        "markerRich": "<strong>WARNING</strong>",
+        "meaning": "Problema real, correção recomendada",
+        "action": "Leia a descrição do controle, planeje uma correção"
+      },
+      {
+        "markerRich": "<strong>SUGGESTION</strong>",
+        "meaning": "Melhoria do endurecimento disponível",
+        "action": "Aplicar se se encaixa no seu modelo de ameaça"
+      }
+    ],
+    "outro": "Relatório completo e dados legíveis por máquina são escritos para <code>/var/log/lynis.log</code> e <code>/var/log/lynis-report.dat</code> pelo próprio Lynis."
+  },
+  "pairFail2ban": {
+    "title": "Combinar com Fail2Ban",
+    "body": "SSH-7408 (MaxAuthTries) é uma das advertências mais comuns. Instalar o <link>Fail2Ban</link> da ProxMenux o limpa automaticamente porque o instalador configura o <code>MaxAuthTries=3</code> como parte da sua etapa de endurecimento do SSH. Corra Lynis novamente depois para confirmar que o aviso se foi."
+  },
+  "update": {
+    "heading": "Actualizar o Lynis",
+    "body": "No menu, <strong>Atualizar Lynis para a versão mais recente</strong> executa <code>git pull --quiet</code> em <code>/opt/lynis</code>. Se o diretório existir mas não for uma cópia de trabalho Git, por exemplo após copiar ficheiros manualmente, o script reinstala por completo."
+  },
+  "reinstall": {
+    "heading": "Reinstalar / desinstalar",
+    "headerAction": "Ação",
+    "headerWhat": "O que ele faz",
+    "rows": [
+      {
+        "actionRich": "<strong>Reinstalar</strong>",
+        "whatRich": "Remove <code>/opt/lynis</code>, clona novamente do GitHub e recria o lançador. Utilize se a cópia local estiver danificada."
+      },
+      {
+        "actionRich": "<strong>Remover</strong>",
+        "whatRich": "Exclui <code>/opt/lynis</code> e <code>/usr/local/bin/lynis</code>. Os logs em <code>/var/log/lynis*</code> são mantidos (são histórico de auditoria). Um Lynis apt-instalado em <code>/usr/bin/lynis</code> é deixado intocado."
+      }
+    ]
+  },
+  "cli": {
+    "heading": "Opções CLI úteis",
+    "intro": "Uma vez instalado, Lynis pode ser invocado diretamente de uma shell com opções extras não expostas pelo menu:",
+    "code": "lynis show version            # version + build date\nlynis show commands           # list every available command\nlynis show details TEST-ID    # explain a specific control\nlynis audit system --quick    # skip slow tests (e.g. malware scan)\nlynis audit system --pentest  # treat host as untrusted (more aggressive)\nlynis update info             # check if a newer Lynis is available\n\n# Filter the report log for just the warnings\ngrep \"Warning\" /var/log/lynis.log\n\n# Same, for suggestions only\ngrep \"Suggestion\" /var/log/lynis.log"
+  },
+  "troubleshoot": {
+    "heading": "Resolução de Problemas",
+    "cloneTitle": "git clone falha durante a instalação",
+    "cloneBody": "O host precisa de acesso à rede e DNS para alcançar <code>github.com</code>. A partir de um console: <code>curl -sI https://github.com</code> e <code>git ls-remote https://github.com/CISOfy/lynis.git</code> irá revelar o erro real (DNS, TLS, proxy, URL repo). Se for necessário um proxy, defina <code>https_proxy</code> no ambiente antes de executar novamente o menu.",
+    "notFoundTitle": "lynis: comando não encontrado após a instalação",
+    "notFoundIntro": "O lançador <code>/usr/local/bin/lynis</code> não foi criado ou foi removido. A solução mais rápida é reinstalar a partir do menu. Correção manual:",
+    "notFoundCode": "cat > /usr/local/bin/lynis <<'EOF'\n#!/bin/bash\ncd /opt/lynis && ./lynis \"$@\"\nEOF\nchmod +x /usr/local/bin/lynis",
+    "sshTitle": "A auditoria mostra \"Warning: Test SSH-7408 — MaxAuthTries set incorrectly\"",
+    "sshIntro": "O servidor SSH permite demasiadas tentativas de autenticação por ligação. Instale o <link>Fail2Ban</link> do ProxMenux (que define o <code>MaxAuthTries=3</code> automaticamente) ou edite o <code>/etc/ssh/sshd_config</code> à mão:",
+    "sshCode": "sed -i 's/^#?MaxAuthTries.*/MaxAuthTries 3/' /etc/ssh/sshd_config\nsystemctl reload sshd",
+    "scoreTitle": "A pontuação caiu após uma atualização do Proxmox",
+    "scoreBody": "Executar <code>lynis update info</code> primeiro — uma atualização Lynis pode ter adicionado novos controles que sinalizam a configuração existente. Atualizar Lynis do menu, reauditar e abordar as novas descobertas."
+  },
+  "files": {
+    "heading": "Ficheiros gravados",
+    "code": "/opt/lynis/                   # full Lynis git checkout\n/usr/local/bin/lynis          # wrapper script (cd + exec)\n/var/log/lynis.log            # human-readable audit log (Lynis itself)\n/var/log/lynis-report.dat     # machine-readable report (Lynis itself)"
+  },
+  "sample": {
+    "heading": "Relatório de exemplo",
+    "intro": "O ProxMenux Monitor gera um PDF de várias páginas para cada execução do Lynis no <link>separador Segurança</link>. A primeira página resume a pontuação de reforço, informações do sistema e estado da segurança. As seguintes explicam cada aviso, ordenam sugestões por impacto e incluem o inventário de pacotes utilizado na auditoria.",
+    "imageAlt": "Primeira página do Lynis Security Audit Report PDF — resumo executivo com índice de endurecimento 71/100, bloco de informações do sistema e visão geral da postura de segurança com firewall, scanner de malware e contagem de pacotes instalados",
+    "captionPrefix": "Primeira página de um relatório de amostra. O PDF completo (",
+    "captionLink": "amostra",
+    "captionSuffix": ") continua com advertências detalhadas, sugestões e a lista de pacotes instalados.",
+    "cli": "No lado CLI os mesmos dados estão em <code>/var/log/lynis-report.dat</code> (arquivo plano legível por máquina) e <code>/var/log/lynis.log</code> (o log de execução legível por humanos). O PDF é gerado sob demanda pelo ProxMenux Monitor — executar o <code>lynis</code> a partir da linha de comando não produz um."
+  },
+  "related": {
+    "heading": "Relacionado",
+    "items": [
+      {
+        "href": "/docs/monitor/dashboard/security",
+        "label": "ProxMenux Monitor → Guia de segurança",
+        "tail": " — executar a auditoria, procurar relatórios históricos e baixar o PDF diretamente do painel."
+      },
+      {
+        "href": "/docs/security/fail2ban",
+        "label": "Fail2Ban",
+        "tailRich": " — implementa a proteção SSH à força bruta que Lynis recomenda."
+      },
+      {
+        "href": "/docs/security",
+        "label": "Visão geral da segurança",
+        "tail": " — voltar ao panorama da secção."
+      }
+    ]
+  }
+}
diff --git a/web/messages/pt/docs/security/ssl-letsencrypt.json b/web/messages/pt/docs/security/ssl-letsencrypt.json
new file mode 100644
index 00000000..3e8ba3c2
--- /dev/null
+++ b/web/messages/pt/docs/security/ssl-letsencrypt.json
@@ -0,0 +1,169 @@
+{
+  "meta": {
+    "title": "HTTPS para ProxMenux Monitor — certificado do anfitrião Proxmox ou caminhos personalizados | ProxMenux",
+    "description": "Disponibilize o ProxMenux Monitor por HTTPS com o certificado do anfitrião Proxmox (detetado automaticamente, incluindo Let’s Encrypt instalado pelo ACME do Proxmox) ou um certificado personalizado em qualquer caminho do disco.",
+    "ogTitle": "HTTPS para ProxMenux Monitor — Host Proxmox ou certificado personalizado",
+    "ogDescription": "Habilite o HTTPS na porta 8008 com o certificado de host Proxmox ou qualquer par personalizado .pem / .key."
+  },
+  "header": {
+    "title": "HTTPS para ProxMenux Monitor",
+    "description": "Ative HTTPS para o Monitor na porta 8008 com o certificado do anfitrião Proxmox detetado automaticamente ou um certificado personalizado no disco. A opção Proxmox prefere o certificado ACME, se existir, e reutiliza Let’s Encrypt gerido pelo Proxmox sem outra tarefa de renovação.",
+    "section": "Segurança"
+  },
+  "intro": {
+    "title": "O que esta página cobre",
+    "body": "Como mudar o Monitor de HTTP para HTTPS no painel Configurações → Painel de segurança, o que cada fonte de certificado realmente aponta no disco, como a opção Proxmox se comporta quando o host tem um certificado Let's Encrypt, e como definir caminhos personalizados se você gerenciar certs fora do Proxmox."
+  },
+  "wheresetting": {
+    "heading": "Onde se encontra a configuração",
+    "body": "Abra o Monitor e vá a <strong>Configurações → Segurança → HTTPS / SSL</strong>. O painel mostra HTTP ou HTTPS e, se HTTPS ainda estiver desativado, as fontes de certificados detetadas.",
+    "imageAlt": "Configurações → Segurança → Painel HTTPS / SSL no Monitor mostrando o estado HTTPS-off, o certificado Proxmox auto-detectado (sujeito, emissor, expiração) e a opção Use Custom Certificate",
+    "caption": "Painel Configurações → Segurança → HTTPS / SSL antes da ativação. O Monitor mostra o certificado utilizado pelo Proxmox e permite escolhê-lo com um clique."
+  },
+  "twoways": {
+    "heading": "Duas maneiras de ativar o HTTPS",
+    "proxmox": {
+      "title": "Usar certificado Proxmox",
+      "summary": "Um clique: o Monitor reutiliza o certificado apresentado pelo Proxmox VE na porta 8006.",
+      "items": [
+        "Detetado automaticamente, sem introduzir caminhos",
+        "Prefere o certificado ACME, se existir; caso contrário usa o certificado autoassinado predefinido",
+        "O Proxmox renova; o Monitor valida e carrega o certificado na próxima nova ligação TLS"
+      ]
+    },
+    "custom": {
+      "title": "Usar certificado personalizado",
+      "summaryRich": "Aponte o monitor em um par <code>.pem</code> / <code>.key</code> em qualquer lugar no disco.",
+      "items": [
+        "Apenas caminhos absolutos (o processo Monitor deve ser capaz de ler ambos)",
+        "Útil para certificados de <code>certbot</code>, <code>acme.sh</code> ou certificados wildcard",
+        "A renovação fica a seu cargo: reinicie o Monitor quando os ficheiros mudarem"
+      ]
+    }
+  },
+  "proxmoxCert": {
+    "heading": "Certificado Proxmox — o que ele realmente aponta",
+    "intro": "Proxmox VE mantém dois pares de certificados em <code>/etc/pve/local/</code>:",
+    "table": {
+      "headers": {
+        "file": "Arquivo",
+        "origin": "Origem",
+        "when": "Quando o Monitor o usa"
+      },
+      "rows": [
+        {
+          "fileRich": "<code>pveproxy-ssl.pem</code><br /><code>pveproxy-ssl.key</code>",
+          "originRich": "Certificado personalizado carregado através da UI Proxmox — incluindo o certificado Let's Encrypt emitido sob <em>Datacenter → Node → Certificados → ACME</em>.",
+          "when": "Preferido quando ambos os ficheiros existem; o Monitor utiliza o certificado apresentado pelo Proxmox."
+        },
+        {
+          "fileRich": "<code>pve-ssl.pem</code><br /><code>pve-ssl.key</code>",
+          "originRich": "Certificado autoassinado gerado no momento da instalação pelo Proxmox PKI.",
+          "whenRich": "Alternativa quando não existe <code>pveproxy-ssl.pem</code>."
+        }
+      ]
+    },
+    "callout": {
+      "title": "A mesma prioridade que o próprio Proxmox",
+      "bodyRich": "<code>pveproxy</code> aplica a mesma seleção. Com a opção Proxmox, o Monitor utiliza o certificado apresentado pela interface Proxmox em 8006, sem cópias nem processo de renovação separado."
+    }
+  },
+  "letsencrypt": {
+    "heading": "Obtendo um certificado Let's Encrypt via Proxmox ACME",
+    "intro": "O Proxmox VE inclui o seu cliente ACME. <em>«Order Certificate Now»</em> guarda o resultado em <code>/etc/pve/local/pveproxy-ssl.pem</code>, que o Monitor lê. Os cinco passos seguintes resumem o <extlink1>guia oficial do Proxmox</extlink1> nos comandos necessários.",
+    "prereqs": {
+      "title": "Pré-requisitos",
+      "items": [
+        "O nó tem um verdadeiro nome DNS (não apenas um IP) apontando para ele.",
+        "<strong>Ou</strong> porta 80 acessível a partir da Internet (validação HTTP-01, a mais simples), <strong>ou</strong> fornecedor DNS com credenciais API (DNS-01, funciona atrás de NAT e suporta certificados wildcard).",
+        "Um endereço de email para a conta ACME."
+      ]
+    },
+    "step1": {
+      "heading": "Etapa 1 — Registo da conta ACME",
+      "introRich": "Substitua o email pelo seu. O nome da conta <code>default</code> é apenas um rótulo — você pode usar qualquer string.",
+      "code": "pvenode acme account register default you@example.com",
+      "afterRich": "A Proxmox pede que você aceite os termos de serviço Let's Encrypt. Depois disso, a conta é persistida em <code>/etc/pve/priv/acme/</code> e a guia ACME na GUI irá mostrá-la."
+    },
+    "step2": {
+      "heading": "Passo 2 — Escolha um tipo de desafio",
+      "http01Rich": "<strong>HTTP-01</strong> é o mais fácil: é embutido, sem plugin extra. O Let's Encrypt conecta-se ao <code>http://&lt;your-host&gt;/.well-known/acme-challenge/...</code> na porta 80, então a porta 80 deve estar aberta da internet pública ao seu nó — normalmente uma porta para frente no seu roteador.",
+      "dns01Rich": "<strong>DNS-01</strong> funciona sem expor o porto 80 (bom para homelabs atrás do CG-NAT) e é a única opção para certificados wildcard. Você adiciona um plugin DNS uma vez com o token API do seu provedor. Exemplo Cloudflare:",
+      "code": "pvenode acme plugin add dns cf \\\n  --api cloudflare \\\n  --data CF_Token=YOUR_CLOUDFLARE_API_TOKEN",
+      "outroRich": "Para outros fornecedores (Gandi, OVH, AWS Route 53, etc.), consulte <code>pvenode acme plugin add dns --help</code>. O Proxmox inclui <extlink2>todos os plugins DNS do acme.sh</extlink2>."
+    },
+    "step3": {
+      "heading": "Passo 3 — Ligar o domínio ao seu nó",
+      "http01Rich": "Para o HTTP-01 (usa o plug- in incorporado do <code>standalone</code>):",
+      "code1": "pvenode config set --acme domains=host.example.com,account=default",
+      "dns01": "Para DNS-01 com o plugin Cloudflare do Passo 2:",
+      "code2": "pvenode config set --acmedomain0 domain=host.example.com,plugin=cf\npvenode config set --acme account=default",
+      "wildcardRich": "Wildcard? Adicionar <code>domain=*.example.com</code> em uma entrada separada <code>--acmedomainN</code>. Wildcards requerem DNS-01."
+    },
+    "step4": {
+      "heading": "Passo 4 — Ordenar o certificado",
+      "code": "pvenode acme cert order",
+      "afterRich": "A primeira execução normalmente leva 30–60 segundos enquanto o desafio se propaga. No sucesso Proxmox escreve <code>/etc/pve/local/pveproxy-ssl.pem</code> + <code>.key</code>, reinicia <code>pveproxy</code>, e um cron de renovação é agendado automaticamente (Let's Encrypt certs são válidos 90 dias; Proxmox renova em 60)."
+    },
+    "step5": {
+      "heading": "Etapa 5 — Verificar o emitente",
+      "code": "openssl x509 -in /etc/pve/local/pveproxy-ssl.pem -noout -issuer",
+      "afterRich": "Deve imprimir um emissor começando com <code>O = Let's Encrypt</code>. Se em vez disso ele lê <code>CN = Proxmox Virtual Environment</code> a ordem falhou e o arquivo ainda é o certificado PVE auto-assinado — re-executar <code>pvenode acme cert order --debug 1</code> para ver porquê."
+    },
+    "gui": {
+      "title": "Preferes a GUI? Os mesmos cinco passos",
+      "bodyRich": "<em>Datacenter → ACME</em> regista a conta; <em>Datacenter → ACME → Plugins</em> adiciona o plugin DNS; <em>Node → Certificates → ACME</em> associa o domínio; <em>Order Certificates Now</em> executa o passo 4. Os comandos anteriores são úteis para scripts e sistemas sem interface gráfica."
+    }
+  },
+  "switchToHttps": {
+    "heading": "Mudar o monitor para HTTPS",
+    "bodyRich": "Quando <code>/etc/pve/local/pveproxy-ssl.pem</code> estiver assinado por Let's Encrypt, abra <strong>Configurações → Segurança → HTTPS / SSL</strong>, confirme que o emissor é <em>Let's Encrypt</em> e não a CA local Proxmox, e clique em <strong>Usar certificado Proxmox</strong>. O Monitor reinicia e o próximo carregamento utiliza HTTPS em 8008 com uma cadeia de confiança pública. As renovações ACME seguintes são validadas e selecionadas na próxima nova ligação TLS, sem consultas periódicas nem reinício por renovação. <strong>Atualizar certificado</strong> continua disponível em Segurança para diagnóstico e recuperação."
+  },
+  "custom": {
+    "heading": "Certificado personalizado — quando usá-lo",
+    "intro": "Clique em <strong>Usar certificado personalizado</strong> e introduza dois caminhos absolutos:",
+    "items": [
+      "<strong>Certificado</strong> — cadeia completa em PEM (<code>.pem</code> ou <code>.crt</code>).",
+      "<strong>Chave privada</strong>: chave correspondente em PEM (<code>.key</code>)."
+    ],
+    "outro": "Ambos os arquivos são lidos pelo processo Monitor na inicialização. Certifique-se de que eles permanecem legíveis pelo usuário que a unidade systemd executa como (root por padrão). Locais comuns quando o ACME é administrado fora do Proxmox:",
+    "code": "# certbot\n/etc/letsencrypt/live/<your-host>/fullchain.pem\n/etc/letsencrypt/live/<your-host>/privkey.pem\n\n# acme.sh\n~/.acme.sh/<your-host>_ecc/fullchain.cer\n~/.acme.sh/<your-host>_ecc/<your-host>.key",
+    "symlinkCallout": {
+      "title": "Alvos do Symlink vs. arquivos",
+      "bodyRich": "<code>certbot</code> armazena os arquivos reais em <code>/etc/letsencrypt/archive/</code> e o caminho <code>live/</code> é um link simbólico. Aponte o Monitor no link simbólico <code>live/</code>, não no arquivo <code>archive/</code> — dessa forma cada ciclo de renovação simplesmente reescreve o alvo do link simbólico e o Monitor capta o novo certificado no próximo início do serviço."
+    }
+  },
+  "afterHttps": {
+    "heading": "Após activar o HTTPS",
+    "bodyRich": "Salvar a mudança escreve <code>/etc/proxmenux/ssl_config.json</code> e ativa um reinício da unidade <code>proxmenux-monitor</code> systemd. A guia do navegador perderá sua conexão atual — recarregue-a no <code>https://&lt;host&gt;:8008/</code>. A primeira carga com um certificado Let's Encrypt não deve mostrar nenhum aviso; com o certificado auto-assinado Proxmox o navegador exigirá uma exceção, a mesma que para porta 8006.",
+    "reverse": {
+      "heading": "Proxies inversos e webhooks",
+      "bodyRich": "Quando o Monitor muda para HTTPS, as URLs Proxmox VE webhook registradas para notificações também passam de <code>http://</code> para <code>https://</code> automaticamente. Entradas webhook existentes são reescritas da próxima vez que uma regra de notificação for salva ou redetectada, então nenhuma edição manual da configuração de notificação Proxmox é necessária."
+    }
+  },
+  "trustCa": {
+    "heading": "Confiar na CA autoassinada do Proxmox",
+    "intro1Rich": "Para manter o certificado Proxmox predefinido sem ACME, importe a CA raiz do cluster para o repositório de confiança do sistema ou do navegador. O Monitor deteta <code>/etc/pve/local/pve-ssl.pem</code> como certificado de recurso. O cliente passa a confiar no emissor; o URL tem ainda de corresponder a um nome do certificado.",
+    "intro2Rich": "O arquivo CA vive em <code>/etc/pve/pve-root-ca.pem</code> em cada nó. Em um cluster, o caminho está no sistema de arquivos <code>pmxcfs</code> compartilhado, então todos os nós compartilham a mesma raiz, e uma única importação cobre todo o datacenter. Copie para a sua máquina:",
+    "code": "scp root@<your-host>:/etc/pve/pve-root-ca.pem ./pve-root-ca.pem",
+    "thenImport": "Depois importa-o do lado do cliente:",
+    "items": [
+      "<strong>Linux (todo o sistema):</strong> execute <code>sudo cp pve-root-ca.pem /usr/local/share/ca-certificates/pve-root-ca.crt</code> e depois <code>sudo update-ca-certificates</code>. Os navegadores que utilizam o repositório de certificados do sistema (Chromium, Edge) reconhecem a CA após reiniciar; Firefox usa um repositório próprio e requer a importação manual abaixo.",
+      "<strong>macOS:</strong> abra o ficheiro <code>.pem</code> com duplo clique no Acesso a Porta-chaves, adicione-o ao porta-chaves <em>Sistema</em> e defina <em>Confiança → Confiar sempre</em>.",
+      "<strong>Windows:</strong> clique com o botão direito no ficheiro → <em>Instalar certificado</em> → coloque-o em <em>Autoridades de certificação de raiz fidedigna</em>.",
+      "<strong>Firefox (qualquer SO):</strong> <em>Configurações → Privacidade e segurança → Certificados → Ver certificados → Autoridades → Importar</em>; selecione <em>Confiar nesta CA para identificar sites</em>."
+    ],
+    "standalone": {
+      "title": "Nós autônomos fora de um cluster",
+      "bodyRich": "Cada host Proxmox não-aglomerado tem seu próprio <code>pve-root-ca.pem</code>. Se você gerenciar vários hosts autônomos, repita a cópia/importação para cada um, ou junte-os a um cluster para que eles compartilhem uma única raiz."
+    }
+  },
+  "disable": {
+    "heading": "Desactivando o HTTPS",
+    "bodyRich": "Clique em <strong>Desativar HTTPS</strong> no mesmo painel. O Monitor reinicia com HTTP sem cifragem, útil se um certificado personalizado ilegível impedir o arranque. Não existe outro passo de desinstalação e os ficheiros de certificados não são alterados.",
+    "stateCallout": {
+      "title": "Onde é guardado o estado",
+      "bodyRich": "<code>/etc/proxmenux/ssl_config.json</code> armazena os caminhos do certificado ativo e a fonte (<code>none</code>, <code>proxmox</code>, <code>custom</code>). Excluir o arquivo é equivalente a desativar o HTTPS — no início seguinte o Monitor cai para o HTTP."
+    }
+  }
+}
diff --git a/web/messages/pt/docs/settings/beta-program.json b/web/messages/pt/docs/settings/beta-program.json
new file mode 100644
index 00000000..641546f6
--- /dev/null
+++ b/web/messages/pt/docs/settings/beta-program.json
@@ -0,0 +1,113 @@
+{
+  "meta": {
+    "title": "Alterar canal de lançamento | Documentação do ProxMenux",
+    "description": "Mude entre os canais Stable (main) e Beta (develop) do ProxMenux numa única janela. Bidirecional e idempotente; executa o instalador oficial do canal escolhido e normaliza o serviço Monitor.",
+    "ogTitle": "Alterar canal de lançamento | Documentação do ProxMenux",
+    "ogDescription": "Uma opção das Configurações para mudar entre Stable e Beta sem executar instaladores manualmente."
+  },
+  "header": {
+    "title": "Alterar canal de lançamento",
+    "description": "Uma opção única das Configurações muda entre Stable (ramo main) e Beta (ramo develop). A antiga opção unidirecional «Desativar programa beta» é substituída por um diálogo bidirecional que oferece ambos os sentidos e executa o instalador oficial do canal escolhido.",
+    "section": "Configurações"
+  },
+  "intro": {
+    "title": "O que mudou",
+    "body": "Antes existiam dois procedimentos: «Desativar programa beta», visível apenas com a beta ativa, e executar novamente o instalador beta para voltar a aderir. Agora estão reunidos em <strong>Alterar canal de lançamento</strong>, sempre disponível, que mostra o canal atual e permite mudar entre Stable e Beta nos dois sentidos."
+  },
+  "why": {
+    "heading": "Por que esta opção existe",
+    "intro": "O ProxMenux é distribuído a partir de dois ramos Git:",
+    "items": [
+      "<strong>Stable</strong>: o ramo <code>main</code>, indicado no README e adequado à maioria dos administradores. Tem lançamentos menos frequentes e apenas alterações já validadas na beta.",
+      "<strong>Beta</strong>: o ramo <code>develop</code>. Funcionalidades e compilações do Monitor mais recentes, com a etiqueta que a próxima versão estável herdará. Algumas funções podem ter falhas: ao escolher este canal participa nos testes antes do lançamento."
+    ],
+    "outro": "Antes era necessário recordar o URL correto do instalador, copiá-lo do README e editar <code>config.json</code> manualmente se algo ficasse dessincronizado. A opção unificada realiza todo o processo numa ação guiada."
+  },
+  "dialog": {
+    "heading": "A janela",
+    "intro": "No menu principal: <strong>Configurações → Alterar canal de lançamento</strong>. Aparece um menu com duas linhas:",
+    "options": [
+      "<code>stable</code> — Stable (ramo main)",
+      "<code>beta</code> — Beta (ramo develop)"
+    ],
+    "behaviour": "O canal atual está pré-selecionado e é mostrado no topo. Escolher o mesmo mostra «Este canal de lançamento já está ativo»: o diálogo é idempotente. Escolher outro canal apresenta uma confirmação específica:",
+    "directions": [
+      "<strong>Stable → Beta:</strong> avisa que as versões beta podem conter erros ou funcionalidades incompletas.",
+      "<strong>Beta → Estável:</strong> avisa que as verificações de atualização beta vão parar e o instalador estável irá reinstalar os componentes do canal estável."
+    ]
+  },
+  "confirm": {
+    "heading": "O que acontece quando você confirmar",
+    "items": [
+      "<strong>Transfere o instalador oficial</strong> do canal de destino:<ul><li>Stable: <code>install_proxmenux.sh</code> de <code>main</code></li><li>Beta: <code>install_proxmenux_beta.sh</code> de <code>develop</code></li></ul>Verifica a existência do ficheiro e torna-o executável antes de continuar.",
+      "<strong>Executa o instalador completo</strong>, o mesmo indicado no README. A deteção dos componentes, cópias de segurança, instalação de dependências e preservação do idioma seguem o procedimento oficial de instalação do canal escolhido.",
+      "Ao mudar para <strong>Stable</strong>, o menu então poda quaisquer metadados beta remanescentes de <code>config.json</code>: <code>beta_program</code>, <code>beta_version</code>, <code>install_branch</code>, <code>update_available.beta*</code> são excluídos, e <code>proxmenux_monitor.status = beta_updated</code> é normalizada para <code>updated</code>. O arquivo <code>beta_version.txt</code> e qualquer instalador beta baixado são removidos.",
+      "Ao mudar para Stable, a unidade systemd do Monitor é reescrita a partir do modelo Stable: remove «Beta» da descrição e <code>ExecStart</code> volta a apontar para o diretório de execução. Assim, uma nova consulta de <code>systemctl status</code> reflete o canal atual.",
+      "Recarrega o menu de configuração. <em>Mostrar informações da versão</em> mostrará o novo canal."
+    ]
+  },
+  "switching": {
+    "heading": "Mudando para trás e para frente",
+    "intro": "Ambas as direções passam pelo mesmo instalador — elas <strong>não</strong> são fluxos de desinstalação e reinstalação de casos especiais. Cada direção simplesmente executa o próprio instalador do canal, que é projetado para ser idempotente e seguro para ser reexecutado em uma instalação existente. Consequências práticas:",
+    "items": [
+      "Sua configuração existente, login ProxMenux Monitor (<code>auth.json</code>), canais de notificação, registro pós-instalação, limiares personalizados — nenhum deles é tocado. O interruptor de canal só troca a árvore de scripts e o binário AppImage.",
+      "Um Monitor ativo antes da mudança continua ativo depois; um que estava desativado continua desativado.",
+      "ProxMenux Monitor <code>auth.json</code>, API tokens e o segredo JWT são preservados através de mudanças de canal. As sessões não são encerradas.",
+      "Você pode inverter os canais quantas vezes quiser — o diálogo irá aceitá-lo toda vez e repetir o instalador. Não é necessário reiniciar o Proxmox.",
+      "A mudança de canal substitui os scripts do ProxMenux e não pode ser executada no terminal do navegador do Monitor: o PTY seria encerrado durante a atualização e o diálogo ficaria bloqueado. Nesse terminal aparece antes uma mensagem com o comando oficial de uma linha do canal escolhido. Execute-o por SSH ou na consola do anfitrião Proxmox."
+    ]
+  },
+  "feedback": {
+    "heading": "Comunicar problemas da beta",
+    "intro": "Se algo se comporta inesperadamente enquanto você está no canal Beta, abrir um problema com contexto suficiente é o que fecha a lacuna para uma liberação estável. O relatório mais útil inclui:",
+    "items": [
+      "O que fizeste e o que esperavas que acontecesse.",
+      "Quaisquer mensagens de erro mostradas na tela.",
+      "Os registos de monitorização relevantes:"
+    ],
+    "logsCommand": "journalctl -u proxmenux-monitor -n 50 --no-pager",
+    "versionLine": "A versão atual do ProxMenux (Configurações → <link>Mostrar informações da versão</link>).",
+    "issueLine": "Abra um <ghlink>problema no GitHub</ghlink> com estas informações para facilitar a correção."
+  },
+  "manual": {
+    "heading": "Equivalente manual",
+    "intro": "Se preferir a shell ou automatizar a mudança de canal, o diálogo executa estes comandos:"
+  },
+  "unifiedCallout": {
+    "title": "Por que ambas as direções são agora uma opção",
+    "body": "A antiga opção «Desativar programa beta» só aparecia após a adesão à beta. Para <em>aderir</em> era necessário procurar o instalador noutro local; para <em>sair</em>, por vezes era necessário limpar os metadados <code>beta_*</code> manualmente. <strong>Alterar canal de lançamento</strong> aparece sempre, indica o canal atual e trata ambos os sentidos como uma operação executável, repetível e idempotente."
+  },
+  "troubleshoot": {
+    "heading": "Resolução de Problemas",
+    "downloadTitle": "“Não foi possível baixar o instalador”",
+    "downloadBody": "O HTTPS para <code>raw.githubusercontent.com</code> falhou. Verifique a conectividade e DNS do host:",
+    "downloadCmd": "curl -fsSL -o /tmp/test https://raw.githubusercontent.com/MacRimi/ProxMenux/main/install_proxmenux.sh && head -1 /tmp/test",
+    "downloadOutro": "Se isso falhar fora do ProxMenux, é um problema de rede / proxy no host.",
+    "errorsTitle": "“Installer terminou com erros”",
+    "errorsBody": "O instalador devolveu um código de saída diferente de zero. Não existe reversão automática: alguns ficheiros ou componentes podem já ter sido alterados. Leia a saída do instalador mostrada acima do erro antes de premir Enter e verifique o estado atual; depois repita a partir do menu ou execute o instalador manualmente por SSH ou na consola do anfitrião.",
+    "configTitle": "\"Não foi possível atualizar o arquivo de configuração\" após mudar para Stable",
+    "configBody": "A limpeza pós-instalação dos metadados beta falhou — geralmente porque o <code>config.json</code> tem um erro de sintaxe de uma edição manual. Validar:",
+    "configCmd": "jq . /usr/local/share/proxmenux/config.json",
+    "configOutro": "Corrigir ou restaurar o arquivo e executar novamente a opção."
+  },
+  "related": {
+    "heading": "Relacionado",
+    "items": [
+      {
+        "href": "/docs/settings/show-version-information",
+        "label": "Mostrar informações da versão",
+        "tail": " — confirmar que canal está activo."
+      },
+      {
+        "href": "/docs/settings/proxmenux-monitor",
+        "label": "ProxMenux Monitor",
+        "tail": " — o serviço Monitor recriado durante a mudança de canal."
+      },
+      {
+        "href": "/docs/settings",
+        "label": "Visão geral das configurações",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/pt/docs/settings/change-language.json b/web/messages/pt/docs/settings/change-language.json
new file mode 100644
index 00000000..3cfc469e
--- /dev/null
+++ b/web/messages/pt/docs/settings/change-language.json
@@ -0,0 +1,108 @@
+{
+  "meta": {
+    "title": "Alterar idioma | Documentação do ProxMenux",
+    "description": "Escolha entre oito idiomas para a interface do ProxMenux. Todas as instalações incluem catálogos JSON de traduções pré-gerados; o anfitrião não necessita de serviços de tradução nem de um ambiente Python. O menu é recarregado automaticamente.",
+    "ogTitle": "Alterar idioma | Documentação do ProxMenux",
+    "ogDescription": "Escolha um dos oito idiomas do ProxMenux nas Configurações. Disponível em todas as instalações."
+  },
+  "header": {
+    "title": "Alterar idioma",
+    "description": "Alterne a interface do ProxMenux entre oito idiomas suportados. A escolha é guardada em config.json e o menu é reiniciado no novo idioma. Todas as instalações incluem os catálogos de traduções.",
+    "section": "Configurações"
+  },
+  "intro": {
+    "title": "O que é isto?",
+    "body": "Um diálogo lista os oito idiomas suportados. O ProxMenux guarda a sua escolha em <code>config.json</code> como <code>.language</code> e reinicia <code>config_menu.sh</code> para a aplicar imediatamente."
+  },
+  "warn": {
+    "title": "Disponível em todas as instalações",
+    "body": "As Configurações mostram sempre Alterar idioma. Os catálogos são instalados em <code>/usr/local/share/proxmenux/lang/</code> <em>e</em> o idioma escolhido é guardado em <code>config.json</code>. O antigo ambiente Python de tradução não é necessário."
+  },
+  "supported": {
+    "heading": "Idiomas suportados",
+    "headerCode": "Code",
+    "headerLang": "Idioma",
+    "headerNotes": "Notas",
+    "rows": [
+      {
+        "code": "en",
+        "lang": "Inglês",
+        "notes": "Língua de origem — mais precisa"
+      },
+      {
+        "code": "es",
+        "lang": "Espanhol",
+        "notes": "Catálogo JSON pré-gerado"
+      },
+      {
+        "code": "fr",
+        "lang": "Francês",
+        "notes": "Catálogo JSON pré-gerado"
+      },
+      {
+        "code": "de",
+        "lang": "Alemão",
+        "notes": "Catálogo JSON pré-gerado"
+      },
+      {
+        "code": "it",
+        "lang": "italiano",
+        "notes": "Catálogo JSON pré-gerado"
+      },
+      {
+        "code": "pt",
+        "lang": "Português",
+        "notes": "Catálogo JSON pré-gerado"
+      },
+      {
+        "code": "sk",
+        "lang": "Eslovaco",
+        "notes": "Catálogo JSON pré-gerado"
+      },
+      {
+        "code": "sv",
+        "lang": "Sueco",
+        "notes": "Catálogo JSON pré-gerado"
+      }
+    ]
+  },
+  "englishTip": {
+    "title": "Inglês é o mais preciso",
+    "body": "Os textos noutros idiomas provêm dos catálogos JSON pré-gerados incluídos no ProxMenux. As traduções em falta usam o inglês; o anfitrião não faz chamadas de tradução em direto. O inglês continua a ser a referência em caso de tradução duvidosa."
+  },
+  "underHood": {
+    "heading": "Como funciona sob o capô",
+    "items": [
+      "O diálogo apresenta oito códigos de idioma; escolha um.",
+      "Se <code>config.json</code> existe: <code>jq --arg lang \"$new_language\" '.language = $lang''</code> atualiza o campo no local.",
+      "Se <code>config.json</code> não existe: um novo é criado com o código de linguagem em um objeto de campo único.",
+      "Diálogo de confirmação: <em>\"Idioma alterado para [code]\"</em>.",
+      "<code>exec bash config_menu.sh</code> recarrega o menu Configurações com o novo idioma ativo."
+    ]
+  },
+  "manual": {
+    "heading": "Equivalente manual"
+  },
+  "troubleshoot": {
+    "heading": "Resolução de Problemas",
+    "noOptionTitle": "A opção não aparece na Configuração",
+    "noOptionBody": "Alterar idioma está sempre disponível nas versões atuais. Se a opção não aparecer, atualize o ProxMenux com o instalador oficial e volte a abrir as Configurações.",
+    "stillEnglishTitle": "A língua mudou, mas a UI ainda mostra inglês",
+    "stillEnglishBody": "O menu volta a ser executado após a alteração. Se abriu uma nova shell e iniciou outro ponto de entrada do ProxMenux, execute <code>menu</code> novamente para aplicar o novo idioma. Confirme com <code>jq -r '.language' /usr/local/share/proxmenux/config.json</code>."
+  },
+  "related": {
+    "heading": "Relacionado",
+    "items": [
+      {
+        "href": "/docs/settings/show-version-information",
+        "label": "Mostrar informações da versão",
+        "tail": " — confirma o canal de lançamento, os ficheiros de tradução e o idioma atual."
+      },
+      {
+        "href": "/docs/settings",
+        "label": "Visão geral das configurações",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/pt/docs/settings/index.json b/web/messages/pt/docs/settings/index.json
new file mode 100644
index 00000000..4ae7a60c
--- /dev/null
+++ b/web/messages/pt/docs/settings/index.json
@@ -0,0 +1,81 @@
+{
+  "meta": {
+    "title": "Configurações do ProxMenux — Ativação do Monitor, canal de lançamento, idiomas | ProxMenux",
+    "description": "Configurações do ProxMenux: serviço Monitor e reposição da palavra-passe, canal Stable/Beta, oito idiomas da interface, diagnóstico da versão e desinstalação. As opções do Monitor aparecem quando o serviço está instalado.",
+    "ogTitle": "Configurações do ProxMenux — Ativação do Monitor, canal de lançamento, idiomas",
+    "ogDescription": "Configure o ProxMenux: serviço Monitor, canal de lançamento, idioma, informações da versão e desinstalação.",
+    "twitterTitle": "Configuração do ProxMenux",
+    "twitterDescription": "Ativação do Monitor, mudança de canal de lançamento, idiomas, informações da versão e desinstalação."
+  },
+  "header": {
+    "title": "Configurações",
+    "description": "Configure o ProxMenux: ative ou desative o Monitor, reponha as credenciais, mude entre Stable e Beta nos dois sentidos, escolha um dos oito idiomas, consulte o diagnóstico da versão e desinstale. As ações do Monitor exigem o serviço instalado; a seleção de idioma está sempre disponível.",
+    "section": "Configurações"
+  },
+  "intro": {
+    "title": "Para que serve este menu",
+    "body": "Administração do próprio ProxMenux: serviço Monitor, saída do canal beta, idioma, diagnóstico da versão e desinstalação. Nenhuma opção deste menu altera as suas VMs, contentores ou armazenamento."
+  },
+  "opening": {
+    "heading": "Abrir o menu",
+    "body": "No menu principal do ProxMenux, prima <kbd>s</kbd>. As ações do Monitor aparecem se o serviço estiver instalado; as restantes configurações estão sempre disponíveis:",
+    "imageAlt": "Menu Configurações do ProxMenux com ações condicionais do Monitor"
+  },
+  "installTypes": {
+    "heading": "Uma instalação, todos os idiomas",
+    "intro": "As versões atuais incluem catálogos JSON estáticos em todas as instalações. As versões antigas ofereciam modos separados com tradução e normal:",
+    "headerType": "Tipo de instalação",
+    "headerBundles": "O que inclui",
+    "headerMenu": "Menu mostra",
+    "rows": [
+      {
+        "type": "Instalação atual",
+        "bundles": "Catálogos JSON estáticos para sete idiomas, mais o inglês integrado; sem ambiente Python de tradução",
+        "menuRich": "<strong>Alterar idioma</strong> + Mostrar versão + Desinstalar"
+      },
+      {
+        "type": "Modos antigos com tradução / normal",
+        "bundles": "Antiga separação entre ambiente de tradução e instalação apenas em inglês",
+        "menu": "Atualize com o instalador oficial para utilizar o menu unificado atual"
+      }
+    ],
+    "detectionTitle": "A seleção de idioma está sempre disponível",
+    "detectionBody": "O menu já não verifica um ambiente de tradução. Todas as instalações incluem <code>/usr/local/share/proxmenux/lang/</code> e guardam o valor <code>language</code> escolhido em <code>config.json</code>."
+  },
+  "options": {
+    "heading": "Opções do menu",
+    "intro": "Estas ferramentas gerem o próprio ProxMenux. <em>Condicional</em> indica que as ações do Monitor aparecem apenas com o serviço systemd instalado. Canal de lançamento, idioma, diagnóstico da versão e desinstalação estão sempre disponíveis.",
+    "list": [
+      {
+        "icon": "Activity",
+        "href": "/docs/settings/proxmenux-monitor",
+        "title": "ProxMenux Monitor",
+        "description": "Ativar / desativar a unidade proxmenux-monitor.service systemd, verificar seu estado atual, e redefinir a senha de login do painel se ela foi perdida. UI Web disponível em TCP 8008.",
+        "badge": "Condicional"
+      },
+      {
+        "icon": "TestTube",
+        "href": "/docs/settings/beta-program",
+        "title": "Alterar canal de lançamento",
+        "description": "Mude entre Stable (main) e Beta (develop) nos dois sentidos a partir de uma única janela. Executa o instalador oficial do canal escolhido; é idempotente e está sempre visível.",
+        "badge": "Sempre disponível"
+      },
+      {
+        "icon": "Info",
+        "href": "/docs/settings/show-version-information",
+        "title": "Mostrar informações da versão",
+        "description": "Versão do ProxMenux, canal de lançamento, componentes instalados, caminhos dos ficheiros, ficheiros de tradução e idioma atual."
+      },
+      {
+        "icon": "Trash2",
+        "href": "/docs/settings/uninstall-proxmenux",
+        "title": "Desinstalar ProxMenux",
+        "description": "Remova ProxMenux e (opcionalmente) suas dependências. Também restaura backups /root/.bashrc e /etc/motd criados no momento da instalação."
+      }
+    ]
+  },
+  "configTip": {
+    "title": "Onde é guardada a configuração",
+    "bodyRich": "A maior parte do estado gerido por este menu é guardada em <code>/usr/local/share/proxmenux/config.json</code>: <code>language</code>, <code>beta_program.status</code> e indicadores de instalação por componente. O estado do serviço Monitor é gerido no systemd (<code>proxmenux-monitor.service</code>), não aqui. A versão é lida de <code>/usr/local/share/proxmenux/version.txt</code>."
+  }
+}
diff --git a/web/messages/pt/docs/settings/proxmenux-monitor.json b/web/messages/pt/docs/settings/proxmenux-monitor.json
new file mode 100644
index 00000000..20ecc680
--- /dev/null
+++ b/web/messages/pt/docs/settings/proxmenux-monitor.json
@@ -0,0 +1,119 @@
+{
+  "meta": {
+    "title": "ProxMenux Monitor | Documentação do ProxMenux",
+    "description": "Ativar ou desativar a unidade proxmenux-monitor.service systemd e inspecionar seu estado atual. O Monitor expõe uma interface web em TCP 8008 para monitoramento visual do hospedeiro.",
+    "ogTitle": "ProxMenux Monitor | Documentação do ProxMenux",
+    "ogDescription": "Ative ou desative o serviço systemd proxmenux-monitor e consulte o estado nas Configurações."
+  },
+  "header": {
+    "title": "ProxMenux Monitor",
+    "description": "Duas ações relacionadas dentro do menu Configurações: alternar a unidade proxmenux-monitor.service systemd (iniciar / parar e ativar / desativar em um clique), e visualizar seu status detalhado atual. O Monitor expõe uma interface web em TCP 8008 para monitoramento visual do hospedeiro.",
+    "section": "Configurações"
+  },
+  "intro": {
+    "title": "O que é o ProxMenux Monitor?",
+    "body": "ProxMenux Monitor é um painel web integrado que oferece visibilidade em tempo real na sua infraestrutura Proxmox – acessível a partir de qualquer navegador na sua rede, sem precisar de um terminal."
+  },
+  "offers": {
+    "heading": "O que oferece",
+    "items": [
+      "Monitoramento em tempo real de CPU, RAM, uso de disco e tráfego de rede.",
+      "Visão geral das VMs e LXC com indicadores de status.",
+      "Autenticação de login para proteger o acesso.",
+      "Autenticação de dois fatores (2FA) com suporte TOTP.",
+      "Suporte a proxy reversa (Nginx / Traefik).",
+      "Projetado para trabalhar em desktop e dispositivos móveis."
+    ]
+  },
+  "access": {
+    "heading": "Acesso",
+    "intro": "Uma vez instalado, o painel está disponível em:",
+    "url": "http://<your-proxmox-ip>:8008",
+    "outro": "O Monitor é instalado automaticamente como parte da instalação padrão ProxMenux e é executado como um serviço systemd (<code>proxmenux-monitor.service</code>) que começa automaticamente no arranque."
+  },
+  "warnConditional": {
+    "title": "Opções de configuração somente visíveis quando o Monitor está instalado",
+    "body": "Os dois itens de menu descritos abaixo só aparecem em Configurações se <code>proxmenux-monitor.service</code> estiver registrado com systemd. Se não os vir, o Monitor não foi instalado (é opcional durante a instalação do ProxMenux). Para adicioná-lo mais tarde, reinstale o ProxMenux com a versão mais recente e escolha a opção Monitor."
+  },
+  "toggle": {
+    "heading": "Activar / Desactivar",
+    "intro": "O primeiro item de menu é uma única opção que muda entre dois estados com base em se o serviço está atualmente em execução:",
+    "headerState": "Estado atual",
+    "headerLabel": "Rótulo do menu apresentado",
+    "headerAction": "Acção sobre a confirmação",
+    "rows": [
+      {
+        "state": "ativo",
+        "label": "Desativar ProxMenux Monitor",
+        "action": "systemctl stop + disable"
+      },
+      {
+        "state": "inativo",
+        "label": "Ativar ProxMenux Monitor",
+        "action": "systemctl enable + start"
+      }
+    ],
+    "outro": "Cada alteração exige confirmação sim/não. Desativar para o serviço <em>e</em> desativa o arranque automático; ativar permite o arranque automático <em>e</em> inicia imediatamente o serviço."
+  },
+  "status": {
+    "heading": "Mostrar status do serviço do monitor",
+    "intro": "O segundo item do menu é somente leitura. Ele limpa a tela, mostra o logotipo ProxMenux e o título <em>\"ProxMenux Monitor Verificação de Serviço\"</em>, em seguida, relata:",
+    "items": [
+      "<strong>Estatuto de serviço:</strong> ativo, inativo ou not_installed.",
+      "<strong>Web UI URL</strong> (apenas quando ativo): <code>http://&lt;host_ip&gt;:8008</code> — derivado de <code>hostname -I | awk '''{print $1}'''</code>.",
+      "<strong> Saída systemd detalhada:</strong> <code>systemctl status proxmenux-monitor.service --no-pager -l</code> — mostra linhas de log recentes, ExecStart, MainPID, etc."
+    ]
+  },
+  "manual": {
+    "title": "Equivalentes manuais",
+    "intro": "De qualquer shell:",
+    "code": "systemctl status proxmenux-monitor.service       # detailed status\nsystemctl is-active proxmenux-monitor.service    # one-word status\nsystemctl enable --now proxmenux-monitor.service # enable + start\nsystemctl disable --now proxmenux-monitor.service # stop + disable\njournalctl -u proxmenux-monitor.service -f       # follow live logs"
+  },
+  "reset": {
+    "heading": "Redefinir senha do ProxMenux Monitor",
+    "intro": "Caminho de recuperação para o operador que perdeu a senha do painel (ou dispositivo 2FA). A opção só aparece quando o Monitor é instalado na máquina. Selecionando- o:",
+    "items": [
+      "Pede confirmação com um diálogo sim/não — a ação é destrutiva para as credenciais de login.",
+      "Faz backup do <code>/root/.config/proxmenux-monitor/auth.json</code> existente para <code>auth.json.bak-&lt;UTC timestamp&gt;</code> (modo <code>0600</code>) para que o estado anterior possa ser restaurado manualmente se o reset foi um erro.",
+      "Para o serviço <code>proxmenux-monitor</code> para evitar conflitos entre a edição do ficheiro e um início de sessão em curso.",
+      "Limpa os campos de identidade em <code>auth.json</code>: <code>enabled=false</code>, <code>configured=false</code>, esvazia <code>username</code>, <code>password_hash</code>, <code>totp_secret</code> e a matriz de códigos de backup.",
+      "<strong>Preserva</strong> <code>jwt_secret</code> e os dados registados <code>api_tokens</code> / <code>revoked_tokens</code>, para que os tokens de longa duração do Home Assistant ou de outros scripts <em>continuem a permitir autenticação</em> após a reposição.",
+      "Reinicia o serviço. A próxima visita ao <code>http://&lt;host&gt;:8008</code> mostra o assistente de configuração do primeiro lançamento para que uma nova conta de administrador possa ser criada."
+    ],
+    "preservedTitle": "O que sobrevive ao reinício, o que não sobrevive",
+    "preservedBody": "<strong>Apagados:</strong> nome de utilizador, hash da palavra-passe, segredo TOTP 2FA e códigos de recuperação. <strong>Preservados:</strong> <code>jwt_secret</code>, metadados <code>api_tokens</code> e lista <code>revoked_tokens</code>. Para invalidar também todos os tokens API e começar de novo, elimine <code>auth.json</code> manualmente em vez de utilizar esta opção. No próximo arranque, o serviço regenera o segredo JWT e os restantes dados.",
+    "trustTitle": "O acesso ao host físico é a âncora de confiança",
+    "trustBody": "Este caminho de reset requer shell root na máquina. Qualquer um que possa executar o comando <code>menu</code> como root já controla a caixa, então dar-lhes recuperação de senha não é uma escalada de privilégio — é consistente com como todas as outras ferramentas de administração no Proxmox funcionam. O corolário: o login do Monitor não protegerá nada de alguém que você já deixou entrar no shell Proxmox.",
+    "seeAlso": "Consulte também <link>Monitor → Acesso e autenticação → Recuperar uma palavra-passe perdida</link> para o mesmo procedimento visto do painel e os detalhes sobre o cálculo dos hashes das palavras-passe e a geração do segredo JWT."
+  },
+  "files": {
+    "heading": "Ficheiros envolvidos",
+    "code": "/etc/systemd/system/proxmenux-monitor.service       # systemd unit\n/root/.config/proxmenux-monitor/                    # runtime config dir\n/var/log/proxmenux-auth.log                         # Flask app auth log\n                                                    # (read by Fail2Ban [proxmenux] jail)"
+  },
+  "troubleshoot": {
+    "heading": "Resolução de Problemas",
+    "missingTitle": "Faltam ambas as opções de menu",
+    "missingBody": "O Monitor não está registado na systemd. Confirme com <code>systemctl list-unit-files | grep proxmenux-monitor</code> — se não houver saída, reinstale o ProxMenux do instalador oficial com a versão mais recente e escolha a opção Monitor durante a instalação.",
+    "unreachableTitle": "Serviço ativado, mas o URL não é acessível",
+    "unreachableBody": "A saída de status Configurações lhe dá o IP. Confirmar:",
+    "unreachableCmd": "ss -tlnp | grep 8008                # is anything listening?\njournalctl -u proxmenux-monitor -n 100 --no-pager  # recent errors\ncurl -sI http://localhost:8008      # local reachability",
+    "unreachableOutro": "Se o localhost funcionar mas o externo não funcionar, verifique o firewall do seu host (<code>pve-firewall</code> ou nftables) para TCP 8008.",
+    "stopsTitle": "Ativado o serviço, mas pára alguns segundos depois",
+    "stopsBody": "Normalmente deve-se a um conflito na porta 8008 ou a uma falha na verificação de dependências. O registo do sistema indica a causa: <code>journalctl -u proxmenux-monitor.service -b</code>."
+  },
+  "related": {
+    "heading": "Relacionado",
+    "items": [
+      {
+        "href": "/docs/security/fail2ban",
+        "label": "Fail2Ban",
+        "tailRich": " — a cadeia <code>[proxmenux]</code> protege o Monitor em TCP 8008."
+      },
+      {
+        "href": "/docs/settings",
+        "label": "Visão geral das configurações",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/pt/docs/settings/show-version-information.json b/web/messages/pt/docs/settings/show-version-information.json
new file mode 100644
index 00000000..a2afbc07
--- /dev/null
+++ b/web/messages/pt/docs/settings/show-version-information.json
@@ -0,0 +1,81 @@
+{
+  "meta": {
+    "title": "Mostrar informações da versão | Documentação do ProxMenux",
+    "description": "Diagnóstico do ProxMenux apenas de leitura: versão, canal de lançamento, componentes registados em config.json, caminhos dos ficheiros, catálogos de traduções e idioma atual.",
+    "ogTitle": "Mostrar informações da versão | Documentação do ProxMenux",
+    "ogDescription": "Dados de diagnóstico da versão do ProxMenux, canal de lançamento, componentes, ficheiros e idioma."
+  },
+  "header": {
+    "title": "Mostrar informações da versão",
+    "description": "Diagnóstico apenas de leitura. Lê version.txt, config.json e caminhos de ficheiros conhecidos e apresenta uma caixa de texto deslocável com a versão, o canal de lançamento, os componentes instalados, a presença de ficheiros, os ficheiros de tradução e o idioma atual.",
+    "section": "Configurações"
+  },
+  "intro": {
+    "title": "O que é isto?",
+    "body": "Um autodiagnóstico. Útil ao comunicar um problema (cole o conteúdo da janela no relatório de erro) ou para confirmar que uma instalação foi concluída corretamente. Não altera nada."
+  },
+  "reports": {
+    "heading": "O que relata",
+    "headerSection": "Secção",
+    "headerSource": "Origem",
+    "headerContent": "Conteúdo",
+    "rows": [
+      {
+        "section": "Versão actual",
+        "source": "version.txt",
+        "contentRich": "Número de versão de linha única; <code>Unknown</code> se o ficheiro faltar"
+      },
+      {
+        "section": "Canal de lançamento",
+        "source": "Estado do programa beta em config.json",
+        "content": "Stable (main) ou Beta (develop); versão beta, se disponível"
+      },
+      {
+        "section": "Componentes instalados",
+        "source": "config.json",
+        "content": "Estado por componente (✓ instalado / criado / atualizado, ✗ ausente)"
+      },
+      {
+        "section": "Ficheiros ProxMenux",
+        "source": "verificação do sistema de ficheiros",
+        "contentRich": "<code>menu</code>, <code>utils.sh</code>, <code>config.json</code>, <code>version.txt</code> presença + caminhos"
+      },
+      {
+        "section": "Ficheiros de tradução",
+        "source": "/usr/local/share/proxmenux/lang/",
+        "content": "Presença do diretório lang/ incluído em todas as instalações"
+      },
+      {
+        "section": "Língua atual",
+        "source": "config.json",
+        "contentRich": "Código do idioma de <code>.language</code>; usa <code>en</code> se não estiver definido"
+      }
+    ]
+  },
+  "sampleHeading": "Saída da amostra",
+  "manualHeading": "Equivalentes manuais",
+  "troubleshoot": {
+    "heading": "Resolução de Problemas",
+    "unknownTitle": "A versão mostra \"Unknown\"",
+    "unknownBody": "<code>/usr/local/share/proxmenux/version.txt</code> está faltando ou ilegível. Na maioria das vezes causada por uma instalação parcial. Reinstalar a partir da fonte oficial ProxMenux.",
+    "noConfigTitle": "Nenhuma informação de instalação disponível",
+    "noConfigBody": "<code>config.json</code> desapareceu. O script não pode enumerar componentes sem ele. Reinstalar para regenerar.",
+    "wrongStatusTitle": "Um componente mostra ✗ embora tenha a certeza de o ter instalado",
+    "wrongStatusBody": "Significa que o <code>config.json</code> não rastreia esse componente como instalado — pode ser um script que ainda não se registra, ou uma instalação manual que contorne o ProxMenux. O diálogo reflete o que <code>config.json</code> diz, não o que está no disco."
+  },
+  "related": {
+    "heading": "Relacionado",
+    "items": [
+      {
+        "href": "/docs/settings/uninstall-proxmenux",
+        "label": "Desinstalar ProxMenux",
+        "tail": " — remover todos estes ficheiros."
+      },
+      {
+        "href": "/docs/settings",
+        "label": "Visão geral das configurações",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/pt/docs/settings/uninstall-proxmenux.json b/web/messages/pt/docs/settings/uninstall-proxmenux.json
new file mode 100644
index 00000000..5d241746
--- /dev/null
+++ b/web/messages/pt/docs/settings/uninstall-proxmenux.json
@@ -0,0 +1,92 @@
+{
+  "meta": {
+    "title": "Desinstalar ProxMenux | Documentação do ProxMenux",
+    "description": "Desinstalação limpa do ProxMenux com remoção opcional de jq e dialog, limpeza de ficheiros de tradução antigos e do serviço Monitor e reposição das cópias de segurança do sistema.",
+    "ogTitle": "Desinstalar ProxMenux | Documentação do ProxMenux",
+    "ogDescription": "Remova ProxMenux de forma limpa de um host Proxmox com limpeza de dependência opcional."
+  },
+  "header": {
+    "title": "Desinstalar ProxMenux",
+    "description": "Remove o ProxMenux do anfitrião Proxmox através de um processo interativo: confirmação, remoção opcional de dependências, limpeza do serviço ProxMenux Monitor e reposição das cópias de segurança de /root/.bashrc e /etc/motd. Apresenta uma barra de progresso durante todo o processo.",
+    "section": "Configurações"
+  },
+  "scopeWarn": {
+    "title": "Afecta apenas a instalação ProxMenux — não as suas VMs / CTs / armazenamento",
+    "body": "A desinstalação remove os scripts do ProxMenux, o lançador do menu, o serviço Monitor opcional e as cópias de segurança dos ficheiros de sistema criadas pelo ProxMenux na instalação. <strong>Não altera as suas VMs, contentores, armazenamento, configuração de rede, Fail2Ban, controlador NVIDIA ou qualquer outro elemento instalado através do ProxMenux.</strong> Estes permanecem como estão."
+  },
+  "flow": {
+    "heading": "Processo de desinstalação",
+    "items": [
+      "<strong>Diálogo de confirmação.</strong> Sim/não: «Tem a certeza de que pretende desinstalar o ProxMenux?»",
+      "<strong>Lista de dependências a remover.</strong> Apresenta jq e dialog. Ambas as caixas estão desmarcadas por predefinição; selecione apenas dependências de que nenhuma outra aplicação necessite.",
+      "<strong>A remoção apresenta uma barra de progresso.</strong> Remove qualquer ambiente de tradução antigo que tenha ficado, o lançador <code>menu</code>, a árvore <code>/usr/local/share/proxmenux/</code>, o serviço ProxMenux Monitor, se existir, e o destino de notificações registado no Proxmox VE (<code>proxmenux-webhook</code> e a respetiva regra de correspondência), bem como as dependências selecionadas. Por fim, repõe as cópias de segurança dos ficheiros de sistema (ver abaixo).",
+      "<strong>Diálogo de conclusão.</strong> Lista as dependências removidas e termina."
+    ]
+  },
+  "deps": {
+    "heading": "Remoção de dependência: o que é oferecido",
+    "intro": "A lista apresenta jq e dialog. <strong>Nenhuma caixa está selecionada por predefinição</strong>: outras aplicações podem utilizar estes pacotes do sistema, por isso é mais seguro mantê-los.",
+    "headerType": "Instalação",
+    "headerOffered": "Oferecido para remoção",
+    "rows": [
+      {
+        "type": "Versões atuais",
+        "offeredRich": "<code>dialog</code>, <code>jq</code>"
+      },
+      {
+        "type": "Instalações antigas após atualização",
+        "offeredRich": "<code>dialog</code>, <code>jq</code>"
+      }
+    ],
+    "warnTitle": "Pacotes em todo o sistema — pense duas vezes",
+    "warnBody": "A lista atual apresenta <code>jq</code> e <code>dialog</code>, não <code>python3</code>. Outras ferramentas podem necessitar destes pacotes do sistema. A remoção pode também eliminar pacotes dependentes ou dependências não utilizadas. Mantenha os pacotes necessários e reveja qualquer proposta de remoção antes de executar o apt manualmente."
+  },
+  "removed": {
+    "heading": "O que é removido",
+    "code": "/usr/local/bin/menu                                  # the launcher\n/usr/local/share/proxmenux/                          # everything: scripts, config, cache, version\n/opt/googletrans-env/                                # leftover legacy translation environment\n/etc/systemd/system/proxmenux-monitor.service        # Monitor service unit\n/root/.config/proxmenux-monitor/                     # Monitor config dir\n                                                     # + dependencies you ticked in the checklist"
+  },
+  "restored": {
+    "heading": "O que é restaurado",
+    "items": [
+      "Se o <code>/root/.bashrc.bak</code> existe → renomeado de volta para <code>/root/.bashrc</code> (seu bashrc original retorna).",
+      "Se <code>/etc/motd.bak</code> existir, é renomeado para <code>/etc/motd</code>. Caso contrário, sed remove a linha do ProxMenux (<em>“This system is optimised by: ProxMenux”</em>) do motd existente."
+    ]
+  },
+  "othersCallout": {
+    "title": "Os outros componentes instalados pelo ProxMenux são mantidos",
+    "body": "Qualquer coisa ProxMenux instalada através de outros menus — Fail2Ban, Lynis, NVIDIA drivers, ajustes pós-instalação — <strong>não</strong> é tocado por este desinstalador. Cada um tem seu próprio fluxo de desinstalação dentro do respectivo menu (ou você pode remover diretamente com o apt). Veja primeiro <em>Mostrar informações da versão</em> para ver o que está registrado."
+  },
+  "manual": {
+    "heading": "Desinstalação manual",
+    "intro": "Se por alguma razão o desinstalador de menu não pode executar (por exemplo. <code>dialog</code> já em falta), a sequência manual equivalente:",
+    "code": "# 1. Stop and remove the Monitor service (if installed)\nsystemctl stop proxmenux-monitor.service 2>/dev/null\nsystemctl disable proxmenux-monitor.service 2>/dev/null\nrm -f /etc/systemd/system/proxmenux-monitor.service\nrm -rf /root/.config/proxmenux-monitor\nsystemctl daemon-reload\nsystemctl reset-failed 2>/dev/null\n\n# 2. Remove a leftover legacy translation environment\nrm -rf /opt/googletrans-env\n\n# 3. Remove ProxMenux files\nrm -f /usr/local/bin/menu\nrm -rf /usr/local/share/proxmenux\n\n# 4. Restore backups\n[ -f /root/.bashrc.bak ] && mv /root/.bashrc.bak /root/.bashrc\n[ -f /etc/motd.bak ] && mv /etc/motd.bak /etc/motd \\\n    || sed -i '/This system is optimised by: ProxMenux/d' /etc/motd"
+  },
+  "reinstall": {
+    "heading": "Reinstalar mais tarde",
+    "body": "Execute novamente o instalador oficial do ProxMenux. As versões atuais utilizam um único modo de instalação que inclui os oito idiomas da interface."
+  },
+  "troubleshoot": {
+    "heading": "Resolução de Problemas",
+    "hangTitle": "A desinstalação bloqueia ao remover um ambiente de tradução antigo",
+    "hangBody": "As versões atuais removem um ambiente residual com <code>rm -rf /opt/googletrans-env</code>; não executam <code>pip uninstall</code>. Se este passo bloquear, examine-o noutra shell e verifique o sistema de ficheiros do anfitrião antes de repetir.",
+    "aptTitle": "O apt avisa sobre pacotes ainda em utilização ao remover dependências",
+    "aptBody": "Os pacotes selecionados são marcados como automáticos e passados a <code>apt-get -y --purge autoremove</code>. Isto não garante a proteção dos serviços dependentes. Deixe as dependências desmarcadas se outras ferramentas precisarem delas e reveja as remoções propostas pelo apt antes de qualquer limpeza manual.",
+    "motdTitle": "MOTD ainda mostra a linha ProxMenux após desinstalar",
+    "motdBody": "Pode acontecer se <code>/etc/motd.bak</code> não existia e o sed não encontrou a linha (por exemplo, porque foi alterada). Edite <code>/etc/motd</code> manualmente e remova qualquer linha do ProxMenux que tenha ficado."
+  },
+  "related": {
+    "heading": "Relacionado",
+    "items": [
+      {
+        "href": "/docs/settings/show-version-information",
+        "label": "Mostrar informações da versão",
+        "tail": " — ver o que seria removido antes de desinstalar."
+      },
+      {
+        "href": "/docs/settings",
+        "label": "Visão geral das configurações",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/pt/docs/storage-share/host-iscsi.json b/web/messages/pt/docs/storage-share/host-iscsi.json
new file mode 100644
index 00000000..46cefdd3
--- /dev/null
+++ b/web/messages/pt/docs/storage-share/host-iscsi.json
@@ -0,0 +1,123 @@
+{
+  "meta": {
+    "title": "Máquina: Adicionar iSCSI alvo como armazenamento Proxmox ProxMenux Documentação",
+    "description": "Registe um alvo iSCSI como armazenamento Proxmox com o ProxMenux. A ferramenta instala open-iscsi, descobre o portal através de sendtargets, permite escolher o alvo e executa pvesm add iscsi. Fornece dispositivos de blocos raw para as imagens de disco das VM.",
+    "ogTitle": "Máquina: Adicionar iSCSI alvo como armazenamento Proxmox ProxMenux Documentação",
+    "ogDescription": "Registe um alvo iSCSI como armazenamento Proxmox com descoberta guiada. Usa pvesm add iscsi e fornece dispositivos de blocos raw para os discos das VM."
+  },
+  "header": {
+    "title": "Máquina: Adicionar iSCSI alvo como armazenamento Proxmox",
+    "description": "Registre um alvo iSCSI (de um SAN, TrueNAS / FreeNAS, Synology, um alvo Windows Server, qualquer array que fala iSCSI) como armazenamento Proxmox. Os LUNs exportados aparecem como dispositivos de bloco e podem hospedar imagens de disco VM em desempenho quase local através da rede.",
+    "section": "Armazenamento e Compartilhamento · Máquina"
+  },
+  "intro": {
+    "title": "O que isto faz",
+    "body": "ProxMenux envolve <code>pvesm add iscsi</code> com um fluxo guiado: instala <code>open-iscsi</code> se necessário, pede o portal iSCSI (IP:port), executa <code>iscsiadm --mode discovery --type sendtargets</code> contra ele, permite escolher um IQN alvo e registra o armazenamento iSCSI no Proxmox. O serviço <code>iscsid</code>, em seguida, mantém a sessão iSCSI vivo através de reinicialização."
+  },
+  "vocab": {
+    "heading": "vocabulário iSCSI (referência rápida)",
+    "headerTerm": "Termo",
+    "headerMeaning": "Significado",
+    "rows": [
+      {
+        "term": "Portal",
+        "meaningRich": "O endpoint de serviço iSCSI no servidor alvo — um IP (ou hostname) mais uma porta TCP. O porto padrão é <code>3260</code>; ProxMenux assume-o se você não especificar um."
+      },
+      {
+        "term": "Alvo",
+        "meaningRich": "Um único servidor exportado dentro do portal, identificado pelo seu IQN (<em>iSCSI Qualified Name</em>). Um portal pode hospedar muitos alvos."
+      },
+      {
+        "term": "IQN",
+        "meaningRich": "A forma canônica é <code>iqn.YYYY-MM.reverse.domain:identifier</code>, por exemplo <code>iqn.2024-08.com.truenas:proxmox-pool</code>. Tanto o alvo como o iniciador têm o seu próprio IQN."
+      },
+      {
+        "term": "LUN",
+        "meaningRich": "Um dispositivo de bloco dentro de um alvo (Número de Unidade Lógica). Um único alvo pode expor vários LUNs; cada LUN aparece como seu próprio disco em Proxmox e pode se tornar um disco VM."
+      },
+      {
+        "term": "Iniciador",
+        "meaningRich": "O cliente que se conecta a um alvo — neste caso, seu host Proxmox. O iniciador tem seu próprio IQN armazenado em <code>/etc/iscsi/initiatorname.iscsi</code>. Os alvos geralmente só aceitam sessões de IQNs de iniciadores pré-autorizados."
+      }
+    ]
+  },
+  "opening": {
+    "heading": "Abrir a ferramenta",
+    "body": "Do menu principal do ProxMenux, abra o <strong>Storage &amp; Share Manager → Adicione iSCSI Target como Proxmox Storage</strong>. Você verá este sub-menu com quatro opções:",
+    "imageAlt": "Menu do gestor de máquinas iSCSI — Adicionar / Ver / Remover / Teste de conectividade"
+  },
+  "howRuns": {
+    "heading": "Como o script é executado (Adicionar fluxo)",
+    "body": "O fluxo tem duas fases com separação clara entre \"ajustar o iniciador, descobrir alvos\" e \"realmente registrar armazenamento em Proxmox\". Ao contrário do NFS / Samba, não há nenhuma descoberta automática na sub-rede — você deve saber o endereço do portal (iSCSI não é amigável à transmissão)."
+  },
+  "add": {
+    "heading": "Adicionar o alvo iSCSI como armazenamento Proxmox",
+    "items": [
+      "<strong>Entrada portal</strong> — digite o IP ou hostname do servidor alvo iSCSI. Porta <code>3260</code> é assumido a menos que você digite <code>host:port</code>.",
+      "<strong>Descoberta do alvo</strong> — ProxMenux chama <code>iscsiadm --mode discovery --type sendtargets --portal &lt;ip:port&gt;</code>. O servidor responde com cada IQN que permite que este iniciador veja. Se a descoberta falhar, o script mostra o erro exato de <code>iscsiadm</code> e lista causas comuns (IP errado, firewall, IQN iniciador não autorizado).",
+      "<strong>Seleção do alvo</strong> — um único alvo é selecionado automaticamente; vários alvos mostram um menu.",
+      "<strong>Storage ID</strong> — padrão é <code>iscsi-&lt;last IQN segment, 20 chars max&gt;</code>. Apenas letras, dígitos, <code>-</code> e <code>_</code>.",
+      "<strong>Tipo de conteúdo</strong> — ao contrário do NFS / Samba, o conteúdo de iSCSI é <strong>fixo ao <code>images</code></strong>. iSCSI expõe dispositivos de bloco brutos, não um sistema de arquivos, então o Proxmox só permite hospedar discos VM nele."
+    ],
+    "authTitle": "Autorizar o iniciador Proxmox no alvo",
+    "authBody1": "Antes do fluxo Adicionar funcionar de ponta a ponta, o alvo iSCSI precisa conhecer seu host Proxmox. Obter o seu IQN iniciador:",
+    "authBody2": "Adicione esse IQN à lista de acesso do alvo (TrueNAS: <em>Sharing → Block → Initiators Groups</em>; Synology: <em>SAN Manager → iSCSI → Target → Edit → Initiators</em>; etc.). Se o iniciador não estiver autorizado, a descoberta com <code>iscsiadm</code> retorna uma lista vazia ou um erro de autenticação."
+  },
+  "manual": {
+    "heading": "Equivalente manual",
+    "body": "O fluxo completo corresponde a estes comandos:"
+  },
+  "view": {
+    "heading": "Ver os armazenamentos iSCSI configurados",
+    "body": "Lista todas as entradas iSCSI no Proxmox (<code>pvesm status | awk ''$2 == \"iscsi\"''</code>) com portal, IQN do alvo, tipo de conteúdo e estado atual."
+  },
+  "remove": {
+    "heading": "Remover o armazenamento de iSCSI",
+    "body": "Executa <code>pvesm remove &lt;storage-id&gt;</code> após confirmar portal, alvo e conteúdo. Somente o registro Proxmox é removido — <strong>o alvo iSCSI em si não é tocado</strong> e as sessões existentes no lado do kernel podem durar até o próximo reinício.",
+    "warnTitle": "Verifique primeiro os discos de VM existentes neste iSCSI",
+    "warnBody": "Removendo um armazenamento iSCSI enquanto as VMs ainda têm discos nele deixa aquelas VMs apontando para uma loja desaparecida. O Proxmox assinalará o erro, mas os dados LUN não são tocados no alvo — você pode registrar novamente o armazenamento mais tarde para recuperar os discos. Ainda assim, mova ou faça backup das VMs primeiro para ser seguro."
+  },
+  "test": {
+    "heading": "Teste de conectividade iSCSI",
+    "body": "Executa um passe diagnóstico: verifica se o <code>iscsiadm</code> está instalado, imprime o seu IQN iniciador, confirma que o <code>iscsid</code> está em execução, pings cada portal registrado, sonda sua porta, e relata o <code>pvesm status</code> mais se uma sessão iSCSI está atualmente ativa (<code>iscsiadm --mode session</code>). Sessão ativa mais portal acessível, mas \"inativo\" no Proxmox geralmente significa um estado obsoleto — tente <code>pvesm set &lt;id&gt; --disable 0</code>."
+  },
+  "troubleshoot": {
+    "heading": "Resolução de Problemas",
+    "portalTitle": "\"Não é possível alcançar o portal\", mas o IP do servidor responde em outro lugar",
+    "portalBody": "O ping ao endereço do portal falhou. Verifique se está alcançando a interface da <em>rede de armazenamento</em> (iSCSI costuma usar uma VLAN ou sub-rede separada da rede de gerenciamento). Confira também o DNS se informou um nome de host.",
+    "discoverTitle": "\"A descoberta do iSCSI falhou\" do iscsiadm",
+    "discoverIntro": "O script mostra o erro exato. Causas mais comuns:",
+    "discoverItems": [
+      "Portal IP / porta errada (dupla verificação, padrão é 3260).",
+      "O serviço iSCSI não está em execução no servidor alvo.",
+      "Firewall bloqueia 3260 entre Proxmox e o alvo.",
+      "<strong>Iniciador IQN não está autorizado no alvo.</strong> Causa mais frequente em matrizes empresariais. Adicione o seu Proxmox IQN ao ACL inicial do alvo primeiro."
+    ],
+    "noTargetTitle": "Nenhum alvo encontrado, mas a descoberta foi bem- sucedida",
+    "noTargetBody": "O servidor aceitou o seu iniciador, mas não expõe nenhum alvo a ele. Revise os controles de autenticação/acesso do alvo — alguns arrays permitem a descoberta de todas as IQNs, mas filtram os alvos que cada IQN pode ver.",
+    "noLunTitle": "LUNs não aparecem em /dev/disk/by-path após o registro",
+    "noLunBody": "<code>pvesm add iscsi</code> teve sucesso, mas o kernel não está vendo dispositivos de bloco. Verifique <code>iscsiadm --mode session</code> — se nenhuma sessão estiver ativa, inicie uma manualmente com <code>iscsiadm --mode node --login</code>. Se uma sessão existir, mas não aparecerem LUNs, force uma nova varredura: <code>iscsiadm --mode session --rescan</code>. Se ainda nada, o alvo provavelmente não tem LUNs atribuídos a este IQN ainda (configurar mapeamento LUN no alvo).",
+    "chapTitle": "Autenticação CHAP",
+    "chapBody": "O ProxMenux não oferece campos de usuário e senha CHAP no fluxo interativo. Se a descoberta falhar, o script para antes de <code>pvesm add</code>; o armazenamento não é registrado apesar da falha. Configure separadamente os requisitos CHAP do alvo em <code>open-iscsi</code>, incluindo a autenticação da descoberta quando necessária, e tente novamente. Confira a configuração com <code>iscsiadm</code> e verifique sessões ativas com <code>iscsiadm --mode session</code>."
+  },
+  "related": {
+    "heading": "Relacionado",
+    "items": [
+      {
+        "href": "/docs/storage-share/host-nfs",
+        "label": "Compartilhamento NFS como armazenamento Proxmox",
+        "tail": " — alternativas ao nível dos ficheiros. Mais simples de configurar, mais flexível (backup / ISO / tmpl / imagens), ligeiramente mais lento para discos VM ao vivo."
+      },
+      {
+        "href": "/docs/storage-share/host-samba",
+        "label": "Samba / CIFS como armazenamento Proxmox",
+        "tail": " — outra opção de nível de arquivo; evite para discos VM ao vivo devido à semântica de bloqueio."
+      },
+      {
+        "href": "/docs/storage-share/host-local-disk",
+        "label": "Adicionar o disco local como armazenamento Proxmox",
+        "tail": " — quando o disco é local para a máquina Proxmox, não em outra caixa na rede."
+      }
+    ]
+  }
+}
diff --git a/web/messages/pt/docs/storage-share/host-local-disk.json b/web/messages/pt/docs/storage-share/host-local-disk.json
new file mode 100644
index 00000000..88588111
--- /dev/null
+++ b/web/messages/pt/docs/storage-share/host-local-disk.json
@@ -0,0 +1,186 @@
+{
+  "meta": {
+    "title": "Máquina: Adicionar o disco local como armazenamento Proxmox ProxMenux Documentação",
+    "description": "Formate um disco SATA, SAS ou NVMe local num host Proxmox e registe-o como armazenamento de tipo diretório ou pool ZFS. Inclui seleção segura do disco, confirmação das operações destrutivas, fstab por UUID, criação do pool ZFS e utilização de pvesm add dir / zfspool.",
+    "ogTitle": "Máquina: Adicionar o disco local como armazenamento Proxmox ProxMenux Documentação",
+    "ogDescription": "Formate um disco local e registre-o como armazenamento de diretório ou pool ZFS no Proxmox com um fluxo guiado e filtros de segurança."
+  },
+  "header": {
+    "title": "Máquina: Adicionar disco local como armazenamento Proxmox",
+    "description": "Pegue um disco físico na máquina Proxmox, opcionalmente formate-o (ext4 / xfs / btrfs / zfs) e registre-o como armazenamento Proxmox — quer como diretório (pvesm add dir) quer como um pool ZFS (pvesm add zfspool). ProxMenux filtra a lista de discos para que você não possa escolher o disco raiz ou qualquer coisa em uso, e torna cada passo destrutivo explícito antes de executá-lo.",
+    "section": "Armazenamento e Compartilhamento · Máquina"
+  },
+  "intro": {
+    "title": "O que isto faz",
+    "body": "Outras ferramentas <em>Host</em> nesta seção lidam com armazenamento de <strong>rede</strong> (NFS / Samba / iSCSI). Este lida com discos <strong>locais</strong> — unidades de reposição fisicamente conectadas ao seu host Proxmox que você deseja usar para discos VM, backups, ISOs ou modelos. ProxMenux prepara o disco (partição + formato + montagem) e registra-o em Proxmox para que a UI possa colocar conteúdo lá."
+  },
+  "destructive": {
+    "title": "Ferramenta destrutiva para o caminho do 'formato'",
+    "body": "A opção <em>Formatar</em> <strong>destrói as partições e os dados existentes no disco selecionado</strong>. O ProxMenux mostra um aviso, filtra discos em uso e exige confirmação antes de executar <code>wipefs</code> / <code>sgdisk</code> / <code>mkfs</code>. Isso não é uma sobrescrita segura de cada byte. Confira duas vezes o caminho do dispositivo antes de confirmar."
+  },
+  "compare": {
+    "heading": "Directório vs ZFS pool — qual escolher",
+    "headerDir": "Pasta (ext4 / xfs / btrfs)",
+    "headerZfs": "Conjunto ZFS",
+    "rows": [
+      {
+        "label": "Tipo de armazenamento Proxmox",
+        "dirRich": "<code>dir</code>",
+        "zfsRich": "<code>zfspool</code>"
+      },
+      {
+        "label": "Formato de disco VM",
+        "dir": "Arquivo qcow2 / raw em um sistema de arquivos",
+        "zfs": "Conjunto de dados nativo ZFS (zvol) por disco"
+      },
+      {
+        "label": "Instantâneos",
+        "dir": "qcow2 instantâneos; btrfs instantâneos se fs=btrfs",
+        "zfs": "Nativo, instantâneo, copy-on-write"
+      },
+      {
+        "label": "Aprovisionamento dinâmico",
+        "dir": "Sim (qcow2 por omissão)",
+        "zfs": "Sim (ZFS por omissão)"
+      },
+      {
+        "label": "Necessidades de RAM",
+        "dir": "Baixo",
+        "zfs": "Altas — o ZFS usa a RAM livre como cache ARC"
+      },
+      {
+        "label": "Suporta tipos de conteúdo",
+        "dir": "images, backup, iso, vztmpl, snippets, rootdir",
+        "zfs": "apenas images e rootdir (armazenamento em blocos)"
+      },
+      {
+        "label": "Melhor para",
+        "dir": "Disco de uso geral: mistura de discos VM, backups, ISOs",
+        "zfs": "Puro disco de dados VM / LXC com instantâneo + necessidades de integridade"
+      }
+    ]
+  },
+  "opening": {
+    "heading": "Abrir a ferramenta",
+    "body": "Do menu principal do ProxMenux, abra o <strong>Storage &amp; Share Manager → Adicione disco local como armazenamento Proxmox</strong>. Você verá este sub-menu com quatro opções:",
+    "imageAlt": "Menu de gerenciamento de disco local — Adicionar / Ver / Remover / Listar discos disponíveis"
+  },
+  "howRuns": {
+    "heading": "Como o script é executado (Adicionar fluxo)",
+    "body": "O fluxo tem duas fases com um filtro de segurança com três verificações. Fase 1 descobre discos seguros, decide o que fazer com o escolhido e coleta parâmetros de armazenamento; Fase 2 faz o trabalho destrutivo. Até a confirmação final o disco está intocado."
+  },
+  "format": {
+    "heading": "Formatar um disco em branco",
+    "intro": "O caminho para um disco fresco ou um cujo conteúdo você não se importa.",
+    "items": [
+      "Escolha o disco (sistema / discos em uso estão escondidos).",
+      "Escolha \"Format disk (ERASE todos os dados)\".",
+      "Escolha o sistema de arquivos — veja a tabela acima para trade-offs.",
+      "ID de armazenamento (padrão <code>disk-&lt;device&gt;</code>), caminho de montagem, tipo de conteúdo predefinido.",
+      "Confirme no diálogo <strong>CONFIRMAÇÃO FINAL — OS DADOS SERÃO APAGADOS</strong>.",
+      "O ProxMenux limpa a tabela de partições e cria uma partição que ocupa o disco. Executa <code>mkfs.&lt;fs&gt;</code> ou <code>zpool create</code> e monta o resultado. Sistemas de arquivos comuns recebem uma entrada UUID em <code>/etc/fstab</code> com <code>defaults,nofail</code>; o ZFS usa a configuração de montagem do pool. Se <em>Como armazenamento Proxmox</em> estiver marcado (sempre no caso do ZFS), ele é registrado com <code>pvesm add dir</code> ou <code>pvesm add zfspool</code>; caso contrário, fica apenas como montagem do host."
+    ],
+    "tipTitle": "Porquê UUID + nofail em /etc/fstab",
+    "tipBody": "O script escreve <code>UUID=… /mnt/&lt;id&gt; &lt;fs&gt; defaults,nofail 0 2</code>. O UUID sobrevive à reordenação do dispositivo através de reinicialização (então o <code>/dev/sdc</code> tornando-se o <code>/dev/sdd</code> não quebra a inicialização). <code>nofail</code> significa que se o disco desaparecer (falha de Hardware, desconectado), o Proxmox ainda inicia — o armazenamento só será mostrado como inativo até que o disco volte."
+  },
+  "reuse": {
+    "heading": "Reutilizar um sistema de ficheiros existente",
+    "intro": "O caminho para um disco que você deseja manter os dados em — talvez você tenha movido de outro host Proxmox, ou o disco já tem backups / ISOs que você deseja manter acessível.",
+    "items": [
+      "Escolhe o disco.",
+      "Escolha \"Usar o sistema de arquivos existente\".",
+      "ID de armazenamento, local de montagem, predefinição do tipo de conteúdo.",
+      "ProxMenux <strong>não</strong> toca nos dados: ele cria o ponto de montagem, monta o disco, adiciona uma entrada UUID a <code>/etc/fstab</code> e a registra como um armazenamento Proxmox <code>dir</code>."
+    ],
+    "warnTitle": "O caminho de reutilização não lida com ZFS pools",
+    "warnBody": "Se o disco já contém um pool ZFS, o caminho <em>reuse</em> aqui apenas tenta montá-lo como um sistema de arquivos regular – que falha. Para importar um pool ZFS existente use <code>zpool import &lt;name&gt;</code> na linha de comando e registre-o manualmente com <code>pvesm add zfspool</code>."
+  },
+  "presets": {
+    "heading": "Predefinições do tipo de conteúdo",
+    "intro": "O ProxMenux oferece três predefinições e uma opção personalizada. A lista de conteúdo escolhida é passada para <code>pvesm add … --content &lt;csv&gt;</code>:",
+    "headerPreset": "Predefinição",
+    "headerContent": "Texto do conteúdo",
+    "headerUse": "Caso de uso",
+    "rows": [
+      {
+        "preset": "Armazenamento VM",
+        "content": "images,backup",
+        "use": "Um armazenamento dedicado aos discos de VMs que também mantém os backups dessas VMs por perto."
+      },
+      {
+        "preset": "NAS padrão",
+        "content": "backup,iso,vztmpl",
+        "use": "Um arquivo / disco de mídia — backups, ISOs e modelos LXC. Nenhum disco VM vivo aqui."
+      },
+      {
+        "preset": "Todos os tipos",
+        "content": "images,backup,iso,vztmpl,snippets",
+        "use": "Esta predefinição ampla habilita imagens, backups, ISOs, modelos LXC e snippets. Adicione outros tipos compatíveis, como rootdir, pela opção Personalizado se necessário."
+      },
+      {
+        "preset": "Personalizado",
+        "content": "(input livre)",
+        "useRich": "Digite o CSV exato, por exemplo. <code>images</code> sozinho, ou <code>rootdir,images</code>."
+      }
+    ],
+    "zfsTitle": "ZFS pool conteúdo é mais estreito",
+    "zfsBody": "Com <strong>zfs</strong>, um <code>zfspool</code> aceita apenas <code>images</code> e <code>rootdir</code>, não arquivos ISO ou backups. Informe uma lista compatível em Personalizado. O script a encaminha sem alterações; tipos incompatíveis podem fazer o registro falhar. Verifique <code>pvesm status</code> depois."
+  },
+  "manual": {
+    "heading": "Equivalente manual",
+    "extIntro": "Formato + registrar um disco como armazenamento de diretório ext4:",
+    "zfsIntro": "Ou como um ZFS pool:"
+  },
+  "view": {
+    "heading": "Ver os armazenamentos de discos",
+    "body": "Lista cada armazenamento Proxmox apoiado em disco (ambos <code>dir</code> e <code>zfspool</code> que são criados pelo usuário – pools de sistema como <code>rpool</code> estão escondidos). Mostra o caminho de montagem / nome do pool, tipos de conteúdo e estado ao vivo."
+  },
+  "remove": {
+    "heading": "Remover o armazenamento do disco",
+    "body": "Remove o registro do armazenamento no Proxmox (<code>pvesm remove</code>) e oferece limpar a entrada correspondente em <code>/etc/fstab</code>. O script <strong>não</strong> destrói pools ZFS automaticamente; isso exige executar separadamente <code>zpool destroy &lt;name&gt;</code> quando tiver certeza.",
+    "warnTitle": "Dados e dependências VM existentes",
+    "warnBody": "A remoção do armazenamento não toca no sistema de arquivos nem no pool — os dados permanecem no disco. Mas VMs / CTs que referenciam este armazenamento por ID não vai começar após a remoção. Mova esses discos VM para outro armazenamento (ou faça um backup) antes de remover."
+  },
+  "list": {
+    "heading": "Listar os discos disponíveis",
+    "body": "Uma visão diagnóstica somente de leitura: imprime a saída de <code>lsblk -o NAME,SIZE,TYPE,FSTYPE,MOUNTPOINT,MODEL</code> seguida pelo <code>dir</code> / <code>zfspool</code> armazenamentos já conhecidos pelo Proxmox. Boa primeira parada quando você abrir a ferramenta e quiser ver \"o que está neste host?\" antes de adicionar qualquer coisa."
+  },
+  "troubleshoot": {
+    "heading": "Resolução de Problemas",
+    "noDisksTitle": "\"Nenhum disco disponível encontrado\"",
+    "noDisksIntro": "O filtro de segurança escondeu todos os discos. Razões comuns:",
+    "noDisksItems": [
+      "Apenas o disco raiz está presente.",
+      "Cada outro disco é parte de uma matriz ativa ZFS / LVM / RAID.",
+      "Cada outro disco é referenciado por uma configuração VM ou LXC (passthrough).",
+      "O disco está em modo somente leitura (falha de hardware ou bloqueio de gravação)."
+    ],
+    "noDisksOutro": "Use <em>Lista de discos disponíveis</em> do menu para ver a saída <code>lsblk</code> bruta e entender o que está acontecendo.",
+    "mountedTitle": "O formato falha com \"o dispositivo está montado\"",
+    "mountedBody": "Algo montou automaticamente o disco (udisksd, um gerenciador de desktop, uma unidade de systemd). Desmontá-lo: <code>umount /dev/sdX?*</code> ou <code>systemctl stop &lt;whatever-mounts-it&gt;</code>, então tente novamente. O filtro de segurança do script deve ter discos montados ocultos, então se você alcançou este erro a montagem aconteceu entre o menu mostrando e você confirmando.",
+    "zpoolTitle": "zpool create falha com «invalid vdev specification»",
+    "zpoolBody": "Normalmente significa que o disco ainda tem GPT / LVM / ZFS assinaturas que <code>zpool</code> se recusa a substituir sem força. O script executa <code>wipefs</code> e <code>sgdisk --zap-all</code> antes do formato, mas um disco muito teimoso ainda pode ter uma etiqueta antiga. Forçar uma limpeza limpa manualmente: <code>zpool labelclear -f /dev/sdX</code> ou <code>dd if=/dev/zero of=/dev/sdX bs=1M count=10</code> e tentar novamente.",
+    "inactiveTitle": "O armazenamento mostra como inativo após reiniciar",
+    "inactiveBody": "Verifique <code>findmnt &lt;mount-path&gt;</code> — se a montagem está faltando, algo em <code>/etc/fstab</code> falhou. <code>dmesg | tail</code> geralmente aponta para a razão (incompatibilidade UUID, corrupção do sistema de arquivos, <code>nofail</code> deixou cair a repetição). Um <code>mount -a</code> geralmente reativa o armazenamento uma vez que a causa é fixa."
+  },
+  "related": {
+    "heading": "Relacionado",
+    "items": [
+      {
+        "href": "/docs/disk-manager/format-disk",
+        "label": "Gerenciador de disco: Formato / Limpar disco físico",
+        "tail": " — alternativa de baixo nível quando você só quer preparar um disco sem registá-lo como armazenamento Proxmox."
+      },
+      {
+        "href": "/docs/storage-share/host-iscsi",
+        "label": "Adicionar o alvo iSCSI como armazenamento Proxmox",
+        "tail": " — equivalente de rede quando o dispositivo de blocos está em outra máquina."
+      },
+      {
+        "href": "/docs/storage-share/host-local-shared",
+        "label": "Adicionar a Pasta Partilhada na Máquina",
+        "tail": " — preparar um directório na máquina para as montagens de ligação LXC (não regista um armazenamento Proxmox)."
+      }
+    ]
+  }
+}
diff --git a/web/messages/pt/docs/storage-share/host-local-shared.json b/web/messages/pt/docs/storage-share/host-local-shared.json
new file mode 100644
index 00000000..83887e3f
--- /dev/null
+++ b/web/messages/pt/docs/storage-share/host-local-shared.json
@@ -0,0 +1,103 @@
+{
+  "meta": {
+    "title": "Máquina: Adicionar diretório compartilhado no Host ProxMenux Documentação",
+    "description": "Crie um diretório no host pronto para bind mounts LXC, com permissões para contêineres com e sem privilégios. Sticky bit, rwx para todos e ACLs padrão para herança.",
+    "ogTitle": "Máquina: Adicionar diretório compartilhado no Host ProxMenux Documentação",
+    "ogDescription": "Prepare um diretório host para bind mounts LXC com permissões compatíveis com CTs privilegiadas e sem privilégios."
+  },
+  "header": {
+    "title": "Máquina: Adicionar diretório compartilhado na Máquina",
+    "description": "Crie um diretório no host para bind mounts em um ou mais contêineres LXC. O ProxMenux aplica permissões para CTs com e sem privilégios, sem precisar alinhar UIDs deslocados ou executar chown para cada contêiner, e registra o diretório para uso posterior pelo LXC Mount Manager.",
+    "section": "Armazenamento e Compartilhamento · Máquina"
+  },
+  "intro": {
+    "title": "O que é isto (e NÃO é)",
+    "body": "Esta ferramenta <strong>não</strong> registra nada no Proxmox (nenhum <code>pvesm add</code> aqui). Ele apenas prepara um diretório no host — <code>/mnt/shared</code>, por padrão — com permissões que qualquer contêiner LXC pode ler e gravar, independentemente de o CT ser privilegiado ou não. A próxima etapa normal é montá-lo em cada CT com o <mountLink>LXC Mount Manager</mountLink>."
+  },
+  "why": {
+    "heading": "Por que uma ferramenta dedicada para isso",
+    "intro": "Quando você vincula uma pasta de host em um container LXC, as permissões dependem de:",
+    "items": [
+      "Se o CT tem <strong>privilégios</strong> (UID 0 no CT = UID 0 no host) ou <strong>não tem privilégios</strong> (UID 0 no CT = UID 100000 no host, com deslocamento de +100000).",
+      "O proprietário do diretório do host (um arquivo do UID 1000 no host usa as permissões de “outros” para um CT sem privilégios, pois nenhum usuário do CT corresponde a esse UID do host).",
+      "Se vários CTs compartilham o mesmo diretório (CTs diferentes podem ter diferentes intervalos UID)."
+    ],
+    "outro": "O truque pragmático que ProxMenux usa aqui é para <strong>dar a todos acesso</strong> no nível do sistema de arquivos: world-rwx mais o sticky bit, além de ACLs para que os novos arquivos herdem as mesmas permissões. Qualquer UID mapeado pode ler e escrever; nenhum alinhamento UID / GID é necessário."
+  },
+  "howRuns": {
+    "heading": "Como o script é executado",
+    "body": "O script não tem menu principal — ele executa uma única ação, <strong>Crie diretório compartilhado</strong>. Fase 1 coleta o caminho-alvo; Fase 2 cria o diretório e aplica permissões."
+  },
+  "bits": {
+    "heading": "O que cada bits de permissão faz",
+    "intro": "O número <strong>1777</strong> não é arbitrário — é o mesmo modo que o Linux usa para <code>/tmp</code>. Três propriedades combinadas:",
+    "headerBit": "Bit",
+    "headerEffect": "Efeito",
+    "headerWhy": "Porque é que isto importa aqui?",
+    "rows": [
+      {
+        "bit": "1 (sticky bit)",
+        "effect": "Somente o proprietário do arquivo, o proprietário do diretório ou um processo com privilégios suficientes pode excluir ou renomear o arquivo.",
+        "why": "Ajuda a impedir que usuários com UIDs mapeados diferentes apaguem arquivos uns dos outros. Não isola CTs com o mesmo UID mapeado ou acesso root privilegiado."
+      },
+      {
+        "bit": "777 (rwx-rwx-rwx)",
+        "effect": "Todos podem ler, gravar e atravessar o diretório.",
+        "why": "Os UIDs CT não privilegiados (100000+) aparecem como \"outros\" do host, então o world-rwx lhes dá acesso."
+      },
+      {
+        "bit": "ACL (predefinidas)",
+        "effect": "Herdado em cada arquivo / subdir recém-criado.",
+        "why": "O novo conteúdo herda as ACLs padrão sem executar o script novamente. Os aplicativos ainda podem solicitar modos restritivos ou alterar as permissões depois."
+      }
+    ],
+    "privTitle": "Os CTs com privilégios veem o mesmo resultado, sem o deslocamento de UIDs",
+    "privBody": "Para um CT privilegiado, o UID 0 no CT é o UID 0 no host, então o <code>root</code> dentro do CT pode ler / escrever o diretório do host diretamente. <code>1777</code> ainda está bem — isso significa que usuários não root dentro do CT também podem usar o diretório. As mesmas permissões cobrem ambos os casos."
+  },
+  "where": {
+    "heading": "Onde colocar o diretório compartilhado",
+    "intro": "O selecionador de localização oferece quatro opções:",
+    "opt1Title": "1. Criar uma nova pasta no /mnt",
+    "opt1Body": "A escolha habitual. ProxMenux auto-sugere o primeiro nome livre (<code>shared</code>, <code>shared2</code>, <code>shared3</code>, ...). Basta confirmar ou escrever um nome diferente.",
+    "opt2Title": "2. Digite o caminho personalizado",
+    "opt2Body": "Para pastas fora de <code>/mnt</code>. Qualquer caminho absoluto funciona (por exemplo, <code>/srv/media</code>, <code>/data/family</code>). O script aplica as mesmas permissões.",
+    "opt3Title": "3. Ver as pastas existentes no /mnt",
+    "opt3Body": "Diagnóstico somente leitura: lista todos os diretórios sob <code>/mnt</code> com suas permissões, proprietário e espaço disponível. Útil antes de criar um novo para evitar colisões de nomes.",
+    "opt4Title": "4. Cancelar",
+    "opt4Body": "Sai sem criar nada. O mesmo que pressionar <kbd>Esc</kbd>.",
+    "tipTitle": "Onde vive o /mnt?",
+    "tipBody": "Por padrão, o <code>/mnt</code> fica no sistema de arquivos raiz do Proxmox. Se você quiser o diretório compartilhado em um disco diferente (um disco de dados, um pool ZFS), monte esse disco em <code>/mnt/&lt;name&gt;</code> primeiro (disco Manager ou <diskLink>Adicionar disco local como armazenamento Proxmox</diskLink>), e então crie o diretório compartilhado como uma subpasta dentro dele — ou escolha \"Digite o caminho personalizado\" aqui e aponte para o disco montado."
+  },
+  "manual": {
+    "heading": "Equivalente manual",
+    "body": "Todo o fluxo pode ser reproduzido à mão:"
+  },
+  "next": {
+    "heading": "Próxima etapa: bind mount nos contêineres",
+    "body": "Criar o diretório apenas o prepara – nenhum contêiner o vê ainda. Para torná-lo visível dentro de um ou mais LXCs, use o <mountLink>LXC Mount Manager</mountLink> para vincular a montagem <code>/mnt/&lt;name&gt;</code> nos CTs. Como as permissões já estão abertas, o Mount Manager <strong>não</strong> se oferecerá para alterá-las — o diretório está pronto para ser usado como está."
+  },
+  "troubleshoot": {
+    "heading": "Resolução de Problemas",
+    "mkdirTitle": "\"Failed to create directory\"",
+    "mkdirBody": "Normalmente um problema do sistema de arquivos: <code>/mnt</code> está em um sistema de arquivos somente leitura, o caminho contém um componente que não é um diretório (por exemplo, você digitou <code>/etc/passwd/sub</code>), ou o disco está cheio. Verifique com <code>df -h /mnt</code> e <code>mount | grep /mnt</code>.",
+    "writeTitle": "O recipiente não pode escrever apesar das permissões abertas",
+    "writeBody": "Verifique novamente se o CT está realmente usando a montagem de ligação (<code>pct config &lt;ctid&gt; | grep ^mp</code>). Dentro do CT, execute <code>touch /mnt/data/test-$(date +%s)</code> — se isso falhar com a permissão negada, a montagem pode estar em um sistema de arquivos host que não honra ACLs (algumas montagens mais antigas de <code>ext3</code> ou <code>vfat</code>). Mova o diretório compartilhado para um ext4 / xfs / btrfs / zfs de suporte.",
+    "aclTitle": "Comandos ACL silenciosamente indisponíveis",
+    "aclBody": "Em uma instalação Proxmox mínima <code>setfacl</code> / <code>getfacl</code> podem não estar instalados. O script cai de volta graciosamente (<code>command -v setfacl</code> check) e aplica apenas permissões POSIX — que é muitas vezes suficiente, mas novos arquivos não herdarão automaticamente o perfil permissivo. Instale <code>acl</code> com <code>apt-get install -y acl</code> e execute novamente o script no diretório."
+  },
+  "related": {
+    "heading": "Relacionado",
+    "items": [
+      {
+        "href": "/docs/storage-share/lxc-mount-points",
+        "label": "Gerenciador de montagem LXC",
+        "tail": " — a etapa natural seguinte: ligar esta pasta num ou mais recipientes."
+      },
+      {
+        "href": "/docs/storage-share/host-local-disk",
+        "label": "Adicionar o disco local como armazenamento Proxmox",
+        "tailRich": " — se você quiser o diretório compartilhado em um disco dedicado, prepare o disco primeiro, monte-o em <code>/mnt</code>, em seguida, crie a subpasta compartilhada aqui."
+      }
+    ]
+  }
+}
diff --git a/web/messages/pt/docs/storage-share/host-nfs.json b/web/messages/pt/docs/storage-share/host-nfs.json
new file mode 100644
index 00000000..2e8471a4
--- /dev/null
+++ b/web/messages/pt/docs/storage-share/host-nfs.json
@@ -0,0 +1,174 @@
+{
+  "meta": {
+    "title": "Host: montar compartilhamento NFS | Documentação ProxMenux",
+    "description": "Monte uma exportação NFS externa no host Proxmox como armazenamento Proxmox com pvesm add nfs, como montagem fstab independente que não aparece em Datacenter > Storage ou das duas formas. O método fstab é adequado para partilhar o caminho com contentores LXC por bind mount sem o registar como armazenamento Proxmox.",
+    "ogTitle": "Host: montar compartilhamento NFS | Documentação ProxMenux",
+    "ogDescription": "Monte uma exportação NFS externa no host Proxmox via pvesm, fstab ou ambos. A opção fstab é ideal para bind mounts LXC."
+  },
+  "header": {
+    "title": "Host: montar compartilhamento NFS no host",
+    "description": "Montar uma exportação NFS externa (de um NAS, outro servidor, uma partilha homelab...) na máquina Proxmox. Escolha um ou ambos os métodos: registre-o como armazenamento Proxmox (visível no Datacenter > Armazenamento) e/ou adicione uma montagem /etc/fstab simples em um caminho que você escolher (útil para montar o compartilhamento em recipientes LXC sem expô-lo como armazenamento Proxmox).",
+    "section": "Armazenamento e Compartilhamento · Máquina"
+  },
+  "intro": {
+    "title": "O que isto faz",
+    "body": "ProxMenux oferece dois métodos de montagem para qualquer exportação de NFS: <strong>(1) Armazenamento Proxmox</strong> via <code>pvesm add nfs</code> — o compartilhamento aparece no Datacenter > Armazenamento e Proxmox gerencia a montagem em <code>/mnt/pve/&lt;id&gt;</code>; <strong>(2) Montagem fstab no host</strong> em um caminho que você escolhe — persistente via <code>/etc/fstab</code>, NÃO visível como armazenamento Proxmox, ideal para montagem em contêineres LXC (Proxmox UI permanece limpo). Você pode executar um método, o outro, ou ambos."
+  },
+  "opening": {
+    "heading": "Abrir a ferramenta",
+    "body": "Do menu principal do ProxMenux, abra o <strong>Storage &amp; Share Manager → Monte NFS Share on Host</strong>. Você verá este sub-menu com quatro opções:",
+    "imageAlt": "Menu do gestor de máquinas NFS — Montar / Ver / Remover / Teste de conectividade"
+  },
+  "howRuns": {
+    "heading": "Como o script é executado",
+    "body": "O fluxo tem duas fases com separação clara entre \"descobrir, validar e escolher\" e \"na verdade montagem / gravação config\". Depois de seleccionar uma exportação, escolha os métodos de montagem através de uma lista de verificação; o resto das janelas só pede parâmetros para os métodos que seleccionou. Até à confirmação final, nem <code>/etc/pve/storage.cfg</code> nem <code>/etc/fstab</code> são tocados."
+  },
+  "modes": {
+    "heading": "Selector de métodos de montagem (duas opções, marca uma ou ambas)",
+    "intro": "Após selecionar e validar a exportação, o ProxMenux mostra uma lista de verificação com os dois métodos de montagem. Pode marcar um ou ambos. Se carregar em OK sem marcar nada, a janela reaparece até escolher pelo menos uma opção ou carregar em Cancelar para sair do fluxo.",
+    "imageAlt": "Lista de verificação do método de montagem com opções pvesm e fstab",
+    "headerMethod": "Método",
+    "headerMount": "Caminho de montagem",
+    "headerUi": "Visível no Datacenter > Armazenamento",
+    "headerUseCase": "Caso de uso típico",
+    "rows": [
+      {
+        "method": "<strong>Como armazenamento Proxmox (pvesm)</strong>",
+        "mountRich": "<code>/mnt/pve/&lt;storage-id&gt;</code> (gerido pela Proxmox)",
+        "ui": "Sim",
+        "useCase": "Imagens de disco VM, backups, ISOs, modelos LXC — qualquer coisa que precise aparecer na interface Proxmox."
+      },
+      {
+        "method": "<strong>Host somente fstab</strong>",
+        "mountRich": "<code>/mnt/&lt;path&gt;</code> (você escolhe o caminho)",
+        "ui": "Não",
+        "useCaseRich": "Compartilhe o caminho com um ou mais LXCs por bind mount <em>sem</em> registrá-lo como armazenamento Proxmox. Mantém a interface Datacenter organizada."
+      },
+      {
+        "method": "<strong>Ambos</strong>",
+        "mount": "Ambos os caminhos acima (dois pontos de montagem da mesma exportação NFS)",
+        "ui": "Sim",
+        "useCase": "Integração com a interface e um caminho estável separado no host com permissões abertas para bind mounts LXC."
+      }
+    ],
+    "bothTitle": "\"Ambos\" cria duas montagens independentes NFS",
+    "bothBody": "Os métodos são executados separadamente: pvesm monta em <code>/mnt/pve/&lt;id&gt;</code> e fstab em <code>/mnt/&lt;path&gt;</code>. Isso oferece uma montagem gerenciada pelo Proxmox com opções padrão e outra no host para bind mounts LXC. Dois pontos de montagem não garantem duas conexões TCP; o cliente NFS pode reutilizar conexões de transporte."
+  },
+  "pvesmBranch": {
+    "heading": "Método A — Armazenagem Proxmox (pvesm)",
+    "intro": "Se o <em>Como armazenamento Proxmox</em> estiver marcado, o ProxMenux roda o fluxo original do pvesm:",
+    "items": [
+      "<strong>Storage ID</strong> — o que o Proxmox chamará de armazenamento. O padrão é <code>nfs-&lt;server-ip-with-dashes&gt;</code>. Apenas são aceites letras, dígitos, <code>-</code> e <code>_</code>.",
+      "<strong>Tipos de conteúdo</strong> — Proxmox liga as categorias de conteúdo aos volumes de armazenamento; escolha o que este NFS pode conter:"
+    ],
+    "headerType": "Tipo de conteúdo",
+    "headerAllows": "O que permite",
+    "rows": [
+      {
+        "type": "import",
+        "allowsRich": "Importação de imagens de disco (selecionada por padrão). Necessário para <em>Importar imagem de disco para VM</em>."
+      },
+      {
+        "type": "backup",
+        "allowsRich": "Arquivos de backup VM e CT (<code>vzdump</code>)."
+      },
+      {
+        "type": "iso",
+        "allows": "Instalação de imagens ISO."
+      },
+      {
+        "type": "vztmpl",
+        "allows": "Modelos LXC."
+      },
+      {
+        "type": "images",
+        "allows": "Imagens de disco das VMs em uso: transforma o NFS em um armazenamento de discos de VMs."
+      },
+      {
+        "type": "rootdir",
+        "allows": "LXC sistemas de arquivos raiz (raro para NFS — leia a nota abaixo)."
+      },
+      {
+        "type": "snippets",
+        "allows": "Scripts de hook e snippets cloud-init."
+      }
+    ],
+    "warnTitle": "images e rootdir em NFS",
+    "warnBody": "Selecionar <code>images</code> permite armazenar discos de VMs no NFS. O desempenho depende da rede, do servidor e da carga; uma falha pode bloquear a E/S que dependa da montagem. <code>rootdir</code> armazena sistemas de arquivos raiz LXC no NFS, onde contêineres sem privilégios podem encontrar limitações de mapeamento de UID, overlay e propriedade. Avalie isso antes de colocar <code>images</code> / <code>rootdir</code> ali; NFS também é útil para <code>backup</code> / <code>iso</code> / <code>vztmpl</code>.",
+    "result": "O resultado é <code>pvesm add nfs &lt;id&gt; --server &lt;srv&gt; --export &lt;path&gt; --content &lt;csv&gt;</code> e Proxmox auto-montagens em <code>/mnt/pve/&lt;id&gt;</code>."
+  },
+  "fstabBranch": {
+    "heading": "Método B — Montagem fstab da máquina",
+    "intro": "Se <em>Somente montagem fstab no host</em> está marcada, ProxMenux pede um caminho de montagem do host e opções persistentes, então monta e escreve a entrada para <code>/etc/fstab</code>:",
+    "items": [
+      "<strong>Caminho de montagem no host</strong> — padrão <code>/mnt/&lt;export-basename&gt;</code>. Deve ser um caminho absoluto. Se algo já estiver montado lá, ou se existir uma entrada fstab para o mesmo caminho, o ProxMenux avisa-o e oferece-lhe para o substituir.",
+      "<strong>Opções de montagem</strong> — <em>Leitura/gravação</em> (padrão: <code>rw,hard,nofail,_netdev,rsize=131072,wsize=131072,timeo=600,retrans=2</code>), <em>Somente leitura</em>, <em>Personalizado</em> (informe suas opções)."
+    ],
+    "appliesIntro": "Uma vez confirmado, o script:",
+    "applies": [
+      "<code>mkdir -p</code> o caminho de montagem.",
+      "<code>mount -t nfs -o &lt;opts&gt; &lt;srv&gt;:&lt;export&gt; &lt;path&gt;</code>.",
+      "Escreve uma entrada de uma linha para <code>/etc/fstab</code>: <code>&lt;srv&gt;:&lt;export&gt; &lt;path&gt; nfs &lt;opts&gt; 0 0</code>.",
+      "Executa o <code>systemctl daemon-reload</code> para que o systemd apanhe a nova entrada do fstab.",
+      "Tenta <code>chmod 1777</code> e <code>setfacl o::rwx</code> no ponto de montagem, ignorando falhas. Só funciona se o servidor NFS permitir; muitas exportações NAS já permitem gravação a todos os usuários."
+    ],
+    "lxcTitle": "Usando a montagem fstab de um LXC",
+    "lxcBody": "O script mostra um comando <code>pct set</code> para bind mount, como <code>pct set &lt;ctid&gt; -mp0 /mnt/&lt;path&gt;,mp=/mnt/&lt;ct-path&gt;,shared=1,backup=0</code>. Ou use o <mountLink>LXC Mount Manager</mountLink>, que detecta montagens fstab. <strong>Nada é alterado dentro do contêiner</strong>. O acesso de um CT sem privilégios depende das permissões do servidor para seus UIDs/GIDs mapeados. O script apenas tenta ajustar permissões pelo host; não garante exportações graváveis nem padrões de fabricantes. Consulte Solução de problemas se o acesso falhar.",
+    "noUiTitle": "A montagem do fstab NÃO é um armazenamento Proxmox",
+    "noUiBody": "A montagem de fstab do hospedeiro é invisível para a interface web Proxmox — por design. Ele não aparece no <em>Datacenter > Storage</em>, você não pode selecioná-lo no criador do VM / CT, e as tarefas de backup do Proxmox não podem segmentá-lo. É puramente um caminho do sistema de arquivos host. Se você também quiser integração com UI, marque os métodos <em>ambos</em> no coletor."
+  },
+  "manual": {
+    "heading": "Equivalente manual",
+    "pvesmIntro": "O método A (pvesm) mapeia para:",
+    "fstabIntro": "Método B (fstab) mapas para:"
+  },
+  "view": {
+    "heading": "Ver os armazenamentos NFS configurados",
+    "body": "Lista todas as entradas NFS no Proxmox (<code>pvesm status | awk ''$2 == \"nfs\"''</code>) com servidor, exportação, tipos de conteúdo, caminho de montagem e status ao vivo. <strong>Nota:</strong> esta vista só mostra armazenamentos registrados em pvesm- — as montagens somente para fstab não estão listadas aqui. Verifique aqueles com <code>findmnt -t nfs</code> ou <code>grep nfs /etc/fstab</code>."
+  },
+  "remove": {
+    "heading": "Remover o armazenamento de NFS",
+    "body": "Executa <code>pvesm remove &lt;storage-id&gt;</code> após uma confirmação que mostra o servidor / exportar / conteúdo. Apenas o registro do lado Proxmox é removido — <strong>o servidor remoto NFS em si nunca é tocado</strong>, nenhum arquivo é excluído. Para remover uma montagem fstab-only, edite <code>/etc/fstab</code> à mão e execute <code>umount &lt;path&gt;</code>.",
+    "warnTitle": "Fazer backup das dependências primeiro",
+    "warnBody": "Se VMs, CTs ou tarefas de backup ainda referenciam este armazenamento (por ID), removendo-o deixa-os apontando para um armazenamento que não existe mais. O Proxmox irá marcar o erro, mas não irá limpar. Mover ou soltar essas referências primeiro, em seguida, remover o armazenamento."
+  },
+  "test": {
+    "heading": "Teste de conectividade NFS",
+    "body": "Executa um passe diagnóstico sobre cada armazenamento NFS registrado no Proxmox: verifica se o <code>showmount</code> está disponível, que o <code>rpcbind</code> está em execução, pings cada servidor, sondas porta 2049, chama <code>showmount -e</code>, e finalmente relata a própria visão do Proxmox (<code>pvesm status</code>). Boa primeira parada quando um armazenamento aparece como <em>inativo</em> na interface Proxmox."
+  },
+  "troubleshoot": {
+    "heading": "Resolução de Problemas",
+    "noServersTitle": "\"Nenhum servidor NFS encontrado na rede\"",
+    "noServersBody": "Auto-descoberta usa <code>nmap -p 2049 --open &lt;subnet&gt;/24</code>. O servidor pode não responder se: estiver em um VLAN / subnet diferente, seu firewall bloqueia nmap sondas (muitos do) ou porta 2049 é intencionalmente fechado nessa interface. Use a opção <em>Manual</em> com o IP ou nome do host do servidor.",
+    "portTitle": "«A porta NFS (2049) não está acessível»",
+    "portBody": "O Ping teve sucesso, mas o <code>nc -z -w 3 &lt;server&gt; 2049</code> falhou. Verifique se o serviço NFS está em execução no servidor (<code>systemctl status nfs-server</code> em Linux, Painel de controle → Serviços de arquivos em Synology, plugin NFS em OMV / TrueNAS), e que o firewall permite 2049 do host Proxmox.",
+    "showmountTitle": "\"Falhou em conectar\" do showmount",
+    "showmountBody": "O servidor recusou a consulta da lista de exportação. Causas comuns: o servidor obriga ACLs cliente restrito (seu IP Proxmox não está na lista permitida), <code>rpcbind</code> não está em execução no servidor, ou o servidor expõe apenas NFSv4 com <code>showmount</code> desabilitado. O caminho de exportação ainda pode ser adicionado manualmente se você souber.",
+    "inactiveTitle": "O armazenamento mostra como inativo na UI Proxmox",
+    "inactiveBody": "Execute primeiro <em>Testar conectividade NFS</em>: ele verifica se o servidor responde ao ping, se a porta 2049 está aberta e se a lista de exportações (<code>showmount -e</code>) está disponível. Se a conexão funcionar mas o armazenamento continuar inativo, consulte <code>journalctl -u pvestatd</code> e a configuração do servidor/exportação. Corrija primeiro a conexão ou os privilégios. <code>pvesm set &lt;id&gt; --disable 0</code> habilita um armazenamento desabilitado; não é um reparo geral de NFS.",
+    "lxcNoWriteTitle": "A montagem fstab funciona mas o LXC sem privilégios não consegue gravar por bind mount",
+    "lxcNoWriteBody": "O acesso NFS depende de proprietários, ACLs e squash no servidor. Opções CIFS como <code>uid=</code> e <code>file_mode=</code> <strong>não</strong> se aplicam a NFS. Com o mapeamento LXC padrão, root no CT vira UID 100000 no host, não UID remoto 0. Configure o acesso para o UID/GID mapeado real ou a identidade anônima do servidor. <code>no_root_squash</code> afeta apenas o UID remoto 0 e não resolve todos os casos de UID 100000. O script tenta <code>chmod 1777</code>, mas não ignora permissões do servidor.",
+    "fstabBootTitle": "A montagem do fstab não aparece após reiniciar",
+    "fstabBootBody": "O script adiciona <code>nofail,_netdev</code> para que um compartilhamento faltando no boot não bloqueie a inicialização. Se a montagem nunca aparecer: confirme que a rede está acessível (<code>ping &lt;server&gt;</code>), verifique <code>journalctl -u remote-fs.target</code>, e verifique se a entrada é válida com <code>mount -fav | grep nfs</code>. <code>mount -a</code> após a inicialização monta tudo o que está faltando atualmente."
+  },
+  "related": {
+    "heading": "Relacionado",
+    "items": [
+      {
+        "href": "/docs/storage-share/host-samba",
+        "label": "Samba / CIFS como armazenamento Proxmox",
+        "tail": " — mesmo padrão de fluxo (método A pvesm + método B fstab) para compartilhamentos SMB/CIFS."
+      },
+      {
+        "href": "/docs/storage-share/lxc-mount-points",
+        "label": "Gerenciador de montagem LXC",
+        "tailRich": " — montar a via apenas para fstab <code>/mnt/&lt;path&gt;</code> num ou mais contentores."
+      },
+      {
+        "href": "/docs/storage-share/lxc-nfs-client",
+        "label": "Cliente NFS em LXC",
+        "tail": " — alternativa: montagem NFS directamente a partir de dentro de um contentor privilegiado (sem passar pelo host)."
+      }
+    ]
+  }
+}
diff --git a/web/messages/pt/docs/storage-share/host-samba.json b/web/messages/pt/docs/storage-share/host-samba.json
new file mode 100644
index 00000000..c0bf69fc
--- /dev/null
+++ b/web/messages/pt/docs/storage-share/host-samba.json
@@ -0,0 +1,172 @@
+{
+  "meta": {
+    "title": "Host: montar compartilhamento Samba | Documentação ProxMenux",
+    "description": "Monte uma partilha Samba ou CIFS externa no host Proxmox como armazenamento Proxmox com pvesm add cifs, como montagem fstab com opções uid/gid/file_mode abertas, invisível em Datacenter > Storage, ou das duas formas. O método fstab permite que um LXC sem privilégios leia e escreva por bind mount sem alterações dentro do contentor.",
+    "ogTitle": "Host: montar compartilhamento Samba | Documentação ProxMenux",
+    "ogDescription": "Montar um compartilhamento externo de Samba / CIFS no host Proxmox via pvesm, fstab com perms abertos (ideal para LXC binding-mounts), ou ambos."
+  },
+  "header": {
+    "title": "Host: montar compartilhamento Samba no host",
+    "description": "Montar um compartilhamento externo de Samba (SMB / CIFS) — de um NAS, uma caixa Windows, uma exportação TrueNAS SMB — no host Proxmox. Escolha um ou ambos os métodos: registre-o como armazenamento Proxmox (visível no Datacenter > Armazenamento) e/ou adicione uma montagem /etc/fstab simples em um caminho que você escolher, com uid/gid/file_mode aberto para que os LXCs não privilegiados possam vincular-montar e escrever sem quaisquer alterações dentro do recipiente.",
+    "section": "Armazenamento e Compartilhamento · Máquina"
+  },
+  "intro": {
+    "title": "O que isto faz",
+    "body": "O ProxMenux oferece dois métodos para uma partilha Samba: <strong>(1) Armazenamento Proxmox</strong> através de <code>pvesm add cifs</code>, visível em Datacenter > Storage e montado em <code>/mnt/pve/&lt;id&gt;</code>. A palavra-passe é guardada em texto simples em <code>/etc/pve/priv/storage/&lt;id&gt;.pw</code>, protegida pelo diretório privado acessível apenas a root: é controlo de acesso, não encriptação. <strong>(2) Montagem fstab do host</strong> num caminho escolhido, persistente através de <code>/etc/fstab</code> e montada com <code>uid=0,gid=0,file_mode=0777,dir_mode=0777</code> para permitir a escrita através de bind mounts de LXC sem privilégios. As credenciais ficam num ficheiro exclusivo de root em <code>/etc/samba/credentials/</code>, nunca diretamente em <code>fstab</code>. Pode utilizar um método ou ambos."
+  },
+  "opening": {
+    "heading": "Abrir a ferramenta",
+    "body": "Do menu principal do ProxMenux, abra o <strong>Storage &amp; Share Manager → Monte Samba Share on Host</strong>. Você verá este sub-menu com quatro opções:",
+    "imageAlt": "Menu do gestor de máquinas Samba — Montar / Ver / Remover / Teste de conectividade"
+  },
+  "howRuns": {
+    "heading": "Como o script é executado",
+    "body": "O fluxo tem duas fases. Fase 1: descubra servidor, valide credenciais, escolha o compartilhamento e, em seguida, escolha os métodos de montagem através de uma lista de verificação. Fase 2: apenas os métodos marcados são executados. As credenciais são necessárias antecipadamente porque o <code>smbclient</code> precisa delas para listar compartilhamentos. Até a confirmação final, nem <code>/etc/pve/storage.cfg</code> nem <code>/etc/fstab</code> são tocados."
+  },
+  "modes": {
+    "heading": "Selector de métodos de montagem (duas opções, marca uma ou ambas)",
+    "intro": "Após selecionar o compartilhamento e validar credenciais, o ProxMenux mostra uma lista de verificação com os dois métodos de montagem. Pode marcar um ou ambos. Se carregar em OK sem marcar nada, a janela reaparece até escolher pelo menos uma opção ou carregar em Cancelar para sair do fluxo.",
+    "headerMethod": "Método",
+    "headerMount": "Caminho de montagem",
+    "headerUi": "Visível no Datacenter > Armazenamento",
+    "headerUseCase": "Caso de uso típico",
+    "rows": [
+      {
+        "method": "<strong>Como armazenamento Proxmox (pvesm)</strong>",
+        "mountRich": "<code>/mnt/pve/&lt;storage-id&gt;</code> (gerido pela Proxmox)",
+        "ui": "Sim",
+        "useCase": "Backups, ISOs, modelos LXC — qualquer coisa que precise aparecer na interface de usuário Proxmox. Discos de VM ao vivo são tecnicamente suportados, mas desencorajados em CIFS (bloqueio semântico)."
+      },
+      {
+        "method": "<strong>Host somente fstab</strong>",
+        "mountRich": "<code>/mnt/&lt;path&gt;</code> com uid/gid/file_mode aberto",
+        "ui": "Não",
+        "useCaseRich": "Disponibilize o compartilhamento aos LXCs por bind mount <em>sem</em> registrar armazenamento Proxmox. Permissões locais abertas facilitam o acesso dos CTs sem privilégios, mas o servidor SMB ainda precisa autorizar a gravação pelo usuário autenticado."
+      },
+      {
+        "method": "<strong>Ambos</strong>",
+        "mount": "Ambos os caminhos acima (dois pontos de montagem da mesma exportação CIFS)",
+        "ui": "Sim",
+        "useCase": "Você quer a integração de UI E um caminho de host-side estável com permissões abertas para LXC binding-mounts. A montagem pvesm usa padrões Proxmox; a montagem fstab aplica o uid/gid/file_mode aberto separadamente."
+      }
+    ],
+    "bothTitle": "«Ambos» cria dois pontos de montagem CIFS",
+    "bothBody": "pvesm monta em <code>/mnt/pve/&lt;id&gt;</code> com as opções padrão do Proxmox. fstab monta em <code>/mnt/&lt;path&gt;</code> com <code>uid=0,gid=0,file_mode=0777,dir_mode=0777</code> para acesso local por bind mounts LXC. O servidor SMB ainda impõe os privilégios do usuário da montagem. Dois pontos de montagem não garantem duas conexões TCP separadas."
+  },
+  "pvesmBranch": {
+    "heading": "Método A — Armazenagem Proxmox (pvesm)",
+    "intro": "Se o <em>Como armazenamento Proxmox</em> estiver marcado, o ProxMenux roda o fluxo original do pvesm:",
+    "items": [
+      "<strong>Storage ID</strong> — <code>cifs-&lt;server-ip-with-dashes&gt;</code> por omissão. Apenas letras, dígitos, <code>-</code> e <code>_</code>.",
+      "<strong>Tipos de conteúdo</strong> — esta lista ProxMenux oferece <strong>6</strong> opções. Omite <code>rootdir</code> em relação ao NFS; é uma escolha do script, não uma proibição de sistemas de arquivos raiz LXC em todas as versões do backend CIFS Proxmox:"
+    ],
+    "headerType": "Tipo de conteúdo",
+    "headerAllows": "O que permite",
+    "rows": [
+      {
+        "type": "import",
+        "allows": "Importação de imagens de disco (selecionada por padrão)."
+      },
+      {
+        "type": "backup",
+        "allowsRich": "Arquivos de backup VM e CT (<code>vzdump</code>)."
+      },
+      {
+        "type": "iso",
+        "allows": "Instalação de imagens ISO."
+      },
+      {
+        "type": "vztmpl",
+        "allows": "Modelos LXC."
+      },
+      {
+        "type": "images",
+        "allowsRich": "Imagens de disco das VMs em uso — <strong>aviso no diálogo</strong>, veja abaixo."
+      },
+      {
+        "type": "snippets",
+        "allows": "Scripts de hook e snippets cloud-init."
+      }
+    ],
+    "warnTitle": "Discos de VM vivos em CIFS",
+    "warnBody": "Selecionar <code>images</code> mostra um aviso ProxMenux: CIFS/SMB pode causar problemas de bloqueio em operações com discos de VMs. O script recomenda NFS, mas permite continuar. Backups e ISOs são usos comuns de CIFS. Avalie bloqueios, snapshots, migração e carga antes de usar CIFS para <code>images</code>.",
+    "credsTitle": "Onde o pvesm armazena credenciais",
+    "credsBody": "A senha não é gravada em <code>/etc/pve/storage.cfg</code>. O Proxmox salva credenciais em texto simples em <code>/etc/pve/priv/storage/&lt;storage-id&gt;.pw</code>, na área privada do sistema de arquivos do cluster, legível apenas por <code>root</code> (modo <code>0600</code>); elas são protegidas por permissões de acesso, não por criptografia. Após mudar a senha no servidor, use <code>pvesm set &lt;id&gt; --password &lt;new&gt;</code> ou remova e adicione o armazenamento pelo ProxMenux."
+  },
+  "fstabBranch": {
+    "heading": "Método B — Montagem fstab da máquina",
+    "intro": "Se <em>Somente montagem fstab no host</em> estiver selecionado, o ProxMenux pede o caminho e as opções persistentes, cria um arquivo de credenciais exclusivo de root no modo usuário, monta o compartilhamento e grava a entrada em <code>/etc/fstab</code>:",
+    "items": [
+      "<strong>Caminho de montagem no host</strong> — padrão <code>/mnt/&lt;share-name&gt;</code>. Deve ser um caminho absoluto. Se algo já está montado lá, ou existe uma entrada fstab, ProxMenux oferece para substituí-lo.",
+      "<strong>Opções de montagem</strong> — <em>Leitura/gravação</em> (padrão: <code>rw,uid=0,gid=0,file_mode=0777,dir_mode=0777,iocharset=utf8,nofail,_netdev</code>), <em>Somente leitura</em> (<code>file_mode=0555,dir_mode=0555</code>), <em>Personalizado</em> (informe suas opções). O script recomenda uid/gid/file_mode abertos para gravação por bind mounts LXC."
+    ],
+    "credsTitle": "Arquivo de credenciais (modo de usuário)",
+    "credsBody": "No modo usuário, o ProxMenux cria um arquivo de credenciais exclusivo de root em <code>/etc/samba/credentials/&lt;server&gt;_&lt;share&gt;.cred</code> (modo <code>0600</code>) com linhas <code>username=</code> e <code>password=</code>. A entrada fstab o referencia pela opção <code>credentials=</code>; a senha em texto simples não aparece em <code>/etc/fstab</code>. No modo convidado, adiciona <code>guest</code> e não cria arquivo de credenciais.",
+    "appliesIntro": "Uma vez confirmado, o script:",
+    "applies": [
+      "<code>mkdir -p</code> o caminho de montagem.",
+      "<code>mount -t cifs -o &lt;opts&gt;,credentials=&lt;file&gt;</code> (ou <code>guest</code>) <code>//&lt;srv&gt;/&lt;share&gt; &lt;path&gt;</code>.",
+      "Escreve uma entrada de uma linha para <code>/etc/fstab</code>: <code>//&lt;srv&gt;/&lt;share&gt; &lt;path&gt; cifs &lt;opts&gt; 0 0</code>.",
+      "Executa o <code>systemctl daemon-reload</code> para que o systemd apanhe a nova entrada do fstab."
+    ],
+    "lxcTitle": "Usando a montagem fstab de um LXC sem privilégios",
+    "lxcBody": "As opções CIFS <code>uid=0,gid=0,file_mode=0777,dir_mode=0777</code> abrem as verificações locais de permissões para bind mounts LXC. ACLs do servidor e a semântica Unix/POSIX negociada ainda podem afetar o acesso. <strong>Nada é alterado no contêiner</strong>: nenhum <code>chown</code> no CT, grupos ou edições de <code>/etc/lxc</code>. A linha <code>mp</code> é gerenciada na configuração Proxmox do CT. Use o comando <code>pct set</code> exibido ou o <mountLink>LXC Mount Manager</mountLink>.",
+    "noUiTitle": "A montagem do fstab NÃO é um armazenamento Proxmox",
+    "noUiBody": "A montagem de fstab do hospedeiro é invisível para a interface web Proxmox — por design. Ele não aparece no <em>Datacenter > Storage</em>, você não pode selecioná-lo no criador do VM / CT, e as tarefas de backup do Proxmox não podem segmentá-lo. É puramente um caminho do sistema de arquivos host. Se você também quiser integração com UI, marque os métodos <em>ambos</em> no coletor."
+  },
+  "manual": {
+    "heading": "Equivalente manual",
+    "pvesmIntro": "O método A (pvesm) mapeia para:",
+    "fstabUserIntro": "Método B (fstab, user auth) — arquivo de credenciais + montagem:",
+    "fstabGuestIntro": "Método B (fstab, guest auth) — nenhum arquivo de credenciais:"
+  },
+  "view": {
+    "heading": "Ver armazenamentos CIFS e montagens do host",
+    "body": "Mostra armazenamentos CIFS registrados (<code>pvesm status | awk ''$2 == \"cifs\"''</code>) com servidor, compartilhamento, conteúdo, usuário ou <em>Convidado</em>, caminho e estado. As senhas <strong>nunca são exibidas</strong>. <strong>Nota:</strong> outra seção lista montagens fstab do host, opções, caminho do arquivo de credenciais e estado ativo/inativo. Para verificar manualmente, use <code>findmnt -t cifs</code> ou <code>grep cifs /etc/fstab</code>."
+  },
+  "remove": {
+    "heading": "Remover armazenamento CIFS ou montagem do host",
+    "body": "O seletor oferece armazenamentos pvesm e montagens fstab do host. Para pvesm executa <code>pvesm remove &lt;storage-id&gt;</code> e o Proxmox remove as credenciais associadas. Para fstab tenta <code>umount &lt;path&gt;</code>, remove a entrada de <code>/etc/fstab</code> e as credenciais em <code>/etc/samba/credentials/</code>, depois o diretório vazio se possível. Se a desmontagem falhar, é preciso desmontar manualmente ou reiniciar. <strong>O servidor Samba remoto e seus arquivos não são alterados</strong>.",
+    "warnTitle": "Fazer backup das dependências primeiro",
+    "warnBody": "VMs, CTs ou tarefas de backup que referenciam este armazenamento por ID irá falhar após a remoção. Mover / soltar essas referências antes de remover o armazenamento."
+  },
+  "test": {
+    "heading": "Teste a conectividade do Samba",
+    "body": "Executa um passe diagnóstico sobre cada armazenamento CIFS registrado no Proxmox: verifica se o <code>smbclient</code> está disponível, pings cada servidor, sonda portas 445 e 139, tenta uma lista de convidados, e relata a própria visão do Proxmox (<code>pvesm status</code>). \"Requer autenticação\" na lista de convidados significa que seu servidor só expõe compartilhamentos a usuários autenticados — normal para a maioria das configurações do NAS."
+  },
+  "troubleshoot": {
+    "heading": "Resolução de Problemas",
+    "noServersTitle": "\"Nenhum servidor Samba encontrado na rede\"",
+    "noServersBody": "Auto-descoberta usa <code>nmap -p 139,445</code>. O servidor pode estar em uma subrede diferente, firewalled, ou somente acessível pelo hostname (mDNS / WINS). Use a opção <em>Manual</em> com o IP ou hostname.",
+    "noSharesTitle": "\"Nenhuma partilha acessível encontrada\"",
+    "noSharesBody": "<code>smbclient -L</code> não devolveu nada para estas credenciais. Causas: o usuário não tem permissão para listar compartilhamentos (tentar com credenciais de administrador uma vez, ou digitar o nome do compartilhamento manualmente), o servidor tem visibilidade de compartilhamento desabilitada, ou as credenciais estão erradas. O script permite digitar o nome do compartilhamento manualmente neste caso.",
+    "denyTitle": "A montagem do Proxmox falhou com o NT_STATUS_ACCESS_DENIED",
+    "denyBody": "As credenciais pvesm armazenadas estão fora de sincronia com o servidor Samba (senha alterada, conta desativada, domínio / grupo de trabalho descompasso). Reentrar credenciais com <code>pvesm set &lt;id&gt; --username &lt;u&gt; --password &lt;p&gt;</code> ou remover e re-adicionar de ProxMenux. Se o servidor estiver em um domínio AD, adicione <code>--domain &lt;DOMAIN&gt;</code> à chamada <code>pvesm set</code>.",
+    "sleepTitle": "\"host está em baixo\" ou o estado de armazenamento fica inativo à noite",
+    "sleepBody": "Alguns aparelhos NAS colocam SMB para dormir agressivamente. <code>pvestatd</code> então vê o armazenamento como inativo até que o primeiro acesso acorde o NAS. Se isto é cosmético, nada está partido. Se isso causar falhas de backup, desativar a desconexão ociosa do SMB no NAS ou agendar backups fora da janela de sono.",
+    "lxcNoWriteTitle": "LXC desprivilegiado não pode escrever no caminho do fstab",
+    "lxcNoWriteBody": "Confira as opções pretendidas em <code>findmnt /mnt/&lt;path&gt;</code>, como <code>uid=0,gid=0,file_mode=0777,dir_mode=0777</code>. A falta de privilégios locais de gravação pode bloquear UIDs LXC mapeados. Reaplique o perfil RW ou ajuste as opções personalizadas. Confira também os privilégios do usuário SMB no servidor e se extensões Unix/POSIX fornecem modos do servidor; modos locais abertos não ignoram ACLs do servidor.",
+    "fstabBootTitle": "A montagem do fstab não aparece após reiniciar",
+    "fstabBootBody": "O script adiciona <code>nofail,_netdev</code> para que um compartilhamento faltando no boot não bloqueie a inicialização. Se a montagem nunca aparecer: confirme que a rede está acessível (<code>ping &lt;server&gt;</code>), verifique <code>journalctl -u remote-fs.target</code>, verifique se o arquivo de credenciais ainda existe (<code>ls -l /etc/samba/credentials/</code>) e é legível, e tente <code>mount -a</code> manualmente."
+  },
+  "related": {
+    "heading": "Relacionado",
+    "items": [
+      {
+        "href": "/docs/storage-share/host-nfs",
+        "label": "NFS partilha como armazenamento Proxmox",
+        "tail": " — página de irmãos com o mesmo padrão de fluxo (método A pvesm + método B fstab) e trade-offs lado a lado."
+      },
+      {
+        "href": "/docs/storage-share/lxc-mount-points",
+        "label": "Gerenciador de montagem LXC",
+        "tailRich": " — montar a via apenas para fstab <code>/mnt/&lt;path&gt;</code> num ou mais contentores."
+      },
+      {
+        "href": "/docs/storage-share/lxc-samba-client",
+        "label": "Cliente Samba em LXC",
+        "tail": " — alternativa: montagem Samba directamente a partir de dentro de um contentor privilegiado (sem passar pelo host)."
+      }
+    ]
+  }
+}
diff --git a/web/messages/pt/docs/storage-share/index.json b/web/messages/pt/docs/storage-share/index.json
new file mode 100644
index 00000000..0378181d
--- /dev/null
+++ b/web/messages/pt/docs/storage-share/index.json
@@ -0,0 +1,135 @@
+{
+  "meta": {
+    "title": "Proxmox NFS, Samba, iSCSI & LXC Pontos de montagem — Armazenamento e Compartilhamento ProxMenux",
+    "description": "Integre armazenamento externo e local ao Proxmox VE e compartilhe pastas entre o host e os contêineres LXC. Adicione compartilhamentos NFS, Samba (CIFS) e destinos iSCSI como armazenamento Proxmox, configure bind mounts LXC com o Mount Manager e execute clientes e servidores NFS ou Samba dentro dos contêineres.",
+    "ogTitle": "Proxmox NFS, Samba, iSCSI e LXC pontos de montagem — Armazenamento e partilha",
+    "ogDescription": "Integre o armazenamento externo/local em Proxmox VE — NFS, Samba, registo iSCSI e bind mounts LXC e partilha de rede.",
+    "twitterTitle": "Proxmox NFS, Samba, iSCSI | ProxMenux",
+    "twitterDescription": "Adicionar NFS / Samba / iSCSI como armazenamento Proxmox e compartilhar pastas entre host e LXC."
+  },
+  "header": {
+    "title": "Gerenciador de armazenamento e compartilhamento",
+    "description": "Integre armazenamento externo ou local ao Proxmox VE e compartilhe pastas entre o host e os contêineres LXC. Três grupos de ferramentas: integração do armazenamento do host (registro no próprio Proxmox), LXC Mount Manager (bind mounts com tratamento prático de permissões) e compartilhamento de rede LXC (fluxos de cliente e servidor NFS ou Samba para casos específicos).",
+    "section": "Armazenamento e compartilhamento"
+  },
+  "intro": {
+    "title": "Para que serve este menu",
+    "body": "O Gerenciador de disco funciona no nível de <em> discos físicos individuais</em>. O Storage &amp; Share Manager funciona um nível acima — ele <strong>registra pools de armazenamento e compartilhamentos de rede no Proxmox</strong> (para que a interface e o criador de VMs possam usá-los) e <strong>configura o compartilhamento de arquivos entre o host e seus containers</strong>."
+  },
+  "opening": {
+    "heading": "Abrir o menu",
+    "body": "No menu principal do ProxMenux, selecione <strong>Storage &amp; Share Manager</strong>. Você verá isto:",
+    "imageAlt": "Menu de gerenciamento de armazenamento e compartilhamento com blocos HOST e LXC"
+  },
+  "groups": {
+    "heading": "Três grupos de ferramentas",
+    "intro": "O menu se divide em três grupos. <strong>Integração do armazenamento do host</strong> registra armazenamento externo ou local no próprio Proxmox. O <strong>LXC Mount Manager</strong> é a principal ferramenta para compartilhar pastas com contêineres: um fluxo de bind mount que trata o mapeamento de UIDs de CTs sem privilégios no lado do host. <strong>Compartilhamento de rede LXC</strong> cobre quatro cenários adicionais em que um contêiner precisa <em>utilizar</em> ou <em>expor</em> compartilhamentos NFS ou Samba diretamente.",
+    "hostTitle": "Armazenagem da máquina",
+    "hostBody": "Registre armazenamento externo e local em Proxmox via <code>pvesm add …</code>. Uma vez registrado, o armazenamento aparece na UI Proxmox e está disponível para os criadores VM e CT.",
+    "hostItems": [
+      "NFS / Samba / iSCSI externos → armazenamento Proxmox",
+      "Disco local → Diretório Proxmox ou armazenamento ZFS",
+      "Diretório local compartilhado (para bind mounts entre CTs)"
+    ],
+    "lxcMountTitle": "Gerenciador de montagem LXC",
+    "lxcMountBody": "A principal ferramenta de compartilhamento LXC. Disponibiliza diretórios do host nos contêineres por bind mount com <code>pct set -mpN</code> e trata as particularidades de permissão dos CTs sem privilégios, sem criar grupos ou usuários dentro do contêiner.",
+    "lxcMountItems": [
+      "Funciona com CTs com e sem privilégios",
+      "Oferece <code>o+rwx</code> no diretório do host para UIDs sem privilégios",
+      "Corrige as montagens CIFS / NFS existentes, se necessário"
+    ],
+    "lxcNetTitle": "Partilha de rede LXC",
+    "lxcNetBody": "Quatro fluxos adicionais para contêineres que precisam utilizar ou expor compartilhamentos NFS ou Samba diretamente. Todos exigem um contêiner <strong>com privilégios</strong>.",
+    "lxcNetItems": [
+      "<strong>Cliente</strong> NFS / Samba (utiliza compartilhamentos externos)",
+      "NFS / Samba <strong>server</strong> (exponha pastas CT)"
+    ]
+  },
+  "host": {
+    "heading": "Integração ao armazenamento da máquina",
+    "intro": "Registo de armazenamento em Proxmox. Cada opção chama <code>pvesm add …</code> sob o capô, então o armazenamento aparece em <strong>Datacenter → Storage</strong> e fica disponível para os criadores VM / CT.",
+    "options": [
+      {
+        "href": "/docs/storage-share/host-nfs",
+        "icon": "Network",
+        "title": "Adicionar a partilha NFS como armazenamento Proxmox",
+        "description": "Registe uma exportação NFS externa como armazenamento Proxmox com pvesm add nfs. O Proxmox trata da montagem, sem entradas adicionais em fstab."
+      },
+      {
+        "href": "/docs/storage-share/host-samba",
+        "icon": "Share2",
+        "title": "Adicionar a partilha Samba como armazenamento Proxmox",
+        "description": "Registe uma partilha Samba ou CIFS externa como armazenamento Proxmox com pvesm add cifs. O Proxmox trata da montagem e das credenciais."
+      },
+      {
+        "href": "/docs/storage-share/host-iscsi",
+        "icon": "Database",
+        "title": "Adicionar o alvo iSCSI como armazenamento Proxmox",
+        "description": "Conecte-se a um alvo externo iSCSI e registre-o como armazenamento Proxmox (dispositivo de bloco) para imagens de disco VM."
+      },
+      {
+        "href": "/docs/storage-share/host-local-disk",
+        "icon": "HardDrive",
+        "title": "Adicionar o disco local como armazenamento Proxmox",
+        "description": "Formate um disco local SATA / SAS / NVMe e registre-o como armazenamento Proxmox do tipo diretório ou pool ZFS."
+      },
+      {
+        "href": "/docs/storage-share/host-local-shared",
+        "icon": "FolderOpen",
+        "title": "Adicionar diretório compartilhado na máquina",
+        "description": "Criar um directório da máquina destinado a ser montado em várias CTs. Não é um armazenamento Proxmox — puramente um recurso do lado do host para as montagens de ligação LXC."
+      }
+    ]
+  },
+  "lxcMount": {
+    "heading": "Gerenciador de montagem LXC",
+    "intro": "A principal ferramenta para compartilhar pastas entre o host Proxmox e os recipientes LXC. Ele usa <code>pct set -mpN</code> para vincular-montar um diretório host no recipiente, e lida com as peculiaridades de permissão de CTs sem privilégios no lado host (nenhum grupo ou usuários são criados dentro do recipiente).",
+    "card": {
+      "title": "LXC pontos de montagem (Host ↔ CT)",
+      "description": "Disponibilize qualquer diretório do host num contentor LXC por bind mount com pct set -mpN. Funciona com CT com ou sem privilégios, oferece chmod o+rwx e ACL para o diretório no host e corrige montagens CIFS ou NFS existentes quando necessário."
+    }
+  },
+  "lxcNet": {
+    "heading": "Partilha de rede LXC",
+    "intro": "Use estes fluxos quando um contêiner precisa <em>ser</em> um endpoint NFS ou Samba: utilizar um compartilhamento externo (cliente) ou expor suas próprias pastas (servidor). Para a maioria das necessidades de compartilhamento (bind mounts host ↔ CT), o <mountLink>LXC Mount Manager</mountLink> é mais simples e não requer contêineres com privilégios.",
+    "options": [
+      {
+        "href": "/docs/storage-share/lxc-nfs-client",
+        "icon": "Download",
+        "title": "Cliente NFS em LXC",
+        "description": "Monte compartilhamentos NFS externos de dentro de um contêiner LXC com privilégios. Oferece descoberta automática, persistência em /etc/fstab e desmontagem limpa."
+      },
+      {
+        "href": "/docs/storage-share/lxc-samba-client",
+        "icon": "Download",
+        "title": "Cliente Samba em LXC",
+        "description": "Monte compartilhamentos Samba / CIFS de dentro de um contêiner LXC com privilégios. Credenciais armazenadas com proteção e descoberta automática disponível."
+      },
+      {
+        "href": "/docs/storage-share/lxc-nfs-server",
+        "icon": "Upload",
+        "title": "Servidor NFS em LXC",
+        "description": "Exportar pastas sobre NFS de dentro de um recipiente privilegiado LXC."
+      },
+      {
+        "href": "/docs/storage-share/lxc-samba-server",
+        "icon": "Upload",
+        "title": "Servidor Samba em LXC",
+        "description": "Expor pastas sobre SMB / CIFS de dentro de um recipiente privilegiado LXC."
+      }
+    ]
+  },
+  "privReq": {
+    "title": "Requisito de contentor privilegiado",
+    "body": "Os quatro fluxos de <strong>compartilhamento de rede LXC</strong> acima exigem um contêiner <strong>com privilégios</strong>. Os scripts exigem esse modo suportado antes de configurar serviços e ferramentas de montagem (<code>nfs-kernel-server</code>, <code>smbd</code>, <code>mount.nfs</code>, <code>mount.cifs</code>). Para compartilhar arquivos entre o host e um CT sem privilégios, use o <mountLink>LXC Mount Manager</mountLink>: ele faz bind mounts e ajusta permissões no host, permitindo leitura e gravação sem configurar esses serviços ou ferramentas dentro do contêiner."
+  },
+  "unprivExplain": {
+    "title": "Como ProxMenux lida com permissões CT sem privilégios",
+    "body": "Contêineres LXC sem privilégios deslocam seus UIDs em <strong>+100000</strong> no host (UID 0 do contêiner = UID 100000 do host, UID 1000 do contêiner = UID 101000 do host, …). Um arquivo criado por um usuário do contêiner aparece no host como <em>outros</em>, sem corresponder a um usuário ou grupo comum do host. O LXC Mount Manager oferece uma solução prática: em vez de alinhar UIDs/GIDs entre host e CT, propõe <code>chmod o+rwx</code> e ACLs correspondentes no diretório do host, para que qualquer UID mapeado possa ler e gravar. Para CIFS, remonta com <code>uid=0,gid=0,file_mode=0777,dir_mode=0777</code>; para NFS, configura um diretório gravável por todos com sticky bit e, se o servidor aplicar root squash, orienta sobre a correção necessária no servidor."
+  },
+  "scripts": {
+    "heading": "Programas envolvidos",
+    "intro": "Cada página inclui um link para o script que impulsiona seu fluxo. O arquivo abaixo é um auxiliar compartilhado que não está documentado como sua própria página, mas é usado por vários dos fluxos de compartilhamento de rede LXC:",
+    "itemTail": " — validação do CT, seleção de pontos de montagem, verificação privilegiada e ajudadores universais de configuração de grupo compartilhados entre os fluxos cliente / servidor do LXC."
+  }
+}
diff --git a/web/messages/pt/docs/storage-share/lxc-mount-points.json b/web/messages/pt/docs/storage-share/lxc-mount-points.json
new file mode 100644
index 00000000..3ccc7237
--- /dev/null
+++ b/web/messages/pt/docs/storage-share/lxc-mount-points.json
@@ -0,0 +1,174 @@
+{
+  "meta": {
+    "title": "Pontos de montagem LXC (host ↔ contêiner) | Documentação ProxMenux",
+    "description": "O LXC Mount Manager disponibiliza um diretório do host num ou mais contentores LXC por bind mount com pct set -mpN. Trata das particularidades dos contentores sem privilégios, corrige montagens CIFS e NFS no host e não altera nada dentro do contentor.",
+    "ogTitle": "Pontos de montagem LXC (host ↔ contêiner) | Documentação ProxMenux",
+    "ogDescription": "Disponibilize diretórios do host nos contêineres LXC por bind mount. Gerencia o mapeamento de UID sem privilégios de forma prática e corrige o acesso CIFS / NFS no host."
+  },
+  "header": {
+    "title": "Pontos de montagem LXC (Host ↔ Container)",
+    "description": "A ferramenta principal para partilhar pastas entre o host Proxmox e os contentores LXC. Disponibiliza um diretório do host num ou mais contentores por bind mount com a sintaxe nativa pct set -mpN. Resolve as particularidades dos privilégios no lado do host, sem alterar nada dentro dos contentores.",
+    "section": "Armazenamento e Compartilhamento · LXC"
+  },
+  "intro": {
+    "title": "O que isto faz",
+    "body": "Pegue um diretório que vive no host Proxmox (uma pasta local, um compartilhamento NAS montado, um armazenamento gerenciado pelo Proxmox...) e faça com que ele apareça dentro de um container LXC em um caminho que você escolher, com permissões que funcionam mesmo para recipientes sem privilégios — sem tocar em nada dentro do container."
+  },
+  "bigPicture": {
+    "heading": "Como funciona (o quadro geral)",
+    "intro": "Um bind mount instrui o kernel a mostrar o diretório <code>X</code> do host também no caminho <code>Y</code> do contêiner. Sem cópia, sincronização ou transferência de rede: ambos veem os <em>mesmos arquivos</em> ao mesmo tempo.",
+    "sourceLabel": "Host Proxmox",
+    "sourceDetail": "/mnt/data\n(sua pasta)",
+    "targetLabel": "Contentor LXC",
+    "targetDetail": "/mnt/data\n(mostra aqui)",
+    "arrowLabel": "bind mount",
+    "outro": "O caminho do hospedeiro à esquerda e o caminho do recipiente à direita podem ser diferentes — por exemplo, o <code>/mnt/nas-films</code> no hospedeiro pode tornar-se <code>/media/films</code> no interior do recipiente. O script adiciona a entrada para a configuração do recipiente (<code>/etc/pve/lxc/&lt;ctid&gt;.conf</code>) usando o próximo índice <code>mpN</code> livre, com dois padrões seguros preparados em:",
+    "items": [
+      "<code>shared=1</code> — informa ao Proxmox que os dados são compartilhados e não devem ser migrados com o CT. A opção não replica dados: o mesmo caminho e os mesmos dados devem estar disponíveis no nó de destino.",
+      "<code>backup=0</code> — exclui o monte de ligação dos backups do <code>vzdump</code> (os dados vivem no host, você faz backup separadamente)."
+    ]
+  },
+  "perms": {
+    "heading": "Manuseamento de permissões – a parte smart",
+    "intro": "Montagens de ligação são fáceis em princípio. A parte difícil são as permissões: um container <strong>sem privilégios</strong> LXC muda cada UID por <strong>+100000</strong>, então um arquivo criado dentro do container pelo usuário 1000 aparece no host como UID 101000 — um UID que ninguém no host possui. Para fazer isso funcionar sem alinhar UIDs entre hosts e contêineres, o ProxMenux aplica o truque certo de \"abrir permissões\" no lado <em>host</em>, dependendo do tipo de diretório que você escolheu:",
+    "headerType": "Tipo de pasta da máquina",
+    "headerAction": "O que o script oferece para fazer",
+    "localType": "Pasta local",
+    "localTypeSub": "Por exemplo: /mnt/data",
+    "localActionRich": "<code>chmod o+rwx</code> + <code>setfacl o::rwx</code> no diretório da máquina. Só é oferecido se o CT não for privilegiado e as permissões atuais forem insuficientes.",
+    "cifsType": "CIFS / SMB montados",
+    "cifsTypeSub": "Por exemplo: /mnt/pve/cifs-…",
+    "cifsActionRich": "Remontar com <code>uid=0, gid=0, file_mode=0777, dir_mode=0777</code> para que o CT (qualquer UID) possa ler e escrever a partilha. O <code>/etc/fstab</code> está actualizado.",
+    "nfsType": "NFS montado",
+    "nfsTypeSub": "Por exemplo: /mnt/pve/nfs-…",
+    "nfsActionRich": "<code>chmod 1777</code> + <code>setfacl o::rwx</code> na montagem NFS. Não é possível substituir o squashing do lado do servidor — se mesmo o host root não consegue gravar, você é guiado para corrigir a exportação no servidor NFS.",
+    "privTitle": "Recipientes privilegiados não precisam de nada disto.",
+    "privBody": "Para recipientes privilegiados, UID 0 no CT é UID 0 no host — raiz dentro do CT pode ler e escrever o diretório do host diretamente sem qualquer truque de permissão. O script detecta isso e ignora o passo de \"abrir permissões\".",
+    "noCtTitle": "O script nunca modifica nada dentro do recipiente",
+    "noCtBody": "Todos os ajustes de permissão acontecem no sistema de arquivos <strong>host</strong>. Sem <code>pct exec</code> chowns, sem grupos criados no CT, sem fstab dentro do recipiente. Se você reutilizar o diretório bind-mounted em um CT diferente mais tarde, as mesmas permissões se aplicam automaticamente — sem configuração por contêiner."
+  },
+  "writes": {
+    "heading": "O que escreve ProxMenux — e o que não escreve",
+    "intro": "Uma confusão comum quando se liga a montagem em um CT: as pessoas assumem que ProxMenux deve estar escrevendo entradas <code>lxc.idmap</code> em <code>/etc/pve/lxc/&lt;CTID&gt;.conf</code>. <strong>Não faz.</strong> Apenas uma linha é anexada a esse arquivo — a própria montagem de ligação:",
+    "outro": "A linha de saída que você vê no final da execução, <em>\"Contêiner sem privilégios — Offset UID: 100000\"</em>, é puramente informacional - ele apenas lhe diz que o CT está usando o mapeamento padrão sem privilégios do Proxmox (root in CT = UID 100000 no host). O script não configura nada em torno dele.",
+    "twoWaysHeading": "As duas maneiras de fazer as permissões funcionar — e por que ProxMenux escolhe uma",
+    "headerApproach": "Aproximação",
+    "headerChanges": "O que muda",
+    "headerWhen": "Quando caber",
+    "hostType": "Permissões no host",
+    "hostTypeSub": "(o que este script faz)",
+    "hostChangesRich": "<code>chmod o+rwx</code> + <code>setfacl o::rwx</code> no diretório da máquina. Os UIDs mapeados do CT (100000+) caem no balde \"outros\", então abrir o <em>outros</em> é suficiente.",
+    "hostWhen": "Acesso genérico a pastas partilhadas de qualquer CT. Vários CTs que partilham o mesmo directório da máquina. Simples e reutilizável.",
+    "idmapTypeRich": "<code>lxc.idmap</code>",
+    "idmapTypeSub": "(não utilizado por este programa)",
+    "idmapChangesRich": "Mapeamento personalizado de UID/GID em <code>/etc/pve/lxc/&lt;CTID&gt;.conf</code> mais entradas correspondentes de <code>/etc/subuid</code> + <code>/etc/subgid</code> na máquina. CT deve ser reiniciado em cada mudança.",
+    "idmapWhenRich": "Você precisa de um UID <em>específico</em> dentro do CT para mapear para um UID <em>específico</em> no host (por exemplo: <code>media:1000</code> no CT deve possuir arquivos como <code>media:1000</code> no host para que NFS não squash). Uma configuração mais rígida, normalmente só vale a pena para esse cenário exato.",
+    "idmapTipTitle": "Quando você realmente precisa de lxc.idmap",
+    "idmapTipBody": "Use mapeamento manual quando arquivos gravados no CT precisarem aparecer no host com um UID/GID numérico específico, por exemplo para compartilhar proprietário com um usuário do host. Isso não ignora <code>all_squash</code> do NFS; o servidor ainda decide a identidade anônima e os privilégios. Adicione entradas <code>lxc.idmap</code> manualmente se necessário. A linha do bind mount é independente dessas entradas."
+  },
+  "opening": {
+    "heading": "Abrir a ferramenta",
+    "body": "Do menu principal do ProxMenux, abra o <strong>Storage &amp; Share Manager → Configure pontos de montagem LXC (Host ↔ Container)</strong>. Você verá este sub-menu com três opções:",
+    "imageAlt": "Menu do gestor de montagem LXC — Adicionar / Ver / Remover"
+  },
+  "addFlow": {
+    "heading": "Adicionar uma montagem — fluxo total",
+    "intro": "A visão técnica, para quando você deseja saber exatamente o que cada diálogo faz:"
+  },
+  "sources": {
+    "heading": "O que você pode escolher como diretório de máquina",
+    "intro": "O seletor de diretório do host é o mais completo na seção Armazenamento &amp; Share. Analisa quatro fontes e apresenta uma lista deduplicada:",
+    "headerSource": "Origem",
+    "headerWhere": "De onde vem",
+    "headerLabel": "Rótulo no menu",
+    "rows": [
+      {
+        "source": "Montagens de rede ativa",
+        "whereRich": "Compartilhamentos CIFS / NFS atualmente montados, lidos de <code>/proc/mounts</code>.",
+        "labelRich": "<code>NFS [used/size]</code> ou <code>CIFS/SMB [used/size]</code>"
+      },
+      {
+        "source": "Montagens de fstab inactivas",
+        "whereRich": "Definido em <code>/etc/fstab</code> mas não montado atualmente.",
+        "labelRich": "<code>fstab(off)-NFS</code> / <code>fstab(off)-CIFS/SMB</code>"
+      },
+      {
+        "source": "Directórios locais",
+        "whereRich": "Directórios Sub sob <code>/mnt</code> que não são montagens de rede.",
+        "labelRich": "<code>Local [size]</code>"
+      },
+      {
+        "source": "Armazenagens Proxmox",
+        "whereRich": "Caminhos de armazenamento sob <code>/mnt/pve/*</code> (NFS / CIFS registrados via <code>pvesm</code>).",
+        "labelRich": "<code>PVE-NFS</code> / <code>PVE-CIFS/SMB</code> / <code>Proxmox-Storage</code>"
+      },
+      {
+        "source": "Entrada manual",
+        "where": "Qualquer outra coisa — digite você mesmo o caminho absoluto.",
+        "labelRich": "<em>Inserir caminho manualmente</em>"
+      }
+    ],
+    "tipTitle": "Caminhos internos do Proxmox são filtrados",
+    "tipBody": "O catador ignora explicitamente os caminhos internos do Proxmox (<code>/mnt/pve/local</code>, <code>/mnt/pve/local-lvm</code>, <code>/mnt/pve/backup</code>, ...) — esses estão reservados para os internos do Proxmox e você não deve ligá-los. Apenas os armazenamentos adicionados ao utilizador aparecem."
+  },
+  "manual": {
+    "heading": "Equivalente manual",
+    "privIntro": "Para um recipiente privilegiado — o caso mais simples, sem truques de permissão:",
+    "unprivLocalIntro": "Para um contêiner sem privilégios com uma pasta de máquinas local — abra as permissões na máquina primeiro:",
+    "unprivCifsIntro": "Para um recipiente sem privilégios com uma partilha CIFS já montada na máquina:"
+  },
+  "view": {
+    "heading": "Ver pontos de montagem",
+    "body": "Lista todas as entradas <code>mpN</code> em cada recipiente neste host Proxmox, agrupados por CT id e mostrando caminho do host → caminho do container além de quaisquer opções extras. Somente leitura — útil como uma verificação de sanidade antes de adicionar ou remover qualquer coisa."
+  },
+  "remove": {
+    "heading": "Remover um ponto de montagem",
+    "body": "Escolha o contentor, escolha a entrada <code>mpN</code>, confirme. O script executa <code>pct set --delete mpN</code> para soltar a entrada da configuração CT e oferece para reiniciar o recipiente se estiver em execução. O diretório host e seu conteúdo são <strong>preservados</strong> — você pode re-adicionar o monte mais tarde (ou anexar o mesmo diretório a um outro CT).",
+    "warnTitle": "Recipientes em funcionamento ao vivo precisam de ser reiniciados para que as alterações produzam efeitos",
+    "warnBody": "Ambos adicionando e removendo pontos de montagem só se tornam visíveis dentro do recipiente após um reinício. O script oferece um clique <code>pct reboot</code> no final de cada operação; você pode recusar e reiniciar manualmente mais tarde."
+  },
+  "troubleshoot": {
+    "heading": "Resolução de Problemas",
+    "noMountTitle": "A montagem aparece em pct config, mas não dentro do contentor",
+    "noMountBody": "As montagens de ligação só se ligam quando o contentor começa. Se você adicionou a montagem enquanto o CT estava em execução, reinicie-a (<code>pct reboot &lt;ctid&gt;</code>). Se já estiver reiniciado e ainda estiver em falta, verifique <code>pct config &lt;ctid&gt;</code> para confirmar que o item existe e o caminho da máquina contém um diretório.",
+    "noWriteTitle": "Container pode ver o diretório, mas não pode escrever",
+    "noWriteBody": "Quase sempre uma questão de permissões. Para contêineres não privilegiados, execute a correção de permissão do script novamente — os ACLs do diretório host podem ter sido reiniciados por outra ferramenta (rsync, restauração de backup, manual <code>chmod</code>). Para o CIFS, verifique novamente as opções de montagem no host: <code>findmnt /mnt/pve/cifs-…</code>, procure por valores <code>uid=</code> / <code>gid=</code> / <code>file_mode=</code>.",
+    "alreadyTitle": "\"Este caminho já é usado como ponto de montagem neste recipiente\"",
+    "alreadyBody": "Escolheste o mesmo caminho que já está ligado a um directório de máquinas diferente. Escolha um caminho diferente do recipiente ou remova primeiro o ponto de montagem existente.",
+    "nfsTitle": "Acesso NFS bloqueado mesmo após a aplicação da correção host",
+    "nfsIntro": "Seu servidor NFS está esmagando root ou todas as conexões. O script pode detectar isso (ele tenta escrever um arquivo de teste do host) e mostra orientação do lado do servidor. Duas correções comuns do lado do servidor para a exportação:",
+    "nfsItems": [
+      "<code>no_root_squash</code> — CTs privilegiados podem escrever diretamente.",
+      "<code>all_squash,anonuid=65534,anongid=65534</code> — para CTs sem privilégios."
+    ],
+    "nfsOutro": "Essas alterações acontecem no servidor NFS (TrueNAS, Synology, sua exportação personalizada, ...), não no Proxmox.",
+    "fstabOffTitle": "Montar entradas \"fstab( off)\" não faz nada",
+    "fstabOffBody": "O seletor mostra entradas <code>fstab(off)-</code> quando uma montagem de rede é definida em fstab mas não é montada atualmente. O script permite- lhe vincular- montar o caminho, mas o diretório estará vazio até que você realmente monte o compartilhamento (<code>mount &lt;path&gt;</code> na máquina). Monta-o primeiro, depois liga-o ao CT."
+  },
+  "related": {
+    "heading": "Relacionado",
+    "items": [
+      {
+        "href": "/docs/storage-share/host-local-shared",
+        "label": "Adicionar a Pasta Partilhada na Máquina",
+        "tailRich": " — primeiro passo típico: preparar um <code>/mnt/shared</code> no hospedeiro antes de o ligar em uma ou mais CTs aqui."
+      },
+      {
+        "href": "/docs/storage-share/host-nfs",
+        "label": "Adicionar a partilha NFS como armazenamento Proxmox",
+        "extraHref": "/docs/storage-share/host-samba",
+        "extraLabel": "Adicionar a partilha Samba como armazenamento Proxmox",
+        "joiner": " / ",
+        "tailRich": " — registar um compartilhamento externo no Proxmox primeiro, em seguida, ligar-montar o seu caminho <code>/mnt/pve/&lt;id&gt;</code> para o CT aqui."
+      },
+      {
+        "href": "/docs/storage-share/lxc-nfs-client",
+        "label": "Cliente NFS em LXC",
+        "extraHref": "/docs/storage-share/lxc-samba-client",
+        "extraLabel": "Cliente Samba em LXC",
+        "joiner": " / ",
+        "tail": " — a alternativa quando pretende que o próprio CT monte o compartilhamento (requer um contentor privilegiado)."
+      }
+    ]
+  }
+}
diff --git a/web/messages/pt/docs/storage-share/lxc-nfs-client.json b/web/messages/pt/docs/storage-share/lxc-nfs-client.json
new file mode 100644
index 00000000..6e159455
--- /dev/null
+++ b/web/messages/pt/docs/storage-share/lxc-nfs-client.json
@@ -0,0 +1,128 @@
+{
+  "meta": {
+    "title": "NFS cliente em LXC | ProxMenux Documentação",
+    "description": "Monte compartilhamentos NFS diretamente em um contêiner LXC Proxmox com o ProxMenux. Instala nfs-common automaticamente, oferece descoberta na LAN, montagens persistentes via /etc/fstab e padrões de inicialização seguros. Exige um contêiner com privilégios.",
+    "ogTitle": "NFS cliente em LXC | ProxMenux Documentação",
+    "ogDescription": "Monte compartilhamentos NFS em um contêiner LXC com privilégios. Descoberta automática, persistência em /etc/fstab e padrões de inicialização seguros."
+  },
+  "header": {
+    "title": "Cliente NFS em LXC",
+    "description": "Monte compartilhamentos NFS diretamente de dentro de um recipiente Proxmox LXC. O container torna-se um cliente NFS real — fala com o servidor NFS através da rede, executa mount.nfs, escreve para /etc/fstab. ProxMenux instala nfs-common para você, ajuda você a encontrar servidores e exportações, e aplica padrões de inicialização seguros.",
+    "section": "Armazenamento e Compartilhamento · LXC"
+  },
+  "privReq": {
+    "title": "Recipiente privilegiado necessário",
+    "body": "O cliente do kernel <code>mount.nfs</code> precisa de recursos (<code>SYS_ADMIN</code> no mínimo) que os recipientes LXC desprivilegiados não expõem. O script impõe isso — ele pede que você escolha um CT e <strong>interrompe a execução se ele não for privilegiado</strong>. Se você precisar da partilha dentro de um CT sem privilégios, monte-a no host Proxmox primeiro (com a partilha <hostNfsLink>NFS como armazenamento Proxmox</hostNfsLink>) e ligue-a ao CT com o gestor de montagem <mountLink>LXC</mountLink>."
+  },
+  "what": {
+    "heading": "O que isto faz",
+    "body": "Ao contrário do LXC Mount Manager — o que faz com que o CT veja algo <em>via</em> o host Proxmox — este script dá ao contêiner seu <strong>próprio cliente NFS</strong>: ele fala NFS sobre a rede, monta compartilhamentos diretamente do servidor NFS, e armazena a montagem no <code>/etc/fstab</code> do contêiner. A máquina Proxmox não está no caminho dos dados.",
+    "diagramServerLabel": "Servidor NFS",
+    "diagramServerDetail": "/export/data",
+    "diagramHostLabel": "Host Proxmox",
+    "diagramHostDetail": "(apenas uma\nponte de rede)",
+    "diagramCtLabel": "LXC (com privilégios)",
+    "diagramCtDetail": "/mnt/data\nmount.nfs dentro do CT",
+    "diagramArrow": "NFS",
+    "twoWaysTitle": "Duas maneiras de dar um acesso CT NFS — escolha uma",
+    "twoWaysBind": "<strong>Bind mount pelo host</strong> (<mountLink>LXC Mount Manager</mountLink>): o host monta NFS uma vez e cada CT recebe o mesmo caminho por bind mount. Funciona com CTs sem privilégios. Recomendado quando vários CTs precisam do mesmo compartilhamento.",
+    "twoWaysDirect": "<strong>Montagem NFS direta no CT</strong> (esta página): o CT monta NFS por conta própria. Exige um CT com privilégios. Útil quando o CT precisa gerenciar sua própria conexão e credenciais ou quando cada CT usa um servidor diferente."
+  },
+  "opening": {
+    "heading": "Abrir a ferramenta",
+    "body": "Do menu principal do ProxMenux, abra o <strong>Storage &amp; Share Manager → Configure o cliente NFS em LXC (somente privilegiado)</strong>. O ProxMenux primeiro pede- lhe para escolher o <strong> alvo CT</strong> (e inicia- o se parar); aborta se não tiver privilégios. Uma vez que o CT é selecionado, você vê este sub-menu:",
+    "imageAlt": "Menu do Gerenciador de Clientes NFS — Montagem / Vista / Desmontagem / Conectividade de teste"
+  },
+  "howRuns": {
+    "heading": "Como o script é executado (Fluxo do Monte)"
+  },
+  "fstabFlags": {
+    "heading": "Por que essas bandeiras fstab",
+    "intro": "Para montagens permanentes o script adiciona três bandeiras além das opções padrão NFS: <code>_netdev,x-systemd.automount,noauto</code>. Cada um resolve um problema de tempo de inicialização real:",
+    "headerFlag": "Bandeira",
+    "headerEffect": "O que ele faz",
+    "rows": [
+      {
+        "flag": "_netdev",
+        "effect": "Informa ao sistema de inicialização que a montagem precisa da rede. A inicialização não fica esperando essa montagem antes de a rede estar disponível."
+      },
+      {
+        "flag": "x-systemd.automount",
+        "effectRich": "Cria uma unidade de montagem automática systemd: a montagem só acontece na primeira vez que algo acessa o <code>/mnt/&lt;path&gt;</code>. O servidor NFS não acessível no arranque não para o servidor CT."
+      },
+      {
+        "flag": "noauto",
+        "effect": "Evita a montagem imediata na inicialização. Com a unidade automount acima, a montagem só ocorre no primeiro acesso."
+      }
+    ],
+    "netEffectTitle": "Efeito líquido",
+    "netEffectBody": "O sistema de arquivos NFS é montado no <em>primeiro acesso</em> em vez de imediatamente durante a inicialização. Se o servidor estiver offline, o acesso pode esperar ou falhar e afetar serviços que dependem do caminho. Automount reduz a dependência na inicialização, mas não garante que todos os serviços do CT fiquem imunes a uma falha NFS."
+  },
+  "manual": {
+    "heading": "Equivalente manual",
+    "body": "Replicar todo o fluxo à mão – cada comando roda <strong> dentro do CT</strong> via <code>pct exec &lt;ctid&gt; --</code> ou diretamente via <code>pct enter &lt;ctid&gt;</code>:"
+  },
+  "view": {
+    "heading": "Ver as montagens actuais",
+    "body": "Lista cada ponto de montagem NFS ativo dentro do CT (<code>mount | grep nfs</code>) mais cada linha NFS no CT <code>/etc/fstab</code>. Para cada entrada do fstab, o status de montagem ao vivo é mostrado — útil para detectar montagens permanentes que não apareceram no boot."
+  },
+  "unmount": {
+    "heading": "Desmontar a partilha NFS",
+    "body": "Combina as montagens ativas e as entradas do fstab em uma lista, permite escolher uma e <strong>remove a linha correspondente de <code>/etc/fstab</code></strong>. O script <em>não</em> executa <code>umount</code> na montagem ativa. Em vez disso, ele informa que uma reinicialização CT é necessária para que a desmontagem entre em vigor.",
+    "warnTitle": "O script remove entradas do fstab, sem desmontar os sistemas de arquivos ativos",
+    "warnBody": "Esta é uma escolha de design deliberada: <code>umount</code> em uma montagem ocupada falha com \"dispositivo ocupado\" quando algo dentro do CT ainda está usando. A remoção da entrada do fstab garante que a montagem desapareça de forma limpa no próximo início do CT. Se você quiser a montagem desfeita <em>agora</em> e você tem certeza de que nada está usando-o, execute <code>pct exec &lt;ctid&gt; -- umount /mnt/&lt;path&gt;</code> à mão após o script terminar."
+  },
+  "test": {
+    "heading": "Teste de conectividade NFS",
+    "body": "Passo diagnóstico dentro do CT: confirma <code>nfs-common</code> está instalado, <code>rpcbind</code> está em execução, lista as montagens atuais NFS, em seguida, itera sobre cada servidor NFS referenciado em fstab e verifica ping → porta 2049 → <code>showmount -e</code>. Boa primeira paragem quando uma montagem permanente falha em subir."
+  },
+  "troubleshoot": {
+    "heading": "Resolução de Problemas",
+    "privTitle": "Contêiner com privilégios necessário (o script interrompe a execução)",
+    "privBody": "O CT selecionado não tem privilégios. O cliente do kernel NFS precisa de capacidade <code>SYS_ADMIN</code> que CTs desprivilegiadas não expõem. Ou converter o CT para a página privilegiada (Disco Manager &amp; conversão está documentada no disco <importLink>Importar para LXC</importLink>) ou usar o caminho alternativo descrito no aviso no topo desta página.",
+    "aptTitle": "apt-get install nfs-common fails",
+    "aptIntro": "O script assume uma família Debian CT (<code>apt-get</code>). Se o CT roda Alpine / Arch / Rocky / Alma, o passo de instalação falha silenciosamente. Instale o cliente NFS manualmente para essa distribuição:",
+    "aptItems": [
+      "Alpine: <code>apk add nfs-utils</code>",
+      "Arch: <code>pacman -S nfs-utils</code>",
+      "Rocky / Alma: <code>dnf install nfs-utils</code>"
+    ],
+    "aptOutro": "Em seguida, execute novamente o script ProxMenux — o passo de instalação salta quando as ferramentas já estão presentes.",
+    "portTitle": "\"NFS port (2049) is not accessible\"",
+    "portBody": "O Ping teve sucesso, mas o <code>nc -z &lt;server&gt; 2049</code> falhou de dentro do CT. Verifique se o serviço NFS está em execução no servidor, que o firewall permite o 2049 da rede do CT, e que o CT realmente tem uma rota de rede válida (Tente <code>pct exec &lt;ctid&gt; -- ip route</code>).",
+    "bootTitle": "A montagem permanente tem sucesso mas não aparece no arranque",
+    "bootBody": "Quase sempre uma de: a rede não está pronta quando o CT monta (as bandeiras <code>_netdev,x-systemd.automount,noauto</code> do script corrigem isto — reajustar a montagem através do script se você escreveu a linha fstab à mão sem elas), o servidor não é acessível no arranque (auto-mount espera pelo primeiro acesso — isso é normal), ou DNS não está resolvido no arranque (use o IP do servidor, não o seu nome de máquina).",
+    "squashTitle": "Servidor squashes root, sem acesso de gravação de dentro CT",
+    "squashIntro": "A exportação NFS usa <code>root_squash</code> (o padrão) e o CT escreve como root. Duas opções:",
+    "squashItems": [
+      "Lado do servidor: alterar a exportação para <code>no_root_squash</code> (apenas se você confiar no CT).",
+      "No CT: grave como um usuário não root aceito pelo servidor ou ajuste o proprietário do compartilhamento com chown."
+    ],
+    "squashOutro": "ProxMenux não pode corrigir isso — é política de servidor."
+  },
+  "related": {
+    "heading": "Relacionado",
+    "items": [
+      {
+        "href": "/docs/storage-share/lxc-mount-points",
+        "label": "Pontos de montagem LXC (Host ↔ Container)",
+        "tail": " — a alternativa para os TAC não privilegiados: montagem no hospedeiro, ligação em CT."
+      },
+      {
+        "href": "/docs/storage-share/lxc-samba-client",
+        "label": "Cliente Samba em LXC",
+        "tail": " — página relacionada com o mesmo padrão para compartilhamentos SMB / CIFS."
+      },
+      {
+        "href": "/docs/storage-share/lxc-nfs-server",
+        "label": "Servidor NFS em LXC",
+        "tailRich": " — o inverso: expor pastas <em>de</em> um CT por NFS."
+      },
+      {
+        "href": "/docs/storage-share/host-nfs",
+        "label": "Compartilhamento NFS como armazenamento Proxmox",
+        "tail": " — registrar o compartilhamento no próprio Proxmox em vez de dentro de um único CT."
+      }
+    ]
+  }
+}
diff --git a/web/messages/pt/docs/storage-share/lxc-nfs-server.json b/web/messages/pt/docs/storage-share/lxc-nfs-server.json
new file mode 100644
index 00000000..2780cb80
--- /dev/null
+++ b/web/messages/pt/docs/storage-share/lxc-nfs-server.json
@@ -0,0 +1,159 @@
+{
+  "meta": {
+    "title": "Servidor NFS em LXC − Documentação ProxMenux",
+    "description": "Compartilhe pastas por NFS a partir de um contêiner LXC Proxmox com o ProxMenux. Instala nfs-kernel-server automaticamente e configura o grupo comum sharedfiles, /etc/exports, ACLs de rede e desinstalação completa. Exige um contêiner com privilégios.",
+    "ogTitle": "Servidor NFS em LXC − Documentação ProxMenux",
+    "ogDescription": "Execute um servidor NFS em um LXC com privilégios, com o grupo comum sharedfiles, ACLs de rede e desinstalação completa."
+  },
+  "header": {
+    "title": "Servidor NFS em LXC",
+    "description": "Execute um servidor NFS do kernel em um contêiner LXC Proxmox e disponibilize pastas a outras máquinas da rede. O ProxMenux instala nfs-kernel-server, configura o grupo comum sharedfiles para facilitar o compartilhamento entre vários CTs com privilégios, gerencia /etc/exports e oferece desinstalação completa.",
+    "section": "Armazenamento e Compartilhamento · LXC"
+  },
+  "privReq": {
+    "title": "Recipiente privilegiado necessário",
+    "body": "<code>nfs-kernel-server</code> precisa montar o sistema de arquivos do kernel <code>nfsd</code> em <code>/proc/fs/nfsd</code>. Isso exige <code>CAP_SYS_ADMIN</code> no espaço de nomes do kernel do host, não apenas no espaço de usuários do contêiner. LXC sem privilégios não têm essa capacidade: <code>rpc.nfsd: Unable to access /proc/fs/nfsd errno 2 (No such file or directory)</code>; o systemd indica falha de dependência em <code>nfs-server.service</code>. O script exige um CT com privilégios e <strong>interrompe a execução se o CT não tiver privilégios</strong>. Outra opção é executar o servidor NFS em uma VM."
+  },
+  "what": {
+    "heading": "O que isto faz",
+    "body": "É o sentido inverso da página de <em>cliente NFS</em>: o CT se torna um <strong>servidor NFS</strong> e disponibiliza uma pasta própria a outros CTs, ao host Proxmox, a VMs ou a máquinas físicas.",
+    "diagramServerLabel": "LXC (privilegiado) — Servidor NFS",
+    "diagramServerDetail": "/mnt/data\n(pasta compartilhada)\n\nchown root:sharedfiles\nchmod 2775 (SGID)\n\nnfs-kernel-server\n+ rpcbind em execução",
+    "diagramClientLabel": "Qualquer cliente na rede",
+    "diagramClientDetail": "outro CT, o host,\num VM, uma máquina física…",
+    "diagramArrow": "Exportação NFS"
+  },
+  "shared": {
+    "heading": "O grupo comum « sharedfiles »",
+    "body": "Antes de exportar a pasta, ProxMenux cria um grupo chamado <code>sharedfiles</code> com <strong>GID 101000</strong> dentro do recipiente, adiciona cada usuário regular para ele, em seguida, define o diretório de exportação para <code>root:sharedfiles</code> com modo <code>2775</code>. O <code>2</code> na frente é o bit SGID — cada arquivo ou pasta criado dentro automaticamente herda o grupo <code>sharedfiles</code>.",
+    "gidTitle": "Por que GID 101000 especificamente",
+    "gidBody": "Com o mapeamento padrão de IDs do LXC (+100000), o GID 101000 do host aparece como GID <strong>1000</strong> em um CT sem privilégios. Este fluxo de servidor usa um CT <strong>com privilégios</strong>, sem deslocamento. Dois CTs com privilégios que usem <code>sharedfiles</code> com GID 101000 compartilham o mesmo ID numérico de grupo.",
+    "remapTitle": "A criação legada de usuários «remap_*» é ignorada em CTs com privilégios",
+    "remapBody": "O ramo legado para CTs sem privilégios criaria usuários <code>remap_&lt;uid&gt;</code> com UID <code>&lt;uid&gt; + 100000</code>, todos em <code>sharedfiles</code>, para usuários comuns e UIDs habituais (33, 1000, 1001, 1002). Esse deslocamento <code>+100000</code> não se aplica aos CTs <strong>com privilégios</strong> exigidos aqui, então o script ignora o ramo. A ausência de contas <code>remap_*</code> em <code>getent passwd</code> é esperada e não indica falha."
+  },
+  "defaults": {
+    "heading": "Opções de exportação padrão — leia isto primeiro",
+    "warnTitle": "Opções padrão incluem no_root_squash",
+    "warnBody": "O ProxMenux usa por padrão <code>rw,sync,no_subtree_check,'<'strong'>'no_root_squash'<'/strong'>'</code>. <strong>Qualquer usuário root de um cliente pode gravar como root na exportação.</strong> Use isso apenas em uma LAN doméstica confiável. Se o CT for acessível por uma rede não confiável (VPS ou VLAN não confiável), <strong>troque a opção por <code>root_squash</code></strong> no diálogo de opções personalizadas."
+  },
+  "opening": {
+    "heading": "Abrir a ferramenta",
+    "body": "No menu principal, abra <strong>Storage & Share Manager → Configure NFS Server in LXC</strong>. Apenas CTs com privilégios são listados. Escolha o CT de destino; o script o inicia se estiver parado e recusa CTs sem privilégios. O menu oferece cinco opções.",
+    "imageAlt": "NFS Server Manager menu — Criar / Ver / Apagar / Estado / Desinstalar"
+  },
+  "howRuns": {
+    "heading": "Como o script é executado (Criar fluxo)"
+  },
+  "network": {
+    "heading": "Rede ACL — quem pode montar a partilha",
+    "intro": "<code>/etc/exports</code> define quais clientes podem montar a exportação. O diálogo oferece três modos:",
+    "headerMode": "Modo",
+    "headerValue": "Valor escrito em /etc/exports",
+    "headerWhen": "Quando o escolher",
+    "rows": [
+      {
+        "mode": "Rede local",
+        "value": "192.168.0.0/16",
+        "whenRich": "Para redes domésticas ou SOHO comuns. Abrange todos os endereços <code>192.168.*.*</code>."
+      },
+      {
+        "mode": "Sub- rede personalizada",
+        "value": "o seu CIDR (por ex. 10.0.0.0/24)",
+        "when": "Quando sua LAN não está em 192.168.x.x ou você quer um escopo mais apertado."
+      },
+      {
+        "mode": "Uma máquina",
+        "value": "o seu IP (por exemplo: 10.0.0.42)",
+        "when": "Apenas uma máquina específica deve montar. Muito restritivo."
+      }
+    ]
+  },
+  "options": {
+    "heading": "Opções de exportação explicadas",
+    "headerOption": "Opção",
+    "headerEffect": "O que ele faz",
+    "rows": [
+      {
+        "option": "rw / ro",
+        "effect": "Permitir o acesso de leitura-escrita ou somente leitura para conectar clientes."
+      },
+      {
+        "option": "sync",
+        "effectRich": "Responde às solicitações de gravação somente depois que os dados estão no disco. Mais seguro que <code>async</code>, com perda de desempenho."
+      },
+      {
+        "option": "no_subtree_check",
+        "effect": "Ignora a verificação, em cada solicitação, de que o arquivo ainda está na subárvore exportada. É mais rápido e evita problemas quando arquivos são renomeados durante a operação."
+      },
+      {
+        "option": "no_root_squash",
+        "effectRich": "<strong>Confia no root do cliente.</strong> Um cliente que monta como root grava como root no servidor. Útil em LANs confiáveis, por exemplo para preservar proprietários nos backups. Substitua por <code>root_squash</code> se não confiar totalmente em todas as máquinas autorizadas pela ACL de rede."
+      }
+    ]
+  },
+  "manual": {
+    "heading": "Equivalente manual",
+    "body": "Replicar todo o fluxo à mão – cada comando roda <strong> dentro do CT</strong> via <code>pct exec &lt;ctid&gt; --</code> ou <code>pct enter &lt;ctid&gt;</code>:"
+  },
+  "view": {
+    "heading": "Ver as exportações actuais",
+    "body": "Exibe <code>/etc/exports</code> de dentro do CT, ignorando comentários e linhas vazias, e mostra cada exportação com sua ACL de rede e opções. Útil para verificar as pastas expostas antes de compartilhar o IP do CT."
+  },
+  "delete": {
+    "heading": "Apagar uma exportação",
+    "body": "Lista cada linha em <code>/etc/exports</code> para seleção, remove a escolhida (<code>sed -i</code>), executa <code>exportfs -ra</code> e reinicia <code>nfs-kernel-server</code>. A pasta em si e seu conteúdo ficam intactos."
+  },
+  "status": {
+    "heading": "Verificar o estado do NFS",
+    "body": "Passe diagnóstico: confirma <code>nfs-kernel-server</code> e <code>rpcbind</code> estão instalados e ativos, imprime saída <code>exportfs -v</code>, lista sessões de NFS ativos (<code>showmount -a</code>) e conexões atuais do cliente."
+  },
+  "uninstall": {
+    "heading": "Desinstalar servidor NFS",
+    "body": "Limpeza completa após confirmação: para e desativa <code>nfs-kernel-server</code> e <code>rpcbind</code>, esvazia <code>/etc/exports</code>, remove os pacotes NFS com <code>apt-get purge</code>, remove o grupo <code>sharedfiles</code> e os usuários <code>remap_*</code> e encerra processos restantes. As <strong>pastas exportadas não são apagadas</strong>; apenas a configuração NFS e os pacotes são removidos.",
+    "warnTitle": "O script pára na linha de exportação, não nos dados",
+    "warnBody": "<em>Excluir exportação</em> e <em>Desinstalar servidor NFS</em> removem a configuração da exportação. Os dados da pasta são preservados. Para apagá-los também, use explicitamente <code>rm -rf</code> após o término do script e faça backup antes se alguém ainda puder precisar deles."
+  },
+  "troubleshoot": {
+    "heading": "Resolução de Problemas",
+    "privTitle": "Exige um contêiner com privilégios (o script interrompe a execução)",
+    "privBody": "O CT selecionado não tem privilégios. <code>nfs-kernel-server</code> não pode começar aí porque a montagem <code>/proc/fs/nfsd</code> exige <code>CAP_SYS_ADMIN</code> no espaço de nomes do kernel da máquina, e na <code>nfsd</code> o módulo também não está exposto ao espaço de nomes do contêiner (<code>modprobe nfsd</code> de dentro retorna <code>FATAL: Module nfsd not found</code>). Se ignorar a verificação, verás <code>rpc.nfsd: Unable to access /proc/fs/nfsd errno 2 (No such file or directory)</code> no diário e nenhuma porta NFS será aberta. As únicas opções viáveis são: converter o CT para privilegiado, ou mover o NFS servidor para uma VM.",
+    "aptTitle": "apt-get install falha",
+    "aptIntro": "O script assume uma família Debian CT. No Alpine / Arch / Rocky / Alma, instale os pacotes do servidor NFS à mão:",
+    "aptItems": [
+      "Alpine: <code>apk add nfs-utils</code>",
+      "Arch: <code>pacman -S nfs-utils</code>",
+      "Rocky / Alma: <code>dnf install nfs-utils</code>"
+    ],
+    "aptOutro": "Execute novamente o script ProxMenux; a instalação é ignorada quando as ferramentas já estão presentes.",
+    "aclTitle": "O cliente não pode montar: 'acesso negado pelo servidor'",
+    "aclBody": "O IP do cliente está fora da ACL de rede configurada. Recrie a exportação com uma sub-rede maior ou adicione o IP exato do cliente. Atenção: por meio de NAT, o cliente pode aparecer com o IP WAN do roteador em vez do próprio IP LAN. Verifique no servidor com <code>tcpdump -n port 2049</code>.",
+    "ownTitle": "Os arquivos escritos pelo cliente aparecem com propriedade estranha no servidor",
+    "ownIntro": "Duas possibilidades:",
+    "ownItems": [
+      "Com <code>no_root_squash</code> (padrão), o cliente root escreve como root no servidor. Os arquivos são de propriedade do <code>root:sharedfiles</code> graças ao SGID na pasta.",
+      "Usuários não-root do cliente escrevem como seu próprio UID/GID. Se seu UID não existe no servidor, os arquivos aparecem com números brutos (por exemplo: <code>1234:1234</code>). Use o grupo <code>sharedfiles</code> no cliente também, ou alinhem UIDs nos sistemas que compartilham arquivos."
+    ],
+    "noShowTitle": "Servidor acessível mas showmount não devolve nada",
+    "noShowBody": "Depois de editar <code>/etc/exports</code>, você deve recarregar a tabela de exportação com <code>exportfs -ra</code> e reiniciar <code>nfs-kernel-server</code> — o script faz ambos, mas se você editou o arquivo à mão, faça você mesmo. Também confirmar o firewall no CT (e no host Proxmox) permite TCP/UDP 2049 e na porta rpcbind (111)."
+  },
+  "related": {
+    "heading": "Relacionado",
+    "items": [
+      {
+        "href": "/docs/storage-share/lxc-nfs-client",
+        "label": "Cliente NFS em LXC",
+        "tail": " — o inverso: montar compartilhamentos NFS externos no CT."
+      },
+      {
+        "href": "/docs/storage-share/lxc-samba-server",
+        "label": "Servidor Samba em LXC",
+        "tail": " — página relacionada, mesmo padrão com SMB / CIFS em vez de NFS."
+      },
+      {
+        "href": "/docs/storage-share/host-nfs",
+        "label": "Compartilhamento NFS como armazenamento Proxmox",
+        "tailRich": " — quando o CT estiver exportando, registre o compartilhamento NFS no Proxmox para que apareça em <em>Datacenter → Storage</em>."
+      }
+    ]
+  }
+}
diff --git a/web/messages/pt/docs/storage-share/lxc-samba-client.json b/web/messages/pt/docs/storage-share/lxc-samba-client.json
new file mode 100644
index 00000000..631d844d
--- /dev/null
+++ b/web/messages/pt/docs/storage-share/lxc-samba-client.json
@@ -0,0 +1,155 @@
+{
+  "meta": {
+    "title": "Cliente Samba em LXC | ProxMenux Documentação",
+    "description": "Monte compartilhamentos Samba / CIFS em um contêiner LXC Proxmox com o ProxMenux. Instala cifs-utils e smbclient automaticamente e oferece descoberta de servidores, armazenamento protegido de credenciais e montagens persistentes via /etc/fstab. Exige um contêiner com privilégios.",
+    "ogTitle": "Cliente Samba em LXC | ProxMenux Documentação",
+    "ogDescription": "Monte compartilhamentos Samba / CIFS em um contêiner LXC com privilégios. Descoberta automática, arquivo de credenciais protegido e persistência em /etc/fstab."
+  },
+  "header": {
+    "title": "Cliente Samba em LXC",
+    "description": "Monte compartilhamentos Samba (SMB / CIFS) diretamente de dentro de um recipiente Proxmox LXC. O container torna-se um cliente CIFS real — fala com o servidor Samba através da rede, executa mount.cifs, armazena credenciais com segurança e escreve para /etc/fstab. ProxMenux instala cifs-utils + smbclient para você e valida credenciais contra o servidor antes de montar.",
+    "section": "Armazenamento e Compartilhamento · LXC"
+  },
+  "privReq": {
+    "title": "Recipiente privilegiado necessário",
+    "body": "O cliente do kernel <code>mount.cifs</code> precisa de recursos (<code>SYS_ADMIN</code> no mínimo) que os recipientes LXC desprivilegiados não expõem. O script impõe isso — ele pede que você escolha um CT e <strong>interrompe a execução se ele não for privilegiado</strong>. Se você precisar da partilha dentro de um CT sem privilégios, monte-a no host Proxmox primeiro (com a partilha <hostSambaLink>Samba / CIFS como armazenamento Proxmox</hostSambaLink>) e ligue-a ao CT com o gestor de montagem <mountLink>LXC</mountLink>."
+  },
+  "what": {
+    "heading": "O que isto faz",
+    "body": "O contêiner fala CIFS através da rede e monta a partilha por conta própria. O host Proxmox é apenas a ponte de rede — ele não vê ou gerencia a montagem.",
+    "diagramServerLabel": "Servidor Samba",
+    "diagramServerDetail": "//srv/share",
+    "diagramHostLabel": "Host Proxmox",
+    "diagramHostDetail": "(apenas uma\nponte de rede)",
+    "diagramCtLabel": "LXC (com privilégios)",
+    "diagramCtDetail": "/mnt/share\nmount.cifs dentro de CT",
+    "diagramArrow": "CIFS",
+    "twoWaysTitle": "Duas maneiras de dar um CT uma quota Samba — escolha uma",
+    "twoWaysBind": "<strong>Bind mount pelo host</strong> (<mountLink>LXC Mount Manager</mountLink>): o host monta CIFS uma vez e cada CT recebe o mesmo caminho por bind mount. Funciona com CTs sem privilégios. Recomendado quando vários CTs precisam do mesmo compartilhamento.",
+    "twoWaysDirect": "<strong>Montagem CIFS direta no CT</strong> (esta página): o CT monta CIFS por conta própria. Exige um CT com privilégios. Útil quando cada CT deve gerenciar suas credenciais ou usar um servidor diferente."
+  },
+  "opening": {
+    "heading": "Abrir a ferramenta",
+    "body": "Do menu principal do ProxMenux, abra o <strong>Storage &amp; Share Manager → Configure o cliente Samba em LXC (somente privilegiado)</strong>. O ProxMenux primeiro pede- lhe para escolher o <strong> alvo CT</strong> (e inicia- o se parar); aborta se não tiver privilégios. Uma vez que o CT é selecionado, você vê este sub-menu:",
+    "imageAlt": "Menu Samba Client Manager — Montar / Ver / Desmontar / Teste de conectividade"
+  },
+  "howRuns": {
+    "heading": "Como o script é executado (Fluxo do Monte)"
+  },
+  "creds": {
+    "heading": "Onde vive a senha",
+    "body": "O ProxMenux <strong>não inclui a senha no comando de montagem</strong> nem em <code>/etc/fstab</code>. Cria um arquivo de credenciais no CT. Esse arquivo contém credenciais em texto simples protegidas por permissões somente para root; não é criptografado:",
+    "whyTitle": "Por que um arquivo separado em vez de fstab",
+    "whyBody": "O módulo CIFS aceita opções <code>username=</code> / <code>password=</code> em linha em fstab, mas qualquer um que possa ler <code>/etc/fstab</code> vê a senha em claro. Colocar credenciais em um arquivo somente root e apontar fstab para ele (<code>credentials=</code>) mantém a senha fora da configuração legível no mundo."
+  },
+  "options": {
+    "heading": "Opções de montagem explicadas",
+    "headerOption": "Opção",
+    "headerEffect": "O que ele faz",
+    "rows": [
+      {
+        "option": "rw / ro",
+        "effect": "Modo de leitura e gravação ou somente leitura para toda a montagem."
+      },
+      {
+        "option": "file_mode=0664",
+        "effect": "Permissões relatadas para arquivos via CIFS. O padrão permite ao proprietário + grupo escrever, outros lerem."
+      },
+      {
+        "option": "dir_mode=0775",
+        "effect": "Permissões relatadas para pastas. O padrão permite que o proprietário + grupo entre e crie, outros atravessam."
+      },
+      {
+        "option": "iocharset=utf8",
+        "effect": "Força UTF-8 para nomes de arquivos recebidos pela rede, evitando caracteres corrompidos em nomes não ASCII."
+      },
+      {
+        "option": "credentials=file",
+        "effect": "Leia o nome de usuário / senha do arquivo (adicionado automaticamente para autenticação do usuário)."
+      },
+      {
+        "option": "guest",
+        "effect": "Autentique como convidado, sem credenciais necessárias (adicionadas automaticamente quando o convidado é escolhido)."
+      },
+      {
+        "option": "_netdev",
+        "effect": "Diz ao sistema de init que esta montagem precisa da rede. O Boot não bloqueia a espera."
+      },
+      {
+        "option": "x-systemd.automount",
+        "effect": "Montagem preguiçosa: apenas monta no primeiro acesso. O servidor CIFS não acessível no arranque não para o CT."
+      },
+      {
+        "option": "noauto",
+        "effect": "Evita a montagem imediata na inicialização. Com a unidade automount, o sistema de arquivos só é montado no primeiro acesso."
+      }
+    ],
+    "netEffectTitle": "Efeito líquido das bandeiras fstab",
+    "netEffectBody": "O sistema de arquivos CIFS é montado no <em>primeiro acesso</em> em vez de imediatamente durante a inicialização. Se o servidor estiver offline, o acesso pode esperar ou falhar e afetar serviços que dependem do caminho. Automount reduz a dependência na inicialização, mas não garante que todos os serviços do CT fiquem imunes a uma falha CIFS."
+  },
+  "manual": {
+    "heading": "Equivalente manual",
+    "body": "Replicar todo o fluxo à mão – cada comando roda <strong> dentro do CT</strong> via <code>pct exec &lt;ctid&gt; --</code> ou diretamente via <code>pct enter &lt;ctid&gt;</code>:",
+    "guestIntro": "Variante convidada — nenhum arquivo de credenciais necessário:"
+  },
+  "view": {
+    "heading": "Ver as montagens actuais",
+    "body": "Lista cada ponto de montagem CIFS ativo dentro do CT (<code>mount -t cifs</code>) mais cada linha CIFS no CT <code>/etc/fstab</code>. Para cada entrada do fstab é mostrado o status de montagem ao vivo — útil para detectar montagens permanentes que não apareceram no boot."
+  },
+  "unmount": {
+    "heading": "Desmontar a partilha do Samba",
+    "body": "Combina as montagens ao vivo e as entradas fstab em uma lista, permite que você escolha uma, e <strong> remove a linha correspondente de <code>/etc/fstab</code></strong> mais o arquivo de credenciais correspondentes. O script não executa <code>umount</code> na montagem ao vivo — em vez disso, ele lhe diz que uma reinicialização CT é necessária para que a desmontagem faça efeito.",
+    "warnTitle": "O script remove entradas do fstab, sem desmontar os sistemas de arquivos ativos",
+    "warnBody": "O mesmo design do cliente NFS: <code>umount</code> em uma montagem movimentada falha com o \"dispositivo ocupado\". A remoção da entrada do fstab garante que a montagem desapareça de forma limpa no próximo início do CT. Se você quiser o <em>agora</em>, execute <code>pct exec &lt;ctid&gt; -- umount /mnt/&lt;path&gt;</code> à mão depois que o script terminar."
+  },
+  "test": {
+    "heading": "Teste a conectividade do Samba",
+    "body": "Passe diagnóstico dentro do CT: confirma <code>cifs-utils</code> é instalado, lista as montagens CIFS atuais, em seguida, para cada servidor referenciado em fstab verifica ping → portas 139/445 → guest listing. \"Requer autenticação\" no teste convidado é normal para qualquer servidor que não expõe compartilhamentos públicos."
+  },
+  "troubleshoot": {
+    "heading": "Resolução de Problemas",
+    "privTitle": "Contêiner com privilégios necessário (o script interrompe a execução)",
+    "privBody": "O CT selecionado não tem privilégios. O cliente do kernel CIFS precisa de capacidade <code>SYS_ADMIN</code> que CTs desprivilegiadas não expõem. Ou converter o CT para privilegiado, ou usar o caminho alternativo descrito no aviso no topo desta página.",
+    "aptTitle": "apt-get install fails",
+    "aptIntro": "O script assume uma família Debian CT (<code>apt-get</code>). No Alpine / Arch / Rocky / Alma, instale o cliente CIFS à mão:",
+    "aptItems": [
+      "Alpine: <code>apk add cifs-utils samba-client</code>",
+      "Arch: <code>pacman -S cifs-utils smbclient</code>",
+      "Rocky / Alma: <code>dnf install cifs-utils samba-client</code>"
+    ],
+    "aptOutro": "Em seguida, execute novamente o script ProxMenux — o passo de instalação salta quando as ferramentas já estão presentes.",
+    "guestFallbackTitle": "\"O servidor conectou você como convidado em vez do usuário especificado\"",
+    "guestFallbackBody": "A validação ativa do script captou um problema real de autenticação. O servidor aceitou a conexão, mas baixou para o hóspede porque as credenciais estão erradas. Causas comuns: erro no nome de usuário / senha, o usuário não existe no servidor, o usuário está bloqueado para fora, ou o grupo de trabalho / domínio é desigual. Execute novamente o fluxo e informe as credenciais com cuidado (a senha está escondida na janela).",
+    "denyTitle": "\"NT_STATUS_ACCESS_DENIED\" na montagem",
+    "denyBody": "As credenciais foram validadas, mas o compartilhamento nega acesso. Verifique no lado do servidor se o usuário tem permissões nesse compartilhamento específico (a validação só confirma login, não ACLs por compartilhamento). Verifique também se o servidor requer uma versão específica do protocolo SMB: anexe <code>vers=3.0</code> (ou <code>2.1</code>, <code>2.0</code>) às opções de montagem.",
+    "utf8Title": "Nomes de arquivos UTF-8 / não ASCII aparecem corrompidos",
+    "utf8Body": "As opções padrão incluem <code>iocharset=utf8</code>, mas algumas configurações de servidor reportam uma página de código inesperada. Se nomes de arquivos com acentos / símbolos olhar errado, também tente <code>nounix</code> (alguns servidores Linux Samba precisam disso quando o cliente também é Linux) ou definir o lado do servidor para <code>unix extensions = no</code>.",
+    "bootTitle": "A montagem permanente tem sucesso mas não aparece no arranque",
+    "bootBody": "Quase sempre uma de: a rede não está pronta quando o CT monta (as bandeiras <code>_netdev,x-systemd.automount,noauto</code> do script corrigem isso), o servidor é inacessível no boot (auto-mount espera pelo primeiro acesso – isso é normal), ou DNS não está resolvido no boot (use o IP do servidor, não seu hostname)."
+  },
+  "related": {
+    "heading": "Relacionado",
+    "items": [
+      {
+        "href": "/docs/storage-share/lxc-mount-points",
+        "label": "Pontos de montagem LXC (Host ↔ Container)",
+        "tail": " — a alternativa para os TAC não privilegiados: montagem no hospedeiro, ligação em CT."
+      },
+      {
+        "href": "/docs/storage-share/lxc-nfs-client",
+        "label": "Cliente NFS em LXC",
+        "tail": " — página relacionada com o mesmo padrão para compartilhamentos NFS."
+      },
+      {
+        "href": "/docs/storage-share/lxc-samba-server",
+        "label": "Servidor Samba em LXC",
+        "tailRich": " — o inverso: expor pastas <em>de</em> um CT por Samba."
+      },
+      {
+        "href": "/docs/storage-share/host-samba",
+        "label": "Samba / CIFS como armazenamento Proxmox",
+        "tail": " — registrar o compartilhamento no próprio Proxmox em vez de dentro de um único CT."
+      }
+    ]
+  }
+}
diff --git a/web/messages/pt/docs/storage-share/lxc-samba-server.json b/web/messages/pt/docs/storage-share/lxc-samba-server.json
new file mode 100644
index 00000000..9ab91c27
--- /dev/null
+++ b/web/messages/pt/docs/storage-share/lxc-samba-server.json
@@ -0,0 +1,132 @@
+{
+  "meta": {
+    "title": "Servidor Samba em LXC | ProxMenux Documentação",
+    "description": "Execute um servidor Samba (SMB / CIFS) em um contêiner LXC Proxmox com o ProxMenux. Instala samba automaticamente e gerencia /etc/samba/smb.conf, usuários smbpasswd e o grupo sharedfiles para pastas em bind mounts. Exige um contêiner com privilégios.",
+    "ogTitle": "Servidor Samba em LXC | ProxMenux Documentação",
+    "ogDescription": "Disponibilize pastas por SMB/CIFS de um LXC com privilégios. Instalação automática, usuário smbpasswd e permissões adaptadas a bind mounts."
+  },
+  "header": {
+    "title": "Servidor Samba em LXC",
+    "description": "Execute um servidor Samba (SMB / CIFS) dentro de um container Proxmox LXC e exponha pastas para clientes Windows / macOS / Linux na rede. ProxMenux instala samba, cria um usuário Samba com smbpasswd, gerencia /etc/samba/smb.conf, e aplica permissões adaptadas a bind mounts quando a pasta compartilhada vem do host.",
+    "section": "Armazenamento e Compartilhamento · LXC"
+  },
+  "privReq": {
+    "title": "Recipiente privilegiado necessário",
+    "body": "Samba personifica o usuário de conexão com <code>setgroups()</code> em cada conexão em árvore (no momento em que um cliente abre um compartilhamento). Em um LXC sem privilégios, o kernel rejeita esse syscall porque o espaço de nomes de usuário do container é criado com <code>setgroups=deny</code> — e o <code>smbd</code> responde abortando o processo de worker com <code>PANIC: sys_setgroups failed</code>. O resultado é que o <code>smbd</code> inicia e liga as portas 139/445, mas toda conexão com o cliente falha com o <code>NT_STATUS_CONNECTION_DISCONNECTED</code>. O script impõe um CT privilegiado por esta razão e <strong>interrompe a execução se o CT não tiver privilégios</strong>. Não há correção limpa no lado do servidor; use um CT privilegiado ou execute Samba dentro de uma VM."
+  },
+  "what": {
+    "heading": "O que isto faz",
+    "body": "O contêiner torna-se um servidor SMB/CIFS: ele roda <code>smbd</code>, expõe uma pasta via <code>/etc/samba/smb.conf</code> e aceita conexões de cliente em portas <code>139</code> / <code>445</code>. Os clientes veem o compartilhamento em <code>\\\\&lt;ct-ip&gt;\\&lt;share-name&gt;</code> no Windows Explorer, <code>smb://&lt;ct-ip&gt;/&lt;share-name&gt;</code> no macOS Finder, ou via <code>mount.cifs</code> no Linux.",
+    "diagramServerLabel": "LXC (privilegiado) — Servidor Samba",
+    "diagramServerDetail": "/mnt/data\n(pasta compartilhada)\n\nsmbd + nmbd em execução\n\nUsuário: <username>\n(via smbpasswd)\n\nGrupo imposto:\nsharedfiles",
+    "diagramClientLabel": "Qualquer cliente na rede",
+    "diagramClientDetail": "Windows: \\\\<ip>\\<share>\nmacOS:   smb://<ip>/<share>\nLinux:   mount.cifs",
+    "diagramArrow": "SMB / CIFS"
+  },
+  "perms": {
+    "heading": "Dois caminhos de permissões, dependendo do tipo de pasta",
+    "body": "Antes de adicionar o compartilhamento ao <code>smb.conf</code>, o script verifica se a pasta escolhida é uma montagem <strong>bind do host</strong> ou uma pasta <strong>local regular dentro do CT</strong> – e aplica diferentes permissões de propriedade em conformidade:",
+    "headerType": "Tipo de pasta",
+    "headerAction": "O que o script faz",
+    "bindType": "Montagem de ligação da máquina",
+    "bindTypeSubRich": "detectado através da saída <code>mount</code>",
+    "bindActionRich": "Cria o grupo <code>sharedfiles</code> (padrão GID 999, dinâmico se tomado), adiciona o usuário Samba a ele, em seguida, <code>chown root:sharedfiles</code> + <code>chmod 2775</code> (SGID — novos arquivos herdam o grupo). Se o usuário ainda não consegue escrever, aplica <code>setfacl -m u:&lt;user&gt;:rwx</code>.",
+    "localType": "Pasta local dentro do CT",
+    "localTypeSub": "nenhuma montagem de ligação detectada",
+    "localActionRich": "Propriedade padrão: <code>chown -R &lt;user&gt;:&lt;user&gt;</code> + <code>chmod -R 755</code>. Nenhum grupo compartilhado é necessário porque nenhum outro CT escreve para esta pasta. Regressa ao <code>setfacl</code> se o acesso de escrita ainda estiver ausente.",
+    "gidTitle": "GID para 'sharedfiles' difere do fluxo do servidor NFS",
+    "gidBody": "O script do servidor Samba usa GID <strong>999</strong> para <code>sharedfiles</code>, enquanto o fluxo do servidor <nfsLink>NFS</nfsLink> usa GID <strong>101000</strong>. Se você executar ambos os servidores no mesmo CT e quiser um único grupo compartilhado em ambos os protocolos, edite um deles para corresponder ao outro após a instalação (por exemplo. <code>groupmod -g 101000 sharedfiles</code>) e reaplicar a propriedade nas pastas afetadas. Esta é uma incoerência conhecida nos scripts atuais."
+  },
+  "opening": {
+    "heading": "Abrir a ferramenta",
+    "body": "No menu principal, abra <strong>Storage & Share Manager → Configure Samba Server in LXC</strong>. Apenas CTs com privilégios são listados. Escolha o CT de destino; o script o inicia se estiver parado e recusa CTs sem privilégios. O menu oferece cinco opções.",
+    "imageAlt": "Samba Server Manager menu — Criar / Ver / Apagar / Estado / Desinstalar"
+  },
+  "howRuns": {
+    "heading": "Como o script é executado (Criar fluxo)"
+  },
+  "modes": {
+    "heading": "Os três modos de partilha",
+    "intro": "Cada modo escreve uma seção diferente em <code>smb.conf</code>. Todos os três incluem <code>valid users = &lt;username&gt;</code> (sem anônimo), <code>force group = sharedfiles</code> (então novos arquivos pertencem ao grupo compartilhado) e <code>veto files = /lost+found/</code> (esconde-o de clientes).",
+    "headerMode": "Modo",
+    "headerBlock": "Bloco escrito para smb.conf",
+    "rwMode": "Leitura e escrita",
+    "roMode": "Somente leitura",
+    "customMode": "Personalizado",
+    "customBodyRich": "Você digita suas próprias diretivas em uma caixa de texto livre. ProxMenux ainda os envolve em um bloco <code>[share]</code> com o <code>path</code>, <code>valid users</code>, <code>force group</code> e <code>veto files</code> padrão."
+  },
+  "manual": {
+    "heading": "Equivalente manual",
+    "body": "Replicar todo o fluxo à mão – cada comando roda <strong> dentro do CT</strong> via <code>pct exec &lt;ctid&gt; --</code> ou <code>pct enter &lt;ctid&gt;</code>:"
+  },
+  "connect": {
+    "heading": "Conexão de clientes",
+    "headerOs": "Sistema operativo do cliente",
+    "headerHow": "Como conectar",
+    "windowsOs": "Windows",
+    "windowsHowRich": "Explorador de Arquivos → barra de endereço: <code>\\\\&lt;ct-ip&gt;\\&lt;share-name&gt;</code>. Ou <em>Mapear unidade de rede</em> → marque «Conectar usando credenciais diferentes».",
+    "macosOs": "macOS",
+    "macosHowRich": "Finder → <em>Ir → Conecte-se ao servidor...</em> → <code>smb://&lt;ct-ip&gt;/&lt;share-name&gt;</code>. Ou <code>mount_smbfs //user@&lt;ct-ip&gt;/&lt;share&gt; /mountpoint</code>.",
+    "linuxOs": "Linux",
+    "linuxHowRich": "<code>mount -t cifs //&lt;ct-ip&gt;/&lt;share&gt; /mnt/x -o username=&lt;u&gt;,password=&lt;p&gt;,iocharset=utf8</code>. Ou use o cliente <clientLink>Samba na página LXC</clientLink> se o cliente for outro Proxmox CT."
+  },
+  "view": {
+    "heading": "Ver os compartilhamentos atuais",
+    "body": "Analisa <code>/etc/samba/smb.conf</code> dentro do CT e lista todos os blocos <code>[share]</code> (passando <code>[global]</code>, <code>[homes]</code>, <code>[printers]</code>) com seu caminho. Útil como um inventário rápido."
+  },
+  "delete": {
+    "heading": "Apagar um compartilhamento",
+    "body": "Permite escolher um compartilhamento pelo nome, remove o bloco do <code>smb.conf</code> (<code>sed</code> exclui do <code>[share]</code> para a próxima linha em branco), e reinicia o <code>smbd</code>. A pasta em si e seu conteúdo ficam intactos."
+  },
+  "status": {
+    "heading": "Verificar o estado do Samba",
+    "body": "Relata se o <code>smbd</code> e o <code>nmbd</code> estão instalados e ativos, lista os usuários do Samba (<code>pdbedit -L</code>) e imprime sessões ativas (<code>smbstatus</code>)."
+  },
+  "uninstall": {
+    "heading": "Desinstalar o servidor Samba",
+    "body": "Limpeza completa após confirmação: para e desativa <code>smbd</code> e <code>nmbd</code>, salva <code>smb.conf</code> em <code>smb.conf.backup.YYYYMMDD_HHMMSS</code>, remove usuários Samba com <code>smbpasswd -x</code> e os pacotes Samba com <code>apt-get purge</code>. As <strong>pastas exportadas não são apagadas</strong>.",
+    "warnTitle": "Pastas sobrevivem — backup de dados separadamente",
+    "warnBody": "<em>Excluir compartilhamento</em> e <em>Desinstalar servidor Samba</em> removem a configuração do compartilhamento. Os dados das pastas exportadas são preservados. Para apagá-los também, use explicitamente <code>rm -rf</code> após o término do script."
+  },
+  "troubleshoot": {
+    "heading": "Resolução de Problemas",
+    "privTitle": "Exige um contêiner com privilégios (o script interrompe a execução)",
+    "privBody": "O CT selecionado é desprivilegiado e o <code>smbd</code> não pode servir arquivos lá. Se você ignorar a verificação e configurar Samba à mão, <code>smbd</code> começa e as portas abrem, mas a primeira conexão do cliente entra em pânico com <code>PANIC: sys_setgroups failed</code> em <code>/var/log/samba/log.&lt;client&gt;</code> e o cliente vê <code>NT_STATUS_CONNECTION_DISCONNECTED</code>. A causa é o namespace desprivilegiado que tem <code>setgroups=deny</code>, que bloqueia a personificação de Samba por conexão. Nem <code>features=keyctl=1</code> nem remover <code>force user</code> / <code>force group</code> altera isso. As únicas opções viáveis são: converter o CT para privilegiado, ou mover Samba para uma VM.",
+    "aptTitle": "apt-get install falha",
+    "aptIntro": "O script assume uma família Debian CT. Em Alpine / Arch / Rocky / Alma, instalar Samba à mão:",
+    "aptItems": [
+      "Alpine: <code>apk add samba</code>",
+      "Arch: <code>pacman -S samba</code>",
+      "Rocky / Alma: <code>dnf install samba</code>"
+    ],
+    "aptOutro": "Execute novamente o script ProxMenux; a instalação é ignorada quando as ferramentas já estão presentes.",
+    "noShareTitle": "O cliente conecta- se mas não consegue ver a partilha",
+    "noShareBody": "Verifique se o <code>browseable = yes</code> está definido no bloco de partilha (por omissão para os modos rw / ro; pode estar em falta na personalização). Também verifique o firewall CT e o firewall do host Proxmox permitem o TCP 445 (SMB) e o 139 (NetBIOS). Alguns clientes do Windows também exigem resolução de nome — tente o IP diretamente primeiro.",
+    "authTitle": "Falha na autenticação (NT_STATUS_LOGON_FAILURE)",
+    "authBody": "A senha está incorreta (as senhas Samba são <em>separadas</em> das do sistema; liste os usuários Samba com <code>pdbedit -L</code>) ou o usuário não consta em <code>valid users</code> para esse compartilhamento. Redefina a senha dentro do CT com <code>smbpasswd &lt;user&gt;</code>.",
+    "groupTitle": "Os arquivos escritos pelo cliente aparecem com o grupo errado no servidor",
+    "groupBody": "O script define <code>force group = sharedfiles</code> no bloco de compartilhamento, então novos arquivos devem ser o grupo <code>sharedfiles</code>. Se eles não forem, o bit SGID no diretório pai pode ter sido perdido (alguém correu <code>chmod</code> à mão). Reaplicação: <code>chmod 2775 /mnt/&lt;share&gt;</code>.",
+    "bothTitle": "Compartilhando a mesma pasta em ambos NFS e Samba",
+    "bothBody": "ProxMenux usa diferentes GIDs para <code>sharedfiles</code> em cada script (Samba: 999, NFS: 101000). Se você serve a mesma pasta através de ambos, decida sobre um GID e alinhar ambos. A correção mais simples: após executar ambos os scripts, edite o GID menor:"
+  },
+  "related": {
+    "heading": "Relacionado",
+    "items": [
+      {
+        "href": "/docs/storage-share/lxc-samba-client",
+        "label": "Cliente Samba em LXC",
+        "tail": " — o inverso: montar compartilhamentos Samba externos no CT."
+      },
+      {
+        "href": "/docs/storage-share/lxc-nfs-server",
+        "label": "Servidor NFS em LXC",
+        "tail": " — página relacionada, mesmo padrão com NFS em vez de CIFS."
+      },
+      {
+        "href": "/docs/storage-share/host-samba",
+        "label": "Samba / CIFS como armazenamento Proxmox",
+        "tailRich": " — quando o CT estiver exportando, registre o compartilhamento Samba no Proxmox para que apareça em <em>Datacenter → Storage</em>."
+      }
+    ]
+  }
+}
diff --git a/web/messages/pt/docs/utils/export-vm.json b/web/messages/pt/docs/utils/export-vm.json
new file mode 100644
index 00000000..0d07c6f4
--- /dev/null
+++ b/web/messages/pt/docs/utils/export-vm.json
@@ -0,0 +1,145 @@
+{
+  "meta": {
+    "title": "Exportar VM para OVA / OVF | Documentação ProxMenux",
+    "description": "Exporte uma VM Proxmox para um arquivo OVA portátil ou um diretório OVF com o esquema padrão DMTF. Discos VMDK no formato streamOptimized e manifesto SHA1. Importável no VMware ESXi / Workstation / Fusion, VirtualBox e novamente no Proxmox.",
+    "ogTitle": "Exportar VM para OVA / OVF | Documentação ProxMenux",
+    "ogDescription": "Converta uma VM Proxmox num pacote OVA / OVF portátil compatível com VMware e VirtualBox."
+  },
+  "header": {
+    "title": "Exportar VM para OVA / OVF",
+    "description": "Converte uma VM Proxmox num pacote OVA portátil (um único arquivo TAR) ou OVF (descritor e ficheiros VMDK) com o esquema OVF padrão DMTF. Os discos são convertidos com qemu-img para VMDK streamOptimized. O resultado pode ser importado no VMware (ESXi / Workstation / Fusion), VirtualBox e novamente no Proxmox através da ferramenta de importação.",
+    "section": "Utilitários"
+  },
+  "intro": {
+    "title": "O que isto faz",
+    "body": "Lê a configuração de uma VM parada, converte cada disco para VMDK streamOptimized, gera um descritor OVF e um manifesto SHA1 e reúne tudo num único ficheiro <code>.ova</code> ou num diretório <code>-ovf</code>. A VM de origem nunca é modificada."
+  },
+  "picker": {
+    "heading": "Seletor de VM",
+    "body": "Ao iniciar, o script lista todas as VMs de <code>qm list</code> com VMID, nome e estado. Escolha a que pretende exportar:",
+    "imgAlt": "Janela de seleção da VM a exportar com a lista de todas as VMs"
+  },
+  "stopped": {
+    "heading": "A VM tem de estar parada",
+    "intro": "Uma imagem de disco consistente exige uma VM parada. Se a VM selecionada estiver em execução, o ProxMenux propõe desligá-la:",
+    "items": [
+      "Encerramento normal através de <code>qm shutdown $VMID --timeout 120</code> (aguarda 2 minutos pelo encerramento ACPI do sistema convidado).",
+      "Se o tempo de espera terminar, propõe uma paragem forçada: <code>qm stop $VMID</code> (equivale a cortar a alimentação).",
+      "Se você recusar ambos, a exportação é interrompida — nenhum dado é tocado."
+    ],
+    "warnTitle": "A paragem forçada equivale a cortar a alimentação",
+    "warnBody": "<code>qm stop</code> equivale a desligar a alimentação à força. O sistema convidado pode precisar de reparar o sistema de ficheiros no arranque seguinte. Prefira o encerramento normal e reserve a paragem forçada para sistemas convidados que não respondem."
+  },
+  "format": {
+    "heading": "Selector de formato: OVA vs OVF",
+    "headerFormat": "Formato",
+    "headerOutput": "Saída",
+    "headerPros": "Vantagens",
+    "headerCons": "Desvantagens",
+    "rows": [
+      {
+        "format": "OVA",
+        "output": "name-vmid-ts.ova",
+        "pros": "Um único ficheiro autónomo, fácil de mover, transferir por sftp ou anexar a um pedido de suporte.",
+        "cons": "Requer ~220% do tamanho virtual do disco (espaço adicional para o arquivo TAR durante a criação)."
+      },
+      {
+        "format": "OVF",
+        "output": "name-vmid-ts-ovf/",
+        "pros": "~120% do tamanho virtual do disco. Mais fácil de inspecionar, pois o descritor é XML em texto. Pode ser editado antes da importação.",
+        "cons": "Vários ficheiros, que têm de ser transferidos em conjunto."
+      }
+    ]
+  },
+  "destination": {
+    "heading": "Diretório de destino",
+    "body": "Escolha um caminho predefinido (<code>/var/lib/vz/dump</code>, <code>/var/lib/vz/template/iso</code>) ou introduza um caminho personalizado. O script verifica se o diretório permite escrita e avisa se o espaço livre parecer insuficiente antes de começar.",
+    "calloutTitle": "Estimativa do espaço livre necessário",
+    "calloutBody": "Para exportar em OVF uma VM cujos discos somam 100 GB virtuais, reserve ~120 GB livres; para OVA, ~220 GB. A utilização real pode ser menor para discos quase vazios. O arquivo OVA é criado com TAR sem compressão enquanto os ficheiros VMDK temporários ainda existem, pelo que deve reservar espaço para ambos. Se o espaço acabar durante a exportação, o gestor de EXIT limpa o diretório temporário e terá de recomeçar."
+  },
+  "package": {
+    "heading": "O que acaba no pacote",
+    "intro": "Para um OVA/OVF denominado <code>myvm-100-2026-04-26_18-30-15</code>:",
+    "code": "# OVA mode (single .ova file is a TAR of):\nmyvm-100-2026-04-26_18-30-15.ovf      # XML descriptor (DMTF OVF 1.0 + RASD + VSSD)\nmyvm-100-2026-04-26_18-30-15.mf       # SHA1 manifest\nmyvm-100-2026-04-26_18-30-15-disk0.vmdk\nmyvm-100-2026-04-26_18-30-15-disk1.vmdk\n...\n\n# OVF mode (a directory):\nmyvm-100-2026-04-26_18-30-15-ovf/\n├── myvm-100-2026-04-26_18-30-15.ovf\n├── myvm-100-2026-04-26_18-30-15.mf\n├── myvm-100-2026-04-26_18-30-15-disk0.vmdk\n└── myvm-100-2026-04-26_18-30-15-disk1.vmdk"
+  },
+  "exported": {
+    "heading": "O que é exportado",
+    "items": [
+      "<strong>Discos:</strong> todas as entradas <code>scsi*</code>, <code>sata*</code>, <code>virtio*</code> e <code>ide*</code> da configuração da VM, convertidas para VMDK streamOptimized.",
+      "<strong>Número de vCPUs</strong> (RASD ResourceType 3) e <strong>memória</strong> em MiB (ResourceType 4).",
+      "<strong>Número de placas de rede</strong> (ResourceType 10: apenas o número, sem a bridge ou o modelo).",
+      "<strong>Nome da VM</strong> e indicação do tipo de sistema operativo."
+    ],
+    "notTitle": "O que não é exportado",
+    "notItems": [
+      "Montagens CD-ROM / ISO (excluídas intencionalmente).",
+      "Unidades cloud-init (excluídas intencionalmente).",
+      "Bridge e modelo específicos da placa de rede (apenas o número é conservado).",
+      "Escolha BIOS / UEFI, a configurar novamente na importação.",
+      "Configuração de passthrough PCI.",
+      "Instantâneos — apenas o estado atual é capturado.",
+      "Opções de nível VM (NUMA, páginas enormes, hotplug, ...)."
+    ]
+  },
+  "conversion": {
+    "heading": "Conversão de disco",
+    "intro": "Cada disco é convertido com:",
+    "code": "qemu-img convert -p -O vmdk -o subformat=streamOptimized \\\n    \"$source_path\" \\\n    \"$work_dir/<base_name>-disk<N>.vmdk\"",
+    "outro": "<code>streamOptimized</code> é o formato VMware legível numa única passagem, suportado pelo ESXi 6.7+, VMware Workstation, VirtualBox e pelo próprio Proxmox. É o subformato VMDK com maior compatibilidade e adequado à portabilidade. A desvantagem é não permitir acesso aleatório, pelo que não pode ser montado diretamente sem conversão."
+  },
+  "manifest": {
+    "heading": "Manifesto SHA1",
+    "intro": "Cada pacote inclui um ficheiro <code>.mf</code> com os hashes SHA1 do descritor OVF e de cada VMDK:",
+    "code": "SHA1(myvm-100-2026-04-26_18-30-15.ovf)= 3a7bd3e2360a3d29eea436fcfb7e44c735d117c9\nSHA1(myvm-100-2026-04-26_18-30-15-disk0.vmdk)= b7e23ec29af22b0b4e41da31e868d57226121c84\nSHA1(myvm-100-2026-04-26_18-30-15-disk1.vmdk)= a87ff679a2f3e71d9181a67b7542122c",
+    "outro": "É opcional na especificação OVF e muitos programas ignoram-no, mas permite verificar se o pacote foi transferido intacto. Verifique manualmente com <code>sha1sum -c file.mf</code>."
+  },
+  "import": {
+    "heading": "Importar o resultado",
+    "intro": "O pacote exportado pode ser importado em:",
+    "items": [
+      {
+        "href": "/docs/utils/import-vm",
+        "preRich": "<strong>Proxmox</strong> — use a ferramenta correspondente ",
+        "linkLabel": "Importar VM de OVA / OVF",
+        "tailRich": "."
+      },
+      {
+        "tailRich": "<strong>VMware ESXi</strong> — Datacenter → Deploy OVF Template; selecione o ficheiro .ova ou .ovf."
+      },
+      {
+        "tailRich": "<strong>VMware Workstation / Fusion</strong> — File → Open; selecione o ficheiro .ova ou .ovf."
+      },
+      {
+        "tailRich": "<strong>VirtualBox</strong> — File → Import Appliance; selecione o ficheiro .ova ou .ovf."
+      }
+    ]
+  },
+  "troubleshoot": {
+    "heading": "Resolução de Problemas",
+    "noSpaceTitle": "qemu-img convert falha durante a conversão com \"No space left on device\"",
+    "noSpaceBody": "O destino ficou sem espaço livre. O gestor de EXIT limpa automaticamente o diretório temporário. Escolha um destino com mais espaço livre (consulte a estimativa acima) e repita a exportação.",
+    "unsupportedHwTitle": "A exportação termina, mas o VMware recusa a importação: \"Unsupported hardware family\"",
+    "unsupportedHwBody": "Algumas versões do ESXi rejeitam descritores OVF que declaram uma família de hardware desconhecida. Abra o .ovf num editor de texto, ou extraia primeiro o .ova, procure <code>&lt;vssd:VirtualSystemType&gt;</code> e defina um valor aceite pelo ESXi, como <code>vmx-13</code> para ESXi 6.5+. Para contornar rapidamente o problema, experimente o VirtualBox, que é mais permissivo.",
+    "nicTitle": "A VM importada usa uma placa de rede ou um controlador SCSI diferente",
+    "nicBody": "O OVF conserva o número de placas de rede, mas não o modelo original. Reveja as definições de rede da VM importada no hipervisor de destino. A exportação declara um controlador SCSI lsilogic para compatibilidade com o VMware. Ao importar novamente no Proxmox com o ProxMenux, a VM é criada com um controlador LSI e placas e1000; mude depois para <code>VirtIO SCSI</code> e VirtIO se o sistema convidado tiver os controladores adequados.",
+    "runningTitle": "A VM estava em execução e recusei pará-la: exportação cancelada",
+    "runningBody": "O script não consegue produzir uma imagem consistente enquanto há escrita nos discos. Aceite o pedido de encerramento na próxima vez, ou desligue primeiro a VM manualmente (<code>qm shutdown $VMID</code>) e repita a exportação.",
+    "slowTitle": "A conversão do disco é lenta",
+    "slowBody": "<code>qemu-img convert</code> usa uma única thread e lê a origem à velocidade máxima. Para um disco de 100 GB num disco rígido mecânico, conte com 15–30 minutos. De NVMe para NVMe é 5–10 vezes mais rápido. Os discos de uma VM são convertidos em sequência; o tempo aumenta linearmente com o tamanho virtual total."
+  },
+  "related": {
+    "heading": "Relacionado",
+    "items": [
+      {
+        "href": "/docs/utils/import-vm",
+        "label": "Importar VM de OVA / OVF",
+        "tail": " — a ferramenta complementar para voltar a importar a VM."
+      },
+      {
+        "href": "/docs/utils",
+        "label": "Visão geral dos utilitários",
+        "tail": " — voltar ao panorama da secção."
+      }
+    ]
+  }
+}
diff --git a/web/messages/pt/docs/utils/import-vm.json b/web/messages/pt/docs/utils/import-vm.json
new file mode 100644
index 00000000..f6af45ce
--- /dev/null
+++ b/web/messages/pt/docs/utils/import-vm.json
@@ -0,0 +1,218 @@
+{
+  "meta": {
+    "title": "Importar VM de OVA / OVF | Documentação ProxMenux",
+    "description": "Importe uma VM VMware ESXi / Workstation / Fusion / VirtualBox / ProxMenux no Proxmox VE. Extrai OVA automaticamente, analisa metadados OVF, cria a VM e importa cada disco no formato nativo do armazenamento (qcow2 / raw).",
+    "ogTitle": "Importar VM de OVA / OVF | Documentação ProxMenux",
+    "ogDescription": "Importe no Proxmox VMs exportadas do VMware, VirtualBox ou ProxMenux. Os discos são convertidos automaticamente para o formato nativo do armazenamento."
+  },
+  "header": {
+    "title": "Importar VM de OVA / OVF",
+    "description": "Importa um pacote OVA / OVF no Proxmox VE: extrai arquivos OVA, lê no descritor OVF o número de vCPUs, memória, placas de rede e referências dos discos, cria a VM e importa cada disco com qm importdisk para o armazenamento escolhido. Compatível com exportações VMware (ESXi / Workstation / Fusion), VirtualBox e ProxMenux.",
+    "section": "Utilitários"
+  },
+  "intro": {
+    "title": "O que isto faz",
+    "body": "Cria uma VM completa no Proxmox a partir de um pacote portátil. Após a importação, está pronta para arrancar; recomendam-se verificações e ajustes do modelo de placa de rede, firmware e tipo de sistema para desempenho e compatibilidade."
+  },
+  "picker": {
+    "heading": "Selector de ficheiros",
+    "intro": "No lançamento, o script oferece dois diretórios predefinidos ou um caminho manual:",
+    "items": [
+      "<code>/var/lib/vz/dump</code> — o diretório de backup padrão do Proxmox vzdump.",
+      "<code>/var/lib/vz/template/iso</code> — útil se transferiu o OVA para aí por sftp.",
+      "Caminho manual — para arquivos OVA / OVF em qualquer outro lugar no host."
+    ],
+    "outro": "Ele então lista todos os arquivos <code>.ova</code> e <code>.ovf</code> no diretório escolhido.",
+    "imageAlt": "Janela de seleção do ficheiro da VM a importar"
+  },
+  "flow": {
+    "heading": "Como funciona a importação",
+    "nodes": [
+      {
+        "label": "Entrada OVA / OVF",
+        "detail": ".ova → tar xf para\n /tmp/.proxmenux-import-*\n.ovf → usar no local",
+        "variant": "source"
+      },
+      {
+        "label": "Processar + diálogos",
+        "detail": "AWK lê OVF\n(nome, vCPU, RAM, NICs,\ndiscos). Escolha de\nVMID / armazenamento / bridge",
+        "variant": "bridge"
+      },
+      {
+        "label": "qm create + importdisk",
+        "detail": "qm create $VMID\nqm importdisk\n(VMDK → formato do armazenamento)\nqm set --scsiN",
+        "variant": "target"
+      }
+    ]
+  },
+  "ovf": {
+    "heading": "Processamento OVF",
+    "intro": "Um analisador <strong>gawk</strong> lê o descritor OVF e retira os metadados VM. O analisador usa a forma de 3-argumento do <code>match()</code> que é específica do gawk (mawk — o <code>awk</code> padrão no Debian / Proxmox — não o suporta). Na primeira importação, o script auto-instala gawk através do par canônico <code>ensure_repositories</code> + <code>install_single_package</code> se estiver faltando; as importações subsequentes começam instantaneamente. Campos extraídos:",
+    "headerField": "Campo",
+    "headerSource": "Fonte em OVF",
+    "headerDefault": "Predefinição se faltar",
+    "rows": [
+      {
+        "field": "Nome VM",
+        "source": "<Name> (primeira correspondência)",
+        "default": "imported-vm"
+      },
+      {
+        "field": "Contagem de vCPU",
+        "source": "RASD ResourceType 3 → VirtualQuantity",
+        "default": "1"
+      },
+      {
+        "field": "Memória (MiB)",
+        "source": "RASD ResourceType 4 → VirtualQuantity",
+        "default": "1024"
+      },
+      {
+        "field": "Contagem NIC",
+        "source": "contagem de ResourceType 10",
+        "default": "1"
+      },
+      {
+        "field": "Tipo de sistema operacional",
+        "source": "/Linux/ ou /Windows/ na descrição",
+        "default": "other"
+      },
+      {
+        "field": "Referências do disco",
+        "source": "atributos href terminando em .vmdk / .qcow2 / .img / .raw",
+        "default": "nenhum (importação aborta)"
+      }
+    ]
+  },
+  "memWarn": {
+    "title": "Ambiguidade da unidade de memória",
+    "body": "O analisador converte as unidades de memória reconhecidas para <strong>MiB</strong>, incluindo bytes, KiB, MiB, GiB e as etiquetas de texto suportadas. As unidades em falta ou desconhecidas são <em>tratadas como MiB</em>. Após importar, compare <code>qm config $VMID | grep memory</code> com a RAM documentada da VM de origem e, se necessário, corrija com <code>qm set $VMID --memory &lt;MiB&gt;</code>."
+  },
+  "dialog": {
+    "heading": "Fluxo de diálogo de importação",
+    "items": [
+      "<strong>VMID</strong> — propõe o próximo identificador disponível (<code>pvesh get /cluster/nextid</code>).",
+      "<strong>Nome da VM</strong> — usa o nome lido no OVF; pode alterá-lo.",
+      "<strong>Armazenamento de destino</strong> — lista dos armazenamentos com conteúdo <code>images</code>, obtida por <code>pvesm status -content images</code>.",
+      "<strong> Ponte de rede</strong> — menu de pontes (de <code>ip link show type bridge</code>); escolhe automaticamente se existir apenas um; o padrão é <code>vmbr0</code>.",
+      "<strong>Confirmação</strong> — diálogo sumário com VMID, nome, vCPU, memória, NICs, armazenamento, ponte e a lista de discos a serem importados. Cancelar aqui = nada muda."
+    ]
+  },
+  "create": {
+    "heading": "Criação de VM",
+    "intro": "Após a confirmação, o script é executado:",
+    "code": "qm create $VMID \\\n    --name \"$NAME\" \\\n    --memory $MEMORY \\\n    --cores $VCPU \\\n    --ostype $OSTYPE \\\n    --scsihw lsi \\\n    --net0 e1000,bridge=$BRIDGE\n\n# For each additional NIC:\nqm set $VMID --netN e1000,bridge=$BRIDGE",
+    "outro": "Controlador SCSI padrão para <code>lsi</code> (LSI Logic) para compatibilidade VMDK. NICs padrão para <code>e1000</code> (compatibilidade universal) na ponte escolhida."
+  },
+  "diskLoop": {
+    "heading": "Loop de importação de disco",
+    "intro": "Para cada referência de disco no OVF:",
+    "items": [
+      "<code>qm importdisk $VMID $disk_path $STORAGE</code> — importa o disco num formato suportado pelo armazenamento de destino e cria uma entrada <code>unusedN:</code> na configuração da VM.",
+      "O script procura com grep na configuração a referência <code>unusedN</code> acabada de criar.",
+      "<code>qm set $VMID --scsiN $unused_disk</code> — liga o disco como <code>scsi0</code>, <code>scsi1</code>, ...",
+      "<code>qm set $VMID --delete unusedN</code> — elimina o marcador unused que deixou de ser necessário."
+    ],
+    "outro": "A inicialização é definida para o primeiro disco SCSI: <code>qm set $VMID --boot c --bootdisk scsi0</code>."
+  },
+  "postImport": {
+    "heading": "Ajustes recomendados após a importação",
+    "intro": "A importação usa configurações amplamente compatíveis para favorecer o arranque à primeira tentativa. Depois de confirmar o arranque, escolha configurações mais eficientes pela interface Proxmox ou CLI:",
+    "headerSetting": "Configuração",
+    "headerDefault": "Predefinição após a importação",
+    "headerRecommended": "Recomendado se suportado pelo sistema convidado",
+    "rows": [
+      {
+        "setting": "Modelo NIC",
+        "default": "e1000",
+        "recommended": "VirtIO (muito mais rápido, exige controlador no sistema convidado)"
+      },
+      {
+        "setting": "Controlador SCSI",
+        "default": "LSI",
+        "recommended": "VirtIO SCSI single (Linux recente ou Windows com controladores VirtIO)"
+      },
+      {
+        "setting": "Firmware (BIOS / UEFI)",
+        "default": "Por omissão do Proxmox (BIOS)",
+        "recommended": "Use o firmware da VM de origem; uma escolha incorreta impede o arranque"
+      },
+      {
+        "setting": "Agente convidado QEMU",
+        "default": "Desligado",
+        "recommendedRich": "Ativar e instalar <code>qemu-guest-agent</code> no sistema convidado (melhores cópias de segurança e indicação dos IPs)"
+      },
+      {
+        "setting": "Tipo de sistema operacional",
+        "default": "l26 / win10 / other (heurística)",
+        "recommended": "Verifique contra o sistema operacional convidado real"
+      },
+      {
+        "setting": "Visualização",
+        "default": "Padrão",
+        "recommended": "VirtIO-GPU ou SPICE (melhor desempenho da consola)"
+      }
+    ]
+  },
+  "fwWarn": {
+    "title": "Firmware mismatch = nenhuma inicialização",
+    "body": "Se a VM de origem usava UEFI mas o Proxmox a cria com BIOS, ou vice-versa, o sistema convidado não encontra um disco de arranque. Verifique <em>FirmwareType / firmware</em> no OVF ou nas configurações originais e use a mesma escolha no Proxmox: <code>qm set $VMID --bios ovmf</code> para UEFI; o valor predefinido para BIOS é <code>seabios</code>."
+  },
+  "notImported": {
+    "heading": "O QUE NÃO É IMPORTADO",
+    "items": [
+      "<strong>Bridges de rede específicas</strong> — apenas o número de placas é preservado. Todas usam a bridge escolhida na importação.",
+      "<strong>Modelo da placa de rede</strong> — usa e1000 por predefinição.",
+      "<strong>Tipo de firmware BIOS / UEFI</strong> — usa a predefinição Proxmox, BIOS.",
+      "<strong>Configuração de passthrough PCI</strong>.",
+      "<strong>TPM</strong> (vTPM).",
+      "Unidades <strong>cloud-init</strong>.",
+      "<strong>Snapshots</strong> — apenas o estado atual.",
+      "<strong>USB / serial / dispositivos paralelos</strong> declarados no OVF.",
+      "Opções de <strong>etiquetas / notas / arranque automático da VM</strong>."
+    ]
+  },
+  "troubleshoot": {
+    "heading": "Resolução de Problemas",
+    "orphanTitle": "A VM foi criada mas a importação dos discos falhou: ficou uma VM parcial",
+    "orphanIntro": "Quando a importação falha, o script propõe remover a VM parcial e os discos importados. Se recusou ou a eliminação automática falhou, inspecione a VM e remova-a manualmente com:",
+    "orphanCode": "qm destroy $VMID --destroy-unreferenced-disks 1",
+    "orphanOutro": "Em seguida, corrija a causa subjacente (provavelmente espaço em disco no armazenamento alvo) e re-importação.",
+    "memTitle": "VM importado tem 8 MB de RAM (ou 8 TB)",
+    "memIntro": "O analisador converte as AllocationUnits reconhecidas para MiB. Unidades em falta ou desconhecidas são tratadas como MiB. Inspecione o OVF e compare a memória importada com a VM de origem. Corrija se necessário:",
+    "memCode": "qm set $VMID --memory 8192    # 8 GiB",
+    "bootTitle": "A VM importada não arranca: \"No bootable device\"",
+    "bootIntro": "Uma causa frequente é uma diferença BIOS / UEFI. A VM usava UEFI, mas o Proxmox criou-a com BIOS. Configure o firmware correspondente:",
+    "bootCode": "qm set $VMID --bios ovmf       # UEFI\n# also add an EFI disk for the EFI vars:\nqm set $VMID --efidisk0 $STORAGE:1,format=qcow2,efitype=4m,pre-enrolled-keys=1",
+    "bootOutro": "Outra causa frequente: a ordem de arranque aponta para scsi0, mas o disco do sistema é scsi1. Altere a ordem no separador Opções da VM.",
+    "bsodTitle": "Uma VM Windows exportada do VMware apresenta um ecrã azul no primeiro arranque",
+    "bsodBody": "O Windows é sensível a mudanças do controlador de disco. Instale os controladores VirtIO <em>antes</em> de exportar do VMware, ou mantenha o controlador <code>lsi</code> predefinido. Mude para VirtIO SCSI só depois de arrancar o sistema convidado e instalar os controladores VirtIO no Windows.",
+    "zeroTitle": "O analisador OVF indica 0 discos",
+    "zeroBody": "O OVF pode usar referências de disco que o analisador não reconhece. Abra-o e procure uma entrada <code>&lt;File ovf:href=\"...vmdk\" ...&gt;</code> para cada disco. Se o disco for realmente VMDK mas tiver uma extensão invulgar como <code>.dat</code>, mude-a para <code>.vmdk</code> e atualize a referência OVF. Mudar o nome não converte o formato.",
+    "awkTitle": "awk: erro de sintaxe em ou próximo , — o analisador falha em cada OVA / OVF",
+    "awkIntro": "O analisador OVF usa a sintaxe gawk de <code>match()</code> com três argumentos, não suportada pelo mawk, o <code>awk</code> predefinido no Debian / Proxmox. As versões recentes instalam gawk no primeiro uso por <code>ensure_repositories</code> + <code>install_single_package</code>. Se usa uma cópia antiga, instale-o manualmente:",
+    "awkCode": "apt-get install -y gawk",
+    "awkOutro": "Depois repita a importação.",
+    "netTitle": "A rede não funciona após a primeira inicialização",
+    "netBody": "O sistema convidado pode não ter controladores para o modelo e1000, ou a bridge escolhida pode estar errada. No separador Hardware da VM, altere Network Device → Model. Verifique também <code>ip a</code> no sistema convidado: a interface pode chamar-se ens18 em vez de eth0, enquanto a configuração de rede ainda usa o nome antigo."
+  },
+  "files": {
+    "heading": "Ficheiros envolvidos",
+    "code": "scripts/utilities/import_vm_ova_ovf.sh       # this script\n/tmp/.proxmenux-import-*/                    # temp extraction dir for OVA\n/etc/pve/nodes/<node>/qemu-server/<vmid>.conf  # created by qm create\n<storage>/<vmid>/<vmid>-disk-<n>.<fmt>        # disk images, format depends on storage"
+  },
+  "related": {
+    "heading": "Relacionado",
+    "items": [
+      {
+        "href": "/docs/utils/export-vm",
+        "label": "Exportar VM para OVA / OVF",
+        "tail": " — a ferramenta complementar para exportar a VM."
+      },
+      {
+        "href": "/docs/utils",
+        "label": "Visão geral dos utilitários",
+        "tail": " — voltar ao panorama da secção."
+      }
+    ]
+  }
+}
diff --git a/web/messages/pt/docs/utils/index.json b/web/messages/pt/docs/utils/index.json
new file mode 100644
index 00000000..ecafb09e
--- /dev/null
+++ b/web/messages/pt/docs/utils/index.json
@@ -0,0 +1,115 @@
+{
+  "meta": {
+    "title": "Utilitários Proxmox — UUP Dump, atualização de PVE 8 para 9, exportação/importação OVA | ProxMenux",
+    "description": "Utilitários do dia a dia para Proxmox VE: criar ISOs do Windows com o UUP Dump, instalar uma seleção de ferramentas CLI, atualizar o sistema Proxmox com segurança, passar do PVE 8 para o PVE 9, exportar VMs para OVA / OVF e importar VMs OVA / OVF do VMware ou VirtualBox.",
+    "ogTitle": "Utilitários Proxmox — UUP Dump, atualização de PVE 8 para 9, exportação/importação OVA",
+    "ogDescription": "Crie ISOs do Windows, instale ferramentas CLI, execute uma atualização segura, passe do PVE 8 para o PVE 9 e exporte ou importe VMs OVA / OVF.",
+    "twitterTitle": "Utilitários Proxmox | ProxMenux",
+    "twitterDescription": "Criação de ISOs, ferramentas CLI, atualização do Proxmox, passagem PVE 8→9 e portabilidade de VMs OVA / OVF."
+  },
+  "header": {
+    "title": "Utilitários e Ferramentas",
+    "description": "Seis ferramentas complementam as tarefas diárias no Proxmox VE: criação de ISOs, manutenção do sistema e portabilidade de VMs. Cada opção é independente: escolha a que precisa; nada é instalado sem que o solicite.",
+    "section": "Utilitários"
+  },
+  "intro": {
+    "title": "Para que serve este menu",
+    "body": "Três grupos de ferramentas independentes, mas frequentemente necessárias: <strong>criar uma ISO do Windows</strong> com o UUP Dump, <strong>manter o host Proxmox</strong> (utilitários CLI, atualizações e passagem de versão principal) e <strong>importar e exportar VMs</strong> no Proxmox através do formato padrão OVA / OVF."
+  },
+  "opening": {
+    "heading": "Abrir o menu",
+    "body": "No menu principal do ProxMenux, selecione <strong>Utilities</strong>. Você verá isto:",
+    "imageAlt": "Menu de utilitários com UUP Dump, utilitários de sistema, atualização, passagem de versão, exportação e importação"
+  },
+  "groups": {
+    "heading": "Três grupos de ferramentas",
+    "intro": "As seis ferramentas estão divididas em três grupos independentes. Clique num cartão abaixo para ir para a secção correspondente.",
+    "iso": {
+      "title": "Criação ISO",
+      "body": "Crie ISOs oficiais do Windows do UUP Dump no próprio host Proxmox.",
+      "bullets": [
+        "Link partilhado do UUP Dump → ISO de arranque",
+        "Dependências instaladas automaticamente",
+        "O resultado é guardado no diretório de modelos ISO do Proxmox"
+      ]
+    },
+    "maintenance": {
+      "title": "Manutenção do sistema",
+      "body": "Mantenha o host saudável: ferramentas CLI, atualizações regulares e atualização de versão principal quando chegar a hora.",
+      "bullets": [
+        "Instalador de utilitários de sistema (25 ferramentas CLI)",
+        "Atualização do Sistema Proxmox (apt + dist-upgrade)",
+        "Atualização de versão principal PVE 8 → PVE 9"
+      ]
+    },
+    "portability": {
+      "title": "Portabilidade VM",
+      "body": "Mover VMs para dentro e para fora do Proxmox usando o formato padrão OVA / OVF.",
+      "bullets": [
+        "Exportação Proxmox VM → OVA / OVF",
+        "Importar OVA / OVF → Proxmox VM",
+        "Compatível com VMware e VirtualBox"
+      ]
+    }
+  },
+  "upgradeWarn": {
+    "title": "A atualização PVE 8 → 9 é destrutiva e não reversível",
+    "body": "Uma atualização de versão principal substitui no local a base Debian (Bookworm → Trixie) e os componentes Proxmox. Não existe um caminho de reversão: antes de começar, precisa de <strong>cópias de segurança verificadas</strong> de cada VM e CT e de <strong>acesso por consola / IPMI / iKVM</strong>. Por isso, a ferramenta recusa a execução no terminal web do Proxmox."
+  },
+  "isoSection": {
+    "heading": "Criação ISO",
+    "body": "Crie uma nova ISO de instalação do Windows atualizada diretamente no host Proxmox. O script automatiza todo o processo UUP Dump: instalação de dependências (aria2c, cabextract, wimlib-imagex, …), transferência paralela dos ficheiros de atualização com aria2 e conversão numa única ISO de arranque. A ISO é guardada em <code>/var/lib/vz/template/iso</code>, pronta para associar a uma VM.",
+    "options": [
+      {
+        "title": "Criador de ISO do UUP Dump",
+        "description": "Crie uma ISO de instalação do Windows atualizada a partir de um link partilhado do UUP Dump. As dependências, a transferência e a conversão são totalmente automatizadas; a ISO resultante é guardada em /var/lib/vz/template/iso, pronta para criar uma VM.",
+        "href": "/docs/utils/UUp-Dump-ISO-Creator"
+      }
+    ]
+  },
+  "maintenanceSection": {
+    "heading": "Manutenção do sistema",
+    "body": "Três ferramentas cobrem as tarefas diárias e ocasionais no host. O <strong>Instalador de utilitários de sistema</strong> configura as ferramentas CLI úteis após uma nova instalação. A <strong>Atualização do sistema Proxmox</strong> trata da manutenção semanal ou mensal. A <strong>Atualização do PVE 8 para o PVE 9</strong> é a grande mudança de cada ciclo de versão principal, com verificações de segurança adicionais por não ser reversível.",
+    "options": [
+      {
+        "title": "Instalador de utilitários de sistema",
+        "description": "Seletor de 25 ferramentas CLI escolhidas (htop, btop, iperf3, tmux, ...) com seleção personalizada ou grupos predefinidos (básico, desenvolvimento, compressão, multiplexadores, análise e rede). Usa o fluxo padrão com repositório e comando de verificação.",
+        "href": "/docs/utils/system-utils"
+      },
+      {
+        "title": "Atualização do sistema Proxmox",
+        "description": "Verificação dos repositórios + apt update + apt dist-upgrade, com confirmação antes de reiniciar. Deteta a versão principal do PVE (8 ou 9), mantém os repositórios configurados e pede confirmação antes de mudar um host sem subscrição para o repositório no-subscription; depois executa autoremove.",
+        "href": "/docs/utils/system-update"
+      },
+      {
+        "title": "Atualize PVE 8 para PVE 9",
+        "description": "Atualização de versão principal (Debian Bookworm → Trixie + PVE 8 → 9). Verificações prévias, migração dos repositórios, modo automatizado ou interativo, validação final e reinício. Recusa a execução no terminal web.",
+        "href": "/docs/utils/upgrade-pve8-pve9"
+      }
+    ]
+  },
+  "portabilitySection": {
+    "heading": "Portabilidade VM (OVA / OVF)",
+    "body": "OVA e OVF são formatos de empacotamento entre hipervisores definidos pelo padrão DMTF e suportados pelo VMware, VirtualBox e Proxmox. As duas ferramentas permitem exportar e voltar a importar: uma VM exportada do Proxmox pode ser importada novamente, e vice-versa. Use-as para migrar cargas de trabalho do ESXi, criar uma cópia de segurança portátil de uma VM ou partilhar uma VM preparada com alguém que usa VirtualBox.",
+    "options": [
+      {
+        "title": "Exportar VM para OVA / OVF",
+        "description": "Converta uma VM Proxmox num arquivo OVA portátil ou num diretório OVF. Esquema padrão DMTF, manifesto SHA1 e discos VMDK no formato streamOptimized. Importável no VMware (ESXi / Workstation / Fusion), VirtualBox e novamente no Proxmox.",
+        "href": "/docs/utils/export-vm"
+      },
+      {
+        "title": "Importar VM de OVA / OVF",
+        "description": "Importe no Proxmox uma exportação do VMware / VirtualBox / ProxMenux. A ferramenta extrai automaticamente o OVA, analisa os metadados OVF, cria a VM e importa cada disco no formato nativo do armazenamento.",
+        "href": "/docs/utils/import-vm"
+      }
+    ]
+  },
+  "diskSpaceCallout": {
+    "title": "Nota sobre o espaço em disco para exportação / importação",
+    "body": "As duas ferramentas convertem formatos de disco: a exportação usa <code>qemu-img convert -O vmdk -o subformat=streamOptimized</code>; a importação usa <code>qm importdisk</code> para voltar ao formato nativo do armazenamento (qcow2 / raw). Para exportar, reserve <strong>~120% do tamanho virtual do disco</strong> para OVF e <strong>~220%</strong> para OVA. O arquivo OVA usa TAR sem compressão e é criado enquanto os ficheiros VMDK temporários ainda existem. Verifique se o diretório de destino tem espaço livre suficiente antes de começar."
+  },
+  "fitsTogether": {
+    "heading": "Como o menu se encaixa",
+    "body": "Cada ferramenta tem um script dedicado em <code>scripts/utilities/</code>. A atualização do sistema Proxmox chama um único script seguro em <code>scripts/global/</code>, update-pve-safe.sh, que deteta a versão principal e trata do PVE 8 e do PVE 9. A atualização PVE 8 → 9 oferece duas ações adicionais no seu próprio menu: uma <em>Verificação prévia à atualização</em> independente (executa <code>pve8to9 --full</code>) e um <em>Guia de atualização manual</em> só de leitura (procedimento de 17 passos), para quem quer inspecionar o processo ou executá-lo manualmente."
+  }
+}
diff --git a/web/messages/pt/docs/utils/system-update.json b/web/messages/pt/docs/utils/system-update.json
new file mode 100644
index 00000000..a311a1ca
--- /dev/null
+++ b/web/messages/pt/docs/utils/system-update.json
@@ -0,0 +1,168 @@
+{
+  "meta": {
+    "title": "Atualização do sistema Proxmox | Documentação ProxMenux",
+    "description": "Atualiza os pacotes dentro da versão principal atual do Proxmox com apt-get update e apt full-upgrade -y. Verifica o espaço em disco e os repositórios configurados, tenta recuperar chaves GPG, verifica e repara cabeçalhos PV LVM antigos, recompila os controladores DKMS geridos quando necessário, executa autoremove/autoclean e propõe reiniciar quando é preciso.",
+    "ogTitle": "Atualização do sistema Proxmox | Documentação ProxMenux",
+    "ogDescription": "apt full-upgrade com verificação de repositórios, autoremove/autoclean e pedido de reinício quando necessário."
+  },
+  "header": {
+    "title": "Atualização do sistema Proxmox",
+    "description": "Chama um único script de execução (<code>update-pve-safe.sh</code>) que deteta a versão principal do Proxmox. Os repositórios são lidos através da API Proxmox e preservados; um host sem subscrição que use apenas Enterprise tem de confirmar a mudança para no-subscription. O script atualiza pacotes e recompila os controladores DKMS geridos pelo ProxMenux para um kernel preparado para o próximo arranque. O script principal propõe reiniciar se existir o marcador de sistema ou se o kernel instalado mais recente diferir do que está em execução. Também pode ser iniciado em <em>Update Now</em>, no cabeçalho do ProxMenux Monitor, quando há atualizações pendentes.",
+    "section": "Utilitários"
+  },
+  "calloutWhat": {
+    "title": "O que isto faz",
+    "body": "Leva o host para o nível de patch mais recente de sua versão principal atual. <strong>não</strong> atualiza entre versões principais — para PVE 8 → PVE 9 consulte <link>Atualizar PVE 8 para PVE 9</link>."
+  },
+  "official": {
+    "heading": "A recomendação oficial da Proxmox",
+    "intro": "A própria orientação de atualização do Proxmox para um host em execução (na mesma versão principal) deve ser executada:",
+    "code": "apt update && apt full-upgrade -y",
+    "outro": "Esta linha é o comando oficial nas versões atuais do Proxmox. É igualmente necessário garantir que os repositórios estão corretos, que os adequados estão ativos e que o host fica num estado coerente após a atualização."
+  },
+  "onTop": {
+    "heading": "O que o ProxMenux acrescenta: verificado no script",
+    "intro": "Usa <strong>a mesma operação apt full-upgrade</strong>, com verificação dos repositórios, recompilação DKMS e limpeza final. Os passos seguintes correspondem a <code>scripts/utilities/proxmox_update.sh</code> e ao seu único script de execução <code>scripts/global/update-pve-safe.sh</code>:",
+    "items": [
+      "<strong>Deteta a versão principal do PVE</strong> no script de execução (<code>pveversion | grep -oP ''pve-manager/\\K[0-9]+''</code>). Um único script trata do PVE 8 e do PVE 9; os repositórios são preservados, salvo se um host sem subscrição aceitar a mudança proposta.",
+      "<strong>Mantém os repositórios configurados.</strong> <code>ensure_repositories</code> lê os repositórios e o estado da subscrição através da API Proxmox. Com uma subscrição ativa ou um repositório no-subscription ou test já utilizado, nada muda. Um host sem subscrição ativa que use apenas Enterprise tem de confirmar a mudança para no-subscription. Se recusar, a atualização termina sem alterar as fontes.",
+      "<strong>Executa a atualização sem interação</strong> com <code>DEBIAN_FRONTEND=noninteractive</code> e <code>--force-confdef --force-confold</code>. Para decisões sobre ficheiros de configuração dpkg, aceita a ação predefinida quando existe; caso contrário, mantém o ficheiro atual.",
+      "<strong>Não impõe utilitários opcionais.</strong> O script não força a instalação de <code>zfsutils-linux</code>, <code>chrony</code>, <code>ifupdown2</code> ou pacotes semelhantes. Se a instalação Proxmox optou por dispensar algum deles, essa escolha mantém-se. Os pacotes em falta são indicados nos processos de instalação superiores, não na atualização.",
+      "<strong>Verificação e reparação de metadados LVM.</strong> Deteta cabeçalhos PV antigos e executa vgck --updatemetadata e vgchange -ay nos grupos de volumes afetados. Pode alterar metadados LVM; não é uma verificação que apenas emite avisos.",
+      "<strong>Limpa depois:</strong> <code>apt-get autoremove -y</code> + <code>apt-get autoclean -y</code>.",
+      "<strong>Recompilação DKMS antes do pedido de reinício.</strong> O script de execução chama <code>pmx_rebuild_dkms_after_kernel</code> quando está preparado um kernel instalado mais recente. O script principal verifica <code>/var/run/reboot-required</code> e usa <code>dpkg-query</code> para comparar o kernel indicado por <code>uname -r</code> com o pacote <code>proxmox-kernel-*-pve-signed</code> / <code>pve-kernel-*-pve</code> instalado mais recente. O marcador pode não existir em hosts sem <code>needrestart</code>; a comparação dos kernels continua a funcionar."
+    ]
+  },
+  "calloutOneSentence": {
+    "title": "Em uma frase",
+    "body": "Atualiza os pacotes do host, preserva os repositórios salvo uma mudança aceite, verifica os metadados LVM, recompila os controladores DKMS geridos, limpa com autoremove/autoclean e propõe reiniciar quando necessário."
+  },
+  "confirm": {
+    "heading": "Janela de confirmação",
+    "intro": "A seleção da opção abre um resumo das ações previstas e exige uma confirmação explícita:",
+    "imageAlt": "Janela de confirmação da atualização Proxmox com verificação dos repositórios, atualização dos pacotes e limpeza"
+  },
+  "routes": {
+    "heading": "Como o script principal delega a execução",
+    "nodes": {
+      "source": {
+        "label": "proxmox_update.sh",
+        "detail": "pveversion |\ngrep -oP ''pve-manager/\\K[0-9]+''"
+      },
+      "bridge": {
+        "label": "Um único script de execução",
+        "detail": "update-pve-safe.sh\n(detecta PVE 8 / 9\ninternamente)"
+      },
+      "target": {
+        "label": "Após a atualização",
+        "detail": "apt-get autoremove\napt-get autoclean\nPedido de reinício se necessário"
+      }
+    }
+  },
+  "worker": {
+    "heading": "O que faz o script de execução",
+    "intro": "Um único script (<code>scripts/global/update-pve-safe.sh</code>) trata do PVE 8 (<code>bookworm</code>) e do PVE 9 (<code>trixie</code>). Deteta a versão principal e verifica os repositórios existentes sem reescrever as fontes base do Debian. As etapas são:",
+    "items": [
+      "<strong>Verificações prévias.</strong> Verifica se há pelo menos ~1 GB livre em <code>/var/cache/apt/archives</code>. Caso contrário, termina de imediato com uma mensagem clara para evitar falhar a meio de uma operação apt.",
+      "<strong>Verificação dos repositórios.</strong> <code>ensure_repositories</code> lê os repositórios e o estado da subscrição. Com um repositório Proxmox utilizável, nada muda. Num host sem subscrição ativa que use apenas Enterprise, pede confirmação antes de passar a no-subscription e interrompe a atualização em caso de recusa.",
+      "<strong>apt update com recuperação automática GPG.</strong> Perante <code>NO_PUBKEY</code> num repositório, incluindo de terceiros, o script importa a chave em falta e tenta novamente antes de apresentar uma falha.",
+      "<strong>Atualizações pendentes e de segurança.</strong> Indica quantos pacotes vão mudar e quantos provêm da suite de segurança, para apresentar números concretos na janela de confirmação.",
+      "<strong>Janela de confirmação.</strong> Depois de atualizar as listas de pacotes, o script exige um sim explícito antes de atualizar os pacotes.",
+      "<strong>apt full-upgrade.</strong> Usa <code>DEBIAN_FRONTEND=noninteractive</code> e <code>--force-confdef --force-confold</code>. O dpkg segue a ação predefinida para os ficheiros de configuração quando existe; caso contrário, conserva o ficheiro atual.",
+      "<strong>Verificação LVM.</strong> <code>lvm_repair_check</code> atualiza os metadados dos grupos de volumes quando discos atribuídos diretamente a VMs convidadas (DSM, TrueNAS ou appliances de armazenamento) regressam com cabeçalhos PV antigos.",
+      "<strong>Recompilação DKMS dos controladores geridos pelo ProxMenux.</strong> Quando há um kernel novo preparado, <code>pmx_rebuild_dkms_after_kernel</code> lê os controladores instalados pelo ProxMenux em <code>components_status.json</code> (atualmente <code>nvidia_driver</code> → módulo <code>nvidia</code> e <code>coral_driver</code> → módulo <code>gasket</code>), instala os cabeçalhos correspondentes (<code>proxmox-headers-&lt;newkver&gt;</code> quando disponível; caso contrário, <code>pve-headers-&lt;newkver&gt;</code>) e executa <code>dkms autoinstall -k &lt;newkver&gt;</code>. Se <code>dkms status</code> não mostrar os módulos compilados para o novo kernel, volta a executar cada instalador com <code>--auto-reinstall</code>. As falhas são registadas sem interromper a atualização, que chega na mesma ao pedido de reinício.",
+      "<strong>Limpeza final.</strong> <code>apt-get autoremove</code> + <code>apt-get autoclean</code> antes de devolver o controlo ao script principal."
+    ]
+  },
+  "post": {
+    "heading": "Limpeza e reinício após a atualização",
+    "intro": "Quando o script de execução termina, o script principal executa:",
+    "code": "apt-get autoremove -y    # drop unused dependencies pulled in by old packages\napt-get autoclean        # drop downloaded .deb files no longer in the index",
+    "afterCode": "O script principal também verifica se é preciso reiniciar. Qualquer um destes sinais faz aparecer o pedido:",
+    "items": [
+      "Existe <code>/var/run/reboot-required</code>: um pacote ou uma ferramenta do sistema marcou a necessidade de reiniciar o host.",
+      "O pacote de kernel Proxmox instalado mais recente difere do kernel em execução, segundo <code>dpkg-query</code> e uname -r."
+    ],
+    "outro": "Se alguma condição for verdadeira, uma janela whiptail pergunta <em>«Algumas alterações exigem um reinício. Pretende reiniciar agora?»</em>. Recuse para continuar com o kernel atual até reiniciar manualmente, por exemplo numa janela de manutenção planeada."
+  },
+  "end": {
+    "heading": "O que vês no fim",
+    "intro": "Quando o script de execução termina, o terminal apresenta o resultado da limpeza e, se necessário, o pedido de reinício:",
+    "imageAlt": "Resumo de conclusão da atualização do sistema Proxmox com saída de limpeza e prompt de reinicialização"
+  },
+  "calloutDeclineReboot": {
+    "title": "Adie o reinício apenas por um motivo concreto",
+    "body": "Instalar um novo pacote <code>proxmox-kernel-*</code> não substitui o kernel em execução até reiniciar. O novo kernel e os módulos correspondentes ficam ativos no próximo arranque. Planeie o reinício para uma janela de manutenção adequada e reveja antes os avisos de compilação DKMS."
+  },
+  "noSub": {
+    "heading": "Como o script trata o repositório Enterprise",
+    "intro": "O Proxmox ativa o repositório Enterprise por predefinição. Sem subscrição ativa, esse repositório devolve 401 em <code>apt-get update</code>. O script só altera os repositórios nesse caso e após confirmação, através da API Proxmox usada por <em>Node → Updates → Repositories</em>. Estes são os casos possíveis:",
+    "items": [
+      "Com uma <strong>subscrição ativa</strong>, os repositórios mantêm-se e o Enterprise fornece as atualizações.",
+      "Com o <strong>repositório no-subscription ou test já ativo</strong>, os repositórios mantêm-se, independentemente de outras fontes configuradas.",
+      "<strong>Sem subscrição ativa e apenas com o repositório Enterprise</strong>, uma janela propõe a mudança. Aceitar desativa Enterprise, ativa no-subscription e atualiza as listas de pacotes. A mudança é registada na vista <em>Changes</em> de Audit & Report. Recusar termina a atualização sem alterar as fontes.",
+      "As <strong>fontes Ceph Enterprise</strong> existentes são desativadas na mesma mudança, sem escolher outro canal Ceph. Um host que use Ceph configura o respetivo canal separadamente.",
+      "Se <strong>não houver um terminal para pedir confirmação</strong>, nenhuma fonte é alterada e a atualização termina com uma mensagem que remete para <em>Node → Updates → Repositories</em>."
+    ],
+    "outro": "As fontes Debian e todos os outros ficheiros de repositórios nunca são alterados por este processo. Uma entrada que misture Enterprise com outros componentes não é mudada: a atualização termina e pede para separar a entrada na vista de repositórios Proxmox."
+  },
+  "cluster": {
+    "heading": "Considerações para clusters",
+    "calloutTitle": "Em clusters: atualizar um nó de cada vez",
+    "calloutBody": "Num cluster Proxmox, execute esta opção em <strong>um nó de cada vez</strong> e espere pelo fim do reinício antes de passar ao seguinte. Migre primeiro os sistemas convidados para fora do nó, para evitar interrupções de serviço no cluster. Versões secundárias diferentes, como 8.4.1 e 8.4.5, podem coexistir durante algumas horas; kernels em execução diferentes podem causar comportamentos inesperados em sistemas convidados geridos por HA."
+  },
+  "doesnt": {
+    "heading": "O que não faz",
+    "items": [
+      "<strong>Atualização de versão principal.</strong> A passagem 8 → 9 é uma operação separada; consulte <link>Atualizar do PVE 8 para o PVE 9</link>.",
+      "<strong>Backup.</strong> Sem instantâneos, sem retrocesso. As operações Apt não são transacionais. Combine com sua disciplina de backup normal (PBS, vzdump, ZFS instantâneos).",
+      "<strong>Atualizações de contentores / VMs.</strong> Só o host é atualizado; os sistemas convidados mantêm-se.",
+      "<strong>Gravação dedicada de firmware.</strong> Esta ferramenta não serve para gravar BIOS ou firmware de dispositivos. Os pacotes de firmware ou microcódigo CPU já instalados podem receber atualizações através de apt."
+    ]
+  },
+  "troubleshooting": {
+    "heading": "Resolução de Problemas",
+    "items": [
+      {
+        "title": "apt update falha com 401 Unauthorized",
+        "body": "O repositório Enterprise está ativo, mas o host não tem subscrição ativa. Antes de <code>apt-get update</code>, o script propõe passar a no-subscription. Se recusou, repita a atualização e aceite, ou desative Enterprise em <em>Node → Updates → Repositories</em> e ative no-subscription."
+      },
+      {
+        "title": "dist-upgrade trava em \"Configuring grub-pc\"",
+        "body": "Se aparecer uma pergunta interativa do GRUB, pede os dispositivos onde instalar o gestor de arranque. A opção <code>--force-confold</code> aplica-se aos ficheiros de configuração, não à escolha dos dispositivos. Use <kbd>Tab</kbd> + <kbd>Space</kbd> para selecionar os discos de arranque adequados e depois OK. Pode configurar esta escolha antes com <code>dpkg-reconfigure grub-pc</code>."
+      },
+      {
+        "title": "O Kernel atualizou, mas faltam os novos módulos para um driver fora da árvore",
+        "body": "Para os controladores geridos (<code>nvidia_driver</code> e <code>coral_driver</code>), a função executa <code>dkms autoinstall -k &lt;newkver&gt;</code> e pode repetir os instaladores com <code>--auto-reinstall</code>. Verifique o resultado com <code>dkms status</code>. O comando autoinstall também pode recompilar outros módulos DKMS registados; os instaladores alternativos limitam-se às entradas geridas de <code>components_status.json</code>. Inspecione os módulos de terceiros ainda em falta e recompile-os se necessário com <code>dkms autoinstall</code>."
+      },
+      {
+        "title": "O prompt de reinicialização não apareceu, mas tenho certeza que o kernel mudou",
+        "body": "Os sinais são alternativos: <code>/var/run/reboot-required</code> ou uma diferença entre o kernel em execução e o kernel Proxmox instalado mais recente. O script principal não analisa entradas linux-image no registo apt. Verifique a versão em execução com <code>uname -r</code> e os pacotes de kernel instalados com <code>dpkg-query</code>. Planeie o reinício necessário ou execute <code>shutdown -r now</code> quando estiver pronto."
+      }
+    ]
+  },
+  "files": {
+    "heading": "Ficheiros envolvidos",
+    "code": "scripts/utilities/proxmox_update.sh              # this script (wrapper)\nscripts/global/update-pve-safe.sh                # single safe worker (PVE 8 + PVE 9)\nscripts/global/repository-functions.sh           # ensure_repositories\nscripts/global/repository_policy.py              # reads and switches repositories through the Proxmox API\nscripts/global/utils-install-functions.sh        # pmx_rebuild_dkms_after_kernel\n/usr/local/share/proxmenux/components_status.json # ProxMenux-managed DKMS driver registry\n/etc/apt/sources.list.d/proxmox.sources          # no-subscription source, written by Proxmox when the switch is accepted\n/var/run/reboot-required                         # read to decide on reboot prompt\n# Reboot fallback when needrestart isn't installed:\n# dpkg-query -W 'proxmox-kernel-*-pve-signed' 'pve-kernel-*-pve' vs. uname -r"
+  },
+  "related": {
+    "heading": "Relacionado",
+    "items": [
+      {
+        "href": "/docs/utils/upgrade-pve8-pve9",
+        "label": "Atualize PVE 8 para PVE 9",
+        "tail": " — para a actualização da versão principal (ferramenta diferente, modelo de segurança diferente)."
+      },
+      {
+        "href": "/docs/utils/system-utils",
+        "label": "Instalador de utilitários de sistema",
+        "tail": " — para instalar ferramentas CLI úteis durante as atualizações (htop / btop / ncdu)."
+      },
+      {
+        "href": "/docs/utils",
+        "label": "Visão geral dos utilitários",
+        "tail": " — voltar ao panorama da secção."
+      }
+    ]
+  }
+}
diff --git a/web/messages/pt/docs/utils/system-utils.json b/web/messages/pt/docs/utils/system-utils.json
new file mode 100644
index 00000000..9390dc12
--- /dev/null
+++ b/web/messages/pt/docs/utils/system-utils.json
@@ -0,0 +1,252 @@
+{
+  "meta": {
+    "title": "Instalador de utilitários de sistema | Documentação ProxMenux",
+    "description": "Instalador de utilitários CLI para Proxmox VE, com 25 pacotes na lista de referência (htop, btop, iperf3, tmux, ...). Seleção personalizada, instalação completa e grupos predefinidos (básico, desenvolvimento, compressão, multiplexadores, análise e rede). Os grupos podem incluir pacotes adicionais. Usa ensure_repositories + install_single_package.",
+    "ogTitle": "Instalador de utilitários de sistema | Documentação ProxMenux",
+    "ogDescription": "Instale ferramentas CLI com curadoria em Proxmox VE com um clique ou seleção personalizada."
+  },
+  "header": {
+    "title": "Instalador de utilitários de sistema",
+    "description": "Seletor dos 25 utilitários CLI da lista de referência PROXMENUX_UTILS. Oferece seleção personalizada, instalação completa, seis grupos predefinidos e verificação das instalações. Os grupos podem incluir ferramentas fora da lista. Usa as funções partilhadas ensure_repositories() + install_single_package() para gerir repositórios e mensagens por pacote de forma coerente.",
+    "section": "Utilitários"
+  },
+  "info": {
+    "title": "O que isto faz",
+    "body": "Instala ferramentas CLI de uma lista de 25 pacotes. Todas as instalações seguem o mesmo processo: <code>ensure_repositories</code> verifica um repositório Proxmox utilizável para a versão principal de PVE em execução; depois <code>install_single_package</code> instala o pacote e verifica se o comando está em PATH."
+  },
+  "opening": {
+    "heading": "Abrir o instalador",
+    "intro": "No menu Utilities, escolha <strong>System Utilities Installer</strong>. O menu principal tem nove opções:",
+    "imageAlt": "Menu Instalador de Utilitários de Sistema com seleção personalizada, ALL, grupos predefinidos e verificar"
+  },
+  "actions": {
+    "heading": "As 9 ações do menu",
+    "headerOption": "Opção",
+    "headerBehaviour": "Comportamento",
+    "rows": [
+      {
+        "option": "1. Seleção personalizada",
+        "behaviourRich": "Lista de seleção dos 25 pacotes. Use SPACE para marcar e ENTER para confirmar; só os pacotes selecionados são instalados."
+      },
+      {
+        "option": "2. Instalar todos os utilitários",
+        "behaviourRich": "Instalação única de cada pacote em <code>PROXMENUX_UTILS</code>. Use após uma instalação nova do Proxmox."
+      },
+      {
+        "option": "3. Básico",
+        "behaviourRich": "<code>grc</code>, <code>htop</code>, <code>tree</code>, <code>curl</code>, <code>wget</code>"
+      },
+      {
+        "option": "4. Desenvolvimento",
+        "behaviourRich": "<code>git</code>, <code>vim</code>, <code>nano</code>"
+      },
+      {
+        "option": "5. Compressão",
+        "behaviourRich": "<code>zip</code>, <code>unzip</code>, <code>rsync</code>"
+      },
+      {
+        "option": "6. Multiplexadores de terminal",
+        "behaviourRich": "<code>screen</code>, <code>tmux</code>"
+      },
+      {
+        "option": "7. Análise",
+        "behaviourRich": "<code>jq</code>, <code>ncdu</code>, <code>iotop</code>"
+      },
+      {
+        "option": "8. Rede",
+        "behaviourRich": "<code>iperf3</code>, <code>nethogs</code>, <code>nmap</code>, <code>tcpdump</code>, <code>lsof</code>"
+      },
+      {
+        "option": "9. Verificar as instalações",
+        "behaviourRich": "Percorre cada entrada de <code>PROXMENUX_UTILS</code>, verifica se o comando está em PATH e apresenta um resumo Disponível / Em falta."
+      }
+    ]
+  },
+  "packages": {
+    "heading": "Os 25 pacotes",
+    "intro": "Definidos no ficheiro partilhado <code>scripts/global/utils-install-functions.sh</code> como <code>PROXMENUX_UTILS</code> (formato: <code>package:verify_command:description</code>). Outros scripts ProxMenux, como os que iniciam iftop / iptraf-ng / iperf3, reutilizam estas entradas para manter os pacotes e comandos de verificação sincronizados.",
+    "headerPackage": "Pacote",
+    "headerVerify": "Comando de verificação",
+    "headerDescription": "Descrição",
+    "rows": [
+      {
+        "package": "axel",
+        "verify": "axel",
+        "description": "Acelerador de transferências"
+      },
+      {
+        "package": "aria2",
+        "verify": "aria2c",
+        "description": "Downloader multi-fonte"
+      },
+      {
+        "package": "btop",
+        "verify": "btop",
+        "description": "Monitor de recursos moderno"
+      },
+      {
+        "package": "cabextract",
+        "verify": "cabextract",
+        "description": "Extrair arquivos CAB"
+      },
+      {
+        "package": "chntpw",
+        "verify": "chntpw",
+        "description": "Editar o registro do Windows / senhas"
+      },
+      {
+        "package": "dos2unix",
+        "verify": "dos2unix",
+        "description": "Converter arquivos de texto DOS / Unix"
+      },
+      {
+        "package": "genisoimage",
+        "verify": "genisoimage",
+        "description": "Criar imagens ISO"
+      },
+      {
+        "package": "grc",
+        "verify": "grc",
+        "description": "Colorador de log genérico"
+      },
+      {
+        "package": "htop",
+        "verify": "htop",
+        "description": "Visualizador interativo de processos"
+      },
+      {
+        "package": "iftop",
+        "verify": "iftop",
+        "description": "Utilização da rede em tempo real"
+      },
+      {
+        "package": "intel-gpu-tools",
+        "verify": "intel_gpu_top",
+        "description": "Ferramentas Intel GPU"
+      },
+      {
+        "package": "iotop",
+        "verify": "iotop",
+        "description": "Monitorar a utilização de E/S do disco"
+      },
+      {
+        "package": "iperf3",
+        "verify": "iperf3",
+        "description": "Teste de largura de banda de rede"
+      },
+      {
+        "package": "ipset",
+        "verify": "ipset",
+        "description": "Gerenciar conjuntos de IP"
+      },
+      {
+        "package": "iptraf-ng",
+        "verify": "iptraf-ng",
+        "description": "Ferramenta de monitorização da rede"
+      },
+      {
+        "package": "libguestfs-tools",
+        "verify": "virt-filesystems",
+        "description": "Utilitários de disco VM"
+      },
+      {
+        "package": "msr-tools",
+        "verify": "rdmsr",
+        "description": "Acesso aos registos MSR da CPU"
+      },
+      {
+        "package": "net-tools",
+        "verify": "netstat",
+        "description": "Ferramentas de rede legadas"
+      },
+      {
+        "package": "plocate",
+        "verify": "locate",
+        "description": "Localizar arquivos rapidamente"
+      },
+      {
+        "package": "s-tui",
+        "verify": "s-tui",
+        "description": "Stress-Terminal UI"
+      },
+      {
+        "package": "sshpass",
+        "verify": "sshpass",
+        "description": "Autenticação não interactiva do SSH"
+      },
+      {
+        "package": "tmux",
+        "verify": "tmux",
+        "description": "Multiplexador de terminal"
+      },
+      {
+        "package": "unzip",
+        "verify": "unzip",
+        "description": "Extrair arquivos ZIP"
+      },
+      {
+        "package": "wimtools",
+        "verify": "wimlib-imagex",
+        "description": "Gerenciar imagens WIM"
+      },
+      {
+        "package": "zip",
+        "verify": "zip",
+        "description": "Criar arquivos ZIP"
+      }
+    ]
+  },
+  "howItWorks": {
+    "heading": "Como funciona a instalação de um pacote",
+    "items": [
+      "<code>ensure_repositories</code> deteta PVE 8 ou 9 e lê os repositórios através da API Proxmox. Com um repositório Proxmox utilizável, nada muda. Um host sem subscrição ativa que use apenas Enterprise tem de confirmar a mudança para no-subscription; <code>apt-get update</code> é executado após a mudança aceite.",
+      "<code>install_single_package \"pkg\" \"verify_cmd\" \"description\"</code> executa <code>apt-get install -y \"$pkg\"</code> com feedback (<code>msg_info</code> / <code>msg_ok</code> / <code>msg_error</code>)."
+    ],
+    "verifyIntro": "Após a instalação, o comando é verificado com <code>command -v \"$verify_cmd\"</code>. Três resultados possíveis:",
+    "verifyOutcomes": [
+      "<strong>0 (sucesso):</strong> comando disponível, pacote contado como <em>Sucesso</em>.",
+      "<strong>1 (falhou):</strong> apt falhou, contado como <em>Falhou</em>.",
+      "<strong>2 (aviso):</strong> apt terminou com sucesso, mas o comando esperado não foi encontrado em PATH; conta como <em>Com avisos</em>."
+    ],
+    "summary": "No fim de uma instalação personalizada ou de grupo, uma janela apresenta os totais <em>Com sucesso / Com avisos / Com falha</em>."
+  },
+  "verify": {
+    "heading": "Verifique as instalações",
+    "intro": "A opção 9 é só de leitura: percorre <code>PROXMENUX_UTILS</code> e executa <code>command -v</code> para cada comando de verificação. O resultado é semelhante a:",
+    "code": "Total: 25\nAvailable: 18\nMissing: 8\n\n✓ axel - Download accelerator\n✓ aria2c - Multi-source downloader\n✓ btop - Modern resource monitor\n✗ cabextract - Extract CAB files\n✓ dos2unix - Convert DOS / Unix text files\n✗ genisoimage - Create ISO images\n✓ grc - Generic log colorizer\n...",
+    "outro": "Útil antes de executar scripts que dependem destas ferramentas (por exemplo. <code>uup_dump_iso_creator.sh</code> precisa de <code>aria2c</code> + <code>cabextract</code> + <code>wimlib-imagex</code>). Se algo estiver faltando, execute a instalação do grupo correspondente ou escolha os pacotes em falta através da seleção personalizada."
+  },
+  "troubleshoot": {
+    "heading": "Resolução de Problemas",
+    "reposTitle": "\"Falhou em configurar repositórios. Instalação cancelada.\"",
+    "reposBody": "A verificação do repositório não passou: a mudança para o repositório sem assinatura foi recusada, o status da assinatura não pôde ser lido, ou uma entrada de repositório precisa de atenção. A mensagem impressa acima indica a causa. Os repositórios estão listados em <em>Node → Atualizações → Repositórios</em> e <code>apt-get update</code> de um console mostra os relatórios de erro apt.",
+    "warningsTitle": "Um pacote é relatado \"Com avisos\", mas o comando funciona depois de fechar o menu",
+    "warningsBody": "Após <code>apt-get install</code>, a função executa <code>hash -r</code>, espera brevemente e verifica o comando esperado com <code>command -v</code>. Um aviso significa que essa verificação continua a falhar, sem identificar a causa. Experimente uma nova shell e verifique a instalação do pacote e PATH se o comando continuar em falta.",
+    "hangsTitle": "Uma instalação apt trava",
+    "hangsBody": "Provavelmente há uma pergunta debconf oculta pela saída silenciada. O script usa <code>DEBIAN_FRONTEND=noninteractive</code> nas chamadas apt, o que normalmente evita perguntas, mas alguns pacotes ainda exigem dados. Cancele com <kbd>Ctrl</kbd>+<kbd>C</kbd> e execute <code>apt-get install -y &lt;pkg&gt;</code> manualmente numa shell para ver a pergunta e decidir."
+  },
+  "files": {
+    "heading": "Ficheiros envolvidos",
+    "code": "scripts/utilities/system_utils.sh                    # this script\nscripts/global/utils-install-functions.sh            # PROXMENUX_UTILS, install_single_package\nscripts/global/repository-functions.sh               # ensure_repositories\nscripts/global/repository_policy.py                  # reads and switches repositories through the Proxmox API\n/etc/apt/sources.list.d/proxmox.sources              # no-subscription source, written by Proxmox when the switch is accepted"
+  },
+  "related": {
+    "heading": "Relacionado",
+    "items": [
+      {
+        "href": "/docs/utils/system-update",
+        "label": "Atualização do sistema Proxmox",
+        "tailRich": " — para o <code>apt dist-upgrade</code> efectivo no hospedeiro."
+      },
+      {
+        "href": "/docs/network/monitoring",
+        "label": "Ferramentas de monitorização ao vivo (rede)",
+        "tailRich": " — utiliza iftop / iptraf-ng / iperf3 desta mesma lista."
+      },
+      {
+        "href": "/docs/utils",
+        "label": "Visão geral dos utilitários",
+        "tailRich": " — voltar ao panorama da secção."
+      }
+    ]
+  }
+}
diff --git a/web/messages/pt/docs/utils/upgrade-pve8-pve9.json b/web/messages/pt/docs/utils/upgrade-pve8-pve9.json
new file mode 100644
index 00000000..441a52ce
--- /dev/null
+++ b/web/messages/pt/docs/utils/upgrade-pve8-pve9.json
@@ -0,0 +1,335 @@
+{
+  "meta": {
+    "title": "Atualizar PVE 8 para PVE 9 | Documentação do ProxMenux",
+    "description": "Três formas de passar do Proxmox VE 8 para 9 (Debian Bookworm para Trixie e PVE 8 para 9): automática, interativa ou manual, seguindo o procedimento oficial. Verificação pve8to9, migração dos repositórios, dist-upgrade e validação final. A execução no terminal web é bloqueada.",
+    "ogTitle": "Atualizar PVE 8 para PVE 9 | Documentação do ProxMenux",
+    "ogDescription": "Três métodos (automático, interativo e manual) para passar do Proxmox VE 8 para 9."
+  },
+  "header": {
+    "title": "Atualize PVE 8 para PVE 9",
+    "description": "Executa a atualização do Proxmox VE 8 para 9 segundo o procedimento oficial: Debian Bookworm para Trixie e PVE 8 para 9. Oferece métodos automático, interativo e manual, além de uma verificação prévia independente. Bloqueia o terminal web porque uma desconexão durante a atualização pode deixar o anfitrião inutilizável.",
+    "section": "Utilitários"
+  },
+  "dangerCallout": {
+    "title": "Uma atualização de versão principal é irreversível",
+    "intro": "Esta operação substitui a base Debian (Bookworm → Trixie) e os componentes Proxmox no próprio sistema. <strong>Não existe um procedimento de reversão</strong>. Antes de começar:",
+    "items": [
+      "<strong>Cópias de segurança verificadas</strong> de cada VM e CT (PBS, vzdump, snapshots ZFS — verifique também o restauro).",
+      "<strong>Acesso por consola / IPMI / iKVM</strong> ao anfitrião caso a ligação SSH seja interrompida.",
+      "O host já está atualizado em PVE 8.4.x (o script obriga isso).",
+      "Ceph (se presente) na versão 19.x Squid.",
+      "Pelo menos <strong>5 GB livres</strong> no sistema de ficheiros raiz."
+    ]
+  },
+  "modeMenu": {
+    "heading": "O menu modo",
+    "intro": "A opção abre quatro entradas: Automático, Interativo, Verificação prévia e Guia manual. Três opções <em>executam</em> a atualização ou explicam como fazê-la; a verificação independente <em>confirma</em> os requisitos e pode propor reparações.",
+    "imageAlt": "Menu de atualização do PVE 8 para 9 com modos automático, interativo, verificação prévia e guia manual"
+  },
+  "threeWays": {
+    "heading": "Três maneiras de atualizar",
+    "intro": "Os modos Automático e Interativo seguem o mesmo processo, com verificações prévias e validação final. Diferem nas respostas às perguntas do dpkg durante <code>dist-upgrade</code>. O guia manual mostra os comandos, incluindo as verificações; cabe-lhe executar todos os passos.",
+    "auto": {
+      "title": "Automático / Sem assistência",
+      "summary": "Define <code>ASSUME_YES=1</code> + <code>DEBIAN_FRONTEND=noninteractive</code>. Para ficheiros de configuração modificados, o dpkg usa a ação predefinida se existir; caso contrário, <strong>mantém o ficheiro atual</strong> (<code>--force-confold</code>).",
+      "items": [
+        "O mais rápido — sem perguntas do dpkg durante a atualização",
+        "Adequado para instalações padrão sem ficheiros de configuração personalizados",
+        "Risco: uma configuração personalizada é mantida sem perguntas e pode ocultar os novos valores predefinidos"
+      ]
+    },
+    "interactive": {
+      "title": "Interactiva",
+      "summary": "O mesmo processo, mas o utilizador responde a cada pergunta do dpkg sobre conflitos de configuração. Mais lento, com visibilidade máxima.",
+      "items": [
+        "Você vê cada conflito de configuração e decide",
+        "Melhor quando você tiver personalizado <code>/etc/lvm</code>, <code>/etc/ssh</code>, etc.",
+        "Consulte a tabela de respostas recomendadas no procedimento manual abaixo"
+      ]
+    },
+    "manual": {
+      "title": "Guia de atualização manual",
+      "summary": "Apresenta, sem executar, o procedimento oficial Proxmox em 17 passos. Execute os comandos manualmente numa shell separada.",
+      "items": [
+        "Controle máximo — você digita cada comando",
+        "Melhor quando você quer aprender o procedimento ou você não confia em nada",
+        "O script exibe as etapas; nada é executado automaticamente"
+      ]
+    }
+  },
+  "precheckCallout": {
+    "title": "Mais uma pré- verificação separada",
+    "body": "A opção 3 — <strong>Executar verificação do PVE 8 para 9</strong> — inicia a ferramenta oficial <code>pve8to9 --full</code>, propõe reparações guiadas para problemas comuns e depois <strong>termina</strong>. Utilize-a antes de atualizar ou após reparações manuais. Os modos automático e interativo também a executam; o guia manual indica que deve executá-la pessoalmente."
+  },
+  "webTerminal": {
+    "heading": "Por que o terminal web está bloqueado",
+    "body": "Os três modos detetam <code>termproxy</code> / <code>vncshell</code> na cadeia de processos ascendentes e recusam iniciar. O terminal web depende de <code>pveproxy</code>, um serviço atualizado durante o processo. Quando <code>pveproxy</code> reinicia, a sessão termina e o script que nela decorre também. O anfitrião pode ficar parcialmente atualizado.",
+    "warningTitle": "Utilize SSH ou uma consola física / IPMI / iKVM",
+    "warningBody": "SSH é a opção habitual. Inicie a sessão dentro de <code>tmux</code> ou <code>screen</code> para resistir a breves interrupções de rede. Se detetar uma shell SSH simples, o script apresenta primeiro um lembrete sobre tmux/screen."
+  },
+  "auto": {
+    "heading": "Modo automático / sem vigilância",
+    "intro": "As perguntas sobre pacotes e ficheiros de configuração usam os valores predefinidos da tabela seguinte, e um 401 do repositório Enterprise muda para no-subscription sem perguntar. A confirmação da atualização, o resumo da atualização do PVE 8, as reparações das verificações e a pergunta de reinício continuam a ser apresentados.",
+    "behaviourHeading": "Comportamento específico do modo automático",
+    "behaviourTable": {
+      "settingHeader": "Configuração",
+      "effectHeader": "Efeito",
+      "rows": [
+        {
+          "settingRich": "<code>ASSUME_YES=1</code>",
+          "effectRich": "Opção interna — o script responde sim às suas próprias perguntas, como mudar para no-subscription após um 401"
+        },
+        {
+          "settingRich": "<code>DEBIAN_FRONTEND=noninteractive</code>",
+          "effectRich": "apt / dpkg são executados sem abrir perguntas do debconf"
+        },
+        {
+          "settingRich": "<code>--force-confdef</code>",
+          "effectRich": "Para arquivos de configuração intocados: instale a nova versão do mantenedor"
+        },
+        {
+          "settingRich": "<code>--force-confold</code>",
+          "effectRich": "Para ficheiros modificados: ação predefinida do dpkg, se existir; caso contrário, <strong>manter a sua versão</strong>."
+        }
+      ]
+    },
+    "flowHeading": "Processo do modo automático",
+    "flowIntro": "Seis fases consecutivas. A fase 2 atualiza os pacotes PVE 8 e a fase 3 escreve a configuração dos repositórios do PVE 9. Uma falha interrompe o processo sem reverter essas alterações; se a atualização do PVE 8 falhar ou for cancelada, os repositórios ficam inalterados. A fase 5 executa <code>dist-upgrade</code> para PVE 9.",
+    "flowDiagram": "1. VERIFICAÇÕES\nBloqueia termproxy / vncshell; confirma a atualização; rejeita PVE 9.\n\n2. PREPARAR PVE 8\nscripts/global/update-pve8.sh\nAtualiza os pacotes PVE 8; para se a atualização falhar ou for cancelada.\npve8to9 --full (pode propor reparações).\nVerifica espaço e conectividade; Ceph 19.x Squid em nós hiperconvergentes.\n\n3. MIGRAR REPOSITÓRIOS\nBookworm → Trixie; escreve ficheiros deb822 .sources.\nComenta os ficheiros .list antigos; apt-get update.\n\n4. VALIDAR O CANDIDATO PVE 9\napt-cache policy proxmox-ve\napt-get -s dist-upgrade\nPara se o candidato não for 9.x ou se proxmox-ve fosse removido.\n\n5. ATUALIZAR\napt-get -y -o Dpkg::Options::='--force-confdef' -o Dpkg::Options::='--force-confold' dist-upgrade\nSem subscrição: desativa pve-enterprise.sources.\nRegisto: /var/log/pve8-a-pve9-'<'timestamp'>'.log\n\n6. VERIFICAR E REINICIAR\nEFI: apt install grub-efi-amd64\npve8to9 --full; examine os resultados e a pergunta de reinício.",
+    "preflightHeading": "Verificações antes da atualização",
+    "preflightTable": {
+      "checkHeader": "Verificar",
+      "whyHeader": "Por que importa",
+      "rows": [
+        {
+          "checkRich": "<strong>Bloco do terminal web</strong>",
+          "whyRich": "Impede que a atualização termine a shell que a executa"
+        },
+        {
+          "checkRich": "<strong>Já em 9.x</strong>",
+          "whyRich": "Interrompe se a máquina já executar PVE 9 (nada a fazer)"
+        },
+        {
+          "checkRich": "<strong>Versão mais recente do PVE 8.4.x</strong>",
+          "whyRich": "Atualiza primeiro o PVE 8 para a última revisão com o respetivo script; versões 8.x antigas têm requisitos diferentes"
+        },
+        {
+          "checkRich": "<strong>pve8to9 --full</strong>",
+          "whyRich": "Verificação dos requisitos pelo Proxmox; os erros FAIL bloqueiam a atualização até serem corrigidos"
+        },
+        {
+          "checkRich": "<strong>Espaço em disco</strong>",
+          "whyRich": "≥ 1024 MB livres em <code>/var/cache/apt/archives</code> para os ficheiros .deb transferidos"
+        },
+        {
+          "checkRich": "<strong>Conectividade</strong>",
+          "whyRich": "Ping a <code>download.proxmox.com</code> — se falhar, a operação não começa"
+        },
+        {
+          "checkRich": "<strong>Ceph 19.x Squid</strong>",
+          "whyRich": "Se o Ceph estiver instalado, já deve estar em 19.x. O PVE 9 não funciona com Ceph 17/18. As opções <code>--ignore-ceph-check</code> e <code>--warn-ceph-check</code> permitem ignorar a verificação; utilize-as apenas com conhecimento das consequências."
+        }
+      ]
+    },
+    "distUpgradeHeading": "O comando dist-upgrade (modo automático)",
+    "distUpgradeCode": "apt-get -y \\\n    -o Dpkg::Options::='--force-confdef' \\\n    -o Dpkg::Options::='--force-confold' \\\n    dist-upgrade",
+    "distUpgradeOutro": "O resultado aparece em tempo real no stdout e é também guardado em <code>/var/log/pve8-a-pve9-&lt;timestamp&gt;.log</code>. Tudo fica visível; só as perguntas são suprimidas.",
+    "postHeading": "Tarefas de pós- atualização (modo automático)",
+    "postItems": [
+      "<strong>Anfitriões EFI:</strong> instala <code>grub-efi-amd64</code>, de acordo com o problema conhecido na documentação Proxmox. A atualização não o instala automaticamente e pode ser necessário no próximo arranque.",
+      "<strong>Repositório Enterprise sem subscrição.</strong> O pve-manager 9 adiciona <code>pve-enterprise.sources</code> durante a atualização; no modo no-subscription, o script define-o como <code>Enabled: false</code>.",
+      "<strong>Volta a executar <code>pve8to9 --full</code>.</strong> Mostra problemas restantes. Os erros FAIL apresentam o mesmo menu de reparação da verificação prévia.",
+      "<strong>Pergunta de reinício.</strong> Recomenda-se reiniciar para carregar o novo kernel e os serviços. Recuse apenas por um motivo concreto: manter o kernel antigo após uma atualização de versão principal apresenta riscos."
+    ]
+  },
+  "interactive": {
+    "heading": "Modo interativo",
+    "intro": "O mesmo processo do <autolink>modo automático</autolink>: verificações, migração dos repositórios e validação final iguais. A diferença está em <code>dist-upgrade</code>: <strong>responde pessoalmente a cada conflito de configuração do dpkg</strong>. O ProxMenux executa <code>apt-get dist-upgrade</code> sem as opções <code>--force-conf*</code>.",
+    "distUpgradeHeading": "O comando dist-upgrade (modo interativo)",
+    "distUpgradeCode": "apt-get dist-upgrade\n# (user answers each dpkg config-file conflict prompt as it appears)",
+    "whenHeading": "Quando interativo é a escolha certa",
+    "whenItems": [
+      "Você personalizou <code>/etc/lvm/lvm.conf</code>, <code>/etc/ssh/sshd_config</code>, <code>/etc/default/grub</code> ou qualquer outro arquivo de configuração que seja tocado pela atualização.",
+      "Pretende ver que pacotes causam conflitos e decidir para cada ficheiro.",
+      "Você está atualizando um host de produção onde qualquer alteração oculta é inaceitável."
+    ],
+    "promptCalloutTitle": "O que responder em cada alerta",
+    "promptCalloutBody": "Aplicam-se as mesmas recomendações da operação manual: consulte <dpkglink>Respostas recomendadas às perguntas do dpkg</dpkglink> abaixo. Introduza <strong>D</strong> para ver as diferenças ou <strong>Z</strong> para abrir uma shell."
+  },
+  "manual": {
+    "heading": "Procedimento de actualização manual",
+    "intro": "É isto que mostra a opção <strong>Guia de atualização manual</strong>: o <wikilink>wiki oficial Proxmox para passar de 8 para 9</wikilink>, organizado em quatro fases. O script <em>mostra</em> os comandos; executa-os pessoalmente numa shell root separada. Cada passo é visível.",
+    "rootCalloutTitle": "Todos os comandos precisam de root",
+    "rootCalloutBody": "Utilize uma shell root para estes comandos, incluindo redirecionamentos e documentos here-document. Com <code>sudo</code>, garanta que todo o comando é executado com privilégios root.",
+    "phase1Heading": "Fase 1 — Preparação",
+    "phase1Intro": "Atualize o anfitrião para a última PVE 8.4.x, confirme a versão e o Ceph se utilizado, execute a verificação Proxmox e inicie um multiplexador de terminal para resistir a desconexões.",
+    "phase1Code": "# Step 1 — Update PVE 8 to the latest 8.4+\napt update && apt dist-upgrade -y\n\n# Step 2 — Verify version (must be 8.4.1 or newer)\npveversion\n\n# Step 2.1 — Hyper-converged Ceph: must already be on 19.x Squid\nceph --version\n# If older, follow https://pve.proxmox.com/wiki/Ceph_Reef_to_Squid\n\n# Step 3 — Run the official upgrade-readiness check\npve8to9 --full\n# If it warns about systemd-boot meta-package, remove it:\n#   apt remove systemd-boot\n\n# Step 4 — Start tmux or screen (so SSH disconnect doesn't kill the upgrade)\ntmux new-session -s upgrade\n# or\nscreen -S upgrade",
+    "phase2Heading": "Fase 2 — Migração do repositório",
+    "phase2Intro": "Mude todos os repositórios Debian e Proxmox de Bookworm para Trixie e converta as fontes Proxmox para deb822. <strong>Escolha o passo 7 OU 8</strong> conforme a subscrição Enterprise. Ignore o passo 9 se não utilizar Ceph.",
+    "phase2Code": "# Step 5 — Debian: bookworm → trixie\nsed -i 's/bookworm/trixie/g' /etc/apt/sources.list\n\n# Step 6 — Same for the legacy enterprise list (only if you use enterprise)\nsed -i 's/bookworm/trixie/g' /etc/apt/sources.list.d/pve-enterprise.list\n\n# Step 7 — Add the new PVE 9 enterprise repo (deb822) — Enterprise users only\ncat > /etc/apt/sources.list.d/pve-enterprise.sources << EOF\nTypes: deb\nURIs: https://enterprise.proxmox.com/debian/pve\nSuites: trixie\nComponents: pve-enterprise\nSigned-By: /usr/share/keyrings/proxmox-archive-keyring.gpg\nEOF\n\n# Step 8 — OR add the no-subscription repo (most home / lab users)\ncat > /etc/apt/sources.list.d/proxmox.sources << EOF\nTypes: deb\nURIs: http://download.proxmox.com/debian/pve\nSuites: trixie\nComponents: pve-no-subscription\nSigned-By: /usr/share/keyrings/proxmox-archive-keyring.gpg\nEOF\n\n# Step 8.1 — Refresh and verify proxmox-ve candidate is 9.x\napt update && apt policy | sed -n '1,120p'\n\n# Step 9 — Update Ceph repo (only if you run Ceph)\ncat > /etc/apt/sources.list.d/ceph.sources << EOF\nTypes: deb\nURIs: http://download.proxmox.com/debian/ceph-squid\nSuites: trixie\nComponents: no-subscription\nSigned-By: /usr/share/keyrings/proxmox-archive-keyring.gpg\nEOF\n\n# Step 10 — Remove old .list files now superseded by deb822 .sources\nrm -f /etc/apt/sources.list.d/pve-enterprise.list /etc/apt/sources.list.d/ceph.list\n\n# Step 11 — Final apt update\napt update",
+    "phase3Heading": "Fase 3 — Dist-upgrade",
+    "phase3Intro": "A atualização propriamente dita. O passo 12 é opcional mas recomendado para reduzir mensagens de auditoria. O 13 demora mais: responda às perguntas do dpkg com a tabela. O 13.1 aplica-se apenas a EFI e segue os problemas conhecidos oficiais.",
+    "phase3Code": "# Step 12 — Disable kernel audit messages (optional)\nsystemctl disable --now systemd-journald-audit.socket\n\n# Step 13 — The main upgrade (this takes a while)\napt dist-upgrade\n# (answer prompts using the table below)\n\n# Step 13.1 — EFI hosts: install grub for EFI (per known issues)\n[ -d /sys/firmware/efi ] && apt install grub-efi-amd64",
+    "dpkgHeading": "Respostas recomendadas para as prompts dpkg",
+    "dpkgIntro": "Respostas recomendadas pelo Proxmox: <strong>Y</strong> instala o novo ficheiro do responsável pelo pacote, substituindo o seu; <strong>N</strong> mantém o ficheiro atual. Em caso de dúvida, veja primeiro as diferenças:",
+    "dpkgTable": {
+      "fileHeader": "Ficheiro / prompt",
+      "answerHeader": "Resposta recomendada",
+      "whyHeader": "Porquê?",
+      "rows": [
+        {
+          "fileRich": "/etc/issue",
+          "answerRich": "<strong>N</strong> (manter o ficheiro atual)",
+          "whyRich": "Banner você está acostumado a ver",
+          "fileFont": true
+        },
+        {
+          "fileRich": "/etc/lvm/lvm.conf",
+          "answerRich": "<strong>Y</strong> (versão do responsável pelo pacote)",
+          "whyRich": "O PVE 9 precisa dos novos valores LVM predefinidos",
+          "fileFont": true
+        },
+        {
+          "fileRich": "/etc/ssh/sshd_config",
+          "answerRich": "<strong>Y</strong> para alterações apenas predefinidas; examine primeiro os ficheiros personalizados",
+          "whyRich": "Reveja as definições SSH locais e preserve o acesso antes de substituir o ficheiro. As alterações padrão incluem opções renomeadas e comentários.",
+          "fileFont": true
+        },
+        {
+          "fileRich": "/etc/default/grub",
+          "answerRich": "<strong>N</strong> se personalizado",
+          "whyRich": "Contém parâmetros de arranque, como IOMMU e passthrough PCI",
+          "fileFont": true
+        },
+        {
+          "fileRich": "/etc/chrony/chrony.conf",
+          "answerRich": "<strong>Y</strong> se não foi modificado; preserve primeiro as definições locais",
+          "whyRich": "O Trixie atualiza os valores de sincronização horária. Mova as definições locais para conf.d / sources.d do chrony antes de aceitar o novo ficheiro.",
+          "fileFont": true
+        },
+        {
+          "fileRich": "Reinícios de serviços durante a atualização",
+          "answerRich": "<strong>Sim</strong> (predefinição)",
+          "whyRich": "Reinicia a maioria dos serviços sem reiniciar o anfitrião",
+          "fileFont": false
+        },
+        {
+          "fileRich": "<code>apt-listchanges</code>",
+          "answerRich": "Pressione <kbd>q</kbd>",
+          "whyRich": "Fecha apenas o pager; as informações apresentadas resumem o registo de alterações",
+          "fileFont": false
+        }
+      ]
+    },
+    "inspectCalloutTitle": "Inspecionando um conflito dpkg específico",
+    "inspectCalloutBody": "Numa pergunta do dpkg sobre configuração, <strong>D</strong> mostra as diferenças entre o ficheiro atual e o novo; <strong>Z</strong> abre uma shell para investigar. Assim pode decidir sem adivinhar.",
+    "phase4Heading": "Fase 4 — Após a atualização",
+    "phase4Intro": "Confirme que a atualização terminou corretamente, reinicie com o kernel PVE 9 e verifique a versão. Depois pode converter os antigos ficheiros <code>.list</code> restantes para deb822.",
+    "phase4Code": "# Step 14 — Re-run the readiness check (should be much cleaner now)\npve8to9 --full\n\n# Step 15 — Reboot to load the new kernel and PVE 9 daemons\nreboot\n\n# Step 16 — After reboot, confirm PVE 9.x\npveversion\n# Should show pve-manager/9.x.x\n\n# Step 17 — Optional: modernise the remaining legacy .list files to deb822\napt modernize-sources\n# (keeps .list backups as .bak)"
+  },
+  "clusterCeph": {
+    "heading": "Cluster e Ceph",
+    "clusterCalloutTitle": "Cluster: atualizar um nó de cada vez",
+    "clusterCalloutBody": "Detetado por <code>pvecm status</code>. <strong>Não</strong> atualize vários nós ao mesmo tempo. Mova os convidados, atualize o nó, reinicie e confirme a participação no cluster antes de continuar. Durante a atualização, funciona a migração em direto de versões PVE anteriores para posteriores; o sentido inverso geralmente não é suportado. Os grupos HA são convertidos automaticamente em regras HA quando todos os nós utilizam PVE 9.",
+    "cephCalloutTitle": "Ceph: atualizar Ceph PRIMEIRO, depois Proxmox",
+    "cephCalloutBody": "O Ceph já deve estar em 19.x Squid antes de atualizar o Proxmox. Siga a sequência oficial Quincy 17 → Reef 18 → Squid 19, atualizando pacotes e reiniciando os daemons Ceph de forma gradual pela ordem documentada. Confirme <code>ceph --version</code> antes de cada nó Proxmox. Procedimento completo: <cephlink>wiki de atualização de Ceph Reef para Squid</cephlink>."
+  },
+  "troubleshooting": {
+    "heading": "Resolução de Problemas",
+    "items": [
+      {
+        "title": "O script interrompe a execução: \"This script cannot be executed from the Proxmox web terminal\"",
+        "bodyRich": "Abra uma ligação SSH ou utilize consola / IPMI / iKVM e execute novamente. Inicie primeiro <code>tmux new -s pveupgrade</code> para resistir a breves interrupções de rede."
+      },
+      {
+        "title": "pve8to9 indica FAIL e a opção 1 de reparação produz \"command not found\"",
+        "bodyRich": "Se o erro mencionar <code>configure_repositories</code>, a cópia do script está desatualizada: a reparação atual usa cleanup_duplicate_repos e ensure_repositories. Atualize-a ou consulte os comandos manuais na opção 2. <code>apt-get update</code> atualiza as listas de pacotes, mas não corrige todas as verificações bloqueantes."
+      },
+      {
+        "title": "A simulação apt indica \"proxmox-ve will be REMOVED\"",
+        "bodyRich": "Os novos repositórios estão inacessíveis ou o nome da distribuição não foi substituído. Verifique <code>cat /etc/apt/sources.list.d/proxmox.sources</code>: a linha <code>Suites:</code> deve indicar <code>trixie</code>, não <code>bookworm</code>. <code>apt-cache policy proxmox-ve</code> deve apresentar um candidato 9.x do novo repositório."
+      },
+      {
+        "title": "dist-upgrade falha a meio",
+        "bodyRich": "Execute <code>apt-get -f install</code> para resolver dependências quebradas e, em seguida, execute novamente a atualização. Se isso falhar, verifique o log no <code>/var/log/pve8-a-pve9-&lt;timestamp&gt;.log</code> — as últimas linhas geralmente apontam o pacote ofensivo. Não reiniciar até que o <code>dpkg -l | grep ^iU</code> retorne vazio (sem pacotes semi-instalados)."
+      },
+      {
+        "title": "A máquina EFI não inicializa após reiniciar",
+        "bodyRich": "A instalação posterior de <code>grub-efi-amd64</code> resolve este problema. Se foi omitida ou falhou, arranque com o ISO Proxmox em modo de recuperação, monte o sistema raiz, execute chroot e <code>apt-get install grub-efi-amd64 &amp;&amp; update-grub</code>."
+      },
+      {
+        "title": "GUI não carrega após a atualização",
+        "bodyRich": "Execute <code>systemctl status pveproxy</code> e <code>systemctl restart pveproxy</code>. Se o problema continuar, procure o erro em <code>journalctl -u pveproxy -b</code>."
+      },
+      {
+        "title": "A rede não funciona após reiniciar",
+        "bodyRich": "Confirme que <code>/etc/network/interfaces</code> referencia dispositivos existentes e que <code>ifupdown2</code> está instalado: <code>apt install ifupdown2</code>. Se os nomes mudaram, consulte <netlink>Nomes persistentes de interfaces</netlink>."
+      },
+      {
+        "title": "Split-brain no cluster após atualizar um nó",
+        "bodyRich": "Os clusters mistos PVE 8 / PVE 9 são suportados durante a atualização. Funciona a migração em direto de versões anteriores para posteriores; o sentido inverso geralmente não é suportado. Se o nó aparecer desligado, verifique <code>corosync</code> e a configuração QDevice / rede. Execute <code>pvecm status</code> em cada nó para confirmar o quórum."
+      }
+    ]
+  },
+  "files": {
+    "heading": "Ficheiros envolvidos",
+    "code": "scripts/utilities/upgrade_pve8_to_pve9.sh                         # main upgrade orchestrator\nscripts/utilities/pve8to9_check.sh                                # pre-check (separate menu option)\nscripts/utilities/proxmox-upgrade-pve8-to-pve9-manual-guide.sh    # 17-step runbook\nscripts/global/update-pve8.sh                                     # PVE 8 worker (final patches)\n/etc/apt/sources.list                                             # bookworm → trixie sed\n/etc/apt/sources.list.d/proxmox.sources                           # created (deb822 PVE 9)\n/etc/apt/sources.list.d/debian.sources                            # created (deb822 trixie)\n/etc/apt/sources.list.d/ceph.sources                              # created if Ceph\n/etc/apt/sources.list.d/*.list                                    # legacy files commented out / removed\n/var/log/pve8-a-pve9-'<'timestamp'>'.log                              # full upgrade log"
+  },
+  "references": {
+    "heading": "Referências oficiais",
+    "intro": "O procedimento manual do script segue estas fontes oficiais. Em caso de dúvida numa atualização, siga o wiki oficial: o ProxMenux ajuda na execução, mas a referência é o Proxmox.",
+    "items": [
+      {
+        "href": "https://pve.proxmox.com/wiki/Upgrade_from_8_to_9",
+        "title": "Atualização de 8 para 9",
+        "desc": "A página principal do wiki Proxmox para a atualização 8 → 9. Fonte da verdade para cada comando no procedimento manual acima."
+      },
+      {
+        "href": "https://pve.proxmox.com/wiki/Ceph_Reef_to_Squid",
+        "title": "Atualização para Ceph Squid (19.x)",
+        "desc": "Passo prévio obrigatório para nós Ceph hiperconvergentes. O Ceph deve estar em 19.x Squid antes do PVE 9."
+      },
+      {
+        "href": "https://pve.proxmox.com/wiki/Roadmap",
+        "title": "Roteiro Proxmox VE",
+        "desc": "Notas de lançamento do PVE 9 e alterações desde 8.x: leia antes de atualizar."
+      },
+      {
+        "href": "https://www.debian.org/releases/trixie/releasenotes",
+        "title": "Notas de lançamento do Debian Trixie",
+        "desc": "O PVE 9 baseia-se no Debian Trixie. As notas Debian descrevem alterações do sistema operativo que também afetam o anfitrião."
+      },
+      {
+        "href": "https://forum.proxmox.com/forums/proxmox-ve-installation-and-configuration.16/",
+        "title": "Fórum de instalação Proxmox VE",
+        "desc": "Se algo correr mal durante a atualização, pesquise primeiro neste fórum: alguém pode já ter encontrado o mesmo problema."
+      },
+      {
+        "href": "https://pve.proxmox.com/wiki/Backup_and_Restore",
+        "title": "Backup e Restauração",
+        "desc": "Uma atualização de versão principal não é reversível. Verifique sua disciplina de backup antes de começar."
+      }
+    ]
+  },
+  "video": {
+    "heading": "Guia em vídeo",
+    "intro": "Prefere ver o upgrade correr de ponta a ponta antes de fazê-lo sozinho? Este passeio demonstra o fluxo de atualização ProxMenux em tempo real.",
+    "title": "ProxMenux — Guia em vídeo para atualizar Proxmox VE 8 para 9",
+    "caption": "Vídeo externo no YouTube. Reprodução no modo de privacidade avançada, sem cookies até iniciar o vídeo."
+  },
+  "related": {
+    "heading": "Relacionado",
+    "items": [
+      {
+        "href": "/docs/utils/system-update",
+        "label": "Atualização do sistema Proxmox",
+        "tail": " — para atualizações regulares dentro da mesma versão principal (8.4.1 → 8.4.5, etc.)."
+      },
+      {
+        "href": "/docs/utils",
+        "label": "Visão geral dos utilitários",
+        "tail": " — voltar à visão geral da secção."
+      }
+    ]
+  }
+}
diff --git a/web/messages/pt/docs/utils/uup-dump-iso-creator.json b/web/messages/pt/docs/utils/uup-dump-iso-creator.json
new file mode 100644
index 00000000..b5ecf78d
--- /dev/null
+++ b/web/messages/pt/docs/utils/uup-dump-iso-creator.json
@@ -0,0 +1,161 @@
+{
+  "meta": {
+    "title": "Criador de ISO do UUP Dump | Documentação ProxMenux",
+    "description": "Crie uma ISO de instalação do Windows atualizada no host Proxmox com o criador de ISO do UUP Dump do ProxMenux. Automatiza a instalação de dependências, a transferência e a conversão dos ficheiros UUP numa ISO de arranque para criar uma VM.",
+    "ogTitle": "Criador de ISO do UUP Dump | Documentação ProxMenux",
+    "ogDescription": "Crie uma ISO do Windows atualizada do UUP Dump usando ProxMenux. Dependências, download e conversão são totalmente automatizados.",
+    "ogImageAlt": "ProxMenux — Criador de ISO do UUP Dump"
+  },
+  "header": {
+    "title": "Criador de ISO do UUP Dump",
+    "description": "Crie uma ISO de instalação do Windows atualizada no host Proxmox com o UUP Dump. O ProxMenux gere as dependências, transfere os ficheiros UUP em paralelo, executa o conversor UUP Dump e move a ISO para o diretório de saída escolhido, que por predefinição é o armazenamento ISO Proxmox detetado.",
+    "section": "Utilitários"
+  },
+  "intro": {
+    "title": "O que este script faz",
+    "body": "Forneça o URL gerado por uupdump.net após escolher a compilação, a língua e a edição. O script instala as dependências em falta, transfere o conversor UUP Dump e os ficheiros UUP, cria uma ISO de arranque do Windows e move-a para o diretório de saída escolhido. O armazenamento ISO Proxmox detetado é proposto como destino predefinido."
+  },
+  "hero": {
+    "imageAlt": "UUP Dump ISO Creator entrada em ProxMenux",
+    "caption": "UUP Dump ISO Creator entrada em ProxMenux"
+  },
+  "what": {
+    "heading": "O que é UUP Dump?",
+    "intro": "O UUP Dump é um serviço da comunidade que permite transferir os ficheiros originais Unified Update Platform (UUP) usados pelo Windows Update para distribuir o Windows. Estes ficheiros podem ser reunidos numa ISO de arranque padrão. Permite obter:",
+    "items": [
+      "A mais recente compilação do Windows (incluindo canais de visualização do Insider).",
+      "Uma compilação histórica específica que não está mais listada na página de download da Microsoft.",
+      "Arquivos limpos e não modificados foram obtidos diretamente dos servidores da Microsoft.",
+      "A combinação exata de edições e idiomas que você deseja em uma única ISO."
+    ],
+    "learnMore": "Saiba mais sobre a página de projeto <extlink>UUP Dump</extlink>."
+  },
+  "automates": {
+    "heading": "O que o script automatiza"
+  },
+  "dependencies": {
+    "heading": "Dependências",
+    "intro": "O script começa por verificar as ferramentas necessárias para transferir os ficheiros UUP e criar a ISO. As que faltam são instaladas com <code>apt-get</code>:",
+    "headerPackage": "Pacote",
+    "headerRole": "Papel",
+    "rows": [
+      {
+        "pkg": "curl",
+        "roleRich": "Transferências HTTP para iniciar o conversor."
+      },
+      {
+        "pkg": "aria2",
+        "roleRich": "Downloader paralelo usado para cada carga útil UUP."
+      },
+      {
+        "pkg": "cabextract",
+        "roleRich": "Extrai pacotes do Microsoft CAB."
+      },
+      {
+        "pkg": "wimtools",
+        "roleRich": "Cria <code>install.wim</code> (wimlib-imagex)."
+      },
+      {
+        "pkg": "genisoimage",
+        "roleRich": "Escreve a ISO final inicializável (ou <code>mkisofs</code>)."
+      },
+      {
+        "pkg": "chntpw",
+        "roleRich": "Modifica as estruturas do registo Windows durante a criação."
+      }
+    ],
+    "manualIntro": "Equivalente manual – se você precisar instalá-los você mesmo:",
+    "manualCode": "apt-get install curl aria2 cabextract wimtools genisoimage chntpw"
+  },
+  "flow": {
+    "heading": "Download e conversão",
+    "steps": [
+      "Detecta o armazenamento ISO Proxmox (via <code>pvesm status -content iso</code>) ou volta para <code>/var/lib/vz/template/iso</code>.",
+      "Pede uma pasta base para arquivos temporários (padrão <code>/root/uup-temp</code>).",
+      "Transfere o conversor UUP Dump de <code>git.uupdump.net</code>.",
+      "Extrai <code>id</code>, <code>pack</code> e <code>edition</code> do URL colado.",
+      "Chama <code>https://uupdump.net/get.php?…&aria2=2</code> para gerar uma lista de download aria2.",
+      "Transfere todos os ficheiros UUP para <code>UUPs/</code> com aria2, em paralelo e com possibilidade de retoma.",
+      "Executa <code>convert.sh wim UUPs 1</code> do conversor para produzir a ISO final.",
+      "Move a ISO para o diretório de saída escolhido e elimina os ficheiros temporários."
+    ]
+  },
+  "aria2": {
+    "heading": "Opções de transferência aria2 utilizadas",
+    "code": "aria2c --no-conf --console-log-level=warn --log-level=info \\\n  --log=aria2_download.log \\\n  -x16 -s16 -j5 -c -R \\\n  -d\"$destDir\" -i\"$tempScript\"",
+    "flags": [
+      "<code>-x16</code> — até 16 ligações por servidor.",
+      "<code>-s16</code> — divide cada ficheiro em 16 segmentos.",
+      "<code>-j5</code> — transfere 5 ficheiros em paralelo.",
+      "<code>-c</code> — retoma os downloads parciais.",
+      "<code>-R</code> — aplica ao ficheiro transferido a data e a hora do ficheiro remoto, quando disponíveis."
+    ],
+    "runtime": "A duração típica ronda os 10 minutos e depende sobretudo da velocidade da ligação à Internet e da carga dos servidores de transferência UUP Dump."
+  },
+  "step1": {
+    "heading": "Passo 1 · Obter um URL UUP Dump",
+    "intro": "Antes de executar o script, você precisa de um URL UUP Dump que inclua os parâmetros de consulta <code>id</code>, <code>pack</code> e <code>edition</code>. Gere-o em <extlink>uupdump.net</extlink>:",
+    "stepBadge": "Etapa",
+    "items": [
+      {
+        "title": "Escolha uma versão do Windows",
+        "img": "/iso-creator/step-1-select-version-windows.png",
+        "caption": "UUP Dump página principal — escolha uma versão do Windows",
+        "body": "Abra a página inicial do UUP Dump e escolha a versão do Windows que você deseja."
+      },
+      {
+        "title": "Escolha uma compilação específica",
+        "img": "/iso-creator/step-2-select-version-windows.png",
+        "caption": "Escolha uma compilação específica",
+        "body": "Escolha a compilação: a mais recente, um canal Insider Preview ou uma compilação mais antiga ainda disponível."
+      },
+      {
+        "title": "Escolha um idioma",
+        "img": "/iso-creator/step-3-select-version-windows.png",
+        "caption": "Escolha um idioma",
+        "body": "Escolha a língua a incluir na ISO."
+      },
+      {
+        "title": "Escolher edições",
+        "img": "/iso-creator/step-4-select-version-windows.png",
+        "caption": "Escolha as edições a incluir",
+        "body": "Escolha as edições a incluir na ISO (Home, Pro, Enterprise, …). Pode combinar várias."
+      },
+      {
+        "title": "Copiar o URL",
+        "img": "/iso-creator/step-5-select-version-windows.png",
+        "caption": "Copiar o URL da barra de endereços",
+        "bodyRich": "Na página final, copie o URL <em> da barra de endereços do navegador</em>. Deve conter <code>id=…</code>, <code>pack=…</code> e <code>edition=…</code>. Essa é a string que o script analisará."
+      }
+    ]
+  },
+  "step2": {
+    "heading": "Passo 2 · Execute o criador",
+    "intro": "Com a URL na mão, abra ProxMenux e inicie o criador:",
+    "stepBadge": "Etapa",
+    "items": [
+      {
+        "title": "Iniciar UUP Dump ISO Creator",
+        "img": "/iso-creator/start-uupdump-iso-creator.png",
+        "caption": "Iniciar UUP Dump ISO Creator de ProxMenux",
+        "bodyRich": "No ProxMenux, abra <strong>Utilities → UUP Dump ISO Creator</strong>. O script verifica as dependências e o diretório ISO antes de pedir os dados."
+      },
+      {
+        "title": "Colar o URL UUP Dump",
+        "img": "/iso-creator/add-url-iso-creator.png",
+        "caption": "Colar o URL que copiou do uupdump.net",
+        "body": "Colar o URL na janela de entrada. O script valida que os três parâmetros necessários estão presentes; se algum estiver faltando, ele aborta de forma limpa."
+      },
+      {
+        "title": "Aguarde que a construção termine",
+        "img": "/iso-creator/end-uupdump-iso-creator.png",
+        "caption": "Compilação terminada — ISO está pronta no armazenamento ISO Proxmox",
+        "bodyRich": "A consola mostra o progresso do aria2 e depois a saída do conversor. A ISO terminada é movida para o diretório de saída escolhido. Se estiver num armazenamento ISO Proxmox configurado, pode ser selecionada em <strong>Criar VM com Windows → Instalar com ISO pessoal</strong>."
+      }
+    ]
+  },
+  "tempFiles": {
+    "title": "Ficheiros temporários",
+    "body": "A pasta temporária predefinida é <code>/root/uup-temp</code>, com as transferências em <code>UUPs/</code> e o conversor em <code>converter/</code>. Um caminho base personalizado recebe um subdiretório de sessão separado. Os ramos de criação bem-sucedida e de ausência de ISO gerada eliminam a sessão temporária. Falhas ou cancelamentos anteriores podem deixar ficheiros temporários."
+  }
+}
diff --git a/web/messages/pt/guides/backup-cloud.json b/web/messages/pt/guides/backup-cloud.json
new file mode 100644
index 00000000..6ccf5880
--- /dev/null
+++ b/web/messages/pt/guides/backup-cloud.json
@@ -0,0 +1,119 @@
+{
+  "meta": {
+    "title": "Cópias de segurança do Proxmox para a nuvem pessoal | ProxMenux",
+    "description": "Utilize rclone para montar uma nuvem pessoal, como Google Drive, Mega, Dropbox ou OneDrive, num diretório do anfitrião Proxmox VE, registe-o como armazenamento de cópias vzdump e faça cópias de VM e contentores diretamente para a nuvem, sem um script de cópias adicional.",
+    "ogTitle": "Cópias de segurança do Proxmox para a nuvem pessoal",
+    "ogDescription": "Monte uma nuvem com rclone no anfitrião Proxmox VE e utilize-a como destino vzdump para cópias de VM e contentores."
+  },
+  "header": {
+    "title": "Cópias de segurança do Proxmox para a nuvem pessoal",
+    "description": "Utilize rclone para montar uma nuvem pessoal, como Google Drive, Mega, Dropbox ou OneDrive, num diretório do anfitrião Proxmox VE, registe-o como armazenamento de cópias vzdump e faça cópias de VM e contentores diretamente para a nuvem, sem um script de cópias adicional.",
+    "section": "Guias"
+  },
+  "intro": {
+    "pbsCalloutTitle": "Considere primeiro o Proxmox Backup Server",
+    "pbsCalloutBody": "Numa segunda máquina que cumpra os requisitos x86-64, <pbsLink>Proxmox Backup Server</pbsLink> oferece cópias incrementais e desduplicadas com encriptação opcional no cliente. Foi concebido para cópias de VM. Este guia explica como montar uma nuvem pessoal, como Google Drive, Mega, OneDrive ou Dropbox, como destino das cópias.",
+    "stepsTitle": "O que vai fazer",
+    "steps": [
+      "Criar um diretório no anfitrião Proxmox e registá-lo como armazenamento de cópias vzdump.",
+      "Instale e configure rclone para o seu provedor de nuvem.",
+      "Montar a pasta da nuvem no diretório do anfitrião.",
+      "Restabelecer a montagem em cada arranque com uma unidade systemd."
+    ],
+    "vzdumpCalloutTitle": "Nota sobre as cópias vzdump do Proxmox",
+    "vzdumpCalloutBody": "Os arquivos vzdump do Proxmox são <strong>cópias completas, não incrementais</strong>. O tamanho real depende dos dados incluídos e da compressão, não apenas da capacidade do disco virtual. Se um arquivo ocupar 30 GB, guardar cinco requer cerca de 150 GB. Defina uma política de retenção para evitar encher a nuvem."
+  },
+  "createDir": {
+    "heading": "1. Criar o diretório no anfitrião e registá-lo como armazenamento de cópias",
+    "body": "Ligue-se ao anfitrião por SSH ou abra a shell Proxmox e crie um diretório como ponto de montagem em <code>/mnt/</code>. Escolha um nome que identifique o fornecedor:",
+    "mkdirCode": "mkdir -p /mnt/gdrive",
+    "afterMkdir": "Na interface web do Proxmox: <strong>Datacenter → Armazenamento → Adicionar → Diretório</strong>.",
+    "image1Alt": "Adicionando novo armazenamento no Proxmox",
+    "configIntro": "Configure assim:",
+    "configItems": [
+      "<strong>ID:</strong> <code>gdrive</code> (ou o que você usou para o nome do diretório)",
+      "<strong>Diretório:</strong> <code>/mnt/gdrive</code>",
+      "<strong>Conteúdo:</strong> selecione <strong>Ficheiro de cópia VZDump</strong>."
+    ],
+    "image2Alt": "Configurando novo armazenamento no Proxmox",
+    "afterConfig": "Clique em <strong>Adicionar</strong>:",
+    "image3Alt": "Novo armazenamento adicionado no Proxmox",
+    "afterAdd": "O diretório está registado como armazenamento Proxmox, mas continua vazio: a nuvem ainda não está montada."
+  },
+  "installRclone": {
+    "heading": "2. Instalar e configurar o rclone",
+    "body": "<rcloneLink>rclone</rcloneLink> comunica com os serviços de armazenamento na nuvem. Instale-o a partir dos repositórios Debian:",
+    "installCode": "apt-get update\napt-get install -y rclone",
+    "newerCalloutTitle": "Se precisar de um rclone mais novo",
+    "newerCalloutBody": "Se precisar de uma versão mais recente do que a disponibilizada pelo Debian, utilize o instalador oficial:",
+    "newerCode": "curl https://rclone.org/install.sh | bash",
+    "tunnelHeading": "2.1 Autenticação no navegador através de túnel SSH",
+    "tunnelBody": "Para fornecedores com autenticação web, o anfitrião Proxmox normalmente não tem navegador. Siga o <remoteSetupLink>procedimento de configuração remota do rclone</remoteSetupLink>: utilize o navegador do portátil e encaminhe a ligação de retorno localhost por SSH para o rclone no anfitrião.",
+    "tunnelFrom": "No seu <strong>portátil</strong>, substituindo <code>ip_proxmox</code> pelo IP do Proxmox:",
+    "tunnelCode": "ssh -L localhost:53682:localhost:53682 root@ip_proxmox",
+    "tunnelAfter": "Esta sessão SSH abre a porta localhost 53682 no portátil e encaminha as ligações para a mesma porta do anfitrião Proxmox. Mantenha-a aberta durante a configuração do rclone.",
+    "runHeading": "2.2 Executar rclone config",
+    "runBody": "Na sessão SSH que acabou de abrir, execute:",
+    "runCode": "rclone config",
+    "runAfter": "Siga as instruções para adicionar uma configuração remota, ou «remote». As respostas dependem do fornecedor; consulte a <providerDocsLink>documentação dos fornecedores rclone</providerDocsLink> para Google Drive, Mega, Dropbox, OneDrive e outros. O passo principal é a pergunta sobre autenticação:",
+    "authPrompt": "Use web browser to automatically authenticate rclone with remote?\n * Say Y if the machine running rclone has a web browser you can use\n * Say N if running rclone on a (remote) machine without web browser access\nIf not sure try Y. If Y failed, try N.\ny) Yes\nn) No\ny/n> y",
+    "authAfter": "Responda <strong>Y</strong>. O rclone apresenta um URL local. Abra-o no <strong>navegador do portátil</strong>; o túnel SSH encaminha a ligação. Autorize o acesso do rclone no fornecedor da nuvem para concluir a configuração.",
+    "nameRemote": "Para o nome da configuração remota, utilize um nome que corresponda ao diretório, por exemplo <code>gdrive</code>."
+  },
+  "mount": {
+    "heading": "3. Montar a pasta na nuvem",
+    "body": "Crie uma pasta na nuvem para as cópias, por exemplo <code>PBC</code>, abreviatura de Proxmox Backup Cloud.",
+    "mountIntro": "Monte-a no diretório do anfitrião:",
+    "mountCode": "rclone mount gdrive:/PBC /mnt/gdrive --allow-other --allow-non-empty --vfs-cache-mode writes",
+    "mountItems": [
+      "<code>gdrive:/PBC</code> — a pasta na sua nuvem.",
+      "<code>/mnt/gdrive</code> — o diretório host que você registrou como datastore."
+    ],
+    "mountFootnote": "<strong>Este comando permanece em primeiro plano.</strong> Deixe-o a executar num terminal para testar uma cópia. Para restabelecer a montagem em cada arranque, configure uma unidade systemd na secção seguinte."
+  },
+  "systemd": {
+    "heading": "4. Montagem automática em cada arranque com systemd",
+    "body": "Uma unidade systemd oferece mais controlo do que <code>crontab @reboot</code>: pode aguardar o arranque da rede, reiniciar em caso de erro e fornecer registos através de <code>journalctl</code>.",
+    "createIntro": "Crie o ficheiro da unidade:",
+    "createCode": "nano /etc/systemd/system/rclone-gdrive.service",
+    "pasteIntro": "Cole:",
+    "unitCode": "[Unit]\nDescription=rclone mount for Proxmox cloud backups\nWants=network-online.target\nAfter=network-online.target\n\n[Service]\nType=notify\nExecStart=/usr/bin/rclone mount \\\n    gdrive:/PBC /mnt/gdrive \\\n    --allow-other \\\n    --allow-non-empty \\\n    --vfs-cache-mode writes \\\n    --log-level INFO \\\n    --log-file /var/log/rclone-gdrive.log\nExecStop=/bin/fusermount -uz /mnt/gdrive\nRestart=on-failure\nRestartSec=10\n\n[Install]\nWantedBy=multi-user.target",
+    "adjust": "Ajuste <code>gdrive:/PBC</code> e <code>/mnt/gdrive</code> se escolheu outros nomes. Guarde, saia do editor com <code>Ctrl+X</code> e ative e inicie o serviço:",
+    "enableCode": "systemctl daemon-reload\nsystemctl enable --now rclone-gdrive.service",
+    "verifyIntro": "Verificar:",
+    "verifyCode": "systemctl status rclone-gdrive.service\nmount | grep /mnt/gdrive",
+    "verifyAfter": "A unidade solicita um reinício após 10 segundos se o processo rclone terminar com erro. Não repara credenciais expiradas nem garante recuperação de qualquer falha de rede ou do fornecedor. Consulte <code>/var/log/rclone-gdrive.log</code> e <code>journalctl -u rclone-gdrive.service -f</code>.",
+    "vfsCalloutTitle": "Porquê utilizar --vfs-cache-mode writes?",
+    "vfsCalloutBody": "Com cache de escrita, operações como <code>fwrite</code> escrevem numa cache local em disco. O rclone envia o ficheiro após ser fechado e decorrido o intervalo de escrita diferida. Reserve espaço local para as cópias em curso e confirme o fim do envio antes de considerar a cópia remota disponível."
+  },
+  "configureBackup": {
+    "heading": "5. Configurar a nuvem como destino das cópias",
+    "body": "No Proxmox, para uma cópia agendada ou manual, escolha o armazenamento registado como <strong>destino</strong>:",
+    "image5Alt": "Selecionar destino de backup no Proxmox",
+    "after": "Após terminar o vzdump, aguarde o fim do envio do rclone em segundo plano e confirme o arquivo na interface do fornecedor da nuvem:",
+    "image6Alt": "Arquivo de backup no armazenamento em nuvem"
+  },
+  "retention": {
+    "heading": "6. Retenção: manter a quota da nuvem sob controlo",
+    "body": "Os arquivos vzdump do Proxmox são <strong>cópias completas, não incrementais</strong>. O tamanho real depende dos dados incluídos e da compressão, não apenas da capacidade do disco virtual. Se um arquivo ocupar 30 GB, guardar cinco requer cerca de 150 GB. Defina uma política de retenção para evitar encher a nuvem.",
+    "uiPath": "Na interface Proxmox: <strong>Datacenter → Cópia de segurança → [a sua tarefa] → Retenção</strong>:",
+    "image7Alt": "Configurações de retenção de backup no Proxmox",
+    "starterIntro": "Valores iniciais possíveis para um ambiente doméstico ou de testes:",
+    "starterItems": [
+      "Guardar as últimas 5 cópias diárias",
+      "Guardar as últimas 4 cópias semanais",
+      "Guardar as últimas 6 cópias mensais"
+    ],
+    "adjust": "Ajuste os valores à quota da nuvem e à frequência com que as VM mudam."
+  },
+  "troubleshoot": {
+    "heading": "Resolução de Problemas",
+    "items": [
+      "<strong><code>Mount point /mnt/gdrive is itself on a fuse.rclone filesystem</code>:</strong> o diretório já está montado, possivelmente por outra instância rclone. Confirme que não há cópias em curso antes de remover a montagem anterior com <code>fusermount -uz /mnt/gdrive</code> e reinicie a unidade systemd.",
+      "<strong>A cópia é muito lenta:</strong> confirme <code>--vfs-cache-mode writes</code> na linha <code>ExecStart</code>. Verifique o desempenho da cache local, a velocidade de envio e os limites do fornecedor. O envio pode continuar após terminar o vzdump.",
+      "<strong>A cópia falha com No space left on device:</strong> verifique o espaço da cache local e a quota da nuvem. A cache utiliza normalmente <code>~/.cache/rclone/</code>. Se estiver cheia, escolha por exemplo <code>--cache-dir /var/cache/rclone</code> num sistema de ficheiros com espaço. Outro caminho no mesmo sistema cheio não resolve o problema.",
+      "<strong>O token de autenticação do rclone expirou:</strong> volte a ligar-se por SSH com o túnel (<code>ssh -L localhost:53682:localhost:53682 root@ip_proxmox</code>) e execute <code>rclone config reconnect gdrive:</code> para renovar a autorização.",
+      "<strong>As cópias estão na nuvem, mas falham ao restaurar:</strong> não utilize a nuvem como <strong>único</strong> destino. Combine-a com PBS local ou cópias vzdump noutro disco."
+    ]
+  }
+}
diff --git a/web/messages/pt/guides/index.json b/web/messages/pt/guides/index.json
new file mode 100644
index 00000000..56837dd1
--- /dev/null
+++ b/web/messages/pt/guides/index.json
@@ -0,0 +1,118 @@
+{
+  "meta": {
+    "title": "Guias Proxmox VE — Coral TPU, NVIDIA, Kodi em LXC, Samba e cópias na nuvem | ProxMenux",
+    "description": "Tutoriais detalhados para Proxmox VE: Kodi em LXC com aceleração por GPU, drivers NVIDIA no PVE 9, disco USB partilhado por Samba num contentor e cópias vzdump para Google Drive, Mega, Dropbox ou OneDrive. Inclui recursos selecionados da comunidade, glossário e referência de comandos.",
+    "ogTitle": "Guias Proxmox VE — Coral TPU, NVIDIA, Kodi em LXC, Samba e cópias na nuvem",
+    "ogDescription": "Tutoriais detalhados para Proxmox VE: passagem direta de GPU, centro multimédia Kodi em LXC, disco USB partilhado por Samba, cópias na nuvem com rclone e recursos selecionados da comunidade.",
+    "twitterTitle": "Guias Proxmox VE | ProxMenux",
+    "twitterDescription": "Tutoriais detalhados para Proxmox VE: GPU, Kodi em LXC, Samba, cópias na nuvem e outros temas.",
+    "ogImageAlt": "Guias ProxMenux — tutoriais detalhados para Proxmox VE"
+  },
+  "header": {
+    "title": "Guias do ProxMenux",
+    "tagline": "Tutoriais aprofundados, referências rápidas e recursos selecionados da comunidade para tirar o máximo partido do Proxmox VE."
+  },
+  "inDepth": {
+    "heading": "Guias aprofundados",
+    "intro": "Tutoriais detalhados para tarefas específicas do Proxmox. Cada um descreve os passos manuais de um processo automatizado pelo ProxMenux, para compreender o que acontece em cada etapa.",
+    "items": [
+      {
+        "slug": "kodi-lxc",
+        "title": "Instalar Kodi em LXC com aceleração por GPU e ligá-lo a um monitor ou televisor",
+        "description": "Execute Kodi num contentor LXC privilegiado no Proxmox VE, disponibilize a iGPU e os dispositivos de entrada USB do anfitrião e utilize o servidor como centro multimédia ligado diretamente ao televisor."
+      },
+      {
+        "slug": "backup-cloud",
+        "title": "Cópias de segurança do Proxmox para a nuvem pessoal",
+        "description": "Utilize rclone para montar uma nuvem pessoal, como Google Drive, Mega, Dropbox ou OneDrive, num diretório do anfitrião Proxmox VE, registe-o como armazenamento de cópias vzdump e faça cópias de VM e contentores diretamente para a nuvem, sem um script de cópias adicional."
+      },
+      {
+        "slug": "lxc-samba",
+        "title": "Adicionar um disco ou uma pen USB a LXC e partilhá-los na rede com Samba",
+        "description": "Disponibilize um disco ou uma pen USB num contentor LXC privilegiado no Proxmox VE, instale Samba no contentor e partilhe o conteúdo na rede."
+      },
+      {
+        "slug": "nvidia-manual",
+        "title": "Instalação de drivers de placas gráficas NVIDIA no Proxmox VE 9 (procedimento manual)",
+        "description": "Instale e configure manualmente os drivers NVIDIA num anfitrião Proxmox VE 9 e disponibilize a GPU a um ou mais contentores LXC. Inclui os drivers, o serviço de persistência, a correção NVENC opcional e a configuração de cada contentor."
+      }
+    ]
+  },
+  "references": {
+    "heading": "Referências ProxMenux",
+    "intro": "Material de referência rápida da própria documentação ProxMenux.",
+    "cards": {
+      "glossary": {
+        "title": "Glossário",
+        "description": "Mais de 60 definições dos termos técnicos usados no ProxMenux: Proxmox, virtualização, armazenamento, rede e Linux. Consulta rápida com etiquetas de categoria e ligações relacionadas."
+      },
+      "helpInfo": {
+        "title": "Ajuda e Informações — Catálogo de comandos",
+        "description": "Uma seleção de comandos Linux e Proxmox por tema, com cópia para a área de transferência. Corresponde à referência disponível no menu ProxMenux."
+      },
+      "linuxResources": {
+        "title": "Recursos Linux",
+        "description": "Recursos externos para aprender a linha de comandos Linux, práticas de segurança, ferramentas de monitorização e ZFS, como complemento do catálogo de comandos ProxMenux."
+      },
+      "externalRepos": {
+        "title": "Repositórios Externos",
+        "description": "Repositórios de scripts de terceiros integrados no ProxMenux como opções alternativas do menu, como community-scripts/ProxmoxVE."
+      }
+    }
+  },
+  "official": {
+    "heading": "Recursos oficiais da Proxmox",
+    "intro": "Documentação publicada pela Proxmox Server Solutions, a referência oficial da plataforma.",
+    "cards": {
+      "pveDocs": {
+        "title": "Documentação Proxmox VE",
+        "description": "O guia oficial de administração: uma referência completa sobre instalação, rede, armazenamento, clusters, alta disponibilidade e API."
+      },
+      "pbsDocs": {
+        "title": "Documentação do Proxmox Backup Server",
+        "description": "Documentação para PBS — backups incrementais, desduplicados e criptografados para Proxmox VE."
+      },
+      "videoTraining": {
+        "title": "Formação em vídeo oficial",
+        "description": "Tutoriais em vídeo e cursos de formação oficiais da Proxmox."
+      },
+      "forum": {
+        "title": "Proxmox Forum",
+        "description": "Fórum oficial da comunidade para perguntas, resolução de problemas e partilha de experiências, acompanhado pelos responsáveis do projeto."
+      }
+    }
+  },
+  "community": {
+    "heading": "Projectos e recursos comunitários",
+    "intro": "Projetos de código aberto e listas selecionadas da comunidade Proxmox. Não são afiliados à Proxmox Server Solutions nem ao ProxMenux; estão aqui porque demonstraram ser úteis.",
+    "cards": {
+      "helperScripts": {
+        "title": "Proxmox VE Helper-Scripts",
+        "description": "Catálogo de scripts mantido pela comunidade para disponibilizar facilmente contentores LXC, VM e ajustes PVE, por exemplo para Home Assistant, Plex ou Frigate. Dá continuidade à ideia dos helper scripts de tteck."
+      },
+      "awesome": {
+        "title": "awesome-proxmox-ve (lista de recursos selecionados)",
+        "description": "Ampla coleção de recursos Proxmox VE selecionados pela comunidade: ferramentas, bibliotecas, integrações, blogs e vídeos. Um bom ponto de partida para descobrir mais."
+      }
+    },
+    "suggestRich": "Conhece um recurso de qualidade que devemos adicionar? Abra uma issue ou um PR no <link>GitHub</link>. Pretendemos manter uma seleção criteriosa, em vez de uma lista exaustiva."
+  },
+  "discussion": {
+    "heading": "Discussão comunitária",
+    "intro": "Onde as pessoas falam sobre Proxmox e ProxMenux.",
+    "cards": {
+      "proxmenuxDiscussions": {
+        "title": "ProxMenux Discussions",
+        "description": "GitHub Discussions dedicado ao ProxMenux: ideias de funcionalidades, perguntas e respostas e partilha de configurações. O local adequado para temas sobre o menu, o Monitor e a documentação."
+      },
+      "proxmoxForum": {
+        "title": "Proxmox Forum",
+        "description": "Fórum oficial do Proxmox (também ligado acima). O lugar certo para solucionar problemas em profundidade e problemas específicos de configuração."
+      },
+      "reddit": {
+        "title": "r/Proxmox no Reddit",
+        "description": "Subreddit ativo para discussões, dicas e apoio técnico. Mais acessível do que o fórum, com respostas frequentemente mais rápidas a perguntas informais."
+      }
+    }
+  }
+}
diff --git a/web/messages/pt/guides/kodi-lxc.json b/web/messages/pt/guides/kodi-lxc.json
new file mode 100644
index 00000000..256ddfd7
--- /dev/null
+++ b/web/messages/pt/guides/kodi-lxc.json
@@ -0,0 +1,70 @@
+{
+  "meta": {
+    "title": "Instalar Kodi em LXC com aceleração por GPU | Guias ProxMenux",
+    "description": "Execute Kodi num contentor LXC privilegiado no Proxmox VE, disponibilize a iGPU e os dispositivos de entrada USB do anfitrião e utilize o servidor como centro multimédia ligado diretamente ao televisor.",
+    "ogTitle": "Instalar Kodi em LXC com aceleração por GPU",
+    "ogDescription": "Execute Kodi num contentor LXC privilegiado no Proxmox VE com acesso à iGPU e aos dispositivos de entrada USB do anfitrião e transforme o servidor num centro multimédia."
+  },
+  "header": {
+    "title": "Instalar Kodi em LXC com aceleração por GPU e ligá-lo a um monitor ou televisor",
+    "description": "Execute Kodi num contentor LXC privilegiado no Proxmox VE, disponibilize a iGPU e os dispositivos de entrada USB do anfitrião e utilize o servidor como centro multimédia ligado diretamente ao televisor.",
+    "section": "Guias"
+  },
+  "intro": {
+    "calloutTitle": "Aviso",
+    "calloutBody": "Este guia utiliza um script externo da comunidade para preparar o contentor Kodi. O ProxMenux também pode configurar o acesso à iGPU do anfitrião: <strong>GPU e Coral-TPU → Adicionar GPU a LXC</strong> configura <code>/dev/dri</code> e instala os drivers no contentor. O script seguinte instala ainda Kodi e o arranque automático em <code>tty7</code>. Utilize-o para obter um centro multimédia LXC pronto a usar; escolha o <gpuLink>procedimento ProxMenux</gpuLink> se apenas precisar de acesso à GPU num contentor configurado manualmente.",
+    "credit": "O script original do Kodi para LXC foi criado por <authorLink>mrrudy</authorLink>.",
+    "stepsTitle": "O que vai fazer",
+    "steps": [
+      "Criar um contentor LXC privilegiado com Kodi através do script.",
+      "Disponibilizar teclado, rato ou comando USB no contentor.",
+      "Opcional: atualizar Kodi a partir dos repositórios configurados no contentor."
+    ]
+  },
+  "createCt": {
+    "heading": "1. Criar o Kodi LXC",
+    "body": "Para este procedimento, selecione <strong>Privileged</strong> nas definições avançadas do script. Por predefinição cria contentores sem privilégios, que exigem permissões de dispositivos e mapeamento de identificadores adequados. Configura o acesso à GPU, Kodi e o arranque automático em <code>tty7</code>:",
+    "code": "bash -c \"$(wget -qLO - https://raw.githubusercontent.com/mrrudy/proxmoxHelper/main/ct/kodi-v1.sh)\"",
+    "after": "A instalação demora algum tempo. Quando Kodi arrancar em <code>tty7</code>, ligue o monitor ou televisor à saída HDMI/DisplayPort do anfitrião. Deverá aparecer a interface do Kodi."
+  },
+  "addInput": {
+    "heading": "2. Adicionar teclado, rato ou comando USB",
+    "body": "Os dispositivos de entrada encontram-se em <code>/dev/input/</code> no anfitrião. Identifique o número major:",
+    "listCode": "ls -l /dev/input",
+    "imageAlt": "Lista de dispositivos de entrada",
+    "afterList": "Nos dispositivos de caracteres, utilize o número major antes da vírgula, neste exemplo <code>13</code>. No host, edite a configuração do contentor Kodi, substituindo <code>'<'CTID'>'</code> pelo respetivo ID, por exemplo <code>102</code>:",
+    "editCode": "nano /etc/pve/lxc/CTID.conf",
+    "addLines": "Adicione as linhas seguintes, ajustando <code>13</code> ao número encontrado no <strong>seu</strong> anfitrião:",
+    "configCode": "lxc.cgroup2.devices.allow: c 13:* rwm\nlxc.mount.entry: /dev/input dev/input none bind,optional,create=dir",
+    "imageConfigAlt": "Configuração do LXC",
+    "save": "Guarde o ficheiro, saia do editor com <code>Ctrl+X</code> e reinicie <strong>apenas o contentor</strong>. Não é necessário reiniciar o anfitrião Proxmox:",
+    "restartCode": "pct reboot CTID",
+    "plug": "Ligue o teclado, rato ou comando USB. Kodi deverá responder."
+  },
+  "updateKodi": {
+    "heading": "3. Opcional: atualizar Kodi a partir dos repositórios configurados",
+    "calloutTitle": "Importante",
+    "calloutBody": "O PPA team-xbmc destina-se <strong>apenas ao Ubuntu</strong> e o Kodi indica que já não é mantido. A ausência de <code>add-apt-repository</code> não identifica a distribuição. Verifique <code>cat /etc/os-release</code> e procure <code>NAME=\"Ubuntu\"</code>; não adicione PPA Ubuntu ao Debian. Os comandos seguintes atualizam pacotes a partir dos repositórios configurados no contentor.",
+    "body": "No contentor (<code>pct enter '<'CTID'>'</code>):",
+    "code": "apt update\napt install --only-upgrade kodi kodi-bin",
+    "after": "Reinicie o contentor após a atualização. Kodi utilizará a versão disponível nos repositórios configurados, que pode diferir da versão mais recente do projeto."
+  },
+  "screenshots": {
+    "heading": "Imagens",
+    "image1Alt": "Interface Kodi 1",
+    "image2Alt": "Interface Kodi 2"
+  },
+  "troubleshoot": {
+    "heading": "Resolução de Problemas",
+    "items": [
+      "<strong>O contentor Kodi arranca, mas não aparece nada no televisor:</strong> pode não ter acesso à iGPU. Verifique <code>ls /dev/dri</code> no contentor: deverão aparecer <code>card0</code> e <code>renderD128</code>. Se o diretório estiver vazio, verifique a passagem direta da GPU ou utilize <strong>Adicionar GPU a LXC</strong> no ProxMenux.",
+      "<strong>Teclado ou rato não detetado após reiniciar:</strong> verifique se <code>/dev/input</code> está montado e se Kodi tem permissão para ler os dispositivos. Execute <code>ls -l /dev/input</code> no anfitrião e no contentor e verifique a regra <code>lxc.cgroup2.devices.allow</code>.",
+      "<strong>A reprodução com aceleração por hardware utiliza a CPU em vez da GPU:</strong> instale ou atualize os drivers VA-API no contentor: <code>intel-media-va-driver</code> para iGPU Intel recentes, <code>i965-va-driver</code> para as antigas e <code>mesa-va-drivers</code> para AMD.",
+      "<strong><code>add-apt-repository: command not found</code>:</strong> o comando não está instalado; isso não prova que o contentor utiliza Debian. Verifique a distribuição e os pacotes disponíveis. Em Debian utilize os respetivos pacotes Kodi, sem adicionar o PPA Ubuntu."
+    ]
+  },
+  "further": {
+    "heading": "Mais informações",
+    "konpatRich": "<konpatLink>Artigo de Konpat</konpatLink> com mais contexto sobre o acesso à iGPU Intel a partir de LXC."
+  }
+}
diff --git a/web/messages/pt/guides/lxc-samba.json b/web/messages/pt/guides/lxc-samba.json
new file mode 100644
index 00000000..e67eac6f
--- /dev/null
+++ b/web/messages/pt/guides/lxc-samba.json
@@ -0,0 +1,119 @@
+{
+  "meta": {
+    "title": "Adicionar um disco USB a LXC e partilhá-lo com Samba | ProxMenux",
+    "description": "Disponibilize um disco ou uma pen USB num contentor LXC privilegiado no Proxmox VE, instale Samba no contentor e partilhe o conteúdo na rede.",
+    "ogTitle": "Adicionar um disco USB a LXC e partilhá-lo com Samba",
+    "ogDescription": "Disponibilize um disco USB num contentor LXC privilegiado no Proxmox VE, instale Samba e partilhe o conteúdo na rede local."
+  },
+  "header": {
+    "title": "Adicionar um disco ou uma pen USB a LXC e partilhá-los na rede com Samba",
+    "description": "Disponibilize um disco ou uma pen USB num contentor LXC privilegiado no Proxmox VE, instale Samba no contentor e partilhe o conteúdo na rede.",
+    "section": "Guias"
+  },
+  "recommended": {
+    "calloutTitle": "Recomendado",
+    "calloutIntro": "O ProxMenux disponibiliza ambas as partes deste procedimento através de menus guiados:",
+    "items": [
+      "<strong>Gestão de discos → Formatar/apagar disco físico</strong> para a formatação.",
+      "<strong>Armazenamento e partilha → Partilha de rede LXC → Servidor Samba em LXC</strong> para a instalação no contentor privilegiado e a configuração do Samba."
+    ],
+    "calloutOutro": "Os procedimentos guiados tratam das permissões dos contentores sem privilégios, dos perfis de partilha com leitura e escrita, só leitura ou personalizados e do grupo sharedfiles. Este guia descreve os passos manuais para os compreender ou configurar diretamente."
+  },
+  "intro": {
+    "body": "Um disco ou uma pen USB pode ser útil num anfitrião Proxmox, sobretudo num mini PC com poucas opções de expansão interna. Este guia explica:",
+    "stepsTitle": "O que vai fazer",
+    "steps": [
+      "Anexando o disco USB a um LXC privilegiado.",
+      "A instalar o Samba dentro do contentor.",
+      "Partilhar o conteúdo do disco pela LAN."
+    ],
+    "useCasesTitle": "Casos de uso",
+    "useCases": [
+      "Guardar ficheiros torrent e disponibilizá-los na rede.",
+      "Fornecer armazenamento a um servidor multimédia como Plex, Jellyfin ou Emby.",
+      "Guardar documentos processados automaticamente pelo Paperless.",
+      "Armazenamento genérico estilo NAS para a rede doméstica."
+    ],
+    "privilegedCalloutTitle": "Contentor privilegiado para este procedimento",
+    "privilegedCalloutBody": "Este procedimento utiliza um contentor LXC privilegiado com um dispositivo de blocos como <code>mp0</code>. Para contentores sem privilégios, pode montar o sistema de ficheiros no anfitrião e disponibilizar o diretório por bind mount, com permissões e mapeamento de identificadores adequados. Consulte <strong>Armazenamento e partilha → Pontos de montagem LXC</strong> no ProxMenux."
+  },
+  "attach": {
+    "heading": "1. Disponibilizar o disco USB em LXC",
+    "identifyHeading": "1.1 Identificar o dispositivo",
+    "identifyBody": "Compare a lista de discos <strong>antes</strong> e <strong>depois</strong> da ligação USB. O novo dispositivo é o disco pretendido.",
+    "beforeLabel": "Antes:",
+    "afterLabel": "Após:",
+    "imageBeforeAlt": "Lista de disco antes de adicionar unidade USB",
+    "imageAfterAlt": "Lista de disco depois de adicionar unidade USB",
+    "lsblkBody": "Pode também utilizar <code>lsblk -o NAME,SIZE,MODEL,SERIAL</code> para listar dispositivos de blocos com modelo e número de série.",
+    "stableCalloutTitle": "Importante — utilizar um identificador estável",
+    "stableCalloutBody": "O nome <code>/dev/sdb1</code> pode mudar após um reinício, sobretudo com vários discos USB. Procure o identificador persistente:",
+    "stableCalloutCode": "ls -l /dev/disk/by-id/",
+    "stableCalloutAfter": "Utilize a entrada <code>/dev/disk/by-id/usb-...</code> da partição pretendida na configuração LXC, em vez de <code>/dev/sdb1</code>. Escolha a partição, não o disco completo: continuará identificável se a ordem dos dispositivos mudar.",
+    "formatHeading": "1.2 Formatar o disco",
+    "formatBody": "ext4 é adequado para partilhas Linux: distingue maiúsculas e suporta ACL POSIX e ficheiros grandes. A formatação destrói o conteúdo do sistema de ficheiros existente. Confirme a partição e execute o comando no <strong>anfitrião Proxmox</strong>:",
+    "formatCode": "mkfs.ext4 /dev/sdb1",
+    "formatAfter": "Substitua <code>/dev/sdb1</code> pela partição real ou pelo respetivo caminho persistente <code>/dev/disk/by-id/usb-...-part1</code>.",
+    "mkdirHeading": "1.3 Criar o ponto de montagem no contentor LXC",
+    "mkdirBody": "Dentro do LXC, crie o diretório onde o disco irá aparecer (qualquer nome funciona):",
+    "mkdirCode": "mkdir /mnt/lxc_USB",
+    "wireHeading": "1.4 Configurar o dispositivo em LXC",
+    "wireBody": "No <strong>anfitrião Proxmox</strong>, edite a configuração do contentor. Substitua <code>'<'CTID'>'</code> pelo respetivo ID:",
+    "wireEditCode": "nano /etc/pve/lxc/CTID.conf",
+    "wireAddLine": "Adicionar esta linha:",
+    "wireConfigCode": "mp0: /dev/disk/by-id/usb-VENDOR_MODEL_SERIAL-part1,mp=/mnt/lxc_USB,backup=0",
+    "wireShortForm": "Pode também utilizar a entrada curta <code>mp0: /dev/sdb1,mp=/mnt/lxc_USB,backup=0</code> se aceitar o risco de alteração do caminho do dispositivo.",
+    "wireBackupNote": "O exemplo utiliza <code>backup=0</code>. O conteúdo dos pontos de montagem de dispositivos e dos bind mounts não é incluído nas cópias <code>vzdump</code> do contentor. Prepare uma cópia separada dos dados do disco externo.",
+    "restartHeading": "1.5 Reinicie o LXC e defina permissões",
+    "restartBody": "Reinicie o CT para aplicar o ponto de montagem:",
+    "restartCode": "pct reboot CTID",
+    "permsBody": "No contentor LXC, crie a conta da partilha antes de lhe atribuir a propriedade e defina as permissões do diretório:",
+    "permsCode": "adduser --system --group --no-create-home --shell /usr/sbin/nologin proxmenux\nmkdir -p /mnt/lxc_USB\nchown -R proxmenux:proxmenux /mnt/lxc_USB\nchmod 770 /mnt/lxc_USB",
+    "permsNoteTitle": "Observação",
+    "permsNote": "Substitua <code>proxmenux</code> pelo nome escolhido. O modo <code>770</code> permite o acesso ao proprietário e ao grupo, sem acesso para outros; é mais restritivo do que <code>chmod -R 777</code>. A conta é criada aqui e registada no Samba no passo 2.2."
+  },
+  "samba": {
+    "heading": "2. Instalar o Samba",
+    "installHeading": "2.1 Instale o pacote dentro do LXC",
+    "installCode": "apt-get update\napt-get install -y samba",
+    "confirmBody": "Confirme que o serviço está em execução:",
+    "confirmCode": "systemctl status smbd.service",
+    "userHeading": "2.2 Verificar a conta da partilha",
+    "userBody": "A conta de sistema <code>proxmenux</code> foi criada sem shell de início de sessão no passo 1.5. Verifique-a antes de definir a palavra-passe Samba e utilize sempre o nome escolhido:",
+    "userCode": "id proxmenux",
+    "passwordBody": "Defina a palavra-passe Samba, separada da palavra-passe do sistema, pois o Samba mantém o seu próprio armazenamento de credenciais:",
+    "passwordCode": "smbpasswd -a proxmenux",
+    "aclHeading": "2.3 Definir propriedade e ACL",
+    "aclBody": "Se o <code>chown</code> do passo 1.5 for suficiente, as permissões estão prontas. Para vários utilizadores com direitos diferentes no mesmo caminho, utilize ACL:",
+    "aclCode": "apt-get install -y acl\nsetfacl -R -m \"u:proxmenux:rwx\" /mnt/lxc_USB\nsetfacl -d -R -m \"u:proxmenux:rwx\" /mnt/lxc_USB    # default ACL — applies to new files"
+  },
+  "configure": {
+    "heading": "3. Configurar a partilha Samba",
+    "editHeading": "3.1 Editar smb.conf",
+    "editCode": "nano /etc/samba/smb.conf",
+    "appendBody": "Adicione uma definição da partilha no fim do ficheiro:",
+    "shareCode": "[lxc_usb]\n    comment = Shared USB storage\n    path = /mnt/lxc_USB\n    read only = no\n    writable = yes\n    browseable = yes\n    guest ok = no\n    valid users = proxmenux\n    create mask = 0660\n    directory mask = 0770",
+    "validUsersNoteTitle": "Observação",
+    "validUsersNote": "A linha <code>valid users = proxmenux</code> restringe o acesso ao único usuário do Samba. Para acesso baseado em grupo, use <code>valid users = @samba_users</code> após adicionar o(s) usuário(s) a um grupo chamado <code>samba_users</code>.",
+    "reloadHeading": "3.2 Recarregar Samba",
+    "reloadCode": "systemctl restart smbd"
+  },
+  "verify": {
+    "heading": "4. Verificar o acesso",
+    "body": "De qualquer cliente da LAN, navegue até <code>\\\\'<'CT_IP'>'</code> (Windows) ou <code>smb://'<'CT_IP'>'</code> (macOS / gerenciadores de arquivos Linux). Autentique com o usuário Samba (<code>proxmenux</code>) e a senha que você definiu com <code>smbpasswd</code>.",
+    "image1Alt": "Acesso ao servidor Samba de um cliente",
+    "image2Alt": "Pedido de autenticação Samba",
+    "usageBody": "Pode utilizar a partilha no contentor e através da rede:",
+    "image3Alt": "Utilização do disco USB através da partilha"
+  },
+  "troubleshoot": {
+    "heading": "Resolução de Problemas",
+    "items": [
+      "<strong><code>pct reboot</code> falha com “device not found”:</strong> confirme que o caminho em <code>mp0</code> existe no anfitrião. Verifique <code>ls -l /dev/disk/by-id/</code> e corrija o caminho.",
+      "<strong>O contentor arranca, mas <code>/mnt/lxc_USB</code> está vazio:</strong> o disco pode não estar montado ou o sistema de ficheiros pode estar vazio. Verifique no anfitrião com <code>pct exec '<'CTID'>' -- mount | grep lxc_USB</code>. Se a montagem faltar, examine a configuração, o caminho do dispositivo e os erros de arranque.",
+      "<strong>A autenticação Samba funciona, mas a escrita falha com “Permission denied”:</strong> verifique as permissões Linux do diretório e as definições de escrita da partilha. Reveja <code>chown</code> e <code>setfacl</code> nas secções 1.5 e 2.3.",
+      "<strong>A partilha não aparece, mas <code>smb://'<'ip'>'/lxc_usb</code> funciona:</strong> a descoberta NetBIOS antiga utiliza <code>nmbd</code>. O Windows moderno utiliza WS-Discovery; em Debian 12 instale <code>apt-get install -y wsdd</code>; em Debian 13, onde <code>wsdd</code> não está no arquivo estável, use <code>apt-get install -y wsdd2</code>. Verifique o serviço e a firewall. Ativar apenas <code>nmbd</code> não fornece WS-Discovery.",
+      "<strong>Para adicionar outro utilizador à partilha:</strong> crie a conta com <code>adduser</code>, registe-a com <code>smbpasswd -a</code> e adicione-a à lista <code>valid users =</code>, separada por vírgulas. Atribua também as permissões ou ACL necessárias no sistema de ficheiros."
+    ]
+  }
+}
diff --git a/web/messages/pt/guides/nvidia-manual.json b/web/messages/pt/guides/nvidia-manual.json
new file mode 100644
index 00000000..dd97cd62
--- /dev/null
+++ b/web/messages/pt/guides/nvidia-manual.json
@@ -0,0 +1,165 @@
+{
+  "meta": {
+    "title": "Instalar controladores NVIDIA no Proxmox VE 9 — procedimento manual | Guias ProxMenux",
+    "description": "Instale e configure manualmente os drivers NVIDIA num anfitrião Proxmox VE 9 e disponibilize a GPU a um ou mais contentores LXC. Inclui os drivers, o serviço de persistência, a correção NVENC opcional e a configuração de cada contentor.",
+    "ogTitle": "Instalação de drivers NVIDIA no Proxmox VE 9 (procedimento manual)",
+    "ogDescription": "Instalação manual NVIDIA no PVE 9: driver do anfitrião, serviço de persistência, correção NVENC opcional e acesso à GPU em cada contentor LXC."
+  },
+  "header": {
+    "title": "Instalação de drivers de placas gráficas NVIDIA no Proxmox VE 9 (procedimento manual)",
+    "description": "Instale e configure manualmente os drivers NVIDIA num anfitrião Proxmox VE 9 e disponibilize a GPU a um ou mais contentores LXC. Inclui os drivers, o serviço de persistência, a correção NVENC opcional e a configuração de cada contentor.",
+    "section": "Guias"
+  },
+  "intro": {
+    "calloutTitle": "Observação",
+    "calloutBody": "Este procedimento manual fica como referência. Para a maioria dos utilizadores recomenda-se o assistente ProxMenux: <strong>Instalar drivers NVIDIA no anfitrião</strong> em <em>GPU e Coral-TPU</em>, seguido de <strong>Adicionar GPU a LXC</strong> ou <strong>Adicionar GPU a VM</strong> para configurar o convidado. O assistente executa os mesmos passos com verificações adicionais de cabeçalhos do kernel, IOMMU e conflitos VFIO. Esta página ajuda a compreender cada comando ou a adaptar a configuração.",
+    "targetNote": "Destina-se ao <strong>Proxmox VE 9</strong> (Debian Trixie). O PVE 7 (Bullseye) e o PVE 8 (Bookworm) já não são abrangidos.",
+    "stepsTitle": "O que vai fazer",
+    "steps": [
+      "Preparar o anfitrião Proxmox VE 9: bloquear nouveau e verificar repositórios e pré-requisitos.",
+      "Instale o driver NVIDIA no host.",
+      "Instale o serviço de persistência NVIDIA.",
+      "Opcional: aplicar a correção keylase para remover o limite de sessões NVENC simultâneas nas GPU de consumo.",
+      "Disponibilizar a GPU a um ou mais contentores LXC e instalar em cada um a versão correspondente do driver."
+    ]
+  },
+  "prepareHost": {
+    "heading": "1. Preparar a máquina (PVE 9)",
+    "blacklistHeading": "1.1 Bloquear nouveau",
+    "blacklistBody": "Verifique se o driver <code>nouveau</code> de código aberto já está na lista negra:",
+    "blacklistCheckCode": "cat /etc/modprobe.d/blacklist.conf",
+    "blacklistAdd": "Se o <code>blacklist nouveau</code> não aparecer, adicione-o e reinicie:",
+    "blacklistAddCode": "echo \"blacklist nouveau\" >> /etc/modprobe.d/blacklist.conf\nupdate-initramfs -u -k all\nreboot",
+    "blacklistImageAlt": "Verificação da lista negra",
+    "reposHeading": "1.2 Verificar repositórios (PVE 9 / Trixie)",
+    "reposBody": "As ferramentas de pós-instalação podem já ter configurado os repositórios. Verifique primeiro as fontes existentes e ignore alterações já feitas, sem duplicar entradas.",
+    "reposOtherwise": "Caso contrário, numa instalação PVE 9 de origem sem subscrição Enterprise:",
+    "reposEditCode": "nano /etc/apt/sources.list.d/proxmox.sources",
+    "reposPveBody": "Certifique-se de que contém a fonte sem assinatura para Trixie:",
+    "reposPveCode": "Types: deb\nURIs: http://download.proxmox.com/debian/pve\nSuites: trixie\nComponents: pve-no-subscription\nSigned-By: /usr/share/keyrings/proxmox-archive-keyring.gpg",
+    "reposDebianBody": "E as fontes Debian em <code>/etc/apt/sources.list.d/debian.sources</code>:",
+    "reposDebianCode": "Types: deb\nURIs: http://deb.debian.org/debian/\nSuites: trixie trixie-updates\nComponents: main contrib non-free non-free-firmware\nSigned-By: /usr/share/keyrings/debian-archive-keyring.gpg\n\nTypes: deb\nURIs: http://security.debian.org/debian-security/\nSuites: trixie-security\nComponents: main contrib non-free non-free-firmware\nSigned-By: /usr/share/keyrings/debian-archive-keyring.gpg",
+    "updateHeading": "1.3 Atualizar o sistema e instalar pré-requisitos",
+    "updateCode": "apt update && apt dist-upgrade -y",
+    "buildToolsBody": "Instale as ferramentas de compilação e os cabeçalhos do kernel necessários para compilar o módulo do kernel NVIDIA:",
+    "buildToolsCode": "apt-get install -y git\napt-get install -qqy pve-headers-$(uname -r) gcc make"
+  },
+  "installDriver": {
+    "heading": "2. Instale o driver NVIDIA na máquina",
+    "pickHeading": "2.1 Escolha uma versão do driver",
+    "pickBody": "Escolha um ramo do driver compatível com a GPU e o kernel em execução. O mais recente pode não suportar GPU antigas; verifique a lista de produtos da versão NVIDIA escolhida:",
+    "pickUrlCode": "https://download.nvidia.com/XFree86/Linux-x86_64/latest.txt",
+    "nvencCallout": "Se você planeja aplicar o patch NVENC (passo 4), verifique se o patch suporta sua versão escolhida primeiro: <patchLink>github.com/keylase/nvidia-patch</patchLink>",
+    "nvencCalloutTitle": "Aviso",
+    "pickReplace": "Substitua <code>latest.txt</code> no URL pelo número de versão para encontrar o instalador terminado em <code>.run</code>. Lista completa dos drivers:",
+    "pickListCode": "https://download.nvidia.com/XFree86/Linux-x86_64/",
+    "pickImageAlt": "Transferência do driver NVIDIA",
+    "pickVersionNote": "Ao longo do resto deste guia, substitua <code>'<'VERSION'>'</code> pela versão atual (por exemplo <code>580.95.05</code>).",
+    "downloadHeading": "2.2 Baixe e execute o instalador",
+    "downloadCode": "mkdir -p /opt/nvidia\ncd /opt/nvidia\nwget https://download.nvidia.com/XFree86/Linux-x86_64/VERSION/NVIDIA-Linux-x86_64-VERSION.run\nchmod +x NVIDIA-Linux-x86_64-VERSION.run",
+    "firstPassBody": "Execute o instalador. A opção seguinte pode desativar <code>nouveau</code> se necessário; poderá ser preciso reiniciar antes de concluir a instalação:",
+    "firstPassCode": "./NVIDIA-Linux-x86_64-VERSION.run --no-questions --ui=none --disable-nouveau\nreboot",
+    "secondPassBody": "Depois que o host voltar, execute o instalador novamente para compilar e instalar o módulo do kernel:",
+    "secondPassCode": "/opt/nvidia/NVIDIA-Linux-x86_64-VERSION.run --no-questions --ui=none",
+    "modulesHeading": "2.3 Carregar módulos NVIDIA no arranque",
+    "modulesBody": "Edite a configuração de carregamento dos módulos:",
+    "modulesEditCode": "nano /etc/modules-load.d/modules.conf",
+    "modulesAddBody": "Adicione os módulos NVIDIA para o anfitrião e LXC. Os módulos VFIO destinam-se à passagem direta para VM e não são necessários aqui:",
+    "modulesAddCode": "nvidia\nnvidia_uvm",
+    "modulesSaveBody": "Salvar (<code>Ctrl+X</code>) e reconstruir initramfs:",
+    "modulesSaveCode": "update-initramfs -u -k all",
+    "udevHeading": "2.4 Criar regras udev",
+    "udevBody": "Para criar os nós dos dispositivos <code>/dev/nvidia*</code> quando os módulos são carregados:",
+    "udevEditCode": "nano /etc/udev/rules.d/70-nvidia.rules",
+    "udevRulesCode": "# /etc/udev/rules.d/70-nvidia.rules\nKERNEL==\"nvidia\", RUN+=\"/bin/bash -c '/usr/bin/nvidia-smi -L'\"\nKERNEL==\"nvidia_uvm\", RUN+=\"/bin/bash -c '/usr/bin/nvidia-modprobe -c0 -u'\"",
+    "udevSaveBody": "Gravar (<code>Ctrl+X</code>)."
+  },
+  "persistence": {
+    "heading": "3. Serviço de persistência NVIDIA",
+    "body": "O serviço de persistência mantém a GPU inicializada quando nenhuma outra aplicação a utiliza. Reduz a latência de reinicialização e conserva esse estado entre clientes:",
+    "installCode": "cd /opt/nvidia\ngit clone https://github.com/NVIDIA/nvidia-persistenced.git\ncd nvidia-persistenced/init\n./install.sh\nreboot",
+    "verifyBody": "Após reiniciar, confirme que o driver está carregado e o serviço ativo:",
+    "verifySmiCode": "nvidia-smi",
+    "smiImageAlt": "Saída NVIDIA SMI",
+    "verifyServiceCode": "systemctl status nvidia-persistenced",
+    "serviceImageAlt": "Estado do serviço de persistência NVIDIA"
+  },
+  "nvenc": {
+    "heading": "4. Opcional: remover o limite de sessões NVENC simultâneas",
+    "body": "O limite de sessões NVENC depende do modelo de GPU e da versão do driver. Consulte a matriz NVIDIA, em vez de presumir um número por geração. A correção keylase remove o limite de software nos drivers suportados e pode ajudar na transcodificação Plex ou Jellyfin.",
+    "code": "cd /opt/nvidia\ngit clone https://github.com/keylase/nvidia-patch.git\ncd nvidia-patch\n./patch.sh",
+    "imageAlt": "Aplicação de patch NVIDIA",
+    "after": "Volte a aplicar a correção após cada atualização do driver. O repositório keylase inclui ainda <code>patch-fbc.sh</code> para FBC, a captura do framebuffer."
+  },
+  "lxcSetup": {
+    "heading": "5. Configurar o acesso à GPU num contentor LXC",
+    "identifyHeading": "5.1 Identificar os números de dispositivo",
+    "identifyBody": "Na máquina:",
+    "identifyCode": "ls -l /dev/nv*",
+    "identifyImageAlt": "Lista de dispositivos NVIDIA",
+    "identifyNote": "Anote os números major dos dispositivos: podem variar entre sistemas. Valores típicos:",
+    "tableHeaders": {
+      "device": "Dispositivo",
+      "major": "Número major típico"
+    },
+    "tableRows": [
+      {
+        "device": "<code>/dev/nvidia0</code>, <code>/dev/nvidiactl</code>",
+        "major": "195"
+      },
+      {
+        "device": "<code>/dev/nvidia-uvm</code>, <code>/dev/nvidia-uvm-tools</code>",
+        "major": "509 (variável)"
+      },
+      {
+        "device": "<code>/dev/dri/*</code>",
+        "major": "226"
+      },
+      {
+        "device": "<code>/dev/nvidia-modeset</code>",
+        "major": "195 (partilhado com nvidia)"
+      }
+    ],
+    "editHeading": "5.2 Editar a configuração do LXC",
+    "editBody": "Pare o contentor se estiver em execução. Abra a configuração, substituindo <code>'<'CTID'>'</code> pelo respetivo ID:",
+    "editCode": "nano /etc/pve/lxc/CTID.conf",
+    "editConfigBody": "Comente apenas as linhas <code>lxc.cgroup2.devices.allow</code> ou <code>/dev/dri</code> que realmente entrem em conflito. Adicione a configuração NVIDIA e ajuste os números major aos dispositivos NVIDIA mostrados por <code>ls -l /dev/nv*</code> no <strong>seu</strong> anfitrião:",
+    "editConfigCode": "lxc.cgroup2.devices.allow: c 195:* rwm\nlxc.cgroup2.devices.allow: c 509:* rwm\nlxc.mount.entry: /dev/nvidia0 dev/nvidia0 none bind,optional,create=file\nlxc.mount.entry: /dev/nvidiactl dev/nvidiactl none bind,optional,create=file\nlxc.mount.entry: /dev/nvidia-uvm dev/nvidia-uvm none bind,optional,create=file\nlxc.mount.entry: /dev/nvidia-modeset dev/nvidia-modeset none bind,optional,create=file\nlxc.mount.entry: /dev/nvidia-uvm-tools dev/nvidia-uvm-tools none bind,optional,create=file",
+    "editConfigImageAlt": "Configuração do LXC",
+    "editSave": "Guarde o ficheiro, saia com <code>Ctrl+X</code> e inicie o contentor.",
+    "installCtHeading": "5.3 Instalar o driver no contentor",
+    "installCtCalloutTitle": "Importante",
+    "installCtCalloutBody": "Esta parte é executada <strong>no contentor</strong>, não no anfitrião.",
+    "installCtBody": "O módulo do kernel já está carregado no anfitrião. O contentor só precisa das bibliotecas em espaço de utilizador da mesma versão do driver:",
+    "installCtCode": "mkdir -p /opt/nvidia\ncd /opt/nvidia\nwget https://download.nvidia.com/XFree86/Linux-x86_64/VERSION/NVIDIA-Linux-x86_64-VERSION.run\nchmod +x NVIDIA-Linux-x86_64-VERSION.run\n./NVIDIA-Linux-x86_64-VERSION.run --no-kernel-module",
+    "installCtAfter": "Leia as perguntas e limite esta instalação às bibliotecas em espaço de utilizador. Não compile nem instale módulos do kernel dentro do LXC.",
+    "installCtImageAlt": "Instalação do driver NVIDIA",
+    "verifyCtHeading": "5.4 Verificar no contentor",
+    "verifyCtSmiCode": "nvidia-smi",
+    "verifyCtSmiImageAlt": "NVIDIA SMI em LXC",
+    "verifyCtLsCode": "ls -l /dev/nv*",
+    "verifyCtLsImageAlt": "Dispositivos NVIDIA em LXC",
+    "verifyCtAfter": "A GPU deverá aparecer na lista e os nós dos dispositivos no sistema de ficheiros do contentor.",
+    "workloadHeading": "5.5 Confirmar a utilização da GPU com uma carga real",
+    "workloadBody": "Ative a aceleração NVIDIA no Plex ou Jellyfin, inicie uma transcodificação e confirme a utilização real da GPU no painel ou nos registos. Instalar o driver não ativa automaticamente a aceleração na aplicação.",
+    "workloadImage1Alt": "Plex usando NVIDIA GPU",
+    "workloadImage2Alt": "Plex usando NVIDIA GPU - sessão ativa",
+    "repeatNote": "Repita a <strong>secção 5</strong> para cada contentor adicional que precise da GPU. Quando atualizar o driver do anfitrião, mantenha alinhadas as bibliotecas em espaço de utilizador de todos os contentores."
+  },
+  "docker": {
+    "heading": "6. (Opcional) NVIDIA Docker dentro de um LXC",
+    "body": "Se o Docker já funciona no LXC, instale aí <code>nvidia-container-toolkit</code> para disponibilizar a GPU aos contentores Docker. O acesso à GPU a partir do LXC deve funcionar primeiro. Estes comandos destinam-se a Docker executado como root:",
+    "code": "apt-get update\napt-get install -y ca-certificates curl gnupg\ncurl -fsSL https://nvidia.github.io/libnvidia-container/gpgkey | gpg --dearmor --yes -o /usr/share/keyrings/nvidia-container-toolkit-keyring.gpg\ncurl -fsSL https://nvidia.github.io/libnvidia-container/stable/deb/nvidia-container-toolkit.list | sed 's#deb https://#deb [signed-by=/usr/share/keyrings/nvidia-container-toolkit-keyring.gpg] https://#g' > /etc/apt/sources.list.d/nvidia-container-toolkit.list\napt-get update\napt-get install -y nvidia-container-toolkit\nnvidia-ctk runtime configure --runtime=docker\nsystemctl restart docker",
+    "after": "Os comandos configuram o repositório NVIDIA, instalam o toolkit, configuram o runtime Docker e reiniciam o Docker. Mantêm-se as permissões dos dispositivos e as restrições cgroup do LXC; confirme a GPU com uma carga de teste."
+  },
+  "troubleshoot": {
+    "heading": "Resolução de Problemas",
+    "items": [
+      "<strong><code>nvidia-smi</code> funciona no anfitrião, mas apresenta “No devices found” no contentor:</strong> verifique montagens, permissões e versões das bibliotecas. Se diferirem, instale no contentor a mesma <code>'<'VERSION'>'</code> do anfitrião com <code>--no-kernel-module</code>.",
+      "<strong>A compilação do driver falha:</strong> consulte o registo. “No precompiled kernel interface was found” pode apenas indicar que é necessária compilação local. Instale os cabeçalhos correspondentes a <code>uname -r</code> com <code>apt-get install pve-headers-$(uname -r)</code> ou o pacote proxmox-headers equivalente.",
+      "<strong>As sessões NVENC continuam limitadas:</strong> confirme que a correção suporta o driver ativo. Uma atualização pode substituí-la. Para uma versão compatível, volte a executar <code>./patch.sh</code> em <code>/opt/nvidia/nvidia-patch</code> e verifique a saída.",
+      "<strong>A GPU deixa de responder após inatividade:</strong> verifique <code>systemctl status nvidia-persistenced</code> e ative o serviço se necessário. Consulte também os registos do kernel e do driver; não é a única causa possível.",
+      "<strong>O contentor arranca, mas <code>ls /dev/nv*</code> não mostra dispositivos NVIDIA:</strong> verifique os bind mounts e os caminhos no anfitrião. Utilize <code>ls -l /dev/nv*</code> para confirmar os números major NVIDIA e verifique as regras <code>lxc.cgroup2.devices.allow</code> e as permissões."
+    ]
+  }
+}
diff --git a/web/messages/sk/common.json b/web/messages/sk/common.json
index 1c34e6b1..b95d8c96 100644
--- a/web/messages/sk/common.json
+++ b/web/messages/sk/common.json
@@ -28,7 +28,12 @@
     "switcher": "Jazyk",
     "en": "English",
     "es": "Español",
-    "sk": "Slovenčina"
+    "sk": "Slovenčina",
+    "de": "Deutsch",
+    "fr": "Français",
+    "it": "Italiano",
+    "pt": "Português",
+    "sv": "Svenska"
   },
   "resources": {
     "documentation": {
@@ -193,7 +198,15 @@
       "backupRestoreJobs": "Plánované úlohy",
       "backupRestoreRestoring": "Obnova",
       "backupRestoreCrossKernel": "Obnova medzi kernelmi",
-      "backupRestoreGlossary": "Slovník pojmov"
+      "backupRestoreGlossary": "Slovník pojmov",
+      "dashboardApps": "Karta Aplikácie",
+      "auditReport": "Audit a správy",
+      "auditReportOverview": "Prehľad",
+      "auditReportAssessment": "Hodnotenie a inventár",
+      "auditReportPolicy": "Pravidlá",
+      "auditReportChanges": "Zmeny",
+      "auditReportReports": "Správy a porovnania",
+      "auditReportScope": "Rozsah a záruky"
     }
   },
   "hero": {
diff --git a/web/messages/sk/docs/about/code-of-conduct.json b/web/messages/sk/docs/about/code-of-conduct.json
new file mode 100644
index 00000000..e46fc339
--- /dev/null
+++ b/web/messages/sk/docs/about/code-of-conduct.json
@@ -0,0 +1,13 @@
+{
+  "meta": {
+    "title": "Pravidlá správania | Dokumentácia ProxMenux",
+    "description": "Kódex správania ProxMenux a najlepšie postupy pre prispievateľov, testerov a používateľov.",
+    "ogTitle": "Pravidlá správania | Dokumentácia ProxMenux",
+    "ogDescription": "Očakávania týkajúce sa zodpovednosti za kód, oznamovania bezpečnostných chýb a rozsahu PR v projekte ProxMenux."
+  },
+  "errors": {
+    "notFound": "Chyba: Súbor CODE_OF_CONDUCT.md nebol nájdený.",
+    "loadFailed": "Chyba: Nemožno načítať obsah kódexu správania."
+  },
+  "contentMarkdown": "# 📝 Kódex správania a odporúčané postupy\n\nTento dokument stanovuje **zásady a usmernenia** na používanie **ProxMenuxu** s cieľom podporovať **rešpekt, spoluprácu a bezpečnosť** pri vývoji.\n\n## 📌 1. Uvedenie autorstva kódu a uznanie\n\n- Pri použití **skriptov, úryvkov kódu alebo nápadov** z iných repozitárov či od iných vývojárov bude vždy uvedený pôvodný autor.\n- V kóde alebo dokumentácii bude komentár s uvedením zdroja a podľa možnosti s odkazom na pôvodný repozitár.\n- Pri použití kódu s konkrétnou **licenciou** je potrebné dodržať jej podmienky.\n\n### ✅ Príklad správneho uvedenia zdroja v kóde:\n\n```bash\n# Skript vychádza z práce [Autor] v [Odkaz na repozitár]\n```\n\n## 🔒 2. Bezpečnosť a zodpovednosť za kód\n\n- Všetok kód v tomto repozitári dodržiava odporúčané postupy bezpečného vývoja.\n- Príspevky, ktoré úmyselne zavádzajú zraniteľnosti alebo nebezpečné postupy, nie sú povolené.\n- Skripty nikdy nesmú ohroziť bezpečnosť systému ani údaje používateľov.\n- Pred implementáciou je potrebné príspevky skontrolovať z hľadiska bezpečnosti a stability.\n\n### ⚠️ Zodpovedné nahlasovanie zraniteľností\n\nAk objavíte bezpečnostnú zraniteľnosť, NEHLÁSTE ju vo verejných issues ani na fórach.\n\nNamiesto toho ju nahláste súkromne e-mailom:\n\n📧 proxmenux@macrimi.pro\n\nPodrobnosti o bezpečnostných zraniteľnostiach a ich nahlasovaní nájdete v našich [bezpečnostných zásadách](./SECURITY.md).\n\n## 🤝 3. Pravidlá komunity\n\nNa zachovanie rešpektujúceho a profesionálneho prostredia musia všetci používatelia dodržiavať tieto pravidlá:\n\n- ✅ V diskusiách buďte úctiví a konštruktívni.\n- ❌ Obťažovanie, nenávistné prejavy ani urážlivé správanie sa nebudú tolerovať.\n- ✅ Spätnú väzbu poskytujte profesionálne a bez osobných útokov.\n- ❌ Porušenie pravidiel môže podľa závažnosti viesť k upozorneniu alebo vylúčeniu.\n\n##\n\nTento dokument podporuje etické používanie kódu, povedomie o bezpečnosti a rešpektujúcu komunitu.\n\n📢 Vytvorme spolu niečo skvelé!\n"
+}
diff --git a/web/messages/sk/docs/about/contributing.json b/web/messages/sk/docs/about/contributing.json
new file mode 100644
index 00000000..b92d38f7
--- /dev/null
+++ b/web/messages/sk/docs/about/contributing.json
@@ -0,0 +1,293 @@
+{
+  "meta": {
+    "title": "Prispievanie k ProxMenux | ProxMenux Dokumentácia",
+    "description": "Ako prispieť do ProxMenux: model vetiev (main / develop / feature/*), postup pull requestu, hlavička skriptu s autorstvom a voliteľným odkazom na podporu, dvojfázové rozhranie, funkcie správ a cesta od vetvy funkcie po stabilné vydanie.",
+    "ogTitle": "Prispievanie k ProxMenux",
+    "ogDescription": "Model vetiev, pracovný postup, autorstvo v hlavičke a dvojfázové rozhranie, ktoré musia prispievatelia dodržiavať."
+  },
+  "header": {
+    "title": "Prispievanie k ProxMenux",
+    "description": "ProxMenux víta príspevky komunity: nové skripty, opravy existujúcich, vylepšenia dialógov, preklady aj integrácie. Táto stránka vysvetľuje štruktúru repozitára, model vetiev a postup pull requestu, hlavičku skriptu s autorstvom a voliteľným odkazom na podporu aj pravidlá návrhu pre každý príspevok.",
+    "section": "O projekte"
+  },
+  "twoPagesCallout": {
+    "title": "Dve súvisiace stránky, jeden projekt",
+    "body": "Nemýľte si túto stránku s <contributorsLink>Prispievateľmi</contributorsLink>: tá oslavuje ľudí, ktorí už prispievajú (testeri, recenzenti, vývojári). Táto stránka je pre <em>vás</em> – potenciálneho prispievateľa – a vysvetľuje, ako poslať PR, ktoré bude zlúčené."
+  },
+  "branching": {
+    "heading": "Model vetiev",
+    "intro": "ProxMenux používa trojstupňový vetviaci model:",
+    "headerBranch": "Vetva",
+    "headerPurpose": "Účel",
+    "rows": [
+      {
+        "branch": "main",
+        "purposeRich": "Stabilný kód pripravený na produkciu. Sem sa začleňujú iba zmeny pripravené na vydanie. Túto verziu dostanú používatelia pri bežnej inštalácii ProxMenux."
+      },
+      {
+        "branch": "develop",
+        "purposeRich": "Aktívna vývojová vetva. Všetky nové zmeny sa najskôr začleňujú sem; ide o kanál „beta“. Keď je stabilné vydanie pripravené, z tejto vetvy sa prenesie do <code>main</code>."
+      },
+      {
+        "branch": "feature/*",
+        "purposeRich": "Krátkodobé vetvy pre funkciu, opravu alebo vylepšenie. Vzniknú z <code>develop</code> a po kontrole sa cez pull request zlúčia späť do <code>develop</code>."
+      }
+    ],
+    "calloutTitle": "Čo to znamená pre užívateľov",
+    "calloutBody": "Používatelia vetvy <code>main</code> dostávajú otestované vydania. Kto chce nové funkcie skôr a znesie občasné nedostatky, môže sledovať <code>develop</code>. Nové funkcie vždy najprv prejdú cez <code>develop</code>; bez tohto cyklu sa do <code>main</code> nedostanú."
+  },
+  "workflow": {
+    "heading": "Postup pull requestu",
+    "intro": "Od nápadu po začlenenie do vydania v piatich krokoch:",
+    "step1Lead": "<strong>Vytvorte vetvu pre funkciu z <code>develop</code></strong>:",
+    "step1Code": "git clone https://github.com/MacRimi/ProxMenux.git\ncd ProxMenux\ngit checkout develop\ngit pull origin develop\ngit checkout -b feature/your-feature-name",
+    "step1Trail": "Použite výstižný názov vetvy: <code>feature/zfs-arc-tuning</code>, <code>feature/fix-iommu-detection</code>, <code>feature/add-tailscale-script</code>.",
+    "step2Lead": "<strong>Pracujte na svojich zmenách a posuňte vetvu:</strong>",
+    "step2Code": "# Make your changes, then:\ngit add scripts/...\ngit commit -m \"Add ZFS ARC tuning script\"\ngit push -u origin feature/your-feature-name",
+    "step3": "<strong>Otvorte pull request do <code>develop</code></strong>, nie do <code>main</code>. Na GitHube overte, že základná vetva je <code>develop</code>. Opíšte účel skriptu, jeho zmeny a verzie Proxmox VE, na ktorých ste ho testovali.",
+    "step4": "<strong>Po kontrole sa zmeny zlúčia do <code>develop</code>.</strong> Správca skontroluje kvalitu kódu, hlavičky a dvojfázové rozhranie. Ak vyžiada úpravy, odošlite ďalšie commity do rovnakej vetvy; PR sa aktualizuje automaticky.",
+    "step5": "<strong>Stabilné vydania sa prenášajú z <code>develop</code> do <code>main</code>.</strong> Pri vydaní sa <code>main</code> posunie na <code>develop</code> pomocou fast-forward a označí sa tagom. Váš príspevok sa stane súčasťou ďalšej stabilnej verzie."
+  },
+  "scriptHeader": {
+    "heading": "Hlavička skriptu: metadáta a popis",
+    "intro": "Každý skript ProxMenux začína dvoma susednými blokmi komentárov, ktoré tvoria hlavičku. <strong>Oba sú povinné</strong>: prezradia autora a účel bez potreby čítať samotný kód.",
+    "bullets": [
+      "<strong>Horný blok: metadáta.</strong> Autor, voliteľné odkazy na GitHub a podporu, správca, autorské práva, licencia, verzia a dátum aktualizácie. Tu prebieha aj <em>uznanie prispievateľov</em>: pri novom skripte uveďte svoje meno a voliteľne stránku GitHub a profil podpory, napríklad Ko-fi, GitHub Sponsors alebo Buy Me a Coffee.",
+      "<strong>Dolný blok: popis.</strong> Krátky odsek v jednoduchej angličtine vysvetľuje skript. Číta sa <em>pred</em> kódom a musí sám objasniť účel, hlavné akcie, dotknuté zdroje a predpoklady."
+    ],
+    "licenseCalloutTitle": "Licenčná linka je pevne stanovená GPL-3.0",
+    "licenseCalloutBody": "ProxMenux je vydaný pod <strong>GNU General Public License v3.0</strong>. Všetky skripty používajú rovnakú licenciu; riadok <code>License</code> v hlavičke musí obsahovať odkaz GPL-3.0 z príkladu nižšie. Nie je to voľba pre jednotlivý skript. Prispením súhlasíte s vydaním pod GPL-3.0: každý môže skript čítať, upraviť a ďalej šíriť vrátane zmien pri zachovaní rovnakej licencie. Úplné znenie: <licenseLink>MacRimi/ProxMenux/LICENSE</licenseLink>.",
+    "templateCode": "#!/bin/bash\n\n# ==========================================================\n# ProxMenux - A menu-driven script for Proxmox VE management\n# ==========================================================\n# Author      : Your Name\n# GitHub      : github.com/yourhandle\n# Sponsor     : ko-fi.com/yourhandle\n# Maintainer  : MacRimi\n# Copyright   : (c) 2026 MacRimi & contributors\n# License     : (GPL-3.0) (https://github.com/MacRimi/ProxMenux/blob/main/LICENSE)\n# Version     : 1.0\n# Last Updated: DD/MM/YYYY\n# ==========================================================\n# Description:\n# Short paragraph explaining what the script does.\n# Mention the main actions (e.g. \"creates a ZFS pool\",\n# \"configures IOMMU and reboots\", \"imports an ISO into a VM\"),\n# the resources it touches, and any prerequisites the user\n# should be aware of before running it.\n# ==========================================================",
+    "optionalNote": "Riadky <code>GitHub</code> a <code>Sponsor</code> sú voliteľné – vynechajte ich, ak ich nechcete zverejniť. Všetko ostatné sa vyžaduje.",
+    "whyCalloutTitle": "Prečo na tom záleží",
+    "whyCalloutBody": "Prispievanie do otvoreného softvéru je dobrovoľná práca. Meno a prípadný odkaz na podporu priamo v zdrojovom kóde zviditeľňujú autorstvo pri každom čítaní; nestratí sa za názvom projektu. Popis má iný význam: je prvou vecou, ktorú číta budúci správca alebo zvedavý používateľ. Jasný popis často rozhoduje, či skriptu dôverujú alebo sa mu vyhnú."
+  },
+  "structure": {
+    "heading": "Štruktúra projektu",
+    "intro": "Kde sa v repozitári nachádzajú jednotlivé druhy skriptov:",
+    "treeCode": "scripts/\n├── menus/              # Top-level menu scripts (entry points)\n├── storage/            # Disk, storage and passthrough scripts\n├── share/              # NFS, Samba, local share scripts\n├── vm/                 # VM creation and configuration scripts\n├── gpu_tpu/            # GPU / TPU passthrough scripts\n├── post_install/       # Post-install automation scripts\n├── backup_restore/     # Backup and restore scripts\n├── utilities/          # System utility scripts\n├── global/             # Shared helper libraries (sourced by other scripts)\n├── utils.sh            # Shared utility functions and message helpers\n└── help_info_menu.sh   # Interactive help and command reference",
+    "outro": "Každý skript pri štarte načíta <code>utils.sh</code> pomocou source, aby získal funkcie správ, indikátor priebehu, farby a prekladový systém. Zdieľané pomocné knižnice v <code>scripts/global/</code> výslovne načítavajú skripty, ktoré ich potrebujú."
+  },
+  "twoPhase": {
+    "heading": "Dvojfázová politika návrhu UI",
+    "intro": "Ide o najdôležitejšie pravidlo ProxMenux a najčastejší dôvod požiadaviek na úpravu PR. Každý skript je rozdelený na <strong>presne dve fázy</strong>:",
+    "headerPhase": "Fáza",
+    "headerPurpose": "Účel",
+    "headerScreen": "Stav obrazovky",
+    "rows": [
+      {
+        "phaseRich": "<strong>Fáza 1: výber</strong>",
+        "purposeRich": "Zbierajte každé rozhodnutie užívateľa. Spustite všetky potrebné prípravné práce (sondy, skeny, kontroly).",
+        "screenRich": "Prekrytia <code>dialog</code>. Ak kontrola medzi ponukami trvá viac ako sekundu či dve, zobrazte indikátor <code>msg_info</code>, aby používateľ vedel, že skript nezamrzol. Tesne pred ďalším dialógom zavolajte <code>stop_spinner</code>."
+      },
+      {
+        "phaseRich": "<strong>Fáza 2: vykonanie</strong>",
+        "purposeRich": "Vykonajte všetky operácie. Na obrazovke postupne zobrazujte úplnú históriu priebehu.",
+        "screenRich": "Viditeľné hlásenia <code>msg_info</code> / <code>msg_ok</code>; nikdy nie <code>dialog</code>."
+      }
+    ],
+    "principle": "Zásada: <strong>najprv zhromaždiť všetky voľby, potom všetko vykonať</strong>. Používateľ najprv pracuje s prehľadným dialógovým menu (fáza 1) a potom sleduje vykonávanie vo forme záznamu (fáza 2). Fázy sa nemiešajú: počas vykonávania sa neotvárajú dialógy a počas výberu sa nevypisuje priebeh.",
+    "phase1Heading": "Fáza 1: typický vzor",
+    "phase1Code": "# Silent preparatory work between dialogs\nmsg_info \"$(translate \"Checking disk assignments...\")\"\nASSIGNED_TO=$(check_assignments \"$DISK\")\nstop_spinner   # ← clears line silently, result saved in variable\n\n# Next dialog can now use ASSIGNED_TO\nif [ -n \"$ASSIGNED_TO\" ]; then\n    dialog --yesno \"$(translate \"Disk already assigned. Continue?\")\" $UI_YESNO_H $UI_YESNO_W\nfi\n\n# Collect multiple decisions per item with parallel arrays\ndeclare -a DISK_LIST=()\ndeclare -a DISK_FORMAT_TYPES=()\ndeclare -a DISK_MOUNT_POINTS=()\nfor DISK in $SELECTED; do\n    msg_info \"$(translate \"Analyzing disk...\")\"\n    CURRENT_FS=$(lsblk -no FSTYPE \"$DISK\" | xargs)\n    stop_spinner\n\n    FORMAT=$(dialog --backtitle \"$BACKTITLE\" \\\n        --title \"$(translate \"Select Filesystem\")\" \\\n        --menu \"...\" $UI_SHORT_MENU_H $UI_SHORT_MENU_W $UI_SHORT_MENU_LIST_H \\\n        \"ext4\" \"...\" \"xfs\" \"...\" \"btrfs\" \"...\" \\\n        2>&1 >/dev/tty)\n    [ -z \"$FORMAT\" ] && continue\n\n    DISK_LIST+=(\"$DISK\")\n    DISK_FORMAT_TYPES+=(\"$FORMAT\")\ndone",
+    "phase1RulesIntro": "<strong>Pravidlá pre fázu 1:</strong>",
+    "phase1Rules": [
+      "Ak beží indikátor <code>msg_info</code> a potrebujete otvoriť ponuku <code>dialog</code> alebo <code>whiptail</code>, najprv zavolajte <code>stop_spinner</code>. Indikátor nemôže bežať súčasne s prekrytím týchto nástrojov. Ak indikátor nebeží, volanie nie je potrebné.",
+      "Použite <code>show_proxmenux_logo</code> + <code>msg_title</code> + <code>msg_info</code> na vizuálny kontext dlhej operácie vo fáze 1, napríklad kontroly trvajúcej päť sekúnd či viac. Funkcia už vyčistí obrazovku, preto pred ňou nevolajte <code>clear</code>.",
+      "Nevolajte <code>show_proxmenux_logo</code> medzi dialógovými menumi, kde nie je čo zobraziť, a vyčistenie obrazovky prázdneho terminálu je len vizuálny hluk.",
+      "Uložte všetky rozhodnutia a výsledky sondy v premenných alebo paralelných poliach. Viditeľné zhrnutie sa uskutoční na začiatku fázy 2, nie vo fáze 1."
+    ],
+    "phase2Heading": "Fáza 2: typický vzor",
+    "phase2Code": "# ── PHASE 2 — EXECUTION ─────────────────────────────\nshow_proxmenux_logo\nmsg_title \"$(translate \"My Script Title\")\"\n\n# Recap Phase 1 preparatory results — show what was already done\nmsg_ok \"$(translate \"CT $CTID selected.\")\"\nmsg_ok \"$(translate \"Repositories verified.\")\"\nmsg_ok \"$(translate \"Disks to process: ${#DISK_LIST[@]}\")\"\n\n# Now execute operations\nfor i in \"${!DISK_LIST[@]}\"; do\n    DISK=\"${DISK_LIST[$i]}\"\n    FORMAT=\"${DISK_FORMAT_TYPES[$i]}\"\n\n    msg_info \"$(translate \"Formatting\") $DISK $(translate \"as\") $FORMAT...\"\n    mkfs.\"$FORMAT\" \"$DISK\" >/dev/null 2>&1\n    msg_ok \"$(translate \"Formatted.\")\"\ndone\n\nmsg_ok \"$(translate \"Completed. ${#DISK_LIST[@]} disk(s) processed.\")\"\nmsg_success \"$(translate \"Press Enter to return to menu...\")\"\nread -r",
+    "phase2Rules": "<strong>Pravidlá fázy 2:</strong> začnite s <code>show_proxmenux_logo + msg_title</code> a hneď zhrňte výsledky fázy 1 riadkami <code>msg_ok</code>. Už nevolajte <code>show_proxmenux_logo</code>, pretože by vymazalo nahromadený priebeh. Nevolajte <code>dialog</code>; pri nevyhnutnom rozhodnutí za behu použite <code>whiptail</code> podľa nasledujúcej časti."
+  },
+  "dialogVsWhiptail": {
+    "headingRich": "Kedy používať <code>dialog</code> vs <code>whiptail</code>",
+    "intro": "Oba nástroje vykresľujú textové používateľské rozhranie, ale na obrazovke sa správajú odlišne. ProxMenux ich preto používa v dvoch samostatných fázach.",
+    "headerTool": "Nástroj",
+    "headerWhen": "Kedy ju použiť",
+    "headerEffect": "Účinok na obrazovku",
+    "rows": [
+      {
+        "toolRich": "<strong><code>dialog</code></strong>",
+        "whenRich": "<strong>Vždy vo fáze 1.</strong> Každý interaktívny výber, napríklad VM, disk, súborový systém alebo potvrdenie akcie, používa <code>dialog</code>. Ide o predvolený nástroj rozhrania ProxMenux.",
+        "effectRich": "Preberá terminál: vyčistí obrazovku, kreslí jej prekrývanie a pri zatvorení vráti terminál do svojho predchádzajúceho stavu. Fáza 1, pretože zatiaľ nič užitočné neukazuje."
+      },
+      {
+        "toolRich": "<strong><code>whiptail</code></strong>",
+        "whenRich": "<strong>Iba vo fáze 2, iba ak je to nevyhnutné.</strong> Typickým prípadom je výzva na reštartovanie na konci vykonávania. Nesiahajte po <code>whiptail</code>, aby ste sa spýtali „pokračovať?“ uprostred vykonávania — toto rozhodnutie malo byť urobené vo fáze 1.",
+        "effectRich": "Ľahšie prekrytie, ktoré <em>nevymaže</em> kontext terminálu. Nahromadená história <code>msg_ok</code>/<code>msg_info</code> z fázy 2 zostane viditeľná za dialógom. Preto je vhodné, keď už obrazovka zobrazuje priebeh."
+      }
+    ],
+    "calloutTitle": "Prečo je rozdelenie dôležité",
+    "calloutBody": "Ak zavoláte <code>dialog</code> uprostred fázy 2, zmiznú všetky riadky <code>msg_ok</code>, ktoré používateľ dovtedy sledoval. Vymažete tým viditeľný záznam vykonaných krokov. <code>whiptail</code> tomu zabráni. Pravidlo teda nie je svojvoľné: zachováva používateľovi prehľad o tom, čo skript doteraz urobil.",
+    "rebootHeading": "Výzva na reštart: typické použitie whiptail vo fáze 2",
+    "rebootIntro": "Ak môže byť po skončení skriptu potrebný reštart, napríklad po zapnutí IOMMU alebo zmene parametrov jadra, výzva na konci fázy 2 používa <code>whiptail</code>. Vždy pridajte vetvu Nie, ktorá upozorní, aby používateľ nepoužíval dotknutý zdroj pred reštartom:",
+    "rebootCode": "if [[ \"$HOST_REBOOT_REQUIRED\" == \"yes\" ]]; then\n  echo \"\"\n  if whiptail --title \"$(translate \"Reboot Required\")\" --yesno \\\n    \"\\n$(translate \"A host reboot is required before starting the VM. Reboot now?\")\" \\\n    13 78; then\n      msg_warn \"$(translate \"Rebooting the system...\")\"\n      reboot\n  else\n      echo \"\"\n      msg_info2 \"$(translate \"Do not start the VM until the system has been rebooted.\")\"\n  fi\nfi\n\nmsg_success \"$(translate \"Press Enter to return to menu...\")\"\nread -r"
+  },
+  "messageFunctions": {
+    "heading": "Prehľad funkcií správ",
+    "intro": "Všetky sú definované v <code>utils.sh</code>. Používajte ich pre výstup viditeľný používateľovi, aby skripty mali jednotný vzhľad. Ak potrebujete novú funkciu, napríklad úroveň závažnosti alebo pomocníka rozloženia, navrhnite ju v pull requeste. Po kontrole sa pridá do <code>utils.sh</code>, ak má širšie využitie.",
+    "headerFunction": "Funkcia",
+    "headerWhen": "Kedy používať",
+    "headerSpinner": "Indikátor priebehu",
+    "rows": [
+      {
+        "function": "msg_info \"text\"",
+        "whenRich": "Prebieha operácia.",
+        "spinner": "Spustí"
+      },
+      {
+        "function": "stop_spinner",
+        "whenRich": "Koniec tichej prípravnej práce vo fáze 1: zastaví indikátor a vyčistí riadok.",
+        "spinner": "Zastaví"
+      },
+      {
+        "function": "msg_ok \"text\"",
+        "whenRich": "Operácia bola úspešná. Použite aj pre zapnutú funkciu, hoci je ešte potrebný reštart.",
+        "spinner": "Zastaví"
+      },
+      {
+        "function": "msg_warn \"text\"",
+        "whenRich": "Skutočné varovanie alebo zhoršený stav.",
+        "spinner": "Zastaví"
+      },
+      {
+        "function": "msg_error \"text\"",
+        "whenRich": "Závažná chyba.",
+        "spinner": "Zastaví"
+      },
+      {
+        "function": "msg_info2 \"text\"",
+        "whenRich": "Neblokujúce odporúčanie, tyrkysový informačný riadok.",
+        "spinner": "Zastaví"
+      },
+      {
+        "function": "msg_success \"text\"",
+        "whenRich": "Záverečná výzva „Stlačte Enter pre návrat“ na konci fázy 2.",
+        "spinner": "Zastaví"
+      },
+      {
+        "function": "msg_title \"text\"",
+        "whenRich": "Tučný nadpis so zabudovanými rozostupmi. Používa sa na začiatku fázy 2.",
+        "spinner": "—"
+      },
+      {
+        "function": "show_proxmenux_logo",
+        "whenRich": "Vyčistí obrazovku a zobrazí logo. Na začiatku fázy 2 sa volá <em>raz</em>.",
+        "spinner": "—"
+      }
+    ]
+  },
+  "dialogConventions": {
+    "heading": "Pravidlá používania dialog",
+    "bullets": [
+      "Každému volaniu <code>dialog</code> a <code>whiptail</code> vždy odovzdajte <code>--backtitle \"$BACKTITLE\"</code>. <code>$BACKTITLE</code> je vždy <code>\"ProxMenux\"</code>, nastavené raz v hlavičke skriptu a nikdy neprepísané. Rámec rozhrania musí používateľovi ukazovať názov projektu, nie vlastný nadpis skriptu.",
+      "Vždy zabaľte titulky a správy s <code>$(translate \"...\")</code>.",
+      "Vždy presmerujte <code>dialog</code> výstup pomocou <code>2&gt;&amp;1 &gt;/dev/tty</code> — zachytený stdout sa stane výberom používateľa, zatiaľ čo samotné dialógové okno sa kreslí na terminál.",
+      "Použite štandardné premenné rozmerov UI (<code>$UI_MENU_H</code>, <code>$UI_MSG_W</code>, atď.) pre konzistentnú veľkosť medzi skriptmi.",
+      "Vždy skontrolujte prázdne / zrušené výbery a zaobchádzajte s nimi elegantne."
+    ],
+    "exampleIntro": "Úplný príklad: vytvorenie ponuky na výber VM a spracovanie zrušenia.",
+    "exampleCode": "# 1) Build the list of VMs as alternating \"ID  NAME\" pairs.\n#    dialog --menu expects this exact shape: tag1 description1 tag2 description2 ...\nVM_LIST=\"\"\nfor vmid in $(qm list | awk 'NR>1 {print $1}'); do\n    vm_name=$(qm config \"$vmid\" | awk -F': ' '/^name:/ {print $2}')\n    VM_LIST=\"$VM_LIST $vmid \\\"$vm_name\\\"\"\ndone\n\n# 2) Show the dialog. Captured stdout is the user's selection (the VMID).\nVMID=$(eval \"dialog --backtitle \\\"\\$BACKTITLE\\\" \\\n    --title \\\"\\$(translate \\\"Select VM\\\")\\\" \\\n    --menu \\\"\\$(translate \\\"Choose a VM from the list:\\\")\\\" \\\n    \\$UI_MENU_H \\$UI_MENU_W \\$UI_MENU_LIST_H \\\n    $VM_LIST \\\n    2>&1 >/dev/tty\")\n\n# 3) Empty result means the user pressed Cancel or Esc — exit silently.\nif [ -z \"$VMID\" ]; then\n    exit 0\nfi\n\n# 4) Continue with the rest of Phase 1, knowing VMID is now set.\necho \"User selected VMID=$VMID\""
+  },
+  "translation": {
+    "heading": "Politika prekladu",
+    "intro": "Všetky užívateľsky viditeľné reťazce musia byť zabalené s funkciou <code>translate</code>. ProxMenux ich automaticky prekladá do všetkých podporovaných jazykov, ktoré píšete anglicky, užívateľ číta ich rodný jazyk.",
+    "code": "msg_ok \"$(translate \"Operation completed successfully.\")\"\nmsg_error \"$(translate \"Failed to start container\") $CTID.\"\ndialog --title \"$(translate \"Select Storage\")\" ...",
+    "bullets": [
+      "Reťazce píšte po anglicky; preklad sa spracuje automaticky pri zostavení.",
+      "Udržujte stručnosť. Ak je to možné, nepoužívajte premenné vo vnútri dlhých viet.",
+      "<strong>Neprekladajte</strong> názvy premenných, cesty ani technické identifikátory."
+    ]
+  },
+  "variableStyle": {
+    "heading": "Pravidlá premenných a štýlu",
+    "bullets": [
+      "Pre premenné úrovne skriptov použite <code>UPPER_CASE</code>.",
+      "Pre lokálne funkčné premenné (vyhlásiť s <code>local</code>) použite <code>lower_case</code>.",
+      "Všetky rozvinutia premenných uzavrite do úvodzoviek: <code>\"$VAR\"</code>, nie <code>$VAR</code>.",
+      "Použite <code>[[ ]]</code> pre podmienky, nie <code>[ ]</code> (s výnimkou prípadov, keď sa POSIX vyžaduje).",
+      "<code>show_proxmenux_logo</code> je správny spôsob vyčistenia obrazovky: vyčistí ju a zobrazí logo projektu pre vizuálny kontext. Zavolajte ho raz na začiatku fázy 2 a voliteľne pred dlhou prípravnou kontrolou s indikátorom vo fáze 1."
+    ],
+    "standardNamesIntro": "Štandardné názvy premenných v rámci projektu:",
+    "standardNamesCode": "CTID         # container ID\nVMID         # virtual machine ID\nDISK         # device path (e.g. /dev/sdb)\nPARTITION    # partition path (e.g. /dev/sdb1)\nSTORAGE      # Proxmox storage name\nMOUNT_POINT  # filesystem mount path",
+    "redirectHeading": "Presmerovanie výstupu nástroja počas fázy 2",
+    "redirectIntro": "Fáza 2 zobrazuje prehľadný záznam riadkov <code>msg_info → msg_ok</code>. Ak volaný nástroj, napríklad apt, mkfs, qm, pct alebo dd, zapisuje na stdout/stderr, posúva správy a naruší prehľad. Používateľ potom nerozozná priebeh skriptu od podrobného výstupu nástroja.",
+    "withoutRedirectIntro": "<strong>Bez presmerovania</strong>: čo používateľ vidí, ak neošetríte rušivý výstup.",
+    "withoutRedirectCode": "ℹ Installing kernel package...\nReading package lists... Done\nBuilding dependency tree... Done\nReading state information... Done\nThe following NEW packages will be installed:\n  proxmox-kernel-6.5\n0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded.\nNeed to get 12.5 MB of archives.\nAfter this operation, 47.2 MB of additional disk space will be used.\nGet:1 http://download.proxmox.com/debian/pve trixie/pve-no-subscription amd64 ...\n... [200+ more lines of dpkg output] ...\n✓ Kernel installed.",
+    "withRedirectIntro": "<strong>S presmerovaním</strong> — ako vyzerá tá istá operácia, keď je šum odoslaný inam:",
+    "withRedirectCode": "ℹ Installing kernel package...\n✓ Kernel installed.\nℹ Configuring kernel command line...\n✓ Configured.\nℹ Refreshing boot loader...\n✓ Boot loader updated.",
+    "twoPatternsIntro": "Dva vzory na výber:",
+    "discardLead": "<strong>Zahodiť výstup</strong>, ak ho nepotrebujete: najjednoduchšia a najrýchlejšia možnosť.",
+    "discardCode": "DEBIAN_FRONTEND=noninteractive apt-get install -y \"$package\" >/dev/null 2>&1",
+    "logLead": "<strong>Pošlite výstup do súboru denníka</strong>, keď ho budete chcieť neskôr skontrolovať (ladenie neúspešnej inštalácie, kontrola toho, čo dpkg skutočne urobil). Toto je preferovaný vzor pre akúkoľvek operáciu apt:",
+    "logCode": "apt-get install -y \"$package\" >> \"$log_file\" 2>&1",
+    "referenceOutro": "<code>scripts/global/update-pve9_2.sh</code> je referenčná implementácia: každé volanie <code>apt-get</code> zapisuje do súboru záznamu. Používateľ vidí iba prehľadný tok <code>msg_info → msg_ok</code>, no pri probléme možno zo súboru presne zistiť, čo apt vykonal."
+  },
+  "dosAndDonts": {
+    "heading": "Čo robiť a čomu sa vyhnúť",
+    "doHeading": "✅ Robiť",
+    "doBullets": [
+      "<code>stop_spinner</code> pred <code>dialog</code> vo fáze 1 iba vtedy, keď <code>msg_info</code> spinner beží.",
+      "Fáza 2 začína s <code>show_proxmenux_logo + msg_title + msg_ok</code> zhrnutie výsledkov fázy 1.",
+      "Pre úspešne zapnuté funkcie použite <code>msg_ok</code>, aj keď je potrebný reštart.",
+      "Používajte <code>whiptail</code> (nie <code>dialog</code>) pre akýkoľvek postup po vykonaní, ktorý sa musí objaviť vo fáze 2.",
+      "V dialógových oknách reštartu vždy zahrňte vetvu „Nie“, ktorá varuje používateľa, aby nespúšťal dotknutý zdroj, kým nebude reštartovaný.",
+      "Logiku určenú iba pre VM chráňte kontrolou <code>[[ -f \"/etc/pve/qemu-server/$'{'vmid'}'.conf\" ]]</code>: radiče a NVMe PCIe nemožno priradiť LXC cez PCI passthrough.",
+      "Použite <code>ensure_repositories</code> z <code>utils-install-functions.sh</code> namiesto bezpodmienečného <code>apt-get update</code>.",
+      "Používajte paralelné polia vo fáze 1, ak každá položka potrebuje viac dialógov."
+    ],
+    "dontHeading": "❌ Nerobiť",
+    "dontBullets": [
+      "Zavolajte <code>dialog</code>, kým je spinner aktívny.",
+      "Preskočiť zhrnutie fázy 1 na začiatku fázy 2.",
+      "Zavolať <code>show_proxmenux_logo</code> druhýkrát; vymaže všetko, čo fáza 2 vypísala.",
+      "Použite <code>dialog</code> vo fáze 2 (použite <code>whiptail</code> pre zriedkavý nevyhnutný prípad).",
+      "Použite holý <code>clear</code>.",
+      "Obaľovať <code>msg_title</code> prázdnymi riadkami <code>echo \"\"</code> — potrebné medzery už obsahuje.",
+      "Použiť <code>msg_warn</code> pre hlásenie úspešne zapnutej funkcie, ktorá je <code>msg_ok</code>.",
+      "Spustiť bezpodmienečné <code>apt-get update</code>; namiesto toho použite <code>ensure_repositories</code>."
+    ]
+  },
+  "submitting": {
+    "heading": "Predloženie príspevku",
+    "steps": [
+      "Vytvorte fork repozitára <code>MacRimi/ProxMenux</code> na GitHube a potom svoj fork naklonujte.",
+      "Vytvorte vetvu <code>feature/*</code> z <code>develop</code> (pozrite <em>Model vetiev</em> vyššie).",
+      "Postupujte podľa tejto príručky pre akékoľvek nové alebo zmenené skripty. Napíšte hlavičku s Vaším menom; pridajte voliteľný riadok sponzora, ak chcete.",
+      "Otestujte skript na skutočnej inštancii Proxmox VE: fázu 1 so všetkými vetvami dialógov a fázu 2 so všetkými operáciami aj čistým návratom pri chybe.",
+      "Otvorte pull request <strong>do vetvy <code>develop</code></strong> s jasným opisom: čo skript robí, čo sa zmenilo a na ktorej verzii Proxmox VE bol otestovaný.",
+      "Uistite sa, že váš príspevok rešpektuje <cocLink>Kódex správania</cocLink>."
+    ],
+    "securityOutro": "Pokiaľ ide o otázky citlivé na bezpečnosť, postupujte podľa toku zverejnenia v <securityLink>SECURITY.md</securityLink> namiesto otvárania verejnej otázky."
+  },
+  "whereNext": {
+    "heading": "Kam ďalej",
+    "items": [
+      {
+        "kind": "external",
+        "url": "https://github.com/MacRimi/ProxMenux/blob/main/CONTRIBUTING.md",
+        "label": "CONTRIBUTING.md (úplný sprievodca)",
+        "tail": " — záväzný zdroj všetkých pravidiel vrátane pokročilých hardvérových postupov."
+      },
+      {
+        "kind": "internal",
+        "href": "/docs/about/contributors",
+        "label": "Prispievatelia",
+        "tail": " — ľudia, ktorých práca formovala vydania ProxMenux. Ide o inú stránku než túto."
+      },
+      {
+        "kind": "internal",
+        "href": "/docs/about/code-of-conduct",
+        "label": "Kódex správania",
+        "tail": " — Každý prispievateľ súhlasí s dodržiavaním noriem."
+      },
+      {
+        "kind": "external",
+        "url": "https://github.com/MacRimi/ProxMenux/discussions",
+        "label": "GitHub Discussions",
+        "tail": " — Ak si nie ste istí, či idea sedí, alebo nájsť spolupracovníkov na väčšiu funkciu, spýtajte sa pred stavaním."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sk/docs/about/contributors.json b/web/messages/sk/docs/about/contributors.json
new file mode 100644
index 00000000..cff3f316
--- /dev/null
+++ b/web/messages/sk/docs/about/contributors.json
@@ -0,0 +1,38 @@
+{
+  "meta": {
+    "title": "Prispievatelia | Dokumentácia ProxMenux",
+    "description": "Poďakovanie ľuďom, vďaka ktorým ProxMenux vzniká: testerom, kontrolórom a vývojárom, ktorí sa podieľajú na každom vydaní.",
+    "ogTitle": "Prispievatelia | Dokumentácia ProxMenux",
+    "ogDescription": "Zoznámte sa s prispievateľmi ProxMenux."
+  },
+  "header": {
+    "title": "Prispievatelia",
+    "description": "Projekt ProxMenux rastie vďaka svojim prispievateľom. Táto stránka oceňuje ich prácu: testovanie zostáv pred vydaním, odhaľovanie regresií, kontrolu PR a formovanie nových funkcií.",
+    "section": "O projekte"
+  },
+  "beyond": {
+    "title": "Ďalší prispievatelia",
+    "body": "Mnohí ďalší ľudia prispievajú hlásením chýb, návrhmi funkcií v Discussions, beta testovaním a prekladmi. Úplný zoznam prispievateľov do kódu nájdete v <extlink>grafe prispievateľov na GitHube</extlink>. Táto stránka vyzdvihuje ľudí, ktorí sa najaktívnejšie zapájajú do testovania a kontroly vydaní ProxMenuxu."
+  },
+  "testers": {
+    "heading": "Testeri a kontrolóri",
+    "intro": "Títo ľudia patrili medzi prvých prispievateľov do projektu. Testovaním, hlásením problémov a návrhmi zlepšení pomohli ProxMenuxu vyrásť do dnešnej podoby.",
+    "roles": {
+      "testing": "Testovanie",
+      "testingReviewer": "Testovanie a kontrola"
+    },
+    "youtube": "YouTube"
+  },
+  "contribute": {
+    "heading": "Chceš prispieť?",
+    "intro": "Akýkoľvek príspevok je vítaný – kód, testovanie, dizajn, dokumentácia alebo len zdieľanie nápadov:",
+    "tester": "<strong>Tester</strong> — vyskúšajte <beta>beta kanál</beta> a pred stabilným vydaním nahláste, čo funguje a čo nie.",
+    "developer": "<strong>Vývojár</strong> — Bash, Next.js (TypeScript) a trochu Pythonu pre virtuálne prostredie prekladov (venv). PR na <gh>GitHube</gh> sú vítané.",
+    "designer": "<strong>Dizajnér</strong> — vylepšenia používateľského rozhrania, ikony a snímky obrazovky pre dokumentáciu.",
+    "ideas": "<strong>Nápady</strong> — pred vytvorením požiadavky na novú funkciu otvorte tému v <disc>GitHub Discussions</disc>."
+  },
+  "coc": {
+    "title": "Najprv si prečítajte kódex správania",
+    "body": "Pred odoslaním kódu alebo nahlásením problému si prečítajte <coclink>Pravidlá správania a osvedčené postupy</coclink>. Opisujú očakávania týkajúce sa zodpovednosti za kód, oznamovania bezpečnostných chýb a rozsahu PR."
+  }
+}
diff --git a/web/messages/sk/docs/about/faq.json b/web/messages/sk/docs/about/faq.json
new file mode 100644
index 00000000..f3d5e07f
--- /dev/null
+++ b/web/messages/sk/docs/about/faq.json
@@ -0,0 +1,94 @@
+{
+  "meta": {
+    "title": "Časté otázky | Dokumentácia ProxMenux",
+    "description": "Časté otázky o ProxMenuxe: funkcie, inštalácia, kompatibilita od PVE 8, prispôsobenie, aktualizácie, bezpečnosť, produkčné použitie, systémové súbory, prispievanie a odinštalovanie.",
+    "ogTitle": "Časté otázky | Dokumentácia ProxMenux",
+    "ogDescription": "Časté otázky o inštalácii ProxMenuxu, kompatibilite, bezpečnosti a možnostiach prispievania."
+  },
+  "header": {
+    "title": "Často kladené otázky",
+    "description": "Bežné otázky o ProxMenuxe: čo to je, komu slúži, inštalácia, aktualizácia, odinštalovanie, kompatibilita, prispôsobenie, bezpečnosť a prispievanie. Ak tu svoju otázku nenájdete, pozrite si GitHub Discussions alebo vytvorte issue.",
+    "section": "O projekte"
+  },
+  "quickLinks": {
+    "title": "Rýchle odkazy",
+    "installationLabel": "Inštalácia",
+    "installationSuffix": " — inštalačný príkaz na jednom riadku a potrebné závislosti.",
+    "introductionLabel": "Úvod",
+    "introductionSuffix": " — čo ProxMenux robí, za päť minút.",
+    "uninstallLabel": "Odinštalovať",
+    "uninstallSuffix": " — úplné odstránenie programu.",
+    "issuesLabel": "GitHub Issues",
+    "discussionsLabel": "Diskusie"
+  },
+  "q1": {
+    "question": "Čo je ProxMenux a na čo slúži?",
+    "p1Rich": "<strong>ProxMenux</strong> je interaktívny nástroj s ponukami, ktorý sprístupňuje <strong>Proxmox VE</strong> všetkým používateľom bez ohľadu na ich technické skúsenosti. Zjednodušuje vykonávanie príkazov a umožňuje spravovať systém bez pokročilých znalostí Linuxu.",
+    "p2": "Menej skúsení používatelia môžu spúšťať príkazy cez prehľadné ponuky a nemusia ich ručne zadávať do terminálu. Skúseným správcom ProxMenux šetrí kroky pri opakovaných úlohách: zabezpečení po inštalácii, GPU passthrough, importe VM vo formáte OVF a rotácii snímok ZFS.",
+    "p3": "Proxmox VE sa široko používa na:",
+    "items": [
+      "Virtualizácia na podnikovej úrovni",
+      "HomeLab a osobné cloudové riešenia",
+      "Multimediálne servery, automatizácia a ďalšie"
+    ]
+  },
+  "q2": {
+    "question": "Ako nainštalujem ProxMenux?",
+    "p1Rich": "Postupujte podľa <installlink>inštalačnej príručky</installlink>. V skratke:",
+    "stableInstall": "bash -c \"$(wget -qLO - https://raw.githubusercontent.com/MacRimi/ProxMenux/main/install_proxmenux.sh)\"",
+    "p2": "Po nainštalovaní jednoducho spustite:",
+    "menuCmd": "menu"
+  },
+  "q3": {
+    "question": "Je ProxMenux kompatibilný so všetkými verziami Proxmoxu?",
+    "bodyRich": "<strong>Nie — ProxMenux vyžaduje Proxmox VE 8 alebo novší.</strong> PVE 7 a staršie verzie nie sú podporované. Ak ešte používate PVE 7, najskôr prejdite na 8.x podľa oficiálneho postupu Proxmoxu. Následný prechod z 8 na 9 môžete vykonať v ProxMenuxe cez <upgradelink>Nástroje → Aktualizovať PVE 8 na PVE 9</upgradelink>."
+  },
+  "q4": {
+    "question": "Môžem prispôsobiť ProxMenux?",
+    "p1Rich": "Aktualizácie môžu prepísať miestne zmeny hlavných skriptov, preto tieto súbory neupravujte priamo. Prispôsobiť si však <em>môžete</em>:",
+    "items": [
+      "Banner konzoly prostredníctvom nástroja <strong>FastFetch</strong> v možnostiach po inštalácii.",
+      "Ktoré voliteľné súčasti sa nainštalujú (Monitor, Fail2Ban, Lynis a ďalšie): vyberiete ich počas inštalácie alebo neskôr v príslušných ponukách."
+    ]
+  },
+  "q5": {
+    "question": "Ako aktualizujem ProxMenux?",
+    "p1Rich": "Keď je dostupná nová verzia, ProxMenux ju zistí pri ďalšom spustení <code>menu</code> a ponúkne aktualizáciu. Ak ju prijmete, nahradí súbory a konfiguráciu nástroja v existujúcej inštalácii. Nemusíte nič sťahovať ručne.",
+    "p2Rich": "Používatelia stabilnej verzie dostávajú stabilné aktualizácie a používatelia beta verzie beta aktualizácie. Po vydaní stabilnej verzie na to beta upozorní pri ďalšom otvorení ponuky a ponúkne automatický prechod. Pozrite si <betalink>beta program</betalink>."
+  },
+  "q6": {
+    "question": "Kde môžem nahlásiť problémy?",
+    "p1Rich": "Chyby nahlasujte cez <issueslink>GitHub Issues</issueslink>. Uveďte kroky na ich zopakovanie, chybové hlásenie a podľa potreby výstup Monitora z príkazu <code>journalctl -u proxmenux-monitor -n 50</code>.",
+    "p2Rich": "V prípade problémov s <strong>bezpečnosťou</strong> ich prosím <strong>nezverejňujte</strong>. Prečítajte si <coclink>Kódex správania a osvedčené postupy</coclink> o zodpovednom postupe zverejnenia."
+  },
+  "q7": {
+    "question": "Môžem prispieť k ProxMenux?",
+    "p1Rich": "<strong>Samozrejme.</strong> ProxMenux je otvorený komunitný projekt. Prispieť môžete kódom (Bash, Next.js/TypeScript a prekladové nástroje v Pythone), testovaním, dokumentáciou, dizajnom alebo nápadmi.",
+    "item1Rich": "Pred otvorením žiadosti o funkciu prediskutujte nápady v <discusslink>GitHub diskusiách</discusslink>.",
+    "item2Rich": "Pred odoslaním pull requestu si prečítajte <coclink>kódex správania a odporúčané postupy</coclink>.",
+    "item3Rich": "Na <contriblink>stránke prispievateľov</contriblink> nájdete aktuálnych testerov a recenzentov."
+  },
+  "q8": {
+    "question": "Upravuje ProxMenux kritické systémové súbory?",
+    "p1Rich": "<strong>Inštalácia ProxMenuxu pridá nasledujúce súčasti.</strong>",
+    "item1Rich": "Závislosti cez apt: <code>dialog</code>, <code>curl</code>, <code>jq</code> a <code>git</code>. Preklady používajú vopred vytvorené katalógy JSON; inštalátor na hostiteľa nepridáva virtuálne prostredie na preklad.",
+    "item2Rich": "Adresárový strom skriptov v <code>/usr/local/share/proxmenux/</code>.",
+    "item3Rich": "Spúšťač v <code>/usr/local/bin/menu</code>.",
+    "item4Rich": "Voliteľne: služba systemd pre Monitor, <code>proxmenux-monitor.service</code>.",
+    "p2Rich": "ProxMenux <em>nemení</em> základnú konfiguráciu Proxmoxu, pokiaľ o to výslovne nepožiadate v príslušnej ponuke. Oprava siete napríklad upravuje <code>/etc/network/interfaces</code>, ale až po vašom potvrdení a vytvorení zálohy."
+  },
+  "q9": {
+    "question": "Je bezpečné používať ProxMenux v produkčnom prostredí?",
+    "bodyRich": "<strong>Áno.</strong> Keďže ProxMenux mení základné súbory Proxmoxu iba na výslovnú žiadosť, možno ho používať aj v produkčnom prostredí. Ako pri každej automatizácii ho najprv otestujte v kontrolovanom prostredí a pred deštruktívnymi operáciami majte zálohy. Týka sa to napríklad prechodu z PVE 8 na 9, formátovania diskov či odstránenia VM."
+  },
+  "q10": {
+    "question": "Ako odinštalujem ProxMenux?",
+    "p1Rich": "V ProxMenuxe: <strong>Nastavenia → Odinštalovať ProxMenux</strong>. Odinštalovanie odstráni skripty, spúšťač a službu Monitor a voliteľne aj vybrané závislosti. Súbory <code>/root/.bashrc</code> a <code>/etc/motd</code> obnoví zo záloh, ktoré vytvoril Post-Install, ak sú dostupné (inak odstráni riadok ProxMenux z MOTD).",
+    "p2Rich": "Celý postup nájdete na stránke <uninstalllink>Odinštalovanie ProxMenuxu</uninstalllink>."
+  },
+  "q11": {
+    "question": "VirusTotal označuje inštalačnú URL ako podozrivú — je bezpečná?",
+    "p1Rich": "Výsledok 1/95 od <em>Chong Lua Dao</em>, nahlásený v issue #162, správca projektu označil za falošný poplach. Inštalátor sa spúšťa príkazom, ktorý skript stiahne a spustí (<code>bash -c \"$(wget -qLO - …)\"</code>) a môže stiahnuť <code>jq</code> z jeho oficiálneho vydania na GitHube. Takéto <em>správanie</em> môže spustiť heuristickú detekciu; historické hlásenie nie je hodnotením všetkých budúcich stiahnutí.",
+    "p2Rich": "ProxMenux má úplne otvorený zdrojový kód a inštalačný skript si môžete skontrolovať riadok po riadku: <scriptlink>install_proxmenux.sh</scriptlink>. Ďalšie súvislosti nájdete v <issuelink>issue #162</issuelink>."
+  }
+}
diff --git a/web/messages/sk/docs/about/index.json b/web/messages/sk/docs/about/index.json
new file mode 100644
index 00000000..163b3c10
--- /dev/null
+++ b/web/messages/sk/docs/about/index.json
@@ -0,0 +1,67 @@
+{
+  "meta": {
+    "title": "O projekte | Dokumentácia ProxMenux",
+    "description": "O projekte ProxMenux: ciele, prispievatelia, časté otázky a pravidlá správania. Nástroj s otvoreným zdrojovým kódom na správu Proxmox VE 8+ cez ponuky, ktorý vyvíja a udržiava MacRimi s malým tímom testerov a prispievateľov.",
+    "ogTitle": "O projekte | Dokumentácia ProxMenux",
+    "ogDescription": "O ProxMenuxe — nástroji s otvoreným zdrojovým kódom na správu Proxmox VE 8+ cez ponuky."
+  },
+  "header": {
+    "title": "O projekte",
+    "description": "Informácie o projekte, časté otázky, prispievatelia a pravidlá správania. ProxMenux je nástroj s otvoreným zdrojovým kódom na správu Proxmox VE 8+ cez ponuky, ktorý vyvíja a udržiava MacRimi s pomocou malého tímu testerov a prispievateľov.",
+    "section": "O projekte"
+  },
+  "callout": {
+    "title": "Otvorený zdrojový kód, vývoj vedený komunitou",
+    "body": "ProxMenux sa poskytuje pod licenciou GPL-3.0 a vyvíja sa verejne na GitHube. Každý skript možno skontrolovať a každú zmenu dohľadať. Hlásenia chýb, nápady, kód aj testovanie sú vítané."
+  },
+  "section": {
+    "heading": "V tejto časti:",
+    "options": [
+      {
+        "icon": "HelpCircle",
+        "href": "/docs/about/faq",
+        "title": "FAQ",
+        "description": "Časté otázky: čo je ProxMenux, inštalácia, kompatibilita, prispôsobenie, aktualizácie, bezpečnosť, používanie v produkcii a odinštalovanie."
+      },
+      {
+        "icon": "Users",
+        "href": "/docs/about/contributors",
+        "title": "Prispievatelia",
+        "description": "Poďakovanie ľuďom, vďaka ktorým ProxMenux vzniká: testerom, kontrolórom a vývojárom, ktorí sa podieľajú na každom vydaní."
+      },
+      {
+        "icon": "ScrollText",
+        "href": "/docs/about/code-of-conduct",
+        "title": "Kódex správania",
+        "description": "Hodnoty projektu, zodpovednosť za kód a pravidlá prispievania. Povinné čítanie pred odoslaním PR alebo hlásenia problému."
+      }
+    ]
+  },
+  "involved": {
+    "heading": "Zapojte sa",
+    "intro": "Tri miesta na zapojenie sa do projektu:",
+    "cards": [
+      {
+        "href": "https://github.com/MacRimi/ProxMenux/issues/new",
+        "title": "🐛 Nahlásiť chybu",
+        "description": "GitHub Issues — priložte záznamy a kroky na zopakovanie problému."
+      },
+      {
+        "href": "https://github.com/MacRimi/ProxMenux/discussions",
+        "title": "💡 Navrhnúť funkciu",
+        "description": "GitHub Discussions — podeľte sa o nápady pred odoslaním PR."
+      },
+      {
+        "href": "https://github.com/MacRimi/ProxMenux/pulls",
+        "title": "🔀 Odoslať PR",
+        "description": "GitHub Pull Requests — najskôr si prečítajte pravidlá správania."
+      }
+    ]
+  },
+  "support": {
+    "heading": "Podpora projektu",
+    "introRich": "Ak vám ProxMenux šetrí čas, najjednoduchšie mu pomôžete osloviť ďalších ľudí tak, že <starlink>dáte repozitáru na GitHube ⭐</starlink>. Ak chcete pomôcť viac:",
+    "kofiLabel": "Podpora pre Ko-fi",
+    "kofiOutro": " — prispejete správcovi na kávu a podporíte pokračovanie vývoja."
+  }
+}
diff --git a/web/messages/sk/docs/backup-restore/creating-backups.json b/web/messages/sk/docs/backup-restore/creating-backups.json
new file mode 100644
index 00000000..3fc89c76
--- /dev/null
+++ b/web/messages/sk/docs/backup-restore/creating-backups.json
@@ -0,0 +1,220 @@
+{
+  "meta": {
+    "title": "Vytváranie záloh — interaktívny postup zálohovania | ProxMenux",
+    "description": "Interaktívny postup zálohovania v ProxMenux: dva vstupné body (ponuka TUI nástroja Scripts a webové rozhranie Monitor), tri ciele, dva režimy profilu, jeden krok dočasnej prípravy a jeden potvrdzovací dialóg. Stránka opisuje maticu šiestich možností, predvolený a vlastný profil a to, čo používateľ vidí od výberu zálohy až po uloženie archívu do cieľa.",
+    "ogTitle": "Zálohovanie ProxMenux — vytváranie záloh",
+    "ogDescription": "Interaktívny postup zálohovania s tromi cieľmi, dvoma profilmi a spoločným krokom dočasnej prípravy.",
+    "twitterTitle": "Vytváranie záloh | ProxMenux",
+    "twitterDescription": "Interaktívny postup zálohovania s tromi cieľmi a dvoma režimami profilu."
+  },
+  "header": {
+    "title": "Vytváranie záloh",
+    "description": "Interaktívny postup zálohovania: vyberte cieľ a profil, skontrolujte súhrn v potvrdzovacom dialógu a sledujte uloženie archívu. Oba vstupné body používajú rovnaký backend a vytvárajú zhodné archívy.",
+    "section": "Záloha a obnova"
+  },
+  "intro": {
+    "title": "Dva vstupné body, rovnaká funkčnosť",
+    "body": "TUI nástroja Scripts a webové rozhranie Monitor ponúkajú <strong>presne rovnaké funkcie</strong>. Každá záloha — manuálna aj plánovaná — prechádza rovnakou maticou výberu (tri ciele × dva profily) a pre každú bunku volá rovnakú funkciu backendu (<code>_bk_pbs</code>, <code>_bk_borg</code> alebo <code>_bk_local</code>). Archívy vytvorené cez oba vstupné body sú nerozoznateľné. Výber závisí od preferencií: TUI je vhodné pre SSH a skripty; Monitor umožňuje ovládanie myšou a obsahuje aj zobrazenia upozornení a priebežného výpisu záznamov."
+  },
+  "entryPoints": {
+    "heading": "Dva vstupné body",
+    "rows": [
+      {
+        "entry": "ProxMenux Scripts (TUI)",
+        "path": "menu → Utilities → Host Config Backup",
+        "detail": "Dialógový tok, SSH-priateľský. Hlavné menu predstavuje šesť možností priamo. Používa <code>backup_menu</code> v <code>backup_host.sh</code>."
+      },
+      {
+        "entry": "ProxMenux Monitor (webové rozhranie)",
+        "path": "Backups tab → Create backup",
+        "detail": "Postup vedený sprievodcom. Rovnakých šesť možností je zobrazených v dvojkrokovom formulári (cieľ → profil). Cez rozhranie Flask API sa volajú rovnaké funkcie backendu."
+      }
+    ]
+  },
+  "modes": {
+    "heading": "Manuálne vs plánované zálohy",
+    "body": "Zálohy možno vytvárať v dvoch režimoch: <strong>manuálne</strong> (interaktívny postup opísaný na tejto stránke — používateľ vyberie cieľ a profil z ponuky a sleduje uloženie archívu) alebo <strong>plánovane</strong> (úloha bez obsluhy, ktorá sa spúšťa časovačom v štýle cron a používa pravidlá uchovávania nastavené pre danú úlohu). Oba režimy podporujú rovnaké tri ciele a dva profily a sú dostupné cez oba vstupné body — ponuku TUI nástroja Scripts a kartu Backups v Monitore. Plánované úlohy používajú cez <code>run_scheduled_backup.sh</code> rovnaké funkcie backendu ako manuálny postup; vytvorené archívy sú nerozoznateľné.",
+    "seeAlso": "Stránka plánovaných úloh opisuje celý postup vrátane vytvorenia úlohy, jej pripojenia k existujúcemu časovaču vzdump v PVE a nastavenia hodnôt uchovávania.",
+    "monitorAlt": "ProxMenux Monitor Zálohy zobrazí nový plánovaný dialóg zálohovania s cieľovým, profilom, harmonogramom a retenčnými poľami.",
+    "monitorCaption": "Plánovaná záloha — ProxMenux Monitor. Rovnaký dialóg sprievodcu ako pri manuálnej zálohe má v dolnej časti polia plánu a uchovávania pre spúšťanie bez obsluhy."
+  },
+  "matrix": {
+    "heading": "Matica šiestich možností",
+    "intro": "Výber určuje spustený backend aj použitú stratégiu výberu ciest. Podrobnosti o konfigurácii každej bunky nájdete na stránkach jednotlivých cieľov.",
+    "rows": [
+      {
+        "combo": "1",
+        "destination": "PBS",
+        "profile": "Štandardné",
+        "action": "Uploaduje štandardný profil plus trvalé doplnky do nakonfigurovaného PBS úložiska."
+      },
+      {
+        "combo": "2",
+        "destination": "Borg",
+        "profile": "Štandardné",
+        "action": "Vytvorí archív so štandardným profilom plus trvalé doplnky vo vybranom úložisku Borg."
+      },
+      {
+        "combo": "3",
+        "destination": "Lokálne",
+        "profile": "Štandardné",
+        "action": "Napíše archív <code>.tar.zst</code> so štandardným profilom plus trvalé doplnky k nakonfigurovanému lokálnemu cieľu."
+      },
+      {
+        "combo": "4",
+        "destination": "PBS",
+        "profile": "Vlastné",
+        "action": "Pred odoslaním do PBS otvorí výber ciest; používateľ zaškrtne požadované cesty a môže pridať nové."
+      },
+      {
+        "combo": "5",
+        "destination": "Borg",
+        "profile": "Vlastné",
+        "action": "Pred vytvorením archívu Borg otvorí výber ciest."
+      },
+      {
+        "combo": "6",
+        "destination": "Lokálne",
+        "profile": "Vlastné",
+        "action": "Pred zápisom lokálneho súboru <code>.tar.zst</code> otvorí výber ciest."
+      }
+    ]
+  },
+  "profiles": {
+    "heading": "Štandardný vs vlastný profil",
+    "defaultTitle": "Predvolený profil",
+    "defaultBody": "Predvolený profil je pripravený zoznam z <code>hb_default_profile_paths</code> (opísaný v časti <em>Ako to funguje</em> pod nadpisom <em>Kategórie ciest</em>) spolu so všetkými položkami zo súboru trvalých doplnkov <code>/usr/local/share/proxmenux/backup-extra-paths.txt</code>. Používateľ potvrdí cieľ a možnosti šifrovania a záloha pokračuje bez ďalšieho výberu ciest.",
+    "customTitle": "Vlastný profil",
+    "customBody": "Vlastný profil otvorí zoznam so všetkými cestami predvoleného profilu (nezaškrtnuté) a všetkými trvalými doplnkami (vopred zaškrtnuté, s predponou <code>[+]</code>). Používateľ zaškrtne cesty pre toto spustenie a cez <em>Pridať vlastnú cestu</em> môže doplniť novú absolútnu cestu. Takto pridaná cesta sa uloží do <code>backup-extra-paths.txt</code>, aby ju budúce zálohy zahrnuli automaticky bez opätovného pridávania. Odškrtnutie trvalého doplnku ho vynechá len pri tomto spustení, ale neodstráni ho zo súboru — na odstránenie slúži samostatná akcia <em>Spravovať vlastné cesty</em> mimo postupu zálohovania.",
+    "customPickerAlt": "Vlastný kontrolný zoznam profilu zobrazujúci predvolené cesty profilu (nezaškrtnuté) a trvalé doplnky (vopred zaškrtnuté s predponou [+]) plus tlačidlá na pridanie novej cesty alebo potvrdenie výberu.",
+    "customPickerCaption": "Vlastný profil — výber ciest. Cesty predvoleného profilu nie sú zaškrtnuté; trvalé doplnky sú vopred zaškrtnuté s predponou [+]. Používateľ zaškrtne cesty pre toto spustenie.",
+    "manageCustomAlt": "Ponuka správy vlastných ciest so zoznamom trvalých doplnkov a možnosťami pridávania, odstraňovania a úprav.",
+    "manageCustomCaption": "Spravovať vlastné cesty — miesto, kde sa pridávajú alebo odstraňujú trvalé doplnky. Každá tu uvedená cesta sa automaticky zahrnie do záloh v predvolenom režime bez potreby otvárať výber ciest vlastného profilu."
+  },
+  "commonPipeline": {
+    "heading": "Čo beží bez ohľadu na cieľ",
+    "intro": "Po určení profilu každý backend vykoná rovnaký postup dočasnej prípravy a potom pokračuje vlastným spôsobom odosielania. <code>hb_prepare_staging</code> zostaví strom archívu v <code>/tmp/proxmenux-DESTINATION-stage.XXXXXX</code> a naplní každý z troch blokov údajov.",
+    "steps": [
+      {
+        "step": "1",
+        "name": "Zostava rootfs",
+        "detail": "Pre každú vybranú cestu spustí <code>rsync -a</code> do <code>staging_root/rootfs/</code>. Databáza pmxcfs v <code>/var/lib/pve-cluster/config.db</code> sa zachytí samostatne cez <code>sqlite3 .backup</code>, aby vznikla konzistentná snímka bez zastavenia klastra; pomocné súbory <code>.db-wal</code> / <code>.db-shm</code> sa z rsync vylúčia. Ak <code>sqlite3</code> nie je dostupné, uloží sa namiesto toho súbor <code>config.db.raw-fallback</code>, ktorý obnova pri importe prevezme ako databázu. Z <code>/root/</code> sa vylúčia dočasné podcesty (história bash, vyrovnávacie pamäte, kôš). Cesty chýbajúce v zdroji sa zapíšu do <code>metadata/missing_paths.txt</code> bez zastavenia zálohy."
+      },
+      {
+        "step": "2",
+        "name": "Vytvorenie manifestu",
+        "detail": "<code>build_manifest.sh</code> koordinuje šesť zberných modulov a zapíše <code>manifest.json</code> do koreňa dočasného adresára. Pri zlyhaní modulu sa pre príslušnú sekciu použije zdokumentovaná prázdna predvolená hodnota; manifest zostane platný."
+      },
+      {
+        "step": "3",
+        "name": "Zoznam balíkov",
+        "detail": "<code>apt-mark showmanual</code> je zachytený doslovne do <code>metadata/packages.manual.list</code>. Stav komponentu je už vnútri obnovených rootfs (<code>components_status.json</code>), pretože <code>/usr/local/share/proxmenux/</code> je súčasťou štandardného profilu."
+      },
+      {
+        "step": "4",
+        "name": "Informácie o spustení",
+        "detail": "<code>metadata/run_info.env</code> zaznamenáva identitu spustenia zálohy – názov hostiteľa, časovú pečiatku, verziu jadra – používanú pri kontrole kompatibility obnovy na určenie smeru medzi jadrami."
+      },
+      {
+        "step": "5",
+        "name": "Oznámenie (začiatok)",
+        "detail": "Spustí sa <code>hb_notify_lifecycle \"start\"</code>. Ak sú v Monitore nastavené upozornenia, používateľ dostane udalosť <em>Zálohovanie hostiteľa sa začalo</em>. Bez nakonfigurovaných kanálov sa upozornenie neodošle."
+      }
+    ]
+  },
+  "included": {
+    "heading": "Čo ide dnu a čo zostane vonku",
+    "intro": "Každá cesta v určenom profile (predvolené + trvalé doplnky + výber vo vlastnom režime) je skopírovaná s <code>rsync -aAXH --numeric-ids</code>. Spoločný zoznam vylúčení sa vzťahuje na každú cestu a dva adresáre majú dodatočné výnimky špecifické pre jednotlivé trasy.",
+    "globalTitle": "Globálne vylúčenia (uplatnené na každú cestu)",
+    "globalItems": [
+      "<code>images/</code> — výpisy obrazov.",
+      "<code>dump/</code> — výstupy vzdump.",
+      "<code>tmp/</code> - dočasné súbory.",
+      "<code>*.log</code> — súbory záznamov."
+    ],
+    "rootTitle": "Výnimky <code>/root/</code>",
+    "rootBody": "<code>/root/</code> je súčasťou predvoleného profilu, aby sa do archívu zahrnuli používateľské skripty a konfigurácia. Dočasné podcesty sa vynechajú:",
+    "rootItems": [
+      "<code>.bash_history</code>",
+      "<code>.cache/</code>",
+      "<code>tmp/</code>",
+      "<code>.local/share/Trash/</code>"
+    ],
+    "proxmenuxTitle": "Výnimky <code>/usr/local/share/proxmenux/</code>",
+    "proxmenuxBody": "Tento adresár obsahuje iba používateľský stav — <code>components_status.json</code>, predvoľby a vyrovnávaciu pamäť po inštalácii. Kód, ktorý už cieľ má z vlastnej inštalácie ProxMenux, sa vylúči, aby obnova neprepísala aktuálne binárne súbory cieľa staršími:",
+    "proxmenuxItems": [
+      "<code>restore-pending/</code>, <code>scripts/</code>, <code>web/</code>",
+      "<code>monitor-app/</code>, <code>monitor-app.*/</code>, <code>AppImage/</code>",
+      "<code>images/</code>, <code>json/</code>",
+      "<code>utils.sh</code>, <code>helpers_cache.json</code>",
+      "<code>ProxMenux-Monitor.AppImage*</code>, <code>install_proxmenux*.sh</code>"
+    ],
+    "notInProfileTitle": "Cesty mimo profilu",
+    "notInProfileBody": "Všetko, čo nie je uvedené v <code>hb_default_profile_paths</code> a nepridal ako vlastné alebo trvalé extra nie je súčasťou zálohy. Pozoruhodné príklady:",
+    "notInProfileItems": [
+      "<strong>Disky VM a LXC</strong> — zálohuje ich <code>vzdump</code>, nie táto funkcia. Konfiguračné súbory hostí v <code>/etc/pve/nodes/*/qemu-server/*.conf</code> a <code>lxc/*.conf</code> sa zachytia (nachádzajú sa v <code>/etc/pve</code>), aby obnova obnovila inventár; samotné disky sa znovu pripoja z existujúcej zálohy vzdump/PBS.",
+      "<strong><code>/boot</code> a <code>/boot/efi</code></strong> — binárne súbory jadra, initramfs a oddiel UEFI ESP po obnove znova vytvorí cieľový systém pomocou <code>update-initramfs</code>, <code>update-grub</code> alebo <code>proxmox-boot-tool refresh</code>. Zavádzač sa nikdy nekopíruje doslova.",
+      "<strong>Súborové systémy jadra a behu systému</strong> — <code>/proc</code>, <code>/sys</code>, <code>/dev</code> a <code>/run</code> sú pseudosúborové systémy vytvárané jadrom a udev; nikde sa trvalo neukladajú.",
+      "<strong>Binárne súbory balíkov v <code>/usr/bin</code>, <code>/usr/lib</code>, <code>/lib</code>, <code>/sbin</code></strong> — APT na cieľovom systéme ich znova nainštaluje podľa <code>packages.manual.list</code>.",
+      "<strong><code>/var/log/</code>, <code>/var/tmp/</code>, <code>/var/cache/</code></strong> — priebežný stav konkrétneho hostiteľa, ktorý sa neobnovuje.",
+      "<strong><code>/home/USER</code></strong> Nie v štandardnom profile. Pridať ako vlastnú cestu, keď systém nesie užívateľské domovské adresáre, ktoré musia prežiť obnovenie."
+    ],
+    "customPathsTitle": "Ako sa spracúvajú vlastné cesty",
+    "customPathsBody": "Vlastná cesta pridaná priamo vo vlastnom režime alebo uložená v <code>backup-extra-paths.txt</code> prechádza rovnakým postupom <code>rsync</code> ako cesty predvoleného profilu. Platia globálne vylúčenia. Ak sa vlastná cesta nachádza pod <code>/root/</code> alebo <code>/usr/local/share/proxmenux/</code>, naďalej platia aj uvedené vylúčenia pre konkrétnu cestu. Každá archivovaná cesta — predvolená aj vlastná — sa zaznamená v <code>metadata/paths_archived.txt</code>. Cesty, ktoré v zdroji neexistujú, sa zapíšu do <code>metadata/missing_paths.txt</code> bez zastavenia zálohy."
+  },
+  "archiveStructure": {
+    "heading": "Štruktúra archívu",
+    "intro": "Dočasný prípravný adresár vytvorený každým backendom má rovnaké usporiadanie bez ohľadu na miesto určenia. Archív tarball, PBS <code>.pxar</code> alebo Borg uchováva tento strom doslovne.",
+    "tree": "backup-[timestamp]/\n├── manifest.json                  # structured host state (kernel_params, hardware, storage, guests, components, source_host)\n├── metadata/\n│   ├── packages.manual.list       # output of apt-mark showmanual\n│   ├── run_info.env               # hostname, timestamp, kernel version, pmxcfs method\n│   ├── paths_archived.txt         # exact list of paths that reached rootfs/\n│   └── missing_paths.txt          # paths from the profile absent on source\n└── rootfs/\n    ├── etc/                       # /etc/pve, /etc/network, /etc/systemd/network, /etc/ssh, /etc/apt, ...\n    ├── root/                      # /root without volatile subpaths\n    ├── usr/local/                 # /usr/local/bin, /usr/local/sbin, /usr/local/share/proxmenux (state only)\n    └── var/                       # /var/lib/pve-cluster (config.db via sqlite3 .backup), /var/spool/cron/crontabs"
+  },
+  "confirmation": {
+    "heading": "Zhrnutie potvrdenia",
+    "body": "Pred zápisom akýchkoľvek údajov do cieľa ProxMenux zobrazí súhrnný dialóg s cieľom, ID zálohy alebo názvom archívu, stavom šifrovania a zoznamom kopírovaných ciest. Zrušenie v tomto bode zálohovanie bezpečne ukončí — obslužný mechanizmus <code>trap</code> nastavený vo funkcii backendu odstráni dočasný prípravný adresár a do cieľa sa nedostanú žiadne čiastočné údaje."
+  },
+  "writing": {
+    "heading": "Písanie na miesto určenia",
+    "intro": "Po potvrdení každý backend vykoná vlastný krok zápisu. Podrobnosti opisujú stránky jednotlivých cieľov; spoločnými prvkami sú záznam, sprievodný súbor a upozornenie o dokončení.",
+    "rows": [
+      {
+        "topic": "Súbor záznamu",
+        "detail": "Každý backend napíše celý svoj výstup do <code>/tmp/proxmenux-DESTINATION-backup-YYYYMMDD_HHMMSS.log</code> a pri zlyhaní ponúkne jeho otvorenie v rolovacom dialógu. Cesta záznamu je vytlačená v súhrne dokončenia iba vtedy, keď má súbor obsah."
+      },
+      {
+        "topic": "Sprievodný súbor (iba lokálne)",
+        "detail": "<code>hb_write_archive_sidecar</code> vytvorí <code>*.proxmenux.json</code> vedľa lokálneho archívu, takže Monitor ho identifikuje ako zálohu hostiteľa ProxMenux aj po presunutí alebo premenovaní."
+      },
+      {
+        "topic": "Upozornenie (dokončenie/zlyhanie)",
+        "detail": "Spustí sa <code>hb_notify_lifecycle \"complete\"</code> alebo <code>\"fail\"</code> s trvaním, veľkosťou archívu a — pri zlyhaní — posledným riadkom záznamu, ktorý vyzerá ako chyba."
+      }
+    ]
+  },
+  "finishedScreens": {
+    "heading": "Ako vyzerá dokončená záloha",
+    "intro": "Rovnaká udalosť dokončenia sa zobrazí cez oba vstupné body. TUI vypíše súhrn do terminálu; karta Backups v Monitore zobrazí spustenie v zozname archívov s veľkosťou, trvaním a indikátormi stavu.",
+    "scriptsAlt": "ProxMenux Scripts TUI zobrazujúce dokončenú zálohu hostiteľa – cieľ, ID zálohy, cestu snapshot, veľkosť údajov, trvanie a stav šifrovania.",
+    "scriptsCaption": "Dokončená záloha — ProxMenux Scripts (TUI). Súhrn dokončenia vypíše cieľ, ID zálohy, názov výslednej snímky alebo archívu, veľkosť údajov, trvanie a stav šifrovania.",
+    "monitorAlt": "ProxMenux Monitor s kartou Backups znázorňujúcou dokončenú zálohovaciu položku hostiteľa s veľkosťou, trvaním, indikátorom metódy a indikátorom šifrovania.",
+    "monitorCaption": "Dokončená záloha — karta Backups v ProxMenux Monitor. Nová záloha sa objaví v zozname archívov s indikátorom cieľovej metódy, veľkosťou, trvaním a — ak je to relevantné — ikonou zámku šifrovania."
+  },
+  "whereNext": {
+    "heading": "Kam ísť ďalej",
+    "items": [
+      {
+        "label": "Ciele",
+        "href": "/docs/backup-restore/destinations",
+        "tail": " — Detaily konfigurácie pre Local, PBS a Borg."
+      },
+      {
+        "label": "Plánované úlohy",
+        "href": "/docs/backup-restore/scheduled-jobs",
+        "tail": " — spúšťanie rovnakej zálohy bez obsluhy podľa plánu namiesto interaktívneho spúšťania."
+      },
+      {
+        "label": "Obnovenie",
+        "href": "/docs/backup-restore/restoring",
+        "tail": " — postup, ktorý používa zálohy vytvorené podľa tejto stránky."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sk/docs/backup-restore/cross-kernel.json b/web/messages/sk/docs/backup-restore/cross-kernel.json
new file mode 100644
index 00000000..266aa51c
--- /dev/null
+++ b/web/messages/sk/docs/backup-restore/cross-kernel.json
@@ -0,0 +1,170 @@
+{
+  "meta": {
+    "title": "Obnova medzi rôznymi jadrami — rozpoznanie smeru, bezpečný výber a prispôsobenie | ProxMenux",
+    "description": "Ako ProxMenux obnoví zálohu hostiteľa na cieľ s inou hlavnou verziou jadra. Vysvetľuje rozpoznanie smeru rozdielu, bezpečný filter vynechávajúci kritické cesty pri novšom cieľovom jadre a štvorfázové doplnenie nastavení IOMMU, ID VFIO a vlastných parametrov bez doslovného kopírovania súborov viazaných na jadro.",
+    "ogTitle": "ProxMenux Backup — obnova medzi verziami jadra a doplnenie nastavení",
+    "ogDescription": "Obnova medzi verziami jadra podľa smeru zmeny s bezpečným filtrom a doplnením nastavení nezávislým od jadra.",
+    "twitterTitle": "Obnova medzi rôznymi jadrami | ProxMenux",
+    "twitterDescription": "Ako ProxMenux spracováva obnovenie, keď sa cieľové jadro líši od zálohy."
+  },
+  "header": {
+    "title": "Obnova medzi kernelmi",
+    "description": "Ako ProxMenux zvláda obnovenie, keď cieľový hostiteľ spustí iné jadro od toho, ktoré je zaznamenané v zálohe, najmä keď cieľ spustí novšie jadro. Opisuje, ako sa rozdiel detekuje, ako sa prefiltrujú cesty kritické z hľadiska zavádzania, ktoré by mohli porušiť cieľ, a ako sa užívateľská konfigurácia znovu dodáva bez kopírovania súborov viazaných na jadro doslova.",
+    "section": "Záloha a obnova"
+  },
+  "intro": {
+    "title": "Každý skok do jadra je riadený inak",
+    "body": "Jadro hostiteľa Proxmox má verziu ako <code>6.17.13-2-pve</code>. Prvé dve čísla (<strong>6.17</strong>) označujú hlavnú verziu; po ich zmene nemusia byť staršie konfiguračné súbory platné. Pri odlišnej verzii jadra v zálohe a cieli sa postup vetví podľa smeru zmeny, pretože obe situácie majú odlišné riziká. Zálohy s novším jadrom než cieľ sa obnovujú bez filtra, podľa zaznamenaných testov cez viac verzií. Zálohy so starším jadrom potrebujú filter, aby staré nastavenia nebránili štartu novšieho cieľa."
+  },
+  "directionCheck": {
+    "heading": "Kontrola smeru",
+    "intro": "Počas kontroly kompatibility <code>hb_compat_check</code> porovnáva jadro zaznamenané v manifeste zálohy s aktuálnym jadrom cieľa (<code>uname -r</code>) a klasifikuje obnovenie do jedného z troch prípadov, uložené vo vnútornej premennej <code>HB_COMPAT_KERNEL_DIRECTION</code>:",
+    "rows": [
+      {
+        "direction": "same",
+        "condition": "Hlavná verzia jadra sa zhoduje medzi zálohou a cieľom.",
+        "behavior": "Úplné obnovenie toku beží nezmenený. Žiadny ďalší filter, žiadna hydratácia, žiadne špeciálne upozornenie v UI."
+      },
+      {
+        "direction": "bk_newer",
+        "condition": "Jadro zálohy je NOVŠIE než cieľové (napríklad záloha z jadra 7.0 a cieľ s jadrom 6.17).",
+        "behavior": "Úplný postup obnovy zostáva nezmenený, ako pri <code>same</code>, bez filtra. Uvedené testy overili reinštaláciu ovládačov pre cieľové jadro, nastavenie IOMMU a spustenie VM s odovzdanou GPU."
+      },
+      {
+        "direction": "bk_older",
+        "condition": "Jadro zálohy je STARŠIE než cieľové (napríklad záloha z jadra 6.17 a cieľ s jadrom 7.0).",
+        "behavior": "Filter bezpečnej podskupiny a štvorfázová hydratácia nižšie sú aktivované. Obnova pokračuje – cieľ reprodukuje zdroj, ale súbory kritické pri zavádzaní sa neskopírujú doslovne."
+      }
+    ]
+  },
+  "whyBkNewerIsSafe": {
+    "heading": "Prečo záloha s novším jadrom ako cieľ obnoví nezmenený",
+    "body": "Pri cieli so <em>starším</em> jadrom než v zálohe používa obnova mechanizmy nezávislé od verzie jadra. Inštalátory ovládačov GPU a PCI zistia bežiace jadro cez <code>uname -r</code> a zostavia DKMS pre cieľ. APT použije binárne balíky cieľovej distribúcie. Parametre IOMMU, napríklad <code>intel_iommu=on</code>, zostávajú stabilné medzi hlavnými verziami. Podľa tohto návrhu sú zoznamy zakázaných modulov, nastavenia GRUB a initramfs zo zálohy syntakticky použiteľné aj na staršom jadre; neznáme parametre jadro ignoruje. ProxMenux preto tento smer spracúva rovnako ako obnovu s rovnakým jadrom."
+  },
+  "safeSubsetFilter": {
+    "heading": "Bezpečný subsetový filter (iba ak je cieľové jadro novšie)",
+    "intro": "Keď je cieľové jadro novšie ako záložné, kontrola kompatibility pridáva 16 ciest kritických pre štart z <code>hb_unsafe_paths_cross_version</code> do <code>RS_SKIP_PATHS</code>. Tieto cesty sú vylúčené z obnovy, pretože písanie ich verzie zo staršieho jadra nad cieľom spusteným novším spôsobilo paniku jadra pri testovaní. Trasy pokrývajú päť kategórií:",
+    "categoryRows": [
+      {
+        "category": "Zavádzač",
+        "paths": "<code>/etc/default/grub</code>, <code>/etc/kernel</code>",
+        "reason": "GRUB defaults viazaná na predchádzajúce poradie jadier a stav proxmox-boot-tool (cmdline, ESP UUIDs, háčiky), ktorý odkazuje na cesty a identifikátory zo staršej inštalácie."
+      },
+      {
+        "category": "Kernelové moduly a štartovacie artefakty",
+        "paths": "<code>/etc/modules-load.d</code>, <code>/etc/modprobe.d</code>, <code>/etc/initramfs-tools</code>",
+        "reason": "Zoznamy automaticky načítaných modulov premenovaných medzi hlavnými verziami jadra, neplatné voľby modulov a hooky initramfs napísané pre staršie jadro."
+      },
+      {
+        "category": "Úložný systém a identita súborového systému",
+        "paths": "<code>/etc/fstab</code>, <code>/etc/multipath</code>, <code>/etc/iscsi</code>, <code>/etc/udev/rules.d</code>, <code>/etc/zfs</code>",
+        "reason": "UUID, ktoré v tejto inštalácii nemusia existovať, viaccestné ovládače, ktoré sa menia medzi jadrami, iSCSI parametre, ktoré sa vyvíjajú, pravidlá udev, ktoré sa môžu viazať na neexistujúce podsystémy, stav ZFS (<code>zpool.cache</code> + <code>hostid</code>), ktoré môžu uzamknúť pool ako cudzie."
+      },
+      {
+        "category": "APT zdroje",
+        "paths": "<code>/etc/apt</code>",
+        "reason": "Vydania v zdrojoch APT môžu pri ďalšej aktualizácii spôsobiť zníženie verzií kritických balíkov."
+      },
+      {
+        "category": "systemd",
+        "paths": "<code>/etc/systemd/system</code>, <code>/etc/systemd/journald.conf</code>, <code>/etc/systemd/logind.conf</code>, <code>/etc/systemd/system.conf</code>, <code>/etc/systemd/user.conf</code>",
+        "reason": "Vlastné úpravy jednotiek a odkazy .wants viazané na staršiu hlavnú verziu systemd; konfiguračné kľúče, ktoré novší systemd nemusí rozpoznať."
+      }
+    ],
+    "outroBody": "Filter beží PRED konfirmačným dialógom, takže užívateľ vidí presný zoznam ciest, ktoré budú preskočené, kategorizované z dôvodu. Obnovenie stále pokračuje všetko ostatné (konfigurácia VM/LXC, sieť, /etc/pve, užívatelia, cron, ProxMenux stav, balíčky, ovládače, /root) je obnovená normálne."
+  },
+  "hydration": {
+    "heading": "Kernel-agnostická hydratácia",
+    "intro": "Filter vynechá kritické súbory, preto doplnenie znovu použije vybrané nastavenia: parametre IOMMU, ID VFIO, vlastný <code>GRUB_TIMEOUT</code> a zoznamy blokovaných modulov nvidia. Beží pri novšom cieľovom jadre. Zlúčenie cmdline zachová kľúče cieľa a doplní chýbajúce moduly. Povolené hodnoty GRUB a používateľské súbory môžu nahradiť odlišný obsah cieľa. Opakovanie rovnakých vstupov je idempotentné.",
+    "phaseRows": [
+      {
+        "phase": "1a GRUB cesta",
+        "detail": "Pre hostiteľov s GRUB (ext4/lvm). <code>_rs_hyd_grub</code> zlúči parametre z <code>manifest.kernel_params.cmdline_extra</code> zálohy do <code>GRUB_CMDLINE_LINUX_DEFAULT</code> cieľa a preskočí existujúce kľúče. Potom obnoví povolené kľúče <code>GRUB_*</code> (<code>GRUB_TIMEOUT</code>, <code>GRUB_TIMEOUT_STYLE</code>, <code>GRUB_DEFAULT</code>, <code>GRUB_TERMINAL</code>, <code>GRUB_DISABLE_OS_PROBER</code>, <code>GRUB_SERIAL_COMMAND</code>, <code>GRUB_GFXMODE</code>, <code>GRUB_GFXPAYLOAD_LINUX</code>) zo súboru <code>/etc/default/grub</code> zálohy, ak sa ich hodnoty líšia od cieľa."
+      },
+      {
+        "phase": "1b — systemd-boot / ZFS",
+        "detail": "Pre systemd-boot (zvyčajne ZFS ako koreňový systém). <code>_rs_hyd_kernel_cmdline</code> zlúči používateľské parametre z <code>cmdline_extra</code> do cieľového <code>/etc/kernel/cmdline</code>, pričom zachová jeho vlastné parametre štartu <code>root=</code>, <code>boot=</code> a <code>rootflags=</code>."
+      },
+      {
+        "phase": "2 — /etc/modules zlúčenie",
+        "detail": "<code>_rs_hyd_modules</code> dopĺňa moduly z <code>manifest.kernel_params.modules_loaded_at_boot</code>, ktoré sú na bielom zozname (<code>vfio</code>, <code>vfio_pci</code>, <code>vfio_iommu_type1</code>, <code>vfio_virqfd</code>, <code>kvm</code>, <code>kvm_intel</code>, <code>kvm_amd</code>, <code>nvidia</code>, <code>nvidia_drm</code>, <code>nvidia_modeset</code>, <code>nvidia_uvm</code>, <code>i915</code>, <code>xe</code>) a ešte nie sú prítomné v cieľovom <code>/etc/modules</code>."
+      },
+      {
+        "phase": "3 — Kopírovanie povolených súborov",
+        "detail": "<code>_rs_hyd_files</code> skopíruje súbory vytvorené používateľom z prípravného rootfs na živý cieľ, keď sa obsah líši. Whitelist pokrýva súbory VFIO/nvidia/blacklist podľa pravidiel <code>/etc/modprobe.d</code>, <code>/etc/modules-load.d</code> a ProxMenux VFIO sa viaže na pravidlo + nvidia udev podľa pravidiel <code>/etc/udev/rules.d</code>. Distro-vlastnené súbory (<code>pve-blacklist.conf</code>, <code>mdadm.conf</code>, <code>nvme.conf</code>) sú zámerne vylúčené, pretože sa ich obsah mení medzi vydaniami."
+      },
+      {
+        "phase": "4 — Vynútenie obnovy po štarte",
+        "detail": "Štyri fázy píšu priamo na živý cieľ mimo bežného postupu obnovy. Aby zlúčené žetóny/moduly/súbory nadobudli účinnosť na ďalšom štarte, <code>HB_HYDRATION_APPLIED=1</code> sa šíri cez <code>plan.env</code> na <code>apply_pending_restore.sh</code>, čo núti <code>NEEDS_INITRAMFS=1</code> a <code>NEEDS_GRUB=1</code> bez ohľadu na to, čo bolo v zozname. Post-boot dispečer potom regeneruje initramfs a osvieži bootloader."
+      }
+    ]
+  },
+  "planCommit": {
+    "heading": "Plánovanie a vykonanie — používateľ najprv vidí náhľad",
+    "body": "Doplnenie má dva režimy. Pred potvrdením ProxMenux spustí <code>_rs_apply_bk_older_hydration</code> v režime <code>plan</code>: vypočíta zmeny, naplní <code>RS_HYDRATION_SUMMARY</code> zeleným zoznamom akcií a nič nezapíše. Dialóg ho zobrazí vedľa žltého zoznamu vynechaných ciest, aby používateľ vopred poznal zmeny. Po potvrdení spustí rovnakú funkciu v režime <code>commit</code>: tie isté fázy a logika, teraz so zápisom do cieľa. Zrušenie ponechá cieľ nedotknutý."
+  },
+  "flowDiagram": {
+    "heading": "Tok, keď je cieľové jadro novšie ako záložné",
+    "intro": "Kroky pridané, keď je cieľové jadro novšie, sú v rámci normálneho toku obnovy. Všetko ostatné – horúce použitie, čakajúca príprava, inštalácia balíka, dispečer po spustení – beží identicky ako pri obnove rovnakého jadra.",
+    "diagram": "  ┌────────────────────────────────────────────────────────────┐\n  │ hb_compat_check                                             │\n  │   HB_COMPAT_KERNEL_DIRECTION = bk_older                     │\n  └───────────────────────────┬────────────────────────────────┘\n                              │\n                              ▼\n  ┌────────────────────────────────────────────────────────────┐\n  │ Add 16 boot-critical paths to RS_SKIP_PATHS                 │\n  │   /etc/default/grub, /etc/kernel, /etc/modules-load.d, ...  │\n  └───────────────────────────┬────────────────────────────────┘\n                              │\n                              ▼\n  ┌────────────────────────────────────────────────────────────┐\n  │ _rs_apply_bk_older_hydration \"plan\"                         │\n  │   Compute what would be merged                              │\n  │   Populate RS_HYDRATION_SUMMARY (green block)               │\n  │   No writes                                                 │\n  └───────────────────────────┬────────────────────────────────┘\n                              │\n                              ▼\n  ┌────────────────────────────────────────────────────────────┐\n  │ Confirmation dialog                                         │\n  │   Amber: paths skipped by safe-subset filter                │\n  │   Green: tokens/files reapplied by hydration                │\n  │   User accepts or cancels                                   │\n  └───────────────────────────┬────────────────────────────────┘\n                              │ (accepted)\n                              ▼\n  ┌────────────────────────────────────────────────────────────┐\n  │ _rs_apply_bk_older_hydration \"commit\"                       │\n  │   Phase 1a/1b: merge cmdline tokens + GRUB keys             │\n  │   Phase 2: append modules to /etc/modules                   │\n  │   Phase 3: copy whitelisted vfio/nvidia files               │\n  │   Set HB_HYDRATION_APPLIED=1                                │\n  └───────────────────────────┬────────────────────────────────┘\n                              │\n                              ▼\n  ┌────────────────────────────────────────────────────────────┐\n  │ Rest of the restore runs normally                           │\n  │   _rs_apply hot (skips RS_SKIP_PATHS)                       │\n  │   _rs_prepare_pending_restore (writes plan.env with         │\n  │     HB_HYDRATION_APPLIED=1)                                 │\n  │   packages.manual.list install                              │\n  │   Reboot                                                    │\n  │   apply_pending_restore.sh (forces NEEDS_INITRAMFS=1,       │\n  │     NEEDS_GRUB=1 because of the hydration flag)             │\n  │   apply_cluster_postboot.sh                                 │\n  │     update-initramfs -u -k all                              │\n  │     update-grub / proxmox-boot-tool refresh                 │\n  │     component --auto-reinstall                              │\n  └────────────────────────────────────────────────────────────┘"
+  },
+  "concreteExamples": {
+    "heading": "Konkrétne príklady",
+    "intro": "Doplnenie nastavení má pri bežných scenároch pozorovateľné výsledky. Dva príklady automaticky spracovaných prípadov:",
+    "rows": [
+      {
+        "scenario": "GPU priechod (VFIO)",
+        "detail": "Zdroj mal <code>intel_iommu=on iommu=pt</code> v cmdline, <code>vfio</code>/<code>vfio_pci</code>/<code>vfio_iommu_type1</code> v <code>/etc/modules</code>, <code>/etc/modprobe.d/vfio.conf</code> s <code>options vfio-pci ids=10de:2216</code>, a <code>/etc/modprobe.d/blacklist-nvidia.conf</code>. Hydratácia zlučuje žetóny cmdline do cieľovej GRUB alebo jadra cmdline, pridá vfio moduly do <code>/etc/modules</code>, a skopíruje dva používateľom vytvorené modprobe súbory. Pri ďalšom štarte je IOMMU aktívna, moduly VFIO sa načítajú, GPU je viazaný na vfio-pci a VM sa spustí s funkčným odovzdaním GPU."
+      },
+      {
+        "scenario": "Vlastné GRUB predvolené",
+        "detail": "Zdroj mal <code>GRUB_TIMEOUT=1</code> a <code>GRUB_DISABLE_OS_PROBER=true</code>. Hydratácia číta oba kľúče z <code>/etc/default/grub</code> zálohy, vidí, že sa líšia od čerstvých predvolených inštalácií, a prepíše tieto dva riadky v cieľovom súbore (uloženie všetko ostatné, vrátane <code>GRUB_DISTRIBUTOR</code>, nedotknuté)."
+      }
+    ]
+  },
+  "callout": {
+    "warningTitle": "Čo sa pri novšom cieľovom jadre neobnovuje",
+    "warningBody": "Doplnenie obnoví iba vybrané nastavenia považované za prenosné medzi jadrami: parametre IOMMU, ID VFIO, povolené kľúče GRUB a moduly z pevného zoznamu (<code>vfio*</code>, <code>nvidia*</code>, <code>i915</code>, <code>xe</code>, <code>kvm*</code>). Ostatné položky, ako vlastné hooky initramfs v <code>/etc/initramfs-tools/hooks/</code>, nepovolené súbory v <code>/etc/modprobe.d/</code> a vlastné úpravy jednotiek systemd, zostanú vynechané. Môžu používať rozhrania jadra, rozloženie <code>/sys</code> a hooky <code>udev</code>, ktoré sa medzi hlavnými verziami menia a môžu zabrániť štartu. Na presné obnovenie štartovacieho reťazca použite rovnakú hlavnú verziu jadra ako v zálohe."
+  },
+  "codeReference": {
+    "heading": "Kde mechanizmy žijú",
+    "intro": "Pre vývojárov, ktorí chcú sledovať alebo rozšíriť správanie obnovy medzi verziami jadra:",
+    "rows": [
+      {
+        "component": "Smerové zistenie",
+        "location": "<code>hb_compat_check</code> v <code>lib_host_backup_common.sh</code>. Nastaví <code>HB_COMPAT_KERNEL_DIRECTION</code>."
+      },
+      {
+        "component": "Zoznam ciest bezpečného filtra",
+        "location": "<code>hb_unsafe_paths_cross_version</code> v <code>lib_host_backup_common.sh</code>. Vypíše <code>path\\treason</code> riadky používané ako CLI filter a webový koncový ukazovateľ <code>/api/host-backups/restore/prepare</code>."
+      },
+      {
+        "component": "Hydratačné fázy",
+        "location": "<code>_rs_hyd_grub</code>, <code>_rs_hyd_kernel_cmdline</code>, <code>_rs_hyd_modules</code>, <code>_rs_hyd_files</code> v <code>backup_host.sh</code>. Orchestrovaný <code>_rs_apply_bk_older_hydration</code>."
+      },
+      {
+        "component": "Vynútenie obnovy po štarte",
+        "location": "<code>apply_pending_restore.sh</code> prečíta <code>HB_HYDRATION_APPLIED</code> z <code>plan.env</code> a vynúti <code>NEEDS_INITRAMFS=1</code>/<code>NEEDS_GRUB=1</code>."
+      },
+      {
+        "component": "Webový náhľad",
+        "location": "<code>/api/host-backups/restore/prepare</code> v <code>flask_server.py</code>. Načíta pomocnú knižnicu, spustí <code>_rs_apply_bk_older_hydration</code> v režime plánu, vráti akcie na Web modus."
+      }
+    ]
+  },
+  "whereNext": {
+    "heading": "Kam ísť ďalej",
+    "items": [
+      {
+        "label": "Obnovenie",
+        "href": "/docs/backup-restore/restoring",
+        "tail": " — úplný postup obnovy, do ktorého sa tieto mechanizmy zapájajú."
+      },
+      {
+        "label": "Ako to funguje",
+        "href": "/docs/backup-restore/how-it-works",
+        "tail": " — manifest a zberné funkcie vytvárajúce blok <code>kernel_params</code>, z ktorého doplnenie číta."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sk/docs/backup-restore/destinations/borg.json b/web/messages/sk/docs/backup-restore/destinations/borg.json
new file mode 100644
index 00000000..bfa4be4a
--- /dev/null
+++ b/web/messages/sk/docs/backup-restore/destinations/borg.json
@@ -0,0 +1,234 @@
+{
+  "meta": {
+    "title": "Cieľ Borg — typy repozitárov, overenie SSH a šifrovanie | ProxMenux",
+    "description": "Cieľ Borg ukladá zálohy hostiteľa ProxMenux do lokálneho úložiska, na pripojený externý disk alebo na vzdialený server cez SSH. Opisuje vyhľadanie spustiteľného súboru borg, štyri úvodné možnosti kľúča SSH, šifrovanie repokey, uloženú konfiguráciu cieľa a uchovávanie podľa plánovanej úlohy.",
+    "ogTitle": "ProxMenux Backup — cieľ Borg",
+    "ogDescription": "Ako ProxMenux ukladá zálohy hostiteľa do úložísk Borg s overením SSH a šifrovaním repokey.",
+    "twitterTitle": "Cieľ záloh Borg | ProxMenux",
+    "twitterDescription": "Lokálne úložiská Borg, úložiská na USB a dostupné cez SSH pre zálohy hostiteľa."
+  },
+  "header": {
+    "title": "Borg",
+    "description": "Cieľ Borg píše zálohy hostiteľa do úložiska Borg. Podporujú sa tri typy úložiska: cesta k lokálnemu súborovému systému, namontovaný externý disk alebo vzdialený server cez SSH. Deduplikácia po blokoch vo všetkých archívoch v úložisku a voliteľné šifrovanie repokey.",
+    "section": "Záloha a obnova"
+  },
+  "aboutBorg": {
+    "heading": "Čo je Borg?",
+    "body": "Borg, známy aj ako BorgBackup, je otvorený zálohovací nástroj s deduplikáciou, ktorý udržiava komunita Borg Backup. Každý archív ukladá ako bloky premenlivej dĺžky v úložisku. Bloky sa zdieľajú medzi archívmi, takže opakovaná záloha nezmenených údajov spotrebuje takmer nulové dodatočné miesto. Borg nie je viazaný na Proxmox: je to univerzálny nástroj používaný v mnohých prostrediach. ProxMenux ho používa ako jeden z troch cieľov záloh hostiteľa. Všetky tu opísané mechanizmy (typy úložísk, borg-serve cez SSH, šifrovanie repokey a prune) sú štandardným správaním Borgu."
+  },
+  "intro": {
+    "title": "Deduplikácia po blokoch s lokálnymi úložiskami alebo úložiskami cez SSH",
+    "body": "Úložisko Borg ukladá bloky zdieľané medzi všetkými svojimi archívmi. Opakovaná záloha nezmeneného súboru preto neprenáša ani neukladá nové údaje. ProxMenux používa pri zálohovaní <code>borg create</code> a pri obnove <code>borg extract</code>. Úložisko môže byť na rovnakom súborovom systéme ako zdroj, na pripojenom externom disku alebo na vzdialenom hostiteľovi cez SSH."
+  },
+  "binarySourcing": {
+    "heading": "Spustiteľný súbor borg",
+    "intro": "Borg nie je základnou závislosťou inštalátora ProxMenux. Keď beží záloha, <code>hb_ensure_borg</code> vyrieši binárny zo štyroch zdrojov v poradí a vráti prvý, ktorý funguje:",
+    "rows": [
+      {
+        "priority": "1",
+        "source": "Systém <code>borg</code>",
+        "detail": "Ak má hostiteľ už <code>borg</code> nainštalovaný cez APT (<code>which borg</code>), použije sa tento binárny kód."
+      },
+      {
+        "priority": "2",
+        "source": "Vyrovnávacia pamäť stavového adresára",
+        "detail": "<code>/usr/local/share/proxmenux/borg</code> — súbor uchovaný po predchádzajúcom stiahnutí z GitHubu na tomto hostiteľovi."
+      },
+      {
+        "priority": "3",
+        "source": "Balík AppImage Monitora",
+        "detail": "<code>/usr/local/share/proxmenux/monitor-app/usr/bin/borg</code> — AppImage obsahuje podpísaný borg-linux64. Táto možnosť funguje aj bez internetu: hostiteľ má stále použiteľný <code>borg</code>."
+      },
+      {
+        "priority": "4",
+        "source": "GitHub stiahnuť",
+        "detail": "Stiahnutie pomocou <code>wget</code> z pevne určenej URL súboru <code>borg-linux64</code> v <code>github.com/borgbackup/borg/releases/</code>, overené oproti konštante SHA-256 v <code>lib_host_backup_common.sh</code> (<code>HB_BORG_LINUX64_SHA256</code>). Pri nesúlade kontrolného súčtu sa binárny súbor odstráni a zálohovanie sa preruší. Stiahnutý súbor sa uchová v stavovom adresári, takže ďalšie zálohovania použijú postup 2."
+      }
+    ]
+  },
+  "repoTypes": {
+    "heading": "Typy úložísk",
+    "intro": "Typ úložiska je vybraný pri pridaní cieľa. Každý typ rieši inú URL úložiska, ktorému Borg rozumie.",
+    "rows": [
+      {
+        "type": "remote",
+        "url": "ssh://USER@HOST/RPATH",
+        "detail": "Úložisko žije na vzdialenom serveri, ktorý prevádzkuje <code>borg serve</code>. Vyžaduje pripojenie SSH k tomu serveru."
+      },
+      {
+        "type": "usb",
+        "url": "/mnt/MOUNTPOINT/borgbackup",
+        "detail": "Repozitár žije na pripojenom externom disku (zvyčajne USB). Pripojenie je riešené pomocou <code>hb_prompt_mounted_path</code>, ktorý detekuje, pripojí alebo formáty USB partícií podľa potreby."
+      },
+      {
+        "type": "local",
+        "url": "/backup/borgbackup (any absolute path)",
+        "detail": "Úložisko žije v lokálnom adresári. Zmysluplné iba vtedy, keď je cieľový adresár na samostatnom fyzickom disku – úložisko na rovnakom disku ako zdroj chráni pred chybou operátora, ale nie pred zlyhaním disku."
+      }
+    ]
+  },
+  "serverSetup": {
+    "heading": "Príprava servera Borg (strana servera)",
+    "intro": "Typ úložiska <code>remote</code> vyžaduje funkčný server Borg dostupný cez SSH. ProxMenux server sám nenastavuje; iba autorizuje kľúč pre existujúci účet. Táto časť opisuje požiadavky pred pripojením.",
+    "hostChoicesTitle": "Kde môže server žiť",
+    "hostChoicesBody": "Každý host Linux s prístupom SSH spĺňa požiadavky. Spoločné nastavenia:",
+    "hostChoicesItems": [
+      "Dedikovaný NAS alebo záložný box (Debian, Ubuntu, TrueNAS SCALE so shellom).",
+      "Kontajner LXC vnútri uzol Proxmox. Malá stopa, izolovaná od hostiteľa, ktorý riadi zálohy.",
+      "Ďalší hostiteľ Proxmox v rovnakej sieti LAN alebo VM kdekoľvek dosiahnuteľný cez SSH."
+    ],
+    "lxcWarningTitle": "LXC ako server Borg",
+    "lxcWarningBody": "Ak server Borg beží v LXC, generate-auto vyžaduje pri inštalácii kľúča účet povoľujúci overenie SSH heslom. Ak nie je dostupný, použite ručnú inštaláciu kľúča alebo alternatívu generate-pct cez hostiteľa PVE.",
+    "requirementsTitle": "Požiadavky na server",
+    "requirementsRows": [
+      {
+        "requirement": "Spustiteľný súbor borg na ceste <code>/usr/bin/borg</code>",
+        "detail": "Riadok <code>command=\"/usr/bin/borg serve ...\"</code>, ktorý ProxMenux zapíše do <code>authorized_keys</code>, používa túto pevnú cestu. APT (<code>apt install borgbackup</code>) sem program nainštaluje. Samostatný binárny súbor musí mať symbolický odkaz na ceste <code>/usr/bin/borg</code>."
+      },
+      {
+        "requirement": "Dedikovaný užívateľský účet (zvyčajne <code>borg</code>)",
+        "detail": "Vlastní adresár úložiska a prijíma prichádzajúce SSH spojenie. Nepotrebuje sudo alebo shell prístup authorized_keys linka aj tak znemožňuje interaktívne shelly."
+      },
+      {
+        "requirement": "Zapisovateľný adresár úložiska",
+        "detail": "Cesta, ktorú operátor poskytuje ProxMenux (napríklad <code>/backup/borgbackup</code>) musí existovať na serveri a musí byť vo vlastníctve používateľa borg."
+      },
+      {
+        "requirement": "SSH démon akceptujúci používateľa borg",
+        "detail": "<code>PubkeyAuthentication yes</code> (predvolené). Overenie heslom je potrebné iba pri inštalácii kľúča cez <em>generate-auto</em>. Po nainštalovaní kľúča môže server overenie heslom úplne vypnúť."
+      }
+    ],
+    "minimalSetupTitle": "Nastavenie minimálneho servera",
+    "minimalSetupBody": "Na serveri Borg so systémom Debian alebo Ubuntu tvoria základ konfigurácie štyri príkazy spustené ako root:",
+    "minimalSetupCmd": "apt install borgbackup\nuseradd -m -d /home/borg -s /bin/bash borg\nmkdir -p /backup/borgbackup\nchown borg:borg /backup/borgbackup",
+    "minimalSetupNote": "Keď je server pripravený a povoľuje overenie SSH heslom, režim <code>generate-auto</code> nainštaluje kľúč cez účet s právom zapisovať do authorized_keys používateľa borg. Ďalšie zálohy používajú tento kľúč obmedzený na <code>borg serve</code> v nastavenej ceste. Bez prihlásenia heslom ho nainštalujte ručne alebo cez hostiteľa PVE."
+  },
+  "sshAuth": {
+    "heading": "Overenie SSH (klientská strana)",
+    "intro": "Remote Borg archívy sú prístupné cez SSH. Spojenie beží od ProxMenux host na užívateľský účet na serveri Borg, ktorý beží <code>borg serve</code>. Tento užívateľ je zvyčajne pomenovaný <code>borg</code>, NIE je admin / root užívateľa servera borg-serve príkazový riadok zablokuje pripojenie k tejto konkrétnej trase úložiska (pozri nižšie kľúčové stratégie).",
+    "strategiesTitle": "Možnosti kľúča SSH",
+    "strategiesIntro": "Pri pridaní vzdialeného cieľa vyžiada ProxMenux používateľa SSH, hostiteľa, port a vzdialenú cestu a ponúkne štyri možnosti overenia. Ak je overenie heslom odmietnuté, ponúkne aj alternatívu generate-pct. Režimy sú opísané nižšie:",
+    "strategyRows": [
+      {
+        "mode": "generate-auto",
+        "label": "Odporúčané",
+        "detail": "ProxMenux vygeneruje alebo znovu použije pár kľúčov ed25519 na ceste <code>~/.ssh/borg_proxmenux_HOST_ed25519</code>. Pomocou <code>sshpass</code> otestuje prihlásenie a nainštaluje verejný kľúč do <code>~borg/.ssh/authorized_keys</code>. Heslo patrí účtu, ktorý môže do súboru zapisovať, zvyčajne root alebo borg. Používa sa pri nastavení a neukladá sa."
+      },
+      {
+        "mode": "generate-manual",
+        "label": "Žiadne admin heslo na tomto hostiteľovi",
+        "detail": "ProxMenux generuje pár kľúčov, ako je uvedené vyššie, ale zobrazuje plnú linku <code>authorized_keys</code> pre operátora na manuálne vkladanie do servera. Admin heslo nikdy neopustí ProxMenux hostiteľa, pretože to nie je nikdy žiadané."
+      },
+      {
+        "mode": "generate-pct",
+        "label": "Borg server je PVE LXC",
+        "detail": "Server Borg beží vo vnútri LXC na uzle PVE. ProxMenux povoľuje kľúč cez <code>pct exec</code> z PVE hostiteľa a root na hostiteľovi PVE píše do LXC's <code>~borg/.ssh/authorized_keys</code> bez potreby SSH do LXC sama o sebe."
+      },
+      {
+        "mode": "existing",
+        "label": "Použiť existujúci kľúč",
+        "detail": "ProxMenux skenuje <code>/root/.ssh/</code> a <code>$HOME/.ssh/</code> na analyzovateľné súkromné ​​kľúče ed25519/RSA a uvádza ich. Operátor vyberie jednu alebo manuálne prejde na neštandardnú cestu."
+      },
+      {
+        "mode": "none",
+        "label": "Štandardná konfigurácia SSH",
+        "detail": "Bez vlastného kľúča: Borg používa predvolenú konfiguráciu SSH hostiteľa, zvyčajne <code>~/.ssh/id_rsa</code> alebo agenta SSH."
+      }
+    ],
+    "restrictTitle": "Čiara authorized_keys",
+    "restrictBody": "Pre každý vygenerovaný kľúč obmedzí riadok <code>authorized_keys</code> zapísaný na serveri použitie kľúča na toto volanie borg-serve pre nastavenú cestu úložiska:",
+    "restrictLine": "command=\"/usr/bin/borg serve --restrict-to-path RPATH\",restrict PUBKEY",
+    "restrictNote": "<code>command=</code> núti každé SSH sedenie pomocou tohto kľúča spustiť len to borg-serve príkaz; <code>restrict</code> vypne port forwarding, agent forwarding, X11 forwarding a PTY alokácie. Kľúč nemožno použiť na otvorenie interaktívneho shellu na serveri alebo na prístup k akejkoľvek inej ceste úložiska, aj keď má účet širšie práva."
+  },
+  "savedTargets": {
+    "heading": "Uložené ciele",
+    "intro": "Uložený cieľ uchová konfiguráciu úložiska pod zrozumiteľným názvom, aby údaje nebolo potrebné zadávať znova. Súbory v stavovom adresári ProxMenux:",
+    "rows": [
+      {
+        "file": "borg-targets.txt",
+        "content": "Jeden riadok pre každý cieľ: <code>NAME|REPO|SSH_KEY_PATH|ENCRYPT_MODE</code>. Funkcia <code>hb_collect_borg_configs</code> ho načíta pri zostavovaní ponuky cieľov."
+      },
+      {
+        "file": "borg-pass-NAME.txt",
+        "content": "Passfráza pre cieľ uvedený vyššie (<code>chmod 600</code>). Prítomný len vtedy, keď si operátor vybral kódovanie repokey."
+      }
+    ],
+    "outro": "Uloženie cieľa je voliteľné. Odmietnutím sa neuloží pomenovaná konfigurácia, ale vygenerovaný kľúč SSH sa neodstráni. Ak je šifrovanie repokey zapnuté bez uloženého cieľa, ProxMenux aj tak uloží prístupovú frázu do staršieho súboru borg-pass.txt."
+  },
+  "encryption": {
+    "heading": "Šifrovanie",
+    "body": "Repozitáre sa inicializujú so zvoleným režimom šifrovania cez <code>hb_borg_init_if_needed</code>: ak je dostupný novší príkaz <code>borg repo-create -e MODE</code>, použije sa ten, inak starší <code>borg init --encryption=MODE</code>. ProxMenux ponúka dva režimy: <code>repokey</code> (predvolený) a <code>none</code>. V režime <code>repokey</code> Borg ukladá šifrovací kľúč priamo do repozitára. Prístup vyžaduje heslovú frázu, ktorú ProxMenux žiada zadať dvakrát, overí zhodu a pri uloženom cieli ju uloží do <code>borg-pass-NAME.txt</code>, inak do staršieho súboru opísaného vyššie. Po uložení sa zobrazí povinné potvrdenie: heslová fráza je jedinou cestou k zašifrovaným archívom a jej strata znemožní obnovu všetkých archívov v repozitári."
+  },
+  "runtimeEnv": {
+    "heading": "Runtime prostredie",
+    "intro": "ProxMenux exportuje nasledujúce premenné prostredia pred vyvolaním <code>borg</code>. Konfigurujú pripojenie a odomykajú úložisko bez vloženia tajomstiev do príkazového riadku.",
+    "rows": [
+      {
+        "var": "BORG_RSH",
+        "value": "ssh -i SSH_KEY_PATH -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new [-p PORT]",
+        "purpose": "Príkaz vzdialeného shellu pre úložiská Borg cez SSH. Vybraný kľúč pridá voľby identity. Keď sa cieľ prvýkrát pridá s neštandardným portom, ProxMenux pridá aj -p PORT; uložené ciele, plánované úlohy a Monitor namiesto toho používajú port z URL ssh://. Bez vlastného kľúča a pri novom cieli s predvoleným portom zostane premenná nenastavená a Borg používa konfiguráciu SSH hostiteľa."
+      },
+      {
+        "var": "BORG_PASSPHRASE",
+        "value": "(passfráza z borg-pass-NAME.txt)",
+        "purpose": "Odomkne repokey. Nastaviť iba vtedy, keď cieľ používa šifrovanie <code>repokey</code>. Nikdy sa neobjaví v zozname procesných argumentov."
+      },
+      {
+        "var": "BORG_ENCRYPT_MODE",
+        "value": "repokey | none",
+        "purpose": "Použité <code>hb_borg_init_if_needed</code> pri inicializácii úložiska, ktoré ešte neexistuje. Ignorované <code>borg create</code> na existujúcich archívoch."
+      },
+      {
+        "var": "BORG_RELOCATED_REPO_ACCESS_IS_OK",
+        "value": "yes",
+        "purpose": "Potlačí interaktívnu otázku Borgu, keď sa URL úložiska líši od pôvodnej adresy, napríklad po premenovaní bodu pripojenia alebo zmene adresy hostiteľa SSH."
+      },
+      {
+        "var": "BORG_UNKNOWN_UNENCRYPTED_REPO_ACCESS_IS_OK",
+        "value": "yes",
+        "purpose": "Potlačí interaktívnu výzvu, ktorú Borg vyvolá pri prvom prístupe k nezašifrovanému úložisku z nového klienta."
+      }
+    ]
+  },
+  "archiveFormat": {
+    "heading": "Archive pomenovanie a uchovávanie",
+    "intro": "Každá záloha vytvorí nový archív vo vnútri úložiska.",
+    "namePattern": "hostcfg-HOSTNAME-YYYYMMDD_HHMMSS",
+    "retentionBody": "Pre plánované úlohy, <code>run_scheduled_backup.sh</code> beží <code>borg prune</code> proti úložisku po každom úspešnom zálohovaní s retenčnými hodnotami nastavenými na úlohu (<code>--keep-last</code>, <code>--keep-daily</code>, <code>--keep-weekly</code>). Interaktívne zálohy neprerezávajú."
+  },
+  "restoreAccess": {
+    "heading": "Získavanie na strane obnovy",
+    "body": "Obnova vypíše archívy pomocou <code>borg list REPO</code> a vybraný archív rozbalí príkazom <code>borg extract REPO::ARCHIVE-NAME</code> do prípravného adresára. Funkcia <code>_rs_check_layout</code> ho odovzdá štandardnému procesu obnovy. Rovnaké príkazy fungujú aj ručne mimo ProxMenux. Rozbalený strom má trojblokovú štruktúru opísanú v časti <em>Ako to funguje</em>."
+  },
+  "references": {
+    "heading": "Odkazy",
+    "intro": "Oficiálna dokumentácia Borg ku komponentom, ktoré ProxMenux používa.",
+    "items": [
+      {
+        "label": "Dokumentácia Borg",
+        "href": "https://borgbackup.readthedocs.io/",
+        "tail": " — hlavný rozcestník pre pojmy, nasadenie, rýchly začiatok a všetky príkazy."
+      },
+      {
+        "label": "borg create",
+        "href": "https://borgbackup.readthedocs.io/en/stable/usage/create.html",
+        "tail": " — príkaz, ktorý ProxMenux používa pri každej zálohe, so všetkými podporovanými voľbami."
+      },
+      {
+        "label": "Šifrovanie úložiska",
+        "href": "https://borgbackup.readthedocs.io/en/stable/usage/init.html#encryption-mode",
+        "tail": " — režimy šifrovania podporované Borgom vrátane repokey, ktorý ProxMenux používa predvolene."
+      },
+      {
+        "label": "borg serve a nasadenie cez SSH",
+        "href": "https://borgbackup.readthedocs.io/en/stable/deployment/central-backup-server.html",
+        "tail": " — nastavenie centrálneho servera Borg dostupného cez SSH vrátane príkazu borg-serve a voľby restrict-to-path, ktoré ProxMenux zapisuje do authorized_keys."
+      },
+      {
+        "label": "borg prune",
+        "href": "https://borgbackup.readthedocs.io/en/stable/usage/prune.html",
+        "tail": " — model uchovávania pre --keep-last / --keep-daily / --keep-weekly, ktorý ProxMenux uplatňuje pri každej plánovanej úlohe."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sk/docs/backup-restore/destinations/index.json b/web/messages/sk/docs/backup-restore/destinations/index.json
new file mode 100644
index 00000000..6a89082e
--- /dev/null
+++ b/web/messages/sk/docs/backup-restore/destinations/index.json
@@ -0,0 +1,110 @@
+{
+  "meta": {
+    "title": "Ciele záloh — lokálny archív, Proxmox Backup Server a Borg | ProxMenux",
+    "description": "Tri úložné backendy prijímajú rovnaký obsah zálohy ProxMenux: lokálny archív .tar.zst na ľubovoľnom zapisovateľnom súborovom systéme, zálohu PBS v dátovom úložisku Proxmox Backup Server alebo archív Borg v lokálnom či vzdialenom repozitári Borg. Každý backend má vlastné vlastnosti kompresie, deduplikácie, šifrovania a sieťovej komunikácie.",
+    "ogTitle": "Ciele záloh ProxMenux",
+    "ogDescription": "Lokálny archív, Proxmox Backup Server a Borg — tri úložné backendy pre rovnaký obsah zálohy hostiteľa.",
+    "twitterTitle": "Ciele záloh ProxMenux | ProxMenux",
+    "twitterDescription": "Miestny archív, Proxmox Backup Server a Borg backendy pre zálohovanie hostiteľov."
+  },
+  "header": {
+    "title": "Ciele",
+    "description": "Tri úložné backendy podporované funkciou ProxMenux Backup: lokálny archív, Proxmox Backup Server (odporúčaný) a Borg. Každý prijíma rovnaký archív s tromi blokmi údajov; líšia sa formátom úložiska, deduplikáciou, modelom šifrovania a sieťovými požiadavkami.",
+    "section": "Záloha a obnova"
+  },
+  "intro": {
+    "title": "Rovnaký obsah, tri backendy",
+    "body": "Každá záloha vytvorí rovnaké tri bloky údajov (rootfs, manifest, aplikácie). Jednotlivé ciele sa líšia spôsobom uloženia týchto údajov a ich získania na obnovu. Každý backend je samostatná funkcia v <code>backup_host.sh</code> — <code>_bk_local</code>, <code>_bk_pbs</code>, <code>_bk_borg</code> — všetky tri však zdieľajú rovnaký krok dočasnej prípravy (<code>hb_prepare_staging</code>) a rovnakú vetvu kódu obnovy. Voľba cieľa ovplyvňuje iba zápis a získanie údajov; nemení priebeh obnovy ani spôsob použitia archívu."
+  },
+  "comparison": {
+    "heading": "Porovnanie funkcií",
+    "intro": "Nasledujúca tabuľka uvádza konkrétne rozdiely medzi tromi backendmi, ako sa správajú v ProxMenux dnes. Všetky hodnoty opisujú pozorované správanie samotného backendu, nie redakčné odporúčania.",
+    "rows": [
+      {
+        "feature": "Formát úložiska",
+        "local": "Jeden súbor <code>.tar.zst</code> (alebo <code>.tar.gz</code>, ak <code>zstd</code> chýba).",
+        "pbs": "Záloha PBS (bloky <code>.pxar</code> v dátovom úložisku).",
+        "borg": "Borg archív vnútri úložiska Borg (segment súbory)."
+      },
+      {
+        "feature": "Kompresia",
+        "local": "zstd (štandardná úroveň) cez <code>tar --zstd</code>. gzip fallback.",
+        "pbs": "Spravuje ju proxmox-backup-client. ProxMenux nemení nastavenia kompresie.",
+        "borg": "Vstavaná kompresia Borg. ProxMenux volá borg create bez zmeny nastavení kompresie."
+      },
+      {
+        "feature": "Deduplikácia",
+        "local": "Žiadne. Každá záloha je úplne nezávislý archív.",
+        "pbs": "Úplná deduplikácia na úrovni blokov medzi všetkými zálohami v dátovom úložisku.",
+        "borg": "Úplná deduplikácia na úrovni blokov medzi všetkými archívmi v repozitári."
+      },
+      {
+        "feature": "Šifrovanie v pokoji",
+        "local": "Žiadne (podliehajú ochrane súborového systému).",
+        "pbs": "Voliteľné šifrovanie na strane klienta pomocou súboru kľúča. Po zapnutí sa objekt obnovy odošle ako samostatná skupina záloh.",
+        "borg": "Voliteľné šifrovanie repokey (kľúč uložený v repo, odomknutý heslom)."
+      },
+      {
+        "feature": "Uchovávanie / čistenie",
+        "local": "Použije sa pre každú plánovanú úlohu cez <code>KEEP_LAST</code>. Staré archívy sa odstránia spolu so sprievodnými súbormi a záznamami spúšťacieho skriptu. Interaktívne zálohy nevykonávajú čistenie.",
+        "pbs": "Použité pre každú plánovanú úlohu cez <code>proxmox-backup-client prune --keep-last / --keep-daily / --keep-weekly</code>. Interaktívne zálohy nevykonávajú čistenie.",
+        "borg": "Použité pre každú plánovanú úlohu cez <code>borg prune --keep-last / --keep-daily / --keep-weekly</code>. Interaktívne zálohy nevykonávajú čistenie."
+      },
+      {
+        "feature": "Sieť",
+        "local": "Žiadne. Píše do lokálneho bodu pripojenia (obvykle interný disk alebo USB disk).",
+        "pbs": "TCP na server PBS (predvolený port 8007). Požaduje prihlasovacie údaje PBS + odtlačok certifikátu.",
+        "borg": "Lokálna cesta súborového systému alebo tunel SSH k vzdialenému Borg hostiteľovi."
+      },
+      {
+        "feature": "Závislosti",
+        "local": "<code>tar</code>, <code>zstd</code> (predvolene prítomné na Proxmoxe).",
+        "pbs": "Balík <code>proxmox-backup-client</code> (dodávaný s Proxmox VE 8+).",
+        "borg": "Binárny <code>borg</code>. Automatické poskytovanie ProxMenux z balíka Monitor AppImage v prípade, že chýba."
+      },
+      {
+        "feature": "Prístup potrebný na obnovu",
+        "local": "Akýkoľvek hostiteľ s tar+zstd môže extrahovať archív. Nie je potrebné PBS/Borg.",
+        "pbs": "Vyžaduje <code>proxmox-backup-client</code>, prihlasovacie údaje PBS a súbor kľúča (pri šifrovanej zálohe).",
+        "borg": "Vyžaduje <code>borg</code> + cestu k úložisku + heslo (ak je zašifrované)."
+      }
+    ],
+    "captionCode": "feature",
+    "captionLocal": "Lokálne",
+    "captionPbs": "Proxmox Backup Server (odporúčané)",
+    "captionBorg": "Borg"
+  },
+  "sameArchive": {
+    "heading": "Rozloženie archívu sa nemení s destináciou",
+    "body": "V každom z troch cieľov sa nachádza rovnaká štruktúra <code>rootfs/</code> + <code>metadata/</code> + <code>manifest.json</code> opísaná v časti <em>Ako to funguje</em>. Rozbalenie lokálneho archívu <code>.tar.zst</code>, obnova <code>.pxar</code> z PBS aj rozbalenie archívu Borg cez <code>borg extract</code> vytvoria rovnaký adresárový strom. Vetva kódu obnovy (<code>_rs_check_layout</code>, <code>_rs_apply</code>, <code>_rs_prepare_pending_restore</code>) číta rovnaké tri bloky údajov bez potreby vedieť, z ktorého cieľa pochádzajú."
+  },
+  "extractStandalone": {
+    "heading": "Rozbalenie zálohy mimo ProxMenux",
+    "intro": "Akýkoľvek z troch formátov archívu je možné čítať pomocou štandardných nástrojov bez nainštalovaného ProxMenux na počítači. Nižšie uvedené príkazy vytvárajú rovnaký adresárový strom, ktorý obnova používa interne.",
+    "localCmd": "# From a local .tar.zst archive:\ntar --zstd -xf hostcfg-HOST-TIMESTAMP.tar.zst\n\n# From a .tar.gz fallback:\ntar -xzf hostcfg-HOST-TIMESTAMP.tar.gz",
+    "pbsCmd": "# From a PBS backup (requires proxmox-backup-client):\nproxmox-backup-client restore \\\n    --repository USER@REALM@HOST:DATASTORE \\\n    host/hostcfg-HOST/BACKUP-TIME \\\n    hostcfg.pxar /tmp/hostcfg\n\n# Add --keyfile KEY-PATH when the backup is encrypted.",
+    "borgCmd": "# Z archívu Borg (vyžaduje borg a heslo pre šifrované repozitáre):\nborg extract REPO-PATH::ARCHIVE-NAME\n\n# Zo vzdialeného repozitára dostupného cez SSH:\nborg extract ssh://USER@HOST:PORT/REPO-PATH::ARCHIVE-NAME",
+    "note": "Rozbalený strom možno ručne skontrolovať alebo použiť na manuálnu obnovu. Presný postup získania údajov, ktorý ProxMenux používa na pozadí, opisujú stránky jednotlivých cieľov."
+  },
+  "whereNext": {
+    "heading": "Podrobnosti jednotlivých cieľov",
+    "intro": "Každá destinácia má svoju vlastnú stránku pokrývajúcu konfiguračný tok, formát on-disku a príkaz na získanie údajov použitý pri obnove.",
+    "items": [
+      {
+        "label": "Lokálny archív",
+        "href": "/docs/backup-restore/destinations/local",
+        "tail": " — prednastavenie lokálneho cieľa, pripojenie USB disku, ochrana pred uložením archívu do jeho vlastného zdroja a sprievodný súbor JSON, pomocou ktorého Monitor rozpozná zálohu."
+      },
+      {
+        "label": "Proxmox Backup Server (odporúčané)",
+        "href": "/docs/backup-restore/destinations/pbs",
+        "tail": " — výber dátového úložiska, prihlasovacie údaje a odtlačok certifikátu, životný cyklus súboru šifrovacieho kľúča, prístupová fráza na obnovu a odoslanie objektu obnovy do PBS na obnovu po čistej inštalácii."
+      },
+      {
+        "label": "Borg",
+        "href": "/docs/backup-restore/destinations/borg",
+        "tail": " — lokálne repozitáre a repozitáre dostupné cez SSH, zdroje binárneho súboru Borg (systém / vyrovnávacia pamäť / balík AppImage nástroja Monitor / stiahnutie z GitHubu), inicializácia repozitára, správa prístupových fráz a nastavenie kľúča SSH pre vzdialené repozitáre."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sk/docs/backup-restore/destinations/local.json b/web/messages/sk/docs/backup-restore/destinations/local.json
new file mode 100644
index 00000000..14df7a05
--- /dev/null
+++ b/web/messages/sk/docs/backup-restore/destinations/local.json
@@ -0,0 +1,75 @@
+{
+  "meta": {
+    "title": "Lokálny archív — tar.zst na súborovom systéme alebo USB disku | ProxMenux",
+    "description": "Lokálny cieľ zálohy vytvorí jediný archív .tar.zst v ľubovoľnom zapisovateľnom adresári: na internom disku, v bode pripojenia Proxmoxu, na zdieľaní NFS alebo na USB disku. Stránka opisuje nastavenie, rozpoznanie a pripojenie USB diskov, ochranu pred uložením archívu do zálohovanej cesty a sprievodný súbor JSON, ktorý zálohu identifikuje.",
+    "ogTitle": "ProxMenux Backup — lokálny cieľ archívu",
+    "ogDescription": "Ako ProxMenux píše lokálne zálohy ako .tar.zst archívy a ako nastaviť cieľový adresár alebo USB disk.",
+    "twitterTitle": "Lokálny cieľ zálohy | ProxMenux",
+    "twitterDescription": "Ako ProxMenux píše lokálne zálohy ako .tar.zst archívy na súborovom systéme alebo USB disku."
+  },
+  "header": {
+    "title": "Lokálny archív",
+    "description": "Lokálny cieľ zapisuje jeden komprimovaný archív tar do ľubovoľného zapisovateľného adresára na hostiteľovi: na interný disk, pripojenie NFS alebo SMB či USB disk.",
+    "section": "Záloha a obnova"
+  },
+  "intro": {
+    "title": "Jeden súbor, samostatný",
+    "body": "Lokálna záloha vytvorí jediný súbor <code>hostcfg-HOST-TIMESTAMP.tar.zst</code> (alebo <code>.tar.gz</code>, ak <code>zstd</code> nie je dostupné). Súbor obsahuje celý strom archívu — <code>manifest.json</code>, <code>metadata/</code> a <code>rootfs/</code> — a možno ho obnoviť na ľubovoľnom hostiteľovi Proxmox postupom obnovy ProxMenux alebo ručne rozbaliť cez <code>tar --zstd -xf</code> na ľubovoľnom systéme Linux. Netreba server, inicializáciu repozitára ani externú závislosť. Ak nie sú dostupné PBS ani Borg, tento cieľ ponúka najkratšiu cestu obnovy."
+  },
+  "targetConfig": {
+    "heading": "Nastavenie cieľového adresára",
+    "intro": "Miestny cieľ je <strong>jeden trvalý cieľový adresár</strong> — nie zoznam. ProxMenux ukladá voľbu operátora na <code>/usr/local/share/proxmenux/local-target.conf</code> a číta ju pri každej zálohe. Ak nie je nakonfigurovaný žiadny cieľ, použije sa predvolený <code>HB_LOCAL_TARGET_DEFAULT = /var/lib/vz/dump</code> (rovnaký adresár, ktorý Proxmox používa pre svoje vlastné výstupy <code>vzdump</code>). Cieľ sa konfiguruje z <em>Konfigurovať ciele zálohovania → Lokálne ciele</em>:",
+    "options": [
+      "<strong>Použiť predvolené (<code>/var/lib/vz/dump</code>).</strong> Lokálne úložisko Proxmox. Prítomný pri každej inštalácii Proxmox; archív sa nachádza vedľa výstupov vzdump a automaticky ho preberá karta Zálohy monitora.",
+      "<strong>Zadajte vlastnú cestu.</strong> Môžete použiť akúkoľvek absolútnu cestu súborového systému: pripojenie NFS, zdieľanie SMB pripojené cez <code>fstab</code>, vyhradený súbor údajov ZFS, druhý interný disk. ProxMenux overí, že cesta existuje a je adresárom, pred jej uložením.",
+      "<strong>Vyberte jednotku USB.</strong> Otvorí podponuku USB (nižšie), ktorá detekuje vymeniteľné zariadenia a ponúka pripojenie alebo formátovanie."
+    ]
+  },
+  "usbFlow": {
+    "heading": "Rozpoznanie a pripojenie USB disku",
+    "intro": "Podponuka USB uvádza oddiely na vymeniteľných zariadeniach hlásených nástrojom <code>lsblk</code>. Každý oddiel sa zobrazí s veľkosťou, menovkou súborového systému a aktuálnym stavom. Stav určuje ponúkanú akciu ProxMenux.",
+    "statesTitle": "Tri stavy zariadenia",
+    "stateRows": [
+      {
+        "state": "pripojené",
+        "shown": "Veľkosť · štítok · [fstype] · → /mount/point",
+        "action": "Oddiel je už pripojený. Jeho výber uloží aktuálny bod pripojenia ako lokálny cieľ zálohy. Žiadne nové pripojenie sa nevykoná."
+      },
+      {
+        "state": "odmontované",
+        "shown": "Veľkosť · menovka · [fstype] · (nepripojený — bude pripojený)",
+        "action": "Súborový systém je prítomný, ale nie je namontovaný. Po potvrdení, ProxMenux spustí <code>hb_mount_usb_partition</code>: vytvorí <code>/mnt/backup-LABEL</code> (alebo cestu založenú na UUID, ak nie je označenie), pripojí partíciu a uloží bod pripojenia ako miestny cieľ."
+      },
+      {
+        "state": "prázdny",
+        "shown": "Veľkosť · surový USB disk — bez súborového systému (bude NAFORMÁTOVANÝ)",
+        "action": "Zariadenie nemá súborový systém. Tento deštruktívny postup chráni dvojité potvrdenie. Najprv dialóg Áno/Nie upozorní, že operácia vymaže disk. Potom musí používateľ do vstupného poľa <strong>zadať presnú cestu zariadenia</strong> (napr. <code>/dev/sdb</code>), až následne ProxMenux vytvorí novú tabuľku GPT s oddielom ext4 a pripojí ho."
+      }
+    ],
+    "notMountedFallback": "Ak nie je detekované žiadne USB zariadenie, podmenu spadne späť do jednoduchého vstupného poľa. Operátor môže zadať ľubovoľnú cestu k bodu pripojenia; ak cesta nie je registrovaným bodom pripojenia, dialóg s potvrdením varuje pred pokračovaním."
+  },
+  "safetyCheck": {
+    "heading": "Bezpečnostná kontrola - cieľ vnútri záložnej cesty",
+    "body": "Pred zapísaním archívu <code>_bk_local</code> overí, že cieľový adresár <strong>nie je</strong> podcestou žiadneho zálohovaného adresára. Bežnou chybou by bolo pridanie <code>/root</code> do profilu a výber <code>/root/backups</code> ako cieľ — archív by potom zahrnul sám seba, buď by vytvoril poškodený archív, alebo by rástol bez obmedzenia, kým sa disk nezaplní. Kontrola vyrieši obe cesty pomocou <code>readlink -m</code>, porovná ich a v prípade konfliktu preruší zálohovanie pomocou dialógového okna, ktoré pomenuje konfliktnú cestu a uvedie tri spôsoby, ako to vyriešiť: vybrať cieľ mimo konfliktnej cesty, odstrániť vlastnú položku, ktorá obsahuje cieľ, alebo použiť vlastný režim na zrušenie začiarknutia konfliktnej cesty pre toto spustenie."
+  },
+  "archiveFormat": {
+    "heading": "Formát archívu a kompresia",
+    "intro": "Výstupné meno súboru vloží zdrojové meno hostiteľa a záložnú časovú pečiatku tak, že adresár, v ktorom je niekoľko archívov, sa chronologicky triedi a každý súbor je sebaidentifikačný.",
+    "namePattern": "hostcfg-HOSTNAME-YYYYMMDD_HHMMSS.tar.zst",
+    "compressionTitle": "Kompresia",
+    "compressionBody": "Hlavný postup používa <code>tar --zstd -cf</code> — jediný príkaz komprimujúci na predvolenej úrovni zstd. Ak <code>zstd</code> v zdroji nie je dostupné (na Proxmoxe zriedkavé, ale možné pri minimálnych inštaláciách), ProxMenux použije <code>gzip</code>. V tomto náhradnom postupe sa pri dostupnom <code>pv</code> pridá ukazovateľ priebehu, takže používateľ vidí rast veľkosti archívu v reálnom čase; bez <code>pv</code> sa použije obyčajné <code>tar -czf</code> bez priebežného výpisu.",
+    "sourceTitle": "Čo ide do archívu",
+    "sourceBody": "Príkaz tar sa spustí s <code>-C \"$staging_root\" .</code>, čím archivuje <strong>celý koreň dočasného prípravného adresára</strong>: <code>rootfs/</code>, <code>metadata/</code> a <code>manifest.json</code>. Všetky tri bloky údajov ležia vedľa seba na najvyššej úrovni archívu tar. Rozbalením vznikne presne ten strom, ktorý používa kód obnovy."
+  },
+  "sidecar": {
+    "heading": "Sprievodný súbor JSON",
+    "intro": "Každá úspešná lokálna záloha produkuje sesterský súbor: <code>HOSTNAME-TIMESTAMP.tar.zst.proxmenux.json</code>, zapísaný vedľa archívu funkciou <code>hb_write_archive_sidecar</code>. Tento malý súbor JSON umožňuje ProxMenux Monitor identifikovať archív ako zálohu ProxMenux hostiteľa, aj keď je neskôr presunutý, premenovaný alebo archivovaný inde.",
+    "contentTitle": "Obsah sprievodného súboru",
+    "contentBody": "Sprievodný súbor obsahuje verziu schémy, údaj o tom, či záloha vznikla interaktívne alebo plánovanou úlohou (<code>kind</code>), ID úlohy pri plánovaných spusteniach, použitý režim profilu (<code>default</code> alebo <code>custom</code>), názov zdrojového hostiteľa, pôvodný názov súboru archívu, časovú pečiatku vytvorenia ISO-8601 a veľkosť archívu v bajtoch.",
+    "whyBody": "Karta Backups v Monitore prehľadáva nakonfigurované lokálne adresáre a hľadá sprievodné súbory <code>*.proxmenux.json</code>, nie súbory <code>*.tar.zst</code>, pretože <code>.tar.zst</code> bez sprievodného súboru nemusí byť zálohou ProxMenux. Hľadanie je rýchle (súbory JSON sú malé) a párovanie zostane platné aj po premenovaní archívu, ak sa zodpovedajúco premenuje aj sprievodný súbor."
+  },
+  "restoreAccess": {
+    "heading": "Obnova z miestneho archívu",
+    "body": "Postup obnovy ProxMenux nájde lokálne archívy vyhľadaním sprievodných súborov v nastavenom lokálnom cieli a zobrazí ich v zozname archívov. Výber archívu spustí <code>_rs_check_layout</code>, ktorý rozbalí archív tar do dočasného prípravného adresára a pred pokračovaním overí štruktúru troch blokov údajov. Pri ručnom rozbalení mimo ProxMenux príkaz <code>tar --zstd -xf hostcfg-HOSTNAME-TIMESTAMP.tar.zst -C /tmp/hostcfg</code> vytvorí rovnaký strom, ktorý používa kód obnovy."
+  }
+}
diff --git a/web/messages/sk/docs/backup-restore/destinations/pbs.json b/web/messages/sk/docs/backup-restore/destinations/pbs.json
new file mode 100644
index 00000000..8df7ad4d
--- /dev/null
+++ b/web/messages/sk/docs/backup-restore/destinations/pbs.json
@@ -0,0 +1,113 @@
+{
+  "meta": {
+    "title": "Cieľ Proxmox Backup Server — repozitár, šifrovanie a obnova | ProxMenux",
+    "description": "Cieľ PBS ukladá zálohy hostiteľa ProxMenux ako zálohy PBS. Stránka opisuje zisťovanie úložísk z /etc/pve/storage.cfg, ručnú konfiguráciu PBS, odoslanie .pxar, šifrovanie na strane klienta so súborom kľúča a voliteľnou obnovovacou kópiou chránenou prístupovou frázou aj obnovu kľúča z viacerých zdrojov na novo nainštalovanom hostiteľovi.",
+    "ogTitle": "Zálohovanie ProxMenux — cieľ Proxmox Backup Server",
+    "ogDescription": "Ako ProxMenux ukladá zálohy hostiteľa na Proxmox Backup Server so šifrovaním súborom kľúča na strane klienta a uloženou kópiou na obnovu.",
+    "twitterTitle": "PBS Záložné miesto ProxMenux",
+    "twitterDescription": "Cieľ Proxmox Backup Server so šifrovaním súborom kľúča a obnovovacou kópiou chránenou prístupovou frázou."
+  },
+  "header": {
+    "title": "Proxmox Backup Server",
+    "description": "Cieľ PBS odosiela celý prípravný adresár ako jednu zálohu .pxar do dátového úložiska Proxmox Backup Server. Voliteľne ju šifruje na strane klienta súborom kľúča a vedľa každej zálohy môže uložiť aj obnovovaciu kópiu kľúča chránenú prístupovou frázou.",
+    "section": "Záloha a obnova"
+  },
+  "recommendedBadge": "Odporúčané miesto určenia",
+  "aboutPbs": {
+    "heading": "Čo je Proxmox Backup Server",
+    "body": "Proxmox Backup Server (PBS) je zálohovací server spoločnosti Proxmox, ktorý vyvíja a udržiava rovnaký tím ako Proxmox VE. Prijíma zálohy z hostiteľov Proxmox VE (VM, kontajnerov LXC a cez <code>proxmox-backup-client</code> aj ľubovoľných adresárov hostiteľa), podporuje deduplikáciu po blokoch, šifrovanie na strane klienta a pravidlá uchovávania na serveri. ProxMenux používa PBS ako jeden z troch cieľov záloh hostiteľa. Všetky tu opísané mechanizmy PBS (skupiny záloh, archívy <code>.pxar</code>, <code>--backup-id</code> a šifrovanie súborom kľúča) patria k štandardnému správaniu PBS."
+  },
+  "intro": {
+    "title": "Jedna záloha pri každom spustení, deduplikácia po blokoch",
+    "body": "Záloha PBS vytvorí v dátovom úložisku jednu položku pod identifikátorom <code>host/hostcfg-HOSTNAME/BACKUP-TIME</code>. Obsah tvorí archív <code>.pxar</code> s rovnakou trojblokovou štruktúrou ako v časti <em>Ako to funguje</em>. PBS deduplikuje bloky medzi všetkými zálohami v úložisku, takže ďalšie zálohy toho istého hostiteľa prenášajú a ukladajú iba zmenené bloky. Uchovávanie pri plánovaných úlohách riadi samotný ProxMenux: po každom úspešnom spustení vykoná <code>run_scheduled_backup.sh</code> príkaz <code>proxmox-backup-client prune</code> s voľbami <code>--keep-last</code> / <code>--keep-daily</code> / <code>--keep-weekly</code> podľa hodnôt nastavených v úlohe."
+  },
+  "repoSelection": {
+    "heading": "Výber úložiska",
+    "intro": "ProxMenux objavuje archív PBS z dvoch zdrojov na každej zálohe. Operátor vyberie jeden z jednotného menu; voľba určuje <code>HB_PBS_REPOSITORY</code>, <code>HB_PBS_SECRET</code> a <code>HB_PBS_FINGERPRINT</code> pre spustenie.",
+    "sourceRows": [
+      {
+        "source": "Proxmox storage.cfg (automaticky zistené)",
+        "path": "/etc/pve/storage.cfg + /etc/pve/priv/storage/NAME.pw",
+        "content": "Každá sekcia <code>pbs:</code> v konfigurácii úložísk Proxmoxu sa zistí automaticky. Server, dátové úložisko, používateľské meno a odtlačok certifikátu sa prevezmú z tejto sekcie. Heslo sa načíta z adresára prihlasovacích údajov Proxmoxu. V ProxMenux ho netreba zadávať znova: úložisko je dostupné hneď po konfigurácii v Proxmoxe."
+      },
+      {
+        "source": "ProxMenux manuálna konfigurácia",
+        "path": "/usr/local/share/proxmenux/pbs-manual-configs.txt + pbs-pass-NAME.txt + pbs-fingerprint-NAME.txt",
+        "content": "Pridáva sa cez <em>Nastaviť ciele záloh → Ciele PBS → Pridať PBS</em>. Zadáva sa názov, používateľské meno (<code>root@pam</code> alebo <code>user@pbs!token</code>), hostiteľ alebo IP adresa, dátové úložisko a heslo. Pri prázdnom hesle sa výzva zopakuje: inak by sa prázdna hodnota potichu uložila a každá ďalšia záloha by zlyhala s nejasnou chybou overenia. Táto možnosť slúži pre PBS, ktorý nie je zaregistrovaný ako úložisko Proxmoxu."
+      }
+    ],
+    "menuTitle": "Výberové menu",
+    "menuBody": "Oba zdroje sú v jednej ponuke a každý riadok označuje pôvod (<code>[proxmox]</code> alebo <code>[manual]</code>). Položky bez zisteného hesla majú upozornenie <code>⚠ no password</code>; pri ich výbere treba heslo zadať pred spustením zálohy. Odtlačok sa odovzdáva nástroju <code>proxmox-backup-client</code> cez premennú prostredia <code>PBS_FINGERPRINT</code>. Ak odtlačok chýba, klient pri prvej zálohe interaktívne požiada operátora o prijatie certifikátu servera."
+  },
+  "backupCommand": {
+    "heading": "Záložný príkaz",
+    "intro": "Odoslanie používa jediné volanie <code>proxmox-backup-client backup</code>. ProxMenux pomocou <code>env</code> odovzdáva klientovi heslo, šifrovacie heslo a odtlačok ako premenné prostredia.",
+    "cmd": "env \\\n    PBS_PASSWORD=\"$HB_PBS_SECRET\" \\\n    PBS_ENCRYPTION_PASSWORD=\"$HB_PBS_ENC_PASS\" \\\n    PBS_FINGERPRINT=\"$HB_PBS_FINGERPRINT\" \\\n    proxmox-backup-client backup \\\n        hostcfg.pxar:$staging_root \\\n        --repository USER@REALM@HOST:DATASTORE \\\n        --backup-type host \\\n        --backup-id  hostcfg-HOSTNAME \\\n        --backup-time BACKUP-EPOCH \\\n        [--keyfile /usr/local/share/proxmenux/pbs-key.conf]",
+    "backupIdTitle": "Identifikačné meno zálohy",
+    "backupIdBody": "Predvolený identifikátor zálohy je <code>hostcfg-HOSTNAME</code>. Pred odoslaním ho operátor potvrdí alebo upraví. Znaky mimo <code>[A-Za-z0-9_-]</code> aj pomlčky na konci sa odstránia. Opakované použitie rovnakého ID je zámerné: PBS ho chápe ako <em>skupinu</em> a každá ďalšia záloha pribudne do tejto skupiny ako nová položka so spoločnou deduplikáciou s predchádzajúcimi zálohami.",
+    "pxarTitle": "Prečo je zdrojom celý prípravný adresár",
+    "pxarBody": "Zdrojom archívu <code>.pxar</code> je celý <code>staging_root</code>: spolu <code>rootfs/</code>, <code>metadata/</code> aj <code>manifest.json</code>. Staršie verzie používali ako zdroj <code>$staging_root/rootfs</code>, takže v archíve chýbal adresár <code>metadata/</code>. Kontrola kompatibility pri obnove nemala čo čítať a zobrazovala upozornenia na iného hostiteľa aj pri obnove na pôvodnom hostiteľovi. Staré zálohy obsahujúce iba rootfs sa stále obnovujú správne pomocou tretej vetvy <code>_rs_check_layout</code>, ktorá plochý strom <code>etc/var/root/usr</code> zabalí do hierarchie <code>rootfs/</code>."
+  },
+  "encryption": {
+    "heading": "Šifrovanie na strane klienta",
+    "glossaryHint": "Táto časť používa pojmy <em>súbor kľúča</em>, <em>prístupová fráza</em> a <em>obnovovacia obálka</em>. <glosarioLink>Slovník pojmov</glosarioLink> vysvetľuje ich rozdiely jednou vetou pre každý pojem.",
+    "intro": "Šifrovanie PBS na strane klienta šifruje bloky súborom kľúča na zdrojovom hostiteľovi ešte pred odoslaním. V ProxMenux je voliteľné. Ak sa zapne, operátor pri nastavení výslovne zvolí áno alebo nie, či sa má na PBS uložiť aj obnovovacia kópia súboru kľúča chránená prístupovou frázou. Voľbu môže neskôr zmeniť v Monitore. Súbor kľúča je vždy na kanonickej ceste <code>/usr/local/share/proxmenux/pbs-key.conf</code> a pri každej ďalšej šifrovanej zálohe sa použije bez ďalších otázok.",
+    "keyfileTitle": "Nastavenie súboru kľúčov",
+    "keyfileBody": "Dialóg šifrovania sa zobrazí pri prvej šifrovanej zálohe hostiteľa. Najprv sa opýta, či sa má záloha šifrovať: <em>Nie</em> pokračuje bez šifrovania, <em>Áno</em> prejde na druhý krok. Ten závisí od toho, či je na ceste <code>/usr/local/share/proxmenux/pbs-key.conf</code> už nainštalovaný súbor kľúča. Ak áno, použije sa bez otázok a zálohovanie pokračuje; ani pri ďalších zálohách sa otázka neopakuje. Ak nie, ponuka poskytne dve možnosti. <em>Vygenerovať nový súbor kľúča</em> spustí <code>proxmox-backup-client key create --kdf none</code>. <em>Použiť existujúci súbor kľúča</em> automaticky zistí kľúč spravovaný PVE: ak je vybrané úložisko PBS v Proxmoxe zaregistrované so šifrovacím kľúčom na ceste <code>/etc/pve/priv/storage/&lt;NAME&gt;.enc</code>, súbor sa bez otázok skopíruje na kanonickú cestu ProxMenux. Ak sa nenájde zodpovedajúci kľúč PVE, dialóg vyžiada absolútnu cestu, kam operátor už súbor kľúča na hostiteľovi umiestnil. V oboch prípadoch sa uloží na kanonickú cestu s <code>chmod 600</code>.",
+    "modesTitle": "Súbor kľúča pre každý hostiteľ alebo spoločný súbor",
+    "modesIntro": "Oba modely sú podporované a ani jeden nie je povinný. Operátor si vyberie podľa organizácie svojich hostiteľov.",
+    "modesPerHostTitle": "Vlastný súbor kľúča pre každý hostiteľ (predvolené)",
+    "modesPerHostBody": "Každý hostiteľ generuje svoj vlastný súbor kľúčov prvýkrát, čo umožňuje šifrovanie PBS. Izolácia je maximálna: ohrozenie súboru kľúčov jedného hostiteľa nevystavuje zálohy žiadneho iného hostiteľa. Odporúčané pre produkčné prostredia a pre prostredia, v ktorých majú hostitelia rôznych vlastníkov alebo hranice súladu.",
+    "modesSharedTitle": "Zdieľaný súbor kľúča (import na každom hostiteľovi)",
+    "modesSharedBody": "Jeden súbor hlavného kľúča vygenerovaný raz a nainštalovaný na každom hostiteľovi pomocou možnosti <em>Použiť existujúci súbor kľúča</em>. Správa je jednoduchšia: jediné tajomstvo na ochranu a ktorýkoľvek hostiteľ môže dešifrovať archívy akéhokoľvek iného (užitočné na konsolidáciu, nácvik obnovy medzi hostiteľmi alebo centralizované overenie zálohy). Kompromisom je, že únik zdieľaného súboru kľúča odhalí každého hostiteľa naraz. Odporúča sa pre domáce laboratóriá a pre flotily, kde majú všetci hostitelia rovnakého vlastníka a hranice dôvery.",
+    "recoveryTitle": "Odoslanie kľúča na PBS — rozhoduje operátor",
+    "recoveryBody": "Hneď po výbere súboru kľúča položí ProxMenux výslovnú otázku <em>Odoslať kľúč na PBS?</em> s dvoma odpoveďami. <strong>Kým operátor nezvolí Áno, na PBS sa neodošle žiadny obnovovací artefakt.</strong> Predvolená voľba je <em>Nie, ponechať iba lokálne</em>: kľúč zostane na kanonickej miestnej ceste, ProxMenux neodosiela na PBS žiadne obnovovacie artefakty a externú kópiu zabezpečí operátor. Tlačidlo <em>Stiahnuť súbor kľúča</em> v riadku cieľa PBS v Monitore ju poskytne na požiadanie. Voľba <em>Áno, odoslať</em> vyžiada dvakrát prístupovú frázu na obnovu a overí zhodu. ProxMenux ňou zašifruje súbor kľúča pomocou AES-256-CBC a PBKDF2 (600 000 iterácií, náhodná soľ) a vytvorí <code>pbs-key.recovery.enc</code>. Každá ďalšia šifrovaná záloha odošle túto obálku na PBS ako priradenú skupinu záloh. Pri týchto odoslaniach sa na PBS neposiela prístupová fráza ani súbor kľúča v otvorenom tvare. Voľbu možno kedykoľvek zmeniť v Monitore: ovládací prvok v riadku PBS prepína Áno/Nie a okamžite použije Spustiť odosielanie, Zastaviť odosielanie alebo Aktualizovať prístupovú frázu podľa aktuálneho stavu.",
+    "blobUploadTitle": "Párovaná záložná skupina na PBS",
+    "blobUploadBody1": "Keď je režim úschovy <em>Áno, nahrať</em>, ProxMenux odošle obálku na obnovenie do PBS po každej zašifrovanej zálohe ako druhá, spárovaná skupina záloh s rovnakým názvom ako hostiteľská skupina, ale končiaca na <code>-keyrecovery</code>. Tieto dve skupiny sedia vedľa seba v zozname dátového skladu – jedna pre zálohy hostiteľa, druhá pre obálky na obnovenie. <strong>Obálka nikdy neopustí hostiteľa v obyčajnom texte</strong>: šifrovanie prebieha na samotnom hostiteľovi pomocou AES-256-CBC a PBKDF2 predtým, ako prejdú akékoľvek bajty na drôt (<code>openssl enc -aes-256-cbc -pbkdf2 -iter 600000 -salt</code>). PBS prijíma iba už zašifrovanú obálku.",
+    "envelopeSecurityTitle": "Predstavuje odoslanie obnovovacieho súboru na PBS bezpečnostné riziko?",
+    "envelopeSecurityBody": "Obnovovací súbor je šifrovaný pri prenose aj pri uložení. Prístupová fráza na obnovu neopúšťa hostiteľa: šifrovanie prebehne lokálne pred odoslaním a PBS dostane iba zašifrovaný výsledok. Správca PBS alebo ktokoľvek s prístupom k dátovému úložisku môže obnovovací súbor stiahnuť, ale bez prístupovej frázy nedokáže prečítať súbor kľúča vnútri; ide o nečitateľný šifrovaný text. Na získanie súboru kľúča treba obe časti súčasne: obnovovací súbor aj prístupovú frázu. Obe má iba operátor.",
+    "blobUploadConstraintTitle": "Prečo dve skupiny namiesto jedného zašifrovaného",
+    "blobUploadConstraintBody": "Jediné volanie <code>proxmox-backup-client backup</code> zašifruje všetky svoje archívy rovnakým súborom kľúča alebo nezašifruje žiadny; kombinácia nie je možná. Záloha hostiteľa sa musí zašifrovať jeho kľúčom, ale obnovovacia obálka sa nesmie odoslať v tom istom volaní. Bola by zašifrovaná práve kľúčom, ktorý obsahuje. Na novo nainštalovanom hostiteľovi by ju nebolo možné otvoriť: na dešifrovanie kľúča by bol potrebný ten istý kľúč. Preto sa oba artefakty odosielajú nezávisle a zobrazujú sa ako dve skupiny. Klient PBS šifruje zálohu hostiteľa súborom kľúča a ProxMenux pred odoslaním šifruje obnovovaciu obálku prístupovou frázou. Dve odlišné šifrovacie vrstvy chránia dva odlišné objekty.",
+    "blobUploadImageAlt": "Rozhranie PBS zobrazuje skupiny záloh hostcfg-HOSTNAME a hostcfg-HOSTNAME-keyrecovery vedľa seba v zozname dátového úložiska.",
+    "blobUploadImageCaption": "Rozhranie PBS — priradené skupiny záloh. Hlavná skupina obsahuje zálohy hostiteľa; skupina -keyrecovery obsahuje súbor kľúča chránený prístupovou frázou.",
+    "recoverTitle": "Obnovenie nového hostiteľa",
+    "recoverBody": "Ak miestny súbor kľúča chýba na kanonickej ceste, napríklad po preinštalovaní hostiteľa alebo úmyselnom odstránení, obnova vyskúša tri zdroje v poradí a skončí pri prvom použiteľnom kľúči. Najprv sa bez otázok skopíruje zodpovedajúci kľúč spravovaný PVE z <code>/etc/pve/priv/storage/&lt;NAME&gt;.enc</code> na kanonickú cestu, ak existuje pre vybrané úložisko PBS. Ak je na PBS dostupná skupina <code>-keyrecovery</code>, druhý krok stiahne jej najnovšiu snímku a vyžiada prístupovú frázu na dešifrovanie. Ak ani jedna možnosť nefunguje alebo ich operátor odmietne, tretí krok vyžiada absolútnu cestu k súboru kľúča na tomto hostiteľovi a skopíruje ho na kanonickú cestu. Monitor poskytuje rovnaký import v okne podrobností zálohy. Ak Obnoviť, Stiahnuť alebo Zobraziť obsah potrebuje chýbajúci kľúč, hore sa zobrazí jantárový panel. Ak je kľúč nainštalovaný, ale nezodpovedá šifrovaniu zálohy, PBS vráti chybu <code>wrong key — manifest's key XX does not match provided key YY</code>. Rovnaké tri akcie potom zobrazia štruktúrovaný panel so zvýrazneným odtlačkom kľúča požadovaným manifestom, aby operátor vedel, ktorý kľúč má pre túto zálohu importovať.",
+    "monitorManagementTitle": "Správa súboru kľúčov z monitora",
+    "monitorManagementBody": "Monitor zobrazuje ovládanie súboru kľúča priamo v každom riadku cieľa PBS na stránke konfigurácie záloh. Sú tam tri akcie: <em>Stiahnuť</em> exportuje aktuálny súbor do prehliadača operátora; <em>Nahrať</em> nahradí nainštalovaný súbor dodaným súborom, pričom pôvodný prepíše až po úspešnom uložení nového na kanonickú cestu; <em>Odstrániť</em> zmaže súbor z hostiteľa. Vedľa je ovládanie obnovovacej kópie: výber Áno/Nie pre <em>Odoslať kľúč na PBS?</em>, pole prístupovej frázy pri voľbe Áno a kontextové tlačidlo na použitie voľby <em>Spustiť odosielanie</em>, <em>Zastaviť odosielanie</em> alebo <em>Aktualizovať prístupovú frázu</em>. Všetky akcie používajú rovnaké koncové body Flask ako terminálové rozhranie, takže účinok na disku a stav na PBS sú z oboch rozhraní rovnaké."
+  },
+  "restoreAccess": {
+    "heading": "Získavanie na strane obnovy",
+    "body": "Obnova zisťuje zálohy hostiteľa ProxMenux na PBS zoznamom skupín v nakonfigurovanom úložisku a filtrovaním podľa vzoru identifikátora zálohy. Karta Zálohy v Monitore zobrazuje rovnaký zoznam. Výber zálohy spustí <code>proxmox-backup-client restore</code> s rovnakým úložiskom, heslom a odtlačkom, prípadne aj s <code>--keyfile</code>, ak bola záloha šifrovaná. Archív <code>.pxar</code> sa rozbalí do prípravného adresára, ktorý <code>_rs_check_layout</code> odovzdá štandardnému procesu obnovy. Pri ručnom získaní mimo ProxMenux rozbalí ten istý príkaz archív na ľubovoľnú cestu; výsledný strom možno skontrolovať alebo použiť pri ručnej obnove."
+  },
+  "references": {
+    "heading": "Odkazy",
+    "intro": "Oficiálna dokumentácia Proxmox Backup Server ku komponentom, ktoré ProxMenux používa.",
+    "items": [
+      {
+        "label": "Dokumentácia Proxmox Backup Server",
+        "href": "https://pbs.proxmox.com/docs/",
+        "tail": " — hlavný rozcestník pre inštaláciu, správu, úložiská, používateľov a roly."
+      },
+      {
+        "label": "proxmox-backup-client",
+        "href": "https://pbs.proxmox.com/docs/backup-client.html",
+        "tail": " — nástroj príkazového riadka, ktorý ProxMenux používa pri každej zálohe a obnove. Opisuje identifikátory a typy záloh, archívy, syntax úložísk a premenné prostredia."
+      },
+      {
+        "label": "Šifrovanie na strane klienta",
+        "href": "https://pbs.proxmox.com/docs/backup-client.html#encryption",
+        "tail": " — vytvorenie súboru kľúča, režimy --kdf a model šifrovania, ktorý ProxMenux rozširuje o obnovovaciu kópiu chránenú prístupovou frázou."
+      },
+      {
+        "label": "Správa dátových úložísk",
+        "href": "https://pbs.proxmox.com/docs/storage.html",
+        "tail": "— vytváranie a správa dátových úložísk, ktoré prijímajú zálohy hostiteľa, vrátane rozloženia chunk-store a povolení."
+      },
+      {
+        "label": "Prerezávanie a zber odpadu",
+        "href": "https://pbs.proxmox.com/docs/maintenance.html#pruning",
+        "tail": " — model uchovávania pre --keep-last / --keep-daily / --keep-weekly, ktorý ProxMenux uplatňuje pre každú plánovanú úlohu, aj spôsob, akým PBS uvoľňuje nepoužívané bloky po odstránení starých záloh."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sk/docs/backup-restore/glossary.json b/web/messages/sk/docs/backup-restore/glossary.json
new file mode 100644
index 00000000..f883a15d
--- /dev/null
+++ b/web/messages/sk/docs/backup-restore/glossary.json
@@ -0,0 +1,230 @@
+{
+  "meta": {
+    "title": "Slovník — zálohovanie a obnova | ProxMenux",
+    "description": "Slovník systému zálohovania a obnovy ProxMenux: šifrovanie, súbor kľúčov, prístupová fráza, obálka obnovy, PBS, bloky, rootfs, manifest, vykonávací proces a doplnenie medzi verziami jadra.",
+    "ogTitle": "Slovník zálohovania a obnovy | ProxMenux",
+    "ogDescription": "Jasné definície slovnej zásoby použitej cez zálohovanie a obnovenie dokumentácie ProxMenux.",
+    "twitterTitle": "Slovník zálohovania a obnovy | ProxMenux",
+    "twitterDescription": "Prístupová fráza, súbor kľúčov, obálka obnovy, rootfs, manifest, PBS a bloky — všetko vysvetlené na jednom mieste."
+  },
+  "header": {
+    "title": "Slovník pojmov",
+    "description": "Pojmy z dokumentácie zálohovania a obnovy spolu s definíciami.",
+    "section": "Záloha a obnova"
+  },
+  "intro": {
+    "body": "Pojmy sú zoskupené podľa témy. Každý záznam dáva termín a krátku definíciu."
+  },
+  "groups": [
+    {
+      "title": "Šifrovanie a obnovenie kľúča",
+      "intro": "Slovník pre šifrovací blok PBS. Zahŕňa dve odlišné tajomstvá: binárny súbor kľúčov a písomné heslo.",
+      "entries": [
+        {
+          "id": "passphrase-recuperacion",
+          "term": "Prístupová fráza na obnovu",
+          "def": "Textové heslo, ktoré užívateľ vyberá na ochranu obálky <a href=\"#sobre-recuperacion\">obnovenie </a>. Vyžaduje sa dvakrát s kontrolou zhody a používa sa len na šifrovanie obálky a dešifrovanie súboru, ak je niekedy potrebné obnoviť súbor kľúčov. <strong>Nie je to heslo, ktoré odomkne samotný súbor kľúčov </strong> a nikdy sa nepošle PBS. Počas normálnej zálohy nikdy neopustí hostiteľa."
+        },
+        {
+          "id": "clave-cifrado",
+          "term": "Súbor kľúčov (šifrovací kľúč)",
+          "def": "Súbor kľúča používaný proxmox-backup-client na šifrovanie <a href=\"#chunk\">blokov</a> pred odoslaním do PBS. Bez príslušného kľúča sa šifrované dáta nedajú čítať. ProxMenux ho uloží do <code>/usr/local/share/proxmenux/pbs-key.conf</code> s režimom <code>600</code>. Chráňte ho; <a href=\"#sobre-recuperacion\">obálka obnovy</a> slúži na jeho získanie pri strate."
+        },
+        {
+          "id": "contrasena-keyfile",
+          "term": "Heslo súboru kľúčov (KDF heslo)",
+          "def": "Voliteľné heslo, ktoré môže byť prenášané samotným súborom kľúčov, odlišné od <a href=\"#passphrase-recuperacion\">prístupovej frázy na obnovu</a>. Existuje len vtedy, keď bol súbor s kľúčom vytvorený <code>--kdf scrypt</code> (zvyčajne importovaný súbor kľúčov). Bez neho nie je možné súbor kľúčov odomknúť pre použitie. ProxMenux pretrváva v zašifrovanej forme na hostiteľa, takže plánované zálohy môžu bežať bez interaktívneho promptu."
+        },
+        {
+          "id": "sobre-recuperacion",
+          "term": "Obálka obnovy",
+          "def": "Súbor <a href=\"#clave-cifrado\">súbor kľúčov</a> zabalený do ďalšej vrstvy: je zašifrovaný <a href=\"#passphrase-recuperacion\">prístupovou frázou na obnovu</a> použitie <a href=\"#aes-256-cbc\">AES-256-CBC</a> a <a href=\"#pbkdf2\">PBKDF2</a> predtým, než opustí hostiteľa. Nahrá sa do PBS ako <code>-keyrecovery</code> skupina. Bez passfrázy je obálka nepriehľadná: sťahovanie z PBS neodhaľuje súbor kľúčov."
+        },
+        {
+          "id": "cifrado-cliente",
+          "term": "Šifrovanie na strane klienta",
+          "def": "Model šifrovania, pri ktorom sa dáta zašifrujú na zdrojovom hostiteľovi pred odoslaním. PBS prijíma a ukladá iba šifrované dáta; bez súboru kľúča ich neprečíta ani správca PBS s prístupom k dátovému úložisku. ProxMenux na tomto modeli stavia a pridáva <a href=\"#sobre-recuperacion\">obálku obnovy</a>."
+        },
+        {
+          "id": "kdf-none",
+          "term": "--kdf none",
+          "def": "Možnosť <code>proxmox-backup-client key create</code>, ktorá vytvára súbor kľúčov bez pripojenej pasovej frázy. Súbor kľúčov možno použiť priamo bez promptu, ktorý je nevyhnutný pre plánované pracovné miesta bez dozoru. Toto ProxMenux používa štandardne pri generovaní nového súboru kľúčov."
+        },
+        {
+          "id": "kdf-scrypt",
+          "term": "--kdf scrypt",
+          "def": "Možnosť <code>proxmox-backup-client key create</code>, ktorá vytvára súbor kľúčov chránený pomocou <a href=\"#contrasena-keyfile\">prístupovej frázy súboru kľúča</a>. Každé použitie súboru kľúčov si vyžaduje odomknutie s touto passfrázou. ProxMenux akceptuje tento štýl súboru kľúčov pri importe a ukladá heslo šifrované, takže plánované zálohy môžu spustiť bez dozoru."
+        },
+        {
+          "id": "aes-256-cbc",
+          "term": "AES-256-CBC",
+          "def": "Štandardné symetrické šifrovanie. ProxMenux ju používa (prostredníctvom <code>openssl enc -aes-256-cbc</code>) na zabalenie <a href=\"#clave-cifrado\">súboru kľúča</a> s <a href=\"#passphrase-recuperacion\"> prístupovou frázou na obnovu</a> a výrobu <a href=\"#sobre-recuperacion\">obálky</a>."
+        },
+        {
+          "id": "pbkdf2",
+          "term": "PBKDF2",
+          "def": "Kryptografická funkcia, ktorá z prístupovej frázy zadanej človekom odvodí binárny šifrovací kľúč. Mnohými iteráciami spomaľuje útoky hrubou silou. Pri šifrovaní obálky obnovy ju ProxMenux používa so 600 000 iteráciami a náhodnou soľou."
+        }
+      ]
+    },
+    {
+      "title": "Štruktúra zálohy",
+      "intro": "Pojmy popisujúce, čo žije v zálohe, bez ohľadu na cieľ.",
+      "entries": [
+        {
+          "id": "rootfs",
+          "term": "rootfs / koreňový súborový systém",
+          "def": "Súborová kópia systému zdrojového hostiteľa vytvorená pomocou <code>rsync</code> podľa <a href=\"#perfil-defecto\">predvoleného profilu</a> a <a href=\"#rutas-personalizadas\">vlastných ciest</a>. Nie je to obraz celého disku: kopírujú sa iba cesty s konfiguráciou alebo stavom, ktoré Proxmox nedokáže sám obnoviť."
+        },
+        {
+          "id": "manifiesto",
+          "term": "Manifest (manifest.json)",
+          "def": "Štruktúrovaný dokument JSON opisujúci zdrojový hostiteľ v čase zálohovania: hardvér, úložisko, jadro, ProxMenux-inštalované komponenty a inventár VM a LXC. Vyrába ho šesť nezávislých zberateľov. Obnoviteľný tok ho využíva na porovnanie zdroja a cieľa."
+        },
+        {
+          "id": "staging",
+          "term": "Staging adresár",
+          "def": "Dočasný adresár, kde ProxMenux zhromažďuje tri bloky (rootfs, metaúdaje a manifest) pred ich zabalením a nahrávanie do cieľa. Po dokončení zálohy sa automaticky odstráni, a to aj po prerušení."
+        },
+        {
+          "id": "perfil-defecto",
+          "term": "Predvolený profil",
+          "def": "Vybraná sada ciest, ktoré ProxMenux predvolene kopíruje v každej zálohe. Zahŕňa konfiguráciu PVE, sieť, SSH, jadro, apt, nástroje ProxMenux a ďalšie. Je definovaná v kóde a opísaná na stránke <em>Ako to funguje</em>."
+        },
+        {
+          "id": "rutas-personalizadas",
+          "term": "Vlastné cesty",
+          "def": "Extra cesty, ktoré užívateľ pridáva na vrchol <a href=\"#perfil-defecto\">predvoleného profilu</a>. Buď perzistentné (uložené v <code>backup-extra-paths.txt</code>) alebo iba pre dané spustenie (vybrané vo vlastnom režime)."
+        }
+      ]
+    },
+    {
+      "title": "Miesta určenia a skladovanie",
+      "intro": "Pojmy súvisiace s cieľom zálohy — server PBS, lokálny archív alebo repozitár Borg — a usporiadaním dát v PBS.",
+      "entries": [
+        {
+          "id": "repositorio-pbs",
+          "term": "PBS repozitár",
+          "def": "Kombinácia Proxmox Backup Server + <a href=\"#datastore\">úložisko údajov</a> + používateľ, ktorý prijíma zálohu. Identifikované podľa reťazca <code>user@realm@host:datastore</code>. Jeden PBS server môže hostiť niekoľko úložísk."
+        },
+        {
+          "id": "datastore",
+          "term": "Dátové úložisko",
+          "def": "Konkrétne dátové úložisko na serveri PBS so zálohami a ich blokmi. Každé je na súborovom systéme servera PBS a má vlastné oprávnenia a pravidlá."
+        },
+        {
+          "id": "chunk",
+          "term": "Chunk / chunk deduplikácia",
+          "def": "PBS rozdelí zálohu na bloky premenlivej veľkosti, každý identifikuje hashom a uloží ho iba raz, aj keď sa vyskytuje vo viacerých zálohách. Následné zálohy rovnakého alebo podobných hostiteľov tak vyžadujú málo ďalšieho miesta."
+        },
+        {
+          "id": "fingerprint",
+          "term": "Odtlačok prsta",
+          "def": "Kryptografický odtlačok certifikátu PBS servera TLS. Umožňuje klientovi overiť, či sa rozpráva s plánovaným serverom bez toho, aby sa spoliehal na verejný certifikačný orgán. ProxMenux ho prenáša na <code>proxmox-backup-client</code> prostredníctvom premennej prostredia <code>PBS_FINGERPRINT</code>."
+        },
+        {
+          "id": "grupo-copia",
+          "term": "Skupina zálohy",
+          "def": "Logická skupina v PBS pre postupné zálohy toho istého zdroja. Nové zálohy využívajú deduplikáciu s predchádzajúcimi. Pri zapnutom šifrovaní používa ProxMenux dve skupiny na hostiteľa: jednu pre jeho zálohu a druhú s príponou <code>-keyrecovery</code> pre <a href=\"#sobre-recuperacion\">obálku obnovy</a>."
+        },
+        {
+          "id": "backup-id",
+          "term": "ID zálohy",
+          "def": "Názov skupiny <a href=\"#grupo-copia\">backup</a>. ProxMenux predvolený <code>hostcfg-HOSTNAME</code> a umožňuje užívateľovi upraviť pred nahrávaním; nepodporované znaky sú automaticky odstránené."
+        },
+        {
+          "id": "pxar",
+          "term": ".pxar",
+          "def": "PBS-native archív formát pre adresáre. Správa sa ako archív tar optimalizovaný pre deduplikáciu kúskov: PBS namiesto ukladania nepriehľadného súboru rozbije svoj obsah na opakovane použiteľné kúsky."
+        }
+      ]
+    },
+    {
+      "title": "Vykonávanie a plánovanie",
+      "intro": "Pojmy systému plánovaných úloh ProxMenux.",
+      "entries": [
+        {
+          "id": "runner",
+          "term": "Vykonávací proces",
+          "def": "Skript <code>run_scheduled_backup.sh</code> vykonávajúci plánovanú zálohu. Prečíta konfiguráciu úlohy, spustí príslušný backend (Local, PBS alebo Borg), po úspechu uplatní pravidlá uchovávania a odošle nastavené oznámenia."
+        },
+        {
+          "id": "trabajo-programado",
+          "term": "Plánovaná úloha",
+          "def": "Pretrvávajúca konfigurácia opakovaného zálohovania. Drží cieľ, poverovacie listiny, šifrovanie, harmonogram a uchovávanie. Žije na <code>/var/lib/proxmenux/backup-jobs/&lt;id&gt;.env</code>."
+        },
+        {
+          "id": "modo-adjunto",
+          "term": "Pripojený režim",
+          "def": "Úloha bez vlastného časovača. Hook job-end PVE <code>vzdump</code> ju spustí po zálohách hostí pri zhodnom úložisku. Vybraná nadradená úloha poskytne cieľ a uchovávanie, ktoré sa pri každom spustení znova načíta z nadradenej úlohy, ale hook porovnáva úložisko, nie ID nadradenej úlohy. Spustiť ju môže aj iná úloha s tým istým úložiskom. Iba Local a PBS."
+        },
+        {
+          "id": "timer-systemd",
+          "term": "Časovač Systemd",
+          "def": "Štandardný mechanizmus systemd, ktorý spúšťa príkaz podľa kalendára. ProxMenux vytvára časovač pre každú <em>nezávislú</em> plánovanú úlohu. Úlohy v <a href=\"#modo-adjunto\">pripojenom režime</a> časovač nemajú; spúšťa ich hook PVE."
+        },
+        {
+          "id": "retencion",
+          "term": "Uchovávanie (keep-last, keep-daily…)",
+          "def": "Politika, ktorá rozhodne, ktoré staršie zálohy udržať a ktoré prerezávať. Definované podľa úloh s parametrami ako <code>keep-last</code>, <code>keep-daily</code>, <code>keep-weekly</code>, <code>keep-monthly</code>. Aplikuje vykonávací proces po každej úspešnej zálohe."
+        }
+      ]
+    },
+    {
+      "title": "Obnoviť",
+      "intro": "Pojmy z postupu obnovy.",
+      "entries": [
+        {
+          "id": "restauracion-universal",
+          "term": "Všeobecná obnova",
+          "def": "Tok obnovy ProxMenux neextrahuje iba súborový systém: prečíta manifest, aby zistil rozdiely medzi zdrojom a cieľom, reprodukuje konfiguráciu systému a znova spustí inštalačné programy pre komponenty spravované ProxMenux. Cieľom je reprodukovať hostiteľa zdroja, nielen archív."
+        },
+        {
+          "id": "hidratacion",
+          "term": "Hydratácia (cross-kernel)",
+          "def": "Krok obnovy, ktorý zlúči používateľské nastavenia zo zdroja (parametre IOMMU, ID zariadení VFIO, vlastné úpravy a kľúče GRUB) s novou konfiguráciou štartu cieľa bez doslovného kopírovania súborov viazaných na zdrojové jadro. Beží, ak je jadro cieľa novšie než v zálohe."
+        },
+        {
+          "id": "cross-kernel",
+          "term": "Obnova medzi kernelmi",
+          "def": "Obnovte tam, kde sa jadro cieľa líši od jadra zdroja (zvyčajne je novšie). Vyžaduje sa prechod <a href=\"#hidratacion\">hydratácia</a>, aby sa predišlo presúvaniu súborov nekompatibilných s jadrom cieľa."
+        },
+        {
+          "id": "instalador-postboot",
+          "term": "Inštalátor post-boot",
+          "def": "Komponenty reinštalované po prvom štarte obnoveného hostiteľa (ovládače NVIDIA, ovládače Coral TPU, nástroje AMD GPU, nástroje Intel GPU). Každý inštalátor beží proti jadru cieľa, takže obnovený hostiteľ nezávisí od prítomnosti jadra zdroja."
+        },
+        {
+          "id": "compatibility-check",
+          "term": "Kontrola kompatibility",
+          "def": "Porovnanie medzi zdrojovým manifestom a cieľovým stavom, ktorý ProxMenux vykonáva na začiatku obnovy. Rozhoduje, ktoré časti sú skopírované doslovne, ktoré potrebujú hydratáciu a ktoré sú znovu vytvorené inštalátorom."
+        },
+        {
+          "id": "equipo-recien-instalado",
+          "term": "Čerstvá inštalácia",
+          "def": "Hostiteľ preinštalovaný od nuly bez lokálneho <a href=\"#clave-cifrado\">súboru kľúča</a>. Obnova šifrovanej zálohy vyžaduje najprv získať kľúč z <a href=\"#sobre-recuperacion\">obálky</a> uloženej v PBS pomocou <a href=\"#passphrase-recuperacion\">prístupovej frázy na obnovu</a>."
+        }
+      ]
+    }
+  ],
+  "whereNext": {
+    "heading": "Kde ďalej",
+    "items": [
+      {
+        "label": "Ako to funguje",
+        "href": "/docs/backup-restore/how-it-works",
+        "tail": " — kde sa v zálohe nachádza rootfs, manifest a inventár aplikácií."
+      },
+      {
+        "label": "Cieľ Proxmox Backup Server",
+        "href": "/docs/backup-restore/destinations/pbs",
+        "tail": "— kde sú do hĺbky zdokumentované šifrovanie na strane klienta, súbor kľúčov, prístupová fráza na obnovenie a obálka."
+      },
+      {
+        "label": "Obnovenie",
+        "href": "/docs/backup-restore/restoring",
+        "tail": " — postup obnovy a použitie manifestu."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sk/docs/backup-restore/how-it-works.json b/web/messages/sk/docs/backup-restore/how-it-works.json
new file mode 100644
index 00000000..76f3c680
--- /dev/null
+++ b/web/messages/sk/docs/backup-restore/how-it-works.json
@@ -0,0 +1,205 @@
+{
+  "meta": {
+    "title": "Ako ProxMenux Backup funguje interne — rootfs, manifest a aplikácie",
+    "description": "Podrobný obsah zálohy ProxMenux: rootfs skopírovaný pomocou rsync podľa predvoleného profilu ciest, štruktúrovaný manifest vytvorený šiestimi nezávislými zbernými skriptmi a inventár aplikácií, ktorý riadi automatickú reinštaláciu balíkov a komponentov po obnove.",
+    "ogTitle": "Ako ProxMenux Backup funguje interne",
+    "ogDescription": "Tri časti zálohy ProxMenux: rootfs, manifest a aplikácie.",
+    "twitterTitle": "Ako funguje zálohovanie ProxMenux | ProxMenux",
+    "twitterDescription": "Tri časti zálohy ProxMenux a spôsob, akým z nich obnova znovu vytvorí zdrojového hostiteľa."
+  },
+  "header": {
+    "title": "Ako to funguje",
+    "description": "Vnútorná štruktúra zálohy ProxMenux — súborový systém, manifest a inventár aplikácií — a spôsob, akým ich obnova používa na vytvorenie pôvodného hostiteľa na cieli, ktorý môže mať iné jadro.",
+    "section": "Záloha a obnova"
+  },
+  "intro": {
+    "title": "Jeden archív, tri časti",
+    "body": "Každá záloha vytvorí tri jasne oddelené časti v spoločnom prípravnom adresári. Archív odoslaný do cieľa (lokálny <code>.tar.zst</code>, záloha PBS alebo archív Borg) obsahuje túto istú štruktúru. Obnova používa všetky tri: <strong>manifest</strong> pred zmenami určí rozdiely a výnimky; <strong>rootfs</strong> poskytne konfiguračné súbory, ktoré sa použijú za behu alebo po reštarte; <strong>inventár aplikácií</strong> riadi inštaláciu balíkov a reinštaláciu komponentov po štarte. Každú časť možno skontrolovať alebo rozbaliť samostatne."
+  },
+  "layout": {
+    "heading": "Rozloženie archívu",
+    "intro": "Každý archív sleduje rovnaké rozloženie stromov bez ohľadu na cieľ. Podadresár <code>metadata/</code> má štruktúrované užitočné zaťaženie; podadresár <code>rootfs/</code> má kópiu súborového systému.",
+    "treeCaption": "Prípravný adresár vytvorený pri zálohe. Každý cieľ dostane rovnaký strom vo svojom formáte: tar pri lokálnom cieli, bloky PBS pri PBS a segmenty Borg pri Borgu.",
+    "tree": "backup-[timestamp]/\n├── manifest.json                  # structured host state\n├── metadata/\n│   ├── packages.manual.list       # apt-mark showmanual\n│   ├── run_info.env               # backup run identity + kernel version + pmxcfs method\n│   ├── paths_archived.txt         # exact list of paths that reached rootfs/\n│   └── missing_paths.txt          # paths from the profile absent on source\n└── rootfs/\n    ├── etc/                       # /etc/pve, /etc/network, /etc/systemd/network, /etc/ssh, …\n    ├── root/                      # /root (with volatile subdirs excluded)\n    ├── usr/local/                 # /usr/local/bin, /usr/local/share/proxmenux, …\n    └── var/                       # /var/lib/pve-cluster (config.db via sqlite3 .backup), /var/spool/cron/…"
+  },
+  "rootfs": {
+    "heading": "Časť rootfs",
+    "intro": "Strom <code>rootfs/</code> je <strong>obyčajná kópia súborového systému</strong> vytvorená pomocou <code>rsync</code> zo zdrojového hostiteľa. Obsahuje vybraný <strong>predvolený profil</strong> ciest dôležitých pre obnovu Proxmoxu a <strong>vlastné cesty</strong>, ktoré používateľ pridal do úlohy alebo interaktívnej relácie. Výber je zámerne úzky: iba cesty, ktoré <em>obsahujú konfiguráciu</em> alebo <em>uchovávajú stav, ktorý Proxmox nedokáže sám znovu vytvoriť</em>.",
+    "defaultProfileTitle": "Štandardný profil",
+    "defaultProfileBody": "Predvolený profil definuje <code>hb_default_profile_paths</code> v <code>lib_host_backup_common.sh</code>. Zahŕňa osem pevných kategórií a prípadne stav ZFS, ktoré spolu opisujú funkčného hostiteľa Proxmox:",
+    "categoriesTitle": "Kategórie ciest",
+    "categoryRows": [
+      {
+        "category": "Jadro PVE",
+        "paths": "/etc/pve, /var/lib/pve-cluster, /etc/vzdump.conf",
+        "why": "Obsah klastrového súborového systému a predvolené nastavenia vzdump. Databáza pmxcfs (<code>config.db</code>) sa zachytí ako konzistentná snímka cez <code>sqlite3 .backup</code> bez zastavenia klastra. Sprievodné súbory <code>.db-wal</code> / <code>.db-shm</code> sa z rsync vylúčia. Ak <code>sqlite3</code> nie je dostupný, vytvorí sa <code>config.db.raw-fallback</code>, ktorý obnova automaticky použije ako databázu."
+      },
+      {
+        "category": "Identita hostiteľa & sieť",
+        "paths": "/etc/hostname, /etc/hosts, /etc/timezone, /etc/resolv.conf, /etc/network, /etc/systemd/network",
+        "why": "Všetko potrebné na spustenie hostiteľa v sieti s rovnakou identitou. Súbory <code>.link</code> v <code>/etc/systemd/network</code> priraďujú názvy sieťových kariet k ich MAC adresám, aby sa názvy zachovali pri reinštalácii a zmenách hardvéru."
+      },
+      {
+        "category": "Prístup a overovanie",
+        "paths": "/etc/ssh, /etc/sudoers, /etc/sudoers.d, /etc/pam.d, /etc/security",
+        "why": "Kľúče SSH, pravidlá sudo a konfigurácia PAM. Ich strata môže používateľovi znemožniť prístup k obnovenému hostiteľovi."
+      },
+      {
+        "category": "Jadro a štart systému",
+        "paths": "/etc/default/grub, /etc/kernel, /etc/modules, /etc/modules-load.d, /etc/modprobe.d, /etc/sysctl.conf, /etc/sysctl.d, /etc/udev/rules.d, /etc/fstab, /etc/iscsi, /etc/multipath",
+        "why": "Parametre IOMMU, zoznamy zakázaných modulov, ID zariadení VFIO, tabuľka pripojení a konfigurácia úložísk."
+      },
+      {
+        "category": "Shell a miestne nastavenia",
+        "paths": "/etc/environment, /etc/bash.bashrc, /etc/inputrc, /etc/profile, /etc/profile.d, /etc/locale.gen, /etc/locale.conf",
+        "why": "Systémová konfigurácia shellu, premenné prostredia a nastavenie generovania miestnych nastavení."
+      },
+      {
+        "category": "Správa balíkov a cron",
+        "paths": "/etc/apt, /etc/cron.d, /etc/cron.{daily,hourly,weekly,monthly}, /etc/cron.allow, /etc/cron.deny, /var/spool/cron/crontabs",
+        "why": "APT zdroje pre konzistentné riešenie balíkov, plánované úlohy definované užívateľom."
+      },
+      {
+        "category": "Stav a nástroje ProxMenux",
+        "paths": "/etc/proxmenux, /etc/systemd/system, /etc/log2ram.conf, /etc/logrotate.conf, /etc/logrotate.d, /etc/lm-sensors, /etc/sensors3.conf, /etc/fail2ban, /etc/snmp, /etc/postfix, /etc/wireguard, /etc/openvpn, /etc/grafana, /etc/influxdb, /etc/prometheus, /etc/telegraf, /etc/zabbix",
+        "why": "Voliteľné, ale bežné náradie Proxmox. Chýbajúce cesty sú zaznamenané v <code>metadata/missing_paths.txt</code> bez zastavenia zálohy."
+      },
+      {
+        "category": "Spustiteľné súbory ProxMenux a účet root",
+        "paths": "/usr/local/bin, /usr/local/sbin, /usr/local/share/proxmenux, /var/lib/proxmenux, /root (bez dočasných podadresárov)",
+        "why": "Binárne systémy nainštalované ProxMenux a konfigurácia na užívateľa podľa <code>/root</code>. Prchavé cesty (<code>.bash_history</code>, <code>.cache/</code>, <code>tmp/</code>, <code>.local/share/Trash/</code>) sú z kópie vylúčené. <code>/var/lib/proxmenux</code> drží plánované záložné úlohy a stav hostiteľa udržiava ProxMenux; obnovenie inscenácie, rollback kópie a post-restore markery sú vylúčené, pretože patria k hostiteľovi, ktorý prevádzkuje obnovenie."
+      },
+      {
+        "category": "Stav ZFS (podmienený)",
+        "paths": "/etc/zfs",
+        "why": "Zahrnuté iba vtedy, keď zdroj spustí ZFS. Obsahuje <code>zpool.cache</code> a <code>hostid</code>."
+      }
+    ],
+    "customTitle": "Rozšírenie profilu vlastnými cestami",
+    "customBody": "Okrem predvoleného profilu, ProxMenux ponúka dva spôsoby, ako zahrnúť ďalšie cesty do zálohy. Skladajú sa bez konfliktu a obe sa vzťahujú na interaktívne zálohy a plánované pracovné miesta.",
+    "customExtrasTitle": "1. Trvalé doplnky (na-host súbor)",
+    "customExtrasBody": "Textový súbor <code>/usr/local/share/proxmenux/backup-extra-paths.txt</code> obsahuje absolútne cesty, ktoré používateľ na tomto hostiteľovi označil ako „vždy zahrnúť“. Pri zálohe v režime <strong>Predvolené</strong> sa automaticky pridajú do predvoleného profilu bez otázok. Súbor sa upravuje cez rozhranie, bez ručnej úpravy, a pretrváva medzi reštartmi aj aktualizáciami. Každý riadok obsahuje jednu absolútnu cestu; komentáre s <code>#</code> sú povolené.",
+    "customModeTitle": "2. Vlastný režim (na beh)",
+    "customModeBody": "Spustenie zálohy v režime <strong>Vlastný</strong> nahradí automatickú aplikáciu predvoleného profilu kontrolným zoznamom zobrazujúcim každú cestu: položky predvoleného profilu a trvalé doplnky (s predponou <code>[+]</code> a vopred začiarknuté). Používateľ začiarkne alebo odznačí položky pre daný konkrétny chod a môže tiež stlačiť <em>Pridať vlastnú cestu</em> na zadanie novej cesty – ktorá sa potom uloží do extra súboru pre budúce zálohy.",
+    "customMissingTitle": "Cesta neprítomná zo zdroja",
+    "customMissingBody": "Akákoľvek cesta z profilu (predvolená alebo pridaná), ktorá neexistuje na zdrojovom hostiteľovi, sa zaznamenáva v <code>metadata/missing_paths.txt</code> vo vnútri archívu. Zálohovanie nezlyhá, ani sa nezastaví. Užívateľ vidí súhrn archivovaných ciest a chýbajúce cesty na konci. V praxi sa to stane pre voliteľné cesty nástrojov, ako je <code>/etc/wireguard</code> alebo <code>/etc/prometheus</code>, ak tieto nástroje nie sú nainštalované."
+  },
+  "manifest": {
+    "heading": "Časť s manifestom",
+    "intro": "<code>manifest.json</code> je štruktúrovaný dokument JSON opisujúci zdrojového hostiteľa v čase zálohy. Vytvára ho <strong>šesť nezávislých zberných skriptov</strong> riadených skriptom <code>build_manifest.sh</code>. Každý iba číta údaje a vytvorí presne definovanú časť JSON. Pri zlyhaní použije bezpečnú prázdnu predvolenú hodnotu, takže manifest zostáva použiteľný aj s neúplnou časťou.",
+    "orchestratorCaption": "Manifest tvorí šesť zberných skriptov. Každý beží vo vlastnom podprocese. Pri zlyhaní jednej časti sa použije zdokumentovaná bezpečná predvolená hodnota a zobrazí upozornenie, ale záloha sa nepreruší.",
+    "collectorRows": [
+      {
+        "collector": "collect_source_host.sh",
+        "produces": "source_host",
+        "content": "Názov hostiteľa, verzia PVE (<code>pveversion</code>), verzia PBS, ak hostiteľ plní úlohu zálohovacieho servera, jadro (<code>uname -r</code>), režim zavádzania (efi/bios), typ koreňového súborového systému, model a architektúra CPU, pamäť v KB."
+      },
+      {
+        "collector": "collect_hardware.sh",
+        "produces": "hardware_inventory",
+        "content": "GPU s výrobcom a priradeným inštalátorom ProxMenux; TPU Coral USB a M.2 zistené pomocou <code>lsusb</code>/<code>lspci</code>; sieťové karty s MAC adresou, PCI slotom a priradením k mostu; bezdrôtové zariadenia. Záznamy GPU obsahujú heuristiku <code>passthrough_eligible</code>."
+      },
+      {
+        "collector": "collect_storage.sh",
+        "produces": "storage_inventory",
+        "content": "ZFS pools (s pool typ + členské disky vyriešené na <code>/dev/disk/by-id/*</code>, <code>/dev/disk/by-partuuid/*</code> alebo surové <code>/dev/sdX</code> cesty v závislosti od toho, ako každý pool bol pôvodne vytvorený), LVM objemové skupiny + thin pools, fyzické disky s SMART schopnosť, PVE <code>storage.cfg</code> vstupy, externé pripojenia."
+      },
+      {
+        "collector": "collect_kernel.sh",
+        "produces": "kernel_params",
+        "content": "Parametre pridané správcom do <code>/proc/cmdline</code> bez bežných predvolených položiek, ako sú <code>BOOT_IMAGE=</code>, <code>root=</code>, <code>ro/rw</code>, <code>quiet</code> a <code>splash</code>; moduly načítavané pri štarte z <code>/etc/modules</code>; a cesty súborov <code>/etc/modprobe.d/*.conf</code>, ktoré obsahujú skutočné direktívy (<code>options</code>, <code>blacklist</code>, <code>install</code>, <code>alias</code>, <code>softdep</code>)."
+      },
+      {
+        "collector": "collect_proxmenux_state.sh",
+        "produces": "proxmenux_installed_components",
+        "content": "Číta <code>/usr/local/share/proxmenux/managed_installs.json</code> (registrácia všetkého, čo ProxMenux nainštaloval) a <code>installed_tools.json</code>. Každý záznam udržuje inštalačnú dráhu (<code>menu_script</code>), takže obnovenie môže spustiť presne rovnaký inštalačný tok."
+      },
+      {
+        "collector": "collect_guests.sh",
+        "produces": "vms_lxcs_at_backup",
+        "content": "Vypíše VM (<code>qm list</code>) a kontajnery LXC (<code>pct list</code>) prítomné v čase zálohy: VMID, názov a aktuálny stav. Ide iba o inventár; samotné údaje hostí zálohujú <code>vzdump</code> / PBS."
+      }
+    ],
+    "schemaTitle": "Potvrdenie schémy",
+    "schemaBody": "Manifest sa overuje podľa <code>scripts/backup_restore/schema/manifest.schema.json</code>. Príkaz <code>build_manifest.sh --validate</code> spustí validáciu JSON Schema v Pythone, ktorá vyžaduje <code>python3</code> a <code>jsonschema</code>. Ak modul chýba, kontrola sa bez upozornenia preskočí. Validácia slúži najmä vývojárom, nie je závislosťou potrebnou pri bežnom behu."
+  },
+  "applications": {
+    "heading": "Inventár aplikácií",
+    "intro": "Dva inventáre evidujú softvér pridaný k základným balíkom Proxmox VE: zoznam balíkov v <code>metadata/</code> a register komponentov v rootfs, podrobne opísané nižšie. Obnova podľa pôvodného spôsobu inštalácie používa APT alebo inštalátory ProxMenux na opätovnú inštaláciu používateľského softvéru.",
+    "packagesTitle": "packages.manual.list",
+    "packagesBody": "Abecedný textový zoznam z <code>apt-mark showmanual</code> obsahuje všetky balíky APT <em>výslovne nainštalované</em> na zdrojovom hostiteľovi. Nezahŕňa závislosti základného systému Proxmox VE, ktoré APT cieľa nainštaluje automaticky. Pri obnove ho číta <code>_rs_run_complete_extras</code> a použije trojstupňový <em>filter proti kaskádovému odstraňovaniu</em>: <code>dpkg -s</code> zistí už nainštalované balíky, pri knižniciach sa zistia iné hlavné verzie a <code>apt-get install --simulate</code> overí riziko následného odstraňovania. Zvyšné balíky sa nainštalujú cez <code>apt-get install -y</code>.",
+    "componentsTitle": "components_status.json (súčasť rootfs)",
+    "componentsBody": "Register JSON v <code>/usr/local/share/proxmenux/</code> eviduje každý komponent nainštalovaný cez ProxMenux s presným stavom: verziou a osobitnými príznakmi (pri NVIDIA logická hodnota <code>patched</code>, pri Coral verzia DKMS). Súbor je v rootfs, nie v <code>metadata/</code>, pretože sa <em>číta až po</em> skopírovaní rootfs na cieľ. Dispečer po štarte (<code>apply_cluster_postboot.sh</code>) prejde záznamy a spustí pre každý komponent jeho <code>--auto-reinstall</code> hook. Ten prečíta uložený stav a zopakuje inštaláciu pre aktuálne jadro cieľa.",
+    "componentInstallersTitle": "Inštalátory komponentov",
+    "componentInstallersBody": "Štyri inštalátory ProxMenux v súčasnosti vystavujú vstupný bod <code>--auto-reinstall</code>:",
+    "installerRows": [
+      {
+        "component": "nvidia_driver",
+        "installer": "gpu_tpu/nvidia_installer.sh",
+        "action": "Číta <code>version</code> a <code>patched</code>. Stiahne ten istý inštalačný súbor NVIDIA, zostaví moduly DKMS pre jadro cieľa a znovu použije opravu ProxMenux, ak bola na zdroji zapnutá."
+      },
+      {
+        "component": "coral_driver",
+        "installer": "gpu_tpu/install_coral.sh",
+        "action": "Číta verziu Coral ovládač. Kompiluje modul DKMS s jadrom cieľa."
+      },
+      {
+        "component": "amdgpu_top",
+        "installer": "gpu_tpu/amd_gpu_tools.sh",
+        "action": "Číta nahranú verziu. Znovu stiahne presný <code>.deb</code> z GitHub vydania."
+      },
+      {
+        "component": "intel_gpu_tools",
+        "installer": "gpu_tpu/intel_gpu_tools.sh",
+        "action": "APT inštaluje balík. Idempotentné, ak už prítomný z <code>packages.manual.list</code>."
+      }
+    ]
+  },
+  "restoreFlow": {
+    "heading": "Ako obnova používa tri časti",
+    "intro": "Obnova má šesť fáz. Každá číta konkrétnu časť archívu a aktualizuje cieľového hostiteľa. Žiadna nevyžaduje dostupnosť zdrojového hostiteľa: archív obsahuje všetky potrebné zálohované údaje.",
+    "stagesCaption": "Fáza 1 podľa manifestu rozhodne, čo upraviť. Fáza 2 skopíruje cesty rootfs použiteľné za behu. Fáza 3 pripraví rizikové cesty na ďalší štart. Fáza 3b importuje dátové pooly ZFS bez koreňového systému, ktorých disky sú všetky prítomné. Fáza 4 rieši balíky. Fáza 5 po reštarte preinštaluje komponenty pre jadro cieľa.",
+    "stageRows": [
+      {
+        "stage": "1",
+        "name": "Kontrola kompatibility",
+        "reads": "manifest.json",
+        "action": "Spúšťa <code>hb_compat_check</code>. Porovnáva zdrojový a cieľový hardvér (NIC, identifikátory úložísk), verziu PVE a hlavnú verziu jadra. Nastavuje <code>HB_COMPAT_KERNEL_DIRECTION</code> (<code>same</code>, <code>bk_newer</code> alebo <code>bk_older</code>) a zaľudňuje <code>RS_SKIP_PATHS</code> s hardware-drift a cross-kernel s výnimkou."
+      },
+      {
+        "stage": "2",
+        "name": "Použitie za tepla",
+        "reads": "rootfs/ (len bezpečné cesty)",
+        "action": "<code>_rs_apply … hot</code> kopíruje <code>hb_classify_path</code>=<code>hot</code> položky priamo do živého cieľa. Všetko pod <code>/etc/pve</code>, <code>/etc/network</code> alebo cesty klasifikované ako <em>reboot</em>/<em>dangerous</em> je odložený."
+      },
+      {
+        "stage": "3",
+        "name": "Príprava odložených zmien",
+        "reads": "rootfs/ (reboot + nebezpečné cesty)",
+        "action": "<code>_rs_prepare_pending_restore</code> pripraví rizikové cesty v <code>/var/lib/proxmenux/pending-restore/</code>, zapíše <code>plan.env</code>, <code>apply-on-boot.list</code> a <code>rs-skip-paths.txt</code> a povolí spustenie <code>proxmenux-restore-onboot.service</code> pri ďalšom štarte."
+      },
+      {
+        "stage": "3b",
+        "name": "Import dátových poolov",
+        "reads": "manifest.storage_inventory + cieľový ZFS stav",
+        "action": "<code>_rs_import_data_pools</code> importuje každého ZFS pool každého iného typu než root, ktorého úplná sada diskov sa nachádza v cieli. Pools nesúci cudzí hostid sa zopakuje s <code>zpool import -f</code>. Pools chýbajúce disky sú preskočené s varovaním. Výsledok per-pool je zaznamenaný v <code>/var/log/proxmenux/restore-datapools-&lt;timestamp&gt;.log</code>."
+      },
+      {
+        "stage": "4",
+        "name": "Inštalácia balíka",
+        "reads": "metadata/packages.manual.list",
+        "action": "<code>_rs_run_complete_extras</code> spustí kaskádovo bezpečný filter a zavolá <code>apt-get install -y</code> so zoznamom prežitých balíkov. Celý výstup ide do <code>/var/log/proxmenux/restore-apt-*.log</code>."
+      },
+      {
+        "stage": "5",
+        "name": "Po štarte systému",
+        "reads": "rootfs (už použité) + components_status.json",
+        "action": "Po reštarte <code>apply_pending_restore.sh</code> použije odložené cesty a <code>apply_cluster_postboot.sh</code> spustí <code>update-initramfs</code>, <code>update-grub</code> alebo <code>proxmox-boot-tool refresh</code>. Potom prejde <code>components_status.json</code> a pre každý komponent spustí jeho <code>--auto-reinstall</code> hook."
+      }
+    ]
+  },
+  "whyItWorks": {
+    "heading": "Prečo je záloha rozdelená na tri časti",
+    "body": "Rozdelenie sleduje <strong>životný cyklus</strong> údajov. Súborový systém sa prenáša cez <code>rsync</code>: rýchlo, prehľadne a atómovo po súboroch. Konfiguračný stav, ktorý treba vyhodnotiť pred zmenami, je <strong>štruktúrovaný JSON</strong>, samostatne čitateľný, verzovateľný schémou a strojovo porovnateľný so stavom cieľa. Softvér na reinštaláciu opisuje <strong>inventár</strong> názvov a verzií; správca balíkov a inštalátory ProxMenux vyberú vhodné binárne súbory. Každá časť plní vlastnú úlohu. Spolu smerujú ku konzistentnej obnove odolnej voči chybám: poškodený manifest ponecháva rootfs obnoviteľný, chýbajúci balík nebráni inštalácii komponentov a zlyhanie pri jednej položke nezastaví ďalšiu."
+  }
+}
diff --git a/web/messages/sk/docs/backup-restore/index.json b/web/messages/sk/docs/backup-restore/index.json
new file mode 100644
index 00000000..0ec15d1c
--- /dev/null
+++ b/web/messages/sk/docs/backup-restore/index.json
@@ -0,0 +1,93 @@
+{
+  "meta": {
+    "title": "ProxMenux Zálohovanie a obnovenie — Prehľad | Úplné zálohovanie a obnovenie hostiteľa pre Proxmox VE",
+    "description": "ProxMenux Backup & Restore zachytáva úplný stav hostiteľa Proxmox – súborový systém, štruktúrovaný konfiguračný manifest a nainštalované balíky/komponenty – a reprodukuje ho na rovnakom alebo inom hostiteľovi. Zálohovanie a obnova sú samostatné: žiadne externé závislosti a obnovy medzi jadrami sú podporované prostredníctvom filtra bezpečnej podmnožiny zohľadňujúceho smer zmeny verzie a hydratácie nezávislej od jadra.",
+    "ogTitle": "ProxMenux Zálohovanie a obnovenie — Prehľad",
+    "ogDescription": "Úplné zálohovanie a obnovenie hostiteľa pre Proxmox VE so štruktúrovaným manifestom, zoznamom balíkov a preinštalátormi komponentov.",
+    "twitterTitle": "ProxMenux Zálohovanie a obnovenie | ProxMenux",
+    "twitterDescription": "Úplné zálohovanie a obnovenie hostiteľa pre Proxmox VE so štruktúrovaným manifestom, zoznamom balíkov a preinštalátormi komponentov."
+  },
+  "header": {
+    "title": "Zálohovanie a obnovenie",
+    "description": "Zálohovanie a obnovenie úplného hostiteľa pre Proxmox VE. Zachytáva súborový systém, konfiguráciu a nainštalované komponenty do jedného archívu a reprodukuje hostiteľa v rovnakej alebo inej inštalácii Proxmox bez externých závislostí.",
+    "section": "Zálohovanie a obnovenie"
+  },
+  "intro": {
+    "title": "Čo to je, v jednom odseku",
+    "body": "Záloha ProxMenux zachytáva úplný stav hostiteľa Proxmox: <strong>súborový systém</strong>, teda príslušné adresáre v <code>/etc</code>, <code>/root</code> a <code>/var/lib/pve-cluster</code> spolu s voliteľnými vlastnými cestami; <strong>štruktúrovaný manifest</strong> vo formáte JSON s detegovaným hardvérom, parametrami jadra, konfiguráciou siete, stavom ZFS, používateľmi a záznamami cron; a <strong>inventár aplikácií</strong> s balíkmi označenými v APT ako manuálne nainštalované a komponentmi nainštalovanými cez ProxMenux vrátane presných verzií. Všetky tri podporované ciele – lokálny archív, Proxmox Backup Server (odporúčaný) a Borg – dostávajú rovnaký samostatný obsah. Z každého možno obnoviť cieľového hostiteľa bez toho, aby bol zdrojový hostiteľ počas obnovy dostupný."
+  },
+  "video": {
+    "heading": "Videonávod",
+    "intro": "Uprednostňujete sledovanie zálohovania a obnovenia v akcii pred jeho konfiguráciou? Tento návod obsahuje úplné demo funkcie v ProxMenux.",
+    "title": "ProxMenux — Návod na zálohovanie a obnovenie",
+    "caption": "Externé video na YouTube. Prehráva sa v režime ochrany osobných údajov (žiadne súbory cookie, kým nestlačíte tlačidlo prehrávania)."
+  },
+  "whatItIsNot": {
+    "heading": "Čo to nie je",
+    "intro": "Táto časť sa venuje zálohovaniu a obnove <strong>hostiteľa</strong>: samotnej inštalácie Proxmoxu, nie aplikácií a virtuálnych systémov, ktoré na nej bežia.",
+    "items": [
+      "<strong>Nejde o nástroj na zálohovanie VM/CT.</strong> Táto funkcia nezachytáva disky ani stav RAM virtuálnych systémov; na to slúži <code>vzdump</code>. Ich <strong>konfiguračné súbory</strong> (<code>/etc/pve/nodes/&lt;node&gt;/qemu-server/*.conf</code> a <code>lxc/*.conf</code>) sa <strong>však zálohujú</strong>. Po obnove sa inventár znovu zobrazí a disky možno obnoviť alebo pripojiť z existujúcej zálohy v PBS či na lokálnom úložisku.",
+      "<strong>Nejde o operáciu pre celý klaster.</strong> Každý uzol zálohuje sám seba. Členstvo v klastri sa zachytáva v <code>/etc/pve</code>, aby sa obnovený uzol mohol opäť pridať do klastra. Obnova celého klastra však vyžaduje koordináciu jednotlivých uzlov.",
+      "<strong>Nejde o úplný obraz disku.</strong> Binárne súbory jadra, initramfs ani zavádzacia partícia sa nezálohujú. Pri obnove ProxMenux využíva zavádzacie súbory cieľového hostiteľa, automaticky vytvorené pomocou <code>update-initramfs</code> a nástroja zavádzača, a inštaluje ovládače zodpovedajúce jadru spustenému na cieľovom hostiteľovi."
+    ]
+  },
+  "threePillars": {
+    "heading": "Tri piliere zálohovania",
+    "intro": "Archív ProxMenux je štruktúrovaný okolo troch samostatných blokov údajov. Obnova používa všetky tri spolu na reprodukciu zdrojového hostiteľa na cieli, ktorý nemusí mať dokonca nainštalované rovnaké jadro.",
+    "diagramCaption": "Každá záloha obsahuje rovnaké tri bloky údajov bez ohľadu na cieľ. Obnova používa všetky tri: rootfs na uloženie súborov, manifest na zistenie odchýlok a rozdielov medzi verziami jadra a inventár aplikácií na opätovnú inštaláciu balíkov a komponentov pre vlastné jadro cieľa.",
+    "pillar1Label": "Súborový systém",
+    "pillar1Detail": "rootfs/\n(rsync z /etc,\n/etc/systemd/network,\n/root, plus\nsnímka sqlite3\nz /var/lib/pve-cluster,\n+ voliteľné cesty)",
+    "pillar2Label": "Manifest",
+    "pillar2Detail": "manifest.json\n(hardvér, parametre\njadra, sieť,\nZFS, používatelia, cron,\npooly ZFS, úložisko)",
+    "pillar3Label": "Aplikácie",
+    "pillar3Detail": "packages.manual.list\n+ components_status.json\n(manuálne balíky APT + inštalátory\nProxMenux s verziami)"
+  },
+  "restoreIsUniversal": {
+    "heading": "Obnova reprodukuje hostiteľa zdroja, nie archív",
+    "body": "Obnova zálohy ProxMenux neznamená len rozbalenie súborového systému. Postup obnovy prečíta manifest, aby zistil rozdiely medzi zdrojom a cieľom (hardvér, premenovanie sieťových kariet, verziu jadra, identitu poolu ZFS), obnoví súborový systém a potom spustí príslušný inštalátor komponentu pre každú službu nainštalovanú v zdroji (ovládač NVIDIA, Coral TPU, nástroje GPU AMD a Intel). Každý inštalátor sa spúšťa pre <strong>aktuálne jadro cieľa</strong>, takže obnovený hostiteľ nezávisí od prítomnosti zdrojového jadra. Ak je jadro cieľa novšie než jadro zálohy, fáza <strong>hydratácie</strong> nezávislá od jadra zlúči vlastné nastavenia používateľa (tokeny IOMMU, ID zariadení VFIO, osobitné úpravy, kľúče GRUB) s novou zavádzacou konfiguráciou cieľa bez doslovného kopírovania súborov viazaných na jadro."
+  },
+  "twoInterfaces": {
+    "heading": "Dve rozhrania, jeden backend",
+    "intro": "Každý krok pracovného postupu zálohovania a obnovy je dostupný z dvoch vstupných bodov. Oba volajú rovnakú knižnicu shellu, vytvárajú identické archívy a čítajú rovnaký register úloh.",
+    "cliLabel": "ProxMenux Scripts (TUI)",
+    "cliDetail": "menu → Nástroje →\nZálohovanie / obnovenie hostiteľa\n\nDialógový tok,\nSSH priateľský, skriptovateľný\nna použitie bez dozoru.",
+    "webLabel": "ProxMenux Monitor (Web UI)",
+    "webDetail": "Karta Backups vo\nwebovom rozhraní Monitor.\n\nObnova jedným kliknutím,\npriebežný výpis záznamov,\nprepojenie s upozorneniami\na zobrazením rozdielov rollbacku."
+  },
+  "whereNext": {
+    "heading": "Kam ísť odtiaľto",
+    "intro": "Každá podsekcia nižšie podrobne pokrýva jeden aspekt pracovného postupu. Začnite s <em>Ako to funguje</em>, ak je cieľom pochopiť, čo archív obsahuje a prečo. Prejdite na <em>Ciele</em> a nakonfigurujte cieľ pre kópiu. Prečítajte si <em>Obnovovanie</em> a <em>Obnova medzi jadrami</em> pre stranu obnovy.",
+    "items": [
+      {
+        "label": "Ako to funguje",
+        "href": "/docs/backup-restore/how-it-works",
+        "tail": "— podrobne tri bloky údajov (rootfs, manifest, aplikácie) s kolektormi, ktoré ich vytvárajú, a formátom každého súboru."
+      },
+      {
+        "label": "Destinácie",
+        "href": "/docs/backup-restore/destinations",
+        "tail": "— porovnanie lokálneho úložiska, Proxmox Backup Server (odporúča sa) a Borg a ako nakonfigurovať každý z nich."
+      },
+      {
+        "label": "Vytváranie záloh",
+        "href": "/docs/backup-restore/creating-backups",
+        "tail": "— jednorazové zálohy, predvolený profil cesty, pridávanie vlastných ciest, šifrovanie pre PBS."
+      },
+      {
+        "label": "Plánované úlohy",
+        "href": "/docs/backup-restore/scheduled-jobs",
+        "tail": "— nové úlohy verzus pripojenie k existujúcej úlohe PVE vzdump, formáty plánovania, modálny detail úlohy."
+      },
+      {
+        "label": "Obnova",
+        "href": "/docs/backup-restore/restoring",
+        "tail": "– tri akcie s archívom (zobrazenie, stiahnutie, obnovenie), úplná a vlastná obnova, dispečer po spustení a prečo záleží na posledných desiatich minútach."
+      },
+      {
+        "label": "Obnova medzi jadrami",
+        "href": "/docs/backup-restore/cross-kernel",
+        "tail": " — správanie zohľadňujúce smer zmeny verzie pri odlišnom jadre cieľa a zálohy, filter bezpečnej podmnožiny a štyri fázy hydratácie."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sk/docs/backup-restore/restoring.json b/web/messages/sk/docs/backup-restore/restoring.json
new file mode 100644
index 00000000..8c5e01d0
--- /dev/null
+++ b/web/messages/sk/docs/backup-restore/restoring.json
@@ -0,0 +1,282 @@
+{
+  "meta": {
+    "title": "Obnovenie zálohy — úplný a vlastný postup | ProxMenux",
+    "description": "Úplný postup obnovy: tri akcie pri každej zálohe (zobraziť, stiahnuť, obnoviť), kontrola kompatibility a jej výsledky, úplný a vlastný režim, klasifikácia ciest na použitie za behu alebo po reštarte a dispečer so záverečnou reinštaláciou komponentov po štarte.",
+    "ogTitle": "ProxMenux Backup — obnova",
+    "ogDescription": "Úplná a vlastná obnova s kontrolou kompatibility, klasifikáciou ciest, dispečerom pri štarte a reinštaláciou po štarte.",
+    "twitterTitle": "Obnovenie zálohy ProxMenux",
+    "twitterDescription": "Ako ProxMenux zálohovanie hostiteľa je premenený späť do fungujúceho Proxmox hostiteľa."
+  },
+  "header": {
+    "title": "Obnovenie zálohy",
+    "description": "Úplný postup od výberu archívu po funkčného hostiteľa. Opisuje kontrolu kompatibility, dva režimy obnovy, dispečer pri štarte, reinštaláciu po štarte a mechanizmy predvídateľnej obnovy medzi rôznymi hostiteľmi a jadrami.",
+    "section": "Záloha a obnova"
+  },
+  "intro": {
+    "title": "Obnovenie reprodukuje zdroj, nielen súbory",
+    "body": "Obnova zálohy ProxMenux znamená viac než rozbalenie súborov. Pred zmenami prečíta manifest, zistí rozdiely medzi zdrojom a cieľom, vylúči cesty ohrozujúce štart a prispôsobí nastavenia používateľa, ktoré nemožno skopírovať doslova. Po potrebnom reštarte sa pokúsi preinštalovať zaznamenané podporované komponenty (ovládač NVIDIA, Coral TPU a nástroje GPU) pre bežiace jadro cieľa. Jeden archív riadi kontrolu kompatibility, klasifikáciu ciest a prácu pri štarte aj po ňom. Výsledok overte v stavoch jednotlivých komponentov a protokoloch."
+  },
+  "threeActions": {
+    "heading": "Tri akcie na zálohe",
+    "intro": "Výberom zálohy zo zoznamu sa otvorí menu s tromi akciami.",
+    "actionRows": [
+      {
+        "action": "Zobraziť",
+        "detail": "Otvorí zobrazenie archívu len na čítanie: obsah manifest.json (source hostname, PVE verzia, jadra, hardvér, nainštalované komponenty), zoznam ciest vnútri <code>rootfs/</code> a rozlíšenie toho, čo by sa zmenilo na aktuálnom hostiteľovi, ak by bola použitá záloha."
+      },
+      {
+        "action": "Stiahnuť",
+        "detail": "Exportuje archív ako prenosný súbor <code>.tar.zst</code> (tar skomprimovaný zstd). Je možné extrahovať na ľubovoľnom systéme Linux s <code>tar --zstd -xf FILE.tar.zst</code>, alebo na macOS/Windows s akýmkoľvek nástrojom, ktorý podporuje zstd (7-Zip, PeaZip, Keka...). Extrahovaný strom obsahuje <code>manifest.json</code>, <code>metadata/</code> a <code>rootfs/</code>, teda rovnakú štruktúru, akú používa obnova. Užitočné pre offline kontrolu alebo obnovenie na hostiteľa bez prístupu k pôvodnému cieľu (PBS, Borg)."
+      },
+      {
+        "action": "Obnoviť",
+        "detail": "Akcia zapisujúca do systému: rozbalí archív do prípravného adresára, spustí kontrolu kompatibility a ponúkne výber úplného alebo vlastného režimu."
+      }
+    ]
+  },
+  "compatibilityCheck": {
+    "heading": "Kontrola zlučiteľnosti",
+    "intro": "Pred napísaním akéhokoľvek súboru <code>hb_compat_check</code> porovnáva stav opísaný v manifeste s cieľovým hostiteľom. Kontrola beží iba na čítanie a vytvára štyri nezávislé výstupy, ktoré poháňajú zvyšok obnovy.",
+    "outputRows": [
+      {
+        "output": "Príznak smeru",
+        "detail": "<code>HB_COMPAT_KERNEL_DIRECTION</code> má hodnotu <code>same</code>, <code>bk_newer</code> alebo <code>bk_older</code> podľa porovnania hlavných verzií jadra zálohy a cieľa. Riadi filter bezpečných ciest medzi jadrami, ktorý sa zapne iba pri <code>bk_older</code>, a prispôsobenie nastavení opísané na príslušnej stránke."
+      },
+      {
+        "output": "Zoznam preskočených ciest",
+        "detail": "<code>RS_SKIP_PATHS</code> obsahuje cesty, ktoré obnova NESMIE použiť. Plnia ho dva mechanizmy: rozdiely hardvéru (chýbajúca sieťová karta, ID úložiska alebo cudzí pool ZFS) a pri smere <code>bk_older</code> zoznam ciest nebezpečných medzi rôznymi jadrami."
+      },
+      {
+        "output": "Plán premapovania sieťových kariet",
+        "detail": "Ak má sieťová karta na cieľovom hostiteľovi rovnakú MAC adresu ako na zdrojovom, ale iný názov (bežné po výmene základnej dosky), kontrola kompatibility zaznamená plán premenovania (<code>HB_NIC_REMAP</code>). Ten počas obnovy upraví <code>/etc/network/interfaces</code>."
+      },
+      {
+        "output": "Plán vrátenia zmien",
+        "detail": "Vypočíta ho <code>compute_rollback_plan.sh</code>. Vypíše VM, LXC a komponenty, ktoré sú na cieli, ale nie v zálohe. Potvrdenie ponúkne voliteľné odstránenie dodatočných hostí pred reštartom. Komponenty treba odstrániť ručne a zmazanie hostí môže zlyhať, takže presná zhoda so zálohou nie je zaručená."
+      }
+    ],
+    "reportBody": "Kontrola tiež vydáva štruktúrované správy (<code>HB_COMPAT_RESULTS</code>) kategorizované ako PASS / INFO / WARN / FAIL. WARN a FAIL vstupy povrch v paneli pre-restore; obnovenie odmieta pokračovať len vtedy, keď je prítomný FAIL, že užívateľ nemôže vyriešiť kliknutím Pokračovať."
+  },
+  "twoModes": {
+    "heading": "Úplné obnovenie vs Vlastné obnovenie",
+    "intro": "Po kontrole kompatibility sa zobrazí výber režimu. Určuje, <em>čo</em> sa použije, nie <em>ako</em>: oba režimy používajú rovnaký postup.",
+    "modeRows": [
+      {
+        "mode": "Úplná obnova",
+        "detail": "Použije každú cestu v archíve, ktorá prežije filtre drift a cross-kernel. Tiež spustí inštaláciu balíka a automatickú reinštaláciu komponentov. Toto je predvolená a odporúčaná voľba – cieľom je reprodukovať zdroj, nie vyberať kúsky."
+      },
+      {
+        "mode": "Vlastné obnovenie",
+        "detail": "Otvorí zoznam všetkých ciest v archíve, z ktorých používateľ vyberie požadovanú časť. Cesty blokované filtrom medzi jadrami sú sivé a nemožno ich vybrať. Vlastný režim predvolene preskočí inštaláciu balíkov a automatickú reinštaláciu komponentov: používateľ požaduje čiastočnú obnovu, nie úplné zopakovanie zdroja."
+      }
+    ]
+  },
+  "pathClassification": {
+    "heading": "Ako sú cesty klasifikované",
+    "intro": "Každá cesta vybraná pre obnovenie je zaradená <code>hb_classify_path</code> do jednej z troch kategórií. Kategória určuje, kedy sa cesta aplikuje na systém a prečo.",
+    "rows": [
+      {
+        "class": "hot",
+        "detail": "Cesta aplikovaná <strong>okamžite</strong> do bežiaceho systému. Služba, ktorá ich konzumuje, vyzdvihne zmenu na vlastnú päsť alebo na ďalšiu reload Jedná sa o väčšinu zálohy: <code>/etc/ssh</code>, <code>/etc/apt</code>, <code>/etc/cron.*</code>, <code>/root</code>, <code>/usr/local/bin</code>, všeobecné konfiguračné súbory služieb, atď."
+      },
+      {
+        "class": "reboot",
+        "detail": "Cesty odložené na <strong>ďalší štart</strong>, nie použité <strong>okamžite</strong> týmto postupom. Ovplyvňujú konfiguráciu štartu: tvorba zavádzača číta <code>/etc/default/grub</code>, pripájanie systémov používa <code>/etc/fstab</code> a načítanie modulov <code>/etc/modules</code>. Odložené súbory sa použijú po reštarte a potom sa znovu vytvoria potrebné zavádzacie súbory. Príklady: <code>/etc/default/grub</code>, <code>/etc/kernel</code>, <code>/etc/modules</code>, <code>/etc/fstab</code>, <code>/etc/zfs</code>, <code>/etc/modprobe.d</code>."
+      },
+      {
+        "class": "dangerous",
+        "detail": "Cesty, ktoré sa <strong>NEPOUŽIJÚ na bežiacom systéme</strong>, pretože zápis za behu by mohol poškodiť stav alebo prerušiť aktívne spojenie. Pripravia sa medzi odloženými súbormi: <code>/etc/network</code> sa zapíše na začiatku ďalšieho štartu, ešte pred spustením siete, a <code>/etc/pve</code> zapíše dispečer po štarte, keď je klastrový súborový systém dostupný. Príklady: <code>/etc/pve</code> (pmxcfs je pripojenie FUSE s aktívnou konfiguráciou klastra), <code>/var/lib/pve-cluster</code> (aktívne údaje klastra, uložené v adresári obnovy len na ručnú obnovu), <code>/etc/network</code> (zmena môže prekonfigurovať rozhranie používané na SSH a prerušiť reláciu)."
+      }
+    ]
+  },
+  "fullFlow": {
+    "heading": "Úplné obnovenie pracovného postupu",
+    "intro": "Celý postup od výberu archívu po obnoveného funkčného hostiteľa. Každá fáza pripraví vstup ďalšej: stav zapísaný skoršími fázami používajú neskoršie.",
+    "diagram": "┌─────────────────────────────────────────────────────────────────┐\n│  Archive → staging_root/                                        │\n│    manifest.json   metadata/   rootfs/                          │\n└──────────────────────────────┬──────────────────────────────────┘\n                               │\n                               ▼\n   ┌─────────────────────────────────────────────────────────┐\n   │  1. hb_compat_check                                     │\n   │     · hardware drift → RS_SKIP_PATHS                    │\n   │     · kernel direction → same / bk_newer / bk_older     │\n   │     · NIC remap plan                                    │\n   │     · hydration plan (bk_older only)                    │\n   │     · rollback plan                                     │\n   └──────────────────────────────┬──────────────────────────┘\n                                  │\n                                  ▼\n   ┌─────────────────────────────────────────────────────────┐\n   │  2. Confirmation dialog                                 │\n   │     Shows: hot count, pending count, drift, hydration,  │\n   │     NIC remap, cross-kernel note, reinstalls preview    │\n   └──────────────────────────────┬──────────────────────────┘\n                                  │ (accepted)\n                                  ▼\n   ┌─────────────────────────────────────────────────────────┐\n   │  3. Apply hot paths → LIVE                              │\n   │     _rs_apply rsyncs each hot path                      │\n   │     from staging_root/rootfs to /                       │\n   │     (skips paths in RS_SKIP_PATHS)                      │\n   └──────────────────────────────┬──────────────────────────┘\n                                  │\n                                  ▼\n   ┌─────────────────────────────────────────────────────────┐\n   │  4. _rs_prepare_pending_restore                         │\n   │     /var/lib/proxmenux/pending-restore/                 │\n   │       ├── apply-on-boot.list                            │\n   │       ├── plan.env                                      │\n   │       ├── rs-skip-paths.txt                             │\n   │       └── rootfs/ (deferred paths)                      │\n   │     Enable proxmenux-restore-onboot.service             │\n   └──────────────────────────────┬──────────────────────────┘\n                                  │\n                                  ▼\n   ┌─────────────────────────────────────────────────────────┐\n   │  4b. _rs_import_data_pools                              │\n   │      Imports non-root ZFS pools whose disks are all     │\n   │      present; retries with -f on foreign hostid;        │\n   │      skips with a warning when disks are missing.       │\n   │      Log: /var/log/proxmenux/restore-datapools-*.log    │\n   └──────────────────────────────┬──────────────────────────┘\n                                  │\n                                  ▼\n   ┌─────────────────────────────────────────────────────────┐\n   │  5. _rs_run_complete_extras                             │\n   │     packages.manual.list                                │\n   │       → cascade-safe filter                             │\n   │       → apt-get install                                 │\n   └──────────────────────────────┬──────────────────────────┘\n                                  │\n                                  ▼\n   ┌─────────────────────────────────────────────────────────┐\n   │  6. REBOOT                                              │\n   └──────────────────────────────┬──────────────────────────┘\n                                  │\n                                  ▼\n   ┌─────────────────────────────────────────────────────────┐\n   │  7. apply_pending_restore.sh (on early boot)            │\n   │     Reads plan.env                                      │\n   │     Applies apply-on-boot.list (filtered)               │\n   │     Installs the postboot systemd unit                  │\n   └──────────────────────────────┬──────────────────────────┘\n                                  │\n                                  ▼\n   ┌─────────────────────────────────────────────────────────┐\n   │  8. apply_cluster_postboot.sh (~10 minutes)             │\n   │     Runs after pve-cluster is up                        │\n   │     · Applies /etc/pve entries to pmxcfs                │\n   │     · update-initramfs -u -k all                        │\n   │     · update-grub / proxmox-boot-tool refresh           │\n   │     · component --auto-reinstall (nvidia, coral, ...)   │\n   │     · Boot sanity check                                 │\n   │     · Notification: \"Host restore finished\"             │\n   └─────────────────────────────────────────────────────────┘"
+  },
+  "pendingMachinery": {
+    "heading": "Mechanizmus odloženej obnovy",
+    "intro": "Cesty klasifikované ako <code>reboot</code> alebo <code>dangerous</code>, a hydratačné zápisy, sú fázované pre ďalšie boot miesto aplikácie naživo. To sa vykonáva prostredníctvom malého, samostatného súboru súborov v <code>/var/lib/proxmenux/pending-restore/</code>:",
+    "rows": [
+      {
+        "file": "apply-on-boot.list",
+        "content": "Jedna relatívna cesta na riadok: presná množina ciest, ktoré <code>apply_pending_restore.sh</code> použije z pripraveného rootfs. Súbor ukazuje, čo sa zmení pri ďalšom štarte."
+      },
+      {
+        "file": "plan.env",
+        "content": "Premenné prostredia načítané skriptom pri štarte: ID obnovy, príznaky kompatibility (<code>HB_COMPAT_CROSS_VERSION</code>, <code>HB_COMPAT_KERNEL_DIRECTION</code>, <code>HB_HYDRATION_APPLIED</code>), súhlas s vrátením stavu a voľby klastra."
+      },
+      {
+        "file": "rs-skip-paths.txt",
+        "content": "Konečný zoznam <code>RS_SKIP_PATHS</code>, uložený pre <code>apply_pending_restore.sh</code>, aby po reštarte zachoval výnimky vypočítané v interaktívnej fáze. Bráni obnoveniu ciest nevhodných pre hardvér alebo rozdielne jadro pri štarte."
+      },
+      {
+        "file": "rootfs/",
+        "content": "Samotné pripravené súbory – presné bajty, ktoré sa zapíšu. Zostávajú na rovnakom súborovom systéme ako <code>/</code>, aby bol rsync pri štarte rýchly a nezávisel od dostupnosti externého úložiska počas štartu."
+      }
+    ],
+    "unitBody": "Jednotka systemd <code>proxmenux-restore-onboot.service</code> sa povolí na konci interaktívnej fázy. Táto jednorazová služba sa spustí na začiatku ďalšieho štartu, zavolá <code>apply_pending_restore.sh</code> a potom sa zakáže. Podmienka <code>ConditionPathExists=/var/lib/proxmenux/pending-restore/state</code> zabezpečí, že bez čakajúcej obnovy nevykoná nič."
+  },
+  "postbootDispatcher": {
+    "heading": "Post-boot dispečer apply_cluster_postboot.sh",
+    "intro": "Kde sa končí interaktívny krok a kde dochádza k skutočnej reprodukcii hostiteľa. <code>apply_cluster_postboot.sh</code> je nainštalovaný ako druhá jednorázová jednotka systemd (<code>proxmenux-apply-cluster-postboot.service</code>), ktorej ciele <code>After=</code>/<code>Wants=</code> zabezpečujú, že beží až po pve-cluster a network-online sú hore. To je miesto, kde hostiteľ-viditeľné obnoviť akcie pozemky.",
+    "tasks": [
+      {
+        "task": "Použiť /etc/pve",
+        "detail": "<code>/etc/pve</code> je aktívne pripojenie FUSE systému pmxcfs, do ktorého nemožno zapisovať v skorej fáze štartu. Dispečer po spustení klastrového systému kopíruje súbory z pripraveného rootfs do živého <code>/etc/pve</code>, po jednom a bez reštartu pve-cluster. Zachytený <code>/var/lib/pve-cluster/config.db</code> alebo náhradný <code>config.db.raw-fallback</code> sa obnoví postupom <code>systemctl stop pve-cluster</code> → atómové kopírovanie súboru → <code>systemctl start pve-cluster</code>, aby pmxcfs po spustení načítal obnovený stav."
+      },
+      {
+        "task": "Znovu vytvoriť initramfs a zavádzač",
+        "detail": "Spustí <code>update-initramfs -u -k all</code> cez každé nainštalované jadro, potom buď <code>update-grub</code> (GRUB inštaluje) alebo <code>proxmox-boot-tool refresh</code> (systemd-boot / ZFS inštaluje). Preskočené, ak interaktívny krok určiť nič sa nezmenilo v chodníkoch, ktoré ovplyvňujú tieto nástroje."
+      },
+      {
+        "task": "Automatická inštalácia komponentov",
+        "detail": "Číta obnovený <code>components_status.json</code> a prejde podporované inštalátory (nvidia_driver, coral_driver, amdgpu_top, intel_gpu_tools). Každý vybraný inštalátor použije <code>--auto-reinstall</code>, načíta uložený stav a zopakuje inštaláciu pre cieľové prostredie, prípadne zostaví moduly jadra. Čaká sa na reštart, aby sa použilo potom bežiace jadro cieľa. Jednotlivé chyby sa zaznamenajú a nezastavia ďalší komponent."
+      },
+      {
+        "task": "Kontrola štartu systému",
+        "detail": "Pred spustením oznámenia o dokončení overíte, či <code>proxmox-boot-tool status</code> zobrazuje nakonfigurovaný ESP, každý <code>/boot/vmlinuz-*</code> má zodpovedajúci <code>/lib/modules/&lt;ver&gt;</code> adresár a <code>/vmlinuz</code> rieši. Akýkoľvek nesúlad sa vynorí v oznámení namiesto toho, aby bol skrytý."
+      },
+      {
+        "task": "Oznámenie o dokončení",
+        "detail": "Posiela udalosť <code>Host restore finished</code> prostredníctvom <code>hb_notify_lifecycle</code>. Zahŕňa celkovú dĺžku trvania, použitý počet ciest, prípadné upozornenia na kontrolu zdravotného stavu a odkaz na log pri <code>/var/log/proxmenux/proxmenux-cluster-postboot-*.log</code>. Ak notifikácie nie sú konfigurované, udalosť sa neodošle; protokol aj tak zaznamená všetko"
+      }
+    ]
+  },
+  "liveProgress": {
+    "heading": "Živý priebeh na karte Zálohy v Monitore",
+    "body": "Po reštarte zobrazuje karta Zálohy v ProxMenux Monitor živý priebeh služby <code>proxmenux-apply-cluster-postboot.service</code>. Číta <code>/var/lib/proxmenux/restore-state.json</code>, ktorý sa aktualizuje pri každej fáze: konfigurácia klastra, initramfs, zavádzač, reinštalácia jednotlivých komponentov, kontrola štartu a dokončenie.",
+    "fields": [
+      {
+        "name": "Označenie stavu",
+        "detail": "Jeden zo stavov <em>Prebieha obnova</em>, <em>Obnova dokončená</em> alebo <em>Obnova zlyhala</em>. Karta číta stavový súbor každé 2 sekundy počas behu a každých 30 sekúnd po skončení."
+      },
+      {
+        "name": "Panel pokroku + počítadlo krokov",
+        "detail": "Zobrazí <code>N/M steps</code> a názov aktuálneho kroku. Počas obnovy sa <em>odhadovaný čas</em> vypočíta z dokončených krokov a uplynutého času."
+      },
+      {
+        "name": "Zoznam komponentov",
+        "detail": "Jeden riadok na jedného ovládača, ktorý bol preinštalovaný (NVIDIA, nástroje Intel GPU, nástroje AMD, Coral TPU) s <code>installing</code> / <code>ok</code> / <code>failed</code> plus odkaz na jednotlivé komponenty pri <code>/var/log/proxmenux/component-*.log</code>."
+      },
+      {
+        "name": "Import dátových poolov",
+        "detail": "Blok <code>data_pools_import</code> má päť farebných riadkov: <em>Importované</em>, <em>Vynútené</em> (s <code>-f</code> pre cudzí hostid), <em>Preskočené, neúplné disky</em> (prítomné iba niektoré disky), <em>Preskočené, chýbajúce disky</em> (žiadny disk prítomný) a <em>Zlyhané</em>. Stav sa ukladá do <code>/var/lib/proxmenux/restore-state.json</code> a úplný protokol behu do <code>/var/log/proxmenux/restore-datapools-&lt;timestamp&gt;.log</code>."
+      },
+      {
+        "name": "Upozornenia pri kontrole štartu",
+        "detail": "Dispečer kontroluje chýbajúce adresáre <code>/lib/modules/&lt;kernel&gt;</code>, chýbajúcu konfiguráciu ESP a symbolické odkazy <code>/vmlinuz</code> bez existujúceho cieľa. Upozornenia sa zobrazia vo farebnom paneli."
+      },
+      {
+        "name": "Rozdiely po obnove",
+        "detail": "Vypíše VM, LXC a komponenty prítomné na cieli, ale nie v obnovenej zálohe: tie isté položky ako v dialógu deštruktívneho vrátenia stavu pred obnovou. Každý riadok obsahuje príkaz na ručné odstránenie."
+      },
+      {
+        "name": "Koniec záznamu",
+        "detail": "Posledné línie 600 <code>proxmenux-cluster-postboot-&lt;ts&gt;.log</code>, s <em>Iba problémy</em>, ktorý udržuje len línie zodpovedajúce <code>error</code>, <code>warning</code>, <code>failed</code>, <code>✗</code> alebo <code>traceback</code>."
+      }
+    ],
+    "dismissBody": "Keď je obnova <em>dokončená</em> alebo <em>zlyhá</em>, tlačidlo Skryť zbalí kartu. Stavový súbor zostane uložený a História znovu otvorí túto aj predošlé obnovy. Posledných 20 behov je archivovaných v <code>/var/lib/proxmenux/restore-history/</code>.",
+    "imageAlt": "Okno Podrobnosti priebehu po obnove v ProxMenux Monitor otvorené počas obnovy. Zobrazuje modrý odznak Prebieha obnova, aktuálny krok Obnovenie initramfs, odhad zostávajúceho času, čiastočne vyplnený ukazovateľ priebehu a živý koniec záznamu po štarte systému.",
+    "imageCaption": "Okno Podrobnosti počas spracovania po štarte: stav, aktuálny krok, zostávajúci čas a živý výpis posledných riadkov protokolu.",
+    "detailsImageAlt": "Rovnaké okno Podrobnosti po skončení obnovy: zelený stav Obnova dokončená, celkový čas 0m53s, plný ukazovateľ 6/6, prázdna časť rozdielov vrátenia stavu a archivovaný protokol po štarte.",
+    "detailsImageCaption": "Rovnaké okno po skončení: stav, celkový čas, plný ukazovateľ priebehu a archivovaný protokol po štarte."
+  },
+  "postbootExample": {
+    "heading": "Ako vyzerá post-boot na konzole",
+    "body": "Na fyzickej konzole skončí úspešne ukončený proces riadkom <code>[ OK ] Finished proxmenux-apply-cluster-postboot.service</code>, často pri hláseniach <code>OK</code> pre <code>multi-user.target</code> a <code>graphical.target</code>. Označuje koniec procesu. Napriek tomu môžu byť zaznamenané chyby komponentov alebo upozornenia na štart. Pred vyhlásením hostiteľa za úplne obnoveného skontrolujte stavy komponentov a protokoly v Monitore.",
+    "imageAlt": "Fyzická konzola Proxmox s hlásením '[ OK ] Finished proxmenux-apply-cluster-postboot.service - ProxMenux Apply Cluster Configs (post-boot).', za ktorým nasleduje OK pre multi-user.target a graphical.target; vyššie je výzva na prihlásenie.",
+    "imageCaption": "Fyzická konzola po skončení procesu. 'Finished proxmenux-apply-cluster-postboot.service' označuje jeho koniec, ktorý Monitor hlási aj ako 'Host restore finished'. Výsledky komponentov a upozornenia treba ešte skontrolovať."
+  },
+  "tenMinutes": {
+    "heading": "Prečo na posledných 10 minútach záleží",
+    "intro": "Reštart sám trvá sekundy, ale post-boot dispečer strávi asi desať minút dokončenie obnovy. Počas tohto okna je hostiteľ dosiahnuteľný a prihlásenie funguje, ale niektoré služby (najmä služby závislé od ovládača GPU) ešte nie sú k dispozícii. Časový rozpis typického hostiteľa Proxmoxu s NVIDIA + nainštalovaným Coralom:",
+    "rows": [
+      {
+        "stage": "Boot + pve-cluster pripravený",
+        "time": "~30 s",
+        "detail": "Standard Proxmox boot. SSH, web UI a login sú k dispozícii na konci tejto etapy."
+      },
+      {
+        "stage": "Použiť /etc/pve na pmxcfs",
+        "time": "~10 s",
+        "detail": "Rýchle: malé konfiguračné súbory sa kopírujú po jednom do aktívneho klastrového súborového systému."
+      },
+      {
+        "stage": "Znovu vytvoriť initramfs pre všetky jadrá",
+        "time": "3–5 min",
+        "detail": "<code>update-initramfs -u -k all</code> prestavuje jeden obrázok initramfs na nainštalované jadro. Veľa čakania."
+      },
+      {
+        "stage": "Znovu vytvoriť bootloader konfigur",
+        "time": "10–30 s",
+        "detail": "<code>update-grub</code> alebo <code>proxmox-boot-tool refresh</code>. Rýchle aj na ZFS."
+      },
+      {
+        "stage": "Preinštalovať ovládač NVIDIA (ak je to vhodné)",
+        "time": "5–10 min",
+        "detail": "Stiahne nahranú verziu ovládača, kompiluje moduly DKMS oproti aktuálnemu jadru, použije opravu ProxMenux ak ju mal zdroj. Najdlhšia jediná úloha."
+      },
+      {
+        "stage": "Opätovná inštalácia Coral a ďalších komponentov",
+        "time": "3–5 min",
+        "detail": "Kompilácia DKMS pre Coral, apt install pre intel-gpu-tools a stiahnutie a inštalácia .deb pre amdgpu_top."
+      },
+      {
+        "stage": "Kontrola štartu a oznámenie",
+        "time": "~2 s",
+        "detail": "Nenáročné. Oznámenie informuje používateľa hneď po skončení behu."
+      }
+    ],
+    "outroBody": "Počas tohto času môžu po prihlásení chýbať nástroje (<code>nvidia-smi</code> sa nenašiel, <code>coral</code> sa nezistil), pretože reinštalácia stále beží na pozadí. Oznámenie označuje jej koniec. Výsledky komponentov, upozornenia a protokoly odlíšia úspech od jednotlivých zlyhaní."
+  },
+  "destructiveRollback": {
+    "heading": "Voliteľný deštruktívny spätný chod",
+    "body": "Obnova je predvolene aditívna: dodatočné VM, LXC a komponenty zostanú zachované. Pri rozdieloch ponúkne potvrdenie <em>Vykonať deštruktívne vrátenie stavu?</em> s predvoleným Nie. Súhlas pred reštartom zavolá <code>_rs_execute_rollback</code> a pokúsi sa odstrániť vypísané dodatočné VM a LXC. Komponenty sa označia na ručné odinštalovanie, pretože automatické nie je implementované. Chyby odstránenia sa oznámia a spracovanie pokračuje, takže presná zhoda nie je zaručená. Pred touto deštruktívnou voľbou skontrolujte názvy a VMID/CTID."
+  },
+  "logs": {
+    "heading": "Kde záznamy žijú",
+    "rows": [
+      {
+        "log": "/var/log/proxmenux/restore-YYYYMMDD_HHMMSS.log",
+        "detail": "Zapisuje sa v interaktívnej fáze: výsledky kompatibility, filter rozdielov, plán prispôsobenia, výstup použitia za behu a prípravy odložených zmien, inštalácia balíkov."
+      },
+      {
+        "log": "/var/log/proxmenux/apply-pending-YYYYMMDD_HHMMSS.log",
+        "detail": "Zapisuje ho <code>apply_pending_restore.sh</code> na začiatku štartu: načítanie plan.env, spracovanie apply-on-boot a filtrovanie vylúčených ciest."
+      },
+      {
+        "log": "/var/log/proxmenux/proxmenux-cluster-postboot-YYYYMMDD_HHMMSS.log",
+        "detail": "Zapisuje ho <code>apply_cluster_postboot.sh</code>: použitie konfigurácie pve-cluster, výstup initramfs a zavádzača, výstup inštalátorov komponentov, kontrola štartu a obsah oznámenia."
+      },
+      {
+        "log": "/var/log/proxmenux/component-<name>-YYYYMMDD_HHMMSS.log",
+        "detail": "Jeden protokol na inštalačný program komponentu (nvidia, coral, atď.), ktorý bol spustený v prechode po spustení. Užitočné, keď preinštalovanie konkrétneho komponentu zlyhalo a používateľ potrebuje vlastný výstup nástroja."
+      },
+      {
+        "log": "/var/log/proxmenux/restore-datapools-YYYYMMDD_HHMMSS.log",
+        "detail": "Napísal <code>_rs_import_data_pools</code>. Obsahuje: sčítanie nekoreňových poolov z manifestu, na-pool výsledok (dovážané čisto, importované s <code>-f</code> pre zahraničné hostid, preskočené kvôli chýbajúce disky, alebo zlyhal), a surový výstup každého <code>zpool import</code> hovoru."
+      }
+    ]
+  },
+  "whereNext": {
+    "heading": "Kam ísť ďalej",
+    "items": [
+      {
+        "label": "Obnova medzi kernelmi",
+        "href": "/docs/backup-restore/cross-kernel",
+        "tail": "— filter bezpečnej podmnožiny zohľadňujúci smer a prechod na hydratáciu vyvolaný, keď sa cieľové jadro líši od záložného."
+      },
+      {
+        "label": "Ako to funguje",
+        "href": "/docs/backup-restore/how-it-works",
+        "tail": " — štruktúra archívu, manifest a inventár aplikácií, ktoré používa obnova."
+      },
+      {
+        "label": "Plánované úlohy",
+        "href": "/docs/backup-restore/scheduled-jobs",
+        "tail": " — bezobslužný postup, ktorý vytvára archívy používané pri tejto obnove."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sk/docs/backup-restore/scheduled-jobs.json b/web/messages/sk/docs/backup-restore/scheduled-jobs.json
new file mode 100644
index 00000000..03e011e3
--- /dev/null
+++ b/web/messages/sk/docs/backup-restore/scheduled-jobs.json
@@ -0,0 +1,152 @@
+{
+  "meta": {
+    "title": "Plánované úlohy — časovače, režim attach a uchovávanie záloh | ProxMenux",
+    "description": "Plánované úlohy zálohovania hostiteľa ProxMenux. Dva režimy vytvorenia (vlastný časovač systemd alebo pripojenie k existujúcej úlohe vzdump PVE), pravidlá uchovávania pre jednotlivé úlohy cez proxmox-backup-client, Borg alebo lokálne čistenie, súbory v /var/lib/proxmenux/backup-jobs a spúšťací skript vytvárajúci rovnaké archívy ako interaktívny postup.",
+    "ogTitle": "Zálohovanie ProxMenux — plánované úlohy",
+    "ogDescription": "Plánované zálohy hostiteľa bez obsluhy s režimom pripojenia, pravidlami uchovávania a rovnakými tromi cieľmi ako interaktívny postup.",
+    "twitterTitle": "Plánované úlohy | ProxMenux",
+    "twitterDescription": "Plánované úlohy zálohovania hostiteľa bez obsluhy s režimom pripojenia a uchovávaním."
+  },
+  "header": {
+    "title": "Plánované úlohy",
+    "description": "Úlohy zálohovania hostiteľa bez obsluhy. Dva modely vytvorenia: nová nezávislá úloha s vlastným plánom alebo úloha pripojená k existujúcej úlohe vzdump PVE, z ktorej preberá plán a pravidlá uchovávania. Oba modely vytvárajú rovnaké archívy ako interaktívny postup.",
+    "section": "Záloha a obnova"
+  },
+  "intro": {
+    "title": "Dva modely plánovaných úloh",
+    "body": "Plánovanú úlohu možno vytvoriť podľa jedného z dvoch modelov:",
+    "modelsList": [
+      "<strong>Nová nezávislá úloha</strong> — ProxMenux nastaví vlastný plán pomocou samostatného časovača systemd, nezávisle od ostatných úloh na hostiteľovi. Podporuje všetky tri ciele: lokálny, PBS a Borg.",
+      "<strong>Pripojenie k existujúcej úlohe vzdump PVE</strong> — úloha nemá vlastný plán; spúšťa sa automaticky pri nadradenej úlohe vzdump PVE, ktorá už zálohuje VM a LXC na hostiteľovi. Preberá jej plán a pravidlá uchovávania. Podporuje lokálny cieľ a PBS (Borg nie je podporovaný, pretože PVE preň nemá natívny plánovač)."
+    ]
+  },
+  "attachBadge": {
+    "title": "Režim pripojenia — odporúčaný, ak už existuje úloha vzdump PVE",
+    "body": "Ak už existuje úloha vzdump PVE pre VM a LXC na uzle, pripojená záloha hostiteľa sa vykoná po zálohe hostí v <strong>rovnakom zálohovacom cykle</strong>. Pri obnove pochádzajú konfigurácie hostí zo zálohy hostiteľa (v <code>/etc/pve</code>) a ich disky zo záloh vzdump daného cyklu. To pomáha koordinovať obnovu celého uzla, ale nejde o atómovú snímku: zmeny počas cyklu môžu zanechať rozdiely medzi konfiguráciou hostiteľa a stavom diskov hostí."
+  },
+  "frequencyBadge": {
+    "title": "Odporúčaná frekvencia",
+    "body": "Ak chcete maximalizovať kompatibilitu zálohy hostiteľa s budúcou obnovou, zálohujte často. Čím bližšie je záloha aktuálnemu stavu hostiteľa, tým menej rozdielov v konfigurácii, balíkoch a komponentoch musí obnova zosúladiť."
+  },
+  "modes": {
+    "heading": "Dva režimy",
+    "rows": [
+      {
+        "mode": "Nová plánovaná úloha",
+        "backends": "Miestne, PBS, Borg",
+        "schedule": "Vlastný výraz <code>OnCalendar</code> (syntax kalendára systemd, napr. <code>daily</code> alebo <code>Mon..Fri 03:00</code>).",
+        "retention": "Zadáva sa samostatne: <code>keep-last</code>, <code>keep-hourly</code>, <code>keep-daily</code>, <code>keep-weekly</code>, <code>keep-monthly</code>, <code>keep-yearly</code>. Použije spúšťací skript po každej úspešnej zálohe."
+      },
+      {
+        "mode": "Pripojiť k úlohe vzdump PVE",
+        "backends": "Local, PBS (Borg nemá plánovač na strane PVE)",
+        "schedule": "Preberá sa z nadradenej úlohy PVE. Na strane ProxMenux sa neinštaluje žiadny časovač systemd.",
+        "retention": "Preberá sa z konfigurácie <code>prune-backups</code> nadradenej úlohy (pomocou <code>hb_pve_prune_to_keep_env</code> mapovanej jedna k jednej na premenné <code>KEEP_*</code> spúšťacieho skriptu)."
+      }
+    ]
+  },
+  "attachDetail": {
+    "heading": "Ako funguje režim pripojenia",
+    "intro": "PVE zapisuje úlohy <code>vzdump</code> do <code>/etc/pve/jobs.cfg</code> — jednu sekciu pre každú úlohu s úložiskom záloh VM a LXC. Režim pripojenia vyžaduje backend podporovaný ProxMenux (lokálny alebo PBS). Záloha hostiteľa sa spustí cez hook job-end po dokončení úlohy zálohovania hostí.",
+    "steps": [
+      {
+        "step": "1",
+        "detail": "Počas vytvárania úlohy ProxMenux uvádza kompatibilné rodičovské PVE úlohy prostredníctvom <code>hb_pve_list_vzdump_jobs_for_backend</code>. Užívateľ si vyberie jednu."
+      },
+      {
+        "step": "2",
+        "detail": "Súbor <code>.env</code> úlohy sa zapíše s <code>PVE_PARENT_JOB</code>, <code>PVE_STORAGE</code> a prevzatými hodnotami <code>KEEP_*</code>; časovač systemd sa nevytvorí."
+      },
+      {
+        "step": "3",
+        "detail": "<code>hb_install_vzdump_hook</code> zaregistruje hook v <code>/etc/vzdump.conf</code>. Vo fáze job-end ľubovoľnej úlohy vzdump porovná prijaté <code>$STOREID</code> s <code>PVE_STORAGE</code> každej povolenej pripojenej úlohy a pri zhode zavolá spúšťací skript. Zhoda sa určuje podľa úložiska, nie podľa ID vybranej nadradenej úlohy."
+      },
+      {
+        "step": "4",
+        "detail": "Archív sa uloží do rovnakého úložiska ako zálohy vzdump: <code>path/dump/</code> pri lokálnom cieli alebo repozitár PBS nastavený v úložisku PVE."
+      }
+    ],
+    "outroBody": "Režim pripojenia nemá vlastný časovač. Vypnutie alebo odstránenie vybranej nadradenej úlohy PVE zastaví jej spúšťanie, ale iná úloha vzdump s rovnakým úložiskom môže pripojenú zálohu hostiteľa stále spustiť. Ak tomu chcete zabrániť, vypnite alebo odstráňte samotnú úlohu ProxMenux. Pri vypnutí zostane záznam na disku a možno ho neskôr povoliť alebo znovu pripojiť."
+  },
+  "storageLayout": {
+    "heading": "Súbory, ktoré tvoria prácu",
+    "intro": "Každá plánovaná úloha je plne popísaná tromi alebo štyrmi súbormi na disku. Čítanie im dáva plnú konfiguráciu úlohy bez spoliehania sa na rozhranie.",
+    "rows": [
+      {
+        "path": "/var/lib/proxmenux/backup-jobs/JOB_ID.env",
+        "content": "Backend, ID zálohy alebo cieľ, plán (nový režim) alebo nadradená úloha PVE (režim pripojenia), príznak povolenia, hodnoty uchovávania <code>KEEP_*</code> a odkazy na prihlasovacie údaje."
+      },
+      {
+        "path": "/var/lib/proxmenux/backup-jobs/JOB_ID.paths",
+        "content": "Jedna absolútna cesta na riadok — výber odvodený z profilu a uložený pri vytvorení úlohy. Po úprave súboru sa pri ďalšom spustení časovačom použije nový výber."
+      },
+      {
+        "path": "/etc/systemd/system/proxmenux-backup-JOB_ID.timer + .service",
+        "content": "Iba nový režim. Služba vyvoláva <code>run_scheduled_backup.sh JOB_ID</code>. Časovač ho naplánuje s <code>Persistent=true</code> (zmeškané spustenia sa vykonajú pri ďalšom štarte) a malým <code>RandomizedDelaySec=120</code> rozložiť zaťaženie, keď viaceré úlohy zdieľa rovnaký OnCalendar výraz."
+      },
+      {
+        "path": "/etc/vzdump.conf script-hook",
+        "content": "Iba režim pripojenia. Raz ho nainštaluje <code>hb_install_vzdump_hook</code>; porovnáva <code>PVE_STORAGE</code> každej pripojenej úlohy s <code>$STOREID</code>, ktoré PVE odovzdáva hooku."
+      }
+    ]
+  },
+  "runner": {
+    "heading": "Čo úloha vykoná pri spustení",
+    "intro": "Každá práca, či je nový model alebo pripojený, má rovnakú trojstupňovú sekvenciu:",
+    "steps": [
+      "<strong>Pripraví zálohu.</strong> Načíta konfiguráciu úlohy (cieľ, profil, cesty) a zostaví strom archívu rovnako ako interaktívny postup. Výsledkom je rovnaký archív, aký by vytvorila manuálna záloha s týmito nastaveniami.",
+      "<strong>Zapíše do cieľa.</strong> Odošle alebo zapíše archív do nastaveného cieľa — lokálny súbor <code>.tar.zst</code>, záloha PBS alebo archív Borg — s presne rovnakými nástrojmi a prihlasovacími údajmi ako manuálna záloha do rovnakého cieľa.",
+      "<strong>Použije pravidlá uchovávania.</strong> Odstráni staré zálohy z cieľa a ponechá počty nastavené v úlohe cez <code>keep-last</code> / <code>keep-daily</code> / <code>keep-weekly</code>. Čistenie vykonáva príslušný backend: PBS používa svoje pravidlá uchovávania, Borg spustí <code>borg prune</code> a pri lokálnom cieli ProxMenux odstráni súbory mimo rozsahu <code>keep-last</code>."
+    ]
+  },
+  "management": {
+    "heading": "Správa úloh",
+    "intro": "Menu rozvrhu (Scripts TUI) a záložka Monitor Backup odhaľujú rovnaké akcie na akejkoľvek práci.",
+    "rows": [
+      {
+        "action": "Spustiť teraz",
+        "detail": "Okamžite zavolá spúšťací skript bez čakania na časovač alebo hook vzdump. Umožní overiť konfiguráciu úlohy bez čakania na ďalšie plánované spustenie."
+      },
+      {
+        "action": "Povoliť / zakázať",
+        "detail": "Nový režim: časovač sa ovláda cez <code>systemctl enable/disable --now</code>. Režim pripojenia: zmení príznak <code>ENABLED</code> v súbore env úlohy — hook ho zohľadní pri ďalšom spustení PVE."
+      },
+      {
+        "action": "Upraviť",
+        "detail": "Znovu otvorí destináciu, rozvrh, profil a retenčný postup a prepíše pracovné súbory. Zachováva ID práce."
+      },
+      {
+        "action": "Odstrániť",
+        "detail": "Odstráni súbor env úlohy, súbor ciest, časovač a službu systemd (nový režim) a vypne pripojenie k hooku (režim pripojenia). Existujúce archívy v cieli nemení."
+      },
+      {
+        "action": "Zobraziť záznam",
+        "detail": "Priebežne zobrazuje <code>/var/log/proxmenux/backup-jobs/JOB_ID-YYYYMMDD_HHMMSS.log</code> — jeden protokolový súbor na beh. Spúšťací skript tiež vydáva kompaktný stavový riadok na journald pod systemd služby."
+      }
+    ]
+  },
+  "notifications": {
+    "heading": "Oznámenia",
+    "body": "Každé plánované spustenie vyvolá rovnaké udalosti <code>hb_notify_lifecycle</code> ako interaktívny postup (<code>start</code>, <code>complete</code>, <code>fail</code>). Ak sú v Monitore nastavené kanály upozornení, úlohy bez obsluhy oznámia výsledky rovnako ako manuálne zálohy — používateľ nemusí kontrolovať záznam, aby zistil úspech úlohy."
+  },
+  "whereNext": {
+    "heading": "Kam ísť ďalej",
+    "items": [
+      {
+        "label": "Vytváranie záloh",
+        "href": "/docs/backup-restore/creating-backups",
+        "tail": " — interaktívny postup, ktorý zdieľa backend s plánovačom."
+      },
+      {
+        "label": "Ciele",
+        "href": "/docs/backup-restore/destinations",
+        "tail": " — konfigurácia jednotlivých backendov používaná interaktívnym postupom aj plánovačom."
+      },
+      {
+        "label": "Obnovenie",
+        "href": "/docs/backup-restore/restoring",
+        "tail": " — postup používajúci zálohy vytvorené úlohami."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sk/docs/create-vm/index.json b/web/messages/sk/docs/create-vm/index.json
new file mode 100644
index 00000000..63cbba8a
--- /dev/null
+++ b/web/messages/sk/docs/create-vm/index.json
@@ -0,0 +1,175 @@
+{
+  "meta": {
+    "title": "Vytváranie VM v Proxmox VE — sprievodcovia pre Synology, Windows, Linux a NAS | ProxMenux",
+    "description": "Vytvárajte a konfigurujte VM v Proxmox VE pomocou ProxMenux. Sprievodcovia pre NAS (Synology DSM, TrueNAS, OpenMediaVault, XigmaNAS atď.), Windows, distribúcie Linux a externý inštalátor macOS. Rozumné predvoľby hardvéru, úložiska a siete.",
+    "ogTitle": "Vytváranie VM v Proxmox VE: sprievodcovia Synology, Windows, Linux a NAS",
+    "ogDescription": "Sprievodcovia ProxMenux na vytváranie VM Synology DSM, TrueNAS, OMV, XigmaNAS, Windows a Linux v Proxmox VE.",
+    "ogImageAlt": "Ponuka Vytvoriť VM v ProxMenux",
+    "twitterTitle": "Vytvoriť VMs na Proxmox VE | ProxMenux",
+    "twitterDescription": "Sprievodcovia pre VM Synology, TrueNAS, OMV, XigmaNAS, Windows a Linux v Proxmox VE."
+  },
+  "header": {
+    "title": "Vytvoriť VM",
+    "description": "ProxMenux združuje vytváranie VM do interaktívnej ponuky. Vyberte skupinu operačných systémov a sprievodca nastaví ISO, CPU, RAM, BIOS, sieť, úložisko a voliteľný GPU passthrough.",
+    "section": "Virtuálne stroje"
+  },
+  "intro": {
+    "title": "Na čo je toto menu",
+    "body": "Menu Vytvoriť VM je router, nie jediný sprievodca. Pýta sa, ktorý rad operačných systémov chcete nainštalovať a načítať príslušný volič ISO a konfigurátor. Predvolené toky používajú rozumné prednastavenia ProxMenux; Pokročilé toky odhaľujú každú konfigurovateľnú možnosť pred vytvorením VM."
+  },
+  "opening": {
+    "heading": "Otvorenie menu",
+    "body": "V hlavnej ponuke ProxMenux vyberte <strong>Vytvoriť VM</strong>. Zobrazí sa:",
+    "imageAlt": "Ponuka Vytvoriť VM s tromi možnosťami ProxMenux (NAS/Windows/Linux) a časťou Community Scripts pod nimi (macOS/Ostatné)"
+  },
+  "families": {
+    "heading": "Tri rodiny OS",
+    "intro": "Tri položky ProxMenux v hornej časti ponuky zdieľajú rovnaký základ a postup po výbere ISO. Líšia sa výberom ISO a predvoľbami pre danú skupinu. Vyberte položku podľa systému, ktorý chcete nainštalovať.",
+    "routes": [
+      {
+        "key": "nas",
+        "title": "Systém NAS",
+        "icon": "HardDrive",
+        "href": "/docs/create-vm/system-nas",
+        "accent": "border-emerald-300 bg-emerald-50",
+        "iconBg": "bg-emerald-100 text-emerald-700",
+        "description": "Osem systémov NAS ako samostatné VM. Väčšina používa automatický postup ISO; Synology DSM má špecializovaného sprievodcu zavádzačom.",
+        "bullets": [
+          "Synology DSM (zavádzače Arc / RR / Alpine RedPill M-shell)",
+          "TrueNAS SCALE a CORE (ZFS)",
+          "OpenMediaVault (na báze Debianu)",
+          "XigmaNAS (FreeBSD ZFS)",
+          "Rockstor (openSUSE / Btrfs), ZimaOS, FygoOS"
+        ]
+      },
+      {
+        "key": "windows",
+        "title": "Systém Windows",
+        "icon": "MonitorCog",
+        "href": "/docs/create-vm/system-windows",
+        "accent": "border-blue-300 bg-blue-50",
+        "iconBg": "bg-blue-100 text-blue-700",
+        "description": "Edície Windows 10, 11 a Server s vhodnými predvoľbami (q35 + OVMF + TPM 2.0) a vopred pripojeným ISO ovládačov VirtIO.",
+        "bullets": [
+          "UUP Dump pre aktuálne ISO",
+          "Alebo miestne ISO z /var/lib/vz/template/iso",
+          "TPM 2.0 pridaný automaticky",
+          "ISO ovládačov VirtIO pripojené k ide3",
+          "Zapnutý kanál hosťovského agenta"
+        ]
+      },
+      {
+        "key": "linux",
+        "title": "Systém Linux",
+        "icon": "Laptop",
+        "href": "/docs/create-vm/system-linux",
+        "accent": "border-amber-300 bg-amber-50",
+        "iconBg": "bg-amber-100 text-amber-700",
+        "description": "Vybraný katalóg oficiálnych ISO Linux stiahnutých automaticky od pôvodných projektov a výber miestnych ISO pre ostatné obrazy.",
+        "bullets": [
+          "Ubuntu (Pracovná plocha / Server, 20.04–25.10)",
+          "Debian (Pracovná plocha / Netinst, 11–13)",
+          "Fedora, Arch, Rocky, Mint, openSUSE",
+          "Alpine, Kali, Manjaro",
+          "Miestna cesta k ISO pre vlastné obrazy"
+        ]
+      }
+    ]
+  },
+  "community": {
+    "title": "Komunitné skripty (tu nie sú zdokumentované)",
+    "intro": "Dve položky pod oddeľovačom <em>Community Scripts</em> spúšťajú kód, ktorý <strong>nie je súčasťou ProxMenux</strong>, preto sú zámerne mimo tejto dokumentácie:",
+    "macosRich": "<strong>Systém macOS</strong>: spustí externý inštalátor <osxLink>OSX-PROXMOX</osxLink>. Naklonuje pôvodný repozitár, pripraví hostiteľa a <strong>po dokončení ho automaticky reštartuje</strong>. Pozrite si dokumentáciu daného projektu.",
+    "othersRich": "<strong>Ostatné systémy (založené na Linuxe)</strong> — načíta upravený zoznam komunitných inštalátorov založených na Linuxe (operačné systémy domáceho servera, zariadenia smerovača/brány firewall atď.). Každý skript komunity je udržiavaný mimo ProxMenux."
+  },
+  "afterPick": {
+    "heading": "Čo sa stane potom, čo si vyberiete OS",
+    "intro": "Po výbere ISO sa dispečer vydá rovnakou cestou bez ohľadu na skupinu OS:",
+    "items": [
+      "<strong>Predvolené alebo pokročilé.</strong> Dialóg umožní prijať predvoľby ProxMenux alebo otvoriť úplnú konfiguráciu: model a jadrá CPU, RAM, BIOS/UEFI, sieťová karta a typ stroja.",
+      "<strong>Plán úložiska.</strong> V rovnakej VM skombinujete virtuálne disky, importované disky a zariadenia PCI passthrough, napríklad celý radič alebo NVMe.",
+      "<strong>Voliteľný prechod GPU.</strong> Ak sa na hostiteľovi zistí kompatibilný GPU, ProxMenux ponúkne spustenie asistenta GPU – po vytvorení VM sa môže vyžadovať reboot.",
+      "<strong>Vytvorenie VM.</strong> VM sa vytvorí, označí tagmi a dostane formátovaný popis HTML na rýchlu orientáciu v rozhraní Proxmox."
+    ],
+    "tipTitle": "Pre VM určené na dlhšie používanie zvoľte pokročilý režim",
+    "tipBody": "Predvoľby sú vhodné na rýchle testy. Pri VM na dlhšie používanie vám pokročilý režim umožní vopred zvoliť BIOS (SeaBIOS alebo OVMF/UEFI), typ stroja (<code>i440fx</code> alebo <code>q35</code>) a radič disku (VirtIO SCSI single alebo SATA). Neskoršie zmeny bývajú náročné."
+  },
+  "scripts": {
+    "heading": "Uvedené skripty",
+    "intro": "Vstupný skript načíta zdieľané komponenty pomocou source. Nemajú samostatné stránky, preto sú uvedené tu. Každá podstránka odkazuje na hlavný skript svojho postupu.",
+    "headerScript": "Skript",
+    "headerRole": "Úloha",
+    "rows": [
+      {
+        "path": "menus/create_vm_menu.sh",
+        "role": "Vstupný bod a smerovanie."
+      },
+      {
+        "path": "vm/select_nas_iso.sh",
+        "role": "Výber ISO a systémov NAS (Synology, TrueNAS, OMV, Rockstor, XigmaNAS, ZimaOS, FygoOS)."
+      },
+      {
+        "path": "vm/select_windows_iso.sh",
+        "role": "Výber ISO Windows. Podľa potreby použije tvorbu ISO cez UUP Dump."
+      },
+      {
+        "path": "vm/select_linux_iso.sh",
+        "role": "Výber ISO Linux pre bežné distribúcie."
+      },
+      {
+        "path": "vm/synology.sh",
+        "role": "Postup Synology DSM: stiahne zavádzač a obraz DSM a pripraví profil VM."
+      },
+      {
+        "path": "vm/zimaos.sh",
+        "role": "ZimaOS tok: stiahne obraz a prepojí ho do definície VM."
+      },
+      {
+        "path": "vm/vm_configurator.sh",
+        "role": "Predvolený alebo pokročilý sprievodca: model a jadrá CPU, RAM, BIOS, sieťová karta, typ stroja."
+      },
+      {
+        "path": "vm/disk_selector.sh",
+        "role": "Plán úložiska: virtuálny disk, import disku, alebo Controller/NVMe priechod."
+      },
+      {
+        "path": "vm/vm_creator.sh",
+        "role": "Záverečné vytvorenie VM: použije konfiguráciu, pripojí úložisko a zapíše popis HTML."
+      },
+      {
+        "path": "vm/guest_agent_config.sh",
+        "role": "Voliteľný hook nastavenia hosťovského agenta QEMU pre viacero postupov."
+      }
+    ]
+  },
+  "related": {
+    "heading": "Súvisiace",
+    "items": [
+      {
+        "href": "/docs/disk-manager",
+        "label": "Správca diskov",
+        "tail": " — pripojiť existujúce fyzické disky alebo importovať obrazy diskov do VM."
+      },
+      {
+        "href": "/docs/utils/UUp-Dump-ISO-Creator",
+        "label": "Tvorba ISO cez UUP Dump",
+        "tail": " — vytvoriť inštalačné ISO Windows ako spúšťacie médium."
+      },
+      {
+        "href": "/docs/utils/import-vm",
+        "label": "Importovať VM z OVA / OVF",
+        "tail": "— priveďte vopred vytvorené VM z exportov VMware / VirtualBox / ProxMenux."
+      },
+      {
+        "href": "/docs/hardware/gpu-vm-passthrough",
+        "label": "Pridať GPU do VM (passthrough)",
+        "tail": " — priradiť GPU novovytvorenej VM."
+      },
+      {
+        "href": "/docs/help-info/vm-ct-commands",
+        "label": "Príkazy na správu VM a CT",
+        "tail": " — Referencia qm pre stranu CLI."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sk/docs/create-vm/synology.json b/web/messages/sk/docs/create-vm/synology.json
new file mode 100644
index 00000000..dbbf8125
--- /dev/null
+++ b/web/messages/sk/docs/create-vm/synology.json
@@ -0,0 +1,453 @@
+{
+  "title": "Skript na vytvorenie VM Synology",
+  "stepLabel": "Krok",
+  "intro": {
+    "heading": "Úvod",
+    "intro": "ProxMenux ponúka automatizovaný skript, ktorý vytvorí a nastaví virtuálny stroj (VM) na inštaláciu Synology DSM (DiskStation Manager) na Proxmox VE. Skript stiahne a pridá zvolený zavádzač ako spúšťací disk VM. Môžete si vybrať zo štyroch možností:",
+    "loaders": [
+      {
+        "name": "AuxXxilium Arc",
+        "url": "https://github.com/AuxXxilium/arc",
+        "extra": ""
+      },
+      {
+        "name": "RedPill RR",
+        "url": "https://github.com/RROrg/rr",
+        "extra": ""
+      },
+      {
+        "name": "Alpine RedPill M-shell (projekt TinyCore)",
+        "url": "https://github.com/PeterSuh-Q3/tinycore-redpill",
+        "extra": ""
+      }
+    ],
+    "customLoader": "Vlastný zavádzač – možnosť použiť vlastný zavádzač, ak uprednostňujete úpravu alebo vytvorenie vlastnej konfigurácie",
+    "simplifiesIntro": "Skript zjednodušuje proces tvorby VM tým, že ponúka nasledujúce možnosti:",
+    "simplifies": [
+      "Výber štandardnej alebo pokročilej konfigurácie",
+      "Konfigurácia CPU, RAM, BIOS a typ stroja",
+      "Výber virtuálneho disku alebo passthrough fyzického disku"
+    ]
+  },
+  "config": {
+    "heading": "Štandardné a pokročilé nastavenie",
+    "intro": "Skript ponúka dva režimy konfigurácie:",
+    "defaultHeading": "Štandardné nastavenie",
+    "defaultIntro": "Ak zvolíte predvolenú konfiguráciu, skript automaticky použije nasledujúce hodnoty:",
+    "headerParam": "Parameter",
+    "headerValue": "Štandardná hodnota",
+    "defaultRows": [
+      {
+        "param": "Typ stroja",
+        "value": "q35"
+      },
+      {
+        "param": "Typ BIOSu",
+        "value": "OVMF (UEFI)"
+      },
+      {
+        "param": "Typ CPU",
+        "value": "Host"
+      },
+      {
+        "param": "Počet jadier",
+        "value": "2"
+      },
+      {
+        "param": "Veľkosť RAM",
+        "value": "4096 MB"
+      },
+      {
+        "param": "Most",
+        "value": "vmbr0"
+      },
+      {
+        "param": "MAC adresa",
+        "value": "Automaticky generované"
+      },
+      {
+        "param": "Spustiť VM pri dokončení",
+        "value": "Nie"
+      }
+    ],
+    "defaultOutro": "Ak chcete prispôsobiť nastavenie, vyberte možnosť Pokročilé nastavenia v menu.",
+    "advancedHeading": "Pokročilé nastavenie",
+    "advancedIntro": "Ak zvolíte pokročilú konfiguráciu, skript vám umožní prispôsobiť každý parameter:",
+    "headerOptions": "Možnosti",
+    "advancedRows": [
+      {
+        "param": "Typ stroja",
+        "options": "q35 alebo i440fx"
+      },
+      {
+        "param": "Typ BIOSu",
+        "options": "OVMF (UEFI) alebo SeaBIOS (staršie)"
+      },
+      {
+        "param": "Typ CPU",
+        "options": "Host alebo KVM64"
+      },
+      {
+        "param": "Počet jadier",
+        "options": "Počet jadier CPU"
+      },
+      {
+        "param": "Veľkosť RAM",
+        "options": "Množstvo pamäte pridelené VM"
+      },
+      {
+        "param": "Most",
+        "options": "Sieťový most na pripojenie"
+      },
+      {
+        "param": "MAC adresa",
+        "options": "Vlastná adresa MAC"
+      },
+      {
+        "param": "VLAN",
+        "options": "Značka VLAN (ak sa používa)"
+      },
+      {
+        "param": "MTU",
+        "options": "Veľkosť maximálnej prenosovej jednotky (MTU)"
+      }
+    ]
+  },
+  "diskSelection": {
+    "heading": "Výber disku",
+    "intro": "Plán úložiska umožňuje pridať virtuálne disky, fyzické disky a radiče PCI alebo zariadenia NVMe. Možnosti diskov sú vysvetlené nižšie.",
+    "virtualHeading": "Virtuálny disk",
+    "virtualItems": [
+      "Skript uvádza možnosti ukladania dostupné v Proxmoxe",
+      "Užívateľ vyberie disk a veľkosť v GB",
+      "Virtuálne disky sa pripoja ako <strong>SATA</strong> (sata0, sata1 atď.). Virtuálne a fyzické dátové disky zdieľajú šesť pozícií SATA s číslami 0 až 5; zavádzač používa samostatnú pozíciu IDE."
+    ],
+    "physicalHeading": "Passthrough fyzického disku",
+    "physicalItems": [
+      "Skript detekuje všetky dostupné fyzické disky",
+      "Užívateľ vyberá fyzický disk alebo disky, ktoré chcú používať.",
+      "Fyzické disky sa pripoja ako zariadenia <strong>SATA</strong>. S virtuálnymi dátovými diskami zdieľajú šesť pozícií SATA s číslami 0 až 5; nejde o ďalší limit šiestich fyzických diskov."
+    ]
+  },
+  "loaderInstall": {
+    "heading": "Inštalácia zavádzača",
+    "intro1": "Skript automaticky stiahne a rozbalí zavádzač z repozitára vývojára. Ak sťahovanie zlyhá, zobrazí chybovú správu.",
+    "intro2Rich": "<strong>AuxXxilium Arc</strong>, <strong>RedPill RR</strong> a <strong>Alpine RedPill M-shell</strong> sa stiahnu a rozbalia automaticky.",
+    "customRich": "Pre <strong>Custom Loader</strong>, skript hľadá súbory v <code>/var/lib/vz/template/iso</code>. Ak sa nájde viac súborov, budete vyzvaní vybrať požadovaný súbor.",
+    "uploadIntro": "Vlastné zavádzače môžete nahrať cez možnosti lokálneho úložiska.",
+    "imageAlt": "Pridať vlastný zavádzač",
+    "imageCaption": "Pridať vlastný zavádzač"
+  },
+  "vmCreation": {
+    "heading": "Vytvorenie VM",
+    "intro": "Po stiahnutí zavádzača skript vytvorí VM pomocou nasledujúcich príkazov:",
+    "items": [
+      "<code>qm create</code> – vytvorí virtuálny stroj s nastavenými parametrami",
+      "<code>qm importdisk</code> importuje obraz zavádzača do úložiska Proxmox. Skript ho potom pre kompatibilitu pripojí k VM ako ide0.",
+      "<code>qm set</code> – nastaví hodnoty konfigurácie, napríklad CPU, RAM a úložisko",
+      "<code>qm set VMID --boot order=ide0</code> nastaví zavádzač ako spúšťacie zariadenie. VMID nahraďte ID virtuálneho stroja."
+    ]
+  },
+  "stepGuide": {
+    "heading": "Podrobný návod na nastavenie zavádzača",
+    "intro": "Každý zavádzač má vlastné menu a spôsob nastavenia. Nasledujúcich šesť krokov vysvetľuje spoločný postup; pri rozdieloch sa riaďte pokynmi aktuálneho zavádzača. Snímky M-shell zobrazujú staršie rozhranie TinyCore, kým aktuálny skript sťahuje Alpine RedPill M-shell.",
+    "selectorHeading": "Vyberte typ zavádzača:",
+    "loaderButtons": {
+      "arc": "Arc Loader",
+      "rr": "RR Loader",
+      "tinycore": "TinyCore Loader"
+    }
+  },
+  "steps": [
+    {
+      "id": "step1",
+      "title": "Spustite VM a otvorte hlavné menu",
+      "intro": "Po vytvorení VM ju spustite. Pri prvom spustení otvoríte hlavné menu zavádzača, kde vyberiete a nastavíte model DSM. Po vytvorení zavádzača sa tento krok preskočí, ak ručne nevynútite nové nastavenie zo spúšťacieho menu. Všetky zavádzače ponúkajú aj nastavenie cez webové rozhranie.",
+      "loaders": {
+        "arc": [
+          {
+            "htmlBefore": "<strong>Webové rozhranie</strong>: otvorte prehliadač a zadajte IP adresu zobrazenú v konzole VM. V našom príklade: http://192.169.0.32.",
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/arc/arc_1_0_1.png",
+            "alt": "Webové rozhranie Arc Loader",
+            "caption": "Webové rozhranie Arc Loader"
+          },
+          {
+            "htmlBefore": "<strong>Terminálové rozhranie</strong>: otvorte ho priamo v konzole VM.",
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/arc/arc_1_1_1.png",
+            "alt": "Terminálové rozhranie zavádzača Arc",
+            "caption": "Terminálové rozhranie zavádzača Arc"
+          }
+        ],
+        "rr": [
+          {
+            "htmlBefore": "<strong>Webové rozhranie</strong>: otvorte prehliadač a zadajte IP adresu z konzoly VM s portom <strong>7681</strong>. V našom príklade: <code>http://192.169.0.33:7681</code>.",
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/rr/rr_2_0_2.png",
+            "alt": "Príklad príkazu RR",
+            "caption": "Webové rozhranie RR Loader"
+          },
+          {
+            "htmlBefore": "<strong>Terminálové rozhranie</strong>: otvorte ho zadaním <strong>menu.sh</strong> v konzole VM.",
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/rr/rr_2_1_1.png",
+            "alt": "Rozhranie RR Loader",
+            "caption": "Terminálové rozhranie RR Loader"
+          }
+        ],
+        "tinycore": [
+          {
+            "htmlBefore": "<strong>Webové rozhranie</strong>: otvorte prehliadač a zadajte IP adresu z konzoly VM s portom <strong>7681</strong>. V našom príklade: <code>http://192.169.0.35:7681</code>.",
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/tinycore/tinycore_3_0_1.png",
+            "alt": "Rozhranie TinyCore Loader",
+            "caption": "Webové rozhranie TinyCore Loader"
+          },
+          {
+            "htmlBefore": "<strong>Terminálové rozhranie</strong>: otvorte ho priamo v konzole VM. Sledujte obrazovku, pretože môže vyzvať na stlačenie klávesu na pokračovanie alebo na zmenu jazyka.",
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/tinycore/tinycore_3_1_1.png",
+            "alt": "Rozhranie TinyCore Loader",
+            "caption": "Terminálové rozhranie TinyCore Loader"
+          }
+        ]
+      }
+    },
+    {
+      "id": "step2",
+      "title": "Vybrať model",
+      "intro": "Po otvorení menu vyberte model Synology DSM, ktorý chcete nainštalovať. Podľa zavádzača môže byť potrebné rozbaliť ďalšie možnosti, aby sa zobrazilo viac modelov.",
+      "outro": "V našom príklade si vyberieme model SA6400.",
+      "loaders": {
+        "arc": [
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/arc/arc_1_2_1.png",
+            "alt": "Výber modelu v Arc",
+            "caption": "Výber modelu v Arc"
+          }
+        ],
+        "rr": [
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/rr/rr_2_2_1.png",
+            "alt": "Výber modelu RR",
+            "caption": "Výber modelu RR"
+          }
+        ],
+        "tinycore": [
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/tinycore/tinycore_3_2_1.png",
+            "alt": "Výber modelu TinyCore",
+            "caption": "Výber modelu TinyCore"
+          }
+        ]
+      }
+    },
+    {
+      "id": "step3",
+      "title": "Vyberte verziu DSM",
+      "intro": "Po výbere modelu musíte vybrať verziu DSM, ktorú chcete nainštalovať.",
+      "loaders": {
+        "arc": [
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/arc/arc_1_3_1.png",
+            "alt": "Výber verzie v Arc – krok 1",
+            "caption": "Výber verzie v Arc – krok 1"
+          },
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/arc/arc_1_3_2.png",
+            "alt": "Výber verzie v Arc – krok 2",
+            "caption": "Výber verzie v Arc – krok 2"
+          }
+        ],
+        "rr": [
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/rr/rr_2_3_1.png",
+            "alt": "Výber verzie RR - krok 1",
+            "caption": "Výber verzie RR - krok 1"
+          },
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/rr/rr_2_3_2.png",
+            "alt": "Výber verzie RR - krok 2",
+            "caption": "Výber verzie RR - krok 2"
+          },
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/rr/rr_2_3_3.png",
+            "alt": "Výber verzie RR - krok 3",
+            "caption": "Výber verzie RR - krok 3"
+          }
+        ],
+        "tinycore": [
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/tinycore/tinycore_3_3_1.png",
+            "alt": "Výber verzie TinyCore - krok 1",
+            "caption": "Výber verzie TinyCore - krok 1"
+          },
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/tinycore/tinycore_3_3_2.png",
+            "alt": "Výber verzie TinyCore - krok 2",
+            "caption": "Výber verzie TinyCore - krok 2"
+          }
+        ]
+      }
+    },
+    {
+      "id": "step4",
+      "title": "Vyberte doplnky",
+      "intro": "V tomto kroku môžete do zavádzača pridať ďalšie funkcie alebo vlastné nastavenia.",
+      "loaders": {
+        "arc": [
+          {
+            "htmlBefore": "<strong>Arc</strong> ponúka automatické nastavenie alebo ručné úpravy. Ak zvolíte automatické nastavenie, zavádzač použije potrebné nastavenia a po dokončení sa automaticky reštartuje.",
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/arc/arc_1_4_1.png",
+            "alt": "Automatické nastavenie Arc",
+            "caption": "Automatické nastavenie Arc"
+          },
+          {
+            "htmlBefore": "Ak nezvolíte automatický režim, otvorte menu a nastavte možnosti potrebné pre zavádzač.",
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/arc/arc_1_4_2.png",
+            "alt": "Ručné nastavenie Arc",
+            "caption": "Ručné nastavenie Arc"
+          },
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/arc/arc_1_4_3.png",
+            "alt": "Konfigurácia Arc SN/Mac",
+            "caption": "Konfigurácia Arc SN/Mac"
+          },
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/arc/arc_1_4_4.png",
+            "alt": "Arc Sata Portmap",
+            "caption": "Arc Sata Portmap (použite odporúčanú možnosť)"
+          },
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/arc/arc_1_4_5.png",
+            "alt": "Výber Arc Addons",
+            "caption": "Výber Arc Addons"
+          }
+        ],
+        "rr": [
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/rr/rr_2_4_1.png",
+            "alt": "Doplnok RR – krok 1",
+            "caption": "Doplnok RR – krok 1"
+          },
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/rr/rr_2_4_2.png",
+            "alt": "Doplnok RR – krok 2",
+            "caption": "Doplnok RR – krok 2: kliknutím pridajte doplnky."
+          },
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/rr/rr_2_4_3.png",
+            "alt": "Doplnok RR – krok 3",
+            "caption": "Doplnok RR – krok 3: kliknite na požadovaný doplnok. Ak chcete pridať ďalšie, zopakujte postup z obrázkov 2.4.2 a 2.4.3."
+          }
+        ],
+        "tinycore": [
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/tinycore/tinycore_3_4_1.png",
+            "alt": "Nastavenie TinyCore SN",
+            "caption": "Nastavenie TinyCore SN"
+          },
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/tinycore/tinycore_3_4_2.png",
+            "alt": "TinyCore Náhodná voľba",
+            "caption": "TinyCore Náhodná voľba - Odporúča sa náhodná voľba"
+          },
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/tinycore/tinycore_3_4_3.png",
+            "alt": "Nastavenie TinyCore MAC",
+            "caption": "Nastavenie TinyCore MAC"
+          },
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/tinycore/tinycore_3_4_4.png",
+            "alt": "TinyCore VM MAC",
+            "caption": "TinyCore VM MAC - Vyberte si používať MAC VM alebo náhodnú"
+          }
+        ]
+      }
+    },
+    {
+      "id": "step5",
+      "title": "Zostavte zavádzač",
+      "intro": "Po výbere modelu, verzie DSM a doplnkov zostavte zavádzač. Podľa zavádzača a nastavení to môže trvať niekoľko minút. Začnite výberom možnosti „Build the Loader“.",
+      "loaders": {
+        "arc": [
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/arc/arc_1_5_1.png",
+            "alt": "Zostavenie zavádzača v Arc",
+            "caption": "Zostavenie zavádzača v Arc"
+          }
+        ],
+        "rr": [
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/rr/rr_2_5_1.png",
+            "alt": "Zostavenie zavádzača v RR",
+            "caption": "Zostavenie zavádzača v RR"
+          }
+        ],
+        "tinycore": [
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/tinycore/tinycore_3_5_1.png",
+            "alt": "Zostavenie zavádzača v TinyCore",
+            "caption": "Zostavenie zavádzača v TinyCore"
+          }
+        ]
+      }
+    },
+    {
+      "id": "step6",
+      "title": "Spustite zavádzač",
+      "intro": "Po zostavení vás zavádzač vyzve na spustenie. VM sa reštartuje s vytvorenou konfiguráciou a začne inštaláciu DSM.",
+      "loaders": {
+        "arc": [
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/arc/arc_1_6_1.png",
+            "alt": "Spustenie zavádzača v Arc",
+            "caption": "Spustenie zavádzača v Arc"
+          }
+        ],
+        "rr": [
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/rr/rr_2_6_1.png",
+            "alt": "Spustenie zavádzača v RR",
+            "caption": "Spustenie zavádzača v RR"
+          }
+        ],
+        "tinycore": [
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/tinycore/tinycore_3_6_1.png",
+            "alt": "Spustenie zavádzača v TinyCore",
+            "caption": "Spustenie zavádzača v TinyCore"
+          }
+        ]
+      }
+    }
+  ],
+  "dsmInstall": {
+    "heading": "Spustenie inštalácie DSM",
+    "intro": "Po spustení zavádzača môžete svoje zariadenie Synology nájsť pomocou:",
+    "afterCode": "Dokončite inštaláciu DSM podľa pokynov na obrazovke.",
+    "setupAlt": "Nastavenie DSM",
+    "setupCaption": "Obrazovka nastavenia DSM",
+    "patience": "Buďte trpezliví; proces môže trvať niekoľko minút. Percento priebehu sa počas inštalácie automaticky aktualizuje. Keď sa inštalácia blíži ku koncu, spustí sa odpočítavanie.",
+    "finishAlt": "Inštalácia dokončená",
+    "finishCaption": "Inštalácia dokončená"
+  },
+  "tips": {
+    "heading": "Tipy",
+    "introItem": "Dostupné možnosti sa môžu meniť podľa verzie zavádzača a aktualizácií vývojára. Pri problémoch počas vytvárania zavádzača si pozrite jeho dokumentáciu:",
+    "docLinks": [
+      {
+        "label": "Arc dokumentácia",
+        "url": "https://github.com/AuxXxilium/arc"
+      },
+      {
+        "label": "Dokumentácia RR",
+        "url": "https://github.com/RROrg/rr"
+      },
+      {
+        "label": "Dokumentácia TinyCore",
+        "url": "https://github.com/PeterSuh-Q3/tinycore-redpill"
+      }
+    ],
+    "olderModels": "Niektoré staršie modely DSM môžu mať problémy s rozpoznaním diskov alebo sieťovej karty. Odporúča sa používať novšie modely.",
+    "updateLabel": "Aktualizácia:",
+    "updateBody": "Niektoré zavádzače umožňujú aktualizáciu priamo z menu.",
+    "importantLabel": "Dôležité:",
+    "importantBody": "ProxMenux neposkytuje podporu pre jednotlivé zavádzače."
+  }
+}
diff --git a/web/messages/sk/docs/create-vm/system-linux.json b/web/messages/sk/docs/create-vm/system-linux.json
new file mode 100644
index 00000000..142ee856
--- /dev/null
+++ b/web/messages/sk/docs/create-vm/system-linux.json
@@ -0,0 +1,292 @@
+{
+  "meta": {
+    "title": "Vytvoriť VM: systém Linux | Dokumentácia ProxMenux",
+    "description": "Vytvárajte virtuálne stroje Linux na Proxmox VE pomocou ProxMenux. Návod opisuje vybraný katalóg oficiálnych ISO (Ubuntu, Debian, Fedora, Arch, Rocky, Mint, openSUSE, Alpine, Kali, Manjaro), spoločný plán úložiska, voliteľný GPU passthrough a tipy po inštalácii.",
+    "ogTitle": "Vytvoriť VM: systém Linux | Dokumentácia ProxMenux",
+    "ogDescription": "Vytvárajte VM Linux na Proxmox VE: katalóg oficiálnych ISO, úložisko, GPU passthrough a tipy po inštalácii.",
+    "ogImageAlt": "Ponuka virtuálnych strojov Linux v ProxMenuxe"
+  },
+  "header": {
+    "title": "Vytvoriť VM: systém Linux",
+    "description": "Vytvorte VM Linux na Proxmox VE. ProxMenux ponúka vybraný katalóg oficiálnych ISO Linuxu na stiahnutie aj výber lokálneho ISO. Všetky možnosti používajú spoločného sprievodcu VM, plán úložiska a voliteľného sprievodcu GPU passthrough.",
+    "section": "Virtuálne stroje"
+  },
+  "intro": {
+    "title": "Čo tento skript robí",
+    "body": "Vyberiete oficiálne ISO Linuxu na automatické stiahnutie alebo už nahrané lokálne ISO. Spoločný sprievodca potom nastaví CPU, RAM a BIOS, plán úložiska, voliteľný GPU passthrough a vytvorí VM."
+  },
+  "image": {
+    "alt": "Možnosti inštalácie ProxMenux Linux",
+    "caption": "Možnosti inštalácie Linuxu"
+  },
+  "config": {
+    "heading": "Štandardná vs Rozšírená konfigurácia",
+    "intro": "Po zvolení ISO sa ProxMenux pýta, či použiť štandardný VM profil alebo otvoriť pokročilého sprievodcu.",
+    "defaultHeading": "Štandardná konfigurácia",
+    "headerParam": "Parameter",
+    "headerValue": "Štandardná hodnota",
+    "defaultRows": [
+      {
+        "param": "Typ stroja",
+        "valueRich": "<code>q35</code>"
+      },
+      {
+        "param": "BIOS",
+        "value": "OVMF (UEFI)"
+      },
+      {
+        "param": "Typ CPU",
+        "value": "Host"
+      },
+      {
+        "param": "Jadrá",
+        "value": "2"
+      },
+      {
+        "param": "RAM",
+        "value": "4096 MB"
+      },
+      {
+        "param": "Most",
+        "valueRich": "<code>vmbr0</code>"
+      },
+      {
+        "param": "Adresa MAC",
+        "value": "Automatické generovanie"
+      },
+      {
+        "param": "Spustiť po dokončení",
+        "value": "Nie"
+      }
+    ],
+    "advancedHeading": "Pokročilá konfigurácia",
+    "advancedIntro": "Pokročilý sprievodca odhaľuje každý parameter samostatne:",
+    "headerOptions": "Možnosti",
+    "advancedRows": [
+      {
+        "param": "Typ stroja",
+        "optionsRich": "<code>q35</code> alebo <code>i440fx</code>"
+      },
+      {
+        "param": "BIOS",
+        "options": "OVMF (UEFI) alebo SeaBIOS (staršie)"
+      },
+      {
+        "param": "Typ CPU",
+        "options": "Host, KVM64 a ďalšie modely CPU zo zoznamu"
+      },
+      {
+        "param": "Jadro",
+        "options": "Počet jadier CPU"
+      },
+      {
+        "param": "RAM",
+        "options": "Pamäť pridelená VM"
+      },
+      {
+        "param": "Most",
+        "options": "Sieťový most"
+      },
+      {
+        "param": "Adresa MAC",
+        "options": "Vlastná MAC adresa"
+      },
+      {
+        "param": "VLAN",
+        "options": "Značka VLAN (voliteľné)"
+      },
+      {
+        "param": "MTU",
+        "options": "Veľkosť MTU"
+      }
+    ]
+  },
+  "storagePlan": {
+    "heading": "Plán úložiska",
+    "body": "Po nastavení CPU a RAM otvorí ProxMenux menu <strong>Plán úložiska</strong>. V jednej VM môžete kombinovať virtuálne disky, importované disky a zariadenia PCI passthrough, pridávať ich po jednom a po dokončení pokračovať.",
+    "virtualDiskTitle": "a. Pridať virtuálny disk",
+    "virtualDiskItems": [
+      "Zobrazí úložiská Proxmox dostupné na hostiteľovi.",
+      "Vyberiete cieľové úložisko a veľkosť v GB.",
+      "Disk používa zvolenú zbernicu: SCSI (predvolená), SATA, VirtIO alebo IDE. SATA má šesť pozícií s číslami 0 až 5: <code>sata0</code>, <code>sata1</code>, …."
+    ],
+    "importDiskTitle": "b. Pridať importný disk",
+    "importDiskItems": [
+      "Detekuje fyzické disky, ktoré sú bezpečné pre import (systém a chránené disky sú skryté).",
+      "Vyberte jeden alebo viac diskov prostredníctvom kontrolného zoznamu.",
+      "Importované disky používajú zvolenú zbernicu a pripoja sa cez <code>qm set</code>."
+    ],
+    "pciTitle": "c. Pridať radič alebo NVMe (PCI passthrough)",
+    "pciItems": [
+      "Rozpozná HBA SATA/SAS a zariadenia NVMe a umožní priradiť VM <em>celý radič</em>. IOMMU musí byť zapnuté; skript ponúkne aktiváciu a podľa potreby reštart.",
+      "Potvrdenie upozorní na riziko pre celý radič: celá karta vrátane všetkých pripojených diskov prestane byť dostupná hostiteľovi.",
+      "Zariadenia PCI sa priradia príkazmi ako <code>qm set VMID --hostpci0 PCI_ADDRESS,pcie=1</code>. VMID a PCI_ADDRESS nahraďte ID virtuálneho stroja a adresou PCI a pre každé zariadenie použite voľný index hostpci."
+    ],
+    "resetTitle": "Resetovať a dokončiť",
+    "resetBody": "Menu tiež ponúka <strong>r</strong> (resetovať aktuálny výber a začať znova) a <strong>d</strong> (dokončiť a pokračovať). Nemôžeš dokončiť prázdny plán."
+  },
+  "gpu": {
+    "heading": "Voliteľný priechod GPU",
+    "body": "Ak sa po pláne úložiska nájde kompatibilná GPU, ProxMenux ponúkne sprievodcu GPU passthrough. Pozrite <gpuLink>Pridať GPU do VM (passthrough)</gpuLink>. Môže byť potrebný reštart hostiteľa."
+  },
+  "autoFeatures": {
+    "heading": "Automatické funkcie VM",
+    "efiTitle": "disk EFI",
+    "efiBody": "Pri výbere OVMF (UEFI) vytvorí ProxMenux na zvolenom úložisku 4 MB disk EFI na uloženie premenných firmvéru.",
+    "isoTitle": "Pripojenie ISO",
+    "isoBody": "ISO Linuxu sa pripojí k <code>ide2</code> ako CD-ROM, pripravené na prvé spustenie.",
+    "guestTitle": "Hosťovský agent QEMU",
+    "guestBody": "Kanál hosťovského agenta je zapnutý v konfigurácii VM. Samotného agenta ešte musíte nainštalovať v hosťovskom systéme; pozrite tipy nižšie."
+  },
+  "installOptions": {
+    "heading": "Možnosti inštalácie Linuxu",
+    "officialHeading": "Oficiálna ISO (tradičná inštalácia)",
+    "officialBody": "ProxMenux obsahuje vybraný zoznam oficiálnych ISO Linuxu. Vyberte jedno a skript ho stiahne zo zrkadlového servera distribúcie do <code>/var/lib/vz/template/iso</code>, potom ho pripojí k VM.",
+    "officialImageAlt": "Výber distribúcie Linuxu",
+    "officialImageCaption": "Výber distribúcie Linuxu",
+    "localHeading": "Miestne ISO",
+    "localBody": "Použije ISO Linuxu, ktoré už je v <code>/var/lib/vz/template/iso</code>. Skript zobrazí všetky nájdené súbory <code>*.iso</code> a umožní jeden vybrať.",
+    "localImageAlt": "Lokálne menu výberu ISO",
+    "localImageCaption": "Lokálne menu výberu ISO",
+    "distros": [
+      {
+        "name": "Ubuntu",
+        "variants": [
+          "25.10 Desktop",
+          "24.04 Desktop",
+          "22.04 Desktop",
+          "20.04 Desktop",
+          "25.10 Server",
+          "24.04 Server",
+          "22.04 Server",
+          "20.04 Server"
+        ]
+      },
+      {
+        "name": "Debian",
+        "variants": [
+          "13 Desktop",
+          "12 Desktop",
+          "11 Desktop",
+          "13 Netinst",
+          "12 Netinst",
+          "11 Netinst"
+        ]
+      },
+      {
+        "name": "Fedora",
+        "variants": [
+          "Workstation 42"
+        ]
+      },
+      {
+        "name": "Arch Linux",
+        "variants": [
+          "najnovší"
+        ]
+      },
+      {
+        "name": "Rocky Linux",
+        "variants": [
+          "9"
+        ]
+      },
+      {
+        "name": "Linux Mint",
+        "variants": [
+          "22.1 Cinnamon"
+        ]
+      },
+      {
+        "name": "openSUSE",
+        "variants": [
+          "Leap 15.6"
+        ]
+      },
+      {
+        "name": "Alpine Linux",
+        "variants": [
+          "3.21"
+        ]
+      },
+      {
+        "name": "Kali Linux",
+        "variants": [
+          "2026.1"
+        ]
+      },
+      {
+        "name": "Manjaro",
+        "variants": [
+          "25.0 GNOME"
+        ]
+      }
+    ]
+  },
+  "endToEnd": {
+    "heading": "Čo skript vykoná od začiatku do konca",
+    "items": [
+      "Získa ISO Linuxu oficiálnym stiahnutím alebo z lokálneho súboru.",
+      "Uplatňuje štandardnú alebo pokročilú konfiguráciu typu CPU / RAM / BIOS / typ stroja.",
+      "Otvorí plán úložiska a pripojí vybrané virtuálne disky, importované disky a PCI zariadenia.",
+      "Vytvorí disk EFI pri výbere UEFI.",
+      "Namontuje Linux ISO na <code>ide2</code>.",
+      "Nastaví poradie spúšťania: najprv disk, potom ISO.",
+      "Zapne kanál hosťovského agenta QEMU.",
+      "Voliteľne spustí sprievodcu GPU passthrough.",
+      "Generuje štýlový HTML popis pripojený k VM.",
+      "Spustí VM, ak ste to zvolili."
+    ]
+  },
+  "postInstall": {
+    "heading": "Tipy po inštalácii",
+    "guestAgentHeading": "Nainštalujte hosťovského agenta QEMU vo VM",
+    "guestAgentBody": "ProxMenux zapne kanál agenta v konfigurácii VM, ale samotného agenta treba nainštalovať v hosťovskom systéme. Podporuje riadené vypnutie a zmrazenie súborových systémov počas zálohovania na zlepšenie konzistentnosti údajov.",
+    "debian": "Debian / Ubuntu",
+    "fedora": "Fedora / Rocky / RHEL",
+    "arch": "Arch Linux",
+    "opensuse": "openSUSE",
+    "virtioHeading": "Podpora VirtIO v Linuxe",
+    "virtioBody": "Moderné distribúcie Linuxu zvyčajne obsahujú ovládače VirtIO pre disky a sieť. Zvoľte <code>virtio</code> pre blokové disky VirtIO alebo <code>scsi</code> s nastaveným radičom VirtIO SCSI; sieťový adaptér tiež používa <code>virtio</code>. Pri starších inštalátoroch overte podporu ovládačov.",
+    "virtioWarnTitle": "Veľmi staré distribúcie",
+    "virtioWarnBody": "Veľmi staré inštalátory nemusia obsahovať potrebné ovládače VirtIO. Použite emulovaný radič SATA / SCSI alebo dodajte vhodné ovládače.",
+    "trimHeading": "Zapnúť TRIM / discard na úložisku SSD",
+    "trimBody": "Ak VM používa úložisko Proxmox na SSD a disk bol pripojený s príznakom <code>discard</code>, môžete posielať príkazy TRIM z hosťovského systému. Dve možnosti:",
+    "trimItems": [
+      "Pravidelne spúšťajte <code>fstrim -av</code> alebo zapnite jednotku <code>fstrim.timer</code> v distribúciách so systemd.",
+      "Alebo pripojiť súborové systémy s možnosťou <code>discard</code> v <code>/etc/fstab</code>."
+    ],
+    "balloonHeading": "Balónovanie pamäte",
+    "balloonBody": "Moderné jadrá Linuxu zvyčajne obsahujú ovládač <code>virtio_balloon</code>. So zapnutým zariadením balloon môže Proxmox získavať štatistiky pamäte. Dynamické uvoľňovanie vyžaduje aj minimum pamäte nižšie než nastavené maximum; pri rovnakých hodnotách zostáva pridelenie pevné."
+  },
+  "related": {
+    "heading": "Súvisiace",
+    "items": [
+      {
+        "href": "/docs/disk-manager/import-disk-image-vm",
+        "label": "Importovať obraz disku do VM",
+        "tail": " — pripojiť existujúci obraz Linuxu .qcow2 / .img / .raw k novej VM."
+      },
+      {
+        "href": "/docs/utils/import-vm",
+        "label": "Importovať VM z OVA / OVF",
+        "tail": " — importovať VM Linux exportovanú z VMware / VirtualBox / Proxmox."
+      },
+      {
+        "href": "/docs/hardware/gpu-vm-passthrough",
+        "label": "Pridať GPU do VM (passthrough)",
+        "tail": " — Pre VMs Linux, ktoré potrebujú zrýchlenie GPU."
+      },
+      {
+        "href": "/docs/help-info/vm-ct-commands",
+        "label": "Príkazy na správu VM a CT",
+        "tail": " — Referencia qm CLI."
+      },
+      {
+        "href": "/docs/create-vm",
+        "label": "Prehľad vytvárania VM",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sk/docs/create-vm/system-nas/index.json b/web/messages/sk/docs/create-vm/system-nas/index.json
new file mode 100644
index 00000000..a0c16bd1
--- /dev/null
+++ b/web/messages/sk/docs/create-vm/system-nas/index.json
@@ -0,0 +1,147 @@
+{
+  "meta": {
+    "title": "Vytvoriť VM: systém NAS | Dokumentácia ProxMenux",
+    "description": "Vytvárajte VM NAS v Proxmox VE pomocou ProxMenux: Synology DSM so zavádzačom, TrueNAS SCALE/CORE, OpenMediaVault, XigmaNAS, Rockstor, ZimaOS a FygoOS. Umbrel OS je dostupný cez komunitný skript.",
+    "ogTitle": "Vytvoriť VM: systém NAS | Dokumentácia ProxMenux",
+    "ogDescription": "Vytvárajte VM NAS v Proxmox VE pomocou ProxMenux: Synology DSM so zavádzačom, TrueNAS SCALE/CORE, OpenMediaVault, XigmaNAS, Rockstor, ZimaOS a FygoOS.",
+    "ogImageAlt": "ProxMenux Menu systému NAS"
+  },
+  "header": {
+    "title": "Vytvoriť VM: Systém NAS",
+    "description": "ProxMenux podporuje osem systémov NAS ako samostatné VM a voliteľnú inštaláciu Umbrel OS cez komunitný skript. Väčšina zdieľa automatický postup ISO; Synology DSM používa špecializovaného sprievodcu zavádzačom.",
+    "section": "Virtuálne stroje"
+  },
+  "intro": {
+    "title": "Ako funguje výber systému NAS",
+    "body": "Pri všeobecnom postupe ISO sa výber NAS pokúsi zistiť najnovšie stabilné vydanie na zrkadle projektu, podľa potreby použije náhradnú verziu, stiahne ISO a otvorí spoločné nastavenia CPU, RAM, diskov a siete. Synology DSM a ZimaOS majú samostatné inštalátory."
+  },
+  "image": {
+    "alt": "ProxMenux Systémový volič NAS",
+    "caption": "Systémový volič NAS"
+  },
+  "flowBadges": {
+    "loader": "Postup so zavádzačom",
+    "auto-iso": "Tok auto-ISO",
+    "dedicated": "Vyhradený skript"
+  },
+  "labels": {
+    "base": "Základ",
+    "fileSystem": "Súborový systém",
+    "viewDetails": "Zobraziť detaily"
+  },
+  "supported": {
+    "heading": "Podporované systémy NAS",
+    "cards": [
+      {
+        "name": "Synology DSM",
+        "tagline": "DiskStation Manager so zavádzačom ARC/RR. Pred prvým spustením treba nakonfigurovať zavádzač.",
+        "icon": "HardDrive",
+        "base": "Linux (vlastné)",
+        "fileSystem": "Btrfs, ext4",
+        "href": "/docs/create-vm/system-nas/synology",
+        "flow": "loader"
+      },
+      {
+        "name": "TrueNAS SCALE",
+        "tagline": "TrueNAS založený na Debiane s aplikáciami Docker v súčasných vydaniach a ZFS ako hlavným súborovým systémom. Staršie vydania SCALE používali Kubernetes.",
+        "icon": "Database",
+        "base": "Debian Linux",
+        "fileSystem": "ZFS",
+        "href": "/docs/create-vm/system-nas/system-nas-others#truenas-scale",
+        "flow": "auto-iso"
+      },
+      {
+        "name": "TrueNAS CORE",
+        "tagline": "TrueNAS založený na FreeBSD so zameraním na úložisko ZFS. Jails a pluginy v CORE 13.3 sú zastarané a bez podpory.",
+        "icon": "Database",
+        "base": "FreeBSD",
+        "fileSystem": "ZFS",
+        "href": "/docs/create-vm/system-nas/system-nas-others#truenas-core",
+        "flow": "auto-iso"
+      },
+      {
+        "name": "OpenMediaVault",
+        "tagline": "Ľahká NAS na báze Debianu s modulárnou architektúrou pluginu. Skvelé pre starší hardvér.",
+        "icon": "Server",
+        "base": "Debian Linux",
+        "fileSystem": "ext4, XFS, Btrfs",
+        "href": "/docs/create-vm/system-nas/system-nas-others#openmediavault",
+        "flow": "auto-iso"
+      },
+      {
+        "name": "XigmaNAS",
+        "tagline": "NAS založený na FreeBSD, pôvodný nástupca FreeNAS so zameraním na ZFS a jednoduchosť.",
+        "icon": "Database",
+        "base": "FreeBSD",
+        "fileSystem": "ZFS, UFS",
+        "href": "/docs/create-vm/system-nas/system-nas-others#xigmanas",
+        "flow": "auto-iso"
+      },
+      {
+        "name": "Rockstor",
+        "tagline": "NAS na báze openSUSE postavený okolo Btrfs. Rock-ons (Docker) rozširuje funkčnosť.",
+        "icon": "HardDrive",
+        "base": "openSUSE Leap",
+        "fileSystem": "Btrfs",
+        "href": "/docs/create-vm/system-nas/system-nas-others#rockstor",
+        "flow": "auto-iso"
+      },
+      {
+        "name": "ZimaOS",
+        "tagline": "Ľahké NAS OS zamerané na médiá, aplikácie Docker a domáce automatizácie. Používa svoj vlastný inštalátor.",
+        "icon": "MonitorIcon",
+        "base": "Buildroot (vznikol z CasaOS)",
+        "fileSystem": "ext4",
+        "href": "/docs/create-vm/system-nas/system-nas-others#zimaos",
+        "flow": "dedicated"
+      },
+      {
+        "name": "FygoOS",
+        "tagline": "Medzinárodná edícia fnOS: NAS založený na Debiane s úložnými zväzkami, aplikáciami a streamovaním médií, spravovaný cez webové rozhranie a aplikácie Fygo.",
+        "icon": "Server",
+        "base": "Debian Linux",
+        "fileSystem": "Btrfs, ext4",
+        "href": "/docs/create-vm/system-nas/system-nas-others#fygoos",
+        "flow": "auto-iso"
+      }
+    ]
+  },
+  "umbrel": {
+    "title": "Komunitná možnosť: Umbrel OS",
+    "bodyRich": "Deviata položka v ponuke NAS je <strong>Umbrel OS</strong>. Spúšťa <umbrelLink>inštalátor komunitných skriptov</umbrelLink> udržiavaný mimo ProxMenux, takže tu nie je zdokumentovaný. Inštalačný program spracuje celý životný cyklus a na konci vytlačí svoje predvolené poverenia."
+  },
+  "zfsMem": {
+    "title": "Pravidlo pamäte ZFS",
+    "bodyRich": "Pre základnú prevádzku TrueNAS prideľte aspoň <strong>8 GB RAM</strong>, pri náročnej záťaži viac. ZFS využíva RAM pre cache ARC, no pre všetky NAS so ZFS neplatí univerzálny výkonnostný prah 8 GB. Overte požiadavky distribúcie a pamäť dimenzujte podľa diskov, služieb a aplikácií; ľahké zostavy OMV alebo Rockstor môžu potrebovať menej."
+  },
+  "related": {
+    "heading": "Súvisiace",
+    "items": [
+      {
+        "href": "/docs/create-vm/system-nas/synology",
+        "label": "VM Synology",
+        "tail": " — samostatný inštalátor Synology DSM (Xpenology) na Proxmox."
+      },
+      {
+        "href": "/docs/create-vm/system-nas/system-nas-others",
+        "label": "Iné systémy NAS",
+        "tail": " — TrueNAS, OpenMediaVault, Rockstor, XigmaNAS, FygoOS a podobne."
+      },
+      {
+        "href": "/docs/disk-manager/import-disk-vm",
+        "label": "Importovať disk do VM",
+        "tail": " — pripojiť fyzické disky k VM NAS; pre produkciu sa uprednostňujú pred virtuálnymi diskami."
+      },
+      {
+        "href": "/docs/help-info/zfs-commands",
+        "label": "Príkazy na správu ZFS",
+        "tail": " — užitočné, ak distribúcia NAS používa ZFS."
+      },
+      {
+        "href": "/docs/create-vm",
+        "label": "Prehľad vytvárania VM",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sk/docs/create-vm/system-nas/synology.json b/web/messages/sk/docs/create-vm/system-nas/synology.json
new file mode 100644
index 00000000..89fed110
--- /dev/null
+++ b/web/messages/sk/docs/create-vm/system-nas/synology.json
@@ -0,0 +1,400 @@
+{
+  "meta": {
+    "title": "Vytvoriť VM: Synology DSM | Dokumentácia ProxMenux",
+    "description": "Vytvorte VM Synology DSM na Proxmox VE. ProxMenux stiahne zvolený zavádzač (Arc, RR, Alpine RedPill M-shell alebo vlastný obraz), importuje ho ako spúšťací disk VM a nastaví CPU, RAM a úložisko pomocou predvoleného alebo pokročilého sprievodcu.",
+    "ogTitle": "Vytvoriť VM: Synology DSM | Dokumentácia ProxMenux",
+    "ogDescription": "Vytvorte virtuálny stroj Synology DSM na Proxmox VE pomocou ProxMenux."
+  },
+  "header": {
+    "title": "Vytvoriť VM: Synology DSM",
+    "description": "Vytvorte VM Synology DSM na Proxmox VE. ProxMenux stiahne zvolený zavádzač (Arc, RR, Alpine RedPill M-shell alebo vlastný obraz), importuje ho ako spúšťací disk VM a nastaví CPU, RAM a úložisko pomocou predvoleného alebo pokročilého sprievodcu.",
+    "section": "Virtuálne stroje · NAS"
+  },
+  "loaderLabels": {
+    "arc": "Arc Loader",
+    "rr": "RR Loader",
+    "tinycore": "TinyCore Loader"
+  },
+  "whatThisDoes": {
+    "title": "Čo to robí?",
+    "bodyRich": "ProxMenux automatizuje prípravu VM pre Synology DSM: stiahne podporovaný zavádzač, importuje ho ako spúšťací disk IDE a použije zvolené nastavenia CPU, RAM, siete a úložiska. Zostavenie zavádzača, výber modelu a inštalácia DSM prebiehajú <strong>vo VM</strong> cez webové alebo terminálové rozhranie zavádzača. Tieto kroky udržiava komunita a často sa menia; stránka poskytuje východiskový postup."
+  },
+  "supportedLoaders": {
+    "heading": "Podporované zavádzače",
+    "intro": "Skript ponúka štyri zdroje zavádzača:",
+    "loaders": [
+      {
+        "name": "AuxXxilium Arc",
+        "url": "https://github.com/AuxXxilium/arc"
+      },
+      {
+        "name": "RedPill RR",
+        "url": "https://github.com/RROrg/rr"
+      },
+      {
+        "name": "Alpine RedPill M-shell (projekt TinyCore)",
+        "url": "https://github.com/PeterSuh-Q3/tinycore-redpill"
+      }
+    ],
+    "customRich": "<strong>Vlastný zavádzač</strong> — uložte vlastný obraz zavádzača do <code>/var/lib/vz/template/iso</code> a skript ho nájde."
+  },
+  "config": {
+    "heading": "Štandardná vs Rozšírená konfigurácia",
+    "intro": "Pri spustení skriptu sa pýta, či použijete predvolený ProxMenux profil VM alebo otvoríte pokročilého sprievodcu. Štandardné hodnoty sú ladené pre DSM a pracujú pre väčšinu inštalácií.",
+    "defaultHeading": "Štandardná konfigurácia",
+    "headerParam": "Parameter",
+    "headerValue": "Štandardná hodnota",
+    "defaultRowsRich": [
+      {
+        "param": "Typ stroja",
+        "valueRich": "<code>q35</code>"
+      },
+      {
+        "param": "BIOS",
+        "valueRich": "OVMF (UEFI)"
+      },
+      {
+        "param": "Typ CPU",
+        "valueRich": "Host"
+      },
+      {
+        "param": "Jadrá",
+        "valueRich": "2"
+      },
+      {
+        "param": "RAM",
+        "valueRich": "4096 MB"
+      },
+      {
+        "param": "Most",
+        "valueRich": "<code>vmbr0</code>"
+      },
+      {
+        "param": "Adresa MAC",
+        "valueRich": "Automatické generovanie"
+      },
+      {
+        "param": "Spustiť po dokončení",
+        "valueRich": "Nie"
+      }
+    ],
+    "advancedHeading": "Pokročilá konfigurácia",
+    "advancedIntro": "Pokročilý sprievodca ponúkne každé nastavenie samostatne. Môžete zmeniť tieto hodnoty:",
+    "headerOptions": "Možnosti",
+    "advancedRowsRich": [
+      {
+        "param": "Typ stroja",
+        "optionsRich": "<code>q35</code> alebo <code>i440fx</code>"
+      },
+      {
+        "param": "BIOS",
+        "optionsRich": "OVMF (UEFI) alebo SeaBIOS (staršie)"
+      },
+      {
+        "param": "Typ CPU",
+        "optionsRich": "Host alebo KVM64"
+      },
+      {
+        "param": "Jadrá",
+        "optionsRich": "Počet jadier CPU"
+      },
+      {
+        "param": "RAM",
+        "optionsRich": "Pamäť pridelená VM"
+      },
+      {
+        "param": "Most",
+        "optionsRich": "Sieťový most"
+      },
+      {
+        "param": "Adresa MAC",
+        "optionsRich": "Vlastná MAC adresa"
+      },
+      {
+        "param": "VLAN",
+        "optionsRich": "Značka VLAN (voliteľné)"
+      },
+      {
+        "param": "MTU",
+        "optionsRich": "Veľkosť MTU"
+      }
+    ]
+  },
+  "storagePlan": {
+    "heading": "Plán úložiska",
+    "introRich": "Po nastavení CPU a RAM otvorí ProxMenux menu <strong>Plán úložiska</strong>. V jednej VM môžete <strong>kombinovať</strong> virtuálne disky, importované disky a zariadenia PCI passthrough. Pridávajte položky po jednej a po dokončení pokračujte.",
+    "virtualHeading": "a. Pridať virtuálny disk",
+    "virtualItemsRich": [
+      "Zobrazí úložiská Proxmox dostupné na hostiteľovi.",
+      "Vyberiete cieľové úložisko a veľkosť v GB.",
+      "Disk sa pripojí ako SATA (<code>sata0</code>, <code>sata1</code>, …). Virtuálne a fyzické dátové disky zdieľajú šesť pozícií SATA s číslami 0 až 5."
+    ],
+    "importHeading": "b. Pridať importný disk",
+    "importItemsRich": [
+      "Detekuje fyzické disky, ktoré sú bezpečné pre import (systém a chránené disky sú skryté).",
+      "Vyberte jeden alebo viac diskov prostredníctvom kontrolného zoznamu.",
+      "Importované disky sú pripojené ako SATA cez <code>qm set</code>."
+    ],
+    "pciHeading": "c. Pridať radič alebo NVMe (PCI passthrough)",
+    "pciItemsRich": [
+      "Rozpozná HBA SATA/SAS a zariadenia NVMe a umožní priradiť VM <em>celý radič</em>. IOMMU musí byť zapnuté; skript ponúkne aktiváciu a podľa potreby reštart.",
+      "Potvrdenie upozorní na riziko pre celý radič: celá karta vrátane všetkých pripojených diskov prestane byť dostupná hostiteľovi.",
+      "Zariadenia PCI sa priradia príkazmi ako <code>qm set VMID --hostpci0 PCI_ADDRESS,pcie=1</code>. VMID a PCI_ADDRESS nahraďte ID virtuálneho stroja a adresou PCI a pre každé zariadenie použite voľný index hostpci."
+    ],
+    "resetCalloutTitle": "Resetovať a dokončiť",
+    "resetCalloutBodyRich": "Menu ponúka <strong>r</strong> na vymazanie výberu a nový začiatok a <strong>d</strong> na dokončenie a pokračovanie. Plán nesmie byť prázdny; Synology potrebuje aspoň jeden disk na inštaláciu DSM."
+  },
+  "gpu": {
+    "heading": "Voliteľný priechod GPU",
+    "bodyRich": "Ak skript po pláne úložiska nájde kompatibilnú GPU, opýta sa na jej priradenie VM. Pozrite <link>Pridať GPU do VM (passthrough)</link>. Môže byť potrebný reštart hostiteľa."
+  },
+  "loaderInstall": {
+    "heading": "Inštalácia zavádzača",
+    "intro1Rich": "<strong>Arc</strong>, <strong>RR</strong> a <strong>Alpine RedPill M-shell</strong> sa automaticky stiahnu a rozbalia z pôvodných repozitárov GitHub. Pri chybe sťahovania sa skript zastaví s jasnou správou.",
+    "intro2Rich": "Pri možnosti <strong>Custom Loader</strong> skript prehľadá <code>/var/lib/vz/template/iso</code>. Ak nájde viac vhodných súborov, vyzve vás na výber.",
+    "uploadIntro": "Vlastné zavádzače môžete nahrať cez lokálne úložisko Proxmox.",
+    "imageAlt": "Pridať vlastný zavádzač",
+    "imageCaption": "Pridať vlastný zavádzač"
+  },
+  "vmCreation": {
+    "heading": "Vytvorenie VM – čo skript spustí",
+    "introRich": "Po potvrdení zavádzača spustí ProxMenux ekvivalent týchto príkazov <code>qm</code>:",
+    "itemsRich": [
+      "<code>qm create</code> — vytvorí VM so zvolenou CPU, RAM, BIOS a typom stroja.",
+      "<code>qm importdisk</code> importuje obraz zavádzača do úložiska Proxmox. Skript ho potom pre kompatibilitu pripojí ako disk <strong>IDE</strong> na ide0.",
+      "<code>qm set VMID --sata0 DISK_REFERENCE</code> pripojí dátový disk z plánu. VMID a DISK_REFERENCE nahraďte ID virtuálneho stroja a odkazom na disk; použite voľný index SATA od 0 do 5. Sieť nastavuje qm create.",
+      "<code>qm set VMID --hostpci0 PCI_ADDRESS,pcie=1</code> priradí zvolený radič PCI alebo zariadenie NVMe. VMID a PCI_ADDRESS nahraďte ID virtuálneho stroja a adresou PCI a pre každé zariadenie použite voľný index hostpci.",
+      "<code>qm set VMID --boot order=ide0</code> nastaví zavádzač ako spúšťacie zariadenie. VMID nahraďte ID virtuálneho stroja."
+    ]
+  },
+  "stepByStep": {
+    "heading": "Nastavenie zavádzača krok za krokom",
+    "intro": "Šesť spoločných krokov: spustiť VM, vybrať model, verziu DSM a doplnky, zostaviť a spustiť zavádzač. Menu a možnosti závisia od vydania. Snímky M-shell zobrazujú staršie rozhranie TinyCore; aktuálny skript sťahuje Alpine RedPill M-shell, preto sa riaďte jeho aktuálnymi pokynmi.",
+    "warnCalloutTitle": "Zavádzače neudržiava ProxMenux",
+    "warnCalloutBody": "Arc, RR a Alpine RedPill M-shell sú komunitné projekty s vlastným harmonogramom vydaní. Ak sa krok líši od snímok nižšie, zavádzač bol pravdepodobne aktualizovaný. Pozrite jeho dokumentáciu; odkazy sú na konci stránky."
+  },
+  "stepBadge": "Krok",
+  "step1": {
+    "title": "Spustite VM a otvorte hlavné menu",
+    "intro": "Spustite vytvorenú VM. Pri prvom spustení sa otvorí nastavenie zavádzača, kde vyberiete a zostavíte model DSM. Ďalšie spustenia tento krok preskočia, ak nevynútite nové nastavenie zo spúšťacieho menu zavádzača. Všetky tri zavádzače ponúkajú terminálové aj webové rozhranie.",
+    "arc": {
+      "webRich": "<strong>Webové rozhranie.</strong> Otvorte prehliadač a prejdite na adresu IP zobrazenú v konzole VM (v našom príklade: <code>http://192.168.0.32</code>).",
+      "webAlt": "Webové rozhranie Arc loader",
+      "webCaption": "Webové rozhranie Arc loader",
+      "termRich": "<strong>Terminálové rozhranie</strong>: otvorte ho priamo v konzole VM.",
+      "termAlt": "Terminálové rozhranie zavádzača Arc",
+      "termCaption": "Terminálové rozhranie zavádzača Arc"
+    },
+    "rr": {
+      "webRich": "<strong>Webové rozhranie.</strong> Otvorte prehliadač a zadajte IP adresu z konzoly VM s portom <strong>7681</strong> (príklad: <code>http://192.168.0.33:7681</code>).",
+      "webAlt": "Webové rozhranie RR loader",
+      "webCaption": "Webové rozhranie RR loader",
+      "termRich": "<strong>Terminálové rozhranie.</strong> Otvorte ho zadaním <code>menu.sh</code> v konzole VM.",
+      "termAlt": "Terminálové rozhranie RR Loader",
+      "termCaption": "Terminálové rozhranie RR Loader"
+    },
+    "tinycore": {
+      "webRich": "<strong>Webové rozhranie.</strong> Otvorte prehliadač a zadajte IP adresu z konzoly VM s portom <strong>7681</strong> (príklad: <code>http://192.168.0.35:7681</code>).",
+      "webAlt": "Webové rozhranie TinyCore loader",
+      "webCaption": "Webové rozhranie TinyCore loader",
+      "termRich": "<strong>Terminálové rozhranie</strong>: otvorte ho priamo v konzole VM. Sledujte obrazovku, pretože môže vyzvať na stlačenie klávesu na pokračovanie alebo na zmenu jazyka.",
+      "termAlt": "Terminálové rozhranie TinyCore Loader",
+      "termCaption": "Terminálové rozhranie TinyCore Loader"
+    }
+  },
+  "step2": {
+    "title": "Vyberte model",
+    "introRich": "Vyberte model Synology DSM, ktorý chcete nainštalovať. Podľa zavádzača možno treba rozbaliť možnosti na zobrazenie celého zoznamu. Na snímkach nižšie používame ako príklad model <strong>SA6400</strong>.",
+    "arc": {
+      "alt": "Výber modelu v Arc",
+      "caption": "Výber modelu v Arc"
+    },
+    "rr": {
+      "alt": "Výber modelu RR",
+      "caption": "Výber modelu RR"
+    },
+    "tinycore": {
+      "alt": "Výber modelu TinyCore",
+      "caption": "Výber modelu TinyCore"
+    }
+  },
+  "step3": {
+    "title": "Vyberte verziu DSM",
+    "intro": "Po vybratí modelu vyberte verziu DSM pre inštaláciu.",
+    "arc": [
+      {
+        "alt": "Výber verzie v Arc – krok 1",
+        "caption": "Výber verzie v Arc – krok 1"
+      },
+      {
+        "alt": "Výber verzie v Arc – krok 2",
+        "caption": "Výber verzie v Arc – krok 2"
+      }
+    ],
+    "rr": [
+      {
+        "alt": "Výber verzie RR - krok 1",
+        "caption": "Výber verzie RR - krok 1"
+      },
+      {
+        "alt": "Výber verzie RR - krok 2",
+        "caption": "Výber verzie RR - krok 2"
+      },
+      {
+        "alt": "Výber verzie RR - krok 3",
+        "caption": "Výber verzie RR - krok 3"
+      }
+    ],
+    "tinycore": [
+      {
+        "alt": "Výber verzie TinyCore - krok 1",
+        "caption": "Výber verzie TinyCore - krok 1"
+      },
+      {
+        "alt": "Výber verzie TinyCore - krok 2",
+        "caption": "Výber verzie TinyCore - krok 2"
+      }
+    ]
+  },
+  "step4": {
+    "title": "Vybrať doplnky",
+    "intro": "V tomto kroku môžete do zavádzača pridať ďalšie funkcie alebo vlastné nastavenia.",
+    "arc": {
+      "autoRich": "<strong>Arc</strong> ponúka odporúčaný automatický režim a ručný režim. V automatickom režime zavádzač použije vhodné predvoľby a po dokončení sa sám reštartuje.",
+      "autoAlt": "Automatické nastavenie Arc",
+      "autoCaption": "Automatické nastavenie Arc",
+      "manualRich": "V ručnom režime prejdete možnosti jednu po druhej:",
+      "manualAlt": "Ručné nastavenie Arc",
+      "manualCaption": "Ručné nastavenie Arc",
+      "snMacAlt": "Arc SN/MAC",
+      "snMacCaption": "Arc SN / MAC konfigurácia",
+      "portmapAlt": "Arc SATA portmap",
+      "portmapCaption": "Arc SATA portmap (použite odporúčanú voľbu)",
+      "addonsAlt": "Doplnky Arc",
+      "addonsCaption": "Výber doplnkov v Arc"
+    },
+    "rr": [
+      {
+        "alt": "Doplnok RR – krok 1",
+        "caption": "Doplnok RR – krok 1"
+      },
+      {
+        "alt": "Doplnok RR – krok 2",
+        "caption": "Doplnok RR – krok 2: kliknutím pridajte doplnok."
+      },
+      {
+        "alt": "Doplnok RR – krok 3",
+        "caption": "Doplnok RR – krok 3: kliknite na požadovaný doplnok. Ak chcete pridať ďalšie, zopakujte postup z predchádzajúcich dvoch snímok."
+      }
+    ],
+    "tinycore": [
+      {
+        "alt": "Konfigurácia TinyCore SN",
+        "caption": "Konfigurácia TinyCore SN"
+      },
+      {
+        "alt": "Náhodná voľba TinyCore",
+        "caption": "TinyCore náhodná voľba (odporúčaná)"
+      },
+      {
+        "alt": "Konfigurácia TinyCore MAC",
+        "caption": "Konfigurácia TinyCore MAC"
+      },
+      {
+        "alt": "TinyCore VM MAC",
+        "caption": "TinyCore – vyberte MAC adresu VM alebo náhodnú adresu."
+      }
+    ]
+  },
+  "step5": {
+    "title": "Zostavte zavádzač",
+    "introRich": "Po výbere modelu, verzie DSM a doplnkov zvoľte <strong>Build the Loader</strong>. Podľa zavádzača a zvolených možností to môže trvať niekoľko minút.",
+    "arc": {
+      "alt": "Zostavenie zavádzača v Arc",
+      "caption": "Zostavenie zavádzača v Arc"
+    },
+    "rr": {
+      "alt": "Zostavenie zavádzača v RR",
+      "caption": "Zostavenie zavádzača v RR"
+    },
+    "tinycore": {
+      "alt": "Zostavenie zavádzača v TinyCore",
+      "caption": "Zostavenie zavádzača v TinyCore"
+    }
+  },
+  "step6": {
+    "title": "Spustite zavádzač",
+    "intro": "Po zostavení zavádzača sa VM reštartuje s vytvorenou konfiguráciou a začne inštaláciu DSM.",
+    "arc": {
+      "alt": "Spustenie zavádzača v Arc",
+      "caption": "Spustenie zavádzača v Arc"
+    },
+    "rr": {
+      "alt": "Spustenie zavádzača v RR",
+      "caption": "Spustenie zavádzača v RR"
+    },
+    "tinycore": {
+      "alt": "Spustenie zavádzača v TinyCore",
+      "caption": "Spustenie zavádzača v TinyCore"
+    }
+  },
+  "dsmInstall": {
+    "heading": "Spustenie inštalácie DSM",
+    "intro": "Po spustení zavádzača môžete svoju VM DSM nájsť otvorením:",
+    "afterCode": "Dokončite inštaláciu DSM podľa pokynov na obrazovke.",
+    "setupAlt": "Nastavenie DSM",
+    "setupCaption": "Obrazovka nastavenia DSM",
+    "patience": "Buďte trpezliví; proces môže trvať niekoľko minút. Priebeh sa aktualizuje automaticky a pred dokončením inštalácie sa zobrazí odpočítavanie.",
+    "finishAlt": "Inštalácia dokončená",
+    "finishCaption": "Inštalácia dokončená"
+  },
+  "tips": {
+    "heading": "Tipy",
+    "recentTitle": "Použiť najnovšie modely DSM",
+    "recentBody": "Niektoré staršie modely DSM majú problém rozpoznať disky alebo sieťovú kartu. Na jednoduchšie prvé spustenie uprednostnite novší model, napríklad SA6400.",
+    "updateTitle": "Aktualizácia zavádzača",
+    "updateBody": "Niektoré zavádzače sa dajú aktualizovať priamo z konfiguračného menu; VM nemusíte odstrániť a znova vytvoriť.",
+    "warnTitle": "ProxMenux neposkytuje podporu pre zavádzače",
+    "warnBody": "ProxMenux automatizuje stranu VM. Problémy so zavádzačom (model sa nenašiel, doplnok sa nedarí nainštalovať, DSM odmieta spustiť systém) sú mimo rozsahu pôsobnosti – použite vlastný nástroj na sledovanie problémov a dokumentáciu každého zavádzača.",
+    "docsHeading": "Dokumentácia zavádzača",
+    "docLinks": [
+      {
+        "label": "Arc dokumentácia",
+        "url": "https://github.com/AuxXxilium/arc"
+      },
+      {
+        "label": "Dokumentácia RR",
+        "url": "https://github.com/RROrg/rr"
+      },
+      {
+        "label": "Dokumentácia TinyCore",
+        "url": "https://github.com/PeterSuh-Q3/tinycore-redpill"
+      }
+    ]
+  },
+  "related": {
+    "heading": "Súvisiace",
+    "itemsRich": [
+      {
+        "href": "/docs/create-vm/system-nas",
+        "label": "Prehľad systému NAS",
+        "tail": "— porovnanie Synology vs TrueNAS / OMV / Rockstor / XigmaNAS."
+      },
+      {
+        "href": "/docs/create-vm/system-nas/system-nas-others",
+        "label": "Iné systémy NAS",
+        "tail": " — iné distribúcie NAS než Synology."
+      },
+      {
+        "href": "/docs/disk-manager/import-disk-vm",
+        "label": "Importovať disk do VM",
+        "tail": " — priradiť fyzické disky VM Synology, odporúčané pre výkon úložiska."
+      },
+      {
+        "href": "/docs/create-vm",
+        "label": "Prehľad vytvárania VM",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sk/docs/create-vm/system-nas/system-nas-others.json b/web/messages/sk/docs/create-vm/system-nas/system-nas-others.json
new file mode 100644
index 00000000..9740c1cb
--- /dev/null
+++ b/web/messages/sk/docs/create-vm/system-nas/system-nas-others.json
@@ -0,0 +1,312 @@
+{
+  "meta": {
+    "title": "Vytvoriť VM: ostatné systémy NAS | Dokumentácia ProxMenux",
+    "description": "Vytvorte TrueNAS SCALE, TrueNAS CORE, OpenMediaVault, XigmaNAS, Rockstor, ZimaOS a FygoOS zapnuté virtuálne stroje Proxmox VE s ProxMenux. Zahŕňa predvolenú / rozšírenú konfiguráciu, nový plán úložiska, voliteľné GPU prechodové a odporúčané špecifikácie pre jednotlivé systémy.",
+    "ogTitle": "Vytvoriť VM: ostatné systémy NAS | Dokumentácia ProxMenux",
+    "ogDescription": "Vytvorte TrueNAS SCALE / CORE, OpenMediaVault, XigmaNAS, Rockstor, ZimaOS a FygoOS VM na Proxmox VE pomocou ProxMenux.",
+    "ogImageAlt": "ProxMenux NAS volič"
+  },
+  "header": {
+    "title": "Vytvoriť VM: Ostatné NAS systémy",
+    "description": "ProxMenux vytvorí VM pripravenú na inštaláciu TrueNAS SCALE, TrueNAS CORE, OpenMediaVault, XigmaNAS, Rockstor, ZimaOS alebo FygoOS. Táto stránka opisuje spoločný postup: predvolené a pokročilé nastavenia, plán úložiska a voliteľný GPU passthrough, aj poznámky a odporúčané zdroje pre každý systém.",
+    "section": "Virtuálne stroje · NAS"
+  },
+  "intro": {
+    "title": "Ako sú tieto systémy vytvorené",
+    "bodyRich": "Všetkých sedem systémov má rovnakého sprievodcu ProxMenux. Volič NAS vyberá zodpovedajúceho inštalátora (auto-detekcia najnovšej stabilnej verzie pre TrueNAS, OMV, XigmaNAS, Rockstor a FygoOS) a potom odovzdá všeobecnému konfigurátoru VM a úložnému plánu. ZimaOS používa svoj vlastný inštalačný skript (<code>vm/zimaos.sh</code>), ale dodržiava rovnakú postupnosť CPU / RAM / úložisko / voliteľné-GPU."
+  },
+  "config": {
+    "heading": "Štandardná vs Rozšírená konfigurácia",
+    "intro": "Po výbere NAS sa ProxMenux opýta na predvolený profil VM alebo pokročilého sprievodcu. Predvoľby sú prispôsobené NAS: viac RAM než pri bežnej linuxovej VM, pretože systémy ZFS ju využívajú na cache ARC.",
+    "defaultHeading": "Štandardná konfigurácia",
+    "headerParam": "Parameter",
+    "headerValue": "Štandardná hodnota",
+    "defaultRowsRich": [
+      {
+        "param": "Typ stroja",
+        "valueRich": "<code>q35</code>"
+      },
+      {
+        "param": "BIOS",
+        "valueRich": "OVMF (UEFI)<note> — SeaBIOS pre OpenMediaVault</note>"
+      },
+      {
+        "param": "Typ CPU",
+        "valueRich": "Host"
+      },
+      {
+        "param": "Jadro",
+        "valueRich": "2"
+      },
+      {
+        "param": "RAM",
+        "valueRich": "8192 MB<note> — 4096 MB pre ZimaOS</note>"
+      },
+      {
+        "param": "Most",
+        "valueRich": "<code>vmbr0</code>"
+      },
+      {
+        "param": "Adresa MAC",
+        "valueRich": "Automatické generovanie"
+      },
+      {
+        "param": "Spustiť po dokončení",
+        "valueRich": "Nie"
+      }
+    ],
+    "advancedHeading": "Pokročilá konfigurácia",
+    "advancedIntro": "Pokročilý sprievodca odhaľuje každý parameter samostatne:",
+    "headerOptions": "Možnosti",
+    "advancedRowsRich": [
+      {
+        "param": "Typ stroja",
+        "optionsRich": "<code>q35</code> alebo <code>i440fx</code>"
+      },
+      {
+        "param": "BIOS",
+        "optionsRich": "OVMF (UEFI) alebo SeaBIOS (staršie)"
+      },
+      {
+        "param": "Typ CPU",
+        "optionsRich": "Host, KVM64 a ďalšie modely CPU zo zoznamu (ZimaOS: Host alebo KVM64)"
+      },
+      {
+        "param": "Jadro",
+        "optionsRich": "Počet jadier CPU"
+      },
+      {
+        "param": "RAM",
+        "optionsRich": "Pamäť pridelená VM"
+      },
+      {
+        "param": "Most",
+        "optionsRich": "Sieťový most"
+      },
+      {
+        "param": "Adresa MAC",
+        "optionsRich": "Vlastná MAC adresa"
+      },
+      {
+        "param": "VLAN",
+        "optionsRich": "Značka VLAN (voliteľné)"
+      },
+      {
+        "param": "MTU",
+        "optionsRich": "Veľkosť MTU"
+      }
+    ],
+    "zfsCalloutTitle": "ZFS a RAM",
+    "zfsCalloutBody": "TrueNAS SCALE/CORE a XigmaNAS používajú ZFS, ktorého cache ARC využíva RAM. TrueNAS potrebuje aspoň 8 GB na základnú prevádzku; 16 GB alebo viac pomôže pri náročných službách a aplikáciách. VM dimenzujte podľa distribúcie a záťaže: 8 GB nie je univerzálne minimum ZFS. Ľahké zostavy OMV, Rockstor alebo ZimaOS môžu potrebovať menej."
+  },
+  "storagePlan": {
+    "heading": "Plán úložiska",
+    "intro": "Po CPU / RAM, ProxMenux otvorí ponuku Storage Plan, kde môžete kombinovať virtuálne disky, importované disky a PCI priechodové zariadenia v rovnakom VM, pridávať položky po jednej a po dokončení je hotovo.",
+    "virtualHeading": "a. Pridať virtuálny disk",
+    "virtualItemsRich": [
+      "Zobrazí úložiská Proxmox dostupné na hostiteľovi.",
+      "Vyberiete cieľové úložisko a veľkosť v GB.",
+      "Disk používa zvolenú zbernicu: SCSI (predvolená), SATA, VirtIO alebo IDE (ZimaOS: SCSI alebo SATA). SATA má šesť pozícií s číslami 0 až 5: <code>sata0</code>, <code>sata1</code>, …."
+    ],
+    "importHeading": "b. Pridať importný disk",
+    "importItemsRich": [
+      "Detekuje fyzické disky, ktoré sú bezpečné pre import (systém a chránené disky sú skryté).",
+      "Vyberte jeden alebo viac diskov prostredníctvom kontrolného zoznamu.",
+      "Importované disky používajú zvolenú zbernicu a pripoja sa cez <code>qm set</code>."
+    ],
+    "pciHeading": "c. Pridať radič alebo NVMe (PCI passthrough)",
+    "pciItemsRich": [
+      "Rozpozná HBA SATA/SAS a zariadenia NVMe a umožní priradiť VM <em>celý radič</em>. IOMMU musí byť zapnuté; skript ponúkne aktiváciu a podľa potreby reštart.",
+      "Potvrdenie upozorní na riziko pre celý radič: celá karta vrátane všetkých pripojených diskov prestane byť dostupná hostiteľovi.",
+      "Zariadenia PCI sa priradia príkazmi ako <code>qm set VMID --hostpci0 PCI_ADDRESS,pcie=1</code>. VMID a PCI_ADDRESS nahraďte ID virtuálneho stroja a adresou PCI a pre každé zariadenie použite voľný index hostpci."
+    ],
+    "resetCalloutTitle": "Resetovať a dokončiť",
+    "resetCalloutBodyRich": "Menu tiež ponúka <strong>r</strong> (resetovať aktuálny výber a začať znova) a <strong>d</strong> (dokončiť a pokračovať). Nemôžeš dokončiť prázdny plán."
+  },
+  "gpu": {
+    "heading": "Voliteľný priechod GPU",
+    "bodyRich": "Ak sa po pláne úložiska nájde kompatibilná GPU, ProxMenux ponúkne sprievodcu GPU passthrough. Pozrite <link>Pridať GPU do VM (passthrough)</link>. Môže byť potrebný reštart hostiteľa."
+  },
+  "autoFeatures": {
+    "heading": "Automatické funkcie VM",
+    "efiTitle": "disk EFI",
+    "efiBody": "Pri OVMF (UEFI) vytvorí ProxMenux automaticky 4 MB disk EFI na zvolenom úložisku vo vhodnom formáte; pri adresárovom úložisku použije raw.",
+    "isoTitle": "Pripojenie ISO",
+    "isoBodyRich": "Inštalačné ISO sa podľa potreby stiahne a pripojí k <code>ide2</code> ako CD-ROM, pripravené na prvé spustenie.",
+    "guestTitle": "QEMU agent",
+    "guestBody": "Kanál hosťovského agenta je zapnutý v konfigurácii VM. Po spustení systému NAS ešte treba agenta nainštalovať v hosťovi."
+  },
+  "endToEnd": {
+    "heading": "Čo skript robí end-to-end",
+    "itemsRich": [
+      "Zistí a stiahne najnovšie stabilné ISO alebo použije náhradnú verziu, ak je pôvodný server nedostupný.",
+      "Použije sa predvolený alebo rozšírený CPU / RAM / BIOS / typ počítača.",
+      "Otvorí plán úložiska a pripojí vybrané virtuálne disky, importované disky a PCI zariadenia.",
+      "Vytvorí disk EFI, ak je vybraný UEFI.",
+      "Namontuje ISO inštalácie na <code>ide2</code>.",
+      "Nastaví poradie spúšťania: najprv disk, potom ISO.",
+      "Zapne kanál hosťovského agenta QEMU.",
+      "Voliteľne spustí sprievodcu GPU passthrough.",
+      "Generuje štýlový HTML popis pripojený k VM.",
+      "Spustí VM, ak ste to zvolili."
+    ]
+  },
+  "perSystem": {
+    "heading": "Poznámky podľa systému",
+    "shellLabel": "Rozhranie Shell",
+    "webLabel": "Webové rozhranie"
+  },
+  "systems": {
+    "truenasScale": {
+      "id": "truenas-scale",
+      "title": "TrueNAS SCALE",
+      "icon": "Database",
+      "officialName": "TrueNAS SCALE",
+      "officialUrl": "https://www.truenas.com/truenas-scale/",
+      "description": "TrueNAS založený na Debiane s aplikáciami Docker v aktuálnych vydaniach, Linux KVM a ZFS ako hlavným súborovým systémom. Staršie vydania SCALE používali Kubernetes. Spája úložisko ZFS s kontajnerovým ekosystémom.",
+      "specs": [
+        "Odporúčané rozhranie: SATA alebo SCSI, obe s podporou discard/TRIM",
+        "Minimálne RAM: 8 GB (16 GB+ odporúčané pre skutočné pracovné zaťaženie)",
+        "Minimálne jadrá CPU: 2 (odporúčané 4+)",
+        "Odporúča sa spúšťanie UEFI (OVMF)",
+        "Sieťový adaptér VirtIO pre vysokú priepustnosť"
+      ],
+      "shellImg": "/vm/truenas/truenas-scale-shell.png",
+      "webImg": "/vm/truenas/truenas-scale-web.png",
+      "shellAlt": "TrueNAS SCALE rozhranie shellu",
+      "webAlt": "TrueNAS SCALE webové rozhranie"
+    },
+    "truenasCore": {
+      "id": "truenas-core",
+      "title": "TrueNAS CORE",
+      "icon": "Database",
+      "officialName": "TrueNAS CORE",
+      "officialUrl": "https://www.truenas.com/truenas-core/",
+      "description": "TrueNAS založený na FreeBSD, predtým FreeNAS, zameraný na ZFS. Jails, pluginy a virtualizácia v CORE 13.3 sú zastarané a bez podpory; vývoj sa sústreďuje na linuxové edície.",
+      "specs": [
+        "Odporúčané rozhranie: SATA",
+        "Minimálne RAM: 8 GB (odporúča sa 16 GB+)",
+        "Minimálne jadrá CPU: 2 (odporúčané 4+)",
+        "Odporúča sa spúšťanie UEFI (OVMF)",
+        "Sieťový adaptér VirtIO pre vysokú priepustnosť"
+      ],
+      "shellImg": "/vm/truenas/truenas-core-shell.png",
+      "webImg": "/vm/truenas/truenas-core-web.png",
+      "shellAlt": "TrueNAS CORE shell rozhranie",
+      "webAlt": "TrueNAS CORE webové rozhranie"
+    },
+    "openmediavault": {
+      "id": "openmediavault",
+      "title": "OpenMediaVault",
+      "icon": "Server",
+      "officialName": "openmediavault.org",
+      "officialUrl": "https://www.openmediavault.org",
+      "description": "NAS založený na Debiane s modulárnymi pluginmi. Má nízke nároky a ľahko beží na skromnom hardvéri; vhodný, ak nepotrebujete ZFS.",
+      "specs": [
+        "Odporúčané rozhranie: SATA alebo VirtIO",
+        "Minimálne RAM: 2 GB (odporúča sa 4 GB+)",
+        "Minimálne jadrá CPU: 1 (odporúčané 2+)",
+        "BIOS: ProxMenux pre OMV predvolene používa SeaBIOS; podľa potreby ho zmeňte v pokročilom režime.",
+        "Sieťový adaptér VirtIO pre vysokú priepustnosť"
+      ],
+      "shellImg": "/vm/openmediavault/openmediavault-shell.png",
+      "webImg": "/vm/openmediavault/openmediavault-web.png",
+      "shellAlt": "Rozhranie shellu OpenMediaVault",
+      "webAlt": "Webové rozhranie OpenMediaVault"
+    },
+    "xigmanas": {
+      "id": "xigmanas",
+      "title": "XigmaNAS",
+      "icon": "Database",
+      "officialName": "xigmanas.com",
+      "officialUrl": "https://www.xigmanas.com",
+      "description": "NAS založený na FreeBSD, priame pokračovanie pôvodného kódu FreeNAS 0.7. Zameriava sa na ZFS a jednoduchosť a má nižšie nároky než TrueNAS.",
+      "specs": [
+        "Odporúčané rozhranie: SATA alebo SCSI",
+        "Minimálne RAM: 4 GB (8 GB+ odporúčané pre ZFS)",
+        "Minimálne jadrá CPU: 2",
+        "Odporúča sa spúšťanie UEFI (OVMF)",
+        "Sieťový adaptér VirtIO pre vysokú priepustnosť"
+      ]
+    },
+    "rockstor": {
+      "id": "rockstor",
+      "title": "Rockstor",
+      "icon": "HardDrive",
+      "officialName": "rockstor.com",
+      "officialUrl": "https://rockstor.com",
+      "description": "openSUSE NAS na báze Leap postavený okolo Btrfs. Snapshoty, subobjemy a rámec aplikácie Rock-ons (Docker) pre médiá, zdieľanie súborov a zálohovanie.",
+      "specs": [
+        "Odporúčané rozhranie: SATA alebo VirtIO",
+        "Minimálne RAM: 2 GB (odporúča sa 4 GB+)",
+        "Minimálne jadrá CPU: 2",
+        "Odporúča sa spúšťanie UEFI (OVMF)",
+        "Sieťový adaptér VirtIO pre vysokú priepustnosť"
+      ],
+      "shellImg": "/vm/rockstor/rockstor-shell.png",
+      "webImg": "/vm/rockstor/rockstor-web.png",
+      "shellAlt": "Rozhranie Rockstor shell",
+      "webAlt": "Webové rozhranie Rockstor"
+    },
+    "zimaos": {
+      "id": "zimaos",
+      "title": "ZimaOS",
+      "icon": "MonitorIcon",
+      "officialName": "zimaspace.com",
+      "officialUrl": "https://www.zimaspace.com/zimaos",
+      "description": "Ľahký NAS/domáci server vytvorený pomocou Buildroot, ktorý vznikol z CasaOS, pre médiá, aplikácie Docker a domácu automatizáciu. Samostatný inštalátor ProxMenux (vm/zimaos.sh) stiahne pripravený obraz a ponúkne nastavenie CPU, RAM a úložiska.",
+      "specs": [
+        "Odporúčané rozhranie: SATA alebo VirtIO",
+        "Predvolené RAM: 4 GB (dostatok pre médiá / aplikácie s vlastným hosťovaním)",
+        "Minimálne jadrá CPU: 2",
+        "Spúšťanie UEFI (OVMF)",
+        "Sieťový adaptér VirtIO pre vysokú priepustnosť"
+      ]
+    },
+    "fygoos": {
+      "id": "fygoos",
+      "title": "FygoOS",
+      "icon": "Server",
+      "officialName": "fygonas.com",
+      "officialUrl": "https://fygonas.com",
+      "description": "Medzinárodná edícia fnOS, NAS založený na Debiane. ProxMenux stiahne najnovšie inštalačné ISO z fygonas.com a pripojí ho do VM. Systém sa nainštaluje na jeden disk; zvyšné miesto môže obsahovať zväzky pre aplikácie a súbory. Konzola po inštalácii zobrazí webové rozhranie na porte 5666, kam presmeruje port 80. Otvorte ho v prehliadači, pomenujte zariadenie a vytvorte účet správcu.",
+      "specs": [
+        "Systémový disk: FygoOS navrhuje 64 systémovú partíciu GB, ktorá môže byť menšia v VM",
+        "Inštalácia: Graphical Install alebo Rescuing Install, ak grafický režim zlyhá",
+        "Spúšťanie UEFI (OVMF) bez kľúčov Secure Boot podľa požiadaviek inštalátora",
+        "Sieť: Ethernet s DHCP štandardne",
+        "Sieťový adaptér VirtIO pre vysokú priepustnosť"
+      ]
+    }
+  },
+  "related": {
+    "heading": "Súvisiace",
+    "itemsRich": [
+      {
+        "href": "/docs/create-vm/system-nas",
+        "label": "Prehľad systému NAS",
+        "tail": " — Rýchle porovnanie všetkých možností NAS."
+      },
+      {
+        "href": "/docs/create-vm/system-nas/synology",
+        "label": "VM Synology",
+        "tail": " — postup Synology DSM (Xpenology)."
+      },
+      {
+        "href": "/docs/disk-manager/import-disk-vm",
+        "label": "Importovať disk do VM",
+        "tail": " — Odporúča sa pre prípady použitia NAS (reálne disky > virtuálne disky)."
+      },
+      {
+        "href": "/docs/help-info/zfs-commands",
+        "label": "Príkazy na správu ZFS",
+        "tail": " — ak zvolíte TrueNAS alebo inú distribúciu využívajúcu ZFS."
+      },
+      {
+        "href": "/docs/create-vm",
+        "label": "Prehľad vytvárania VM",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sk/docs/create-vm/system-windows.json b/web/messages/sk/docs/create-vm/system-windows.json
new file mode 100644
index 00000000..c4f217cb
--- /dev/null
+++ b/web/messages/sk/docs/create-vm/system-windows.json
@@ -0,0 +1,259 @@
+{
+  "meta": {
+    "title": "Vytvoriť VM: systém Windows | Dokumentácia ProxMenux",
+    "description": "Vytvárajte a nastavujte virtuálne stroje Windows na Proxmox VE pomocou ProxMenux. ISO cez UUP Dump alebo lokálny súbor, predvolené či pokročilé nastavenia, spoločný plán úložiska, voliteľný GPU passthrough, TPM 2.0 a inštalácia ovládačov VirtIO.",
+    "ogTitle": "Vytvoriť VM: systém Windows | Dokumentácia ProxMenux",
+    "ogDescription": "Vytvárajte VM Windows na Proxmox VE pomocou ProxMenux: UUP Dump alebo lokálne ISO, spoločný plán úložiska, voliteľný GPU passthrough, TPM 2.0 a ovládače VirtIO.",
+    "ogImageAlt": "Menu VM Windows v ProxMenux"
+  },
+  "header": {
+    "title": "Vytvoriť VM: systém Windows",
+    "description": "Vytvorte VM Windows na Proxmox VE. ProxMenux zabezpečí výber ISO (UUP Dump alebo lokálne), CPU, RAM, typ stroja, spoločný plán úložiska, voliteľný GPU passthrough, TPM 2.0 a inštaláciu ovládačov VirtIO.",
+    "section": "Virtuálne stroje"
+  },
+  "intro": {
+    "title": "Čo tento skript robí",
+    "body": "Postup pre Windows sa opýta na zdroj ISO: UUP Dump alebo lokálna kópia v <code>/var/lib/vz/template/iso</code>. Potom spustí spoločného sprievodcu VM s nastaveniami pre Windows: <code>q35</code>, OVMF a TPM 2.0. ISO ovládačov VirtIO pripojí ako druhé CD-ROM a VM je pripravená spustiť inštalátor Windows."
+  },
+  "image": {
+    "alt": "Možnosti inštalácie ProxMenux Windows",
+    "caption": "Možnosti inštalácie Windows"
+  },
+  "config": {
+    "heading": "Štandardná vs Rozšírená konfigurácia",
+    "intro": "Po zvolení ISO sa ProxMenux pýta, či použiť štandardný VM profil alebo otvoriť pokročilého sprievodcu. Predvolený profil je ladený pre moderné Windows desktop a serverové edície.",
+    "defaultHeading": "Štandardná konfigurácia",
+    "headerParam": "Parameter",
+    "headerValue": "Štandardná hodnota",
+    "defaultRows": [
+      {
+        "param": "Typ stroja",
+        "valueRich": "<code>q35</code>"
+      },
+      {
+        "param": "BIOS",
+        "value": "OVMF (UEFI)"
+      },
+      {
+        "param": "Typ CPU",
+        "value": "Host"
+      },
+      {
+        "param": "Jadrá",
+        "value": "4"
+      },
+      {
+        "param": "RAM",
+        "value": "8192 MB"
+      },
+      {
+        "param": "Most",
+        "valueRich": "<code>vmbr0</code>"
+      },
+      {
+        "param": "Adresa MAC",
+        "value": "Automatické generovanie"
+      },
+      {
+        "param": "TPM",
+        "value": "Povolené (v2.0)"
+      },
+      {
+        "param": "Spustiť po dokončení",
+        "value": "Nie"
+      }
+    ],
+    "advancedHeading": "Pokročilá konfigurácia",
+    "advancedIntro": "Pokročilý sprievodca ponúkne každé nastavenie samostatne:",
+    "headerOptions": "Možnosti",
+    "advancedRows": [
+      {
+        "param": "Typ stroja",
+        "optionsRich": "<code>q35</code> alebo <code>i440fx</code>"
+      },
+      {
+        "param": "BIOS",
+        "options": "OVMF (UEFI) alebo SeaBIOS (staršie)"
+      },
+      {
+        "param": "Typ CPU",
+        "options": "Host, KVM64 a ďalšie modely CPU zo zoznamu"
+      },
+      {
+        "param": "Jadrá",
+        "options": "Počet jadier CPU"
+      },
+      {
+        "param": "RAM",
+        "options": "Pamäť pridelená VM"
+      },
+      {
+        "param": "Most",
+        "options": "Sieťový most"
+      },
+      {
+        "param": "Adresa MAC",
+        "options": "Vlastná MAC adresa"
+      },
+      {
+        "param": "VLAN",
+        "options": "Značka VLAN (voliteľné)"
+      },
+      {
+        "param": "MTU",
+        "options": "Veľkosť MTU"
+      },
+      {
+        "param": "TPM",
+        "options": "TPM 2.0 sa pre Windows pridáva automaticky; sprievodca nemá prepínač TPM."
+      }
+    ],
+    "tpmWarnTitle": "Požiadavky TPM závisia od edície Windows",
+    "tpmWarnBody": "Windows 11 zvyčajne vyžaduje TPM 2.0. Windows Server 2022 ho potrebuje na niektoré bezpečnostné funkcie, nie na každú inštaláciu. ProxMenux pridá virtuálne TPM pre Windows; pokročilý sprievodca nemá prepínač TPM."
+  },
+  "storagePlan": {
+    "heading": "Plán úložiska",
+    "body": "Po nastavení CPU a RAM otvorí ProxMenux menu <strong>Plán úložiska</strong>. V jednej VM môžete kombinovať virtuálne disky, importované disky a zariadenia PCI passthrough, pridávať ich po jednom a po dokončení pokračovať.",
+    "virtualDiskTitle": "a. Pridať virtuálny disk",
+    "virtualDiskItems": [
+      "Zobrazí úložiská Proxmox dostupné na hostiteľovi.",
+      "Vyberiete cieľové úložisko a veľkosť v GB.",
+      "Disk používa zvolenú zbernicu: SCSI (predvolená), SATA, VirtIO alebo IDE. SATA má šesť pozícií s číslami 0 až 5: <code>sata0</code>, <code>sata1</code>, …."
+    ],
+    "importDiskTitle": "b. Pridať importný disk",
+    "importDiskItems": [
+      "Detekuje fyzické disky, ktoré sú bezpečné pre import (systém a chránené disky sú skryté).",
+      "Vyberte jeden alebo viac diskov prostredníctvom kontrolného zoznamu.",
+      "Importované disky používajú zvolenú zbernicu a pripoja sa cez <code>qm set</code>."
+    ],
+    "pciTitle": "c. Pridať radič alebo NVMe (PCI passthrough)",
+    "pciItems": [
+      "Rozpozná HBA SATA/SAS a zariadenia NVMe a umožní priradiť VM <em>celý radič</em>. IOMMU musí byť zapnuté; skript ponúkne aktiváciu a podľa potreby reštart.",
+      "Potvrdenie upozorní na riziko pre celý radič: celá karta vrátane všetkých pripojených diskov prestane byť dostupná hostiteľovi.",
+      "Zariadenia PCI sa priradia príkazmi ako <code>qm set VMID --hostpci0 PCI_ADDRESS,pcie=1</code>. VMID a PCI_ADDRESS nahraďte ID virtuálneho stroja a adresou PCI a pre každé zariadenie použite voľný index hostpci."
+    ],
+    "resetTitle": "Resetovať a dokončiť",
+    "resetBody": "Menu tiež ponúka <strong>r</strong> (resetovať aktuálny výber a začať znova) a <strong>d</strong> (dokončiť a pokračovať). Nemôžeš dokončiť prázdny plán."
+  },
+  "gpu": {
+    "heading": "Voliteľný priechod GPU",
+    "body": "Ak sa po pláne úložiska nájde kompatibilná GPU, ProxMenux ponúkne sprievodcu GPU passthrough. Pozrite <gpuLink>Pridať GPU do VM (passthrough)</gpuLink>. Môže byť potrebný reštart hostiteľa."
+  },
+  "autoFeatures": {
+    "heading": "Automatické funkcie VM",
+    "efiTitle": "disk EFI",
+    "efiBody": "Keď vyberiete OVMF (UEFI), ProxMenux vytvorí systémový disk 4 MB EFI na úložisku, ktoré vyberiete, a pripojí ho k VM, takže firmvér UEFI má miesto na uloženie svojich premenných.",
+    "tpmTitle": "TPM 2.0",
+    "tpmBody": "ProxMenux pridá do VM Windows virtuálne zariadenie TPM 2.0. Spĺňa požiadavku TPM systému Windows 11 a podporuje funkcie Windows Server, ktoré závisia od TPM.",
+    "isoTitle": "Pripojenie ISO",
+    "isoBody": "Inštalačné ISO sa pripojí k <code>ide2</code>. ISO ovládačov VirtIO sa podľa potreby stiahne a pripojí k <code>ide3</code> pre krok <em>Načítať ovládač</em>.",
+    "guestTitle": "Hosťovský agent QEMU",
+    "guestBody": "Kanál hosťujúceho agenta je zapnutý v konfigurácii VM. Samotný agent je nainštalovaný vo Windows spustením <code>virtio-win-guest-tools.exe</code> po nastavení."
+  },
+  "installOptions": {
+    "heading": "Možnosti inštalácie Windows",
+    "intro": "ProxMenux ponúka dva spôsoby získania inštalačných médií systému Windows:",
+    "uupTitle": "Tvorba ISO cez UUP Dump",
+    "uupLogoAlt": "Logo UUP Dump",
+    "uupBody": "Skript <strong>UUP Dump ISO Creator</strong> je ProxMenux nástroj, ktorý vytvára Windows ISO za behu zo serverov Windows Update od spoločnosti Microsoft. Sťahuje čisté, oficiálne inštalačné súbory (vrátane zostavení Insider Preview).",
+    "uupItems": [
+      "Prístup k najnovším zostaveniam Windows.",
+      "Podporuje verzie náhľadu Insider.",
+      "Čisté oficiálne inštalačné súbory Microsoft.",
+      "Automatické vytvorenie ISO a jeho pripojenie k VM.",
+      "Podporuje edície Home, Pro a Enterprise."
+    ],
+    "uupLearnMore": "Zistite viac o UUP Dump ISO Creator",
+    "localTitle": "Inštalovať s lokálnou ISO",
+    "localBody": "Používa Windows ISO, ktorý ste už nahrali do miestneho úložiska hostiteľa (<code>/var/lib/vz/template/iso</code>). Skript obsahuje zoznam všetkých non-VirtIO ISO, ktoré nájde a umožní vám vybrať jeden.",
+    "localImageAlt": "Lokálne menu výberu ISO",
+    "localImageCaption": "Lokálne menu výberu ISO"
+  },
+  "endToEnd": {
+    "heading": "Čo skript vykoná od začiatku do konca",
+    "items": [
+      "Získa Windows ISO (UUP Dump build alebo lokálnu kópiu).",
+      "Uplatňuje štandardnú alebo pokročilú konfiguráciu typu CPU / RAM / BIOS / typ stroja.",
+      "Otvorí plán úložiska a pripojí vybrané virtuálne disky, importované disky a PCI zariadenia.",
+      "Pri inštalácii UEFI vytvorí disk EFI a pripojí zariadenie TPM 2.0.",
+      "Pripojí Windows ISO na <code>ide2</code>.",
+      "Stiahne a pripojí ovládače VirtIO ISO na <code>ide3</code>.",
+      "Nastaví poradie spúšťania: najprv disk, potom ISO.",
+      "Zapne kanál hosťovského agenta QEMU.",
+      "Voliteľne spustí sprievodcu GPU passthrough.",
+      "Generuje štýlový HTML popis pripojený k VM.",
+      "Spustí VM, ak ste to zvolili."
+    ]
+  },
+  "virtio": {
+    "heading": "Ovládače VirtIO počas inštalácie",
+    "body": "Tvorca VM predvolene používa disky SCSI s radičom VirtIO SCSI a sieťový adaptér VirtIO. Bežné ISO Windows môže potrebovať ich ovládače z ISO VirtIO pripojeného na <code>ide3</code>. Disky SATA zvyčajne fungujú s ovládačmi Windows; výber SATA nemení sieťový adaptér VirtIO.",
+    "warnTitle": "Ak Windows nemá sieť, načítajte sieťový ovládač VirtIO",
+    "warnBody": "VM používa sieťový adaptér VirtIO (<code>virtio</code>). Ak Windows neobsahuje jeho ovládač, načítajte ho počas inštalácie na získanie prístupu k sieti. Inak nemusí byť pri prvom spustení dostupná aktivácia ani Windows Update.",
+    "stepLabel": "Krok",
+    "steps": [
+      {
+        "title": "Otvorte obrazovku „Kde chcete nainštalovať Windows?“",
+        "body": "Ak sa počas inštalácie Windows nezobrazujú disky, ovládač úložiska pre zvolené rozhranie SCSI alebo VirtIO ešte nie je načítaný. Načítajte ho ručne z pripojeného ISO VirtIO.",
+        "img": "/vm/windows/virtio-step-1.png",
+        "caption": "Nastavenie Windows bez zobrazených diskov"
+      },
+      {
+        "title": "Kliknite na tlačidlo \"Load driver\"",
+        "bodyRich": "Kliknutím na <strong>Načítať ovládač</strong> si prehliadnite pripojený VirtIO ISO a vyberte ovládač úložiska, ktorý zodpovedá zvolenému rozhraniu.",
+        "img": "/vm/windows/virtio-step-2.png",
+        "caption": "Kliknite na tlačidlo Načítať ovládač pre prehliadanie VirtIO ISO"
+      },
+      {
+        "title": "Prechádzať do správneho priečinka ovládača",
+        "bodyRich": "Na ISO VirtIO vyberte <code>vioscsi</code> pre radič VirtIO SCSI alebo <code>viostor</code> pre blokové disky VirtIO. Potom zvoľte podpriečinok pre verziu Windows a architektúru.",
+        "img": "/vm/windows/virtio-step-3.png",
+        "caption": "Prechádzať do príslušného priečinku ovládača"
+      },
+      {
+        "title": "Vyberte ovládač",
+        "bodyRich": "Windows zobrazí dostupné ovládače. Vyberte vhodný ovládač pre svoju konfiguráciu, zvyčajne <strong>Red Hat VirtIO SCSI controller</strong>, a kliknite na <strong>Ďalej</strong>.",
+        "img": "/vm/windows/virtio-step-4.png",
+        "caption": "Vyberte ovládač VirtIO, ktorý zodpovedá vášmu diskovému rozhraniu"
+      },
+      {
+        "title": "(nepovinné) Inštalácia sieťového ovládača",
+        "bodyRich": "Ak ste si tiež vybrali VirtIO ako sieťové rozhranie, načítajte sieťový ovládač z <code>NetKVM</code> priečinka rovnakého ISO, pričom vyberte podpriečinok pre verziu Windows. Bez tohto kroku Windows inštaluje bez prístupu na internet.",
+        "img": "/vm/windows/virtio-step-5.png",
+        "caption": "Načítať sieťový ovládač VirtIO pre umožnenie internetu počas inštalácie"
+      }
+    ],
+    "tipTitle": "Po inštalácii: spustiť virtio-win-guest-tools.exe",
+    "tipBody": "Po inštalácii Windows otvorte ISO VirtIO v Prieskumníkovi a spustite <code>virtio-win-guest-tools.exe</code>. Naraz nainštaluje zostávajúce ovládače siete, displeja, vstupu a ballooningu aj hosťovského agenta QEMU."
+  },
+  "related": {
+    "heading": "Súvisiace",
+    "items": [
+      {
+        "href": "/docs/utils/UUp-Dump-ISO-Creator",
+        "label": "Tvorba ISO cez UUP Dump",
+        "tail": " — vytváranie aktuálnych inštalačných obrazov ISO systému Windows na hostiteľovi Proxmox."
+      },
+      {
+        "href": "/docs/disk-manager/import-disk-image-vm",
+        "label": "Importovať obraz disku do VM",
+        "tail": " — importovať existujúci obraz disku Windows (.vmdk, .qcow2, .img alebo .raw) do existujúcej VM; obrazy .vhdx najprv previesť do podporovaného formátu."
+      },
+      {
+        "href": "/docs/hardware/gpu-vm-passthrough",
+        "label": "Pridať GPU do VM (passthrough)",
+        "tail": " — pre VM Windows s hardvérovo akcelerovanou GPU."
+      },
+      {
+        "href": "/docs/help-info/vm-ct-commands",
+        "label": "Príkazy na správu VM a CT",
+        "tail": " — Referencia qm CLI."
+      },
+      {
+        "href": "/docs/create-vm",
+        "label": "Prehľad vytvárania VM",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sk/docs/disk-manager/add-controller-nvme-vm.json b/web/messages/sk/docs/disk-manager/add-controller-nvme-vm.json
new file mode 100644
index 00000000..1f8a0385
--- /dev/null
+++ b/web/messages/sk/docs/disk-manager/add-controller-nvme-vm.json
@@ -0,0 +1,128 @@
+{
+  "meta": {
+    "title": "Pridať radič alebo NVMe do VM | Dokumentácia ProxMenux",
+    "description": "Sprístupnenie radiča úložiska SATA/SAS HBA alebo zariadenia NVMe virtuálnemu stroju Proxmox cez PCI passthrough pomocou ProxMenuxu. Nástroj zabezpečuje aktiváciu IOMMU, rozpoznanie konfliktov a priradenie cez qm set --hostpci.",
+    "ogTitle": "Pridať radič alebo NVMe do VM | Dokumentácia ProxMenux",
+    "ogDescription": "Priraďte celý HBA SATA/SAS alebo zariadenie NVMe virtuálnemu stroju Proxmox. ProxMenux zabezpečí IOMMU, rozpoznanie konfliktov a priradenie hostpci."
+  },
+  "header": {
+    "title": "Pridať radič alebo NVMe do VM",
+    "description": "Priraďte celý adaptér SATA/SAS HBA alebo zariadenie NVMe virtuálnemu stroju Proxmox cez PCI passthrough. ProxMenux skontroluje IOMMU a s vaším súhlasom ho aktivuje, vyhľadá vhodné zariadenia, vylúči konflikty a zapíše priradenie pomocou qm set --hostpci.",
+    "section": "Správca disku · VM"
+  },
+  "intro": {
+    "title": "Čo to robí (a nerobí)",
+    "body": "Toto je <strong>priechod na úrovni zariadenia</strong>: karta PCIe opustí pohľad hostiteľského jadra a je viazaná na <code>vfio-pci</code>. VM vidí samotný radič – nie jednotlivé disky za ním – a načíta svoj vlastný ovládač pre tento presný model. Každý disk pripojený k tomuto radiču ho nasleduje automaticky, s natívnymi SMART údajmi, úplnými funkciami firmvéru a bez vrstvy Proxmox medzi nimi."
+  },
+  "howRuns": {
+    "heading": "Ako beží skript",
+    "body": "Postup má dve oddelené fázy: zhromaždenie informácií, kontrolu IOMMU a výpis vhodných zariadení; potom samotné pripojenie zariadenia PCI. Až do záverečného potvrdenia sa do konfigurácie VM nič nezapisuje."
+  },
+  "iommu": {
+    "heading": "Skupiny IOMMU: prečo treba posudzovať celú kartu",
+    "body": "Hranicou izolácie PCI passthrough je <strong>skupina IOMMU</strong>, najmenšia jednotka, ktorú IOMMU procesora dokáže izolovať. Zariadenia v rovnakej skupine nemožno izolovať navzájom. Ak radič SATA zdieľa skupinu s radičom USB, passthrough SATA môže vyžadovať aj uvoľnenie USB z hostiteľa alebo nemusí byť možný. Automaticky nepriradí VM všetky zariadenia skupiny.",
+    "outro": "ProxMenux zobrazuje skupinu IOMMU pri každom zariadení a upozorní, ak skupina obsahuje aj iné zariadenia než požadovaný radič. Môžete pokračovať, ak sú tieto ďalšie zariadenia prijateľné, napríklad ak sú všetky radičmi diskov, alebo sa vrátiť späť."
+  },
+  "prereqs": {
+    "heading": "Predpoklady",
+    "items": [
+      "<strong>CPU a základná doska podporujú</strong> VT-d (Intel) alebo AMD-Vi a funkcia je povolená vo firmvéri (BIOS/UEFI). ProxMenux môže upraviť nastavenie jadra, ale nemôže prepnúť nastavenie firmvéru.",
+      "Cieľová VM je pred pripojením zariadení PCI <strong>vypnutá</strong>.",
+      "Radič/NVMe <strong>nie je ten, na ktorom sa nachádza koreňový súborový systém Proxmox</strong>. Skript skryje všetko, čo hostiteľ používa.",
+      "Hosťujúci OS má ovládače pre model radiča. Linux pokrýva prakticky každý HBA hneď po vybalení; Windows potrebuje nainštalovaný ovládač od dodávateľa <em>pred</em> spustením s pripojeným radičom."
+    ],
+    "warnTitle": "Živá migrácia nie je možná",
+    "warnBody": "VM s PCI passthrough je viazaná na uzol, v ktorom je karta fyzicky osadená. Živá migrácia medzi uzlami zlyhá. Prispôsobte tomu zálohovanie a replikáciu."
+  },
+  "steps": {
+    "heading": "Krok za krokom",
+    "stepLabel": "Krok",
+    "list": [
+      {
+        "title": "Vyberte cieľovú VM",
+        "bodyRich": "ProxMenux načíta <code>qm list</code> a zobrazí všetky VM. Vyberte tú, ktorej chcete priradiť radič.",
+        "img": "/disk/nvme-passthrough/vm-selection.png",
+        "alt": "dialóg výberu VM",
+        "caption": "dialóg výberu VM"
+      },
+      {
+        "title": "Kontrola IOMMU",
+        "bodyRich": "Ak IOMMU nie je povolené v príkazovom riadku jadra, ProxMenux ponúkne jeho aktiváciu. Upraví <code>/etc/kernel/cmdline</code> pre systemd-boot alebo <code>/etc/default/grub</code> pre GRUB a pridá správny parameter pre váš CPU:",
+        "items": [
+          "<code>intel_iommu=on</code> pre procesory Intel.",
+          "<code>amd_iommu=on</code> pre CPU AMD."
+        ],
+        "outro": "Po tejto zmene je potrebný reštart. Skript ponúkne reštart teraz alebo neskôr; passthrough nemôže pokračovať, kým nie je aktívny nový príkazový riadok jadra.",
+        "img": "/disk/nvme-passthrough/iommu-warning.png",
+        "alt": "Dialóg IOMMU je vyžadované",
+        "caption": "IOMMU je vyžadované: ponuka aktivácie a reštartu"
+      },
+      {
+        "title": "Výpis zariadení",
+        "body": "ProxMenux vypíše všetky radiče úložiska (HBA SATA/SAS) a všetky zariadenia NVMe na zbernici PCI. Pri každom zariadení zobrazí:",
+        "items": [
+          "Adresa PCI (<code>00:17.0</code>, <code>01:00.0</code>, ...).",
+          "Dodávateľ / popis zariadenia.",
+          "Skupina IOMMU a upozornenie ⚠, ak ju zdieľajú ďalšie nesúvisiace zariadenia.",
+          "Disky aktuálne pripojené k radiču, aby ste vedeli, ktoré s ním prejdú do VM."
+        ],
+        "img": "/disk/nvme-passthrough/device-list.png",
+        "alt": "Výpis radičov a zariadení NVMe",
+        "caption": "Výpis radičov a zariadení NVMe s informáciami o skupine IOMMU"
+      },
+      {
+        "title": "Odhalenie konfliktov",
+        "bodyRich": "Skript zablokuje jednoznačne nebezpečné zariadenia: už priradené inej VM cez <code>hostpci</code> v jej konfigurácii, používané hostiteľom, napríklad radič koreňového disku, alebo zaradené v skupine IOMMU, ktorej ostatných členov nedokáže bezpečne identifikovať. Vhodné zariadenia sú dostupné na výber.",
+        "img": "/disk/nvme-passthrough/conflict-warning.png",
+        "alt": "Upozornenie na zistený konflikt",
+        "caption": "Rozpoznanie konfliktu: zariadenie zablokované s uvedením dôvodu"
+      },
+      {
+        "title": "Pripojiť a dokončiť",
+        "bodyRich": "Pre každé vybrané zariadenie ProxMenux spustí <code>qm set &lt;VMID&gt; --hostpciN &lt;pci-addr&gt;,pcie=1</code> a vyberie ďalší voľný slot <code>hostpci</code>. Ak sa počas tejto relácie aktivovalo IOMMU, pripomenie potrebu reštartu pred spustením VM.",
+        "img": "/disk/nvme-passthrough/assignment.png",
+        "alt": "Prehľad priradenia",
+        "caption": "Prehľad priradenia: sloty hostpciN a pripojené adresy PCI"
+      }
+    ]
+  },
+  "manual": {
+    "heading": "Ručný ekvivalent"
+  },
+  "troubleshoot": {
+    "heading": "Riešenie problémov",
+    "noGroupsTitle": "IOMMU povolené, ale žiadne skupiny pod /sys/kernel/iommu_groups/",
+    "noGroupsBody": "Na uplatnenie príkazového riadka jadra je potrebný reštart. Ak skupiny chýbajú aj po reštarte, VT-d/AMD-Vi je pravdepodobne vypnuté vo firmvéri: skontrolujte nastavenia BIOS/UEFI.",
+    "busyTitle": "VM sa nespustí: \"hostpciN: device busy\"",
+    "busyBody": "Iný proces stále drží PCI zariadenie. Najčastejšie príčiny: predchádzajúci VM, ktorý zlyhal bez jeho uvoľnenia, alebo ho hostiteľské jadro získalo späť pri poslednom spustení. Spustite <code>lspci -nnk -s &lt;addr&gt;</code> a zistite, ktorý ovládač je viazaný; malo by to byť <code>vfio-pci</code>. Úplný reštart hostiteľa to zvyčajne vymaže.",
+    "noDisksTitle": "Hosť vidí radič, ale nie disky",
+    "noDisksBody": "V hosťovi chýba ovládač pre daný model radiča. V Linuxe je to zriedkavé, vo Windowse sa to stáva: nainštalujte ovládač výrobcu, napríklad LSI/Broadcom pre staršie HBA SAS, keď karta nie je priradená, a potom reštartujte s priradenou kartou.",
+    "sharedTitle": "Skupina IOMMU obsahuje nesúvisiace zariadenie",
+    "sharedBody": "Možnosti: (a) presunúť kartu do iného slotu PCIe a zmeniť tak jej skupinu, (b) zapnúť <em>ACS override</em> v jadre na rozdelenie skupín (bezpečnostný kompromis, pred použitím si ho preštudujte), alebo (c) vybrať inú kartu v lepšie izolovanej skupine."
+  },
+  "related": {
+    "heading": "Súvisiace",
+    "items": [
+      {
+        "href": "/docs/disk-manager/import-disk-vm",
+        "label": "Importovať disk do VM",
+        "tail": " — alternatíva: pripojiť fyzický disk cez Proxmox bez úplného PCIe passthrough."
+      },
+      {
+        "href": "/docs/hardware/gpu-vm-passthrough",
+        "label": "Pridať GPU do VM (passthrough)",
+        "tail": " — Rovnaké IOMMU / VFIO koncepty použité na GPU."
+      },
+      {
+        "href": "/docs/help-info/gpu-commands",
+        "label": "Príkazy pre GPU passthrough",
+        "tail": " — príkazy na overenie IOMMU platia aj pre passthrough radiča alebo NVMe."
+      },
+      {
+        "href": "/docs/disk-manager",
+        "label": "Prehľad správcu diskov",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sk/docs/disk-manager/format-disk.json b/web/messages/sk/docs/disk-manager/format-disk.json
new file mode 100644
index 00000000..38bfd68e
--- /dev/null
+++ b/web/messages/sk/docs/disk-manager/format-disk.json
@@ -0,0 +1,142 @@
+{
+  "meta": {
+    "title": "Formátovať alebo vymazať fyzický disk | Dokumentácia ProxMenux",
+    "description": "Mazanie a formátovanie fyzických diskov v Proxmox VE pomocou ProxMenux. Štyri režimy, prísne filtre blokujúce systémové, pripojené a používané disky a dvojité potvrdenie vrátane zadania celej cesty.",
+    "ogTitle": "Formátovať alebo vymazať fyzický disk | Dokumentácia ProxMenux",
+    "ogDescription": "Vymažte alebo naformátujte fyzický disk v Proxmox. Bezpečnostné filtre, štyri režimy a dvojité potvrdenie."
+  },
+  "header": {
+    "title": "Formátovať / vymazať fyzický disk",
+    "description": "Vymažte alebo naformátujte fyzický disk na hostiteľovi Proxmox. ProxMenux zobrazí iba úplne voľné disky, ktoré nepoužíva systém, nie sú uvedené v konfigurácii hosťa a nemajú pripojené súborové systémy. Pred zničením dát vyžaduje dvojité potvrdenie: áno/nie a presné zadanie celej cesty k disku.",
+    "section": "Správca diskov · Nástroje"
+  },
+  "danger": {
+    "title": "Deštrukčný nástroj",
+    "body": "Každá operácia zapisuje na disk. Nedá sa vrátiť späť. ProxMenux používa prísne bezpečnostné filtre a potvrdenia, no za výber správneho disku zodpovedáte vy. Pred zadaním si cestu k disku dvakrát prečítajte nahlas."
+  },
+  "howRuns": {
+    "heading": "Ako beží skript",
+    "body": "Postup má dve fázy s trojitou bezpečnostnou kontrolou medzi nimi. V prvej fáze sa zhromaždí výber disku, režim operácie a údaje súborového systému. Nič sa nezapíše, kým druhá fáza neprejde záverečným opätovným overením tesne pred vykonaním."
+  },
+  "visibility": {
+    "heading": "Pravidlá viditeľnosti",
+    "intro": "Pred tým, ako sa zobrazí menu, ProxMenux filtruje zoznam diskov. Zobrazujú sa iba kandidáti, ktorí sú preukázateľne v bezpečí:",
+    "items": [
+      "<strong>Zobrazené</strong>: disky, ktoré <em>nepoužíva</em> hostiteľ (koreňový pool, swap, pripojené systémy, aktívne ZFS/LVM/RAID) a <em>nie sú</em> uvedené v konfigurácii žiadnej VM/LXC, spustenej ani zastavenej.",
+      "<strong>Skryté</strong>: disky hostiteľa a systému.",
+      "<strong>Skryté</strong>: disky uvedené v konfigurácii VM/LXC."
+    ],
+    "safetyTitle": "Bezpečnosť pri potvrdení a vykonávaní",
+    "safetyItems": [
+      "Disky so zastaranými alebo aktívnymi metadátami zobrazia podrobné upozornenia <em>pred</em> potvrdením.",
+      "Disky používané <strong>spustenou</strong> VM sa pri potvrdení <strong>bez výnimky zablokujú</strong>.",
+      "Disky s pripojenými oddielmi sú <strong>pevne zablokované</strong> pri spustení (tesne predtým, ako sa čokoľvek zapíše, sa spustí nové overenie).",
+      "Vždy sa vyžadujú dve potvrdenia: <em>áno/nie</em> dialógové okno + presné napísanie celej cesty k disku."
+    ]
+  },
+  "modes": {
+    "heading": "Režimy prevádzky",
+    "intro": "Po vybratí disku si vyberiete jeden zo štyroch režimov. Odlišujú sa v tom, čo ničia a čo za sebou zanechávajú:",
+    "headerMode": "Režim",
+    "headerPart": "Tabuľka oddielov",
+    "headerData": "Údaje",
+    "headerUseCase": "Prípad použitia",
+    "rows": [
+      {
+        "mode": "1. Vymazať všetko",
+        "part": "Zničené",
+        "data": "Vymazané podpisy",
+        "useCase": "Odstráni tabuľku oddielov a metadáta súborových systémov a RAID, vynuluje prvých a posledných 16 MiB a na diskoch s podporou discard vykoná TRIM celého disku. Ostatné dáta sa neprepíšu a na HDD môžu byť stále obnoviteľné; nejde o bezpečné vymazanie."
+      },
+      {
+        "mode": "2. Odstrániť značky FS",
+        "part": "Zachované",
+        "data": "Zachované",
+        "useCase": "Odstráni staré podpisy ZFS / LVM / RAID, aby sa disk automaticky nepreberal. Používateľské dáta sa plošne neprepisujú, no odstránenie podpisov ich môže zneprístupniť."
+      },
+      {
+        "mode": "3. Prepísať dáta nulami",
+        "part": "Zachované",
+        "data": "Zničené (prepísané nulami)",
+        "useCase": "Prepíše existujúce oddiely nulami a zachová tabuľku oddielov. Nezahŕňa nepridelené miesto ani rezervné oblasti SSD; nezaručuje úplné bezpečné vymazanie zariadenia."
+      },
+      {
+        "mode": "4. Úplné formátovanie",
+        "part": "Nová GPT",
+        "data": "Zničené",
+        "useCase": "Disk pripravený na použitie s jednou novou partíciou a novým súborovým systémom."
+      }
+    ],
+    "fullFormatOutro": "<strong>Úplné formátovanie</strong> pokračuje dvoma ďalšími dialógmi:",
+    "fullFormatItems": [
+      "<strong>Súborový systém</strong>: <code>ext4</code>, <code>xfs</code>, <code>exfat</code> (prenosný) alebo <code>btrfs</code>. Ak chýbajú nástroje, napríklad <code>mkfs.btrfs</code>, operácia sa preruší s jasnou správou.",
+      "<strong>Menovka</strong>: voliteľná menovka súborového systému na jeho identifikáciu."
+    ]
+  },
+  "steps": {
+    "heading": "Krok za krokom",
+    "stepLabel": "Krok",
+    "list": [
+      {
+        "title": "Vyberte si voľný disk",
+        "body": "ProxMenux uvádza zoznam všetkých diskov, ktoré vyhovujú vyššie uvedeným filtrom viditeľnosti. Disky so značkami ⚠ nesú neaktuálne metadáta a zobrazujú sa s podrobnosťami, aby ste vedeli, čo sa chystáte prepísať."
+      },
+      {
+        "title": "Vybrať operačný režim",
+        "bodyRich": "Podľa tabuľky vyberte <strong>Vymazať všetko</strong>, <strong>Odstrániť značky FS</strong>, <strong>Prepísať dáta nulami</strong> alebo <strong>Úplné formátovanie</strong>."
+      },
+      {
+        "title": "(iba celý formát) Vyberte súborový systém a popis",
+        "body": "ext4 / xfs / exfat / btrfs, plus voliteľný štítok."
+      },
+      {
+        "title": "Potvrdiť dvakrát",
+        "bodyRich": "ProxMenux zobrazí prehľad plánovanej operácie. Potvrdíte dialóg áno/nie a <strong>zadáte celú cestu k disku</strong> presne podľa zobrazenia, napríklad <code>/dev/sdc</code>. Iný vstup operáciu zruší."
+      },
+      {
+        "title": "Opätovné overenie a vykonanie",
+        "body": "Tesne pred zápisom skript znova overí stav disku. Ak sa medzitým pripojil oddiel alebo spustila VM, vykonávanie sa preruší. Inak prebehne zvolená operácia a na konci sa zobrazí prehľad."
+      }
+    ]
+  },
+  "manual": {
+    "heading": "Ručné ekvivalenty",
+    "body": "Ak chcete spustiť rovnocenné príkazy ručne:"
+  },
+  "troubleshoot": {
+    "notListedTitle": "Disk nie je uvedený v menu",
+    "notListedBody": "Disk bol z bezpečnostných dôvodov skrytý. Časté dôvody: je pripojený, aj pod <code>/mnt/tmp</code>, je aktívnym členom ZFS/LVM/RAID, je uvedený v konfigurácii VM/LXC alebo ide o koreňový disk Proxmox. Na hostiteľovi spustite <code>lsblk -f</code> a <code>cat /proc/mdstat</code> na zistenie dôvodu.",
+    "busyTitle": "\"Disk may be busy\" / odpojenie zlyhalo",
+    "busyBody": "Niektorý proces stále drží otvorený súbor na oddiele tohto disku, najčastejšie kontajner alebo shell s pracovným adresárom v bode pripojenia. Zistite ho pomocou <code>lsof | grep /dev/sdX</code> alebo <code>fuser -vm /dev/sdX1</code>, zastavte ho a znova spustite nástroj."
+  },
+  "related": {
+    "heading": "Súvisiace",
+    "items": [
+      {
+        "href": "/docs/disk-manager/smart-disk-test",
+        "label": "SMART Zdravie a test disku",
+        "tail": " — skontrolovať stav disku pred vymazaním alebo po ňom."
+      },
+      {
+        "href": "/docs/disk-manager/import-disk-vm",
+        "label": "Importovať disk do VM",
+        "tail": " — priradiť čerstvo naformátovaný disk VM."
+      },
+      {
+        "href": "/docs/storage-share/host-local-disk",
+        "label": "Pridať lokálny disk ako Proxmox úložisko",
+        "tail": "— zaregistrujte vymazaný disk ako úložisko Proxmox pool."
+      },
+      {
+        "href": "/docs/help-info/storage-commands",
+        "label": "Príkazy pre úložiská a disky",
+        "tail": " — prehľad príkazov lsblk, blkid a parted."
+      },
+      {
+        "href": "/docs/disk-manager",
+        "label": "Prehľad správcu diskov",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sk/docs/disk-manager/import-disk-image-vm.json b/web/messages/sk/docs/disk-manager/import-disk-image-vm.json
new file mode 100644
index 00000000..d3d580bf
--- /dev/null
+++ b/web/messages/sk/docs/disk-manager/import-disk-image-vm.json
@@ -0,0 +1,110 @@
+{
+  "meta": {
+    "title": "Importovať obraz disku do VM | Dokumentácia ProxMenux",
+    "description": "Import súboru obrazu disku (.img / .qcow2 / .vmdk / .raw) do existujúcej VM Proxmox pomocou ProxMenux. Rozhranie, emulácia SSD a príznak spúšťacieho disku sa nastavujú pre každý obraz; na pozadí sa používa qm importdisk.",
+    "ogTitle": "Importovať obraz disku do VM | Dokumentácia ProxMenux",
+    "ogDescription": "Importovať .img / .qcow2 / .vmdk / .raw diskové snímky do existujúceho VM s ProxMenux. Používa qm importdisk pod kapotou."
+  },
+  "header": {
+    "title": "Importovať obraz disku do VM",
+    "description": "Importujte súbor obrazu disku (.img, .qcow2, .vmdk alebo .raw) do existujúcej VM Proxmox. ProxMenux najprv zhromaždí všetky voľby: cieľovú VM, úložisko Proxmox, zdrojový adresár, rozhranie, emuláciu SSD a poradie spúšťania. Potom spustí qm importdisk pre každý vybraný obraz.",
+    "section": "Správca disku · VM"
+  },
+  "intro": {
+    "title": "Čo to robí?",
+    "body": "Na rozdiel od <em>Importovať disk do VM</em>, ktorý pripája fyzický disk priamo, tento postup používa <strong>súbor</strong> na hostiteľovi: exportovaný z iného hypervízora, stiahnutý ako cloudový obraz alebo extrahovaný zo zálohy. Prevedie ho na disk VM Proxmox na zvolenom úložisku. Pôvodný súbor zostáva zachovaný; ProxMenux ho skopíruje, nepresunie."
+  },
+  "howRuns": {
+    "heading": "Ako beží skript",
+    "body": "Postup má dve fázy. Prvá zhromaždí cez dialógy všetky voľby: VM, úložisko, zdrojový adresár, obrazy a možnosti pre každý obraz. Druhá spustí <code>qm importdisk</code> pre každý vybraný obraz. Kým sa druhá fáza nezačne, nič sa nekopíruje a konfigurácia VM sa nemení."
+  },
+  "prereqs": {
+    "heading": "Predpoklady",
+    "items": [
+      "Na hostiteľovi je definovaná aspoň jedna VM. Cieľová VM by mala byť <strong>vypnutá</strong>.",
+      "V zdrojovom adresári je aspoň jeden súbor obrazu v podporovanom formáte: <code>.img</code>, <code>.qcow2</code>, <code>.vmdk</code>, <code>.raw</code>.",
+      "Na cieľovom úložisku Proxmox je dosť voľného miesta pre všetky importované disky.",
+      "ProxMenux štandardne hľadá obrazy v <code>/var/lib/vz/template/iso</code>. Po výzve môžete zadať aj iný adresár na hostiteľovi."
+    ]
+  },
+  "steps": {
+    "heading": "Krok za krokom",
+    "stepLabel": "Krok",
+    "list": [
+      {
+        "title": "Vyberte cieľovú VM",
+        "bodyRich": "ProxMenux načíta <code>qm list</code> a zobrazí všetky VM. Vyberte tú, ktorá dostane importované disky."
+      },
+      {
+        "title": "Vyberte Proxmox úložisko",
+        "bodyRich": "Zoznam obsahuje všetky úložiská s povoleným typom obsahu <code>images</code>. Ak je dostupné iba jedno, vyberie sa automaticky a dialóg sa preskočí."
+      },
+      {
+        "title": "Vyberte zdrojový adresár",
+        "bodyRich": "Vyberte predvolený adresár (<code>/var/lib/vz/template/iso</code>) alebo zadajte vlastnú cestu, zvyčajne tam, kde ste obraz stiahli alebo nahrali. Skript odmietne neexistujúce cesty."
+      },
+      {
+        "title": "Vybrať jeden alebo viac obrazov",
+        "bodyRich": "V adresári sa vyhľadajú súbory <code>.img</code> / <code>.qcow2</code> / <code>.vmdk</code> / <code>.raw</code>. Možno ich vybrať viac naraz; v ďalšom kroku sa pre každý obraz nastavia samostatné voľby."
+      },
+      {
+        "title": "Možnosti pre jednotlivé obrazy",
+        "intro": "Pre každý vybraný obraz sa ProxMenux opýta:",
+        "items": [
+          "<strong>Rozhranie</strong> — <code>scsi</code> (predvolené), <code>virtio</code>, <code>sata</code> alebo <code>ide</code>. Zhoduje sa s tým, ako hosť uvidí disk.",
+          "<strong>Emulácia SSD</strong>: ponúka sa iba pre rozhrania iné než VirtIO. Pridá <code>ssd=1</code>, aby hosť rozpoznal disk SSD. Podporu discard/TRIM treba nastaviť samostatne.",
+          "<strong>Spúšťací</strong>: pri voľbe áno ProxMenux pridá disk do poradia spúšťania ako hlavné spúšťacie zariadenie VM."
+        ]
+      },
+      {
+        "title": "Importovať a pripojiť",
+        "bodyRich": "ProxMenux spustí <code>qm importdisk</code> pre každý obraz a podľa potreby skonvertuje formát. Výsledný disk pripojí na ďalší voľný slot (<code>scsiN</code>, <code>sataN</code>, …) so zvolenými možnosťami. Ak ste označili niektorý disk ako spúšťací, aktualizuje poradie spúšťania. Priebeh sa zobrazuje v termináli."
+      }
+    ]
+  },
+  "manual": {
+    "heading": "Ručný ekvivalent",
+    "body": "Import jedného obrazu zodpovedá trom príkazom <code>qm</code>:",
+    "warnTitle": "Konverzia formátu obrazu",
+    "warnBody": "Ak cieľové úložisko nemôže držať zdrojový formát natívne (napríklad LVM úložisko nemôže držať <code>.qcow2</code>), <code>qm importdisk</code> konvertuje obraz transparentne. To môže trvať niekoľko minút pre viac-GB snímky; podľa toho plán a neprerušujte skript."
+  },
+  "troubleshoot": {
+    "heading": "Riešenie problémov",
+    "noImagesTitle": "\"Nenájdené žiadne kompatibilné obrazy disku\"",
+    "noImagesBody": "Skript prehľadal adresár, ale nenašiel žiadny súbor <code>.img</code> / <code>.qcow2</code> / <code>.vmdk</code> / <code>.raw</code>. Skontrolujte príponu (rozlišujú sa veľké a malé písmená), či je súbor priamo vo vybranom adresári (podadresáre sa neprehľadávajú) a či ho root môže čítať.",
+    "slowTitle": "Import je pomalý",
+    "slowBody": "Konverzie medzi VMDK, QCOW2 a raw môžu byť obmedzené CPU a vstupom/výstupom. Rýchlosť závisí od čítania zdroja, zápisu na cieľ a prípadnej dekompresie. Ak je to možné, uprednostnite zdroje raw alebo qcow2.",
+    "uefiTitle": "Importovaný disk sa spustí do UEFI shellu",
+    "uefiBody": "Obraz bol vytvorený pre starší režim (SeaBIOS), ale VM používa OVMF alebo naopak. Prepnite BIOS VM v Proxmox podľa obrazu alebo obraz pred importom znova vytvorte v správnom režime."
+  },
+  "related": {
+    "heading": "Súvisiace",
+    "items": [
+      {
+        "href": "/docs/disk-manager/import-disk-vm",
+        "label": "Importovať disk do VM",
+        "tail": " — rovnaký postup pre fyzické disky (passthrough)."
+      },
+      {
+        "href": "/docs/utils/import-vm",
+        "label": "Importovať VM z OVA / OVF",
+        "tail": " — keď máte kompletný balík VM, nielen obraz disku."
+      },
+      {
+        "href": "/docs/utils/UUp-Dump-ISO-Creator",
+        "label": "Tvorba ISO cez UUP Dump",
+        "tail": " — vytvoriť ISO Windows pre novú inštaláciu."
+      },
+      {
+        "href": "/docs/help-info/storage-commands",
+        "label": "Príkazy pre úložiská a disky",
+        "tail": " — prehľad príkazov qm importdisk a qemu-img convert."
+      },
+      {
+        "href": "/docs/disk-manager",
+        "label": "Prehľad správcu diskov",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sk/docs/disk-manager/import-disk-lxc.json b/web/messages/sk/docs/disk-manager/import-disk-lxc.json
new file mode 100644
index 00000000..408e34dc
--- /dev/null
+++ b/web/messages/sk/docs/disk-manager/import-disk-lxc.json
@@ -0,0 +1,115 @@
+{
+  "meta": {
+    "title": "Importovať disk do LXC | ProxMenux Dokumentácia",
+    "description": "Pripojte fyzický disk k existujúcemu kontajneru LXC v Proxmox VE pomocou ProxMenux. Zabezpečí rozpoznanie a formátovanie súborového systému, bod pripojenia, konverziu z neprivilegovaného na privilegovaný kontajner a trvalé cesty zariadení.",
+    "ogTitle": "Importovať disk do LXC | ProxMenux Dokumentácia",
+    "ogDescription": "Pripojte fyzický disk k existujúcemu kontajneru LXC. Zabezpečí súborový systém, bod pripojenia a konverziu z neprivilegovaného na privilegovaný kontajner."
+  },
+  "header": {
+    "title": "Importovať disk do LXC",
+    "description": "Pripojte fyzický disk k existujúcemu LXC kontajneru na Proxmox hostiteľa. ProxMenux detekuje voľné disky, voliteľne ich formátuje podporovaným súborovým systémom a prepojí partíciu na bod pripojenia vo vnútri kontajnera pomocou trvalých trás zariadenia.",
+    "section": "Správca disku · LXC"
+  },
+  "intro": {
+    "title": "Passthrough vo VM a v LXC",
+    "body": "Tento passthrough LXC <strong>neposkytuje priamo blokové zariadenie</strong>. Kontajner dostane <em>bod pripojenia</em>, teda adresár na vybranom oddiele hostiteľa. Na rozdiel od VM používa jadro hostiteľa, preto súborový systém (ext4/xfs/btrfs) číta a spravuje hostiteľ Proxmox a následne ho sprístupní kontajneru."
+  },
+  "howRuns": {
+    "heading": "Ako beží skript",
+    "body": "Postup má dve oddelené fázy: zhromaždenie informácií a volieb, potom samotnú zmenu konfigurácie kontajnera. Až do záverečného potvrdenia sa v CT nič nepripája.",
+    "summary": "ProxMenux skryje koreňový disk, pripojené disky a disky uvedené v konfiguráciách VM/LXC. Aktívni členovia ZFS/LVM/RAID sú skrytí; staré podpisy sú označené ⚠, aby ste ich mohli pred formátovaním vymazať."
+  },
+  "prereqs": {
+    "heading": "Predpoklady",
+    "items": [
+      "Aspoň jeden kontajner LXC definovaný na hostiteľovi.",
+      "Kontajner je <strong>privilegovaný</strong>, alebo akceptujete ponuku skriptu na jeho konverziu.",
+      "Aspoň jeden fyzický disk nepoužívaný hostiteľom alebo iným hosťom."
+    ],
+    "warnTitle": "Požadovaný privilegovaný kontajner",
+    "warnBody": "Tento skript vyžaduje na priame pripojenie disku <strong>privilegovaný</strong> kontajner. Ak nájde <code>unprivileged: 1</code>, ponúkne priamu úpravu <code>/etc/pve/lxc/&lt;CTID&gt;.conf</code>. Zmení sa bezpečnostný model, ale vlastníctvo existujúcich súborov sa nepremapuje. Pred prijatím kontajner zálohujte a overte vlastníctvo alebo ho znova vytvorte ako privilegovaný."
+  },
+  "steps": {
+    "heading": "Krok za krokom",
+    "stepLabel": "Krok",
+    "list": [
+      {
+        "title": "Vybrať cieľový kontajner",
+        "img": "/disk/select-container.png",
+        "caption": "Výberové menu kontajnera",
+        "bodyRich": "ProxMenux uvádza každý LXC kontajner na hostiteľa (<code>pct list</code>). Vyberte ten, ktorý dostane disk. Ak je kontajner neprivilegovaný, ponúka sa mu konvertovať teraz."
+      },
+      {
+        "title": "Vyberte fyzický disk",
+        "img": "/disk/disk-selection-ct.png",
+        "caption": "Voľné disky na hostiteľovi, s označením ⚠ pre staré metadáta",
+        "bodyRich": "Zobrazia sa iba bezpeční kandidáti. Na rozdiel od postupu pre VM tento skript pripojí <strong>jeden disk na spustenie</strong>. Pre každý ďalší disk ho spustite znova."
+      },
+      {
+        "title": "Formátovať alebo znova použiť",
+        "intro": "Skript kontroluje disk:",
+        "items": [
+          "Ak už obsahuje podporovaný súborový systém (ext4/xfs/btrfs), možno ho použiť bez zmeny; existujúce súbory sa zachovajú.",
+          "Ak disk nemá podporovaný súborový systém, ponúkne sa formátovanie. Vyberte ext4/xfs/btrfs."
+        ]
+      },
+      {
+        "title": "Vyberte bod pripojenia",
+        "bodyRich": "Zadajte cestu, kde má kontajner vidieť disk, napríklad <code>/mnt/data</code> alebo <code>/mnt/disk_passthrough</code>. Ide o cestu <em>vnútri</em> kontajnera; hostiteľ už vidí oddiel pod <code>/dev/disk/by-id/…</code>."
+      },
+      {
+        "title": "Pripojiť a overiť",
+        "img": "/disk/assignment-ct.png",
+        "caption": "Priradenie ku CT",
+        "bodyRich": "ProxMenux pridá do konfigurácie kontajnera nový záznam <code>mpN:</code>, pričom preskočí už použité indexy. Potom konfiguráciu znovu načíta a overí. Ak kontajner beží, pripojenie sa vykoná za behu; inak sa uplatní pri ďalšom spustení.",
+        "extraImg": "/disk/result-point.png",
+        "extraAlt": "Bod pripojenia vytvorený úspešne",
+        "extraCaption": "Bod pripojenia vytvorený a overený"
+      }
+    ]
+  },
+  "manual": {
+    "heading": "Ručný ekvivalent",
+    "body": "Skript používa <code>pct set</code>. Priamy príkaz pre jeden disk vyzerá takto:"
+  },
+  "important": {
+    "heading": "Dôležité úvahy",
+    "items": [
+      "<strong>Jeden disk na spustenie</strong>. Znova spustite skript pre každý ďalší disk.",
+      "<strong>Nepripájajte</strong> rovnaký oddiel k viacerým kontajnerom, ktoré by ho mohli pripojiť súčasne; súbežné zápisy poškodia súborový systém.",
+      "<strong>Staré metadáta</strong> (podpisy RAID / ZFS / LVM) sa musia manuálne vymazať skôr, ako vám skript umožní formátovanie, inak <code>mkfs</code> odmietne prepísať. Použite na to nástroj <wipeLink>Formátovanie / vymazanie fyzického disku</wipeLink>."
+    ]
+  },
+  "troubleshoot": {
+    "heading": "Riešenie problémov",
+    "unprivTitle": "\"Nemôže pokračovať s neprivilegovaným kontajnerom\"",
+    "unprivBody": "Odmietli ste konverziu, takže skript skončil bez akejkoľvek zmeny. Ak chcete pokračovať, spustite ho znova a súhlaste: skript zastaví kontajner, zálohuje jeho konfiguráciu do <code>/etc/pve/lxc/&lt;CTID&gt;.conf.bak</code> a nahradí <code>unprivileged: 1</code> hodnotou <code>unprivileged: 0</code>. Samotná zmena neprevedie vlastníctvo UID/GID existujúcich súborov; preto kontajner najprv zálohujte a upravte vlastníkov, prípadne ho obnovte alebo znova vytvorte ako privilegovaný.",
+    "permsTitle": "Práva vnútri kontajnera sú nesprávne",
+    "permsBody": "Pri pripojení oddielu do privilegovaného kontajnera sa zachová existujúce vlastníctvo súborov; nový súborový systém často patrí <code>root:root</code>. Ak služba beží pod iným používateľom, napríklad <code>www-data</code> pri Nextcloude, overte UID/GID a upravte potrebné súbory pomocou <code>chown</code>/<code>chmod</code>. Zmeny ovplyvnia aj podkladový disk."
+  },
+  "related": {
+    "heading": "Súvisiace",
+    "items": [
+      {
+        "href": "/docs/disk-manager/import-disk-vm",
+        "label": "Importovať disk do VM",
+        "tail": " — rovnaký postup pre VM."
+      },
+      {
+        "href": "/docs/storage-share/lxc-mount-points",
+        "label": "LXC mount pointy (Host ↔ CT)",
+        "tail": " Zdieľať adresáre hostiteľa s CT namiesto pripojenia celého disku."
+      },
+      {
+        "href": "/docs/help-info/vm-ct-commands",
+        "label": "Príkazy na správu VM a CT",
+        "tail": " — prehľad príkazov pct config / push / pull."
+      },
+      {
+        "href": "/docs/disk-manager",
+        "label": "Prehľad správcu diskov",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sk/docs/disk-manager/import-disk-vm.json b/web/messages/sk/docs/disk-manager/import-disk-vm.json
new file mode 100644
index 00000000..820e6983
--- /dev/null
+++ b/web/messages/sk/docs/disk-manager/import-disk-vm.json
@@ -0,0 +1,113 @@
+{
+  "meta": {
+    "title": "Importovať disk do VM | ProxMenux Dokumentácia",
+    "description": "Pripojte fyzický disk na existujúci Proxmox VM s ProxMenux. Bezpečná detekcia disku (okrem systému, namontovaných, používaných, ZFS/RAID/LVM), perzistentných ciest /dev/disk/by-id a SATA / SCSI / VirtIO / IDE rozhraní.",
+    "ogTitle": "Importovať disk do VM | ProxMenux Dokumentácia",
+    "ogDescription": "Pripojte fyzický disk na existujúci Proxmox VM. Používa perzistentné cesty /dev/disk/by-id a podporuje SATA / SCSI / VirtIO / IDE."
+  },
+  "header": {
+    "title": "Importovať disk do VM",
+    "description": "Pripojte fyzický disk, ktorý už existuje na Proxmox hostiteľa k existujúcemu virtuálnemu stroju. ProxMenux detekuje voľné disky, umožňuje vám vybrať cieľovú VM, typ zbernice (SATA / SCSI / VirtIO / IDE) a pripojí všetko pomocou perzistentných ciest /dev/disk/by-id, takže mapovanie prežije reštarty a zmeny v poradí zariadenia.",
+    "section": "Správca disku · VM"
+  },
+  "intro": {
+    "title": "Čo to robí?",
+    "body": "Fyzický disk sa pripojí ako podkladové zariadenie rozhrania virtuálneho disku. Hosť automaticky nedostane natívne SMART dáta ani funkcie fyzického radiča; ak ich potrebujete, použite PCI passthrough radiča. Disk sa pripája cez svoju cestu <code>/dev/disk/by-id/…</code>, ak existuje, takže zmena poradia zariadení pri štarte nenaruší priradenie; inak sa použije <code>/dev/sdX</code>."
+  },
+  "howRuns": {
+    "heading": "Ako beží skript",
+    "body": "Postup má dve oddelené fázy: zhromaždenie informácií a volieb, potom samotné pripojenie diskov k VM. Až do záverečného potvrdenia sa konfigurácia VM nemení.",
+    "summary": "ProxMenux filtruje všetko, čo nemôže bezpečne prejsť: koreňový disk, disky pripojené k hostiteľovi, členovia aktívneho ZFS/LVM/RAID pool a disky, na ktoré už odkazujú VM/LXC konfigurácia. Disky s <em>zastaranými</em> metadátami (staré ZFS / RAID / LVM podpisy, ktoré sa už nepoužívajú) sú zobrazené s označením ⚠, ale nie sú blokované."
+  },
+  "prereqs": {
+    "heading": "Predpoklady",
+    "items": [
+      "Aspoň jeden VM definovaný na hostiteľovi (skript odosiela priamo do <code>qm list</code>).",
+      "<strong>Cieľová VM je vypnutá</strong>. Ak beží, skript sa preruší so správou; pridávanie diskov za behu nie je súčasťou tohto postupu.",
+      "Aspoň jeden fyzický disk na hostiteľa, ktorý nie je v prevádzke hostiteľom alebo iným hosťom."
+    ]
+  },
+  "steps": {
+    "heading": "Krok za krokom",
+    "stepLabel": "Krok",
+    "list": [
+      {
+        "title": "Vyberte cieľovú VM",
+        "bodyRich": "ProxMenux vypíše všetky VM hostiteľa cez <code>qm list</code>. Vyberte tú, ktorej chcete pripojiť disk. Ak beží, skript sa preruší a vyžiada si jej vypnutie."
+      },
+      {
+        "title": "Vybrať fyzické disky na pripojenie",
+        "img": "/disk/disk-selection.png",
+        "caption": "Voľné disky na hostiteľovi, s označením ⚠ pre staré metadáta",
+        "body": "Skript prehľadá každý hostiteľský disk a zobrazí len tie, ktoré je možné bezpečne pripojiť. Kontrolný zoznam vám umožňuje vybrať jeden alebo niekoľko naraz. Disky so starými ZFS / LVM / RAID signatúrami sa stále zobrazujú a sú označené ⚠, takže viete, že je potrebné ich vymazať, aby ich hosť mohol naformátovať."
+      },
+      {
+        "title": "Vyberte rozhranie zbernice",
+        "img": "/disk/disk-assigment.png",
+        "caption": "Výber rozhrania zbernice",
+        "intro": "Vyberte si, ako by mal hosť vidieť disk:",
+        "items": [
+          "<strong>SCSI</strong>: moderná predvolená voľba pre Linux a Windows s nainštalovanými ovládačmi VirtIO-SCSI.",
+          "<strong>SATA</strong>: široká kompatibilita, funguje bez ďalších ovládačov takmer v každom hosťovi.",
+          "<strong>VirtIO</strong>: efektívne paravirtualizované blokové zariadenie; vyžaduje ovládače v hosťovi.",
+          "<strong>IDE</strong>: pre staršie hosťovské systémy, ktorým chýbajú uvedené ovládače."
+        ]
+      },
+      {
+        "title": "Pripojiť a overiť",
+        "bodyRich": "ProxMenux pripojí každý vybraný disk cez najvhodnejšiu cestu <code>/dev/disk/by-id/</code>, preskočí už obsadené sloty konfigurácie VM (<code>scsi0</code>, <code>sata0</code>, …) a znova načíta konfiguráciu na overenie priradenia. Na konci zobrazí prehľad."
+      }
+    ]
+  },
+  "manual": {
+    "heading": "Ručný ekvivalent",
+    "body": "Scenár je obal okolo <code>qm set</code>. Presný príkaz pre jeden disk vyzerá takto:",
+    "migrationTitle": "Živá migrácia nie je možná",
+    "migrationBody": "VM s priamo pripojeným fyzickým diskom je <strong>viazaná na hostiteľa, ktorý disk sprístupňuje</strong>. Iný uzol zvyčajne nemá rovnakú cestu <code>/dev/disk/by-id/…</code> ani dáta disku. Zálohujte a preneste dáta samostatne alebo použite spravované virtuálne disky na zdieľanom či podporovanom replikovanom úložisku. Nepredpokladajte, že replikácia Proxmox zahŕňa toto zariadenie.",
+    "shareTitle": "Nezdieľať fyzický disk medzi VM",
+    "shareBody": "Pripojenie rovnakého fyzického disku k dvom VM súčasne skazí dáta pri ďalšom zápise. ProxMenux detekuje túto situáciu a blokuje ju, ale ak obídete skript (direct <code>qm set</code>), uistite sa, že len jeden hosť niekedy pripojí disk."
+  },
+  "troubleshoot": {
+    "heading": "Riešenie problémov",
+    "noDisksTitle": "\"Nie sú k dispozícii disky pre tento VM\"",
+    "noDisksIntro": "Skript našiel disky, ale každý kandidát bol odfiltrovaný. Časté dôvody:",
+    "noDisksItems": [
+      "Každý zostávajúci disk je už uvedený v cieľovom VM konfigurácii.",
+      "Každý zostávajúci disk je namontovaný na hostiteľa alebo je súčasťou aktívneho ZFS / LVM / RAID.",
+      "Hostiteľ má nainštalovaný iba koreňový disk."
+    ],
+    "noDisksOutro": "Spustite <code>lsblk -f</code> na hostiteľa skontrolovať stav každého disku.",
+    "noVisibleTitle": "VM nevidí disk po štarte",
+    "noVisibleBody": "Pri <strong>SCSI</strong> alebo <strong>VirtIO</strong> hosť potrebuje príslušný ovládač. Linux ho má v jadre; vo Windowse ho nainštalujte z VirtIO ISO (pozrite <winLink>Vytvoriť VM: Windows</winLink>). Prepnutie na SATA na karte Hardvér VM je rýchly test priradenia disku."
+  },
+  "related": {
+    "heading": "Súvisiace",
+    "items": [
+      {
+        "href": "/docs/disk-manager/import-disk-image-vm",
+        "label": "Importovať obraz disku do VM",
+        "tail": " — rovnaký postup pre súbory obrazov (qcow2 / vmdk / raw / img)."
+      },
+      {
+        "href": "/docs/disk-manager/import-disk-lxc",
+        "label": "Importovať disk do LXC",
+        "tail": " — rovnaký postup pre kontajnery LXC."
+      },
+      {
+        "href": "/docs/disk-manager/add-controller-nvme-vm",
+        "label": "Pridať radič alebo NVMe do VM",
+        "tail": " — ak potrebujete úplný PCIe/NVMe passthrough namiesto pripojenia disku."
+      },
+      {
+        "href": "/docs/help-info/storage-commands",
+        "label": "Príkazy pre úložiská a disky",
+        "tail": " — prehľad qm importdisk a súvisiacich príkazov shellu."
+      },
+      {
+        "href": "/docs/disk-manager",
+        "label": "Prehľad správcu diskov",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sk/docs/disk-manager/index.json b/web/messages/sk/docs/disk-manager/index.json
new file mode 100644
index 00000000..7d892d90
--- /dev/null
+++ b/web/messages/sk/docs/disk-manager/index.json
@@ -0,0 +1,135 @@
+{
+  "meta": {
+    "title": "Správca diskov Proxmox: VM/LXC, testy SMART a mazanie | ProxMenux",
+    "description": "Spravujte fyzické disky hostiteľa Proxmox VE pomocou ProxMenux: pripájajte disky k VM alebo LXC (qm set scsi/sata/virtio, pct mp), importujte obrazy img / qcow2 / vmdk / raw, priraďujte celé HBA alebo radiče NVMe, mažte disky s bezpečnostnými kontrolami a spúšťajte testy SMART.",
+    "ogTitle": "Správca diskov Proxmox: VM/LXC, testy SMART a mazanie",
+    "ogDescription": "Pripájajte disky k VM/LXC, importujte obrazy, priraďujte radiče cez PCI passthrough, mažte s bezpečnostnými kontrolami a spúšťajte testy SMART v Proxmox VE.",
+    "twitterTitle": "Správca diskov Proxmox | ProxMenux",
+    "twitterDescription": "Pripojenie diskov k VM/LXC, import obrazov, PCI passthrough, mazanie s bezpečnostnými kontrolami a testy SMART."
+  },
+  "header": {
+    "title": "Správca diskov",
+    "description": "Ponuka Správca diskov združuje nástroje ProxMenux na správu fyzických diskov hostiteľa: pripojenie k VM a LXC, import obrazov diskov, passthrough celého radiča alebo zariadenia NVMe, mazanie s bezpečnostnými kontrolami a testy SMART.",
+    "section": "Správca diskov"
+  },
+  "intro": {
+    "title": "Na čo je toto menu",
+    "body": "Nástroje pracujú s <strong>fyzickými diskami viditeľnými pre hostiteľa Proxmox a súbormi obrazov uloženými na ňom</strong>. Sú rozdelené do troch skupín: <strong>VM</strong> (pripojenie diskov alebo import obrazov), <strong>LXC</strong> (pripojenie diskov ku kontajneru) a <strong>Nástroje</strong> (formátovanie a stav SMART). Pripájanie a mazanie skryje alebo zablokuje systémové a používané disky; SMART ich môže kontrolovať bez vymazania."
+  },
+  "opening": {
+    "heading": "Otvorenie menu",
+    "body": "V hlavnej ponuke ProxMenux vyberte <strong>Správca diskov</strong>. Zobrazí sa:",
+    "imageAlt": "Menu správcu diskov s VM, LXC a blokmi utilít"
+  },
+  "groups": {
+    "heading": "Tri skupiny nástrojov",
+    "intro": "Ponuka Disk Manager je organizovaná v troch skupinách <strong>VM</strong>, <strong>LXC</strong> a <strong>Nástroje</strong>. Kliknite na kartu pre skok priamo na nástroje v tejto skupine.",
+    "vmTitle": "VM",
+    "vmBody": "Nástroje pre existujúce virtuálne stroje. VM musí byť vypnutá; ProxMenux to overí pred zmenou konfigurácie.",
+    "vmItems": [
+      "Importovať disk do VM",
+      "Importovať obraz disku do VM",
+      "Pridať radič alebo NVMe do VM"
+    ],
+    "lxcTitle": "LXC",
+    "lxcBody": "Nástroje pre existujúce kontajnery LXC. Tento skript vyžaduje privilegovaný kontajner a podľa potreby ponúkne zmenu príznaku. Najprv si na stránke nástroja prečítajte upozornenia ku konverzii a vlastníctvu súborov.",
+    "lxcItems": [
+      "Importovať disk do LXC"
+    ],
+    "utilitiesTitle": "Nástroje",
+    "utilitiesBody": "Nástroje na strane hostiteľa, ktoré fungujú na samotných diskoch, nezávisle od akéhokoľvek VM alebo kontajnera.",
+    "utilitiesItems": [
+      "Formátovať / vymazať fyzický disk",
+      "SMART Zdravie a test disku"
+    ]
+  },
+  "vm": {
+    "heading": "VM",
+    "intro": "Nástroje pre existujúce virtuálne stroje. VM musí byť vypnutá; ProxMenux to overí pred zmenou konfigurácie.",
+    "options": [
+      {
+        "icon": "HardDrive",
+        "href": "/docs/disk-manager/import-disk-vm",
+        "title": "Importovať disk do VM",
+        "description": "Pripojte nepridelený fyzický disk na existujúci VM. Podporuje SATA / SCSI / VirtIO / IDE, používa trvalé cesty /dev/disk/by-id."
+      },
+      {
+        "icon": "FileDown",
+        "href": "/docs/disk-manager/import-disk-image-vm",
+        "title": "Importovať obraz disku do VM",
+        "description": "Import súborov obrazov disku (.img / .qcow2 / .vmdk / .raw) do existujúcej VM. Dvojfázový postup s qm importdisk na pozadí."
+      },
+      {
+        "icon": "Cpu",
+        "href": "/docs/disk-manager/add-controller-nvme-vm",
+        "title": "Pridať radič alebo NVMe do VM",
+        "description": "PCI priechod celého zariadenia SATA / SAS HBA alebo NVMe do zariadenia VM. Ovláda IOMMU a umožňuje odhaľovanie konfliktov."
+      }
+    ]
+  },
+  "lxc": {
+    "heading": "LXC",
+    "intro": "Nástroje pre existujúce kontajnery LXC. Tento skript vyžaduje privilegovaný kontajner a podľa potreby ponúkne zmenu príznaku. Najprv si na stránke nástroja prečítajte upozornenia ku konverzii a vlastníctvu súborov.",
+    "options": [
+      {
+        "icon": "Boxes",
+        "href": "/docs/disk-manager/import-disk-lxc",
+        "title": "Importovať disk do LXC",
+        "description": "Pripojí nepriradený fyzický disk k existujúcemu kontajneru LXC ako bod pripojenia. Zabezpečí rozpoznanie a formátovanie súborového systému aj zmenu na privilegovaný režim."
+      }
+    ]
+  },
+  "utilities": {
+    "heading": "Nástroje",
+    "intro": "Nástroje na strane hostiteľa, ktoré fungujú na samotných diskoch, nezávisle od akéhokoľvek VM alebo kontajnera.",
+    "options": [
+      {
+        "icon": "Eraser",
+        "href": "/docs/disk-manager/format-disk",
+        "title": "Formátovať / vymazať fyzický disk (bezpečne)",
+        "description": "Mazanie diskov s prísnymi bezpečnostnými kontrolami: zobrazia sa iba úplne voľné disky a vždy sa vyžaduje dvojité potvrdenie."
+      },
+      {
+        "icon": "Activity",
+        "href": "/docs/disk-manager/smart-disk-test",
+        "title": "SMART Zdravie a test disku",
+        "description": "Spustite SMART zdravotné kontroly a krátke / dlhé vlastné testy na SATA, SAS a NVMe disky. Exportuje JSON pre monitor."
+      }
+    ]
+  },
+  "safety": {
+    "title": "Bezpečnostné pravidlá pripájania a mazania diskov",
+    "intro": "Pripájanie a mazanie vylučuje zariadenia, ktoré by mohli poškodiť hostiteľa:",
+    "items": [
+      "<strong>systémový disk</strong> (koreňový pool, swap, aktívny ZFS / LVM členovia RAID) je vždy skrytý.",
+      "Disky <strong>pripojené</strong> kdekoľvek na hostiteľovi sa nezobrazia alebo sa ich použitie pri vykonávaní zablokuje.",
+      "Disky, na ktoré <strong>odkazuje spustená VM alebo LXC</strong>, nemožno priradiť inému hosťovi ani vymazať.",
+      "Operácie, ktoré môžu zmeniť hostiteľský stav (IOMMU povoliť, vymazať) vyžadujú explicitné potvrdenie."
+    ]
+  },
+  "related": {
+    "heading": "Súvisiace",
+    "items": [
+      {
+        "href": "/docs/storage-share",
+        "label": "Správca úložísk a zdieľania",
+        "tail": " Registrácia úložiska v Proxmoxe (NFS / Samba / iSCSI / miestne) a zdieľať priečinky medzi hostiteľom a CTs."
+      },
+      {
+        "href": "/docs/help-info/storage-commands",
+        "label": "Príkazy pre úložiská a disky",
+        "tail": " — prehľad blokových zariadení, LVM, pvesm a SMART."
+      },
+      {
+        "href": "/docs/help-info/zfs-commands",
+        "label": "Príkazy na správu ZFS",
+        "tail": " — pre pooly a datasety ZFS."
+      },
+      {
+        "href": "/docs/hardware/gpu-vm-passthrough",
+        "label": "Pridať GPU do VM (passthrough)",
+        "tail": " — rovnaké princípy IOMMU/VFIO použité pre GPU."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sk/docs/disk-manager/smart-disk-test.json b/web/messages/sk/docs/disk-manager/smart-disk-test.json
new file mode 100644
index 00000000..d186464f
--- /dev/null
+++ b/web/messages/sk/docs/disk-manager/smart-disk-test.json
@@ -0,0 +1,146 @@
+{
+  "meta": {
+    "title": "Stav a testy diskov SMART | Dokumentácia ProxMenux",
+    "description": "Kontroly stavu SMART a testy diskov v Proxmox VE pomocou ProxMenux. Podporuje SATA/SAS cez smartmontools a NVMe cez nvme-cli, krátke aj dlhé testy a export JSON pre ProxMenux Monitor.",
+    "ogTitle": "Stav a testy diskov SMART | Dokumentácia ProxMenux",
+    "ogDescription": "Kontroly stavu SMART a testy diskov SATA/SAS a NVMe v Proxmox. Export JSON pre Monitor."
+  },
+  "header": {
+    "title": "SMART Zdravie a test disku",
+    "description": "Čítajte dáta SMART a spúšťajte testy fyzických diskov hostiteľa Proxmox. ProxMenux automaticky nainštaluje smartmontools pre SATA/SAS a nvme-cli pre NVMe, spustí test vo firmvéri disku (dlhé testy pokračujú aj po zatvorení terminálu) a exportuje výsledky JSON pre ProxMenux Monitor.",
+    "section": "Správca diskov · Nástroje"
+  },
+  "intro": {
+    "title": "Načo to je?",
+    "body": "SMART (Self-Monitoring, Analysis and Reporting Technology) umožňuje disku hlásiť svoj stav a vykonávať vlastné testy. Nástroj zobrazí tieto dáta bez potreby pamätať si správne volanie <code>smartctl</code> alebo <code>nvme</code> a uloží výstup ako JSON, aby Monitor mohol zobrazovať vývoj v čase."
+  },
+  "howRuns": {
+    "heading": "Ako beží skript",
+    "body": "Všetky akcie sú nedeštruktívne: SMART číta počítadlá firmvéru disku a testy prebiehajú v samotnom disku. Nie je potrebné oddeľovať fázy. Postup: kontrola závislostí → výber disku → výber akcie → volanie nástroja smartctl alebo nvme-cli podľa typu disku → zobrazenie výstupu a export JSON pre Monitor."
+  },
+  "deps": {
+    "heading": "Závislosti",
+    "body": "Nástroj pri prvom spustení automaticky nainštaluje potrebné závislosti. Disky SATA / SAS používajú <code>smartmontools</code>, disky NVMe používajú <code>nvme-cli</code>. Oba balíky:"
+  },
+  "actions": {
+    "heading": "Dostupné opatrenia",
+    "headerAction": "Akcia",
+    "headerWhat": "Čo číta alebo spúšťa",
+    "headerDur": "Trvanie",
+    "rows": [
+      {
+        "action": "Rýchly zdravotný stav",
+        "whatRich": "Celkový stav PASSED/FAILED a kľúčové atribúty.<br /><code>smartctl -H</code> + <code>-A</code> (SATA/SAS) alebo <code>nvme smart-log</code> (NVMe).",
+        "dur": "Okamžite"
+      },
+      {
+        "action": "Úplná správa",
+        "whatRich": "Kompletné dáta SMART, posuvné. <code>smartctl -x</code> pre SATA/SAS alebo <code>nvme smart-log</code> + <code>id-ctrl</code> pre NVMe.",
+        "dur": "Okamžite"
+      },
+      {
+        "action": "Krátky test",
+        "what": "Základná kontrola povrchu a elektroniky vo firmvéri disku.",
+        "dur": "~2 minút"
+      },
+      {
+        "action": "Dlhá skúška",
+        "what": "Úplná kontrola povrchu. Beží na hardvéri disku a pokračuje aj po zatvorení terminálu.",
+        "dur": "Hodiny (od veľkosti disku závisí)"
+      },
+      {
+        "action": "Skontrolovať priebeh testu",
+        "what": "Stav aktívneho alebo posledného samotestu.",
+        "dur": "Okamžite"
+      }
+    ],
+    "tipTitle": "Dlhé testy pokračujú po zatvorení terminálu",
+    "tipBody": "Dlhý test beží <em>vnútri disku</em> a nezávisí od bežiaceho procesu ProxMenux. Terminál môžete zavrieť a neskôr použiť <strong>Skontrolovať priebeh testu</strong>. Reštart hostiteľa, reset radiča alebo výpadok napájania môže prerušiť test aj zber výsledkov; nepredpokladajte automatické pokračovanie."
+  },
+  "json": {
+    "heading": "Export JSON pre monitor",
+    "intro": "Akcie stavu, krátkeho testu a priebehu zapisujú JSON s časovou pečiatkou do <code>/usr/local/share/proxmenux/smart/&lt;disk&gt;/</code>; výsledky dlhého testu sa zbierajú na pozadí. Úplná správa sa iba zobrazí. Štruktúra je:",
+    "outro": "ProxMenux Monitor používa tieto súbory na zobrazenie vývoja stavu diskov. Staré súbory sa po dosiahnutí limitu uchovávania automaticky odstránia."
+  },
+  "steps": {
+    "heading": "Krok za krokom",
+    "stepLabel": "Krok",
+    "list": [
+      {
+        "title": "Vybrať disk",
+        "body": "ProxMenux vypíše všetky fyzické disky hostiteľa s modelom a veľkosťou. Na rozdiel od nástroja formátovania sa tu bezpečnostné filtre nepoužívajú, pretože čítanie SMART je nedeštruktívne.",
+        "img": "/disk/smart/disk-selection.png",
+        "alt": "Menu výberu disku SMART",
+        "caption": "Menu výberu disku SMART"
+      },
+      {
+        "title": "Vybrať akciu",
+        "body": "Vyberte rýchly stav, úplnú správu, krátky test, dlhý test alebo kontrolu priebehu. Ponuka zostane po každej akcii otvorená, aby ste mohli vykonať viac kontrol toho istého disku.",
+        "img": "/disk/smart/action-menu.png",
+        "alt": "Akčné menu SMART",
+        "caption": "Akčné menu SMART (5 akcie + zrušiť)"
+      },
+      {
+        "title": "(Iba dlhý test) Potvrdiť vykonávanie na pozadí",
+        "body": "ProxMenux upozorní, že test bude pokračovať po zatvorení terminálu, a zobrazí miesto uloženia výsledku JSON. Potvrdením spustíte test.",
+        "img": "/disk/smart/long-test-warning.png",
+        "alt": "Dialóg potvrdenia dlhého testu",
+        "caption": "Potvrdenie dlhého testu: beží na pozadí a výsledok sa uloží do JSON"
+      },
+      {
+        "title": "Skontrolovať výsledky",
+        "bodyRich": "Stav, testy a priebeh sa zobrazia v termináli; <strong>Úplná správa</strong> sa otvorí v posúvateľnom dialógu. JSON sa exportuje pri vyššie opísaných akciách, nie pri úplnej správe. Pri dlhých testoch neskôr použite <strong>Skontrolovať priebeh testu</strong> na rovnakom disku.",
+        "img": "/disk/smart/quick-status.png",
+        "alt": "Výstup rýchlej kontroly stavu",
+        "caption": "Rýchly prehľad stavu disku (SATA — smartctl -H + -A)"
+      }
+    ]
+  },
+  "manual": {
+    "heading": "Ručné ekvivalenty",
+    "nvmeWarnTitle": "Testy NVMe závisia od firmvéru disku",
+    "nvmeWarnBody": "Nie každý NVMe disk podporuje krátky/dlhý samotestový príkaz. Ak pohon odmietne test, log SMART a dáta ovládača ID (<code>nvme smart-log</code> + <code>id-ctrl</code>) sú stále najspoľahlivejším zdravotným signálom."
+  },
+  "troubleshoot": {
+    "heading": "Riešenie problémov",
+    "noSmartTitle": "\"Nepodarilo sa prečítať dáta SMART z /dev/sdX\"",
+    "noSmartBody": "Disk je pravdepodobne za radičom RAID/SAS, ktorý nesprístupňuje SMART. Pri kartách megaraid skúste <code>smartctl -d megaraid,N /dev/sdX</code>. Pri HBA v režime IT funguje priame volanie.",
+    "longTitle": "Dlhý test sa nikdy nedokončil",
+    "longBody": "Test beží vo firmvéri disku a vysoká záťaž ho môže spomaliť. Skúste pokojné obdobie, napríklad noc. Pri SATA zobrazí <code>smartctl -c</code> zostávajúce percento, pri SAS <code>smartctl -l selftest</code>; výsledok a prípadné chybné LBA nájdete v zázname testov. Chybu čítania treba preskúmať; pomalý priebeh sám osebe nedokazuje chybný sektor."
+  },
+  "related": {
+    "heading": "Súvisiace",
+    "items": [
+      {
+        "href": "/docs/disk-manager/format-disk",
+        "label": "Formátovať / vymazať fyzický disk",
+        "tail": " — znova použiť disk po overení jeho stavu."
+      },
+      {
+        "href": "/docs/help-info/storage-commands",
+        "label": "Príkazy pre úložiská a disky → Stav SMART",
+        "tail": " — prehľad smartctl/nvme s príkazmi na skopírovanie."
+      },
+      {
+        "href": "/docs/help-info/zfs-commands",
+        "label": "Príkazy na správu ZFS",
+        "tail": " — zpool scrub overuje kontrolné súčty dát ZFS a dopĺňa hardvérové testy SMART."
+      },
+      {
+        "href": "/docs/monitor/dashboard/storage",
+        "label": "ProxMenux Monitor — karta Úložisko",
+        "tail": " — podrobný pohľad na disk využívajúci exportovaný JSON: úplná tabuľka SMART, história a správa PDF."
+      },
+      {
+        "href": "/docs/monitor/dashboard/hardware",
+        "label": "ProxMenux Monitor — karta Hardvér",
+        "tail": " — prehľad úložiska s modelom, kapacitou a dohodnutou rýchlosťou spojenia (aktuálna a maximálna pri NVMe)."
+      },
+      {
+        "href": "/docs/disk-manager",
+        "label": "Prehľad správcu diskov",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sk/docs/external-repositories.json b/web/messages/sk/docs/external-repositories.json
new file mode 100644
index 00000000..0ba67861
--- /dev/null
+++ b/web/messages/sk/docs/external-repositories.json
@@ -0,0 +1,58 @@
+{
+  "meta": {
+    "title": "Externé repozitáre | Dokumentácia ProxMenuxu",
+    "description": "ProxMenux začleňuje vybrané externé repozitáre skriptov, napríklad community-scripts a ZimaOS, ako alternatívy v niektorých ponukách. Každý skript má jasne uvedený pôvod; chyby sa hlásia jeho pôvodnému správcovi.",
+    "ogTitle": "Externé repozitáre | Dokumentácia ProxMenuxu",
+    "ogDescription": "Externé repozitáre skriptov začlenené ako alternatívy v ponukách ProxMenuxu."
+  },
+  "header": {
+    "title": "Externé repozitáre",
+    "description": "ProxMenux začleňuje vybrané externé repozitáre skriptov ako alternatívy v niektorých častiach ponuky. Skripty pochádzajú z dôveryhodných zdrojov tretích strán a v ponuke je jasne uvedený ich pôvod.",
+    "section": "Externé repozitáre"
+  },
+  "practice": {
+    "title": "Čo to znamená v praxi",
+    "body": "Ak položka ponuky používa externý skript namiesto vlastného kódu ProxMenuxu, ponuka výslovne uvádza jeho pôvod a načítaný repozitár. ProxMenux skripty iba spúšťa, nemení ich. Chyby v ich fungovaní patria správcovi pôvodného repozitára, nie ProxMenuxu."
+  },
+  "integrated": {
+    "heading": "Aktuálne začlenené repozitáre",
+    "usedInLabel": "Použité v:",
+    "items": [
+      {
+        "name": "community-scripts / ProxmoxVE",
+        "url": "https://community-scripts.github.io/ProxmoxVE/",
+        "description": "Duchovný nástupca pomocných skriptov od ttecka. Rozsiahly katalóg skriptov na nasadenie LXC (Home Assistant, Plex, Frigate…), VM, doplnkov a úprav PVE jedným spustením.",
+        "usedIn": "Spúšťač Helper Scripts a Sieť (oprava offloadingu sieťovej karty Intel e1000e)"
+      }
+    ]
+  },
+  "attribution": {
+    "heading": "Uvedenie autorstva a uznanie",
+    "items": [
+      "Pôvodní autori sú vždy uvedení v ponuke aj na stránke dokumentácie k začlenenému skriptu.",
+      "Odkaz na zdrojový repozitár sa zobrazuje pred spustením skriptu aj na príslušnej stránke dokumentácie.",
+      "Vývojárov týchto externých projektov môžete podporiť hviezdičkou ⭐, sponzorstvom alebo kvalitnými hláseniami chýb."
+    ]
+  },
+  "report": {
+    "title": "Kde nahlásiť problémy s externými skriptmi",
+    "body": "Ak externý skript nefunguje podľa očakávania, <strong>nahláste to priamo v jeho repozitári</strong>, nie v ProxMenuxe. ProxMenux skript stiahne a spustí bez zmeny zdrojového kódu. Pôvodný správca môže chybu posúdiť a opraviť. Hlásenia pre ProxMenux sú určené na problémy so spúšťačom alebo so začlenením skriptu."
+  },
+  "suggest": {
+    "heading": "Navrhovanie nových externých repozitárov",
+    "intro": "Našli ste skript alebo repozitár, ktorý by sa hodil do ponuky ProxMenuxu? Navrhnite ho cez:",
+    "discussionTitle": "💬 Otvoriť diskusiu",
+    "discussionBody": "Vhodné pre nápady: získate spätnú väzbu komunity, skôr než z nich vznikne žiadosť o funkciu.",
+    "issueTitle": "🐛 Vytvoriť issue",
+    "issueBody": "Pre konkrétne žiadosti o funkcie s jasne určeným rozsahom."
+  },
+  "candidate": {
+    "title": "Čo robí dobrého kandidáta na integráciu",
+    "items": [
+      "Otvorený zdrojový kód a aktívny správca.",
+      "Idempotentný: možno ho bezpečne spustiť viackrát.",
+      "Nemení základnú konfiguráciu Proxmoxu bez upozornenia.",
+      "Rieši problém, ktorý ProxMenux ešte nepokrýva, a predchádza tak zdvojovaniu funkcií."
+    ]
+  }
+}
diff --git a/web/messages/sk/docs/glossary.json b/web/messages/sk/docs/glossary.json
new file mode 100644
index 00000000..ccfb3a68
--- /dev/null
+++ b/web/messages/sk/docs/glossary.json
@@ -0,0 +1,677 @@
+{
+  "meta": {
+    "title": "Slovník pojmov | Dokumentácia ProxMenux",
+    "description": "Definície pojmov používaných v dokumentácii ProxMenux: Proxmox, úložiská, siete a virtualizácia.",
+    "ogTitle": "Slovník pojmov | Dokumentácia ProxMenux",
+    "ogDescription": "Stručný prehľad pojmov"
+  },
+  "header": {
+    "title": "Slovník pojmov",
+    "description": "Stručné definície pojmov z ProxMenuxu a z vysvetlení vnútorného fungovania Proxmoxu.",
+    "section": "Slovník pojmov"
+  },
+  "callout": {
+    "title": "Ako používať túto stránku",
+    "bodyRich": "Každá položka obsahuje kategóriu a stručnú definíciu. Odkazy <em>Pozri tiež</em> otvoria súvisiacu dokumentáciu. Navigáciou A–Z prejdete priamo na vybrané písmeno."
+  },
+  "jumpHeading": "Prejsť na písmeno",
+  "seeAlsoLabel": "Pozri tiež:",
+  "aliasesLabel": "tiež:",
+  "missingCallout": {
+    "title": "Chýba vám pojem?",
+    "leadRich": "Ak pojem chýba, otvorte issue alebo PR na <ext>GitHub</ext>. Slovník je v <code>web/messages/en/docs/glossary.json</code> so zodpovedajúcimi jazykovými katalógmi."
+  },
+  "entries": [
+    {
+      "term": "ACS",
+      "aliases": [
+        "Access Control Services",
+        "Prepísanie ACS"
+      ],
+      "category": "Virtualizácia",
+      "definitionRich": "Funkcie riadenia prístupu PCIe, ktoré pomáhajú izolovať komunikáciu zariadení. Skupiny IOMMU závisia od hardvéru a topológie. Úprava jadra <em>ACS override</em> môže rozdeliť skupiny hlásené Linuxom, nevytvára však hardvérovú izoláciu; priradenie do rôznych VM predstavuje bezpečnostné riziko.",
+      "seeAlso": [
+        {
+          "label": "Pridať radič alebo NVMe do VM",
+          "href": "/docs/disk-manager/add-controller-nvme-vm"
+        }
+      ]
+    },
+    {
+      "term": "ARC",
+      "aliases": [
+        "Adaptive Replacement Cache"
+      ],
+      "category": "Úložisko",
+      "definitionRich": "Vyrovnávacia pamäť ZFS v RAM hostiteľa pre nedávno a často používané dátové bloky. Predvolený limit závisí od verzie a nastavení inštalácie Proxmoxu. ProxMenux ponúka jeho obmedzenie v ponuke po inštalácii.",
+      "seeAlso": [
+        {
+          "label": "Po inštalácii: úložiská",
+          "href": "/docs/post-install/storage"
+        },
+        {
+          "label": "ZFS príkazy",
+          "href": "/docs/help-info/zfs-commands"
+        }
+      ]
+    },
+    {
+      "term": "Bind mount",
+      "category": "Linux",
+      "definitionRich": "Funkcia Linuxu, ktorá sprístupní časť súborového systému aj cez inú cestu. ProxMenux ju používa na zdieľanie adresárov hostiteľa s kontajnermi LXC cez <code>pct set -mpN</code>.",
+      "seeAlso": [
+        {
+          "label": "Prípojné body LXC",
+          "href": "/docs/storage-share/lxc-mount-points"
+        }
+      ]
+    },
+    {
+      "term": "Agregované sieťové rozhranie",
+      "aliases": [
+        "Združenie sieťových rozhraní",
+        "Agregácia liniek"
+      ],
+      "category": "Sieť",
+      "definitionRich": "Združuje viac fyzických sieťových rozhraní do jedného logického pre redundanciu (active-backup), vyššiu súhrnnú priepustnosť (LACP / 802.3ad) alebo oboje. Nastavuje sa v <code>/etc/network/interfaces</code>."
+    },
+    {
+      "term": "Most",
+      "aliases": [
+        "vmbrX",
+        "vmbr0",
+        "Most Linux"
+      ],
+      "category": "Sieť",
+      "definitionRich": "Virtuálny prepínač druhej vrstvy na hostiteľovi. <code>vmbr0</code> zvyčajne pripája hosťov k fyzickej sieti. Ďalšie mosty (<code>vmbr1</code>, <code>vmbr2</code>...) môžu oddeľovať siete podľa fyzických prepojení a konfigurácie.",
+      "seeAlso": [
+        {
+          "label": "Analýza a oprava mosta",
+          "href": "/docs/network/bridge-analysis"
+        }
+      ]
+    },
+    {
+      "term": "Ceph",
+      "category": "Úložisko",
+      "definitionRich": "Distribuované úložisko integrované do Proxmoxu pre hyperkonvergované klastre. OSD (Object Storage Daemons) tvoria základ objektového, blokového a súborového úložiska. Požadovaná verzia Cephu závisí od verzie Proxmoxu a postupu aktualizácie; pozrite si príslušnú príručku.",
+      "seeAlso": [
+        {
+          "label": "Upgrade PVE 8 na PVE 9",
+          "href": "/docs/utils/upgrade-pve8-pve9"
+        }
+      ]
+    },
+    {
+      "term": "CT",
+      "aliases": [
+        "Kontajner",
+        "Kontajner LXC"
+      ],
+      "category": "Proxmox",
+      "definitionRich": "Skratka pre kontajner používaná v Proxmoxe pre inštanciu LXC. Číselné CTID zodpovedá súboru <code>/etc/pve/lxc/&lt;CTID&gt;.conf</code>. Pozri aj <strong>LXC</strong>.",
+      "seeAlso": [
+        {
+          "label": "Správa VM a kontajnerov",
+          "href": "/docs/help-info/vm-ct-commands"
+        }
+      ]
+    },
+    {
+      "term": "deb822",
+      "category": "Linux",
+      "definitionRich": "Moderný formát zdrojov APT: súbory <code>.sources</code> so štruktúrovanými blokmi a poľami Types, URIs, Suites, Components a Signed-By. Nahrádza jednoriadkový formát <code>.list</code>; štandard od PVE 9 / Debian Trixie.",
+      "seeAlso": [
+        {
+          "label": "Upgrade PVE 8 na PVE 9",
+          "href": "/docs/utils/upgrade-pve8-pve9"
+        }
+      ]
+    },
+    {
+      "term": "dGPU",
+      "aliases": [
+        "Samostatný GPU"
+      ],
+      "category": "Virtualizácia",
+      "definitionRich": "Samostatná grafická karta, zvyčajne pripojená cez PCIe, na rozdiel od <strong>iGPU</strong>. Možno ju priradiť VM cez VFIO alebo sprístupniť viacerým kontajnerom LXC cez zariadenia a ovládač hostiteľa, ak to hardvér a aplikácie podporujú.",
+      "seeAlso": [
+        {
+          "label": "Pridať GPU do VM (priame priradenie)",
+          "href": "/docs/hardware/gpu-vm-passthrough"
+        }
+      ]
+    },
+    {
+      "term": "Dialog",
+      "category": "Linux",
+      "definitionRich": "Nástroj založený na ncurses na zobrazovanie ponúk, výziev a priebehu operácií v termináli. Ponuky ProxMenuxu používajú dialog."
+    },
+    {
+      "term": "DKMS",
+      "aliases": [
+        "Podpora dynamického kernelového modulu"
+      ],
+      "category": "Linux",
+      "definitionRich": "Systém na opätovné zostavenie registrovaných externých modulov, napríklad NVIDIA alebo ZFS, pri zmene jadra. Úspech vyžaduje kompatibilné zdrojové kódy modulov a zodpovedajúce hlavičky jadra.",
+      "seeAlso": [
+        {
+          "label": "Nainštalovať Coral TPU (host)",
+          "href": "/docs/hardware/install-coral-tpu-host"
+        }
+      ]
+    },
+    {
+      "term": "Fail2Ban",
+      "category": "Linux",
+      "definitionRich": "Služba sledujúca opakované neúspešné prihlásenia v protokoloch a blokujúca príslušné IP adresy cez firewall. ProxMenux obsahuje prednastavené pravidlá jail pre SSH, rozhranie Proxmoxu a Monitor.",
+      "seeAlso": [
+        {
+          "label": "Fail2Ban",
+          "href": "/docs/security/fail2ban"
+        }
+      ]
+    },
+    {
+      "term": "Fastfetch",
+      "category": "Linux",
+      "definitionRich": "Nástroj zobrazujúci informácie o systéme s grafikou ASCII pri prihlásení do shellu. Nahrádza <code>neofetch</code> a možno ho voliteľne zapnúť v ponuke ProxMenuxu po inštalácii.",
+      "seeAlso": [
+        {
+          "label": "Po inštalácii: voliteľné",
+          "href": "/docs/post-install/optional"
+        }
+      ]
+    },
+    {
+      "term": "GRUB",
+      "aliases": [
+        "GRand Unified Bootloader"
+      ],
+      "category": "Linux",
+      "definitionRich": "Zavádzač používaný v inštaláciách Linuxu s GRUB-om. Konfigurácia je v <code>/etc/default/grub</code> a <code>/boot/grub/</code>; zmeny aplikujte cez <code>update-grub</code>. Proxmox môže používať aj systemd-boot: pred zmenou parametrov jadra overte aktívny zavádzač.",
+      "seeAlso": [
+        {
+          "label": "GPU Prenosové príkazy",
+          "href": "/docs/help-info/gpu-commands"
+        }
+      ]
+    },
+    {
+      "term": "iGPU",
+      "aliases": [
+        "Integrovaný GPU"
+      ],
+      "category": "Virtualizácia",
+      "definitionRich": "Grafický procesor integrovaný v puzdre CPU, napríklad Intel UHD / Iris alebo Radeon v APU Ryzen. Často sa zdieľa medzi viacerými LXC cez <code>/dev/dri</code> namiesto výhradného priradenia jednej VM.",
+      "seeAlso": [
+        {
+          "label": "Pridať GPU do LXC",
+          "href": "/docs/hardware/igpu-acceleration-lxc"
+        }
+      ]
+    },
+    {
+      "term": "ifupdown / ifupdown2",
+      "category": "Sieť",
+      "definitionRich": "Klasický systém konfigurácie siete v Debiane, ktorý číta <code>/etc/network/interfaces</code>. Proxmox štandardne používa prepracovanú verziu <code>ifupdown2</code> s načítaním konfigurácie za behu cez <code>ifreload -a</code>."
+    },
+    {
+      "term": "initramfs",
+      "category": "Linux",
+      "definitionRich": "Počiatočný súborový systém v RAM používaný pred pripojením skutočného koreňového systému. Obsahuje ovládače potrebné pri štarte. Po zmenách VFIO, IOMMU alebo ovládačov úložísk ho obnovte cez <code>update-initramfs -u -k all</code>."
+    },
+    {
+      "term": "IOMMU",
+      "aliases": [
+        "Jednotka riadenia vstupnej/výstupnej pamäte",
+        "VT-d",
+        "AMD-Vi"
+      ],
+      "category": "Virtualizácia",
+      "definitionRich": "Hardvérová funkcia (Intel VT-d / AMD-Vi) potrebná na priame priradenie PCIe zariadení do VM. Zapnite ju vo firmvéri a overte podporu v jadre. Podľa platformy a predvolených nastavení môžu byť potrebné parametre <code>intel_iommu=on</code> alebo <code>amd_iommu=on</code>.",
+      "seeAlso": [
+        {
+          "label": "Po inštalácii: Virtualizácia",
+          "href": "/docs/post-install/virtualization"
+        },
+        {
+          "label": "Pridať GPU do VM (priame priradenie)",
+          "href": "/docs/hardware/gpu-vm-passthrough"
+        }
+      ]
+    },
+    {
+      "term": "Skupina IOMMU",
+      "category": "Virtualizácia",
+      "definitionRich": "Skupina zariadení tvoriaca najmenšiu jednotku izolácie IOMMU. Jej členovia nemusia byť izolovaní navzájom; pred priradením cez VFIO skontrolujte všetkých. Zoznam zobrazíte cez <code>find /sys/kernel/iommu_groups/ -type l | sort -V</code>."
+    },
+    {
+      "term": "iSCSI",
+      "aliases": [
+        "Internet SCSI"
+      ],
+      "category": "Úložisko",
+      "definitionRich": "Protokol pre blokové úložisko cez IP: vzdialený disk sa zobrazí ako lokálne zariadenie SCSI. Do Proxmoxu sa pridáva cez <code>pvesm add iscsi</code>.",
+      "seeAlso": [
+        {
+          "label": "Pridať iSCSI target ako Proxmox úložisko",
+          "href": "/docs/storage-share/host-iscsi"
+        }
+      ]
+    },
+    {
+      "term": "KVM",
+      "aliases": [
+        "Virtuálny stroj na báze kernelu"
+      ],
+      "category": "Virtualizácia",
+      "definitionRich": "Modul jadra Linuxu, ktorý z hostiteľa vytvára hypervízor. Spolu s <strong>QEMU</strong> na emuláciu zariadení tvorí základ virtuálnych strojov v Proxmoxe."
+    },
+    {
+      "term": "LVM",
+      "aliases": [
+        "Logical Volume Manager"
+      ],
+      "category": "Úložisko",
+      "definitionRich": "Správa zväzkov Linuxu združujúca fyzické úložisko do skupín (VG) obsahujúcich logické zväzky (LV). Inštalácie Proxmoxu založené na LVM často používajú LVM-thin pre disky hosťov; dostupné sú aj iné úložiská. Nástroje: <code>pvs</code>, <code>vgs</code> a <code>lvs</code>.",
+      "seeAlso": [
+        {
+          "label": "Príkazy pre úložiská a disky",
+          "href": "/docs/help-info/storage-commands"
+        }
+      ]
+    },
+    {
+      "term": "LXC",
+      "aliases": [
+        "Linux Containers"
+      ],
+      "category": "Linux",
+      "definitionRich": "Virtualizácia na úrovni operačného systému: izolované používateľské prostredia zdieľajú jadro hostiteľa. Zvyčajne má nižšiu réžiu než VM, ale inú hranicu izolácie. Proxmox spravuje LXC cez <code>pct</code>.",
+      "seeAlso": [
+        {
+          "label": "Správa VM a kontajnerov",
+          "href": "/docs/help-info/vm-ct-commands"
+        }
+      ]
+    },
+    {
+      "term": "Lynis",
+      "category": "Linux",
+      "definitionRich": "Bezpečnostný audítor s otvoreným zdrojovým kódom od CISOfy. Analyzuje hostiteľa a poskytuje skóre zabezpečenia s konkrétnymi odporúčaniami. ProxMenux inštaluje verziu z pôvodného repozitára GitHub namiesto staršieho balíka Debianu.",
+      "seeAlso": [
+        {
+          "label": "Lynis",
+          "href": "/docs/security/lynis"
+        }
+      ]
+    },
+    {
+      "term": "Adresa MAC",
+      "aliases": [
+        "Adresa hardvéru"
+      ],
+      "category": "Sieť",
+      "definitionRich": "Zvyčajne 48-bitový identifikátor ethernetového rozhrania pridelený hardvérom alebo softvérom. Funkcia <em>Trvalé názvy sieťových rozhraní</em> v ProxMenuxe spája MAC adresy so stálymi názvami (<code>eno1</code>, <code>enp3s0</code>) aj po zmene enumerácie PCI.",
+      "seeAlso": [
+        {
+          "label": "Stále názvy sieťových rozhraní",
+          "href": "/docs/network/persistent-names"
+        }
+      ]
+    },
+    {
+      "term": "MOTD",
+      "aliases": [
+        "Správa dňa"
+      ],
+      "category": "Linux",
+      "definitionRich": "Text zobrazený po prihlásení cez SSH, uložený v <code>/etc/motd</code>. ProxMenux môže po inštalácii pridať banner; odinštalovanie obnoví pôvodný súbor, ak existuje jeho záloha."
+    },
+    {
+      "term": "NFS",
+      "aliases": [
+        "Systém sieťových súborov"
+      ],
+      "category": "Úložisko",
+      "definitionRich": "Protokol na sieťové zdieľanie súborov pochádzajúci z Unixu. Do Proxmoxu sa pridáva cez <code>pvesm add nfs</code>; ProxMenux ponúka aj postupy pre klientov a servery NFS v LXC.",
+      "seeAlso": [
+        {
+          "label": "Správca úložísk a zdieľania",
+          "href": "/docs/storage-share"
+        }
+      ]
+    },
+    {
+      "term": "nftables / iptables",
+      "category": "Sieť",
+      "definitionRich": "Nástroje firewallu Linuxu. <code>nftables</code> je moderné riešenie; <code>iptables</code> môže používať pôvodný alebo nft-kompatibilný backend. Klasický <code>pve-firewall</code> používa iptables, alternatívny proxmox-firewall používa nftables.",
+      "seeAlso": [
+        {
+          "label": "Sieťové príkazy",
+          "href": "/docs/help-info/network-commands"
+        }
+      ]
+    },
+    {
+      "term": "nouveau",
+      "category": "Linux",
+      "definitionRich": "Ovládač grafických kariet NVIDIA s otvoreným zdrojovým kódom v Linuxe. Pri inštalácii proprietárneho ovládača zabráňte tomu, aby nouveau obsadil ten istý GPU, zvyčajne zablokovaním modulu a obnovou initramfs.",
+      "seeAlso": [
+        {
+          "label": "Inštalačný návod NVIDIA",
+          "href": "/guides/nvidia"
+        }
+      ]
+    },
+    {
+      "term": "Repozitár no-subscription",
+      "category": "Proxmox",
+      "definitionRich": "Repozitár balíkov Proxmoxu dostupný bez predplatného enterprise. Balíky prechádzajú menším rozsahom overenia než v repozitári enterprise, ktorý Proxmox odporúča do produkcie. ProxMenux ponúka nastavenie repozitárov po inštalácii.",
+      "seeAlso": [
+        {
+          "label": "Po inštalácii: Základné nastavenia",
+          "href": "/docs/post-install/basic-settings"
+        }
+      ]
+    },
+    {
+      "term": "OVA / OVF",
+      "aliases": [
+        "Open Virtualization Format"
+      ],
+      "category": "Virtualizácia",
+      "definitionRich": "Formáty DMTF na prenos virtuálnych strojov. <strong>OVA</strong> zabalí súbory do jedného archívu TAR; <strong>OVF</strong> opisuje VM v XML so súvisiacimi súbormi diskov, často VMDK. Podpora importu závisí od cieľového hypervízora a konfigurácie.",
+      "seeAlso": [
+        {
+          "label": "Exportovať VM do OVA / OVF",
+          "href": "/docs/utils/export-vm"
+        },
+        {
+          "label": "Importovať VM z OVA / OVF",
+          "href": "/docs/utils/import-vm"
+        }
+      ]
+    },
+    {
+      "term": "OVMF",
+      "aliases": [
+        "Firmvér UEFI",
+        "Open Virtual Machine Firmware"
+      ],
+      "category": "Virtualizácia",
+      "definitionRich": "Firmvér UEFI pre VM, nastavený cez <code>qm set &lt;vmid&gt; -bios ovmf</code>. Používa sa pre hostí UEFI vrátane Windows 11 a konfigurácií Secure Boot. <code>efidisk0</code> uchováva premenné EFI; mnohí iní hostia môžu naďalej používať klasický BIOS.",
+      "seeAlso": [
+        {
+          "label": "Pridať GPU do VM (priame priradenie)",
+          "href": "/docs/hardware/gpu-vm-passthrough"
+        }
+      ]
+    },
+    {
+      "term": "PBS",
+      "aliases": [
+        "Proxmox Backup Server"
+      ],
+      "category": "Proxmox",
+      "definitionRich": "Samostatný zálohovací produkt Proxmoxu s inkrementálnym prenosom, deduplikáciou a voliteľným šifrovaním na strane klienta pre VM a CT. Môže byť cieľom vzdump; samostatný server je vhodnejší než zálohy na chránenom hostiteľovi."
+    },
+    {
+      "term": "pct",
+      "category": "Proxmox",
+      "definitionRich": "Nástroj príkazového riadka na správu kontajnerov LXC v Proxmoxe: <code>pct list / start / stop / shutdown / config / enter / exec / push / pull / destroy</code>.",
+      "seeAlso": [
+        {
+          "label": "Správa VM a kontajnerov",
+          "href": "/docs/help-info/vm-ct-commands"
+        }
+      ]
+    },
+    {
+      "term": "pmxcfs",
+      "aliases": [
+        "Proxmox Cluster Filesystem"
+      ],
+      "category": "Proxmox",
+      "definitionRich": "Virtuálny súborový systém založený na FUSE, pripojený v <code>/etc/pve/</code>. Replikuje konfiguráciu medzi uzlami klastra: zmeny v <code>/etc/pve/</code> sa šíria automaticky."
+    },
+    {
+      "term": "pveam",
+      "aliases": [
+        "Správca virtuálnych zariadení Proxmox VE"
+      ],
+      "category": "Proxmox",
+      "definitionRich": "Nástroj na správu lokálneho katalógu šablón CT. <code>pveam update</code> aktualizuje index; <code>pveam available</code> vypíše šablóny a <code>pveam download &lt;storage&gt; &lt;template&gt;</code> stiahne vybranú šablónu."
+    },
+    {
+      "term": "pveproxy",
+      "category": "Proxmox",
+      "definitionRich": "Služba HTTPS pre webové rozhranie a terminál Proxmoxu na porte 8006. Pri veľkých aktualizáciách sa reštartuje; ProxMenux preto odmieta spustiť prechod PVE 8 → 9 z webového terminálu."
+    },
+    {
+      "term": "pvesm",
+      "aliases": [
+        "Správca úložísk Proxmox"
+      ],
+      "category": "Proxmox",
+      "definitionRich": "Nástroj CLI pre správu úložiska Proxmox. <code>pvesm status</code> zobrazuje všetky nakonfigurované úložiská; <code>pvesm add &lt;type&gt;</code> registruje nové (NFS, Samba, iSCSI, dir, ZFS, LVM, ...).",
+      "seeAlso": [
+        {
+          "label": "Príkazy pre úložiská a disky",
+          "href": "/docs/help-info/storage-commands"
+        }
+      ]
+    },
+    {
+      "term": "Privilegovaný kontajner",
+      "category": "Linux",
+      "definitionRich": "Kontajner LXC, ktorého root <em>zodpovedá UID 0 hostiteľa</em>, pričom naďalej platia menné priestory a ďalšie obmedzenia. Má slabšiu izoláciu než neprivilegovaný kontajner. GPU, USB a Samba tento režim nevyžadujú vždy; dôležité sú oprávnenia a mapovania UID."
+    },
+    {
+      "term": "ProxMenux Monitor",
+      "category": "ProxMenux",
+      "definitionRich": "Voliteľný webový panel ProxMenuxu. Zobrazuje štatistiky hostiteľa v reálnom čase (CPU, RAM, disky a sieť), prehľad VM a LXC a prihlásenie s 2FA na porte TCP <code>8008</code>.",
+      "seeAlso": [
+        {
+          "label": "ProxMenux Monitor",
+          "href": "/docs/settings/proxmenux-monitor"
+        }
+      ]
+    },
+    {
+      "term": "qcow2",
+      "aliases": [
+        "QEMU Copy-On-Write v2"
+      ],
+      "category": "Úložisko",
+      "definitionRich": "Formát obrazu disku VM bežný na adresárových úložiskách. Podporuje prideľovanie priestoru podľa potreby, snímky a kopírovanie pri zápise. Konverzia cez <code>qemu-img convert -O qcow2 ...</code>."
+    },
+    {
+      "term": "qm",
+      "aliases": [
+        "Správca QEMU"
+      ],
+      "category": "Proxmox",
+      "definitionRich": "Nástroj na správu VM v Proxmoxe: <code>qm list / start / stop / shutdown / config / set / destroy / importdisk / migrate</code>. Pre kontajnery plní rovnakú úlohu <code>pct</code>.",
+      "seeAlso": [
+        {
+          "label": "Správa VM a kontajnerov",
+          "href": "/docs/help-info/vm-ct-commands"
+        }
+      ]
+    },
+    {
+      "term": "Q35",
+      "category": "Virtualizácia",
+      "definitionRich": "Typ stroja QEMU emulujúci čipovú súpravu Intel Q35 s PCIe. Odporúčaný namiesto i440FX pre priame priradenie PCIe a moderných hostí. Nastaví sa cez <code>qm set &lt;vmid&gt; -machine q35</code>."
+    },
+    {
+      "term": "QEMU",
+      "category": "Virtualizácia",
+      "definitionRich": "Emulátor počítačov a virtualizačný nástroj s otvoreným zdrojovým kódom. Proxmox ho kombinuje s KVM na spúšťanie VM s výkonom blízkym natívnemu."
+    },
+    {
+      "term": "rclone",
+      "category": "Linux",
+      "definitionRich": "Nástroj príkazového riadka podporujúci mnohé cloudové úložiská vrátane Google Drive, Dropbox, OneDrive, Mega a S3. Príručka cloudového zálohovania ho používa na pripojenie vzdialeného úložiska ako adresára pre archívy vzdump.",
+      "seeAlso": [
+        {
+          "label": "Zálohy do osobného cloudu",
+          "href": "/guides/backup_cloud"
+        }
+      ]
+    },
+    {
+      "term": "Samba / SMB / CIFS",
+      "category": "Úložisko",
+      "definitionRich": "Rodina protokolov Microsoftu na zdieľanie súborov. <strong>SMB</strong> je protokol, <strong>Samba</strong> jeho otvorená implementácia pre Linux a <strong>CIFS</strong> starší dialekt SMB. Do Proxmoxu sa pridáva cez <code>pvesm add cifs</code>.",
+      "seeAlso": [
+        {
+          "label": "Správca úložísk a zdieľania",
+          "href": "/docs/storage-share"
+        }
+      ]
+    },
+    {
+      "term": "SeaBIOS",
+      "category": "Virtualizácia",
+      "definitionRich": "Otvorená implementácia klasického BIOS-u používaná v QEMU. Predvolený firmvér nových VM, ak nevyberiete OVMF. Vhodný pre staršie systémy a inštalácie Linuxu bez požiadavky na UEFI."
+    },
+    {
+      "term": "smartctl / SMART",
+      "aliases": [
+        "Self-Monitoring, Analysis and Reporting Technology"
+      ],
+      "category": "Úložisko",
+      "definitionRich": "Vstavaná diagnostika diskov poskytujúca stav, počty chýb a výsledky interných testov. Nástrojom je <code>smartctl</code> z balíka <code>smartmontools</code>; <code>nvme-cli</code> pridáva príkazy pre NVMe.",
+      "seeAlso": [
+        {
+          "label": "SMART Zdravie a test disku",
+          "href": "/docs/disk-manager/smart-disk-test"
+        },
+        {
+          "label": "Príkazy pre úložiská → časť SMART",
+          "href": "/docs/help-info/storage-commands"
+        }
+      ]
+    },
+    {
+      "term": "systemd / systemctl / journalctl",
+      "category": "Linux",
+      "definitionRich": "Inicializačný systém Debianu / Proxmoxu. <code>systemctl</code> spravuje služby: spustenie, zastavenie, povolenie a stav. <code>journalctl</code> číta binárny protokol vytvorený službou <code>systemd-journald</code>."
+    },
+    {
+      "term": "sysctl",
+      "category": "Linux",
+      "definitionRich": "Nástroj na čítanie a zmenu parametrov jadra. Trvalé nastavenia sa zvyčajne ukladajú do <code>/etc/sysctl.d/*.conf</code>; podpora <code>/etc/sysctl.conf</code> závisí od načítavacej služby. ProxMenux ponúka profil sysctl po inštalácii.",
+      "seeAlso": [
+        {
+          "label": "Po inštalácii: sieť",
+          "href": "/docs/post-install/network"
+        }
+      ]
+    },
+    {
+      "term": "trixie",
+      "category": "Linux",
+      "definitionRich": "Kódový názov Debianu 13, základného operačného systému pre Proxmox VE 9. Predchodca: <em>bookworm</em> (Debian 12 / PVE 8).",
+      "seeAlso": [
+        {
+          "label": "Upgrade PVE 8 na PVE 9",
+          "href": "/docs/utils/upgrade-pve8-pve9"
+        }
+      ]
+    },
+    {
+      "term": "udev",
+      "category": "Linux",
+      "definitionRich": "Správca zariadení Linuxu. Reaguje na hardvérové udalosti a vytvára alebo odstraňuje položky v <code>/dev</code>. Pravidlá v <code>/etc/udev/rules.d/</code> môžu priraďovať stále názvy rozhraní podľa MAC, vytvárať zariadenia NVIDIA pri načítaní ovládača a podobne."
+    },
+    {
+      "term": "UID / GID idmap",
+      "aliases": [
+        "UID posun"
+      ],
+      "category": "Linux",
+      "definitionRich": "Pri predvolenom mapovaní <strong>neprivilegovaných</strong> LXC sú UID a GID na hostiteľovi posunuté o <code>+100000</code>: UID 0 zodpovedá 100000 a 1000 zodpovedá 101000. Vlastné mapovania môžu byť odlišné; vlastníctvo súborov v bind mountoch musí zodpovedať mapovaniu.",
+      "seeAlso": [
+        {
+          "label": "Prípojné body LXC",
+          "href": "/docs/storage-share/lxc-mount-points"
+        }
+      ]
+    },
+    {
+      "term": "Neprivilegovaný kontajner",
+      "category": "Linux",
+      "definitionRich": "Kontajner LXC, ktorého root sa mapuje na neprivilegované UID hostiteľa, zvyčajne 100000. Obmedzuje práva na hostiteľovi, ale zdieľa jeho jadro. Prístup k hardvéru je možný s vhodnými oprávneniami a mapovaním; privilegovaný režim nie je vždy potrebný."
+    },
+    {
+      "term": "VFIO",
+      "aliases": [
+        "Virtuálna funkcia I/O"
+      ],
+      "category": "Virtualizácia",
+      "definitionRich": "Rozhranie jadra Linuxu pre bezpečné ovládače v používateľskom priestore, používané na priame priradenie PCIe zariadení do VM. Využíva <code>vfio</code>, <code>vfio_iommu_type1</code> a <code>vfio_pci</code> s konfiguráciou v <code>/etc/modprobe.d/vfio.conf</code>.",
+      "seeAlso": [
+        {
+          "label": "Po inštalácii: Virtualizácia",
+          "href": "/docs/post-install/virtualization"
+        }
+      ]
+    },
+    {
+      "term": "VirtIO",
+      "category": "Virtualizácia",
+      "definitionRich": "Rodina paravirtualizovaných ovládačov pre sieť, úložisko, dynamickú pamäť a GPU. Znižujú réžiu emulácie starého hardvéru, napríklad e1000 alebo IDE. Hosť potrebuje príslušné ovládače: v Linuxe sú súčasťou jadra, pre Windows sú na samostatnom ISO."
+    },
+    {
+      "term": "VLAN",
+      "aliases": [
+        "Virtuálna lokálna sieť"
+      ],
+      "category": "Sieť",
+      "definitionRich": "Značky 802.1Q rozdeľujúce jednu fyzickú sieť na viac logických sietí. Nastavujú sa pre most alebo rozhranie v <code>/etc/network/interfaces</code>."
+    },
+    {
+      "term": "VM",
+      "aliases": [
+        "Virtuálny stroj"
+      ],
+      "category": "Proxmox",
+      "definitionRich": "Virtuálny stroj spravovaný Proxmoxom cez QEMU/KVM s vlastným jadrom hosťa. Číselné VMID zodpovedá <code>/etc/pve/qemu-server/&lt;VMID&gt;.conf</code>. Zvyčajne má vyššiu réžiu než LXC a izoláciu cez oddelené jadro.",
+      "seeAlso": [
+        {
+          "label": "Správa VM a kontajnerov",
+          "href": "/docs/help-info/vm-ct-commands"
+        }
+      ]
+    },
+    {
+      "term": "vzdump",
+      "category": "Proxmox",
+      "definitionRich": "Zálohovací nástroj Proxmoxu pre VM a CT. Súborové archívy <strong>nie sú inkrementálne</strong>; ciele PBS podporujú inkrementálne prenosy. Úlohy nastavujú režim (snapshot / suspend / stop), kompresiu (napríklad zstd, gzip alebo lzo), uchovávanie a upozornenia.",
+      "seeAlso": [
+        {
+          "label": "Príkazy zálohovania a obnovy",
+          "href": "/docs/help-info/backup-commands"
+        }
+      ]
+    },
+    {
+      "term": "ZFS",
+      "aliases": [
+        "Zettabyte File System"
+      ],
+      "category": "Úložisko",
+      "definitionRich": "Súborový systém a správca zväzkov so snímkami, replikáciou send/receive, kontrolnými súčtami a kompresiou. Poškodené dáta môže opraviť, ak existuje platná redundantná kópia. Vyrovnávacia pamäť <strong>ARC</strong> používa RAM a možno ju obmedziť.",
+      "seeAlso": [
+        {
+          "label": "Príkazy správy ZFS",
+          "href": "/docs/help-info/zfs-commands"
+        }
+      ]
+    }
+  ]
+}
diff --git a/web/messages/sk/docs/hardware/coral-tpu-lxc.json b/web/messages/sk/docs/hardware/coral-tpu-lxc.json
new file mode 100644
index 00000000..3df4b7c6
--- /dev/null
+++ b/web/messages/sk/docs/hardware/coral-tpu-lxc.json
@@ -0,0 +1,120 @@
+{
+  "meta": {
+    "title": "Pridať Coral TPU do LXC | Dokumentácia ProxMenux",
+    "description": "Sprístupnite Google Coral TPU cez USB alebo M.2 / PCIe kontajneru LXC v Proxmoxe. ProxMenux nastaví zariadenia, oprávnenia a pripojenia, spustí kontajner a v podporovaných distribúciách nainštaluje runtime Edge TPU."
+  },
+  "header": {
+    "title": "Pridať Coral TPU do LXC",
+    "description": "Sprístupnite Coral USB Accelerator alebo M.2 / Mini-PCIe kontajneru LXC. ProxMenux nastaví kontajner a runtime Edge TPU. Táto voľba rieši iba TPU; pre Quick Sync, VA-API alebo NVENC spustite aj Pridať GPU do LXC.",
+    "section": "Hardvér: grafické karty a Coral TPU"
+  },
+  "intro": {
+    "title": "Čo robí",
+    "body": "Zapíše konfiguráciu do <code>/etc/pve/lxc/&lt;ctid&gt;.conf</code> pre <strong>USB Accelerator</strong>, <strong>Coral M.2 / PCIe</strong> alebo oba. Spustí kontajner a nainštaluje runtime Google <code>libedgetpu</code>. GPU sa nastavuje samostatne cez <lxcGpuLink>Pridať GPU do LXC</lxcGpuLink>."
+  },
+  "whenUse": {
+    "heading": "Kedy použiť",
+    "body": "Pre <frigateLink>Frigate</frigateLink> alebo inú kompatibilnú linuxovú aplikáciu v LXC. Coral vykonáva podporovanú ML inferenciu namiesto CPU. Výkon závisí od modelu a hardvéru; dekódovanie videa a ďalšie úlohy naďalej spotrebúvajú prostriedky."
+  },
+  "prereqs": {
+    "title": "Skôr ako začnete",
+    "drivers": "<strong>Pripravte zariadenie Coral na hostiteľovi</strong>. M.2 / PCIe vyžaduje načítaný ovládač hostiteľa; USB prístup k zariadeniu a správne oprávnenia. Pozrite <hostLink>Inštalácia Coral TPU na hostiteľa</hostLink>. Skript nainštaluje runtime aplikácie v kontajneroch Debian/Ubuntu; ostatné distribúcie ho musia poskytnúť samostatne.",
+    "driversCheck": "ls /dev/apex_* 2>/dev/null ; lsusb | grep -E '1a6e:089a|18d1:9302'",
+    "container": "<strong>Existujúci LXC</strong>, ideálne založený na <strong>Debian / Ubuntu</strong>: inštalácia používa <code>apt-get</code>. <strong>Kontajnery iných distribúcií</strong> môžu zvoliť <strong>režim iba sprístupnenia zariadenia</strong>, ktorý preskočí APT inštaláciu <code>libedgetpu</code>. Hodí sa, ak aplikácia už runtime obsahuje, napríklad Docker obraz Frigate.",
+    "downtime": "<strong>Počítajte s krátkym výpadkom</strong> kontajnera. Skript ho zastaví kvôli konfigurácii a spustí na inštaláciu runtime. Tieto zmeny nevyžadujú reštart hostiteľa."
+  },
+  "hostPrep": {
+    "title": "Hostiteľ musí byť pripravený ako prvý",
+    "body": "M.2 / PCIe potrebuje <code>gasket</code>/<code>apex</code> na hostiteľovi a funkčné zariadenie. USB potrebuje pripojené zariadenie a oprávnenia; aplikácia nemusí bežať na hostiteľovi. <code>libedgetpu</code> musí byť tam, kde beží aplikácia. Poradie: <strong>príprava hostiteľa → prístup LXC → nastavenie aplikácie</strong>."
+  },
+  "running": {
+    "heading": "Spustenie skriptu",
+    "body": "V ProxMenuxe otvorte <strong>Hardvér: GPU a Coral-TPU → Pridať Coral TPU do LXC</strong>.",
+    "imageAlt": "Voľba Pridať Coral TPU do LXC v ponuke hardvéru"
+  },
+  "howRuns": {
+    "heading": "Ako skript funguje",
+    "body": "Vyberte kontajner. Skript nastaví prístup USB aj bez pripojeného USB Coral a pridá M.2 / PCIe, ak zistí príslušný hardvér."
+  },
+  "walkthrough": {
+    "heading": "Postup krok za krokom",
+    "pick": {
+      "title": "Vyberte kontajner LXC",
+      "body": "Výber obsahuje vhodné kontajnery z <code>pct list</code>; OCI kontajnery sú skryté a spravujú sa cez Apps v správcovi OCI. Vyberte spustený alebo zastavený kontajner. Skript ho podľa potreby zastaví, nakonfiguruje a spustí na inštaláciu runtime."
+    },
+    "gpuHint": {
+      "title": "Voliteľné odporúčanie prístupu ku GPU",
+      "body": "Ak sa zistí GPU, ktorá nie je nakonfigurovaná pre tento kontajner, dialóg odporučí <lxcGpuLink>Pridať GPU do LXC</lxcGpuLink> na hardvérové dekódovanie videa, napríklad Quick Sync, VA-API alebo NVENC. Pýta sa, či pokračovať iba s Coral: Áno pokračuje v nastavení TPU; Nie ukončí postup, aby ste najprv mohli nastaviť GPU."
+    },
+    "usb": {
+      "title": "Nastavenie prístupu USB v LXC",
+      "body": "Vytvorí pravidlo udev na hostiteľovi pre <code>/dev/coral</code> a sprístupní <strong>celý</strong> strom <code>/dev/bus/usb</code> kontajneru. Konfigurácia sa zapíše aj bez pripojeného USB Coral a sprístupní viac než iba toto zariadenie.",
+      "whyTitle": "Prečo pripojiť /dev/bus/usb namiesto /dev/coral?",
+      "whyBody": "Cesta USB, napríklad <code>/dev/bus/usb/001/005</code>, sa pri opätovnom pripojení mení. Staršie verzie pripájali odkaz <code>/dev/coral</code> a mohli zachovať neplatnú cestu. Pripojenie celého stromu USB sprístupní aktuálny uzol zariadenia. Aplikácia môže potrebovať zariadenie znovu otvoriť."
+    },
+    "pcie": {
+      "title": "Nastavenie prístupu M.2 / PCIe v LXC",
+      "body1": "Ak zistí Coral M.2 / PCIe a existuje <code>/dev/apex_0</code>, použije API Proxmoxu <code>dev</code> na správu cgroup2 v privilegovaných aj neprivilegovaných LXC:",
+      "body2": "Ak po <hostLink>Inštalácii Coral na hostiteľa</hostLink> chýba <code>/dev/apex_0</code>, skript zapíše bind mount s <code>create=file</code> a iba vtedy, keď je číslo major zariadenia apex uvedené v <code>/proc/devices</code>, aj klasické pravidlo cgroup2. Ani jedno nevytvorí funkčné zariadenie:",
+      "rebootTitle": "Reštartovať hostiteľa ako prvý, ak ste práve nainštalovali Coral ovládače",
+      "rebootBody": "Náhradné pripojenie nenačíta ovládač <code>apex</code> na hostiteľovi. Načítajte ho alebo po inštalácii reštartujte a overte zariadenie. Potom znova spustite skript pre modernú položku zariadenia a reštartujte kontajner."
+    },
+    "drivers": {
+      "title": "Spustenie LXC a inštalácia runtime Coral",
+      "body": "Spustí kontajner a čaká najviac 15 sekúnd na stav running. Potom cez <code>pct exec</code> spustí inštalátor vnútri. Inštalátor:",
+      "items": [
+        "Spúšťa <code>apt-get update</code>.",
+        "Nainštaluje požiadavky repozitára Coral: <code>gnupg</code>, <code>curl</code> a <code>ca-certificates</code>.",
+        "Importuje kľúč GPG od Googlu do <code>/etc/apt/keyrings/coral-edgetpu.gpg</code>, rovnako ako inštalátor hostiteľa, a pridá repozitár APT <code>coral-edgetpu-stable</code> s <code>signed-by=</code>.",
+        "Predvolene nainštaluje <code>libedgetpu1-std</code>. Pri zistení Coral M.2 ponúkne <code>libedgetpu1-std</code> alebo <code>libedgetpu1-max</code>. Výber balíka sám nenastaví detekciu v aplikácii."
+      ],
+      "noIgpuTitle": "Prečo tu nie sú žiadne ovládače iGPU?",
+      "noIgpuBody": "Predtým inštaloval aj <code>va-driver-all</code>, <code>intel-opencl-icd</code> a ďalšie balíky Intel pre Quick Sync spolu s Coral. To spôsobovalo nejasné chyby pri požiadavke iba na Coral. iGPU sa teraz nastavuje cez <lxcGpuLink>Pridať GPU do LXC</lxcGpuLink>; pre hardvérové dekódovanie videa to spustite najprv.",
+      "debianTitle": "Iné distribúcie: iba sprístupnenie zariadenia",
+      "debianBody": "V Debiane/Ubuntu používa <code>apt-get</code>. Pre <strong>Alpine, Arch, RHEL alebo SUSE</strong> zistené cez <code>/etc/os-release</code> ponúkne <em>pokračovať iba so sprístupnením zariadenia</em> alebo <em>zrušiť</em>. Prvá voľba nastaví <code>/etc/pve/lxc/&lt;ctid&gt;.conf</code> bez inštalácie <code>libedgetpu</code>. Ak aplikácia runtime obsahuje, napríklad Frigate Docker, tento režim stačí. Inak nainštalujte <code>libedgetpu</code> podľa <coralLink>oficiálnej príručky Googlu</coralLink>."
+    },
+    "summary": {
+      "title": "Zhrnutie",
+      "body": "Na konci zobrazí Coral USB a M.2 so značkou ✓ alebo ⚠ podľa zistenia hardvéru. Kontajner zostane spustený na nastavenie Frigate, CodeProject.AI alebo vašej aplikácie."
+    }
+  },
+  "manual": {
+    "heading": "Ručný postup",
+    "body": "Ak chcete presne vidieť konfiguráciu LXC alebo ju použiť ručne:",
+    "usbHeading": "USB Coral",
+    "pcieHeading": "M.2 / PCIe Coral",
+    "runtimeHeading": "V kontajneri: runtime Coral"
+  },
+  "verification": {
+    "heading": "Overenie",
+    "body": "Otvorte shell v kontajneri a overte viditeľnosť Coral:"
+  },
+  "troubleshoot": {
+    "heading": "Riešenie problémov",
+    "apexTitle": "LXC je spustený, ale chýba /dev/apex_0",
+    "apexBody": "Najprv overte ovládač hostiteľa: <code>lsmod | grep apex</code>. Ak chýba, skúste <code>modprobe apex</code> alebo po inštalácii ovládača reštartujte. Keď na hostiteľovi existuje <code>/dev/apex_0</code>, overte položku zariadenia LXC (ak sa zapísali iba náhradné položky, spustite skript znova) a reštartujte kontajner cez <code>pct stop &lt;ctid&gt; &amp;&amp; pct start &lt;ctid&gt;</code>.",
+    "replugTitle": "USB Coral zmizne po pripojení do iného portu",
+    "replugBody": "Overte, že LXC pripája <code>/dev/bus/usb</code> namiesto odkazu <code>/dev/coral</code>. Konfigurácia má obsahovať <code>lxc.mount.entry: /dev/bus/usb dev/bus/usb ...</code> bez priamej závislosti od <code>/dev/coral</code>. Pri starej konfigurácii skript spustite znova.",
+    "alpineTitle": "Alpine / Arch / RHEL / SUSE: runtime nie je nainštalovaný",
+    "alpineBody": "<em>Režim iba sprístupnenia zariadenia</em> nastaví zariadenie bez inštalácie <code>libedgetpu</code>. Použite kompatibilný komunitný balík alebo zostavte zdrojový kód; pred príkazom ako <code>apk add</code> v Alpine overte dostupnosť balíka. Frigate môže runtime obsahovať. Pri Dockeri v LXC sprístupnite M.2 aj cez <code>--device /dev/apex_0:/dev/apex_0</code> alebo pripojte USB do Dockera: samotný LXC mount nestačí.",
+    "frigateTitle": "Frigate hlási „Coral EdgeTPU detected but not available“",
+    "frigateBody": "Overte runtime, viditeľnosť zariadenia a práva na čítanie/zápis skutočného procesu aplikácie. Pre USB skontrolujte oprávnenia a prípadnú skupinu <code>plugdev</code>. Pre M.2 overte <code>/dev/apex_0</code> cez <code>ls -l /dev/apex_0</code>. Názov ako <code>apex</code> v <code>/etc/group</code> nestačí: číselné GID a mapovania LXC musia sedieť. Overte aj obsadenie TPU iným procesom; privilegovaný režim nech nie je prvým riešením.",
+    "logsTitle": "Skontrolujte host a kontajnerové protokoly",
+    "logsBody": "Na hostiteľovi pozrite správy jadra cez <code>journalctl -k | grep -i -e apex -e gasket -e usb</code>. V LXC skontrolujte protokoly aplikácie; pri vnorenom Dockeri použite <code>docker logs &lt;container&gt;</code>. Chyby môžu spôsobiť oprávnenia, chýbajúci runtime, USB spojenie alebo iný proces používajúci TPU."
+  },
+  "related": {
+    "heading": "Súvisiace",
+    "items": [
+      {
+        "label": "Inštalácia Coral TPU na hostiteľa",
+        "href": "/docs/hardware/install-coral-tpu-host",
+        "tail": " — predpoklad použitia Coral M.2 / PCIe v CT."
+      },
+      {
+        "label": "Pridať GPU do LXC",
+        "href": "/docs/hardware/igpu-acceleration-lxc",
+        "tail": " — prístup ku GPU, často kombinovaný s Coral vo Frigate."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sk/docs/hardware/gpu-vm-passthrough.json b/web/messages/sk/docs/hardware/gpu-vm-passthrough.json
new file mode 100644
index 00000000..3a2487ad
--- /dev/null
+++ b/web/messages/sk/docs/hardware/gpu-vm-passthrough.json
@@ -0,0 +1,178 @@
+{
+  "meta": {
+    "title": "Pridanie GPU do VM | Dokumentácia ProxMenux",
+    "description": "Priraďte fyzickú GPU virtuálnemu stroju Proxmox. ProxMenux overí IOMMU, nastaví VFIO a zariadenia VM a zistí konflikty s inými VM alebo LXC."
+  },
+  "header": {
+    "title": "Pridať GPU do VM (passthrough)",
+    "description": "Zistí GPU Intel, AMD alebo NVIDIA pre priamy prístup z VM. Overí IOMMU a pridružené zariadenia, nastaví VFIO a VM a použije pravidlá kompatibility. Overte všetky dotknuté zariadenia.",
+    "section": "Hardvér: grafické karty a Coral TPU"
+  },
+  "intro": {
+    "title": "Čo robí",
+    "body": "Automatizuje nastavenie hostiteľa a <code>hostpci</code> z <pveLink>dokumentácie PCI passthrough Proxmox</pveLink>. Overí priradenia <em>iným</em> hosťom a ponúkne riešenie konfliktov. Nezaručuje podporu každej GPU, resetovania či hosťovského ovládača."
+  },
+  "who": {
+    "heading": "Pre koho je toto?",
+    "body": "Pre priamy prístup <strong>virtuálneho stroja</strong> ku GPU cez VFIO. Kým je GPU priradená VFIO, ovládač hostiteľa ju nepoužije ani pri zastavenej VM. Na zdieľanie s <em>LXC</em> použite <lxcLink>Pridať GPU do LXC</lxcLink>."
+  },
+  "prereqs": {
+    "title": "Skôr ako začnete",
+    "gpu": "Fyzicky nainštalovaná <strong>kompatibilná GPU</strong>. Skript zisťuje Intel, AMD a NVIDIA cez <code>lspci</code>.",
+    "gpuCheck": "lspci | grep -iE 'VGA|3D|Display'",
+    "iommu": "<strong>Podpora IOMMU</strong> v hardvéri a potrebné zapnutie vo firmvéri (Intel VT-d alebo AMD-Vi). Overí systém a môže nastaviť Linux; nemení BIOS/UEFI ani nedokazuje, že neaktívne IOMMU je vypnuté vo firmvéri.",
+    "q35": "Sprievodca vyžaduje <strong>q35</strong> a odmietne <code>i440fx</code>. Typ stroja je oddelený od firmvéru BIOS/UEFI. Zmena čipovej súpravy existujúcej VM vyžaduje plánovanie a nevykonáva sa automaticky.",
+    "q35Check": "qm config VMID | grep machine",
+    "moreGpus": "Pripravte <strong>ďalšiu GPU alebo náhradný prístup</strong> cez SSH, IPMI či sériovú konzolu. Rezervovanie hlavnej GPU môže vypnúť miestny obraz. Pri <em>NVIDIA</em> môže karta mimo dotknutej skupiny IOMMU zostať hostiteľovi.",
+    "nvidiaInstalled": "Po <nvidiaLink>inštalácii NVIDIA na hostiteľa</nvidiaLink> sa vybrané funkcie rezervujú pre <code>vfio-pci</code> namiesto <code>nvidia</code>. Modul <code>nvidia</code> môže zostať pre <strong>ostatné</strong> karty mimo dotknutej skupiny IOMMU. Overte ich cez <code>nvidia-smi</code>."
+  },
+  "pickOne": {
+    "title": "Výhradné priradenie VM alebo zdieľanie LXC",
+    "body": "Používateľ GPU viazaný na <code>vfio-pci</code> pre prechod VM nemôže súčasne používať hostiteľ ani LXC. Ak máte dva GPU, môžete vyhradiť jeden pre každú cestu. Ak máte iba jeden, vyberte:",
+    "vmItem": "<strong>VM:</strong> priamy a výhradný prístup pre túto VM.",
+    "lxcItem": "<strong>LXC (<lxcLink>Pridať GPU do LXC</lxcLink>):</strong> zdieľa zariadenie s hostiteľom a ďalšími kontajnermi cez natívny ovládač."
+  },
+  "running": {
+    "heading": "Spustenie inštalátora",
+    "body": "Otvorte ProxMenux a vyberte <strong>Hardvér: GPU a Coral-TPU → Pridať GPU do VM</strong>.",
+    "imageAlt": "Položka ponuky na pridanie GPU do VM"
+  },
+  "howRuns": {
+    "heading": "Ako skript funguje",
+    "body": "Zistenie a výber predchádzajú hlavným zmenám potvrdeným súhrnom. Zapnutie IOMMU má skoršie samostatné potvrdenie a môže už zmeniť štart systému. Neskoršie čistenie zvuku môže tiež vyžadovať výber."
+  },
+  "walkthrough": {
+    "heading": "Postup krok za krokom",
+    "detect": {
+      "title": "Detekovať GPU a skontrolovať IOMMU",
+      "body": "Považuje IOMMU za aktívne iba vtedy, keď bežiace jadro má <code>intel_iommu=on</code> alebo <code>amd_iommu=on</code> a existujú skupiny IOMMU. Ak je parameter už uložený pre ďalší štart, pokračuje v režime čakajúceho reštartu; inak ho samostatne potvrdený krok môže pridať s <code>iommu=pt</code>. Jeho heuristika zavádzacieho súboru použije <code>/etc/kernel/cmdline</code>, keď sa v ňom nachádza značka koreňa ZFS ako <code>root=ZFS=</code>; inak použije <code>/etc/default/grub</code>. Táto heuristika nedokazuje skutočne použitý zavádzač. Novo nakonfigurované IOMMU sa prejaví po reštarte; potom overte skutočné skupiny.",
+      "tipTitle": "Už ste nastavili kroky po inštalácii?",
+      "tipBody": "Ak je <postLink>podpora VFIO IOMMU</postLink> nastavená a aktívna v jadre, kontrola prejde. Nastavenie pre ďalší štart samo osebe nedokazuje aktuálne zapnutie.",
+      "imageAlt": "Zoznam zistených GPU s predávajúcim a PCI adresa"
+    },
+    "preflight": {
+      "title": "Výber GPU a predbežné kontroly",
+      "intro": "Akonáhle si vyberiete GPU, skript spustí sériu kontrol, ktoré môžu každý blok ďalší postup:",
+      "items": [
+        "<strong>Ochrana SR-IOV.</strong> Odmietne VF a PF s aktívnymi VF, pretože nastavuje celé zariadenia, nie SR-IOV. SR-IOV nastavte samostatne na podporovanom hardvéri.",
+        "<strong>Jediná GPU.</strong> Po rezervovaní pre VFIO môže miestna konzola stratiť obraz. Najprv overte SSH alebo webový prístup z iného počítača.",
+        "<strong>Politika resetovania AMD.</strong> Číta <code>/sys/bus/pci/devices/&lt;pci&gt;/reset_method</code>. APU alebo samostatná karta bez FLR je <em>blokovaná politikou sprievodcu</em>; neznámy podtyp bez FLR vyžaduje potvrdenie. Nedokazuje to všeobecnú nemožnosť.",
+        "<strong>Stav D3cold.</strong> Sprievodca blokuje AMD karty so stavom <code>D3cold</code> pre riziko zlyhania aktivácie. Overte napájanie a firmvér.",
+        "<strong>Analýza skupiny IOMMU.</strong> Číta <code>/sys/kernel/iommu_groups/</code> a do plánu VM zahrnie <em>všetkých členov okrem mostov</em>, prípadne aj sieťové či úložné radiče. Ak skupina obsahuje zariadenia z iného slotu, skript ich vypíše pred súhrnom; overte, že hostiteľ žiadne z nich nepotrebuje. Pri čakajúcom reštarte IOMMU nie sú skutočné skupiny dostupné a plán najprv obsahuje iba vybranú funkciu GPU; izoláciu overte po reštarte."
+      ],
+      "audioIntro": "<strong>Pridružený zvuk.</strong> Dva prípady podľa umiestnenia radiča:",
+      "audioDgpu": "<strong>Samostatná GPU:</strong> zvuk HDMI býva vo funkcii <code>.1</code> rovnakého PCI slotu a pri zistení sa zahrnie. Ak ho používal hostiteľ, rezervovaním pre VM stratí prístup.",
+      "audioIgpu": "<strong>Bez zvukovej funkcie <code>.1</code>:</strong> zvuk môže byť na inom zariadení ako <code>00:1f.3</code>. Vypíše radiče a ovládače, napríklad <code>snd_hda_intel</code>. Predvolene nie je vybraný <strong>žiadny</strong>; vyberte iba potrebné."
+    },
+    "pickVm": {
+      "title": "Vyberte cieľovú VM",
+      "body": "Vyberte VM zo zoznamu. Vyžaduje q35 a podľa možnosti použije existujúce položky GPU. BIOS/UEFI je samostatné nastavenie, nie typ stroja. Čipovú súpravu ani režim štartu hosťa automaticky nemení.",
+      "imageAlt": "Výber VM podľa názvu, ID a stavu"
+    },
+    "switchMode": {
+      "title": "Riešenie existujúcich priradení",
+      "intro": "Skript prehľadá konfigurácie VM a LXC na hostiteľovi a zisťuje použitie vybranej GPU. Možné výsledky:",
+      "items": [
+        "<strong>GPU je voľná.</strong> Pokračuje bez odstránenia priradení.",
+        "<strong>Priradená inej VM.</strong> Najprv zastavte zdrojovú VM. Môžete <em>ponechať položky a vypnúť automatický štart</em> alebo <em>odstrániť položky a ponechať automatický štart</em>. Pri aktívnom <code>vfio-pci</code> bez potrebných zmien hostiteľa možno presun VM→VM vykonať bez jeho reštartu.",
+        "<strong>GPU používaná LXC.</strong> Pri bežných kontajneroch zvoľte <em>ponechať konfiguráciu GPU a vypnúť automatický štart</em> alebo <em>odstrániť konfiguráciu zariadenia GPU a automatický štart ponechať</em>. Odstránenie vymaže položky <code>devN</code> a pri AMD/Intel aj staré pravidlá <code>/dev/dri</code> <code>lxc.mount.entry</code> a <code>lxc.cgroup2.devices.allow</code>. Kontajnery OCI si ponechajú konfiguráciu a zastavia sa s vypnutým automatickým štartom; ich GPU odstráňte cez OCI manager Apps. Detekcia konfliktov prebieha podľa rodiny zariadení GPU a môže zahrnúť ďalšie karty tejto rodiny."
+      ],
+      "imageAlt": "Dialóg ponúka odstrániť GPU z LXC pred pridelením do VM",
+      "smartTitle": "Kontrola pridruženého zvuku pri odstránení GPU",
+      "smartBody": "Potom môže ponúknuť zoznam <strong>potenciálne nepotrebných zvukových zariadení</strong> zdrojovej VM. Zrušte výber stále potrebných. Napríklad môže ponechať <code>02:00.1</code> a ponúknuť odstránenie <code>00:1f.3</code>. O odstránení rozhoduje výber, nie zaručená univerzálna väzba zvuku a obrazu."
+    },
+    "audioPick": {
+      "title": "Bez zvukovej funkcie .1 vyberte potrebné radiče",
+      "body": "Stáva sa to len pre Intel iGPU a podobné split-audio nastavenia. Kontrolný zoznam zobrazuje každý PCI audio ovládač na hostiteľovi (s výnimkou všetkých už v skupine IOMMU GPU), označený jeho súčasným vodičom. Vyberte tie, ktoré chcete, alebo žiadne, ak VM nepotrebuje audio z hostiteľa hardvéru.",
+      "imageAlt": "Kontrolný dialóg s každým hostiteľom PCI audio ovládač (BDF + ovládač), keď GPU nemá .1 súrodenec",
+      "warnTitle": "Nevyberajte zvuk potrebný hostiteľovi",
+      "warnBody": "Priradenie zvuku môže odobrať prístup hostiteľovi; radič nemôže súčasne patriť inej spustenej VM. Nepotrebný zvuk nevyberajte a overte priradenia. Pípanie konzoly nemusí pochádzať z PCI zvuku."
+    },
+    "summary": {
+      "title": "Preskúmanie zhrnutia potvrdenia",
+      "body": "Overte konečný plán hostiteľa a VM a pri chybe ho zrušte. Zobrazuje skupinu IOMMU a počet jej zariadení; členovia z iného slotu sú vypísaní v predchádzajúcom kroku. Zrušenie zastaví hlavné zmeny, nevráti však skoršiu samostatne potvrdenú zmenu nastavenia štartu pre IOMMU.",
+      "imageAlt": "Súhrn plánovaných zmien hostiteľa a VM"
+    },
+    "hostApply": {
+      "title": "Uplatnia sa zmeny hostiteľa",
+      "intro": "Fáza vykonania mení hostiteľa a VM. Čistenie zvuku môže ešte vyžadovať výber. Možné zmeny:",
+      "items": [
+        "<code>/etc/modules</code> Dodáva: <code>vfio</code>, <code>vfio_iommu_type1</code>, <code>vfio_pci</code> (plus <code>vfio_virqfd</code> o jadrách &lt; 6.2).",
+        "<code>/etc/modprobe.d/vfio.conf</code> — AMD/Intel: <code>options vfio-pci ids=&lt;vendor:device,...&gt; disable_vga=1</code>. NVIDIA: <code>softdep nvidia pre: vfio-pci</code> (<code>_drm</code>/<code>_modeset</code>/<code>_uvm</code>); skutočné priradenie je podľa BDF. AMD pridáva poradie načítania <code>softdep</code>: <code>vfio-pci</code> → <code>radeon</code>/<code>amdgpu</code>.",
+        "Zapíše <code>/etc/modprobe.d/iommu_unsafe_interrupts.conf</code> a <code>kvm.conf</code> s <code>allow_unsafe_interrupts=1</code> a <code>ignore_msrs=1</code>. Ide o nastavenia skriptu, nie všeobecné požiadavky Windows/macOS; nebezpečné prerušenia oslabujú ochranu premapovania.",
+        "<code>/etc/modprobe.d/blacklist.conf</code>: NVIDIA — <code>nouveau</code>/<code>lbm-nouveau</code>; AMD — <code>radeon</code> + <code>amdgpu</code>; Intel — <code>i915</code>. Tieto pravidlá výrobcu môžu ovplyvniť ďalšie karty s rovnakým ovládačom. Modul <code>nvidia</code> sa blokuje <strong>iba</strong> cez <code>/etc/modprobe.d/proxmenux-nvidia-vfio-blacklist.conf</code>, keď sú <em>všetky</em> NVIDIA hostiteľa evidované pre VFIO.",
+        "<code>/etc/udev/rules.d/10-proxmenux-vfio-bind.rules</code> + <code>/etc/proxmenux/vfio-bind.bdfs</code> — <strong>Iba NVIDIA.</strong> Nastaví <code>ATTR'{'driver_override'}'=\"vfio-pci\"</code> pri PCI ADD pre evidované BDF vrátane funkcií dotknutej skupiny IOMMU. Mimo skupín môže zostať <code>nvidia</code>. Politika BDF nerozdelí hardvérovú skupinu IOMMU.",
+        "<strong>Iba AMD.</strong> Pokúsi sa o výpis ROM z <code>/sys/bus/pci/.../rom</code> alebo ACPI VFCT do <code>/usr/share/kvm/vbios_&lt;vendor&gt;_&lt;device&gt;.bin</code>. Pri úspechu VM použije <code>romfile=</code>. Platný výpis nezaručí úspešnú inicializáciu GPU.",
+        "<strong>Iba NVIDIA.</strong> Zastaví a vypne <code>nvidia-persistenced</code>, <code>nvidia-powerd</code>, <code>nvidia-fabricmanager</code> iba ak sú všetky NVIDIA rezervované pre VFIO. Pri zmiešanom použití zachová služby a <code>nvidia</code> pre natívne karty.",
+        "<code>update-initramfs -u -k all</code> — spustí sa iba pri zmene nastavenia hostiteľa."
+      ]
+    },
+    "vmApply": {
+      "title": "Konfigurácia VM sa aplikuje pomocou qm set",
+      "body": "VM konfig na <code>/etc/pve/qemu-server/&lt;vmid&gt;.conf</code> je aktualizovaný prostredníctvom <code>qm set</code> (nikdy priamo <code>sed</code>):",
+      "after1": "Pridáva <code>x-vga=1</code> pre AMD a NVIDIA, <strong>nie</strong> Intel. Ide o politiku skriptu, nie dôkaz, že všetkým Intel iGPU chýba firmvér alebo že príznak vždy spôsobuje zamrznutie.",
+      "after2": "Dodatočné linky <code>hostpciN</code> sú pripojené, ak skupina IOMMU GPU obsahuje ďalšie zariadenia, ktoré potrebujete spoločne prechádzať."
+    },
+    "reboot": {
+      "title": "Reštart pri požadovanej zmene hostiteľa",
+      "body": "Pri zmene štartu alebo ovládačov postupujte podľa výzvy na reštart a pred VM overte aktívne priradenie GPU. Uložené nastavenie nepotvrdzuje aktiváciu. Presun VM→VM so správnym VFIO nemusí vyžadovať reštart hostiteľa.",
+      "imageAlt": "Súhrnná obrazovka znázorňujúca, čo bolo zmenené, nasledovaná reštartom"
+    }
+  },
+  "vendors": {
+    "heading": "Poznámky podľa výrobcu",
+    "nvidiaHeading": "NVIDIA",
+    "nvidiaBody": "Zachováva staršie riešenie pre <em>Code 43</em>: <code>hidden=1</code>, ID <code>NV43FIX</code> v <code>args</code> a <code>kvm=off</code>. Nie je všeobecnou požiadavkou dnešných GeForce; NVIDIA povolila Windows passthrough od R465. Chyba môže mať iné príčiny; overte GPU a ovládač.",
+    "nvidiaMultiHeading": "Podpora multi-GPU NVIDIA",
+    "nvidiaMultiBody": "Zmiešané použitie NVIDIA <strong>podľa BDF</strong>. Funkcie <code>vfio-pci</code> eviduje podľa adresy, nielen ID <code>vendor:device</code>. Mimo dotknutých skupín môže ponechať <code>nvidia</code>; overte cez <code>nvidia-smi</code>. Dve karty v rovnakej skupine tým neizoluje.",
+    "amdHeading": "AMD",
+    "amdBody": "Niektoré AMD GPU sa po zastavení VM nedajú resetovať. Sprievodca overuje hlásené schopnosti, nie každý reálny cyklus. <vendorResetLink>vendor-reset</vendorResetLink> podporuje obmedzený zoznam, vyžaduje kompatibilné jadro a skoré načítanie; nenainštaluje sa. Aj <em>RadeonResetBugFix</em> pre Windows závisí od hardvéru, bez všeobecnej záruky.",
+    "intelHeading": "Intel iGPU",
+    "intelBody": "Úplné priradenie Intel iGPU a SR-IOV sú odlišné postupy. Sprievodca rezervuje celé zariadenie pre jednu VM bez <code>x-vga=1</code>. <sriovLink>i915-sriov-dkms</sriovLink> vyžaduje podporovaný hardvér a jadro; „UHD 630+“ nie je pravidlo kompatibility. Pripravte náhradný prístup k hostiteľovi."
+  },
+  "verification": {
+    "heading": "Overenie"
+  },
+  "troubleshoot": {
+    "heading": "Riešenie problémov",
+    "code43Title": "Kód 43 vo Windows (NVIDIA)",
+    "code43Body": "Code 43 nedokazuje chybu skrytia KVM. Overte <code>qm config VMID | grep -E \"cpu|args\"</code> so skutočným VMID, potom <code>hidden=1</code> a <code>hv_vendor_id=NV43FIX</code>. Overte aj hosťovský ovládač, firmvér a priradenie. Opakovanie môže pri existujúcom priradení skončiť.",
+    "amdResetTitle": "AMD GPU funguje raz, zlyháva na reštarte VM",
+    "amdResetBody": "Zlyhanie resetovania je jednou z príčin. Reštart alebo úplné vypnutie môže dočasne pomôcť. Overte podporu a skoré načítanie <code>vendor-reset</code>; samotné <code>softdep amdgpu pre: vendor-reset</code> nezaručí načítanie pred VFIO. Aj <em>RadeonResetBugFix</em> potrebuje kompatibilnú GPU.",
+    "stuckBootTitle": "VM prilepené booting / GPU nezistené",
+    "stuckBootBody": "Overte skutočnú adresu cez <code>lspci -nnk -s PCI_ADDRESS</code>; očakáva sa <code>Kernel driver in use: vfio-pci</code>. Nahraďte PCI_ADDRESS. Pri natívnom ovládači overte politiku priradenia, nielen <code>/etc/modprobe.d/blacklist.conf</code>; NVIDIA používa stav BDF. Pozrite <code>dmesg | grep vfio</code>. Po oprave spustite <code>update-initramfs -u -k all</code> a plánovaný reštart.",
+    "darkTitle": "Hostiteľská konzola ide tma po reštarte a nemôžem SSH v",
+    "darkBody": "Čierna obrazovka nedokazuje výpadok hostiteľa. Ak nefunguje ani SSH, overte sieť a radiče zahrnuté v skupine IOMMU. Obnovte prístup cez IPMI, sériovú konzolu alebo záchranné prostredie; overte <code>/etc/pve/qemu-server/&lt;vmid&gt;.conf</code> a vráťte iba príslušné priradenia a pravidlá. Nemažte nesúvisiace nastavenia.",
+    "logTitle": "Skontrolujte protokol inštalácie",
+    "logBody": "Každé spustenie zapisuje <code>/tmp/add_gpu_vm.log</code>. Záznam priložte k žiadosti o pomoc."
+  },
+  "revert": {
+    "heading": "Ručné vrátenie zmien",
+    "intro": "Zastavte VM a odstráňte iba príslušné PCI priradenia v Hardvéri alebo pomocou nižšie uvedeného indexu. GPU sa tým nevráti natívnemu ovládaču hostiteľa. Na to použite Zmeniť režim GPU a pred potvrdením overte dotknutých hostí."
+  },
+  "related": {
+    "heading": "Súvisiace",
+    "items": [
+      {
+        "label": "Nainštalovať ovládače NVIDIA (host)",
+        "href": "/docs/hardware/nvidia-host",
+        "tail": " — príprava ovládača pre natívne karty hostiteľa; GPU vo VFIO ho nemôže používať súčasne."
+      },
+      {
+        "label": "Pridať GPU do LXC",
+        "href": "/docs/hardware/igpu-acceleration-lxc",
+        "tail": " — alternatíva: zdieľať GPU s viacerými kontajnermi namiesto vyhradenia jednej VM."
+      },
+      {
+        "label": "Zmeniť režim GPU (VM ↔ LXC)",
+        "href": "/docs/hardware/switch-gpu-mode",
+        "tail": " — prepnutie tej istej GPU medzi zdieľaním a výhradným priradením."
+      },
+      {
+        "label": "GPU Prenosové príkazy",
+        "href": "/docs/help-info/gpu-commands",
+        "tail": " — lspci, overenie IOMMU a prehľad qm set hostpci."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sk/docs/hardware/igpu-acceleration-lxc.json b/web/messages/sk/docs/hardware/igpu-acceleration-lxc.json
new file mode 100644
index 00000000..ca86ae9f
--- /dev/null
+++ b/web/messages/sk/docs/hardware/igpu-acceleration-lxc.json
@@ -0,0 +1,185 @@
+{
+  "meta": {
+    "title": "Pridanie GPU do LXC | Dokumentácia ProxMenux",
+    "description": "Zdieľajte GPU Intel, AMD alebo NVIDIA s LXC. ProxMenux nastaví zariadenia, skupiny a knižnice podľa distribúcie; aplikácia musí akceleráciu podporovať a mať nastavenú."
+  },
+  "header": {
+    "title": "Pridať GPU do LXC",
+    "description": "Zdieľa prístup ku GPU s LXC cez zariadenia hostiteľa. Ovládač zostáva na hostiteľovi; aplikácie potrebujú kompatibilné knižnice a vlastné nastavenie.",
+    "section": "Hardvér: grafické karty a Coral TPU"
+  },
+  "intro": {
+    "title": "Čo robí",
+    "body": "Pridá položky <code>dev&lt;N&gt;</code> do <code>/etc/pve/lxc/&lt;ctid&gt;.conf</code> pre príslušné uzly <code>/dev/dri/*</code>, <code>/dev/kfd</code> alebo <code>/dev/nvidia*</code>. Spustí kontajner, nainštaluje balíky používateľského priestoru pre jeho distribúciu a pri Intel/AMD zosúladí skupiny <code>video</code> a <code>render</code>. Akcelerácia aplikácií naďalej vyžaduje kompatibilný hardvér, knižnice a nastavenie aplikácie."
+  },
+  "compare": {
+    "heading": "Zdieľanie LXC a priame priradenie VM",
+    "intro": "LXC zdieľa jadro a môže GPU <em>zdieľať</em> medzi hostiteľom a kontajnermi. Pri <vmLink>úplnom priradení VM</vmLink> je zariadenie vyhradené tejto VM a ovládač hostiteľa ho nemôže používať.",
+    "headerFeature": "Funkcia",
+    "headerLxc": "LXC (táto stránka)",
+    "headerVm": "VM",
+    "rows": [
+      {
+        "feature": "Hostiteľ stále používa GPU?",
+        "lxc": "Áno",
+        "vm": "Nie, exkluzívny pre VM"
+      },
+      {
+        "feature": "Viac kontajnerov zdieľajúcich jednu GPU?",
+        "lxc": "Áno",
+        "vm": "Nie"
+      },
+      {
+        "feature": "Vyžaduje IOMMU / VFIO na hostiteľovi?",
+        "lxc": "Nie",
+        "vm": "Áno"
+      },
+      {
+        "feature": "Požaduje sa reštart?",
+        "lxc": "Zvyčajne nie (len reštart CT)",
+        "vm": "Pri zmene ovládača alebo IOMMU hostiteľa; nie pri každom priradení"
+      },
+      {
+        "feature": "Hosťovské operačné systémy",
+        "lxc": "Iba Linux (LXC je iba Linux)",
+        "vm": "Podporovaný hosťovský OS s kompatibilným ovládačom GPU"
+      }
+    ]
+  },
+  "prereqs": {
+    "title": "Skôr ako začnete",
+    "gpu": "<strong>GPU na hostiteľovi</strong> Intel, AMD alebo NVIDIA zistená cez <code>lspci</code>.",
+    "gpuCheck": "lspci | grep -iE 'VGA|3D|Display'",
+    "vfio": "<strong>GPU nesmie byť priradená vfio-pci.</strong> Potrebuje natívny ovládač hostiteľa. Pri priradení VM skript ponúkne <switchLink>Zmeniť režim GPU</switchLink>.",
+    "nvidia": "<strong>Pre NVIDIA:</strong> najprv nainštalujte ovládač hostiteľa. Knižnice kontajnera musia zodpovedať jeho verzii. Pozrite <nvidiaLink>Inštalácia ovládačov NVIDIA na hostiteľa</nvidiaLink>.",
+    "nvidiaCheck": "nvidia-smi",
+    "container": "<strong>Existujúci LXC.</strong> Skript ho nevytvorí. Podporuje oba režimy; <strong>privilegovaný</strong> kontajner nie je vždy nutný. Zariadenia a číselné skupinové oprávnenia aplikácie musia súhlasiť."
+  },
+  "unpriv": {
+    "title": "Podporuje privilegované aj neprivilegované kontajnery",
+    "body": "Skript píše položky <code>dev&lt;N&gt;</code> na LXC config a, na neprivilegovaných kontajneroch, zarovná <code>video</code> a <code>render</code> GIDs medzi hostiteľom a kontajnerom, takže uzly zariadenia GPU sú dosiahnuteľné zvnútra bez toho, aby ste museli ručne editovať <code>lxc.idmap</code>."
+  },
+  "running": {
+    "heading": "Spustenie inštalátora",
+    "body": "Otvorte ProxMenux a vyberte <strong>Hardvér: GPU a Coral-TPU → Pridať GPU do LXC</strong>.",
+    "imageAlt": "Položka ponuky na pridanie GPU do LXC"
+  },
+  "howRuns": {
+    "heading": "Ako skript funguje",
+    "body": "Vyberte kontajner a rodiny GPU a prejdite kontrolami. Potom spracovanie zastaví a zmení kontajner bez ďalšieho konečného potvrdenia. Voliteľné čistenie VFIO má vlastné potvrdenie a môže skôr zmeniť hostiteľa."
+  },
+  "walkthrough": {
+    "heading": "Postup krok za krokom",
+    "detect": {
+      "title": "Zistenie GPU hostiteľa",
+      "body": "Hľadá radiče GPU cez <code>lspci</code>. Pre NVIDIA overí modul <code>nvidia</code> a <code>nvidia-smi</code>; zistená verzia určuje inštalátor <code>.run</code> pre kontajner.",
+      "tipTitle": "NVIDIA nie je pripravený?",
+      "tipBody": "Ak chýba modul alebo NVIDIA na hostiteľovi nefunguje, najprv použite <nvidiaLink>Inštalácia ovládačov NVIDIA na hostiteľa</nvidiaLink> a ovládač overte."
+    },
+    "pickCt": {
+      "title": "Vyberte kontajner LXC",
+      "body": "Zobrazí vhodné kontajnery LXC podľa ID a názvu; kontajnery OCI sú vylúčené a pre zariadenia používajú OCI manager Apps. Kontajner sa zastaví, ak beží, spustí sa na inštaláciu ovládačov a bežne sa vráti do pôvodného stavu (spustený/zastavený).",
+      "imageAlt": "Výber existujúceho kontajnera LXC"
+    },
+    "selectGpu": {
+      "title": "Vyberte rodiny GPU",
+      "body": "Zoznam vyberá rodiny výrobcov, nie izolované PCI zariadenie. Intel/AMD pridajú určené uzly DRI; NVIDIA dostupné zariadenia, prípadne z viacerých kariet. Jediná rodina sa vyberie automaticky. Overte výsledný zoznam najmä pri viacerých GPU.",
+      "imageAlt": "Zoznam zistených rodín GPU s názvom a PCI adresou"
+    },
+    "preflight": {
+      "title": "Predbežné kontroly",
+      "imageAlt": "Ponuka zmeny režimu GPU priradenej vfio-pci",
+      "intro": "Tri kontroly, ktoré vás môžu blokovať alebo presmerovať:",
+      "items": [
+        "<strong>Ochrana SR-IOV.</strong> Sprievodca blokuje VF alebo PF s aktívnymi VF. Je to obmedzenie širokého výberu zariadení, nie všeobecný zákaz v LXC. Tieto zariadenia nastavte samostatne.",
+        "<strong>Priradená vfio-pci.</strong> Natívny ovládač nevytvorí <code>/dev/dri/*</code> ani <code>/dev/nvidia*</code>. Ponúkne <switchLink>Zmeniť režim GPU</switchLink>; postupujte podľa pokynov na reštart a vráťte sa.",
+        "<strong>Už nastavená.</strong> Ak sú všetky zariadenia prítomné, skončí bez preinštalovania knižníc. Pokračuje iba s chýbajúcimi vybranými rodinami."
+      ]
+    },
+    "applyConfig": {
+      "title": "Použiť zmeny konfigurácie LXC",
+      "body1": "Zastaví kontajner, ak beží, a upraví <code>/etc/pve/lxc/&lt;ctid&gt;.conf</code>. Číslované položky <code>dev&lt;N&gt;</code> obsahujú GID hostiteľa pre <code>video</code> alebo <code>render</code>. Existujúce riadky bind <code>lxc.mount.entry</code> pre <code>/dev/dri</code> sa nahradia položkami <code>dev:</code>; overte výslednú konfiguráciu a oprávnenia.",
+      "body2": "Príklad po Intel + NVIDIA na tom istom kontajneri:"
+    },
+    "installDrivers": {
+      "title": "Spustiť kontajner a inštalovať ovládače vnútri",
+      "body": "Spustí kontajner a čaká približne 30 sekúnd na odpoveď <code>pct exec</code>. Zistí distribúciu cez <code>/etc/os-release</code> a nainštaluje príslušné balíky.",
+      "headerDistro": "Distribúcia",
+      "headerInt": "Intel / AMD",
+      "headerNvidia": "NVIDIA",
+      "rows": [
+        {
+          "distro": "Alpine",
+          "intel": "apk add mesa-va-gallium intel-media-driver libva-utils",
+          "nvidia": "apk add nvidia-utils"
+        },
+        {
+          "distro": "Arch / Manjaro",
+          "intel": "pacman -Sy intel-media-driver mesa libva-utils",
+          "nvidia": "pacman -Sy nvidia-utils"
+        }
+      ],
+      "debianDistro": "Debian / Ubuntu / ostatné",
+      "debianIntel": "apt-get install va-driver-all intel-opencl-icd vainfo",
+      "debianNvidia": "Rozbalí <code>.run</code> na hostiteľovi → <code>pct push</code> → inštaluje s <code>--no-kernel-modules --no-dkms</code>.",
+      "whyTitle": "Prečo na Debiane používa inštalátor NVIDIA .run",
+      "whyBody": "Balíky nemusia zodpovedať hostiteľovi. Knižnice <strong>musia zodpovedať načítanému modulu hostiteľa</strong> pre NVML a <code>nvidia-smi</code>. Debian/glibc použije uložený <code>.run</code> verzie hostiteľa, rozbalí a zabalí ho na hostiteľovi, prenesie cez <code>pct push</code> a inštaluje s <code>--no-kernel-modules --no-dkms</code>. Alpine a Arch používajú repozitáre; overte verzie."
+    },
+    "alignGids": {
+      "title": "Zarovnať GID a obnoviť stav",
+      "body1": "Pri Intel/AMD načíta GID hostiteľa pre <code>video</code> a <code>render</code>, pričom 44/104 použije iba ako náhradné hodnoty, a potom upraví <code>/etc/group</code> v kontajneri tak, aby zodpovedali; pri behu iba s NVIDIA sa tento krok preskočí. Položky ako <code>video:44</code> a <code>render:104</code> sú príklady, nie univerzálne ID. Overte členstvo aplikácie a účinné oprávnenia k zariadeniam.",
+      "body2": "Pri bežnom dokončení pôvodne zastavený kontajner znovu zastaví; pôvodne spustený nechá bežať. Pri chybe spustenia alebo inštalácie overte konečný stav a záznam."
+    }
+  },
+  "vendors": {
+    "heading": "Poznámky podľa výrobcu",
+    "intelHeading": "Intel iGPU",
+    "intelBody": "Akcelerácia médií Intel vrátane <em>Quick Sync</em> závisí od generácie GPU, kodekov a nastavenia aplikácie. Skript zdieľa tie z <code>/dev/dri/card0</code>, <code>card1</code>, <code>renderD128</code> a <code>renderD129</code>, ktoré existujú; iné čísla uzlov sa nepridajú. Hostiteľ ich už musí poskytovať prostredníctvom natívneho ovládača, napríklad <code>i915</code>.",
+    "amdHeading": "AMD",
+    "amdBody": "AMD používa DRI pre Mesa/VA-API. Ak hostiteľ poskytuje <code>/dev/kfd</code>, zdieľa aj ten. ROCm/OpenCL potrebuje podporovaný hardvér a kompatibilné knižnice; zdieľanie zariadenia nenainštaluje celé prostredie ROCm.",
+    "nvidiaHeading": "NVIDIA",
+    "nvidiaBody": "Zdieľa dostupné <code>/dev/nvidia*</code>. <strong>Zhoda verzií ovládača</strong> je dôležitá pre <code>nvidia-smi</code>. Debian/glibc používa <code>.run</code> verzie hostiteľa, Alpine/Arch repozitáre. Pod 2048 MiB nastavenej RAM ponúkne dočasné zvýšenie a potom obnoví hodnotu; vyžaduje aj 1500 MiB voľného disku.",
+    "updateTitle": "Po aktualizácii NVIDIA hostiteľa overte knižnice LXC",
+    "updateBody": "Staré knižnice môžu vyvolať chybu <code>nvidia-smi</code>. <nvidiaLink>Inštalátor NVIDIA hostiteľa</nvidiaLink> ponúka aktualizáciu kontajnerov. Opätovné pridanie môže pri existujúcich zariadeniach skončiť a aktualizáciu knižníc nezaručuje. Overte verzie a aktualizujte príslušné balíky alebo používateľský inštalátor."
+  },
+  "verification": {
+    "heading": "Overenie",
+    "body": "V kontajneri overte, či je GPU viditeľná a použiteľná."
+  },
+  "troubleshoot": {
+    "heading": "Riešenie problémov",
+    "mismatchTitle": "nvidia-smi: Failed to initialize NVML: Driver/library version mismatch",
+    "mismatchBody": "Knižnice nezodpovedajú načítanému modulu. Overte verzie a aktualizujte používateľský priestor LXC. Uložený <code>.run</code> slúži pre Debian/glibc, no pridanie môže skončiť, ak už všetky zariadenia existujú.",
+    "denyTitle": "Povolenie zamietnuté na /dev/dri/renderD128 vnútri kontajnera",
+    "denyBody": "Overte zariadenie a číselné oprávnenia <code>render</code>, potom členstvo používateľa v <code>render</code>. Ak je príkaz dostupný, pridajte ho do <code>render</code> cez <code>usermod -aG render &lt;user&gt;</code>; zástupný text nahraďte skutočným účtom. Reštartujte reláciu. Zmena privilégií nie je všeobecná oprava.",
+    "vainfoTitle": "vainfo hovorí: VA-API verzia 1.xx; nepodarilo sa inicializovať",
+    "vainfoBody": "Overte prístup a ovládač VA-API. Názvy balíkov závisia od distribúcie: napríklad <code>intel-media-driver</code> pre podporované novšie Intel GPU, <code>i965-va-driver</code> pre staršie a <code>mesa-va-drivers</code> pre AMD. Samotná správa nepotvrdzuje chýbajúci balík.",
+    "logTitle": "Záznam inštalácie",
+    "logBody": "Každé spustenie zapisuje <code>/tmp/add_gpu_lxc.log</code> na hostiteľovi. Priložte záznam k žiadosti o pomoc."
+  },
+  "related": {
+    "heading": "Súvisiace",
+    "items": [
+      {
+        "label": "Nainštalovať ovládače NVIDIA (host)",
+        "href": "/docs/hardware/nvidia-host",
+        "tail": " — pred zdieľaním NVIDIA nainštalujte ovládač hostiteľa."
+      },
+      {
+        "label": "Pridať GPU do VM (passthrough)",
+        "href": "/docs/hardware/gpu-vm-passthrough",
+        "tail": " — alternatíva na vyhradenie GPU jednej VM."
+      },
+      {
+        "label": "Zmeniť režim GPU (VM ↔ LXC)",
+        "href": "/docs/hardware/switch-gpu-mode",
+        "tail": " — prepnutie GPU medzi zdieľaním LXC a priradením VM."
+      },
+      {
+        "label": "GPU Prenosové príkazy",
+        "href": "/docs/help-info/gpu-commands",
+        "tail": " — stručný prehľad súvisiacich príkazov shellu."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sk/docs/hardware/install-coral-tpu-host.json b/web/messages/sk/docs/hardware/install-coral-tpu-host.json
new file mode 100644
index 00000000..b0b7ae5b
--- /dev/null
+++ b/web/messages/sk/docs/hardware/install-coral-tpu-host.json
@@ -0,0 +1,203 @@
+{
+  "meta": {
+    "title": "Inštalácia Coral TPU na hostiteľa | Dokumentácia ProxMenux",
+    "description": "Inštaluje komponenty Coral na Proxmox VE podľa hardvéru: gasket/apex cez DKMS pre M.2 / Mini-PCIe a libedgetpu1-std pre USB. Pri oboch typoch vykoná oba postupy."
+  },
+  "header": {
+    "title": "Inštalácia Coral TPU na hostiteľa",
+    "description": "Pripraví hostiteľa Proxmoxu na Coral a zdieľanie LXC. Zistí M.2 / Mini-PCIe, USB alebo oba a použije príslušný postup: moduly DKMS pre PCIe a runtime Google Edge TPU pre USB.",
+    "section": "Hardvér: grafické karty a Coral TPU"
+  },
+  "intro": {
+    "title": "Čo robí",
+    "body": "<strong>Jeden inštalátor s rozpoznaním hardvéru</strong>. PCIe používa <code>gasket</code> a <code>apex</code> s DKMS; budúce zostavenia vyžadujú kompatibilné zdroje a hlavičky. USB používa <code>libedgetpu1-std</code>. Pri oboch typoch vykoná oba postupy. Runtime USB musí byť tam, kde beží aplikácia; pri použití iba v LXC nie je nevyhnutný aj na hostiteľovi."
+  },
+  "which": {
+    "heading": "Ktorý Coral mám?",
+    "body": "Modely PCIe a USB majú odlišné vyhotovenie a požiadavky. Skript podporuje oba; pred spustením identifikujte svoje zariadenie.",
+    "headerForm": "Vyhotovenie",
+    "headerDetect": "Detekcia",
+    "headerInstall": "Typ inštalácie",
+    "headerReboot": "Reštart?",
+    "pcieForm": "M.2 / Mini-PCIe",
+    "pcieFormSub": "(karty M.2 existujú s jedným alebo dvoma Edge TPU)",
+    "pcieDetect": "PCI ID výrobcu <code>1ac1</code>",
+    "pcieInstall": "Modul jadra (gasket + apex) cez DKMS",
+    "pcieReboot": "Áno",
+    "usbForm": "USB akcelerátor",
+    "usbFormSub": "(malý plastový USB adaptér)",
+    "usbDetect": "USB <code>1a6e:089a</code> (nenaprogramované) / <code>18d1:9302</code> (naprogramované)",
+    "usbInstall": "Používateľský runtime <code>libedgetpu1-std</code> z repozitára APT Google",
+    "usbReboot": "Nie"
+  },
+  "prereqs": {
+    "title": "Skôr ako začnete",
+    "coral": "<strong>Pripojený Coral</strong> (M.2, Mini-PCIe alebo USB) na inštaláciu. Bez zisteného hardvéru môže ponúknuť čistenie či odstránenie existujúcich komponentov, nový hardvérový postup však neinštaluje.",
+    "coralCheck": "lspci -d 1ac1: ; lsusb | grep -E '1a6e:089a|18d1:9302'",
+    "internet": "<strong>Prístup na internet</strong> na hostiteľovi na klonovanie ovládača PCIe z GitHubu alebo stiahnutie <code>libedgetpu1-std</code> z repozitára APT Google pre USB.",
+    "headers": "<strong>Hlavičky jadra dostupné cez APT</strong>: <code>proxmox-headers-$(uname -r)</code>. Potrebné iba pre PCIe/M.2; skript ich nainštaluje.",
+    "reboot": "<strong>Naplánujte reštart</strong> pre PCIe. Skript sa pokúsi načítať zostavené moduly; reštart overí aj ich automatické načítanie."
+  },
+  "hostPrepTip": {
+    "title": "To len pripravuje hostiteľa",
+    "body": "Pripraví hostiteľa na <em>prístup k zariadeniu</em>, aplikáciu však nenastaví ani neotestuje. Ak chcete Coral <em>používať</em> v kompatibilnej aplikácii ako Frigate, pokračujte na <lxcLink>Pridanie Coral TPU do LXC</lxcLink>."
+  },
+  "running": {
+    "heading": "Spustenie inštalátora",
+    "body": "Otvorte ProxMenux na hostiteľovi a vyberte <strong>Hardvér: GPU a Coral-TPU → Inštalovať/aktualizovať Coral TPU na hostiteľovi</strong>.",
+    "imageAlt": "Položka ponuky na inštaláciu alebo aktualizáciu Coral TPU na hostiteľovi"
+  },
+  "howRuns": {
+    "heading": "Ako skript funguje",
+    "body": "Najprv zistí hardvér a pripraví príslušný plán. Inštalácia vyžaduje potvrdenie."
+  },
+  "walkthrough": {
+    "heading": "Postup krok za krokom",
+    "detect": {
+      "title": "Detekcia hardvéru",
+      "body": "Hľadá výrobcu <code>0x1ac1</code> v <code>/sys/bus/pci/devices/*/vendor</code> a USB zisťuje cez <code>lsusb</code>. Existujú <strong>dva</strong> USB identifikátory podľa stavu firmvéru:",
+      "items": [
+        "<code>1a6e:089a</code> — Global Unichip, stav <em>nenaprogramované</em>, pred načítaním firmvéru cez runtime.",
+        "<code>18d1:9302</code> — Google, stav <em>naprogramované</em>, po načítaní firmvéru."
+      ],
+      "outro": "Ak nezistí Coral ani existujúcu inštaláciu, zobrazí vysvetlenie a skončí. Existujúce komponenty môžu vyvolať ponuku čistenia alebo odstránenia."
+    },
+    "prompt": {
+      "title": "Potvrdenie inštalácie",
+      "body": "Pred inštaláciou dialóg zobrazí zariadenia a plánované komponenty. Zrušením inštaláciu preskočíte. Voliteľné čistenie starých komponentov má samostatné predchádzajúce potvrdenie.",
+      "imageAlt": "Prehľad zariadení Coral a krokov inštalácie"
+    },
+    "pcie": {
+      "title": "PCIe: moduly gasket a apex cez DKMS",
+      "body": "Spustí sa iba pri zistenom Coral PCIe/M.2. Zostaví moduly pre aktuálne spustené jadro hostiteľa.",
+      "items": [
+        "<strong>Čistenie.</strong> Existujúci balík <code>gasket-dkms</code> sa pred opätovným zostavením odstráni; ak je v chybnom stave, skript vynúti jeho odstránenie a vyčistenie (purge).",
+        "<strong>Závislosti na zostavenie:</strong> <code>git</code>, <code>dkms</code>, <code>build-essential</code>, <code>proxmox-headers-$(uname -r)</code>."
+      ],
+      "cloneIntro": "<strong>Klonuje zdroje ovládača.</strong> Uprednostní <feranickLink>feranick/gasket-driver</feranickLink>, inak použije <googleLink>google/gasket-driver</googleLink>. Úspešné zostavenie závisí od kompatibility jadra. Na zdroje Google aplikuje tieto opravy podľa verzie:",
+      "kernelPatches": [
+        "Pre jadro 6.5 a novšie nahradí v náhradných zdrojoch <code>no_llseek</code> za <code>noop_llseek</code>.",
+        "Jadro 6.13 a novšie: zmení argument <code>MODULE_IMPORT_NS(DMA_BUF)</code> na reťazcový literál."
+      ],
+      "afterItems": [
+        "<strong>Skopíruje zdroje do <code>/usr/src/gasket-1.0/</code>,</strong> vytvorí <code>dkms.conf</code> a zaregistruje ich cez <code>dkms add</code>.",
+        "<strong>Zostaví a nainštaluje:</strong> <code>dkms build</code>, potom <code>dkms install</code>. Pri zlyhaní zobrazí posledných 50 riadkov <code>make.log</code>, ak je dostupný.",
+        "<strong>Vytvorí skupinu <code>apex</code> a pravidlá udev</strong> (<code>/etc/udev/rules.d/99-coral-apex.rules</code>) na priradenie skupiny zariadeniam <code>/dev/apex_*</code>.",
+        "<strong>Pokúsi sa načítať moduly:</strong> <code>modprobe gasket</code> a <code>modprobe apex</code>."
+      ],
+      "imageAlt": "Zostavenie cez DKMS a načítanie modulov gasket/apex"
+    },
+    "usb": {
+      "title": "USB: runtime Edge TPU od Googlu",
+      "body": "Spustí sa len vtedy, ak bol zistený akcelerátor USB. Oveľa jednoduchšie:",
+      "items": [
+        "<strong>Pridá kľúč GPG Googlu</strong> do <code>/etc/apt/keyrings/coral-edgetpu.gpg</code>.",
+        "<strong>Pridá repozitár APT</strong> do <code>/etc/apt/sources.list.d/coral-edgetpu.list</code>; <code>signed-by=</code> obmedzí overenie na jeho zväzok kľúčov. Ide o jednoriadkový formát .list, nie deb822 .sources.",
+        "<strong>Nainštaluje <code>libedgetpu1-std</code></strong>, runtime Edge TPU so štandardným výkonom.",
+        "<strong>Znovu načíta udev</strong> a uplatní pravidlá balíka na zariadenie USB."
+      ],
+      "stdTitle": "Prečo libedgetpu1-std a nie libedgetpu1-max?",
+      "stdBody": "Balík <code>max</code> zapne najvyššiu podporovanú frekvenciu a zvýši výkon, spotrebu aj zahrievanie. Pred zmenou overte chladenie a prevádzkové podmienky akcelerátora. Balíky sa navzájom vylučujú; zmenu vykonáte cez <code>apt install libedgetpu1-max</code>."
+    },
+    "reboot": {
+      "title": "Voliteľný reštart po inštalácii PCIe",
+      "body": "Po PCIe ponúkne reštart. Už sa pokúsil o <code>modprobe</code>; overte načítané moduly a <code>/dev/apex_0</code> so skupinou <code>apex</code>. Plánovaný reštart preverí automatické načítanie. Pri samotnom USB reštart hostiteľa neponúkne.",
+      "imageAlt": "Súhrn a ponuka reštartu po inštalácii PCIe"
+    }
+  },
+  "legacyCleanup": {
+    "heading": "Čistenie starého gasket-dkms na hostiteľoch iba s USB",
+    "intro": "Ak <strong>nezistí Coral PCIe/M.2</strong>, ale nájde starú inštaláciu <code>gasket-dkms</code>, ponúkne voliteľné čistenie s potvrdením.",
+    "items": [
+      "Ak zistí Coral PCIe/M.2, použije bežné opätovné zostavenie DKMS a toto čistenie neponúkne.",
+      "Odstráni <code>gasket-dkms</code>, staré záznamy DKMS a zdroje gasket a opraví nevybavený stav <code>dpkg</code>/APT.",
+      "Zachová USB balíky <code>libedgetpu1-std</code> a <code>libedgetpu1-max</code>, takže Coral USB si ponechá runtime.",
+      "Skript potvrdzuje, že starý balík je preč a že správa balíkov je pred nahlásením úspechu zdravá."
+    ],
+    "warningTitle": "Potvrdiť najprv hardvér",
+    "warningBody": "Ak očakávaný Coral PCIe/M.2 nie je zistený, zrušte čistenie a skontrolujte kartu, slot a firmvér."
+  },
+  "reinstallUninstall": {
+    "heading": "Preinštalovať alebo odinštalovať",
+    "intro": "Pri zistenej inštalácii PCIe s <code>gasket-dkms</code>, USB s <code>libedgetpu1-std</code>/<code>libedgetpu1-max</code> alebo oboch zobrazí ponuku akcií.",
+    "imageAlt": "Ponuka na preinštalovanie, aktualizáciu alebo odinštalovanie Coral",
+    "imageCaption": "Ponuka sa zobrazí, ak existuje komponent: záznam DKMS gasket, balík <code>libedgetpu1-*</code> alebo zariadenia <code>/dev/apex_*</code>.",
+    "reinstallHeading": "Preinštalovať/aktualizovať",
+    "reinstallBody": "Spustí bežnú inštaláciu: opätovné zostavenie po zmene jadra alebo aktualizáciu <code>libedgetpu1-*</code> z Googlu. Najprv vyčistí predchádzajúci stav DKMS, aby chybná inštalácia neblokovala zostavenie.",
+    "uninstallHeading": "Odinštalovať čo sa odstráni",
+    "uninstallIntro": "Vyžaduje potvrdenie. Aplikácie LXC používajúce <code>/dev/apex_*</code> môžu stratiť prístup počas odstránenia alebo po reštarte. Postup:",
+    "uninstallItems": [
+      "Pokúsi sa uvoľniť <code>apex</code> a <code>gasket</code>; aktívne používanie tomu môže zabrániť.",
+      "Odstráni každú položku DKMS registrovanú na <code>gasket/&lt;version&gt;</code>, aby sa moduly nevrátili na ďalšiu inštaláciu jadra.",
+      "Úplne odstráni <code>gasket-dkms</code>, <code>libedgetpu1-std</code> a <code>libedgetpu1-max</code> a spustí <code>apt-get autoremove --purge</code>.",
+      "Odstráni <code>/etc/udev/rules.d/99-coral-apex.rules</code> a obnoví predvolenú skupinu v <code>60-gasket-dkms.rules</code>, ak súbor ešte existuje.",
+      "Skontroluje doplnkových členov <code>apex</code>. <strong>Ak je zoznam prázdny</strong>, pokúsi sa skupinu odstrániť; inak <code>apex</code> zachová a vypíše členov. Nejde o úplnú kontrolu používateľov s touto primárnou skupinou.",
+      "Odstráni zoznam repozitárov <code>/etc/apt/sources.list.d/coral-edgetpu.list</code>, starší <code>coral-cloud.list</code> a staré zväzky kľúčov s názvom <code>coral-edgetpu-archive-keyring.gpg</code>. Aktuálny zväzok kľúčov v <code>/etc/apt/keyrings/coral-edgetpu.gpg</code> tento postup neodstráni.",
+      "Ponúkne reštart <strong>iba ak bol nainštalovaný PCIe postup</strong>, aby uvoľnil stále aktívne moduly. Odstránenie samotného USB reštart nevyžaduje."
+    ],
+    "lxcWarnTitle": "Nádoby LXC s priechodom apex",
+    "lxcWarnBody": "Odstránenie komponentov hostiteľa môže prerušiť prístup LXC. Naplánujte údržbu, ak od tohto Coral závisia kompatibilné aplikácie ako Frigate."
+  },
+  "updates": {
+    "heading": "Upozornenia na aktualizácie",
+    "intro": "ProxMenux eviduje komponenty Coral a kontroluje PCIe/M.2 a USB samostatne. Ak máte oba typy, každý používa vlastný zdroj verzií:",
+    "headerVariant": "Variant",
+    "headerTracked": "Evidovaná verzia",
+    "headerUpstream": "Zdroj verzií",
+    "pcieVariant": "PCIe / M.2",
+    "pcieTracked": "Najprv značka vydania uložená po úspešnej inštalácii, potom verzia funkčného balíka <code>gasket-dkms</code>, prípadne verzia modulu DKMS. Samotná verzia DKMS neurčuje úroveň opráv forku.",
+    "pcieUpstream": "Najnovšia značka <code>feranick/gasket-driver</code> na GitHube; sedemdňová vyrovnávacia pamäť a porovnanie čísla zostavenia.",
+    "usbVariant": "USB",
+    "usbTracked": "<code>libedgetpu1-std</code> alebo <code>libedgetpu1-max</code> apt verzia",
+    "usbUpstream": "Lokálny kandidát na <code>apt-cache policy</code> (Google Coral apt repo)",
+    "outro": "Pri novšej verzii Monitor odošle <code>coral_driver_update_available</code> cez zapnuté kanály. Upozornenie odkazuje na inštalátor: vyberte <strong>Preinštalovať / aktualizovať</strong>.",
+    "antiTitle": "Bez opakovaných upozornení",
+    "antiBody": "Jedno upozornenie pre každý typ pri zmene dostupnej verzie. Neopakuje sa pri každej dennej kontrole; ďalšie príde až pri novšom vydaní.",
+    "rebootTitle": "Aktualizácie PCIe: naplánujte reštart",
+    "rebootBody": "Znovu zostavený modul PCIe treba načítať; plánovaný reštart preverí aj automatické načítanie. Aktualizácia knižnice USB nevyžaduje reštart hostiteľa, aplikácie so starou knižnicou však môže byť nutné reštartovať."
+  },
+  "manual": {
+    "heading": "Ručný postup",
+    "intro": "Tieto príkazy ukazujú hlavné kroky oboch postupov na preštudovanie alebo ručné vykonanie.",
+    "pcieHeading": "PCIe / M.2 (gasket + apex cez DKMS)",
+    "usbHeading": "USB (runtime libedgetpu)"
+  },
+  "verification": {
+    "heading": "Overenie",
+    "pcieHeading": "PCIe / M.2",
+    "usbHeading": "USB"
+  },
+  "troubleshoot": {
+    "heading": "Riešenie problémov",
+    "dkmsFailTitle": "Zlyhanie zostavenia DKMS po aktualizácii jadra",
+    "dkmsFailBody": "Jednou z príčin sú chýbajúce hlavičky. Overte <code>proxmox-headers-$(uname -r)</code> cez <code>dpkg -l proxmox-headers-$(uname -r)</code> a podľa potreby ich nainštalujte. V zázname hľadajte nekompatibilitu zdrojov s jadrom. Opakovanie spustí <code>cleanup_broken_gasket_dkms</code>, nezaručí však kompatibilitu s každým jadrom.",
+    "apexMissTitle": "/dev/apex_0 chýba po reštarte",
+    "apexMissBody": "Overte detekciu PCIe a zhodu modulu so spusteným jadrom. Skúste <code>modprobe apex</code> a pozrite <code>dmesg | grep -iE \"apex|gasket\"</code>. Chyby zostavenia, načítania či nastavenia slotu/firmvéru môžu zabrániť vytvoreniu zariadenia.",
+    "lxcMissTitle": "Hostiteľ vidí /dev/apex_0, ale LXC nie",
+    "lxcMissBody": "Viditeľný uzol nepotvrdzuje funkčnosť. Overte prístup na hostiteľovi, pripojenie v LXC, pravidlá cgroup a číselné oprávnenia UID/GID. Pozrite <lxcLink>Pridanie Coral TPU do LXC</lxcLink>.",
+    "usbUnreachTitle": "USB akcelerátor detekovaný, ale Frigate / TFLite nemôže dosiahnuť",
+    "usbUnreachBody": "Skontrolujte pravidlá <code>libedgetpu1-std</code> a oprávnenia cez <code>ls -l /dev/bus/usb/*/*</code>. Mapovaný používateľ/skupina aplikácie potrebuje čítanie a zápis; vlastníctvo root samo osebe nie je chyba. Po zmene pravidiel spustite <code>udevadm control --reload-rules &amp;&amp; udevadm trigger</code> a podľa potreby zariadenie znovu pripojte.",
+    "logTitle": "Záznam inštalácie",
+    "logBody": "Každé spustenie zapisuje <code>/tmp/coral_install.log</code>. Pri zlyhaní DKMS pridá posledných 50 riadkov <code>/var/lib/dkms/gasket/1.0/build/make.log</code>, ak existuje. Záznam priložte k žiadosti o pomoc."
+  },
+  "related": {
+    "heading": "Súvisiace",
+    "items": [
+      {
+        "label": "Pridať Coral TPU do LXC",
+        "href": "/docs/hardware/coral-tpu-lxc",
+        "tail": " — sprístupnenie Coral z hostiteľa kontajneru s kompatibilnou aplikáciou."
+      },
+      {
+        "label": "Nainštalovať ovládače NVIDIA (host)",
+        "href": "/docs/hardware/nvidia-host",
+        "tail": " — Rovnaký nápad pre NVIDIA GPU."
+      },
+      {
+        "label": "ProxMenux Monitor",
+        "href": "/docs/monitor/dashboard/hardware",
+        "tail": " — panel Coral zobrazuje ovládač, moduly, zariadenia a runtime; aj teplotu, ak ju poskytuje podporovaný snímač."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sk/docs/hardware/nvidia-host.json b/web/messages/sk/docs/hardware/nvidia-host.json
new file mode 100644
index 00000000..89762a7c
--- /dev/null
+++ b/web/messages/sk/docs/hardware/nvidia-host.json
@@ -0,0 +1,175 @@
+{
+  "meta": {
+    "title": "Inštalácia NVIDIA na hostiteľa | Dokumentácia ProxMenux",
+    "description": "Inštalujte proprietárne ovládače NVIDIA na Proxmox VE cez ProxMenux: filtrovanie GPU, kontrola zostavenia a DKMS, perzistencia, voliteľný patch NVENC a aktualizácia knižníc LXC."
+  },
+  "header": {
+    "title": "Inštalovať ovládače NVIDIA na hostiteľa",
+    "description": "Inštalácia NVIDIA na hostiteľa Proxmox VE. Filtruje udržiavané vetvy podľa PCI ID GPU, kontroluje zostavenie, používa DKMS, spravuje nouveau a inštaluje perzistenciu. Môže aktualizovať knižnice LXC s prístupom k NVIDIA.",
+    "section": "Hardvér: grafické karty a Coral TPU"
+  },
+  "intro": {
+    "title": "Čo robí",
+    "body": "ProxMenux zistí GPU a ponúkne udržiavané vetvy NVIDIA, ktoré uvádzajú jeho PCI ID. Zablokuje <code>nouveau</code>, stiahne oficiálny inštalátor <code>.run</code>, používa DKMS, nainštaluje <code>nvidia-persistenced</code>, pravidlá udev a NVIDIA Container Toolkit a ponúkne voliteľný patch NVENC. Kontroly zostavenia overujú bežiace jadro; úspešná kompilácia nezaručuje, že bude fungovať každá aplikácia. Existujúcim LXC NVIDIA sa ponúkne aktualizácia knižníc používateľského priestoru so zodpovedajúcou verziou, okrem Arch."
+  },
+  "who": {
+    "heading": "Pre koho je toto?",
+    "body": "Pre GPU akcelerované video alebo výpočty v Plex, Jellyfin, Frigate, Immich či Stable Diffusion <strong>v LXC</strong> najprv nainštalujte NVIDIA na <em>hostiteľa</em> Proxmox. Priame priradenie do <strong>VM</strong> používa samostatný postup VFIO."
+  },
+  "prereqs": {
+    "title": "Skôr ako začnete",
+    "gpu": "<strong>GPU NVIDIA</strong> nainštalovaný v hostiteľovi. Zistí sa automaticky; táto voľba nespravuje AMD ani Intel.",
+    "gpuCheck": "lspci | grep -i nvidia",
+    "notVm": "GPU <strong>nesmie byť vyhradený pre VM cez VFIO</strong>. Inštalátor tento prípad odmietne, aby nenarušil priradenie.",
+    "internet": "Internetové pripojenie hostiteľa. Stiahne ovládač z <code>download.nvidia.com</code> a môže klonovať <code>nvidia-persistenced</code> a <code>nvidia-patch</code> z GitHubu.",
+    "space": "Vyhraďte miesto v <code>/opt/nvidia</code> pre <code>.run</code> a RAM na kompiláciu. Aktualizácia LXC mimo Arch overuje 1500 MiB voľného miesta a pri nižšej RAM môže žiadať dočasné zvýšenie na 2048 MiB; potom obnoví pôvodný limit. Počítajte s reštartom hostiteľa."
+  },
+  "vmWarn": {
+    "title": "GPU vyhradený pre VM? Tu sa zastavte",
+    "body": "Ak je zariadenie NVIDIA pripojené k <code>vfio-pci</code>, inštalátor skončí aj pri zastavenej VM. Vyhradenie neznamená aktívne používanie. Naplánujte návrat k ovládaču hostiteľa a odstráňte staré priradenia VM/VFIO pred reštartom a inštaláciou."
+  },
+  "running": {
+    "heading": "Spustenie inštalátora",
+    "body": "V ProxMenuxe otvorte <strong>Hardware Graphics → NVIDIA GPU Driver Installer</strong>. Ponuka závisí od prítomnosti aktívneho ovládača.",
+    "imageAlt": "Ponuka hardvéru so zvýrazneným inštalátorom NVIDIA"
+  },
+  "howRuns": {
+    "heading": "Ako skript funguje",
+    "body": "Zistí zariadenia, vyberie verziu a inštaluje. Samostatne potvrdené čistenie VFIO môže predchádzať prehľadu. Príprava repozitárov/hlavičiek a sťahovanie predchádzajú výmene ovládača; všetky zmeny nezačínajú až po jednom záverečnom potvrdení."
+  },
+  "walkthrough": {
+    "detect": {
+      "title": "Detekcia a prehľad GPU",
+      "body1": "Zobrazí grafické radiče NVIDIA, stav ovládača alebo <em>„Ovládač NVIDIA nie je nainštalovaný“</em> a LXC s nastaveným prístupom k NVIDIA s ich verziou ovládača.",
+      "body2": "Overte GPU a verzie hostiteľa/kontajnerov. Pri neočakávanom výbere zrušte v prehľade; predtým samostatne potvrdené čistenie VFIO už bolo vykonané.",
+      "imageAlt": "Prehľad pred inštaláciou: GPU, ovládač a LXC NVIDIA"
+    },
+    "version": {
+      "title": "Vyberte verziu ovládača",
+      "body1": "Filtruje verzie z <code>nvidia.com</code>, ktoré <strong>uvádzajú PCI ID GPU v tabuľke podporovaných čipov</strong>, a heuristicky vyraďuje beta/vývojové verzie. <em>&lt;verzia&gt; — Odporúčaná</em> uprednostní najnovšiu verziu nainštalovanej vetvy, potom Production Branch a napokon najvyššie podporované číslo verzie.",
+      "body2": "Ak je ovládač evidovaný s patchom keylase, výber sa obmedzí na tabuľku NVENC. <em>Preinštalovať / aktualizovať</em> naďalej obsahuje potvrdenia a výber patchu; overte konečný výsledok.",
+      "whyTitle": "Ako je validovaná kompatibilita jadra",
+      "whyBody": "Filtruje podľa udržiavaných vetiev a PCI ID, bez pevnej matice jadro/ovládač. Predbežné zostavenie skúša aktuálne jadro. Potvrdená chyba vráti výber verzie; nedostupný test môže len varovať a pokračovať. Konečná inštalácia a overenie funkčnosti sú naďalej potrebné.",
+      "imageAlt": "Výber vetiev podporujúcich GPU s odporúčanou verziou navrchu"
+    },
+    "uninstall": {
+      "title": "Odstránenie starého ovládača pri preinštalovaní",
+      "body": "Po stiahnutí a overení inštalátora odstráni predchádzajúci ovládač. Zastaví služby NVIDIA, odpojí moduly, odstráni záznamy DKMS a balíky <code>nvidia-*</code> / <code>libnvidia-*</code> / <code>cuda-*</code>. Platí aj pri potvrdenej preinštalácii rovnakej verzie."
+    },
+    "prepare": {
+      "title": "Pripravte systém",
+      "body": "Počas prípravy skript:",
+      "items": [
+        "Overí repozitáre pred odstránením alebo inštaláciou. Bez predplatného a iba s Enterprise žiada súhlas s no-subscription; odmietnutie zastaví inštaláciu.",
+        "Inštaluje <code>pve-headers-$(uname -r)</code> (alebo <code>proxmox-headers-$(uname -r)</code>), <code>build-essential</code> a <code>dkms</code>.",
+        "Vytvorí súbor spravovaný ProxMenuxom <code>/etc/modprobe.d/proxmenux-nouveau-blacklist.conf</code> s <code>blacklist nouveau</code> a <code>options nouveau modeset=0</code>. Zaznamená prípadný riadok pridaný do <code>blacklist.conf</code> a skúsi odpojiť nouveau.",
+        "Zapíše <code>nvidia</code> a <code>nvidia_uvm</code> do <code>/etc/modules-load.d/nvidia-vfio.conf</code>, aby sa moduly načítali pri štarte."
+      ]
+    },
+    "download": {
+      "title": "Stiahnite a spustite inštalátor NVIDIA",
+      "body": "Stiahne <code>NVIDIA-Linux-x86_64-&lt;version&gt;.run</code> do <code>/opt/nvidia</code> a overí veľkosť a spustiteľný typ. Ide o kontrolu formátu, nie kryptografického podpisu. Zaregistruje DKMS na zostavenie pri zmene jadra; zdrojový kód a jadro musia zostať kompatibilné.",
+      "imageAlt": "Priebeh sťahovania a zostavenia DKMS inštalátora NVIDIA"
+    },
+    "persist": {
+      "title": "Pretrvávajúce služby a udev pravidlá",
+      "body": "Nainštaluje <persistLink>nvidia-persistenced</persistLink> a zapíše <code>/etc/udev/rules.d/70-nvidia.rules</code> na vytvorenie <code>/dev/nvidia*</code> pri štarte. Pomáha predísť prístupu LXC ku GPU skôr, než existujú zariadenia."
+    },
+    "nvenc": {
+      "title": "Voliteľné: použiť patch NVENC",
+      "body": "Limity relácií NVENC závisia od GPU a ovládača. <patchLink>keylase/nvidia-patch</patchLink> môže odstrániť limit ovládača pre podporované verzie. Vyberte <strong>Áno</strong>, ak túto zmenu kódovania potrebujete a verzia je podporovaná. Nezrýchľuje dekódovanie ani neodstraňuje kapacitu hardvéru.",
+      "supportTitle": "Overenie podpory patchu",
+      "supportBody": "Overte presnú verziu v <patchTableLink>tabuľke patchov</patchTableLink>. Ak chýba, použite ovládač bez patchu alebo inú udržiavanú verziu podporujúcu GPU, jadro aj patch; nevyberajte iba podľa blízkosti v zozname."
+    },
+    "propagate": {
+      "title": "Voliteľné: aktualizovať knižnice NVIDIA v LXC",
+      "body1": "Ponúkne aktualizáciu knižníc ovládača v zistených LXC. Tie a modul hostiteľa <strong>musia mať zodpovedajúce verzie</strong>; inak môže <code>nvidia-smi</code> hlásiť „version mismatch“.",
+      "body2": "Debian / Ubuntu a ďalšie glibc kontajnery dostanú rozbalený inštalátor <code>.run</code> s <code>--no-kernel-modules --no-dkms --no-install-compat32-libs</code>; RAM sa môže dočasne zvýšiť na 2 GiB a potom obnoviť. <strong>Arch, Manjaro a EndeavourOS</strong> používajú <code>pacman -Syu nvidia-utils</code> z repozitárov bez pripnutia na verziu hostiteľa: overte výsledok. <strong>Alpine</strong> dostane rozbalený obsah <code>.run</code> cez <code>pct push</code>, inštaluje <code>gcompat</code> a <code>binutils</code> cez <code>apk</code> a vytvorí odkazy SONAME cez <code>readelf</code>. Overte funkčnosť; kompatibilná vrstva nezaručuje všetky knižnice na musl.",
+      "imageAlt": "Dialóg LXC NVIDIA a verzií na potvrdenie aktualizácie"
+    },
+    "reboot": {
+      "title": "Reštartovať",
+      "body": "Po inštalácii ovládača skript obnoví <code>initramfs</code> pre všetky jadrá; jeho posledný krok ponúkne reštart. <strong>Naplánujte tento reštart</strong> na overenie trvalej konfigurácie modulov a nouveau pri novom štarte, aj keď nový ovládač odpovedá už pred reštartom."
+    }
+  },
+  "reinstallUninstall": {
+    "heading": "Preinštalovať alebo odinštalovať",
+    "intro": "Ak je <code>nvidia</code> načítaný a <code>nvidia-smi</code> vráti verziu, zobrazí ponuku akcií. Takto zisťuje aktívny ovládač; súbory môžu byť nainštalované aj bez načítaného modulu.",
+    "imageAlt": "Ponuka NVIDIA s voľbami preinštalovať/aktualizovať ovládač alebo úplne odinštalovať ovládač",
+    "imageCaption": "Akčné menu sa zobrazí iba vtedy, keď je ovládač NVIDIA momentálne aktívny na hostiteľovi.",
+    "reinstallHeading": "Preinštalovať/aktualizovať",
+    "reinstallBody": "Vyberie verziu, pripraví repozitáre/hlavičky, stiahne a overí zostavenie pred výmenou ovládača. Umožní aktualizáciu v udržiavanej vetve alebo výber inej podporovanej. Potom znova ponúkne knižnice LXC a patch NVENC.",
+    "uninstallHeading": "Odinštalovať čo sa odstráni",
+    "uninstallIntro": "Po potvrdení Áno/Nie odstráni nasledujúce komponenty:",
+    "uninstallItems": [
+      "Zastaví a zakáže <code>nvidia-persistenced</code> a <code>nvidia-powerd</code>, skúsi odpojiť <code>nvidia_uvm</code>, <code>nvidia_drm</code>, <code>nvidia_modeset</code> a <code>nvidia</code> a potom spustí <code>nvidia-uninstall --silent</code> pre inštaláciu <code>.run</code>. Ovplyvní záťaže LXC závislé od NVIDIA; aktívni klienti môžu odpojenie blokovať.",
+      "Spustí <code>apt purge</code> pre <code>nvidia-*</code>, <code>libnvidia-*</code>, <code>cuda-*</code> a <code>libcudnn*</code>, odstráni zdrojový strom DKMS a priečinky <code>nvidia-persistenced</code> a <code>nvidia-patch</code> v <code>/opt/nvidia</code>.",
+      "Odstráni konfiguráciu načítavania modulov (<code>/etc/modules-load.d/nvidia-vfio.conf</code>) a položky blokovania ovládača nouveau spravované ProxMenux. Staré dvojriadkové súbory blokovania ProxMenux sa tiež migrujú a odstránia. Upravené alebo nesúvisiace súbory správcu sa zachovajú.",
+      "Odstráni <code>/etc/udev/rules.d/70-nvidia.rules</code> a nastaví stav NVENC na <em>removed</em> v registri spravovaných inštalácií; samostatný stavový súbor neexistuje.",
+      "Obnoví <code>initramfs</code> pre všetky jadrá, podľa konfigurácie zavádzania spustí <code>proxmox-boot-tool refresh</code> a vyzve na reštart."
+    ],
+    "lxcWarnTitle": "LXC s prístupom k NVIDIA",
+    "lxcWarnBody": "Odstránenie ovládača hostiteľa preruší aplikácie LXC používajúce NVIDIA, aj keď knižnice zostanú nainštalované. Naplánujte údržbu pre Frigate, Plex, Jellyfin, Ollama a ďalšie GPU aplikácie."
+  },
+  "updates": {
+    "heading": "Upozornenia na aktualizácie",
+    "body": "Ovládač NVIDIA sa sleduje v registri spravovaných inštalácií. Pri štarte a každých 24 hodín Monitor porovná verzie z <code>download.nvidia.com/XFree86/Linux-x86_64/</code> s verziou hlásenou cez <code>nvidia-smi</code>. Upozorní iba na nové vydania údržby nainštalovanej vetvy.",
+    "kindsHeading": "Správa o aktualizácii",
+    "kindsItems": [
+      "<strong>Údržba v rovnakej vetve.</strong> Napríklad nainštalované 580.65.06 → dostupné 580.105.08. Monitor nevyvodzuje kompatibilitu jadra medzi vetvami."
+    ],
+    "antiTitle": "Zabránenie opakovaným upozorneniam",
+    "antiBody": "Jedno upozornenie na novú verziu, nie pri každej dennej kontrole. Bez novšej verzie v nainštalovanej vetve neupozorňuje.",
+    "applyTitle": "Uplatňovanie aktualizácie",
+    "applyBody": "Monitor upozorní bez automatickej inštalácie. Otvorte inštalátor, vyberte <strong>Preinštalovať / aktualizovať</strong> a podporovanú verziu, potom dokončite zostavenie a inštaláciu. Naplánujte ponúknutý reštart a overte hostiteľa aj knižnice LXC."
+  },
+  "verify": {
+    "heading": "Overenie inštalácie",
+    "intro": "Po reštarte hostiteľa sa prihláste cez SSH alebo shell Proxmoxu a spustite:",
+    "after": "Overte GPU a očakávanú verziu. Procesy už môžu byť zobrazené, ak GPU používajú služby hostiteľa alebo automaticky spustené kontajnery. Potom overte perzistenciu:",
+    "imageAlt": "Výstup nvidia-smi na hostiteľa zobrazujúci detekované GPU a nainštalovanú verziu ovládača"
+  },
+  "troubleshoot": {
+    "heading": "Riešenie problémov",
+    "smiFailTitle": "nvidia-smi hlási „NVIDIA-SMI has failed“",
+    "smiFailBody": "Možné príčiny sú <strong>nouveau</strong>, <strong>chýbajúce alebo nesprávne hlavičky jadra</strong>, nekompatibilné zdroje ovládača alebo iné chyby načítania. Pozrite <code>lsmod | grep nouveau</code>, <code>dmesg | grep -i nvidia</code> a protokoly inštalátora/DKMS. Pri oprave nouveau overte <code>/etc/modprobe.d/proxmenux-nouveau-blacklist.conf</code> pred <code>update-initramfs -u -k all</code> a reštartom. Nie každá chyba zostavenia súvisí s hlavičkami.",
+    "lxcMissTitle": "LXC kontajner nemôže vidieť GPU po aktualizácii hostiteľa",
+    "lxcMissBody": "Pred preinštalovaním overte zariadenia hostiteľa, oprávnenia LXC a verziu knižníc. Nesúlad môže vyžadovať zodpovedajúci používateľský ovládač podporovaným postupom distribúcie; na glibc používa <code>--no-kernel-modules</code>. Knižnice neopravia chýbajúce pripojenia či oprávnenia.",
+    "logTitle": "Skontrolujte protokol inštalácie",
+    "logBody": "Inštalácia zapisuje do <code>/tmp/nvidia_install.log</code>. Pri chybe overte sťahovanie, zostavenie DKMS a služby. Priložte protokol k hláseniu na GitHube."
+  },
+  "manualSteps": {
+    "heading": "Hľadáte ručné kroky?",
+    "body": "Pozrite <guideLink>Príručky → NVIDIA</guideLink> pre ručné postupy vrátane <code>wget</code> a <code>./NVIDIA-Linux-...run</code>. Vysvetľuje komponenty, nie je však presným prepisom inštalátora. Udržiavaný postup ProxMenuxu poskytuje filtrovanie GPU, kontrolu zostavenia, aktualizácie LXC a overenie VFIO."
+  },
+  "related": {
+    "heading": "Súvisiace",
+    "items": [
+      {
+        "label": "Pridať GPU do VM (passthrough)",
+        "href": "/docs/hardware/gpu-vm-passthrough",
+        "tail": " — priame priradenie NVIDIA do VM cez VFIO."
+      },
+      {
+        "label": "Pridať GPU do LXC",
+        "href": "/docs/hardware/igpu-acceleration-lxc",
+        "tail": " — zdieľanie NVIDIA s jedným alebo viacerými kontajnermi."
+      },
+      {
+        "label": "Zmeniť režim GPU (VM ↔ LXC)",
+        "href": "/docs/hardware/switch-gpu-mode",
+        "tail": " — prepínanie medzi priamym prístupom VM a zdieľaním LXC."
+      },
+      {
+        "label": "ProxMenux Monitor — karta Hardvér",
+        "href": "/docs/monitor/dashboard/hardware",
+        "tail": " — okno GPU, ktoré otvorí inštalátor a zobrazuje sledovanie v reálnom čase."
+      },
+      {
+        "label": "Príkazy priameho priradenia GPU",
+        "href": "/docs/help-info/gpu-commands",
+        "tail": " — prehľad príkazov lspci / dmesg / IOMMU / nvidia-smi."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sk/docs/hardware/switch-gpu-mode.json b/web/messages/sk/docs/hardware/switch-gpu-mode.json
new file mode 100644
index 00000000..cdd4f760
--- /dev/null
+++ b/web/messages/sk/docs/hardware/switch-gpu-mode.json
@@ -0,0 +1,172 @@
+{
+  "meta": {
+    "title": "Zmeniť režim GPU (VM ↔ LXC) | Dokumentácia ProxMenux",
+    "description": "Prepnite GPU medzi VFIO pre VM a natívnym ovládačom pre LXC. ProxMenux zistí ovládač, ponúkne riešenie konfliktov hostí, odstráni súvisiace zvukové priradenia a pri zmene konfigurácie hostiteľa obnoví initramfs."
+  },
+  "header": {
+    "title": "Zmeniť režim GPU (VM ↔ LXC)",
+    "description": "Prepnite priradený GPU medzi priamym prístupom VM a zdieľaním LXC. ProxMenux spravuje ovládač, VFIO, moduly a initramfs a pýta sa na dotknutých hostí. Skontrolujte voľby a po reštarte overte výslednú konfiguráciu.",
+    "section": "Hardvér: grafické karty a Coral TPU"
+  },
+  "intro": {
+    "title": "Čo robí",
+    "body": "S <code>vfio-pci</code> je GPU vyhradený pre VM. S natívnym ovládačom <em>(i915 / amdgpu / nvidia)</em> ho môžu zdieľať hostiteľ a LXC. <strong>Zmeniť režim GPU</strong> spravuje <code>vfio.conf</code>, blokovanie modulov a odkazy hostí a upozorní na zostávajúce priradenia."
+  },
+  "graphics": {
+    "lxcTitle": "Pripravené pre LXC kontajnery",
+    "lxcDesc": "Aktívny natívny ovládač",
+    "vmTitle": "Pripravené pre VM passthrough",
+    "vmDesc": "Aktívny VFIO-PCI ovládač"
+  },
+  "when": {
+    "heading": "Kedy to mám použiť?",
+    "intro": "Použite, ak je GPU <strong>už priradený</strong> a chcete zmeniť jeho použitie:",
+    "headerSituation": "Situácia",
+    "headerUse": "Použiť túto stránku?",
+    "rows": [
+      {
+        "situation": "GPU je voľný a nebol priradený: chcem ho použiť vo VM.",
+        "useRich": "Nie — použite <vmLink>Pridať GPU do VM</vmLink>"
+      },
+      {
+        "situation": "GPU je voľný a nebol priradený: chcem ho použiť v LXC.",
+        "useRich": "Nie — použite <lxcLink>Pridať GPU do LXC</lxcLink>"
+      },
+      {
+        "situationRich": "GPU je priradený VM cez <code>vfio-pci</code>, ale chcem ho používať v LXC.",
+        "useRich": "<strong>Áno – táto stránka.</strong>"
+      },
+      {
+        "situation": "GPU je zdieľaný s LXC, chcem ho venovať VM.",
+        "useRich": "<strong>Áno – táto stránka.</strong>"
+      },
+      {
+        "situation": "Chcem odstrániť všetky priradenia tohto GPU.",
+        "use": "Režim LXC vráti GPU ovládaču hostiteľa; postup pri konflikte pre VM môže odstrániť položky hostpci, položky zariadení LXC však treba odstrániť samostatne. GPU zostane pripojený k ovládaču."
+      }
+    ]
+  },
+  "prereqs": {
+    "title": "Skôr ako začnete",
+    "assigned": "<strong>Už priradený GPU</strong> do VM cez VFIO alebo do LXC. Pri prvom priradení použite Pridať GPU do VM / LXC.",
+    "iommu": "<strong>IOMMU musí byť aktívne na hostiteľovi</strong> pri prechode <em>do</em> režimu VM. Záleží na nastaveniach firmvéru aj na podpore jadra. Ak v bežiacom jadre chýba <code>intel_iommu=on</code> alebo <code>amd_iommu=on</code>, skript ho pridá s <code>iommu=pt</code> do <code>/etc/kernel/cmdline</code> (značka koreňa ZFS) alebo <code>/etc/default/grub</code> a potom spustí <code>proxmox-boot-tool refresh</code> alebo <code>update-grub</code>. Skontrolujte prípadné varovania a podľa výzvy reštartujte.",
+    "iommuCheck": "dmesg | grep -i 'IOMMU enabled' | head -1",
+    "reboot": "<strong>Počítajte s reštartom.</strong> Trvalé zmeny ovládača a zavádzania môžu vyžadovať obnovu initramfs a reštart. Skript na to vyzve na konci.",
+    "knowList": "<strong>Zistite, ktoré VM a LXC používajú GPU.</strong> Skript vyhľadá odkazy a spýta sa na každého hosťa; známy zoznam uľahčí kontrolu."
+  },
+  "blocklist": {
+    "title": "Nie všetky GPU sú bezpečné prejsť na VM",
+    "body": "Skript podľa svojich pravidiel kompatibility blokuje režim VM pre ID zariadení <code>8086:5a84</code> a <code>8086:5a85</code>. Ak vybraná GPU zodpovedá, zastaví prechod do režimu VM a vráti sa na výber GPU, alebo skončí, ak je to jediná GPU. Tento zoznam blokovaných nebráni prechodu <em>do</em> režimu LXC; ďalšie kontroly môžu naďalej platiť."
+  },
+  "running": {
+    "heading": "Spustenie skriptu",
+    "body": "V ProxMenuxe otvorte <strong>Hardvér: GPU a Coral-TPU → Zmeniť režim GPU (VM ↔ LXC)</strong>.",
+    "imageAlt": "Voľba Zmeniť režim GPU (VM ↔ LXC) v ponuke hardvéru"
+  },
+  "howRuns": {
+    "heading": "Ako skript funguje",
+    "body": "Výber GPU a smer sa kontrolujú pred hlavným prepnutím. Samostatné čistenie starých záznamov VFIO môže žiadať potvrdenie skôr; hostia majú vlastné dialógy konfliktov. Čítajte každé potvrdenie: jedno záverečné potvrdenie nepokrýva všetky zmeny."
+  },
+  "walkthrough": {
+    "heading": "Postup krok za krokom",
+    "detect": {
+      "title": "Zistenie GPU a aktuálneho ovládača",
+      "body": "Prehľadá radiče VGA, 3D a Display hostiteľa a overí <code>/sys/bus/pci/devices/*/driver</code>. Zobrazí názov, adresu PCI a aktuálny ovládač každého GPU na určenie režimu.",
+      "imageAlt": "Zoznam GPU s aktuálnym ovládačom (vfio-pci / nvidia / amdgpu / i915) a adresou PCI"
+    },
+    "pickGpu": {
+      "title": "Výber GPU na prepnutie",
+      "body": "Jediný GPU sa vyberie automaticky. Pri viacerých možno označiť viac GPU, ale musia byť v <em>rovnakom</em> režime. Pri zmiešaných režimoch treba výber zúžiť.",
+      "tipTitle": "Prepínanie viacerých GPU naraz",
+      "tipBody": "Príklad: prepnúť tri NVIDIA do režimu VM a potom vrátiť iGPU do LXC. Dve spustenia, každé so spoločným cieľom, namiesto samostatného prepínania kariet."
+    },
+    "direction": {
+      "title": "Preskúmanie navrhovaného smerovania",
+      "intro": "Na základe aktuálneho režimu, skript navrhuje opak ako cieľ:",
+      "items": [
+        "<strong>VM → LXC:</strong> odstráni väzbu na <code>vfio-pci</code>, aby GPU mohol používať natívny ovládač (<code>nvidia</code>, <code>amdgpu</code>, <code>i915</code>). Pre NVIDIA odstráni príslušné položky BDF z <code>/etc/udev/rules.d/10-proxmenux-vfio-bind.rules</code> pre ďalší štart.",
+        "<strong>LXC → VM:</strong> pripraví priradenie k <code>vfio-pci</code>. AMD / Intel blokujú natívny ovládač a používajú <code>options vfio-pci ids=…</code>. Pre NVIDIA sa <code>nvidia</code> globálne blokuje iba vtedy, keď je každá NVIDIA GPU hostiteľa vo VFIO; inak pravidlá podľa BDF nastavia <code>driver_override=vfio-pci</code> zariadeniam dotknutých skupín IOMMU a NVIDIA GPU mimo týchto skupín si ponechajú <code>nvidia</code>. Pred prepnutím skontrolujte každého člena skupiny."
+      ],
+      "outro": "Potvrdiť smer alebo zrušiť."
+    },
+    "conflict": {
+      "title": "Postup pre každú dotknutú VM alebo LXC",
+      "body": "Kontroluje <code>/etc/pve/lxc/*.conf</code> podľa rodiny ovládača GPU a <code>/etc/pve/qemu-server/*.conf</code> podľa PCI priradení. Detekcia LXC nie je presnou zhodou BDF každej karty. Skontrolujte zistených hostí a vyberte postup pre každého:",
+      "headerPolicy": "Politika",
+      "headerEffect": "Účinok",
+      "headerWhen": "Kedy vybrať",
+      "keepPolicy": "Ponechať konfiguráciu a vypnúť automatický štart",
+      "keepEffect": "<code>pct set CTID -onboot 0</code> alebo <code>qm set VMID -onboot 0</code>. Položky GPU zostanú zachované.",
+      "keepWhen": "Ak chcete hosťa znova používať po návrate GPU do pôvodného režimu. Opatrná predvolená voľba.",
+      "removePolicy": "Odstrániť GPU z konfigurácie",
+      "removeEffect": "Odstráni zistené položky <code>hostpci</code> / <code>dev</code> a podporované staršie odkazy.",
+      "removeWhen": "Ak má hosť fungovať bez GPU. Najprv overte aplikáciu: náhrada cez CPU závisí od nej a odstránenie zariadenia ju automaticky nenastaví.",
+      "imageAlt": "Dialóg výberu postupu pre dotknuté VM alebo LXC"
+    },
+    "audio": {
+      "title": "Odstránenie súvisiacich zvukových priradení pri opustení VM",
+      "body1": "Mnohé samostatné GPU NVIDIA / AMD poskytujú HDMI zvuk cez funkciu <code>.1</code> rovnakého slotu; priradené môžu byť aj ďalšie zvukové zariadenia. Po odstránení GPU môžu zostať neplatné zvukové položky <code>hostpci</code>. Overte, ktoré priradenia ponechať.",
+      "body2": "Identifikuje zvukové adresy BDF a zobrazí zoznam priradení na odstránenie. Ich ID vendor:device odstráni aj z <code>/etc/modprobe.d/vfio.conf</code>, iba ak ich nepoužíva iná VM."
+    },
+    "apply": {
+      "title": "Použitie zmien hostiteľa a hostí",
+      "body": "Po potvrdení zapíše zmeny hostiteľa: <code>vfio.conf</code>, blokovanie ovládačov, moduly a pre NVIDIA pravidlo BDF <code>/etc/udev/rules.d/10-proxmenux-vfio-bind.rules</code> so stavom v <code>/etc/proxmenux/vfio-bind.bdfs</code>. Použije aj zvolený postup pre každého hosťa. Pri zmene konfigurácie hostiteľa spustí <code>update-initramfs -u -k all</code> a potom <code>proxmox-boot-tool refresh</code>; inak oba kroky preskočí."
+    },
+    "reboot": {
+      "title": "Reštartovať",
+      "body": "Reštartujte hostiteľa na použitie novej trvalej väzby. Reštart možno odložiť, ale pred spustením cieľového hosťa overte aktívny ovládač: dovtedy môže byť aktívny pôvodný.",
+      "imageAlt": "Súhrnný dialóg so zmenami a následnou výzvou na reštart"
+    }
+  },
+  "manual": {
+    "heading": "Ručná kontrola",
+    "intro": "Pred <strong>VM → LXC</strong> overte ovládač a pravidlá BDF. Príklad NVIDIA používa <code>10de:2204</code>; prispôsobte ho karte. Príkazy čítajú stav; skript spravuje aj hostí a členov skupiny IOMMU.",
+    "lxcToVm": "Pred <strong>LXC → VM</strong> overte adresu PCI a skupinu IOMMU. Nahraďte vzorovú adresu a pred priradením skontrolujte všetkých členov skupiny.",
+    "oneVmTitle": "Fyzický GPU priradený cez VFIO môže naraz používať iba jedna VM",
+    "oneVmBody": "Dve VM môžu mať položky <code>hostpci</code> pre rovnakú adresu PCI, ale GPU môže súčasne používať iba jedna; spustenie druhej zlyhá. Výber postupu pri konflikte pomáha tomu predísť."
+  },
+  "verification": {
+    "heading": "Overenie po reštarte"
+  },
+  "troubleshoot": {
+    "heading": "Riešenie problémov",
+    "stillVfioTitle": "GPU stále ukazuje vfio-pci po prepnutí do režimu LXC",
+    "stillVfioBody": "Načítaný modul VFIO neurčuje, ktorý ovládač používa tento GPU. Overte väzbu karty, dokončenie <code>update-initramfs</code> a reštart. <code>lsmod | grep vfio</code> iba vypíše moduly. Pre AMD / Intel pozrite <code>vfio.conf</code>; pre NVIDIA <code>/etc/proxmenux/vfio-bind.bdfs</code> a <code>/etc/udev/rules.d/10-proxmenux-vfio-bind.rules</code>. Opravte staré pravidlá pred <code>update-initramfs -u -k all</code> a reštartom.",
+    "vmFailTitle": "VM sa nespustí po prepnutí GPU do LXC",
+    "vmFailBody": "Overte neplatné odkazy <code>hostpci</code>. Voľba <em>Odstrániť GPU z konfigurácie</em> ich môže odstrániť počas plánovaného prepnutia. Pred opakovaním skriptu overte smer, aby ste režim neobrátili omylom. Priradenie môžete odstrániť aj v Proxmoxe pri zastavenej VM.",
+    "smiFailTitle": "nvidia-smi hlási „Driver/library version mismatch“ po návrate do LXC",
+    "smiFailBody": "Porovnajte načítaný modul NVIDIA s nainštalovanými knižnicami aj v LXC. Najprv zjednoťte verzie: reštart načíta nainštalovaný modul, neopraví však nekompatibilné balíky. Obnovenie cez <code>modprobe -r nvidia</code> a <code>modprobe nvidia</code> vyžaduje zastavených GPU klientov a môže zlyhať pri používaných závislých moduloch.",
+    "logTitle": "Protokol vykonávania",
+    "logBody": "Každé spustenie zapisuje do <code>/tmp/proxmenux_gpu_switch_mode.log</code> na hostiteľovi. Priložte protokol k žiadosti o pomoc na GitHube."
+  },
+  "related": {
+    "heading": "Súvisiace",
+    "items": [
+      {
+        "label": "Pridať GPU do VM (passthrough)",
+        "href": "/docs/hardware/gpu-vm-passthrough",
+        "tail": " — prvotné nastavenie režimu VM."
+      },
+      {
+        "label": "Pridať GPU do LXC",
+        "href": "/docs/hardware/igpu-acceleration-lxc",
+        "tail": " — prvotné nastavenie režimu LXC."
+      },
+      {
+        "label": "Nainštalovať ovládače NVIDIA (host)",
+        "href": "/docs/hardware/nvidia-host",
+        "tail": " — Vyžadované pre LXC režim na NVIDIA GPU."
+      },
+      {
+        "label": "ProxMenux Monitor — karta Hardvér",
+        "href": "/docs/monitor/dashboard/hardware",
+        "tail": " — časť Grafické karty s aktuálnym režimom a ovládaním prepnutia."
+      },
+      {
+        "label": "Príkazy priameho priradenia GPU",
+        "href": "/docs/help-info/gpu-commands",
+        "tail": " — stručný prehľad príkazov."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sk/docs/help-info/backup-commands.json b/web/messages/sk/docs/help-info/backup-commands.json
new file mode 100644
index 00000000..dc8760ca
--- /dev/null
+++ b/web/messages/sk/docs/help-info/backup-commands.json
@@ -0,0 +1,235 @@
+{
+  "meta": {
+    "title": "Príkazy zálohovania Proxmox — vzdump, qmrestore, pct restore | ProxMenux",
+    "description": "Prehľad príkazov zálohovania a obnovy v Proxmox VE: vzdump pre VM a kontajnery LXC, qmrestore pre VM, pct restore pre kontajnery, plánované zálohy v /etc/pve/jobs.cfg, hook skripty a vylúčené cesty.",
+    "ogTitle": "Príkazy zálohovania Proxmox — vzdump, qmrestore, pct restore",
+    "ogDescription": "Prehľad príkazov vzdump, qmrestore a pct restore na zálohovanie a obnovu VM a kontajnerov LXC v Proxmoxe.",
+    "twitterTitle": "Príkazy zálohovania Proxmoxu | ProxMenux",
+    "twitterDescription": "Príkazy vzdump, qmrestore a pct restore na zálohovanie a obnovu VM a kontajnerov Proxmox."
+  },
+  "header": {
+    "title": "Zálohovanie a obnova",
+    "description": "Prehľad príkazov vzdump, qmrestore a pct restore pre zálohovanie v Proxmoxe. Obsahuje plánovanie, pokročilé možnosti ako hook skripty, vylúčené cesty a prioritu I/O, ako aj správu súborov záloh.",
+    "section": "Pomoc a informácie"
+  },
+  "intro": {
+    "title": "Tri režimy zálohovania",
+    "body": "Pri VM je <strong>snapshot</strong> živá záloha bez požiadavky na snímky úložiska. <strong>suspend</strong> VM predtým pozastaví a nemusí zlepšiť konzistentnosť. <strong>stop</strong> ju najprv vypne; predtým bežiaca VM môže pokračovať po začatí zálohy. Pri LXC je to iné: snapshot vyžaduje úložisko so snímkami, suspend používa dva priechody rsync a stop drží kontajner zastavený počas celej zálohy."
+  },
+  "commandGroups": [
+    {
+      "title": "Zálohovanie VM",
+      "commands": [
+        {
+          "command": "vzdump <vmid>",
+          "description": "Vytvoriť zálohu špecifického VM/CT"
+        },
+        {
+          "command": "vzdump <vmid> --storage <storage>",
+          "description": "Zálohovanie VM do špecifického úložiska"
+        },
+        {
+          "command": "vzdump <vmid> --mode snapshot",
+          "description": "Vytvoriť zálohu snímok (pre VMs)"
+        },
+        {
+          "command": "vzdump <vmid> --mode suspend",
+          "description": "Pozastaviť VM pred živou zálohou, starší režim suspend"
+        },
+        {
+          "command": "vzdump <vmid> --mode stop",
+          "description": "Vypnúť VM pred začatím zálohy"
+        },
+        {
+          "command": "vzdump --all",
+          "description": "Zálohovať všetky VM a kontajnery"
+        },
+        {
+          "command": "vzdump --all --exclude <vmid1>,<vmid2>",
+          "description": "Zálohovať všetko okrem zadaných VM"
+        }
+      ]
+    },
+    {
+      "title": "Možnosti zálohovania",
+      "commands": [
+        {
+          "command": "vzdump <vmid> --compress zstd",
+          "description": "Použiť kompresiu zstd pre zálohovanie"
+        },
+        {
+          "command": "vzdump <vmid> --compress gzip --pigz <threads>",
+          "description": "Použiť pigz s viacerými vláknami"
+        },
+        {
+          "command": "vzdump <vmid> --storage <storage> --notes-template <text>",
+          "description": "Pridať poznámky k zálohe"
+        },
+        {
+          "command": "vzdump <vmid> --mailto <email>",
+          "description": "Poslať notifikáciu e-mail"
+        },
+        {
+          "command": "vzdump <vmid> --prune-backups keep-last=<n>",
+          "description": "Udržujte iba n zálohy na VM"
+        },
+        {
+          "command": "vzdump <vmid> --stdexcludes 0",
+          "description": "Nevylučujte dočasné súbory"
+        },
+        {
+          "command": "vzdump <vmid> --quiet 1",
+          "description": "Potlačiť výstupné správy"
+        }
+      ]
+    },
+    {
+      "title": "Obnoviť zálohy",
+      "commands": [
+        {
+          "command": "qmrestore <backup-file> <vmid>",
+          "description": "Obnoviť VM zo zálohy"
+        },
+        {
+          "command": "qmrestore <backup-file> <vmid> --storage <storage>",
+          "description": "Obnoviť na vybrané úložisko"
+        },
+        {
+          "command": "qmrestore <backup-file> <vmid> --unique",
+          "description": "Obnoviť VM s novými náhodnými MAC adresami"
+        },
+        {
+          "command": "pct restore <vmid> <backup-file>",
+          "description": "Obnoviť kontajner zo zálohy"
+        },
+        {
+          "command": "pct restore <vmid> <backup-file> --storage <storage>",
+          "description": "Obnoviť kontajner na vybrané úložisko"
+        },
+        {
+          "command": "pct restore <vmid> <backup-file> --rootfs <storage>:<size-GiB>",
+          "description": "Obnoviť s koreňovým diskom na vybranom úložisku a so zvolenou veľkosťou"
+        },
+        {
+          "command": "pct restore <vmid> <backup-file> --unprivileged 1",
+          "description": "Obnoviť ako neprivilegovaný CT"
+        }
+      ]
+    },
+    {
+      "title": "Správa záloh",
+      "commands": [
+        {
+          "command": "ls -la /var/lib/vz/dump/",
+          "description": "Zoznam záloh v predvolenom mieste"
+        },
+        {
+          "command": "find /var/lib/vz/dump/ -name \"*.vma*\"",
+          "description": "Nájsť zálohy VM"
+        },
+        {
+          "command": "find /var/lib/vz/dump/ -name \"*.tar*\"",
+          "description": "Nájsť zálohy kontajnerov"
+        },
+        {
+          "command": "pvesm list <storage> --content backup",
+          "description": "Zobraziť zálohy na vybranom úložisku"
+        },
+        {
+          "command": "rm /var/lib/vz/dump/<backup-file>",
+          "description": "Odstrániť zálohovací súbor"
+        },
+        {
+          "command": "cat /etc/vzdump.conf",
+          "description": "Zobraziť nastavenie zálohy"
+        }
+      ]
+    },
+    {
+      "title": "Plánované zálohy",
+      "commands": [
+        {
+          "command": "cat /etc/pve/jobs.cfg",
+          "description": "Zobraziť plán zálohovania"
+        },
+        {
+          "command": "nano /etc/vzdump.conf",
+          "description": "Upraviť nastavenie zálohovania"
+        },
+        {
+          "command": "systemctl list-timers",
+          "description": "Zobraziť časovače systemd"
+        },
+        {
+          "command": "systemctl status cron",
+          "description": "Kontrola stavu služby Cron"
+        },
+        {
+          "command": "pvenode task list --typefilter vzdump",
+          "description": "Zobraziť dokončené úlohy zálohovania"
+        },
+        {
+          "command": "pvenode task log <upid>",
+          "description": "Zobraziť protokol úlohy zálohovania podľa jej UPID"
+        }
+      ]
+    },
+    {
+      "title": "Pokročilé operácie",
+      "commands": [
+        {
+          "command": "qmrestore <backup> <vmid> --force",
+          "description": "Vynútiť obnovu s prepísaním existujúcej VM"
+        },
+        {
+          "command": "vzdump <vmid> --dumpdir <directory>",
+          "description": "Zadať vlastný záložný adresár"
+        },
+        {
+          "command": "vzdump <vmid> --script <script>",
+          "description": "Spustiť hook skript počas zálohy"
+        },
+        {
+          "command": "vzdump <vmid> --exclude-path <path>",
+          "description": "Vylúčiť špecifické cesty zo zálohy"
+        },
+        {
+          "command": "vzdump <vmid> --ionice <priority>",
+          "description": "Nastaviť prioritu I/O pre proces zálohovania"
+        },
+        {
+          "command": "vzdump <vmid> --lockwait <minutes>",
+          "description": "Počkajte na zámok"
+        },
+        {
+          "command": "qm importdisk <vmid> <disk-image> <storage>",
+          "description": "Importovať súbor obrazu disku (napríklad raw, qcow2 alebo vmdk) ako nepoužitý disk, nie archív zálohy vzdump"
+        }
+      ]
+    }
+  ],
+  "testRestores": {
+    "title": "Otestujte si svoje obnovy",
+    "bodyRich": "Pravidelne obnovte zálohu na voľné testovacie VMID cez <code>qmrestore --unique</code>, spustite VM v izolovanej testovacej sieti a overte obsah. Voľba unique vytvára nové MAC adresy, nemení statické IP ani nastavenia aplikácií. Rovnako otestujte kontajnery cez <code>pct restore</code>."
+  },
+  "related": {
+    "heading": "Súvisiace",
+    "items": [
+      {
+        "href": "/docs/help-info/vm-ct-commands",
+        "label": "Správa VM a CT",
+        "tail": " — príkazy qm a pct na správu životného cyklu hostí."
+      },
+      {
+        "href": "/docs/help-info/storage-commands",
+        "label": "Úložiská a disky",
+        "tail": " — správa úložísk cez pvesm."
+      },
+      {
+        "href": "/docs/help-info",
+        "label": "Prehľad pomoci a informácií",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sk/docs/help-info/gpu-commands.json b/web/messages/sk/docs/help-info/gpu-commands.json
new file mode 100644
index 00000000..9da75ba4
--- /dev/null
+++ b/web/messages/sk/docs/help-info/gpu-commands.json
@@ -0,0 +1,162 @@
+{
+  "meta": {
+    "title": "Príkazy GPU passthrough v Proxmoxe — lspci, VFIO, IOMMU, qm set hostpci | ProxMenux",
+    "description": "Prehľad GPU passthrough v Proxmox VE: identifikácia zariadení cez lspci, moduly VFIO, skupiny IOMMU (intel_iommu / amd_iommu), aktualizácie GRUB a initramfs, qm set hostpci0 a nastavenie GPU NVIDIA, AMD a Intel.",
+    "ogTitle": "Príkazy GPU passthrough v Proxmoxe — lspci, VFIO, IOMMU, qm set hostpci",
+    "ogDescription": "Odkaz na kontrolu a konfiguráciu GPU priechodu na Proxmox VE — PCI zariadenia, VFIO moduly, IOMMU skupiny, parametre zavádzania jadra, qm set hostpci.",
+    "twitterTitle": "Príkazy GPU passthrough v Proxmoxe | ProxMenux",
+    "twitterDescription": "Skontrolujte PCI zariadenia, konfigurujte VFIO a IOMMU a pripojte GPU k VM na Proxmox VE."
+  },
+  "header": {
+    "title": "GPU passthrough",
+    "description": "Prehľad kontroly a nastavenia GPU / TPU passthrough v Proxmoxe: identifikácia zariadení (lspci), nastavenie modulov VFIO, overenie IOMMU, aktualizácie initramfs / GRUB a konfigurácia pre jednotlivé VM (qm set hostpci, machine q35, bios ovmf).",
+    "section": "Pomoc a informácie"
+  },
+  "intro": {
+    "title": "IOMMU musí byť povolené v BIOS / UEFI",
+    "body": "Najprv zapnite IOMMU vo firmvéri: v BIOS/UEFI hľadajte <em>VT-d</em>, <em>AMD-Vi</em> alebo <em>IOMMU</em>. V Linuxe je predvolene zapnuté na AMD a na Inteli s jadrami Proxmox 6.8 a novšími. Staršie jadrá Intel môžu vyžadovať <code>intel_iommu=on</code>. Voliteľné <code>iommu=pt</code> riadi režim IOMMU passthrough; nie je dôvodom na plošné vypínanie framebufferu hostiteľa."
+  },
+  "commandGroups": [
+    {
+      "title": "Identifikácia zariadenia",
+      "commands": [
+        {
+          "command": "lspci -nn | grep -i nvidia",
+          "description": "Zoznam zariadení NVIDIA PCI"
+        },
+        {
+          "command": "lspci -nn | grep -i vga",
+          "description": "Zoznam všetkých VGA kompatibilných zariadení"
+        },
+        {
+          "command": "lspci -nn | grep -i amd",
+          "description": "Zoznam zariadení AMD PCI"
+        },
+        {
+          "command": "lspci -nnk | grep -A3 VGA",
+          "description": "Zoznam zariadení VGA s ovládačmi jadra"
+        },
+        {
+          "command": "lspci -v -s <PCI_ID>",
+          "description": "Zobraziť podrobné informácie pre konkrétne PCI zariadenie"
+        }
+      ]
+    },
+    {
+      "title": "Nastavenie VFIO",
+      "commands": [
+        {
+          "command": "dmesg | grep -i vfio",
+          "description": "Kontrola správ modulu VFIO"
+        },
+        {
+          "command": "cat /etc/modprobe.d/vfio.conf",
+          "description": "Skontrolovať konfiguráciu VFIO passthrough"
+        },
+        {
+          "command": "ls -la /etc/modprobe.d/",
+          "description": "Zoznam všetkých konfiguračných súborov modprobe"
+        },
+        {
+          "command": "cat /etc/modules",
+          "description": "Zobraziť načítané moduly v čase zavedenia"
+        },
+        {
+          "command": "lsmod | grep vfio",
+          "description": "Skontrolujte, či sú moduly VFIO načítané"
+        }
+      ]
+    },
+    {
+      "title": "Nastavenie IOMMU",
+      "commands": [
+        {
+          "command": "cat /etc/default/grub",
+          "description": "Preskúmanie možností GRUB pre IOMMU"
+        },
+        {
+          "command": "update-grub",
+          "description": "Použiť zmeny GRUB"
+        },
+        {
+          "command": "dmesg | grep -i iommu",
+          "description": "Skontrolujte IOMMU správy v loge jadra"
+        },
+        {
+          "command": "dmesg | grep -e DMAR -e IOMMU",
+          "description": "Skontrolujte správy DMAR a IOMMU"
+        },
+        {
+          "command": "find /sys/kernel/iommu_groups/ -type l | sort -V",
+          "description": "Zoznam skupín IOMMU"
+        }
+      ]
+    },
+    {
+      "title": "Aktualizácie systému",
+      "commands": [
+        {
+          "command": "update-initramfs -u",
+          "description": "Použiť zmeny initramfs (VFIO)"
+        },
+        {
+          "command": "update-initramfs -u -k all",
+          "description": "Aktualizovať initramfs pre všetky jadrá"
+        },
+        {
+          "command": "cat /proc/cmdline",
+          "description": "Zobraziť aktuálne parametre zavádzania jadra"
+        }
+      ]
+    },
+    {
+      "title": "Nastavenie VM",
+      "commands": [
+        {
+          "command": "qm config <vmid> | grep hostpci",
+          "description": "Zobraziť nastavenie PCI passthrough pre VM"
+        },
+        {
+          "command": "qm set <vmid> -hostpci0 <PCI_ID>,pcie=1,x-vga=1",
+          "description": "Pridať GPU passthrough do VM"
+        },
+        {
+          "command": "cat /etc/pve/qemu-server/<vmid>.conf",
+          "description": "Zobraziť konfiguračný súbor VM"
+        },
+        {
+          "command": "qm set <vmid> -machine q35",
+          "description": "Nastaviť VM pre použitie čipset Q35 (odporúčané pre priechod)"
+        },
+        {
+          "command": "qm set <vmid> -bios ovmf",
+          "description": "Nastaviť VM na UEFI/OVMF, odporúčané pri podpore UEFI v ROM GPU"
+        }
+      ]
+    }
+  ],
+  "afterChangesTip": {
+    "title": "Po zmene GRUB alebo modprobe konfigurácie",
+    "bodyRich": "Na hostiteľoch s GRUB použite na zmeny štartovacích parametrov <code>update-grub</code>. Zmeny modulov zapracujte cez <code>update-initramfs -u -k all</code> a reštartujte. Iné zavádzače vyžadujú vlastný postup. Overte <code>cat /proc/cmdline</code> (parametre jadra), <code>dmesg | grep -i iommu</code> (inicializácia IOMMU) a <code>find /sys/kernel/iommu_groups/ -type l | sort -V</code> (prítomné skupiny)."
+  },
+  "related": {
+    "heading": "Súvisiace",
+    "items": [
+      {
+        "href": "/docs/hardware/gpu-vm-passthrough",
+        "label": "Pridať GPU do VM (passthrough)",
+        "tail": " — Interaktívny tok ProxMenux."
+      },
+      {
+        "href": "/docs/hardware/igpu-acceleration-lxc",
+        "label": "Pridať GPU do LXC",
+        "tail": " — zdieľať prístup k zariadeniam GPU hostiteľa s kontajnerom LXC."
+      },
+      {
+        "href": "/docs/help-info",
+        "label": "Prehľad pomoci a informácií",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sk/docs/help-info/index.json b/web/messages/sk/docs/help-info/index.json
new file mode 100644
index 00000000..24d33c14
--- /dev/null
+++ b/web/messages/sk/docs/help-info/index.json
@@ -0,0 +1,87 @@
+{
+  "meta": {
+    "title": "Prehľad príkazov Proxmoxu — qm, pct, vzdump, zpool, pveversion | ProxMenux",
+    "description": "Výber dôležitých príkazov Proxmox VE a Linuxu podľa tém: kontrola systému, správa VM a LXC (qm / pct), úložiská a disky, sieť, aktualizácie, GPU passthrough, ZFS, zálohovanie a obnova a každodenné nástroje príkazového riadka.",
+    "ogTitle": "Prehľad príkazov Proxmoxu — qm, pct, vzdump, zpool",
+    "ogDescription": "Výber užitočných príkazov Proxmox VE a Linuxu podľa tém: systém, VM/CT, úložiská, sieť, aktualizácie, GPU passthrough, ZFS, zálohy a nástroje CLI.",
+    "twitterTitle": "Prehľad príkazov Proxmoxu | ProxMenux",
+    "twitterDescription": "Výber užitočných príkazov Proxmox VE a Linuxu, zoskupených podľa tém."
+  },
+  "header": {
+    "title": "Pomoc a informácie",
+    "description": "Výber užitočných príkazov Linuxu a Proxmox VE podľa tém. Deväť kategórií zahŕňa rýchle overenie cez pveversion aj viacriadkové postupy so zfs send/receive. Slúži ako spoločný prehľad popri častiach ProxMenuxu pre GPU, disky a zdieľanie.",
+    "section": "Pomoc a informácie"
+  },
+  "intro": {
+    "title": "Čo to je?",
+    "body": "Katalóg príkazov používaných na hostiteľovi Proxmox, zoskupený podľa tém. V ProxMenuxe môžete príkaz spustiť výberom čísla alebo do výzvy vložiť vlastný príkaz. Na tejto stránke je každá kategória tabuľkou, z ktorej možno príkazy kopírovať."
+  },
+  "opening": {
+    "heading": "Otvorenie menu",
+    "body": "Z hlavného menu ProxMenux stlačte tlačidlo <kbd>h</kbd>. Uvidíte toto:",
+    "imageAlt": "Ponuka Pomoc a informácie s deviatimi kategóriami príkazov"
+  },
+  "categories": {
+    "heading": "Deväť kategórií",
+    "options": [
+      {
+        "icon": "Terminal",
+        "href": "/docs/help-info/system-commands",
+        "title": "Užitočné systémové príkazy",
+        "description": "pveversion, uptime, free, journalctl, hostnamectl, informácie o aktuálnom používateľovi, audit lynis a fastfetch."
+      },
+      {
+        "icon": "Cpu",
+        "href": "/docs/help-info/vm-ct-commands",
+        "title": "Správa VM a CT",
+        "description": "qm list / config / start / stop / migrate, pct list / config / enter, snímky a klonovanie."
+      },
+      {
+        "icon": "HardDrive",
+        "href": "/docs/help-info/storage-commands",
+        "title": "Úložiská a disky",
+        "description": "lsblk, blkid, smartctl, informácie o pripojených súborových systémoch, pvesm status a príkazy LVM."
+      },
+      {
+        "icon": "Network",
+        "href": "/docs/help-info/network-commands",
+        "title": "Sieťové príkazy",
+        "description": "ip / ss / nmcli, kontrola sieťových mostov, ping / traceroute, dotazy DNS a fail2ban-client."
+      },
+      {
+        "icon": "Package",
+        "href": "/docs/help-info/update-commands",
+        "title": "Aktualizácie a balíky",
+        "description": "apt update / dist-upgrade, apt-cache policy, dotazy dpkg a kontrola súborov repozitárov."
+      },
+      {
+        "icon": "Cpu",
+        "href": "/docs/help-info/gpu-commands",
+        "title": "GPU passthrough",
+        "description": "Kontroly cez lspci / dmesg, overenie zapnutia IOMMU, priradenie k vfio-pci a využitie GPU na hostiteľovi."
+      },
+      {
+        "icon": "Database",
+        "href": "/docs/help-info/zfs-commands",
+        "title": "Správa ZFS",
+        "description": "Príkazy zpool / zfs pre stav, datasety, snímky, send/receive, ladenie ARC a TRIM."
+      },
+      {
+        "icon": "Archive",
+        "href": "/docs/help-info/backup-commands",
+        "title": "Zálohovanie a obnova",
+        "description": "vzdump, qmrestore / pct restore, nástroje Proxmox Backup Server a operácie so snímkami."
+      },
+      {
+        "icon": "Wrench",
+        "href": "/docs/help-info/tools-commands",
+        "title": "Systémové CLI nástroje",
+        "description": "tmux, screen, htop / btop, ncdu, jq, dig, lsof, watch — každodenné nástroje správcu."
+      }
+    ]
+  },
+  "tip": {
+    "title": "Hľadať z globálneho vyhľadávania",
+    "body": "Všetky príkazy z týchto stránok sú zaradené do vyhľadávania dokumentácie. Ak si pamätáte prepínač alebo úryvok, ale nie príslušnú stránku, použite vyhľadávací panel hore a prejdete priamo na správnu položku."
+  }
+}
diff --git a/web/messages/sk/docs/help-info/network-commands.json b/web/messages/sk/docs/help-info/network-commands.json
new file mode 100644
index 00000000..5987e4cb
--- /dev/null
+++ b/web/messages/sk/docs/help-info/network-commands.json
@@ -0,0 +1,174 @@
+{
+  "meta": {
+    "title": "Sieťové príkazy Proxmoxu — ip, ping, ss, pve-firewall, iptables | ProxMenux",
+    "description": "Prehľad sieťových príkazov hostiteľa Proxmox VE: ip / ip link / ip addr, ping, traceroute, mtr, ss, ethtool, dig, nslookup a na filtrovanie pve-firewall, iptables a nftables. Kontrola sieťových mostov, bondov a VLAN.",
+    "ogTitle": "Sieťové príkazy Proxmoxu — ip, ping, ss, pve-firewall, iptables",
+    "ogDescription": "Sieťové príkazy pre Proxmox VE: kontrola rozhraní, testy pripojenia, monitorovanie, firewall (pve-firewall, iptables, nftables) a dotazy DNS.",
+    "twitterTitle": "Sieťové príkazy Proxmoxu | ProxMenux",
+    "twitterDescription": "Príkazy sieťovej kontroly, testovania, konfigurácie a firewallu pre Proxmox VE."
+  },
+  "header": {
+    "title": "Sieťové príkazy",
+    "description": "Výber sieťových príkazov hostiteľa Proxmox: informácie o rozhraniach, testy pripojenia, konfigurácia, monitorovanie prevádzky a správa firewallu. Zahŕňa ip / ss / nmcli / ethtool / tcpdump / pve-firewall.",
+    "section": "Pomoc a informácie"
+  },
+  "intro": {
+    "title": "Rýchly prehľad rozhraní",
+    "body": "<code>ip a</code> zobrazuje každé rozhranie s jeho IP adresami a MAC adresou. <code>ip r</code> zobrazuje smerovaciu tabuľku. Spolu za pár sekúnd zodpovedajú väčšinu otázok o správnom nastavení rozhrania."
+  },
+  "commandGroups": [
+    {
+      "title": "Sieťové informácie",
+      "commands": [
+        {
+          "command": "ip a",
+          "description": "Zobraziť sieťové rozhrania a IP adresy"
+        },
+        {
+          "command": "ip r",
+          "description": "Zobraziť smerovaciu tabuľku"
+        },
+        {
+          "command": "ip -s link",
+          "description": "Zobraziť štatistiky prenosu podľa rozhrania"
+        },
+        {
+          "command": "brctl show",
+          "description": "Zobraziť nastavené sieťové bridge"
+        },
+        {
+          "command": "cat /etc/network/interfaces",
+          "description": "Zobraziť surové sieťové nastavenie"
+        }
+      ]
+    },
+    {
+      "title": "Testovanie siete",
+      "commands": [
+        {
+          "command": "ping <host>",
+          "description": "Skontrolovať spojenie s iným hostom"
+        },
+        {
+          "command": "traceroute <host>",
+          "description": "Sledovať trasu k hostiteľovi"
+        },
+        {
+          "command": "mtr <host>",
+          "description": "Kombinácia ping a traceroute v reálnom čase"
+        },
+        {
+          "command": "dig <domain>",
+          "description": "DNS vyhľadanie domény"
+        },
+        {
+          "command": "nslookup <domain>",
+          "description": "Alternatívne vyhľadávanie DNS"
+        }
+      ]
+    },
+    {
+      "title": "Nastavenie siete",
+      "commands": [
+        {
+          "command": "ifreload -a",
+          "description": "Znovu načítať sieťové nastavenie (ifupdown2)"
+        },
+        {
+          "command": "ethtool <iface>",
+          "description": "Zobraziť informácie o ethernetovom zariadení"
+        },
+        {
+          "command": "resolvectl status",
+          "description": "Zobraziť stav DNS prekladu"
+        },
+        {
+          "command": "nmcli device show",
+          "description": "Zobraziť detaily sieťového zariadenia (ak sa použije NetworkManager)"
+        },
+        {
+          "command": "ip link set <iface> up",
+          "description": "Zapnúť sieťové rozhranie"
+        },
+        {
+          "command": "ip link set <iface> down",
+          "description": "Vypnúť sieťové rozhranie"
+        }
+      ]
+    },
+    {
+      "title": "Monitorovanie siete",
+      "commands": [
+        {
+          "command": "ss -tuln",
+          "description": "Zobraziť počúvajúce porty (TCP/UDP)"
+        },
+        {
+          "command": "netstat -tuln",
+          "description": "Alternatíva k zobrazeniu počúvacích portov"
+        },
+        {
+          "command": "lsof -i",
+          "description": "Zoznam otvorených sieťových súborov a pripojení"
+        },
+        {
+          "command": "tcpdump -i <iface>",
+          "description": "Zachytiť pakety na rozhraní"
+        },
+        {
+          "command": "iftop -i <iface>",
+          "description": "Monitorovať využívanie šírky pásma na rozhraní"
+        }
+      ]
+    },
+    {
+      "title": "Správa firewallu",
+      "commands": [
+        {
+          "command": "iptables -L -n -v",
+          "description": "Zobraziť aktívne pravidlá firewallu (iptables)"
+        },
+        {
+          "command": "nft list ruleset",
+          "description": "Zobraziť pravidlá nftables"
+        },
+        {
+          "command": "pve-firewall status",
+          "description": "Skontrolovať stav Proxmox firewallu"
+        },
+        {
+          "command": "pve-firewall compile",
+          "description": "Zostaviť pravidlá firewallu pre všetky uzly"
+        },
+        {
+          "command": "pve-firewall reload",
+          "description": "Znovu načítať pravidlá Proxmox firewallu"
+        }
+      ]
+    }
+  ],
+  "iptablesTip": {
+    "title": "iptables vs nftables",
+    "bodyRich": "Klasická služba <code>pve-firewall</code> vytvára pravidlá iptables. Alternatívna služba proxmox-firewall používa <strong>nftables</strong>. Backend iptables skontrolujete cez <code>iptables -L -n -v</code> a backend nftables cez <code>nft list ruleset</code>. Používajte nástroje aktívneho backendu; tieto výpisy nie sú zameniteľné."
+  },
+  "related": {
+    "heading": "Súvisiace",
+    "items": [
+      {
+        "href": "/docs/network",
+        "label": "Správa siete",
+        "tail": " — ProxMenux interaktívne sieťové nástroje (analýza mosta, trvalé názvy, monitorovanie)."
+      },
+      {
+        "href": "/docs/help-info/tools-commands",
+        "label": "Systémové CLI nástroje",
+        "tail": " — Viac nástrojov na monitorovanie sietí."
+      },
+      {
+        "href": "/docs/help-info",
+        "label": "Prehľad pomoci a informácií",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sk/docs/help-info/storage-commands.json b/web/messages/sk/docs/help-info/storage-commands.json
new file mode 100644
index 00000000..f85bff2e
--- /dev/null
+++ b/web/messages/sk/docs/help-info/storage-commands.json
@@ -0,0 +1,232 @@
+{
+  "meta": {
+    "title": "Príkazy úložísk a diskov Proxmoxu — lsblk, LVM, pvesm, qm importdisk | ProxMenux",
+    "description": "Prehľad príkazov úložísk a diskov v Proxmox VE: lsblk, blkid, parted, lvdisplay, vgdisplay, pvs, mount, df, du, ncdu a pvesm status; pre disky VM aj qm importdisk a qemu-img convert.",
+    "ogTitle": "Príkazy úložísk a diskov Proxmoxu — lsblk, LVM, pvesm, qm importdisk",
+    "ogDescription": "Príkazy úložísk a diskov Proxmox VE: kontrola diskov, LVM, pripojené súborové systémy, správa úložísk Proxmoxu, import diskov VM a konverzia obrazov.",
+    "twitterTitle": "Príkazy úložísk Proxmoxu | ProxMenux",
+    "twitterDescription": "Príkazy na kontrolu diskov a pripojení, správu LVM a úložísk Proxmox a import alebo konverziu diskov VM."
+  },
+  "header": {
+    "title": "Úložiská a disky",
+    "description": "Výber príkazov na kontrolu úložísk hostiteľov Proxmox: blokové zariadenia, oddiely, pripojené súborové systémy, zväzky LVM, konfigurácia úložísk a operácie s diskami VM (importdisk, qemu-img convert).",
+    "section": "Pomoc a informácie"
+  },
+  "intro": {
+    "title": "Rýchly prehľad diskov",
+    "body": "<code>lsblk</code> zobrazuje blokové zariadenia a oddiely v strome. Trvalé identifikátory overíte cez <code>ls -lh /dev/disk/by-id/</code>: pri rovnakom disku zostávajú zvyčajne stabilné po reštarte aj zmene poradia zariadení. Výmena disku alebo zmena spôsobu, akým radič sprístupňuje jeho identitu, môže cestu by-id zmeniť."
+  },
+  "commandGroups": [
+    {
+      "title": "Informácie o disku",
+      "commands": [
+        {
+          "command": "lsblk",
+          "description": "Zobraziť blokové zariadenia a oddiely"
+        },
+        {
+          "command": "fdisk -l",
+          "description": "Zobraziť disky s podrobnými informáciami"
+        },
+        {
+          "command": "blkid",
+          "description": "Zobraziť UUID a typ súborového systému zariadení"
+        },
+        {
+          "command": "ls -lh /dev/disk/by-id/",
+          "description": "Zobraziť trvalé identifikátory diskov"
+        },
+        {
+          "command": "parted -l",
+          "description": "Podrobné rozdelenie disku vrátane GPT"
+        }
+      ]
+    },
+    {
+      "title": "Využitie úložiska",
+      "commands": [
+        {
+          "command": "df -h",
+          "description": "Zobraziť využitie diskov podľa bodu pripojenia"
+        },
+        {
+          "command": "du -sh /path",
+          "description": "Zobraziť veľkosť priečinka"
+        },
+        {
+          "command": "mount | grep ^/dev",
+          "description": "Zobraziť pripojené úložné zariadenia"
+        },
+        {
+          "command": "cat /proc/mounts",
+          "description": "Zobraziť všetky aktívne pripojenia z kernelu"
+        }
+      ]
+    },
+    {
+      "title": "Správa LVM",
+      "commands": [
+        {
+          "command": "pvdisplay",
+          "description": "Zobraziť fyzické zväzky (LVM)"
+        },
+        {
+          "command": "vgdisplay",
+          "description": "Zobraziť skupiny zväzkov (LVM)"
+        },
+        {
+          "command": "lvdisplay",
+          "description": "Zobraziť logické zväzky (LVM)"
+        },
+        {
+          "command": "pvs",
+          "description": "Stručný výpis fyzických zväzkov"
+        },
+        {
+          "command": "vgs",
+          "description": "Stručný výpis skupín zväzkov"
+        },
+        {
+          "command": "lvs",
+          "description": "Stručný výpis logických zväzkov"
+        }
+      ]
+    },
+    {
+      "title": "Úložiská Proxmoxu",
+      "commands": [
+        {
+          "command": "cat /etc/pve/storage.cfg",
+          "description": "Zobraziť nastavenie úložísk Proxmoxu"
+        },
+        {
+          "command": "pvesm status",
+          "description": "Zobraziť stav všetkých úložísk"
+        },
+        {
+          "command": "pvesm status --enabled 1",
+          "description": "Zobraziť povolené nakonfigurované úložiská"
+        },
+        {
+          "command": "pvesm list <storage>",
+          "description": "Zobraziť obsah vybraného úložiska"
+        },
+        {
+          "command": "pvesm scan nfs <server>",
+          "description": "Vyhľadať exporty NFS na serveri"
+        }
+      ]
+    },
+    {
+      "title": "Operácie s diskami",
+      "commands": [
+        {
+          "command": "qm importdisk <vmid> <image_path> <storage>",
+          "description": "Importovať obraz ako nepoužitý disk VM; pripojiť ho treba osobitne"
+        },
+        {
+          "command": "qm set <vmid> -<bus><index> <disk_path>",
+          "description": "Priradiť fyzický disk na VM (prejazdový režim)"
+        },
+        {
+          "command": "qemu-img convert -O <format> <input> <output>",
+          "description": "Previesť formát obrazu disku, ktorý sa práve nepoužíva"
+        }
+      ]
+    },
+    {
+      "title": "Stav disku podľa SMART",
+      "commands": [
+        {
+          "command": "smartctl --scan",
+          "description": "Zoznam zariadení SMART-schopných na hostiteľovi"
+        },
+        {
+          "command": "smartctl -i /dev/<disk>",
+          "description": "Základné informácie o zariadení: model, firmvér a sériové číslo"
+        },
+        {
+          "command": "smartctl -H /dev/<disk>",
+          "description": "Rýchla kontrola celkového stavu: PASSED / FAILED"
+        },
+        {
+          "command": "smartctl -A /dev/<disk>",
+          "description": "Iba atribúty SMART (surové hodnoty, prahové hodnoty)"
+        },
+        {
+          "command": "smartctl -a /dev/<disk>",
+          "description": "Úplné informácie SMART: zariadenie, atribúty a protokol samotestov"
+        },
+        {
+          "command": "smartctl -t short /dev/<disk>",
+          "description": "Spustiť krátky samotest (~2 minút, beží v pozadí)"
+        },
+        {
+          "command": "smartctl -t long /dev/<disk>",
+          "description": "Spustiť dlhý samotest (hodiny, behy v pozadí)"
+        },
+        {
+          "command": "smartctl -l selftest /dev/<disk>",
+          "description": "Zobraziť samotestový log (výsledky minulých testov)"
+        },
+        {
+          "command": "smartctl -X /dev/<disk>",
+          "description": "Prerušiť prebiehajúci samotest"
+        }
+      ]
+    },
+    {
+      "title": "Stav disku NVMe",
+      "commands": [
+        {
+          "command": "nvme list",
+          "description": "Zoznam zariadení NVMe viditeľných do jadra"
+        },
+        {
+          "command": "nvme smart-log /dev/<nvme>",
+          "description": "NVMe špecifický SMART log (teplota, opotrebenie, chyby)"
+        },
+        {
+          "command": "nvme id-ctrl /dev/<nvme>",
+          "description": "Informácie o radiči: model, firmvér a funkcie"
+        },
+        {
+          "command": "nvme error-log /dev/<nvme>",
+          "description": "Nedávne záznamy chýb NVMe"
+        }
+      ]
+    }
+  ],
+  "lvmTip": {
+    "title": "LVM krátke vs dlhé príkazy",
+    "bodyRich": "Dostupné sú obe podoby. <code>pvs</code> / <code>vgs</code> / <code>lvs</code> vypisujú stručné tabuľky s jedným riadkom na fyzický zväzok, skupinu zväzkov, respektíve logický zväzok. <code>pvdisplay</code> / <code>vgdisplay</code> / <code>lvdisplay</code> poskytujú podrobnejší viacriadkový výpis. Krátke podoby sú praktické pri každodenných kontrolách."
+  },
+  "smartInfo": {
+    "title": "SMART pre SATA/SAS a NVMe",
+    "bodyRich": "<strong>Disky SATA / SAS vrátane SSD</strong> možno skontrolovať nástrojom <code>smartctl</code> z balíka <code>smartmontools</code>, ktorý je v Proxmoxe predvolene nainštalovaný. Zadajte zariadenie, napríklad <code>/dev/sda</code> alebo <code>/dev/sdb</code>. <strong>Disky NVMe</strong> používajú iný natívny protokol. Podporuje ich aj <code>smartctl</code>, zatiaľ čo <code>nvme</code> z balíka <code>nvme-cli</code> poskytuje špecifické dotazy na radiče, menné priestory a stav NVMe. Ak chýba, nainštalujte ho cez <code>apt install nvme-cli</code>."
+  },
+  "selfTestWarn": {
+    "title": "Samotesty bežia v pozadí",
+    "bodyRich": "Na podporovaných diskoch <code>smartctl -t short /dev/&lt;disk&gt;</code> a <code>smartctl -t long /dev/&lt;disk&gt;</code> spustia test na pozadí a hneď vrátia riadenie. Priebeh overíte cez <code>smartctl -a /dev/&lt;disk&gt;</code> podľa \"Self-test routine in progress\" alebo po dokončení prečítate <code>smartctl -l selftest /dev/&lt;disk&gt;</code>. Krátke testy zvyčajne trvajú asi dve minúty, dlhé môžu trvať hodiny. Disk zostáva použiteľný, ale výkon vstupov/výstupov môže klesnúť."
+  },
+  "related": {
+    "heading": "Súvisiace",
+    "items": [
+      {
+        "href": "/docs/help-info/zfs-commands",
+        "label": "Správa ZFS",
+        "tail": " — príkazy zpool / zfs pre úložiská založené na ZFS."
+      },
+      {
+        "href": "/docs/disk-manager",
+        "label": "Správca diskov",
+        "tail": " — interaktívne postupy ProxMenuxu na priame pripojenie diskov, import, formátovanie a SMART."
+      },
+      {
+        "href": "/docs/help-info",
+        "label": "Prehľad pomoci a informácií",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sk/docs/help-info/system-commands.json b/web/messages/sk/docs/help-info/system-commands.json
new file mode 100644
index 00000000..789b48c6
--- /dev/null
+++ b/web/messages/sk/docs/help-info/system-commands.json
@@ -0,0 +1,158 @@
+{
+  "meta": {
+    "title": "Systémové príkazy Proxmox VE — pveversion, uptime, journalctl, systemctl | ProxMenux",
+    "description": "Systémové príkazy Proxmox VE a Linuxu pre verzie, dobu behu, pamäť, služby, protokoly a používateľov spolu s nástrojmi na audit a prehľady. Súčasťou je reštart služby; nie všetky príklady slúžia iba na čítanie.",
+    "ogTitle": "Systémové príkazy Proxmox VE — pveversion, uptime, journalctl, systemctl",
+    "ogDescription": "Systémové príkazy Proxmox VE a Linuxu pre verziu, dobu behu, služby, protokoly a používateľov vrátane správy služieb a auditu.",
+    "twitterTitle": "Systémové príkazy Proxmox VE | ProxMenux",
+    "twitterDescription": "Dôležité príkazy na kontrolu systému Proxmox VE: verzia, stav, služby, protokoly a informácie o používateľoch."
+  },
+  "header": {
+    "title": "Užitočné systémové príkazy",
+    "description": "Príkazy na kontrolu hostiteľa Proxmox: verzia, jadro, doba behu, pamäť, stav webového rozhrania, nedávne protokoly a prihlásení používatelia spolu s nástrojmi na audit a prehľady. Väčšina iba zisťuje stav, ale systemctl restart pveproxy reštartuje webový proxy server a audit môže zapisovať správy a protokoly.",
+    "section": "Pomoc a informácie"
+  },
+  "intro": {
+    "title": "Čo to je?",
+    "body": "Rovnaký očíslovaný zoznam, aký ProxMenux zobrazuje v časti <em>Užitočné systémové príkazy</em>. Tlačidlom Kopírovať skopírujete príkaz alebo si v zozname overíte presný prepínač."
+  },
+  "commandGroups": [
+    {
+      "title": "Informácie o systéme",
+      "commands": [
+        {
+          "command": "pveversion",
+          "description": "Zobraziť verziu Proxmoxu"
+        },
+        {
+          "command": "pveversion -v",
+          "description": "Podrobné informácie o verzii Proxmoxu"
+        },
+        {
+          "command": "hostnamectl",
+          "description": "Názov hostiteľa a informácie o jadre"
+        },
+        {
+          "command": "uname -a",
+          "description": "Informácie o jadre a architektúre"
+        },
+        {
+          "command": "cat /etc/os-release",
+          "description": "Podrobnosti o vydaní systému"
+        }
+      ]
+    },
+    {
+      "title": "Stav systému",
+      "commands": [
+        {
+          "command": "uptime",
+          "description": "Doba behu systému"
+        },
+        {
+          "command": "uptime -p",
+          "description": "Prehľadný formát doby behu systému"
+        },
+        {
+          "command": "free -h",
+          "description": "Využitie RAM a swapu"
+        },
+        {
+          "command": "who -b",
+          "description": "Čas posledného štartu systému"
+        },
+        {
+          "command": "last -x | grep shutdown",
+          "description": "Predchádzajúce vypnutia"
+        }
+      ]
+    },
+    {
+      "title": "Riadenie služieb",
+      "commands": [
+        {
+          "command": "systemctl status pveproxy",
+          "description": "Skontrolovať stav webového rozhrania Proxmoxu"
+        },
+        {
+          "command": "systemctl restart pveproxy",
+          "description": "Reštartovať proxy webového rozhrania"
+        },
+        {
+          "command": "journalctl -xe",
+          "description": "Systémové chyby a logy"
+        },
+        {
+          "command": "dmesg -T | tail -n 50",
+          "description": "Posledných 50 riadkov logu jadra"
+        }
+      ]
+    },
+    {
+      "title": "Informácie o používateľoch",
+      "commands": [
+        {
+          "command": "whoami",
+          "description": "Aktuálny používateľ"
+        },
+        {
+          "command": "id",
+          "description": "UID, GID a skupiny aktuálneho používateľa"
+        },
+        {
+          "command": "who",
+          "description": "Prihlásení používatelia"
+        },
+        {
+          "command": "w",
+          "description": "Aktivita používateľov a doba behu systému"
+        },
+        {
+          "command": "uptime && w",
+          "description": "Doba behu systému a prihlásení používatelia"
+        },
+        {
+          "command": "cut -d: -f1,3,4 /etc/passwd",
+          "description": "Všetci používatelia s UID a GID"
+        },
+        {
+          "command": "getent passwd | column -t -s :",
+          "description": "Prehľadná tabuľka používateľov (UID, shell a pod.)"
+        }
+      ]
+    },
+    {
+      "title": "Kontrolné a súhrnné nástroje",
+      "commands": [
+        {
+          "command": "lynis audit system",
+          "description": "Spustiť úplný audit systémovej bezpečnosti"
+        },
+        {
+          "command": "fastfetch",
+          "description": "Zobraziť súhrn systému vo formáte ASCII"
+        }
+      ]
+    }
+  ],
+  "related": {
+    "heading": "Súvisiace",
+    "items": [
+      {
+        "href": "/docs/help-info/update-commands",
+        "label": "Aktualizácie a balíky",
+        "tail": " — príkazy apt a aktualizácie PVE."
+      },
+      {
+        "href": "/docs/help-info/tools-commands",
+        "label": "Systémové CLI nástroje",
+        "tail": " — htop, btop, ncdu a podobné nástroje."
+      },
+      {
+        "href": "/docs/help-info",
+        "label": "Prehľad pomoci a informácií",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sk/docs/help-info/tools-commands.json b/web/messages/sk/docs/help-info/tools-commands.json
new file mode 100644
index 00000000..a9188b33
--- /dev/null
+++ b/web/messages/sk/docs/help-info/tools-commands.json
@@ -0,0 +1,276 @@
+{
+  "meta": {
+    "title": "Nástroje CLI Linuxu pre Proxmox — htop, iftop, journalctl, rsync, tmux | ProxMenux",
+    "description": "Nástroje CLI Linuxu na každodennú správu Proxmox VE: monitorovanie (htop, atop, glances, iotop), sieť (iftop, nmap, mtr, ss), súbory a text (find, grep, journalctl), výkon (iostat, perf, strace), bezpečnosť (fail2ban, lynis, lsof) a vzdialená správa (ssh, rsync, tmux).",
+    "ogTitle": "Nástroje CLI Linuxu pre Proxmox — htop, iftop, journalctl, rsync, tmux",
+    "ogDescription": "Každodenné nástroje CLI na správu Proxmox VE podľa účelu: monitorovanie, sieť, súbory a text, výkon, bezpečnosť a vzdialená správa.",
+    "twitterTitle": "Nástroje CLI Linuxu pre Proxmox | ProxMenux",
+    "twitterDescription": "Nástroje CLI na každodennú správu Proxmox VE, zoskupené podľa účelu."
+  },
+  "header": {
+    "title": "Systémové CLI nástroje",
+    "description": "Nástroje CLI na každodennú správu hostiteľa Proxmox podľa účelu: monitorovanie, sieť, súbory a text, analýza výkonu, bezpečnosť, vzdialená správa a konfigurácia systému.",
+    "section": "Pomoc a informácie"
+  },
+  "intro": {
+    "title": "Väčšinu nainštaluje skript po inštalácii",
+    "body": "Ak ste spustili skript ProxMenuxu po inštalácii s predvoleným výberom, väčšina nástrojov je už nainštalovaná. Chýbajúce nástroje ponúka <utilsLink>inštalátor systémových nástrojov</utilsLink> v skupinách ako základné, vývoj, sieť a analýza."
+  },
+  "commandGroups": [
+    {
+      "title": "Monitorovanie systému",
+      "commands": [
+        {
+          "command": "htop",
+          "description": "Interaktívny prehliadač procesov s využitím CPU a pamäte"
+        },
+        {
+          "command": "top",
+          "description": "Zobraziť procesy Linuxu v reálnom čase"
+        },
+        {
+          "command": "atop",
+          "description": "Rozšírený systémový a procesný monitor"
+        },
+        {
+          "command": "glances",
+          "description": "Nástroj na monitorovanie systému s webovým rozhraním"
+        },
+        {
+          "command": "nmon",
+          "description": "Nástroj na monitorovanie výkonnosti"
+        },
+        {
+          "command": "iotop",
+          "description": "Monitorovať používanie disku I/O procesmi"
+        },
+        {
+          "command": "vmstat 1",
+          "description": "Každú sekundu hlásite štatistiky virtuálnej pamäte"
+        }
+      ]
+    },
+    {
+      "title": "Sieťové nástroje",
+      "commands": [
+        {
+          "command": "iftop",
+          "description": "Zobraziť využitie šírky pásma na rozhraní"
+        },
+        {
+          "command": "nmap <host>",
+          "description": "Prieskum siete a bezpečnostné skenovanie"
+        },
+        {
+          "command": "tcpdump -i <interface>",
+          "description": "Zachytiť sieťovú prevádzku"
+        },
+        {
+          "command": "netstat -tuln",
+          "description": "Zobrazenie sieťových pripojení"
+        },
+        {
+          "command": "ss -tuln",
+          "description": "Ďalší nástroj na skúmanie sockets"
+        },
+        {
+          "command": "mtr <host>",
+          "description": "Sieťový diagnostický nástroj kombinujúci ping a traceroute"
+        },
+        {
+          "command": "iperf3 -s",
+          "description": "Spustiť iperf server pre skúšku šírky pásma"
+        }
+      ]
+    },
+    {
+      "title": "Súborové a textové nástroje",
+      "commands": [
+        {
+          "command": "find / -name <filename>",
+          "description": "Hľadať súbory podľa názvu"
+        },
+        {
+          "command": "grep -r 'pattern' /path",
+          "description": "Hľadať vzor v súboroch"
+        },
+        {
+          "command": "sed -i 's/old/new/g' file",
+          "description": "Nahradiť text v súboroch"
+        },
+        {
+          "command": "awk '{print $1}' file",
+          "description": "Nástroj na spracovanie textu"
+        },
+        {
+          "command": "tail -f /var/log/syslog",
+          "description": "Sledovať log súbor v reálnom čase"
+        },
+        {
+          "command": "less /var/log/messages",
+          "description": "Zobraziť súbor s pagináciou"
+        },
+        {
+          "command": "journalctl -f",
+          "description": "Sledovať protokoly denníka systemd"
+        }
+      ]
+    },
+    {
+      "title": "Analýza výkonnosti",
+      "commands": [
+        {
+          "command": "iostat -x 1",
+          "description": "Zobraziť štatistiky CPU a vstupov/výstupov"
+        },
+        {
+          "command": "mpstat -P ALL 1",
+          "description": "Zobraziť využitie CPU"
+        },
+        {
+          "command": "perf top",
+          "description": "Systémový profilovací nástroj"
+        },
+        {
+          "command": "strace <command>",
+          "description": "Sledovať systémové volania a signály"
+        },
+        {
+          "command": "lsof",
+          "description": "Zoznam otvorených súborov"
+        },
+        {
+          "command": "pstree",
+          "description": "Zobraziť strom procesov"
+        },
+        {
+          "command": "slabtop",
+          "description": "Zobraziť informácie o vyrovnávacej pamäti slab jadra"
+        }
+      ]
+    },
+    {
+      "title": "Bezpečnostné nástroje",
+      "commands": [
+        {
+          "command": "fail2ban-client status",
+          "description": "Zobraziť stav fail2ban"
+        },
+        {
+          "command": "chage -l <username>",
+          "description": "Zobraziť informácie o uplynutí platnosti hesla"
+        },
+        {
+          "command": "lastlog",
+          "description": "Zobraziť posledné prihlásenie všetkých užívateľov"
+        },
+        {
+          "command": "last",
+          "description": "Zobraziť zoznam posledných prihlásených užívateľov"
+        },
+        {
+          "command": "w",
+          "description": "Zobraziť kto je prihlásený a čo robí"
+        },
+        {
+          "command": "lynis audit system",
+          "description": "Nástroj bezpečnostného auditu"
+        },
+        {
+          "command": "openssl s_client -connect host:port",
+          "description": "Test SSL/TLS pripojenia"
+        }
+      ]
+    },
+    {
+      "title": "Vzdialená správa",
+      "commands": [
+        {
+          "command": "ssh <user>@<host>",
+          "description": "Bezpečné spojenie shellu"
+        },
+        {
+          "command": "scp <file> <user>@<host>:<path>",
+          "description": "Bezpečne kopírovať súbory"
+        },
+        {
+          "command": "rsync -avz <src> <dest>",
+          "description": "Synchronizovať súbory/priečinky"
+        },
+        {
+          "command": "screen",
+          "description": "Terminálny multiplexer"
+        },
+        {
+          "command": "tmux",
+          "description": "Alternatíva Terminálneho multiplexeru"
+        },
+        {
+          "command": "ssh-keygen -t rsa -b 4096",
+          "description": "Generovať pár kľúčov SSH"
+        },
+        {
+          "command": "ssh-copy-id <user>@<host>",
+          "description": "Kopírovať kľúč SSH na server"
+        }
+      ]
+    },
+    {
+      "title": "Nastavenie systému",
+      "commands": [
+        {
+          "command": "systemctl status <service>",
+          "description": "Skontrolovať stav služby"
+        },
+        {
+          "command": "journalctl -u <service>",
+          "description": "Zobrazenie servisných záznamov"
+        },
+        {
+          "command": "timedatectl",
+          "description": "Spravovať systémový čas a dátum"
+        },
+        {
+          "command": "hostnamectl",
+          "description": "Spravovať názov hostiteľa"
+        },
+        {
+          "command": "localectl",
+          "description": "Spravovať miestne nastavenia a klávesnicu systému"
+        },
+        {
+          "command": "update-alternatives --config <name>",
+          "description": "Nastavenie systémových alternatív"
+        },
+        {
+          "command": "dpkg-reconfigure <package>",
+          "description": "Prekonfigurovať nainštalovaný balík"
+        }
+      ]
+    }
+  ],
+  "tmuxTip": {
+    "title": "Pri dlho bežiacich príkazoch používajte tmux / screen",
+    "bodyRich": "Dlho bežiace úlohy, napríklad zálohu, aktualizáciu alebo veľký prenos rsync, spúšťajte v <code>tmux</code> alebo <code>screen</code>, aby odpojenie SSH neukončilo terminálovú reláciu. K relácii tmux sa pripojíte znova na rovnakom hostiteľovi ako rovnaký používateľ príkazom <code>tmux attach</code>. Relácie screen majú vlastný príkaz na opätovné pripojenie."
+  },
+  "related": {
+    "heading": "Súvisiace",
+    "items": [
+      {
+        "href": "/docs/utils/system-utils",
+        "label": "Inštalátor systémových nástrojov",
+        "tail": " — nainštalovať chýbajúce nástroje."
+      },
+      {
+        "href": "/docs/help-info/system-commands",
+        "label": "Užitočné systémové príkazy",
+        "tail": " — príkazy na kontrolu systému špecifické pre Proxmox."
+      },
+      {
+        "href": "/docs/help-info",
+        "label": "Prehľad pomoci a informácií",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sk/docs/help-info/update-commands.json b/web/messages/sk/docs/help-info/update-commands.json
new file mode 100644
index 00000000..fedbecd7
--- /dev/null
+++ b/web/messages/sk/docs/help-info/update-commands.json
@@ -0,0 +1,170 @@
+{
+  "meta": {
+    "title": "Príkazy na aktualizáciu a správu balíkov Proxmoxu — apt, pveupgrade, dpkg | ProxMenux",
+    "description": "Prehľad príkazov na aktualizáciu a správu balíkov Proxmox VE: apt update, apt upgrade, apt dist-upgrade, pveupgrade, dpkg -l, zisťovanie informácií o balíkoch a konfigurácia repozitárov v /etc/apt/sources.list.d/.",
+    "ogTitle": "Príkazy na aktualizáciu a správu balíkov Proxmoxu — apt, pveupgrade, dpkg",
+    "ogDescription": "Príkazy apt, pveupgrade a dpkg na udržiavanie aktuálneho Proxmox VE: aktualizácie systému, správa balíkov a konfigurácia repozitárov.",
+    "twitterTitle": "Príkazy na aktualizáciu Proxmoxu | ProxMenux",
+    "twitterDescription": "Príkazy apt a pveupgrade na správu aktualizácií a balíkov na hostiteľoch Proxmox VE."
+  },
+  "header": {
+    "title": "Aktualizácie a balíky",
+    "description": "Výber príkazov apt a na aktualizáciu Proxmoxu: aktualizácie systému, inštalácia, odstránenie a úplné vyčistenie balíkov, informácie cez apt-cache policy a dpkg -l a kontrola repozitárov.",
+    "section": "Pomoc a informácie"
+  },
+  "intro": {
+    "title": "Vždy najprv aktualizovať index",
+    "body": "<code>apt update</code> obnoví miestny zoznam balíkov z nastavených repozitárov. Bez tohto kroku môže <code>apt install</code> použiť zastarané verzie alebo zlyhať s hlásením „Unable to locate package“."
+  },
+  "commandGroups": [
+    {
+      "title": "Aktualizácie systému",
+      "commands": [
+        {
+          "command": "apt update && apt upgrade -y",
+          "description": "Obnoviť zoznamy a aktualizovať nainštalované balíky (apt upgrade)"
+        },
+        {
+          "command": "apt dist-upgrade -y",
+          "description": "Úplná aktualizácia systému vrátane závislostí"
+        },
+        {
+          "command": "apt update",
+          "description": "Aktualizovať iba zoznamy balíkov"
+        },
+        {
+          "command": "apt upgrade",
+          "description": "Aktualizovať iba balíky (interaktívne)"
+        },
+        {
+          "command": "apt full-upgrade",
+          "description": "Aktualizovať balíky s riešením závislostí (interaktívne)"
+        }
+      ]
+    },
+    {
+      "title": "Aktualizácie Proxmox",
+      "commands": [
+        {
+          "command": "pveupdate",
+          "description": "Aktualizovať zoznamy Proxmox balíkov"
+        },
+        {
+          "command": "pveupgrade",
+          "description": "Spustiť interaktívnu aktualizáciu balíkov Proxmoxu"
+        },
+        {
+          "command": "pve8to9 --full",
+          "description": "Overiť pripravenosť na prechod z PVE 8 na 9 bez vykonania aktualizácie"
+        },
+        {
+          "command": "ceph versions",
+          "description": "Zobraziť verzie démonov Ceph pred plánovaním aktualizácie"
+        }
+      ]
+    },
+    {
+      "title": "Správa balíkov",
+      "commands": [
+        {
+          "command": "apt autoremove --purge",
+          "description": "Odstrániť nepoužívané balíky aj ich nastavenia"
+        },
+        {
+          "command": "apt clean",
+          "description": "Vymazať lokálne úložisko súborov balíčkov"
+        },
+        {
+          "command": "apt autoclean",
+          "description": "Vymazať iba zastarané súbory balíkov"
+        },
+        {
+          "command": "apt install <package>",
+          "description": "Inštalovať konkrétny balík"
+        },
+        {
+          "command": "apt remove <package>",
+          "description": "Odstrániť balík"
+        },
+        {
+          "command": "apt purge <package>",
+          "description": "Odstrániť balík a jeho konfiguračné súbory"
+        }
+      ]
+    },
+    {
+      "title": "Informácie o balíku",
+      "commands": [
+        {
+          "command": "apt list --installed",
+          "description": "Zoznam všetkých nainštalovaných balíkov"
+        },
+        {
+          "command": "apt search <keyword>",
+          "description": "Hľadať balíky podľa kľúčového slova"
+        },
+        {
+          "command": "apt show <package>",
+          "description": "Zobraziť podrobné informácie o balíku"
+        },
+        {
+          "command": "dpkg -l",
+          "description": "Zoznam všetkých nainštalovaných balíkov (alternatívnych)"
+        },
+        {
+          "command": "dpkg -l | grep <keyword>",
+          "description": "Hľadať nainštalované balíky podľa kľúčového slova"
+        },
+        {
+          "command": "apt-cache policy <package>",
+          "description": "Zobraziť verzie a priority balíkov"
+        }
+      ]
+    },
+    {
+      "title": "Správa repozitárov",
+      "commands": [
+        {
+          "command": "cat /etc/apt/sources.list",
+          "description": "Zobraziť hlavné zdroje úložiska APT"
+        },
+        {
+          "command": "ls -la /etc/apt/sources.list.d/",
+          "description": "Zoznam ďalších zdrojových súborov úložiska"
+        },
+        {
+          "command": "cat /etc/apt/sources.list.d/pve-enterprise.list",
+          "description": "Zobraziť konfiguráciu repozitára Proxmox Enterprise v súbore .list pre PVE 8"
+        },
+        {
+          "command": "apt-key list",
+          "description": "Zobraziť staršie podpisové kľúče repozitárov, ak je dostupný apt-key"
+        }
+      ]
+    }
+  ],
+  "backupWarn": {
+    "title": "Pred veľkou aktualizáciou vytvorte zálohu",
+    "bodyRich": "Na bežné aktualizácie Proxmox odporúča <code>apt update &amp;&amp; apt full-upgrade</code>. Pred potvrdením skontrolujte navrhované zmeny balíkov. Pri <strong>prechode na novú hlavnú verziu</strong> (PVE 8 → 9) použite postup ProxMenuxu <upgradeLink>Aktualizovať PVE 8 na PVE 9</upgradeLink>. Zahŕňa kontroly pripravenosti, migráciu repozitárov a overenie po aktualizácii. Najskôr vytvorte zálohu."
+  },
+  "related": {
+    "heading": "Súvisiace",
+    "items": [
+      {
+        "href": "/docs/utils/system-update",
+        "label": "Aktualizácia systému Proxmox (interaktívna)",
+        "tail": " — nástroj vykoná tieto kroky s potvrdením, pri inštalácii nového jadra automaticky zostaví ovládače spravované ProxMenuxom cez DKMS a ponúkne reštart. Spustiť ho možno aj tlačidlom Aktualizovať teraz na paneli ProxMenux Monitora."
+      },
+      {
+        "href": "/docs/utils/upgrade-pve8-pve9",
+        "label": "Upgrade PVE 8 na PVE 9",
+        "tail": " — na prechod na novú hlavnú verziu."
+      },
+      {
+        "href": "/docs/help-info",
+        "label": "Prehľad pomoci a informácií",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sk/docs/help-info/vm-ct-commands.json b/web/messages/sk/docs/help-info/vm-ct-commands.json
new file mode 100644
index 00000000..670c1c58
--- /dev/null
+++ b/web/messages/sk/docs/help-info/vm-ct-commands.json
@@ -0,0 +1,182 @@
+{
+  "meta": {
+    "title": "Príkazy qm a pct Proxmoxu — správa VM a kontajnerov LXC | ProxMenux",
+    "description": "Príkazy qm a pct Proxmox VE pre VM a kontajnery LXC: list, config, start, stop, shutdown, reboot, destroy, clone, migrate, snapshot, resize a pre kontajnery aj pct exec / enter / push / pull.",
+    "ogTitle": "Príkazy qm a pct Proxmoxu — správa VM a kontajnerov LXC",
+    "ogDescription": "Príkazy qm a pct Proxmox VE na správu virtuálnych strojov a kontajnerov LXC z príkazového riadka: spustenie, zastavenie, konfigurácia, snímky, migrácia, klonovanie a odstránenie.",
+    "twitterTitle": "Príkazy qm / pct Proxmoxu | ProxMenux",
+    "twitterDescription": "Výber príkazov qm / pct na správu virtuálnych strojov a kontajnerov LXC v Proxmox VE."
+  },
+  "header": {
+    "title": "Správa VM a CT",
+    "description": "Výber príkazov qm pre VM a pct pre kontajnery LXC: zoznamy, životný cyklus (start / stop / shutdown / destroy), kontrola konfigurácie a operácie s kontajnermi ako exec, enter, push a pull.",
+    "section": "Pomoc a informácie"
+  },
+  "intro": {
+    "title": "Najprv nájdite VMID alebo CTID",
+    "body": "Takmer každý príkaz potrebuje numerickú identifikáciu. Použite <code>qm list</code> pre VMs a <code>pct list</code> pre kontajnery. Nahradiť <code>&lt;vmid&gt;</code> / <code>&lt;ctid&gt;</code> v útržkoch s aktuálnym ID pred spustením."
+  },
+  "commandGroups": [
+    {
+      "title": "Zoznam a informácie",
+      "commands": [
+        {
+          "command": "qm list",
+          "description": "Zobraziť všetky VM"
+        },
+        {
+          "command": "pct list",
+          "description": "Zobraziť všetky LXC kontajnery"
+        },
+        {
+          "command": "qm config <vmid>",
+          "description": "Zobraziť konfiguráciu VM spracovanú nástrojom qm"
+        },
+        {
+          "command": "pct config <ctid>",
+          "description": "Zobraziť konfiguráciu kontajnera spracovanú nástrojom pct"
+        }
+      ]
+    },
+    {
+      "title": "Konfiguračné súbory (raw)",
+      "commands": [
+        {
+          "command": "cat /etc/pve/qemu-server/<vmid>.conf",
+          "description": "Zobraziť konfiguračný súbor VM"
+        },
+        {
+          "command": "cat /etc/pve/lxc/<ctid>.conf",
+          "description": "Zobraziť konfiguračný súbor CT"
+        },
+        {
+          "command": "nano /etc/pve/qemu-server/<vmid>.conf",
+          "description": "Upraviť konfiguračný súbor VM (nano)"
+        },
+        {
+          "command": "nano /etc/pve/lxc/<ctid>.conf",
+          "description": "Upraviť konfiguračný súbor CT (nano)"
+        },
+        {
+          "command": "vi /etc/pve/qemu-server/<vmid>.conf",
+          "description": "Upraviť konfiguračný súbor VM (vi)"
+        },
+        {
+          "command": "vi /etc/pve/lxc/<ctid>.conf",
+          "description": "Upraviť konfiguračný súbor CT (vi)"
+        }
+      ]
+    },
+    {
+      "title": "Správa VM",
+      "commands": [
+        {
+          "command": "qm start <vmid>",
+          "description": "Spustiť VM. Použite správne <vmid>"
+        },
+        {
+          "command": "qm stop <vmid>",
+          "description": "Vynútene zastaviť VM. Použite správne <vmid>"
+        },
+        {
+          "command": "qm shutdown <vmid>",
+          "description": "Riadne vypnúť virtuálny stroj"
+        },
+        {
+          "command": "qm reset <vmid>",
+          "description": "Resetovať virtuálny stroj (hard reštart)"
+        },
+        {
+          "command": "qm suspend <vmid>",
+          "description": "Pozastaviť virtuálny stroj"
+        },
+        {
+          "command": "qm resume <vmid>",
+          "description": "Obnoviť beh pozastaveného virtuálneho stroja"
+        },
+        {
+          "command": "qm destroy <vmid>",
+          "description": "Vymazať VM (nedá sa vrátiť späť). Použite správne <vmid>"
+        }
+      ]
+    },
+    {
+      "title": "Správa kontajnerov",
+      "commands": [
+        {
+          "command": "pct start <ctid>",
+          "description": "Spustiť kontajner. Použite správne <ctid>"
+        },
+        {
+          "command": "pct stop <ctid>",
+          "description": "Vynútene zastaviť kontajner. Použite správne <ctid>"
+        },
+        {
+          "command": "pct shutdown <ctid>",
+          "description": "Riadne vypnúť kontajner"
+        },
+        {
+          "command": "pct reboot <ctid>",
+          "description": "Znovu spustiť kontajner"
+        },
+        {
+          "command": "pct destroy <ctid>",
+          "description": "Vymazať CT (nedá sa vrátiť späť). Použite správne <ctid>"
+        }
+      ]
+    },
+    {
+      "title": "Prevádzka kontajnerov",
+      "commands": [
+        {
+          "command": "pct exec <ctid> -- getent passwd | column -t -s :",
+          "description": "Zobraziť používateľov CT v tabuľke"
+        },
+        {
+          "command": "pct exec <ctid> -- ps aux --sort=-%mem | head",
+          "description": "Procesy s najväčšou spotrebou pamäte v CT"
+        },
+        {
+          "command": "pct enter <ctid>",
+          "description": "Vstúpiť do shellu kontajnera"
+        },
+        {
+          "command": "pct push <ctid> <source> <dest>",
+          "description": "Kopírovať súbor z hostiteľa do kontajnera"
+        },
+        {
+          "command": "pct pull <ctid> <source> <dest>",
+          "description": "Kopírovať súbor z kontajnera na hostiteľa"
+        }
+      ]
+    }
+  ],
+  "destroyWarn": {
+    "title": "Zničiť je nezvratné",
+    "bodyRich": "<code>qm destroy</code> a <code>pct destroy</code> odstránia konfiguráciu hosťa a jeho spravované diskové zväzky. Nepredpokladajte, že odstránia aj externé údaje alebo údaje v bind mountoch. CLI predvolene nežiada potvrdenie. Potrebné údaje si najprv zálohujte; pozrite <backupLink>Zálohovanie a obnova</backupLink>."
+  },
+  "qmConfigTip": {
+    "title": "qm config a priama úprava súboru .conf",
+    "bodyRich": "<code>qm config &lt;vmid&gt;</code> a <code>pct config &lt;ctid&gt;</code> zobrazujú konfiguráciu cez parsery Proxmoxu. Na bežné zmeny uprednostnite <code>qm set</code> alebo zodpovedajúci príkaz pct. Priame úpravy <code>/etc/pve/qemu-server/&lt;vmid&gt;.conf</code> alebo <code>/etc/pve/lxc/&lt;ctid&gt;.conf</code> obchádzajú validáciu a zámky správcovských príkazov; súbor musí zostať spracovateľný. Pred ručnou opravou hosťa zastavte a uchovajte kópiu. <code>pmxcfs</code> synchronizuje konfiguráciu medzi uzlami klastra, nie obsah diskov hostí."
+  },
+  "related": {
+    "heading": "Súvisiace",
+    "items": [
+      {
+        "href": "/docs/help-info/backup-commands",
+        "label": "Zálohovanie a obnova",
+        "tail": " — vzdump a qmrestore / pct restore."
+      },
+      {
+        "href": "/docs/help-info/storage-commands",
+        "label": "Úložiská a disky",
+        "tail": " — qm importdisk a správa diskov."
+      },
+      {
+        "href": "/docs/help-info",
+        "label": "Prehľad pomoci a informácií",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sk/docs/help-info/zfs-commands.json b/web/messages/sk/docs/help-info/zfs-commands.json
new file mode 100644
index 00000000..b95f937c
--- /dev/null
+++ b/web/messages/sk/docs/help-info/zfs-commands.json
@@ -0,0 +1,227 @@
+{
+  "meta": {
+    "title": "Príkazy ZFS v Proxmoxe — zpool, zfs snapshot, send/receive, scrub | ProxMenux",
+    "description": "Príkazy na správu ZFS v Proxmox VE: zpool create / status / history, zfs list / get / set, snímky, clone, zfs send a receive, scrub, clear, replace, zpool iostat a súhrn ARC.",
+    "ogTitle": "Príkazy ZFS v Proxmoxe — zpool, zfs snapshot, send/receive, scrub",
+    "ogDescription": "Prehľad príkazov zpool a zfs v Proxmox VE: pooly, datasety, snímky, replikácia a údržba.",
+    "twitterTitle": "Príkazy ZFS v Proxmoxe | ProxMenux",
+    "twitterDescription": "príkazy zpool a zfs pre Proxmox VE: pools, množiny údajov, snapshots, replikácia, údržba."
+  },
+  "header": {
+    "title": "Správa ZFS",
+    "description": "Výber príkazov zpool a zfs: kontrola poolov, vytváranie, čítanie, úpravy a odstránenie datasetov, snímky, clone a prírastkové či rekurzívne send/receive, údržba cez scrub / clear / replace, štatistiky I/O a súhrn ARC.",
+    "section": "Pomoc a informácie"
+  },
+  "intro": {
+    "title": "Dve skupiny príkazov",
+    "body": "<code>zpool *</code> spravuje úložné pooly, teda fyzickú vrstvu: disky, vdevy a redundanciu. <code>zfs *</code> spravuje datasety a snímky v týchto pooloch, teda logickú vrstvu: súborové systémy, zväzky, snímky a vlastnosti."
+  },
+  "commandGroups": [
+    {
+      "title": "Informácie o pooloch",
+      "commands": [
+        {
+          "command": "zpool list",
+          "description": "Zobraziť všetky ZFS pooly"
+        },
+        {
+          "command": "zpool status",
+          "description": "Zobraziť podrobný stav a zdravie poolu"
+        },
+        {
+          "command": "zpool status -v",
+          "description": "Zobraziť podrobný stav pool s chybami"
+        },
+        {
+          "command": "zpool history",
+          "description": "Zobraziť históriu príkazov pre všetky pools"
+        },
+        {
+          "command": "zpool history <pool>",
+          "description": "Zobraziť históriu príkazov konkrétneho poolu"
+        },
+        {
+          "command": "zpool get all <pool>",
+          "description": "Zobraziť všetky vlastnosti pool"
+        }
+      ]
+    },
+    {
+      "title": "Správa datasetov",
+      "commands": [
+        {
+          "command": "zfs list",
+          "description": "Zobraziť všetky datasety ZFS"
+        },
+        {
+          "command": "zfs list -r <pool>",
+          "description": "Rekurzívne zobraziť všetky datasety v poole"
+        },
+        {
+          "command": "zfs create <pool>/<dataset>",
+          "description": "Vytvoriť nový dataset"
+        },
+        {
+          "command": "zfs destroy <pool>/<dataset>",
+          "description": "Odstrániť dataset"
+        },
+        {
+          "command": "zfs rename <pool>/<dataset> <pool>/<new-name>",
+          "description": "Premenovať dataset"
+        },
+        {
+          "command": "zfs get all <pool>/<dataset>",
+          "description": "Zobraziť všetky vlastnosti datasetu"
+        },
+        {
+          "command": "zfs set compression=on <pool>/<dataset>",
+          "description": "Zapnúť kompresiu na datasete"
+        }
+      ]
+    },
+    {
+      "title": "Správa snímok",
+      "commands": [
+        {
+          "command": "zfs list -t snapshot",
+          "description": "Zoznam všetkých snímok"
+        },
+        {
+          "command": "zfs list -t snapshot -r <pool>",
+          "description": "Zobraziť všetky snímky v poole"
+        },
+        {
+          "command": "zfs snapshot <pool>/<dataset>@<snapshot-name>",
+          "description": "Vytvoriť snímku"
+        },
+        {
+          "command": "zfs destroy <pool>/<dataset>@<snapshot-name>",
+          "description": "Odstrániť snímku"
+        },
+        {
+          "command": "zfs rollback <pool>/<dataset>@<snapshot-name>",
+          "description": "Rollback na snímku"
+        },
+        {
+          "command": "zfs hold <tag> <pool>/<dataset>@<snapshot-name>",
+          "description": "Chrániť snímku pred odstránením pomocou hold"
+        },
+        {
+          "command": "zfs release <tag> <pool>/<dataset>@<snapshot-name>",
+          "description": "Uvoľniť ochranu hold na snímke"
+        }
+      ]
+    },
+    {
+      "title": "Klon a odoslanie/prijatie",
+      "commands": [
+        {
+          "command": "zfs clone <pool>/<dataset>@<snapshot> <pool>/<clone-name>",
+          "description": "Vytvoriť klon zo snímky"
+        },
+        {
+          "command": "zfs send <pool>/<dataset>@<snapshot> > backup.zfs",
+          "description": "Poslať snímku do súboru"
+        },
+        {
+          "command": "zfs receive <pool>/<dataset> < backup.zfs",
+          "description": "Získať snímku zo súboru"
+        },
+        {
+          "command": "zfs send -i <pool>/<dataset>@<snap1> <pool>/<dataset>@<snap2> > incr.zfs",
+          "description": "Poslať prírastkovú snímku"
+        },
+        {
+          "command": "zfs send -R <pool>/<dataset>@<snapshot> > full-recursive.zfs",
+          "description": "Poslať rekurzívne snímky"
+        }
+      ]
+    },
+    {
+      "title": "Údržba a opravy",
+      "commands": [
+        {
+          "command": "zpool scrub <pool>",
+          "description": "Spustiť kontrolu scrub poolu"
+        },
+        {
+          "command": "zpool scrub -s <pool>",
+          "description": "Zastaviť prebiehajúci scrub"
+        },
+        {
+          "command": "zpool clear <pool>",
+          "description": "Vynulovať počítadlá chýb poolu"
+        },
+        {
+          "command": "zpool clear <pool> <device>",
+          "description": "Vymazať chyby na konkrétnom zariadení"
+        },
+        {
+          "command": "zpool replace <pool> <old-device> <new-device>",
+          "description": "Nahradiť chybné zariadenie"
+        },
+        {
+          "command": "zpool offline <pool> <device>",
+          "description": "Nastaviť zariadenie v poole ako offline"
+        },
+        {
+          "command": "zpool online <pool> <device>",
+          "description": "Nastaviť zariadenie v poole ako online"
+        }
+      ]
+    },
+    {
+      "title": "Výkonnosť a monitorovanie",
+      "commands": [
+        {
+          "command": "zpool iostat",
+          "description": "Zobraziť štatistiky I/O poolov"
+        },
+        {
+          "command": "zpool iostat -v",
+          "description": "Zobraziť podrobné I/O štatistiky"
+        },
+        {
+          "command": "zpool iostat 5",
+          "description": "Zobraziť štatistiky I/O každých päť sekúnd"
+        },
+        {
+          "command": "arc_summary",
+          "description": "Zobraziť štatistiku ARC (ak je nainštalovaná)"
+        },
+        {
+          "command": "zfs get compressratio <pool>/<dataset>",
+          "description": "Zobraziť kompresný pomer"
+        },
+        {
+          "command": "zfs get used,available,referenced <pool>/<dataset>",
+          "description": "Zobraziť využitie priestoru"
+        }
+      ]
+    }
+  ],
+  "bestPractices": {
+    "title": "Najlepšie prevádzkové postupy",
+    "bodyRich": "Pravidelne plánujte <code>zpool scrub</code> na overenie kontrolných súčtov a skontrolujte výsledok. Nechávajte voľnú kapacitu: vplyv takmer plného poolu závisí od záťaže a rozloženia. Chybné zariadenie vymeňte cez <code>zpool replace</code> podľa postupu pre jeho typ vdevu. Detach + add nie je rovnocenná výmena a môže zmeniť topológiu alebo odstrániť redundanciu."
+  },
+  "related": {
+    "heading": "Súvisiace",
+    "items": [
+      {
+        "href": "/docs/help-info/storage-commands",
+        "label": "Úložiská a disky",
+        "tail": " — všeobecné príkazy pre blokové zariadenia a LVM."
+      },
+      {
+        "href": "/docs/help-info/backup-commands",
+        "label": "Zálohovanie a obnova",
+        "tail": " — vzdump, qmrestore."
+      },
+      {
+        "href": "/docs/help-info",
+        "label": "Prehľad pomoci a informácií",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sk/docs/installation.json b/web/messages/sk/docs/installation.json
new file mode 100644
index 00000000..5d067516
--- /dev/null
+++ b/web/messages/sk/docs/installation.json
@@ -0,0 +1,93 @@
+{
+  "meta": {
+    "title": "Inštalácia ProxMenuxu | Dokumentácia ProxMenuxu",
+    "description": "Inštalácia ProxMenuxu jedným príkazom na hostiteľoch Proxmox VE 8 a novších. Obsahuje vopred vytvorené katalógy JSON pre osem jazykov: angličtinu, španielčinu, francúzštinu, nemčinu, taliančinu, portugalčinu, slovenčinu a švédčinu. Jazyk vyberiete pri inštalácii alebo ho neskôr zmeníte v nastaveniach. Beta kanál poskytuje skorý prístup k novým funkciám.",
+    "ogTitle": "Inštalácia ProxMenuxu | Dokumentácia ProxMenuxu",
+    "ogDescription": "Nainštalujte ProxMenux na Proxmox VE 8 alebo novší jediným príkazom. K dispozícii je stabilný aj beta kanál."
+  },
+  "header": {
+    "title": "Inštalácia ProxMenuxu",
+    "description": "Inštalátor spustíte jedným riadkom na ľubovoľnom hostiteľovi Proxmox VE 8 alebo novšom. Automaticky nainštaluje závislosti, stiahne skripty, nastaví spúšťač ponuky a pri prvom spustení požiada o výber jazyka. K dispozícii sú dva kanály: stabilný (predvolený) a beta.",
+    "section": "Inštalácia"
+  },
+  "stable": {
+    "heading": "Inštalovať",
+    "intro": "Spustite tento príkaz v termináli hostiteľa Proxmox:",
+    "code": "bash -c \"$(wget -qLO - https://raw.githubusercontent.com/MacRimi/ProxMenux/main/install_proxmenux.sh)\""
+  },
+  "during": {
+    "heading": "Počas inštalácie",
+    "intro": "ProxMenux automaticky nainštaluje a nakonfiguruje závislosti, ktoré potrebuje:",
+    "tablePackage": "Balík",
+    "tablePurpose": "Účel",
+    "rows": [
+      {
+        "package": "dialog",
+        "purpose": "Interaktívne ponuky v termináli"
+      },
+      {
+        "package": "curl",
+        "purpose": "Sťahovanie a kontrola pripojenia"
+      },
+      {
+        "package": "jq",
+        "purpose": "Spracovanie JSON"
+      },
+      {
+        "package": "git",
+        "purpose": "Klonovanie a aktualizácia repozitárov"
+      }
+    ],
+    "outro": "Inštalátor tiež stiahne skripty do <code>/usr/local/share/proxmenux/</code> a vytvorí spúšťač <code>/usr/local/bin/menu</code>. Webový panel <strong>ProxMenux Monitor</strong> sa zaregistruje ako služba <code>proxmenux-monitor.service</code>.",
+    "imageAlt": "Prebieha inštalácia ProxMenux"
+  },
+  "first": {
+    "heading": "Prvé spustenie",
+    "intro": "Po inštalácii spustite:",
+    "code": "menu",
+    "outro": "ProxMenux otvorí hlavnú ponuku. Z nej môžete spustiť všetky postupy zdokumentované na tejto stránke. Na čerstvo nainštalovanom hostiteľovi Proxmox je vhodné začať časťou <postlink>Po inštalácii</postlink>."
+  },
+  "beta": {
+    "heading": "Beta kanál",
+    "calloutTitle": "Čo je Beta program?",
+    "calloutBody": "Chcete vyskúšať novinky pred oficiálnym vydaním a pomôcť vytvoriť konečnú verziu? Beta program ProxMenuxu sprístupňuje nové funkcie vrátane najnovších zostavení Monitora priamo z vetvy <code>develop</code>. Beta verzie môžu obsahovať chyby alebo nedokončené funkcie. Vaša spätná väzba pomáha opraviť ich pred stabilným vydaním.",
+    "intro": "Namiesto stabilného nainštalujte beta verziu:",
+    "code": "bash -c \"$(wget -qLO - https://raw.githubusercontent.com/MacRimi/ProxMenux/develop/install_proxmenux_beta.sh)\"",
+    "outro": "Účasť v beta programe je dobrovoľná: musíte výslovne spustiť beta inštalátor. Po vydaní stabilnej verzie ProxMenux pri ďalšom spustení <code>menu</code> upozorní a ponúkne automatický prechod. Ak chcete beta program opustiť skôr, v nastaveniach vyberte <betalink>Deaktivovať beta program</betalink>."
+  },
+  "updating": {
+    "heading": "Aktualizácia",
+    "body": "ProxMenux spravuje vlastné aktualizácie. Keď je dostupná nová verzia, ďalšie spustenie <code>menu</code> ponúkne jej inštaláciu. Po prijatí sa súbory a konfigurácia nástroja nahradia v existujúcej inštalácii, bez ručného sťahovania. Stabilný kanál dostáva stabilné vydania a beta kanál beta vydania spolu s vyššie opísanou ponukou prechodu. Podoba výzvy závisí od toho, kde spustíte <code>menu</code>: cez SSH alebo konzolu Proxmox sa zobrazí dialóg áno/nie a po potvrdení sa aktualizácia vykoná ihneď. V termináli WebSocket v ProxMenux Monitore sa namiesto neho zobrazí informačné okno, pretože tento terminál by sa počas aktualizácie prerušil. Okno ukazuje jednoriadkový inštalačný príkaz (<code>bash -c \"$(wget -qLO - https://raw.githubusercontent.com/MacRimi/ProxMenux/main/install_proxmenux.sh)\"</code> pre stabilný kanál alebo zodpovedajúcu URL <code>install_proxmenux_beta.sh</code> pre beta kanál), ktorý spustíte cez SSH alebo konzolu."
+  },
+  "uninstall": {
+    "heading": "Odinštalovanie",
+    "body": "V ProxMenuxe: <strong>Nastavenia → Odinštalovať ProxMenux</strong>. Odinštalovanie odstráni skripty, spúšťač a službu Monitor a voliteľne aj vybrané závislosti. Súbory <code>/root/.bashrc</code> a <code>/etc/motd</code> obnoví zo záloh, ktoré vytvoril Post-Install, ak sú dostupné (inak odstráni riadok ProxMenux z MOTD). Celý postup: <uninstalllink>Odinštalovanie ProxMenuxu</uninstalllink>."
+  },
+  "troubleshoot": {
+    "heading": "Riešenie problémov",
+    "virustotalTitle": "VirusTotal označuje URL inštalácie",
+    "virustotalBody": "Výsledok 1/95 od <em>Chong Lua Dao</em>, nahlásený v issue #162, správca projektu označil za falošný poplach. Inštalátor sa spúšťa príkazom, ktorý skript stiahne a spustí (<code>bash -c \"$(wget -qLO - …)\"</code>) a môže stiahnuť <code>jq</code> z jeho oficiálneho vydania na GitHube. Takéto <em>správanie</em> môže spustiť heuristickú detekciu; historické hlásenie nie je hodnotením všetkých budúcich stiahnutí. Inštalátor má otvorený zdrojový kód a možno ho skontrolovať. Ďalšie súvislosti v <issuelink>issue #162</issuelink>.",
+    "aptTitle": "Inštalácia zlyhala s apt chybami",
+    "aptBody": "Zvyčajne chýba repozitár Proxmoxu alebo je nesprávne nastavený. Inštalátor získava závislosti cez apt, ktorý pri chybnej konfigurácii repozitárov zlyhá. Stáva sa to napríklad pri minimálnych inštaláciách Proxmoxu 8, ktoré ešte neboli aktualizované. Najprv ručne spustite <code>apt-get update</code>, opravte všetky chyby a potom znova spustite inštalátor.",
+    "menuTitle": "`menu: command not found` po inštalácii",
+    "menuBody": "Spúšťač je v <code>/usr/local/bin/menu</code>. Overte ho príkazom <code>ls -lh /usr/local/bin/menu</code>. Ak chýba, inštalácia sa predčasne ukončila; spustite ju znova. Ak existuje, ale príkaz sa nenájde, PATH neobsahuje <code>/usr/local/bin</code>. Opravte PATH alebo spustite priamo <code>/usr/local/bin/menu</code>.",
+    "stuckTitle": "Inštalácia visí alebo nepostupuje",
+    "stuckBody": "Ak sa inštalácia, reinštalácia alebo aktualizácia zasekne pre problém s pripojením, prerušte ju pomocou <strong>Ctrl + C</strong> a znova ručne spustite inštalátor.",
+    "otherTitle": "Iné problémy",
+    "otherBody": "Pozrite si známe problémy v <issueslink>GitHub Issues</issueslink> alebo vytvorte nové hlásenie s príslušnými výpismi. Ak používate beta verziu a problém súvisí s Monitorom, pridajte výstup <code>journalctl -u proxmenux-monitor -n 50</code>."
+  },
+  "next": {
+    "heading": "Čo ďalej?",
+    "postInstall": "<postlink>Skript po inštalácii</postlink> — úpravy a zabezpečenie čerstvo nainštalovaného hostiteľa Proxmox.",
+    "introduction": "<introlink>Úvod</introlink> — úplný prehľad funkcií.",
+    "monitor": "<monitorlink>ProxMenux Monitor</monitorlink> — webový panel hostiteľa, ktorý sa automaticky inštaluje spolu s ponukou."
+  },
+  "requirements": {
+    "heading": "Požiadavky a osvedčené postupy",
+    "reqTitle": "Požiadavky",
+    "reqBody": "Proxmox VE <strong>8.x alebo novší</strong>. PVE 7 a staršie verzie nie sú podporované. Hostiteľ potrebuje prístup na internet na stiahnutie skriptov, závislostí a AppImage ProxMenux Monitora. Inštalátor spúšťajte ako <strong>root</strong> na hostiteľovi Proxmox.",
+    "inspectTitle": "Vždy skontrolujte skripty, ktoré spustíte z internetu",
+    "inspectReview": "<sourcelink>Pred spustením si prezrite zdroj inštalátora</sourcelink>.",
+    "inspectCoc": "Všetky spustiteľné odkazy dodržiavajú <coclink>kódex správania ProxMenuxu</coclink>."
+  }
+}
diff --git a/web/messages/sk/docs/introduction.json b/web/messages/sk/docs/introduction.json
new file mode 100644
index 00000000..870fe71c
--- /dev/null
+++ b/web/messages/sk/docs/introduction.json
@@ -0,0 +1,206 @@
+{
+  "meta": {
+    "title": "ProxMenux — Správa Proxmox VE pomocou ponúk | Open source",
+    "description": "Open-source nástroj na správu Proxmox VE pomocou ponúk. ProxMenux má dve súčasti: CLI/TUI na úpravy po inštalácii, vytváranie VM a kontajnerov LXC, priame priradenie GPU a Coral TPU, správu diskov, úložísk a siete; a webový panel na vlastnom serveri s proaktívnym monitorovaním stavu, upozorneniami cez Telegram, Discord alebo e-mail, preformulovaním pomocou AI a rozhraním REST API.",
+    "ogTitle": "ProxMenux — Správa Proxmox VE pomocou ponúk",
+    "ogDescription": "Open-source CLI/TUI a webový panel pre Proxmox VE: úpravy po inštalácii, VM, GPU, disky, sieť, úložiská a zabezpečenie. Samostatný Monitor pridáva kontroly stavu, upozornenia, preformulovanie pomocou AI a REST API.",
+    "twitterTitle": "ProxMenux — Správa Proxmox VE pomocou ponúk",
+    "twitterDescription": "Open-source CLI/TUI a webový panel pre Proxmox VE. Monitorovanie stavu, upozornenia, preformulovanie pomocou AI a REST API."
+  },
+  "header": {
+    "title": "Úvod",
+    "description": "ProxMenux je open-source nástroj pre Proxmox VE ovládaný pomocou ponúk. Projekt má dve súčasti: CLI/TUI pre bežné úlohy pri správe hostiteľa, VM, kontajnerov, úložísk, siete a zabezpečenia a webový panel na vlastnom serveri s proaktívnym monitorovaním stavu, upozorneniami, voliteľným preformulovaním pomocou AI a REST API.",
+    "section": "Úvod"
+  },
+  "hero": {
+    "tagline": "<strong>Jedna ponuka pre všetky úlohy.</strong> To, na čo bežne potrebujete otvorenú wiki, dve diskusie na fóre a skopírovanú sériu príkazov, je dostupné ako číslovaná voľba, ktorú spustíte za pár sekúnd.",
+    "audience": "Určený pre <em>začínajúcich</em> používateľov Proxmoxu s bezpečnými predvolenými nastaveniami aj pre <em>skúsených</em> správcov, ktorí chcú bežné úlohy vykonať s menším počtom príkazov. Bezplatný a open source, s aktívnou komunitou na <github>GitHub</github>."
+  },
+  "twoProducts": {
+    "heading": "Dve súčasti, jeden projekt",
+    "intro": "ProxMenux má dve súčasti v spoločnom zdrojovom strome. Inštalátor nainštaluje obe na hostiteľa: Scripts poskytuje terminálové rozhranie a Monitor webový panel:",
+    "scripts": {
+      "title": "ProxMenux Scripts",
+      "body": "Pôvodné rozhranie CLI/TUI, ktoré spustíte príkazom <code>menu</code>. Deväť oblastí pokrýva optimalizácie po inštalácii, VM a kontajnery LXC, priame priradenie GPU a Coral TPU, disky, úložiská, sieť, zabezpečenie a nástroje, spolu s prehľadom vybraných príkazov. Funguje v lokálnom termináli, cez SSH aj vo webovom termináli."
+    },
+    "monitor": {
+      "title": "ProxMenux Monitor",
+      "body": "Webový panel na vlastnom serveri, distribuovaný ako AppImage. Metriky hostiteľa v reálnom čase, proaktívne monitorovanie stavu, upozornenia, voliteľné preformulovanie pomocou AI so šiestimi poskytovateľmi, integrovaný webový terminál a REST API. Zapnete ho v ponuke Scripts cez Nastavenia → ProxMenux Monitor."
+    },
+    "calloutTitle": "Čo ProxMenux spravuje",
+    "calloutIntro": "Tri vrstvy, všetky dosiahnuteľné z toho istého projektu:",
+    "layers": [
+      "<strong>Hostiteľ Proxmox</strong> — repozitáre, balíky, sieť, ZFS, Ceph, jadro a monitorovanie.",
+      "<strong>Virtuálne stroje (VM)</strong> — vytváranie, priame priradenie GPU a diskov, import a export OVA/OVF.",
+      "<strong>Kontajnery LXC</strong> — vytváranie, prípojné body, priame priradenie GPU/TPU, klienti a servery NFS/Samba."
+    ]
+  },
+  "scriptsSection": {
+    "heading": "ProxMenux Scripts — čo ponúka",
+    "intro": "Deväť funkčných oblastí, každá s vlastnou ponukou v <code>menu</code> a podrobnou stránkou v dokumentácii. Kliknutím na kartu otvoríte prehľad príslušnej oblasti.",
+    "items": [
+      {
+        "title": "Po inštalácii",
+        "description": "Optimalizácie čerstvej inštalácie Proxmoxu: repozitáre, jadro, synchronizácia času, základné zabezpečenie a výkon, s možnosťami vrátenia zmien.",
+        "icon": "Server",
+        "href": "/docs/post-install"
+      },
+      {
+        "title": "GPU a Coral TPU",
+        "description": "Priame priradenie NVIDIA, Intel iGPU, AMD a Coral TPU virtuálnym strojom a kontajnerom LXC s prepínaním medzi režimami VM a LXC.",
+        "icon": "Cpu",
+        "href": "/docs/hardware/nvidia-host"
+      },
+      {
+        "title": "Vytvoriť VM",
+        "description": "Sprievodcovia pre systémy NAS, Windows a Linux s rozumnými predvolenými nastaveniami hardvéru, úložísk a siete.",
+        "icon": "Server",
+        "href": "/docs/create-vm"
+      },
+      {
+        "title": "Správca diskov",
+        "description": "Sprístupnenie fyzických diskov pre VM a LXC, formátovanie a mazanie diskov, testy SMART a import obrazov qcow2, vmdk a vdi — priamo z ponuky.",
+        "icon": "HardDrive",
+        "href": "/docs/disk-manager"
+      },
+      {
+        "title": "Úložiská a zdieľanie",
+        "description": "Registrácia úložísk NFS, Samba/CIFS, iSCSI a lokálnych úložísk v Proxmoxe; zdieľanie priečinkov medzi hostiteľom a kontajnermi LXC pomocou bind mountov alebo sieťových protokolov.",
+        "icon": "Boxes",
+        "href": "/docs/storage-share"
+      },
+      {
+        "title": "Sieť",
+        "description": "Diagnostika bez zmien, analýza s návrhmi a riadené opravy /etc/network/interfaces. Pred zmenami sa vytvárajú zálohy.",
+        "icon": "Network",
+        "href": "/docs/network"
+      },
+      {
+        "title": "Zabezpečenie",
+        "description": "Fail2Ban na ochranu SSH a webových rozhraní pred pokusmi o prienik a Lynis na audit zabezpečenia — inštalácia a správa s rozumnými predvolenými nastaveniami.",
+        "icon": "Shield",
+        "href": "/docs/security"
+      },
+      {
+        "title": "Nástroje",
+        "description": "Vytváranie ISO systému Windows cez UUP Dump, inštalácia nástrojov CLI, riadené aktualizácie systému, prechod z PVE 8 na 9 a export či import VM vo formáte OVA/OVF.",
+        "icon": "Wrench",
+        "href": "/docs/utils"
+      },
+      {
+        "title": "Prehľad príkazov",
+        "description": "Výber príkazov Linuxu a Proxmoxu podľa tém: systém, VM/CT s qm a pct, úložiská, sieť, ZFS, priame priradenie GPU, zálohovanie a každodenné nástroje CLI.",
+        "icon": "BookOpen",
+        "href": "/docs/help-info"
+      }
+    ]
+  },
+  "monitorSection": {
+    "heading": "ProxMenux Monitor — čo ponúka",
+    "intro": "Webový panel beží priamo na hostiteľovi Proxmox na porte TCP 8008. Kliknutím na kartu otvoríte príslušnú stránku alebo si najprv prečítajte <link>prehľad Monitora</link>.",
+    "items": [
+      {
+        "title": "Monitor stavu systému",
+        "description": "Každých päť minút sa kontroluje desať kategórií: CPU, pamäť, úložiská, disky/SMART, sieť, VM, služby, protokoly, aktualizácie a zabezpečenie. S úrovňami závažnosti a možnosťou potlačiť upozornenia pre jednotlivé kategórie.",
+        "icon": "Activity",
+        "href": "/docs/monitor/health-monitor"
+      },
+      {
+        "title": "Oznámenia",
+        "description": "Telegram, Discord, e-mail, Gotify, Pushover a viackanálový Apprise — s odstraňovaním duplicít, minimálnym odstupom medzi odoslaniami, zoskupovaním súbežných upozornení, tichými hodinami a úplnou históriou.",
+        "icon": "Bell",
+        "href": "/docs/monitor/notifications"
+      },
+      {
+        "title": "AI asistent",
+        "description": "Voliteľné preformulovanie upozornení do zrozumiteľného jazyka. Šesť poskytovateľov: OpenAI, Anthropic Claude, Google Gemini, Groq, OpenRouter a lokálny Ollama. Trinásť jazykov vo výbere jazyka AI.",
+        "icon": "Sparkles",
+        "href": "/docs/monitor/ai-assistant"
+      },
+      {
+        "title": "Web terminál",
+        "description": "Interaktívny shell na hostiteľovi Proxmox v prehliadači a samostatný terminál ProxMenux Scripts, ktorý spúšťa ponuku vo webovom rozhraní.",
+        "icon": "Terminal",
+        "href": "/docs/monitor/dashboard/terminal"
+      },
+      {
+        "title": "REST API",
+        "description": "HTTP endpointy pre systém, jeho stav, úložiská/SMART, sieť, VM, upozornenia a zabezpečenie — vhodné pre Homepage, Home Assistant, Prometheus alebo vlastné skripty.",
+        "icon": "Code2",
+        "href": "/docs/monitor/api"
+      },
+      {
+        "title": "Integrácie",
+        "description": "Natívny webhook Proxmox VE, zber metrík cez Prometheus, kontroly Uptime Kuma, widgety Homepage, Home Assistant a Glance, automatizácie n8n/Zapier a Tailscale Secure Gateway.",
+        "icon": "Plug",
+        "href": "/docs/monitor/integrations"
+      }
+    ]
+  },
+  "installPaths": {
+    "heading": "Možnosti inštalácie",
+    "intro": "Oba inštalátory nainštalujú Scripts a Monitor. Scripts používa vopred pripravené katalógy JSON v ôsmich jazykoch bez online prekladu. Môžete si vybrať stabilný alebo beta kanál; Monitor sa distribuuje ako AppImage a spúšťa sa z rozbaleného prostredia:",
+    "headerPath": "Install path",
+    "headerBundles": "Čo obsahuje",
+    "headerWhen": "Kedy zvoliť",
+    "rows": [
+      {
+        "pathRich": "<strong>Scripts: stabilný kanál</strong>",
+        "bundles": "CLI/TUI s vopred pripravenými prekladmi JSON v ôsmich jazykoch, bez virtuálneho prostredia či online prekladovej služby.",
+        "when": "Bežné používanie so stabilným kanálom vydaní."
+      },
+      {
+        "pathRich": "<strong>Scripts: beta kanál</strong>",
+        "bundles": "Rovnaké viacjazyčné rozhranie nainštalované z vetvy develop na testovanie pripravovaných zmien.",
+        "when": "Skoré testovanie nových funkcií s vyšším rizikom chýb."
+      },
+      {
+        "pathRich": "<strong>Monitor</strong>",
+        "bundles": "Samostatný AppImage s webovým panelom na porte TCP 8008. Inštalátor rozbalí jeho prostredie a spravuje službu; Monitor sa ovláda v nastaveniach.",
+        "when": "Keď chcete sledovať hostiteľa cez webový panel v telefóne, tablete alebo prehliadači."
+      }
+    ],
+    "outro": "Podrobné príkazy a požiadavky nájdete na <link>stránke inštalácie</link>."
+  },
+  "warnSource": {
+    "title": "Pred spustením vždy skontrolujte skripty z internetu",
+    "body": "ProxMenux je open source a každý skript si môžete prezrieť na GitHube. Pred spustením inštalačného príkazu si prečítajte zdrojový kód. Rovnako postupujte pri iných automatizačných nástrojoch.",
+    "sourceLabel": "Zobraziť zdroj ProxMenux",
+    "cocLabel": "Kódex správania"
+  },
+  "next": {
+    "heading": "Ďalšie kroky",
+    "items": [
+      {
+        "lead": "<strong>Začínate s ProxMenuxom?</strong> ",
+        "linkHref": "/docs/installation",
+        "linkLabel": "Nainštalujte ho jedným príkazom",
+        "tailRich": " a spustite <code>menu</code>."
+      },
+      {
+        "lead": "<strong>Práve ste nainštalovali Proxmox?</strong> Začnite so ",
+        "linkHref": "/docs/post-install",
+        "linkLabel": "skriptom po inštalácii",
+        "tail": "."
+      },
+      {
+        "lead": "<strong>Chcete webový panel?</strong> ",
+        "linkHref": "/docs/monitor",
+        "linkLabel": "ProxMenux Monitor",
+        "tail": " má dokumentáciu, ktorá vysvetľuje jeho funkcie, architektúru a zabezpečenie."
+      },
+      {
+        "lead": "<strong>Hľadáte konkrétny príkaz?</strong> ",
+        "linkHref": "/docs/help-info",
+        "linkLabel": "Prehľad príkazov",
+        "tail": " obsahuje vybrané príkazy podľa tém s tlačidlami na kopírovanie."
+      },
+      {
+        "lead": "<strong>Chcete podrobnejšie návody?</strong> ",
+        "linkHref": "/guides",
+        "linkLabel": "Sekcia návodov",
+        "tail": " sa venuje Coral TPU, priamemu priradeniu NVIDIA, Kodi v LXC a ďalším témam."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sk/docs/monitor/dashboard/vms-lxcs-app.json b/web/messages/sk/docs/monitor/dashboard/vms-lxcs-app.json
index 8abc8a2b..551b00fc 100644
--- a/web/messages/sk/docs/monitor/dashboard/vms-lxcs-app.json
+++ b/web/messages/sk/docs/monitor/dashboard/vms-lxcs-app.json
@@ -98,7 +98,7 @@
     ],
     "sourcesHeading": "Zdroje dostupnej verzie",
     "sources": [
-      "<strong>GitHub repozitár</strong>: najnovšie vydanie alebo značka verejného repozitára <code>vlastník/názov</code>.",
+      "<strong>GitHub repozitár</strong>: najnovšie vydanie alebo značka verejného repozitára <code>owner/name</code>.",
       "<strong>HTTP JSON</strong>: verejný koncový bod a cesta ako <code>data.version</code> alebo <code>releases[0].tag_name</code>.",
       "<strong>Docker Hub</strong>: verzované značky filtrované regulárnym výrazom. Živý náhľad pred uložením ukáže skutočné zodpovedajúce značky.",
       "Pohyblivé značky ako <code>latest</code>, <code>stable</code> alebo <code>lts</code> neobsahujú verziu. Tieto obrazy sledujte podľa digestu v aktualizáciách Docker obrazov."
diff --git a/web/messages/sk/docs/monitor/dashboard/vms-lxcs-updates.json b/web/messages/sk/docs/monitor/dashboard/vms-lxcs-updates.json
index 7f4438f6..52331ccf 100644
--- a/web/messages/sk/docs/monitor/dashboard/vms-lxcs-updates.json
+++ b/web/messages/sk/docs/monitor/dashboard/vms-lxcs-updates.json
@@ -110,7 +110,7 @@
       "Nepridávajte <code>pct exec</code>; ProxMenux už vstupuje do kontajnera a príkaz spúšťa ako root."
     ],
     "exampleLead": "Príklad úplného postupu v kontajneri:",
-    "example": "cd /opt/moja-aplikacia && ./update.sh",
+    "example": "cd /opt/my-app && ./update.sh",
     "callout": "Príkaz ako <code>myapp --version</code> iba číta verziu a nič neaktualizuje. Príkazy sa spúšťajú s oprávneniami správcu a musia sa kontrolovať ako príkazy shellu root."
   },
   "bulk": {
@@ -140,7 +140,7 @@
     "items": [
       "Vyberte predvoľbu alebo cron výraz a potom presné ciele: balíky OS, jednotlivé aplikácie, Docker Engine, samostatné jednotky Dockeru alebo skupiny služieb Compose.",
       "Oneskorenie po vydaní platí iba pre vybrané aplikácie so sledovaním verzie. Aplikácie bez sledovania spustia aktualizátor pri každom termíne.",
-      "Stav posledného behu rozlišuje úspech, čiastočné dokončenie, zlyhanie, bezpečnostné pozdržanie a stav bez čakajúcich aktualizácií.",
+      "Stav posledného behu rozlišuje úspech, čiastočné dokončenie, zlyhanie, bezpečnostné pozastavenie a žiadne čakajúce aktualizácie. Po prvom plánovanom behu otvorí <strong>Aktualizácie → Plánované aktualizácie → Zobraziť záznam</strong> celý výstup aktualizátora a podradených skriptov.",
       "Zistené externé plány Proxmox VE Helper-Scripts sa zobrazia samostatne, aby bola viditeľná prekrývajúca sa automatizácia."
     ],
     "callout": "Pred zapnutím plánu otestujte každú vybranú metódu manuálne. Plánovaný príkaz nemôže odpovedať na interaktívne otázky."
diff --git a/web/messages/sk/docs/network/backup-restore.json b/web/messages/sk/docs/network/backup-restore.json
new file mode 100644
index 00000000..077fdfba
--- /dev/null
+++ b/web/messages/sk/docs/network/backup-restore.json
@@ -0,0 +1,110 @@
+{
+  "meta": {
+    "title": "Záloha a reštart rozhraní | Dokumentácia ProxMenux",
+    "description": "Ručné vytváranie snímok, prehliadanie a obnova záloh /etc/network/interfaces uložených v /var/backups/proxmenux/. Zahŕňa reštart sieťovej služby s potvrdením a rýchle zobrazenie aktuálnej konfigurácie.",
+    "ogTitle": "Záloha a reštart rozhraní | Dokumentácia ProxMenux",
+    "ogDescription": "Vytvorte snímku a obnovte sieťovú konfiguráciu Proxmox; reštartujte sieťovú službu s potvrdením."
+  },
+  "header": {
+    "title": "Záloha a reštart rozhraní",
+    "description": "Štyri nástroje pre /etc/network/interfaces: ručne vytvoriť snímku, zobraziť aktuálnu konfiguráciu, obnoviť predchádzajúcu zálohu s voliteľným náhľadom a reštartovať sieťovú službu s výslovným súhlasom. Používajú rovnaký záložný adresár ako opravy so sprievodcom.",
+    "section": "Sieť"
+  },
+  "intro": {
+    "title": "Čo to robí?",
+    "body": "Spravuje rovnaký adresár záloh ako opravy so sprievodcom (<code>/var/backups/proxmenux/</code>). Umožňuje vytvoriť ďalšiu snímku pred každou ručnou zmenou, prehliadať všetky existujúce zálohy a obnoviť ktorúkoľvek z nich — vždy s automaticky vytvorenou novou zálohou stavu pred obnovou ako druhou ochranou."
+  },
+  "shared": {
+    "heading": "Zdieľaný adresár zálohovania",
+    "intro": "Každá záloha vytvorená kdekoľvek v menu Sieť sa uloží na rovnaké miesto:",
+    "outro": "Názvy súborov sú časovo označené, zoradené podľa dátumu a nikdy neprepísané. Adresár je vytvorený pri prvom použití."
+  },
+  "show": {
+    "heading": "Zobraziť konfiguračný súbor siete",
+    "body": "Vypíše presný obsah <code>/etc/network/interfaces</code> do terminálu. Iba na čítanie. Užitočné na kontrolu pred zálohovaním alebo po obnove. Samostatný nástroj na porovnanie s predchádzajúcou zálohou neexistuje, takže najjednoduchšie je skontrolovať obsah aktuálneho súboru pohľadom."
+  },
+  "create": {
+    "heading": "Vytvoriť zálohu siete",
+    "body": "Skopíruje aktuálny <code>/etc/network/interfaces</code> do adresára záloh s novou časovou pečiatkou. To je všetko — bez analýzy, bez výziev, iba snímka.",
+    "whenTitle": "Kedy vytvoriť ručnú zálohu",
+    "whenBody": "Pred ručnou úpravou <code>/etc/network/interfaces</code>, pred inštaláciou balíka, ktorý môže meniť sieťový stack (napríklad NetworkManager alebo Open vSwitch), alebo pred zmenami hardvéru. Opravy so sprievodcom už vytvárajú snímky automaticky — táto možnosť je určená na <em>ručné</em> zásahy."
+  },
+  "restore": {
+    "heading": "Obnoviť sieť zo zálohy",
+    "intro": "Zobrazí všetky zálohy v <code>/var/backups/proxmenux/</code> od najnovšej po najstaršiu a prevedie vás obnovou s bezpečnostnými opatreniami:",
+    "steps": [
+      {
+        "title": "1. Vybrať zálohu",
+        "body": "Menu zobrazí každú zálohu podľa jej časovej pečiatky. Ak neexistujú žiadne zálohy, postup sa ukončí s jasným hlásením.",
+        "tone": "blue"
+      },
+      {
+        "title": "2. Nepovinný náhľad",
+        "body": "Ponúkne otvorenie vybranej zálohy v posúvateľnom zobrazení pred potvrdením obnovy. Predvolená odpoveď je Áno — na vzdialenom hostiteľovi tento krok nevynechávajte.",
+        "tone": "blue"
+      },
+      {
+        "title": "3. Záloha pred obnovou",
+        "body": "Pred prepísaním <code>/etc/network/interfaces</code> vytvorí <strong>ďalšiu</strong> zálohu aktuálneho stavu. Obnova je sama osebe deštruktívna akcia, preto nová snímka pred obnovou umožní návrat, ak bola vybraná záloha nesprávna.",
+        "tone": "amber"
+      },
+      {
+        "title": "4. Použiť obnovenie",
+        "body": "Kopíruje vybranú zálohu cez <code>/etc/network/interfaces</code>. Zmena súboru je na disku; stav živého jadra stále odráža predchádzajúcu konfiguráciu.",
+        "tone": "amber"
+      },
+      {
+        "title": "5. Nepovinný reštart",
+        "body": "Pýta sa, či má teraz spustiť <code>systemctl restart networking</code>. Odmietnutím odložíte použitie zmeny na ďalší reštart.",
+        "tone": "emerald"
+      }
+    ],
+    "autoBackupTitle": "Obnova automaticky vytvorí vlastnú zálohu",
+    "autoBackupBody": "Výber <em>Obnoviť sieť zo zálohy</em> vždy vytvorí novú snímku <em>aktuálnej</em> konfigurácie pred jej prepísaním. Ak obnovíte nesprávnu zálohu, najnovší súbor v <code>/var/backups/proxmenux/</code> obsahuje predchádzajúci stav."
+  },
+  "restart": {
+    "heading": "Reštartovať sieťovú službu",
+    "body": "Po potvrdení áno/nie spustí <code>systemctl restart networking</code>. Výsledok oznámi cez <code>msg_ok</code> / <code>msg_error</code>. Väčšina postupov v tomto menu ponúka vlastný reštart na konci. Táto možnosť slúži na reštart po ručnej úprave alebo po odmietnutí skôr ponúknutého reštartu.",
+    "warnTitle": "Zaručené krátke odpojenie; možné trvalé odpojenie",
+    "warnBody": "Reštart <code>networking</code> deaktivuje a znovu nastaví každé rozhranie deklarované v <code>/etc/network/interfaces</code>. Relácie SSH cez tieto rozhrania sa prerušia. Ak je nová konfigurácia neplatná, sieť sa neobnoví. Spustite to iba vtedy, keď:",
+    "warnItems": [
+      "Máte konzolu / IPMI / iKVM prístup pripravený, <em>alebo</em>",
+      "Ste fyzicky vedľa stroja, <em>alebo</em>",
+      "Práve ste úspešne obnovili overenú funkčnú konfiguráciu a chcete ju použiť."
+    ]
+  },
+  "manualRollback": {
+    "heading": "Ručné vrátenie zmien z konzoly",
+    "intro": "Ak nemôžete dosiahnuť menu (žiadne SSH, dialógové zrútenie, ...), ale môžete dosiahnuť konzolu, rollback je dva príkazy:",
+    "outro": "Ide o <em>rovnakú</em> operáciu, akú vykonáva menu, iba zadanú ručne. Ak sa <code>networking</code> stále nespustí, skontrolujte <code>journalctl -u networking -b</code> a zistite príčinu v syntaxi alebo ovládači."
+  },
+  "troubleshoot": {
+    "heading": "Riešenie problémov",
+    "noneTitle": "„Nenašli sa žiadne zálohy“ pri obnove",
+    "noneBody": "Adresár <code>/var/backups/proxmenux/</code> neexistuje alebo neobsahuje súbory <code>interfaces_backup_*</code>. Aspoň raz spustite <em>Vytvoriť zálohu siete</em> alebo opravu so sprievodcom, ktorá vytvorí zálohu automaticky. Overte to cez <code>ls /var/backups/proxmenux/</code>.",
+    "unreachTitle": "Reštart siete prejde, ale hostiteľ je stále nedosiahnuteľný",
+    "unreachBody": "Nová konfigurácia je nesprávna alebo nepriraďuje vašu IP adresu na správu. Obnovte predchádzajúci stav z konzoly (pozri vyššie). Potom použite <bridgeLink>analýzu mostov</bridgeLink> a <configLink>analýzu konfigurácie</configLink>, aby ste pred opätovným použitím pochopili príčinu.",
+    "emptyTitle": "Náhľad obnovy zobrazuje prázdny súbor",
+    "emptyBody": "Záložný súbor je prázdny (0 bajtov). Stane sa to, ak kopírovanie počas predchádzajúceho spustenia nepozorovane zlyhalo. Vyberte staršiu zálohu alebo znovu spustite <em>Vytvoriť zálohu siete</em>, ak je aktuálna konfigurácia funkčná."
+  },
+  "related": {
+    "heading": "Súvisiace",
+    "items": [
+      {
+        "label": "Analýza mostov a oprava so sprievodcom",
+        "href": "/docs/network/bridge-analysis",
+        "tail": " — Najbežnejší dôvod, prečo tu končí záloha."
+      },
+      {
+        "label": "Analýza konfigurácie a čistenie so sprievodcom",
+        "href": "/docs/network/config-analysis",
+        "tailRich": " — tiež automaticky zapisuje do <code>/var/backups/proxmenux/</code>."
+      },
+      {
+        "label": "Diagnostika",
+        "href": "/docs/network/diagnostics",
+        "tail": " — na overenie aktuálneho stavu po obnove."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sk/docs/network/bridge-analysis.json b/web/messages/sk/docs/network/bridge-analysis.json
new file mode 100644
index 00000000..c4f7388b
--- /dev/null
+++ b/web/messages/sk/docs/network/bridge-analysis.json
@@ -0,0 +1,132 @@
+{
+  "meta": {
+    "title": "Analýza mostov a oprava so sprievodcom | Dokumentácia ProxMenux",
+    "description": "Zistí mosty vmbrX s chýbajúcimi alebo neplatnými fyzickými portmi, typicky po opätovnom číslovaní PCI. Nahlási ich s návrhmi príkazov shellu a ponúkne opravu so sprievodcom v 5 krokoch s povinnou zálohou.",
+    "ogTitle": "Analýza mostov a oprava so sprievodcom | Dokumentácia ProxMenux",
+    "ogDescription": "Skontrolujte a opravte porty mostov Proxmox po zmenách hardvéru pomocou postupu so sprievodcom a bezpečným vrátením zmien."
+  },
+  "header": {
+    "title": "Analýza mostov a oprava so sprievodcom",
+    "description": "Skontroluje každý most vmbrX deklarovaný v /etc/network/interfaces, overí existenciu fyzických portov a pri chýbajúcich ponúkne opravu krok za krokom. Analýza je iba na čítanie; oprava vyžaduje súhlas, zobrazí náhľad a vytvorí zálohu.",
+    "section": "Sieť"
+  },
+  "intro": {
+    "title": "Čo to robí?",
+    "body": "Prečíta každý most v <code>/etc/network/interfaces</code>, skontroluje jeho riadok <code>bridge-ports</code> a overí, či každý deklarovaný port, napríklad <code>enp3s0</code>, existuje na hostiteľovi. Ak port chýba, navrhne náhradu a s výslovným súhlasom použije zmenu postupom <strong>záloha, náhľad, použitie, overenie</strong>."
+  },
+  "when": {
+    "heading": "Keď to potrebujete",
+    "intro": "Linux prideľuje predvídateľné názvy rozhraní podľa topológie PCI a poradia slotov. Viaceré udalosti ich môžu zmeniť, takže <code>/etc/network/interfaces</code> odkazuje na názvy, ktoré už neexistujú:",
+    "items": [
+      "Pridanie alebo odstránenie PCIe karty (NIC, GPU, a HBA, nosič NVMe).",
+      "Presun existujúcej karty na iný PCIe slot.",
+      "Aktualizácie BIOS / UEFI, ktoré znovu číslujú zariadenia PCI.",
+      "Migrácia zavádzacieho disku na iný hardvér."
+    ],
+    "outro": "Po ďalšom štarte sa most pokúsi pripojiť k portu, ktorý už neexistuje, neaktivuje sa a hostiteľ stratí sieťové pripojenie. <link>Trvalé názvy rozhraní</link> zabránia opakovaniu tohto problému. Ak ste už stratili prístup, táto stránka opisuje postup obnovy."
+  },
+  "bigPicture": {
+    "heading": "Celkový prehľad",
+    "diagram1": {
+      "arrowLabel": "krok 1",
+      "nodes": {
+        "sourceLabel": "/etc/network/interfaces",
+        "sourceDetail": "auto vmbr0\niface vmbr0 inet static\n  bridge-ports enp3s0",
+        "bridgeLabel": "Analyzovať (iba na čítanie)",
+        "bridgeDetail": "ip link show enp3s0\n→ neexistuje",
+        "targetLabel": "Správa + návrh",
+        "targetDetail": "❌ enp3s0: NENÁJDENÉ\nNahradiť za: eno1\n(zatiaľ bez zmien)"
+      }
+    },
+    "diagram2": {
+      "arrowLabel": "aplikovať so zálohou",
+      "nodes": {
+        "sourceLabel": "Oprava so sprievodcom",
+        "sourceDetail": "1. Záloha\n2. Zobraziť aktuálny stav\n3. Náhľad zmien\n4. Použiť\n5. Overiť",
+        "targetLabel": "/etc/network/interfaces (nový)",
+        "targetDetail": "auto vmbr0\niface vmbr0 inet static\n  bridge-ports eno1"
+      }
+    }
+  },
+  "step1": {
+    "heading": "Krok 1: analýza (iba na čítanie)",
+    "intro": "Po výbere <strong>Analyzovať konfiguráciu mostov</strong> sa nástroj okamžite zastaví, ak hostiteľ nepoužíva klasický stack Debian/Proxmox. Inak prejde každý most a nahlási:",
+    "items": [
+      "Názov mosta, aktuálny stav (UP / DOWN) a pridelená IP adresa.",
+      "Každý deklarovaný port a či v súčasnosti existuje (<code>ip link show &lt;port&gt;</code>).",
+      "Pre každý neplatný port: navrhovaná náhrada (prvé dostupné fyzické rozhranie) plus presný <code>sed</code> príkaz na manuálne použitie.",
+      "Mosty bez riadka <code>bridge-ports</code> a osirelé položky <code>auto</code> bez zodpovedajúceho bloku <code>iface</code>."
+    ],
+    "readonlyTitle": "Záruka režimu iba na čítanie",
+    "readonlyBody": "Až do tohto bodu skript nespustil žiadny príkaz meniaci systém. Analýzu môžete nechať otvorenú, skopírovať navrhnuté príkazy <code>sed</code> a použiť ich ručne, ak to uprednostňujete. Alebo prijmite nasledujúcu výzvu na spustenie opravy so sprievodcom."
+  },
+  "step2": {
+    "heading": "Krok 2: oprava so sprievodcom (5 krokov)",
+    "intro": "Spustí sa iba po prijatí výzvy na konci analýzy. Každý krok zobrazí plánovanú akciu a pred pokračovaním vyžiada potvrdenie.",
+    "steps": [
+      {
+        "title": "1. Bezpečnostná záloha",
+        "body": "Skopíruje <code>/etc/network/interfaces</code> do <code>/var/backups/proxmenux/interfaces_backup_&lt;TIMESTAMP&gt;</code>. Presnú cestu zálohy zobrazí pred kopírovaním aj po ňom spolu s príkazom na vrátenie zmien.",
+        "tone": "blue"
+      },
+      {
+        "title": "2. Preskúmanie aktuálnej konfigurácie",
+        "body": "Otvorí aktuálny <code>/etc/network/interfaces</code> v posúvateľnom dialógu, aby ste presne videli, čo sa zmení.",
+        "tone": "blue"
+      },
+      {
+        "title": "3. Náhľad navrhovaných zmien",
+        "body": "Presne vypíše dotknuté mosty a plánované náhrady portov. Ak už oprava nie je potrebná, pretože sa port medzi kontrolami znovu objavil, postup sa ukončí hlásením <em>„Nie sú potrebné žiadne zmeny.“</em>",
+        "tone": "blue"
+      },
+      {
+        "title": "4. Použiť zmeny",
+        "body": "Pre každý postihnutý most beží <code>sed -i \"/iface $bridge/,/bridge-ports/ s/bridge-ports.*/bridge-ports $new_ports/\"</code> proti <code>/etc/network/interfaces</code>. Ak most nemal k dispozícii platnú náhradu, substitúcia sa preskočí a zaznamená v kroku 5.",
+        "tone": "amber"
+      },
+      {
+        "title": "5. Overovanie",
+        "body": "Znovu prečíta súbor a potvrdí, že nový port každého mosta existuje. Vypíše príkaz na vrátenie zmien (<code>cp &lt;backup&gt; /etc/network/interfaces</code>). Nakoniec ponúkne <strong>Reštartovať sieť</strong> — prijmite iba vtedy, ak máte náhradný prístup cez konzolu.",
+        "tone": "emerald"
+      }
+    ],
+    "restartTitle": "Reštart siete ≠ bezpečné vrátenie zmien",
+    "restartBody": "Oprava sa zapíše na disk bez ohľadu na reštart služby. <code>systemctl restart networking</code> použije zmenu <em>teraz</em>, čo môže prerušiť reláciu SSH, ak je nový port nesprávny. Ak reštart odmietnete, zmena sa aj tak prejaví pri ďalšom štarte. Najprv overte novú konfiguráciu alebo ju vráťte zobrazeným príkazom."
+  },
+  "edits": {
+    "heading": "Čo sa edituje (presne)",
+    "body": "Iba riadok <code>bridge-ports</code> každého dotknutého mosta. Ostatné direktívy (<code>address</code>, <code>netmask</code>, <code>gateway</code>, <code>bridge-stp</code>, …) zostávajú nezmenené. Skript v tomto postupe nevytvára ani neodstraňuje bloky <code>iface</code> — to je úloha <link>analýzy konfigurácie &amp; čistenia</link>."
+  },
+  "troubleshoot": {
+    "heading": "Riešenie problémov",
+    "unsupportedTitle": "Analýza sa zastaví s hlásením „Nepodporovaný sieťový stack“",
+    "unsupportedBody": "Hostiteľ používa netplan, systemd-networkd alebo NetworkManager. Nástroj podporuje iba <code>/etc/network/interfaces</code>. Najprv prepnite hostiteľa na klasický stack alebo upravte konfiguráciu natívnymi nástrojmi správcu (napríklad <code>netplan apply</code>).",
+    "noSuggestTitle": "Pre neplatný port sa nevypíše žiadny návrh",
+    "noSuggestBody": "Hostiteľ nemá žiadne voľné fyzické rozhrania: všetky sú už v inom moste alebo neexistujú. Analýza preto navrhne <code>bridge-ports none</code>, aby sa most mohol aspoň aktivovať bez portu. Pred opätovným spustením pridajte sieťovú kartu alebo ručne presuňte porty medzi mostmi.",
+    "stillDownTitle": "Oprava sa skončila, ale most je stále dole",
+    "stillDownBody": "<code>sed</code> aktualizoval súbor, ale <code>systemctl restart networking</code> bol odmietnutý. Po overení novej konfigurácie ho spustite ručne alebo reštartujte systém. Ak bol reštart prijatý a most je stále DOWN, overte existenciu nového portu cez <code>ip link show</code> a skontrolujte <code>journalctl -u networking</code> pre skutočnú chybu: odpojený kábel, nevyjednané spojenie alebo port už patriaci do iného mosta.",
+    "lostSshTitle": "Stratila som prístup SSH hneď po reštarte siete",
+    "lostSshIntro": "Použite konzolu / IPMI / iKVM na dosiahnutie hostiteľa. Obnoviť zálohu:",
+    "lostSshOutro": "Potom znovu spustite analýzu z konzoly a zistite, prečo návrh nefungoval, typicky preto, že náhradný port nie je zapojený."
+  },
+  "related": {
+    "heading": "Súvisiace",
+    "items": [
+      {
+        "label": "Trvalé názvy rozhraní",
+        "href": "/docs/network/persistent-names",
+        "tail": " — priradí názvy k MAC adresám, aby sa problém neopakoval."
+      },
+      {
+        "label": "Analýza konfigurácie a čistenie so sprievodcom",
+        "href": "/docs/network/config-analysis",
+        "tailRich": " — Pre osirotené <code>iface</code> bloky (druhá polovica rovnakého problému)."
+      },
+      {
+        "label": "Záloha a reštart rozhraní",
+        "href": "/docs/network/backup-restore",
+        "tail": " — ručné snímky a prehliadanie záloh na obnovu."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sk/docs/network/config-analysis.json b/web/messages/sk/docs/network/config-analysis.json
new file mode 100644
index 00000000..819ef52f
--- /dev/null
+++ b/web/messages/sk/docs/network/config-analysis.json
@@ -0,0 +1,122 @@
+{
+  "meta": {
+    "title": "Analýza konfigurácie a čistenie so sprievodcom | Dokumentácia ProxMenux",
+    "description": "Zistí bloky iface v /etc/network/interfaces odkazujúce na fyzické sieťové karty, ktoré už nie sú na hostiteľovi. Nahlási ich a ponúkne odstránenie so sprievodcom v 5 krokoch s povinnou zálohou a náhľadom každého bloku.",
+    "ogTitle": "Analýza konfigurácie a čistenie so sprievodcom | Dokumentácia ProxMenux",
+    "ogDescription": "Nájdite a odstráňte osirelé bloky rozhraní, ktoré zostali po zmenách hardvéru, s úplným náhľadom a možnosťou vrátenia zmien."
+  },
+  "header": {
+    "title": "Analýza konfigurácie a čistenie so sprievodcom",
+    "description": "Prejde každý blok iface v /etc/network/interfaces a overí, či príslušná fyzická sieťová karta stále existuje. Nahlási osirelé bloky po zmenách hardvéru a ponúkne odstránenie so sprievodcom, zálohou, náhľadom a potvrdením každého bloku.",
+    "section": "Sieť"
+  },
+  "intro": {
+    "title": "Čo to robí?",
+    "body": "Identifikuje deklarácie <code>iface</code>, ktorých sieťová karta už nie je na hostiteľovi, typicky po výmene alebo odobratí karty. Potom ponúkne čistenie so sprievodcom, ktoré odstráni <em>iba</em> osirelé bloky, so zálohou, náhľadom každej sekcie a výslovným záverečným potvrdením."
+  },
+  "differs": {
+    "heading": "Ako sa líši od analýzy mosta",
+    "headerAspect": "Aspekt",
+    "headerBridge": "Analýza mosta",
+    "headerConfig": "Analýza konfigurácie",
+    "rows": [
+      {
+        "aspect": "Pozerá sa na",
+        "bridge": "Mosty (<code>vmbrX</code>) a ich riadok <code>bridge-ports</code>",
+        "config": "Každý blok <code>iface</code> okrem loopbacku, mostov a bondov"
+      },
+      {
+        "aspect": "Zisťuje",
+        "bridge": "Mosty odkazujúce na neexistujúci port",
+        "config": "Samostatné bloky rozhrania pre NIC, ktoré neexistujú"
+      },
+      {
+        "aspect": "Oprava",
+        "bridge": "Nahrádza názov portu v <code>bridge-ports</code>",
+        "config": "Odstráni celý blok <code>iface</code>"
+      },
+      {
+        "aspect": "Nezahŕňa",
+        "bridge": "Nič, každý most je analyzovaný",
+        "config": "Mosty (<code>vmbrX</code>) a bondy (<code>bondX</code>) sa vždy zachovajú, pretože sú virtuálne a ich neprítomnosť počas štartu môže byť normálna"
+      }
+    ],
+    "outro": "V praxi často použijete oba nástroje v tomto poradí: najprv <strong>analýzu konfigurácie</strong> na odstránenie osirelých blokov, potom <link>analýzu mostov</link> na nové priradenie mostov, ktoré používali odstránené rozhranie."
+  },
+  "step1": {
+    "heading": "Krok 1: analýza (iba na čítanie)",
+    "intro": "Okamžite sa zastaví, ak hostiteľ nepoužíva klasický sieťový stack. Inak zobrazí všetky nakonfigurované rozhrania okrem loopbacku a ich stav:",
+    "virtTitle": "Virtuálne rozhrania sú chránené",
+    "virtBody": "Mosty (<code>vmbrX</code>) a bondy (<code>bondX</code>) sú virtuálne konštrukcie. Pri kontrole môžu oprávnene chýbať, napríklad most bez portov. Analýza preto nikdy nenavrhuje ich odstránenie, iba odstránenie fyzických sieťových kariet."
+  },
+  "step2": {
+    "heading": "Krok 2: čistenie so sprievodcom (5 krokov)",
+    "intro": "Spustí sa iba po prijatí výzvy na konci analýzy. Každý krok vyžaduje potvrdenie; zrušením v ktoromkoľvek bode sa postup ukončí bez zápisu.",
+    "steps": [
+      {
+        "title": "1. Bezpečnostná záloha",
+        "body": "Skopíruje <code>/etc/network/interfaces</code> do <code>/var/backups/proxmenux/interfaces_backup_&lt;TIMESTAMP&gt;</code>. Cestu zobrazí pred kopírovaním aj po ňom.",
+        "tone": "blue"
+      },
+      {
+        "title": "2. Potvrdenie zoznamu odstránenia",
+        "body": "Presne vypíše bloky fyzických rozhraní určené na odstránenie. Ak sa karty medzi analýzou a čistením znovu objavia, napríklad po opätovnom zasunutí, postup sa ukončí hlásením <em>„Čistenie nie je potrebné.“</em>",
+        "tone": "blue"
+      },
+      {
+        "title": "3. Náhľad presných blokov",
+        "body": "Otvorí rolovací pohľad na každý blok <code>iface</code>, ktorý by bol vymazaný, doslovne zo súboru. Toto je chvíľa, kedy si môžete všimnúť napríklad zaujímavý <code>up</code> hák, ktorý chcete zachovať.",
+        "tone": "blue"
+      },
+      {
+        "title": "4. Použiť odstránenie",
+        "body": "Pre každé sirotské rozhranie beží <code>sed -i \"/^iface $iface/,/^$/d\" /etc/network/interfaces</code>. To odstráni zo zodpovedajúcej línie <code>iface</code> až do ďalšieho prázdneho riadku.",
+        "tone": "amber"
+      },
+      {
+        "title": "5. Overovanie",
+        "body": "Opätovne načíta súbor, vypíše, čo bolo odstránené, a znova skontroluje zostávajúce rozhrania. Vytlačí príkaz na vrátenie. <strong>nereštartuje</strong> automaticky sieť – odstránenie nepoužívaného bloku je bezpečné použiť pri ďalšom reštarte a nedotýka sa aktívneho stavu.",
+        "tone": "emerald"
+      }
+    ],
+    "noRestartTitle": "Nereštartuje sieť automaticky",
+    "noRestartBody": "Na rozdiel od opravy mostov čistenie neponúka reštart služby. Odstránenie nepoužívaného bloku rozhrania okamžite neovplyvní bežiacu konfiguráciu, takže reštart nie je potrebný a zbytočne by ohrozil pripojenie. Zmena sa prejaví pri ďalšom ručnom <code>systemctl restart networking</code> alebo pri ďalšom reštarte systému."
+  },
+  "caveats": {
+    "heading": "Dôležité upozornenia",
+    "boundaryTitle": "Hranica bloku je prvý prázdny riadok",
+    "boundaryBody": "Vzor <code>sed</code> odstráni obsah od <code>iface &lt;name&gt;</code> po ďalší prázdny riadok. Ak v <code>/etc/network/interfaces</code> chýbajú prázdne riadky medzi blokmi, čo je zriedkavé, ale možné po ručných úpravách, môže sa odstrániť aj nasledujúci blok. Preto je <strong>krok 3 povinný</strong>: pred potvrdením skontrolujte náhľad.",
+    "tandemTitle": "Osirelý blok iface používaný mostom sa zistí tu, nie pri analýze mostov",
+    "tandemBody": "Ak <code>vmbr0</code> deklaruje <code>bridge-ports enp3s0</code> a <code>enp3s0</code> má aj vlastný blok <code>iface enp3s0 inet manual</code>, odstránenie <code>enp3s0</code> tu ponechá neplatný odkaz v <code>vmbr0</code>. Po čistení spustite <link>analýzu mostov</link> na zmenu priradenia alebo odstránenie portu mosta. Oba postupy sú navrhnuté na spoločné použitie."
+  },
+  "troubleshoot": {
+    "heading": "Riešenie problémov",
+    "notFoundTitle": "Analýza zobrazuje moju novú sieťovú kartu ako „NENÁJDENÁ“",
+    "notFoundBody": "Jadro vidí zariadenie pod iným názvom, než je v súbore. Spustite <code>ip link show</code> a zistite skutočný názov. Presne v takomto prípade by <link>trvalé názvy rozhraní</link> zabránili problému v budúcnosti.",
+    "tooMuchTitle": "Čistenie odstránilo príliš veľa, aj blok, ktorý som chcel zachovať",
+    "tooMuchBody": "Obnovte stav zo zálohy uvedenej v kroku 5:",
+    "tooMuchOutro": "Pred opätovným spustením čistenia ručne upravte súbor a pridajte prázdny riadok medzi bloky alebo problematický blok odstráňte ručne.",
+    "bridgeBreakTitle": "Most prestane pracovať po vyčistení.",
+    "bridgeBreakBody": "Most používal port, ktorého blok <code>iface</code> sa práve odstránil. Spustite <link>analýzu mostov</link> a návrh priradí most k existujúcemu fyzickému rozhraniu."
+  },
+  "related": {
+    "heading": "Súvisiace",
+    "items": [
+      {
+        "label": "Analýza mostov a oprava so sprievodcom",
+        "href": "/docs/network/bridge-analysis",
+        "tail": " — prirodzený ďalší krok po čistení."
+      },
+      {
+        "label": "Trvalé názvy rozhraní",
+        "href": "/docs/network/persistent-names",
+        "tail": " — zabraňuje hromadeniu osirelých blokov po každej zmene hardvéru."
+      },
+      {
+        "label": "Záloha a reštart rozhraní",
+        "href": "/docs/network/backup-restore",
+        "tail": " — ručné snímky a prehliadanie záloh na obnovu."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sk/docs/network/diagnostics.json b/web/messages/sk/docs/network/diagnostics.json
new file mode 100644
index 00000000..1381afe4
--- /dev/null
+++ b/web/messages/sk/docs/network/diagnostics.json
@@ -0,0 +1,94 @@
+{
+  "meta": {
+    "title": "Diagnostika | Dokumentácia ProxMenux",
+    "description": "Tri jednorazové diagnostické kontroly iba na čítanie: Zobraziť smerovaciu tabuľku, Test pripojenia a Pokročilá diagnostika. Iba kontrola — nikdy nezapisuje do /etc/network/interfaces ani nespúšťa príkazy meniace systém, s jedinou výslovnou výnimkou: úplné odstránenie zisteného NetworkManager vyžaduje váš súhlas.",
+    "ogTitle": "Diagnostika | Dokumentácia ProxMenux",
+    "ogDescription": "Sieťová diagnostika iba na čítanie pre hostiteľa Proxmoxu: smerovanie, dosiahnuteľnosť, pokročilé štatistiky."
+  },
+  "header": {
+    "title": "Diagnostika",
+    "description": "Tri jednorazové kontroly aktuálneho stavu siete iba na čítanie: smerovacia tabuľka, test pripojenia a pokročilé štatistiky. Žiadna nezapisuje do /etc/network/interfaces — bezpečné použitie kedykoľvek, aj cez SSH. Pre interaktívne sledovanie v reálnom čase pozrite Nástroje na sledovanie v reálnom čase.",
+    "section": "Sieť"
+  },
+  "intro": {
+    "title": "Čo to robí?",
+    "body": "Zobrazuje informácie o smerovaní, dosiahnuteľnosti a súhrnných štatistikách <strong>bez akýchkoľvek zmien</strong>. Overte ním správne fungovanie siete alebo odhaľte duplicitné IP adresy. Na nepretržité sledovanie prevádzky pozrite <monitoringLink>Nástroje na sledovanie v reálnom čase</monitoringLink>; na zobrazenie nespracovaného konfiguračného súboru pozrite <backupLink>Záloha a reštart rozhraní</backupLink>."
+  },
+  "routing": {
+    "heading": "Zobraziť smerovaciu tabuľku",
+    "body": "Zobrazí všetky trasy aktuálne používané jadrom (<code>ip route show</code>) a zvýrazní predvolenú bránu. Umožňuje overiť, že prevádzka do internetu odchádza očakávaným rozhraním a žiadne zvyšné trasy nemajú prednosť."
+  },
+  "connectivity": {
+    "heading": "Otestovať pripojenie",
+    "intro": "Postupne odošle na každý z troch cieľov dve sondy ICMP a vypíše výsledky. Potom spustí <code>nslookup google.com</code> na overenie prekladu DNS nezávisle od ICMP.",
+    "headerTest": "Skúška",
+    "headerTarget": "Cieľ",
+    "headerConfirms": "Čo potvrdzuje",
+    "rows": [
+      {
+        "test": "Google DNS",
+        "target": "8.8.8.8",
+        "confirms": "Externá dosiahnuteľnosť cez známu IP adresu anycast"
+      },
+      {
+        "test": "Cloudflare DNS",
+        "target": "1.1.1.1",
+        "confirms": "Nezávislé druhé stanovisko, ak Google blokuje ICMP"
+      },
+      {
+        "test": "Brána",
+        "target": "(štandardná trasa)",
+        "confirms": "L2 / L3 pripojenie k miestnemu routeru"
+      },
+      {
+        "test": "Preklad DNS",
+        "target": "google.com",
+        "confirms": "DNS server je dosiahnuteľný a odpovedá"
+      }
+    ],
+    "readingTitle": "Čítanie výsledku",
+    "readingBody": "Ak test brány prejde, ale verejné servery DNS neodpovedajú, máte lokálne pripojenie, no nemáte internet — skontrolujte pripojenie brány smerom k poskytovateľovi. Ak preklad DNS zlyhá, ale ping na <code>8.8.8.8</code> funguje, problém je v resolveri, nie v sieti: skontrolujte <code>/etc/resolv.conf</code>."
+  },
+  "advanced": {
+    "heading": "Pokročilá diagnostika",
+    "intro": "Zhromažďuje štatistiky celej siete a vykonáva sériu kontrol bežných problémov. Hlási počet aktívnych pripojení, načúvajúce porty a celkový počet rozhraní a výslovne upozorňuje na dve nevhodné konfigurácie:",
+    "items": [
+      "<strong>NetworkManager beží na hostiteľovi Proxmox.</strong> NetworkManager a <code>ifupdown</code> systému Proxmox sú v konflikte: oba sa pokúšajú spravovať rozhrania, takže mosty opakovane menia stav alebo sa nedajú aktivovať. Ak sa zistí NetworkManager, nástroj ponúkne interaktívne potvrdenie jeho zastavenia, zakázania a úplného odstránenia (ide o <em>jedinú</em> diagnostiku, ktorá môže meniť systém, a to iba po výslovnom súhlase).",
+      "<strong>Duplicitné IP adresy na rôznych rozhraniach.</strong> Dve rozhrania s rovnakou IPv4 adresou spôsobujú občasné výpadky pripojenia, ktoré sa zvnútra VM veľmi ťažko diagnostikujú. Zisťujú sa cez <code>ip -4 addr show | sort | uniq -d</code>."
+    ],
+    "nmTitle": "Výzva pre NetworkManager je tu jedinou akciou, ktorá môže meniť systém",
+    "nmBody": "Všetky ostatné kontroly pokročilej diagnostiky sú iba na čítanie. Odstránenie NetworkManager vyžaduje potvrdenie áno/nie a spustí <code>systemctl stop / disable</code> + <code>apt-get purge -y network-manager</code>. Ak odmietnete, nič sa nezmení."
+  },
+  "troubleshoot": {
+    "heading": "Riešenie problémov",
+    "gwTitle": "Test pripojenia hlási zlyhanie brány, ale hostiteľ má prístup na internet",
+    "gwBody": "Niektoré smerovače neodpovedajú na ICMP na internom rozhraní, aj keď správne preposielajú prevádzku. V konzole skúste <code>traceroute 8.8.8.8</code>: ak je druhým skokom váš poskytovateľ a test verejného DNS prešiel, brána funguje aj napriek neúspešnému pingu.",
+    "dupTitle": "Pokročilá diagnostika stále hlási duplicitné IP adresy aj po odstránení jednej z nich",
+    "dupBody": "Kontrola skúma aktuálny stav jadra, nie konfiguračný súbor. Overte ho príkazom <code>ip -4 addr show</code>; ak je duplicitná adresa stále prítomná, niektoré rozhranie ju stále používa. Pomocou <code>ip addr del &lt;IP&gt;/&lt;mask&gt; dev &lt;iface&gt;</code> ju odstráňte z aktuálneho stavu a potom upravte <code>/etc/network/interfaces</code>, ak je nastavená aj natrvalo."
+  },
+  "related": {
+    "heading": "Súvisiace",
+    "items": [
+      {
+        "label": "Nástroje na sledovanie v reálnom čase",
+        "href": "/docs/network/monitoring",
+        "tail": " — Interaktívne iftop / iptraf-ng / iperf3 spúšťače."
+      },
+      {
+        "label": "Analýza mostov a oprava so sprievodcom",
+        "href": "/docs/network/bridge-analysis",
+        "tail": " — Keď vmbrX chýba fyzický port."
+      },
+      {
+        "label": "Analýza konfigurácie a čistenie so sprievodcom",
+        "href": "/docs/network/config-analysis",
+        "tail": " — keď je stará sieťová karta stále deklarovaná, ale už nie je prítomná."
+      },
+      {
+        "label": "Záloha a reštart rozhraní",
+        "href": "/docs/network/backup-restore",
+        "tail": " — na vytvorenie snímky konfigurácie pred každou zmenou."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sk/docs/network/index.json b/web/messages/sk/docs/network/index.json
new file mode 100644
index 00000000..871acbef
--- /dev/null
+++ b/web/messages/sk/docs/network/index.json
@@ -0,0 +1,107 @@
+{
+  "meta": {
+    "title": "Správa siete Proxmox — Mosty, bondy, diagnostika, oprava | ProxMenux",
+    "description": "Diagnostika iba na čítanie, analýzy s následnými návrhmi a opravy so sprievodcom pre sieťový stack Debian / Proxmox (/etc/network/interfaces). Skontrolujte mosty a bondy, spustite nástroje na sledovanie v reálnom čase, nastavte trvalé názvy rozhraní, zálohujte konfiguráciu a bezpečne reštartujte sieť — s povinnými zálohami a náhľadmi jednotlivých krokov.",
+    "ogTitle": "Správa siete Proxmox — Mosty, bondy, diagnostika, oprava",
+    "ogDescription": "Diagnostika, analýza a opravy sieťového stacku Proxmox so sprievodcom, povinnými zálohami a náhľadmi jednotlivých krokov.",
+    "twitterTitle": "Správa siete Proxmox | ProxMenux",
+    "twitterDescription": "Mosty, bondy, diagnostika a opravy sieťového stacku Proxmox so sprievodcom a povinnými zálohami."
+  },
+  "header": {
+    "title": "Správa siete",
+    "description": "Diagnostika iba na čítanie, analytické správy s následnými návrhmi a opravy so sprievodcom pre klasický sieťový stack Debian/Proxmox. Každý deštruktívny postup najprv vytvorí zálohu a pred použitím zobrazí presné zmeny.",
+    "section": "Sieť"
+  },
+  "intro": {
+    "title": "Na čo je toto menu",
+    "body": "Skontrolujte, diagnostikujte a v prípade potreby opravte sieťovú konfiguráciu hostiteľa Proxmox bez straty vzdialeného prístupu. Nástroje sa riadia jednou zásadou: <strong>najprv prečítať, potom navrhnúť a zmeny použiť iba s výslovným súhlasom a bezpečnostnou zálohou</strong>. Tlačidlo „Automaticky opraviť všetko“ neexistuje."
+  },
+  "openingMenu": {
+    "heading": "Otvorenie menu",
+    "intro": "V hlavnom menu ProxMenux vyberte <strong>Sieť</strong>. Zobrazí sa toto:",
+    "imageAlt": "Menu Správa siete s možnosťami diagnostiky, sledovania, analýzy, opráv, trvalých názvov a zálohovania"
+  },
+  "safety": {
+    "heading": "Bezpečnostný model",
+    "body": "Úprava sieťovej konfigurácie vzdialeného hostiteľa Proxmox je jedným z najjednoduchších spôsobov, ako stratiť prístup. ProxMenux to zohľadňuje pri každej akcii. Nástroje sú rozdelené do troch úrovní správania — vyberte kartu, ktorá zodpovedá vášmu zámeru:"
+  },
+  "tiers": {
+    "readOnly": {
+      "title": "Iba na čítanie",
+      "body": "Iba kontrola. Za žiadnych okolností nemôže meniť systém.",
+      "items": [
+        "Smerovacia tabuľka, testy pripojenia, pokročilé štatistiky",
+        "Sledovanie sieťovej prevádzky v reálnom čase (iftop, iptraf-ng)",
+        "Test priepustnosti (iperf3)"
+      ]
+    },
+    "analyze": {
+      "title": "Analyzovať, potom navrhnúť",
+      "body": "Zistí problémy, vypíše správu s navrhovanými príkazmi shellu a zastaví sa. Sami sa rozhodnete, či potom spustíte opravu so sprievodcom.",
+      "items": [
+        "Analýza konfigurácie mosta",
+        "Analýza konfigurácie siete"
+      ]
+    },
+    "apply": {
+      "title": "Aplikovať so zálohou",
+      "body": "Mení systém. Vždy najprv vytvorí zálohu dotknutého súboru s časovou pečiatkou a pred zápisom zobrazí náhľad.",
+      "items": [
+        "Trvalé názvy rozhraní (súbory .link)",
+        "Ručné zálohovanie, obnovenie a reštart služby"
+      ]
+    }
+  },
+  "classicTitle": "Iba klasický sieťový stack",
+  "classicBody": "Každá funkcia analýzy a opravy pred zásahom skontroluje aktívneho správcu siete. Ak hostiteľ používa <strong>netplan</strong>, <strong>systemd-networkd</strong> alebo <strong>NetworkManager</strong>, nástroj sa ihneď zastaví s jasným hlásením. Menu podporuje iba klasickú sieťovú konfiguráciu Debian/Proxmox v <code>/etc/network/interfaces</code>. Je to zámerné: úprava súboru netplan podľa pravidiel pre <code>ifupdown</code> by mohla konfiguráciu nepozorovane poškodiť.",
+  "backups": {
+    "heading": "Kam sa ukladajú zálohy",
+    "intro": "Každá oprava so sprievodcom, obnova alebo ručné zálohovanie zapíše kópiu <code>/etc/network/interfaces</code> s časovou pečiatkou do <code>/var/backups/proxmenux/</code>:",
+    "rollbackIntro": "Na ručné obnovenie predchádzajúceho stavu z konzoly:"
+  },
+  "readOnlySection": {
+    "heading": "Kontrola len na čítanie",
+    "body": "Východiskový bod, keď niečo nefunguje správne. Iba kontrola — nikdy nezapisuje do <code>/etc/network/interfaces</code> ani nespúšťa príkazy meniace systém, s jedinou výslovnou výnimkou: úplné odstránenie zisteného NetworkManager vyžaduje váš súhlas. Bezpečné použitie cez SSH kedykoľvek.",
+    "options": [
+      {
+        "title": "Diagnostika",
+        "description": "Tri jednorazové kontroly iba na čítanie: Zobraziť smerovaciu tabuľku, Test pripojenia a Pokročilá diagnostika. Iba kontrola — nikdy nezapisuje do systému."
+      },
+      {
+        "title": "Nástroje na sledovanie v reálnom čase",
+        "description": "Tri interaktívne spúšťače: iftop (šírka pásma v reálnom čase pre každú dvojicu hostiteľov), iptraf-ng (sledovanie prevádzky vo viacerých režimoch) a iperf3 (test šírky pásma, režim server / klient)."
+      }
+    ]
+  },
+  "analyzeSection": {
+    "heading": "Analyzovať, potom navrhnúť",
+    "body": "Používajú sa, keď kontrola alebo skutočný výpadok poukazuje na problém konfigurácie. Každý nástroj prejde príslušnú časť <code>/etc/network/interfaces</code>, vypíše podrobnú správu s presným príkazom shellu na opravu každého zistenia a <strong>zastaví sa</strong>. Ak potom prijmete voliteľnú opravu so sprievodcom, pred každou zmenou sa vytvorí záloha a zmena sa zobrazí pred zápisom.",
+    "options": [
+      {
+        "title": "Analýza mostov a oprava so sprievodcom",
+        "description": "Zistí mosty vmbrX s chýbajúcimi alebo neplatnými portmi, typicky po opätovnom číslovaní zariadení PCI. Najprv zobrazí správu a opravu vykoná iba po prijatí postupu so sprievodcom v 5 krokoch."
+      },
+      {
+        "title": "Analýza konfigurácie a čistenie so sprievodcom",
+        "description": "Nájde fyzické rozhrania deklarované v /etc/network/interfaces, ktoré už neexistujú — osirelé konfigurácie po zmenách hardvéru. Nahlási ich a ponúkne odstránenie so sprievodcom."
+      }
+    ]
+  },
+  "applySection": {
+    "heading": "Aplikovať so zálohou",
+    "body": "Tieto nástroje zo svojej podstaty zapisujú na disk. Každý pred zápisom vytvorí zálohu dotknutého súboru s časovou pečiatkou. Deštruktívne možnosti, ako obnova a reštart, vyžadujú výslovné potvrdenie áno/nie. <em>Trvalé názvy rozhraní</em> sa prejavia až pri ďalšom reštarte, nie okamžite, takže ich nastavenie možno bezpečne naplánovať aj na vzdialenom hostiteľovi.",
+    "options": [
+      {
+        "title": "Trvalé názvy rozhraní",
+        "description": "Priradí názvy rozhraní (eno1, enp3s0, …) k MAC adresám pomocou súborov .link služby systemd. Názvy zostanú zachované pri zmene slotov PCI, aktualizáciách jadra aj pridávaní alebo odoberaní iných sieťových kariet."
+      },
+      {
+        "title": "Záloha a reštart rozhraní",
+        "description": "Ručné vytvorenie snímky /etc/network/interfaces, prehliadanie a obnova predchádzajúcich záloh, zobrazenie aktuálnej konfigurácie a reštart sieťovej služby podľa potreby."
+      }
+    ]
+  },
+  "consoleTitle": "Pripravte si prístup ku konzole",
+  "consoleSubTitle": "Pred akoukoľvek opravou na vzdialenom hostiteľovi",
+  "consoleBody": "Ak ste pripojení cez SSH a máte iba jednu cestu k hostiteľovi, pred zmenami siete si pripravte náhradný prístup: fyzickú konzolu / IPMI / iKVM alebo iný počítač v rovnakej LAN. Opravy so sprievodcom sú bezpečné a vždy ponúkajú príkaz na vrátenie zmien, ale nesprávne nakonfigurovaný most alebo prerušené spojenie vás aj tak môže pripraviť o prístup, kým sa nedostanete ku konzole."
+}
diff --git a/web/messages/sk/docs/network/monitoring.json b/web/messages/sk/docs/network/monitoring.json
new file mode 100644
index 00000000..e46d34d3
--- /dev/null
+++ b/web/messages/sk/docs/network/monitoring.json
@@ -0,0 +1,136 @@
+{
+  "meta": {
+    "title": "Nástroje na sledovanie v reálnom čase | Dokumentácia ProxMenux",
+    "description": "Tri interaktívne spúšťače nástrojov na sledovanie siete: iftop (šírka pásma v reálnom čase pre každú dvojicu hostiteľov), iptraf-ng (sledovanie prevádzky vo viacerých režimoch) a iperf3 (test šírky pásma, režim server / klient). Každý sa nainštaluje pri prvom použití.",
+    "ogTitle": "Nástroje na sledovanie v reálnom čase | Dokumentácia ProxMenux",
+    "ogDescription": "Interaktívne monitorovanie siete a testovanie šírky pásma pre Proxmox host: iftop, iptraf-ng, iperf3."
+  },
+  "header": {
+    "title": "Nástroje na sledovanie v reálnom čase",
+    "description": "Tri interaktívne spúšťače na sledovanie siete v reálnom čase a meranie šírky pásma: iftop, iptraf-ng a iperf3. Každý nástroj sa pri prvom použití automaticky nainštaluje cez apt, beží v popredí a ukončuje sa uvedeným klávesom. Nemenia sieťovú konfiguráciu hostiteľa; iperf3 generuje testovaciu prevádzku.",
+    "section": "Sieť"
+  },
+  "intro": {
+    "title": "Čo to robí?",
+    "body": "Tri interaktívne monitorovacie nástroje, každý za vlastným vstupom do menu. Pri prvom spustení jedného sa balík inštaluje ticho cez <code>apt-get</code>. Následné štarty začínajú okamžite. Žiadny z týchto nástrojov nemení konfiguráciu hostiteľskej siete."
+  },
+  "when": {
+    "heading": "Kedy použiť ktorý",
+    "headerQuestion": "Otázka",
+    "headerUse": "Použitie",
+    "rows": [
+      {
+        "question": "Kto vyťažuje spojenie <em>práve teraz</em>?",
+        "use": "iftop"
+      },
+      {
+        "question": "Aké členenie protokolu / veľkosti paketov / toky TCP prúdia?",
+        "use": "iptraf-ng"
+      },
+      {
+        "question": "Koľko šírky pásma je skutočne k dispozícii medzi dvoma hostiteľmi?",
+        "use": "iperf3"
+      }
+    ]
+  },
+  "iftop": {
+    "heading": "Sieťová prevádzka v reálnom čase (iftop)",
+    "body": "Šírka pásma v reálnom čase pre dvojice hostiteľov (zdroj ↔ cieľ) — ako <code>top</code> pre sieťovú prevádzku. Najväčšie toky zobrazuje navrchu s kĺzavými priemermi za 2/10/40 sekúnd. Najlepší nástroj na otázku <em>„Prečo je moje odchádzajúce spojenie vyťažené?“</em>.",
+    "exit": "<strong>Ukončenie:</strong> stlačte <kbd>q</kbd>. ProxMenux pred spustením zobrazí pripomenutie.",
+    "keysTitle": "Užitočné klávesy v iftop",
+    "keysBody": "<kbd>n</kbd> prepína vyhľadávanie DNS, <kbd>p</kbd> zobrazuje čísla portov, <kbd>P</kbd> pozastaví zobrazenie, <kbd>t</kbd> prepína smer riadku (odoslané / prijaté / oboje), <kbd>1</kbd>/<kbd>2</kbd>/<kbd>3</kbd> zoradí podľa priemeru za 2 s / 10 s / 40 s. Úplný zoznam nájdete v <code>man iftop</code>."
+  },
+  "iptraf": {
+    "heading": "Nástroj na sledovanie siete (iptraf-ng)",
+    "intro": "Nástroj na sledovanie prevádzky vo viacerých režimoch, ovládaný cez menu. iftop odpovedá na <em>„kto“</em>, iptraf-ng na <em>„čo“</em>: počty bajtov a paketov podľa protokolu, sledovanie stavu spojení TCP, histogramy veľkosti paketov a aktivita LAN podľa stanice.",
+    "menuIntro": "Pri spustení dostanete ponuku piatich možností:",
+    "headerMode": "Režim",
+    "headerUseFor": "Použiť pre",
+    "rows": [
+      {
+        "mode": "IP traffic monitor",
+        "useFor": "Zoznam tokov TCP / UDP / ICMP / iných protokolov IP v reálnom čase s počítadlami bajtov a stavom pripojenia"
+      },
+      {
+        "mode": "General interface stats",
+        "useFor": "Súhrnný počet paketov IPv4 / IPv6 / TCP / UDP / ICMP / non-IP paketov na sieťovú kartu"
+      },
+      {
+        "mode": "Detailed interface stats",
+        "useFor": "Rovnaké ako vyššie, ale pre jedno rozhranie, s podrobnosťami o veľkosti a rýchlosti paketov"
+      },
+      {
+        "mode": "Statistical breakdowns",
+        "useFor": "Histogram rozdelenia veľkosti paketov podľa portu TCP / UDP"
+      },
+      {
+        "mode": "LAN station monitor",
+        "useFor": "Štatistiky prevádzky podľa MAC adresy pre lokálnu broadcastovú doménu"
+      }
+    ],
+    "exit": "<strong>Ukončenie:</strong> stlačte <kbd>x</kbd> v ľubovoľnom zobrazení alebo <kbd>Q</kbd> v hlavnom menu. ProxMenux pred spustením zobrazí pripomenutie.",
+    "logTitle": "Zaznamenávanie zachytených údajov do súboru",
+    "logBody": "Každý režim ponúka zápis zachytených štatistík do <code>/var/log/iptraf-ng/</code>. Ak potrebujete záznam špičky prevádzky, nechajte nástroj bežať, zapisujte do súboru a skontrolujte ho neskôr namiesto sledovania obrazovky v reálnom čase."
+  },
+  "iperf3": {
+    "heading": "Test priepustnosti (iperf3)",
+    "intro1": "Meria skutočnú priepustnosť TCP medzi dvoma hostiteľmi. Na rozdiel od iftop / iptraf-ng, ktoré sledujú existujúcu prevádzku, iperf3 generuje syntetickú prevádzku na záťažový test spojenia. Nevyhnutné pri otázkach ako <em>„Dosahuje moje 10 GbE skutočne 10 GbE?“</em> alebo <em>„Je úzkym miestom sieťová karta, prepínač alebo úložisko?“</em>.",
+    "intro2": "iperf3 je <strong>nástroj pre dvoch hostiteľov</strong>: jeden beží ako server a načúva na porte TCP 5201, druhý ako klient, ktorý sa pripojí, odošle údaje a vypíše rýchlosť. Spúšťač ProxMenux sa opýta na požadovaný režim:",
+    "headerMode": "Režim",
+    "headerBehaviour": "Správanie",
+    "headerCli": "Ekvivalentný príkaz CLI",
+    "rows": [
+      {
+        "mode": "Server",
+        "behaviour": "Načúva na porte TCP 5201 a vypíše výsledky každého prichádzajúceho testu. Ukončí sa cez Ctrl+C.",
+        "cli": "iperf3 -s"
+      },
+      {
+        "mode": "Klient",
+        "behaviour": "Vyžiada IP adresu alebo názov servera, pripojí sa, spustí predvolený 10-sekundový test a vypíše správu.",
+        "cli": "iperf3 -c <target>"
+      }
+    ],
+    "workflowIntro": "Typický pracovný postup na testovanie 10 GbE spojenia medzi dvoma hostiteľmi Proxmox:",
+    "workflow": [
+      "Na hostiteľovi A otvorte menu Sieť → <em>Test priepustnosti (iperf3)</em> → vyberte <strong>Server</strong>.",
+      "Na hostiteľovi B otvorte rovnakú položku ponuky → vyberte <strong>Klient</strong> → zadajte IP hostiteľa A.",
+      "Počkajte 10 sekúnd. Porovnajte nameranú rýchlosť s teoretickým maximom spojenia."
+    ],
+    "sample": "Vzorový výstup klienta:",
+    "flagsTitle": "Užitočné voľby pri ručnom spustení zo shellu",
+    "flagsBody": "<code>-t 60</code> dlhší test (60 s namiesto 10 s), <code>-P 4</code> 4 paralelné toky (rýchlejšie vyťažia spojenie), <code>-R</code> opačný smer (server → klient), <code>-u -b 100M</code> test UDP pri 100 Mbit/s (meranie kolísania oneskorenia a straty paketov), <code>-p 5202</code> iný port (viac testov súčasne). Úplný zoznam nájdete v <code>man iperf3</code>.",
+    "firewallTitle": "Otvoriť firewall port na serveri",
+    "firewallBody": "Server predvolene načúva na porte TCP <strong>5201</strong>. Ak ho spustíte na hostiteľovi Proxmox s prísnym firewallom na úrovni dátového centra alebo hostiteľa, počas testu povoľte prichádzajúce TCP 5201 z IP adresy klienta a potom port opäť zatvorte. To isté platí pre <code>nftables</code> / <code>iptables</code> na fyzických hostiteľoch."
+  },
+  "install": {
+    "heading": "Prvé spustenie nainštaluje balík",
+    "body": "Všetky tri spúšťače overia prítomnosť programu a ak chýba, spustia <code>apt-get update -qq &amp;&amp; apt-get install -y &lt;pkg&gt;</code>. Inštalácia prebieha bez výpisu: pri prvom použití môže menu pôsobiť zamrznuto 10–30 sekúnd. Ďalšie spustenia sú okamžité."
+  },
+  "troubleshoot": {
+    "heading": "Riešenie problémov",
+    "hangTitle": "Inštalácia visí navždy pri prvom spustení",
+    "hangBody": "Hostiteľ nemá internet alebo apt repo sú nedosiahnuteľné. Zrušiť pomocou <kbd>Ctrl</kbd>+<kbd>C</kbd>, spustiť <code>apt-get update</code> ručne vidieť skutočnú chybu (DNS, repo podpis, proxy ...), potom sa vrátiť do menu.",
+    "refusedTitle": "Klient iperf3: „unable to connect to server: Connection refused“",
+    "refusedBody": "Server buď nebeží, alebo jeho firewall blokuje TCP 5201. Na serveri overte cez <code>ss -tlnp | grep 5201</code>, že iperf3 načúva. Ak načúva, ale klient stále zlyháva, skontrolujte firewally na trase medzi hostiteľmi.",
+    "slowTitle": "iperf3 hlási výrazne nižšiu rýchlosť, než sa od spojenia očakáva",
+    "slowBody": "Bežné príčiny v poradí pravdepodobnosti: (1) CPU jedného hostiteľa je úzkym miestom — skúste <code>iperf3 -c &lt;target&gt; -P 4</code> na využitie viacerých jadier; (2) prenos prechádza pomalším spojom, napríklad gigabitovým prepínačom medzi dvoma kartami 10 GbE; (3) nezhodné MTU — skontrolujte <code>ip link show</code> na oboch koncoch; (4) vypnutý NIC offloading — pri karte Intel e1000e pozrite komunitný skript <em>Disable NIC Offloading</em>.",
+    "noTrafficTitle": "iftop / iptraf-ng nevykazujú žiadnu prevádzku pre rušného hostiteľa",
+    "noTrafficBody": "Predvolené zachytávanie používa prvé zistené rozhranie. Správne rozhranie zadajte výslovne zo shellu: <code>iftop -i vmbr0</code> alebo <code>iptraf-ng -i vmbr0</code>. Spúšťač v menu používa predvolené rozhranie; pre iné rozhrania spustite nástroj z konzoly."
+  },
+  "related": {
+    "heading": "Súvisiace",
+    "items": [
+      {
+        "label": "Diagnostika",
+        "href": "/docs/network/diagnostics",
+        "tail": " — jednorazové kontroly iba na čítanie (smerovanie, pripojenie a pokročilé štatistiky)."
+      },
+      {
+        "label": "Analýza mostov a oprava so sprievodcom",
+        "href": "/docs/network/bridge-analysis",
+        "tail": " — keď sledovanie odhalí, že rozhranie alebo most nefunguje správne."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sk/docs/network/persistent-names.json b/web/messages/sk/docs/network/persistent-names.json
new file mode 100644
index 00000000..bb2a952e
--- /dev/null
+++ b/web/messages/sk/docs/network/persistent-names.json
@@ -0,0 +1,130 @@
+{
+  "meta": {
+    "title": "Trvalé názvy rozhraní | Dokumentácia ProxMenux",
+    "description": "Priraďte názvy rozhraní Proxmox (eno1, enp3s0, …) k MAC adresám pomocou súborov .link služby systemd, aby zostali zachované pri opätovnom číslovaní PCI, aktualizáciách jadra a pridávaní či odoberaní iných sieťových kariet.",
+    "ogTitle": "Trvalé názvy rozhraní | Dokumentácia ProxMenux",
+    "ogDescription": "Zabráňte zmene názvov rozhraní Proxmox pri zmene hardvéru. Používa súbory .link služby systemd s priradením podľa MAC adresy."
+  },
+  "header": {
+    "title": "Trvalé názvy rozhraní",
+    "description": "Pre každú fyzickú sieťovú kartu vytvorí súbor .link služby systemd, ktorý priradí názov pridelený jadrom k MAC adrese karty. Po použití pri ďalšom reštarte sa názvy rozhraní prestanú meniť pri pridávaní, odoberaní alebo presúvaní kariet PCIe.",
+    "section": "Sieť"
+  },
+  "intro": {
+    "title": "Čo to robí?",
+    "body": "Pre každú fyzickú sieťovú kartu hostiteľa zapíše malý súbor <code>/etc/systemd/network/10-&lt;iface&gt;.link</code> s pravidlom: <em>„Zariadenie s touto MAC adresou sa musí vždy volať týmto názvom.“</em> systemd-udevd použije pravidlo pri každom štarte skôr, než <code>ifupdown</code> prečíta <code>/etc/network/interfaces</code>."
+  },
+  "problem": {
+    "heading": "Problém, ktorý rieši",
+    "intro": "Linux odvodzuje predvolené názvy rozhraní z topológie PCI — <code>eno1</code> = integrovaná karta, <code>enp3s0</code> = karta na zbernici PCI 3, slot 0 atď. Schéma názvov je deterministická <em>pri rovnakom rozložení hardvéru</em>. Ak sa rozloženie zmení, zmenia sa aj názvy:",
+    "items": [
+      "Pridanie GPU pred existujúcu sieťovú kartu → číslo zbernice sieťovej karty sa môže zmeniť → zmení sa názov.",
+      "Presunutie karty do iného slotu PCIe → zmení sa názov.",
+      "Aktualizácia BIOS / UEFI s opätovným číslovaním zariadení → názvy sa môžu zmeniť.",
+      "Nahradenie chybnej karty rovnakým modelom v inom slote → zmení sa názov."
+    ],
+    "outro": "Po takejto zmene <code>/etc/network/interfaces</code> stále odkazuje na <em>starý</em> názov; most sa neaktivuje a hostiteľ stratí sieťové pripojenie. Nastavenie trvalých názvov zabráni opakovaniu tejto situácie."
+  },
+  "howWorks": {
+    "heading": "Ako to funguje",
+    "arrowLabel": "na NIC",
+    "nodes": {
+      "detectLabel": "Zistiť fyzické sieťové karty",
+      "detectDetail": "ls /sys/class/net/\nvylúčiť vmbr / bond /\ndocker / veth / wireguard …",
+      "readLabel": "Prečítať každú MAC adresu",
+      "readDetail": "cat /sys/class/net/\n  '<'iface'>'/address",
+      "writeLabel": "Zapísať súbor .link",
+      "writeDetail": "/etc/systemd/network/\n  10-'<'iface'>'.link"
+    },
+    "minimalIntro": "Každý vygenerovaný súbor je zámerne minimálny:",
+    "minimalOutro": "Pri štarte systemd-udevd identifikuje zariadenie podľa MAC adresy a pridelí požadovaný názov <em>skôr</em>, než zasiahnu iné komponenty (ifupdown, predvolené pomenovanie jadra). Predpona <code>10-</code> zabezpečuje skoré načítanie pravidiel pred predvoleným súborom <code>99-default.link</code>."
+  },
+  "scope": {
+    "heading": "Čo sa napíše, čo sa preskočí",
+    "headerType": "Typ",
+    "headerBehaviour": "Správanie",
+    "headerWhy": "Prečo?",
+    "rows": [
+      {
+        "type": "Integrovaná / PCIe sieťová karta",
+        "behaviour": "Zapíše sa súbor <code>.link</code>",
+        "why": "Zodpovedá skutočnému zariadeniu PCI — prípad, pre ktorý je nástroj určený"
+      },
+      {
+        "type": "Wi-Fi (phy80211)",
+        "behaviour": "Zapíše sa súbor <code>.link</code>",
+        "why": "Má skutočnú MAC adresu a využije stabilný názov"
+      },
+      {
+        "type": "Mosty (vmbrX)",
+        "behaviour": "Preskočené",
+        "why": "Virtuálne; meno pochádza z <code>/etc/network/interfaces</code>"
+      },
+      {
+        "type": "Bondy (bondX)",
+        "behaviour": "Preskočené",
+        "why": "Virtuálne; názov bondu nastavuje ifupdown"
+      },
+      {
+        "type": "veth / docker0 / br-XXXX",
+        "behaviour": "Preskočené",
+        "why": "Vytvárané podľa potreby systémom Docker / LXC — nejde o trvalý hardvér"
+      },
+      {
+        "type": "tap / fwpr / fwln",
+        "behaviour": "Preskočené",
+        "why": "Vytvárané podľa potreby systémom Proxmox pre každú VM/CT"
+      },
+      {
+        "type": "WireGuard / Cilium / Tailscale",
+        "behaviour": "Preskočené",
+        "why": "Softvérové rozhrania spravované vlastnými démonmi"
+      }
+    ]
+  },
+  "safety": {
+    "heading": "Ochrana: predchádzajúce súbory .link sa zálohujú",
+    "intro": "Ak <code>/etc/systemd/network/</code> už obsahuje <code>.link</code> súbory (z predchádzajúceho spustenia alebo iného nástroja), skopírujú sa do záložného adresára s časovou značkou pred generovaním nových:",
+    "outro": "Ak chcete vrátiť späť: skopírujte súbory späť zo záložného adresára a reštartujte.",
+    "rebootTitle": "Prejaví sa pri ďalšom reštarte, nie okamžite",
+    "rebootBody": "Zmeny súborov <code>.link</code> sa použijú iba pri štarte, keď udev znovu enumeruje zariadenia. Preto nástroj hlási <em>„Zmeny sa použijú po reštarte“</em>. Premenovanie rozhrania za behu je riskantné a nástroj sa oň nepokúša: aktívny <code>vmbr0</code> s členskými rozhraniami by sa musel prekonfigurovať atómovo. Operácia sa preto odkladá na ďalší čistý štart."
+  },
+  "afterReboot": {
+    "heading": "Po reštarte",
+    "intro": "Keď sú názvy napevno priradené, postup pri budúcich zmenách hardvéru je jednoduchý:",
+    "items": [
+      "Vypnite počítač, zmeňte hardvér (pridajte kartu, zmeňte slot, …) a spustite ho.",
+      "Každý NIC si ponechá svoje predchádzajúce meno, pretože jeho MAC zodpovedá súboru <code>.link</code>.",
+      "Ak je NIC nahradený (iný MAC), dostane predvolený názov jadra (<code>enp&lt;bus&gt;s&lt;slot&gt;</code>); znovu spustite toto menu pre pridanie položky <code>.link</code> pre MAC novej karty."
+    ]
+  },
+  "troubleshoot": {
+    "heading": "Riešenie problémov",
+    "emptyTitle": "\"Nenájdené žiadne fyzické rozhrania\" po spustení nástroja",
+    "emptyBody": "Jadro na hostiteľovi nevidí žiadne rozhrania založené na PCI / phy80211. Overte to cez <code>ls -l /sys/class/net/</code> — každá položka by mala obsahovať symbolický odkaz <code>device</code> (PCI) alebo položku <code>phy80211</code> (Wi-Fi). Ak pri skutočnej sieťovej karte chýbajú obe, ovládač nie je načítaný.",
+    "noChangeTitle": "Po reštarte sa mená nezmenili podľa očakávania.",
+    "noChangeBody": "Skontrolujte, či súbor existuje a má správny formát: <code>cat /etc/systemd/network/10-&lt;iface&gt;.link</code>. Potom skontrolujte záznamy udev: <code>journalctl -u systemd-udevd -b | grep -i link</code>. Bežnou príčinou je starý parameter jadra <code>net.ifnames=0</code>, ktorý úplne vypína predvídateľné názvy — odstráňte ho z <code>/etc/default/grub</code>, spustite <code>update-grub</code> a reštartujte.",
+    "undoTitle": "Chcem zrušiť trvalé pomenovanie.",
+    "undoBody": "Buď odstráňte súbory <code>.link</code> (<code>rm /etc/systemd/network/10-*.link</code>), alebo ich obnovte z adresára záloh vytvoreného pri predchádzajúcom spustení. Zmenu použijete reštartom."
+  },
+  "related": {
+    "heading": "Súvisiace",
+    "items": [
+      {
+        "label": "Analýza mostov a oprava so sprievodcom",
+        "href": "/docs/network/bridge-analysis",
+        "tailRich": " — postup obnovy, keď sa názvy <em>už</em> zmenili."
+      },
+      {
+        "label": "Analýza konfigurácie a čistenie so sprievodcom",
+        "href": "/docs/network/config-analysis",
+        "tail": " — na odstránenie osirelých blokov, ktoré zostali po zmenách názvov."
+      },
+      {
+        "label": "Diagnostika",
+        "href": "/docs/network/diagnostics",
+        "tailRich": " — po reštarte overte nové názvy cez <em>Zobraziť smerovaciu tabuľku</em>."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sk/docs/oci-manager/architecture.json b/web/messages/sk/docs/oci-manager/architecture.json
new file mode 100644
index 00000000..657730c7
--- /dev/null
+++ b/web/messages/sk/docs/oci-manager/architecture.json
@@ -0,0 +1,171 @@
+{
+  "meta": {
+    "title": "Ako sa prispôsobí obraz OCI | ProxMenux",
+    "description": "Od repozitára obrazu a jeho súboru Compose cez skontrolovateľnú šablónu a plán nasadenia až po natívny LXC v Proxmox VE, bez Dockeru v kontajneri."
+  },
+  "header": {
+    "title": "Ako sa prispôsobí obraz OCI",
+    "description": "Od repozitára obrazu a jeho súboru Compose cez skontrolovateľnú šablónu a plán nasadenia až po natívny LXC, bez inštalácie Dockeru v kontajneri.",
+    "section": "OCI manager Apps"
+  },
+  "sections": [
+    {
+      "id": "pipeline",
+      "title": "Postup prispôsobenia",
+      "blocks": [
+        {
+          "mermaid": {
+            "chartCode": "flowchart LR\n A[\"{{repo}}\"] --> B[\"Compose + README\"]\n B --> C[\"{{converter}}\"]\n C --> D[\"{{template}}\"]\n D --> E{\"{{blockers}}\"}\n E -- \"{{no}}\" --> F[\"{{review}}\"]\n F --> D\n E -- \"{{yes}}\" --> G[\"{{plan}}\"]\n G --> H[\"pct create\"]\n H --> I[\"{{lxc}}\"]",
+            "labels": {
+              "repo": "Repozitár obrazu",
+              "converter": "Konvertor",
+              "template": "Šablóna JSON",
+              "blockers": "Bez prekážok?",
+              "no": "Nie",
+              "yes": "Áno",
+              "review": "Kontrola / overlay",
+              "plan": "Plán nasadenia",
+              "lxc": "Natívny LXC"
+            }
+          }
+        },
+        {
+          "p": "Konvertor načíta obraz a súbor Compose zverejnené projektom a vytvorí šablónu JSON. Ak niektoré požiadavky ešte nie sú prispôsobené a bránia inštalácii, šablóna pred zverejnením v katalógu prejde kontrolou. Súbor overených úprav, nazývaný overlay, tieto prekážky vyrieši. Na inštaláciu sa ponúkajú iba šablóny bez nevyriešených prekážok."
+        }
+      ]
+    },
+    {
+      "id": "template",
+      "title": "Čo šablóna zachováva",
+      "blocks": [
+        {
+          "cards": {
+            "items": [
+              {
+                "icon": "archive",
+                "title": "Identita obrazu",
+                "body": "Repozitár, priebežne aktualizovaná značka, architektúra, zistený digest a revízia zdroja."
+              },
+              {
+                "icon": "braces",
+                "title": "Kontrakt kontajnera",
+                "body": "Entrypoint, Cmd, prostredie, používateľ, pracovný adresár, signál na zastavenie, porty a zväzky."
+              },
+              {
+                "icon": "layers",
+                "title": "Prispôsobenie pre Proxmox VE",
+                "body": "Zdroje, zabezpečenie, prípojné body, zariadenia, sysctls, kontroly stavu a potrebné úpravy pre každú položku vrátane ich zdôvodnenia."
+              },
+              {
+                "icon": "shield",
+                "title": "Kompatibilita",
+                "body": "Podporované kľúče, neprispôsobené požiadavky brániace inštalácii a stav každej kontroly."
+              }
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "sources",
+      "title": "OCI poskytuje proces, Compose poskytuje prostredie",
+      "blocks": [
+        {
+          "table": {
+            "headers": [
+              "Zdroj",
+              "Príklad",
+              "Natívny výsledok"
+            ],
+            "rows": [
+              [
+                "Metadáta OCI",
+                "<code>Entrypoint</code>, <code>Cmd</code>, <code>User</code>",
+                "Proxmox VE ich importuje pri vytváraní CT"
+              ],
+              [
+                "Docker Compose",
+                "<code>environment</code>, <code>volumes</code>, <code>devices</code>",
+                "Záznamy prostredia LXC, <code>mpN</code> a <code>devN</code>"
+              ],
+              [
+                "Profil ProxMenux",
+                "GPU, kontrola stavu, prihlasovacie údaje",
+                "Otázky a overené úpravy"
+              ],
+              [
+                "Používateľ",
+                "VMID, úložisko, sieť",
+                "Kontrakt inštancie"
+              ]
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "install",
+      "title": "Čo sa deje počas inštalácie",
+      "blocks": [
+        {
+          "steps": {
+            "items": [
+              {
+                "title": "Zistiť konkrétny obraz",
+                "body": "Vyhľadá sa obraz v registri, vyberie sa architektúra hostiteľa a zaznamená sa konkrétny digest, na ktorý odkazuje priebežne aktualizovaná značka."
+              },
+              {
+                "title": "Stiahnuť a overiť",
+                "body": "Skopeo stiahne obraz ako archív OCI. Pred vytvorením akýchkoľvek prostriedkov sa každá vrstva overí podľa jej digestu a rozbalí. Ak je stiahnutý súbor poškodený, sťahovanie sa ešte raz zopakuje, až potom sa inštalácia zastaví."
+              },
+              {
+                "title": "Vytvoriť súborový systém",
+                "body": "<code>pct create</code> vytvorí rootfs z archívu a zachová oficiálne metadáta procesu obrazu."
+              },
+              {
+                "title": "Pripojiť prostriedky",
+                "body": "Pripoja sa deklarované zväzky a zariadenia a nastavia sa sieť, prostredie a bezpečnostné profily."
+              },
+              {
+                "title": "Konzola",
+                "body": "Výstup konzoly kontajnera sa uchováva na hostiteľovi. Konzola Proxmox VE otvorí shell, ak ho obraz obsahuje."
+              },
+              {
+                "title": "Overiť",
+                "body": "Pri prvom spustení sa čaká na pridelenie adresy a odpoveď služby. V prípade zlyhania sa inštalácia neoznačí za úspešnú."
+              },
+              {
+                "title": "Zaznamenať konfiguráciu",
+                "body": "Výsledná konfigurácia sa uloží do kontraktu inštancie, ktorý sa používa pri aktualizáciách a opätovnom vytvorení."
+              }
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "example",
+      "title": "Príklad: obraz s /config a /downloads",
+      "intro": "Bežná definícia Compose a konfigurácia Proxmox VE, ktorá z nej vznikne. Cesty očakávané aplikáciou sa nemenia.",
+      "blocks": [
+        {
+          "codeGrid": {
+            "items": [
+              {
+                "title": "Docker Compose",
+                "code": "image: lscr.io/linuxserver/example:latest\nenvironment:\n  - PUID=1000\n  - PGID=1000\nvolumes:\n  - config:/config\n  - /srv/downloads:/downloads\nports:\n  - 8080:8080"
+              },
+              {
+                "title": "/etc/pve/lxc/VMID.conf (úryvok)",
+                "code": "entrypoint: /init\nmp0: local-lvm:vm-VMID-disk-1,mp=/config,backup=1,size=8G\nmp1: /srv/downloads,mp=/downloads\nnet0: name=eth0,bridge=vmbr0,ip=dhcp,type=veth\nlxc.environment.runtime: PUID=1000\nlxc.environment.runtime: PGID=1000"
+              }
+            ]
+          }
+        },
+        {
+          "p": "<code>mp0</code> je druhý disk patriaci kontajneru, na zvolenom úložisku pomenovaný <code>vm-VMID-disk-N</code>. Pripája sa do <code>/config</code> a pri <code>backup=1</code> je súčasťou zálohy kontajnera. <code>mp1</code> nevytvára disk: pripája adresár hostiteľa <code>/srv/downloads</code> do <code>/downloads</code> v LXC. Port 8080 sa nemapuje: LXC má vlastnú adresu a služba odpovedá na nej."
+        }
+      ]
+    }
+  ]
+}
diff --git a/web/messages/sk/docs/oci-manager/custom-image.json b/web/messages/sk/docs/oci-manager/custom-image.json
new file mode 100644
index 00000000..7122dedf
--- /dev/null
+++ b/web/messages/sk/docs/oci-manager/custom-image.json
@@ -0,0 +1,278 @@
+{
+  "meta": {
+    "title": "Inštalácia obrazu mimo katalógu | ProxMenux",
+    "description": "Prispôsobte obraz OCI zo súboru Compose, URL, príkazu docker run alebo odkazu na obraz a pred inštaláciou skontrolujte, čo ProxMenux dokáže reprodukovať."
+  },
+  "header": {
+    "title": "Nainštalovať obraz mimo katalógu",
+    "description": "Vlastný obraz sa prispôsobí zo súboru Compose, príkazu docker run alebo iba z odkazu na obraz. Výsledok sa zobrazí na kontrolu skôr, než sa vytvorí akýkoľvek LXC.",
+    "section": "OCI manager Apps"
+  },
+  "sections": [
+    {
+      "id": "intro",
+      "blocks": [
+        {
+          "calloutInfo": {
+            "title": "Rovnaký konvertor a inštalátor",
+            "body": "Voľba <strong>Nainštalovať obraz mimo katalógu</strong> používa rovnaký konvertor a inštalátor ako šablóny katalógu. Rozdiel je v tom, že kontrakt sa vytvorí až vtedy zo zadanej definície a overí sa pred vytvorením akéhokoľvek LXC."
+          }
+        }
+      ]
+    },
+    {
+      "id": "sources",
+      "title": "Ako je obraz opísaný",
+      "intro": "Úvodná obrazovka sa pýta, ako je obraz opísaný. Štyri možnosti poskytnú definíciu na prispôsobenie, piata používa iba názov obrazu a ďalšie tri načítajú už napísaný oci-compose.",
+      "blocks": [
+        {
+          "table": {
+            "headers": [
+              "Voľba",
+              "Čo sa načíta"
+            ],
+            "rows": [
+              [
+                "Vložiť súbor Compose do terminálu",
+                "Vložte obsah YAML do terminálu a ukončite ho pomocou Ctrl+D."
+              ],
+              [
+                "Načítať súbor Compose z tohto hostiteľa",
+                "Cesta na uzle, predvolene <code>/root/docker-compose.yml</code>. Súbor musí existovať a nesmie presiahnuť 256 KiB."
+              ],
+              [
+                "Stiahnuť súbor Compose z adresy",
+                "Adresa <code>http://</code> alebo <code>https://</code>, ktorá poskytuje nespracovaný YAML. Stiahne sa najviac 256 KiB."
+              ],
+              [
+                "Vložiť príkaz docker run do terminálu",
+                "Príkaz zverejnený projektom. Prispôsobia sa porty, prostredie, zväzky, zariadenia, capabilities, používateľ, zdieľaná pamäť a ďalšie podporované voľby."
+              ],
+              [
+                "Iba odkaz na obraz, bez súboru Compose",
+                "Odkaz, napríklad <code>ghcr.io/user/application:latest</code>. Vyhľadá sa obraz v registri a zachovajú sa jeho metadáta OCI."
+              ],
+              [
+                "Vložiť oci-compose do terminálu",
+                "Vložte JSON do terminálu a ukončite ho pomocou Ctrl+D. Nekonvertuje sa: overí sa a nainštaluje tak, ako je napísaný."
+              ],
+              [
+                "Načítať oci-compose z tohto hostiteľa",
+                "Súbor JSON na uzle, predvolene <code>/root/oci-compose.json</code>, s veľkosťou najviac 2 MiB."
+              ],
+              [
+                "Stiahnuť oci-compose z adresy",
+                "Adresa <code>http://</code> alebo <code>https://</code>, ktorá poskytuje súbor JSON. Stiahnu sa najviac 2 MiB."
+              ]
+            ]
+          }
+        },
+        {
+          "figure": {
+            "src": "/oci-manager/custom-source-menu.png",
+            "alt": "Menu výberu spôsobu opisu obrazu mimo katalógu",
+            "caption": "Spôsoby opisu obrazu mimo katalógu."
+          }
+        }
+      ]
+    },
+    {
+      "id": "reference-only",
+      "title": "Čo poskytuje samotný odkaz na obraz",
+      "intro": "Obraz obsahuje metadáta svojho procesu, nie však celé prostredie, ktoré zvyčajne dopĺňa súbor Compose.",
+      "blocks": [
+        {
+          "table": {
+            "headers": [
+              "Načítané z obrazu",
+              "Nie je v obraze",
+              "Dôsledok"
+            ],
+            "rows": [
+              [
+                "<code>Entrypoint</code>, <code>Cmd</code>, <code>User</code>, <code>WorkingDir</code> a zahrnuté prostredie",
+                "Premenné uvedené iba v dokumentácii",
+                "Pridajú sa pri inštalácii alebo cez Upraviť"
+              ],
+              [
+                "Zväzky deklarované obrazom",
+                "Adresáre hostiteľa uvedené iba v súbore Compose",
+                "Ďalšie cesty sa pridajú pred inštaláciou"
+              ],
+              [
+                "Porty <code>EXPOSE</code>",
+                "URL, protokol alebo funkčná kontrola služby",
+                "Potvrdí sa port a spôsob kontroly služby"
+              ],
+              [
+                "Architektúry a digest v registri",
+                "Zariadenia, oprávnenia alebo externé závislosti",
+                "Bez požiadavky v definícii sa nepovolia"
+              ]
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "review",
+      "title": "Kontrola pred inštaláciou",
+      "intro": "Po prispôsobení definície ProxMenux zobrazí, ako ju pochopil, ešte pred otázkami na VMID, zdroje a úložisko.",
+      "blocks": [
+        {
+          "steps": {
+            "items": [
+              {
+                "title": "Analyzovať",
+                "body": "Načítajú sa služby, obraz, porty, cesty, prostredie, zariadenia, zabezpečenie a kontroly stavu."
+              },
+              {
+                "title": "Overiť obraz v registri",
+                "body": "Obraz musí existovať v registri a zobrazia sa jeho publikované architektúry. Súkromný register sa načíta pomocou účtu uloženého pre daný register."
+              },
+              {
+                "title": "Uviesť nepoužité voľby",
+                "body": "Vypíšu sa štítky, siete Docker, nastavenia Swarm a ďalšie kľúče, ktoré nemajú na LXC vplyv."
+              },
+              {
+                "title": "Zablokovať voľby bez bezpečného ekvivalentu",
+                "body": "Kľúče bez bezpečného ekvivalentu sa zobrazia v časti <strong>Voľby bez ekvivalentu</strong> a inštalácia nepokračuje. Žiadny sa nevynechá bez upozornenia."
+              },
+              {
+                "title": "Vyžiadať tajné údaje",
+                "body": "Premenné, ktorých názov označuje heslo, token alebo kľúč, sa pri inštalácii vyžiadajú ako citlivé údaje."
+              }
+            ]
+          }
+        },
+        {
+          "figure": {
+            "src": "/oci-manager/custom-review.png",
+            "alt": "Súhrn interpretácie súboru Compose v ProxMenux",
+            "caption": "Súhrn zobrazený pred otázkami na VMID a zdroje."
+          }
+        },
+        {
+          "p": "Po potvrdení súhrnu nasleduje rovnaký postup ako v katalógu: názov, predvolený alebo rozšírený režim, VMID, CPU, pamäť, sieť, spúšťanie s uzlom, trvalé a ďalšie cesty, kompatibilné zariadenia a záverečný súhrn."
+        }
+      ]
+    },
+    {
+      "id": "examples",
+      "title": "Príklady vstupu",
+      "blocks": [
+        {
+          "codeGrid": {
+            "items": [
+              {
+                "title": "Compose",
+                "code": "services:\n  app:\n    image: ghcr.io/example/app:latest\n    ports:\n      - \"8080:8080\"\n    volumes:\n      - ./config:/config\n      - /srv/media:/media\n    environment:\n      TZ: Europe/Madrid"
+              },
+              {
+                "title": "docker run",
+                "code": "docker run -d \\\n  --name app \\\n  -p 8080:8080 \\\n  -e TZ=Europe/Madrid \\\n  -v app-config:/config \\\n  -v /srv/media:/media \\\n  ghcr.io/example/app:latest"
+              }
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "oci-compose",
+      "title": "Ručne napísaný oci-compose",
+      "intro": "oci-compose je súbor JSON, z ktorého sa inštaluje aplikácia. Katalóg uchováva jeden pre každú aplikáciu. Rovnaký formát možno napísať ručne a nainštalovať touto voľbou.",
+      "blocks": [
+        {
+          "p": "V ručne napísanom súbore autor určí obraz, porty, premenné, zväzky a otázky pri inštalácii. ProxMenux pri načítaní doplní zvyšok. Formát vyjadrí aj to, čo Compose neobsahuje: text otázky, heslo vytvorené pri inštalácii, profil GPU, vlastníka každého zväzku, kontrolu prvého spustenia alebo prihlasovacie údaje zobrazené na konci."
+        },
+        {
+          "steps": {
+            "items": [
+              {
+                "title": "Overiť",
+                "body": "Súbor s chybami sa nenainštaluje. Každá chyba označí príslušné pole; pri neplatnom JSON sa uvedie riadok a stĺpec."
+              },
+              {
+                "title": "Skontrolovať",
+                "body": "Platný súbor zobrazí, čo nainštaluje: obraz, webovú adresu, porty, trvalé cesty, premenné požadované pri inštalácii a súbory, ktoré zapíše."
+              },
+              {
+                "title": "Nainštalovať",
+                "body": "Inštalácia je rovnaká ako pri aplikáciách katalógu, s predvolenými alebo rozšírenými nastaveniami."
+              }
+            ]
+          }
+        },
+        {
+          "calloutWarning": {
+            "title": "Súbor, ktorý určuje oprávnenia",
+            "body": "oci-compose určuje, čo sa v kontajneri pripojí a s akými oprávneniami. Kontrola to ukáže pred inštaláciou: používajte iba súbory z dôveryhodných zdrojov."
+          }
+        },
+        {
+          "p": "Formát je opísaný po blokoch s dvoma úplnými príkladmi v <readmeLink>README enginu OCI</readmeLink>. Rovnakým spôsobom možno načítať aj záznam inštalácie: použije sa iba pôvodná šablóna, nie odpovede z danej inštalácie."
+        }
+      ]
+    },
+    {
+      "id": "private-registries",
+      "title": "Obrazy v súkromných registroch",
+      "intro": "Obraz zo súkromného registra, napríklad súkromný balík GitHub alebo repozitár Docker Hub, sa načíta pomocou účtu uloženého v ProxMenux.",
+      "blocks": [
+        {
+          "steps": {
+            "items": [
+              {
+                "title": "Register odmietne prístup k obrazu",
+                "body": "Ak register oznámi, že obraz vyžaduje účet, kontrola ponúkne prihlásenie a potom obraz načíta znova."
+              },
+              {
+                "title": "Prihlásiť sa",
+                "body": "Používateľské meno a heslo alebo token s oprávnením na stiahnutie obrazu. Register ich overí a uložia sa iba pri úspešnom overení."
+              },
+              {
+                "title": "Nainštalovať a udržiavať aktuálne",
+                "body": "Účet sa použije na stiahnutie obrazu pri inštalácii aj pri aktualizáciách, úpravách, opätovnom vytvorení, vo watchdogu a pri kontrole aktualizácií Monitora na ľubovoľnom uzle klastra."
+              }
+            ]
+          }
+        },
+        {
+          "p": "<strong>Účty registrov</strong> v hlavnom menu OCI manager Apps zobrazujú uložené účty podľa registra a používateľa, nikdy nie ich tajné údaje. Z každého účtu možno overiť, stiahnuť alebo nainštalovať obraz a aktualizovať alebo odstrániť prihlasovacie údaje."
+        },
+        {
+          "list": {
+            "items": [
+              "GitHub (<code>ghcr.io</code>): používateľ je účet GitHub a heslo je osobný prístupový token s oprávnením <code>read:packages</code>.",
+              "Docker Hub (<code>docker.io</code>): používateľ je účet Docker Hub a heslo je prístupový token s oprávnením na čítanie.",
+              "Ostatné registre, aj s vlastným portom, napríklad <code>registry.example.com:5000</code>: používateľské meno a heslo alebo token poskytnuté daným registrom."
+            ]
+          }
+        },
+        {
+          "calloutInfo": {
+            "title": "Kde sa účty ukladajú",
+            "body": "V <code>/etc/pve/priv/proxmenux/registry-auth.json</code>, ktorý môže čítať iba root, v rovnakom adresári ako heslá úložísk Proxmox. <code>/etc/pve</code> zdieľajú všetky uzly klastra, preto sa účet pridaný na jednom uzle používa na všetkých. Záloha hostiteľa tento súbor obsahuje a odinštalovanie ProxMenux ho odstráni zo všetkých uzlov."
+          }
+        }
+      ]
+    },
+    {
+      "id": "limits",
+      "title": "Definície, ktoré sa nenainštalujú",
+      "blocks": [
+        {
+          "list": {
+            "items": [
+              "Dockerfile bez publikovaného obrazu: obraz sa musí najprv zostaviť a zverejniť v registri OCI.",
+              "Súbor Compose s viacerými službami sa zablokuje, pretože táto voľba inštaluje iba jednu službu do jedného kontajnera, aj keď viaceré služby používajú rovnaký obraz.",
+              "<code>configs</code>, externé tajné údaje alebo formáty zariadení, ktoré nemožno jednoznačne prispôsobiť.",
+              "Nahradenia shellu, napríklad <code>$(command)</code>: namiesto nich treba zapísať výslednú hodnotu.",
+              "Nerozpoznané voľby <code>docker run</code> a <code>--env-file</code>: namiesto nich použite súbor Compose s výslovne uvedenými hodnotami."
+            ]
+          }
+        }
+      ]
+    }
+  ]
+}
diff --git a/web/messages/sk/docs/oci-manager/hardware.json b/web/messages/sk/docs/oci-manager/hardware.json
new file mode 100644
index 00000000..f6a5bf36
--- /dev/null
+++ b/web/messages/sk/docs/oci-manager/hardware.json
@@ -0,0 +1,392 @@
+{
+  "meta": {
+    "title": "Zariadenia a zrýchlenie ProxMenux",
+    "description": "Ako OCI manager Apps sprístupňuje GPU, NVIDIA, Coral, USB, FUSE a ďalšie zariadenia kontajneru OCI ako overené natívne zdroje Proxmox VE."
+  },
+  "header": {
+    "title": "Zariadenia a akcelerácia",
+    "description": "GPU, NVIDIA, Coral, USB, FUSE a blokové zariadenia sa stávajú overenými natívnymi zdrojmi Proxmox VE pre kontajner.",
+    "section": "OCI manager Apps"
+  },
+  "sections": [
+    {
+      "id": "principle",
+      "title": "Zariadenie, ktoré aplikácia potrebuje, nie celý hostiteľ",
+      "blocks": [
+        {
+          "p": "Zariadenie požadované súborom Compose alebo aplikačným profilom sa stáva konkrétnou položkou <code>devN</code> alebo LXC pripojením. Požiadanie o GPU, USB zariadenie alebo Coral nerobí kontajner privilegovaným."
+        },
+        {
+          "flow": {
+            "nodes": [
+              {
+                "label": "Inventár hostiteľa",
+                "detail": "/dev/dri/renderD128\nGID 993 · Intel"
+              },
+              {
+                "label": "ProxMenux",
+                "detail": "výrobca a\noverenie oprávnení"
+              },
+              {
+                "label": "LXC",
+                "detail": "rovnaké zariadenie\nefektívne GID"
+              }
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "origin",
+      "title": "Odkiaľ pochádza požiadavka na zariadenie",
+      "blocks": [
+        {
+          "table": {
+            "headers": [
+              "Zdroj",
+              "Čo sa číta",
+              "Čo robí inštalátor"
+            ],
+            "rows": [
+              [
+                "Docker Compose",
+                "<code>devices</code>, <code>group_add</code>, <code>deploy.resources</code> a NVIDIA žiadosti",
+                "Každá požiadavka sa stáva požiadavkou zariadenia zobrazenou na preskúmanie"
+              ],
+              [
+                "Katalógový profil",
+                "Podpora GPU, Coral, OpenCL, USB alebo FUSE, ktorú aplikácia skutočne má",
+                "Ponúkajú sa len možnosti overené pre tento obraz"
+              ],
+              [
+                "Metadáta a dokumentácia obrazu",
+                "VA-API, Selkies, LinuxServer mods alebo NVIDIA runtime",
+                "Pridávajú sa zdokumentované premenné a príprava"
+              ],
+              [
+                "Výber užívateľa",
+                "iba CPU, Intel/AMD, OpenCL, NVIDIA alebo voliteľné zariadenie",
+                "Výber je uložený v inštančnej zmluve"
+              ]
+            ]
+          }
+        },
+        {
+          "calloutWarning": {
+            "title": "Zistené zariadenia sa nepripájajú automaticky",
+            "body": "Na hostiteľovi sa vytvorí inventár, ale ponúknu a pripoja sa len zariadenia deklarované v súbore Compose alebo kompatibilnom profile. GPU, USB adaptér či Coral prítomný na hostiteľovi sa nesprístupní každému LXC."
+          }
+        }
+      ]
+    },
+    {
+      "id": "identify",
+      "title": "Ako sa identifikuje hostiteľské zariadenie",
+      "intro": "Pred úpravou LXC sa zariadenie číta na hostiteľovi a zodpovedá zvolenému profilu.",
+      "blocks": [
+        {
+          "table": {
+            "headers": [
+              "Typ",
+              "Identita",
+              "Overenie"
+            ],
+            "rows": [
+              [
+                "Intel/AMD DRM",
+                "<code>/dev/dri/renderD*</code> a <code>/sys/class/drm/NODE/device/vendor</code>",
+                "Znakové zariadenie s výrobcom <code>0x8086</code> (Intel) alebo <code>0x1002</code> (AMD)"
+              ],
+              [
+                "AMD OpenCL",
+                "Renderovací uzol a <code>/dev/kfd</code>, ak ho profil potrebuje",
+                "Existencia, typ, výrobca, oprávnenia a deklarovaná zlučiteľnosť"
+              ],
+              [
+                "AMD ROCm",
+                "Renderovací uzol, <code>/dev/kfd</code> a generácia, ktorú výpočtový ovládač hlási v <code>/sys/class/kfd/kfd/topology/nodes/*/properties</code>",
+                "Generácia, pre ktorú obraz ROCm aplikácie obsahuje výpočtové jadrá — uvedené GPU RDNA2 a novšie — sa ponúkne bez úprav. Ostatné GPU týchto rodín, napríklad Radeon 680M a 780M, sa ponúkajú ako experimentálne a nikdy nie sú navrhnutou voľbou: ROCm ich oficiálne nepodporuje, aplikácia ich prezentuje ako generáciu danej rodiny (<code>HSA_OVERRIDE_GFX_VERSION</code>) a inštalátor pred stiahnutím väčšieho obrazu vyžiada potvrdenie. Staršia GPU, napríklad integrovaná grafika Ryzen 5000U, sa neponúkne a Immich ponechá rozpoznávanie na CPU."
+              ],
+              [
+                "NVIDIA",
+                "<code>nvidia-smi</code> a <code>nvidia-container-cli</code>",
+                "GPU, UUID, PCI bus, verzia ovládača, Toolkit, uzly <code>/dev/nvidia*</code>, binárne súbory a knižnice"
+              ],
+              [
+                "Coral PCIe/M.2",
+                "<code>/dev/apex_N</code> a jeho odkaz na <code>/sys/dev/char/MAJOR:MINOR</code>",
+                "Uzol znakového zariadenia, čísla major/minor, vlastník, GID a oprávnenia"
+              ],
+              [
+                "USB a sériové",
+                "<code>/dev/ttyUSB*</code>, <code>/dev/ttyACM*</code> alebo <code>/dev/bus/usb/BBB/DDD</code>",
+                "Uzol znakového zariadenia; pri USB aj výrobca, produkt a sériové číslo, ak ich sysfs zverejňuje"
+              ],
+              [
+                "KVM, TUN, FUSE, video a generické SCSI",
+                "<code>/dev/kvm</code>, <code>/dev/net/tun</code>, <code>/dev/fuse</code>, <code>/dev/videoN</code> alebo <code>/dev/sgN</code>",
+                "Podporovaná cesta, typ uzla a účinné práva"
+              ],
+              [
+                "Optická mechanika",
+                "<code>/dev/srN</code>",
+                "Blokové zariadenie"
+              ]
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "install",
+      "title": "Čo sa stane počas inštalácie",
+      "blocks": [
+        {
+          "steps": {
+            "items": [
+              {
+                "title": "Šablóna ponúka svoje profily",
+                "body": "Napríklad len CPU, Intel/AMD VA-API, AMD OpenCL, Intel OpenCL alebo NVIDIA. Možnosti patria k obrazu, nie k spoločnému menu."
+              },
+              {
+                "title": "Vyberie sa profil",
+                "body": "Určuje uzly zariadení, prostredie, mody alebo runtime, ktoré aplikácia potrebuje."
+              },
+              {
+                "title": "Navrhuje sa cesta",
+                "body": "Pre DRM, <code>/dev/dri/renderD128</code>, ktoré môžu byť zmenené na hostiteľa s niekoľkými renderových uzlov. Pre USB alebo sériový je vybraný konkrétny uzol."
+              },
+              {
+                "title": "Overenie",
+                "body": "Existencia, typ, povolený výrobca, povolenia a GID sú kontrolované. Nesúlad zastaví operáciu."
+              },
+              {
+                "title": "Zapíše sa kontrakt",
+                "body": "Cesta, režim, GID, zápis a profil sa zaznamenávajú pre aktualizácie a opätovné vytvorenia."
+              },
+              {
+                "title": "Pripojenie a skúška",
+                "body": "<code>pct set</code> pridáva položku <code>devN</code> a prístup sa potom kontroluje vo vnútri LXC. LinuxServer obrazy sú tiež kontrolované ako používateľ <code>abc</code>."
+              }
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "config",
+      "title": "Ako sa objavuje v konfigurácii LXC",
+      "intro": "Ilustračné hodnoty: <code>dev0</code> a <code>dev1</code> sú voľné pozície priradené Proxmox VE. <code>renderD128</code>, <code>apex_0</code> a GID závisia od hardvéru uzla.",
+      "blocks": [
+        {
+          "codeGrid": {
+            "items": [
+              {
+                "title": "Intel/AMD VA-API",
+                "code": "dev0: path=/dev/dri/renderD128,mode=0660,gid=993,deny-write=0"
+              },
+              {
+                "title": "Coral PCIe/M.2",
+                "code": "dev0: path=/dev/apex_0,mode=0660,gid=GID,deny-write=0"
+              },
+              {
+                "title": "Špecifické USB zariadenie",
+                "code": "dev0: path=/dev/bus/usb/003/004,mode=0660,gid=GID,deny-write=0"
+              },
+              {
+                "title": "AMD OpenCL",
+                "code": "dev0: path=/dev/dri/renderD128,mode=0660,gid=GID,deny-write=0\ndev1: path=/dev/kfd,mode=0660,gid=GID,deny-write=0"
+              }
+            ]
+          }
+        },
+        {
+          "p": "GID sa načíta na hostiteľovi pomocou <code>stat</code> a zapíše do položky <code>devN</code>; nepredpokladá sa, že skupiny <code>render</code> a <code>video</code> majú pevné číslo. Zariadenie má v LXC rovnakú cestu <code>/dev</code>, na ktorej ho vyhľadávajú vlastné mechanizmy aplikácie."
+        }
+      ]
+    },
+    {
+      "id": "profiles",
+      "title": "Profily, ktoré môže obraz ponúknuť",
+      "blocks": [
+        {
+          "table": {
+            "headers": [
+              "Profil",
+              "Výsledná konfigurácia",
+              "Ponúknuté, keď"
+            ],
+            "rows": [
+              [
+                "Intel/AMD VA-API",
+                "Renderovací uzol <code>/dev/dri</code>",
+                "Aplikácia podporuje video zrýchlenie"
+              ],
+              [
+                "OpenCL",
+                "Render uzol, <code>/dev/kfd</code> v prípade potreby a oficiálny mod",
+                "Obraz alebo profil ho dokumentuje"
+              ],
+              [
+                "NVIDIA",
+                "Zariadenia a knižnice ovládača na hostiteľovi",
+                "Hostiteľ má funkčný ovládač a NVIDIA Container Toolkit"
+              ],
+              [
+                "Coral",
+                "<code>/dev/apex_0</code> alebo zbernica USB",
+                "Profil vyhlasuje Coral podporu (Frigate)"
+              ],
+              [
+                "USB, sériové, FUSE",
+                "Jediné zariadenie, validovaný strom alebo funkcia LXC",
+                "Zmluva o ňu žiada"
+              ]
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "nvidia",
+      "title": "NVIDIA",
+      "blocks": [
+        {
+          "calloutWarning": {
+            "title": "Požiadavka na uzol: NVIDIA Container Toolkit",
+            "body": "Funkčný ovládač na Proxmox VE nestačí na sprístupnenie GPU NVIDIA obrazu OCI. OCI manager Apps používa <code>nvidia-container-cli</code> zo súpravy NVIDIA Container Toolkit na identifikáciu zariadení a získanie binárnych súborov a knižníc zodpovedajúcich načítanému ovládaču."
+          }
+        },
+        {
+          "p": "<nvidiaLink>Inštalátor NVIDIA nástroja ProxMenux</nvidiaLink> nainštaluje NVIDIA Container Toolkit z oficiálneho repozitára NVIDIA spolu s ovládačom. Skontroluje jeho štyri balíky, overí <code>nvidia-container-cli</code> a zaznamená výsledok do denníka zmien <auditLink>Audit a správa</auditLink>."
+        },
+        {
+          "p": "Tieto dva príkazy na hostiteľovi ukazujú, či je k dispozícii ovládač a súbor nástrojov:"
+        },
+        {
+          "shell": {
+            "code": "nvidia-smi -L\nnvidia-container-cli --version"
+          }
+        },
+        {
+          "p": "Na hostiteľovi, kde bol ovládač nainštalovaný inými prostriedkami, je Toolkit nainštalovaný z oficiálneho stabilného úložiska:"
+        },
+        {
+          "shell": {
+            "code": "apt-get update\napt-get install -y --no-install-recommends ca-certificates curl gnupg2\n\ncurl -fsSL https://nvidia.github.io/libnvidia-container/gpgkey \\\n  | gpg --dearmor -o /usr/share/keyrings/nvidia-container-toolkit-keyring.gpg\n\ncurl -s -L https://nvidia.github.io/libnvidia-container/stable/deb/nvidia-container-toolkit.list \\\n  | sed 's#deb https://#deb [signed-by=/usr/share/keyrings/nvidia-container-toolkit-keyring.gpg] https://#g' \\\n  > /etc/apt/sources.list.d/nvidia-container-toolkit.list\n\napt-get update\napt-get install -y nvidia-container-toolkit libnvidia-container-tools"
+          }
+        },
+        {
+          "p": "Inventár, ktorý používa OCI manager Apps, je výstupom príkazu:"
+        },
+        {
+          "shell": {
+            "code": "nvidia-container-cli list --device all --libraries --binaries --firmwares --ipcs"
+          }
+        },
+        {
+          "calloutInfo": {
+            "title": "Konfigurácia Runtime Docker nie je zahrnutá",
+            "body": "Kontajnery sú natívne LXC a nepoužívajú démona Docker, takže <code>nvidia-ctk runtime configure --runtime=docker</code> nehrá žiadnu úlohu: ProxMenux priamo volá <code>nvidia-container-cli</code> a zapíše zariadenia a pripojenia LXC. Príkazy a podporované platformy sú uvedené v <toolkitLink>návode na inštaláciu NVIDIA Container Toolkit</toolkitLink>."
+          }
+        },
+        {
+          "cards": {
+            "items": [
+              {
+                "icon": "cpu",
+                "title": "Inventár z ovládača",
+                "body": "<code>nvidia-container-cli</code> uvádza uzly zariadenia, binárne súbory, firmware a knižnice nainštalovaného ovládača."
+              },
+              {
+                "icon": "refresh",
+                "title": "Bez pevnej verzie",
+                "body": "Šablóna nepomenuje súbory knižnice. Profil je generovaný z aktuálneho hostiteľa."
+              },
+              {
+                "icon": "shield",
+                "title": "Pripojenia iba na čítanie",
+                "body": "Hostiteľské knižnice sú namontované iba na čítanie namiesto kopírovania do kontajnera."
+              },
+              {
+                "icon": "hardDrive",
+                "title": "Zmeny ovládača",
+                "body": "Po zmene ovládača sa inventár znovu vygeneruje pred začiatkom postihnutých LXC."
+              }
+            ]
+          }
+        },
+        {
+          "code": {
+            "title": "Výsledok NVIDIA (zjednodušený)",
+            "code": "devN: path=/dev/nvidia0,...\ndevN: path=/dev/nvidiactl,...\ndevN: path=/dev/nvidia-uvm,...\nlxc.mount.entry: HOST_LIBRARY CONTAINER_LIBRARY none ro,bind,create=file 0 0"
+          }
+        },
+        {
+          "p": "Sprístupniť len <code>/dev/nvidia0</code> nestačí. Komponenty užívateľského priestoru načítaného ovládača sú namontované len na čítanie a <code>nvidia-smi</code> potom beží vnútri LXC pre porovnanie GPU, UUID, PCI zbernice a verzie s inventárom hostiteľa."
+        }
+      ]
+    },
+    {
+      "id": "usb",
+      "title": "USB, sériové a USB Coral",
+      "blocks": [
+        {
+          "calloutWarning": {
+            "title": "Číslovanie USB sa môže zmeniť",
+            "body": "Cesta ako <code>/dev/bus/usb/003/004</code> sa môže zmeniť po opätovnom pripojení zariadenia alebo reštarte hostiteľa. Profil zaznamená výrobcu, produkt a sériové číslo, ak sú dostupné, ale nová adresa zbernice sa automaticky nepremapuje."
+          }
+        },
+        {
+          "p": "Periférne zariadenie je daný jeho konkrétnym uzlom: <code>/dev/ttyUSB0</code>, <code>/dev/ttyACM0</code>, <code>/dev/apex_0</code> alebo <code>/dev/bus/usb/BBB/DDD</code>. Sprístupnenie celého <code>/dev</code> nie je akceptovaný. Coral je ponúkaný len pre aplikácie, ktorých profil deklaruje."
+        }
+      ]
+    },
+    {
+      "id": "trees",
+      "title": "Stromy zariadení a funkcie LXC",
+      "blocks": [
+        {
+          "table": {
+            "headers": [
+              "Žiadosť",
+              "Výsledná konfigurácia",
+              "Rozsah"
+            ],
+            "rows": [
+              [
+                "<code>/dev/dvb</code>, <code>/dev/snd</code> alebo <code>/dev/bus/usb</code>",
+                "Každý uzol znakového zariadenia v strome dostane vlastnú položku <code>devN</code> s režimom a GID hostiteľa",
+                "Len požadovaný strom, nie zvyšok <code>/dev</code>"
+              ],
+              [
+                "<code>/dev/fuse</code>",
+                "Uzol a, keď ho profil potrebuje, funkcia <code>fuse=1</code>",
+                "Samotná FUSE nepublikuje pripojenia do iných LXC"
+              ],
+              [
+                "<code>/dev/net/tun</code>",
+                "Položka <code>devN</code> s rovnakou cestou vo vnútri LXC",
+                "VPN alebo konfigurácia siete zostáva v aplikácii"
+              ],
+              [
+                "<code>/dev/kvm</code>",
+                "Potvrdená položka <code>devN</code>",
+                "Ponúkané iba vtedy, keď o to zmluva požiada"
+              ]
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "security",
+      "title": "Potvrdenie podľa úrovne rizika",
+      "blocks": [
+        {
+          "p": "Konkrétne zariadenia, voliteľné privilégium, požadované privilégium, AppArmor alebo seccomp relaxácia a prístup k mennému priestoru PID hostiteľa sa považujú za samostatné prípady, nie pod jedným generickým privilegovaným označením. Každá možnosť s rizikom sa vysvetľuje a potvrdzuje počas inštalácie."
+        }
+      ]
+    }
+  ]
+}
diff --git a/web/messages/sk/docs/oci-manager/index.json b/web/messages/sk/docs/oci-manager/index.json
new file mode 100644
index 00000000..00fea885
--- /dev/null
+++ b/web/messages/sk/docs/oci-manager/index.json
@@ -0,0 +1,213 @@
+{
+  "meta": {
+    "title": "OCI manager Apps | ProxMenux",
+    "description": "Spúšťajte oficiálne obrazy OCI ako natívne kontajnery LXC v Proxmox VE, s trvalými údajmi, prístupom k zariadeniam, aplikáciami s viacerými kontajnermi a transakčnými aktualizáciami."
+  },
+  "header": {
+    "title": "OCI manager Apps",
+    "description": "Oficiálne obrazy OCI bežia ako natívne kontajnery LXC v Proxmox VE. Používa sa rovnaký obraz, aký zverejňuje jeho správca; ProxMenux vytvorí prostredie, ktoré by okolo neho pripravil Docker Compose.",
+    "section": "OCI manager Apps"
+  },
+  "sections": [
+    {
+      "id": "model",
+      "blocks": [
+        {
+          "calloutInfo": {
+            "title": "Jeden obraz OCI, jeden natívny LXC",
+            "body": "V kontajneroch nebeží Docker Engine. Proxmox VE importuje súborový systém obrazu a jeho metadáta OCI. Aplikácia sa stane hlavným procesom natívneho LXC, ktorý sa spravuje rovnakými nástrojmi ako ostatné kontajnery uzla."
+          }
+        },
+        {
+          "flow": {
+            "nodes": [
+              {
+                "label": "Zdroj",
+                "detail": "Obraz OCI\nCompose a dokumentácia"
+              },
+              {
+                "label": "ProxMenux",
+                "detail": "Kontrakt JSON\noverenie a plánovanie"
+              },
+              {
+                "label": "Proxmox VE",
+                "detail": "Natívny LXC\nzväzky a zariadenia"
+              }
+            ],
+            "caption": "Používa sa pôvodná aplikácia; jej prostredie sa deklaratívne opíše a následne znovu vytvorí."
+          }
+        }
+      ]
+    },
+    {
+      "id": "where",
+      "title": "Kde ho nájdete",
+      "intro": "Na uzle Proxmox otvorte ako root položku <strong>OCI manager Apps (Technology Preview)</strong> v hlavnom menu ProxMenux. Úvodná obrazovka ponúka:",
+      "blocks": [
+        {
+          "list": {
+            "items": [
+              "<strong>Vyhľadať aplikácie</strong> – vyhľadávanie podľa názvu v celom katalógu.",
+              "<strong>Všetky aplikácie</strong> – úplný katalóg s počtom aplikácií.",
+              "<strong>Spravovať nainštalované aplikácie OCI</strong> – aktualizovať, upravovať, odstraňovať alebo obnovovať existujúce inštalácie.",
+              "<strong>Účty registrov</strong> – správa účtov na inštaláciu a aktualizáciu obrazov zo súkromných registrov.",
+              "<strong>Nainštalovať obraz mimo katalógu</strong> – prispôsobiť súbor Compose, príkaz <code>docker run</code> alebo odkaz na obraz.",
+              "Kategórie katalógu, každá s počtom aplikácií."
+            ]
+          }
+        },
+        {
+          "figure": {
+            "src": "/oci-manager/main-menu.png",
+            "alt": "Hlavná obrazovka OCI manager Apps s vyhľadávaním, úplným katalógom, správou aplikácií, obrazmi mimo katalógu a kategóriami.",
+            "caption": "Hlavná obrazovka OCI manager Apps."
+          }
+        },
+        {
+          "p": "Po výbere aplikácie sa zobrazí jej opis, používaný obraz a dva režimy inštalácie. <strong>Inštalovať s predvolenými nastaveniami</strong> sa pýta len na základné voľby: úložisko, umiestnenie údajov, adresu a spustenie. <strong>Inštalovať s rozšírenými nastaveniami</strong> postupne prejde všetky rozhodnutia: VMID a zdroje, úložisko pre každú cestu, sieťový most a zariadenia."
+        },
+        {
+          "p": "Aplikácie, ktoré boli skutočne otestované, majú v tomto zobrazení označenie <strong>Overené</strong> a v zoznamoch značku ✓. Platí to pre testy v laboratóriu ProxMenux aj pre testy komunity."
+        }
+      ]
+    },
+    {
+      "id": "beta",
+      "title": "Prečo má označenie Technology Preview",
+      "blocks": [
+        {
+          "p": "OCI manager Apps ponecháva označenie <strong>Technology Preview</strong>, ktoré Proxmox VE používa pre aplikačné kontajnery vytvorené z obrazov OCI. Ich podpora bola zavedená v Proxmox VE 9.1. Označenie sa týka technológie, na ktorej OCI manager Apps beží, nie jadra ProxMenuxu: správanie týchto kontajnerov sa ešte môže meniť medzi vydaniami Proxmox VE. Označenie zostane, kým Proxmox VE túto podporu neoznačí za stabilnú."
+        },
+        {
+          "p": "Funkcie OCI manager Apps sa testujú v laboratóriu ProxMenux: inštalácia, aktualizácia, úpravy, opätovné vytvorenie, zálohovanie, obnova, migrácia a watchdog. Každá aplikácia sa overuje samostatne. Skutočne otestované aplikácie majú označenie <strong>Overené</strong> a v zoznamoch značku ✓."
+        }
+      ]
+    },
+    {
+      "id": "translation",
+      "title": "Ako Docker opisuje požiadavky a OCI manager Apps ich realizuje",
+      "blocks": [
+        {
+          "table": {
+            "headers": [
+              "Požiadavka",
+              "Vyjadrenie v Dockeri",
+              "Realizácia v OCI manager Apps"
+            ],
+            "rows": [
+              [
+                "Spustiť aplikáciu",
+                "<code>image</code>, <code>entrypoint</code>, <code>command</code>",
+                "Rootfs obrazu OCI a hlavný proces LXC"
+              ],
+              [
+                "Zachovať konfiguráciu",
+                "<code>volumes: /config</code>",
+                "Trvalý zväzok <code>mpN</code> zahrnutý do zálohy alebo adresár na hostiteľovi."
+              ],
+              [
+                "Sprístupniť službu",
+                "<code>ports</code>",
+                "Vlastná adresa pre LXC a URL na prístup k službe."
+              ],
+              [
+                "Použiť hardvér",
+                "<code>devices</code>, <code>group_add</code>",
+                "Záznamy <code>devN</code> s efektívnym GID hostiteľa a overeným profilom."
+              ],
+              [
+                "Prepojiť závislosti",
+                "<code>networks</code>, <code>depends_on</code>",
+                "Súkromný sieťový most, pevné adresy, poradie spúšťania a kontroly stavu."
+              ],
+              [
+                "Aktualizovať",
+                "Stiahnuť cez <code>pull</code> a znovu vytvoriť",
+                "Nový rootfs so zachovaným kontraktom trvalých údajov."
+              ]
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "kept",
+      "title": "Čo zostáva a čo sa mení",
+      "blocks": [
+        {
+          "cards": {
+            "items": [
+              {
+                "icon": "archive",
+                "title": "Zachované",
+                "body": "Oficiálny obraz, jeho vnútorné cesty, prostredie, proces spustenia a dokumentácia používania."
+              },
+              {
+                "icon": "boxes",
+                "title": "Prispôsobené",
+                "body": "Prostredie behu: sieť, trvalé údaje, zariadenia, oprávnenia a závislosti využívajú natívne mechanizmy LXC v Proxmox VE."
+              },
+              {
+                "icon": "shield",
+                "title": "Bez ekvivalentu",
+                "body": "Voľba Compose bez bezpečného ekvivalentu sa označí ako prekážka inštalácie. Šablóny s takými prekážkami sa na inštaláciu neponúkajú a citlivé voľby vyžadujú potvrdenie v sprievodcovi."
+              },
+              {
+                "icon": "refresh",
+                "title": "Uložené",
+                "body": "Digest obrazu, zdroje, cesty, sieť, zariadenia a príslušnosť k zostave sa ukladajú do kontraktu inštancie. Aktualizácie aj opätovné vytvorenie tento kontrakt zachovávajú."
+              }
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "pages",
+      "title": "Stránky tejto časti",
+      "blocks": [
+        {
+          "next": {
+            "items": [
+              {
+                "label": "Ako sa prispôsobí obraz OCI",
+                "href": "/docs/oci-manager/architecture",
+                "tail": "Od obrazu a jeho súboru Compose k natívnemu LXC."
+              },
+              {
+                "label": "Inštalácia obrazu mimo katalógu",
+                "href": "/docs/oci-manager/custom-image",
+                "tail": "Súbor Compose, príkaz docker run alebo odkaz na obraz."
+              },
+              {
+                "label": "Údaje, cesty a sieť",
+                "href": "/docs/oci-manager/storage-network",
+                "tail": "Zväzky kontajnera, adresáre hostiteľa, pripojenia cez rclone a adresy."
+              },
+              {
+                "label": "Zariadenia a akcelerácia",
+                "href": "/docs/oci-manager/hardware",
+                "tail": "GPU, NVIDIA, Coral, USB a ďalšie zariadenia."
+              },
+              {
+                "label": "Aplikácie s viacerými kontajnermi",
+                "href": "/docs/oci-manager/stacks",
+                "tail": "Aplikácia, databáza a vyrovnávacia pamäť v koordinovaných LXC."
+              },
+              {
+                "label": "Inštalácia, aktualizácia a úpravy",
+                "href": "/docs/oci-manager/lifecycle",
+                "tail": "Kontrakt inštancie a operácie s ním."
+              },
+              {
+                "label": "V ProxMenux Monitor",
+                "href": "/docs/oci-manager/monitor",
+                "tail": "Verzie, aktualizácie, výstup konzoly a terminál."
+              }
+            ]
+          }
+        }
+      ]
+    }
+  ]
+}
diff --git a/web/messages/sk/docs/oci-manager/lifecycle.json b/web/messages/sk/docs/oci-manager/lifecycle.json
new file mode 100644
index 00000000..5f345b34
--- /dev/null
+++ b/web/messages/sk/docs/oci-manager/lifecycle.json
@@ -0,0 +1,499 @@
+{
+  "meta": {
+    "title": "Inštalácia, aktualizácia a úpravy | ProxMenux",
+    "description": "Kontrakt inštancie kontajnera OCI a operácie, ktoré ho používajú: aktualizácia, úprava, odstránenie, zotavenie z prerušenej operácie a obnovenie prevádzky po obnove zo zálohy na tomto alebo inom hostiteľovi."
+  },
+  "header": {
+    "title": "Inštalácia, aktualizácia a úpravy",
+    "description": "Každá inštancia uchováva reprodukovateľný kontrakt, takže jej rootfs možno nahradiť bez straty konfigurácie alebo trvalých dát.",
+    "section": "OCI manager Apps"
+  },
+  "sections": [
+    {
+      "id": "contract",
+      "title": "Kontrakt inštancie",
+      "blocks": [
+        {
+          "p": "Po inštalácii sa výsledná konfigurácia uloží do <code>/usr/local/share/proxmenux/oci/instances/VMID/oci-compose.json</code>. Nejde o kópiu pôvodného súboru Compose: je to reprodukovateľný kontrakt kontajnera LXC, ktorý existuje na tomto hostiteľovi."
+        },
+        {
+          "code": {
+            "code": "instances/\n└── 105/\n    └── oci-compose.json\n        ├── image and resolved digest\n        ├── resources and network\n        ├── environment (secrets protected)\n        ├── container disks and host directories\n        ├── hardware profile and devices\n        ├── console log and terminal mode\n        └── stack membership and lifecycle"
+          }
+        },
+        {
+          "p": "Kópia kontraktu sa nachádza v kontajneri v <code>/.proxmenux/oci-record.json</code> a môže ju čítať iba používateľ root kontajnera. Záloha kontajnera preto vždy obsahuje kontrakt platný v čase zálohovania. Druhá kópia je uložená v <code>/etc/pve/priv/proxmenux/oci</code>, ktorý zdieľajú všetky uzly klastra a môže ho čítať iba root hostiteľa. Obe kópie sa zapisujú po každej inštalácii, aktualizácii a zmene."
+        }
+      ]
+    },
+    {
+      "id": "manage",
+      "title": "Spravovať nainštalované aplikácie OCI",
+      "intro": "Táto možnosť na hlavnej obrazovke zobrazí registrované inštancie s ich aplikáciou a obrazom. Pred každou akciou sa každá inštancia porovná so svojím kontraktom; CT, ktorý už nezodpovedá svojmu záznamu, sa neupraví ani neodstráni. Rovnaká aktualizácia a rovnaký editor sú dostupné na karte Aktualizácie v <monitorLink>ProxMenux Monitor</monitorLink>.",
+      "blocks": [
+        {
+          "table": {
+            "headers": [
+              "Možnosť",
+              "Čo sa zmení?",
+              "Čo sa uchováva"
+            ],
+            "rows": [
+              [
+                "Aktualizovať obraz pomocou uloženej konfigurácie",
+                "Rootfs sa nahradí obrazom, ktorý uložený kanál aktuálne publikuje",
+                "Zmluva, kontajnerové disky, hostiteľské adresáre, siete a zariadenia"
+              ],
+              [
+                "Upraviť: upraviť zdroje, sieť, cesty a GPU",
+                "Editor sa otvorí s aktuálnym kontraktom; CT sa znova vytvorí so zmenami",
+                "Dáta kontajnerových diskov a hostiteľských adresárov"
+              ],
+              [
+                "Watchdog: reštartovať aplikáciu pri havárii",
+                "Určuje, či sa aplikácia znova spustí, keď sa sama zastaví. Nič sa nevytvára znova",
+                "Celá inštalácia; len voľba je uložená v zmluve"
+              ],
+              [
+                "Odstrániť: odstrániť aplikáciu a jej kontajnery",
+                "LXC alebo všetci členovia zostavy a ich kontrakty sa odstránia",
+                "Hostiteľské adresáre s obsahom"
+              ]
+            ]
+          }
+        },
+        {
+          "p": "Pre aplikáciu s viacerými kontajnermi menu ponúka <strong>Aktualizovať všetky kontajnery aplikácie</strong>, <strong>Upraviť ďalšie cesty a zariadenia</strong>, <strong>Znovu vytvoriť všetky kontajnery s uloženou konfiguráciou</strong>, watchdog a odstránenie. Úprava pridáva alebo odstraňuje ďalšie cesty a zariadenia aplikačného kontajnera bez opätovného vytvárania. V Immich tiež mení zariadenie, ktoré vykonáva rozpoznávanie. Opätovné vytvorenie zostaví každý kontajner z pôvodne nainštalovaného obrazu bez vyhľadávania novšieho."
+        },
+        {
+          "figure": {
+            "src": "/oci-manager/manage-menu.png",
+            "alt": "Zoznam nainštalovaných aplikácií OCI s možnosťami aktualizácie, úpravy a odstránenia",
+            "caption": "Spravovať nainštalované aplikácie OCI."
+          }
+        }
+      ]
+    },
+    {
+      "id": "update",
+      "title": "Transakčná aktualizácia",
+      "blocks": [
+        {
+          "mermaid": {
+            "chartCode": "sequenceDiagram\n participant U as {{user}}\n participant P as ProxMenux\n participant R as {{registry}}\n participant X as Proxmox VE\n U->>P: {{update}}\n P->>R: {{resolve}}\n R-->>P: digest\n P->>P: {{verify}}\n P->>X: {{backup}}\n P->>X: {{import}}\n P->>X: {{reapply}}\n X-->>P: healthcheck\n alt {{healthy}}\n  P-->>U: {{commit}}\n else {{failure}}\n  P->>X: Rollback\n  P-->>U: {{restored}}\n end",
+            "labels": {
+              "user": "Používateľ",
+              "registry": "Register OCI",
+              "update": "Aktualizovať inštanciu",
+              "resolve": "Zistiť obraz podľa značky",
+              "verify": "Overiť archív a vykonať predbežné kontroly",
+              "backup": "Zastaviť a zálohovať CT",
+              "import": "Importovať nové rootfs",
+              "reapply": "Znova použiť kontrakt",
+              "healthy": "v poriadku",
+              "failure": "zlyhanie",
+              "commit": "Kontrakt zverejnený s novým digestom",
+              "restored": "Predchádzajúca inštancia obnovená"
+            }
+          }
+        },
+        {
+          "list": {
+            "items": [
+              "Ak register stále poskytuje nainštalovaný digest, nič sa nesťahuje a inštancia zostáva nezmenená.",
+              "Nový obraz sa overí vrstvu po vrstve ešte pred zastavením CT. Poškodené stiahnutie sa zopakuje druhýkrát; obraz už uložený vo vyrovnávacej pamäti, ktorý neprejde kontrolou, sa stiahne znova.",
+              "Nastavenia zmenené v Proxmox VE po inštalácii (pamäť, swap, jadrá, limit CPU, priorita CPU, spustenie spolu s uzlom) sa zachovajú a prenesú do nového kontraktu.",
+              "Rozhranie LAN, ktoré pridáva súprava Arr a aplikácie s viacerými kontajnermi (<code>net1</code>), aj poradie spúšťania (<code>startup</code>) sa bez zmeny prenesú do nového kontajnera.",
+              "Akýkoľvek iný rozdiel medzi CT a jeho zmluvou zastaví aktualizáciu pred zastavením CT."
+            ]
+          }
+        },
+        {
+          "flow": {
+            "nodes": [
+              {
+                "label": "Pred",
+                "detail": "rootfs A\n/config mp0\n/media hostiteľský adresár"
+              },
+              {
+                "label": "Aktualizácia",
+                "detail": "nahradí iba\nrootfs"
+              },
+              {
+                "label": "Po",
+                "detail": "rootfs B\n/config mp0\n/media hostiteľský adresár"
+              }
+            ]
+          }
+        },
+        {
+          "p": "Pred zastavením čohokoľvek sa overí dostatok miesta pre zálohu: využité dáta na zálohovaných zväzkoch plus rezerva. Záloha sa zapisuje vedľa záznamu aplikácie na systémový disk hostiteľa. Ak tam nie je dosť miesta, ponuka vyžiada iné úložisko hostiteľa podporujúce zálohy. Záloha sa vytvorí tam a po skončení operácie sa odstráni. Výber sa zapamätá pre danú aplikáciu aj pre plánované aktualizácie. Ak žiadne úložisko nemá dosť miesta, operácia sa odmietne a aplikácia zostane nezmenená. Rovnako sa pred stiahnutím overí miesto pre nový obraz."
+        }
+      ]
+    },
+    {
+      "id": "recovery",
+      "title": "Zotavenie z prerušenej operácie",
+      "intro": "Aktualizácia aj úprava používajú trvalo uloženú transakciu. Ak sa proces, terminál alebo uzol preruší po zastavení CT, operácia sa nepovažuje za dokončenú.",
+      "blocks": [
+        {
+          "steps": {
+            "items": [
+              {
+                "title": "Značka nedokončenej operácie",
+                "body": "Keď sa otvorí správa nainštalovaných aplikácií OCI, uložený stav ukazuje, že výmena nebola nikdy zverejnená."
+              },
+              {
+                "title": "Zobraziť stav",
+                "body": "Zobrazí dosiahnutú fázu bez zmeny kontajnerov alebo dát."
+              },
+              {
+                "title": "Obnoviť predchádzajúcu inštaláciu",
+                "body": "Obnoví overenú natívnu zálohu vytvorenú pred výmenou aj predchádzajúci kontrakt."
+              },
+              {
+                "title": "Zostavy ako celok",
+                "body": "V prípade aplikácie s viacerými kontajnermi je každý člen obnovený z rovnakého transakčného bodu, nielen z vybraného."
+              }
+            ]
+          }
+        },
+        {
+          "calloutWarning": {
+            "title": "Hostiteľské adresáre sú mimo návratu do pôvodného stavu",
+            "body": "Záloha zahŕňa rootfs a disky kontajnera, ktoré sú do nej zahrnuté. Hostiteľský adresár sa nevracia do predchádzajúceho stavu, pretože jeho dáta môžu používať iné kontajnery LXC."
+          }
+        }
+      ]
+    },
+    {
+      "id": "watchdog",
+      "title": "Watchdog: reštartovanie aplikácie, ktorá sa zastaví",
+      "intro": "Proxmox nemá politiku reštartovania: keď sa proces aplikačného kontajnera skončí, kontajner zostane zastavený. Pri zapnutom watchdogu sa aplikácia, ktorá sa sama zastaví, znova spustí. Pre aplikáciu OCI zabezpečuje to, čo <code>restart: unless-stopped</code> v súbore Compose.",
+      "blocks": [
+        {
+          "table": {
+            "headers": [
+              "Čo sa stane?",
+              "So zapnutým watchdogom"
+            ],
+            "rows": [
+              [
+                "Aplikácia havaruje alebo jej proces končí",
+                "Kontajner sa znova spustí do niekoľkých sekúnd"
+              ],
+              [
+                "Zastaví sa alebo vypne cez Proxmox, Monitor alebo pomocou <code>pct</code>",
+                "Zostane zastavený, kým ho niekto nespustí"
+              ],
+              [
+                "Pracuje na tom záloha, migrácia alebo operácia ProxMenux",
+                "Nič sa nerobí, kým to neskončí."
+              ],
+              [
+                "Bol už zastavený pri spustení hostiteľa",
+                "Zostane zastavený; rozhoduje o tom <strong>Spustiť s Proxmox</strong>"
+              ],
+              [
+                "Opakovane sa zastavuje hneď po spustení",
+                "Aplikácia, ktorá sa zastaví v priebehu niekoľkých sekúnd po spustení alebo sa nespustí vôbec, sa skúsi spustiť päťkrát s odstupmi 30 sekúnd, 1, 2 a 5 minút. Potom zostane zastavená a odošle sa oznámenie"
+              ]
+            ]
+          }
+        },
+        {
+          "p": "Inštalátor sa na túto možnosť pýta v oboch režimoch inštalácie a navrhuje hodnotu uvedenú v recepte aplikácie. Neskôr sa mení cez <strong>Spravovať nainštalované aplikácie OCI</strong> alebo prepínačom <strong>Watchdog</strong> kontajnera v <monitorLink>ProxMenux Monitor</monitorLink> a platí pre všetky kontajnery aplikácie. Jediná služba hostiteľa, <code>proxmenux-oci-watchdog.service</code>, sleduje všetky aplikácie, ktoré si to vyžiadali; jej inštalácia je uvedená na karte Zmeny v Audit & Report."
+        },
+        {
+          "calloutInfo": {
+            "title": "Čo hostiteľ nevie povedať",
+            "body": "Návratový kód aplikácie sa k hostiteľovi nedostane, takže riadne ukončenie a pád vyzerajú rovnako a v oboch prípadoch nasleduje reštart, podobne ako pri <code>always</code> a <code>unless-stopped</code> v Dockeri. Zastavenie vyžiadané mimo Proxmox pomocou <code>lxc-stop</code> alebo <code>systemctl</code> nevytvorí úlohu zastavenia a považuje sa za samovoľné zastavenie."
+          }
+        }
+      ]
+    },
+    {
+      "id": "restore",
+      "title": "Zálohovanie, obnova a ďalší hostiteľ",
+      "intro": "Záloha vytvorená pomocou vzdump alebo Proxmox Backup Server obsahuje kontajner, disky kontajnera vybrané na zálohovanie a kópiu jeho kontraktu. To, čo inštalácia uchováva na hostiteľovi, do nej nepatrí. <strong>Spravovať nainštalované aplikácie OCI</strong> rozpozná kontajnery obnovené na hostiteľovi, ktorý nemá ich kontrakt, napríklad po novej inštalácii Proxmox alebo na inom hostiteľovi, a ponúkne ich opätovnú registráciu.",
+      "blocks": [
+        {
+          "steps": {
+            "items": [
+              {
+                "title": "Obnoviť kontajnery v Proxmoxe",
+                "body": "Zo zálohovacieho úložiska, s pôvodným ID alebo ľubovoľným voľným ID. Aplikácia s viacerými kontajnermi potrebuje všetky svoje kontajnery."
+              },
+              {
+                "title": "Otvoriť Spravovať nainštalované aplikácie OCI",
+                "body": "Zobrazia sa obnovené kontajnery a ponúkne sa obnovenie. Tlačidlo <strong>Obnoviť</strong> na karte Aktualizácie <monitorLink>ProxMenux Monitor</monitorLink> otvorí rovnaké obnovenie."
+              },
+              {
+                "title": "Pred zmenou skontrolujte",
+                "body": "Obnova overí, či hostiteľ má všetko, čo každá aplikácia potrebuje. Aplikácia, ktorú nemožno obnoviť ako celok, zostane nezmenená a uvedie sa dôvod."
+              },
+              {
+                "title": "Registrácia a spustenie",
+                "body": "Kontrakt sa zaregistruje na tomto hostiteľovi a znova sa zapíše to, čo na ňom inštalácia uchovávala. Spustenie aplikácií je samostatná otázka, na ktorú treba odpovedať Nie, ak pôvodné kontajnery stále bežia na inom hostiteľovi."
+              }
+            ]
+          }
+        },
+        {
+          "figure": {
+            "src": "/oci-manager/restore-offer.png",
+            "alt": "Dialóg, ktorý uvádza obnovené kontajnery a ponúka ich obnoviť",
+            "caption": "Obnova ponúknutá po otvorení Spravovať nainštalované aplikácie OCI."
+          }
+        },
+        {
+          "table": {
+            "headers": [
+              "Čo si hostiteľ nechal?",
+              "Po zotavení"
+            ],
+            "rows": [
+              [
+                "Kontrakt inštancie",
+                "Zaregistruje sa z kópie v kontajneri, ktorá sa porovná s konfiguráciou obnovenou systémom Proxmox"
+              ],
+              [
+                "Súkromná sieť multikontajnerovej aplikácie",
+                "Znova sa vytvorí s rovnakým mostom a podsieťou; pevné adresy kontajnerov sa nezmenia"
+              ],
+              [
+                "Poradie spúšťania aplikácie s viacerými kontajnermi",
+                "Hookscript závislostí a jeho kontrakt sa znova nainštalujú; ak žiadne úložisko nepodporuje snippets, povolia sa na úložisku <code>local</code>"
+              ],
+              [
+                "Sieťové sysctls a súbor host-monitor",
+                "Znova sa zapíšu do <code>/etc/pve/proxmenux</code>"
+              ],
+              [
+                "Runtime NVIDIA",
+                "Hook neprivilegovaného kontajnera sa znova nainštaluje. Privilegovaný kontajner dostane súbory ovládača tohto hostiteľa namiesto súborov pôvodného hostiteľa"
+              ],
+              [
+                "Pripojenie Rclone",
+                "Hookscript a programy, ktoré sprístupňujú pripojenie, sa znova zapíšu s rovnakými pohľadmi na hostiteľovi"
+              ],
+              [
+                "Pravidlo firewallu hostiteľa pre monitor hostiteľa",
+                "Znova sa vyžiada súhlas pre webový port a podsieť mosta na tomto hostiteľovi"
+              ],
+              [
+                "<code>lost+found</code> z každého obnoveného disku",
+                "Odstráni sa, ak je prázdny; obnova ho vytvorí a niektoré aplikácie sa nespustia, ak je medzi ich dátami"
+              ],
+              [
+                "Disky obnovené na inom úložisku",
+                "Kontrakt sa aktualizuje podľa úložiska, na ktorom sa teraz nachádzajú"
+              ]
+            ]
+          }
+        },
+        {
+          "p": "Kontajner obnovený s iným ID si zachová svoju aplikáciu. Kontrakt, záznam konzoly, sieťové nastavenia sysctl, hookscript pripojenia Rclone a poradie spúšťania viackontajnerovej aplikácie sa zaregistrujú s ID, ktoré majú kontajnery na tomto hostiteľovi."
+        },
+        {
+          "table": {
+            "headers": [
+              "Čo bráni obnove",
+              "Čo urobiť"
+            ],
+            "rows": [
+              [
+                "Chýba kontajner aplikácie s viacerými kontajnermi",
+                "Obnovte aj tento kontajner; aplikácia sa obnovuje ako celok"
+              ],
+              [
+                "Súkromná podsieť sa už používa na tomto hostiteľovi",
+                "Obnova sa zruší a nič sa nezmení: adresy kontajnerov sú pevné a nepresúvajú sa do inej podsiete"
+              ],
+              [
+                "Adresár hostiteľa neexistuje",
+                "Pripojiť alebo vytvoriť s jeho dátami; záloha kontajnera nezahŕňa adresáre hostiteľa"
+              ],
+              [
+                "Zariadenie neexistuje na tomto hostiteľovi",
+                "Pripojte ho alebo ho odstráňte z kontajnera v Proxmox"
+              ],
+              [
+                "Aplikácia s NVIDIA na hostiteľovi bez ovládača",
+                "Nainštalujte ovládač NVIDIA a Container Toolkit"
+              ],
+              [
+                "Záloha bola vytvorená skôr, než existovala kópia kontraktu",
+                "Kontajner zostáva ako bežný LXC a nie je opäť ponúkaný"
+              ]
+            ]
+          }
+        },
+        {
+          "calloutInfo": {
+            "title": "Kontajner, ktorý sa vráti",
+            "body": "Kontajner obnovený s pôvodným ID zo staršej zálohy, vrátený do snímky alebo presunutý späť z iného uzla nesie kontrakt svojho aktuálneho stavu. Ak sa pri výbere na operáciu jeho kontrakt líši od kontraktu na tomto hostiteľovi, operácia sa nespustí a ponúkne sa obnova kontajnera."
+          }
+        },
+        {
+          "figure": {
+            "src": "/oci-manager/restore-result.png",
+            "alt": "Výsledok obnovy so súkromnou sieťou, poradím spúšťania a zaregistrovanými kontajnermi",
+            "caption": "Výsledok zotavenia, krok za krokom."
+          }
+        }
+      ]
+    },
+    {
+      "id": "remove",
+      "title": "Odstránenie aplikácie OCI",
+      "blocks": [
+        {
+          "p": "Pred potvrdením je zostavený súhrn zo skutočnej konfigurácie: kontajnery, ktoré sú odstránené, údaje s nimi vymazané, súkromná sieť, ktorá je uvoľnená a hostiteľské adresáre, ktoré sú uchovávané. Potvrdenie je predvolene <strong>Nie</strong>, pretože údaje z vymazaných diskov nie je možné následne obnoviť."
+        },
+        {
+          "table": {
+            "headers": [
+              "Prostriedok",
+              "Po odstránení",
+              "Dôvod"
+            ],
+            "rows": [
+              [
+                "rootfs a kontajnerové disky",
+                "Odstránia sa",
+                "Patria len do kontajnera."
+              ],
+              [
+                "Adresár hostiteľa",
+                "Zachová sa aj s obsahom",
+                "Iné aplikácie ho môžu používať"
+              ],
+              [
+                "Hostiteľské súbory kontajnera",
+                "Odstránia sa",
+                "Jeho záznam konzoly, sieťové parametre sysctl, hookscript pripojenia Rclone a registrácia na karte App v ProxMenux Monitor neslúžia žiadnemu inému kontajneru"
+              ],
+              [
+                "Súbory zdieľané viacerými inštaláciami",
+                "Vymazané s poslednou inštaláciou, ktorá ich používa",
+                "Súbor monitora hostiteľa a hookscript závislostí aplikácií s viacerými kontajnermi"
+              ],
+              [
+                "Kontrakt inštancie",
+                "Odstráni sa po úspešnom odstránení aplikácie",
+                "Už s ním nie je spojený žiadny CT"
+              ],
+              [
+                "Súkromný most zostavy",
+                "Uvoľní sa spolu so zostavou",
+                "Nemá žiadnych členov na pripojenie"
+              ],
+              [
+                "Sieť zdieľaná súpravou Arr",
+                "Uvoľní sa s poslednou aplikáciou súpravy",
+                "Každá aplikácia súpravy je nezávislá a odstraňuje sa samostatne"
+              ],
+              [
+                "Jeden člen zostavy",
+                "Neodstránené samostatne",
+                "Odstráni sa celá aplikácia, aby nezostala neúplná zostava"
+              ],
+              [
+                "Kontajner na inom uzle klastra",
+                "Neodstránené",
+                "Jeho záznam a súbory na hostiteľovi sú na uzle, kde bol nainštalovaný: odstráni sa tam po migrácii späť"
+              ]
+            ]
+          }
+        },
+        {
+          "figure": {
+            "src": "/oci-manager/remove-summary.png",
+            "alt": "Prehľad odstránenia s dotknutými kontajnermi, dátami a adresármi hostiteľa",
+            "caption": "Prehľad odstránenia, postavený z reálnej konfigurácie."
+          }
+        }
+      ]
+    },
+    {
+      "id": "archives",
+      "title": "Stiahnuté obrazy a miesto na hostiteľovi",
+      "blocks": [
+        {
+          "p": "Archív OCI slúži na vytvorenie rootfs; bežiaci CT ho nečíta. Po inštalácii alebo aktualizácii sa zobrazia archívy stiahnuté počas danej operácie aj s ich veľkosťou a ponúkne sa ich odstránenie. Odstránením sa uvoľní miesto bez vplyvu na kontajner alebo jeho dáta."
+        },
+        {
+          "calloutInfo": {
+            "title": "Aktualizácie nepotrebujú archív",
+            "body": "Bez archívu aktualizácia vyrieši uložený kanál a stiahne nový digest. S ním sa archív znova použije iba vtedy, keď sa jeho referencia a integrita zhodujú s požadovaným."
+          }
+        }
+      ]
+    },
+    {
+      "id": "registry",
+      "title": "Register a čistenie",
+      "blocks": [
+        {
+          "p": "Pri otvorení <strong>Spravovať nainštalované aplikácie OCI</strong> sa najskôr odstránia pozostatky kontajnerov, ktoré už neexistujú na žiadnom uzle klastra: uložený záznam kontajnera odstráneného cez rozhranie Proxmox, uchovávaný ako história, a súbory hostiteľa, ktoré zostali po odstránení. Záznam s nedokončenou operáciou sa zachová, pretože jeho záloha môže byť ešte potrebná. Zväzky ani adresáre hostiteľa sa nikdy neodstraňujú na základe domnienok."
+        }
+      ]
+    },
+    {
+      "id": "cluster",
+      "title": "V klastri: migrácia a vysoká dostupnosť",
+      "intro": "Kontajner OCI je bežný LXC Proxmox: možno ho migrovať alebo spravovať pomocou HA ako ostatné, s rovnakými obmedzeniami. Všetko potrebné na spustenie je uložené tam, kde to nájde každý uzol klastra.",
+      "blocks": [
+        {
+          "table": {
+            "headers": [
+              "Časť",
+              "Na inom uzle klastra"
+            ],
+            "rows": [
+              [
+                "Konzolový log",
+                "Kontajner pred spustením vytvorí <code>/var/log/proxmenux/oci</code> na uzle, ktorý ho spúšťa. Každý uzol uchováva záznam spustení, ktoré vykonal."
+              ],
+              [
+                "Sieťové parametre sysctl a monitor hostiteľa",
+                "Uchovávajú sa v <code>/etc/pve/proxmenux</code>, ktorý zdieľajú všetky uzly klastra, takže migrovaný kontajner ich nájde."
+              ],
+              [
+                "Kontajnerové disky",
+                "Proxmox ich presúva s kontajnerom. HA potrebuje mať ich dáta dostupné na cieľovom uzle cez zdieľané úložisko alebo podporovanú konfiguráciu replikácie."
+              ],
+              [
+                "Hostiteľské adresáre a zariadenia",
+                "Rovnaké pravidlá ako všetky LXC: hostiteľský adresár musí existovať na cieľovom uzle a musí byť označený ako zdieľaný a musí tam byť prítomný GPU, Coral alebo NPU."
+              ],
+              [
+                "Záznam ProxMenux",
+                "Kontrakt zostáva na uzle, kde bola aplikácia nainštalovaná, a každý uzol číta kópiu v <code>/etc/pve/priv/proxmenux/oci</code>. Migrovaná aplikácia s jedným kontajnerom sa zaregistruje na cieľovom uzle po otvorení <strong>Spravovať nainštalované aplikácie OCI</strong> alebo po spustení operácie pre danú aplikáciu. Aplikácia s viacerými kontajnermi sa tam ponúkne na obnovu, pretože jej súkromná sieť sa musí vytvoriť na tomto uzle."
+              ]
+            ]
+          }
+        },
+        {
+          "calloutWarning": {
+            "title": "Nie je určené pre vysokú dostupnosť",
+            "body": "Aplikácia s viacerými kontajnermi komunikuje so svojimi členmi cez súkromný most uzla, na ktorom bola nainštalovaná, preto jej členovia zostávajú na tomto uzle. Monitor hostiteľa, napríklad Glances v režime hostiteľa alebo Netdata, sleduje uzol, na ktorom beží; presunutím by sledoval iný uzol."
+          }
+        },
+        {
+          "p": "Pri obnove aplikácie dostane záloha obnovená mimo klastra súbory z <code>/etc/pve/proxmenux</code>, ktoré kontajner používa."
+        }
+      ]
+    },
+    {
+      "id": "channel",
+      "title": "Priebežne aktualizovaná značka neznamená bezobslužnú aktualizáciu",
+      "blocks": [
+        {
+          "p": "Katalóg nainštaluje priebežne aktualizovanú značku, ktorú publikuje správca, ale skutočný digest sa zistí a zaznamená a zmení sa iba explicitnou aktualizáciou s predbežnou kontrolou a možnosťou návratu späť. <monitorLink>ProxMenux Monitor</monitorLink> porovná nainštalovaný digest s digestom publikovaným registrom a zobrazí aj odošle upozornenie, keď je dostupný nový obraz."
+        }
+      ]
+    }
+  ]
+}
diff --git a/web/messages/sk/docs/oci-manager/monitor.json b/web/messages/sk/docs/oci-manager/monitor.json
new file mode 100644
index 00000000..e8b44003
--- /dev/null
+++ b/web/messages/sk/docs/oci-manager/monitor.json
@@ -0,0 +1,213 @@
+{
+  "meta": {
+    "title": "Kontajnery OCI v ProxMenux Monitor | ProxMenux",
+    "description": "Čo ProxMenux Monitor zobrazuje pre kontajner nainštalovaný cez OCI manager Apps: verzie aplikácie a obrazu, nové obrazy, výstup konzoly a terminál Proxmox VE."
+  },
+  "header": {
+    "title": "V ProxMenux Monitore",
+    "description": "Kontajner nainštalovaný cez OCI manager Apps sa zobrazuje v časti VM a LXC ako každý iný LXC. Jeho detail načíta záznam inštalácie: verzie aplikácie a obrazu, nové obrazy, výstup konzoly a terminál.",
+    "section": "OCI manager Apps"
+  },
+  "sections": [
+    {
+      "id": "intro",
+      "blocks": [
+        {
+          "calloutInfo": {
+            "title": "Záznam je zdroj",
+            "body": "OCI manager Apps vie, čo nainštaloval a odkiaľ to pochádza. Monitor načíta tento záznam inštalácie namiesto vyhľadávania aplikácie v kontajneri. Tieto údaje sú preto rovnaké pri spustenom aj zastavenom kontajneri."
+          }
+        },
+        {
+          "table": {
+            "headers": [
+              "Karta",
+              "Čo sa mení pri kontajneri OCI"
+            ],
+            "rows": [
+              [
+                "Stav",
+                "Prepínač <strong>Watchdog</strong> pod Start at boot: aplikácia sa znova spustí, keď sa sama zastaví"
+              ],
+              [
+                "Aplikácia",
+                "Aplikácia je identifikovaná zo záznamu a aktualizácie sú sledované obrazom"
+              ],
+              [
+                "Aktualizácie",
+                "Obraz je aktualizovaný alebo aplikácia upravená s rovnakým tokom ako OCI menu"
+              ],
+              [
+                "Pripojenia",
+                "Kontajnerové disky a hostiteľské adresáre s ich použitím"
+              ],
+              [
+                "Logy",
+                "Len pre kontajnery OCI: výstup konzoly aplikácie"
+              ]
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "app",
+      "title": "Aplikácia",
+      "intro": "Záložka <appLink>App</appLink> ponúka nainštalovanú aplikáciu ako detekciu s názvom, logom, portom a schémou záznamu. Zaregistrovanie otvára editor metódou <strong>Obraz OCI (nainštalovaný ProxMenux)</strong>, ktorá nepotrebuje konfiguráciu.",
+      "blocks": [
+        {
+          "cards": {
+            "items": [
+              {
+                "icon": "boxes",
+                "title": "Aplikácia",
+                "body": "Verzia aplikácie v obraze, načítaná zo samotného obrazu: z jeho prostredia alebo štítku <code>org.opencontainers.image.version</code>. Je to informatívny údaj."
+              },
+              {
+                "icon": "archive",
+                "title": "Obraz",
+                "body": "Dátum zostavenia a digest nainštalovaného obrazu. O aktualizácii sa rozhoduje tu: nainštalovaný digest sa porovná s tým, ktorý register dnes publikuje pre rovnakú značku."
+              }
+            ]
+          }
+        },
+        {
+          "list": {
+            "items": [
+              "Keď register zverejní nový digest, na karte sa zobrazí <strong>Nový obraz</strong> s jeho dátumom a digest, aj keď sa verzia aplikácie vo vnútri nezmenila: prestavba na aktualizovanej báze je aktualizáciou.",
+              "Keď sa hodnoty digest zhodujú, karta zobrazí <strong>Verzia</strong>.",
+              "Karta odkazuje na úložisko obrazu: jeho projekt GitHub alebo jeho stránku Docker Hub pre oficiálny obraz.",
+              "Prístupové spojenie používa LAN adresu kontajnera, aj pre hlavného člena viackontajnerovej aplikácie, ktorá má druhú adresu vo svojej súkromnej sieti.",
+              "Tlačidlo <strong>Obnoviť údaje</strong> znovu načíta záznam aj register obrazov. Možnosti vyhľadávania alebo registrácie ďalších aplikácií sa neponúkajú: kontajner obsahuje presne aplikáciu zo svojho záznamu."
+            ]
+          }
+        },
+        {
+          "figure": {
+            "src": "/oci-manager/monitor-app-tab.png",
+            "alt": "App záložka kontajnera OCI s verziou aplikácie, obrazom a odkazom na úložisko",
+            "caption": "Karta Aplikácia kontajnera nainštalovaného cez OCI manager Apps."
+          }
+        },
+        {
+          "p": "Kontrola prebieha raz denne s kontrolami aktualizácií monitora a <strong>Obnoviť údaje</strong> ju spustí okamžite. Nový obraz sa odošle ako upozornenie prostredníctvom kanálov nakonfigurovaných v <notificationsLink>Upozornenia</notificationsLink>. Aktualizácia sa aplikuje na karte Aktualizácie."
+        }
+      ]
+    },
+    {
+      "id": "updates",
+      "title": "Aktualizácie",
+      "intro": "Pri kontajneri nainštalovanom cez OCI manager Apps zobrazuje karta Aktualizácie aplikáciu s nainštalovaným obrazom a prípadným novým obrazom z registra, rovnako ako pri ostatných aplikáciách. Nástroje na aktualizáciu balíkov a aplikácií bežného LXC sa nezobrazujú.",
+      "blocks": [
+        {
+          "table": {
+            "headers": [
+              "Tlačidlo",
+              "Čo to otvára?"
+            ],
+            "rows": [
+              [
+                "Aktualizácia",
+                "Aktualizácia z časti <lifecycleLink>Spravovať nainštalované aplikácie OCI</lifecycleLink> pre tento kontajner v termináli Monitor. Možno ju spustiť aj bez nového obrazu; vtedy sa nič nezmení. Vo viackontajnerovej aplikácii aktualizuje všetkých členov."
+              ],
+              [
+                "Upraviť",
+                "Editor aplikácie (zdroje, sieť, cesty a GPU). Vo viackontajnerovej aplikácii pridáva alebo odstraňuje ďalšie cesty a zariadenia aplikačného kontajnera a v Immich mení, čo vykonáva rozpoznávanie."
+              ],
+              [
+                "Obnoviť",
+                "Nahradí Aktualizáciu po prerušení operácie na kontajneri a otvorí jeho obnovu."
+              ],
+              [
+                "Obnoviť (obnovený kontajner)",
+                "Zobrazí sa pri kontajneri obnovenom zo zálohy, ktorý na tomto hostiteľovi nemá kontrakt, v časti <strong>Obnovená aplikácia OCI</strong>. Otvorí <lifecycleLink>obnovu</lifecycleLink> v termináli Monitor; po registrácii sa zobrazia možnosti Aktualizovať a Upraviť."
+              ]
+            ]
+          }
+        },
+        {
+          "p": "Externé zmeny, hostiteľské adresáre a multikontajnerové aplikácie sú spracované ako v ponuke OCI. Vo viackontajnerovej aplikácii sa tlačidlá a možnosti zobrazia len na hlavnom kontajneri; ostatní členovia zobrazujú svoj obraz, poznámku, že sú aktualizované z hlavného kontajnera a tlačidlo, ktoré ho otvára. Keď sa terminál uzavrie, obraz, záznam a pripojenia sa znovu prečítajú."
+        },
+        {
+          "table": {
+            "headers": [
+              "Možnosť",
+              "Správanie"
+            ],
+            "rows": [
+              [
+                "Ponechať zálohu vytvorenú pred aktualizáciou",
+                "Každá aktualizácia zálohuje kontajner, aby ho bolo možné obnoviť pri zlyhaní aktualizácie. Pri tejto voľbe sa tá istá záloha ponechá vo vybranom úložisku a zobrazí medzi zálohami CT; pri Proxmox Backup Server sa záloha zapíše pred aktualizáciou."
+              ],
+              [
+                "Plánované aktualizácie",
+                "Obraz sa aktualizuje v zvolenom čase iba vtedy, keď register publikuje nový obraz; voliteľne až po jeho dosiahnutí veku 1, 3, 7 alebo 14 dní. Kontajner so zmenami mimo ProxMenux sa preskočí a nahlási."
+              ]
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "logs",
+      "title": "Logy",
+      "intro": "Karta Záznamy sa zobrazuje iba pri kontajneroch nainštalovaných cez OCI manager Apps, medzi kartami Pripojenia a Zálohy. Zobrazuje štandardný a chybový výstup hlavného procesu obrazu, teda rovnaký výstup ako <code>docker logs</code> pri kontajneri Docker.",
+      "blocks": [
+        {
+          "list": {
+            "items": [
+              "Výstup sa uchováva na hostiteľovi v <code>/var/log/proxmenux/oci/VMID.console.log</code> (režim 0600) od prvého spustenia aj cez reštarty, takže ho možno čítať pri zastavenom kontajneri.",
+              "Súbor sa otáča na 10 MB, pričom sa uchovávajú tri komprimované kópie (<code>/etc/logrotate.d/proxmenux-oci</code>).",
+              "Každý začiatok kontajnera je označený vo výstupe. Karta štandardne zobrazuje výstup od posledného spustenia; <strong>Úplná história</strong> zobrazuje aj predchádzajúce.",
+              "Po odstránení aplikácie sa odstráni jej výstup.",
+              "Zobrazuje sa posledných 100, 500 alebo 1000 riadkov. Počas behu kontajnera sa nové riadky sledujú naživo; posunutie nahor sledovanie pozastaví a tlačidlo <strong>Sledovať</strong> ho obnoví.",
+              "Filter zobrazí iba riadky, ktoré obsahujú text a <strong>Stiahnuť</strong> uloží načítané riadky.",
+              "Farebné kódy sa odstránia a riadok opakovane prekresľovaný ukazovateľom priebehu sa zobrazí v konečnom stave.",
+              "Karta načíta súbor pri každom otvorení; nepoužíva vyrovnávaciu pamäť."
+            ]
+          }
+        },
+        {
+          "calloutInfo": {
+            "title": "Prihlasovacie údaje pri prvom spustení",
+            "body": "Obrazy, ktoré vytlačia vygenerované heslo na ich prvom štarte, to nechajú v tomto výstupe, ako to robí <code>docker logs</code>. Inštalátor ho odtiaľ prečíta, aby ju ukázal v súhrne."
+          }
+        },
+        {
+          "figure": {
+            "src": "/oci-manager/monitor-logs-tab.png",
+            "alt": "Karta záznamov s výstupom konzoly kontajnera OCI, výberom počtu riadkov, filtrom a tlačidlom sledovania",
+            "caption": "Konzolový výstup kontajnera OCI."
+          }
+        }
+      ]
+    },
+    {
+      "id": "terminal",
+      "title": "konzola Proxmox VE",
+      "blocks": [
+        {
+          "p": "Obraz OCI spúšťa vlastný proces ako PID 1 a neobsahuje prihlasovaciu službu. Predvolená konzola LXC by preto otvorila terminál bez procesu, ktorý by odpovedal na prihlásenie. Kontajnery nainštalované cez OCI manager Apps sa vytvárajú s <code>cmode: shell</code>: konzola Proxmox VE otvorí shell pomocou <code>lxc-attach</code>, čo zodpovedá <code>docker exec</code>. Spustená aplikácia zostáva nedotknutá."
+        },
+        {
+          "list": {
+            "items": [
+              "Shell je ten, ktorý súbor <code>/etc/passwd</code> v obraze priraďuje používateľovi root. Ak root nemá shell alebo obraz žiadny neobsahuje, zostane predvolená konzola.",
+              "Shell beží ako root vnútri kontajnera, bez hesla. O tom, kto ho môže otvoriť, rozhoduje <code>VM.Console</code> povolenie Proxmox VE.",
+              "Terminál monitora vstupuje do kontajnera s <code>pct enter</code>, ktorý funguje rovnako."
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "mounts",
+      "title": "Pripojenia",
+      "blocks": [
+        {
+          "p": "Karta <mountsLink>Pripojenia</mountsLink> uvádza disky kontajnera a jeho adresáre hostiteľa. Využitie disku kontajnera na blokovom úložisku, napríklad LVM-thin, sa číta zo súborového systému disku, ktorý je pripojený iba v kontajneri."
+        }
+      ]
+    }
+  ]
+}
diff --git a/web/messages/sk/docs/oci-manager/stacks.json b/web/messages/sk/docs/oci-manager/stacks.json
new file mode 100644
index 00000000..5a0c1640
--- /dev/null
+++ b/web/messages/sk/docs/oci-manager/stacks.json
@@ -0,0 +1,404 @@
+{
+  "meta": {
+    "title": "Aplikácie s viacerými kontajnermi | ProxMenux",
+    "description": "Ako OCI manager Apps mení aplikáciu s databázou a vyrovnávacou pamäťou na koordinované natívne LXC: plán, súkromná sieť, hook závislostí, overenie a transakčné aktualizácie."
+  },
+  "header": {
+    "title": "Aplikácie s viacerými kontajnermi",
+    "description": "Aplikácia so svojou databázou, vyrovnávacou pamäťou a ďalšími službami sa stáva niekoľkými koordinovanými LXC, nainštalovanými a aktualizovanými ako jedna.",
+    "section": "OCI manager Apps"
+  },
+  "sections": [
+    {
+      "id": "intro",
+      "blocks": [
+        {
+          "calloutInfo": {
+            "title": "Jedna aplikácia pre užívateľa, niekoľko LXC pre Proxmox VE",
+            "body": "Definícia viacerých kontajnerov je jedným záznamom v katalógu. Inštalátor vytvorí jeden natívny LXC pre každú službu a explicitne spravuje ich závislosti. Immich, Nextcloud, Paperless-ngx a Tandoor sú nainštalované týmto spôsobom."
+          }
+        },
+        {
+          "mermaid": {
+            "chartCode": "flowchart LR\n C[\"Docker Compose\"] --> O[\"{{plan}}\"]\n O --> A[\"{{app}}<br/>{{appNet}}\"]\n O --> D[\"{{db}}<br/>{{private}}\"]\n O --> R[\"{{cache}}<br/>{{private}}\"]\n V1[(\"config\")] --> A\n V2[(\"database\")] --> D\n V3[(\"cache\")] --> R\n D --> A\n R --> A",
+            "labels": {
+              "plan": "Stack plán",
+              "app": "Aplikácia LXC",
+              "appNet": "LAN + súkromné",
+              "db": "PostgreSQL LXC",
+              "cache": "Valkey LXC",
+              "private": "súkromné"
+            }
+          }
+        }
+      ]
+    },
+    {
+      "id": "plan",
+      "title": "1. Plán ešte pred vytvorením kontajnerov",
+      "blocks": [
+        {
+          "p": "Počas spracovania definície Compose sa nevytvára žiadny LXC. Najprv vznikne úplný plán so všetkými členmi, obrazmi, VMID, sieťami, cestami, tajnými údajmi, poradím a kontrolami stavu. Ak plán nie je konzistentný, inštalácia sa nezačne."
+        },
+        {
+          "table": {
+            "headers": [
+              "Prvok plánu",
+              "Obsah",
+              "Overenie pred vytvorením čohokoľvek"
+            ],
+            "rows": [
+              [
+                "Členovia",
+                "Hlavná aplikácia, databáza, vyrovnávacia pamäť, strojové učenie a iné závislosti",
+                "Jedinečné VMID, známe úlohy a presne jeden hlavný člen"
+              ],
+              [
+                "Obrazy",
+                "Priebežne aktualizovaný odkaz, architektúra a určený digest každej služby",
+                "Všetky existujú, podporujú architektúru a prejdú kontrolou integrity OCI"
+              ],
+              [
+                "Sieť",
+                "Súkromný most, podsieť, pevná adresa pre každú službu a prístup LAN pre hlavného člena",
+                "Žiadna zrážka s existujúcimi mostmi alebo podsietami a žiadna opakovaná adresa"
+              ],
+              [
+                "Perzistencia",
+                "Kontajnerové disky, hostiteľské adresáre, majitelia a zálohovanie",
+                "Žiadne prekrývanie ciest, dostupné úložisko a deklarované oprávnenia"
+              ],
+              [
+                "Tajomstvá",
+                "Heslo databázy, aplikačné kľúče a počiatočné prihlasovacie údaje",
+                "Generované raz a podané iba členom, ktorí ich používajú"
+              ],
+              [
+                "Životný cyklus",
+                "Poradie spúšťania, poradie zastavovania a kontrola stavu každého člena",
+                "Hlavná aplikácia sa spúšťa posledná a zastavuje prvá"
+              ]
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "create",
+      "title": "2. Vytváranie jednotlivých členov",
+      "blocks": [
+        {
+          "steps": {
+            "items": [
+              {
+                "title": "Rezervujte každý VMID",
+                "body": "Súpis Proxmox VE a inštančný register sú kontrolované. Existujúce CT nie je prijaté a zmluva, ktorá stále patrí do inej inštancie, sa opätovne nepoužíva."
+              },
+              {
+                "title": "Pripravte každý obraz",
+                "body": "Všetky obrazy sú vyriešené, stiahnuté a overené pred vytvorením prvého kontajnera."
+              },
+              {
+                "title": "Vytvoriť každý rootfs",
+                "body": "Importujú sa oficiálne metadáta OCI a pridá sa identita inštancie ProxMenux a rola člena."
+              },
+              {
+                "title": "Súkromná sieť",
+                "body": "Vytvorí sa most a podsieť a každý člen dostane pevnú adresu; iba hlavný člen navyše dostane rozhranie LAN."
+              },
+              {
+                "title": "Perzistencia",
+                "body": "Každá databáza a konfigurácia dostane svoj vlastný disk kontajnera; iba údaje určené na zdieľanie používajú adresáre hostiteľov."
+              },
+              {
+                "title": "Prostredie",
+                "body": "Zapíšu sa interné koncové body, zdieľané tajné údaje a premenné služieb. Aplikácia pristupuje k svojim závislostiam cez ich vyhradené súkromné adresy."
+              },
+              {
+                "title": "Záznam",
+                "body": "Každý člen zaznamenáva svoju natívnu konfiguráciu, rootfs zmeny, ktoré aktualizácie musia reprodukovať a jeho vzťah k stohu."
+              }
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "checks",
+      "title": "3. Spustiť a skontrolovať každý kontajner",
+      "intro": "Vytvorený LXC ešte neznamená pripravenú službu. Závislosti sa spúšťajú v určenom poradí a každá prejde kontrolou špecifickou pre danú službu.",
+      "blocks": [
+        {
+          "table": {
+            "headers": [
+              "Služba",
+              "Kontrola",
+              "Čo ukazuje"
+            ],
+            "rows": [
+              [
+                "PostgreSQL",
+                "<code>pg_isready</code> v CT s očakávaným hostiteľom, používateľom a databázou",
+                "Server akceptuje spojenia pre nakonfigurovanú databázu"
+              ],
+              [
+                "Redis / Valkey",
+                "<code>redis-cli</code> alebo <code>valkey-cli</code> s príkazom <code>PING</code> na jeho súkromnej adrese",
+                "Broker počúva a odpovedá"
+              ],
+              [
+                "Immich strojové učenie",
+                "HTTP <code>GET /ping</code>, plus kontrola zvoleného runtime GPU",
+                "Služba odpovedá a požadovaná akcelerácia neprešla na CPU"
+              ],
+              [
+                "Nextcloud",
+                "<code>GET /status.php</code> s <code>installed=true</code>, <code>maintenance=false</code> a <code>needsDbUpgrade=false</code>",
+                "Inicializácia ukončená bez ďalšej migrácie"
+              ],
+              [
+                "Paperless-ngx / Tandoor",
+                "HTTP na adrese LAN a skutočnom porte služby",
+                "Frontend a jeho závislosti poskytujú aplikáciu"
+              ],
+              [
+                "Hlavná aplikácia",
+                "Koncový bod jeho šablóny, napríklad <code>/api/server/ping</code> v Immich",
+                "Celý zásobník pracuje prostredníctvom aplikácie, ktorá používa závislosti"
+              ]
+            ]
+          }
+        },
+        {
+          "calloutWarning": {
+            "title": "Spustený neznamená funkčný",
+            "body": "Stav spustené len hovorí, že proces LXC existuje. Tam, kde služba ponúka lepšiu kontrolu, sa používa exec alebo HTTP kontrola s časovým limitom. Ak člen zastaví alebo zlyhá jeho kontrola, zásobník nie je deklarovaný ako nainštalovaný."
+          }
+        }
+      ]
+    },
+    {
+      "id": "hook",
+      "title": "4. Hook závislostí",
+      "blocks": [
+        {
+          "p": "Hook sa nastaví iba na hlavnom kontajneri zostavy so závislosťami. Proxmox VE uchováva skript ako snippet a spúšťa ho ako <code>hookscript</code> daného CT. Recept zostavy nie je zapísaný v skripte: nachádza sa v samostatnom súkromnom kontrakte."
+        },
+        {
+          "codeGrid": {
+            "items": [
+              {
+                "title": "Hlavné nastavenie CT",
+                "code": "hookscript: local:snippets/proxmenux-stack-dependencies.sh"
+              },
+              {
+                "title": "Súkromná zmluva (príklad)",
+                "code": "/etc/pve/priv/proxmenux-stack-VMID.json\n{\n  \"schema\": 1,\n  \"stack\": \"immich\",\n  \"dependencies\": [\n    {\"vmid\": 107, \"label\": \"PostgreSQL\", \"healthcheck\": {...}},\n    {\"vmid\": 108, \"label\": \"Valkey\", \"healthcheck\": {...}},\n    {\"vmid\": 106, \"label\": \"Machine Learning\", \"healthcheck\": {...}}\n  ]\n}"
+              }
+            ]
+          }
+        },
+        {
+          "snippet": {
+            "summary": "Kompletný zdroj proxmenux-stack-dependencies.sh",
+            "pathCode": "local:snippets/proxmenux-stack-dependencies.sh",
+            "snippetCode": "stackDependencyHook"
+          }
+        },
+        {
+          "p": "Skript je rovnaký pre každý zásobník. VMID, názvy, kontrolné typy a timeouty pochádzajú zo súkromného kontraktu <code>/etc/pve/priv/proxmenux-stack-VMID.json</code> každého zásobníka."
+        },
+        {
+          "steps": {
+            "items": [
+              {
+                "title": "Proxmox VE zavolá pre-start",
+                "body": "Pred spustením hlavného CT sa hook spustí s jeho VMID a fázou životného cyklu."
+              },
+              {
+                "title": "Zámok na zásobník",
+                "body": "<code>flock</code> na <code>/run/lock/proxmenux-stack-VMID.lock</code> zabraňuje dvom štartovým sekvenciám súčasne."
+              },
+              {
+                "title": "Zmluva je prečítaná a overená",
+                "body": "Požaduje sa známa schéma, numerické závislosti, etikety, exec, http alebo kontrola chodu a pozitívny timeout."
+              },
+              {
+                "title": "Závislosti v poradí",
+                "body": "Každý CT musí existovať; zastavený sa spustí, už spustený sa nereštartuje."
+              },
+              {
+                "title": "Čakanie na pripravenosť služby",
+                "body": "Kontrola beží každé dve sekundy, a CT je tiež potvrdené, že stále beží."
+              },
+              {
+                "title": "Hlavné CT začína",
+                "body": "Keď je každá závislosť pripravená, pre-start končí a Proxmox VE spustí aplikáciu."
+              }
+            ]
+          }
+        },
+        {
+          "calloutInfo": {
+            "title": "Háčik nezastaví závislosť",
+            "body": "Fázy post-start, pre-stop a post-stop nič nevykonávajú. Zastavenie hlavného CT ponechá PostgreSQL, Redis, Valkey alebo strojové učenie spustené. Hook určuje poradie spúšťania; nemení viaceré LXC na jeden proces."
+          }
+        },
+        {
+          "table": {
+            "headers": [
+              "Typ",
+              "Príklad",
+              "Neskoršie spustenia"
+            ],
+            "rows": [
+              [
+                "Závislý zásobník",
+                "Immich, Nextcloud, aplikácia s PostgreSQL",
+                "Hook hlavného CT spustí závislosti a čaká na ich pripravenosť."
+              ],
+              [
+                "Súprava aplikácií",
+                "Súprava Arr",
+                "Žiadny hlavný člen: každý LXC sleduje svoje vlastné <code>onboot</code>"
+              ],
+              [
+                "Samostatná aplikácia",
+                "Jellyfin",
+                "Proxmox VE spustí daný LXC priamo"
+              ]
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "stack-checks",
+      "title": "5. Kontrola stohu ako celku",
+      "blocks": [
+        {
+          "list": {
+            "items": [
+              "Každý VMID existuje, je jedinečný a udržiava očakávanú inštančnú identitu.",
+              "Každý kontrakt patrí do rovnakej zostavy, zachováva svoju rolu a zaznamenanú natívnu konfiguráciu.",
+              "Hlavný člen je posledný v <code>start_order</code> a prvý v <code>stop_order</code>.",
+              "Nechýba žiadny člen, zväzok ani úprava rootfs.",
+              "Hook odkazuje na oficiálny snippet, jeho obsah sa nezmenil a jeho kontrakt zodpovedá receptu zostavy.",
+              "Zistené obrazy a hodnoty digest zodpovedajú pripraveným archívom OCI.",
+              "Zariadenia, profily GPU, pripojenia, tajomstvá a koncové body stále zodpovedajú zmluvám.",
+              "Keď všetky závislosti prejdú kontrolou, koncový bod hlavnej aplikácie overí integráciu medzi členmi."
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "manage",
+      "title": "Správa nainštalovaného zásobníka",
+      "intro": "V časti <strong>Spravovať nainštalované aplikácie OCI</strong> vedie každý člen k celej zostave. Ponuka obsahuje <strong>Aktualizovať všetky kontajnery aplikácie</strong>, <strong>Upraviť dodatočné cesty a zariadenia</strong>, <strong>Znova vytvoriť všetky kontajnery s uloženou konfiguráciou</strong> a <strong>Odstrániť: vymazať aplikáciu a jej kontajnery</strong>. Opätovné vytvorenie zostaví každý kontajner z pôvodného obrazu podľa uloženého digestu bez hľadania novšieho obrazu. Používa rovnaké kroky ako aktualizácia a ponúka sa pre aktualizovateľné zostavy.",
+      "blocks": [
+        {
+          "steps": {
+            "items": [
+              {
+                "title": "Každý člen",
+                "body": "Zmluva člena menuje hlavné VMID a kompletný zoznam členov."
+              },
+              {
+                "title": "Stack je reprodukovateľný",
+                "body": "Overia sa identity, kontrakty, hook, úpravy a koordinované opätovné vykonanie daného receptu."
+              },
+              {
+                "title": "Prvé obrazy",
+                "body": "Aplikácia sa nezastaví, kým sa každý digest neurčí, nestiahne a neoverí."
+              },
+              {
+                "title": "Zastaviť súčasti a zálohovať celú zostavu",
+                "body": "Overené natívne zálohy sa vytvoria pri zastavenej zostave, aby aplikácia a databázy zodpovedali rovnakému okamihu."
+              },
+              {
+                "title": "Aktualizovať a skontrolovať každého člena",
+                "body": "Adaptácia, sieť, pripojenia, tajomstvá a zariadenia sa používajú opäť pred kontrolou stavu každého člena."
+              },
+              {
+                "title": "Publikovať alebo obnoviť všetko",
+                "body": "Nové zmluvy sa uverejňujú iba vtedy, keď každý člen prejde. Ak jeden zlyhá, každý člen je obnovený."
+              }
+            ]
+          }
+        },
+        {
+          "table": {
+            "headers": [
+              "Upraviť",
+              "Čo sa zmení?",
+              "Čo sa uchováva"
+            ],
+            "rows": [
+              [
+                "Extra cesty a zariadenia",
+                "Pridajú sa do aplikačného kontajnera alebo sa z neho odstránia a kontajner sa reštartuje. Nič sa znova nevytvára.",
+                "Údaje aplikácie, jej databázy a ostatných kontajnerov"
+              ],
+              [
+                "Čo spúšťa rozpoznanie (Immich)",
+                "Kontajner strojového učenia dostane obraz a zariadenia pre CPU alebo GPU hostiteľa. Celá aplikácia sa zastaví a aktualizuje rovnakým postupom ako pri aktualizácii.",
+                "Modelová vyrovnávacia pamäť, knižnica a databáza. Ak niečo zlyhá, predchádzajúce kontajnery a predchádzajúca voľba sú obnovené"
+              ]
+            ]
+          }
+        },
+        {
+          "calloutWarning": {
+            "title": "Zostava bez koordinovaného opätovného vykonania sa neaktualizuje",
+            "body": "Ak sa príprava zásobníka nedá reprodukovať, aktualizácia sa zamietne pred zastavením zásobníka. Aplikácia funguje tak, ako je."
+          }
+        }
+      ]
+    },
+    {
+      "id": "failure",
+      "title": "6. Keď niečo zlyhá",
+      "blocks": [
+        {
+          "p": "Ak počas inštalácie nastane chyba, zastavia a odstránia sa neúplné kontajnery vytvorené touto operáciou aj súkromný most, ak ho operácia vytvorila. Zostava sa nezverejní ako platná, kým neskončí celý postup."
+        },
+        {
+          "p": "Aktualizácia je transakčná: všetky obrazy sú pripravené ako prvé, potom stack zastaví, každý člen je zálohovaný a záloha overená, a len potom je každý rootfs nahradený. Členovia začínajú jeden po druhom so zdravotnou kontrolou; ak jeden zlyhá, každý člen je obnovený z rovnakého súboru záloh, takže databáza a aplikácia nikdy nepatria do rôznych momentov."
+        },
+        {
+          "mermaid": {
+            "chartCode": "flowchart LR\n P[\"{{prepare}}\"] --> S[\"{{stop}}\"]\n S --> B[\"{{backup}}\"]\n B --> R[\"{{replace}}\"]\n R --> H{\"{{healthy}}\"}\n H -- \"{{yes}}\" --> C[\"{{commit}}\"]\n H -- \"{{no}}\" --> X[\"{{rollback}}\"]",
+            "labels": {
+              "prepare": "Pripravte každý obraz",
+              "stop": "Stop, hlavný člen prvý",
+              "backup": "Overená záloha každého CT",
+              "replace": "Nahradiť rootfs",
+              "healthy": "Sú všetky funkčné?",
+              "yes": "Áno",
+              "no": "Nie",
+              "commit": "Zverejniť kontrakty",
+              "rollback": "Obnoviť každého člena"
+            }
+          }
+        }
+      ]
+    },
+    {
+      "id": "not-assumed",
+      "title": "Čo zásobník nezahŕňa",
+      "blocks": [
+        {
+          "list": {
+            "items": [
+              "Súprava nainštalovaná v jednom postupe, napríklad súprava Arr, nie je zostavou so závislosťami: jej kontajnery nemajú určené vzájomné poradie spúšťania.",
+              "Súkromná sieť nenahrádza autentifikáciu, TLS ani konfiguráciu každej aplikácie.",
+              "Zálohovanie jedného LXC neobsahuje most, hák ani zmluvy zvyšku zásobníka.",
+              "Prowlarr, Sonarr alebo Radarr neprijímajú žiadne indexátory, profily alebo poskytovateľov z ProxMenux."
+            ]
+          }
+        }
+      ]
+    }
+  ]
+}
diff --git a/web/messages/sk/docs/oci-manager/storage-network.json b/web/messages/sk/docs/oci-manager/storage-network.json
new file mode 100644
index 00000000..f0ff007e
--- /dev/null
+++ b/web/messages/sk/docs/oci-manager/storage-network.json
@@ -0,0 +1,305 @@
+{
+  "meta": {
+    "title": "Údaje, cesty a sieť | ProxMenux",
+    "description": "Ako OCI manager Apps uchováva údaje kontajnera OCI: disky kontajnera, adresáre hostiteľa, pripojenia cez rclone, adresy a súkromné siete."
+  },
+  "header": {
+    "title": "Údaje, cesty a sieť",
+    "description": "Čo sa nachádza v rootfs, čo sa zachová pri jeho výmene, ako sa zdieľajú údaje medzi kontajnermi a ako každý kontajner získa svoju adresu.",
+    "section": "OCI manager Apps"
+  },
+  "sections": [
+    {
+      "id": "intro",
+      "blocks": [
+        {
+          "calloutInfo": {
+            "title": "Trvalé uloženie údajov sa určí pred vytvorením LXC",
+            "body": "Pred vytvorením kontajnera sa načítajú zväzky deklarované obrazom a jeho súborom Compose. Každá cesta, ktorá sa má zachovať po aktualizácii, sa stane prípojným bodom nezávislým od rootfs. Rootfs tak obsahuje iba súbory patriace obrazu a možno ho vymeniť."
+          }
+        }
+      ]
+    },
+    {
+      "id": "questions",
+      "title": "Na čo sa pýta inštalátor",
+      "intro": "Šablóna poskytuje cesty potrebné pre aplikáciu. Každá sa umiestni na disk kontajnera alebo do adresára hostiteľa. Pred súhrnom možno pridať ďalšie cesty.",
+      "blocks": [
+        {
+          "steps": {
+            "items": [
+              {
+                "title": "Potrebné cesty",
+                "body": "Zobrazia sa <code>/config</code>, <code>/data</code>, knižnice, stiahnuté súbory a všetky zväzky deklarované aplikáciou."
+              },
+              {
+                "title": "Umiestnenie",
+                "body": "Každá cesta sa umiestni na disk kontajnera alebo do existujúceho adresára hostiteľa."
+              },
+              {
+                "title": "Úložisko a veľkosť",
+                "body": "Na úložisku Proxmox VE sa vytvorí disk kontajnera so zadanou veľkosťou. Predvolená inštalácia používa <code>local-lvm</code>. Rozšírená inštalácia sa pri každej ceste pýta najprv na úložisko a potom na veľkosť; navrhuje úložisko rootfs. Disk sa zobrazuje ako <code>vm-VMID-disk-N</code> a pripája sa ako <code>mpN</code>."
+              },
+              {
+                "title": "Adresár hostiteľa",
+                "body": "Adresár hostiteľa sa zadáva jeho cestou. Ak neexistuje, vytvorí sa a jeho vlastníkom bude používateľ hostiteľa, na ktorého sa mapuje používateľ kontajnera."
+              },
+              {
+                "title": "Ďalšie cesty",
+                "body": "Pred inštaláciou možno pridať ďalšie dvojice cesty alebo zväzku hostiteľa a cesty v kontajneri."
+              },
+              {
+                "title": "Súhrn",
+                "body": "Pred vytvorením CT sa zobrazí úplné mapovanie ciest a uloží sa do kontraktu inštancie."
+              }
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "options",
+      "title": "Dve možnosti trvalého uloženia",
+      "blocks": [
+        {
+          "table": {
+            "headers": [
+              "Vlastnosť",
+              "Disk kontajnera",
+              "Adresár hostiteľa"
+            ],
+            "rows": [
+              [
+                "V konfigurácii",
+                "<code>mpN: STORAGE:vm-VMID-disk-N,mp=/config,backup=1,size=16G</code>",
+                "<code>mpN: /mnt/oci-shared/media,mp=/data/media</code>"
+              ],
+              [
+                "Záloha kontajnera (vzdump)",
+                "Zahrnutý pri <code>backup=1</code>",
+                "Nezahrnutý"
+              ],
+              [
+                "Veľkosť",
+                "Pevná; zväčšuje sa zmenou veľkosti prípojného bodu",
+                "Voľné miesto v súborovom systéme alebo datasete hostiteľa"
+              ],
+              [
+                "Ostatné kontajnery",
+                "Pripája ho iba kontajner, ktorému patrí",
+                "Ten istý adresár možno pripojiť do viacerých kontajnerov"
+              ],
+              [
+                "Snapshoty a obnova",
+                "Spravuje ich Proxmox VE spolu s CT",
+                "Spravujú sa na úložisku hostiteľa"
+              ],
+              [
+                "Pri odstránení aplikácie",
+                "Odstráni sa spolu s kontajnerom",
+                "Zachová sa aj s obsahom"
+              ],
+              [
+                "Pri presune CT na iný uzol",
+                "Presunie sa spolu s CT",
+                "Na druhom uzle musí existovať rovnaká cesta"
+              ]
+            ]
+          }
+        },
+        {
+          "p": "Rootfs je vyhradený pre binárne súbory a obsah obrazu. Aktualizácia alebo opätovné vytvorenie ho nahradí bez zásahu do ktoréhokoľvek z dvoch typov prípojných bodov."
+        }
+      ]
+    },
+    {
+      "id": "example",
+      "title": "Príklad: kontajner s oboma umiestneniami",
+      "blocks": [
+        {
+          "code": {
+            "title": "Jellyfin nainštalovaný ako CT 151 na local-lvm (úryvok)",
+            "code": "rootfs: local-lvm:vm-151-disk-0,size=8G\n# Container disk, part of the CT backup\nmp0: local-lvm:vm-151-disk-1,mp=/config,backup=1,size=16G\n\n# Host directory, outside the CT backup\nmp1: /mnt/oci-shared/media,mp=/data/media"
+          }
+        },
+        {
+          "p": "Aktualizácia alebo opätovné vytvorenie nahradí iba rootfs: <code>mp0</code> zachová používateľov, knižnice a nastavenia a <code>mp1</code> naďalej sprístupňuje rovnaké médiá. Obnova zálohy CT obnoví <code>/config</code>. Adresár s médiami sa v prípade potreby obnovuje zo zálohy úložiska hostiteľa."
+        },
+        {
+          "flow": {
+            "nodes": [
+              {
+                "label": "Kontrakt",
+                "detail": "/config"
+              },
+              {
+                "label": "Umiestnenie",
+                "detail": "Disk kontajnera\nalebo adresár hostiteľa"
+              },
+              {
+                "label": "LXC",
+                "detail": "Pre aplikáciu\nvždy /config"
+              }
+            ],
+            "caption": "Aplikácia vidí cestu deklarovanú obrazom; mení sa iba miesto jej uloženia."
+          }
+        }
+      ]
+    },
+    {
+      "id": "shared",
+      "title": "Jeden adresár hostiteľa, viacero kontajnerov",
+      "blocks": [
+        {
+          "mermaid": {
+            "chartCode": "flowchart TB\n H[\"{{host}}<br/>/mnt/oci-shared/media\"]\n H --> Q[\"qBittorrent<br/>/data\"]\n H --> J[\"Jellyfin<br/>/data\"]\n H --> R[\"Radarr / Sonarr<br/>/data\"]\n Q -. \"{{config}}\" .-> QV[(\"/config mpN\")]\n J -. \"{{config}}\" .-> JV[(\"/config mpN\")]\n R -. \"{{config}}\" .-> RV[(\"/config mpN\")]",
+            "labels": {
+              "host": "Adresár hostiteľa",
+              "config": "Vlastná konfigurácia"
+            }
+          }
+        },
+        {
+          "p": "Každý kontajner uchováva svoju konfiguráciu na vlastnom disku. Knižnica alebo stiahnuté súbory sú v jednom adresári hostiteľa, pripojenom na rovnakej vnútornej ceste v každom kontajneri. Cesta, do ktorej jedna aplikácia zapisuje, je preto rovnaká ako cesta, z ktorej druhá číta."
+        }
+      ]
+    },
+    {
+      "id": "rclone",
+      "title": "Cloudové úložisko cez aplikáciu rclone",
+      "intro": "Položka rclone v katalógu okrem inštalácie ponúka aj možnosť <strong>Aktivovať pripojenie v existujúcom kontajneri OCI s rclone</strong>. Pripojí sa vzdialené úložisko, ktoré už bolo vytvorené a autorizované vo webovom rozhraní rclone, a sprístupní sa na hostiteľovi. Ostatné kontajnery ho môžu používať ako adresár hostiteľa.",
+      "blocks": [
+        {
+          "steps": {
+            "items": [
+              {
+                "title": "Kontajner a vzdialené úložisko",
+                "body": "VMID kontajnera s rclone, presný názov vzdialeného úložiska a voliteľne cesta v ňom."
+              },
+              {
+                "title": "Názov pripojenia a vyrovnávacia pamäť",
+                "body": "Názov pripojenia a režim vyrovnávacej pamäte VFS: <code>off</code>, <code>minimal</code>, <code>writes</code> alebo <code>full</code> (predvolený)."
+              },
+              {
+                "title": "Sprístupnené zobrazenia",
+                "body": "Spoločný koreňový adresár, predvolene <code>/mnt/oci-shared</code>, obsahuje zobrazenie na čítanie aj zápis v <code>/mnt/oci-shared/remotes/NAME</code> a zobrazenie iba na čítanie v <code>/mnt/oci-shared/remotes-ro/NAME</code>."
+              },
+              {
+                "title": "Aktivácia",
+                "body": "Po potvrdení sa CT zastaví, nastaví sa jeho spúšťací príkaz a hookscript Proxmox VE a znova sa spustí. Operácia čaká, kým budú obe zobrazenia pripojené na hostiteľovi."
+              }
+            ]
+          }
+        },
+        {
+          "calloutInfo": {
+            "title": "Ak sa pripojenie neaktivuje",
+            "body": "Obnoví sa predchádzajúca konfigurácia kontajnera a kontajner sa znova spustí. Ak aktivácia zlyhá, rclone tak zostane v pôvodnom stave."
+          }
+        }
+      ]
+    },
+    {
+      "id": "network",
+      "title": "Adresy a siete",
+      "intro": "Aplikácia s jedným kontajnerom potrebuje adresu. Aplikácia s viacerými kontajnermi potrebuje aj stabilnú sieť medzi svojimi členmi.",
+      "blocks": [
+        {
+          "cards": {
+            "items": [
+              {
+                "icon": "network",
+                "title": "Aplikácia s jedným kontajnerom",
+                "body": "Vyberie sa sieťový most a DHCP alebo pevná adresa vo formáte CIDR. LXC má vlastnú adresu a súhrn zobrazuje úplné URL služieb."
+              },
+              {
+                "icon": "waypoints",
+                "title": "Aplikácia s viacerými kontajnermi",
+                "body": "Vyhľadá sa voľná podsieť a vytvorí sa trvalý súkromný sieťový most. Každý člen — aplikácia, databáza a vyrovnávacia pamäť — v ňom dostane pevnú adresu."
+              }
+            ]
+          }
+        },
+        {
+          "flow": {
+            "nodes": [
+              {
+                "label": "LAN",
+                "detail": "Dostupná adresa\niba pre hlavnú službu"
+              },
+              {
+                "label": "Hlavný LXC",
+                "detail": "Web / API\nLAN + súkromná sieť"
+              },
+              {
+                "label": "Súkromná sieť",
+                "detail": "PostgreSQL · Valkey · ML\npevné adresy"
+              }
+            ],
+            "caption": "Závislé služby komunikujú cez súkromnú sieť a nemajú adresu v LAN."
+          }
+        },
+        {
+          "p": "Kontrakt zostavy uchováva sieťový most, podsieť, adresy a vzťahy medzi službami. Pri aktualizácii aplikácie sa pre všetkých členov znovu použije rovnaká topológia. ProxMenux Monitor otvára hlavný kontajner na jeho adrese v LAN, nie na adrese v súkromnej sieti."
+        }
+      ]
+    },
+    {
+      "id": "ownership",
+      "title": "Vlastníctvo súborov a adresárov",
+      "blocks": [
+        {
+          "list": {
+            "items": [
+              "Nové adresáre sa vytvárajú s UID a GID, na ktoré sa mapuje neprivilegovaný LXC.",
+              "Vlastníctvo existujúcich adresárov sa nemení rekurzívne.",
+              "Sockety, systémové súbory a citlivé cesty sa neponúkajú ako bežné adresáre hostiteľa."
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "backup",
+      "title": "Čo obsahuje záloha kontajnera",
+      "blocks": [
+        {
+          "table": {
+            "headers": [
+              "Položka",
+              "V zálohe vzdump kontajnera CT",
+              "Kde sa uchováva"
+            ],
+            "rows": [
+              [
+                "Rootfs OCI",
+                "Áno",
+                "V zálohe CT; možno ho tiež znovu vytvoriť z obrazu a kontraktu"
+              ],
+              [
+                "Disk kontajnera s <code>backup=1</code>",
+                "Áno",
+                "Záloha CT"
+              ],
+              [
+                "Adresár hostiteľa",
+                "Nie",
+                "Záloha úložiska hostiteľa"
+              ],
+              [
+                "Kontrakt inštancie",
+                "Áno, kópia uložená v CT",
+                "<code>/.proxmenux/oci-record.json</code> v CT; ďalšie kópie hostiteľa a klastra sa uchovávajú samostatne"
+              ],
+              [
+                "Aplikácia s viacerými kontajnermi",
+                "Každý člen vo vlastnej zálohe",
+                "Zálohy všetkých členov spolu s kontraktom zostavy a jej sieťovým mostom na hostiteľovi"
+              ]
+            ]
+          }
+        }
+      ]
+    }
+  ]
+}
diff --git a/web/messages/sk/docs/post-install/automated.json b/web/messages/sk/docs/post-install/automated.json
new file mode 100644
index 00000000..39289025
--- /dev/null
+++ b/web/messages/sk/docs/post-install/automated.json
@@ -0,0 +1,172 @@
+{
+  "meta": {
+    "title": "Automatický skript po inštalácii | Dokumentácia ProxMenux",
+    "description": "Automatický skript ProxMenux po inštalácii vykoná na novom hostiteľovi Proxmox VE 14 vopred určených optimalizácií podľa hardvéru. Nemá zoznam funkcií na výber, no môže žiadať potvrdenie aktualizácie systému, odstránenia upozornenia na predplatné, niektorých inštalácií Log2RAM a reštartu. Vratné zmeny sa zaznamenajú na neskoršiu obnovu.",
+    "ogTitle": "Automatický skript po inštalácii | Dokumentácia ProxMenux",
+    "ogDescription": "14 vopred určených optimalizácií podľa hardvéru pre nový hostiteľ Proxmox VE, s potvrdením niektorých krokov a záznamom vratných zmien."
+  },
+  "header": {
+    "title": "Automatický skript po inštalácii",
+    "description": "ProxMenux vykoná 14 vopred určených základných optimalizácií bez zoznamu funkcií na výber. Niektoré kroky žiadajú potvrdenie. Vratné zmeny sa zaznamenajú pre Odinštalovať optimalizácie; aktualizácie balíkov sa neoznačujú za vratné.",
+    "section": "Po inštalácii · Automatizovaná"
+  },
+  "intro": {
+    "title": "Kedy vybrať automatizované",
+    "body": "Spustite ho na čerstvo nainštalovanom hostiteľovi Proxmox, ak chcete rozumné základné nastavenie bez výberu každej funkcie. Skript je idempotentný: opakované spustenie znovu použije rovnakú konfiguráciu. Voliteľné funkcie (Fastfetch, IOMMU, repozitár Ceph, HA, opravy AMD…) zámerne <strong>nie sú</strong> súčasťou tohto postupu; v prípade potreby ich vyberte v <link>Prispôsobiteľné</link>."
+  },
+  "applies": {
+    "heading": "Čo skript nastaví",
+    "intro": "Optimalizácia sa uplatňuje v tomto presnom poradí. Stĺpec <em>Kategória</em> odkazuje na podrobnú dokumentáciu každej zmeny v prispôsobiteľnom odkaze.",
+    "headerNum": "#",
+    "headerTool": "Nástroj",
+    "headerWhat": "Čo to robí?",
+    "headerCategory": "Kategória"
+  },
+  "optimizations": [
+    {
+      "tool": "Repozitáre APT + úplná aktualizácia",
+      "what": "Zakáže podnikové zdroje pve-enterprise.sources a ceph.sources, vytvorí čistý zdroj no-subscription pre kódový názov Debianu na hostiteľovi a spustí apt update && apt full-upgrade -y, čo je oficiálny príkaz Proxmoxu na aktualizáciu.",
+      "category": "Základné nastavenia",
+      "categorySlug": "basic-settings"
+    },
+    {
+      "tool": "Odstránenie upozornenia na predplatné",
+      "what": "Upraví webové rozhranie, aby skrylo upozornenie „Žiadne platné predplatné“. Pred použitím žiada potvrdenie; zmenu možno vrátiť cez Odinštalovať optimalizácie.",
+      "category": "Prispôsobenie",
+      "categorySlug": "customization"
+    },
+    {
+      "tool": "Vynútiť IPv4",
+      "what": "Zapíše /etc/apt/apt.conf.d/99-force-ipv4, aby apt používal iba IPv4 a obišiel nestabilné IPv6 spojenia so zrkadlami.",
+      "category": "Sieť",
+      "categorySlug": "network"
+    },
+    {
+      "tool": "Preskočiť jazykové balíky",
+      "what": "Zapíše /etc/apt/apt.conf.d/99-disable-translations, aby sa nesťahovali indexy preložených opisov balíkov a znížil sa objem dát pri aktualizáciách apt.",
+      "category": "Základné nastavenia",
+      "categorySlug": "basic-settings"
+    },
+    {
+      "tool": "Zvýšiť systémové limity",
+      "what": "Zvýši počet sledovaní inotify, limity nofile/nproc, limity zväzku kľúčov jadra a fs.file-max cez sysctl.d, limits.d, pam a systemd na hodnoty vhodné pre hostiteľov s mnohými kontajnermi.",
+      "category": "Systém",
+      "categorySlug": "system"
+    },
+    {
+      "tool": "Ladenie pamäte",
+      "what": "Nastaví vm.swappiness=10, vyvážené podiely zmenených nezapísaných stránok, vm.max_map_count=262144 a proaktívnu kompaktáciu, ak je podporovaná. Politika prideľovania pamäte nad dostupnú kapacitu zostáva na predvolenej hodnote Proxmoxu.",
+      "category": "Systém",
+      "categorySlug": "system"
+    },
+    {
+      "tool": "Správanie pri panike jadra",
+      "what": "Nastaví reštart hostiteľa 10 sekúnd po panic / oops / hardlockup namiesto neobmedzeného zamrznutia.",
+      "category": "Systém",
+      "categorySlug": "system"
+    },
+    {
+      "tool": "Ladenie sieťového zásobníka",
+      "what": "Veľkosti vyrovnávacích pamätí TCP, posilnenie IPv4 (vypnuté presmerovania, rp_filter=2, vypnuté logovanie martian), lokálne porty 1024-65535, zisťovanie MTU TCP, RFC 1337 a skript /usr/local/sbin/proxmenux-fwbr-tune spúšťaný jednorazovou jednotkou systemd a pravidlom udev. Tým sa rp_filter=0 / log_martians=0 opätovne nastavia na fwbr*/fwln*/fwpr*/tap* vždy, keď ich Proxmox znovu vytvorí pri štarte/zastavení VM, reštarte alebo živej migrácii.",
+      "category": "Sieť",
+      "categorySlug": "network"
+    },
+    {
+      "tool": "Prispôsobenie bashrc (root)",
+      "what": "Farebné PS1, bežné aliasy (l/la/ll/ls/grep), história s časovými značkami a načítanie bash-completion, všetko v ohraničenom bloku PMX_CORE_BASHRC na jednoduché odstránenie.",
+      "category": "Prispôsobenie",
+      "categorySlug": "customization"
+    },
+    {
+      "tool": "Log2RAM (prispôsobené pre SSD, automatické)",
+      "what": "Znižuje opotrebenie SSD/NVMe presunom /var/log na ramdisk tmpfs s pravidelnou synchronizáciou na disk. Inštalácia z pôvodného projektu pri koreňovom disku SSD alebo NVMe. Veľkosť podľa RAM hostiteľa (128M / 256M / 512M), pravidelná synchronizácia a ochrana, ktorá pri 80% zaplnení vyčistí staré žurnály a pri 92% skráti rýchlo rastúce logy pred zápisom. Limity journald prispôsobí ramdisku. Podrobnosti v <link>Log2RAM</link>.",
+      "category": "Úložisko",
+      "categorySlug": "storage"
+    },
+    {
+      "tool": "Autotrim ZFS (iba SSD)",
+      "what": "Zapne zpool autotrim=on v každom poole ZFS, ktorého všetky vdev sú SSD/NVMe s podporou TRIM (kontroluje /sys/block/[dev]/queue/rotational a discard_granularity). Pooly s HDD automaticky vynechá. Na odinštalovanie zaznamená iba pooly skutočne zmenené cez ProxMenux; ručne zapnutý autotrim ponechá.",
+      "category": "Úložisko",
+      "categorySlug": "storage"
+    },
+    {
+      "tool": "Limity veľkosti journald",
+      "what": "Vynúti trvalé ukladanie, obmedzí SystemMaxUse=64M / RuntimeMaxUse=60M, zapne kompresiu a logovanie úrovne info potrebné pre Monitor. Pri aktívnom Log2RAM sa vynechá, pretože ten vykonáva vlastné úpravy.",
+      "category": "Systém",
+      "categorySlug": "system"
+    },
+    {
+      "tool": "Ladenie logrotate",
+      "what": "Globálne nastaví daily a potom size 10M, uchová 7 rotácií a zapne kompresiu aj copytruncate. Neskoršie veľkostné kritérium má prednosť; pravidlá konkrétnych logov ho môžu prepísať. Vhodné pre Log2RAM, no frekvencia závisí od pravidiel a časovača.",
+      "category": "Systém",
+      "categorySlug": "system"
+    },
+    {
+      "tool": "Trvalé názvy rozhraní",
+      "what": "Pre každú fyzickú sieťovú kartu zapíše <code>/etc/systemd/network/10-proxmenux-&lt;iface&gt;.link</code> s hlavičkou „Managed by ProxMenux“, ktorý priradí MAC k aktuálnemu názvu. Názvy <code>eth0</code> / <code>enp…</code> zostanú stabilné po reštarte aj pridaní kariet.",
+      "category": "Sieť",
+      "categorySlug": "network"
+    }
+  ],
+  "hardwareTitle": "Predvolené hodnoty podľa hardvéru",
+  "hardwareBody": "Skript pred nastavením preskúma hardvér hostiteľa. Log2RAM sa predvolene inštaluje iba pri koreňovom disku SSD alebo NVMe; pri inej detekcii žiada potvrdenie. Veľkosť ramdisku sa vyberá podľa celkovej RAM (<code>≤ 8 GB → 128M</code>, <code>≤ 16 GB → 256M</code>, <code>'>' 16 GB → 512M</code>). Pri aktívnom Log2RAM sa limity journald prispôsobia ramdisku, aby sa nezaplnil.",
+  "upgrade": {
+    "heading": "Aktualizovať systém",
+    "intro": "Prvým krokom automatického postupu je aktualizácia Proxmoxu. Oficiálny návod pre bežiaci hostiteľ v rámci rovnakej hlavnej verzie odporúča spustiť:",
+    "after": "Tento riadok je oficiálny príkaz pre aktuálne verzie Proxmoxu. Automatický skript vykoná <strong>presne</strong> tento príkaz a pridá čistenie repozitárov a kroky po aktualizácii podľa oficiálneho návodu — rovnako ako samostatný nástroj <link>Aktualizácia systému Proxmox</link>:",
+    "items": [
+      "Zakáže podnikové zdroje <code>pve-enterprise.sources</code> / <code>ceph.sources</code>, odstráni staré súbory repozitárov a zapíše čistý zdroj bez predplatného pre kódový názov distribúcie hostiteľa.",
+      "Spustí inováciu neinteraktívne pomocou <code>DEBIAN_FRONTEND=noninteractive</code> a <code>--force-confdef --force-confold</code> – konfiguračné súbory, ktoré ste si prispôsobili, zostanú vaše, aj keď ich upstream zmení.",
+      "Nainštaluje základné balíky Proxmox, ak chýbajú (<code>zfsutils-linux</code>, <code>proxmox-backup-restore-image</code>, <code>chrony</code>).",
+      "Kontrola konzistentnosti metadát LVM, <code>apt-get autoremove -y</code> + <code>apt-get autoclean -y</code> a výzva na reštart iba pri zmene jadra."
+    ],
+    "sameTitle": "Rovnaká aktualizácia, dva vstupné body",
+    "sameBody": "Automatický postup a samostatný nástroj <link>Aktualizácia systému Proxmox</link> používajú rovnaké skripty (<code>update-pve8.sh</code> / <code>update-pve9_2.sh</code>). Samostatný nástroj použite, ak chcete iba aktualizovať hostiteľa bez ostatných optimalizácií."
+  },
+  "endResult": {
+    "heading": "Očakávaný konečný výsledok",
+    "body": "Po skončení uvidíte správu o úspechu s výstupmi jednotlivých krokov a výzvu na reštart, ktorý vyžadujú niektoré nastavenia jadra. Reštart môžete odložiť; nastavenia sa prejavia pri ďalšom štarte.",
+    "imageAlt": "Automatický skript po inštalácii – konečný výstup terminálu zobrazujúci každú úspešne aplikovanú optimalizáciu"
+  },
+  "notDoes": {
+    "heading": "Čo tento skript nerobí",
+    "items": [
+      "Automatické zistenie časového pásma (v pôvodnom skripte je zakomentované; v prípade potreby použite Prispôsobiteľné).",
+      "Zakázať portmapper / rpcbind (pozri <secLink>Zabezpečenie</secLink>).",
+      "Povoliť IOMMU / VFIO (pozri <virtLink>Virtualizácia</virtLink>).",
+      "Nainštalovať Fastfetch / Figurine / repozitár Ceph / HA / opravy CPU AMD (pozri <optLink>Voliteľné</optLink>).",
+      "Nainštalovať pigz alebo naladiť ZFS ARC (pozri <perfLink>Výkon</perfLink> / <storLink>Úložisko</storLink>)."
+    ]
+  },
+  "xshokTitle": "Detekcia xshok-proxmox",
+  "xshokBody": "Ak hostiteľ už spustil skript <code>xshok-proxmox</code>, ProxMenux rozpozná súbor označenia a pred pokračovaním vás upozorní. Niektoré úpravy sa môžu prekrývať. Doplnkový skript je zastaraný; ak napriek tomu pokračujete, prečítajte si <link>prehľad</link> so súvislosťami.",
+  "revert": {
+    "heading": "Vrátenie",
+    "body": "Každý nástroj v tabuľke sa zaznamená v <code>/usr/local/share/proxmenux/installed_tools.json</code>. Otvorte <link>Odinštalovať optimalizácie</link> a vyberte položky na obnovu. Zálohy zmenených súborov sú vedľa originálov s príponou <code>.bak</code>."
+  },
+  "related": {
+    "heading": "Súvisiace",
+    "items": [
+      {
+        "label": "Prispôsobiteľné nastavenia po inštalácii",
+        "href": "/docs/post-install/customizable",
+        "tail": " — Vyberte si presne to, čo chcete z rovnakého katalógu."
+      },
+      {
+        "label": "Odinštalovať optimalizácie",
+        "href": "/docs/post-install/uninstall",
+        "tail": " — vráťte vybrané zmeny z tohto postupu späť."
+      },
+      {
+        "label": "Užitočné systémové príkazy",
+        "href": "/docs/help-info/system-commands",
+        "tail": " — overte zmeny (uptime, free, journalctl atď.)."
+      },
+      {
+        "label": "Prehľad po inštalácii",
+        "href": "/docs/post-install",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sk/docs/post-install/basic-settings.json b/web/messages/sk/docs/post-install/basic-settings.json
new file mode 100644
index 00000000..7ae6b83e
--- /dev/null
+++ b/web/messages/sk/docs/post-install/basic-settings.json
@@ -0,0 +1,240 @@
+{
+  "meta": {
+    "title": "Po inštalácii: Základné nastavenia | Dokumentácia ProxMenux",
+    "description": "Základné možnosti po inštalácii: prechod na repozitáre Proxmox bez predplatného a aktualizácia systému, zistenie časového pásma a zapnutie NTP, vynechanie prekladov APT a výber z 25 bežných systémových nástrojov na inštaláciu."
+  },
+  "header": {
+    "title": "Po inštalácii: Základné nastavenia",
+    "section": "Nastavenie Proxmoxu po inštalácii"
+  },
+  "intro": {
+    "title": "Čo táto kategória zahŕňa",
+    "body": "Päť základných možností pre nový hostiteľ Proxmox: prejsť na komunitné repozitáre bez predplatného, plne aktualizovať systém, automaticky nastaviť časové pásmo a NTP, vypnúť preklady APT na úsporu šírky pásma a disku a vybrať z 25 bežných nástrojov."
+  },
+  "upgrade": {
+    "heading": "Aktualizovať systém",
+    "intro": "Nastaví APT na bezplatný repozitár <em>pve-no-subscription</em> namiesto repozitára Enterprise s predplatným a plne aktualizuje systém. Presné kroky závisia od hlavnej verzie Proxmox VE; ProxMenux ju zistí a spustí správny skript.",
+    "headerVersion": "PVE verzia",
+    "headerScript": "Skript výberu podľa verzie",
+    "headerCodename": "Kódové meno Debianu",
+    "rows": [
+      {
+        "version": "9.x",
+        "script": "update-pve9_2.sh",
+        "codename": "trixie"
+      },
+      {
+        "version": "8.x",
+        "script": "update-pve8.sh",
+        "codename": "bookworm"
+      }
+    ],
+    "officialTitle": "Oficiálne odporúčanie pre Proxmox",
+    "officialBody": "Oficiálny návod Proxmox odporúča tieto príkazy v presnom poradí:",
+    "officialOutro": "Toto je bežný príkaz pre aktualizácie v rámci nainštalovanej hlavnej verzie Proxmox VE. Skontrolujte repozitáre a navrhované zmeny balíkov <em>pred</em> pokračovaním. Prechod na inú hlavnú verziu vyžaduje oficiálny migračný postup.",
+    "doesTitle": "Čo robí možnosť ProxMenux — overené podľa skriptu",
+    "doesIntro": "Aktualizácia ProxMenux vykoná uvedené príkazy apt a pridá prípravné aj záverečné kroky, na ktoré by ste inak museli myslieť sami. Nasledujúce položky zodpovedajú výberovému skriptu; podrobnosti sú v <link>Aktualizácia systému Proxmox</link>.",
+    "doesItems": [
+      "<strong>Najprv poriadok v repozitároch.</strong> Zakáže podnikové zdroje <code>pve-enterprise.sources</code> / <code>ceph.sources</code>, odstráni staré súbory repozitárov z predchádzajúcich verzií PVE a vytvorí čistý <code>proxmox.sources</code> s bezplatným kanálom <em>pve-no-subscription</em> podľa kódového názvu Debianu na hostiteľovi: trixie pre PVE 9, bookworm pre PVE 8.",
+      "<strong>Prepíše repozitáre Debian</strong> s main / updates / security a <code>non-free-firmware</code>, aby počas aktualizácie zmizlo upozornenie na firmvér.",
+      "<strong>Spustí oficiálnu aktualizáciu.</strong> <code>apt-get update</code> a potom <code>apt full-upgrade -y</code> (PVE 9) alebo <code>apt dist-upgrade -y</code> (PVE 8), neinteraktívne s <code>--force-confdef --force-confold</code> na zachovanie upravených konfiguračných súborov.",
+      "<strong>Nainštaluje základné balíky</strong>, ak chýbajú: <code>zfsutils-linux</code>, <code>proxmox-backup-restore-image</code>, <code>chrony</code>.",
+      "<strong>Skontroluje metadáta LVM.</strong> Hľadá VM s priamo priradenými diskami, ktoré mohli na surové disky zapísať staré hlavičky fyzických zväzkov. Upozorní na nezrovnalosti bez automatickej opravy.",
+      "<strong>Potom vyčistí:</strong> <code>apt-get autoremove -y</code> + <code>apt-get autoclean -y</code>, potom vyzve na reštart, ak jadro bolo aktualizované alebo <code>/var/run/reboot-required</code> je prítomný."
+    ],
+    "shortTitle": "Stručne povedané",
+    "shortBody": "Možnosť spustí odporúčaný príkaz <code>apt update && apt full-upgrade -y</code>, doplní úpravu repozitárov a záverečné čistenie uvedené v oficiálnom návode a ponúkne reštart. Pozrite <link>Aktualizácia systému Proxmox</link> s celým diagramom; rovnaký aktualizátor je samostatne dostupný v hlavnom menu.",
+    "subTitle": "Nepoužívajte na hostiteľovi s predplatným",
+    "subBody": "Ak máte predplatné Proxmox a chcete ponechať repozitáre Enterprise, túto možnosť vynechajte. Zakáže Enterprise a prepne hostiteľa na komunitný kanál. Aktualizácia balíkov ani prepísanie repozitárov sa nedajú vrátiť cez Odinštalovať optimalizácie. Neskoršiu zmenu kanála musíte vykonať úpravou konfigurácie repozitárov.",
+    "safetyTitle": "Bezpečnostná kontrola po aktualizácii",
+    "safetyBody": "Po aktualizácii skript hľadá staré metadáta fyzických zväzkov (PV) na diskoch. Môže k tomu dôjsť, keď VM s priamo priradeným diskom zapíše hlavičky LVM na surový disk. Pri podozrivom náleze zobrazí upozornenie a navrhne kontrolu cez <code>pvs</code>. Automaticky nič nemení."
+  },
+  "time": {
+    "heading": "Automaticky synchronizovať čas",
+    "intro": "Zistí verejnú IP adresu servera cez <code>dig myip.opendns.com @resolver1.opendns.com</code>, potom z <code>ipapi.co/'{'ip'}'/timezone</code> získa zodpovedajúce časové pásmo IANA a nastaví ho cez <code>timedatectl set-timezone</code>. Nakoniec zapne NTP cez <code>timedatectl set-ntp true</code>.",
+    "depTitle": "Závisí od dvoch externých služieb",
+    "depBody": "Vyhľadávanie závisí od dostupnosti OpenDNS a <code>ipapi.co</code> a od správnosti ich odpovedí. Ak spustíte Proxmox za VPN alebo na VLAN, ktorá vychádza z iného regiónu, automaticky zistené časové pásmo môže byť nesprávne. V takom prípade preskočte túto možnosť a nastavte časové pásmo ručne:",
+    "revertTitle": "Reverzibilné z menu Odinštalovať",
+    "revertBody": "<link>Odinštalovanie optimalizácií</link> obnoví časové pásmo na UTC (bezpečné predvolené nastavenie). Nezakáže NTP – vaše hodiny sa neustále synchronizujú, len sú ukotvené na UTC, kým manuálne nenastavíte nové časové pásmo."
+  },
+  "languages": {
+    "heading": "Nesťahovať ďalšie jazyky",
+    "intro": "Počas <code>apt update</code> môže APT okrem hlavných metadát sťahovať aj preklady opisov balíkov. Možnosť ich vypne na úsporu šírky pásma a miesta. Predtým ProxMenux <strong>overí, že miestne nastavenie hostiteľa je vygenerované</strong>: prečíta <code>/etc/default/locale</code> alebo <code>/etc/environment</code>, podľa potreby doplní <code>/etc/locale.gen</code> a spustí <code>locale-gen</code>. Miestne nastavenie shellu sa tak zachová.",
+    "writtenTitle": "Čo sa napíše",
+    "revertTitle": "Reverzibilné z menu Odinštalovať",
+    "revertBody": "Odstraňovanie <code>/etc/apt/apt.conf.d/99-disable-translations</code> (buď manuálne, alebo z menu Odinštalovať) obnoví štandardné správanie a APT znovu stiahne jazykové súbory."
+  },
+  "utilities": {
+    "heading": "Nainštalovať bežné systémové nástroje",
+    "intro": "Otvorí zoznam <strong>25 vybraných nástrojov</strong> rozdelených do skupín. Vyberiete požadované nástroje a potvrdíte výber. ProxMenux ich nainštaluje cez <code>apt</code>, overí fungovanie balíkov a na konci zobrazí súhrn.",
+    "imageAlt": "Výber systémových nástrojov ProxMenux: medzerník vyberá, Enter potvrdzuje",
+    "reuseTitle": "Rovnaký zoznam je opätovne použitý inde",
+    "reuseBody": "Katalóg 25 nástrojov má jedinú definíciu: <code>PROXMENUX_UTILS</code> v <code>scripts/global/utils-install-functions.sh</code>. Menu <em>Pomôcky a nástroje → Systémové nástroje</em> ponúka rovnaký zoznam na neskoršie inštalácie bez opakovania nastavení po inštalácii.",
+    "listTitle": "Čo je v zozname?",
+    "groups": [
+      {
+        "group": "Monitory systému",
+        "items": [
+          {
+            "pkg": "htop",
+            "desc": "Interaktívny prehliadač procesov"
+          },
+          {
+            "pkg": "btop",
+            "desc": "Moderný monitor zdrojov (CPU, RAM, disky, sieť, procesy)"
+          },
+          {
+            "pkg": "s-tui",
+            "desc": "Terminálové rozhranie na záťažové testy a sledovanie CPU"
+          },
+          {
+            "pkg": "iftop",
+            "desc": "Využitie šírky pásma pre každé spojenie v reálnom čase"
+          },
+          {
+            "pkg": "iotop",
+            "desc": "Diskové I/O podľa procesu"
+          },
+          {
+            "pkg": "iptraf-ng",
+            "desc": "Interaktívny monitor IP LAN"
+          }
+        ]
+      },
+      {
+        "group": "Sieť",
+        "items": [
+          {
+            "pkg": "iperf3",
+            "desc": "Meranie maximálnej dosiahnuteľnej šírky pásma medzi hostiteľmi"
+          },
+          {
+            "pkg": "net-tools",
+            "desc": "Staršie nástroje (ifconfig, netstat, route). Stále užitočné na rýchle kontroly"
+          },
+          {
+            "pkg": "ipset",
+            "desc": "Spravuje veľké množiny IP adries v jadre — užitočné pre pravidlá iptables/nftables"
+          }
+        ]
+      },
+      {
+        "group": "Sťahovanie a archívy",
+        "items": [
+          {
+            "pkg": "axel",
+            "desc": "Nenáročný akcelerátor paralelného sťahovania"
+          },
+          {
+            "pkg": "aria2",
+            "desc": "Sťahovanie z viacerých zdrojov a cez viac protokolov (HTTP, FTP, BitTorrent, Metalink)"
+          },
+          {
+            "pkg": "unzip",
+            "desc": "Rozbaliť archívy ZIP"
+          },
+          {
+            "pkg": "zip",
+            "desc": "Vytvoriť ZIP archívy"
+          },
+          {
+            "pkg": "cabextract",
+            "desc": "Rozbaliť archívy Microsoft CAB (užitočné pri súboroch ISO systému Windows)"
+          },
+          {
+            "pkg": "wimtools",
+            "desc": "Manipulovať obrazy Windows WIM (extrahovať, rozdeliť, pripojiť, použiť)"
+          },
+          {
+            "pkg": "genisoimage",
+            "desc": "Vytvárať obrazy ISO 9660 z adresára"
+          }
+        ]
+      },
+      {
+        "group": "Text a súbory",
+        "items": [
+          {
+            "pkg": "dos2unix",
+            "desc": "Previesť koncovky riadkov CRLF (Windows) na LF (Unix)"
+          },
+          {
+            "pkg": "grc",
+            "desc": "Univerzálne farebné zvýraznenie výstupu príkazov ping, traceroute, dig, tail a ďalších"
+          },
+          {
+            "pkg": "plocate",
+            "desc": "Rýchle indexované vyhľadávanie súborov. Po inštalácii spustite updatedb na vytvorenie indexu"
+          }
+        ]
+      },
+      {
+        "group": "Vzdialený prístup a relácie",
+        "items": [
+          {
+            "pkg": "sshpass",
+            "desc": "Neinteraktívne overenie SSH heslom (užitočné pre skripty, nie na každodenné používanie)"
+          },
+          {
+            "pkg": "tmux",
+            "desc": "Terminálový multiplexer: odpojenie relácií, rozdelenie panelov a zachovanie relácií pri strate spojenia"
+          }
+        ]
+      },
+      {
+        "group": "Hardvér a nízkoúrovňové nástroje",
+        "items": [
+          {
+            "pkg": "msr-tools",
+            "desc": "Čítať a zapisovať registre špecifické pre model CPU (rdmsr, wrmsr)"
+          },
+          {
+            "pkg": "intel-gpu-tools",
+            "desc": "Intel GPU diagnostické pomôcky vrátane `intel_gpu_top`"
+          }
+        ]
+      },
+      {
+        "group": "Virtualizácia",
+        "items": [
+          {
+            "pkg": "libguestfs-tools",
+            "desc": "Kontrolovať a upravovať obrazy diskov VM (virt-ls, virt-cat, guestmount…)"
+          },
+          {
+            "pkg": "chntpw",
+            "desc": "Upravovať Windows SAM (užitočné na obnovenie hesiel v prevzatých Windows VM)"
+          }
+        ]
+      }
+    ],
+    "actionTitle": "Niekoľko z nich v akcii",
+    "noBulkTitle": "Odstránia sa iba nástroje nainštalované cez ProxMenux",
+    "noBulkBody": "ProxMenux zaznamenáva iba vybrané balíky, ktoré ešte neboli nainštalované. Voľba Odinštalovať optimalizácie ich úplne odstráni a ponechá pôvodné balíky. Aktualizácie APT nemajú bezpečný atómový návrat späť: odinštalovanie nástrojov nevráti aktualizáciu systému."
+  },
+  "related": {
+    "heading": "Súvisiace",
+    "items": [
+      {
+        "label": "Aktualizácia systému Proxmox",
+        "href": "/docs/utils/system-update",
+        "tail": " — Na požiadanie zopakuje cyklus apt update + dist-upgrade."
+      },
+      {
+        "label": "Inštalátor systémových nástrojov",
+        "href": "/docs/utils/system-utils",
+        "tail": " — Nainštalovať alebo preinštalovať jednotlivé nástroje aj po nastavení po inštalácii."
+      },
+      {
+        "label": "Príkazy na aktualizácie a balíky",
+        "href": "/docs/help-info/update-commands",
+        "tail": " — Prehľad apt pre shell."
+      },
+      {
+        "label": "Prispôsobiteľné nastavenia po inštalácii",
+        "href": "/docs/post-install/customizable",
+        "tail": " — späť do nadradeného menu."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sk/docs/post-install/customizable.json b/web/messages/sk/docs/post-install/customizable.json
new file mode 100644
index 00000000..cbc7d261
--- /dev/null
+++ b/web/messages/sk/docs/post-install/customizable.json
@@ -0,0 +1,106 @@
+{
+  "meta": {
+    "title": "Prispôsobiteľný skript po inštalácii | Dokumentácia ProxMenux",
+    "description": "Vyberte presne tie optimalizácie, ktoré má ProxMenux použiť na hostiteľovi Proxmox VE. 10 kategórií, približne 35 nástrojov a výber pomocou zaškrtávacích políčok. Obsahuje všetko z automatizovaného skriptu aj voliteľné funkcie (IOMMU, Fastfetch, Figurine, Ceph, HA, opravy AMD…).",
+    "ogTitle": "Prispôsobiteľný skript po inštalácii | Dokumentácia ProxMenux",
+    "ogDescription": "10 kategórií, približne 35 jednotlivých optimalizácií. Vyberte presne to, čo chcete na hostiteľovi Proxmox VE. Vratné zmeny sa zaznamenávajú."
+  },
+  "header": {
+    "title": "Prispôsobiteľný post-inštalačný skript",
+    "description": "Vyberte presne tie optimalizácie, ktoré chcete použiť na hostiteľovi Proxmox VE. ProxMenux zoskupuje približne 35 nástrojov do 10 kategórií v jednom výberovom dialógu. Rovnaký základ ako Automatizované, ale s úplnou kontrolou nad použitými zmenami.",
+    "section": "Po inštalácii · Prispôsobiteľné"
+  },
+  "intro": {
+    "title": "Kedy vybrať prispôsobiteľné",
+    "body": "Vyberte túto cestu, ak už poznáte požadované alebo nechcené úpravy hostiteľa. Výberový zoznam zoskupený podľa kategórií umožňuje vopred vyberať, rušiť výber a kombinovať optimalizácie. Položky možno neskôr použiť znovu a vratné zmeny sa zaznamenávajú pre <link>Odinštalovať optimalizácie</link>. Aktualizácie balíkov sa neuvádzajú ako vratné."
+  },
+  "compare": {
+    "heading": "Ako sa porovnáva s Automatizovaným",
+    "body": "Prispôsobiteľné obsahuje celý <link>automatizovaný skript</link>: rovnakých 14 základných optimalizácií a množstvo voliteľných položiek, ktoré Automatizované zámerne vynecháva. Sú užitočné pre konkrétny hardvér (opravy AMD), hosting (OVH RTM) alebo záťaže (IOMMU/VFIO, repozitár Ceph, vysoká dostupnosť, Fastfetch, Figurine, ladenie ARC ZFS, pigz, automatické snímky ZFS, rýchlostné limity vzdump, Open vSwitch, TCP BBR…)."
+  },
+  "categoriesSection": {
+    "heading": "10 kategórií",
+    "body": "Prispôsobiteľný skript zoskupuje optimalizácie do 10 kategórií v jednom výberovom dialógu. Každá kategória má vlastnú stránku dokumentácie — otvorte kartu nižšie pre zdôvodnenie, predvolené hodnoty a overovacie kroky jednotlivých možností."
+  },
+  "categories": [
+    {
+      "name": "Základné nastavenia",
+      "description": "Vyčistí zdroje APT, spustí oficiálnu aktualizáciu Proxmox a nastaví časové pásmo, miestne nastavenia a bežné nástroje. Základ všetkých ostatných skupín."
+    },
+    {
+      "name": "Systém",
+      "description": "Vyladí záznamový subsystém a limity jadra pre hostiteľa s mnohými VM a kontajnermi. Zahŕňa journald, logrotate, sysctl (pamäť, limity súborov), správanie pri kernel panic a rýchle reštarty."
+    },
+    {
+      "name": "Virtualizácia",
+      "description": "Pripraví hostiteľa na pokročilú virtualizáciu. Nainštaluje zodpovedajúceho hosťovského agenta, ak samotný Proxmox beží v podporovanej VM, a povolí IOMMU/VFIO na priame priradenie PCI zariadení GPU, radičov a TPU."
+    },
+    {
+      "name": "Sieť",
+      "description": "Posilní a vyladí sieťový stack hostiteľa. Vynúti IPv4 pre APT, použije bezpečnostné nastavenia sysctl a ladenie vyrovnávacích pamätí TCP, ponúkne Open vSwitch, TCP BBR a TCP Fast Open a priradí trvalé názvy rozhraní k MAC adresám."
+    },
+    {
+      "name": "Úložisko",
+      "description": "Nastaví bežné úložné subsystémy Proxmox: veľkosť ARC ZFS, automatické snímky ZFS, autotrim ZFS pre pooly SSD/NVMe a rýchlostné limity vzdump proti vyťaženiu diskov pri zálohovaní."
+    },
+    {
+      "name": "Zabezpečenie",
+      "description": "Zmenší predvolene vystavenú útočnú plochu. Vypne služby RPC portmapper/rpcbind, ktoré Proxmox nepotrebuje, ale ponecháva načúvať."
+    },
+    {
+      "name": "Prispôsobenie",
+      "description": "Zmení vzhľad a prostredie shellu hostiteľa: farby a aliasy v bashrc, banner MOTD a odstránenie upozornenia na predplatné vo webovom rozhraní."
+    },
+    {
+      "name": "Monitorovanie",
+      "description": "Integruje hostiteľa s OVH Real-Time Monitoring. RTM sa nainštaluje iba pri zistení servera OVH; na iných hostiteľoch možnosť nič nemení."
+    },
+    {
+      "name": "Výkon",
+      "description": "Zrýchli kompresiu pri zálohách a prenosoch nahradením gzip jeho paralelnou alternatívou pigz."
+    },
+    {
+      "name": "Voliteľné",
+      "description": "Špecializované možnosti, ktoré nepotrebuje každý hostiteľ: opravy CPU AMD, banner Fastfetch, 3D názov hostiteľa Figurine, aktualizácia indexu PVE Appliance Manager, repozitár Ceph, služby vysokej dostupnosti, Log2RAM na zníženie opotrebenia SSD a swapový profil ZRAM."
+    }
+  ],
+  "mixTip": {
+    "title": "Kombinujte Automatizované a Prispôsobiteľné",
+    "body": "Bežný postup: najprv spustite <strong>Automatizované</strong> pre rozumné základné nastavenia, potom otvorte <strong>Prispôsobiteľné</strong> a vyberte iba potrebné voliteľné nástroje, napríklad IOMMU pre priame priradenie GPU. Zmeny sa sledujú nezávisle; menu Odinštalovať zobrazí všetko použité bez ohľadu na zvolenú cestu."
+  },
+  "related": {
+    "heading": "Súvisiace",
+    "items": [
+      {
+        "label": "Automatizované nastavenia po inštalácii",
+        "href": "/docs/post-install/automated",
+        "tail": " — rozumné predvolené nastavenia použité bez otázok."
+      },
+      {
+        "label": "Odinštalovať optimalizácie",
+        "href": "/docs/post-install/uninstall",
+        "tail": " — čisto vrátiť vybrané zmeny."
+      },
+      {
+        "label": "Základné nastavenia",
+        "href": "/docs/post-install/basic-settings",
+        "tail": " — repozitáre, čas, jazyk a nástroje."
+      },
+      {
+        "label": "Virtualizácia",
+        "href": "/docs/post-install/virtualization",
+        "tail": " — IOMMU + VFIO na priame priradenie zariadení."
+      },
+      {
+        "label": "Zabezpečenie",
+        "href": "/docs/post-install/security",
+        "tailRich": " · <storageLink>Úložisko</storageLink> · <networkLink>Sieť</networkLink> · <customLink>Prispôsobenie</customLink> — ďalšie kategórie."
+      },
+      {
+        "label": "Prehľad po inštalácii",
+        "href": "/docs/post-install",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sk/docs/post-install/customization.json b/web/messages/sk/docs/post-install/customization.json
new file mode 100644
index 00000000..c26ee7e3
--- /dev/null
+++ b/web/messages/sk/docs/post-install/customization.json
@@ -0,0 +1,74 @@
+{
+  "meta": {
+    "title": "Po inštalácii: Prispôsobenie | Dokumentácia ProxMenux",
+    "description": "Možnosti prispôsobenia v prispôsobiteľnom skripte ProxMenux po inštalácii: farebný prompt bash s užitočnými aliasmi, banner ProxMenux v MOTD a odstránenie upozornenia na predplatné z webového rozhrania Proxmox."
+  },
+  "header": {
+    "title": "Po inštalácii: prispôsobenie",
+    "description": "Vizuálne a praktické úpravy hostiteľa Proxmox. Spríjemnia používanie shellu a skryjú upozornenie na predplatné vo webovom rozhraní. Bashrc, MOTD aj banner predplatného sa zaznamenávajú a dajú sa obnoviť cez Odinštalovať.",
+    "section": "Nastavenie Proxmoxu po inštalácii"
+  },
+  "intro": {
+    "title": "Čo táto kategória zahŕňa",
+    "body": "Tri malé nezávislé možnosti: <strong>farebný prompt bash s aliasmi</strong> pre shell root, jednoriadkový <strong>banner MOTD</strong> pri prihlásení cez SSH a odstránenie <strong>okna „Žiadne platné predplatné“</strong>, ktoré Proxmox zobrazuje pri každom prihlásení do webového rozhrania."
+  },
+  "bashrc": {
+    "heading": "Prispôsobiť bashrc",
+    "intro": "Vloží do <code>/root/.bashrc</code> pripravený blok s farebným promptom, históriou s časovými pečiatkami, bežnými aliasmi <code>ls</code> / <code>grep</code> a príkazom <code>source</code> na dopĺňanie bash. Spríjemní prácu cez SSH a pri viacerých otvorených kartách jasne ukáže aktuálneho hostiteľa.",
+    "writesTitle": "Čo ProxMenux pridáva do .bashrc",
+    "writesOutro": "Blok je ohraničený značkami <code>PMX_CORE_BASHRC</code>. Opätovné spustenie nahradí predchádzajúci blok bez duplikovania. Pôvodný <code>.bashrc</code> sa raz zálohuje do <code>/root/.bashrc.bak</code> a do <code>/root/.bash_profile</code> sa pridá riadok <code>source /root/.bashrc</code>, aby sa prompt použil aj v prihlasovacích shelloch, napríklad po <code>su -</code>.",
+    "rootTitle": "Platí iba pre root",
+    "rootBody": "Prispôsobenie sa týka shellu účtu root. Ostatní používatelia hostiteľa si ponechajú svoje predvolené nastavenia. Ak spravujete Proxmox výhradne cez webové rozhranie a shell nepoužívate, túto čisto estetickú možnosť môžete vynechať."
+  },
+  "motd": {
+    "heading": "Nastaviť vlastnú MOTD správu",
+    "intro": "Pridá <em>\"This system is optimised by: ProxMenux\"</em> na začiatok <code>/etc/motd</code>, správy po úspešnom prihlásení cez SSH, nad promptom a pred skriptmi <code>update-motd</code>. Neškodné a čisto informatívne — rýchle vizuálne potvrdenie použitia ProxMenux na hostiteľovi.",
+    "writesTitle": "Čo píše ProxMenux",
+    "writesOutro": "Pri prvom použití ProxMenux zaznamená, či <code>/etc/motd</code> existoval, a uloží pôvodný obsah pod <code>/usr/local/share/proxmenux</code>. Operácia je idempotentná: ak riadok so značkou už existuje, nič sa nepridá. Staršie inštalácie s <code>/etc/motd.bak</code> sa prevedú do rovnakého vratného stavu."
+  },
+  "banner": {
+    "heading": "Odstrániť hlásenie o predplatnom",
+    "intro": "Odstráni okno <em>„Nemáte platné predplatné pre tento server“</em>, ktoré sa zobrazuje pri každom prihlásení do webového rozhrania Proxmox bez predplatného Enterprise. ProxMenux zohľadňuje verziu a spustí správny skript pre odlišné balíky rozhrania hlavných verzií.",
+    "versionTitle": "Výber skriptu podľa verzie",
+    "versionItems": [
+      "<strong>PVE 9.x</strong> → spúšťa <code>remove-banner-pve-v3.sh</code> (opravuje desktop <code>proxmoxlib.js</code> aj nový mobilný UI založený na Yew).",
+      "<strong>PVE 8.x</strong> → spustí <code>remove-banner-pve8.sh</code> (iba pre počítač)."
+    ],
+    "versionOutro": "Pred úpravou ProxMenux zálohuje pôvodné súbory JS/šablón do <code>/usr/local/share/proxmenux/backups/</code> s časovou pečiatkou. Odinštalovanie ich obnoví zo záloh; ak záloha chýba alebo je poškodená, preinštaluje balíky rozhrania Proxmox.",
+    "breakTitle": "Môže sa zlomiť po aktualizáciách Proxmoxu",
+    "breakBody": "Aktualizácie rozhrania Proxmox pravidelne prepisujú <code>proxmoxlib.js</code>, takže upozornenie sa môže vrátiť. Túto možnosť môžete použiť znovu na opätovnú úpravu súboru alebo dovtedy ponechať upozornenie. ProxMenux inštaluje aj hook APT na automatické opakovanie úpravy po aktualizácii balíkov — jeho odstránenie opisuje <link>Odinštalovať optimalizácie</link>.",
+    "legalTitle": "Právne upozornenie (vždy stojí za to zopakovať)",
+    "legalBody": "Táto možnosť iba skryje upozornenie rozhrania. <strong>Neposkytuje</strong> podporu Enterprise ani prístup k repozitáru Enterprise a nemení licenciu softvéru. Proxmox VE sa vydáva pod GNU AGPLv3. Predplatné podporuje projekt a umožňuje prístup ku kanálu aktualizácií Enterprise; vyberte si podporu vhodnú pre svoje prostredie."
+  },
+  "verify": {
+    "heading": "Overenie",
+    "intro": "Po uplatnení všetkých troch:",
+    "reversibleTitle": "Všetky tri zmeny prispôsobenia sú sledované",
+    "reversibleBody": "<link>Odinštalovať optimalizácie</link> obnoví <code>/root/.bashrc</code>, vráti presný obsah MOTD spred ProxMenux alebo súbor odstráni, ak predtým neexistoval, a obnoví upravené súbory rozhrania zo zálohy alebo podľa potreby preinštaluje príslušné balíky Proxmox."
+  },
+  "related": {
+    "heading": "Súvisiace",
+    "items": [
+      {
+        "label": "Voliteľné",
+        "href": "/docs/post-install/optional",
+        "tail": " — Fastfetch a Figurine, ďalšie vizuálne úpravy."
+      },
+      {
+        "label": "Zobraziť informácie o verzii",
+        "href": "/docs/settings/show-version-information",
+        "tail": " — potvrdí, že prispôsobenia sú registrované ako nainštalované."
+      },
+      {
+        "label": "Odinštalovať optimalizácie",
+        "href": "/docs/post-install/uninstall",
+        "tail": " — obnoviť bashrc, motd a upozornenie na predplatné."
+      },
+      {
+        "label": "Prispôsobiteľné nastavenia po inštalácii",
+        "href": "/docs/post-install/customizable",
+        "tail": " — späť do nadradeného menu."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sk/docs/post-install/index.json b/web/messages/sk/docs/post-install/index.json
new file mode 100644
index 00000000..af8baf78
--- /dev/null
+++ b/web/messages/sk/docs/post-install/index.json
@@ -0,0 +1,106 @@
+{
+  "meta": {
+    "title": "Skript po inštalácii Proxmox VE — Automatizovaný a prispôsobiteľný | ProxMenux",
+    "description": "Prehľad skriptov ProxMenux po inštalácii Proxmox VE. Automatizovaný skript použije rozumné predvolené nastavenia bez otázok. Prispôsobiteľný skript umožní presný výber z 10 kategórií. Odinštalovať optimalizácie obnoví podporované vratné zmeny.",
+    "ogTitle": "Skript po inštalácii Proxmox VE — Automatizovaný a prispôsobiteľný",
+    "ogDescription": "Použite bežné optimalizácie po inštalácii Proxmox VE v 10 kategóriách — automaticky alebo podľa výberu, s vratnými možnosťami.",
+    "twitterTitle": "Skript po inštalácii Proxmox VE | ProxMenux",
+    "twitterDescription": "Automatizované a prispôsobiteľné optimalizácie po inštalácii Proxmox VE s vratnými možnosťami."
+  },
+  "header": {
+    "title": "Skripty po inštalácii",
+    "description": "Nakonfigurujte čerstvo nainštalovaný hostiteľ Proxmox VE pomocou optimalizácií ProxMenux. Automaticky použite základné nastavenia, vyberte jednotlivé možnosti, aktualizujte nainštalované funkcie alebo obnovte podporované vratné zmeny. Aktualizácie balíkov sa neuvádzajú ako vratné.",
+    "section": "Nastavenie Proxmoxu po inštalácii"
+  },
+  "intro": {
+    "title": "Na čo je toto menu",
+    "body": "Hneď po inštalácii Proxmox VE môžu desiatky drobných zmien zrýchliť hostiteľa a zjednodušiť jeho údržbu: repozitáre bez predplatného, rozumné limity journald a vyrovnávacie pamäte TCP, ukladanie záznamov šetrné k SSD, vylepšenia bashrc a ďalšie. ProxMenux ich automatizuje a sleduje podporované vratné zmeny konfigurácie."
+  },
+  "openingMenu": {
+    "heading": "Otvorenie menu",
+    "body": "V hlavnom menu ProxMenux vyberte <strong>Nastavenie Proxmoxu po inštalácii</strong>. Zobrazí sa toto:",
+    "imageAlt": "Ponuka Skripty po inštalácii – Automatizované, Prispôsobiteľné, podmienené Použiť dostupné aktualizácie (iba keď čakajú aktualizácie) a Odinštalovať, po ktorej nasleduje sekcia Komunitné skripty"
+  },
+  "threeWays": {
+    "heading": "Štyri spôsoby, ako uplatniť optimalizáciu",
+    "body": "Štyri položky ProxMenux používajú rovnaký kód aj register nainštalovaných nástrojov, ale poskytujú rôznu mieru ovládania. <em>Aplikovať dostupné aktualizácie</em> sa zobrazí iba vtedy, keď má aspoň jedna nainštalovaná optimalizácia na disku novšiu verziu než registrovanú. Na čerstvo nakonfigurovanom hostiteľovi zostáva skrytá."
+  },
+  "routes": [
+    {
+      "title": "Automatizované",
+      "description": "Starostlivo vybraných 14 bezpečných a vždy užitočných optimalizácií, ktoré sa použijú postupne bez otázok. Dobrá predvolená voľba pre väčšinu používateľov.",
+      "bullets": [
+        "Repozitáre bez predplatného + aktualizácia systému",
+        "Pamäť, jadro, sieťové ladenie",
+        "Log2RAM (automatické zistenie SSD/NVMe)",
+        "Journald + limity veľkosti logrotate",
+        "Trvalé názvy rozhraní"
+      ]
+    },
+    {
+      "title": "Prispôsobiteľné",
+      "description": "Približne 35 jednotlivých optimalizácií v 10 kategóriách. Presne si vyberiete, ktoré sa použijú. Rovnaký základ ako Automatizované, ale s úplnou kontrolou.",
+      "bullets": [
+        "Výberový zoznam so zaškrtávacími políčkami pre každú kategóriu",
+        "Obsahuje všetko z Automatizované a navyše výslovne voliteľné položky (IOMMU, Fastfetch, Figurine, Ceph, HA, opravy AMD…)",
+        "Spustite ho ľubovoľne veľakrát — zmeny sú idempotentné"
+      ]
+    },
+    {
+      "title": "Aplikovať dostupné aktualizácie",
+      "description": "Keď má optimalizácia po inštalácii (Log2Ram, nastavenia pamäte, Logrotate…) na disku novšiu verziu než tú registrovanú na hostiteľovi, položka zobrazí iba zmenené optimalizácie. Znovu spustí príslušnú funkciu a aktualizuje register — ničoho iného sa nedotkne.",
+      "bullets": [
+        "Výslovný výber každej optimalizácie, iba zmenených",
+        "Rovnaký výber je dostupný z prehľadu Monitor",
+        "Jedno súhrnné oznámenie pri dostupnosti nových aktualizácií"
+      ]
+    },
+    {
+      "title": "Odinštalovať optimalizácie",
+      "description": "Podporované vratné zmeny sa sledujú v registri JSON a majú priradenú funkciu obnovy. Akcie bez bezpečného vrátenia, napríklad úplná aktualizácia balíkov, sú zámerne vylúčené.",
+      "bullets": [
+        "Odhaľuje predtým aplikovanú optimalizáciu automaticky",
+        "Pre každú položku vyberie správny postup obnovy: obnoví zálohu .bak, ak bola vytvorená, odstráni konfiguračný úryvok sysctl.d, ak nebolo čo zálohovať, alebo znovu nainštaluje pôvodný balík s --force-confnew (napríklad pri upozornení na predplatné)",
+        "Výzva na reštart podľa potreby (VFIO, trvalé názvy atď.)"
+      ]
+    }
+  ],
+  "whichTitle": "Ktorý by si si mal vybrať?",
+  "whichBody": "Pri novej inštalácii Proxmox s rozumnými základnými nastaveniami bez rozhodovania vyberte <autoLink><strong>Automatizované</strong></autoLink>. Ak už poznáte požadované alebo nechcené úpravy: <customLink><strong>Prispôsobiteľné</strong></customLink>. Na aktualizáciu iba už použitej optimalizácie s novšou verziou na disku: <updatesLink><strong>Aplikovať dostupné aktualizácie</strong></updatesLink>. Na čisté vrátenie predchádzajúcich zmien: <uninstallLink><strong>Odinštalovať optimalizácie</strong></uninstallLink>. Možnosti možno kombinovať: najprv Automatizované, potom pridať Fastfetch či IOMMU cez Prispôsobiteľné a neskôr vrátiť jednotlivé položky.",
+  "mixing": {
+    "heading": "Miešanie s inými postinštalačnými skriptmi",
+    "stackTitle": "Nekombinujte viacero skriptov po inštalácii",
+    "stackBody": "Spustenie viacerých skriptov po inštalácii na rovnakom hostiteľovi môže vytvoriť duplicitné konfiguračné súbory, konfliktné položky sysctl alebo dokonca nefunkčnú sieť po reštarte. Ak ste už použili <strong>Helper-Scripts Post Install</strong>, niektoré optimalizácie ProxMenux sa môžu prekrývať s jeho konfiguráciou. Používajte jeden nástroj po inštalácii na hostiteľa.",
+    "xshokTitle": "xshok-proxmox: deprekovaný",
+    "xshokBody": "Staršie verzie ProxMenux uvádzali <a>xshok-proxmox</a> ako doplnkový nástroj po inštalácii. Projekt je už zastaraný a ProxMenux ho neponúka. Ak predchádzajúce spustenie zanechalo značky na hostiteľovi, ProxMenux ich stále zistí a upozorní vás. Dnes ho však nemáte inštalovať popri ProxMenux."
+  },
+  "community": {
+    "heading": "Komunitné skripty",
+    "body": "Menu ponúka aj dva skripty tretích strán z projektu <a>community-scripts</a>: <em>Proxmox VE Post Install</em> a <em>Proxmox VE Microcode</em>. Ide o obaly, ktoré stiahnu a spustia pôvodné autorské skripty cez <code>wget | bash</code>. ProxMenux ich neudržiava. Pred spustením si pozrite podrobnosti a otázky dôvery v časti <link>Externé repozitáre</link>."
+  },
+  "related": {
+    "heading": "Súvisiace",
+    "items": [
+      {
+        "label": "Aktualizácia systému Proxmox",
+        "href": "/docs/utils/system-update",
+        "tail": " — udržiava hostiteľa aktuálneho po nastavení po inštalácii."
+      },
+      {
+        "label": "Zabezpečenie",
+        "href": "/docs/security",
+        "tail": " — Fail2Ban + Lynis navyše k posilneniu zabezpečenia po inštalácii."
+      },
+      {
+        "label": "Zobraziť informácie o verzii",
+        "href": "/docs/settings/show-version-information",
+        "tail": " — Pozrite sa, ktoré komponenty po inštalácii sú sledované ako nainštalované."
+      },
+      {
+        "label": "Príkazy na aktualizácie a balíky",
+        "href": "/docs/help-info/update-commands",
+        "tail": " — Referencie pre apt / pveupgrade."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sk/docs/post-install/monitoring.json b/web/messages/sk/docs/post-install/monitoring.json
new file mode 100644
index 00000000..c68ed4d9
--- /dev/null
+++ b/web/messages/sk/docs/post-install/monitoring.json
@@ -0,0 +1,56 @@
+{
+  "meta": {
+    "title": "Po inštalácii: Sledovanie | Dokumentácia ProxMenux",
+    "description": "Možnosti sledovania v prispôsobiteľnom skripte ProxMenux po inštalácii. Zatiaľ jediná možnosť: inštalácia OVH Real-Time Monitoring (RTM), ktorá sa vykoná iba po zistení, že hostiteľ je serverom OVH."
+  },
+  "header": {
+    "title": "Po inštalácii: monitorovanie",
+    "description": "Možnosti sledovania v prispôsobiteľnom skripte po inštalácii. Táto malá kategória je špecifická pre poskytovateľa: nainštaluje agenta OVH Real-Time Monitoring na dedikovaných serveroch OVH a inde nič nevykoná.",
+    "section": "Nastavenie Proxmoxu po inštalácii"
+  },
+  "intro": {
+    "title": "Zámerne úzky rozsah",
+    "body": "Sledovanie po inštalácii sa obmedzuje na <strong>jedného agenta konkrétneho poskytovateľa</strong>. Všeobecné nástroje (Prometheus, Grafana, node_exporter) sem nepatria, pretože vyžadujú architektonické rozhodnutia o samostatnom hostiteľovi, uchovávaní údajov a cieľoch upozornení, ktoré sa nehodia do kroku na jedno kliknutie. ProxMenux Monitor, dodávaný s ProxMenux, pokrýva väčšinu tejto úlohy bez externého agenta."
+  },
+  "ovh": {
+    "heading": "Inštalovať OVH monitorovanie v reálnom čase (RTM)",
+    "intro": "Ak je hostiteľ Proxmox dedikovaný server prenajatý od <a>OVHcloud</a>, môžete povoliť RTM a sprístupniť hardvérovú telemetriu (teplota CPU, stav zdroja, SMART diskov, stav radiča RAID atď.) v ovládacom paneli OVH. Ide o rovnakého agenta, akého OVH používa pre funkciu „Server Monitoring“.",
+    "decisionsTitle": "Ako sa rozhoduje ProxMenux",
+    "decisionsItems": [
+      "Získa verejnú IP adresu hostiteľa cez <code>curl ipinfo.io/ip</code>.",
+      "Zistí vlastníckeho poskytovateľa pomocou dotazu <code>whois</code> na <code>v4.whois.cymru.com</code>.",
+      "Ak výsledok uvádza OVH, stiahne <code>last-public-ovh-infra-yak.snap.mirrors.ovh.net/yak/archives/apply.sh</code> a cez rúru ho odovzdá <code>bash</code> s manifestom Puppet pre RTM v2.",
+      "Ak výsledok <em>neuvádza</em> OVH, nič sa nenainštaluje. Možnosť nevykoná žiadne zmeny."
+    ],
+    "remoteTitle": "Vzdialený skript odovzdaný cez rúru do bash",
+    "remoteBody": "Inštalácia spustí <code>wget -qO - https://…apply.sh | bash</code>. Ak dôjde ku kompromitovaniu zrkadla OVH, skript sa na hostiteľovi vykoná ako root. Pred povolením zvážte dôveru v reťazec zrkadiel OVH oproti prínosu sledovania. Pre väčšinu domácich laboratórií a používateľov mimo OVH má možnosť zostať vypnutá.",
+    "noOpTitle": "Povoliť iba vtedy, ak je hostiteľ skutočne na OVH",
+    "noOpBody": "Na serveroch mimo OVH možnosť nič nemení, takže jej zaškrtnutie na domácom Proxmox nič nepokazí. Skript vypíše <em>„Nie je to server OVH, inštalácia RTM sa preskočí“</em> a ukončí sa bez inštalácie balíkov.",
+    "runsTitle": "Čo ProxMenux spúšťa",
+    "verifyTitle": "Overenie",
+    "verifyBody": "Na skutočnom hostiteľovi OVH by sa po reštarte mal v OVH Manager zobraziť <a>prehľad RTM</a> s aktuálnymi údajmi hostiteľa. Na strane Proxmox je zberač RTM službou systemd — overte ju priamo:",
+    "troubleTitle": "Riešenie problémov",
+    "revertTitle": "Odstrániť RTM cez menu Odinštalovať",
+    "revertBody": "Ak je RTM registrovaný ako nainštalovaný, Odinštalovať optimalizácie ponúkne položku OVH Real-Time Monitoring. Spustí <code>apt-get purge -y ''ovh-rtm*'' ''rtm'' ''rtm-*''</code>, odstráni /etc/rtm a označí RTM za odinštalovaný. Zvyšky Puppet môžu vyžadovať ručné čistenie; skontrolujte manifesty RTM v <code>/etc/puppet/</code>. Na hostiteľovi mimo OVH sa balíky RTM nenainštalovali, takže nie je čo odstrániť."
+  },
+  "related": {
+    "heading": "Súvisiace",
+    "items": [
+      {
+        "label": "ProxMenux Monitor",
+        "href": "/docs/settings/proxmenux-monitor",
+        "tail": " — lokálny webový prehľad hostiteľa, ktorý funguje u každého poskytovateľa, nielen OVH."
+      },
+      {
+        "label": "Užitočné systémové príkazy",
+        "href": "/docs/help-info/system-commands",
+        "tail": " — referencia pre sledovanie lokálneho hostiteľa."
+      },
+      {
+        "label": "Prispôsobiteľné nastavenia po inštalácii",
+        "href": "/docs/post-install/customizable",
+        "tail": " — späť do nadradeného menu."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sk/docs/post-install/network.json b/web/messages/sk/docs/post-install/network.json
new file mode 100644
index 00000000..9a3cfe8a
--- /dev/null
+++ b/web/messages/sk/docs/post-install/network.json
@@ -0,0 +1,128 @@
+{
+  "meta": {
+    "title": "Po inštalácii: Sieť | Dokumentácia ProxMenux",
+    "description": "Sieťové možnosti prispôsobiteľného skriptu ProxMenux po inštalácii: vynútiť APT cez IPv4, použiť vybraný profil sysctl, nainštalovať Open vSwitch, zapnúť TCP BBR + Fast Open a priradiť názvy rozhraní k ich MAC adresám."
+  },
+  "header": {
+    "title": "Po inštalácii: Sieť",
+    "section": "Nastavenie Proxmoxu po inštalácii"
+  },
+  "intro": {
+    "title": "Čo táto kategória zahŕňa",
+    "body": "Päť nezávislých sieťových možností. Dve sú jednoduché (<strong>APT cez IPv4</strong>, <strong>inštalácia Open vSwitch</strong>), dve upravujú správanie TCP (<strong>sieťový profil sysctl</strong>, <strong>BBR + Fast Open</strong>) a jedna rieši častý prevádzkový problém: <strong>pevné priradenie názvov rozhraní</strong>, aby nová sieťová karta alebo aktualizácia BIOSu nepremenovala <code>enp3s0</code> na <code>enp4s0</code> a nenarušila mosty."
+  },
+  "ipv4": {
+    "heading": "Prinútiť APT používať IPv4",
+    "intro": "Píše <code>Acquire::ForceIPv4 \"true\";</code> na <code>/etc/apt/apt.conf.d/99-force-ipv4</code>. APT potom odmieta používať IPv6 na sťahovanie balíkov, aj keď má hostiteľ IPv6 pripojenie.",
+    "tipTitle": "Kto má prospech",
+    "tipBody": "Užitočné pri nestabilnom IPv6, pri nižšej rýchlosti oproti IPv4 alebo ak zrkadlo Debian/Proxmox občas cez IPv6 nefunguje. Hostiteľom bez IPv6 neprekáža. Vo funkčnej sieti s oboma protokolmi zaistí predvídateľné správanie: apt vás neprekvapí prekročením časového limitu IPv6."
+  },
+  "sysctl": {
+    "heading": "Použiť sieťové optimalizácie",
+    "intro": "Zapíše vybraný profil sysctl do <code>/etc/sysctl.d/99-network.conf</code>. Zahŕňa vyrovnávacie pamäte socketov jadra, posilnenie ICMP, základnú ochranu pred falšovaním adries a veľkosti vyrovnávacích pamätí TCP vhodné pre hypervízor s mnohými súbežnými tokmi.",
+    "tunedTitle": "Čo sa upraví",
+    "headerArea": "Oblasť",
+    "headerSettings": "Kľúčové nastavenia",
+    "rows": [
+      {
+        "area": "Vyrovnávacie pamäte socketov jadra",
+        "settings": "<code>netdev_max_backlog=8192</code>, <code>rmem_max=16M</code>, <code>wmem_max=16M</code>, <code>somaxconn=8192</code>"
+      },
+      {
+        "area": "Posilnenie ICMP",
+        "settings": "<code>icmp_echo_ignore_broadcasts=1</code>, <code>icmp_ignore_bogus_error_responses=1</code>"
+      },
+      {
+        "area": "Bezpečnosť smerovania",
+        "settings": "<code>accept_redirects=0</code>, <code>accept_source_route=0</code>, <code>secure_redirects=0</code>, <code>send_redirects=0</code>, <code>log_martians=0</code>"
+      },
+      {
+        "area": "Filter spätnej cesty",
+        "settings": "<code>rp_filter=2</code> (voľný režim, pozri poznámku nižšie)"
+      },
+      {
+        "area": "TCP",
+        "settings": "<code>tcp_mtu_probing=1</code>, <code>tcp_rfc1337=1</code>, <code>tcp_sack=1</code>, <code>tcp_rmem=8K/87K/16M</code>, <code>tcp_wmem=8K/64K/16M</code>"
+      },
+      {
+        "area": "Porty",
+        "settings": "<code>ip_local_port_range=1024 65535</code> (rozsah dočasných portov)"
+      },
+      {
+        "area": "Unixové sockety",
+        "settings": "<code>net.unix.max_dgram_qlen=4096</code>"
+      }
+    ],
+    "sourceOutro": "Pridá tiež <code>source /etc/network/interfaces.d/*</code> do <code>/etc/network/interfaces</code>, ak tam ešte nie je. Ide o bežný postup umožňujúci pridávať samostatné konfiguračné súbory rozhraní bez úpravy hlavného súboru.",
+    "fwbrTitle": "Automatické ladenie virtuálnych mostov firewallu",
+    "fwbrBody": "Spolu s profilom sysctl ProxMenux nainštaluje pomocný skript <code>/usr/local/sbin/proxmenux-fwbr-tune</code>. Nastaví <code>rp_filter=0</code> a <code>log_martians=0</code> na rozhraniach <code>fwbr*</code> / <code>fwln*</code> / <code>fwpr*</code> / <code>tap*</code>, ktoré Proxmox vytvára pre VM a kontajnery. Jednorazová jednotka <code>proxmenux-fwbr-tune.service</code> ho spustí pri štarte a pravidlo <code>/etc/udev/rules.d/99-zz-proxmenux-fwbr-tune.rules</code> pri každej udalosti <code>net add</code> s týmito predponami. Zahŕňa aj rozhrania znovu vytvorené pri spustení/zastavení VM, reštarte a živej migrácii. Skript sa spustí aj hneď po inštalácii a spracuje už existujúce rozhrania.",
+    "rpFilterTitle": "Prečo rp_filter=2 (voľný) namiesto 1 (prísny)",
+    "rpFilterBody": "Prísny filter spätnej cesty zahadzuje pakety, ktorých zdroj by bol dostupný cez <em>iné</em> rozhranie. Je to vhodné predvolené nastavenie klienta, ale na hostiteľovi Proxmox môže narušiť sieť: prevádzka VM často prichádza cez most a odchádza cez uplink s asymetrickými trasami. <code>rp_filter=2</code> (voľný) zahadzuje iba pakety so skutočne nesmerovateľnými zdrojmi. Ide o kompromis: mierne nižšia detekcia falšovania lokálnej IP adresy výmenou za funkčnú sieť VM."
+  },
+  "ovs": {
+    "heading": "Nainštalovať Open vSwitch",
+    "intro": "Nainštaluje <code>openvswitch-switch</code> + <code>openvswitch-common</code>. Balíky pridajú OVS ako alternatívu k predvoleným linuxovým mostom Proxmoxu. Samotná inštalácia nemení sieť: existujúce mosty <code>vmbrX</code> fungujú ďalej. Pri <em>vytváraní</em> nového mosta v rozhraní Proxmox si môžete vybrať OVS zo zoznamu typov.",
+    "tipTitle": "Keď OVS dáva zmysel",
+    "tipBody": "Zvážte OVS, ak potrebujete <strong>VLAN trunking s nesúvislými VLAN ID</strong>, <strong>LACP s LLDP v špecifických režimoch</strong>, <strong>jemnozrnné programovanie toku</strong> (OpenFlow), alebo súčinnosť s radičmi SDN. Pre domáce laboratórium s niekoľkými sieťami VLAN a jedným uplinkom LACP, štandardné linuxové mosty + <code>vmbrX.VID</code> sú jednoduchšie a úplne v poriadku.",
+    "revertTitle": "Reverzibilné z menu Odinštalovať",
+    "revertBody": "OVS je zaznamenaný. <link>Odinštalovať optimalizácie</link> spustí <code>apt purge</code> pre <code>openvswitch-switch</code> a <code>openvswitch-common</code>. Mosty OVS migrujte späť na linuxové mosty <em>pred</em> odinštaláciou, inak ich VM pri ďalšom štarte stratia sieť. Ručný ekvivalent:"
+  },
+  "bbr": {
+    "heading": "Povoliť TCP BBR + TCP Fast Open",
+    "intro": "Zapíše dva súbory sysctl a znovu ich načíta. BBR nahradí CUBIC algoritmom riadenia preťaženia od Googlu založeným na šírke pásma, ktorý lepšie zvláda vysokokapacitné spoje s veľkou latenciou aj stratové spoje. TCP Fast Open (TFO) ušetrí jeden obojsmerný prenos pri opakovaných spojeniach TCP tým, že odošle dáta už v SYN.",
+    "verifyTitle": "Overenie",
+    "impactTitle": "Vplyv závisí od pracovného zaťaženia",
+    "impactBody": "BBR vyniká na spojoch s vysokou latenciou alebo stratami paketov (medzikontinentálna replikácia, tunely VPN, mobilní klienti). V LAN medzi dvoma počítačmi na rovnakom prepínači býva rozdiel v rámci šumu merania. TFO najviac pomáha krátkym opakovaným spojeniam HTTP.",
+    "revertTitle": "Reverzibilné z menu Odinštalovať",
+    "revertBody": "BBR/TFO sú zaznamenané. <link>Odinštalovať optimalizácie</link> odstráni dva súbory sysctl (<code>/etc/sysctl.d/99-kernel-bbr.conf</code> a <code>99-tcp-fastopen.conf</code>) a znovu načíta zvyšnú konfiguráciu. Odstránenie súboru samo neobnoví aktívne hodnoty jadra. Predvolené hodnoty ako <code>cubic</code> a <code>tcp_fastopen=1</code> sa vrátia po reštarte, ak ich neprepíše iná konfigurácia. Ručný ekvivalent:"
+  },
+  "names": {
+    "heading": "Trvalé názvy rozhraní",
+    "intro": "Prejde fyzické sieťové karty hostiteľa. Vynechá loopback, Docker veth, mosty, zariadenia TAP, bondy, Cilium, ZeroTier a WireGuard. Zapíše súbor systemd <code>.link</code>, ktorý priradí aktuálny názov k aktuálnej MAC adrese. Priradenie podľa MAC tak dostane prednosť pred pravidlami pomenovania jadra.",
+    "whyTitle": "Prečo na tom záleží",
+    "whyItems": [
+      "Pridanie alebo odstránenie zariadení PCIe môže zmeniť číslovanie zbernice a premenovať <code>enp3s0</code> na <code>enp4s0</code>. Ak <code>/etc/network/interfaces</code> odkazuje na starý názov, most po reštarte zmizne.",
+      "BIOS / Aktualizácie firmvéru niekedy menia spôsob, akým zariadenia enumerujú, s rovnakým účinkom.",
+      "Pomocný skript zapisuje súbory <code>.link</code> pre fyzické karty vrátane portov bondov, s MAC adresou, ktorú práve hlási sysfs; pri portoch bondu to môže byť spoločná MAC bondu, preto ich názvy po reštarte skontrolujte. Vynecháva virtuálne rozhrania, napríklad LXC veth a samotné bondy; nerieši súbehy pri pomenovaní virtuálnych kariet <code>hotplug</code>."
+    ],
+    "writtenTitle": "Čo sa napíše",
+    "writtenIntro": "Jeden súbor pre každú fyzickú kartu v <code>/etc/systemd/network/10-proxmenux-&lt;iface&gt;.link</code>. Začína hlavičkou <code># Managed by ProxMenux — do not edit</code>, aby ProxMenux rozlíšil vlastné súbory od súborov <code>.link</code> používateľa alebo iných balíkov.",
+    "writtenOutro": "Súbory <code>.link</code> iných balíkov alebo používateľa zostávajú zachované; spravujú sa iba súbory s hlavičkou ProxMenux. Pri opakovanom spustení funkcia skontroluje svoje súbory: z každého <code>10-proxmenux-*.link</code> znovu načíta <code>MACAddress=</code> a odstráni tie, ktorých MAC sa už nenachádza v <code>/sys/class/net/</code>. Súbory starších verzií vo formáte <code>10-&lt;iface&gt;.link</code> sa pri prvom spustení automaticky migrujú.",
+    "pveTitle": "PVE 9 vs PVE 8",
+    "pveBody": "Skript používa súbory systemd <code>.link</code> pre trvalé názvy. V Proxmox VE 9 po ich zápise navyše načíta pravidlá udev, aby už pripnutá karta, ktorá sa znova pripojí alebo rozpozná, použila svoje pravidlo bez reštartu. Existujúce rozhrania skontrolujte po reštarte v PVE 8 aj PVE 9. Nemení sa tým používanie <code>ifupdown2</code> na hostiteľovi. Skript v oboch prípadoch nastaví príznak reštartu, aby sa naň prispôsobiteľné nastavenie opýtalo.",
+    "reviewTitle": "Najprv skontrolujte existujúci /etc/network/interfaces",
+    "reviewBody": "Ak staršia konfigurácia v <code>/etc/network/interfaces</code> odkazuje na názvy kariet vytvorené jadrom, pevné priradenie <em>aktuálnych</em> názvov je správny výsledok. Ak ste už konfiguráciu ručne prispôsobili konkrétnym názvom, pred reštartom overte, že pevné názvy zodpovedajú súboru interfaces.",
+    "revertTitle": "Reverzibilné z menu Odinštalovať",
+    "revertBody": "<link>Odinštalovať optimalizácie</link> odstráni iba súbory <code>10-proxmenux-*.link</code> s hlavičkou ProxMenux z <code>/etc/systemd/network/</code>. Zachová všetky súbory <code>.link</code> používateľa alebo iných balíkov. Po ďalšom reštarte sa obnoví predvolené pomenovanie systemd."
+  },
+  "related": {
+    "heading": "Súvisiace",
+    "items": [
+      {
+        "label": "Správa siete",
+        "href": "/docs/network",
+        "tail": " — diagnostika, analýza mostov a opravy so sprievodcom."
+      },
+      {
+        "label": "Trvalé názvy rozhraní",
+        "href": "/docs/network/persistent-names",
+        "tail": " — rovnaká funkcia neskôr v samostatnom menu; použite jednu z možností, nie obe."
+      },
+      {
+        "label": "Prehľad sieťových príkazov",
+        "href": "/docs/help-info/network-commands",
+        "tail": " — ip, ss, ethtool, sysctl."
+      },
+      {
+        "label": "Odinštalovať optimalizácie",
+        "href": "/docs/post-install/uninstall",
+        "tail": " — vráti tieto zmeny siete späť."
+      },
+      {
+        "label": "Prispôsobiteľné nastavenia po inštalácii",
+        "href": "/docs/post-install/customizable",
+        "tail": " — späť do nadradeného menu."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sk/docs/post-install/optional.json b/web/messages/sk/docs/post-install/optional.json
new file mode 100644
index 00000000..ee101952
--- /dev/null
+++ b/web/messages/sk/docs/post-install/optional.json
@@ -0,0 +1,177 @@
+{
+  "meta": {
+    "title": "ProxMenux po inštalácii: Voliteľné nastavenia",
+    "description": "Sprievodca voliteľnými nastaveniami skriptu ProxMenux po inštalácii pre ďalšie funkcie a optimalizácie Proxmox VE.",
+    "ogTitle": "ProxMenux po inštalácii: Voliteľné nastavenia",
+    "ogDescription": "Sprievodca voliteľnými nastaveniami skriptu ProxMenux po inštalácii pre ďalšie funkcie a optimalizácie Proxmox VE.",
+    "ogImageAlt": "ProxMenux Nepovinné nastavenia po inštalácii"
+  },
+  "title": "Voliteľné nastavenia",
+  "intro": "Kategória <strong>Voliteľné nastavenia</strong> ponúka ďalšie funkcie a optimalizácie pre inštaláciu Proxmox VE. Nie sú nevyhnutné, ale v konkrétnych situáciách môžu rozšíriť možnosti systému.",
+  "available": "Dostupné voliteľné funkcie",
+  "stepLabel": "Krok",
+  "ceph": {
+    "title": "Pridať najnovšiu podporu Ceph",
+    "intro": "Táto možnosť nainštaluje najnovšiu podporu Ceph úložného systému pre Proxmox VE. Ceph je distribuovaný úložný systém, ktorý poskytuje vysoký výkon, spoľahlivosť a škálovateľnosť.",
+    "doesIntro": "Čo robí:",
+    "doesItems": [
+      "Pridá repozitár Ceph do vášho systému",
+      "Aktualizuje zoznamy balíkov",
+      "Inštaluje balíky Ceph pomocou príkazu 'pveceph install'",
+      "Overuje inštaláciu"
+    ],
+    "howUse": "Použitie: Po inštalácii môžete nastaviť a spravovať úložisko Ceph cez webové rozhranie Proxmox VE alebo nástroje príkazového riadku.",
+    "automates": "Táto úprava automatizuje nasledujúce príkazy:"
+  },
+  "amd": {
+    "title": "Použiť opravy CPU AMD",
+    "intro": "Táto možnosť použije konkrétne opravy procesorov AMD EPYC a Ryzen na zlepšenie stability a kompatibility.",
+    "doesIntro": "Čo robí:",
+    "doesItems": [
+      "Odhaľuje, či je prítomný AMD EPYC alebo Ryzen CPU",
+      "Použije parameter jadra idle=nomwait na predchádzanie náhodným pádom (cez /etc/kernel/cmdline na hostiteľoch so systemd-boot alebo /etc/default/grub pri GRUB, so zálohou originálu .bak).",
+      "Nastaví KVM na ignorovanie určitých MSR (registrov špecifických pre model) pre lepšiu kompatibilitu hosťovských systémov Windows."
+    ],
+    "howUse": "Použitie: Opravy sa použijú automaticky a prejavia sa po reštarte systému.",
+    "automates": "Táto úprava automatizuje nasledujúce príkazy:"
+  },
+  "ha": {
+    "title": "Zapnúť služby vysokej dostupnosti",
+    "intro": "Táto možnosť zapne služby vysokej dostupnosti (HA) v Proxmox VE, ktoré umožňujú automatické prevzatie VM a kontajnerov iným uzlom pri poruche uzla.",
+    "doesIntro": "Čo robí:",
+    "doesItems": [
+      "Zapne a spustí službu pve-ha-lrm (lokálny správca zdrojov)",
+      "Zapne a spustí službu pve-ha-crm (správca zdrojov klastra)",
+      "Zapne a spustí službu corosync na komunikáciu klastra"
+    ],
+    "howUse": "Ako používať: Po umožnení týchto služieb môžete konfigurovať HA skupiny a zdroje vo webovom rozhraní Proxmox VE.",
+    "automates": "Táto úprava automatizuje nasledujúce príkazy:"
+  },
+  "pveam": {
+    "title": "Aktualizovať Proxmox VE Appliance Manager",
+    "intro": "Obnoví lokálny index šablón kontajnerov, ktorý <code>pveam</code> sprístupňuje v rozhraní Proxmox. Zoznam dostupných softvérových šablón tak bude aktuálny pri ďalšom vytvorení LXC.",
+    "doesIntro": "Čo robí:",
+    "doesItems": [
+      "Spustí <code>pveam update</code> voči zrkadlám Proxmox a získa aktuálny katalóg softvérových šablón",
+      "Doplní zoznam softvérových šablón zobrazený pri vytváraní kontajnera"
+    ],
+    "howUse": "Použitie: spustite ho, ak zoznam šablón v rozhraní vyzerá zastarano alebo po zmene zrkadiel. Stiahne iba index katalógu, nie samotné šablóny.",
+    "automates": "Táto úprava automatizuje nasledujúci príkaz:"
+  },
+  "fastfetch": {
+    "title": "Nainštalovať a nastaviť Fastfetch",
+    "intro": "Táto možnosť ticho nainštaluje a konfiguruje nástroj Fastfetch, ktorý zobrazuje systémové špecifikácie a vlastné logo pri prihlásení.",
+    "doesLabel": "Čo robí:",
+    "doesItems": [
+      "Ticho stiahne a nainštaluje najnovšiu verziu Fastfetch",
+      "Umožňuje vám vybrať si vlastné logo (<strong>ProxMenux, Proxmox, Helper-Scripts, Home-Labs-Club, Proxmology</strong> alebo vlastné logo)",
+      "Nastaví Fastfetch na zobrazenie <em>„Systém optimalizovaný cez ProxMenux“</em>",
+      "Nastaví Fastfetch pre automatické spustenie pri prihlásení konzoly"
+    ],
+    "importantLabel": "Dôležité:",
+    "importantBody": "Ak sa pripájate k Proxmoxu cez SSH, vyberte logo <strong>Proxmox</strong> alebo vytvorte vlastné pomocou <code>jp2a</code> alebo <code>img2txt</code>. Ostatné logá vytvára <code>chafa</code> a v bežnej relácii SSH sa nemusia zobraziť správne.",
+    "customLabel": "Vlastné logá:",
+    "customBody1": "Vlastné logo použijete vložením textového súboru s ASCII grafikou do: <code>/usr/local/share/fastfetch/logos/</code>",
+    "customBody2": "Môžete vytvoriť vlastné logá pomocou nástrojov ako <code>chafa</code>, <code>jp2a</code>, alebo <code>img2txt</code>.",
+    "customBody3": "Pre dosiahnutie najlepších výsledkov:",
+    "customItems": [
+      "Obmedzte výšku loga na 35 riadkov, aby sa zachovali proporcie a zmestilo sa do terminálu",
+      "Použite <code>chafa</code> pre farebné logá (v reláciách SSH sa nemusia zobraziť správne)",
+      "Použiť <code>jp2a</code> alebo <code>img2txt</code> pre logá kompatibilné s SSH"
+    ],
+    "examplesLabel": "Príkladové logá:",
+    "logos": [
+      {
+        "name": "ProxMenux",
+        "alt": "Logo ProxMenux",
+        "src": "https://macrimi.github.io/ProxMenux/fastfetch/proxmenux.png"
+      },
+      {
+        "name": "Proxmox",
+        "alt": "Logo Proxmox",
+        "src": "https://macrimi.github.io/ProxMenux/fastfetch/proxmox.png"
+      },
+      {
+        "name": "JC Channel",
+        "alt": "Logo JC Channel",
+        "src": "/fastfetch/jc-channel.png"
+      },
+      {
+        "name": "Helper-Scripts",
+        "alt": "Logo Helper-Scripts",
+        "src": "https://macrimi.github.io/ProxMenux/fastfetch/helper-scripts.png"
+      },
+      {
+        "name": "Home-Labs-Club",
+        "alt": "Logo Home-Labs-Club",
+        "src": "https://macrimi.github.io/ProxMenux/fastfetch/home-labs-club.png"
+      },
+      {
+        "name": "Proxmology",
+        "alt": "Logo Proxmology",
+        "src": "https://macrimi.github.io/ProxMenux/fastfetch/proxmology.png"
+      }
+    ],
+    "automates": "Táto úprava automatizuje nasledujúce príkazy:"
+  },
+  "figurine": {
+    "title": "Inštalovať a nastaviť Figurine",
+    "intro": "Táto voľba nainštaluje a konfiguruje Figurine, nástroj, ktorý vytvára štýlové ASCII textové bannery pre váš terminál, zobrazujúci vaše meno hostiteľa vo vizuálne atraktívnom 3D formáte.",
+    "doesLabel": "Čo robí:",
+    "doesItems": [
+      "Stiahne a nainštaluje Figurine v2.1.1 z GitHubu pre architektúru hostiteľa (AMD64, ARM64 alebo ARMv7)",
+      "Vytvorí uvítaciu správu, ktorá zobrazí vaše meno hostiteľa v 3D ASCII umení pri prihlásení",
+      "Aktualizuje existujúci binárny súbor Figurine až po úspešnom stiahnutí a rozbalení",
+      "Nastaví uvítaciu správu pre automatické spustenie pri prihlásení"
+    ],
+    "practicalLabel": "Praktické použitie:",
+    "practicalBody": "Pri správe viacerých uzlov Proxmox v klastri Figurine hneď ukáže, do ktorého uzla ste prihlásený. Pomáha to predchádzať náhodným príkazom na nesprávnom uzle a zlepšuje prácu s viacerými servermi.",
+    "exampleLabel": "Príklad výstupu:",
+    "imageAlt": "Príklad výstupu Figurine",
+    "automates": "Táto úprava automatizuje tento proces:",
+    "outro": "Po inštalácii uvidíte vaše meno hostiteľa zobrazené v 3D ASCII umení zakaždým, keď sa prihlásite, aby bolo okamžite jasné, na ktorom uzol Proxmox pracujete."
+  },
+  "log2ram": {
+    "title": "Nainštalovať Log2RAM (zníženie opotrebenia SSD/NVMe)",
+    "intro": "Log2RAM pripojí <code>/var/log</code> ako ramdisk tmpfs a pravidelne ho synchronizuje na disk. Ukladanie častých zápisov journald do RAM môže znížiť opotrebenie SSD a diskové I/O. Synchronizácia a riadne vypnutie uložia logy na disk, ale náhly výpadok napájania môže stratiť záznamy od poslednej synchronizácie.",
+    "upstreamLabel": "Pôvodný projekt:",
+    "upstreamUrl": "https://github.com/azlux/log2ram",
+    "upstreamLinkLabel": "azlux/log2ram na GitHub",
+    "doesLabel": "Čo robí ProxMenux:",
+    "doesItems": [
+      "Čítaním <code>/sys/block/&lt;dev&gt;/queue/rotational</code> zistí, či je koreňový disk SSD/NVMe. Pri rotačnom disku sa automatický postup pred inštaláciou opýta.",
+      "Naklonuje pôvodný repozitár (<code>azlux/log2ram</code>) do <code>/tmp/log2ram</code> a upraví <code>install.sh</code>: nahradí <code>rsync -aAXv</code> príkazom <code>rsync -aXv --no-acls</code>. Predíde tak chybe <em>set_acl: Operation not supported</em> s návratovým kódom 23 pri presune /var/log na súborovom systéme bez ACL. Jednotka systemd <code>log2ram</code> sa po inštalácii zapne.",
+      "Nastaví veľkosť ramdisku podľa RAM hostiteľa: <code>≤ 8 GB → 128M</code>, <code>≤ 16 GB → 256M</code>, <code>&gt; 16 GB → 512M</code>. Zapíše hodnotu do <code>SIZE=</code> v <code>/etc/log2ram.conf</code>.",
+      "Plánuje periodickú synchronizáciu disku cez <code>/etc/cron.d/log2ram</code>: každý 1h / 3h / 6h podľa rovnakej úrovne RAM.",
+      "Nainštaluje <code>/usr/local/bin/log2ram-check.sh</code>, spúšťaný cez <code>/etc/cron.d/log2ram-auto-sync</code> každých 10 minút. Keď <code>/var/log</code> dosiahne 80% ramdisku, vyčistí staré žurnály. Pri 92% najprv spustí <code>logrotate -f /etc/logrotate.d/proxmox-backup-api</code>, ak súbor existuje: logy API PBS bývajú najväčším spotrebiteľom miesta na hostiteľovi PBS. Potom skráti <code>pveproxy access/error</code> a <code>pveam.log</code> pred synchronizáciou. Samotný <code>log2ram write</code> skopíruje tmpfs na disk, ale nezmenší ho. Ochrana pomáha predchádzať pádom PVE s <em>No space left on device</em> pri nekontrolovanom raste logov.",
+      "Zistí službu <code>proxmox-backup-server</code> na hostiteľovi. Ak existuje, vytvorí <code>/etc/logrotate.d/proxmox-backup-api</code> (20 MB × 3 rotácie) a <code>/etc/cron.hourly/proxmox-backup-logrotate</code>, aby obmedzil logy API PBS, častý zdroj rastu, aj medzi synchronizáciami Log2RAM. Bez PBS nič nezmení.",
+      "Prispôsobí limity systemd-journald (<code>SystemMaxUse</code>, <code>RuntimeMaxUse</code>) ramdisku, aby ho nárazový príval záznamov nezaplnil.",
+      "Zaznamená sa v <code>installed_tools.json</code>, aby sa dal vrátiť cez Odinštalovať optimalizácie."
+    ],
+    "howUseLabel": "Ako používať:",
+    "howUseBody": "Automatický postup nainštaluje Log2RAM bez zásahu pri zistení koreňového SSD/NVMe. Prispôsobiteľný postup sa pýta na veľkosť, interval a ochranu synchronizácie. Výzva uvádza 90%, no vytvorený skript používa vyššie opísané limity 80% na čistenie a 92% na intenzívne čistenie.",
+    "verifyLabel": "Overiť a spravovať zo shellu:",
+    "verifyCode": "# Service state and configured timers\nsystemctl status log2ram\nsystemctl list-timers log2ram*\n\n# Current ramdisk usage — /var/log IS the tmpfs itself\ndf -h /var/log\n\n# Force a sync now (tmpfs → disk); does NOT shrink the tmpfs\nlog2ram write\n\n# Trigger the auto-sync guard on demand (vacuum + sync when usage is high)\n/usr/local/bin/log2ram-check.sh\n\n# Current config: SIZE, mail settings, path\ncat /etc/log2ram.conf\n\n# ProxMenux-specific cron jobs\ncat /etc/cron.d/log2ram /etc/cron.d/log2ram-auto-sync\n\n# Recent Log2RAM activity\njournalctl -u log2ram -n 50 --no-pager"
+  },
+  "zram": {
+    "title": "Povoliť výmenný profil ZRAM",
+    "intro": "Pomocou <code>/dev/zram0</code> vytvorí komprimované odkladacie zariadenie v RAM cez <code>systemd-zram-generator</code>. Stránky presunuté jadrom do swapu sa komprimujú cez zstd a zostanú v pamäti pred použitím swapu na disku.",
+    "doesLabel": "Čo robí:",
+    "doesItems": [
+      "Nainštaluje <code>systemd-zram-generator</code>, ak chýba, a zaznamená, či ho nainštaloval ProxMenux.",
+      "Zapíše <code>/etc/systemd/zram-generator.conf.d/90-proxmenux.conf</code>: zariadenie <code>zram0</code> s veľkosťou desatiny RAM hostiteľa, kompresiou zstd (<code>zstd(level=9)</code> pri systemd-zram-generator 1.2.0 alebo novšom) a prioritou swapu 32767.",
+      "S touto prioritou jadro najprv zaplní ZRAM. Existujúci swap na disku si zachová svoju prioritu a prijme stránky, ktoré sa už do ZRAM nezmestia.",
+      "Pred zmenou niečoho, hľadá ďalšie nastavenie ZRAM: aktívny zram swap, zram linka v <code>/etc/fstab</code>, systemd jednotka alebo iný súbor generátora. Ak ho nájde, možnosť sa zastaví a nechá nastavenie ako je.",
+      "Spustí <code>dev-zram0.swap</code> a overí, či aktívne zariadenie zodpovedá profilu. Ak nie, obnoví predchádzajúci stav.",
+      "Zaznamená sa v <code>installed_tools.json</code>, aby sa dal vrátiť cez Odinštalovať optimalizácie."
+    ],
+    "howUseLabel": "Ako používať:",
+    "howUseBody": "Možnosť je iba v prispôsobiteľnom postupe; automatický ju nepoužíva. Zariadenie sa pri každom štarte vytvorí znovu. Kým je aktívne, panel Pamäť v ProxMenux Monitor zobrazí kapacitu, využitý swap, algoritmus, kompresný pomer a obsadenú fyzickú pamäť.",
+    "verifyLabel": "Overiť zo shellu:",
+    "verifyCode": "# Active swap devices and their priority\nswapon --show\n\n# ZRAM device: algorithm, size and compressed data\nzramctl\n\n# Profile written by ProxMenux\ncat /etc/systemd/zram-generator.conf.d/90-proxmenux.conf\n\n# State of the swap unit\nsystemctl status dev-zram0.swap"
+  },
+  "autoApplication": {
+    "title": "Automatická aplikácia",
+    "body": "V prispôsobiteľnom postupe vyberte funkcie podľa potreby. Log2RAM je aj súčasťou automatického postupu s detekciou hardvéru; ZRAM zostáva iba prispôsobiteľný. Jednotlivé časti opisujú výzvy a predpoklady."
+  }
+}
diff --git a/web/messages/sk/docs/post-install/performance.json b/web/messages/sk/docs/post-install/performance.json
new file mode 100644
index 00000000..0681e16a
--- /dev/null
+++ b/web/messages/sk/docs/post-install/performance.json
@@ -0,0 +1,61 @@
+{
+  "meta": {
+    "title": "Po inštalácii: Výkon | Dokumentácia ProxMenux",
+    "description": "Možnosti výkonu v prispôsobiteľnom skripte ProxMenux po inštalácii. Nahrádza jednovláknový gzip programom pigz (paralelný gzip) na rýchlejšie zálohovanie a kompresiu na viacjadrových hostiteľoch."
+  },
+  "header": {
+    "title": "Po inštalácii: výkon",
+    "description": "Možnosti výkonu v prispôsobiteľnom skripte po inštalácii. Kategória obsahuje jednu optimalizáciu: nahradenie gzip programom pigz, aby zálohovanie a kompresia používali všetky jadrá CPU namiesto jedného.",
+    "section": "Nastavenie Proxmoxu po inštalácii"
+  },
+  "intro": {
+    "title": "Čo táto kategória zahŕňa",
+    "body": "Jediná možnosť výkonu tu presmeruje systémový gzip na paralelnú implementáciu. Ostatné úpravy výkonu (pamäť, plánovanie I/O, veľkosť ARC ZFS, limity jadra) sú vo vlastných kategóriách (<em>Systém</em>, <em>Úložisko</em>), pretože ovplyvňujú iné subsystémy."
+  },
+  "pigz": {
+    "heading": "Použiť pigz pre rýchlejšiu gzip kompresiu",
+    "intro": "Štandardný <code>gzip</code> komprimuje údaje pomocou <strong>jediného jadra CPU</strong>. Na moderných hostiteľoch Proxmox s 8, 16 alebo 32 jadrami je to veľké úzke miesto pri zálohách VM/CT cez <code>vzdump</code>, rotácii záznamov a všetkom, čo prechádza cez <code>gzip</code>. <a>pigz</a> je priamo zameniteľná paralelná náhrada: rovnaký výstup kompatibilný s gzip, ale práca rozdelená medzi všetky jadrá.",
+    "doesTitle": "Čo robí ProxMenux",
+    "doesIntro": "Päť krokov, všetky idempotentné:",
+    "doesItems": [
+      "Nastaví <code>pigz: 1</code> v <code>/etc/vzdump.conf</code>, aby zálohovací nástroj Proxmox používal pigz natívne.",
+      "Nainštaluje apt balíček <code>pigz</code>, ak už nie je prítomný.",
+      "Napíše wrapper skript na <code>/bin/pigzwrapper</code>, ktorý posiela každý argument na <code>/usr/bin/pigz</code>.",
+      "Zaregistruje presmerovanie dpkg pre systémový program <code>gzip</code> (<code>/usr/bin/gzip</code> v Proxmox VE 9, <code>/bin/gzip</code> v Proxmox VE 8). Pôvodný program zostane vedľa ako <code>gzip.distrib</code> a na jeho miesto príde wrapper. Odvtedy <em>všetko</em>, čo volá <code>gzip</code> — logrotate, <code>tar czf</code>, skripty aj vzdump — používa pigz transparentne.",
+      "Pred umiestnením wrappera overí, že súbor <code>gzip.distrib</code> je funkčný gzip; ak nie, najprv preinštaluje balík <code>gzip</code>. Hostiteľ so staršou náhradou <code>/bin/gzip.original</code> pri opätovnom použití možnosti prejde na presmerovanie dpkg."
+    ],
+    "replacesTitle": "Nahrádza systémový program",
+    "replacesBody": "Umiestniť wrapper namiesto <code>gzip</code> je nezvyčajné. Je to bezpečné, pretože vytvára výstup kompatibilný s gzip, ale skripty s pevne zapísanými cestami, v obmedzených prostrediach chroot alebo overujúce hash programu sa môžu správať inak. Pôvodný program zostáva ako <code>gzip.distrib</code>. Vďaka presmerovaniu dpkg aktualizácia balíka <code>gzip</code> alebo prechod z Proxmox VE 8 na 9 aktualizuje tento súbor a ponechá wrapper na mieste.",
+    "revertTitle": "Reverzibilné z menu Odinštalovať",
+    "revertBody": "Táto optimalizácia sa sleduje. <link>Odinštalovať optimalizácie</link> skopíruje pôvodný program z <code>gzip.distrib</code> na miesto wrappera, odstráni presmerovanie aj <code>pigzwrapper</code>, zakomentuje riadok <code>pigz</code> v <code>/etc/vzdump.conf</code> a po overení funkčnosti gzip spustí <code>apt purge pigz</code>. Ručný ekvivalent pre Proxmox VE 9:",
+    "verifyTitle": "Overenie",
+    "verifyBody": "Po použití by mal <code>gzip --version</code> uviesť pigz. Rýchly test výkonu tiež ukáže rozdiel v rýchlosti na viacjadrovom hostiteľovi:",
+    "whenTitle": "Keď na tom záleží najviac",
+    "whenBody": "Prínos závisí od <strong>počtu jadier hostiteľa</strong> a <strong>frekvencie zálohovania</strong>. Na domácom serveri s 2 jadrami a jedným denným vzdump je malý. Na produkčnom hostiteľovi so 16 jadrami, ktorý každú noc zálohuje tucet VM, môže pigz skrátiť časové okno záloh na zlomok času jednovláknového gzip."
+  },
+  "related": {
+    "heading": "Súvisiace",
+    "items": [
+      {
+        "label": "Príkazy na zálohovanie a obnovu",
+        "href": "/docs/help-info/backup-commands",
+        "tailRich": " — referencia CLI vzdump vrátane voľby počtu vlákien <code>--pigz</code>."
+      },
+      {
+        "label": "Úložisko",
+        "href": "/docs/post-install/storage",
+        "tail": " — Vzdump rýchlostné limity a ZFS ARC ladenie."
+      },
+      {
+        "label": "Systém",
+        "href": "/docs/post-install/system",
+        "tail": " — ladenie deskriptorov súborov a pamäte."
+      },
+      {
+        "label": "Prispôsobiteľné nastavenia po inštalácii",
+        "href": "/docs/post-install/customizable",
+        "tail": " — späť do nadradeného menu."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sk/docs/post-install/security.json b/web/messages/sk/docs/post-install/security.json
new file mode 100644
index 00000000..8cc4c920
--- /dev/null
+++ b/web/messages/sk/docs/post-install/security.json
@@ -0,0 +1,57 @@
+{
+  "meta": {
+    "title": "Po inštalácii: Zabezpečenie | Dokumentácia ProxMenux",
+    "description": "Možnosti zabezpečenia v prispôsobiteľnom skripte ProxMenux po inštalácii. Zatiaľ jediná možnosť: zakázať službu portmapper/rpcbind na zmenšenie útočnej plochy hostiteľa."
+  },
+  "header": {
+    "title": "Po inštalácii: Zabezpečenie",
+    "section": "Nastavenie Proxmoxu po inštalácii"
+  },
+  "intro": {
+    "title": "Čo táto kategória zahŕňa",
+    "body": "Zabezpečenie po inštalácii zahŕňa iba <strong>posilnenie hostiteľa, ktoré sa dá bezpečne použiť bez dozoru</strong>: vypnutie služieb, ktoré takmer nikto nepotrebuje a ktoré možno obnoviť cez Odinštalovať. Aktívne bezpečnostné nástroje (Fail2Ban na prevenciu prienikov, Lynis na audit) nájdete pod položkou <em>Zabezpečenie</em> v hlavnom menu ProxMenux, mimo nastavení po inštalácii."
+  },
+  "rpcbind": {
+    "heading": "Zakázať portmapper / rpcbind",
+    "intro": "<code>rpcbind</code> (predtým <code>portmap</code>) mapuje čísla programov RPC na sieťové porty. NFS a niektoré staršie nástroje RPC ho potrebujú. Na typickom hostiteľovi Proxmox, ktorý nie je serverom NFS, ho <strong>nič nepoužíva</strong>; ak zostane zapnutý, port <code>111/tcp</code> načúva na každom rozhraní.",
+    "whyTitle": "Prečo sa ho oplatí vypnúť",
+    "whyItems": [
+      "Zmenšuje útočnú plochu hostiteľa — o jednu načúvajúcu službu menej, o ktorú sa treba starať.",
+      "V minulosti sa zneužíval ako vektor odrazu a zosilnenia pri útokoch DDoS. Vypnutím <code>rpcbind</code> sa tento faktor zosilnenia na hostiteľovi odstráni.",
+      "Odstráni zbytočné hlásenia zo záznamov a výstupu <code>netstat</code> / <code>ss</code>, aby sa skutočná aktivita ľahšie rozpoznávala."
+    ],
+    "nfsTitle": "Nevypnite to, ak používate NFS",
+    "nfsBody": "Server NFS <strong>aj</strong> klient NFS používajú <code>rpcbind</code> na vyjednanie portov pre <code>mountd</code>, <code>statd</code>, <code>lockd</code> a ďalšie služby. Ak hostiteľ Proxmox <em>exportuje</em> zdieľania NFS iným počítačom alebo <em>pripája</em> zdieľania NFS z NAS, túto možnosť nepoužívajte. Pripájanie zlyhá s chybou <code>mount.nfs: rpc.statd is not running</code> alebo podobnou.",
+    "runsTitle": "Čo ProxMenux spúšťa",
+    "runsOutro": "Balík zostáva nainštalovaný. ProxMenux zaznamená pôvodný stav povolenia a aktivity rpcbind.service aj rpcbind.socket, potom obe jednotky zakáže a zastaví, aby aktivácia cez socket nemohla službu znovu spustiť.",
+    "verifyTitle": "Overenie",
+    "verifyBody": "Po použití overte, že <code>rpcbind</code> je vypnutý a na porte 111 nič nenačúva:",
+    "reversibleTitle": "Obnovuje pôvodný stav služby",
+    "reversibleBody": "Zmena sa zaznamená do <code>installed_tools.json</code>. <link>Odinštalovať optimalizácie</link> vráti každú jednotku rpcbind do povoleného/zakázaného a aktívneho/neaktívneho stavu zaznamenaného pred zmenou ProxMenux. Nepredpokladá, že rpcbind bol povolený na každom hostiteľovi."
+  },
+  "related": {
+    "heading": "Súvisiace",
+    "items": [
+      {
+        "label": "Bezpečnostné menu",
+        "href": "/docs/security",
+        "tail": " — pokročilejšie nástroje: Fail2Ban (prevencia prienikov) a Lynis (audit)."
+      },
+      {
+        "label": "Lynis",
+        "href": "/docs/security/lynis",
+        "tail": " — audit hostiteľa na nájdenie ďalších možností posilnenia zabezpečenia."
+      },
+      {
+        "label": "Užitočné systémové príkazy",
+        "href": "/docs/help-info/system-commands",
+        "tail": " — Stav služby, journalctl, referencia auditu lynis."
+      },
+      {
+        "label": "Prispôsobiteľné nastavenia po inštalácii",
+        "href": "/docs/post-install/customizable",
+        "tail": " — späť do nadradeného menu."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sk/docs/post-install/storage.json b/web/messages/sk/docs/post-install/storage.json
new file mode 100644
index 00000000..5a3a2440
--- /dev/null
+++ b/web/messages/sk/docs/post-install/storage.json
@@ -0,0 +1,167 @@
+{
+  "meta": {
+    "title": "Po inštalácii: Úložisko | Dokumentácia ProxMenux",
+    "description": "Optimalizácie úložiska v prispôsobiteľnom skripte ProxMenux po inštalácii: veľkosť ZFS ARC podľa RAM, pravidelné snímky cez zfs-auto-snapshot a odstránenie rýchlostných limitov záloh vzdump."
+  },
+  "header": {
+    "title": "Po inštalácii: Úložisko",
+    "section": "Nastavenie Proxmoxu po inštalácii"
+  },
+  "intro": {
+    "title": "Čo táto kategória zahŕňa",
+    "body": "Štyri optimalizácie úložiska: nastaviť <strong>ZFS ARC</strong> na vhodný podiel RAM, nainštalovať a naplánovať <strong>automatické snímky ZFS</strong>, zapnúť <strong>ZFS autotrim</strong> v SSD/NVMe pooloch a odstrániť obmedzenia <strong>vzdump</strong>, aby sa zálohy mohli vytvárať plnou rýchlosťou. Možnosti sú nezávislé; vyberte podľa svojho systému. Piata, <link>Log2RAM</link>, znižuje opotrebenie SSD/NVMe presunom <code>/var/log</code> na ramdisk. Je na stránke Voliteľné podľa zaradenia v prispôsobiteľnom menu."
+  },
+  "trackedTitle": "Všetky štyri sú sledované v menu Odinštalovať",
+  "trackedBody": "Každá z týchto možností zaregistruje nástroj v <code>installed_tools.json</code>, takže sa zobrazí v časti <link>Odstrániť optimalizácie</link>. Vrátenie <code>zfs_arc</code> odstráni <code>/etc/modprobe.d/99-zfsarc.conf</code> a znovu vytvorí initramfs. <code>zfs_auto_snapshot</code> zruší plán cron a ponúkne úplné odstránenie balíka; <code>zfs_autotrim</code> nastaví <code>autotrim=off</code> v pooloch, v ktorých ho zaplo; <code>vzdump_speed</code> obnoví <code>/etc/vzdump.conf</code> zo súboru <code>.bak</code> vytvoreného pri inštalácii.",
+  "arc": {
+    "heading": "Optimalizovať veľkosť ZFS ARC",
+    "intro": "<strong>Adaptive Replacement Cache (ARC)</strong> je čítacia cache ZFS v RAM. Inštalácie Proxmox VE od 8.1 nastavujú 10% RAM, najviac 16 GiB; staršie alebo aktualizované hostitele sa môžu líšiť. Táto možnosť zapíše rovnaké pravidlo výslovne (RAM/10, najviac 16 GiB, najmenej 64 MiB) do vlastného súboru, čím pokryje aj staršie alebo aktualizované hostitele. Skontrolujte existujúce nastavenia a záťaž: menšia cache nie je vždy rýchlejšia.",
+    "sizingTitle": "Pravidlá veľkosti",
+    "headerRam": "RAM hostiteľa",
+    "headerMax": "Limit ARC",
+    "rows": [
+      {
+        "ram": "Vzorec",
+        "max": "RAM / 10, najviac 16 GiB a najmenej 64 MiB"
+      },
+      {
+        "ram": "8 GB hostiteľ",
+        "max": "≈ 819 MiB (RAM/10)"
+      },
+      {
+        "ram": "16 GB hostiteľ",
+        "max": "≈ 1.6 GiB (RAM/10)"
+      },
+      {
+        "ram": "64 GB hostiteľ",
+        "max": "≈ 6.4 GiB (RAM/10)"
+      },
+      {
+        "ram": "≥ 160 GB hostiteľ",
+        "max": "16 GiB (limit)"
+      }
+    ],
+    "after": "Súbor <code>/etc/modprobe.d/99-zfsarc.conf</code> obsahuje iba <code>options zfs zfs_arc_max=…</code>. Ostatné parametre ZFS (<code>zfs_arc_min</code>, prednačítanie/obmedzenie zápisov L2ARC, časový limit TXG) sa neladia. Pred zápisom kontrola nájde iné <code>*.conf</code> v <code>/etc/modprobe.d/</code> s <code>zfs_arc_min</code> / <code>zfs_arc_max</code>, zálohuje ich s manifestom do <code>/usr/local/share/proxmenux/backups/zfs_arc/</code> a odstráni z nich konfliktné hodnoty <code>zfs_arc_min</code> / <code>zfs_arc_max</code> (ostatné voľby v týchto riadkoch zostanú), aby limit určoval iba súbor ARC ProxMenux. Potom <code>update-initramfs -u -k all</code> a podľa potreby <code>proxmox-boot-tool refresh</code> začlenia limit do initramfs systémov s koreňom na ZFS.",
+    "rebootTitle": "Prejaví sa po reštarte",
+    "rebootBody": "Nastavenia ARC sa čítajú pri načítaní modulu <code>zfs</code>. Pre hostiteľov s koreňom na ZFS ProxMenux znovu vytvorí initramfs cez <code>update-initramfs -u -k all</code> a podľa potreby obnoví zavádzač cez <code>proxmox-boot-tool refresh</code>. Nový parameter stále vyžaduje reštart; príznak potreby reštartu sa nastaví automaticky.",
+    "safeTitle": "Bezpečné na hostiteľoch bez ZFS",
+    "safeBody": "Funkcia zapíše konfiguráciu iba vtedy, ak <code>zpool list</code> ohlási aspoň jeden importovaný pool ZFS. Na hostiteľoch iba s ext4/LVM alebo s nástrojmi ZFS bez importovaného poolu voľba nič neurobí a nič nezapíše.",
+    "verifyTitle": "Overenie a ručná obnova"
+  },
+  "autoSnap": {
+    "heading": "Nainštalovať ZFS auto-snapshot",
+    "intro": "Nainštaluje balík <a>zfs-auto-snapshot</a> a prepíše plány cron na automatické vytváranie snímok v niekoľkých intervaloch. Jednoduchá dodatočná ochrana popri pravidelných zálohách vzdump.",
+    "cadenceTitle": "Intervaly snímok nastavené cez ProxMenux",
+    "headerLabel": "Štítok",
+    "headerRuns": "Beží",
+    "headerKept": "Uchované snímky",
+    "rows": [
+      {
+        "label": "časté",
+        "runs": "každý 15 min.",
+        "kept": "4"
+      },
+      {
+        "label": "hodinová",
+        "runs": "každú hodinu",
+        "kept": "1"
+      },
+      {
+        "label": "denne",
+        "runs": "jedenkrát denne",
+        "kept": "1"
+      },
+      {
+        "label": "týždenne",
+        "runs": "jedenkrát týždenne",
+        "kept": "1"
+      },
+      {
+        "label": "mesačne",
+        "runs": "jedenkrát mesačne",
+        "kept": "1"
+      }
+    ],
+    "conservativeTitle": "Obmedzené počty uchovaných snímok",
+    "conservativeBody": "ProxMenux sa dodáva s konzervatívnym uchovávaním (len 4 často + 1 každého dlhšieho intervalu), takže ZFS snapshot úložisko nenarastá. Ak chcete dlhšie uchovávanie, po spustení skriptu upravte čísla v <code>/etc/cron.d/zfs-auto-snapshot</code>, <code>/etc/cron.hourly/zfs-auto-snapshot</code> atď.",
+    "onlyZfsTitle": "Užitočné iba v pooloch ZFS",
+    "onlyZfsBody": "Inštalácia balíka na hostiteľovi iba s ext4 je neškodná, ale zbytočná: neexistujú datasety ZFS na vytváranie snímok. Ak ZFS nepoužívate, možnosť vynechajte.",
+    "verifyTitle": "Overenie a ručná obnova"
+  },
+  "autotrim": {
+    "heading": "Zapnúť ZFS autotrim (SSD/NVMe pooly)",
+    "intro": "Zapne <code>autotrim</code> v pooloch ZFS zložených iba z SSD alebo NVMe s TRIM. Z opatrnosti vynechá pooly s rotačným diskom. Pooly už nastavené na <code>autotrim=on</code> ponechá bez zmeny.",
+    "trimTitle": "Čo TRIM robí, a prečo to záleží na ZFS",
+    "trimBody1": "SSD a NVMe používajú interné mazacie bloky väčšie než logické sektory súborového systému. Po zmazaní súboru disk ešte nevie, že sektory sú voľné, a jeho interné čistenie môže pri uvoľňovaní ďalších blokov zbytočne presúvať staré dáta. <strong>TRIM</strong> oznámi disku voľné sektory, aby ich mohol vymazať vopred.",
+    "trimBody2": "Bez TRIM sa výkon SSD časom znižuje, pretože na disku sa míňajú vopred vymazané bloky a musí vykonať vymazanie pri zápise a zvyšuje sa zosilnenie zápisu – oboje skracuje životnosť disku. So zapnutým TRIM môže disk udržiavať zdravé pool prázdnych blokov pripravených na zápis.",
+    "trimBody3": "Pri <code>autotrim=on</code> ZFS na pozadí vykonáva TRIM nedávno uvoľneného miesta a zlučuje rozsahy. Alternatívou je pravidelný <code>zpool trim &lt;pool&gt;</code>. Autotrim nepotrebuje samostatný plán, ale vplyv závisí od diskov; slabším zariadeniam môže viac vyhovovať pravidelný ručný TRIM.",
+    "practicalTitle": "Prečo je to praktické?",
+    "practicalItems": [
+      "<strong>Trvalý výkon zápisu.</strong> TRIM môže pomôcť efektívne obnoviť nepoužité bloky. Prínos a vplyv na latenciu závisia od zariadenia a záťaže.",
+      "<strong>Životnosť disku.</strong> Menej zbytočného interného kopírovania môže znížiť násobenie zápisov a opotrebenie NAND. Nezaručuje konkrétne predĺženie životnosti.",
+      "<strong>Bez samostatnej úlohy cron.</strong> Na rozdiel od pravidelného <code>zpool trim</code> sa o autotrim stará samotný pool."
+    ],
+    "whenTitle": "Kedy je to nutné?",
+    "whenIntro1": "<strong>Zvážte zapnutie</strong> v pooloch ZFS iba s SSD/NVMe podporujúcimi TRIM. Overte správanie a latenciu; niektorému hardvéru viac vyhovuje plánovaný ručný TRIM.",
+    "whenIntro2": "<strong>Skript ho automaticky preskočí</strong> na:",
+    "whenSkipItems": [
+      "Pooly s rotačným HDD vdev — opatrný hardvérový filter tohto skriptu.",
+      "Disky bez <code>discard_granularity</code> vystavené v sysfs – zvyčajne staré SSD bez TRIM alebo priechodných ciest, kde OS nevidí základné zariadenie.",
+      "Pools, kde ZFS sám uvádza, že vlastnosť nie je podporovaná (zriedkavé; veľmi staré pools).",
+      "Pools už nastavený na <code>autotrim=on</code> (bez-op)."
+    ],
+    "whenIntro3": "<strong>Nie je relevantné pre hostiteľov iba s ext4</strong> — ZFS nemá čo trimovať. Funkcia vtedy skončí s vysvetľujúcou správou.",
+    "recordedTitle": "Prečo sa zaznamenávajú iba pooly zmenené cez ProxMenux",
+    "recordedBody": "Funkcia zapíše pool do interného súboru stavu (<code>/usr/local/share/proxmenux/zfs_autotrim_pools</code>) iba pri zmene z <code>off</code> na <code>on</code>. Pooly s už aktívnym autotrimom vynechá. Neskoršie odinštalovanie tak vráti iba vlastné zmeny ProxMenuxu a nevypne vaše nastavenia.",
+    "manualTitle": "Ručný ekvivalent (spustite na svojom serveri)",
+    "manualIntro": "Úplná sekvencia skriptu spustená proti každému pool je replikovateľná ručne. Toto by ste napísali, ak by ste chceli urobiť to isté na jednom pool bez ProxMenux:",
+    "verifyTitle": "Overenie a ručná obnova",
+    "oneShotTitle": "Potrebujete jednorazový TRIM namiesto priebežného?",
+    "oneShotBody": "Niektorí správcovia uprednostňujú ručný TRIM mimo špičky. Vypnite autotrim a naplánujte úlohu cron s <code>zpool trim &lt;pool&gt;</code>: rovnaký cieľ, iný interval."
+  },
+  "vzdump": {
+    "heading": "Zvýšiť rýchlosť záloh vzdump",
+    "intro": "Zapíše bwlimit: 0 a ionice: 5 do globálnej konfigurácie vzdump. Proxmox už predvolene neobmedzuje šírku pásma; odstráni teda iba nastavený limit. Oproti ionice: 7 hodnota 5 zvýši prioritu I/O best-effort, ak ju plánovač rešpektuje. Môže ovplyvniť hostí a nezaručuje rýchlejšie zálohy.",
+    "changedTitle": "Čo sa zmení v /etc/vzdump.conf",
+    "backupTitle": "Prvý beh vytvára .bak vzdump.conf",
+    "backupBody": "Pri prvom spustení ProxMenux pred úpravami skopíruje <code>/etc/vzdump.conf</code> do <code>/etc/vzdump.conf.bak</code>. Ďalšie spustenia zálohu neprepíšu, takže pôvodná ručne upravená konfigurácia zostane obnoviteľná. <code>bwlimit</code> a <code>ionice</code> zmení cez <code>sed</code>; ostatné možnosti ako compress, pigz, tmpdir a exclude-path ponechá.",
+    "skipTitle": "Kedy to preskočiť",
+    "skipBody": "Na hostiteľovi s pomalým úložiskom a VM citlivými na latenciu môže odstránenie limitu šírky pásma spomaliť prevádzku počas záloh. Ak ste preto nastavili <code>bwlimit</code>, ponechajte ho a túto možnosť vynechajte.",
+    "verifyTitle": "Overenie a ručná obnova"
+  },
+  "related": {
+    "heading": "Súvisiace",
+    "items": [
+      {
+        "label": "Príkazy na správu ZFS",
+        "href": "/docs/help-info/zfs-commands",
+        "tail": " — prehľad zpool / zfs pre ARC, snímky a scrub."
+      },
+      {
+        "label": "Príkazy pre úložiská a disky",
+        "href": "/docs/help-info/storage-commands",
+        "tail": " — všeobecná príručka blokových zariadení a úložísk Proxmox."
+      },
+      {
+        "label": "Príkazy zálohovania a obnovy",
+        "href": "/docs/help-info/backup-commands",
+        "tail": " — prehľad CLI vzdump pre šírku pásma a prioritu I/O."
+      },
+      {
+        "label": "Odinštalovať optimalizácie",
+        "href": "/docs/post-install/uninstall",
+        "tail": " — vráťte zmeny ARC / vzdump späť."
+      },
+      {
+        "label": "Log2RAM",
+        "href": "/docs/post-install/optional#log2ram",
+        "tail": " - znižuje SSD/NVMe opotrebenie ramdiskom /var/log; zdokumentované podľa Voliteľné."
+      },
+      {
+        "label": "Prispôsobiteľné nastavenia po inštalácii",
+        "href": "/docs/post-install/customizable",
+        "tail": " — späť do nadradeného menu."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sk/docs/post-install/system.json b/web/messages/sk/docs/post-install/system.json
new file mode 100644
index 00000000..21a7bf3f
--- /dev/null
+++ b/web/messages/sk/docs/post-install/system.json
@@ -0,0 +1,133 @@
+{
+  "meta": {
+    "title": "Po inštalácii: Systém | Dokumentácia ProxMenux",
+    "description": "Systémové optimalizácie prispôsobiteľného skriptu ProxMenux po inštalácii: limity veľkosti journald a logrotate, vyššie limity jadra a deskriptorov súborov, vyvážené ladenie pamäte, rýchle reštarty cez kexec a obnova po panike jadra."
+  },
+  "header": {
+    "title": "Po inštalácii: systém",
+    "section": "Nastavenie Proxmoxu po inštalácii"
+  },
+  "intro": {
+    "title": "Čo táto kategória zahŕňa",
+    "body": "Šesť nezávislých systémových optimalizácií. Upravujú <strong>journald</strong> a <strong>logrotate</strong>, aby logy nezaplnili disk, zvyšujú <strong>limity jadra a deskriptorov súborov</strong> pre aplikácie s mnohými otvorenými súbormi, <strong>vyvažujú využitie pamäte</strong> na virtualizačnom hostiteľovi, pridávajú <strong>kexec</strong> na reštart bez BIOSu a nastavujú <strong>automatickú obnovu</strong> pri panike jadra. Všetkých šesť je zaznamenaných a vratných z menu Odinštalovať."
+  },
+  "journald": {
+    "heading": "Optimalizovať journald",
+    "intro": "Prepíše <code>/etc/systemd/journald.conf</code> s rozumnými predvolenými hodnotami, aby žurnál systemd postupne nezaplnil koreňový oddiel. Potom reštartuje <code>systemd-journald</code> a vyčistí staré záznamy.",
+    "keyTitle": "Kľúčové hodnoty",
+    "keyItems": [
+      "<code>Storage=persistent</code> — uchová záznamy na disku aj po reštarte.",
+      "<code>SystemMaxUse=64M</code> / <code>RuntimeMaxUse=60M</code> — pevné limity využitia disku a pamäte systémovým denníkom.",
+      "<code>Compress=yes</code>, <code>Seal=no</code> — komprimuje záznamy, vypne kryptografické pečatenie s doprednou bezpečnosťou (šetrí CPU).",
+      "<code>MaxLevelStore=info</code> — ukladá úroveň info a vyššie, potrebné pre prehliadač logov ProxMenux Monitor aj pre detekciu neúspešných overení SSH/Proxmox cez Fail2Ban v žurnáli.",
+      "Limit frekvencie: <code>1000 events / 30 s</code> proti zahlteniu logmi.",
+      "<code>ForwardToSyslog=no</code>, <code>ForwardToWall=no</code> — neduplikovať hlásenia do syslogu ani ich nerozosielať na konzoly."
+    ],
+    "tipTitle": "Prečo je MaxLevelStore=info dôležité",
+    "tipBody": "Prísnejšia úroveň ako <code>warning</code> spôsobí, že ProxMenux Monitor ukáže takmer rovnaké záznamy vo všetkých obdobiach, pretože väčšina aktivity má úroveň info, a Fail2Ban neuvidí neúspešné prihlásenia. Objem obmedzte pomocou <code>SystemMaxUse</code> a <code>RateLimitBurst</code>, nie obmedzením ukladaných úrovní."
+  },
+  "logrotate": {
+    "heading": "Optimalizovať logrotate",
+    "intro": "Prepíše <code>/etc/logrotate.conf</code> s globálnym denným a veľkostným nastavením, uchovaním 7 rotácií, kompresiou a <code>copytruncate</code>, aby služby mohli písať bez opätovného otvorenia logov. Veľkostné kritérium je uvedené po dennom a má prednosť, ak ho neprepíše pravidlo konkrétneho logu. Pôvodný <code>logrotate.conf</code> sa pri prvom použití zálohuje do <code>.bak</code>.",
+    "tipTitle": "Vhodné pre Log2RAM",
+    "tipBody": "Direktíva <code>size 10M</code> má prednosť pred skorším denným nastavením; <em>neznamená</em> to prvé splnené kritérium. Logrotate kontroluje limit pri spustení a pravidlá konkrétnych logov môžu prepísať globálne hodnoty. Pri <code>/var/log</code> v RAM cez Log2RAM skontrolujte pravidlá aj frekvenciu časovača na riadenie využitia miesta."
+  },
+  "limits": {
+    "heading": "Zvýšiť systémové limity",
+    "intro": "Zvýši limity jadra, systemd a PAM, ktorých predvolené hodnoty môžu byť nízke pre hostiteľa s mnohými VM, kontajnermi a sieťovými službami.",
+    "headerFile": "Súbor",
+    "headerSets": "Čo nastavuje",
+    "rows": [
+      {
+        "file": "/etc/sysctl.d/99-maxwatches.conf",
+        "sets": "<code>fs.inotify.max_user_watches / max_user_instances / max_queued_events = 1048576</code>"
+      },
+      {
+        "file": "/etc/sysctl.d/99-maxkeys.conf",
+        "sets": "<code>kernel.keys.maxkeys / root_maxkeys = 1000000</code>"
+      },
+      {
+        "file": "/etc/sysctl.d/99-swap.conf",
+        "sets": "<code>vm.swappiness = 10</code>, <code>vm.vfs_cache_pressure = 100</code>"
+      },
+      {
+        "file": "/etc/sysctl.d/99-fs.conf",
+        "sets": "<code>fs.nr_open / file-max = 2097152</code>, <code>fs.aio-max-nr = 1048576</code>"
+      },
+      {
+        "file": "/etc/security/limits.d/99-limits.conf",
+        "sets": "<code>nofile</code> a <code>nproc</code> na 1,048,576 (pre root bez obmedzenia)"
+      },
+      {
+        "file": "/etc/systemd/system.conf + user.conf",
+        "sets": "<code>DefaultLimitNOFILE=1048576</code> pre služby systemd"
+      },
+      {
+        "file": "/etc/pam.d/common-session + runuser-l",
+        "sets": "<code>session required pam_limits.so</code>, aby sa uvedené limity uplatnili v prihlasovacích shelloch"
+      },
+      {
+        "file": "/root/.profile",
+        "sets": "<code>ulimit -n 1048576</code> pre shell používateľa root"
+      }
+    ],
+    "tipTitle": "Prečo je inotify dôležité",
+    "tipBody": "Docker, Syncthing, sledovanie súborov Node.js a skenovanie knižníc Plex môžu vyčerpať <code>max_user_watches</code>. Predvolená hodnota závisí od jadra a pamäte; nie je vždy 8192. Limit 1M umožní viac sledovaní bez ich predbežného pridelenia. Aktívne sledovania spotrebúvajú pamäť jadra, preto pri nedostatku RAM kontrolujte využitie."
+  },
+  "memory": {
+    "heading": "Optimalizácia nastavenia pamäte",
+    "intro": "Zapíše vyvážený profil sysctl do <code>/etc/sysctl.d/99-memory.conf</code>. Je navrhnutý pre hostiteľa hypervízora: uprednostňuje ponechanie aktívnej pamäte VM v RAM a vopred uvoľňuje stránky, aby nárazové prideľovanie pamäte nespôsobovalo zdržanie.",
+    "warnTitle": "swappiness=10 na hostiteľoch s nedostatkom pamäte",
+    "warnBody": "Na hostiteľovi so 16 GB RAM a mnohými VM môže zníženie swappiness viesť k ukončovaniu procesov pre nedostatok pamäte namiesto použitia swapu. Pri častých udalostiach OOM po spustení skriptu zvýšte swappiness na 30–60 v <code>/etc/sysctl.d/99-memory.conf</code>."
+  },
+  "kexec": {
+    "heading": "Povoliť rýchle reštarty (kexec)",
+    "intro": "Nainštaluje <code>kexec-tools</code> a nastaví ich na priamy reštart hostiteľa do nového jadra <em>bez prechodu firmvérom BIOS/UEFI</em>. Na veľkých serveroch, kde POST trvá 45 – 90 sekúnd, sa tým reštart môže skrátiť z prestávky na kávu na niekoľko sekúnd výpadku.",
+    "installsTitle": "Čo nainštaluje ProxMenux",
+    "installsItems": [
+      "Balík <code>kexec-tools</code> (debconf má vopred nastavené <code>kexec-tools/load_kexec boolean false</code>, aby sa apt nepýtal a automatické načítanie pri vypínaní zostalo vypnuté).",
+      "Jednotka Systemd <code>/etc/systemd/system/kexec-pve.service</code> — načíta jadro Proxmox a initrd do pamäte pri zavádzaní, pričom opätovne použije aktuálny cmdline.",
+      "Alias v <code>/root/.bash_profile</code>: <code>reboot-quick</code> → <code>systemctl kexec</code>."
+    ],
+    "usageIntro": "Použitie po ďalšom reštarte (alebo manuálnom <code>systemctl start kexec-pve</code>):",
+    "warnTitle": "Kedy nepoužívať kexec",
+    "warnBody": "kexec vynechá inicializáciu firmvéru. Ak BIOS/UEFI musí obnoviť stav hardvéru, napríklad GPU s passthrough vyžadujúca úplný POST alebo problémový firmvér HBA, reštart cez kexec môže nechať zariadenia čiastočne inicializované. Po aktualizácii jadra alebo pre zmeny BIOS/UEFI použite bežný <code>reboot</code>. <code>reboot-quick</code> je na každodenné reštarty."
+  },
+  "panic": {
+    "heading": "Zapnúť reštart pri kernel panic",
+    "intro": "Zabezpečí <strong>automatický reštart</strong> jadra namiesto trvalého zamrznutia na obrazovke paniky. Dôležité pri vzdialených hostiteľoch Proxmox bez lokálnej konzoly: pri zaseknutom jadre sú všetky VM nedostupné, kým hostiteľa nevypnete a znovu nezapnete.",
+    "tipTitle": "Skombinujte to s prístupom k vzdialenej konzole",
+    "tipBody": "Automatický reštart je mechanizmus obnovy, nie nástroj na ladenie. Ak chcete paniku <em>preskúmať</em>, nielen znovu spustiť systém, použite <link>možnosť kexec</link> vyššie s podporou kdump jadra, ktorú ProxMenux nenastavuje, alebo pred zapnutím automatického reštartu zachytávajte sériovú konzolu na inom hostiteľovi."
+  },
+  "verify": {
+    "heading": "Overenie",
+    "intro": "Po uplatnení optimalizácie systému:",
+    "tipTitle": "Obnova a obmedzenia",
+    "tipBody": "Všetkých šesť možností je v <code>installed_tools.json</code> a <link>Odinštalovať optimalizácie</link>. Obnova odstráni konfiguračné súbory, jednotku a alias kexec, prepíše journald.conf predvolenými hodnotami systemd a obnoví logrotate.conf zo zálohy. Niektoré aktívne limity vyžadujú novú reláciu alebo reštart."
+  },
+  "related": {
+    "heading": "Súvisiace",
+    "items": [
+      {
+        "label": "Užitočné systémové príkazy",
+        "href": "/docs/help-info/system-commands",
+        "tail": " — overte zmeny (free -h, journalctl, ulimit -a)."
+      },
+      {
+        "label": "Výkon",
+        "href": "/docs/post-install/performance",
+        "tail": " — ďalšie systémové ladenie (pigz)."
+      },
+      {
+        "label": "Odinštalovať optimalizácie",
+        "href": "/docs/post-install/uninstall",
+        "tail": " — vráťte tieto zmeny späť."
+      },
+      {
+        "label": "Prispôsobiteľné nastavenia po inštalácii",
+        "href": "/docs/post-install/customizable",
+        "tail": " — späť do nadradeného menu."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sk/docs/post-install/uninstall.json b/web/messages/sk/docs/post-install/uninstall.json
new file mode 100644
index 00000000..ee7856ba
--- /dev/null
+++ b/web/messages/sk/docs/post-install/uninstall.json
@@ -0,0 +1,271 @@
+{
+  "meta": {
+    "title": "Odinštalovať optimalizácie | Dokumentácia ProxMenux",
+    "description": "Obnoví vratné zmeny konfigurácie vykonané cez ProxMenux po inštalácii. Zaznamenané nástroje majú vlastné odinštalačné funkcie, ktoré podľa možností zachovajú pôvodný stav hostiteľa."
+  },
+  "header": {
+    "title": "Odinštalovať optimalizácie",
+    "description": "Obnoviť reverzibilné zmeny vykonané automatizovanými alebo prispôsobiteľnými skriptmi po inštalácii. ProxMenux registruje každú podporovanú optimalizáciu s jeho špecializovanou funkciou obnovy; aktualizácie balíkov sú zámerne vylúčené.",
+    "section": "Nastavenie Proxmoxu po inštalácii"
+  },
+  "intro": {
+    "title": "Prečo to existuje?",
+    "body": "Každá podporovaná vratná úprava sa <strong>zaznamená</strong> v <code>/usr/local/share/proxmenux/installed_tools.json</code>. Register riadi odinštalovanie: ukáže aktívne optimalizácie a spustí zodpovedajúcu obnovu. Akcie bez bezpečného návratu, napríklad úplná aktualizácia balíkov, sa nepridávajú."
+  },
+  "openMenu": {
+    "heading": "Ako to otvoriť",
+    "body": "V hlavnom menu otvorte <strong>Nastavenia Proxmox po inštalácii → Odinštalovať optimalizácie</strong>. Zobrazí sa zoznam <em>aktuálne použitých</em> optimalizácií; nepoužité položky sa nezobrazia.",
+    "imageAlt": "Zoznam Odinštalovať optimalizácie s aktívnymi úpravami hostiteľa a políčkami na výber obnovy"
+  },
+  "howWorks": {
+    "heading": "Ako reverzia účinkuje",
+    "steps": [
+      {
+        "title": "Register a autodetekcia",
+        "body1": "Pri prvom spustení ProxMenux hľadá rozpoznávacie znaky na hostiteľovi, napríklad <code>/etc/sysctl.d/99-memory.conf</code>, <code>/etc/apt/apt.conf.d/99-force-ipv4</code>, nainštalovaný balík <code>haveged</code> alebo aktívny Log2RAM. Nájdené úpravy pridá do registra ako vratné aj pri staršej verzii ProxMenux bez registra.",
+        "body2": "Migrácia prebehne iba raz. Potom každý zásah aj obnova aktualizujú register priamo."
+      },
+      {
+        "title": "Vyberte si, čo vrátiť",
+        "body1": "Zoznam má pre každú položku čitateľné označenie, napríklad <em>Optimalizácia pamäte</em>, <em>IOMMU/VFIO PCI passthrough</em> alebo <em>Log2RAM (ochrana SSD)</em>. Označte úpravy na obnovu; neoznačené sa nemenia."
+      },
+      {
+        "title": "Spustenie obnovy",
+        "body1": "Pre každú vybranú položku ProxMenux volá zodpovedajúcu funkciu odinštalovania. Väčšina zvratov nasleduje jeden z troch vzorov:",
+        "items": [
+          "<strong>Zo zálohy</strong> — obnoví <code>.bak</code> vytvorený pri použití úpravy (bashrc, logrotate.conf, journald.conf, príkazový riadok GRUB/jadra).",
+          "<strong>Odstránenie konfigurácie</strong> — odstráni súbory ProxMenux <code>/etc/sysctl.d/99-*.conf</code>, <code>/etc/apt/apt.conf.d/99-*</code> alebo jednotku systemd a znovu načíta nastavenia.",
+          "<strong>Preinštalovanie balíkov</strong> — pri zmenách rozhrania, napríklad upozornení na predplatné, preinštaluje pôvodné balíky s <code>--force-confnew</code> na obnovu dodanej konfigurácie."
+        ],
+        "body2": "Každá obnova zaznamenáva priebeh. Položky vyžadujúce reštart (VFIO, trvalé názvy rozhraní) nastavia príznak, ktorý na konci vyvolá výzvu na reštart."
+      },
+      {
+        "title": "Reštart na konci",
+        "body1": "Po dokončení obnovy menu ponúkne reštart. Zmeny parametrov alebo modulov jadra a názvov rozhraní (VFIO, trvalé názvy) reštart vyžadujú; iné nie. Výzva je všeobecné bezpečnostné opatrenie, nie kontrola každej položky."
+      }
+    ]
+  },
+  "reversible": {
+    "heading": "Čo je reverzibilné",
+    "intro": "Registrované reverzibilné optimalizácie a ich zodpovedajúce odinštalátory sú zoskupené podľa oblastí:",
+    "groups": [
+      {
+        "title": "Repozitáre a APT",
+        "items": [
+          {
+            "tool": "Odstránenie upozornenia na predplatné",
+            "restores": "Najprv skúsi obnoviť súbory rozhrania zo záloh ProxMenux (/usr/local/share/proxmenux/backups/proxmoxlib.js.backup.* a index.html.tpl.backup.* pri upravenom mobilnom rozhraní). Iba pri chýbajúcej alebo poškodenej zálohe preinštaluje pve-manager, proxmox-widget-toolkit, libjs-extjs a libpve-http-server-perl s force-confnew. Vyčistí aj kópie .js / .gz v cache."
+          },
+          {
+            "tool": "Preskočiť jazykové súbory APT",
+            "restores": "Odstráni /etc/apt/apt.conf.d/99-disable-translations, aby APT mohol sťahovať indexy preložených opisov balíkov podľa ostatných jazykových nastavení."
+          },
+          {
+            "tool": "Vynútiť IPv4 pre APT",
+            "restores": "Odstráni /etc/apt/apt.conf.d/99-force-ipv4."
+          },
+          {
+            "tool": "Systémové nástroje",
+            "restores": "Úplne odstráni iba vybrané balíky nástrojov, ktoré ProxMenux zaznamenal ako nové inštalácie. Pôvodné balíky sa do zoznamu nepridávajú a zostanú zachované."
+          }
+        ]
+      },
+      {
+        "title": "Kernel, pamäť a systémové limity",
+        "items": [
+          {
+            "tool": "Nastavenie pamäte",
+            "restores": "Odstráni /etc/sysctl.d/99-memory.conf a znovu načíta sysctl."
+          },
+          {
+            "tool": "Nastavenie paniky jadra",
+            "restores": "Odstráni /etc/sysctl.d/99-kernelpanic.conf."
+          },
+          {
+            "tool": "Zvýšenie systémových limitov",
+            "restores": "Odstráni /etc/sysctl.d/99-maxwatches.conf, 99-maxkeys.conf, 99-swap.conf, 99-fs.conf a /etc/security/limits.d/99-limits.conf. Obnoví limity PAM a DefaultLimitNOFILE systemd. V /root/.profile odstraňuje iba starý ulimit -n 256000; aktuálny ulimit -n 1048576 môže zostať a vyžadovať ručné odstránenie."
+          },
+          {
+            "tool": "Profil výmeny ZRAM",
+            "restores": "Vypne swap /dev/zram0, zastaví dev-zram0.swap a odstráni /etc/systemd/zram-generator.conf.d/90-proxmenux.conf. Balík systemd-zram-generator úplne odstráni iba pri inštalácii cez ProxMenux a bez inej konfigurácie ZRAM. Ak sa stránky nedajú presunúť zo ZRAM, profil zostane aktívny a nič sa neodstráni."
+          }
+        ]
+      },
+      {
+        "title": "Sieťovanie",
+        "items": [
+          {
+            "tool": "Optimalizácia siete",
+            "restores": "Odstráni /etc/sysctl.d/99-network.conf, 97-proxmenux-fwbr.conf a 98-proxmenux-rpf.conf, jednotku proxmenux-fwbr-tune.service, skript /usr/local/sbin/proxmenux-fwbr-tune a pravidlo udev /etc/udev/rules.d/99-zz-proxmenux-fwbr-tune.rules. Odstráni aj riadok source /etc/network/interfaces.d/* z /etc/network/interfaces. Znovu načíta sysctl, systemd a pravidlá udev."
+          },
+          {
+            "tool": "Open vSwitch",
+            "restores": "Spustí apt purge pre openvswitch-switch a openvswitch-common. Mosty OVS najprv migrujte na linuxové mosty, inak ich VM pri ďalšom štarte stratia sieť."
+          },
+          {
+            "tool": "TCP BBR + TCP Fast Open",
+            "restores": "Odstráni /etc/sysctl.d/99-kernel-bbr.conf a 99-tcp-fastopen.conf a načíta zvyšné sysctl. Odstránenie súborov neobnoví aktívne hodnoty; predvolené cubic a tcp_fastopen=1 sa vrátia po reštarte, ak ich neprepíše iná konfigurácia."
+          },
+          {
+            "tool": "Pretrvávajúce názvy rozhraní",
+            "restores": "Odstráni iba súbory 10-proxmenux-*.link s hlavičkou ProxMenux z /etc/systemd/network/. Všetky súbory .link iných balíkov alebo používateľa zostanú zachované. Po ďalšom reštarte sa obnoví predvolené pomenovanie systemd."
+          }
+        ]
+      },
+      {
+        "title": "Zaznamenávanie",
+        "items": [
+          {
+            "tool": "Optimalizácia journald",
+            "restores": "Prepíše /etc/systemd/journald.conf s pôvodnými predvolenými hodnotami a reštartuje systemd-journald."
+          },
+          {
+            "tool": "Optimalizácia logrotate",
+            "restores": "Obnoví /etc/logrotate.conf zo súboru .bak zachytený pred zmenou."
+          },
+          {
+            "tool": "Log2RAM",
+            "restores": "Zastaví a zakáže službu a časovač. Čistí úlohy cron, jednotky systemd, binárne súbory, konfiguračné súbory a adresár /var/log.hdd. Tiež odinštaluje balík apt, ak bol nainštalovaný týmto spôsobom."
+          },
+          {
+            "tool": "Automatický TRIM ZFS",
+            "restores": "Prečíta /usr/local/share/proxmenux/zfs_autotrim_pools so skutočne zmenenými poolmi a na každom spustí zpool set autotrim=off. Ručne zapnutý autotrim spred ProxMenuxu ponechá."
+          }
+        ]
+      },
+      {
+        "title": "Shell a vzhľad",
+        "items": [
+          {
+            "tool": "Prispôsobenie Bashrc",
+            "restores": "Obnovuje /root/.bashrc zo zálohy .bak. Ak neexistuje záloha, odstráni blok PMX_CORE_BASHRC pomocou markerov."
+          },
+          {
+            "tool": "Vlastný banner MOTD",
+            "restores": "Obnoví presný pôvodný obsah /etc/motd uložený v /usr/local/share/proxmenux, odstráni súbor, ak predtým neexistoval, alebo bezpečne odstráni starý marker pri migrácii staršej inštalácie."
+          },
+          {
+            "tool": "Fastfetch",
+            "restores": "Odstráni binárny súbor, konfiguračný adresár, hook update-motd a ohraničený blok BEGIN FASTFETCH / END FASTFETCH z /root/.bashrc, ~/.profile, /etc/profile a /etc/profile.d/fastfetch.sh. Úplne odstráni nainštalovaný balík apt."
+          },
+          {
+            "tool": "Figurine",
+            "restores": "Odstráni binárny súbor, záznam profile.d a blok aliasov v bashrc/profile."
+          }
+        ]
+      },
+      {
+        "title": "Hardware & virtualizácia",
+        "items": [
+          {
+            "tool": "IOMMU / VFIO",
+            "restores": "Odstráni moduly vfio z /etc/modules, položky blokovania ovládačov nouveau / radeon / nvidia a parametre intel_iommu=on / amd_iommu=on / iommu=pt / pcie_acs_override z /etc/kernel/cmdline (ZFS) alebo GRUB. Znovu vytvorí initramfs."
+          },
+          {
+            "tool": "Opravy AMD CPU (Ryzen/EPYC)",
+            "restores": "Odstráni idle=nomwait z príkazového riadka jadra (ZFS) alebo GRUB a možnosti ignore_msrs / report_ignored_msrs z /etc/modprobe.d/kvm.conf."
+          },
+          {
+            "tool": "Hosťovský agent pre virtualizovaný hostiteľ Proxmox",
+            "restores": "Prečíta /usr/local/share/proxmenux/guest_agent.pkg a úplne odstráni zaznamenaný balík hostiteľa. Inštalátor vyberá qemu-guest-agent, open-vm-tools alebo virtualbox-guest-utils podľa hypervízora. Bez záznamu skúsi tieto tri balíky. Ide o vnorený hostiteľ Proxmox, nie šablóny hostí."
+          }
+        ]
+      },
+      {
+        "title": "Úložisko",
+        "items": [
+          {
+            "tool": "Nastavenie veľkosti ARC ZFS",
+            "restores": "Odstráni /etc/modprobe.d/99-zfsarc.conf, obnoví konfliktné externé *.conf zo zálohy /usr/local/share/proxmenux/backups/zfs_arc/, znovu vytvorí initramfs a na hostiteľoch so systemd-boot spustí proxmox-boot-tool refresh."
+          },
+          {
+            "tool": "Automatické snímky ZFS",
+            "restores": "Odstráni položky cron zapísané skriptom a ponúkne apt purge zfs-auto-snapshot. Existujúce snímky v pooloch zostanú zachované; v prípade potreby ich odstráňte samostatne."
+          },
+          {
+            "tool": "Obmedzenia rýchlosti vzdump",
+            "restores": "Obnoví /etc/vzdump.conf zo zálohy .bak vytvorenej pri inštalácii a vráti bwlimit aj ionice na hodnoty pred ProxMenux."
+          }
+        ]
+      },
+      {
+        "title": "Služby a doplnky",
+        "items": [
+          {
+            "tool": "Synchronizácia času",
+            "restores": "Nastaví časovú zónu späť do UTC (bezpečné predvolené) prostredníctvom timedatectl."
+          },
+          {
+            "tool": "Generovanie entropie (haveged)",
+            "restores": "Zastaví, vypne a úplne odstráni balík haveged."
+          },
+          {
+            "tool": "kexec (rýchly reštart)",
+            "restores": "Vypne kexec-pve.service, odstráni súbor jednotky a alias reboot-quick z /root/.bash_profile a úplne odstráni kexec-tools."
+          },
+          {
+            "tool": "Zakázať RPC / rpcbind",
+            "restores": "Obnoví rpcbind.service a rpcbind.socket každý samostatne na zaznamenaný stav zapnutia/vypnutia a aktivity/neaktivity spred ProxMenuxu."
+          },
+          {
+            "tool": "pigz (paralelný gzip)",
+            "restores": "Obnoví skutočný gzip z gzip.distrib, odstráni presmerovanie dpkg a /bin/pigzwrapper, zakomentuje riadok pigz v /etc/vzdump.conf a po overení gzip spustí apt purge pigz."
+          },
+          {
+            "tool": "Vysoko dostupné služby",
+            "restores": "Zastaví a vypne pve-ha-lrm, pve-ha-crm a corosync. Existujúce skupiny HA a definície zdrojov nevymaže; ak ich už nepotrebujete, odstráňte ich cez webové rozhranie."
+          },
+          {
+            "tool": "Repozitár Ceph",
+            "restores": "Úplne odstráni balíky Ceph z tejto možnosti, odstráni deb822 /etc/apt/sources.list.d/ceph.sources v PVE 9 alebo starý zoznam Ceph v PVE 8 a obnoví cache APT."
+          },
+          {
+            "tool": "OVH RTM (monitorovanie)",
+            "restores": "Úplne odstráni balíky zodpovedajúce ovh-rtm*, rtm a rtm-*, odstráni /etc/rtm a záznam RTM v registri. Zvyšky Puppet v /etc/puppet/ môžu vyžadovať ručnú kontrolu a čistenie; adresár sa neodstraňuje. Mimo OVH inštalátor zvyčajne nič nemení."
+          }
+        ]
+      }
+    ]
+  },
+  "edge": {
+    "heading": "Osobitné prípady a obmedzenia",
+    "packageTitle": "Preinštalovanie zasiahne používané balíky Proxmox",
+    "packageBody": "Ak zálohy ProxMenux nedokážu vrátiť <strong>Odstránenie upozornenia na predplatné</strong>, náhradný postup preinštaluje <code>pve-manager</code>, <code>proxmox-widget-toolkit</code>, <code>libjs-extjs</code> a <code>libpve-http-server-perl</code> s <code>--force-confnew</code>. Zasiahne bežiace webové rozhranie: obnovte prehliadač a počkajte pár sekúnd na spojenie. Nerobte to počas migrácie alebo klonovania.",
+    "rebootTitle": "Trvalé mená a VFIO potrebujú reštart",
+    "rebootBody": "Odstránenie súborov <code>10-proxmenux-*.link</code> (<em>Trvalé názvy rozhraní</em>) a vrátenie <em>IOMMU/VFIO</em> nemenia už spustený systém; prejavia sa po reštarte. ProxMenux automaticky nastaví príznak potreby reštartu.",
+    "perItemTitle": "Môžeš vrátiť jednu vec a zvyšok si nechať.",
+    "perItemBody": "Odinštalačný program funguje pre každú položku. Ak chcete odstrániť iba Log2RAM, ale zachovať ladenie siete a zmeny bashrc, začiarknite iba <em>Log2RAM</em>. Nič iného sa nedotkne a register sa podľa toho aktualizuje."
+  },
+  "inspect": {
+    "heading": "Manuálne sledovanie registra",
+    "intro": "Ak chcete vidieť, čo je sledované bez otvorenia menu:",
+    "outro": "Každý záznam <code>\"tool\": true</code> zodpovedá úprave, ktorú ProxMenux použil a dokáže vrátiť. Neodstraňujte záznamy ručne: použite menu, ktoré aj spustí obnovu namiesto toho, aby na zmenu iba zabudlo.",
+    "reinstallTitle": "Preinštalovať po odinštalovaní",
+    "reinstallBody": "Vrátenú optimalizáciu môžete neskôr použiť znova. Otvorte <link>menu po inštalácii</link> a spustite Automatické alebo Prispôsobiteľné; register zaznamená nový stav."
+  },
+  "related": {
+    "heading": "Súvisiace",
+    "items": [
+      {
+        "label": "Automatizované po inštalácii",
+        "href": "/docs/post-install/automated",
+        "tail": " — znovu použite rozumnú základnú konfiguráciu."
+      },
+      {
+        "label": "Prispôsobiteľné nastavenia po inštalácii",
+        "href": "/docs/post-install/customizable",
+        "tail": " — Vyber si inú podskupinu."
+      },
+      {
+        "label": "Odinštalovať ProxMenux",
+        "href": "/docs/settings/uninstall-proxmenux",
+        "tail": " — Rôzne operácie: odstraňuje ProxMenux sám, nie jeho aplikované optimalizácie."
+      },
+      {
+        "label": "Prehľad po inštalácii",
+        "href": "/docs/post-install",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sk/docs/post-install/updates.json b/web/messages/sk/docs/post-install/updates.json
new file mode 100644
index 00000000..bf7b42d5
--- /dev/null
+++ b/web/messages/sk/docs/post-install/updates.json
@@ -0,0 +1,112 @@
+{
+  "meta": {
+    "title": "Aplikovať dostupné aktualizácie — Optimalizácie po inštalácii | Dokumentácia ProxMenux",
+    "description": "Ako ProxMenux zisťuje nové verzie optimalizácií po inštalácii (Log2Ram, nastavenia pamäte, limity systému, Logrotate, sieť…) a ako ich použiť cez menu po inštalácii alebo prehľad Monitor."
+  },
+  "header": {
+    "title": "Aplikovať dostupné aktualizácie",
+    "description": "Ak má optimalizácia po inštalácii (Log2Ram, nastavenia pamäte, limity systému, Logrotate…) na disku novšiu verziu než registrovanú, ProxMenux ju zobrazí ako dostupnú aktualizáciu. Možno ju použiť cez menu po inštalácii v skriptoch alebo cez prehľad Monitor. Obe cesty znovu spustia tú istú funkciu a aktualizujú register.",
+    "section": "Nastavenie Proxmoxu po inštalácii"
+  },
+  "intro": {
+    "title": "Čo to je?",
+    "body": "Optimalizácie ProxMenux po inštalácii majú verzie, napríklad <code>Log2ram SSD Protection v1.2</code>. Hostiteľ eviduje aktívne optimalizácie a ich verzie v <code>/usr/local/share/proxmenux/installed_tools.json</code>. Ak nové vydanie ProxMenux prinesie novšiu optimalizáciu, zistí rozdiel a ponúkne opätovné použitie iba tejto položky bez spustenia celého skriptu po inštalácii."
+  },
+  "why": {
+    "heading": "Prečo to existuje?",
+    "body": "Optimalizácie po inštalácii sa priebežne zlepšujú: vhodnejšie nastavenia sysctl, prísnejšie limity Logrotate, nový odhad veľkosti Log2RAM alebo oprava okrajového prípadu nahláseného testerom. Bez aktualizačného postupu mal správca len dve možnosti: znovu spustiť celý poinštalačný skript, ktorý opäť použije <em>všetky</em> optimalizácie, alebo sa zlepšenia vzdať. Použiť dostupné aktualizácie umožňuje dobrovoľne znovu spustiť iba tie optimalizácie, ktorých verzia sa skutočne zmenila."
+  },
+  "detection": {
+    "heading": "Spôsob zistenia aktualizácií",
+    "steps": [
+      {
+        "title": "Verziované skripty na disku",
+        "body": "Každá funkcia po inštalácii deklaruje svoju verziu vo vnútri skriptu (<code>scripts/post_install/auto_post_install.sh</code> a <code>scripts/post_install/customizable_post_install.sh</code>). Scanner vyberá tieto verzie zo zdroja na disku."
+      },
+      {
+        "title": "Register verzií na hostiteľovi",
+        "body": "Pri použití každej optimalizácie príslušné volanie <code>register_tool</code> zapísalo aktívnu verziu do <code>/usr/local/share/proxmenux/installed_tools.json</code>. Tento súbor je rozhodujúcim záznamom toho, čo je na hostiteľovi práve aktívne."
+      },
+      {
+        "title": "Monitor porovnáva obe strany",
+        "body": "Pri štarte a každých 24 hodín Monitor porovná verzie na disku s registrom. Každý rozdiel vytvorí položku v <code>/usr/local/share/proxmenux/updates_available.json</code>. Súbor riadi položku menu po inštalácii aj kartu prehľadu Monitor."
+      },
+      {
+        "title": "Jedno oznámenie na novú verziu",
+        "body": "Ak čaká aspoň jedna aktualizácia, Monitor odošle jedno súhrnné oznámenie, napríklad <em>„Dostupné 4 aktualizácie optimalizácií ProxMenux“</em>, s riadkom pre každý nástroj vo formáte <code>name (vX → vY)</code>, ako pri balíkoch Proxmox. Pre rovnakú skupinu sa denne neopakuje; znovu ho vyvolá iba nová verzia alebo nový nástroj v zozname."
+      }
+    ]
+  },
+  "pathA": {
+    "heading": "Cesta A — Z menu po inštalácii",
+    "intro": "V hlavnom menu ProxMenux otvorte <strong>Nastavenie Proxmoxu po inštalácii</strong>. Pri čakajúcich aktualizáciách sa nad <em>Odinštalovať optimalizácie</em> zobrazí <strong>Aplikovať dostupné aktualizácie (N)</strong>. Číslo udáva počet optimalizácií s novšou verziou na disku než v registri. Ak je všetko aktuálne, položka sa skryje.",
+    "menuAlt": "Menu skriptov po inštalácii s podmienenou položkou Aplikovať dostupné aktualizácie (N) nad Odinštalovať optimalizácie; počítadlo udáva počet novších verzií optimalizácií na disku",
+    "menuCaption": "<em>Aplikovať dostupné aktualizácie (N)</em> sa zobrazí iba pri čakajúcej aktualizácii aspoň jednej optimalizácie; pri aktuálnom hostiteľovi sa skryje.",
+    "checklistBody": "Otvorí výberový zoznam všetkých čakajúcich aktualizácií vo formáte <code>name (vX → vY)</code>. Všetky riadky sú predvolene zaškrtnuté; zrušte výber tých, ktoré teraz nechcete použiť.",
+    "checklistAlt": "Dialóg Aplikovať dostupné aktualizácie s riadkom pre každú čakajúcu optimalizáciu, názvom a zmenou verzie (aktuálna → dostupná). Všetky riadky sú zaškrtnuté.",
+    "checklistCaption": "Vyberte jednotlivé optimalizácie na aktualizáciu. Rovnaký mechanizmus ako Automatizované a Prispôsobiteľné znovu použije funkcie na pozadí a aktualizuje ich verzie v registri."
+  },
+  "pathB": {
+    "heading": "Cesta B — Z prehľadu Monitor",
+    "intro": "Rovnaké aktualizácie sú v Monitor pod <link>Nastavenia → Optimalizácie ProxMenux</link>. Karta zobrazí <strong>počítadlo čakajúcich aktualizácií</strong>, ktoré otvorí výber jednotlivých optimalizácií. Každý nástroj má aj vlastnú akciu aktualizácie.",
+    "imageAlt": "Karta Optimalizácie ProxMenux v nastaveniach Monitor s počítadlom čakajúcich aktualizácií na otvorenie výberu a akciami aktualizácie jednotlivých nástrojov",
+    "imageCaption": "Karta Optimalizácie v Monitor sprístupní aktualizácie cez počítadlo pri novšej verzii na disku bez prístupu do shellu."
+  },
+  "applying": {
+    "heading": "Čo sa stane po použití aktualizácie",
+    "steps": [
+      {
+        "title": "Znovu spustí funkciu po inštalácii",
+        "body": "Funkcia vybranej optimalizácie sa znovu spustí na hostiteľovi. Keďže každá poinštalačná funkcia je <strong>idempotentná</strong>, opakovanie nevytvára duplicitnú konfiguráciu: nahradí predchádzajúcu verziu novou, napríklad súbory sysctl, doplnkové konfigurácie a jednotky služieb."
+      },
+      {
+        "title": "Obnovuje register",
+        "body": "Volanie <code>register_tool</code> vo vnútri funkcie zapíše novú verziu do <code>installed_tools.json</code>. Ďalší sken už nevidí nesúlad a položka aktualizácie zmizne z menu aj z karty Monitor."
+      },
+      {
+        "title": "Žiadny reštart, pokiaľ to funkcia nepovie",
+        "body": "Väčšina aktualizácií sa prejaví okamžite. Tie, ktoré menia moduly jadra, trvalé názvy rozhraní alebo VFIO, zobrazia rovnakú výzvu na reštart ako pri prvej inštalácii."
+      },
+      {
+        "title": "Aktualizácia registra zaslaná monitoru",
+        "body": "Po dokončení dávky menu odošle požiadavku POST na <code>http://127.0.0.1:8008/api/updates/post-install/scan</code> na obnovu <code>/usr/local/share/proxmenux/updates_available.json</code>. Po použití všetkých aktualizácií zmizne ich počítadlo na karte Optimalizácie aj podmienená položka menu shellu bez čakania na ďalšiu kontrolu. Samotná karta zostane dostupná."
+      }
+    ],
+    "jqTitle": "Vyžaduje sa jq",
+    "jqBody": "Výber na ceste A používa <code>jq</code> na spracovanie JSON čakajúcich aktualizácií. Ak <code>jq</code> chýba, postup sa potichu ukončí: menu ukáže počet, ale po výbere sa nič nestane. Moderná inštalácia Proxmox má <code>jq</code>; pri pochybnostiach spustite <code>apt install -y jq</code>."
+  },
+  "differs": {
+    "heading": "Ako sa líši od ostatných ciest",
+    "headerPath": "Path",
+    "headerScope": "Rozsah",
+    "headerWhen": "Keď to dáva zmysel",
+    "rows": [
+      {
+        "pathLabel": "Automatizované",
+        "pathHref": "/docs/post-install/automated",
+        "scope": "Znovu použije <em>všetky</em> optimalizácie v balíku.",
+        "when": "Nový hostiteľ alebo úplné obnovenie základných nastavení plne spravovaného uzla."
+      },
+      {
+        "pathLabel": "Prispôsobiteľné",
+        "pathHref": "/docs/post-install/customizable",
+        "scope": "Vyberte si z celého katalógu.",
+        "when": "Presne vybrať aktívne optimalizácie hostiteľa."
+      },
+      {
+        "pathLabel": "Nainštalovať dostupné aktualizácie",
+        "pathHref": null,
+        "scope": "Iba optimalizácie s novšou verziou na disku.",
+        "when": "Udržiavať nainštalované optimalizácie aktuálne bez zásahu do ostatných."
+      },
+      {
+        "pathLabel": "Odstrániť optimalizácie",
+        "pathHref": "/docs/post-install/uninstall",
+        "scope": "Vrátiť optimalizáciu a odstrániť jej položku registra.",
+        "when": "Vrátiť konkrétnu zmenu."
+      }
+    ]
+  },
+  "notifTitle": "Ovládanie oznámenia",
+  "notifBody": "Čakajúce aktualizácie oznamuje udalosť <em>Dostupné aktualizácie optimalizácií ProxMenux</em>. Predvolene je povolená na každom kanáli a dá sa pre jednotlivé kanály stíšiť v <link>Nastavenia → Oznámenia</link>. Spustí sa iba raz pre každú odlišnú skupinu aktualizácií, nie pri každej kontrole po 24 hodinách."
+}
diff --git a/web/messages/sk/docs/post-install/virtualization.json b/web/messages/sk/docs/post-install/virtualization.json
new file mode 100644
index 00000000..4d88c434
--- /dev/null
+++ b/web/messages/sk/docs/post-install/virtualization.json
@@ -0,0 +1,116 @@
+{
+  "meta": {
+    "title": "Po inštalácii: Virtualizácia | Dokumentácia ProxMenux",
+    "description": "Možnosti virtualizácie v prispôsobiteľnom skripte ProxMenux po inštalácii: automaticky nainštaluje správneho hosťovského agenta, ak Proxmox beží vo VM, a povolí IOMMU / VFIO na priame priradenie zariadení PCI (GPU, NIC, HBA) vašim VM."
+  },
+  "header": {
+    "title": "Po inštalácii: Virtualizácia",
+    "section": "Nastavenie Proxmoxu po inštalácii"
+  },
+  "intro": {
+    "title": "Čo táto kategória zahŕňa",
+    "body": "Dve nezávislé možnosti. <strong>Nainštalovať vhodného hosťovského agenta</strong> pomáha, keď samotný Proxmox beží vnorený v inom hypervízore. <strong>Zapnúť podporu VFIO/IOMMU</strong> zaujíma väčšinu používateľov: povolí funkcie jadra na priame priradenie GPU, HBA alebo sieťovej karty do VM s takmer natívnym výkonom."
+  },
+  "guestAgent": {
+    "heading": "Nainštalovať vhodného hosťovského agenta",
+    "intro": "Zistí virtualizačné prostredie hostiteľa Proxmox pomocou <code>systemd-detect-virt</code> a <code>dmidecode</code> a nainštaluje príslušný balík hosťovských nástrojov na správnu komunikáciu s vonkajším hypervízorom: riadne vypnutie, synchronizácia času, hlásenie IP adresy atď.",
+    "headerDetected": "Detekovaný hostiteľ",
+    "headerPackage": "Inštalovaný balík",
+    "rows": [
+      {
+        "detected": "QEMU / KVM",
+        "package": "qemu-guest-agent"
+      },
+      {
+        "detected": "VMware (ESXi, Workstation)",
+        "package": "open-vm-tools"
+      },
+      {
+        "detected": "VirtualBox",
+        "package": "virtualbox-guest-utils"
+      },
+      {
+        "detected": "Bare metal (žiadne)",
+        "package": " — bez zmien, nič sa nenainštaluje"
+      }
+    ],
+    "skipTitle": "Vynechajte pri Proxmox bežiacom priamo na hardvéri",
+    "skipBody": "Ak Proxmox beží priamo na hardvéri, čo je bežný prípad, zaškrtnutie nič nezmení: detektor vráti <code>none</code> a skript sa ukončí bez zmien. Možnosť má význam iba pre menšinu zostáv, kde Proxmox beží <em>ako hosť</em> na testovanie alebo v laboratóriu."
+  },
+  "vfio": {
+    "heading": "Zapnúť podporu VFIO/IOMMU",
+    "intro": "Zapne IOMMU na hostiteľovi a načíta moduly jadra na priame priradenie PCI (<code>vfio</code>, <code>vfio_iommu_type1</code>, <code>vfio_pci</code>). Fyzické zariadenie potom môžete priradiť do VM, ktorej hosť získa priamy prístup s takmer natívnym výkonom.",
+    "whoTitle": "Kto to potrebuje?",
+    "whoItems": [
+      "Chcete priamo priradiť GPU hernej VM s Windows alebo VM s macOS.",
+      "Máte vyhradenú 10G NIC pre firewall / router VM (OPNsense, pfSense).",
+      "Chcete priamo priradiť HBA do VM s TrueNAS/Unraid pre ZFS na fyzických diskoch.",
+      "Plánujete použiť <em>Coral TPU</em>, zachytávaciu kartu alebo SDR adaptér vo VM."
+    ],
+    "whoOutro": "Ak nič z toho neplatí, môžete možnosť vynechať. Na sprístupnenie zariadenia kontajneru <strong>LXC</strong> namiesto VM sa IOMMU <em>nevyžaduje</em>.",
+    "doesTitle": "Čo robí ProxMenux",
+    "doesIntro": "Funkcia zohľadňuje zavádzač: zistí ZFS (systemd-boot) alebo LVM/ext4 (GRUB) a zapíše do správneho súboru. Je idempotentná — existujúce parametre nepridáva znovu.",
+    "headerBoot": "Typ zavádzania",
+    "headerFile": "Upravený súbor",
+    "headerPost": "Krok po aktualizácii",
+    "bootRows": [
+      {
+        "boot": "systemd-boot (ZFS)",
+        "file": "/etc/kernel/cmdline",
+        "post": "proxmox-boot-tool refresh"
+      },
+      {
+        "boot": "GRUB (LVM/ext4)",
+        "file": "/etc/default/grub",
+        "post": "update-grub"
+      }
+    ],
+    "kernelIntro": "Pridané parametre jadra:",
+    "modulesIntro": "Moduly jadra pridané do <code>/etc/modules</code>:",
+    "blacklistIntro": "Konfliktné ovládače zakázané v <code>/etc/modprobe.d/blacklist.conf</code>:",
+    "blacklistTitle": "Zákaz ovládačov GPU je v konflikte s používaním GPU na hostiteľovi",
+    "blacklistBody": "Zoznam zakázaných ovládačov zabraňuje jadru hostiteľa priradiť <em>akýkoľvek</em> ovládač GPU, aby ju mohol prevziať VFIO. To chcete pri priamom priradení do VM, ale je to <strong>opak</strong> toho, čo treba na <link>inštaláciu ovládačov NVIDIA na hostiteľovi</link>, napríklad pre transkódovanie LXC. Pre každú GPU vyberte jednu cestu:",
+    "pathItems": [
+      "<strong>GPU → VM:</strong> povoľte tu VFIO/IOMMU a ponechajte ovládače GPU zakázané.",
+      "<strong>GPU → LXC (alebo hostiteľ):</strong> túto možnosť vynechajte, použite inštaláciu NVIDIA na hostiteľovi a nezakazujte nvidia/nouveau.",
+      "<strong>Dve GPU:</strong> jedna môže ísť do VM a druhá do LXC, ale treba presnejšiu konfiguráciu: priradiť iba jednu kartu k <code>vfio-pci</code> podľa PCI ID. Predvolený zoznam zákazov je príliš široký — potom upravte <code>blacklist.conf</code>."
+    ],
+    "acsTitle": "O pcie_acs_override — vedzte, čo povoľujete",
+    "acsBody": "<code>pcie_acs_override=downstream,multifunction</code> uvoľňuje kontrolu PCIe Access Control Services. Umožňuje jadru rozdeliť skupiny IOMMU, ktoré firmvér označuje za nedeliteľné, čo je niekedy jediná cesta na priradenie jedného zariadenia bez ostatných. Nevýhodou je <strong>znížená izolácia medzi zariadeniami</strong>: škodlivá alebo kompromitovaná VM s priamym priradením má väčšiu útočnú plochu cez DMA. Pre domáce laboratórium prijateľné; pri nedôveryhodných záťažiach to dôkladne zvážte. Ak parameter nepotrebujete, po skripte ho odstráňte z <code>/etc/kernel/cmdline</code> alebo <code>/etc/default/grub</code> a znovu aktualizujte zavádzač.",
+    "rebootTitle": "Vyžaduje sa reštart",
+    "rebootBody": "IOMMU, moduly VFIO a zoznam zákazov sa prejavia po obnovení initramfs a reštarte. Skript spustí <code>update-initramfs -u -k all</code>, aktualizuje zavádzač a nastaví príznak „vyžaduje sa reštart“, aby sa Prispôsobiteľné na konci opýtalo.",
+    "verifyTitle": "Overenie po reštarte",
+    "revertTitle": "Reverzibilné z menu Odinštalovať",
+    "revertBody": "<link>Odinštalujte optimalizácie</link> vráti všetky zmeny: odoberie tokeny IOMMU <code>/etc/kernel/cmdline</code> alebo GRUB, odstráni moduly VFIO z <code>/etc/modules</code>, odstráni položky čiernej listiny ovládačov a prebuduje initramfs. Na skutočné použitie reverzie je potrebný reštart."
+  },
+  "related": {
+    "heading": "Súvisiace",
+    "items": [
+      {
+        "label": "Pridať GPU do VM (passthrough)",
+        "href": "/docs/hardware/gpu-vm-passthrough",
+        "tail": " — prirodzený ďalší krok po povolení IOMMU + VFIO."
+      },
+      {
+        "label": "Pridať radič alebo NVMe do VM",
+        "href": "/docs/disk-manager/add-controller-nvme-vm",
+        "tail": " — rovnaká infraštruktúra priameho priradenia pre radiče úložísk."
+      },
+      {
+        "label": "Príkazy na priame priradenie GPU",
+        "href": "/docs/help-info/gpu-commands",
+        "tail": " — Referencia na overenie IOMMU."
+      },
+      {
+        "label": "Odinštalovať optimalizácie",
+        "href": "/docs/post-install/uninstall",
+        "tail": " — čisto vrátiť nastavenia IOMMU / VFIO."
+      },
+      {
+        "label": "Prispôsobiteľné nastavenia po inštalácii",
+        "href": "/docs/post-install/customizable",
+        "tail": " — späť do nadradeného menu."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sk/docs/security/fail2ban.json b/web/messages/sk/docs/security/fail2ban.json
new file mode 100644
index 00000000..33062ab3
--- /dev/null
+++ b/web/messages/sk/docs/security/fail2ban.json
@@ -0,0 +1,152 @@
+{
+  "meta": {
+    "title": "Fail2Ban | Dokumentácia ProxMenux",
+    "description": "Nainštalujte Fail2Ban s tromi jails vyladenými pre Proxmox (SSH agresívny, Proxmox UI 8006, ProxMenux Monitor 8008). Zahŕňa opravu journald MaxLevelStore, vlastné protokolové služby pre spoľahlivosť, automaticky detekovaný backend nftables/iptables a zosilnenie SSH MaxAuthTries.",
+    "ogTitle": "Fail2Ban | Dokumentácia ProxMenux",
+    "ogDescription": "Ochrana pred hrubou silou pre SSH a webové rozhrania Proxmox s opravami journald a backendu špecifickými pre Proxmox."
+  },
+  "header": {
+    "title": "Fail2Ban",
+    "description": "Nainštaluje Fail2Ban pre Proxmox: tri jaily (agresívny SSH, rozhranie Proxmox na 8006, ProxMenux Monitor na 8008 a reverzný proxy), opravu úrovne journald na ukladanie udalostí SSH, dve služby kopírujúce denník do súborov na obídenie známeho problému backendu systemd, detekciu backendu firewallu a posilnenie SSH pomocou MaxAuthTries.",
+    "section": "Zabezpečenie"
+  },
+  "intro": {
+    "title": "Čo to robí?",
+    "body": "Inštaluje Fail2Ban z repozitárov Debian a vytvorí konfiguráciu Proxmox, ktorá ihneď chráni SSH, rozhranie Proxmox a ProxMenux Monitor. Ak rozpozná existujúcu inštaláciu, ponúkne menu správy na preinštalovanie alebo odstránenie."
+  },
+  "firstLaunch": {
+    "heading": "Dialóg prvého spustenia",
+    "body": "Ak Fail2Ban nie je nainštalovaný, skript zobrazí potvrdenie so súhrnom plánovanej inštalácie a konfigurácie. Zrušenie ukončí postup bez zmien; potvrdenie spustí inštaláciu.",
+    "imageAlt": "Potvrdenie inštalácie Fail2Ban s tromi jailmi, opravou journald a posilnením SSH"
+  },
+  "jails": {
+    "heading": "Tri jails",
+    "headerJail": "Jail",
+    "headerProtects": "Chráni",
+    "headerRetries": "Pokusy / Časové okno",
+    "headerBan": "Trvanie blokovania",
+    "rows": [
+      {
+        "jail": "[sshd]",
+        "protects": "SSH (agresívny režim — zahŕňa ddos, mode, normal)",
+        "retries": "2 / 60 min",
+        "ban": "9 hodín"
+      },
+      {
+        "jail": "[proxmox]",
+        "protects": "Webové rozhranie Proxmox (port 8006)",
+        "retries": "3 / 10 min",
+        "ban": "1 hodina"
+      },
+      {
+        "jail": "[proxmenux]",
+        "protects": "ProxMenux Monitor (port 8008 + http/https reverzný proxy)",
+        "retries": "3 / 10 min",
+        "ban": "1 hodina"
+      }
+    ],
+    "outro": "Globálne predvolené hodnoty od <code>jail.local</code>: <code>ignoreip = 127.0.0.1/8 ::1</code>, <code>ignoreself = true</code>,<code> bantime = 86400</code> (24-hodinová rezerva pre jails ktoré to neprepíšu), <code>maxretry = 2</code>, <code>findtime = 1800</code>."
+  },
+  "journald": {
+    "heading": "Prečo je oprava journald dôležitá",
+    "intro": "Proxmox dodáva <code>/etc/systemd/journald.conf</code> s <codeNw>MaxLevelStore=warning</codeNw>. journald pred uložením zahodí správy s úrovňou <em>nižšou</em> než warning. SSH a PAM hlásia chyby overovania na úrovniach <em>info</em> / <em>notice</em>, preto:",
+    "diagram": {
+      "sshLabel": "SSH / PAM",
+      "sshDetail": "chyba overovania\n(úroveň info / notice)",
+      "journaldLabel": "journald",
+      "journaldDetail": "MaxLevelStore=warning\n→ udalosť sa bez upozornenia zahodí",
+      "fail2banLabel": "Fail2Ban",
+      "fail2banDetail": "nevidí nič\n→ nikdy nič nezakazuje",
+      "arrowLabel": "predvolený Proxmox"
+    },
+    "afterDiagram": "Inštalátor to rozpozná a vytvorí doplnkový súbor <codeXs>/etc/systemd/journald.conf.d/proxmenux-loglevel.conf</codeXs>, ktorý nastaví <code>MaxLevelStore</code> aj <code>MaxLevelSyslog</code> na <code>info</code>:",
+    "code": "[Journal]\nMaxLevelStore=info\nMaxLevelSyslog=info",
+    "outro": "Potom reštartuje <code>systemd-journald</code>. Pri odinštalovaní sa doplnkový súbor odstráni a obnoví sa pôvodné nastavenie Proxmox."
+  },
+  "loggers": {
+    "heading": "Prečo dve vlastné logger služby",
+    "intro1": "Fail2Ban môže čítať priamo denník systemd (<code>backend = systemd</code>), ale tento backend má na Proxmoxe známe problémy s pracovnými procesmi <code>pvedaemon</code>: udalosti overovania sa objavia v denníku, ale nie vždy sa zachytia. Problém sa občas týka aj <code>sshd</code>.",
+    "intro2": "ProxMenux vytvorí dve malé služby systemd, ktoré sledujú príslušné jednotky pomocou <code>journalctl -f</code> a pridávajú každý riadok do súboru. Fail2Ban číta tieto súbory spoľahlivým <code>backend = auto</code> (súborový režim):",
+    "headerService": "Služba",
+    "headerSource": "Zdrojová jednotka",
+    "headerOutput": "Výstupný súbor",
+    "rows": [
+      {
+        "service": "proxmox-auth-logger.service",
+        "source": "pvedaemon.service",
+        "output": "/var/log/proxmox-auth.log"
+      },
+      {
+        "service": "ssh-auth-logger.service",
+        "source": "ssh.service",
+        "output": "/var/log/ssh-auth.log"
+      }
+    ],
+    "outro": "Obe služby sú deklarované ako <code>PartOf=fail2ban.service</code>, takže sa reštartujú s Fail2Ban a zastavia sa s ním. Režim 640, ktorý vlastní <code>root:adm</code> v súboroch denníka. Tretí protokol používaný <code>[proxmenux]</code> jail (<code>/var/log/proxmenux-auth.log</code>) je zapísaný priamo aplikáciou ProxMenux Monitor Flask – nie je potrebná žiadna služba zapisovača."
+  },
+  "backend": {
+    "heading": "Automatická detekcia backendu firewallu",
+    "intro": "Inštalátor sonduje hostiteľa: ak <code>nft list ruleset</code> funguje, vyberie <code>nftables</code> ako akciu zákazu. Inak sa vráti do <code>iptables-multiport</code> / <code>iptables-allports</code>. Voľba je napísaná do <code>jail.local</code>:",
+    "code": "# nftables host\nbanaction = nftables\nbanaction_allports = nftables[type=allports]\n\n# iptables host (fallback)\nbanaction = iptables-multiport\nbanaction_allports = iptables-allports"
+  },
+  "hardening": {
+    "heading": "Posilnenie SSH: MaxAuthTries",
+    "intro": "Kontrola Lynis <strong>SSH-7408</strong> odporúča <code>MaxAuthTries 3</code> v <code>sshd_config</code>. SSH jail používa <code>maxretry = 2</code> na blokovanie po opakovaných zlyhaniach; MaxAuthTries obmedzuje pokusy v rámci jedného spojenia. Toto nastavenie SSH pridáva ďalšiu vrstvu ochrany aj pri zastavení Fail2Ban počas údržby.",
+    "installerIntro": "Inštalátor:",
+    "items": [
+      "Číta aktuálnu hodnotu <code>MaxAuthTries</code> (alebo predvolené hodnoty 6 v prípade neprítomnosti).",
+      "Ukladá to na <code>/usr/local/share/proxmenux/sshd_maxauthtries_backup</code>.",
+      "Upraví <code>sshd_config</code> priamo: nahradí existujúci riadok, odkomentuje zakomentovaný alebo pridá nový.",
+      "Znova načíta <code>sshd</code> bez reštartu, aby existujúce relácie zostali aktívne."
+    ],
+    "outro": "Na odinštalovanie je uložená pôvodná hodnota obnovená a <code>sshd</code> je znovu načítaná."
+  },
+  "manage": {
+    "heading": "Spravovať existujúcu inštaláciu",
+    "intro": "Ak je Fail2Ban nainštalovaný už pri otvorení ponuky, skript ho detekuje a zobrazí riadiace menu namiesto opätovného spustenia inštalátora:",
+    "headerAction": "Akcia",
+    "headerWhat": "Čo to robí?",
+    "rows": [
+      {
+        "action": "Preinštalovať",
+        "what": "Znova spustí celý inštalátor a prepíše všetky jaily aktuálnymi predvolenými hodnotami ProxMenux. Použite to, keď aktualizácia zmení odporúčané hodnoty."
+      },
+      {
+        "action": "Odstrániť",
+        "what": "Zastaví fail2ban a dve loggerové služby, vyčistí balík apt, odstráni všetky jail / súbory filtrov, odstráni drop-in journald (obnoví predvolené nastavenie Proxmox) a obnoví pôvodný SSH MaxAuthTries."
+      }
+    ]
+  },
+  "verify": {
+    "heading": "Overte, či funguje.",
+    "intro": "Po inštalácii užitočné príkazy od hostiteľa:",
+    "code": "# Service status and version\nsystemctl status fail2ban\nfail2ban-client --version\n\n# All active jails\nfail2ban-client status\n\n# Detail on one jail\nfail2ban-client status sshd\nfail2ban-client status proxmox\nfail2ban-client status proxmenux\n\n# Currently banned IPs in a jail\nfail2ban-client status sshd | grep \"Banned IP\"\n\n# Manually unban an IP (use this if you ban yourself)\nfail2ban-client unban 192.0.2.10\n\n# Tail the auth logs Fail2Ban watches\ntail -f /var/log/ssh-auth.log\ntail -f /var/log/proxmox-auth.log\ntail -f /var/log/fail2ban.log"
+  },
+  "troubleshoot": {
+    "heading": "Riešenie problémov",
+    "neverBansTitle": "Fail2Ban beží, ale nikdy nič nezakazuje",
+    "neverBansBody": "Overte, či <code>tail -f /var/log/ssh-auth.log</code> dostane záznam po pokuse o SSH prihlásenie s nesprávnym heslom z iného počítača. Ak zostane prázdny, skontrolujte <code>systemctl status ssh-auth-logger.service</code>. Ak služba beží, prezrite udalosti príkazom <code>journalctl -u ssh.service -n 50 --no-pager -p info</code> a overte, či doplnková konfigurácia journald povoľuje úroveň <em>info</em>.",
+    "monitorEmptyTitle": "ProxMenux Monitor jail nemá žiadne položky ani po neúspešnom prihlásení",
+    "monitorEmptyBody": "<code>[proxmenux]</code> jail číta <code>/var/log/proxmenux-auth.log</code>, ktorý je napísaný aplikáciou ProxMenux Monitor Flask – nie zapisovačom journald. Ak nespustíte Monitor, súbor zostane prázdny a jail sa nikdy nespustí. To sa očakáva; konfigurácia jail je neškodná. Ak spustíte Monitor a protokol je prázdny, skontrolujte konfiguráciu protokolovania Flask.",
+    "selfBanTitle": "Zakázal som sám seba.",
+    "selfBanIntro": "Z konzoly / IPMI / iKVM (alebo inej povolenej IP adresy):",
+    "selfBanCode": "fail2ban-client unban '<'YOUR_IP'>'\n\n# To prevent it next time, edit /etc/fail2ban/jail.local and add your IP:\nignoreip = 127.0.0.1/8 ::1 192.168.1.0/24 203.0.113.42\n\n# Then reload\nfail2ban-client reload",
+    "aptFailTitle": "apt-get zlyhá: ''Unable to locate package fail2ban''",
+    "aptFailBody": "Hostiteľovi chýbajú repozitáre Debian (bežné pri minimálnej inštalácii Proxmox). Inštalátor to rozpozná a pred opakovaním vytvorí <code>/etc/apt/sources.list.d/debian.sources</code> so správnym kódovým označením (<code>bookworm</code> / <code>trixie</code>). Ak chyba pretrváva, skontrolujte <code>VERSION_CODENAME</code> v <code>/etc/os-release</code> a dostupnosť URL repozitára.",
+    "lockoutTitle": "SSH ma po inštalácii zamkne",
+    "lockoutBody": "Inštalatér nastaví <code>MaxAuthTries=3</code>. Ak váš správca hesla / agent získa viac kľúčov, môžete to prekročiť pri jednom pokuse o pripojenie. Obmedzte ponúkané kľúče: <code>ssh -o IdentitiesOnly=yes -i ~/.ssh/specific_key user@host</code>. Alebo dočasne zvýšiť <code>MaxAuthTries</code> v <code>sshd_config</code>, zatiaľ čo vy ladíte."
+  },
+  "files": {
+    "heading": "Súbory napísané",
+    "code": "/etc/fail2ban/jail.local                              # global defaults + [sshd]\n/etc/fail2ban/jail.d/proxmox.conf                     # [proxmox]\n/etc/fail2ban/jail.d/proxmenux.conf                   # [proxmenux]\n/etc/fail2ban/filter.d/proxmox.conf                   # auth-failure regex for pvedaemon\n/etc/fail2ban/filter.d/proxmenux.conf                 # auth-failure regex for Monitor\n/etc/systemd/system/proxmox-auth-logger.service       # journal → file (pvedaemon)\n/etc/systemd/system/ssh-auth-logger.service           # journal → file (sshd)\n/etc/systemd/journald.conf.d/proxmenux-loglevel.conf  # MaxLevelStore=info\n/etc/ssh/sshd_config                                  # MaxAuthTries=3 (in-place edit)\n/var/log/proxmox-auth.log                             # written by logger service\n/var/log/ssh-auth.log                                 # written by logger service\n/var/log/proxmenux-auth.log                           # written by Monitor Flask app\n/usr/local/share/proxmenux/sshd_maxauthtries_backup   # for restore on uninstall"
+  },
+  "related": {
+    "heading": "Súvisiace",
+    "monitorLabel": "ProxMenux Monitor → Bezpečnostná karta",
+    "monitorTail": " — inštalácia z ovládacieho panela, aktuálny stav jailov, blokované IP adresy a nastavenie počtu pokusov a trvania blokovania pre každý jail v prehliadači.",
+    "lynisLabel": "Lynis",
+    "lynisTail": " — spustite bezpečnostný audit pred zmenou a po nej a overte splnenie kontroly SSH-7408.",
+    "securityLabel": "Prehľad bezpečnosti",
+    "securityTail": " — Späť na prehľad sekcie."
+  }
+}
diff --git a/web/messages/sk/docs/security/index.json b/web/messages/sk/docs/security/index.json
new file mode 100644
index 00000000..39762fe4
--- /dev/null
+++ b/web/messages/sk/docs/security/index.json
@@ -0,0 +1,70 @@
+{
+  "meta": {
+    "title": "Zabezpečenie Proxmox — Fail2Ban a audit zabezpečenia Lynis | ProxMenux",
+    "description": "Dva bezpečnostné nástroje pre Proxmox VE: Fail2Ban (prevencia prienikov cez SSH, webové rozhranie Proxmox a ProxMenux Monitor) a Lynis (audit bezpečnosti a posilnenia zabezpečenia, inštalovaný z pôvodného repozitára GitHub).",
+    "ogTitle": "Zabezpečenie Proxmox — Fail2Ban a audit zabezpečenia Lynis",
+    "ogDescription": "Fail2Ban a Lynis pre Proxmox VE: prevencia prienikov a audit zabezpečenia, inštalované a spravované cez ProxMenux.",
+    "twitterTitle": "Zabezpečenie Proxmox | ProxMenux",
+    "twitterDescription": "Fail2Ban a Lynis pre Proxmox VE: prevencia prienikov a audit zabezpečenia."
+  },
+  "header": {
+    "title": "Zabezpečenie",
+    "description": "Dva doplnkové nástroje pre Proxmox VE: aktívna ochrana (Fail2Ban blokuje IP adresy útočiace na SSH alebo webové rozhrania) a lokálny audit (Lynis hľadá nedostatky zabezpečenia a udeľuje skóre 0–100). Každý má vlastné menu inštalácie a správy, ktoré pred každou akciou rozpozná existujúcu inštaláciu.",
+    "section": "Zabezpečenie"
+  },
+  "intro": {
+    "title": "Aktívna ochrana a lokálny audit",
+    "body": "Odpovedajú na rôzne otázky. <strong>Fail2Ban</strong> odpovedá na <em>„Útočí na nás niekto práve teraz?“</em> sledovaním protokolov overovania a blokovaním útočiacich IP adries. <strong>Lynis</strong> odpovedá na <em>„Ako dobre je tento hostiteľ zabezpečený?“</em> jednorazovým auditom a konkrétnymi odporúčaniami. Používajte oba: Lynis ukáže, čo zlepšiť, a Fail2Ban reaguje na prebiehajúce útoky."
+  },
+  "opening": {
+    "heading": "Otvorenie menu",
+    "body": "V hlavnom menu ProxMenux vyberte <strong>Zabezpečenie</strong>. Zobrazí sa toto:",
+    "imageAlt": "Bezpečnostné menu s možnosťami Fail2Ban a Lynis"
+  },
+  "pick": {
+    "heading": "Vyberte si nástroj",
+    "body": "Tieto dva nástroje sú nezávislé: nainštalujte jeden, oba alebo žiadny. Každá karta nižšie odkazuje na podrobný opis nástroja."
+  },
+  "cards": {
+    "fail2ban": {
+      "title": "Fail2Ban",
+      "body": "Aktívna prevencia prienikov. Sleduje protokoly overovania SSH a webových rozhraní a po opakovaných zlyhaniach blokuje IP adresy.",
+      "bullets": [
+        "Tri jails: SSH, Proxmox UI (8006), ProxMenux Monitor (8008)",
+        "Opravuje predvolené nastavenia Proxmox journald, ktoré blokujú protokoly overenia",
+        "Automaticky rozpozná nftables / iptables",
+        "Posilnenie SSH: MaxAuthTries=3 (odporúčanie Lynis)"
+      ]
+    },
+    "lynis": {
+      "title": "Lynis",
+      "body": "Lokálny bezpečnostný audítor. Preskúma hostiteľa a zobrazí skóre zabezpečenia a konkrétne odporúčania na nápravu.",
+      "bullets": [
+        "Inštalované z pôvodného repozitára CISOfy na GitHube (najnovšia verzia)",
+        "Skóre zabezpečenia 0–100 a zoznam upozornení a návrhov",
+        "Audit a aktualizácia priamo v menu",
+        "Navrhnuté iba na čítanie: nikdy nemení systém"
+      ]
+    }
+  },
+  "workflowTip": {
+    "title": "Pracovný tok, ktorý využíva oboje",
+    "body": "Najprv spustite audit Lynis, aby ste poznali počiatočné skóre a hlavné odporúčania. Použite vybrané opravy. Potom nainštalujte Fail2Ban: automaticky zavedie ochranu SSH pred hrubou silou a upraví <code>MaxAuthTries</code> v <code>sshd_config</code> podľa kontroly SSH-7408. Opätovným auditom Lynis overte zlepšenie."
+  },
+  "fail2banSection": {
+    "heading": "Fail2Ban",
+    "body": "ProxMenux inštaluje Fail2Ban s konfiguráciou pre Proxmox. Okrem štandardného SSH jailu chráni webové rozhranie Proxmox a ProxMenux Monitor. Obchádza dva špecifické problémy: predvolené nastavenie journald zahadzujúce udalosti overovania a problém backendu systemd, ktorý bráni spoľahlivému čítaniu niektorých zdrojov systémového denníka. Podrobná stránka vysvetľuje inštaláciu, tri jaily, opravu journald, posilnenie SSH a riešenie problémov.",
+    "optionTitle": "Fail2Ban — inštalácia a správa",
+    "optionDescription": "Tri predkonfigurované jaily (agresívny režim sshd, rozhranie Proxmox na 8006, ProxMenux Monitor na 8008 a reverzný proxy), detekcia nftables/iptables, oprava journald a posilnenie SSH pomocou MaxAuthTries."
+  },
+  "lynisSection": {
+    "heading": "Lynis",
+    "body": "ProxMenux klonuje Lynis z <code>github.com/CISOfy/lynis</code> do <code>/opt/lynis</code> a sprístupní ho ako <code>/usr/local/bin/lynis</code>. Balík Debian zámerne nepoužíva, pretože za pôvodným projektom zaostáva o viacero hlavných verzií. Podrobná stránka opisuje inštaláciu, audit, aktualizáciu, odinštalovanie, čítanie správy a riešenie zistení.",
+    "optionTitle": "Lynis — inštalácia, audit a správa",
+    "optionDescription": "Nainštaluje najnovší Lynis z oficiálneho repozitára CISOfy na GitHube (namiesto staršieho balíka Debian), vykonáva audity systému so skóre zabezpečenia a aktualizuje cez git pull."
+  },
+  "componentStatus": {
+    "heading": "Stav komponentu",
+    "body": "Obaja inštalátori registrujú svoj stav v <code>/usr/local/share/proxmenux/components_status.json</code> v kategórii <code>security</code>. ProxMenux používa tento súbor na rozhodnutie, či zobraziť inštaláciu alebo menu správy pri následných spusteniach, a rovnaké dáta napája palubnú dosku v ProxMenux Monitor keď je prítomný."
+  }
+}
diff --git a/web/messages/sk/docs/security/lynis.json b/web/messages/sk/docs/security/lynis.json
new file mode 100644
index 00000000..41bd07bc
--- /dev/null
+++ b/web/messages/sk/docs/security/lynis.json
@@ -0,0 +1,170 @@
+{
+  "meta": {
+    "title": "Lynis | Dokumentácia ProxMenux",
+    "description": "Nainštalujte najnovší Lynis z oficiálneho repozitára CISOfy na GitHube, vykonajte audit so skóre zabezpečenia 0–100 a aktualizujte cez git pull. Audítor iba na čítanie: nemení systém.",
+    "ogTitle": "Lynis | Dokumentácia ProxMenux",
+    "ogDescription": "Nainštalujte a spustite bezpečnostný audítor Lynis na Proxmox VE. Inštalácia z pôvodného repozitára GitHub, audit a aktualizácia."
+  },
+  "header": {
+    "title": "Lynis",
+    "description": "Klonuje najnovší Lynis z oficiálneho repozitára CISOfy na GitHube, sprístupní ho ako /usr/local/bin/lynis a v menu ponúka audit, aktualizáciu, preinštalovanie a odinštalovanie. Audítor iba číta a vytvára správy bez zmeny systému.",
+    "section": "Zabezpečenie"
+  },
+  "intro": {
+    "title": "Čo to robí?",
+    "body": "Nainštaluje Lynis, bezpečnostný audítor s otvoreným zdrojovým kódom od CISOfy, z jeho repozitára GitHub do <code>/opt/lynis</code> a vytvorí spúšťací skript <code>/usr/local/bin/lynis</code>, aby bol dostupný cez <code>PATH</code>. Ak rozpozná existujúcu inštaláciu, zobrazí menu auditu, aktualizácie, preinštalovania alebo odstránenia."
+  },
+  "manageMenu": {
+    "heading": "Menu správy (po inštalácii)",
+    "intro": "Keď je Lynis nainštalovaný, každé následné vyvolanie otvorí menu správy namiesto opätovného spustenia inštalátora. Odtiaľ spustíte audit, aktualizáciu prostredníctvom git pull, preinštalovať alebo odinštalovať:",
+    "imageAlt": "Lynis management menu s auditom, aktualizácia, preinštalovať a odstrániť možnosti"
+  },
+  "whyUpstream": {
+    "heading": "Prečo pôvodný repozitár GitHub namiesto apt",
+    "intro": "Debian poskytuje Lynis cez apt, ale balík zvyčajne zaostáva o viacero hlavných verzií. Nové kontroly, opravy nových vektorov útoku a vylepšené odporúčania prichádzajú najprv na GitHub. Lynis je samostatný shellový skript bez kompilácie a inštalačných závislostí okrem <code>git</code>; klonovanie repozitára je preto metóda odporúčaná CISOfy.",
+    "headerSource": "Zdroj",
+    "headerPath": "Install path",
+    "headerUpdate": "Spôsob aktualizácie",
+    "headerFresh": "Aktuálnosť verzie",
+    "rows": [
+      {
+        "sourceRich": "<strong>ProxMenux (tento skript)</strong>",
+        "path": "/opt/lynis/",
+        "update": "git pull (v menu)",
+        "fresh": "Najnovšia verzia pôvodného projektu"
+      },
+      {
+        "sourceRich": "<strong>Debian apt</strong>",
+        "path": "/usr/bin/lynis",
+        "update": "apt upgrade",
+        "fresh": "Často mesiace / roky pozadu"
+      }
+    ]
+  },
+  "install": {
+    "heading": "Ako funguje inštalácia",
+    "node1Label": "github.com/CISOfy/lynis",
+    "node1Detail": "git clone\n(najprv nainštaluje git, ak chýba)",
+    "node2Label": "/opt/lynis/",
+    "node2Detail": "celý repozitár\nvrátane skriptu ./lynis",
+    "node3Label": "/usr/local/bin/lynis",
+    "node3Detail": "obal:\ncd /opt/lynis && ./lynis $@",
+    "outro": "Balíčk je povinný – Lynis trvá na tom, aby bol spustený z vlastného adresára, pretože načítava relatívne cesty pre zásuvné moduly a údaje profilu. Obal tento detail skrýva, takže <code>lynis audit system</code> jednoducho funguje odkiaľkoľvek."
+  },
+  "detection": {
+    "heading": "Zisťovacie cesty",
+    "intro": "Pred zobrazením menu skript kontroluje tri miesta, aby rozhodol, či je Lynis už prítomný:",
+    "items": [
+      "<code>/usr/local/bin/lynis</code> Wrapper nainštalovaný ProxMenux",
+      "<code>/opt/lynis/lynis</code> — priama cesta, ak bol spúšťací skript odstránený",
+      "<code>/usr/bin/lynis</code> — verzia nainštalovaná cez apt, ak ju používateľ nainštaloval týmto spôsobom"
+    ],
+    "outro": "Ak sa nájde niektorá z ciest, otvorí sa menu správy. Skript <strong>neodinštaluje</strong> Lynis nainštalovaný cez apt; odstráni iba vlastnú inštaláciu v <code>/opt/lynis</code> a jej spúšťací skript."
+  },
+  "audit": {
+    "heading": "Spustiť audit",
+    "intro": "V menu správy vyberte <strong>Spustiť bezpečnostný audit teraz</strong>. Zodpovedá to spusteniu:",
+    "code": "lynis audit system --no-colors",
+    "outro": "Audit trvá od 30 sekúnd do niekoľkých minút podľa veľkosti hostiteľa. Výstup ide priamo do terminálu bez animácie čakania. Lynis člení kontroly podľa kategórií a každý test označí ako <ok>[ OK ]</ok>, <warn>[ WARNING ]</warn> alebo <sugg>[ SUGGESTION ]</sugg>. Záverečné zhrnutie ukazuje hlavné údaje:",
+    "summary": "================================================================================\n\n  Lynis security scan details:\n\n  Hardening index : 76 [############        ]\n  Tests performed : 247\n  Plugins enabled : 0\n\n  Components:\n  - Firewall               [V]\n  - Malware scanner        [X]\n\n  Lynis modules:\n  - Compliance status      [?]\n  - Security audit         [V]\n  - Vulnerability scan     [V]\n\n================================================================================"
+  },
+  "report": {
+    "heading": "Čítanie správy",
+    "intro": "Dve dôležité časti sú <strong>Upozornenia</strong> (veci, ktoré by ste mali čoskoro opraviť) a <strong>Návrhy</strong> (odporúčania na zlepšenie vytvrdzovania). Každá položka nesie kontrolné ID ako <code>SSH-7408</code> – užitočné pri hľadaní zdôvodnenia a opravy v dokumentoch Lynis.",
+    "headerMarker": "Značka",
+    "headerMeaning": "Význam",
+    "headerAction": "Akcia",
+    "rows": [
+      {
+        "markerRich": "<strong>OK</strong>",
+        "meaning": "Skúška prešla",
+        "action": "Nič."
+      },
+      {
+        "markerRich": "<strong>WARNING</strong>",
+        "meaning": "Skutočný problém; odporúčaná oprava",
+        "action": "Prečítajte si kontrolný popis, naplánujte opravu"
+      },
+      {
+        "markerRich": "<strong>SUGGESTION</strong>",
+        "meaning": "Možné zlepšenie zabezpečenia",
+        "action": "Aplikujte, ak vyhovuje vášmu modelu hrozby"
+      }
+    ],
+    "outro": "Kompletná správa a strojovo čitateľné údaje sú napísané <code>/var/log/lynis.log</code> a <code>/var/log/lynis-report.dat</code> samotným Lynisom."
+  },
+  "pairFail2ban": {
+    "title": "Používajte spolu s Fail2Ban",
+    "body": "SSH-7408 (MaxAuthTries) je jedným z najčastejších varovaní. Inštalácia <link>Fail2Ban</link> od ProxMenux automaticky ho vymaže, pretože inštalátor nastaví <code>MaxAuthTries=3</code> ako súčasť SSH tvrdnúci krok. Spustite znova Lynis potom potvrdiť, že varovanie je preč."
+  },
+  "update": {
+    "heading": "Aktualizácia Lynis",
+    "body": "V menu možnosť <strong>Aktualizovať Lynis na najnovšiu verziu</strong> spustí <code>git pull --quiet</code> v <code>/opt/lynis</code>. Ak adresár existuje, ale nie je pracovnou kópiou Git, napríklad po ručnom kopírovaní súborov, skript vykoná úplnú preinštaláciu."
+  },
+  "reinstall": {
+    "heading": "Preinštalovať/odinštalovať",
+    "headerAction": "Akcia",
+    "headerWhat": "Čo to robí?",
+    "rows": [
+      {
+        "actionRich": "<strong>Preinštalovať</strong>",
+        "whatRich": "Odstráni <code>/opt/lynis</code>, znova klonuje z GitHubu a vytvorí spúšťací skript. Použite pri poškodenej miestnej pracovnej kópii."
+      },
+      {
+        "actionRich": "<strong>Odstrániť</strong>",
+        "whatRich": "Odstráni <code>/opt/lynis</code> a <code>/usr/local/bin/lynis</code>. Záznamy na <code>/var/log/lynis*</code> sú vedené (sú audit histórie). Apt-inštalovaný Lynis na <code>/usr/bin/lynis</code> zostáva nedotknutý."
+      }
+    ]
+  },
+  "cli": {
+    "heading": "Užitočné možnosti CLI",
+    "intro": "Po nainštalovaní sa Lynis môže použiť priamo z shellu s extra možnosťami, ktoré nie sú vystavené menu:",
+    "code": "lynis show version            # version + build date\nlynis show commands           # list every available command\nlynis show details TEST-ID    # explain a specific control\nlynis audit system --quick    # skip slow tests (e.g. malware scan)\nlynis audit system --pentest  # treat host as untrusted (more aggressive)\nlynis update info             # check if a newer Lynis is available\n\n# Filter the report log for just the warnings\ngrep \"Warning\" /var/log/lynis.log\n\n# Same, for suggestions only\ngrep \"Suggestion\" /var/log/lynis.log"
+  },
+  "troubleshoot": {
+    "heading": "Riešenie problémov",
+    "cloneTitle": "git clone počas inštalácie zlyhá",
+    "cloneBody": "Hostiteľ potrebuje prístup k sieti a DNS dosiahnuť <code>github.com</code>. Z konzoly: <code>curl -sI https://github.com</code> a <code>git ls-remote https://github.com/CISOfy/lynis.git</code> odhalí skutočnú chybu (DNS, TLS, proxy, repo URL). Ak sa vyžaduje proxy, nastavte <code>https_proxy</code> v prostredí pred opätovným spustením menu.",
+    "notFoundTitle": "lynis: príkaz nenájdený po inštalácii",
+    "notFoundIntro": "Obal na <code>/usr/local/bin/lynis</code> buď nebol vytvorený, alebo bol odstránený. Najrýchlejšia oprava: preinštalovať z menu. Ručné nastavenie:",
+    "notFoundCode": "cat > /usr/local/bin/lynis <<'EOF'\n#!/bin/bash\ncd /opt/lynis && ./lynis \"$@\"\nEOF\nchmod +x /usr/local/bin/lynis",
+    "sshTitle": "Audit zobrazuje \"Warning: Test SSH-7408 — MaxAuthTries set incorrectly\"",
+    "sshIntro": "Démon SSH umožňuje príliš veľa auth pokusov na pripojenie. Buď nainštalujte <link>Fail2Ban</link> z ProxMenux (ktorý nastaví <code>MaxAuthTries=3</code>), alebo editujte <code>/etc/ssh/sshd_config</code> ručne:",
+    "sshCode": "sed -i 's/^#?MaxAuthTries.*/MaxAuthTries 3/' /etc/ssh/sshd_config\nsystemctl reload sshd",
+    "scoreTitle": "Skóre klesol po upgrade Proxmox",
+    "scoreBody": "Najprv spustite <code>lynis update info</code>; aktualizácia Lynis mohla pridať kontroly, ktoré upozorňujú na existujúcu konfiguráciu. Aktualizujte Lynis z menu, zopakujte audit a riešte nové zistenia."
+  },
+  "files": {
+    "heading": "Súbory napísané",
+    "code": "/opt/lynis/                   # full Lynis git checkout\n/usr/local/bin/lynis          # wrapper script (cd + exec)\n/var/log/lynis.log            # human-readable audit log (Lynis itself)\n/var/log/lynis-report.dat     # machine-readable report (Lynis itself)"
+  },
+  "sample": {
+    "heading": "Ukážková správa",
+    "intro": "ProxMenux Monitor vytvorí pre každé spustenie Lynis viacstranové PDF dostupné na <link>karte Zabezpečenie</link>. Prvá strana obsahuje skóre zabezpečenia, údaje o systéme a prehľad bezpečnostného stavu. Ďalšie strany vysvetľujú každé upozornenie, zoradia návrhy podľa vplyvu a uvedú inventár balíkov použitý pri audite.",
+    "imageAlt": "Prvá strana PDF bezpečnostného auditu Lynis: zhrnutie so skóre zabezpečenia 71/100, systémovými informáciami a prehľadom firewallu, skenera škodlivého softvéru a počtu nainštalovaných balíkov",
+    "captionPrefix": "Prvá strana ukážkovej správy. Úplné PDF (",
+    "captionLink": "vzorka",
+    "captionSuffix": ") pokračuje podrobnými upozorneniami, návrhmi a zoznamom nainštalovaných balíkov.",
+    "cli": "Rovnaké údaje sú v CLI v súbore <code>/var/log/lynis-report.dat</code> (strojovo čitateľný textový súbor) a <code>/var/log/lynis.log</code> (čitateľný denník spustenia). PDF vytvára na požiadanie ProxMenux Monitor; spustenie <code>lynis</code> z príkazového riadka PDF nevytvorí."
+  },
+  "related": {
+    "heading": "Súvisiace",
+    "items": [
+      {
+        "href": "/docs/monitor/dashboard/security",
+        "label": "ProxMenux Monitor → Bezpečnostná karta",
+        "tail": "— spustite audit, prezerajte historické správy a stiahnite si PDF priamo z hlavného panela."
+      },
+      {
+        "href": "/docs/security/fail2ban",
+        "label": "Fail2Ban",
+        "tailRich": " — zavádza ochranu SSH pred hrubou silou, ktorú odporúča Lynis."
+      },
+      {
+        "href": "/docs/security",
+        "label": "Prehľad bezpečnosti",
+        "tail": " — Späť na prehľad sekcie."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sk/docs/security/ssl-letsencrypt.json b/web/messages/sk/docs/security/ssl-letsencrypt.json
new file mode 100644
index 00000000..418a3d3a
--- /dev/null
+++ b/web/messages/sk/docs/security/ssl-letsencrypt.json
@@ -0,0 +1,169 @@
+{
+  "meta": {
+    "title": "HTTPS pre ProxMenux Monitor — certifikát hostiteľa Proxmox alebo vlastné cesty | ProxMenux",
+    "description": "Sprístupnite ProxMenux Monitor cez HTTPS s automaticky rozpoznaným certifikátom hostiteľa Proxmox vrátane Let’s Encrypt nainštalovaného cez ACME Proxmox, alebo s vlastným certifikátom na ľubovoľnej ceste na disku.",
+    "ogTitle": "HTTPS pre ProxMenux Monitor — certifikát hostiteľa Proxmox alebo vlastný certifikát",
+    "ogDescription": "Povoľte HTTPS na porte 8008 s certifikátom hostiteľa Proxmox alebo vlastnou dvojicou .pem / .key."
+  },
+  "header": {
+    "title": "HTTPS pre ProxMenux Monitor",
+    "description": "Zapnite HTTPS pre Monitor na porte 8008 s automaticky rozpoznaným certifikátom hostiteľa Proxmox alebo vlastným certifikátom na disku. Možnosť Proxmox uprednostní certifikát ACME, ak existuje, a znovu použije Let’s Encrypt spravovaný Proxmoxom bez ďalšej úlohy obnovy.",
+    "section": "Zabezpečenie"
+  },
+  "intro": {
+    "title": "Čo táto stránka obsahuje",
+    "body": "Ako prepnúť Monitor z HTTP na HTTPS v paneli Nastavenia → Zabezpečenie, na aké súbory ukazujú zdroje certifikátov, ako sa správa možnosť Proxmox s certifikátom Let’s Encrypt a ako nastaviť vlastné cesty pri správe certifikátov mimo Proxmox."
+  },
+  "wheresetting": {
+    "heading": "Kde nájdete nastavenie",
+    "body": "Otvorte Monitor a prejdite na <strong>Nastavenia → Zabezpečenie → HTTPS / SSL</strong>. Panel zobrazuje HTTP alebo HTTPS a pri vypnutom HTTPS rozpoznané zdroje certifikátov.",
+    "imageAlt": "Nastavenia → Zabezpečenie → HTTPS / panel SSL na monitore zobrazujúci vypnutý stav HTTPS, automaticky zistený certifikát Proxmox (predmet, vydavateľ, expirácia) a možnosť Použiť vlastný certifikát",
+    "caption": "Panel Nastavenia → Zabezpečenie → HTTPS / SSL pred aktiváciou. Monitor zobrazí certifikát používaný Proxmoxom a umožní ho vybrať jedným kliknutím."
+  },
+  "twoways": {
+    "heading": "Dva spôsoby, ako umožniť HTTPS",
+    "proxmox": {
+      "title": "Použiť Proxmox certifikát",
+      "summary": "Jedno kliknutie: Monitor použije certifikát, ktorý Proxmox VE poskytuje na porte 8006.",
+      "items": [
+        "Automaticky rozpoznané, bez zadávania ciest",
+        "Uprednostní certifikát ACME, ak existuje; inak použije predvolený certifikát s vlastným podpisom",
+        "Proxmox spravuje obnovu; Monitor overí a načíta certifikát pri nasledujúcom novom spojení TLS"
+      ]
+    },
+    "custom": {
+      "title": "Použiť vlastný certifikát",
+      "summaryRich": "Nastavte Monitor tak, aby používal dvojicu <code>.pem</code> / <code>.key</code> uloženú kdekoľvek na disku.",
+      "items": [
+        "Iba absolútne cesty (proces monitora musí byť schopný čítať oboje)",
+        "Užitočné pre certifikáty z <code>certbot</code>, <code>acme.sh</code> alebo wildcard certifikáty",
+        "Obnovu spravujete vy: po zmene súborov reštartujte Monitor"
+      ]
+    }
+  },
+  "proxmoxCert": {
+    "heading": "Certifikát Proxmox — na čo skutočne ukazuje",
+    "intro": "Proxmox VE uchováva dva páry certifikátov v <code>/etc/pve/local/</code>:",
+    "table": {
+      "headers": {
+        "file": "Súbor",
+        "origin": "Pôvod",
+        "when": "Keď ho Monitor používa"
+      },
+      "rows": [
+        {
+          "fileRich": "<code>pveproxy-ssl.pem</code><br /><code>pveproxy-ssl.key</code>",
+          "originRich": "Vlastný certifikát nahraný cez rozhranie Proxmox vrátane certifikátu Let’s Encrypt vydaného cez <em>Datacenter → Node → Certificates → ACME</em>.",
+          "when": "Uprednostní sa, ak existujú oba súbory; Monitor použije certifikát poskytovaný Proxmoxom."
+        },
+        {
+          "fileRich": "<code>pve-ssl.pem</code><br /><code>pve-ssl.key</code>",
+          "originRich": "Samopodpísaný certifikát vytvorený v čase inštalácie spoločnosťou Proxmox PKI.",
+          "whenRich": "Náhradný certifikát, ak <code>pveproxy-ssl.pem</code> neexistuje."
+        }
+      ]
+    },
+    "callout": {
+      "title": "Rovnaká priorita ako samotný Proxmox",
+      "bodyRich": "<code>pveproxy</code> používa rovnaké pravidlo výberu. Pri možnosti Proxmox Monitor použije certifikát webového rozhrania Proxmox na porte 8006 bez kopírovania a samostatného procesu obnovy."
+    }
+  },
+  "letsencrypt": {
+    "heading": "Získanie certifikátu Let's Encrypt cez Proxmox ACME",
+    "intro": "Proxmox VE obsahuje vlastného klienta ACME. <em>„Order Certificate Now“</em> uloží výsledok do <code>/etc/pve/local/pveproxy-ssl.pem</code>, ktorý Monitor číta. Nasledujúcich päť krokov zhŕňa <extlink1>oficiálnu príručku Proxmox</extlink1> do potrebných príkazov.",
+    "prereqs": {
+      "title": "Predpoklady",
+      "items": [
+        "Uzol má skutočný názov DNS (nielen IP) ukazuje na to.",
+        "<strong>Buď</strong> port 80 dostupný z internetu (overenie HTTP-01, najjednoduchšie), <strong>alebo</strong> poskytovateľ DNS s prihlasovacími údajmi API (DNS-01, funguje za NAT a podporuje wildcard certifikáty).",
+        "E-mailová adresa pre účet ACME."
+      ]
+    },
+    "step1": {
+      "heading": "Krok 1 — Zaregistrujte účet ACME",
+      "introRich": "Nahraďte e-mail vlastnou adresou. Názov účtu <code>default</code> je iba označenie; môžete použiť ľubovoľný reťazec.",
+      "code": "pvenode acme account register default you@example.com",
+      "afterRich": "Proxmox vyžiada súhlas s podmienkami služby Let’s Encrypt. Potom uloží účet do <code>/etc/pve/priv/acme/</code> a zobrazí ho na karte ACME v grafickom rozhraní."
+    },
+    "step2": {
+      "heading": "Krok 2 — Vyberte typ overenia",
+      "http01Rich": "<strong>HTTP-01</strong> je najjednoduchší: je zabudovaný, bez ďalšieho pluginu. Let's Encrypt sa pripája k <code>http://&lt;your-host&gt;/.well-known/acme-challenge/...</code> na porte 80, takže port 80 musí byť otvorený z verejného internetu do vášho uzla – zvyčajne port forward na vašom smerovači.",
+      "dns01Rich": "<strong>DNS-01</strong> funguje bez sprístupnenia portu 80, takže je vhodné pre domáce laby za CG-NAT, a je jedinou možnosťou pre wildcard certifikáty. Jednorazovo pridajte DNS doplnok s tokenom API poskytovateľa. Príklad pre Cloudflare:",
+      "code": "pvenode acme plugin add dns cf \\\n  --api cloudflare \\\n  --data CF_Token=YOUR_CLOUDFLARE_API_TOKEN",
+      "outroRich": "Pre iných poskytovateľov (Gandi, OVH, AWS Route 53 atď.) použite <code>pvenode acme plugin add dns --help</code>. Proxmox obsahuje <extlink2>všetky DNS doplnky acme.sh</extlink2>."
+    },
+    "step3": {
+      "heading": "Krok 3 — Priraďte doménu k uzlu",
+      "http01Rich": "Pre HTTP-01 (používa vstavaný <code>standalone</code> modul):",
+      "code1": "pvenode config set --acme domains=host.example.com,account=default",
+      "dns01": "Pre DNS-01 s plugin Cloudflare zo Step 2:",
+      "code2": "pvenode config set --acmedomain0 domain=host.example.com,plugin=cf\npvenode config set --acme account=default",
+      "wildcardRich": "Wildcard? Pridať <code>domain=*.example.com</code> na samostatnú položku <code>--acmedomainN</code>. Wildcards vyžadujú DNS-01."
+    },
+    "step4": {
+      "heading": "Krok 4 — Vyžiadajte certifikát",
+      "code": "pvenode acme cert order",
+      "afterRich": "Prvý beh zvyčajne trvá 30–60 sekundy, kým sa výzva šíri. O úspechu Proxmox píše <code>/etc/pve/local/pveproxy-ssl.pem</code> + <code>.key</code>, reštartuje <code>pveproxy</code>, a obnovenie cron je naplánované automaticky (Let's Encrypt Certs sú platné 90 dní; Proxmox obnovuje pri 60)."
+    },
+    "step5": {
+      "heading": "Krok 5 — Overte vydavateľa",
+      "code": "openssl x509 -in /etc/pve/local/pveproxy-ssl.pem -noout -issuer",
+      "afterRich": "Výstup má obsahovať vydavateľa začínajúceho <code>O = Let's Encrypt</code>. Ak uvádza <code>CN = Proxmox Virtual Environment</code>, požiadavka zlyhala a súbor je stále certifikát PVE s vlastným podpisom. Príčinu zistíte opätovným spustením <code>pvenode acme cert order --debug 1</code>."
+    },
+    "gui": {
+      "title": "Preferujete GUI? Rovnakých päť krokov",
+      "bodyRich": "<em>Datacenter → ACME</em> zaregistruje účet; <em>Datacenter → ACME → Plugins</em> pridá DNS doplnok; <em>Node → Certificates → ACME</em> priradí doménu; <em>Order Certificates Now</em> vykoná krok 4. Uvedené príkazy CLI sú vhodné na skriptovanie a systémy bez grafického rozhrania."
+    }
+  },
+  "switchToHttps": {
+    "heading": "Prepnúť monitor na HTTPS",
+    "bodyRich": "Keď je <code>/etc/pve/local/pveproxy-ssl.pem</code> podpísaný Let's Encrypt, otvorte <strong>Nastavenia → Zabezpečenie → HTTPS / SSL</strong>, overte vydavateľa <em>Let's Encrypt</em> namiesto miestnej CA Proxmox a kliknite na <strong>Použiť certifikát Proxmox</strong>. Monitor sa reštartuje a ďalšie načítanie použije HTTPS na 8008 s verejne dôveryhodným reťazcom. Ďalšie obnovy ACME sa overia a vyberú pri nasledujúcom novom spojení TLS bez pravidelného dopytovania alebo reštartu služby pri obnove. <strong>Aktualizovať certifikát</strong> zostáva v Zabezpečení dostupné na diagnostiku a obnovu."
+  },
+  "custom": {
+    "heading": "Vlastný certifikát — kedy ho použiť",
+    "intro": "Kliknite na <strong>Použiť vlastný certifikát</strong> a zadajte dve absolútne cesty:",
+    "items": [
+      "<strong>Osvedčenie</strong> Celý reťazec v PEM (<code>.pem</code> alebo <code>.crt</code>).",
+      "<strong>Súkromný kľúč</strong>: zodpovedajúci kľúč vo formáte PEM (<code>.key</code>)."
+    ],
+    "outro": "Oba súbory načíta proces Monitora pri štarte. Musia zostať čitateľné pre používateľa, pod ktorým beží jednotka systemd (predvolene root). Bežné umiestnenia pri správe ACME mimo Proxmox:",
+    "code": "# certbot\n/etc/letsencrypt/live/<your-host>/fullchain.pem\n/etc/letsencrypt/live/<your-host>/privkey.pem\n\n# acme.sh\n~/.acme.sh/<your-host>_ecc/fullchain.cer\n~/.acme.sh/<your-host>_ecc/<your-host>.key",
+    "symlinkCallout": {
+      "title": "Symlink ciele vs. súbory",
+      "bodyRich": "<code>certbot</code> ukladá skutočné súbory do <code>/etc/letsencrypt/archive/</code> a cesta <code>live/</code> je symbolický odkaz. Nasmerujte monitor na symbolický odkaz <code>live/</code>, nie na súbor <code>archive/</code> – takto každý cyklus obnovy jednoducho prepíše cieľ symbolického odkazu a monitor si pri ďalšom spustení služby vyberie nový certifikát."
+    }
+  },
+  "afterHttps": {
+    "heading": "Po umožnení HTTPS",
+    "bodyRich": "Uloženie zmeny zapíše <code>/etc/proxmenux/ssl_config.json</code> a reštartuje jednotku systemd <code>proxmenux-monitor</code>. Karta prehliadača stratí spojenie; načítajte ju znova na <code>https://&lt;host&gt;:8008/</code>. Certifikát Let’s Encrypt by nemal vyvolať upozornenie; pri certifikáte Proxmox s vlastným podpisom bude prehliadač vyžadovať výnimku, rovnako ako na porte 8006.",
+    "reverse": {
+      "heading": "Reverzné proxy a webhooky",
+      "bodyRich": "Pri prepnutí Monitora na HTTPS sa adresy webhookov Proxmox VE pre oznámenia automaticky zmenia z <code>http://</code> na <code>https://</code>. Existujúce záznamy sa prepíšu pri ďalšom uložení alebo opätovnom rozpoznaní pravidla oznámení; ručná úprava konfigurácie oznámení Proxmox nie je potrebná."
+    }
+  },
+  "trustCa": {
+    "heading": "Dôverujte samopodpísanej CA spoločnosti Proxmox",
+    "intro1Rich": "Ak chcete zachovať predvolený certifikát Proxmox bez ACME, importujte koreňovú CA klastra do úložiska dôveryhodných certifikátov systému alebo prehliadača. Monitor rozpozná <code>/etc/pve/local/pve-ssl.pem</code> ako náhradný certifikát. Klient tak dôveruje vydavateľovi; URL musí stále zodpovedať názvu v certifikáte.",
+    "intro2Rich": "CA súbor žije v <code>/etc/pve/pve-root-ca.pem</code> na každom uzle. V klastri cesta je na zdieľanom <code>pmxcfs</code> súborovom systéme, takže všetky uzly zdieľajú rovnaký koreň a jeden import pokrýva celý dátový stred. Skopírujte ho do svojho stroja:",
+    "code": "scp root@<your-host>:/etc/pve/pve-root-ca.pem ./pve-root-ca.pem",
+    "thenImport": "Potom ho importovať na strane klienta:",
+    "items": [
+      "<strong>Linux (celý systém):</strong> spustite <code>sudo cp pve-root-ca.pem /usr/local/share/ca-certificates/pve-root-ca.crt</code> a potom <code>sudo update-ca-certificates</code>. Prehliadače používajúce systémové úložisko certifikátov (Chromium, Edge) rozpoznajú CA po reštarte; Firefox má vlastné úložisko a potrebuje ručný import uvedený nižšie.",
+      "<strong>macOS:</strong> dvojklikom otvorte súbor <code>.pem</code> v Keychain Access, pridajte ho do kľúčenky <em>System</em> a nastavte <em>Trust → Always Trust</em>.",
+      "<strong>Windows:</strong> kliknite pravým tlačidlom na súbor → <em>Inštalovať certifikát</em> → uložte ho do <em>Dôveryhodné koreňové certifikačné autority</em>.",
+      "<strong>Firefox (ľubovoľný OS):</strong> <em>Nastavenia → Súkromie a bezpečnosť → Certifikáty → Zobraziť certifikáty → Autority → Importovať</em>; vyberte <em>Dôverovať tejto CA pri identifikácii webových stránok</em>."
+    ],
+    "standalone": {
+      "title": "Samostatné uzly mimo klastra",
+      "bodyRich": "Každý non-clustered Proxmox hostiteľ má svoje vlastné <code>pve-root-ca.pem</code>. Ak spravujete niekoľko samostatných hostiteľov, opakujte kópiu/dovoz pre každého, alebo sa pripojte k klastru, takže zdieľajú jeden koreň."
+    }
+  },
+  "disable": {
+    "heading": "Zastavenie HTTPS",
+    "bodyRich": "Kliknite na <strong>Vypnúť HTTPS</strong> v rovnakom paneli. Monitor sa reštartuje s nešifrovaným HTTP, čo pomôže pri nečitateľnom vlastnom certifikáte brániacom štartu služby. Samostatné odinštalovanie nie je potrebné a súbory certifikátov sa nemenia.",
+    "stateCallout": {
+      "title": "Kde sa ukladá stav",
+      "bodyRich": "<code>/etc/proxmenux/ssl_config.json</code> ukladá aktívne cesty k certifikátom a zdroj (<code>none</code>, <code>proxmox</code>, <code>custom</code>). Odstránenie súboru zodpovedá vypnutiu HTTPS; pri ďalšom štarte Monitor použije HTTP."
+    }
+  }
+}
diff --git a/web/messages/sk/docs/settings/beta-program.json b/web/messages/sk/docs/settings/beta-program.json
new file mode 100644
index 00000000..15f322d7
--- /dev/null
+++ b/web/messages/sk/docs/settings/beta-program.json
@@ -0,0 +1,113 @@
+{
+  "meta": {
+    "title": "Zmeniť kanál vydaní | Dokumentácia ProxMenux",
+    "description": "Prepínajte medzi kanálmi Stable (main) a Beta (develop) v jednom dialógu. Obojsmerné a idempotentné; spustí oficiálny inštalátor zvoleného kanála a normalizuje službu Monitor.",
+    "ogTitle": "Zmeniť kanál vydaní | Dokumentácia ProxMenux",
+    "ogDescription": "Jedna možnosť v Nastaveniach na prepínanie medzi Stable a Beta bez ručného spúšťania inštalátorov."
+  },
+  "header": {
+    "title": "Zmeniť kanál vydaní",
+    "description": "Jedna spoločná možnosť Nastavení prepína ProxMenux medzi Stable (vetva main) a Beta (vetva develop). Pôvodnú jednosmernú možnosť „Deaktivovať beta program“ nahrádza obojsmerný dialóg, ktorý ponúka oba smery a spúšťa oficiálny inštalátor zvoleného kanála.",
+    "section": "Nastavenia"
+  },
+  "intro": {
+    "title": "Čo sa zmenilo?",
+    "body": "Staršie verzie mali dva postupy: „Deaktivovať beta program“, viditeľný iba pri aktívnej bete, a opätovné ručné spustenie beta inštalátora na návrat. Teraz ich spája vždy dostupná možnosť <strong>Zmeniť kanál vydaní</strong>, ktorá zobrazuje aktuálny kanál a umožňuje prechod medzi Stable a Beta v oboch smeroch."
+  },
+  "why": {
+    "heading": "Prečo táto možnosť existuje",
+    "intro": "ProxMenux sa distribuuje z dvoch vetiev Git:",
+    "items": [
+      "<strong>Stable</strong>: vetva <code>main</code>, na ktorú odkazuje README a ktorú uprednostňuje väčšina správcov. Vydania vychádzajú menej často a obsahujú iba zmeny, ktoré už prešli beta overením.",
+      "<strong>Beta</strong>: vetva <code>develop</code>. Novšie funkcie a zostavy Monitora so značkou, ktorú zdedí nasledujúce stabilné vydanie. Niektoré veci nemusia fungovať bezchybne; výberom tohto kanála sa zúčastňujete testovania pred vydaním."
+    ],
+    "outro": "Predtým bolo potrebné poznať správnu URL inštalátora, skopírovať ju z README a pri nesúlade ručne upraviť <code>config.json</code>. Jednotná možnosť vykoná celý postup ako jednu vedenú akciu."
+  },
+  "dialog": {
+    "heading": "Dialóg",
+    "intro": "V hlavnom menu: <strong>Nastavenia → Zmeniť kanál vydaní</strong>. Zobrazí sa dvojriadkové menu:",
+    "options": [
+      "<code>stable</code> — Stable (vetva main)",
+      "<code>beta</code> — Beta (vetva develop)"
+    ],
+    "behaviour": "Aktuálny kanál je predvolený a zobrazený hore. Výber rovnakého kanála zobrazí správu „Tento kanál vydaní je už aktívny“; dialóg je idempotentný. Výber iného kanála otvorí potvrdenie s textom pre daný kanál:",
+    "directions": [
+      "<strong>Stable → Beta:</strong> upozorňuje, že beta zostavy môžu obsahovať chyby alebo neúplné funkcie.",
+      "<strong>Beta → Stable:</strong> upozorňuje, že kontroly beta aktualizácií sa zastavia a stabilný inštalátor znova nainštaluje komponenty kanála Stable."
+    ]
+  },
+  "confirm": {
+    "heading": "Čo sa stane, keď potvrdíte",
+    "items": [
+      "<strong>Stiahne oficiálny inštalátor</strong> cieľového kanála:<ul><li>Stable: <code>install_proxmenux.sh</code> z <code>main</code></li><li>Beta: <code>install_proxmenux_beta.sh</code> z <code>develop</code></li></ul>Pred ďalším krokom overí prítomnosť stiahnutého súboru a nastaví ho ako spustiteľný.",
+      "<strong>Spustí celý inštalátor</strong>, ten istý, na ktorý odkazuje README. Detekcia komponentov, zálohy súborov, inštalácia závislostí a zachovanie jazyka sa riadia oficiálnym postupom inštalácie cieľového kanála.",
+      "Pri prepnutí na <strong>Stable</strong>, menu potom scvrkne akékoľvek zvyšné beta metaúdaje z <code>config.json</code>: <code>beta_program</code>, <code>beta_version</code>, <code>install_branch</code>, <code>update_available.beta*</code> sa odstránia a <code>proxmenux_monitor.status = beta_updated</code> sa normalizuje na <code>updated</code>. Zvyškový súbor <code>beta_version.txt</code> a akýkoľvek stiahnutý beta inštalátor sú odstránené.",
+      "Pri prepnutí na Stable sa súbor jednotky systemd Monitora prepíše podľa stabilnej šablóny: z popisu sa odstráni prípona „Beta“ a <code>ExecStart</code> opäť ukazuje na adresár behu. Nový výpis <code>systemctl status</code> tak zodpovedá aktuálnemu kanálu.",
+      "Znova načíta konfiguračné menu. <em>Zobraziť informácie o verzii</em> zobrazí nový kanál."
+    ]
+  },
+  "switching": {
+    "heading": "Prepínam dopredu a dozadu",
+    "intro": "Obidva smery prechádzajú rovnakým inštalačným programom — <strong>nie sú</strong> špeciálnymi postupmi odinštalovania a preinštalovania. Každý smer jednoducho spúšťa vlastný inštalačný program kanála, ktorý je navrhnutý tak, aby bol idempotentný a bezpečný na opätovné spustenie cez existujúcu inštaláciu. Praktické dôsledky:",
+    "items": [
+      "Existujúca konfigurácia, prihlásenie do ProxMenux Monitor (<code>auth.json</code>), kanály oznámení, register úprav po inštalácii a vlastné prahové hodnoty zostávajú nezmenené. Prepnutie kanála vymení iba strom skriptov a binárny AppImage.",
+      "Monitor, ktorý bol aktívny pred spínačom zostane aktívny po; ten, ktorý bol deaktivovaný, zostane deaktivovaný.",
+      "Súbor <code>auth.json</code>, tokeny API a tajomstvo JWT ProxMenux Monitor sa pri zmene kanála zachovajú. Relácie sa neodhlásia.",
+      "Kanály môžete prepínať ľubovoľne často; dialóg vždy prijme zmenu a znova spustí inštalátor. Reštart Proxmoxu nie je potrebný.",
+      "Prepnutie kanála nahrádza skripty ProxMenux a nemožno ho vykonať v termináli Monitora v prehliadači: PTY by sa počas aktualizácie ukončil a dialóg by uviazol. V tomto termináli sa namiesto toho zobrazí informačné okno s oficiálnym jednoriadkovým príkazom pre zvolený kanál. Spustite ho cez SSH alebo konzolu hostiteľa Proxmox."
+    ]
+  },
+  "feedback": {
+    "heading": "Hlásenie problémov z beta verzie",
+    "intro": "Ak sa niečo správa nečakane, keď ste na kanáli Beta, otvorenie problému s dostatočným kontextom je to, čo uzatvára medzeru k stabilnému uvoľňovaniu. Najužitočnejšia správa obsahuje:",
+    "items": [
+      "Čo si urobil a čo si čakal, že sa stane.",
+      "Všetky chybové správy zobrazené na obrazovke.",
+      "Príslušné protokoly monitora:"
+    ],
+    "logsCommand": "journalctl -u proxmenux-monitor -n 50 --no-pager",
+    "versionLine": "Aktuálna verzia ProxMenux (Nastavenia → <link>Zobraziť informácie o verzii</link>).",
+    "issueLine": "Otvorte <ghlink>GitHub problém</ghlink> s týmito informáciami a rýchlejšie sa dostaneme k oprave."
+  },
+  "manual": {
+    "heading": "Ručný ekvivalent",
+    "intro": "Ak uprednostňujete shell alebo automatizujete prepínanie kanálov, dialóg vykonáva tieto príkazy:"
+  },
+  "unifiedCallout": {
+    "title": "Prečo sú oba smery teraz jednou možnosťou",
+    "body": "Pôvodná možnosť „Deaktivovať beta program“ sa zobrazovala iba po pripojení k bete. Na <em>pripojenie</em> bolo potrebné hľadať URL inštalátora inde; na <em>opustenie</em> bolo niekedy nutné ručne vyčistiť metaúdaje <code>beta_*</code>. Možnosť <strong>Zmeniť kanál vydaní</strong> sa zobrazuje vždy, uvádza aktuálny kanál a oba smery vykonáva ako spustiteľnú, opakovateľnú a idempotentnú operáciu."
+  },
+  "troubleshoot": {
+    "heading": "Riešenie problémov",
+    "downloadTitle": "Nepodarilo sa stiahnuť inštalátor",
+    "downloadBody": "Odchádzajúci HTTPS na <code>raw.githubusercontent.com</code> zlyhal. Skontrolujte pripojenie a DNS z hostiteľa:",
+    "downloadCmd": "curl -fsSL -o /tmp/test https://raw.githubusercontent.com/MacRimi/ProxMenux/main/install_proxmenux.sh && head -1 /tmp/test",
+    "downloadOutro": "Ak toto zlyhá mimo ProxMenux, je to sieťový / proxy problém na hostiteľa.",
+    "errorsTitle": "Installer skončil s chybami",
+    "errorsBody": "Inštalátor vrátil nenulový návratový kód. Automatický návrat zmien neexistuje; niektoré súbory alebo komponenty sa už mohli zmeniť. Pred stlačením Enter si prečítajte výstup inštalátora nad chybou a skontrolujte aktuálny stav; potom to skúste znova z menu alebo spustite inštalátor ručne cez SSH alebo konzolu hostiteľa.",
+    "configTitle": "Nie je možné aktualizovať konfiguračný súbor po prepnutí na Stable",
+    "configBody": "Vyčistenie beta metadát po inštalácii zlyhalo, zvyčajne preto, že <code>config.json</code> má syntax chybu z manuálnej úpravy. Overte ho:",
+    "configCmd": "jq . /usr/local/share/proxmenux/config.json",
+    "configOutro": "Opravte alebo obnovte súbor a znova spustite túto možnosť."
+  },
+  "related": {
+    "heading": "Súvisiace",
+    "items": [
+      {
+        "href": "/docs/settings/show-version-information",
+        "label": "Zobraziť informácie o verzii",
+        "tail": " — Potvrďte, ktorý kanál je teraz aktívny."
+      },
+      {
+        "href": "/docs/settings/proxmenux-monitor",
+        "label": "ProxMenux Monitor",
+        "tail": " — služba Monitor, ktorá sa pri prepnutí znova vytvorí."
+      },
+      {
+        "href": "/docs/settings",
+        "label": "Prehľad nastavení",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sk/docs/settings/change-language.json b/web/messages/sk/docs/settings/change-language.json
new file mode 100644
index 00000000..9e0c6ef0
--- /dev/null
+++ b/web/messages/sk/docs/settings/change-language.json
@@ -0,0 +1,108 @@
+{
+  "meta": {
+    "title": "Zmeniť jazyk | Dokumentácia ProxMenux",
+    "description": "Vyberte si z ôsmich jazykov rozhrania ProxMenux. Každá inštalácia obsahuje vopred vytvorené prekladové katalógy JSON; hostiteľ nepotrebuje prekladovú službu ani prostredie Python. Menu sa automaticky načíta znova.",
+    "ogTitle": "Zmeniť jazyk | Dokumentácia ProxMenux",
+    "ogDescription": "Vyberte jeden z ôsmich jazykov ProxMenux v Nastaveniach. Dostupné pri každej inštalácii."
+  },
+  "header": {
+    "title": "Zmeniť jazyk",
+    "description": "Prepnite rozhranie ProxMenux medzi ôsmimi podporovanými jazykmi. Výber sa uloží do config.json a menu sa reštartuje v novom jazyku. Každá inštalácia obsahuje prekladové katalógy.",
+    "section": "Nastavenia"
+  },
+  "intro": {
+    "title": "Čo to je?",
+    "body": "Dialóg uvádza osem podporovaných jazykov. ProxMenux uloží váš výber do <code>config.json</code> ako <code>.language</code> a reštartuje <code>config_menu.sh</code>, aby sa zmena ihneď prejavila."
+  },
+  "warn": {
+    "title": "Dostupné pri každej inštalácii",
+    "body": "Nastavenia vždy zobrazujú možnosť Zmeniť jazyk. Katalógy sa inštalujú do <code>/usr/local/share/proxmenux/lang/</code> <em>a</em> vybraný jazyk sa ukladá do <code>config.json</code>. Staršie prekladové prostredie Python nie je potrebné."
+  },
+  "supported": {
+    "heading": "Podporované jazyky",
+    "headerCode": "Code",
+    "headerLang": "Jazyk",
+    "headerNotes": "Poznámky",
+    "rows": [
+      {
+        "code": "en",
+        "lang": "Angličtina",
+        "notes": "Zdrojový jazyk — najpresnejší"
+      },
+      {
+        "code": "es",
+        "lang": "Španielčina",
+        "notes": "Vopred vytvorený katalóg JSON"
+      },
+      {
+        "code": "fr",
+        "lang": "Francúzština",
+        "notes": "Vopred vytvorený katalóg JSON"
+      },
+      {
+        "code": "de",
+        "lang": "Nemčina",
+        "notes": "Vopred vytvorený katalóg JSON"
+      },
+      {
+        "code": "it",
+        "lang": "Taliančina",
+        "notes": "Vopred vytvorený katalóg JSON"
+      },
+      {
+        "code": "pt",
+        "lang": "Portugalčina",
+        "notes": "Vopred vytvorený katalóg JSON"
+      },
+      {
+        "code": "sk",
+        "lang": "Slovenčina",
+        "notes": "Vopred vytvorený katalóg JSON"
+      },
+      {
+        "code": "sv",
+        "lang": "Švédčina",
+        "notes": "Vopred vytvorený katalóg JSON"
+      }
+    ]
+  },
+  "englishTip": {
+    "title": "Angličtina je najpresnejšia",
+    "body": "Texty v iných jazykoch pochádzajú z vopred vytvorených katalógov JSON dodávaných s ProxMenux. Chýbajúce preklady používajú angličtinu; hostiteľ nevolá živú prekladovú službu. Pri pochybnom preklade zostáva referenciou anglický text."
+  },
+  "underHood": {
+    "heading": "Ako to funguje pod kapotou",
+    "items": [
+      "Dialóg uvádza osem kódov jazykov; vyberte si jeden.",
+      "Ak <code>config.json</code> existuje: <code>jq --arg lang \"$new_language\" '.language = $lang''</code> aktualizuje pole na mieste.",
+      "Ak <code>config.json</code> neexistuje: nový je vytvorený s jazykovým kódom v objekte s jedným poľom.",
+      "Potvrdzovací dialóg: <em>\"Jazyk bol zmenený na [code]\"</em>.",
+      "<code>exec bash config_menu.sh</code> znova načíta menu Nastavenia s aktivovaným novým jazykom."
+    ]
+  },
+  "manual": {
+    "heading": "Ručný ekvivalent"
+  },
+  "troubleshoot": {
+    "heading": "Riešenie problémov",
+    "noOptionTitle": "Voľba sa neobjavuje v Nastaveniach",
+    "noOptionBody": "Možnosť Zmeniť jazyk je v aktuálnych vydaniach vždy dostupná. Ak chýba, aktualizujte ProxMenux oficiálnym inštalátorom a znova otvorte Nastavenia.",
+    "stillEnglishTitle": "Jazyk sa zmenil, ale rozhranie je stále v angličtine",
+    "stillEnglishBody": "Po zmene sa menu znova spustí. Ak ste otvorili nový shell a spustili iný vstupný bod ProxMenux, znova spustite <code>menu</code>, aby sa použil nový jazyk. Overte to príkazom <code>jq -r '.language' /usr/local/share/proxmenux/config.json</code>."
+  },
+  "related": {
+    "heading": "Súvisiace",
+    "items": [
+      {
+        "href": "/docs/settings/show-version-information",
+        "label": "Zobraziť informácie o verzii",
+        "tail": " — potvrdzuje kanál vydaní, prekladové súbory a aktuálny jazyk."
+      },
+      {
+        "href": "/docs/settings",
+        "label": "Prehľad nastavení",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sk/docs/settings/index.json b/web/messages/sk/docs/settings/index.json
new file mode 100644
index 00000000..c713aab9
--- /dev/null
+++ b/web/messages/sk/docs/settings/index.json
@@ -0,0 +1,81 @@
+{
+  "meta": {
+    "title": "Nastavenia ProxMenux — Aktivácia Monitora, kanál vydaní, jazyky | ProxMenux",
+    "description": "Nastavenia ProxMenux: služba Monitor a obnovenie hesla, kanál Stable/Beta, osem jazykov rozhrania, diagnostika verzie a odinštalovanie. Možnosti Monitora sa zobrazujú, keď je služba nainštalovaná.",
+    "ogTitle": "Nastavenia ProxMenux — Aktivácia Monitora, kanál vydaní, jazyky",
+    "ogDescription": "Konfigurácia ProxMenux: služba Monitor, kanál vydaní, jazyk, informácie o verzii a odinštalovanie.",
+    "twitterTitle": "Nastavenie ProxMenux",
+    "twitterDescription": "Aktivácia Monitora, prepínanie kanála vydaní, jazyky, informácie o verzii a odinštalovanie."
+  },
+  "header": {
+    "title": "Nastavenia",
+    "description": "Konfigurujte ProxMenux: aktivujte alebo deaktivujte Monitor, obnovte prihlasovacie údaje, prepínajte medzi Stable a Beta v oboch smeroch, vyberte jeden z ôsmich jazykov, zobrazte diagnostiku verzie a odinštalujte. Akcie Monitora vyžadujú nainštalovanú službu; výber jazyka je vždy dostupný.",
+    "section": "Nastavenia"
+  },
+  "intro": {
+    "title": "Na čo je toto menu",
+    "body": "Správa samotného ProxMenux: služba Monitor, opustenie beta kanála, jazyk, diagnostika verzie a odinštalovanie. Žiadna možnosť v tomto menu nemení vaše VM, kontajnery ani úložisko."
+  },
+  "opening": {
+    "heading": "Otvorenie menu",
+    "body": "V hlavnom menu ProxMenux stlačte <kbd>s</kbd>. Akcie Monitora sa zobrazia, ak je služba nainštalovaná; ostatné nastavenia sú vždy dostupné:",
+    "imageAlt": "Menu Nastavenia ProxMenux s podmienenými akciami Monitora"
+  },
+  "installTypes": {
+    "heading": "Jedna inštalácia, všetky jazyky",
+    "intro": "Aktuálne vydania obsahujú statické prekladové katalógy JSON v každej inštalácii. Staršie vydania ponúkali samostatné režimy s prekladom a normálny režim:",
+    "headerType": "Typ inštalácie",
+    "headerBundles": "Čo obsahuje",
+    "headerMenu": "Zobrazené možnosti menu",
+    "rows": [
+      {
+        "type": "Aktuálna inštalácia",
+        "bundles": "Statické katalógy JSON pre sedem jazykov a vstavaná angličtina; bez prekladového prostredia Python",
+        "menuRich": "<strong>Zmeniť jazyk</strong> + Zobraziť verziu + Odinštalovať"
+      },
+      {
+        "type": "Staršie režimy s prekladom / normálny",
+        "bundles": "Zastarané rozdelenie na prekladové prostredie a inštaláciu iba v angličtine",
+        "menu": "Aktualizujte oficiálnym inštalátorom a používajte aktuálne jednotné menu"
+      }
+    ],
+    "detectionTitle": "Výber jazyka je vždy dostupný",
+    "detectionBody": "Menu už nekontroluje prekladové prostredie. Každá inštalácia obsahuje <code>/usr/local/share/proxmenux/lang/</code> a ukladá zvolenú hodnotu <code>language</code> do <code>config.json</code>."
+  },
+  "options": {
+    "heading": "Možnosti menu",
+    "intro": "Tieto nástroje spravujú samotný ProxMenux. <em>Podmienené</em> znamená, že akcie Monitora sa zobrazia iba pri nainštalovanej službe systemd. Kanál vydaní, jazyk, diagnostika verzie a odinštalovanie sú vždy dostupné.",
+    "list": [
+      {
+        "icon": "Activity",
+        "href": "/docs/settings/proxmenux-monitor",
+        "title": "ProxMenux Monitor",
+        "description": "Aktivujte alebo deaktivujte jednotku systemd proxmenux-monitor.service, skontrolujte jej aktuálny stav a v prípade straty obnovte prihlasovacie heslo ovládacieho panela. Webové rozhranie je dostupné na porte TCP 8008.",
+        "badge": "Podmienené"
+      },
+      {
+        "icon": "TestTube",
+        "href": "/docs/settings/beta-program",
+        "title": "Zmeniť kanál vydaní",
+        "description": "Prepínajte medzi Stable (main) a Beta (develop) v oboch smeroch v jednom dialógu. Spustí oficiálny inštalátor zvoleného kanála; je idempotentný a vždy viditeľný.",
+        "badge": "Vždy k dispozícii"
+      },
+      {
+        "icon": "Info",
+        "href": "/docs/settings/show-version-information",
+        "title": "Zobraziť informácie o verzii",
+        "description": "Verzia ProxMenux, kanál vydaní, nainštalované komponenty, cesty k súborom, prekladové súbory a aktuálny jazyk."
+      },
+      {
+        "icon": "Trash2",
+        "href": "/docs/settings/uninstall-proxmenux",
+        "title": "Odinštalovať ProxMenux",
+        "description": "Odstrániť ProxMenux a (voliteľne) jeho závislosti. Tiež obnovuje zálohy /root/.bashrc a /etc/motd vytvorené v čase inštalácie."
+      }
+    ]
+  },
+  "configTip": {
+    "title": "Kde je uložená konfigurácia",
+    "bodyRich": "Väčšina stavu spravovaného týmto menu je uložená v <code>/usr/local/share/proxmenux/config.json</code>: <code>language</code>, <code>beta_program.status</code> a príznaky inštalácie jednotlivých komponentov. Stav služby Monitor spravuje systemd (<code>proxmenux-monitor.service</code>), nie tento súbor. Verzia sa načítava z <code>/usr/local/share/proxmenux/version.txt</code>."
+  }
+}
diff --git a/web/messages/sk/docs/settings/proxmenux-monitor.json b/web/messages/sk/docs/settings/proxmenux-monitor.json
new file mode 100644
index 00000000..caa61e93
--- /dev/null
+++ b/web/messages/sk/docs/settings/proxmenux-monitor.json
@@ -0,0 +1,119 @@
+{
+  "meta": {
+    "title": "ProxMenux Monitor | Dokumentácia ProxMenux",
+    "description": "Aktivujte alebo deaktivujte jednotku systemd proxmenux-monitor.service a skontrolujte jej aktuálny stav. Monitor poskytuje webové rozhranie na porte TCP 8008 na vizuálne monitorovanie hostiteľa.",
+    "ogTitle": "ProxMenux Monitor | Dokumentácia ProxMenux",
+    "ogDescription": "Aktivujte alebo deaktivujte službu systemd proxmenux-monitor a skontrolujte jej stav v Nastaveniach."
+  },
+  "header": {
+    "title": "ProxMenux Monitor",
+    "description": "Dve súvisiace akcie v Nastaveniach: aktivovať alebo deaktivovať jednotku systemd proxmenux-monitor.service (spustiť/zastaviť a povoliť/zakázať automatický štart naraz) a zobraziť jej podrobný stav. Monitor poskytuje webové rozhranie na porte TCP 8008 na vizuálne monitorovanie hostiteľa.",
+    "section": "Nastavenia"
+  },
+  "intro": {
+    "title": "Čo je ProxMenux Monitor?",
+    "body": "ProxMenux Monitor je integrovaný webový ovládací panel, ktorý zobrazuje stav infraštruktúry Proxmox v reálnom čase. Je dostupný z ľubovoľného prehliadača vo vašej sieti bez potreby terminálu."
+  },
+  "offers": {
+    "heading": "Čo ponúka",
+    "items": [
+      "Monitorovanie CPU, RAM, používanie disku a sieťová prevádzka v reálnom čase.",
+      "Prehľad prevádzkovaných VMs a LXC kontajnerov s indikátormi stavu.",
+      "Overenie prihlásenia na ochranu prístupu.",
+      "Dvojfaktorové overovanie (2FA) s podporou TOTP.",
+      "Reverzná proxy podpora (Nginx / Traefik).",
+      "Navrhnuté pre prácu cez stolové a mobilné zariadenia."
+    ]
+  },
+  "access": {
+    "heading": "Prístup",
+    "intro": "Po inštalácii je ovládací panel dostupný na adrese:",
+    "url": "http://<your-proxmox-ip>:8008",
+    "outro": "Monitor je automaticky nainštalovaný ako súčasť štandardnej inštalácie ProxMenux a beží ako služba systemd (<code>proxmenux-monitor.service</code>), ktorá sa spustí automaticky pri štarte."
+  },
+  "warnConditional": {
+    "title": "Možnosti nastavenia iba viditeľné pri inštalácii monitora",
+    "body": "V Nastaveniach sa zobrazujú dva nižšie uvedené položky menu, len ak je <code>proxmenux-monitor.service</code> registrovaný systemd. Ak ich nevidíte, monitor nebol nainštalovaný (je voliteľný počas inštalácie ProxMenux). Ak chcete pridať neskôr, preinštalujte ProxMenux s najnovšou verziou a vyberte možnosť Monitor."
+  },
+  "toggle": {
+    "heading": "Aktivovať / deaktivovať",
+    "intro": "Prvá položka menu prepína medzi dvoma stavmi podľa toho, či služba práve beží:",
+    "headerState": "Súčasný stav",
+    "headerLabel": "Zobrazený štítok menu",
+    "headerAction": "Akcia na potvrdenie",
+    "rows": [
+      {
+        "state": "aktívne",
+        "label": "Vypnúť ProxMenux Monitor",
+        "action": "systemctl stop + disable"
+      },
+      {
+        "state": "neaktívne",
+        "label": "Zapnúť ProxMenux Monitor",
+        "action": "systemctl enable + start"
+      }
+    ],
+    "outro": "Každé prepnutie vyžaduje potvrdenie áno/nie. Deaktivácia zastaví službu <em>a</em> zakáže jej automatický štart; aktivácia povolí automatický štart <em>a</em> službu ihneď spustí."
+  },
+  "status": {
+    "heading": "Zobraziť stav služby Monitor",
+    "intro": "Druhá položka menu je len na čítanie. Vyčistí obrazovku, zobrazí logo ProxMenux a názov <em>\"ProxMenux Monitor Service Verification\"</em>, potom uvádza:",
+    "items": [
+      "Stav <strong>Service:</strong> aktívny, neaktívny alebo not_installed.",
+      "<strong>Web UI URL</strong> (iba ak je aktívny): <code>http://&lt;host_ip&gt;:8008</code> Odvodené od <code>hostname -I | awk '''{print $1}'''</code>.",
+      "<strong>Podrobné systemd výstup:</strong> <code>systemctl status proxmenux-monitor.service --no-pager -l</code> Znázorňuje posledné logovacie riadky, ExecStart, MainPIDatď."
+    ]
+  },
+  "manual": {
+    "title": "Ručné ekvivalenty",
+    "intro": "Z ľubovoľného shellu:",
+    "code": "systemctl status proxmenux-monitor.service       # detailed status\nsystemctl is-active proxmenux-monitor.service    # one-word status\nsystemctl enable --now proxmenux-monitor.service # enable + start\nsystemctl disable --now proxmenux-monitor.service # stop + disable\njournalctl -u proxmenux-monitor.service -f       # follow live logs"
+  },
+  "reset": {
+    "heading": "Obnoviť heslo pre ProxMenux Monitor",
+    "intro": "Cesta obnovy pre operátora, ktorý stratil heslo palubnej dosky (alebo zariadenie 2FA). Voľba sa zobrazí iba vtedy, keď je monitor nainštalovaný na hostiteľa. Výber:",
+    "items": [
+      "Požiada o potvrdenie pomocou dialógového okna áno/nie – akcia je deštruktívna pre prihlasovacie údaje.",
+      "Zálohuje existujúci <code>/root/.config/proxmenux-monitor/auth.json</code> na <code>auth.json.bak-&lt;UTC timestamp&gt;</code> (režim <code>0600</code>), takže predchádzajúci stav môže byť obnovený manuálne, ak reset bol chyba.",
+      "Zastaví službu <code>proxmenux-monitor</code>, aby sa úprava súboru nedostala do konfliktu s prebiehajúcim prihlásením.",
+      "Vymaže údaje identity v <code>auth.json</code>: nastaví <code>enabled=false</code>, <code>configured=false</code> a vyprázdni <code>username</code>, <code>password_hash</code>, <code>totp_secret</code> aj pole záložných kódov.",
+      "<strong>Zachová</strong> <code>jwt_secret</code> a zaregistrované <code>api_tokens</code> / <code>revoked_tokens</code>, takže dlhodobé tokeny API používané Home Assistantom alebo inými skriptmi <em>naďalej umožňujú overenie</em> aj po obnovení.",
+      "Reštartuje službu. Ďalšia návšteva <code>http://&lt;host&gt;:8008</code> ukazuje sprievodcu nastavením prvého štartu, aby bolo možné vytvoriť nový účet admin."
+    ],
+    "preservedTitle": "Čo prežije reset, čo nie",
+    "preservedBody": "<strong>Vymazané:</strong> meno používateľa, hash hesla, tajomstvo TOTP pre 2FA a záložné kódy. <strong>Zachované:</strong> <code>jwt_secret</code>, metaúdaje <code>api_tokens</code> a zoznam <code>revoked_tokens</code>. Ak chcete zrušiť aj všetky tokeny API a začať odznova, ručne odstráňte <code>auth.json</code> namiesto použitia tejto možnosti. Pri ďalšom štarte služba znova vytvorí tajomstvo JWT a všetky ostatné údaje.",
+    "trustTitle": "Prístup k hostiteľovi je základom dôvery",
+    "trustBody": "Tento postup obnovenia vyžaduje root shell na hostiteľovi. Kto môže spustiť <code>menu</code> ako root, už ovláda celý systém; obnova hesla preto nepredstavuje zvýšenie oprávnení a zodpovedá správaniu ostatných nástrojov správy Proxmoxu. Prihlásenie do Monitora nechráni systém pred osobou, ktorej ste už umožnili prístup do shellu Proxmoxu.",
+    "seeAlso": "Pozrite aj <link>Monitor → Prístup a overovanie → Obnovenie strateného hesla</link>, kde je rovnaký postup opísaný z pohľadu ovládacieho panela spolu s podrobnosťami o hashovaní hesiel a generovaní tajomstva JWT."
+  },
+  "files": {
+    "heading": "Príslušné súbory",
+    "code": "/etc/systemd/system/proxmenux-monitor.service       # systemd unit\n/root/.config/proxmenux-monitor/                    # runtime config dir\n/var/log/proxmenux-auth.log                         # Flask app auth log\n                                                    # (read by Fail2Ban [proxmenux] jail)"
+  },
+  "troubleshoot": {
+    "heading": "Riešenie problémov",
+    "missingTitle": "Obe možnosti menu chýbajú",
+    "missingBody": "Monitor nie je registrovaný na systemd. Potvrďte <code>systemctl list-unit-files | grep proxmenux-monitor</code> Ak nie je výstup, preinštalujte ProxMenux od oficiálneho inštalátora s najnovšou verziou a vyberte možnosť Monitor počas inštalácie.",
+    "unreachableTitle": "Služba aktivovaná, ale URL je nedostupná",
+    "unreachableBody": "Stavový výstup Nastavenia vám dáva IP. Potvrdiť:",
+    "unreachableCmd": "ss -tlnp | grep 8008                # is anything listening?\njournalctl -u proxmenux-monitor -n 100 --no-pager  # recent errors\ncurl -sI http://localhost:8008      # local reachability",
+    "unreachableOutro": "Ak prístup cez localhost funguje, ale zvonka nie, skontrolujte firewall hostiteľa (<code>pve-firewall</code> alebo nftables) pre prichádzajúce spojenia na TCP 8008.",
+    "stopsTitle": "Aktivoval službu, ale zastaví sa o pár sekúnd neskôr",
+    "stopsBody": "Najčastejšie ide o konflikt na porte 8008 alebo zlyhanie kontroly závislostí. Príčinu ukáže systémový denník: <code>journalctl -u proxmenux-monitor.service -b</code>."
+  },
+  "related": {
+    "heading": "Súvisiace",
+    "items": [
+      {
+        "href": "/docs/security/fail2ban",
+        "label": "Fail2Ban",
+        "tailRich": "— <code>[proxmenux]</code> jail chráni monitor na TCP 8008."
+      },
+      {
+        "href": "/docs/settings",
+        "label": "Prehľad nastavení",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sk/docs/settings/show-version-information.json b/web/messages/sk/docs/settings/show-version-information.json
new file mode 100644
index 00000000..8f566a3b
--- /dev/null
+++ b/web/messages/sk/docs/settings/show-version-information.json
@@ -0,0 +1,81 @@
+{
+  "meta": {
+    "title": "Zobraziť informácie o verzii | Dokumentácia ProxMenux",
+    "description": "Diagnostika ProxMenux iba na čítanie: verzia, kanál vydaní, komponenty zaznamenané v config.json, cesty k súborom, prekladové katalógy a aktuálny jazyk.",
+    "ogTitle": "Zobraziť informácie o verzii | Dokumentácia ProxMenux",
+    "ogDescription": "Diagnostický výpis verzie ProxMenux, kanála vydaní, komponentov, súborov a jazyka."
+  },
+  "header": {
+    "title": "Zobraziť informácie o verzii",
+    "description": "Diagnostika iba na čítanie. Načíta version.txt, config.json a známe cesty k súborom a zobrazí posúvateľné textové pole s verziou, kanálom vydaní, nainštalovanými komponentmi, prítomnosťou súborov, prekladovými súbormi a aktuálnym jazykom.",
+    "section": "Nastavenia"
+  },
+  "intro": {
+    "title": "Čo to je?",
+    "body": "Vlastná diagnostika. Užitočná pri nahlasovaní problému (vložte obsah dialógu do hlásenia chyby) alebo na overenie úspešného dokončenia inštalácie. Nič nemení."
+  },
+  "reports": {
+    "heading": "Čo hlási",
+    "headerSection": "Oddiel",
+    "headerSource": "Zdroj",
+    "headerContent": "Obsah",
+    "rows": [
+      {
+        "section": "Aktuálna verzia",
+        "source": "version.txt",
+        "contentRich": "Jednoriadkové číslo verzie; <code>Unknown</code>, ak chýba súbor"
+      },
+      {
+        "section": "Kanál vydaní",
+        "source": "Stav beta programu v config.json",
+        "content": "Stable (main) alebo Beta (develop); beta verzia, ak je dostupná"
+      },
+      {
+        "section": "Inštalované komponenty",
+        "source": "config.json",
+        "content": "Stav každého komponentu (✓ nainštalovaný / vytvorený / aktualizovaný, ✗ chýba)"
+      },
+      {
+        "section": "Súbory ProxMenux",
+        "source": "kontroly súborového systému",
+        "contentRich": "<code>menu</code>, <code>utils.sh</code>, <code>config.json</code>, prítomnosť <code>version.txt</code> + cesty"
+      },
+      {
+        "section": "Prekladové súbory",
+        "source": "/usr/local/share/proxmenux/lang/",
+        "content": "Prítomnosť adresára lang/ dodávaného s každou inštaláciou"
+      },
+      {
+        "section": "Aktuálny jazyk",
+        "source": "config.json",
+        "contentRich": "Kód jazyka z <code>.language</code>; ak nie je nastavený, použije <code>en</code>"
+      }
+    ]
+  },
+  "sampleHeading": "Výstup vzorky",
+  "manualHeading": "Ručné ekvivalenty",
+  "troubleshoot": {
+    "heading": "Riešenie problémov",
+    "unknownTitle": "Verzia zobrazuje \"Unknown\"",
+    "unknownBody": "<code>/usr/local/share/proxmenux/version.txt</code> chýba alebo nie je čitateľný. Najčastejšie spôsobené čiastočnou inštaláciou. Preinštalovať z oficiálneho zdroja ProxMenux.",
+    "noConfigTitle": "Nie sú k dispozícii žiadne informácie o inštalácii",
+    "noConfigBody": "<code>config.json</code> chýba. Bez neho skript nedokáže vypísať komponenty. Preinštalovaním súbor obnovíte.",
+    "wrongStatusTitle": "Komponent zobrazuje ✗, hoci som si istý, že som ho nainštaloval",
+    "wrongStatusBody": "To znamená, že <code>config.json</code> nesleduje ten komponent ako nainštalovaný, môže to byť skript, ktorý sa ešte sám neregistruje, alebo manuálna inštalácia, ktorá obíde ProxMenux. Dialóg odráža to, čo hovorí <code>config.json</code>, nie to, čo je vlastne na disku."
+  },
+  "related": {
+    "heading": "Súvisiace",
+    "items": [
+      {
+        "href": "/docs/settings/uninstall-proxmenux",
+        "label": "Odinštalovať ProxMenux",
+        "tail": " — Odstrániť všetky tieto súbory."
+      },
+      {
+        "href": "/docs/settings",
+        "label": "Prehľad nastavení",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sk/docs/settings/uninstall-proxmenux.json b/web/messages/sk/docs/settings/uninstall-proxmenux.json
new file mode 100644
index 00000000..a32c8db3
--- /dev/null
+++ b/web/messages/sk/docs/settings/uninstall-proxmenux.json
@@ -0,0 +1,92 @@
+{
+  "meta": {
+    "title": "Odinštalovať ProxMenux | Dokumentácia ProxMenux",
+    "description": "Čisté odinštalovanie ProxMenux s voliteľným odstránením jq a dialog, vyčistením starých prekladových súborov a služby Monitor a obnovením záloh systémových súborov.",
+    "ogTitle": "Odinštalovať ProxMenux | Dokumentácia ProxMenux",
+    "ogDescription": "Čisté odstránenie ProxMenux z hostiteľa Proxmox s voliteľným vyčistením závislostí."
+  },
+  "header": {
+    "title": "Odinštalovať ProxMenux",
+    "description": "Odstráni ProxMenux z hostiteľa Proxmox interaktívnym postupom: potvrdenie, voliteľné odstránenie závislostí, vyčistenie služby ProxMenux Monitor a obnovenie záloh /root/.bashrc a /etc/motd. Počas celého postupu zobrazuje ukazovateľ priebehu.",
+    "section": "Nastavenia"
+  },
+  "scopeWarn": {
+    "title": "Ovplyvní iba inštaláciu ProxMenux — nie vaše VM / CT / úložisko",
+    "body": "Odinštalovanie odstráni skripty ProxMenux, spúšťač menu, voliteľnú službu Monitor a zálohy systémových súborov, ktoré ProxMenux vytvoril počas inštalácie. <strong>Nemení vaše VM, kontajnery, úložisko, konfiguráciu siete, Fail2Ban, ovládač NVIDIA ani nič iné nainštalované cez ProxMenux.</strong> Tieto súčasti zostanú nezmenené."
+  },
+  "flow": {
+    "heading": "Postup odinštalovania",
+    "items": [
+      "<strong>Potvrdzovací dialóg.</strong> Áno/nie: „Naozaj chcete odinštalovať ProxMenux?“",
+      "<strong>Zoznam závislostí na odstránenie.</strong> Ponúka jq a dialog. Obe políčka sú predvolene vypnuté; vyberte iba závislosti, ktoré nepotrebuje žiadna iná aplikácia.",
+      "<strong>Odstraňovanie zobrazuje ukazovateľ priebehu.</strong> Odstráni prípadné zvyšné staré prekladové prostredie, spúšťač <code>menu</code>, strom <code>/usr/local/share/proxmenux/</code>, službu ProxMenux Monitor, ak existuje, spolu s cieľom oznámení zaregistrovaným v Proxmox VE (<code>proxmenux-webhook</code> a jeho pravidlo zhody) a vybrané závislosti. Nakoniec obnoví zálohy systémových súborov (pozri nižšie).",
+      "<strong>Záverečný dialóg.</strong> Vypíše odstránené závislosti a ukončí program."
+    ]
+  },
+  "deps": {
+    "heading": "Odstránenie závislosti: čo ponúkame",
+    "intro": "Zoznam ponúka jq a dialog. <strong>Žiadne políčko nie je predvolene začiarknuté</strong>: tieto systémové balíky môžu používať iné aplikácie, preto je bezpečnejšie ich ponechať.",
+    "headerType": "Inštalácia",
+    "headerOffered": "Ponúkané na odstránenie",
+    "rows": [
+      {
+        "type": "Aktuálne vydania",
+        "offeredRich": "<code>dialog</code>, <code>jq</code>"
+      },
+      {
+        "type": "Staršie inštalácie po aktualizácii",
+        "offeredRich": "<code>dialog</code>, <code>jq</code>"
+      }
+    ],
+    "warnTitle": "Systémové balíky — odstránenie si dobre premyslite",
+    "warnBody": "Aktuálny zoznam ponúka <code>jq</code> a <code>dialog</code>, nie <code>python3</code>. Tieto systémové balíky môžu potrebovať iné nástroje. Odstránenie môže odstrániť aj závislé balíky alebo nepoužívané závislosti. Potrebné balíky ponechajte a pred ručným spustením apt skontrolujte navrhované odstránenie."
+  },
+  "removed": {
+    "heading": "Čo sa odstráni",
+    "code": "/usr/local/bin/menu                                  # the launcher\n/usr/local/share/proxmenux/                          # everything: scripts, config, cache, version\n/opt/googletrans-env/                                # leftover legacy translation environment\n/etc/systemd/system/proxmenux-monitor.service        # Monitor service unit\n/root/.config/proxmenux-monitor/                     # Monitor config dir\n                                                     # + dependencies you ticked in the checklist"
+  },
+  "restored": {
+    "heading": "Čo sa obnoví",
+    "items": [
+      "Ak <code>/root/.bashrc.bak</code> existuje → premenovaná späť na <code>/root/.bashrc</code> (vaše pôvodné Bashrc vracia).",
+      "Ak existuje <code>/etc/motd.bak</code>, premenuje sa späť na <code>/etc/motd</code>. Inak sed odstráni riadok ProxMenux (<em>“This system is optimised by: ProxMenux”</em>) z existujúceho motd."
+    ]
+  },
+  "othersCallout": {
+    "title": "Ostatné ProxMenux-inštalované komponenty zostávajú",
+    "body": "Súčasti, ktoré ProxMenux nainštaloval cez iné menu — Fail2Ban, Lynis, ovládače NVIDIA či úpravy po inštalácii — tento odinštalátor <strong>nemení</strong>. Každá má vlastný postup odinštalovania vo svojom menu (alebo ju môžete odstrániť priamo pomocou apt). Najprv otvorte <em>Zobraziť informácie o verzii</em>, aby ste videli, čo je zaregistrované."
+  },
+  "manual": {
+    "heading": "Ručné odinštalovanie",
+    "intro": "Ak z nejakého dôvodu menu odinštalátor nemôže bežať (napr. <code>dialog</code> už chýba), ekvivalentná manuálna sekvencia:",
+    "code": "# 1. Stop and remove the Monitor service (if installed)\nsystemctl stop proxmenux-monitor.service 2>/dev/null\nsystemctl disable proxmenux-monitor.service 2>/dev/null\nrm -f /etc/systemd/system/proxmenux-monitor.service\nrm -rf /root/.config/proxmenux-monitor\nsystemctl daemon-reload\nsystemctl reset-failed 2>/dev/null\n\n# 2. Remove a leftover legacy translation environment\nrm -rf /opt/googletrans-env\n\n# 3. Remove ProxMenux files\nrm -f /usr/local/bin/menu\nrm -rf /usr/local/share/proxmenux\n\n# 4. Restore backups\n[ -f /root/.bashrc.bak ] && mv /root/.bashrc.bak /root/.bashrc\n[ -f /etc/motd.bak ] && mv /etc/motd.bak /etc/motd \\\n    || sed -i '/This system is optimised by: ProxMenux/d' /etc/motd"
+  },
+  "reinstall": {
+    "heading": "Preinštalácia neskôr",
+    "body": "Znova spustite oficiálny inštalátor ProxMenux. Aktuálne vydania používajú jeden spôsob inštalácie so všetkými ôsmimi jazykmi rozhrania."
+  },
+  "troubleshoot": {
+    "heading": "Riešenie problémov",
+    "hangTitle": "Odinštalovanie sa zasekne pri odstraňovaní starého prekladového prostredia",
+    "hangBody": "Aktuálne vydania odstraňujú zvyšné prostredie príkazom <code>rm -rf /opt/googletrans-env</code>; nespúšťajú <code>pip uninstall</code>. Ak sa tento krok zasekne, preskúmajte ho z iného shellu a pred opakovaním skontrolujte súborový systém hostiteľa.",
+    "aptTitle": "apt upozorňuje na stále používané balíky pri odstraňovaní závislostí",
+    "aptBody": "Vybrané balíky sa označia ako automatické a odovzdajú príkazu <code>apt-get -y --purge autoremove</code>. To nezaručuje ochranu závislých služieb. Závislosti potrebné pre iné nástroje nevyberajte a pred ručným čistením skontrolujte odstránenia navrhnuté nástrojom apt.",
+    "motdTitle": "MOTD po odinštalovaní stále zobrazuje riadok ProxMenux",
+    "motdBody": "Môže sa to stať, ak <code>/etc/motd.bak</code> neexistoval a sed nenašiel riadok (napríklad bol upravený). Ručne upravte <code>/etc/motd</code> a odstráňte všetky zostávajúce riadky ProxMenux."
+  },
+  "related": {
+    "heading": "Súvisiace",
+    "items": [
+      {
+        "href": "/docs/settings/show-version-information",
+        "label": "Zobraziť informácie o verzii",
+        "tail": " — pred odinštalovaním zistite, čo by sa odstránilo."
+      },
+      {
+        "href": "/docs/settings",
+        "label": "Prehľad nastavení",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sk/docs/storage-share/host-iscsi.json b/web/messages/sk/docs/storage-share/host-iscsi.json
new file mode 100644
index 00000000..8b1243dc
--- /dev/null
+++ b/web/messages/sk/docs/storage-share/host-iscsi.json
@@ -0,0 +1,123 @@
+{
+  "meta": {
+    "title": "Hostiteľ: Pridanie cieľa iSCSI ako úložiska Proxmox | Dokumentácia ProxMenux",
+    "description": "Zaregistrujte cieľ iSCSI ako úložisko Proxmox cez ProxMenux. Nástroj nainštaluje open-iscsi, vyhľadá ciele portálu cez sendtargets, umožní výber cieľa a spustí pvesm add iscsi. Poskytuje surové blokové zariadenia pre obrazy diskov VM.",
+    "ogTitle": "Hostiteľ: Pridanie cieľa iSCSI ako úložiska Proxmox | Dokumentácia ProxMenux",
+    "ogDescription": "Zaregistrujte cieľ iSCSI ako úložisko Proxmox so sprievodcom vyhľadávaním. Používa pvesm add iscsi a poskytuje surové blokové zariadenia pre disky VM."
+  },
+  "header": {
+    "title": "Host: Pridať iSCSI cieľ ako Proxmox úložisko",
+    "description": "Zaregistrujte iSCSI cieľ (z SAN, TrueNAS / FreeNAS, Synology, Windows Server cieľ, akékoľvek pole, ktoré hovorí iSCSI) ako Proxmox úložisko. Exportované LUNs sa objavujú ako blokové zariadenia a môžu hostiť VM diskové snímky s takmer lokálnym výkonom v sieti.",
+    "section": "Úložisko a zdieľanie · hostiteľ"
+  },
+  "intro": {
+    "title": "Čo to robí?",
+    "body": "ProxMenux ponúka sprievodcu pre <code>pvesm add iscsi</code>: podľa potreby nainštaluje <code>open-iscsi</code>, vyžiada portál iSCSI (IP:port), spustí proti nemu <code>iscsiadm --mode discovery --type sendtargets</code>, umožní vybrať IQN cieľa a zaregistruje úložisko iSCSI v Proxmoxe. Služba <code>iscsid</code> potom udržiava reláciu iSCSI aj po reštartoch."
+  },
+  "vocab": {
+    "heading": "Pojmy iSCSI (stručný prehľad)",
+    "headerTerm": "Termín",
+    "headerMeaning": "Význam",
+    "rows": [
+      {
+        "term": "Portál",
+        "meaningRich": "Koncový bod služby iSCSI na cieľovom serveri — IP adresa (alebo názov hostiteľa) a port TCP. Predvolený port je <code>3260</code>; ProxMenux ho použije, ak iný nezadáte."
+      },
+      {
+        "term": "Cieľ",
+        "meaningRich": "Jeden exportovaný \"server\" vnútri portálu, identifikovaný jeho IQN (<em>iSCSI Kvalifikovaný názov</em>). Jeden portál môže hostiť veľa cieľov."
+      },
+      {
+        "term": "IQN",
+        "meaningRich": "Kanonická forma je <code>iqn.YYYY-MM.reverse.domain:identifier</code>, napríklad <code>iqn.2024-08.com.truenas:proxmox-pool</code>. Cieľ aj iniciátor majú vlastné IQN."
+      },
+      {
+        "term": "LUN",
+        "meaningRich": "Blokové zariadenie vnútri cieľa (Logické číslo jednotky). Jeden cieľ môže odhaliť niekoľko LUNs; každý LUN sa objaví ako svoj vlastný disk v Proxmox a môže sa stať VM disk."
+      },
+      {
+        "term": "Iniciátor",
+        "meaningRich": "Klient, ktorý sa pripojí k cieľu, v tomto prípade, váš Proxmox hostiteľ. Iniciátor má vlastné IQN uložené v <code>/etc/iscsi/initiatorname.iscsi</code>. Ciele zvyčajne prijímajú iba sedenia od vopred schválených iniciátorov IQN."
+      }
+    ]
+  },
+  "opening": {
+    "heading": "Otvorenie nástroja",
+    "body": "Z hlavného menu ProxMenux, otvoriť <strong>Storage &amp; Share Manager → Pridať iSCSI Target ako Proxmox Storage</strong>. Uvidíte toto sub- menu so štyrmi možnosťami:",
+    "imageAlt": "Ponuka správcu iSCSI hostiteľa — Pridať / Zobraziť / Odstrániť / Testovať pripojenie"
+  },
+  "howRuns": {
+    "heading": "Ako beží skript (Pridať tok)",
+    "body": "Postup má dve fázy: nastavenie iniciátora a vyhľadanie cieľov, potom registráciu úložiska v Proxmoxe. Na rozdiel od NFS a Samba sa nevykonáva automatické vyhľadávanie v podsieti — adresu portálu musíte poznať (iSCSI sa nehodí na vyhľadávanie cez broadcast)."
+  },
+  "add": {
+    "heading": "Pridať iSCSI target ako Proxmox úložisko",
+    "items": [
+      "<strong>Zadanie portálu</strong> — zadajte IP adresu alebo názov hostiteľa cieľového servera iSCSI. Použije sa port <code>3260</code>, ak nezadáte <code>host:port</code>.",
+      "<strong>Vyhľadanie cieľov</strong> — ProxMenux zavolá <code>iscsiadm --mode discovery --type sendtargets --portal &lt;ip:port&gt;</code>. Server vráti všetky IQN, ktoré tomuto iniciátorovi sprístupňuje. Pri zlyhaní skript zobrazí presnú chybu z <code>iscsiadm</code> a bežné príčiny (nesprávna IP adresa, firewall, nepovolené IQN iniciátora).",
+      "<strong>Výber cieľa</strong> — jeden cieľ sa vyberie automaticky; viacero cieľov zobrazí ponuku.",
+      "<strong>ID skladu</strong> Predvolená hodnota <code>iscsi-&lt;last IQN segment, 20 chars max&gt;</code>. Iba písmená, číslice, <code>-</code> a <code>_</code>.",
+      "<strong>Typ obsahu</strong> — na rozdiel od NFS a Samba je obsah iSCSI <strong>pevne nastavený na <code>images</code></strong>. iSCSI poskytuje surové blokové zariadenia, nie súborový systém, preto na ňom Proxmox povoľuje iba disky VM."
+    ],
+    "authTitle": "Povoľte iniciátora Proxmox na cieľ",
+    "authBody1": "Aby pridanie fungovalo od začiatku do konca, cieľ iSCSI musí poznať vášho hostiteľa Proxmox. Zistite IQN svojho iniciátora:",
+    "authBody2": "Pridajte toto IQN do zoznamu prístupu cieľa (TrueNAS: <em>Sharing → Block → Initiators Groups</em>; Synology: <em>SAN Manager → iSCSI → Target → Edit → Initiators</em>; atď.). Ak iniciátor nie je povolený, vyhľadávanie cez <code>iscsiadm</code> vráti prázdny zoznam alebo chybu autentifikácie."
+  },
+  "manual": {
+    "heading": "Ručný ekvivalent",
+    "body": "Celý postup zodpovedá týmto príkazom:"
+  },
+  "view": {
+    "heading": "Zobraziť nakonfigurované úložiská iSCSI",
+    "body": "Zobrazí každú položku iSCSI v Proxmoxe (<code>pvesm status | awk ''$2 == \"iscsi\"''</code>) s portálom, cieľovou IQN, typom obsahu a živým stavom."
+  },
+  "remove": {
+    "heading": "Odstrániť úložisko iSCSI",
+    "body": "Po potvrdení portálu, cieľa a obsahu spustí <code>pvesm remove &lt;storage-id&gt;</code>. Odstráni sa iba registrácia v Proxmoxe — <strong>samotný cieľ iSCSI zostane nedotknutý</strong> a existujúce relácie jadra môžu pretrvať až do reštartu.",
+    "warnTitle": "Najprv skontrolujte existujúce disky VM na tomto iSCSI",
+    "warnBody": "Odstránenie úložiska iSCSI, na ktorom VM stále majú disky, ponechá VM odkazovať na chýbajúce úložisko. Proxmox nahlási chybu, ale údaje LUN zostanú v cieli nedotknuté — opätovnou registráciou úložiska môžete disky znovu sprístupniť. Pre istotu však VM najprv presuňte alebo zálohujte."
+  },
+  "test": {
+    "heading": "Test iSCSI konektivita",
+    "body": "Spustí diagnostiku: overí inštaláciu <code>iscsiadm</code>, vypíše IQN iniciátora, skontroluje beh <code>iscsid</code>, vykoná ping každého registrovaného portálu, overí jeho port a zobrazí <code>pvesm status</code> aj stav aktívnej relácie iSCSI (<code>iscsiadm --mode session</code>). Aktívna relácia a dostupný portál pri stave „inactive“ v Proxmoxe zvyčajne znamenajú zastaraný stav — skúste <code>pvesm set &lt;id&gt; --disable 0</code>."
+  },
+  "troubleshoot": {
+    "heading": "Riešenie problémov",
+    "portalTitle": "\"Nedostať sa k portálu,\" ale server IP reaguje inde",
+    "portalBody": "Ping zlyhal na adrese portálu. Skontrolujte, či sa pripájate k rozhraniu <em>siete úložiska</em> (iSCSI často žije na oddelenej VLAN / podsieti od siete správy). Overte tiež DNS, ak ste zadali názov hostiteľa.",
+    "discoverTitle": "\"iSCSI objav zlyhal\" z iscsiadm",
+    "discoverIntro": "Skript ukazuje presnú chybu. Najčastejšie príčiny:",
+    "discoverItems": [
+      "Portál IP / port zle (dvojitá kontrola, predvolená je 3260).",
+      "Služba iSCSI nebeží na cieľovom serveri.",
+      "Firewall blokuje 3260 medzi Proxmox a cieľ.",
+      "<strong>IQN iniciátora nie je povolené v cieli.</strong> Najčastejšia príčina pri podnikových diskových poliach. Najprv pridajte IQN Proxmox do ACL iniciátorov na cieľovom serveri."
+    ],
+    "noTargetTitle": "Neboli nájdené žiadne ciele, ale objav bol úspešný",
+    "noTargetBody": "Server prijal iniciátora, ale nesprístupňuje mu žiadny cieľ. Skontrolujte autentifikáciu a pravidlá prístupu — niektoré diskové polia povoľujú vyhľadávanie všetkým IQN, ale filtrujú ciele viditeľné jednotlivým IQN.",
+    "noLunTitle": "LUNs sa po registrácii v /dev/disk/by-path neobjavujú",
+    "noLunBody": "<code>pvesm add iscsi</code> uspel, ale jadro nevidí blokové zariadenia. Skontrolujte <code>iscsiadm --mode session</code> — ak žiadna relácia nie je aktívna, prihláste sa ručne cez <code>iscsiadm --mode node --login</code>. Ak relácia existuje, ale LUN chýbajú, vynúťte nové vyhľadanie: <code>iscsiadm --mode session --rescan</code>. Ak sa stále nič nezobrazí, cieľ zrejme ešte nemá LUN priradené tomuto IQN (nastavte mapovanie LUN v cieli).",
+    "chapTitle": "Autentifikácia CHAP",
+    "chapBody": "ProxMenux v interaktívnom postupe nemá polia na meno a heslo CHAP. Ak vyhľadávanie zlyhá, skript skončí pred <code>pvesm add</code> a úložisko napriek chybe nezaregistruje. Požiadavky CHAP cieľa nastavte samostatne v <code>open-iscsi</code>, podľa potreby aj autentifikáciu vyhľadávania, a skúste to znova. Konfiguráciu overte cez <code>iscsiadm</code> a aktívne relácie cez <code>iscsiadm --mode session</code>."
+  },
+  "related": {
+    "heading": "Súvisiace",
+    "items": [
+      {
+        "href": "/docs/storage-share/host-nfs",
+        "label": "Zdieľanie NFS ako úložisko Proxmox",
+        "tail": " — alternatíva na úrovni súborov: jednoduchšie nastavenie, väčšia flexibilita (backup / ISO / tmpl / images), mierne nižší výkon pre disky spustených VM."
+      },
+      {
+        "href": "/docs/storage-share/host-samba",
+        "label": "Samba / CIFS ako úložisko Proxmox",
+        "tail": " — ďalšia možnosť na úrovni súborov; pre disky spustených VM sa neodporúča kvôli sémantike zámkov."
+      },
+      {
+        "href": "/docs/storage-share/host-local-disk",
+        "label": "Pridať lokálny disk ako Proxmox úložisko",
+        "tail": " — keď je disk lokálny pre hostiteľa Proxmox a nie na inom zariadení v sieti."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sk/docs/storage-share/host-local-disk.json b/web/messages/sk/docs/storage-share/host-local-disk.json
new file mode 100644
index 00000000..e3ca9cbb
--- /dev/null
+++ b/web/messages/sk/docs/storage-share/host-local-disk.json
@@ -0,0 +1,186 @@
+{
+  "meta": {
+    "title": "Host: Pridať lokálny disk ako Proxmox úložisko ProxMenux Dokumentácia",
+    "description": "Naformátujte lokálny disk SATA, SAS alebo NVMe na hostiteľovi Proxmox a zaregistrujte ho ako adresárové úložisko alebo pool ZFS. Postup zahŕňa bezpečný výber disku, potvrdenie deštruktívnych operácií, fstab podľa UUID, vytvorenie poolu ZFS a príkazy pvesm add dir / zfspool.",
+    "ogTitle": "Host: Pridať lokálny disk ako Proxmox úložisko ProxMenux Dokumentácia",
+    "ogDescription": "Naformátujte lokálny disk a zaregistrujte ho ako adresár Proxmox alebo ZFS pool pomocou riadeného, bezpečnostne filtrovaného postupu."
+  },
+  "header": {
+    "title": "Host: Pridať lokálny disk ako úložisko Proxmox",
+    "description": "Vyberte fyzický disk na hostiteľovi Proxmox, prípadne ho naformátujte (ext4 / xfs / btrfs / zfs) a zaregistrujte ako úložisko Proxmox — adresár (pvesm add dir) alebo pool ZFS (pvesm add zfspool). ProxMenux odfiltruje systémový disk aj používané disky a pred vykonaním jasne uvedie každý deštruktívny krok.",
+    "section": "Úložisko a zdieľanie · hostiteľ"
+  },
+  "intro": {
+    "title": "Čo to robí?",
+    "body": "Ostatné nástroje pre <em>hostiteľa</em> v tejto časti pracujú so <strong>sieťovým</strong> úložiskom (NFS / Samba / iSCSI). Tento pracuje s <strong>lokálnymi</strong> diskami, teda voľnými diskami fyzicky pripojenými k hostiteľovi Proxmox, ktoré chcete použiť na disky VM, zálohy, ISO alebo šablóny. ProxMenux disk pripraví (rozdelenie + formátovanie + pripojenie) a zaregistruje v Proxmoxe, aby naň rozhranie mohlo ukladať obsah."
+  },
+  "destructive": {
+    "title": "Deštrukčný nástroj pre \"formátovú\" dráhu",
+    "body": "Postup <em>Formátovať</em> <strong>zničí existujúce oddiely a dáta na vybranom disku</strong>. ProxMenux zobrazí varovanie, odfiltruje používané disky a vyžiada potvrdenie pred spustením <code>wipefs</code> / <code>sgdisk</code> / <code>mkfs</code>. Nejde o bezpečné prepísanie každého bajtu. Pred potvrdením dvakrát overte cestu zariadenia."
+  },
+  "compare": {
+    "heading": "Adresár alebo pool ZFS — čo si vybrať?",
+    "headerDir": "Adresár (ext4 / xfs / btrfs)",
+    "headerZfs": "ZFS pool",
+    "rows": [
+      {
+        "label": "Typ skladovania Proxmoxu",
+        "dirRich": "<code>dir</code>",
+        "zfsRich": "<code>zfspool</code>"
+      },
+      {
+        "label": "Formát disku VM",
+        "dir": "Súbor qcow2 / raw na súborovom systéme",
+        "zfs": "Natívny súbor údajov ZFS (zvol) na disk"
+      },
+      {
+        "label": "Snímky",
+        "dir": "qcow2 snímky; btrfs snímky, ak fs=btrfs",
+        "zfs": "Natívne, okamžité, copy-on-write"
+      },
+      {
+        "label": "Tenké prideľovanie",
+        "dir": "Áno (predvolené pri qcow2)",
+        "zfs": "Áno (predvolená hodnota ZFS)"
+      },
+      {
+        "label": "RAM potreby",
+        "dir": "nízka",
+        "zfs": "Vysoké — ZFS používa voľnú RAM ako vyrovnávaciu pamäť ARC"
+      },
+      {
+        "label": "Podporuje typy obsahu",
+        "dir": "images, backup, iso, vztmpl, snippets, rootdir",
+        "zfs": "iba images a rootdir (blokové úložisko)"
+      },
+      {
+        "label": "Najlepšie pre",
+        "dir": "Univerzálny disk: mix diskov VM, zálohy, ISO",
+        "zfs": "Čistý dátový disk VM / LXC s snapshot + potreba integrity"
+      }
+    ]
+  },
+  "opening": {
+    "heading": "Otvorenie nástroja",
+    "body": "V hlavnej ponuke ProxMenux otvorte <strong>Storage &amp; Share Manager → Add Local Disk as Proxmox Storage</strong>. Zobrazí sa podponuka so štyrmi možnosťami:",
+    "imageAlt": "Ponuka lokálnych diskov — Pridať / Zobraziť / Odstrániť / Vypísať dostupné disky"
+  },
+  "howRuns": {
+    "heading": "Ako beží skript (Pridať tok)",
+    "body": "Postup má dve fázy s trojstupňovým bezpečnostným filtrom. Fáza 1 objavuje bezpečné disky, rozhoduje, čo robiť s vybraným a zbiera parametre úložiska; Fáza 2 robí deštruktívne práce. Až do posledného potvrdenia je disk nedotknutý."
+  },
+  "format": {
+    "heading": "Formátovať prázdny disk",
+    "intro": "Cesta pre čerstvý disk alebo ten, ktorého obsah vás nezaujíma.",
+    "items": [
+      "Vyberte disk (systém / používané disky sú skryté).",
+      "Vyberte \"Format disk (EASE všetky dáta) .\"",
+      "Vyberte súborový systém — porovnanie výhod a nevýhod je v tabuľke vyššie.",
+      "ID úložiska (predvolene <code>disk-&lt;device&gt;</code>), cesta pripojenia a predvoľba typu obsahu.",
+      "Potvrďte v dialógu <strong>KONEČNÉ POTVRDENIE — DÁTA SA VYMAŽÚ</strong>.",
+      "ProxMenux vymaže tabuľku oddielov a vytvorí jeden oddiel na celom disku. Spustí <code>mkfs.&lt;fs&gt;</code> alebo <code>zpool create</code> a výsledok pripojí. Bežné súborové systémy dostanú položku UUID v <code>/etc/fstab</code> s <code>defaults,nofail</code>; ZFS používa konfiguráciu pripojenia poolu. Ak je označené <em>Ako úložisko Proxmoxu</em> (pri ZFS vždy), následne sa zaregistruje cez <code>pvesm add dir</code> alebo <code>pvesm add zfspool</code>; inak zostane len pripojením na hostiteľovi."
+    ],
+    "tipTitle": "Prečo UUID + nofail v /etc/fstab",
+    "tipBody": "Skript zapíše <code>UUID=… /mnt/&lt;id&gt; &lt;fs&gt; defaults,nofail 0 2</code>. UUID zostane rovnaké aj pri zmene poradia zariadení po reštarte, takže premenovanie <code>/dev/sdc</code> na <code>/dev/sdd</code> nenaruší štart. S <code>nofail</code> sa Proxmox spustí aj pri chýbajúcom disku (porucha alebo odpojenie); úložisko sa bude zobrazovať ako neaktívne, kým sa disk nevráti."
+  },
+  "reuse": {
+    "heading": "Znovu použiť existujúci súborový systém",
+    "intro": "Cesta k disku, na ktorom si chcete ponechať údaje – možno ste ho presunuli z iného hostiteľa Proxmox alebo disk už obsahuje zálohy / ISO, ktoré chcete ponechať prístupné.",
+    "items": [
+      "Vyber ten disk.",
+      "Vyberte \"Použiť existujúci súborový systém.\"",
+      "ID úložiska, cesta pripojenia a predvoľba typu obsahu.",
+      "ProxMenux dáta <strong>nemení</strong>: vytvorí bod pripojenia, pripojí disk, pridá položku UUID do <code>/etc/fstab</code> a zaregistruje ho ako úložisko Proxmox typu <code>dir</code>."
+    ],
+    "warnTitle": "Opätovné použitie cesty nespracúva ZFS pools",
+    "warnBody": "Ak už disk obsahuje ZFS pool, cesta <em>znova použiť</em> sa ho pokúsi pripojiť ako bežný súborový systém – čo zlyhá. Ak chcete importovať existujúci ZFS pool, použite <code>zpool import &lt;name&gt;</code> na príkazovom riadku a potom ho manuálne zaregistrujte pomocou <code>pvesm add zfspool</code>."
+  },
+  "presets": {
+    "heading": "Prednastavenia typu obsahu",
+    "intro": "ProxMenux ponúka tri predvoľby a vlastnú možnosť. Vybraný reťazec typov obsahu odovzdá príkazu <code>pvesm add … --content &lt;csv&gt;</code>:",
+    "headerPreset": "Predvoľba",
+    "headerContent": "Reťazec typov obsahu",
+    "headerUse": "Prípad použitia",
+    "rows": [
+      {
+        "preset": "Úložisko VM",
+        "content": "images,backup",
+        "use": "Vyhradené úložisko diskov VM, ktoré zároveň uchováva aj zálohy týchto VM."
+      },
+      {
+        "preset": "Štandardné NAS",
+        "content": "backup,iso,vztmpl",
+        "use": "Archívny alebo mediálny disk — zálohy, ISO a šablóny LXC. Bez diskov používaných bežiacimi VM."
+      },
+      {
+        "preset": "Všetky typy",
+        "content": "images,backup,iso,vztmpl,snippets",
+        "use": "Táto široká predvoľba povolí obrazy, zálohy, ISO, šablóny LXC a snippet súbory. Ďalšie podporované typy, napríklad rootdir, podľa potreby pridajte cez vlastnú možnosť."
+      },
+      {
+        "preset": "Vlastné",
+        "content": "(voľný vstup)",
+        "useRich": "Napíšte presné CSV, napr. samotný <code>images</code> alebo <code>rootdir,images</code>."
+      }
+    ],
+    "zfsTitle": "ZFS pool obsah je užší",
+    "zfsBody": "Pri <strong>zfs</strong> podporuje <code>zfspool</code> iba <code>images</code> a <code>rootdir</code>, nie súbory ISO či zálohy. Cez vlastnú možnosť zadajte podporované typy. Skript výber odovzdá bez zmien; nepodporované typy môžu spôsobiť zlyhanie registrácie. Potom overte <code>pvesm status</code>."
+  },
+  "manual": {
+    "heading": "Ručný ekvivalent",
+    "extIntro": "Formát + zaregistrovať disk ako úložisko adresára ext4:",
+    "zfsIntro": "Alebo ako ZFS pool:"
+  },
+  "view": {
+    "heading": "Zobraziť diskové úložiská",
+    "body": "Vypisuje všetky diskové úložiská Proxmox (<code>dir</code> aj <code>zfspool</code>, ktoré sú vytvorené používateľom — systémové pooly ako <code>rpool</code> je skrytý). Zobrazuje cestu pripojenia / pool názov, typy obsahu a aktuálny stav."
+  },
+  "remove": {
+    "heading": "Odstrániť diskové úložisko",
+    "body": "Odregistruje úložisko z Proxmoxu (<code>pvesm remove</code>) a ponúkne odstránenie príslušnej položky v <code>/etc/fstab</code>. Skript pool ZFS automaticky <strong>nezničí</strong>; na to slúži samostatný príkaz <code>zpool destroy &lt;name&gt;</code>, ktorý vykonáte ručne, keď ste si istí.",
+    "warnTitle": "Údaje a existujúce závislosti VM",
+    "warnBody": "Odstránenie úložiska sa nedotkne súborového systému ani pool — údaje zostanú na disku. Ale virtuálne počítače / CT, ktoré odkazujú na toto úložisko podľa ID, sa po odstránení nespustia. Pred odstránením presuňte tieto VM disky na iné úložisko (alebo vytvorte zálohu)."
+  },
+  "list": {
+    "heading": "Zoznam dostupných diskov",
+    "body": "Diagnostický pohľad iba na čítanie: vytlačí výstup <code>lsblk -o NAME,SIZE,TYPE,FSTYPE,MOUNTPOINT,MODEL</code>, po ktorom nasleduje <code>dir</code> / <code>zfspool</code> úložiská, ktoré Proxmox už pozná. Dobrá prvá zastávka, keď otvoríte nástroj a chcete vidieť \"čo je na tomto hostiteľovi?\" pred pridaním niečoho."
+  },
+  "troubleshoot": {
+    "heading": "Riešenie problémov",
+    "noDisksTitle": "\"Nenájdené žiadne dostupné disky\"",
+    "noDisksIntro": "Bezpečnostný filter skryl každý disk. Časté dôvody:",
+    "noDisksItems": [
+      "Prítomný je len koreňový disk.",
+      "Každý iný disk je súčasťou aktívneho ZFS / LVM / RAID poľa.",
+      "Každý iný disk je odkazovaný VM alebo LXC config (pass through).",
+      "Disk je v režime iba na čítanie (zlyhanie hardvéru alebo write-blokátor)."
+    ],
+    "noDisksOutro": "Použite <em>Zoznam dostupných diskov</em> z ponuky, aby ste videli nespracovaný výstup <code>lsblk</code> a pochopili, čo sa deje.",
+    "mountedTitle": "Formát zlyhá s \"device is mounted\"",
+    "mountedBody": "Niečo auto-montoval disk (udisksd, desktop manažér, pretrvávajúce systemd jednotka). Odpojte ho: <code>umount /dev/sdX?*</code> alebo <code>systemctl stop &lt;whatever-mounts-it&gt;</code>, potom sa znovu skúste. Bezpečnostný filter skriptu by mal mať skryté namontované disky, takže ak ste dosiahli túto chybu, pripojiť sa stalo medzi zobrazením menu a potvrdením.",
+    "zpoolTitle": "zpool create zlyhá s hlásením \"invalid vdev specification\"",
+    "zpoolBody": "Zvyčajne to znamená, že disk má stále zastarané GPT / LVM / ZFS podpisy, ktoré <code>zpool</code> odmieta bez vynútenia prepísať. Skript pred formátovaním spustí <code>wipefs</code> a <code>sgdisk --zap-all</code>, ale veľmi tvrdohlavý disk môže mať stále zastaraný štítok. Manuálne vynútenie čistého vymazania: <code>zpool labelclear -f /dev/sdX</code> alebo <code>dd if=/dev/zero of=/dev/sdX bs=1M count=10</code> a skúste to znova.",
+    "inactiveTitle": "Skladovanie ukazuje ako neaktívne po reštarte",
+    "inactiveBody": "Skontrolujte <code>findmnt &lt;mount-path&gt;</code>. Ak pripojenie chýba, zlyhalo niečo v <code>/etc/fstab</code>. Výstup <code>dmesg | tail</code> zvyčajne ukáže príčinu, napríklad nesúlad UUID, poškodenie súborového systému alebo vynechanie ďalšieho pokusu v súvislosti s <code>nofail</code>. Po odstránení príčiny príkaz <code>mount -a</code> zvyčajne úložisko znovu pripojí."
+  },
+  "related": {
+    "heading": "Súvisiace",
+    "items": [
+      {
+        "href": "/docs/disk-manager/format-disk",
+        "label": "Správca diskov: formátovanie / vymazanie fyzického disku",
+        "tail": "— nízkoúrovňová alternatíva, keď chcete iba pripraviť disk bez toho, aby ste ho registrovali ako úložisko Proxmox."
+      },
+      {
+        "href": "/docs/storage-share/host-iscsi",
+        "label": "Pridať iSCSI target ako Proxmox úložisko",
+        "tail": " — sieťový ekvivalent, ak je blokové zariadenie na inom počítači."
+      },
+      {
+        "href": "/docs/storage-share/host-local-shared",
+        "label": "Pridať zdieľaný adresár na hostiteľa",
+        "tail": " — príprava adresára na hostiteľovi pre bind mounty LXC (bez registrácie úložiska Proxmox)."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sk/docs/storage-share/host-local-shared.json b/web/messages/sk/docs/storage-share/host-local-shared.json
new file mode 100644
index 00000000..961b2abc
--- /dev/null
+++ b/web/messages/sk/docs/storage-share/host-local-shared.json
@@ -0,0 +1,103 @@
+{
+  "meta": {
+    "title": "Hostiteľ: Pridanie zdieľaného adresára | Dokumentácia ProxMenux",
+    "description": "Vytvorte adresár hostiteľa pripravený pre bind mounty LXC s oprávneniami pre privilegované aj neprivilegované kontajnery. Sticky bit, rwx pre všetkých a predvolené ACL pre dedenie.",
+    "ogTitle": "Hostiteľ: Pridanie zdieľaného adresára | Dokumentácia ProxMenux",
+    "ogDescription": "Pripravte si hostiteľský adresár pre bind mounty LXC s oprávneniami kompatibilnými s privilegovanými a neprivilegovanými CT."
+  },
+  "header": {
+    "title": "Hostiteľ: Pridať zdieľaný adresár",
+    "description": "Vytvorte adresár na hostiteľovi určený pre bind mounty v jednom alebo viacerých kontajneroch LXC. ProxMenux použije oprávnenia pre privilegované aj neprivilegované CT bez riešenia posunutých UID alebo zmeny vlastníka pre každý kontajner a zaregistruje adresár na neskoršie použitie v LXC Mount Manager.",
+    "section": "Úložisko a zdieľanie · hostiteľ"
+  },
+  "intro": {
+    "title": "Čo je toto (a NIE)",
+    "body": "Tento nástroj <strong>nič</strong> neregistruje v Proxmoxe (nepoužíva <code>pvesm add</code>). Iba pripraví adresár na hostiteľovi — predvolene <code>/mnt/shared</code> — s oprávneniami na čítanie a zápis pre ľubovoľný LXC bez ohľadu na privilegovaný či neprivilegovaný režim. Ďalším krokom je zvyčajne bind mount do jednotlivých CT cez <mountLink>LXC Mount Manager</mountLink>."
+  },
+  "why": {
+    "heading": "Prečo je to špecializovaný nástroj",
+    "intro": "Keď pripojíte adresár do LXC kontajnera, práva závisia od:",
+    "items": [
+      "Či je CT <strong>privilegovaný</strong> (UID 0 v CT = UID 0 na hostiteľovi) alebo <strong>neprivilegovaný</strong> (UID 0 v CT = UID 100000 na hostiteľovi — všetko je posunuté o +100000).",
+      "Vlastníctvo adresára hostiteľa (súbor s UID 1000 na hostiteľovi sa z pohľadu neprivilegovaného CT riadi oprávneniami „ostatní“, pretože žiadny používateľ CT sa nemapuje na UID 1000 hostiteľa).",
+      "Či viaceré CT zdieľajú rovnaký adresár (rôzne CT môžu mať rôzne UID rozsahy)."
+    ],
+    "outro": "ProxMenux používa praktický postup: <strong>poskytnúť prístup všetkým</strong> na úrovni súborového systému pomocou rwx pre všetkých, sticky bitu a ACL na dedenie oprávnení. Každé mapované UID môže čítať a zapisovať; netreba zosúlaďovať UID/GID."
+  },
+  "howRuns": {
+    "heading": "Ako beží skript",
+    "body": "Skript nemá žiadne hlavné menu – spúšťa jedinú akciu, <strong>Vytvoriť zdieľaný adresár</strong>. Fáza 1 zhromažďuje cieľovú cestu; Fáza 2 vytvorí adresár a použije povolenia."
+  },
+  "bits": {
+    "heading": "Čo robia jednotlivé bity oprávnení",
+    "intro": "Číslo <strong>1777</strong> nie je náhodné — rovnaký režim Linux používa pre <code>/tmp</code>. Kombinuje tri vlastnosti:",
+    "headerBit": "Bit",
+    "headerEffect": "Účinok",
+    "headerWhy": "Prečo na tom záleží tu",
+    "rows": [
+      {
+        "bit": "1 (sticky bit)",
+        "effect": "Súbor môže odstrániť alebo premenovať jeho vlastník, vlastník adresára alebo proces s dostatočnými oprávneniami.",
+        "why": "Pomáha zabrániť používateľom s rôznymi mapovanými UID odstraňovať cudzie súbory. Neizoluje CT s rovnakým mapovaným UID alebo privilegovaným prístupom root."
+      },
+      {
+        "bit": "777 (rwx-rwx-rwx)",
+        "effect": "Každý vie čítať, písať a prechádzať.",
+        "why": "Neprivilegované CT UID (100000+) sa objavujú ako \"ostatné\" z hostiteľa, takže svet-rwx im dáva prístup."
+      },
+      {
+        "bit": "ACL (predvolené)",
+        "effect": "Dedia sa pri vytvorení každého súboru alebo podadresára.",
+        "why": "Nový obsah zdedí predvolené ACL bez opätovného spustenia skriptu. Aplikácie však môžu požadovať obmedzujúce režimy alebo neskôr zmeniť oprávnenia."
+      }
+    ],
+    "privTitle": "Privilegované CT vidia to isté, len bez zmeny.",
+    "privBody": "V privilegovanom CT je UID 0 totožné s UID 0 na hostiteľovi, takže <code>root</code> v CT môže priamo čítať a zapisovať do adresára hostiteľa. Režim <code>1777</code> je naďalej vhodný — umožňuje používanie adresára aj používateľom CT mimo root. Rovnaké oprávnenia pokrývajú oba prípady."
+  },
+  "where": {
+    "heading": "Kam dať zdieľaný adresár",
+    "intro": "Výber umiestnenia ponúka štyri možnosti:",
+    "opt1Title": "1. Vytvoriť nový priečinok v /mnt",
+    "opt1Body": "Zvyčajná voľba. ProxMenux auto-navrhuje prvý voľný názov (<code>shared</code>, <code>shared2</code>, <code>shared3</code>, ...). Stačí potvrdiť alebo napísať iný názov.",
+    "opt2Title": "2. Zadajte vlastnú cestu",
+    "opt2Body": "Pre adresáre mimo <code>/mnt</code>. Akákoľvek absolútna cesta funguje (napr. <code>/srv/media</code>, <code>/data/family</code>). Skript uplatňuje rovnaké práva.",
+    "opt3Title": "3. Zobraziť existujúce priečinky v /mnt",
+    "opt3Body": "Diagnostika iba na čítanie: uvádza každý adresár pod <code>/mnt</code> so svojimi oprávneniami, vlastníkom a dostupným priestorom. Užitočné pred vytvorením nového, aby sa zabránilo pomenovaniu kolízie.",
+    "opt4Title": "4. Zrušiť",
+    "opt4Body": "Ukončí postup bez vytvorenia čohokoľvek. Rovnako ako stlačenie <kbd>Esc</kbd>.",
+    "tipTitle": "Kde žije /mnt?",
+    "tipBody": "Predvolene sa <code>/mnt</code> nachádza na koreňovom súborovom systéme Proxmox. Ak má byť zdieľaný adresár na inom disku (dátový disk alebo pool ZFS), najprv ho pripojte pod <code>/mnt/&lt;name&gt;</code> cez Disk Manager alebo <diskLink>Pridať lokálny disk ako úložisko Proxmox</diskLink>. Potom vytvorte zdieľaný podadresár v ňom alebo tu vyberte „Zadať vlastnú cestu“ a zadajte cestu pripojeného disku."
+  },
+  "manual": {
+    "heading": "Ručný ekvivalent",
+    "body": "Celý tok sa dá prehrať ručne:"
+  },
+  "next": {
+    "heading": "Ďalší krok: bind mount do kontajnerov",
+    "body": "Vytvorením adresára sa iba pripraví – zatiaľ ho nevidí žiadny kontajner. Aby bolo viditeľné v jednom alebo viacerých LXC, použite <mountLink>LXC Mount Manager</mountLink> na pripojenie <code>/mnt/&lt;name&gt;</code> do CT. Pretože oprávnenia sú už otvorené, Mount Manager <strong>neponúkne</strong> ich zmenu – adresár je pripravený na použitie tak, ako je."
+  },
+  "troubleshoot": {
+    "heading": "Riešenie problémov",
+    "mkdirTitle": "\"Failed to create directory\"",
+    "mkdirBody": "Zvyčajne je problém súborového systému: <code>/mnt</code> je na súborovom systéme iba na čítanie, cesta obsahuje komponent, ktorý nie je adresárom (napr. ste zadali <code>/etc/passwd/sub</code>), alebo disk je plný. Overte si to s <code>df -h /mnt</code> a <code>mount | grep /mnt</code>.",
+    "writeTitle": "Kontajner nemôže písať napriek otvoreným povoleniam",
+    "writeBody": "Overte, či CT skutočne používa bind mount (<code>pct config &lt;ctid&gt; | grep ^mp</code>). V CT spustite <code>touch /mnt/data/test-$(date +%s)</code>. Ak príkaz zlyhá s odmietnutým prístupom, pripojenie môže byť na súborovom systéme hostiteľa bez podpory ACL (niektoré staršie pripojenia <code>ext3</code> alebo <code>vfat</code>). Presuňte zdieľaný adresár na súborový systém ext4, xfs, btrfs alebo zfs.",
+    "aclTitle": "ACL príkazy ticho nedostupné",
+    "aclBody": "Na minimálnej inštalácii Proxmox nemusia byť <code>setfacl</code> / <code>getfacl</code> nainštalované. Skript to overí cez <code>command -v setfacl</code> a použije iba oprávnenia POSIX. Tie často stačia, no nové súbory automaticky nezdedia otvorené oprávnenia. Nainštalujte <code>acl</code> pomocou <code>apt-get install -y acl</code> a spustite skript pre daný adresár znova."
+  },
+  "related": {
+    "heading": "Súvisiace",
+    "items": [
+      {
+        "href": "/docs/storage-share/lxc-mount-points",
+        "label": "Správca LXC mountov",
+        "tail": " — ďalší bežný krok: bind mount tohto adresára do jedného alebo viacerých kontajnerov."
+      },
+      {
+        "href": "/docs/storage-share/host-local-disk",
+        "label": "Pridať lokálny disk ako Proxmox úložisko",
+        "tailRich": " — Ak chcete zdieľaný adresár na vyhradenom disku, pripravte najprv disk, pripojte ho pod <code>/mnt</code>, potom tu vytvorte zdieľaný podpriečinok."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sk/docs/storage-share/host-nfs.json b/web/messages/sk/docs/storage-share/host-nfs.json
new file mode 100644
index 00000000..fd90b99a
--- /dev/null
+++ b/web/messages/sk/docs/storage-share/host-nfs.json
@@ -0,0 +1,174 @@
+{
+  "meta": {
+    "title": "Hostiteľ: pripojenie zdieľania NFS | Dokumentácia ProxMenux",
+    "description": "Pripojte externý export NFS na hostiteľovi Proxmox ako úložisko Proxmox cez pvesm add nfs, ako samostatné pripojenie cez fstab neviditeľné v Datacenter > Storage alebo oboma spôsobmi. Metóda fstab je vhodná na sprístupnenie cesty kontajnerom LXC cez bind mount bez registrácie úložiska v Proxmoxe.",
+    "ogTitle": "Hostiteľ: pripojenie zdieľania NFS | Dokumentácia ProxMenux",
+    "ogDescription": "Pripojte externý export NFS na hostiteľovi Proxmox cez pvesm, fstab alebo oboje. Spôsob fstab je vhodný pre bind mounty LXC."
+  },
+  "header": {
+    "title": "Hostiteľ: pripojiť zdieľanie NFS na hostiteľovi",
+    "description": "Pripojte externý export NFS z NAS, iného servera alebo domáceho labu k hostiteľovi Proxmox. Môžete ho zaregistrovať ako úložisko Proxmox viditeľné v Datacenter > Storage, pridať samostatné pripojenie cez /etc/fstab na zvolenú cestu alebo použiť oba spôsoby. Samostatná cesta je vhodná na sprístupnenie zdieľania kontajnerom LXC pomocou bind mountu bez registrácie úložiska v Proxmoxe.",
+    "section": "Úložisko a zdieľanie · hostiteľ"
+  },
+  "intro": {
+    "title": "Čo to robí?",
+    "body": "ProxMenux ponúka dva spôsoby pripojenia exportu NFS: <strong>(1) Úložisko Proxmox</strong> pomocou <code>pvesm add nfs</code>. Zdieľanie sa zobrazí v Datacenter > Storage a Proxmox spravuje pripojenie na <code>/mnt/pve/&lt;id&gt;</code>. <strong>(2) Pripojenie cez fstab na hostiteľovi</strong> na zvolenú cestu, trvalo zapísané v <code>/etc/fstab</code>. Nezobrazí sa ako úložisko Proxmox a hodí sa na bind mounty do kontajnerov LXC bez ďalších položiek v rozhraní Proxmoxu. Môžete použiť jeden alebo oba spôsoby."
+  },
+  "opening": {
+    "heading": "Otvorenie nástroja",
+    "body": "V hlavnej ponuke ProxMenux otvorte <strong>Storage &amp; Share Manager → Mount NFS Share on Host</strong>. Zobrazí sa podponuka so štyrmi možnosťami:",
+    "imageAlt": "Ponuka NFS hostiteľa — Pripojiť / Zobraziť / Odstrániť / Testovať pripojenie"
+  },
+  "howRuns": {
+    "heading": "Ako beží skript",
+    "body": "Postup má dve jasne oddelené fázy: vyhľadanie, overenie a výber, potom samotné pripojenie a zápis konfigurácie. Po výbere exportu zvolíte metódy pripojenia v zozname. Ďalšie dialógy sa pýtajú iba na parametre vybraných metód. Až do záverečného potvrdenia sa nemení ani <code>/etc/pve/storage.cfg</code>, ani <code>/etc/fstab</code>."
+  },
+  "modes": {
+    "heading": "Výber spôsobu pripojenia (označte jednu alebo obe možnosti)",
+    "intro": "Po výbere a overení exportu zobrazí ProxMenux zoznam dvoch spôsobov pripojenia. Môžete označiť jeden alebo oba. Ak stlačíte OK bez výberu, dialóg sa otvorí znovu. Vyberte aspoň jednu možnosť alebo postup ukončite tlačidlom Zrušiť.",
+    "imageAlt": "Výber spôsobov pripojenia s možnosťami pvesm a fstab",
+    "headerMethod": "Metóda",
+    "headerMount": "Cesta pripojenia",
+    "headerUi": "Viditeľné v datacentre > Úložisko",
+    "headerUseCase": "Typický prípad použitia",
+    "rows": [
+      {
+        "method": "<strong>Ako úložisko Proxmox (pvesm)</strong>",
+        "mountRich": "<code>/mnt/pve/&lt;storage-id&gt;</code> (manažovaný spoločnosťou Proxmox)",
+        "ui": "Áno",
+        "useCase": "VM obrazy diskov, zálohy, ISO, LXC šablóny — čokoľvek, čo sa musí objaviť v Proxmox UI."
+      },
+      {
+        "method": "<strong>Iba fstab hostiteľa</strong>",
+        "mountRich": "<code>/mnt/&lt;path&gt;</code> (vyberiete cestu)",
+        "ui": "Nie",
+        "useCaseRich": "Sprístupnite zdieľanie jednému alebo viacerým LXC cez bind mount <em>bez</em> registrácie úložiska Proxmox. Rozhranie Datacenter zostane prehľadné."
+      },
+      {
+        "method": "<strong>Obe</strong>",
+        "mount": "Obe cesty uvedené vyššie (dva body pripojenia toho istého exportu NFS)",
+        "ui": "Áno",
+        "useCase": "Integrácia s rozhraním a samostatná stabilná cesta hostiteľa s otvorenými oprávneniami pre bind mounty LXC."
+      }
+    ],
+    "bothTitle": "Možnosť „Oboje“ vytvorí dve nezávislé pripojenia NFS",
+    "bothBody": "Obe metódy sa vykonajú samostatne: pvesm pripojí export do <code>/mnt/pve/&lt;id&gt;</code> a fstab do <code>/mnt/&lt;path&gt;</code>. Získate pripojenie spravované Proxmoxom s predvolenými voľbami a samostatné pripojenie hostiteľa pre bind mounty LXC. Dva body pripojenia nezaručujú dve spojenia TCP; klient NFS môže transportné spojenia opätovne použiť."
+  },
+  "pvesmBranch": {
+    "heading": "Metóda A — ako úložisko Proxmox (pvesm)",
+    "intro": "Ak je <em>Ako úložisko Proxmox</em> označený, ProxMenux spustí pôvodný pvesm prietok:",
+    "items": [
+      "<strong>ID úložiska</strong> — názov, pod ktorým Proxmox toto úložisko zaregistruje. Predvolene je to <code>nfs-&lt;server-ip-with-dashes&gt;</code>. Povolené sú iba písmená, číslice, <code>-</code> a <code>_</code>.",
+      "<strong>Typy obsahu</strong> Proxmox viaže kategórie obsahu na úložné objemy; vyberte si, čo to NFS je povolené držať:"
+    ],
+    "headerType": "Typ obsahu",
+    "headerAllows": "Čo to umožňuje",
+    "rows": [
+      {
+        "type": "import",
+        "allowsRich": "Import obrazu disku (štandardne vybraný). Potrebné pre <em>Import Disk Image na VM</em>."
+      },
+      {
+        "type": "backup",
+        "allowsRich": "VM a CT záložné súbory (<code>vzdump</code>)."
+      },
+      {
+        "type": "iso",
+        "allows": "Inštalačné obrazy ISO."
+      },
+      {
+        "type": "vztmpl",
+        "allows": "Šablóny LXC."
+      },
+      {
+        "type": "images",
+        "allows": "Obrazy diskov používaných VM — NFS tak slúži ako úložisko diskov VM."
+      },
+      {
+        "type": "rootdir",
+        "allows": "Koreňové súborové systémy LXC (pri NFS nezvyčajné — prečítajte si poznámku nižšie)."
+      },
+      {
+        "type": "snippets",
+        "allows": "Hook skripty a snippet súbory cloud-init."
+      }
+    ],
+    "warnTitle": "images a rootdir na NFS",
+    "warnBody": "Voľba <code>images</code> umožní ukladať disky VM na NFS. Výkon závisí od siete, servera a záťaže; výpadok môže zablokovať vstupno-výstupné operácie závislé od pripojenia. Voľba <code>rootdir</code> ukladá koreňové súborové systémy LXC na NFS, kde môžu neprivilegované kontajnery naraziť na obmedzenia mapovania UID, overlay a vlastníctva. Zvážte to pred umiestnením <code>images</code> / <code>rootdir</code>; NFS je vhodné aj pre <code>backup</code> / <code>iso</code> / <code>vztmpl</code>.",
+    "result": "Výsledok je <code>pvesm add nfs &lt;id&gt; --server &lt;srv&gt; --export &lt;path&gt; --content &lt;csv&gt;</code> a Proxmox auto-mounts na <code>/mnt/pve/&lt;id&gt;</code>."
+  },
+  "fstabBranch": {
+    "heading": "Metóda B — iba pripojenie cez fstab hostiteľa",
+    "intro": "Ak <em>Iba pripojenie cez fstab hostiteľa</em> je označený, ProxMenux požiada o cestu pripojenia hostiteľa a trvalé možnosti, potom sa pripojí a napíše položku na <code>/etc/fstab</code>:",
+    "items": [
+      "<strong>Cesta pripojenia k hostiteľovi</strong> Predvolené <code>/mnt/&lt;export-basename&gt;</code>. Musí to byť absolútna cesta. Ak je tam niečo už namontované, alebo existuje fstab položka pre tú istú cestu, ProxMenux Varuje vás a ponúka, že ho nahradíte.",
+      "<strong>Voľby pripojenia</strong> — <em>Čítanie/zápis</em> (predvolené: <code>rw,hard,nofail,_netdev,rsize=131072,wsize=131072,timeo=600,retrans=2</code>), <em>Iba na čítanie</em>, <em>Vlastné</em> (zadajte vlastné voľby)."
+    ],
+    "appliesIntro": "Keď potvrdíte, skript:",
+    "applies": [
+      "Vytvorí adresár bodu pripojenia pomocou <code>mkdir -p</code>.",
+      "<code>mount -t nfs -o &lt;opts&gt; &lt;srv&gt;:&lt;export&gt; &lt;path&gt;</code>.",
+      "Napíše jednoriadkový zápis do <code>/etc/fstab</code>: <code>&lt;srv&gt;:&lt;export&gt; &lt;path&gt; nfs &lt;opts&gt; 0 0</code>.",
+      "Spustí <code>systemctl daemon-reload</code> takže systemd zachytí novú fstab položku.",
+      "Pokúsi sa vykonať <code>chmod 1777</code> a <code>setfacl o::rwx</code> na bode pripojenia. Operácia je nezáväzná a nehlási zlyhanie: uspeje iba vtedy, ak ju server NFS povolí. Mnohé exporty NAS už umožňujú zápis všetkým používateľom."
+    ],
+    "lxcTitle": "Použitie pripojenia fstab z LXC",
+    "lxcBody": "Skript vypíše príkaz <code>pct set</code> pre bind mount, napríklad <code>pct set &lt;ctid&gt; -mp0 /mnt/&lt;path&gt;,mp=/mnt/&lt;ct-path&gt;,shared=1,backup=0</code>. Alebo použite <mountLink>LXC Mount Manager</mountLink>, ktorý rozpozná pripojenia fstab. <strong>V kontajneri sa nič nemení</strong>. Prístup neprivilegovaného CT závisí od oprávnení servera pre jeho mapované UID/GID. Skript sa len pokúsi upraviť oprávnenia z hostiteľa; nezaručuje zapisovateľné exporty ani predvolené nastavenia výrobcov. Pri problémoch pozrite riešenie problémov.",
+    "noUiTitle": "Pripojenie fstab NIE JE úložiskom Proxmox",
+    "noUiBody": "Hostiteľský fstab mount je neviditeľný pre web Proxmox UI — podľa návrhu. Nezobrazuje sa v <em>Datacenter > Storage</em>, nemôžete ho vybrať v tvorcovi VM / CT a úlohy zálohovania Proxmox sa naň nemôžu zamerať. Je to čisto cesta hostiteľského súborového systému. Ak chcete aj integráciu UI, označte vo výbere <em>obe</em> metódy."
+  },
+  "manual": {
+    "heading": "Ručný ekvivalent",
+    "pvesmIntro": "Metóda A (pvesm) zodpovedá:",
+    "fstabIntro": "Metóda B (fstab) zodpovedá:"
+  },
+  "view": {
+    "heading": "Zobraziť nakonfigurované úložiská NFS",
+    "body": "Vypíše položky NFS v Proxmoxe (<code>pvesm status | awk ''$2 == \"nfs\"''</code>) so serverom, exportom, typmi obsahu, cestou pripojenia a aktuálnym stavom. <strong>Poznámka:</strong> zobrazí iba úložiská registrované cez pvesm, nie samostatné pripojenia fstab. Tie overte pomocou <code>findmnt -t nfs</code> alebo <code>grep nfs /etc/fstab</code>."
+  },
+  "remove": {
+    "heading": "Odstrániť úložisko NFS",
+    "body": "Po potvrdení so serverom, exportom a obsahom spustí <code>pvesm remove &lt;storage-id&gt;</code>. Odstráni iba registráciu v Proxmoxe; <strong>vzdialený server NFS nemení</strong> a súbory neodstráni. Samostatné pripojenie fstab odstráňte ručnou úpravou <code>/etc/fstab</code> a príkazom <code>umount &lt;path&gt;</code>.",
+    "warnTitle": "Zálohovanie závislostí najprv",
+    "warnBody": "Ak VM, CT alebo úlohy zálohovania odkazujú na ID tohto úložiska, po odstránení budú odkazovať na neexistujúce úložisko. Proxmox ohlási chybu, ale odkazy neodstráni. Najprv ich presuňte alebo odstráňte a až potom odstráňte úložisko."
+  },
+  "test": {
+    "heading": "Test NFS konektivita",
+    "body": "Spustí diagnostický prechod cez každý NFS skladovanie registrované v Proxmoxe: kontroluje, či <code>showmount</code> je k dispozícii, <code>rpcbind</code> beží, pings každý server, sondy port 2049, volá <code>showmount -e</code>, a nakoniec uvádza Proxmox vlastný názor (<code>pvesm status</code>). Dobrá prvá zastávka, keď úložisko ukazuje ako <em>neaktívny</em> v Proxmoxe UI."
+  },
+  "troubleshoot": {
+    "heading": "Riešenie problémov",
+    "noServersTitle": "\"Žiadne NFS servery nájdené v sieti\"",
+    "noServersBody": "Automatické vyhľadávanie používa <code>nmap -p 2049 --open &lt;subnet&gt;/24</code>. Server nemusí reagovať, ak: je na inom VLAN / subnet, jeho firewall bloky nmap sondy (mnohý robiť) alebo port 2049 je zámerne uzavretý na tomto rozhraní. Použite možnosť <em>Manual</em> s IP alebo meno hostiteľa servera.",
+    "portTitle": "„Port NFS (2049) nie je dostupný“",
+    "portBody": "Ping uspel, ale <code>nc -z -w 3 &lt;server&gt; 2049</code> zlyhal. Skontrolujte, či služba NFS beží na serveri (<code>systemctl status nfs-server</code> na Linuxe, Ovládací panel → Súborové služby na Synology, NFS plugin na OMV / TrueNAS), a že firewall umožňuje 2049 z Proxmox hostiteľa.",
+    "showmountTitle": "„Failed to connect“ z príkazu showmount",
+    "showmountBody": "Server odmietol dotaz exportného zoznamu. Bežné príčiny: server vymáha prísne klientske ACL (vaše Proxmox IP nie je na povolenom zozname), <code>rpcbind</code> nebeží na serveri, alebo server vystaví iba NFSv4 s <code>showmount</code> vypnutým. Exportná cesta môže byť stále pridaná ručne, ak ju poznáte.",
+    "inactiveTitle": "Úložisko ukazuje ako neaktívne v systéme Proxmox UI",
+    "inactiveBody": "Najprv spustite <em>Testovať pripojenie NFS</em>: overí, či server odpovedá na ping, či je otvorený port 2049 a či je dostupný zoznam exportov (<code>showmount -e</code>). Ak spojenie funguje, ale úložisko zostáva neaktívne, skontrolujte <code>journalctl -u pvestatd</code> a konfiguráciu servera/exportu. Najprv opravte spojenie alebo oprávnenia. Príkaz <code>pvesm set &lt;id&gt; --disable 0</code> zapne vypnuté úložisko; nie je všeobecnou opravou chýb NFS.",
+    "lxcNoWriteTitle": "Pripojenie fstab funguje, ale neprivilegovaný LXC nemôže zapisovať cez bind mount",
+    "lxcNoWriteBody": "Prístup NFS závisí od vlastníkov, ACL a nastavení squash na serveri. Voľby CIFS <code>uid=</code> a <code>file_mode=</code> pre NFS <strong>neplatia</strong>. Pri predvolenom mapovaní LXC má root z CT na hostiteľovi UID 100000, nie vzdialené UID 0. Povoľte prístup skutočnému mapovanému UID/GID alebo anonymnej identite servera. <code>no_root_squash</code> ovplyvňuje iba vzdialené UID 0 a nie je všeobecným riešením pre UID 100000. Skript skúsi <code>chmod 1777</code>, ale oprávnenia servera neobíde.",
+    "fstabBootTitle": "fstab mount nepríde po reštarte",
+    "fstabBootBody": "Skript pridáva <code>nofail,_netdev</code>, aby nedostupné zdieľanie pri štarte neblokovalo spúšťanie systému. Ak sa nepripojí vôbec, overte dostupnosť siete pomocou <code>ping &lt;server&gt;</code>, skontrolujte <code>journalctl -u remote-fs.target</code> a platnosť záznamu pomocou <code>mount -fav | grep nfs</code>. Príkaz <code>mount -a</code> po štarte pripojí položky, ktoré zatiaľ chýbajú."
+  },
+  "related": {
+    "heading": "Súvisiace",
+    "items": [
+      {
+        "href": "/docs/storage-share/host-samba",
+        "label": "Samba / CIFS ako úložisko Proxmox",
+        "tail": " — Rovnaký vzorec prietoku (Metóda A pvesm + metóda B fstab) pre zdieľania SMB/CIFS."
+      },
+      {
+        "href": "/docs/storage-share/lxc-mount-points",
+        "label": "Správca LXC mountov",
+        "tailRich": " Pripojiť cestu, ktorá je určená len pre fstab <code>/mnt/&lt;path&gt;</code> do jedného alebo viacerých kontajnerov."
+      },
+      {
+        "href": "/docs/storage-share/lxc-nfs-client",
+        "label": "NFS klient v LXC",
+        "tail": " Alternatíva: pripojte NFS priamo zvnútra privilegovaného kontajnera (obíde hostiteľa)."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sk/docs/storage-share/host-samba.json b/web/messages/sk/docs/storage-share/host-samba.json
new file mode 100644
index 00000000..dca9ba3c
--- /dev/null
+++ b/web/messages/sk/docs/storage-share/host-samba.json
@@ -0,0 +1,172 @@
+{
+  "meta": {
+    "title": "Hostiteľ: pripojenie zdieľania Samba | Dokumentácia ProxMenux",
+    "description": "Pripojte externé zdieľanie Samba / CIFS na hostiteľovi Proxmox: ako úložisko Proxmox (pvesm add cifs), ako bežné pripojenie cez fstab hostiteľa s otvorenými oprávneniami uid/gid/file_mode (NEZOBRAZUJE sa v Datacenter > Storage), alebo oboma spôsobmi. Metóda fstab otvorí oprávnenia, aby neprivilegovaný LXC s bind mountom tejto cesty mohol čítať a zapisovať bez zmien v kontajneri.",
+    "ogTitle": "Hostiteľ: pripojenie zdieľania Samba | Dokumentácia ProxMenux",
+    "ogDescription": "Pripojte externé zdieľanie Samba / CIFS na hostiteľovi Proxmox cez pvesm, fstab s otvorenými oprávneniami pre bind mounty LXC alebo oboje."
+  },
+  "header": {
+    "title": "Hostiteľ: pripojiť zdieľanie Samba na hostiteľovi",
+    "description": "Pripojte externé zdieľanie Samba (SMB / CIFS) z NAS, počítača Windows alebo exportu SMB TrueNAS na hostiteľovi Proxmox. Vyberte jeden alebo oba spôsoby: registráciu úložiska Proxmox viditeľného v Datacenter > Storage a samostatné pripojenie cez /etc/fstab na zvolenú cestu. Otvorené voľby uid/gid/file_mode umožnia neprivilegovaným LXC používať bind mount bez zmien vnútri kontajnera.",
+    "section": "Úložisko a zdieľanie · hostiteľ"
+  },
+  "intro": {
+    "title": "Čo to robí?",
+    "body": "ProxMenux ponúka dva spôsoby pripojenia zdieľania Samba: <strong>(1) Úložisko Proxmox</strong> cez <code>pvesm add cifs</code>, viditeľné v Datacenter > Storage a pripojené do <code>/mnt/pve/&lt;id&gt;</code>. Heslo sa uchováva v otvorenom texte v <code>/etc/pve/priv/storage/&lt;id&gt;.pw</code>, chránené súkromným adresárom prístupným iba root. Ide o riadenie prístupu, nie šifrovanie. <strong>(2) Pripojenie fstab na hostiteľovi</strong> do zvolenej cesty, trvalé cez <code>/etc/fstab</code> a s voľbami <code>uid=0,gid=0,file_mode=0777,dir_mode=0777</code>, aby neprivilegované LXC mohli zapisovať cez bind mounty. Prihlasovacie údaje sú v súbore pre root v <code>/etc/samba/credentials/</code>, nikdy priamo vo <code>fstab</code>. Možno použiť jeden spôsob alebo oba."
+  },
+  "opening": {
+    "heading": "Otvorenie nástroja",
+    "body": "V hlavnej ponuke ProxMenux otvorte <strong>Storage &amp; Share Manager → Mount Samba Share on Host</strong>. Zobrazí sa podponuka so štyrmi možnosťami:",
+    "imageAlt": "Ponuka Samba hostiteľa — Pripojiť / Zobraziť / Odstrániť / Testovať pripojenie"
+  },
+  "howRuns": {
+    "heading": "Ako beží skript",
+    "body": "Postup má dve fázy. Najprv vyhľadá server, overí prihlasovacie údaje, vyberie zdieľanie a spôsoby pripojenia. Potom vykoná iba vybrané metódy. Prihlasovacie údaje potrebuje vopred, pretože <code>smbclient</code> ich používa na výpis zdieľaní. Do záverečného potvrdenia nemení <code>/etc/pve/storage.cfg</code> ani <code>/etc/fstab</code>."
+  },
+  "modes": {
+    "heading": "Výber spôsobu pripojenia (označte jednu alebo obe možnosti)",
+    "intro": "Po výbere zdieľania a overení prihlasovacích údajov zobrazí ProxMenux zoznam dvoch spôsobov pripojenia. Môžete označiť jeden alebo oba. Ak stlačíte OK bez výberu, dialóg sa otvorí znovu. Vyberte aspoň jednu možnosť alebo postup ukončite tlačidlom Zrušiť.",
+    "headerMethod": "Metóda",
+    "headerMount": "Cesta pripojenia",
+    "headerUi": "Viditeľné v datacentre > Úložisko",
+    "headerUseCase": "Typický prípad použitia",
+    "rows": [
+      {
+        "method": "<strong>Ako úložisko Proxmox (pvesm)</strong>",
+        "mountRich": "<code>/mnt/pve/&lt;storage-id&gt;</code> (manažovaný spoločnosťou Proxmox)",
+        "ui": "Áno",
+        "useCase": "Zálohy, obrazy ISO a šablóny LXC — všetko, čo má byť viditeľné v rozhraní Proxmox. Aktívne disky VM sú technicky podporované, ale pri CIFS sa neodporúčajú pre odlišné správanie zámkov."
+      },
+      {
+        "method": "<strong>Iba fstab hostiteľa</strong>",
+        "mountRich": "<code>/mnt/&lt;path&gt;</code> s otvoreným uidom/gid/file_mode",
+        "ui": "Nie",
+        "useCaseRich": "Sprístupnite zdieľanie LXC cez bind mount <em>bez</em> registrácie úložiska Proxmox. Otvorené lokálne oprávnenia pomôžu neprivilegovaným CT, ale zápis stále musí povoliť server SMB overenému používateľovi."
+      },
+      {
+        "method": "<strong>Obe</strong>",
+        "mount": "Obe cesty uvedené vyššie (dva body pripojenia toho istého exportu CIFS)",
+        "ui": "Áno",
+        "useCase": "Chcete UI integráciu A stabilnú cestu na strane hostiteľa s otvorenými právami pre LXC viazanie-mounts. Pripojenie pvesm používa predvolené nastavenia Proxmox; pripojka fstab aplikuje otvorené uid/gid/file_mode samostatne."
+      }
+    ],
+    "bothTitle": "„Oboje“ vytvorí dva body pripojenia CIFS",
+    "bothBody": "pvesm pripojí zdieľanie do <code>/mnt/pve/&lt;id&gt;</code> s predvolenými voľbami Proxmoxu. fstab používa <code>/mnt/&lt;path&gt;</code> s <code>uid=0,gid=0,file_mode=0777,dir_mode=0777</code> na lokálny prístup cez bind mounty LXC. Server SMB stále vynucuje oprávnenia používateľa pripojenia. Dva body pripojenia nezaručujú dve samostatné spojenia TCP."
+  },
+  "pvesmBranch": {
+    "heading": "Metóda A — ako úložisko Proxmox (pvesm)",
+    "intro": "Ak je <em>Ako úložisko Proxmox</em> označený, ProxMenux spustí pôvodný pvesm prietok:",
+    "items": [
+      "<strong>ID skladu</strong> Predvolené <code>cifs-&lt;server-ip-with-dashes&gt;</code>. Iba písmená, číslice, <code>-</code> a <code>_</code>.",
+      "<strong>Typy obsahu</strong> — tento výber ProxMenuxu ponúka <strong>6</strong> možností. Oproti NFS vynecháva <code>rootdir</code>. Ide o rozhodnutie skriptu, nie tvrdenie, že každá verzia backendu CIFS v Proxmoxe zakazuje koreňové súborové systémy LXC:"
+    ],
+    "headerType": "Typ obsahu",
+    "headerAllows": "Čo to umožňuje",
+    "rows": [
+      {
+        "type": "import",
+        "allows": "Import obrazu disku (štandardne vybraný)."
+      },
+      {
+        "type": "backup",
+        "allowsRich": "VM a CT záložné súbory (<code>vzdump</code>)."
+      },
+      {
+        "type": "iso",
+        "allows": "Inštalačné obrazy ISO."
+      },
+      {
+        "type": "vztmpl",
+        "allows": "Šablóny LXC."
+      },
+      {
+        "type": "images",
+        "allowsRich": "Obrazy diskov používaných VM — <strong>s varovaním v dialógu</strong>, pozrite nižšie."
+      },
+      {
+        "type": "snippets",
+        "allows": "Hook skripty a snippet súbory cloud-init."
+      }
+    ],
+    "warnTitle": "Živé disky VM na CIFS",
+    "warnBody": "Výber <code>images</code> zobrazí varovanie ProxMenuxu: CIFS/SMB môže spôsobovať problémy so zámkami pri operáciách s diskami VM. Skript odporúča NFS, ale umožní pokračovať. Zálohy a ISO sú bežným použitím CIFS. Pred použitím pre <code>images</code> posúďte zámky, snímky, migráciu a záťaž.",
+    "credsTitle": "Kde pvesm ukladá údaje",
+    "credsBody": "Heslo sa nezapisuje do <code>/etc/pve/storage.cfg</code>. Proxmox uloží údaje v otvorenom texte do <code>/etc/pve/priv/storage/&lt;storage-id&gt;.pw</code>, v súkromnej oblasti klastrového súborového systému, ktorú môže čítať iba <code>root</code> (režim <code>0600</code>); chránia ich prístupové práva, nie šifrovanie. Po zmene hesla na serveri použite <code>pvesm set &lt;id&gt; --password &lt;new&gt;</code> alebo úložisko odstráňte a pridajte cez ProxMenux."
+  },
+  "fstabBranch": {
+    "heading": "Metóda B — iba pripojenie cez fstab hostiteľa",
+    "intro": "Pri výbere <em>Iba pripojenie cez fstab hostiteľa</em> sa ProxMenux opýta na cestu a trvalé voľby, v režime používateľa vytvorí súbor prihlasovacích údajov iba pre root, pripojí zdieľanie a zapíše položku do <code>/etc/fstab</code>:",
+    "items": [
+      "<strong>Cesta pripojenia k hostiteľovi</strong> Predvolené <code>/mnt/&lt;share-name&gt;</code>. Musí to byť absolútna cesta. Ak je tam niečo už namontované, alebo existuje fstab položka, ProxMenux ponúka, že ho nahradí.",
+      "<strong>Voľby pripojenia</strong> — <em>Čítanie/zápis</em> (predvolené: <code>rw,uid=0,gid=0,file_mode=0777,dir_mode=0777,iocharset=utf8,nofail,_netdev</code>), <em>Iba na čítanie</em> (<code>file_mode=0555,dir_mode=0555</code>), <em>Vlastné</em> (zadajte vlastné voľby). Skript odporúča otvorené uid/gid/file_mode pre zápis cez bind mounty LXC."
+    ],
+    "credsTitle": "Súbor prihlasovacích údajov (režim používateľa)",
+    "credsBody": "V režime používateľa ProxMenux vytvorí súbor údajov iba pre root v <code>/etc/samba/credentials/&lt;server&gt;_&lt;share&gt;.cred</code> (režim <code>0600</code>) s riadkami <code>username=</code> a <code>password=</code>. Položka fstab naň odkazuje cez <code>credentials=</code>; heslo v otvorenom texte nie je v <code>/etc/fstab</code>. V režime hosťa sa pridá <code>guest</code> a súbor údajov sa nevytvorí.",
+    "appliesIntro": "Keď potvrdíte, skript:",
+    "applies": [
+      "Vytvorí adresár bodu pripojenia pomocou <code>mkdir -p</code>.",
+      "<code>mount -t cifs -o &lt;opts&gt;,credentials=&lt;file&gt;</code> (alebo <code>guest</code>) <code>//&lt;srv&gt;/&lt;share&gt; &lt;path&gt;</code>.",
+      "Napíše jednoriadkový zápis do <code>/etc/fstab</code>: <code>//&lt;srv&gt;/&lt;share&gt; &lt;path&gt; cifs &lt;opts&gt; 0 0</code>.",
+      "Spustí <code>systemctl daemon-reload</code> takže systemd zachytí novú fstab položku."
+    ],
+    "lxcTitle": "Použitie pripojenia fstab z neprivilegovaného LXC",
+    "lxcBody": "Voľby CIFS <code>uid=0,gid=0,file_mode=0777,dir_mode=0777</code> otvoria lokálne kontroly oprávnení pre bind mounty LXC. ACL servera a dohodnutá sémantika Unix/POSIX môžu prístup stále ovplyvniť. <strong>V kontajneri sa nič nemení</strong>: žiadne <code>chown</code> v CT, skupiny ani úpravy <code>/etc/lxc</code>. Riadok <code>mp</code> spravuje Proxmox v konfigurácii CT. Použite vypísaný príkaz <code>pct set</code> alebo <mountLink>LXC Mount Manager</mountLink>.",
+    "noUiTitle": "Pripojenie fstab NIE JE úložiskom Proxmox",
+    "noUiBody": "Hostiteľský fstab mount je neviditeľný pre web Proxmox UI — podľa návrhu. Nezobrazuje sa v <em>Datacenter > Storage</em>, nemôžete ho vybrať v tvorcovi VM / CT a úlohy zálohovania Proxmox sa naň nemôžu zamerať. Je to čisto cesta hostiteľského súborového systému. Ak chcete aj integráciu UI, označte vo výbere <em>obe</em> metódy."
+  },
+  "manual": {
+    "heading": "Ručný ekvivalent",
+    "pvesmIntro": "Metóda A (pvesm) zodpovedá:",
+    "fstabUserIntro": "Metóda B (fstab, overenie používateľa) — súbor prihlasovacích údajov a pripojenie:",
+    "fstabGuestIntro": "Metóda B (fstab, hosť) — bez súboru prihlasovacích údajov:"
+  },
+  "view": {
+    "heading": "Zobraziť úložiská CIFS a pripojenia hostiteľa",
+    "body": "Zobrazí registrované úložiská CIFS (<code>pvesm status | awk ''$2 == \"cifs\"''</code>) so serverom, zdieľaním, obsahom, používateľom alebo <em>hosťom</em>, cestou a stavom. Heslá <strong>nikdy nevypisuje</strong>. <strong>Poznámka:</strong> druhá časť vypíše pripojenia fstab hostiteľa, voľby, cestu súboru údajov a aktívny/neaktívny stav. Ručne overte pomocou <code>findmnt -t cifs</code> alebo <code>grep cifs /etc/fstab</code>."
+  },
+  "remove": {
+    "heading": "Odstrániť úložisko CIFS alebo pripojenie hostiteľa",
+    "body": "Výber ponúka úložiská pvesm aj pripojenia fstab hostiteľa. Pri pvesm spustí <code>pvesm remove &lt;storage-id&gt;</code> a Proxmox odstráni príslušné údaje. Pri fstab skúsi <code>umount &lt;path&gt;</code>, odstráni položku z <code>/etc/fstab</code>, údaje z <code>/etc/samba/credentials/</code> a podľa možnosti prázdny adresár. Neúspešné odpojenie vyžaduje ručné odpojenie alebo reštart. <strong>Vzdialený server Samba a jeho súbory sa nemenia</strong>.",
+    "warnTitle": "Zálohovanie závislostí najprv",
+    "warnBody": "VM, CT alebo úlohy zálohovania odkazujúce na ID tohto úložiska po odstránení zlyhajú. Pred odstránením úložiska odkazy presuňte alebo odstráňte."
+  },
+  "test": {
+    "heading": "Testovať Samba konektivitu",
+    "body": "Diagnostika každého úložiska CIFS registrovaného v Proxmoxe: overí dostupnosť <code>smbclient</code>, ping, porty 445/139, skúsi výpis zdieľaní ako hosť a zobrazí stav podľa Proxmoxu (<code>pvesm status</code>). „Vyžaduje overenie“ pri výpise hosťa znamená, že server sprístupňuje zdieľania iba overeným používateľom, čo je bežné pre väčšinu NAS."
+  },
+  "troubleshoot": {
+    "heading": "Riešenie problémov",
+    "noServersTitle": "\"Žiadne Samba servery nájdené v sieti\"",
+    "noServersBody": "Automatické vyhľadávanie používa <code>nmap -p 139,445</code>. Server môže byť na inej podsiete, firewalled, alebo len dosiahnuteľný podľa mena hostiteľa (mDNS / WINS). Použite možnosť <em>Manual</em> s IP alebo názov hostiteľa.",
+    "noSharesTitle": "„Nenašli sa dostupné zdieľania“",
+    "noSharesBody": "<code>smbclient -L</code> pre tieto údaje nič nevrátil. Používateľ nemusí mať právo vypísať zdieľania (skúste raz administrátorské údaje alebo zadajte názov ručne), server môže mať vypnutú viditeľnosť zdieľaní alebo sú údaje nesprávne. V takom prípade skript umožní zadať názov zdieľania ručne.",
+    "denyTitle": "Pripojenie v Proxmoxe zlyhá s NT_STATUS_ACCESS_DENIED",
+    "denyBody": "Poverenia pvesm uložené sú mimo synchronizáciu so serverom Samba (zmenilo sa heslo, účet vypnutý, nesúlad domény / pracovnej skupiny). Opätovne zadať údaje <code>pvesm set &lt;id&gt; --username &lt;u&gt; --password &lt;p&gt;</code> alebo odstrániť a opätovne pridať z ProxMenux. Ak je server v doméne AD, pripojte <code>--domain &lt;DOMAIN&gt;</code> k hovoru <code>pvesm set</code>.",
+    "sleepTitle": "\"host je dole\" alebo stav úložiska je neaktívny v noci",
+    "sleepBody": "Niektoré NAS spotrebiče dali SMB do agresívneho spánku. <code>pvestatd</code> potom vidí úložisko ako neaktívne, kým prvý prístup prebudí NAS. Ak je to kozmetické, nič nie je pokazené. Ak to spôsobí poruchy zálohovania, zakázať SMB vypnuté odpojenie na NAS alebo plán záloh mimo okna spánku.",
+    "lxcNoWriteTitle": "Neprivilegovaný LXC nemôže zapisovať do cesty fstab cez bind mount",
+    "lxcNoWriteBody": "Pomocou <code>findmnt /mnt/&lt;path&gt;</code> overte požadované voľby, napríklad <code>uid=0,gid=0,file_mode=0777,dir_mode=0777</code>. Chýbajúci lokálny zápis môže blokovať mapované UID LXC. Znova použite profil RW alebo upravte vlastné voľby. Overte aj právo zápisu používateľa SMB na serveri a či rozšírenia Unix/POSIX poskytujú režimy servera. Otvorené lokálne režimy neobídu ACL servera.",
+    "fstabBootTitle": "fstab mount nepríde po reštarte",
+    "fstabBootBody": "Skript pridáva <code>nofail,_netdev</code>, aby nedostupné zdieľanie pri štarte neblokovalo spúšťanie systému. Ak sa nepripojí vôbec, overte sieť pomocou <code>ping &lt;server&gt;</code>, skontrolujte <code>journalctl -u remote-fs.target</code>, existenciu a čitateľnosť súboru s údajmi pomocou <code>ls -l /etc/samba/credentials/</code> a skúste ručne spustiť <code>mount -a</code>."
+  },
+  "related": {
+    "heading": "Súvisiace",
+    "items": [
+      {
+        "href": "/docs/storage-share/host-nfs",
+        "label": "Zdieľanie NFS ako úložisko Proxmox",
+        "tail": " — súvisiaca stránka s rovnakým postupom (metóda A pvesm + metóda B fstab) a porovnaním výhod a nevýhod."
+      },
+      {
+        "href": "/docs/storage-share/lxc-mount-points",
+        "label": "Správca LXC mountov",
+        "tailRich": " Pripojiť cestu, ktorá je určená len pre fstab <code>/mnt/&lt;path&gt;</code> do jedného alebo viacerých kontajnerov."
+      },
+      {
+        "href": "/docs/storage-share/lxc-samba-client",
+        "label": "Samba klient v LXC",
+        "tail": " Alternatíva: pripojte Samba priamo zvnútra privilegovaného kontajnera (obíde hostiteľa)."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sk/docs/storage-share/index.json b/web/messages/sk/docs/storage-share/index.json
new file mode 100644
index 00000000..957518f0
--- /dev/null
+++ b/web/messages/sk/docs/storage-share/index.json
@@ -0,0 +1,135 @@
+{
+  "meta": {
+    "title": "Proxmox NFS, Samba, iSCSI a body pripojenia LXC — Úložisko a zdieľanie | ProxMenux",
+    "description": "Integrujte externé aj lokálne úložisko do Proxmox VE a zdieľajte priečinky medzi hostiteľom a kontajnermi LXC. Pridajte zdieľania NFS, Samba (CIFS) a ciele iSCSI ako úložisko Proxmox, nastavte bind mounty LXC cez Mount Manager a prevádzkujte klientov a servery NFS alebo Samba v kontajneroch.",
+    "ogTitle": "Proxmox NFS, Samba, iSCSI a body pripojenia LXC — Úložisko a zdieľanie",
+    "ogDescription": "Integrácia externých a lokálnych úložísk do Proxmox VE: registrácia NFS, Samba a iSCSI, bind mounty LXC a zdieľanie cez sieť.",
+    "twitterTitle": "Proxmox NFS, Samba, iSCSI | ProxMenux",
+    "twitterDescription": "Pridajte NFS / Samba / iSCSI ako úložisko Proxmox a zdieľajte priečinky medzi hostiteľom a LXC."
+  },
+  "header": {
+    "title": "Správca úložísk a zdieľania",
+    "description": "Integrujte externé alebo lokálne úložisko do Proxmox VE a zdieľajte priečinky medzi hostiteľom a kontajnermi LXC. Tri skupiny nástrojov: integrácia úložiska hostiteľa (registrácia priamo v Proxmoxe), LXC Mount Manager (bind mounty s praktickou správou oprávnení) a sieťové zdieľanie LXC (postupy klienta a servera NFS alebo Samba pre konkrétne prípady použitia).",
+    "section": "Úložisko a zdieľanie"
+  },
+  "intro": {
+    "title": "Na čo je toto menu",
+    "body": "Disk Manager pracuje na úrovni <em>jednotlivých fyzických diskov</em>. Storage &amp; Share Manager pracuje o úroveň vyššie — <strong>registruje úložné pooly a sieťové zdieľania v Proxmoxe</strong> (aby ich mohlo používať rozhranie a nástroj na vytváranie VM) a <strong>nastavuje zdieľanie súborov medzi hostiteľom a kontajnermi</strong>."
+  },
+  "opening": {
+    "heading": "Otvorenie menu",
+    "body": "V hlavnej ponuke ProxMenux vyberte <strong>Storage &amp; Share Manager</strong>. Zobrazí sa toto:",
+    "imageAlt": "Menu správcu úložiska a zdieľania s blokmi HOST a LXC"
+  },
+  "groups": {
+    "heading": "Tri skupiny nástrojov",
+    "intro": "Ponuka je rozdelená na tri skupiny. <strong>Integrácia úložiska hostiteľa</strong> registruje externé alebo lokálne úložisko priamo v Proxmoxe. <strong>LXC Mount Manager</strong> je hlavný nástroj na zdieľanie priečinkov s kontajnermi — praktický postup bind mountu, ktorý na strane hostiteľa rieši mapovanie UID neprivilegovaných CT. <strong>Sieťové zdieľanie LXC</strong> zahŕňa štyri ďalšie scenáre, pri ktorých kontajner potrebuje priamo <em>používať</em> alebo <em>sprístupňovať</em> zdieľania NFS alebo Samba.",
+    "hostTitle": "Úložisko hostiteľa",
+    "hostBody": "Zaregistrujte externé a lokálne úložisko v Proxmoxe cez <code>pvesm add …</code>. Po registrácii, úložisko sa objaví v Proxmox UI a je k dispozícii pre VM a CT tvorcov.",
+    "hostItems": [
+      "Externé NFS / Samba / iSCSI → Úložisko Proxmox",
+      "Lokálny disk → Adresár Proxmox alebo pamäť ZFS",
+      "Lokálny zdieľaný adresár (pre bind mounty medzi CT)"
+    ],
+    "lxcMountTitle": "Správca LXC mountov",
+    "lxcMountBody": "Hlavný nástroj na zdieľanie LXC. Cez <code>pct set -mpN</code> sprístupňuje adresáre hostiteľa v kontajneroch pomocou bind mountov a rieši osobitosti oprávnení neprivilegovaných CT bez vytvárania skupín alebo používateľov v kontajneri.",
+    "lxcMountItems": [
+      "Pracuje s privilegovanými a neprivilegovanými CT",
+      "Ponúka nastavenie <code>o+rwx</code> v adresári hostiteľa pre neprivilegované UID",
+      "V prípade potreby opraví existujúce pripojenia CIFS a NFS"
+    ],
+    "lxcNetTitle": "Sieťové zdieľanie v LXC",
+    "lxcNetBody": "Štyri ďalšie postupy pre kontajnery, ktoré potrebujú priamo používať alebo sprístupňovať zdieľania NFS alebo Samba. Všetky vyžadujú <strong>privilegovaný</strong> kontajner.",
+    "lxcNetItems": [
+      "<strong>Klient</strong> NFS / Samba (používanie externých zdieľaní)",
+      "<strong>Server</strong> NFS / Samba (sprístupňovanie priečinkov CT)"
+    ]
+  },
+  "host": {
+    "heading": "Napojenie úložiska na hosta",
+    "intro": "Zaregistrujte skladovanie v Proxmox. Každá možnosť volá <code>pvesm add …</code> pod kapotou, takže úložisko sa zobrazí v <strong>Datacenter → Úložisko</strong> a stáva sa k dispozícii pre tvorcov VM / CT.",
+    "options": [
+      {
+        "href": "/docs/storage-share/host-nfs",
+        "icon": "Network",
+        "title": "Pridať NFS zdieľanie ako Proxmox úložisko",
+        "description": "Zaregistruje externý export NFS ako úložisko Proxmox pomocou pvesm add nfs. Pripojenie spravuje Proxmox, bez ďalších záznamov vo fstab."
+      },
+      {
+        "href": "/docs/storage-share/host-samba",
+        "icon": "Share2",
+        "title": "Pridať Samba zdieľanie ako Proxmox úložisko",
+        "description": "Zaregistruje externé zdieľanie Samba alebo CIFS ako úložisko Proxmox pomocou pvesm add cifs. Proxmox spravuje pripojenie aj prihlasovacie údaje."
+      },
+      {
+        "href": "/docs/storage-share/host-iscsi",
+        "icon": "Database",
+        "title": "Pridať iSCSI target ako Proxmox úložisko",
+        "description": "Pripojte sa k externému iSCSI cieľu a zaregistrujte ho ako úložisko Proxmox (blokové zariadenie) pre obrazy VM disku."
+      },
+      {
+        "href": "/docs/storage-share/host-local-disk",
+        "icon": "HardDrive",
+        "title": "Pridať lokálny disk ako Proxmox úložisko",
+        "description": "Naformátujte lokálny disk SATA / SAS / NVMe a zaregistrujte ho ako adresár Proxmox alebo ZFS pool úložisko."
+      },
+      {
+        "href": "/docs/storage-share/host-local-shared",
+        "icon": "FolderOpen",
+        "title": "Pridať zdieľaný priečinok na hoste",
+        "description": "Vytvorte adresár na hostiteľovi určený na sprístupnenie viacerým CT pomocou bind mountov. Nejde o úložisko Proxmox — je to iba prostriedok na strane hostiteľa pre bind mounty LXC."
+      }
+    ]
+  },
+  "lxcMount": {
+    "heading": "Správca LXC mountov",
+    "intro": "Hlavný nástroj na zdieľanie priečinkov medzi hostiteľom Proxmox a kontajnermi LXC. Používa <code>pct set -mpN</code> na bind mount adresára hostiteľa do kontajnera a na strane hostiteľa rieši osobitosti oprávnení neprivilegovaných CT (v kontajneri sa nevytvárajú skupiny ani používatelia).",
+    "card": {
+      "title": "Body pripojenia LXC (hostiteľ ↔ CT)",
+      "description": "Sprístupnite ľubovoľný adresár hostiteľa kontajneru LXC cez bind mount pomocou pct set -mpN. Funguje s privilegovanými aj neprivilegovanými CT, ponúka chmod o+rwx a ACL pre adresár na hostiteľovi a podľa potreby opraví existujúce pripojenia CIFS alebo NFS."
+    }
+  },
+  "lxcNet": {
+    "heading": "Sieťové zdieľanie v LXC",
+    "intro": "Tieto postupy použite, ak kontajner potrebuje <em>byť</em> koncovým bodom NFS alebo Samba — používať externé zdieľanie (klient) alebo sprístupňovať vlastné priečinky (server). Pre väčšinu potrieb zdieľania (bind mounty hostiteľ ↔ CT) je <mountLink>LXC Mount Manager</mountLink> jednoduchší a nevyžaduje privilegované kontajnery.",
+    "options": [
+      {
+        "href": "/docs/storage-share/lxc-nfs-client",
+        "icon": "Download",
+        "title": "NFS klient v LXC",
+        "description": "Pripájajte externé zdieľania NFS z privilegovaného kontajnera LXC. Podporuje automatické vyhľadanie, trvalé nastavenie v /etc/fstab a čisté odpojenie."
+      },
+      {
+        "href": "/docs/storage-share/lxc-samba-client",
+        "icon": "Download",
+        "title": "Samba klient v LXC",
+        "description": "Pripájajte zdieľania Samba / CIFS z privilegovaného kontajnera LXC. Prihlasovacie údaje sa ukladajú chráneným spôsobom a je dostupné automatické vyhľadanie."
+      },
+      {
+        "href": "/docs/storage-share/lxc-nfs-server",
+        "icon": "Upload",
+        "title": "NFS server v LXC",
+        "description": "Exportovať priečinky cez NFS z vo vnútri privilegovaného LXC kontajnera."
+      },
+      {
+        "href": "/docs/storage-share/lxc-samba-server",
+        "icon": "Upload",
+        "title": "Samba server v LXC",
+        "description": "Sprístupniť priečinky cez SMB / CIFS z privilegovaného LXC kontajnera."
+      }
+    ]
+  },
+  "privReq": {
+    "title": "Požiadavka na privilegovaný kontajner",
+    "body": "Štyri uvedené postupy <strong>sieťového zdieľania LXC</strong> vyžadujú <strong>privilegovaný</strong> kontajner. Skripty tento podporovaný režim overujú pred nastavením služieb a pripájacích nástrojov (<code>nfs-kernel-server</code>, <code>smbd</code>, <code>mount.nfs</code>, <code>mount.cifs</code>). Ak potrebujete len zdieľať súbory medzi hostiteľom a neprivilegovaným CT, použite <mountLink>LXC Mount Manager</mountLink> — vytvorí bind mount a upraví oprávnenia na hostiteľovi, takže kontajner môže čítať a zapisovať bez nastavenia týchto služieb či nástrojov vo svojom vnútri."
+  },
+  "unprivExplain": {
+    "title": "Ako ProxMenux spracováva neprivilegované práva CT",
+    "body": "Neprivilegované kontajnery LXC posúvajú svoje UID na hostiteľovi o <strong>+100000</strong> (UID 0 v kontajneri = UID 100000 na hostiteľovi, UID 1000 v kontajneri = UID 101000 na hostiteľovi, …). Súbor vytvorený používateľom kontajnera sa preto na hostiteľovi javí ako <em>ostatní</em> — nezodpovedá bežnému používateľovi ani skupine hostiteľa. LXC Mount Manager to rieši prakticky: namiesto zosúlaďovania UID/GID medzi hostiteľom a CT ponúka <code>chmod o+rwx</code> a zodpovedajúce ACL v adresári hostiteľa, aby každé mapované UID mohlo čítať a zapisovať. CIFS znova pripojí s <code>uid=0,gid=0,file_mode=0777,dir_mode=0777</code>; pri NFS nastaví adresár zapisovateľný všetkými so sticky bitom a pri root squash poradí so správnou úpravou na serveri."
+  },
+  "scripts": {
+    "heading": "Uvedené skripty",
+    "intro": "Každá jednotlivá stránka odkazuje na skript, ktorý riadi jej tok. Nižšie uvedený súbor je zdieľaný pomocník, ktorý nie je zdokumentovaný ako jeho vlastná stránka, ale je používaný niekoľkými z LXC sieťových tokov:",
+    "itemTail": " — spoločné pomocné funkcie pre klientov a servery LXC: overenie CT, výber bodu pripojenia, kontrola privilegovaného režimu a nastavenie univerzálnej skupiny."
+  }
+}
diff --git a/web/messages/sk/docs/storage-share/lxc-mount-points.json b/web/messages/sk/docs/storage-share/lxc-mount-points.json
new file mode 100644
index 00000000..39cba7ef
--- /dev/null
+++ b/web/messages/sk/docs/storage-share/lxc-mount-points.json
@@ -0,0 +1,174 @@
+{
+  "meta": {
+    "title": "Body pripojenia LXC (hostiteľ ↔ kontajner) | Dokumentácia ProxMenux",
+    "description": "LXC Mount Manager sprístupní adresár hostiteľa jednému alebo viacerým kontajnerom LXC cez bind mount pomocou pct set -mpN. Rieši osobitosti oprávnení neprivilegovaných kontajnerov, opravuje pripojenia CIFS a NFS na hostiteľovi a vnútri kontajnera nič nemení.",
+    "ogTitle": "Body pripojenia LXC (hostiteľ ↔ kontajner) | Dokumentácia ProxMenux",
+    "ogDescription": "Sprístupnite adresáre hostiteľa kontajnerom LXC cez bind mount. Prakticky rieši mapovanie UID neprivilegovaných kontajnerov a opravuje prístup CIFS / NFS na hostiteľovi."
+  },
+  "header": {
+    "title": "Body pripojenia LXC (hostiteľ ↔ kontajner)",
+    "description": "Hlavný nástroj na zdieľanie priečinkov medzi hostiteľom Proxmox a kontajnermi LXC. Sprístupní ľubovoľný adresár hostiteľa jednému alebo viacerým kontajnerom cez bind mount pomocou natívnej syntaxe pct set -mpN. Oprávnenia neprivilegovaných kontajnerov rieši na hostiteľovi a vnútri kontajnera nič nemení.",
+    "section": "Úložisko a zdieľanie · LXC"
+  },
+  "intro": {
+    "title": "Čo to robí?",
+    "body": "Vyberte adresár na hostiteľovi Proxmox (lokálny priečinok, pripojené zdieľanie NAS alebo úložisko spravované Proxmoxom) a sprístupnite ho v kontajneri LXC na zvolenej ceste. Oprávnenia fungujú aj pre neprivilegované kontajnery bez zmien vnútri kontajnera."
+  },
+  "bigPicture": {
+    "heading": "Ako to funguje (veľký obraz)",
+    "intro": "Pri bind mounte Proxmox požiada jadro, aby adresár <code>X</code> hostiteľa zobrazovalo aj na ceste <code>Y</code> v kontajneri. Bez kopírovania, synchronizácie či siete: obe strany vidia súčasne <em>tie isté súbory</em>.",
+    "sourceLabel": "Hostiteľ Proxmox",
+    "sourceDetail": "/mnt/data\n(váš priečinok)",
+    "targetLabel": "Kontajner LXC",
+    "targetDetail": "/mnt/data\n(Ukazuje sa tu)",
+    "arrowLabel": "bind mount",
+    "outro": "Cesta hostiteľa vľavo a cesta kontajnera vpravo sa môžu líšiť. Napríklad <code>/mnt/nas-films</code> na hostiteľovi môže byť <code>/media/films</code> v kontajneri. Skript pridá položku do konfigurácie kontajnera (<code>/etc/pve/lxc/&lt;ctid&gt;.conf</code>) s ďalším voľným indexom <code>mpN</code> a dvoma predvolenými nastaveniami:",
+    "items": [
+      "<code>shared=1</code> — označí dáta ako zdieľané, takže ich Proxmox nemigruje s CT. Tento príznak dáta nereplikuje: rovnaká cesta a dáta už musia byť dostupné na cieľovom uzle.",
+      "<code>backup=0</code> — vylúči bind mount zo záloh <code>vzdump</code>. Dáta sú na hostiteľovi a zálohujete ich samostatne."
+    ]
+  },
+  "perms": {
+    "heading": "Spracovanie oprávnení",
+    "intro": "Bind mounty sú v princípe jednoduché. Náročné sú oprávnenia: <strong>neprivilegovaný</strong> kontajner LXC posúva UID o <strong>+100000</strong>, takže súbor vytvorený používateľom 1000 v CT má na hostiteľovi UID 101000, ktoré nepatrí bežnému účtu hostiteľa. ProxMenux namiesto zjednocovania UID hostiteľa a kontajnerov upraví oprávnenia na strane <em>hostiteľa</em> podľa typu adresára:",
+    "headerType": "Typ adresára hostiteľa",
+    "headerAction": "Čo skript ponúka vykonať",
+    "localType": "Lokálny priečinok",
+    "localTypeSub": "napr. /mnt/data",
+    "localActionRich": "<code>chmod o+rwx</code> + <code>setfacl o::rwx</code> v adresári hostiteľa. Ponúka sa len vtedy, ak CT nie je privilegované a aktuálne práva sú nedostatočné.",
+    "cifsType": "Pripojené CIFS / SMB",
+    "cifsTypeSub": "napr. /mnt/pve/cifs-…",
+    "cifsActionRich": "Znova pripojiť s <code>uid=0, gid=0, file_mode=0777, dir_mode=0777</code>, takže CT (akékoľvek UID) môže čítať a zapisovať do zdieľania. <code>/etc/fstab</code> je aktualizovaný.",
+    "nfsType": "Pripojená NFS",
+    "nfsTypeSub": "napr. /mnt/pve/nfs-…",
+    "nfsActionRich": "<code>chmod 1777</code> a <code>setfacl o::rwx</code> na pripojení NFS. Neobídu squashing na serveri: ak nemôže zapisovať ani root hostiteľa, skript poradí upraviť export na serveri NFS.",
+    "privTitle": "Privilegované kontajnery nepotrebujú nič z toho.",
+    "privBody": "V privilegovanom CT je UID 0 rovnaké ako UID 0 hostiteľa. Používateľ root v CT preto môže priamo čítať a zapisovať do adresára hostiteľa bez úprav oprávnení. Skript to rozpozná a úpravu oprávnení úplne preskočí.",
+    "noCtTitle": "Skript nikdy nemení nič vnútri kontajnera",
+    "noCtBody": "Všetky úpravy oprávnení prebiehajú na <strong>súborovom systéme hostiteľa</strong>. Žiadne zmeny vlastníkov cez <code>pct exec</code>, vytváranie skupín v CT ani fstab v kontajneri. Pri neskoršom použití toho istého adresára v inom CT platia rovnaké oprávnenia automaticky, bez nastavovania každého kontajnera."
+  },
+  "writes": {
+    "heading": "Čo ProxMenux píše a čo nie",
+    "intro": "Bežný zmätok pri pripájaní väzby do neprivilegovaného CT: ľudia predpokladajú, že ProxMenux musí zapisovať <code>lxc.idmap</code> položky do <code>/etc/pve/lxc/&lt;CTID&gt;.conf</code>. <strong>Nie.</strong> K tomuto súboru je pripojený iba jeden riadok – samotný bind mount:",
+    "outro": "Výstupný riadok na konci <em>„Neprivilegovaný kontajner — posun UID: 100000“</em> je len informačný. Oznamuje predvolené neprivilegované mapovanie Proxmoxu (root v CT = UID 100000 hostiteľa). Skript toto mapovanie nijako nenastavuje.",
+    "twoWaysHeading": "Dva spôsoby riešenia oprávnení — a prečo si ProxMenux vyberá jeden",
+    "headerApproach": "Prístup",
+    "headerChanges": "Čo to mení",
+    "headerWhen": "Kedy je vhodný",
+    "hostType": "Oprávnenia na hostiteľovi",
+    "hostTypeSub": "(čo tento scenár robí)",
+    "hostChangesRich": "<code>chmod o+rwx</code> + <code>setfacl o::rwx</code> v adresári hostiteľa. CT zmapované UID (100000+) spadajú do \"ostatných\" vedra, takže otvorenie <em>ostatní</em> je dosť.",
+    "hostWhen": "Všeobecný prístup k zdieľanému priečinku z ľubovoľného CT. Viaceré CT používajú rovnaký adresár hostiteľa. Jednoduché a opakovane použiteľné.",
+    "idmapTypeRich": "<code>lxc.idmap</code>",
+    "idmapTypeSub": "(nepoužitý týmto skriptom)",
+    "idmapChangesRich": "Vlastné UID/GID mapovanie v <code>/etc/pve/lxc/&lt;CTID&gt;.conf</code> plus zodpovedajúce <code>/etc/subuid</code> + <code>/etc/subgid</code> položky na hostiteľa. CT sa musí reštartovať pri každej zmene.",
+    "idmapWhenRich": "Potrebujete <em>špecifickú</em> UID vnútri CT mapovať na <em>špecifickú</em> UID na hostiteľa (napr. <code>media:1000</code> v CT musí vlastniť súbory ako <code>media:1000</code> na hostiteľa, takže NFS nemá squash). Pevnejšie nastavenie, zvyčajne stojí za to len pre tento presný scenár.",
+    "idmapTipTitle": "Keď skutočne potrebujete lxc.idmap",
+    "idmapTipBody": "Ručné mapovanie použite, ak majú súbory z CT na hostiteľovi patriť konkrétnemu číselnému UID/GID, napríklad spoločnému vlastníkovi s používateľom hostiteľa. Neobíde NFS <code>all_squash</code>; anonymnú identitu a oprávnenia stále určuje server. Podľa potreby ručne pridajte položky <code>lxc.idmap</code>. Riadok bind mountu je od nich nezávislý."
+  },
+  "opening": {
+    "heading": "Otvorenie nástroja",
+    "body": "V hlavnej ponuke ProxMenux otvorte <strong>Storage &amp; Share Manager → Configure LXC Mount Points (Host ↔ Container)</strong>. Zobrazí sa podponuka s tromi možnosťami:",
+    "imageAlt": "Ponuka LXC Mount Manager — Pridať / Zobraziť / Odstrániť"
+  },
+  "addFlow": {
+    "heading": "Pridať pripojenie — celý postup",
+    "intro": "Technický pohľad, pre kedy chcete presne vedieť, čo robí každý dialóg:"
+  },
+  "sources": {
+    "heading": "Čo si môžete vybrať ako hostiteľský adresár",
+    "intro": "Výber adresára hostiteľa je najpodrobnejší v časti Úložisko a zdieľanie. Prehľadá štyri zdroje a ponúkne zoznam bez duplicít:",
+    "headerSource": "Zdroj",
+    "headerWhere": "Odkiaľ pochádza",
+    "headerLabel": "Štítok v menu",
+    "rows": [
+      {
+        "source": "Aktívne sieťové pripojenia",
+        "whereRich": "Aktuálne pripojené zdieľania CIFS / NFS načítané z <code>/proc/mounts</code>.",
+        "labelRich": "<code>NFS [used/size]</code> alebo <code>CIFS/SMB [used/size]</code>"
+      },
+      {
+        "source": "Neaktívne pripojenia fstab",
+        "whereRich": "Definované v <code>/etc/fstab</code>, ale momentálne nie sú namontované.",
+        "labelRich": "<code>fstab(off)-NFS</code> / <code>fstab(off)-CIFS/SMB</code>"
+      },
+      {
+        "source": "Miestne adresáre",
+        "whereRich": "Sub-adresáre pod <code>/mnt</code>, ktoré nie sú sieťové pripojenia.",
+        "labelRich": "<code>Local [size]</code>"
+      },
+      {
+        "source": "Úložiská Proxmox",
+        "whereRich": "Skladovacie cesty pod <code>/mnt/pve/*</code> (NFS / CIFS registrované cez <code>pvesm</code>).",
+        "labelRich": "<code>PVE-NFS</code> / <code>PVE-CIFS/SMB</code> / <code>Proxmox-Storage</code>"
+      },
+      {
+        "source": "Ručný záznam",
+        "where": "Čokoľvek iné, zadajte absolútnu cestu.",
+        "labelRich": "<em>Zadajte cestu manuálne</em>"
+      }
+    ],
+    "tipTitle": "Interné cesty Proxmox sú filtrované",
+    "tipBody": "Výber vynechá interné cesty Proxmoxu (<code>/mnt/pve/local</code>, <code>/mnt/pve/local-lvm</code>, <code>/mnt/pve/backup</code> atď.). Sú vyhradené pre interné použitie a nemali by sa sprístupňovať cez bind mount. Zobrazia sa iba úložiská pridané používateľom."
+  },
+  "manual": {
+    "heading": "Ručný ekvivalent",
+    "privIntro": "Pre privilegovaný kontajner — najjednoduchší prípad bez úprav oprávnení:",
+    "unprivLocalIntro": "Pre neprivilegovaný kontajner s lokálnym adresárom hostiteľa — najprv otvorte oprávnenia na hostiteľovi:",
+    "unprivCifsIntro": "Pre neprivilegovaný kontajner s zdieľaním CIFS už namontovaný na hostiteľa:"
+  },
+  "view": {
+    "heading": "Zobraziť body pripojenia",
+    "body": "Vypíše všetky položky <code>mpN</code> všetkých kontajnerov na hostiteľovi Proxmox, zoskupené podľa ID CT. Zobrazí cestu hostiteľa → cestu kontajnera aj ďalšie voľby. Je to pohľad iba na čítanie, vhodný na kontrolu pred pridaním či odstránením."
+  },
+  "remove": {
+    "heading": "Odstrániť bod pripojenia",
+    "body": "Vyberte kontajner, položku <code>mpN</code> a potvrďte. Skript pomocou <code>pct set --delete mpN</code> odstráni položku z konfigurácie CT a ponúkne reštart bežiaceho kontajnera. Adresár hostiteľa a jeho obsah <strong>zostanú nedotknuté</strong>. Pripojenie môžete neskôr pridať znova alebo ten istý adresár pripojiť inému CT.",
+    "warnTitle": "Bežiace kontajnery potrebujú reštart, aby sa zmeny prejavili",
+    "warnBody": "Pridanie aj odstránenie bodov pripojenia sa zobrazí vo vnútri kontajnera až po reštarte. Skript ponúka jedno kliknutie <code>pct reboot</code> na konci každej operácie; môžete odmietnuť a reštartovať neskôr."
+  },
+  "troubleshoot": {
+    "heading": "Riešenie problémov",
+    "noMountTitle": "Pripojenie sa zobrazuje v pct config, ale nie v kontajneri",
+    "noMountBody": "Bind mounty sa pripájajú pri spustení kontajnera. Ak ste pripojenie pridali počas behu CT, reštartujte ho pomocou <code>pct reboot &lt;ctid&gt;</code>. Ak stále chýba aj po reštarte, príkazom <code>pct config &lt;ctid&gt;</code> overte, že záznam existuje a cesta na hostiteľovi skutočne obsahuje adresár.",
+    "noWriteTitle": "Kontajner môže vidieť adresár, ale nemôže písať",
+    "noWriteBody": "Takmer vždy ide o oprávnenia. Pri neprivilegovanom CT zopakujte opravu oprávnení v skripte; ACL adresára hostiteľa mohol zmeniť rsync, obnova zálohy alebo ručné <code>chmod</code>. Pri CIFS overte voľby na hostiteľovi pomocou <code>findmnt /mnt/pve/cifs-…</code> a hodnoty <code>uid=</code> / <code>gid=</code> / <code>file_mode=</code>.",
+    "alreadyTitle": "\"Táto cesta sa už používa ako bod pripojenia v tomto kontajneri\"",
+    "alreadyBody": "Vybrali ste si rovnakú cestu kontajnera, ktorá je už pripojená k inému adresáru. Buď vyberiete inú cestu kontajnera, alebo najprv odstráňte existujúci bod pripojenia.",
+    "nfsTitle": "NFS prístup zablokovaný aj po použití hostiteľa fix",
+    "nfsIntro": "Váš NFS server je squashing koreň alebo všetky spojenia. Skript to môže detekovať (snaží sa napísať testovací súbor z hostiteľa) a zobrazí usmernenie na strane servera. Dve spoločné serverové opravy pre export:",
+    "nfsItems": [
+      "<code>no_root_squash</code> — privilegované CT môžu zapisovať priamo.",
+      "<code>all_squash,anonuid=65534,anongid=65534</code> pre neprivilegované CT."
+    ],
+    "nfsOutro": "Tieto zmeny sa dejú na serveri NFS (TrueNAS, Synology, váš vlastný export, ...), nie na serveri Proxmox.",
+    "fstabOffTitle": "Pripojenie \"fstab(off) \" položky nič nerobí",
+    "fstabOffBody": "Zoznam zobrazuje položky <code>fstab(off)-</code>, ak je sieťové pripojenie definované vo fstab, ale momentálne nie je pripojené. Skript umožní sprístupniť cestu cez bind mount, no adresár zostane prázdny, kým zdieľanie skutočne nepripojíte príkazom <code>mount &lt;path&gt;</code> na hostiteľovi. Najskôr pripojte zdieľanie a až potom ho sprístupnite CT."
+  },
+  "related": {
+    "heading": "Súvisiace",
+    "items": [
+      {
+        "href": "/docs/storage-share/host-local-shared",
+        "label": "Pridať zdieľaný adresár na hostiteľa",
+        "tailRich": " — Typický prvý krok: pripraviť <code>/mnt/shared</code> na hostiteľa pred viazaním-pripojiť ho do jedného alebo viacerých CT tu."
+      },
+      {
+        "href": "/docs/storage-share/host-nfs",
+        "label": "Pridať NFS zdieľanie ako Proxmox úložisko",
+        "extraHref": "/docs/storage-share/host-samba",
+        "extraLabel": "Pridať Samba zdieľanie ako Proxmox úložisko",
+        "joiner": " / ",
+        "tailRich": " — Najskôr zaregistrujte externé zdieľanie v Proxmoxe, potom priviažte jeho cestu <code>/mnt/pve/&lt;id&gt;</code> do CT tu."
+      },
+      {
+        "href": "/docs/storage-share/lxc-nfs-client",
+        "label": "NFS klient v LXC",
+        "extraHref": "/docs/storage-share/lxc-samba-client",
+        "extraLabel": "Samba klient v LXC",
+        "joiner": " / ",
+        "tail": " - Alternatíva, keď chcete CT sám pripojiť zdieľanie (vyžaduje privilegovaný kontajner)."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sk/docs/storage-share/lxc-nfs-client.json b/web/messages/sk/docs/storage-share/lxc-nfs-client.json
new file mode 100644
index 00000000..b3667eca
--- /dev/null
+++ b/web/messages/sk/docs/storage-share/lxc-nfs-client.json
@@ -0,0 +1,128 @@
+{
+  "meta": {
+    "title": "NFS klient v LXC | ProxMenux Dokumentácia",
+    "description": "Pripojte zdieľania NFS priamo zvnútra kontajnera Proxmox LXC pomocou ProxMenuxu. Skript nainštaluje nfs-common, podporuje automatické vyhľadanie serverov v LAN, trvalé pripojenia cez /etc/fstab a bezpečné spúšťanie systému. Vyžaduje privilegovaný kontajner.",
+    "ogTitle": "NFS klient v LXC | ProxMenux Dokumentácia",
+    "ogDescription": "Pripojte zdieľania NFS z privilegovaného kontajnera LXC. Automatické vyhľadanie, trvalé záznamy v /etc/fstab a bezpečné nastavenia spúšťania."
+  },
+  "header": {
+    "title": "NFS klient v LXC",
+    "description": "Pripojte zdieľania NFS priamo z kontajnera Proxmox LXC. Kontajner sa stáva skutočným klientom NFS: komunikuje so serverom cez sieť, spúšťa mount.nfs a zapisuje do /etc/fstab. ProxMenux nainštaluje nfs-common, pomôže vyhľadať servery a exporty a nastaví bezpečné spúšťanie.",
+    "section": "Úložisko a zdieľanie · LXC"
+  },
+  "privReq": {
+    "title": "Požadovaný privilegovaný kontajner",
+    "body": "Klient NFS používajúci <code>mount.nfs</code> potrebuje schopnosti (aspoň <code>SYS_ADMIN</code>), ktoré neprivilegované LXC neposkytujú. Skript vyžiada výber CT a <strong>skončí, ak je neprivilegovaný</strong>. Ak zdieľanie potrebujete v neprivilegovanom CT, najprv ho pripojte na hostiteľovi Proxmox cez <hostNfsLink>Zdieľanie NFS ako úložisko Proxmox</hostNfsLink> a potom ho sprístupnite CT pomocou bind mountu v <mountLink>LXC Mount Manager</mountLink>."
+  },
+  "what": {
+    "heading": "Čo to robí?",
+    "body": "LXC Mount Manager sprístupňuje CT cestu <em>cez</em> hostiteľa Proxmox. Tento skript namiesto toho poskytne kontajneru <strong>vlastného klienta NFS</strong>: kontajner komunikuje cez sieť, pripája zdieľania priamo zo servera NFS a ukladá ich do vlastného súboru <code>/etc/fstab</code>. Hostiteľ Proxmox nie je súčasťou dátovej cesty.",
+    "diagramServerLabel": "NFS server",
+    "diagramServerDetail": "/export/data",
+    "diagramHostLabel": "Hostiteľ Proxmox",
+    "diagramHostDetail": "(len\nmost siete)",
+    "diagramCtLabel": "LXC (privilegovaný)",
+    "diagramCtDetail": "/mnt/data\nmount.nfs vnútri CT",
+    "diagramArrow": "NFS",
+    "twoWaysTitle": "Dva spôsoby, ako poskytnúť CT NFS prístup — vyberte si jeden",
+    "twoWaysBind": "<strong>Bind mount cez hostiteľa</strong> (<mountLink>LXC Mount Manager</mountLink>): hostiteľ pripojí NFS raz a každý CT dostane rovnakú cestu cez bind mount. Funguje s neprivilegovanými CT. Odporúča sa, ak rovnaké zdieľanie potrebuje viacero CT.",
+    "twoWaysDirect": "<strong>Priame pripojenie NFS v CT</strong> (táto stránka): CT pripojí NFS samostatne. Vyžaduje privilegovaný CT. Hodí sa, ak má CT spravovať vlastné pripojenie a prihlasovacie údaje alebo ak každý CT komunikuje s iným serverom."
+  },
+  "opening": {
+    "heading": "Otvorenie nástroja",
+    "body": "V hlavnej ponuke otvorte <strong>Storage &amp; Share Manager → Nastaviť klienta NFS v LXC (iba privilegovaný)</strong>. ProxMenux najprv vyžiada <strong>výber cieľového CT</strong>, spustí ho, ak je zastavený, a skončí pri neprivilegovanom CT. Potom sa zobrazí táto podponuka:",
+    "imageAlt": "Ponuka klienta NFS — Pripojiť / Zobraziť / Odpojiť / Testovať pripojenie"
+  },
+  "howRuns": {
+    "heading": "Ako beží skript (Mount flow)"
+  },
+  "fstabFlags": {
+    "heading": "Prečo tie fstab vlajky?",
+    "intro": "Pre trvalé pripojenie skript pridáva tri vlajky za štandardné NFS možnosti: <code>_netdev,x-systemd.automount,noauto</code>. Každý z nich rieši skutočný boot-time problém:",
+    "headerFlag": "Vlajka",
+    "headerEffect": "Čo to robí?",
+    "rows": [
+      {
+        "flag": "_netdev",
+        "effect": "Oznámi inicializačnému systému, že toto pripojenie potrebuje sieť. Spúšťanie systému sa nezablokuje čakaním na pripojenie ešte pred dostupnosťou siete."
+      },
+      {
+        "flag": "x-systemd.automount",
+        "effectRich": "Vytvorí jednotku systemd automount: súborový systém sa pripojí až pri prvom prístupe k <code>/mnt/&lt;path&gt;</code>. Nedostupný server NFS pri štarte nezablokuje CT."
+      },
+      {
+        "flag": "noauto",
+        "effect": "Vynechá okamžité pripojenie pri štarte. Spolu s uvedenou jednotkou automount sa súborový systém pripojí až pri prvom prístupe."
+      }
+    ],
+    "netEffectTitle": "Čistý účinok",
+    "netEffectBody": "Súborový systém NFS sa pripojí pri <em>prvom prístupe</em>, nie okamžite pri štarte. Ak server nie je dostupný, prístup môže čakať alebo zlyhať a ovplyvniť služby závislé od danej cesty. Automount znižuje závislosť pri štarte, ale nezaručuje, že výpadok NFS neovplyvní žiadnu službu CT."
+  },
+  "manual": {
+    "heading": "Ručný ekvivalent",
+    "body": "Celý postup zopakujete ručne — každý príkaz sa spúšťa <strong>vo vnútri CT</strong> cez <code>pct exec &lt;ctid&gt; --</code> alebo priamo cez <code>pct enter &lt;ctid&gt;</code>:"
+  },
+  "view": {
+    "heading": "Zobraziť aktuálne pripojenia",
+    "body": "Zobrazí aktívne pripojenia NFS v CT (<code>mount | grep nfs</code>) aj všetky riadky NFS v jeho <code>/etc/fstab</code>. Pri každom zázname fstab sa zobrazí aktuálny stav pripojenia, čo pomáha nájsť trvalé pripojenia neobnovené pri štarte."
+  },
+  "unmount": {
+    "heading": "Odpojiť zdieľanie NFS",
+    "body": "Spojí aktívne pripojenia a položky fstab do jedného zoznamu, umožní výber a <strong>odstráni príslušný riadok z <code>/etc/fstab</code></strong>. Skript <em>nespúšťa</em> <code>umount</code> na aktívnom pripojení — upozorní, že odpojenie sa prejaví až po reštarte CT.",
+    "warnTitle": "Skript odstráni položky fstab, nie aktívne pripojenia",
+    "warnBody": "Ide o zámerné správanie: <code>umount</code> zlyhá s „device busy“, ak pripojenie stále používa proces v CT. Odstránenie záznamu z fstab zabezpečí, že sa pri ďalšom spustení CT neobnoví. Ak ho chcete odpojiť <em>hneď</em> a ste si istí, že ho nič nepoužíva, po skončení skriptu ručne vykonajte <code>pct exec &lt;ctid&gt; -- umount /mnt/&lt;path&gt;</code>."
+  },
+  "test": {
+    "heading": "Test NFS konektivita",
+    "body": "Diagnostika vnútri CT overí inštaláciu <code>nfs-common</code>, beh <code>rpcbind</code> a vypíše aktuálne pripojenia NFS. Potom pri každom serveri NFS uvedenom vo fstab skontroluje ping, port 2049 a <code>showmount -e</code>. Je to vhodný prvý krok, ak sa trvalé pripojenie neobnoví."
+  },
+  "troubleshoot": {
+    "heading": "Riešenie problémov",
+    "privTitle": "Vyžaduje sa privilegovaný kontajner (skript skončí)",
+    "privBody": "Vybrané CT je neprivilegované. Jadro NFS klient potrebuje schopnosť <code>SYS_ADMIN</code>, ktorú neprivilegované CT nevystavujú. Buď previesť CT na privilegované (Disk Manager &amp; konverzie je zdokumentovaný v <importLink>Import Disk na LXC</importLink>) alebo použiť alternatívnu cestu popísanú v varovaní v hornej časti tejto stránky.",
+    "aptTitle": "apt-get install nfs-common fails",
+    "aptIntro": "Skript predpokladá rodinu Debianu CT (<code>apt-get</code>). Ak CT beží Alpine / Arch / Rocky / Alma, inštalačný krok nefunguje ticho. Nainštalujte NFS klienta ručne pre tento distro:",
+    "aptItems": [
+      "Alpine: <code>apk add nfs-utils</code>",
+      "Arch: <code>pacman -S nfs-utils</code>",
+      "Rocky / Alma: <code>dnf install nfs-utils</code>"
+    ],
+    "aptOutro": "Potom znova spustite skript ProxMenux — krok inštalácie preskočí, keď už sú nástroje k dispozícii.",
+    "portTitle": "\"NFS port (2049) is not accessible\"",
+    "portBody": "Ping uspel, ale <code>nc -z &lt;server&gt; 2049</code> zlyhal zvnútra CT. Skontrolujte, či služba NFS beží na serveri, či firewall umožňuje 2049 zo siete CT a či má CT skutočne platnú sieťovú trasu (skúste <code>pct exec &lt;ctid&gt; -- ip route</code>).",
+    "bootTitle": "Trvalé pripojenie funguje, ale po štarte sa neobnoví",
+    "bootBody": "Príčinou býva nepripravená sieť pri pripájaní v CT, nedostupný server pri štarte alebo nefungujúce DNS pri štarte. Prvý problém riešia voľby <code>_netdev,x-systemd.automount,noauto</code>; ak ste záznam fstab vytvorili ručne bez nich, pridajte pripojenie znovu cez skript. Automount čaká na prvý prístup, čo je bežné správanie. Pri probléme s DNS použite IP adresu servera namiesto názvu.",
+    "squashTitle": "Server squashes root, žiadny prístup k zápisu z vnútra CT",
+    "squashIntro": "Export NFS používa <code>root_squash</code> (štandardne) a CT píše ako root. Dve možnosti:",
+    "squashItems": [
+      "Server-strana: zmeňte export na <code>no_root_squash</code> (iba ak veríte CT).",
+      "Na strane CT zapisujte ako používateľ mimo root, ktorého server akceptuje, alebo vhodne upravte vlastníka zdieľania cez chown."
+    ],
+    "squashOutro": "ProxMenux to nemôže opraviť — ide o pravidlá servera."
+  },
+  "related": {
+    "heading": "Súvisiace",
+    "items": [
+      {
+        "href": "/docs/storage-share/lxc-mount-points",
+        "label": "LXC Body pripojenia (Host ↔ Container)",
+        "tail": " - alternatíva pre neprivilegované CT: pripojiť sa na hostiteľa, naviazať do CT."
+      },
+      {
+        "href": "/docs/storage-share/lxc-samba-client",
+        "label": "Samba klient v LXC",
+        "tail": " — súvisiaca stránka s rovnakým postupom pre zdieľania SMB / CIFS."
+      },
+      {
+        "href": "/docs/storage-share/lxc-nfs-server",
+        "label": "NFS server v LXC",
+        "tailRich": " — opačný smer: sprístupniť priečinky <em>z</em> CT cez NFS."
+      },
+      {
+        "href": "/docs/storage-share/host-nfs",
+        "label": "Zdieľanie NFS ako úložisko Proxmox",
+        "tail": " — zaregistrovať zdieľanie priamo v Proxmoxe namiesto jedného CT."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sk/docs/storage-share/lxc-nfs-server.json b/web/messages/sk/docs/storage-share/lxc-nfs-server.json
new file mode 100644
index 00000000..876d5a67
--- /dev/null
+++ b/web/messages/sk/docs/storage-share/lxc-nfs-server.json
@@ -0,0 +1,159 @@
+{
+  "meta": {
+    "title": "NFS server v LXC | ProxMenux Dokumentácia",
+    "description": "Zdieľajte priečinky cez NFS z kontajnera Proxmox LXC pomocou ProxMenux. Automaticky nainštaluje nfs-kernel-server a nastaví spoločnú skupinu sharedfiles, /etc/exports, sieťové ACL aj úplnú odinštaláciu. Vyžaduje privilegovaný kontajner.",
+    "ogTitle": "NFS server v LXC | ProxMenux Dokumentácia",
+    "ogDescription": "Spustite server NFS v privilegovanom LXC so spoločnou skupinou sharedfiles, sieťovými ACL a úplnou odinštaláciou."
+  },
+  "header": {
+    "title": "NFS server v LXC",
+    "description": "Spustite server NFS jadra v kontajneri Proxmox LXC a sprístupnite priečinky iným počítačom v sieti. ProxMenux nainštaluje nfs-kernel-server, nastaví spoločnú skupinu sharedfiles na zdieľanie súborov medzi viacerými privilegovanými CT, spravuje /etc/exports a ponúka úplnú odinštaláciu.",
+    "section": "Úložisko & Share · LXC"
+  },
+  "privReq": {
+    "title": "Požadovaný privilegovaný kontajner",
+    "body": "<code>nfs-kernel-server</code> musí pripojiť súborový systém jadra <code>nfsd</code> do <code>/proc/fs/nfsd</code>. To vyžaduje <code>CAP_SYS_ADMIN</code> v mennom priestore jadra hostiteľa, nielen v používateľskom mennom priestore kontajnera. Neprivilegované LXC túto schopnosť nemajú: <code>rpc.nfsd: Unable to access /proc/fs/nfsd errno 2 (No such file or directory)</code>; systemd označí <code>nfs-server.service</code> ako zlyhanú pre závislosť. Skript preto vyžaduje privilegovaný CT a <strong>pri neprivilegovanom CT sa ukončí</strong>. Alternatívou je server NFS vo VM."
+  },
+  "what": {
+    "heading": "Čo to robí?",
+    "body": "Ide o opačný smer než na stránke <em>klienta NFS</em>: CT sa stane <strong>serverom NFS</strong> a sprístupní vlastný priečinok iným CT, hostiteľovi Proxmox, VM alebo fyzickým počítačom.",
+    "diagramServerLabel": "LXC (privilegovaný) NFS server",
+    "diagramServerDetail": "/mnt/data\n(sprístupnený priečinok)\n\nchown root:sharedfiles\nchmod 2775 (SGID)\n\nnfs-kernel-server\n+ rpcbind spustené",
+    "diagramClientLabel": "Každý klient v sieti",
+    "diagramClientDetail": "ďalší CT, hostiteľ,\nVM, fyzický stroj...",
+    "diagramArrow": "Export NFS"
+  },
+  "shared": {
+    "heading": "Spoločná skupina „sharedfiles“",
+    "body": "Skript vytvorí skupinu <code>sharedfiles</code> s GID <strong>101000</strong> a pridá do nej bežných používateľov. Exportovaný adresár nastaví na <code>root:sharedfiles</code> s režimom <code>2775</code>. Úvodná číslica <code>2</code> zapína SGID: nové súbory a podadresáre zdedia skupinu <code>sharedfiles</code>.",
+    "gidTitle": "Prečo konkrétne GID 101000",
+    "gidBody": "Pri predvolenom mapovaní ID v LXC (+100000) sa GID 101000 hostiteľa zobrazí ako GID <strong>1000</strong> v neprivilegovanom CT. Tento serverový postup používa <strong>privilegovaný</strong> CT bez posunu ID. Dva privilegované CT so skupinou <code>sharedfiles</code> a GID 101000 preto používajú rovnaké číselné ID skupiny.",
+    "remapTitle": "Staré vytváranie používateľov „remap_*“ sa pri privilegovaných CT preskočí",
+    "remapBody": "Stará vetva pre neprivilegované CT by vytvorila používateľov <code>remap_&lt;uid&gt;</code> s UID <code>&lt;uid&gt; + 100000</code> v skupine <code>sharedfiles</code> pre bežných používateľov a časté UID (33, 1000, 1001, 1002). Posun <code>+100000</code> sa na požadované <strong>privilegované</strong> CT nevzťahuje, preto skript túto vetvu preskočí. Chýbajúce účty <code>remap_*</code> vo výstupe <code>getent passwd</code> sú očakávané a neznamenajú chybu."
+  },
+  "defaults": {
+    "heading": "Predvolené voľby exportu — prečítajte si najprv",
+    "warnTitle": "Štandardné možnosti zahŕňajú no_root_squash",
+    "warnBody": "ProxMenux predvolene používa <code>rw,sync,no_subtree_check,'<'strong'>'no_root_squash'<'/strong'>'</code>. <strong>Každý používateľ root na klientovi môže do exportu zapisovať ako root.</strong> Používajte to iba v dôveryhodnej domácej LAN. Ak je CT dostupný z nedôveryhodnej siete (VPS alebo nedôveryhodná VLAN), <strong>zmeňte voľbu na <code>root_squash</code></strong> v dialógu vlastných volieb."
+  },
+  "opening": {
+    "heading": "Otvorenie nástroja",
+    "body": "V hlavnej ponuke otvorte <strong>Storage & Share Manager → Configure NFS Server in LXC</strong>. Zobrazia sa iba privilegované CT. Vyberte cieľový CT; skript ho spustí, ak je zastavený, a neprivilegovaný CT odmietne. Ponuka má päť možností.",
+    "imageAlt": "Ponuka servera NFS — Vytvoriť / Zobraziť / Odstrániť / Stav / Odinštalovať"
+  },
+  "howRuns": {
+    "heading": "Ako spustí skript (Create flow)"
+  },
+  "network": {
+    "heading": "Sieťové ACL — kto smie pripojiť export?",
+    "intro": "<code>/etc/exports</code> určuje, ktorí klienti smú export pripojiť. Dialóg ponúka tri režimy:",
+    "headerMode": "Režim",
+    "headerValue": "Hodnota napísaná /etc/exports",
+    "headerWhen": "Kedy si ju vybrať",
+    "rows": [
+      {
+        "mode": "Miestna sieť",
+        "value": "192.168.0.0/16",
+        "whenRich": "Pre bežné domáce a malé firemné siete. Zahŕňa všetky adresy <code>192.168.*.*</code>."
+      },
+      {
+        "mode": "Vlastná podsieť",
+        "value": "Váš CIDR (napr. 10.0.0.0/24)",
+        "when": "Keď vaša LAN nie je v 192.168.x.x alebo chcete pevnejší rozsah."
+      },
+      {
+        "mode": "Jediný hostiteľ",
+        "value": "IP (napr. 10.0.0.42)",
+        "when": "Len jeden konkrétny stroj by sa mal pripojiť. Najviac obmedzujúce."
+      }
+    ]
+  },
+  "options": {
+    "heading": "Možnosti exportu vysvetlené",
+    "headerOption": "Možnosť",
+    "headerEffect": "Čo to robí?",
+    "rows": [
+      {
+        "option": "rw / ro",
+        "effect": "Povolí pripojeným klientom čítanie a zápis alebo prístup iba na čítanie."
+      },
+      {
+        "option": "sync",
+        "effectRich": "Odpovedať na žiadosti o zápis až potom, čo dáta sú na disku. Bezpečnejšie ako <code>async</code> za cenu priepustnosti."
+      },
+      {
+        "option": "no_subtree_check",
+        "effect": "Pri každej požiadavke vynechá kontrolu, či je súbor stále v exportovanom podstrome. Je to rýchlejšie a predchádza problémom pri premenovaní súborov počas operácie."
+      },
+      {
+        "option": "no_root_squash",
+        "effectRich": "<strong>Dôverovať používateľovi root na klientovi.</strong> Klient pripájajúci zdieľanie ako root zapisuje aj na serveri ako root. Hodí sa do dôveryhodnej LAN, napríklad ak zálohovací nástroj musí zachovať vlastníkov súborov. Ak úplne nedôverujete každému zariadeniu povolenému sieťovým ACL, použite namiesto toho <code>root_squash</code>."
+      }
+    ]
+  },
+  "manual": {
+    "heading": "Ručný ekvivalent",
+    "body": "Celý postup môžete vykonať ručne. Každý príkaz sa spúšťa <strong>v CT</strong> cez <code>pct exec &lt;ctid&gt; --</code> alebo <code>pct enter &lt;ctid&gt;</code>:"
+  },
+  "view": {
+    "heading": "Zobraziť aktuálne exporty",
+    "body": "Zobrazí <code>/etc/exports</code> z CT bez komentárov a prázdnych riadkov a vypíše každý export so sieťovým ACL a voľbami. Pred zdieľaním IP adresy CT tak môžete overiť, ktoré priečinky sú sprístupnené."
+  },
+  "delete": {
+    "heading": "Odstrániť export",
+    "body": "Zobrazí každý riadok v <code>/etc/exports</code> pre výber, odstráni vybraný (<code>sed -i</code>), spustí <code>exportfs -ra</code> a reštartuje <code>nfs-kernel-server</code>. Samotný priečinok a jeho obsah zostávajú neporušené."
+  },
+  "status": {
+    "heading": "Kontrola stavu NFS",
+    "body": "Diagnostika overí, či sú <code>nfs-kernel-server</code> a <code>rpcbind</code> nainštalované a aktívne, vypíše výstup <code>exportfs -v</code>, aktívne relácie NFS (<code>showmount -a</code>) a aktuálne pripojenia klientov."
+  },
+  "uninstall": {
+    "heading": "Odinštalovať server NFS",
+    "body": "Úplné čistenie po potvrdení: zastaví a vypne <code>nfs-kernel-server</code> a <code>rpcbind</code>, vyprázdni <code>/etc/exports</code>, odstráni balíky NFS pomocou <code>apt-get purge</code>, skupinu <code>sharedfiles</code> aj používateľov <code>remap_*</code> a ukončí zvyšné procesy. <strong>Exportované priečinky sa neodstránia</strong>; odstráni sa iba konfigurácia NFS a balíky.",
+    "warnTitle": "Skript sa zastaví na exportnom riadku, nie na dátach",
+    "warnBody": "<em>Odstrániť export</em> a <em>Odinštalovať server NFS</em> odstráni konfiguráciu exportu. Údaje o exportovanom priečinku sa zachovajú. Ak chcete odstrániť aj údaje, urobte to explicitne pomocou <code>rm -rf</code> po dokončení skriptu – a ak by ich ešte niekto mohol potrebovať, najprv si ich zálohujte."
+  },
+  "troubleshoot": {
+    "heading": "Riešenie problémov",
+    "privTitle": "Vyžaduje sa privilegovaný kontajner (skript sa ukončí)",
+    "privBody": "Vybraný CT je neprivilegovaný. <code>nfs-kernel-server</code> v ňom nemôže bežať, pretože pripojenie <code>/proc/fs/nfsd</code> vyžaduje <code>CAP_SYS_ADMIN</code> v mennom priestore jadra hostiteľa. Ani modul <code>nfsd</code> nie je sprístupnený v mennom priestore kontajnera: <code>modprobe nfsd</code> zvnútra vráti <code>FATAL: Module nfsd not found</code>. Ak obídete kontrolu, v denníku sa objaví <code>rpc.nfsd: Unable to access /proc/fs/nfsd errno 2 (No such file or directory)</code> a porty NFS sa neotvoria. Možnosti sú previesť CT na privilegovaný alebo presunúť server NFS do VM.",
+    "aptTitle": "Príkaz apt-get install zlyhá",
+    "aptIntro": "Skript predpokladá CT založený na Debiane. Na Alpine / Arch / Rocky / Alma nainštalujte balíky servera NFS ručne:",
+    "aptItems": [
+      "Alpine: <code>apk add nfs-utils</code>",
+      "Arch: <code>pacman -S nfs-utils</code>",
+      "Rocky / Alma: <code>dnf install nfs-utils</code>"
+    ],
+    "aptOutro": "Potom znova spustite skript ProxMenux; ak sú nástroje už prítomné, inštalácia sa preskočí.",
+    "aclTitle": "Klient sa nemôže pripojiť: 'prístup zamietnutý serverom'",
+    "aclBody": "IP adresa klienta je mimo nakonfigurovaného sieťového ACL. Vytvorte export so širšou podsieťou alebo pridajte presnú IP klienta. Pozor: pri pripojení cez NAT sa môže zobraziť WAN IP smerovača namiesto LAN IP klienta. Overte to na serveri pomocou <code>tcpdump -n port 2049</code>.",
+    "ownTitle": "Súbory napísané klientom sa objavujú s divným vlastníctvom na serveri",
+    "ownIntro": "Dve možnosti:",
+    "ownItems": [
+      "S <code>no_root_squash</code> (predvolené) používateľ root na klientovi zapisuje ako root na serveri. Súbory sú vlastnené <code>root:sharedfiles</code> vďaka SGID na priečinku.",
+      "Používatelia klienta bez oprávnení root zapisujú pod vlastným UID/GID. Ak ich UID na serveri neexistuje, pri súboroch sa zobrazia iba čísla, napríklad <code>1234:1234</code>. Použite aj na klientovi skupinu <code>sharedfiles</code> alebo zjednoťte UID v systémoch, ktoré zdieľajú súbory."
+    ],
+    "noShowTitle": "Server dosiahnuteľný, ale showmount nič nevráti",
+    "noShowBody": "Po úprave <code>/etc/exports</code> obnovte tabuľku exportov pomocou <code>exportfs -ra</code> a reštartujte <code>nfs-kernel-server</code>. Skript robí oboje, ale po ručnej úprave to musíte spraviť sami. Overte tiež, že firewall CT aj hostiteľa Proxmox povoľuje TCP/UDP 2049 a port rpcbind (111)."
+  },
+  "related": {
+    "heading": "Súvisiace",
+    "items": [
+      {
+        "href": "/docs/storage-share/lxc-nfs-client",
+        "label": "NFS klient v LXC",
+        "tail": " — opačný smer: pripojenie externých zdieľaní NFS v CT."
+      },
+      {
+        "href": "/docs/storage-share/lxc-samba-server",
+        "label": "Samba server v LXC",
+        "tail": " — súvisiaca stránka s rovnakým postupom, ale SMB / CIFS namiesto NFS."
+      },
+      {
+        "href": "/docs/storage-share/host-nfs",
+        "label": "Zdieľanie NFS ako úložisko Proxmox",
+        "tailRich": " — keď CT sprístupňuje export, zaregistrujte zdieľanie NFS v Proxmoxe, aby sa zobrazilo v <em>Datacenter → Storage</em>."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sk/docs/storage-share/lxc-samba-client.json b/web/messages/sk/docs/storage-share/lxc-samba-client.json
new file mode 100644
index 00000000..e1416df1
--- /dev/null
+++ b/web/messages/sk/docs/storage-share/lxc-samba-client.json
@@ -0,0 +1,155 @@
+{
+  "meta": {
+    "title": "Samba klient v LXC | ProxMenux Dokumentácia",
+    "description": "Pripojte zdieľania Samba / CIFS z kontajnera Proxmox LXC cez ProxMenux. Automaticky nainštaluje cifs-utils a smbclient, podporuje vyhľadanie serverov, chránené uloženie prihlasovacích údajov a trvalé pripojenia cez /etc/fstab. Vyžaduje privilegovaný kontajner.",
+    "ogTitle": "Samba klient v LXC | ProxMenux Dokumentácia",
+    "ogDescription": "Pripojte zdieľania Samba / CIFS z privilegovaného kontajnera LXC. Automatické vyhľadanie, chránený súbor prihlasovacích údajov a trvalé nastavenie v /etc/fstab."
+  },
+  "header": {
+    "title": "Samba klient v LXC",
+    "description": "Pripájajte zdieľania Samba (SMB / CIFS) priamo zvnútra kontajnera Proxmox LXC. Kontajner funguje ako skutočný klient CIFS: komunikuje so serverom Samba cez sieť, používa mount.cifs, chráni prihlasovacie údaje a zapisuje pripojenia do /etc/fstab. ProxMenux nainštaluje cifs-utils a smbclient a pred pripojením overí prihlasovacie údaje na serveri.",
+    "section": "Úložisko a zdieľanie · LXC"
+  },
+  "privReq": {
+    "title": "Požadovaný privilegovaný kontajner",
+    "body": "Klient Samba / CIFS používajúci <code>mount.cifs</code> potrebuje schopnosti (aspoň <code>SYS_ADMIN</code>), ktoré neprivilegované LXC neposkytujú. Skript vyžiada výber CT a <strong>skončí, ak je neprivilegovaný</strong>. Ak zdieľanie potrebujete v neprivilegovanom CT, najprv ho pripojte na hostiteľovi Proxmox cez <hostSambaLink>Zdieľanie Samba / CIFS ako úložisko Proxmox</hostSambaLink> a potom ho sprístupnite CT pomocou bind mountu v <mountLink>LXC Mount Manager</mountLink>."
+  },
+  "what": {
+    "heading": "Čo to robí?",
+    "body": "Kontajner komunikuje cez sieť protokolom CIFS a pripája zdieľanie samostatne. Hostiteľ Proxmox slúži len ako sieťový most — pripojenie nevidí ani nespravuje.",
+    "diagramServerLabel": "Samba server",
+    "diagramServerDetail": "//srv/share",
+    "diagramHostLabel": "Hostiteľ Proxmox",
+    "diagramHostDetail": "(len\nmost siete)",
+    "diagramCtLabel": "LXC (privilegovaný)",
+    "diagramCtDetail": "/mnt/share\nmount.cifs vnútri CT",
+    "diagramArrow": "CIFS",
+    "twoWaysTitle": "Dva spôsoby, ako dať CT zdieľanie Samba — vyberte si jeden",
+    "twoWaysBind": "<strong>Bind mount cez hostiteľa</strong> (<mountLink>LXC Mount Manager</mountLink>): hostiteľ pripojí CIFS raz a každý CT dostane rovnakú cestu cez bind mount. Funguje s neprivilegovanými CT. Odporúča sa, ak rovnaké zdieľanie potrebuje viacero CT.",
+    "twoWaysDirect": "<strong>Priame pripojenie CIFS v CT</strong> (táto stránka): CT pripojí CIFS samostatne. Vyžaduje privilegovaný CT. Hodí sa, ak má CT spravovať vlastné prihlasovacie údaje alebo ak každý CT komunikuje s iným serverom."
+  },
+  "opening": {
+    "heading": "Otvorenie nástroja",
+    "body": "V hlavnej ponuke otvorte <strong>Storage &amp; Share Manager → Nastaviť klienta Samba v LXC (iba privilegovaný)</strong>. ProxMenux najprv vyžiada <strong>výber cieľového CT</strong>, spustí ho, ak je zastavený, a skončí pri neprivilegovanom CT. Potom sa zobrazí táto podponuka:",
+    "imageAlt": "Ponuka klienta Samba — Pripojiť / Zobraziť / Odpojiť / Testovať pripojenie"
+  },
+  "howRuns": {
+    "heading": "Ako beží skript (Mount flow)"
+  },
+  "creds": {
+    "heading": "Kde býva heslo",
+    "body": "ProxMenux <strong>nevkladá heslo do príkazu na pripojenie</strong> ani do <code>/etc/fstab</code>. Namiesto toho vytvorí súbor prihlasovacích údajov v CT. Obsahuje údaje v otvorenom texte chránené oprávneniami iba pre root; nie je šifrovaný:",
+    "whyTitle": "Prečo samostatný súbor skôr než fstab",
+    "whyBody": "Modul CIFS podporuje voľby <code>username=</code> / <code>password=</code> priamo vo fstab. Každý, kto môže čítať <code>/etc/fstab</code>, by však videl heslo v otvorenom texte. Uloženie prihlasovacích údajov do súboru prístupného iba root a odkaz z fstab pomocou <code>credentials=</code> zabráni tomu, aby bolo heslo v konfigurácii čitateľnej pre všetkých."
+  },
+  "options": {
+    "heading": "Vysvetlenie možností pripojenia",
+    "headerOption": "Možnosť",
+    "headerEffect": "Čo to robí?",
+    "rows": [
+      {
+        "option": "rw / ro",
+        "effect": "Režim čítania a zápisu alebo iba čítania pre celé pripojenie."
+      },
+      {
+        "option": "file_mode=0664",
+        "effect": "Oprávnenia hlásené pre súbory prostredníctvom CIFS. Štandardne umožňuje majiteľ+skupina písať, iní čítať."
+      },
+      {
+        "option": "dir_mode=0775",
+        "effect": "Oprávnenia hlásené pre adresáre. Predvolene vlastník a skupina môžu vstupovať a vytvárať obsah, ostatní môžu adresár prechádzať."
+      },
+      {
+        "option": "iocharset=utf8",
+        "effect": "Vynúti UTF-8 pre názvy súborov prenášané cez sieť a zabráni poškodenému zobrazovaniu znakov mimo ASCII."
+      },
+      {
+        "option": "credentials=file",
+        "effect": "Čítať užívateľské meno / heslo zo súboru (pridané automaticky pre užívateľa auth)."
+      },
+      {
+        "option": "guest",
+        "effect": "Overte ako hosť, nie sú potrebné žiadne údaje (pri výbere hosťa automaticky pridané)."
+      },
+      {
+        "option": "_netdev",
+        "effect": "Oznámi inicializačnému systému, že toto pripojenie potrebuje sieť. Spúšťanie systému sa nezablokuje čakaním naň."
+      },
+      {
+        "option": "x-systemd.automount",
+        "effect": "Pripojenie až pri prvom prístupe: súborový systém sa pripojí, keď sa začne používať. Nedostupný server CIFS pri štarte nezablokuje CT."
+      },
+      {
+        "option": "noauto",
+        "effect": "Vynechá okamžité pripojenie pri štarte. V kombinácii s jednotkou automount sa súborový systém pripojí až vtedy, keď je potrebný."
+      }
+    ],
+    "netEffectTitle": "Čistý účinok indikátorov fstab",
+    "netEffectBody": "Súborový systém CIFS sa pripojí pri <em>prvom prístupe</em>, nie okamžite pri štarte. Ak server nie je dostupný, prístup môže čakať alebo zlyhať a ovplyvniť služby závislé od danej cesty. Automount znižuje závislosť pri štarte, ale nezaručuje, že výpadok CIFS neovplyvní žiadnu službu CT."
+  },
+  "manual": {
+    "heading": "Ručný ekvivalent",
+    "body": "Celý postup zopakujete ručne — každý príkaz sa spúšťa <strong>vo vnútri CT</strong> cez <code>pct exec &lt;ctid&gt; --</code> alebo priamo cez <code>pct enter &lt;ctid&gt;</code>:",
+    "guestIntro": "Variant hosťa — súbor prihlasovacích údajov nie je potrebný:"
+  },
+  "view": {
+    "heading": "Zobraziť aktuálne pripojenia",
+    "body": "Zobrazí aktívne pripojenia CIFS v CT (<code>mount -t cifs</code>) a všetky riadky CIFS v jeho <code>/etc/fstab</code>. Pri každom zázname fstab sa zobrazí aktuálny stav, čo pomáha nájsť trvalé pripojenia neobnovené pri štarte."
+  },
+  "unmount": {
+    "heading": "Odpojiť zdieľanie Samba",
+    "body": "Spojí aktívne pripojenia a položky fstab do zoznamu, umožní výber a <strong>odstráni príslušný riadok z <code>/etc/fstab</code></strong> aj súvisiaci súbor prihlasovacích údajov. Skript nespustí <code>umount</code> na aktívnom pripojení, ale upozorní na potrebu reštartu CT, aby sa odpojenie prejavilo.",
+    "warnTitle": "Skript odstráni položky fstab, nie aktívne pripojenia",
+    "warnBody": "Rovnaký princíp ako pri klientovi NFS: <code>umount</code> na používanom pripojení zlyhá s „device busy“. Odstránenie záznamu z fstab zabezpečí, že sa pripojenie pri ďalšom spustení CT neobnoví. Ak ho chcete odpojiť <em>hneď</em>, po skončení skriptu ručne vykonajte <code>pct exec &lt;ctid&gt; -- umount /mnt/&lt;path&gt;</code>."
+  },
+  "test": {
+    "heading": "Testovať Samba konektivitu",
+    "body": "Diagnostický priechod vnútri CT: potvrdzuje, že je nainštalovaný <code>cifs-utils</code>, uvádza aktuálne pripojenia CIFS, potom pre každý server, na ktorý sa odkazuje vo fstab, kontroluje ping → porty 139/445 → zoznam hostí. \"Vyžaduje overenie\" v teste hosťa je normálne pre každý server, ktorý nezverejňuje verejné zdieľania."
+  },
+  "troubleshoot": {
+    "heading": "Riešenie problémov",
+    "privTitle": "Vyžaduje sa privilegovaný kontajner (skript skončí)",
+    "privBody": "Vybrané CT je neprivilegované. Jadro CIFS klient potrebuje <code>SYS_ADMIN</code>, ktoré neprivilegované CT nevystavujú. Buď konvertujte CT na privilegovanú alebo použite alternatívnu cestu popísanú v varovaní v hornej časti tejto stránky.",
+    "aptTitle": "apt-get install fails",
+    "aptIntro": "Skript predpokladá rodinu Debianu CT (<code>apt-get</code>). Na Alpine / Arch / Rocky / Alma, inštalujte CIFS klienta ručne:",
+    "aptItems": [
+      "Alpine: <code>apk add cifs-utils samba-client</code>",
+      "Arch: <code>pacman -S cifs-utils smbclient</code>",
+      "Rocky / Alma: <code>dnf install cifs-utils samba-client</code>"
+    ],
+    "aptOutro": "Potom znova spustite skript ProxMenux — krok inštalácie preskočí, keď už sú nástroje k dispozícii.",
+    "guestFallbackTitle": "\"Server vás spájal ako hosť namiesto zadaného užívateľa\"",
+    "guestFallbackBody": "Aktívne overenie skriptu zistilo problém s autentifikáciou. Server prijal pripojenie, ale zmenil ho na hosťa pre nesprávne prihlasovacie údaje. Príčiny bývajú preklep v mene alebo hesle, neexistujúci alebo zablokovaný používateľ a nesprávna pracovná skupina či doména. Zopakujte postup a údaje starostlivo zadajte znova (heslo je v dialógu skryté).",
+    "denyTitle": "„NT_STATUS_ACCESS_DENIED“ pri pripájaní",
+    "denyBody": "Prihlasovacie údaje sú overené, ale zdieľanie odmieta prístup. Na serveri skontrolujte oprávnenia používateľa ku konkrétnemu zdieľaniu (overenie potvrdzuje prihlásenie, nie ACL jednotlivých zdieľaní). Overte aj požadovanú verziu SMB: do volieb pridajte <code>vers=3.0</code> (alebo <code>2.1</code>, <code>2.0</code>).",
+    "utf8Title": "Názvy súborov UTF-8 / mimo ASCII sa zobrazujú nesprávne",
+    "utf8Body": "Predvolené možnosti zahŕňajú <code>iocharset=utf8</code>, ale niektoré konfigurácie serverov hlásia neočakávanú stránku kódov. Ak mená súborov s akcentmi / symbolmi vyzerajú zle, skúste aj <code>nounix</code> (niektoré servery Linux Samba to potrebujú, keď je klient tiež Linux) alebo nastavte stranu servera na <code>unix extensions = no</code>.",
+    "bootTitle": "Trvalé pripojenie funguje, ale po štarte sa neobnoví",
+    "bootBody": "Príčinou býva nepripravená sieť pri pripájaní v CT, nedostupný server pri štarte alebo nefungujúce DNS. Voľby <code>_netdev,x-systemd.automount,noauto</code> riešia prvý prípad; automount bežne čaká na prvý prístup. Pri probléme s DNS použite IP adresu servera namiesto názvu."
+  },
+  "related": {
+    "heading": "Súvisiace",
+    "items": [
+      {
+        "href": "/docs/storage-share/lxc-mount-points",
+        "label": "LXC Body pripojenia (Host ↔ Container)",
+        "tail": " - alternatíva pre neprivilegované CT: pripojiť sa na hostiteľa, naviazať do CT."
+      },
+      {
+        "href": "/docs/storage-share/lxc-nfs-client",
+        "label": "NFS klient v LXC",
+        "tail": " — súvisiaca stránka s rovnakým postupom pre zdieľania NFS."
+      },
+      {
+        "href": "/docs/storage-share/lxc-samba-server",
+        "label": "Samba server v LXC",
+        "tailRich": " — opačný smer: sprístupniť priečinky <em>z</em> CT cez Samba."
+      },
+      {
+        "href": "/docs/storage-share/host-samba",
+        "label": "Samba / CIFS ako Proxmox skladovanie",
+        "tail": " — zaregistrovať zdieľanie priamo v Proxmoxe namiesto jedného CT."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sk/docs/storage-share/lxc-samba-server.json b/web/messages/sk/docs/storage-share/lxc-samba-server.json
new file mode 100644
index 00000000..1c43f777
--- /dev/null
+++ b/web/messages/sk/docs/storage-share/lxc-samba-server.json
@@ -0,0 +1,132 @@
+{
+  "meta": {
+    "title": "Samba server v LXC | ProxMenux Dokumentácia",
+    "description": "Spustite server Samba (SMB / CIFS) v kontajneri Proxmox LXC cez ProxMenux. Automaticky nainštaluje samba a spravuje /etc/samba/smb.conf, používateľov smbpasswd a skupinu sharedfiles pre priečinky pripojené cez bind mount. Vyžaduje privilegovaný kontajner.",
+    "ogTitle": "Samba server v LXC | ProxMenux Dokumentácia",
+    "ogDescription": "Sprístupnite priečinky cez SMB/CIFS z privilegovaného LXC. Automatická inštalácia, používateľ smbpasswd a oprávnenia prispôsobené bind mountom."
+  },
+  "header": {
+    "title": "Samba server v LXC",
+    "description": "Spustite server Samba (SMB / CIFS) v kontajneri Proxmox LXC a vystavte priečinky klientom Windows / macOS / Linux v sieti. ProxMenux nainštaluje samba, vytvorí používateľa Samba pomocou smbpasswd, spravuje /etc/samba/smb.conf a použije oprávnenia prispôsobené bind mountom, keď zdieľaný priečinok pochádza od hostiteľa.",
+    "section": "Úložisko & Share · LXC"
+  },
+  "privReq": {
+    "title": "Požadovaný privilegovaný kontajner",
+    "body": "Samba sa vydáva za pripájajúceho užívateľa <code>setgroups()</code> pri každom pripojení k zdieľaniu (v okamihu, keď klient otvorí zdieľanie). V neprivilegovaných LXC, jadro odmieta, že syscall, pretože používateľský menný priestor kontajnera je vytvorený s <code>setgroups=deny</code> a <code>smbd</code> reaguje prerušením pracovného procesu s <code>PANIC: sys_setgroups failed</code>. Výsledkom je, že <code>smbd</code> začína a viaže porty 139/445, ale každý klient spojenie zlyhá s <code>NT_STATUS_CONNECTION_DISCONNECTED</code>. Skript presadzuje privilegovaný CT z tohto dôvodu a <strong>sa ukončí, ak CT nie je privilegovaný</strong>. Na strane servera neexistuje čistá oprava; použite privilegovaný CT, alebo spustiť Samba vnútri VM."
+  },
+  "what": {
+    "heading": "Čo to robí?",
+    "body": "Kontajner sa stáva SMB/CIFS serverom: prevádzkuje <code>smbd</code>, vystavuje priečinok cez <code>/etc/samba/smb.conf</code> a prijíma klientske pripojenia na portoch <code>139</code> / <code>445</code>. Klienti vidia zdieľanie na <code>\\\\&lt;ct-ip&gt;\\&lt;share-name&gt;</code> vo Windows Explorer, <code>smb://&lt;ct-ip&gt;/&lt;share-name&gt;</code> v macOS Finder, alebo prostredníctvom <code>mount.cifs</code> na Linuxe.",
+    "diagramServerLabel": "LXC (privilegovaný) — server Samba",
+    "diagramServerDetail": "/mnt/data\n(sprístupnený priečinok)\n\nsmbd + nmbd spustené\n\nPoužívateľ: <username>\n(via smbpasswd)\n\nVynútená skupina:\nsharedfiles",
+    "diagramClientLabel": "Každý klient v sieti",
+    "diagramClientDetail": "Windows: \\\\<ip>\\<share>\nmacOS:   smb://<ip>/<share>\nLinux:   mount.cifs",
+    "diagramArrow": "SMB / CIFS"
+  },
+  "perms": {
+    "heading": "Dve cesty povolenia v závislosti od typu priečinka",
+    "body": "Pred pridaním zdieľania do <code>smb.conf</code> skript overí, či je priečinok <strong>bind mountom z hostiteľa</strong> alebo bežným <strong>lokálnym priečinkom v CT</strong>. Podľa toho nastaví rôznych vlastníkov a oprávnenia:",
+    "headerType": "Typ priečinku",
+    "headerAction": "Čo robí skript",
+    "bindType": "Bind mount z hostiteľa",
+    "bindTypeSubRich": "detekovaný prostredníctvom výstupu <code>mount</code>",
+    "bindActionRich": "Vytvorí skupinu <code>sharedfiles</code> (predvolené GID 999, dynamické, ak je obsadené), pridá používateľa Samba a použije <code>chown root:sharedfiles</code> a <code>chmod 2775</code> (SGID — nové súbory zdedia skupinu). Ak používateľ stále nemôže zapisovať, použije <code>setfacl -m u:&lt;user&gt;:rwx</code>.",
+    "localType": "Lokálny priečinok vnútri CT",
+    "localTypeSub": "Nebol zistený bind mount",
+    "localActionRich": "Štandardné vlastníctvo: <code>chown -R &lt;user&gt;:&lt;user&gt;</code> + <code>chmod -R 755</code>. Žiadna spoločná skupina nie je potrebná, pretože do tohto priečinku nepíše žiadna iná CT. Vracia sa do <code>setfacl</code> ak stále chýba prístup k zápisu.",
+    "gidTitle": "GID pre „sharedfiles“ sa líši od toku servera NFS",
+    "gidBody": "Skript Samba server používa GID <strong>999</strong> pre <code>sharedfiles</code>, zatiaľ čo <nfsLink>postup servera NFS</nfsLink> používa GID <strong>101000</strong>. Ak spustíte oba servery v rovnakom CT a chcete jednu spoločnú skupinu v oboch protokoloch, upravte jeden z nich tak, aby zodpovedal druhému po inštalácii (napr. <code>groupmod -g 101000 sharedfiles</code>) a znova nastavte vlastníkov príslušných priečinkov. Toto je známy nesúlad v aktuálnych skriptoch."
+  },
+  "opening": {
+    "heading": "Otvorenie nástroja",
+    "body": "V hlavnej ponuke otvorte <strong>Storage & Share Manager → Configure Samba Server in LXC</strong>. Zobrazia sa iba privilegované CT. Vyberte cieľový CT; skript ho spustí, ak je zastavený, a neprivilegovaný CT odmietne. Ponuka má päť možností.",
+    "imageAlt": "Ponuka servera Samba — Vytvoriť / Zobraziť / Odstrániť / Stav / Odinštalovať"
+  },
+  "howRuns": {
+    "heading": "Ako prebieha vytvorenie v skripte"
+  },
+  "modes": {
+    "heading": "Tri režimy zdieľania",
+    "intro": "Každý režim zapíše iný blok do <code>smb.conf</code>. Všetky tri zahŕňajú <code>valid users = &lt;username&gt;</code> (nie anonymné), <code>force group = sharedfiles</code> (takže nové súbory patria do zdieľanej skupiny) a <code>veto files = /lost+found/</code> (skrýva ich od klientov).",
+    "headerMode": "Režim",
+    "headerBlock": "Blok napísaný smb.conf",
+    "rwMode": "Čítanie a zápis",
+    "roMode": "Iba na čítanie",
+    "customMode": "Vlastné",
+    "customBodyRich": "Svoje vlastné smernice zapíšete do voľného textu. ProxMenux ich stále zabalí do bloku <code>[share]</code> štandardným <code>path</code>, <code>valid users</code>, <code>force group</code> a <code>veto files</code>."
+  },
+  "manual": {
+    "heading": "Ručný ekvivalent",
+    "body": "Celý postup môžete vykonať ručne. Každý príkaz sa spúšťa <strong>v CT</strong> cez <code>pct exec &lt;ctid&gt; --</code> alebo <code>pct enter &lt;ctid&gt;</code>:"
+  },
+  "connect": {
+    "heading": "Pripojenie od klientov",
+    "headerOs": "Operačný systém klienta",
+    "headerHow": "Ako sa pripojiť",
+    "windowsOs": "Windows",
+    "windowsHowRich": "Prieskumník → panel s adresou: <code>\\\\&lt;ct-ip&gt;\\&lt;share-name&gt;</code>. Alebo <em>Pripojiť sieťovú jednotku</em> → začiarknite „Pripojiť pomocou iných prihlasovacích údajov“.",
+    "macosOs": "macOS",
+    "macosHowRich": "Finder → <em>Choď → Pripojiť k serveru…</em> → <code>smb://&lt;ct-ip&gt;/&lt;share-name&gt;</code>. Alebo <code>mount_smbfs //user@&lt;ct-ip&gt;/&lt;share&gt; /mountpoint</code>.",
+    "linuxOs": "Linux",
+    "linuxHowRich": "<code>mount -t cifs //&lt;ct-ip&gt;/&lt;share&gt; /mnt/x -o username=&lt;u&gt;,password=&lt;p&gt;,iocharset=utf8</code>. Alebo použite klienta <clientLink>Samba na stránke LXC</clientLink>, ak je klientom iný Proxmox CT."
+  },
+  "view": {
+    "heading": "Zobraziť aktuálne zdieľania",
+    "body": "Analyzuje <code>/etc/samba/smb.conf</code> v CT a vypíše každý blok <code>[share]</code> s cestou, pričom preskočí <code>[global]</code>, <code>[homes]</code> a <code>[printers]</code>. Hodí sa ako rýchly prehľad."
+  },
+  "delete": {
+    "heading": "Odstrániť zdieľanie",
+    "body": "Umožňuje vybrať zdieľanie podľa mena, odstraňuje blok z <code>smb.conf</code> (<code>sed</code> odstráni z <code>[share]</code> do ďalšieho prázdneho riadku) a reštartuje <code>smbd</code>. Priečinok sám a jeho obsah sú ponechané neporušené."
+  },
+  "status": {
+    "heading": "Kontrola stavu Samby",
+    "body": "Oznámi, či sú <code>smbd</code> a <code>nmbd</code> nainštalované a aktívne, vypíše používateľov Samba (<code>pdbedit -L</code>) a aktívne relácie (<code>smbstatus</code>)."
+  },
+  "uninstall": {
+    "heading": "Odinštalovať server Samba",
+    "body": "Úplné čistenie po potvrdení: zastaví a vypne <code>smbd</code> a <code>nmbd</code>, zálohuje <code>smb.conf</code> do <code>smb.conf.backup.YYYYMMDD_HHMMSS</code>, odstráni používateľov Samba pomocou <code>smbpasswd -x</code> a balíky Samba pomocou <code>apt-get purge</code>. <strong>Exportované priečinky sa neodstránia</strong>.",
+    "warnTitle": "Priečinky zostanú — dáta zálohujte samostatne",
+    "warnBody": "<em>Odstrániť zdieľanie</em> aj <em>Odinštalovať server Samba</em> odstránia konfiguráciu zdieľania. Dáta v exportovaných priečinkoch sa zachovajú. Ak ich chcete tiež odstrániť, použite po dokončení skriptu výslovne <code>rm -rf</code>."
+  },
+  "troubleshoot": {
+    "heading": "Riešenie problémov",
+    "privTitle": "Vyžaduje sa privilegovaný kontajner (skript sa ukončí)",
+    "privBody": "Vybrané CT je neprivilegované a <code>smbd</code> tam nemôže slúžiť súbory. Ak obídete bránu a konfigurujete Sambu ručne, začne sa <code>smbd</code> a otvoria sa porty, ale prvé klientske spojenie spanikári s <code>PANIC: sys_setgroups failed</code> v <code>/var/log/samba/log.&lt;client&gt;</code> a klient vidí <code>NT_STATUS_CONNECTION_DISCONNECTED</code>. Príčinou je neprivilegované používateľský menný priestor s <code>setgroups=deny</code>, ktoré blokuje prevzatie identity používateľa Sambou pri každom pripojení. Ani <code>features=keyctl=1</code> ani odstránenie <code>force user</code> / <code>force group</code> to nemení. Jediné funkčné možnosti sú: previesť CT na privilegované, alebo presunúť Samba na VM.",
+    "aptTitle": "Príkaz apt-get install zlyhá",
+    "aptIntro": "Skript predpokladá CT založený na Debiane. Na Alpine / Arch / Rocky / Alma nainštalujte Sambu ručne:",
+    "aptItems": [
+      "Alpine: <code>apk add samba</code>",
+      "Arch: <code>pacman -S samba</code>",
+      "Rocky / Alma: <code>dnf install samba</code>"
+    ],
+    "aptOutro": "Potom znova spustite skript ProxMenux; ak sú nástroje už prítomné, inštalácia sa preskočí.",
+    "noShareTitle": "Klient sa pripojí, ale nevidí zdieľanie",
+    "noShareBody": "Overte <code>browseable = yes</code> v bloku zdieľania (predvolené pre rw / ro; vo vlastnom režime môže chýbať). Firewall CT aj hostiteľa Proxmox musí povoľovať TCP 445 (SMB) a 139 (NetBIOS). Niektorí klienti Windows potrebujú preklad názvov; najprv skúste priamo IP adresu.",
+    "authTitle": "Zlyhanie overovania (NT_STATUS_LOGON_FAILURE)",
+    "authBody": "Heslo je nesprávne (heslá Samba sú <em>oddelené</em> od systémových; používateľov Samba vypíšete pomocou <code>pdbedit -L</code>) alebo používateľ chýba v <code>valid users</code> daného zdieľania. Heslo obnovte v CT pomocou <code>smbpasswd &lt;user&gt;</code>.",
+    "groupTitle": "Súbory napísané klientom sa objavujú s nesprávnou skupinou na serveri",
+    "groupBody": "Skript nastaví <code>force group = sharedfiles</code> v bloku zdieľania, takže nové súbory by mali byť skupiny <code>sharedfiles</code>. Ak nie sú, SGID bit na rodičovskom adresári mohol byť stratený (niekto spustil <code>chmod</code> ručne). Opakovane: <code>chmod 2775 /mnt/&lt;share&gt;</code>.",
+    "bothTitle": "Zdieľanie rovnakého priečinka na oboch NFS a Samba",
+    "bothBody": "ProxMenux používa rôzne GIDs pre <code>sharedfiles</code> v každom skripte (Samba: 999, NFS: 101000). Ak podávate rovnaký priečinok prostredníctvom oboch, rozhodnite sa pre jednu GID a zarovnajte obe. Najjednoduchšia oprava: po spustení oboch skriptov upravte menšie GID:"
+  },
+  "related": {
+    "heading": "Súvisiace",
+    "items": [
+      {
+        "href": "/docs/storage-share/lxc-samba-client",
+        "label": "Samba klient v LXC",
+        "tail": " — opačný smer: pripojenie externých zdieľaní Samba v CT."
+      },
+      {
+        "href": "/docs/storage-share/lxc-nfs-server",
+        "label": "NFS server v LXC",
+        "tail": " — súvisiaca stránka s rovnakým postupom, ale NFS namiesto CIFS."
+      },
+      {
+        "href": "/docs/storage-share/host-samba",
+        "label": "Samba / CIFS ako úložisko Proxmox",
+        "tailRich": " — keď CT sprístupňuje export, zaregistrujte zdieľanie Samba v Proxmoxe, aby sa zobrazilo v <em>Datacenter → Storage</em>."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sk/docs/utils/export-vm.json b/web/messages/sk/docs/utils/export-vm.json
new file mode 100644
index 00000000..85037f00
--- /dev/null
+++ b/web/messages/sk/docs/utils/export-vm.json
@@ -0,0 +1,145 @@
+{
+  "meta": {
+    "title": "Export VM do OVA / OVF | Dokumentácia ProxMenux",
+    "description": "Exportujte VM Proxmox do prenosného archívu OVA alebo adresára OVF pomocou štandardnej schémy DMTF. Disky VMDK vo formáte streamOptimized a manifest SHA1. Import je možný vo VMware ESXi / Workstation / Fusion, VirtualBox aj späť v Proxmoxe.",
+    "ogTitle": "Export VM do OVA / OVF | Dokumentácia ProxMenux",
+    "ogDescription": "Preveďte VM Proxmox na prenosný balík OVA / OVF kompatibilný s VMware a VirtualBox."
+  },
+  "header": {
+    "title": "Exportovať VM do OVA / OVF",
+    "description": "Prevedie VM Proxmox na prenosný balík OVA (jeden archív TAR) alebo OVF (deskriptor a súbory VMDK) pomocou štandardnej schémy DMTF OVF. Disky sa pomocou qemu-img konvertujú na VMDK vo formáte streamOptimized. Výsledok možno importovať vo VMware (ESXi / Workstation / Fusion), VirtualBox aj späť v Proxmoxe pomocou nástroja na import.",
+    "section": "Nástroje"
+  },
+  "intro": {
+    "title": "Čo to robí?",
+    "body": "Načíta konfiguráciu zastavenej VM, prevedie každý disk na VMDK vo formáte streamOptimized, vytvorí deskriptor OVF a manifest SHA1 a všetko zabalí do jedného súboru <code>.ova</code> alebo adresára <code>-ovf</code>. Zdrojová VM sa nikdy nemení."
+  },
+  "picker": {
+    "heading": "Výber VM",
+    "body": "Po spustení skript zobrazí všetky VM z <code>qm list</code> s VMID, názvom a stavom. Vyberte VM na export:",
+    "imgAlt": "Dialóg výberu VM na export so zoznamom všetkých VM"
+  },
+  "stopped": {
+    "heading": "VM musí byť zastavená",
+    "intro": "Konzistentný obraz disku vyžaduje zastavenú VM. Ak vybraná VM beží, ProxMenux ponúkne jej vypnutie:",
+    "items": [
+      "Riadne vypnutie cez <code>qm shutdown $VMID --timeout 120</code> (čaká 2 minúty na vypnutie hosťovského systému cez ACPI).",
+      "Po uplynutí času ponúkne vynútené zastavenie: <code>qm stop $VMID</code> (zodpovedá odpojeniu napájania).",
+      "Ak odmietnete obe možnosti, export sa zruší a žiadne údaje sa nezmenia."
+    ],
+    "warnTitle": "Vynútené zastavenie zodpovedá odpojeniu napájania",
+    "warnBody": "<code>qm stop</code> zodpovedá vytiahnutiu napájacieho kábla. Pri ďalšom štarte môže hosťovský systém potrebovať opravu súborového systému. Ak je to možné, použite riadne vypnutie a vynútené zastavenie si nechajte pre hosťovské systémy, ktoré nereagujú."
+  },
+  "format": {
+    "heading": "Volič formátu: OVA vs OVF",
+    "headerFormat": "Formát",
+    "headerOutput": "Výstup",
+    "headerPros": "Výhody",
+    "headerCons": "Nevýhody",
+    "rows": [
+      {
+        "format": "OVA",
+        "output": "name-vmid-ts.ova",
+        "pros": "Jeden samostatný súbor, ktorý sa ľahko presúva, prenáša cez sftp alebo pripája k požiadavke podpory.",
+        "cons": "Vyžaduje ~220% virtuálnej veľkosti disku (dodatočný priestor pre archív TAR počas vytvárania)."
+      },
+      {
+        "format": "OVF",
+        "output": "name-vmid-ts-ovf/",
+        "pros": "~120% virtuálnej veľkosti disku. Jednoduchšia kontrola, pretože deskriptor je textový XML. Pred importom ho možno upraviť.",
+        "cons": "Viac súborov, ktoré sa musia preniesť spoločne."
+      }
+    ]
+  },
+  "destination": {
+    "heading": "Cieľový priečinok",
+    "body": "Vyberte prednastavenú cestu (<code>/var/lib/vz/dump</code>, <code>/var/lib/vz/template/iso</code>) alebo zadajte vlastnú. Skript pred začiatkom overí možnosť zápisu do adresára a upozorní na nedostatok voľného miesta.",
+    "calloutTitle": "Orientačný odhad voľného miesta",
+    "calloutBody": "Pri exporte VM s celkovou virtuálnou veľkosťou diskov 100 GB do OVF počítajte s ~120 GB voľného miesta; pri OVA s ~220 GB. Takmer prázdne disky môžu v skutočnosti zaberať menej. Archív OVA sa vytvára pomocou nekomprimovaného TAR, kým dočasné súbory VMDK ešte existujú, preto treba miesto pre oboje. Ak sa miesto minie počas exportu, obsluha EXIT vyčistí dočasný adresár a musíte začať odznova."
+  },
+  "package": {
+    "heading": "Čo balík obsahuje",
+    "intro": "Pre OVA / OVF s názvom <code>myvm-100-2026-04-26_18-30-15</code>:",
+    "code": "# OVA mode (single .ova file is a TAR of):\nmyvm-100-2026-04-26_18-30-15.ovf      # XML descriptor (DMTF OVF 1.0 + RASD + VSSD)\nmyvm-100-2026-04-26_18-30-15.mf       # SHA1 manifest\nmyvm-100-2026-04-26_18-30-15-disk0.vmdk\nmyvm-100-2026-04-26_18-30-15-disk1.vmdk\n...\n\n# OVF mode (a directory):\nmyvm-100-2026-04-26_18-30-15-ovf/\n├── myvm-100-2026-04-26_18-30-15.ovf\n├── myvm-100-2026-04-26_18-30-15.mf\n├── myvm-100-2026-04-26_18-30-15-disk0.vmdk\n└── myvm-100-2026-04-26_18-30-15-disk1.vmdk"
+  },
+  "exported": {
+    "heading": "Čo sa exportuje",
+    "items": [
+      "<strong>Disky:</strong> všetky položky <code>scsi*</code>, <code>sata*</code>, <code>virtio*</code> a <code>ide*</code> v konfigurácii VM, prevedené na VMDK vo formáte streamOptimized.",
+      "<strong>Počet vCPU</strong> (RASD ResourceType 3) a <strong>pamäť</strong> v MiB (ResourceType 4).",
+      "<strong>Počet sieťových kariet</strong> (ResourceType 10: iba počet, nie most ani model).",
+      "<strong>Názov VM</strong> a údaj o type operačného systému."
+    ],
+    "notTitle": "Čo sa NEEXPORTUJE",
+    "notItems": [
+      "Pripojené CD-ROM / ISO (zámerne vylúčené).",
+      "Jednotky cloud-init (zámerne vylúčené).",
+      "Konkrétny most a model sieťovej karty (zachová sa iba počet).",
+      "Voľba BIOS / UEFI, ktorú treba pri importe znova nastaviť.",
+      "Konfigurácia priameho priradenia PCI.",
+      "Snímky: zachytí sa iba aktuálny stav.",
+      "Možnosti na úrovni VM (NUMA, hugepages, hotplug, …)."
+    ]
+  },
+  "conversion": {
+    "heading": "Konverzia disku",
+    "intro": "Každý disk je konvertovaný s:",
+    "code": "qemu-img convert -p -O vmdk -o subformat=streamOptimized \\\n    \"$source_path\" \\\n    \"$work_dir/<base_name>-disk<N>.vmdk\"",
+    "outro": "<code>streamOptimized</code> je formát VMware čitateľný jedným priechodom. Podporujú ho ESXi 6.7+, VMware Workstation, VirtualBox aj samotný Proxmox. Je to najširšie kompatibilný podformát VMDK a vhodná voľba na prenos. Nevýhodou je, že neumožňuje náhodný prístup, takže ho nemožno priamo pripojiť bez konverzie."
+  },
+  "manifest": {
+    "heading": "Manifest SHA1",
+    "intro": "Každý balík obsahuje súbor <code>.mf</code> s hashmi SHA1 deskriptora OVF a každého súboru VMDK:",
+    "code": "SHA1(myvm-100-2026-04-26_18-30-15.ovf)= 3a7bd3e2360a3d29eea436fcfb7e44c735d117c9\nSHA1(myvm-100-2026-04-26_18-30-15-disk0.vmdk)= b7e23ec29af22b0b4e41da31e868d57226121c84\nSHA1(myvm-100-2026-04-26_18-30-15-disk1.vmdk)= a87ff679a2f3e71d9181a67b7542122c",
+    "outro": "V špecifikácii OVF je manifest voliteľný a mnohé programy ho ignorujú. Pomáha však overiť, či sa balík preniesol neporušený. Overte ho ručne pomocou <code>sha1sum -c file.mf</code>."
+  },
+  "import": {
+    "heading": "Importovanie výsledku",
+    "intro": "Exportovaný balík možno importovať do:",
+    "items": [
+      {
+        "href": "/docs/utils/import-vm",
+        "preRich": "<strong>Proxmox</strong> — použite príslušný nástroj ",
+        "linkLabel": "Importovať VM z OVA / OVF",
+        "tailRich": "."
+      },
+      {
+        "tailRich": "<strong>VMware ESXi</strong> — Datacenter → Deploy OVF Template; vyberte súbor .ova alebo .ovf."
+      },
+      {
+        "tailRich": "<strong>VMware Workstation / Fusion</strong> — File → Open; vyberte súbor .ova alebo .ovf."
+      },
+      {
+        "tailRich": "<strong>VirtualBox</strong> — File → Import Appliance; vyberte súbor .ova alebo .ovf."
+      }
+    ]
+  },
+  "troubleshoot": {
+    "heading": "Riešenie problémov",
+    "noSpaceTitle": "qemu-img convert zlyhá počas konverzie s chybou \"No space left on device\"",
+    "noSpaceBody": "V cieli sa minulo voľné miesto. Obsluha EXIT automaticky vyčistí dočasný adresár. Vyberte cieľ s väčším voľným miestom podľa odhadu vyššie a export spustite znova.",
+    "unsupportedHwTitle": "Export sa dokončí, ale VMware odmietne import: \"Unsupported hardware family\"",
+    "unsupportedHwBody": "Niektoré verzie ESXi odmietajú deskriptory OVF, ktoré deklarujú neznámu rodinu hardvéru. Otvorte .ovf v textovom editore alebo najprv rozbaľte .ova. Nájdite <code>&lt;vssd:VirtualSystemType&gt;</code> a zmeňte hodnotu na takú, ktorú ESXi prijme, napríklad <code>vmx-13</code> pre ESXi 6.5+. Ako rýchle obídenie problému skúste VirtualBox, ktorý je menej prísny.",
+    "nicTitle": "Importovaná VM používa inú sieťovú kartu alebo radič SCSI",
+    "nicBody": "OVF zachováva počet sieťových kariet, nie ich pôvodný model. Skontrolujte sieťové nastavenia importovanej VM v cieľovom hypervízore. Export deklaruje radič SCSI lsilogic pre kompatibilitu s VMware. Pri spätnom importe do Proxmoxu cez ProxMenux sa VM vytvorí s radičom LSI a kartami e1000; ak má hosťovský systém vhodné ovládače, prepnite potom na <code>VirtIO SCSI</code> a VirtIO.",
+    "runningTitle": "VM bežala a odmietol som jej vypnutie: export sa zrušil",
+    "runningBody": "Skript nemôže vytvoriť konzistentný obraz, keď sa na disky zapisuje. Nabudúce potvrďte vypnutie alebo najprv vypnite VM ručne (<code>qm shutdown $VMID</code>) a export spustite znova.",
+    "slowTitle": "Konverzia disku je pomalá",
+    "slowBody": "<code>qemu-img convert</code> používa jedno vlákno a číta zdroj plnou rýchlosťou. Pri 100 GB disku na mechanickom pevnom disku počítajte s 15–30 minútami. Prenos z NVMe na NVMe je 5–10-krát rýchlejší. Disky VM sa konvertujú postupne a čas rastie lineárne s celkovou virtuálnou veľkosťou."
+  },
+  "related": {
+    "heading": "Súvisiace",
+    "items": [
+      {
+        "href": "/docs/utils/import-vm",
+        "label": "Importovať VM z OVA / OVF",
+        "tail": " — doplnkový nástroj na spätný import."
+      },
+      {
+        "href": "/docs/utils",
+        "label": "Prehľad pomocných nástrojov",
+        "tail": " — Späť na prehľad sekcie."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sk/docs/utils/import-vm.json b/web/messages/sk/docs/utils/import-vm.json
new file mode 100644
index 00000000..fc4f335a
--- /dev/null
+++ b/web/messages/sk/docs/utils/import-vm.json
@@ -0,0 +1,218 @@
+{
+  "meta": {
+    "title": "Import VM z OVA / OVF | Dokumentácia ProxMenux",
+    "description": "Importujte VMware ESXi / Workstation / Fusion / VirtualBox / ProxMenux VM do Proxmox VE. Automaticky extrahuje OVA, analyzuje metadáta OVF, vytvorí VM a importuje každý disk ako natívny formát úložiska (qcow2 / raw).",
+    "ogTitle": "Import VM z OVA / OVF | Dokumentácia ProxMenux",
+    "ogDescription": "Importujte do Proxmoxu VM exportované z VMware, VirtualBox alebo ProxMenux. Disky sa automaticky konvertujú do natívneho formátu úložiska."
+  },
+  "header": {
+    "title": "Importovať VM z OVA / OVF",
+    "description": "Importuje balík OVA / OVF do Proxmox VE: rozbalí archívy OVA, z deskriptora OVF načíta vCPU, pamäť, počet sieťových kariet a odkazy na disky, potom vytvorí VM a pomocou qm importdisk importuje každý disk do vybraného úložiska. Kompatibilné s exportmi z VMware (ESXi / Workstation / Fusion), VirtualBox aj ProxMenux.",
+    "section": "Nástroje"
+  },
+  "intro": {
+    "title": "Čo to robí?",
+    "body": "Vytvorí kompletnú VM v Proxmoxe z prenosného balíka. Po importe je pripravená na spustenie; pre výkon a kompatibilitu sa odporúča skontrolovať model sieťovej karty, firmvér a typ operačného systému."
+  },
+  "picker": {
+    "heading": "Vyberač súborov",
+    "intro": "Pri štarte skript ponúka dva prednastavené adresáre alebo manuálnu cestu:",
+    "items": [
+      "<code>/var/lib/vz/dump</code> — predvolený adresár záloh vzdump v Proxmox.",
+      "<code>/var/lib/vz/template/iso</code> — užitočné, ak ste sem preniesli OVA cez sftp.",
+      "Manuálna cesta pre OVA / OVF súbory kdekoľvek inde na hostiteľovi."
+    ],
+    "outro": "To potom uvádza každý súbor <code>.ova</code> a <code>.ovf</code> vo vybranom adresári.",
+    "imageAlt": "Dialóg výberu súboru VM na import"
+  },
+  "flow": {
+    "heading": "Ako funguje import",
+    "nodes": [
+      {
+        "label": "Vstup OVA / OVF",
+        "detail": ".ova → tar xf do\n /tmp/.proxmenux-import-*\n.ovf → použiť na mieste",
+        "variant": "source"
+      },
+      {
+        "label": "Spracovať + dialógy",
+        "detail": "AWK načíta OVF\n(názov, vCPU, RAM, NIC,\ndisky). Výber\nVMID / úložiska / mosta",
+        "variant": "bridge"
+      },
+      {
+        "label": "qm create + importdisk",
+        "detail": "qm create $VMID\nqm importdisk\n(VMDK → formát úložiska)\nqm set --scsiN",
+        "variant": "target"
+      }
+    ]
+  },
+  "ovf": {
+    "heading": "OVF spracovanie",
+    "intro": "Parser <strong>gawk</strong> načíta deskriptor OVF a metadáta VM. Používa <code>match()</code> s tromi argumentmi, čo je rozšírenie gawk, ktoré mawk, predvolený <code>awk</code> v Debiane / Proxmoxe, nepodporuje. Ak gawk chýba, skript ho pri prvom importe nainštaluje cez <code>ensure_repositories</code> + <code>install_single_package</code>. Ďalšie importy tento krok nepotrebujú. Načítané polia:",
+    "headerField": "Pole",
+    "headerSource": "Zdroj v OVF",
+    "headerDefault": "Štandardne, ak chýba",
+    "rows": [
+      {
+        "field": "Názov VM",
+        "source": "<Name> (prvá zhoda)",
+        "default": "imported-vm"
+      },
+      {
+        "field": "Počet vCPU",
+        "source": "RASD ResourceType 3 → VirtualQuantity",
+        "default": "1"
+      },
+      {
+        "field": "Pamäť (MiB)",
+        "source": "RASD ResourceType 4 → VirtualQuantity",
+        "default": "1024"
+      },
+      {
+        "field": "Počet NIC",
+        "source": "počet ResourceType 10",
+        "default": "1"
+      },
+      {
+        "field": "Typ OS",
+        "source": "/Linux/ alebo /Windows/ v popise",
+        "default": "other"
+      },
+      {
+        "field": "Odkazy na disk",
+        "source": "href atribúty končiace v .vmdk / .qcow2 / .img / .raw",
+        "default": "Žiadne (import sa zruší)"
+      }
+    ]
+  },
+  "memWarn": {
+    "title": "Nejasnosť pamäťovej jednotky",
+    "body": "Parser prevedie rozpoznané jednotky pamäte na <strong>MiB</strong>, vrátane bajtov, KiB, MiB, GiB a podporovaných textových označení. Chýbajúce alebo neznáme jednotky sa <em>považujú za MiB</em>. Po importe porovnajte <code>qm config $VMID | grep memory</code> so zdokumentovanou RAM zdrojovej VM a podľa potreby ju opravte pomocou <code>qm set $VMID --memory &lt;MiB&gt;</code>."
+  },
+  "dialog": {
+    "heading": "Postup dialógov importu",
+    "items": [
+      "<strong>VMID</strong> — predvolene ďalší voľný identifikátor (<code>pvesh get /cluster/nextid</code>).",
+      "<strong>Názov VM</strong> — predvolene názov načítaný z OVF; môžete ho zmeniť.",
+      "<strong>Cieľové úložisko</strong> — zoznam úložísk s obsahom <code>images</code> z <code>pvesm status -content images</code>.",
+      "<strong>Sieťový most</strong> — zoznam mostov z <code>ip link show type bridge</code>. Jediný most sa vyberie automaticky; predvolený je <code>vmbr0</code>.",
+      "<strong>Potvrdenie</strong> — súhrn s VMID, názvom, vCPU, pamäťou, sieťovými kartami, úložiskom, mostom a zoznamom diskov na import. Pri zrušení sa nič nemení."
+    ]
+  },
+  "create": {
+    "heading": "Vytvorenie VM",
+    "intro": "Po potvrdení skript spustí:",
+    "code": "qm create $VMID \\\n    --name \"$NAME\" \\\n    --memory $MEMORY \\\n    --cores $VCPU \\\n    --ostype $OSTYPE \\\n    --scsihw lsi \\\n    --net0 e1000,bridge=$BRIDGE\n\n# For each additional NIC:\nqm set $VMID --netN e1000,bridge=$BRIDGE",
+    "outro": "SCSI radič predvolí <code>lsi</code> (LSI Logic) pre kompatibilitu VMDK. NIC predvolené <code>e1000</code> (univerzálna kompatibilita) na zvolenom moste."
+  },
+  "diskLoop": {
+    "heading": "Cyklus importu diskov",
+    "intro": "Pre každý odkaz na disk v OVF:",
+    "items": [
+      "<code>qm importdisk $VMID $disk_path $STORAGE</code> — importuje disk vo formáte podporovanom cieľovým úložiskom a vytvorí položku <code>unusedN:</code> v konfigurácii VM.",
+      "Skript pomocou grep vyhľadá v konfigurácii práve vytvorený odkaz <code>unusedN</code>.",
+      "<code>qm set $VMID --scsiN $unused_disk</code> Prikladá disk ako <code>scsi0</code>, <code>scsi1</code>, …",
+      "<code>qm set $VMID --delete unusedN</code> — odstráni už nepotrebnú značku unused."
+    ],
+    "outro": "Boot je nastavená na prvý SCSI disk: <code>qm set $VMID --boot c --bootdisk scsi0</code>."
+  },
+  "postImport": {
+    "heading": "Odporúčané úpravy po importe",
+    "intro": "Import používa široko kompatibilné nastavenia, aby sa VM podľa možnosti spustila na prvý pokus. Po overení štartu môžete v rozhraní Proxmox alebo cez CLI vybrať výkonnejšie nastavenia:",
+    "headerSetting": "Nastavenie",
+    "headerDefault": "Štandardné po importe",
+    "headerRecommended": "Odporúčané (ak hosť podporuje)",
+    "rows": [
+      {
+        "setting": "Model sieťovej karty",
+        "default": "e1000",
+        "recommended": "VirtIO (oveľa rýchlejšie, potrebuje ovládač v hosťovskom systéme)"
+      },
+      {
+        "setting": "SCSI radič",
+        "default": "LSI",
+        "recommended": "VirtIO SCSI single (novší Linux alebo Windows s ovládačmi VirtIO)"
+      },
+      {
+        "setting": "Firmvér (BIOS / UEFI)",
+        "default": "Proxmox predvolený (BIOS)",
+        "recommended": "Použite firmvér zdrojovej VM; nesúlad zabráni štartu"
+      },
+      {
+        "setting": "QEMU hosťujúci agent",
+        "default": "Vypnuté",
+        "recommendedRich": "Zapnúť a nainštalovať <code>qemu-guest-agent</code> v hosťovskom systéme (lepšie zálohy a hlásenie IP adries)"
+      },
+      {
+        "setting": "Typ OS",
+        "default": "l26 / win10 / other (heuristika)",
+        "recommended": "Overte podľa skutočného hosťovského operačného systému"
+      },
+      {
+        "setting": "Zobrazenie",
+        "default": "Štandardné",
+        "recommended": "VirtIO-GPU alebo SPICE (lepší výkon konzol)"
+      }
+    ]
+  },
+  "fwWarn": {
+    "title": "Nesúlad firmvéru zabráni štartu",
+    "body": "Ak zdrojová VM používala UEFI, ale Proxmox ju vytvorí s BIOS, alebo naopak, hosťovský systém nenájde zavádzací disk. Overte <em>FirmwareType / firmware</em> v OVF alebo v nastaveniach pôvodnej VM a nastavte rovnakú voľbu v Proxmoxe: <code>qm set $VMID --bios ovmf</code> pre UEFI; predvolená hodnota BIOS je <code>seabios</code>."
+  },
+  "notImported": {
+    "heading": "Čo sa NEIMPORTUJE",
+    "items": [
+      "<strong>Konkrétne sieťové mosty</strong> — zachová sa iba počet kariet. Všetky sa pripoja k mostu vybranému pri importe.",
+      "<strong>Model NIC</strong> – predvolená hodnota je e1000.",
+      "<strong>Typ firmvéru BIOS / UEFI</strong> — použije sa predvolený BIOS Proxmox.",
+      "<strong>Konfigurácia priameho priradenia PCI</strong>.",
+      "<strong>TPM</strong> (vTPM).",
+      "<strong>Cloud-init</strong> disky.",
+      "<strong>Snímky</strong> — iba aktuálny stav.",
+      "<strong>USB / sériové / paralelné zariadenia</strong> deklarované v OVF.",
+      "<strong>VM možnosti tagov / poznámok / štart-on-boot</strong>."
+    ]
+  },
+  "troubleshoot": {
+    "heading": "Riešenie problémov",
+    "orphanTitle": "VM sa vytvorila, ale import diskov zlyhal: zostala čiastočná VM",
+    "orphanIntro": "Pri zlyhaní importu skript ponúkne odstránenie čiastočnej VM aj importovaných diskov. Ak ste odmietli alebo automatické odstránenie zlyhalo, skontrolujte VM a odstráňte ju ručne pomocou:",
+    "orphanCode": "qm destroy $VMID --destroy-unreferenced-disks 1",
+    "orphanOutro": "Potom opravte príčinu, pravdepodobne nedostatok miesta v cieľovom úložisku, a import zopakujte.",
+    "memTitle": "Importovaná VM má 8 MB RAM alebo 8 TB",
+    "memIntro": "Parser prevedie rozpoznané AllocationUnits na MiB. Chýbajúce alebo neznáme jednotky považuje za MiB. Skontrolujte OVF a porovnajte importovanú pamäť so zdrojovou VM. Podľa potreby ju opravte:",
+    "memCode": "qm set $VMID --memory 8192    # 8 GiB",
+    "bootTitle": "Importovaná VM sa nespustí: \"No bootable device\"",
+    "bootIntro": "Najčastejšia príčina: BIOS / UEFI nesúlad. VM bol UEFI, ale Proxmox ho vytvoril ako BIOS. Nastavte zodpovedajúci firmvér:",
+    "bootCode": "qm set $VMID --bios ovmf       # UEFI\n# also add an EFI disk for the EFI vars:\nqm set $VMID --efidisk0 $STORAGE:1,format=qcow2,efitype=4m,pre-enrolled-keys=1",
+    "bootOutro": "Ďalšia častá príčina: poradie štartu ukazuje na scsi0, ale operačný systém je na scsi1. Upravte poradie na karte Možnosti VM.",
+    "bsodTitle": "VM so systémom Windows exportovaná z VMware zobrazí pri prvom štarte modrú obrazovku",
+    "bsodBody": "Windows je citlivý na zmenu radiča disku. Nainštalujte ovládače VirtIO <em>pred</em> exportom z VMware alebo ponechajte predvolený radič <code>lsi</code>. Na VirtIO SCSI prejdite až po spustení hosťovského systému a inštalácii ovládačov VirtIO vo Windows.",
+    "zeroTitle": "Parser OVF hlási 0 diskov",
+    "zeroBody": "OVF môže používať odkazy na disky, ktoré parser nerozpozná. Otvorte ho a pre každý disk nájdite položku <code>&lt;File ovf:href=\"...vmdk\" ...&gt;</code>. Ak je disk skutočne VMDK, ale má nezvyčajnú príponu ako <code>.dat</code>, premenujte ho na <code>.vmdk</code> a aktualizujte odkaz v OVF. Premenovanie nekonvertuje formát disku.",
+    "awkTitle": "awk: syntax error at or near , — parser zlyhá pri každom OVA / OVF",
+    "awkIntro": "Parser OVF používa syntax gawk: <code>match()</code> s tromi argumentmi. Tú mawk, predvolený <code>awk</code> v Debiane / Proxmoxe, nepodporuje. Novšie verzie skriptu nainštalujú gawk pri prvom použití cez <code>ensure_repositories</code> + <code>install_single_package</code>. Pri staršej kópii ho nainštalujte ručne:",
+    "awkCode": "apt-get install -y gawk",
+    "awkOutro": "Potom znovu spustite import.",
+    "netTitle": "Sieť nefunguje po prvom spustení",
+    "netBody": "Hosťovský systém nemusí mať ovládače pre model sieťovej karty e1000 alebo môže byť vybraný nesprávny most. Na karte Hardware VM zmeňte Network Device → Model. V hosťovskom systéme skontrolujte aj <code>ip a</code>: rozhranie môže mať nový názov, napríklad ens18 namiesto eth0, zatiaľ čo sieťové nastavenie stále používa starý názov."
+  },
+  "files": {
+    "heading": "Príslušné súbory",
+    "code": "scripts/utilities/import_vm_ova_ovf.sh       # this script\n/tmp/.proxmenux-import-*/                    # temp extraction dir for OVA\n/etc/pve/nodes/<node>/qemu-server/<vmid>.conf  # created by qm create\n<storage>/<vmid>/<vmid>-disk-<n>.<fmt>        # disk images, format depends on storage"
+  },
+  "related": {
+    "heading": "Súvisiace",
+    "items": [
+      {
+        "href": "/docs/utils/export-vm",
+        "label": "Exportovať VM do OVA / OVF",
+        "tail": " — doplnkový nástroj na export VM."
+      },
+      {
+        "href": "/docs/utils",
+        "label": "Prehľad pomocných nástrojov",
+        "tail": " — Späť na prehľad sekcie."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sk/docs/utils/index.json b/web/messages/sk/docs/utils/index.json
new file mode 100644
index 00000000..c006b4bc
--- /dev/null
+++ b/web/messages/sk/docs/utils/index.json
@@ -0,0 +1,115 @@
+{
+  "meta": {
+    "title": "Nástroje Proxmox — UUP Dump, aktualizácia PVE 8 na 9, export/import OVA | ProxMenux",
+    "description": "Každodenné nástroje pre Proxmox VE: vytváranie obrazov ISO systému Windows cez UUP Dump, inštalácia vybraných nástrojov CLI, bezpečná aktualizácia systému Proxmox, prechod z PVE 8 na PVE 9, export VM do OVA / OVF a import VM vo formáte OVA / OVF z VMware alebo VirtualBox.",
+    "ogTitle": "Nástroje Proxmox — UUP Dump, aktualizácia PVE 8 na 9, export/import OVA",
+    "ogDescription": "Vytvárajte obrazy ISO systému Windows, inštalujte nástroje CLI, bezpečne aktualizujte systém, prejdite z PVE 8 na PVE 9 a exportujte alebo importujte VM vo formáte OVA / OVF.",
+    "twitterTitle": "Nástroje Proxmox | ProxMenux",
+    "twitterDescription": "Tvorba ISO, nástroje CLI, aktualizácia Proxmoxu, prechod PVE 8→9 a prenosnosť VM vo formáte OVA / OVF."
+  },
+  "header": {
+    "title": "Pomocné nástroje",
+    "description": "Šesť nástrojov dopĺňa každodennú prácu s Proxmox VE: tvorbu ISO, údržbu systému a prenos VM. Každá možnosť je nezávislá. Vyberte si tú, ktorú potrebujete; nič sa nenainštaluje, kým o to nepožiadate.",
+    "section": "Nástroje"
+  },
+  "intro": {
+    "title": "Na čo je toto menu",
+    "body": "Tri skupiny nezávislých, ale často potrebných nástrojov: <strong>vytvorenie ISO systému Windows</strong> cez UUP Dump, <strong>údržba hostiteľa Proxmox</strong> (nástroje CLI, aktualizácie a prechod na novú hlavnú verziu) a <strong>import a export VM</strong> v Proxmoxe pomocou štandardného formátu OVA / OVF."
+  },
+  "opening": {
+    "heading": "Otvorenie menu",
+    "body": "V hlavnom menu ProxMenux vyberte <strong>Utilities</strong>. Zobrazí sa toto:",
+    "imageAlt": "Menu pomocných nástrojov s UUP Dump, systémovými nástrojmi, aktualizáciou, prechodom na novú verziu, exportom a importom"
+  },
+  "groups": {
+    "heading": "Tri skupiny nástrojov",
+    "intro": "Šesť nástrojov patrí do troch nezávislých skupín. Kliknite na kartu nižšie pre skok do zodpovedajúcej časti.",
+    "iso": {
+      "title": "Tvorba ISO",
+      "body": "Vytvorte oficiálne obrazy ISO systému Windows cez UUP Dump priamo na hostiteľovi Proxmox.",
+      "bullets": [
+        "Zdieľaný odkaz UUP Dump → zavádzací obraz ISO",
+        "Závislosti nainštalované automaticky",
+        "Výsledok sa uloží do adresára šablón ISO v Proxmoxe"
+      ]
+    },
+    "maintenance": {
+      "title": "Údržba systému",
+      "body": "Udržiavajte hostiteľa v dobrom stave pomocou nástrojov CLI, pravidelných aktualizácií a prechodu na novú hlavnú verziu, keď príde čas.",
+      "bullets": [
+        "Inštalátor systémových nástrojov (25 nástrojov CLI)",
+        "Aktualizácia systému Proxmox (apt + dist-upgrade)",
+        "Prechod z PVE 8 na PVE 9"
+      ]
+    },
+    "portability": {
+      "title": "Prenosnosť VM",
+      "body": "Importujte a exportujte VM v Proxmoxe pomocou štandardného formátu OVA / OVF.",
+      "bullets": [
+        "Exportovať Proxmox VM → OVA / OVF",
+        "Importovať OVA / OVF → Proxmox VM",
+        "Kompatibilný s VMware a VirtualBox"
+      ]
+    }
+  },
+  "upgradeWarn": {
+    "title": "Prechod PVE 8 → 9 je deštruktívny a nie je vratný",
+    "body": "Aktualizácia hlavnej verzie prepíše základ Debianu (Bookworm → Trixie) aj súčasti Proxmox priamo na mieste. Nie je k dispozícii automatický návrat: pred začiatkom potrebujete <strong>overené zálohy</strong> každej VM a CT a <strong>prístup ku konzole / IPMI / iKVM</strong>. Preto sa aktualizačný nástroj odmietne spustiť vo webovom termináli Proxmox."
+  },
+  "isoSection": {
+    "heading": "Tvorba ISO",
+    "body": "Vytvorte nový, aktuálny inštalačný obraz ISO systému Windows priamo na hostiteľovi Proxmox. Skript automatizuje celý postup UUP Dump: inštaláciu závislostí (aria2c, cabextract, wimlib-imagex, …), paralelné sťahovanie aktualizačných súborov cez aria2 a konverziu na jeden zavádzací obraz ISO. Ten sa uloží do <code>/var/lib/vz/template/iso</code> a je pripravený na pripojenie k VM.",
+    "options": [
+      {
+        "title": "Tvorba ISO cez UUP Dump",
+        "description": "Vytvorte aktuálny inštalačný obraz ISO systému Windows zo zdieľaného odkazu UUP Dump. Závislosti, sťahovanie aj konverzia sú plne automatizované. Výsledný obraz ISO sa uloží do /var/lib/vz/template/iso a je pripravený na vytvorenie VM.",
+        "href": "/docs/utils/UUp-Dump-ISO-Creator"
+      }
+    ]
+  },
+  "maintenanceSection": {
+    "heading": "Údržba systému",
+    "body": "Tri nástroje pokrývajú každodenné aj príležitostné úlohy na hostiteľovi. <strong>Inštalátor systémových nástrojov</strong> nastaví nástroje CLI, ktoré využijete po novej inštalácii. <strong>Aktualizácia systému Proxmox</strong> slúži na týždennú alebo mesačnú údržbu. <strong>Prechod z PVE 8 na PVE 9</strong> je veľká zmena pri každej novej hlavnej verzii a zahŕňa dodatočné bezpečnostné kontroly, pretože nie je vratná.",
+    "options": [
+      {
+        "title": "Inštalátor systémových nástrojov",
+        "description": "Výber 25 osvedčených nástrojov CLI (htop, btop, iperf3, tmux, ...) s vlastným výberom alebo preddefinovanými skupinami (základné, vývoj, kompresia, multiplexery, analýza, sieť). Používa štandardný postup s repozitárom a overovacím príkazom.",
+        "href": "/docs/utils/system-utils"
+      },
+      {
+        "title": "Aktualizácia systému Proxmox",
+        "description": "Kontrola repozitárov + apt update + apt dist-upgrade s potvrdením pred reštartom. Rozpozná hlavnú verziu PVE (8 alebo 9), zachová nakonfigurované repozitáre a pred prepnutím hostiteľa bez predplatného na repozitár no-subscription požiada o potvrdenie. Potom spustí autoremove.",
+        "href": "/docs/utils/system-update"
+      },
+      {
+        "title": "Prechod z PVE 8 na PVE 9",
+        "description": "Prechod na novú hlavnú verziu (Debian Bookworm → Trixie + PVE 8 → 9). Kontroly pred začiatkom, migrácia repozitárov, automatizovaný alebo interaktívny režim, následné overenie a reštart. Odmietne spustenie z webového terminálu.",
+        "href": "/docs/utils/upgrade-pve8-pve9"
+      }
+    ]
+  },
+  "portabilitySection": {
+    "heading": "Prenosnosť VM (OVA / OVF)",
+    "body": "OVA a OVF sú formáty balíkov na prenos medzi hypervízormi podľa štandardu DMTF. Podporujú ich VMware, VirtualBox a Proxmox. Oba nástroje umožňujú export aj spätný import: VM exportovanú z Proxmoxu možno znova importovať a naopak. Použite ich na migráciu pracovných záťaží z ESXi, vytvorenie prenosnej zálohy VM alebo zdieľanie pripravenej VM s používateľom VirtualBox.",
+    "options": [
+      {
+        "title": "Exportovať VM do OVA / OVF",
+        "description": "Preveďte VM Proxmox na prenosný archív OVA alebo adresár OVF. Štandardná schéma DMTF, manifest SHA1 a disky VMDK vo formáte streamOptimized. Import je možný vo VMware (ESXi / Workstation / Fusion), VirtualBox aj späť v Proxmoxe.",
+        "href": "/docs/utils/export-vm"
+      },
+      {
+        "title": "Importovať VM z OVA / OVF",
+        "description": "Preneste export VMware / VirtualBox / ProxMenux späť do Proxmoxu. Automaticky extrahuje OVA, analyzuje metadáta OVF, vytvorí VM a importuje každý disk ako natívny formát úložiska.",
+        "href": "/docs/utils/import-vm"
+      }
+    ]
+  },
+  "diskSpaceCallout": {
+    "title": "Poznámka k priestoru na disku pri exporte / importe",
+    "body": "Oba nástroje konvertujú formáty diskov: export používa <code>qemu-img convert -O vmdk -o subformat=streamOptimized</code>; import používa <code>qm importdisk</code> na spätnú konverziu do natívneho formátu úložiska (qcow2 / raw). Pri exporte počítajte s <strong>~120% virtuálnej veľkosti disku</strong> pre OVF a <strong>~220%</strong> pre OVA. Archív OVA používa nekomprimovaný TAR a vytvára sa, kým dočasné súbory VMDK ešte existujú. Pred začiatkom overte, či je v cieľovom adresári dostatok voľného miesta."
+  },
+  "fitsTogether": {
+    "heading": "Ako je menu usporiadané",
+    "body": "Každý nástroj má vlastný skript v <code>scripts/utilities/</code>. Aktualizácia systému Proxmox volá jediný bezpečný skript v <code>scripts/global/</code>, update-pve-safe.sh, ktorý rozpozná hlavnú verziu a obsluhuje PVE 8 aj PVE 9. Prechod PVE 8 → 9 ponúka vo vlastnom menu dve ďalšie akcie: samostatnú <em>Kontrolu pred aktualizáciou</em> (spustí <code>pve8to9 --full</code>) a <em>Príručku na manuálnu aktualizáciu</em> iba na čítanie (postup so 17 krokmi), pre používateľov, ktorí chcú proces skontrolovať alebo vykonať ručne."
+  }
+}
diff --git a/web/messages/sk/docs/utils/system-update.json b/web/messages/sk/docs/utils/system-update.json
new file mode 100644
index 00000000..bab1ab9e
--- /dev/null
+++ b/web/messages/sk/docs/utils/system-update.json
@@ -0,0 +1,168 @@
+{
+  "meta": {
+    "title": "Aktualizácia systému Proxmox | Dokumentácia ProxMenux",
+    "description": "Aktualizuje balíky v rámci aktuálnej hlavnej verzie Proxmox pomocou apt-get update a apt full-upgrade -y. Kontroluje miesto na disku a repozitáre, skúša obnoviť kľúče GPG, kontroluje a opravuje staré hlavičky PV v LVM, podľa potreby znovu zostaví spravované ovládače DKMS, spustí autoremove/autoclean a ponúkne potrebný reštart.",
+    "ogTitle": "Aktualizácia systému Proxmox | Dokumentácia ProxMenux",
+    "ogDescription": "apt full-upgrade s kontrolou repozitárov, autoremove/autoclean a výzvou na reštart podľa potreby."
+  },
+  "header": {
+    "title": "Aktualizácia systému Proxmox",
+    "description": "Volá jediný pracovný skript (<code>update-pve-safe.sh</code>), ktorý rozpozná hlavnú verziu Proxmox. Nakonfigurované repozitáre načíta cez API Proxmox a zachová ich. Hostiteľ bez predplatného, ktorý používa iba Enterprise, musí potvrdiť prechod na no-subscription. Skript aktualizuje balíky a znovu zostaví ovládače DKMS spravované ProxMenux pre jadro pripravené na ďalší štart. Hlavný skript ponúkne reštart, ak existuje systémová značka alebo sa najnovšie nainštalované jadro líši od spusteného. Pri čakajúcich aktualizáciách možno postup spustiť aj cez <em>Update Now</em> v hlavičke ProxMenux Monitor.",
+    "section": "Nástroje"
+  },
+  "calloutWhat": {
+    "title": "Čo to robí?",
+    "body": "Aktualizuje hostiteľa na najnovšiu úroveň opráv jeho aktuálnej hlavnej verzie. <strong>Neprechádza</strong> na inú hlavnú verziu; pre PVE 8 → PVE 9 pozrite <link>Prechod z PVE 8 na PVE 9</link>."
+  },
+  "official": {
+    "heading": "Oficiálne odporúčanie pre Proxmox",
+    "intro": "Proxmox pri aktualizácii bežiaceho hostiteľa v rámci rovnakej hlavnej verzie odporúča spustiť:",
+    "code": "apt update && apt full-upgrade -y",
+    "outro": "Tento riadok je oficiálnym príkazom pre aktuálne vydania Proxmox. Treba tiež overiť správnosť repozitárov, zapnutie vhodných zdrojov a dobrý stav hostiteľa po aktualizácii."
+  },
+  "onTop": {
+    "heading": "Čo ProxMenux pridáva: overené v skripte",
+    "intro": "Používa <strong>rovnakú operáciu apt full-upgrade</strong> s kontrolou repozitárov, opätovným zostavením DKMS a následným čistením. Nasledujúce kroky zodpovedajú <code>scripts/utilities/proxmox_update.sh</code> a jeho jedinému pracovnému skriptu <code>scripts/global/update-pve-safe.sh</code>:",
+    "items": [
+      "<strong>Rozpozná hlavnú verziu PVE</strong> v pracovnom skripte (<code>pveversion | grep -oP ''pve-manager/\\K[0-9]+''</code>). Jeden skript obsluhuje PVE 8 aj PVE 9. Repozitáre sa zachovajú, ak hostiteľ bez predplatného nepotvrdí ponúknutú zmenu.",
+      "<strong>Zachová nakonfigurované repozitáre.</strong> <code>ensure_repositories</code> cez API Proxmox načíta repozitáre a stav predplatného. Pri aktívnom predplatnom alebo už používanom repozitári no-subscription či test nič nemení. Hostiteľ bez aktívneho predplatného s jediným repozitárom Enterprise musí potvrdiť prechod na no-subscription. Pri odmietnutí sa aktualizácia skončí bez zmeny zdrojov.",
+      "<strong>Spustí aktualizáciu neinteraktívne</strong> s <code>DEBIAN_FRONTEND=noninteractive</code> a <code>--force-confdef --force-confold</code>. Pri rozhodovaní o konfiguračných súboroch dpkg prijme predvolenú akciu, ak existuje; inak zachová aktuálny súbor.",
+      "<strong>Nevynucuje voliteľné nástroje.</strong> Bezpečný skript nevnucuje hostiteľovi <code>zfsutils-linux</code>, <code>chrony</code>, <code>ifupdown2</code> ani podobné balíky. Ak sa inštalácia Proxmox rozhodla niektorý z nich nepoužiť, táto voľba sa zachová. Chýbajúce balíky oznamujú nadradené inštalačné postupy, nie aktualizačný postup.",
+      "<strong>Kontrola a oprava metadát LVM.</strong> Rozpozná staré hlavičky PV a pre dotknuté skupiny zväzkov spustí vgck --updatemetadata a vgchange -ay. Môže zmeniť metadáta LVM; nejde iba o kontrolu s upozorneniami.",
+      "<strong>Potom vyčistí:</strong> <code>apt-get autoremove -y</code> + <code>apt-get autoclean -y</code>.",
+      "<strong>Opätovné zostavenie DKMS pred výzvou na reštart.</strong> Pracovný skript volá <code>pmx_rebuild_dkms_after_kernel</code>, keď je pripravené novšie nainštalované jadro. Hlavný skript kontroluje <code>/var/run/reboot-required</code> a pomocou <code>dpkg-query</code> porovná jadro uvedené v <code>uname -r</code> s najnovšie nainštalovaným balíkom <code>proxmox-kernel-*-pve-signed</code> / <code>pve-kernel-*-pve</code>. Na hostiteľoch bez <code>needrestart</code> môže značka chýbať; porovnanie jadier funguje aj vtedy."
+    ]
+  },
+  "calloutOneSentence": {
+    "title": "V jednej vete",
+    "body": "Aktualizuje balíky hostiteľa, zachová repozitáre bez potvrdenej zmeny, skontroluje metadáta LVM, znovu zostaví spravované ovládače DKMS, vyčistí systém cez autoremove/autoclean a podľa potreby ponúkne reštart."
+  },
+  "confirm": {
+    "heading": "Potvrdzovací dialóg",
+    "intro": "Výber možnosti otvorí súhrn plánovaných krokov a vyžaduje výslovné potvrdenie:",
+    "imageAlt": "Potvrdzovací dialóg aktualizácie Proxmox s kontrolou repozitárov, aktualizáciou balíkov a čistením"
+  },
+  "routes": {
+    "heading": "Ako hlavný skript odovzdáva prácu",
+    "nodes": {
+      "source": {
+        "label": "proxmox_update.sh",
+        "detail": "pveversion |\ngrep -oP ''pve-manager/\\K[0-9]+''"
+      },
+      "bridge": {
+        "label": "Jediný pracovný skript",
+        "detail": "update-pve-safe.sh\n(rozpozná PVE 8 / 9\ninterne)"
+      },
+      "target": {
+        "label": "Po aktualizácii",
+        "detail": "apt-get autoremove\napt-get autoclean\nVýzva na reštart podľa potreby"
+      }
+    }
+  },
+  "worker": {
+    "heading": "Čo robí pracovný skript",
+    "intro": "Jeden pracovný skript (<code>scripts/global/update-pve-safe.sh</code>) obsluhuje PVE 8 (<code>bookworm</code>) aj PVE 9 (<code>trixie</code>). Interne rozpozná hlavnú verziu a kontroluje existujúce repozitáre bez prepísania základných zdrojov Debianu. Kroky sú:",
+    "items": [
+      "<strong>Kontroly pred začiatkom.</strong> Overí aspoň ~1 GB voľného miesta v <code>/var/cache/apt/archives</code>. Pri nedostatku miesta sa včas zastaví s jasnou správou, aby nezlyhal uprostred operácie apt.",
+      "<strong>Kontrola repozitárov.</strong> <code>ensure_repositories</code> načíta repozitáre a stav predplatného. Pri použiteľnom repozitári Proxmox nič nemení. Hostiteľ bez aktívneho predplatného s jediným repozitárom Enterprise musí potvrdiť prechod na no-subscription; pri odmietnutí sa aktualizácia skončí.",
+      "<strong>apt update s automatickou obnovou GPG.</strong> Pri <code>NO_PUBKEY</code> pre ľubovoľný repozitár vrátane zdroja tretej strany skript importuje chýbajúci kľúč a automaticky zopakuje pokus pred ohlásením chyby.",
+      "<strong>Čakajúce a bezpečnostné aktualizácie.</strong> Uvedie počet menených balíkov a počet balíkov z bezpečnostnej vetvy, aby potvrdzovací dialóg zobrazoval konkrétne čísla.",
+      "<strong>Potvrdzovací dialóg.</strong> Po obnovení zoznamov balíkov pracovný skript vyžaduje výslovné áno pred aktualizáciou balíkov.",
+      "<strong>apt full-upgrade.</strong> Používa <code>DEBIAN_FRONTEND=noninteractive</code> a <code>--force-confdef --force-confold</code>. Dpkg pri rozhodovaní o konfiguračných súboroch použije predvolenú akciu, ak existuje; inak zachová aktuálny súbor.",
+      "<strong>Kontrola LVM.</strong> <code>lvm_repair_check</code> obnoví metadáta skupín zväzkov, keď sa disky priamo priradené hosťovským VM (DSM, TrueNAS alebo úložné zariadenia) vrátia so starými hlavičkami PV.",
+      "<strong>Opätovné zostavenie ovládačov DKMS spravovaných ProxMenux.</strong> Keď je pripravené nové jadro, <code>pmx_rebuild_dkms_after_kernel</code> načíta ovládače nainštalované ProxMenux zo súboru <code>components_status.json</code> (aktuálne <code>nvidia_driver</code> → modul <code>nvidia</code> a <code>coral_driver</code> → modul <code>gasket</code>), nainštaluje príslušné hlavičky jadra (<code>proxmox-headers-&lt;newkver&gt;</code>, ak sú dostupné, inak <code>pve-headers-&lt;newkver&gt;</code>) a spustí <code>dkms autoinstall -k &lt;newkver&gt;</code>. Ak <code>dkms status</code> nezobrazuje moduly zostavené pre nové jadro, znovu spustí jednotlivé inštalátory s <code>--auto-reinstall</code>. Chyby sa zaznamenajú, ale aktualizáciu nezrušia; postup sa dostane k výzve na reštart.",
+      "<strong>Záverečné čistenie.</strong> <code>apt-get autoremove</code> + <code>apt-get autoclean</code> pred odovzdaním riadenia hlavnému skriptu."
+    ]
+  },
+  "post": {
+    "heading": "Čistenie a reštart po aktualizácii",
+    "intro": "Po dokončení pracovného skriptu hlavný skript spustí:",
+    "code": "apt-get autoremove -y    # drop unused dependencies pulled in by old packages\napt-get autoclean        # drop downloaded .deb files no longer in the index",
+    "afterCode": "Hlavný skript tiež kontroluje potrebu reštartu. Ktorýkoľvek z týchto signálov vyvolá výzvu:",
+    "items": [
+      "Existuje <code>/var/run/reboot-required</code>: balík alebo systémový nástroj označil potrebu reštartovať hostiteľa.",
+      "Najnovšie nainštalovaný balík jadra Proxmox sa líši od spusteného jadra podľa <code>dpkg-query</code> a uname -r."
+    ],
+    "outro": "Ak platí niektorá podmienka, dialóg whiptail sa opýta <em>„Niektoré zmeny vyžadujú reštart. Chcete reštartovať teraz?“</em>. Odmietnutím môžete pokračovať s aktuálnym jadrom až do ručného reštartu, napríklad v plánovanom okne údržby."
+  },
+  "end": {
+    "heading": "Čo vidíte na konci",
+    "intro": "Po dokončení pracovného skriptu terminál zobrazí výsledok čistenia a podľa potreby aj výzvu na reštart:",
+    "imageAlt": "Záverečný súhrn aktualizácie Proxmox s výsledkom čistenia a výzvou na reštart"
+  },
+  "calloutDeclineReboot": {
+    "title": "Reštart odložte iba z konkrétneho dôvodu",
+    "body": "Inštalácia nového balíka <code>proxmox-kernel-*</code> nahradí spustené jadro až po reštarte. Nové jadro a zodpovedajúce moduly sa aktivujú pri ďalšom štarte. Naplánujte vhodné okno údržby a predtým skontrolujte upozornenia na chyby zostavenia DKMS."
+  },
+  "noSub": {
+    "heading": "Ako pracovný skript zaobchádza s repozitárom Enterprise",
+    "intro": "Proxmox predvolene zapína repozitár Enterprise. Bez aktívneho predplatného vráti pri <code>apt-get update</code> chybu 401. Pracovný skript mení repozitáre iba v tomto prípade a po potvrdení, cez API Proxmox používané v <em>Node → Updates → Repositories</em>. Jednotlivé prípady:",
+    "items": [
+      "Pri <strong>aktívnom predplatnom</strong> sa repozitáre nemenia a aktualizácie poskytuje Enterprise.",
+      "Ak je <strong>repozitár no-subscription alebo test už zapnutý</strong>, repozitáre sa nemenia bez ohľadu na ďalšie nakonfigurované zdroje.",
+      "Pri <strong>chýbajúcom aktívnom predplatnom a jedinom repozitári Enterprise</strong> dialóg ponúkne zmenu. Potvrdenie vypne zdroj Enterprise, zapne no-subscription a obnoví zoznamy balíkov. Zmena sa zaznamená v zobrazení <em>Changes</em> v Audit & Report. Odmietnutie ukončí aktualizáciu bez zmeny zdrojov.",
+      "Prítomné <strong>zdroje Ceph Enterprise</strong> sa vypnú pri rovnakej zmene bez výberu iného kanála Ceph. Hostiteľ používajúci Ceph si jeho kanál nastavuje samostatne.",
+      "Ak <strong>nie je dostupný terminál na potvrdenie</strong>, žiadny zdroj sa nezmení a aktualizácia sa skončí správou s odkazom na <em>Node → Updates → Repositories</em>."
+    ],
+    "outro": "Zdroje Debianu ani ostatné súbory repozitárov tento postup nikdy neupravuje. Položku kombinujúcu Enterprise s inými komponentmi neprepne: aktualizácia sa zastaví a požiada o rozdelenie položky v zobrazení repozitárov Proxmox."
+  },
+  "cluster": {
+    "heading": "Čo zohľadniť v klastri",
+    "calloutTitle": "V klastri aktualizujte vždy iba jeden uzol",
+    "calloutBody": "V klastri Proxmox spúšťajte túto možnosť vždy na <strong>jednom uzle</strong> a pred prechodom na ďalší počkajte na dokončenie reštartu. Najprv migrujte hosťovské systémy z uzla, aby nevznikol výpadok služieb celého klastra. Rôzne vedľajšie verzie, napríklad 8.4.1 a 8.4.5, môžu dočasne fungovať spolu niekoľko hodín; rôzne spustené jadrá môžu spôsobiť neočakávané správanie hosťovských systémov spravovaných HA."
+  },
+  "doesnt": {
+    "heading": "Čo to nerobí",
+    "items": [
+      "<strong>Prechod na novú hlavnú verziu.</strong> 8 → 9 je samostatná operácia; pozrite <link>Prechod z PVE 8 na PVE 9</link>.",
+      "<strong>Zálohovanie.</strong> Žiadne snímky ani návrat späť. Operácie apt nie sú transakčné. Zachovajte bežný postup zálohovania (PBS, vzdump, snímky ZFS).",
+      "<strong>Aktualizácie kontajnerov / VM.</strong> Aktualizuje sa iba hostiteľ; hosťovské systémy sa nemenia.",
+      "<strong>Samostatné nahrávanie firmvéru.</strong> Toto nie je nástroj na nahrávanie BIOS alebo firmvéru zariadení. Už nainštalované balíky firmvéru alebo mikrokódu CPU môžu byť aktualizované cez apt."
+    ]
+  },
+  "troubleshooting": {
+    "heading": "Riešenie problémov",
+    "items": [
+      {
+        "title": "apt update zlyhá s chybou 401 Unauthorized",
+        "body": "Repozitár Enterprise je zapnutý, ale hostiteľ nemá aktívne predplatné. Pred <code>apt-get update</code> skript ponúkne prechod na no-subscription. Ak ste ho odmietli, spustite aktualizáciu znova a potvrďte ho, alebo vypnite Enterprise v <em>Node → Updates → Repositories</em> a zapnite no-subscription."
+      },
+      {
+        "title": "dist-upgrade sa zastaví pri \"Configuring grub-pc\"",
+        "body": "Ak sa zobrazuje interaktívna otázka GRUB, žiada zariadenia na inštaláciu zavádzača. Voľba <code>--force-confold</code> platí pre konfiguračné súbory, nie pre tento výber zariadení. Pomocou <kbd>Tab</kbd> + <kbd>Space</kbd> vyberte príslušné zavádzacie disky a potom OK. Výber možno nastaviť vopred pomocou <code>dpkg-reconfigure grub-pc</code>."
+      },
+      {
+        "title": "Jadro sa aktualizovalo, ale chýbajú nové moduly externého ovládača",
+        "body": "Pre spravované ovládače (<code>nvidia_driver</code> a <code>coral_driver</code>) funkcia spustí <code>dkms autoinstall -k &lt;newkver&gt;</code> a môže zopakovať ich inštalátory s <code>--auto-reinstall</code>. Výsledok skontrolujte cez <code>dkms status</code>. Príkaz autoinstall môže znovu zostaviť aj iné registrované moduly DKMS; náhradné spustenie inštalátorov je obmedzené na spravované položky v <code>components_status.json</code>. Skontrolujte chýbajúce moduly tretích strán a podľa potreby ich zostavte pomocou <code>dkms autoinstall</code>."
+      },
+      {
+        "title": "Výzva na reštart sa nezobrazila, hoci sa nainštalovalo nové jadro",
+        "body": "Signály sú alternatívy: <code>/var/run/reboot-required</code> alebo rozdiel medzi spusteným a najnovšie nainštalovaným jadrom Proxmox. Hlavný skript neanalyzuje položky linux-image v zázname apt. Spustenú verziu overte cez <code>uname -r</code> a nainštalované balíky jadra cez <code>dpkg-query</code>. Potrebný reštart naplánujte alebo vo vhodnom čase spustite <code>shutdown -r now</code>."
+      }
+    ]
+  },
+  "files": {
+    "heading": "Príslušné súbory",
+    "code": "scripts/utilities/proxmox_update.sh              # this script (wrapper)\nscripts/global/update-pve-safe.sh                # single safe worker (PVE 8 + PVE 9)\nscripts/global/repository-functions.sh           # ensure_repositories\nscripts/global/repository_policy.py              # reads and switches repositories through the Proxmox API\nscripts/global/utils-install-functions.sh        # pmx_rebuild_dkms_after_kernel\n/usr/local/share/proxmenux/components_status.json # ProxMenux-managed DKMS driver registry\n/etc/apt/sources.list.d/proxmox.sources          # no-subscription source, written by Proxmox when the switch is accepted\n/var/run/reboot-required                         # read to decide on reboot prompt\n# Reboot fallback when needrestart isn't installed:\n# dpkg-query -W 'proxmox-kernel-*-pve-signed' 'pve-kernel-*-pve' vs. uname -r"
+  },
+  "related": {
+    "heading": "Súvisiace",
+    "items": [
+      {
+        "href": "/docs/utils/upgrade-pve8-pve9",
+        "label": "Prechod z PVE 8 na PVE 9",
+        "tail": " — pre prechod na novú hlavnú verziu s iným nástrojom a bezpečnostným postupom."
+      },
+      {
+        "href": "/docs/utils/system-utils",
+        "label": "Inštalátor systémových nástrojov",
+        "tail": " — na inštaláciu užitočných nástrojov CLI pre aktualizácie (htop / btop / ncdu)."
+      },
+      {
+        "href": "/docs/utils",
+        "label": "Prehľad pomocných nástrojov",
+        "tail": " — Späť na prehľad sekcie."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sk/docs/utils/system-utils.json b/web/messages/sk/docs/utils/system-utils.json
new file mode 100644
index 00000000..6a683e47
--- /dev/null
+++ b/web/messages/sk/docs/utils/system-utils.json
@@ -0,0 +1,252 @@
+{
+  "meta": {
+    "title": "Inštalátor systémových nástrojov | Dokumentácia ProxMenux",
+    "description": "Inštalátor nástrojov CLI pre Proxmox VE s 25 balíkmi v hlavnom zozname (htop, btop, iperf3, tmux, ...). Vlastný výber, inštalácia všetkého a preddefinované skupiny (základné, vývoj, kompresia, multiplexery, analýza, sieť). Skupiny môžu obsahovať ďalšie balíky. Používa ensure_repositories + install_single_package.",
+    "ogTitle": "Inštalátor systémových nástrojov | Dokumentácia ProxMenux",
+    "ogDescription": "Nainštalujte vybrané nástroje CLI v Proxmox VE jedným kliknutím alebo vlastným výberom."
+  },
+  "header": {
+    "title": "Inštalátor systémových nástrojov",
+    "description": "Výber 25 nástrojov CLI z hlavného zoznamu PROXMENUX_UTILS. Ponúka vlastný výber, inštaláciu všetkého, šesť preddefinovaných skupín a overenie inštalácií. Skupiny môžu obsahovať nástroje mimo hlavného zoznamu. Používa spoločné funkcie ensure_repositories() + install_single_package() na jednotnú správu repozitárov a správy o jednotlivých balíkoch.",
+    "section": "Nástroje"
+  },
+  "info": {
+    "title": "Čo to robí?",
+    "body": "Inštaluje nástroje CLI zo zoznamu 25 balíkov. Každá inštalácia používa rovnaký postup: <code>ensure_repositories</code> overí použiteľný repozitár Proxmox pre spustenú hlavnú verziu PVE; potom <code>install_single_package</code> nainštaluje balík a overí dostupnosť príkazu v PATH."
+  },
+  "opening": {
+    "heading": "Otvorenie inštalátora",
+    "intro": "Z menu Utilities vyberte <strong>System Utilities Installer</strong>. Hlavné menu ponúka deväť možností:",
+    "imageAlt": "Menu inštalátora systémových nástrojov s vlastným výberom, ALL, preddefinovanými skupinami a overením"
+  },
+  "actions": {
+    "heading": "9 akcií menu",
+    "headerOption": "Možnosť",
+    "headerBehaviour": "Správanie",
+    "rows": [
+      {
+        "option": "1. Vlastný výber",
+        "behaviourRich": "Výberový zoznam všetkých 25 balíkov. SPACE prepína označenie a ENTER potvrdzuje; nainštalujú sa iba vybrané balíky."
+      },
+      {
+        "option": "2. Nainštalovať všetky nástroje",
+        "behaviourRich": "Nainštaluje všetky balíky z <code>PROXMENUX_UTILS</code> naraz. Použite po novej inštalácii Proxmox."
+      },
+      {
+        "option": "3. Základné",
+        "behaviourRich": "<code>grc</code>, <code>htop</code>, <code>tree</code>, <code>curl</code>, <code>wget</code>"
+      },
+      {
+        "option": "4. Vývoj",
+        "behaviourRich": "<code>git</code>, <code>vim</code>, <code>nano</code>"
+      },
+      {
+        "option": "5. Kompresia",
+        "behaviourRich": "<code>zip</code>, <code>unzip</code>, <code>rsync</code>"
+      },
+      {
+        "option": "6. Terminálne multiplexéry",
+        "behaviourRich": "<code>screen</code>, <code>tmux</code>"
+      },
+      {
+        "option": "7. Analýza",
+        "behaviourRich": "<code>jq</code>, <code>ncdu</code>, <code>iotop</code>"
+      },
+      {
+        "option": "8. Sieť",
+        "behaviourRich": "<code>iperf3</code>, <code>nethogs</code>, <code>nmap</code>, <code>tcpdump</code>, <code>lsof</code>"
+      },
+      {
+        "option": "9. Overiť inštalácie",
+        "behaviourRich": "Prejde každú položku v <code>PROXMENUX_UTILS</code>, overí dostupnosť príkazu v PATH a vypíše súhrn Dostupné / Chýbajúce."
+      }
+    ]
+  },
+  "packages": {
+    "heading": "25 balíkov",
+    "intro": "Definované v spoločnom súbore <code>scripts/global/utils-install-functions.sh</code> ako <code>PROXMENUX_UTILS</code> (formát: <code>package:verify_command:description</code>). Ďalšie skripty ProxMenux, napríklad spúšťanie sieťových nástrojov iftop / iptraf-ng / iperf3, tieto položky používajú tiež, aby balík a overovací príkaz zostali zosúladené.",
+    "headerPackage": "Balík",
+    "headerVerify": "Overovací príkaz",
+    "headerDescription": "Popis",
+    "rows": [
+      {
+        "package": "axel",
+        "verify": "axel",
+        "description": "Urýchľovač sťahovania"
+      },
+      {
+        "package": "aria2",
+        "verify": "aria2c",
+        "description": "Sťahovanie z viacerých zdrojov"
+      },
+      {
+        "package": "btop",
+        "verify": "btop",
+        "description": "Moderný monitor zdrojov"
+      },
+      {
+        "package": "cabextract",
+        "verify": "cabextract",
+        "description": "Extrahovať CAB súbory"
+      },
+      {
+        "package": "chntpw",
+        "verify": "chntpw",
+        "description": "Upraviť register Windows / heslá"
+      },
+      {
+        "package": "dos2unix",
+        "verify": "dos2unix",
+        "description": "Previesť DOS / Unix textové súbory"
+      },
+      {
+        "package": "genisoimage",
+        "verify": "genisoimage",
+        "description": "Vytváranie obrazov ISO"
+      },
+      {
+        "package": "grc",
+        "verify": "grc",
+        "description": "Všeobecné farebné zvýrazňovanie záznamov"
+      },
+      {
+        "package": "htop",
+        "verify": "htop",
+        "description": "Interaktívny prehliadač procesov"
+      },
+      {
+        "package": "iftop",
+        "verify": "iftop",
+        "description": "Používanie siete v reálnom čase"
+      },
+      {
+        "package": "intel-gpu-tools",
+        "verify": "intel_gpu_top",
+        "description": "Nástroje Intel GPU"
+      },
+      {
+        "package": "iotop",
+        "verify": "iotop",
+        "description": "Monitorovanie diskových vstupov a výstupov"
+      },
+      {
+        "package": "iperf3",
+        "verify": "iperf3",
+        "description": "Testovanie šírky pásma siete"
+      },
+      {
+        "package": "ipset",
+        "verify": "ipset",
+        "description": "Správa množín IP adries"
+      },
+      {
+        "package": "iptraf-ng",
+        "verify": "iptraf-ng",
+        "description": "Nástroj monitorovania siete"
+      },
+      {
+        "package": "libguestfs-tools",
+        "verify": "virt-filesystems",
+        "description": "Nástroje pre disky VM"
+      },
+      {
+        "package": "msr-tools",
+        "verify": "rdmsr",
+        "description": "Prístup k registrom MSR procesora"
+      },
+      {
+        "package": "net-tools",
+        "verify": "netstat",
+        "description": "Staršie sieťové nástroje"
+      },
+      {
+        "package": "plocate",
+        "verify": "locate",
+        "description": "Rýchlo nájsť súbory"
+      },
+      {
+        "package": "s-tui",
+        "verify": "s-tui",
+        "description": "Stress-Terminal UI"
+      },
+      {
+        "package": "sshpass",
+        "verify": "sshpass",
+        "description": "Neinteraktívne prihlásenie SSH"
+      },
+      {
+        "package": "tmux",
+        "verify": "tmux",
+        "description": "Terminálny multiplexer"
+      },
+      {
+        "package": "unzip",
+        "verify": "unzip",
+        "description": "Extrakcia ZIP súborov"
+      },
+      {
+        "package": "wimtools",
+        "verify": "wimlib-imagex",
+        "description": "Správa obrazov WIM"
+      },
+      {
+        "package": "zip",
+        "verify": "zip",
+        "description": "Vytvoriť ZIP súbory"
+      }
+    ]
+  },
+  "howItWorks": {
+    "heading": "Ako funguje inštalácia jedného balíka",
+    "items": [
+      "<code>ensure_repositories</code> rozpozná PVE 8 alebo 9 a načíta repozitáre cez API Proxmox. Pri použiteľnom repozitári Proxmox nič nemení. Hostiteľ bez aktívneho predplatného s jediným repozitárom Enterprise musí potvrdiť prechod na no-subscription. Po potvrdenej zmene sa spustí <code>apt-get update</code>.",
+      "<code>install_single_package \"pkg\" \"verify_cmd\" \"description\"</code> spustí <code>apt-get install -y \"$pkg\"</code> so správami (<code>msg_info</code> / <code>msg_ok</code> / <code>msg_error</code>)."
+    ],
+    "verifyIntro": "Po inštalácii sa overovací príkaz skontroluje pomocou <code>command -v \"$verify_cmd\"</code>. Možné sú tri výsledky:",
+    "verifyOutcomes": [
+      "<strong>0 (úspech):</strong> príkaz je dostupný a balík sa počíta ako <em>Úspešný</em>.",
+      "<strong>1 (zlyhanie):</strong> apt zlyhal a balík sa počíta ako <em>Neúspešný</em>.",
+      "<strong>2 (upozornenie):</strong> apt uspel, ale očakávaný príkaz sa nenašiel v PATH; balík sa počíta ako <em>S upozorneniami</em>."
+    ],
+    "summary": "Na konci skupinovej/vlastnej inštalácie sa v súhrnnom dialógovom okne zobrazí počet <em>Úspešné / S upozorneniami / Neúspešné</em>."
+  },
+  "verify": {
+    "heading": "Overiť inštalácie",
+    "intro": "Možnosť 9 je iba na čítanie: prejde <code>PROXMENUX_UTILS</code> a spustí <code>command -v</code> pre každý príkaz. Výstup vyzerá takto:",
+    "code": "Total: 25\nAvailable: 18\nMissing: 8\n\n✓ axel - Download accelerator\n✓ aria2c - Multi-source downloader\n✓ btop - Modern resource monitor\n✗ cabextract - Extract CAB files\n✓ dos2unix - Convert DOS / Unix text files\n✗ genisoimage - Create ISO images\n✓ grc - Generic log colorizer\n...",
+    "outro": "Užitočné pred spustením skriptov závislých od týchto nástrojov. Napríklad <code>uup_dump_iso_creator.sh</code> potrebuje <code>aria2c</code> + <code>cabextract</code> + <code>wimlib-imagex</code>. Ak niečo chýba, nainštalujte príslušnú skupinu alebo vyberte chýbajúce balíky jednotlivo."
+  },
+  "troubleshoot": {
+    "heading": "Riešenie problémov",
+    "reposTitle": "„Repozitáre sa nepodarilo nastaviť. Inštalácia sa zrušila.“",
+    "reposBody": "Kontrola repozitárov zlyhala: prechod na no-subscription bol odmietnutý, stav predplatného sa nedal načítať alebo položka repozitára potrebuje zásah. Príčinu uvádza predchádzajúca správa. Repozitáre sú v <em>Node → Updates → Repositories</em>; príkaz <code>apt-get update</code> v konzole zobrazí chybu apt.",
+    "warningsTitle": "Balíček je hlásený \"S upozorneniami,\" ale príkaz funguje po zatvorení menu",
+    "warningsBody": "Po <code>apt-get install</code> funkcia spustí <code>hash -r</code>, krátko počká a overí očakávaný príkaz cez <code>command -v</code>. Upozornenie znamená, že kontrola stále zlyhala, ale neurčuje príčinu. Skúste nový shell a ak príkaz stále chýba, overte inštaláciu balíka a PATH.",
+    "hangsTitle": "Apt inštalácia visí",
+    "hangsBody": "Pravdepodobne je otázka debconf skrytá za potlačeným výstupom. Skript pri volaniach apt používa <code>DEBIAN_FRONTEND=noninteractive</code>, čo zvyčajne otázky potlačí, ale niektoré balíky stále potrebujú vstup. Zrušte operáciu pomocou <kbd>Ctrl</kbd>+<kbd>C</kbd> a ručne spustite <code>apt-get install -y &lt;pkg&gt;</code> v shelli, aby ste otázku videli a mohli rozhodnúť."
+  },
+  "files": {
+    "heading": "Príslušné súbory",
+    "code": "scripts/utilities/system_utils.sh                    # this script\nscripts/global/utils-install-functions.sh            # PROXMENUX_UTILS, install_single_package\nscripts/global/repository-functions.sh               # ensure_repositories\nscripts/global/repository_policy.py                  # reads and switches repositories through the Proxmox API\n/etc/apt/sources.list.d/proxmox.sources              # no-subscription source, written by Proxmox when the switch is accepted"
+  },
+  "related": {
+    "heading": "Súvisiace",
+    "items": [
+      {
+        "href": "/docs/utils/system-update",
+        "label": "Aktualizácia systému Proxmox",
+        "tailRich": " — pre samotný <code>apt dist-upgrade</code> na hostiteľovi."
+      },
+      {
+        "href": "/docs/network/monitoring",
+        "label": "Živé monitorovacie nástroje (Sieť)",
+        "tailRich": " — používa iftop / iptraf-ng / iperf3 z rovnakého zoznamu."
+      },
+      {
+        "href": "/docs/utils",
+        "label": "Prehľad pomocných nástrojov",
+        "tailRich": " — Späť na prehľad sekcie."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sk/docs/utils/upgrade-pve8-pve9.json b/web/messages/sk/docs/utils/upgrade-pve8-pve9.json
new file mode 100644
index 00000000..d4aa1c6b
--- /dev/null
+++ b/web/messages/sk/docs/utils/upgrade-pve8-pve9.json
@@ -0,0 +1,335 @@
+{
+  "meta": {
+    "title": "Aktualizácia PVE 8 na PVE 9 | Dokumentácia ProxMenux",
+    "description": "Tri spôsoby prechodu z Proxmox VE 8 na 9 (Debian Bookworm na Trixie a PVE 8 na 9): automaticky, interaktívne alebo ručne podľa oficiálneho postupu. Kontrola pve8to9, migrácia repozitárov, dist-upgrade a záverečné overenie. Spustenie z webového terminálu je zablokované.",
+    "ogTitle": "Aktualizácia PVE 8 na PVE 9 | Dokumentácia ProxMenux",
+    "ogDescription": "Tri postupy (automatický, interaktívny a ručný) na prechod z Proxmox VE 8 na 9."
+  },
+  "header": {
+    "title": "Aktualizácia PVE 8 na PVE 9",
+    "description": "Vykoná prechod z Proxmox VE 8 na 9 podľa oficiálneho postupu: Debian Bookworm na Trixie a PVE 8 na 9. Ponúka automatický, interaktívny a ručný postup aj samostatnú predbežnú kontrolu. Webový terminál blokuje, pretože prerušenie spojenia počas aktualizácie môže poškodiť systém hostiteľa.",
+    "section": "Nástroje"
+  },
+  "dangerCallout": {
+    "title": "Prechod na novú hlavnú verziu je nevratný",
+    "intro": "Táto operácia nahradí základ Debianu (Bookworm → Trixie) a súčasti Proxmoxu priamo v systéme. <strong>Návrat na pôvodnú verziu nie je možný</strong>. Pred začiatkom:",
+    "items": [
+      "<strong>Overené zálohy</strong> všetkých VM a CT (PBS, vzdump, snímky ZFS — overte aj obnovu).",
+      "<strong>Prístup cez konzolu / IPMI / iKVM</strong> k hostiteľovi pre prípad výpadku SSH.",
+      "Hostiteľ už používa aktuálnu PVE 8.4.x (skript to vynucuje).",
+      "Ceph (ak je k dispozícii) vo verzii 19.x Squid.",
+      "Aspoň <strong>5 GB voľného miesta</strong> v koreňovom súborovom systéme."
+    ]
+  },
+  "modeMenu": {
+    "heading": "Menu režimu",
+    "intro": "Voľba otvorí štyri položky: Automaticky, Interaktívne, Predbežná kontrola a Ručný návod. Tri možnosti aktualizáciu <em>vykonajú</em> alebo vysvetlia jej postup; samostatná kontrola <em>overí</em> pripravenosť a môže ponúknuť opravy.",
+    "imageAlt": "Ponuka aktualizácie PVE 8 na 9: automaticky, interaktívne, predbežná kontrola a ručný návod"
+  },
+  "threeWays": {
+    "heading": "Tri spôsoby aktualizácie",
+    "intro": "Automatický a interaktívny režim používajú rovnaký postup s predbežnými aj záverečnými kontrolami. Líšia sa odpoveďami na otázky dpkg počas <code>dist-upgrade</code>. Ručný návod zobrazí príkazy vrátane kontrol; každý krok musíte vykonať sami.",
+    "auto": {
+      "title": "Automatické / bez dozoru",
+      "summary": "Nastaví <code>ASSUME_YES=1</code> + <code>DEBIAN_FRONTEND=noninteractive</code>. Pri upravených konfiguračných súboroch použije dpkg predvolenú akciu, ak existuje; inak <strong>ponechá aktuálny súbor</strong> (<code>--force-confold</code>).",
+      "items": [
+        "Najrýchlejšie — počas aktualizácie žiadne otázky dpkg",
+        "Vhodné pre štandardné inštalácie bez vlastných úprav konfigurácie",
+        "Riziko: upravený súbor sa ponechá bez otázky a môže prekryť nové predvolené nastavenia"
+      ]
+    },
+    "interactive": {
+      "title": "Interaktívny",
+      "summary": "Rovnaký postup, ale na každú otázku dpkg o konflikte konfigurácie odpovedáte sami. Pomalšie, no s úplným prehľadom.",
+      "items": [
+        "Vidíte každý konflikt a rozhodnite sa.",
+        "Najlepšie keď máte prispôsobené <code>/etc/lvm</code>, <code>/etc/ssh</code>, atď.",
+        "Pozrite si tabuľku odporúčaných odpovedí v ručnom postupe nižšie"
+      ]
+    },
+    "manual": {
+      "title": "Príručka manuálnej aktualizácie",
+      "summary": "Zobrazí oficiálny postup Proxmoxu v 17 krokoch bez jeho vykonania. Príkazy spúšťajte ručne v samostatnom shelli.",
+      "items": [
+        "Úplná kontrola — každý príkaz zadávate sami",
+        "Najlepšie, keď sa chcete naučiť postup alebo neveríte ničomu",
+        "Skript zobrazuje kroky; nič nie je spustené automaticky"
+      ]
+    }
+  },
+  "precheckCallout": {
+    "title": "Plus samostatná predbežná kontrola",
+    "body": "Možnosť 3 — <strong>Spustiť kontrolu PVE 8 na 9</strong> — spustí oficiálny nástroj <code>pve8to9 --full</code>, ponúkne opravy bežných problémov a potom <strong>skončí</strong>. Použite ju pred aktualizáciou alebo po ručných opravách. Automatický a interaktívny režim kontrolu tiež spúšťajú; v ručnom návode ju spúšťate sami."
+  },
+  "webTerminal": {
+    "heading": "Prečo je webový terminál zablokovaný?",
+    "body": "Všetky tri režimy zistia <code>termproxy</code> / <code>vncshell</code> v reťazci rodičovských procesov a odmietnu spustenie. Webový terminál závisí od služby <code>pveproxy</code>, ktorá sa počas aktualizácie mení. Po reštarte <code>pveproxy</code> sa ukončí terminál aj skript v ňom. Hostiteľ môže zostať aktualizovaný iba čiastočne.",
+    "warningTitle": "Použite SSH alebo fyzickú konzolu / IPMI / iKVM",
+    "warningBody": "Najčastejšou voľbou je SSH. Spustite ho v <code>tmux</code> alebo <code>screen</code>, aby krátky výpadok siete neprerušil aktualizáciu. Pri bežnom SSH shelli skript najprv zobrazí pripomienku tmux/screen."
+  },
+  "auto": {
+    "heading": "Automatický režim / Bezobslužne",
+    "intro": "Otázky k balíkom a konfiguračným súborom používajú predvolené hodnoty z nasledujúcej tabuľky a odpoveď 401 z repozitára Enterprise prepne na no-subscription bez opýtania. Potvrdenie aktualizácie, súhrn aktualizácie PVE 8, opravy z predbežnej kontroly a otázka na reštart sa naďalej zobrazujú.",
+    "behaviourHeading": "Správanie automatického režimu",
+    "behaviourTable": {
+      "settingHeader": "Nastavenie",
+      "effectHeader": "Účinok",
+      "rows": [
+        {
+          "settingRich": "<code>ASSUME_YES=1</code>",
+          "effectRich": "Interná voľba — skript sám odpovie áno na svoje otázky, napríklad na prechod na no-subscription po chybe 401"
+        },
+        {
+          "settingRich": "<code>DEBIAN_FRONTEND=noninteractive</code>",
+          "effectRich": "apt / dpkg sa spúšťajú bez otázok debconf"
+        },
+        {
+          "settingRich": "<code>--force-confdef</code>",
+          "effectRich": "Pre nedotknuté konfiguračné súbory: nainštalujte novú verziu správcu"
+        },
+        {
+          "settingRich": "<code>--force-confold</code>",
+          "effectRich": "Pri upravených súboroch: predvolená akcia dpkg, ak existuje; inak <strong>ponechať vašu verziu</strong>."
+        }
+      ]
+    },
+    "flowHeading": "Postup automatického režimu",
+    "flowIntro": "Šesť po sebe idúcich fáz. Fáza 2 aktualizuje balíky PVE 8 a fáza 3 zapíše konfiguráciu repozitárov PVE 9. Chyba postup zastaví, tieto zmeny však nevráti; ak aktualizácia PVE 8 zlyhá alebo sa zruší, repozitáre zostanú nezmenené. Fáza 5 vykoná <code>dist-upgrade</code> na PVE 9.",
+    "flowDiagram": "1. KONTROLY\nBlokuje termproxy / vncshell; potvrdí aktualizáciu; odmietne PVE 9.\n\n2. PRÍPRAVA PVE 8\nscripts/global/update-pve8.sh\nAktualizuje balíky PVE 8; zastaví sa, ak aktualizácia zlyhá alebo sa zruší.\npve8to9 --full (môže ponúknuť opravy).\nOverí miesto a pripojenie; Ceph 19.x Squid na hyperkonvergovaných uzloch.\n\n3. MIGRÁCIA REPOZITÁROV\nBookworm → Trixie; zapíše súbory deb822 .sources.\nZakomentuje staré súbory .list; apt-get update.\n\n4. OVERENIE KANDIDÁTA PVE 9\napt-cache policy proxmox-ve\napt-get -s dist-upgrade\nZastaví sa, ak kandidát nie je 9.x alebo by sa odstránil proxmox-ve.\n\n5. AKTUALIZÁCIA\napt-get -y -o Dpkg::Options::='--force-confdef' -o Dpkg::Options::='--force-confold' dist-upgrade\nBez predplatného: vypne pve-enterprise.sources.\nProtokol: /var/log/pve8-a-pve9-'<'timestamp'>'.log\n\n6. OVERENIE A REŠTART\nEFI: apt install grub-efi-amd64\npve8to9 --full; skontrolujte výsledok a otázku na reštart.",
+    "preflightHeading": "Kontroly pred aktualizáciou",
+    "preflightTable": {
+      "checkHeader": "Kontrola",
+      "whyHeader": "Prečo na tom záleží",
+      "rows": [
+        {
+          "checkRich": "<strong>Blok webového terminálu</strong>",
+          "whyRich": "Zabráni tomu, aby aktualizácia ukončila shell, v ktorom beží"
+        },
+        {
+          "checkRich": "<strong>Už na 9.x</strong>",
+          "whyRich": "Skončí, ak hostiteľ už používa PVE 9 — nie je čo aktualizovať"
+        },
+        {
+          "checkRich": "<strong>Najnovšia verzia PVE 8.4.x</strong>",
+          "whyRich": "Najprv aktualizuje PVE 8 na najnovšiu revíziu pomocou príslušného skriptu; staré verzie 8.x majú odlišné požiadavky"
+        },
+        {
+          "checkRich": "<strong>pve8to9 --full</strong>",
+          "whyRich": "Kontrola pripravenosti od Proxmoxu; chyby FAIL blokujú aktualizáciu, kým ich neopravíte"
+        },
+        {
+          "checkRich": "<strong>Miesto na disku</strong>",
+          "whyRich": "≥ 1024 MB voľného miesta v <code>/var/cache/apt/archives</code> pre stiahnuté súbory .deb"
+        },
+        {
+          "checkRich": "<strong>Pripojenie</strong>",
+          "whyRich": "Ping na <code>download.proxmox.com</code> — pri zlyhaní sa aktualizácia nezačne"
+        },
+        {
+          "checkRich": "<strong>Ceph 19.x Squid</strong>",
+          "whyRich": "Ak je Ceph nainštalovaný, musí už používať 19.x. PVE 9 nefunguje s Ceph 17/18. Voľby <code>--ignore-ceph-check</code> a <code>--warn-ceph-check</code> obchádzajú kontrolu; používajte ich len so znalosťou dôsledkov."
+        }
+      ]
+    },
+    "distUpgradeHeading": "Príkaz dist-upgrade (automatický režim)",
+    "distUpgradeCode": "apt-get -y \\\n    -o Dpkg::Options::='--force-confdef' \\\n    -o Dpkg::Options::='--force-confold' \\\n    dist-upgrade",
+    "distUpgradeOutro": "Výstup sa zobrazuje v reálnom čase na stdout a ukladá sa aj do <code>/var/log/pve8-a-pve9-&lt;timestamp&gt;.log</code>. Vidíte všetko; vynechané sú len otázky.",
+    "postHeading": "Úlohy po aktualizácii (automatický režim)",
+    "postItems": [
+      "<strong>Hostitelia EFI:</strong> nainštaluje <code>grub-efi-amd64</code> podľa známeho problému v dokumentácii Proxmoxu. Aktualizácia ho nepridá automaticky a pri ďalšom štarte môže byť potrebný.",
+      "<strong>Repozitár Enterprise bez predplatného.</strong> pve-manager 9 počas aktualizácie pridá <code>pve-enterprise.sources</code>; v režime no-subscription ho skript nastaví na <code>Enabled: false</code>.",
+      "<strong>Znova spustí <code>pve8to9 --full</code>.</strong> Zobrazí zostávajúce problémy. Pri chybách FAIL sa otvorí rovnaká ponuka opráv ako pri predbežnej kontrole.",
+      "<strong>Otázka na reštart.</strong> Reštart sa odporúča na načítanie nového jadra a služieb. Odmietnite ho iba z konkrétneho dôvodu: ponechanie starého jadra po prechode na novú hlavnú verziu prináša riziko."
+    ]
+  },
+  "interactive": {
+    "heading": "Interaktívny režim",
+    "intro": "Rovnaký postup ako <autolink>automatický režim</autolink>: rovnaké kontroly, migrácia repozitárov aj záverečné overenie. Rozdiel je pri <code>dist-upgrade</code>: <strong>na každú otázku dpkg o konflikte konfigurácie odpovedáte sami</strong>. ProxMenux spustí <code>apt-get dist-upgrade</code> bez volieb <code>--force-conf*</code>.",
+    "distUpgradeHeading": "Dist-upgrade príkaz (interaktívny režim)",
+    "distUpgradeCode": "apt-get dist-upgrade\n# (user answers each dpkg config-file conflict prompt as it appears)",
+    "whenHeading": "Keď interaktívne je správna voľba",
+    "whenItems": [
+      "Prispôsobili ste <code>/etc/lvm/lvm.conf</code>, <code>/etc/ssh/sshd_config</code>, <code>/etc/default/grub</code> alebo akýkoľvek iný konfiguračný súbor, ktorý sa dotkne aktualizácie.",
+      "Chcete vidieť, ktoré balíky spôsobujú konflikty, a rozhodnúť o každom súbore.",
+      "Vylepšujete producenta, kde je akákoľvek skrytá zmena neprijateľná."
+    ],
+    "promptCalloutTitle": "Čo odpovedať na každú výzvu",
+    "promptCalloutBody": "Platia rovnaké odporúčania ako pri ručnom postupe: pozrite <dpkglink>Odporúčané odpovede na otázky dpkg</dpkglink> nižšie. Pomocou <strong>D</strong> zobrazíte rozdiely, pomocou <strong>Z</strong> otvoríte shell."
+  },
+  "manual": {
+    "heading": "Postup manuálnej aktualizácie",
+    "intro": "Toto zobrazí možnosť <strong>Ručný návod na aktualizáciu</strong>: <wikilink>oficiálny wiki návod Proxmoxu z 8 na 9</wikilink>, rozdelený do štyroch fáz. Skript príkazy <em>zobrazí</em>; vykonáte ich sami v samostatnom shelli používateľa root. Každý krok máte pod kontrolou.",
+    "rootCalloutTitle": "Všetky príkazy vyžadujú root",
+    "rootCalloutBody": "Použite shell používateľa root aj pre presmerovania a dokumenty here-document. Pri <code>sudo</code> zabezpečte, aby sa s oprávneniami root vykonal celý príkaz.",
+    "phase1Heading": "Fáza 1 — Príprava",
+    "phase1Intro": "Aktualizujte hostiteľa na najnovšiu PVE 8.4.x, overte verziu a používaný Ceph, spustite kontrolu Proxmoxu a terminálový multiplexor na prežitie výpadkov spojenia.",
+    "phase1Code": "# Step 1 — Update PVE 8 to the latest 8.4+\napt update && apt dist-upgrade -y\n\n# Step 2 — Verify version (must be 8.4.1 or newer)\npveversion\n\n# Step 2.1 — Hyper-converged Ceph: must already be on 19.x Squid\nceph --version\n# If older, follow https://pve.proxmox.com/wiki/Ceph_Reef_to_Squid\n\n# Step 3 — Run the official upgrade-readiness check\npve8to9 --full\n# If it warns about systemd-boot meta-package, remove it:\n#   apt remove systemd-boot\n\n# Step 4 — Start tmux or screen (so SSH disconnect doesn't kill the upgrade)\ntmux new-session -s upgrade\n# or\nscreen -S upgrade",
+    "phase2Heading": "Fáza 2 — Migrácia repozitárov",
+    "phase2Intro": "Zmeňte všetky repozitáre Debianu a Proxmoxu z Bookworm na Trixie a zdroje Proxmoxu preveďte na deb822. <strong>Vyberte krok 7 ALEBO 8</strong> podľa predplatného Enterprise. Bez Ceph vynechajte krok 9.",
+    "phase2Code": "# Step 5 — Debian: bookworm → trixie\nsed -i 's/bookworm/trixie/g' /etc/apt/sources.list\n\n# Step 6 — Same for the legacy enterprise list (only if you use enterprise)\nsed -i 's/bookworm/trixie/g' /etc/apt/sources.list.d/pve-enterprise.list\n\n# Step 7 — Add the new PVE 9 enterprise repo (deb822) — Enterprise users only\ncat > /etc/apt/sources.list.d/pve-enterprise.sources << EOF\nTypes: deb\nURIs: https://enterprise.proxmox.com/debian/pve\nSuites: trixie\nComponents: pve-enterprise\nSigned-By: /usr/share/keyrings/proxmox-archive-keyring.gpg\nEOF\n\n# Step 8 — OR add the no-subscription repo (most home / lab users)\ncat > /etc/apt/sources.list.d/proxmox.sources << EOF\nTypes: deb\nURIs: http://download.proxmox.com/debian/pve\nSuites: trixie\nComponents: pve-no-subscription\nSigned-By: /usr/share/keyrings/proxmox-archive-keyring.gpg\nEOF\n\n# Step 8.1 — Refresh and verify proxmox-ve candidate is 9.x\napt update && apt policy | sed -n '1,120p'\n\n# Step 9 — Update Ceph repo (only if you run Ceph)\ncat > /etc/apt/sources.list.d/ceph.sources << EOF\nTypes: deb\nURIs: http://download.proxmox.com/debian/ceph-squid\nSuites: trixie\nComponents: no-subscription\nSigned-By: /usr/share/keyrings/proxmox-archive-keyring.gpg\nEOF\n\n# Step 10 — Remove old .list files now superseded by deb822 .sources\nrm -f /etc/apt/sources.list.d/pve-enterprise.list /etc/apt/sources.list.d/ceph.list\n\n# Step 11 — Final apt update\napt update",
+    "phase3Heading": "Fáza 3 — dist-upgrade",
+    "phase3Intro": "Samotná aktualizácia. Krok 12 je voliteľný, ale odporúčaný na obmedzenie správ auditu. Krok 13 trvá dlhšie: odpovedajte podľa tabuľky. Krok 13.1 je iba pre EFI a vychádza zo známych problémov v oficiálnom návode.",
+    "phase3Code": "# Step 12 — Disable kernel audit messages (optional)\nsystemctl disable --now systemd-journald-audit.socket\n\n# Step 13 — The main upgrade (this takes a while)\napt dist-upgrade\n# (answer prompts using the table below)\n\n# Step 13.1 — EFI hosts: install grub for EFI (per known issues)\n[ -d /sys/firmware/efi ] && apt install grub-efi-amd64",
+    "dpkgHeading": "Odporúčané odpovede na otázky dpkg",
+    "dpkgIntro": "Odporúčania Proxmoxu: <strong>Y</strong> nainštaluje nový súbor správcu balíka a prepíše váš; <strong>N</strong> ponechá aktuálny súbor. Pri pochybnostiach najprv skontrolujte rozdiely:",
+    "dpkgTable": {
+      "fileHeader": "Súbor / otázka",
+      "answerHeader": "Odporúčaná odpoveď",
+      "whyHeader": "Prečo?",
+      "rows": [
+        {
+          "fileRich": "/etc/issue",
+          "answerRich": "<strong>N</strong> (ponechať aktuálny súbor)",
+          "whyRich": "Ponechá prihlasovací oznam, na ktorý ste zvyknutí",
+          "fileFont": true
+        },
+        {
+          "fileRich": "/etc/lvm/lvm.conf",
+          "answerRich": "<strong>Y</strong> (verzia správcu balíka)",
+          "whyRich": "PVE 9 potrebuje nové predvolené nastavenia LVM",
+          "fileFont": true
+        },
+        {
+          "fileRich": "/etc/ssh/sshd_config",
+          "answerRich": "<strong>Y</strong> pri iba predvolených zmenách; vlastné úpravy najprv skontrolujte",
+          "whyRich": "Pred nahradením súboru overte miestne nastavenia SSH a zachovajte prístup. Predvolené zmeny zahŕňajú premenované voľby a komentáre.",
+          "fileFont": true
+        },
+        {
+          "fileRich": "/etc/default/grub",
+          "answerRich": "<strong>N</strong> v prípade prispôsobenia",
+          "whyRich": "Sú tu parametre zavádzania, napríklad IOMMU a PCI passthrough",
+          "fileFont": true
+        },
+        {
+          "fileRich": "/etc/chrony/chrony.conf",
+          "answerRich": "<strong>Y</strong>, ak nebol upravený; miestne nastavenia najprv zachovajte",
+          "whyRich": "Trixie mení predvolené nastavenia synchronizácie času. Pred prijatím nového súboru presuňte miestne nastavenia do adresárov conf.d / sources.d programu chrony.",
+          "fileFont": true
+        },
+        {
+          "fileRich": "Reštarty služieb počas aktualizácie",
+          "answerRich": "<strong>Áno</strong> (predvolené)",
+          "whyRich": "Reštartuje väčšinu služieb bez reštartu hostiteľa",
+          "fileFont": false
+        },
+        {
+          "fileRich": "<code>apt-listchanges</code>",
+          "answerRich": "Stlačte <kbd>q</kbd>",
+          "whyRich": "Ukončí iba prehliadač textu; zobrazené informácie sú súhrnom zmien",
+          "fileFont": false
+        }
+      ]
+    },
+    "inspectCalloutTitle": "Kontrola špecifického dpkg konfliktu",
+    "inspectCalloutBody": "Pri otázke dpkg o konfiguračnom súbore zobrazí <strong>D</strong> rozdiely medzi vaším súborom a novou verziou; <strong>Z</strong> otvorí shell na ďalšie overenie. Rozhodnutie tak nemusíte odhadovať.",
+    "phase4Heading": "Fáza 4 — Po aktualizácii",
+    "phase4Intro": "Overte úspešné dokončenie, reštartujte na jadro PVE 9 a potvrďte verziu. Potom môžete zostávajúce staré súbory <code>.list</code> previesť na deb822.",
+    "phase4Code": "# Step 14 — Re-run the readiness check (should be much cleaner now)\npve8to9 --full\n\n# Step 15 — Reboot to load the new kernel and PVE 9 daemons\nreboot\n\n# Step 16 — After reboot, confirm PVE 9.x\npveversion\n# Should show pve-manager/9.x.x\n\n# Step 17 — Optional: modernise the remaining legacy .list files to deb822\napt modernize-sources\n# (keeps .list backups as .bak)"
+  },
+  "clusterCeph": {
+    "heading": "Klaster a Ceph",
+    "clusterCalloutTitle": "Klaster: aktualizujte uzly po jednom",
+    "clusterCalloutBody": "Zistené cez <code>pvecm status</code>. <strong>Neaktualizujte</strong> viac uzlov naraz. Presuňte hostí, aktualizujte uzol, reštartujte a overte členstvo v klastri. Až potom pokračujte. Počas aktualizácie funguje živá migrácia zo staršej verzie PVE na novšiu; opačný smer spravidla nie je podporovaný. Skupiny HA sa automaticky prevedú na pravidlá HA, keď všetky uzly používajú PVE 9.",
+    "cephCalloutTitle": "Ceph: NAJPRV inovujte Ceph, potom Proxmox",
+    "cephCalloutBody": "Ceph musí pred aktualizáciou Proxmoxu už používať 19.x Squid. Postupujte v oficiálnom poradí Quincy 17 → Reef 18 → Squid 19: aktualizujte balíky a postupne reštartujte démony Ceph podľa návodu. Pred každým uzlom Proxmoxu overte <code>ceph --version</code>. Celý postup: <cephlink>wiki aktualizácie Ceph Reef na Squid</cephlink>."
+  },
+  "troubleshooting": {
+    "heading": "Riešenie problémov",
+    "items": [
+      {
+        "title": "Skript skončí: \"This script cannot be executed from the Proxmox web terminal\"",
+        "bodyRich": "Otvorte SSH alebo konzolu / IPMI / iKVM a spustite ho odtiaľ. Najprv použite <code>tmux new -s pveupgrade</code>, aby krátky výpadok siete neprerušil beh."
+      },
+      {
+        "title": "pve8to9 hlási FAIL a oprava cez možnosť 1 hlási \"command not found\"",
+        "bodyRich": "Ak chyba spomína <code>configure_repositories</code>, kópia skriptu je zastaraná. Aktuálna oprava používa cleanup_duplicate_repos a ensure_repositories. Aktualizujte ju alebo cez možnosť 2 skontrolujte ručné príkazy. <code>apt-get update</code> obnoví zoznamy balíkov, ale nevyrieši všetky blokujúce kontroly."
+      },
+      {
+        "title": "Simulácia apt hlási \"proxmox-ve will be REMOVED\"",
+        "bodyRich": "Nové repozitáre sú nedostupné alebo sa nezmenil názov vydania. Skontrolujte <code>cat /etc/apt/sources.list.d/proxmox.sources</code>: riadok <code>Suites:</code> musí obsahovať <code>trixie</code>, nie <code>bookworm</code>. <code>apt-cache policy proxmox-ve</code> musí zobrazovať kandidáta 9.x z nového repozitára."
+      },
+      {
+        "title": "dist-upgrade zlyhá čiastočne cez",
+        "bodyRich": "Opravte závislosti pomocou <code>apt-get -f install</code> a zopakujte aktualizáciu. Ak zlyhá, pozrite koniec protokolu <code>/var/log/pve8-a-pve9-&lt;timestamp&gt;.log</code>. Nereštartujte, kým <code>dpkg -l | grep ^iU</code> nevráti prázdny výstup."
+      },
+      {
+        "title": "EFI host nebude štartovať po reštarte",
+        "bodyRich": "Po aktualizácii sa inštaluje <code>grub-efi-amd64</code>. Ak ste krok vynechali alebo zlyhal, spustite ISO Proxmoxu v záchrannom režime, pripojte koreňový súborový systém, použite chroot a <code>apt-get install grub-efi-amd64 &amp;&amp; update-grub</code>."
+      },
+      {
+        "title": "GUI sa po aktualizácii nenačíta",
+        "bodyRich": "Spustite <code>systemctl status pveproxy</code> a <code>systemctl restart pveproxy</code>. Ak problém pretrváva, pozrite chybu cez <code>journalctl -u pveproxy -b</code>."
+      },
+      {
+        "title": "Sieť nefunguje po reštarte",
+        "bodyRich": "Overte, že <code>/etc/network/interfaces</code> odkazuje na existujúce zariadenia a je nainštalovaný <code>ifupdown2</code>: <code>apt install ifupdown2</code>. Pri zmene názvov pozrite <netlink>Trvalé názvy sieťových rozhraní</netlink>."
+      },
+      {
+        "title": "Split-brain klastra po aktualizácii jedného uzla",
+        "bodyRich": "Zmiešané klastre PVE 8 / PVE 9 sú počas aktualizácie podporované. Živá migrácia zo starších na novšie verzie funguje; opačný smer spravidla nie je podporovaný. Ak sa uzol javí odpojený, skontrolujte <code>corosync</code> a konfiguráciu QDevice / siete. Na každom uzle spustite <code>pvecm status</code> na overenie kvóra."
+      }
+    ]
+  },
+  "files": {
+    "heading": "Príslušné súbory",
+    "code": "scripts/utilities/upgrade_pve8_to_pve9.sh                         # main upgrade orchestrator\nscripts/utilities/pve8to9_check.sh                                # pre-check (separate menu option)\nscripts/utilities/proxmox-upgrade-pve8-to-pve9-manual-guide.sh    # 17-step runbook\nscripts/global/update-pve8.sh                                     # PVE 8 worker (final patches)\n/etc/apt/sources.list                                             # bookworm → trixie sed\n/etc/apt/sources.list.d/proxmox.sources                           # created (deb822 PVE 9)\n/etc/apt/sources.list.d/debian.sources                            # created (deb822 trixie)\n/etc/apt/sources.list.d/ceph.sources                              # created if Ceph\n/etc/apt/sources.list.d/*.list                                    # legacy files commented out / removed\n/var/log/pve8-a-pve9-'<'timestamp'>'.log                              # full upgrade log"
+  },
+  "references": {
+    "heading": "Oficiálne zdroje",
+    "intro": "Ručný postup skriptu vychádza z týchto oficiálnych zdrojov. Pri pochybnostiach počas aktualizácie postupujte podľa oficiálneho wiki: ProxMenux pomáha s vykonaním, rozhodujúci je návod Proxmoxu.",
+    "items": [
+      {
+        "href": "https://pve.proxmox.com/wiki/Upgrade_from_8_to_9",
+        "title": "Aktualizácia z 8 na 9",
+        "desc": "Hlavná stránka Proxmox wiki pre aktualizáciu 8 → 9. Zdroj pravdy pre každý príkaz v manuálnom postupe vyššie."
+      },
+      {
+        "href": "https://pve.proxmox.com/wiki/Ceph_Reef_to_Squid",
+        "title": "Aktualizácia na Ceph Squid (19.x)",
+        "desc": "Povinný predbežný krok pre hyperkonvergované uzly Ceph. Pred PVE 9 musí Ceph používať 19.x Squid."
+      },
+      {
+        "href": "https://pve.proxmox.com/wiki/Roadmap",
+        "title": "Plán Proxmox VE",
+        "desc": "Poznámky k vydaniu PVE 9 a zmeny oproti 8.x — prečítajte si ich pred aktualizáciou."
+      },
+      {
+        "href": "https://www.debian.org/releases/trixie/releasenotes",
+        "title": "Poznámky k vydaniu Debianu Trixie",
+        "desc": "PVE 9 vychádza z Debianu Trixie. Poznámky Debianu vysvetľujú zmeny operačného systému, ktoré ovplyvnia aj hostiteľa."
+      },
+      {
+        "href": "https://forum.proxmox.com/forums/proxmox-ve-installation-and-configuration.16/",
+        "title": "Inštalačné fórum Proxmox VE",
+        "desc": "Pri problémoch počas aktualizácie najprv prehľadajte toto fórum; rovnaký problém už možno niekto riešil."
+      },
+      {
+        "href": "https://pve.proxmox.com/wiki/Backup_and_Restore",
+        "title": "Zálohovanie a obnova",
+        "desc": "Aktualizácia hlavnej verzie je nevratná. Pred začiatkom overte svoje zálohy."
+      }
+    ]
+  },
+  "video": {
+    "heading": "Videonávod",
+    "intro": "Preferovať sledovanie upgrade spustiť end-to-end pred tým, než to urobiť sám? Tento prechod demonštruje tok upgrade ProxMenux v reálnom čase.",
+    "title": "ProxMenux — Videonávod na aktualizáciu Proxmox VE 8 na 9",
+    "caption": "Externé video na YouTube. Prehrávanie v režime rozšíreného súkromia, bez cookies až do spustenia videa."
+  },
+  "related": {
+    "heading": "Súvisiace",
+    "items": [
+      {
+        "href": "/docs/utils/system-update",
+        "label": "Aktualizácia systému Proxmox",
+        "tail": " — pre bežné aktualizácie v rámci rovnakej hlavnej verzie (8.4.1 → 8.4.5 a podobne)."
+      },
+      {
+        "href": "/docs/utils",
+        "label": "Prehľad pomocných nástrojov",
+        "tail": " — späť na prehľad sekcie."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sk/docs/utils/uup-dump-iso-creator.json b/web/messages/sk/docs/utils/uup-dump-iso-creator.json
new file mode 100644
index 00000000..8f518879
--- /dev/null
+++ b/web/messages/sk/docs/utils/uup-dump-iso-creator.json
@@ -0,0 +1,161 @@
+{
+  "meta": {
+    "title": "Tvorba ISO cez UUP Dump | Dokumentácia ProxMenux",
+    "description": "Vytvorte aktuálny inštalačný obraz ISO systému Windows na hostiteľovi Proxmox pomocou nástroja UUP Dump ISO Creator v ProxMenux. Automatizuje inštaláciu závislostí, sťahovanie a konverziu súborov UUP na zavádzací obraz ISO na vytvorenie VM.",
+    "ogTitle": "Tvorba ISO cez UUP Dump | Dokumentácia ProxMenux",
+    "ogDescription": "Vytvorte aktuálny obraz ISO systému Windows z UUP Dump pomocou ProxMenux. Závislosti, sťahovanie aj konverzia sú plne automatizované.",
+    "ogImageAlt": "ProxMenux — Tvorca ISO UUP Dump"
+  },
+  "header": {
+    "title": "Tvorba ISO cez UUP Dump",
+    "description": "Vytvorte aktuálny inštalačný obraz ISO systému Windows na hostiteľovi Proxmox pomocou UUP Dump. ProxMenux spravuje závislosti, paralelne sťahuje súbory UUP, spustí konvertor UUP Dump a presunie obraz ISO do vybraného výstupného adresára. Predvolene je to rozpoznané úložisko ISO Proxmox.",
+    "section": "Nástroje"
+  },
+  "intro": {
+    "title": "Čo robí tento skript",
+    "body": "Zadajte URL vytvorenú službou uupdump.net po výbere zostavy, jazyka a edície. Skript nainštaluje chýbajúce závislosti, stiahne konvertor UUP Dump aj súbory UUP, vytvorí zavádzací obraz ISO systému Windows a presunie ho do vybraného výstupného adresára. Ako predvolený cieľ ponúkne rozpoznané úložisko ISO Proxmox."
+  },
+  "hero": {
+    "imageAlt": "Položka UUP Dump ISO Creator v ProxMenux",
+    "caption": "Položka UUP Dump ISO Creator v ProxMenux"
+  },
+  "what": {
+    "heading": "Čo je UUP Dump?",
+    "intro": "UUP Dump je komunitná služba na sťahovanie pôvodných súborov Unified Update Platform (UUP), ktoré Windows Update používa na distribúciu systému Windows. Tieto súbory možno zostaviť do štandardného zavádzacieho obrazu ISO. Umožňuje získať:",
+    "items": [
+      "Najnovšiu zostavu systému Windows vrátane kanálov Insider Preview.",
+      "Konkrétnu staršiu zostavu, ktorú už Microsoft neuvádza na stránke na stiahnutie.",
+      "Čisté, nemodifikované súbory pochádzajúce priamo zo serverov Microsoft.",
+      "Presná kombinácia edícií a jazykov, ktoré chcete v jednom ISO."
+    ],
+    "learnMore": "Viac informácií nájdete na <extlink>stránke projektu UUP Dump</extlink>."
+  },
+  "automates": {
+    "heading": "Čo skript automatizuje"
+  },
+  "dependencies": {
+    "heading": "Závislosti",
+    "intro": "Skript najprv skontroluje nástroje potrebné na stiahnutie súborov UUP a vytvorenie obrazu ISO. Chýbajúce nástroje nainštaluje pomocou <code>apt-get</code>:",
+    "headerPackage": "Balík",
+    "headerRole": "Úloha",
+    "rows": [
+      {
+        "pkg": "curl",
+        "roleRich": "Sťahovanie cez HTTP na spustenie konvertora."
+      },
+      {
+        "pkg": "aria2",
+        "roleRich": "Paralelné sťahovanie všetkých súborov UUP."
+      },
+      {
+        "pkg": "cabextract",
+        "roleRich": "Rozbalí balíky Microsoft CAB."
+      },
+      {
+        "pkg": "wimtools",
+        "roleRich": "Buduje <code>install.wim</code> (wimlib-imagex)."
+      },
+      {
+        "pkg": "genisoimage",
+        "roleRich": "Vytvorí výsledný zavádzací obraz ISO (alebo <code>mkisofs</code>)."
+      },
+      {
+        "pkg": "chntpw",
+        "roleRich": "Počas vytvárania upravuje súbory registra Windows."
+      }
+    ],
+    "manualIntro": "Ručný ekvivalent, ak budete musieť nástroje nainštalovať sami:",
+    "manualCode": "apt-get install curl aria2 cabextract wimtools genisoimage chntpw"
+  },
+  "flow": {
+    "heading": "Sťahovanie a konverzia",
+    "steps": [
+      "Rozpozná úložisko ISO Proxmox cez <code>pvesm status -content iso</code> alebo použije náhradnú cestu <code>/var/lib/vz/template/iso</code>.",
+      "Vyžiada základný priečinok pre dočasné súbory (predvolene <code>/root/uup-temp</code>).",
+      "Stiahne konvertor UUP Dump z <code>git.uupdump.net</code>.",
+      "Z vloženej URL načíta <code>id</code>, <code>pack</code> a <code>edition</code>.",
+      "Zavolá <code>https://uupdump.net/get.php?…&aria2=2</code> a vytvorí zoznam na sťahovanie cez aria2.",
+      "Stiahne všetky súbory UUP do <code>UUPs/</code> pomocou aria2, paralelne a s možnosťou pokračovania.",
+      "Spustí <code>convert.sh wim UUPs 1</code> z konvertora a vytvorí výsledný obraz ISO.",
+      "Presunie obraz ISO do vybraného výstupného adresára a vyčistí dočasné súbory."
+    ]
+  },
+  "aria2": {
+    "heading": "Použité prepínače sťahovania Aria2",
+    "code": "aria2c --no-conf --console-log-level=warn --log-level=info \\\n  --log=aria2_download.log \\\n  -x16 -s16 -j5 -c -R \\\n  -d\"$destDir\" -i\"$tempScript\"",
+    "flags": [
+      "<code>-x16</code> — najviac 16 pripojení na server.",
+      "<code>-s16</code> — rozdelí každý súbor na 16 segmentov.",
+      "<code>-j5</code> — sťahuje 5 súborov súčasne.",
+      "<code>-c</code> — pokračuje v neúplných sťahovaniach.",
+      "<code>-R</code> — prenesie časovú značku vzdialeného súboru na stiahnutý súbor, ak je dostupná."
+    ],
+    "runtime": "Bežný čas je približne 10 minút a závisí najmä od rýchlosti internetu a vyťaženia serverov na sťahovanie UUP Dump."
+  },
+  "step1": {
+    "heading": "Krok 1 · Získajte UUP Dump URL",
+    "intro": "Pred spustením skriptu potrebujete URL UUP Dump s parametrami <code>id</code>, <code>pack</code> a <code>edition</code>. Vytvorte ju na <extlink>uupdump.net</extlink>:",
+    "stepBadge": "Krok",
+    "items": [
+      {
+        "title": "Vyberte verziu Windows",
+        "img": "/iso-creator/step-1-select-version-windows.png",
+        "caption": "Hlavná stránka UUP Dump: vyberte verziu Windows",
+        "body": "Otvorte domovskú stránku UUP Dump a vyberte verziu Windows, ktorú chcete."
+      },
+      {
+        "title": "Vyberte konkrétnu zostavu",
+        "img": "/iso-creator/step-2-select-version-windows.png",
+        "caption": "Vyberte konkrétnu zostavu",
+        "body": "Vyberte zostavu: najnovšiu, z kanála Insider Preview alebo konkrétnu staršiu, ktorá je ešte uvedená."
+      },
+      {
+        "title": "Vybrať jazyk",
+        "img": "/iso-creator/step-3-select-version-windows.png",
+        "caption": "Vybrať jazyk",
+        "body": "Vyberte jazyk, ktorý má obraz ISO obsahovať."
+      },
+      {
+        "title": "Vybrať edície",
+        "img": "/iso-creator/step-4-select-version-windows.png",
+        "caption": "Vyberte edície, ktoré sa majú zahrnúť",
+        "body": "Vyberte edície, ktoré chcete zahrnúť do obrazu ISO (Home, Pro, Enterprise, …). Môžete ich skombinovať viacero."
+      },
+      {
+        "title": "Kopírovať URL",
+        "img": "/iso-creator/step-5-select-version-windows.png",
+        "caption": "Kopírovať URL z panela adries",
+        "bodyRich": "Na poslednej stránke skopírujte URL <em>z panela s adresou prehliadača</em>. Musí obsahovať <code>id=…</code>, <code>pack=…</code> a <code>edition=…</code>. Tento reťazec skript spracuje."
+      }
+    ]
+  },
+  "step2": {
+    "heading": "Krok 2 · Spustite tvorcu",
+    "intro": "Po skopírovaní URL otvorte ProxMenux a spustite tvorbu ISO:",
+    "stepBadge": "Krok",
+    "items": [
+      {
+        "title": "Spustiť UUP Dump ISO Creator",
+        "img": "/iso-creator/start-uupdump-iso-creator.png",
+        "caption": "Spustiť UUP Dump ISO Creator z ProxMenux",
+        "bodyRich": "V ProxMenux otvorte <strong>Utilities → UUP Dump ISO Creator</strong>. Skript skontroluje závislosti a adresár ISO pred vyžiadaním údajov."
+      },
+      {
+        "title": "Vložiť UUP Dump URL",
+        "img": "/iso-creator/add-url-iso-creator.png",
+        "caption": "Vložte URL, ktoré ste skopírovali z uupdump.net",
+        "body": "Vložte URL do vstupného dialógu. Skript potvrdzuje, že sú prítomné tri požadované parametre; ak nejaký chýba, preruší sa čisto."
+      },
+      {
+        "title": "Počkajte na dokončenie vytvárania",
+        "img": "/iso-creator/end-uupdump-iso-creator.png",
+        "caption": "Vytváranie je dokončené — obraz ISO je pripravený v úložisku ISO Proxmox",
+        "bodyRich": "Konzola zobrazuje priebeh aria2 a potom výstup konvertora. Hotový obraz ISO sa presunie do vybraného výstupného adresára. Ak je v nakonfigurovanom úložisku ISO Proxmox, možno ho vybrať cez <strong>Vytvoriť VM s Windows → Inštalovať z vlastného ISO</strong>."
+      }
+    ]
+  },
+  "tempFiles": {
+    "title": "Dočasné súbory",
+    "body": "Predvolený dočasný priečinok je <code>/root/uup-temp</code>, so stiahnutými súbormi v <code>UUPs/</code> a konvertorom v <code>converter/</code>. Vlastná základná cesta dostane samostatný podadresár relácie. Vetvy úspešného vytvorenia a nevytvoreného ISO odstránia dočasnú reláciu. Skoršie chyby alebo zrušenie môžu zanechať dočasné súbory."
+  }
+}
diff --git a/web/messages/sk/guides/backup-cloud.json b/web/messages/sk/guides/backup-cloud.json
new file mode 100644
index 00000000..6e1424cb
--- /dev/null
+++ b/web/messages/sk/guides/backup-cloud.json
@@ -0,0 +1,119 @@
+{
+  "meta": {
+    "title": "Zálohy Proxmoxu na osobné cloudové úložisko | ProxMenux",
+    "description": "Pomocou rclone pripojte osobné cloudové úložisko, napríklad Google Drive, Mega, Dropbox alebo OneDrive, ako adresár na hostiteľovi Proxmox VE, zaregistrujte ho ako úložisko záloh pre vzdump a zálohujte VM aj kontajnery priamo do cloudu bez ďalšieho zálohovacieho skriptu.",
+    "ogTitle": "Zálohy Proxmoxu na osobné cloudové úložisko",
+    "ogDescription": "Pripojte cloudové úložisko cez rclone na hostiteľovi Proxmox VE a používajte ho ako cieľ záloh vzdump pre VM a kontajnery."
+  },
+  "header": {
+    "title": "Zálohy Proxmoxu na osobné cloudové úložisko",
+    "description": "Pomocou rclone pripojte osobné cloudové úložisko, napríklad Google Drive, Mega, Dropbox alebo OneDrive, ako adresár na hostiteľovi Proxmox VE, zaregistrujte ho ako úložisko záloh pre vzdump a zálohujte VM aj kontajnery priamo do cloudu bez ďalšieho zálohovacieho skriptu.",
+    "section": "Návody"
+  },
+  "intro": {
+    "pbsCalloutTitle": "Najprv zvážte Proxmox Backup Server",
+    "pbsCalloutBody": "Na druhom stroji, ktorý spĺňa požiadavky x86-64, poskytuje <pbsLink>Proxmox Backup Server</pbsLink> inkrementálne a deduplikované zálohy s voliteľným šifrovaním na strane klienta. Je určený na zálohy VM. Tento návod namiesto toho opisuje pripojenie osobného cloudu, napríklad Google Drive, Mega, OneDrive alebo Dropbox, ako cieľa záloh.",
+    "stepsTitle": "Čo budete robiť",
+    "steps": [
+      "Vytvoriť adresár na hostiteľovi Proxmox a zaregistrovať ho ako úložisko záloh vzdump.",
+      "Nainštalujte a nakonfigurujte rclone pre svojho poskytovateľa cloudu.",
+      "Pripojiť cloudový priečinok do vytvoreného adresára.",
+      "Obnovovať pripojenie po každom reštarte pomocou jednotky systemd."
+    ],
+    "vzdumpCalloutTitle": "Upozornenie k zálohám vzdump v Proxmoxe",
+    "vzdumpCalloutBody": "Archívy Proxmox vzdump sú <strong>úplné zálohy, nie prírastkové</strong>. Ich skutočná veľkosť závisí od zahrnutých údajov a kompresie, nie iba od kapacity virtuálneho disku. Ak jeden archív zaberá 30 GB, päť uchovaných archívov potrebuje približne 150 GB. Nastavte pravidlá uchovávania, aby sa cloudové úložisko nezaplnilo."
+  },
+  "createDir": {
+    "heading": "1. Vytvorenie adresára na hostiteľovi a registrácia úložiska záloh",
+    "body": "Pripojte sa k hostiteľovi cez SSH alebo otvorte shell Proxmoxu a vytvorte prípojný adresár v <code>/mnt/</code>. Zvoľte názov, podľa ktorého spoznáte poskytovateľa:",
+    "mkdirCode": "mkdir -p /mnt/gdrive",
+    "afterMkdir": "V webe Proxmox UI: <strong>Datacentrum → Úložisko → Pridať → Directory</strong>.",
+    "image1Alt": "Pridanie nového úložiska v Proxmoxe",
+    "configIntro": "Nastaviť to takto:",
+    "configItems": [
+      "<strong>ID:</strong> <code>gdrive</code> (alebo čokoľvek ste použili pre názov adresára)",
+      "<strong>Adresár:</strong> <code>/mnt/gdrive</code>",
+      "<strong>Obsah:</strong> vyberte <strong>Súbor zálohy VZDump</strong>."
+    ],
+    "image2Alt": "Nastavenie nového úložiska v Proxmoxe",
+    "afterConfig": "Kliknite na <strong>Pridať</strong>:",
+    "image3Alt": "Nové úložisko pridané v Proxmoxe",
+    "afterAdd": "Adresár je zaregistrovaný ako úložisko Proxmoxu, ale zatiaľ je prázdny: cloud ešte nie je pripojený."
+  },
+  "installRclone": {
+    "heading": "2. Nainštalujte a nakonfigurujte rclone",
+    "body": "<rcloneLink>rclone</rcloneLink> komunikuje so službami cloudového úložiska. Nainštalujte ho z repozitárov Debianu:",
+    "installCode": "apt-get update\napt-get install -y rclone",
+    "newerCalloutTitle": "Ak potrebujete novší rclone",
+    "newerCalloutBody": "Ak potrebujete novšiu verziu než tú z Debianu, použite oficiálny inštalátor:",
+    "newerCode": "curl https://rclone.org/install.sh | bash",
+    "tunnelHeading": "2.1 Overenie založené na prehliadači cez tunel SSH",
+    "tunnelBody": "Pri poskytovateľoch s prihlásením cez prehliadač hostiteľ Proxmox zvyčajne prehliadač nemá. Postupujte podľa <remoteSetupLink>návodu na vzdialenú konfiguráciu rclone</remoteSetupLink>: použite prehliadač notebooku a jeho spätné spojenie na localhost presmerujte cez SSH k rclone na hostiteľovi.",
+    "tunnelFrom": "Na <strong>notebooku</strong> nahraďte <code>ip_proxmox</code> IP adresou Proxmoxu:",
+    "tunnelCode": "ssh -L localhost:53682:localhost:53682 root@ip_proxmox",
+    "tunnelAfter": "Táto relácia SSH otvorí lokálny port 53682 na notebooku a presmeruje spojenia na rovnaký port hostiteľa Proxmox. Nechajte ju otvorenú počas konfigurácie rclone.",
+    "runHeading": "2.2 Spustiť rclone config",
+    "runBody": "V práve otvorenej relácii SSH spustite:",
+    "runCode": "rclone config",
+    "runAfter": "Podľa pokynov pridajte novú vzdialenú konfiguráciu, tzv. remote. Odpovede závisia od poskytovateľa; pozrite si <providerDocsLink>dokumentáciu poskytovateľov rclone</providerDocsLink> pre Google Drive, Mega, Dropbox, OneDrive a ďalších. Kľúčová je otázka na overenie:",
+    "authPrompt": "Use web browser to automatically authenticate rclone with remote?\n * Say Y if the machine running rclone has a web browser you can use\n * Say N if running rclone on a (remote) machine without web browser access\nIf not sure try Y. If Y failed, try N.\ny) Yes\nn) No\ny/n> y",
+    "authAfter": "Odpovedzte <strong>Y</strong>. rclone zobrazí lokálnu URL. Otvorte ju v <strong>prehliadači notebooku</strong>; tunel SSH presmeruje spojenie. Povoľte rclone prístup u poskytovateľa cloudu a dokončite konfiguráciu.",
+    "nameRemote": "Ako názov vzdialenej konfigurácie použite názov zodpovedajúci adresáru, napríklad <code>gdrive</code>."
+  },
+  "mount": {
+    "heading": "3. Pripojenie cloudového priečinka",
+    "body": "Vytvorte v cloude priečinok na zálohy, napríklad <code>PBC</code>, skratku pre Proxmox Backup Cloud.",
+    "mountIntro": "Pripojte ho do adresára na hostiteľovi:",
+    "mountCode": "rclone mount gdrive:/PBC /mnt/gdrive --allow-other --allow-non-empty --vfs-cache-mode writes",
+    "mountItems": [
+      "<code>gdrive:/PBC</code> — priečinok vo vašom cloude.",
+      "<code>/mnt/gdrive</code> — adresár hostiteľa zaregistrovaný ako úložisko záloh."
+    ],
+    "mountFootnote": "<strong>Tento príkaz beží v popredí.</strong> Pri testovaní ho nechajte spustený v termináli a vyskúšajte zálohu. Na obnovenie pripojenia pri každom štarte nastavte jednotku systemd podľa ďalšej časti."
+  },
+  "systemd": {
+    "heading": "4. Automatické pripojenie pri každom štarte cez systemd",
+    "body": "Jednotka systemd ponúka viac možností než <code>crontab @reboot</code>: dokáže počkať na spustenie siete, reštartovať sa pri chybe a poskytnúť protokoly cez <code>journalctl</code>.",
+    "createIntro": "Vytvorte súbor jednotky:",
+    "createCode": "nano /etc/systemd/system/rclone-gdrive.service",
+    "pasteIntro": "Vložte:",
+    "unitCode": "[Unit]\nDescription=rclone mount for Proxmox cloud backups\nWants=network-online.target\nAfter=network-online.target\n\n[Service]\nType=notify\nExecStart=/usr/bin/rclone mount \\\n    gdrive:/PBC /mnt/gdrive \\\n    --allow-other \\\n    --allow-non-empty \\\n    --vfs-cache-mode writes \\\n    --log-level INFO \\\n    --log-file /var/log/rclone-gdrive.log\nExecStop=/bin/fusermount -uz /mnt/gdrive\nRestart=on-failure\nRestartSec=10\n\n[Install]\nWantedBy=multi-user.target",
+    "adjust": "Ak ste zvolili iné názvy, upravte <code>gdrive:/PBC</code> a <code>/mnt/gdrive</code>. Uložte súbor, ukončite editor cez <code>Ctrl+X</code> a zapnite aj spustite službu:",
+    "enableCode": "systemctl daemon-reload\nsystemctl enable --now rclone-gdrive.service",
+    "verifyIntro": "Overiť:",
+    "verifyCode": "systemctl status rclone-gdrive.service\nmount | grep /mnt/gdrive",
+    "verifyAfter": "Jednotka požiada o reštart po 10 sekundách, ak sa proces rclone skončí chybou. Neopraví expirované prihlasovacie údaje ani nezaručí zotavenie zo všetkých chýb siete či poskytovateľa. Skontrolujte <code>/var/log/rclone-gdrive.log</code> a <code>journalctl -u rclone-gdrive.service -f</code>.",
+    "vfsCalloutTitle": "Prečo použiť --vfs-cache-mode writes?",
+    "vfsCalloutBody": "Pri ukladaní zápisov do cache sa operácie ako <code>fwrite</code> zapisujú do lokálnej diskovej cache. rclone odošle súbor po jeho zatvorení a uplynutí oneskorenia zápisu. Vyhraďte dosť lokálneho miesta na prebiehajúce zálohy a overte dokončenie odoslania, skôr než budete cloudovú kópiu považovať za dostupnú."
+  },
+  "configureBackup": {
+    "heading": "5. Nastavenie cloudu ako cieľa záloh",
+    "body": "V Proxmoxe pri plánovanej alebo ručnej zálohe vyberte zaregistrované úložisko ako <strong>cieľ</strong>:",
+    "image5Alt": "Výber cieľa zálohy v Proxmoxe",
+    "after": "Po dokončení vzdump počkajte na dokončenie odosielania rclone na pozadí a overte archív v rozhraní poskytovateľa cloudu:",
+    "image6Alt": "Záložný súbor v cloudovom úložisku"
+  },
+  "retention": {
+    "heading": "6. Uchovávanie záloh — kontrola cloudovej kvóty",
+    "body": "Archívy Proxmox vzdump sú <strong>úplné zálohy, nie prírastkové</strong>. Ich skutočná veľkosť závisí od zahrnutých údajov a kompresie, nie iba od kapacity virtuálneho disku. Ak jeden archív zaberá 30 GB, päť uchovaných archívov potrebuje približne 150 GB. Nastavte pravidlá uchovávania, aby sa cloudové úložisko nezaplnilo.",
+    "uiPath": "V rozhraní Proxmox: <strong>Dátové centrum → Zálohovanie → [vaša úloha] → Uchovávanie</strong>:",
+    "image7Alt": "Nastavenia uchovávania záloh v Proxmoxe",
+    "starterIntro": "Možné počiatočné hodnoty pre domáce alebo testovacie prostredie:",
+    "starterItems": [
+      "Uchovať posledných 5 denných záloh",
+      "Uchovať posledné 4 týždenné zálohy",
+      "Uchovať posledných 6 mesačných záloh"
+    ],
+    "adjust": "Hodnoty prispôsobte cloudovej kvóte a frekvencii zmien VM."
+  },
+  "troubleshoot": {
+    "heading": "Riešenie problémov",
+    "items": [
+      "<strong><code>Mount point /mnt/gdrive is itself on a fuse.rclone filesystem</code>:</strong> adresár je už pripojený, možno inou inštanciou rclone. Pred odstránením starého pripojenia cez <code>fusermount -uz /mnt/gdrive</code> overte, že neprebieha záloha, a potom reštartujte jednotku systemd.",
+      "<strong>Záloha je veľmi pomalá:</strong> overte <code>--vfs-cache-mode writes</code> v riadku <code>ExecStart</code>. Skontrolujte výkon lokálnej cache, rýchlosť odosielania a limity poskytovateľa. Odosielanie môže pokračovať aj po dokončení vzdump.",
+      "<strong>Záloha hlási No space left on device:</strong> overte miesto v lokálnej cache a cloudovú kvótu. Cache bežne používa <code>~/.cache/rclone/</code>. Ak je plná, zvoľte napríklad <code>--cache-dir /var/cache/rclone</code> na súborovom systéme s dostatkom miesta. Iná cesta na tom istom plnom systéme nepomôže.",
+      "<strong>Platnosť overovacieho tokenu rclone vypršala:</strong> pripojte sa znova cez SSH s tunelom (<code>ssh -L localhost:53682:localhost:53682 root@ip_proxmox</code>) a spustite <code>rclone config reconnect gdrive:</code> na obnovenie autorizácie.",
+      "<strong>Zálohy sú v cloude, ale obnova zlyháva:</strong> nepoužívajte cloud ako <strong>jediný</strong> cieľ záloh. Doplňte ho lokálnym PBS alebo zálohami vzdump na inom disku."
+    ]
+  }
+}
diff --git a/web/messages/sk/guides/index.json b/web/messages/sk/guides/index.json
new file mode 100644
index 00000000..d6a8b390
--- /dev/null
+++ b/web/messages/sk/guides/index.json
@@ -0,0 +1,118 @@
+{
+  "meta": {
+    "title": "Návody pre Proxmox VE — Coral TPU, NVIDIA, Kodi v LXC, Samba a cloudové zálohy | ProxMenux",
+    "description": "Podrobné návody pre Proxmox VE: Kodi v LXC s akceleráciou GPU, ovládače NVIDIA na PVE 9, USB disk zdieľaný cez Sambu v kontajneri a zálohy vzdump na Google Drive, Mega, Dropbox alebo OneDrive. Navyše vybrané komunitné zdroje, slovník pojmov a prehľad príkazov.",
+    "ogTitle": "Návody pre Proxmox VE — Coral TPU, NVIDIA, Kodi v LXC, Samba a cloudové zálohy",
+    "ogDescription": "Podrobné návody pre Proxmox VE: priame priradenie GPU, multimediálne centrum Kodi v LXC, USB disk zdieľaný cez Sambu, cloudové zálohy pomocou rclone a vybrané komunitné zdroje.",
+    "twitterTitle": "Návody pre Proxmox VE | ProxMenux",
+    "twitterDescription": "Podrobné návody pre Proxmox VE — GPU, Kodi v LXC, Samba, cloudové zálohy a ďalšie témy.",
+    "ogImageAlt": "Návody ProxMenux — podrobné postupy pre Proxmox VE"
+  },
+  "header": {
+    "title": "Návody ProxMenux",
+    "tagline": "Podrobné návody, stručné prehľady a vybrané komunitné zdroje na lepšie využitie Proxmox VE."
+  },
+  "inDepth": {
+    "heading": "Hĺbkové príručky",
+    "intro": "Podrobné návody na konkrétne úlohy v Proxmoxe. Každý opisuje manuálne kroky postupu, ktorý ProxMenux automatizuje, aby ste vedeli, čo sa v každom kroku deje.",
+    "items": [
+      {
+        "slug": "kodi-lxc",
+        "title": "Inštalácia Kodi v LXC s akceleráciou GPU a pripojením k monitoru alebo televízoru",
+        "description": "Spustite Kodi v privilegovanom kontajneri LXC na Proxmox VE, sprístupnite mu iGPU a vstupné USB zariadenia hostiteľa a používajte server ako multimediálne centrum pripojené priamo k televízoru."
+      },
+      {
+        "slug": "backup-cloud",
+        "title": "Zálohy Proxmoxu na osobné cloudové úložisko",
+        "description": "Pomocou rclone pripojte osobné cloudové úložisko, napríklad Google Drive, Mega, Dropbox alebo OneDrive, ako adresár na hostiteľovi Proxmox VE, zaregistrujte ho ako úložisko záloh pre vzdump a zálohujte VM aj kontajnery priamo do cloudu bez ďalšieho zálohovacieho skriptu."
+      },
+      {
+        "slug": "lxc-samba",
+        "title": "Pripojenie USB disku alebo kľúča ku kontajneru LXC a zdieľanie cez Sambu",
+        "description": "Sprístupnite USB disk alebo kľúč privilegovanému kontajneru LXC na Proxmox VE, nainštalujte v ňom Sambu a zdieľajte obsah cez sieť."
+      },
+      {
+        "slug": "nvidia-manual",
+        "title": "Inštalácia NVIDIA ovládačov grafickej karty na Proxmox VE 9 (manuálny postup)",
+        "description": "Manuálna inštalácia a konfigurácia ovládačov NVIDIA na hostiteľovi Proxmox VE 9 a sprístupnenie GPU jednému alebo viacerým kontajnerom LXC. Zahŕňa ovládače, službu perzistencie, voliteľnú úpravu NVENC a konfiguráciu jednotlivých kontajnerov."
+      }
+    ]
+  },
+  "references": {
+    "heading": "Odkazy na ProxMenux",
+    "intro": "Rýchly referenčný materiál z dokumentácie ProxMenux.",
+    "cards": {
+      "glossary": {
+        "title": "Slovník pojmov",
+        "description": "Viac než 60 definícií technických pojmov z ProxMenuxu: Proxmox, virtualizácia, úložiská, sieť a Linux. Rýchle vyhľadanie pomocou kategórií a súvisiacich odkazov."
+      },
+      "helpInfo": {
+        "title": "Pomoc a informácie — katalóg príkazov",
+        "description": "Výber príkazov Linuxu a Proxmoxu podľa tém s kopírovaním do schránky. Zodpovedá prehľadu v ponuke ProxMenuxu."
+      },
+      "linuxResources": {
+        "title": "Zdroje Linuxu",
+        "description": "Externé zdroje na učenie príkazového riadka Linuxu, bezpečnostných postupov, monitorovacích nástrojov a ZFS — dopĺňajú katalóg príkazov ProxMenuxu."
+      },
+      "externalRepos": {
+        "title": "Externé repozitáre",
+        "description": "Repozitáre skriptov tretích strán začlenené do ProxMenuxu ako alternatívne voľby ponuky, napríklad community-scripts/ProxmoxVE."
+      }
+    }
+  },
+  "official": {
+    "heading": "Oficiálne zdroje Proxmoxu",
+    "intro": "Dokumentácia priamo od Proxmox Server Solutions — rozhodujúci zdroj informácií o platforme.",
+    "cards": {
+      "pveDocs": {
+        "title": "Dokumentácia Proxmox VE",
+        "description": "Oficiálna príručka správcu. Komplexný prehľad inštalácie, siete, úložísk, klastrov, vysokej dostupnosti a API."
+      },
+      "pbsDocs": {
+        "title": "Dokumentácia Proxmox Backup Server",
+        "description": "Dokumentácia PBS — inkrementálne, deduplikované a šifrované zálohy pre Proxmox VE."
+      },
+      "videoTraining": {
+        "title": "Oficiálne videoškolenie",
+        "description": "Oficiálne videonávody a školenia od Proxmoxu."
+      },
+      "forum": {
+        "title": "Proxmox Forum",
+        "description": "Oficiálne komunitné fórum na otázky, riešenie problémov a zdieľanie skúseností. Sledujú ho správcovia projektu."
+      }
+    }
+  },
+  "community": {
+    "heading": "Komunitné projekty a zdroje",
+    "intro": "Open-source projekty a vybrané zoznamy zo širšej komunity Proxmox. Nie sú pridružené k Proxmox Server Solutions ani k ProxMenuxu; sú tu uvedené, pretože sa osvedčili.",
+    "cards": {
+      "helperScripts": {
+        "title": "Proxmox VE Helper-Scripts",
+        "description": "Komunitou udržiavaný katalóg skriptov na jednoduché nasadenie kontajnerov LXC, VM a úprav PVE, napríklad pre Home Assistant, Plex či Frigate. Nadväzuje na pomocné skripty od ttecka."
+      },
+      "awesome": {
+        "title": "awesome-proxmox-ve (výber zdrojov)",
+        "description": "Rozsiahly komunitný výber zdrojov pre Proxmox VE: nástroje, knižnice, integrácie, blogy a videá. Dobrý východiskový bod na ďalšie objavovanie."
+      }
+    },
+    "suggestRich": "Poznáte kvalitný zdroj, ktorý by sme mali pridať? Otvorte issue alebo PR na <link>GitHub</link>. Chceme zachovať premyslený výber, nie úplný zoznam všetkého."
+  },
+  "discussion": {
+    "heading": "Komunitná diskusia",
+    "intro": "Kde ľudia hovoria o Proxmoxe a ProxMenux.",
+    "cards": {
+      "proxmenuxDiscussions": {
+        "title": "ProxMenux Discussions",
+        "description": "GitHub Discussions venované ProxMenuxu: nápady na funkcie, otázky a odpovede a zdieľanie konfigurácií. Vhodné miesto na témy o ponuke, Monitore a dokumentácii."
+      },
+      "proxmoxForum": {
+        "title": "Proxmox Forum",
+        "description": "Oficiálne fórum Proxmoxu, uvedené aj vyššie. Vhodné na podrobné riešenie problémov a otázky ku konkrétnym konfiguráciám."
+      },
+      "reddit": {
+        "title": "r/Proxmox na Reddite",
+        "description": "Aktívny subreddit na diskusie, tipy a technickú pomoc. Jednoduchšie zapojenie než na fóre a často rýchlejšie odpovede na neformálne otázky."
+      }
+    }
+  }
+}
diff --git a/web/messages/sk/guides/kodi-lxc.json b/web/messages/sk/guides/kodi-lxc.json
new file mode 100644
index 00000000..ee817760
--- /dev/null
+++ b/web/messages/sk/guides/kodi-lxc.json
@@ -0,0 +1,70 @@
+{
+  "meta": {
+    "title": "Inštalácia Kodi v LXC s akceleráciou GPU | Návody ProxMenux",
+    "description": "Spustite Kodi v privilegovanom kontajneri LXC na Proxmox VE, sprístupnite mu iGPU a vstupné USB zariadenia hostiteľa a používajte server ako multimediálne centrum pripojené priamo k televízoru.",
+    "ogTitle": "Inštalácia Kodi v LXC s akceleráciou GPU",
+    "ogDescription": "Spustite Kodi v privilegovanom kontajneri LXC na Proxmox VE s prístupom k iGPU a vstupným USB zariadeniam hostiteľa a vytvorte zo servera multimediálne centrum."
+  },
+  "header": {
+    "title": "Inštalácia Kodi v LXC s akceleráciou GPU a pripojením k monitoru alebo televízoru",
+    "description": "Spustite Kodi v privilegovanom kontajneri LXC na Proxmox VE, sprístupnite mu iGPU a vstupné USB zariadenia hostiteľa a používajte server ako multimediálne centrum pripojené priamo k televízoru.",
+    "section": "Návody"
+  },
+  "intro": {
+    "calloutTitle": "Upozornenie",
+    "calloutBody": "Tento návod používa externý komunitný skript na prípravu kontajnera Kodi. Prístup k iGPU hostiteľa dokáže nastaviť aj ProxMenux: <strong>GPU a Coral-TPU → Pridať GPU do LXC</strong> nakonfiguruje <code>/dev/dri</code> a nainštaluje ovládače v kontajneri. Skript nižšie navyše nainštaluje Kodi a nastaví automatické spustenie na <code>tty7</code>. Použite ho na hotové multimediálne centrum v LXC; <gpuLink>postup ProxMenuxu</gpuLink> zvoľte, ak potrebujete iba prístup ku GPU pre ručne nastavený kontajner.",
+    "credit": "Pôvodný skript Kodi pre LXC vytvoril <authorLink>mrrudy</authorLink>.",
+    "stepsTitle": "Čo budete robiť",
+    "steps": [
+      "Pomocou skriptu vytvoriť privilegovaný kontajner LXC s Kodi.",
+      "Sprístupniť kontajneru USB klávesnicu, myš alebo herný ovládač.",
+      "Voliteľne aktualizovať Kodi z repozitárov nastavených v kontajneri."
+    ]
+  },
+  "createCt": {
+    "heading": "1. Vytvoriť kodi LXC",
+    "body": "Pre tento postup zvoľte <strong>Privileged</strong> v rozšírených nastaveniach skriptu. Skript predvolene vytvára neprivilegované kontajnery, ktoré potrebujú vhodné oprávnenia zariadení a mapovanie identifikátorov. Nastaví prístup ku GPU, Kodi a automatické spustenie na <code>tty7</code>:",
+    "code": "bash -c \"$(wget -qLO - https://raw.githubusercontent.com/mrrudy/proxmoxHelper/main/ct/kodi-v1.sh)\"",
+    "after": "Inštalácia chvíľu trvá. Keď sa Kodi spustí na <code>tty7</code>, pripojte monitor alebo televízor k výstupu HDMI/DisplayPort hostiteľa. Malo by sa zobraziť rozhranie Kodi."
+  },
+  "addInput": {
+    "heading": "2. Pridanie klávesnice, myši alebo USB ovládača",
+    "body": "Vstupné zariadenia nájdete na hostiteľovi v <code>/dev/input/</code>. Zistite ich hlavné číslo zariadenia (major):",
+    "listCode": "ls -l /dev/input",
+    "imageAlt": "Zoznam vstupných zariadení",
+    "afterList": "Pri znakových zariadeniach použite hlavné číslo pred čiarkou, v príklade <code>13</code>. Na hostiteľovi upravte konfiguráciu kontajnera Kodi. Nahraďte <code>'<'CTID'>'</code> jeho ID, napríklad <code>102</code>:",
+    "editCode": "nano /etc/pve/lxc/CTID.conf",
+    "addLines": "Pridajte nasledujúce riadky a upravte <code>13</code> podľa čísla na <strong>vašom</strong> hostiteľovi:",
+    "configCode": "lxc.cgroup2.devices.allow: c 13:* rwm\nlxc.mount.entry: /dev/input dev/input none bind,optional,create=dir",
+    "imageConfigAlt": "Konfigurácia LXC",
+    "save": "Uložte súbor, ukončite editor pomocou <code>Ctrl+X</code> a reštartujte <strong>iba kontajner</strong>. Hostiteľa Proxmox reštartovať netreba:",
+    "restartCode": "pct reboot CTID",
+    "plug": "Pripojte klávesnicu, myš alebo USB ovládač. Kodi by mal reagovať."
+  },
+  "updateKodi": {
+    "heading": "3. Voliteľná aktualizácia Kodi z nastavených repozitárov",
+    "calloutTitle": "Dôležité",
+    "calloutBody": "PPA team-xbmc je <strong>iba pre Ubuntu</strong> a Kodi uvádza, že už nie je udržiavaný. Chýbajúci príkaz <code>add-apt-repository</code> neurčuje distribúciu. Skontrolujte <code>cat /etc/os-release</code> a hľadajte <code>NAME=\"Ubuntu\"</code>; nepridávajte Ubuntu PPA do Debianu. Príkazy nižšie aktualizujú balíky z repozitárov nastavených v kontajneri.",
+    "body": "V kontajneri (<code>pct enter '<'CTID'>'</code>):",
+    "code": "apt update\napt install --only-upgrade kodi kodi-bin",
+    "after": "Po aktualizácii reštartujte kontajner. Kodi použije verziu dostupnú v nastavených repozitároch, ktorá sa môže líšiť od najnovšieho vydania projektu."
+  },
+  "screenshots": {
+    "heading": "Snímky obrazovky",
+    "image1Alt": "Kodi rozhranie 1",
+    "image2Alt": "Kodi rozhranie 2"
+  },
+  "troubleshoot": {
+    "heading": "Riešenie problémov",
+    "items": [
+      "<strong>Kontajner Kodi sa spustí, ale na televízore nič nevidno:</strong> možno nemá prístup k iGPU. V kontajneri skontrolujte <code>ls /dev/dri</code>; mali by sa zobraziť <code>card0</code> a <code>renderD128</code>. Ak je adresár prázdny, skontrolujte priame priradenie GPU alebo použite <strong>Pridať GPU do LXC</strong> v ProxMenuxe.",
+      "<strong>Klávesnica alebo myš sa po reštarte nezistí:</strong> skontrolujte pripojenie <code>/dev/input</code> a oprávnenie Kodi čítať zariadenia. Spustite <code>ls -l /dev/input</code> na hostiteľovi aj v kontajneri a overte pravidlo <code>lxc.cgroup2.devices.allow</code>.",
+      "<strong>Prehrávanie s hardvérovou akceleráciou používa CPU namiesto GPU:</strong> nainštalujte alebo aktualizujte ovládače VA-API v kontajneri: <code>intel-media-va-driver</code> pre novšie Intel iGPU, <code>i965-va-driver</code> pre staršie a <code>mesa-va-drivers</code> pre AMD.",
+      "<strong><code>add-apt-repository: command not found</code>:</strong> príkaz nie je nainštalovaný; to nedokazuje, že kontajner používa Debian. Skontrolujte distribúciu a dostupné balíky. Na Debiane použite jeho balíky Kodi bez pridávania Ubuntu PPA."
+    ]
+  },
+  "further": {
+    "heading": "Ďalšie informácie",
+    "konpatRich": "<konpatLink>Konpatov blogový príspevok</konpatLink> s ďalšími informáciami o sprístupnení Intel iGPU v LXC."
+  }
+}
diff --git a/web/messages/sk/guides/lxc-samba.json b/web/messages/sk/guides/lxc-samba.json
new file mode 100644
index 00000000..51369215
--- /dev/null
+++ b/web/messages/sk/guides/lxc-samba.json
@@ -0,0 +1,119 @@
+{
+  "meta": {
+    "title": "Pripojenie USB disku k LXC a zdieľanie cez Sambu | ProxMenux",
+    "description": "Sprístupnite USB disk alebo kľúč privilegovanému kontajneru LXC na Proxmox VE, nainštalujte v ňom Sambu a zdieľajte obsah cez sieť.",
+    "ogTitle": "Pripojenie USB disku k LXC a zdieľanie cez Sambu",
+    "ogDescription": "Sprístupnite USB disk privilegovanému kontajneru LXC na Proxmox VE, nainštalujte Sambu a zdieľajte obsah v lokálnej sieti."
+  },
+  "header": {
+    "title": "Pripojenie USB disku alebo kľúča ku kontajneru LXC a zdieľanie cez Sambu",
+    "description": "Sprístupnite USB disk alebo kľúč privilegovanému kontajneru LXC na Proxmox VE, nainštalujte v ňom Sambu a zdieľajte obsah cez sieť.",
+    "section": "Návody"
+  },
+  "recommended": {
+    "calloutTitle": "Odporúčané",
+    "calloutIntro": "ProxMenux ponúka obe časti tohto postupu prostredníctvom sprievodcov v ponukách:",
+    "items": [
+      "<strong>Správca diskov → Formátovať/vymazať fyzický disk</strong> na formátovanie.",
+      "<strong>Úložiská a zdieľanie → Sieťové zdieľanie LXC → Server Samba v LXC</strong> na inštaláciu v privilegovanom kontajneri a konfiguráciu Samby."
+    ],
+    "calloutOutro": "Sprievodcovia riešia osobitosti oprávnení neprivilegovaných kontajnerov, profily zdieľania na čítanie a zápis, iba na čítanie či vlastné nastavenia a skupinu sharedfiles. Tento návod opisuje manuálne kroky, aby ste im rozumeli alebo ich mohli nastaviť sami."
+  },
+  "intro": {
+    "body": "USB disk alebo kľúč môže byť užitočným doplnkom hostiteľa Proxmox, najmä pri mini PC s obmedzenými možnosťami rozšírenia. Tento návod vysvetľuje:",
+    "stepsTitle": "Čo budete robiť",
+    "steps": [
+      "Pripojenie USB disku k privilegovanému LXC.",
+      "Inštalácia Samby vnútri kontajnera.",
+      "Zdieľanie obsahu disku cez LAN."
+    ],
+    "useCasesTitle": "Prípady použitia",
+    "useCases": [
+      "Ukladať torrentové súbory a sprístupňovať ich cez sieť.",
+      "Poskytovať úložisko multimediálnemu serveru, napríklad Plex, Jellyfin alebo Emby.",
+      "Ukladať dokumenty, ktoré Paperless automaticky spracúva.",
+      "Všeobecné úložisko typu NAS pre domácu sieť."
+    ],
+    "privilegedCalloutTitle": "Privilegovaný kontajner pre tento postup",
+    "privilegedCalloutBody": "Tento postup používa privilegovaný kontajner LXC s blokovým zariadením ako <code>mp0</code>. Pri neprivilegovanom kontajneri môžete pripojiť súborový systém na hostiteľovi a sprístupniť jeho adresár cez bind mount s vhodnými oprávneniami a mapovaním identifikátorov. Pozrite <strong>Úložiská a zdieľanie → Prípojné body LXC</strong> v ProxMenuxe."
+  },
+  "attach": {
+    "heading": "1. Pripojenie USB disku k LXC",
+    "identifyHeading": "1.1 Identifikujte zariadenie",
+    "identifyBody": "Porovnajte zoznam diskov <strong>pred</strong> a <strong>po</strong> pripojení USB disku. Nové zariadenie je hľadaný disk.",
+    "beforeLabel": "Pred:",
+    "afterLabel": "Po:",
+    "imageBeforeAlt": "Zoznam diskov pred pridaním USB disku",
+    "imageAfterAlt": "Zoznam diskov po pridaní USB disku",
+    "lsblkBody": "Príkazom <code>lsblk -o NAME,SIZE,MODEL,SERIAL</code> zobrazíte blokové zariadenia s modelom a sériovým číslom.",
+    "stableCalloutTitle": "Dôležité — použite stabilný identifikátor",
+    "stableCalloutBody": "Názov <code>/dev/sdb1</code> sa môže po reštarte zmeniť, najmä pri viacerých USB diskoch. Nájdite trvalý identifikátor:",
+    "stableCalloutCode": "ls -l /dev/disk/by-id/",
+    "stableCalloutAfter": "V konfigurácii LXC použite záznam <code>/dev/disk/by-id/usb-...</code> pre požadovaný oddiel namiesto <code>/dev/sdb1</code>. Vyberte oddiel, nie celý disk; zostane identifikovateľný aj pri zmene poradia zariadení.",
+    "formatHeading": "1.2 Formát disku",
+    "formatBody": "ext4 je vhodný pre zdieľanie z Linuxu: rozlišuje veľké a malé písmená, podporuje POSIX ACL a veľké súbory. Formátovanie zničí obsah existujúceho súborového systému. Overte oddiel a spustite príkaz na <strong>hostiteľovi Proxmox</strong>:",
+    "formatCode": "mkfs.ext4 /dev/sdb1",
+    "formatAfter": "Nahraďte <code>/dev/sdb1</code> skutočným oddielom alebo jeho trvalou cestou <code>/dev/disk/by-id/usb-...-part1</code>.",
+    "mkdirHeading": "1.3 Vytvorenie prípojného bodu v kontajneri LXC",
+    "mkdirBody": "V kontajneri LXC vytvorte adresár, v ktorom sa disk sprístupní; názov si môžete zvoliť.",
+    "mkdirCode": "mkdir /mnt/lxc_USB",
+    "wireHeading": "1.4 Nastavenie zariadenia v LXC",
+    "wireBody": "Na <strong>hostiteľovi Proxmox</strong> upravte konfiguráciu kontajnera. Nahraďte <code>'<'CTID'>'</code> jeho ID:",
+    "wireEditCode": "nano /etc/pve/lxc/CTID.conf",
+    "wireAddLine": "Pridať tento riadok:",
+    "wireConfigCode": "mp0: /dev/disk/by-id/usb-VENDOR_MODEL_SERIAL-part1,mp=/mnt/lxc_USB,backup=0",
+    "wireShortForm": "Môžete použiť aj kratší záznam <code>mp0: /dev/sdb1,mp=/mnt/lxc_USB,backup=0</code>, ak prijmete riziko zmeny cesty zariadenia.",
+    "wireBackupNote": "Príklad používa <code>backup=0</code>. Obsah pripojených zariadení a bind mountov sa nezahŕňa do záloh kontajnera cez <code>vzdump</code>. Údaje na externom disku zálohujte samostatne.",
+    "restartHeading": "1.5 Reštart LXC a nastaviť práva",
+    "restartBody": "Reštartovanie CT na použitie bodu pripojenia:",
+    "restartCode": "pct reboot CTID",
+    "permsBody": "V kontajneri LXC najprv vytvorte účet pre zdieľanie, potom mu priraďte vlastníctvo a nastavte oprávnenia adresára:",
+    "permsCode": "adduser --system --group --no-create-home --shell /usr/sbin/nologin proxmenux\nmkdir -p /mnt/lxc_USB\nchown -R proxmenux:proxmenux /mnt/lxc_USB\nchmod 770 /mnt/lxc_USB",
+    "permsNoteTitle": "Poznámka",
+    "permsNote": "Nahraďte <code>proxmenux</code> zvoleným názvom účtu. Režim <code>770</code> povoľuje prístup vlastníkovi a skupine a ostatným ho odopiera; je prísnejší než <code>chmod -R 777</code>. Účet sa vytvorí tu a v kroku 2.2 sa zaregistruje v Sambe."
+  },
+  "samba": {
+    "heading": "2. Inštalovať Sambu",
+    "installHeading": "2.1 Nainštalujte balík vo vnútri LXC",
+    "installCode": "apt-get update\napt-get install -y samba",
+    "confirmBody": "Potvrďte, že služba beží:",
+    "confirmCode": "systemctl status smbd.service",
+    "userHeading": "2.2 Overenie účtu pre zdieľanie",
+    "userBody": "Systémový účet <code>proxmenux</code> bol vytvorený bez prihlasovacieho shellu v kroku 1.5. Pred nastavením hesla Samba ho skontrolujte a všade používajte zvolený názov:",
+    "userCode": "id proxmenux",
+    "passwordBody": "Nastavte heslo Samba, ktoré je oddelené od systémového hesla: Samba má vlastné úložisko prihlasovacích údajov.",
+    "passwordCode": "smbpasswd -a proxmenux",
+    "aclHeading": "2.3 Nastavenie vlastníctva a ACL",
+    "aclBody": "Ak stačí <code>chown</code> z kroku 1.5, oprávnenia sú nastavené. Pre viacerých používateľov s rôznymi právami k tej istej ceste použite ACL:",
+    "aclCode": "apt-get install -y acl\nsetfacl -R -m \"u:proxmenux:rwx\" /mnt/lxc_USB\nsetfacl -d -R -m \"u:proxmenux:rwx\" /mnt/lxc_USB    # default ACL — applies to new files"
+  },
+  "configure": {
+    "heading": "3. Konfigurácia zdieľania Samba",
+    "editHeading": "3.1 Úprava smb.conf",
+    "editCode": "nano /etc/samba/smb.conf",
+    "appendBody": "Na koniec súboru pridajte definíciu zdieľania:",
+    "shareCode": "[lxc_usb]\n    comment = Shared USB storage\n    path = /mnt/lxc_USB\n    read only = no\n    writable = yes\n    browseable = yes\n    guest ok = no\n    valid users = proxmenux\n    create mask = 0660\n    directory mask = 0770",
+    "validUsersNoteTitle": "Poznámka",
+    "validUsersNote": "Linka <code>valid users = proxmenux</code> obmedzuje prístup k tomu jedinému používateľovi Samby. Pre skupinový prístup použite <code>valid users = @samba_users</code> po pridaní užívateľa (-ov) do skupiny s názvom <code>samba_users</code>.",
+    "reloadHeading": "3.2 Znova načítať Sambu",
+    "reloadCode": "systemctl restart smbd"
+  },
+  "verify": {
+    "heading": "4. Overiť prístup",
+    "body": "Z ľubovoľného klienta LAN prejdite na <code>\\\\'<'CT_IP'>'</code> (Windows) alebo <code>smb://'<'CT_IP'>'</code> (macOS / Linux správcovia súborov). Overte si to s používateľom Samby (<code>proxmenux</code>) a heslom, ktoré ste nastavili s <code>smbpasswd</code>.",
+    "image1Alt": "Prístup k serveru Samba od klienta",
+    "image2Alt": "Výzva na overenie Samba",
+    "usageBody": "Zdieľaný obsah môžete používať v kontajneri aj cez sieť:",
+    "image3Alt": "Používanie USB disku cez zdieľanie"
+  },
+  "troubleshoot": {
+    "heading": "Riešenie problémov",
+    "items": [
+      "<strong><code>pct reboot</code> hlási „device not found“:</strong> overte, či cesta v <code>mp0</code> existuje na hostiteľovi. Skontrolujte <code>ls -l /dev/disk/by-id/</code> a opravte cestu.",
+      "<strong>Kontajner sa spustí, ale <code>/mnt/lxc_USB</code> je prázdny:</strong> disk nemusí byť pripojený alebo je jeho súborový systém prázdny. Na hostiteľovi overte <code>pct exec '<'CTID'>' -- mount | grep lxc_USB</code>. Ak pripojenie chýba, skontrolujte konfiguráciu, cestu zariadenia a chyby pri štarte.",
+      "<strong>Overenie Samba prejde, ale zápis hlási „Permission denied“:</strong> overte oprávnenia adresára v Linuxe a nastavenie zápisu zdieľania. Pozrite <code>chown</code> a <code>setfacl</code> v častiach 1.5 a 2.3.",
+      "<strong>Zdieľanie sa nezobrazuje, ale <code>smb://'<'ip'>'/lxc_usb</code> funguje:</strong> staršie vyhľadávanie NetBIOS používa <code>nmbd</code>. Moderný Windows používa WS-Discovery; na Debiane 12 nainštalujte <code>apt-get install -y wsdd</code>; na Debiane 13, kde <code>wsdd</code> nie je v stabilnom archíve, použite <code>apt-get install -y wsdd2</code>. Skontrolujte službu aj firewall. Samotné zapnutie <code>nmbd</code> neposkytuje WS-Discovery.",
+      "<strong>Pridanie ďalšieho používateľa k zdieľaniu:</strong> vytvorte účet cez <code>adduser</code>, zaregistrujte ho cez <code>smbpasswd -a</code> a pridajte ho do zoznamu <code>valid users =</code> oddeleného čiarkami. Prideľte mu aj potrebné oprávnenia alebo ACL v súborovom systéme."
+    ]
+  }
+}
diff --git a/web/messages/sk/guides/nvidia-manual.json b/web/messages/sk/guides/nvidia-manual.json
new file mode 100644
index 00000000..b826cabc
--- /dev/null
+++ b/web/messages/sk/guides/nvidia-manual.json
@@ -0,0 +1,165 @@
+{
+  "meta": {
+    "title": "Inštalácia ovládačov NVIDIA v Proxmox VE 9 — ručný postup | Príručky ProxMenux",
+    "description": "Manuálna inštalácia a konfigurácia ovládačov NVIDIA na hostiteľovi Proxmox VE 9 a sprístupnenie GPU jednému alebo viacerým kontajnerom LXC. Zahŕňa ovládače, službu perzistencie, voliteľnú úpravu NVENC a konfiguráciu jednotlivých kontajnerov.",
+    "ogTitle": "Inštalácia ovládačov NVIDIA na Proxmox VE 9 (manuálny postup)",
+    "ogDescription": "Manuálna inštalácia NVIDIA na PVE 9: ovládač hostiteľa, služba perzistencie, voliteľná úprava NVENC a prístup ku GPU v jednotlivých kontajneroch LXC."
+  },
+  "header": {
+    "title": "Inštalácia NVIDIA ovládačov grafickej karty na Proxmox VE 9 (manuálny postup)",
+    "description": "Manuálna inštalácia a konfigurácia ovládačov NVIDIA na hostiteľovi Proxmox VE 9 a sprístupnenie GPU jednému alebo viacerým kontajnerom LXC. Zahŕňa ovládače, službu perzistencie, voliteľnú úpravu NVENC a konfiguráciu jednotlivých kontajnerov.",
+    "section": "Návody"
+  },
+  "intro": {
+    "calloutTitle": "Poznámka",
+    "calloutBody": "Tento manuálny postup slúži ako referencia. Väčšine používateľov odporúčame sprievodcu ProxMenuxu: <strong>Inštalovať ovládače NVIDIA na hostiteľovi</strong> v ponuke <em>GPU a Coral-TPU</em> a potom <strong>Pridať GPU do LXC</strong> alebo <strong>Pridať GPU do VM</strong> pre nastavenie hosťa. Sprievodca vykonáva rovnaké kroky s ďalšími kontrolami hlavičiek jadra, IOMMU a konfliktov VFIO. Táto stránka pomôže pochopiť jednotlivé príkazy alebo prispôsobiť konfiguráciu.",
+    "targetNote": "Návod je určený pre <strong>Proxmox VE 9</strong> (Debian Trixie). PVE 7 (Bullseye) a PVE 8 (Bookworm) už nie sú zahrnuté.",
+    "stepsTitle": "Čo budete robiť",
+    "steps": [
+      "Pripraviť hostiteľa Proxmox VE 9: zablokovať nouveau a overiť repozitáre aj požiadavky.",
+      "Nainštalujte ovládač NVIDIA na hostiteľa.",
+      "Nainštalovať službu perzistencie NVIDIA.",
+      "Voliteľne použiť úpravu keylase na odstránenie limitu súbežných relácií NVENC na spotrebiteľských GPU.",
+      "Sprístupniť GPU jednému alebo viacerým kontajnerom LXC a v každom nainštalovať zodpovedajúcu verziu ovládača."
+    ]
+  },
+  "prepareHost": {
+    "heading": "1. Pripravte hostiteľa (PVE 9)",
+    "blacklistHeading": "1.1 Zablokovať nouveau",
+    "blacklistBody": "Skontrolujte, či ovládač Open-source <code>nouveau</code> je už na čiernom zozname:",
+    "blacklistCheckCode": "cat /etc/modprobe.d/blacklist.conf",
+    "blacklistAdd": "Ak sa neobjaví <code>blacklist nouveau</code>, pridajte ho a reštartujte:",
+    "blacklistAddCode": "echo \"blacklist nouveau\" >> /etc/modprobe.d/blacklist.conf\nupdate-initramfs -u -k all\nreboot",
+    "blacklistImageAlt": "Kontrola čiernej listiny",
+    "reposHeading": "1.2 Overenie repozitárov (PVE 9 / Trixie)",
+    "reposBody": "Nástroje po inštalácii už mohli nastaviť repozitáre. Najprv skontrolujte existujúce zdroje a vynechajte hotové zmeny; nevytvárajte duplicitné záznamy.",
+    "reposOtherwise": "Inak pri základnej inštalácii PVE 9 bez predplatného Enterprise:",
+    "reposEditCode": "nano /etc/apt/sources.list.d/proxmox.sources",
+    "reposPveBody": "Overte, že obsahuje zdroj no-subscription pre Trixie:",
+    "reposPveCode": "Types: deb\nURIs: http://download.proxmox.com/debian/pve\nSuites: trixie\nComponents: pve-no-subscription\nSigned-By: /usr/share/keyrings/proxmox-archive-keyring.gpg",
+    "reposDebianBody": "A zdroje Debianu na <code>/etc/apt/sources.list.d/debian.sources</code>:",
+    "reposDebianCode": "Types: deb\nURIs: http://deb.debian.org/debian/\nSuites: trixie trixie-updates\nComponents: main contrib non-free non-free-firmware\nSigned-By: /usr/share/keyrings/debian-archive-keyring.gpg\n\nTypes: deb\nURIs: http://security.debian.org/debian-security/\nSuites: trixie-security\nComponents: main contrib non-free non-free-firmware\nSigned-By: /usr/share/keyrings/debian-archive-keyring.gpg",
+    "updateHeading": "1.3 Aktualizovať systém a inštalovať predpoklady",
+    "updateCode": "apt update && apt dist-upgrade -y",
+    "buildToolsBody": "Nainštalujte nástroje a hlavičky jadra potrebné na zostavenie modulu jadra NVIDIA:",
+    "buildToolsCode": "apt-get install -y git\napt-get install -qqy pve-headers-$(uname -r) gcc make"
+  },
+  "installDriver": {
+    "heading": "2. Nainštalujte ovládač NVIDIA na hostiteľa",
+    "pickHeading": "2.1 Vyberte si verziu ovládača",
+    "pickBody": "Vyberte vetvu ovládača podporujúcu GPU a bežiace jadro. Najnovšia vetva nemusí podporovať staršie GPU; overte zoznam podporovaných produktov pre vybrané vydanie NVIDIA:",
+    "pickUrlCode": "https://download.nvidia.com/XFree86/Linux-x86_64/latest.txt",
+    "nvencCallout": "Ak chcete použiť úpravu NVENC v kroku 4, najprv overte podporu zvolenej verzie ovládača: <patchLink>github.com/keylase/nvidia-patch</patchLink>",
+    "nvencCalloutTitle": "Upozornenie",
+    "pickReplace": "Nahraďte <code>latest.txt</code> v URL číslom verzie a vyhľadajte inštalátor s príponou <code>.run</code>. Úplný zoznam ovládačov:",
+    "pickListCode": "https://download.nvidia.com/XFree86/Linux-x86_64/",
+    "pickImageAlt": "Sťahovanie ovládača NVIDIA",
+    "pickVersionNote": "V priebehu zvyšku tejto príručky, nahradiť <code>'<'VERSION'>'</code> s aktuálnou verziou (napríklad <code>580.95.05</code>).",
+    "downloadHeading": "2.2 Stiahnite si a spustite inštalátor",
+    "downloadCode": "mkdir -p /opt/nvidia\ncd /opt/nvidia\nwget https://download.nvidia.com/XFree86/Linux-x86_64/VERSION/NVIDIA-Linux-x86_64-VERSION.run\nchmod +x NVIDIA-Linux-x86_64-VERSION.run",
+    "firstPassBody": "Spustite inštalátor. Nasledujúca voľba môže podľa potreby vypnúť <code>nouveau</code>; pred dokončením môže byť nutný reštart:",
+    "firstPassCode": "./NVIDIA-Linux-x86_64-VERSION.run --no-questions --ui=none --disable-nouveau\nreboot",
+    "secondPassBody": "Po návrate hostiteľa znovu spustite inštalátor a nainštalujte modul jadra:",
+    "secondPassCode": "/opt/nvidia/NVIDIA-Linux-x86_64-VERSION.run --no-questions --ui=none",
+    "modulesHeading": "2.3 Načítanie modulov NVIDIA pri štarte",
+    "modulesBody": "Upravte konfiguráciu načítavania modulov:",
+    "modulesEditCode": "nano /etc/modules-load.d/modules.conf",
+    "modulesAddBody": "Pridajte moduly NVIDIA pre hostiteľa a LXC. Moduly VFIO slúžia na priame priradenie do VM a v tomto postupe nie sú potrebné:",
+    "modulesAddCode": "nvidia\nnvidia_uvm",
+    "modulesSaveBody": "Uložiť (<code>Ctrl+X</code>) a prestavať initramfs:",
+    "modulesSaveCode": "update-initramfs -u -k all",
+    "udevHeading": "2.4 Vytvoriť pravidlá udev",
+    "udevBody": "Aby sa pri načítaní modulov vytvorili uzly zariadení <code>/dev/nvidia*</code>:",
+    "udevEditCode": "nano /etc/udev/rules.d/70-nvidia.rules",
+    "udevRulesCode": "# /etc/udev/rules.d/70-nvidia.rules\nKERNEL==\"nvidia\", RUN+=\"/bin/bash -c '/usr/bin/nvidia-smi -L'\"\nKERNEL==\"nvidia_uvm\", RUN+=\"/bin/bash -c '/usr/bin/nvidia-modprobe -c0 -u'\"",
+    "udevSaveBody": "Uložiť (<code>Ctrl+X</code>)."
+  },
+  "persistence": {
+    "heading": "3. Služba perzistencie NVIDIA",
+    "body": "Služba perzistencie udržiava GPU inicializovaný, keď ho nepoužíva iná aplikácia. Znižuje latenciu opakovanej inicializácie a zachováva inicializačný stav medzi klientmi:",
+    "installCode": "cd /opt/nvidia\ngit clone https://github.com/NVIDIA/nvidia-persistenced.git\ncd nvidia-persistenced/init\n./install.sh\nreboot",
+    "verifyBody": "Po reštarte overte, že ovládač je načítaný a služba beží:",
+    "verifySmiCode": "nvidia-smi",
+    "smiImageAlt": "NVIDIA SMI výstup",
+    "verifyServiceCode": "systemctl status nvidia-persistenced",
+    "serviceImageAlt": "Stav služby perzistencie NVIDIA"
+  },
+  "nvenc": {
+    "heading": "4. Voliteľné odstránenie limitu súbežných relácií NVENC",
+    "body": "Limit relácií NVENC závisí od modelu GPU a verzie ovládača. Overte maticu NVIDIA, nepredpokladajte pevnú hodnotu podľa generácie. Úprava keylase odstraňuje softvérový limit pri podporovaných ovládačoch a môže pomôcť pri transkódovaní Plex či Jellyfin.",
+    "code": "cd /opt/nvidia\ngit clone https://github.com/keylase/nvidia-patch.git\ncd nvidia-patch\n./patch.sh",
+    "imageAlt": "Použitie úpravy NVIDIA",
+    "after": "Po každej aktualizácii ovládača použite úpravu znova. Repozitár keylase obsahuje aj <code>patch-fbc.sh</code> pre FBC, zachytávanie obrazovej pamäte."
+  },
+  "lxcSetup": {
+    "heading": "5. Nastavenie prístupu ku GPU v kontajneri LXC",
+    "identifyHeading": "5.1 Identifikovať čísla zariadenia",
+    "identifyBody": "Na hostiteľovi:",
+    "identifyCode": "ls -l /dev/nv*",
+    "identifyImageAlt": "Zoznam zariadení NVIDIA",
+    "identifyNote": "Poznačte si hlavné čísla zariadení (major); môžu sa medzi systémami líšiť. Typické hodnoty:",
+    "tableHeaders": {
+      "device": "Zariadenie",
+      "major": "Typické hlavné číslo"
+    },
+    "tableRows": [
+      {
+        "device": "<code>/dev/nvidia0</code>, <code>/dev/nvidiactl</code>",
+        "major": "195"
+      },
+      {
+        "device": "<code>/dev/nvidia-uvm</code>, <code>/dev/nvidia-uvm-tools</code>",
+        "major": "509 (premenlivé)"
+      },
+      {
+        "device": "<code>/dev/dri/*</code>",
+        "major": "226"
+      },
+      {
+        "device": "<code>/dev/nvidia-modeset</code>",
+        "major": "195 (zdieľané s nvidia)"
+      }
+    ],
+    "editHeading": "5.2 Úprava konfigurácie LXC",
+    "editBody": "Ak kontajner beží, zastavte ho. Otvorte konfiguráciu a nahraďte <code>'<'CTID'>'</code> jeho ID:",
+    "editCode": "nano /etc/pve/lxc/CTID.conf",
+    "editConfigBody": "Zakomentujte iba skutočne konfliktné riadky <code>lxc.cgroup2.devices.allow</code> alebo <code>/dev/dri</code>. Pridajte konfiguráciu NVIDIA a upravte hlavné čísla podľa zariadení NVIDIA, ktoré ukazuje <code>ls -l /dev/nv*</code> na <strong>vašom</strong> hostiteľovi:",
+    "editConfigCode": "lxc.cgroup2.devices.allow: c 195:* rwm\nlxc.cgroup2.devices.allow: c 509:* rwm\nlxc.mount.entry: /dev/nvidia0 dev/nvidia0 none bind,optional,create=file\nlxc.mount.entry: /dev/nvidiactl dev/nvidiactl none bind,optional,create=file\nlxc.mount.entry: /dev/nvidia-uvm dev/nvidia-uvm none bind,optional,create=file\nlxc.mount.entry: /dev/nvidia-modeset dev/nvidia-modeset none bind,optional,create=file\nlxc.mount.entry: /dev/nvidia-uvm-tools dev/nvidia-uvm-tools none bind,optional,create=file",
+    "editConfigImageAlt": "Konfigurácia LXC",
+    "editSave": "Uložiť (<code>Ctrl+X</code>) a spustiť kontajner.",
+    "installCtHeading": "5.3 Nainštalujte ovládač vo vnútri kontajnera",
+    "installCtCalloutTitle": "Dôležité",
+    "installCtCalloutBody": "Táto časť sa vykonáva <strong>v kontajneri</strong>, nie na hostiteľovi.",
+    "installCtBody": "Modul jadra je už načítaný na hostiteľovi. Kontajner potrebuje iba knižnice používateľského priestoru s rovnakou verziou ovládača:",
+    "installCtCode": "mkdir -p /opt/nvidia\ncd /opt/nvidia\nwget https://download.nvidia.com/XFree86/Linux-x86_64/VERSION/NVIDIA-Linux-x86_64-VERSION.run\nchmod +x NVIDIA-Linux-x86_64-VERSION.run\n./NVIDIA-Linux-x86_64-VERSION.run --no-kernel-module",
+    "installCtAfter": "Skontrolujte otázky a inštalujte iba knižnice používateľského priestoru. V LXC nekompilujte ani neinštalujte modul jadra.",
+    "installCtImageAlt": "Inštalácia ovládača NVIDIA",
+    "verifyCtHeading": "5.4 Overenie vo vnútri kontajnera",
+    "verifyCtSmiCode": "nvidia-smi",
+    "verifyCtSmiImageAlt": "NVIDIA SMI v LXC",
+    "verifyCtLsCode": "ls -l /dev/nv*",
+    "verifyCtLsImageAlt": "Zariadenia NVIDIA v LXC",
+    "verifyCtAfter": "GPU by sa mal zobraziť v zozname a uzly zariadení v súborovom systéme kontajnera.",
+    "workloadHeading": "5.5 Overenie využitia GPU pri skutočnej záťaži",
+    "workloadBody": "Zapnite hardvérovú akceleráciu NVIDIA v Plexe alebo Jellyfine, spustite transkódovanie a overte skutočné využitie GPU v paneli či protokoloch. Samotná inštalácia ovládača akceleráciu v aplikácii nezapne.",
+    "workloadImage1Alt": "Plex používajúci NVIDIA GPU",
+    "workloadImage2Alt": "Plex využívajúci GPU NVIDIA — aktívna relácia",
+    "repeatNote": "Zopakujte <strong>časť 5</strong> pre každý ďalší kontajner vyžadujúci GPU. Pri aktualizácii ovládača hostiteľa udržujte zodpovedajúcu verziu knižníc používateľského priestoru vo všetkých kontajneroch."
+  },
+  "docker": {
+    "heading": "6 (nepovinné) NVIDIA Docker vnútri LXC",
+    "body": "Ak Docker už beží v LXC, nainštalujte v ňom <code>nvidia-container-toolkit</code> na sprístupnenie GPU kontajnerom Docker. Prístup ku GPU zo samotného LXC musí už fungovať. Nasledujúce príkazy sú pre Docker spustený ako root:",
+    "code": "apt-get update\napt-get install -y ca-certificates curl gnupg\ncurl -fsSL https://nvidia.github.io/libnvidia-container/gpgkey | gpg --dearmor --yes -o /usr/share/keyrings/nvidia-container-toolkit-keyring.gpg\ncurl -fsSL https://nvidia.github.io/libnvidia-container/stable/deb/nvidia-container-toolkit.list | sed 's#deb https://#deb [signed-by=/usr/share/keyrings/nvidia-container-toolkit-keyring.gpg] https://#g' > /etc/apt/sources.list.d/nvidia-container-toolkit.list\napt-get update\napt-get install -y nvidia-container-toolkit\nnvidia-ctk runtime configure --runtime=docker\nsystemctl restart docker",
+    "after": "Príkazy nastavia repozitár NVIDIA, nainštalujú toolkit, nastavia runtime Docker a reštartujú Docker. Oprávnenia zariadení a obmedzenia cgroup v LXC naďalej platia; overte GPU pomocou testovacej záťaže."
+  },
+  "troubleshoot": {
+    "heading": "Riešenie problémov",
+    "items": [
+      "<strong><code>nvidia-smi</code> funguje na hostiteľovi, ale v kontajneri hlási „No devices found“:</strong> overte pripojenia zariadení, oprávnenia a verzie knižníc. Ak sa líšia, nainštalujte v kontajneri rovnakú <code>'<'VERSION'>'</code> ako na hostiteľovi s <code>--no-kernel-module</code>.",
+      "<strong>Kompilácia ovládača zlyhá:</strong> pozrite protokol zostavenia. „No precompiled kernel interface was found“ môže len oznamovať potrebu lokálnej kompilácie. Nainštalujte hlavičky pre <code>uname -r</code> cez <code>apt-get install pve-headers-$(uname -r)</code> alebo zodpovedajúci balík proxmox-headers.",
+      "<strong>Relácie NVENC zostávajú obmedzené:</strong> overte podporu aktívneho ovládača úpravou. Aktualizácia ju môže prepísať. Pri podporovanej verzii znova spustite <code>./patch.sh</code> z <code>/opt/nvidia/nvidia-patch</code> a skontrolujte výstup.",
+      "<strong>GPU po nečinnosti prestane reagovať:</strong> overte <code>systemctl status nvidia-persistenced</code> a podľa potreby zapnite službu. Skontrolujte aj protokoly jadra a ovládača; zastavená služba nie je jediná možná príčina.",
+      "<strong>Kontajner sa spustí, ale <code>ls /dev/nv*</code> neukazuje zariadenia NVIDIA:</strong> overte bind mounty a cesty na hostiteľovi. Cez <code>ls -l /dev/nv*</code> overte hlavné čísla NVIDIA, potom pravidlá <code>lxc.cgroup2.devices.allow</code> aj oprávnenia."
+    ]
+  }
+}
diff --git a/web/messages/sv/common.json b/web/messages/sv/common.json
new file mode 100644
index 00000000..658933e3
--- /dev/null
+++ b/web/messages/sv/common.json
@@ -0,0 +1,254 @@
+{
+  "site": {
+    "name": "ProxMenux",
+    "tagline": "Interaktiv meny och webbaserad instrumentpanel för Proxmox VE"
+  },
+  "nav": {
+    "home": "Start",
+    "docs": "Dokumentation",
+    "documentation": "Dokumentation",
+    "guides": "Guider",
+    "changelog": "Ändringslogg",
+    "github": "GitHub",
+    "rss": "RSS",
+    "rssTitle": "RSS-flöde",
+    "menuOpen": "Öppna meny"
+  },
+  "footer": {
+    "sponsorHeading": "Stöd projektet",
+    "sponsorBody": "Om du vill stödja projektet.",
+    "sponsorAlt": "Stöd mig på Ko-fi",
+    "connectHeading": "Gemenskap",
+    "connectBody": "Delta i diskussionerna på GitHub för att få hjälp, dela idéer och bidra till projektet. Alla idéer är välkomna!",
+    "joinDiscussion": "Delta i diskussionen",
+    "copyrightPrefix": "ProxMenux, ett samarbetsprojekt med öppen källkod av",
+    "copyrightSuffix": "."
+  },
+  "language": {
+    "switcher": "Språk",
+    "en": "English",
+    "es": "Español",
+    "sk": "Slovenčina",
+    "de": "Deutsch",
+    "fr": "Français",
+    "it": "Italiano",
+    "pt": "Português",
+    "sv": "Svenska"
+  },
+  "resources": {
+    "documentation": {
+      "title": "Dokumentation",
+      "description": "Systembeskrivning och användarguider"
+    },
+    "changelog": {
+      "title": "Ändringslogg",
+      "description": "Information om de senaste uppdateringarna"
+    },
+    "guides": {
+      "title": "Guider",
+      "description": "Stegvisa instruktioner och guider för vanliga uppgifter"
+    },
+    "github": {
+      "title": "GitHub-arkiv",
+      "description": "Utforska källkoden."
+    }
+  },
+  "docSidebar": {
+    "documentation": "Dokumentation",
+    "items": {
+      "introduction": "Introduktion",
+      "installation": "Installation",
+      "proxmenuxMonitor": "ProxMenux Monitor",
+      "monitorOverview": "Översikt",
+      "architecture": "Arkitektur",
+      "accessAuth": "Åtkomst och autentisering",
+      "dashboard": "Instrumentpanel",
+      "dashboardSystemOverview": "Fliken Systemöversikt",
+      "dashboardApps": "Fliken Program",
+      "dashboardStorage": "Fliken Lagring",
+      "dashboardNetwork": "Fliken Nätverk",
+      "dashboardVmsLxcs": "Fliken VM och LXC",
+      "dashboardVmsLxcsApp": "Program",
+      "dashboardVmsLxcsUpdates": "Uppdateringar",
+      "dashboardHardware": "Fliken Maskinvara",
+      "dashboardSystemLogs": "Fliken Systemloggar",
+      "dashboardTerminal": "Fliken Terminal",
+      "dashboardSecurity": "Fliken Säkerhet",
+      "dashboardSettings": "Fliken Inställningar",
+      "healthMonitor": "Systemövervakning",
+      "auditReport": "Granskning och rapporter",
+      "auditReportOverview": "Översikt",
+      "auditReportAssessment": "Bedömning och inventering",
+      "auditReportPolicy": "Policy",
+      "auditReportChanges": "Ändringar",
+      "auditReportReports": "Rapporter och jämförelser",
+      "auditReportScope": "Omfattning och garantier",
+      "notifications": "Aviseringar",
+      "aiAssistant": "AI-assistent",
+      "apiReference": "API-referens",
+      "integrations": "Integrationer",
+      "ociManager": "OCI manager Apps",
+      "ociOverview": "Översikt",
+      "ociArchitecture": "Så anpassas en OCI-avbildning",
+      "ociCustomImage": "Avbildning utanför katalogen",
+      "ociStorageNetwork": "Data, sökvägar och nätverk",
+      "ociHardware": "Enheter och acceleration",
+      "ociStacks": "Program med flera containrar",
+      "ociLifecycle": "Installera, uppdatera och ändra",
+      "ociMonitor": "I ProxMenux Monitor",
+      "proxmenuxScripts": "ProxMenux Scripts",
+      "postInstallScript": "Skript efter installationen",
+      "postInstallOverview": "Översikt",
+      "postInstallAutomated": "Automatiskt",
+      "postInstallCustomizable": "Anpassningsbart",
+      "postInstallBasicSettings": "Grundinställningar",
+      "postInstallSystem": "System",
+      "postInstallVirtualization": "Virtualisering",
+      "postInstallNetwork": "Nätverk",
+      "postInstallStorage": "Lagring",
+      "postInstallSecurity": "Säkerhet",
+      "postInstallCustomization": "Anpassning",
+      "postInstallMonitoring": "Övervakning",
+      "postInstallPerformance": "Prestanda",
+      "postInstallOptional": "Valfritt",
+      "postInstallUpdates": "Installera tillgängliga uppdateringar",
+      "postInstallUninstall": "Ta bort optimeringar",
+      "gpusCoralTpu": "GPU och Coral TPU",
+      "nvidiaHost": "Installera NVIDIA-drivrutiner på värden",
+      "coralHost": "Installera Coral TPU på värden",
+      "addGpuLxc": "Gör en GPU tillgänglig i en LXC",
+      "addCoralLxc": "Gör Coral TPU tillgänglig i en LXC",
+      "addGpuVm": "Tilldela en GPU till en VM (passthrough)",
+      "switchGpuMode": "Byt GPU-läge (VM ↔ LXC)",
+      "createVm": "Skapa en VM",
+      "createVmOverview": "Översikt",
+      "createVmSystemNas": "NAS-system",
+      "createVmSynology": "Synology-VM",
+      "createVmNasOthers": "Andra NAS-system",
+      "createVmSystemWindows": "Windows-system",
+      "createVmSystemLinux": "Linux-system",
+      "diskManager": "Diskhantering",
+      "diskManagerOverview": "Översikt",
+      "diskImportVm": "Importera en disk till en VM",
+      "diskImportImageVm": "Importera en diskavbildning till en VM",
+      "diskAddController": "Lägg till en styrenhet eller NVMe-enhet i en VM",
+      "diskImportLxc": "Importera en disk till en LXC",
+      "diskFormat": "Formatera eller radera en fysisk disk",
+      "diskSmart": "SMART-status och disktester",
+      "storageShareManager": "Hantering av lagring och delningar",
+      "storageShareOverview": "Översikt",
+      "hostStorage": "Anslut lagring till värden",
+      "hostNfs": "Lägg till en NFS-delning som Proxmox-lagring",
+      "hostSamba": "Lägg till en Samba-delning som Proxmox-lagring",
+      "hostIscsi": "Lägg till ett iSCSI-mål som Proxmox-lagring",
+      "hostLocalDisk": "Lägg till en lokal disk som Proxmox-lagring",
+      "hostLocalShared": "Skapa en delad katalog på värden",
+      "lxcMountPoints": "LXC-monteringspunkter (värd ↔ CT)",
+      "lxcNetworkSharing": "Nätverksdelning i LXC",
+      "lxcNfsClient": "NFS-klient i LXC",
+      "lxcSambaClient": "Samba-klient i LXC",
+      "lxcNfsServer": "NFS-server i LXC",
+      "lxcSambaServer": "Samba-server i LXC",
+      "network": "Nätverk",
+      "networkOverview": "Översikt",
+      "networkDiagnostics": "Diagnostik",
+      "networkMonitoring": "Verktyg för övervakning i realtid",
+      "networkBridge": "Analysera och reparera nätverksbryggor",
+      "networkConfig": "Analysera och rensa konfigurationen",
+      "networkPersistent": "Beständiga gränssnittsnamn",
+      "networkBackup": "Säkerhetskopiera och starta om gränssnitt",
+      "security": "Säkerhet",
+      "securityOverview": "Översikt",
+      "securityFail2ban": "Fail2Ban",
+      "securityLynis": "Lynis",
+      "utilities": "Verktyg",
+      "utilsOverview": "Översikt",
+      "utilsUupDump": "Skapa ISO med UUP Dump",
+      "utilsSystemUtils": "Installera systemverktyg",
+      "utilsSystemUpdate": "Uppdatera Proxmox-systemet",
+      "utilsUpgradePve": "Uppgradera från PVE 8 till PVE 9",
+      "utilsExportVm": "Exportera en VM till OVA/OVF",
+      "utilsImportVm": "Importera en VM från OVA/OVF",
+      "settingsProxmenux": "ProxMenux-inställningar",
+      "settingsOverview": "Översikt",
+      "settingsMonitor": "ProxMenux Monitor",
+      "settingsBeta": "Byt versionskanal",
+      "settingsVersion": "Visa versionsinformation",
+      "settingsUninstall": "Avinstallera ProxMenux",
+      "commandsReference": "Kommandoreferens",
+      "commandsOverview": "Översikt",
+      "commandsSystem": "Användbara systemkommandon",
+      "commandsVmCt": "Hantera VM och CT",
+      "commandsStorage": "Lagring och diskar",
+      "commandsNetwork": "Nätverkskommandon",
+      "commandsUpdates": "Uppdateringar och paket",
+      "commandsGpu": "GPU-passthrough",
+      "commandsZfs": "Hantera ZFS",
+      "commandsBackup": "Säkerhetskopiering och återställning",
+      "commandsTools": "Systemverktyg för kommandoraden",
+      "glossary": "Ordlista",
+      "about": "Om projektet",
+      "aboutOverview": "Översikt",
+      "aboutFaq": "FAQ",
+      "aboutContributors": "Medverkande",
+      "aboutContributing": "Bidra",
+      "aboutCodeOfConduct": "Uppförandekod",
+      "externalRepositories": "Externa arkiv",
+      "backupRestore": "Säkerhetskopiering och återställning",
+      "backupRestoreOverview": "Översikt",
+      "backupRestoreHowItWorks": "Så fungerar det",
+      "backupRestoreDestinations": "Mål",
+      "backupRestoreDestOverview": "Översikt",
+      "backupRestoreDestLocal": "Lokalt arkiv",
+      "backupRestoreDestPbs": "Proxmox Backup Server",
+      "backupRestoreDestBorg": "Borg",
+      "backupRestoreCreating": "Skapa säkerhetskopior",
+      "backupRestoreJobs": "Schemalagda jobb",
+      "backupRestoreRestoring": "Återställning",
+      "backupRestoreCrossKernel": "Återställning mellan kärnversioner",
+      "backupRestoreGlossary": "Ordlista"
+    }
+  },
+  "hero": {
+    "title": "ProxMenux",
+    "tagline": "En interaktiv meny och webbaserad instrumentpanel för Proxmox VE",
+    "description": "ProxMenux kombinerar en interaktiv meny med en webbaserad instrumentpanel för Proxmox VE. Kör kommandon, skript och guidade steg från terminalmenyn, eller följ värdens status, mätvärden och aviseringar i webbläsaren.",
+    "installButton": "Installera nu",
+    "whatIsButton": "Vad är ProxMenux?",
+    "logoAlt": "ProxMenux-logotyp"
+  },
+  "docNav": {
+    "previous": "Föregående",
+    "next": "Nästa"
+  },
+  "tocPanel": {
+    "onThisPage": "På den här sidan"
+  },
+  "supportProject": {
+    "heading": "Stöd projektet!",
+    "body": "Om du har nytta av <strong>ProxMenux</strong> kan du ge projektet en ⭐ på GitHub så att fler upptäcker det.",
+    "button": "Ge en stjärna på GitHub"
+  },
+  "rssLink": {
+    "heading": "Följ uppdateringarna!",
+    "body": "Prenumerera på vårt RSS-flöde för att få information om nyheter.",
+    "copy": "Kopiera",
+    "copied": "Kopierat!",
+    "copyTitle": "Kopiera RSS-adressen",
+    "openFeed": "Öppna RSS-flödet",
+    "openTitle": "Öppna RSS-flödet"
+  },
+  "changelog": {
+    "pageTitle": "Ändringslogg",
+    "meta": {
+      "title": "Ändringslogg för ProxMenux",
+      "titleSuffix": "Versionsinformation",
+      "latest": "Senaste",
+      "mostRecent": "Senaste versionen",
+      "description": "Versionsinformation och uppdateringshistorik för ProxMenux, det menystyrda skriptet för administration av Proxmox VE.",
+      "descriptionTail": "Nya funktioner, felrättningar, säkerhetsuppdateringar, förbättringar i ProxMenux Monitor, stöd för AI-leverantörer, säkrare GPU-passthrough och mer.",
+      "ogDescription": "Versionsinformation för ProxMenux.",
+      "ogTail": "Prenumerera via RSS eller besök sidan igen för att se nya versioner."
+    }
+  }
+}
diff --git a/web/messages/sv/docs/about/code-of-conduct.json b/web/messages/sv/docs/about/code-of-conduct.json
new file mode 100644
index 00000000..7cddd218
--- /dev/null
+++ b/web/messages/sv/docs/about/code-of-conduct.json
@@ -0,0 +1,13 @@
+{
+  "meta": {
+    "title": "Uppförandekod | ProxMenux-dokumentation",
+    "description": "ProxMenux uppförandekod och rekommenderade arbetssätt för bidragsgivare, testare och användare.",
+    "ogTitle": "Uppförandekod | ProxMenux-dokumentation",
+    "ogDescription": "Förväntningar på ansvar för koden, rapportering av säkerhetsbrister och omfattningen av PR:ar i ProxMenux-projektet."
+  },
+  "errors": {
+    "notFound": "Fel: CODE_OF_CONDUCT.md-filen hittades inte.",
+    "loadFailed": "Fel: Det går inte att läsa in uppförandekodens innehåll."
+  },
+  "contentMarkdown": "# 📝 Uppförandekod och rekommendationer\n\nDetta dokument fastställer **principer och riktlinjer** för användningen av **ProxMenux**, för att främja **respekt, samarbete och säkerhet** i utvecklingen.\n\n## 📌 1. Källangivelser och erkännande\n\n- Om **skript, kodavsnitt eller idéer** från andra kodarkiv eller utvecklare används ska den ursprungliga upphovspersonen alltid anges.\n- En kommentar i koden eller dokumentationen ska ange källan och om möjligt länka till det ursprungliga kodarkivet.\n- Vid användning av kod med en viss **licens** måste dess villkor följas.\n\n### ✅ Exempel på korrekt källangivelse i koden:\n\n```bash\n# Skript baserat på arbetet av [Upphovsperson] i [Länk till kodarkiv]\n```\n\n## 🔒 2. Säkerhet och ansvar för koden\n\n- All kod i detta arkiv följer rekommenderade arbetssätt för säker utveckling.\n- Bidrag som avsiktligt inför sårbarheter eller osäkra arbetssätt tillåts inte.\n- Skript får aldrig äventyra systemsäkerheten eller användarnas data.\n- Bidrag bör granskas med avseende på säkerhet och stabilitet före införandet.\n\n### ⚠️ Ansvarsfull rapportering av sårbarheter\n\nOm du upptäcker en säkerhetssårbarhet ska du INTE rapportera den i offentliga ärenden eller forum.\n\nRapportera den i stället privat via e-post:\n\n📧 proxmenux@macrimi.pro\n\nLäs vår [säkerhetspolicy](./SECURITY.md) för mer information om sårbarheter och hur de rapporteras.\n\n## 🤝 3. Gemenskapens riktlinjer\n\nAlla användare måste följa dessa riktlinjer för att upprätthålla en respektfull och professionell miljö:\n\n- ✅ Var respektfull och konstruktiv i diskussioner.\n- ❌ Trakasserier, hatretorik och stötande beteende tolereras inte.\n- ✅ Ge återkoppling professionellt och undvik personangrepp.\n- ❌ Överträdelser kan leda till varningar eller avstängningar beroende på allvarlighetsgrad.\n\n##\n\nDetta dokument främjar etisk kodanvändning, säkerhetsmedvetenhet och en respektfull gemenskap.\n\n📢 Låt oss bygga något fantastiskt tillsammans!\n"
+}
diff --git a/web/messages/sv/docs/about/contributing.json b/web/messages/sv/docs/about/contributing.json
new file mode 100644
index 00000000..f951f4af
--- /dev/null
+++ b/web/messages/sv/docs/about/contributing.json
@@ -0,0 +1,293 @@
+{
+  "meta": {
+    "title": "Bidra till ProxMenux | ProxMenux Dokumentation",
+    "description": "Så bidrar du till ProxMenux: grenmodell (main / develop / feature/*), pull request-flöde, skripthuvud med författare och valfri stödlänk, gränssnitt i två faser, meddelandefunktioner och vägen till en stabil utgåva.",
+    "ogTitle": "Bidra till ProxMenux",
+    "ogDescription": "Grenmodell, arbetsflöde, författarangivelse i skripthuvudet och regler för gränssnitt i två faser som bidragsgivare ska följa."
+  },
+  "header": {
+    "title": "Bidra till ProxMenux",
+    "description": "ProxMenux välkomnar bidrag från gemenskapen: nya skript, rättningar, förbättrade dialogrutor, översättningar och integrationer. Sidan beskriver arkivets struktur, grenmodellen, pull request-flödet, skripthuvudet med författare och valfri stödlänk samt de designregler varje bidrag ska följa.",
+    "section": "Om"
+  },
+  "twoPagesCallout": {
+    "title": "Två relaterade sidor, ett projekt",
+    "body": "Förväxla inte sidan med <contributorsLink>Bidragsgivare</contributorsLink>, som uppmärksammar dem som redan bidrar: testare, granskare och utvecklare. Den här sidan är för <em>dig</em> som vill börja bidra och förklarar hur du förbereder en pull request för sammanslagning."
+  },
+  "branching": {
+    "heading": "Grenmodell",
+    "intro": "ProxMenux använder en grenmodell med tre nivåer:",
+    "headerBranch": "Gren",
+    "headerPurpose": "syfte",
+    "rows": [
+      {
+        "branch": "main",
+        "purposeRich": "Stabil kod som är klar för produktion. Bara ändringar som är klara för utgivning slås samman här. Det är den version slutanvändare får vid en vanlig installation av ProxMenux."
+      },
+      {
+        "branch": "develop",
+        "purposeRich": "Aktiv utvecklingsgren. Allt nytt arbete tas först in här; det är betakanalen. När en stabil utgåva är klar förs den härifrån till <code>main</code>."
+      },
+      {
+        "branch": "feature/*",
+        "purposeRich": "Kortlivade grenar per funktion, fix eller förbättring. Skapad från <code>develop</code>, fusioneras tillbaka till <code>develop</code> via en Pull begäran efter granskning."
+      }
+    ],
+    "calloutTitle": "Vad detta innebär för användare",
+    "calloutBody": "Slutanvändare som spårar <code>main</code> får testade releaser. Användare som vill ha de senaste funktionerna tidigt - och inte har något emot enstaka grova kanter - kan följa <code>develop</code>. Nya funktioner passerar alltid genom <code>develop</code> först; ingenting når <code>main</code> utan att gå igenom den cykeln."
+  },
+  "workflow": {
+    "heading": "Arbetsflöde för pull requests",
+    "intro": "Från idé till fusion i fem steg:",
+    "step1Lead": "<strong>Skapa en funktionsgren från <code>develop</code></strong>:",
+    "step1Code": "git clone https://github.com/MacRimi/ProxMenux.git\ncd ProxMenux\ngit checkout develop\ngit pull origin develop\ngit checkout -b feature/your-feature-name",
+    "step1Trail": "Använd ett beskrivande grennamn: <code>feature/zfs-arc-tuning</code>, <code>feature/fix-iommu-detection</code>, <code>feature/add-tailscale-script</code>.",
+    "step2Lead": "<strong>Arbeta med ändringarna och skicka upp grenen:</strong>",
+    "step2Code": "# Make your changes, then:\ngit add scripts/...\ngit commit -m \"Add ZFS ARC tuning script\"\ngit push -u origin feature/your-feature-name",
+    "step3": "<strong>Öppna en pull request mot <code>develop</code></strong>, inte mot <code>main</code>. Kontrollera på GitHub att basgrenen är <code>develop</code>. Beskriv vad skriptet gör och ändrar och vilka Proxmox VE-versioner det testats på.",
+    "step4": "<strong>Efter granskning slås ändringarna samman i <code>develop</code>.</strong> En underhållare granskar kodkvalitet, skripthuvud och gränssnittets två faser. Om ändringar begärs skickar du fler incheckningar till samma gren; PR:n uppdateras automatiskt.",
+    "step5": "<strong>Stabila utgåvor förs från <code>develop</code> till <code>main</code>.</strong> Vid utgivning flyttas <code>main</code> fram till <code>develop</code> med fast-forward och taggas. Ditt bidrag ingår i nästa stabila version."
+  },
+  "scriptHeader": {
+    "heading": "Skripthuvud: metadata och beskrivning",
+    "intro": "Varje ProxMenux-skript börjar med två intilliggande kommentarsblock som bildar skripthuvudet. <strong>Båda krävs</strong>: de anger författare och syfte utan att läsaren behöver gå igenom själva koden.",
+    "bullets": [
+      "<strong>Övre blocket: metadata.</strong> Författare, valfria GitHub-/stödlänkar, underhållare, upphovsrätt, licens, version och uppdateringsdatum. Här ges också <em>erkännande åt bidragsgivare</em>: för ett nytt skript anger du ditt namn och valfritt GitHub-sida och stödprofil, till exempel Ko-fi, GitHub Sponsors eller Buy Me a Coffee.",
+      "<strong>Nedre blocket: beskrivning.</strong> Ett kort stycke på enkel engelska förklarar skriptet. Det läses <em>före</em> koden och ska på egen hand klargöra syfte, huvudåtgärder, berörda resurser och förutsättningar."
+    ],
+    "licenseCalloutTitle": "Licenslinjen är fast - GPL-3.0",
+    "licenseCalloutBody": "ProxMenux ges ut under <strong>GNU General Public License v3.0</strong>. Alla skript har samma licens. Raden <code>License</code> i skripthuvudet ska alltid ha GPL-3.0-hänvisningen i exemplet nedan; den väljs inte per skript. Genom att bidra godkänner du GPL-3.0: alla får läsa, ändra och sprida skriptet och ändringarna med samma licens. Fullständig text: <licenseLink>MacRimi/ProxMenux/LICENSE</licenseLink>.",
+    "templateCode": "#!/bin/bash\n\n# ==========================================================\n# ProxMenux - A menu-driven script for Proxmox VE management\n# ==========================================================\n# Author      : Your Name\n# GitHub      : github.com/yourhandle\n# Sponsor     : ko-fi.com/yourhandle\n# Maintainer  : MacRimi\n# Copyright   : (c) 2026 MacRimi & contributors\n# License     : (GPL-3.0) (https://github.com/MacRimi/ProxMenux/blob/main/LICENSE)\n# Version     : 1.0\n# Last Updated: DD/MM/YYYY\n# ==========================================================\n# Description:\n# Short paragraph explaining what the script does.\n# Mention the main actions (e.g. \"creates a ZFS pool\",\n# \"configures IOMMU and reboots\", \"imports an ISO into a VM\"),\n# the resources it touches, and any prerequisites the user\n# should be aware of before running it.\n# ==========================================================",
+    "optionalNote": "Raderna <code>GitHub</code> och <code>Sponsor</code> är valfria. Utelämna dem om du inte vill publicera dem. Allt annat krävs.",
+    "whyCalloutTitle": "Varför detta är viktigt",
+    "whyCalloutBody": "Bidrag till öppen källkod är frivilligt arbete. Namn och eventuell stödlänk direkt i källkoden ger författaren synligt erkännande vid varje läsning, i stället för att döljas bakom projektet. Beskrivningen har ett annat syfte: den är det första en framtida underhållare eller nyfiken användare läser. En tydlig beskrivning avgör ofta om skriptet inger förtroende eller undviks."
+  },
+  "structure": {
+    "heading": "Projektstruktur",
+    "intro": "Var olika typer av skript finns i arkivet:",
+    "treeCode": "scripts/\n├── menus/              # Top-level menu scripts (entry points)\n├── storage/            # Disk, storage and passthrough scripts\n├── share/              # NFS, Samba, local share scripts\n├── vm/                 # VM creation and configuration scripts\n├── gpu_tpu/            # GPU / TPU passthrough scripts\n├── post_install/       # Post-install automation scripts\n├── backup_restore/     # Backup and restore scripts\n├── utilities/          # System utility scripts\n├── global/             # Shared helper libraries (sourced by other scripts)\n├── utils.sh            # Shared utility functions and message helpers\n└── help_info_menu.sh   # Interactive help and command reference",
+    "outro": "Varje skript läser in <code>utils.sh</code> vid start med source för att få meddelandefunktioner, väntindikator, färgvariabler och översättningssystem. Gemensamma hjälpbibliotek i <code>scripts/global/</code> läses uttryckligen in av de skript som behöver dem."
+  },
+  "twoPhase": {
+    "heading": "Regler för gränssnitt i två faser",
+    "intro": "Detta är den viktigaste regeln i ProxMenux och den som oftast leder till ändringskrav i PR:er. Varje skript delas in i <strong>exakt två faser</strong>:",
+    "headerPhase": "Fas",
+    "headerPurpose": "syfte",
+    "headerScreen": "Skärmtillstånd",
+    "rows": [
+      {
+        "phaseRich": "<strong>Fas 1 — Urval</strong>",
+        "purposeRich": "Samla varje användarbeslut. Kör något förberedande arbete som behövs (sonder, skanningar, kontroller).",
+        "screenRich": "<code>dialog</code>-överlägg. Om en kontroll mellan två menyer tar mer än någon sekund, visa en <code>msg_info</code>-väntindikator så att användaren ser att skriptet inte hängt sig. Anropa sedan <code>stop_spinner</code> direkt före nästa dialogruta."
+      },
+      {
+        "phaseRich": "<strong>Fas 2 - Utförande</strong>",
+        "purposeRich": "Utför varje operation. Visa hela framstegshistorien som ackumuleras på skärmen.",
+        "screenRich": "Synliga <code>msg_info</code>/<code>msg_ok</code>-meddelanden; aldrig <code>dialog</code>."
+      }
+    ],
+    "principle": "Principen är <strong>samla alla val först och kör sedan allt</strong>. Användaren ser först ordnade dialogmenyer (fas 1), sedan en loggliknande körningsvy (fas 2). Faserna blandas inte: inga dialogrutor mitt i körningen och inga förloppsmeddelanden under valet.",
+    "phase1Heading": "Fas 1 - typiskt mönster",
+    "phase1Code": "# Silent preparatory work between dialogs\nmsg_info \"$(translate \"Checking disk assignments...\")\"\nASSIGNED_TO=$(check_assignments \"$DISK\")\nstop_spinner   # ← clears line silently, result saved in variable\n\n# Next dialog can now use ASSIGNED_TO\nif [ -n \"$ASSIGNED_TO\" ]; then\n    dialog --yesno \"$(translate \"Disk already assigned. Continue?\")\" $UI_YESNO_H $UI_YESNO_W\nfi\n\n# Collect multiple decisions per item with parallel arrays\ndeclare -a DISK_LIST=()\ndeclare -a DISK_FORMAT_TYPES=()\ndeclare -a DISK_MOUNT_POINTS=()\nfor DISK in $SELECTED; do\n    msg_info \"$(translate \"Analyzing disk...\")\"\n    CURRENT_FS=$(lsblk -no FSTYPE \"$DISK\" | xargs)\n    stop_spinner\n\n    FORMAT=$(dialog --backtitle \"$BACKTITLE\" \\\n        --title \"$(translate \"Select Filesystem\")\" \\\n        --menu \"...\" $UI_SHORT_MENU_H $UI_SHORT_MENU_W $UI_SHORT_MENU_LIST_H \\\n        \"ext4\" \"...\" \"xfs\" \"...\" \"btrfs\" \"...\" \\\n        2>&1 >/dev/tty)\n    [ -z \"$FORMAT\" ] && continue\n\n    DISK_LIST+=(\"$DISK\")\n    DISK_FORMAT_TYPES+=(\"$FORMAT\")\ndone",
+    "phase1RulesIntro": "<strong>Regler för fas 1:</strong>",
+    "phase1Rules": [
+      "Om en <code>msg_info</code>-väntindikator körs och du ska öppna en <code>dialog</code>- eller <code>whiptail</code>-meny, anropa först <code>stop_spinner</code>. Indikatorn kan inte samexistera med verktygens överlägg. Om ingen indikator är aktiv behövs inget anrop.",
+      "Använd <code>show_proxmenux_logo</code> + <code>msg_title</code> + <code>msg_info</code> för att ge visuellt sammanhang åt längre åtgärder i fas 1, exempelvis en kontroll som tar minst fem sekunder. Funktionen rensar redan skärmen; anropa inte <code>clear</code> före den.",
+      "Anropa inte <code>show_proxmenux_logo</code> mellan dialogmenyer när det saknas något att visa. Att rensa skärmen för en tom terminal ger bara visuellt brus.",
+      "Lagra alla val och kontrollresultat i variabler eller parallella arrayer. Sammanfattningen visas i början av fas 2, inte i fas 1."
+    ],
+    "phase2Heading": "Fas 2 - typiskt mönster",
+    "phase2Code": "# ── PHASE 2 — EXECUTION ─────────────────────────────\nshow_proxmenux_logo\nmsg_title \"$(translate \"My Script Title\")\"\n\n# Recap Phase 1 preparatory results — show what was already done\nmsg_ok \"$(translate \"CT $CTID selected.\")\"\nmsg_ok \"$(translate \"Repositories verified.\")\"\nmsg_ok \"$(translate \"Disks to process: ${#DISK_LIST[@]}\")\"\n\n# Now execute operations\nfor i in \"${!DISK_LIST[@]}\"; do\n    DISK=\"${DISK_LIST[$i]}\"\n    FORMAT=\"${DISK_FORMAT_TYPES[$i]}\"\n\n    msg_info \"$(translate \"Formatting\") $DISK $(translate \"as\") $FORMAT...\"\n    mkfs.\"$FORMAT\" \"$DISK\" >/dev/null 2>&1\n    msg_ok \"$(translate \"Formatted.\")\"\ndone\n\nmsg_ok \"$(translate \"Completed. ${#DISK_LIST[@]} disk(s) processed.\")\"\nmsg_success \"$(translate \"Press Enter to return to menu...\")\"\nread -r",
+    "phase2Rules": "<strong>Regler för fas 2:</strong> börja med <code>show_proxmenux_logo + msg_title</code> och sammanfatta genast fas 1 som <code>msg_ok</code>-rader. Anropa aldrig <code>show_proxmenux_logo</code> igen, eftersom det raderar förloppshistoriken. Använd inte <code>dialog</code>; om ett val under körningen är oundvikligt, använd <code>whiptail</code> enligt nästa avsnitt."
+  },
+  "dialogVsWhiptail": {
+    "headingRich": "När du ska använda <code>dialog</code> vs <code>whiptail</code>",
+    "intro": "Båda verktygen ritar textbaserade gränssnitt men beter sig olika på skärmen. ProxMenux använder dem därför i två skilda faser.",
+    "headerTool": "Verktyg",
+    "headerWhen": "När du ska använda den",
+    "headerEffect": "Effekt på skärmen",
+    "rows": [
+      {
+        "toolRich": "<strong><code>dialog</code></strong>",
+        "whenRich": "<strong>Alltid i fas 1.</strong> Alla interaktiva val, som VM, disk, filsystem eller bekräftelse av en åtgärd, använder <code>dialog</code>. Det är ProxMenux standardverktyg för gränssnitt.",
+        "effectRich": "Tar över terminalen, rensar skärmen, ritar sitt överlägg och återställer föregående tillstånd när den stängs. Det fungerar i fas 1 eftersom inga användbara resultat visas ännu."
+      },
+      {
+        "toolRich": "<strong><code>whiptail</code></strong>",
+        "whenRich": "<strong>Bara i fas 2, när det är oundvikligt.</strong> Ett typiskt fall är en omstartsfråga när körningen är klar. Använd inte <code>whiptail</code> för att fråga ”fortsätt?” mitt i körningen; det beslutet skulle ha fattats i fas 1.",
+        "effectRich": "Ett lättare överlägg som <em>inte</em> rensar terminalens innehåll. Historiken från <code>msg_ok</code>/<code>msg_info</code> i fas 2 syns bakom dialogrutan. Därför passar det när förlopp redan visas på skärmen."
+      }
+    ],
+    "calloutTitle": "Varför uppdelningen är viktig",
+    "calloutBody": "Om du anropar <code>dialog</code> mitt i fas 2 försvinner alla <code>msg_ok</code>-rader användaren har följt. Det synliga händelseförloppet raderas. <code>whiptail</code> undviker det. Regeln bevarar alltså användarens bild av vad skriptet hittills har gjort.",
+    "rebootHeading": "Omstartsfråga: det typiska whiptail-fallet i fas 2",
+    "rebootIntro": "Om ett skript kan kräva omstart efter exempelvis aktivering av IOMMU eller ändrade kärnparametrar använder slutfrågan i fas 2 <code>whiptail</code>. Ha alltid en Nej-gren som säger att den berörda resursen inte ska användas före omstart:",
+    "rebootCode": "if [[ \"$HOST_REBOOT_REQUIRED\" == \"yes\" ]]; then\n  echo \"\"\n  if whiptail --title \"$(translate \"Reboot Required\")\" --yesno \\\n    \"\\n$(translate \"A host reboot is required before starting the VM. Reboot now?\")\" \\\n    13 78; then\n      msg_warn \"$(translate \"Rebooting the system...\")\"\n      reboot\n  else\n      echo \"\"\n      msg_info2 \"$(translate \"Do not start the VM until the system has been rebooted.\")\"\n  fi\nfi\n\nmsg_success \"$(translate \"Press Enter to return to menu...\")\"\nread -r"
+  },
+  "messageFunctions": {
+    "heading": "Referens för meddelandefunktioner",
+    "intro": "Alla finns i <code>utils.sh</code>. Använd dem som standard för synlig utdata så att skripten får ett enhetligt utseende. Om en ny funktion behövs, till exempel en allvarlighetsnivå eller layouthjälpare, föreslå den i din pull request. Den granskas och läggs till i <code>utils.sh</code> om den är användbar för fler skript.",
+    "headerFunction": "Funktion",
+    "headerWhen": "När man ska använda",
+    "headerSpinner": "Förloppsindikator",
+    "rows": [
+      {
+        "function": "msg_info \"text\"",
+        "whenRich": "Operation pågår.",
+        "spinner": "Börjar"
+      },
+      {
+        "function": "stop_spinner",
+        "whenRich": "Slutet av tyst förberedande arbete i fas 1 - dödar spinner, rensar linjen.",
+        "spinner": "Stopp"
+      },
+      {
+        "function": "msg_ok \"text\"",
+        "whenRich": "Operationen lyckades. Använd också för \"funktion aktiverad\" även när en omstart krävs.",
+        "spinner": "Stopp"
+      },
+      {
+        "function": "msg_warn \"text\"",
+        "whenRich": "Faktisk varning eller nedbrutet tillstånd.",
+        "spinner": "Stopp"
+      },
+      {
+        "function": "msg_error \"text\"",
+        "whenRich": "Allvarligt fel.",
+        "spinner": "Stopp"
+      },
+      {
+        "function": "msg_info2 \"text\"",
+        "whenRich": "Icke blockerande upplysning på en cyan informationsrad.",
+        "spinner": "Stopp"
+      },
+      {
+        "function": "msg_success \"text\"",
+        "whenRich": "Avslutande frågan ”Tryck Enter för att återgå” i slutet av fas 2.",
+        "spinner": "Stopp"
+      },
+      {
+        "function": "msg_title \"text\"",
+        "whenRich": "Fet rubrik med inbyggda mellanrum. Används i början av fas 2.",
+        "spinner": "—"
+      },
+      {
+        "function": "show_proxmenux_logo",
+        "whenRich": "Rensar skärmen och visar logotypen. Anropas <em>en gång</em> i början av fas 2.",
+        "spinner": "—"
+      }
+    ]
+  },
+  "dialogConventions": {
+    "heading": "dialogkonventioner",
+    "bullets": [
+      "Skicka alltid <code>--backtitle \"$BACKTITLE\"</code> till varje <code>dialog</code>- och <code>whiptail</code>-anrop. <code>$BACKTITLE</code> är alltid <code>\"ProxMenux\"</code>, satt en gång i skripthuvudet och aldrig överskrivet. Användaren ska alltid se projektnamnet som ram, inte skriptets egen titel.",
+      "Omslut alltid rubriker och meddelanden med <code>$(translate \"...\")</code>.",
+      "Omdirigera alltid <code>dialog</code>-utgången med <code>2&gt;&amp;1 &gt;/dev/tty</code> - den fångade stdouten blir användarens val, medan dialogrutan själv drar på terminalen.",
+      "Använd standard UI dimension variabler (<code>$UI_MENU_H</code>, <code>$UI_MSG_W</code>, etc.) för konsekvent storlek över skript.",
+      "Kontrollera alltid tomma eller avbrutna val och hantera dem korrekt."
+    ],
+    "exampleIntro": "Fullständigt exempel: skapa en VM-valmeny och hantera avbrott.",
+    "exampleCode": "# 1) Build the list of VMs as alternating \"ID  NAME\" pairs.\n#    dialog --menu expects this exact shape: tag1 description1 tag2 description2 ...\nVM_LIST=\"\"\nfor vmid in $(qm list | awk 'NR>1 {print $1}'); do\n    vm_name=$(qm config \"$vmid\" | awk -F': ' '/^name:/ {print $2}')\n    VM_LIST=\"$VM_LIST $vmid \\\"$vm_name\\\"\"\ndone\n\n# 2) Show the dialog. Captured stdout is the user's selection (the VMID).\nVMID=$(eval \"dialog --backtitle \\\"\\$BACKTITLE\\\" \\\n    --title \\\"\\$(translate \\\"Select VM\\\")\\\" \\\n    --menu \\\"\\$(translate \\\"Choose a VM from the list:\\\")\\\" \\\n    \\$UI_MENU_H \\$UI_MENU_W \\$UI_MENU_LIST_H \\\n    $VM_LIST \\\n    2>&1 >/dev/tty\")\n\n# 3) Empty result means the user pressed Cancel or Esc — exit silently.\nif [ -z \"$VMID\" ]; then\n    exit 0\nfi\n\n# 4) Continue with the rest of Phase 1, knowing VMID is now set.\necho \"User selected VMID=$VMID\""
+  },
+  "translation": {
+    "heading": "Översättningspolicy",
+    "intro": "Alla användarsynliga strängar måste inslagas med funktionen <code>translate</code>. ProxMenux översätter dem automatiskt till alla språk - du skriver engelska, användaren läser sitt modersmål.",
+    "code": "msg_ok \"$(translate \"Operation completed successfully.\")\"\nmsg_error \"$(translate \"Failed to start container\") $CTID.\"\ndialog --title \"$(translate \"Select Storage\")\" ...",
+    "bullets": [
+      "Skriv strängar på engelska - översättning hanteras automatiskt av bygget.",
+      "Håll strängar koncis. Undvik inbäddningsvariabler inom långa meningar där det är möjligt.",
+      "Översätt <strong>inte</strong> variabelnamn, sökvägar eller tekniska identifierare."
+    ]
+  },
+  "variableStyle": {
+    "heading": "Regler för variabler och stil",
+    "bullets": [
+      "Använd <code>UPPER_CASE</code> för script-nivå variabler.",
+      "Använd <code>lower_case</code> för lokala funktionsvariabler (deklarera med <code>local</code>).",
+      "Sätt alla variabelexpansioner inom citattecken: <code>\"$VAR\"</code>, inte <code>$VAR</code>.",
+      "Använd <code>[[ ]]</code> för villkor, inte <code>[ ]</code> (förutom där POSIX krävs).",
+      "<code>show_proxmenux_logo</code> är det avsedda sättet att rensa skärmen: den rensar och visar projektlogotypen för att ge visuellt sammanhang. Anropa den en gång i början av fas 2, och valfritt före ett längre block med väntindikator i fas 1."
+    ],
+    "standardNamesIntro": "Standardvariabla namn över hela projektet:",
+    "standardNamesCode": "CTID         # container ID\nVMID         # virtual machine ID\nDISK         # device path (e.g. /dev/sdb)\nPARTITION    # partition path (e.g. /dev/sdb1)\nSTORAGE      # Proxmox storage name\nMOUNT_POINT  # filesystem mount path",
+    "redirectHeading": "Omdirigera verktygsutgång under fas 2",
+    "redirectIntro": "Fas 2 visar en logg med <code>msg_info → msg_ok</code>-rader. Om ett anropat verktyg, som apt, mkfs, qm, pct eller dd, skriver till stdout/stderr rullar dess utdata förbi meddelandena och stör överblicken. Användaren kan inte längre skilja skriptets förlopp från verktygets detaljer.",
+    "withoutRedirectIntro": "<strong> Utan omdirigering</strong> - vad användaren ser om du inte hanterar ljudet:",
+    "withoutRedirectCode": "ℹ Installing kernel package...\nReading package lists... Done\nBuilding dependency tree... Done\nReading state information... Done\nThe following NEW packages will be installed:\n  proxmox-kernel-6.5\n0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded.\nNeed to get 12.5 MB of archives.\nAfter this operation, 47.2 MB of additional disk space will be used.\nGet:1 http://download.proxmox.com/debian/pve trixie/pve-no-subscription amd64 ...\n... [200+ more lines of dpkg output] ...\n✓ Kernel installed.",
+    "withRedirectIntro": "<strong> Med omdirigering</strong> - hur samma operation ser ut när buller skickas någon annanstans:",
+    "withRedirectCode": "ℹ Installing kernel package...\n✓ Kernel installed.\nℹ Configuring kernel command line...\n✓ Configured.\nℹ Refreshing boot loader...\n✓ Boot loader updated.",
+    "twoPatternsIntro": "Två mönster att välja mellan:",
+    "discardLead": "<strong>Kasta utdata</strong> när de inte behövs: snabbast och enklast.",
+    "discardCode": "DEBIAN_FRONTEND=noninteractive apt-get install -y \"$package\" >/dev/null 2>&1",
+    "logLead": "<strong>Skicka utdata till en loggfil</strong> när de kan behöva granskas senare, exempelvis vid en misslyckad installation eller för att se vad dpkg gjorde. Det är det föredragna mönstret för apt-åtgärder:",
+    "logCode": "apt-get install -y \"$package\" >> \"$log_file\" 2>&1",
+    "referenceOutro": "Skriptet <code>scripts/global/update-pve9_2.sh</code> är ett referensimplementering - varje <code>apt-get</code>-samtal skickar ut till en loggfil så att användaren bara ser det rena <code>msg_info → msg_ok</code>-flödet, medan loggen på disken låter dig rekonstruera exakt vad apt gjorde om något går fel."
+  },
+  "dosAndDonts": {
+    "heading": "Do's och Don'ts",
+    "doHeading": "✅ Gör",
+    "doBullets": [
+      "<code>stop_spinner</code> före en <code>dialog</code> i fas 1 endast när en <code>msg_info</code> spinner körs för närvarande.",
+      "Fas 2 börjar med <code>show_proxmenux_logo + msg_title + msg_ok</code> för att sammanfatta resultaten från fas 1.",
+      "Använd <code>msg_ok</code> för framgångsrikt aktiverade funktioner - även om en omstart krävs.",
+      "Använd <code>whiptail</code> (inte <code>dialog</code>) för någon post-exekveringsprompt som måste visas i Fas 2.",
+      "Ha alltid en Nej-gren i omstartsfrågor som säger att den berörda resursen inte ska startas före omstart.",
+      "Bevakning VM-bara logik genom att kontrollera <code>[[ -f \"/etc/pve/qemu-server/$'{'vmid'}'.conf\" ]]</code> - controllers och NVMe PCIe kan inte läggas till LXC containrar.",
+      "Använd <code>ensure_repositories</code> från <code>utils-install-functions.sh</code> istället för ovillkorlig <code>apt-get update</code>.",
+      "Använd parallella arrayer i Fas 1 när varje objekt behöver flera dialoger."
+    ],
+    "dontHeading": "❌ Gör inte",
+    "dontBullets": [
+      "Anropa <code>dialog</code> medan en väntindikator är aktiv.",
+      "Hoppa över fas 1 recap i början av fas 2.",
+      "Anropa <code>show_proxmenux_logo</code> en andra gång; det raderar allt fas 2 har visat.",
+      "Använd <code>dialog</code> i Fas 2 (använd <code>whiptail</code> för det sällsynta oundvikliga fallet).",
+      "Använda enbart <code>clear</code>.",
+      "Omge <code>msg_title</code> med tomma <code>echo \"\"</code>-rader; mellanrum ingår redan.",
+      "Använd <code>msg_warn</code> för att rapportera en framgångsrikt aktiverad funktion - det är en <code>msg_ok</code>.",
+      "Kör ovillkorlig <code>apt-get update</code> - använd <code>ensure_repositories</code>."
+    ]
+  },
+  "submitting": {
+    "heading": "Skicka in ditt bidrag",
+    "steps": [
+      "Skapa en fork av <code>MacRimi/ProxMenux</code> på GitHub och klona din fork.",
+      "Skapa en <code>feature/*</code>-gren från <code>develop</code> (se <em>Grenmodell</em> ovan).",
+      "Följ denna guide för nya eller modifierade skript. Skriv rubriken med ditt namn; lägg till den valfria sponsorlinjen om du vill.",
+      "Testa ditt manus på en riktig Proxmox VE-instans - både Fas 1 (varje dialogruta) och Fas 2 (varje operation lyckas och rullar tillbaka rent på fel).",
+      "Öppna en pull request <strong>mot <code>develop</code></strong> med en tydlig beskrivning: skriptets syfte, ändringar och den Proxmox VE-version som användes för tester.",
+      "Se till att ditt bidrag respekterar <cocLink>Uppförandekod</cocLink>."
+    ],
+    "securityOutro": "För säkerhetskänsliga problem följer du rapporteringsprocessen i <securityLink>SECURITY.md</securityLink> i stället för att öppna ett offentligt ärende."
+  },
+  "whereNext": {
+    "heading": "Nästa steg",
+    "items": [
+      {
+        "kind": "external",
+        "url": "https://github.com/MacRimi/ProxMenux/blob/main/CONTRIBUTING.md",
+        "label": "CONTRIBUTING.md (fullständig guide)",
+        "tail": " — källan till sanning för varje konvention, inklusive avancerade hårdvarumönster."
+      },
+      {
+        "kind": "internal",
+        "href": "/docs/about/contributors",
+        "label": "Bidragsgivare",
+        "tail": " — personerna vars arbete har format ProxMenux-utgåvor. Detta är en annan sida."
+      },
+      {
+        "kind": "internal",
+        "href": "/docs/about/code-of-conduct",
+        "label": "Uppförandekod",
+        "tail": " - standarderna varje bidragsgivare går med på att följa."
+      },
+      {
+        "kind": "external",
+        "url": "https://github.com/MacRimi/ProxMenux/discussions",
+        "label": "GitHub Discussions",
+        "tail": " - fråga innan du bygger om du inte är säker på om en idé passar, eller att hitta medarbetare på en större funktion."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sv/docs/about/contributors.json b/web/messages/sv/docs/about/contributors.json
new file mode 100644
index 00000000..c8580f3e
--- /dev/null
+++ b/web/messages/sv/docs/about/contributors.json
@@ -0,0 +1,38 @@
+{
+  "meta": {
+    "title": "Bidragsgivare | ProxMenux-dokumentation",
+    "description": "Ett erkännande till dem som gör ProxMenux möjligt: testare, granskare och utvecklare som bidrar till varje version.",
+    "ogTitle": "Bidragsgivare | ProxMenux-dokumentation",
+    "ogDescription": "Möt bidragsgivarna bakom ProxMenux."
+  },
+  "header": {
+    "title": "Bidragsgivare",
+    "description": "ProxMenux växer tack vare sina bidragsgivare. Den här sidan uppmärksammar deras arbete: att testa versioner före publicering, hitta regressioner, granska PR:ar och påverka utvecklingen av nya funktioner.",
+    "section": "Om"
+  },
+  "beyond": {
+    "title": "Utöver denna lista",
+    "body": "Många fler bidrar genom felrapporter, funktionsförslag i Discussions, betatestning och översättningar. Den fullständiga listan över kodbidragsgivare finns i <extlink>GitHubs bidragsgivargraf</extlink>. Den här sidan lyfter fram dem som är mest aktiva med att testa och granska ProxMenux-versioner."
+  },
+  "testers": {
+    "heading": "Testare och granskare",
+    "intro": "De här personerna var bland de första att bidra till projektet. Deras tester, felrapporter och förbättringsförslag hjälpte ProxMenux att bli vad det är i dag.",
+    "roles": {
+      "testing": "Testning",
+      "testingReviewer": "Testning och granskning"
+    },
+    "youtube": "YouTube"
+  },
+  "contribute": {
+    "heading": "Vill du bidra?",
+    "intro": "Alla bidrag är välkomna - kod, testning, design, dokumentation eller bara dela dina idéer:",
+    "tester": "<strong>Testare</strong> — prova <beta>betakanalen</beta> och rapportera vad som fungerar och vad som inte fungerar före de stabila versionerna.",
+    "developer": "<strong>Utvecklare</strong> — Bash, Next.js (TypeScript) och lite Python för översättningens virtuella miljö (venv). PR:ar välkomnas på <gh>GitHub</gh>.",
+    "designer": "<strong>Designer</strong> — UI förbättringar, ikoner, skärmdumpar för dokumentation.",
+    "ideas": "<strong>Idéer</strong> — öppna en tråd i <disc>GitHub Discussions</disc> innan du skapar ett ärende med ett funktionsförslag."
+  },
+  "coc": {
+    "title": "Läs uppförandekoden först",
+    "body": "Läs <coclink>uppförandekoden och rekommenderade arbetssätt</coclink> innan du skickar in kod eller rapporterar problem. Där beskrivs förväntningar på kodansvar, rapportering av säkerhetsbrister och omfattningen av PR:ar."
+  }
+}
diff --git a/web/messages/sv/docs/about/faq.json b/web/messages/sv/docs/about/faq.json
new file mode 100644
index 00000000..a39c07b9
--- /dev/null
+++ b/web/messages/sv/docs/about/faq.json
@@ -0,0 +1,94 @@
+{
+  "meta": {
+    "title": "Vanliga frågor | ProxMenux-dokumentation",
+    "description": "Vanliga frågor om ProxMenux: funktioner, installation, kompatibilitet från PVE 8, anpassning, uppdateringar, säkerhet, produktionsanvändning, systemfiler, bidrag och avinstallation.",
+    "ogTitle": "Vanliga frågor | ProxMenux-dokumentation",
+    "ogDescription": "Vanliga frågor om ProxMenux installation, kompatibilitet, säkerhet och hur du kan bidra."
+  },
+  "header": {
+    "title": "Vanliga frågor",
+    "description": "Vanliga frågor om ProxMenux: vad det är, vem det passar, installation, uppdatering, avinstallation, kompatibilitet, anpassning, säkerhet och bidrag. Om din fråga saknas, titta i GitHub Discussions eller skapa ett ärende.",
+    "section": "Om"
+  },
+  "quickLinks": {
+    "title": "Snabba länkar",
+    "installationLabel": "Installation",
+    "installationSuffix": " — installationskommandot på en rad och dess beroenden.",
+    "introductionLabel": "Introduktion",
+    "introductionSuffix": " — vad ProxMenux gör, på fem minuter.",
+    "uninstallLabel": "Avinstallera",
+    "uninstallSuffix": " — ren borttagning.",
+    "issuesLabel": "GitHub Issues",
+    "discussionsLabel": "Diskussioner"
+  },
+  "q1": {
+    "question": "Vad är ProxMenux, och vad används det för?",
+    "p1Rich": "<strong>ProxMenux</strong> är ett interaktivt menystyrt verktyg som gör <strong>Proxmox VE</strong> tillgängligt oavsett teknisk erfarenhet. Det förenklar körningen av kommandon och låter dig hantera systemet utan avancerade Linux-kunskaper.",
+    "p2": "Mindre erfarna användare kan köra kommandon via strukturerade menyer och behöver skriva mindre i terminalen. Erfarna administratörer sparar steg i återkommande uppgifter som härdning efter installation, GPU-passthrough, import av OVF-VM:ar och rotation av ZFS-snapshots.",
+    "p3": "Proxmox VE används ofta för:",
+    "items": [
+      "Virtualisering i företagsklass",
+      "HomeLab och personliga molnlösningar",
+      "Multimedieservrar, automatisering och mycket mer"
+    ]
+  },
+  "q2": {
+    "question": "Hur installerar jag ProxMenux?",
+    "p1Rich": "Följ <installlink>installationsguiden</installlink>. Kortfattat:",
+    "stableInstall": "bash -c \"$(wget -qLO - https://raw.githubusercontent.com/MacRimi/ProxMenux/main/install_proxmenux.sh)\"",
+    "p2": "När installationen är klar startar du verktyget med:",
+    "menuCmd": "menu"
+  },
+  "q3": {
+    "question": "Är ProxMenux kompatibel med alla Proxmox-versioner?",
+    "bodyRich": "<strong>Nej — ProxMenux kräver Proxmox VE 8 eller senare.</strong> PVE 7 och äldre stöds inte. Uppgradera först PVE 7 till 8.x enligt Proxmox officiella anvisningar. Därefter kan ProxMenux hantera steget från 8 till 9 via <upgradelink>Verktyg → Uppgradera PVE 8 till PVE 9</upgradelink>."
+  },
+  "q4": {
+    "question": "Kan jag anpassa ProxMenux?",
+    "p1Rich": "Uppdateringar kan skriva över lokala ändringar i huvudskripten, så undvik att redigera dessa filer direkt. Det här <em>kan</em> du anpassa:",
+    "items": [
+      "Konsolens välkomstbanner med verktyget <strong>FastFetch</strong> i menyn för efterinstallation.",
+      "Vilka valfria komponenter installeras (Monitor, Fail2Ban, Lynis ...) - välj under installation eller via den relevanta menyn senare."
+    ]
+  },
+  "q5": {
+    "question": "Hur uppdaterar jag ProxMenux?",
+    "p1Rich": "När en ny version finns upptäcker ProxMenux den nästa gång du kör <code>menu</code> och erbjuder en uppdatering. Om du accepterar ersätts verktygets filer och konfiguration i den befintliga installationen. Du behöver inte ladda ned något manuellt.",
+    "p2Rich": "Användare av den stabila versionen får stabila uppdateringar, och betaanvändare får betauppdateringar. När en stabil version släpps meddelar betan det nästa gång menyn öppnas och erbjuder automatiskt byte. Läs mer om <betalink>betaprogrammet</betalink>."
+  },
+  "q6": {
+    "question": "Var kan jag rapportera problem eller föreslå funktioner?",
+    "p1Rich": "Rapportera buggar i <issueslink>GitHub Issues</issueslink>. Beskriv stegen för att återskapa felet, felmeddelandet och vid behov Monitor-utdata från <code>journalctl -u proxmenux-monitor -n 50</code>.",
+    "p2Rich": "För <strong>säkerhetsproblem</strong>: <strong>publicera inte detaljerna</strong>. Följ rutinen för ansvarsfull rapportering i <coclink>uppförandekoden och rekommendationerna</coclink>."
+  },
+  "q7": {
+    "question": "Kan jag bidra till ProxMenux?",
+    "p1Rich": "<strong>Absolut.</strong> ProxMenux är ett samarbetsprojekt med öppen källkod. Du kan bidra med kod (Bash, Next.js/TypeScript och översättningsverktyg i Python), tester, dokumentation, design eller idéer.",
+    "item1Rich": "Diskutera idéer i <discusslink>GitHub Discussions</discusslink> innan du skapar en funktionsförfrågan.",
+    "item2Rich": "Läs <coclink>uppförandekoden och rekommendationerna</coclink> innan du skickar en pull request.",
+    "item3Rich": "På <contriblink>sidan för medverkande</contriblink> ser du vilka som för närvarande testar och granskar projektet."
+  },
+  "q8": {
+    "question": "Ändrar ProxMenux kritiska systemfiler?",
+    "p1Rich": "<strong>Installationen av ProxMenux lägger till följande komponenter.</strong>",
+    "item1Rich": "Beroenden via apt: <code>dialog</code>, <code>curl</code>, <code>jq</code> och <code>git</code>. Översättningarna använder färdiga JSON-kataloger. Installationsprogrammet lägger inte till någon virtuell översättningsmiljö på värden.",
+    "item2Rich": "Skriptträdet på <code>/usr/local/share/proxmenux/</code>.",
+    "item3Rich": "Startkommandot i <code>/usr/local/bin/menu</code>.",
+    "item4Rich": "Valfritt: Monitors systemd-tjänst <code>proxmenux-monitor.service</code>.",
+    "p2Rich": "ProxMenux ändrar <em>inte</em> Proxmox centrala konfiguration om du inte uttryckligen begär det via en särskild meny. Nätverksreparationen redigerar till exempel <code>/etc/network/interfaces</code>, men först efter din bekräftelse och efter att en säkerhetskopia har skapats."
+  },
+  "q9": {
+    "question": "Är det säkert att använda ProxMenux i produktion?",
+    "bodyRich": "<strong>Ja.</strong> Eftersom ProxMenux bara ändrar Proxmox centrala filer på uttrycklig begäran kan det användas i produktionsmiljöer. Som med all automatisering bör du först testa i en kontrollerad miljö och ha säkerhetskopior innan du kör destruktiva åtgärder, till exempel uppgradering från PVE 8 till 9, diskformatering eller borttagning av en VM."
+  },
+  "q10": {
+    "question": "Hur avinstallerar jag ProxMenux?",
+    "p1Rich": "I ProxMenux: <strong>Inställningar → Avinstallera ProxMenux</strong>. Avinstallationen tar bort skriptträdet, startkommandot och Monitor-tjänsten samt, om du väljer det, utvalda beroenden. Den återställer <code>/root/.bashrc</code> och <code>/etc/motd</code> från säkerhetskopiorna som Post-Install skapade, om de finns (annars tas ProxMenux-raden bort ur MOTD).",
+    "p2Rich": "Fullständiga instruktioner: <uninstalllink>Avinstallera ProxMenux</uninstalllink>."
+  },
+  "q11": {
+    "question": "VirusTotal flaggar installationsadressen — är den säker?",
+    "p1Rich": "Resultatet 1/95 från <em>Chong Lua Dao</em>, som rapporterades i ärende #162, bedömdes av projektansvarig som ett falsklarm. Installationsprogrammet startas med ett kommando som laddar ned och kör skriptet (<code>bash -c \"$(wget -qLO - …)\"</code>) och kan ladda ned <code>jq</code> från dess officiella GitHub-utgåva. Detta <em>beteende</em> kan utlösa heuristiska skannrar. Den historiska rapporten säger inget avgörande om alla framtida nedladdningar.",
+    "p2Rich": "ProxMenux har helt öppen källkod och du kan granska installationsskriptet rad för rad: <scriptlink>install_proxmenux.sh</scriptlink>. Mer bakgrund finns i <issuelink>ärende #162</issuelink>."
+  }
+}
diff --git a/web/messages/sv/docs/about/index.json b/web/messages/sv/docs/about/index.json
new file mode 100644
index 00000000..437a1b7e
--- /dev/null
+++ b/web/messages/sv/docs/about/index.json
@@ -0,0 +1,67 @@
+{
+  "meta": {
+    "title": "Om projektet | ProxMenux-dokumentation",
+    "description": "Om ProxMenux: projektmål, bidragsgivare, vanliga frågor och uppförandekod. Ett menystyrt hanteringsverktyg med öppen källkod för Proxmox VE 8+, utvecklat och underhållet av MacRimi tillsammans med en liten grupp testare och bidragsgivare.",
+    "ogTitle": "Om projektet | ProxMenux-dokumentation",
+    "ogDescription": "Om ProxMenux — ett menystyrt hanteringsverktyg med öppen källkod för Proxmox VE 8+."
+  },
+  "header": {
+    "title": "Om",
+    "description": "Projektinformation, vanliga frågor, bidragsgivare och uppförandekod. ProxMenux är ett menystyrt hanteringsverktyg med öppen källkod för Proxmox VE 8+, utvecklat och underhållet av MacRimi med hjälp av en liten grupp testare och bidragsgivare.",
+    "section": "Om"
+  },
+  "callout": {
+    "title": "Öppen källkod, utvecklad av gemenskapen",
+    "body": "ProxMenux har GPL-3.0-licens och utvecklas öppet på GitHub. Varje skript kan granskas och varje ändring spåras. Felrapporter, idéer, kod och testning välkomnas."
+  },
+  "section": {
+    "heading": "I detta avsnitt",
+    "options": [
+      {
+        "icon": "HelpCircle",
+        "href": "/docs/about/faq",
+        "title": "FAQ",
+        "description": "Vanliga frågor: vad ProxMenux är, installation, kompatibilitet, anpassning, uppdateringar, säkerhet, användning i produktion och avinstallation."
+      },
+      {
+        "icon": "Users",
+        "href": "/docs/about/contributors",
+        "title": "Bidragsgivare",
+        "description": "Ett erkännande till dem som gör ProxMenux möjligt: testare, granskare och utvecklare som bidrar till varje version."
+      },
+      {
+        "icon": "ScrollText",
+        "href": "/docs/about/code-of-conduct",
+        "title": "Uppförandekod",
+        "description": "Projektvärden, kodansvarsförväntningar och bidragsriktlinjer. Obligatorisk läsning innan du öppnar en PR eller rapport."
+      }
+    ]
+  },
+  "involved": {
+    "heading": "Bli involverad",
+    "intro": "Tre ställen att engagera sig i projektet:",
+    "cards": [
+      {
+        "href": "https://github.com/MacRimi/ProxMenux/issues/new",
+        "title": "🐛 Rapportera en bugg",
+        "description": "GitHub Issues — bifoga loggar och steg för att återskapa problemet."
+      },
+      {
+        "href": "https://github.com/MacRimi/ProxMenux/discussions",
+        "title": "💡 Föreslå en funktion",
+        "description": "GitHub Discussions — dela idéer innan du öppnar en PR."
+      },
+      {
+        "href": "https://github.com/MacRimi/ProxMenux/pulls",
+        "title": "🔀 Skicka en PR",
+        "description": "GitHub Pull Requests - läs uppförandekoden först."
+      }
+    ]
+  },
+  "support": {
+    "heading": "Stöd projektet",
+    "introRich": "Om ProxMenux sparar tid åt dig är det enklaste sättet att hjälpa andra hitta det att <starlink>ge förrådet en ⭐ på GitHub</starlink>. Om du vill göra mer:",
+    "kofiLabel": "Stöd på Ko-fi",
+    "kofiOutro": " — Köper underhållaren en kaffe och håller utvecklingen på gång."
+  }
+}
diff --git a/web/messages/sv/docs/backup-restore/creating-backups.json b/web/messages/sv/docs/backup-restore/creating-backups.json
new file mode 100644
index 00000000..f11c2a6d
--- /dev/null
+++ b/web/messages/sv/docs/backup-restore/creating-backups.json
@@ -0,0 +1,220 @@
+{
+  "meta": {
+    "title": "Skapa säkerhetskopior — interaktivt säkerhetskopieringsflöde | ProxMenux",
+    "description": "Det interaktiva säkerhetskopieringsflödet i ProxMenux: två ingångspunkter (Scripts TUI-meny och Monitors webbgränssnitt), tre destinationer, två profillägen, ett gemensamt steg för tillfällig förberedelse och en bekräftelsedialog. Sidan beskriver matrisen med sex alternativ, standardprofilen och den anpassade profilen samt vad användaren ser från valet av säkerhetskopia tills arkivet sparas på destinationen.",
+    "ogTitle": "ProxMenux Backup - skapa backup",
+    "ogDescription": "Det interaktiva säkerhetskopieringsflödet med tre destinationer, två profiler och ett gemensamt steg för tillfällig förberedelse.",
+    "twitterTitle": "Skapa backups | ProxMenux",
+    "twitterDescription": "Interaktivt backupflöde med tre destinationer och två profillägen."
+  },
+  "header": {
+    "title": "Skapa backups",
+    "description": "Det interaktiva säkerhetskopieringsflödet: välj en destination och en profil, granska bekräftelsen och följ hur arkivet sparas. De två ingångspunkterna använder samma backend och skapar identiska arkiv.",
+    "section": "Säkerhetskopiering och återställning"
+  },
+  "intro": {
+    "title": "Två ingångspunkter, identisk funktionalitet",
+    "body": "Scripts TUI och Monitors webbgränssnitt erbjuder <strong>exakt samma funktioner</strong>. Varje säkerhetskopia — manuell eller schemalagd — går genom samma valmatris (tre destinationer × två profiler) och anropar samma backendfunktion per cell (<code>_bk_pbs</code>, <code>_bk_borg</code> eller <code>_bk_local</code>). Arkiven som skapas via de två ingångspunkterna är identiska. Valet beror på vad man föredrar: TUI passar för SSH och skript; Monitor erbjuder musklick tillsammans med vyerna för aviseringar och löpande loggutdata."
+  },
+  "entryPoints": {
+    "heading": "De två ingångspunkterna",
+    "rows": [
+      {
+        "entry": "ProxMenux Scripts (TUI)",
+        "path": "menu → Utilities → Host Config Backup",
+        "detail": "Dialogbaserat flöde, SSH-vänligt. Huvudmenyn presenterar de sex alternativen direkt. Använder <code>backup_menu</code> i <code>backup_host.sh</code>."
+      },
+      {
+        "entry": "ProxMenux Monitor (Webb UI)",
+        "path": "Backups tab → Create backup",
+        "detail": "Guidebaserat flöde. Samma sex alternativ visas i ett formulär med två steg (destination → profil). Samma backendfunktioner anropas via Flask-API:et."
+      }
+    ]
+  },
+  "modes": {
+    "heading": "Manuella och schemalagda säkerhetskopior",
+    "body": "Säkerhetskopior kan produceras i två lägen: <strong>manuellt</strong> (det interaktiva flöde som beskrivs på denna sida - användaren plockar en destination och en profil från en meny och följer hur arkivet sparas) eller <strong>schemalagt</strong> (ett obevakat jobb som körs på en timer i cron-stil och tillämpar bevarandeinställningarna för jobbet). Båda lägena stöder samma tre destinationer och samma två profiler, och båda är tillgängliga från båda ingångspunkterna - Scripts TUI-meny och Monitors Backups-flik. Planerade jobb använder samma backendfunktioner som manuellt flöde genom <code>run_scheduled_backup.sh</code>; de arkiv som produceras är oskiljbara.",
+    "seeAlso": "Sidan schemalagda jobb täcker hela flödet, inklusive hur man skapar ett jobb, bifogar det till en befintlig PVE vzdump timer och konfigurerar retentionsvärdena.",
+    "monitorAlt": "ProxMenux Monitor Backups-fliken som visar den nya schemalagda backup-dialogen med destination, profil, schema och fält för bevarande.",
+    "monitorCaption": "Schemalagd säkerhetskopia — ProxMenux Monitor. Samma guidedialog som skapar en manuell säkerhetskopia har fält för schema och bevarande längst ner för obevakad körning."
+  },
+  "matrix": {
+    "heading": "Matrisen med sex alternativ",
+    "intro": "Valet avgör både vilken backend som körs och vilken strategi för sökvägsval som används. Se sidorna för respektive destination för konfigurationsdetaljer om varje cell.",
+    "rows": [
+      {
+        "combo": "1",
+        "destination": "PBS",
+        "profile": "Standard",
+        "action": "Laddar upp standardprofilen och de beständiga tilläggen till ett konfigurerat PBS-arkiv."
+      },
+      {
+        "combo": "2",
+        "destination": "Borg",
+        "profile": "Standard",
+        "action": "Skapar ett arkiv med standardprofilen plus beständiga tillägg i det valda Borg-förvaret."
+      },
+      {
+        "combo": "3",
+        "destination": "Lokal",
+        "profile": "Standard",
+        "action": "Skriver ett <code>.tar.zst</code>-arkiv med standardprofilen plus beständiga tillägg till det konfigurerade lokala målet."
+      },
+      {
+        "combo": "4",
+        "destination": "PBS",
+        "profile": "Anpassad",
+        "action": "Öppnar sökvägsväljaren före uppladdningen till PBS; användaren markerar sökvägar och kan lägga till nya."
+      },
+      {
+        "combo": "5",
+        "destination": "Borg",
+        "profile": "Anpassad",
+        "action": "Öppnar sökvägsväljaren innan Borg-arkivet skapas."
+      },
+      {
+        "combo": "6",
+        "destination": "Lokal",
+        "profile": "Anpassad",
+        "action": "Öppnar sökvägsväljaren innan det lokala <code>.tar.zst</code>-arkivet skrivs."
+      }
+    ]
+  },
+  "profiles": {
+    "heading": "Standard vs anpassad profil",
+    "defaultTitle": "Standardprofil",
+    "defaultBody": "Standardprofilen är den kurerade listan från <code>hb_default_profile_paths</code> (dokumenterad i <em>Hur det fungerar</em> under <em>Sökvägskategorier</em>) plus varje post i den filen med beständiga tillägg <code>/usr/local/share/proxmenux/backup-extra-paths.txt</code>. Användaren bekräftar destinationen och krypteringsalternativen och backupen fortsätter utan ytterligare sökvägsval.",
+    "customTitle": "Anpassad profil",
+    "customBody": "Den anpassade profilen öppnar en checklista med alla sökvägar i standardprofilen (omarkerade) och alla beständiga tillägg (förmarkerade, med prefixet <code>[+]</code>). Användaren markerar sökvägarna för denna körning och kan trycka på <em>Lägg till anpassad sökväg</em> för att lägga till en ny absolut sökväg. Sökvägar som läggs till här sparas i <code>backup-extra-paths.txt</code> så att framtida säkerhetskopior tar med dem automatiskt. Att avmarkera ett beständigt tillägg utesluter det från denna körning men tar inte bort det ur filen — borttagning görs separat via <em>Hantera anpassade sökvägar</em>, utanför säkerhetskopieringsflödet.",
+    "customPickerAlt": "Checklista för anpassad profil med standardprofilens sökvägar (omarkerade) och beständiga tillägg (förmarkerade med prefixet [+]), samt knappar för att lägga till en sökväg eller bekräfta valet.",
+    "customPickerCaption": "Anpassad profil — sökvägsväljaren. Standardprofilens sökvägar är omarkerade; beständiga tillägg är förmarkerade med prefixet [+]. Användaren markerar sökvägarna för denna körning.",
+    "manageCustomAlt": "Menyn för att hantera anpassade sökvägar med listan över beständiga tillägg och alternativ för att lägga till, ta bort eller redigera dem.",
+    "manageCustomCaption": "Hantera anpassade sökvägar — platsen där beständiga tillägg läggs till eller tas bort. Varje sökväg här ingår automatiskt i säkerhetskopior med standardprofilen utan att den anpassade sökvägsväljaren behöver öppnas."
+  },
+  "commonPipeline": {
+    "heading": "Vad som går oavsett destination",
+    "intro": "När profilen har fastställts kör varje backend samma tillfälliga förberedelsesteg innan den går vidare till sin egen uppladdningsmetod. <code>hb_prepare_staging</code> bygger arkivträdet i <code>/tmp/proxmenux-DESTINATION-stage.XXXXXX</code> och fyller vart och ett av de tre datablocken.",
+    "steps": [
+      {
+        "step": "1",
+        "name": "Sammanställning av rootfs",
+        "detail": "Kör <code>rsync -a</code> för varje vald sökväg till <code>staging_root/rootfs/</code>. Databasen pmxcfs i <code>/var/lib/pve-cluster/config.db</code> sparas separat via <code>sqlite3 .backup</code> för att få en konsekvent ögonblicksbild utan att stoppa klustret; hjälpfilerna <code>.db-wal</code> / <code>.db-shm</code> utesluts från rsync. Om <code>sqlite3</code> saknas sparas i stället en fil <code>config.db.raw-fallback</code>, som återställningen använder som databas vid importen. Flyktiga undersökvägar (bash-historik, cache, papperskorg) utesluts från <code>/root/</code>. Sökvägar som saknas i källan registreras i <code>metadata/missing_paths.txt</code> utan att säkerhetskopieringen avbryts."
+      },
+      {
+        "step": "2",
+        "name": "Manifestgenerering",
+        "detail": "<code>build_manifest.sh</code> samordnar de sex insamlingsmodulerna och skriver <code>manifest.json</code> i roten av den tillfälliga katalogen. Om en modul misslyckas får det berörda avsnittet ett dokumenterat tomt standardvärde; manifestet är fortfarande giltigt."
+      },
+      {
+        "step": "3",
+        "name": "Paketinventering",
+        "detail": "<code>apt-mark showmanual</code> fångas verbatim i <code>metadata/packages.manual.list</code>. Komponentstatus är redan inne i det återställda rootfs (<code>components_status.json</code>) eftersom <code>/usr/local/share/proxmenux/</code> är en del av standardprofilen."
+      },
+      {
+        "step": "4",
+        "name": "Information om körningen",
+        "detail": "<code>metadata/run_info.env</code> registrerar säkerhetskopieringens identitet - värdnamn, tidsstämpel, kärnversion - som används av återställningens kompatibilitetskontroll för att bestämma riktningen mellan kärnversionerna."
+      },
+      {
+        "step": "5",
+        "name": "Avisering (start)",
+        "detail": "<code>hb_notify_lifecycle \"start\"</code> utlöses. Om aviseringar är konfigurerade i Monitor skickas händelsen <em>Säkerhetskopiering av värden startad</em> till användaren. Inget skickas om inga kanaler har konfigurerats."
+      }
+    ]
+  },
+  "included": {
+    "heading": "Vad går in och vad stannar ut",
+    "intro": "Varje sökväg i den fastställda profilen (standard + beständiga tillägg + val i anpassat läge) kopieras med <code>rsync -aAXH --numeric-ids</code>. En delad uteslutningslista gäller för varje sökväg, och två kataloger har ytterligare sökvägsspecifika uteslutningar.",
+    "globalTitle": "Globala uteslutningar (tillämpas varje väg)",
+    "globalItems": [
+      "<code>images/</code> - bilddumpar.",
+      "<code>dump/</code> — utdata från vzdump.",
+      "<code>tmp/</code> - tillfälliga filer.",
+      "<code>*.log</code> loggfiler."
+    ],
+    "rootTitle": "<code>/root/</code>-uteslutningar",
+    "rootBody": "<code>/root/</code> ingår i standardprofilen så att användarens skript och konfiguration sparas i arkivet. Flyktiga undersökvägar utesluts:",
+    "rootItems": [
+      "<code>.bash_history</code>",
+      "<code>.cache/</code>",
+      "<code>tmp/</code>",
+      "<code>.local/share/Trash/</code>"
+    ],
+    "proxmenuxTitle": "<code>/usr/local/share/proxmenux/</code>-uteslutningar",
+    "proxmenuxBody": "Denna katalog skickar användarstatus endast - <code>components_status.json</code>, preferenser, post-install cache. Kod som destinationen redan har från sin egen ProxMenux-installation utesluts så att en återställning inte överskriver målets nuvarande binärer med äldre:",
+    "proxmenuxItems": [
+      "<code>restore-pending/</code>, <code>scripts/</code>, <code>web/</code>",
+      "<code>monitor-app/</code>, <code>monitor-app.*/</code>, <code>AppImage/</code>",
+      "<code>images/</code>, <code>json/</code>",
+      "<code>utils.sh</code>, <code>helpers_cache.json</code>",
+      "<code>ProxMenux-Monitor.AppImage*</code>, <code>install_proxmenux*.sh</code>"
+    ],
+    "notInProfileTitle": "Vägar utanför profilen",
+    "notInProfileBody": "Allt som inte anges i <code>hb_default_profile_paths</code> och inte läggs till som en anpassad eller ihållande extra är inte en del av backupen. Anmärkningsvärda exempel:",
+    "notInProfileItems": [
+      "<strong>VM- och LXC-diskar</strong> - hanteras av <code>vzdump</code>, inte av denna funktion. Gästkonfigurationsfiler under <code>/etc/pve/nodes/*/qemu-server/*.conf</code> och <code>lxc/*.conf</code> fångas (de lever under <code>/etc/pve</code>) så återställningen reproducerar inventeringen; diskarna själva är återanslutna från en befintlig vzdump / PBS backup.",
+      "<strong><code>/boot</code> och <code>/boot/efi</code></strong> - kärnbinärer, initramfs och UEFI ESP-partitionen regenereras av målets egen <code>update-initramfs</code>, <code>update-grub</code> eller <code>proxmox-boot-tool refresh</code> efter återställningen. Starthanteraren kopieras aldrig ordagrant.",
+      "<strong>Filsystem för kärnan och systemets körning</strong> — <code>/proc</code>, <code>/sys</code>, <code>/dev</code> och <code>/run</code> är pseudofilsystem som skapas av kärnan och udev; de lagras inte beständigt någonstans.",
+      "<strong>Paketbinärer under <code>/usr/bin</code>, <code>/usr/lib</code>, <code>/lib</code>, <code>/sbin</code></strong> - ominstallerad av målets APT från <code>packages.manual.list</code>.",
+      "<strong><code>/var/log/</code>, <code>/var/tmp/</code>, <code>/var/cache/</code></strong> - per-värd runtime tillstånd, inte återställd.",
+      "<strong><code>/home/USER</code></strong> - inte i standardprofilen. Lägg till det som en anpassad väg när ett system bär hemkataloger som måste överleva en återställning."
+    ],
+    "customPathsTitle": "Hur anpassade vägar hanteras",
+    "customPathsBody": "En anpassad väg som läggs till i anpassat läge eller kvarstår i <code>backup-extra-paths.txt</code> går igenom samma <code>rsync</code>-pipeline som standardprofilvägar. Globala uteslutningar gäller. Om den anpassade vägen råkar vara under <code>/root/</code> eller <code>/usr/local/share/proxmenux/</code> gäller fortfarande de vägspecifika uteslutningarna ovan. Varje arkiverad väg - standard eller anpassad - registreras i <code>metadata/paths_archived.txt</code>. Sökvägar som inte finns på källan registreras i <code>metadata/missing_paths.txt</code> utan att stoppa backupen."
+  },
+  "archiveStructure": {
+    "heading": "Arkivstruktur",
+    "intro": "Den tillfälliga katalog som varje backend skapar har samma struktur oavsett destination. Tar-arkivet, PBS-arkivet <code>.pxar</code> eller Borg-arkivet lagrar detta träd oförändrat.",
+    "tree": "backup-[timestamp]/\n├── manifest.json                  # structured host state (kernel_params, hardware, storage, guests, components, source_host)\n├── metadata/\n│   ├── packages.manual.list       # output of apt-mark showmanual\n│   ├── run_info.env               # hostname, timestamp, kernel version, pmxcfs method\n│   ├── paths_archived.txt         # exact list of paths that reached rootfs/\n│   └── missing_paths.txt          # paths from the profile absent on source\n└── rootfs/\n    ├── etc/                       # /etc/pve, /etc/network, /etc/systemd/network, /etc/ssh, /etc/apt, ...\n    ├── root/                      # /root without volatile subpaths\n    ├── usr/local/                 # /usr/local/bin, /usr/local/sbin, /usr/local/share/proxmenux (state only)\n    └── var/                       # /var/lib/pve-cluster (config.db via sqlite3 .backup), /var/spool/cron/crontabs"
+  },
+  "confirmation": {
+    "heading": "Sammanfattning för bekräftelse",
+    "body": "Innan backend skriver något till destinationen visar ProxMenux en sammanfattande dialog med destinationen, backup-ID eller arkivnamn, krypteringstillstånd och listan över vägar som kopieras. Avbokning här avbryter backupen rent - staging katalogen tas bort av <code>trap</code> kroken på backend funktionen och ingen partiell data når destinationen."
+  },
+  "writing": {
+    "heading": "Skriva till destinationen",
+    "intro": "Efter bekräftelsen kör varje backend sitt eget skrivsteg. Sidorna för destinationerna beskriver hur det fungerar; de gemensamma delarna är loggen, sidofilen och aviseringen om slutförande.",
+    "rows": [
+      {
+        "topic": "Loggfil",
+        "detail": "Varje backend skriver sin fullständiga utdata till <code>/tmp/proxmenux-DESTINATION-backup-YYYYMMDD_HHMMSS.log</code> och, på misslyckande, erbjuder att öppna den i en rullande dialog. Loggsökvägen visas i sammanfattningen endast när filen har innehåll."
+      },
+      {
+        "topic": "Sidecar (endast lokal)",
+        "detail": "<code>hb_write_archive_sidecar</code> släpper en <code>*.proxmenux.json</code> bredvid det lokala arkivet så att Monitor identifierar det som en ProxMenux-värdbackup även efter flytt eller namnbyte."
+      },
+      {
+        "topic": "Avisering (slutförd/misslyckad)",
+        "detail": "<code>hb_notify_lifecycle \"complete\"</code> eller <code>\"fail\"</code> utlöses med varaktighet, arkivstorlek och — vid fel — den sista loggraden som ser ut att beskriva ett fel."
+      }
+    ]
+  },
+  "finishedScreens": {
+    "heading": "Vad en färdig backup ser ut",
+    "intro": "Samma slutförandehändelse uppträder av båda ingångspunkterna. TUI skriver ett sammanfattande block till terminalen; Monitor's Backups-fliken visar körningen i arkivlistan med storlek, varaktighet och statusmärken.",
+    "scriptsAlt": "ProxMenux Scripts TUI visar en färdig värd backup — destination, backup ID, snapshot väg, data storlek, varaktighet och kryptering tillstånd.",
+    "scriptsCaption": "Avslutad backup - ProxMenux Scripts (TUI). Slutförande blocket trycker destinationen, backup-ID, vilket resulterar i snapshot eller arkivnamn, datastorlek, varaktighet och krypteringstillstånd.",
+    "monitorAlt": "ProxMenux Monitor Backups-fliken som visar en färdig värdbackuppost med storlek, varaktighet, metodmärke och krypteringsindikator.",
+    "monitorCaption": "Avslutad backup - ProxMenux Monitor Backups-fliken. Den nya säkerhetskopian visas i arkivlistan med destinationsmetodens märke, storlek, varaktighet och - när det är tillämpligt - krypteringslåsindikatorn."
+  },
+  "whereNext": {
+    "heading": "Nästa steg",
+    "items": [
+      {
+        "label": "Destinationer",
+        "href": "/docs/backup-restore/destinations",
+        "tail": " - konfigurationsdetaljer för Local, PBS och Borg."
+      },
+      {
+        "label": "Planerade jobb",
+        "href": "/docs/backup-restore/scheduled-jobs",
+        "tail": " - kör samma backup obevakad på ett schema istället för interaktivt."
+      },
+      {
+        "label": "Återställande",
+        "href": "/docs/backup-restore/restoring",
+        "tail": " — flödet som förbrukar vad denna sida producerar."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sv/docs/backup-restore/cross-kernel.json b/web/messages/sv/docs/backup-restore/cross-kernel.json
new file mode 100644
index 00000000..2c7ade68
--- /dev/null
+++ b/web/messages/sv/docs/backup-restore/cross-kernel.json
@@ -0,0 +1,170 @@
+{
+  "meta": {
+    "title": "Återställning mellan kärnversioner — riktning, säkert urval och komplettering | ProxMenux",
+    "description": "Hur ProxMenux återställer en värdbackup på ett mål som kör en annan stor kärnversion. Dokument hur riktningen av felmatchen detekteras, det säkra subsetfiltret som hoppar över boot-kritiska vägar när målet kör en nyare kärna än backupen, och den fyrfasiga kärnan-agnostiska hydrering som återanvänder användarjustering som IOMMU, VFIO IDs och anpassade cmdline tokens utan att kopiera kernel-tied filer verbatim.",
+    "ogTitle": "ProxMenux Backup - cross-kernel restaurering och hydrering",
+    "ogDescription": "Återställning mellan kärnversioner med riktningskontroll, säkert urval och kärnoberoende komplettering.",
+    "twitterTitle": "Cross-kernel återställning | ProxMenux",
+    "twitterDescription": "Hur ProxMenux hanterar en återställning när målkärnan skiljer sig från säkerhetskopiorna."
+  },
+  "header": {
+    "title": "Återställning mellan kärnversioner",
+    "description": "Hur ProxMenux hanterar en återställning när målvärden kör en annan kärna från den som spelas in i backupen - särskilt när målet kör en nyare kärna. Dokument hur skillnaden upptäcks, hur startkritiska vägar som kan bryta målet filtreras, och hur användarens egen konfiguration återanvänds utan att kopiera kärnbundna filer verbatim.",
+    "section": "Säkerhetskopiering och återställning"
+  },
+  "intro": {
+    "title": "Varje kärnhopp hanteras annorlunda",
+    "body": "En Proxmox värd kärna identifieras av en version sträng som <code>6.17.13-2-pve</code>. De två första siffrorna (<strong>6.17</strong> i det här exemplet) definierar den stora versionen: när de ändras kan vissa konfigurationsfiler skrivna för den tidigare kärnan inte vara giltiga på den nya. När återställningen upptäcker att backupen och målet har olika stora kärnversioner, flödesgrenarna baserat på hoppets riktning - oavsett om backupen är äldre eller nyare än målet - eftersom de två fallen har motsatta fellägen. Säkerhetskopior nyare än målet återställs rent as-is (bänk-verifierad över flera kärnhopp). Säkerhetskopior äldre än målet behöver ett filter för att undvika att bryta målets start med konfiguration skriven för en kärna som sedan dess har ändrats."
+  },
+  "directionCheck": {
+    "heading": "Riktningskontroll",
+    "intro": "Under kompatibilitetskontrollen jämför <code>hb_compat_check</code> kärnan registrerad i backupens manifest mot målets nuvarande kärna (<code>uname -r</code>) och klassificerar återställningen i ett av tre fall, lagrad i den interna variabla <code>HB_COMPAT_KERNEL_DIRECTION</code>:",
+    "rows": [
+      {
+        "direction": "same",
+        "condition": "Den stora kärnversionen matchar mellan backup och mål.",
+        "behavior": "Det fullständiga återställningsflödet går oförändrat. Inget extra filter, ingen hydrering, inget särskilt meddelande i UI."
+      },
+      {
+        "direction": "bk_newer",
+        "condition": "Säkerhetskopians kärna är NYARE än målets (exempel: säkerhetskopian gjordes på 7.0 och målet kör 6.17).",
+        "behavior": "Hela återställningsflödet körs oförändrat som vid <code>same</code>, utan filter. Rapporterade tester visade ominstallation av drivrutiner för målkärnan, fungerande IOMMU-konfiguration och start av VM:ar med GPU-genomkoppling."
+      },
+      {
+        "direction": "bk_older",
+        "condition": "Säkerhetskopians kärna är ÄLDRE än målets (exempel: säkerhetskopian gjordes på 6.17 och målet kör 7.0).",
+        "behavior": "Det säkra filtret och fyrfasens hydrering nedan aktiveras. Återställningen fortsätter - målet reproducerar källan, men startkritiska filer kopieras inte."
+      }
+    ]
+  },
+  "whyBkNewerIsSafe": {
+    "heading": "Varför en backup med en nyare kärna än målet återställer oförändrad",
+    "body": "När återställningen går mot ett mål med en <em>äldre</em>-kärna än den som spelas in i backupen, är varje mekanism som återställningen beror på oberoende av kärnversionen. GPU-drivrutininstallatörer och andra PCI-enhetsinstallatörer upptäcker körkärnan med <code>uname -r</code> och sammanställer DKMS mot vad målet har. APT-paketet installerar binärer byggda för målets distribution. IOMMU cmdline tokens som <code>intel_iommu=on</code> är stabila över stora kärnversioner. Backupen bär vägar skrivna under en nyare kärna, men de vägar (modul svartlistor, GRUB standarder, initramfs config) är fortfarande giltig syntax på den äldre - kärnor ignorerar tokens de inte känner igen i stället för att misslyckas. Detta fall är likvärdigt i praktiken med en återställning av samma kärna, och ProxMenux behandlar det som sådant."
+  },
+  "safeSubsetFilter": {
+    "heading": "Det säkra filtret (endast när målkärnan är nyare)",
+    "intro": "När målkärnan är nyare än backupen, tillägger kompatibilitetskontrollen 16 boot-kritiska vägar från <code>hb_unsafe_paths_cross_version</code> till <code>RS_SKIP_PATHS</code>. Dessa vägar är uteslutna från återställningen eftersom att skriva en version av dem från en äldre kärna över ett mål som kör en nyare har orsakat kärnpaniker i bänkprov. Vägarna täcker fem kategorier:",
+    "categoryRows": [
+      {
+        "category": "Starthanterare",
+        "paths": "<code>/etc/default/grub</code>, <code>/etc/kernel</code>",
+        "reason": "GRUB standarder knutna till den tidigare kärnordern, och proxmox-boot-tool tillstånd (cmdline, ESP UUID, krokar) som refererar vägar och identifierare från den äldre installationen."
+      },
+      {
+        "category": "Kernel moduler och boot artefakter",
+        "paths": "<code>/etc/modules-load.d</code>, <code>/etc/modprobe.d</code>, <code>/etc/initramfs-tools</code>",
+        "reason": "Autoload listor som kan referera moduler döpt mellan kärn majors, modulalternativ som kanske inte gäller, initramfs krokar skrivna för den äldre kärnan."
+      },
+      {
+        "category": "Lagring stack och filsystem identitet",
+        "paths": "<code>/etc/fstab</code>, <code>/etc/multipath</code>, <code>/etc/iscsi</code>, <code>/etc/udev/rules.d</code>, <code>/etc/zfs</code>",
+        "reason": "UUID som kanske inte finns på denna installation, multipath drivrutiner som ändras mellan kärnor, iSCSI parametrar som utvecklas, udev regler som kan binda till icke-existerande delsystem, ZFS tillstånd (<code>zpool.cache</code> + <code>hostid</code>) som kan låsa poolen som främmande."
+      },
+      {
+        "category": "APT-källor",
+        "paths": "<code>/etc/apt</code>",
+        "reason": "APT-källor kan utlösa en nedgradering av kritiska paket på nästa uppgradering."
+      },
+      {
+        "category": "systemd",
+        "paths": "<code>/etc/systemd/system</code>, <code>/etc/systemd/journald.conf</code>, <code>/etc/systemd/logind.conf</code>, <code>/etc/systemd/system.conf</code>, <code>/etc/systemd/user.conf</code>",
+        "reason": "Enhetsåsidosättningar och .wants-länkar bundna till en äldre huvudversion av systemd samt inställningsnycklar som kanske inte kan tolkas av en nyare version."
+      }
+    ],
+    "outroBody": "Filtret kör FÖRE bekräftelsedialogen så att användaren ser den exakta listan över vägar som kommer att hoppas, kategoriseras av förnuftet. Återställningen fortsätter fortfarande - allt annat (VM-/LXC-konfiguration, nätverk, /etc/pve, användare, cron, ProxMenux tillstånd, paket, drivrutiner, /root) återställs normalt."
+  },
+  "hydration": {
+    "heading": "Kernel-agnostisk hydrering",
+    "intro": "Filtret utelämnar startkritiska filer, så kompletteringen återställer utvalda inställningar: IOMMU-parametrar, VFIO-ID:n, eget <code>GRUB_TIMEOUT</code> och nvidia-spärrlistor. Den körs när målkärnan är nyare. Cmdline-nycklar på målet bevaras och saknade moduler läggs till. Tillåtna GRUB-värden och användarfiler kan ersätta avvikande målinnehåll. Upprepning med samma indata är idempotent.",
+    "phaseRows": [
+      {
+        "phase": "1a - GRUB väg",
+        "detail": "För GRUB-värdar (ext4/lvm). <code>_rs_hyd_grub</code> sammanfogar parametrar från säkerhetskopians <code>manifest.kernel_params.cmdline_extra</code> i målets <code>GRUB_CMDLINE_LINUX_DEFAULT</code> och hoppar över nycklar som redan finns. Därefter återställs tillåtna <code>GRUB_*</code>-nycklar (<code>GRUB_TIMEOUT</code>, <code>GRUB_TIMEOUT_STYLE</code>, <code>GRUB_DEFAULT</code>, <code>GRUB_TERMINAL</code>, <code>GRUB_DISABLE_OS_PROBER</code>, <code>GRUB_SERIAL_COMMAND</code>, <code>GRUB_GFXMODE</code>, <code>GRUB_GFXPAYLOAD_LINUX</code>) från säkerhetskopians <code>/etc/default/grub</code> när värdena skiljer sig från målets."
+      },
+      {
+        "phase": "1b — systemd-boot / ZFS",
+        "detail": "För systemd-boot (vanligen ZFS på roten). <code>_rs_hyd_kernel_cmdline</code> sammanfogar användarparametrar från <code>cmdline_extra</code> i målets <code>/etc/kernel/cmdline</code> och bevarar målets startparametrar <code>root=</code>, <code>boot=</code> och <code>rootflags=</code>."
+      },
+      {
+        "phase": "2 — /etc/modules Sammanslagning",
+        "detail": "<code>_rs_hyd_modules</code> Lägger till moduler från <code>manifest.kernel_params.modules_loaded_at_boot</code> som finns i den vita listan (<code>vfio</code>, <code>vfio_pci</code>, <code>vfio_iommu_type1</code>, <code>vfio_virqfd</code>, <code>kvm</code>, <code>kvm_intel</code>, <code>kvm_amd</code>, <code>nvidia</code>, <code>nvidia_drm</code>, <code>nvidia_modeset</code>, <code>nvidia_uvm</code>, <code>i915</code>, <code>xe</code>) och inte redan närvarande i målets mål <code>/etc/modules</code>."
+      },
+      {
+        "phase": "3 — Kopiera tillåtna filer",
+        "detail": "<code>_rs_hyd_files</code> kopierar användarskrivna filer från staging rootfs till det levande målet när innehållet skiljer sig. Whitelist täcker VFIO/nvidia/blacklist-filer under <code>/etc/modprobe.d</code>, <code>/etc/modules-load.d</code> och ProxMenux VFIO bind regel + nvidia udev regler under <code>/etc/udev/rules.d</code>. Distro-ägda filer (<code>pve-blacklist.conf</code>, <code>mdadm.conf</code>, <code>nvme.conf</code>) är avsiktligt uteslutna - deras innehåll utvecklas mellan releaser."
+      },
+      {
+        "phase": "4 — Framtvinga ombyggnad efter uppstart",
+        "detail": "De fyra faserna skriver direkt till det levande målet UTANFÖR den normala återställningsledningen. För att göra de sammanslagna tokens/modulerna/filerna träder i kraft vid nästa start, <code>HB_HYDRATION_APPLIED=1</code> förökar genom <code>plan.env</code> för att <code>apply_pending_restore.sh</code>, som tvingar <code>NEEDS_INITRAMFS=1</code> och <code>NEEDS_GRUB=1</code> Oavsett vad som fanns i appliceringslistan. Post-boot dispatcher regenererar sedan initramfs och uppdaterar bootloader."
+      }
+    ]
+  },
+  "planCommit": {
+    "heading": "Plan och commit — användaren ser först en förhandsvisning",
+    "body": "Kompletteringen körs i två lägen. Innan bekräftelsedialogen kör ProxMenux <code>_rs_apply_bk_older_hydration</code> i <code>plan</code>-läge: det beräknar exakt vad som skulle slås samman, fyller <code>RS_HYDRATION_SUMMARY</code> med ett grönt block som listar varje åtgärd och returnerar utan att skriva. Bekräftelsedialogen visar att grönt block tillsammans med den gula listan över uteslutna sökvägar, så användaren ser I FÖRVÄG vad som kommer att återanvändas automatiskt. När användaren bekräftar, ProxMenux kör samma hjälpare i <code>commit</code> läge - samma faser, samma logik, men denna gång varje fas skriver till levande mål. Annullera bekräftelsedialogen lämnar målet orört."
+  },
+  "flowDiagram": {
+    "heading": "Flödet när målkärnan är nyare än backupens",
+    "intro": "Stegen som läggs till när målkärnan är nyare sitter inuti det normala återställningsflödet. Allt annat - varmt applicera, i väntan på förberedelse, paketinstallation, post-boot dispatcher - körs identiskt till en same-kernel restaurering.",
+    "diagram": "  ┌────────────────────────────────────────────────────────────┐\n  │ hb_compat_check                                             │\n  │   HB_COMPAT_KERNEL_DIRECTION = bk_older                     │\n  └───────────────────────────┬────────────────────────────────┘\n                              │\n                              ▼\n  ┌────────────────────────────────────────────────────────────┐\n  │ Add 16 boot-critical paths to RS_SKIP_PATHS                 │\n  │   /etc/default/grub, /etc/kernel, /etc/modules-load.d, ...  │\n  └───────────────────────────┬────────────────────────────────┘\n                              │\n                              ▼\n  ┌────────────────────────────────────────────────────────────┐\n  │ _rs_apply_bk_older_hydration \"plan\"                         │\n  │   Compute what would be merged                              │\n  │   Populate RS_HYDRATION_SUMMARY (green block)               │\n  │   No writes                                                 │\n  └───────────────────────────┬────────────────────────────────┘\n                              │\n                              ▼\n  ┌────────────────────────────────────────────────────────────┐\n  │ Confirmation dialog                                         │\n  │   Amber: paths skipped by safe-subset filter                │\n  │   Green: tokens/files reapplied by hydration                │\n  │   User accepts or cancels                                   │\n  └───────────────────────────┬────────────────────────────────┘\n                              │ (accepted)\n                              ▼\n  ┌────────────────────────────────────────────────────────────┐\n  │ _rs_apply_bk_older_hydration \"commit\"                       │\n  │   Phase 1a/1b: merge cmdline tokens + GRUB keys             │\n  │   Phase 2: append modules to /etc/modules                   │\n  │   Phase 3: copy whitelisted vfio/nvidia files               │\n  │   Set HB_HYDRATION_APPLIED=1                                │\n  └───────────────────────────┬────────────────────────────────┘\n                              │\n                              ▼\n  ┌────────────────────────────────────────────────────────────┐\n  │ Rest of the restore runs normally                           │\n  │   _rs_apply hot (skips RS_SKIP_PATHS)                       │\n  │   _rs_prepare_pending_restore (writes plan.env with         │\n  │     HB_HYDRATION_APPLIED=1)                                 │\n  │   packages.manual.list install                              │\n  │   Reboot                                                    │\n  │   apply_pending_restore.sh (forces NEEDS_INITRAMFS=1,       │\n  │     NEEDS_GRUB=1 because of the hydration flag)             │\n  │   apply_cluster_postboot.sh                                 │\n  │     update-initramfs -u -k all                              │\n  │     update-grub / proxmox-boot-tool refresh                 │\n  │     component --auto-reinstall                              │\n  └────────────────────────────────────────────────────────────┘"
+  },
+  "concreteExamples": {
+    "heading": "Konkreta exempel",
+    "intro": "Kompletteringen är inte abstrakt - det ger observerbara, korrekta resultat för vanliga scenarier. Två exempel som hydrering hanterar automatiskt:",
+    "rows": [
+      {
+        "scenario": "GPU-genomkoppling (VFIO)",
+        "detail": "Källan hade <code>intel_iommu=on iommu=pt</code> i cmdline, <code>vfio</code>/<code>vfio_pci</code>/<code>vfio_iommu_type1</code> i <code>/etc/modules</code>, en <code>/etc/modprobe.d/vfio.conf</code> med <code>options vfio-pci ids=10de:2216</code> och en <code>/etc/modprobe.d/blacklist-nvidia.conf</code>. Hydration sammanfogar cmdline-tokens i målets GRUB eller kernel cmdline, appends vfio-modulerna till <code>/etc/modules</code> och kopierar de två användarskrivna modprobe-filerna. På nästa start är IOMMU aktiv, VFIO-moduler laddas, GPU är bunden till vfio-pci och VM kommer upp med genomgående arbete."
+      },
+      {
+        "scenario": "Anpassade GRUB standarder",
+        "detail": "Källan hade <code>GRUB_TIMEOUT=1</code> och <code>GRUB_DISABLE_OS_PROBER=true</code>. Hydration läser båda nycklarna från säkerhetskopieringens <code>/etc/default/grub</code>, ser att de skiljer sig från den färska installationens standarder och skriver om de två linjerna i målets fil (som lämnar allt annat, inklusive <code>GRUB_DISTRIBUTOR</code>, orörd)."
+      }
+    ]
+  },
+  "callout": {
+    "warningTitle": "Vad kompletteringen utelämnar när målkärnan är nyare",
+    "warningBody": "Hydration återanvänder endast konfigurationen ProxMenux vet att vara säker över kärnversioner: IOMMU-tokens, VFIO-ID, vitlistade GRUB-nycklar och moduler från en fast lista (<code>vfio*</code>, <code>nvidia*</code>, <code>i915</code>, <code>xe</code>, <code>kvm*</code>). Allt utanför den uppsättningen - anpassade initramfs krokar under <code>/etc/initramfs-tools/hooks/</code>, icke-vitlistade filer under <code>/etc/modprobe.d/</code>, användarskrivna systemd-enhetsåsidosättningar - förblir uteslutna. Anledningen är konkret: dessa filer kan ringa kärnintern gränssnitt (modul API, <code>/sys</code> layout, <code>udev</code> krokar) som ändras mellan stora versioner och tillämpar dem verbatim över den nyare kärnan kan förhindra att målet startar. När exakt reproduktion av startkedjan krävs måste återställningen köras på en värd med samma stora kärnversion som backup."
+  },
+  "codeReference": {
+    "heading": "Där mekanismerna lever",
+    "intro": "För utvecklare som vill spåra eller förlänga cross-kernel beteende:",
+    "rows": [
+      {
+        "component": "Direktionsdetektering",
+        "location": "<code>hb_compat_check</code> i <code>lib_host_backup_common.sh</code>. Sätter <code>HB_COMPAT_KERNEL_DIRECTION</code>."
+      },
+      {
+        "component": "Sökvägslista för säkert urval",
+        "location": "<code>hb_unsafe_paths_cross_version</code> i <code>lib_host_backup_common.sh</code>. Ger <code>path\\treason</code>-linjer som används av både CLI-filtret och Web endpoint <code>/api/host-backups/restore/prepare</code>."
+      },
+      {
+        "component": "Hydrationsfaser",
+        "location": "<code>_rs_hyd_grub</code>, <code>_rs_hyd_kernel_cmdline</code>, <code>_rs_hyd_modules</code>, <code>_rs_hyd_files</code> i <code>backup_host.sh</code>. Orkestrerad av <code>_rs_apply_bk_older_hydration</code>."
+      },
+      {
+        "component": "Framtvingad ombyggnad efter uppstart",
+        "location": "<code>apply_pending_restore.sh</code> läser <code>HB_HYDRATION_APPLIED</code> från <code>plan.env</code> och tvingar <code>NEEDS_INITRAMFS=1</code>/<code>NEEDS_GRUB=1</code>."
+      },
+      {
+        "component": "Web Preview",
+        "location": "<code>/api/host-backups/restore/prepare</code> i <code>flask_server.py</code>. Läser in hjälpbiblioteket, kör <code>_rs_apply_bk_older_hydration</code> i planläge, returnerar åtgärderna till webbmodalen."
+      }
+    ]
+  },
+  "whereNext": {
+    "heading": "Vart ska man gå nästa",
+    "items": [
+      {
+        "label": "Återställande",
+        "href": "/docs/backup-restore/restoring",
+        "tail": " — Den fullständiga återställningspipeline denna sidas mekanismer ansluter till."
+      },
+      {
+        "label": "Hur det fungerar",
+        "href": "/docs/backup-restore/how-it-works",
+        "tail": " — manifestet och insamlingsrutinerna som skapar blocket <code>kernel_params</code> som kompletteringen läser."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sv/docs/backup-restore/destinations/borg.json b/web/messages/sv/docs/backup-restore/destinations/borg.json
new file mode 100644
index 00000000..d5ee7167
--- /dev/null
+++ b/web/messages/sv/docs/backup-restore/destinations/borg.json
@@ -0,0 +1,234 @@
+{
+  "meta": {
+    "title": "Borg-mål — förvarstyper, SSH-autentisering, kryptering | ProxMenux",
+    "description": "Borg-målet lagrar ProxMenux värdsäkerhetskopior i ett lokalt förvar, på en monterad extern disk eller på en fjärrserver via SSH. Beskriver sökordningen för borg-programmet, de fyra inledande SSH-nyckelalternativen, repokey-kryptering, sparade mål och lagringsregler per schemalagt jobb.",
+    "ogTitle": "ProxMenux Backup - Borg destination",
+    "ogDescription": "Så lagrar ProxMenux värdsäkerhetskopior i Borg-förvar med SSH-autentisering och repokey-kryptering.",
+    "twitterTitle": "Borg som mål för säkerhetskopior | ProxMenux",
+    "twitterDescription": "Lokala, USB och SSH-serverade Borg repositorier för värdbackups."
+  },
+  "header": {
+    "title": "Borg",
+    "description": "Borg-destinationen skriver värdbackups till ett Borg-förvar. Tre förvarstyper stöds: lokal filsystemväg, monterad extern disk eller fjärrserver via SSH. Chunk-nivå deduplicering över alla arkiv i förvaret och valfri repokey kryptering.",
+    "section": "Säkerhetskopiering och återställning"
+  },
+  "aboutBorg": {
+    "heading": "Vad Borg är",
+    "body": "Borg (även stavat BorgBackup) är en öppen källkod som deduplicerar backupverktyg som upprätthålls av Borg Backup community. Det lagrar varje arkiv som en uppsättning av variabel-längd bitar inuti ett arkiv; bitar delas över arkiv så åter backa upp oförändrade data har nästan noll lagringskostnad. Borg är inte knuten till Proxmox - det är ett allmänt ändamål backupverktyg som används i många miljöer. ProxMenux använder den som en av de tre destinationerna för värdbackups; varje Borg-specifik mekanism som beskrivs på denna sida (förvarstyper, borg-serve över SSH, repokey kryptering, beskärning) är standard Borg beteende."
+  },
+  "intro": {
+    "title": "Blockbaserad deduplicering med lokala förvar eller förvar via SSH",
+    "body": "Ett Borg-förvar lagrar block som delas mellan alla arkiv. Att säkerhetskopiera en oförändrad fil igen överför och lagrar därför inga nya data. ProxMenux kör <code>borg create</code> vid säkerhetskopiering och <code>borg extract</code> vid återställning. Förvaret kan ligga på samma filsystem som källan, på en monterad extern disk eller på en fjärrvärd via SSH."
+  },
+  "binarySourcing": {
+    "heading": "Det körbara borg-programmet",
+    "intro": "Borg är inte en bas beroende av ProxMenux installer. När en backup körs, <code>hb_ensure_borg</code> löser binären från fyra källor i ordning och returnerar den första som fungerar:",
+    "rows": [
+      {
+        "priority": "1",
+        "source": "Systemets <code>borg</code>",
+        "detail": "Om värden redan har <code>borg</code> installerat via APT (<code>which borg</code> löser), den binära används."
+      },
+      {
+        "priority": "2",
+        "source": "Cache för tillståndskatalogen",
+        "detail": "<code>/usr/local/share/proxmenux/borg</code> — sparat från en tidigare GitHub-nedladdning på värden."
+      },
+      {
+        "priority": "3",
+        "source": "Monitors AppImage-paket",
+        "detail": "<code>/usr/local/share/proxmenux/monitor-app/usr/bin/borg</code> - den AppImage buntar en signerad borg-linux64. Detta är offline-säker väg: en värd utan internet har fortfarande en fungerande <code>borg</code>."
+      },
+      {
+        "priority": "4",
+        "source": "GitHub nedladdning",
+        "detail": "<code>wget</code> mot <code>borg-linux64</code> URL under <code>github.com/borgbackup/borg/releases/</code>, verifierad mot en konstant SHA-256 i <code>lib_host_backup_common.sh</code> (<code>HB_BORG_LINUX64_SHA256</code>). På checksum missmatch binären kasseras och backupen aborter. Den nedladdade filen är cachad i tillståndskatalogen så efterföljande säkerhetskopior använder sökväg 2."
+      }
+    ]
+  },
+  "repoTypes": {
+    "heading": "Förvarstyper",
+    "intro": "Förvarstypen väljs när ett mål läggs till. Varje typ löser sig till en annan adress som Borg förstår.",
+    "rows": [
+      {
+        "type": "remote",
+        "url": "ssh://USER@HOST/RPATH",
+        "detail": "Repository bor på en fjärrserver som kör <code>borg serve</code>. Kräver en SSH-anslutning till den servern."
+      },
+      {
+        "type": "usb",
+        "url": "/mnt/MOUNTPOINT/borgbackup",
+        "detail": "Repository bor på en monterad extern disk (typiskt USB). Monteringen löses via <code>hb_prompt_mounted_path</code>, som upptäcker, monterar eller formaterar USB-partitioner efter behov."
+      },
+      {
+        "type": "local",
+        "url": "/backup/borgbackup (any absolute path)",
+        "detail": "Repository bor på en lokal katalog. Meningsfullt endast när målkatalogen är på en separat fysisk disk - ett förvar på samma disk som källan skyddar mot operatörsfel men inte mot diskfel."
+      }
+    ]
+  },
+  "serverSetup": {
+    "heading": "Förbereda Borg-servern (server sida)",
+    "intro": "<code>remote</code> repository typ förväntar sig en fungerande Borg server tillgänglig över SSH. ProxMenux startar inte själva servern - den tillåter bara en nyckel mot ett befintligt konto på den. Det här avsnittet dokumenterar vad servern behöver innan ProxMenux kan ansluta.",
+    "hostChoicesTitle": "Där servern kan leva",
+    "hostChoicesBody": "Alla Linux värd med SSH åtkomst kvalificerar. Vanliga inställningar:",
+    "hostChoicesItems": [
+      "En dedikerad NAS eller backup box (Debian, Ubuntu, TrueNAS SCALE med ett skal).",
+      "En LXC-behållare inuti en Proxmox-nod. Litet fotavtryck, isolerat från värden som kör säkerhetskopiorna.",
+      "En annan Proxmox värd på samma LAN, eller en VM var som helst nås över SSH."
+    ],
+    "lxcWarningTitle": "LXC som Borg server",
+    "lxcWarningBody": "Om Borg-servern körs i en LXC kräver generate-auto ett konto som tillåter SSH-inloggning med lösenord när nyckeln installeras. Annars används manuell nyckelinstallation eller alternativet generate-pct via PVE-värden.",
+    "requirementsTitle": "Krav på servern",
+    "requirementsRows": [
+      {
+        "requirement": "Körbart borg-program på <code>/usr/bin/borg</code>",
+        "detail": "<code>command=\"/usr/bin/borg serve ...\"</code>-linjen ProxMenux skriver i <code>authorized_keys</code> hårdkoder som väg. Installera via APT (<code>apt install borgbackup</code>) sätter den där. En fristående binär måste symlinkeras till <code>/usr/bin/borg</code>."
+      },
+      {
+        "requirement": "Ett dedikerat användarkonto (vanligtvis <code>borg</code>)",
+        "detail": "Äger förvarskatalogen och tar emot inkommande SSH-anslutningar. Behöver inte sudo eller skal åtkomst - authorized_keys-linjen inaktiverar interaktiva skal ändå."
+      },
+      {
+        "requirement": "En skrivbar repository katalog",
+        "detail": "Den väg som operatören ger ProxMenux (till exempel <code>/backup/borgbackup</code>) måste finnas på servern och ägas av borganvändaren."
+      },
+      {
+        "requirement": "SSH daemon accepterar borganvändaren",
+        "detail": "<code>PubkeyAuthentication yes</code> (standard). Lösenordsautentisering behövs endast för en-shot <em>generate-auto</em>-flödet - efter att nyckeln är installerad kan servern inaktivera lösenord auth helt."
+      }
+    ],
+    "minimalSetupTitle": "Minimal serverkonfiguration",
+    "minimalSetupBody": "På en Borg-server med Debian eller Ubuntu ger fyra kommandon som root en grundkonfiguration:",
+    "minimalSetupCmd": "apt install borgbackup\nuseradd -m -d /home/borg -s /bin/bash borg\nmkdir -p /backup/borgbackup\nchown borg:borg /backup/borgbackup",
+    "minimalSetupNote": "När servern är förberedd och SSH-lösenordsinloggning är tillgänglig kan <code>generate-auto</code> installera nyckeln via ett konto som får skriva i borg-användarens authorized_keys. Senare säkerhetskopior använder nyckeln, begränsad till <code>borg serve</code> på den konfigurerade sökvägen. Utan lösenordsinloggning installeras nyckeln manuellt eller via PVE-värden."
+  },
+  "sshAuth": {
+    "heading": "SSH autentisering (klientsida)",
+    "intro": "Remote Borg repositorier är tillgängliga över SSH. Anslutningen går från ProxMenux-värden till ett användarkonto på Borg-servern som kör <code>borg serve</code>. Den här användaren heter vanligtvis <code>borg</code>, inte admin/root-användaren av servern - borg-serve-kommandoraden låser anslutningen till den specifika förvaringsbanan (se de viktigaste strategierna nedan).",
+    "strategiesTitle": "SSH-nyckelalternativ",
+    "strategiesIntro": "När ett fjärrmål läggs till frågar ProxMenux efter SSH-användare, värd, port och fjärrsökväg och erbjuder fyra autentiseringsval. Alternativet generate-pct erbjuds om lösenordsautentisering nekas. Lägena beskrivs nedan:",
+    "strategyRows": [
+      {
+        "mode": "generate-auto",
+        "label": "Rekommenderas",
+        "detail": "ProxMenux skapar eller återanvänder ett ed25519-nyckelpar på <code>~/.ssh/borg_proxmenux_HOST_ed25519</code> och använder <code>sshpass</code> för att testa inloggningen och installera den offentliga nyckeln i <code>~borg/.ssh/authorized_keys</code>. Lösenordet tillhör ett konto som får skriva i filen, oftast root eller borg. Det används under installationen och sparas inte."
+      },
+      {
+        "mode": "generate-manual",
+        "label": "Inget admin lösenord på denna värd",
+        "detail": "ProxMenux genererar nyckelparet som ovan men visar hela <code>authorized_keys</code>-linjen för operatören att klistra in manuellt i servern. Admin lösenord lämnar aldrig ProxMenux värd eftersom det aldrig bett om."
+      },
+      {
+        "mode": "generate-pct",
+        "label": "Borg server är en PVE LXC",
+        "detail": "Borg-servern körs inuti en LXC på en PVE-nod. ProxMenux tillåter nyckeln via <code>pct exec</code> från PVE-värden - root på PVE-värden skriver in i LXC <code>~borg/.ssh/authorized_keys</code> utan att behöva SSH i LXC själv."
+      },
+      {
+        "mode": "existing",
+        "label": "Använd en befintlig nyckel",
+        "detail": "ProxMenux skannar <code>/root/.ssh/</code> och <code>$HOME/.ssh/</code> för parseable ed25519/RSA privata nycklar och listar dem. Operatören väljer en eller bläddrar manuellt till en icke-standardväg."
+      },
+      {
+        "mode": "none",
+        "label": "Standard SSH konfig",
+        "detail": "Ingen anpassad nyckel - Borg är beroende av värdens standard SSH-konfiguration (vanligtvis <code>~/.ssh/id_rsa</code> eller en SSH-agent)."
+      }
+    ],
+    "restrictTitle": "authorized_keys-linjen",
+    "restrictBody": "För varje skapad nyckel begränsar raden <code>authorized_keys</code> som ProxMenux skriver på servern nyckeln till följande borg-serve-anrop för den konfigurerade förvarssökvägen:",
+    "restrictLine": "command=\"/usr/bin/borg serve --restrict-to-path RPATH\",restrict PUBKEY",
+    "restrictNote": "<code>command=</code> tvingar varje SSH-session med hjälp av den här nyckeln för att bara köra borg-serve-kommandot; <code>restrict</code> inaktiverar portöverföring, agentöverföring, X11-överföring och PTY-tilldelning. Nyckeln kan inte användas för att öppna ett interaktivt skal på servern eller för att komma åt någon annan förvaringsväg, även om kontot har bredare privilegier."
+  },
+  "savedTargets": {
+    "heading": "Sparade mål",
+    "intro": "Ett sparat mål behåller förvarskonfigurationen under ett tydligt namn, så att uppgifterna inte behöver anges igen. Filer i ProxMenux tillståndskatalog:",
+    "rows": [
+      {
+        "file": "borg-targets.txt",
+        "content": "En linje per mål: <code>NAME|REPO|SSH_KEY_PATH|ENCRYPT_MODE</code>. Läs av <code>hb_collect_borg_configs</code> för att befolka målvalsmenyn."
+      },
+      {
+        "file": "borg-pass-NAME.txt",
+        "content": "Lösenfras för målet som anges som NAME ovan (<code>chmod 600</code>). Finns endast om repokey-kryptering har valts."
+      }
+    ],
+    "outro": "Det är valfritt att spara målet. Om frågan avböjs sparas ingen namngiven målkonfiguration, men en skapad SSH-nyckel tas inte bort. Om repokey aktiveras utan ett sparat mål lagrar ProxMenux ändå lösenfrasen i den äldre filen borg-pass.txt."
+  },
+  "encryption": {
+    "heading": "Kryptering",
+    "body": "Repositorier inleds med ett krypteringsläge via <code>hb_borg_init_if_needed</code>: den moderna <code>borg repo-create -e MODE</code> när den är tillgänglig, eller arvet <code>borg init --encryption=MODE</code>. ProxMenux avslöjar två lägen: <code>repokey</code> (standard) och <code>none</code>. I <code>repokey</code>-läget lagrar Borg krypteringsnyckeln inuti själva förvaret; tillgång kräver en passfras, som ProxMenux uppmanar till två gånger med match validering och lagrar i <code>borg-pass-NAME.txt</code> för sparade mål, annars i den äldre fil som beskrivs ovan. En obligatorisk bekräftelsedialog visas efter passfrasen sparas: passfrasen är det enda sättet att komma åt krypterade arkiv och förlora det gör varje arkiv i förvaret oåterkallelig."
+  },
+  "runtimeEnv": {
+    "heading": "Runtime miljö",
+    "intro": "ProxMenux exporterar följande miljövariabler innan <code>borg</code>. De konfigurerar anslutningen och låser upp förvaret utan att bädda in hemligheter i kommandoraden.",
+    "rows": [
+      {
+        "var": "BORG_RSH",
+        "value": "ssh -i SSH_KEY_PATH -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new [-p PORT]",
+        "purpose": "Fjärrskalskommandot som Borg använder för SSH-förvar. En vald nyckel lägger till identitetsalternativen. När ett mål läggs till med en annan port än standard lägger ProxMenux även till -p PORT; sparade mål, schemalagda jobb och Monitor använder i stället porten i ssh://-URL:en. Utan egen nyckel, och för ett nytt mål med standardport, lämnas variabeln osatt och Borg använder värdens SSH-konfiguration."
+      },
+      {
+        "var": "BORG_PASSPHRASE",
+        "value": "(passfras från borg-pass-NAME.txt)",
+        "purpose": "låser upp repokey. Ange endast när målet använder <code>repokey</code>-kryptering. Aldrig visas i processargumentlistan."
+      },
+      {
+        "var": "BORG_ENCRYPT_MODE",
+        "value": "repokey | none",
+        "purpose": "Används av <code>hb_borg_init_if_needed</code> när du startar ett förvar som ännu inte existerar. Ignorerad av <code>borg create</code> på befintliga repositorier."
+      },
+      {
+        "var": "BORG_RELOCATED_REPO_ACCESS_IS_OK",
+        "value": "yes",
+        "purpose": "Undertrycker den interaktiva prompten Borg höjer när förvaringsadressen skiljer sig från webbadressen som den ursprungligen nåddes från (gemensamt efter ett monteringsnamn eller SSH-värd som nås via ny adress)."
+      },
+      {
+        "var": "BORG_UNKNOWN_UNENCRYPTED_REPO_ACCESS_IS_OK",
+        "value": "yes",
+        "purpose": "Undertrycker den interaktiva prompten Borg höjer första gången ett okrypterat förvar nås från en ny klient."
+      }
+    ]
+  },
+  "archiveFormat": {
+    "heading": "Arkivnamn och retention",
+    "intro": "Varje backup skapar ett nytt arkiv inuti förvaret.",
+    "namePattern": "hostcfg-HOSTNAME-YYYYMMDD_HHMMSS",
+    "retentionBody": "För schemalagda jobb kör <code>run_scheduled_backup.sh</code> <code>borg prune</code> mot förvaret efter varje framgångsrik backup med lagringsvärdena konfigurerade på jobbet (<code>--keep-last</code>, <code>--keep-daily</code>, <code>--keep-weekly</code>). Interaktiva säkerhetskopior inte beskär."
+  },
+  "restoreAccess": {
+    "heading": "Hämta vid återställning",
+    "body": "Återställningsflödet listar arkiv med <code>borg list REPO</code> och extraherar den valda med <code>borg extract REPO::ARCHIVE-NAME</code> i en staging katalog som <code>_rs_check_layout</code> matar till standardåterställning pipeline. För manuell hämtning utanför ProxMenux samma kommandon arbete; det extraherade trädet är den standard tre-payload layout som beskrivs i <em>Hur det fungerar</em>."
+  },
+  "references": {
+    "heading": "Referenser",
+    "intro": "Officiell Borg-dokumentation för komponenterna ProxMenux är beroende av.",
+    "items": [
+      {
+        "label": "Borg dokumentation",
+        "href": "https://borgbackup.readthedocs.io/",
+        "tail": " - huvudingångspunkt som täcker koncept, distribution, snabbstart och varje kommando."
+      },
+      {
+        "label": "borg create",
+        "href": "https://borgbackup.readthedocs.io/en/stable/usage/create.html",
+        "tail": " - kommandot ProxMenux åberopar varje backup, med alla stödda flaggor."
+      },
+      {
+        "label": "Repository kryptering",
+        "href": "https://borgbackup.readthedocs.io/en/stable/usage/init.html#encryption-mode",
+        "tail": " - krypteringslägen Borg stöder, inklusive repokey som ProxMenux använder som standard."
+      },
+      {
+        "label": "borg serve och driftsättning via SSH",
+        "href": "https://borgbackup.readthedocs.io/en/stable/deployment/central-backup-server.html",
+        "tail": " - hur man ställer in en central Borg-server som nås över SSH, inklusive borg-serve-kommandot och restrict-to-path-flaggan ProxMenux skriver i authorized_keys."
+      },
+      {
+        "label": "borg prune",
+        "href": "https://borgbackup.readthedocs.io/en/stable/usage/prune.html",
+        "tail": " — lagringsreglerna bakom --keep-last / --keep-daily / --keep-weekly som ProxMenux tillämpar per schemalagt jobb."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sv/docs/backup-restore/destinations/index.json b/web/messages/sv/docs/backup-restore/destinations/index.json
new file mode 100644
index 00000000..793321f9
--- /dev/null
+++ b/web/messages/sv/docs/backup-restore/destinations/index.json
@@ -0,0 +1,110 @@
+{
+  "meta": {
+    "title": "Destinationer för säkerhetskopior — lokalt, Proxmox Backup Server, Borg | ProxMenux",
+    "description": "Tre lagringsbackender tar emot samma säkerhetskopieringsinnehåll från ProxMenux: ett lokalt .tar.zst-arkiv på ett skrivbart filsystem, en PBS-säkerhetskopia i en Proxmox Backup Server-datastore eller ett Borg-arkiv i ett lokalt eller fjärranslutet Borg-arkivlager. Varje backend har egna egenskaper för komprimering, deduplicering, kryptering och nätverk.",
+    "ogTitle": "ProxMenux mål för säkerhetskopior",
+    "ogDescription": "Lokal, Proxmox Backup Server och Borg - tre lagringsbackends för samma värdbackup payload.",
+    "twitterTitle": "Destinationer för ProxMenux-säkerhetskopior | ProxMenux",
+    "twitterDescription": "Lokal arkiv, Proxmox Backup Server och Borg backends för värdbackups."
+  },
+  "header": {
+    "title": "Destinationer",
+    "description": "Tre lagringsbackends som stöds av ProxMenux Backup: lokal arkiv, Proxmox Backup Server (rekommenderas) och Borg. Varje får samma tre-payload arkiv; de skiljer sig i lagringsformat, deduplicering, krypteringsmodell och nätverkskrav.",
+    "section": "Säkerhetskopiering och återställning"
+  },
+  "intro": {
+    "title": "Samma nyttolast, tre backends",
+    "body": "Varje säkerhetskopia skapar samma tre datablock (rootfs, manifest, program). Det som skiljer destinationerna åt är hur innehållet lagras och hämtas inför en återställning. Varje backend är en separat funktion i <code>backup_host.sh</code> — <code>_bk_local</code>, <code>_bk_pbs</code>, <code>_bk_borg</code> — men alla tre använder samma tillfälliga förberedelsesteg (<code>hb_prepare_staging</code>) och samma återställningskod. Valet av destination påverkar bara skrivning och hämtning; det ändrar inte hur återställningen fungerar eller använder arkivet."
+  },
+  "comparison": {
+    "heading": "Funktionsjämförelse",
+    "intro": "Följande tabell listar de konkreta skillnaderna mellan de tre backends som de beter sig i ProxMenux idag. Alla värden beskriver observerat beteende av backend själv, inte redaktionella rekommendationer.",
+    "rows": [
+      {
+        "feature": "Lagringsformat",
+        "local": "Enkel <code>.tar.zst</code>-fil (eller <code>.tar.gz</code> om <code>zstd</code> är frånvarande).",
+        "pbs": "PBS-säkerhetskopia (<code>.pxar</code>-block i datastoren).",
+        "borg": "Borg arkiv inuti ett Borg-förvar (segmentfiler)."
+      },
+      {
+        "feature": "Kompression",
+        "local": "zstd (standardnivå) via <code>tar --zstd</code>. gzip fallback.",
+        "pbs": "Hanteras av proxmox-backup-client. ProxMenux åsidosätter inte komprimeringsinställningarna.",
+        "borg": "Borgs inbyggda komprimering. ProxMenux anropar borg create utan att åsidosätta komprimeringsinställningarna."
+      },
+      {
+        "feature": "Deduplicering",
+        "local": "Ingen. Varje backup är ett fullt oberoende arkiv.",
+        "pbs": "Full chunk-nivå deduplicering över alla säkerhetskopior i databutiken.",
+        "borg": "Full chunk-nivå deduplicering över alla arkiv i förvaret."
+      },
+      {
+        "feature": "Kryptering i vila",
+        "local": "Ingen (förlitar sig på skydd av filsystemnivå).",
+        "pbs": "Valfri kryptering på klientsidan med en nyckelfil. När den är aktiverad laddas återställningsbloben upp som en separat säkerhetskopieringsgrupp.",
+        "borg": "Valfri repokey kryptering (nyckel lagrad i repan, upplåst med en passfras)."
+      },
+      {
+        "feature": "Bevarande / rensning",
+        "local": "Tillämpas per schemalagt jobb via <code>KEEP_LAST</code>. Gamla arkiv tas bort tillsammans med sina sidofiler och körningsloggar. Interaktiva säkerhetskopior utför ingen rensning.",
+        "pbs": "Tillämpas per schemalagt jobb via <code>proxmox-backup-client prune --keep-last / --keep-daily / --keep-weekly</code>. Interaktiva säkerhetskopior utför ingen rensning.",
+        "borg": "Tillämpas per schemalagt jobb via <code>borg prune --keep-last / --keep-daily / --keep-weekly</code>. Interaktiva säkerhetskopior utför ingen rensning."
+      },
+      {
+        "feature": "Nätverk",
+        "local": "Ingen. Skriver till en lokal monteringspunkt (vanligtvis en intern disk eller en USB-enhet).",
+        "pbs": "TCP till PBS-servern (standardport 8007). Kräver PBS-uppgifter + fingeravtryck.",
+        "borg": "Lokal filsystemväg eller SSH tunnel till en avlägsen Borg värd."
+      },
+      {
+        "feature": "Beroenden",
+        "local": "<code>tar</code>, <code>zstd</code> (på Proxmox som standard).",
+        "pbs": "Paketet <code>proxmox-backup-client</code> (medföljer Proxmox VE 8+).",
+        "borg": "<code>borg</code> binär. Autotillhandahållen av ProxMenux från Monitor AppImage-paketet när det saknas."
+      },
+      {
+        "feature": "Åtkomst för återställning",
+        "local": "Alla värdar med tar+zstd kan extrahera arkivet. Inget PBS/Borg behövs.",
+        "pbs": "Kräver <code>proxmox-backup-client</code>, PBS-inloggningsuppgifter och nyckelfilen (om säkerhetskopian är krypterad).",
+        "borg": "Kräver <code>borg</code> + sökvägen till arkivlagret + passfrasen (om krypterad)."
+      }
+    ],
+    "captionCode": "feature",
+    "captionLocal": "Lokal",
+    "captionPbs": "Proxmox Backup Server (rekommenderas)",
+    "captionBorg": "Borg"
+  },
+  "sameArchive": {
+    "heading": "Arkivlayouten ändras inte med destinationen",
+    "body": "Alla tre destinationerna innehåller samma struktur med <code>rootfs/</code> + <code>metadata/</code> + <code>manifest.json</code> som beskrivs i <em>Så fungerar det</em>. Ett uppackat lokalt <code>.tar.zst</code>-arkiv, ett <code>.pxar</code>-arkiv återställt från PBS och ett Borg-arkiv uppackat med <code>borg extract</code> ger samma katalogträd. Återställningskoden (<code>_rs_check_layout</code>, <code>_rs_apply</code>, <code>_rs_prepare_pending_restore</code>) läser samma tre datablock utan att behöva veta vilken destination de kommer från."
+  },
+  "extractStandalone": {
+    "heading": "Extrahera en backup utanför ProxMenux",
+    "intro": "Alla tre arkivformat kan läsas med standardverktyg utan ProxMenux installerat på läsvärden. Kommandona nedan producerar samma katalogträd som en återställning konsumerar internt.",
+    "localCmd": "# From a local .tar.zst archive:\ntar --zstd -xf hostcfg-HOST-TIMESTAMP.tar.zst\n\n# From a .tar.gz fallback:\ntar -xzf hostcfg-HOST-TIMESTAMP.tar.gz",
+    "pbsCmd": "# From a PBS backup (requires proxmox-backup-client):\nproxmox-backup-client restore \\\n    --repository USER@REALM@HOST:DATASTORE \\\n    host/hostcfg-HOST/BACKUP-TIME \\\n    hostcfg.pxar /tmp/hostcfg\n\n# Add --keyfile KEY-PATH when the backup is encrypted.",
+    "borgCmd": "# Från ett Borg-arkiv (kräver borg och passfrasen för krypterade arkivlager):\nborg extract REPO-PATH::ARCHIVE-NAME\n\n# Från ett fjärranslutet arkivlager via SSH:\nborg extract ssh://USER@HOST:PORT/REPO-PATH::ARCHIVE-NAME",
+    "note": "Det extraherade trädet kan sedan inspekteras manuellt eller matas till en manuell återställning. Se de enskilda destinationssidorna för det exakta hämtningsflödet ProxMenux använder under huven."
+  },
+  "whereNext": {
+    "heading": "Detaljer per destination",
+    "intro": "Varje destination har sin egen sida som täcker konfigurationsflödet, on-disk-formatet och hämtningskommandot som används av återställningen.",
+    "items": [
+      {
+        "label": "Lokalt arkiv",
+        "href": "/docs/backup-restore/destinations/local",
+        "tail": " — förkonfigurera ett lokalt mål, montera USB-enheter, skydd mot att arkivet inkluderar sig självt samt JSON-sidofilen som låter Monitor identifiera filen."
+      },
+      {
+        "label": "Proxmox Backup Server (rekommenderas)",
+        "href": "/docs/backup-restore/destinations/pbs",
+        "tail": " — val av datastore, inloggningsuppgifter och certifikatets fingeravtryck, nyckelfilens livscykel, återställningspassfras samt uppladdning av återställningsbloben till PBS för återställning efter en nyinstallation."
+      },
+      {
+        "label": "Borg",
+        "href": "/docs/backup-restore/destinations/borg",
+        "tail": " — lokala arkivlager och arkivlager via SSH, var Borg-binären hämtas (system / cache / Monitors AppImage-paket / GitHub), initiering av arkivlager, hantering av passfraser och SSH-nycklar för fjärranslutna arkivlager."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sv/docs/backup-restore/destinations/local.json b/web/messages/sv/docs/backup-restore/destinations/local.json
new file mode 100644
index 00000000..858d0b06
--- /dev/null
+++ b/web/messages/sv/docs/backup-restore/destinations/local.json
@@ -0,0 +1,75 @@
+{
+  "meta": {
+    "title": "Lokalt arkivmål — tar.zst på ett filsystem eller en USB-enhet | ProxMenux",
+    "description": "Det lokala säkerhetskopieringsmålet skriver ett enda .tar.zst-arkiv till en skrivbar katalog: en intern disk, en Proxmox-monteringspunkt, en NFS-delning eller en USB-enhet. Sidan beskriver konfigurationen, hur USB-enheter upptäcks och monteras, skyddet mot att skriva arkivet till en sökväg som säkerhetskopieras samt JSON-sidofilen som identifierar arkivet.",
+    "ogTitle": "ProxMenux Backup - Lokal arkiv destination",
+    "ogDescription": "Hur ProxMenux skriver lokala säkerhetskopior som .tar.zst arkiv och hur man konfigurerar destinationskatalogen eller USB-enheten.",
+    "twitterTitle": "Lokal backup destination | ProxMenux",
+    "twitterDescription": "Hur ProxMenux skriver lokala säkerhetskopior som .tar.zst arkiv på ett filsystem eller USB-enhet."
+  },
+  "header": {
+    "title": "Lokalt arkiv",
+    "description": "Det lokala målet skriver ett enda komprimerat tar-arkiv till en skrivbar katalog på värden: en intern disk, ett monterat NFS- eller SMB-filsystem eller en USB-enhet.",
+    "section": "Säkerhetskopiering och återställning"
+  },
+  "intro": {
+    "title": "En fristående fil",
+    "body": "En lokal säkerhetskopia producerar en enda <code>hostcfg-HOST-TIMESTAMP.tar.zst</code>-fil (eller <code>.tar.gz</code> när <code>zstd</code> är frånvarande). Filen innehåller hela arkivträdet - <code>manifest.json</code>, <code>metadata/</code> och <code>rootfs/</code> - och kan återställas på någon Proxmox värd med ProxMenux återställningsflöde, eller extraheras manuellt med <code>tar --zstd -xf</code> på alla Linux-system. Ingen server, ingen initiering av arkivlager, inget externt beroende. Detta är destinationen med den kortaste återhämtningsvägen när varken PBS eller Borg är tillgänglig."
+  },
+  "targetConfig": {
+    "heading": "Konfigurera målkatalogen",
+    "intro": "Det lokala målet är en <strong>enda sparad målkatalog</strong> — inte en lista. ProxMenux sparar användarens val i <code>/usr/local/share/proxmenux/local-target.conf</code> och läser det vid varje säkerhetskopiering. Om inget mål har konfigurerats används standardvärdet <code>HB_LOCAL_TARGET_DEFAULT = /var/lib/vz/dump</code> (samma katalog som Proxmox använder för sina egna <code>vzdump</code>-utdata). Målet konfigureras via <em>Konfigurera säkerhetskopieringsmål → Lokala mål</em>:",
+    "options": [
+      "<strong>Använd standard (<code>/var/lib/vz/dump</code>).</strong> Proxmox lokal lagring. Finns på varje Proxmox-installation; arkivet sitter bredvid vzdump-utdata och hämtas av fliken Monitor's Backups automatiskt.",
+      "<strong>Ange en anpassad sökväg.</strong> Alla absoluta filsystemsökvägar kan användas: en NFS-montering, en SMB-delning monterad via <code>fstab</code>, ett särskilt ZFS-dataset eller en andra intern disk. ProxMenux kontrollerar att sökvägen finns och är en katalog innan valet sparas.",
+      "<strong>Välj en USB-enhet.</strong> Öppnar USB-undermenyn (nedan), som upptäcker flyttbara enheter och erbjuder sig att montera eller formatera en."
+    ]
+  },
+  "usbFlow": {
+    "heading": "USB-enhetsdetektering och montering",
+    "intro": "USB-undermenyn listar partitioner på flyttbara enheter som rapporteras av <code>lsblk</code>. Varje partition visas med storlek, filsystemets etikett och aktuellt tillstånd. Tillståndet avgör vilken åtgärd ProxMenux erbjuder.",
+    "statesTitle": "De tre enhetstillstånden",
+    "stateRows": [
+      {
+        "state": "monterad",
+        "shown": "Storlek · etikett · [fstype] · → /mount/point",
+        "action": "Partitionen är redan monterad. Om den väljs sparas dess aktuella monteringspunkt som lokalt mål. Ingen ny montering utförs."
+      },
+      {
+        "state": "ej monterad",
+        "shown": "Storlek · etikett · [fstype] · (ej monterad — kommer att monteras)",
+        "action": "Ett filsystem är närvarande men inte monterat. På bekräftelse kör ProxMenux <code>hb_mount_usb_partition</code>: skapar <code>/mnt/backup-LABEL</code> (eller en UUID-baserad väg om det inte finns någon etikett), monterar partitionen och sparar monteringspunkten som det lokala målet."
+      },
+      {
+        "state": "tom",
+        "shown": "Storlek · rå USB-disk — inget filsystem (kommer att FORMATERAS)",
+        "action": "Enheten har inget filsystem. Denna destruktiva åtgärd skyddas av två bekräftelser. Först förklarar en Ja/Nej-dialog att disken raderas. Sedan måste användaren <strong>skriva den exakta enhetssökvägen</strong> (t.ex. <code>/dev/sdb</code>) innan ProxMenux skapar en ny GPT med en ext4-partition och monterar den."
+      }
+    ],
+    "notMountedFallback": "Om ingen USB-enhet upptäcks visar undermenyn ett vanligt inmatningsfält. Användaren kan ange valfri sökväg till en monteringspunkt; om sökvägen inte är en registrerad monteringspunkt visas en varning i en bekräftelsedialog innan processen fortsätter."
+  },
+  "safetyCheck": {
+    "heading": "Säkerhetskontroll - destination inuti en backupbana",
+    "body": "Innan du skriver arkivet, verifierar <code>_bk_local</code> att destinationskatalogen <strong>inte</strong> är en undersökväg till någon katalog som säkerhetskopieras. Ett vanligt misstag skulle vara att lägga till <code>/root</code> till profilen och välja <code>/root/backups</code> som destination — arkivet skulle då inkludera sig självt, antingen producera ett korrupt arkiv eller växa utan gräns tills skivan fylls. Kontrollen löser båda sökvägarna med <code>readlink -m</code>, jämför dem och, vid konflikt, avbryter säkerhetskopieringen med en dialogruta som namnger den motstridiga sökvägen och listar tre sätt att lösa den: välj en destination utanför den motstridiga sökvägen, ta bort den anpassade posten som innehåller destinationen, eller använd anpassat läge för att avmarkera den motstridiga sökvägen för denna körning."
+  },
+  "archiveFormat": {
+    "heading": "Arkivformat och komprimering",
+    "intro": "Utdatafilnamnet bäddar in källvärdnamnet och backup timestamp så att en katalog med flera arkiv sorterar kronologiskt och varje fil är självidentifierande.",
+    "namePattern": "hostcfg-HOSTNAME-YYYYMMDD_HHMMSS.tar.zst",
+    "compressionTitle": "Kompression",
+    "compressionBody": "Huvudmetoden använder <code>tar --zstd -cf</code> — ett enda kommando som komprimerar med zstd:s standardnivå. Om <code>zstd</code> saknas på källan (ovanligt på Proxmox, men möjligt på minimala installationer) används <code>gzip</code>. Om <code>pv</code> finns vid denna reservmetod läggs en förloppsindikator till så att användaren ser arkivstorleken växa i realtid; utan <code>pv</code> används vanlig <code>tar -czf</code> utan förloppsutdata.",
+    "sourceTitle": "Vad går in i arkivet",
+    "sourceBody": "Kommandot tar anropas med <code>-C \"$staging_root\" .</code> och arkiverar därmed <strong>hela roten i den tillfälliga katalogen</strong>: <code>rootfs/</code>, <code>metadata/</code> och <code>manifest.json</code>. Alla tre datablocken ligger bredvid varandra högst upp i tar-arkivet. Uppackningen ger exakt samma träd som återställningskoden använder."
+  },
+  "sidecar": {
+    "heading": "JSON-sidofilen",
+    "intro": "Varje framgångsrik lokal backup producerar en följeslagare fil: <code>HOSTNAME-TIMESTAMP.tar.zst.proxmenux.json</code>, skriven bredvid arkivet av <code>hb_write_archive_sidecar</code>. Denna lilla JSON-fil låter ProxMenux Monitor identifiera arkivet som en ProxMenux-värdbackup även om det senare flyttas, bytas namn eller arkiveras någon annanstans.",
+    "contentTitle": "Sidofilens innehåll",
+    "contentBody": "Sidofilen lagrar schemaversionen, om säkerhetskopian kom från en interaktiv körning eller ett schemalagt jobb (<code>kind</code>), jobb-ID för schemalagda körningar, det profilläge som används (<code>default</code> eller <code>custom</code>), källvärdnamnet, den ursprungliga arkivbasnamnet, en tidsstämpel för skapandet i ISO-8601-format och arkivstorleken i byte.",
+    "whyBody": "Monitors Backups-flik söker igenom konfigurerade lokala kataloger efter <code>*.proxmenux.json</code>-sidofiler, inte efter <code>*.tar.zst</code>-filer, eftersom en <code>.tar.zst</code> utan sidofil kanske inte är en ProxMenux-säkerhetskopia. Sökningen är snabb (JSON-filer är små) och kopplingen fungerar även efter namnbyte om sidofilen får ett motsvarande nytt namn."
+  },
+  "restoreAccess": {
+    "heading": "Återställande från ett lokalt arkiv",
+    "body": "ProxMenux återställningsflödet upptäcker lokala arkiv genom att skanna det konfigurerade lokala målet efter sidofiler och visa dem i arkivlistan. Valet av ett arkiv utlöser <code>_rs_check_layout</code>, som extraherar tarball i en staging katalog och bekräftar strukturen med tre datablock innan du fortsätter. För manuell utvinning utanför ProxMenux ger <code>tar --zstd -xf hostcfg-HOSTNAME-TIMESTAMP.tar.zst -C /tmp/hostcfg</code> samma träd som återställningskoden förbrukar."
+  }
+}
diff --git a/web/messages/sv/docs/backup-restore/destinations/pbs.json b/web/messages/sv/docs/backup-restore/destinations/pbs.json
new file mode 100644
index 00000000..2fe4d02b
--- /dev/null
+++ b/web/messages/sv/docs/backup-restore/destinations/pbs.json
@@ -0,0 +1,113 @@
+{
+  "meta": {
+    "title": "Proxmox Backup Server destination - förvar, kryptering, återhämtning | ProxMenux",
+    "description": "PBS-målet lagrar ProxMenux värdsäkerhetskopior som PBS-säkerhetskopior. Sidan beskriver automatisk identifiering från /etc/pve/storage.cfg, manuell PBS-konfiguration, uppladdning av .pxar, klientkryptering med nyckelfil och en valfri återställningskopia skyddad med lösenfras samt återställning av nyckeln från flera källor på en nyinstallerad värd.",
+    "ogTitle": "ProxMenux Backup - Proxmox Backup Server destination",
+    "ogDescription": "Hur ProxMenux skriver värdbackups till Proxmox Backup Server med klient-side keyfile kryptering och återhämtning escrow.",
+    "twitterTitle": "PBS som mål för säkerhetskopior | ProxMenux",
+    "twitterDescription": "Proxmox Backup Server som mål med nyckelfilskryptering och en återställningskopia skyddad med lösenfras."
+  },
+  "header": {
+    "title": "Proxmox Backup Server",
+    "description": "PBS-målet laddar upp hela förberedelsekatalogen som en enda .pxar-säkerhetskopia till ett Proxmox Backup Server-datalager. Klientkryptering med nyckelfil är valfri, liksom uppladdning av en återställningskopia av nyckelfilen, skyddad med lösenfras, bredvid varje säkerhetskopia.",
+    "section": "Säkerhetskopiering och återställning"
+  },
+  "recommendedBadge": "Rekommenderad destination",
+  "aboutPbs": {
+    "heading": "Vad Proxmox Backup Server är",
+    "body": "Proxmox Backup Server (PBS) är Proxmox egen backup server produkt, utvecklad och underhålls av samma team som författare Proxmox VE. Det är en dedikerad säkerhetskopieringsserver utformad för att ta emot säkerhetskopior från Proxmox VE-värdar (VM, LXCs och - via <code>proxmox-backup-client</code> - godtyckliga värdkataloger) med chunk-baserad deduplicering, klient-side-kryptering och lagringspolicy tillämpad server-side. ProxMenux använder PBS som en av de tre destinationerna för värdbackups; varje PBS-specifik mekanism som beskrivs på denna sida (backupgrupper, <code>.pxar</code> arkiv, <code>--backup-id</code>, keyfile kryptering) är standard PBS beteende."
+  },
+  "intro": {
+    "title": "En säkerhetskopia per körning, deduplicering på blocknivå",
+    "body": "En PBS-säkerhetskopia skapar en enda post i datalagret under säkerhetskopierings-ID:t <code>host/hostcfg-HOSTNAME/BACKUP-TIME</code>. Innehållet är ett <code>.pxar</code>-arkiv med samma struktur i tre delar som beskrivs i <em>Så fungerar det</em>. PBS deduplicerar block mellan alla säkerhetskopior i datalagret, så senare säkerhetskopior av samma värd överför och lagrar endast ändrade block. ProxMenux tillämpar själv lagringsreglerna för schemalagda jobb: efter varje lyckad körning kör <code>run_scheduled_backup.sh</code> kommandot <code>proxmox-backup-client prune</code> med <code>--keep-last</code> / <code>--keep-daily</code> / <code>--keep-weekly</code> och jobbets inställda värden."
+  },
+  "repoSelection": {
+    "heading": "Repository urval",
+    "intro": "ProxMenux upptäcker PBS repositorier från två källor på varje backup. Operatören väljer en från en enhetlig meny; valet bestämmer <code>HB_PBS_REPOSITORY</code>, <code>HB_PBS_SECRET</code> och <code>HB_PBS_FINGERPRINT</code> för körningen.",
+    "sourceRows": [
+      {
+        "source": "Proxmox storage.cfg (identifierad automatiskt)",
+        "path": "/etc/pve/storage.cfg + /etc/pve/priv/storage/NAME.pw",
+        "content": "Varje <code>pbs:</code>-avsnitt i Proxmox egen lagringskonfiguration identifieras automatiskt. Server, datalager, användarnamn och fingeravtryck hämtas från avsnittet. Lösenordet läses från Proxmox egen katalog för inloggningsuppgifter. Uppgifterna behöver inte anges på nytt i ProxMenux; förvaret är tillgängligt så snart det har konfigurerats i Proxmox."
+      },
+      {
+        "source": "ProxMenux manuell konfig",
+        "path": "/usr/local/share/proxmenux/pbs-manual-configs.txt + pbs-pass-NAME.txt + pbs-fingerprint-NAME.txt",
+        "content": "Läggs till via <em>Konfigurera säkerhetskopieringsmål → PBS-mål → Lägg till PBS</em>. Du anger namn, användarnamn (<code>root@pam</code> eller <code>user@pbs!token</code>), värd eller IP-adress, datalager och lösenord. Om lösenordet lämnas tomt visas frågan igen; annars skulle en tom uppgift sparas utan varning och alla senare säkerhetskopior misslyckas med ett otydligt autentiseringsfel. Detta används när PBS-målet inte är registrerat som Proxmox-lagring."
+      }
+    ],
+    "menuTitle": "Urvalsmenyn",
+    "menuBody": "Båda källorna visas i en enda meny, varje rad märkt med sitt ursprung (<code>[proxmox]</code> eller <code>[manual]</code>). Anteckningar vars lösenord inte kunde lösas är taggade med en <code>⚠ no password</code>-varning - välja en utlöser ett lösenord återinträde innan backupen startar. Fingeravtrycket överförs till <code>proxmox-backup-client</code> via <code>PBS_FINGERPRINT</code>-miljövariabeln; när det saknas frågar klienten operatören att acceptera servercertifikatet interaktivt på den första säkerhetskopian."
+  },
+  "backupCommand": {
+    "heading": "Backup kommandot",
+    "intro": "Uppladdningen sker med ett enda anrop till <code>proxmox-backup-client backup</code>. ProxMenux använder <code>env</code> för att överföra lösenord, krypteringslösenord och fingeravtryck till klienten som miljövariabler.",
+    "cmd": "env \\\n    PBS_PASSWORD=\"$HB_PBS_SECRET\" \\\n    PBS_ENCRYPTION_PASSWORD=\"$HB_PBS_ENC_PASS\" \\\n    PBS_FINGERPRINT=\"$HB_PBS_FINGERPRINT\" \\\n    proxmox-backup-client backup \\\n        hostcfg.pxar:$staging_root \\\n        --repository USER@REALM@HOST:DATASTORE \\\n        --backup-type host \\\n        --backup-id  hostcfg-HOSTNAME \\\n        --backup-time BACKUP-EPOCH \\\n        [--keyfile /usr/local/share/proxmenux/pbs-key.conf]",
+    "backupIdTitle": "Namnge säkerhetskopierings-ID",
+    "backupIdBody": "Standard-ID är <code>hostcfg-HOSTNAME</code>. Operatören bekräftar eller redigerar det före uppladdning; tecken utanför <code>[A-Za-z0-9_-]</code> och avslutande bindestreck tas bort. Att återanvända samma ID är avsiktligt: PBS behandlar ID:t som en <em>grupp</em>, och varje senare säkerhetskopia blir en ny post i gruppen med gemensam deduplicering med tidigare körningar.",
+    "pxarTitle": "Varför källan är hela staging roten",
+    "pxarBody": "<code>.pxar</code>-källan är hela <code>staging_root</code> - <code>rootfs/</code>, <code>metadata/</code> och <code>manifest.json</code> tillsammans. Tidigare versioner passerade <code>$staging_root/rootfs</code> som källa; som lämnade <code>metadata/</code> ur arkivet och återställningens kompatibilitetskontroll hade ingenting att läsa, försämrade att korsa värd varningar även på samma värd återställningar. Gamla säkerhetskopior som skapats med rootfs-bara källan återställs fortfarande korrekt via <code>_rs_check_layout</code>: s fall-3 gren, som lindrar en platt <code>etc/var/root/usr</code> träd tillbaka till en <code>rootfs/</code> hierarki."
+  },
+  "encryption": {
+    "heading": "Klient-side kryptering",
+    "glossaryHint": "Avsnittet använder termerna <em>nyckelfil</em>, <em>lösenfras</em> och <em>återställningskuvert</em>. <glosarioLink>Ordlistan</glosarioLink> sammanfattar skillnaderna med en mening per term.",
+    "intro": "PBS klientkryptering med nyckelfil krypterar blocken på källvärden före uppladdning. Kryptering är valfri i ProxMenux. När den aktiveras väljer operatören uttryckligen ja eller nej till att även lagra en återställningskopia av nyckelfilen, skyddad med lösenfras, på PBS. Valet kan ändras senare i Monitor. Själva nyckelfilen finns alltid på den kanoniska sökvägen <code>/usr/local/share/proxmenux/pbs-key.conf</code> och återanvänds utan nya frågor vid varje senare krypterad säkerhetskopiering.",
+    "keyfileTitle": "Ställ in nyckelfilen",
+    "keyfileBody": "Krypteringsdialogen visas vid värdens första krypterade säkerhetskopiering. Först frågar den om säkerhetskopian ska krypteras: <em>Nej</em> fortsätter utan kryptering och <em>Ja</em> går till steg två. Det steget beror på om en nyckelfil redan finns på <code>/usr/local/share/proxmenux/pbs-key.conf</code>. I så fall återanvänds den utan frågor och säkerhetskopieringen fortsätter; inte heller senare säkerhetskopieringar frågar igen. Annars visar en meny två alternativ. <em>Skapa en ny nyckelfil</em> kör <code>proxmox-backup-client key create --kdf none</code>. <em>Använd en befintlig nyckelfil</em> identifierar automatiskt en PVE-hanterad nyckel: om det valda PBS-förvaret är registrerat i Proxmox med en krypteringsnyckel på <code>/etc/pve/priv/storage/&lt;NAME&gt;.enc</code>, kopieras filen utan frågor till ProxMenux kanoniska sökväg. Om ingen PVE-hanterad nyckel matchar förvaret efterfrågas den absoluta sökväg där operatören redan har placerat nyckelfilen på värden. I båda fallen installeras filen på den kanoniska sökvägen med <code>chmod 600</code>.",
+    "modesTitle": "En nyckelfil per värd eller en gemensam nyckelfil",
+    "modesIntro": "Båda driftsmodellerna stöds och ingen är obligatorisk. Operatören väljer utifrån hur värdarna är organiserade.",
+    "modesPerHostTitle": "En nyckelfil per värd (standard)",
+    "modesPerHostBody": "Varje värd genererar sin egen nyckelfil första gången det möjliggör PBS-kryptering. Isolering är maximal: att kompromissa med nyckelfilen hos en värd exponerar inte någon annans säkerhetskopior. Rekommenderas för produktionsflottor och för miljöer där värdar har olika ägare eller överensstämmelse gränser.",
+    "modesSharedTitle": "Gemensam nyckelfil (importeras på varje värd)",
+    "modesSharedBody": "En huvudnyckelfil skapas en gång och installeras på varje värd via alternativet <em>Använd en befintlig nyckelfil</em>. Hanteringen blir enklare: en enda hemlighet att skydda, och varje värd kan dekryptera alla andra värdars arkiv. Det är användbart för konsolidering, återställningsövningar mellan värdar och central verifiering av säkerhetskopior. Nackdelen är att en läcka av den gemensamma nyckeln exponerar alla värdar samtidigt. Rekommenderas för hemlabb och miljöer där alla värdar har samma ägare och ingår i samma tillitsområde.",
+    "recoveryTitle": "Ladda upp nyckeln till PBS – operatören bestämmer",
+    "recoveryBody": "Direkt efter valet av nyckelfil ställer ProxMenux den uttryckliga frågan <em>Ladda upp nyckeln till PBS?</em> med två svar. <strong>Ingen återställningsfil laddas upp till PBS förrän operatören svarar Ja.</strong> Standardvalet är <em>Nej, behåll endast lokalt</em>: nyckelfilen ligger kvar på den kanoniska lokala sökvägen, ProxMenux laddar inte upp någon återställningsfil till PBS och operatören ansvarar själv för kopian utanför värden. Knappen <em>Ladda ner nyckelfil</em> på PBS-målets rad i Monitor ger en kopia vid behov. Valet <em>Ja, ladda upp</em> efterfrågar en återställningslösenfras två gånger och kontrollerar att svaren matchar. ProxMenux skyddar nyckelfilen med AES-256-CBC och PBKDF2 (600 000 iterationer, slumpmässigt salt) och skapar <code>pbs-key.recovery.enc</code>. Varje senare krypterad säkerhetskopia laddar upp detta kuvert till PBS som en tillhörande säkerhetskopieringsgrupp. Dessa uppladdningar skickar varken lösenfrasen eller nyckelfilen i klartext till PBS. Valet kan ändras när som helst i Monitor: kontrollen på PBS-målets rad växlar Ja/Nej och tillämpar omedelbart Börja ladda upp, Sluta ladda upp eller Uppdatera lösenfras beroende på aktuellt tillstånd.",
+    "blobUploadTitle": "Tillhörande säkerhetskopieringsgrupp på PBS",
+    "blobUploadBody1": "När läget är <em>Ja, ladda upp</em> laddar ProxMenux upp återställningskuvertet till PBS efter varje krypterad säkerhetskopiering, som en andra tillhörande grupp. Den har samma namn som värdens grupp med suffixet <code>-keyrecovery</code>. Grupperna visas bredvid varandra i datalagrets lista: en för värdsäkerhetskopior och en för återställningskuvert. <strong>Kuvertet lämnar aldrig värden i klartext</strong>: krypteringen sker på värden med AES-256-CBC och PBKDF2 innan några data överförs (<code>openssl enc -aes-256-cbc -pbkdf2 -iter 600000 -salt</code>). PBS tar endast emot det redan krypterade kuvertet.",
+    "envelopeSecurityTitle": "Överför nyckelåterhämtningsfilen till PBS en säkerhetsrisk?",
+    "envelopeSecurityBody": "Keyrecovery-filen krypteras i transit och i vila. Återhämtningspassfrasen lämnar aldrig värden: kryptering sker lokalt före uppladdningen, och PBS ser bara det redan krypterade resultatet. En PBS-administratör - eller någon med tillgång till databutiken - kan ladda ner nyckelrecovery-filen, men utan återställningspassfrasen kan de inte läsa nyckelfilen inuti: det är ogenomskinlig chiffertext. Rekonstruera nyckelfilen kräver båda bitarna samtidigt, nyckelrecovery-filen och passfrasen, och endast operatören håller båda.",
+    "blobUploadConstraintTitle": "Varför två grupper istället för en enda krypterad",
+    "blobUploadConstraintBody": "Ett enda anrop till <code>proxmox-backup-client backup</code> krypterar antingen alla sina arkiv med samma nyckelfil eller inget av dem. Värdsäkerhetskopian måste krypteras med värdens nyckelfil, men återställningskuvertet kan inte skickas med i samma uppladdning: då skulle det krypteras med just den nyckelfil som det innehåller. På en nyinstallerad värd skulle det inte gå att öppna, eftersom nyckelfilen skulle behövas för att dekryptera sig själv. Därför laddas de två filerna upp separat och visas som två grupper. PBS-klienten krypterar värdsäkerhetskopian med nyckelfilen, medan ProxMenux krypterar kuvertet med lösenfrasen före uppladdning. Två olika krypteringslager skyddar två olika innehåll.",
+    "blobUploadImageAlt": "PBS-gränssnittet visar säkerhetskopieringsgrupperna hostcfg-HOSTNAME och hostcfg-HOSTNAME-keyrecovery bredvid varandra i datalagrets lista.",
+    "blobUploadImageCaption": "PBS-gränssnittet — de tillhörande säkerhetskopieringsgrupperna. Huvudgruppen innehåller värdsäkerhetskopiorna; gruppen -keyrecovery innehåller nyckelfilen skyddad med lösenfras.",
+    "recoverTitle": "Återhämtning på en ny värd",
+    "recoverBody": "Om nyckelfilen saknas på den kanoniska sökvägen, efter en ominstallation eller uttrycklig borttagning, provar återställningen tre källor i ordning och stannar vid den första användbara nyckeln. Först kopieras en matchande PVE-hanterad nyckel från <code>/etc/pve/priv/storage/&lt;NAME&gt;.enc</code> utan frågor till den kanoniska sökvägen, om den finns för det valda PBS-förvaret. Om det finns en <code>-keyrecovery</code>-grupp på PBS laddas sedan den senaste ögonblicksbilden ner och operatören anger återställningslösenfrasen för att dekryptera den. Om båda alternativen misslyckas eller avböjs efterfrågas till sist den absoluta sökvägen till nyckelfilen på värden, och filen kopieras till den kanoniska sökvägen. Monitor visar samma importflöde i säkerhetskopians detaljdialog. En gul panel visas överst när Återställ, Ladda ner eller Visa innehåll behöver en nyckel som saknas. Om en installerad nyckel inte matchar säkerhetskopian returnerar PBS <code>wrong key — manifest's key XX does not match provided key YY</code>. Samma tre åtgärder visar då en strukturerad panel med manifestets nödvändiga nyckelfingeravtryck tydligt utmärkt, så att operatören kan identifiera rätt nyckelfil att importera för säkerhetskopian.",
+    "monitorManagementTitle": "Hantera nyckelfilen från Monitor",
+    "monitorManagementBody": "Monitor visar nyckelfilens kontroller direkt på varje PBS-målrad i säkerhetskopieringskonfigurationen. Tre åtgärder finns: <em>Ladda ner</em> exporterar den aktuella filen till webbläsaren; <em>Ladda upp</em> ersätter den installerade filen med operatörens fil, och den gamla skrivs över först när den nya har installerats på den kanoniska sökvägen; <em>Ta bort</em> tar bort filen från värden. Bredvid finns kontrollen för återställningskopian: ett Ja/Nej-val för <em>Ladda upp nyckeln till PBS?</em>, ett lösenfrasfält när Ja väljs och en knapp som beroende på tillstånd tillämpar <em>Börja ladda upp</em>, <em>Sluta ladda upp</em> eller <em>Uppdatera lösenfras</em>. Alla åtgärder använder samma Flask-slutpunkter som terminalgränssnittet, så effekten på disk och tillståndet på PBS blir identiska från båda gränssnitten."
+  },
+  "restoreAccess": {
+    "heading": "Hämta vid återställning",
+    "body": "Återställningen hittar ProxMenux värdsäkerhetskopior på PBS genom att lista grupperna i det konfigurerade förvaret och filtrera efter ID-mönster. Fliken Säkerhetskopior i Monitor visar samma lista. När en säkerhetskopia väljs körs <code>proxmox-backup-client restore</code> med samma förvar, lösenord och fingeravtryck, samt <code>--keyfile</code> om kopian är krypterad. Arkivet <code>.pxar</code> packas upp i en förberedelsekatalog som <code>_rs_check_layout</code> lämnar vidare till den vanliga återställningen. Utanför ProxMenux kan samma kommando packa upp arkivet till valfri sökväg för att granska trädet eller återställa manuellt."
+  },
+  "references": {
+    "heading": "Referenser",
+    "intro": "Officiell Proxmox Backup Server-dokumentation för komponenterna ProxMenux är beroende av.",
+    "items": [
+      {
+        "label": "Proxmox Backup Server dokumentation",
+        "href": "https://pbs.proxmox.com/docs/",
+        "tail": " - huvudingångspunkt som täcker installation, administration, lagring, användare och roller."
+      },
+      {
+        "label": "proxmox-backup-client",
+        "href": "https://pbs.proxmox.com/docs/backup-client.html",
+        "tail": " — kommandoradsverktyget som ProxMenux använder för varje säkerhetskopiering och återställning. Beskriver säkerhetskopierings-ID, typer, arkiv, förvarssyntax och miljövariabler."
+      },
+      {
+        "label": "Kryptering på klientsidan",
+        "href": "https://pbs.proxmox.com/docs/backup-client.html#encryption",
+        "tail": " — skapa nyckelfiler, --kdf-lägen och krypteringsmodellen som ProxMenux utökar med en återställningskopia skyddad med lösenfras."
+      },
+      {
+        "label": "Datalagerhantering",
+        "href": "https://pbs.proxmox.com/docs/storage.html",
+        "tail": " - skapa och hantera datastorer som tar emot värdbackups, inklusive chunk-store layout och behörigheter."
+      },
+      {
+        "label": "Gallring och skräpinsamling",
+        "href": "https://pbs.proxmox.com/docs/maintenance.html#pruning",
+        "tail": " — lagringsreglerna bakom --keep-last / --keep-daily / --keep-weekly som ProxMenux tillämpar per schemalagt jobb, samt hur PBS frigör oanvända block efter gallring."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sv/docs/backup-restore/glossary.json b/web/messages/sv/docs/backup-restore/glossary.json
new file mode 100644
index 00000000..613cf074
--- /dev/null
+++ b/web/messages/sv/docs/backup-restore/glossary.json
@@ -0,0 +1,230 @@
+{
+  "meta": {
+    "title": "Ordlista - Backup & Restore | ProxMenux",
+    "description": "Termer i ProxMenux system för säkerhetskopiering och återställning: kryptering, nyckelfil, passfras, återställningskuvert, PBS, datablock, rootfs, manifest, körprocess och komplettering mellan kärnversioner.",
+    "ogTitle": "Backup & Återställ ordlista | ProxMenux",
+    "ogDescription": "Tydliga definitioner för ordförråd som används över ProxMenux backup och återställa dokumentation.",
+    "twitterTitle": "Backup & Återställ ordlista | ProxMenux",
+    "twitterDescription": "Passfras, keyfile, återhämtningskuvert, rootfs, manifest, PBS, bitar - alla definierade på ett ställe."
+  },
+  "header": {
+    "title": "Ordlista",
+    "description": "Termer i dokumentationen för säkerhetskopiering och återställning, med definitioner.",
+    "section": "Säkerhetskopiering och återställning"
+  },
+  "intro": {
+    "body": "Termer grupperas efter tema. Varje post ger termen och en kort definition."
+  },
+  "groups": [
+    {
+      "title": "Kryptering och nyckelåterställning",
+      "intro": "Vocabulary för PBS kryptering block. Det handlar om två distinkta hemligheter: en binär nyckelfil och en skriftlig passfras.",
+      "entries": [
+        {
+          "id": "passphrase-recuperacion",
+          "term": "Återställningslösenfras",
+          "def": "Text lösenord användaren väljer för att skydda <a href=\"#sobre-recuperacion\">återställningskuvertet</a>. Det uppmanas två gånger med en matchkontroll, och används endast för att kryptera kuvertet och för att dekryptera det om nyckelfilen någonsin behöver återställas. <strong>Det är inte passfrasen som låser upp nyckelfilen själv</strong>, och det skickas aldrig till PBS. Under en normal backup lämnar den aldrig värden."
+        },
+        {
+          "id": "clave-cifrado",
+          "term": "Keyfile (krypteringsnyckel)",
+          "def": "Nyckelfil som proxmox-backup-client använder för att kryptera <a href=\"#chunk\">datablock</a> före uppladdning till PBS. Utan rätt nyckel kan krypterade data inte läsas. ProxMenux sparar filen på <code>/usr/local/share/proxmenux/pbs-key.conf</code> med läge <code>600</code>. Skydda den: <a href=\"#sobre-recuperacion\">återställningskuvertet</a> finns för att återställa filen om den förloras."
+        },
+        {
+          "id": "contrasena-keyfile",
+          "term": "Keyfile passfras (KDF passfras)",
+          "def": "Valfri passfras som keyfilen själv kan bära, skiljer sig från <a href=\"#passphrase-recuperacion\">återställningspassfrasen</a>. Det finns bara när nyckelfilen skapades med <code>--kdf scrypt</code> (vanligtvis en importerad nyckelfil). Utan det kan nyckelfilen inte låsas upp för användning. ProxMenux sparar den i krypterad form på värden så att schemalagda säkerhetskopior kan köras utan en interaktiv prompt."
+        },
+        {
+          "id": "sobre-recuperacion",
+          "term": "Återhämtningskuvert",
+          "def": "<a href=\"#clave-cifrado\">Nyckelfilen</a> är insvept i ett extra lager: det är krypterat med <a href=\"#passphrase-recuperacion\">Återhämtningspassfras</a> Använda <a href=\"#aes-256-cbc\">AES-256-CBC</a> och <a href=\"#pbkdf2\">PBKDF2</a> innan den någonsin lämnar värden. Det är det som laddas upp till PBS som den <code>-keyrecovery</code> grupp. Utan passfrasen är kuvertet ogenomskinligt: ladda ner det från PBS avslöjar inte keyfile."
+        },
+        {
+          "id": "cifrado-cliente",
+          "term": "Klient-side kryptering",
+          "def": "Krypteringsmodell där data krypteras på källvärden innan de laddas upp. PBS får bara och lagrar chiffertext; inte ens en PBS-administratör med databutiksåtkomst kan läsa den utan nyckelfilen. ProxMenux bygger på denna modell och lägger till <a href=\"#sobre-recuperacion\">återställningskuvertet</a> ovanpå."
+        },
+        {
+          "id": "kdf-none",
+          "term": "--kdf none",
+          "def": "Alternativ till <code>proxmox-backup-client key create</code> som producerar en nyckelfil utan bifogad passfras. Nyckelfilen kan användas direkt utan en prompt, vilket är viktigt för schemalagda jobb som körs obevakad. Detta är vad ProxMenux använder som standard när man skapar en ny nyckelfil."
+        },
+        {
+          "id": "kdf-scrypt",
+          "term": "--kdf scrypt",
+          "def": "Alternativ till <code>proxmox-backup-client key create</code> som producerar en nyckelfil skyddad av en <a href=\"#contrasena-keyfile\">nyckelfilspassfras</a>. Varje användning av nyckelfilen kräver att låsa upp den med den passfrasen. ProxMenux accepterar denna typ av nyckelfil på import och lagrar passfrasen krypterad så schemalagda säkerhetskopior kan fortfarande köras obevakad."
+        },
+        {
+          "id": "aes-256-cbc",
+          "term": "AES-256-CBC",
+          "def": "Standard symmetrisk chiffer. ProxMenux använder den (via <code>openssl enc -aes-256-cbc</code>) för att linda <a href=\"#clave-cifrado\">nyckelfilen</a> med <a href=\"#passphrase-recuperacion\">återställningspassfrasen</a> och producera <a href=\"#sobre-recuperacion\">kuvertet</a>."
+        },
+        {
+          "id": "pbkdf2",
+          "term": "PBKDF2",
+          "def": "Kryptografisk funktion som förvandlar en mänskligt utformad passfras till en binär nyckel som är lämplig för kryptering. Det saktar ner brute-force försök genom att tillämpa många iterationer. ProxMenux använder den med 600 000 iterationer och ett slumpmässigt salt när man krypterar återhämtningskuvertet."
+        }
+      ]
+    },
+    {
+      "title": "Backup struktur",
+      "intro": "Termer som beskriver vad som lever i en säkerhetskopia, oavsett destination.",
+      "entries": [
+        {
+          "id": "rootfs",
+          "term": "rootfs / rotfilsystem",
+          "def": "Filbaserad kopia av källvärdens filsystem skapad med <code>rsync</code> enligt <a href=\"#perfil-defecto\">standardprofilen</a> och <a href=\"#rutas-personalizadas\">egna sökvägar</a>. Det är ingen hel diskavbildning: endast sökvägar med konfiguration eller tillstånd som Proxmox inte kan återskapa självt kopieras."
+        },
+        {
+          "id": "manifiesto",
+          "term": "Manifest (manifest.json)",
+          "def": "Strukturerad JSON-dokument som beskriver källvärden vid backuptid: hårdvara, lagring, kärna, ProxMenux-installerade komponenter och inventering av VM och LXC. Den produceras av sex oberoende samlare. Återställningsflödet använder det för att jämföra källa och mål."
+        },
+        {
+          "id": "staging",
+          "term": "Staging katalog",
+          "def": "Tillfällig katalog där ProxMenux monterar de tre blocken (rootfs, metadata och manifest) innan du packar dem och laddar upp till destinationen. Det tas bort automatiskt när backupen slutar, även på abort."
+        },
+        {
+          "id": "perfil-defecto",
+          "term": "Standardprofil",
+          "def": "Utvalda sökvägar som ProxMenux kopierar som standard i varje säkerhetskopia. Omfattar PVE-konfiguration, nätverk, SSH, kärna, apt, ProxMenux-verktyg och mer. Definieras i koden och beskrivs på sidan <em>Hur det fungerar</em>."
+        },
+        {
+          "id": "rutas-personalizadas",
+          "term": "Anpassade vägar",
+          "def": "Extra vägar som användaren lägger till ovanpå <a href=\"#perfil-defecto\">default profil</a>. Antingen ihållande (lagras i <code>backup-extra-paths.txt</code>) eller per-run (plockad i anpassat läge)."
+        }
+      ]
+    },
+    {
+      "title": "Destinationer och lagring",
+      "intro": "Villkor bundna till var backup landar - PBS server, lokal arkiv eller Borg repository - och hur PBS organiserar data.",
+      "entries": [
+        {
+          "id": "repositorio-pbs",
+          "term": "PBS-arkivet",
+          "def": "Kombination av Proxmox Backup Server + <a href=\"#datastore\">datastore</a> + användare som tar emot backupen. Identifierad av strängen <code>user@realm@host:datastore</code>. En enda PBS-server kan vara värd för flera förråd."
+        },
+        {
+          "id": "datastore",
+          "term": "Datalager",
+          "def": "Ett visst lagringsutrymme på en PBS-server där säkerhetskopior och deras datablock finns. Varje datalager ligger på ett filsystem på PBS-servern och har egna behörigheter och regler."
+        },
+        {
+          "id": "chunk",
+          "term": "Datablock / deduplicering av datablock",
+          "def": "PBS delar varje backup i varierande storlek bitar, identifierar varje bit av sin hash och lagrar varje bit bara en gång, även om det visas i många olika säkerhetskopior. Detta innebär successiva säkerhetskopior av samma värd - eller över liknande värdar - ta mycket lite extra utrymme."
+        },
+        {
+          "id": "fingerprint",
+          "term": "Fingeravtryck",
+          "def": "Kryptografiskt fingeravtryck av PBS-serverns TLS-certifikat. Den låter kunden verifiera att den talar till den avsedda servern utan att förlita sig på en myndighet för offentlig certifikat. ProxMenux passerar den till <code>proxmox-backup-client</code> via <code>PBS_FINGERPRINT</code> miljövariabel."
+        },
+        {
+          "id": "grupo-copia",
+          "term": "Säkerhetskopia grupp",
+          "def": "Logisk container inuti PBS under vilken successiva säkerhetskopior av samma tillgång ackumuleras. Varje ny backup delar deduplicering med tidigare i samma grupp. ProxMenux använder två grupper per värd när kryptering är aktiverad: en för värdbackupen och en med ett <code>-keyrecovery</code>-suffix för <a href=\"#sobre-recuperacion\">återställningskuvertet</a>."
+        },
+        {
+          "id": "backup-id",
+          "term": "Säkerhetskopierings-ID",
+          "def": "Namnet på <a href=\"#grupo-copia\">backup grupp</a>. ProxMenux standarder till <code>hostcfg-HOSTNAME</code> och låter användaren redigera det innan uppladdning; ostödda tecken tas bort automatiskt."
+        },
+        {
+          "id": "pxar",
+          "term": ".pxar",
+          "def": "PBS-inhemska arkivformat för kataloger. Det beter sig som en tar-arkiv optimerad för chunk deduplicering: snarare än att lagra en ogenomskinlig fil bryter PBS innehållet i återanvändbara bitar."
+        }
+      ]
+    },
+    {
+      "title": "Körning och schemaläggning",
+      "intro": "Termer i ProxMenux system för schemalagda jobb.",
+      "entries": [
+        {
+          "id": "runner",
+          "term": "Körprocess",
+          "def": "<code>run_scheduled_backup.sh</code>-skriptet som utför en schemalagd säkerhetskopia. Den läser jobbkonfigen, lanserar matchande backend (Local, PBS eller Borg), tillämpar lagring på framgång och skickar konfigurerade meddelanden."
+        },
+        {
+          "id": "trabajo-programado",
+          "term": "Schemalagt jobb",
+          "def": "Bestående konfiguration av en återkommande backup. Håller destination, referenser, kryptering, schema och lagring. Lever på <code>/var/lib/proxmenux/backup-jobs/&lt;id&gt;.env</code>."
+        },
+        {
+          "id": "modo-adjunto",
+          "term": "Anslutet läge",
+          "def": "Jobb utan egen timer. En job-end-hook i PVE <code>vzdump</code> utlöser det efter gästsäkerhetskopior när mållagringen matchar. Det valda överordnade jobbet ger lagring och lagringsregler, som läses om från det överordnade jobbet vid varje körning, men hooken matchar lagring, inte jobb-ID. Även en annan uppgift med samma lagring kan utlösa det. Endast Local och PBS."
+        },
+        {
+          "id": "timer-systemd",
+          "term": "systemd-timer",
+          "def": "Standard systemd-mekanism som skjuter ett kommando i en kalender. ProxMenux skapar en timer per <em>oberoende</em> schemalagt jobb; <a href=\"#modo-adjunto\">attach-mode</a> jobb använder ingen timer, de körs via PVE script-hook."
+        },
+        {
+          "id": "retencion",
+          "term": "Lagringsregler (keep-last, keep-daily…)",
+          "def": "Policy som bestämmer vilka äldre säkerhetskopior som ska hållas och vilka som ska beskäras. Definieras per jobb med parametrar som <code>keep-last</code>, <code>keep-daily</code>, <code>keep-weekly</code>, <code>keep-monthly</code>. Tillämpad av körprocessen efter varje framgångsrik backup."
+        }
+      ]
+    },
+    {
+      "title": "Återställa",
+      "intro": "Termer från återställningsflödet.",
+      "entries": [
+        {
+          "id": "restauracion-universal",
+          "term": "Universell återställning",
+          "def": "ProxMenux-återställningsflödet extraherar inte bara filsystemet: det läser manifestet för att upptäcka skillnader mellan källa och mål, reproducerar systemkonfigurationen och kör om installatörerna för ProxMenux-hanterade komponenter. Målet är att reproducera källvärden, inte bara arkivet."
+        },
+        {
+          "id": "hidratacion",
+          "term": "Komplettering mellan kärnversioner",
+          "def": "Återställ pass som sammanfogar användarens egen konfiguration från källan (IOMMU-tokens, VFIO-enhets-ID, anpassade quirks, GRUB-nycklar) ovanpå målets färska startkonfiguration, utan att kopiera källans kärnbundna filer verbatim. Kör när målkärnan är nyare än backupen."
+        },
+        {
+          "id": "cross-kernel",
+          "term": "Återställning mellan kärnversioner",
+          "def": "Återställ var målets kärna skiljer sig från (vanligtvis är nyare än) källan. Kräver <a href=\"#hidratacion\">hydration</a> pass för att undvika att dra längs filer oförenliga med målets kärna."
+        },
+        {
+          "id": "instalador-postboot",
+          "term": "Installerare efter uppstart",
+          "def": "Komponenter installerade efter den första starten av den restaurerade värden (NVIDIA drivrutiner, Coral TPU drivrutiner, AMD GPU verktyg, Intel GPU verktyg). Varje installatör körs mot målets kärna, så den restaurerade värden beror inte på att källans kärna är närvarande."
+        },
+        {
+          "id": "compatibility-check",
+          "term": "Kompatibilitetskontroll",
+          "def": "Jämförelse mellan källans manifest och målets tillstånd som ProxMenux utför i början av återställningen. Det bestämmer vilka delar som kopieras verbatim, som behöver hydrering och som återskapas av en installatör."
+        },
+        {
+          "id": "equipo-recien-instalado",
+          "term": "Färsk installation",
+          "def": "Värd bara ominstallerad från början, utan lokal <a href=\"#clave-cifrado\">nyckelfil</a>. Återställa en krypterad säkerhetskopia kräver första återställning av nyckelfilen från <a href=\"#sobre-recuperacion\">återställningskuvertet</a> lagrad på PBS, med hjälp av <a href=\"#passphrase-recuperacion\">återställningspassfrasen</a>."
+        }
+      ]
+    }
+  ],
+  "whereNext": {
+    "heading": "Nästa steg",
+    "items": [
+      {
+        "label": "Hur det fungerar",
+        "href": "/docs/backup-restore/how-it-works",
+        "tail": " — där rootfs, manifest och applikationsinventering passar in i en backup."
+      },
+      {
+        "label": "Proxmox Backup Server-mål",
+        "href": "/docs/backup-restore/destinations/pbs",
+        "tail": " - där klient-side kryptering, keyfile, återställningspassfras och kuvert dokumenteras på djupet."
+      },
+      {
+        "label": "Återställande",
+        "href": "/docs/backup-restore/restoring",
+        "tail": " — Återställande flöde och manifest användning."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sv/docs/backup-restore/how-it-works.json b/web/messages/sv/docs/backup-restore/how-it-works.json
new file mode 100644
index 00000000..b50bb742
--- /dev/null
+++ b/web/messages/sv/docs/backup-restore/how-it-works.json
@@ -0,0 +1,205 @@
+{
+  "meta": {
+    "title": "Hur ProxMenux Backup fungerar internt - rootfs, manifest, applikationer",
+    "description": "Detaljerat innehåll i en ProxMenux-säkerhetskopia: rootfs kopierat med rsync enligt standardprofilens sökvägar, ett strukturerat manifest från sex oberoende insamlare och programinventeringen som styr automatisk ominstallation av paket och komponenter efter återställning.",
+    "ogTitle": "Hur ProxMenux Backup fungerar internt",
+    "ogDescription": "De tre nyttolasterna av en ProxMenux-backup förklarade: rootfs, manifest och applikationer.",
+    "twitterTitle": "Hur ProxMenux Backup fungerar | ProxMenux",
+    "twitterDescription": "De tre nyttolasterna av en ProxMenux-backup och hur återställningen reproducerar källvärden från dem."
+  },
+  "header": {
+    "title": "Hur det fungerar",
+    "description": "Den interna nedbrytningen av en ProxMenux-backup - filsystem, manifest och applikationsinventering - och hur återställningen förbrukar alla tre för att reproducera källvärden på ett mål som kanske inte delar samma kärna.",
+    "section": "Säkerhetskopiering och återställning"
+  },
+  "intro": {
+    "title": "Ett arkiv, tre delar",
+    "body": "Varje säkerhetskopia skapar tre tydliga delar under en gemensam förberedelsekatalog. Arkivet som laddas upp till målet (lokalt <code>.tar.zst</code>, PBS-säkerhetskopia eller Borg-arkiv) innehåller samma struktur. Återställningen använder alla tre: <strong>manifestet</strong> läses före ändringar för att upptäcka avvikelser och bestämma undantag; <strong>rootfs</strong> ger konfigurationsfiler som tillämpas direkt eller efter omstart; <strong>programinventeringen</strong> styr paketinstallation och ominstallation av komponenter efter start. Varje del kan granskas eller packas upp oberoende."
+  },
+  "layout": {
+    "heading": "Arkivlayout",
+    "intro": "Varje arkiv följer samma trädlayout oavsett destination. <code>metadata/</code> underkatalog håller de strukturerade nyttolasterna; <code>rootfs/</code> underkatalog håller filsystemet kopiera.",
+    "treeCaption": "Förberedelsekatalogen som skapas vid säkerhetskopiering. Alla mål får samma träd i sitt eget format: tar för lokala mål, PBS-block för PBS och Borg-segment för Borg.",
+    "tree": "backup-[timestamp]/\n├── manifest.json                  # structured host state\n├── metadata/\n│   ├── packages.manual.list       # apt-mark showmanual\n│   ├── run_info.env               # backup run identity + kernel version + pmxcfs method\n│   ├── paths_archived.txt         # exact list of paths that reached rootfs/\n│   └── missing_paths.txt          # paths from the profile absent on source\n└── rootfs/\n    ├── etc/                       # /etc/pve, /etc/network, /etc/systemd/network, /etc/ssh, …\n    ├── root/                      # /root (with volatile subdirs excluded)\n    ├── usr/local/                 # /usr/local/bin, /usr/local/share/proxmenux, …\n    └── var/                       # /var/lib/pve-cluster (config.db via sqlite3 .backup), /var/spool/cron/…"
+  },
+  "rootfs": {
+    "heading": "Innehållet i rootfs",
+    "intro": "Trädet <code>rootfs/</code> är en <strong>vanlig filsystemkopia</strong> som skapas med <code>rsync</code> från källvärden. Det innehåller en utvald <strong>standardprofil</strong> med sökvägar som behövs för Proxmox-återställning samt <strong>egna sökvägar</strong> som användaren lägger till i jobbet eller den interaktiva sessionen. Urvalet är avsiktligt begränsat till sökvägar som <em>innehåller konfiguration</em> eller <em>lagrar tillstånd som Proxmox inte kan återskapa själv</em>.",
+    "defaultProfileTitle": "Standardprofilen",
+    "defaultProfileBody": "Standardprofilen definieras av <code>hb_default_profile_paths</code> i <code>lib_host_backup_common.sh</code>. Den omfattar åtta fasta kategorier och vid behov ZFS-tillstånd, som tillsammans beskriver en fungerande Proxmox-värd:",
+    "categoriesTitle": "Sökvägskategorier",
+    "categoryRows": [
+      {
+        "category": "PVE-kärna",
+        "paths": "/etc/pve, /var/lib/pve-cluster, /etc/vzdump.conf",
+        "why": "Cluster filsystem innehåll och vzdump standarder. Pmxcfs databas (<code>config.db</code>) fångas som en konsekvent ögonblicksbild via <code>sqlite3 .backup</code> utan att stoppa klustret, och <code>.db-wal</code> / <code>.db-shm</code> sidovagnar är uteslutna från rsync. När <code>sqlite3</code> inte är tillgänglig, skapas i stället <code>config.db.raw-fallback</code>, som automatiskt används som databas vid återställning."
+      },
+      {
+        "category": "Värd identitet och nätverk",
+        "paths": "/etc/hostname, /etc/hosts, /etc/timezone, /etc/resolv.conf, /etc/network, /etc/systemd/network",
+        "why": "Det värden behöver för att komma upp i nätverket med samma identitet. Filerna <code>.link</code> under <code>/etc/systemd/network</code> kopplar nätverkskortens namn till deras MAC-adresser, så att namnen bevaras vid ominstallation och hårdvaruändringar."
+      },
+      {
+        "category": "Åtkomst och autentisering",
+        "paths": "/etc/ssh, /etc/sudoers, /etc/sudoers.d, /etc/pam.d, /etc/security",
+        "why": "SSH-nycklar, sudoregler och PAM-konfiguration. Att förlora dessa låser användaren ur den restaurerade värden."
+      },
+      {
+        "category": "Kärna och uppstart",
+        "paths": "/etc/default/grub, /etc/kernel, /etc/modules, /etc/modules-load.d, /etc/modprobe.d, /etc/sysctl.conf, /etc/sysctl.d, /etc/udev/rules.d, /etc/fstab, /etc/iscsi, /etc/multipath",
+        "why": "IOMMU-parametrar, svartlistor för moduler, VFIO-enhets-ID, monteringstabell och lagringskonfiguration."
+      },
+      {
+        "category": "Skal och språkinställningar",
+        "paths": "/etc/environment, /etc/bash.bashrc, /etc/inputrc, /etc/profile, /etc/profile.d, /etc/locale.gen, /etc/locale.conf",
+        "why": "Systemgemensam skalkonfiguration, miljövariabler och inställningar för generering av språkmiljöer."
+      },
+      {
+        "category": "Pakethantering och cron",
+        "paths": "/etc/apt, /etc/cron.d, /etc/cron.{daily,hourly,weekly,monthly}, /etc/cron.allow, /etc/cron.deny, /var/spool/cron/crontabs",
+        "why": "APT-källor för konsekvent paketlösning, schemalagda uppgifter som definieras av användaren."
+      },
+      {
+        "category": "ProxMenux tillstånd och verktyg",
+        "paths": "/etc/proxmenux, /etc/systemd/system, /etc/log2ram.conf, /etc/logrotate.conf, /etc/logrotate.d, /etc/lm-sensors, /etc/sensors3.conf, /etc/fail2ban, /etc/snmp, /etc/postfix, /etc/wireguard, /etc/openvpn, /etc/grafana, /etc/influxdb, /etc/prometheus, /etc/telegraf, /etc/zabbix",
+        "why": "Valfri men vanlig Proxmox verktyg. Saknade vägar noteras i <code>metadata/missing_paths.txt</code> utan att stoppa backupen."
+      },
+      {
+        "category": "ProxMenux-program och root-kontot",
+        "paths": "/usr/local/bin, /usr/local/sbin, /usr/local/share/proxmenux, /var/lib/proxmenux, /root (flyktiga subdirs exkluderade)",
+        "why": "ProxMenux-installerade binärer och per användare konfiguration under <code>/root</code>. Volatila vägar (<code>.bash_history</code>, <code>.cache/</code>, <code>tmp/</code>, <code>.local/share/Trash/</code>) utesluts från kopian. <code>/var/lib/proxmenux</code> håller de schemalagda backupjobben och värdens tillstånd som hålls av ProxMenux; återställningsstagningen, återställningskopiorna och efteråtsmarkörerna är uteslutna, eftersom de tillhör värden som kör en återställning."
+      },
+      {
+        "category": "ZFS tillstånd (villkor)",
+        "paths": "/etc/zfs",
+        "why": "Det ingår endast när källvärden kör ZFS. innehåller <code>zpool.cache</code> och <code>hostid</code>."
+      }
+    ],
+    "customTitle": "Utöka profilen med anpassade vägar",
+    "customBody": "Utöver standardprofilen erbjuder ProxMenux två sätt att inkludera ytterligare vägar i en säkerhetskopia. De komponerar utan konflikt och gäller både interaktiva säkerhetskopior och schemalagda jobb.",
+    "customExtrasTitle": "1. Persistenta extrafunktioner (per-host-fil)",
+    "customExtrasBody": "En textfil på <code>/usr/local/share/proxmenux/backup-extra-paths.txt</code> innehåller en lista över absoluta vägar som användaren har markerat som \"alltid inkluderar\" på denna värd. När en säkerhetskopia körs i <strong>Default</strong>-läge, appenderar ProxMenux dessa vägar till standardprofilen automatiskt utan att fråga. Filen redigeras från gränssnittet - ingen manuell redigering behövs - och kvarstår över omstart och uppdateringar. En absolut väg per rad; <code>#</code> kommentarer är tillåtna.",
+    "customModeTitle": "2. Anpassat läge (per körning)",
+    "customModeBody": "Att starta en säkerhetskopia i <strong>Custom</strong>-läge ersätter den automatiska tillämpningen av standardprofilen med en checklista som visar varje väg: standardprofilerade poster och de ihållande extrafunktionerna (prefixed med <code>[+]</code> och förmarkerade). Användaren markerar eller avmarkerar poster för den specifika körningen, och kan också trycka på <em>Lägg till anpassad sökväg</em> för att ange en ny väg - som sedan kvarstår till extrafilen för framtida säkerhetskopior.",
+    "customMissingTitle": "Vägar frånvarande från källan",
+    "customMissingBody": "Varje väg från profilen (standard eller tillägg) som inte finns på källvärden registreras i <code>metadata/missing_paths.txt</code> inuti arkivet. Säkerhetskopieringen misslyckas varken eller slutar - användaren ser en sammanfattning av arkiverade vägar och saknade vägar i slutet. I praktiken sker detta för valfria verktygsvägar som <code>/etc/wireguard</code> eller <code>/etc/prometheus</code> när dessa verktyg inte är installerade."
+  },
+  "manifest": {
+    "heading": "Manifestdelen",
+    "intro": "<code>manifest.json</code> är ett strukturerat JSON-dokument som beskriver källvärden vid backupen. Den produceras av <strong>sex oberoende insamlare</strong> orkestrerad av <code>build_manifest.sh</code>. Varje samlare läser endast data, producerar ett väldefinierat JSON-fragment och faller tillbaka till ett säkert tomt standard om det misslyckas - manifestet är fortfarande användbart om ett avsnitt är ofullständigt.",
+    "orchestratorCaption": "De sex samlarna komponerar manifestet. Varje samlare körs i sin egen underprocess; ett misslyckande i en faller tillbaka till en dokumenterad säker standard och varnar men inte avbryter backupen.",
+    "collectorRows": [
+      {
+        "collector": "collect_source_host.sh",
+        "produces": "source_host",
+        "content": "Hostname, PVE version (<code>pveversion</code>), PBS version om värden kör backup-server roll, kärna (<code>uname -r</code>), startläge (efi/bios), root filsystem typ, CPU modell + arkitektur, minne i KB."
+      },
+      {
+        "collector": "collect_hardware.sh",
+        "produces": "hardware_inventory",
+        "content": "GPU (med leverantör och ProxMenux installer mapping), TPUs (Coral USB + M.2 med <code>lsusb</code> / <code>lspci</code> detektering), NICs (med MAC, PCI slot och bro medlemskap), trådlösa enheter. GPU-poster bär en <code>passthrough_eligible</code>-heuristisk."
+      },
+      {
+        "collector": "collect_storage.sh",
+        "produces": "storage_inventory",
+        "content": "ZFS-pooler (med pooltyp + medlemsdisker löste <code>/dev/disk/by-id/*</code>, <code>/dev/disk/by-partuuid/*</code> eller rå <code>/dev/sdX</code>-vägar beroende på hur varje pool ursprungligen skapades), LVM-volymgrupper + tunna pooler, fysiska diskar med SMART-kapacitet, PVE <code>storage.cfg</code>-poster, externa monteringar."
+      },
+      {
+        "collector": "collect_kernel.sh",
+        "produces": "kernel_params",
+        "content": "Parametrar som operatören lagt till i <code>/proc/cmdline</code>, utan standardposter som <code>BOOT_IMAGE=</code>, <code>root=</code>, <code>ro/rw</code>, <code>quiet</code> och <code>splash</code>; moduler som laddas vid start från <code>/etc/modules</code>; sökvägar till <code>/etc/modprobe.d/*.conf</code>-filer med faktiska direktiv (<code>options</code>, <code>blacklist</code>, <code>install</code>, <code>alias</code>, <code>softdep</code>)."
+      },
+      {
+        "collector": "collect_proxmenux_state.sh",
+        "produces": "proxmenux_installed_components",
+        "content": "Läser <code>/usr/local/share/proxmenux/managed_installs.json</code> (registret över allt ProxMenux har installerat) och <code>installed_tools.json</code>. Varje post håller installationsbanan (<code>menu_script</code>) så att återställningen kan utlösa exakt samma installationsflöde."
+      },
+      {
+        "collector": "collect_guests.sh",
+        "produces": "vms_lxcs_at_backup",
+        "content": "Uppräknar VMs (<code>qm list</code>) och LXCs (<code>pct list</code>) närvarande vid backuptid - VMID, namn, aktuell status. Endast inventeringen: de faktiska gästdata är <code>vzdump</code>/PBS."
+      }
+    ],
+    "schemaTitle": "Schema validering",
+    "schemaBody": "manifestet validerar mot <code>scripts/backup_restore/schema/manifest.schema.json</code>. Kör <code>build_manifest.sh --validate</code> utlöser en Python-side JSON Schema validering (kräver <code>python3</code> + <code>jsonschema</code>). Om modulen inte är närvarande, är kontrollen hoppad tyst - validering är i första hand ett utvecklarhjälp, inte ett drifttidsberoende."
+  },
+  "applications": {
+    "heading": "Applikationsinventeringen",
+    "intro": "Två inventeringar listar programvara utöver Proxmox VE:s baspaket: paketlistan under <code>metadata/</code> och komponentregistret i rootfs, som beskrivs nedan. Återställningen använder APT eller ProxMenux egna installationsprogram för att återskapa användarens programvara enligt det ursprungliga installationssättet.",
+    "packagesTitle": "packages.manual.list",
+    "packagesBody": "En alfabetisk textlista från <code>apt-mark showmanual</code> med alla APT-paket som <em>uttryckligen installerats</em> på källvärden. Beroenden till Proxmox VE:s bassystem ingår inte; målets APT installerar dem automatiskt. Under återställningen läser <code>_rs_run_complete_extras</code> listan och använder ett <em>filter mot borttagning i kaskad</em> i tre steg: <code>dpkg -s</code> hittar redan installerade paket, andra huvudversioner av bibliotek identifieras och <code>apt-get install --simulate</code> kontrollerar risken för följdborttagningar. Återstående paket installeras med <code>apt-get install -y</code>.",
+    "componentsTitle": "components_status.json (del av rootfs)",
+    "componentsBody": "En JSON registret under <code>/usr/local/share/proxmenux/</code> som registrerar varje komponent ProxMenux har installerat med sitt exakta tillstånd: version, ProxMenux-specifika flaggor (för NVIDIA: <code>patched</code> boolean; för Coral: DKMS version). Denna fil lever i rootfs - inte i <code>metadata/</code> - eftersom det är <em>läses efter</em> att rootfs har kopierats till målet. Post-boot dispatcher (<code>apply_cluster_postboot.sh</code>) itererar över sina poster och kör varje komponent <code>--auto-reinstall</code> krok, som läser det inspelade tillståndet och reproducerar installationen mot målets nuvarande kärna.",
+    "componentInstallersTitle": "Installationsprogram för komponenter",
+    "componentInstallersBody": "Fyra ProxMenux installatörer exponerar för närvarande en <code>--auto-reinstall</code> ingångspunkt:",
+    "installerRows": [
+      {
+        "component": "nvidia_driver",
+        "installer": "gpu_tpu/nvidia_installer.sh",
+        "action": "Läser <code>version</code> + <code>patched</code>. Ladda ner exakt samma NVIDIA runfil, bygger DKMS-moduler mot målets kärna, applicerar ProxMenux-patchen om källan hade den."
+      },
+      {
+        "component": "coral_driver",
+        "installer": "gpu_tpu/install_coral.sh",
+        "action": "Läser versionen av Coral-drivrutinen och kompilerar DKMS-modulen för målets kärna."
+      },
+      {
+        "component": "amdgpu_top",
+        "installer": "gpu_tpu/amd_gpu_tools.sh",
+        "action": "Läser den inspelade versionen. Laddar ner exakt <code>.deb</code> från GitHub release."
+      },
+      {
+        "component": "intel_gpu_tools",
+        "installer": "gpu_tpu/intel_gpu_tools.sh",
+        "action": "APT-installerar paketet. Idempotent om det redan finns från <code>packages.manual.list</code>."
+      }
+    ]
+  },
+  "restoreFlow": {
+    "heading": "Hur återställningen förbrukar de tre nyttolasterna",
+    "intro": "Återställningen är en sexstegs pipeline. Varje steg läser en specifik delmängd av arkivet och uppdaterar målvärden. Inget stadium kräver att källvärden kan nås - arkivet är helt fristående.",
+    "stagesCaption": "Steg 1 använder manifestet för att bestämma vad du ska röra. Steg 2 kopierar rootfs vägar som är säkra att tillämpa på ett körsystem. Stadium 3 iscensätter de riskfyllda vägarna för nästa start. Steg 3b importerar icke-rot ZFS datapooler vars diskar är alla närvarande. Steg 4 hanterar paket. Stage 5 körs efter omstart och ominstallerar komponenter mot målets kärna.",
+    "stageRows": [
+      {
+        "stage": "1",
+        "name": "Kompatibilitetskontroll",
+        "reads": "manifest.json",
+        "action": "Kör <code>hb_compat_check</code>. Jämför källa vs mål hårdvara (NIC, lagrings-ID), PVE-version och stor kärnversion. Set <code>HB_COMPAT_KERNEL_DIRECTION</code> (<code>same</code>, <code>bk_newer</code> eller <code>bk_older</code>) och befolkar <code>RS_SKIP_PATHS</code> med hårdvara-drift och cross-kernel uteslutningar."
+      },
+      {
+        "stage": "2",
+        "name": "Tillämpning under drift",
+        "reads": "rootfs/ (endast säkra vägar)",
+        "action": "<code>_rs_apply … hot</code> kopierar <code>hb_classify_path</code>=<code>hot</code>-poster direkt till live-målet. Allt under <code>/etc/pve</code>, <code>/etc/network</code> eller vägar som klassificeras som <em>reboot</em>/<em>dangerous</em> uppskjuts."
+      },
+      {
+        "stage": "3",
+        "name": "Förbered uppskjutna ändringar",
+        "reads": "rootfs/ (omstart + farliga vägar)",
+        "action": "<code>_rs_prepare_pending_restore</code> förbereder riskfyllda sökvägar under <code>/var/lib/proxmenux/pending-restore/</code>, skriver <code>plan.env</code>, <code>apply-on-boot.list</code> och <code>rs-skip-paths.txt</code> och aktiverar <code>proxmenux-restore-onboot.service</code> för nästa start."
+      },
+      {
+        "stage": "3b",
+        "name": "Datapool import",
+        "reads": "manifest.storage_inventory + mål ZFS tillstånd",
+        "action": "<code>_rs_import_data_pools</code> försöker importera varje ZFS-pool utan rotfilsystem vars samtliga diskar finns på målet. Pooler med ett annat hostid provas igen med <code>zpool import -f</code>. Om någon disk saknas hoppas poolen över med en varning. Resultatet per pool loggas i <code>/var/log/proxmenux/restore-datapools-&lt;timestamp&gt;.log</code>."
+      },
+      {
+        "stage": "4",
+        "name": "Paketinstallation",
+        "reads": "metadata/packages.manual.list",
+        "action": "<code>_rs_run_complete_extras</code> kör kaskadsäkert filter och kallar <code>apt-get install -y</code> med den överlevande paketlistan. Fullständig utdata går till <code>/var/log/proxmenux/restore-apt-*.log</code>."
+      },
+      {
+        "stage": "5",
+        "name": "Efter uppstart",
+        "reads": "rootfs (redan tillämpat) + components_status.json",
+        "action": "Efter omstart, <code>apply_pending_restore.sh</code> spelar tillbaka de uppskjutna banorna och <code>apply_cluster_postboot.sh</code> kör <code>update-initramfs</code>, <code>update-grub</code> (eller <code>proxmox-boot-tool refresh</code>) och itererar över <code>components_status.json</code> skjuter varje komponent <code>--auto-reinstall</code> krok."
+      }
+    ]
+  },
+  "whyItWorks": {
+    "heading": "Varför säkerhetskopian delas i tre delar",
+    "body": "Uppdelningen följer uppgifternas <strong>livscykel</strong>. Filsystemet överförs med <code>rsync</code>: snabbt, öppet och atomärt per fil. Konfigurationstillstånd som måste tolkas före ändringar lagras som <strong>strukturerad JSON</strong>, läsbar för sig, versionshanterbar med schema och maskinellt jämförbar med målets tillstånd. Programvara som ska installeras om beskrivs i en <strong>inventering</strong> med namn och versioner; målets pakethanterare och ProxMenux installationsprogram väljer rätt binärer. Varje del fyller sin egen uppgift. Tillsammans eftersträvar de en sammanhängande återställning med feltolerans: ett skadat manifest lämnar rootfs återställbart, ett saknat paket hindrar inte komponentinstallation och ett fel för en post stoppar inte nästa."
+  }
+}
diff --git a/web/messages/sv/docs/backup-restore/index.json b/web/messages/sv/docs/backup-restore/index.json
new file mode 100644
index 00000000..0c60947e
--- /dev/null
+++ b/web/messages/sv/docs/backup-restore/index.json
@@ -0,0 +1,93 @@
+{
+  "meta": {
+    "title": "ProxMenux Säkerhetskopiering och återställning — Översikt | Fullständig säkerhetskopiering och återställning av värd för Proxmox VE",
+    "description": "ProxMenux Backup & Restore fångar det fullständiga tillståndet för en Proxmox-värd – filsystem, strukturerat konfigurationsmanifest och installerade paket/komponenter – och återskapar det på samma eller en annan värd. Säkerhetskopieringen och återställningen är fristående: inga externa beroenden, och återställningar över kärnor stöds genom ett riktningsmedvetet filter för säker delmängd och kärnagnostisk hydrering.",
+    "ogTitle": "ProxMenux Säkerhetskopiering och återställning — Översikt",
+    "ogDescription": "Fullständig säkerhetskopiering och återställning av värd för Proxmox VE med strukturerat manifest, paketlista och ominstallerare av komponenter.",
+    "twitterTitle": "ProxMenux Säkerhetskopiering och återställning | ProxMenux",
+    "twitterDescription": "Fullständig säkerhetskopiering och återställning av värd för Proxmox VE med strukturerat manifest, paketlista och ominstallerare av komponenter."
+  },
+  "header": {
+    "title": "Säkerhetskopiering och återställning",
+    "description": "Säkerhetskopiering av hela värden och återställning för Proxmox VE. Fångar filsystem, konfiguration och installerade komponenter i ett enda arkiv och återskapar värden på samma eller en annan Proxmox-installation utan externa beroenden.",
+    "section": "Säkerhetskopiering och återställning"
+  },
+  "intro": {
+    "title": "Vad det är, i ett stycke",
+    "body": "En ProxMenux-säkerhetskopia sparar hela tillståndet för en Proxmox-värd: <strong>filsystemet</strong>, med relevanta kataloger under <code>/etc</code>, <code>/root</code> och <code>/var/lib/pve-cluster</code> samt valfria egna sökvägar; <strong>ett strukturerat manifest</strong> i JSON med upptäckt maskinvara, kärnparametrar, nätverkskonfiguration, ZFS-status, användare och cron-poster; och <strong>en programinventering</strong> med paket som APT markerar som manuellt installerade samt komponenter som ProxMenux installerat, med exakta versioner. Alla tre mål som stöds – lokalt arkiv, Proxmox Backup Server (rekommenderas) och Borg – får samma fristående innehåll. Vart och ett kan användas för att återskapa målvärden utan att källvärden behöver vara nåbar under återställningen."
+  },
+  "video": {
+    "heading": "Videogenomgång",
+    "intro": "Föredrar du att titta på Backup & Restore i aktion innan du konfigurerar det? Den här genomgången täcker en fullständig demo av funktionen i ProxMenux.",
+    "title": "ProxMenux – genomgång för säkerhetskopiering och återställning",
+    "caption": "Extern video på YouTube. Spelas upp i integritetsförbättrat läge (inga cookies förrän du trycker på play)."
+  },
+  "whatItIsNot": {
+    "heading": "Vad det inte är",
+    "intro": "Det här avsnittet gäller säkerhetskopiering och återställning <strong>av värden</strong>: själva Proxmox-installationen, inte de program och gästsystem som körs på den.",
+    "items": [
+      "<strong>Det här är inget verktyg för säkerhetskopiering av VM:ar eller CT:er.</strong> Funktionen sparar varken gästernas diskar eller RAM-tillstånd; det sköts av <code>vzdump</code>. Gästernas <strong>konfigurationsfiler</strong> (<code>/etc/pve/nodes/&lt;node&gt;/qemu-server/*.conf</code> och <code>lxc/*.conf</code>) <strong>ingår däremot</strong>. Efter återställning visas inventeringen igen, och diskarna kan återställas eller anslutas från en befintlig PBS- eller lokal säkerhetskopia.",
+      "<strong>Det här är ingen åtgärd för hela klustret.</strong> Varje nod säkerhetskopierar sig själv. Klustertillhörigheten sparas i <code>/etc/pve</code> så att en återställd nod kan anslutas igen, men återställning av hela klustret kräver samordning mellan noderna.",
+      "<strong>Det här är ingen fullständig diskavbildning.</strong> Kärnans binärfiler, initramfs och startpartitionen ingår inte. Vid återställning använder ProxMenux målvärdens egna startfiler, som återskapas automatiskt av <code>update-initramfs</code> och starthanterarens verktyg, och installerar drivrutiner som passar målets körande kärna."
+    ]
+  },
+  "threePillars": {
+    "heading": "De tre pelarna i en säkerhetskopia",
+    "intro": "Ett ProxMenux arkiv är uppbyggt kring tre fristående nyttolaster. Återställningen använder alla tre tillsammans för att reproducera källvärden på ett mål som kanske inte ens har samma kärna installerad.",
+    "diagramCaption": "Varje säkerhetskopia innehåller samma tre datablock oavsett destination. Återställningen använder alla tre: rootfs för att återställa filerna, manifestet för att upptäcka avvikelser och skillnader mellan kärnversioner samt programinventeringen för att installera om paket och komponenter för målets egen kärna.",
+    "pillar1Label": "Filsystem",
+    "pillar1Detail": "rootfs/\n(rsync av /etc,\n/etc/systemd/network,\n/root, samt en\nsqlite3-ögonblicksbild\nav /var/lib/pve-cluster,\n+ valfria sökvägar)",
+    "pillar2Label": "Manifest",
+    "pillar2Detail": "manifest.json\n(maskinvara, kärn-\nparametrar, nätverk,\nZFS, användare, cron,\nZFS-pooler, lagring)",
+    "pillar3Label": "Applikationer",
+    "pillar3Detail": "packages.manual.list\n+ components_status.json\n(manuella APT-paket + ProxMenux-\ninstallationsprogram med versioner)"
+  },
+  "restoreIsUniversal": {
+    "heading": "Återställningen återger källvärden, inte arkivet",
+    "body": "En återställning av en ProxMenux-säkerhetskopia packar inte bara upp filsystemet. Återställningen läser manifestet för att upptäcka avvikelser mellan källa och mål (maskinvaruskillnader, namnbyten på nätverkskort, kärnversion och ZFS-poolens identitet), återställer filsystemet och startar sedan rätt komponentinstallerare för varje tjänst som fanns på källan (NVIDIA-drivrutin, Coral TPU samt GPU-verktyg för AMD och Intel). Varje installerare körs för <strong>målets aktuella kärna</strong>, så den återställda värden är inte beroende av att källans kärna finns kvar. När målets kärna är nyare än säkerhetskopians sammanfogar en kärnoberoende <strong>hydrering</strong> användarens egna inställningar (IOMMU-token, VFIO-enhets-ID:n, särskilda anpassningar och GRUB-nycklar) med målets nya startkonfiguration utan att kopiera kärnbundna filer ordagrant."
+  },
+  "twoInterfaces": {
+    "heading": "Två gränssnitt, en backend",
+    "intro": "Varje steg i arbetsflödet för säkerhetskopiering och återställning är tillgängligt från två ingångspunkter. Båda anropar samma skalbibliotek, producerar identiska arkiv och läser samma jobbregister.",
+    "cliLabel": "ProxMenux Scripts (TUI)",
+    "cliDetail": "meny → Verktyg →\nVärdsäkerhetskopiering/återställning\n\nDialogbaserat flöde,\nSSH-vänlig, skriptbar\nför obevakad användning.",
+    "webLabel": "ProxMenux Monitor (Webb UI)",
+    "webDetail": "Backups-fliken i\nMonitors webbgränssnitt.\n\nÅterställning med ett klick,\nlöpande loggvisning, integrerat\nmed aviseringar och visning\nav skillnader vid återställning."
+  },
+  "whereNext": {
+    "heading": "Vart ska man gå härifrån",
+    "intro": "Varje underavsnitt nedan täcker en aspekt av arbetsflödet på djupet. Börja med <em>Hur det fungerar</em> om målet är att förstå vad arkivet innehåller och varför. Hoppa till <em>Destinationer</em> för att konfigurera målet för kopian. Läs <em>Återställning</em> och <em>Återställning mellan kärnversioner</em> för återställningssidan.",
+    "items": [
+      {
+        "label": "Så fungerar det",
+        "href": "/docs/backup-restore/how-it-works",
+        "tail": "— de tre nyttolasterna (rootfs, manifest, applikationer) i detalj, med de samlare som producerar dem och formatet för varje fil."
+      },
+      {
+        "label": "Destinationer",
+        "href": "/docs/backup-restore/destinations",
+        "tail": "— jämförelse av lokal, Proxmox Backup Server (rekommenderas) och Borg, och hur man konfigurerar var och en."
+      },
+      {
+        "label": "Skapa säkerhetskopior",
+        "href": "/docs/backup-restore/creating-backups",
+        "tail": "— engångssäkerhetskopior, standardsökvägsprofilen, lägga till anpassade sökvägar, kryptering för PBS."
+      },
+      {
+        "label": "Schemalagda jobb",
+        "href": "/docs/backup-restore/scheduled-jobs",
+        "tail": "— nya jobb kontra att koppla till ett befintligt PVE vzdump-jobb, schemaläggningsformat, jobbdetaljmodal."
+      },
+      {
+        "label": "Återställning",
+        "href": "/docs/backup-restore/restoring",
+        "tail": "— de tre åtgärderna i ett arkiv (visa, ladda ner, återställ), Komplett vs. anpassad återställning, post-boot-dispatcher och varför de sista tio minuterna är viktiga."
+      },
+      {
+        "label": "Återställning mellan kärnversioner",
+        "href": "/docs/backup-restore/cross-kernel",
+        "tail": " — beteende som tar hänsyn till riktningen på versionsbytet när målets kärna skiljer sig från säkerhetskopians, filtret för en säker delmängd och de fyra hydreringsfaserna."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sv/docs/backup-restore/restoring.json b/web/messages/sv/docs/backup-restore/restoring.json
new file mode 100644
index 00000000..2d86fed6
--- /dev/null
+++ b/web/messages/sv/docs/backup-restore/restoring.json
@@ -0,0 +1,282 @@
+{
+  "meta": {
+    "title": "Återställ en backup - full och anpassade flöden | ProxMenux",
+    "description": "Hela återställningsflödet: visa, ladda ner eller återställa en säkerhetskopia, kompatibilitetskontroll och resultat, fullständigt eller anpassat läge, sökvägar som tillämpas direkt eller efter omstart samt startskriptet och ominstallation av komponenter efter start.",
+    "ogTitle": "ProxMenux Backup - återställande",
+    "ogDescription": "Fullständiga och anpassade återställningsflöden med kompatibilitetskontrollen, banklassificering, on-boot dispatcher och post-boot ominstallation.",
+    "twitterTitle": "Återställ en backup | ProxMenux",
+    "twitterDescription": "Hur en ProxMenux värd backup förvandlas tillbaka till en fungerande Proxmox värd."
+  },
+  "header": {
+    "title": "Återställ en backup",
+    "description": "Det fullständiga återställningsflödet: från att välja ett arkiv till en fungerande värd. Dokument kompatibilitetskontrollen, de två återställningslägena, on-boot-avsändaren, post-boot-ominstallationspasset och de mekanismer som gör cross-host och cross-kernel-återställningar förutsägbara.",
+    "section": "Säkerhetskopiering och återställning"
+  },
+  "intro": {
+    "title": "Återställningen reproducerar källan, inte bara filerna",
+    "body": "Att återställa en ProxMenux-säkerhetskopia innebär mer än att packa upp filer. Före ändringar läses manifestet för att hitta skillnader mellan källa och mål, sökvägar som kan hindra starten utesluts och användarinställningar som inte kan kopieras direkt anpassas. Efter den nödvändiga omstarten försöker processen installera om de registrerade komponenter som stöds (NVIDIA-drivrutin, Coral TPU och GPU-verktyg) för målets aktiva kärna. Ett enda arkiv styr kompatibilitetskontroll, sökvägsklassificering och arbetet under och efter start. Kontrollera resultaten per komponent och loggarna för att bekräfta utfallet."
+  },
+  "threeActions": {
+    "heading": "Tre åtgärder på en backup",
+    "intro": "Välja en säkerhetskopia från listan öppnar en meny med tre åtgärder.",
+    "actionRows": [
+      {
+        "action": "Visa",
+        "detail": "Öppnar en skrivskyddad vy av arkivet: manifest.json-innehåll (källvärdnamn, PVE-version, kärna, hårdvara, installerade komponenter), listan över vägar inuti <code>rootfs/</code> och en diff av vad som skulle förändras på den aktuella värden om säkerhetskopieringen tillämpades."
+      },
+      {
+        "action": "Ladda ner",
+        "detail": "Exporterar arkivet som en bärbar <code>.tar.zst</code>-fil (tar komprimerad med zstd). Det kan extraheras på alla Linux-system med <code>tar --zstd -xf FILE.tar.zst</code>, eller på macOS / Windows med något verktyg som stöder zstd (7-Zip, PeaZip, Keka ...). Det extraherade trädet innehåller <code>manifest.json</code>, <code>metadata/</code> och <code>rootfs/</code> - exakt samma layout som återställningen förbrukar. Användbar för offline inspektion eller för att återställa på en värd utan tillgång till den ursprungliga destinationen (PBS, Borg)."
+      },
+      {
+        "action": "Återställa",
+        "detail": "Åtgärden som skriver till systemet. Packar upp arkivet i en förberedelsekatalog, kör kompatibilitetskontrollen och visar valet mellan fullständig och anpassad återställning."
+      }
+    ]
+  },
+  "compatibilityCheck": {
+    "heading": "Kompatibilitetskontrollen",
+    "intro": "Innan någon fil skrivs jämför <code>hb_compat_check</code> det tillstånd som beskrivs i manifestet mot målvärden. Kontrollen läser endast data och producerar fyra oberoende utgångar som driver resten av återställningen.",
+    "outputRows": [
+      {
+        "output": "Riktningsflaggan",
+        "detail": "<code>HB_COMPAT_KERNEL_DIRECTION</code> är <code>same</code>, <code>bk_newer</code> eller <code>bk_older</code> efter jämförelse av kärnans huvudversion i säkerhetskopian och på målet. Det styr filtret för säkra sökvägar mellan kärnor, som bara används vid <code>bk_older</code>, och anpassningen av inställningar som beskrivs på sidan om återställning mellan kärnversioner."
+      },
+      {
+        "output": "Lista över undantagna sökvägar",
+        "detail": "<code>RS_SKIP_PATHS</code> varje väg som restaureringen inte får tillämpa. Befolkad av två mekanismer: hårdvarudrift (saknas NIC, saknas lagrings-ID, utländsk ZFS pool) och — när riktningen är <code>bk_older</code> - cross-kernel unsafe-paths lista."
+      },
+      {
+        "output": "Plan för ommappning av nätverkskort",
+        "detail": "När en NIC på målet har samma MAC som en på källan men ett annat namn (typiskt efter en moderkortsbyte), registrerar kompatibilitetskontrollen en bytesplan (<code>HB_NIC_REMAP</code>) som kommer att skriva om <code>/etc/network/interfaces</code> under återställningen."
+      },
+      {
+        "output": "Återställningsplan",
+        "detail": "Beräknas av <code>compute_rollback_plan.sh</code>. Listar VM, LXC och komponenter som finns på målet men saknas i säkerhetskopian. Bekräftelsen erbjuder valfri borttagning av extra gäster före omstart. Komponenter tas bort manuellt och gästborttagning kan misslyckas; en exakt matchning garanteras därför inte."
+      }
+    ],
+    "reportBody": "Kontrollen avger också en strukturerad rapport (<code>HB_COMPAT_RESULTS</code>) som kategoriseras som PASS / INFO / WARN / FAIL. WARN och FAIL-poster dyker upp i panelen före återställningen; återställningen vägrar att fortsätta först när en FAIL är närvarande att användaren inte kan lösa genom att klicka på Fortsätt."
+  },
+  "twoModes": {
+    "heading": "Full återställning vs Anpassad återställning",
+    "intro": "Efter kompatibilitetskontrollen visas lägesvalet. Det avgör <em>vad</em> som tillämpas och inte <em>hur</em>: båda lägena använder samma process.",
+    "modeRows": [
+      {
+        "mode": "Full återställning",
+        "detail": "Gäller varje väg i arkivet som överlever drift och cross-kernel filter. Kör också paketet installera och komponenten auto-reinstall pass. Detta är standarden och det rekommenderade valet - målet är att reproducera källan, inte plocka bitar."
+      },
+      {
+        "mode": "Anpassad återställning",
+        "detail": "Öppnar en checklista med alla sökvägar i arkivet. Användaren väljer en delmängd. Sökvägar som blockeras av filtret mellan kärnor är grå och kan inte väljas. Paketinstallation och automatisk ominstallation av komponenter hoppas över som standard i anpassat läge, eftersom användaren begär en partiell återställning."
+      }
+    ]
+  },
+  "pathClassification": {
+    "heading": "Hur vägar klassificeras",
+    "intro": "Varje väg som valts för återställningen klassificeras av <code>hb_classify_path</code> i en av tre kategorier. Kategorin bestämmer när vägen tillämpas på systemet och varför.",
+    "rows": [
+      {
+        "class": "hot",
+        "detail": "Paths tillämpade <strong>omedelbart</strong> till körsystemet. Tjänsten som förbrukar dem plockar upp förändringen på egen hand eller vid nästa reload - ingen omstart krävs. Dessa är huvuddelen av en säkerhetskopia: <code>/etc/ssh</code>, <code>/etc/apt</code>, <code>/etc/cron.*</code>, <code>/root</code>, <code>/usr/local/bin</code>, allmänna servicekonfigurationsfiler etc."
+      },
+      {
+        "class": "reboot",
+        "detail": "Sökvägar som skjuts upp till <strong>nästa start</strong> i stället för att tillämpas <strong>omedelbart</strong> av återställningen. De påverkar startkonfigurationen: genereringen av starthanteraren läser <code>/etc/default/grub</code>, monteringar använder <code>/etc/fstab</code> och modulladdning <code>/etc/modules</code>. De väntande filerna tillämpas efter omstart och nödvändiga startfiler genereras sedan om. Exempel: <code>/etc/default/grub</code>, <code>/etc/kernel</code>, <code>/etc/modules</code>, <code>/etc/fstab</code>, <code>/etc/zfs</code>, <code>/etc/modprobe.d</code>."
+      },
+      {
+        "class": "dangerous",
+        "detail": "Sökvägar som <strong>INTE tillämpas på det körande systemet</strong>: en skrivning under drift kan förstöra tillståndet eller bryta den aktiva anslutningen. De läggs i den väntande uppsättningen: <code>/etc/network</code> skrivs tidigt vid nästa start, innan nätverket startar, och <code>/etc/pve</code> skrivs av efterstartsdistributören när klusterfilsystemet är uppe. Exempel: <code>/etc/pve</code> (pmxcfs är en aktiv FUSE-montering med klustrets konfiguration), <code>/var/lib/pve-cluster</code> (aktiva klusterdata, sparade i återställningskatalogen endast för manuell återställning), <code>/etc/network</code> (kan konfigurera om just det gränssnitt som SSH-anslutningen använder och bryta sessionen)."
+      }
+    ]
+  },
+  "fullFlow": {
+    "heading": "Fullständig återställning arbetsflöde",
+    "intro": "Den kompletta pipeline från arkivval till en återställd arbetsvärd. Varje steg matar nästa, staten skriven av tidigare stadier konsumeras av senare.",
+    "diagram": "┌─────────────────────────────────────────────────────────────────┐\n│  Archive → staging_root/                                        │\n│    manifest.json   metadata/   rootfs/                          │\n└──────────────────────────────┬──────────────────────────────────┘\n                               │\n                               ▼\n   ┌─────────────────────────────────────────────────────────┐\n   │  1. hb_compat_check                                     │\n   │     · hardware drift → RS_SKIP_PATHS                    │\n   │     · kernel direction → same / bk_newer / bk_older     │\n   │     · NIC remap plan                                    │\n   │     · hydration plan (bk_older only)                    │\n   │     · rollback plan                                     │\n   └──────────────────────────────┬──────────────────────────┘\n                                  │\n                                  ▼\n   ┌─────────────────────────────────────────────────────────┐\n   │  2. Confirmation dialog                                 │\n   │     Shows: hot count, pending count, drift, hydration,  │\n   │     NIC remap, cross-kernel note, reinstalls preview    │\n   └──────────────────────────────┬──────────────────────────┘\n                                  │ (accepted)\n                                  ▼\n   ┌─────────────────────────────────────────────────────────┐\n   │  3. Apply hot paths → LIVE                              │\n   │     _rs_apply rsyncs each hot path                      │\n   │     from staging_root/rootfs to /                       │\n   │     (skips paths in RS_SKIP_PATHS)                      │\n   └──────────────────────────────┬──────────────────────────┘\n                                  │\n                                  ▼\n   ┌─────────────────────────────────────────────────────────┐\n   │  4. _rs_prepare_pending_restore                         │\n   │     /var/lib/proxmenux/pending-restore/                 │\n   │       ├── apply-on-boot.list                            │\n   │       ├── plan.env                                      │\n   │       ├── rs-skip-paths.txt                             │\n   │       └── rootfs/ (deferred paths)                      │\n   │     Enable proxmenux-restore-onboot.service             │\n   └──────────────────────────────┬──────────────────────────┘\n                                  │\n                                  ▼\n   ┌─────────────────────────────────────────────────────────┐\n   │  4b. _rs_import_data_pools                              │\n   │      Imports non-root ZFS pools whose disks are all     │\n   │      present; retries with -f on foreign hostid;        │\n   │      skips with a warning when disks are missing.       │\n   │      Log: /var/log/proxmenux/restore-datapools-*.log    │\n   └──────────────────────────────┬──────────────────────────┘\n                                  │\n                                  ▼\n   ┌─────────────────────────────────────────────────────────┐\n   │  5. _rs_run_complete_extras                             │\n   │     packages.manual.list                                │\n   │       → cascade-safe filter                             │\n   │       → apt-get install                                 │\n   └──────────────────────────────┬──────────────────────────┘\n                                  │\n                                  ▼\n   ┌─────────────────────────────────────────────────────────┐\n   │  6. REBOOT                                              │\n   └──────────────────────────────┬──────────────────────────┘\n                                  │\n                                  ▼\n   ┌─────────────────────────────────────────────────────────┐\n   │  7. apply_pending_restore.sh (on early boot)            │\n   │     Reads plan.env                                      │\n   │     Applies apply-on-boot.list (filtered)               │\n   │     Installs the postboot systemd unit                  │\n   └──────────────────────────────┬──────────────────────────┘\n                                  │\n                                  ▼\n   ┌─────────────────────────────────────────────────────────┐\n   │  8. apply_cluster_postboot.sh (~10 minutes)             │\n   │     Runs after pve-cluster is up                        │\n   │     · Applies /etc/pve entries to pmxcfs                │\n   │     · update-initramfs -u -k all                        │\n   │     · update-grub / proxmox-boot-tool refresh           │\n   │     · component --auto-reinstall (nvidia, coral, ...)   │\n   │     · Boot sanity check                                 │\n   │     · Notification: \"Host restore finished\"             │\n   └─────────────────────────────────────────────────────────┘"
+  },
+  "pendingMachinery": {
+    "heading": "Mekanismen för uppskjuten återställning",
+    "intro": "Paths som klassificeras som <code>reboot</code> eller <code>dangerous</code>, och hydrering skriver, iscensätts för nästa start istället för att appliceras live. Detta görs genom en liten, självinnehållen uppsättning filer under <code>/var/lib/proxmenux/pending-restore/</code>:",
+    "rows": [
+      {
+        "file": "apply-on-boot.list",
+        "content": "En relativ sökväg per rad: exakt de sökvägar som <code>apply_pending_restore.sh</code> tillämpar från förberett rootfs. Filen visar vad som ändras vid nästa start."
+      },
+      {
+        "file": "plan.env",
+        "content": "Miljövariabler som hämtats från on-boot script: restaurera ID, kompatibilitetsflaggor (<code>HB_COMPAT_CROSS_VERSION</code>, <code>HB_COMPAT_KERNEL_DIRECTION</code>, <code>HB_HYDRATION_APPLIED</code>), Rollback opt-in flagga, kluster alternativ."
+      },
+      {
+        "file": "rs-skip-paths.txt",
+        "content": "Den slutliga <code>RS_SKIP_PATHS</code>-listan, kvarstår så <code>apply_pending_restore.sh</code> tillämpar samma uteslutningar efter omstart som beräknades under det interaktiva steget. Förhindrar driftdrabbade eller kors-kernel-osäkra vägar från att återställas vid starttid."
+      },
+      {
+        "file": "rootfs/",
+        "content": "Själva förberedda filerna: exakt de byte som ska skrivas. De lagras på samma filsystem som <code>/</code> så att rsync vid start går snabbt och inte kräver åtkomst till extern lagring."
+      }
+    ],
+    "unitBody": "Systemd-enheten <code>proxmenux-restore-onboot.service</code> aktiveras i slutet av det interaktiva steget. Engångstjänsten körs tidigt vid nästa start, anropar <code>apply_pending_restore.sh</code> och inaktiverar sedan sig själv. Villkoret <code>ConditionPathExists=/var/lib/proxmenux/pending-restore/state</code> gör att inget körs vid starter utan väntande återställning."
+  },
+  "postbootDispatcher": {
+    "heading": "Post-boot dispatcher - apply_cluster_postboot.sh",
+    "intro": "Där det interaktiva steget slutar och där den faktiska värdreproduktionen sker. <code>apply_cluster_postboot.sh</code> installeras som en andra one-shot systemd-enhet (<code>proxmenux-apply-cluster-postboot.service</code>) vars <code>After=</code>/<code>Wants=</code>-mål säkerställer att det körs först efter att pve-cluster och nätverk-online är uppe. Det är här värdsynliga återställningsåtgärder landar.",
+    "tasks": [
+      {
+        "task": "Applicera /etc/pve",
+        "detail": "<code>/etc/pve</code> är ett levande pmxcfs FUSE-fäste - det kan inte skrivas till på tidig start. Dispatcher kopierar filer från de förberedda rootfs till live <code>/etc/pve</code> när klusterfilsystemet är upp, en fil i taget, utan att starta om pve-kluster. Den fångade <code>/var/lib/pve-cluster/config.db</code> från backupen (eller den befordrade <code>config.db.raw-fallback</code>) materialiseras med <code>systemctl stop pve-cluster</code> → atomfilkopia → <code>systemctl start pve-cluster</code> mönster, så pmxcfs återläser det återställda tillståndet på vägen tillbaka upp."
+      },
+      {
+        "task": "Rebuild initramfs och bootloader",
+        "detail": "Kör <code>update-initramfs -u -k all</code> över varje installerad kärna, sedan antingen <code>update-grub</code> (GRUB-installationer) eller <code>proxmox-boot-tool refresh</code> (systemd-start / ZFS-installationer). Skippades om det interaktiva steget fastställde ingenting förändrades i de vägar som påverkar dessa verktyg."
+      },
+      {
+        "task": "Komponent auto-reinstallation",
+        "detail": "Läser återställd <code>components_status.json</code> och går igenom de installationsprogram som stöds (nvidia_driver, coral_driver, amdgpu_top, intel_gpu_tools). Varje valt program körs med <code>--auto-reinstall</code>, läser registrerat tillstånd och installerar för målmiljön, med ombyggnad av kärnmoduler där det behövs. Arbetet väntar till efter omstart för att använda målets då aktiva kärna. Enskilda fel loggas och stoppar inte nästa komponent."
+      },
+      {
+        "task": "Rimlighetskontroll vid uppstart",
+        "detail": "Innan du skjuter slutförandet av meddelandet, verifierar att <code>proxmox-boot-tool status</code> visar en konfigurerad ESP, har varje <code>/boot/vmlinuz-*</code> en matchande <code>/lib/modules/&lt;ver&gt;</code>-katalog och <code>/vmlinuz</code> löser. Varje inkonsistens dyker upp i meddelandet istället för att vara dold."
+      },
+      {
+        "task": "Slutförande anmälan",
+        "detail": "Skickar <code>Host restore finished</code>-eventet genom <code>hb_notify_lifecycle</code>. Inkluderar total varaktighet, tillämpad vägräkning, sanity-check varningar om någon, och en länk till loggen på <code>/var/log/proxmenux/proxmenux-cluster-postboot-*.log</code>. Om meddelanden inte är konfigurerade är händelsen tyst - loggen registrerar fortfarande allt."
+      }
+    ]
+  },
+  "liveProgress": {
+    "heading": "Aktuellt förlopp på fliken Säkerhetskopior i Monitor",
+    "body": "Efter omstarten av Backups-fliken ProxMenux Monitor gör ett live post-restore-kort som återspeglar tillståndet <code>proxmenux-apply-cluster-postboot.service</code> som det körs. Kortet drivs av <code>/var/lib/proxmenux/restore-state.json</code>, som avsändaren uppdaterar på varje milstolpe (tillämplig klusterkonfig, återuppbygga initramfs, uppdatera bootloader, per-component ominstallera, start sanity check, slutföra).",
+    "fields": [
+      {
+        "name": "Statusmärke",
+        "detail": "Något av tillstånden <em>Återställning pågår</em>, <em>Återställning klar</em> eller <em>Återställning misslyckades</em>. Kortet läser tillståndsfilen varannan sekund under körning och var 30:e sekund efter avslut."
+      },
+      {
+        "name": "Förloppsindikator och stegräknare",
+        "detail": "Visar <code>N/M steps</code> med namnet på det aktuella steget. Under återställningen beräknas en <em>uppskattad tid</em> från slutförda steg och förfluten tid."
+      },
+      {
+        "name": "Komponentlista",
+        "detail": "En rad per drivrutin installeras om (NVIDIA, Intel GPU verktyg, AMD verktyg, Coral TPU) med <code>installing</code> / <code>ok</code> / <code>failed</code> plus en länk till per-komponent logga på <code>/var/log/proxmenux/component-*.log</code>."
+      },
+      {
+        "name": "Datapool import",
+        "detail": "Blocket <code>data_pools_import</code> visar fem färgade rader: <em>Importerade</em>, <em>Tvingade</em> (med <code>-f</code> för ett annat hostid), <em>Överhoppade, delvis närvarande</em> (bara vissa diskar finns), <em>Överhoppade, saknade</em> (inga diskar finns) och <em>Misslyckade</em>. Tillståndet sparas i <code>/var/lib/proxmenux/restore-state.json</code> och hela körningsloggen i <code>/var/log/proxmenux/restore-datapools-&lt;timestamp&gt;.log</code>."
+      },
+      {
+        "name": "Varningar om startkonfigurationen",
+        "detail": "Processen kontrollerar saknade <code>/lib/modules/&lt;kernel&gt;</code>-kataloger, saknad ESP-konfiguration och <code>/vmlinuz</code>-länkar utan giltigt mål. Varningar visas här i en färgad ruta."
+      },
+      {
+        "name": "Återställningsdelta",
+        "detail": "Listor VMs, LXCs och komponenter som finns på målet men inte var i den återställda backupen - samma poster som uppstod i förväg destruktiv återgångsdialog. Varje rad bär manuell rensning kommandot."
+      },
+      {
+        "name": "Loggens slut",
+        "detail": "De sista 600-linjerna i <code>proxmenux-cluster-postboot-&lt;ts&gt;.log</code>, med ett <em>Endast problem</em>-filter som håller bara linjer som matchar <code>error</code>, <code>warning</code>, <code>failed</code>, <code>✗</code> eller <code>traceback</code>."
+      }
+    ],
+    "dismissBody": "När återställningen är <em>klar</em> eller <em>misslyckad</em> fäller knappen Dölj ihop kortet. Tillståndsfilen bevaras och Historik öppnar denna och tidigare återställningar igen. De senaste 20 körningarna arkiveras under <code>/var/lib/proxmenux/restore-history/</code>.",
+    "imageAlt": "Detaljdialogen för återställning i ProxMenux Monitor under körning: blå statusmarkering, aktuellt steg Bygger om initramfs, uppskattad återstående tid, delvis fylld förloppsindikator och aktuella loggrader.",
+    "imageCaption": "Detaljerna modal medan post-boot-avsändaren fortfarande kör - emblem, aktuellt steg, tid kvar och levande loggsvans.",
+    "detailsImageAlt": "Samma detaljer modal efter återställningen har avslutats, med den gröna återställningen fullständiga märket, den totala löptiden (0m53s), en fullt fylld 6 / 6 framstegsfältet, den tomma Rollback delta och den arkiverade postboot log.",
+    "detailsImageCaption": "Samma modal när körningen har avslutats - emblem, total varaktighet, fylld progress bar och arkiverad postboot logg."
+  },
+  "postbootExample": {
+    "heading": "Hur post-boot ser ut på konsolen",
+    "body": "På den fysiska konsolen avslutas en process som lyckas med <code>[ OK ] Finished proxmenux-apply-cluster-postboot.service</code>, ofta nära <code>OK</code> för <code>multi-user.target</code> och <code>graphical.target</code>. Detta markerar att processen har avslutats. Enskilda komponentfel eller startvarningar kan ändå ha registrerats. Kontrollera komponenternas tillstånd och loggarna i Monitor innan värden betraktas som helt återställd.",
+    "imageAlt": "Proxmox fysiska konsol med '[ OK ] Finished proxmenux-apply-cluster-postboot.service - ProxMenux Apply Cluster Configs (post-boot).', följt av OK för multi-user.target och graphical.target och med inloggningsraden ovanför.",
+    "imageCaption": "Fysisk konsol när processen avslutats. 'Finished proxmenux-apply-cluster-postboot.service' markerar slutet, vilket även 'Host restore finished' visar i Monitor. Komponentresultat och varningar behöver fortfarande granskas."
+  },
+  "tenMinutes": {
+    "heading": "Varför de senaste tio minuterna är viktigt",
+    "intro": "Omstarten själv tar sekunder, men post-boot-avsändaren spenderar cirka tio minuter efter återställningen. Under detta fönster är värden nåbara och inloggningsarbeten, men vissa tjänster (främst GPU-drivrutinberoende) är ännu inte tillgängliga. Tidsuppdelning för en typisk Proxmox-värd med NVIDIA + Coral installerad:",
+    "rows": [
+      {
+        "stage": "Boot + pve-cluster redo",
+        "time": "~30 s",
+        "detail": "Standard Proxmox boot. SSH, webb-UI och inloggning är tillgängliga i slutet av detta skede."
+      },
+      {
+        "stage": "Applicera /etc/pve till pmxcfs",
+        "time": "~10 s",
+        "detail": "Snabba - små konfigfiler kopierade en efter en till live klusterfilsystemet."
+      },
+      {
+        "stage": "Rebuild initramfs över kärnor",
+        "time": "3–5 min",
+        "detail": "<code>update-initramfs -u -k all</code> bygger en initramfs avbildning per installerad kärna. Större delen av väntetiden."
+      },
+      {
+        "stage": "Bygg om starthanterarens konfiguration",
+        "time": "10–30 s",
+        "detail": "<code>update-grub</code> eller <code>proxmox-boot-tool refresh</code>. Snabbt även på ZFS."
+      },
+      {
+        "stage": "NVIDIA ominstallation av drivrutin (om tillämpligt)",
+        "time": "5–10 min",
+        "detail": "Ladda ner den inspelade drivrutinsversionen, sammanställer DKMS-modulerna mot den nuvarande kärnan, tillämpar ProxMenux-patchen om källan hade den. Längsta enskilda uppgift."
+      },
+      {
+        "stage": "Ominstallation av Coral och andra komponenter",
+        "time": "3–5 min",
+        "detail": "DKMS-kompilering för Coral, apt install för intel-gpu-tools samt nedladdning och installation av .deb för amdgpu_top."
+      },
+      {
+        "stage": "Startkontroll och meddelande",
+        "time": "~2 s",
+        "detail": "Kräver få resurser. Meddelandet informerar användaren så snart körningen har avslutats."
+      }
+    ],
+    "outroBody": "Under denna tid kan verktyg saknas efter inloggning (<code>nvidia-smi</code> hittas inte, <code>coral</code> identifieras inte), eftersom ominstallationen fortfarande körs i bakgrunden. Slutmeddelandet markerar arbetets slut; kontrollera komponentresultat, varningar och loggar för att skilja lyckade åtgärder från enskilda fel."
+  },
+  "destructiveRollback": {
+    "heading": "Den valfria destruktiva rollback",
+    "body": "Återställningen är additiv som standard: extra VM, LXC och komponenter blir kvar. Vid skillnader erbjuder bekräftelsen <em>Kör destruktiv återställning?</em>, med Nej som standard. Ja anropar <code>_rs_execute_rollback</code> före omstart för att försöka ta bort de listade extra VM:erna och LXC:erna. Komponenter markeras för manuell avinstallation eftersom automatisk avinstallation saknas. Fel vid borttagning rapporteras och processen fortsätter, så en exakt matchning garanteras inte. Granska namn och VMID/CTID före detta destruktiva val."
+  },
+  "logs": {
+    "heading": "Var loggarna finns",
+    "rows": [
+      {
+        "log": "/var/log/proxmenux/restore-YYYYMMDD_HHMMSS.log",
+        "detail": "Skrivs under det interaktiva steget: kompatibilitetsresultat, avvikelsefilter, anpassningsplan, utdata från direkt tillämpning och förberedelse av uppskjutna ändringar samt paketinstallation."
+      },
+      {
+        "log": "/var/log/proxmenux/apply-pending-YYYYMMDD_HHMMSS.log",
+        "detail": "Skrivs av <code>apply_pending_restore.sh</code> tidigt vid start: inläsning av plan.env, genomgång av apply-on-boot och filtrering av undantagna sökvägar."
+      },
+      {
+        "log": "/var/log/proxmenux/proxmenux-cluster-postboot-YYYYMMDD_HHMMSS.log",
+        "detail": "Skrivs av <code>apply_cluster_postboot.sh</code>: tillämpning av pve-cluster-konfiguration, utdata från initramfs och starthanterare, komponenternas installationsutdata, startkontroll och meddelandeinnehåll."
+      },
+      {
+        "log": "/var/log/proxmenux/component-<name>-YYYYMMDD_HHMMSS.log",
+        "detail": "En logg per komponentinstallationsprogram (nvidia, coral, etc.) som kördes i post-boot-passet. Användbart när en specifik komponents ominstallation misslyckades och användaren behöver verktygets egen utdata."
+      },
+      {
+        "log": "/var/log/proxmenux/restore-datapools-YYYYMMDD_HHMMSS.log",
+        "detail": "Skriven av <code>_rs_import_data_pools</code>. Innehåller: uppräkning av icke-rotpooler från det manifesterade, perpoolresultatet (importerad rent, importerad med <code>-f</code> för ett annat hostid, hoppad på grund av saknade diskar eller misslyckades), och råutdata av varje <code>zpool import</code> samtal."
+      }
+    ]
+  },
+  "whereNext": {
+    "heading": "Vart ska man gå nästa",
+    "items": [
+      {
+        "label": "Återställning mellan kärnversioner",
+        "href": "/docs/backup-restore/cross-kernel",
+        "tail": " - det riktningsmedvetna säkra filtret och det hydreringspass som åberopats när målkärnan skiljer sig från säkerhetskopieringen."
+      },
+      {
+        "label": "Hur det fungerar",
+        "href": "/docs/backup-restore/how-it-works",
+        "tail": " - arkivlayouten, manifestet och appliceringsinventeringen som återställningen förbrukar."
+      },
+      {
+        "label": "Planerade jobb",
+        "href": "/docs/backup-restore/scheduled-jobs",
+        "tail": " - det obevakade flödet som producerar arkiven denna sida förbrukar."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sv/docs/backup-restore/scheduled-jobs.json b/web/messages/sv/docs/backup-restore/scheduled-jobs.json
new file mode 100644
index 00000000..ae00c752
--- /dev/null
+++ b/web/messages/sv/docs/backup-restore/scheduled-jobs.json
@@ -0,0 +1,152 @@
+{
+  "meta": {
+    "title": "Schemalagda jobb — timers, kopplingsläge, bevarande | ProxMenux",
+    "description": "Schemalagda ProxMenux-jobb för säkerhetskopiering av värden. Två sätt att skapa jobb (egen systemd-timer eller koppling till ett befintligt PVE vzdump-jobb), bevaranderegler per jobb via proxmox-backup-client, Borg eller lokal rensning, filer under /var/lib/proxmenux/backup-jobs och körningsskriptet som skapar samma arkiv som det interaktiva flödet.",
+    "ogTitle": "ProxMenux Backup - schemalagda jobb",
+    "ogDescription": "Obevakade schemalagda värdsäkerhetskopior med kopplingsläge, bevaranderegler och samma tre destinationer som det interaktiva flödet.",
+    "twitterTitle": "Planerade jobb | ProxMenux",
+    "twitterDescription": "Obevakade schemalagda värdsäkerhetskopieringsjobb med kopplingsläge och bevaranderegler."
+  },
+  "header": {
+    "title": "Planerade jobb",
+    "description": "Obevakade jobb för säkerhetskopiering av värden. Två modeller: ett nytt oberoende jobb med eget schema eller ett jobb kopplat till ett befintligt PVE vzdump-jobb som ärver dess schema och bevaranderegler. Båda skapar samma arkiv som det interaktiva flödet.",
+    "section": "Säkerhetskopiering och återställning"
+  },
+  "intro": {
+    "title": "De två modellerna för schemalagda jobb",
+    "body": "Ett schemalagt jobb kan skapas efter en av två modeller:",
+    "modelsList": [
+      "<strong>Nytt oberoende jobb</strong> - ProxMenux definierar själva arbetsschemat med sin egen systemd timer, oberoende av någon annan uppgift på värden. Kompatibel med alla tre destinationer: Lokal, PBS och Borg.",
+      "<strong>Koppla till ett befintligt PVE vzdump-jobb</strong> — jobbet har inget eget schema; det körs automatiskt när det överordnade vzdump-jobbet säkerhetskopierar värdens VM:ar och LXC:er. Det ärver schemat och bevarandereglerna. Stöder lokalt mål och PBS (Borg stöds inte eftersom PVE saknar en inbyggd schemaläggare för Borg)."
+    ]
+  },
+  "attachBadge": {
+    "title": "Kopplingsläge — rekommenderas när ett PVE vzdump-jobb redan finns",
+    "body": "Om ett PVE vzdump-jobb redan är konfigurerat för nodens VM:ar och LXC:er körs den kopplade värdsäkerhetskopieringen efter gästernas säkerhetskopiering, i <strong>samma säkerhetskopieringscykel</strong>. Vid återställning kommer gästkonfigurationerna från värdsäkerhetskopian (under <code>/etc/pve</code>) och gästdiskarna från cykelns vzdump-kopior. Detta underlättar samordnad återställning av hela noden men är ingen atomär ögonblicksbild: ändringar under cykeln kan ge skillnader mellan värdkonfiguration och gästernas disktillstånd."
+  },
+  "frequencyBadge": {
+    "title": "Rekommenderad frekvens",
+    "body": "Säkerhetskopiera värden ofta för att maximera kompatibiliteten med en framtida återställning. Ju närmare säkerhetskopian ligger värdens aktuella tillstånd, desto färre avvikelser i konfiguration, paket och komponenter måste återställningen hantera."
+  },
+  "modes": {
+    "heading": "De två lägena",
+    "rows": [
+      {
+        "mode": "Nytt schemalagt jobb",
+        "backends": "Lokalt, PBS, Borg",
+        "schedule": "Egen <code>OnCalendar</code> uttryck (systemd kalendersyntax - t.ex. <code>daily</code>, <code>Mon..Fri 03:00</code>).",
+        "retention": "Efterfrågas separat: <code>keep-last</code>, <code>keep-hourly</code>, <code>keep-daily</code>, <code>keep-weekly</code>, <code>keep-monthly</code>, <code>keep-yearly</code>. Tillämpad av körningsskriptet efter varje framgångsrik backup."
+      },
+      {
+        "mode": "Bifoga till ett PVE vzdump jobb",
+        "backends": "Lokal, PBS (Borg har ingen PVE-sida schemaläggning)",
+        "schedule": "Ärvd från föräldern PVE jobb. Ingen systemd-timer installeras på ProxMenux-sidan.",
+        "retention": "Ärvd från förälderns <code>prune-backups</code>-konfiguration (mappade en-till-en till körningsskriptets <code>KEEP_*</code>-variabler via <code>hb_pve_prune_to_keep_env</code>)."
+      }
+    ]
+  },
+  "attachDetail": {
+    "heading": "Så fungerar kopplingsläget",
+    "intro": "PVE skriver <code>vzdump</code>-jobb till <code>/etc/pve/jobs.cfg</code>, med ett avsnitt per jobb som anger lagringen för VM- och LXC-kopiorna. Kopplingsläget kräver en backend som ProxMenux stöder (lokalt eller PBS). Värdsäkerhetskopieringen körs via job-end-hooken efter att gästernas säkerhetskopieringsjobb avslutats.",
+    "steps": [
+      {
+        "step": "1",
+        "detail": "Under jobbskapande listar ProxMenux kompatibla förälder PVE-uppgifter via <code>hb_pve_list_vzdump_jobs_for_backend</code>. Användaren väljer en."
+      },
+      {
+        "step": "2",
+        "detail": "Jobbets <code>.env</code> är skrivet med <code>PVE_PARENT_JOB</code>, <code>PVE_STORAGE</code> och de ärvda <code>KEEP_*</code> värdena; ingen systemd timer skapas."
+      },
+      {
+        "step": "3",
+        "detail": "<code>hb_install_vzdump_hook</code> registrerar en skripthook i <code>/etc/vzdump.conf</code>. I job-end-fasen för varje vzdump-jobb jämförs mottaget <code>$STOREID</code> med <code>PVE_STORAGE</code> för varje aktiverat kopplat jobb, och körningsskriptet startas för matchande jobb. Matchningen görs efter lagring, inte efter det valda överordnade jobbets ID."
+      },
+      {
+        "step": "4",
+        "detail": "Arkivet sparas i samma lagring som vzdump-kopiorna: <code>path/dump/</code> för lokalt mål eller PBS-arkivlagret som konfigurerats i PVE-lagringsposten."
+      }
+    ],
+    "outroBody": "Kopplingsläget har ingen egen timer. Om det valda överordnade PVE-jobbet inaktiveras eller tas bort stoppas dess utlösning, men ett annat vzdump-jobb med samma lagring kan fortfarande starta värdsäkerhetskopieringen. Inaktivera eller ta bort själva ProxMenux-jobbet för att förhindra det. Vid inaktivering ligger jobbposten kvar och kan senare aktiveras eller kopplas igen."
+  },
+  "storageLayout": {
+    "heading": "Filer som utgör ett jobb",
+    "intro": "Varje schemalagt jobb beskrivs fullständigt av tre eller fyra filer på disken. Att läsa dem ger hela konfigurationen av jobbet utan att förlita sig på gränssnittet.",
+    "rows": [
+      {
+        "path": "/var/lib/proxmenux/backup-jobs/JOB_ID.env",
+        "content": "Backend, backup-ID eller destination, schema (nyt läge) eller PVE-förälder (Attach-läge), aktiverad flagga, lagring <code>KEEP_*</code>-värden, referenspekare."
+      },
+      {
+        "path": "/var/lib/proxmenux/backup-jobs/JOB_ID.paths",
+        "content": "En absolut sökväg per rad — valet från profilen fastställs när jobbet skapas. Om filen redigeras används det nya valet nästa gång timern löser ut."
+      },
+      {
+        "path": "/etc/systemd/system/proxmenux-backup-JOB_ID.timer + .service",
+        "content": "Nytt läge bara. Tjänsten anropar <code>run_scheduled_backup.sh JOB_ID</code>. Timern schemalägger det med <code>Persistent=true</code> (missade körningar utförs vid nästa start) och en liten <code>RandomizedDelaySec=120</code> att sprida belastning när flera jobb delar samma OnCalendar uttryck."
+      },
+      {
+        "path": "/etc/vzdump.conf script-hook",
+        "content": "Fäst läge bara. Installerad en gång av <code>hb_install_vzdump_hook</code>; matchar varje bifogat jobb <code>PVE_STORAGE</code> mot <code>$STOREID</code> PVE passerar till krokskriptet."
+      }
+    ]
+  },
+  "runner": {
+    "heading": "Vad ett jobb gör när det startar",
+    "intro": "Varje jobb – oavsett om det är nymodell eller bifogad – kör samma trestegssekvens:",
+    "steps": [
+      "<strong>Förbered säkerhetskopian.</strong> Läser jobbkonfigurationen (destination, profil, vägar) och monterar arkivträdet exakt på samma sätt som det interaktiva flödet gör. Resultatet är samma arkiv som en manuell säkerhetskopia med dessa inställningar skulle producera.",
+      "<strong>Skriv till destinationen.</strong> Laddar eller skriver arkivet till den konfigurerade destinationen - en lokal <code>.tar.zst</code> fil, en PBS backup, eller ett Borg-arkiv - med exakt samma verktyg och referenser en manuell säkerhetskopia till samma destination skulle använda.",
+      "<strong>Tillämpa bevaranderegler.</strong> Ta bort gamla säkerhetskopior från destinationen, hålla <code>keep-last</code> / <code>keep-daily</code> / <code>keep-weekly</code> räknas konfigurerade på jobbet. Pruning utförs av själva destinationen: PBS tillämpar sina egna bevaranderegler, Borg kör <code>borg prune</code>, och för Local ProxMenux raderar filerna som faller utanför <code>keep-last</code>-fönstret."
+    ]
+  },
+  "management": {
+    "heading": "Hantera jobb",
+    "intro": "Schemaläggarmenyn (Scripts TUI) och fliken Monitor Backups avslöjar samma åtgärder på något jobb.",
+    "rows": [
+      {
+        "action": "Kör nu",
+        "detail": "Anropar körningsskriptet omedelbart utan att vänta på timern eller vzdump-hooken. Användbart för att verifiera konfigurationen utan att vänta till nästa schemalagda körning."
+      },
+      {
+        "action": "Aktivera / Inaktivera",
+        "detail": "Nytt läge: <code>systemctl enable/disable --now</code> timern. Bifoga läge: vänder <code>ENABLED</code> flaggan i jobbenv - krokskriptet respekterar den vid nästa PVE-körning."
+      },
+      {
+        "action": "Redigera",
+        "detail": "Öppnar åter dialogerna för destination, schema, profil och bevarande och skriver om jobbfilerna. Jobb-ID:t behålls."
+      },
+      {
+        "action": "Ta bort",
+        "detail": "Tar bort jobbets env-fil, sökvägsfilen och systemd-timern med tjänsten (nytt läge) samt inaktiverar hookkopplingen (kopplingsläge). Arkiv som redan finns på destinationen påverkas inte."
+      },
+      {
+        "action": "Visa logg",
+        "detail": "Strömmar <code>/var/log/proxmenux/backup-jobs/JOB_ID-YYYYMMDD_HHMMSS.log</code> — en loggfil per körning. Körningsskriptet sänder också ut en kompakt statusrad till journald under tjänsten systemd."
+      }
+    ]
+  },
+  "notifications": {
+    "heading": "Aviseringar",
+    "body": "Varje schemalagd körning utlöser samma <code>hb_notify_lifecycle</code> händelser som det interaktiva flödet (<code>start</code>, <code>complete</code>, <code>fail</code>). Om meddelandekanaler är konfigurerade i Monitor, obevakade jobb visar sina resultat på samma sätt manuella säkerhetskopior gör - en användare behöver inte kontrollera loggen för att veta om ett jobb lyckades."
+  },
+  "whereNext": {
+    "heading": "Nästa steg",
+    "items": [
+      {
+        "label": "Skapa backups",
+        "href": "/docs/backup-restore/creating-backups",
+        "tail": " - det interaktiva flödet som delar backend med schemaläggaren."
+      },
+      {
+        "label": "Destinationer",
+        "href": "/docs/backup-restore/destinations",
+        "tail": " — per-backend konfiguration som används av både det interaktiva flödet och schemaläggaren."
+      },
+      {
+        "label": "Återställande",
+        "href": "/docs/backup-restore/restoring",
+        "tail": " — flödet som använder de säkerhetskopior som jobben skapar."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sv/docs/create-vm/index.json b/web/messages/sv/docs/create-vm/index.json
new file mode 100644
index 00000000..10071d2a
--- /dev/null
+++ b/web/messages/sv/docs/create-vm/index.json
@@ -0,0 +1,175 @@
+{
+  "meta": {
+    "title": "Skapa VM på Proxmox VE: guider för Synology, Windows, Linux och NAS | ProxMenux",
+    "description": "Skapa och konfigurera VM på Proxmox VE med ProxMenux. Guider för NAS (Synology DSM, TrueNAS, OpenMediaVault, XigmaNAS med flera), Windows, Linuxdistributioner och en extern macOS-installerare. Förnuftiga standardval för maskinvara, lagring och nätverk.",
+    "ogTitle": "Skapa VM på Proxmox VE: guider för Synology, Windows, Linux och NAS",
+    "ogDescription": "ProxMenux-guider för att skapa VM med Synology DSM, TrueNAS, OMV, XigmaNAS, Windows och Linux på Proxmox VE.",
+    "ogImageAlt": "ProxMenux Skapa VM-menyn",
+    "twitterTitle": "Skapa VM på Proxmox VE | ProxMenux",
+    "twitterDescription": "Guider för VM med Synology, TrueNAS, OMV, XigmaNAS, Windows och Linux på Proxmox VE."
+  },
+  "header": {
+    "title": "Skapa VM",
+    "description": "ProxMenux samlar VM-skapandet i en interaktiv meny. Välj operativsystemfamilj så hanterar rätt guide ISO, CPU, RAM, BIOS, nätverk, lagring och valfri GPU-passthrough.",
+    "section": "Virtuella maskiner"
+  },
+  "intro": {
+    "title": "Vad denna meny är för",
+    "body": "Skapa VM-menyn är en router, inte en enda guide. Den frågar vilken operativsystemfamilj du vill installera och ladda upp lämplig ISO-väljare och konfigurator. Standardflöden använder förnuftiga ProxMenux-förinställningar; Avancerade flöden exponerar varje konfigurerbart alternativ innan VM skapas."
+  },
+  "opening": {
+    "heading": "Öppna menyn",
+    "body": "Välj <strong>Skapa VM</strong> i ProxMenux huvudmeny. Du ser då:",
+    "imageAlt": "Menyn Skapa VM med tre ProxMenux-val (NAS/Windows/Linux) följda av Community Scripts (macOS/Övriga)"
+  },
+  "families": {
+    "heading": "Tre OS-familjer",
+    "intro": "De tre ProxMenux-posterna högst upp på menyn delar samma underliggande motor och post-ISO-flöde - de sträcker sig bara till olika ISO-väljare och tillämpar standarder inställda för varje familj. Välj den som matchar den gäst du vill installera.",
+    "routes": [
+      {
+        "key": "nas",
+        "title": "NAS-system",
+        "icon": "HardDrive",
+        "href": "/docs/create-vm/system-nas",
+        "accent": "border-emerald-300 bg-emerald-50",
+        "iconBg": "bg-emerald-100 text-emerald-700",
+        "description": "Åtta NAS-system som separata VM. De flesta använder automatiskt ISO-flöde; Synology DSM har en särskild starthanterarguide.",
+        "bullets": [
+          "Synology DSM (starthanterare Arc / RR / Alpine RedPill M-shell)",
+          "TrueNAS SCALE och CORE (ZFS)",
+          "OpenMediaVault (Debianbaserad)",
+          "XigmaNAS (FreeBSD ZFS)",
+          "Rockstor (openSUSE / Btrfs), ZimaOS, FygoOS"
+        ]
+      },
+      {
+        "key": "windows",
+        "title": "Windows-system",
+        "icon": "MonitorCog",
+        "href": "/docs/create-vm/system-windows",
+        "accent": "border-blue-300 bg-blue-50",
+        "iconBg": "bg-blue-100 text-blue-700",
+        "description": "Windows 10, 11 och Server-utgåvor med Windows-vänliga standarder (q35 + OVMF + TPM 2.0) och VirtIO-drivrutiner premonterade.",
+        "bullets": [
+          "UUP Dump för aktuella ISO-filer",
+          "Eller lokal ISO från /var/lib/vz/template/iso",
+          "TPM 2.0 adderas automatiskt",
+          "VirtIO-drivrutins-ISO ansluten till ide3",
+          "Guest agent kanal aktiverad"
+        ]
+      },
+      {
+        "key": "linux",
+        "title": "Linux-system",
+        "icon": "Laptop",
+        "href": "/docs/create-vm/system-linux",
+        "accent": "border-amber-300 bg-amber-50",
+        "iconBg": "bg-amber-100 text-amber-700",
+        "description": "Utvald katalog med officiella Linux-ISO-filer som laddas ned från originalprojekten, samt val av lokala ISO-filer för andra avbildningar.",
+        "bullets": [
+          "Ubuntu (Skrivbord / Server, 20.04–25.10)",
+          "Debian (Skrivbord / Netinst, 11–13)",
+          "Fedora, Arch, Rocky, Mint, openSUSE",
+          "Alpine, Kali, Manjaro",
+          "Lokal ISO-väg för anpassade avbildningar"
+        ]
+      }
+    ]
+  },
+  "community": {
+    "title": "Gemenskapskript (ej dokumenterat här)",
+    "intro": "De två posterna under <em>Community Scripts</em> separator kör kod som är <strong> inte en del av ProxMenux</strong>, så de är avsiktligt kvar utanför denna dokumentation:",
+    "macosRich": "<strong>macOS-system</strong>: kör den externa installeraren <osxLink>OSX-PROXMOX</osxLink>. Den klonar originalarkivet, förbereder värden och <strong>startar om automatiskt när den är klar</strong>. Se projektets egen dokumentation.",
+    "othersRich": "<strong>Övriga system (Linuxbaserade)</strong>: läser in ett urval av gemenskapens installerare för hemservrar, routrar, brandväggar med mera. Varje skript underhålls utanför ProxMenux."
+  },
+  "afterPick": {
+    "heading": "Vad händer när du väljer ett OS",
+    "intro": "Efter ISO-valet följer menyn samma väg för varje operativsystemfamilj:",
+    "items": [
+      "<strong>Standard eller avancerat.</strong> En dialog låter dig godta ProxMenux standardval eller öppna hela konfiguratorn: CPU-modell och kärnor, RAM, BIOS/UEFI, nätverkskort och maskintyp.",
+      "<strong>Lagringsplan.</strong> Kombinera virtuella diskar, importerade diskar och PCI-passthrough-enheter som hela styrenheter eller NVMe i samma VM.",
+      "<strong>Valfri GPU-passthrough.</strong> Om en kompatibel GPU hittas erbjuder ProxMenux GPU-guiden efter att VM:n skapats. En omstart kan krävas.",
+      "<strong>Skapa VM.</strong> VM:n skapas, taggas och får en formaterad HTML-beskrivning som referens i Proxmox-gränssnittet."
+    ],
+    "tipTitle": "Välj avancerat läge för VM som ska användas länge",
+    "tipBody": "Standardförinställningar fungerar bra för snabba tester. För en VM du har för avsikt att hålla, den avancerade vägen låter dig välja rätt BIOS (SeaBIOS vs OVMF / UEFI), maskintyp (<code>i440fx</code> vs <code>q35</code>) och diskkontroller (VirtIO SCSI single vs SATA) fram - dessa är smärtsamma att ändra senare."
+  },
+  "scripts": {
+    "heading": "Skript involverade",
+    "intro": "Menyn läser in flera gemensamma komponentskript med source som saknar egna sidor. De listas här som referens. Varje undersida länkar till huvudskriptet för sitt flöde.",
+    "headerScript": "Skript",
+    "headerRole": "Rollen",
+    "rows": [
+      {
+        "path": "menus/create_vm_menu.sh",
+        "role": "Startpunkt och vägval."
+      },
+      {
+        "path": "vm/select_nas_iso.sh",
+        "role": "Val av ISO och NAS-system (Synology, TrueNAS, OMV, Rockstor, XigmaNAS, ZimaOS, FygoOS)."
+      },
+      {
+        "path": "vm/select_windows_iso.sh",
+        "role": "Val av Windows-ISO. Använder UUP Dump-byggaren vid behov."
+      },
+      {
+        "path": "vm/select_linux_iso.sh",
+        "role": "Linux ISO-väljaren för Linuxflödet (mainstreamdistributioner)."
+      },
+      {
+        "path": "vm/synology.sh",
+        "role": "Synology DSM-flöde: hämtar starthanterare och DSM-avbildning och förbereder VM-profilen."
+      },
+      {
+        "path": "vm/zimaos.sh",
+        "role": "ZimaOS-flödet: laddar ner avbildningen och kopplar den till VM-definitionen."
+      },
+      {
+        "path": "vm/vm_configurator.sh",
+        "role": "Standard- eller avancerad guide: CPU-modell och kärnor, RAM, BIOS, nätverkskort och maskintyp."
+      },
+      {
+        "path": "vm/disk_selector.sh",
+        "role": "Lagringsplan: virtuell disk, diskimport eller Controller/NVMe passthrough."
+      },
+      {
+        "path": "vm/vm_creator.sh",
+        "role": "Slutlig VM skapelse: tillämpa konfig, fäster lagring, skriver HTML beskrivning."
+      },
+      {
+        "path": "vm/guest_agent_config.sh",
+        "role": "Valfritt QEMU gäst agent setup hook, som används av flera flöden."
+      }
+    ]
+  },
+  "related": {
+    "heading": "Relaterat",
+    "items": [
+      {
+        "href": "/docs/disk-manager",
+        "label": "Diskhanteraren",
+        "tail": " - bifoga befintliga fysiska diskar eller importera diskbilder till VM."
+      },
+      {
+        "href": "/docs/utils/UUp-Dump-ISO-Creator",
+        "label": "UUP Dump ISO-skapare",
+        "tail": " — skapa installations-ISO för Windows att använda som startmedium."
+      },
+      {
+        "href": "/docs/utils/import-vm",
+        "label": "Importera VM från OVA / OVF",
+        "tail": " - ta in förbyggda VM från VMware / VirtualBox / ProxMenux export."
+      },
+      {
+        "href": "/docs/hardware/gpu-vm-passthrough",
+        "label": "Lägg till GPU till VM (Passthrough)",
+        "tail": " — passera en GPU till en nyskapad VM."
+      },
+      {
+        "href": "/docs/help-info/vm-ct-commands",
+        "label": "Kommandon för VM- och CT-hantering",
+        "tail": " — Qm referens för CLI-sidan."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sv/docs/create-vm/synology.json b/web/messages/sv/docs/create-vm/synology.json
new file mode 100644
index 00000000..5827b0a9
--- /dev/null
+++ b/web/messages/sv/docs/create-vm/synology.json
@@ -0,0 +1,453 @@
+{
+  "title": "Skript för att skapa en Synology-VM",
+  "stepLabel": "Steg",
+  "intro": {
+    "heading": "Introduktion",
+    "intro": "ProxMenux har ett automatiserat skript som skapar och konfigurerar en virtuell maskin (VM) för Synology DSM (DiskStation Manager) på Proxmox VE. Skriptet laddar ned och lägger till vald starthanterare som startdisk i VM:n. Det finns fyra alternativ:",
+    "loaders": [
+      {
+        "name": "AuxXxilium Arc",
+        "url": "https://github.com/AuxXxilium/arc",
+        "extra": ""
+      },
+      {
+        "name": "RedPill RR",
+        "url": "https://github.com/RROrg/rr",
+        "extra": ""
+      },
+      {
+        "name": "Alpine RedPill M-shell (TinyCore-projektet)",
+        "url": "https://github.com/PeterSuh-Q3/tinycore-redpill",
+        "extra": ""
+      }
+    ],
+    "customLoader": "Anpassad starthanterare – använd en egen starthanterare om du vill ändra eller skapa en egen konfiguration",
+    "simplifiesIntro": "Skriptet förenklar skapandet av VM genom att erbjuda följande alternativ:",
+    "simplifies": [
+      "Val av standard eller avancerad konfiguration",
+      "Konfiguration av CPU, RAM, BIOS och maskintyp",
+      "Val mellan virtuell disk och passthrough av fysisk disk"
+    ]
+  },
+  "config": {
+    "heading": "Standard och avancerad konfiguration",
+    "intro": "Skriptet erbjuder två konfigurationslägen:",
+    "defaultHeading": "Standardkonfiguration",
+    "defaultIntro": "Om du väljer standardkonfiguration kommer skriptet automatiskt att tillämpa följande värden:",
+    "headerParam": "Parameter",
+    "headerValue": "Standardvärde",
+    "defaultRows": [
+      {
+        "param": "Maskintyp",
+        "value": "q35"
+      },
+      {
+        "param": "BIOS-typ",
+        "value": "OVMF (UEFI)"
+      },
+      {
+        "param": "CPU-typ",
+        "value": "Host"
+      },
+      {
+        "param": "Antal kärnor",
+        "value": "2"
+      },
+      {
+        "param": "RAM-storlek",
+        "value": "4096 MB"
+      },
+      {
+        "param": "Bro",
+        "value": "vmbr0"
+      },
+      {
+        "param": "MAC-adress",
+        "value": "Automatiskt genererad"
+      },
+      {
+        "param": "Starta VM:n när det är klart",
+        "value": "Nej"
+      }
+    ],
+    "defaultOutro": "Om du vill anpassa konfigurationen väljer du alternativet Avancerade inställningar i menyn.",
+    "advancedHeading": "Avancerad konfiguration",
+    "advancedIntro": "Om du väljer avancerad konfiguration tillåter skriptet dig att anpassa varje parameter:",
+    "headerOptions": "Alternativ",
+    "advancedRows": [
+      {
+        "param": "Maskintyp",
+        "options": "q35 eller i440fx"
+      },
+      {
+        "param": "BIOS-typ",
+        "options": "OVMF (UEFI) eller SeaBIOS (Legacy)"
+      },
+      {
+        "param": "CPU-typ",
+        "options": "Host eller KVM64"
+      },
+      {
+        "param": "Antal kärnor",
+        "options": "Antal CPU-kärnor"
+      },
+      {
+        "param": "RAM-storlek",
+        "options": "Mängden minne som tilldelats VM"
+      },
+      {
+        "param": "Bro",
+        "options": "Nätverksbro för anslutning"
+      },
+      {
+        "param": "MAC-adress",
+        "options": "Anpassad MAC-adress"
+      },
+      {
+        "param": "VLAN",
+        "options": "VLAN-taggen (om den används)"
+      },
+      {
+        "param": "MTU",
+        "options": "Storlek på maximal överföringsenhet (MTU)"
+      }
+    ]
+  },
+  "diskSelection": {
+    "heading": "Diskval",
+    "intro": "Lagringsplanen låter dig lägga till virtuella diskar, fysiska diskar och PCI-styrenheter eller NVMe-enheter. Diskalternativen förklaras nedan.",
+    "virtualHeading": "Virtuell Disk",
+    "virtualItems": [
+      "Skriptet listar de lagringsalternativ som finns i Proxmox",
+      "Användaren väljer disk och storlek i GB",
+      "Virtuella diskar ansluts som <strong>SATA</strong> (sata0, sata1 osv.). Virtuella och fysiska datadiskar delar de sex SATA-platserna 0–5; starthanteraren använder en separat IDE-plats."
+    ],
+    "physicalHeading": "Passthrough av fysisk disk",
+    "physicalItems": [
+      "Skriptet upptäcker alla tillgängliga fysiska diskar",
+      "Användaren väljer fysiska diskar eller diskar som de vill använda.",
+      "Fysiska diskar ansluts som <strong>SATA</strong>-enheter. De delar de sex SATA-platserna 0–5 med virtuella datadiskar; det finns ingen separat kvot på sex fysiska diskar."
+    ]
+  },
+  "loaderInstall": {
+    "heading": "Installation av starthanterare",
+    "intro1": "Skriptet laddar automatiskt ned och packar upp starthanteraren från utvecklarens kodförråd. Om nedladdningen misslyckas visas ett felmeddelande.",
+    "intro2Rich": "<strong>AuxXxilium Arc</strong>, <strong>RedPill RR</strong> och <strong>Alpine RedPill M-shell</strong> laddas ned och packas upp automatiskt.",
+    "customRich": "För <strong>Custom Loader</strong> söker skriptet efter filer i <code>/var/lib/vz/template/iso</code>. Om flera hittas får du välja vilken fil som ska användas.",
+    "uploadIntro": "Du kan ladda upp egna starthanterare via alternativen för lokal lagring.",
+    "imageAlt": "Lägg till anpassad starthanterare",
+    "imageCaption": "Lägg till anpassad starthanterare"
+  },
+  "vmCreation": {
+    "heading": "Skapa VM",
+    "intro": "När starthanteraren har laddats ned skapar skriptet VM:n med följande kommandon:",
+    "items": [
+      "<code>qm create</code> Skapar den virtuella maskinen med de konfigurerade parametrarna",
+      "<code>qm importdisk</code> importerar starthanterarens avbildning till Proxmox-lagringen. Skriptet ansluter sedan avbildningen som ide0 för kompatibilitet.",
+      "<code>qm set</code> – tilldelar konfigurationsvärden för exempelvis CPU, RAM och lagring",
+      "<code>qm set VMID --boot order=ide0</code> anger starthanteraren som startenhet. Ersätt VMID med VM-ID:t."
+    ]
+  },
+  "stepGuide": {
+    "heading": "Stegvis guide till konfiguration av starthanteraren",
+    "intro": "Varje starthanterare har egna menyer och inställningsmetoder. De sex stegen nedan beskriver den gemensamma processen; följ den aktuella starthanterarens instruktioner när de skiljer sig. M-shell-bilderna visar ett äldre TinyCore-gränssnitt, medan det aktuella skriptet laddar ned Alpine RedPill M-shell.",
+    "selectorHeading": "Välj din loadertyp:",
+    "loaderButtons": {
+      "arc": "Arc Loader",
+      "rr": "RR Loader",
+      "tinycore": "TinyCore Loader"
+    }
+  },
+  "steps": [
+    {
+      "id": "step1",
+      "title": "Starta VM:n och öppna huvudmenyn",
+      "intro": "Starta VM:n när den har skapats. Vid första starten öppnas starthanterarens huvudmeny för val och konfiguration av DSM-modell. När starthanteraren har skapats hoppas steget över om du inte manuellt begär en ny konfiguration från startmenyn. Alla starthanterare kan även konfigureras via ett webbgränssnitt.",
+      "loaders": {
+        "arc": [
+          {
+            "htmlBefore": "<strong>Webbgränssnitt</strong>: öppna en webbläsare och ange IP-adressen som visas i VM-konsolen. I vårt exempel: http://192.169.0.32.",
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/arc/arc_1_0_1.png",
+            "alt": "Arc-starthanterarens webbgränssnitt",
+            "caption": "Arc-starthanterarens webbgränssnitt"
+          },
+          {
+            "htmlBefore": "<strong>Terminalgränssnitt</strong>: öppna det direkt i VM-konsolen.",
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/arc/arc_1_1_1.png",
+            "alt": "Arc-starthanterarens terminalgränssnitt",
+            "caption": "Arc-starthanterarens terminalgränssnitt"
+          }
+        ],
+        "rr": [
+          {
+            "htmlBefore": "<strong>Webbgränssnitt</strong>: öppna en webbläsare och ange IP-adressen från VM-konsolen följd av port <strong>7681</strong>. I vårt exempel: <code>http://192.169.0.33:7681</code>.",
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/rr/rr_2_0_2.png",
+            "alt": "Exempel på RR-kommando",
+            "caption": "RR-starthanterarens webbgränssnitt"
+          },
+          {
+            "htmlBefore": "<strong>Terminalgränssnitt</strong>: öppna det genom att skriva <strong>menu.sh</strong> i VM-konsolen.",
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/rr/rr_2_1_1.png",
+            "alt": "RR-starthanterarens gränssnitt",
+            "caption": "RR-starthanterarens terminalgränssnitt"
+          }
+        ],
+        "tinycore": [
+          {
+            "htmlBefore": "<strong>Webbgränssnitt</strong>: öppna en webbläsare och ange IP-adressen från VM-konsolen följd av port <strong>7681</strong>. I vårt exempel: <code>http://192.169.0.35:7681</code>.",
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/tinycore/tinycore_3_0_1.png",
+            "alt": "Gränssnitt för TinyCore Loader",
+            "caption": "TinyCore-starthanterarens webbgränssnitt"
+          },
+          {
+            "htmlBefore": "<strong>Terminalgränssnitt</strong>: öppna det direkt i VM-konsolen. Håll uppsikt över skärmen; du kan bli ombedd att trycka på en tangent för att fortsätta eller välja ett annat språk.",
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/tinycore/tinycore_3_1_1.png",
+            "alt": "Gränssnitt för TinyCore Loader",
+            "caption": "TinyCore-starthanterarens terminalgränssnitt"
+          }
+        ]
+      }
+    },
+    {
+      "id": "step2",
+      "title": "Välj modell",
+      "intro": "Välj den Synology DSM-modell du vill installera när menyn har öppnats. Beroende på starthanteraren kan du behöva visa fler alternativ för att se fler modeller.",
+      "outro": "Vi väljer SA6400-modellen.",
+      "loaders": {
+        "arc": [
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/arc/arc_1_2_1.png",
+            "alt": "Modellval i Arc",
+            "caption": "Modellval i Arc"
+          }
+        ],
+        "rr": [
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/rr/rr_2_2_1.png",
+            "alt": "Modellval i RR",
+            "caption": "Modellval i RR"
+          }
+        ],
+        "tinycore": [
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/tinycore/tinycore_3_2_1.png",
+            "alt": "Modellval i TinyCore",
+            "caption": "Modellval i TinyCore"
+          }
+        ]
+      }
+    },
+    {
+      "id": "step3",
+      "title": "Välj DSM-version",
+      "intro": "När du har valt modellen måste du välja den DSM-version du vill installera.",
+      "loaders": {
+        "arc": [
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/arc/arc_1_3_1.png",
+            "alt": "Versionsval i Arc – steg 1",
+            "caption": "Versionsval i Arc – steg 1"
+          },
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/arc/arc_1_3_2.png",
+            "alt": "Versionsval i Arc – steg 2",
+            "caption": "Versionsval i Arc – steg 2"
+          }
+        ],
+        "rr": [
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/rr/rr_2_3_1.png",
+            "alt": "Versionsval i RR – steg 1",
+            "caption": "Versionsval i RR – steg 1"
+          },
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/rr/rr_2_3_2.png",
+            "alt": "Versionsval i RR – steg 2",
+            "caption": "Versionsval i RR – steg 2"
+          },
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/rr/rr_2_3_3.png",
+            "alt": "Versionsval i RR – steg 3",
+            "caption": "Versionsval i RR – steg 3"
+          }
+        ],
+        "tinycore": [
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/tinycore/tinycore_3_3_1.png",
+            "alt": "Versionsval i TinyCore – steg 1",
+            "caption": "Versionsval i TinyCore – steg 1"
+          },
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/tinycore/tinycore_3_3_2.png",
+            "alt": "Versionsval i TinyCore – steg 2",
+            "caption": "Versionsval i TinyCore – steg 2"
+          }
+        ]
+      }
+    },
+    {
+      "id": "step4",
+      "title": "Välj Addons",
+      "intro": "I det här steget kan du lägga till funktioner eller egna inställningar i starthanteraren.",
+      "loaders": {
+        "arc": [
+          {
+            "htmlBefore": "<strong>Arc</strong> erbjuder automatisk konfiguration eller manuella inställningar. Om du väljer automatisk konfiguration tillämpar starthanteraren nödvändiga inställningar och startar om automatiskt när processen är klar.",
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/arc/arc_1_4_1.png",
+            "alt": "Automatisk Arc-konfiguration",
+            "caption": "Automatisk Arc-konfiguration"
+          },
+          {
+            "htmlBefore": "Om du väljer bort det automatiska läget öppnar du menyn och ställer in de alternativ som starthanteraren behöver.",
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/arc/arc_1_4_2.png",
+            "alt": "Manuell Arc-konfiguration",
+            "caption": "Manuell Arc-konfiguration"
+          },
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/arc/arc_1_4_3.png",
+            "alt": "Konfiguration av serienummer och MAC i Arc",
+            "caption": "Konfiguration av serienummer och MAC i Arc"
+          },
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/arc/arc_1_4_4.png",
+            "alt": "Arc Sata Portmap",
+            "caption": "Arc Sata Portmap (använd det rekommenderade alternativet)"
+          },
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/arc/arc_1_4_5.png",
+            "alt": "Val av Arc-tillägg",
+            "caption": "Val av Arc-tillägg"
+          }
+        ],
+        "rr": [
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/rr/rr_2_4_1.png",
+            "alt": "RR-tillägg steg 1",
+            "caption": "RR-tillägg steg 1"
+          },
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/rr/rr_2_4_2.png",
+            "alt": "RR-tillägg steg 2",
+            "caption": "RR-tillägg – steg 2: tryck för att lägga till tillägg."
+          },
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/rr/rr_2_4_3.png",
+            "alt": "RR-tillägg steg 3",
+            "caption": "RR-tillägg – steg 3: välj önskat tillägg genom att klicka på det. Upprepa processen i bilderna 2.4.2 och 2.4.3 för fler tillägg."
+          }
+        ],
+        "tinycore": [
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/tinycore/tinycore_3_4_1.png",
+            "alt": "TinyCore-konfiguration av serienummer",
+            "caption": "TinyCore-konfiguration av serienummer"
+          },
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/tinycore/tinycore_3_4_2.png",
+            "alt": "TinyCore-slumpalternativ",
+            "caption": "Slumpalternativ i TinyCore – det slumpmässiga alternativet rekommenderas."
+          },
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/tinycore/tinycore_3_4_3.png",
+            "alt": "TinyCore-MAC-konfiguration",
+            "caption": "TinyCore-MAC-konfiguration"
+          },
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/tinycore/tinycore_3_4_4.png",
+            "alt": "TinyCore VM MAC",
+            "caption": "TinyCore VM MAC - Välj att använda din VM MAC eller en slumpmässig"
+          }
+        ]
+      }
+    },
+    {
+      "id": "step5",
+      "title": "Bygg starthanteraren",
+      "intro": "Bygg starthanteraren när du har valt modell, DSM-version och tillägg. Det kan ta några minuter beroende på starthanterare och inställningar. Välj ”Build the Loader” för att börja.",
+      "loaders": {
+        "arc": [
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/arc/arc_1_5_1.png",
+            "alt": "Bygg starthanteraren i Arc",
+            "caption": "Bygg starthanteraren i Arc"
+          }
+        ],
+        "rr": [
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/rr/rr_2_5_1.png",
+            "alt": "Bygg starthanteraren i RR",
+            "caption": "Bygg starthanteraren i RR"
+          }
+        ],
+        "tinycore": [
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/tinycore/tinycore_3_5_1.png",
+            "alt": "Bygg starthanteraren i TinyCore",
+            "caption": "Bygg starthanteraren i TinyCore"
+          }
+        ]
+      }
+    },
+    {
+      "id": "step6",
+      "title": "Starta starthanteraren",
+      "intro": "När starthanteraren har byggts uppmanas du att starta den. VM:n startar om med din konfiguration och påbörjar DSM-installationen.",
+      "loaders": {
+        "arc": [
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/arc/arc_1_6_1.png",
+            "alt": "Starta starthanteraren i Arc",
+            "caption": "Starta starthanteraren i Arc"
+          }
+        ],
+        "rr": [
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/rr/rr_2_6_1.png",
+            "alt": "Starta starthanteraren i RR",
+            "caption": "Starta starthanteraren i RR"
+          }
+        ],
+        "tinycore": [
+          {
+            "src": "https://macrimi.github.io/ProxMenux/vm/synology/tinycore/tinycore_3_6_1.png",
+            "alt": "Starta starthanteraren i TinyCore",
+            "caption": "Starta starthanteraren i TinyCore"
+          }
+        ]
+      }
+    }
+  ],
+  "dsmInstall": {
+    "heading": "Starta DSM installation",
+    "intro": "När starthanteraren har startats kan du hitta din Synology-enhet med:",
+    "afterCode": "Följ stegen på skärmen för att slutföra DSM-installationen.",
+    "setupAlt": "Konfiguration av DSM",
+    "setupCaption": "Konfigurationsskärm för DSM",
+    "patience": "Var tålmodig - Processen kan ta några minuter att slutföra. Progressprocenten uppdateras automatiskt när installationen fortskrider. En nedräkning börjar när installationen närmar sig slutförandet.",
+    "finishAlt": "Installationen är klar",
+    "finishCaption": "Installationen är klar"
+  },
+  "tips": {
+    "heading": "Tips",
+    "introItem": "Tillgängliga alternativ kan ändras med starthanterarens version och utvecklarens uppdateringar. Läs starthanterarens dokumentation om du stöter på problem när den skapas:",
+    "docLinks": [
+      {
+        "label": "Arc-dokumentation",
+        "url": "https://github.com/AuxXxilium/arc"
+      },
+      {
+        "label": "RR-dokumentation",
+        "url": "https://github.com/RROrg/rr"
+      },
+      {
+        "label": "TinyCore Dokumentation",
+        "url": "https://github.com/PeterSuh-Q3/tinycore-redpill"
+      }
+    ],
+    "olderModels": "Vissa äldre DSM-modeller kan ha problem med att känna igen diskar eller nätverkskortet. Det rekommenderas att använda nyare modeller.",
+    "updateLabel": "Uppdatering:",
+    "updateBody": "Vissa starthanterare kan uppdateras direkt från menyn.",
+    "importantLabel": "Viktigt:",
+    "importantBody": "ProxMenux erbjuder inte support för de olika starthanterarna."
+  }
+}
diff --git a/web/messages/sv/docs/create-vm/system-linux.json b/web/messages/sv/docs/create-vm/system-linux.json
new file mode 100644
index 00000000..6e3f9164
--- /dev/null
+++ b/web/messages/sv/docs/create-vm/system-linux.json
@@ -0,0 +1,292 @@
+{
+  "meta": {
+    "title": "Skapa VM: Linux-system | ProxMenux-dokumentation",
+    "description": "Skapa virtuella Linux-maskiner på Proxmox VE med ProxMenux. Beskriver katalogen med utvalda officiella ISO-avbildningar (Ubuntu, Debian, Fedora, Arch, Rocky, Mint, openSUSE, Alpine, Kali, Manjaro), den gemensamma lagringsplanen, valfri GPU-passthrough och tips efter installationen.",
+    "ogTitle": "Skapa VM: Linux-system | ProxMenux-dokumentation",
+    "ogDescription": "Skapa Linux VM på Proxmox VE med ProxMenux. Curated ISO katalog, enhetlig lagringsplan, valfri GPU genomgång och post-install tips.",
+    "ogImageAlt": "ProxMenux Linux VM-menyn"
+  },
+  "header": {
+    "title": "Skapa VM: Linux-system",
+    "description": "Skapa en Linux-VM på Proxmox VE. ProxMenux har en katalog med utvalda officiella Linux-ISO:er för nedladdning och en väljare för lokala ISO:er. Alla alternativ använder den gemensamma VM-guiden, lagringsplanen och den valfria guiden för GPU-passthrough.",
+    "section": "Virtuella maskiner"
+  },
+  "intro": {
+    "title": "Vad skriptet gör",
+    "body": "Välj en officiell Linux-ISO för automatisk nedladdning eller en lokal ISO som redan har laddats upp. Den gemensamma guiden går sedan igenom CPU, RAM och BIOS, lagringsplan, valfri GPU-passthrough och skapandet av VM:n."
+  },
+  "image": {
+    "alt": "ProxMenux Linux installationsalternativ",
+    "caption": "Linux installationsalternativ"
+  },
+  "config": {
+    "heading": "Standard vs Avancerad konfiguration",
+    "intro": "När ISO väljs frågar ProxMenux om du vill använda standard VM-profilen eller öppna den avancerade guiden.",
+    "defaultHeading": "Standardkonfiguration",
+    "headerParam": "Parameter",
+    "headerValue": "Standardvärde",
+    "defaultRows": [
+      {
+        "param": "maskintyp",
+        "valueRich": "<code>q35</code>"
+      },
+      {
+        "param": "BIOS",
+        "value": "OVMF (UEFI)"
+      },
+      {
+        "param": "CPU-typ",
+        "value": "Host"
+      },
+      {
+        "param": "Kärnor",
+        "value": "2"
+      },
+      {
+        "param": "RAM",
+        "value": "4096 MB"
+      },
+      {
+        "param": "Bro",
+        "valueRich": "<code>vmbr0</code>"
+      },
+      {
+        "param": "MAC-adress",
+        "value": "Autogenererad"
+      },
+      {
+        "param": "Starta när det är klart",
+        "value": "Nej"
+      }
+    ],
+    "advancedHeading": "Avancerad konfiguration",
+    "advancedIntro": "Den avancerade guiden visar varje inställning separat:",
+    "headerOptions": "Alternativ",
+    "advancedRows": [
+      {
+        "param": "maskintyp",
+        "optionsRich": "<code>q35</code> eller <code>i440fx</code>"
+      },
+      {
+        "param": "BIOS",
+        "options": "OVMF (UEFI) eller SeaBIOS (Legacy)"
+      },
+      {
+        "param": "CPU-typ",
+        "options": "Host, KVM64 och andra listade CPU-modeller"
+      },
+      {
+        "param": "Kärnor",
+        "options": "Antal CPU-kärnor"
+      },
+      {
+        "param": "RAM",
+        "options": "Minne som tilldelats VM"
+      },
+      {
+        "param": "Bro",
+        "options": "Nätverksbro"
+      },
+      {
+        "param": "MAC-adress",
+        "options": "Egen MAC-adress"
+      },
+      {
+        "param": "VLAN",
+        "options": "VLAN tag (tillval)"
+      },
+      {
+        "param": "MTU",
+        "options": "MTU storlek"
+      }
+    ]
+  },
+  "storagePlan": {
+    "heading": "Lagringsplan",
+    "body": "Efter CPU / RAM öppnar ProxMenux <strong>Storage Plan</strong>-menyn, där du kan kombinera virtuella diskar, importerade diskar och PCI genomgångsenheter i samma VM, lägga till objekt en i taget och avsluta när du är klar.",
+    "virtualDiskTitle": "a. Lägg till virtuell disk",
+    "virtualDiskItems": [
+      "Listar de Proxmox lagringsvolymer som finns på värden.",
+      "Du väljer mållagring och storleken på GB.",
+      "Disken använder vald buss: SCSI (standard), SATA, VirtIO eller IDE. SATA har sex platser numrerade 0–5: <code>sata0</code>, <code>sata1</code>, …."
+    ],
+    "importDiskTitle": "b. Lägg till importerad disk",
+    "importDiskItems": [
+      "Detekterar fysiska diskar som är säkra att importera (system och skyddade diskar är dolda).",
+      "Du väljer en eller flera diskar via en checklista.",
+      "Importerade diskar använder vald buss och ansluts via <code>qm set</code>."
+    ],
+    "pciTitle": "c. Lägg till styrenhet eller NVMe (PCI-passthrough)",
+    "pciItems": [
+      "Hittar SATA/SAS-HBA:er och NVMe-enheter och låter dig tilldela en <em>hel styrenhet</em> till VM:n. IOMMU måste vara aktivt; skriptet erbjuder aktivering och omstart vid behov.",
+      "Ett bekräftelsesteg varnar för kontrollörens hela risk (hela kortet, inklusive varje disk på det, lämnar värden).",
+      "PCI-enheter tilldelas med kommandon som <code>qm set VMID --hostpci0 PCI_ADDRESS,pcie=1</code>. Ersätt VMID och PCI_ADDRESS med VM-ID och PCI-adress och använd ett ledigt hostpci-index för varje enhet."
+    ],
+    "resetTitle": "Återställ och slutför",
+    "resetBody": "Menyn erbjuder också <strong>r</strong> (återställ det aktuella urvalet och börja om) och <strong>d</strong> (slutför och fortsätt). Du kan inte avsluta med en tom plan."
+  },
+  "gpu": {
+    "heading": "Valfri GPU passthrough",
+    "body": "Efter lagringsplanen, om en kompatibel GPU detekteras på värd ProxMenux erbjudanden för att starta GPU passthrough assistent. Se <gpuLink>Lägg till GPU till en VM (Passthrough) </gpuLink> för hur assistenten fungerar - en värd omstart kan krävas."
+  },
+  "autoFeatures": {
+    "heading": "Automatiska VM-funktioner",
+    "efiTitle": "EFI-disk",
+    "efiBody": "När OVMF (UEFI) väljs skapar ProxMenux en 4 MB EFI-systemdisk på lagringen du väljer så firmware har en plats att lagra sina variabler.",
+    "isoTitle": "ISO montering",
+    "isoBody": "Installationen ISO är kopplad till <code>ide2</code> som en CD-ROM, redo för första start.",
+    "guestTitle": "QEMU gästagent",
+    "guestBody": "Gästagentkanalen är aktiverad i VM-konfig. Du måste fortfarande installera agenten inuti gästen - se tipsen nedan."
+  },
+  "installOptions": {
+    "heading": "Linux installationsalternativ",
+    "officialHeading": "Officiell ISO (traditionell installation)",
+    "officialBody": "ProxMenux har ett urval officiella Linux-ISO:er. Välj en så laddar skriptet ned den direkt från distributionens spegelserver till <code>/var/lib/vz/template/iso</code> och ansluter den till VM:n.",
+    "officialImageAlt": "Val av Linux-distribution",
+    "officialImageCaption": "Val av Linux-distribution",
+    "localHeading": "Lokalt ISO",
+    "localBody": "Använder en Linux-ISO som redan finns i <code>/var/lib/vz/template/iso</code>. Skriptet listar alla <code>*.iso</code>-filer det hittar och låter dig välja en.",
+    "localImageAlt": "Lokala ISO urvalsmenyn",
+    "localImageCaption": "Lokala ISO urvalsmenyn",
+    "distros": [
+      {
+        "name": "Ubuntu",
+        "variants": [
+          "25.10 Desktop",
+          "24.04 Desktop",
+          "22.04 Desktop",
+          "20.04 Desktop",
+          "25.10 Server",
+          "24.04 Server",
+          "22.04 Server",
+          "20.04 Server"
+        ]
+      },
+      {
+        "name": "Debian",
+        "variants": [
+          "13 Desktop",
+          "12 Desktop",
+          "11 Desktop",
+          "13 Netinst",
+          "12 Netinst",
+          "11 Netinst"
+        ]
+      },
+      {
+        "name": "Fedora",
+        "variants": [
+          "Workstation 42"
+        ]
+      },
+      {
+        "name": "Arch Linux",
+        "variants": [
+          "senaste versionen"
+        ]
+      },
+      {
+        "name": "Rocky Linux",
+        "variants": [
+          "9"
+        ]
+      },
+      {
+        "name": "Linux Mint",
+        "variants": [
+          "22.1 Cinnamon"
+        ]
+      },
+      {
+        "name": "openSUSE",
+        "variants": [
+          "Leap 15.6"
+        ]
+      },
+      {
+        "name": "Alpine Linux",
+        "variants": [
+          "3.21"
+        ]
+      },
+      {
+        "name": "Kali Linux",
+        "variants": [
+          "2026.1"
+        ]
+      },
+      {
+        "name": "Manjaro",
+        "variants": [
+          "25.0 GNOME"
+        ]
+      }
+    ]
+  },
+  "endToEnd": {
+    "heading": "Vad skriptet gör från början till slut",
+    "items": [
+      "Hämtar Linux-ISO:n via officiell nedladdning eller en lokal fil.",
+      "Tillämpar standard- eller avancerade inställningar för CPU, RAM, BIOS och maskintyp.",
+      "Öppnar lagringsplanen och fäster de valda virtuella diskarna, importerade diskar och PCI-enheter.",
+      "Skapar EFI-skivan när UEFI väljs.",
+      "Monterar Linux ISO på <code>ide2</code>.",
+      "Ange startordern (disk först, sedan ISO).",
+      "Möjliggör QEMU Guest Agent-kanalen.",
+      "Kör guiden för GPU-passthrough om du väljer det.",
+      "Genererar en stilig HTML-beskrivning bifogad till VM.",
+      "Startar VM:n om du valde det."
+    ]
+  },
+  "postInstall": {
+    "heading": "Tips efter installationen",
+    "guestAgentHeading": "Installera QEMU Guest Agent i VM",
+    "guestAgentBody": "ProxMenux aktiverar gästagentens kanal i VM-konfigurationen, men agenten måste installeras i gästsystemet. Den stöder kontrollerad avstängning och frysning av filsystem under säkerhetskopiering för bättre datakonsistens.",
+    "debian": "Debian / Ubuntu",
+    "fedora": "Fedora / Rocky / RHEL",
+    "arch": "Arch Linux",
+    "opensuse": "openSUSE",
+    "virtioHeading": "VirtIO stöd i Linux",
+    "virtioBody": "Moderna Linux-distributioner innehåller normalt VirtIO-drivrutiner för disk och nätverk. Välj <code>virtio</code> för VirtIO-blockdiskar eller <code>scsi</code> med den konfigurerade VirtIO SCSI-styrenheten; nätverkskortet använder också <code>virtio</code>. Kontrollera drivrutinsstödet i äldre installerare.",
+    "virtioWarnTitle": "Mycket gamla distributioner",
+    "virtioWarnBody": "Mycket gamla installerare kan sakna nödvändiga VirtIO-drivrutiner. Använd då en emulerad SATA-/SCSI-styrenhet eller tillhandahåll lämpliga drivrutiner.",
+    "trimHeading": "Aktivera TRIM / discard på SSD-lagring",
+    "trimBody": "När VM sitter på SSD-stödd Proxmox-lagring och disken fästes med <code>discard</code>-flaggan kan du vidarebefordra trimkommandon inifrån gästen. Två alternativ:",
+    "trimItems": [
+      "Kör <code>fstrim -av</code> regelbundet eller aktivera enheten <code>fstrim.timer</code> på distributioner med systemd.",
+      "Eller montera filsystem med alternativet <code>discard</code> i <code>/etc/fstab</code>."
+    ],
+    "balloonHeading": "Dynamiskt minne (ballooning)",
+    "balloonBody": "Moderna Linux-kärnor innehåller normalt drivrutinen <code>virtio_balloon</code>. Med en aktiverad balloon-enhet kan Proxmox samla minnesstatistik. Dynamisk återvinning kräver också ett minimivärde under konfigurerat maximum; lika värden ger fast minnestilldelning."
+  },
+  "related": {
+    "heading": "Relaterat",
+    "items": [
+      {
+        "href": "/docs/disk-manager/import-disk-image-vm",
+        "label": "Importera diskavbildning till virtuell dator",
+        "tail": " - bifoga en befintlig Linux .qcow2 / .img / .raw till en ny VM."
+      },
+      {
+        "href": "/docs/utils/import-vm",
+        "label": "Importera VM från OVA / OVF",
+        "tail": " - ta in en Linux VM exporterad från VMware / VirtualBox / Proxmox."
+      },
+      {
+        "href": "/docs/hardware/gpu-vm-passthrough",
+        "label": "Lägg till GPU till VM (Passthrough)",
+        "tail": " — För Linux VM som behöver GPU acceleration."
+      },
+      {
+        "href": "/docs/help-info/vm-ct-commands",
+        "label": "Kommandon för VM- och CT-hantering",
+        "tail": " — referens för qm CLI."
+      },
+      {
+        "href": "/docs/create-vm",
+        "label": "Översikt över att skapa VM",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sv/docs/create-vm/system-nas/index.json b/web/messages/sv/docs/create-vm/system-nas/index.json
new file mode 100644
index 00000000..bd666614
--- /dev/null
+++ b/web/messages/sv/docs/create-vm/system-nas/index.json
@@ -0,0 +1,147 @@
+{
+  "meta": {
+    "title": "Skapa VM: System NAS | ProxMenux Dokumentation",
+    "description": "Skapa NAS virtuella maskiner på Proxmox VE med ProxMenux. Stöder Synology DSM (laddare), TrueNAS SCALE / CORE, OpenMediaVault, XigmaNAS, Rockstor, ZimaOS och FygoOS. Umbrel OS är tillgänglig via community script.",
+    "ogTitle": "Skapa VM: System NAS | ProxMenux Dokumentation",
+    "ogDescription": "Skapa NAS virtuella maskiner på Proxmox VE med ProxMenux. Stöder Synology DSM (laddare), TrueNAS SCALE / CORE, OpenMediaVault, XigmaNAS, Rockstor, ZimaOS och FygoOS.",
+    "ogImageAlt": "ProxMenux-meny för NAS-system"
+  },
+  "header": {
+    "title": "Skapa VM: System NAS",
+    "description": "ProxMenux stöder åtta NAS-system som separata VM och en valfri Umbrel OS-installation via ett gemenskapsskript. De flesta delar ett automatiskt ISO-flöde; Synology DSM har en särskild starthanterarguide.",
+    "section": "Virtuella maskiner"
+  },
+  "intro": {
+    "title": "Hur NAS-väljaren fungerar",
+    "body": "I det generella ISO-flödet försöker NAS-väljaren hitta senaste stabila versionen på projektets spegel, använder en reservversion vid behov, laddar ned ISO:n och öppnar den gemensamma konfiguratorn för CPU, RAM, diskar och nätverk. Synology DSM och ZimaOS har egna installationsflöden."
+  },
+  "image": {
+    "alt": "ProxMenux System NAS-väljaren",
+    "caption": "System NAS väljare"
+  },
+  "flowBadges": {
+    "loader": "Starthanterarflöde",
+    "auto-iso": "Auto-ISO flöde",
+    "dedicated": "Dedikerat skript"
+  },
+  "labels": {
+    "base": "Bas",
+    "fileSystem": "Filsystem",
+    "viewDetails": "Visa detaljer"
+  },
+  "supported": {
+    "heading": "Stödda NAS-system",
+    "cards": [
+      {
+        "name": "Synology DSM",
+        "tagline": "DiskStation Manager med ARC/RR-starthanterare. Starthanteraren behöver konfigureras före första starten.",
+        "icon": "HardDrive",
+        "base": "Linux (anpassad)",
+        "fileSystem": "Btrfs, ext4",
+        "href": "/docs/create-vm/system-nas/synology",
+        "flow": "loader"
+      },
+      {
+        "name": "TrueNAS SCALE",
+        "tagline": "Debianbaserad TrueNAS med Docker-appar i aktuella versioner och ZFS som primärt filsystem. Äldre SCALE-versioner använde Kubernetes.",
+        "icon": "Database",
+        "base": "Debian Linux",
+        "fileSystem": "ZFS",
+        "href": "/docs/create-vm/system-nas/system-nas-others#truenas-scale",
+        "flow": "auto-iso"
+      },
+      {
+        "name": "TrueNAS CORE",
+        "tagline": "FreeBSD-baserad TrueNAS med fokus på ZFS-lagring. Jails och insticksprogram i CORE 13.3 är föråldrade och saknar stöd.",
+        "icon": "Database",
+        "base": "FreeBSD",
+        "fileSystem": "ZFS",
+        "href": "/docs/create-vm/system-nas/system-nas-others#truenas-core",
+        "flow": "auto-iso"
+      },
+      {
+        "name": "OpenMediaVault",
+        "tagline": "Lättviktig Debianbaserad NAS med modulära insticksprogram. Passar äldre maskinvara.",
+        "icon": "Server",
+        "base": "Debian Linux",
+        "fileSystem": "ext4, XFS, Btrfs",
+        "href": "/docs/create-vm/system-nas/system-nas-others#openmediavault",
+        "flow": "auto-iso"
+      },
+      {
+        "name": "XigmaNAS",
+        "tagline": "FreeBSD-baserade NAS - den ursprungliga efterträdaren till FreeNAS, fokuserad på ZFS och enkelhet.",
+        "icon": "Database",
+        "base": "FreeBSD",
+        "fileSystem": "ZFS, UFS",
+        "href": "/docs/create-vm/system-nas/system-nas-others#xigmanas",
+        "flow": "auto-iso"
+      },
+      {
+        "name": "Rockstor",
+        "tagline": "openSUSE-baserade NAS byggdes runt Btrfs. Rock-ons (Docker-appar) utökar funktionaliteten.",
+        "icon": "HardDrive",
+        "base": "openSUSE Leap",
+        "fileSystem": "Btrfs",
+        "href": "/docs/create-vm/system-nas/system-nas-others#rockstor",
+        "flow": "auto-iso"
+      },
+      {
+        "name": "ZimaOS",
+        "tagline": "Lättviktigt NAS-system för media, Docker-appar och hemautomation. Har en egen installerare.",
+        "icon": "MonitorIcon",
+        "base": "Buildroot (vidareutvecklat från CasaOS)",
+        "fileSystem": "ext4",
+        "href": "/docs/create-vm/system-nas/system-nas-others#zimaos",
+        "flow": "dedicated"
+      },
+      {
+        "name": "FygoOS",
+        "tagline": "Internationell utgåva av fnOS: en Debian-baserad NAS med lagringsvolymer, appar och media streaming, hanteras från sitt webbgränssnitt och Fygo-appar.",
+        "icon": "Server",
+        "base": "Debian Linux",
+        "fileSystem": "Btrfs, ext4",
+        "href": "/docs/create-vm/system-nas/system-nas-others#fygoos",
+        "flow": "auto-iso"
+      }
+    ]
+  },
+  "umbrel": {
+    "title": "Gemenskapsalternativ: Umbrel OS",
+    "bodyRich": "Den 9: e posten i NAS-menyn är <strong>Umbrel OS</strong>. Det körs en <umbrelLink>community-scripts installer</umbrelLink> underhålls utanför ProxMenux, så det är inte dokumenterat här. Installeraren hanterar hela livscykeln och skriver ut sina standarduppgifter i slutet."
+  },
+  "zfsMem": {
+    "title": "Tumregel för ZFS-minne",
+    "bodyRich": "Ge TrueNAS minst <strong>8 GB RAM</strong> för grundläggande drift och mer vid krävande belastning. ZFS använder RAM för ARC-cache, men det finns ingen allmän prestandagräns vid 8 GB för alla ZFS-NAS. Kontrollera distributionens krav och dimensionera för diskar, tjänster och appar; lätta OMV- eller Rockstor-installationer kan behöva mindre."
+  },
+  "related": {
+    "heading": "Relaterat",
+    "items": [
+      {
+        "href": "/docs/create-vm/system-nas/synology",
+        "label": "Synology-VM",
+        "tail": " — Dedikerad installatör för Synology DSM (Xpenology) på Proxmox."
+      },
+      {
+        "href": "/docs/create-vm/system-nas/system-nas-others",
+        "label": "Övriga system NAS",
+        "tail": " — TrueNAS, OpenMediaVault, Rockstor, XigmaNAS, FygoOS och liknande."
+      },
+      {
+        "href": "/docs/disk-manager/import-disk-vm",
+        "label": "Importera disk till VM",
+        "tail": " - passera riktiga fysiska diskar till NAS VM (rekommenderas över virtuella diskar för produktion)."
+      },
+      {
+        "href": "/docs/help-info/zfs-commands",
+        "label": "Kommandon för ZFS-hantering",
+        "tail": " - användbart om din NAS-distribution använder ZFS under."
+      },
+      {
+        "href": "/docs/create-vm",
+        "label": "Översikt över att skapa VM",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sv/docs/create-vm/system-nas/synology.json b/web/messages/sv/docs/create-vm/system-nas/synology.json
new file mode 100644
index 00000000..43669abb
--- /dev/null
+++ b/web/messages/sv/docs/create-vm/system-nas/synology.json
@@ -0,0 +1,400 @@
+{
+  "meta": {
+    "title": "Skapa VM: Synology DSM | ProxMenux-dokumentation",
+    "description": "Skapa en Synology DSM-VM på Proxmox VE. ProxMenux laddar ned vald starthanterare (Arc, RR, Alpine RedPill M-shell eller en egen avbildning), importerar den som VM:ns startdisk och konfigurerar CPU, RAM och lagring med standard- eller avancerad guide.",
+    "ogTitle": "Skapa VM: Synology DSM | ProxMenux-dokumentation",
+    "ogDescription": "Skapa en Synology DSM virtuell maskin på Proxmox VE med ProxMenux."
+  },
+  "header": {
+    "title": "Skapa VM: Synology DSM",
+    "description": "Skapa en Synology DSM-VM på Proxmox VE. ProxMenux laddar ned vald starthanterare (Arc, RR, Alpine RedPill M-shell eller en egen avbildning), importerar den som VM:ns startdisk och konfigurerar CPU, RAM och lagring med standard- eller avancerad guide.",
+    "section": "Virtuella maskiner · NAS"
+  },
+  "loaderLabels": {
+    "arc": "Arc Loader",
+    "rr": "RR Loader",
+    "tinycore": "TinyCore Loader"
+  },
+  "whatThisDoes": {
+    "title": "Vad detta gör",
+    "bodyRich": "ProxMenux automatiserar VM-förberedelserna för Synology DSM: det laddar ned en starthanterare, importerar den som IDE-startdisk och tillämpar dina val för CPU, RAM, nätverk och lagring. Att bygga starthanteraren, välja modell och installera DSM sker <strong>inne i VM:n</strong> via starthanterarens webb- eller terminalgränssnitt. Dessa steg underhålls av communityn och ändras ofta; sidan ger en utgångspunkt."
+  },
+  "supportedLoaders": {
+    "heading": "Starthanterare som stöds",
+    "intro": "Skriptet låter dig välja mellan fyra källor för starthanteraren:",
+    "loaders": [
+      {
+        "name": "AuxXxilium Arc",
+        "url": "https://github.com/AuxXxilium/arc"
+      },
+      {
+        "name": "RedPill RR",
+        "url": "https://github.com/RROrg/rr"
+      },
+      {
+        "name": "Alpine RedPill M-shell (TinyCore-projektet)",
+        "url": "https://github.com/PeterSuh-Q3/tinycore-redpill"
+      }
+    ],
+    "customRich": "<strong>Anpassad starthanterare</strong> — lägg din egen avbildning i <code>/var/lib/vz/template/iso</code> så hittar skriptet den."
+  },
+  "config": {
+    "heading": "Standard vs Avancerad konfiguration",
+    "intro": "När du kör skriptet frågar det om du ska använda ProxMenux standard VM-profilen eller öppna den avancerade guiden. Standardvärden är anpassade för DSM och fungerar för de flesta installationer.",
+    "defaultHeading": "Standardkonfiguration",
+    "headerParam": "Parameter",
+    "headerValue": "Standardvärde",
+    "defaultRowsRich": [
+      {
+        "param": "maskintyp",
+        "valueRich": "<code>q35</code>"
+      },
+      {
+        "param": "BIOS",
+        "valueRich": "OVMF (UEFI)"
+      },
+      {
+        "param": "CPU-typ",
+        "valueRich": "Host"
+      },
+      {
+        "param": "Kärnor",
+        "valueRich": "2"
+      },
+      {
+        "param": "RAM",
+        "valueRich": "4096 MB"
+      },
+      {
+        "param": "Bro",
+        "valueRich": "<code>vmbr0</code>"
+      },
+      {
+        "param": "MAC-adress",
+        "valueRich": "Autogenererad"
+      },
+      {
+        "param": "Starta när det är klart",
+        "valueRich": "Nej"
+      }
+    ],
+    "advancedHeading": "Avancerad konfiguration",
+    "advancedIntro": "Den avancerade guiden visar varje inställning separat. Du kan ändra följande värden:",
+    "headerOptions": "Alternativ",
+    "advancedRowsRich": [
+      {
+        "param": "maskintyp",
+        "optionsRich": "<code>q35</code> eller <code>i440fx</code>"
+      },
+      {
+        "param": "BIOS",
+        "optionsRich": "OVMF (UEFI) eller SeaBIOS (Legacy)"
+      },
+      {
+        "param": "CPU-typ",
+        "optionsRich": "Host eller KVM64"
+      },
+      {
+        "param": "Kärnor",
+        "optionsRich": "Antal CPU-kärnor"
+      },
+      {
+        "param": "RAM",
+        "optionsRich": "Minne som tilldelats VM"
+      },
+      {
+        "param": "Bro",
+        "optionsRich": "Nätverksbro"
+      },
+      {
+        "param": "MAC-adress",
+        "optionsRich": "Egen MAC-adress"
+      },
+      {
+        "param": "VLAN",
+        "optionsRich": "VLAN tag (tillval)"
+      },
+      {
+        "param": "MTU",
+        "optionsRich": "MTU storlek"
+      }
+    ]
+  },
+  "storagePlan": {
+    "heading": "Lagringsplan",
+    "introRich": "Efter CPU och RAM öppnar ProxMenux menyn <strong>Lagringsplan</strong>. Där kan du <strong>kombinera</strong> virtuella diskar, importerade diskar och PCI-passthrough-enheter i samma VM. Lägg till ett objekt i taget och slutför när du är klar.",
+    "virtualHeading": "a. Lägg till virtuell disk",
+    "virtualItemsRich": [
+      "Listar de Proxmox lagringsvolymer som finns på värden.",
+      "Du väljer mållagring och storleken på GB.",
+      "Disken ansluts som SATA (<code>sata0</code>, <code>sata1</code>, …). Virtuella och fysiska datadiskar delar de sex SATA-platserna 0–5."
+    ],
+    "importHeading": "b. Lägg till importerad disk",
+    "importItemsRich": [
+      "Detekterar fysiska diskar som är säkra att importera (system och skyddade diskar är dolda).",
+      "Du väljer en eller flera diskar via en checklista.",
+      "Importerade diskar bifogas som SATA via <code>qm set</code>."
+    ],
+    "pciHeading": "c. Lägg till styrenhet eller NVMe (PCI-passthrough)",
+    "pciItemsRich": [
+      "Hittar SATA/SAS-HBA:er och NVMe-enheter och låter dig tilldela en <em>hel styrenhet</em> till VM:n. IOMMU måste vara aktivt; skriptet erbjuder aktivering och omstart vid behov.",
+      "Ett bekräftelsesteg varnar för kontrollörens hela risk (hela kortet, inklusive varje disk på det, lämnar värden).",
+      "PCI-enheter tilldelas med kommandon som <code>qm set VMID --hostpci0 PCI_ADDRESS,pcie=1</code>. Ersätt VMID och PCI_ADDRESS med VM-ID och PCI-adress och använd ett ledigt hostpci-index för varje enhet."
+    ],
+    "resetCalloutTitle": "Återställ och slutför",
+    "resetCalloutBodyRich": "Menyn erbjuder också <strong>r</strong> (återställ det aktuella urvalet och börja om) och <strong>d</strong> (slutför och fortsätt). Du kan inte avsluta med en tom plan - Synology behöver minst en disk för att installera DSM på."
+  },
+  "gpu": {
+    "heading": "Valfri GPU passthrough",
+    "bodyRich": "Efter lagringsplanen, om manuset upptäcker en kompatibel GPU på värden frågar det om du vill skicka den till denna VM. Se <link>Lägg till GPU till en VM (Passthrough) </link> för hur assistenten fungerar - en värd omstart kan krävas."
+  },
+  "loaderInstall": {
+    "heading": "Installation av starthanterare",
+    "intro1Rich": "<strong>Arc</strong>, <strong>RR</strong> och <strong>Alpine RedPill M-shell</strong> laddas ned och packas upp automatiskt från sina ursprungliga GitHub-kodförråd. Om nedladdningen misslyckas avbryts skriptet med ett tydligt meddelande.",
+    "intro2Rich": "För alternativet <strong>Custom Loader</strong> söker skriptet i <code>/var/lib/vz/template/iso</code>. Om flera lämpliga filer hittas får du välja en.",
+    "uploadIntro": "Du kan ladda upp egna starthanterare via Proxmox lokala lagring.",
+    "imageAlt": "Lägg till anpassad starthanterare",
+    "imageCaption": "Lägg till anpassad starthanterare"
+  },
+  "vmCreation": {
+    "heading": "Skapa VM – vad skriptet kör",
+    "introRich": "När du har bekräftat starthanteraren kör ProxMenux motsvarande dessa <code>qm</code>-kommandon:",
+    "itemsRich": [
+      "<code>qm create</code> Skapar VM med den valda CPU, RAM, BIOS och maskintyp.",
+      "<code>qm importdisk</code> importerar starthanterarens avbildning till Proxmox-lagringen. Skriptet ansluter den sedan som en <strong>IDE</strong>-disk på ide0 för kompatibilitet.",
+      "<code>qm set VMID --sata0 DISK_REFERENCE</code> ansluter en datadisk från planen. Ersätt VMID och DISK_REFERENCE med VM-ID och diskreferens; använd ett ledigt SATA-index 0–5. Nätverket konfigureras av qm create.",
+      "<code>qm set VMID --hostpci0 PCI_ADDRESS,pcie=1</code> tilldelar en vald PCI-styrenhet eller NVMe-enhet. Ersätt VMID och PCI_ADDRESS med VM-ID och PCI-adress och använd ett ledigt hostpci-index per enhet.",
+      "<code>qm set VMID --boot order=ide0</code> anger starthanteraren som startenhet. Ersätt VMID med VM-ID:t."
+    ]
+  },
+  "stepByStep": {
+    "heading": "Konfigurera starthanteraren steg för steg",
+    "intro": "De sex gemensamma stegen är: starta VM:n, välj modell, DSM-version och tillägg, bygg och starta. Menyer och alternativ varierar mellan versioner. M-shell-bilderna visar ett äldre TinyCore-gränssnitt; det aktuella skriptet laddar ned Alpine RedPill M-shell, så följ dess aktuella instruktioner.",
+    "warnCalloutTitle": "Starthanterarna underhålls inte av ProxMenux",
+    "warnCalloutBody": "Arc, RR och Alpine RedPill M-shell är communityprojekt med egna utgivningsplaner. Om ett steg skiljer sig från bilderna nedan har starthanteraren troligen uppdaterats. Läs dess egen dokumentation via länkarna längst ned på sidan."
+  },
+  "stepBadge": "Steg",
+  "step1": {
+    "title": "Starta VM:n och öppna huvudmenyn",
+    "intro": "Starta den skapade VM:n. Första starten öppnar starthanterarens konfiguration där du väljer och bygger DSM-modellen. Senare starter hoppar över steget om du inte begär en ny konfiguration från starthanterarens startmeny. Alla tre har både terminal- och webbgränssnitt.",
+    "arc": {
+      "webRich": "<strong>Webbgränssnitt.</strong> Öppna en webbläsare och gå till IP-adressen i VM-konsolen (i vårt exempel: <code>http://192.168.0.32</code>).",
+      "webAlt": "Arc-starthanterarens webbgränssnitt",
+      "webCaption": "Arc-starthanterarens webbgränssnitt",
+      "termRich": "<strong>Terminalgränssnitt</strong>: öppna det direkt i VM-konsolen.",
+      "termAlt": "Arc-starthanterarens terminalgränssnitt",
+      "termCaption": "Arc-starthanterarens terminalgränssnitt"
+    },
+    "rr": {
+      "webRich": "<strong>Webbgränssnitt.</strong> Öppna en webbläsare och ange IP-adressen från VM-konsolen följd av port <strong>7681</strong> (exempel: <code>http://192.168.0.33:7681</code>).",
+      "webAlt": "RR-starthanterarens webbgränssnitt",
+      "webCaption": "RR-starthanterarens webbgränssnitt",
+      "termRich": "<strong>Terminalgränssnitt.</strong> Skriv <code>menu.sh</code> i VM-konsolen för att öppna det.",
+      "termAlt": "RR-starthanterarens terminalgränssnitt",
+      "termCaption": "RR-starthanterarens terminalgränssnitt"
+    },
+    "tinycore": {
+      "webRich": "<strong>Webbgränssnitt.</strong> Öppna en webbläsare och ange IP-adressen från VM-konsolen följd av port <strong>7681</strong> (exempel: <code>http://192.168.0.35:7681</code>).",
+      "webAlt": "TinyCore loader webbgränssnitt",
+      "webCaption": "TinyCore loader webbgränssnitt",
+      "termRich": "<strong>Terminalgränssnitt</strong>: öppna det direkt i VM-konsolen. Håll uppsikt över skärmen; du kan bli ombedd att trycka på en tangent för att fortsätta eller välja ett annat språk.",
+      "termAlt": "TinyCore-starthanterarens terminalgränssnitt",
+      "termCaption": "TinyCore-starthanterarens terminalgränssnitt"
+    }
+  },
+  "step2": {
+    "title": "Välj modell",
+    "introRich": "Välj den Synology DSM-modell du vill installera. Beroende på starthanteraren kan du behöva visa fler alternativ för hela listan. Bilderna nedan använder modellen <strong>SA6400</strong> som exempel.",
+    "arc": {
+      "alt": "Modellval i Arc",
+      "caption": "Modellval i Arc"
+    },
+    "rr": {
+      "alt": "RR-modellval",
+      "caption": "RR-modellval"
+    },
+    "tinycore": {
+      "alt": "TinyCore-modellval",
+      "caption": "TinyCore-modellval"
+    }
+  },
+  "step3": {
+    "title": "Välj DSM version",
+    "intro": "Efter att ha valt modellen väljer du DSM-versionen för att installera.",
+    "arc": [
+      {
+        "alt": "Versionsval i Arc – steg 1",
+        "caption": "Versionsval i Arc – steg 1"
+      },
+      {
+        "alt": "Versionsval i Arc – steg 2",
+        "caption": "Versionsval i Arc – steg 2"
+      }
+    ],
+    "rr": [
+      {
+        "alt": "Versionsval i RR – steg 1",
+        "caption": "Versionsval i RR – steg 1"
+      },
+      {
+        "alt": "Versionsval i RR – steg 2",
+        "caption": "Versionsval i RR – steg 2"
+      },
+      {
+        "alt": "Versionsval i RR – steg 3",
+        "caption": "Versionsval i RR – steg 3"
+      }
+    ],
+    "tinycore": [
+      {
+        "alt": "Versionsval i TinyCore – steg 1",
+        "caption": "Versionsval i TinyCore – steg 1"
+      },
+      {
+        "alt": "Versionsval i TinyCore – steg 2",
+        "caption": "Versionsval i TinyCore – steg 2"
+      }
+    ]
+  },
+  "step4": {
+    "title": "Välj addons",
+    "intro": "I det här steget kan du lägga till extra funktioner eller egna inställningar i starthanteraren.",
+    "arc": {
+      "autoRich": "<strong>Arc</strong> erbjuder ett rekommenderat automatiskt läge och ett manuellt läge. I automatiskt läge tillämpar starthanteraren lämpliga standardvärden och startar om när det är klart.",
+      "autoAlt": "Automatisk konfiguration i Arc",
+      "autoCaption": "Automatisk konfiguration i Arc",
+      "manualRich": "I manuellt läge går du igenom alternativen ett i taget:",
+      "manualAlt": "Manuell konfiguration i Arc",
+      "manualCaption": "Manuell konfiguration i Arc",
+      "snMacAlt": "Arc SN/MAC",
+      "snMacCaption": "Arc SN / MAC konfiguration",
+      "portmapAlt": "Arc SATA portmap",
+      "portmapCaption": "Arc SATA Portmap (använd det rekommenderade alternativet)",
+      "addonsAlt": "Arc-tillägg",
+      "addonsCaption": "Val av Arc-tillägg"
+    },
+    "rr": [
+      {
+        "alt": "RR-tillägg – steg 1",
+        "caption": "RR-tillägg – steg 1"
+      },
+      {
+        "alt": "RR-tillägg – steg 2",
+        "caption": "RR addon - steg 2: tryck för att lägga till en addon"
+      },
+      {
+        "alt": "RR-tillägg – steg 3",
+        "caption": "RR-tillägg – steg 3: klicka på önskat tillägg. Upprepa stegen i de två föregående bilderna för att lägga till fler."
+      }
+    ],
+    "tinycore": [
+      {
+        "alt": "TinyCore SN-konfiguration",
+        "caption": "TinyCore SN-konfiguration"
+      },
+      {
+        "alt": "TinyCore slumpmässigt alternativ",
+        "caption": "TinyCore slumpmässigt alternativ (rekommenderas)"
+      },
+      {
+        "alt": "TinyCore MAC konfiguration",
+        "caption": "TinyCore MAC konfiguration"
+      },
+      {
+        "alt": "TinyCore VM MAC",
+        "caption": "TinyCore – välj VM:ns MAC-adress eller en slumpmässig adress."
+      }
+    ]
+  },
+  "step5": {
+    "title": "Bygg starthanteraren",
+    "introRich": "Välj <strong>Build the Loader</strong> när modell, DSM-version och tillägg har valts. Det kan ta några minuter beroende på starthanterare och valda alternativ.",
+    "arc": {
+      "alt": "Bygg starthanteraren i Arc",
+      "caption": "Bygg starthanteraren i Arc"
+    },
+    "rr": {
+      "alt": "Bygg starthanteraren i RR",
+      "caption": "Bygg starthanteraren i RR"
+    },
+    "tinycore": {
+      "alt": "Bygg starthanteraren i TinyCore",
+      "caption": "Bygg starthanteraren i TinyCore"
+    }
+  },
+  "step6": {
+    "title": "Starta starthanteraren",
+    "intro": "När starthanteraren har byggts startar VM:n om med din konfiguration och DSM-installationen börjar.",
+    "arc": {
+      "alt": "Starta starthanteraren i Arc",
+      "caption": "Starta starthanteraren i Arc"
+    },
+    "rr": {
+      "alt": "Starta starthanteraren i RR",
+      "caption": "Starta starthanteraren i RR"
+    },
+    "tinycore": {
+      "alt": "Starta starthanteraren i TinyCore",
+      "caption": "Starta starthanteraren i TinyCore"
+    }
+  },
+  "dsmInstall": {
+    "heading": "Starta DSM-installationen",
+    "intro": "När starthanteraren har startat kan du hitta din DSM-VM genom att öppna:",
+    "afterCode": "Följ stegen på skärmen för att slutföra DSM-installationen.",
+    "setupAlt": "DSM-konfiguration",
+    "setupCaption": "DSM-installationsskärm",
+    "patience": "Ha tålamod; processen kan ta flera minuter. Förloppet uppdateras automatiskt och en nedräkning visas när installationen närmar sig slutet.",
+    "finishAlt": "Installationen är klar",
+    "finishCaption": "Installationen är klar"
+  },
+  "tips": {
+    "heading": "Tips",
+    "recentTitle": "Använd de senaste DSM-modellerna",
+    "recentBody": "Vissa äldre DSM-modeller har problem att känna igen diskar eller nätverkskort. Välj en nyare modell, exempelvis SA6400, för en smidigare första start.",
+    "updateTitle": "Uppdatera starthanteraren",
+    "updateBody": "Vissa starthanterare kan uppdateras direkt från sin konfigurationsmeny; du behöver inte ta bort och återskapa VM:n.",
+    "warnTitle": "ProxMenux erbjuder inte support för starthanterarna",
+    "warnBody": "ProxMenux automatiserar VM-förberedelserna. Problem med starthanteraren, som saknad modell, tillägg som inte installeras eller DSM som inte startar, hanteras via starthanterarens egen ärendehantering och dokumentation.",
+    "docsHeading": "Starthanterarens dokumentation",
+    "docLinks": [
+      {
+        "label": "Arc dokumentation",
+        "url": "https://github.com/AuxXxilium/arc"
+      },
+      {
+        "label": "RR dokumentation",
+        "url": "https://github.com/RROrg/rr"
+      },
+      {
+        "label": "TinyCore dokumentation",
+        "url": "https://github.com/PeterSuh-Q3/tinycore-redpill"
+      }
+    ]
+  },
+  "related": {
+    "heading": "Relaterat",
+    "itemsRich": [
+      {
+        "href": "/docs/create-vm/system-nas",
+        "label": "Översikt över NAS-system",
+        "tail": " — Jämförelse av Synology vs TrueNAS / OMV / Rockstor / XigmaNAS."
+      },
+      {
+        "href": "/docs/create-vm/system-nas/system-nas-others",
+        "label": "Övriga NAS-system",
+        "tail": " — andra NAS-distributioner än Synology."
+      },
+      {
+        "href": "/docs/disk-manager/import-disk-vm",
+        "label": "Importera disk till VM",
+        "tail": " — passera verkliga diskar till Synology VM (rekommenderas för lagringsprestanda)."
+      },
+      {
+        "href": "/docs/create-vm",
+        "label": "Översikt över att skapa VM",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sv/docs/create-vm/system-nas/system-nas-others.json b/web/messages/sv/docs/create-vm/system-nas/system-nas-others.json
new file mode 100644
index 00000000..52553a79
--- /dev/null
+++ b/web/messages/sv/docs/create-vm/system-nas/system-nas-others.json
@@ -0,0 +1,312 @@
+{
+  "meta": {
+    "title": "Skapa VM: Andra NAS-system | ProxMenux Dokumentation",
+    "description": "Skapa VM för TrueNAS SCALE, TrueNAS CORE, OpenMediaVault, XigmaNAS, Rockstor, ZimaOS och FygoOS på Proxmox VE med ProxMenux. Standard- och avancerade inställningar, lagringsplan, valfri GPU-passthrough och rekommenderade resurser per system.",
+    "ogTitle": "Skapa VM: Andra NAS-system | ProxMenux Dokumentation",
+    "ogDescription": "Skapa TrueNAS SCALE / CORE, OpenMediaVault, XigmaNAS, Rockstor, ZimaOS och FygoOS VMs på Proxmox VE med ProxMenux.",
+    "ogImageAlt": "ProxMenux NAS-väljaren"
+  },
+  "header": {
+    "title": "Skapa VM: Andra NAS-system",
+    "description": "ProxMenux kan skapa en färdig VM för TrueNAS SCALE, TrueNAS CORE, OpenMediaVault, XigmaNAS, Rockstor, ZimaOS och FygoOS. Denna sida täcker det delade skapande flödet (standard / avancerad konfiguration, den nya lagringsplanen, valfria GPU genomgång) plus per-system anteckningar och rekommenderade specifikationer.",
+    "section": "Virtuella maskiner · NAS"
+  },
+  "intro": {
+    "title": "Hur dessa system skapas",
+    "bodyRich": "De sju systemen använder ProxMenux-guiden. NAS-väljaren väljer installerare och hittar senaste stabila versionen för TrueNAS, OMV, XigmaNAS, Rockstor och FygoOS innan VM-konfiguratorn och lagringsplanen öppnas. ZimaOS har ett eget installationsskript (<code>vm/zimaos.sh</code>) med samma ordning för CPU, RAM, lagring och valfri GPU."
+  },
+  "config": {
+    "heading": "Standard vs Avancerad konfiguration",
+    "intro": "När en NAS väljs frågar ProxMenux om du vill använda standard VM-profilen eller öppna den avancerade guiden. Standarderna är inställda på NAS arbetsbelastningar - mer RAM än en vanlig Linux VM eftersom ZFS-baserade system behöver det för ARC-cache.",
+    "defaultHeading": "Standardkonfiguration",
+    "headerParam": "Parameter",
+    "headerValue": "Standardvärde",
+    "defaultRowsRich": [
+      {
+        "param": "maskintyp",
+        "valueRich": "<code>q35</code>"
+      },
+      {
+        "param": "BIOS",
+        "valueRich": "OVMF (UEFI)<note> - SeaBIOS för OpenMediaVault</note>"
+      },
+      {
+        "param": "CPU-typ",
+        "valueRich": "Host"
+      },
+      {
+        "param": "Kärnor",
+        "valueRich": "2"
+      },
+      {
+        "param": "RAM",
+        "valueRich": "8192 MB<note> - 4096 MB för ZimaOS</note>"
+      },
+      {
+        "param": "Bro",
+        "valueRich": "<code>vmbr0</code>"
+      },
+      {
+        "param": "MAC-adress",
+        "valueRich": "Autogenererad"
+      },
+      {
+        "param": "Starta när det är klart",
+        "valueRich": "Nej"
+      }
+    ],
+    "advancedHeading": "Avancerad konfiguration",
+    "advancedIntro": "Den avancerade guiden visar varje inställning separat:",
+    "headerOptions": "Alternativ",
+    "advancedRowsRich": [
+      {
+        "param": "maskintyp",
+        "optionsRich": "<code>q35</code> eller <code>i440fx</code>"
+      },
+      {
+        "param": "BIOS",
+        "optionsRich": "OVMF (UEFI) eller SeaBIOS (Legacy)"
+      },
+      {
+        "param": "CPU-typ",
+        "optionsRich": "Host, KVM64 och andra listade CPU-modeller (ZimaOS: Host eller KVM64)"
+      },
+      {
+        "param": "Kärnor",
+        "optionsRich": "Antal CPU-kärnor"
+      },
+      {
+        "param": "RAM",
+        "optionsRich": "Minne som tilldelats VM"
+      },
+      {
+        "param": "Bro",
+        "optionsRich": "Nätverksbro"
+      },
+      {
+        "param": "MAC-adress",
+        "optionsRich": "Egen MAC-adress"
+      },
+      {
+        "param": "VLAN",
+        "optionsRich": "VLAN tag (tillval)"
+      },
+      {
+        "param": "MTU",
+        "optionsRich": "MTU storlek"
+      }
+    ],
+    "zfsCalloutTitle": "ZFS och RAM",
+    "zfsCalloutBody": "TrueNAS SCALE/CORE och XigmaNAS använder ZFS, vars ARC-cache drar nytta av RAM. TrueNAS behöver minst 8 GB för grundläggande drift; 16 GB eller mer kan hjälpa vid krävande tjänster och appar. Dimensionera för distribution och belastning: 8 GB är inget allmänt ZFS-minimum. Lätta OMV-, Rockstor- eller ZimaOS-installationer kan behöva mindre."
+  },
+  "storagePlan": {
+    "heading": "Lagringsplan",
+    "intro": "Efter CPU / RAM öppnar ProxMenux menyn Lagringsplan, där du kan kombinera virtuella diskar, importerade diskar och PCI genomgångsenheter i samma VM, lägga till objekt en i taget och avsluta när du är klar.",
+    "virtualHeading": "a. Lägg till virtuell disk",
+    "virtualItemsRich": [
+      "Listar de Proxmox lagringsvolymer som finns på värden.",
+      "Du väljer mållagring och storleken på GB.",
+      "Disken använder vald buss: SCSI (standard), SATA, VirtIO eller IDE (ZimaOS: SCSI eller SATA). SATA har sex platser numrerade 0–5: <code>sata0</code>, <code>sata1</code>, …."
+    ],
+    "importHeading": "b. Lägg till importerad disk",
+    "importItemsRich": [
+      "Detekterar fysiska diskar som är säkra att importera (system och skyddade diskar är dolda).",
+      "Du väljer en eller flera diskar via en checklista.",
+      "Importerade diskar använder vald buss och ansluts via <code>qm set</code>."
+    ],
+    "pciHeading": "c. Lägg till styrenhet eller NVMe (PCI-passthrough)",
+    "pciItemsRich": [
+      "Hittar SATA/SAS-HBA:er och NVMe-enheter och låter dig tilldela en <em>hel styrenhet</em> till VM:n. IOMMU måste vara aktivt; skriptet erbjuder aktivering och omstart vid behov.",
+      "Ett bekräftelsesteg varnar för kontrollörens hela risk (hela kortet, inklusive varje disk på det, lämnar värden).",
+      "PCI-enheter tilldelas med kommandon som <code>qm set VMID --hostpci0 PCI_ADDRESS,pcie=1</code>. Ersätt VMID och PCI_ADDRESS med VM-ID och PCI-adress och använd ett ledigt hostpci-index för varje enhet."
+    ],
+    "resetCalloutTitle": "Återställ och slutför",
+    "resetCalloutBodyRich": "Menyn erbjuder också <strong>r</strong> (återställ det aktuella urvalet och börja om) och <strong>d</strong> (slutför och fortsätt). Du kan inte avsluta med en tom plan."
+  },
+  "gpu": {
+    "heading": "Valfri GPU passthrough",
+    "bodyRich": "Efter lagringsplanen, om en kompatibel GPU detekteras på värden, erbjuder ProxMenux att starta GPU passthrough assistent. Se <link>Lägg till GPU till en VM (Passthrough) </link> för hur assistenten fungerar - en värd omstart kan krävas."
+  },
+  "autoFeatures": {
+    "heading": "Automatiska VM-funktioner",
+    "efiTitle": "EFI-disk",
+    "efiBody": "Med OVMF (UEFI) skapar ProxMenux automatiskt en 4 MB EFI-disk på vald lagring i ett format som passar lagringstypen, raw för kataloglagring.",
+    "isoTitle": "ISO montering",
+    "isoBodyRich": "Installationen ISO laddas ner (om det behövs) och bifogas <code>ide2</code> som en CD-ROM, redo för första start.",
+    "guestTitle": "QEMU gästagent",
+    "guestBody": "Gästagentkanalen är aktiverad i VM-konfig. Du måste fortfarande installera agenten inuti gästen efter att NAS OS är uppe."
+  },
+  "endToEnd": {
+    "heading": "Vad manuset gör end-to-end",
+    "itemsRich": [
+      "Hittar och laddar ned senaste stabila ISO eller använder en reservversion om originalservern inte kan nås.",
+      "Tillämpar standard- eller avancerade inställningar för CPU, RAM, BIOS och maskintyp.",
+      "Öppnar lagringsplanen och fäster de valda virtuella diskarna, importerade diskar och PCI-enheter.",
+      "Skapar en EFI-skiva om UEFI väljs.",
+      "Monterar installationen ISO på <code>ide2</code>.",
+      "Ange startordern (disk först, sedan ISO).",
+      "Möjliggör QEMU Guest Agent-kanalen.",
+      "Alternativt kör GPU passthrough assistent.",
+      "Genererar en stilig HTML-beskrivning bifogad till VM.",
+      "Startar VM:n om du valde det."
+    ]
+  },
+  "perSystem": {
+    "heading": "Per-system noter",
+    "shellLabel": "Shell Interface",
+    "webLabel": "Web Interface"
+  },
+  "systems": {
+    "truenasScale": {
+      "id": "truenas-scale",
+      "title": "TrueNAS SCALE",
+      "icon": "Database",
+      "officialName": "TrueNAS SCALE",
+      "officialUrl": "https://www.truenas.com/truenas-scale/",
+      "description": "Debianbaserad TrueNAS med Docker-appar i aktuella versioner, Linux KVM och ZFS som primärt filsystem. Äldre SCALE-versioner använde Kubernetes. Det kombinerar ZFS-lagring med ett containerekosystem.",
+      "specs": [
+        "Rekommenderat gränssnitt: SATA eller SCSI (både support discard/trim)",
+        "Minst RAM: 8 GB (16 GB eller mer rekommenderas för krävande belastning)",
+        "Minsta CPU kärnor: 2 (4 + rekommenderas)",
+        "UEFI (OVMF) boot rekommenderas",
+        "VirtIO nätverksadapter för bästa genomströmning"
+      ],
+      "shellImg": "/vm/truenas/truenas-scale-shell.png",
+      "webImg": "/vm/truenas/truenas-scale-web.png",
+      "shellAlt": "TrueNAS SCALE skal gränssnitt",
+      "webAlt": "TrueNAS SCALE webbgränssnitt"
+    },
+    "truenasCore": {
+      "id": "truenas-core",
+      "title": "TrueNAS CORE",
+      "icon": "Database",
+      "officialName": "TrueNAS CORE",
+      "officialUrl": "https://www.truenas.com/truenas-core/",
+      "description": "FreeBSD-baserad TrueNAS, tidigare FreeNAS, med fokus på ZFS. Jails, insticksprogram och virtualisering i CORE 13.3 är föråldrade och saknar stöd; utvecklingen fokuserar på Linuxutgåvorna.",
+      "specs": [
+        "Rekommenderat gränssnitt: SATA",
+        "Minsta RAM: 8 GB (16 GB+ rekommenderas)",
+        "Minsta CPU kärnor: 2 (4 + rekommenderas)",
+        "UEFI (OVMF) boot rekommenderas",
+        "VirtIO nätverksadapter för bästa genomströmning"
+      ],
+      "shellImg": "/vm/truenas/truenas-core-shell.png",
+      "webImg": "/vm/truenas/truenas-core-web.png",
+      "shellAlt": "TrueNAS CORE shell gränssnitt",
+      "webAlt": "TrueNAS CORE webbgränssnitt"
+    },
+    "openmediavault": {
+      "id": "openmediavault",
+      "title": "OpenMediaVault",
+      "icon": "Server",
+      "officialName": "openmediavault.org",
+      "officialUrl": "https://www.openmediavault.org",
+      "description": "Debian-baserade NAS med ett modulärt pluginsystem. Lätt på resurser och lätt att köra på blygsam hårdvara - ett naturligt val när du inte behöver ZFS.",
+      "specs": [
+        "Rekommenderat gränssnitt: SATA eller VirtIO",
+        "Minsta RAM: 2 GB (4 GB+ rekommenderas)",
+        "Minsta CPU kärnor: 1 (2 + rekommenderas)",
+        "BIOS: ProxMenux Defaults till SeaBIOS för OMV (överskridande i Avancerad om det behövs)",
+        "VirtIO nätverksadapter för bästa genomströmning"
+      ],
+      "shellImg": "/vm/openmediavault/openmediavault-shell.png",
+      "webImg": "/vm/openmediavault/openmediavault-web.png",
+      "shellAlt": "OpenMediaVault skalgränssnitt",
+      "webAlt": "OpenMediaVault webbgränssnitt"
+    },
+    "xigmanas": {
+      "id": "xigmanas",
+      "title": "XigmaNAS",
+      "icon": "Database",
+      "officialName": "xigmanas.com",
+      "officialUrl": "https://www.xigmanas.com",
+      "description": "FreeBSD-baserade NAS - den direkta fortsättningen av den ursprungliga FreeNAS (0.7)-kodbasen. Fokuserad på ZFS och enkelhet, med ett lättare fotavtryck än TrueNAS.",
+      "specs": [
+        "Rekommenderat gränssnitt: SATA eller SCSI",
+        "Minsta RAM: 4 GB (8 GB + rekommenderas för ZFS)",
+        "Minsta CPU-kärnor: 2",
+        "UEFI (OVMF) boot rekommenderas",
+        "VirtIO nätverksadapter för bästa genomströmning"
+      ]
+    },
+    "rockstor": {
+      "id": "rockstor",
+      "title": "Rockstor",
+      "icon": "HardDrive",
+      "officialName": "rockstor.com",
+      "officialUrl": "https://rockstor.com",
+      "description": "openSUSE Leap-baserade NAS byggdes runt Btrfs. Snapshots, subvolumes och Rock-ons app ram (Docker) för media, fildelning och backup.",
+      "specs": [
+        "Rekommenderat gränssnitt: SATA eller VirtIO",
+        "Minsta RAM: 2 GB (4 GB+ rekommenderas)",
+        "Minsta CPU-kärnor: 2",
+        "UEFI (OVMF) boot rekommenderas",
+        "VirtIO nätverksadapter för bästa genomströmning"
+      ],
+      "shellImg": "/vm/rockstor/rockstor-shell.png",
+      "webImg": "/vm/rockstor/rockstor-web.png",
+      "shellAlt": "Rockstor Shell Interface",
+      "webAlt": "Rockstor webbgränssnitt"
+    },
+    "zimaos": {
+      "id": "zimaos",
+      "title": "ZimaOS",
+      "icon": "MonitorIcon",
+      "officialName": "zimaspace.com",
+      "officialUrl": "https://www.zimaspace.com/zimaos",
+      "description": "Lättviktigt NAS-/hemserversystem byggt med Buildroot och vidareutvecklat från CasaOS, för media, Docker-appar och hemautomation. En egen ProxMenux-installerare (vm/zimaos.sh) laddar ned en färdig avbildning och erbjuder CPU-, RAM- och lagringsinställningar.",
+      "specs": [
+        "Rekommenderat gränssnitt: SATA eller VirtIO",
+        "Standard RAM: 4 GB (tillräckligt för media/självvärda appar)",
+        "Minsta CPU-kärnor: 2",
+        "UEFI (OVMF) start",
+        "VirtIO nätverksadapter för bästa genomströmning"
+      ]
+    },
+    "fygoos": {
+      "id": "fygoos",
+      "title": "FygoOS",
+      "icon": "Server",
+      "officialName": "fygonas.com",
+      "officialUrl": "https://fygonas.com",
+      "description": "Internationell utgåva av fnOS, en Debian-baserad NAS. ProxMenux hämtar den senaste installatören ISO publicerad på fygonas.com och monterar den i VM. Installationsprogrammet sätter systemet på en disk; utrymmet kvar på den disken kan hålla volymer för appar och filer. Efter installationen visar konsolen adressen till webbgränssnittet, på port 5666 (port 80 omdirigeringar till det): öppna den i en webbläsare för att namnge enheten och skapa administratörskontot.",
+      "specs": [
+        "Systemdisk: FygoOS föreslår en 64 GB systempartition, som kan vara mindre i en VM",
+        "Installation: Graphical Install eller Rescuing Install om grafikläget misslyckas",
+        "UEFI (OVMF) start utan Secure Boot-nycklar, eftersom installationsprogrammet kräver",
+        "Nätverk: Ethernet med DHCP som standard",
+        "VirtIO nätverksadapter för bästa genomströmning"
+      ]
+    }
+  },
+  "related": {
+    "heading": "Relaterat",
+    "itemsRich": [
+      {
+        "href": "/docs/create-vm/system-nas",
+        "label": "System NAS översikt",
+        "tail": " — Snabb jämförelse över alla NAS-alternativ."
+      },
+      {
+        "href": "/docs/create-vm/system-nas/synology",
+        "label": "Synology-VM",
+        "tail": " — för Synology DSM (Xpenology) flöde."
+      },
+      {
+        "href": "/docs/disk-manager/import-disk-vm",
+        "label": "Importera disk till VM",
+        "tail": " — rekommenderas för NAS användningsfall (riktiga diskar > virtuella diskar)."
+      },
+      {
+        "href": "/docs/help-info/zfs-commands",
+        "label": "Kommandon för ZFS-hantering",
+        "tail": " — om du väljer TrueNAS eller annan ZFS-stödd distribution."
+      },
+      {
+        "href": "/docs/create-vm",
+        "label": "Översikt över att skapa VM",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sv/docs/create-vm/system-windows.json b/web/messages/sv/docs/create-vm/system-windows.json
new file mode 100644
index 00000000..4110ccdf
--- /dev/null
+++ b/web/messages/sv/docs/create-vm/system-windows.json
@@ -0,0 +1,259 @@
+{
+  "meta": {
+    "title": "Skapa VM: Windows-system | ProxMenux-dokumentation",
+    "description": "Skapa och konfigurera virtuella Windows-maskiner på Proxmox VE med ProxMenux. ISO via UUP Dump eller lokal fil, standard- eller avancerad konfiguration, gemensam lagringsplan, valfri GPU-passthrough, TPM 2.0 och installation av VirtIO-drivrutiner.",
+    "ogTitle": "Skapa VM: Windows-system | ProxMenux-dokumentation",
+    "ogDescription": "Skapa Windows-VM:ar på Proxmox VE med ProxMenux: UUP Dump eller lokal ISO, gemensam lagringsplan, valfri GPU-passthrough, TPM 2.0 och VirtIO-drivrutiner.",
+    "ogImageAlt": "ProxMenux Windows VM-menyn"
+  },
+  "header": {
+    "title": "Skapa VM: Windows-system",
+    "description": "Skapa en Windows-VM på Proxmox VE. ProxMenux hanterar ISO-val (UUP Dump eller lokal), CPU, RAM, maskintyp, gemensam lagringsplan, valfri GPU-passthrough, TPM 2.0 och installation av VirtIO-drivrutiner.",
+    "section": "Virtuella maskiner"
+  },
+  "intro": {
+    "title": "Vad skriptet gör",
+    "body": "Windows-flödet frågar efter ISO-källan: UUP Dump eller en lokal kopia i <code>/var/lib/vz/template/iso</code>. Sedan startar den gemensamma VM-guiden med Windows-anpassade standardval: <code>q35</code>, OVMF och TPM 2.0. ISO:n med VirtIO-drivrutiner ansluts som en andra CD-ROM och VM:n är redo för Windows-installationen."
+  },
+  "image": {
+    "alt": "ProxMenux Windows installationsalternativ",
+    "caption": "Windows installationsalternativ"
+  },
+  "config": {
+    "heading": "Standard vs Avancerad konfiguration",
+    "intro": "När ISO väljs frågar ProxMenux om du vill använda standard VM-profilen eller öppna den avancerade guiden. Standardprofilen är inställd på moderna Windows-skrivbord och serverutgåvor.",
+    "defaultHeading": "Standardkonfiguration",
+    "headerParam": "Parameter",
+    "headerValue": "Standardvärde",
+    "defaultRows": [
+      {
+        "param": "maskintyp",
+        "valueRich": "<code>q35</code>"
+      },
+      {
+        "param": "BIOS",
+        "value": "OVMF (UEFI)"
+      },
+      {
+        "param": "CPU-typ",
+        "value": "Host"
+      },
+      {
+        "param": "Kärnor",
+        "value": "4"
+      },
+      {
+        "param": "RAM",
+        "value": "8192 MB"
+      },
+      {
+        "param": "Bro",
+        "valueRich": "<code>vmbr0</code>"
+      },
+      {
+        "param": "MAC-adress",
+        "value": "Autogenererad"
+      },
+      {
+        "param": "TPM",
+        "value": "Aktiverad (v2.0)"
+      },
+      {
+        "param": "Starta när det är klart",
+        "value": "Nej"
+      }
+    ],
+    "advancedHeading": "Avancerad konfiguration",
+    "advancedIntro": "Den avancerade guiden visar varje inställning separat:",
+    "headerOptions": "Alternativ",
+    "advancedRows": [
+      {
+        "param": "maskintyp",
+        "optionsRich": "<code>q35</code> eller <code>i440fx</code>"
+      },
+      {
+        "param": "BIOS",
+        "options": "OVMF (UEFI) eller SeaBIOS (Legacy)"
+      },
+      {
+        "param": "CPU-typ",
+        "options": "Host, KVM64 och andra listade CPU-modeller"
+      },
+      {
+        "param": "Kärnor",
+        "options": "Antal CPU-kärnor"
+      },
+      {
+        "param": "RAM",
+        "options": "Minne som tilldelats VM"
+      },
+      {
+        "param": "Bro",
+        "options": "Nätverksbro"
+      },
+      {
+        "param": "MAC-adress",
+        "options": "Egen MAC-adress"
+      },
+      {
+        "param": "VLAN",
+        "options": "VLAN tag (tillval)"
+      },
+      {
+        "param": "MTU",
+        "options": "MTU storlek"
+      },
+      {
+        "param": "TPM",
+        "options": "TPM 2.0 läggs till automatiskt för Windows; guiden har ingen TPM-växel."
+      }
+    ],
+    "tpmWarnTitle": "TPM-kraven beror på Windows-utgåvan",
+    "tpmWarnBody": "Windows 11 kräver normalt TPM 2.0. Windows Server 2022 kräver det för vissa säkerhetsfunktioner, inte för varje installation. ProxMenux lägger till ett virtuellt TPM för Windows; den avancerade guiden har ingen TPM-växel."
+  },
+  "storagePlan": {
+    "heading": "Lagringsplan",
+    "body": "Efter CPU / RAM öppnar ProxMenux <strong>Storage Plan</strong>-menyn, där du kan kombinera virtuella diskar, importerade diskar och PCI genomgångsenheter i samma VM, lägga till objekt en i taget och avsluta när du är klar.",
+    "virtualDiskTitle": "a. Lägg till virtuell disk",
+    "virtualDiskItems": [
+      "Listar de Proxmox lagringsvolymer som finns på värden.",
+      "Du väljer mållagring och storleken på GB.",
+      "Disken använder vald buss: SCSI (standard), SATA, VirtIO eller IDE. SATA har sex platser numrerade 0–5: <code>sata0</code>, <code>sata1</code>, …."
+    ],
+    "importDiskTitle": "b. Lägg till importerad disk",
+    "importDiskItems": [
+      "Detekterar fysiska diskar som är säkra att importera (system och skyddade diskar är dolda).",
+      "Du väljer en eller flera diskar via en checklista.",
+      "Importerade diskar använder vald buss och ansluts via <code>qm set</code>."
+    ],
+    "pciTitle": "c. Lägg till styrenhet eller NVMe (PCI-passthrough)",
+    "pciItems": [
+      "Hittar SATA/SAS-HBA:er och NVMe-enheter och låter dig tilldela en <em>hel styrenhet</em> till VM:n. IOMMU måste vara aktivt; skriptet erbjuder aktivering och omstart vid behov.",
+      "Ett bekräftelsesteg varnar för kontrollörens hela risk (hela kortet, inklusive varje disk på det, lämnar värden).",
+      "PCI-enheter tilldelas med kommandon som <code>qm set VMID --hostpci0 PCI_ADDRESS,pcie=1</code>. Ersätt VMID och PCI_ADDRESS med VM-ID och PCI-adress och använd ett ledigt hostpci-index för varje enhet."
+    ],
+    "resetTitle": "Återställ och slutför",
+    "resetBody": "Menyn erbjuder också <strong>r</strong> (återställ det aktuella urvalet och börja om) och <strong>d</strong> (slutför och fortsätt). Du kan inte avsluta med en tom plan."
+  },
+  "gpu": {
+    "heading": "Valfri GPU passthrough",
+    "body": "Efter lagringsplanen, om en kompatibel GPU detekteras på värd ProxMenux erbjudanden för att starta GPU passthrough assistent. Se <gpuLink>Lägg till GPU till en VM (Passthrough) </gpuLink> för hur assistenten fungerar - en värd omstart kan krävas."
+  },
+  "autoFeatures": {
+    "heading": "Automatiska VM-funktioner",
+    "efiTitle": "EFI-disk",
+    "efiBody": "När OVMF (UEFI) väljs, skapar ProxMenux en 4 MB EFI systemdisk på lagringen du väljer och fäster den på VM så UEFI firmware har en plats att lagra sina variabler.",
+    "tpmTitle": "TPM 2.0",
+    "tpmBody": "ProxMenux lägger till en virtuell TPM 2.0-enhet i Windows-VM:ar. Den uppfyller Windows 11:s TPM-krav och stöder TPM-beroende funktioner i Windows Server.",
+    "isoTitle": "ISO montering",
+    "isoBody": "Installations-ISO:n ansluts till <code>ide2</code>. ISO:n med VirtIO-drivrutiner laddas ned vid behov och ansluts till <code>ide3</code> för steget <em>Läs in drivrutin</em>.",
+    "guestTitle": "QEMU gästagent",
+    "guestBody": "Gästagentkanalen är aktiverad i VM-konfig. Själva agenten installeras i Windows genom att köra <code>virtio-win-guest-tools.exe</code> efter installationen."
+  },
+  "installOptions": {
+    "heading": "Windows installationsalternativ",
+    "intro": "ProxMenux erbjuder två metoder för att få Windows-installationsmedia:",
+    "uupTitle": "UUP Dump ISO-skapare",
+    "uupLogoAlt": "UUP Dump logotyp",
+    "uupBody": "Skriptet <strong>UUP Dump ISO Creator</strong> är ett ProxMenux-verktyg som skapar en Windows-ISO på begäran med filer från Microsofts Windows Update-servrar. Det hämtar rena, officiella installationsfiler, även Insider Preview-versioner.",
+    "uupItems": [
+      "Tillgång till de senaste Windows-versionerna.",
+      "Stöder Insider Preview versioner.",
+      "Rena, officiella installationsfiler från Microsoft.",
+      "Automatisk ISO-skapelse och montering i VM.",
+      "Stöder Home, Pro och Enterprise utgåvor."
+    ],
+    "uupLearnMore": "Läs mer om UUP Dump ISO Creator",
+    "localTitle": "Installera med lokal ISO",
+    "localBody": "Använder en Windows ISO du redan har laddat upp till värdens lokala lagring (<code>/var/lib/vz/template/iso</code>). Skriptet listar varje icke-VirtIO ISO det hittar och låter dig välja en.",
+    "localImageAlt": "Lokala ISO urvalsmenyn",
+    "localImageCaption": "Lokala ISO urvalsmenyn"
+  },
+  "endToEnd": {
+    "heading": "Vad skriptet gör från början till slut",
+    "items": [
+      "Hämtar Windows-ISO:n från UUP Dump eller en lokal kopia.",
+      "Tillämpar standard- eller avancerade inställningar för CPU, RAM, BIOS och maskintyp.",
+      "Öppnar lagringsplanen och fäster de valda virtuella diskarna, importerade diskar och PCI-enheter.",
+      "Skapar EFI-skivan (UEFI-installationer) och fäster TPM 2.0-enheten.",
+      "Monterar Windows ISO på <code>ide2</code>.",
+      "Laddar ned ISO:n med VirtIO-drivrutiner och monterar den på <code>ide3</code>.",
+      "Ange startordern (disk först, sedan ISO).",
+      "Möjliggör QEMU Guest Agent-kanalen.",
+      "Kör guiden för GPU-passthrough om du väljer det.",
+      "Genererar en stilig HTML-beskrivning bifogad till VM.",
+      "Startar VM:n om du valde det."
+    ]
+  },
+  "virtio": {
+    "heading": "VirtIO-drivrutiner under installationen",
+    "body": "VM-skaparen använder som standard SCSI-diskar med en VirtIO SCSI-styrenhet och ett VirtIO-nätverkskort. En vanlig Windows-ISO kan behöva deras drivrutiner från VirtIO-ISO:n på <code>ide3</code>. SATA-diskar fungerar oftast med Windows inbyggda drivrutiner; valet SATA ändrar inte VirtIO-nätverkskortet.",
+    "warnTitle": "Läs in VirtIO-nätverksdrivrutinen om Windows saknar nätverk",
+    "warnBody": "VM:n använder ett VirtIO-nätverkskort (<code>virtio</code>). Om Windows saknar drivrutinen läser du in den under installationen för nätverksåtkomst. Annars kan aktivering och Windows Update saknas vid första starten.",
+    "stepLabel": "Steg",
+    "steps": [
+      {
+        "title": "Öppna skärmen ”Var vill du installera Windows?”",
+        "body": "Under Windows-installationen, om inga diskar visas, är lagringsdrivrutinen för ditt valda gränssnitt (SCSI eller VirtIO) inte laddad ännu. Ladda det manuellt från den monterade VirtIO ISO.",
+        "img": "/vm/windows/virtio-step-1.png",
+        "caption": "Windows-installation utan diskar som visas"
+      },
+      {
+        "title": "Klicka på ”Läs in drivrutin”",
+        "bodyRich": "Klicka på <strong>Load driver</strong> för att bläddra i den monterade VirtIO ISO och välj lagringsdrivrutinen som matchar gränssnittet du valde.",
+        "img": "/vm/windows/virtio-step-2.png",
+        "caption": "Klicka på Läs in drivrutin för att bläddra i VirtIO-ISO:n"
+      },
+      {
+        "title": "Bläddra till rätt drivrutinsmapp",
+        "bodyRich": "Välj <code>vioscsi</code> för VirtIO SCSI-styrenheten eller <code>viostor</code> för VirtIO-blockdiskar på VirtIO-ISO:n. Välj sedan undermappen för din Windows-version och arkitektur.",
+        "img": "/vm/windows/virtio-step-3.png",
+        "caption": "Bläddra till lämplig drivrutinsmapp"
+      },
+      {
+        "title": "Välj drivrutinen",
+        "bodyRich": "Windows listar tillgängliga drivrutiner. Välj den som matchar din inställning (typiskt <strong>Red Hat VirtIO SCSI controller</strong>) och klicka på <strong>Next</strong>.",
+        "img": "/vm/windows/virtio-step-4.png",
+        "caption": "Välj den VirtIO-drivrutin som matchar diskgränssnittet"
+      },
+      {
+        "title": "(Valfritt) Installera nätverksdrivrutinen",
+        "bodyRich": "Om du också valde VirtIO som nätverksgränssnitt, ladda nätverksdrivrutinen från <code>NetKVM</code>-mappen i samma ISO, väljer du undermappen för din Windows-version. Utan detta steg installerar Windows utan internetåtkomst.",
+        "img": "/vm/windows/virtio-step-5.png",
+        "caption": "Ladda VirtIO-nätverksdrivrutinen för att aktivera internet under installationen"
+      }
+    ],
+    "tipTitle": "Post-install: kör virtio-win-guest-tools.exe",
+    "tipBody": "Öppna VirtIO-ISO:n i Utforskaren efter Windows-installationen och kör <code>virtio-win-guest-tools.exe</code>. Det installerar återstående drivrutiner för nätverk, skärm, inmatning och ballooning samt QEMU-gästagenten i samma körning."
+  },
+  "related": {
+    "heading": "Relaterat",
+    "items": [
+      {
+        "href": "/docs/utils/UUp-Dump-ISO-Creator",
+        "label": "UUP Dump ISO-skapare",
+        "tail": " - generera uppdaterad Windows-installation ISOs på Proxmox-värden."
+      },
+      {
+        "href": "/docs/disk-manager/import-disk-image-vm",
+        "label": "Importera diskavbildning till virtuell dator",
+        "tail": " — importera en befintlig Windows-diskavbild (.vmdk, .qcow2, .img eller .raw) till en befintlig VM; konvertera först .vhdx-avbildningar till ett format som stöds."
+      },
+      {
+        "href": "/docs/hardware/gpu-vm-passthrough",
+        "label": "Lägg till GPU till VM (Passthrough)",
+        "tail": " — för Windows VM med hårdvaruaccelererad GPU."
+      },
+      {
+        "href": "/docs/help-info/vm-ct-commands",
+        "label": "Kommandon för VM- och CT-hantering",
+        "tail": " — referens för qm CLI."
+      },
+      {
+        "href": "/docs/create-vm",
+        "label": "Översikt över att skapa VM",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sv/docs/disk-manager/add-controller-nvme-vm.json b/web/messages/sv/docs/disk-manager/add-controller-nvme-vm.json
new file mode 100644
index 00000000..0aba2356
--- /dev/null
+++ b/web/messages/sv/docs/disk-manager/add-controller-nvme-vm.json
@@ -0,0 +1,128 @@
+{
+  "meta": {
+    "title": "Lägg till styrenhet eller NVMe i en VM | ProxMenux-dokumentation",
+    "description": "PCI-passthrough av en lagringsstyrenhet (SATA/SAS-HBA) eller NVMe-enhet till en Proxmox-VM med ProxMenux. Hanterar aktivering av IOMMU, konfliktkontroll och tilldelning med qm set --hostpci.",
+    "ogTitle": "Lägg till styrenhet eller NVMe i en VM | ProxMenux-dokumentation",
+    "ogDescription": "Tilldela en hel SATA/SAS-HBA eller NVMe-enhet till en Proxmox-VM. ProxMenux hanterar IOMMU, konfliktkontroll och hostpci-tilldelningen."
+  },
+  "header": {
+    "title": "Lägg till styrenhet eller NVMe i en VM",
+    "description": "Tilldela en hel SATA/SAS-värdbussadapter (HBA) eller NVMe-enhet till en Proxmox-VM via PCI-passthrough. ProxMenux kontrollerar IOMMU och aktiverar det med ditt samtycke, listar lämpliga enheter, filtrerar bort konflikter och konfigurerar tilldelningen med qm set --hostpci.",
+    "section": "Diskhanterare · VM"
+  },
+  "intro": {
+    "title": "Vad detta gör (och inte) gör",
+    "body": "Detta är <strong>passthrough på enhetsnivå</strong>: PCIe-kortet lämnar värdkärnans kontroll och binds till <code>vfio-pci</code>. VM:n ser själva styrenheten i stället för enskilt vidarebefordrade diskar och laddar sin egen drivrutin för modellen. Alla anslutna diskar följer automatiskt med, med inbyggda SMART-data, fullständiga firmwarefunktioner och utan ett Proxmox-lager emellan."
+  },
+  "howRuns": {
+    "heading": "Så körs skriptet",
+    "body": "Flödet har två faser med tydlig separation mellan \"samla information, kontrollera IOMMU och lista kandidater\" och \"faktiskt fästa PCI-enheten\". Fram till den slutliga bekräftelsen skrivs ingenting till VM-konfig."
+  },
+  "iommu": {
+    "heading": "IOMMU-grupper – varför hela kortet lämnar samtidigt",
+    "body": "Isoleringsgränsen för PCI-passthrough är <strong>IOMMU-gruppen</strong>, den minsta enhet som processorns IOMMU kan isolera. Enheter i samma grupp kan inte isoleras från varandra. Om en SATA-styrenhet delar grupp med en USB-styrenhet kan SATA-passthrough kräva att även USB frigörs från värden, eller hindra passthrough. Alla enheter i gruppen tilldelas inte automatiskt till VM:n.",
+    "outro": "ProxMenux visar IOMMU-gruppen bredvid varje enhet och varnar dig när en grupp bär mer än bara den kontroller du vill ha. Du kan fortfarande fortsätta om de extra enheterna i gruppen är acceptabla (alla diskkontroller, till exempel), eller backa ut om de inte är det."
+  },
+  "prereqs": {
+    "heading": "Förutsättningar",
+    "items": [
+      "<strong>Processor och moderkort stöder</strong> VT-d (Intel) eller AMD-Vi, och funktionen är aktiverad i firmware (BIOS/UEFI). ProxMenux kan aktivera kärnans inställning men inte ändra firmwareinställningen.",
+      "Mål-VM:n är <strong>avstängd</strong> innan PCI-enheter ansluts.",
+      "Controller/NVMe <strong> är inte den som innehar Proxmox root-filsystem</strong>. Skriptet döljer allt som används av värden.",
+      "Gästoperativsystemet har drivrutiner för styrenhetens modell. Linux stöder praktiskt taget alla HBA:er direkt; Windows behöver tillverkarens drivrutin installerad <em>innan</em> du startar med styrenheten ansluten."
+    ],
+    "warnTitle": "Live migration är inte möjligt",
+    "warnBody": "En VM med PCI-passthrough är knuten till noden där kortet sitter fysiskt. Livemigrering mellan noder misslyckas. Planera säkerhetskopiering och replikering därefter."
+  },
+  "steps": {
+    "heading": "Steg-för-steg",
+    "stepLabel": "Steg",
+    "list": [
+      {
+        "title": "Välj mål-VM",
+        "bodyRich": "ProxMenux läser <code>qm list</code> och visar alla VM:ar. Välj den som ska få styrenheten.",
+        "img": "/disk/nvme-passthrough/vm-selection.png",
+        "alt": "VM urvalsdialog",
+        "caption": "VM urvalsdialog"
+      },
+      {
+        "title": "IOMMU-kontroll",
+        "bodyRich": "Om IOMMU inte är aktiverat i kärnans kommandorad erbjuder ProxMenux att aktivera det. Skriptet redigerar <code>/etc/kernel/cmdline</code> för systemd-boot eller <code>/etc/default/grub</code> för GRUB och lägger till rätt parameter för din processor:",
+        "items": [
+          "<code>intel_iommu=on</code> för Intel CPU.",
+          "<code>amd_iommu=on</code> för AMD CPU."
+        ],
+        "outro": "En omstart krävs efter ändringen. Skriptet erbjuder omstart nu eller senare; passthrough kan inte fortsätta förrän kärnans nya kommandorad är aktiv.",
+        "img": "/disk/nvme-passthrough/iommu-warning.png",
+        "alt": "Dialogrutan IOMMU krävs",
+        "caption": "IOMMU krävs: erbjudande om aktivering och omstart"
+      },
+      {
+        "title": "Enhetsuppräkning",
+        "body": "ProxMenux listar varje lagringskontroll (SATA / SAS HBA) och varje NVMe-enhet på PCI-bussen. För varje enhet den visar:",
+        "items": [
+          "PCI-adress (<code>00:17.0</code>, <code>01:00.0</code>, ...).",
+          "Leverantör / enhetsbeskrivning.",
+          "IOMMU-grupp, med en ⚠-varning om gruppen delas med andra orelaterade enheter.",
+          "Diskarna som är anslutna till styrenheten, så att du vet vilka som följer med till VM:n."
+        ],
+        "img": "/disk/nvme-passthrough/device-list.png",
+        "alt": "Lista över styrenheter och NVMe-enheter",
+        "caption": "Lista över styrenheter och NVMe-enheter med information om IOMMU-grupper"
+      },
+      {
+        "title": "Konfliktdetektering",
+        "bodyRich": "Skriptet blockerar tydligt osäkra enheter: sådana som redan tilldelats en annan VM via <code>hostpci</code> i dess konfiguration, används av värden som styrenheten för rotdisken, eller ingår i en IOMMU-grupp vars övriga medlemmar inte kan identifieras säkert. Lämpliga enheter går att välja.",
+        "img": "/disk/nvme-passthrough/conflict-warning.png",
+        "alt": "Varning om upptäckt konflikt",
+        "caption": "Konfliktdetektering - enhet blockerad med anledning"
+      },
+      {
+        "title": "Anslut och slutför",
+        "bodyRich": "För varje vald enhet kör ProxMenux <code>qm set &lt;VMID&gt; --hostpciN &lt;pci-addr&gt;,pcie=1</code> och väljer nästa lediga <code>hostpci</code>-plats. Om IOMMU aktiverades under sessionen påminns du om att starta om värden innan VM:n startas.",
+        "img": "/disk/nvme-passthrough/assignment.png",
+        "alt": "Tilldelningssammanfattning",
+        "caption": "Tilldelningsöversikt: hostpciN-platser och anslutna PCI-adresser"
+      }
+    ]
+  },
+  "manual": {
+    "heading": "Manuell motsvarighet"
+  },
+  "troubleshoot": {
+    "heading": "Felsökning",
+    "noGroupsTitle": "IOMMU aktiverade men inga grupper under /sys/kernel/iommu_groups/",
+    "noGroupsBody": "En omstart krävs för att kärnans kommandorad ska börja gälla. Om grupperna fortfarande saknas efter omstart är VT-d/AMD-Vi troligen inaktiverat i firmware. Kontrollera BIOS/UEFI-inställningarna.",
+    "busyTitle": "VM:n startar inte: \"hostpciN: device busy\"",
+    "busyBody": "En annan process håller fortfarande PCI-enheten upptagen. Vanliga orsaker är en VM som kraschat utan att frigöra den eller att värdkärnan tog tillbaka den vid senaste starten. Kör <code>lspci -nnk -s &lt;addr&gt;</code> för att se den bundna drivrutinen; den bör vara <code>vfio-pci</code>. En fullständig omstart av värden brukar lösa problemet.",
+    "noDisksTitle": "Gästen ser styrenheten men inte diskarna",
+    "noDisksBody": "Gästen saknar drivrutin för styrenhetens modell. Det är ovanligt i Linux men förekommer i Windows: installera tillverkarens drivrutin, exempelvis LSI/Broadcom för äldre SAS-HBA:er, när kortet inte är tilldelat och starta sedan om med kortet tilldelat.",
+    "sharedTitle": "IOMMU-gruppen innehåller en orelaterad enhet",
+    "sharedBody": "Alternativ: (a) flytta kortet till en annan PCIe slot för att ändra sin grupp, (b) aktivera <em>ACS override</em> i kärnan för att dela grupper (säkerhet avvägning - forskning innan applicering), eller (c) välja ett annat kort i en renare grupp."
+  },
+  "related": {
+    "heading": "Relaterat",
+    "items": [
+      {
+        "href": "/docs/disk-manager/import-disk-vm",
+        "label": "Importera disk till VM",
+        "tail": " — alternativ: anslut en fysisk disk via Proxmox utan fullständig PCIe-passthrough."
+      },
+      {
+        "href": "/docs/hardware/gpu-vm-passthrough",
+        "label": "Lägg till GPU till VM (Passthrough)",
+        "tail": " - samma IOMMU / VFIO-koncept som tillämpas på en GPU."
+      },
+      {
+        "href": "/docs/help-info/gpu-commands",
+        "label": "GPU Passthrough kommandon",
+        "tail": " - IOMMU-verifieringskommandon gäller också för styrenhet / NVMe-genomgång."
+      },
+      {
+        "href": "/docs/disk-manager",
+        "label": "Disk Manager översikt",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sv/docs/disk-manager/format-disk.json b/web/messages/sv/docs/disk-manager/format-disk.json
new file mode 100644
index 00000000..760c04cc
--- /dev/null
+++ b/web/messages/sv/docs/disk-manager/format-disk.json
@@ -0,0 +1,142 @@
+{
+  "meta": {
+    "title": "Formatera eller radera en fysisk disk | ProxMenux-dokumentation",
+    "description": "Radera och formatera fysiska diskar på Proxmox VE med ProxMenux. Fyra driftlägen, strikta filter som blockerar systemdiskar, monterade eller använda diskar och dubbel bekräftelse med inmatning av hela sökvägen.",
+    "ogTitle": "Formatera eller radera en fysisk disk | ProxMenux-dokumentation",
+    "ogDescription": "Radera eller formatera en fysisk disk på Proxmox. Säkerhetsfilter, fyra driftlägen och dubbel bekräftelse."
+  },
+  "header": {
+    "title": "Formatera / radera fysisk disk",
+    "description": "Radera eller formatera en fysisk disk på Proxmox-värden. ProxMenux visar bara helt lediga diskar som inte används av systemet, inte refereras av gäster och inte har några monteringar. Innan data förstörs krävs dubbel bekräftelse: ja/nej och inmatning av hela disksökvägen.",
+    "section": "Diskhanterare · Verktyg"
+  },
+  "danger": {
+    "title": "Destruktivt verktyg",
+    "body": "Varje operation här skriver till disken. Det finns ingen undo. ProxMenux tillämpar strikta säkerhetsfilter och bekräftelser, men ansvaret för att välja rätt disk är din. Läs diskvägen högt två gånger innan du skriver den."
+  },
+  "howRuns": {
+    "heading": "Så körs skriptet",
+    "body": "Flödet har två faser med tre säkerhetskontroller emellan. I fas 1 samlas diskval, driftläge och filsystemsuppgifter in. Ingenting skrivs förrän fas 2 klarar en sista förnyad kontroll direkt före körningen."
+  },
+  "visibility": {
+    "heading": "Synlighetsregler",
+    "intro": "Innan menyn ens visas filtrerar ProxMenux disklistan. Endast kandidater som är bevisligen säkra visas:",
+    "items": [
+      "<strong>Visas</strong>: diskar som <em>inte</em> används av värden (rotpool, swap, monteringar, aktiv ZFS/LVM/RAID) och <em>inte</em> refereras i någon VM/LXC-konfiguration, oavsett om gästen körs eller är stoppad.",
+      "<strong>Döljs</strong>: värd- och systemdiskar.",
+      "<strong>Döljs</strong>: diskar som refereras i en VM/LXC-konfiguration."
+    ],
+    "safetyTitle": "Säkerhet vid bekräftelse och utförande",
+    "safetyItems": [
+      "Diskar med gamla eller aktiva metadata visar detaljerade varningar <em>innan</em> du bekräftar.",
+      "Diskar som används av en <strong>körande</strong> VM <strong>blockeras helt</strong> vid bekräftelsen.",
+      "Diskar med monterade partitioner <strong>blockeras helt</strong> vid körningen. En ny kontroll görs direkt innan något skrivs.",
+      "Två bekräftelser krävs alltid: en <em>ja/nej</em>-dialog och exakt inmatning av hela disksökvägen."
+    ]
+  },
+  "modes": {
+    "heading": "Operationslägen",
+    "intro": "Efter att ha valt en disk väljer du en av fyra lägen. De skiljer sig åt i vad de förstör och vad de lämnar efter sig:",
+    "headerMode": "Läge",
+    "headerPart": "Partitionstabell",
+    "headerData": "Data",
+    "headerUseCase": "Användningsfall",
+    "rows": [
+      {
+        "mode": "1. Radera allt",
+        "part": "Förstörd",
+        "data": "Signaturer raderade",
+        "useCase": "Tar bort partitionstabellen och metadata för filsystem och RAID, nollställer de första och sista 16 MiB och kör TRIM på hela disken om enheten stöder discard. Övriga data skrivs inte över och kan fortfarande gå att återställa på en HDD; detta är ingen säker radering."
+      },
+      {
+        "mode": "2. Ta bort FS-etiketter",
+        "part": "Bevarad",
+        "data": "Bevarad",
+        "useCase": "Tar bort gamla ZFS/LVM/RAID-signaturer så att disken inte tas i bruk automatiskt. Användardata skrivs inte över i sin helhet, men borttagna signaturer kan göra dem oåtkomliga."
+      },
+      {
+        "mode": "3. Nollställ alla data",
+        "part": "Bevarad",
+        "data": "Förstörda (överskrivna med nollor)",
+        "useCase": "Skriv över befintliga partitioner med nollor och behåll partitionstabellen. Oallokerat utrymme och SSD-reservområden omfattas inte; detta garanterar inte fullständig datasanering av enheten."
+      },
+      {
+        "mode": "4. Fullständigt format",
+        "part": "Ny GPT",
+        "data": "Förstörd",
+        "useCase": "Redo att använda disk med en enda ny partition och ett nytt filsystem."
+      }
+    ],
+    "fullFormatOutro": "<strong>Fullständig formatering</strong> fortsätter med två ytterligare dialogrutor:",
+    "fullFormatItems": [
+      "<strong>Filsystem</strong>: <code>ext4</code>, <code>xfs</code>, <code>exfat</code> (portabelt) eller <code>btrfs</code>. Om verktyg som <code>mkfs.btrfs</code> saknas avbryts åtgärden med ett tydligt meddelande.",
+      "<strong>Etikett</strong>: valfri filsystemetikett för identifiering."
+    ]
+  },
+  "steps": {
+    "heading": "Steg-för-steg",
+    "stepLabel": "Steg",
+    "list": [
+      {
+        "title": "Välj en ledig disk",
+        "body": "ProxMenux listar de diskar som klarar filtren ovan. Diskar märkta med ⚠ har gamla metadata som visas i detalj så att du vet vad du är på väg att skriva över."
+      },
+      {
+        "title": "Välj ett operationsläge",
+        "bodyRich": "Välj <strong>Radera allt</strong>, <strong>Ta bort FS-etiketter</strong>, <strong>Nollställ alla data</strong> eller <strong>Fullständig formatering</strong> enligt tabellen ovan."
+      },
+      {
+        "title": "(Endast fullständig formatering) Välj filsystem och etikett",
+        "body": "ext4 / xfs / exfat / btrfs, plus en valfri etikett."
+      },
+      {
+        "title": "Bekräfta två gånger",
+        "bodyRich": "ProxMenux visar en sammanfattning av åtgärden. Bekräfta i ja/nej-dialogen och <strong>skriv hela disksökvägen</strong> exakt som den visas, exempelvis <code>/dev/sdc</code>. All annan inmatning avbryter."
+      },
+      {
+        "title": "Re-validering och utförande",
+        "body": "Direkt före skrivningen kontrollerar skriptet diskens tillstånd igen. Om en partition har monterats eller en VM startats under tiden avbryts körningen. Annars utförs den valda åtgärden och en sammanfattning visas efteråt."
+      }
+    ]
+  },
+  "manual": {
+    "heading": "Manuella motsvarigheter",
+    "body": "Om du föredrar att köra motsvarande kommandon för hand:"
+  },
+  "troubleshoot": {
+    "notListedTitle": "Disk som inte anges i menyn",
+    "notListedBody": "Det filtrerades för säkerhet. Vanliga skäl: det är monterat (även på <code>/mnt/tmp</code>), det är en aktiv ZFS / LVM / RAID-medlem, det refereras av en VM eller LXC config, eller det är din Proxmox root disk. Kör <code>lsblk -f</code> och <code>cat /proc/mdstat</code> på värden för att förstå varför.",
+    "busyTitle": "\"Disk may be busy\" / avmontering misslyckades",
+    "busyBody": "Något håller fortfarande en öppen fil på en partition av den disken - oftast en container eller ett skal vars cwd är inuti en monteringspunkt. Identifiera det med <code>lsof | grep /dev/sdX</code> eller <code>fuser -vm /dev/sdX1</code>, stoppa det och sedan köra verktyget igen."
+  },
+  "related": {
+    "heading": "Relaterat",
+    "items": [
+      {
+        "href": "/docs/disk-manager/smart-disk-test",
+        "label": "SMART-status och disktest",
+        "tail": " — Kontrollera en disk före / efter att ha torkat för att bekräfta att den är frisk."
+      },
+      {
+        "href": "/docs/disk-manager/import-disk-vm",
+        "label": "Importera disk till VM",
+        "tail": " — passera en nyformaterad disk till en VM."
+      },
+      {
+        "href": "/docs/storage-share/host-local-disk",
+        "label": "Lägg till lokal disk som Proxmox lagring",
+        "tail": " - registrera en torkad disk som en Proxmox lagringspool."
+      },
+      {
+        "href": "/docs/help-info/storage-commands",
+        "label": "Kommandon för lagring och diskar",
+        "tail": " — referens för lsblk, blkid och parted."
+      },
+      {
+        "href": "/docs/disk-manager",
+        "label": "Disk Manager översikt",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sv/docs/disk-manager/import-disk-image-vm.json b/web/messages/sv/docs/disk-manager/import-disk-image-vm.json
new file mode 100644
index 00000000..d0674b63
--- /dev/null
+++ b/web/messages/sv/docs/disk-manager/import-disk-image-vm.json
@@ -0,0 +1,110 @@
+{
+  "meta": {
+    "title": "Importera diskbild till VM | ProxMenux Dokumentation",
+    "description": "Importera en disk bildfil (.img / .qcow2 / .vmdk / .raw) till en befintlig Proxmox VM med ProxMenux. Per-image gränssnitt, SSD emulering och startbar flagga, med qm importdisk under huven.",
+    "ogTitle": "Importera diskbild till VM | ProxMenux Dokumentation",
+    "ogDescription": "Importera .img / .qcow2 / .vmdk / .raw-diskavbildningar till en befintlig VM med ProxMenux. Använder qm importdisk i bakgrunden."
+  },
+  "header": {
+    "title": "Importera diskavbildning till virtuell dator",
+    "description": "Importera en diskbildfil (.img, .qcow2, .vmdk eller .raw) till en befintlig Proxmox VM. ProxMenux samlar varje beslut up-front - mål VM, Proxmox lagring, källkatalog, gränssnitt, SSD emulering, startorder - och sedan kör qm importdisk för varje vald avbildning.",
+    "section": "Diskhanterare · VM"
+  },
+  "intro": {
+    "title": "Vad detta gör",
+    "body": "Till skillnad från <em>Importera disk till VM</em>, som ansluter en fysisk disk direkt, använder detta flöde en <strong>fil</strong> på värden: exporterad från en annan hypervisor, nedladdad som molnavbildning eller extraherad ur en säkerhetskopia. Den omvandlas till en Proxmox-VM-disk på vald lagring. Originalfilen bevaras; ProxMenux kopierar den utan att flytta den."
+  },
+  "howRuns": {
+    "heading": "Så körs skriptet",
+    "body": "Flödet har två faser. Fas 1 samlar alla val via dialogrutor: VM, lagring, källkatalog, avbildningar och alternativ för varje avbildning. Fas 2 kör <code>qm importdisk</code> för varje vald avbildning. Innan fas 2 börjar kopieras ingenting och VM-konfigurationen ändras inte."
+  },
+  "prereqs": {
+    "heading": "Förutsättningar",
+    "items": [
+      "Minst en VM är definierad på värden. Mål-VM:n bör vara <strong>avstängd</strong>.",
+      "Minst en diskavbildningsfil i ett format som stöds finns i källkatalogen: <code>.img</code>, <code>.qcow2</code>, <code>.vmdk</code>, <code>.raw</code>.",
+      "Tillräckligt med ledigt utrymme på målet Proxmox lagring för att hålla varje importerad disk.",
+      "ProxMenux letar efter avbildningar i <code>/var/lib/vz/template/iso</code> som standard. Du kan peka det på någon annan katalog på värden när den frågar."
+    ]
+  },
+  "steps": {
+    "heading": "Steg-för-steg",
+    "stepLabel": "Steg",
+    "list": [
+      {
+        "title": "Välj mål-VM",
+        "bodyRich": "ProxMenux läser <code>qm list</code> och visar alla VM:ar. Välj den som ska få de importerade diskarna."
+      },
+      {
+        "title": "Välj Proxmox lagring",
+        "bodyRich": "Listan innehåller varje lagring som har <code>images</code>-innehållstyp aktiverad. Om det bara finns en kandidat är det automatiskt valt och dialogen hoppas över."
+      },
+      {
+        "title": "Välj källkatalogen",
+        "bodyRich": "Välj standardkatalogen (<code>/var/lib/vz/template/iso</code>) eller skriv en anpassad väg - vanligtvis där du laddade ner / laddade upp avbildningen. Skriptet avvisar vägar som inte existerar."
+      },
+      {
+        "title": "Välj en eller flera avbildningar",
+        "bodyRich": "Katalogen skannas för <code>.img</code> / <code>.qcow2</code> / <code>.vmdk</code> / <code>.raw</code> filer. Du kan välja flera samtidigt; var och en kommer att gå igenom alternativen per avbildning i nästa steg."
+      },
+      {
+        "title": "Alternativ per avbildning",
+        "intro": "För varje vald avbildning frågar ProxMenux:",
+        "items": [
+          "<strong>Interface</strong> - <code>scsi</code> (standard), <code>virtio</code>, <code>sata</code> eller <code>ide</code>. Matchar hur gästen kommer att se skivan.",
+          "<strong>SSD-emulering</strong>: erbjuds bara för andra gränssnitt än VirtIO. Lägger till <code>ssd=1</code> så att gästen känner igen en SSD. Stöd för discard/TRIM måste konfigureras separat.",
+          "<strong>Startbar</strong>: om du väljer ja lägger ProxMenux disken först i VM:ns startordning."
+        ]
+      },
+      {
+        "title": "Importera och anslut",
+        "bodyRich": "ProxMenux kör <code>qm importdisk</code> för varje avbildning och konverterar formatet vid behov. Disken ansluts till nästa lediga plats (<code>scsiN</code>, <code>sataN</code>, …) med valda alternativ. Om någon disk markerats som startbar uppdateras startordningen. Förloppet visas i terminalen."
+      }
+    ]
+  },
+  "manual": {
+    "heading": "Manuell motsvarighet",
+    "body": "Import av en enda avbildning motsvarar tre <code>qm</code>-kommandon:",
+    "warnTitle": "Konvertering av avbildningsformat",
+    "warnBody": "När mållagringen inte kan hålla källformatet inbyggt (till exempel kan LVM-lagring inte hålla <code>.qcow2</code>), konverterar <code>qm importdisk</code> avbildningen transparent. Detta kan ta flera minuter för multi-GB avbildningar; planera därefter och inte avbryta manuset."
+  },
+  "troubleshoot": {
+    "heading": "Felsökning",
+    "noImagesTitle": "\"Inga kompatibla diskbilder hittades\"",
+    "noImagesBody": "Skriptet hittade ingen <code>.img</code>, <code>.qcow2</code>, <code>.vmdk</code> eller <code>.raw</code>-fil. Kontrollera filändelsens stora och små bokstäver, att filen ligger direkt i vald katalog (underkataloger genomsöks inte) och att root får läsa den.",
+    "slowTitle": "Importen är långsam",
+    "slowBody": "Konverteringar mellan VMDK, QCOW2 och raw kan begränsas av CPU och in-/utmatning. Hastigheten beror på läsning från källan, skrivning till målet och eventuell dekomprimering. Välj helst raw- eller qcow2-källor när det går.",
+    "uefiTitle": "Den importerade disken startar i UEFI-skalet",
+    "uefiBody": "Avbildningen skapades för äldre BIOS-läge (SeaBIOS) men VM:n använder OVMF, eller tvärtom. Ändra VM:ns BIOS i Proxmox så att det matchar avbildningen, eller bygg om avbildningen i rätt läge före importen."
+  },
+  "related": {
+    "heading": "Relaterat",
+    "items": [
+      {
+        "href": "/docs/disk-manager/import-disk-vm",
+        "label": "Importera disk till VM",
+        "tail": " — samma flöde för fysiska diskar (passthrough)."
+      },
+      {
+        "href": "/docs/utils/import-vm",
+        "label": "Importera VM från OVA / OVF",
+        "tail": " — När du har ett komplett VM-paket, inte bara en skivbild."
+      },
+      {
+        "href": "/docs/utils/UUp-Dump-ISO-Creator",
+        "label": "UUP Dump ISO-skapare",
+        "tail": " — generera en Windows ISO om du behöver en för en ny installation."
+      },
+      {
+        "href": "/docs/help-info/storage-commands",
+        "label": "Kommandon för lagring och diskar",
+        "tail": " — referens för qm importdisk och qemu-img convert."
+      },
+      {
+        "href": "/docs/disk-manager",
+        "label": "Disk Manager översikt",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sv/docs/disk-manager/import-disk-lxc.json b/web/messages/sv/docs/disk-manager/import-disk-lxc.json
new file mode 100644
index 00000000..07347a3b
--- /dev/null
+++ b/web/messages/sv/docs/disk-manager/import-disk-lxc.json
@@ -0,0 +1,115 @@
+{
+  "meta": {
+    "title": "Importera disk till LXC | ProxMenux Dokumentation",
+    "description": "Bifoga en fysisk disk till en befintlig LXC-behållare på Proxmox VE med ProxMenux. Hantera filsystemdetektering / formatering, monteringspunkt, oprivilegierade → privilegierad omvandling och ihållande enhetsvägar.",
+    "ogTitle": "Importera disk till LXC | ProxMenux Dokumentation",
+    "ogDescription": "Bifoga en fysisk disk till en befintlig LXC-behållare. Hantera filsystem, monteringspunkt och oprivilegierad → privilegierad omvandling."
+  },
+  "header": {
+    "title": "Importera disk till LXC",
+    "description": "Anslut en fysisk disk till en befintlig LXC-container på Proxmox-värden. ProxMenux hittar lediga diskar, erbjuder formatering med ett filsystem som stöds och ansluter partitionen till en monteringspunkt i containern via beständiga enhetssökvägar.",
+    "section": "Diskhanterare · LXC"
+  },
+  "intro": {
+    "title": "VM passthrough vs LXC genomgång",
+    "body": "Den här LXC-passthroughen ger <strong>ingen rå blockenhet</strong>. Containern får en <em>monteringspunkt</em>, alltså en katalog på den partition du väljer på värden. Till skillnad från en VM använder gästen värdens kärna, så filsystemet (ext4/xfs/btrfs) läses och hanteras av Proxmox-värden och görs sedan tillgängligt i containern."
+  },
+  "howRuns": {
+    "heading": "Så körs skriptet",
+    "body": "Flödet har två faser med tydlig åtskillnad mellan \"samla information och beslut\" och \"faktiskt ändra containerkonfig\". Fram till den slutliga bekräftelsen monteras ingenting i CT.",
+    "summary": "ProxMenux filtrerar bort rotdisken, monterade diskar och diskar som refereras i VM/LXC-konfigurationer. Aktiva ZFS/LVM/RAID-medlemmar döljs; gamla signaturer märks med ⚠ så att de kan raderas före formatering."
+  },
+  "prereqs": {
+    "heading": "Förutsättningar",
+    "items": [
+      "Minst en LXC-container definierad på värden.",
+      "Containern är <strong>privilegierad</strong>, eller så accepterar du skriptets erbjudande att konvertera den.",
+      "Minst en fysisk disk som inte används av värden eller någon annan gäst."
+    ],
+    "warnTitle": "Privilegierad container krävs",
+    "warnBody": "Det här skriptet kräver en <strong>privilegierad</strong> container för direkt diskanslutning. Om det hittar <code>unprivileged: 1</code> erbjuds ändring av <code>/etc/pve/lxc/&lt;CTID&gt;.conf</code> på plats. Det ändrar säkerhetsmodellen men mappar inte om befintliga filägare. Säkerhetskopiera containern och kontrollera ägarskapet innan du accepterar, eller återskapa den som privilegierad."
+  },
+  "steps": {
+    "heading": "Steg-för-steg",
+    "stepLabel": "Steg",
+    "list": [
+      {
+        "title": "Välj målcontainer",
+        "img": "/disk/select-container.png",
+        "caption": "Meny för containerval",
+        "bodyRich": "ProxMenux listar varje LXC-container på värden (<code>pct list</code>). Välj den som får disken. Om containern är oprivilegierad erbjuds du att konvertera den nu."
+      },
+      {
+        "title": "Välj den fysiska disken",
+        "img": "/disk/disk-selection-ct.png",
+        "caption": "Lediga diskar på värden, med ⚠ för gamla metadata",
+        "bodyRich": "Bara säkra kandidater visas. Till skillnad från VM-flödet ansluter skriptet <strong>en disk per körning</strong>. Kör det igen för varje ytterligare disk."
+      },
+      {
+        "title": "Formatera eller återanvänd",
+        "intro": "Skriptet inspekterar disken:",
+        "items": [
+          "Om disken redan har ett filsystem som stöds (ext4/xfs/btrfs) kan det återanvändas som det är; befintliga filer bevaras.",
+          "Om disken saknar ett filsystem som stöds erbjuds formatering. Välj ext4/xfs/btrfs."
+        ]
+      },
+      {
+        "title": "Välj monteringspunkten",
+        "bodyRich": "Ange sökvägen där containern ska se disken, exempelvis <code>/mnt/data</code> eller <code>/mnt/disk_passthrough</code>. Det är sökvägen <em>inne i</em> containern; värden ser redan partitionen under <code>/dev/disk/by-id/…</code>."
+      },
+      {
+        "title": "Anslut och verifiera",
+        "img": "/disk/assignment-ct.png",
+        "caption": "Tilldelning till CT",
+        "bodyRich": "ProxMenux lägger till en ny <code>mpN:</code>-post i containerkonfigurationen, hoppar över upptagna index och läser konfigurationen igen för att bekräfta. Om containern körs tillämpas monteringen direkt; annars vid nästa start.",
+        "extraImg": "/disk/result-point.png",
+        "extraAlt": "Monteringspunkten skapades",
+        "extraCaption": "Monteringspunkt skapad och verifierad"
+      }
+    ]
+  },
+  "manual": {
+    "heading": "Manuell motsvarighet",
+    "body": "Skriptet använder <code>pct set</code>. Ett direkt anrop för en enda disk ser ut så här:"
+  },
+  "important": {
+    "heading": "Viktiga överväganden",
+    "items": [
+      "<strong>En disk per körning</strong>. Kör skriptet igen för varje ytterligare disk.",
+      "Anslut <strong>inte</strong> samma partition till flera containrar som kan montera den samtidigt; samtidiga skrivningar skadar filsystemet.",
+      "<strong>Gamla metadata</strong> (RAID/ZFS/LVM-signaturer) måste rensas manuellt innan skriptet tillåter formatering, annars vägrar <code>mkfs</code> att skriva över. Använd <wipeLink>Formatera eller radera fysisk disk</wipeLink>."
+    ]
+  },
+  "troubleshoot": {
+    "heading": "Felsökning",
+    "unprivTitle": "\"Kan inte fortsätta med en oprivilegierad container\"",
+    "unprivBody": "Du avböjde konverteringen, så skriptet avslutades utan att ändra något. Kör det igen och godkänn för att fortsätta: skriptet stoppar containern, säkerhetskopierar konfigurationen till <code>/etc/pve/lxc/&lt;CTID&gt;.conf.bak</code> och ersätter <code>unprivileged: 1</code> med <code>unprivileged: 0</code>. Den ändringen omvandlar inte i sig UID/GID-ägarskapet för befintliga filer, så säkerhetskopiera containern och rätta ägarskapet först, eller återställ eller återskapa containern som privilegierad.",
+    "permsTitle": "Behörigheter inne i containern är fel",
+    "permsBody": "Befintliga filägare behålls när en partition monteras i en privilegierad container; ett nyformaterat filsystem ägs ofta av <code>root:root</code>. Om tjänsten körs som en annan användare, exempelvis <code>www-data</code> för Nextcloud, kontrollera UID/GID och justera berörda filer med <code>chown</code>/<code>chmod</code>. Ändringarna påverkar även den underliggande disken."
+  },
+  "related": {
+    "heading": "Relaterat",
+    "items": [
+      {
+        "href": "/docs/disk-manager/import-disk-vm",
+        "label": "Importera disk till VM",
+        "tail": " - motsvarande flöde för VM."
+      },
+      {
+        "href": "/docs/storage-share/lxc-mount-points",
+        "label": "LXC-monteringspunkter (värd ↔ CT)",
+        "tail": " - dela värdkataloger med en CT istället för att fästa en hel disk."
+      },
+      {
+        "href": "/docs/help-info/vm-ct-commands",
+        "label": "Kommandon för VM- och CT-hantering",
+        "tail": " — pct config / push / pull referens."
+      },
+      {
+        "href": "/docs/disk-manager",
+        "label": "Disk Manager översikt",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sv/docs/disk-manager/import-disk-vm.json b/web/messages/sv/docs/disk-manager/import-disk-vm.json
new file mode 100644
index 00000000..3c05c8a0
--- /dev/null
+++ b/web/messages/sv/docs/disk-manager/import-disk-vm.json
@@ -0,0 +1,113 @@
+{
+  "meta": {
+    "title": "Importera disk till VM | ProxMenux Dokumentation",
+    "description": "Bifoga en fysisk disk till en befintlig Proxmox VM med ProxMenux. Säker diskdetektering (exkluderar system, monterad, in-use, ZFS / RAID / LVM), ihållande /dev/disk/by-id vägar och SATA / SCSI / VirtIO / IDE gränssnitt.",
+    "ogTitle": "Importera disk till VM | ProxMenux Dokumentation",
+    "ogDescription": "Bifoga en fysisk disk till en befintlig Proxmox VM. Använder ihållande /dev/disk/by-id vägar och stöder SATA / SCSI / VirtIO / IDE."
+  },
+  "header": {
+    "title": "Importera disk till VM",
+    "description": "Anslut en fysisk disk på Proxmox-värden till en befintlig virtuell maskin. ProxMenux hittar lediga diskar, låter dig välja mål-VM och busstyp (SATA/SCSI/VirtIO/IDE) och använder beständiga /dev/disk/by-id-sökvägar. Tilldelningen består då efter omstarter och ändrad enhetsordning.",
+    "section": "Diskhanterare · VM"
+  },
+  "intro": {
+    "title": "Vad detta gör",
+    "body": "En fysisk disk ansluts som underlag för ett virtuellt diskgränssnitt. Gästen får inte automatiskt inbyggda SMART-data eller den fysiska styrenhetens funktioner; använd PCI-passthrough av styrenheten om dessa behövs. Disken ansluts via sin sökväg <code>/dev/disk/by-id/…</code> när en sådan finns, så ändrad enhetsordning vid start bryter inte tilldelningen; annars används <code>/dev/sdX</code>."
+  },
+  "howRuns": {
+    "heading": "Så körs skriptet",
+    "body": "Flödet har två faser med tydlig åtskillnad mellan \"samla information och beslut\" och \"faktiskt fästa diskar till VM\". Fram till den slutliga bekräftelsen är VM-konfig orörd.",
+    "summary": "ProxMenux filtrerar bort osäkra kandidater: rotdisken, diskar monterade på värden, aktiva ZFS/LVM/RAID-medlemmar och diskar som refereras i VM/LXC-konfigurationer. Diskar med <em>gamla</em>, oanvända ZFS/RAID/LVM-signaturer märks med ⚠ men blockeras inte."
+  },
+  "prereqs": {
+    "heading": "Förutsättningar",
+    "items": [
+      "Minst en VM definierad på värden (skriptet skickar direkt till <code>qm list</code>).",
+      "<strong>Mål-VM:n är avstängd</strong>. Om den körs avbryts skriptet med ett meddelande; tillägg av diskar under drift ingår inte i det här flödet.",
+      "Minst en fysisk disk på värden som inte används av värden eller någon annan gäst."
+    ]
+  },
+  "steps": {
+    "heading": "Steg-för-steg",
+    "stepLabel": "Steg",
+    "list": [
+      {
+        "title": "Välj mål-VM",
+        "bodyRich": "ProxMenux listar alla VM:ar på värden via <code>qm list</code>. Välj den som ska få disken. Om den körs avbryts skriptet och ber dig stänga av den först."
+      },
+      {
+        "title": "Välj fysiska diskar att ansluta",
+        "img": "/disk/disk-selection.png",
+        "caption": "Lediga diskar på värden, med ⚠ för gamla metadata",
+        "body": "Skriptet granskar värdens diskar och visar bara sådana som kan anslutas utan konflikt. Du kan välja flera samtidigt. Diskar med gamla ZFS/LVM/RAID-signaturer visas fortfarande med ⚠ för att ange att signaturerna behöver raderas innan gästen formaterar dem."
+      },
+      {
+        "title": "Välj bussgränssnittet",
+        "img": "/disk/disk-assigment.png",
+        "caption": "Val av bussgränssnitt",
+        "intro": "Välj hur gästen ska se skivan:",
+        "items": [
+          "<strong>SCSI</strong> moderna standard för Linux och Windows med VirtIOSCSI-drivrutiner installerade.",
+          "<strong>SATA</strong> bred kompatibilitet, fungerar ur lådan på praktiskt taget alla gäster.",
+          "<strong>VirtIO</strong>: effektiv paravirtualiserad blockenhet; kräver drivrutiner i gästen.",
+          "<strong>IDE</strong>: för äldre gäster som saknar ovanstående drivrutiner."
+        ]
+      },
+      {
+        "title": "Anslut och verifiera",
+        "bodyRich": "ProxMenux fäster varje vald disk med sin bästa <code>/dev/disk/by-id/</code>-väg, hoppar över slotindex som redan används i VM-konfig (<code>scsi0</code>, <code>sata0</code>, ...) och läser om konfigen för att bekräfta uppdraget. En sammanfattning trycks i slutet."
+      }
+    ]
+  },
+  "manual": {
+    "heading": "Manuell motsvarighet",
+    "body": "Manuset är en wrapper runt <code>qm set</code>. Det exakta kommandot för en enda disk ser ut så här:",
+    "migrationTitle": "Live migration är inte möjligt",
+    "migrationBody": "En VM med en direktansluten fysisk disk är <strong>knuten till värden som tillhandahåller disken</strong>. En annan nod saknar normalt både samma <code>/dev/disk/by-id/…</code>-sökväg och diskdata. Säkerhetskopiera och överför data separat, eller använd hanterade virtuella diskar på delad lagring eller med replikering som stöds. Utgå inte från att Proxmox lagringsreplikering omfattar enheten.",
+    "shareTitle": "Dela inte en fysisk disk mellan VM",
+    "shareBody": "Att fästa samma fysiska disk till två VM samtidigt kommer att korrumpera data på nästa skriv. ProxMenux upptäcker denna situation och blockerar den, men om du kringgår manuset (direkt <code>qm set</code>), se till att endast en gäst någonsin monterar disken."
+  },
+  "troubleshoot": {
+    "heading": "Felsökning",
+    "noDisksTitle": "Inga diskar tillgängliga för denna VM",
+    "noDisksIntro": "Manuset hittade skivor, men varje kandidat filtrerades ut. Vanliga skäl:",
+    "noDisksItems": [
+      "Varje återstående disk refereras redan i målet VM-konfig.",
+      "Varje återstående disk monteras på värden eller är en del av en aktiv ZFS / LVM / RAID.",
+      "Värden har bara rotskivan installerad."
+    ],
+    "noDisksOutro": "Kör <code>lsblk -f</code> på värden för att granska tillståndet för varje disk.",
+    "noVisibleTitle": "VM ser inte disken efter start",
+    "noVisibleBody": "Med <strong>SCSI</strong> eller <strong>VirtIO</strong> behöver gästen rätt drivrutin. Linux har den i kärnan; i Windows installerar du den från VirtIO-ISO:n (se <winLink>Skapa VM: Windows</winLink>). Att byta till SATA på VM:ns maskinvaruflik är ett snabbt test av diskens tilldelning."
+  },
+  "related": {
+    "heading": "Relaterat",
+    "items": [
+      {
+        "href": "/docs/disk-manager/import-disk-image-vm",
+        "label": "Importera diskavbildning till virtuell dator",
+        "tail": " — samma flöde för diskavbildningsfiler (qcow2 / vmdk / raw / img)."
+      },
+      {
+        "href": "/docs/disk-manager/import-disk-lxc",
+        "label": "Importera disk till LXC",
+        "tail": " - motsvarande flöde för LXC containrar."
+      },
+      {
+        "href": "/docs/disk-manager/add-controller-nvme-vm",
+        "label": "Lägg till styrenhet eller NVMe i en VM",
+        "tail": " — när du behöver fullständig PCIe/NVMe-passthrough i stället för diskanslutning."
+      },
+      {
+        "href": "/docs/help-info/storage-commands",
+        "label": "Kommandon för lagring och diskar",
+        "tail": " — referens för qm importdisk och relaterade skalkommandon."
+      },
+      {
+        "href": "/docs/disk-manager",
+        "label": "Disk Manager översikt",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sv/docs/disk-manager/index.json b/web/messages/sv/docs/disk-manager/index.json
new file mode 100644
index 00000000..b78eefe9
--- /dev/null
+++ b/web/messages/sv/docs/disk-manager/index.json
@@ -0,0 +1,135 @@
+{
+  "meta": {
+    "title": "Proxmox diskhanterare: VM/LXC, SMART-test och radering | ProxMenux",
+    "description": "Hantera fysiska diskar på en Proxmox VE-värd med ProxMenux: anslut diskar till VM eller LXC (qm set scsi/sata/virtio, pct mp), importera img/qcow2/vmdk/raw-avbildningar, tilldela hela HBA:er eller NVMe-styrenheter, radera med säkerhetskontroller och kör SMART-självtester.",
+    "ogTitle": "Proxmox diskhanterare: VM/LXC, SMART-test och radering",
+    "ogDescription": "Anslut diskar till VM/LXC, importera avbildningar, använd PCI-passthrough för styrenheter, radera med säkerhetskontroller och kör SMART-test på Proxmox VE.",
+    "twitterTitle": "Proxmox diskhanterare | ProxMenux",
+    "twitterDescription": "Anslut diskar till VM/LXC, importera avbildningar, PCI-passthrough, radering med säkerhetskontroller och SMART-test."
+  },
+  "header": {
+    "title": "Diskhanteraren",
+    "description": "Menyn Diskhanterare samlar ProxMenux-verktyg för värdens fysiska diskar: anslutning till VM och LXC, import av diskavbildningar, passthrough av en hel styrenhet eller NVMe-enhet, radering med säkerhetskontroller och SMART-test.",
+    "section": "Diskhanteraren"
+  },
+  "intro": {
+    "title": "Vad denna meny är för",
+    "body": "Verktygen arbetar med <strong>fysiska diskar som värden ser och avbildningsfiler lagrade på den</strong>. Menyn har tre grupper: <strong>VM</strong> (anslut diskar eller importera avbildningar), <strong>LXC</strong> (anslut diskar till containrar) och <strong>Verktyg</strong> (formatering och SMART-status). Anslutning och radering döljer eller blockerar systemdiskar och använda diskar; SMART-kontroller kan granska dem utan att radera dem."
+  },
+  "opening": {
+    "heading": "Öppna menyn",
+    "body": "Från ProxMenux huvudmenyn väljer du <strong>Disk Manager</strong>. Du kommer att se detta:",
+    "imageAlt": "Disk Manager-menyn med VM, LXC och Utilities block"
+  },
+  "groups": {
+    "heading": "Tre verktygsgrupper",
+    "intro": "Disk Manager-menyn är organiserad i tre grupper - <strong>VM</strong>, <strong>LXC</strong> och <strong>Utilities</strong>. Klicka på ett kort för att hoppa direkt till verktygen i den gruppen.",
+    "vmTitle": "VM",
+    "vmBody": "Verktyg för befintliga virtuella maskiner. VM:n måste vara avstängd; ProxMenux kontrollerar detta innan konfigurationen ändras.",
+    "vmItems": [
+      "Importera disk till VM",
+      "Importera diskavbildning till virtuell dator",
+      "Lägg till styrenhet eller NVMe i en VM"
+    ],
+    "lxcTitle": "LXC",
+    "lxcBody": "Verktyg för befintliga LXC-containrar. Skriptet kräver en privilegierad container och erbjuder att ändra flaggan vid behov. Läs först informationen om konvertering och filägarskap på verktygets sida.",
+    "lxcItems": [
+      "Importera disk till LXC"
+    ],
+    "utilitiesTitle": "Verktyg",
+    "utilitiesBody": "Värdsida verktyg som fungerar på diskarna själva, oberoende av någon VM eller container.",
+    "utilitiesItems": [
+      "Formatera / radera fysisk disk",
+      "SMART-status och disktest"
+    ]
+  },
+  "vm": {
+    "heading": "VM",
+    "intro": "Verktyg för befintliga virtuella maskiner. VM:n måste vara avstängd; ProxMenux kontrollerar detta innan konfigurationen ändras.",
+    "options": [
+      {
+        "icon": "HardDrive",
+        "href": "/docs/disk-manager/import-disk-vm",
+        "title": "Importera disk till VM",
+        "description": "Bifoga en otilldelad fysisk disk till en befintlig VM. Stöder SATA / SCSI / VirtIO / IDE, använder ihållande /dev/disk/by-id vägar."
+      },
+      {
+        "icon": "FileDown",
+        "href": "/docs/disk-manager/import-disk-image-vm",
+        "title": "Importera diskavbildning till virtuell dator",
+        "description": "Importera diskavbildningar (.img / .qcow2 / .vmdk / .raw) till en befintlig VM. Två faser med qm importdisk i bakgrunden."
+      },
+      {
+        "icon": "Cpu",
+        "href": "/docs/disk-manager/add-controller-nvme-vm",
+        "title": "Lägg till styrenhet eller NVMe i en VM",
+        "description": "PCI-passthrough av en hel SATA/SAS-HBA eller NVMe-enhet till en VM. Hanterar aktivering av IOMMU och konfliktkontroll."
+      }
+    ]
+  },
+  "lxc": {
+    "heading": "LXC",
+    "intro": "Verktyg för befintliga LXC-containrar. Skriptet kräver en privilegierad container och erbjuder att ändra flaggan vid behov. Läs först informationen om konvertering och filägarskap på verktygets sida.",
+    "options": [
+      {
+        "icon": "Boxes",
+        "href": "/docs/disk-manager/import-disk-lxc",
+        "title": "Importera disk till LXC",
+        "description": "Bifoga en otilldelad fysisk disk till en befintlig LXC-behållare som fästpunkt. Hantera filsystemdetektering / format och privilegierad omvandling."
+      }
+    ]
+  },
+  "utilities": {
+    "heading": "Verktyg",
+    "intro": "Värdsida verktyg som fungerar på diskarna själva, oberoende av någon VM eller container.",
+    "options": [
+      {
+        "icon": "Eraser",
+        "href": "/docs/disk-manager/format-disk",
+        "title": "Formatera eller radera fysisk disk (med säkerhetskontroller)",
+        "description": "Radera diskar med strikta säkerhetskontroller: bara helt lediga diskar visas och dubbel bekräftelse krävs alltid."
+      },
+      {
+        "icon": "Activity",
+        "href": "/docs/disk-manager/smart-disk-test",
+        "title": "SMART-status och disktest",
+        "description": "Kör SMART hälsokontroller och kort / långa självtester på SATA, SAS och NVMe-enheter. Exporterar JSON för monitorn."
+      }
+    ]
+  },
+  "safety": {
+    "title": "Säkerhetsregler för diskanslutning och radering",
+    "intro": "Anslutning och radering filtrerar bort enheter som kan skada värden:",
+    "items": [
+      "<strong>Systemdisken</strong>, rotpoolen, swap och aktiva ZFS/LVM/RAID-medlemmar döljs alltid.",
+      "Diskar som är <strong>monterade</strong> någonstans på värden döljs eller blockeras vid körningen.",
+      "Diskar som <strong>refereras av en körande VM eller LXC</strong> kan inte tilldelas om eller raderas.",
+      "Åtgärder som ändrar värdens tillstånd, exempelvis aktivering av IOMMU eller radering, kräver uttrycklig bekräftelse."
+    ]
+  },
+  "related": {
+    "heading": "Relaterat",
+    "items": [
+      {
+        "href": "/docs/storage-share",
+        "label": "Lagrings- och delningshanterare",
+        "tail": " - registrera lagring i Proxmox själv (NFS / Samba / iSCSI / lokal) och dela mappar mellan värd och CT."
+      },
+      {
+        "href": "/docs/help-info/storage-commands",
+        "label": "Kommandon för lagring och diskar",
+        "tail": " - blockenheter, LVM, pvesm, SMART referens."
+      },
+      {
+        "href": "/docs/help-info/zfs-commands",
+        "label": "Kommandon för ZFS-hantering",
+        "tail": " — för ZFS pooler och datamängder."
+      },
+      {
+        "href": "/docs/hardware/gpu-vm-passthrough",
+        "label": "Lägg till GPU till VM (Passthrough)",
+        "tail": " - samma IOMMU / VFIO-koncept som tillämpas på GPU."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sv/docs/disk-manager/smart-disk-test.json b/web/messages/sv/docs/disk-manager/smart-disk-test.json
new file mode 100644
index 00000000..0836550e
--- /dev/null
+++ b/web/messages/sv/docs/disk-manager/smart-disk-test.json
@@ -0,0 +1,146 @@
+{
+  "meta": {
+    "title": "SMART-status och disktest | ProxMenux-dokumentation",
+    "description": "Kör SMART hälsokontroller och disktester på Proxmox VE med ProxMenux. Stöder SATA / SAS (smartmontools) och NVMe (nvme-cli). Korta och långa självtester, JSON export för ProxMenux Monitor integration.",
+    "ogTitle": "SMART-status och disktest | ProxMenux-dokumentation",
+    "ogDescription": "SMART hälsokontroller och självtest för SATA / SAS och NVMe-enheter på Proxmox. JSON export för Monitor."
+  },
+  "header": {
+    "title": "SMART-status och disktest",
+    "description": "Läs SMART-data och starta självtester på värdens fysiska diskar. ProxMenux installerar smartmontools för SATA/SAS och nvme-cli för NVMe, startar testet i diskens firmware (långa tester fortsätter när terminalen stängs) och exporterar JSON-resultat för ProxMenux Monitor.",
+    "section": "Diskhanterare · Verktyg"
+  },
+  "intro": {
+    "title": "Vad detta är för",
+    "body": "SMART (Self-Monitoring, Analysis and Reporting Technology) låter disken rapportera sitt tillstånd och köra självtester. Verktyget visar data utan att du behöver minnas rätt <code>smartctl</code>- eller <code>nvme</code>-anrop och sparar utdata som JSON så att Monitor kan visa trender över tid."
+  },
+  "howRuns": {
+    "heading": "Så körs skriptet",
+    "body": "Alla åtgärder är icke-destruktiva: SMART läser firmware-räknare och självtester körs inne i disken. Ingen fasindelning behövs. Flödet är: beroendekontroll → diskval → åtgärdsval → anrop av smartctl eller nvme-cli beroende på disktyp → visad utdata och JSON-export för Monitor."
+  },
+  "deps": {
+    "heading": "Beroenden",
+    "body": "Verktyget installerar automatiskt vad det behöver på första körningen. SATA / SAS-enheter är beroende av <code>smartmontools</code>; NVMe-enheter är beroende av <code>nvme-cli</code>. Båda:"
+  },
+  "actions": {
+    "heading": "Tillgängliga åtgärder",
+    "headerAction": "Handling",
+    "headerWhat": "Vad som läses eller körs",
+    "headerDur": "Varaktighet",
+    "rows": [
+      {
+        "action": "Snabb hälsostatus",
+        "whatRich": "Totalt PASSED/FAILED + nyckelattribut.<br /><code>smartctl -H</code> + <code>-A</code> (SATA/SAS) eller <code>nvme smart-log</code> (NVMe).",
+        "dur": "Omedelbart"
+      },
+      {
+        "action": "Fullständig rapport",
+        "whatRich": "Komplett SMART data, rullbar. <code>smartctl -x</code> för SATA/SAS eller <code>nvme smart-log</code> + <code>id-ctrl</code> för NVMe.",
+        "dur": "Omedelbart"
+      },
+      {
+        "action": "Kort test",
+        "what": "Grundläggande kontroll av lagringsytan och elektroniken i diskens firmware.",
+        "dur": "~2 minuter"
+      },
+      {
+        "action": "Långt test",
+        "what": "Full skanning av hela ytan. Körs på hårdvaran - kvarstår även om du stänger terminalen.",
+        "dur": "Timmar (diskstorlek beroende)"
+      },
+      {
+        "action": "Kontrollera testförlopp",
+        "what": "Status för det aktiva eller senaste självtestet.",
+        "dur": "Omedelbart"
+      }
+    ],
+    "tipTitle": "Långa tester fortsätter när terminalen stängs",
+    "tipBody": "Ett långt test körs <em>inne i disken</em> och kräver inte att ProxMenux-processen fortsätter. Du kan stänga terminalen och återkomma till <strong>Kontrollera testförlopp</strong>. Omstart av värden, återställning av styrenheten eller strömavbrott kan avbryta testet och resultatinsamlingen; utgå inte från att de återupptas automatiskt."
+  },
+  "json": {
+    "heading": "JSON export för Monitor",
+    "intro": "Status-, korttest- och förloppsåtgärder skriver en tidsstämplad JSON-fil till <code>/usr/local/share/proxmenux/smart/&lt;disk&gt;/</code>; långa testers resultat samlas i bakgrunden. Den fullständiga rapporten visas bara. Strukturen är:",
+    "outro": "ProxMenux Monitor plockar upp dessa för att göra hälsotrender per disk; gamla filer roteras automatiskt när lagringsgränsen nås."
+  },
+  "steps": {
+    "heading": "Steg-för-steg",
+    "stepLabel": "Steg",
+    "list": [
+      {
+        "title": "Välj en disk",
+        "body": "ProxMenux listar varje fysisk disk på värden med sin modell och storlek. Till skillnad från Format-verktyget filtreras inte den här listan av säkerhet - läs SMART är en icke-destruktiv operation.",
+        "img": "/disk/smart/disk-selection.png",
+        "alt": "SMART diskval meny",
+        "caption": "SMART diskval meny"
+      },
+      {
+        "title": "Välj en åtgärd",
+        "body": "Välj snabb status, fullständig rapport, kort test, långt test eller kontroll av testförlopp. Menyn hålls öppen efter varje åtgärd så att du kan göra flera förfrågningar mot samma disk.",
+        "img": "/disk/smart/action-menu.png",
+        "alt": "SMART åtgärdsmenyn",
+        "caption": "SMART åtgärdsmenyn (5 åtgärder + avbryta)"
+      },
+      {
+        "title": "(Endast långt test) Bekräfta bakgrundskörning",
+        "body": "ProxMenux informerar om att testet fortsätter när terminalen stängs och visar var JSON-resultatet sparas. Bekräfta för att starta testet.",
+        "img": "/disk/smart/long-test-warning.png",
+        "alt": "Lång testbekräftelsedialog",
+        "caption": "Lång testbekräftelse - körs i bakgrunden, vilket sparas till JSON"
+      },
+      {
+        "title": "Granska resultat",
+        "bodyRich": "Status, tester och förlopp visas i terminalen; <strong>Fullständig rapport</strong> öppnas i en rullbar dialog. JSON exporteras för åtgärderna ovan, inte för Fullständig rapport. För långa tester återkommer du till <strong>Kontrollera testförlopp</strong> på samma disk.",
+        "img": "/disk/smart/quick-status.png",
+        "alt": "Utdata från snabb statuskontroll",
+        "caption": "Snabb hälsostatusutgång (SATA - smartctl -H + -A)"
+      }
+    ]
+  },
+  "manual": {
+    "heading": "Manuella motsvarigheter",
+    "nvmeWarnTitle": "NVMe-självtester beror på diskens firmware",
+    "nvmeWarnBody": "Inte varje NVMe-enhet stöder det korta / långa självtestkommandot. Om en enhet vägrar testet är SMART-loggen och ID-kontrolldata (<code>nvme smart-log</code> + <code>id-ctrl</code>) fortfarande den mest tillförlitliga hälsosignalen."
+  },
+  "troubleshoot": {
+    "heading": "Felsökning",
+    "noSmartTitle": "\"Kan inte läsa SMART data från /dev/sdX\"",
+    "noSmartBody": "Disken sitter troligen bakom en RAID/SAS-styrenhet som inte vidarebefordrar SMART. För megaraid-kort kan du prova <code>smartctl -d megaraid,N /dev/sdX</code>. För HBA:er i IT-läge fungerar det direkta anropet.",
+    "longTitle": "Långt test slutför aldrig",
+    "longBody": "Testet körs i diskens firmware och hög I/O-belastning kan fördröja det. Prova en lugn period, exempelvis över natten. För SATA visar <code>smartctl -c</code> återstående procent, för SAS <code>smartctl -l selftest</code>; självtestloggen visar slutstatus och eventuella felaktiga LBA:er. Läsfel behöver undersökas; långsamt förlopp bevisar inte i sig en dålig sektor."
+  },
+  "related": {
+    "heading": "Relaterat",
+    "items": [
+      {
+        "href": "/docs/disk-manager/format-disk",
+        "label": "Formatera / radera fysisk disk",
+        "tail": " — Återanvänd en disk efter att ha bekräftat att den är frisk."
+      },
+      {
+        "href": "/docs/help-info/storage-commands",
+        "label": "Kommandon för lagring och diskar → SMART-status",
+        "tail": " — referens för smartctl/nvme med kommandon att kopiera."
+      },
+      {
+        "href": "/docs/help-info/zfs-commands",
+        "label": "Kommandon för ZFS-hantering",
+        "tail": " — zpool scrub verifierar ZFS-datas kontrollsummor och kompletterar hårdvarans SMART-test."
+      },
+      {
+        "href": "/docs/monitor/dashboard/storage",
+        "label": "ProxMenux Monitor - Lagringsflik",
+        "tail": " — detaljerad diskvy som använder exporterad JSON: fullständig SMART-tabell, historik och PDF-rapport."
+      },
+      {
+        "href": "/docs/monitor/dashboard/hardware",
+        "label": "ProxMenux Monitor — maskinvarufliken",
+        "tail": " - Lagring Sammanfattning med modell, kapacitet och förhandlad länkhastighet (nuvarande vs maximum på NVMe)."
+      },
+      {
+        "href": "/docs/disk-manager",
+        "label": "Disk Manager översikt",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sv/docs/external-repositories.json b/web/messages/sv/docs/external-repositories.json
new file mode 100644
index 00000000..4ce33f9e
--- /dev/null
+++ b/web/messages/sv/docs/external-repositories.json
@@ -0,0 +1,58 @@
+{
+  "meta": {
+    "title": "Externa kodarkiv | ProxMenux-dokumentation",
+    "description": "ProxMenux integrerar utvalda externa skriptarkiv, till exempel community-scripts och ZimaOS, som alternativ i vissa menyer. Varje skript har tydlig källangivelse. Rapportera buggar till den ursprungliga underhållaren.",
+    "ogTitle": "Externa kodarkiv | ProxMenux-dokumentation",
+    "ogDescription": "Externa skriptarkiv som är integrerade som alternativ i ProxMenux menyer."
+  },
+  "header": {
+    "title": "Externa kodarkiv",
+    "description": "ProxMenux integrerar utvalda externa skriptarkiv som alternativ i vissa menyer. Skripten kommer från betrodda tredjepartskällor och deras ursprung visas tydligt i menyn.",
+    "section": "Externa kodarkiv"
+  },
+  "practice": {
+    "title": "Vad detta innebär i praktiken",
+    "body": "När ett menyalternativ använder ett externt skript i stället för ProxMenux egen kod visar menyn dess ursprung och vilket kodarkiv som läses in. ProxMenux startar skripten utan att ändra dem. Problem med skriptens funktion hör till underhållaren av deras ursprungliga kodarkiv."
+  },
+  "integrated": {
+    "heading": "För närvarande integrerade",
+    "usedInLabel": "Används i:",
+    "items": [
+      {
+        "name": "community-scripts / ProxmoxVE",
+        "url": "https://community-scripts.github.io/ProxmoxVE/",
+        "description": "Andlig efterföljare till ttecks hjälpskript. Stor katalog med skript som i en körning installerar LXC:er (Home Assistant, Plex, Frigate…), VM:ar, tillägg och PVE-anpassningar.",
+        "usedIn": "Start av Helper Scripts och Nätverk (korrigering av nätverksavlastning för Intel e1000e)"
+      }
+    ]
+  },
+  "attribution": {
+    "heading": "Källangivelser och erkännande",
+    "items": [
+      "De ursprungliga upphovspersonerna anges alltid i menyn och på dokumentationssidan för skriptets integration.",
+      "En länk till källarkivet visas både före körningen och på motsvarande dokumentationssida.",
+      "Stöd utvecklarna av dessa externa projekt med en ⭐, sponsring eller välskrivna buggrapporter."
+    ]
+  },
+  "report": {
+    "title": "Var kan man rapportera problem med externa skript",
+    "body": "Om ett externt skript inte fungerar som förväntat, <strong>rapportera det direkt i dess kodarkiv</strong>, inte till ProxMenux. ProxMenux laddar ned och kör skriptet utan att ändra koden. Den ursprungliga underhållaren kan bedöma och åtgärda problemet. ProxMenux ärenden gäller problem med startfunktionen eller skriptets integration."
+  },
+  "suggest": {
+    "heading": "Förslag till nya externa repositorier",
+    "intro": "Har du hittat ett skript eller kodarkiv som skulle passa i en ProxMenux-meny? Föreslå det via:",
+    "discussionTitle": "💬 Starta en diskussion",
+    "discussionBody": "Passar bäst för idéer: få synpunkter från gemenskapen innan idén blir en funktionsförfrågan.",
+    "issueTitle": "🐛 Skapa ett ärende",
+    "issueBody": "För specifika funktionsförfrågningar med tydlig avgränsning."
+  },
+  "candidate": {
+    "title": "Vad gör en bra integrationskandidat",
+    "items": [
+      "Öppen källkod med en aktiv underhållare.",
+      "Idempotent: säkert att köra flera gånger.",
+      "Ändrar inte Proxmox centrala konfiguration utan att meddela det.",
+      "Löser ett problem som ProxMenux ännu inte hanterar, så att funktioner inte dubbleras."
+    ]
+  }
+}
diff --git a/web/messages/sv/docs/glossary.json b/web/messages/sv/docs/glossary.json
new file mode 100644
index 00000000..87216202
--- /dev/null
+++ b/web/messages/sv/docs/glossary.json
@@ -0,0 +1,677 @@
+{
+  "meta": {
+    "title": "Ordlista | ProxMenux-dokumentation",
+    "description": "Definitioner av termer som används i ProxMenux-dokumentationen om Proxmox, lagring, nätverk och virtualisering.",
+    "ogTitle": "Ordlista | ProxMenux-dokumentation",
+    "ogDescription": "Snabb referens för de tekniska termer som används i ProxMenux-dokumentationen."
+  },
+  "header": {
+    "title": "Ordlista",
+    "description": "Korta definitioner av termer som används i ProxMenux och för att beskriva hur Proxmox fungerar.",
+    "section": "Ordlista"
+  },
+  "callout": {
+    "title": "Hur man använder denna sida",
+    "bodyRich": "Varje post har en kategori och en kort definition. Länkarna <em>Se även</em> öppnar relevant dokumentation. Använd A–Z-navigeringen för att gå direkt till en bokstav."
+  },
+  "jumpHeading": "Gå till bokstav",
+  "seeAlsoLabel": "Se även:",
+  "aliasesLabel": "också:",
+  "missingCallout": {
+    "title": "Saknar en term?",
+    "leadRich": "Om en term saknas öppnar du en issue eller PR på <ext>GitHub</ext>. Ordlistan finns i <code>web/messages/en/docs/glossary.json</code> med motsvarande kataloger för varje språk."
+  },
+  "entries": [
+    {
+      "term": "ACS",
+      "aliases": [
+        "Access Control Services",
+        "Åsidosättning av ACS"
+      ],
+      "category": "Virtualisering",
+      "definitionRich": "PCIe-funktioner för åtkomstkontroll som hjälper till att isolera enheternas trafik. IOMMU-grupper beror på hårdvara och topologi. Kernelpatchen <em>ACS override</em> kan dela grupperna som Linux rapporterar, men tillför ingen hårdvaruisolering; tilldelning till separata VM innebär en säkerhetsrisk.",
+      "seeAlso": [
+        {
+          "label": "Lägg till Controller eller NVMe till VM",
+          "href": "/docs/disk-manager/add-controller-nvme-vm"
+        }
+      ]
+    },
+    {
+      "term": "ARC",
+      "aliases": [
+        "Adaptive Replacement Cache"
+      ],
+      "category": "Lagring",
+      "definitionRich": "ZFS läscache i värdens RAM för nyligen och ofta använda datablock. Standardgränsen beror på Proxmox-versionen och installationsinställningarna. ProxMenux erbjuder en gränsinställning i efterinstallationen.",
+      "seeAlso": [
+        {
+          "label": "Efterinstallation: lagring",
+          "href": "/docs/post-install/storage"
+        },
+        {
+          "label": "ZFS kommandon",
+          "href": "/docs/help-info/zfs-commands"
+        }
+      ]
+    },
+    {
+      "term": "Bind-montering",
+      "category": "Linux",
+      "definitionRich": "Linux-funktion som gör en del av filsystemet tillgänglig på ytterligare en sökväg. ProxMenux använder bind-monteringar för att dela värdkataloger med LXC-containrar via <code>pct set -mpN</code>.",
+      "seeAlso": [
+        {
+          "label": "LXC-monteringspunkter",
+          "href": "/docs/storage-share/lxc-mount-points"
+        }
+      ]
+    },
+    {
+      "term": "Nätverksbond",
+      "aliases": [
+        "Aggregering av nätverksgränssnitt",
+        "Länkaggregering"
+      ],
+      "category": "Nätverk",
+      "definitionRich": "Samlar flera fysiska nätverksgränssnitt i ett logiskt för redundans (active-backup), högre sammanlagd kapacitet (LACP / 802.3ad) eller båda. Konfigureras i <code>/etc/network/interfaces</code>."
+    },
+    {
+      "term": "Bro",
+      "aliases": [
+        "vmbrX",
+        "vmbr0",
+        "Linux-brygga"
+      ],
+      "category": "Nätverk",
+      "definitionRich": "Virtuell lager 2-switch på värden. <code>vmbr0</code> ansluter vanligen gäster till det fysiska nätverket. Fler bryggor (<code>vmbr1</code>, <code>vmbr2</code>...) kan separera gästnät beroende på fysiska anslutningar och konfiguration.",
+      "seeAlso": [
+        {
+          "label": "Bridge analys och guidad reparation",
+          "href": "/docs/network/bridge-analysis"
+        }
+      ]
+    },
+    {
+      "term": "Ceph",
+      "category": "Lagring",
+      "definitionRich": "Distribuerad lagring integrerad med Proxmox för hyperkonvergerade kluster. OSD:er (Object Storage Daemons) ligger till grund för objekt-, block- och fillagring. Kraven på Ceph-version beror på Proxmox-versionen och uppgraderingsvägen; se motsvarande uppgraderingsguide.",
+      "seeAlso": [
+        {
+          "label": "Uppgradera PVE 8 till PVE 9",
+          "href": "/docs/utils/upgrade-pve8-pve9"
+        }
+      ]
+    },
+    {
+      "term": "CT",
+      "aliases": [
+        "Container",
+        "LXC-container"
+      ],
+      "category": "Proxmox",
+      "definitionRich": "Proxmox förkortning för en LXC-container. Dess numeriska CTID motsvarar <code>/etc/pve/lxc/&lt;CTID&gt;.conf</code>. Se även <strong>LXC</strong>.",
+      "seeAlso": [
+        {
+          "label": "Hantera virtuella maskiner och containrar",
+          "href": "/docs/help-info/vm-ct-commands"
+        }
+      ]
+    },
+    {
+      "term": "deb822",
+      "category": "Linux",
+      "definitionRich": "Modernt format för APT-paketkällor: <code>.sources</code>-filer med strukturerade block och fälten Types, URIs, Suites, Components och Signed-By. Ersätter det enradiga <code>.list</code>-formatet; standard från PVE 9 / Debian Trixie.",
+      "seeAlso": [
+        {
+          "label": "Uppgradera PVE 8 till PVE 9",
+          "href": "/docs/utils/upgrade-pve8-pve9"
+        }
+      ]
+    },
+    {
+      "term": "dGPU",
+      "aliases": [
+        "Dedikerad GPU"
+      ],
+      "category": "Virtualisering",
+      "definitionRich": "Separat grafikkort, vanligen anslutet via PCIe, till skillnad från en <strong>iGPU</strong>. Det kan tilldelas en VM med VFIO eller användas av flera LXC-containrar via enhetsnoder och värdens drivrutin, om hårdvara och program stöder det.",
+      "seeAlso": [
+        {
+          "label": "Koppla GPU till VM (genomkoppling)",
+          "href": "/docs/hardware/gpu-vm-passthrough"
+        }
+      ]
+    },
+    {
+      "term": "Dialog",
+      "category": "Linux",
+      "definitionRich": "Verktyg baserat på ncurses för menyer, inmatningsfrågor och förloppsindikatorer i terminalen. ProxMenux menyer använder dialog."
+    },
+    {
+      "term": "DKMS",
+      "aliases": [
+        "Dynamisk Kernel Modulstöd"
+      ],
+      "category": "Linux",
+      "definitionRich": "Ramverk som bygger om registrerade externa kärnmoduler, som NVIDIA eller ZFS, när kärnan ändras. Det kräver kompatibel modulkällkod och matchande kärnheaders.",
+      "seeAlso": [
+        {
+          "label": "Installera Coral TPU (Host)",
+          "href": "/docs/hardware/install-coral-tpu-host"
+        }
+      ]
+    },
+    {
+      "term": "Fail2Ban",
+      "category": "Linux",
+      "definitionRich": "Tjänst som söker efter upprepade autentiseringsfel i loggar och blockerar berörda IP-adresser i brandväggen. ProxMenux har förkonfigurerade jails för SSH, Proxmox-gränssnittet och Monitor.",
+      "seeAlso": [
+        {
+          "label": "Fail2Ban",
+          "href": "/docs/security/fail2ban"
+        }
+      ]
+    },
+    {
+      "term": "Fastfetch",
+      "category": "Linux",
+      "definitionRich": "Verktyg som visar systeminformation med ASCII-grafik vid inloggning i skalet. Ersätter <code>neofetch</code> och kan aktiveras i ProxMenux efterinstallation.",
+      "seeAlso": [
+        {
+          "label": "Efter installationen: valfria åtgärder",
+          "href": "/docs/post-install/optional"
+        }
+      ]
+    },
+    {
+      "term": "GRUB",
+      "aliases": [
+        "GRand Unified Bootloader"
+      ],
+      "category": "Linux",
+      "definitionRich": "Starthanterare för Linux-installationer som använder GRUB. Konfiguration finns i <code>/etc/default/grub</code> och <code>/boot/grub/</code>; tillämpa ändringar med <code>update-grub</code>. Proxmox kan även använda systemd-boot: kontrollera aktiv starthanterare innan du ändrar kärnparametrar.",
+      "seeAlso": [
+        {
+          "label": "GPU Passthrough kommandon",
+          "href": "/docs/help-info/gpu-commands"
+        }
+      ]
+    },
+    {
+      "term": "iGPU",
+      "aliases": [
+        "Integrerad GPU"
+      ],
+      "category": "Virtualisering",
+      "definitionRich": "Grafikprocessor integrerad i CPU-kapseln, som Intel UHD / Iris eller Radeon i Ryzen-APU:er. Delas ofta mellan flera LXC-containrar via <code>/dev/dri</code> i stället för att tilldelas en enda VM.",
+      "seeAlso": [
+        {
+          "label": "Lägg till GPU till LXC",
+          "href": "/docs/hardware/igpu-acceleration-lxc"
+        }
+      ]
+    },
+    {
+      "term": "ifupdown / ifupdown2",
+      "category": "Nätverk",
+      "definitionRich": "Debians klassiska nätverkskonfiguration via <code>/etc/network/interfaces</code>. Proxmox använder normalt den omskrivna versionen <code>ifupdown2</code>, som kan läsa om konfigurationen under drift med <code>ifreload -a</code>."
+    },
+    {
+      "term": "initramfs",
+      "category": "Linux",
+      "definitionRich": "Inledande RAM-filsystem som kärnan använder innan det riktiga rotfilsystemet monteras. Innehåller drivrutiner som behövs tidigt. Byggs om med <code>update-initramfs -u -k all</code> efter ändringar av VFIO, IOMMU eller lagringsdrivrutiner."
+    },
+    {
+      "term": "IOMMU",
+      "aliases": [
+        "Minneshanteringsenhet för in- och utmatning",
+        "VT-d",
+        "AMD-Vi"
+      ],
+      "category": "Virtualisering",
+      "definitionRich": "Hårdvarufunktion (Intel VT-d / AMD-Vi) som behövs för PCIe-genomkoppling till VM. Aktivera den i firmware och kontrollera stödet i kärnan. Beroende på plattform och kärnans standardvärden kan <code>intel_iommu=on</code> eller <code>amd_iommu=on</code> behövas.",
+      "seeAlso": [
+        {
+          "label": "Post-Install: Virtualisering",
+          "href": "/docs/post-install/virtualization"
+        },
+        {
+          "label": "Koppla GPU till VM (genomkoppling)",
+          "href": "/docs/hardware/gpu-vm-passthrough"
+        }
+      ]
+    },
+    {
+      "term": "IOMMU-grupp",
+      "category": "Virtualisering",
+      "definitionRich": "Grupp av enheter som utgör den minsta IOMMU-isoleringsgränsen. Enheter inom gruppen är inte nödvändigtvis isolerade från varandra; kontrollera alla före VFIO-tilldelning. Lista med <code>find /sys/kernel/iommu_groups/ -type l | sort -V</code>."
+    },
+    {
+      "term": "iSCSI",
+      "aliases": [
+        "Internet SCSI"
+      ],
+      "category": "Lagring",
+      "definitionRich": "Protokoll för blocklagring över IP: en fjärrdisk visas som en lokal SCSI-enhet. Läggs till i Proxmox med <code>pvesm add iscsi</code>.",
+      "seeAlso": [
+        {
+          "label": "Lägg till iSCSI-mål som Proxmox-lagring",
+          "href": "/docs/storage-share/host-iscsi"
+        }
+      ]
+    },
+    {
+      "term": "KVM",
+      "aliases": [
+        "Kernelbaserad virtuell maskin"
+      ],
+      "category": "Virtualisering",
+      "definitionRich": "Linux-kärnmodul som gör värden till en hypervisor. Tillsammans med <strong>QEMU</strong> för enhetsemulering utgör den grunden för Proxmox virtuella maskiner."
+    },
+    {
+      "term": "LVM",
+      "aliases": [
+        "Logical Volume Manager"
+      ],
+      "category": "Lagring",
+      "definitionRich": "Linux volymhantering som samlar fysisk lagring i volymgrupper (VG) med logiska volymer (LV). LVM-baserade Proxmox-installationer använder ofta LVM-thin för gästdiskar; andra lagringslösningar finns. Verktyg: <code>pvs</code>, <code>vgs</code> och <code>lvs</code>.",
+      "seeAlso": [
+        {
+          "label": "Kommandon för lagring och diskar",
+          "href": "/docs/help-info/storage-commands"
+        }
+      ]
+    },
+    {
+      "term": "LXC",
+      "aliases": [
+        "Linux Containers"
+      ],
+      "category": "Linux",
+      "definitionRich": "Virtualisering på operativsystemnivå där isolerade användarmiljöer delar värdens kärna. Har vanligen lägre overhead än VM, men en annan isoleringsgräns. Proxmox hanterar LXC-containrar med <code>pct</code>.",
+      "seeAlso": [
+        {
+          "label": "Hantera virtuella maskiner och containrar",
+          "href": "/docs/help-info/vm-ct-commands"
+        }
+      ]
+    },
+    {
+      "term": "Lynis",
+      "category": "Linux",
+      "definitionRich": "Säkerhetsgranskare med öppen källkod från CISOfy. Analyserar värden och ger ett härdningsvärde samt konkreta förbättringsförslag. ProxMenux installerar versionen från projektets GitHub-förråd i stället för det äldre Debian-paketet.",
+      "seeAlso": [
+        {
+          "label": "Lynis",
+          "href": "/docs/security/lynis"
+        }
+      ]
+    },
+    {
+      "term": "MAC-adress",
+      "aliases": [
+        "Hårdvaruadress"
+      ],
+      "category": "Nätverk",
+      "definitionRich": "Vanligen en 48-bitars identifierare för ett Ethernet-gränssnitt, tilldelad av hårdvara eller programvara. ProxMenux <em>Beständiga nätverksnamn</em> kopplar MAC-adresser till fasta namn (<code>eno1</code>, <code>enp3s0</code>) som består efter ändrad PCI-uppräkning.",
+      "seeAlso": [
+        {
+          "label": "Persistenta gränssnitt namn",
+          "href": "/docs/network/persistent-names"
+        }
+      ]
+    },
+    {
+      "term": "MOTD",
+      "aliases": [
+        "Dagens budskap"
+      ],
+      "category": "Linux",
+      "definitionRich": "Text som visas efter SSH-inloggning, lagrad i <code>/etc/motd</code>. ProxMenux kan lägga till en banner efter installationen; avinstallationen återställer föregående fil om en säkerhetskopia finns."
+    },
+    {
+      "term": "NFS",
+      "aliases": [
+        "Nätverksfilsystem"
+      ],
+      "category": "Lagring",
+      "definitionRich": "Protokoll för fildelning i nätverk med ursprung i Unix. Läggs till som Proxmox-lagring med <code>pvesm add nfs</code>; ProxMenux har även guider för NFS-klienter och -servrar i LXC.",
+      "seeAlso": [
+        {
+          "label": "Lagrings- och delningshanterare",
+          "href": "/docs/storage-share"
+        }
+      ]
+    },
+    {
+      "term": "nftables / iptables",
+      "category": "Nätverk",
+      "definitionRich": "Brandväggsverktyg för Linux. <code>nftables</code> är det moderna ramverket; <code>iptables</code> kan använda äldre eller nft-kompatibla bakändar. Klassiska <code>pve-firewall</code> använder iptables, medan alternativet proxmox-firewall använder nftables.",
+      "seeAlso": [
+        {
+          "label": "Nätverkskommandon",
+          "href": "/docs/help-info/network-commands"
+        }
+      ]
+    },
+    {
+      "term": "nouveau",
+      "category": "Linux",
+      "definitionRich": "Öppen NVIDIA-grafikdrivrutin som ingår i Linux-kärnan. Vid installation av den proprietära drivrutinen måste nouveau hindras från att binda samma GPU, vanligen genom blockering av modulen och ombyggnad av initramfs.",
+      "seeAlso": [
+        {
+          "label": "NVIDIA installationsguide",
+          "href": "/guides/nvidia"
+        }
+      ]
+    },
+    {
+      "term": "No-subscription-paketförråd",
+      "category": "Proxmox",
+      "definitionRich": "Proxmox paketförråd utan enterprise-prenumeration. Paketen valideras mindre omfattande än i enterprise-förrådet, som Proxmox rekommenderar för produktion. ProxMenux erbjuder konfiguration av paketförråd i efterinstallationen.",
+      "seeAlso": [
+        {
+          "label": "Post-Install: Grundläggande inställningar",
+          "href": "/docs/post-install/basic-settings"
+        }
+      ]
+    },
+    {
+      "term": "OVA / OVF",
+      "aliases": [
+        "Open Virtualization Format"
+      ],
+      "category": "Virtualisering",
+      "definitionRich": "DMTF-format för att paketera flyttbara VM. <strong>OVA</strong> samlar filerna i ett TAR-arkiv; <strong>OVF</strong> beskriver VM i XML med tillhörande diskfiler, ofta VMDK. Importstödet beror på målhypervisorn och konfigurationen.",
+      "seeAlso": [
+        {
+          "label": "Exportera VM till OVA / OVF",
+          "href": "/docs/utils/export-vm"
+        },
+        {
+          "label": "Importera VM från OVA / OVF",
+          "href": "/docs/utils/import-vm"
+        }
+      ]
+    },
+    {
+      "term": "OVMF",
+      "aliases": [
+        "UEFI-programvara",
+        "Open Virtual Machine Firmware"
+      ],
+      "category": "Virtualisering",
+      "definitionRich": "UEFI-firmware för VM, valt med <code>qm set &lt;vmid&gt; -bios ovmf</code>. Används för UEFI-gäster, inklusive Windows 11 och Secure Boot-konfigurationer. <code>efidisk0</code> lagrar beständiga EFI-variabler; många andra gäster kan fortfarande använda äldre BIOS.",
+      "seeAlso": [
+        {
+          "label": "Koppla GPU till VM (genomkoppling)",
+          "href": "/docs/hardware/gpu-vm-passthrough"
+        }
+      ]
+    },
+    {
+      "term": "PBS",
+      "aliases": [
+        "Proxmox Backup Server"
+      ],
+      "category": "Proxmox",
+      "definitionRich": "Separat säkerhetskopieringsprodukt från Proxmox med inkrementella överföringar, deduplicering och valfri klientkryptering för VM och CT. Kan användas som vzdump-mål; en separat backupserver är att föredra framför kopior på den skyddade värden."
+    },
+    {
+      "term": "pct",
+      "category": "Proxmox",
+      "definitionRich": "Kommandoradsverktyg för LXC-containrar i Proxmox: <code>pct list / start / stop / shutdown / config / enter / exec / push / pull / destroy</code>.",
+      "seeAlso": [
+        {
+          "label": "Hantera virtuella maskiner och containrar",
+          "href": "/docs/help-info/vm-ct-commands"
+        }
+      ]
+    },
+    {
+      "term": "pmxcfs",
+      "aliases": [
+        "Proxmox Cluster Filesystem"
+      ],
+      "category": "Proxmox",
+      "definitionRich": "FUSE-baserat virtuellt filsystem monterat på <code>/etc/pve/</code>. Replikerar konfigurationsändringar mellan klusternoder: ändringar under <code>/etc/pve/</code> sprids automatiskt."
+    },
+    {
+      "term": "pveam",
+      "aliases": [
+        "Hanterare för virtuella apparater i Proxmox VE"
+      ],
+      "category": "Proxmox",
+      "definitionRich": "Verktyg för den lokala katalogen med CT-mallar. <code>pveam update</code> uppdaterar indexet; <code>pveam available</code> listar mallar och <code>pveam download &lt;storage&gt; &lt;template&gt;</code> hämtar en mall."
+    },
+    {
+      "term": "pveproxy",
+      "category": "Proxmox",
+      "definitionRich": "HTTPS-tjänst för Proxmox webbgränssnitt och webbterminal på port 8006. Startas om vid större uppgraderingar; därför tillåter ProxMenux inte uppgraderingen PVE 8 → 9 från webbterminalen."
+    },
+    {
+      "term": "pvesm",
+      "aliases": [
+        "Proxmox lagringshanterare"
+      ],
+      "category": "Proxmox",
+      "definitionRich": "CLI verktyg för hantering av Proxmox lagring. <code>pvesm status</code> visar alla konfigurerade lagringar; <code>pvesm add &lt;type&gt;</code> registrerar nya (NFS, Samba, iSCSI, dir, ZFS, LVM, ...).",
+      "seeAlso": [
+        {
+          "label": "Kommandon för lagring och diskar",
+          "href": "/docs/help-info/storage-commands"
+        }
+      ]
+    },
+    {
+      "term": "Privilegerad container",
+      "category": "Linux",
+      "definitionRich": "LXC-container vars root <em>mappas till värdens UID 0</em>, medan namnrymder och andra begränsningar fortfarande gäller. Mindre isolerad än en oprivilegierad container. GPU, USB och Samba kräver inte alltid detta läge; behörigheter och UID-mappning spelar roll."
+    },
+    {
+      "term": "ProxMenux Monitor",
+      "category": "ProxMenux",
+      "definitionRich": "Valfri webbpanel för ProxMenux. Visar värdstatistik i realtid (CPU, RAM, diskar och nätverk), VM- och LXC-översikt samt inloggning med 2FA på TCP-port <code>8008</code>.",
+      "seeAlso": [
+        {
+          "label": "ProxMenux Monitor",
+          "href": "/docs/settings/proxmenux-monitor"
+        }
+      ]
+    },
+    {
+      "term": "qcow2",
+      "aliases": [
+        "QEMU Copy-On-Write v2"
+      ],
+      "category": "Lagring",
+      "definitionRich": "Format för VM-diskavbilder som ofta används på kataloglagring. Stöder tilldelning vid behov, ögonblicksbilder och copy-on-write. Konvertera med <code>qemu-img convert -O qcow2 ...</code>."
+    },
+    {
+      "term": "qm",
+      "aliases": [
+        "QEMU-hanterare"
+      ],
+      "category": "Proxmox",
+      "definitionRich": "Verktyg för att hantera VM i Proxmox: <code>qm list / start / stop / shutdown / config / set / destroy / importdisk / migrate</code>. Motsvarar <code>pct</code> för containrar.",
+      "seeAlso": [
+        {
+          "label": "Hantera virtuella maskiner och containrar",
+          "href": "/docs/help-info/vm-ct-commands"
+        }
+      ]
+    },
+    {
+      "term": "Q35",
+      "category": "Virtualisering",
+      "definitionRich": "QEMU-maskintyp som emulerar Intel Q35 med PCIe-stöd. Rekommenderas framför i440FX för PCIe-genomkoppling och moderna gästsystem. Ställs in med <code>qm set &lt;vmid&gt; -machine q35</code>."
+    },
+    {
+      "term": "QEMU",
+      "category": "Virtualisering",
+      "definitionRich": "Maskinemulator och virtualiserare med öppen källkod. Proxmox kombinerar den med KVM för att köra VM med prestanda nära den fysiska maskinens."
+    },
+    {
+      "term": "rclone",
+      "category": "Linux",
+      "definitionRich": "Kommandoradsverktyg med stöd för många molnlagringstjänster, bland annat Google Drive, Dropbox, OneDrive, Mega och S3. Molnbackupguiden använder det för att montera fjärrlagring som en katalog för vzdump-arkiv.",
+      "seeAlso": [
+        {
+          "label": "Säkerhetskopiera till personlig molnlagring",
+          "href": "/guides/backup_cloud"
+        }
+      ]
+    },
+    {
+      "term": "Samba / SMB / CIFS",
+      "category": "Lagring",
+      "definitionRich": "Microsofts protokollfamilj för fildelning. <strong>SMB</strong> är protokollet, <strong>Samba</strong> den öppna Linux-implementationen och <strong>CIFS</strong> en äldre SMB-dialekt. Läggs till i Proxmox med <code>pvesm add cifs</code>.",
+      "seeAlso": [
+        {
+          "label": "Lagrings- och delningshanterare",
+          "href": "/docs/storage-share"
+        }
+      ]
+    },
+    {
+      "term": "SeaBIOS",
+      "category": "Virtualisering",
+      "definitionRich": "Öppen implementation av äldre BIOS som används av QEMU. Standardfirmware för nya VM om du inte väljer OVMF. Passar äldre system och Linux-installationer utan UEFI-krav."
+    },
+    {
+      "term": "smartctl / SMART",
+      "aliases": [
+        "Self-Monitoring, Analysis and Reporting Technology"
+      ],
+      "category": "Lagring",
+      "definitionRich": "Inbyggd diskdiagnostik för hälsostatus, felräknare och självtestresultat. Verktyget är <code>smartctl</code> från <code>smartmontools</code>; <code>nvme-cli</code> lägger till NVMe-specifika kommandon.",
+      "seeAlso": [
+        {
+          "label": "SMART-status och disktest",
+          "href": "/docs/disk-manager/smart-disk-test"
+        },
+        {
+          "label": "Lagringskommandon → SMART sektion",
+          "href": "/docs/help-info/storage-commands"
+        }
+      ]
+    },
+    {
+      "term": "systemd / systemctl / journalctl",
+      "category": "Linux",
+      "definitionRich": "Init-system i Debian / Proxmox. <code>systemctl</code> hanterar tjänster: start, stopp, aktivering och status. <code>journalctl</code> läser binärloggen som skrivs av <code>systemd-journald</code>."
+    },
+    {
+      "term": "sysctl",
+      "category": "Linux",
+      "definitionRich": "Verktyg för att läsa och ändra kärnparametrar. Beständiga inställningar placeras vanligen i <code>/etc/sysctl.d/*.conf</code>; stödet för <code>/etc/sysctl.conf</code> beror på laddningstjänsten. ProxMenux erbjuder en sysctl-profil i efterinstallationen.",
+      "seeAlso": [
+        {
+          "label": "Post-Install: Nätverk",
+          "href": "/docs/post-install/network"
+        }
+      ]
+    },
+    {
+      "term": "trixie",
+      "category": "Linux",
+      "definitionRich": "Kodnamn för Debian 13, OS-basen för Proxmox VE 9. Föregångare: <em>bookworm</em> (Debian 12 / PVE 8).",
+      "seeAlso": [
+        {
+          "label": "Uppgradera PVE 8 till PVE 9",
+          "href": "/docs/utils/upgrade-pve8-pve9"
+        }
+      ]
+    },
+    {
+      "term": "udev",
+      "category": "Linux",
+      "definitionRich": "Linux enhetshanterare. Reagerar på hårdvaruhändelser och skapar eller tar bort poster under <code>/dev</code>. Regler i <code>/etc/udev/rules.d/</code> kan binda gränssnittsnamn till MAC-adresser, skapa NVIDIA-enhetsnoder när drivrutinen laddas och annat."
+    },
+    {
+      "term": "UID / GID idmap",
+      "aliases": [
+        "UID skift"
+      ],
+      "category": "Linux",
+      "definitionRich": "Med standardmappningen i <strong>oprivilegierade</strong> LXC förskjuts UID och GID på värden med <code>+100000</code>: UID 0 motsvarar 100000 och 1000 motsvarar 101000. Anpassade mappningar kan skilja sig; filägarskap i bind-monteringar måste stämma med mappningen.",
+      "seeAlso": [
+        {
+          "label": "LXC-monteringspunkter",
+          "href": "/docs/storage-share/lxc-mount-points"
+        }
+      ]
+    },
+    {
+      "term": "Oprivilegierad container",
+      "category": "Linux",
+      "definitionRich": "LXC-container vars root mappas till ett oprivilegierat UID på värden, normalt 100000. Det minskar värdprivilegierna medan kärnan delas. Hårdvaruåtkomst kan konfigureras med lämpliga behörigheter och mappningar; privilegierat läge krävs inte alltid."
+    },
+    {
+      "term": "VFIO",
+      "aliases": [
+        "Virtuell funktion I/O"
+      ],
+      "category": "Virtualisering",
+      "definitionRich": "Linux-kärnramverk för säkra enhetsdrivrutiner i användarutrymme, använt för direkt PCIe-tilldelning till VM. Använder <code>vfio</code>, <code>vfio_iommu_type1</code> och <code>vfio_pci</code> med konfiguration i <code>/etc/modprobe.d/vfio.conf</code>.",
+      "seeAlso": [
+        {
+          "label": "Post-Install: Virtualisering",
+          "href": "/docs/post-install/virtualization"
+        }
+      ]
+    },
+    {
+      "term": "VirtIO",
+      "category": "Virtualisering",
+      "definitionRich": "Familj av paravirtualiserade drivrutiner för nätverk, lagring, dynamisk minneshantering och GPU. Undviker overhead från emulerad äldre hårdvara som e1000 eller IDE. Gästen behöver motsvarande drivrutiner: inbyggda i Linux och tillgängliga som separat ISO för Windows."
+    },
+    {
+      "term": "VLAN",
+      "aliases": [
+        "Virtuellt LAN"
+      ],
+      "category": "Nätverk",
+      "definitionRich": "802.1Q-taggar som delar ett fysiskt nätverk i flera logiska nät. Konfigureras per brygga eller nätverksgränssnitt i <code>/etc/network/interfaces</code>."
+    },
+    {
+      "term": "VM",
+      "aliases": [
+        "Virtuell maskin"
+      ],
+      "category": "Proxmox",
+      "definitionRich": "Virtuell maskin som Proxmox hanterar med QEMU/KVM och som kör en egen gästkärna. Dess numeriska VMID motsvarar <code>/etc/pve/qemu-server/&lt;VMID&gt;.conf</code>. Har vanligen högre overhead än LXC, med isolering genom en separat kärna.",
+      "seeAlso": [
+        {
+          "label": "Hantera virtuella maskiner och containrar",
+          "href": "/docs/help-info/vm-ct-commands"
+        }
+      ]
+    },
+    {
+      "term": "vzdump",
+      "category": "Proxmox",
+      "definitionRich": "Proxmox säkerhetskopieringsverktyg för VM och CT. Filarkiv är <strong>inte inkrementella</strong>; PBS-mål stöder inkrementella överföringar. Jobb konfigurerar läge (snapshot / suspend / stop), komprimering (som zstd, gzip eller lzo), bevarande och aviseringar.",
+      "seeAlso": [
+        {
+          "label": "Kommandon för säkerhetskopiering och återställning",
+          "href": "/docs/help-info/backup-commands"
+        }
+      ]
+    },
+    {
+      "term": "ZFS",
+      "aliases": [
+        "Zettabyte File System"
+      ],
+      "category": "Lagring",
+      "definitionRich": "Filsystem och volymhanterare med ögonblicksbilder, send/receive-replikering, kontrollsummor och komprimering. Kan reparera skadade data om en giltig redundant kopia finns. Läscachen <strong>ARC</strong> använder RAM och kan begränsas.",
+      "seeAlso": [
+        {
+          "label": "Kommandon för ZFS-hantering",
+          "href": "/docs/help-info/zfs-commands"
+        }
+      ]
+    }
+  ]
+}
diff --git a/web/messages/sv/docs/hardware/coral-tpu-lxc.json b/web/messages/sv/docs/hardware/coral-tpu-lxc.json
new file mode 100644
index 00000000..af76627f
--- /dev/null
+++ b/web/messages/sv/docs/hardware/coral-tpu-lxc.json
@@ -0,0 +1,120 @@
+{
+  "meta": {
+    "title": "Lägg till Coral TPU i LXC | ProxMenux-dokumentation",
+    "description": "Dela Google Coral TPU via USB eller M.2 / PCIe med en Proxmox-LXC. ProxMenux konfigurerar enheter, behörigheter och monteringar, startar containern och installerar Edge TPU-körmiljön på kompatibla distributioner."
+  },
+  "header": {
+    "title": "Lägg till Coral TPU i LXC",
+    "description": "Dela Coral USB Accelerator eller M.2 / Mini-PCIe med en LXC. ProxMenux hanterar containerkonfiguration och Edge TPU-körmiljö. Alternativet gäller bara TPU; för Quick Sync, VA-API eller NVENC kör du även Lägg till GPU i LXC.",
+    "section": "Hårdvara: GPU:er och Coral-TPU"
+  },
+  "intro": {
+    "title": "Vad det gör",
+    "body": "Skriver konfigurationen i <code>/etc/pve/lxc/&lt;ctid&gt;.conf</code> för <strong>USB Accelerator</strong>, <strong>M.2 / PCIe Coral</strong> eller båda. Startar containern och installerar Googles <code>libedgetpu</code>-körmiljö. GPU konfigureras separat via <lxcGpuLink>Lägg till GPU i LXC</lxcGpuLink>."
+  },
+  "whenUse": {
+    "heading": "När det används",
+    "body": "För <frigateLink>Frigate</frigateLink> eller en annan kompatibel Linux-app i LXC. Coral utför ML-inferens som stöds i stället för CPU:n. Prestanda beror på modell och hårdvara; videoavkodning och andra uppgifter använder fortfarande resurser."
+  },
+  "prereqs": {
+    "title": "Innan du börjar",
+    "drivers": "<strong>Förbered Coral-enheten på värden</strong>. M.2 / PCIe kräver att värddrivrutinen är laddad; USB kräver enhetsåtkomst och rätt behörigheter. Se <hostLink>Installera Coral TPU på värden</hostLink>. Skriptet installerar appens körmiljö i Debian/Ubuntu-containrar; andra distributioner måste tillhandahålla den separat.",
+    "driversCheck": "ls /dev/apex_* 2>/dev/null ; lsusb | grep -E '1a6e:089a|18d1:9302'",
+    "container": "<strong>En befintlig LXC</strong>, helst baserad på <strong>Debian / Ubuntu</strong>: installationen använder <code>apt-get</code>. <strong>Containrar med andra distributioner</strong> kan välja <strong>läge med enbart enhetsåtkomst</strong>, som hoppar över APT-installationen av <code>libedgetpu</code>. Passar om appen redan innehåller körmiljön, som Frigates Docker-avbildning.",
+    "downtime": "<strong>Planera ett kort driftstopp</strong> för containern. Skriptet stoppar den för konfiguration och startar den för installation av körmiljön. Dessa ändringar kräver ingen omstart av värden."
+  },
+  "hostPrep": {
+    "title": "Förbered värden först",
+    "body": "M.2 / PCIe behöver <code>gasket</code>/<code>apex</code> på värden och en fungerande enhetsnod. USB behöver ansluten enhet och behörigheter; appen behöver inte köras på värden. <code>libedgetpu</code> måste finnas där appen körs. Ordning: <strong>förbered värden → LXC-enhetsåtkomst → konfigurera appen</strong>."
+  },
+  "running": {
+    "heading": "Kör skriptet",
+    "body": "Öppna <strong>Hårdvara: GPU och Coral-TPU → Lägg till Coral TPU i LXC</strong> i ProxMenux.",
+    "imageAlt": "Alternativet Lägg till Coral TPU i LXC i hårdvarumenyn"
+  },
+  "howRuns": {
+    "heading": "Så fungerar skriptet",
+    "body": "Välj container. Skriptet konfigurerar USB-åtkomst även utan ansluten USB-Coral och lägger till M.2 / PCIe när den hårdvaran upptäcks."
+  },
+  "walkthrough": {
+    "heading": "Steg för steg",
+    "pick": {
+      "title": "Välj LXC-container",
+      "body": "Väljaren visar lämpliga containrar från <code>pct list</code>; OCI-containrar döljs och hanteras via Apps i OCI-hanteraren. Välj en körande eller stoppad container. Skriptet stoppar den vid behov, konfigurerar den och startar den för installation av körmiljön."
+    },
+    "gpuHint": {
+      "title": "Valfritt förslag om GPU-åtkomst",
+      "body": "Om en GPU hittas men inte är konfigurerad för den här containern rekommenderar en dialog <lxcGpuLink>Lägg till GPU i LXC</lxcGpuLink> för hårdvaruavkodning av video, som Quick Sync, VA-API eller NVENC. Den frågar om installationen ska fortsätta med enbart Coral: Ja fortsätter TPU-konfigurationen, Nej avslutar så att du kan konfigurera GPU:n först."
+    },
+    "usb": {
+      "title": "Konfigurera USB-åtkomst i LXC",
+      "body": "Skapar en udev-regel på värden för <code>/dev/coral</code> och bind-monterar <strong>hela</strong> <code>/dev/bus/usb</code> i containern. Konfigurationen skrivs även utan ansluten USB-Coral och exponerar fler enheter än bara Coral.",
+      "whyTitle": "Varför montera /dev/bus/usb istället för /dev/coral?",
+      "whyBody": "USB-sökvägen, exempelvis <code>/dev/bus/usb/001/005</code>, ändras vid återanslutning. Äldre versioner monterade länken <code>/dev/coral</code> och kunde behålla en inaktuell sökväg. Hela USB-trädet gör den aktuella enhetsnoden synlig. Appen kan fortfarande behöva öppna enheten igen."
+    },
+    "pcie": {
+      "title": "Konfigurera M.2 / PCIe-åtkomst i LXC",
+      "body1": "Om M.2 / PCIe-Coral hittas och <code>/dev/apex_0</code> finns används Proxmox API <code>dev</code> för cgroup2-behörigheter i privilegierade och oprivilegierade LXC:",
+      "body2": "Om <code>/dev/apex_0</code> saknas efter <hostLink>Installera Coral på värden</hostLink> skriver skriptet en bind-montering med <code>create=file</code> och, endast när apex-majornumret finns listat i <code>/proc/devices</code>, en klassisk cgroup2-regel. Ingen av dem skapar en fungerande enhet:",
+      "rebootTitle": "Starta om värden först om du nyss installerat Coral-drivrutiner",
+      "rebootBody": "Reservmonteringen laddar inte värdens <code>apex</code>-drivrutin. Ladda den eller starta om efter installationen och kontrollera enheten. Kör sedan skriptet igen för den moderna enhetsposten och starta om containern."
+    },
+    "drivers": {
+      "title": "Starta LXC och installera Coral-körmiljön",
+      "body": "Startar containern och väntar upp till 15 sekunder på statusen running, och kör sedan installationen inuti med <code>pct exec</code>. Installeraren:",
+      "items": [
+        "Kör <code>apt-get update</code>.",
+        "Installerar förutsättningarna för Coral-paketförrådet: <code>gnupg</code>, <code>curl</code> och <code>ca-certificates</code>.",
+        "Importerar Googles Coral-GPG-nyckel till <code>/etc/apt/keyrings/coral-edgetpu.gpg</code>, samma sökväg som värdinstallationen, och lägger till APT-förrådet <code>coral-edgetpu-stable</code> med <code>signed-by=</code>.",
+        "Installerar <code>libedgetpu1-std</code> som standard. Om M.2-Coral hittas erbjuds <code>libedgetpu1-std</code> eller <code>libedgetpu1-max</code>. Paketvalet konfigurerar inte i sig appens detekteringsinställningar."
+      ],
+      "noIgpuTitle": "Varför installeras inga iGPU-drivrutiner här?",
+      "noIgpuBody": "Tidigare installerades även <code>va-driver-all</code>, <code>intel-opencl-icd</code> och andra Intel-paket för Quick Sync tillsammans med Coral. Det gav förvirrande fel när bara Coral önskades. iGPU konfigureras nu via <lxcGpuLink>Lägg till GPU i LXC</lxcGpuLink>; kör det först om du vill ha hårdvaruavkodning av video.",
+      "debianTitle": "Andra distributioner: enbart enhetsåtkomst",
+      "debianBody": "Använder <code>apt-get</code> på Debian/Ubuntu. För <strong>Alpine, Arch, RHEL eller SUSE</strong>, identifierade via <code>/etc/os-release</code>, erbjuds <em>fortsätt med enbart enhetsåtkomst</em> eller <em>avbryt</em>. Det första konfigurerar <code>/etc/pve/lxc/&lt;ctid&gt;.conf</code> utan att installera <code>libedgetpu</code>. Läget passar när appen redan innehåller körmiljön, som Frigate Docker. Installera annars <code>libedgetpu</code> enligt <coralLink>Googles officiella guide</coralLink>."
+    },
+    "summary": {
+      "title": "Sammanfattning",
+      "body": "Till sist visas Coral USB och M.2 med ✓ eller ⚠ beroende på upptäckt hårdvara. Containern fortsätter köra så att du kan konfigurera Frigate, CodeProject.AI eller din app."
+    }
+  },
+  "manual": {
+    "heading": "Motsvarande manuella steg",
+    "body": "Om du vill se exakt vad som går in i LXC-konfigen eller tillämpa den för hand:",
+    "usbHeading": "USB Coral",
+    "pcieHeading": "M.2 / PCIe Coral",
+    "runtimeHeading": "I containern: Coral-körmiljö"
+  },
+  "verification": {
+    "heading": "Verifiering",
+    "body": "Öppna ett skal i containern och kontrollera att Coral syns:"
+  },
+  "troubleshoot": {
+    "heading": "Felsökning",
+    "apexTitle": "LXC har startat men /dev/apex_0 saknas",
+    "apexBody": "Kontrollera först värdens drivrutin: <code>lsmod | grep apex</code>. Om den saknas, prova <code>modprobe apex</code> eller starta om efter installationen av drivrutinen. När <code>/dev/apex_0</code> finns på värden, kontrollera LXC-enhetsposten (kör skriptet igen om bara reservposterna skrevs) och starta om containern med <code>pct stop &lt;ctid&gt; &amp;&amp; pct start &lt;ctid&gt;</code>.",
+    "replugTitle": "USB-Coral försvinner efter återanslutning till en annan port",
+    "replugBody": "Kontrollera att LXC monterar <code>/dev/bus/usb</code> i stället för länken <code>/dev/coral</code>. Konfigurationen ska innehålla <code>lxc.mount.entry: /dev/bus/usb dev/bus/usb ...</code> utan direkt beroende av <code>/dev/coral</code>. Kör skriptet igen om konfigurationen är gammal.",
+    "alpineTitle": "Alpine / Arch / RHEL / SUSE: körmiljö inte installerad",
+    "alpineBody": "<em>Läget med enbart enhetsåtkomst</em> konfigurerar enheten utan att installera <code>libedgetpu</code>. Använd ett kompatibelt communitypaket eller bygg från källkod; kontrollera tillgängligheten före kommandon som <code>apk add</code> i Alpine. Frigate kan innehålla körmiljön. Med Docker i LXC måste M.2 även vidarebefordras med <code>--device /dev/apex_0:/dev/apex_0</code>, eller USB monteras i Docker: enbart LXC-monteringen räcker inte.",
+    "frigateTitle": "Frigate visar ”Coral EdgeTPU detected but not available”",
+    "frigateBody": "Kontrollera körmiljö, enhetssynlighet och läs-/skrivåtkomst för appens faktiska process. För USB, kontrollera behörigheter och eventuellt <code>plugdev</code>-medlemskap. För M.2, granska <code>/dev/apex_0</code> med <code>ls -l /dev/apex_0</code>. Ett namn som <code>apex</code> i <code>/etc/group</code> räcker inte: numeriska GID och LXC-mappning måste stämma. Kontrollera även om en annan process använder TPU:n; byt inte först till privilegierat läge.",
+    "logsTitle": "Kontrollera både värd- och containerloggar",
+    "logsBody": "På värden, granska kärnmeddelanden med <code>journalctl -k | grep -i -e apex -e gasket -e usb</code>. I LXC, läs apploggarna; med nästlad Docker använd <code>docker logs &lt;container&gt;</code>. Behörigheter, saknad körmiljö, USB-anslutning eller en annan process som använder TPU:n kan orsaka fel."
+  },
+  "related": {
+    "heading": "Relaterat",
+    "items": [
+      {
+        "label": "Installera Coral TPU på värden",
+        "href": "/docs/hardware/install-coral-tpu-host",
+        "tail": " — förutsättning för att använda M.2 / PCIe-Coral i en CT."
+      },
+      {
+        "label": "Lägg till GPU i LXC",
+        "href": "/docs/hardware/igpu-acceleration-lxc",
+        "tail": " — GPU-åtkomst, som ofta kombineras med Coral i Frigate."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sv/docs/hardware/gpu-vm-passthrough.json b/web/messages/sv/docs/hardware/gpu-vm-passthrough.json
new file mode 100644
index 00000000..ffafba3a
--- /dev/null
+++ b/web/messages/sv/docs/hardware/gpu-vm-passthrough.json
@@ -0,0 +1,178 @@
+{
+  "meta": {
+    "title": "Lägg till GPU i VM | ProxMenux-dokumentation",
+    "description": "Tilldela en fysisk GPU till en Proxmox-VM. ProxMenux kontrollerar IOMMU, konfigurerar VFIO och VM-enheter samt upptäcker konflikter med andra VM:er eller LXC."
+  },
+  "header": {
+    "title": "Lägg till GPU till VM (Passthrough)",
+    "description": "Identifierar Intel-, AMD- eller NVIDIA-GPU:er för direkt åtkomst från en VM. Kontrollerar IOMMU och tillhörande enheter, konfigurerar VFIO och VM samt tillämpar kompatibilitetsregler. Kontrollera alla berörda enheter.",
+    "section": "Hårdvara: GPU:er och Coral-TPU"
+  },
+  "intro": {
+    "title": "Vad det gör",
+    "body": "Automatiserar värd- och <code>hostpci</code>-stegen i <pveLink>Proxmox-dokumentationen för PCI-passthrough</pveLink>. Kontrollerar tilldelningar i <em>andra</em> gäster och erbjuder konflikthantering. Garanterar inte stöd för varje GPU, återställningsmetod eller gästdrivrutin."
+  },
+  "who": {
+    "heading": "Vem är detta för?",
+    "body": "För direkt GPU-åtkomst från en <strong>virtuell maskin</strong> via VFIO. Så länge GPU:n är bunden till VFIO kan värdens drivrutin inte använda den, även med stoppad VM. För delning med <em>LXC</em>, använd <lxcLink>Lägg till GPU i LXC</lxcLink>."
+  },
+  "prereqs": {
+    "title": "Innan du börjar",
+    "gpu": "Fysiskt installerad <strong>kompatibel GPU</strong>. Skriptet hittar Intel, AMD och NVIDIA med <code>lspci</code>.",
+    "gpuCheck": "lspci | grep -iE 'VGA|3D|Display'",
+    "iommu": "<strong>IOMMU-stöd</strong> krävs i hårdvara och vid behov firmware (Intel VT-d eller AMD-Vi). Kontrollerar systemet och kan konfigurera Linux; ändrar inte BIOS/UEFI och bevisar inte att inaktiv IOMMU är avstängd där.",
+    "q35": "Guiden kräver <strong>q35</strong> och avvisar <code>i440fx</code>. Maskintyp och BIOS/UEFI är separata inställningar. Byte av chipset på en befintlig VM kräver planering och sker inte automatiskt.",
+    "q35Check": "qm config VMID | grep machine",
+    "moreGpus": "Förbered <strong>en annan GPU eller alternativ åtkomst</strong> via SSH, IPMI eller seriellt. Reserverad primär GPU kan släcka lokal bild. För <em>NVIDIA</em> kan ett kort utanför berörd IOMMU-grupp stanna på värden.",
+    "nvidiaInstalled": "Efter <nvidiaLink>NVIDIA-installation på värden</nvidiaLink> reserveras valda funktioner för <code>vfio-pci</code> i stället för <code>nvidia</code>. Modulen <code>nvidia</code> kan finnas kvar för <strong>andra</strong> kort utanför berörd IOMMU-grupp. Kontrollera med <code>nvidia-smi</code>."
+  },
+  "pickOne": {
+    "title": "Exklusiv VM-tilldelning eller LXC-delning",
+    "body": "En GPU bunden till <code>vfio-pci</code> för VM genomgång kan inte samtidigt användas av värden eller en LXC. Om du har två GPU kan du ägna en till varje väg. Om du bara har en, välj:",
+    "vmItem": "<strong>VM:</strong> direkt och exklusiv åtkomst för den VM:n.",
+    "lxcItem": "<strong>LXC (<lxcLink>Lägg till GPU i LXC</lxcLink>):</strong> delar enheten med värden och andra containrar via den vanliga drivrutinen."
+  },
+  "running": {
+    "heading": "Kör installationen",
+    "body": "Öppna ProxMenux och välj <strong>Hårdvara: GPU:er och Coral-TPU → Lägg till GPU i VM</strong>.",
+    "imageAlt": "Menyval för att lägga till GPU i VM"
+  },
+  "howRuns": {
+    "heading": "Så fungerar skriptet",
+    "body": "Identifiering och val föregår huvudändringarna, som bekräftas i en sammanfattning. Aktivering av IOMMU har en tidigare egen bekräftelse och kan redan ändra startkonfigurationen. Senare ljudrensning kan också kräva ett val."
+  },
+  "walkthrough": {
+    "heading": "Steg för steg",
+    "detect": {
+      "title": "Upptäck GPU och kontrollera IOMMU",
+      "body": "Betraktar IOMMU som aktivt endast när den körande kärnan har <code>intel_iommu=on</code> eller <code>amd_iommu=on</code> och IOMMU-grupper finns. Om parametern redan är sparad för nästa start fortsätter den i läget väntande omstart; annars kan ett separat bekräftat steg lägga till den med <code>iommu=pt</code>. Dess heuristik för startfilen använder <code>/etc/kernel/cmdline</code> när en ZFS-rotmarkör som <code>root=ZFS=</code> finns där; annars används <code>/etc/default/grub</code>. Heuristiken bevisar inte vilken starthanterare som faktiskt används. Nykonfigurerad IOMMU börjar gälla efter omstart; kontrollera de faktiska grupperna efteråt.",
+      "tipTitle": "Har du redan gjort efterinstallationen?",
+      "tipBody": "Om <postLink>VFIO IOMMU-stöd</postLink> redan är inställt och aktivt i kerneln godkänns kontrollen. En inställning för nästa start bevisar inte att det är aktivt nu.",
+      "imageAlt": "Lista över upptäckta GPU med leverantör och PCI-adress"
+    },
+    "preflight": {
+      "title": "Välj GPU och kör förkontroller",
+      "intro": "När du väljer GPU kör manuset en serie kontroller som kan varje blockera ytterligare framsteg:",
+      "items": [
+        "<strong>SR-IOV-kontroll.</strong> Avvisar VF:er och PF:er med aktiva VF:er eftersom flödet tilldelar hela enheter, inte konfigurerar SR-IOV. Ställ in SR-IOV separat på kompatibel hårdvara.",
+        "<strong>En enda GPU.</strong> Den lokala konsolen kan förlora bildutmatningen när VFIO reserverar GPU:n. Kontrollera först SSH- eller webbåtkomst från en annan dator.",
+        "<strong>AMD-policy för återställning.</strong> Läser <code>/sys/bus/pci/devices/&lt;pci&gt;/reset_method</code>. APU eller separat kort utan FLR <em>blockeras av guidens policy</em>; okänd undertyp utan FLR kräver bekräftelse. Det bevisar inte att funktionen är omöjlig i alla miljöer.",
+        "<strong>D3cold-läge.</strong> Guiden blockerar AMD-kort som rapporterar <code>D3cold</code> på grund av risk för aktiveringsfel. Kontrollera strömhantering och firmware.",
+        "<strong>Analys av IOMMU-grupp.</strong> Läser <code>/sys/kernel/iommu_groups/</code> och tar med <em>alla medlemmar utom bryggor</em> i VM-planen, möjligen nätverks- eller lagringskontroller. Om gruppen innehåller enheter från en annan PCI-plats listar skriptet dem före sammanfattningen; kontrollera att värden inte behöver någon av dem. Om IOMMU väntar på omstart är de faktiska grupperna inte tillgängliga och planen innehåller först bara den valda GPU-funktionen; kontrollera isoleringen efter omstarten."
+      ],
+      "audioIntro": "<strong>Tillhörande ljud.</strong> Två fall beroende på var kontrollern finns:",
+      "audioDgpu": "<strong>Separat GPU:</strong> HDMI-ljud finns ofta på funktion <code>.1</code> i samma PCI-plats och tas med om det hittas. Om värden använde ljudet förlorar den åtkomsten när det reserveras för VM:n.",
+      "audioIgpu": "<strong>Utan ljudfunktion <code>.1</code>:</strong> kan ljudet finnas på en annan enhet som <code>00:1f.3</code>. Listar kontroller och drivrutiner, exempelvis <code>snd_hda_intel</code>. Som standard väljs <strong>ingen</strong>; välj bara de som behövs."
+    },
+    "pickVm": {
+      "title": "Välj mål-VM",
+      "body": "Välj VM i listan. Kräver q35 och återanvänder befintliga GPU-poster där det går. BIOS/UEFI är en separat inställning, inte en maskintyp. Chipset och gästsystemets startläge ändras inte automatiskt.",
+      "imageAlt": "Val av VM efter namn, ID och status"
+    },
+    "switchMode": {
+      "title": "Hantera befintliga tilldelningar",
+      "intro": "Manuset skannar varje VM-konfig och varje LXC-konfig på värden som letar efter GPU du valde. Tre möjliga resultat:",
+      "items": [
+        "<strong>GPU tillgänglig.</strong> Fortsätter utan att ta bort tilldelningar.",
+        "<strong>Tilldelad till en annan VM.</strong> Stoppa först källan. Välj <em>behåll poster och inaktivera automatisk start</em> eller <em>ta bort poster och behåll automatisk start</em>. Med aktiv <code>vfio-pci</code> utan nödvändiga värdändringar kan VM→VM ske utan omstart av värden.",
+        "<strong>GPU som används av LXC.</strong> För vanliga containrar, välj <em>behåll GPU-konfigurationen och inaktivera automatisk start</em> eller <em>ta bort GPU-enhetskonfigurationen och behåll automatisk start</em>. Borttagningen raderar <code>devN</code>-posterna och, för AMD/Intel, även äldre <code>/dev/dri</code>-regler för <code>lxc.mount.entry</code> och <code>lxc.cgroup2.devices.allow</code>. OCI-containrar behåller sin konfiguration och stoppas med automatisk start inaktiverad; ta bort deras GPU via OCI manager Apps. Konfliktidentifieringen sker per GPU-enhetsfamilj och kan omfatta andra kort i samma familj."
+      ],
+      "imageAlt": "Dialog erbjudande att ta bort GPU från en LXC innan tilldela den till VM",
+      "smartTitle": "Granska tillhörande ljud när GPU:n tas bort",
+      "smartBody": "Därefter kan en lista med <strong>möjligen oanvända ljudenheter</strong> i käll-VM:n visas. Avmarkera sådant som fortfarande behövs. Exempelvis kan <code>02:00.1</code> behållas medan <code>00:1f.3</code> föreslås tas bort. Valet styr borttagningen; alla ljud-/bildkopplingar är inte garanterade."
+    },
+    "audioPick": {
+      "title": "Välj nödvändiga kontroller om .1-ljud saknas",
+      "body": "Det händer bara för Intel iGPU och liknande uppsättningar av split-audio. En checklista visar varje PCI ljudkontroll på värden (exklusive någon redan i GPU IOMMU grupp), märkt med sin nuvarande drivrutin. Välj de du vill - eller ingen, om VM inte behöver ljud från värd hårdvaran.",
+      "imageAlt": "Checklista dialog med varje värd PCI ljudkontroller (BDF + förare) när GPU har ingen .1 syskon ljud",
+      "warnTitle": "Välj inte ljud som värden behöver",
+      "warnBody": "Ljudtilldelning kan ta bort värdens åtkomst; kontrollern kan inte samtidigt tillhöra en annan aktiv VM. Lämna onödigt ljud omarkerat och kontrollera tilldelningarna. Konsolens pip kommer inte nödvändigtvis från PCI-ljud."
+    },
+    "summary": {
+      "title": "Granska bekräftelse sammanfattning",
+      "body": "Granska den slutliga planen för värd och VM och avbryt om den är fel. Den visar IOMMU-gruppen och antalet enheter i den; medlemmar från en annan PCI-plats listas i föregående steg. Att avbryta stoppar huvudändringarna men återställer inte en tidigare separat bekräftad ändring av IOMMU-startkonfigurationen.",
+      "imageAlt": "Översikt över planerade ändringar på värd och VM"
+    },
+    "hostApply": {
+      "title": "Värdförändringar tillämpas",
+      "intro": "Tillämpningsfasen ändrar värd och VM. Tillhörande ljudrensning kan fortfarande kräva ett val. Möjliga ändringar:",
+      "items": [
+        "<code>/etc/modules</code> - tillägg <code>vfio</code>, <code>vfio_iommu_type1</code>, <code>vfio_pci</code> (plus) <code>vfio_virqfd</code> på Kernels &lt; 6.2).",
+        "<code>/etc/modprobe.d/vfio.conf</code> — AMD/Intel: <code>options vfio-pci ids=&lt;vendor:device,...&gt; disable_vga=1</code>. NVIDIA: <code>softdep nvidia pre: vfio-pci</code> (<code>_drm</code>/<code>_modeset</code>/<code>_uvm</code>); den faktiska bindningen sker per BDF. AMD lägger till inläsningsordningen <code>softdep</code>: <code>vfio-pci</code> → <code>radeon</code>/<code>amdgpu</code>.",
+        "Skriver <code>/etc/modprobe.d/iommu_unsafe_interrupts.conf</code> och <code>kvm.conf</code> med <code>allow_unsafe_interrupts=1</code> och <code>ignore_msrs=1</code>. Detta är skriptets kompatibilitetsval, inga universella Windows/macOS-krav; osäkra avbrott försvagar avbrottsomappningens skydd.",
+        "<code>/etc/modprobe.d/blacklist.conf</code>: NVIDIA — <code>nouveau</code>/<code>lbm-nouveau</code>; AMD — <code>radeon</code> + <code>amdgpu</code>; Intel — <code>i915</code>. Dessa regler per tillverkare kan påverka andra kort med samma drivrutin. Modulen <code>nvidia</code> blockeras <strong>bara</strong> via <code>/etc/modprobe.d/proxmenux-nvidia-vfio-blacklist.conf</code> när <em>alla</em> värdens NVIDIA-kort är registrerade för VFIO.",
+        "<code>/etc/udev/rules.d/10-proxmenux-vfio-bind.rules</code> + <code>/etc/proxmenux/vfio-bind.bdfs</code> — <strong>Endast NVIDIA.</strong> Sätter <code>ATTR'{'driver_override'}'=\"vfio-pci\"</code> vid PCI ADD för registrerade BDF:er, inklusive berörda IOMMU-gruppfunktioner. Utanför grupperna kan <code>nvidia</code> behållas. BDF-policy delar inte upp hårdvarans IOMMU-grupp.",
+        "<strong>Endast AMD.</strong> Försöker dumpa ROM från <code>/sys/bus/pci/.../rom</code> eller ACPI VFCT till <code>/usr/share/kvm/vbios_&lt;vendor&gt;_&lt;device&gt;.bin</code>. Vid framgång använder VM:en <code>romfile=</code>. En giltig dump garanterar inte att GPU-initialiseringen lyckas.",
+        "<strong>Endast NVIDIA.</strong> Stoppar och inaktiverar <code>nvidia-persistenced</code>, <code>nvidia-powerd</code>, <code>nvidia-fabricmanager</code> bara när alla NVIDIA-kort reserverats för VFIO. Vid blandad användning behålls tjänsterna och <code>nvidia</code> för vanliga värdkort.",
+        "<code>update-initramfs -u -k all</code> - körs endast om något av ovanstående faktiskt ändrats."
+      ]
+    },
+    "vmApply": {
+      "title": "VM konfig appliceras via qm set",
+      "body": "VM-konfig på <code>/etc/pve/qemu-server/&lt;vmid&gt;.conf</code> uppdateras via <code>qm set</code> (aldrig via direkt <code>sed</code>):",
+      "after1": "Lägger till <code>x-vga=1</code> för AMD och NVIDIA, <strong>inte</strong> Intel. Det är skriptets policy, inget bevis för att alla Intel-iGPU:er saknar firmware eller att flaggan alltid orsakar låsningar.",
+      "after2": "Ytterligare <code>hostpciN</code>-linjer läggs till om GPUs IOMMU-grupp innehåller andra enheter du behöver för att passera tillsammans."
+    },
+    "reboot": {
+      "title": "Starta om när värdändringen kräver det",
+      "body": "Följ omstartsanvisningen vid ändringar av start eller drivrutiner och kontrollera aktiv GPU-bindning före VM-start. Sparad konfiguration bevisar inte att den är aktiv. VM→VM med rätt VFIO-läge kan slippa värdomstart.",
+      "imageAlt": "Sammanfattning skärmen visar vad som ändrades, följt av en omstart prompt"
+    }
+  },
+  "vendors": {
+    "heading": "Anmärkningar per tillverkare",
+    "nvidiaHeading": "NVIDIA",
+    "nvidiaBody": "Behåller en äldre lösning för <em>Code 43</em>: <code>hidden=1</code>, ID <code>NV43FIX</code> i <code>args</code> och <code>kvm=off</code>. Inget universellt krav för moderna GeForce-drivrutiner: NVIDIA aktiverade Windows-VM-passthrough i R465. Felet kan ha andra orsaker; kontrollera GPU och drivrutin.",
+    "nvidiaMultiHeading": "Multi-GPU NVIDIA stöd",
+    "nvidiaMultiBody": "Blandad NVIDIA-användning <strong>per BDF</strong>. Registrerar <code>vfio-pci</code>-funktioner efter adress, inte bara ID <code>vendor:device</code>. Utanför berörda grupper kan <code>nvidia</code> behållas; kontrollera med <code>nvidia-smi</code>. Isolerar inte två kort i samma grupp.",
+    "amdHeading": "AMD",
+    "amdBody": "Vissa AMD-GPU:er misslyckas med återställning efter VM-stopp. Guiden kontrollerar rapporterade egenskaper, inte alla verkliga cykler. <vendorResetLink>vendor-reset</vendorResetLink> stöder en begränsad lista och kräver kompatibel kernel samt tidig inläsning; installeras inte automatiskt. Även <em>RadeonResetBugFix</em> för Windows är hårdvaruberoende, utan allmän garanti.",
+    "intelHeading": "Intel iGPU",
+    "intelBody": "Full Intel-iGPU-passthrough och SR-IOV är skilda flöden. Guiden reserverar hela enheten för en VM utan <code>x-vga=1</code>. <sriovLink>i915-sriov-dkms</sriovLink> kräver kompatibel hårdvara och kernel; ”UHD 630+” är ingen kompatibilitetsregel. Planera alternativ värdåtkomst."
+  },
+  "verification": {
+    "heading": "Verifiering"
+  },
+  "troubleshoot": {
+    "heading": "Felsökning",
+    "code43Title": "Kod 43 i Windows (NVIDIA)",
+    "code43Body": "Code 43 bevisar inte att KVM-döljning misslyckats. Granska <code>qm config VMID | grep -E \"cpu|args\"</code> med rätt VMID samt <code>hidden=1</code> och <code>hv_vendor_id=NV43FIX</code>. Kontrollera även gästdrivrutin, firmware och tilldelning. En ny körning kan avslutas direkt vid befintlig tilldelning.",
+    "amdResetTitle": "AMD GPU fungerar en gång, misslyckas på VM omstart",
+    "amdResetBody": "Ett återställningsfel är en möjlig orsak. Omstart eller av-/påslagning kan hjälpa tillfälligt. Kontrollera stöd och tidig inläsning av <code>vendor-reset</code>; enbart <code>softdep amdgpu pre: vendor-reset</code> garanterar inte inläsning före VFIO. Även <em>RadeonResetBugFix</em> kräver kompatibel GPU.",
+    "stuckBootTitle": "VM fastnade start / GPU inte upptäckt",
+    "stuckBootBody": "Kontrollera den verkliga adressen med <code>lspci -nnk -s PCI_ADDRESS</code>; förvänta <code>Kernel driver in use: vfio-pci</code>. Ersätt PCI_ADDRESS. Om vanlig drivrutin är aktiv, granska bindningspolicyn, inte bara <code>/etc/modprobe.d/blacklist.conf</code>; NVIDIA använder BDF-status. Läs <code>dmesg | grep vfio</code>. Efter rättning, kör <code>update-initramfs -u -k all</code> och följ omstartsplanen.",
+    "darkTitle": "Värd konsol går mörkt efter omstart och jag kan inte SSH",
+    "darkBody": "Svart bild bevisar inte att värden är avstängd. Om även SSH misslyckas, kontrollera nätverk och kontroller i IOMMU-gruppen. Återfå åtkomst via IPMI, seriell konsol eller räddningsmiljö; granska <code>/etc/pve/qemu-server/&lt;vmid&gt;.conf</code> och återställ bara berörda tilldelningar och regler. Radera inte annan konfiguration.",
+    "logTitle": "Kolla installationsloggen",
+    "logBody": "Varje körning skriver <code>/tmp/add_gpu_vm.log</code>. Bifoga loggen när du söker hjälp."
+  },
+  "revert": {
+    "heading": "Återställ ändringar manuellt",
+    "intro": "Stoppa VM:n och ta bara bort berörda PCI-tilldelningar under Hårdvara eller med det uttryckliga indexet nedan. Det lämnar inte tillbaka GPU:n till värdens drivrutin. Använd Byt GPU-läge för det steget och kontrollera berörda gäster före bekräftelse."
+  },
+  "related": {
+    "heading": "Relaterat",
+    "items": [
+      {
+        "label": "Installera NVIDIA Drivers (Host)",
+        "href": "/docs/hardware/nvidia-host",
+        "tail": " — förbered drivrutinen för kort som stannar på värden; en VFIO-bunden GPU kan inte använda den samtidigt."
+      },
+      {
+        "label": "Lägg till GPU i LXC",
+        "href": "/docs/hardware/igpu-acceleration-lxc",
+        "tail": " - alternativ modell: dela GPU med flera containrar istället för att dedikera den till en VM."
+      },
+      {
+        "label": "Byt GPU-läge (VM ↔ LXC)",
+        "href": "/docs/hardware/switch-gpu-mode",
+        "tail": " — växla samma GPU mellan delning och exklusiv tilldelning."
+      },
+      {
+        "label": "GPU Passthrough kommandon",
+        "href": "/docs/help-info/gpu-commands",
+        "tail": " - lspci, IOMMU-verifiering, qm set hostpci referens."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sv/docs/hardware/igpu-acceleration-lxc.json b/web/messages/sv/docs/hardware/igpu-acceleration-lxc.json
new file mode 100644
index 00000000..5ceb8dfd
--- /dev/null
+++ b/web/messages/sv/docs/hardware/igpu-acceleration-lxc.json
@@ -0,0 +1,185 @@
+{
+  "meta": {
+    "title": "Lägg till GPU i LXC | ProxMenux-dokumentation",
+    "description": "Dela Intel-, AMD- eller NVIDIA-GPU med LXC. ProxMenux konfigurerar enheter, grupper och bibliotek efter distribution; appen måste stödja och vara inställd för acceleration."
+  },
+  "header": {
+    "title": "Lägg till GPU i LXC",
+    "description": "Delar GPU-åtkomst med LXC via värdens enheter. Drivrutinen finns kvar på värden; apparna behöver kompatibla bibliotek och egna inställningar.",
+    "section": "Hårdvara: GPU:er och Coral-TPU"
+  },
+  "intro": {
+    "title": "Vad det gör",
+    "body": "Lägger till <code>dev&lt;N&gt;</code>-poster i <code>/etc/pve/lxc/&lt;ctid&gt;.conf</code> för tillämpliga <code>/dev/dri/*</code>-, <code>/dev/kfd</code>- eller <code>/dev/nvidia*</code>-noder. Startar containern, installerar userspace-paket för dess distribution och anpassar, för Intel/AMD, grupperna <code>video</code> och <code>render</code>. Appacceleration kräver fortfarande kompatibel hårdvara, bibliotek och appinställningar."
+  },
+  "compare": {
+    "heading": "LXC-delning jämfört med VM-passthrough",
+    "intro": "LXC delar kerneln och kan <em>dela</em> GPU:n mellan värd och containrar. Med <vmLink>fullständig VM-passthrough</vmLink> tillhör enheten bara den VM:n och är inte tillgänglig för värdens drivrutin.",
+    "headerFeature": "Funktion",
+    "headerLxc": "LXC (denna sida)",
+    "headerVm": "VM",
+    "rows": [
+      {
+        "feature": "Värd fortsätter att använda GPU?",
+        "lxc": "Ja",
+        "vm": "Nej – exklusivt för VM"
+      },
+      {
+        "feature": "Flera containrar som delar en GPU?",
+        "lxc": "Ja",
+        "vm": "Nej"
+      },
+      {
+        "feature": "Kräver IOMMU/VFIO på värden?",
+        "lxc": "Nej",
+        "vm": "Ja"
+      },
+      {
+        "feature": "Reboot krävs?",
+        "lxc": "Normalt nej (bara starta om CT)",
+        "vm": "När värdens drivrutin eller IOMMU ändras; inte för varje tilldelning"
+      },
+      {
+        "feature": "Gästoperativsystem",
+        "lxc": "Endast Linux (LXC är Linux-bara)",
+        "vm": "Gästsystem som stöds med en kompatibel GPU-drivrutin"
+      }
+    ]
+  },
+  "prereqs": {
+    "title": "Innan du börjar",
+    "gpu": "<strong>GPU på värden</strong> från Intel, AMD eller NVIDIA, identifierad med <code>lspci</code>.",
+    "gpuCheck": "lspci | grep -iE 'VGA|3D|Display'",
+    "vfio": "<strong>GPU:n får inte vara bunden till vfio-pci.</strong> Den behöver värdens vanliga drivrutin. Vid VM-tilldelning erbjuder skriptet <switchLink>Byt GPU-läge</switchLink>.",
+    "nvidia": "<strong>För NVIDIA:</strong> installera först värdens drivrutin. Containerns bibliotek måste passa versionen. Använd <nvidiaLink>Installera NVIDIA-drivrutiner på värden</nvidiaLink>.",
+    "nvidiaCheck": "nvidia-smi",
+    "container": "<strong>En befintlig LXC-container.</strong> Skriptet skapar ingen. Båda lägena stöds; en <strong>privilegierad</strong> container krävs inte alltid. Enhetsposter och appens numeriska grupprättigheter måste passa."
+  },
+  "unpriv": {
+    "title": "Stöder privilegierade och oprivilegierade containrar",
+    "body": "Skriptet skriver <code>dev&lt;N&gt;</code>-poster till LXC-konfigen och på oprivilegierade behållare anpassar <code>video</code> och <code>render</code> GID mellan värd och behållare så att GPU-enhetsnoderna nås inifrån utan att du behöver handredigera <code>lxc.idmap</code>."
+  },
+  "running": {
+    "heading": "Kör installationen",
+    "body": "Öppna ProxMenux och välj <strong>Hårdvara: GPU:er och Coral-TPU → Lägg till GPU i LXC</strong>.",
+    "imageAlt": "Menyval för att lägga till GPU i LXC"
+  },
+  "howRuns": {
+    "heading": "Så fungerar skriptet",
+    "body": "Välj container och GPU-familjer och gå igenom kontrollerna. Därefter stoppas och ändras containern utan ytterligare slutbekräftelse. Valfri VFIO-rensning bekräftas separat och kan ändra värden tidigare."
+  },
+  "walkthrough": {
+    "heading": "Steg för steg",
+    "detect": {
+      "title": "Identifiera värdens GPU:er",
+      "body": "Söker GPU-kontroller med <code>lspci</code>. För NVIDIA kontrolleras modulen <code>nvidia</code> och <code>nvidia-smi</code>; den upptäckta versionen styr containerns <code>.run</code>-installation.",
+      "tipTitle": "NVIDIA är inte redo?",
+      "tipBody": "Om modulen saknas eller NVIDIA inte fungerar på värden, använd först <nvidiaLink>Installera NVIDIA-drivrutiner på värden</nvidiaLink> och kontrollera drivrutinen."
+    },
+    "pickCt": {
+      "title": "Välj en LXC-container",
+      "body": "Listar lämpliga LXC-containrar med ID och namn; OCI-containrar undantas och använder OCI manager Apps för enheter. Containern stoppas om den körs, startas för installation av drivrutiner och återgår normalt till sitt ursprungliga läge (igång/stoppad).",
+      "imageAlt": "Val av en befintlig LXC-container"
+    },
+    "selectGpu": {
+      "title": "Välj GPU-familjer",
+      "body": "Listan väljer tillverkarfamiljer, inte en isolerad PCI-enhet. Intel/AMD lägger till avsedda DRI-noder och NVIDIA sina tillgängliga enheter, ibland för flera kort. En enda familj väljs automatiskt. Kontrollera resultatet, särskilt med flera GPU:er.",
+      "imageAlt": "Lista över upptäckta GPU-familjer med namn och PCI-adress"
+    },
+    "preflight": {
+      "title": "Förkontroller",
+      "imageAlt": "Erbjudande om lägesbyte för en GPU bunden till vfio-pci",
+      "intro": "Tre kontroller, som alla kan blockera eller omdirigera dig:",
+      "items": [
+        "<strong>SR-IOV-kontroll.</strong> Guiden blockerar en VF eller PF med aktiva VF:er. Det beror på dess breda enhetsval och är inget allmänt förbud i LXC. Konfigurera dessa enheter separat.",
+        "<strong>Bunden till vfio-pci.</strong> Den vanliga drivrutinen kan inte skapa <code>/dev/dri/*</code> eller <code>/dev/nvidia*</code>. <switchLink>Byt GPU-läge</switchLink> erbjuds; följ anvisningarna om omstart och återkom sedan.",
+        "<strong>Redan konfigurerad.</strong> Om alla enheter finns avslutas skriptet utan att installera om bibliotek. Fortsätter bara med valda familjer som saknas."
+      ]
+    },
+    "applyConfig": {
+      "title": "Tillämpa ändringarna i LXC-konfigurationen",
+      "body1": "Stoppar containern om den körs och ändrar <code>/etc/pve/lxc/&lt;ctid&gt;.conf</code>. Numrerade <code>dev&lt;N&gt;</code>-poster innehåller värdens GID för <code>video</code> eller <code>render</code>. Befintliga <code>lxc.mount.entry</code>-bindrader för <code>/dev/dri</code> ersätts av <code>dev:</code>-poster; kontrollera slutlig konfiguration och rättigheter.",
+      "body2": "Exempel efter Intel + NVIDIA på samma container:"
+    },
+    "installDrivers": {
+      "title": "Starta containern och installera drivrutiner inuti",
+      "body": "Startar containern och väntar högst cirka 30 sekunder på att <code>pct exec</code> svarar. Läser distributionen från <code>/etc/os-release</code> och installerar lämpliga paket.",
+      "headerDistro": "Distribution",
+      "headerInt": "Intel / AMD",
+      "headerNvidia": "NVIDIA",
+      "rows": [
+        {
+          "distro": "Alpine",
+          "intel": "apk add mesa-va-gallium intel-media-driver libva-utils",
+          "nvidia": "apk add nvidia-utils"
+        },
+        {
+          "distro": "Arch / Manjaro",
+          "intel": "pacman -Sy intel-media-driver mesa libva-utils",
+          "nvidia": "pacman -Sy nvidia-utils"
+        }
+      ],
+      "debianDistro": "Debian / Ubuntu / andra",
+      "debianIntel": "apt-get install va-driver-all intel-opencl-icd vainfo",
+      "debianNvidia": "Packar upp <code>.run</code> på värden → <code>pct push</code> → installerar med <code>--no-kernel-modules --no-dkms</code>.",
+      "whyTitle": "Varför NVIDIA-installationen med .run används på Debian",
+      "whyBody": "Paketen kan avvika från värdens version. Biblioteken <strong>måste passa värdens inlästa modul</strong> för NVML och <code>nvidia-smi</code>. Debian/glibc använder cachad <code>.run</code> för värdversionen, packar upp och arkiverar på värden, överför med <code>pct push</code> och installerar med <code>--no-kernel-modules --no-dkms</code>. Alpine och Arch använder förrådspaket; kontrollera versionerna."
+    },
+    "alignGids": {
+      "title": "Anpassa GID:n och återställ tillståndet",
+      "body1": "För Intel/AMD läses värdens GID:n för <code>video</code> och <code>render</code>, med 44/104 endast som reservvärden, och sedan ändras <code>/etc/group</code> i containern så att de matchar; körningar med enbart NVIDIA hoppar över steget. Poster som <code>video:44</code> och <code>render:104</code> är exempel, inte universella ID:n. Kontrollera appens gruppmedlemskap och faktiska enhetsrättigheter.",
+      "body2": "Vid normal avslutning stoppas en från början stoppad container igen; en som kördes fortsätter köra. Vid start- eller installationsfel, kontrollera slutläget och loggen."
+    }
+  },
+  "vendors": {
+    "heading": "Anmärkningar per tillverkare",
+    "intelHeading": "Intel iGPU",
+    "intelBody": "Intels mediaacceleration, inklusive <em>Quick Sync</em>, beror på GPU-generation, kodekar och appinställningar. Skriptet delar de av <code>/dev/dri/card0</code>, <code>card1</code>, <code>renderD128</code> och <code>renderD129</code> som finns; andra nodnummer läggs inte till. Värden måste redan tillhandahålla dem via sin inbyggda drivrutin, exempelvis <code>i915</code>.",
+    "amdHeading": "AMD",
+    "amdBody": "AMD använder DRI för Mesa/VA-API. Om värden har <code>/dev/kfd</code> delas även den. ROCm/OpenCL kräver kompatibel hårdvara och bibliotek; enhetsdelning installerar inte hela ROCm-miljön.",
+    "nvidiaHeading": "NVIDIA",
+    "nvidiaBody": "Delar tillgängliga <code>/dev/nvidia*</code>-enheter. <strong>Matchande drivrutinsversioner</strong> krävs för <code>nvidia-smi</code>. Debian/glibc använder värdversionens <code>.run</code>, Alpine/Arch förrådspaket. Under 2048 MiB inställt RAM erbjuds en tillfällig höjning med återställning; dessutom krävs 1500 MiB ledigt diskutrymme.",
+    "updateTitle": "Efter NVIDIA-uppdatering på värden, kontrollera LXC-biblioteken",
+    "updateBody": "Gamla bibliotek kan ge versionsfel i <code>nvidia-smi</code>. <nvidiaLink>Värdens NVIDIA-installation</nvidiaLink> erbjuder containeruppdateringar. En ny enhetstilldelning kan avslutas direkt om posterna redan finns och garanterar ingen biblioteksuppdatering. Kontrollera versioner och uppdatera lämpliga paket eller användarinstallation."
+  },
+  "verification": {
+    "heading": "Verifiering",
+    "body": "Kontrollera i containern att GPU:n syns och går att använda."
+  },
+  "troubleshoot": {
+    "heading": "Felsökning",
+    "mismatchTitle": "nvidia-smi: Failed to initialize NVML: Driver/library version mismatch",
+    "mismatchBody": "Biblioteken passar inte den inlästa modulen. Kontrollera versionerna och uppdatera containerns användarmiljö. Cachad <code>.run</code> används för Debian/glibc, men enhetstilldelningen kan avslutas tidigt om alla poster redan finns.",
+    "denyTitle": "Tillstånd nekas på /dev/dri/renderD128 inuti containern",
+    "denyBody": "Kontrollera enhetsposten och numeriska rättigheter för <code>render</code>, sedan att appens användare tillhör <code>render</code>. Lägg vid behov till användaren i <code>render</code> med <code>usermod -aG render &lt;user&gt;</code>; ersätt platshållaren med kontot. Starta om sessionen. Byte av privilegieläge är ingen generell lösning.",
+    "vainfoTitle": "vainfo säger: VA-API version 1.xx; misslyckades med att initialisera",
+    "vainfoBody": "Kontrollera åtkomst och VA-API-drivrutin. Paketnamn varierar per distribution: exempelvis <code>intel-media-driver</code> för nyare Intel-GPU:er som stöds, <code>i965-va-driver</code> för äldre och <code>mesa-va-drivers</code> för AMD. Meddelandet bevisar inte ensamt ett saknat paket.",
+    "logTitle": "Installationslogg",
+    "logBody": "Varje körning skriver <code>/tmp/add_gpu_lxc.log</code> på värden. Bifoga loggen när du söker hjälp."
+  },
+  "related": {
+    "heading": "Relaterat",
+    "items": [
+      {
+        "label": "Installera NVIDIA Drivers (Host)",
+        "href": "/docs/hardware/nvidia-host",
+        "tail": " — installera värdens drivrutin före NVIDIA-delning."
+      },
+      {
+        "label": "Lägg till GPU till VM (Passthrough)",
+        "href": "/docs/hardware/gpu-vm-passthrough",
+        "tail": " — alternativ för att reservera en GPU för en VM."
+      },
+      {
+        "label": "Byt GPU-läge (VM ↔ LXC)",
+        "href": "/docs/hardware/switch-gpu-mode",
+        "tail": " — växla GPU:n mellan LXC-delning och VM-tilldelning."
+      },
+      {
+        "label": "GPU Passthrough kommandon",
+        "href": "/docs/help-info/gpu-commands",
+        "tail": " — snabb referens för relaterade skalkommandon."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sv/docs/hardware/install-coral-tpu-host.json b/web/messages/sv/docs/hardware/install-coral-tpu-host.json
new file mode 100644
index 00000000..6dccb0d5
--- /dev/null
+++ b/web/messages/sv/docs/hardware/install-coral-tpu-host.json
@@ -0,0 +1,203 @@
+{
+  "meta": {
+    "title": "Installera Coral TPU på värden | ProxMenux-dokumentation",
+    "description": "Installerar Coral-komponenter på Proxmox VE efter upptäckt hårdvara: gasket/apex med DKMS för M.2 / Mini-PCIe och libedgetpu1-std för USB. Kör båda flödena om båda typerna hittas."
+  },
+  "header": {
+    "title": "Installera Coral TPU på värden",
+    "description": "Förbered Proxmox-värden för Coral och LXC-delning. Identifierar M.2 / Mini-PCIe, USB eller båda och kör rätt flöde: DKMS-moduler för PCIe och Google Edge TPU-körmiljö för USB.",
+    "section": "Hårdvara: GPU:er och Coral-TPU"
+  },
+  "intro": {
+    "title": "Vad det gör",
+    "body": "En <strong>gemensam installation med hårdvaruidentifiering</strong>. PCIe använder <code>gasket</code> och <code>apex</code> med DKMS; framtida byggen kräver kompatibel källkod och headers. USB använder <code>libedgetpu1-std</code>. Båda flödena körs om båda typerna hittas. USB-körmiljön ska finnas där appen körs; för enbart LXC behövs den inte nödvändigtvis även på värden."
+  },
+  "which": {
+    "heading": "Vilken Coral har jag?",
+    "body": "PCIe- och USB-modeller har olika format och krav. Skriptet stöder båda; identifiera din enhet före körning.",
+    "headerForm": "Formfaktor",
+    "headerDetect": "Detektering",
+    "headerInstall": "Installationstyp",
+    "headerReboot": "Starta om?",
+    "pcieForm": "M.2 / Mini-PCIe",
+    "pcieFormSub": "(M.2-kort finns med en eller två Edge TPU:er)",
+    "pcieDetect": "PCI-tillverkar-ID <code>1ac1</code>",
+    "pcieInstall": "Kernel modul (gasket + apex) via DKMS",
+    "pcieReboot": "Ja",
+    "usbForm": "USB-accelerator",
+    "usbFormSub": "(liten plastdongel)",
+    "usbDetect": "USB <code>1a6e:089a</code> (oprogrammerad) / <code>18d1:9302</code> (programmerad)",
+    "usbInstall": "Användarkörmiljö <code>libedgetpu1-std</code> från Googles APT-förråd",
+    "usbReboot": "Nej"
+  },
+  "prereqs": {
+    "title": "Innan du börjar",
+    "coral": "<strong>En ansluten Coral</strong> (M.2, Mini-PCIe eller USB) för installation. Utan upptäckt hårdvara kan skriptet städa eller ta bort befintliga komponenter, men installerar ingen ny hårdvaruväg.",
+    "coralCheck": "lspci -d 1ac1: ; lsusb | grep -E '1a6e:089a|18d1:9302'",
+    "internet": "<strong>Internetanslutning</strong> på värden för att klona PCIe-drivrutinen från GitHub eller hämta <code>libedgetpu1-std</code> från Googles APT-förråd för USB.",
+    "headers": "<strong>Kernelheaders tillgängliga via APT</strong>: <code>proxmox-headers-$(uname -r)</code>. Behövs bara för PCIe/M.2; skriptet installerar dem.",
+    "reboot": "<strong>Planera en omstart</strong> för PCIe. Skriptet försöker läsa in de byggda modulerna; en omstart kontrollerar även automatisk inläsning."
+  },
+  "hostPrepTip": {
+    "title": "Detta förbereder bara värden",
+    "body": "Förbereder värden för <em>åtkomst till enheten</em> utan att konfigurera eller testa appen. För att <em>använda</em> Coral i en kompatibel app som Frigate, följ <lxcLink>Lägg till Coral TPU i LXC</lxcLink>."
+  },
+  "running": {
+    "heading": "Kör installationen",
+    "body": "Öppna ProxMenux på värden och välj <strong>Hårdvara: GPU:er och Coral-TPU → Installera/uppdatera Coral TPU på värden</strong>.",
+    "imageAlt": "Menyval för att installera eller uppdatera Coral TPU på värden"
+  },
+  "howRuns": {
+    "heading": "Så fungerar skriptet",
+    "body": "Identifierar först hårdvaran och tar fram rätt plan. Installationen kräver bekräftelse."
+  },
+  "walkthrough": {
+    "heading": "Steg för steg",
+    "detect": {
+      "title": "Hårdvaruidentifiering",
+      "body": "Söker efter tillverkare <code>0x1ac1</code> i <code>/sys/bus/pci/devices/*/vendor</code> och använder <code>lsusb</code> för USB. Det finns <strong>två</strong> USB-ID:n beroende på firmwareläget:",
+      "items": [
+        "<code>1a6e:089a</code> — Global Unichip, <em>oprogrammerat</em> läge innan körmiljön läser in firmware.",
+        "<code>18d1:9302</code> — Google, <em>programmerat</em> läge efter att firmware lästs in."
+      ],
+      "outro": "Om varken Coral eller en befintlig installation hittas visas ett meddelande och skriptet avslutas. Befintliga komponenter kan fortfarande öppna menyn för rensning eller borttagning."
+    },
+    "prompt": {
+      "title": "Bekräfta installationen",
+      "body": "Före installationen visas en dialog med enheter och planerade komponenter. Avbryt för att hoppa över installationen. Valfri rensning av äldre komponenter har en egen tidigare bekräftelse.",
+      "imageAlt": "Översikt över Coral-enheter och installationssteg"
+    },
+    "pcie": {
+      "title": "PCIe: modulerna gasket och apex med DKMS",
+      "body": "Körs bara om en PCIe/M.2-Coral hittas. Bygger moduler för den kernel som värden kör.",
+      "items": [
+        "<strong>Rensning.</strong> Ett befintligt <code>gasket-dkms</code>-paket tas bort före ombygget; om paketet är i ett felaktigt tillstånd tvingar skriptet fram borttagning och rensning (purge).",
+        "<strong>Byggberoenden:</strong> <code>git</code>, <code>dkms</code>, <code>build-essential</code>, <code>proxmox-headers-$(uname -r)</code>."
+      ],
+      "cloneIntro": "<strong>Klonar drivrutinens källkod.</strong> Föredrar <feranickLink>feranick/gasket-driver</feranickLink>, annars används <googleLink>google/gasket-driver</googleLink>. Bygget kräver en kompatibel kernel. Google-koden får följande versionsberoende ändringar:",
+      "kernelPatches": [
+        "Från kernel 6.5 ersätter reservpatchen <code>no_llseek</code> med <code>noop_llseek</code>.",
+        "Kernel 6.13 eller senare: ändrar argumentet till <code>MODULE_IMPORT_NS(DMA_BUF)</code> till en strängliteral."
+      ],
+      "afterItems": [
+        "<strong>Kopierar källkoden till <code>/usr/src/gasket-1.0/</code>,</strong> skapar <code>dkms.conf</code> och registrerar med <code>dkms add</code>.",
+        "<strong>Bygger och installerar:</strong> <code>dkms build</code> följt av <code>dkms install</code>. Vid fel visas de sista 50 raderna i <code>make.log</code> om filen finns.",
+        "<strong>Skapar gruppen <code>apex</code> och udev-regler</strong> (<code>/etc/udev/rules.d/99-coral-apex.rules</code>) för att tilldela <code>/dev/apex_*</code> rätt grupp.",
+        "<strong>Försöker läsa in modulerna:</strong> <code>modprobe gasket</code> och <code>modprobe apex</code>."
+      ],
+      "imageAlt": "DKMS-bygge och inläsning av gasket/apex-moduler"
+    },
+    "usb": {
+      "title": "USB: Googles Edge TPU-körmiljö",
+      "body": "Det går bara om en USB-accelerator upptäcktes. Mycket enklare:",
+      "items": [
+        "<strong>Lägger till Googles GPG-nyckel</strong> i <code>/etc/apt/keyrings/coral-edgetpu.gpg</code>.",
+        "<strong>Lägger till APT-förrådet</strong> i <code>/etc/apt/sources.list.d/coral-edgetpu.list</code>; <code>signed-by=</code> begränsar verifieringen till dess nyckelring. Detta är enradsformatet .list, inte deb822-formatet .sources.",
+        "<strong>Installerar <code>libedgetpu1-std</code></strong>, Edge TPU-körmiljön med standardprestanda.",
+        "<strong>Läser om udev</strong> och tillämpar paketets regler på USB-enheten."
+      ],
+      "stdTitle": "Varför libedgetpu1-std och inte libedgetpu1-max?",
+      "stdBody": "Paketet <code>max</code> aktiverar högsta frekvens som stöds och ökar prestanda, effektförbrukning och värme. Kontrollera acceleratorns kylning och driftvillkor före bytet. Paketen kan inte vara installerade samtidigt; byt med <code>apt install libedgetpu1-max</code>."
+    },
+    "reboot": {
+      "title": "Valfri omstart efter PCIe-installationen",
+      "body": "Efter PCIe erbjuds omstart. Skriptet har försökt med <code>modprobe</code>; kontrollera modulerna och <code>/dev/apex_0</code> med gruppen <code>apex</code>. En planerad omstart testar automatisk inläsning. För enbart USB föreslås ingen omstart av värden.",
+      "imageAlt": "Sammanfattning och erbjudande om omstart efter PCIe-installation"
+    }
+  },
+  "legacyCleanup": {
+    "heading": "Rensa äldre gasket-dkms på värdar som bara använder USB",
+    "intro": "Om <strong>ingen PCIe/M.2-Coral hittas</strong> men en äldre installation av <code>gasket-dkms</code> finns erbjuds valfri rensning med bekräftelse.",
+    "items": [
+      "Om en PCIe/M.2-Coral hittas används det vanliga DKMS-bygget och denna rensning erbjuds inte.",
+      "Rensar bort <code>gasket-dkms</code>, gamla DKMS-registreringar och gasket-källkod samt reparerar väntande <code>dpkg</code>/APT-tillstånd.",
+      "USB-paketen <code>libedgetpu1-std</code> och <code>libedgetpu1-max</code> behålls så att USB-Coral har kvar sin körmiljö.",
+      "Manuset verifierar att arvspaketet är borta och att pakethanteringen är hälsosam innan rapporteringen av framgång."
+    ],
+    "warningTitle": "Bekräfta hårdvaran först",
+    "warningBody": "Om en förväntad PCIe/M.2-Coral saknas, avbryt rensningen och kontrollera kort, kortplats och firmware."
+  },
+  "reinstallUninstall": {
+    "heading": "Reinstallera eller avinstallera",
+    "intro": "Om en PCIe-installation med <code>gasket-dkms</code>, USB med <code>libedgetpu1-std</code>/<code>libedgetpu1-max</code> eller båda hittas visas en åtgärdsmeny.",
+    "imageAlt": "Meny för att installera om, uppdatera eller avinstallera Coral",
+    "imageCaption": "Menyn visas om någon komponent finns: en gasket-registrering i DKMS, paketet <code>libedgetpu1-*</code> eller enheter <code>/dev/apex_*</code>.",
+    "reinstallHeading": "Installera om / uppdatera",
+    "reinstallBody": "Kör den vanliga installationen: bygger om efter kernelbyte eller uppdaterar <code>libedgetpu1-*</code> från Google. Rensar först tidigare DKMS-tillstånd så att en misslyckad installation inte blockerar bygget.",
+    "uninstallHeading": "Avinstallera - vad som tas bort",
+    "uninstallIntro": "Kräver bekräftelse. LXC-appar som använder <code>/dev/apex_*</code> kan förlora åtkomsten under borttagningen eller efter omstart. Stegen är:",
+    "uninstallItems": [
+      "Försöker ta bort <code>apex</code> och <code>gasket</code> ur kerneln; aktiva användare kan förhindra detta.",
+      "Ta bort varje DKMS-registrerad <code>gasket/&lt;version&gt;</code>-post så att modulerna inte kommer tillbaka på nästa kärninstallation.",
+      "Rensar bort <code>gasket-dkms</code>, <code>libedgetpu1-std</code> och <code>libedgetpu1-max</code> och kör <code>apt-get autoremove --purge</code>.",
+      "Tar bort <code>/etc/udev/rules.d/99-coral-apex.rules</code> och återställer standardgruppen i <code>60-gasket-dkms.rules</code> om filen finns kvar.",
+      "Kontrollerar kompletterande medlemmar i <code>apex</code>. <strong>Om listan är tom</strong> försöker skriptet ta bort gruppen; annars behålls <code>apex</code> och medlemmarna listas. Användare med gruppen som primär grupp kontrolleras inte fullständigt.",
+      "Tar bort förrådslistan <code>/etc/apt/sources.list.d/coral-edgetpu.list</code>, den äldre <code>coral-cloud.list</code> och gamla nyckelringar med namnet <code>coral-edgetpu-archive-keyring.gpg</code>. Den aktuella nyckelringen i <code>/etc/apt/keyrings/coral-edgetpu.gpg</code> tas inte bort av den här sekvensen.",
+      "Erbjuder omstart <strong>bara om PCIe var installerat</strong> för att ta bort kvarvarande moduler ur kerneln. Avinstallation av enbart USB kräver ingen omstart."
+    ],
+    "lxcWarnTitle": "LXC containrar med apex genomgång",
+    "lxcWarnBody": "Borttagning av värdens komponenter kan bryta LXC-åtkomsten. Planera underhåll om kompatibla appar som Frigate är beroende av denna Coral."
+  },
+  "updates": {
+    "heading": "Uppdateringsaviseringar",
+    "intro": "ProxMenux registrerar Coral-komponenter och kontrollerar PCIe/M.2 och USB separat. Om båda finns använder varje variant sin egen versionskälla:",
+    "headerVariant": "Variant",
+    "headerTracked": "Registrerad version",
+    "headerUpstream": "Versionskälla",
+    "pcieVariant": "PCIe / M.2",
+    "pcieTracked": "Först den registrerade versionstaggen från en lyckad installation, sedan versionen av ett fungerande <code>gasket-dkms</code>-paket, annars DKMS-modulens version. Den senare anger inte forkens patchnivå.",
+    "pcieUpstream": "Senaste GitHub-taggen för <code>feranick/gasket-driver</code>; sju dagars cache och jämförelse av byggnummer.",
+    "usbVariant": "USB",
+    "usbTracked": "<code>libedgetpu1-std</code> eller <code>libedgetpu1-max</code> apt version",
+    "usbUpstream": "Lokal <code>apt-cache policy</code> kandidat (Google Coral apt repo)",
+    "outro": "Om en ny version hittas skickar Monitor <code>coral_driver_update_available</code> via aktiverade kanaler. Aviseringen leder till installationen: välj <strong>Installera om / uppdatera</strong>.",
+    "antiTitle": "Inga upprepade aviseringar",
+    "antiBody": "En avisering per variant när den tillgängliga versionen ändras. Ingen upprepning vid varje daglig kontroll; nästa avisering kommer först vid en senare version.",
+    "rebootTitle": "PCIe-uppdateringar: planera en omstart",
+    "rebootBody": "Den ombyggda PCIe-modulen måste läsas in; en planerad omstart testar även automatisk inläsning. USB-biblioteket kräver ingen omstart av värden, men appar som använder den gamla versionen kan behöva startas om."
+  },
+  "manual": {
+    "heading": "Motsvarande manuella steg",
+    "intro": "Dessa kommandon visar huvudstegen i varje flöde för genomgång eller manuell körning.",
+    "pcieHeading": "PCIe / M.2 (gasket + apex via DKMS)",
+    "usbHeading": "USB (libedgetpu-körmiljö)"
+  },
+  "verification": {
+    "heading": "Verifiering",
+    "pcieHeading": "PCIe / M.2",
+    "usbHeading": "USB"
+  },
+  "troubleshoot": {
+    "heading": "Felsökning",
+    "dkmsFailTitle": "DKMS-bygget misslyckas efter kerneluppdatering",
+    "dkmsFailBody": "Saknade headers är en möjlig orsak. Kontrollera <code>proxmox-headers-$(uname -r)</code> med <code>dpkg -l proxmox-headers-$(uname -r)</code> och installera vid behov. Läs byggloggen efter inkompatibilitet med kerneln. En ny körning anropar <code>cleanup_broken_gasket_dkms</code> men kan inte garantera stöd för varje kernel.",
+    "apexMissTitle": "/dev/apex_0 saknas efter omstart",
+    "apexMissBody": "Kontrollera PCIe-identifieringen och att modulen passar aktuell kernel. Prova <code>modprobe apex</code> och läs <code>dmesg | grep -iE \"apex|gasket\"</code>. Fel vid bygge, inläsning eller kortplats-/firmwareinställningar kan hindra att enheten skapas.",
+    "lxcMissTitle": "Värden ser /dev/apex_0 men inte LXC",
+    "lxcMissBody": "En synlig enhetsnod bevisar inte att enheten fungerar. Kontrollera åtkomst på värden, LXC-montering, cgroup-regler och numeriska UID/GID-rättigheter. Se <lxcLink>Lägg till Coral TPU i LXC</lxcLink>.",
+    "usbUnreachTitle": "USB Accelerator upptäckt men Frigate / TFLite kan inte nå den",
+    "usbUnreachBody": "Kontrollera reglerna från <code>libedgetpu1-std</code> och rättigheterna med <code>ls -l /dev/bus/usb/*/*</code>. Appens mappade användare/grupp behöver läs- och skrivåtkomst; root som ägare är inte ett fel i sig. Efter regeländringar, kör <code>udevadm control --reload-rules &amp;&amp; udevadm trigger</code> och återanslut vid behov.",
+    "logTitle": "Installationslogg",
+    "logBody": "Varje körning skriver <code>/tmp/coral_install.log</code>. Vid DKMS-fel läggs de sista 50 raderna från <code>/var/lib/dkms/gasket/1.0/build/make.log</code> till om filen finns. Bifoga loggen när du söker hjälp."
+  },
+  "related": {
+    "heading": "Relaterat",
+    "items": [
+      {
+        "label": "Lägg till Coral TPU i LXC",
+        "href": "/docs/hardware/coral-tpu-lxc",
+        "tail": " — ge en container med en kompatibel app åtkomst till värdens Coral."
+      },
+      {
+        "label": "Installera NVIDIA Drivers (Host)",
+        "href": "/docs/hardware/nvidia-host",
+        "tail": " - samma idé för NVIDIA GPU."
+      },
+      {
+        "label": "ProxMenux Monitor Hardware Tab",
+        "href": "/docs/monitor/dashboard/hardware",
+        "tail": " — Coral-panelen visar drivrutin, moduler, enheter och körmiljöstatus samt temperatur om en sensor som stöds tillhandahåller den."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sv/docs/hardware/nvidia-host.json b/web/messages/sv/docs/hardware/nvidia-host.json
new file mode 100644
index 00000000..0401a1db
--- /dev/null
+++ b/web/messages/sv/docs/hardware/nvidia-host.json
@@ -0,0 +1,175 @@
+{
+  "meta": {
+    "title": "Installera NVIDIA på värden | ProxMenux-dokumentation",
+    "description": "Installera proprietära NVIDIA-drivrutiner på Proxmox VE med ProxMenux: GPU-filtrering, bygg- och DKMS-kontroller, persistens, valfri NVENC-patch och uppdatering av LXC-bibliotek."
+  },
+  "header": {
+    "title": "Installera NVIDIA-drivrutiner på värden",
+    "description": "Installera NVIDIA på Proxmox VE-värden. Filtrerar underhållna grenar efter GPU:ns PCI-ID, kontrollerar bygget, använder DKMS, hanterar nouveau och installerar persistens. Kan även uppdatera bibliotek i LXC med NVIDIA-åtkomst.",
+    "section": "Hårdvara: GPU:er och Coral-TPU"
+  },
+  "intro": {
+    "title": "Vad det gör",
+    "body": "ProxMenux identifierar GPU:n och erbjuder underhållna NVIDIA-grenar som listar dess PCI-ID. Det blockerar <code>nouveau</code>, hämtar den officiella <code>.run</code>-installationen, använder DKMS, installerar <code>nvidia-persistenced</code>, udev-regler och NVIDIA Container Toolkit och erbjuder en valfri NVENC-patch. Byggkontroller bedömer den körande kärnan; en lyckad kompilering garanterar inte att alla appar fungerar. Befintliga NVIDIA-LXC erbjuds en uppdatering av användarbiblioteken, med matchande version utom på Arch."
+  },
+  "who": {
+    "heading": "Vem är detta för?",
+    "body": "För GPU-accelererad video eller beräkning i Plex, Jellyfin, Frigate, Immich eller Stable Diffusion <strong>i LXC</strong>, installera först NVIDIA på Proxmox-<em>värden</em>. Direkt tilldelning till en <strong>VM</strong> använder det separata VFIO-flödet."
+  },
+  "prereqs": {
+    "title": "Innan du börjar",
+    "gpu": "<strong>En NVIDIA-GPU</strong> installerad i värden. Identifieras automatiskt; AMD och Intel hanteras inte här.",
+    "gpuCheck": "lspci | grep -i nvidia",
+    "notVm": "GPU:n <strong>får inte vara reserverad för VM via VFIO</strong>. Installationen avbryter i detta fall för att inte störa tilldelningen.",
+    "internet": "Internetåtkomst på värden. Hämtar drivrutinen från <code>download.nvidia.com</code> och kan klona <code>nvidia-persistenced</code> och <code>nvidia-patch</code> från GitHub.",
+    "space": "Planera plats i <code>/opt/nvidia</code> för <code>.run</code> och RAM för kompilering. LXC-uppdateringen utanför Arch kontrollerar 1500 MiB ledigt och kan begära en tillfällig ökning till 2048 MiB RAM om gränsen är lägre, och återställer sedan tidigare gräns. Planera för värdens omstart."
+  },
+  "vmWarn": {
+    "title": "GPU reserverad för VM? Stanna här",
+    "body": "Om en NVIDIA-enhet är bunden till <code>vfio-pci</code> avslutas installationen även när VM är stoppad. Reservation betyder inte aktiv användning. Planera återgången till värddrivrutinen och ta bort gamla VM-/VFIO-tilldelningar före omstart och installation."
+  },
+  "running": {
+    "heading": "Kör installatören",
+    "body": "Öppna <strong>Hardware Graphics → NVIDIA GPU Driver Installer</strong> i ProxMenux. Menyn beror på om en drivrutin redan är aktiv.",
+    "imageAlt": "Hårdvarumeny med NVIDIA-installationen markerad"
+  },
+  "howRuns": {
+    "heading": "Så fungerar skriptet",
+    "body": "Identifierar enheter, väljer version och installerar. Separat bekräftad VFIO-städning kan ske före översikten. Förberedelse av paketförråd/headers och hämtning sker före drivrutinsbytet; alla ändringar börjar inte efter en enda slutbekräftelse."
+  },
+  "walkthrough": {
+    "detect": {
+      "title": "GPU upptäckt och översikt",
+      "body1": "Visar NVIDIA-grafikstyrenheter, drivrutinsstatus eller <em>”Ingen NVIDIA-drivrutin installerad”</em> samt LXC med konfigurerad NVIDIA-åtkomst och deras drivrutinsversion.",
+      "body2": "Granska GPU och värd-/containerversioner. Avbryt i översikten om urvalet är oväntat; tidigare separat bekräftad VFIO-städning har redan utförts.",
+      "imageAlt": "Översikt före installation: GPU, drivrutin och NVIDIA-LXC"
+    },
+    "version": {
+      "title": "Välj drivrutinsversion",
+      "body1": "Filtrerar versioner från <code>nvidia.com</code> som <strong>listar GPU:ns PCI-ID bland stödda kretsar</strong> och sorterar bort beta-/utvecklarversioner heuristiskt. <em>&lt;version&gt; — Rekommenderad</em> prioriterar senaste versionen i installerad gren, sedan Production Branch och till sist högsta stödda versionsnummer.",
+      "body2": "Om drivrutinen registrerats med keylase-patch begränsas väljaren till NVENC-patchtabellen. <em>Installera om / uppdatera</em> har fortfarande bekräftelser och patchfrågor; kontrollera slutresultatet.",
+      "whyTitle": "Hur kärnkompatibilitet valideras",
+      "whyBody": "Filtrerar efter underhållna grenar och PCI-ID, utan fast kärn-/drivrutinsmatris. Ett förbygge testar aktuell kärna. Bekräftat byggfel återgår till väljaren; ett otillgängligt förtest kan varna och fortsätta. Slutinstallation och funktionskontroll behövs fortfarande.",
+      "imageAlt": "Väljare för GPU-kompatibla grenar med rekommendation överst"
+    },
+    "uninstall": {
+      "title": "Ta bort tidigare drivrutin vid ominstallation",
+      "body": "Efter hämtning och kontroll av vald installation tas föregående drivrutin bort. Stoppar NVIDIA-tjänster, laddar ur moduler, tar bort DKMS-poster och rensar <code>nvidia-*</code> / <code>libnvidia-*</code> / <code>cuda-*</code>. Gäller även bekräftad ominstallation av samma version."
+    },
+    "prepare": {
+      "title": "Förbered systemet",
+      "body": "Under förberedelsen gör skriptet följande:",
+      "items": [
+        "Kontrollerar paketförråd före borttagning eller installation. Utan prenumeration och med enbart Enterprise frågar det om byte till no-subscription; nej avbryter installationen.",
+        "Installerar <code>pve-headers-$(uname -r)</code> (eller <code>proxmox-headers-$(uname -r)</code>), <code>build-essential</code> och <code>dkms</code>.",
+        "Skapar den ProxMenux-hanterade filen <code>/etc/modprobe.d/proxmenux-nouveau-blacklist.conf</code> med <code>blacklist nouveau</code> och <code>options nouveau modeset=0</code>. Registrerar eventuell tillagd rad i <code>blacklist.conf</code> och försöker ladda ur nouveau.",
+        "Skriver <code>/etc/modules-load.d/nvidia-vfio.conf</code> med <code>nvidia</code> och <code>nvidia_uvm</code> så modulerna laddas tidigt på starten."
+      ]
+    },
+    "download": {
+      "title": "Hämta och kör NVIDIA-installationen",
+      "body": "Hämtar <code>NVIDIA-Linux-x86_64-&lt;version&gt;.run</code> till <code>/opt/nvidia</code> och kontrollerar storlek och körbar filtyp. Det är formatkontroller, inte kontroll av kryptografisk signatur. Registrerar DKMS för kärnändringar; kompatibel källkod och kärna krävs fortfarande.",
+      "imageAlt": "Hämtningsförlopp och NVIDIA-installationens DKMS-bygge"
+    },
+    "persist": {
+      "title": "Persistens service och udev regler",
+      "body": "Installerar <persistLink>nvidia-persistenced</persistLink> och skriver <code>/etc/udev/rules.d/70-nvidia.rules</code> för att skapa <code>/dev/nvidia*</code> vid start. Det hjälper till att undvika LXC-åtkomst innan enheterna finns."
+    },
+    "nvenc": {
+      "title": "Valfritt: tillämpa NVENC-patchen",
+      "body": "NVENC-sessionsgränser beror på GPU och drivrutin. <patchLink>keylase/nvidia-patch</patchLink> kan ta bort drivrutinsgränsen för stödda versioner. Välj <strong>Ja</strong> om du behöver ändringen för kodning och versionen stöds. Det förbättrar inte avkodning eller hårdvarans kapacitetsgräns.",
+      "supportTitle": "Kontrollera patchstödet",
+      "supportBody": "Kontrollera exakt version i <patchTableLink>patchtabellen</patchTableLink>. Om den saknas, använd opatchad drivrutin eller välj en annan underhållen version som stöder GPU, kärna och patch; närhet i listan räcker inte."
+    },
+    "propagate": {
+      "title": "Valfritt: uppdatera NVIDIA-bibliotek i LXC",
+      "body1": "Erbjuder uppdatering av drivrutinsbibliotek i upptäckta LXC. De och värdens modul <strong>måste ha matchande versioner</strong>; annars kan <code>nvidia-smi</code> visa ”version mismatch”.",
+      "body2": "Debian / Ubuntu och andra glibc-containrar får den uppackade <code>.run</code>-installationen med <code>--no-kernel-modules --no-dkms --no-install-compat32-libs</code>; RAM kan tillfälligt höjas till 2 GiB och återställas efteråt. <strong>Arch, Manjaro och EndeavourOS</strong> använder <code>pacman -Syu nvidia-utils</code> från paketförråden, utan låsning till värdversionen: kontrollera resultatet. <strong>Alpine</strong> får uppackat <code>.run</code>-innehåll via <code>pct push</code>, installerar <code>gcompat</code> och <code>binutils</code> med <code>apk</code> och skapar SONAME-länkar med <code>readelf</code>. Kontrollera funktionen; kompatibilitetslagret garanterar inte alla bibliotek på musl.",
+      "imageAlt": "Dialog med NVIDIA-LXC och versioner för att bekräfta uppdatering"
+    },
+    "reboot": {
+      "title": "Starta om",
+      "body": "Efter installationen av drivrutinen bygger skriptet om <code>initramfs</code> för alla kärnor; dess sista steg erbjuder omstart. <strong>Planera den omstarten</strong> för att kontrollera den beständiga modul- och nouveau-konfigurationen vid en ny start, även om den nya drivrutinen redan svarar före omstarten."
+    }
+  },
+  "reinstallUninstall": {
+    "heading": "Reinstallera eller avinstallera",
+    "intro": "Om <code>nvidia</code> är laddad och <code>nvidia-smi</code> returnerar en version visas en åtgärdsmeny. Det identifierar en aktiv drivrutin; installerade filer kan finnas även utan laddad modul.",
+    "imageAlt": "NVIDIA-åtgärdsmeny med valen Installera om / uppdatera drivrutin och Avinstallera NVIDIA-drivrutinen helt",
+    "imageCaption": "Åtgärdsmenyn visas när en NVIDIA-drivrutin är aktiv på värden.",
+    "reinstallHeading": "Installera om / uppdatera",
+    "reinstallBody": "Väljer version, förbereder paketförråd/headers, hämtar och kontrollerar bygget före drivrutinsbytet. Kan uppdatera inom underhållen gren eller välja annan stödd gren. Frågor om LXC-bibliotek och NVENC-patch visas igen efteråt.",
+    "uninstallHeading": "Avinstallera - vad som tas bort",
+    "uninstallIntro": "Efter Ja/Nej-bekräftelse tas följande komponenter bort:",
+    "uninstallItems": [
+      "Stoppar och inaktiverar <code>nvidia-persistenced</code> och <code>nvidia-powerd</code>, försöker ladda ur <code>nvidia_uvm</code>, <code>nvidia_drm</code>, <code>nvidia_modeset</code> och <code>nvidia</code> och kör sedan <code>nvidia-uninstall --silent</code> för <code>.run</code>-installationen. NVIDIA-beroende LXC-arbetslaster påverkas; aktiva klienter kan hindra urladdningen.",
+      "Kör <code>apt purge</code> på <code>nvidia-*</code>, <code>libnvidia-*</code>, <code>cuda-*</code> och <code>libcudnn*</code>, tar bort DKMS-källträdet och mapparna <code>nvidia-persistenced</code> och <code>nvidia-patch</code> under <code>/opt/nvidia</code>.",
+      "Tar bort modulkonfigurationen <code>/etc/modules-load.d/nvidia-vfio.conf</code> och ProxMenux egna nouveau-blockeringar. Äldre ProxMenux-filer med de två kända raderna migreras och tas bort; ändrade eller orelaterade administratörsfiler bevaras.",
+      "Tar bort <code>/etc/udev/rules.d/70-nvidia.rules</code> och sätter NVENC-status till <em>removed</em> i registret för hanterade installationer; ingen separat statusfil finns.",
+      "Bygger om <code>initramfs</code> för alla kärnor, kör <code>proxmox-boot-tool refresh</code> enligt startkonfigurationen och frågar om omstart."
+    ],
+    "lxcWarnTitle": "LXC med NVIDIA-åtkomst",
+    "lxcWarnBody": "Borttagning av värddrivrutinen avbryter NVIDIA-beroende LXC-appar även om biblioteken finns kvar. Planera underhåll för Frigate, Plex, Jellyfin, Ollama och andra GPU-appar."
+  },
+  "updates": {
+    "heading": "Aviseringar om uppdateringar",
+    "body": "NVIDIA-drivrutinen följs i registret för hanterade installationer. Vid start och var 24:e timme jämför Monitor versionerna på <code>download.nvidia.com/XFree86/Linux-x86_64/</code> med den som <code>nvidia-smi</code> rapporterar. Aviserar bara nya underhållsversioner i installerad gren.",
+    "kindsHeading": "Uppdateringsmeddelande",
+    "kindsItems": [
+      "<strong>Underhåll i samma gren.</strong> Exempel: installerad 580.65.06 → tillgänglig 580.105.08. Monitor drar inga slutsatser om kärnkompatibilitet mellan grenar."
+    ],
+    "antiTitle": "Undvik upprepade aviseringar",
+    "antiBody": "En avisering per ny version, inte vid varje daglig kontroll. Ingen avisering utan nyare version i installerad gren.",
+    "applyTitle": "Applicera uppdateringen",
+    "applyBody": "Monitor meddelar utan automatisk installation. Öppna installationen, välj <strong>Installera om / uppdatera</strong> och en stödd version, och slutför bygge och installation. Planera omstarten som erbjuds och kontrollera därefter värd och LXC-bibliotek."
+  },
+  "verify": {
+    "heading": "Verifiera installationen",
+    "intro": "Efter värdens omstart, logga in via SSH eller Proxmox-skalet och kör:",
+    "after": "Kontrollera GPU och förväntad version. Processer kan redan visas om värdtjänster eller automatiskt startade containrar använder GPU:n. Kontrollera sedan persistensen:",
+    "imageAlt": "Utdata från nvidia-smi på värden med upptäckt GPU och installerad drivrutinsversion"
+  },
+  "troubleshoot": {
+    "heading": "Felsökning",
+    "smiFailTitle": "nvidia-smi visar ”NVIDIA-SMI has failed”",
+    "smiFailBody": "Möjliga orsaker är <strong>nouveau</strong>, <strong>saknade eller felaktiga kärnheaders</strong>, inkompatibel drivrutinskällkod eller andra laddningsfel. Granska <code>lsmod | grep nouveau</code>, <code>dmesg | grep -i nvidia</code> och installations-/DKMS-loggar. Om nouveau-regeln behöver rättas, kontrollera <code>/etc/modprobe.d/proxmenux-nouveau-blacklist.conf</code> före <code>update-initramfs -u -k all</code> och omstart. Alla byggfel beror inte på headers.",
+    "lxcMissTitle": "LXC-container kan inte se GPU efter värduppdatering",
+    "lxcMissBody": "Före ominstallation, kontrollera värdens enheter, LXC-behörigheter och biblioteksversion. Versionskonflikt kan kräva matchande användardrivrutin via distributionens stödda metod; på glibc används <code>--no-kernel-modules</code>. Bibliotek rättar inte saknade monteringar eller behörigheter.",
+    "logTitle": "Kolla installationsloggen",
+    "logBody": "Installationen skriver till <code>/tmp/nvidia_install.log</code>. Vid fel, granska hämtning, DKMS-bygge och tjänster. Bifoga loggen till felrapporten på GitHub."
+  },
+  "manualSteps": {
+    "heading": "Letar du efter manuella steg?",
+    "body": "Se <guideLink>Guider → NVIDIA</guideLink> för manuella grunder med <code>wget</code> och <code>./NVIDIA-Linux-...run</code>. Guiden förklarar komponenterna men återger inte installationen exakt. Det underhållna ProxMenux-flödet ger GPU-filtrering, byggkontroller, LXC-uppdateringar och VFIO-kontroller."
+  },
+  "related": {
+    "heading": "Relaterat",
+    "items": [
+      {
+        "label": "Lägg till GPU till VM (Passthrough)",
+        "href": "/docs/hardware/gpu-vm-passthrough",
+        "tail": " — tilldela NVIDIA direkt till en VM via VFIO."
+      },
+      {
+        "label": "Lägg till GPU i LXC",
+        "href": "/docs/hardware/igpu-acceleration-lxc",
+        "tail": " — dela NVIDIA med en eller flera containrar."
+      },
+      {
+        "label": "Byt GPU-läge (VM ↔ LXC)",
+        "href": "/docs/hardware/switch-gpu-mode",
+        "tail": " — växla mellan VM-genomkoppling och LXC-delning."
+      },
+      {
+        "label": "ProxMenux Monitor — fliken Hårdvara",
+        "href": "/docs/monitor/dashboard/hardware",
+        "tail": " — GPU-dialog som öppnar installationen och visar övervakning i realtid."
+      },
+      {
+        "label": "Kommandon för GPU-genomkoppling",
+        "href": "/docs/help-info/gpu-commands",
+        "tail": " — lspci / dmesg / IOMMU / nvidia-smi referens."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sv/docs/hardware/switch-gpu-mode.json b/web/messages/sv/docs/hardware/switch-gpu-mode.json
new file mode 100644
index 00000000..14c4fac1
--- /dev/null
+++ b/web/messages/sv/docs/hardware/switch-gpu-mode.json
@@ -0,0 +1,172 @@
+{
+  "meta": {
+    "title": "Byt GPU-läge (VM ↔ LXC) | ProxMenux-dokumentation",
+    "description": "Byt GPU mellan VFIO för VM och inbyggd drivrutin för LXC. ProxMenux identifierar drivrutinen, frågar hur berörda gäster ska hanteras, tar bort tillhörande ljudtilldelningar och bygger om initramfs om värdkonfigurationen ändras."
+  },
+  "header": {
+    "title": "Byt GPU-läge (VM ↔ LXC)",
+    "description": "Byt en tilldelad GPU mellan VM-genomkoppling och LXC-delning. ProxMenux hanterar drivrutin, VFIO, moduler och initramfs och frågar hur berörda gäster ska hanteras. Granska valen och kontrollera konfigurationen efter omstart.",
+    "section": "Hårdvara: GPU:er och Coral-TPU"
+  },
+  "intro": {
+    "title": "Vad det gör",
+    "body": "Med <code>vfio-pci</code> reserveras GPU:n för en VM. Med inbyggd drivrutin <em>(i915 / amdgpu / nvidia)</em> kan värden och LXC dela den. <strong>Byt GPU-läge</strong> hanterar <code>vfio.conf</code>, modulblockering och gästreferenser och varnar om kvarvarande tilldelningar."
+  },
+  "graphics": {
+    "lxcTitle": "Klar för LXC-containrar",
+    "lxcDesc": "Inbyggd drivrutin aktiv",
+    "vmTitle": "Redo för VM-passthrough",
+    "vmDesc": "VFIO-PCI drivrutin aktiv"
+  },
+  "when": {
+    "heading": "När ska jag använda detta?",
+    "intro": "Använd när GPU:n <strong>redan är tilldelad</strong> och du vill ändra användningen:",
+    "headerSituation": "Situation",
+    "headerUse": "Använd denna sida?",
+    "rows": [
+      {
+        "situation": "GPU ledig och aldrig tilldelad: använd den i en VM.",
+        "useRich": "Nej — använd <vmLink>Lägg till GPU i VM</vmLink>"
+      },
+      {
+        "situation": "GPU ledig och aldrig tilldelad: använd den i en LXC.",
+        "useRich": "Nej — använd <lxcLink>Lägg till GPU i LXC</lxcLink>"
+      },
+      {
+        "situationRich": "GPU är i en VM via <code>vfio-pci</code>, jag vill använda den från en LXC istället.",
+        "useRich": "<strong>Ja — den här sidan.</strong>"
+      },
+      {
+        "situation": "GPU delas med en LXC, jag vill ägna den till en VM.",
+        "useRich": "<strong>Ja — den här sidan.</strong>"
+      },
+      {
+        "situation": "Jag vill ta bort alla tilldelningar av denna GPU.",
+        "use": "LXC-läget återför GPU:n till värdens drivrutin; VM-konfliktpolicyn kan ta bort hostpci-poster, men LXC-enhetsposter måste tas bort separat. GPU:n är fortfarande bunden till en drivrutin."
+      }
+    ]
+  },
+  "prereqs": {
+    "title": "Innan du börjar",
+    "assigned": "<strong>En redan tilldelad GPU</strong> i en VM via VFIO eller i en LXC. För första tilldelningen, använd Lägg till GPU i VM / LXC.",
+    "iommu": "<strong>IOMMU måste vara aktivt på värden</strong> vid byte <em>till</em> VM-läge. Både firmwareinställningar och kärnstöd spelar roll. Om <code>intel_iommu=on</code> eller <code>amd_iommu=on</code> saknas i den körande kärnan lägger skriptet till det med <code>iommu=pt</code> i <code>/etc/kernel/cmdline</code> (ZFS-rotmarkör) eller <code>/etc/default/grub</code> och kör sedan <code>proxmox-boot-tool refresh</code> eller <code>update-grub</code>. Granska eventuella varningar och starta om när du uppmanas.",
+    "iommuCheck": "dmesg | grep -i 'IOMMU enabled' | head -1",
+    "reboot": "<strong>Planera en omstart.</strong> Beständiga drivrutins- och startändringar kan kräva ombyggnad av initramfs och omstart. Skriptet frågar om detta i slutet.",
+    "knowList": "<strong>Ta reda på vilka VM och LXC som använder GPU:n.</strong> Skriptet hittar referenser och frågar hur varje gäst ska hanteras; en känd lista underlättar granskningen."
+  },
+  "blocklist": {
+    "title": "Inte alla GPU är säkra att passera till en VM",
+    "body": "Skriptet blockerar VM-läge för enhets-ID <code>8086:5a84</code> och <code>8086:5a85</code> enligt sin kompatibilitetspolicy. Om en vald GPU matchar avbryts bytet till VM-läge och skriptet återgår till GPU-valet, eller avslutas om det är den enda GPU:n. Blocklistan hindrar inte byte <em>till</em> LXC-läge; andra kontroller kan fortfarande gälla."
+  },
+  "running": {
+    "heading": "Kör skriptet",
+    "body": "Öppna <strong>Hårdvara: GPU och Coral-TPU → Byt GPU-läge (VM ↔ LXC)</strong> i ProxMenux.",
+    "imageAlt": "Alternativet Byt GPU-läge (VM ↔ LXC) i hårdvarumenyn"
+  },
+  "howRuns": {
+    "heading": "Så fungerar skriptet",
+    "body": "GPU-val och riktning granskas före huvudbytet. Separat städning av gamla VFIO-poster kan fråga tidigare, och berörda gäster har egna konfliktdialoger. Läs varje bekräftelse: en enda slutbekräftelse täcker inte alla ändringar."
+  },
+  "walkthrough": {
+    "heading": "Steg för steg",
+    "detect": {
+      "title": "Identifiera GPU och aktuell drivrutin",
+      "body": "Granskar värdens VGA-, 3D- och Display-styrenheter och kontrollerar <code>/sys/bus/pci/devices/*/driver</code>. Visar namn, PCI-adress och aktuell drivrutin för varje GPU så att läget kan identifieras.",
+      "imageAlt": "GPU checklista som visar varje upptäckt GPU med sin nuvarande drivrutin (vfio-pci / nvidia / amdgpu / i915) och PCI slot"
+    },
+    "pickGpu": {
+      "title": "Välj GPU:er att växla",
+      "body": "En ensam GPU väljs automatiskt. Med flera kan du markera flera, men alla måste vara i <em>samma</em> läge. Blandade lägen kräver att du begränsar urvalet.",
+      "tipTitle": "Växla flera GPU:er samtidigt",
+      "tipBody": "Exempel: växla tre NVIDIA till VM-läge och sedan iGPU:n tillbaka till LXC. Två körningar med ett gemensamt mål i varje, i stället för att växla korten ett i taget."
+    },
+    "direction": {
+      "title": "Granska den föreslagna riktningen",
+      "intro": "Baserat på det aktuella läget föreslår manuset motsatsen som mål:",
+      "items": [
+        "<strong>VM → LXC:</strong> tar bort bindningen till <code>vfio-pci</code> så att den inbyggda drivrutinen (<code>nvidia</code>, <code>amdgpu</code>, <code>i915</code>) kan använda GPU:n. För NVIDIA tas motsvarande BDF-poster bort från <code>/etc/udev/rules.d/10-proxmenux-vfio-bind.rules</code> inför nästa start.",
+        "<strong>LXC → VM:</strong> förbereder bindning till <code>vfio-pci</code>. AMD / Intel blockerar den inbyggda drivrutinen och använder <code>options vfio-pci ids=…</code>. För NVIDIA blockeras <code>nvidia</code> globalt endast när varje NVIDIA-GPU på värden är i VFIO; annars sätter regler per BDF <code>driver_override=vfio-pci</code> för enheterna i berörda IOMMU-grupper, och NVIDIA-GPU:er utanför grupperna behåller <code>nvidia</code>. Granska varje gruppmedlem före bytet."
+      ],
+      "outro": "Bekräfta riktningen eller avbryt."
+    },
+    "conflict": {
+      "title": "Val för varje berörd VM eller LXC",
+      "body": "Kontrollerar <code>/etc/pve/lxc/*.conf</code> efter GPU-enheter per drivrutinsfamilj och <code>/etc/pve/qemu-server/*.conf</code> efter PCI-tilldelningar. LXC-detekteringen matchar inte varje kort exakt per BDF. Granska gästerna och välj hantering för varje:",
+      "headerPolicy": "Policy",
+      "headerEffect": "Effekt",
+      "headerWhen": "När ska man välja",
+      "keepPolicy": "Behåll konfiguration, inaktivera automatisk start",
+      "keepEffect": "<code>pct set CTID -onboot 0</code> eller <code>qm set VMID -onboot 0</code>. GPU-posterna behålls.",
+      "keepWhen": "Om gästen ska användas igen när GPU:n återgår till ursprungligt läge. Försiktigt standardval.",
+      "removePolicy": "Ta bort GPU från konfig",
+      "removeEffect": "Tar bort identifierade <code>hostpci</code>- / <code>dev</code>-poster och äldre referenser som stöds.",
+      "removeWhen": "Om gästen ska fungera utan GPU. Kontrollera appinställningarna först: CPU-reservdrift beror på appen, och enhetsborttagning konfigurerar inte om den automatiskt.",
+      "imageAlt": "Dialog för att hantera varje berörd VM eller LXC"
+    },
+    "audio": {
+      "title": "Ta bort tillhörande ljudtilldelningar när VM-läget lämnas",
+      "body1": "Många separata NVIDIA-/AMD-GPU:er har HDMI-ljud på funktion <code>.1</code> i samma slot; fler ljudenheter kan också ha tilldelats. När GPU:n tas bort kan gamla ljudposter av typen <code>hostpci</code> bli kvar. Granska vilka tilldelningar som ska behållas.",
+      "body2": "Identifierar ljudets BDF-adresser och visar en lista för att välja tilldelningar att ta bort. Tar även bort deras vendor:device-ID från <code>/etc/modprobe.d/vfio.conf</code>, men bara om ingen annan VM använder dem."
+    },
+    "apply": {
+      "title": "Tillämpa ändringar på värd och gäster",
+      "body": "Efter bekräftelse skrivs värdändringarna: <code>vfio.conf</code>, drivrutinsblockering, moduler och för NVIDIA BDF-regeln <code>/etc/udev/rules.d/10-proxmenux-vfio-bind.rules</code> med status i <code>/etc/proxmenux/vfio-bind.bdfs</code>. Vald konfliktpolicy tillämpas på varje gäst. Om värdkonfigurationen ändrats körs <code>update-initramfs -u -k all</code> följt av <code>proxmox-boot-tool refresh</code>; annars hoppas båda över."
+    },
+    "reboot": {
+      "title": "Starta om",
+      "body": "Starta om värden för att tillämpa den nya beständiga bindningen. Omstarten kan skjutas upp, men kontrollera aktiv drivrutin före start av målgästen: den gamla kan fortfarande vara aktiv fram till omstarten.",
+      "imageAlt": "Sammanfattningsdialog som listar vad som ändrats, följt av omstartsprompten"
+    }
+  },
+  "manual": {
+    "heading": "Manuell granskning",
+    "intro": "Före <strong>VM → LXC</strong>, granska drivrutin och BDF-policy. NVIDIA-exemplet använder <code>10de:2204</code>; anpassa till ditt kort. Kommandona läser status; skriptet hanterar även gäster och IOMMU-gruppmedlemmar.",
+    "lxcToVm": "Före <strong>LXC → VM</strong>, granska PCI-adressen och IOMMU-gruppen. Ersätt exempeladressen och kontrollera alla gruppmedlemmar före tilldelning.",
+    "oneVmTitle": "En fysisk GPU tilldelad via VFIO kan bara användas av en VM i taget",
+    "oneVmBody": "Att sätta flera <code>hostpci</code>-poster med samma PCI-slot i två VM är giltigt konfig men bara en av VM kan börja med GPU - den andra kommer att misslyckas. ProxMenux konfliktpolitiskt steg handlar om att undvika denna fälla."
+  },
+  "verification": {
+    "heading": "Verifiering efter omstart"
+  },
+  "troubleshoot": {
+    "heading": "Felsökning",
+    "stillVfioTitle": "GPU visar fortfarande vfio-pci efter byte till LXC-läge",
+    "stillVfioBody": "En laddad VFIO-modul visar inte vilken drivrutin som äger denna GPU. Kontrollera kortets bindning samt att <code>update-initramfs</code> och omstart slutförts. <code>lsmod | grep vfio</code> listar bara moduler. För AMD / Intel granska <code>vfio.conf</code>; för NVIDIA <code>/etc/proxmenux/vfio-bind.bdfs</code> och <code>/etc/udev/rules.d/10-proxmenux-vfio-bind.rules</code>. Korrigera gamla regler före <code>update-initramfs -u -k all</code> och omstart.",
+    "vmFailTitle": "En VM startar inte efter byte av GPU:n till LXC-läge",
+    "vmFailBody": "Kontrollera gamla <code>hostpci</code>-referenser. Valet <em>Ta bort GPU från konfiguration</em> kan rensa dem under avsett byte. Granska föreslagen riktning innan skriptet körs igen så att läget inte vänds av misstag. Alternativt ta bort tilldelningen i Proxmox när VM är stoppad.",
+    "smiFailTitle": "nvidia-smi visar ”Driver/library version mismatch” efter återgång till LXC",
+    "smiFailBody": "Jämför laddad NVIDIA-modul med installerade bibliotek, även i LXC. Anpassa versionerna först: omstart laddar installerad modul men rättar inte felaktiga bibliotekspaket. Omladdning med <code>modprobe -r nvidia</code> och <code>modprobe nvidia</code> kräver stoppade GPU-klienter och kan misslyckas när beroende moduler används.",
+    "logTitle": "Körningslogg",
+    "logBody": "Varje körning skriver till <code>/tmp/proxmenux_gpu_switch_mode.log</code> på värden. Bifoga loggen när du ber om hjälp på GitHub."
+  },
+  "related": {
+    "heading": "Relaterat",
+    "items": [
+      {
+        "label": "Lägg till GPU till VM (Passthrough)",
+        "href": "/docs/hardware/gpu-vm-passthrough",
+        "tail": " — första konfigurationen av VM-läge."
+      },
+      {
+        "label": "Lägg till GPU i LXC",
+        "href": "/docs/hardware/igpu-acceleration-lxc",
+        "tail": " — första konfigurationen av LXC-läge."
+      },
+      {
+        "label": "Installera NVIDIA-drivrutiner på värden",
+        "href": "/docs/hardware/nvidia-host",
+        "tail": " - krävs för LXC-läge på NVIDIA GPU."
+      },
+      {
+        "label": "ProxMenux Monitor — fliken Hårdvara",
+        "href": "/docs/monitor/dashboard/hardware",
+        "tail": " — avsnittet Grafikkort med aktuellt läge och växlingskontroll."
+      },
+      {
+        "label": "Kommandon för GPU-genomkoppling",
+        "href": "/docs/help-info/gpu-commands",
+        "tail": " — kort kommandoreferens."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sv/docs/help-info/backup-commands.json b/web/messages/sv/docs/help-info/backup-commands.json
new file mode 100644
index 00000000..0ba26cb5
--- /dev/null
+++ b/web/messages/sv/docs/help-info/backup-commands.json
@@ -0,0 +1,235 @@
+{
+  "meta": {
+    "title": "Proxmox-kommandon för säkerhetskopiering — vzdump, qmrestore, pct restore | ProxMenux",
+    "description": "Referens för säkerhetskopiering och återställning i Proxmox VE: vzdump för VM:ar och LXC-containrar, qmrestore för VM:ar, pct restore för containrar, schemalagda säkerhetskopior i /etc/pve/jobs.cfg, hookskript och sökvägar som ska undantas.",
+    "ogTitle": "Proxmox-kommandon för säkerhetskopiering — vzdump, qmrestore, pct restore",
+    "ogDescription": "Referens för vzdump, qmrestore och pct restore vid säkerhetskopiering och återställning av Proxmox-VM:ar och LXC-containrar.",
+    "twitterTitle": "Proxmox-kommandon för säkerhetskopiering | ProxMenux",
+    "twitterDescription": "Kommandona vzdump, qmrestore och pct restore för säkerhetskopiering och återställning av Proxmox-VM:ar och containrar."
+  },
+  "header": {
+    "title": "Säkerhetskopiering och återställning",
+    "description": "Kommenterad referens för vzdump, qmrestore och pct restore i Proxmox arbetsflöden för säkerhetskopiering. Omfattar schemaläggning, avancerade alternativ som hookskript, undantagna sökvägar och I/O-prioritet samt hantering av säkerhetskopieringsfiler.",
+    "section": "Hjälp och info"
+  },
+  "intro": {
+    "title": "Tre backup lägen",
+    "body": "För VM:ar är <strong>snapshot</strong> en livesäkerhetskopiering som inte kräver snapshots i lagringen. <strong>suspend</strong> pausar VM:n före säkerhetskopieringen utan att nödvändigtvis förbättra konsistensen. <strong>stop</strong> stänger först av VM:n; om den kördes kan den återupptas när säkerhetskopieringen har startat. LXC skiljer sig: snapshot kräver lagring med snapshot-stöd, suspend använder två rsync-pass och stop håller containern avstängd under hela säkerhetskopieringen."
+  },
+  "commandGroups": [
+    {
+      "title": "VM-säkerhetskopiering",
+      "commands": [
+        {
+          "command": "vzdump <vmid>",
+          "description": "Skapa en säkerhetskopia av en specifik VM/CT"
+        },
+        {
+          "command": "vzdump <vmid> --storage <storage>",
+          "description": "Backup VM till specifik lagring"
+        },
+        {
+          "command": "vzdump <vmid> --mode snapshot",
+          "description": "Skapa snapshot backup (för VM)"
+        },
+        {
+          "command": "vzdump <vmid> --mode suspend",
+          "description": "Pausa VM:n före livesäkerhetskopieringen, äldre suspend-läge"
+        },
+        {
+          "command": "vzdump <vmid> --mode stop",
+          "description": "Stäng av VM:n innan säkerhetskopieringen startar"
+        },
+        {
+          "command": "vzdump --all",
+          "description": "Säkerhetskopiera alla VM och containrar"
+        },
+        {
+          "command": "vzdump --all --exclude <vmid1>,<vmid2>",
+          "description": "Säkerhetskopiera alla utom specificerade VM"
+        }
+      ]
+    },
+    {
+      "title": "Alternativ för säkerhetskopiering",
+      "commands": [
+        {
+          "command": "vzdump <vmid> --compress zstd",
+          "description": "Använd zstd komprimering för backup"
+        },
+        {
+          "command": "vzdump <vmid> --compress gzip --pigz <threads>",
+          "description": "Använd pigz med flera trådar"
+        },
+        {
+          "command": "vzdump <vmid> --storage <storage> --notes-template <text>",
+          "description": "Lägg till anteckningar till backup"
+        },
+        {
+          "command": "vzdump <vmid> --mailto <email>",
+          "description": "Skicka meddelande e-post"
+        },
+        {
+          "command": "vzdump <vmid> --prune-backups keep-last=<n>",
+          "description": "Håll bara n backups per VM"
+        },
+        {
+          "command": "vzdump <vmid> --stdexcludes 0",
+          "description": "Undvik inte tillfälliga filer"
+        },
+        {
+          "command": "vzdump <vmid> --quiet 1",
+          "description": "Undertryck utdatameddelanden"
+        }
+      ]
+    },
+    {
+      "title": "Återställ säkerhetskopior",
+      "commands": [
+        {
+          "command": "qmrestore <backup-file> <vmid>",
+          "description": "Återställ VM från backup"
+        },
+        {
+          "command": "qmrestore <backup-file> <vmid> --storage <storage>",
+          "description": "Återställ till specifik lagring"
+        },
+        {
+          "command": "qmrestore <backup-file> <vmid> --unique",
+          "description": "Återställ VM:n med nya slumpmässiga MAC-adresser"
+        },
+        {
+          "command": "pct restore <vmid> <backup-file>",
+          "description": "Återställ container från backup"
+        },
+        {
+          "command": "pct restore <vmid> <backup-file> --storage <storage>",
+          "description": "Återställ container till specifik lagring"
+        },
+        {
+          "command": "pct restore <vmid> <backup-file> --rootfs <storage>:<size-GiB>",
+          "description": "Återställ med en rotdisk på vald lagring och med vald storlek"
+        },
+        {
+          "command": "pct restore <vmid> <backup-file> --unprivileged 1",
+          "description": "Återställ som oprivilegierad CT"
+        }
+      ]
+    },
+    {
+      "title": "Hantering av säkerhetskopior",
+      "commands": [
+        {
+          "command": "ls -la /var/lib/vz/dump/",
+          "description": "Lista säkerhetskopior på standardplats"
+        },
+        {
+          "command": "find /var/lib/vz/dump/ -name \"*.vma*\"",
+          "description": "Hitta VM säkerhetskopior"
+        },
+        {
+          "command": "find /var/lib/vz/dump/ -name \"*.tar*\"",
+          "description": "Hitta container backups"
+        },
+        {
+          "command": "pvesm list <storage> --content backup",
+          "description": "Lista säkerhetskopior i specifik lagring"
+        },
+        {
+          "command": "rm /var/lib/vz/dump/<backup-file>",
+          "description": "Ta bort en backup-fil"
+        },
+        {
+          "command": "cat /etc/vzdump.conf",
+          "description": "Visa backup konfiguration"
+        }
+      ]
+    },
+    {
+      "title": "Schemalagda Backups",
+      "commands": [
+        {
+          "command": "cat /etc/pve/jobs.cfg",
+          "description": "Visa backup schema"
+        },
+        {
+          "command": "nano /etc/vzdump.conf",
+          "description": "Redigera säkerhetskopieringskonfigurationen"
+        },
+        {
+          "command": "systemctl list-timers",
+          "description": "Lista systemd-timers"
+        },
+        {
+          "command": "systemctl status cron",
+          "description": "Kontrollera cron service status"
+        },
+        {
+          "command": "pvenode task list --typefilter vzdump",
+          "description": "Lista slutförda säkerhetskopieringsuppgifter"
+        },
+        {
+          "command": "pvenode task log <upid>",
+          "description": "Visa loggen för en säkerhetskopieringsuppgift via dess UPID"
+        }
+      ]
+    },
+    {
+      "title": "Avancerade åtgärder",
+      "commands": [
+        {
+          "command": "qmrestore <backup> <vmid> --force",
+          "description": "Force-återställning, överskrivning av befintlig VM"
+        },
+        {
+          "command": "vzdump <vmid> --dumpdir <directory>",
+          "description": "Ange anpassad backup katalog"
+        },
+        {
+          "command": "vzdump <vmid> --script <script>",
+          "description": "Kör hook script under backup"
+        },
+        {
+          "command": "vzdump <vmid> --exclude-path <path>",
+          "description": "Undanta angivna sökvägar från säkerhetskopieringen"
+        },
+        {
+          "command": "vzdump <vmid> --ionice <priority>",
+          "description": "Ställ in I/O prioritet för backup process"
+        },
+        {
+          "command": "vzdump <vmid> --lockwait <minutes>",
+          "description": "Vänta på lås"
+        },
+        {
+          "command": "qm importdisk <vmid> <disk-image> <storage>",
+          "description": "Importera en diskavbildsfil (till exempel raw, qcow2 eller vmdk) som en oanvänd disk, inte ett vzdump-säkerhetskopiearkiv"
+        }
+      ]
+    }
+  ],
+  "testRestores": {
+    "title": "Testa återställningarna",
+    "bodyRich": "Återställ regelbundet en säkerhetskopia till ett ledigt test-VMID med <code>qmrestore --unique</code>, starta VM:n på ett isolerat testnät och kontrollera innehållet. unique skapar nya MAC-adresser men ändrar inte statiska IP-adresser eller programinställningar. Testa containeråterställning på samma sätt med <code>pct restore</code>."
+  },
+  "related": {
+    "heading": "Relaterat",
+    "items": [
+      {
+        "href": "/docs/help-info/vm-ct-commands",
+        "label": "Hantering av VM:ar och CT:er",
+        "tail": " — qm och pct livscykel kommandon."
+      },
+      {
+        "href": "/docs/help-info/storage-commands",
+        "label": "Lagring och diskar",
+        "tail": " — pvesm lagringshantering."
+      },
+      {
+        "href": "/docs/help-info",
+        "label": "Översikt över Hjälp och info",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sv/docs/help-info/gpu-commands.json b/web/messages/sv/docs/help-info/gpu-commands.json
new file mode 100644
index 00000000..bf5b1263
--- /dev/null
+++ b/web/messages/sv/docs/help-info/gpu-commands.json
@@ -0,0 +1,162 @@
+{
+  "meta": {
+    "title": "Proxmox-kommandon för GPU-passthrough — lspci, VFIO, IOMMU, qm set hostpci | ProxMenux",
+    "description": "Referens för GPU-passthrough på Proxmox VE: identifiering med lspci, VFIO-moduler, IOMMU-grupper (intel_iommu / amd_iommu), GRUB- och initramfs-uppdateringar, qm set hostpci0 och inställningar för NVIDIA / AMD / Intel.",
+    "ogTitle": "Proxmox-kommandon för GPU-passthrough — lspci, VFIO, IOMMU, qm set hostpci",
+    "ogDescription": "Referens för inspektering och konfigurering av GPU passthrough på Proxmox VE - PCI-enheter, VFIO-moduler, IOMMU-grupper, kärnstartsparam, qm set hostpci.",
+    "twitterTitle": "Proxmox-kommandon för GPU-passthrough | ProxMenux",
+    "twitterDescription": "Kontrollera PCI-enheter, konfigurera VFIO och IOMMU och tilldela GPU:er till VM:ar på Proxmox VE."
+  },
+  "header": {
+    "title": "GPU-genomföring",
+    "description": "Referens för kontroll och konfigurering av GPU-/TPU-passthrough på Proxmox: enhetsidentifiering (lspci), VFIO-moduler, IOMMU-kontroll, initramfs-/GRUB-uppdateringar och inställningar per VM (qm set hostpci, machine q35, bios ovmf).",
+    "section": "Hjälp och info"
+  },
+  "intro": {
+    "title": "IOMMU måste aktiveras i BIOS / UEFI",
+    "body": "Aktivera först IOMMU i firmware: leta efter <em>VT-d</em>, <em>AMD-Vi</em> eller <em>IOMMU</em> i BIOS/UEFI. I Linux är det aktiverat som standard på AMD och på Intel med Proxmox-kärnor från 6.8. Äldre Intel-kärnor kan behöva <code>intel_iommu=on</code>. Det valfria <code>iommu=pt</code> styr IOMMU:s passthrough-läge och är inget skäl att generellt stänga av värdens framebuffer."
+  },
+  "commandGroups": [
+    {
+      "title": "Enhetsidentifiering",
+      "commands": [
+        {
+          "command": "lspci -nn | grep -i nvidia",
+          "description": "Lista NVIDIA PCI-enheter"
+        },
+        {
+          "command": "lspci -nn | grep -i vga",
+          "description": "Lista alla VGA kompatibla enheter"
+        },
+        {
+          "command": "lspci -nn | grep -i amd",
+          "description": "Lista AMD PCI-enheter"
+        },
+        {
+          "command": "lspci -nnk | grep -A3 VGA",
+          "description": "Lista VGA-enheter med kärndrivrutiner"
+        },
+        {
+          "command": "lspci -v -s <PCI_ID>",
+          "description": "Visa detaljerad information för specifik PCI-enhet"
+        }
+      ]
+    },
+    {
+      "title": "VFIO-konfiguration",
+      "commands": [
+        {
+          "command": "dmesg | grep -i vfio",
+          "description": "Kontrollera VFIO-modulmeddelanden"
+        },
+        {
+          "command": "cat /etc/modprobe.d/vfio.conf",
+          "description": "Granska konfigurationen för VFIO-passthrough"
+        },
+        {
+          "command": "ls -la /etc/modprobe.d/",
+          "description": "Lista alla modprobe konfigurationsfiler"
+        },
+        {
+          "command": "cat /etc/modules",
+          "description": "Visa moduler laddade vid starttid"
+        },
+        {
+          "command": "lsmod | grep vfio",
+          "description": "Kontrollera om VFIO-moduler laddas"
+        }
+      ]
+    },
+    {
+      "title": "IOMMU Konfiguration",
+      "commands": [
+        {
+          "command": "cat /etc/default/grub",
+          "description": "Granska GRUB alternativ för IOMMU"
+        },
+        {
+          "command": "update-grub",
+          "description": "Applicera GRUB ändringar"
+        },
+        {
+          "command": "dmesg | grep -i iommu",
+          "description": "Kontrollera IOMMU-meddelanden i kärnlogg"
+        },
+        {
+          "command": "dmesg | grep -e DMAR -e IOMMU",
+          "description": "Kontrollera DMAR och IOMMU-meddelanden"
+        },
+        {
+          "command": "find /sys/kernel/iommu_groups/ -type l | sort -V",
+          "description": "Lista IOMMU-grupper"
+        }
+      ]
+    },
+    {
+      "title": "Systemuppdateringar",
+      "commands": [
+        {
+          "command": "update-initramfs -u",
+          "description": "Applicera initramfs förändringar (VFIO)"
+        },
+        {
+          "command": "update-initramfs -u -k all",
+          "description": "Uppdatera initramfs för alla kärnor"
+        },
+        {
+          "command": "cat /proc/cmdline",
+          "description": "Visa nuvarande kärnstartsparametrar"
+        }
+      ]
+    },
+    {
+      "title": "VM Konfiguration",
+      "commands": [
+        {
+          "command": "qm config <vmid> | grep hostpci",
+          "description": "Visa PCI-passthrough-inställningar för en VM"
+        },
+        {
+          "command": "qm set <vmid> -hostpci0 <PCI_ID>,pcie=1,x-vga=1",
+          "description": "Lägg till GPU-passthrough till en VM"
+        },
+        {
+          "command": "cat /etc/pve/qemu-server/<vmid>.conf",
+          "description": "Visa VM konfigurationsfil"
+        },
+        {
+          "command": "qm set <vmid> -machine q35",
+          "description": "Ställ in VM för att använda Q35-chipset (rekommenderas för genomgång)"
+        },
+        {
+          "command": "qm set <vmid> -bios ovmf",
+          "description": "Ställ in VM:n på UEFI/OVMF, rekommenderat om GPU:ns ROM stöder UEFI"
+        }
+      ]
+    }
+  ],
+  "afterChangesTip": {
+    "title": "Efter att ha ändrat GRUB eller modprobe configs",
+    "bodyRich": "På värdar med GRUB tillämpar du startparametrar med <code>update-grub</code>. Uppdatera moduländringar med <code>update-initramfs -u -k all</code> och starta sedan om. Andra starthanterare har egna rutiner. Kontrollera med <code>cat /proc/cmdline</code> (kärnparametrar), <code>dmesg | grep -i iommu</code> (IOMMU aktiverad) och <code>find /sys/kernel/iommu_groups/ -type l | sort -V</code> (grupper finns)."
+  },
+  "related": {
+    "heading": "Relaterat",
+    "items": [
+      {
+        "href": "/docs/hardware/gpu-vm-passthrough",
+        "label": "Lägg till GPU till VM (Passthrough)",
+        "tail": " — interaktivt ProxMenux-flöde."
+      },
+      {
+        "href": "/docs/hardware/igpu-acceleration-lxc",
+        "label": "Lägg till GPU till LXC",
+        "tail": " — dela åtkomst till värdens GPU-enheter med en LXC-container."
+      },
+      {
+        "href": "/docs/help-info",
+        "label": "Översikt över Hjälp och info",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sv/docs/help-info/index.json b/web/messages/sv/docs/help-info/index.json
new file mode 100644
index 00000000..9f10121d
--- /dev/null
+++ b/web/messages/sv/docs/help-info/index.json
@@ -0,0 +1,87 @@
+{
+  "meta": {
+    "title": "Referens för Proxmox-kommandon — qm, pct, vzdump, zpool, pveversion | ProxMenux",
+    "description": "Utvalda viktiga kommandon för Proxmox VE och Linux efter ämne: systemkontroll, hantering av VM:ar och LXC:er (qm / pct), lagring och diskar, nätverk, uppdateringar, GPU-passthrough, ZFS, säkerhetskopiering och återställning samt vardagens terminalverktyg.",
+    "ogTitle": "Referens för Proxmox-kommandon — qm, pct, vzdump, zpool",
+    "ogDescription": "Utvalda användbara Proxmox VE- och Linux-kommandon efter ämne: system, VM/CT, lagring, nätverk, uppdateringar, GPU-passthrough, ZFS, säkerhetskopiering och CLI-verktyg.",
+    "twitterTitle": "Referens för Proxmox-kommandon | ProxMenux",
+    "twitterDescription": "Utvalda användbara Proxmox VE- och Linux-kommandon, grupperade efter ämne."
+  },
+  "header": {
+    "title": "Hjälp och info",
+    "description": "Utvalda användbara Linux- och Proxmox VE-kommandon efter ämne. De nio kategorierna omfattar allt från en snabb kontroll med pveversion till flera rader med zfs send/receive. Samlingen är en gemensam referens tillsammans med ProxMenux avsnitt om GPU, diskar och delningar.",
+    "section": "Hjälp och info"
+  },
+  "intro": {
+    "title": "Vad detta är",
+    "body": "En referenskatalog över kommandon du använder på en Proxmox-värd, grupperade efter ämne. I ProxMenux kan du välja ett nummer för att köra ett kommando direkt eller klistra in ett eget vid prompten. På webbplatsen visas varje kategori som en tabell att kopiera från."
+  },
+  "opening": {
+    "heading": "Öppna menyn",
+    "body": "Tryck på <kbd>h</kbd> i ProxMenux huvudmeny. Då visas detta:",
+    "imageAlt": "Menyn Hjälp och info med nio kommandokategorier"
+  },
+  "categories": {
+    "heading": "De nio kategorierna",
+    "options": [
+      {
+        "icon": "Terminal",
+        "href": "/docs/help-info/system-commands",
+        "title": "Användbara systemkommandon",
+        "description": "pveversion, uptime, free, journalctl, hostnamectl, information om aktuell användare, granskning med lynis och fastfetch."
+      },
+      {
+        "icon": "Cpu",
+        "href": "/docs/help-info/vm-ct-commands",
+        "title": "Hantering av VM:ar och CT:er",
+        "description": "qm list / config / start / stop / migrate, pct list / config / enter, snapshots och kloning."
+      },
+      {
+        "icon": "HardDrive",
+        "href": "/docs/help-info/storage-commands",
+        "title": "Lagring och diskar",
+        "description": "lsblk, blkid, smartctl, monteringsinformation, pvesm status och LVM-kommandon."
+      },
+      {
+        "icon": "Network",
+        "href": "/docs/help-info/network-commands",
+        "title": "Nätverkskommandon",
+        "description": "ip / ss / nmcli, kontroll av nätverksbryggor, ping / traceroute, DNS-uppslagningar och fail2ban-client."
+      },
+      {
+        "icon": "Package",
+        "href": "/docs/help-info/update-commands",
+        "title": "Uppdateringar och paket",
+        "description": "apt update / dist-upgrade, apt-cache policy, dpkg-frågor och kontroll av arkivfiler."
+      },
+      {
+        "icon": "Cpu",
+        "href": "/docs/help-info/gpu-commands",
+        "title": "GPU-genomföring",
+        "description": "Kontroller med lspci / dmesg, verifiering av aktiverad IOMMU, bindning till vfio-pci och GPU-användning på värden."
+      },
+      {
+        "icon": "Database",
+        "href": "/docs/help-info/zfs-commands",
+        "title": "ZFS-hantering",
+        "description": "zpool / zfs för status, dataset, snapshots, send/receive, ARC-justering och TRIM."
+      },
+      {
+        "icon": "Archive",
+        "href": "/docs/help-info/backup-commands",
+        "title": "Säkerhetskopiering och återställning",
+        "description": "vzdump, qmrestore / pct restore, verktyg för Proxmox Backup Server och snapshot-åtgärder."
+      },
+      {
+        "icon": "Wrench",
+        "href": "/docs/help-info/tools-commands",
+        "title": "System CLI-verktyg",
+        "description": "tmux, screen, htop / btop, ncdu, jq, dig, lsof, watch — verktyg för daglig administration."
+      }
+    ]
+  },
+  "tip": {
+    "title": "Sökbar från den globala sökningen",
+    "body": "Varje kommando på dessa sidor indexeras av dokumentationssökningen. Om du kommer ihåg en flagga eller fragment men inte vilken sida den är på, slå sökfältet på toppen - du landar direkt på rätt post."
+  }
+}
diff --git a/web/messages/sv/docs/help-info/network-commands.json b/web/messages/sv/docs/help-info/network-commands.json
new file mode 100644
index 00000000..ce219316
--- /dev/null
+++ b/web/messages/sv/docs/help-info/network-commands.json
@@ -0,0 +1,174 @@
+{
+  "meta": {
+    "title": "Proxmox-nätverkskommandon — ip, ping, ss, pve-firewall, iptables | ProxMenux",
+    "description": "Referens för nätverkskommandon på Proxmox VE-värdar: ip / ip link / ip addr, ping, traceroute, mtr, ss, ethtool, dig och nslookup samt pve-firewall, iptables och nftables för filtrering. Kontroll av bryggor, länkaggregeringar och VLAN.",
+    "ogTitle": "Proxmox-nätverkskommandon — ip, ping, ss, pve-firewall, iptables",
+    "ogDescription": "Referens av nätverkskommandon för Proxmox VE - gränssnittskontroll, anslutningstest, övervakning, brandvägg (pve-firewall, iptables, nftables) och DNS-uppslag.",
+    "twitterTitle": "Proxmox nätverkskommandon | ProxMenux",
+    "twitterDescription": "Nätverksinspektion, testning, konfiguration och brandväggskommandon för Proxmox VE."
+  },
+  "header": {
+    "title": "Nätverkskommandon",
+    "description": "Utvalda kommandon för Proxmox-värdens nätverk: gränssnittsinformation, anslutningstester, konfiguration, trafikövervakning och brandväggshantering. Omfattar ip / ss / nmcli / ethtool / tcpdump / pve-firewall.",
+    "section": "Hjälp och info"
+  },
+  "intro": {
+    "title": "Snabb översikt över gränssnitten",
+    "body": "<code>ip a</code> visar varje gränssnitt med dess IP- och MAC-adresser. <code>ip r</code> visar routningstabellen. Tillsammans besvarar de på några sekunder de flesta frågor om huruvida ett gränssnitt är rätt konfigurerat."
+  },
+  "commandGroups": [
+    {
+      "title": "Nätverksinformation",
+      "commands": [
+        {
+          "command": "ip a",
+          "description": "Visa nätverksgränssnitt och IP-adresser"
+        },
+        {
+          "command": "ip r",
+          "description": "Visa rutttabell"
+        },
+        {
+          "command": "ip -s link",
+          "description": "Visa trafikstatistik per gränssnitt"
+        },
+        {
+          "command": "brctl show",
+          "description": "Visa konfigurerade nätverksbryggor"
+        },
+        {
+          "command": "cat /etc/network/interfaces",
+          "description": "Visa rå nätverkskonfiguration"
+        }
+      ]
+    },
+    {
+      "title": "Nätverkstestning",
+      "commands": [
+        {
+          "command": "ping <host>",
+          "description": "Kontrollera anslutningen med en annan värd"
+        },
+        {
+          "command": "traceroute <host>",
+          "description": "Spåra vägen till en värd"
+        },
+        {
+          "command": "mtr <host>",
+          "description": "Kombinera ping och traceroute i realtid"
+        },
+        {
+          "command": "dig <domain>",
+          "description": "DNS-sökning för en domän"
+        },
+        {
+          "command": "nslookup <domain>",
+          "description": "Alternativ DNS-uppslagning"
+        }
+      ]
+    },
+    {
+      "title": "Nätverkskonfiguration",
+      "commands": [
+        {
+          "command": "ifreload -a",
+          "description": "Ladda om nätverkskonfigurationen (ifupdown2)"
+        },
+        {
+          "command": "ethtool <iface>",
+          "description": "Visa Ethernet-enhetsinformation"
+        },
+        {
+          "command": "resolvectl status",
+          "description": "Visa DNS-upplösningsstatus"
+        },
+        {
+          "command": "nmcli device show",
+          "description": "Visa nätverksenhetsdetaljer (om NetworkManager används)"
+        },
+        {
+          "command": "ip link set <iface> up",
+          "description": "Aktivera ett nätverksgränssnitt"
+        },
+        {
+          "command": "ip link set <iface> down",
+          "description": "Inaktivera ett nätverksgränssnitt"
+        }
+      ]
+    },
+    {
+      "title": "Nätverksövervakning",
+      "commands": [
+        {
+          "command": "ss -tuln",
+          "description": "Visa lyssningsportar (TCP/UDP)"
+        },
+        {
+          "command": "netstat -tuln",
+          "description": "Alternativ för att visa lyssnande portar"
+        },
+        {
+          "command": "lsof -i",
+          "description": "Lista öppna nätverksfiler och anslutningar"
+        },
+        {
+          "command": "tcpdump -i <iface>",
+          "description": "Fånga paket på gränssnitt"
+        },
+        {
+          "command": "iftop -i <iface>",
+          "description": "Övervaka bandbreddsanvändningen på ett gränssnitt"
+        }
+      ]
+    },
+    {
+      "title": "Brandväggshantering",
+      "commands": [
+        {
+          "command": "iptables -L -n -v",
+          "description": "Visa aktiva brandväggsregler (iptables)"
+        },
+        {
+          "command": "nft list ruleset",
+          "description": "Visa nftables regler"
+        },
+        {
+          "command": "pve-firewall status",
+          "description": "Kontrollera status för Proxmox brandvägg"
+        },
+        {
+          "command": "pve-firewall compile",
+          "description": "Kompilera brandväggsregler för alla noder"
+        },
+        {
+          "command": "pve-firewall reload",
+          "description": "Ladda om Proxmox brandväggsregler"
+        }
+      ]
+    }
+  ],
+  "iptablesTip": {
+    "title": "iptables vs nftables",
+    "bodyRich": "Den klassiska tjänsten <code>pve-firewall</code> skapar iptables-regler. Den alternativa tjänsten proxmox-firewall använder <strong>nftables</strong>. Kontrollera iptables-backenden med <code>iptables -L -n -v</code> och nftables-backenden med <code>nft list ruleset</code>. Använd verktygen för den aktiva backenden; listorna är inte utbytbara."
+  },
+  "related": {
+    "heading": "Relaterat",
+    "items": [
+      {
+        "href": "/docs/network",
+        "label": "Nätverkshantering",
+        "tail": " — ProxMenux interaktiva nätverksverktyg för brygganalys, beständiga namn och övervakning."
+      },
+      {
+        "href": "/docs/help-info/tools-commands",
+        "label": "System CLI-verktyg",
+        "tail": " - fler nätverksövervakningsverktyg."
+      },
+      {
+        "href": "/docs/help-info",
+        "label": "Översikt över Hjälp och info",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sv/docs/help-info/storage-commands.json b/web/messages/sv/docs/help-info/storage-commands.json
new file mode 100644
index 00000000..a38b8213
--- /dev/null
+++ b/web/messages/sv/docs/help-info/storage-commands.json
@@ -0,0 +1,232 @@
+{
+  "meta": {
+    "title": "Proxmox-kommandon för lagring och diskar — lsblk, LVM, pvesm, qm importdisk | ProxMenux",
+    "description": "Lagrings- och diskkommandon på Proxmox VE: lsblk, blkid, parted, lvdisplay, vgdisplay, pvs, mount, df, du, ncdu, pvesm status samt qm importdisk och qemu-img convert för VM-diskar.",
+    "ogTitle": "Proxmox-kommandon för lagring och diskar — lsblk, LVM, pvesm, qm importdisk",
+    "ogDescription": "Lagrings- och diskkommandon på Proxmox VE: diskkontroll, LVM, monteringar, Proxmox-lagring, import av VM-diskar och konvertering av diskavbilder.",
+    "twitterTitle": "Proxmox lagringskommandon | ProxMenux",
+    "twitterDescription": "Diskkontroll, monteringsinformation, LVM-hantering, Proxmox-lagring samt import och konvertering av VM-diskar."
+  },
+  "header": {
+    "title": "Lagring och diskar",
+    "description": "Utvalda kommandon för att kontrollera lagring på Proxmox-värdar: blockenheter, partitioner, monteringar, LVM-volymer, lagringskonfiguration och VM-diskåtgärder (importdisk, qemu-img convert).",
+    "section": "Hjälp och info"
+  },
+  "intro": {
+    "title": "Snabb översikt över diskarna",
+    "body": "<code>lsblk</code> visar blockenheter och partitioner som ett träd. Kontrollera beständiga identifierare med <code>ls -lh /dev/disk/by-id/</code>: för samma disk är de normalt stabila över omstarter och ändrad enhetsordning. Ett diskbyte eller en ändring av hur styrenheten visar diskens identitet kan ändra dess by-id-sökväg."
+  },
+  "commandGroups": [
+    {
+      "title": "Diskinformation",
+      "commands": [
+        {
+          "command": "lsblk",
+          "description": "Lista blockenheter och partitioner"
+        },
+        {
+          "command": "fdisk -l",
+          "description": "Lista diskar med detaljerad information"
+        },
+        {
+          "command": "blkid",
+          "description": "Visa UUID och filsystemtyp av blockenheter"
+        },
+        {
+          "command": "ls -lh /dev/disk/by-id/",
+          "description": "Lista diskbeständiga identifierare"
+        },
+        {
+          "command": "parted -l",
+          "description": "Detaljerad partitionslayout med GPT-information"
+        }
+      ]
+    },
+    {
+      "title": "Lagringsanvändning",
+      "commands": [
+        {
+          "command": "df -h",
+          "description": "Visa diskanvändning efter monteringspunkt"
+        },
+        {
+          "command": "du -sh /path",
+          "description": "Visa storleken på en katalog"
+        },
+        {
+          "command": "mount | grep ^/dev",
+          "description": "Visa monterade lagringsenheter"
+        },
+        {
+          "command": "cat /proc/mounts",
+          "description": "Visa alla aktiva monteringar från kärnan"
+        }
+      ]
+    },
+    {
+      "title": "LVM-hantering",
+      "commands": [
+        {
+          "command": "pvdisplay",
+          "description": "Visa fysiska volymer (LVM)"
+        },
+        {
+          "command": "vgdisplay",
+          "description": "Visa volymgrupper (LVM)"
+        },
+        {
+          "command": "lvdisplay",
+          "description": "Visa logiska volymer (LVM)"
+        },
+        {
+          "command": "pvs",
+          "description": "Kortfattad utdata av fysiska volymer"
+        },
+        {
+          "command": "vgs",
+          "description": "Kortfattad utdata av volymgrupper"
+        },
+        {
+          "command": "lvs",
+          "description": "Kortfattad utdata av logiska volymer"
+        }
+      ]
+    },
+    {
+      "title": "Proxmox lagring",
+      "commands": [
+        {
+          "command": "cat /etc/pve/storage.cfg",
+          "description": "Visa Proxmox-lagringskonfiguration"
+        },
+        {
+          "command": "pvesm status",
+          "description": "Visa status för alla lagringspooler"
+        },
+        {
+          "command": "pvesm status --enabled 1",
+          "description": "Lista konfigurerad och aktiverad lagring"
+        },
+        {
+          "command": "pvesm list <storage>",
+          "description": "Lista innehållet i specifik lagring"
+        },
+        {
+          "command": "pvesm scan nfs <server>",
+          "description": "Hitta NFS-exporter på en server"
+        }
+      ]
+    },
+    {
+      "title": "Diskåtgärder",
+      "commands": [
+        {
+          "command": "qm importdisk <vmid> <image_path> <storage>",
+          "description": "Importera diskavbilden som oanvänd VM-disk och anslut den sedan separat"
+        },
+        {
+          "command": "qm set <vmid> -<bus><index> <disk_path>",
+          "description": "Tilldela fysisk disk till VM (genomfångsläge)"
+        },
+        {
+          "command": "qemu-img convert -O <format> <input> <output>",
+          "description": "Konvertera formatet för en diskavbild som inte används aktivt"
+        }
+      ]
+    },
+    {
+      "title": "Diskhälsa med SMART",
+      "commands": [
+        {
+          "command": "smartctl --scan",
+          "description": "Lista SMART-kompatibla enheter på värden"
+        },
+        {
+          "command": "smartctl -i /dev/<disk>",
+          "description": "Grundläggande enhetsinformation: modell, firmware och serienummer"
+        },
+        {
+          "command": "smartctl -H /dev/<disk>",
+          "description": "Snabb hälsokontroll - övergripande PASSED / FAILED"
+        },
+        {
+          "command": "smartctl -A /dev/<disk>",
+          "description": "SMART attribut endast (råvärden, trösklar)"
+        },
+        {
+          "command": "smartctl -a /dev/<disk>",
+          "description": "Fullständig SMART-information: enhet, attribut och självtestlogg"
+        },
+        {
+          "command": "smartctl -t short /dev/<disk>",
+          "description": "Starta kort självtest (~2 minuter, körs i bakgrunden)"
+        },
+        {
+          "command": "smartctl -t long /dev/<disk>",
+          "description": "Starta ett långt självtest som kan ta timmar i bakgrunden"
+        },
+        {
+          "command": "smartctl -l selftest /dev/<disk>",
+          "description": "Visa självtest log (resultat från tidigare tester)"
+        },
+        {
+          "command": "smartctl -X /dev/<disk>",
+          "description": "Avbryt det pågående självtestet"
+        }
+      ]
+    },
+    {
+      "title": "NVMe-diskhälsa",
+      "commands": [
+        {
+          "command": "nvme list",
+          "description": "Lista NVMe-enheter synliga för kärnan"
+        },
+        {
+          "command": "nvme smart-log /dev/<nvme>",
+          "description": "NVMe-specifik SMART-logg (temperatur, slitage, fel)"
+        },
+        {
+          "command": "nvme id-ctrl /dev/<nvme>",
+          "description": "Styrenhetsinformation: modell, firmware och funktioner"
+        },
+        {
+          "command": "nvme error-log /dev/<nvme>",
+          "description": "Nyligen NVMe felloggposter"
+        }
+      ]
+    }
+  ],
+  "lvmTip": {
+    "title": "LVM kort vs långa kommandon",
+    "bodyRich": "Båda formerna finns. <code>pvs</code> / <code>vgs</code> / <code>lvs</code> ger kompakta tabeller med en rad per fysisk volym, volymgrupp respektive logisk volym. <code>pvdisplay</code> / <code>vgdisplay</code> / <code>lvdisplay</code> visar mer detaljer på flera rader. De korta formerna passar bra för dagliga kontroller."
+  },
+  "smartInfo": {
+    "title": "SMART för SATA/SAS jämfört med NVMe",
+    "bodyRich": "<strong>SATA-/SAS-diskar, även SSD:er,</strong> kan granskas med <code>smartctl</code> från <code>smartmontools</code>, som ingår i Proxmox. Ange enheten, till exempel <code>/dev/sda</code> eller <code>/dev/sdb</code>. <strong>NVMe-diskar</strong> använder ett annat inbyggt protokoll. Även <code>smartctl</code> stöder dem, medan <code>nvme</code> från <code>nvme-cli</code> ger NVMe-specifika frågor om styrenheter, namnrymder och hälsa. Installera med <code>apt install nvme-cli</code> om det saknas."
+  },
+  "selfTestWarn": {
+    "title": "Självtester körs i bakgrunden",
+    "bodyRich": "På enheter som stöds startar <code>smartctl -t short /dev/&lt;disk&gt;</code> och <code>smartctl -t long /dev/&lt;disk&gt;</code> bakgrundstester och återvänder direkt. Kontrollera förloppet med <code>smartctl -a /dev/&lt;disk&gt;</code>, leta efter \"Self-test routine in progress\", eller vänta och läs <code>smartctl -l selftest /dev/&lt;disk&gt;</code>. Korta tester tar ofta cirka två minuter; långa kan ta timmar. Disken kan fortfarande användas, men I/O-prestandan kan minska."
+  },
+  "related": {
+    "heading": "Relaterat",
+    "items": [
+      {
+        "href": "/docs/help-info/zfs-commands",
+        "label": "ZFS-hantering",
+        "tail": " — zpool / zfs kommandon för ZFS-stödd lagring."
+      },
+      {
+        "href": "/docs/disk-manager",
+        "label": "Diskhanteraren",
+        "tail": " — interaktiva ProxMenux-flöden för diskåtkomst, import, formatering och SMART."
+      },
+      {
+        "href": "/docs/help-info",
+        "label": "Översikt över Hjälp och info",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sv/docs/help-info/system-commands.json b/web/messages/sv/docs/help-info/system-commands.json
new file mode 100644
index 00000000..9787a9c2
--- /dev/null
+++ b/web/messages/sv/docs/help-info/system-commands.json
@@ -0,0 +1,158 @@
+{
+  "meta": {
+    "title": "Proxmox VE Systemkommandon - pveversion, uptime, journalctl, systemctl | ProxMenux",
+    "description": "Systemkommandon för Proxmox VE och Linux för versioner, drifttid, minne, tjänster, loggar och användare samt gransknings- och sammanfattningsverktyg. En tjänsteomstart ingår; alla exempel är inte skrivskyddade.",
+    "ogTitle": "Proxmox VE Systemkommandon - pveversion, uptime, journalctl, systemctl",
+    "ogDescription": "Systemkommandon för Proxmox VE och Linux för version, drifttid, tjänster, loggar och användarinformation, inklusive tjänstehantering och granskning.",
+    "twitterTitle": "Proxmox VE Systemkommandon | ProxMenux",
+    "twitterDescription": "Viktiga systeminspektionskommandon för Proxmox VE - version, status, tjänster, loggar, användarinformation."
+  },
+  "header": {
+    "title": "Användbara systemkommandon",
+    "description": "Kommandon för att kontrollera Proxmox-värden: version, kärna, drifttid, minne, webbgränssnittets status, aktuella loggar och inloggade användare samt gransknings- och sammanfattningsverktyg. De flesta läser status, men systemctl restart pveproxy startar om webbproxyn och granskningsverktyg kan skriva rapporter och loggar.",
+    "section": "Hjälp och info"
+  },
+  "intro": {
+    "title": "Vad detta är",
+    "body": "Samma numrerade lista som ProxMenux visar under <em>Användbara systemkommandon</em>. Kopiera ett kommando med knappen Kopiera eller slå upp den exakta flaggan."
+  },
+  "commandGroups": [
+    {
+      "title": "Systeminformation",
+      "commands": [
+        {
+          "command": "pveversion",
+          "description": "Visa Proxmox-version"
+        },
+        {
+          "command": "pveversion -v",
+          "description": "Detaljerad Proxmox-versionsinformation"
+        },
+        {
+          "command": "hostnamectl",
+          "description": "Systemvärdnamn och kärninformation"
+        },
+        {
+          "command": "uname -a",
+          "description": "Information om operativsystemets kärna och arkitektur"
+        },
+        {
+          "command": "cat /etc/os-release",
+          "description": "Detaljer om operativsystemets utgåva"
+        }
+      ]
+    },
+    {
+      "title": "Systemstatus",
+      "commands": [
+        {
+          "command": "uptime",
+          "description": "Systemuppetid"
+        },
+        {
+          "command": "uptime -p",
+          "description": "Drifttid i lättläst format"
+        },
+        {
+          "command": "free -h",
+          "description": "Användning av RAM och swap"
+        },
+        {
+          "command": "who -b",
+          "description": "Sista systemstarttid"
+        },
+        {
+          "command": "last -x | grep shutdown",
+          "description": "Tidigare avstängningar"
+        }
+      ]
+    },
+    {
+      "title": "Tjänstehantering",
+      "commands": [
+        {
+          "command": "systemctl status pveproxy",
+          "description": "Kontrollera status för Proxmox Web UI"
+        },
+        {
+          "command": "systemctl restart pveproxy",
+          "description": "Starta om proxy för webbgränssnittet"
+        },
+        {
+          "command": "journalctl -xe",
+          "description": "Systemfel och loggar"
+        },
+        {
+          "command": "dmesg -T | tail -n 50",
+          "description": "Senaste 50 kärnloggraderna"
+        }
+      ]
+    },
+    {
+      "title": "Användarinformation",
+      "commands": [
+        {
+          "command": "whoami",
+          "description": "Nuvarande användare"
+        },
+        {
+          "command": "id",
+          "description": "Aktuell användar-UID, GID och grupper"
+        },
+        {
+          "command": "who",
+          "description": "Inloggade användare"
+        },
+        {
+          "command": "w",
+          "description": "Användaraktivitet och drifttid"
+        },
+        {
+          "command": "uptime && w",
+          "description": "Upptid och vem som är inloggad"
+        },
+        {
+          "command": "cut -d: -f1,3,4 /etc/passwd",
+          "description": "Alla användare med UID och GID"
+        },
+        {
+          "command": "getent passwd | column -t -s :",
+          "description": "Läsbar användartabell (UID, skal, etc.)"
+        }
+      ]
+    },
+    {
+      "title": "Verktyg för granskning och sammanfattning",
+      "commands": [
+        {
+          "command": "lynis audit system",
+          "description": "Kör en fullständig systemsäkerhetsrevision"
+        },
+        {
+          "command": "fastfetch",
+          "description": "Visa systemsammanfattning i ASCII-format"
+        }
+      ]
+    }
+  ],
+  "related": {
+    "heading": "Relaterat",
+    "items": [
+      {
+        "href": "/docs/help-info/update-commands",
+        "label": "Uppdateringar och paket",
+        "tail": " — kommandon för apt och PVE-uppgradering."
+      },
+      {
+        "href": "/docs/help-info/tools-commands",
+        "label": "System CLI-verktyg",
+        "tail": " — htop, btop, ncdu och liknande verktyg."
+      },
+      {
+        "href": "/docs/help-info",
+        "label": "Översikt över Hjälp och info",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sv/docs/help-info/tools-commands.json b/web/messages/sv/docs/help-info/tools-commands.json
new file mode 100644
index 00000000..4891fa22
--- /dev/null
+++ b/web/messages/sv/docs/help-info/tools-commands.json
@@ -0,0 +1,276 @@
+{
+  "meta": {
+    "title": "Linux-terminalverktyg för Proxmox — htop, iftop, journalctl, rsync, tmux | ProxMenux",
+    "description": "Linux-terminalverktyg för daglig Proxmox VE-administration: övervakning (htop, atop, glances, iotop), nätverk (iftop, nmap, mtr, ss), filer och text (find, grep, journalctl), prestanda (iostat, perf, strace), säkerhet (fail2ban, lynis, lsof) och fjärradministration (ssh, rsync, tmux).",
+    "ogTitle": "Linux-terminalverktyg för Proxmox — htop, iftop, journalctl, rsync, tmux",
+    "ogDescription": "Dagliga CLI-verktyg för Proxmox VE-administration som grupperas efter ändamål: övervakning, nätverk, fil / text, prestanda, säkerhet och fjärradministration.",
+    "twitterTitle": "Linux-terminalverktyg för Proxmox | ProxMenux",
+    "twitterDescription": "CLI-verktyg för Proxmox VE-administration grupperad efter ändamål."
+  },
+  "header": {
+    "title": "System CLI-verktyg",
+    "description": "Terminalverktyg för daglig administration av Proxmox-värden, grupperade efter syfte: övervakning, nätverk, filer och text, prestandaanalys, säkerhet, fjärradministration och systemkonfiguration.",
+    "section": "Hjälp och info"
+  },
+  "intro": {
+    "title": "De flesta installeras av efterinstallationsskriptet",
+    "body": "Om du körde ProxMenux efterinstallationsskript med standardvalen är de flesta verktygen redan installerade. För det som saknas erbjuder <utilsLink>installationsprogrammet för systemverktyg</utilsLink> fördefinierade grupper, till exempel grundverktyg, utveckling, nätverk och analys."
+  },
+  "commandGroups": [
+    {
+      "title": "Systemövervakning",
+      "commands": [
+        {
+          "command": "htop",
+          "description": "Interaktiv processtittare med CPU/minnesanvändning"
+        },
+        {
+          "command": "top",
+          "description": "Visa Linux-processer i realtid"
+        },
+        {
+          "command": "atop",
+          "description": "Avancerad system- och processövervakning"
+        },
+        {
+          "command": "glances",
+          "description": "Systemövervakningsverktyg med webbgränssnitt"
+        },
+        {
+          "command": "nmon",
+          "description": "Verktyg för prestandaövervakning"
+        },
+        {
+          "command": "iotop",
+          "description": "Övervaka disk I/O-användning genom processer"
+        },
+        {
+          "command": "vmstat 1",
+          "description": "Rapportera virtuell minnesstatistik varje sekund"
+        }
+      ]
+    },
+    {
+      "title": "Nätverksverktyg",
+      "commands": [
+        {
+          "command": "iftop",
+          "description": "Visa bandbreddsanvändningen på ett gränssnitt"
+        },
+        {
+          "command": "nmap <host>",
+          "description": "Nätverksutforskning och säkerhetsskanning"
+        },
+        {
+          "command": "tcpdump -i <interface>",
+          "description": "Fånga nätverkstrafik"
+        },
+        {
+          "command": "netstat -tuln",
+          "description": "Visa nätverksanslutningar"
+        },
+        {
+          "command": "ss -tuln",
+          "description": "Ett annat verktyg för att undersöka nätverkssocklar"
+        },
+        {
+          "command": "mtr <host>",
+          "description": "Nätverk diagnostiskt verktyg som kombinerar ping och traceroute"
+        },
+        {
+          "command": "iperf3 -s",
+          "description": "Kör iperf server för bandbreddstestning"
+        }
+      ]
+    },
+    {
+      "title": "Fil och textverktyg",
+      "commands": [
+        {
+          "command": "find / -name <filename>",
+          "description": "Hitta filer efter namn"
+        },
+        {
+          "command": "grep -r 'pattern' /path",
+          "description": "Sök efter mönster i filer"
+        },
+        {
+          "command": "sed -i 's/old/new/g' file",
+          "description": "Ersätt text i filer"
+        },
+        {
+          "command": "awk '{print $1}' file",
+          "description": "Verktyg för textbearbetning"
+        },
+        {
+          "command": "tail -f /var/log/syslog",
+          "description": "Följ en loggfil i realtid"
+        },
+        {
+          "command": "less /var/log/messages",
+          "description": "Visa fil med pagination"
+        },
+        {
+          "command": "journalctl -f",
+          "description": "Följ systemd-journalens loggar"
+        }
+      ]
+    },
+    {
+      "title": "Prestandaanalys",
+      "commands": [
+        {
+          "command": "iostat -x 1",
+          "description": "Rapportera CPU och I/O statistik"
+        },
+        {
+          "command": "mpstat -P ALL 1",
+          "description": "Visa CPU-användningen"
+        },
+        {
+          "command": "perf top",
+          "description": "Systemprofileringsverktyg"
+        },
+        {
+          "command": "strace <command>",
+          "description": "Spåra systemanrop och signaler"
+        },
+        {
+          "command": "lsof",
+          "description": "Lista öppna filer"
+        },
+        {
+          "command": "pstree",
+          "description": "Visa processträdet"
+        },
+        {
+          "command": "slabtop",
+          "description": "Visa information om kärnans slab-cache"
+        }
+      ]
+    },
+    {
+      "title": "Säkerhetsverktyg",
+      "commands": [
+        {
+          "command": "fail2ban-client status",
+          "description": "Visa fail2ban status"
+        },
+        {
+          "command": "chage -l <username>",
+          "description": "Visa lösenord utgångsinformation"
+        },
+        {
+          "command": "lastlog",
+          "description": "Visa sista inloggningen av alla användare"
+        },
+        {
+          "command": "last",
+          "description": "Visa en lista över de senast inloggade användarna"
+        },
+        {
+          "command": "w",
+          "description": "Visa vem som är inloggad och vad de gör"
+        },
+        {
+          "command": "lynis audit system",
+          "description": "Säkerhetsrevisionsverktyg"
+        },
+        {
+          "command": "openssl s_client -connect host:port",
+          "description": "Test SSL/TLS-anslutningar"
+        }
+      ]
+    },
+    {
+      "title": "Fjärradministration",
+      "commands": [
+        {
+          "command": "ssh <user>@<host>",
+          "description": "Säker skalanslutning"
+        },
+        {
+          "command": "scp <file> <user>@<host>:<path>",
+          "description": "Kopiera filer säkert"
+        },
+        {
+          "command": "rsync -avz <src> <dest>",
+          "description": "Synkronisera filer / mappar"
+        },
+        {
+          "command": "screen",
+          "description": "Terminalmultiplexer"
+        },
+        {
+          "command": "tmux",
+          "description": "Alternativ terminalmultiplexer"
+        },
+        {
+          "command": "ssh-keygen -t rsa -b 4096",
+          "description": "Generera SSH nyckelpar"
+        },
+        {
+          "command": "ssh-copy-id <user>@<host>",
+          "description": "Kopiera SSH-nyckeln till servern"
+        }
+      ]
+    },
+    {
+      "title": "Systemkonfiguration",
+      "commands": [
+        {
+          "command": "systemctl status <service>",
+          "description": "Kontrollera servicestatus"
+        },
+        {
+          "command": "journalctl -u <service>",
+          "description": "Visa serviceloggar"
+        },
+        {
+          "command": "timedatectl",
+          "description": "Hantera systemets tid och datum"
+        },
+        {
+          "command": "hostnamectl",
+          "description": "Hantera systemets värdnamn"
+        },
+        {
+          "command": "localectl",
+          "description": "Hantera systemets språk- och tangentbordsinställningar"
+        },
+        {
+          "command": "update-alternatives --config <name>",
+          "description": "Konfigurera systemalternativ"
+        },
+        {
+          "command": "dpkg-reconfigure <package>",
+          "description": "Konfigurera om ett installerat paket"
+        }
+      ]
+    }
+  ],
+  "tmuxTip": {
+    "title": "Använd tmux / screen för långvariga kommandon",
+    "bodyRich": "Kör långvariga arbeten, som säkerhetskopiering, uppgradering eller en stor rsync-överföring, i <code>tmux</code> eller <code>screen</code> så att en SSH-frånkoppling inte avslutar terminalsessionen. För en tmux-session ansluter du till samma värd med samma användare och kör <code>tmux attach</code>. Screen-sessioner har ett eget kommando för återanslutning."
+  },
+  "related": {
+    "heading": "Relaterat",
+    "items": [
+      {
+        "href": "/docs/utils/system-utils",
+        "label": "Installationsprogram för systemverktyg",
+        "tail": " - installera något av dessa verktyg som saknas."
+      },
+      {
+        "href": "/docs/help-info/system-commands",
+        "label": "Användbara systemkommandon",
+        "tail": " — Proxmox-specifika inspektionskommandon."
+      },
+      {
+        "href": "/docs/help-info",
+        "label": "Översikt över Hjälp och info",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sv/docs/help-info/update-commands.json b/web/messages/sv/docs/help-info/update-commands.json
new file mode 100644
index 00000000..b199ff16
--- /dev/null
+++ b/web/messages/sv/docs/help-info/update-commands.json
@@ -0,0 +1,170 @@
+{
+  "meta": {
+    "title": "Proxmox-kommandon för uppdateringar och paket — apt, pveupgrade, dpkg | ProxMenux",
+    "description": "Uppdaterings- och paketkommandon för Proxmox VE: apt update, apt upgrade, apt dist-upgrade, pveupgrade, dpkg -l, paketinformationsfrågor och arkivkonfiguration i /etc/apt/sources.list.d/.",
+    "ogTitle": "Proxmox-kommandon för uppdateringar och paket — apt, pveupgrade, dpkg",
+    "ogDescription": "apt, pveupgrade och dpkg kommandon för att hålla Proxmox VE uppdaterad - systemuppgraderingar, pakethantering, förvarskonfiguration.",
+    "twitterTitle": "Proxmox uppdateringskommandon | ProxMenux",
+    "twitterDescription": "Kommandon med apt och pveupgrade för att hantera uppdateringar och paket på Proxmox VE-värdar."
+  },
+  "header": {
+    "title": "Uppdateringar och paket",
+    "description": "Utvalda kommandon med apt och för Proxmox-uppgraderingar: systemuppdatering, installation, borttagning och rensning av paket, paketfrågor med apt-cache policy och dpkg -l samt kontroll av arkivkonfiguration.",
+    "section": "Hjälp och info"
+  },
+  "intro": {
+    "title": "Alltid uppdatera indexet först",
+    "body": "<code>apt update</code> uppdaterar det lokala paketindexet från konfigurerade arkiv. Utan detta kan <code>apt install</code> använda gamla versioner eller misslyckas med \"Unable to locate package\"."
+  },
+  "commandGroups": [
+    {
+      "title": "Systemuppdateringar",
+      "commands": [
+        {
+          "command": "apt update && apt upgrade -y",
+          "description": "Uppdatera paketlistor och installerade paket (apt upgrade)"
+        },
+        {
+          "command": "apt dist-upgrade -y",
+          "description": "Fullständig systemuppgradering, inklusive beroenden"
+        },
+        {
+          "command": "apt update",
+          "description": "Uppdatera paketlistor endast"
+        },
+        {
+          "command": "apt upgrade",
+          "description": "Uppgradera endast paket (interaktivt)"
+        },
+        {
+          "command": "apt full-upgrade",
+          "description": "Uppgradera paket med beroendehantering (interaktiv)"
+        }
+      ]
+    },
+    {
+      "title": "Proxmox Uppdateringar",
+      "commands": [
+        {
+          "command": "pveupdate",
+          "description": "Uppdatera Proxmox-paketlistor"
+        },
+        {
+          "command": "pveupgrade",
+          "description": "Starta den interaktiva paketuppgraderingen för Proxmox"
+        },
+        {
+          "command": "pve8to9 --full",
+          "description": "Kontrollera beredskapen för PVE 8 till 9 utan att uppgradera"
+        },
+        {
+          "command": "ceph versions",
+          "description": "Visa versioner av Ceph-demoner innan en uppgradering planeras"
+        }
+      ]
+    },
+    {
+      "title": "Pakethantering",
+      "commands": [
+        {
+          "command": "apt autoremove --purge",
+          "description": "Ta bort oanvända paket och deras konfiguration"
+        },
+        {
+          "command": "apt clean",
+          "description": "Rensa ut det lokala förvaret av hämtade paketfiler"
+        },
+        {
+          "command": "apt autoclean",
+          "description": "Rensa ut endast föråldrade paketfiler"
+        },
+        {
+          "command": "apt install <package>",
+          "description": "Installera ett specifikt paket"
+        },
+        {
+          "command": "apt remove <package>",
+          "description": "Ta bort ett paket"
+        },
+        {
+          "command": "apt purge <package>",
+          "description": "Ta bort ett paket och dess konfigurationsfiler"
+        }
+      ]
+    },
+    {
+      "title": "Paketinformation",
+      "commands": [
+        {
+          "command": "apt list --installed",
+          "description": "Lista alla installerade paket"
+        },
+        {
+          "command": "apt search <keyword>",
+          "description": "Sök efter paket med sökord"
+        },
+        {
+          "command": "apt show <package>",
+          "description": "Visa detaljerad information om ett paket"
+        },
+        {
+          "command": "dpkg -l",
+          "description": "Lista alla installerade paket (alternativ)"
+        },
+        {
+          "command": "dpkg -l | grep <keyword>",
+          "description": "Sök installerade paket med sökord"
+        },
+        {
+          "command": "apt-cache policy <package>",
+          "description": "Visa paketversioner och prioriteringar"
+        }
+      ]
+    },
+    {
+      "title": "Hantering av paketförråd",
+      "commands": [
+        {
+          "command": "cat /etc/apt/sources.list",
+          "description": "Visa huvudsakliga APT repository källor"
+        },
+        {
+          "command": "ls -la /etc/apt/sources.list.d/",
+          "description": "Lista ytterligare arkiv källfiler"
+        },
+        {
+          "command": "cat /etc/apt/sources.list.d/pve-enterprise.list",
+          "description": "Visa Proxmox Enterprise-arkivets konfiguration i .list-filen för PVE 8"
+        },
+        {
+          "command": "apt-key list",
+          "description": "Lista äldre signeringsnycklar för arkiv där apt-key finns"
+        }
+      ]
+    }
+  ],
+  "backupWarn": {
+    "title": "Ta en backup innan stora uppgraderingar",
+    "bodyRich": "För vanliga uppdateringar rekommenderar Proxmox <code>apt update &amp;&amp; apt full-upgrade</code>. Granska paketändringarna innan du bekräftar. För <strong>uppgraderingar till en ny huvudversion</strong> (PVE 8 → 9) använder du ProxMenux-flödet <upgradeLink>Uppgradera PVE 8 till PVE 9</upgradeLink>. Det lägger till förkontroller, arkivmigrering och efterkontroll. Säkerhetskopiera först."
+  },
+  "related": {
+    "heading": "Relaterat",
+    "items": [
+      {
+        "href": "/docs/utils/system-update",
+        "label": "Proxmox-systemuppdatering (interaktiv)",
+        "tail": " — verktyget utför detta med en bekräftelsedialog, bygger automatiskt om ProxMenux-hanterade drivrutiner med DKMS när en ny kärna installeras och erbjuder omstart. Kan även startas från Uppdatera nu i ProxMenux Monitors panel."
+      },
+      {
+        "href": "/docs/utils/upgrade-pve8-pve9",
+        "label": "Uppgradera PVE 8 till PVE 9",
+        "tail": " — för uppgraderingar till en ny huvudversion."
+      },
+      {
+        "href": "/docs/help-info",
+        "label": "Översikt över Hjälp och info",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sv/docs/help-info/vm-ct-commands.json b/web/messages/sv/docs/help-info/vm-ct-commands.json
new file mode 100644
index 00000000..bbe74f83
--- /dev/null
+++ b/web/messages/sv/docs/help-info/vm-ct-commands.json
@@ -0,0 +1,182 @@
+{
+  "meta": {
+    "title": "Proxmox-kommandona qm och pct — hantering av VM:ar och LXC-containrar | ProxMenux",
+    "description": "Hänvisning till Proxmox VE qm och pct kommandon för VMs och LXC containers: list, config, start, stop, shutdown, reboot, destroy, clone, migrate, snapshot, resize, plus pct exec / enter / push / pull för containrar.",
+    "ogTitle": "Proxmox-kommandona qm och pct — hantering av VM:ar och LXC-containrar",
+    "ogDescription": "Referens av Proxmox VE qm och pct kommandon - hantera virtuella maskiner och LXC containrar från CLI: start, stopp, konfigurera, ögonblicksbild, migrera, klon, förstöra.",
+    "twitterTitle": "Proxmox-kommandon med qm / pct | ProxMenux",
+    "twitterDescription": "Utvalda qm / pct-kommandon för hantering av virtuella maskiner och LXC-containrar i Proxmox VE."
+  },
+  "header": {
+    "title": "Hantering av VM:ar och CT:er",
+    "description": "Utvalda kommandon med qm för VM:ar och pct för LXC-containrar: listning, livscykel (start / stop / shutdown / destroy), konfigurationskontroll och containeråtgärder som exec, enter, push och pull.",
+    "section": "Hjälp och info"
+  },
+  "intro": {
+    "title": "Hitta ett VMID eller CTID först",
+    "body": "Nästan varje kommando behöver ett numeriskt ID. Använd <code>qm list</code> för VM:ar och <code>pct list</code> för containrar. Ersätt <code>&lt;vmid&gt;</code> / <code>&lt;ctid&gt;</code> i exemplen med rätt ID innan du kör dem."
+  },
+  "commandGroups": [
+    {
+      "title": "Lista och information",
+      "commands": [
+        {
+          "command": "qm list",
+          "description": "Lista alla virtuella maskiner"
+        },
+        {
+          "command": "pct list",
+          "description": "Lista alla LXC-containrar"
+        },
+        {
+          "command": "qm config <vmid>",
+          "description": "Visa VM-konfigurationen tolkad av qm"
+        },
+        {
+          "command": "pct config <ctid>",
+          "description": "Visa containerkonfigurationen tolkad av pct"
+        }
+      ]
+    },
+    {
+      "title": "Konfigurationsfiler (rå)",
+      "commands": [
+        {
+          "command": "cat /etc/pve/qemu-server/<vmid>.conf",
+          "description": "Visa rå VM-konfigurationsfil"
+        },
+        {
+          "command": "cat /etc/pve/lxc/<ctid>.conf",
+          "description": "Visa rå CT-konfigurationsfil"
+        },
+        {
+          "command": "nano /etc/pve/qemu-server/<vmid>.conf",
+          "description": "Redigera rå VM konfigurationsfil (nano)"
+        },
+        {
+          "command": "nano /etc/pve/lxc/<ctid>.conf",
+          "description": "Redigera rå CT konfigurationsfil (nano)"
+        },
+        {
+          "command": "vi /etc/pve/qemu-server/<vmid>.conf",
+          "description": "Redigera rå VM konfigurationsfil (vi)"
+        },
+        {
+          "command": "vi /etc/pve/lxc/<ctid>.conf",
+          "description": "Redigera rå CT konfigurationsfil (vi)"
+        }
+      ]
+    },
+    {
+      "title": "VM-hantering",
+      "commands": [
+        {
+          "command": "qm start <vmid>",
+          "description": "Starta en virtuell maskin. Använd rätt <vmid>"
+        },
+        {
+          "command": "qm stop <vmid>",
+          "description": "Tvinga stopp av en virtuell maskin. Använd rätt <vmid>"
+        },
+        {
+          "command": "qm shutdown <vmid>",
+          "description": "Stäng av en virtuell maskin ordnat"
+        },
+        {
+          "command": "qm reset <vmid>",
+          "description": "Återställ en virtuell maskin med en hård omstart"
+        },
+        {
+          "command": "qm suspend <vmid>",
+          "description": "Pausa en virtuell maskin"
+        },
+        {
+          "command": "qm resume <vmid>",
+          "description": "Återuppta en pausad virtuell maskin"
+        },
+        {
+          "command": "qm destroy <vmid>",
+          "description": "Ta bort en virtuell dator (oåterkallelig). Använd rätt <vmid>"
+        }
+      ]
+    },
+    {
+      "title": "Containerhantering",
+      "commands": [
+        {
+          "command": "pct start <ctid>",
+          "description": "Starta en container. Använd rätt <ctid>"
+        },
+        {
+          "command": "pct stop <ctid>",
+          "description": "Tvinga stopp av en container. Använd rätt <ctid>"
+        },
+        {
+          "command": "pct shutdown <ctid>",
+          "description": "Stäng av en container ordnat"
+        },
+        {
+          "command": "pct reboot <ctid>",
+          "description": "Starta om en container"
+        },
+        {
+          "command": "pct destroy <ctid>",
+          "description": "Ta bort en CT (irreversibel). Använd rätt <ctid>"
+        }
+      ]
+    },
+    {
+      "title": "Containeråtgärder",
+      "commands": [
+        {
+          "command": "pct exec <ctid> -- getent passwd | column -t -s :",
+          "description": "Visa CT-användare i tabellformat"
+        },
+        {
+          "command": "pct exec <ctid> -- ps aux --sort=-%mem | head",
+          "description": "Processer med högst minnesanvändning i CT:n"
+        },
+        {
+          "command": "pct enter <ctid>",
+          "description": "Öppna containerns skal"
+        },
+        {
+          "command": "pct push <ctid> <source> <dest>",
+          "description": "Kopiera fil från värd till container"
+        },
+        {
+          "command": "pct pull <ctid> <source> <dest>",
+          "description": "Kopiera fil från container till värd"
+        }
+      ]
+    }
+  ],
+  "destroyWarn": {
+    "title": "Förstörelse är irreversibel",
+    "bodyRich": "<code>qm destroy</code> och <code>pct destroy</code> tar bort gästkonfigurationen och dess hanterade diskvolymer. Räkna inte med att externa data eller bindmonterade data tas bort. Kommandoraden ber inte om bekräftelse som standard. Säkerhetskopiera nödvändiga data först; se <backupLink>Säkerhetskopiering och återställning</backupLink>."
+  },
+  "qmConfigTip": {
+    "title": "qm config jämfört med direkt redigering av .conf-filen",
+    "bodyRich": "<code>qm config &lt;vmid&gt;</code> och <code>pct config &lt;ctid&gt;</code> visar konfigurationen via Proxmox tolkar. För vanliga ändringar använder du helst <code>qm set</code> eller motsvarande pct-kommando. Direkt redigering av <code>/etc/pve/qemu-server/&lt;vmid&gt;.conf</code> eller <code>/etc/pve/lxc/&lt;ctid&gt;.conf</code> kringgår hanteringskommandonas validering och låsning; filen måste fortfarande gå att tolka. Stoppa gästen och behåll en kopia före manuell reparation. <code>pmxcfs</code> synkroniserar konfiguration mellan klusternoder, inte gästernas diskinnehåll."
+  },
+  "related": {
+    "heading": "Relaterat",
+    "items": [
+      {
+        "href": "/docs/help-info/backup-commands",
+        "label": "Säkerhetskopiering och återställning",
+        "tail": " — vzdump och qmrestore / pct restore."
+      },
+      {
+        "href": "/docs/help-info/storage-commands",
+        "label": "Lagring och diskar",
+        "tail": " — qm importdisk och diskhantering."
+      },
+      {
+        "href": "/docs/help-info",
+        "label": "Översikt över Hjälp och info",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sv/docs/help-info/zfs-commands.json b/web/messages/sv/docs/help-info/zfs-commands.json
new file mode 100644
index 00000000..d6d637e7
--- /dev/null
+++ b/web/messages/sv/docs/help-info/zfs-commands.json
@@ -0,0 +1,227 @@
+{
+  "meta": {
+    "title": "ZFS-kommandon på Proxmox — zpool, zfs snapshot, send/receive, scrub | ProxMenux",
+    "description": "ZFS-hanteringskommandon på Proxmox VE: zpool create / status / history, zfs list / get / set, snapshots, clone, zfs send och receive, scrub, clear, replace, zpool iostat och ARC-sammanfattning.",
+    "ogTitle": "ZFS-kommandon på Proxmox — zpool, zfs snapshot, send/receive, scrub",
+    "ogDescription": "Referens av zpool och zfs kommandon på Proxmox VE - pooler, datamängder, ögonblicksbilder, replikering, underhåll.",
+    "twitterTitle": "ZFS-kommandon på Proxmox | ProxMenux",
+    "twitterDescription": "zpool och zfs kommandon för Proxmox VE: pooler, datamängder, ögonblicksbilder, replikering, underhåll."
+  },
+  "header": {
+    "title": "ZFS-hantering",
+    "description": "Utvalda zpool- och zfs-kommandon: poolkontroll, skapa, läsa, ändra och ta bort dataset, snapshots, clone och inkrementell eller rekursiv send/receive, underhåll med scrub / clear / replace, I/O-statistik och ARC-sammanfattning.",
+    "section": "Hjälp och info"
+  },
+  "intro": {
+    "title": "Två kommandofamiljer",
+    "body": "<code>zpool *</code> hanterar lagringspoolerna (fysiskt lager - skivor, vdevs, redundans). <code>zfs *</code> hanterar datamängder och ögonblicksbilder som bor i dessa pooler (logiskt lager - filsystem, volymer, ögonblicksbilder, egenskaper)."
+  },
+  "commandGroups": [
+    {
+      "title": "Poolinformation",
+      "commands": [
+        {
+          "command": "zpool list",
+          "description": "Lista alla ZFS-pooler"
+        },
+        {
+          "command": "zpool status",
+          "description": "Visa detaljerad poolstatus och hälsa"
+        },
+        {
+          "command": "zpool status -v",
+          "description": "Visa utförlig poolstatus med fel"
+        },
+        {
+          "command": "zpool history",
+          "description": "Visa kommandohistoria för alla pooler"
+        },
+        {
+          "command": "zpool history <pool>",
+          "description": "Visa kommandohistoria för specifik pool"
+        },
+        {
+          "command": "zpool get all <pool>",
+          "description": "Visa alla egenskaper hos en pool"
+        }
+      ]
+    },
+    {
+      "title": "Datasethantering",
+      "commands": [
+        {
+          "command": "zfs list",
+          "description": "Lista alla ZFS dataset"
+        },
+        {
+          "command": "zfs list -r <pool>",
+          "description": "Lista alla dataset i en pool rekursivt"
+        },
+        {
+          "command": "zfs create <pool>/<dataset>",
+          "description": "Skapa en ny dataset"
+        },
+        {
+          "command": "zfs destroy <pool>/<dataset>",
+          "description": "Förstör en dataset"
+        },
+        {
+          "command": "zfs rename <pool>/<dataset> <pool>/<new-name>",
+          "description": "byta namn på en dataset"
+        },
+        {
+          "command": "zfs get all <pool>/<dataset>",
+          "description": "Visa alla egenskaper hos en dataset"
+        },
+        {
+          "command": "zfs set compression=on <pool>/<dataset>",
+          "description": "Aktivera komprimering på en dataset"
+        }
+      ]
+    },
+    {
+      "title": "Hantering av ögonblicksbilder",
+      "commands": [
+        {
+          "command": "zfs list -t snapshot",
+          "description": "Lista alla snapshots"
+        },
+        {
+          "command": "zfs list -t snapshot -r <pool>",
+          "description": "Lista alla ögonblicksbilder i en pool"
+        },
+        {
+          "command": "zfs snapshot <pool>/<dataset>@<snapshot-name>",
+          "description": "Skapa en snapshot"
+        },
+        {
+          "command": "zfs destroy <pool>/<dataset>@<snapshot-name>",
+          "description": "Ta bort en ögonblicksbild"
+        },
+        {
+          "command": "zfs rollback <pool>/<dataset>@<snapshot-name>",
+          "description": "Rollback till en snapshot"
+        },
+        {
+          "command": "zfs hold <tag> <pool>/<dataset>@<snapshot-name>",
+          "description": "Skydda en snapshot mot borttagning med hold"
+        },
+        {
+          "command": "zfs release <tag> <pool>/<dataset>@<snapshot-name>",
+          "description": "Ta bort hold-skyddet för en snapshot"
+        }
+      ]
+    },
+    {
+      "title": "Klon och skicka / ta emot",
+      "commands": [
+        {
+          "command": "zfs clone <pool>/<dataset>@<snapshot> <pool>/<clone-name>",
+          "description": "Skapa en klon från en ögonblicksbild"
+        },
+        {
+          "command": "zfs send <pool>/<dataset>@<snapshot> > backup.zfs",
+          "description": "Skicka en ögonblicksbild till en fil"
+        },
+        {
+          "command": "zfs receive <pool>/<dataset> < backup.zfs",
+          "description": "Få en ögonblicksbild från en fil"
+        },
+        {
+          "command": "zfs send -i <pool>/<dataset>@<snap1> <pool>/<dataset>@<snap2> > incr.zfs",
+          "description": "Skicka inkrementell snapshot"
+        },
+        {
+          "command": "zfs send -R <pool>/<dataset>@<snapshot> > full-recursive.zfs",
+          "description": "Skicka en snapshot rekursivt"
+        }
+      ]
+    },
+    {
+      "title": "Underhåll och reparation",
+      "commands": [
+        {
+          "command": "zpool scrub <pool>",
+          "description": "Starta en scrub-kontroll av en pool"
+        },
+        {
+          "command": "zpool scrub -s <pool>",
+          "description": "Stoppa pågående scrub"
+        },
+        {
+          "command": "zpool clear <pool>",
+          "description": "Nollställ felräknarna i en pool"
+        },
+        {
+          "command": "zpool clear <pool> <device>",
+          "description": "Nollställ fel för en angiven enhet"
+        },
+        {
+          "command": "zpool replace <pool> <old-device> <new-device>",
+          "description": "Ersätt en misslyckad enhet"
+        },
+        {
+          "command": "zpool offline <pool> <device>",
+          "description": "Ta en enhet offline"
+        },
+        {
+          "command": "zpool online <pool> <device>",
+          "description": "Aktivera en enhet online i poolen"
+        }
+      ]
+    },
+    {
+      "title": "Prestanda och övervakning",
+      "commands": [
+        {
+          "command": "zpool iostat",
+          "description": "Visa I/O statistik för pooler"
+        },
+        {
+          "command": "zpool iostat -v",
+          "description": "Visa detaljerad I/O statistik"
+        },
+        {
+          "command": "zpool iostat 5",
+          "description": "Visa I/O statistik varje 5 sekunder"
+        },
+        {
+          "command": "arc_summary",
+          "description": "Visa ARC-statistik (om den är installerad)"
+        },
+        {
+          "command": "zfs get compressratio <pool>/<dataset>",
+          "description": "Visa kompressionsförhållande"
+        },
+        {
+          "command": "zfs get used,available,referenced <pool>/<dataset>",
+          "description": "Visa utrymmesanvändning"
+        }
+      ]
+    }
+  ],
+  "bestPractices": {
+    "title": "Operativa bästa praxis",
+    "bodyRich": "Schemalägg <code>zpool scrub</code> regelbundet för att verifiera kontrollsummor och granska resultatet. Behåll ledig kapacitet: effekten av en nästan full pool beror på arbetslast och layout. Använd <code>zpool replace</code> för en trasig enhet och följ rutinen för dess vdev-typ. Detach + add är inte en likvärdig ersättning och kan ändra topologin eller ta bort redundans."
+  },
+  "related": {
+    "heading": "Relaterat",
+    "items": [
+      {
+        "href": "/docs/help-info/storage-commands",
+        "label": "Lagring och diskar",
+        "tail": " — generiska block-enhet och LVM kommandon."
+      },
+      {
+        "href": "/docs/help-info/backup-commands",
+        "label": "Säkerhetskopiering och återställning",
+        "tail": " — vzdump, qmrestore."
+      },
+      {
+        "href": "/docs/help-info",
+        "label": "Översikt över Hjälp och info",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sv/docs/installation.json b/web/messages/sv/docs/installation.json
new file mode 100644
index 00000000..9157dac6
--- /dev/null
+++ b/web/messages/sv/docs/installation.json
@@ -0,0 +1,93 @@
+{
+  "meta": {
+    "title": "Installera ProxMenux | ProxMenux-dokumentation",
+    "description": "Installera ProxMenux med ett kommando på Proxmox VE 8 eller senare. Färdiga JSON-kataloger ingår för åtta språk: engelska, spanska, franska, tyska, italienska, portugisiska, slovakiska och svenska. Välj språk vid installationen eller ändra det senare i inställningarna. Betakanalen ger tidig tillgång till nya funktioner.",
+    "ogTitle": "Installera ProxMenux | ProxMenux-dokumentation",
+    "ogDescription": "Installera ProxMenux på Proxmox VE 8+ i ett kommando. Stabila och betakanaler tillgängliga."
+  },
+  "header": {
+    "title": "Installera ProxMenux",
+    "description": "Installationsprogrammet startas med en rad på en Proxmox VE-värd med version 8 eller senare. Det installerar beroenden, laddar ned skripten, skapar menyns startkommando och frågar efter språk vid första körningen. Två kanaler finns: stabil (standard) och beta.",
+    "section": "Installation"
+  },
+  "stable": {
+    "heading": "Installera",
+    "intro": "Kör detta i terminalen på din Proxmox-värd:",
+    "code": "bash -c \"$(wget -qLO - https://raw.githubusercontent.com/MacRimi/ProxMenux/main/install_proxmenux.sh)\""
+  },
+  "during": {
+    "heading": "Under installationen",
+    "intro": "ProxMenux installerar automatiskt och konfigurerar de beroenden det behöver:",
+    "tablePackage": "Paket",
+    "tablePurpose": "Syfte",
+    "rows": [
+      {
+        "package": "dialog",
+        "purpose": "Interaktiva terminalmenyer"
+      },
+      {
+        "package": "curl",
+        "purpose": "Nedladdningar och anslutningskontroller"
+      },
+      {
+        "package": "jq",
+        "purpose": "JSON-bearbetning"
+      },
+      {
+        "package": "git",
+        "purpose": "Kloning och uppdatering av kodarkiv"
+      }
+    ],
+    "outro": "Installationsprogrammet laddar också ned skriptträdet till <code>/usr/local/share/proxmenux/</code> och skapar startkommandot <code>/usr/local/bin/menu</code>. Webbpanelen <strong>ProxMenux Monitor</strong> registreras som tjänsten <code>proxmenux-monitor.service</code>.",
+    "imageAlt": "ProxMenux installation pågår"
+  },
+  "first": {
+    "heading": "Första starten",
+    "intro": "Kör följande efter installationen:",
+    "code": "menu",
+    "outro": "ProxMenux öppnas i huvudmenyn. Därifrån kan du starta alla arbetsflöden som beskrivs på webbplatsen. På en nyinstallerad Proxmox-värd är <postlink>Efterinstallation</postlink> en bra början."
+  },
+  "beta": {
+    "heading": "Betakanal",
+    "calloutTitle": "Vad är Beta-programmet?",
+    "calloutBody": "Vill du testa nyheterna före den officiella utgåvan och påverka slutversionen? ProxMenux betaprogram ger tidig tillgång till nya funktioner, inklusive de senaste versionerna av Monitor, direkt från grenen <code>develop</code>. Betaversioner kan innehålla buggar och ofullständiga funktioner. Dina synpunkter hjälper till att rätta dem före den stabila utgåvan.",
+    "intro": "Installera betaversionen istället för den stabila med:",
+    "code": "bash -c \"$(wget -qLO - https://raw.githubusercontent.com/MacRimi/ProxMenux/develop/install_proxmenux_beta.sh)\"",
+    "outro": "Betaprogrammet är frivilligt: du måste uttryckligen köra beta-installationsprogrammet. När en stabil version släpps meddelar ProxMenux det vid nästa start av <code>menu</code> och erbjuder automatiskt byte. Om du vill lämna betan tidigare väljer du <betalink>Inaktivera betaprogrammet</betalink> i inställningarna."
+  },
+  "updating": {
+    "heading": "Uppdatering",
+    "body": "ProxMenux hanterar sina egna uppdateringar. När en ny version finns erbjuder nästa start av <code>menu</code> att installera den. Om du accepterar ersätts verktygets filer och konfiguration i den befintliga installationen, utan manuell nedladdning. Den stabila kanalen får stabila utgåvor och betakanalen betautgåvor, med erbjudandet om byte som beskrivs ovan. Dialogen beror på var du kör <code>menu</code>: via SSH eller i Proxmox-konsolen visas en ja/nej-dialog, och uppdateringen tillämpas direkt om du accepterar. I WebSocket-terminalen i ProxMenux Monitor visas i stället information, eftersom den terminalen skulle avbrytas under uppdateringen. Meddelandet visar installationskommandot på en rad (<code>bash -c \"$(wget -qLO - https://raw.githubusercontent.com/MacRimi/ProxMenux/main/install_proxmenux.sh)\"</code> för stabil eller motsvarande adress till <code>install_proxmenux_beta.sh</code> för beta), som du kör via SSH eller konsolen."
+  },
+  "uninstall": {
+    "heading": "Avinstallera",
+    "body": "I ProxMenux: <strong>Inställningar → Avinstallera ProxMenux</strong>. Avinstallationen tar bort skriptträdet, startkommandot och Monitor-tjänsten samt, om du väljer det, utvalda beroenden. Den återställer <code>/root/.bashrc</code> och <code>/etc/motd</code> från säkerhetskopiorna som Post-Install skapade, om de finns (annars tas ProxMenux-raden bort ur MOTD). Fullständiga instruktioner: <uninstalllink>Avinstallera ProxMenux</uninstalllink>."
+  },
+  "troubleshoot": {
+    "heading": "Felsökning",
+    "virustotalTitle": "VirusTotal flaggar installationsadressen",
+    "virustotalBody": "Resultatet 1/95 från <em>Chong Lua Dao</em>, som rapporterades i ärende #162, bedömdes av projektansvarig som ett falsklarm. Installationsprogrammet startas med ett kommando som laddar ned och kör skriptet (<code>bash -c \"$(wget -qLO - …)\"</code>) och kan ladda ned <code>jq</code> från dess officiella GitHub-utgåva. Detta <em>beteende</em> kan utlösa heuristiska skannrar. Den historiska rapporten säger inget avgörande om alla framtida nedladdningar. Installationsprogrammet har öppen källkod och kan granskas. Mer bakgrund finns i <issuelink>ärende #162</issuelink>.",
+    "aptTitle": "Installationen misslyckas med apt-fel",
+    "aptBody": "Vanligtvis saknas ett Proxmox-kodarkiv eller så är det felkonfigurerat. Installationsprogrammet hämtar beroenden via apt, som misslyckas om arkivkonfigurationen är fel. Det förekommer bland annat på minimala Proxmox 8-installationer som ännu inte har uppdaterats. Kör först <code>apt-get update</code> manuellt, rätta alla fel och kör sedan installationsprogrammet igen.",
+    "menuTitle": "`menu: command not found` efter installation",
+    "menuBody": "Startkommandot finns i <code>/usr/local/bin/menu</code>. Kontrollera med <code>ls -lh /usr/local/bin/menu</code>. Om filen saknas avbröts installationen för tidigt; kör den igen. Om filen finns men kommandot inte hittas saknar PATH <code>/usr/local/bin</code>. Rätta PATH eller kör direkt <code>/usr/local/bin/menu</code>.",
+    "stuckTitle": "Installationen fastnar eller kommer inte vidare",
+    "stuckBody": "Om en installation, ominstallation eller uppdatering fastnar på grund av ett anslutningsproblem, annullera med <strong>Ctrl + C</strong> och kör om installationsprogrammet manuellt.",
+    "otherTitle": "Andra problem",
+    "otherBody": "Sök efter kända problem i <issueslink>GitHub Issues</issueslink> eller skapa ett nytt ärende med relevanta loggar. Om du använder betan och problemet gäller Monitor, inkludera utdata från <code>journalctl -u proxmenux-monitor -n 50</code>."
+  },
+  "next": {
+    "heading": "Nästa steg",
+    "postInstall": "<postlink>Efterinstallationsskript</postlink> — anpassningar och härdning av en nyinstallerad Proxmox-värd.",
+    "introduction": "<introlink>Introduktion</introlink> — fullständig genomgång av funktionerna.",
+    "monitor": "<monitorlink>ProxMenux Monitor</monitorlink> — webbpanel för värden som installeras automatiskt tillsammans med menyn."
+  },
+  "requirements": {
+    "heading": "Krav och god praxis",
+    "reqTitle": "Krav",
+    "reqBody": "Proxmox VE <strong>8.x eller senare</strong>. PVE 7 och tidigare stöds inte. Värden behöver internetåtkomst för att hämta skript, beroenden och ProxMenux Monitors AppImage. Kör installationsprogrammet som <strong>root</strong> på Proxmox-värden.",
+    "inspectTitle": "Inspektera alltid skript du kör från internet",
+    "inspectReview": "<sourcelink>Granska installationsprogrammets källkod</sourcelink> innan du kör det.",
+    "inspectCoc": "Alla körbara länkar följer <coclink>ProxMenux uppförandekod</coclink>."
+  }
+}
diff --git a/web/messages/sv/docs/introduction.json b/web/messages/sv/docs/introduction.json
new file mode 100644
index 00000000..eb8ebeac
--- /dev/null
+++ b/web/messages/sv/docs/introduction.json
@@ -0,0 +1,206 @@
+{
+  "meta": {
+    "title": "ProxMenux — Hantera Proxmox VE via menyer | Öppen källkod",
+    "description": "Ett verktyg med öppen källkod för att hantera Proxmox VE via menyer. ProxMenux består av två delar: ett CLI/TUI för anpassningar efter installation, virtuella maskiner och LXC-containrar, GPU- och Coral TPU-genomkoppling, diskar, lagring och nätverk samt en webbpanel på den egna servern med proaktiv övervakning, aviseringar via Telegram, Discord eller e-post, AI-omformulering och ett REST-API.",
+    "ogTitle": "ProxMenux — Hantera Proxmox VE via menyer",
+    "ogDescription": "CLI/TUI med öppen källkod och webbpanel för Proxmox VE: anpassningar efter installation, virtuella maskiner, GPU:er, diskar, nätverk, lagring och säkerhet. En separat Monitor ger tillståndskontroller, aviseringar, AI-omformulering och REST-API.",
+    "twitterTitle": "ProxMenux — Hantera Proxmox VE via menyer",
+    "twitterDescription": "CLI/TUI med öppen källkod och webbpanel för Proxmox VE. Tillståndsövervakning, aviseringar, AI-omformulering och REST-API."
+  },
+  "header": {
+    "title": "Introduktion",
+    "description": "ProxMenux är ett menybaserat verktyg med öppen källkod för Proxmox VE. Projektet består av ett CLI/TUI för vanliga uppgifter kring värdsystem, virtuella maskiner, containrar, lagring, nätverk och säkerhet samt en webbpanel på den egna servern med proaktiv övervakning, aviseringar, valfri AI-omformulering och REST-API.",
+    "section": "Introduktion"
+  },
+  "hero": {
+    "tagline": "<strong>En meny för alla arbetsflöden.</strong> Det som annars kräver en öppen wikiflik, två forumtrådar och en inklistrad kommandoföljd finns som ett numrerat menyval som du kan starta på några sekunder.",
+    "audience": "För både <em>nya</em> Proxmox-användare, med genomtänkta och säkra standardinställningar, och <em>erfarna</em> administratörer som vill slippa upprepad kommandoskrivning. Kostnadsfritt och med öppen källkod samt en aktiv gemenskap på <github>GitHub</github>."
+  },
+  "twoProducts": {
+    "heading": "Två produkter, ett projekt",
+    "intro": "ProxMenux har två delar i samma källkodsträd. Installationsprogrammet installerar båda på värdsystemet: Scripts ger terminalgränssnittet och Monitor webbpanelen:",
+    "scripts": {
+      "title": "ProxMenux Scripts",
+      "body": "Det ursprungliga CLI/TUI som du startar med <code>menu</code>. Nio områden täcker optimeringar efter installation, virtuella maskiner och LXC-containrar, GPU- och Coral TPU-genomkoppling, diskar, lagring, nätverk, säkerhet och verktyg samt en utvald kommandoreferens. Fungerar i lokala terminaler, via SSH och i webbterminaler."
+    },
+    "monitor": {
+      "title": "ProxMenux Monitor",
+      "body": "Webbpanel på den egna servern, distribuerad som AppImage. Värdsystemets mätvärden i realtid, proaktiv övervakning, aviseringar, valfri AI-omformulering med sex leverantörer, inbyggd webbterminal och REST-API. Aktiveras i Scripts-menyn under Inställningar → ProxMenux Monitor."
+    },
+    "calloutTitle": "Vad ProxMenux hanterar",
+    "calloutIntro": "Tre lager, alla tillgängliga från samma projekt:",
+    "layers": [
+      "<strong>Proxmox-värdsystemet</strong> — paketförråd, paket, nätverk, ZFS, Ceph, kärna och övervakning.",
+      "<strong>Virtuella maskiner (VM)</strong> — skapande, GPU-genomkoppling, import och export av OVA/OVF samt direktåtkomst till diskar.",
+      "<strong>LXC-containrar</strong> — skapande, monteringspunkter, GPU-/TPU-genomkoppling samt NFS-/Samba-klienter och -servrar."
+    ]
+  },
+  "scriptsSection": {
+    "heading": "ProxMenux Scripts - vad du får",
+    "intro": "Nio funktionella områden, var och en med sin egen meny i <code>menu</code> och en detaljsida i dokumentationen. Klicka på vilket kort som helst för att hoppa direkt till det avsnittets översikt.",
+    "items": [
+      {
+        "title": "Efter installationen",
+        "description": "Optimeringar för en ny Proxmox-installation: paketförråd, kärna, tidssynkronisering, grundläggande säkerhet och prestanda, med alternativ som kan återställas.",
+        "icon": "Server",
+        "href": "/docs/post-install"
+      },
+      {
+        "title": "GPU & Coral TPU",
+        "description": "Genomkoppling av NVIDIA, Intel iGPU, AMD och Coral TPU till virtuella maskiner och LXC-containrar, med växling mellan VM- och LXC-läge.",
+        "icon": "Cpu",
+        "href": "/docs/hardware/nvidia-host"
+      },
+      {
+        "title": "Skapa VM",
+        "description": "Guider för NAS-system, Windows och Linux med lämpliga standardinställningar för maskinvara, lagring och nätverk.",
+        "icon": "Server",
+        "href": "/docs/create-vm"
+      },
+      {
+        "title": "Diskhanteraren",
+        "description": "Ge virtuella maskiner och LXC tillgång till fysiska diskar, formatera och radera, kör SMART-tester och importera qcow2-, vmdk- och vdi-avbilder — allt via en meny.",
+        "icon": "HardDrive",
+        "href": "/docs/disk-manager"
+      },
+      {
+        "title": "Lagring och delning",
+        "description": "Registrera NFS-, Samba-/CIFS-, iSCSI- och lokal lagring i Proxmox och dela mappar mellan värdsystemet och LXC-containrar via bind-monteringar eller nätverksprotokoll.",
+        "icon": "Boxes",
+        "href": "/docs/storage-share"
+      },
+      {
+        "title": "Nätverk",
+        "description": "Diagnostik utan ändringar, analys följd av förslag och guidade reparationer av /etc/network/interfaces. Säkerhetskopior skapas före ändringar.",
+        "icon": "Network",
+        "href": "/docs/network"
+      },
+      {
+        "title": "Säkerhet",
+        "description": "Fail2Ban för att skydda SSH och webbgränssnitt mot intrångsförsök samt Lynis för säkerhetsgranskning — installation och hantering med lämpliga standardinställningar.",
+        "icon": "Shield",
+        "href": "/docs/security"
+      },
+      {
+        "title": "Verktyg",
+        "description": "Skapa Windows-ISO:er med UUP Dump, installera CLI-verktyg, kör guidade systemuppdateringar eller uppgradera PVE 8 till 9 samt exportera och importera virtuella maskiner i OVA-/OVF-format.",
+        "icon": "Wrench",
+        "href": "/docs/utils"
+      },
+      {
+        "title": "Kommandoreferens",
+        "description": "En utvald samling Linux- och Proxmox-kommandon efter ämne: system, VM/CT med qm och pct, lagring, nätverk, ZFS, GPU-genomkoppling, säkerhetskopiering och CLI-verktyg för vardagen.",
+        "icon": "BookOpen",
+        "href": "/docs/help-info"
+      }
+    ]
+  },
+  "monitorSection": {
+    "heading": "ProxMenux Monitor - vad du får",
+    "intro": "Webbpanelen körs på Proxmox-värdsystemet via TCP-port 8008. Klicka på ett kort för att öppna motsvarande sida eller läs först <link>översikten över Monitor</link>.",
+    "items": [
+      {
+        "title": "Tillståndsövervakning",
+        "description": "Tio kategorier kontrolleras var femte minut: CPU, minne, lagring, diskar/SMART, nätverk, virtuella maskiner, tjänster, loggar, uppdateringar och säkerhet. Med allvarlighetsgrader och möjlighet att undertrycka aviseringar per kategori.",
+        "icon": "Activity",
+        "href": "/docs/monitor/health-monitor"
+      },
+      {
+        "title": "Aviseringar",
+        "description": "Telegram, Discord, e-post, Gotify, Pushover och Apprise för flera kanaler — med borttagning av dubbletter, minsta intervall mellan utskick, gruppering av täta aviseringar, tysta tider och fullständig historik.",
+        "icon": "Bell",
+        "href": "/docs/monitor/notifications"
+      },
+      {
+        "title": "AI assistent",
+        "description": "Valfri omformulering av aviseringar till lättbegripligt språk. Sex leverantörer: OpenAI, Anthropic Claude, Google Gemini, Groq, OpenRouter och lokalt körd Ollama. Tretton språk i AI-språkvalet.",
+        "icon": "Sparkles",
+        "href": "/docs/monitor/ai-assistant"
+      },
+      {
+        "title": "Webbterminal",
+        "description": "Ett interaktivt skal på Proxmox-värdsystemet i webbläsaren samt en separat ProxMenux Scripts-terminal som kör menyn i webbgränssnittet.",
+        "icon": "Terminal",
+        "href": "/docs/monitor/dashboard/terminal"
+      },
+      {
+        "title": "REST API",
+        "description": "HTTP-slutpunkter för system, tillstånd, lagring/SMART, nätverk, virtuella maskiner, aviseringar och säkerhet — för Homepage, Home Assistant, Prometheus eller egna skript.",
+        "icon": "Code2",
+        "href": "/docs/monitor/api"
+      },
+      {
+        "title": "Integrationer",
+        "description": "Inbyggd Proxmox VE-webhook, mätvärdesinsamling med Prometheus, kontroller med Uptime Kuma, widgetar för Homepage, Home Assistant och Glance, n8n-/Zapier-flöden samt Tailscale Secure Gateway.",
+        "icon": "Plug",
+        "href": "/docs/monitor/integrations"
+      }
+    ]
+  },
+  "installPaths": {
+    "heading": "Installationsalternativ",
+    "intro": "Båda installationsprogrammen installerar Scripts och Monitor. Scripts använder färdiga JSON-kataloger på åtta språk utan onlineöversättning. Välj stabil- eller betakanalen; Monitor distribueras som AppImage och körs från sin uppackade körmiljö:",
+    "headerPath": "Install path",
+    "headerBundles": "Vad som ingår",
+    "headerWhen": "När det passar",
+    "rows": [
+      {
+        "pathRich": "<strong>Scripts: stabil</strong>",
+        "bundles": "CLI/TUI med färdiga JSON-översättningar på åtta språk, utan virtuell miljö eller onlinetjänst för översättning.",
+        "when": "Vanlig användning med den stabila versionskanalen."
+      },
+      {
+        "pathRich": "<strong>Scripts: beta</strong>",
+        "bundles": "Samma flerspråkiga gränssnitt, installerat från develop-grenen för att testa kommande ändringar.",
+        "when": "Tidig testning av nya funktioner, med större risk för fel."
+      },
+      {
+        "pathRich": "<strong>Monitor</strong>",
+        "bundles": "Fristående AppImage med webbpanel på TCP-port 8008. Installationsprogrammet packar upp körmiljön och hanterar tjänsten; Monitor kan styras från inställningarna.",
+        "when": "När du vill följa värdsystemet i en webbpanel på mobil, surfplatta eller i webbläsaren."
+      }
+    ],
+    "outro": "Detaljerade kommandon och förutsättningar finns på <link>installationssidan</link>."
+  },
+  "warnSource": {
+    "title": "Granska alltid skript från internet innan du kör dem",
+    "body": "ProxMenux har öppen källkod och du kan granska varje skript på GitHub. Läs källkoden innan du kör installationskommandot. Gör samma sak med andra automationsverktyg.",
+    "sourceLabel": "Visa ProxMenux-källa",
+    "cocLabel": "Uppförandekod"
+  },
+  "next": {
+    "heading": "Nästa steg",
+    "items": [
+      {
+        "lead": "<strong>Ny med ProxMenux?</strong> ",
+        "linkHref": "/docs/installation",
+        "linkLabel": "Installera med ett enda kommando",
+        "tailRich": " och kör <code>menu</code>."
+      },
+      {
+        "lead": "<strong>Har du just installerat Proxmox?</strong> Börja med ",
+        "linkHref": "/docs/post-install",
+        "linkLabel": "skriptet för efterinstallation",
+        "tail": "."
+      },
+      {
+        "lead": "<strong>Vill du ha en webbpanel?</strong> ",
+        "linkHref": "/docs/monitor",
+        "linkLabel": "ProxMenux Monitor",
+        "tail": " har dokumentation som förklarar vad panelen visar, hur den är byggd och hur du skyddar den."
+      },
+      {
+        "lead": "<strong>Letar du efter ett visst kommando?</strong> ",
+        "linkHref": "/docs/help-info",
+        "linkLabel": "Kommandoreferensen",
+        "tail": " innehåller ett urval ordnat efter ämne, med kopieringsknappar."
+      },
+      {
+        "lead": "<strong>Vill du ha mer utförliga guider?</strong> ",
+        "linkHref": "/guides",
+        "linkLabel": "Guideavsnittet",
+        "tail": " tar upp Coral TPU, NVIDIA-genomkoppling, Kodi i LXC och annat."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sv/docs/network/backup-restore.json b/web/messages/sv/docs/network/backup-restore.json
new file mode 100644
index 00000000..6b0269b3
--- /dev/null
+++ b/web/messages/sv/docs/network/backup-restore.json
@@ -0,0 +1,110 @@
+{
+  "meta": {
+    "title": "Säkerhetskopiering och omstart av gränssnitt | ProxMenux-dokumentation",
+    "description": "Ta manuella ögonblicksbilder, bläddra bland och återställ säkerhetskopior av /etc/network/interfaces som lagras i /var/backups/proxmenux/. Inkluderar omstart av nätverkstjänsten med bekräftelse och en snabbvy av den aktuella konfigurationen.",
+    "ogTitle": "Säkerhetskopiering och omstart av gränssnitt | ProxMenux-dokumentation",
+    "ogDescription": "Ta en ögonblicksbild och återställ Proxmox nätverkskonfiguration; starta om nätverkstjänsten med bekräftelse."
+  },
+  "header": {
+    "title": "Säkerhetskopiering och omstart av gränssnitt",
+    "description": "Fyra verktyg för /etc/network/interfaces: ta en manuell ögonblicksbild, visa aktuell konfiguration, återställa en tidigare säkerhetskopia med valfri förhandsvisning och starta om nätverkstjänsten med uttryckligt samtycke. Samma katalog för säkerhetskopior används av de guidade reparationerna.",
+    "section": "Nätverk"
+  },
+  "intro": {
+    "title": "Vad detta gör",
+    "body": "Hanterar samma katalog för säkerhetskopior som de guidade reparationerna (<code>/var/backups/proxmenux/</code>). Du kan ta en extra ögonblicksbild före manuella ändringar, bläddra bland alla befintliga säkerhetskopior och återställa vilken som helst — alltid med en ny automatisk säkerhetskopia före återställningen som ett andra skydd."
+  },
+  "shared": {
+    "heading": "Den gemensamma katalogen för säkerhetskopior",
+    "intro": "Varje säkerhetskopia som tas någonstans i nätverksmenyn landar på samma ställe:",
+    "outro": "Filnamnen är tidsstämplade och sorterade efter datum, och filerna skrivs aldrig över. Katalogen skapas vid första användningen."
+  },
+  "show": {
+    "heading": "Visa nätverkskonfigurationsfil",
+    "body": "Skriver ut <code>/etc/network/interfaces</code> oförändrad i terminalen. Skrivskyddat. Användbart som kontroll före säkerhetskopiering eller efter återställning. Det finns inget separat verktyg för att jämföra med föregående säkerhetskopia, så att granska den aktuella filen är det enklaste sättet att kontrollera innehållet."
+  },
+  "create": {
+    "heading": "Skapa nätverksbackup",
+    "body": "Kopierar den nuvarande <code>/etc/network/interfaces</code> i backupkatalogen med en ny tidsstämpel. Det är det - ingen analys, inga prompts, bara en ögonblicksbild.",
+    "whenTitle": "När man tar en manuell backup",
+    "whenBody": "Innan du redigerar <code>/etc/network/interfaces</code> för hand, installerar ett paket som kan ändra nätverksstacken (till exempel NetworkManager eller Open vSwitch) eller gör en maskinvaruändring. De guidade reparationerna tar redan ögonblicksbilder automatiskt — det här alternativet är för <em>manuella</em> ingrepp."
+  },
+  "restore": {
+    "heading": "Återställ nätverkssäkerhetskopia",
+    "intro": "Listar alla säkerhetskopior i <code>/var/backups/proxmenux/</code> från nyast till äldst och vägleder genom en återställning med skyddsåtgärder:",
+    "steps": [
+      {
+        "title": "1. Välj en backup",
+        "body": "En meny listar varje säkerhetskopia med dess tidsstämpel. Om det inte finns några säkerhetskopior avslutas flödet med ett tydligt meddelande.",
+        "tone": "blue"
+      },
+      {
+        "title": "2. Valfri förhandsvisning",
+        "body": "Erbjuder att öppna den valda säkerhetskopian i en rullningsbar vy innan återställningen bekräftas. Ja är standardvalet — hoppa inte över detta på en fjärransluten värd.",
+        "tone": "blue"
+      },
+      {
+        "title": "3. Säkerhetskopiering före återställning",
+        "body": "Tar <strong>ytterligare en</strong> säkerhetskopia av det aktuella tillståndet innan <code>/etc/network/interfaces</code> skrivs över. Återställning är i sig en destruktiv åtgärd, så den nya ögonblicksbilden före återställningen gör att du kan gå tillbaka om du valde fel säkerhetskopia.",
+        "tone": "amber"
+      },
+      {
+        "title": "4. Applicera återställningen",
+        "body": "Skriver den valda säkerhetskopian över <code>/etc/network/interfaces</code>. Filen har ändrats på disk, men kärnans aktuella tillstånd speglar fortfarande den tidigare konfigurationen.",
+        "tone": "amber"
+      },
+      {
+        "title": "5. Valfri omstart",
+        "body": "Frågar om <code>systemctl restart networking</code> ska köras nu. Avböj för att skjuta upp ändringen till nästa omstart.",
+        "tone": "emerald"
+      }
+    ],
+    "autoBackupTitle": "En återställning tar sin egen backup automatiskt",
+    "autoBackupBody": "När du väljer <em>Återställ nätverkssäkerhetskopia</em> tas alltid en ny ögonblicksbild av den <em>aktuella</em> konfigurationen innan den skrivs över. Om du återställer fel säkerhetskopia innehåller den senaste filen i <code>/var/backups/proxmenux/</code> tillståndet du hade före återställningen."
+  },
+  "restart": {
+    "heading": "Starta om nätverkstjänsten",
+    "body": "Kör <code>systemctl restart networking</code> efter en ja/nej-bekräftelse. Rapporterar resultatet med <code>msg_ok</code> / <code>msg_error</code>. De flesta flöden i menyn erbjuder redan en omstart i slutet. Detta alternativ används efter en manuell ändring eller om du tidigare avböjt den erbjudna omstarten.",
+    "warnTitle": "Kort frånkoppling garanteras; permanent frånkoppling är möjlig",
+    "warnBody": "Omstart av <code>networking</code> tar ned och konfigurerar om alla gränssnitt som deklareras i <code>/etc/network/interfaces</code>. SSH-sessioner via dessa gränssnitt bryts. Om den nya konfigurationen är ogiltig kommer nätverket inte tillbaka. Kör endast detta när:",
+    "warnItems": [
+      "Du har konsolåtkomst / IPMI / iKVM redo, <em>eller</em>",
+      "Du befinner dig fysiskt bredvid maskinen, <em>eller</em>",
+      "Du har precis återställt en konfiguration som du vet fungerar och vill tillämpa den."
+    ]
+  },
+  "manualRollback": {
+    "heading": "Manuell återgång från en konsol",
+    "intro": "Om du inte kan nå menyn (ingen SSH, dialog kraschar, ...) men kan nå en konsol, är återgång två kommandon:",
+    "outro": "Det är <em>samma</em> åtgärd som menyn utför, bara inmatad för hand. Om <code>networking</code> fortfarande inte startar, kontrollera <code>journalctl -u networking -b</code> för att hitta det bakomliggande syntax- eller drivrutinsfelet."
+  },
+  "troubleshoot": {
+    "heading": "Felsökning",
+    "noneTitle": "”Inga säkerhetskopior hittades” vid återställning",
+    "noneBody": "Katalogen <code>/var/backups/proxmenux/</code> finns inte eller innehåller inga <code>interfaces_backup_*</code>-filer. Kör <em>Skapa nätverksbackup</em> minst en gång eller en guidad reparation som tar en säkerhetskopia automatiskt. Bekräfta med <code>ls /var/backups/proxmenux/</code>.",
+    "unreachTitle": "Omstart av nätverket lyckas men värden är fortfarande onåbar",
+    "unreachBody": "Den nya konfigurationen är fel eller tilldelar inte din IP-adress för administration. Återställ från konsolen (se ovan). Använd sedan <bridgeLink>brygganalys</bridgeLink> och <configLink>konfigurationsanalys</configLink> för att förstå felet innan du tillämpar den igen.",
+    "emptyTitle": "Förhandsvisningen för återställning visar en tom fil",
+    "emptyBody": "Säkerhetskopian är tom (0 byte). Det händer om en kopiering misslyckats utan felmeddelande under en tidigare körning. Välj en äldre säkerhetskopia eller kör <em>Skapa nätverksbackup</em> igen nu om den aktuella konfigurationen fungerar."
+  },
+  "related": {
+    "heading": "Relaterat",
+    "items": [
+      {
+        "label": "Brygganalys och guidad reparation",
+        "href": "/docs/network/bridge-analysis",
+        "tail": " — Den vanligaste orsaken till att en säkerhetskopia hamnar här."
+      },
+      {
+        "label": "Konfigurationsanalys och guidad rensning",
+        "href": "/docs/network/config-analysis",
+        "tailRich": " - skriver också till <code>/var/backups/proxmenux/</code> automatiskt."
+      },
+      {
+        "label": "Diagnostik",
+        "href": "/docs/network/diagnostics",
+        "tail": " — för att verifiera det aktuella tillståndet efter en återställning."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sv/docs/network/bridge-analysis.json b/web/messages/sv/docs/network/bridge-analysis.json
new file mode 100644
index 00000000..24d477a6
--- /dev/null
+++ b/web/messages/sv/docs/network/bridge-analysis.json
@@ -0,0 +1,132 @@
+{
+  "meta": {
+    "title": "Brygganalys och guidad reparation | ProxMenux-dokumentation",
+    "description": "Upptäcker vmbrX-bryggor med saknade eller ogiltiga fysiska portar, vanligen efter omnumrering av PCI-enheter. Rapporterar dem med föreslagna skalkommandon och erbjuder guidad reparation i 5 steg med obligatorisk säkerhetskopia.",
+    "ogTitle": "Brygganalys och guidad reparation | ProxMenux-dokumentation",
+    "ogDescription": "Granska och reparera Proxmox bryggportar efter maskinvaruändringar med ett guidat flöde som ger säker återställning."
+  },
+  "header": {
+    "title": "Brygganalys och guidad reparation",
+    "description": "Granskar varje vmbrX-brygga i /etc/network/interfaces, kontrollerar att dess fysiska portar finns och erbjuder stegvis reparation om de saknas. Analysen är skrivskyddad; reparationen kräver godkännande, visar en förhandsvisning och tar en säkerhetskopia.",
+    "section": "Nätverk"
+  },
+  "intro": {
+    "title": "Vad detta gör",
+    "body": "Läser varje brygga i <code>/etc/network/interfaces</code>, granskar dess <code>bridge-ports</code>-rad och kontrollerar att varje deklarerad port, till exempel <code>enp3s0</code>, finns på värden. Om en port saknas föreslås en ersättning och ändringen tillämpas med uttryckligt samtycke i flödet <strong>säkerhetskopiera, förhandsvisa, tillämpa, verifiera</strong>."
+  },
+  "when": {
+    "heading": "När du behöver detta",
+    "intro": "Linux tilldelar förutsägbara gränssnittsnamn från PCI topologi och slot order. Flera händelser blandar dem och lämnar <code>/etc/network/interfaces</code> med hänvisning till namn som inte längre finns:",
+    "items": [
+      "Lägga till eller ta bort ett PCIe-kort (en NIC, en GPU, en HBA, en NVMe-bärare).",
+      "Flytta ett befintligt kort till en annan PCIe slot.",
+      "BIOS-/UEFI-uppdateringar som numrerar om PCI-enheter.",
+      "Flytta startdisken till annan maskinvara."
+    ],
+    "outro": "Efter nästa start försöker bryggan ansluta till en port som inte längre finns. Den kan inte aktiveras och värden förlorar nätverksanslutningen. <link>Beständiga gränssnittsnamn</link> förhindrar att detta händer igen. Om du redan är utelåst visar den här sidan hur du återställer åtkomsten."
+  },
+  "bigPicture": {
+    "heading": "Överblick",
+    "diagram1": {
+      "arrowLabel": "Steg 1",
+      "nodes": {
+        "sourceLabel": "/etc/network/interfaces",
+        "sourceDetail": "auto vmbr0\niface vmbr0 inet static\n  bridge-ports enp3s0",
+        "bridgeLabel": "Analysera (skrivskyddat)",
+        "bridgeDetail": "ip link show enp3s0\n→ finns inte",
+        "targetLabel": "Rapport + förslag",
+        "targetDetail": "❌ enp3s0: HITTADES INTE\nErsätt med: eno1\n(inga ändringar ännu)"
+      }
+    },
+    "diagram2": {
+      "arrowLabel": "tillämpa med säkerhetskopia",
+      "nodes": {
+        "sourceLabel": "Guidad reparation",
+        "sourceDetail": "1. Säkerhetskopiera\n2. Visa aktuell konfiguration\n3. Förhandsvisa ändringar\n4. Tillämpa\n5. Verifiera",
+        "targetLabel": "/etc/network/interfaces (ny)",
+        "targetDetail": "auto vmbr0\niface vmbr0 inet static\n  bridge-ports eno1"
+      }
+    }
+  },
+  "step1": {
+    "heading": "Steg 1: analys (skrivskyddad)",
+    "intro": "När du väljer <strong>Analysera bryggkonfiguration</strong> avbryts verktyget direkt om värden inte använder den klassiska Debian/Proxmox-stacken. Annars granskas varje brygga och följande rapporteras:",
+    "items": [
+      "Bryggnamn, aktuell status (UP / DOWN), tilldelad IP.",
+      "Varje deklarerad port och om den för närvarande finns (<code>ip link show &lt;port&gt;</code>).",
+      "För varje ogiltig port: en föreslagen ersättning (det första tillgängliga fysiska gränssnittet) och det exakta <code>sed</code>-kommandot för att tillämpa ändringen manuellt.",
+      "Broar utan <code>bridge-ports</code> alls och föräldralösa <code>auto</code>-poster (ingen matchande <code>iface</code>-block)."
+    ],
+    "readonlyTitle": "Garanti för skrivskyddad analys",
+    "readonlyBody": "Fram till denna punkt har skriptet inte kört ett enda kommando som ändrar systemet. Du kan lämna analysen öppen, kopiera de föreslagna <code>sed</code>-kommandona och tillämpa dem manuellt om du vill, eller godkänna nästa fråga för att gå vidare till den guidade reparationen."
+  },
+  "step2": {
+    "heading": "Steg 2: guidad reparation (5 steg)",
+    "intro": "Startas bara om du godkänner frågan i slutet av analysen. Varje steg visar vad som kommer att ske och ber om bekräftelse innan flödet fortsätter.",
+    "steps": [
+      {
+        "title": "1. Säkerhetskopia",
+        "body": "Kopierar <code>/etc/network/interfaces</code> till <code>/var/backups/proxmenux/interfaces_backup_&lt;TIMESTAMP&gt;</code>. Den exakta sökvägen visas före och efter kopieringen, tillsammans med återställningskommandot.",
+        "tone": "blue"
+      },
+      {
+        "title": "2. Granska nuvarande konfiguration",
+        "body": "Öppnar live <code>/etc/network/interfaces</code> i en rullningsbar dialog så att du kan se exakt vad som ska ändras.",
+        "tone": "blue"
+      },
+      {
+        "title": "3. Förhandsgranska föreslagna ändringar",
+        "body": "Listar exakt vilka bryggor som berörs och vilka portbyten som planeras. Om ingen reparation längre behövs eftersom porten har dykt upp igen mellan kontrollerna avslutas flödet med <em>”Inga ändringar behövs.”</em>",
+        "tone": "blue"
+      },
+      {
+        "title": "4. Tillämpa ändringarna",
+        "body": "För varje drabbad bro kör <code>sed -i \"/iface $bridge/,/bridge-ports/ s/bridge-ports.*/bridge-ports $new_ports/\"</code> mot <code>/etc/network/interfaces</code>. Om en bro inte hade någon giltig ersättning tillgänglig, är ersättningen hoppad och rapporterad i steg 5.",
+        "tone": "amber"
+      },
+      {
+        "title": "5. Verifiering",
+        "body": "Läser filen igen och bekräftar att varje bryggas nya port finns. Skriver ut återställningskommandot (<code>cp &lt;backup&gt; /etc/network/interfaces</code>). Erbjuder slutligen <strong>Starta om nätverket</strong> — godkänn bara om du har konsolåtkomst som reserv.",
+        "tone": "emerald"
+      }
+    ],
+    "restartTitle": "Omstart av nätverket ≠ riskfri återställning",
+    "restartBody": "Reparationen skrivs till disk oavsett om du startar om tjänsten. <code>systemctl restart networking</code> tillämpar ändringen <em>nu</em>, vilket kan bryta SSH-sessionen om den nya porten är fel. Om du avböjer börjar ändringen ändå gälla vid nästa omstart — kontrollera först den nya konfigurationen eller återställ med det utskrivna kommandot."
+  },
+  "edits": {
+    "heading": "Vad blir redigerat (exakt)",
+    "body": "Endast <code>bridge-ports</code>-raden för varje berörd brygga. Andra direktiv (<code>address</code>, <code>netmask</code>, <code>gateway</code>, <code>bridge-stp</code>, …) lämnas orörda. Skriptet skapar eller tar aldrig bort <code>iface</code>-block i detta flöde — det sköts av <link>konfigurationsanalys &amp; rensning</link>."
+  },
+  "troubleshoot": {
+    "heading": "Felsökning",
+    "unsupportedTitle": "Analysen avbryts med ”Nätverksstacken stöds inte”",
+    "unsupportedBody": "Värden kör netplan, systemd-networkd eller NetworkManager. Verktyget stöder endast <code>/etc/network/interfaces</code>. Byt först till den klassiska stacken eller redigera konfigurationen med nätverkshanterarens egna verktyg, till exempel <code>netplan apply</code>.",
+    "noSuggestTitle": "Inget förslag trycks för en ogiltig port",
+    "noSuggestBody": "Värden har noll fria fysiska gränssnitt (allt är antingen redan i en annan bro eller inte existerar). Analysen faller tillbaka för att föreslå <code>bridge-ports none</code> så att bron åtminstone kan komma upp utan en port. Lägg till en NIC eller migrera portar mellan broar manuellt innan du kör.",
+    "stillDownTitle": "Reparationen slutförs men bron är fortfarande DOWN",
+    "stillDownBody": "<code>sed</code> uppdaterade filen men <code>systemctl restart networking</code> avböjdes. Kör kommandot manuellt när den nya konfigurationen har kontrollerats eller starta om. Om omstarten godkändes och bryggan fortfarande är DOWN, kör <code>ip link show</code> för att kontrollera att den nya porten finns och granska sedan <code>journalctl -u networking</code> för det verkliga felet: urkopplad kabel, länk som inte förhandlats fram eller port som redan tillhör en annan brygga.",
+    "lostSshTitle": "Jag förlorade SSH-åtkomst direkt efter att ha startat om nätverk",
+    "lostSshIntro": "Använd konsol / IPMI / iKVM för att nå värden. Återställ backup:",
+    "lostSshOutro": "Kör sedan analysen igen från konsolen för att ta reda på varför förslaget inte fungerade, oftast för att ersättningsporten inte är ansluten."
+  },
+  "related": {
+    "heading": "Relaterat",
+    "items": [
+      {
+        "label": "Beständiga gränssnittsnamn",
+        "href": "/docs/network/persistent-names",
+        "tail": " — binder namn till MAC-adresser så att problemet inte återkommer."
+      },
+      {
+        "label": "Konfigurationsanalys och guidad rensning",
+        "href": "/docs/network/config-analysis",
+        "tailRich": " — för föräldralösa <code>iface</code> block (den andra hälften av samma problem)."
+      },
+      {
+        "label": "Säkerhetskopiering och omstart av gränssnitt",
+        "href": "/docs/network/backup-restore",
+        "tail": " — manuella ögonblicksbilder och bläddring bland säkerhetskopior för återställning."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sv/docs/network/config-analysis.json b/web/messages/sv/docs/network/config-analysis.json
new file mode 100644
index 00000000..213f14af
--- /dev/null
+++ b/web/messages/sv/docs/network/config-analysis.json
@@ -0,0 +1,122 @@
+{
+  "meta": {
+    "title": "Konfigurationsanalys och guidad rensning | ProxMenux-dokumentation",
+    "description": "Upptäcker iface-block i /etc/network/interfaces som refererar till fysiska nätverkskort som inte längre finns på värden. Rapporterar dem och erbjuder guidad borttagning i 5 steg med obligatorisk säkerhetskopiering och förhandsvisning av varje block.",
+    "ogTitle": "Konfigurationsanalys och guidad rensning | ProxMenux-dokumentation",
+    "ogDescription": "Hitta och ta bort föräldralösa gränssnittsblock kvar av hårdvaruförändringar, med full förhandsgranskning och återgång."
+  },
+  "header": {
+    "title": "Konfigurationsanalys och guidad rensning",
+    "description": "Går igenom varje iface-block i /etc/network/interfaces och kontrollerar att det underliggande fysiska nätverkskortet finns kvar. Rapporterar överblivna block efter maskinvaruändringar och erbjuder guidad borttagning med säkerhetskopia, förhandsvisning och bekräftelse för varje block.",
+    "section": "Nätverk"
+  },
+  "intro": {
+    "title": "Vad detta gör",
+    "body": "Identifierar <code>iface</code>-deklarationer vars stödjande NIC inte längre finns på värden (vanligtvis efter att ett nätverkskort har bytts ut eller tagits bort). Erbjuder sedan en guidad rensning som <em>endast</em> tar bort de föräldralösa blocken, med en säkerhetskopia, en förhandsgranskning per sektion och en explicit slutlig bekräftelse."
+  },
+  "differs": {
+    "heading": "Hur det skiljer sig från brygganalys",
+    "headerAspect": "Aspekt",
+    "headerBridge": "Brygganalys",
+    "headerConfig": "Konfigurationsanalys",
+    "rows": [
+      {
+        "aspect": "Granskar",
+        "bridge": "Bryggor (<code>vmbrX</code>) och deras <code>bridge-ports</code> linje",
+        "config": "Varje <code>iface</code>-block utom loopback, bryggor och bondgränssnitt"
+      },
+      {
+        "aspect": "Detekterar",
+        "bridge": "Bryggor som refererar till en port som inte finns",
+        "config": "Fristående gränssnittsblock för nätverkskort som inte finns"
+      },
+      {
+        "aspect": "Reparationsåtgärder",
+        "bridge": "Ersätter portnamnet i <code>bridge-ports</code>",
+        "config": "Ta bort hela <code>iface</code>-blocket"
+      },
+      {
+        "aspect": "Exkluderar",
+        "bridge": "Ingenting – varje bro analyseras",
+        "config": "Bryggor (<code>vmbrX</code>) och bondgränssnitt (<code>bondX</code>) behålls alltid eftersom de är virtuella och det kan vara normalt att de saknas under start"
+      }
+    ],
+    "outro": "I praktiken kör du ofta båda i denna ordning: först <strong>konfigurationsanalys</strong> för att ta bort överblivna block, sedan <link>brygganalys</link> för att ändra portkopplingen för bryggor som använde det borttagna gränssnittet."
+  },
+  "step1": {
+    "heading": "Steg 1: analys (skrivskyddad)",
+    "intro": "Avbryter omedelbart om värden inte använder den klassiska stacken. Annars listas alla konfigurerade gränssnitt utom loopback med sina tillstånd:",
+    "virtTitle": "Virtuella gränssnitt skyddas",
+    "virtBody": "Bryggor (<code>vmbrX</code>) och bondgränssnitt (<code>bondX</code>) är virtuella konstruktioner. De kan av giltiga skäl saknas vid inspektionen, till exempel en brygga som ännu saknar portar. Analysen föreslår därför aldrig att de tas bort, bara fysiska nätverkskort."
+  },
+  "step2": {
+    "heading": "Steg 2: guidad rensning (5 steg)",
+    "intro": "Startas bara om du godkänner frågan i slutet av analysen. Varje steg kräver bekräftelse; om du avbryter avslutas flödet utan att skriva.",
+    "steps": [
+      {
+        "title": "1. Säkerhetskopia",
+        "body": "Kopierar <code>/etc/network/interfaces</code> till <code>/var/backups/proxmenux/interfaces_backup_&lt;TIMESTAMP&gt;</code>. Sökvägen visas före och efter.",
+        "tone": "blue"
+      },
+      {
+        "title": "2. Bekräfta borttagningslistan",
+        "body": "Listar exakt vilka fysiska gränssnittsblock som ska tas bort. Om nätverkskorten har dykt upp igen mellan analys och rensning, till exempel efter att ett kort satts i igen, avslutas flödet med <em>”Ingen rensning behövs.”</em>",
+        "tone": "blue"
+      },
+      {
+        "title": "3. Förhandsvisa de exakta blocken",
+        "body": "Öppnar en rullningsbar vy av varje <code>iface</code>-block som skulle raderas, exakt som det står i filen. Här kan du till exempel upptäcka en viktig <code>up</code>-hook som du vill behålla.",
+        "tone": "blue"
+      },
+      {
+        "title": "4. Tillämpa borttagningen",
+        "body": "För varje föräldralös gränssnitt, kör <code>sed -i \"/^iface $iface/,/^$/d\" /etc/network/interfaces</code>. Det tar bort från matchande <code>iface</code> linje upp till nästa tomma rad.",
+        "tone": "amber"
+      },
+      {
+        "title": "5. Verifiering",
+        "body": "Läser filen igen, listar det som togs bort och kontrollerar återstående gränssnitt. Skriver ut återställningskommandot. Startar <strong>inte</strong> om nätverket automatiskt — borttagning av ett oanvänt block kan säkert tillämpas vid nästa omstart utan att ändra det aktuella tillståndet.",
+        "tone": "emerald"
+      }
+    ],
+    "noRestartTitle": "Startar inte om nätverket automatiskt",
+    "noRestartBody": "Till skillnad från bryggreparation erbjuder rensningen ingen omstart av tjänsten. Att ta bort ett oanvänt gränssnittsblock påverkar inte den aktiva konfigurationen direkt, så en omstart är onödig och skulle innebära en onödig risk för anslutningen. Ändringen börjar gälla vid nästa manuella <code>systemctl restart networking</code> eller vid nästa systemomstart."
+  },
+  "caveats": {
+    "heading": "Viktiga förbehåll",
+    "boundaryTitle": "Blockgränsen är den första tomma linjen",
+    "boundaryBody": "<code>sed</code>-mönstret raderar från <code>iface &lt;name&gt;</code> till nästa tomma rad. Om <code>/etc/network/interfaces</code> saknar tomma rader mellan block, vilket är ovanligt men möjligt efter manuell redigering, kan även nästa block tas bort. Därför är <strong>steg 3 obligatoriskt</strong>: granska förhandsvisningen innan du bekräftar.",
+    "tandemTitle": "Ett överblivet iface-block som används av en brygga upptäcks här, inte i brygganalysen",
+    "tandemBody": "Om <code>vmbr0</code> deklarerar <code>bridge-ports enp3s0</code> och <code>enp3s0</code> också har ett eget block <code>iface enp3s0 inet manual</code> lämnar borttagning av <code>enp3s0</code> en ogiltig referens i <code>vmbr0</code>. Kör <link>brygganalys</link> efter rensningen för att ändra eller ta bort bryggporten. De två flödena är avsedda att användas tillsammans."
+  },
+  "troubleshoot": {
+    "heading": "Felsökning",
+    "notFoundTitle": "Analysen visar mitt nya nätverkskort som ”HITTADES INTE”",
+    "notFoundBody": "Kärnan ser enheten under ett annat namn än det som står i filen. Kör <code>ip link show</code> för att se det verkliga namnet. Det här är precis ett sådant fall där <link>beständiga gränssnittsnamn</link> skulle förhindra problemet framöver.",
+    "tooMuchTitle": "Städningen tog bort för mycket (ett block jag ville behålla)",
+    "tooMuchBody": "Återställ från backupen tryckt i steg 5:",
+    "tooMuchOutro": "Redigera filen för hand för att lägga till en tydlig tom linje mellan block innan du kör rengöring, eller ta bort problematiskt block manuellt.",
+    "bridgeBreakTitle": "En bro slutar fungera efter rengöring",
+    "bridgeBreakBody": "Bryggan använde en port vars <code>iface</code>-block just togs bort. Kör <link>brygganalys</link> så föreslås ett befintligt fysiskt gränssnitt för bryggan."
+  },
+  "related": {
+    "heading": "Relaterat",
+    "items": [
+      {
+        "label": "Brygganalys och guidad reparation",
+        "href": "/docs/network/bridge-analysis",
+        "tail": " — Den naturliga uppföljningen efter en rengöring."
+      },
+      {
+        "label": "Beständiga gränssnittsnamn",
+        "href": "/docs/network/persistent-names",
+        "tail": " — stoppar föräldralösa block från att ackumulera efter varje hårdvaruförändring."
+      },
+      {
+        "label": "Säkerhetskopiering och omstart av gränssnitt",
+        "href": "/docs/network/backup-restore",
+        "tail": " — manuella ögonblicksbilder och bläddring bland säkerhetskopior för återställning."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sv/docs/network/diagnostics.json b/web/messages/sv/docs/network/diagnostics.json
new file mode 100644
index 00000000..4baf1157
--- /dev/null
+++ b/web/messages/sv/docs/network/diagnostics.json
@@ -0,0 +1,94 @@
+{
+  "meta": {
+    "title": "Diagnostik | ProxMenux Dokumentation",
+    "description": "Tre enstaka skrivskyddade diagnostikkontroller: Visa routningstabell, Testa anslutning och Avancerad diagnostik. Ren inspektion — skriver aldrig till /etc/network/interfaces och kör aldrig kommandon som ändrar systemet, med ett uttryckligt undantag: fullständig borttagning av NetworkManager, om det upptäcks, kräver ditt samtycke.",
+    "ogTitle": "Diagnostik | ProxMenux Dokumentation",
+    "ogDescription": "Skrivskyddad nätverksdiagnostik för Proxmox-värden: routning, nåbarhet och avancerad statistik."
+  },
+  "header": {
+    "title": "Diagnostik",
+    "description": "Tre enstaka skrivskyddade kontroller av nätverkets aktuella tillstånd: routningstabell, anslutningstest och avancerad statistik. Ingen skriver till /etc/network/interfaces — säkra att använda när som helst, även via SSH. För interaktiv övervakning i realtid, se Övervakningsverktyg i realtid.",
+    "section": "Nätverk"
+  },
+  "intro": {
+    "title": "Vad detta gör",
+    "body": "Visar information om routning, nåbarhet och samlad statistik <strong>utan att ändra något</strong>. Använd verktyget för att kontrollera att nätverket fungerar eller identifiera dubbla IP-adresser. För kontinuerlig trafikövervakning, se <monitoringLink>Övervakningsverktyg i realtid</monitoringLink>; för att visa den obearbetade konfigurationsfilen, se <backupLink>Säkerhetskopiering och omstart av gränssnitt</backupLink>."
+  },
+  "routing": {
+    "heading": "Visa routningstabell",
+    "body": "Listar alla rutter som kärnan använder för tillfället (<code>ip route show</code>) och markerar standardgatewayen. Användbart för att kontrollera att internettrafiken går genom rätt gränssnitt och att inga kvarvarande gamla rutter har företräde."
+  },
+  "connectivity": {
+    "heading": "Testa anslutning",
+    "intro": "Skickar två ICMP-sonder till vart och ett av tre mål i tur och ordning och rapporterar resultatet för varje mål. Kör sedan <code>nslookup google.com</code> för att verifiera DNS-uppslagning oberoende av ICMP.",
+    "headerTest": "Test",
+    "headerTarget": "Mål",
+    "headerConfirms": "Vad den bekräftar",
+    "rows": [
+      {
+        "test": "Google DNS",
+        "target": "8.8.8.8",
+        "confirms": "Extern nåbarhet via en välkänd anycast-IP-adress"
+      },
+      {
+        "test": "Cloudflare DNS",
+        "target": "1.1.1.1",
+        "confirms": "Oberoende andra åsikt om Google blockerar ICMP"
+      },
+      {
+        "test": "Gateway",
+        "target": "(standardrutt)",
+        "confirms": "L2 / L3-anslutning till den lokala routern"
+      },
+      {
+        "test": "DNS-upplösning",
+        "target": "google.com",
+        "confirms": "DNS server är tillgänglig och svarar"
+      }
+    ],
+    "readingTitle": "Läsa resultatet",
+    "readingBody": "Om gatewaytestet lyckas men de offentliga DNS-målen inte svarar har du lokal anslutning men inget internet — kontrollera gatewayens anslutning uppströms. Om DNS-uppslagning misslyckas men ping till <code>8.8.8.8</code> fungerar ligger problemet i DNS-resolvern, inte i nätverket: kontrollera <code>/etc/resolv.conf</code>."
+  },
+  "advanced": {
+    "heading": "Avancerad diagnostik",
+    "intro": "Sammanställer statistik för hela nätverket och utför en serie kontroller av vanliga problem. Rapporterar antalet aktiva anslutningar, lyssnande portar och totalt antal gränssnitt samt pekar uttryckligen ut två problematiska konfigurationer:",
+    "items": [
+      "<strong>NetworkManager körs på en Proxmox-värd.</strong> NetworkManager och Proxmox <code>ifupdown</code> står i konflikt: båda försöker hantera gränssnitten, vilket gör att bryggor växlar mellan aktivt och inaktivt tillstånd eller inte kan aktiveras. Om NetworkManager upptäcks erbjuder verktyget en interaktiv bekräftelse för att stoppa, inaktivera och ta bort det helt (detta är den <em>enda</em> diagnostik som kan ändra systemet, och bara efter uttryckligt samtycke).",
+      "<strong>Dubbla IP-adresser på olika gränssnitt.</strong> Två gränssnitt med samma IPv4-adress orsakar intermittenta anslutningsproblem som är mycket svåra att felsöka inifrån en VM. Upptäcks via <code>ip -4 addr show | sort | uniq -d</code>."
+    ],
+    "nmTitle": "NetworkManager-prompten är den enda modifierande åtgärden här",
+    "nmBody": "Alla andra kontroller i Avancerad diagnostik är skrivskyddade. Borttagning av NetworkManager kräver en ja/nej-bekräftelse och kör <code>systemctl stop / disable</code> + <code>apt-get purge -y network-manager</code>. Om du avböjer ändras ingenting."
+  },
+  "troubleshoot": {
+    "heading": "Felsökning",
+    "gwTitle": "Testa anslutning rapporterar ett gatewayfel men värden har internetåtkomst",
+    "gwBody": "Vissa routrar svarar inte på ICMP via sitt interna gränssnitt även om de vidarebefordrar trafiken korrekt. Testa med <code>traceroute 8.8.8.8</code> från en konsol: om det andra hoppet är din internetleverantör och det offentliga DNS-testet lyckades fungerar gatewayen trots att ping misslyckades.",
+    "dupTitle": "Avancerad diagnostik fortsätter att rapportera dubbla IP-adresser efter att jag tagit bort en",
+    "dupBody": "Kontrollen granskar kärnans aktuella tillstånd, inte konfigurationsfilen. Kör <code>ip -4 addr show</code> för att kontrollera. Om dubbletten finns kvar har ett gränssnitt fortfarande adressen. Använd <code>ip addr del &lt;IP&gt;/&lt;mask&gt; dev &lt;iface&gt;</code> för att ta bort den från det aktuella tillståndet och redigera sedan <code>/etc/network/interfaces</code> om den också är beständigt konfigurerad."
+  },
+  "related": {
+    "heading": "Relaterat",
+    "items": [
+      {
+        "label": "Övervakningsverktyg i realtid",
+        "href": "/docs/network/monitoring",
+        "tail": " — interaktiva iftop / iptraf-ng / iperf3-startare."
+      },
+      {
+        "label": "Brygganalys och guidad reparation",
+        "href": "/docs/network/bridge-analysis",
+        "tail": " — när en vmbrX saknar sin fysiska port."
+      },
+      {
+        "label": "Konfigurationsanalys och guidad rensning",
+        "href": "/docs/network/config-analysis",
+        "tail": " — när ett gammalt nätverkskort fortfarande deklareras men inte längre finns."
+      },
+      {
+        "label": "Säkerhetskopiering och omstart av gränssnitt",
+        "href": "/docs/network/backup-restore",
+        "tail": " — för att ta en ögonblicksbild av konfigurationen före varje ändring."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sv/docs/network/index.json b/web/messages/sv/docs/network/index.json
new file mode 100644
index 00000000..f8a424ea
--- /dev/null
+++ b/web/messages/sv/docs/network/index.json
@@ -0,0 +1,107 @@
+{
+  "meta": {
+    "title": "Nätverkshantering i Proxmox — Bryggor, bondning, diagnostik, reparation | ProxMenux",
+    "description": "Skrivskyddad diagnostik, analyser med efterföljande förslag och guidade reparationer för nätverksstacken i Debian / Proxmox (/etc/network/interfaces). Inspektera bryggor och bondgränssnitt, starta övervakningsverktyg i realtid, ge gränssnitt beständiga namn, säkerhetskopiera och starta om nätverket säkert — med obligatoriska säkerhetskopior och förhandsvisning steg för steg.",
+    "ogTitle": "Nätverkshantering i Proxmox — Bryggor, bondning, diagnostik, reparation",
+    "ogDescription": "Diagnostik, analys och guidade reparationer för Proxmox nätverksstack med obligatoriska säkerhetskopior och förhandsvisning steg för steg.",
+    "twitterTitle": "Nätverkshantering i Proxmox | ProxMenux",
+    "twitterDescription": "Bryggor, bondning, diagnostik och guidade reparationer för Proxmox nätverksstack med obligatoriska säkerhetskopior."
+  },
+  "header": {
+    "title": "Nätverkshantering",
+    "description": "Skrivskyddad diagnostik, analysrapporter med efterföljande förslag och guidade reparationer för den klassiska nätverksstacken i Debian/Proxmox. Varje destruktiv åtgärd tar först en säkerhetskopia och visar de exakta ändringarna innan de tillämpas.",
+    "section": "Nätverk"
+  },
+  "intro": {
+    "title": "Vad menyn används till",
+    "body": "Inspektera, diagnostisera och vid behov reparera Proxmox-värdens nätverkskonfiguration utan att förlora fjärråtkomsten. Verktygen följer en princip: <strong>läs först, föreslå sedan och tillämpa endast med uttryckligt samtycke och en säkerhetskopia</strong>. Det finns ingen knapp som automatiskt åtgärdar allt."
+  },
+  "openingMenu": {
+    "heading": "Öppna menyn",
+    "intro": "Välj <strong>Nätverk</strong> i ProxMenux huvudmeny. Då visas följande:",
+    "imageAlt": "Nätverkshanteringsmenyn med alternativ för diagnostik, övervakning, analys, reparation, beständiga namn och säkerhetskopiering"
+  },
+  "safety": {
+    "heading": "Säkerhetsmodellen",
+    "body": "Att redigera nätverkskonfigurationen på en fjärransluten Proxmox-värd är ett av de enklaste sätten att låsa sig ute. ProxMenux tar hänsyn till det vid varje åtgärd. Verktygen delas in i tre nivåer efter hur de fungerar — välj det kort som motsvarar ditt mål:"
+  },
+  "tiers": {
+    "readOnly": {
+      "title": "Skrivskyddad",
+      "body": "Ren inspektion. Kan inte ändra systemet under några omständigheter.",
+      "items": [
+        "Routningstabell, anslutningstester, avancerad statistik",
+        "Trafikövervakning i realtid (iftop, iptraf-ng)",
+        "Bandbreddstest (iperf3)"
+      ]
+    },
+    "analyze": {
+      "title": "Analysera, sedan föreslå",
+      "body": "Upptäcker problem, skriver ut en rapport med föreslagna skalkommandon och stannar sedan. Du avgör om du vill gå vidare till den guidade reparationen.",
+      "items": [
+        "Analys av bryggkonfiguration",
+        "Nätverkskonfigurationsanalys"
+      ]
+    },
+    "apply": {
+      "title": "Tillämpa med säkerhetskopia",
+      "body": "Ändrar systemet. Tar alltid först en tidsstämplad säkerhetskopia av den berörda filen och visar en förhandsvisning innan den skriver.",
+      "items": [
+        "Beständiga gränssnittsnamn (.link-filer)",
+        "Manuell säkerhetskopiering, återställning och omstart av tjänsten"
+      ]
+    }
+  },
+  "classicTitle": "Endast den klassiska stacken",
+  "classicBody": "Varje analys- och reparationsfunktion kontrollerar den aktiva nätverkshanteraren innan något ändras. Om värden kör <strong>netplan</strong>, <strong>systemd-networkd</strong> eller <strong>NetworkManager</strong> avbryts verktyget omedelbart med ett tydligt meddelande — menyn stöder endast den klassiska Debian/Proxmox-stacken i <code>/etc/network/interfaces</code>. Det är avsiktligt: att redigera en netplan-fil enligt regler för <code>ifupdown</code> skulle skada konfigurationen utan att det märks.",
+  "backups": {
+    "heading": "Var säkerhetskopiorna sparas",
+    "intro": "Varje guidad reparation, återställning eller manuell säkerhetskopia skriver en tidsstämplad kopia av <code>/etc/network/interfaces</code> till <code>/var/backups/proxmenux/</code>:",
+    "rollbackIntro": "Så återställer du manuellt från en konsol:"
+  },
+  "readOnlySection": {
+    "heading": "Skrivskyddad inspektion",
+    "body": "Börja här när något verkar fel. Ren inspektion — skriver aldrig till <code>/etc/network/interfaces</code> och kör aldrig kommandon som ändrar systemet, med ett uttryckligt undantag: fullständig borttagning av NetworkManager, om det upptäcks, kräver ditt samtycke. Kan användas säkert via SSH när som helst.",
+    "options": [
+      {
+        "title": "Diagnostik",
+        "description": "Tre enstaka skrivskyddade kontroller: Visa routningstabell, Testa anslutning och Avancerad diagnostik. Ren inspektion — skriver aldrig till systemet."
+      },
+      {
+        "title": "Övervakningsverktyg i realtid",
+        "description": "Tre interaktiva verktygsstartare: iftop (bandbredd i realtid per värdpar), iptraf-ng (trafikövervakning med flera lägen) och iperf3 (bandbreddstest i server- eller klientläge)."
+      }
+    ]
+  },
+  "analyzeSection": {
+    "heading": "Analysera, sedan föreslå",
+    "body": "Används när en inspektion eller ett verkligt avbrott pekar på ett konfigurationsproblem. Varje verktyg granskar den relevanta delen av <code>/etc/network/interfaces</code>, skriver ut en detaljerad rapport med det exakta skalkommando som skulle åtgärda varje problem och <strong>stannar</strong>. Om du därefter godkänner den valfria guidade reparationen säkerhetskopieras och förhandsvisas varje ändring innan den skrivs.",
+    "options": [
+      {
+        "title": "Brygganalys och guidad reparation",
+        "description": "Upptäcker vmbrX-bryggor med saknade eller ogiltiga portar, vilket är vanligt efter omnumrering av PCI-enheter. Visar först en rapport och reparerar endast om du godkänner det guidade flödet med 5 steg."
+      },
+      {
+        "title": "Konfigurationsanalys och guidad rensning",
+        "description": "Hittar fysiska gränssnitt som deklareras i /etc/network/interfaces men inte längre finns, alltså överblivna konfigurationer efter maskinvaruändringar. Rapporterar dem och erbjuder guidad borttagning."
+      }
+    ]
+  },
+  "applySection": {
+    "heading": "Tillämpa med säkerhetskopia",
+    "body": "Dessa verktyg är avsedda att skriva till disk. Varje verktyg tar först en tidsstämplad säkerhetskopia av den berörda filen, och destruktiva alternativ som återställning och omstart kräver ett uttryckligt ja/nej-svar. <em>Beständiga gränssnittsnamn</em> börjar gälla vid nästa omstart, inte omedelbart, så inställningen kan planeras säkert även på en fjärransluten värd.",
+    "options": [
+      {
+        "title": "Beständiga gränssnittsnamn",
+        "description": "Binder gränssnittsnamn (eno1, enp3s0, …) till MAC-adresser via systemds .link-filer. Namnen består när PCI-kort byter plats, kärnan uppgraderas och andra nätverkskort läggs till eller tas bort."
+      },
+      {
+        "title": "Säkerhetskopiering och omstart av gränssnitt",
+        "description": "Ta en manuell ögonblicksbild av /etc/network/interfaces, bläddra bland och återställ tidigare säkerhetskopior, visa den aktuella konfigurationen och starta om nätverkstjänsten vid behov."
+      }
+    ]
+  },
+  "consoleTitle": "Ha konsolåtkomst redo",
+  "consoleSubTitle": "Före varje reparation på en fjärransluten värd",
+  "consoleBody": "Om du är ansluten via SSH och bara har en åtkomstväg till värden bör du ha en reservväg redo innan du ändrar nätverket: fysisk konsol / IPMI / iKVM eller en annan dator i samma LAN. De guidade reparationerna är säkra och erbjuder alltid ett kommando för att återställa ändringarna, men en felkonfigurerad brygga eller en bruten länk kan ändå låsa dig ute tills du kommer åt konsolen."
+}
diff --git a/web/messages/sv/docs/network/monitoring.json b/web/messages/sv/docs/network/monitoring.json
new file mode 100644
index 00000000..e09a8e9b
--- /dev/null
+++ b/web/messages/sv/docs/network/monitoring.json
@@ -0,0 +1,136 @@
+{
+  "meta": {
+    "title": "Övervakningsverktyg i realtid | ProxMenux-dokumentation",
+    "description": "Tre interaktiva startare för nätverksverktyg: iftop (bandbredd i realtid per värdpar), iptraf-ng (trafikövervakning med flera lägen) och iperf3 (bandbreddstest i server- eller klientläge). Varje verktyg installeras vid första användningen.",
+    "ogTitle": "Övervakningsverktyg i realtid | ProxMenux-dokumentation",
+    "ogDescription": "Interaktiv nätverksövervakning och bandbreddstestning för Proxmox värd: iftop, iptraf-ng, iperf3."
+  },
+  "header": {
+    "title": "Övervakningsverktyg i realtid",
+    "description": "Tre interaktiva verktygsstartare för nätverksövervakning i realtid och bandbreddsmätning: iftop, iptraf-ng och iperf3. Varje verktyg installeras automatiskt via apt vid första användningen, körs i förgrunden och avslutas med den angivna tangenten. De ändrar inte värdens nätverkskonfiguration; iperf3 genererar testtrafik.",
+    "section": "Nätverk"
+  },
+  "intro": {
+    "title": "Vad detta gör",
+    "body": "Tre interaktiva övervakningsverktyg, var och en bakom sin egen meny. Första gången du startar ett installeras paketet tyst via <code>apt-get</code>. Efterföljande lanseringar börjar omedelbart. Inget av dessa verktyg ändrar värdnätverkskonfigurationen."
+  },
+  "when": {
+    "heading": "När du ska använda vilken",
+    "headerQuestion": "Fråga",
+    "headerUse": "Använd",
+    "rows": [
+      {
+        "question": "Vem mättar länken <em>just nu</em>?",
+        "use": "iftop"
+      },
+      {
+        "question": "Hur ser fördelningen per protokoll, paketstorlekarna och TCP-flödena ut?",
+        "use": "iptraf-ng"
+      },
+      {
+        "question": "Hur mycket bandbredd är faktiskt tillgänglig mellan två värdar?",
+        "use": "iperf3"
+      }
+    ]
+  },
+  "iftop": {
+    "heading": "Nätverksanvändning i realtid (iftop)",
+    "body": "Bandbredd i realtid per värdpar (källa ↔ destination) — som <code>top</code> för trafik. Visar de största flödena överst med glidande medelvärden över 2/10/40 sekunder. Bästa verktyget för frågan <em>”Varför är min upplänk mättad?”</em>.",
+    "exit": "<strong>Avsluta:</strong> tryck på <kbd>q</kbd>. ProxMenux visar en påminnelse före start.",
+    "keysTitle": "Användbara tangenter i iftop",
+    "keysBody": "<kbd>n</kbd> växlar DNS-uppslagning, <kbd>p</kbd> visar portnummer, <kbd>P</kbd> pausar visningen, <kbd>t</kbd> växlar radens riktning (skickat / mottaget / båda), <kbd>1</kbd>/<kbd>2</kbd>/<kbd>3</kbd> sorterar efter medelvärdet över 2 s / 10 s / 40 s. Se <code>man iftop</code> för hela listan."
+  },
+  "iptraf": {
+    "heading": "Nätverksövervakningsverktyg (iptraf-ng)",
+    "intro": "En menystyrd trafikövervakare med flera lägen. iftop svarar på <em>”vem”</em>, medan iptraf-ng svarar på <em>”vad”</em>: antal byte och paket per protokoll, spårning av TCP-anslutningars tillstånd, histogram över paketstorlekar och LAN-aktivitet per station.",
+    "menuIntro": "Vid start visas en meny med fem alternativ:",
+    "headerMode": "Läge",
+    "headerUseFor": "Använd den för",
+    "rows": [
+      {
+        "mode": "IP traffic monitor",
+        "useFor": "Lista i realtid över TCP-/UDP-/ICMP-/övriga IP-flöden med byteräknare och anslutningstillstånd"
+      },
+      {
+        "mode": "General interface stats",
+        "useFor": "Samlat antal IPv4-/IPv6-/TCP-/UDP-/ICMP-/icke-IP-paket per nätverkskort"
+      },
+      {
+        "mode": "Detailed interface stats",
+        "useFor": "Samma som ovan men för ett gränssnitt, med paketstorlek och hastighetsdetalj"
+      },
+      {
+        "mode": "Statistical breakdowns",
+        "useFor": "Histogram över paketstorleksfördelningen per TCP-/UDP-port"
+      },
+      {
+        "mode": "LAN station monitor",
+        "useFor": "Per-MAC trafikstatistik för den lokala sändningsdomänen"
+      }
+    ],
+    "exit": "<strong>Avsluta:</strong> tryck på <kbd>x</kbd> i valfri vy eller <kbd>Q</kbd> i huvudmenyn. ProxMenux visar en påminnelse före start.",
+    "logTitle": "Logga insamlade data till fil",
+    "logBody": "Varje läge erbjuder loggning av insamlad statistik till <code>/var/log/iptraf-ng/</code>. Om du behöver dokumentera en trafikspik kan du låta verktyget köra, logga till fil och granska filen efteråt i stället för att försöka läsa skärmen i realtid."
+  },
+  "iperf3": {
+    "heading": "Bandbreddstest (iperf3)",
+    "intro1": "Mäter den faktiska TCP-genomströmningen mellan två värdar. Till skillnad från iftop / iptraf-ng, som observerar befintlig trafik, genererar iperf3 syntetisk trafik för att belastningstesta länken. Oumbärligt för frågor som <em>”Når min 10 GbE-länk verkligen 10 GbE?”</em> eller <em>”Är nätverkskortet, switchen eller lagringen flaskhalsen?”</em>.",
+    "intro2": "iperf3 är ett <strong>verktyg för två värdar</strong>: den ena kör som server och lyssnar på TCP-port 5201, den andra som klient som ansluter, skickar data och skriver ut hastigheten. ProxMenux-startaren frågar vilket läge du vill använda:",
+    "headerMode": "Läge",
+    "headerBehaviour": "Beteende",
+    "headerCli": "Motsvarande CLI-kommando",
+    "rows": [
+      {
+        "mode": "Server",
+        "behaviour": "Lyssnar på TCP 5201 och skriver ut resultat för varje inkommande test. Slutar på Ctrl+C.",
+        "cli": "iperf3 -s"
+      },
+      {
+        "mode": "Klient",
+        "behaviour": "Frågar efter serverns IP-adress eller värdnamn, ansluter, kör standardtestet på 10 sekunder och skriver ut rapporten.",
+        "cli": "iperf3 -c <target>"
+      }
+    ],
+    "workflowIntro": "Typiskt arbetsflöde för att testa en 10 GbE länk mellan två Proxmox värdar:",
+    "workflow": [
+      "Öppna nätverksmenyn på värd A → <em>Bandbreddstest (iperf3)</em> → välj <strong>Server</strong>.",
+      "Öppna samma menyalternativ på värd B → välj <strong>Klient</strong> → ange IP-adressen för värd A.",
+      "Vänta 10 sekunder. Jämför den rapporterade hastigheten med länkens teoretiska maximum."
+    ],
+    "sample": "Exempel på klientutdata:",
+    "flagsTitle": "Användbara manuella flaggor (kör från ett skal)",
+    "flagsBody": "<code>-t 60</code> längre test (60 s i stället för 10 s), <code>-P 4</code> 4 parallella strömmar (mättar länken snabbare), <code>-R</code> omvänd riktning (server → klient), <code>-u -b 100M</code> UDP-test med 100 Mbit/s (mätning av jitter och paketförlust), <code>-p 5202</code> annan port (flera tester parallellt). Se <code>man iperf3</code> för hela listan.",
+    "firewallTitle": "Öppna brandväggsporten på servern",
+    "firewallBody": "Servern lyssnar på TCP <strong>5201</strong> som standard. Om du kör servern i en Proxmox-värd med en strikt brandvägg (datacenter eller värdnivå), låt inkommande TCP 5201 från klientens IP för testets varaktighet, stäng sedan den igen. Samma gäller för <code>nftables</code> / <code>iptables</code> på bara värdar."
+  },
+  "install": {
+    "heading": "Första lanseringen installerar paketet",
+    "body": "Alla tre startare kontrollerar om programmet finns och kör annars <code>apt-get update -qq &amp;&amp; apt-get install -y &lt;pkg&gt;</code>. Installationen sker utan utdata: menyn kan verka frusen i 10–30 sekunder första gången. Senare starter sker omedelbart."
+  },
+  "troubleshoot": {
+    "heading": "Felsökning",
+    "hangTitle": "Installationen fastnar vid första start",
+    "hangBody": "Värden har inget internet eller apt repos är oåtkomliga. Avbryt med <kbd>Ctrl</kbd>+<kbd>C</kbd>, kör <code>apt-get update</code> manuellt för att se det faktiska felet (DNS, repo signatur, proxy ...), sedan komma tillbaka till menyn.",
+    "refusedTitle": "iperf3-klient: ”unable to connect to server: Connection refused”",
+    "refusedBody": "Antingen körs inte servern eller så blockerar dess brandvägg TCP 5201. Kontrollera på servern med <code>ss -tlnp | grep 5201</code> — det ska visa att iperf3 lyssnar. Om den lyssnar men klienten fortfarande misslyckas, kontrollera brandväggarna på vägen mellan de två värdarna.",
+    "slowTitle": "iperf3 rapporterar mycket lägre hastighet än förväntat för länken",
+    "slowBody": "Vanliga orsaker i sannolikhetsordning: (1) en av värdarnas CPU begränsar hastigheten — prova <code>iperf3 -c &lt;target&gt; -P 4</code> för att använda flera kärnor; (2) trafiken passerar en långsammare länk, till exempel en gigabitswitch mellan två 10 GbE-kort; (3) olika MTU — kontrollera <code>ip link show</code> i båda ändarna; (4) avstängd NIC offloading — se communityskriptet <em>Disable NIC Offloading</em> om du har ett Intel e1000e-kort.",
+    "noTrafficTitle": "iftop / iptraf-ng visar ingen trafik för en upptagen värd",
+    "noTrafficBody": "Standardfångst är på det första upptäckta gränssnittet. Ange rätt från skalet: <code>iftop -i vmbr0</code> eller <code>iptraf-ng -i vmbr0</code>. Menyn launcher använder standarden; för icke-standardgränssnitt, kör från en konsol."
+  },
+  "related": {
+    "heading": "Relaterat",
+    "items": [
+      {
+        "label": "Diagnostik",
+        "href": "/docs/network/diagnostics",
+        "tail": " — de enstaka skrivskyddade kontrollerna (routning, anslutning och avancerad statistik)."
+      },
+      {
+        "label": "Brygganalys och guidad reparation",
+        "href": "/docs/network/bridge-analysis",
+        "tail": " — när övervakningen visar att ett gränssnitt eller en brygga inte fungerar som det ska."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sv/docs/network/persistent-names.json b/web/messages/sv/docs/network/persistent-names.json
new file mode 100644
index 00000000..adaf92cf
--- /dev/null
+++ b/web/messages/sv/docs/network/persistent-names.json
@@ -0,0 +1,130 @@
+{
+  "meta": {
+    "title": "Beständiga gränssnittsnamn | ProxMenux-dokumentation",
+    "description": "Bind Proxmox-gränssnittsnamn (eno1, enp3s0, …) till MAC-adresser via systemds .link-filer så att namnen består vid omnumrering av PCI-enheter, kärnuppgraderingar och när andra nätverkskort läggs till eller tas bort.",
+    "ogTitle": "Beständiga gränssnittsnamn | ProxMenux-dokumentation",
+    "ogDescription": "Förhindra att Proxmox gränssnittsnamn ändras när du ändrar maskinvaran. Använder systemds .link-filer med matchning på MAC-adress."
+  },
+  "header": {
+    "title": "Beständiga gränssnittsnamn",
+    "description": "Skapar en .link-fil för systemd per fysiskt nätverkskort som binder det kärntilldelade namnet till kortets MAC-adress. När detta tillämpats efter nästa omstart förblir gränssnittsnamnen stabila när du lägger till, tar bort eller flyttar PCIe-kort.",
+    "section": "Nätverk"
+  },
+  "intro": {
+    "title": "Vad detta gör",
+    "body": "För varje fysisk NIC på värden, skriver en liten fil under <code>/etc/systemd/network/10-&lt;iface&gt;.link</code> som säger: <em> \"enheten med denna MAC måste alltid kallas detta namn\" </em>. systemd-udevd tillämpar regeln vid varje start, innan <code>ifupdown</code> läser <code>/etc/network/interfaces</code>."
+  },
+  "problem": {
+    "heading": "Problemet detta löser",
+    "intro": "Linux härleder standardnamn för gränssnitt från PCI-topologin — <code>eno1</code> = inbyggt nätverkskort, <code>enp3s0</code> = kortet på PCI-buss 3, plats 0 osv. Namnschemat är deterministiskt <em>vid samma maskinvaruplacering</em>. Ändras placeringen kan namnen ändras:",
+    "items": [
+      "Lägg till en GPU före ett befintligt nätverkskort → nätverkskortets bussnummer kan ändras → namnet ändras.",
+      "Flytta ett kort till en annan PCIe slot → namnändringar.",
+      "BIOS-/UEFI-uppdatering som numrerar om enheter → namnen kan ändras.",
+      "Ersätt ett felaktigt kort med samma modell i en annan slot → namnändringar."
+    ],
+    "outro": "Efter en sådan ändring refererar <code>/etc/network/interfaces</code> fortfarande till det <em>gamla</em> namnet. Bryggan kan inte aktiveras och värden förlorar nätverksanslutningen. Beständiga namn förhindrar att detta händer igen."
+  },
+  "howWorks": {
+    "heading": "Hur det fungerar",
+    "arrowLabel": "per nätverkskort",
+    "nodes": {
+      "detectLabel": "Identifiera fysiska nätverkskort",
+      "detectDetail": "ls /sys/class/net/\nuteslut vmbr / bond /\ndocker / veth / wireguard …",
+      "readLabel": "Läs varje MAC",
+      "readDetail": "cat /sys/class/net/\n  '<'iface'>'/address",
+      "writeLabel": "Skriv .link-fil",
+      "writeDetail": "/etc/systemd/network/\n  10-'<'iface'>'.link"
+    },
+    "minimalIntro": "Varje genererad fil är avsiktligt minimal:",
+    "minimalOutro": "Vid start matchar systemd-udevd enheten på MAC-adress och tilldelar det begärda namnet <em>innan</em> andra komponenter (ifupdown, kärnans standardnamngivning) kommer åt den. Filprefixet <code>10-</code> ser till att reglerna läses in tidigt, före standardfilen <code>99-default.link</code>."
+  },
+  "scope": {
+    "heading": "Vad som skrivs och vad som hoppas över",
+    "headerType": "Typ",
+    "headerBehaviour": "Beteende",
+    "headerWhy": "Varför",
+    "rows": [
+      {
+        "type": "Inbyggt nätverkskort / PCIe-nätverkskort",
+        "behaviour": "<code>.link</code>-fil skrivs",
+        "why": "Motsvarar en verklig PCI-enhet — det fall verktyget är avsett för"
+      },
+      {
+        "type": "Wi-Fi (phy80211)",
+        "behaviour": "<code>.link</code>-fil skrivs",
+        "why": "Har en verklig MAC-adress och gynnas av ett stabilt namn"
+      },
+      {
+        "type": "Bryggor (vmbrX)",
+        "behaviour": "Överhoppad",
+        "why": "Virtuell; namn kommer från <code>/etc/network/interfaces</code>"
+      },
+      {
+        "type": "Bondgränssnitt (bondX)",
+        "behaviour": "Överhoppad",
+        "why": "Virtuellt; bondgränssnittets namn anges av ifupdown"
+      },
+      {
+        "type": "veth / docker0 / br-XXXX",
+        "behaviour": "Överhoppad",
+        "why": "Skapas vid behov av Docker / LXC — ingen beständig maskinvara"
+      },
+      {
+        "type": "tap / fwpr / fwln",
+        "behaviour": "Överhoppad",
+        "why": "Skapas vid behov av Proxmox för varje VM/CT"
+      },
+      {
+        "type": "WireGuard / Cilium / Tailscale",
+        "behaviour": "Överhoppad",
+        "why": "Programvarugränssnitt som hanteras av sina egna daemoner"
+      }
+    ]
+  },
+  "safety": {
+    "heading": "Säkerhetsnät: tidigare .link-filer backas upp",
+    "intro": "Om <code>/etc/systemd/network/</code> redan innehåller <code>.link</code>-filer från en tidigare körning eller andra verktyg kopieras de till en tidsstämplad säkerhetskopieringskatalog innan de nya skapas:",
+    "outro": "För att rulla tillbaka: kopiera filerna tillbaka från backupkatalogen och starta om.",
+    "rebootTitle": "Börjar gälla vid nästa omstart, inte omedelbart",
+    "rebootBody": "Ändringar i <code>.link</code>-filer tillämpas endast vid start, när udev räknar upp enheterna på nytt. Därför rapporterar verktyget <em>”Ändringarna tillämpas efter omstart”</em>. Namnbyte på ett aktivt gränssnitt är riskabelt och försöks inte: en aktiv <code>vmbr0</code> med medlemsgränssnitt skulle behöva konfigureras om atomärt. Åtgärden skjuts därför upp till nästa rena start."
+  },
+  "afterReboot": {
+    "heading": "Efter omstarten",
+    "intro": "När namnen är beständigt bundna är arbetsflödet för framtida maskinvaruändringar enkelt:",
+    "items": [
+      "Stäng av, ändra maskinvaran (lägg till kort, byt plats, …) och starta.",
+      "Varje NIC håller sitt tidigare namn eftersom dess MAC matchar en <code>.link</code>-fil.",
+      "Om ett nätverkskort ersätts med ett som har en annan MAC-adress får det ett standardnamn från kärnan (<code>enp&lt;bus&gt;s&lt;slot&gt;</code>). Kör menyn igen för att lägga till en <code>.link</code>-post för det nya kortets MAC-adress."
+    ]
+  },
+  "troubleshoot": {
+    "heading": "Felsökning",
+    "emptyTitle": "\"Inga fysiska gränssnitt hittades\" efter att ha kört verktyget",
+    "emptyBody": "Kärnan ser inga gränssnitt som bygger på PCI / phy80211 på värden. Kontrollera med <code>ls -l /sys/class/net/</code> — varje post ska ha antingen en symbolisk länk <code>device</code> (PCI) eller en post <code>phy80211</code> (Wi-Fi). Om båda saknas för ett verkligt nätverkskort är drivrutinen inte inläst.",
+    "noChangeTitle": "Efter omstarten ändrades inte namnen som förväntat.",
+    "noChangeBody": "Kontrollera att filen finns och är korrekt formaterad: <code>cat /etc/systemd/network/10-&lt;iface&gt;.link</code>. Kontrollera sedan udev-loggarna: <code>journalctl -u systemd-udevd -b | grep -i link</code>. En vanlig orsak är en kvarvarande kärnparameter <code>net.ifnames=0</code> som helt inaktiverar förutsägbara namn — ta bort den från <code>/etc/default/grub</code>, kör <code>update-grub</code> och starta om.",
+    "undoTitle": "Jag vill ångra beständig namngivning",
+    "undoBody": "Radera antingen <code>.link</code>-filerna (<code>rm /etc/systemd/network/10-*.link</code>) eller återställ dem från säkerhetskopieringskatalogen som skapades vid föregående körning. Starta om för att tillämpa ändringen."
+  },
+  "related": {
+    "heading": "Relaterat",
+    "items": [
+      {
+        "label": "Brygganalys och guidad reparation",
+        "href": "/docs/network/bridge-analysis",
+        "tailRich": " — återställningsvägen när namnen <em>redan</em> har ändrats."
+      },
+      {
+        "label": "Konfigurationsanalys och guidad rensning",
+        "href": "/docs/network/config-analysis",
+        "tail": " — för att ta bort föräldralösa block kvar efter namnskiften."
+      },
+      {
+        "label": "Diagnostik",
+        "href": "/docs/network/diagnostics",
+        "tailRich": " — bekräfta de nya namnen med <em>Visa routningstabell</em> efter omstart."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sv/docs/oci-manager/architecture.json b/web/messages/sv/docs/oci-manager/architecture.json
new file mode 100644
index 00000000..fa8bb5ab
--- /dev/null
+++ b/web/messages/sv/docs/oci-manager/architecture.json
@@ -0,0 +1,171 @@
+{
+  "meta": {
+    "title": "Så anpassas en OCI-avbildning | ProxMenux",
+    "description": "Från avbildningens arkiv och Compose-fil till en granskningsbar mall, en distributionsplan och en LXC direkt i Proxmox VE, utan Docker i containern."
+  },
+  "header": {
+    "title": "Så anpassas en OCI-avbildning",
+    "description": "Från avbildningens arkiv och Compose-fil till en granskningsbar mall, en distributionsplan och en LXC direkt i Proxmox VE, utan att installera Docker i containern.",
+    "section": "OCI manager Apps"
+  },
+  "sections": [
+    {
+      "id": "pipeline",
+      "title": "Anpassningsflödet",
+      "blocks": [
+        {
+          "mermaid": {
+            "chartCode": "flowchart LR\n A[\"{{repo}}\"] --> B[\"Compose + README\"]\n B --> C[\"{{converter}}\"]\n C --> D[\"{{template}}\"]\n D --> E{\"{{blockers}}\"}\n E -- \"{{no}}\" --> F[\"{{review}}\"]\n F --> D\n E -- \"{{yes}}\" --> G[\"{{plan}}\"]\n G --> H[\"pct create\"]\n H --> I[\"{{lxc}}\"]",
+            "labels": {
+              "repo": "Avbildningens arkiv",
+              "converter": "Konverterare",
+              "template": "JSON-mall",
+              "blockers": "Inga hinder?",
+              "no": "Nej",
+              "yes": "Ja",
+              "review": "Granskning / overlay",
+              "plan": "Distributionsplan",
+              "lxc": "LXC direkt i Proxmox VE"
+            }
+          }
+        },
+        {
+          "p": "Konverteraren läser avbildningen och Compose-filen som projektet publicerar och skapar en JSON-mall. Om krav ännu inte har kunnat anpassas och hindrar installationen granskas mallen innan den publiceras i katalogen. En fil med granskade anpassningar, en så kallad overlay, löser dessa hinder. Bara mallar utan kvarstående hinder erbjuds för installation."
+        }
+      ]
+    },
+    {
+      "id": "template",
+      "title": "Vad mallen bevarar",
+      "blocks": [
+        {
+          "cards": {
+            "items": [
+              {
+                "icon": "archive",
+                "title": "Avbildningens identitet",
+                "body": "Arkiv, löpande uppdaterad tagg, arkitektur, fastställd digest och källrevision."
+              },
+              {
+                "icon": "braces",
+                "title": "Containerkontrakt",
+                "body": "Entrypoint, Cmd, miljö, användare, arbetskatalog, stoppsignal, portar och volymer."
+              },
+              {
+                "icon": "layers",
+                "title": "Anpassning till Proxmox VE",
+                "body": "Resurser, säkerhet, monteringspunkter, enheter, sysctls, hälsokontroller och de anpassningar som behövs för var och en, med motivering."
+              },
+              {
+                "icon": "shield",
+                "title": "Kompatibilitet",
+                "body": "Nycklar som stöds, krav som ännu inte anpassats och hindrar installationen samt status för varje validering."
+              }
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "sources",
+      "title": "OCI anger processen, Compose anger miljön",
+      "blocks": [
+        {
+          "table": {
+            "headers": [
+              "Källa",
+              "Exempel",
+              "Resultat i Proxmox VE"
+            ],
+            "rows": [
+              [
+                "OCI-metadata",
+                "<code>Entrypoint</code>, <code>Cmd</code>, <code>User</code>",
+                "Proxmox VE importerar dem när CT:n skapas"
+              ],
+              [
+                "Docker Compose",
+                "<code>environment</code>, <code>volumes</code>, <code>devices</code>",
+                "Miljöposter för LXC, <code>mpN</code> och <code>devN</code>"
+              ],
+              [
+                "ProxMenux-profil",
+                "GPU, hälsokontroll, inloggningsuppgifter",
+                "Frågor och granskade anpassningar"
+              ],
+              [
+                "Användare",
+                "VMID, lagring, nätverk",
+                "Instanskontraktet"
+              ]
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "install",
+      "title": "Vad som händer under installationen",
+      "blocks": [
+        {
+          "steps": {
+            "items": [
+              {
+                "title": "Fastställ avbildningen",
+                "body": "Registret frågas, värdens arkitektur väljs och den exakta digest som den löpande uppdaterade taggen pekar på fastställs."
+              },
+              {
+                "title": "Hämta och verifiera",
+                "body": "Skopeo hämtar avbildningen som ett OCI-arkiv. Innan något skapas kontrolleras varje lager mot sin digest och packas upp. Om hämtningen är skadad görs ett nytt försök innan installationen avbryts."
+              },
+              {
+                "title": "Skapa filsystemet",
+                "body": "<code>pct create</code> skapar rootfs från arkivet och bevarar avbildningens officiella processmetadata."
+              },
+              {
+                "title": "Anslut resurserna",
+                "body": "Deklarerade volymer, nätverk, miljö, enheter och säkerhetsprofiler kopplas in."
+              },
+              {
+                "title": "Konsol",
+                "body": "Containerns konsolutdata sparas på värden. Konsolen i Proxmox VE öppnar ett skal om avbildningen innehåller ett."
+              },
+              {
+                "title": "Kontrollera",
+                "body": "Vid första starten väntar installationen på en adress och på att tjänsten ska svara. Ett misslyckande rapporteras inte som en lyckad installation."
+              },
+              {
+                "title": "Registrera konfigurationen",
+                "body": "Den faktiska konfigurationen sparas i instanskontraktet som används vid uppdateringar och återskapande."
+              }
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "example",
+      "title": "Exempel: en avbildning med /config och /downloads",
+      "intro": "En vanlig Compose-definition och den Proxmox VE-konfiguration som den omvandlas till. Sökvägarna som programmet förväntar sig ändras inte.",
+      "blocks": [
+        {
+          "codeGrid": {
+            "items": [
+              {
+                "title": "Docker Compose",
+                "code": "image: lscr.io/linuxserver/example:latest\nenvironment:\n  - PUID=1000\n  - PGID=1000\nvolumes:\n  - config:/config\n  - /srv/downloads:/downloads\nports:\n  - 8080:8080"
+              },
+              {
+                "title": "/etc/pve/lxc/VMID.conf (utdrag)",
+                "code": "entrypoint: /init\nmp0: local-lvm:vm-VMID-disk-1,mp=/config,backup=1,size=8G\nmp1: /srv/downloads,mp=/downloads\nnet0: name=eth0,bridge=vmbr0,ip=dhcp,type=veth\nlxc.environment.runtime: PUID=1000\nlxc.environment.runtime: PGID=1000"
+              }
+            ]
+          }
+        },
+        {
+          "p": "<code>mp0</code> är en andra disk som tillhör containern och heter <code>vm-VMID-disk-N</code> på den valda lagringen. Den monteras på <code>/config</code> och ingår i containerns säkerhetskopia med <code>backup=1</code>. <code>mp1</code> skapar ingen disk: värdens katalog <code>/srv/downloads</code> monteras på <code>/downloads</code> i LXC-containern. Port 8080 mappas inte: LXC-containern har en egen adress där tjänsten svarar."
+        }
+      ]
+    }
+  ]
+}
diff --git a/web/messages/sv/docs/oci-manager/custom-image.json b/web/messages/sv/docs/oci-manager/custom-image.json
new file mode 100644
index 00000000..c8c04c7e
--- /dev/null
+++ b/web/messages/sv/docs/oci-manager/custom-image.json
@@ -0,0 +1,278 @@
+{
+  "meta": {
+    "title": "Installera en avbildning utanför katalogen | ProxMenux",
+    "description": "Anpassa en OCI-avbildning från en Compose-fil, en URL, ett docker run-kommando eller en avbildningsreferens och granska vad ProxMenux kan återskapa före installationen."
+  },
+  "header": {
+    "title": "Installera en avbildning utanför katalogen",
+    "description": "Din avbildning anpassas från sin Compose-fil, ett docker run-kommando eller enbart referensen. Resultatet visas för granskning innan någon LXC-container skapas.",
+    "section": "OCI manager Apps"
+  },
+  "sections": [
+    {
+      "id": "intro",
+      "blocks": [
+        {
+          "calloutInfo": {
+            "title": "Samma konverterare och installationsflöde",
+            "body": "Alternativet <strong>Installera en avbildning utanför katalogen</strong> använder samma konverterare och installationsflöde som katalogmallarna. Skillnaden är att kontraktet skapas vid det tillfället från den angivna definitionen och valideras innan någon LXC-container skapas."
+          }
+        }
+      ]
+    },
+    {
+      "id": "sources",
+      "title": "Så beskrivs avbildningen",
+      "intro": "Första vyn frågar hur avbildningen beskrivs. Fyra alternativ läser en definition som anpassas, ett femte använder bara avbildningens namn och tre andra läser en färdig oci-compose-fil.",
+      "blocks": [
+        {
+          "table": {
+            "headers": [
+              "Alternativ",
+              "Vad som läses"
+            ],
+            "rows": [
+              [
+                "Klistra in Compose-filen i terminalen",
+                "Klistra in YAML-innehållet i terminalen och avsluta med Ctrl+D."
+              ],
+              [
+                "Läs Compose-filen från värden",
+                "En sökväg på noden, som standard <code>/root/docker-compose.yml</code>. Filen måste finnas och får vara högst 256 KiB."
+              ],
+              [
+                "Hämta Compose-filen från en adress",
+                "En <code>http://</code>- eller <code>https://</code>-adress som tillhandahåller rå YAML. Högst 256 KiB hämtas."
+              ],
+              [
+                "Klistra in docker run-kommandot i terminalen",
+                "Kommandot som projektet publicerar. Portar, miljö, volymer, enheter, capabilities, användare, delat minne och andra alternativ som stöds anpassas."
+              ],
+              [
+                "Bara avbildningsreferensen, utan Compose-fil",
+                "En referens som <code>ghcr.io/user/application:latest</code>. Registret frågas och avbildningens OCI-metadata bevaras."
+              ],
+              [
+                "Klistra in en oci-compose i terminalen",
+                "Klistra in JSON-innehållet i terminalen och avsluta med Ctrl+D. Det konverteras inte utan kontrolleras och installeras som det är skrivet."
+              ],
+              [
+                "Läs en oci-compose-fil från värden",
+                "En JSON-fil på noden, som standard <code>/root/oci-compose.json</code>, på högst 2 MiB."
+              ],
+              [
+                "Hämta en oci-compose från en adress",
+                "En <code>http://</code>- eller <code>https://</code>-adress som tillhandahåller JSON-filen. Högst 2 MiB hämtas."
+              ]
+            ]
+          }
+        },
+        {
+          "figure": {
+            "src": "/oci-manager/custom-source-menu.png",
+            "alt": "Meny för att välja hur en avbildning utanför katalogen ska beskrivas",
+            "caption": "Olika sätt att beskriva en avbildning utanför katalogen."
+          }
+        }
+      ]
+    },
+    {
+      "id": "reference-only",
+      "title": "Vad enbart avbildningsreferensen ger",
+      "intro": "Avbildningen innehåller processens metadata, men inte allt som en Compose-fil brukar lägga till runt den.",
+      "blocks": [
+        {
+          "table": {
+            "headers": [
+              "Läses från avbildningen",
+              "Finns inte i avbildningen",
+              "Konsekvens"
+            ],
+            "rows": [
+              [
+                "<code>Entrypoint</code>, <code>Cmd</code>, <code>User</code>, <code>WorkingDir</code> och den inbyggda miljön",
+                "Variabler som bara finns i dokumentationen",
+                "Läggs till under installationen eller via Ändra"
+              ],
+              [
+                "Volymer som avbildningen deklarerar",
+                "Kataloger på värden som bara anges i Compose-filen",
+                "Ytterligare sökvägar läggs till före installationen"
+              ],
+              [
+                "<code>EXPOSE</code>-portar",
+                "URL, protokoll eller funktionell hälsokontroll",
+                "Porten och sättet att kontrollera tjänsten bekräftas"
+              ],
+              [
+                "Arkitekturer och digest i registret",
+                "Enheter, privilegier eller externa beroenden",
+                "Aktiveras inte utan en definition som begär dem"
+              ]
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "review",
+      "title": "Granska före installationen",
+      "intro": "Efter att definitionen anpassats visar ProxMenux hur den har tolkats, innan VMID, resurser eller lagring efterfrågas.",
+      "blocks": [
+        {
+          "steps": {
+            "items": [
+              {
+                "title": "Analysera",
+                "body": "Tjänster, avbildning, portar, sökvägar, miljö, enheter, säkerhet och hälsokontroll läses in."
+              },
+              {
+                "title": "Fråga registret",
+                "body": "Avbildningen måste finnas i registret och de publicerade arkitekturerna listas. Ett privat register läses med kontot som sparats för det."
+              },
+              {
+                "title": "Lista det som inte tillämpas",
+                "body": "Etiketter, Docker-nätverk, Swarm-inställningar och andra nycklar som inte påverkar en LXC-container listas."
+              },
+              {
+                "title": "Blockera alternativ utan säker motsvarighet",
+                "body": "Nycklar utan säker motsvarighet visas under <strong>Alternativ utan motsvarighet</strong> och installationen fortsätter inte. Inget ignoreras utan besked."
+              },
+              {
+                "title": "Fråga efter hemliga uppgifter",
+                "body": "Variabler vars namn tyder på lösenord, token eller nyckel efterfrågas som känsliga uppgifter under installationen."
+              }
+            ]
+          }
+        },
+        {
+          "figure": {
+            "src": "/oci-manager/custom-review.png",
+            "alt": "Sammanfattning av hur ProxMenux har tolkat Compose-filen",
+            "caption": "Sammanfattningen som visas innan installationen frågar efter VMID och resurser."
+          }
+        },
+        {
+          "p": "Efter att sammanfattningen godkänts följer samma flöde som i katalogen: namn, standardläge eller avancerat läge, VMID, CPU, minne, nätverk, start med noden, beständiga och extra sökvägar, kompatibla enheter och en slutlig sammanfattning."
+        }
+      ]
+    },
+    {
+      "id": "examples",
+      "title": "Exempel på indata",
+      "blocks": [
+        {
+          "codeGrid": {
+            "items": [
+              {
+                "title": "Compose",
+                "code": "services:\n  app:\n    image: ghcr.io/example/app:latest\n    ports:\n      - \"8080:8080\"\n    volumes:\n      - ./config:/config\n      - /srv/media:/media\n    environment:\n      TZ: Europe/Madrid"
+              },
+              {
+                "title": "docker run",
+                "code": "docker run -d \\\n  --name app \\\n  -p 8080:8080 \\\n  -e TZ=Europe/Madrid \\\n  -v app-config:/config \\\n  -v /srv/media:/media \\\n  ghcr.io/example/app:latest"
+              }
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "oci-compose",
+      "title": "En oci-compose skriven för hand",
+      "intro": "En oci-compose är JSON-filen som ett program installeras från. Katalogen innehåller en sådan fil per program. Samma format kan skrivas för hand och installeras med det här alternativet.",
+      "blocks": [
+        {
+          "p": "I en handskriven fil bestämmer författaren avbildning, portar, variabler, volymer och installationsfrågor. ProxMenux kompletterar resten när filen läses. Formatet kan ange sådant som Compose inte kan: frågetexter, ett lösenord som skapas under installationen, en GPU-profil, ägaren till varje volym, kontrollen vid första starten eller inloggningsuppgifterna som visas till sist."
+        },
+        {
+          "steps": {
+            "items": [
+              {
+                "title": "Kontrollera",
+                "body": "En fil med fel installeras inte. Varje fel anger vilket fält det gäller; vid ogiltig JSON visas rad och kolumn."
+              },
+              {
+                "title": "Granska",
+                "body": "En giltig fil visar vad den installerar: avbildning, webbadress, portar, beständiga sökvägar, variabler som efterfrågas och filer som skrivs."
+              },
+              {
+                "title": "Installera",
+                "body": "Installationen är densamma som för katalogens program, med standardinställningar eller avancerade inställningar."
+              }
+            ]
+          }
+        },
+        {
+          "calloutWarning": {
+            "title": "En fil som bestämmer privilegierna",
+            "body": "En oci-compose bestämmer vad som monteras i containern och med vilka privilegier. Granskningen visar detta före installationen: installera bara filer från betrodda källor."
+          }
+        },
+        {
+          "p": "Formatet beskrivs block för block med två fullständiga exempel i <readmeLink>OCI-motorns README</readmeLink>. Även en installationspost kan läsas på samma sätt: bara den ursprungliga mallen används, inga av svaren från den installationen."
+        }
+      ]
+    },
+    {
+      "id": "private-registries",
+      "title": "Avbildningar i privata register",
+      "intro": "En avbildning i ett privat register, till exempel ett privat GitHub-paket eller ett privat Docker Hub-arkiv, läses med ett konto som sparats i ProxMenux.",
+      "blocks": [
+        {
+          "steps": {
+            "items": [
+              {
+                "title": "Registret nekar åtkomst till avbildningen",
+                "body": "Om registret svarar att avbildningen kräver ett konto erbjuder granskningen inloggning och läser sedan avbildningen igen."
+              },
+              {
+                "title": "Logga in",
+                "body": "Ett användarnamn och ett lösenord eller en token som får hämta avbildningen. Registret kontrollerar uppgifterna och de sparas bara om de godkänns."
+              },
+              {
+                "title": "Installera och håll uppdaterat",
+                "body": "Kontot används för att hämta avbildningen under installationen och även vid uppdatering, Ändra, Återskapa, watchdog och Monitors uppdateringskontroll, på alla noder i klustret."
+              }
+            ]
+          }
+        },
+        {
+          "p": "<strong>Registerkonton</strong> i huvudmenyn för OCI manager Apps visar sparade konton per register och användare, aldrig deras hemliga uppgifter. Från varje konto kan du kontrollera, hämta eller installera en avbildning samt uppdatera eller ta bort inloggningsuppgifterna."
+        },
+        {
+          "list": {
+            "items": [
+              "GitHub (<code>ghcr.io</code>): användaren är GitHub-kontot och lösenordet en personlig åtkomsttoken med behörigheten <code>read:packages</code>.",
+              "Docker Hub (<code>docker.io</code>): användaren är Docker Hub-kontot och lösenordet en åtkomsttoken med läsbehörighet.",
+              "Andra register, även med egen port som <code>registry.example.com:5000</code>: användarnamn och lösenord eller token som registret tillhandahåller."
+            ]
+          }
+        },
+        {
+          "calloutInfo": {
+            "title": "Var kontona sparas",
+            "body": "I <code>/etc/pve/priv/proxmenux/registry-auth.json</code>, läsbar bara av root, i samma mapp där Proxmox sparar lagringslösenord. <code>/etc/pve</code> delas mellan alla noder i klustret, så ett konto som läggs till på en nod används på alla. Värdens säkerhetskopia innehåller filen och avinstallation av ProxMenux tar bort den från alla noder."
+          }
+        }
+      ]
+    },
+    {
+      "id": "limits",
+      "title": "Definitioner som inte installeras",
+      "blocks": [
+        {
+          "list": {
+            "items": [
+              "En Dockerfile utan publicerad avbildning: avbildningen måste först byggas och publiceras i ett OCI-register.",
+              "En Compose-fil med flera tjänster blockeras eftersom det här alternativet installerar en tjänst i en container, även om flera tjänster använder samma avbildning.",
+              "<code>configs</code>, externa hemligheter eller enhetsformat som inte kan anpassas entydigt.",
+              "Skalsubstitutioner som <code>$(command)</code>: ange det resulterande värdet direkt i stället.",
+              "Okända <code>docker run</code>-alternativ och <code>--env-file</code>: använd en Compose-fil med uttryckliga värden i stället."
+            ]
+          }
+        }
+      ]
+    }
+  ]
+}
diff --git a/web/messages/sv/docs/oci-manager/hardware.json b/web/messages/sv/docs/oci-manager/hardware.json
new file mode 100644
index 00000000..e828a5d7
--- /dev/null
+++ b/web/messages/sv/docs/oci-manager/hardware.json
@@ -0,0 +1,392 @@
+{
+  "meta": {
+    "title": "Enheter och acceleration | ProxMenux",
+    "description": "Hur OCI manager Apps ger en OCI-container tillgång till GPU, NVIDIA, Coral, USB, FUSE och andra enheter som validerade inbyggda Proxmox VE-resurser."
+  },
+  "header": {
+    "title": "Enheter och acceleration",
+    "description": "GPU, NVIDIA, Coral, USB, FUSE och blockenheter blir validerade inbyggda Proxmox VE-resurser för containern.",
+    "section": "OCI manager Apps"
+  },
+  "sections": [
+    {
+      "id": "principle",
+      "title": "Enheten som programmet behöver, inte hela värden",
+      "blocks": [
+        {
+          "p": "En enhet som begärs av Compose-filen eller av applikationsprofilen blir en konkret <code>devN</code>-post eller LXC-montering. Be om en GPU, en USB-enhet eller en Coral gör inte containern privilegierad."
+        },
+        {
+          "flow": {
+            "nodes": [
+              {
+                "label": "Värdinventering",
+                "detail": "/dev/dri/renderD128\nGID 993 · Intel"
+              },
+              {
+                "label": "ProxMenux",
+                "detail": "tillverkare och\nbehörigheter kontrollerade"
+              },
+              {
+                "label": "LXC",
+                "detail": "samma enhet\neffektiv GID"
+              }
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "origin",
+      "title": "Varifrån enhetsbegäran kommer",
+      "blocks": [
+        {
+          "table": {
+            "headers": [
+              "Källa",
+              "Vad läses",
+              "Vad installationsprogrammet gör"
+            ],
+            "rows": [
+              [
+                "Docker Compose",
+                "<code>devices</code>, <code>group_add</code>, <code>deploy.resources</code> och NVIDIA förfrågningar",
+                "Varje krav blir en begäran om enhet som visas för granskning"
+              ],
+              [
+                "Katalogprofil",
+                "Programmets faktiska stöd för GPU, Coral, OpenCL, USB eller FUSE",
+                "Endast de alternativ som valideras för den avbildningen erbjuds"
+              ],
+              [
+                "Avbildningens metadata och dokumentation",
+                "VA-API, Selkies, LinuxServer mods eller NVIDIA runtime",
+                "Dokumenterade variabler och förberedelser läggs till"
+              ],
+              [
+                "Användarval",
+                "CPU endast, Intel/AMD, OpenCL, NVIDIA eller en valfri enhet",
+                "Urvalet lagras i instansavtalet"
+              ]
+            ]
+          }
+        },
+        {
+          "calloutWarning": {
+            "title": "Upptäckta enheter ansluts inte automatiskt",
+            "body": "Värden är inventerad, men endast enheter som deklareras av Compose-filen eller av en kompatibel profil erbjuds och bifogas. En GPU, USB-dongel eller Coral närvarande på värden är inte utsatt för varje LXC."
+          }
+        }
+      ]
+    },
+    {
+      "id": "identify",
+      "title": "Hur värdenheten identifieras",
+      "intro": "Innan LXC modifieras läses enheten på värden och matchas mot den valda profilen.",
+      "blocks": [
+        {
+          "table": {
+            "headers": [
+              "Typ",
+              "Identitet",
+              "Validering"
+            ],
+            "rows": [
+              [
+                "Intel/AMD DRM",
+                "<code>/dev/dri/renderD*</code> och <code>/sys/class/drm/NODE/device/vendor</code>",
+                "En teckenenhet med leverantör <code>0x8086</code> (Intel) eller <code>0x1002</code> (AMD)"
+              ],
+              [
+                "AMD OpenCL",
+                "Rendernoden plus <code>/dev/kfd</code> när profilen behöver den",
+                "Existens, typ, leverantör, behörigheter och förklarad kompatibilitet"
+              ],
+              [
+                "AMD ROCm",
+                "Rendernoden, <code>/dev/kfd</code> och generationen som beräkningsdrivrutinen rapporterar i <code>/sys/class/kfd/kfd/topology/nodes/*/properties</code>",
+                "En generation som programmets ROCm-avbildning innehåller beräkningskärnor för — de namngivna RDNA2-GPU:erna och nyare — erbjuds utan anpassning. Andra GPU:er i dessa familjer, till exempel Radeon 680M och 780M, erbjuds som experimentella och väljs aldrig som föreslaget alternativ: ROCm stöder dem inte officiellt, programmet presenterar dem som familjens generation (<code>HSA_OVERRIDE_GFX_VERSION</code>) och installeraren begär bekräftelse innan den större avbildningen hämtas. Äldre GPU:er, till exempel den integrerade grafiken i Ryzen 5000U, erbjuds inte och Immich fortsätter köra igenkänningen på CPU:n."
+              ],
+              [
+                "NVIDIA",
+                "<code>nvidia-smi</code> och <code>nvidia-container-cli</code>",
+                "GPU, UUID, PCI buss, drivrutinsversion, Toolkit, <code>/dev/nvidia*</code> noder, binärer och bibliotek"
+              ],
+              [
+                "Coral PCIe/M.2",
+                "<code>/dev/apex_N</code> och dess länk i <code>/sys/dev/char/MAJOR:MINOR</code>",
+                "Teckenenhetsnod, major/minor-nummer, ägare, GID och behörigheter"
+              ],
+              [
+                "USB och seriell",
+                "<code>/dev/ttyUSB*</code>, <code>/dev/ttyACM*</code> eller <code>/dev/bus/usb/BBB/DDD</code>",
+                "Teckenenhetsnod; för USB även tillverkare, produkt och serienummer när sysfs publicerar dem"
+              ],
+              [
+                "KVM, TUN, FUSE, video och generisk SCSI",
+                "<code>/dev/kvm</code>, <code>/dev/net/tun</code>, <code>/dev/fuse</code>, <code>/dev/videoN</code> eller <code>/dev/sgN</code>",
+                "Sökväg som stöds, nodtyp och effektiva behörigheter"
+              ],
+              [
+                "Optisk enhet",
+                "<code>/dev/srN</code>",
+                "En blockenhet"
+              ]
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "install",
+      "title": "Vad händer under installationen",
+      "blocks": [
+        {
+          "steps": {
+            "items": [
+              {
+                "title": "Mallen erbjuder sina profiler",
+                "body": "Till exempel CPU endast, Intel/AMD VA-API, AMD OpenCL, Intel OpenCL eller NVIDIA. Alternativen hör till avbildningen, inte till en vanlig meny."
+              },
+              {
+                "title": "En profil väljs",
+                "body": "Den anger enhetsnoder, miljö, moddar eller den körmiljö som programmet behöver."
+              },
+              {
+                "title": "En väg föreslås",
+                "body": "För DRM, <code>/dev/dri/renderD128</code>, som kan ändras på en värd med flera rendernoder. För USB eller seriell, är den specifika noden vald."
+              },
+              {
+                "title": "Validering",
+                "body": "Existens, typ, tillåten leverantör, behörigheter och GID kontrolleras. En missmatchning stoppar operationen."
+              },
+              {
+                "title": "Kontraktet är skrivet",
+                "body": "Sökväg, läge, GID, skrivåtkomst och profil sparas för uppdateringar och när containern skapas om."
+              },
+              {
+                "title": "Anslut och testa",
+                "body": "<code>pct set</code> lägger till <code>devN</code> inträde och åtkomst kontrolleras sedan inuti LXC. LinuxServer avbildningar kontrolleras också som användare <code>abc</code>."
+              }
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "config",
+      "title": "Hur det visas i LXC-konfigurationen",
+      "intro": "Exempelvärden: <code>dev0</code> och <code>dev1</code> är lediga platser som Proxmox VE tilldelar, och <code>renderD128</code>, <code>apex_0</code> samt GID beror på nodens maskinvara.",
+      "blocks": [
+        {
+          "codeGrid": {
+            "items": [
+              {
+                "title": "Intel/AMD VA-API",
+                "code": "dev0: path=/dev/dri/renderD128,mode=0660,gid=993,deny-write=0"
+              },
+              {
+                "title": "Coral PCIe/M.2",
+                "code": "dev0: path=/dev/apex_0,mode=0660,gid=GID,deny-write=0"
+              },
+              {
+                "title": "En specifik USB-enhet",
+                "code": "dev0: path=/dev/bus/usb/003/004,mode=0660,gid=GID,deny-write=0"
+              },
+              {
+                "title": "AMD OpenCL",
+                "code": "dev0: path=/dev/dri/renderD128,mode=0660,gid=GID,deny-write=0\ndev1: path=/dev/kfd,mode=0660,gid=GID,deny-write=0"
+              }
+            ]
+          }
+        },
+        {
+          "p": "GID läses med <code>stat</code> på värden och skrivs till <code>devN</code>-posten; <code>render</code> och <code>video</code>-grupper antas inte ha ett fast nummer. Enheten håller samma <code>/dev</code>-väg inuti LXC, där programmets egna mekanismer letar efter det."
+        }
+      ]
+    },
+    {
+      "id": "profiles",
+      "title": "Profiler en avbildning kan erbjuda",
+      "blocks": [
+        {
+          "table": {
+            "headers": [
+              "Profil",
+              "Resulterande konfiguration",
+              "Erbjuds när"
+            ],
+            "rows": [
+              [
+                "Intel/AMD VA-API",
+                "Rendernod i <code>/dev/dri</code>",
+                "Applikationen stöder videoacceleration"
+              ],
+              [
+                "OpenCL",
+                "Rendernod, <code>/dev/kfd</code> vid behov och den officiella modden",
+                "Avbildningen eller profilen dokumenterar den"
+              ],
+              [
+                "NVIDIA",
+                "Värdens drivrutinsenheter och bibliotek",
+                "Värden har en fungerande drivrutin och NVIDIA Container Toolkit"
+              ],
+              [
+                "Coral",
+                "<code>/dev/apex_0</code> eller USB buss",
+                "Profilen förklarar Coral Support (Frigate)"
+              ],
+              [
+                "USB, seriell, FUSE",
+                "En enhet, ett validerat träd eller en LXC-funktion",
+                "Kontraktet begär det"
+              ]
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "nvidia",
+      "title": "NVIDIA",
+      "blocks": [
+        {
+          "calloutWarning": {
+            "title": "Nodkrav: NVIDIA Container Toolkit",
+            "body": "En fungerande drivrutin på Proxmox VE är inte tillräckligt för att ge en NVIDIA GPU till en OCI-avbildning. OCI Manager Apps använder <code>nvidia-container-cli</code>, från NVIDIA Container Toolkit, för att identifiera enheterna och för att få binärer och bibliotek som matchar den laddade drivrutinen."
+          }
+        },
+        {
+          "p": "<nvidiaLink>ProxMenux NVIDIA-installerare</nvidiaLink> installerar NVIDIA Container Toolkit från NVIDIAs officiella arkiv tillsammans med drivrutinen. Den kontrollerar dess fyra paket, validerar <code>nvidia-container-cli</code> och registrerar resultatet i ändringsloggen för <auditLink>Audit & Report</auditLink>."
+        },
+        {
+          "p": "Dessa två kommandon på värden visar om drivrutinen och Toolkit är tillgängliga:"
+        },
+        {
+          "shell": {
+            "code": "nvidia-smi -L\nnvidia-container-cli --version"
+          }
+        },
+        {
+          "p": "På en värd där drivrutinen installerades på annat sätt installeras Toolkit från det officiella stabila förvaret:"
+        },
+        {
+          "shell": {
+            "code": "apt-get update\napt-get install -y --no-install-recommends ca-certificates curl gnupg2\n\ncurl -fsSL https://nvidia.github.io/libnvidia-container/gpgkey \\\n  | gpg --dearmor -o /usr/share/keyrings/nvidia-container-toolkit-keyring.gpg\n\ncurl -s -L https://nvidia.github.io/libnvidia-container/stable/deb/nvidia-container-toolkit.list \\\n  | sed 's#deb https://#deb [signed-by=/usr/share/keyrings/nvidia-container-toolkit-keyring.gpg] https://#g' \\\n  > /etc/apt/sources.list.d/nvidia-container-toolkit.list\n\napt-get update\napt-get install -y nvidia-container-toolkit libnvidia-container-tools"
+          }
+        },
+        {
+          "p": "Inventeringen OCI Manager Apps använder är utdata av:"
+        },
+        {
+          "shell": {
+            "code": "nvidia-container-cli list --device all --libraries --binaries --firmwares --ipcs"
+          }
+        },
+        {
+          "calloutInfo": {
+            "title": "Docker runtime konfiguration är inte involverad",
+            "body": "Containrarna är inbyggda LXC:er utan Docker-demon, så <code>nvidia-ctk runtime configure --runtime=docker</code> ingår inte: ProxMenux frågar <code>nvidia-container-cli</code> direkt och skriver LXC-enheter och monteringar. Kommandon och plattformar som stöds underhålls i <toolkitLink>installationsguiden för NVIDIA Container Toolkit</toolkitLink>."
+          }
+        },
+        {
+          "cards": {
+            "items": [
+              {
+                "icon": "cpu",
+                "title": "Inventering från drivrutinen",
+                "body": "<code>nvidia-container-cli</code> listar enhetsnoder, binärer, firmware och bibliotek av den installerade drivrutinen."
+              },
+              {
+                "icon": "refresh",
+                "title": "Ingen fast version",
+                "body": "Mallen anger inga biblioteksfilnamn. Profilen genereras från den aktuella värden."
+              },
+              {
+                "icon": "shield",
+                "title": "Skrivskyddade monteringar",
+                "body": "Värdens bibliotek monteras skrivskyddat i stället för att kopieras till containern."
+              },
+              {
+                "icon": "hardDrive",
+                "title": "Ändringar av drivrutin",
+                "body": "Efter en drivrutinsändring genereras inventeringen på nytt innan berörda LXC:er startar."
+              }
+            ]
+          }
+        },
+        {
+          "code": {
+            "title": "NVIDIA resultat (förenklad)",
+            "code": "devN: path=/dev/nvidia0,...\ndevN: path=/dev/nvidiactl,...\ndevN: path=/dev/nvidia-uvm,...\nlxc.mount.entry: HOST_LIBRARY CONTAINER_LIBRARY none ro,bind,create=file 0 0"
+          }
+        },
+        {
+          "p": "Att bara ge tillgång till <code>/dev/nvidia0</code> räcker inte. Den laddade drivrutinens användarkomponenter monteras skrivskyddat, och <code>nvidia-smi</code> körs sedan i LXC:n för att jämföra GPU, UUID, PCI-buss och version med värdens inventering."
+        }
+      ]
+    },
+    {
+      "id": "usb",
+      "title": "USB, seriell och USB Coral",
+      "blocks": [
+        {
+          "calloutWarning": {
+            "title": "USB-nummer kan ändra",
+            "body": "En väg som <code>/dev/bus/usb/003/004</code> kan ändras när enheten är återansluten eller värden startar om. Profilen registrerar tillverkaren, produkten och serienumret när de är tillgängliga, men en ny bussadress mappas om inte automatiskt."
+          }
+        },
+        {
+          "p": "En kringutrustning anges med sin specifika nod: <code>/dev/ttyUSB0</code>, <code>/dev/ttyACM0</code>, <code>/dev/apex_0</code> eller <code>/dev/bus/usb/BBB/DDD</code>. Att passera hela <code>/dev</code> accepteras inte. Coral erbjuds endast program vars profil anger det."
+        }
+      ]
+    },
+    {
+      "id": "trees",
+      "title": "Enhetsträd och LXC-funktioner",
+      "blocks": [
+        {
+          "table": {
+            "headers": [
+              "Begäran",
+              "Resulterande konfiguration",
+              "Omfattning"
+            ],
+            "rows": [
+              [
+                "<code>/dev/dvb</code>, <code>/dev/snd</code> eller <code>/dev/bus/usb</code>",
+                "Varje teckenenhetsnod i trädet får en egen <code>devN</code>-post med värdens läge och GID",
+                "Endast det begärda trädet, inte resten av <code>/dev</code>"
+              ],
+              [
+                "<code>/dev/fuse</code>",
+                "Noden och när profilen behöver den, funktionen <code>fuse=1</code>",
+                "FUSE offentliggör inte fästen till andra LXCs"
+              ],
+              [
+                "<code>/dev/net/tun</code>",
+                "En <code>devN</code>-post med samma sökväg inuti LXC:n",
+                "VPN- eller nätverkskonfigurationen stannar i programmet"
+              ],
+              [
+                "<code>/dev/kvm</code>",
+                "En validerad <code>devN</code>-post",
+                "Erbjuds endast när kontraktet begär det"
+              ]
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "security",
+      "title": "Bekräftelser av risknivå",
+      "blocks": [
+        {
+          "p": "Konkreta enheter, valfri privilegiering, krävs privilegier, AppArmor eller seccomp avslappning och tillgång till värd PID-namnrymden behandlas som separata fall, inte under en generisk privilegierad etikett. Varje alternativ med en risk förklaras och bekräftas under installationen."
+        }
+      ]
+    }
+  ]
+}
diff --git a/web/messages/sv/docs/oci-manager/index.json b/web/messages/sv/docs/oci-manager/index.json
new file mode 100644
index 00000000..390aa4d6
--- /dev/null
+++ b/web/messages/sv/docs/oci-manager/index.json
@@ -0,0 +1,213 @@
+{
+  "meta": {
+    "title": "OCI manager Apps | ProxMenux",
+    "description": "Kör officiella OCI-avbildningar som LXC-containrar direkt i Proxmox VE, med beständiga data, enhetsåtkomst, program med flera containrar och transaktionsbaserade uppdateringar."
+  },
+  "header": {
+    "title": "OCI manager Apps",
+    "description": "Officiella OCI-avbildningar körs som inbyggda LXC-containrar i Proxmox VE. Avbildningen är fortfarande den som underhållaren publicerar; ProxMenux återskapar miljön som Docker Compose annars skulle ha skapat runt den.",
+    "section": "OCI manager Apps"
+  },
+  "sections": [
+    {
+      "id": "model",
+      "blocks": [
+        {
+          "calloutInfo": {
+            "title": "En OCI-avbildning, en LXC direkt i Proxmox VE",
+            "body": "Ingen Docker Engine körs i containrarna. Proxmox VE importerar avbildningens filsystem och OCI-metadata. Programmet blir huvudprocessen i en inbyggd LXC-container som hanteras med samma verktyg som övriga containrar på noden."
+          }
+        },
+        {
+          "flow": {
+            "nodes": [
+              {
+                "label": "Källa",
+                "detail": "OCI-avbildning\nCompose och dokumentation"
+              },
+              {
+                "label": "ProxMenux",
+                "detail": "JSON-kontrakt\nvalidering och planering"
+              },
+              {
+                "label": "Proxmox VE",
+                "detail": "LXC direkt i Proxmox VE\nvolymer och enheter"
+              }
+            ],
+            "caption": "Programmet byggs inte om. Dess miljö beskrivs deklarativt och återskapas."
+          }
+        }
+      ]
+    },
+    {
+      "id": "where",
+      "title": "Var du hittar det",
+      "intro": "Öppna <strong>OCI manager Apps (Technology Preview)</strong> i ProxMenux huvudmeny på Proxmox-noden som root. Den första vyn erbjuder:",
+      "blocks": [
+        {
+          "list": {
+            "items": [
+              "<strong>Sök program</strong> – sök efter namn i hela katalogen.",
+              "<strong>Alla program</strong> – visa hela katalogen och antalet program.",
+              "<strong>Hantera installerade OCI-program</strong> – uppdatera, ändra, ta bort eller återställ befintliga installationer.",
+              "<strong>Registerkonton</strong> – hantera konton för att installera och uppdatera avbildningar från privata register.",
+              "<strong>Installera en avbildning utanför katalogen</strong> – anpassa en Compose-fil, ett <code>docker run</code>-kommando eller en avbildningsreferens.",
+              "Katalogens kategorier, var och en med sitt antal program."
+            ]
+          }
+        },
+        {
+          "figure": {
+            "src": "/oci-manager/main-menu.png",
+            "alt": "Huvudvyn i OCI manager Apps med sökning, hela katalogen, programhantering, avbildningar utanför katalogen och kategorier.",
+            "caption": "Huvudvyn i OCI manager Apps."
+          }
+        },
+        {
+          "p": "När du väljer ett program visas dess beskrivning, avbildningen som används och två installationslägen. <strong>Installera med standardinställningar</strong> frågar bara efter grundvalen: lagring, dataplacering, adress och start. <strong>Installera med avancerade inställningar</strong> går igenom alla val i ordning: VMID och resurser, lagring för varje sökväg, nätverksbrygga och enheter."
+        },
+        {
+          "p": "Program som faktiskt har testats visas som <strong>Verifierad</strong> i den här vyn och markeras med ✓ i listorna, oavsett om testet gjordes i ProxMenux labb eller av användargemenskapen."
+        }
+      ]
+    },
+    {
+      "id": "beta",
+      "title": "Varför beteckningen Technology Preview används",
+      "blocks": [
+        {
+          "p": "OCI manager Apps behåller beteckningen <strong>Technology Preview</strong> som Proxmox VE använder för programcontainrar skapade från OCI-avbildningar. Stödet infördes i Proxmox VE 9.1. Beteckningen gäller tekniken som OCI manager Apps bygger på, inte ProxMenux-motorn: containrarnas beteende kan fortfarande ändras mellan Proxmox VE-versioner. Beteckningen behålls tills Proxmox VE bedömer att stödet är stabilt."
+        },
+        {
+          "p": "Funktionerna i OCI manager Apps testas i ProxMenux labb: installation, uppdatering, ändringar, återskapande, säkerhetskopiering, återställning, migrering och watchdog. Varje program testas separat. De som faktiskt har testats visas som <strong>Verifierad</strong> och markeras med ✓ i listorna."
+        }
+      ]
+    },
+    {
+      "id": "translation",
+      "title": "Så beskriver Docker kraven och så omsätter OCI manager Apps dem",
+      "blocks": [
+        {
+          "table": {
+            "headers": [
+              "Krav",
+              "Så uttrycks det i Docker",
+              "Så omsätts det i OCI manager Apps"
+            ],
+            "rows": [
+              [
+                "Kör programmet",
+                "<code>image</code>, <code>entrypoint</code>, <code>command</code>",
+                "OCI-avbildningens rootfs och LXC-containerns huvudprocess"
+              ],
+              [
+                "Bevara konfigurationen",
+                "<code>volumes: /config</code>",
+                "En beständig <code>mpN</code>-volym som tas med i säkerhetskopian, eller en katalog på värden."
+              ],
+              [
+                "Gör tjänsten tillgänglig",
+                "<code>ports</code>",
+                "En egen adress för LXC-containern och tjänstens åtkomst-URL."
+              ],
+              [
+                "Använd maskinvara",
+                "<code>devices</code>, <code>group_add</code>",
+                "<code>devN</code>-poster med värdens effektiva grupp-ID (GID) och en validerad profil."
+              ],
+              [
+                "Koppla ihop beroenden",
+                "<code>networks</code>, <code>depends_on</code>",
+                "En privat nätverksbrygga, fasta adresser, startordning och hälsokontroller."
+              ],
+              [
+                "Uppdatera",
+                "Hämta med <code>pull</code> och återskapa",
+                "Ett nytt rootfs med samma kontrakt för beständiga data."
+              ]
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "kept",
+      "title": "Vad som bevaras och vad som ändras",
+      "blocks": [
+        {
+          "cards": {
+            "items": [
+              {
+                "icon": "archive",
+                "title": "Bevaras",
+                "body": "Den officiella avbildningen, dess interna sökvägar, miljö, startprocess och användardokumentation."
+              },
+              {
+                "icon": "boxes",
+                "title": "Anpassas",
+                "body": "Körmiljön: nätverk, beständiga data, enheter, behörigheter och beroenden använder de inbyggda LXC-funktionerna i Proxmox VE."
+              },
+              {
+                "icon": "shield",
+                "title": "Utan motsvarighet",
+                "body": "Ett Compose-alternativ utan en säker motsvarighet markeras som ett hinder för installationen. Mallar med sådana hinder erbjuds inte för installation, och känsliga alternativ måste bekräftas i installationsguiden."
+              },
+              {
+                "icon": "refresh",
+                "title": "Sparas",
+                "body": "Avbildningens digest, resurser, sökvägar, nätverk, enheter och tillhörighet till en stack sparas i instanskontraktet. Uppdateringar och återskapande följer samma kontrakt."
+              }
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "pages",
+      "title": "Sidor i det här avsnittet",
+      "blocks": [
+        {
+          "next": {
+            "items": [
+              {
+                "label": "Så anpassas en OCI-avbildning",
+                "href": "/docs/oci-manager/architecture",
+                "tail": "Från avbildningen och dess Compose-fil till en LXC direkt i Proxmox VE."
+              },
+              {
+                "label": "Installera en avbildning utanför katalogen",
+                "href": "/docs/oci-manager/custom-image",
+                "tail": "En Compose-fil, ett docker run-kommando eller en avbildningsreferens."
+              },
+              {
+                "label": "Data, sökvägar och nätverk",
+                "href": "/docs/oci-manager/storage-network",
+                "tail": "Containervolymer, kataloger på värden, rclone-monteringar och adresser."
+              },
+              {
+                "label": "Enheter och acceleration",
+                "href": "/docs/oci-manager/hardware",
+                "tail": "GPU, NVIDIA, Coral, USB och andra enheter."
+              },
+              {
+                "label": "Program med flera containrar",
+                "href": "/docs/oci-manager/stacks",
+                "tail": "Program, databas och cache i samordnade LXC-containrar."
+              },
+              {
+                "label": "Installera, uppdatera och ändra",
+                "href": "/docs/oci-manager/lifecycle",
+                "tail": "Instanskontraktet och dess åtgärder."
+              },
+              {
+                "label": "I ProxMenux Monitor",
+                "href": "/docs/oci-manager/monitor",
+                "tail": "Versioner, uppdateringar, konsolutdata och terminal."
+              }
+            ]
+          }
+        }
+      ]
+    }
+  ]
+}
diff --git a/web/messages/sv/docs/oci-manager/lifecycle.json b/web/messages/sv/docs/oci-manager/lifecycle.json
new file mode 100644
index 00000000..b4a5ad6e
--- /dev/null
+++ b/web/messages/sv/docs/oci-manager/lifecycle.json
@@ -0,0 +1,499 @@
+{
+  "meta": {
+    "title": "Installera, uppdatera och ändra | ProxMenux",
+    "description": "Instanskontraktet för en OCI-container och de åtgärder som använder det: uppdatering, ändring, borttagning, återupptagning av en avbruten åtgärd och återställning av driften efter en återläsning på denna eller en annan värd."
+  },
+  "header": {
+    "title": "Installera, uppdatera och modifiera",
+    "description": "Varje instans behåller ett reproducerbart kontrakt, så att dess rootfs kan ersättas utan att konfiguration eller beständiga data går förlorade.",
+    "section": "OCI manager Apps"
+  },
+  "sections": [
+    {
+      "id": "contract",
+      "title": "Instanskontraktet",
+      "blocks": [
+        {
+          "p": "Efter installationen sparas den faktiska konfigurationen i <code>/usr/local/share/proxmenux/oci/instances/VMID/oci-compose.json</code>. Det är inte en kopia av den ursprungliga Compose-filen, utan ett reproducerbart kontrakt för den LXC som finns på värden."
+        },
+        {
+          "code": {
+            "code": "instances/\n└── 105/\n    └── oci-compose.json\n        ├── image and resolved digest\n        ├── resources and network\n        ├── environment (secrets protected)\n        ├── container disks and host directories\n        ├── hardware profile and devices\n        ├── console log and terminal mode\n        └── stack membership and lifecycle"
+          }
+        },
+        {
+          "p": "En kopia av kontraktet finns i containern under <code>/.proxmenux/oci-record.json</code> och kan bara läsas av containerns root-användare. En säkerhetskopia av containern innehåller därför alltid det kontrakt som gällde då. En andra kopia sparas i <code>/etc/pve/priv/proxmenux/oci</code>, som delas av alla noder i klustret och bara kan läsas av värdens root-användare. Båda kopiorna skrivs efter varje installation, uppdatering och ändring."
+        }
+      ]
+    },
+    {
+      "id": "manage",
+      "title": "Hantera installerade OCI-program",
+      "intro": "Det här alternativet på huvudskärmen listar registrerade instanser med tillhörande program och avbildning. Varje instans kontrolleras mot sitt kontrakt före varje åtgärd. En CT som inte längre stämmer med sin post varken ändras eller tas bort. Samma uppdatering och editor finns på fliken Uppdateringar i <monitorLink>ProxMenux Monitor</monitorLink>.",
+      "blocks": [
+        {
+          "table": {
+            "headers": [
+              "Alternativ",
+              "Vad ändras",
+              "Vad bevaras"
+            ],
+            "rows": [
+              [
+                "Uppdatera avbildningen med sparad konfiguration",
+                "Rootfs ersätts med den avbildning som den sparade kanalen publicerar för närvarande",
+                "Kontrakt, containerdiskar, värdkataloger, nätverk och enheter"
+              ],
+              [
+                "Ändra: redigera resurser, nätverk, sökvägar och GPU",
+                "Editorn öppnas med det aktuella kontraktet; CT:n byggs om med ändringarna",
+                "Data på containerdiskar och i värdkataloger"
+              ],
+              [
+                "Watchdog: starta om programmet när det kraschar",
+                "Om programmet ska startas igen när det stannar av sig självt. Ingenting byggs om",
+                "Hela installationen; endast valet sparas i kontraktet"
+              ],
+              [
+                "Ta bort: ta bort programmet och dess containrar",
+                "LXC, eller varje medlem i en stack, och deras kontrakt raderas",
+                "Värdkataloger, med deras innehåll"
+              ]
+            ]
+          }
+        },
+        {
+          "p": "För ett program med flera containrar erbjuder menyn <strong>Uppdatera alla programmets containrar</strong>, <strong>Ändra extra sökvägar och enheter</strong>, <strong>Återskapa alla containrar med sparad konfiguration</strong>, watchdog och borttagning. Ändra lägger till eller tar bort extra sökvägar och enheter i programcontainern utan att bygga om något och ändrar i Immich vad som kör igenkänningen. Återskapa bygger om varje container från den avbildning som användes vid installationen utan att söka efter en nyare."
+        },
+        {
+          "figure": {
+            "src": "/oci-manager/manage-menu.png",
+            "alt": "Lista över installerade OCI-program med alternativ för att uppdatera, ändra och ta bort",
+            "caption": "Hantera installerade OCI-program."
+          }
+        }
+      ]
+    },
+    {
+      "id": "update",
+      "title": "En transaktionell uppdatering",
+      "blocks": [
+        {
+          "mermaid": {
+            "chartCode": "sequenceDiagram\n participant U as {{user}}\n participant P as ProxMenux\n participant R as {{registry}}\n participant X as Proxmox VE\n U->>P: {{update}}\n P->>R: {{resolve}}\n R-->>P: digest\n P->>P: {{verify}}\n P->>X: {{backup}}\n P->>X: {{import}}\n P->>X: {{reapply}}\n X-->>P: healthcheck\n alt {{healthy}}\n  P-->>U: {{commit}}\n else {{failure}}\n  P->>X: Rollback\n  P-->>U: {{restored}}\n end",
+            "labels": {
+              "user": "Användare",
+              "registry": "OCI-registret",
+              "update": "Uppdatera instans",
+              "resolve": "Slå upp taggen",
+              "verify": "Verifiera arkivet och kör förkontroller",
+              "backup": "Stoppa och säkerhetskopiera CT:n",
+              "import": "Importera det nya rootfs",
+              "reapply": "Applicera kontraktet igen",
+              "healthy": "frisk",
+              "failure": "misslyckande",
+              "commit": "Kontraktet publiceras med den nya digesten",
+              "restored": "Tidigare instans återställd"
+            }
+          }
+        },
+        {
+          "list": {
+            "items": [
+              "Om registret fortfarande tillhandahåller den installerade digesten laddas ingenting ned och instansen lämnas orörd.",
+              "Den nya avbildningen verifieras lager för lager innan CT:n stoppas. En skadad nedladdning hämtas en andra gång; en redan cachad avbildning som inte klarar kontrollen laddas ned igen.",
+              "Inställningar som ändrats i Proxmox VE efter installationen (minne, swap, kärnor, CPU-gräns, CPU-prioritet och start med noden) bevaras och förs över till det nya kontraktet.",
+              "LAN-gränssnittet som Arr-sviten och multi-container-applikationerna lägger till (<code>net1</code>) och startordern (<code>startup</code>) ges tillbaka till den nya containern som de är.",
+              "Alla andra skillnader mellan CT och dess kontrakt stoppar uppdateringen innan CT stoppas."
+            ]
+          }
+        },
+        {
+          "flow": {
+            "nodes": [
+              {
+                "label": "Före",
+                "detail": "rootfs A\n/config mp0\n/media värdkatalog"
+              },
+              {
+                "label": "Uppdatering",
+                "detail": "ersätter endast\nrootfs"
+              },
+              {
+                "label": "Efter",
+                "detail": "rootfs B\n/config mp0\n/media värdkatalog"
+              }
+            ]
+          }
+        },
+        {
+          "p": "Innan något stoppas kontrolleras att det finns plats för säkerhetskopian: använda data på de volymer som ingår, plus en marginal. Den skrivs intill programmets post på värdens systemdisk. Om utrymmet inte räcker ber menyn om en annan lagring på värden som stöder säkerhetskopior. Kopian skapas där och tas bort när åtgärden är klar. Valet sparas för programmet, även för schemalagda uppdateringar. Om ingen lagring har tillräckligt med plats avvisas åtgärden och programmet förblir oförändrat. Utrymmet för den nya avbildningen kontrolleras på samma sätt före nedladdningen."
+        }
+      ]
+    },
+    {
+      "id": "recovery",
+      "title": "Återställa en avbruten operation",
+      "intro": "En uppdatering och en förändring använder en ihållande transaktion. Om processen, terminalen eller noden avbryts efter CT-stoppen, är operationen inte färdig.",
+      "blocks": [
+        {
+          "steps": {
+            "items": [
+              {
+                "title": "Markör för väntande åtgärd",
+                "body": "När Hantera installerade OCI-program öppnas visar det sparade tillståndet att ersättningen aldrig publicerades."
+              },
+              {
+                "title": "Visa status",
+                "body": "Visar den fas som uppnåddes utan att ändra containrar eller data."
+              },
+              {
+                "title": "Återställ den tidigare installationen",
+                "body": "Återläser den verifierade säkerhetskopia i plattformens eget format som togs före ersättningen samt det tidigare kontraktet."
+              },
+              {
+                "title": "Stackar som en enhet",
+                "body": "För en multicontainer-applikation återhämtas varje medlem från samma transaktionspunkt, inte bara den valda."
+              }
+            ]
+          }
+        },
+        {
+          "calloutWarning": {
+            "title": "Värdkataloger ingår inte i återställningen",
+            "body": "Säkerhetskopian omfattar rootfs och de containerdiskar som ingår i den. En värdkatalog återställs inte till sitt tidigare tillstånd, eftersom andra LXC-containrar kan använda dess data."
+          }
+        }
+      ]
+    },
+    {
+      "id": "watchdog",
+      "title": "Watchdog: starta om ett program som stannar",
+      "intro": "Proxmox har ingen omstartspolicy: när processen i en programcontainer avslutas förblir containern stoppad. Med watchdog aktiverad startas ett program som stannar av sig självt igen. För ett OCI-program gör den vad <code>restart: unless-stopped</code> gör i en Compose-fil.",
+      "blocks": [
+        {
+          "table": {
+            "headers": [
+              "Vad händer",
+              "Med Watchdog på"
+            ],
+            "rows": [
+              [
+                "Programmet kraschar eller dess process avslutas",
+                "Containern startas igen inom några sekunder"
+              ],
+              [
+                "Det stoppas eller stängs av från Proxmox, från Monitor eller med <code>pct</code>",
+                "Den förblir stoppad tills någon startar den"
+              ],
+              [
+                "En backup, en migration eller en ProxMenux-operation arbetar med den",
+                "Ingenting görs förrän det slutar"
+              ],
+              [
+                "Den var redan stoppad när värden startade",
+                "Den förblir stoppad; detta styrs av <strong>Starta med Proxmox</strong>"
+              ],
+              [
+                "Den stannar upprepade gånger direkt efter start",
+                "För ett program som stannar inom några sekunder efter start, eller inte startar alls, görs fem startförsök med 30 sekunders, 1, 2 och 5 minuters väntan mellan försöken. Därefter lämnas det stoppat och en avisering skickas"
+              ]
+            ]
+          }
+        },
+        {
+          "p": "Installationsprogrammet frågar om detta i båda installationslägena och föreslår värdet från programmets recept. Inställningen kan senare ändras under <strong>Hantera installerade OCI-program</strong> eller med containerns <strong>Watchdog</strong>-reglage i <monitorLink>ProxMenux Monitor</monitorLink> och gäller alla containrar i ett program med flera containrar. En enda tjänst på värden, <code>proxmenux-oci-watchdog.service</code>, övervakar alla program som begärt det. Installationen visas på fliken Ändringar i Audit & Report."
+        },
+        {
+          "calloutInfo": {
+            "title": "Vad värden inte kan avgöra",
+            "body": "Programmets slutkod når inte värden, så ett normalt avslut och en krasch ser likadana ut och leder båda till omstart, som <code>always</code> och <code>unless-stopped</code> i Docker. Ett stopp som begärs utanför Proxmox med <code>lxc-stop</code> eller <code>systemctl</code> lämnar ingen stoppuppgift och tolkas som att programmet stannade av sig självt."
+          }
+        }
+      ]
+    },
+    {
+      "id": "restore",
+      "title": "Backup, restaurering och en annan värd",
+      "intro": "En säkerhetskopia som görs med vzdump eller Proxmox Backup Server innehåller containern, de containerdiskar som valts för säkerhetskopiering och kopian av dess kontrakt. Det som installationen sparar på värden ingår inte. <strong>Hantera installerade OCI-program</strong> upptäcker containrar som återlästs på en värd utan deras kontrakt, efter en ny Proxmox-installation eller på en annan värd, och erbjuder att registrera dem igen.",
+      "blocks": [
+        {
+          "steps": {
+            "items": [
+              {
+                "title": "Återställ containrarna i Proxmox",
+                "body": "Från säkerhetskopieringslagringen, med det ursprungliga ID:t eller ett annat ledigt ID. Ett program med flera containrar behöver samtliga sina containrar."
+              },
+              {
+                "title": "Öppna Hantera installerade OCI-program",
+                "body": "De återlästa containrarna listas och återställning erbjuds. Knappen <strong>Återställ</strong> på fliken Uppdateringar i <monitorLink>ProxMenux Monitor</monitorLink> öppnar samma återställning."
+              },
+              {
+                "title": "Kontrollera innan du ändrar",
+                "body": "Återställningen kontrollerar att värden har allt som varje program behöver. Ett program som inte kan återställas i sin helhet lämnas oförändrat och orsaken anges."
+              },
+              {
+                "title": "Registrera och starta",
+                "body": "Kontraktet registreras på den här värden och det som installationen sparade där skrivs på nytt. Om programmen ska startas är en separat fråga. Svara Nej om de ursprungliga containrarna fortfarande körs på en annan värd."
+              }
+            ]
+          }
+        },
+        {
+          "figure": {
+            "src": "/oci-manager/restore-offer.png",
+            "alt": "Dialog som listar de restaurerade containrarna och erbjuder att återställa dem",
+            "caption": "Återställningen som erbjuds när Hantera installerade OCI-program öppnas."
+          }
+        },
+        {
+          "table": {
+            "headers": [
+              "Vad värden sparade",
+              "Efter återhämtningen"
+            ],
+            "rows": [
+              [
+                "Instanskontrakt",
+                "Registreras från kopian i containern, som kontrolleras mot den konfiguration som Proxmox återläste"
+              ],
+              [
+                "Privat nätverk av en multi-container-applikation",
+                "Skapad igen med samma bro och undernät; de fasta adresserna i containrarna ändras inte"
+              ],
+              [
+                "Startorder för en multicontainer-applikation",
+                "Beroende hookscript och dess kontrakt installeras igen; snippets är aktiverade på <code>local</code> lagring när ingen lagring accepterar dem"
+              ],
+              [
+                "Nätverks-sysctl och fil för värdövervakning",
+                "Skriven igen i <code>/etc/pve/proxmenux</code>"
+              ],
+              [
+                "NVIDIA-körmiljö",
+                "Hooken för en oprivilegierad container installeras på nytt. En privilegierad container får den här värdens drivrutinsfiler i stället för filerna från ursprungsvärden"
+              ],
+              [
+                "Rclone montering",
+                "Hookscriptet och de program som gör monteringen tillgänglig skrivs på nytt, med samma vyer på värden"
+              ],
+              [
+                "Brandväggsregel på värden för en värdmonitor",
+                "Efterfrågas igen för dess webbport och bryggans undernät på den här värden"
+              ],
+              [
+                "<code>lost+found</code> av varje återställd disk",
+                "Tas bort om den är tom; en återläsning skapar den och vissa program kan inte starta om den finns bland deras data"
+              ],
+              [
+                "Diskar som återlästs till annan lagring",
+                "Kontraktet uppdateras till lagringen de är på nu"
+              ]
+            ]
+          }
+        },
+        {
+          "p": "En container som återlästs med ett annat ID behåller sitt program. Kontraktet, konsolloggen, nätverksparametrarna för sysctl, hookscriptet för en Rclone-montering och startordningen för ett program med flera containrar registreras med de ID:n som containrarna har på den här värden."
+        },
+        {
+          "table": {
+            "headers": [
+              "Vad hindrar en återställning",
+              "Vad du gör"
+            ],
+            "rows": [
+              [
+                "En container av en multicontainer-applikation saknas",
+                "Återläs den också; programmet återställs i sin helhet"
+              ],
+              [
+                "Det privata undernätet används redan på den här värden",
+                "Återhämtningen avbryts och ingenting ändras: adresserna till containrarna är fasta och flyttas inte till ett annat undernät."
+              ],
+              [
+                "En värdkatalog finns inte",
+                "Montera eller skapa den med dess data; en säkerhetskopia av containern inkluderar inte värdkataloger"
+              ],
+              [
+                "En enhet finns inte på denna värd",
+                "Anslut den eller ta bort den från containern i Proxmox"
+              ],
+              [
+                "Ett program med NVIDIA på en värd utan drivrutinen",
+                "Installera NVIDIA-drivrutinen och Container Toolkit"
+              ],
+              [
+                "Backupen gjordes innan kopian av kontraktet fanns",
+                "Containern stannar som en vanlig LXC och erbjuds inte igen"
+              ]
+            ]
+          }
+        },
+        {
+          "calloutInfo": {
+            "title": "En container som kommer tillbaka",
+            "body": "En container som återlästs över sig själv från en äldre säkerhetskopia, återställts till en ögonblicksbild eller återvänt från en annan nod bär kontraktet för sitt nuvarande tillstånd. Om den väljs för en åtgärd och dess kontrakt skiljer sig från värdens startar åtgärden inte, och containern erbjuds för återställning."
+          }
+        },
+        {
+          "figure": {
+            "src": "/oci-manager/restore-result.png",
+            "alt": "Resultatet av återhämtningen med det privata nätverket, startordern och de registrerade containrarna",
+            "caption": "Resultatet av en återhämtning steg för steg."
+          }
+        }
+      ]
+    },
+    {
+      "id": "remove",
+      "title": "Ta bort en OCI-applikation",
+      "blocks": [
+        {
+          "p": "Före bekräftelsen skapas en sammanfattning utifrån den faktiska konfigurationen: containrarna som tas bort, data som raderas med dem, det privata nätverket som frigörs och värdkatalogerna som bevaras. Bekräftelsen är förvald till <strong>Nej</strong>, eftersom data på raderade diskar inte kan återställas efteråt."
+        },
+        {
+          "table": {
+            "headers": [
+              "Resurs",
+              "Vid borttagning",
+              "Orsak"
+            ],
+            "rows": [
+              [
+                "rootfs och containerdiskar",
+                "Raderas",
+                "De tillhör endast containern"
+              ],
+              [
+                "Värdkatalog",
+                "Bevaras med sitt innehåll",
+                "Andra applikationer kan använda den"
+              ],
+              [
+                "Containerns filer på värden",
+                "Raderas",
+                "Dess konsollogg, nätverkssysctls, Rclone montering hookscript och dess registrering i App-fliken ProxMenux Monitor tjänar ingen annan container"
+              ],
+              [
+                "Filer som delas av flera installationer",
+                "Tas bort när den sista installationen som använder dem tas bort",
+                "Värdmonitorfilen och hookscriptet för beroenden i program med flera containrar"
+              ],
+              [
+                "Instanskontrakt",
+                "Tas bort efter en framgångsrik borttagning",
+                "Ingen CT är associerad med den mer"
+              ],
+              [
+                "Privat brygga för en stack",
+                "Frigörs med stacken",
+                "Det har inga medlemmar kvar att ansluta"
+              ],
+              [
+                "Nätverk som delas av Arr-paketet",
+                "Frigörs när det sista programmet i sviten tas bort",
+                "Varje program i sviten är oberoende och tas bort separat"
+              ],
+              [
+                "En enda medlem av en stack",
+                "Tas inte bort separat",
+                "Hela applikationen tas bort, så ingen stack lämnas ofullständig"
+              ],
+              [
+                "En container på en annan nod av klustret",
+                "Inte borttagen",
+                "Dess rekord och värdfiler är på noden där den installerades: den tas bort där, efter att ha migrerat den tillbaka."
+              ]
+            ]
+          }
+        },
+        {
+          "figure": {
+            "src": "/oci-manager/remove-summary.png",
+            "alt": "Sammanfattning av borttagningen med berörda containrar, data och värdkataloger",
+            "caption": "Sammanfattningen av borttagningen, skapad utifrån den faktiska konfigurationen."
+          }
+        }
+      ]
+    },
+    {
+      "id": "archives",
+      "title": "Nedladdade avbildningar och utrymme på värden",
+      "blocks": [
+        {
+          "p": "OCI-arkivet används för att bygga rootfs; den körande CT:n läser det inte. Efter en installation eller uppdatering listas de arkiv som laddades ned under åtgärden med sina storlekar, och borttagning erbjuds. Att ta bort dem frigör utrymme utan att påverka containern eller dess data."
+        },
+        {
+          "calloutInfo": {
+            "title": "Uppdateringar behöver inte arkivet",
+            "body": "Utan arkivet slår en uppdatering upp den sparade kanalen och laddar ned den nya digesten. Om arkivet finns återanvänds det bara när dess referens och integritet motsvarar det som begärs."
+          }
+        }
+      ]
+    },
+    {
+      "id": "registry",
+      "title": "Register och rensning",
+      "blocks": [
+        {
+          "p": "När <strong>Hantera installerade OCI-program</strong> öppnas tas först rester bort efter containrar som inte längre finns på någon nod i klustret: posten som sparats som historik efter borttagning via Proxmox-gränssnittet och värdfiler som lämnats kvar efter en borttagning. En post med en halvfärdig åtgärd behålls eftersom säkerhetskopian fortfarande kan behövas. Volymer och värdkataloger raderas aldrig utifrån antaganden."
+        }
+      ]
+    },
+    {
+      "id": "cluster",
+      "title": "I ett kluster: migration och hög tillgänglighet",
+      "intro": "En OCI-container är en vanlig Proxmox-LXC: den kan migreras eller hanteras av HA som andra containrar, med samma begränsningar. Det som behövs för att starta den sparas där alla noder i klustret kan hitta det.",
+      "blocks": [
+        {
+          "table": {
+            "headers": [
+              "Delar",
+              "På en annan nod av klustret"
+            ],
+            "rows": [
+              [
+                "Konsollogg",
+                "Containern skapar <code>/var/log/proxmenux/oci</code> före start på den nod som kör den. Varje nod sparar loggen för de starter som utförts där."
+              ],
+              [
+                "Nätverks-sysctl och värdmonitor",
+                "Sparas i <code>/etc/pve/proxmenux</code>, som delas av alla noder i klustret, så att en migrerad container hittar dem."
+              ],
+              [
+                "Containerdiskar",
+                "Proxmox flyttar dem med containern. HA behöver ha deras data tillgängliga på målnoden via delad lagring eller en replikering som stöds."
+              ],
+              [
+                "Värdkataloger och enheter",
+                "Samma regler som alla LXC: en värdkatalog måste finnas på målnoden och markeras som delad, och en GPU, Coral eller NPU måste finnas där."
+              ],
+              [
+                "ProxMenux-post",
+                "Kontraktet stannar på noden där programmet installerades, och varje nod läser kopian i <code>/etc/pve/priv/proxmenux/oci</code>. Ett program med en enda container som migreras registreras på målnoden när <strong>Hantera installerade OCI-program</strong> öppnas eller en åtgärd startas för programmet. Ett program med flera containrar erbjuds för återställning där eftersom dess privata nätverk måste skapas på den noden."
+              ]
+            ]
+          }
+        },
+        {
+          "calloutWarning": {
+            "title": "Inte för hög tillgänglighet",
+            "body": "En multi-container-applikation når sina medlemmar genom en privat bro av noden som den installerades på, så dess medlemmar stannar på den noden. En värdmonitor, såsom Glances i värdläge eller Netdata, övervakar den nod som den körs på; flytta den skulle övervaka en annan nod."
+          }
+        },
+        {
+          "p": "När programmet återställs får en säkerhetskopia som återlästs utanför klustret de filer från <code>/etc/pve/proxmenux</code> som containern använder."
+        }
+      ]
+    },
+    {
+      "id": "channel",
+      "title": "En rullande tag är inte en obevakad uppdatering",
+      "blocks": [
+        {
+          "p": "Katalogen installerar den rullande tagg som underhållaren publicerar, men den faktiska digesten slås upp och sparas och ändras bara genom en uttrycklig uppdatering med förkontroller och återställning. <monitorLink>ProxMenux Monitor</monitorLink> jämför den installerade digesten med den som registret publicerar och visar och aviserar när en ny avbildning är tillgänglig."
+        }
+      ]
+    }
+  ]
+}
diff --git a/web/messages/sv/docs/oci-manager/monitor.json b/web/messages/sv/docs/oci-manager/monitor.json
new file mode 100644
index 00000000..c1780c38
--- /dev/null
+++ b/web/messages/sv/docs/oci-manager/monitor.json
@@ -0,0 +1,213 @@
+{
+  "meta": {
+    "title": "OCI-behållare i ProxMenux Monitor | ProxMenux",
+    "description": "Vad ProxMenux Monitor visar för en container installerad av OCI Manager Apps: applikations- och avbildningsversioner, nya avbildningar, konsolutdata och Proxmox VE-terminalen."
+  },
+  "header": {
+    "title": "I ProxMenux Monitor",
+    "description": "En container installerad av OCI Manager Apps visas i VMs & LXCs som alla andra LXC. Dess modal läser installationsposten: applikations- och avbildningsversioner, nya avbildningar, konsolutdata och terminal.",
+    "section": "OCI manager Apps"
+  },
+  "sections": [
+    {
+      "id": "intro",
+      "blocks": [
+        {
+          "calloutInfo": {
+            "title": "Posten är källan",
+            "body": "OCI Manager Apps vet vad den installerade och var den kom ifrån. Monitorn läser det installationsrekordet istället för att prova containern, så data är detsamma om containern körs eller stoppas."
+          }
+        },
+        {
+          "table": {
+            "headers": [
+              "Flik",
+              "Vilka förändringar för en OCI container"
+            ],
+            "rows": [
+              [
+                "Status",
+                "En <strong>Watchdog</strong>-brytare under Start vid start: programmet startas igen när det stannar på egen hand."
+              ],
+              [
+                "App",
+                "Programmet identifieras från posten och uppdateringar spåras av avbildning"
+              ],
+              [
+                "Uppdateringar",
+                "Avbildningen uppdateras eller programmet ändras, med samma flöde som OCI-menyn"
+              ],
+              [
+                "Monteringar",
+                "Container diskar och värd kataloger, med deras användning"
+              ],
+              [
+                "Loggar",
+                "Endast för OCI-containrar: programmets konsolutdata"
+              ]
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "app",
+      "title": "App",
+      "intro": "<appLink>App</appLink>-fliken erbjuder den installerade applikationen som en detektering, med namnet, logotypen, porten och schemat för posten. När den registreras öppnas redigeraren med metoden <strong>OCI-avbildning (installerad av ProxMenux) </strong>, som inte behöver någon konfiguration.",
+      "blocks": [
+        {
+          "cards": {
+            "items": [
+              {
+                "icon": "boxes",
+                "title": "Program",
+                "body": "Versionen av applikationen i avbildningen, läs från själva avbildningen: dess miljö eller <code>org.opencontainers.image.version</code>-etiketten. Det är informativt."
+              },
+              {
+                "icon": "archive",
+                "title": "Avbildning",
+                "body": "Byggdatum och digest för den installerade avbildningen. Uppdateringen avgörs här: installerad digest jämförs med den som registret publicerar för samma tagg i dag."
+              }
+            ]
+          }
+        },
+        {
+          "list": {
+            "items": [
+              "När registret publicerar en ny digest visar kortet <strong>Ny avbildning</strong> med datum och digest, även om programversionen inuti inte ändrats: en ombyggnad på en uppdaterad bas är en uppdatering.",
+              "När digestvärdena matchar visar kortet <strong>Version</strong>.",
+              "Kortet länkar till bildförvaret: dess GitHub-projekt, eller dess Docker Hub-sida för en officiell avbildning.",
+              "Tillgångslänken använder containerns LAN-adress, även för huvudmedlemmen i en multi-container-applikation, som har en andra adress på sitt privata nätverk.",
+              "Knappen <strong>Uppdatera data</strong> läser installationsposten och avbildningsregistret igen. Alternativen för att söka efter eller registrera andra program visas inte: containern innehåller exakt det program som anges i posten."
+            ]
+          }
+        },
+        {
+          "figure": {
+            "src": "/oci-manager/monitor-app-tab.png",
+            "alt": "App-fliken för en OCI-behållare med applikationsversionen, avbildningen och förvaringslänken",
+            "caption": "App-fliken för en container installerad av OCI Manager Apps."
+          }
+        },
+        {
+          "p": "Kontrollen körs en gång om dagen med uppdateringskontrollerna av Monitor, och <strong>Uppdatera data</strong> kör den omedelbart. En ny avbildning skickas som ett meddelande via de kanaler som konfigureras i <notificationsLink>Aviseringar</notificationsLink>. Uppdateringen tillämpas från fliken Uppdateringar."
+        }
+      ]
+    },
+    {
+      "id": "updates",
+      "title": "Uppdateringar",
+      "intro": "För en container installerad av OCI Manager Apps visar fliken Uppdateringar programmet med sin installerade avbildning och när registret publicerar en, den nya avbildningen, i samma format som alla andra program. Paket- och programuppdaterarna för en vanlig LXC visas inte.",
+      "blocks": [
+        {
+          "table": {
+            "headers": [
+              "Knapp",
+              "Vad det öppnar"
+            ],
+            "rows": [
+              [
+                "Uppdatering",
+                "Uppdateringen från <lifecycleLink>Hantera installerade OCI-program</lifecycleLink> för denna container i Monitors terminal. Den kan köras med eller utan ny avbildning; utan en ny avbildning ändras ingenting. I ett program med flera containrar uppdateras alla medlemmar."
+              ],
+              [
+                "Ändra",
+                "Redigeraren för programmet (resurser, nätverk, vägar och GPU). I en multi-container-applikation lägger den till eller tar bort de extra vägarna och enheterna i applikationsbehållaren och i Immich ändrar det som kör igenkänning."
+              ],
+              [
+                "Återställ",
+                "Ersätter uppdatering när en operation på containern avbröts och öppnar sin återhämtning."
+              ],
+              [
+                "Återställ (återställd container)",
+                "Visas för en container återställd från säkerhetskopia som saknar kontrakt på denna värd, under <strong>Återställt OCI-program</strong>. Öppnar <lifecycleLink>återställningen</lifecycleLink> i Monitors terminal; Uppdatera och Ändra visas när den har registrerats."
+              ]
+            ]
+          }
+        },
+        {
+          "p": "Externa förändringar, värdkataloger och multi-container-applikationer hanteras som i OCI-menyn. I en multi-container-applikation visas knapparna och alternativen endast på huvudbehållaren; de andra medlemmarna visar sin avbildning, en anteckning om att de uppdateras från huvudbehållaren och en knapp som öppnar den. När terminalen stängs läses avbildningen, posten och monteringarna igen."
+        },
+        {
+          "table": {
+            "headers": [
+              "Alternativ",
+              "Beteende"
+            ],
+            "rows": [
+              [
+                "Behåll säkerhetskopian som tas före uppdateringen",
+                "Varje uppdatering backar upp containern för att återställa den om uppdateringen misslyckas. Med det här alternativet hålls samma säkerhetskopiering i den valda lagringen och visas bland säkerhetskopiorna i CT; på Proxmox Backup Server skrivs en säkerhetskopia före uppdateringen."
+              ],
+              [
+                "Schemalagda uppdateringar",
+                "Avbildningen uppdateras vid vald tid bara om registret publicerar en ny, med möjlighet att vänta tills den är 1, 3, 7 eller 14 dagar gammal. En container med ändringar gjorda utanför ProxMenux hoppas över och rapporteras."
+              ]
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "logs",
+      "title": "Loggar",
+      "intro": "Logs-fliken visas bara för containrar installerade av OCI manager Apps, mellan Monteringar och Säkerhetskopior. Den visar standardutdata och standardfel från avbildningens huvudprocess, samma utdata som <code>docker logs</code> visar för en Docker-container.",
+      "blocks": [
+        {
+          "list": {
+            "items": [
+              "Utdata sparas på värden i <code>/var/log/proxmenux/oci/VMID.console.log</code> (läge 0600), från första starten och över omstarter, så att de kan läsas när containern är stoppad.",
+              "Filen roteras på 10 MB och håller tre komprimerade kopior (<code>/etc/logrotate.d/proxmenux-oci</code>).",
+              "Varje start av containern är markerad i utgången. Fliken visar utgången sedan den sista starten som standard; <strong>Full historia</strong> visar också de tidigare.",
+              "När programmet tas bort tas även dess utdata bort.",
+              "De senaste 100, 500 eller 1000 raderna visas. När containern körs följs nya rader i realtid; om du rullar upp pausas följningen och <strong>Följ</strong> återupptar den.",
+              "Ett filter visar endast linjer som innehåller en text, och <strong>Ladda ner</strong> sparar linjerna laddade.",
+              "Färgkoder tas bort och en rad som ritas om av en förloppsindikator visas i sitt slutliga tillstånd.",
+              "Fliken läser filen varje gång den öppnas; den mellanlagras inte."
+            ]
+          }
+        },
+        {
+          "calloutInfo": {
+            "title": "Inloggningsuppgifter vid första starten",
+            "body": "Avbildningar som skriver ut ett genererat lösenord på sin första start lämnar det i denna utgång, som <code>docker logs</code> gör. Installatören läser den därifrån för att visa den i sin sammanfattning."
+          }
+        },
+        {
+          "figure": {
+            "src": "/oci-manager/monitor-logs-tab.png",
+            "alt": "Logs-fliken med konsolutgången av en OCI-behållare, linjeväljaren, filtret och följknappen",
+            "caption": "Konsolutgång av en OCI-behållare."
+          }
+        }
+      ]
+    },
+    {
+      "id": "terminal",
+      "title": "Proxmox VE konsol",
+      "blocks": [
+        {
+          "p": "En OCI-bild kör sin egen process som PID 1 och ingen inloggningstjänst, så standardkonsolen för en LXC skulle öppna en terminal där inget svarar. Containers installerade av OCI Manager Apps skapas med <code>cmode: shell</code>: Proxmox VE-konsolen öppnar ett skal med <code>lxc-attach</code>, motsvarande <code>docker exec</code>, med den löpande applikationen orörd."
+        },
+        {
+          "list": {
+            "items": [
+              "Skalet är det som <code>/etc/passwd</code> anger för root i avbildningen. Om root saknar skal eller avbildningen inte innehåller något behålls standardkonsolen.",
+              "Skalet körs som root i containern, utan ett lösenord. Vem kan öppna det beslutas av <code>VM.Console</code> tillstånd av Proxmox VE.",
+              "Monitorns terminal går in i containern med <code>pct enter</code>, som fungerar på samma sätt."
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "mounts",
+      "title": "Monteringar",
+      "blocks": [
+        {
+          "p": "<mountsLink>Monteringar</mountsLink>-fliken listar containerns diskar och värdkataloger. Användningen av en containerdisk på blocklagring som LVM-thin läses från diskens filsystem, som bara är monterat inuti containern."
+        }
+      ]
+    }
+  ]
+}
diff --git a/web/messages/sv/docs/oci-manager/stacks.json b/web/messages/sv/docs/oci-manager/stacks.json
new file mode 100644
index 00000000..b50eadde
--- /dev/null
+++ b/web/messages/sv/docs/oci-manager/stacks.json
@@ -0,0 +1,404 @@
+{
+  "meta": {
+    "title": "Multi-container applikationer | ProxMenux",
+    "description": "Hur OCI Manager Apps förvandlar en applikation med sin databas och cache till samordnade inbyggda LXC:er: plan, privat nätverk, beroendehook, validering och transaktionsuppdateringar."
+  },
+  "header": {
+    "title": "Program med flera containrar",
+    "description": "En applikation med sin databas, cache och andra tjänster blir flera samordnade inbyggda LXC:er, installerade och uppdaterade som en.",
+    "section": "OCI manager Apps"
+  },
+  "sections": [
+    {
+      "id": "intro",
+      "blocks": [
+        {
+          "calloutInfo": {
+            "title": "En applikation för användaren, flera LXCs för Proxmox VE",
+            "body": "En multi-container definition är en post av katalogen. Installationsprogrammet skapar en inbyggd LXC per tjänst och håller sina beroenden explicit. Immich, Nextcloud, Paperless-ngx och Tandoor installeras på detta sätt."
+          }
+        },
+        {
+          "mermaid": {
+            "chartCode": "flowchart LR\n C[\"Docker Compose\"] --> O[\"{{plan}}\"]\n O --> A[\"{{app}}<br/>{{appNet}}\"]\n O --> D[\"{{db}}<br/>{{private}}\"]\n O --> R[\"{{cache}}<br/>{{private}}\"]\n V1[(\"config\")] --> A\n V2[(\"database\")] --> D\n V3[(\"cache\")] --> R\n D --> A\n R --> A",
+            "labels": {
+              "plan": "Stackplan",
+              "app": "Programmets LXC",
+              "appNet": "LAN + privat",
+              "db": "PostgreSQL LXC",
+              "cache": "Valkey LXC",
+              "private": "privat"
+            }
+          }
+        }
+      ]
+    },
+    {
+      "id": "plan",
+      "title": "1. Planen, innan någon container finns",
+      "blocks": [
+        {
+          "p": "Inget LXC skapas medan Compose definitionen tolkas. En komplett plan kommer först, med varje medlem, avbildning, VMID, nätverk, väg, hemlighet, ordning och hälsokontroll. Om planen inte är konsekvent startar installationen inte."
+        },
+        {
+          "table": {
+            "headers": [
+              "Planelement",
+              "Innehåll",
+              "Kontrolleras innan du skapar något"
+            ],
+            "rows": [
+              [
+                "Medlemmar",
+                "Huvudapplikation, databas, cache, maskininlärning och andra beroenden",
+                "Unika VMID, kända roller och exakt en huvudmedlem"
+              ],
+              [
+                "Avbilder",
+                "Rullande referens, arkitektur och fastställd digest för varje tjänst",
+                "Alla finns, stöder arkitekturen och klarar OCI-integritetskontrollen"
+              ],
+              [
+                "Nätverk",
+                "Privat bro, subnet, en fast adress per tjänst och LAN-åtkomst för huvudmedlemmen",
+                "Ingen kollision med befintliga broar eller undernät och ingen upprepad adress"
+              ],
+              [
+                "Persistens",
+                "Container diskar, värdkataloger, ägare och backup",
+                "Inga överlappande vägar, lagring tillgängliga och deklarerade behörigheter"
+              ],
+              [
+                "Hemligheter",
+                "Databaslösenord, applikationsnycklar och inledande inloggningsuppgifter",
+                "Genereras en gång och ges endast till de medlemmar som använder dem"
+              ],
+              [
+                "Livscykel",
+                "Startorder, stopporder och hälsokontroll per medlem",
+                "Huvudapplikationen börjar sist och stoppar först"
+              ]
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "create",
+      "title": "2. Skapa en medlem i taget",
+      "blocks": [
+        {
+          "steps": {
+            "items": [
+              {
+                "title": "Reservera varje VMID",
+                "body": "Proxmox VE-inventeringen och instansregistret kontrolleras. En befintlig CT tas inte över och ett kontrakt som fortfarande tillhör en annan instans återanvänds inte."
+              },
+              {
+                "title": "Förbered varje avbildning",
+                "body": "Alla avbildningar löses, laddas ner och verifieras innan den första containern skapas."
+              },
+              {
+                "title": "Skapa varje rootfs",
+                "body": "Den officiella OCI-metadatan importeras och ProxMenux-instansidentiteten och medlemsrollen läggs till."
+              },
+              {
+                "title": "Privat nätverk",
+                "body": "En bro och undernät skapas och varje medlem får sin fasta adress; endast huvudmedlemmen får också LAN-gränssnittet."
+              },
+              {
+                "title": "Persistens",
+                "body": "Varje databas och konfiguration får sin egen containerdisk; endast data avsedda att delas använder värdkataloger."
+              },
+              {
+                "title": "Miljö",
+                "body": "Interna slutpunkter, delade hemligheter och servicevariabler skrivs. Programmet når sina beroenden på deras reserverade privata adresser."
+              },
+              {
+                "title": "Post",
+                "body": "Varje medlem registrerar sin inbyggda konfiguration, de rootfs-ändringar som uppdateringar måste återskapa och sin relation till stacken."
+              }
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "checks",
+      "title": "3. Börja och kontrollera varje container",
+      "intro": "En skapad LXC betyder inte att tjänsten är redo. Beroendena startar i ordning och varje tjänst genomgår en egen kontroll.",
+      "blocks": [
+        {
+          "table": {
+            "headers": [
+              "Tjänst",
+              "Kontroll",
+              "Vad det visar"
+            ],
+            "rows": [
+              [
+                "PostgreSQL",
+                "<code>pg_isready</code> i CT med förväntad värd, användare och databas",
+                "Servern accepterar anslutningar för den konfigurerade databasen"
+              ],
+              [
+                "Redis / Valkey",
+                "<code>redis-cli</code> eller <code>valkey-cli</code> <code>PING</code> mot sin privata adress",
+                "Brokern lyssnar och svarar"
+              ],
+              [
+                "Immich maskininlärning",
+                "HTTP <code>GET /ping</code>, plus en kontroll av den valda GPU runtime",
+                "Tjänsten svarar och den begärda accelerationen har inte fallit tillbaka till CPU"
+              ],
+              [
+                "Nextcloud",
+                "<code>GET /status.php</code> med <code>installed=true</code>, <code>maintenance=false</code> och <code>needsDbUpgrade=false</code>",
+                "Initieringen är klar utan väntande migrering"
+              ],
+              [
+                "Paperless-ngx / Tandoor",
+                "HTTP på LAN-adressen och tjänstens faktiska port",
+                "Frontend och dess beroenden tillhandahåller programmet"
+              ],
+              [
+                "Huvudapplikation",
+                "Slutpunkten för dess mall, till exempel <code>/api/server/ping</code> i Immich",
+                "Hela stacken fungerar genom programmet som använder beroenden"
+              ]
+            ]
+          }
+        },
+        {
+          "calloutWarning": {
+            "title": "Körs betyder inte att allt fungerar",
+            "body": "Det löpande tillståndet säger bara att LXC-processen existerar. Där tjänsten erbjuder en bättre check, en exec eller HTTP check med en timeout används. Om en medlem slutar eller misslyckas med sin kontroll, deklareras inte stacken installerad."
+          }
+        }
+      ]
+    },
+    {
+      "id": "hook",
+      "title": "4. Beroende hook",
+      "blocks": [
+        {
+          "p": "Kroken är endast inställd på huvudbehållaren av en beroende stack. Proxmox VE håller manuset som en snippet och kör det som <code>hookscript</code> av den CT. Receptet är inte skrivet i manuset: det lever i ett separat privat kontrakt."
+        },
+        {
+          "codeGrid": {
+            "items": [
+              {
+                "title": "Huvud CT konfiguration",
+                "code": "hookscript: local:snippets/proxmenux-stack-dependencies.sh"
+              },
+              {
+                "title": "Privat kontrakt (exempel)",
+                "code": "/etc/pve/priv/proxmenux-stack-VMID.json\n{\n  \"schema\": 1,\n  \"stack\": \"immich\",\n  \"dependencies\": [\n    {\"vmid\": 107, \"label\": \"PostgreSQL\", \"healthcheck\": {...}},\n    {\"vmid\": 108, \"label\": \"Valkey\", \"healthcheck\": {...}},\n    {\"vmid\": 106, \"label\": \"Machine Learning\", \"healthcheck\": {...}}\n  ]\n}"
+              }
+            ]
+          }
+        },
+        {
+          "snippet": {
+            "summary": "Fullständig källa till proxmenux-stack-dependencies.sh",
+            "pathCode": "local:snippets/proxmenux-stack-dependencies.sh",
+            "snippetCode": "stackDependencyHook"
+          }
+        },
+        {
+          "p": "Skriptet är detsamma för varje stack. VMID, namn, checktyper och timeouts kommer från det privata kontraktet <code>/etc/pve/priv/proxmenux-stack-VMID.json</code> av varje stack."
+        },
+        {
+          "steps": {
+            "items": [
+              {
+                "title": "Proxmox VE anropar pre-start",
+                "body": "Innan CT startar körs kroken med sin VMID och livscykelfasen."
+              },
+              {
+                "title": "Ett lås per stack",
+                "body": "<code>flock</code> på <code>/run/lock/proxmenux-stack-VMID.lock</code> förhindrar två startsekvenser samtidigt."
+              },
+              {
+                "title": "Kontraktet läses och valideras",
+                "body": "Ett känt schema, numeriska beroenden, etiketter, en exec, http eller kör kontroll och en positiv timeout krävs."
+              },
+              {
+                "title": "Beroende i ordning",
+                "body": "Varje CT måste finnas; en stoppad startas och en som redan körs inte startas om."
+              },
+              {
+                "title": "Vänta tills tjänsten är redo",
+                "body": "Kontrollen körs vartannat sekund, och CT bekräftas också vara igång."
+              },
+              {
+                "title": "Huvud CT startar",
+                "body": "När alla beroenden är redo avslutas pre-start och Proxmox VE startar programmet."
+              }
+            ]
+          }
+        },
+        {
+          "calloutInfo": {
+            "title": "Kroken stoppar inte beroenden",
+            "body": "Faserna post-start, pre-stop och post-stop gör ingenting. Om huvud-CT:n stoppas fortsätter PostgreSQL, Redis, Valkey eller maskininlärningen att köras. Hooken ordnar starten; den gör inte flera LXC:er till en process."
+          }
+        },
+        {
+          "table": {
+            "headers": [
+              "Typ",
+              "Exempel",
+              "Senare starter"
+            ],
+            "rows": [
+              [
+                "Beroende stack",
+                "Immich, Nextcloud, applikation med PostgreSQL",
+                "Huvud-CT:ns hook startar beroendena och väntar på dem"
+              ],
+              [
+                "Applikationssvit",
+                "Arr-programsviten",
+                "Ingen huvudmedlem: varje LXC följer sin egen <code>onboot</code>"
+              ],
+              [
+                "Enskilt program",
+                "Jellyfin",
+                "Proxmox VE startar den LXC:n direkt"
+              ]
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "stack-checks",
+      "title": "5. Kontroller på stacken som helhet",
+      "blocks": [
+        {
+          "list": {
+            "items": [
+              "Varje VMID finns, är unik och håller den förväntade instansidentiteten.",
+              "Varje kontrakt tillhör samma stack och behåller sin roll och registrerade inbyggda konfiguration.",
+              "Huvudmedlemmen är senast i <code>start_order</code> och först i <code>stop_order</code>.",
+              "Ingen medlem, volym eller rootfs anpassning saknas.",
+              "Kroken pekar på den officiella snippet, dess innehåll är oförändrat och dess kontrakt matchar stack receptet.",
+              "De observerade avbildningarna och digestvärdena matchar de förberedda OCI-arkiven.",
+              "Enheter, GPU-profiler, monteringar, hemligheter och ändpunkter matchar fortfarande kontrakten.",
+              "När alla beroenden har klarat kontrollerna verifierar huvudprogrammets ändpunkt integrationen mellan medlemmarna."
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "manage",
+      "title": "Hantera en installerad stack",
+      "intro": "Under <strong>Hantera installerade OCI-program</strong> leder varje medlem till hela stacken. Menyn erbjuder <strong>Uppdatera alla programmets containrar</strong>, <strong>Ändra extra sökvägar och enheter</strong>, <strong>Återskapa alla containrar med sparad konfiguration</strong> och <strong>Ta bort: radera programmet och dess containrar</strong>. Återskapa bygger om varje container från dess ursprungliga avbildning med sparad digest, utan att leta efter en nyare. Samma steg som vid en uppdatering används; alternativet erbjuds för stackar som kan uppdateras.",
+      "blocks": [
+        {
+          "steps": {
+            "items": [
+              {
+                "title": "Alla medlemmar",
+                "body": "Medlemmens kontrakt anger huvud-VMID och den fullständiga listan över medlemmar."
+              },
+              {
+                "title": "Stacken är reproducerbar",
+                "body": "Identiteter, kontrakt, krok, anpassningar och en samordnad replay för det receptet valideras."
+              },
+              {
+                "title": "Avbildningar först",
+                "body": "Programmet stoppas inte förrän varje digest har fastställts, hämtats och verifierats."
+              },
+              {
+                "title": "Stoppa och backa upp setet",
+                "body": "Verifierade inbyggda säkerhetskopior tas när stacken är stoppad, så att program och databaser motsvarar samma tidpunkt."
+              },
+              {
+                "title": "Uppdatera och kontrollera varje medlem",
+                "body": "Anpassning, nätverk, fästen, hemligheter och enheter appliceras igen innan hälsokontrollen av varje medlem."
+              },
+              {
+                "title": "Publicera eller återställa allt",
+                "body": "De nya kontrakten publiceras endast när varje medlem passerar. Om man misslyckas återställs varje medlem."
+              }
+            ]
+          }
+        },
+        {
+          "table": {
+            "headers": [
+              "Ändra",
+              "Vilka förändringar",
+              "Vad som behålls"
+            ],
+            "rows": [
+              [
+                "Extra sökvägar och enheter",
+                "De läggs till eller tas bort från applikationsbehållaren, som startar om. Ingenting byggs om",
+                "Uppgifterna för programmet, dess databas och andra containrar"
+              ],
+              [
+                "Vad som kör igenkänningen (Immich)",
+                "Maskininlärningsbehållaren tar avbildningen och enheterna i CPU eller en GPU av värden. Hela programmet stoppas och uppdateras, som i en uppdatering",
+                "Modellcachen, biblioteket och databasen. Om något misslyckas, återställs tidigare containrar och tidigare val"
+              ]
+            ]
+          }
+        },
+        {
+          "calloutWarning": {
+            "title": "En stack utan samordnad replay uppdateras inte",
+            "body": "Om beredningen av en stack inte kan reproduceras vägras uppdateringen innan stacken stoppas. Applikationen fortsätter att fungera som det är."
+          }
+        }
+      ]
+    },
+    {
+      "id": "failure",
+      "title": "6. När något misslyckas",
+      "blocks": [
+        {
+          "p": "Under en installation stannar ett fel och tar bort de ofullständiga containrarna som skapats och den privata broen om operationen skapade den. En stack publiceras inte som giltig tills hela sekvensen avslutas."
+        },
+        {
+          "p": "En uppdatering är transaktionell: alla avbildningar är förberedda först, sedan stacken stannar, varje medlem backas upp och backup verifieras, och först då är varje rootfs ersatt. Medlemmar startar en efter en med sin hälsokontroll; om man misslyckas återställs varje medlem från samma uppsättning säkerhetskopior, så databasen och programmet hör aldrig till olika ögonblick."
+        },
+        {
+          "mermaid": {
+            "chartCode": "flowchart LR\n P[\"{{prepare}}\"] --> S[\"{{stop}}\"]\n S --> B[\"{{backup}}\"]\n B --> R[\"{{replace}}\"]\n R --> H{\"{{healthy}}\"}\n H -- \"{{yes}}\" --> C[\"{{commit}}\"]\n H -- \"{{no}}\" --> X[\"{{rollback}}\"]",
+            "labels": {
+              "prepare": "Förbered varje avbildning",
+              "stop": "Sluta, huvudmedlem först",
+              "backup": "Verifierad säkerhetskopia av varje CT",
+              "replace": "Ersätt rootfs",
+              "healthy": "Fungerar alla?",
+              "yes": "Ja",
+              "no": "Nej",
+              "commit": "Publicera avtal",
+              "rollback": "Återställ varje medlem"
+            }
+          }
+        }
+      ]
+    },
+    {
+      "id": "not-assumed",
+      "title": "Vad en stack inte inkluderar",
+      "blocks": [
+        {
+          "list": {
+            "items": [
+              "En svit installerad i ett flöde, till exempel Arr-sviten, är inte en beroende stack: dess containrar har ingen startordning mellan dem.",
+              "Det privata nätverket ersätter inte autentisering, TLS eller konfigurationen av varje applikation.",
+              "Säkerhetskopieringen av en LXC innehåller inte bron, kroken eller kontrakten i resten av stacken.",
+              "Prowlarr, Sonarr eller Radarr får inga indexerare, profiler eller leverantörer från ProxMenux."
+            ]
+          }
+        }
+      ]
+    }
+  ]
+}
diff --git a/web/messages/sv/docs/oci-manager/storage-network.json b/web/messages/sv/docs/oci-manager/storage-network.json
new file mode 100644
index 00000000..db121e93
--- /dev/null
+++ b/web/messages/sv/docs/oci-manager/storage-network.json
@@ -0,0 +1,305 @@
+{
+  "meta": {
+    "title": "Data, sökvägar och nätverk | ProxMenux",
+    "description": "Så bevarar OCI manager Apps data i en OCI-container: containerdiskar, kataloger på värden, rclone-monteringar, adresser och privata nätverk."
+  },
+  "header": {
+    "title": "Data, sökvägar och nätverk",
+    "description": "Vad som finns i rootfs, vad som bevaras när det ersätts, hur data delas mellan containrar och hur varje container får sin adress.",
+    "section": "OCI manager Apps"
+  },
+  "sections": [
+    {
+      "id": "intro",
+      "blocks": [
+        {
+          "calloutInfo": {
+            "title": "Beständig lagring bestäms innan LXC-containern skapas",
+            "body": "Volymerna som deklareras av avbildningen och dess Compose-fil läses innan containern skapas. Varje sökväg som måste bevaras vid en uppdatering blir en monteringspunkt som är oberoende av rootfs. Därmed innehåller rootfs bara det som tillhör avbildningen och kan ersättas."
+          }
+        }
+      ]
+    },
+    {
+      "id": "questions",
+      "title": "Vad installationsguiden frågar efter",
+      "intro": "Mallen anger de sökvägar som programmet behöver. Var och en placeras på en containerdisk eller i en katalog på värden. Fler sökvägar kan läggas till före sammanfattningen.",
+      "blocks": [
+        {
+          "steps": {
+            "items": [
+              {
+                "title": "Nödvändiga sökvägar",
+                "body": "<code>/config</code>, <code>/data</code>, bibliotek, hämtningar och alla volymer som programmet deklarerar listas."
+              },
+              {
+                "title": "Plats",
+                "body": "Varje sökväg placeras på en containerdisk eller i en befintlig katalog på värden."
+              },
+              {
+                "title": "Lagring och storlek",
+                "body": "En containerdisk skapas på en Proxmox VE-lagring med den angivna storleken. Standardinstallationen använder <code>local-lvm</code>. Den avancerade installationen frågar efter lagring för varje sökväg strax före storleken och föreslår lagringen för rootfs. Disken visas som <code>vm-VMID-disk-N</code> och ansluts som <code>mpN</code>."
+              },
+              {
+                "title": "Katalog på värden",
+                "body": "Katalogen på värden anges med sin sökväg. Om den inte finns skapas den med den värdanvändare som containeranvändaren mappas till som ägare."
+              },
+              {
+                "title": "Ytterligare sökvägar",
+                "body": "Före installationen kan fler kopplingar läggas till mellan en sökväg eller volym på värden och en sökväg i containern."
+              },
+              {
+                "title": "Sammanfattning",
+                "body": "Hela sökvägsmappningen visas innan CT:n skapas och sparas i instanskontraktet."
+              }
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "options",
+      "title": "De två platserna för beständig lagring",
+      "blocks": [
+        {
+          "table": {
+            "headers": [
+              "Egenskap",
+              "Containerdisk",
+              "Katalog på värden"
+            ],
+            "rows": [
+              [
+                "I konfigurationen",
+                "<code>mpN: STORAGE:vm-VMID-disk-N,mp=/config,backup=1,size=16G</code>",
+                "<code>mpN: /mnt/oci-shared/media,mp=/data/media</code>"
+              ],
+              [
+                "Containerns säkerhetskopia (vzdump)",
+                "Ingår med <code>backup=1</code>",
+                "Ingår inte"
+              ],
+              [
+                "Storlek",
+                "Fast; kan utökas genom att ändra monteringspunktens storlek",
+                "Det lediga utrymmet i värdens filsystem eller dataset"
+              ],
+              [
+                "Andra containrar",
+                "Monteras bara av den container som den tillhör",
+                "Samma katalog kan monteras i flera containrar"
+              ],
+              [
+                "Ögonblicksbilder och återställning",
+                "Hanteras av Proxmox VE tillsammans med CT:n",
+                "Hanteras på värdens lagring"
+              ],
+              [
+                "När programmet tas bort",
+                "Tas bort med containern",
+                "Bevaras med sitt innehåll"
+              ],
+              [
+                "När CT:n flyttas till en annan nod",
+                "Flyttas med CT:n",
+                "Samma sökväg måste finnas på den andra noden"
+              ]
+            ]
+          }
+        },
+        {
+          "p": "Rootfs är reserverat för binärfilerna och avbildningens innehåll. En uppdatering eller ett återskapande ersätter det utan att röra någon av de två typerna av monteringspunkt."
+        }
+      ]
+    },
+    {
+      "id": "example",
+      "title": "Exempel: en container med båda platserna",
+      "blocks": [
+        {
+          "code": {
+            "title": "Jellyfin installerat som CT 151 på local-lvm (utdrag)",
+            "code": "rootfs: local-lvm:vm-151-disk-0,size=8G\n# Container disk, part of the CT backup\nmp0: local-lvm:vm-151-disk-1,mp=/config,backup=1,size=16G\n\n# Host directory, outside the CT backup\nmp1: /mnt/oci-shared/media,mp=/data/media"
+          }
+        },
+        {
+          "p": "En uppdatering eller ett återskapande ersätter bara rootfs: <code>mp0</code> bevarar användare, bibliotek och inställningar, och <code>mp1</code> visar fortfarande samma medier. När CT:ns säkerhetskopia återställs kommer <code>/config</code> tillbaka. Mediekatalogen återställs vid behov från säkerhetskopian av värdens lagring."
+        },
+        {
+          "flow": {
+            "nodes": [
+              {
+                "label": "Kontrakt",
+                "detail": "/config"
+              },
+              {
+                "label": "Plats",
+                "detail": "Containerdisk\neller katalog på värden"
+              },
+              {
+                "label": "LXC",
+                "detail": "Alltid /config\nför programmet"
+              }
+            ],
+            "caption": "Programmet ser sökvägen som avbildningen anger. Bara lagringsplatsen ändras."
+          }
+        }
+      ]
+    },
+    {
+      "id": "shared",
+      "title": "En katalog på värden, flera containrar",
+      "blocks": [
+        {
+          "mermaid": {
+            "chartCode": "flowchart TB\n H[\"{{host}}<br/>/mnt/oci-shared/media\"]\n H --> Q[\"qBittorrent<br/>/data\"]\n H --> J[\"Jellyfin<br/>/data\"]\n H --> R[\"Radarr / Sonarr<br/>/data\"]\n Q -. \"{{config}}\" .-> QV[(\"/config mpN\")]\n J -. \"{{config}}\" .-> JV[(\"/config mpN\")]\n R -. \"{{config}}\" .-> RV[(\"/config mpN\")]",
+            "labels": {
+              "host": "Katalog på värden",
+              "config": "Egen konfiguration"
+            }
+          }
+        },
+        {
+          "p": "Varje container sparar sin konfiguration på sin egen disk. Biblioteket eller hämtningarna ligger i en enda katalog på värden som monteras på samma interna sökväg i alla containrar. Därmed är sökvägen som ett program skriver till samma sökväg som ett annat läser från."
+        }
+      ]
+    },
+    {
+      "id": "rclone",
+      "title": "Molnlagring via programmet rclone",
+      "intro": "Utöver installation erbjuder rclone-posten i katalogen <strong>Aktivera en montering i en befintlig OCI-container med rclone</strong>. En fjärrlagring som redan skapats och auktoriserats i rclones webbgränssnitt monteras och görs tillgänglig på värden. Andra containrar kan använda den som en katalog på värden.",
+      "blocks": [
+        {
+          "steps": {
+            "items": [
+              {
+                "title": "Container och fjärrlagring",
+                "body": "VMID för rclone-containern, fjärrlagringens exakta namn och, valfritt, en sökväg i den."
+              },
+              {
+                "title": "Monteringens namn och cache",
+                "body": "Monteringens namn och VFS-cacheläget: <code>off</code>, <code>minimal</code>, <code>writes</code> eller <code>full</code> (standard)."
+              },
+              {
+                "title": "Tillgängliga vyer",
+                "body": "En gemensam rot, som standard <code>/mnt/oci-shared</code>, innehåller en läs- och skrivbar vy i <code>/mnt/oci-shared/remotes/NAME</code> och en skrivskyddad vy i <code>/mnt/oci-shared/remotes-ro/NAME</code>."
+              },
+              {
+                "title": "Aktivering",
+                "body": "Efter bekräftelsen stoppas CT:n, dess startkommando och ett Proxmox VE-hookscript konfigureras, och den startas igen. Åtgärden väntar tills båda vyerna är monterade på värden."
+              }
+            ]
+          }
+        },
+        {
+          "calloutInfo": {
+            "title": "Om monteringen inte aktiveras",
+            "body": "Containerns tidigare konfiguration återställs och containern startas igen. En misslyckad aktivering lämnar därmed rclone som det var."
+          }
+        }
+      ]
+    },
+    {
+      "id": "network",
+      "title": "Adresser och nätverk",
+      "intro": "Ett program med en enda container behöver en adress. Ett program med flera containrar behöver också ett stabilt nätverk mellan sina delar.",
+      "blocks": [
+        {
+          "cards": {
+            "items": [
+              {
+                "icon": "network",
+                "title": "Program med en container",
+                "body": "En nätverksbrygga väljs tillsammans med DHCP eller en fast adress i CIDR-format. LXC-containern har en egen adress och sammanfattningen visar tjänsternas fullständiga URL:er."
+              },
+              {
+                "icon": "waypoints",
+                "title": "Program med flera containrar",
+                "body": "Ett ledigt subnät hittas och en beständig privat brygga skapas. Varje del – program, databas och cache – får en fast adress på nätverket."
+              }
+            ]
+          }
+        },
+        {
+          "flow": {
+            "nodes": [
+              {
+                "label": "LAN",
+                "detail": "Nåbar adress\nbara huvudtjänsten"
+              },
+              {
+                "label": "Huvud-LXC",
+                "detail": "Webb / API\nLAN + privat nätverk"
+              },
+              {
+                "label": "Privat nätverk",
+                "detail": "PostgreSQL · Valkey · ML\nfasta adresser"
+              }
+            ],
+            "caption": "Beroenden kommunicerar över det privata nätverket och har ingen adress på LAN:et."
+          }
+        },
+        {
+          "p": "Stackkontraktet sparar brygga, subnät, adresser och relationerna mellan tjänsterna. När programmet uppdateras återanvänds samma topologi för alla delar. ProxMenux Monitor öppnar huvudcontainern på dess LAN-adress, inte dess adress på det privata nätverket."
+        }
+      ]
+    },
+    {
+      "id": "ownership",
+      "title": "Ägarskap för filer och kataloger",
+      "blocks": [
+        {
+          "list": {
+            "items": [
+              "Nya kataloger skapas med de UID och GID som den oprivilegierade LXC-containern mappas till.",
+              "Ägarskapet för befintliga kataloger ändras inte rekursivt.",
+              "Socklar, systemfiler och känsliga sökvägar erbjuds inte som vanliga kataloger på värden."
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "backup",
+      "title": "Vad en säkerhetskopia av containern innehåller",
+      "blocks": [
+        {
+          "table": {
+            "headers": [
+              "Del",
+              "I CT:ns vzdump-säkerhetskopia",
+              "Var det sparas"
+            ],
+            "rows": [
+              [
+                "OCI-rootfs",
+                "Ja",
+                "I CT:ns säkerhetskopia; kan också återskapas från avbildningen och kontraktet"
+              ],
+              [
+                "Containerdisk med <code>backup=1</code>",
+                "Ja",
+                "CT:ns säkerhetskopia"
+              ],
+              [
+                "Katalog på värden",
+                "Nej",
+                "Säkerhetskopian av värdens lagring"
+              ],
+              [
+                "Instanskontrakt",
+                "Ja, kopian som finns i CT:n",
+                "<code>/.proxmenux/oci-record.json</code> i CT:n; ytterligare kopior på värden och i klustret sparas separat"
+              ],
+              [
+                "Program med flera containrar",
+                "Varje del i sin egen säkerhetskopia",
+                "Säkerhetskopiorna av alla delar samt stackkontraktet och dess nätverksbrygga på värden"
+              ]
+            ]
+          }
+        }
+      ]
+    }
+  ]
+}
diff --git a/web/messages/sv/docs/post-install/automated.json b/web/messages/sv/docs/post-install/automated.json
new file mode 100644
index 00000000..c3fc9aa6
--- /dev/null
+++ b/web/messages/sv/docs/post-install/automated.json
@@ -0,0 +1,172 @@
+{
+  "meta": {
+    "title": "Automatiserat efterinstallationsskript | ProxMenux Dokumentation",
+    "description": "ProxMenux automatiserade efterinstallationsskript kör 14 förvalda optimeringar anpassade efter hårdvaran på en ny Proxmox VE-värd. Det saknar checklista för funktionsval men kan be om bekräftelse för systemuppdateringen, prenumerationsvarningen, vissa Log2RAM-installationer och omstart. Återställbara konfigurationsändringar registreras.",
+    "ogTitle": "Automatiserat efterinstallationsskript | ProxMenux Dokumentation",
+    "ogDescription": "14 fasta, hårdvaruanpassade optimeringar för en ny Proxmox VE-värd, med bekräftelse för vissa åtgärder och registrering av återställbara ändringar."
+  },
+  "header": {
+    "title": "Automatiserat efterinstallationsskript",
+    "description": "ProxMenux kör 14 förvalda grundoptimeringar utan checklista för funktionsval. Vissa åtgärder kräver bekräftelse. Återställbara konfigurationsändringar registreras för Avinstallera optimeringar; paketuppgraderingar beskrivs inte som återställbara.",
+    "section": "Post-Install · Automatiserad"
+  },
+  "intro": {
+    "title": "När du ska välja automatiserad efterinstallation",
+    "body": "Kör detta på en nyinstallerad Proxmox-värd när du vill ha den vettiga baslinjen utan att ta beslut. Skriptet är idempotent - att köra det två gånger är säkert, det tillämpar bara samma konfigurationer igen. Opt-in-funktioner (Fastfetch, IOMMU, Ceph repo, HA, AMD-fixar...) är avsiktligt <strong>inte</strong> en del av denna väg; välj dem från <link>Anpassningsbara</link> om du behöver dem."
+  },
+  "applies": {
+    "heading": "Vad skriptet tillämpar",
+    "intro": "Optimeringarna tillämpas i exakt denna ordning. Kolumnen <em>Kategori</em> länkar till utförlig dokumentation om varje ändring i den anpassningsbara efterinstallationen.",
+    "headerNum": "#",
+    "headerTool": "Verktyg",
+    "headerWhat": "Vad det gör",
+    "headerCategory": "Kategori"
+  },
+  "optimizations": [
+    {
+      "tool": "APT-repositorier + full uppgradering",
+      "what": "Inaktiverar företagsförråden pve-enterprise.sources och ceph.sources, skriver en no-subscription-källa för värdens Debian-kodnamn och kör sedan apt update && apt full-upgrade -y, Proxmox officiella uppgraderingskommando.",
+      "category": "Grundinställningar",
+      "categorySlug": "basic-settings"
+    },
+    {
+      "tool": "Borttagning av prenumerationsvarning",
+      "what": "Ändrar webbgränssnittet för att dölja varningen ”Ingen giltig prenumeration”. Ber om bekräftelse före ändringen; kan återställas via Avinstallera optimeringar.",
+      "category": "Anpassning",
+      "categorySlug": "customization"
+    },
+    {
+      "tool": "Tvinga IPv4",
+      "what": "Skriver /etc/apt/apt.conf.d/99-force-ipv4 så att apt bara använder IPv4 och kringgår instabila IPv6-anslutningar till speglar.",
+      "category": "Nätverk",
+      "categorySlug": "network"
+    },
+    {
+      "tool": "Hoppa över språkpaket",
+      "what": "Skriver /etc/apt/apt.conf.d/99-disable-translations för att sluta hämta index över översatta paketbeskrivningar och minska datamängden vid apt-uppdateringar.",
+      "category": "Grundinställningar",
+      "categorySlug": "basic-settings"
+    },
+    {
+      "tool": "Öka systemgränserna",
+      "what": "Höjer antalet inotify-bevakningar, nofile/nproc-gränser, kärnans nyckelringsgränser och fs.file-max via sysctl.d, limits.d, pam och systemd för värdar med många containrar.",
+      "category": "System",
+      "categorySlug": "system"
+    },
+    {
+      "tool": "Minnesjustering",
+      "what": "Sätter vm.swappiness=10, balanserade andelar ändrade men ännu inte skrivna minnessidor, vm.max_map_count=262144 och proaktiv minneskompaktering när det stöds. Kärnans policy för minnesöverallokering behåller Proxmox standardvärde.",
+      "category": "System",
+      "categorySlug": "system"
+    },
+    {
+      "tool": "Beteende vid kärnpanik",
+      "what": "Konfigurerar värden för att starta om 10 sekunder efter en panik / oops / hardlockup istället för att frysa på obestämd tid.",
+      "category": "System",
+      "categorySlug": "system"
+    },
+    {
+      "tool": "Justering av nätverksstacken",
+      "what": "TCP-buffertstorlekar, IPv4-härdning (omdirigeringar av, rp_filter=2, martian-loggning av), lokala portar 1024-65535, TCP MTU-avkänning, RFC 1337 och hjälpskriptet /usr/local/sbin/proxmenux-fwbr-tune kopplat till en engångsenhet i systemd och en udev-regel. Därmed återställs rp_filter=0 / log_martians=0 på fwbr*/fwln*/fwpr*/tap* varje gång Proxmox återskapar dem när VM:ar startas/stoppas, vid omstart eller livemigrering.",
+      "category": "Nätverk",
+      "categorySlug": "network"
+    },
+    {
+      "tool": "Anpassning av bashrc (root)",
+      "what": "Färgad PS1, vanliga alias (l/la/ll/ls/grep), tidsstämplad historik och inläsning av bash-completion, allt i ett avgränsat PMX_CORE_BASHRC-block som är lätt att ta bort.",
+      "category": "Anpassning",
+      "categorySlug": "customization"
+    },
+    {
+      "tool": "Log2RAM (SSD-medveten, auto)",
+      "what": "Minskar SSD-/NVMe-slitage genom att flytta /var/log till en tmpfs-ramdisk med regelbunden synkronisering till disk. Installation från ursprungsprojektet när rotdisken är SSD eller NVMe. Storlek efter värdens RAM (128M / 256M / 512M), periodisk synkronisering och skydd som rensar äldre journaler vid 80% fyllnadsgrad och trunkerar snabbt växande loggar vid 92% före skrivning. Anpassar journald-gränser till ramdisken. Detaljer på <link>Log2RAM</link>.",
+      "category": "Lagring",
+      "categorySlug": "storage"
+    },
+    {
+      "tool": "ZFS autotrim (endast SSD)",
+      "what": "Aktiverar zpool autotrim=on för varje ZFS-pool där alla vdevs är SSD- eller NVMe-enheter med TRIM-stöd. Kontrollerar /sys/block/[dev]/queue/rotational och discard_granularity. Pooler med hårddiskar hoppas över. Endast pooler som ProxMenux faktiskt ändrar registreras för återställning vid avinstallation; manuellt aktiverad autotrim lämnas oförändrad.",
+      "category": "Lagring",
+      "categorySlug": "storage"
+    },
+    {
+      "tool": "Journald storleksgränser",
+      "what": "Tvingar beständig lagring, begränsar SystemMaxUse=64M / RuntimeMaxUse=60M och aktiverar komprimering och info-loggning som Monitor behöver. Hoppas över när Log2RAM är aktivt eftersom det gör sin egen justering.",
+      "category": "System",
+      "categorySlug": "system"
+    },
+    {
+      "tool": "Justering av logrotate",
+      "what": "Sätter globalt daily följt av size 10M, sparar 7 rotationer och aktiverar komprimering och copytruncate. Det senare storleksvillkoret får företräde; enskilda loggregler kan åsidosätta det. Lämpligt för Log2RAM men frekvensen beror på regler och timer.",
+      "category": "System",
+      "categorySlug": "system"
+    },
+    {
+      "tool": "Beständiga gränssnittsnamn",
+      "what": "Skriver en <code>/etc/systemd/network/10-proxmenux-&lt;iface&gt;.link</code> per fysiskt nätverkskort med rubriken ”Managed by ProxMenux” som binder MAC till aktuellt namn. Namn som <code>eth0</code> / <code>enp…</code> förblir stabila efter omstarter och nya nätverkskort.",
+      "category": "Nätverk",
+      "categorySlug": "network"
+    }
+  ],
+  "hardwareTitle": "Hårdvaruanpassade standardvärden",
+  "hardwareBody": "Skriptet läser värdhårdvaran innan inställningar tillämpas. Log2RAM är bara installerat på SSD / NVMe rotdiskar som standard (den frågar om upptäckten säger något annat). Log2RAM ramdiskstorlek väljs från totalt RAM (<code>≤ 8 GB → 128M</code>, <code>≤ 16 GB → 256M</code>, <code>'>' 16 GB → 512M</code>). De journald gränser matchas till ramdiskstorleken när Log2RAM är aktivt, för att undvika att fylla det.",
+  "upgrade": {
+    "heading": "Uppdatera och uppgradera systemet",
+    "intro": "Det första steget i Automated-paketet är Proxmox-uppgraderingen. Proxmox egen uppgraderingsvägledning för en löpande värd (inom samma stora version) är att köra:",
+    "after": "Denna rad är det officiella kommandot för aktuella Proxmox-versioner. Skriptet kör <strong>exakt</strong> detta och lägger till förrådsstädning och efterarbete enligt uppgraderingsguiden — samma steg som det fristående verktyget <link>Proxmox systemuppdatering</link>:",
+    "items": [
+      "Inaktiverar Enterprise-källorna <code>pve-enterprise.sources</code> / <code>ceph.sources</code>, tar bort äldre förrådsfiler och skriver en no-subscription-källa för värdens kodnamn.",
+      "Kör uppgraderingen utan interaktion med <code>DEBIAN_FRONTEND=noninteractive</code> och <code>--force-confdef --force-confold</code>. Anpassade konfigurationsfiler behålls även när de har ändrats i ursprungsprojektet.",
+      "Installerar viktiga Proxmox-paket om de saknas (<code>zfsutils-linux</code>, <code>proxmox-backup-restore-image</code>, <code>chrony</code>).",
+      "Kontroll av LVM-metadatas rimlighet, <code>apt-get autoremove -y</code> + <code>apt-get autoclean -y</code> och omstartsfråga bara om kärnan faktiskt ändrats."
+    ],
+    "sameTitle": "Samma uppdaterare, två ingångspunkter",
+    "sameBody": "Automatiserad bunt och fristående <link>Proxmox System Update</link>-verktyget delar samma underliggande skript (<code>update-pve8.sh</code> / <code>update-pve9_2.sh</code>). Använd verktyget på egen hand när du bara vill uppgradera värden utan att tillämpa resten av optimeringarna."
+  },
+  "endResult": {
+    "heading": "Förväntat slutresultat",
+    "body": "När skriptet är klart visas ett framgångsmeddelande med utdata från varje steg och en fråga om omstart, eftersom vissa kärninställningar kräver det. Du kan skjuta upp omstarten; inställningarna gäller vid nästa start.",
+    "imageAlt": "Automatiserat efterinstallationsskript — slutlig terminalutdata med varje optimering genomförd"
+  },
+  "notDoes": {
+    "heading": "Vad skriptet INTE gör",
+    "items": [
+      "Automatisk tidszonsidentifiering (bortkommenterad i källskriptet; använd Anpassningsbar om du vill ha den).",
+      "Inaktivera portmapper / rpcbind (se <secLink>Säkerhet</secLink>).",
+      "Aktivera IOMMU / VFIO (se <virtLink>Virtualisering</virtLink>).",
+      "Installera Fastfetch / Figurine / Ceph-förråd / HA / AMD-CPU-korrigeringar (se <optLink>Valfritt</optLink>).",
+      "Installera pigz eller justera ZFS ARC (se <perfLink>Prestanda</perfLink> / <storLink>Lagring</storLink>)."
+    ]
+  },
+  "xshokTitle": "xshok-proxmox detektering",
+  "xshokBody": "Om värden redan har kört skriptet <code>xshok-proxmox</code> upptäcker ProxMenux markörfilen och varnar innan du fortsätter. Vissa ändringar kan överlappa. Kompanjonskriptet är föråldrat; om du ändå fortsätter, läs <link>översikten</link> för sammanhang.",
+  "revert": {
+    "heading": "Revertering",
+    "body": "Varje verktyg i tabellen registreras i <code>/usr/local/share/proxmenux/installed_tools.json</code>. Öppna <link>Avinstallera optimeringar</link> och välj vilka delar som ska återställas. Kopior av ändrade konfigurationsfiler ligger bredvid originalen med suffixet <code>.bak</code>."
+  },
+  "related": {
+    "heading": "Relaterat",
+    "items": [
+      {
+        "label": "Anpassningsbar efterinstallation",
+        "href": "/docs/post-install/customizable",
+        "tail": " — Välj exakt vad du vill ha från samma katalog."
+      },
+      {
+        "label": "Avinstallera optimeringar",
+        "href": "/docs/post-install/uninstall",
+        "tail": " — återställ valfria delar av ändringarna som gjorts här."
+      },
+      {
+        "label": "Användbara systemkommandon",
+        "href": "/docs/help-info/system-commands",
+        "tail": " — verifiera ändringarna (uptime, free, journalctl osv.)."
+      },
+      {
+        "label": "Översikt över efterinstallation",
+        "href": "/docs/post-install",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sv/docs/post-install/basic-settings.json b/web/messages/sv/docs/post-install/basic-settings.json
new file mode 100644
index 00000000..44a4b929
--- /dev/null
+++ b/web/messages/sv/docs/post-install/basic-settings.json
@@ -0,0 +1,240 @@
+{
+  "meta": {
+    "title": "Post-Install: Grundläggande inställningar | ProxMenux Dokumentation",
+    "description": "Grundalternativ efter installationen: byt till Proxmox paketförråd utan prenumeration och uppgradera, identifiera tidszon och aktivera NTP, hoppa över APT-översättningar och välj bland 25 vanliga systemverktyg att installera."
+  },
+  "header": {
+    "title": "Post-Install: Grundläggande inställningar",
+    "section": "Inställningar efter installation av Proxmox"
+  },
+  "intro": {
+    "title": "Vad denna kategori täcker",
+    "body": "Fem grundval för en ny Proxmox-värd: byt till gemenskapens paketförråd utan prenumeration, uppgradera hela systemet, konfigurera tidszon och NTP automatiskt, stäng av APT-översättningar för att spara bandbredd och diskutrymme och välj bland 25 vanliga verktyg."
+  },
+  "upgrade": {
+    "heading": "Uppdatera och uppgradera systemet",
+    "intro": "Ställer om APT till det kostnadsfria förrådet <em>pve-no-subscription</em> i stället för Enterprise-förrådet som kräver prenumeration och uppgraderar hela systemet. Stegen beror på huvudversionen av Proxmox VE; ProxMenux identifierar den och startar rätt skript.",
+    "headerVersion": "PVE-version",
+    "headerScript": "Fördelningsskript",
+    "headerCodename": "Debians kodnamn",
+    "rows": [
+      {
+        "version": "9.x",
+        "script": "update-pve9_2.sh",
+        "codename": "trixie"
+      },
+      {
+        "version": "8.x",
+        "script": "update-pve8.sh",
+        "codename": "bookworm"
+      }
+    ],
+    "officialTitle": "Den officiella Proxmox rekommendation",
+    "officialBody": "Proxmox egna uppgraderingsvägledning är att köra i denna exakta ordning:",
+    "officialOutro": "Detta är det vanliga kommandot för uppdateringar inom den installerade huvudversionen av Proxmox VE. Kontrollera paketförråden och de föreslagna paketändringarna <em>innan</em> du fortsätter. Byte av huvudversion kräver den officiella migreringsproceduren.",
+    "doesTitle": "Vad ProxMenux-alternativet gör - verifierad mot skriptet",
+    "doesIntro": "ProxMenux-uppdateraren kör apt-kommandona ovan och lägger till för- och eftersteg som du annars behöver hantera manuellt. Punkterna nedan motsvarar vad versionsskriptet gör; se <link>Proxmox systemuppdatering</link> för hela beskrivningen.",
+    "doesItems": [
+      "<strong>Städa först i paketarkiven.</strong> Inaktiverar Enterprise-källorna <code>pve-enterprise.sources</code> / <code>ceph.sources</code>, tar bort gamla arkivfiler från tidigare PVE-versioner och skriver en ren <code>proxmox.sources</code> som pekar på den kostnadsfria kanalen <em>pve-no-subscription</em>, anpassad till värdens Debian-kodnamn: trixie för PVE 9, bookworm för PVE 8.",
+      "<strong>Skriver om Debians paketförråd</strong> med main / updates / security och <code>non-free-firmware</code>, så att firmwarevarningen vid uppgradering försvinner.",
+      "<strong>Kör den officiella uppgraderingen.</strong> <code>apt-get update</code> följt av <code>apt full-upgrade -y</code> (PVE 9) eller <code>apt dist-upgrade -y</code> (PVE 8), båda utan interaktion med <code>--force-confdef --force-confold</code> för att behålla anpassade konfigurationsfiler.",
+      "<strong>Installerar viktiga paket</strong> om de saknas: <code>zfsutils-linux</code>, <code>proxmox-backup-restore-image</code>, <code>chrony</code>.",
+      "<strong>Kontrollerar LVM-metadata.</strong> Söker efter VM:ar med diskgenomkoppling som kan ha lämnat gamla fysiska volymhuvuden på rådiskar. Varnar vid avvikelser utan automatisk åtgärd.",
+      "<strong>Rengör efteråt:</strong> <code>apt-get autoremove -y</code> + <code>apt-get autoclean -y</code>, sedan uppmanar till en omstart om kärnan uppdaterades eller <code>/var/run/reboot-required</code> är närvarande."
+    ],
+    "shortTitle": "Kort sagt",
+    "shortBody": "Alternativet kör rekommenderade <code>apt update && apt full-upgrade -y</code>, lägger till förråds- och efterstädning som beskrivs i den officiella guiden och frågar om omstart i slutet. Se <link>Proxmox systemuppdatering</link> för hela diagrammet — samma uppdaterare finns separat i huvudmenyn.",
+    "subTitle": "Tillämpa inte på en värd med prenumeration",
+    "subBody": "Om du har Proxmox-prenumeration och vill behålla Enterprise-förråden ska du hoppa över alternativet. Det stänger av Enterprise och byter till gemenskapskanalen. Paketuppgradering och omskrivning av förråd kan inte återställas via Avinstallera optimeringar; konfigurera förråden uttryckligen om du senare vill byta kanal.",
+    "safetyTitle": "Säkerhetskontroll efter uppdatering",
+    "safetyBody": "Efter uppgraderingen söker skriptet efter gamla metadata för fysiska volymer (PV) på diskar. Det kan uppstå när en VM med diskgenomkoppling skriver LVM-huvuden på en rådisk. Misstänkta fynd ger en varning med förslaget att granska med <code>pvs</code>. Inga automatiska åtgärder utförs."
+  },
+  "time": {
+    "heading": "Synkronisera tiden automatiskt",
+    "intro": "Hämtar serverns offentliga IP-adress med <code>dig myip.opendns.com @resolver1.opendns.com</code>, frågar sedan <code>ipapi.co/'{'ip'}'/timezone</code> efter motsvarande IANA-tidszon och ställer in den med <code>timedatectl set-timezone</code>. Aktiverar slutligen NTP med <code>timedatectl set-ntp true</code>.",
+    "depTitle": "Beroende på två externa tjänster",
+    "depBody": "Uppslagningen är beroende av att OpenDNS och <code>ipapi.co</code> kan nås och att deras svar är korrekta. Om du kör Proxmox bakom en VPN eller på en VLAN som avgår från en annan region, kan den automatiska upptäckta tidszonen vara fel. I det fallet hoppa över detta alternativ och ställa in tidszonen för hand:",
+    "revertTitle": "Kan återställas från Avinstallera-menyn",
+    "revertBody": "<link>Avinstallera optimeringar</link> återställer tidszonen till UTC, ett säkert standardval. NTP förblir aktivt: klockan fortsätter synkroniseras och visar UTC tills du ställer in en annan tidszon."
+  },
+  "languages": {
+    "heading": "Hoppa över nedladdning av ytterligare språk",
+    "intro": "Vid <code>apt update</code> kan APT hämta översatta paketbeskrivningar utöver huvudmetadata. Alternativet stänger av dessa för att spara bandbredd och diskutrymme. Först <strong>kontrollerar ProxMenux att värdens regionala inställning är genererad</strong>: läser <code>/etc/default/locale</code> eller <code>/etc/environment</code>, lägger till i <code>/etc/locale.gen</code> vid behov och kör <code>locale-gen</code>. Därmed behålls skalets regionala inställning.",
+    "writtenTitle": "Vad blir skrivet",
+    "revertTitle": "Kan återställas från Avinstallera-menyn",
+    "revertBody": "Ta bort <code>/etc/apt/apt.conf.d/99-disable-translations</code> (antingen manuellt eller från avinstallationsmenyn) återställer standardbeteendet och APT hämtar språkfiler igen."
+  },
+  "utilities": {
+    "heading": "Installera vanliga systemverktyg",
+    "intro": "Öppnar en grupperad lista med <strong>25 utvalda verktyg</strong>. Välj och bekräfta; ProxMenux installerar dem via <code>apt</code>, kontrollerar resultatet och visar en sammanfattning.",
+    "imageAlt": "Val av ProxMenux-systemverktyg: mellanslag väljer och Enter bekräftar",
+    "reuseTitle": "Samma lista återanvänds någon annanstans",
+    "reuseBody": "Katalogen med 25 verktyg definieras centralt: <code>PROXMENUX_UTILS</code> i <code>scripts/global/utils-install-functions.sh</code>. Menyn <em>Hjälpprogram och verktyg → Systemverktyg</em> erbjuder samma lista för senare installationer utan att köra efterinstallationen igen.",
+    "listTitle": "Vad finns i listan",
+    "groups": [
+      {
+        "group": "Systemövervakare",
+        "items": [
+          {
+            "pkg": "htop",
+            "desc": "Interaktiv processvisare"
+          },
+          {
+            "pkg": "btop",
+            "desc": "Modern resursövervakning (CPU, RAM, diskar, nät, processer)"
+          },
+          {
+            "pkg": "s-tui",
+            "desc": "Terminalgränssnitt för CPU-belastningstest och övervakning"
+          },
+          {
+            "pkg": "iftop",
+            "desc": "Bandbreddsanvändning per anslutning i realtid"
+          },
+          {
+            "pkg": "iotop",
+            "desc": "Disk-I/O per process"
+          },
+          {
+            "pkg": "iptraf-ng",
+            "desc": "Interaktiv IP-/LAN-övervakare"
+          }
+        ]
+      },
+      {
+        "group": "Nätverk",
+        "items": [
+          {
+            "pkg": "iperf3",
+            "desc": "Mät maximal uppnåelig bandbredd mellan värdar"
+          },
+          {
+            "pkg": "net-tools",
+            "desc": "Äldre verktyg (ifconfig, netstat, route). Fortfarande användbara för snabba kontroller"
+          },
+          {
+            "pkg": "ipset",
+            "desc": "Hantera stora IP-uppsättningar i kärnan - användbart med iptables/nftables-regler."
+          }
+        ]
+      },
+      {
+        "group": "Nedladdning och arkivering",
+        "items": [
+          {
+            "pkg": "axel",
+            "desc": "Resurssnål accelerator för parallella nedladdningar"
+          },
+          {
+            "pkg": "aria2",
+            "desc": "Nedladdare med flera källor och protokoll (HTTP, FTP, BitTorrent, Metalink)"
+          },
+          {
+            "pkg": "unzip",
+            "desc": "Extrahera ZIP arkiv"
+          },
+          {
+            "pkg": "zip",
+            "desc": "Skapa ZIP-arkiv"
+          },
+          {
+            "pkg": "cabextract",
+            "desc": "Packa upp Microsoft CAB-arkiv (användbart för Windows-ISO-filer)"
+          },
+          {
+            "pkg": "wimtools",
+            "desc": "Hantera Windows WIM-avbildningar (extrahera, dela, montera, tillämpa)"
+          },
+          {
+            "pkg": "genisoimage",
+            "desc": "Skapa ISO 9660-avbildningar från en katalog"
+          }
+        ]
+      },
+      {
+        "group": "Text och filer",
+        "items": [
+          {
+            "pkg": "dos2unix",
+            "desc": "Konvertera CRLF-radslut (Windows) till LF (Unix)"
+          },
+          {
+            "pkg": "grc",
+            "desc": "Allmän färgmarkering: ger syntaxmarkering åt utdata från ping, traceroute, dig, tail med flera"
+          },
+          {
+            "pkg": "plocate",
+            "desc": "Snabb filsökning (indexerad). Kör `updatedb` efter installation för att bygga indexet."
+          }
+        ]
+      },
+      {
+        "group": "Fjärråtkomst och sessioner",
+        "items": [
+          {
+            "pkg": "sshpass",
+            "desc": "SSH-lösenordsautentisering utan interaktion (användbart för skript, inte för dagligt bruk)"
+          },
+          {
+            "pkg": "tmux",
+            "desc": "Terminalmultiplexer: koppla loss sessioner, dela paneler och behåll sessioner efter frånkoppling"
+          }
+        ]
+      },
+      {
+        "group": "Hårdvara och låg nivå",
+        "items": [
+          {
+            "pkg": "msr-tools",
+            "desc": "Läs/skriv CPU-modellspecifika register (rdmsr, wrmsr)"
+          },
+          {
+            "pkg": "intel-gpu-tools",
+            "desc": "Intel GPU diagnostiska verktyg inklusive `intel_gpu_top`"
+          }
+        ]
+      },
+      {
+        "group": "Virtualisering",
+        "items": [
+          {
+            "pkg": "libguestfs-tools",
+            "desc": "Inspektera och ändra VM-diskavbildningar (virt-ls, virt-cat, guestmount…)"
+          },
+          {
+            "pkg": "chntpw",
+            "desc": "Redigera Windows SAM - användbar för återställning av lösenord på Windows VMs du ärver"
+          }
+        ]
+      }
+    ],
+    "actionTitle": "Några exempel i praktiken",
+    "noBulkTitle": "Endast ProxMenux-installerade verktyg tas bort",
+    "noBulkBody": "ProxMenux registrerar bara valda paket som inte redan var installerade. Avinstallera optimeringar rensar bort dessa paket och behåller tidigare installerade paket. APT-uppgraderingar har ingen säker atomär återställning: avinstallation av verktygen återställer inte systemuppgraderingen."
+  },
+  "related": {
+    "heading": "Relaterat",
+    "items": [
+      {
+        "label": "Proxmox systemuppdatering",
+        "href": "/docs/utils/system-update",
+        "tail": " — Kör cykeln apt update + dist-upgrade igen vid behov."
+      },
+      {
+        "label": "Installationsprogram för systemverktyg",
+        "href": "/docs/utils/system-utils",
+        "tail": " - installera (eller installera om) verktyg individuellt efter post-install."
+      },
+      {
+        "label": "Uppdateringar och paketkommandon",
+        "href": "/docs/help-info/update-commands",
+        "tail": " — apt-referens för skalet."
+      },
+      {
+        "label": "Anpassningsbar efterinstallation",
+        "href": "/docs/post-install/customizable",
+        "tail": " — tillbaka till den överordnade menyn."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sv/docs/post-install/customizable.json b/web/messages/sv/docs/post-install/customizable.json
new file mode 100644
index 00000000..b592c041
--- /dev/null
+++ b/web/messages/sv/docs/post-install/customizable.json
@@ -0,0 +1,106 @@
+{
+  "meta": {
+    "title": "Anpassningsbart skript efter installation | ProxMenux-dokumentation",
+    "description": "Välj exakt vilka optimeringar ProxMenux ska tillämpa på en Proxmox VE-värd. 10 kategorier, cirka 35 verktyg och ett gränssnitt med kryssrutor. Innehåller allt i det automatiserade skriptet samt uttryckligen valbara funktioner (IOMMU, Fastfetch, Figurine, Ceph, HA, AMD-korrigeringar …).",
+    "ogTitle": "Anpassningsbart skript efter installation | ProxMenux-dokumentation",
+    "ogDescription": "10 kategorier, ~ 35 individuella optimeringar. Välj exakt vad du vill ha på en Proxmox VE värd. Reversibla förändringar spåras."
+  },
+  "header": {
+    "title": "Anpassningsbart skript efter installation",
+    "description": "Välj exakt vilka optimeringar som ska tillämpas på en Proxmox VE-värd. ProxMenux grupperar cirka 35 verktyg i 10 kategorier i en gemensam dialog med kryssrutor. Samma motor som Automatiserad, med full kontroll över vad som tillämpas.",
+    "section": "Efter installation · Anpassningsbar"
+  },
+  "intro": {
+    "title": "När du ska välja Anpassningsbar",
+    "body": "Välj detta om du redan vet vilka justeringar du vill ha eller undvika på värden. En lista med kryssrutor grupperade per kategori låter dig välja, avmarkera och kombinera optimeringar. Poster kan tillämpas igen senare och återställbara ändringar registreras för <link>Avinstallera optimeringar</link>. Paketuppgraderingar presenteras inte som återställbara."
+  },
+  "compare": {
+    "heading": "Jämförelse med Automatiserad",
+    "body": "Anpassningsbar innehåller hela det <link>automatiserade skriptet</link>: samma 14 grundoptimeringar och en lång lista med valbara alternativ som Automatiserad avsiktligt hoppar över. De passar viss maskinvara (AMD-korrigeringar), viss hosting (OVH RTM) eller särskilda arbetslaster (IOMMU/VFIO, Ceph-förråd, hög tillgänglighet, Fastfetch, Figurine, justering av ZFS ARC, pigz, automatiska ZFS-ögonblicksbilder, hastighetsgränser för vzdump, Open vSwitch, TCP BBR …)."
+  },
+  "categoriesSection": {
+    "heading": "De 10 kategorierna",
+    "body": "Det anpassningsbara skriptet grupperar optimeringarna i 10 kategorier i en gemensam dialog med kryssrutor. Varje kategori har en egen dokumentationssida — öppna ett kort nedan för motivering, standardvärden och verifieringssteg för varje alternativ."
+  },
+  "categories": [
+    {
+      "name": "Grundinställningar",
+      "description": "Rensar APT-källorna, kör den officiella Proxmox-uppgraderingen och ställer in tidszon, regionala inställningar och vanliga verktyg. Grunden för alla andra kategorier."
+    },
+    {
+      "name": "System",
+      "description": "Justerar loggning och kärngränser för en värd med många VM:ar och containrar. Omfattar journald, logrotate, sysctl (minne och filgränser), beteende vid kärnpanik och snabba omstarter."
+    },
+    {
+      "name": "Virtualisering",
+      "description": "Förbereder värden för avancerad virtualisering. Installerar rätt gästagent när Proxmox självt körs i en VM som stöds och aktiverar IOMMU/VFIO för PCI-genomkoppling av GPU:er, styrenheter och TPU:er."
+    },
+    {
+      "name": "Nätverk",
+      "description": "Stärker och justerar värdens nätverksstack. Tvingar APT över IPv4, tillämpar säkerhetsinställningar i sysctl och TCP-buffertjusteringar, erbjuder Open vSwitch, TCP BBR och TCP Fast Open och binder beständiga gränssnittsnamn till MAC-adresser."
+    },
+    {
+      "name": "Lagring",
+      "description": "Konfigurerar Proxmox vanliga lagringsdelsystem: ZFS ARC-storlek, automatiska ZFS-ögonblicksbilder, ZFS autotrim för SSD-/NVMe-pooler och hastighetsgränser för vzdump så att diskar inte mättas under säkerhetskopiering."
+    },
+    {
+      "name": "Säkerhet",
+      "description": "Minskar attackytan som exponeras som standard. Inaktiverar RPC-tjänsterna portmapper/rpcbind som Proxmox inte behöver men lämnar lyssnande."
+    },
+    {
+      "name": "Anpassning",
+      "description": "Ändrar värdens utseende och skalmiljö: färger och alias i bashrc, MOTD-banner och borttagning av prenumerationsmeddelandet i webbgränssnittet."
+    },
+    {
+      "name": "Övervakning",
+      "description": "Integrerar värden med OVH Real-Time Monitoring. Installerar RTM bara om ProxMenux identifierar en OVH-server; på andra värdar ändrar alternativet ingenting."
+    },
+    {
+      "name": "Prestanda",
+      "description": "Snabbar upp komprimering vid säkerhetskopiering och överföringar genom att ersätta gzip med dess parallella motsvarighet pigz."
+    },
+    {
+      "name": "Valfritt",
+      "description": "Specialiserade alternativ som inte alla värdar behöver: AMD CPU-korrigeringar, Fastfetch-banner, 3D-värdnamn med Figurine, uppdatering av PVE Appliance Manager-indexet, Ceph-förråd, tjänster för hög tillgänglighet, Log2RAM för mindre SSD-slitage och en ZRAM-swapprofil."
+    }
+  ],
+  "mixTip": {
+    "title": "Kombinera Automatiserad och Anpassningsbar",
+    "body": "Ett vanligt upplägg: kör först <strong>Automatiserad</strong> för rimliga grundinställningar, öppna sedan <strong>Anpassningsbar</strong> och välj bara de extra verktyg du behöver, till exempel IOMMU för GPU-genomkoppling. Ändringarna registreras separat; Avinstallera visar allt du har tillämpat oavsett vilken väg som lade till det."
+  },
+  "related": {
+    "heading": "Relaterat",
+    "items": [
+      {
+        "label": "Automatiserad efterinstallation",
+        "href": "/docs/post-install/automated",
+        "tail": " — rimliga standardvärden som tillämpas utan frågor."
+      },
+      {
+        "label": "Avinstallera optimeringar",
+        "href": "/docs/post-install/uninstall",
+        "tail": " — återställ valda ändringar utan rester."
+      },
+      {
+        "label": "Grundinställningar",
+        "href": "/docs/post-install/basic-settings",
+        "tail": " — repos, tid, språk, verktyg."
+      },
+      {
+        "label": "Virtualisering",
+        "href": "/docs/post-install/virtualization",
+        "tail": " — IOMMU + VFIO för genomkoppling."
+      },
+      {
+        "label": "Säkerhet",
+        "href": "/docs/post-install/security",
+        "tailRich": " · <storageLink>Lagring</storageLink> · <networkLink>Nätverk</networkLink> · <customLink>Anpassning</customLink> - andra kategorier."
+      },
+      {
+        "label": "Översikt efter installation",
+        "href": "/docs/post-install",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sv/docs/post-install/customization.json b/web/messages/sv/docs/post-install/customization.json
new file mode 100644
index 00000000..c4882529
--- /dev/null
+++ b/web/messages/sv/docs/post-install/customization.json
@@ -0,0 +1,74 @@
+{
+  "meta": {
+    "title": "Post-Install: Anpassning | ProxMenux Dokumentation",
+    "description": "Anpassningar i ProxMenux anpassningsbara skript efter installationen: färgad bash-prompt med användbara alias, ProxMenux-banner i MOTD och möjlighet att ta bort prenumerationsmeddelandet från Proxmox webbgränssnitt."
+  },
+  "header": {
+    "title": "Efter installationen: anpassning",
+    "description": "Visuella och praktiska justeringar för Proxmox-värden. De gör skalet trevligare och döljer prenumerationsmeddelandet i webbgränssnittet. Bashrc, MOTD och bannern registreras och kan återställas via Avinstallera.",
+    "section": "Inställningar efter installation av Proxmox"
+  },
+  "intro": {
+    "title": "Vad denna kategori täcker",
+    "body": "Tre små oberoende alternativ: en <strong>färgad bash-prompt med alias</strong> för root-skalet, en enradig <strong>MOTD-banner</strong> vid SSH-inloggning och borttagning av <strong>popupen ”Ingen giltig prenumeration”</strong> som Proxmox visar vid varje webbinloggning."
+  },
+  "bashrc": {
+    "heading": "Anpassa bashrc",
+    "intro": "Lägger in ett förberett block i <code>/root/.bashrc</code> med färgad prompt, tidsstämplad historik, vanliga <code>ls</code>-/<code>grep</code>-alias och en <code>source</code> för bash-komplettering. Gör arbetet via SSH trevligare och visar tydligt vilken värd du är på när många flikar är öppna.",
+    "writesTitle": "Vad ProxMenux lägger till .bashrc",
+    "writesOutro": "Blocket avgränsas av markörerna <code>PMX_CORE_BASHRC</code>. Om skriptet körs igen ersätts det gamla blocket utan att dupliceras. Ursprunglig <code>.bashrc</code> säkerhetskopieras en gång till <code>/root/.bashrc.bak</code>, och raden <code>source /root/.bashrc</code> läggs till i <code>/root/.bash_profile</code> så att prompten även gäller i inloggningsskal, till exempel efter <code>su -</code>.",
+    "rootTitle": "Gäller för root endast",
+    "rootBody": "Anpassningen gäller root-kontots skal. Andra användare på värden behåller sina egna standardinställningar. Om du bara administrerar Proxmox via webben och aldrig använder skalet kan du hoppa över detta rent estetiska alternativ."
+  },
+  "motd": {
+    "heading": "Konfigurera anpassad MOTD-banner",
+    "intro": "Lägger <em>\"This system is optimised by: ProxMenux\"</em> först i <code>/etc/motd</code>, meddelandet efter lyckad SSH-inloggning ovanför prompten och före <code>update-motd</code>-skript. Ofarligt och rent informativt — en snabb synlig bekräftelse på att ProxMenux har tillämpats på värden.",
+    "writesTitle": "Vad ProxMenux skriver",
+    "writesOutro": "Vid första tillämpningen registrerar ProxMenux om <code>/etc/motd</code> fanns och sparar originalinnehållet under <code>/usr/local/share/proxmenux</code>. Åtgärden är idempotent: om markörraden redan finns läggs inget till. Äldre installationer med <code>/etc/motd.bak</code> migreras till samma återställbara tillstånd."
+  },
+  "banner": {
+    "heading": "Ta bort prenumerationsbanner",
+    "intro": "Tar bort dialogen <em>”Du har ingen giltig prenumeration för den här servern”</em> som visas vid varje webbinloggning i Proxmox utan Enterprise-prenumeration. ProxMenux tar hänsyn till versionen och väljer rätt skript för huvudversionernas olika gränssnittspaket.",
+    "versionTitle": "Val av skript efter version",
+    "versionItems": [
+      "<strong>PVE 9.x</strong> → kör <code>remove-banner-pve-v3.sh</code>, som patchar både <code>proxmoxlib.js</code> för datorgränssnittet och det nya Yew-baserade mobilgränssnittet.",
+      "<strong>PVE 8.x</strong> → kör <code>remove-banner-pve8.sh</code>, endast för datorgränssnittet."
+    ],
+    "versionOutro": "Före patchningen säkerhetskopierar ProxMenux originalfilerna för JS/mallar till <code>/usr/local/share/proxmenux/backups/</code> med tidsstämpel. Avinstallationen återställer filerna därifrån eller installerar om Proxmox gränssnittspaket om säkerhetskopian saknas eller är skadad.",
+    "breakTitle": "Kan bryta efter Proxmox uppdateringar",
+    "breakBody": "Proxmox gränssnittsuppdateringar skriver regelbundet över <code>proxmoxlib.js</code>, vilket kan få meddelandet att återkomma. Du kan tillämpa alternativet igen eller acceptera meddelandet tills dess. ProxMenux installerar också en APT-hook som patchar om efter paketuppgraderingar — se <link>Avinstallera optimeringar</link> för hur den tas bort.",
+    "legalTitle": "Juridisk anmärkning (alltid värt att upprepa)",
+    "legalBody": "Alternativet döljer bara gränssnittets meddelande. Det ger <strong>inte</strong> Enterprise-support eller åtkomst till Enterprise-förrådet och ändrar inte programvarans licens. Proxmox VE ges ut under GNU AGPLv3. En prenumeration stödjer projektet och ger åtkomst till Enterprise-uppdateringskanalen; välj rätt supportnivå för din miljö."
+  },
+  "verify": {
+    "heading": "Verifiering",
+    "intro": "Efter att ha applicerat alla tre:",
+    "reversibleTitle": "Alla tre anpassningsförändringar spåras",
+    "reversibleBody": "<link>Avinstallera optimeringar</link> återställer <code>/root/.bashrc</code>, återför MOTD till exakt innehåll före ProxMenux eller tar bort filen om den inte fanns tidigare och återställer patchade gränssnittsfiler från säkerhetskopian eller installerar om berörda paket vid behov."
+  },
+  "related": {
+    "heading": "Relaterat",
+    "items": [
+      {
+        "label": "Valfritt",
+        "href": "/docs/post-install/optional",
+        "tail": " — Fastfetch och Figurine (andra visuella anpassningar)."
+      },
+      {
+        "label": "Visa versionsinformation",
+        "href": "/docs/settings/show-version-information",
+        "tail": " — bekräftar att anpassningarna spåras som installerade."
+      },
+      {
+        "label": "Avinstallera optimeringar",
+        "href": "/docs/post-install/uninstall",
+        "tail": " — återställ bashrc, motd och prenumerationsmeddelandet."
+      },
+      {
+        "label": "Anpassningsbar efterinstallation",
+        "href": "/docs/post-install/customizable",
+        "tail": " — tillbaka till den överordnade menyn."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sv/docs/post-install/index.json b/web/messages/sv/docs/post-install/index.json
new file mode 100644
index 00000000..e9e49444
--- /dev/null
+++ b/web/messages/sv/docs/post-install/index.json
@@ -0,0 +1,106 @@
+{
+  "meta": {
+    "title": "Skript efter installation av Proxmox VE — Automatiserat och anpassningsbart | ProxMenux",
+    "description": "Översikt över ProxMenux skript efter installation av Proxmox VE. Automatiserad tillämpar rimliga standardvärden utan frågor, Anpassningsbar låter dig välja exakt vad du vill i 10 kategorier och Avinstallera optimeringar återställer de ändringar som stöder återställning.",
+    "ogTitle": "Skript efter installation av Proxmox VE — Automatiserat och anpassningsbart",
+    "ogDescription": "Tillämpa vanliga optimeringar efter installation av Proxmox VE i 10 kategorier — automatiskt eller efter eget val, med återställbara alternativ.",
+    "twitterTitle": "Skript efter installation av Proxmox VE | ProxMenux",
+    "twitterDescription": "Automatiserade och anpassningsbara optimeringar efter installationen för Proxmox VE med reversibla alternativ."
+  },
+  "header": {
+    "title": "Skript efter installationen",
+    "description": "Konfigurera en nyinstallerad Proxmox VE-värd med ProxMenux optimeringar efter installationen. Tillämpa grundinställningarna automatiskt, välj enskilda alternativ, uppdatera installerade funktioner eller återställ de ändringar som stöds. Paketuppgraderingar presenteras inte som återställbara.",
+    "section": "Inställningar efter installation av Proxmox"
+  },
+  "intro": {
+    "title": "Vad menyn används till",
+    "body": "Efter installation av Proxmox VE finns dussintals små ändringar som gör värden snabbare och lättare att underhålla: paketförråd utan prenumeration, rimliga journald-gränser, lämpliga TCP-buffertar, SSD-vänlig logglagring, förbättringar i bashrc med mera. ProxMenux automatiserar dem och registrerar de konfigurationsändringar som stöder återställning."
+  },
+  "openingMenu": {
+    "heading": "Öppna menyn",
+    "body": "Välj <strong>Inställningar efter installation av Proxmox</strong> i ProxMenux huvudmeny. Då visas följande:",
+    "imageAlt": "Menyn för skript efter installation: Automatiserad, Anpassningsbar, det villkorliga alternativet Tillämpa tillgängliga uppdateringar (bara vid väntande uppdateringar) och Avinstallera, följt av Gemenskapens skript"
+  },
+  "threeWays": {
+    "heading": "Fyra sätt att tillämpa optimeringar",
+    "body": "De fyra ProxMenux-alternativen delar samma kod och register över installerade verktyg men ger olika grad av kontroll. <em>Tillämpa tillgängliga uppdateringar</em> visas bara när minst en installerad optimering har en nyare version på disk än den registrerade. På en nykonfigurerad värd är alternativet dolt."
+  },
+  "routes": [
+    {
+      "title": "Automatiserad",
+      "description": "Ett utvalt paket med 14 säkra och alltid användbara optimeringar som tillämpas i följd utan frågor. Ett bra standardval för de flesta användare.",
+      "bullets": [
+        "Paketförråd utan prenumeration + systemuppgradering",
+        "Minne, kärna, nätverkstuning",
+        "Log2RAM (auto-detekterad på SSD/NVMe)",
+        "Journald + logrotate storleksgränser",
+        "Beständiga gränssnittsnamn"
+      ]
+    },
+    {
+      "title": "Anpassningsbar",
+      "description": "Cirka 35 enskilda optimeringar i 10 kategorier. Du väljer exakt vilka som ska tillämpas. Samma motor som Automatiserad, med full kontroll.",
+      "bullets": [
+        "Gränssnitt med kryssrutor per kategori",
+        "Innehåller allt i Automatiserad samt alternativ som väljs uttryckligen (IOMMU, Fastfetch, Figurine, Ceph, HA, AMD-korrigeringar …)",
+        "Kör så många gånger du vill — ändringarna är idempotenta"
+      ]
+    },
+    {
+      "title": "Tillämpa tillgängliga uppdateringar",
+      "description": "När en optimering efter installationen (Log2Ram, minnesinställningar, Logrotate …) har en nyare version på disk än den registrerade visar alternativet bara de ändrade optimeringarna. Motsvarande funktion körs igen och registret uppdateras — inget annat ändras.",
+      "bullets": [
+        "Uttryckligt val per optimering, endast de ändrade",
+        "Samma väljare finns i Monitors instrumentpanel",
+        "En samlad avisering när nya uppdateringar blir tillgängliga"
+      ]
+    },
+    {
+      "title": "Avinstallera optimeringar",
+      "description": "Återställbara ändringar som stöds registreras i ett JSON-register och kopplas till en återställningsfunktion. Åtgärder utan säker återställning, som fullständig paketuppgradering, är avsiktligt uteslutna.",
+      "bullets": [
+        "Detekterar tidigare tillämpade optimeringar automatiskt",
+        "Väljer rätt återställning för varje post: återställer från en .bak-säkerhetskopia om en sådan togs, tar bort konfigurationsfragmentet i sysctl.d om inget behövde säkerhetskopieras eller installerar om originalpaketet med --force-confnew (till exempel för prenumerationsbannern)",
+        "Fråga om omstart vid behov (VFIO, beständiga namn osv.)"
+      ]
+    }
+  ],
+  "whichTitle": "Vilken ska du välja?",
+  "whichBody": "För en ny Proxmox-installation med rimliga grundinställningar utan beslut: <autoLink><strong>Automatiserad</strong></autoLink>. Om du redan vet vilka justeringar du vill ha eller undvika: <customLink><strong>Anpassningsbar</strong></customLink>. För att bara uppdatera en tillämpad optimering som har en nyare version på disk: <updatesLink><strong>Tillämpa tillgängliga uppdateringar</strong></updatesLink>. För att återställa tidigare ändringar: <uninstallLink><strong>Avinstallera optimeringar</strong></uninstallLink>. Du kan kombinera dem: börja med Automatiserad, lägg sedan till Fastfetch eller IOMMU med Anpassningsbar och återställ enskilda poster senare.",
+  "mixing": {
+    "heading": "Blanda med andra post-install skript",
+    "stackTitle": "Kombinera inte flera skript efter installationen",
+    "stackBody": "Kör flera post-install-skript på samma värd kan orsaka duplicerade konfigurationsfiler, motstridiga sysctl-poster eller värre - brutna nätverk efter omstart. Om du redan tillämpade <strong>Helper-Scripts Post Install</strong>, kan vissa ProxMenux optimeringar överlappa med vad den redan konfigurerade. Håll dig till ett post-install-verktyg per värd.",
+    "xshokTitle": "xshok-proxmox: föråldrad",
+    "xshokBody": "Tidigare versioner av ProxMenux hänvisade till <a>xshok-proxmox</a> som ett kompletterande verktyg efter installationen. Projektet är nu föråldrat och erbjuds inte längre i ProxMenux. Om en tidigare körning lämnat markörer på värden upptäcker ProxMenux dem fortfarande och varnar dig. Det är dock inget som bör installeras tillsammans med ProxMenux i dag."
+  },
+  "community": {
+    "heading": "Gemenskapens skript",
+    "body": "Menyn erbjuder också två tredjepartsskript från projektet <a>community-scripts</a>: <em>Proxmox VE Post Install</em> och <em>Proxmox VE Microcode</em>. Startskripten laddar ned och kör originalförfattarnas skript via <code>wget | bash</code>. De underhålls inte av ProxMenux. Se <link>Externa paketförråd</link> för detaljer och frågor om tillit innan du kör dem."
+  },
+  "related": {
+    "heading": "Relaterat",
+    "items": [
+      {
+        "label": "Proxmox systemuppdatering",
+        "href": "/docs/utils/system-update",
+        "tail": " — håller värden uppdaterad efter grundkonfigurationen."
+      },
+      {
+        "label": "Säkerhet",
+        "href": "/docs/security",
+        "tail": " — Fail2Ban + Lynis utöver säkerhetsförstärkningen efter installationen."
+      },
+      {
+        "label": "Visa versionsinformation",
+        "href": "/docs/settings/show-version-information",
+        "tail": " - se vilka postinstallationskomponenter som spåras som installerade."
+      },
+      {
+        "label": "Uppdateringar och paketkommandon",
+        "href": "/docs/help-info/update-commands",
+        "tail": " — referens för apt / pveupgrade."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sv/docs/post-install/monitoring.json b/web/messages/sv/docs/post-install/monitoring.json
new file mode 100644
index 00000000..2ab048f3
--- /dev/null
+++ b/web/messages/sv/docs/post-install/monitoring.json
@@ -0,0 +1,56 @@
+{
+  "meta": {
+    "title": "Post-Install: Övervakning | ProxMenux Dokumentation",
+    "description": "Övervakningsalternativ i ProxMenux anpassningsbara skript efter installationen. För närvarande ett alternativ: installera OVH Real-Time Monitoring (RTM), som bara aktiveras om värden identifieras som en OVH-server."
+  },
+  "header": {
+    "title": "Efter installationen: övervakning",
+    "description": "Övervakningsalternativ i det anpassningsbara skriptet efter installationen. Denna lilla leverantörsspecifika kategori installerar OVH Real-Time Monitoring-agenten på dedikerade OVH-servrar och gör ingenting på andra värdar.",
+    "section": "Inställningar efter installation av Proxmox"
+  },
+  "intro": {
+    "title": "Avsiktligt begränsad omfattning",
+    "body": "Övervakningen efter installationen begränsas till <strong>en leverantörsspecifik agent</strong>. Allmänna verktyg (Prometheus, Grafana, node_exporter) ingår inte här eftersom arkitekturval om separat värd, datalagring och aviseringsmål inte passar i ett steg med ett klick. ProxMenux Monitor, som ingår i ProxMenux, fyller större delen av den rollen utan extern agent."
+  },
+  "ovh": {
+    "heading": "Installera OVH Real-Time Monitoring (RTM)",
+    "intro": "Om din Proxmox värd är en dedikerad server hyrd från <a>OVHcloud</a>, kan du aktivera RTM för att exponera hårdvara telemetri (CPU temperatur, PSU status, disk SMART, RAID controller state, etc.) till OVH kontrollpanelen. Detta är samma agent OVH använder för sin egen \"Server Monitoring\" -funktion.",
+    "decisionsTitle": "Hur ProxMenux bestämmer",
+    "decisionsItems": [
+      "Hämtar värdens offentliga IP-adress med <code>curl ipinfo.io/ip</code>.",
+      "Slår upp internetleverantören som äger adressen med en <code>whois</code>-fråga till <code>v4.whois.cymru.com</code>.",
+      "Om resultatet nämner OVH hämtas <code>last-public-ovh-infra-yak.snap.mirrors.ovh.net/yak/archives/apply.sh</code> och skickas till <code>bash</code> med Puppet-manifestet för RTM v2.",
+      "Om resultatet <em>inte</em> nämner OVH, är ingenting installerat. Alternativet är en no-op."
+    ],
+    "remoteTitle": "Fjärrskript skickas via pipe till bash",
+    "remoteBody": "Installationen kör <code>wget -qO - https://…apply.sh | bash</code>. Om OVH-spegeln komprometteras körs skriptet som root på värden. Väg tilliten till OVH:s spegelkedja mot nyttan av övervakningen innan du aktiverar alternativet. För de flesta hemmaservrar och användare utanför OVH bör det vara avstängt.",
+    "noOpTitle": "Endast aktivera om värden faktiskt är på OVH",
+    "noOpBody": "Alternativet ändrar ingenting på servrar utanför OVH, så att kryssa i det på en hemmaserver med Proxmox orsakar inga problem. Skriptet skriver <em>”Inte en OVH-server, hoppar över RTM-installationen”</em> och avslutas utan att installera paket.",
+    "runsTitle": "Vad ProxMenux kör",
+    "verifyTitle": "Verifiering",
+    "verifyBody": "På en riktig OVH-värd bör du efter omstart se <a>RTM-panelen</a> i OVH Manager med aktuella data från värden. På Proxmox-sidan är RTM-insamlaren en systemd-tjänst — kontrollera den direkt:",
+    "troubleTitle": "Felsökning",
+    "revertTitle": "Ta bort RTM via Avinstallera-menyn",
+    "revertBody": "När RTM är registrerat som installerat erbjuder Avinstallera optimeringar alternativet OVH Real-Time Monitoring. Det kör <code>apt-get purge -y ''ovh-rtm*'' ''rtm'' ''rtm-*''</code>, raderar /etc/rtm och markerar RTM som avinstallerat. Puppet-filer kan fortfarande behöva städas manuellt; granska RTM-specifika manifest i <code>/etc/puppet/</code>. På en värd utanför OVH installerades inga RTM-paket, så inget behöver tas bort."
+  },
+  "related": {
+    "heading": "Relaterat",
+    "items": [
+      {
+        "label": "ProxMenux Monitor",
+        "href": "/docs/settings/proxmenux-monitor",
+        "tail": " — lokal webbpanel för värden som fungerar hos alla leverantörer, inte bara OVH."
+      },
+      {
+        "label": "Användbara systemkommandon",
+        "href": "/docs/help-info/system-commands",
+        "tail": " — referens för övervakning av den lokala värden."
+      },
+      {
+        "label": "Anpassningsbar efterinstallation",
+        "href": "/docs/post-install/customizable",
+        "tail": " — tillbaka till den överordnade menyn."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sv/docs/post-install/network.json b/web/messages/sv/docs/post-install/network.json
new file mode 100644
index 00000000..1f8bf807
--- /dev/null
+++ b/web/messages/sv/docs/post-install/network.json
@@ -0,0 +1,128 @@
+{
+  "meta": {
+    "title": "Post-Install: Nätverk | ProxMenux Dokumentation",
+    "description": "Nätverksalternativ i ProxMenux anpassningsbara efterinstallation: tvinga APT över IPv4, tillämpa en utvald sysctl-profil, installera Open vSwitch, aktivera TCP BBR + Fast Open och bind gränssnittsnamn till deras MAC-adresser."
+  },
+  "header": {
+    "title": "Post-Install: Nätverk",
+    "section": "Inställningar efter installation av Proxmox"
+  },
+  "intro": {
+    "title": "Vad denna kategori täcker",
+    "body": "Fem oberoende nätverksalternativ. Två är enkla (<strong>APT över IPv4</strong>, <strong>installation av Open vSwitch</strong>), två justerar TCP-beteendet (<strong>sysctl-profil för nätverk</strong>, <strong>BBR + Fast Open</strong>) och ett löser ett vanligt driftproblem: <strong>fasta gränssnittsnamn</strong> så att ett nytt nätverkskort eller en BIOS-uppdatering inte byter namn från <code>enp3s0</code> till <code>enp4s0</code> och bryter bryggorna."
+  },
+  "ipv4": {
+    "heading": "Tvinga APT att använda IPv4",
+    "intro": "Skriver <code>Acquire::ForceIPv4 \"true\";</code> till <code>/etc/apt/apt.conf.d/99-force-ipv4</code>. APT vägrar sedan att använda IPv6 för nedladdning av paket, även om värden har IPv6-anslutning.",
+    "tipTitle": "Vem har nytta av det",
+    "tipBody": "Användbart när IPv6-anslutningen är instabil, långsammare än IPv4 eller Debian-/Proxmox-spegeln ibland inte fungerar över IPv6. Ofarligt på värdar utan IPv6. I ett fungerande dual stack-nät ger det förutsägbart beteende: apt överraskar dig inte med en IPv6-timeout."
+  },
+  "sysctl": {
+    "heading": "Tillämpa nätverksoptimeringar",
+    "intro": "Skriver en utvald sysctl-profil till <code>/etc/sysctl.d/99-network.conf</code> med kärnans socketbuffertar, ICMP-härdning, grundläggande skydd mot adressförfalskning och TCP-buffertstorlekar för en hypervisor med många samtidiga flöden.",
+    "tunedTitle": "Vad som justeras",
+    "headerArea": "Område",
+    "headerSettings": "Nyckelinställningar",
+    "rows": [
+      {
+        "area": "Kärnans socketbuffertar",
+        "settings": "<code>netdev_max_backlog=8192</code>, <code>rmem_max=16M</code>, <code>wmem_max=16M</code>, <code>somaxconn=8192</code>"
+      },
+      {
+        "area": "ICMP-härdning",
+        "settings": "<code>icmp_echo_ignore_broadcasts=1</code>, <code>icmp_ignore_bogus_error_responses=1</code>"
+      },
+      {
+        "area": "Routningssäkerhet",
+        "settings": "<code>accept_redirects=0</code>, <code>accept_source_route=0</code>, <code>secure_redirects=0</code>, <code>send_redirects=0</code>, <code>log_martians=0</code>"
+      },
+      {
+        "area": "Filter för omvänd väg",
+        "settings": "<code>rp_filter=2</code> (löst läge, se nedan)"
+      },
+      {
+        "area": "TCP",
+        "settings": "<code>tcp_mtu_probing=1</code>, <code>tcp_rfc1337=1</code>, <code>tcp_sack=1</code>, <code>tcp_rmem=8K/87K/16M</code>, <code>tcp_wmem=8K/64K/16M</code>"
+      },
+      {
+        "area": "Portar",
+        "settings": "<code>ip_local_port_range=1024 65535</code> (pool av tillfälliga portar)"
+      },
+      {
+        "area": "Unix-socketar",
+        "settings": "<code>net.unix.max_dgram_qlen=4096</code>"
+      }
+    ],
+    "sourceOutro": "Lägger även till <code>source /etc/network/interfaces.d/*</code> i <code>/etc/network/interfaces</code> om det saknas. Det är standardpraxis för att kunna lägga till separata konfigurationsfiler för gränssnitt utan att redigera huvudfilen.",
+    "fwbrTitle": "Automatisk justering av virtuella brandväggsbryggor",
+    "fwbrBody": "Utöver sysctl-profilen installerar ProxMenux hjälpskriptet <code>/usr/local/sbin/proxmenux-fwbr-tune</code>, som sätter <code>rp_filter=0</code> och <code>log_martians=0</code> på gränssnitten <code>fwbr*</code> / <code>fwln*</code> / <code>fwpr*</code> / <code>tap*</code> som Proxmox skapar för VM:ar och containrar. Engångsenheten <code>proxmenux-fwbr-tune.service</code> kör det vid uppstart och regeln <code>/etc/udev/rules.d/99-zz-proxmenux-fwbr-tune.rules</code> vid varje <code>net add</code>-händelse med dessa prefix. Därmed täcks gränssnitt som återskapas när VM:ar startas/stoppas, vid omstart och vid livemigrering. Skriptet körs även direkt efter installationen för att behandla befintliga gränssnitt.",
+    "rpFilterTitle": "Varför rp_filter=2 (löst) i stället för 1 (strikt)",
+    "rpFilterBody": "Strikt filtrering av omvänd väg kastar paket vars källa skulle nås via ett <em>annat</em> gränssnitt. Det är en lämplig standard för en klient, men kan störa en Proxmox-värd där VM-trafik ofta kommer in via en brygga och lämnar via en upplänk med asymmetriska rutter. <code>rp_filter=2</code> (löst) kastar bara paket med källor som verkligen saknar en rutt. Det är en praktisk avvägning: något sämre upptäckt av lokal IP-adressförfalskning för att hålla VM-nätet fungerande."
+  },
+  "ovs": {
+    "heading": "Installera Open vSwitch",
+    "intro": "Installerar <code>openvswitch-switch</code> + <code>openvswitch-common</code>. Paketen lägger till OVS som alternativ till de Linux-bryggor Proxmox använder som standard. Installationen ändrar ingen nätverkskonfiguration: befintliga <code>vmbrX</code>-bryggor fungerar vidare. När du <em>skapar</em> en ny brygga i Proxmox kan du välja OVS i listan över typer.",
+    "tipTitle": "När OVS är meningsfullt",
+    "tipBody": "Överväg OVS om du behöver <strong>VLAN-trunkning med VLAN-ID:n som inte är sammanhängande</strong>, <strong>LACP med LLDP i vissa lägen</strong>, <strong>detaljerad programmering av trafikflöden</strong> (OpenFlow) eller samverkan med SDN-styrenheter. För ett hemlabb med några VLAN och en enda LACP-upplänk är Linux-bryggor + <code>vmbrX.VID</code> enklare och fullt tillräckliga.",
+    "revertTitle": "Kan återställas via avinstallationsmenyn",
+    "revertBody": "OVS registreras. <link>Avinstallera optimeringar</link> kör <code>apt purge</code> för <code>openvswitch-switch</code> och <code>openvswitch-common</code>. Migrera OVS-bryggor till Linux-bryggor <em>innan</em> du avinstallerar, annars förlorar VM:arna på dem nätverket vid nästa start. Manuell motsvarighet:"
+  },
+  "bbr": {
+    "heading": "Aktivera TCP BBR + TCP Fast Open",
+    "intro": "Skriver två sysctl-filer och laddar om dem. BBR ersätter CUBIC med Googles bandbreddsbaserade överbelastningsalgoritm, som hanterar länkar med hög kapacitet och latens samt paketförluster bättre. TCP Fast Open (TFO) sparar en tur och retur vid upprepade TCP-anslutningar genom att skicka data i SYN.",
+    "verifyTitle": "Verifiering",
+    "impactTitle": "Effekten beror på arbetsbelastningen",
+    "impactBody": "BBR gör mest nytta på länkar med hög latens eller paketförluster (replikering mellan kontinenter, VPN-tunnlar, mobila klienter). I ett LAN mellan två datorer på samma switch ligger skillnaden ofta inom mätbruset. TFO hjälper främst korta, upprepade HTTP-anslutningar.",
+    "revertTitle": "Kan återställas via avinstallationsmenyn",
+    "revertBody": "BBR/TFO registreras. <link>Avinstallera optimeringar</link> tar bort de två sysctl-filerna (<code>/etc/sysctl.d/99-kernel-bbr.conf</code> och <code>99-tcp-fastopen.conf</code>) och laddar om återstående konfiguration. Att ta bort en fil återställer inte dess aktiva kärnvärden. Standardvärden som <code>cubic</code> och <code>tcp_fastopen=1</code> återkommer efter omstart om ingen annan konfiguration åsidosätter dem. Manuell motsvarighet:"
+  },
+  "names": {
+    "heading": "Beständiga gränssnittsnamn",
+    "intro": "Går igenom värdens fysiska nätverkskort och hoppar över loopback, Docker-veth, bryggor, TAP-enheter, bond-gränssnitt, Cilium, ZeroTier och WireGuard. Skriver en systemd-<code>.link</code>-fil som binder det aktuella namnet till den aktuella MAC-adressen. MAC-bindningen får då företräde framför kärnans namnlogik.",
+    "whyTitle": "Varför detta är viktigt",
+    "whyItems": [
+      "Lägga till eller ta bort PCIe-enheter kan flytta bussnumret, vända <code>enp3s0</code> till <code>enp4s0</code>. Om din <code>/etc/network/interfaces</code> refererar till det gamla namnet försvinner bron på omstart.",
+      "BIOS / firmwareuppdateringar ändrar ibland hur enheterna räknas, med samma effekt.",
+      "Hjälpskriptet skriver <code>.link</code>-filer för fysiska nätverkskort, även bond-portar, med den MAC som sysfs rapporterar just då; för bond-portar kan det vara bondens gemensamma MAC, så kontrollera deras namn efter en omstart. Det hoppar över virtuella gränssnitt som LXC-veth och bond-enheterna själva; det löser inte kapplöpningar vid namngivning av virtuella <code>hotplug</code>-kort."
+    ],
+    "writtenTitle": "Vad blir skrivet",
+    "writtenIntro": "En fil per fysisk NIC, på <code>/etc/systemd/network/10-proxmenux-&lt;iface&gt;.link</code>. Varje fil börjar med rubriken <code># Managed by ProxMenux — do not edit</code> så att ProxMenux kan skilja sina egna filer från användar- eller pakettillhandahållna <code>.link</code>-filer.",
+    "writtenOutro": "<code>.link</code>-filer från andra paket eller användaren bevaras; endast filer med ProxMenux-rubriken hanteras. Vid nästa körning stämmer funktionen av sina filer: den läser <code>MACAddress=</code> från varje <code>10-proxmenux-*.link</code> och tar bort filer vars MAC inte längre finns under <code>/sys/class/net/</code>. Filer från äldre ProxMenux-versioner i formatet <code>10-&lt;iface&gt;.link</code> migreras automatiskt första gången.",
+    "pveTitle": "PVE 9 vs PVE 8",
+    "pveBody": "Skriptet använder systemd-<code>.link</code>-filer för beständiga namn. På Proxmox VE 9 laddar det även om udev-regler efter skrivningen, så att ett redan fastlåst nätverkskort som ansluts eller identifieras på nytt kan använda sin regel utan omstart. Kontrollera befintliga gränssnitt efter en omstart på både PVE 8 och PVE 9. Detta ersätter inte <code>ifupdown2</code> på värden. Skriptet sätter omstartsflaggan i båda fallen så att den anpassningsbara efterinstallationen frågar om omstart.",
+    "reviewTitle": "Granska befintlig /etc/network/interfaces först",
+    "reviewBody": "Om äldre konfiguration i <code>/etc/network/interfaces</code> använder nätverkskortsnamn som kärnan skapar automatiskt är det rätt att binda <em>dagens</em> namn. Om du redan har anpassat konfigurationen till vissa namn, kontrollera före omstart att bindningarna matchar vad interfaces-filen förväntar sig.",
+    "revertTitle": "Kan återställas via avinstallationsmenyn",
+    "revertBody": "<link>Avinstallera optimeringar</link> tar bara bort <code>10-proxmenux-*.link</code>-filer med ProxMenux-rubriken från <code>/etc/systemd/network/</code>. Alla <code>.link</code>-filer från användaren eller andra paket bevaras. Namngivningen återgår till systemd-standard vid nästa omstart."
+  },
+  "related": {
+    "heading": "Relaterat",
+    "items": [
+      {
+        "label": "Nätverkshantering",
+        "href": "/docs/network",
+        "tail": " — diagnostik, broanalys, guidade reparationer."
+      },
+      {
+        "label": "Beständiga gränssnittsnamn",
+        "href": "/docs/network/persistent-names",
+        "tail": " — samma funktion som eget menyval senare; använd ett av alternativen, inte båda."
+      },
+      {
+        "label": "Referens för nätverkskommandon",
+        "href": "/docs/help-info/network-commands",
+        "tail": " — ip, ss, ethtool, sysctl."
+      },
+      {
+        "label": "Avinstallera optimeringar",
+        "href": "/docs/post-install/uninstall",
+        "tail": " - återställ någon av dessa nätverksändringar."
+      },
+      {
+        "label": "Anpassningsbar efterinstallation",
+        "href": "/docs/post-install/customizable",
+        "tail": " — tillbaka till den överordnade menyn."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sv/docs/post-install/optional.json b/web/messages/sv/docs/post-install/optional.json
new file mode 100644
index 00000000..e1811788
--- /dev/null
+++ b/web/messages/sv/docs/post-install/optional.json
@@ -0,0 +1,177 @@
+{
+  "meta": {
+    "title": "ProxMenux Post-Install: Valfria inställningar",
+    "description": "Guide till valfria inställningar i ProxMenux efterinstallationsskript för ytterligare funktioner och optimeringar i Proxmox VE.",
+    "ogTitle": "ProxMenux Post-Install: Valfria inställningar",
+    "ogDescription": "Guide till valfria inställningar i ProxMenux efterinstallationsskript för ytterligare funktioner och optimeringar i Proxmox VE.",
+    "ogImageAlt": "ProxMenux Post-Install valfria inställningar"
+  },
+  "title": "Valfria inställningar",
+  "intro": "Kategorin <strong>Valfria inställningar</strong> erbjuder ytterligare funktioner och optimeringar för Proxmox VE. De är inte nödvändiga men kan förbättra systemets möjligheter i vissa situationer.",
+  "available": "Tillgängliga valfria funktioner",
+  "stepLabel": "Steg",
+  "ceph": {
+    "title": "Lägg till det senaste Ceph-stödet",
+    "intro": "Detta alternativ installerar den senaste Ceph lagringssystem stöd för Proxmox VE. Ceph är ett distribuerat lagringssystem som ger hög prestanda, tillförlitlighet och skalbarhet.",
+    "doesIntro": "Vad det gör:",
+    "doesItems": [
+      "Lägger till Ceph-förvaret i ditt system",
+      "Uppdaterar paketlistor",
+      "Installerar Ceph-paket med kommandot pveceph install",
+      "Verifierar installationen"
+    ],
+    "howUse": "Hur man använder: Efter installationen kan du konfigurera och hantera Ceph lagring med Proxmox VE webbgränssnitt eller kommandoradsverktyg.",
+    "automates": "Denna justering automatiserar följande kommandon:"
+  },
+  "amd": {
+    "title": "Tillämpa korrigeringar för AMD-processorer",
+    "intro": "Detta alternativ tillämpar specifika fixar för AMD EPYC och Ryzen CPU för att förbättra stabiliteten och kompatibiliteten.",
+    "doesIntro": "Vad det gör:",
+    "doesItems": [
+      "Detekterar om en AMD EPYC eller Ryzen CPU är närvarande",
+      "Tillämpar kärnparametern idle=nomwait för att förebygga slumpmässiga krascher (via /etc/kernel/cmdline på systemd-boot-värdar eller /etc/default/grub på GRUB-värdar, med en .bak-kopia av originalet).",
+      "Konfigurerar KVM för att ignorera vissa MSR (Model Specific Register) för bättre Windows-gästkompatibilitet"
+    ],
+    "howUse": "Hur man använder: Dessa korrigeringar tillämpas automatiskt och kräver en omstart av systemet för att träda i kraft.",
+    "automates": "Denna justering automatiserar följande kommandon:"
+  },
+  "ha": {
+    "title": "Aktivera tjänster för hög tillgänglighet",
+    "intro": "Alternativet aktiverar tjänster för hög tillgänglighet (HA) i Proxmox VE, vilket möjliggör automatisk överflyttning av VM:ar och containrar om en nod slutar fungera.",
+    "doesIntro": "Vad det gör:",
+    "doesItems": [
+      "Möjliggör och startar tjänsten pve-ha-lrm (Local Resource Manager)",
+      "Möjliggör och startar tjänsten pve-ha-crm (Cluster Resource Manager)",
+      "Möjliggör och startar corosync-tjänsten för klusterkommunikation"
+    ],
+    "howUse": "Hur man använder: Efter att ha aktiverat dessa tjänster kan du konfigurera HA-grupper och resurser i Proxmox VE-webbgränssnittet.",
+    "automates": "Denna justering automatiserar följande kommandon:"
+  },
+  "pveam": {
+    "title": "Uppdatera Proxmox VE Appliance Manager",
+    "intro": "Uppdaterar det lokala indexet över containermallar som <code>pveam</code> visar i Proxmox, så att listan över tillgängliga programmallar är aktuell nästa gång du skapar en LXC.",
+    "doesIntro": "Vad det gör:",
+    "doesItems": [
+      "Kör <code>pveam update</code> mot Proxmox speglar för att hämta den aktuella katalogen över programmallar",
+      "Fyller listan över programmallar som visas när du skapar en container"
+    ],
+    "howUse": "Användning: kör det när listan över programmallar verkar gammal eller efter byte av speglar. Det hämtar bara katalogindexet, inte själva mallarna.",
+    "automates": "Denna justering automatiserar följande kommando:"
+  },
+  "fastfetch": {
+    "title": "Installera och konfigurera Fastfetch",
+    "intro": "Det här alternativet installerar tyst och konfigurerar Fastfetch, ett systeminformationsverktyg som visar systemspecifikationer och en anpassad logotyp vid inloggningen.",
+    "doesLabel": "Vad det gör:",
+    "doesItems": [
+      "Tyst laddar ner och installerar den senaste versionen av Fastfetch",
+      "Låter dig välja en anpassad logotyp (<strong>ProxMenux, Proxmox, Helper-Scripts, Home-Labs-Club, Proxmology</strong>, eller en anpassad)",
+      "Konfigurerar Fastfetch för att visa <em> \"System optimerad av ProxMenux\"</em>",
+      "Ställ in Fastfetch för att köra automatiskt vid konsolinloggning"
+    ],
+    "importantLabel": "Viktigt:",
+    "importantBody": "Om du ansluter till Proxmox via SSH, bör du välja <strong>Proxmox</strong> logotyp eller skapa en anpassad med <code>jp2a</code> eller <code>img2txt</code>. De andra logotyperna genereras med <code>chafa</code> och kan inte visas korrekt i en vanlig SSH-session.",
+    "customLabel": "Egna logotyper:",
+    "customBody1": "För att använda en anpassad logotyp, placera din ASCII art textfil i: <code>/usr/local/share/fastfetch/logos/</code>",
+    "customBody2": "Du kan skapa anpassade logotyper med verktyg som <code>chafa</code>, <code>jp2a</code> eller <code>img2txt</code>.",
+    "customBody3": "För bästa resultat:",
+    "customItems": [
+      "Håll logohöjden till 35-linjer eller mindre för att upprätthålla proportioner och passa i terminalen",
+      "Använd <code>chafa</code> för färglogotyper (kan inte visas korrekt i SSH-sessioner)",
+      "Använd <code>jp2a</code> eller <code>img2txt</code> för SSH-kompatibel logotyp"
+    ],
+    "examplesLabel": "Exempel på logotyper:",
+    "logos": [
+      {
+        "name": "ProxMenux",
+        "alt": "ProxMenux-logotyp",
+        "src": "https://macrimi.github.io/ProxMenux/fastfetch/proxmenux.png"
+      },
+      {
+        "name": "Proxmox",
+        "alt": "Proxmox-logotyp",
+        "src": "https://macrimi.github.io/ProxMenux/fastfetch/proxmox.png"
+      },
+      {
+        "name": "JC Channel",
+        "alt": "JC Channel-logotyp",
+        "src": "/fastfetch/jc-channel.png"
+      },
+      {
+        "name": "Helper-Scripts",
+        "alt": "Helper-Scripts-logotyp",
+        "src": "https://macrimi.github.io/ProxMenux/fastfetch/helper-scripts.png"
+      },
+      {
+        "name": "Home-Labs-Club",
+        "alt": "Home-Labs-Club-logotyp",
+        "src": "https://macrimi.github.io/ProxMenux/fastfetch/home-labs-club.png"
+      },
+      {
+        "name": "Proxmology",
+        "alt": "Proxmology-logotyp",
+        "src": "https://macrimi.github.io/ProxMenux/fastfetch/proxmology.png"
+      }
+    ],
+    "automates": "Denna justering automatiserar följande kommandon:"
+  },
+  "figurine": {
+    "title": "Installera och konfigurera Figurine",
+    "intro": "Det här alternativet installerar och konfigurerar Figurine, ett verktyg som skapar snygga ASCII-textbanners för din terminal och visar ditt värdnamn i ett visuellt tilltalande 3D-format.",
+    "doesLabel": "Vad det gör:",
+    "doesItems": [
+      "Hämtar och installerar Figurine v2.1.1 från GitHub för värdens arkitektur (AMD64, ARM64 eller ARMv7)",
+      "Skapa ett välkomstmeddelande som visar ditt värdnamn i 3D ASCII-konst när du loggar in",
+      "Uppdaterar en befintlig Figurine-binär först när hämtningen och uppackningen har slutförts utan fel",
+      "Ställ in välkomstmeddelandet för att köra automatiskt vid inloggningen"
+    ],
+    "practicalLabel": "Praktisk användning:",
+    "practicalBody": "När du hanterar flera Proxmox-noder i ett kluster ger Figurine en omedelbar visuell indikation på vilken nod du för närvarande är inloggad. Detta hjälper till att förhindra oavsiktliga kommandon på fel nod och förbättrar ditt arbetsflöde när du hanterar flera servrar.",
+    "exampleLabel": "Exempel på utdata:",
+    "imageAlt": "Exempel på utdata från Figurine",
+    "automates": "Denna justering automatiserar följande process:",
+    "outro": "Efter installationen ser du ditt värdnamn som visas i 3D ASCII-konst varje gång du loggar in, vilket gör det omedelbart klart vilken Proxmox-nod du arbetar på."
+  },
+  "log2ram": {
+    "title": "Installera Log2RAM (SSD/NVMe slitage reduktion)",
+    "intro": "Log2RAM monterar <code>/var/log</code> som en tmpfs-ramdisk och synkroniserar regelbundet till disk. Att buffra journalds täta skrivningar i RAM kan minska SSD-slitage och disk-I/O. Synkronisering och normal avstängning sparar loggar, men ett plötsligt strömavbrott kan förlora poster sedan senaste synkroniseringen.",
+    "upstreamLabel": "Upstream projekt:",
+    "upstreamUrl": "https://github.com/azlux/log2ram",
+    "upstreamLinkLabel": "azlux/log2ram på GitHub",
+    "doesLabel": "Vad ProxMenux gör:",
+    "doesItems": [
+      "Detekterar om rotskivan är SSD/NVMe genom att läsa <code>/sys/block/&lt;dev&gt;/queue/rotational</code>. På en rotationsdisk frågar det automatiska flödet först innan du installerar.",
+      "Kloner uppströms repository (<code>azlux/log2ram</code>) i <code>/tmp/log2ram</code> och patchar sin <code>install.sh</code>, ersätta <code>rsync -aAXv</code> med <code>rsync -aXv --no-acls</code>. Denna justering undviker <em>set_acl: Operation not supported</em> exit 23 misslyckande att vaniljskriptet utlöser när man flyttar /var/log på filsystem utan ACL stöd. <code>log2ram</code> systemd-enheten är aktiverad efter installation.",
+      "Anpassar ramdiskens storlek efter värdens RAM: <code>≤ 8 GB → 128M</code>, <code>≤ 16 GB → 256M</code>, <code>&gt; 16 GB → 512M</code>. Skriver värdet till <code>SIZE=</code> i <code>/etc/log2ram.conf</code>.",
+      "Schemalägger regelbunden disksynkronisering via <code>/etc/cron.d/log2ram</code>: var 1 / 3 / 6 timme enligt samma RAM-nivå.",
+      "Installerar <code>/usr/local/bin/log2ram-check.sh</code>, som körs var tionde minut via <code>/etc/cron.d/log2ram-auto-sync</code>. När <code>/var/log</code> når 80% av ramdisken rensas äldre journaler. Vid 92% körs först <code>logrotate -f /etc/logrotate.d/proxmox-backup-api</code> om filen finns: PBS API-loggar tar ofta mest utrymme på en PBS-värd. Sedan trunkeras <code>pveproxy access/error</code> och <code>pveam.log</code> före synkronisering. <code>log2ram write</code> kopierar bara tmpfs till disk utan att krympa det. Skyddet hjälper till att förebygga PVE-fel med <em>No space left on device</em> när loggar växer okontrollerat.",
+      "Upptäcker tjänsten <code>proxmox-backup-server</code> på värden. Om den finns skapas <code>/etc/logrotate.d/proxmox-backup-api</code> (20 MB × 3 rotationer) och <code>/etc/cron.hourly/proxmox-backup-logrotate</code> för att begränsa PBS API-loggar, den vanliga tillväxtkällan, även mellan Log2RAM-synkroniseringar. Utan PBS görs ingen ändring.",
+      "Justerar systemd-journald gränser (<code>SystemMaxUse</code>, <code>RuntimeMaxUse</code>) för att passa in i ramdisken så att en enda burst inte kan fylla den.",
+      "Registreras i <code>installed_tools.json</code> så att det kan återställas via Avinstallera optimeringar."
+    ],
+    "howUseLabel": "Hur man använder:",
+    "howUseBody": "Det automatiserade flödet installerar Log2RAM utan åtgärd när en SSD-/NVMe-rotdisk upptäcks. Det anpassningsbara flödet frågar om storlek, intervall och synkskydd. Frågan anger 90%, men det genererade skriptet använder trösklarna 80% för rensning och 92% för intensiv rensning som beskrivs ovan.",
+    "verifyLabel": "Verifiera och hantera från skalet:",
+    "verifyCode": "# Service state and configured timers\nsystemctl status log2ram\nsystemctl list-timers log2ram*\n\n# Current ramdisk usage — /var/log IS the tmpfs itself\ndf -h /var/log\n\n# Force a sync now (tmpfs → disk); does NOT shrink the tmpfs\nlog2ram write\n\n# Trigger the auto-sync guard on demand (vacuum + sync when usage is high)\n/usr/local/bin/log2ram-check.sh\n\n# Current config: SIZE, mail settings, path\ncat /etc/log2ram.conf\n\n# ProxMenux-specific cron jobs\ncat /etc/cron.d/log2ram /etc/cron.d/log2ram-auto-sync\n\n# Recent Log2RAM activity\njournalctl -u log2ram -n 50 --no-pager"
+  },
+  "zram": {
+    "title": "Aktivera ZRAM-swap-profil",
+    "intro": "Skapar en komprimerad swap-enhet i RAM, <code>/dev/zram0</code>, med <code>systemd-zram-generator</code>. Sidor som kärnan flyttar till swap komprimeras med zstd och hålls i minnet, så de är skrivna till RAM innan de når swap på disken.",
+    "doesLabel": "Vad det gör:",
+    "doesItems": [
+      "Installerar <code>systemd-zram-generator</code> om det saknas och registrerar om ProxMenux installerade det.",
+      "Skriver <code>/etc/systemd/zram-generator.conf.d/90-proxmenux.conf</code>: en <code>zram0</code>-enhet på en tiondel av värdens RAM, zstd-komprimering (<code>zstd(level=9)</code> med systemd-zram-generator 1.2.0 eller senare) och swap-prioritet 32767.",
+      "Med denna prioritet fyller kärnan ZRAM först. En befintlig swap på disken håller sin egen prioritet och tar de sidor som inte längre passar i ZRAM.",
+      "Innan du ändrar något, letar efter en annan ZRAM-installation: en aktiv zram swap, en zramlinje i <code>/etc/fstab</code>, en systemd-enhet eller en annan generatorfil. Om det hittar en, stannar alternativet och lämnar den inställningen som den är.",
+      "Startar <code>dev-zram0.swap</code> och kontrollerar att den aktiva enheten matchar profilen. Om det inte gör det återställs det tidigare tillståndet.",
+      "Registreras i <code>installed_tools.json</code> så att det kan återställas via Avinstallera optimeringar."
+    ],
+    "howUseLabel": "Hur man använder:",
+    "howUseBody": "Alternativet finns bara i det anpassningsbara flödet, inte det automatiserade. Enheten återskapas vid varje start. Medan den är aktiv visar panelen Minne i ProxMenux Monitor kapacitet, använd swap, algoritm, komprimeringsgrad och använt fysiskt minne.",
+    "verifyLabel": "Verifiera från skalet:",
+    "verifyCode": "# Active swap devices and their priority\nswapon --show\n\n# ZRAM device: algorithm, size and compressed data\nzramctl\n\n# Profile written by ProxMenux\ncat /etc/systemd/zram-generator.conf.d/90-proxmenux.conf\n\n# State of the swap unit\nsystemctl status dev-zram0.swap"
+  },
+  "autoApplication": {
+    "title": "Automatisk applikation",
+    "body": "Välj funktioner efter behov i det anpassningsbara flödet. Log2RAM ingår även i det automatiserade flödet med hårdvaruidentifiering; ZRAM finns bara i det anpassningsbara. Läs avsnitten om bekräftelser och förutsättningar."
+  }
+}
diff --git a/web/messages/sv/docs/post-install/performance.json b/web/messages/sv/docs/post-install/performance.json
new file mode 100644
index 00000000..b688cbf8
--- /dev/null
+++ b/web/messages/sv/docs/post-install/performance.json
@@ -0,0 +1,61 @@
+{
+  "meta": {
+    "title": "Post-Install: Prestanda | ProxMenux Dokumentation",
+    "description": "Prestandaalternativ i ProxMenux anpassningsbara skript efter installationen. Ersätter entrådig gzip med pigz (parallell gzip) för snabbare säkerhetskopiering och komprimering på värdar med flera kärnor."
+  },
+  "header": {
+    "title": "Efter installationen: prestanda",
+    "description": "Prestandaalternativ i det anpassningsbara skriptet efter installationen. Kategorin innehåller en enda optimering: att ersätta gzip med pigz så att säkerhetskopiering och komprimering använder alla CPU-kärnor i stället för en.",
+    "section": "Inställningar efter installation av Proxmox"
+  },
+  "intro": {
+    "title": "Vad denna kategori täcker",
+    "body": "Det enda prestandaalternativet här styr om systemets gzip till en parallell implementation. Andra prestandajusteringar (minne, I/O-schemaläggning, ZFS ARC-storlek och kärngränser) finns i sina egna kategorier (<em>System</em>, <em>Lagring</em>) eftersom de påverkar andra delsystem."
+  },
+  "pigz": {
+    "heading": "Använd pigz för snabbare gzip-komprimering",
+    "intro": "Vanlig <code>gzip</code> komprimerar med <strong>en enda CPU-kärna</strong>. På moderna Proxmox-värdar med 8, 16 eller 32 kärnor blir det en stor flaskhals vid VM-/CT-säkerhetskopiering med <code>vzdump</code>, loggrotation och annat som går genom <code>gzip</code>. <a>pigz</a> är en direkt kompatibel parallell ersättning: samma gzip-kompatibla utdata, men arbetet fördelas över alla kärnor.",
+    "doesTitle": "Vad ProxMenux gör",
+    "doesIntro": "Fem steg, alla idempotenta:",
+    "doesItems": [
+      "Ställer in <code>pigz: 1</code> i <code>/etc/vzdump.conf</code> så att Proxmox säkerhetskopieringsverktyg använder pigz direkt.",
+      "Installerar <code>pigz</code> apt-paketet om det inte redan finns.",
+      "Skriver ett wrapper-skript på <code>/bin/pigzwrapper</code> som vidarebefordrar varje argument till <code>/usr/bin/pigz</code>.",
+      "Registrerar en dpkg-omdirigering för systemets <code>gzip</code>-program (<code>/usr/bin/gzip</code> på Proxmox VE 9, <code>/bin/gzip</code> på Proxmox VE 8). Originalprogrammet bevaras bredvid som <code>gzip.distrib</code> och wrappern tar dess plats. Därefter använder <em>allt</em> som anropar <code>gzip</code> — logrotate, <code>tar czf</code>, skript och vzdump — pigz transparent.",
+      "Kontrollerar att filen som hålls som <code>gzip.distrib</code> är en fungerande gzip innan omslaget sätts på plats, och installerar om <code>gzip</code>-paketet först när det inte är det. En värd som fortfarande har den tidigare <code>/bin/gzip.original</code> swap flyttas till avledningen när alternativet appliceras igen."
+    ],
+    "replacesTitle": "Ersätter ett systemprogram",
+    "replacesBody": "Att sätta en wrapper i stället för <code>gzip</code> är ovanligt. Det är säkert eftersom utdata är gzip-kompatibla, men skript med hårdkodade sökvägar, i restriktiva chroot-miljöer eller med kontroll av programhashar kan fungera annorlunda. Originalprogrammet bevaras som <code>gzip.distrib</code>. Tack vare dpkg-omdirigeringen uppdaterar ett nytt <code>gzip</code>-paket eller uppgraderingen från Proxmox VE 8 till 9 den filen och lämnar wrappern på plats.",
+    "revertTitle": "Kan återställas från Avinstallera-menyn",
+    "revertBody": "Denna optimering registreras. <link>Avinstallera optimeringar</link> kopierar originalprogrammet från <code>gzip.distrib</code> över wrappern, tar bort omdirigeringen och <code>pigzwrapper</code>, kommenterar bort <code>pigz</code>-raden i <code>/etc/vzdump.conf</code> och kör <code>apt purge pigz</code> när gzip har verifierats fungera. Manuell motsvarighet på Proxmox VE 9:",
+    "verifyTitle": "Verifiering",
+    "verifyBody": "Efter applicering bör <code>gzip --version</code> nämna pigz. Ett snabbt riktmärke visar också hastighetsskillnaden på en multi-core värd:",
+    "whenTitle": "När detta betyder mest",
+    "whenBody": "Nyttan ökar med <strong>antalet kärnor på värden</strong> och <strong>hur ofta du säkerhetskopierar</strong>. På en hemmaserver med 2 kärnor och en daglig vzdump är vinsten liten. På en produktionsvärd med 16 kärnor som säkerhetskopierar ett dussin VM:ar varje natt kan pigz minska säkerhetskopieringsfönstret till en bråkdel av tiden för entrådig gzip."
+  },
+  "related": {
+    "heading": "Relaterat",
+    "items": [
+      {
+        "label": "Kommandon för säkerhetskopiering och återställning",
+        "href": "/docs/help-info/backup-commands",
+        "tailRich": " — CLI-referens för vzdump, inklusive trådalternativet <code>--pigz</code>."
+      },
+      {
+        "label": "Lagring",
+        "href": "/docs/post-install/storage",
+        "tail": " — hastighetsgränser för vzdump och justering av ZFS ARC."
+      },
+      {
+        "label": "System",
+        "href": "/docs/post-install/system",
+        "tail": " — justering av filbeskrivare och minne."
+      },
+      {
+        "label": "Anpassningsbar efterinstallation",
+        "href": "/docs/post-install/customizable",
+        "tail": " — tillbaka till den överordnade menyn."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sv/docs/post-install/security.json b/web/messages/sv/docs/post-install/security.json
new file mode 100644
index 00000000..8f1a77b3
--- /dev/null
+++ b/web/messages/sv/docs/post-install/security.json
@@ -0,0 +1,57 @@
+{
+  "meta": {
+    "title": "Post-Install: Säkerhet | ProxMenux Dokumentation",
+    "description": "Säkerhetsalternativ i ProxMenux anpassningsbara skript efter installationen. För närvarande ett enda alternativ: inaktivera tjänsten portmapper/rpcbind för att minska värdens attackyta."
+  },
+  "header": {
+    "title": "Post-Install: Säkerhet",
+    "section": "Inställningar efter installation av Proxmox"
+  },
+  "intro": {
+    "title": "Vad denna kategori täcker",
+    "body": "Säkerheten efter installationen begränsas till <strong>förstärkning av värden som säkert kan tillämpas utan övervakning</strong>: inaktivera tjänster som nästan ingen behöver och kunna återställa dem via Avinstallera. Aktiva säkerhetsverktyg (Fail2Ban för intrångsskydd och Lynis för granskning) finns under <em>Säkerhet</em> i ProxMenux huvudmeny, utanför efterinstallationen."
+  },
+  "rpcbind": {
+    "heading": "Inaktivera Portmapper / rpcbind",
+    "intro": "<code>rpcbind</code> (tidigare <code>portmap</code>) mappar RPC-programnummer till nätverksportar. NFS och vissa äldre RPC-verktyg är beroende av det. På en typisk Proxmox-värd som inte är NFS-server <strong>använder inget det</strong>; om det lämnas aktiverat lyssnar port <code>111/tcp</code> på alla gränssnitt.",
+    "whyTitle": "Varför det är värt att inaktivera",
+    "whyItems": [
+      "Minskar värdattackytan - en mindre lyssnande tjänst att oroa sig för.",
+      "Historiskt missbrukas som en reflektion/amplifieringsvektor i DDoS-attacker. Inaktivera <code>rpcbind</code> tar bort den förstärkningsfaktorn för din värd.",
+      "Tar bort bruset i loggar och utdata från <code>netstat</code> / <code>ss</code>, så att verklig aktivitet blir lättare att upptäcka."
+    ],
+    "nfsTitle": "Inaktivera inte detta om du använder NFS",
+    "nfsBody": "NFS-servern <strong>och</strong> NFS-klienten använder <code>rpcbind</code> för att förhandla om portarna för <code>mountd</code>, <code>statd</code>, <code>lockd</code> med flera. Tillämpa inte alternativet om Proxmox-värden <em>exporterar</em> NFS-resurser till andra datorer eller <em>monterar</em> NFS-resurser från en NAS. Montering misslyckas då med <code>mount.nfs: rpc.statd is not running</code> eller liknande.",
+    "runsTitle": "Vad ProxMenux kör",
+    "runsOutro": "Paketet förblir installerat. ProxMenux registrerar de ursprungliga aktiverings- och körningstillstånden för rpcbind.service och rpcbind.socket, inaktiverar och stoppar sedan båda enheterna så att socketaktivering inte kan starta tjänsten igen.",
+    "verifyTitle": "Verifiering",
+    "verifyBody": "Efter applicering, bekräfta <code>rpcbind</code> är avstängd och ingenting lyssnar på port 111:",
+    "reversibleTitle": "Återställer tjänstens ursprungliga tillstånd",
+    "reversibleBody": "Ändringen registreras i <code>installed_tools.json</code>. <link>Avinstallera optimeringar</link> återställer varje rpcbind-enhet till dess aktiverade/inaktiverade och aktiva/inaktiva tillstånd som registrerades före ProxMenux ändring. Verktyget antar inte att rpcbind var aktiverat på alla värdar."
+  },
+  "related": {
+    "heading": "Relaterat",
+    "items": [
+      {
+        "label": "Säkerhetsmenyn",
+        "href": "/docs/security",
+        "tail": " — kraftfullare verktyg: Fail2Ban (intrångsskydd) och Lynis (granskning)."
+      },
+      {
+        "label": "Lynis",
+        "href": "/docs/security/lynis",
+        "tail": " — granska värden för att hitta fler möjligheter att stärka säkerheten."
+      },
+      {
+        "label": "Användbara systemkommandon",
+        "href": "/docs/help-info/system-commands",
+        "tail": " — referens för tjänststatus, journalctl och lynis audit."
+      },
+      {
+        "label": "Anpassningsbar efterinstallation",
+        "href": "/docs/post-install/customizable",
+        "tail": " — tillbaka till den överordnade menyn."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sv/docs/post-install/storage.json b/web/messages/sv/docs/post-install/storage.json
new file mode 100644
index 00000000..73af8a1c
--- /dev/null
+++ b/web/messages/sv/docs/post-install/storage.json
@@ -0,0 +1,167 @@
+{
+  "meta": {
+    "title": "Post-Install: Lagring | ProxMenux Dokumentation",
+    "description": "Lagringsoptimeringar i ProxMenux anpassningsbara efterinstallationsskript: ZFS ARC-storlek efter värdens RAM, periodiska ögonblicksbilder med zfs-auto-snapshot och borttagning av vzdump-hastighetsgränser."
+  },
+  "header": {
+    "title": "Post-Install: Lagring",
+    "section": "Inställningar efter installation av Proxmox"
+  },
+  "intro": {
+    "title": "Vad denna kategori täcker",
+    "body": "Fyra lagringsoptimeringar: anpassa <strong>ZFS ARC</strong> till en rimlig andel av RAM, installera och schemalägg <strong>automatiska ZFS-ögonblicksbilder</strong>, aktivera <strong>ZFS autotrim</strong> på SSD-/NVMe-pooler och ta bort begränsningar i <strong>vzdump</strong> för snabbare säkerhetskopiering. Välj de oberoende alternativen efter din miljö. Ett femte, <link>Log2RAM</link>, minskar SSD-/NVMe-slitage genom att flytta <code>/var/log</code> till en ramdisk. Det ligger under Valfritt eftersom den anpassningsbara menyn grupperar det där."
+  },
+  "trackedTitle": "Alla fyra registreras i avinstallationsmenyn",
+  "trackedBody": "Varje alternativ registreras i <code>installed_tools.json</code> för <link>Avinstallera optimeringar</link>. Återställning av <code>zfs_arc</code> tar bort <code>/etc/modprobe.d/99-zfsarc.conf</code> och bygger om initramfs; <code>zfs_auto_snapshot</code> tar bort cron-schemat och erbjuder paketrensning; <code>zfs_autotrim</code> sätter <code>autotrim=off</code> på pooler det aktiverat; <code>vzdump_speed</code> återställer <code>/etc/vzdump.conf</code> från installationens <code>.bak</code>.",
+  "arc": {
+    "heading": "Optimera ZFS ARC-storlek",
+    "intro": "<strong>Adaptive Replacement Cache (ARC)</strong> är ZFS läscache i RAM. Proxmox VE-installationer från 8.1 sätter 10% av RAM, högst 16 GiB; äldre eller uppgraderade värdar kan skilja sig. Alternativet skriver samma regel uttryckligen (RAM/10, högst 16 GiB, minst 64 MiB) till en egen fil, vilket även täcker äldre eller uppgraderade värdar. Granska befintliga inställningar och arbetslast; en mindre cache är inte alltid snabbare.",
+    "sizingTitle": "Storleksregler",
+    "headerRam": "Värdens RAM",
+    "headerMax": "ARC-gräns",
+    "rows": [
+      {
+        "ram": "Formel",
+        "max": "RAM / 10, högst 16 GiB och minst 64 MiB"
+      },
+      {
+        "ram": "8 GB värd",
+        "max": "≈ 819 MiB (RAM/10)"
+      },
+      {
+        "ram": "16 GB värd",
+        "max": "≈ 1.6 GiB (RAM/10)"
+      },
+      {
+        "ram": "64 GB värd",
+        "max": "≈ 6.4 GiB (RAM/10)"
+      },
+      {
+        "ram": "≥ 160 GB värd",
+        "max": "16 GiB (gräns)"
+      }
+    ],
+    "after": "Filen <code>/etc/modprobe.d/99-zfsarc.conf</code> innehåller bara <code>options zfs zfs_arc_max=…</code>. Övriga ZFS-parametrar (<code>zfs_arc_min</code>, L2ARC-förhämtning/skrivbegränsning, TXG-timeout) justeras inte. Först söks andra <code>*.conf</code> i <code>/etc/modprobe.d/</code> efter <code>zfs_arc_min</code> / <code>zfs_arc_max</code>. De säkerhetskopieras med manifest till <code>/usr/local/share/proxmenux/backups/zfs_arc/</code> och de motstridiga värdena <code>zfs_arc_min</code> / <code>zfs_arc_max</code> tas bort (övriga alternativ på de raderna behålls) så att bara ProxMenux ARC-fil sätter gränsen. Sedan körs <code>update-initramfs -u -k all</code> och vid behov <code>proxmox-boot-tool refresh</code> så gränsen når initramfs för system med ZFS-rot.",
+    "rebootTitle": "Kräver en omstart för att träda i kraft",
+    "rebootBody": "ARC-inställningar läses när kärnmodulen <code>zfs</code> laddas. För ZFS-rotvärdar bygger ProxMenux om initramfs med <code>update-initramfs -u -k all</code> och uppdaterar vid behov starthanteraren med <code>proxmox-boot-tool refresh</code>. Den nya parametern kräver fortfarande omstart; omstartsflaggan sätts automatiskt.",
+    "safeTitle": "Säker på icke-ZFS värdar",
+    "safeBody": "Funktionen skriver bara konfigen när <code>zpool list</code> rapporterar minst en importerad ZFS-pool. På ext4 / LVM-bara Proxmox-värdar, eller på maskiner med ZFS-verktyg installerade men ingen pool importerad, kryssa detta alternativ är en no-op - ingenting blir skrivet.",
+    "verifyTitle": "Verifiering och manuell återgång"
+  },
+  "autoSnap": {
+    "heading": "Installera ZFS auto-snapshot",
+    "intro": "Installerar <a>zfs-auto-snapshot</a>-paketet och skriver om sina cron scheman så snapshots tas automatiskt vid flera intervaller. Ett bra säkerhetsnät på toppen av dina vanliga vzdump-backups.",
+    "cadenceTitle": "Intervall för ögonblicksbilder som ProxMenux konfigurerar",
+    "headerLabel": "Etikett",
+    "headerRuns": "Körs",
+    "headerKept": "Sparade ögonblicksbilder",
+    "rows": [
+      {
+        "label": "frekventa",
+        "runs": "var 15:e minut",
+        "kept": "4"
+      },
+      {
+        "label": "timme",
+        "runs": "varje timme",
+        "kept": "1"
+      },
+      {
+        "label": "dagligen",
+        "runs": "En gång om dagen",
+        "kept": "1"
+      },
+      {
+        "label": "Veckovis",
+        "runs": "En gång i veckan",
+        "kept": "1"
+      },
+      {
+        "label": "månadsvis",
+        "runs": "En gång i månaden",
+        "kept": "1"
+      }
+    ],
+    "conservativeTitle": "Begränsade antal sparade ögonblicksbilder",
+    "conservativeBody": "ProxMenux sparar ett begränsat antal: 4 täta ögonblicksbilder och 1 för varje längre intervall, så att ZFS-utrymmet inte växer för mycket. För längre lagring, ändra antalen i <code>/etc/cron.d/zfs-auto-snapshot</code>, <code>/etc/cron.hourly/zfs-auto-snapshot</code> osv. efter skriptet.",
+    "onlyZfsTitle": "Endast användbar på ZFS pooler",
+    "onlyZfsBody": "Installera paketet på en ext4-bara värd är ofarlig men meningslös - det finns inga ZFS datamängder för att det ska snapshot. Hoppa över det här alternativet om du inte använder ZFS.",
+    "verifyTitle": "Verifiering och manuell återgång"
+  },
+  "autotrim": {
+    "heading": "Aktivera ZFS autotrim (SSD/NVMe-pooler)",
+    "intro": "Aktiverar <code>autotrim</code> på ZFS-pooler med enbart TRIM-kompatibla SSD- eller NVMe-enheter. Skriptet hoppar försiktigt över pooler med roterande enheter. Pooler som redan har <code>autotrim=on</code> lämnas oförändrade.",
+    "trimTitle": "Vad TRIM gör och varför det spelar roll på ZFS",
+    "trimBody1": "SSD- och NVMe-enheter använder interna raderingsblock som är större än filsystemets logiska sektorer. När en fil tas bort vet enheten ännu inte att sektorerna är lediga, så intern städning kan fortsätta flytta gamla data för att frigöra block. <strong>TRIM</strong> talar om vilka sektorer som är lediga så att de kan raderas i förväg.",
+    "trimBody2": "Utan TRIM kan brist på redan raderade block försämra SSD-prestanda och öka interna skrivningar, vilket förkortar livslängden. Med TRIM kan enheten hålla tomma block redo för skrivning.",
+    "trimBody3": "Med <code>autotrim=on</code> trimmar ZFS nyligen frigjort utrymme i bakgrunden och samlar intervall före kommandona. Periodisk <code>zpool trim &lt;pool&gt;</code> är ett alternativ. Autotrim slipper separat schema men påverkan beror på enheterna; periodisk manuell trimning kan passa enklare diskar bättre.",
+    "practicalTitle": "Varför kan det vara praktiskt att aktivera?",
+    "practicalItems": [
+      "<strong>Uthållig skrivprestanda.</strong> TRIM kan hjälpa enheten att återvinna oanvända block effektivt. Nytta och latenspåverkan beror på enhet och arbetslast.",
+      "<strong>Enhetens livslängd.</strong> Färre onödiga interna kopior kan minska skrivförstärkning och NAND-slitage. Det garanterar ingen viss förlängning av livslängden.",
+      "<strong>Inget separat cron-jobb att schemalägga.</strong> Till skillnad från periodisk <code>zpool trim</code> hanteras autotrim automatiskt av poolen."
+    ],
+    "whenTitle": "När är detta nödvändigt?",
+    "whenIntro1": "<strong>Överväg att aktivera det</strong> på ZFS-pooler med enbart TRIM-kompatibla SSD-/NVMe-enheter. Kontrollera beteende och latens; schemalagd manuell trimning kan passa bättre.",
+    "whenIntro2": "<strong>Skriptet hoppar automatiskt över det</strong> på:",
+    "whenSkipItems": [
+      "Pooler med roterande HDD-vdev — ett försiktigt maskinvarufilter i skriptet.",
+      "Enheter utan <code>discard_granularity</code> i sysfs — vanligen äldre SSD:er utan TRIM eller passthrough-vägar där operativsystemet inte ser den underliggande enheten.",
+      "Pooler där ZFS rapporterar att egenskapen inte stöds (sällsynt; mycket gamla pooler).",
+      "Pooler som redan är inställda på <code>autotrim=on</code> (no-op)."
+    ],
+    "whenIntro3": "<strong>Inte relevant på ext4-bara värdar</strong> - det finns inget för ZFS att trimma. Funktionen avslutas med ett vänligt meddelande i det fallet.",
+    "recordedTitle": "Varför bara pooler som ProxMenux ändrat registreras",
+    "recordedBody": "Funktionen skriver bara en pool till sin interna statliga fil (<code>/usr/local/share/proxmenux/zfs_autotrim_pools</code>) när den aktivt vände den poolen från <code>off</code> till <code>on</code>. Pooler du hade på autotrim innan du kör skriptet lämnas ut ur listan, så en framtida Uninstall stänger inte av inställningar du konfigurerade själv - bara ProxMenux egna ändringar återställs.",
+    "manualTitle": "Manuell motsvarighet (kör på din server)",
+    "manualIntro": "Den fullständiga sekvensen manuset går mot varje pool är replikerbart för hand. Detta är vad du skulle skriva om du ville göra samma sak på en enda pool utan ProxMenux:",
+    "verifyTitle": "Verifiering och manuell återgång",
+    "oneShotTitle": "Behöver du engångstrimning i stället för kontinuerlig?",
+    "oneShotBody": "Vissa operatörer föredrar en manuell trim under off-peak timmar snarare än kontinuerlig trim aktivitet. Inaktivera autotrim och schemalägga ett cronjobb som kör <code>zpool trim &lt;pool&gt;</code> - samma slutmål, olika kadens."
+  },
+  "vzdump": {
+    "heading": "Öka hastigheten för vzdump-säkerhetskopiering",
+    "intro": "Skriver bwlimit: 0 och ionice: 5 i global vzdump-konfiguration. Proxmox har redan obegränsad bandbredd som standard, så bara en inställd gräns tas bort. Jämfört med ionice: 7 ger 5 högre best effort-I/O-prioritet där schemaläggaren stöder det. Det kan påverka gäster och garanterar inte snabbare säkerhetskopiering.",
+    "changedTitle": "Vad som ändras i /etc/vzdump.conf",
+    "backupTitle": "Första körningen skapar en .bak av vzdump.conf",
+    "backupBody": "Första gången kopierar ProxMenux <code>/etc/vzdump.conf</code> till <code>/etc/vzdump.conf.bak</code> före ändringar. Senare körningar skriver inte över kopian, så den tidigare manuella konfigurationen kan återställas. <code>bwlimit</code> och <code>ionice</code> ändras med <code>sed</code>; övriga alternativ som compress, pigz, tmpdir och exclude-path bevaras.",
+    "skipTitle": "När man ska hoppa över detta",
+    "skipBody": "På en värd med långsam lokal lagring och VM som är latenskänsliga, kan avlägsna bandbredd cap orsaka märkbara avmattningar under säkerhetskopior. Om du tidigare har angett en specifik <code>bwlimit</code> av den anledningen, håll det - hoppa över det här alternativet.",
+    "verifyTitle": "Verifiering och manuell återgång"
+  },
+  "related": {
+    "heading": "Relaterat",
+    "items": [
+      {
+        "label": "Kommandon för ZFS-hantering",
+        "href": "/docs/help-info/zfs-commands",
+        "tail": " — zpool / zfs referens för ARC, snapshots, scrub."
+      },
+      {
+        "label": "Kommandon för lagring och diskar",
+        "href": "/docs/help-info/storage-commands",
+        "tail": " — generisk block-enhet och Proxmox lagring referens."
+      },
+      {
+        "label": "Kommandon för säkerhetskopiering och återställning",
+        "href": "/docs/help-info/backup-commands",
+        "tail": " — vzdump-CLI-referens för bandbredd och I/O-prioritet."
+      },
+      {
+        "label": "Avinstallera optimeringar",
+        "href": "/docs/post-install/uninstall",
+        "tail": " — återställ ARC-/vzdump-ändringar."
+      },
+      {
+        "label": "Log2RAM",
+        "href": "/docs/post-install/optional#log2ram",
+        "tail": " — minskar SSD-/NVMe-slitage med /var/log på ramdisk; dokumenteras under Valfritt."
+      },
+      {
+        "label": "Anpassningsbar efterinstallation",
+        "href": "/docs/post-install/customizable",
+        "tail": " — tillbaka till den överordnade menyn."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sv/docs/post-install/system.json b/web/messages/sv/docs/post-install/system.json
new file mode 100644
index 00000000..b7461b07
--- /dev/null
+++ b/web/messages/sv/docs/post-install/system.json
@@ -0,0 +1,133 @@
+{
+  "meta": {
+    "title": "Post-Install: System | ProxMenux Dokumentation",
+    "description": "Systemoptimeringar i ProxMenux anpassningsbara efterinstallationsskript: storleksgränser för journald och logrotate, högre kärn- och filbeskrivargränser, balanserad minnesjustering, snabba omstarter med kexec och återhämtning efter kärnpanik."
+  },
+  "header": {
+    "title": "Efter installationen: system",
+    "section": "Inställningar efter installation av Proxmox"
+  },
+  "intro": {
+    "title": "Vad denna kategori täcker",
+    "body": "Sex oberoende systemoptimeringar. De justerar <strong>journald</strong> och <strong>logrotate</strong> så att loggar inte fyller disken, höjer <strong>kärn- och filbeskrivargränser</strong> för program med många öppna filer, <strong>balanserar minnet</strong> för en virtualiseringsvärd, lägger till <strong>kexec</strong> för omstarter utan BIOS och konfigurerar <strong>automatisk återhämtning</strong> vid kärnpanik. Alla sex registreras och kan återställas via avinstallationsmenyn."
+  },
+  "journald": {
+    "heading": "Optimera journald",
+    "intro": "Skriver om <code>/etc/systemd/journald.conf</code> med rimliga standardvärden så att systemd-journalen inte fyller rotpartitionen över tid. Startar sedan om <code>systemd-journald</code> och rensar äldre loggar.",
+    "keyTitle": "Nyckelvärden",
+    "keyItems": [
+      "<code>Storage=persistent</code> - hålla loggar på disk över omstarter.",
+      "<code>SystemMaxUse=64M</code> / <code>RuntimeMaxUse=60M</code> — gränser för journalens disk- och minnesanvändning.",
+      "<code>Compress=yes</code>, <code>Seal=no</code> — komprimera loggar och hoppa över kryptografisk försegling med framåtsäkerhet (sparar CPU).",
+      "<code>MaxLevelStore=info</code> — lagra info och högre nivåer, vilket behövs för loggvisaren i ProxMenux Monitor och för att Fail2Ban ska upptäcka misslyckad SSH-/Proxmox-autentisering i journalen.",
+      "Frekvensgräns: <code>1000 events / 30 s</code> för att förhindra loggflöden.",
+      "<code>ForwardToSyslog=no</code>, <code>ForwardToWall=no</code> - duplicera inte meddelanden till syslog eller sänds till konsoler."
+    ],
+    "tipTitle": "Varför MaxLevelStore=info är viktigt",
+    "tipBody": "En striktare nivå som <code>warning</code> gör att ProxMenux Monitor visar nästan samma poster i alla datumintervall eftersom de flesta aktiviteter har info-nivå, och hindrar Fail2Ban från att se misslyckade inloggningar. Begränsa i stället volymen med <code>SystemMaxUse</code> och <code>RateLimitBurst</code> utan att begränsa vilka nivåer som lagras."
+  },
+  "logrotate": {
+    "heading": "Optimera logrotate",
+    "intro": "Skriver om <code>/etc/logrotate.conf</code> med globala dags- och storleksinställningar, 7 sparade rotationer, komprimering och <code>copytruncate</code> så att tjänster kan fortsätta skriva utan att öppna loggarna igen. Storleksvillkoret står efter daglig rotation och får företräde om ingen enskild loggregel ändrar det. Originalets <code>logrotate.conf</code> kopieras till <code>.bak</code> första gången.",
+    "tipTitle": "Anpassat för Log2RAM",
+    "tipBody": "Direktivet <code>size 10M</code> får företräde framför den tidigare dagsinställningen; det betyder <em>inte</em> det som inträffar först. Logrotate kontrollerar tröskeln när det körs och enskilda loggregler kan åsidosätta globala värden. För <code>/var/log</code> i Log2RAMs RAM bör du granska regler och timerfrekvens för att styra utrymmesanvändningen."
+  },
+  "limits": {
+    "heading": "Öka olika systemgränser",
+    "intro": "Höjer gränser i kärnan, systemd och PAM som kan vara för låga för en värd med många VM:ar, containrar och nätverkstjänster.",
+    "headerFile": "Fil",
+    "headerSets": "Vad det sätter",
+    "rows": [
+      {
+        "file": "/etc/sysctl.d/99-maxwatches.conf",
+        "sets": "<code>fs.inotify.max_user_watches / max_user_instances / max_queued_events = 1048576</code>"
+      },
+      {
+        "file": "/etc/sysctl.d/99-maxkeys.conf",
+        "sets": "<code>kernel.keys.maxkeys / root_maxkeys = 1000000</code>"
+      },
+      {
+        "file": "/etc/sysctl.d/99-swap.conf",
+        "sets": "<code>vm.swappiness = 10</code>, <code>vm.vfs_cache_pressure = 100</code>"
+      },
+      {
+        "file": "/etc/sysctl.d/99-fs.conf",
+        "sets": "<code>fs.nr_open / file-max = 2097152</code>, <code>fs.aio-max-nr = 1048576</code>"
+      },
+      {
+        "file": "/etc/security/limits.d/99-limits.conf",
+        "sets": "<code>nofile</code> och <code>nproc</code> till 1 048 576 (obegränsade för root)"
+      },
+      {
+        "file": "/etc/systemd/system.conf + user.conf",
+        "sets": "<code>DefaultLimitNOFILE=1048576</code> för systemd-tjänster"
+      },
+      {
+        "file": "/etc/pam.d/common-session + runuser-l",
+        "sets": "<code>session required pam_limits.so</code> så ovanstående gäller för inloggningsskal"
+      },
+      {
+        "file": "/root/.profile",
+        "sets": "<code>ulimit -n 1048576</code> för root shell"
+      }
+    ],
+    "tipTitle": "Varför inotify är viktigt",
+    "tipBody": "Docker, Syncthing, Node.js filbevakare och Plex-biblioteksskanningar kan förbruka <code>max_user_watches</code>. Standardvärdet beror på kärnan och värdens minne; det är inte alltid 8192. Gränsen 1M tillåter fler bevakningar utan att förallokera dem. Aktiva bevakningar använder kärnminne, så kontrollera användningen på värdar med ont om RAM."
+  },
+  "memory": {
+    "heading": "Optimera minnesinställningar",
+    "intro": "Skriver en balanserad sysctl-profil till <code>/etc/sysctl.d/99-memory.conf</code>. Avsedd för en hypervisorvärd: håller helst VM:arnas aktivt använda minne i RAM och frigör sidor i förväg så att allokeringstoppar inte fastnar.",
+    "warnTitle": "swappiness=10 på värdar med ont om minne",
+    "warnBody": "På en värd med 16 GB RAM och många VM:ar kan lägre swappiness leda till att kärnan avslutar processer vid minnesbrist i stället för att använda swap. Vid återkommande OOM-händelser, höj swappiness till 30–60 i <code>/etc/sysctl.d/99-memory.conf</code> efter skriptet."
+  },
+  "kexec": {
+    "heading": "Aktivera snabba omstarter (kexec)",
+    "intro": "Installerar <code>kexec-tools</code> och trådar upp det så att du kan starta om värden rakt in i en ny kärna <em> utan att gå igenom BIOS / UEFI firmware</em>. På stora servrar där POST tar 45 - 90 sekunder, förvandlar detta en omstart från en kaffepaus till några sekunder av stillestånd.",
+    "installsTitle": "Vad ProxMenux installerar",
+    "installsItems": [
+      "Paketet <code>kexec-tools</code> (debconf förinställt med <code>kexec-tools/load_kexec boolean false</code> så att apt inte frågar och automatisk laddning vid avstängning förblir avstängd).",
+      "Systemd-enhet <code>/etc/systemd/system/kexec-pve.service</code> - laddar Proxmox-kärnan och initrd till minne vid start, återanvändning av den nuvarande cmdline.",
+      "Ett alias i <code>/root/.bash_profile</code>: <code>reboot-quick</code> → <code>systemctl kexec</code>."
+    ],
+    "usageIntro": "Användning efter nästa omstart (eller manuell <code>systemctl start kexec-pve</code>):",
+    "warnTitle": "När du inte använder kexec",
+    "warnBody": "kexec hoppar över firmware-nivå init. Om du litar på BIOS/UEFI för att återställa hårdvarutillstånd - till exempel en GPU gör genomgång som bara återställs rent på full POST, eller en besvärlig HBA firmware - kexec omstarter kan lämna dessa enheter i ett halvinitialiserat tillstånd. Använd en normal <code>reboot</code> efter kerneluppgraderingar eller när du behöver BIOS/UEFI ändringar för att träda i kraft. <code>reboot-quick</code> är för vardagliga omstarter."
+  },
+  "panic": {
+    "heading": "Aktivera omstart vid kernel panic",
+    "intro": "Låter kärnan <strong>starta om automatiskt</strong> i stället för att fastna på panikskärmen. Viktigt för fjärrstyrda Proxmox-värdar utan lokal konsol: en låst kärna stoppar alla VM:ar tills du kan bryta och återställa strömmen.",
+    "tipTitle": "Kombinera med åtkomst till fjärrkonsol",
+    "tipBody": "Automatisk omstart är en återställningsmekanism, inte ett felsökningsverktyg. För att <em>undersöka</em> en kärnpanik i stället för att bara starta igen, använd <link>kexec-alternativet</link> ovan med kärnans kdump-stöd, som ProxMenux inte konfigurerar, eller spela in en seriell konsol på en annan värd innan automatisk omstart aktiveras."
+  },
+  "verify": {
+    "heading": "Verifiering",
+    "intro": "Efter att ha tillämpat systemoptimeringarna:",
+    "tipTitle": "Återställning och begränsningar",
+    "tipBody": "Alla sex alternativ finns i <code>installed_tools.json</code> och <link>Avinstallera optimeringar</link>. Återställningen tar bort konfigurationsfilerna, kexec-enheten och aliaset, skriver om journald.conf med systemds standardvärden och återställer logrotate.conf från säkerhetskopian. Vissa aktiva gränser kräver ny session eller omstart."
+  },
+  "related": {
+    "heading": "Relaterat",
+    "items": [
+      {
+        "label": "Användbara systemkommandon",
+        "href": "/docs/help-info/system-commands",
+        "tail": " — verifiera ändringarna (free -h, journalctl, ulimit -a)."
+      },
+      {
+        "label": "Prestanda",
+        "href": "/docs/post-install/performance",
+        "tail": " — ytterligare systemnivåjustering (pigz)."
+      },
+      {
+        "label": "Avinstallera optimeringar",
+        "href": "/docs/post-install/uninstall",
+        "tail": " — återställ någon av dessa förändringar."
+      },
+      {
+        "label": "Anpassningsbar efterinstallation",
+        "href": "/docs/post-install/customizable",
+        "tail": " — tillbaka till den överordnade menyn."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sv/docs/post-install/uninstall.json b/web/messages/sv/docs/post-install/uninstall.json
new file mode 100644
index 00000000..c8fad698
--- /dev/null
+++ b/web/messages/sv/docs/post-install/uninstall.json
@@ -0,0 +1,271 @@
+{
+  "meta": {
+    "title": "Avinstallera optimeringar | ProxMenux Dokumentation",
+    "description": "Återställ återställbara konfigurationsändringar som ProxMenux gjort efter installationen. Registrerade verktyg har egna avinstallationsfunktioner som bevarar värdens tidigare tillstånd där det är möjligt."
+  },
+  "header": {
+    "title": "Avinstallera optimeringar",
+    "description": "Återställ reversibla ändringar som gjorts av Automatiserade eller Anpassningsbara postinstallationsskript. ProxMenux registrerar varje stödd optimering med sin dedikerade restaureringsfunktion; paketuppgraderingar är avsiktligt uteslutna.",
+    "section": "Inställningar efter installation av Proxmox"
+  },
+  "intro": {
+    "title": "Varför detta existerar",
+    "body": "Varje ändring som stöds för återställning <strong>registreras</strong> i <code>/usr/local/share/proxmenux/installed_tools.json</code>. Registret listar aktiva optimeringar och anropar rätt återställningsfunktion. Åtgärder utan säker återgång, till exempel fullständig paketuppgradering, läggs inte till."
+  },
+  "openMenu": {
+    "heading": "Hur man öppnar den",
+    "body": "Öppna <strong>Proxmox-inställningar efter installation → Avinstallera optimeringar</strong> i huvudmenyn. Listan visar <em>nu tillämpade</em> optimeringar; sådant som inte tillämpats visas inte.",
+    "imageAlt": "Lista för Avinstallera optimeringar med aktiva ändringar och kryssrutor för att välja vad som ska återställas"
+  },
+  "howWorks": {
+    "heading": "Hur reverseringen fungerar",
+    "steps": [
+      {
+        "title": "Register och automatisk identifiering",
+        "body1": "Första gången söker ProxMenux efter kännetecken på värden: <code>/etc/sysctl.d/99-memory.conf</code>, <code>/etc/apt/apt.conf.d/99-force-ipv4</code>, installerat <code>haveged</code>, aktiv Log2RAM-tjänst och liknande. Identifierade ändringar registreras som återställbara även om en äldre ProxMenux-version utan register gjorde dem.",
+        "body2": "Migreringen körs bara en gång. Därefter uppdaterar varje tillämpning och återställning registret direkt."
+      },
+      {
+        "title": "Välj vad som ska återställas",
+        "body1": "Listan visar begripliga namn som <em>Optimering av minnesinställningar</em>, <em>IOMMU/VFIO PCI-passthrough</em> och <em>Log2RAM (SSD-skydd)</em>. Markera det du vill återställa. Omarkerade objekt ändras inte."
+      },
+      {
+        "title": "Återställningen körs",
+        "body1": "För varje valt objekt kallar ProxMenux sin matchande avinstallationsfunktion. De flesta omkastningar följer ett av tre mönster:",
+        "items": [
+          "<strong>Från säkerhetskopia</strong> — återställer en <code>.bak</code> skapad vid ändringen (bashrc, logrotate.conf, journald.conf, GRUB-/kärnkommandorad).",
+          "<strong>Ta bort konfiguration</strong> — tar bort ProxMenux-filerna <code>/etc/sysctl.d/99-*.conf</code>, <code>/etc/apt/apt.conf.d/99-*</code> eller systemd-enheten och laddar om.",
+          "<strong>Ominstallation av paket</strong> — för gränssnittsändringar som prenumerationsvarningen installeras ursprungspaketen om med <code>--force-confnew</code> för att återställa levererad konfiguration."
+        ],
+        "body2": "Varje omvänd loggar sina framsteg. Objekt som kräver en omstart (VFIO, ihållande gränssnittsnamn) ställer in en flagga som utlöser omstartsprompten i slutet."
+      },
+      {
+        "title": "Fråga om omstart i slutet",
+        "body1": "Efter återställningen visar menyn en omstartsfråga. Ändringar av kärnparametrar, moduler och gränssnittsnamn (VFIO, beständiga namn) behöver omstart; andra gör det inte. Frågan visas som allmän försiktighetsåtgärd, inte efter en kontroll per objekt."
+      }
+    ]
+  },
+  "reversible": {
+    "heading": "Vad är reversibelt",
+    "intro": "Registrerade reversibla optimeringar och deras matchande avinstallatörer grupperas här efter område:",
+    "groups": [
+      {
+        "title": "Repositorier och APT",
+        "items": [
+          {
+            "tool": "Borttagning av prenumerationsvarning",
+            "restores": "Försöker först återställa gränssnittsfiler från ProxMenux säkerhetskopior (/usr/local/share/proxmenux/backups/proxmoxlib.js.backup.* och index.html.tpl.backup.* om mobilgränssnittet ändrats). Bara om kopian saknas eller är skadad installeras pve-manager, proxmox-widget-toolkit, libjs-extjs och libpve-http-server-perl om med force-confnew. Rensar även cachade .js-/ .gz-kopior."
+          },
+          {
+            "tool": "Hoppa över APT-språkfiler",
+            "restores": "Tar bort /etc/apt/apt.conf.d/99-disable-translations så att APT kan hämta index över översatta paketbeskrivningar enligt övriga språkinställningar."
+          },
+          {
+            "tool": "Tvinga IPv4 för APT",
+            "restores": "Ta bort /etc/apt/apt.conf.d/99-force-ipv4."
+          },
+          {
+            "tool": "Systemverktyg",
+            "restores": "Rensar bara valda verktygspaket som ProxMenux registrerat som nyinstallerade. Paket som redan fanns läggs aldrig till i listan och lämnas oförändrade."
+          }
+        ]
+      },
+      {
+        "title": "Kernel, minne och systemgränser",
+        "items": [
+          {
+            "tool": "Minnesinställningar",
+            "restores": "Tar bort /etc/sysctl.d/99-memory.conf och laddar om sysctl."
+          },
+          {
+            "tool": "Konfiguration vid kärnpanik",
+            "restores": "Ta bort /etc/sysctl.d/99-kernelpanic.conf."
+          },
+          {
+            "tool": "Höjning av systemgränser",
+            "restores": "Tar bort /etc/sysctl.d/99-maxwatches.conf, 99-maxkeys.conf, 99-swap.conf, 99-fs.conf och /etc/security/limits.d/99-limits.conf. Återställer PAM-gränser och systemd DefaultLimitNOFILE. I /root/.profile tas bara äldre ulimit -n 256000 bort; nuvarande ulimit -n 1048576 kan bli kvar och behöva tas bort manuellt."
+          },
+          {
+            "tool": "ZRAM swap profil",
+            "restores": "Stänger av bytet på /dev/zram0, stoppar dev-zram0.swap och tar bort /etc/systemd/zram-generator.conf.d/90-proxmenux.conf. systemd-zram-generatorpaketet rensas endast när ProxMenux installerade det och ingen annan ZRAM-installation är närvarande. Om sidorna i ZRAM inte kan flyttas ut, förblir profilen aktiv och ingenting tas bort."
+          }
+        ]
+      },
+      {
+        "title": "Nätverk",
+        "items": [
+          {
+            "tool": "Nätverksoptimeringar",
+            "restores": "Tar bort /etc/sysctl.d/99-network.conf, 97-proxmenux-fwbr.conf och 98-proxmenux-rpf.conf samt proxmenux-fwbr-tune.service, hjälpskriptet /usr/local/sbin/proxmenux-fwbr-tune och udev-regeln /etc/udev/rules.d/99-zz-proxmenux-fwbr-tune.rules. Tar även bort raden source /etc/network/interfaces.d/* ur /etc/network/interfaces. Laddar om sysctl, systemd och udev-regler."
+          },
+          {
+            "tool": "Open vSwitch",
+            "restores": "Kör apt purge för openvswitch-switch och openvswitch-common. Migrera OVS-bryggor till Linux-bryggor först, annars förlorar VM:arna på dem nätverket vid nästa start."
+          },
+          {
+            "tool": "TCP BBR + TCP Fast Open",
+            "restores": "Tar bort /etc/sysctl.d/99-kernel-bbr.conf och 99-tcp-fastopen.conf och laddar om övrig sysctl-konfiguration. Borttagning återställer inte aktiva värden; standarder som cubic och tcp_fastopen=1 återkommer efter omstart om ingen annan konfiguration åsidosätter dem."
+          },
+          {
+            "tool": "Persistenta gränssnittsnamn",
+            "restores": "Ta bort endast 10-proxmenux-*.link-filer som bär ProxMenux-rubriken från /etc/systemd/network/. Alla .link-filer som tillhandahålls av ett annat paket eller skrivs av användaren lämnas på plats. Interface namn återvänder till systemd: s standard beteende på nästa omstart."
+          }
+        ]
+      },
+      {
+        "title": "Loggning",
+        "items": [
+          {
+            "tool": "Optimering av journald",
+            "restores": "Skriver om /etc/systemd/journald.conf med ursprungliga standardvärden och startar om systemd-journald."
+          },
+          {
+            "tool": "Logrotate-optimering",
+            "restores": "Återställer /etc/logrotate.conf från .bak-filen som fångats före ändringen."
+          },
+          {
+            "tool": "Log2RAM",
+            "restores": "Stoppar och inaktiverar tjänst och timer. Tar bort cron-jobb, systemd-enheter, binärer, konfiguration och /var/log.hdd. Avinstallerar även apt-paketet om det installerats så."
+          },
+          {
+            "tool": "Automatisk ZFS-TRIM",
+            "restores": "Läser /usr/local/share/proxmenux/zfs_autotrim_pools med faktiskt ändrade pooler och kör zpool set autotrim=off på var och en. Autotrim som aktiverats manuellt före ProxMenux lämnas kvar."
+          }
+        ]
+      },
+      {
+        "title": "Shell & utseende",
+        "items": [
+          {
+            "tool": "Anpassning av Bashrc",
+            "restores": "Återställer /root/.bashrc från .bak backup. Om ingen säkerhetskopia finns, tar bort PMX_CORE_BASHRC blocket av markörer."
+          },
+          {
+            "tool": "Egen MOTD-banner",
+            "restores": "Återställer det exakta ursprungliga /etc/motd-innehållet som hålls under /usr/local/share/proxmenux, tar bort filen när den inte fanns innan, eller tar säkert bort arvsmarkören när du migrerar en äldre installation."
+          },
+          {
+            "tool": "Fastfetch",
+            "restores": "Tar bort binär, konfigurationskatalog, update-motd-krok och det avgränsade blocket BEGIN FASTFETCH / END FASTFETCH ur /root/.bashrc, ~/.profile, /etc/profile och /etc/profile.d/fastfetch.sh. Rensar apt-paketet om det är installerat."
+          },
+          {
+            "tool": "Figurine",
+            "restores": "Tar bort binären, profile.d-posten och aliasblocket i bashrc/profile."
+          }
+        ]
+      },
+      {
+        "title": "Hårdvara och virtualisering",
+        "items": [
+          {
+            "tool": "IOMMU / VFIO",
+            "restores": "Ta bort vfio-moduler från /etc/modules, nouveau / radeon / nvidia svartlista poster, och intel_iommu=on / amd_iommu=on / iommu=pt / pcie_acs_override parametrar från /etc/kernel/cmdline (ZFS) eller GRUB. Bygger initramfs."
+          },
+          {
+            "tool": "AMD-processorkorrigeringar (Ryzen/EPYC)",
+            "restores": "Ta bort idle=nomwait från kernel cmdline (ZFS) eller GRUB, och ignore_msrs / report_ignored_msrs alternativ från /etc/modprobe.d/kvm.conf."
+          },
+          {
+            "tool": "Gästagent för en virtualiserad Proxmox-värd",
+            "restores": "Läser /usr/local/share/proxmenux/guest_agent.pkg och rensar det registrerade värdpaketet. Installationen väljer qemu-guest-agent, open-vm-tools eller virtualbox-guest-utils efter hypervisor. Utan post prövas dessa tre paket. Det gäller den nästlade Proxmox-värden, inte gästmallar."
+          }
+        ]
+      },
+      {
+        "title": "Lagring",
+        "items": [
+          {
+            "tool": "Dimensionering av ZFS ARC",
+            "restores": "Tar bort /etc/modprobe.d/99-zfsarc.conf, återställer eventuella externa *.conf-filer som tillfälligt flyttats till /usr/local/share/proxmenux/backups/zfs_arc/, bygger om initramfs och kör proxmox-boot-tool refresh på värdar med systemd-boot."
+          },
+          {
+            "tool": "Automatiska ZFS-ögonblicksbilder",
+            "restores": "Ta bort cron-posterna som manuset skrev och erbjuder till apt purge zfs-auto-snapshot. Befintliga snapshot-dataset på poolerna lämnas intakt - ta bort dem separat om du vill ha dem borta."
+          },
+          {
+            "tool": "Hastighetsgränser för vzdump",
+            "restores": "Återställer /etc/vzdump.conf från installationens .bak och ger bwlimit och ionice deras värden före ProxMenux."
+          }
+        ]
+      },
+      {
+        "title": "Tjänster & extras",
+        "items": [
+          {
+            "tool": "Tidssynkronisering",
+            "restores": "Ställ in tidszon tillbaka till UTC (säker standard) via timedatectl."
+          },
+          {
+            "tool": "Entropigenerering (haveged)",
+            "restores": "Stoppar, inaktiverar och rensar paketet haveged."
+          },
+          {
+            "tool": "kexec (snabba omstarter)",
+            "restores": "Inaktiverar kexec-pve.service, tar bort enhetsfilen och aliaset reboot-quick ur /root/.bash_profile och rensar kexec-tools."
+          },
+          {
+            "tool": "Inaktivering av RPC / rpcbind",
+            "restores": "Återställer rpcbind.service och rpcbind.socket var för sig till registrerat aktiverat/inaktiverat och aktivt/inaktivt tillstånd före ProxMenux."
+          },
+          {
+            "tool": "pigz (parallell gzip)",
+            "restores": "Återställer riktig gzip från gzip.distrib, tar bort dpkg-omdirigeringen och /bin/pigzwrapper, kommenterar pigz-raden i /etc/vzdump.conf och kör apt purge pigz efter verifiering av gzip."
+          },
+          {
+            "tool": "Hög tillgänglighetstjänster",
+            "restores": "Stoppar och inaktiverar pve-ha-lrm, pve-ha-crm och corosync. Befintliga HA-grupper och resursdefinitioner raderas inte; ta bort dem i webbgränssnittet om de inte längre behövs."
+          },
+          {
+            "tool": "Ceph-paketförråd",
+            "restores": "Rensar Ceph-paketen som alternativet installerat, tar bort deb822-filen /etc/apt/sources.list.d/ceph.sources på PVE 9 eller äldre Ceph-lista på PVE 8 och uppdaterar APT-cachen."
+          },
+          {
+            "tool": "OVH RTM (övervakning)",
+            "restores": "Rensar paket som matchar ovh-rtm*, rtm och rtm-*, tar bort /etc/rtm och RTM-posten i registret. Puppet-rester under /etc/puppet/ kan behöva granskas och rensas manuellt; katalogen tas inte bort. På andra värdar än OVH gör installationen normalt inga ändringar."
+          }
+        ]
+      }
+    ]
+  },
+  "edge": {
+    "heading": "Specialfall och begränsningar",
+    "packageTitle": "Ominstallation påverkar Proxmox-paket som används",
+    "packageBody": "Om ProxMenux säkerhetskopior inte kan återställa <strong>Borttagning av prenumerationsvarning</strong> installeras <code>pve-manager</code>, <code>proxmox-widget-toolkit</code>, <code>libjs-extjs</code> och <code>libpve-http-server-perl</code> om med <code>--force-confnew</code>. Det påverkar webbgränssnittet som används: uppdatera webbläsaren och vänta några sekunder på återanslutning. Undvik det under migrering eller kloning.",
+    "rebootTitle": "Ihållande namn och VFIO behöver en omstart",
+    "rebootBody": "Att ta bort <code>10-proxmenux-*.link</code>-filerna (<em>Beständiga gränssnittsnamn</em>) och återställa <em>IOMMU/VFIO</em> ändrar inte det redan startade systemet; ändringarna gäller efter omstart. ProxMenux sätter omstartsflaggan automatiskt.",
+    "perItemTitle": "Du kan återställa en sak och hålla resten",
+    "perItemBody": "Avinstallationen arbetar per objekt. För att bara ta bort Log2RAM och behålla nätverksjusteringar och bashrc, markera endast <em>Log2RAM</em>. Övriga ändringar lämnas kvar och registret uppdateras."
+  },
+  "inspect": {
+    "heading": "Inspektera registret manuellt",
+    "intro": "Om du vill se vad som spåras utan att öppna menyn:",
+    "outro": "Varje <code>\"tool\": true</code>-post motsvarar något ProxMenux tillämpas och kan vända. Ta bort en post manuellt rekommenderas inte - använd alltid menyn, som också kör omvänd funktion istället för att bara glömma förändringen.",
+    "reinstallTitle": "Installera om efter avinstallation",
+    "reinstallBody": "En återställd optimering kan tillämpas igen senare. Öppna <link>efterinstallationsmenyn</link> och kör Automatiserad eller Anpassningsbar; registret sparar det nya tillståndet."
+  },
+  "related": {
+    "heading": "Relaterat",
+    "items": [
+      {
+        "label": "Automatiserad post-Install",
+        "href": "/docs/post-install/automated",
+        "tail": " — tillämpa den rimliga grundkonfigurationen igen."
+      },
+      {
+        "label": "Anpassningsbar efterinstallation",
+        "href": "/docs/post-install/customizable",
+        "tail": " — Välj en annan delmängd."
+      },
+      {
+        "label": "Avinstallera ProxMenux",
+        "href": "/docs/settings/uninstall-proxmenux",
+        "tail": " - olika operationer: tar bort ProxMenux själv, inte dess tillämpade optimeringar."
+      },
+      {
+        "label": "Översikt över efterinstallation",
+        "href": "/docs/post-install",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sv/docs/post-install/updates.json b/web/messages/sv/docs/post-install/updates.json
new file mode 100644
index 00000000..dd5f6a4c
--- /dev/null
+++ b/web/messages/sv/docs/post-install/updates.json
@@ -0,0 +1,112 @@
+{
+  "meta": {
+    "title": "Tillämpa tillgängliga uppdateringar — Optimeringar efter installation | ProxMenux-dokumentation",
+    "description": "Hur ProxMenux upptäcker nya versioner av optimeringar efter installationen (Log2Ram, minnesinställningar, systemgränser, Logrotate, nätverk …) och hur du tillämpar dem via efterinstallationsmenyn eller Monitors instrumentpanel."
+  },
+  "header": {
+    "title": "Tillämpa tillgängliga uppdateringar",
+    "description": "När en optimering efter installationen (Log2Ram, minnesinställningar, systemgränser, Logrotate …) har en nyare version på disk än den registrerade visar ProxMenux den som en tillgänglig uppdatering. Du kan tillämpa den via skriptens efterinstallationsmeny eller Monitors instrumentpanel. Båda kör samma funktion igen och uppdaterar registret.",
+    "section": "Inställningar efter installation av Proxmox"
+  },
+  "intro": {
+    "title": "Vad detta är",
+    "body": "ProxMenux optimeringar efter installationen har versionsnummer, till exempel <code>Log2ram SSD Protection v1.2</code>. Värden registrerar aktiva optimeringar och deras versioner i <code>/usr/local/share/proxmenux/installed_tools.json</code>. När en ny ProxMenux-version levererar en uppdaterad optimering upptäcks skillnaden och bara den erbjuds för ny tillämpning utan att köra hela efterinstallationen."
+  },
+  "why": {
+    "heading": "Varför detta existerar",
+    "body": "Optimeringar efter installationen förbättras ibland med bättre sysctl-inställningar, striktare Logrotate-gränser, nya storleksregler för Log2RAM eller korrigeringar av specialfall. Utan uppdateringsvägen behövde administratören köra hela skriptet med <em>alla</em> optimeringar igen eller avstå förbättringen. Tillämpa tillgängliga uppdateringar låter dig välja omkörning för endast de optimeringar vars version har ändrats."
+  },
+  "detection": {
+    "heading": "Hur uppdateringar upptäcks",
+    "steps": [
+      {
+        "title": "Versionerade skript på disk",
+        "body": "Varje post-install-funktion förklarar sin version i skriptet (<code>scripts/post_install/auto_post_install.sh</code> och <code>scripts/post_install/customizable_post_install.sh</code>). En scanner extraherar dessa versioner från källan på disken."
+      },
+      {
+        "title": "Versionsregister på värden",
+        "body": "När administratören tillämpade varje optimering skrev motsvarande <code>register_tool</code>-anrop den aktiva versionen till <code>/usr/local/share/proxmenux/installed_tools.json</code>. Filen är den auktoritativa uppgiften om vad som är aktivt på värden just nu."
+      },
+      {
+        "title": "Monitor jämför båda sidor",
+        "body": "Vid start och var 24:e timme jämför Monitor versionerna på disk med registret. Varje skillnad ger en post i <code>/usr/local/share/proxmenux/updates_available.json</code>. Filen styr både efterinstallationsmenyns alternativ och kortet i Monitors instrumentpanel."
+      },
+      {
+        "title": "En avisering per ny version",
+        "body": "När minst en uppdatering väntar skickar Monitor en samlad avisering, till exempel <em>”4 uppdateringar av ProxMenux-optimeringar tillgängliga”</em>, med en rad per verktyg i formatet <code>name (vX → vY)</code>, som för Proxmox-paket. Den upprepas inte dagligen för samma uppsättning; bara en ny version eller ett nytt verktyg i listan utlöser den igen."
+      }
+    ]
+  },
+  "pathA": {
+    "heading": "Väg A — Från efterinstallationsmenyn",
+    "intro": "Öppna <strong>Inställningar efter installation av Proxmox</strong> i huvudmenyn. När uppdateringar väntar visas <strong>Tillämpa tillgängliga uppdateringar (N)</strong> ovanför <em>Avinstallera optimeringar</em>. Antalet visar optimeringar med nyare version på disk än i registret. När allt är aktuellt döljs alternativet.",
+    "menuAlt": "Efterinstallationsmenyn med det villkorliga alternativet Tillämpa tillgängliga uppdateringar (N) ovanför Avinstallera optimeringar; antalet visar optimeringar med nyare version på disk",
+    "menuCaption": "<em>Tillämpa tillgängliga uppdateringar (N)</em> visas bara när en optimering har en väntande uppdatering och döljs när värden är aktuell.",
+    "checklistBody": "Öppnar en lista med alla väntande uppdateringar i formatet <code>name (vX → vY)</code>. Alla är valda som standard; avmarkera dem du inte vill tillämpa nu.",
+    "checklistAlt": "Dialogen Tillämpa tillgängliga uppdateringar med en rad per väntande optimering, namn och versionsövergång (aktuell → tillgänglig). Alla rader är valda.",
+    "checklistCaption": "Välj enskilda optimeringar att uppdatera. Samma motor som Automatiserad och Anpassningsbar tillämpar funktionerna igen i bakgrunden och uppdaterar deras registerversioner."
+  },
+  "pathB": {
+    "heading": "Väg B — Från Monitors instrumentpanel",
+    "intro": "Samma uppdateringar finns i Monitor under <link>Inställningar → ProxMenux-optimeringar</link>. Kortet visar en <strong>räknare för väntande uppdateringar</strong> som öppnar väljaren per optimering. Varje verktyg har också en egen uppdateringsåtgärd.",
+    "imageAlt": "Kortet ProxMenux-optimeringar i Monitors inställningar med räknare som öppnar väljaren och uppdateringsåtgärder per verktyg",
+    "imageCaption": "Optimeringskortet i Monitor gör uppdateringarna tillgängliga via räknaren när en nyare version finns på disk, utan skalåtkomst."
+  },
+  "applying": {
+    "heading": "Vad som händer när du tillämpar uppdateringen",
+    "steps": [
+      {
+        "title": "Kör efterinstallationsfunktionen igen",
+        "body": "Den valda funktionen körs igen på värden. Eftersom den är <strong>idempotent</strong> dupliceras inte konfigurationen utan den gamla versionen ersätts av den nya, inklusive sysctl-filer, tilläggskonfigurationer och tjänsteenheter."
+      },
+      {
+        "title": "Uppdaterar registret",
+        "body": "<code>register_tool</code>-anropet i funktionen skriver den nya versionen till <code>installed_tools.json</code>. Nästa skanning ser inte längre en felmatch och uppdateringsinmatningen försvinner från både menyn och Monitor-kortet."
+      },
+      {
+        "title": "Ingen omstart om inte funktionen säger så",
+        "body": "De flesta uppdateringar gäller omedelbart. De som ändrar kärnmoduler, beständiga gränssnittsnamn eller VFIO visar samma fråga om omstart som vid en ny installation."
+      },
+      {
+        "title": "Registreringsuppdatering skickas till Monitor",
+        "body": "När omgången är klar skickar menyn en POST-begäran till <code>http://127.0.0.1:8008/api/updates/post-install/scan</code> för att återskapa <code>/usr/local/share/proxmenux/updates_available.json</code>. När alla väntande uppdateringar tillämpats försvinner räknaren och det villkorliga skalmenyalternativet utan att invänta nästa skanning. Optimeringskortet finns kvar."
+      }
+    ],
+    "jqTitle": "jq krävs",
+    "jqBody": "Listan i väg A använder <code>jq</code> för att läsa JSON med väntande uppdateringar. Om <code>jq</code> saknas avslutas flödet tyst: menyn visar antalet men inget händer efter valet. På en modern Proxmox-installation finns <code>jq</code>; kör annars <code>apt install -y jq</code>."
+  },
+  "differs": {
+    "heading": "Hur det skiljer sig från de andra vägarna",
+    "headerPath": "Path",
+    "headerScope": "Omfattning",
+    "headerWhen": "När det är meningsfullt",
+    "rows": [
+      {
+        "pathLabel": "Automatiserad",
+        "pathHref": "/docs/post-install/automated",
+        "scope": "Tillämpar <em>alla</em> optimeringar i paketet igen.",
+        "when": "Ny värd eller fullständig återtillämpning av grundinställningarna för en helt hanterad nod."
+      },
+      {
+        "pathLabel": "Anpassningsbar",
+        "pathHref": "/docs/post-install/customizable",
+        "scope": "Välj från hela katalogen.",
+        "when": "Välja exakt vilka optimeringar som är aktiva på värden."
+      },
+      {
+        "pathLabel": "Tillämpa tillgängliga uppdateringar",
+        "pathHref": null,
+        "scope": "Bara optimeringar med nyare version på disk.",
+        "when": "Hålla installerade optimeringar aktuella utan att ändra resten."
+      },
+      {
+        "pathLabel": "Avinstallera optimeringar",
+        "pathHref": "/docs/post-install/uninstall",
+        "scope": "Omvänd optimering och ta bort dess registerpost.",
+        "when": "Rulla tillbaka en specifik förändring."
+      }
+    ]
+  },
+  "notifTitle": "Styrning av aviseringen",
+  "notifBody": "Händelsen <em>Uppdateringar av ProxMenux-optimeringar tillgängliga</em> meddelar väntande uppdateringar. Den är aktiverad som standard på varje kanal och kan tystas per kanal under <link>Inställningar → Aviseringar</link>. Den utlöses bara en gång per unik uppsättning uppdateringar, inte vid varje skanning var 24:e timme."
+}
diff --git a/web/messages/sv/docs/post-install/virtualization.json b/web/messages/sv/docs/post-install/virtualization.json
new file mode 100644
index 00000000..8375333e
--- /dev/null
+++ b/web/messages/sv/docs/post-install/virtualization.json
@@ -0,0 +1,116 @@
+{
+  "meta": {
+    "title": "Post-Install: Virtualisering | ProxMenux Dokumentation",
+    "description": "Virtualiseringsalternativ i ProxMenux anpassningsbara skript efter installationen: installerar automatiskt rätt gästagent om Proxmox körs i en VM och aktiverar IOMMU / VFIO så att PCI-enheter (GPU:er, nätverkskort, HBA:er) kan genomkopplas till dina VM:ar."
+  },
+  "header": {
+    "title": "Post-Install: Virtualisering",
+    "section": "Inställningar efter installation av Proxmox"
+  },
+  "intro": {
+    "title": "Vad denna kategori täcker",
+    "body": "Två oberoende alternativ. <strong>Installera rätt gästagent</strong> hjälper när Proxmox självt körs inuti en annan hypervisor. <strong>Aktivera VFIO IOMMU-stöd</strong> är det alternativ de flesta behöver: aktiverar kärnfunktioner för att genomkoppla en GPU, HBA eller ett nätverkskort direkt till en VM med nästan nativ prestanda."
+  },
+  "guestAgent": {
+    "heading": "Installera relevant gästagent",
+    "intro": "Identifierar Proxmox-värdens virtualiseringsmiljö med <code>systemd-detect-virt</code> och <code>dmidecode</code> och installerar rätt gästverktyg så att den yttre hypervisorn kan kommunicera korrekt med Proxmox: ordnad avstängning, klocksynkronisering, IP-rapportering med mera.",
+    "headerDetected": "Detekterad värd",
+    "headerPackage": "Paket installerat",
+    "rows": [
+      {
+        "detected": "QEMU / KVM",
+        "package": "qemu-guest-agent"
+      },
+      {
+        "detected": "VMware (ESXi, Workstation)",
+        "package": "open-vm-tools"
+      },
+      {
+        "detected": "VirtualBox",
+        "package": "virtualbox-guest-utils"
+      },
+      {
+        "detected": "Bare metal (ingen)",
+        "package": " — ingen åtgärd, inget installeras"
+      }
+    ],
+    "skipTitle": "Hoppa över detta när Proxmox körs direkt på maskinvaran",
+    "skipBody": "Om Proxmox körs direkt på maskinvaran, vilket är vanligast, ändrar alternativet ingenting: detektorn returnerar <code>none</code> och skriptet avslutas utan ändringar. Det gäller bara de installationer som kör Proxmox <em>som gäst</em> för test eller labb."
+  },
+  "vfio": {
+    "heading": "Aktivera VFIO IOMMU-stöd",
+    "intro": "Aktiverar IOMMU på värden och läser in kärnmodulerna för PCI-genomkoppling (<code>vfio</code>, <code>vfio_iommu_type1</code>, <code>vfio_pci</code>). Då kan du tilldela en fysisk enhet till en VM, vars gäst får direkt åtkomst med nästan nativ prestanda.",
+    "whoTitle": "Vem behöver detta",
+    "whoItems": [
+      "Du vill genomkoppla en GPU till en Windows-VM för spel eller en macOS-VM.",
+      "Du har en dedikerad 10G NIC för en brandvägg / router VM (OPNsense, pfSense).",
+      "Du vill passera en HBA direkt till en TrueNAS/Unraid VM för ZFS på nakna diskar.",
+      "Du planerar att använda <em>Coral TPU</em>, ett inspelningskort eller en SDR-dongel i en VM."
+    ],
+    "whoOutro": "Om inget av dessa stämmer kan du säkert hoppa över det här alternativet. För vidarekoppling till en <strong>LXC</strong> (inte en VM), krävs <em>inte</em> IOMMU.",
+    "doesTitle": "Vad ProxMenux gör",
+    "doesIntro": "Funktionen tar hänsyn till starthanteraren: den identifierar ZFS (systemd-boot) eller LVM/ext4 (GRUB) och skriver till rätt fil. Den är idempotent — parametrar som redan finns läggs inte till igen.",
+    "headerBoot": "Starttyp",
+    "headerFile": "Ändrad fil",
+    "headerPost": "Steg efter uppdatering",
+    "bootRows": [
+      {
+        "boot": "systemd-boot (ZFS)",
+        "file": "/etc/kernel/cmdline",
+        "post": "proxmox-boot-tool refresh"
+      },
+      {
+        "boot": "GRUB (LVM/ext4)",
+        "file": "/etc/default/grub",
+        "post": "update-grub"
+      }
+    ],
+    "kernelIntro": "Tillagda kärnparametrar:",
+    "modulesIntro": "Kärnmoduler som läggs till i <code>/etc/modules</code>:",
+    "blacklistIntro": "Konflikterande drivrutiner svartlistas i <code>/etc/modprobe.d/blacklist.conf</code>:",
+    "blacklistTitle": "Svartlistade GPU-drivrutiner förhindrar GPU-användning på värden",
+    "blacklistBody": "Svartlistan hindrar värdkärnan från att binda <em>någon</em> GPU-drivrutin så att VFIO kan ta över GPU:n. Det är önskat för genomkoppling till en VM, men är <strong>motsatsen</strong> till vad du behöver för att <link>installera NVIDIA-drivrutiner på värden</link>, till exempel för LXC-transkodning. Välj en väg per GPU:",
+    "pathItems": [
+      "<strong>GPU → VM:</strong> aktivera VFIO/IOMMU här och låt GPU-drivrutinerna vara svartlistade.",
+      "<strong>GPU → LXC (eller värd):</strong> hoppa över det här alternativet, använd NVIDIA-värdinstallationen, svartlista inte nvidia/nouveau.",
+      "<strong>Två GPU:er:</strong> en kan tilldelas en VM och den andra en LXC, men du behöver mer detaljerad konfiguration: bind bara ett kort till <code>vfio-pci</code> med PCI-ID. Standardsvartlistan är för bred för detta — redigera <code>blacklist.conf</code> efteråt."
+    ],
+    "acsTitle": "Om pcie_acs_override — förstå vad du aktiverar",
+    "acsBody": "<code>pcie_acs_override=downstream,multifunction</code> lättar på kontrollen av PCIe Access Control Services. Kärnan kan dela IOMMU-grupper som firmware rapporterar som odelbara, ibland det enda sättet att genomkoppla en enhet utan hela gruppen. Avvägningen är <strong>minskad isolering mellan enheter</strong>: en skadlig eller komprometterad VM med genomkoppling får större attackyta via DMA. Acceptabelt i ett hemlabb, men överväg noga på värdar med opålitliga arbetslaster. Ta bort parametern från <code>/etc/kernel/cmdline</code> eller <code>/etc/default/grub</code> efter skriptet om den inte behövs och uppdatera starthanteraren igen.",
+    "rebootTitle": "Omstart krävs",
+    "rebootBody": "IOMMU, VFIO-moduler och svartlistan börjar gälla efter ombyggnad av initramfs och omstart. Skriptet kör <code>update-initramfs -u -k all</code>, uppdaterar starthanteraren och markerar ”omstart krävs” så att Anpassningsbar frågar i slutet.",
+    "verifyTitle": "Verifiering efter omstart",
+    "revertTitle": "Kan återställas från Avinstallera-menyn",
+    "revertBody": "<link>Avinstallera optimeringar</link> återställer alla ändringar: tar bort IOMMU-parametrarna från <code>/etc/kernel/cmdline</code> eller GRUB, VFIO-modulerna från <code>/etc/modules</code> och drivrutinernas svartlistposter samt bygger om initramfs. En omstart krävs för att återställningen ska börja gälla."
+  },
+  "related": {
+    "heading": "Relaterat",
+    "items": [
+      {
+        "label": "Lägg till GPU till VM (Passthrough)",
+        "href": "/docs/hardware/gpu-vm-passthrough",
+        "tail": " — naturliga nästa steg när IOMMU + VFIO är aktiverat."
+      },
+      {
+        "label": "Lägg till Controller eller NVMe till VM",
+        "href": "/docs/disk-manager/add-controller-nvme-vm",
+        "tail": " — samma genomkopplingsinfrastruktur för lagringsstyrenheter."
+      },
+      {
+        "label": "GPU Passthrough kommandon",
+        "href": "/docs/help-info/gpu-commands",
+        "tail": " — IOMMU verifiering referens."
+      },
+      {
+        "label": "Avinstallera optimeringar",
+        "href": "/docs/post-install/uninstall",
+        "tail": " — återställ IOMMU / VFIO utan rester."
+      },
+      {
+        "label": "Anpassningsbar efterinstallation",
+        "href": "/docs/post-install/customizable",
+        "tail": " — tillbaka till den överordnade menyn."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sv/docs/security/fail2ban.json b/web/messages/sv/docs/security/fail2ban.json
new file mode 100644
index 00000000..ce691098
--- /dev/null
+++ b/web/messages/sv/docs/security/fail2ban.json
@@ -0,0 +1,152 @@
+{
+  "meta": {
+    "title": "Fail2Ban | ProxMenux-dokumentation",
+    "description": "Installera Fail2Ban med tre jails inställd för Proxmox (SSH aggressiv, Proxmox UI 8006, ProxMenux Monitor 8008). Inkluderar journald MaxLevelStore fix, anpassade loggtjänster för tillförlitlighet, automatiskt upptäckta nftables/iptables backend och SSH MaxAuthTries härdning.",
+    "ogTitle": "Fail2Ban | ProxMenux-dokumentation",
+    "ogDescription": "Skydd mot lösenordsattacker för SSH och Proxmox webbgränssnitt, med Proxmox-specifika korrigeringar av journald och backend."
+  },
+  "header": {
+    "title": "Fail2Ban",
+    "description": "Installerar Fail2Ban för Proxmox: tre jails (aggressivt SSH, Proxmox-gränssnitt på 8006, ProxMenux Monitor på 8008 och omvänd proxy), journald-korrigering för att spara SSH-händelser, två tjänster som kopierar journalen till filer för att kringgå ett känt systemd-backendproblem, automatisk brandväggsbackend och SSH-härdning med MaxAuthTries.",
+    "section": "Säkerhet"
+  },
+  "intro": {
+    "title": "Vad detta gör",
+    "body": "Installerar Fail2Ban från Debians paketförråd och skapar en Proxmox-konfiguration som direkt skyddar SSH, Proxmox webbgränssnitt och ProxMenux Monitor. En befintlig installation upptäcks och ger i stället en hanteringsmeny för ominstallation eller borttagning."
+  },
+  "firstLaunch": {
+    "heading": "Första lanseringen dialog",
+    "body": "Om Fail2Ban saknas visar skriptet en bekräftelse med vad som ska installeras och konfigureras. Avbryt avslutar utan ändringar; bekräftelse startar installationen.",
+    "imageAlt": "Installationsbekräftelse för Fail2Ban med tre jails, journald-korrigering och SSH-härdning"
+  },
+  "jails": {
+    "heading": "De tre jails",
+    "headerJail": "Jail",
+    "headerProtects": "Skyddar",
+    "headerRetries": "Försök / Tidsfönster",
+    "headerBan": "Blockeringstid",
+    "rows": [
+      {
+        "jail": "[sshd]",
+        "protects": "SSH (aggressivt läge — omfattar ddos, mode, normal)",
+        "retries": "2 / 60 min",
+        "ban": "9 timmar"
+      },
+      {
+        "jail": "[proxmox]",
+        "protects": "Proxmox webb UI (port 8006)",
+        "retries": "3 / 10 min",
+        "ban": "1 timme"
+      },
+      {
+        "jail": "[proxmenux]",
+        "protects": "ProxMenux Monitor (port 8008 + http / https omvänd proxy)",
+        "retries": "3 / 10 min",
+        "ban": "1 timme"
+      }
+    ],
+    "outro": "Globala standardinställningar från <code>jail.local</code>: <code>ignoreip = 127.0.0.1/8 ::1</code>, <code>ignoreself = true</code>,<code> bantime = 86400</code> (24h reserv för jails som inte åsidosätter det), <code>maxretry = 2</code>, <code>findtime = 1800</code>."
+  },
+  "journald": {
+    "heading": "Varför journald-korrigeringen är viktig",
+    "intro": "Proxmox levererar <code>/etc/systemd/journald.conf</code> med <codeNw>MaxLevelStore=warning</codeNw>. journald kastar meddelanden på nivåer <em>under</em> warning innan de lagras. SSH och PAM rapporterar autentiseringsfel på nivåerna <em>info</em> / <em>notice</em>, så:",
+    "diagram": {
+      "sshLabel": "SSH / PAM",
+      "sshDetail": "autentiseringsfel\n(nivå info / notice)",
+      "journaldLabel": "journald",
+      "journaldDetail": "MaxLevelStore=warning\n→ händelsen kastas utan varning",
+      "fail2banLabel": "Fail2Ban",
+      "fail2banDetail": "ser ingenting\naldrig förbjuder något",
+      "arrowLabel": "Standard Proxmox"
+    },
+    "afterDiagram": "Installatören upptäcker detta och skriver en drop-in på <codeXs>/etc/systemd/journald.conf.d/proxmenux-loglevel.conf</codeXs> höja både <code>MaxLevelStore</code> och <code>MaxLevelSyslog</code> till <code>info</code>:",
+    "code": "[Journal]\nMaxLevelStore=info\nMaxLevelSyslog=info",
+    "outro": "Startar sedan om <code>systemd-journald</code>. Vid avinstallation tas tillägget bort och Proxmox ursprungliga standardvärde återställs."
+  },
+  "loggers": {
+    "heading": "Varför två anpassade loggertjänster",
+    "intro1": "Fail2Ban kan läsa systemd-journalen direkt (<code>backend = systemd</code>), men på Proxmox har denna backend kända problem med arbetsprocesser i <code>pvedaemon</code>: autentiseringshändelser syns i journalen men upptäcks inte alltid. Även <code>sshd</code> berörs ibland.",
+    "intro2": "ProxMenux skapar två små systemd-tjänster som följer berörda enheter med <code>journalctl -f</code> och lägger till varje rad i en fil. Fail2Ban läser filerna med tillförlitliga <code>backend = auto</code> (filläge):",
+    "headerService": "Tjänst",
+    "headerSource": "Källenhet",
+    "headerOutput": "Utdatafil",
+    "rows": [
+      {
+        "service": "proxmox-auth-logger.service",
+        "source": "pvedaemon.service",
+        "output": "/var/log/proxmox-auth.log"
+      },
+      {
+        "service": "ssh-auth-logger.service",
+        "source": "ssh.service",
+        "output": "/var/log/ssh-auth.log"
+      }
+    ],
+    "outro": "Båda tjänsterna är deklarerade <code>PartOf=fail2ban.service</code> så de startar om med Fail2Ban och slutar med det. Läget 640 som ägs av <code>root:adm</code> på loggfilerna. Den tredje loggen som används av <code>[proxmenux]</code> jail (<code>/var/log/proxmenux-auth.log</code>) skrivs direkt av appen ProxMenux Monitor Flask – ingen loggertjänst behövs för den."
+  },
+  "backend": {
+    "heading": "Automatisk identifiering av brandväggsbackend",
+    "intro": "Installationsproberar värden: om <code>nft list ruleset</code> fungerar, väljer den <code>nftables</code> som förbudsåtgärden. Annars faller det tillbaka till <code>iptables-multiport</code> / <code>iptables-allports</code>. Valet är skrivet i <code>jail.local</code>:",
+    "code": "# nftables host\nbanaction = nftables\nbanaction_allports = nftables[type=allports]\n\n# iptables host (fallback)\nbanaction = iptables-multiport\nbanaction_allports = iptables-allports"
+  },
+  "hardening": {
+    "heading": "SSH-härdning: MaxAuthTries",
+    "intro": "Lynis-kontrollen <strong>SSH-7408</strong> rekommenderar <code>MaxAuthTries 3</code> i <code>sshd_config</code>. SSH-jailen använder <code>maxretry = 2</code> för blockering efter upprepade fel; MaxAuthTries begränsar försök inom samma anslutning. SSH-inställningen ger ett extra skyddslager även när Fail2Ban stoppats för underhåll.",
+    "installerIntro": "Installationsprogrammet:",
+    "items": [
+      "Läser det aktuella <code>MaxAuthTries</code>-värdet (eller standarder till 6 om det saknas).",
+      "Spara det till <code>/usr/local/share/proxmenux/sshd_maxauthtries_backup</code>.",
+      "Redigerar <code>sshd_config</code> direkt: ersätter befintlig rad, avkommenterar en kommenterad rad eller lägger till en ny.",
+      "Laddar om <code>sshd</code> utan omstart så att befintliga sessioner behålls."
+    ],
+    "outro": "Vid avinstallation återställs det sparade ursprungliga värdet och <code>sshd</code> laddas om igen."
+  },
+  "manage": {
+    "heading": "Hantera en befintlig installation",
+    "intro": "Om Fail2Ban redan är installerad när du öppnar menyn upptäcker manuset den och visar en meny istället för att köra om installationsprogrammet:",
+    "headerAction": "Handling",
+    "headerWhat": "Vad det gör",
+    "rows": [
+      {
+        "action": "Reinstallera",
+        "what": "Kör hela installationen igen och skriver om alla jails med aktuella ProxMenux-standardvärden. Använd när en uppdatering ändrar rekommendationerna."
+      },
+      {
+        "action": "Ta bort",
+        "what": "Stoppar fail2ban och de två loggertjänsterna, rensar apt-paketet, tar bort alla jail / filtrera filer, tar bort journald drop-in (återställer Proxmox standard) och återställer originalet SSH MaxAuthTries."
+      }
+    ]
+  },
+  "verify": {
+    "heading": "Verifiera att det fungerar",
+    "intro": "Efter installation, användbara kommandon från värden:",
+    "code": "# Service status and version\nsystemctl status fail2ban\nfail2ban-client --version\n\n# All active jails\nfail2ban-client status\n\n# Detail on one jail\nfail2ban-client status sshd\nfail2ban-client status proxmox\nfail2ban-client status proxmenux\n\n# Currently banned IPs in a jail\nfail2ban-client status sshd | grep \"Banned IP\"\n\n# Manually unban an IP (use this if you ban yourself)\nfail2ban-client unban 192.0.2.10\n\n# Tail the auth logs Fail2Ban watches\ntail -f /var/log/ssh-auth.log\ntail -f /var/log/proxmox-auth.log\ntail -f /var/log/fail2ban.log"
+  },
+  "troubleshoot": {
+    "heading": "Felsökning",
+    "neverBansTitle": "Fail2Ban körs men förbjuder aldrig något",
+    "neverBansBody": "Kontrollera att <code>tail -f /var/log/ssh-auth.log</code> får en post efter ett SSH-försök med fel lösenord från en annan dator. Om filen är tom granskar du <code>systemctl status ssh-auth-logger.service</code>. Om loggern körs visar du aktuella händelser med <code>journalctl -u ssh.service -n 50 --no-pager -p info</code> och kontrollerar att journald-tillägget tillåter nivån <em>info</em>.",
+    "monitorEmptyTitle": "ProxMenux Monitor jail har inga poster även efter misslyckade inloggningar",
+    "monitorEmptyBody": "Jailen <code>[proxmenux]</code> läser <code>/var/log/proxmenux-auth.log</code>, som skrivs av Flask-appen ProxMenux Monitor, inte av en journald-logger. Utan Monitor förblir filen tom och jailen utlöses inte. Det är väntat och konfigurationen är ofarlig. Om Monitor körs men loggen är tom kontrollerar du loggningskonfigurationen i Flask.",
+    "selfBanTitle": "Jag har blockerat min egen åtkomst",
+    "selfBanIntro": "Från en konsol / IPMI / iKVM (eller annan vitlistad IP):",
+    "selfBanCode": "fail2ban-client unban '<'YOUR_IP'>'\n\n# To prevent it next time, edit /etc/fail2ban/jail.local and add your IP:\nignoreip = 127.0.0.1/8 ::1 192.168.1.0/24 203.0.113.42\n\n# Then reload\nfail2ban-client reload",
+    "aptFailTitle": "apt-get misslyckas: ''Unable to locate package fail2ban''",
+    "aptFailBody": "Värden saknas Debian repos (gemensamt på barebones Proxmox installationer). Installatören upptäcker detta och skriver <code>/etc/apt/sources.list.d/debian.sources</code> med rätt kodnamn (<code>bookworm</code> / <code>trixie</code>) innan du går tillbaka. Om det fortfarande misslyckas, kontrollera <code>/etc/os-release</code> för <code>VERSION_CODENAME</code> och bekräfta att repo URL är tillgänglig.",
+    "lockoutTitle": "SSH låser mig efter installation",
+    "lockoutBody": "Installationsprogrammet sätter <code>MaxAuthTries=3</code>. Om din lösenordshanterare / agent har flera nycklar kan du överstiga det på ett enda anslutningsförsök. Begränsa nycklarna som erbjuds: <code>ssh -o IdentitiesOnly=yes -i ~/.ssh/specific_key user@host</code>. Eller tillfälligt höja <code>MaxAuthTries</code> i <code>sshd_config</code> medan du debug."
+  },
+  "files": {
+    "heading": "Filer skrivna",
+    "code": "/etc/fail2ban/jail.local                              # global defaults + [sshd]\n/etc/fail2ban/jail.d/proxmox.conf                     # [proxmox]\n/etc/fail2ban/jail.d/proxmenux.conf                   # [proxmenux]\n/etc/fail2ban/filter.d/proxmox.conf                   # auth-failure regex for pvedaemon\n/etc/fail2ban/filter.d/proxmenux.conf                 # auth-failure regex for Monitor\n/etc/systemd/system/proxmox-auth-logger.service       # journal → file (pvedaemon)\n/etc/systemd/system/ssh-auth-logger.service           # journal → file (sshd)\n/etc/systemd/journald.conf.d/proxmenux-loglevel.conf  # MaxLevelStore=info\n/etc/ssh/sshd_config                                  # MaxAuthTries=3 (in-place edit)\n/var/log/proxmox-auth.log                             # written by logger service\n/var/log/ssh-auth.log                                 # written by logger service\n/var/log/proxmenux-auth.log                           # written by Monitor Flask app\n/usr/local/share/proxmenux/sshd_maxauthtries_backup   # for restore on uninstall"
+  },
+  "related": {
+    "heading": "Relaterad",
+    "monitorLabel": "ProxMenux Monitor → Säkerhetsflik",
+    "monitorTail": " — installation via panelen, aktuell jail-status, blockerade IP-adresser och inställning av försök och blockeringstid per jail i webbläsaren.",
+    "lynisLabel": "Lynis",
+    "lynisTail": " — kör en säkerhetsgranskning före och efter för att bekräfta att kontrollen SSH-7408 uppfylls.",
+    "securityLabel": "Säkerhetsöversikt",
+    "securityTail": " - tillbaka till avsnittsöversikten."
+  }
+}
diff --git a/web/messages/sv/docs/security/index.json b/web/messages/sv/docs/security/index.json
new file mode 100644
index 00000000..bf05f49e
--- /dev/null
+++ b/web/messages/sv/docs/security/index.json
@@ -0,0 +1,70 @@
+{
+  "meta": {
+    "title": "Proxmox-säkerhet — Fail2Ban och härdningsgranskning med Lynis | ProxMenux",
+    "description": "Två säkerhetsverktyg för Proxmox VE: Fail2Ban (intrångsskydd för SSH, Proxmox webbgränssnitt och ProxMenux Monitor) och Lynis (säkerhets- och härdningsgranskning installerad från det officiella GitHub-arkivet).",
+    "ogTitle": "Proxmox-säkerhet — Fail2Ban och härdningsgranskning med Lynis",
+    "ogDescription": "Fail2Ban och Lynis för Proxmox VE: intrångsskydd och härdningsgranskning, installerade och hanterade av ProxMenux.",
+    "twitterTitle": "Proxmox säkerhet | ProxMenux",
+    "twitterDescription": "Fail2Ban och Lynis för Proxmox VE: intrångsskydd och härdningsgranskning."
+  },
+  "header": {
+    "title": "Säkerhet",
+    "description": "Två kompletterande verktyg för Proxmox VE: aktivt skydd (Fail2Ban blockerar IP-adresser som angriper SSH eller webbgränssnitt) och lokal granskning (Lynis söker härdningsbrister och ger 0–100 poäng). Varje verktyg har en egen installations- och hanteringsmeny som upptäcker befintliga installationer före varje åtgärd.",
+    "section": "Säkerhet"
+  },
+  "intro": {
+    "title": "Aktivt skydd och lokal granskning",
+    "body": "De besvarar olika frågor. <strong>Fail2Ban</strong> svarar på <em>”Angrips vi just nu?”</em> genom att bevaka autentiseringsloggar och blockera angripande IP-adresser. <strong>Lynis</strong> svarar på <em>”Hur väl härdad är värden?”</em> med en engångsgranskning och konkreta rekommendationer. Använd båda: Lynis visar vad som bör förbättras och Fail2Ban hanterar pågående angrepp."
+  },
+  "opening": {
+    "heading": "Öppna menyn",
+    "body": "Välj <strong>Säkerhet</strong> i ProxMenux huvudmeny. Du får se följande:",
+    "imageAlt": "Säkerhetsmeny med Fail2Ban och Lynis alternativ"
+  },
+  "pick": {
+    "heading": "Välj ditt verktyg",
+    "body": "Verktygen är oberoende: installera ett, båda eller inget. Varje kort nedan leder till avsnittet som förklarar verktyget i detalj."
+  },
+  "cards": {
+    "fail2ban": {
+      "title": "Fail2Ban",
+      "body": "Aktivt intrångsskydd. Bevakar autentiseringsloggar för SSH och webbgränssnitt och blockerar IP-adresser efter upprepade fel.",
+      "bullets": [
+        "Tre jails: SSH, Proxmox UI (8006), ProxMenux Monitor (8008)",
+        "Korrigerar Proxmox standardinställningar för journald som blockerar autentiseringsloggar",
+        "Upptäcker nftables / iptables automatiskt",
+        "SSH härdning: MaxAuthTries=3 (Lynis rekommendation)"
+      ]
+    },
+    "lynis": {
+      "title": "Lynis",
+      "body": "Lokal säkerhetsgranskare. Skannar värden och visar härdningspoäng samt konkreta åtgärdsförslag.",
+      "bullets": [
+        "Installerat från CISOfys officiella GitHub-arkiv (senaste versionen)",
+        "Härdningspoäng 0–100 och lista över varningar och förslag",
+        "Granskning och uppdatering via menyn",
+        "Utformat för enbart läsning: ändrar aldrig systemet"
+      ]
+    }
+  },
+  "workflowTip": {
+    "title": "Arbetsflöde som använder båda",
+    "body": "Kör först Lynis för att se startpoäng och viktigaste rekommendationer. Genomför önskade åtgärder. Installera sedan Fail2Ban: det inför automatiskt SSH-skydd mot lösenordsattacker och anpassar <code>MaxAuthTries</code> i <code>sshd_config</code> till kontrollen SSH-7408. Kör Lynis igen för att bekräfta förbättringen."
+  },
+  "fail2banSection": {
+    "heading": "Fail2Ban",
+    "body": "ProxMenux installerar Fail2Ban med en konfiguration för Proxmox. Utöver standardjailen för SSH skyddas Proxmox webbgränssnitt och ProxMenux Monitor. Två specifika problem hanteras: en standardinställning i journald som släpper autentiseringshändelser och ett problem i systemd-backend som hindrar tillförlitlig läsning av vissa journalkällor. Detaljsidan beskriver installationen, de tre jails, journald-korrigeringen, SSH-härdningen och felsökningen.",
+    "optionTitle": "Fail2Ban – installera och hantera",
+    "optionDescription": "Tre förkonfigurerade jails (aggressivt sshd, Proxmox-gränssnitt på 8006, ProxMenux Monitor på 8008 och omvänd proxy), automatisk nftables/iptables-detektering, journald-korrigering och SSH-härdning med MaxAuthTries."
+  },
+  "lynisSection": {
+    "heading": "Lynis",
+    "body": "ProxMenux klonar Lynis från <code>github.com/CISOfy/lynis</code> till <code>/opt/lynis</code> och gör det tillgängligt som <code>/usr/local/bin/lynis</code>. Debianpaketet undviks avsiktligt eftersom det ligger flera huvudversioner efter originalprojektet. Detaljsidan beskriver installation, granskning, uppdatering, avinstallation, rapportläsning och åtgärder utifrån resultaten.",
+    "optionTitle": "Lynis — installera, granska och hantera",
+    "optionDescription": "Installerar den senaste Lynis från den officiella CISOfy GitHub repo (inte det äldre Debian-paketet), kör systemrevisioner med härdningspoäng och uppdateringar via git pull."
+  },
+  "componentStatus": {
+    "heading": "Komponentstatus",
+    "body": "Båda installatörerna registrerar sitt tillstånd i <code>/usr/local/share/proxmenux/components_status.json</code> under kategorin <code>security</code>. ProxMenux använder den här filen för att bestämma om du vill visa installationen eller menyn för hantering påföljande körningar, och samma data matar instrumentpanelerna i ProxMenux Monitor när de är närvarande."
+  }
+}
diff --git a/web/messages/sv/docs/security/lynis.json b/web/messages/sv/docs/security/lynis.json
new file mode 100644
index 00000000..55e58af0
--- /dev/null
+++ b/web/messages/sv/docs/security/lynis.json
@@ -0,0 +1,170 @@
+{
+  "meta": {
+    "title": "Lynis | ProxMenux-dokumentation",
+    "description": "Installera senaste Lynis från CISOfys officiella GitHub-arkiv, kör en säkerhetsgranskning med härdningspoäng 0–100 och uppdatera med git pull. Utformat för enbart läsning, utan systemändringar.",
+    "ogTitle": "Lynis | ProxMenux-dokumentation",
+    "ogDescription": "Installera och kör säkerhetsgranskaren Lynis på Proxmox VE. Installation från det officiella GitHub-arkivet, granskning och uppdatering."
+  },
+  "header": {
+    "title": "Lynis",
+    "description": "Klonar senaste Lynis från CISOfys officiella GitHub-arkiv, gör det tillgängligt som /usr/local/bin/lynis och erbjuder granskning, uppdatering, ominstallation och avinstallation via menyn. Granskaren läser bara och rapporterar utan att ändra systemet.",
+    "section": "Säkerhet"
+  },
+  "intro": {
+    "title": "Vad detta gör",
+    "body": "Installerar Lynis, CISOfys säkerhetsgranskare med öppen källkod, från dess GitHub-arkiv till <code>/opt/lynis</code> och skapar ett startskript i <code>/usr/local/bin/lynis</code> så att det nås via <code>PATH</code>. En befintlig installation ger i stället en meny för granskning, uppdatering, ominstallation eller borttagning."
+  },
+  "manageMenu": {
+    "heading": "Hanteringsmeny (efter installation)",
+    "intro": "Efter installationen öppnar varje nytt anrop hanteringsmenyn. Där kan du starta en granskning, uppdatera med git pull, installera om eller avinstallera.",
+    "imageAlt": "Lynis management meny med revision, uppdatering, ominstallera och ta bort alternativ"
+  },
+  "whyUpstream": {
+    "heading": "Varför det officiella GitHub-arkivet i stället för apt",
+    "intro": "Debian erbjuder Lynis via apt, men paketet ligger vanligtvis flera huvudversioner efter originalprojektet. Nya kontroller, åtgärder för nya angreppssätt och förbättrade rekommendationer kommer först till GitHub. Lynis är ett fristående skalskript utan kompilering eller installationsberoenden utöver <code>git</code>; kloning av arkivet är därför metoden CISOfy rekommenderar.",
+    "headerSource": "Källa",
+    "headerPath": "Install path",
+    "headerUpdate": "Uppdateringsmetod",
+    "headerFresh": "Versionens aktualitet",
+    "rows": [
+      {
+        "sourceRich": "<strong>ProxMenux (detta manus) </strong>",
+        "path": "/opt/lynis/",
+        "update": "git pull (via menyn)",
+        "fresh": "Senaste versionen av originalprojektet"
+      },
+      {
+        "sourceRich": "<strong>Debian apt</strong>",
+        "path": "/usr/bin/lynis",
+        "update": "apt upgrade",
+        "fresh": "Ofta månader / år bakom"
+      }
+    ]
+  },
+  "install": {
+    "heading": "Hur installationen fungerar",
+    "node1Label": "github.com/CISOfy/lynis",
+    "node1Detail": "git clone\n(installera git först om det saknas)",
+    "node2Label": "/opt/lynis/",
+    "node2Detail": "hela arkivet\ninklusive skriptet ./lynis",
+    "node3Label": "/usr/local/bin/lynis",
+    "node3Detail": "wrapper:\ncd /opt/lynis && ./lynis $@",
+    "outro": "Wrapper är obligatorisk - Lynis insisterar på att köras från sin egen katalog eftersom det laddar relativa vägar för plugins och profildata. Wrapper döljer den detaljen så <code>lynis audit system</code> fungerar bara från var som helst."
+  },
+  "detection": {
+    "heading": "Detektering vägar",
+    "intro": "Innan du visar menyn kontrollerar manuset tre platser för att avgöra om Lynis redan är närvarande:",
+    "items": [
+      "<code>/usr/local/bin/lynis</code> Wrapper installerad av ProxMenux",
+      "<code>/opt/lynis/lynis</code> - direkt väg (om wrapperen togs bort)",
+      "<code>/usr/bin/lynis</code> apt-installerad version, om användaren installerade den på det sättet tidigare"
+    ],
+    "outro": "Om någon av sökvägarna hittas öppnas hanteringsmenyn. Skriptet avinstallerar <strong>inte</strong> Lynis som installerats via apt, bara den egna installationen i <code>/opt/lynis</code> och dess startskript."
+  },
+  "audit": {
+    "heading": "Kör en revision",
+    "intro": "Välj <strong>Kör säkerhetsgranskning nu</strong> i hanteringsmenyn. Det motsvarar att köra:",
+    "code": "lynis audit system --no-colors",
+    "outro": "Granskningen tar 30 sekunder till några minuter beroende på värdens storlek. Utdata visas direkt i terminalen utan väntanimation. Lynis grupperar kontroller efter kategori och märker varje test med <ok>[ OK ]</ok>, <warn>[ WARNING ]</warn> eller <sugg>[ SUGGESTION ]</sugg>. Slutets sammanfattning visar de viktigaste siffrorna:",
+    "summary": "================================================================================\n\n  Lynis security scan details:\n\n  Hardening index : 76 [############        ]\n  Tests performed : 247\n  Plugins enabled : 0\n\n  Components:\n  - Firewall               [V]\n  - Malware scanner        [X]\n\n  Lynis modules:\n  - Compliance status      [?]\n  - Security audit         [V]\n  - Vulnerability scan     [V]\n\n================================================================================"
+  },
+  "report": {
+    "heading": "Läsa rapporten",
+    "intro": "De två viktiga avsnitten är <strong>Warnings</strong> (saker du bör fixa snart) och <strong>Suggestions</strong> (rekommendationer för att förbättra härdning). Varje objekt bär ett kontroll-ID som <code>SSH-7408</code> - användbart när du söker Lynis-dokumenten för motiveringen och fixen.",
+    "headerMarker": "Markör",
+    "headerMeaning": "Betydelse",
+    "headerAction": "Handling",
+    "rows": [
+      {
+        "markerRich": "<strong>OK</strong>",
+        "meaning": "Test passerade",
+        "action": "Ingenting"
+      },
+      {
+        "markerRich": "<strong>WARNING</strong>",
+        "meaning": "Verklig fråga, fix rekommenderad",
+        "action": "Läs kontrollbeskrivningen, planera en fix"
+      },
+      {
+        "markerRich": "<strong>SUGGESTION</strong>",
+        "meaning": "Hardening förbättring tillgänglig",
+        "action": "Tillämpa om det passar din hotmodell"
+      }
+    ],
+    "outro": "Fullständig rapport och maskinläsbara data skrivs till <code>/var/log/lynis.log</code> och <code>/var/log/lynis-report.dat</code> av Lynis själv."
+  },
+  "pairFail2ban": {
+    "title": "Kombinera med Fail2Ban",
+    "body": "SSH-7408 (MaxAuthTries) är en av de vanligaste varningarna. Installera <link>Fail2Ban</link> från ProxMenux rensar det automatiskt eftersom installationsprogrammet sätter <code>MaxAuthTries=3</code> som en del av dess SSH härdning steg. Kör Lynis igen efteråt för att bekräfta varningen är borta."
+  },
+  "update": {
+    "heading": "Uppdatering Lynis",
+    "body": "I menyn kör <strong>Uppdatera Lynis till senaste versionen</strong> kommandot <code>git pull --quiet</code> i <code>/opt/lynis</code>. Om katalogen finns men inte är en Git-arbetskopia, exempelvis efter manuell filkopiering, gör skriptet en fullständig ominstallation."
+  },
+  "reinstall": {
+    "heading": "Installera om / avinstallera",
+    "headerAction": "Handling",
+    "headerWhat": "Vad det gör",
+    "rows": [
+      {
+        "actionRich": "<strong>Installera om</strong>",
+        "whatRich": "Tar bort <code>/opt/lynis</code>, klonar igen från GitHub och återskapar startskriptet. Använd om den lokala arbetskopian är skadad."
+      },
+      {
+        "actionRich": "<strong>Ta bort</strong>",
+        "whatRich": "Ta bort <code>/opt/lynis</code> och <code>/usr/local/bin/lynis</code>. Loggar på <code>/var/log/lynis*</code> hålls (de är revisionshistorik). En apt-installerad Lynis på <code>/usr/bin/lynis</code> lämnas orörd."
+      }
+    ]
+  },
+  "cli": {
+    "heading": "Användbara CLI-alternativ",
+    "intro": "Efter installationen kan Lynis köras direkt från ett skal med extra alternativ som inte visas i menyn:",
+    "code": "lynis show version            # version + build date\nlynis show commands           # list every available command\nlynis show details TEST-ID    # explain a specific control\nlynis audit system --quick    # skip slow tests (e.g. malware scan)\nlynis audit system --pentest  # treat host as untrusted (more aggressive)\nlynis update info             # check if a newer Lynis is available\n\n# Filter the report log for just the warnings\ngrep \"Warning\" /var/log/lynis.log\n\n# Same, for suggestions only\ngrep \"Suggestion\" /var/log/lynis.log"
+  },
+  "troubleshoot": {
+    "heading": "Felsökning",
+    "cloneTitle": "git clone misslyckas under installationen",
+    "cloneBody": "Värden behöver nätverksåtkomst och DNS för att nå <code>github.com</code>. Från en konsol: <code>curl -sI https://github.com</code> och <code>git ls-remote https://github.com/CISOfy/lynis.git</code> kommer att avslöja det faktiska felet (DNS, TLS, proxy, repo URL). Om en proxy krävs, sätt <code>https_proxy</code> i miljön innan du kör menyn.",
+    "notFoundTitle": "lynis: kommandot som inte hittats efter installation",
+    "notFoundIntro": "Startskriptet <code>/usr/local/bin/lynis</code> skapades inte eller har tagits bort. Snabbaste lösningen är att installera om via menyn. Manuell lösning:",
+    "notFoundCode": "cat > /usr/local/bin/lynis <<'EOF'\n#!/bin/bash\ncd /opt/lynis && ./lynis \"$@\"\nEOF\nchmod +x /usr/local/bin/lynis",
+    "sshTitle": "Granskningen visar \"Warning: Test SSH-7408 — MaxAuthTries set incorrectly\"",
+    "sshIntro": "SSH daemon tillåter för många auth försök per anslutning. Antingen installera <link>Fail2Ban</link> från ProxMenux (som sätter <code>MaxAuthTries=3</code> automatiskt) eller redigera <code>/etc/ssh/sshd_config</code> för hand:",
+    "sshCode": "sed -i 's/^#?MaxAuthTries.*/MaxAuthTries 3/' /etc/ssh/sshd_config\nsystemctl reload sshd",
+    "scoreTitle": "Score gick ner efter en Proxmox uppgradering",
+    "scoreBody": "Kör <code>lynis update info</code> först - en Lynis-uppdatering kan ha lagt till nya kontroller som flaggar befintlig konfig. Uppdatera Lynis från menyn, re-audit och adressera de nya resultaten."
+  },
+  "files": {
+    "heading": "Filer skrivna",
+    "code": "/opt/lynis/                   # full Lynis git checkout\n/usr/local/bin/lynis          # wrapper script (cd + exec)\n/var/log/lynis.log            # human-readable audit log (Lynis itself)\n/var/log/lynis-report.dat     # machine-readable report (Lynis itself)"
+  },
+  "sample": {
+    "heading": "Provrapport",
+    "intro": "ProxMenux Monitor skapar en flersidig PDF för varje Lynis-körning via <link>fliken Säkerhet</link>. Första sidan sammanfattar härdningspoäng, systeminformation och säkerhetsläge. Följande sidor förklarar varje varning, listar förslag efter påverkan och visar paketinventeringen som användes vid granskningen.",
+    "imageAlt": "Första sidan av Lynis Security Audit Report PDF - verkställande sammanfattning med Hardening Index 71/100, systeminformationsblock och säkerhetsställningsöversikt med brandvägg, malware scanner och installerade paket räknas",
+    "captionPrefix": "Första sidan i en exempelrapport. Hela PDF-filen (",
+    "captionLink": "exempel",
+    "captionSuffix": ") fortsätter med detaljerade varningar, förslag och listan över installerade paket.",
+    "cli": "På CLI-sidan är samma data i <code>/var/log/lynis-report.dat</code> (maskinläsbar plattfil) och <code>/var/log/lynis.log</code> (den mänskliga läsbara körloggen). PDF genereras på begäran av ProxMenux Monitor - kör <code>lynis</code> från kommandoraden producerar inte en."
+  },
+  "related": {
+    "heading": "Relaterad",
+    "items": [
+      {
+        "href": "/docs/monitor/dashboard/security",
+        "label": "ProxMenux Monitor → Säkerhetsflik",
+        "tail": " - köra revisionen, bläddra i historiska rapporter och ladda ner PDF direkt från instrumentbrädan."
+      },
+      {
+        "href": "/docs/security/fail2ban",
+        "label": "Fail2Ban",
+        "tailRich": " - implementerar SSH brute-force skydd som Lynis rekommenderar."
+      },
+      {
+        "href": "/docs/security",
+        "label": "Säkerhetsöversikt",
+        "tail": " - tillbaka till avsnittsöversikten."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sv/docs/security/ssl-letsencrypt.json b/web/messages/sv/docs/security/ssl-letsencrypt.json
new file mode 100644
index 00000000..7d11d70d
--- /dev/null
+++ b/web/messages/sv/docs/security/ssl-letsencrypt.json
@@ -0,0 +1,169 @@
+{
+  "meta": {
+    "title": "HTTPS för ProxMenux Monitor — Proxmox-värdcertifikat eller anpassade sökvägar | ProxMenux",
+    "description": "Tillhandahåll ProxMenux Monitor via HTTPS med Proxmox-värdens automatiskt upptäckta certifikat, inklusive Let’s Encrypt installerat via Proxmox ACME, eller ett eget certifikat på valfri sökväg på disken.",
+    "ogTitle": "HTTPS för ProxMenux Monitor - Proxmox värd eller anpassat certifikat",
+    "ogDescription": "Aktivera HTTPS på port 8008 med Proxmox värdcertifikat eller någon anpassad .pem / .key par."
+  },
+  "header": {
+    "title": "HTTPS för ProxMenux Monitor",
+    "description": "Aktivera HTTPS för Monitor på port 8008 med det automatiskt upptäckta Proxmox-värdcertifikatet eller ett eget certifikat på disken. Proxmox-alternativet föredrar ACME-certifikatet om det finns och återanvänder Let’s Encrypt som Proxmox hanterar utan en extra förnyelseuppgift.",
+    "section": "Säkerhet"
+  },
+  "intro": {
+    "title": "Vad denna sida täcker",
+    "body": "Hur man byter Monitor från HTTP till HTTPS i Inställningarna → Säkerhetspanel, vad varje certifikatkälla faktiskt pekar på på disken, hur Proxmox-alternativet beter sig när värden har en Let's Encrypt-cert och hur man ställer in anpassade vägar om du hanterar certer utanför Proxmox."
+  },
+  "wheresetting": {
+    "heading": "Var inställningen finns",
+    "body": "Öppna Monitor och gå till <strong>Inställningar → Säkerhet → HTTPS / SSL</strong>. Panelen visar HTTP eller HTTPS och, om HTTPS inte aktiverats, de upptäckta certifikatkällorna.",
+    "imageAlt": "Inställningar → Säkerhet → HTTPS / SSL-panelen i Monitorn som visar HTTPS-off-tillståndet, det automatiska upptäckta Proxmox-certifikatet (ämne, emittent, utgång) och alternativet Använd anpassat certifikat",
+    "caption": "Panelen Inställningar → Säkerhet → HTTPS / SSL före aktivering. Monitor visar certifikatet som Proxmox använder och låter dig välja det med ett klick."
+  },
+  "twoways": {
+    "heading": "Två sätt att aktivera HTTPS",
+    "proxmox": {
+      "title": "Använd Proxmox-certifikat",
+      "summary": "Ett klick: Monitor återanvänder certifikatet som Proxmox VE presenterar på port 8006.",
+      "items": [
+        "Upptäcks automatiskt, ingen sökväg att skriva",
+        "Föredrar ACME-certifikatet om det finns, annars det självsignerade standardcertifikatet",
+        "Proxmox sköter förnyelsen; Monitor validerar och laddar certifikatet vid nästa nya TLS-anslutning"
+      ]
+    },
+    "custom": {
+      "title": "Använd anpassat certifikat",
+      "summaryRich": "Peka monitorn på ett <code>.pem</code> / <code>.key</code>-par var som helst på disken.",
+      "items": [
+        "Absoluta vägar (övervakningsprocessen måste kunna läsa båda)",
+        "Användbara när certerna kommer från <code>certbot</code>, <code>acme.sh</code> eller ett wildcard",
+        "Du ansvarar för förnyelsen: starta om Monitor när filerna ändras"
+      ]
+    }
+  },
+  "proxmoxCert": {
+    "heading": "Proxmox-certifikat - vad det faktiskt pekar på",
+    "intro": "Proxmox VE håller två certifikatpar i <code>/etc/pve/local/</code>:",
+    "table": {
+      "headers": {
+        "file": "Fil",
+        "origin": "Ursprung",
+        "when": "När monitorn använder den"
+      },
+      "rows": [
+        {
+          "fileRich": "<code>pveproxy-ssl.pem</code><br /><code>pveproxy-ssl.key</code>",
+          "originRich": "Anpassade certifikat som laddats upp via Proxmox UI - inklusive Let's Encrypt-certifikatet som utfärdats under <em>Datacenter → Node → Certifikat → ACME</em>.",
+          "when": "Föredras när båda filerna finns; Monitor använder certifikatet som Proxmox presenterar."
+        },
+        {
+          "fileRich": "<code>pve-ssl.pem</code><br /><code>pve-ssl.key</code>",
+          "originRich": "Självsignerat certifikat som genereras vid installationstid av Proxmox PKI.",
+          "whenRich": "Fallback när ingen <code>pveproxy-ssl.pem</code> finns."
+        }
+      ]
+    },
+    "callout": {
+      "title": "Samma prioritet som Proxmox själv",
+      "bodyRich": "<code>pveproxy</code> använder samma urvalsregel. Med Proxmox-alternativet använder Monitor certifikatet som Proxmox webbgränssnitt presenterar på 8006, utan kopiering eller separat förnyelseflöde."
+    }
+  },
+  "letsencrypt": {
+    "heading": "Få ett Let's Encrypt-certifikat via Proxmox ACME",
+    "intro": "Proxmox VE innehåller en egen ACME-klient. <em>”Order Certificate Now”</em> sparar resultatet i <code>/etc/pve/local/pveproxy-ssl.pem</code>, som Monitor läser. Följande fem steg sammanfattar <extlink1>Proxmox officiella guide</extlink1> i kommandona som behövs.",
+    "prereqs": {
+      "title": "Förutsättningar",
+      "items": [
+        "Noden har ett riktigt DNS-namn (inte bara en IP) som pekar på det.",
+        "<strong>Antingen</strong> port 80 nåbar från Internet (HTTP-01-validering, enklast), <strong>eller</strong> en DNS-leverantör med API-uppgifter (DNS-01, fungerar bakom NAT och stöder wildcard-certifikat).",
+        "En e-postadress för ACME-kontot."
+      ]
+    },
+    "step1": {
+      "heading": "Steg 1 - Registrera ACME-kontot",
+      "introRich": "Ersätt e-post med din. Kontonamnet <code>default</code> är bara en etikett - du kan använda någon sträng.",
+      "code": "pvenode acme account register default you@example.com",
+      "afterRich": "Proxmox uppmanar dig att acceptera Let's Encrypt användarvillkor. Därefter kvarstår kontot under <code>/etc/pve/priv/acme/</code> och fliken ACME i GUI kommer att visa det."
+    },
+    "step2": {
+      "heading": "Steg 2 — Välj valideringstyp",
+      "http01Rich": "<strong>HTTP-01</strong> är den enklaste: den är inbyggd, ingen extra plugin. Let's Encrypt ansluter till <code>http://&lt;your-host&gt;/.well-known/acme-challenge/...</code> på port 80, så port 80 måste vara öppen från det offentliga internet till din nod - vanligtvis en port framåt på din router.",
+      "dns01Rich": "<strong>DNS-01</strong> fungerar utan att exponera port 80 (bra för homelabs bakom CG-NAT) och är det enda alternativet för wildcard certifikat. Du lägger till en DNS plugin en gång med din leverantörs API-token. Cloudflare exempel:",
+      "code": "pvenode acme plugin add dns cf \\\n  --api cloudflare \\\n  --data CF_Token=YOUR_CLOUDFLARE_API_TOKEN",
+      "outroRich": "För andra leverantörer (Gandi, OVH, AWS Route 53 osv.) se <code>pvenode acme plugin add dns --help</code>. Proxmox innehåller <extlink2>alla DNS-insticksmoduler från acme.sh</extlink2>."
+    },
+    "step3": {
+      "heading": "Steg 3 - Bind domänen till din nod",
+      "http01Rich": "För HTTP-01 (använder den inbyggda <code>standalone</code> plugin):",
+      "code1": "pvenode config set --acme domains=host.example.com,account=default",
+      "dns01": "För DNS-01 med Cloudflare plugin från Step 2:",
+      "code2": "pvenode config set --acmedomain0 domain=host.example.com,plugin=cf\npvenode config set --acme account=default",
+      "wildcardRich": "Wildcard? Lägg till <code>domain=*.example.com</code> på en separat <code>--acmedomainN</code>-post. Wildcards kräver DNS-01."
+    },
+    "step4": {
+      "heading": "Steg 4 - Beställ certifikatet",
+      "code": "pvenode acme cert order",
+      "afterRich": "Första körningen tar vanligtvis 30-60 sekunder medan utmaningen sprider sig. På framgång Proxmox skriver <code>/etc/pve/local/pveproxy-ssl.pem</code> + <code>.key</code>, startar <code>pveproxy</code>, och en förnyelsekrona schemaläggs automatiskt (Let's Encrypt certs är giltiga 90 dagar; Proxmox förnyar på 60)."
+    },
+    "step5": {
+      "heading": "Steg 5 - Verifiera emittenten",
+      "code": "openssl x509 -in /etc/pve/local/pveproxy-ssl.pem -noout -issuer",
+      "afterRich": "Bör skriva ut en emittent som börjar med <code>O = Let's Encrypt</code>. Om det i stället läser <code>CN = Proxmox Virtual Environment</code> misslyckades ordern och filen är fortfarande den självsignerade PVE-certen - kör <code>pvenode acme cert order --debug 1</code> för att se varför."
+    },
+    "gui": {
+      "title": "Föredrar GUI? Samma fem steg",
+      "bodyRich": "<em>Datacenter → ACME</em> registrerar kontot; <em>Datacenter → ACME → Plugins</em> lägger till DNS-insticksmodulen; <em>Node → Certificates → ACME</em> kopplar domänen; <em>Order Certificates Now</em> kör steg 4. Kommandona ovan passar för skript och system utan grafiskt gränssnitt."
+    }
+  },
+  "switchToHttps": {
+    "heading": "Byt Monitor till HTTPS",
+    "bodyRich": "När <code>/etc/pve/local/pveproxy-ssl.pem</code> signerats av Let's Encrypt öppnar du <strong>Inställningar → Säkerhet → HTTPS / SSL</strong>, kontrollerar att utfärdaren är <em>Let's Encrypt</em> och inte Proxmox lokala CA och klickar på <strong>Använd Proxmox-certifikat</strong>. Monitor startar om och nästa sidladdning använder HTTPS på 8008 med en offentligt betrodd certifikatkedja. Senare ACME-förnyelser valideras och väljs vid nästa nya TLS-anslutning, utan återkommande avfrågning eller omstart vid förnyelse. <strong>Uppdatera certifikat</strong> finns kvar under Säkerhet för diagnos och återställning."
+  },
+  "custom": {
+    "heading": "Anpassat certifikat - när du ska använda det",
+    "intro": "Klicka på <strong>Använd anpassat certifikat</strong> och ange två absoluta sökvägar:",
+    "items": [
+      "<strong>Certifikat</strong>: hela kedjan i PEM-format (<code>.pem</code> eller <code>.crt</code>).",
+      "<strong>Privat nyckel</strong>: matchande nyckel i PEM-format (<code>.key</code>)."
+    ],
+    "outro": "Båda filerna läses av Monitor-processen vid start. De måste kunna läsas av användaren som systemd-enheten körs som (root som standard). Vanliga sökvägar när ACME hanteras utanför Proxmox:",
+    "code": "# certbot\n/etc/letsencrypt/live/<your-host>/fullchain.pem\n/etc/letsencrypt/live/<your-host>/privkey.pem\n\n# acme.sh\n~/.acme.sh/<your-host>_ecc/fullchain.cer\n~/.acme.sh/<your-host>_ecc/<your-host>.key",
+    "symlinkCallout": {
+      "title": "Symlink mål vs. filer",
+      "bodyRich": "<code>certbot</code> lagrar de faktiska filerna i <code>/etc/letsencrypt/archive/</code> och <code>live/</code>-vägen är en symlänk. Peka Monitorn på <code>live/</code> symlink, inte <code>archive/</code>-filen - på så sätt omskriver varje förnyelsecykel helt enkelt symlinkmålet och Monitorn plockar upp den nya certen vid nästa servicestart."
+    }
+  },
+  "afterHttps": {
+    "heading": "Efter att ha aktiverat HTTPS",
+    "bodyRich": "Att spara förändringen skriver <code>/etc/proxmenux/ssl_config.json</code> och utlöser en omstart av <code>proxmenux-monitor</code> systemd-enheten. Fliken webbläsare kommer att förlora sin nuvarande anslutning - ladda den på <code>https://&lt;host&gt;:8008/</code>. Den första belastningen med en Let's Encrypt-cert bör inte visa någon varning; med Proxmox självsignerad cert kommer webbläsaren att kräva ett undantag, samma som för port 8006.",
+    "reverse": {
+      "heading": "Omvända proxyservrar och webhooks",
+      "bodyRich": "När Monitorn byter till HTTPS, Proxmox VE webhook URL-adresser registrerade för meddelanden också vända från <code>http://</code> till <code>https://</code> automatiskt. Befintliga webhook-poster skrivs om nästa gång en anmälningsregel sparas eller återupptäcks, så ingen manuell redigering av Proxmox-meddelandekonfig behövs."
+    }
+  },
+  "trustCa": {
+    "heading": "Lita på Proxmox självsignerade CA",
+    "intro1Rich": "För att behålla Proxmox standardcertifikat utan ACME importerar du klustrets rot-CA i systemets eller webbläsarens betrodda certifikatlager. Monitor upptäcker <code>/etc/pve/local/pve-ssl.pem</code> som reservcertifikat. Klienten litar då på utfärdaren; URL:en måste fortfarande matcha ett namn i certifikatet.",
+    "intro2Rich": "CA-filen bor på <code>/etc/pve/pve-root-ca.pem</code> på varje nod. I ett kluster är vägen på det delade <code>pmxcfs</code>-filsystemet så att alla noder delar samma rot, och en enda import täcker hela datacentret. Kopiera den till din maskin:",
+    "code": "scp root@<your-host>:/etc/pve/pve-root-ca.pem ./pve-root-ca.pem",
+    "thenImport": "Importera sedan den på klientsidan:",
+    "items": [
+      "<strong>Linux (hela systemet):</strong> kör <code>sudo cp pve-root-ca.pem /usr/local/share/ca-certificates/pve-root-ca.crt</code> följt av <code>sudo update-ca-certificates</code>. Webbläsare med systemets certifikatlager (Chromium, Edge) känner igen CA:n efter omstart; Firefox har ett eget lager och behöver den manuella importen nedan.",
+      "<strong>macOS:</strong> dubbelklicka på <code>.pem</code>-filen i Nyckelhanterare, lägg till den i nyckelringen <em>System</em> och välj <em>Lita på → Lita alltid på</em>.",
+      "<strong>Windows:</strong> högerklicka på filen → <em>Installera certifikat</em> → placera det i <em>Betrodda rotcertifikatutfärdare</em>.",
+      "<strong>Firefox (alla operativsystem):</strong> <em>Inställningar → Sekretess och säkerhet → Certifikat → Visa certifikat → Certifikatutfärdare → Importera</em>; markera <em>Lita på denna CA för att identifiera webbplatser</em>."
+    ],
+    "standalone": {
+      "title": "Standalone noder utanför ett kluster",
+      "bodyRich": "Varje icke-klustrerad Proxmox värd har sin egen <code>pve-root-ca.pem</code>. Om du hanterar flera fristående värdar, upprepa kopian/importen för varje eller gå med dem till ett kluster så att de delar en enda rot."
+    }
+  },
+  "disable": {
+    "heading": "Inaktivera HTTPS",
+    "bodyRich": "Klicka på <strong>Inaktivera HTTPS</strong> i samma panel. Monitor startar om med okrypterad HTTP, användbart om ett oläsbart eget certifikat hindrar tjänsten från att starta. Ingen separat avinstallation krävs och certifikatfilerna ändras inte.",
+    "stateCallout": {
+      "title": "Var tillståndet lagras",
+      "bodyRich": "<code>/etc/proxmenux/ssl_config.json</code> lagrar de aktiva certvägarna och källan (<code>none</code>, <code>proxmox</code>, <code>custom</code>). Radera filen är likvärdig med att inaktivera HTTPS - nästa start faller Monitor tillbaka till HTTP."
+    }
+  }
+}
diff --git a/web/messages/sv/docs/settings/beta-program.json b/web/messages/sv/docs/settings/beta-program.json
new file mode 100644
index 00000000..ed5b438f
--- /dev/null
+++ b/web/messages/sv/docs/settings/beta-program.json
@@ -0,0 +1,113 @@
+{
+  "meta": {
+    "title": "Byt versionskanal | ProxMenux-dokumentation",
+    "description": "Växla mellan ProxMenux-kanalerna Stable (main) och Beta (develop) i en dialogruta. Dubbelriktat och idempotent; kör den officiella installeraren för vald kanal och normaliserar Monitor-tjänsten.",
+    "ogTitle": "Byt versionskanal | ProxMenux-dokumentation",
+    "ogDescription": "Ett alternativ i Inställningar för att växla mellan Stable och Beta utan att köra installerare manuellt."
+  },
+  "header": {
+    "title": "Byt versionskanal",
+    "description": "Ett gemensamt alternativ i Inställningar växlar ProxMenux mellan Stable (grenen main) och Beta (grenen develop). Det tidigare enkelriktade ”Inaktivera betaprogram” har ersatts av en dubbelriktad dialog som erbjuder båda riktningarna och kör den officiella installeraren för vald kanal.",
+    "section": "Inställningar"
+  },
+  "intro": {
+    "title": "Vad förändrats",
+    "body": "Tidigare fanns två flöden: ”Inaktivera betaprogram”, bara synligt med aktiv beta, och en manuell omkörning av betainstalleraren för att gå med igen. De har slagits ihop till <strong>Byt versionskanal</strong>, som alltid visas, anger aktuell kanal och låter dig växla mellan Stable och Beta i båda riktningarna."
+  },
+  "why": {
+    "heading": "Varför det här alternativet finns",
+    "intro": "ProxMenux distribueras från två Git-grenar:",
+    "items": [
+      "<strong>Stable</strong>: grenen <code>main</code>, som README länkar till och som de flesta administratörer föredrar. Versionerna släpps mer sällan och innehåller bara ändringar som redan validerats i beta.",
+      "<strong>Beta</strong>: grenen <code>develop</code>. Nyare funktioner och Monitor-byggen med taggen som nästa stabila version ärver. Vissa saker kan fungera bristfälligt; genom att välja kanalen deltar du i testerna före lansering."
+    ],
+    "outro": "Tidigare behövde du hitta rätt installationsadress i README och redigera <code>config.json</code> manuellt om något blev osynkroniserat. Det gemensamma alternativet utför hela flödet som en enda guidad åtgärd."
+  },
+  "dialog": {
+    "heading": "Dialogen",
+    "intro": "I huvudmenyn: <strong>Inställningar → Byt versionskanal</strong>. En meny med två rader visas:",
+    "options": [
+      "<code>stable</code> — Stable (grenen main)",
+      "<code>beta</code> — Beta (grenen develop)"
+    ],
+    "behaviour": "Aktuell kanal är förvald och visas högst upp. Samma val visar ”Den här versionskanalen är redan aktiv”; dialogen är idempotent. En annan kanal visar en bekräftelse med kanalspecifik text:",
+    "directions": [
+      "<strong>Stable → Beta:</strong> varnar för att betaversioner kan innehålla fel eller ofullständiga funktioner.",
+      "<strong>Beta → Stable:</strong> varnar för att beta-uppdateringskontroller kommer att sluta och den stabila installatören kommer att installera om Stable-kanalkomponenterna."
+    ]
+  },
+  "confirm": {
+    "heading": "Vad händer när du bekräftar",
+    "items": [
+      "<strong>Laddar ned den officiella installeraren</strong> för målkanalen:<ul><li>Stable: <code>install_proxmenux.sh</code> från <code>main</code></li><li>Beta: <code>install_proxmenux_beta.sh</code> från <code>develop</code></li></ul>Kontrollerar att filen finns och gör den körbar före nästa steg.",
+      "<strong>Kör hela installeraren</strong>, samma som README länkar till. Komponentdetektering, säkerhetskopior, installation av beroenden och bevarande av språk följer målkanalens officiella installationsflöde.",
+      "När du byter till <strong>Stable</strong>, menyn sedan beskär någon överbliven beta metadata från <code>config.json</code>: <code>beta_program</code>, <code>beta_version</code>, <code>install_branch</code>, <code>update_available.beta*</code> raderas, och <code>proxmenux_monitor.status = beta_updated</code> normaliseras till <code>updated</code>. Den överblivna <code>beta_version.txt</code>-filen och alla nedladdade beta-installatörer tas bort.",
+      "Vid byte till Stable skrivs Monitors systemd-enhet om från Stable-mallen: ”Beta” tas bort ur beskrivningen och <code>ExecStart</code> pekar åter på körningskatalogen. En ny <code>systemctl status</code> visar då aktuell kanal.",
+      "Laddar om konfigurationsmenyn. <em>Visa versionsinformation</em> visar sedan den nya kanalen."
+    ]
+  },
+  "switching": {
+    "heading": "Växla fram och tillbaka",
+    "intro": "Båda riktningarna går igenom samma installationsprogram – de är <strong>inte</strong> specialcase avinstallations- + ominstallationsflöden. Varje riktning kör helt enkelt kanalens eget installationsprogram, som är designat för att vara idempotent och säkert att köra om över en befintlig installation. Praktiska konsekvenser:",
+    "items": [
+      "Din befintliga konfig, ProxMenux Monitor inloggning (<code>auth.json</code>), meddelandekanaler, post-install registret, anpassade trösklar - ingen av dem berörs. Kanalbrytaren byter bara skriptträdet och den binära AppImage.",
+      "En Monitor som var aktiv före bytet är aktiv även efteråt; en inaktiverad Monitor förblir inaktiverad.",
+      "ProxMenux Monitors <code>auth.json</code>, API-token och JWT-hemlighet bevaras vid kanalbyten. Sessionerna loggas inte ut.",
+      "Du kan vända kanaler så många gånger du vill - dialogrutan accepterar det varje gång och kör installationsprogrammet. Ingen omstart av Proxmox krävs.",
+      "Kanalbytet ersätter ProxMenux-skripten och kan inte köras i Monitors webbläsarterminal: PTY:n skulle stängas mitt i uppdateringen och lämna dialogen avbruten. Där visas i stället ett informationsfönster med det officiella enradsinstallationskommandot för målkanalen. Kör det via SSH eller Proxmox-värdens konsol."
+    ]
+  },
+  "feedback": {
+    "heading": "Rapportera problem i beta",
+    "intro": "Om något beter sig oväntat medan du är på Beta-kanalen, öppnar ett problem med tillräckligt sammanhang är det som stänger klyftan till en stabil release. Den mest användbara rapporten inkluderar:",
+    "items": [
+      "Vad du gjorde och vad du förväntade dig att hända.",
+      "Alla felmeddelanden som visas på skärmen.",
+      "De relevanta övervakningsloggarna:"
+    ],
+    "logsCommand": "journalctl -u proxmenux-monitor -n 50 --no-pager",
+    "versionLine": "Aktuell ProxMenux-version (Inställningar → <link>Visa versionsinformation</link>).",
+    "issueLine": "Öppna en <ghlink>GitHub Issue</ghlink> med den informationen och vi kommer till rätta snabbare."
+  },
+  "manual": {
+    "heading": "Manuell motsvarighet",
+    "intro": "Om du föredrar skalet eller automatiserar kanalbytet är det dessa kommandon dialogen kör:"
+  },
+  "unifiedCallout": {
+    "title": "Varför båda riktningarna nu är ett alternativ",
+    "body": "Det tidigare ”Inaktivera betaprogram” visades bara efter att värden gått med i beta. För att <em>gå med</em> fick man söka installeraren någon annanstans; för att <em>lämna</em> behövde man ibland rensa <code>beta_*</code>-metadata manuellt. <strong>Byt versionskanal</strong> visas alltid, anger aktuell kanal och hanterar båda riktningarna som en körbar, upprepningsbar och idempotent operation."
+  },
+  "troubleshoot": {
+    "heading": "Felsökning",
+    "downloadTitle": "\"Kan inte ladda ner installationsprogrammet\"",
+    "downloadBody": "Utgående HTTPS till <code>raw.githubusercontent.com</code> misslyckades. Kontrollera anslutning och DNS från värden:",
+    "downloadCmd": "curl -fsSL -o /tmp/test https://raw.githubusercontent.com/MacRimi/ProxMenux/main/install_proxmenux.sh && head -1 /tmp/test",
+    "downloadOutro": "Om detta misslyckas utanför ProxMenux är det ett nätverk / proxyproblem på värden.",
+    "errorsTitle": "\"Installer slutade med fel\"",
+    "errorsBody": "Installeraren returnerade en slutkod som inte är noll. Ingen automatisk återställning sker; vissa filer eller komponenter kan redan ha ändrats. Läs installerarens utdata ovanför felet innan du trycker på Enter och kontrollera aktuellt tillstånd. Försök sedan igen från menyn eller kör installeraren manuellt via SSH eller värdkonsolen.",
+    "configTitle": "\"Kan inte uppdatera konfigfil\" efter att ha bytt till Stable",
+    "configBody": "Post-install rensningen av beta metadata misslyckades - vanligtvis eftersom <code>config.json</code> har ett syntaxfel från en manuell redigering. Validera det:",
+    "configCmd": "jq . /usr/local/share/proxmenux/config.json",
+    "configOutro": "Rätta eller återställ filen och kör alternativet igen."
+  },
+  "related": {
+    "heading": "Relaterad",
+    "items": [
+      {
+        "href": "/docs/settings/show-version-information",
+        "label": "Visa versionsinformation",
+        "tail": " — bekräfta vilken kanal som är aktiv nu."
+      },
+      {
+        "href": "/docs/settings/proxmenux-monitor",
+        "label": "ProxMenux Monitor",
+        "tail": " — Monitor-tjänsten som skapas om vid kanalbytet."
+      },
+      {
+        "href": "/docs/settings",
+        "label": "Översikt över inställningar",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sv/docs/settings/change-language.json b/web/messages/sv/docs/settings/change-language.json
new file mode 100644
index 00000000..78eb487b
--- /dev/null
+++ b/web/messages/sv/docs/settings/change-language.json
@@ -0,0 +1,108 @@
+{
+  "meta": {
+    "title": "Byt språk | ProxMenux-dokumentation",
+    "description": "Välj mellan åtta språk för ProxMenux. Varje installation innehåller förgenererade JSON-kataloger med översättningar; ingen översättningstjänst eller Python-miljö behövs på värden. Menyn laddas om automatiskt.",
+    "ogTitle": "Byt språk | ProxMenux-dokumentation",
+    "ogDescription": "Välj ett av åtta språk för ProxMenux i Inställningar. Tillgängligt i varje installation."
+  },
+  "header": {
+    "title": "Byt språk",
+    "description": "Byt språk i ProxMenux mellan åtta språk som stöds. Valet sparas i config.json och menyn startas om på det nya språket. Varje installation innehåller översättningskatalogerna.",
+    "section": "Inställningar"
+  },
+  "intro": {
+    "title": "Vad detta är",
+    "body": "En dialog visar de åtta språken som stöds. ProxMenux sparar ditt val i <code>config.json</code> som <code>.language</code> och startar sedan om <code>config_menu.sh</code> så att det används direkt."
+  },
+  "warn": {
+    "title": "Tillgängligt i varje installation",
+    "body": "Inställningar visar alltid Byt språk. Katalogerna installeras i <code>/usr/local/share/proxmenux/lang/</code> <em>och</em> det valda språket lagras i <code>config.json</code>. Den äldre Python-miljön för översättning behövs inte."
+  },
+  "supported": {
+    "heading": "Stödda språk",
+    "headerCode": "Code",
+    "headerLang": "Språk",
+    "headerNotes": "Anteckningar",
+    "rows": [
+      {
+        "code": "en",
+        "lang": "engelska",
+        "notes": "Källspråk — mest korrekt"
+      },
+      {
+        "code": "es",
+        "lang": "spanska",
+        "notes": "Förgenererad JSON-katalog"
+      },
+      {
+        "code": "fr",
+        "lang": "franska",
+        "notes": "Förgenererad JSON-katalog"
+      },
+      {
+        "code": "de",
+        "lang": "tyska",
+        "notes": "Förgenererad JSON-katalog"
+      },
+      {
+        "code": "it",
+        "lang": "italienska",
+        "notes": "Förgenererad JSON-katalog"
+      },
+      {
+        "code": "pt",
+        "lang": "portugisiska",
+        "notes": "Förgenererad JSON-katalog"
+      },
+      {
+        "code": "sk",
+        "lang": "slovakiska",
+        "notes": "Förgenererad JSON-katalog"
+      },
+      {
+        "code": "sv",
+        "lang": "svenska",
+        "notes": "Förgenererad JSON-katalog"
+      }
+    ]
+  },
+  "englishTip": {
+    "title": "Engelska är den mest exakta",
+    "body": "Texter på andra språk hämtas från förgenererade JSON-kataloger som ingår i ProxMenux. Saknade översättningar ersätts med engelska; inga direkta översättningsanrop görs på värden. Engelskan är referensen vid tveksamma översättningar."
+  },
+  "underHood": {
+    "heading": "Hur det fungerar under huven",
+    "items": [
+      "Dialogen visar åtta språkkoder; välj en.",
+      "Om <code>config.json</code> finns uppdaterar <code>jq --arg lang \"$new_language\" '.language = $lang''</code> fältet på plats.",
+      "Om <code>config.json</code> inte existerar: en ny skapas med språkkoden i ett enda fältobjekt.",
+      "Bekräftelsedialog: <em>\"Språket har ändrats till [code]\"</em>.",
+      "<code>exec bash config_menu.sh</code> laddar om menyn Inställningar med det nya språket aktivt."
+    ]
+  },
+  "manual": {
+    "heading": "Manuell motsvarighet"
+  },
+  "troubleshoot": {
+    "heading": "Felsökning",
+    "noOptionTitle": "Alternativ visas inte i Inställningar",
+    "noOptionBody": "Byt språk är alltid tillgängligt i aktuella versioner. Om alternativet saknas uppdaterar du ProxMenux med den officiella installeraren och öppnar Inställningar igen.",
+    "stillEnglishTitle": "Språket har ändrats men gränssnittet är fortfarande på engelska",
+    "stillEnglishBody": "Menyn startas om efter ändringen. Om du har öppnat ett nytt skal och startat en annan ingång till ProxMenux kör du <code>menu</code> igen för att använda det nya språket. Kontrollera med <code>jq -r '.language' /usr/local/share/proxmenux/config.json</code>."
+  },
+  "related": {
+    "heading": "Relaterad",
+    "items": [
+      {
+        "href": "/docs/settings/show-version-information",
+        "label": "Visa versionsinformation",
+        "tail": " — bekräftar versionskanal, översättningsfiler och aktuellt språk."
+      },
+      {
+        "href": "/docs/settings",
+        "label": "Översikt över inställningar",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sv/docs/settings/index.json b/web/messages/sv/docs/settings/index.json
new file mode 100644
index 00000000..534b7d64
--- /dev/null
+++ b/web/messages/sv/docs/settings/index.json
@@ -0,0 +1,81 @@
+{
+  "meta": {
+    "title": "ProxMenux-inställningar — Aktivering av Monitor, versionskanal, språk | ProxMenux",
+    "description": "ProxMenux-inställningar: Monitor-tjänst och lösenordsåterställning, Stable/Beta-kanal, åtta gränssnittsspråk, versionsdiagnostik och avinstallation. Monitor-alternativen visas när tjänsten är installerad.",
+    "ogTitle": "ProxMenux-inställningar — Aktivering av Monitor, versionskanal, språk",
+    "ogDescription": "Konfigurera ProxMenux: Monitor-tjänst, versionskanal, språk, versionsinformation och avinstallation.",
+    "twitterTitle": "ProxMenux Inställningar",
+    "twitterDescription": "Aktivering av Monitor, byte av versionskanal, språk, versionsinformation och avinstallation."
+  },
+  "header": {
+    "title": "Inställningar",
+    "description": "Konfigurera ProxMenux: aktivera eller inaktivera Monitor, återställ dess inloggningsuppgifter, växla mellan Stable och Beta i båda riktningarna, välj ett av åtta språk, visa versionsdiagnostik och avinstallera. Monitor-åtgärder kräver att tjänsten är installerad; språkvalet är alltid tillgängligt.",
+    "section": "Inställningar"
+  },
+  "intro": {
+    "title": "Vad denna meny är för",
+    "body": "Administration av ProxMenux självt: Monitor-tjänst, lämna betakanalen, språk, versionsdiagnostik och avinstallation. Inget i menyn ändrar dina virtuella maskiner, containrar eller lagring."
+  },
+  "opening": {
+    "heading": "Öppna menyn",
+    "body": "Tryck på <kbd>s</kbd> i ProxMenux huvudmeny. Monitor-åtgärder visas om tjänsten är installerad; övriga inställningar är alltid tillgängliga:",
+    "imageAlt": "ProxMenux inställningsmeny med villkorliga Monitor-åtgärder"
+  },
+  "installTypes": {
+    "heading": "En installation, alla språk",
+    "intro": "Aktuella versioner inkluderar statiska JSON-kataloger i varje installation. Äldre versioner erbjöd separata lägen med översättning och Normal:",
+    "headerType": "Installationstyp",
+    "headerBundles": "Vad som ingår",
+    "headerMenu": "Menyn visar",
+    "rows": [
+      {
+        "type": "Aktuell installation",
+        "bundles": "Statiska JSON-kataloger för sju språk plus inbyggd engelska; ingen Python-miljö för översättning",
+        "menuRich": "<strong>Byt språk</strong> + Visa version + Avinstallera"
+      },
+      {
+        "type": "Äldre lägen med översättning / Normal",
+        "bundles": "Föråldrad uppdelning mellan översättningsmiljö och installation enbart på engelska",
+        "menu": "Uppdatera med den officiella installeraren för att använda den gemensamma menyn"
+      }
+    ],
+    "detectionTitle": "Språkvalet är alltid tillgängligt",
+    "detectionBody": "Menyn kontrollerar inte längre en översättningsmiljö. Varje installation innehåller <code>/usr/local/share/proxmenux/lang/</code> och sparar vald <code>language</code> i <code>config.json</code>."
+  },
+  "options": {
+    "heading": "Menyalternativ",
+    "intro": "Verktygen hanterar ProxMenux självt. <em>Villkorligt</em> betyder att Monitor-åtgärder bara visas när dess systemd-tjänst är installerad. Versionskanal, språk, versionsdiagnostik och avinstallation är alltid tillgängliga.",
+    "list": [
+      {
+        "icon": "Activity",
+        "href": "/docs/settings/proxmenux-monitor",
+        "title": "ProxMenux Monitor",
+        "description": "Aktivera / inaktivera proxmenux-monitor.service systemd-enheten, kontrollera dess nuvarande tillstånd och återställa inloggningslösenordet om det har gått förlorat. Web UI tillgängligt på TCP 8008.",
+        "badge": "Villkorligt"
+      },
+      {
+        "icon": "TestTube",
+        "href": "/docs/settings/beta-program",
+        "title": "Byt versionskanal",
+        "description": "Växla mellan Stable (main) och Beta (develop) i båda riktningarna från en enda dialogruta. Kör den officiella installeraren för den valda kanalen; idempotent och alltid synlig.",
+        "badge": "Alltid tillgänglig"
+      },
+      {
+        "icon": "Info",
+        "href": "/docs/settings/show-version-information",
+        "title": "Visa versionsinformation",
+        "description": "ProxMenux-version, versionskanal, installerade komponenter, filvägar, översättningsfiler och aktuellt språk."
+      },
+      {
+        "icon": "Trash2",
+        "href": "/docs/settings/uninstall-proxmenux",
+        "title": "Avinstallera ProxMenux",
+        "description": "Ta bort ProxMenux och (valfritt) dess beroenden. Återställer också /root/.bashrc och /etc/motd säkerhetskopior skapade vid installationstid."
+      }
+    ]
+  },
+  "configTip": {
+    "title": "Var konfigurationen lagras",
+    "bodyRich": "Det mesta av tillståndet som hanteras av menyn lagras i <code>/usr/local/share/proxmenux/config.json</code>: <code>language</code>, <code>beta_program.status</code> och installationsflaggor per komponent. Monitor-tjänstens tillstånd hanteras i systemd (<code>proxmenux-monitor.service</code>), inte här. Versionen läses från <code>/usr/local/share/proxmenux/version.txt</code>."
+  }
+}
diff --git a/web/messages/sv/docs/settings/proxmenux-monitor.json b/web/messages/sv/docs/settings/proxmenux-monitor.json
new file mode 100644
index 00000000..1576e8a7
--- /dev/null
+++ b/web/messages/sv/docs/settings/proxmenux-monitor.json
@@ -0,0 +1,119 @@
+{
+  "meta": {
+    "title": "ProxMenux Monitor | ProxMenux-dokumentation",
+    "description": "Aktivera eller inaktivera systemd-enheten proxmenux-monitor.service och granska dess tillstånd. Monitor tillhandahåller ett webbgränssnitt på TCP-port 8008 för visuell övervakning av värden.",
+    "ogTitle": "ProxMenux Monitor | ProxMenux-dokumentation",
+    "ogDescription": "Aktivera eller inaktivera systemd-tjänsten proxmenux-monitor och kontrollera dess status i Inställningar."
+  },
+  "header": {
+    "title": "ProxMenux Monitor",
+    "description": "Två relaterade åtgärder i Inställningar: växla systemd-enheten proxmenux-monitor.service (starta/stoppa och aktivera/inaktivera autostart tillsammans) och visa dess detaljerade status. Monitor tillhandahåller ett webbgränssnitt på TCP-port 8008 för visuell övervakning av värden.",
+    "section": "Inställningar"
+  },
+  "intro": {
+    "title": "Vad är ProxMenux Monitor?",
+    "body": "ProxMenux Monitor är en integrerad webbpanel som visar din Proxmox-infrastruktur i realtid. Den nås från valfri webbläsare i nätverket utan att du behöver en terminal."
+  },
+  "offers": {
+    "heading": "Vad det erbjuder",
+    "items": [
+      "Realtidsövervakning av CPU, RAM, diskanvändning och nätverkstrafik.",
+      "Översikt över virtuella maskiner och LXC-containrar som körs, med statusindikatorer.",
+      "Inloggningsautentisering för att skydda åtkomsten.",
+      "Tvåfaktorsautentisering (2FA) med TOTP-stöd.",
+      "Omvänd proxy stöd (Nginx / Traefik).",
+      "Designad för att arbeta över stationära och mobila enheter."
+    ]
+  },
+  "access": {
+    "heading": "Åtkomst",
+    "intro": "Efter installationen är panelen tillgänglig på:",
+    "url": "http://<your-proxmox-ip>:8008",
+    "outro": "Monitorn installeras automatiskt som en del av standard ProxMenux-installationen och körs som en systemd-tjänst (<code>proxmenux-monitor.service</code>) som startar automatiskt på start."
+  },
+  "warnConditional": {
+    "title": "Inställningar endast synliga när Monitor är installerad",
+    "body": "De två menyposterna som beskrivs nedan visas endast i Inställningar om <code>proxmenux-monitor.service</code> är registrerad hos systemd. Om du inte ser dem installerades inte Monitor (det är valfritt under ProxMenux-installation). För att lägga till det senare, installera om ProxMenux med den senaste versionen och välj alternativet Monitor."
+  },
+  "toggle": {
+    "heading": "Aktivera / Deaktivera",
+    "intro": "Den första menyposten växlar mellan två tillstånd beroende på om tjänsten körs:",
+    "headerState": "Aktuellt tillstånd",
+    "headerLabel": "Visad menytext",
+    "headerAction": "Åtgärd vid bekräftelse",
+    "rows": [
+      {
+        "state": "aktiv",
+        "label": "Inaktivera ProxMenux Monitor",
+        "action": "systemctl stop + disable"
+      },
+      {
+        "state": "Inaktiv",
+        "label": "Aktivera ProxMenux Monitor",
+        "action": "systemctl enable + start"
+      }
+    ],
+    "outro": "Varje ändring kräver en ja/nej-bekräftelse. Inaktivering stoppar tjänsten <em>och</em> stänger av autostart; aktivering slår på autostart <em>och</em> startar tjänsten direkt."
+  },
+  "status": {
+    "heading": "Visa Monitor-tjänstens status",
+    "intro": "Den andra menyposten läser bara information. Den rensar skärmen, visar ProxMenux-logotypen och rubriken <em>”Verifiering av tjänsten ProxMenux Monitor”</em> och rapporterar sedan:",
+    "items": [
+      "<strong>Servicestatus:</strong> aktiv, inaktiv eller not_installed.",
+      "<strong>Web UI URL</strong> (endast när den är aktiv): <code>http://&lt;host_ip&gt;:8008</code> - härrör från <code>hostname -I | awk '''{print $1}'''</code>.",
+      "<strong>Detailed systemd-utgång:</strong> <code>systemctl status proxmenux-monitor.service --no-pager -l</code> - visar senaste logglinjer, ExecStart, MainPID, etc."
+    ]
+  },
+  "manual": {
+    "title": "Manuella motsvarigheter",
+    "intro": "Från varje skal:",
+    "code": "systemctl status proxmenux-monitor.service       # detailed status\nsystemctl is-active proxmenux-monitor.service    # one-word status\nsystemctl enable --now proxmenux-monitor.service # enable + start\nsystemctl disable --now proxmenux-monitor.service # stop + disable\njournalctl -u proxmenux-monitor.service -f       # follow live logs"
+  },
+  "reset": {
+    "heading": "Återställ lösenordet för ProxMenux Monitor",
+    "intro": "Återställningsväg för operatören som förlorade instrumentpanelens lösenord (eller 2FA-enhet). Alternativet visas endast när monitorn är installerad på värden. Välja det:",
+    "items": [
+      "Be om bekräftelse med en ja/nej dialog - åtgärden är destruktiv för inloggningsuppgifterna.",
+      "Backar upp den befintliga <code>/root/.config/proxmenux-monitor/auth.json</code> till <code>auth.json.bak-&lt;UTC timestamp&gt;</code> (läge <code>0600</code>) så att det tidigare tillståndet kan återställas manuellt om återställningen var ett misstag.",
+      "Stoppar tjänsten <code>proxmenux-monitor</code> för att undvika konflikt mellan filändringen och en pågående inloggning.",
+      "Rensar identitetsfälten i <code>auth.json</code>: <code>enabled=false</code>, <code>configured=false</code>, tömmer <code>username</code>, <code>password_hash</code>, <code>totp_secret</code> och listan med reservkoder.",
+      "<strong>Bevarar</strong> <code>jwt_secret</code> och registrerade <code>api_tokens</code> / <code>revoked_tokens</code>, så att långlivade API-token för Home Assistant eller andra skript <em>fortsätter att fungera för autentisering</em> efter återställningen.",
+      "Startar om tjänsten. Nästa besök på <code>http://&lt;host&gt;:8008</code> visar den första lanseringsguiden så att ett nytt admin-konto kan skapas."
+    ],
+    "preservedTitle": "Vad som överlever återställningen, vad som inte",
+    "preservedBody": "<strong>Rensas:</strong> användarnamn, lösenordshash, TOTP-hemlighet för 2FA och reservkoder. <strong>Bevaras:</strong> <code>jwt_secret</code>, metadata för <code>api_tokens</code> och listan <code>revoked_tokens</code>. Vill du även ogiltigförklara alla API-token och börja om helt tar du bort <code>auth.json</code> manuellt i stället för att använda menyalternativet. Vid nästa start skapar tjänsten en ny JWT-hemlighet och övriga data från grunden.",
+    "trustTitle": "Fysisk åtkomst är förtroendeankaret",
+    "trustBody": "Denna återställningsväg kräver rot skal på värden. Den som kan köra <code>menu</code> kommandot som rot redan styr rutan, så att ge dem lösenord återhämtning är inte ett privilegium eskalering - det är förenligt med hur alla andra admin verktyg på Proxmox fungerar. Korollären: Monitor-inloggningen skyddar inte någonting från någon du redan har släppt in Proxmox-skalet.",
+    "seeAlso": "Se även <link>Monitor → Åtkomst och autentisering → Återställa ett förlorat lösenord</link> för samma flöde från panelens perspektiv och mer om lösenordshashning och hur JWT-hemligheten skapas."
+  },
+  "files": {
+    "heading": "Filer involverade",
+    "code": "/etc/systemd/system/proxmenux-monitor.service       # systemd unit\n/root/.config/proxmenux-monitor/                    # runtime config dir\n/var/log/proxmenux-auth.log                         # Flask app auth log\n                                                    # (read by Fail2Ban [proxmenux] jail)"
+  },
+  "troubleshoot": {
+    "heading": "Felsökning",
+    "missingTitle": "Båda menyalternativen saknas",
+    "missingBody": "Monitorn är inte registrerad hos systemd. Bekräfta med <code>systemctl list-unit-files | grep proxmenux-monitor</code> - om det inte finns någon utgång, installera om ProxMenux från den officiella installatören med den senaste versionen och välj alternativet Monitor under installationen.",
+    "unreachableTitle": "Tjänsten är aktiverad men webbadressen kan inte nås",
+    "unreachableBody": "Statusutskriften i Inställningar visar IP-adressen. Kontrollera:",
+    "unreachableCmd": "ss -tlnp | grep 8008                # is anything listening?\njournalctl -u proxmenux-monitor -n 100 --no-pager  # recent errors\ncurl -sI http://localhost:8008      # local reachability",
+    "unreachableOutro": "Om localhost fungerar men externt inte, kontrollera din värd brandvägg (<code>pve-firewall</code> eller nftables) för inkommande TCP 8008.",
+    "stopsTitle": "Aktiverade tjänsten men det stoppar sig några sekunder senare",
+    "stopsBody": "Oftast beror det på en portkonflikt (något annat använder 8008) eller en misslyckad beroendekontroll. Systemjournalen visar orsaken: <code>journalctl -u proxmenux-monitor.service -b</code>."
+  },
+  "related": {
+    "heading": "Relaterad",
+    "items": [
+      {
+        "href": "/docs/security/fail2ban",
+        "label": "Fail2Ban",
+        "tailRich": "— <code>[proxmenux]</code> jail skyddar monitorn på TCP 8008."
+      },
+      {
+        "href": "/docs/settings",
+        "label": "Översikt över inställningar",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sv/docs/settings/show-version-information.json b/web/messages/sv/docs/settings/show-version-information.json
new file mode 100644
index 00000000..410050f5
--- /dev/null
+++ b/web/messages/sv/docs/settings/show-version-information.json
@@ -0,0 +1,81 @@
+{
+  "meta": {
+    "title": "Visa versionsinformation | ProxMenux-dokumentation",
+    "description": "ProxMenux-diagnostik med enbart läsning: version, versionskanal, komponenter registrerade i config.json, filvägar, översättningskataloger och aktuellt språk.",
+    "ogTitle": "Visa versionsinformation | ProxMenux-dokumentation",
+    "ogDescription": "Diagnostisk utskrift av ProxMenux-version, versionskanal, komponenter, filer och språk."
+  },
+  "header": {
+    "title": "Visa versionsinformation",
+    "description": "Diagnostik med enbart läsning. Läser version.txt, config.json och kända filvägar och visar en rullbar textruta med version, versionskanal, installerade komponenter, filernas närvaro, översättningsfiler och aktuellt språk.",
+    "section": "Inställningar"
+  },
+  "intro": {
+    "title": "Vad detta är",
+    "body": "Självdiagnostik. Användbar när du rapporterar ett problem (klistra in dialogens innehåll i felrapporten) eller för att bekräfta att en installation slutfördes korrekt. Ändrar ingenting."
+  },
+  "reports": {
+    "heading": "Vad det rapporterar",
+    "headerSection": "Avsnitt",
+    "headerSource": "Källa",
+    "headerContent": "Innehåll",
+    "rows": [
+      {
+        "section": "Nuvarande version",
+        "source": "version.txt",
+        "contentRich": "Versionsnummer på en rad; <code>Unknown</code> om filen saknas"
+      },
+      {
+        "section": "Versionskanal",
+        "source": "Betaprogrammets status i config.json",
+        "content": "Stable (main) eller Beta (develop); betaversion om tillgänglig"
+      },
+      {
+        "section": "Installerade komponenter",
+        "source": "config.json",
+        "content": "Status per komponent (✓ installerad / skapad / uppgraderad, ✗ saknas)"
+      },
+      {
+        "section": "ProxMenux-filer",
+        "source": "Filsystemkontroller",
+        "contentRich": "<code>menu</code>, <code>utils.sh</code>, <code>config.json</code>, <code>version.txt</code> närvaro + vägar"
+      },
+      {
+        "section": "Översättningsfiler",
+        "source": "/usr/local/share/proxmenux/lang/",
+        "content": "Närvaro av katalogen lang/ som ingår i varje installation"
+      },
+      {
+        "section": "Nuvarande språk",
+        "source": "config.json",
+        "contentRich": "Språkkod från <code>.language</code>; använder <code>en</code> om inget är inställt"
+      }
+    ]
+  },
+  "sampleHeading": "Exempel på utdata",
+  "manualHeading": "Manuella motsvarigheter",
+  "troubleshoot": {
+    "heading": "Felsökning",
+    "unknownTitle": "Versionen visar \"Unknown\"",
+    "unknownBody": "<code>/usr/local/share/proxmenux/version.txt</code> saknas eller är oläslig. Oftast orsakad av en partiell installation. Installera från den officiella ProxMenux-källan.",
+    "noConfigTitle": "Ingen installationsinformation tillgänglig",
+    "noConfigBody": "<code>config.json</code> saknas. Skriptet kan inte lista komponenter utan den filen. Installera om för att återskapa den.",
+    "wrongStatusTitle": "En komponent visar ✗ trots att jag är säker på att jag installerat den",
+    "wrongStatusBody": "<code>config.json</code> spårar inte den komponenten som installerad - kan vara ett manus som inte registrerar sig ännu, eller en manuell installation som kringgick ProxMenux. Dialogen speglar vad <code>config.json</code> säger, inte vad som faktiskt finns på disken."
+  },
+  "related": {
+    "heading": "Relaterad",
+    "items": [
+      {
+        "href": "/docs/settings/uninstall-proxmenux",
+        "label": "Avinstallera ProxMenux",
+        "tail": " — ta bort alla dessa filer."
+      },
+      {
+        "href": "/docs/settings",
+        "label": "Översikt över inställningar",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sv/docs/settings/uninstall-proxmenux.json b/web/messages/sv/docs/settings/uninstall-proxmenux.json
new file mode 100644
index 00000000..803f9faa
--- /dev/null
+++ b/web/messages/sv/docs/settings/uninstall-proxmenux.json
@@ -0,0 +1,92 @@
+{
+  "meta": {
+    "title": "Avinstallera ProxMenux | ProxMenux-dokumentation",
+    "description": "Ren avinstallation av ProxMenux med valfri borttagning av jq och dialog, rensning av äldre översättningsfiler och Monitor-tjänsten samt återställning av säkerhetskopierade systemfiler.",
+    "ogTitle": "Avinstallera ProxMenux | ProxMenux-dokumentation",
+    "ogDescription": "Ta bort ProxMenux rent från en Proxmox-värd med valfri rensning av beroenden."
+  },
+  "header": {
+    "title": "Avinstallera ProxMenux",
+    "description": "Tar bort ProxMenux från Proxmox-värden med ett interaktivt förlopp: bekräftelse, valfri borttagning av beroenden, rensning av tjänsten ProxMenux Monitor och återställning av säkerhetskopior av /root/.bashrc och /etc/motd. Visar en förloppsindikator under hela processen.",
+    "section": "Inställningar"
+  },
+  "scopeWarn": {
+    "title": "Påverkar ProxMenux-installationen bara - inte dina VM / CT / lagringsutrymme",
+    "body": "Avinstallationen tar bort ProxMenux-skripten, menystartaren, den valfria Monitor-tjänsten och säkerhetskopior av systemfiler som ProxMenux skapade vid installationen. <strong>Den ändrar inte dina virtuella maskiner, containrar, lagring, nätverkskonfiguration, Fail2Ban, NVIDIA-drivrutiner eller annat som du installerat via ProxMenux.</strong> De förblir som de är."
+  },
+  "flow": {
+    "heading": "Avinstallationsförloppet",
+    "items": [
+      "<strong>Bekräftelsedialog.</strong> Ja/nej: ”Vill du verkligen avinstallera ProxMenux?”",
+      "<strong>Lista över beroenden att ta bort.</strong> Erbjuder jq och dialog. Båda rutorna är avmarkerade från början; välj bara beroenden som inget annat program behöver.",
+      "<strong>Borttagningen visar en förloppsindikator.</strong> Tar bort en eventuell kvarvarande äldre översättningsmiljö, startaren <code>menu</code>, katalogträdet <code>/usr/local/share/proxmenux/</code>, tjänsten ProxMenux Monitor om den finns samt aviseringsmålet som den registrerat i Proxmox VE (<code>proxmenux-webhook</code> och dess matchningsregel) och de markerade beroendena. Slutligen återställs säkerhetskopiorna av systemfilerna (se nedan).",
+      "<strong>Slutdialog.</strong> Listar borttagna beroenden och avslutar."
+    ]
+  },
+  "deps": {
+    "heading": "Beroende borttagning: vad som erbjuds",
+    "intro": "Listan erbjuder jq och dialog. <strong>Ingen ruta är markerad som standard</strong>: andra program kan använda dessa systempaket, så det är säkrare att behålla dem.",
+    "headerType": "Installation",
+    "headerOffered": "Erbjuds för borttagning",
+    "rows": [
+      {
+        "type": "Aktuella versioner",
+        "offeredRich": "<code>dialog</code>, <code>jq</code>"
+      },
+      {
+        "type": "Äldre installationer efter uppdatering",
+        "offeredRich": "<code>dialog</code>, <code>jq</code>"
+      }
+    ],
+    "warnTitle": "Systemomfattande paket – tänk två gånger",
+    "warnBody": "Den aktuella listan erbjuder <code>jq</code> och <code>dialog</code>, inte <code>python3</code>. Andra verktyg kan behöva dessa systempaket. Borttagning kan även ta bort beroende paket eller oanvända beroenden. Behåll nödvändiga paket och granska föreslagna borttagningar innan du kör apt manuellt."
+  },
+  "removed": {
+    "heading": "Vad som tas bort",
+    "code": "/usr/local/bin/menu                                  # the launcher\n/usr/local/share/proxmenux/                          # everything: scripts, config, cache, version\n/opt/googletrans-env/                                # leftover legacy translation environment\n/etc/systemd/system/proxmenux-monitor.service        # Monitor service unit\n/root/.config/proxmenux-monitor/                     # Monitor config dir\n                                                     # + dependencies you ticked in the checklist"
+  },
+  "restored": {
+    "heading": "Vad som återställs",
+    "items": [
+      "Om <code>/root/.bashrc.bak</code> finns → byta namn tillbaka till <code>/root/.bashrc</code> (din ursprungliga bashrc returnerar).",
+      "Om <code>/etc/motd.bak</code> finns byter den namn till <code>/etc/motd</code>. Annars tar sed bort ProxMenux-raden (<em>“This system is optimised by: ProxMenux”</em>) från befintlig motd."
+    ]
+  },
+  "othersCallout": {
+    "title": "Andra ProxMenux-installerade komponenter stannar",
+    "body": "Allt som ProxMenux installerat via andra menyer — Fail2Ban, Lynis, NVIDIA drivrutiner, justeringar efter installation — berörs <strong>inte</strong> av denna avinstallation. Var och en har sitt eget avinstallationsflöde i sin respektive meny (eller så kan du ta bort med apt direkt). Titta på <em>Visa versionsinformation</em> först för att se vad som är registrerat."
+  },
+  "manual": {
+    "heading": "Manuell avinstallation",
+    "intro": "Om menyn av någon anledning inte kan köras (t.ex. <code>dialog</code> saknas redan), motsvarande manuell sekvens:",
+    "code": "# 1. Stop and remove the Monitor service (if installed)\nsystemctl stop proxmenux-monitor.service 2>/dev/null\nsystemctl disable proxmenux-monitor.service 2>/dev/null\nrm -f /etc/systemd/system/proxmenux-monitor.service\nrm -rf /root/.config/proxmenux-monitor\nsystemctl daemon-reload\nsystemctl reset-failed 2>/dev/null\n\n# 2. Remove a leftover legacy translation environment\nrm -rf /opt/googletrans-env\n\n# 3. Remove ProxMenux files\nrm -f /usr/local/bin/menu\nrm -rf /usr/local/share/proxmenux\n\n# 4. Restore backups\n[ -f /root/.bashrc.bak ] && mv /root/.bashrc.bak /root/.bashrc\n[ -f /etc/motd.bak ] && mv /etc/motd.bak /etc/motd \\\n    || sed -i '/This system is optimised by: ProxMenux/d' /etc/motd"
+  },
+  "reinstall": {
+    "heading": "Ominstallera senare",
+    "body": "Kör den officiella ProxMenux-installeraren igen. Aktuella versioner använder en gemensam installationsväg som inkluderar alla åtta gränssnittsspråk."
+  },
+  "troubleshoot": {
+    "heading": "Felsökning",
+    "hangTitle": "Avinstallationen fastnar när en äldre översättningsmiljö tas bort",
+    "hangBody": "Aktuella versioner tar bort en kvarvarande miljö med <code>rm -rf /opt/googletrans-env</code>; de kör inte <code>pip uninstall</code>. Om steget fastnar undersöker du det från ett annat skal och kontrollerar värdens filsystem innan du försöker igen.",
+    "aptTitle": "apt varnar om paket som fortfarande används när beroenden tas bort",
+    "aptBody": "Valda paket markeras som automatiska och skickas till <code>apt-get -y --purge autoremove</code>. Det garanterar inte att beroende tjänster skyddas. Låt beroenden vara avmarkerade om andra verktyg behöver dem och granska apts föreslagna borttagningar före manuell rensning.",
+    "motdTitle": "MOTD visar fortfarande ProxMenux-linjen efter avinstallation",
+    "motdBody": "Det kan hända om <code>/etc/motd.bak</code> saknades och sed inte hittade raden (till exempel för att den ändrats). Redigera <code>/etc/motd</code> manuellt och ta bort kvarvarande ProxMenux-rader."
+  },
+  "related": {
+    "heading": "Relaterad",
+    "items": [
+      {
+        "href": "/docs/settings/show-version-information",
+        "label": "Visa versionsinformation",
+        "tail": " - se vad som skulle tas bort innan du avinstallerar."
+      },
+      {
+        "href": "/docs/settings",
+        "label": "Översikt över inställningar",
+        "tail": "."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sv/docs/storage-share/host-iscsi.json b/web/messages/sv/docs/storage-share/host-iscsi.json
new file mode 100644
index 00000000..f53aaa80
--- /dev/null
+++ b/web/messages/sv/docs/storage-share/host-iscsi.json
@@ -0,0 +1,123 @@
+{
+  "meta": {
+    "title": "Värd: Lägg till iSCSI-mål som Proxmox-lagring | ProxMenux Dokumentation",
+    "description": "Registrera ett iSCSI-mål som Proxmox-lagring med ProxMenux. Verktyget installerar open-iscsi, hittar portalen via sendtargets, låter dig välja mål och kör pvesm add iscsi. Det ger råa blockenheter för VM-diskavbildningar.",
+    "ogTitle": "Värd: Lägg till iSCSI-mål som Proxmox-lagring | ProxMenux Dokumentation",
+    "ogDescription": "Registrera ett iSCSI-mål som Proxmox-lagring med guidad upptäckt. Använder pvesm add iscsi och ger råa blockenheter för VM-diskar."
+  },
+  "header": {
+    "title": "Värd: Lägg till iSCSI-mål som Proxmox-lagring",
+    "description": "Registrera ett iSCSI-mål (från en SAN, TrueNAS / FreeNAS, Synology, ett Windows Server-mål, någon matris som talar iSCSI) som Proxmox-lagring. De exporterade LUNs visas som blockenheter och kan vara värd för VM-diskbilder vid nära lokal prestanda över nätverket.",
+    "section": "Lagring och delning · Värd"
+  },
+  "intro": {
+    "title": "Vad detta gör",
+    "body": "ProxMenux erbjuder <code>pvesm add iscsi</code> med ett guidat flöde: det installerar <code>open-iscsi</code> om det behövs, ber om iSCSI portal (IP:port), kör <code>iscsiadm --mode discovery --type sendtargets</code> mot det, låter dig välja ett mål IQN, och registrerar iSCSI lagring i Proxmox. <code>iscsid</code>-tjänsten håller sedan iSCSI-sessionen levande över omstart."
+  },
+  "vocab": {
+    "heading": "iSCSI ordförråd (snabb referens)",
+    "headerTerm": "Termen",
+    "headerMeaning": "Betydelse",
+    "rows": [
+      {
+        "term": "Portal",
+        "meaningRich": "iSCSI service endpoint på målservern - en IP (eller värdnamn) plus en TCP-port. Standardport är <code>3260</code>; ProxMenux antar det om du inte anger en."
+      },
+      {
+        "term": "Mål",
+        "meaningRich": "En enda exporterad \"server\" i portalen, identifierad av dess IQN (<em>iSCSI Kvalificerad Name</em>). En portal kan vara värd för många mål."
+      },
+      {
+        "term": "IQN",
+        "meaningRich": "Kanonisk form är <code>iqn.YYYY-MM.reverse.domain:identifier</code>, till exempel <code>iqn.2024-08.com.truenas:proxmox-pool</code>. Både målet och initiatorn har sin egen IQN."
+      },
+      {
+        "term": "LUN",
+        "meaningRich": "En blockenhet inuti ett mål (Logical Unit Number). Ett enda mål kan exponera flera LUNs; varje LUN visas som sin egen disk i Proxmox och kan bli en VM-skiva."
+      },
+      {
+        "term": "Initiator",
+        "meaningRich": "Klienten som ansluter till ett mål, i detta fall din Proxmox-värd. Initiatorn har ett eget IQN i <code>/etc/iscsi/initiatorname.iscsi</code>. Mål accepterar vanligtvis bara sessioner från förhandsgodkända initiator-IQN."
+      }
+    ]
+  },
+  "opening": {
+    "heading": "Öppna verktyget",
+    "body": "Från ProxMenux: s huvudmeny, öppna <strong>Storage &amp; Share Manager → Lägg till iSCSI Mål som Proxmox Storage</strong>. Du kommer att se denna sub-meny med fyra alternativ:",
+    "imageAlt": "iSCSI Host Manager-menyn - Lägg till / Visa / Ta bort / Testanslutning"
+  },
+  "howRuns": {
+    "heading": "Hur man kör skriptet (Lägg till flöde)",
+    "body": "Flödet har två faser med tydlig åtskillnad mellan att \"sätta upp initiativtagaren, upptäcka mål\" och \"registrera lagring i Proxmox\". Till skillnad från NFS / Samba finns det ingen auto-upptäckt på subnet - du måste veta portal adressen (iSCSI är inte sändningsvänlig)."
+  },
+  "add": {
+    "heading": "Lägg till iSCSI-mål som Proxmox-lagring",
+    "items": [
+      "<strong>Ange portal</strong> - Skriv IP- eller värdnamnet på iSCSI-målsservern. Port <code>3260</code> antas om du inte skriver <code>host:port</code>.",
+      "<strong>Upptäck mål</strong> — ProxMenux anropar <code>iscsiadm --mode discovery --type sendtargets --portal &lt;ip:port&gt;</code>. Servern svarar med varje IQN som initiatorn får se. Om upptäckten misslyckas visar skriptet det exakta felet från <code>iscsiadm</code> och vanliga orsaker (fel IP, brandvägg, initiatorns IQN är inte godkänt).",
+      "<strong>Målval</strong> - ett enda mål är automatisk vald; flera mål visar en meny.",
+      "<strong>Lagring ID</strong> — standard är <code>iscsi-&lt;last IQN segment, 20 chars max&gt;</code>. Endast bokstäver, siffror, <code>-</code> och <code>_</code>.",
+      "<strong>Innehållstyp</strong> — till skillnad från NFS/Samba är iSCSI-innehållet <strong>låst till <code>images</code></strong>. iSCSI exponerar råa blockenheter, inte ett filsystem, så Proxmox tillåter bara VM-diskar där."
+    ],
+    "authTitle": "auktorisera Proxmox-initiativtagaren på målet",
+    "authBody1": "Innan tilläggsflödet kan slutföras måste iSCSI-målet känna till din Proxmox-värd. Hämta initiatorns IQN:",
+    "authBody2": "Lägg till detta IQN i målets åtkomstlista (TrueNAS: <em>Sharing → Block → Initiators Groups</em>; Synology: <em>SAN Manager → iSCSI → Target → Edit → Initiators</em>; osv.). Om initiatorn inte är godkänd returnerar <code>iscsiadm</code>-upptäckten en tom lista eller ett autentiseringsfel."
+  },
+  "manual": {
+    "heading": "Manuell motsvarande",
+    "body": "Hela flödet motsvarar dessa kommandon:"
+  },
+  "view": {
+    "heading": "Visa konfigurerade iSCSI lager",
+    "body": "Listar varje iSCSI-post i Proxmox (<code>pvesm status | awk ''$2 == \"iscsi\"''</code>) med portal, mål IQN, innehållstyp och levande status."
+  },
+  "remove": {
+    "heading": "Ta bort iSCSI lagring",
+    "body": "Kör <code>pvesm remove &lt;storage-id&gt;</code> efter att ha bekräftat portal, mål och innehåll. Endast Proxmox-registreringen tas bort - <strong>iSCSI-målet i sig är inte rörd</strong> och befintliga sessioner på kärnsidan kan dröja kvar till nästa omstart.",
+    "warnTitle": "Kontrollera först befintliga VM-diskar på detta iSCSI",
+    "warnBody": "Om en iSCSI-lagring tas bort medan VM:ar fortfarande har diskar där pekar de på en lagring som inte längre är registrerad. Proxmox rapporterar felet men LUN-data på målet påverkas inte: du kan registrera lagringen igen för att få tillbaka diskarna. Flytta eller säkerhetskopiera ändå VM:arna först."
+  },
+  "test": {
+    "heading": "Test iSCSI-anslutning",
+    "body": "Kör en diagnostik: kontrollerar att <code>iscsiadm</code> är installerat, visar initiatorns IQN, bekräftar att <code>iscsid</code> körs, pingar varje registrerad portal, provar dess port och visar <code>pvesm status</code> samt om en iSCSI-session är aktiv (<code>iscsiadm --mode session</code>). En aktiv session och nåbar portal men ”inactive” i Proxmox tyder oftast på föråldrat tillstånd — prova <code>pvesm set &lt;id&gt; --disable 0</code>."
+  },
+  "troubleshoot": {
+    "heading": "Felsökning",
+    "portalTitle": "\"Kan inte nå portal\" men servern IP svarar någon annanstans",
+    "portalBody": "Ping misslyckades på portal adressen. Kontrollera att du når <em>lagringsnätverk</em>-gränssnittet (iSCSI bor ofta på ett separat VLAN / subnet från ledningsnätverket). Kontrollera också DNS om du skrev ett värdnamn.",
+    "discoverTitle": "\"iSCSI upptäckt misslyckades\" från iscsiadm",
+    "discoverIntro": "Skriptet visar exakt fel. De vanligaste orsakerna:",
+    "discoverItems": [
+      "Portal IP / port fel (dubbelkontroll, standard är 3260).",
+      "iSCSI-tjänst som inte körs på målservern.",
+      "Brandvägg blockerar 3260 mellan Proxmox och målet.",
+      "<strong>Initiator IQN är inte auktoriserad på målet.</strong> Den vanligaste orsaken till företagsarrayer. Lägg till din Proxmox IQN till målets initiativtagare ACL först."
+    ],
+    "noTargetTitle": "Inga mål hittades men upptäckten lyckades",
+    "noTargetBody": "Servern accepterade initiatorn men exponerar inget mål för den. Granska autentisering och åtkomstkontroller: vissa arrayer tillåter upptäckt för alla IQN men filtrerar vilka mål varje IQN får se.",
+    "noLunTitle": "LUNs visas inte i /dev/disk/by-path efter registrering",
+    "noLunBody": "<code>pvesm add iscsi</code> lyckades men kärnan ser inte blockenheter. Kontrollera <code>iscsiadm --mode session</code> - om ingen session är aktiv, starta en manuellt med <code>iscsiadm --mode node --login</code>. Om en session existerar men inga LUN visas, tvinga en rescan: <code>iscsiadm --mode session --rescan</code>. Om fortfarande ingenting, har målet förmodligen inga LUNs tilldelats denna IQN än (konfigurera LUN-kartläggning på målet).",
+    "chapTitle": "CHAP autentisering",
+    "chapBody": "ProxMenux har inga fält för CHAP-användarnamn och lösenord i det interaktiva flödet. Om upptäckten misslyckas stoppar skriptet före <code>pvesm add</code>; lagringen registreras inte trots felet. Konfigurera målets CHAP-krav separat i <code>open-iscsi</code>, inklusive autentisering för upptäckt om det krävs, och försök igen. Kontrollera konfigurationen med <code>iscsiadm</code> och aktiva sessioner med <code>iscsiadm --mode session</code>."
+  },
+  "related": {
+    "heading": "Relaterad",
+    "items": [
+      {
+        "href": "/docs/storage-share/host-nfs",
+        "label": "NFS-delning som Proxmox-lagring",
+        "tail": " — fil-nivå alternativ. Enkelt att ställa in, mer flexibel (backup / ISO / tmpl / avbildningar), något långsammare för levande VM-skivor."
+      },
+      {
+        "href": "/docs/storage-share/host-samba",
+        "label": "Samba / CIFS som Proxmox förvaring",
+        "tail": " — ett annat alternativ på filnivå; undvik för diskar till körande VM:ar på grund av låssemantiken."
+      },
+      {
+        "href": "/docs/storage-share/host-local-disk",
+        "label": "Lägg till lokal disk som Proxmox lagring",
+        "tail": " — när disken finns lokalt på Proxmox-värden i stället för på en annan dator i nätverket."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sv/docs/storage-share/host-local-disk.json b/web/messages/sv/docs/storage-share/host-local-disk.json
new file mode 100644
index 00000000..f0e1d7ae
--- /dev/null
+++ b/web/messages/sv/docs/storage-share/host-local-disk.json
@@ -0,0 +1,186 @@
+{
+  "meta": {
+    "title": "Värd: Lägg till lokal disk som Proxmox lagring | ProxMenux Dokumentation",
+    "description": "Formatera en lokal SATA-, SAS- eller NVMe-disk på en Proxmox-värd och registrera den som katalog- eller ZFS-poollagring. Verktyget väljer diskar säkert, kräver bekräftelse före destruktiva steg, använder UUID i fstab, skapar ZFS-pooler och kör pvesm add dir / zfspool.",
+    "ogTitle": "Värd: Lägg till lokal disk som Proxmox lagring | ProxMenux Dokumentation",
+    "ogDescription": "Formatera en lokal disk och registrera den som kataloglagring eller ZFS-pool i Proxmox med ett guidat flöde och säkerhetsfilter."
+  },
+  "header": {
+    "title": "Värd: Lägg till lokal disk som Proxmox lagring",
+    "description": "Välj en fysisk disk på Proxmox-värden, formatera den vid behov som ext4, xfs, btrfs eller zfs och registrera den som kataloglagring med pvesm add dir eller som ZFS-pool med pvesm add zfspool. ProxMenux filtrerar bort systemdisken och diskar som används och beskriver varje destruktivt steg innan det körs.",
+    "section": "Lagring och delning · Värd"
+  },
+  "intro": {
+    "title": "Vad detta gör",
+    "body": "Övriga <em>Host</em> verktyg i detta avsnitt behandla <strong>nätverkslagring</strong> (NFS / Samba / iSCSI). Den här handlar om <strong>lokala</strong> diskar - reservdiskar fysiskt fästa på din Proxmox-värd som du vill använda för VM-skivor, säkerhetskopior, ISOs eller mallar. ProxMenux förbereder disken (partition + format + montering) och registrerar den i Proxmox så att UI kan placera innehåll där."
+  },
+  "destructive": {
+    "title": "Destruktivt verktyg för \"format\" vägen",
+    "body": "Alternativet <em>Formatera</em> <strong>förstör befintliga partitioner och data på den valda disken</strong>. ProxMenux visar en varning, filtrerar bort diskar som används och kräver bekräftelse innan <code>wipefs</code> / <code>sgdisk</code> / <code>mkfs</code> körs. Detta är inte säker överskrivning av varje byte. Kontrollera enhetssökvägen två gånger innan du bekräftar."
+  },
+  "compare": {
+    "heading": "Katalog eller ZFS-pool — vilket ska du välja?",
+    "headerDir": "Katalog (ext4 / xfs / btrfs)",
+    "headerZfs": "ZFS pool",
+    "rows": [
+      {
+        "label": "Proxmox lagringstyp",
+        "dirRich": "<code>dir</code>",
+        "zfsRich": "<code>zfspool</code>"
+      },
+      {
+        "label": "VM skivformat",
+        "dir": "qcow2-/raw-fil i ett filsystem",
+        "zfs": "Inbyggt ZFS-dataset (zvol) per disk"
+      },
+      {
+        "label": "Ögonblicksbilder",
+        "dir": "qcow2 snapshots; btrfs snapshots om fs=btrfs",
+        "zfs": "Inbyggda, omedelbara, copy-on-write"
+      },
+      {
+        "label": "Dynamisk allokering",
+        "dir": "Ja (qcow2 standard)",
+        "zfs": "Ja (ZFS standard)"
+      },
+      {
+        "label": "RAM-behov",
+        "dir": "Låg",
+        "zfs": "Högt — ZFS använder ledigt RAM som ARC-cache"
+      },
+      {
+        "label": "Stöder innehållstyper",
+        "dir": "images, backup, iso, vztmpl, snippets, rootdir",
+        "zfs": "endast images och rootdir (blocklagring)"
+      },
+      {
+        "label": "Bäst för",
+        "dir": "Allmänt ändamål disk: blandning av VM diskar, säkerhetskopior, ISOs",
+        "zfs": "Rena VM / LXC datadisk med ögonblicksbild + integritetsbehov"
+      }
+    ]
+  },
+  "opening": {
+    "heading": "Öppna verktyget",
+    "body": "Öppna <strong>Storage &amp; Share Manager → Add Local Disk as Proxmox Storage</strong> i ProxMenux huvudmeny. Undermenyn har fyra alternativ:",
+    "imageAlt": "Lokal Disk Manager-menyn - Lägg till / Visa / Ta bort / Lista tillgängliga diskar"
+  },
+  "howRuns": {
+    "heading": "Hur man kör skriptet (Lägg till flöde)",
+    "body": "Flödet har två faser med ett trippelt säkerhetsfilter. Fas 1 upptäcker säkra diskar, bestämmer vad du ska göra med den valda och samlar in lagringsparametrar; Fas 2 gör det destruktiva arbetet. Fram till den slutliga bekräftelsen är disken orörd."
+  },
+  "format": {
+    "heading": "Formatera en blank disk",
+    "intro": "Vägen för en ny skiva eller en vars innehåll du inte bryr dig om.",
+    "items": [
+      "Välj disken (system / in-use diskar är dolda).",
+      "Välj \"Format disk (ERASE all data)\".",
+      "Välj filsystemet - se tabellen ovan för avvägningar.",
+      "Lagring ID (standard <code>disk-&lt;device&gt;</code>), monteringsväg, innehållstyp förinställd.",
+      "Bekräfta i dialogen <strong>SLUTLIG BEKRÄFTELSE — DATA KOMMER ATT RADERAS</strong>.",
+      "ProxMenux rensar partitionstabellen och skapar en partition över hela disken. Det kör <code>mkfs.&lt;fs&gt;</code> eller <code>zpool create</code> och monterar resultatet. Vanliga filsystem får en UUID-post i <code>/etc/fstab</code> med <code>defaults,nofail</code>; ZFS använder poolens monteringskonfiguration. Om <em>Som Proxmox-lagring</em> är markerat (alltid för ZFS) registreras den sedan med <code>pvesm add dir</code> eller <code>pvesm add zfspool</code>; annars förblir den bara en montering på värden."
+    ],
+    "tipTitle": "Varför UUID + nofail i /etc/fstab",
+    "tipBody": "Skriptet skriver <code>UUID=… /mnt/&lt;id&gt; &lt;fs&gt; defaults,nofail 0 2</code>. UUID överlever enhetsreordering över omstart (så <code>/dev/sdc</code> blir <code>/dev/sdd</code> inte bryta start). <code>nofail</code> innebär att om disken någonsin försvinner (hårdvarufel, urkopplad), startar Proxmox ändå - lagring kommer bara att visas som inaktiv tills disken kommer tillbaka."
+  },
+  "reuse": {
+    "heading": "Återanvänd ett befintligt filsystem",
+    "intro": "Vägen för en disk du vill hålla data på - kanske du flyttade den från en annan Proxmox-värd, eller disken har redan säkerhetskopior / ISOs du vill hålla tillgänglig.",
+    "items": [
+      "Välj disken.",
+      "Välj \"Använd befintliga filsystem\".",
+      "Lagring ID, monteringsväg, innehållstyp förinställd.",
+      "ProxMenux vidrör <strong>inte</strong> data: den skapar monteringspunkten, monterar disken, lägger till en UUID-post till <code>/etc/fstab</code> och registrerar den som en Proxmox <code>dir</code>-lagring."
+    ],
+    "warnTitle": "Återanvändningsväg hanterar inte ZFS pooler",
+    "warnBody": "Om disken redan innehåller en ZFS pool, <em>reuse</em> väg här försöker bara montera den som ett vanligt filsystem - som misslyckas. För att importera en befintlig ZFS pool använda <code>zpool import &lt;name&gt;</code> på kommandoraden och sedan registrera den manuellt med <code>pvesm add zfspool</code>."
+  },
+  "presets": {
+    "heading": "Innehållstyp förinställningar",
+    "intro": "ProxMenux erbjuder tre förinställningar och ett eget alternativ. Den valda innehållssträngen skickas till <code>pvesm add … --content &lt;csv&gt;</code>:",
+    "headerPreset": "Förinställning",
+    "headerContent": "Innehållssträng",
+    "headerUse": "Användningsfall",
+    "rows": [
+      {
+        "preset": "VM-lagring",
+        "content": "images,backup",
+        "use": "Lagring avsedd för VM-diskar som även har säkerhetskopior av samma VM:ar nära till hands."
+      },
+      {
+        "preset": "Standard-NAS",
+        "content": "backup,iso,vztmpl",
+        "use": "En arkiv / media disk - säkerhetskopior, ISOs och LXC mallar. Inga live VM-skivor här."
+      },
+      {
+        "preset": "Alla typer",
+        "content": "images,backup,iso,vztmpl,snippets",
+        "use": "Den breda förinställningen aktiverar avbildningar, säkerhetskopior, ISO-filer, LXC-mallar och snippets. Lägg vid behov till andra typer som stöds, exempelvis rootdir, via Anpassad."
+      },
+      {
+        "preset": "Anpassad",
+        "content": "(fri input)",
+        "useRich": "Skriv exakt CSV själv, t.ex. <code>images</code> ensam, eller <code>rootdir,images</code>."
+      }
+    ],
+    "zfsTitle": "ZFS pool innehåll är smalare",
+    "zfsBody": "Med <strong>zfs</strong> stöder en <code>zfspool</code> endast <code>images</code> och <code>rootdir</code>, inte ISO- eller säkerhetskopieringsfiler. Ange en lista som stöds via Anpassad. Skriptet skickar valet oförändrat; typer som inte stöds kan få registreringen att misslyckas. Kontrollera därefter <code>pvesm status</code>."
+  },
+  "manual": {
+    "heading": "Manuell motsvarande",
+    "extIntro": "Format + registrera en disk som ext4 katalog lagring:",
+    "zfsIntro": "Eller som ZFS pool:"
+  },
+  "view": {
+    "heading": "Visa disklagringar",
+    "body": "Listar varje diskstödd Proxmox-lagring (både <code>dir</code> och <code>zfspool</code> som är användarskapade - systempooler som <code>rpool</code> är dolda). Visar monteringsvägen / poolnamn, innehållstyper och aktuell status."
+  },
+  "remove": {
+    "heading": "Ta bort disklagring",
+    "body": "Avregistrerar lagringen från Proxmox (<code>pvesm remove</code>) och erbjuder att rensa upp den matchande posten i <code>/etc/fstab</code>. För ZFS pools förstör skriptet <strong>inte</strong> automatiskt pool – det är ett separat <code>zpool destroy &lt;name&gt;</code> steg du gör för hand när du är säker.",
+    "warnTitle": "Data och befintliga VM beroenden",
+    "warnBody": "Ta bort lagringen rör inte filsystemet eller poolen - data stannar på disken. Men VMs / CT som refererar till denna lagring av ID kommer inte att starta efter borttagning. Flytta dessa VM-skivor till en annan lagring (eller ta en säkerhetskopia) innan du tar bort."
+  },
+  "list": {
+    "heading": "Lista tillgängliga diskar",
+    "body": "En skrivskyddad diagnostikvy: visar utdata av <code>lsblk -o NAME,SIZE,TYPE,FSTYPE,MOUNTPOINT,MODEL</code> följt av <code>dir</code> / <code>zfspool</code> lagringar Proxmox vet redan om. Bra första stopp när du öppnar verktyget och vill se \"vad är på denna värd?\" innan du lägger till något."
+  },
+  "troubleshoot": {
+    "heading": "Felsökning",
+    "noDisksTitle": "\"Inga tillgängliga diskar hittade\"",
+    "noDisksIntro": "Säkerhetsfiltret gömde varje disk. Vanliga skäl:",
+    "noDisksItems": [
+      "Endast rotskivan är närvarande.",
+      "Varje annan disk är en del av en aktiv ZFS / LVM / RAID-array.",
+      "Varje annan disk refereras av en VM eller LXC konfig (genomgång).",
+      "Disken är skrivskyddad (hårdvarufel eller skrivblockerare)."
+    ],
+    "noDisksOutro": "Använd <em>List Available Disks</em> från menyn för att se den råa <code>lsblk</code>-utgången och förstå vad som händer.",
+    "mountedTitle": "Format misslyckas med \"enhet är monterad\"",
+    "mountedBody": "Något automatiskt monterade disken (udisksd, en skrivbordshanterare, en kvardröjande systemd-enhet). Avmontera den: <code>umount /dev/sdX?*</code> eller <code>systemctl stop &lt;whatever-mounts-it&gt;</code>, och försök igen. Skriptets säkerhetsfilter ska ha dolda monterade diskar, så om du nådde detta fel inträffade monteringen mellan menyn och du bekräftar.",
+    "zpoolTitle": "zpool create misslyckas med ”invalid vdev specification”",
+    "zpoolBody": "Vanligtvis betyder disken fortfarande har gamla GPT / LVM / ZFS signaturer som <code>zpool</code> vägrar att skriva utan att tvingas. Manuset kör <code>wipefs</code> och <code>sgdisk --zap-all</code> före formatet, men en mycket envis disk kan fortfarande ha en gammal etikett. Tvinga en rensning manuellt: <code>zpool labelclear -f /dev/sdX</code> eller <code>dd if=/dev/zero of=/dev/sdX bs=1M count=10</code> och försök igen.",
+    "inactiveTitle": "Lagring visar som inaktiv efter omstart",
+    "inactiveBody": "Kontrollera <code>findmnt &lt;mount-path&gt;</code> - om fästet saknas, missade något i <code>/etc/fstab</code>. <code>dmesg | tail</code> pekar vanligen på orsaken (UUID felmatch, filsystem korruption, <code>nofail</code> släppte retry). En <code>mount -a</code> återaktiverar vanligtvis lagringen när orsaken är fast."
+  },
+  "related": {
+    "heading": "Relaterad",
+    "items": [
+      {
+        "href": "/docs/disk-manager/format-disk",
+        "label": "Diskhanterare: formatera / radera fysisk disk",
+        "tail": " — låg nivå alternativ när du bara vill förbereda en disk utan att registrera den som Proxmox lagring."
+      },
+      {
+        "href": "/docs/storage-share/host-iscsi",
+        "label": "Lägg till iSCSI-mål som Proxmox-lagring",
+        "tail": " — motsvarande nätverkslösning när blockenheten finns på en annan dator."
+      },
+      {
+        "href": "/docs/storage-share/host-local-shared",
+        "label": "Lägg till delad katalog på värd",
+        "tail": " — förbered en katalog på värden för LXC-bind-monteringar (registrerar ingen Proxmox-lagring)."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sv/docs/storage-share/host-local-shared.json b/web/messages/sv/docs/storage-share/host-local-shared.json
new file mode 100644
index 00000000..ca4f1151
--- /dev/null
+++ b/web/messages/sv/docs/storage-share/host-local-shared.json
@@ -0,0 +1,103 @@
+{
+  "meta": {
+    "title": "Värd: Lägg till delad katalog på Värd | ProxMenux Dokumentation",
+    "description": "Skapa en värdkatalog för LXC-bind-monteringar med behörigheter för både privilegierade och oprivilegierade containrar. Sticky bit, rwx för alla och standard-ACL:er för arv.",
+    "ogTitle": "Värd: Lägg till delad katalog på Värd | ProxMenux Dokumentation",
+    "ogDescription": "Förbered en värdkatalog för LXC-bind-monteringar med behörigheter som är kompatibla med privilegierade och oprivilegierade CT."
+  },
+  "header": {
+    "title": "Värd: Lägg till delad katalog på värd",
+    "description": "Skapa en värdkatalog utformad för att vara bindmonterad till en eller flera LXC-behållare. ProxMenux tillämpar en uppsättning behörigheter som fungerar för både privilegierade och oprivilegierade CT på en gång - ingen skiftad UID huvudvärk, inga per-container chowns - och registrerar katalogen så LXC Mount Manager kan plocka upp det senare.",
+    "section": "Lagring och delning · Värd"
+  },
+  "intro": {
+    "title": "Vad detta är (och inte)",
+    "body": "Det här verktyget registrerar <strong>inte</strong> något i Proxmox (ingen <code>pvesm add</code> här). Den förbereder bara en katalog på värden — <code>/mnt/shared</code>, som standard — med behörigheter som alla LXC-behållare kan läsa och skriva, oavsett om CT är privilegierad eller oprivilegierad. Det vanliga nästa steget är att bind-montera den i varje CT med <mountLink>LXC Mount Manager</mountLink>."
+  },
+  "why": {
+    "heading": "Varför ett dedikerat verktyg för detta",
+    "intro": "När du binder en värdkatalog till en LXC-behållare beror behörigheter på:",
+    "items": [
+      "Om CT:n är <strong>privilegierad</strong> (UID 0 i CT = UID 0 på värden) eller <strong>oprivilegierad</strong> (UID 0 i CT = UID 100000 på värden — allt förskjuts med +100000).",
+      "Värdkatalogens ägare (en fil som ägs av UID 1000 på värden använder behörigheterna för ”övriga” ur en oprivilegierad CT:s perspektiv, eftersom ingen CT-användare mappas till värdens UID 1000).",
+      "Oavsett om flera CT delar samma katalog (annorlunda CT kan ha olika UID-intervall)."
+    ],
+    "outro": "ProxMenux använder en praktisk metod: <strong>ge alla åtkomst</strong> på filsystemnivå med rwx för alla, sticky bit och ACL:er för arv av behörigheter. Alla mappade UID:n kan läsa och skriva; ingen anpassning av UID/GID behövs."
+  },
+  "howRuns": {
+    "heading": "Så körs skriptet",
+    "body": "Skriptet har ingen huvudmeny - det driver en enda åtgärd, <strong>Skapa delad katalog</strong>. Fas 1 samlar in målvägen; Fas 2 skapar katalogen och tillämpar behörigheter."
+  },
+  "bits": {
+    "heading": "Vad varje tillstånd bit gör",
+    "intro": "Numret <strong>1777</strong> är inte godtyckligt - det är samma läge Linux använder för <code>/tmp</code>. Tre egenskaper kombinerade:",
+    "headerBit": "Bit",
+    "headerEffect": "Effekt",
+    "headerWhy": "Varför det spelar roll här",
+    "rows": [
+      {
+        "bit": "1 (sticky bit)",
+        "effect": "Bara filägaren, katalogägaren eller en process med tillräckliga privilegier får ta bort eller byta namn på filen.",
+        "why": "Hjälper till att hindra användare med olika mappade UID:n från att radera varandras filer. Isolerar inte CT:er som delar mappat UID eller privilegierad rootåtkomst."
+      },
+      {
+        "bit": "777 (rwx-rwx-rwx)",
+        "effect": "Alla kan läsa, skriva och korsa.",
+        "why": "Oprivilegierade CT UID (100000+) visas som \"andra\" från värden, så världsrwx ger dem tillgång."
+      },
+      {
+        "bit": "ACL:er (standard)",
+        "effect": "Ärvd på varje nyskapad fil/underdir.",
+        "why": "Nytt innehåll ärver standard-ACL:erna utan att skriptet körs igen. Program kan fortfarande begära restriktiva lägen eller ändra behörigheter senare."
+      }
+    ],
+    "privTitle": "Privilegierade CT ser samma sak, bara utan skiftet",
+    "privBody": "För en privilegierad CT, UID 0 i CT är UID 0 på värden, så <code>root</code> inuti CT kan läsa / skriva värdkatalogen direkt. <code>1777</code> är fortfarande bra - det betyder bara att icke-rotanvändare i CT också kan använda katalogen. Samma behörighet omfattar båda fallen."
+  },
+  "where": {
+    "heading": "Var ska man sätta den delade katalogen",
+    "intro": "Platsvalaren erbjuder fyra alternativ:",
+    "opt1Title": "1. Skapa ny mapp i /mnt",
+    "opt1Body": "Det vanliga valet. ProxMenux auto föreslår det första fria namnet (<code>shared</code>, <code>shared2</code>, <code>shared3</code>, ...). Du bekräftar eller skriver ett annat namn.",
+    "opt2Title": "2. Ange anpassad väg",
+    "opt2Body": "För kataloger utanför <code>/mnt</code>. All absolut väg fungerar (t.ex. <code>/srv/media</code>, <code>/data/family</code>). Skriptet tillämpar samma behörigheter.",
+    "opt3Title": "3. Visa befintliga mappar i /mnt",
+    "opt3Body": "Läs-bara diagnostik: listar varje katalog under <code>/mnt</code> med sina behörigheter, ägare och tillgängligt utrymme. Användbar innan du skapar en ny för att undvika namnkollisioner.",
+    "opt4Title": "4. Avbryt",
+    "opt4Body": "Avslutar utan att skapa något, som att trycka på <kbd>Esc</kbd>.",
+    "tipTitle": "Var bor /mnt?",
+    "tipBody": "Som standard <code>/mnt</code> sitter på Proxmox rotfilsystem. Om du vill ha den delade katalogen på en annan disk (en dataskiva, en ZFS pool), montera den disken under <code>/mnt/&lt;name&gt;</code> först (Disk Manager eller <diskLink>Lägg till lokal disk som Proxmox lagring</diskLink>), och sedan skapa den delade katalogen som en undermapp i den - eller välj \"Ange anpassad sökväg\" här och peka på den monterade disken."
+  },
+  "manual": {
+    "heading": "Manuell motsvarande",
+    "body": "Hela flödet kan återspelas för hand:"
+  },
+  "next": {
+    "heading": "Nästa steg: bind-mount i containrar",
+    "body": "Att skapa katalogen förbereder den bara – ingen container ser den ännu. För att göra det synligt inuti en eller flera LXC:er, använd <mountLink>LXC Mount Manager</mountLink> för att binda <code>/mnt/&lt;name&gt;</code> till CT:erna. Eftersom behörigheterna redan är öppna, kommer Mount Manager <strong>inte</strong> att erbjuda att ändra dem – katalogen är redo att användas som den är."
+  },
+  "troubleshoot": {
+    "heading": "Felsökning",
+    "mkdirTitle": "\"Failed to create directory\"",
+    "mkdirBody": "Vanligtvis ett filsystemproblem: <code>/mnt</code> är på ett skrivskyddat filsystem, banan innehåller en komponent som inte är en katalog (t.ex. du skrev <code>/etc/passwd/sub</code>), eller disken är full. Kolla med <code>df -h /mnt</code> och <code>mount | grep /mnt</code>.",
+    "writeTitle": "Container kan inte skriva trots öppna behörigheter",
+    "writeBody": "Dubbelkolla CT använder faktiskt bindfästet (<code>pct config &lt;ctid&gt; | grep ^mp</code>). Inuti CT, kör <code>touch /mnt/data/test-$(date +%s)</code> - om detta misslyckas med tillstånd nekas, kan fästet vara på ett värdfilsystem som inte hedrar ACLs (vissa äldre <code>ext3</code> eller <code>vfat</code> fästen). Flytta den delade katalogen till en ext4 / xfs / btrfs / zfs-backning.",
+    "aclTitle": "ACL kommandon tyst otillgängliga",
+    "aclBody": "På en minimal Proxmox installera <code>setfacl</code> / <code>getfacl</code> kanske inte installeras. Manuset faller tillbaka graciöst (<code>command -v setfacl</code> check) och tillämpar endast POSIX behörigheter - vilket ofta är tillräckligt, men nya filer kommer inte automatiskt att ärva den tillåtna profilen. Installera <code>acl</code> med <code>apt-get install -y acl</code> och kör om manuset på katalogen."
+  },
+  "related": {
+    "heading": "Relaterad",
+    "items": [
+      {
+        "href": "/docs/storage-share/lxc-mount-points",
+        "label": "Monteringshanterare för LXC",
+        "tail": " - det naturliga nästa steget: binda samman denna katalog till en eller flera containrar."
+      },
+      {
+        "href": "/docs/storage-share/host-local-disk",
+        "label": "Lägg till lokal disk som Proxmox lagring",
+        "tailRich": " — Om du vill ha den delade katalogen på en dedikerad disk, förbered disken först, montera den under <code>/mnt</code>, skapa sedan den delade undermappen här."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sv/docs/storage-share/host-nfs.json b/web/messages/sv/docs/storage-share/host-nfs.json
new file mode 100644
index 00000000..bf3fe357
--- /dev/null
+++ b/web/messages/sv/docs/storage-share/host-nfs.json
@@ -0,0 +1,174 @@
+{
+  "meta": {
+    "title": "Värd: montera NFS-delning | ProxMenux-dokumentation",
+    "description": "Montera en extern NFS-export på Proxmox-värden som Proxmox-lagring med pvesm add nfs, som ett separat fstab-montage som inte visas i Datacenter > Storage eller på båda sätten. Fstab passar när sökvägen ska delas med LXC-containrar via bind mount utan att registreras som Proxmox-lagring.",
+    "ogTitle": "Värd: montera NFS-delning | ProxMenux-dokumentation",
+    "ogDescription": "Montera en extern NFS-export på Proxmox-värden via pvesm, fstab eller båda. fstab-väg är idealisk för LXC-bindning."
+  },
+  "header": {
+    "title": "Värd: montera NFS-delning på värden",
+    "description": "Montera en extern NFS export (från en NAS, en annan server, en homelab-delning ...) på Proxmox värd. Välj en eller båda metoderna: registrera den som Proxmox-lagring (synlig i Datacenter > Lagring) och / eller lägg till en vanlig /etc/fstab-montering på en väg du väljer (användbar för bindmontering av delningen i LXC-behållare utan att exponera den som en Proxmox-lagring).",
+    "section": "Lagring och delning · Värd"
+  },
+  "intro": {
+    "title": "Vad detta gör",
+    "body": "ProxMenux erbjuder två sätt att montera en NFS-export: <strong>(1) Proxmox-lagring</strong> via <code>pvesm add nfs</code>, där resursen visas i Datacenter > Lagring och Proxmox hanterar monteringen på <code>/mnt/pve/&lt;id&gt;</code>; <strong>(2) fstab-montering på värden</strong> på en sökväg du väljer, beständig genom <code>/etc/fstab</code> och inte synlig som Proxmox-lagring. Det senare passar för bind-montering till LXC-containrar utan extra poster i Proxmox-gränssnittet. Du kan använda endera metoden eller båda."
+  },
+  "opening": {
+    "heading": "Öppna verktyget",
+    "body": "Öppna <strong>Storage &amp; Share Manager → Mount NFS Share on Host</strong> i ProxMenux huvudmeny. Undermenyn har fyra alternativ:",
+    "imageAlt": "NFS-värdmeny — Montera / Visa / Ta bort / Testa anslutning"
+  },
+  "howRuns": {
+    "heading": "Hur manuset går",
+    "body": "Flödet har två faser med tydlig separation mellan \"upptäcka, validera och välja\" och \"faktiskt montering / skrivkonfig\". Efter att ha valt en export väljer du monteringsmetod (er) via en checklista; resten av dialogrutorna ber bara om param för de metoder du valde. Fram till den slutliga bekräftelsen berörs varken <code>/etc/pve/storage.cfg</code> eller <code>/etc/fstab</code>."
+  },
+  "modes": {
+    "heading": "Välj monteringsmetod (ett eller båda alternativen)",
+    "intro": "Efter att ha valt och validerat exporten visar ProxMenux en checklista med de två monteringsmetoderna. Du kan markera antingen, eller båda. Om du trycker på OK utan att markera något, återkommer dialogrutan tills du väljer minst ett alternativ eller trycker på Avbryt flödet.",
+    "imageAlt": "Mount metod checklista med pvesm och fstab alternativ",
+    "headerMethod": "Metod",
+    "headerMount": "Monteringssökväg",
+    "headerUi": "Synlig i datacenter > Lagring",
+    "headerUseCase": "Typiskt användningsfall",
+    "rows": [
+      {
+        "method": "<strong>Som Proxmox-lagring (pvesm)</strong>",
+        "mountRich": "<code>/mnt/pve/&lt;storage-id&gt;</code> (hanterad av Proxmox)",
+        "ui": "Ja",
+        "useCase": "VM diskbilder, säkerhetskopior, ISOs, LXC mallar - allt som behöver visas i Proxmox UI."
+      },
+      {
+        "method": "<strong>Endast värdens fstab</strong>",
+        "mountRich": "<code>/mnt/&lt;path&gt;</code> (du väljer vägen)",
+        "ui": "Nej",
+        "useCaseRich": "Bind-montera delningen i en eller flera LXC:er <em>utan</em> att registrera den som Proxmox-lagring. Håller Datacenter-gränssnittet överskådligt."
+      },
+      {
+        "method": "<strong>Båda</strong>",
+        "mount": "Båda sökvägarna ovan (två monteringspunkter för samma NFS-export)",
+        "ui": "Ja",
+        "useCase": "Integrering i gränssnittet och en separat stabil värdsökväg med öppna behörigheter för LXC-bind-monteringar."
+      }
+    ],
+    "bothTitle": "\"Både\" skapar två oberoende NFS-fästen",
+    "bothBody": "Båda metoderna körs separat: pvesm monterar på <code>/mnt/pve/&lt;id&gt;</code> och fstab på <code>/mnt/&lt;path&gt;</code>. Det ger en Proxmox-hanterad montering med standardalternativ och en separat värdmontering för LXC-bind-monteringar. Två monteringspunkter garanterar inte två TCP-anslutningar; NFS-klienten kan återanvända transportanslutningar."
+  },
+  "pvesmBranch": {
+    "heading": "Metod A - Som Proxmox lagring (pvesm)",
+    "intro": "Om <em>Som Proxmox-lagring</em> är markerad, ProxMenux kör den ursprungliga pvesm flöde:",
+    "items": [
+      "<strong>Lagring ID</strong> Vad Proxmox kallar detta lagringsutrymme Standard är <code>nfs-&lt;server-ip-with-dashes&gt;</code>. Endast bokstäver, siffror, <code>-</code> och <code>_</code> accepteras.",
+      "<strong>Content typer</strong> - Proxmox binder innehållskategorier till lagringsvolymer; välj vad denna NFS är tillåtet att hålla:"
+    ],
+    "headerType": "Innehåll typ",
+    "headerAllows": "Vad det tillåter",
+    "rows": [
+      {
+        "type": "import",
+        "allowsRich": "Diskbildsimport (vald som standard). Behövs för <em>Import Disk Image till VM</em>."
+      },
+      {
+        "type": "backup",
+        "allowsRich": "VM och CT backup filer (<code>vzdump</code>)."
+      },
+      {
+        "type": "iso",
+        "allows": "Installation av ISO-bilder."
+      },
+      {
+        "type": "vztmpl",
+        "allows": "LXC mallar."
+      },
+      {
+        "type": "images",
+        "allows": "Diskavbildningar för VM:ar i drift (gör NFS till lagring för VM-diskar)."
+      },
+      {
+        "type": "rootdir",
+        "allows": "LXC rotfilsystem (sällsynta för NFS - läs anteckningen nedan)."
+      },
+      {
+        "type": "snippets",
+        "allows": "Hook scripts och cloud-init snippets."
+      }
+    ],
+    "warnTitle": "images och rootdir på NFS",
+    "warnBody": "Med <code>images</code> kan Proxmox lagra VM-diskar på NFS. Prestandan beror på nätverk, server och arbetslast; ett avbrott kan blockera I/O som beror på monteringen. <code>rootdir</code> lagrar LXC-rotfilsystem på NFS, där oprivilegierade containrar kan möta begränsningar i UID-mappning, overlay och ägarskap. Bedöm detta innan du lägger <code>images</code> / <code>rootdir</code> där; NFS passar även för <code>backup</code> / <code>iso</code> / <code>vztmpl</code>.",
+    "result": "Resultatet är <code>pvesm add nfs &lt;id&gt; --server &lt;srv&gt; --export &lt;path&gt; --content &lt;csv&gt;</code> och Proxmox auto-mounts på <code>/mnt/pve/&lt;id&gt;</code>."
+  },
+  "fstabBranch": {
+    "heading": "Metod B - Värd fstab montering endast",
+    "intro": "Om <em>Endast fstab-montering på värden</em> är markerad, ProxMenux ber om en värd monteringsväg och ihållande alternativ, sedan monterar och skriver ingången till <code>/etc/fstab</code>:",
+    "items": [
+      "<strong>Monteringssökväg på värden</strong> - standard <code>/mnt/&lt;export-basename&gt;</code>. Måste vara en absolut väg. Om något redan är monterat där, eller en fstab ingång finns för samma väg, ProxMenux varnar dig och erbjuder att ersätta den.",
+      "<strong>Monteringsalternativ</strong> — <em>Läs/skriv</em> (standard: <code>rw,hard,nofail,_netdev,rsize=131072,wsize=131072,timeo=600,retrans=2</code>), <em>Skrivskyddad</em>, <em>Anpassad</em> (ange egna alternativ)."
+    ],
+    "appliesIntro": "När du bekräftar gör skriptet följande:",
+    "applies": [
+      "<code>mkdir -p</code> monteringsvägen.",
+      "<code>mount -t nfs -o &lt;opts&gt; &lt;srv&gt;:&lt;export&gt; &lt;path&gt;</code>.",
+      "Skriver en enradig post till <code>/etc/fstab</code>: <code>&lt;srv&gt;:&lt;export&gt; &lt;path&gt; nfs &lt;opts&gt; 0 0</code>.",
+      "Kör <code>systemctl daemon-reload</code> så systemd plockar upp den nya fstab inträde.",
+      "Försöker köra <code>chmod 1777</code> och <code>setfacl o::rwx</code> på monteringspunkten utan att rapportera eventuella fel. Det lyckas endast om NFS-servern tillåter det; många NAS-exporter tillåter redan alla användare att skriva."
+    ],
+    "lxcTitle": "Använda fstab montering från en LXC",
+    "lxcBody": "Skriptet visar ett <code>pct set</code>-kommando för bind-montering, exempelvis <code>pct set &lt;ctid&gt; -mp0 /mnt/&lt;path&gt;,mp=/mnt/&lt;ct-path&gt;,shared=1,backup=0</code>. Eller använd <mountLink>LXC Mount Manager</mountLink>, som upptäcker fstab-monteringar. <strong>Inget ändras inne i containern</strong>. Åtkomst från en oprivilegierad CT beror på serverbehörigheter för dess mappade UID/GID. Skriptet försöker endast ändra behörigheter från värden; skrivbara exporter och tillverkares standardinställningar garanteras inte. Se Felsökning om åtkomsten misslyckas.",
+    "noUiTitle": "Fstab montering är inte en Proxmox lagring",
+    "noUiBody": "Värd fstab montering är osynlig för Proxmox webb UI - genom design. Det visas inte i <em>Datacenter > Storage</em>, du kan inte välja det i VM / CT skapare, och Proxmox backup jobb kan inte rikta det. Det är bara en värd filsystem väg. Om du också vill ha UI integration, markera <em>båda</em> metoder i väljaren."
+  },
+  "manual": {
+    "heading": "Manuell motsvarande",
+    "pvesmIntro": "Metod A (pvesm) motsvarar:",
+    "fstabIntro": "Metod B (fstab) motsvarar:"
+  },
+  "view": {
+    "heading": "Visa konfigurerade NFS lager",
+    "body": "Listar varje NFS-post i Proxmox (<code>pvesm status | awk ''$2 == \"nfs\"''</code>) med server, export, innehållstyper, monteringsväg och levande status. <strong>Note:</strong> visar endast pvesm-registrerade lager - fstab-bara fästen är inte listade här. Kontrollera dem med <code>findmnt -t nfs</code> eller <code>grep nfs /etc/fstab</code>."
+  },
+  "remove": {
+    "heading": "Ta bort NFS lagring",
+    "body": "Kör <code>pvesm remove &lt;storage-id&gt;</code> efter en bekräftelse som visar server / export / innehåll. Endast Proxmox-side-registreringen tas bort - <strong>Den avlägsna NFS-servern själv är aldrig rörd</strong>, inga filer raderas. För att ta bort en fstab-bara montering, redigera <code>/etc/fstab</code> för hand och kör <code>umount &lt;path&gt;</code>.",
+    "warnTitle": "Säkerhetskopiera beroenden först",
+    "warnBody": "Om VM, CT eller backup jobb fortfarande refererar till detta lagringsutrymme (genom ID), ta bort det lämnar dem pekar på en lagring som inte längre finns. Proxmox kommer att flagga felet men inte städa upp. Flytta eller släppa dessa referenser först, sedan ta bort lagringen."
+  },
+  "test": {
+    "heading": "Test NFS-anslutning",
+    "body": "Kör ett diagnostiskt pass över varje NFS-lagring registrerad i Proxmox: kontrollerar att <code>showmount</code> är tillgänglig, att <code>rpcbind</code> körs, pings varje server, probes port 2049, kallar <code>showmount -e</code>, och slutligen rapporterar Proxmox egen vy (<code>pvesm status</code>). Bra första stopp när en förvaring visar som <em>inactive</em> i Proxmox UI."
+  },
+  "troubleshoot": {
+    "heading": "Felsökning",
+    "noServersTitle": "\"Inga NFS-servrar som finns på nätverket\"",
+    "noServersBody": "Auto-discover använder <code>nmap -p 2049 --open &lt;subnet&gt;/24</code>. Servern kanske inte svarar om: det är på en annan VLAN / subnet, dess brandvägg blockerar nmap-sonder (många gör) eller port 2049 är avsiktligt stängd på det gränssnittet. Använd alternativet <em>Manual</em> med serverns IP- eller värdnamn istället.",
+    "portTitle": "”NFS-porten (2049) kan inte nås”",
+    "portBody": "Ping lyckades men <code>nc -z -w 3 &lt;server&gt; 2049</code> misslyckades. Kontrollera NFS tjänsten körs på servern (<code>systemctl status nfs-server</code> på Linux, Kontrollpanel → Filtjänster på Synology, NFS plugin på OMV / TrueNAS), och att brandväggen tillåter 2049 från Proxmox värd.",
+    "showmountTitle": "\"Fel att ansluta\" från showmount",
+    "showmountBody": "Servern vägrade exportlistafrågan. Vanliga orsaker: servern genomdriver strikta klient ACL (din Proxmox IP är inte på den tillåtna listan), <code>rpcbind</code> körs inte på servern, eller servern exponerar endast NFSv4 med <code>showmount</code> inaktiverat. Exportvägen kan fortfarande läggas manuellt om du vet det.",
+    "inactiveTitle": "Lagring visar som inaktiv i Proxmox UI",
+    "inactiveBody": "Kör först <em>Testa NFS-anslutning</em>: den kontrollerar att servern svarar på ping, att port 2049 är öppen och att exportlistan (<code>showmount -e</code>) är tillgänglig. Om anslutningen fungerar men lagringen förblir inaktiv, kontrollera <code>journalctl -u pvestatd</code> och serverns/exportens inställningar. Återställ först anslutning eller behörigheter. <code>pvesm set &lt;id&gt; --disable 0</code> aktiverar inaktiverad lagring; det är ingen allmän reparation av NFS-fel.",
+    "lxcNoWriteTitle": "fstab montering fungerar men oprivilegierad LXC kan inte skriva genom en bind-mount",
+    "lxcNoWriteBody": "NFS-åtkomst beror på serverns ägare, ACL:er och squash-inställningar. CIFS-alternativ som <code>uid=</code> och <code>file_mode=</code> gäller <strong>inte</strong> för NFS. Med LXC:s standardmappning blir CT-root värdens UID 100000, inte fjärr-UID 0. Ge åtkomst till det faktiska mappade UID/GID:t eller serverns anonyma identitet. <code>no_root_squash</code> påverkar endast fjärr-UID 0 och löser inte alla fall med UID 100000. Skriptet försöker köra <code>chmod 1777</code> men kan inte kringgå serverns behörigheter.",
+    "fstabBootTitle": "fstab montering kommer inte upp efter omstart",
+    "fstabBootBody": "Skriptet lägger till <code>nofail,_netdev</code> så en saknad andel på start blockerar inte start. Om fästet aldrig kommer upp: bekräfta att nätverket är tillgängligt (<code>ping &lt;server&gt;</code>), kontrollera <code>journalctl -u remote-fs.target</code> och verifiera att posten är giltig med <code>mount -fav | grep nfs</code>. <code>mount -a</code> efter start monterar allt som för närvarande saknas."
+  },
+  "related": {
+    "heading": "Relaterad",
+    "items": [
+      {
+        "href": "/docs/storage-share/host-samba",
+        "label": "Samba / CIFS som Proxmox-lagring",
+        "tail": " - samma flödesmönster (Metod A pvesm + Metod B fstab) för SMB/CIFS-delningar."
+      },
+      {
+        "href": "/docs/storage-share/lxc-mount-points",
+        "label": "Monteringshanterare för LXC",
+        "tailRich": " - bind-mount fstab-bara vägen <code>/mnt/&lt;path&gt;</code> i en eller flera containrar."
+      },
+      {
+        "href": "/docs/storage-share/lxc-nfs-client",
+        "label": "NFS klient i LXC",
+        "tail": " — alternativ: montering NFS direkt inifrån en privilegierad container (skippar värden)."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sv/docs/storage-share/host-samba.json b/web/messages/sv/docs/storage-share/host-samba.json
new file mode 100644
index 00000000..2ec63e3b
--- /dev/null
+++ b/web/messages/sv/docs/storage-share/host-samba.json
@@ -0,0 +1,172 @@
+{
+  "meta": {
+    "title": "Värd: montera Samba-delning | ProxMenux-dokumentation",
+    "description": "Montera en extern Samba-/CIFS-delning på Proxmox-värden - antingen som Proxmox-lagring (pvesm add cifs), som en vanlig värd fstab-fäste med öppen uid/gid/file_mode (Inte synlig i Datacenter > Lagring), eller båda. Fstab-metoden öppnar behörigheter så att en oprivilegierad LXC-bindning kan läsa / skriva utan några ändringar i containern.",
+    "ogTitle": "Värd: montera Samba-delning | ProxMenux-dokumentation",
+    "ogDescription": "Montera en extern Samba-/CIFS-delning på Proxmox-värden via pvesm, fstab med öppna behörigheter för LXC-bind-monteringar eller båda."
+  },
+  "header": {
+    "title": "Värd: montera Samba-delning på värden",
+    "description": "Montera en extern Samba-delning (SMB / CIFS) - från en NAS, en Windows-box, en TrueNAS SMB export - på Proxmox värd. Välj en eller båda metoderna: registrera den som Proxmox-lagring (synlig i Datacenter > Lagring) och / eller lägg till en vanlig /etc/fstab-fäste på en väg du väljer, med öppen uid / gid / file_mode så oprivilegierade LXCs kan binda-mount och skriva utan några ändringar i containern.",
+    "section": "Lagring och delning · Värd"
+  },
+  "intro": {
+    "title": "Vad detta gör",
+    "body": "ProxMenux erbjuder två sätt att montera en Samba-resurs: <strong>(1) Proxmox-lagring</strong> via <code>pvesm add cifs</code>, synlig i Datacenter > Storage och monterad på <code>/mnt/pve/&lt;id&gt;</code>. Lösenordet sparas i klartext i <code>/etc/pve/priv/storage/&lt;id&gt;.pw</code>, skyddat av den privata katalog som bara root kan komma åt. Det är åtkomstkontroll, inte kryptering. <strong>(2) fstab-montering på värden</strong> på en vald sökväg, beständig via <code>/etc/fstab</code> med <code>uid=0,gid=0,file_mode=0777,dir_mode=0777</code> så att oprivilegierade LXC-containrar kan skriva via bind-monteringar. Uppgifterna finns i en fil som bara root kan läsa under <code>/etc/samba/credentials/</code>, aldrig direkt i <code>fstab</code>. Du kan använda endera metoden eller båda."
+  },
+  "opening": {
+    "heading": "Öppna verktyget",
+    "body": "Öppna <strong>Storage &amp; Share Manager → Mount Samba Share on Host</strong> i ProxMenux huvudmeny. Undermenyn har fyra alternativ:",
+    "imageAlt": "Samba-värdmeny — Montera / Visa / Ta bort / Testa anslutning"
+  },
+  "howRuns": {
+    "heading": "Hur manuset går",
+    "body": "Flödet har två faser. Fas 1: Upptäck server, validera inloggningsuppgifter, välj delning, välj sedan monteringsmetod (er) via en checklista. Fas 2: endast de metoder du markerade utförs. Inloggningsuppgifter behövs i förväg eftersom <code>smbclient</code> behöver dem för att lista delningar. Fram till den slutliga bekräftelsen berörs varken <code>/etc/pve/storage.cfg</code> eller <code>/etc/fstab</code>."
+  },
+  "modes": {
+    "heading": "Välj monteringsmetod (ett eller båda alternativen)",
+    "intro": "Efter att ha valt delningen och validerat inloggningsuppgifterna visar ProxMenux en checklista med de två monteringsmetoderna. Du kan markera antingen, eller båda. Om du trycker på OK utan att markera något, återkommer dialogrutan tills du väljer minst ett alternativ eller trycker på Avbryt flödet.",
+    "headerMethod": "Metod",
+    "headerMount": "Monteringssökväg",
+    "headerUi": "Synlig i datacenter > Lagring",
+    "headerUseCase": "Typiskt användningsfall",
+    "rows": [
+      {
+        "method": "<strong>Som Proxmox-lagring (pvesm)</strong>",
+        "mountRich": "<code>/mnt/pve/&lt;storage-id&gt;</code> (hanterad av Proxmox)",
+        "ui": "Ja",
+        "useCase": "Säkerhetskopior, ISOs, LXC-mallar - allt som behöver visas i Proxmox UI. Live VM-skivor stöds tekniskt men avskräcks på CIFS (låser semantik)."
+      },
+      {
+        "method": "<strong>Endast värdens fstab</strong>",
+        "mountRich": "<code>/mnt/&lt;path&gt;</code> med öppen uid/gid/file_mode",
+        "ui": "Nej",
+        "useCaseRich": "Bind-montera delningen i LXC:er <em>utan</em> att registrera Proxmox-lagring. Öppna lokala behörigheter underlättar åtkomst för oprivilegierade CT:er, men SMB-servern måste fortfarande tillåta den autentiserade användaren att skriva."
+      },
+      {
+        "method": "<strong>Båda</strong>",
+        "mount": "Båda sökvägarna ovan (två monteringspunkter för samma CIFS-export)",
+        "ui": "Ja",
+        "useCase": "Du vill ha UI-integration och en stabil värdsida med öppna behörigheter för LXC-bindning. pvesm-fästet använder Proxmox-standarder; fstabfästet tillämpar den öppna uid/gid/file_mode separat."
+      }
+    ],
+    "bothTitle": "”Båda” skapar två CIFS-monteringspunkter",
+    "bothBody": "pvesm monterar på <code>/mnt/pve/&lt;id&gt;</code> med Proxmox standardalternativ. fstab monterar på <code>/mnt/&lt;path&gt;</code> med <code>uid=0,gid=0,file_mode=0777,dir_mode=0777</code> för lokal åtkomst via LXC-bind-monteringar. SMB-servern upprätthåller fortfarande monteringsanvändarens behörigheter. Två monteringspunkter garanterar inte två separata TCP-anslutningar."
+  },
+  "pvesmBranch": {
+    "heading": "Metod A - Som Proxmox lagring (pvesm)",
+    "intro": "Om <em>Som Proxmox-lagring</em> är markerad, ProxMenux kör den ursprungliga pvesm flöde:",
+    "items": [
+      "<strong>Lagring ID</strong> - Standard <code>cifs-&lt;server-ip-with-dashes&gt;</code>. Endast bokstäver, siffror, <code>-</code> och <code>_</code>.",
+      "<strong>Innehållstyper</strong> — den här ProxMenux-listan har <strong>6</strong> val. Den utelämnar <code>rootdir</code> jämfört med NFS-listan. Detta är ett val i skriptet, inte ett påstående att alla versioner av Proxmox CIFS-backend förbjuder LXC-rotfilsystem:"
+    ],
+    "headerType": "Innehåll typ",
+    "headerAllows": "Vad det tillåter",
+    "rows": [
+      {
+        "type": "import",
+        "allows": "Diskbildsimport (vald som standard)."
+      },
+      {
+        "type": "backup",
+        "allowsRich": "VM och CT backup filer (<code>vzdump</code>)."
+      },
+      {
+        "type": "iso",
+        "allows": "Installation av ISO-bilder."
+      },
+      {
+        "type": "vztmpl",
+        "allows": "LXC mallar."
+      },
+      {
+        "type": "images",
+        "allowsRich": "Diskavbildningar för VM:ar i drift — <strong>varning visas i dialogen</strong>, se nedan."
+      },
+      {
+        "type": "snippets",
+        "allows": "Hook scripts och cloud-init snippets."
+      }
+    ],
+    "warnTitle": "Live VM diskar på CIFS",
+    "warnBody": "Valet <code>images</code> visar en ProxMenux-varning om att CIFS/SMB kan ge låsningsproblem vid VM-diskoperationer. Skriptet rekommenderar NFS men låter dig fortsätta. Säkerhetskopior och ISO-filer är vanliga CIFS-användningar. Bedöm låsning, ögonblicksbilder, migrering och arbetslast innan CIFS används för <code>images</code>.",
+    "credsTitle": "Var pvesm lagrar inloggningsuppgifter",
+    "credsBody": "Lösenordet skrivs inte i <code>/etc/pve/storage.cfg</code>. Proxmox sparar klartextuppgifter i <code>/etc/pve/priv/storage/&lt;storage-id&gt;.pw</code>, i klusterfilsystemets privata område som bara <code>root</code> kan läsa (läge <code>0600</code>); de skyddas av åtkomstbehörigheter, inte av kryptering. Efter ett lösenordsbyte på servern använder du <code>pvesm set &lt;id&gt; --password &lt;new&gt;</code> eller tar bort och lägger till lagringen via ProxMenux."
+  },
+  "fstabBranch": {
+    "heading": "Metod B - Värd fstab montering endast",
+    "intro": "Om <em>Endast fstab-montering på värden</em> väljs frågar ProxMenux efter sökväg och beständiga alternativ, skapar en fil med inloggningsuppgifter endast för root i användarläge, monterar delningen och skriver posten i <code>/etc/fstab</code>:",
+    "items": [
+      "<strong>Monteringssökväg på värden</strong> - standard <code>/mnt/&lt;share-name&gt;</code>. Måste vara en absolut väg. Om något redan är monterat där, eller en fstab-post existerar, erbjuder ProxMenux att ersätta den.",
+      "<strong>Monteringsalternativ</strong> — <em>Läs/skriv</em> (standard: <code>rw,uid=0,gid=0,file_mode=0777,dir_mode=0777,iocharset=utf8,nofail,_netdev</code>), <em>Skrivskyddad</em> (<code>file_mode=0555,dir_mode=0555</code>), <em>Anpassad</em> (ange egna alternativ). Skriptet rekommenderar öppna uid/gid/file_mode för skrivning via LXC-bind-monteringar."
+    ],
+    "credsTitle": "Fil med inloggningsuppgifter (användarläge)",
+    "credsBody": "I användarläge skapar ProxMenux en fil som bara root kan läsa på <code>/etc/samba/credentials/&lt;server&gt;_&lt;share&gt;.cred</code> (läge <code>0600</code>) med raderna <code>username=</code> och <code>password=</code>. Fstab-posten hänvisar till den via <code>credentials=</code>; klartextlösenordet skrivs inte i <code>/etc/fstab</code>. I gästläge läggs <code>guest</code> till i stället och ingen inloggningsfil skapas.",
+    "appliesIntro": "När du bekräftar gör skriptet följande:",
+    "applies": [
+      "<code>mkdir -p</code> monteringsvägen.",
+      "<code>mount -t cifs -o &lt;opts&gt;,credentials=&lt;file&gt;</code> (eller <code>guest</code>) <code>//&lt;srv&gt;/&lt;share&gt; &lt;path&gt;</code>.",
+      "Skriver en enradig post till <code>/etc/fstab</code>: <code>//&lt;srv&gt;/&lt;share&gt; &lt;path&gt; cifs &lt;opts&gt; 0 0</code>.",
+      "Kör <code>systemctl daemon-reload</code> så systemd plockar upp den nya fstab inträde."
+    ],
+    "lxcTitle": "Använda fstab montering från en oprivilegierad LXC",
+    "lxcBody": "CIFS-alternativen <code>uid=0,gid=0,file_mode=0777,dir_mode=0777</code> öppnar lokala behörighetskontroller för LXC-bind-monteringar. Serverns ACL:er och förhandlad Unix-/POSIX-semantik kan fortfarande påverka åtkomsten. <strong>Inget ändras inne i containern</strong>: ingen <code>chown</code> i CT:n, inga grupper eller ändringar i <code>/etc/lxc</code>. Raden <code>mp</code> hanteras i Proxmox CT-konfiguration. Använd det visade <code>pct set</code>-kommandot eller <mountLink>LXC Mount Manager</mountLink>.",
+    "noUiTitle": "Fstab montering är inte en Proxmox lagring",
+    "noUiBody": "Värd fstab montering är osynlig för Proxmox webb UI - genom design. Det visas inte i <em>Datacenter > Storage</em>, du kan inte välja det i VM / CT skapare, och Proxmox backup jobb kan inte rikta det. Det är bara en värd filsystem väg. Om du också vill ha UI integration, markera <em>båda</em> metoder i väljaren."
+  },
+  "manual": {
+    "heading": "Manuell motsvarande",
+    "pvesmIntro": "Metod A (pvesm) motsvarar:",
+    "fstabUserIntro": "Metod B (fstab, användarautentisering) — fil med inloggningsuppgifter och montering:",
+    "fstabGuestIntro": "Metod B (fstab, gästautentisering) — ingen fil med inloggningsuppgifter:"
+  },
+  "view": {
+    "heading": "Visa CIFS-lagringar och värdmonteringar",
+    "body": "Visar registrerade CIFS-lagringar (<code>pvesm status | awk ''$2 == \"cifs\"''</code>) med server, delning, innehåll, användare eller <em>Gäst</em>, sökväg och status. Lösenord <strong>visas aldrig</strong>. <strong>Obs:</strong> ett andra avsnitt visar värdens fstab-monteringar, alternativ, inloggningsfilens sökväg och aktiv/inaktiv status. Kontrollera manuellt med <code>findmnt -t cifs</code> eller <code>grep cifs /etc/fstab</code>."
+  },
+  "remove": {
+    "heading": "Ta bort CIFS-lagring eller värdmontering",
+    "body": "Väljaren erbjuder pvesm-lagringar och värdens fstab-monteringar. För pvesm körs <code>pvesm remove &lt;storage-id&gt;</code> och Proxmox tar bort motsvarande inloggningsuppgifter. För fstab försöker skriptet köra <code>umount &lt;path&gt;</code>, tar bort posten i <code>/etc/fstab</code> och uppgifter under <code>/etc/samba/credentials/</code> samt den tomma monteringskatalogen om möjligt. Misslyckad avmontering kräver manuell avmontering eller omstart. <strong>Den externa Samba-servern och dess filer ändras inte</strong>.",
+    "warnTitle": "Säkerhetskopiera beroenden först",
+    "warnBody": "VM, CT eller backup jobb som refererar till denna lagring av ID kommer att misslyckas efter borttagning. Flytta/släpp dessa referenser innan du tar bort lagringen."
+  },
+  "test": {
+    "heading": "Testa Samba-anslutning",
+    "body": "Kör ett diagnostiskt pass över varje CIFS-lagring registrerad i Proxmox: kontrollerar att <code>smbclient</code> är tillgänglig, pings varje server, probes portar 445 och 139, försöker en gästlista och rapporterar Proxmox egen vy (<code>pvesm status</code>). \"Kräver autentisering\" på gästlista betyder att din server endast exponerar aktier till autentiserade användare - normalt för de flesta NAS-inställningar."
+  },
+  "troubleshoot": {
+    "heading": "Felsökning",
+    "noServersTitle": "\"Inga Samba-servrar som finns på nätverket\"",
+    "noServersBody": "Auto-discover använder <code>nmap -p 139,445</code>. Servern kan vara på ett annat undernät, brandvägg eller bara nås via värdnamn (mDNS / WINS). Använd alternativet <em>Manual</em> med IP eller värdnamn istället.",
+    "noSharesTitle": "”Inga tillgängliga delningar hittades”",
+    "noSharesBody": "<code>smbclient -L</code> returnerade ingenting för dessa referenser. Orsaker: användaren har ingen tillåtelse att lista delningar (försök med admin referenser en gång eller ange delningens namn manuellt), servern har dela synlighet inaktiverad, eller referenser är fel. Skriptet låter dig skriva delningens namn för hand i det här fallet.",
+    "denyTitle": "Proxmox montering misslyckas med NT_STATUS_ACCESS_DENIED",
+    "denyBody": "Credentials pvesm lagras inte synkroniseras med Samba-servern (lösenord ändras, konto funktionshindrad, domän / arbetsgrupp felmatch). Ange referenser med <code>pvesm set &lt;id&gt; --username &lt;u&gt; --password &lt;p&gt;</code> eller ta bort och re-add från ProxMenux. Om servern finns i en AD-domän, använd <code>--domain &lt;DOMAIN&gt;</code> till <code>pvesm set</code>-samtalet.",
+    "sleepTitle": "\"host is down\" eller lagringsstatus går inaktiv på natten",
+    "sleepBody": "Vissa NAS-apparater sätter SMB för att sova aggressivt. <code>pvestatd</code> ser sedan lagringen som inaktiv tills den första åtkomsten vaknar NAS. Om detta är kosmetiskt, är ingenting brutet. Om det orsakar säkerhetskopieringsfel, inaktivera SMB-idle koppla bort på NAS eller schemalägga säkerhetskopior utanför sömnfönstret.",
+    "lxcNoWriteTitle": "Oprivilegierad LXC bind-mount kan inte skriva till fstab-banan",
+    "lxcNoWriteBody": "Kontrollera avsedda alternativ med <code>findmnt /mnt/&lt;path&gt;</code>, exempelvis <code>uid=0,gid=0,file_mode=0777,dir_mode=0777</code>. Saknade lokala skrivbehörigheter kan blockera mappade LXC-UID:n. Tillämpa RW-profilen igen eller anpassa egna alternativ. Kontrollera även SMB-användarens skrivbehörighet på servern och om Unix-/POSIX-tillägg ger serverlägen; öppna lokala lägen åsidosätter inte serverns ACL:er.",
+    "fstabBootTitle": "fstab montering kommer inte upp efter omstart",
+    "fstabBootBody": "Skriptet lägger till <code>nofail,_netdev</code> så en saknad delning på start blockerar inte start. Om fästet aldrig kommer upp: bekräfta att nätverket är tillgängligt (<code>ping &lt;server&gt;</code>), kontrollera <code>journalctl -u remote-fs.target</code>, verifiera filen med inloggningsuppgifter fortfarande finns (<code>ls -l /etc/samba/credentials/</code>) och är läsbar och prova <code>mount -a</code> manuellt."
+  },
+  "related": {
+    "heading": "Relaterad",
+    "items": [
+      {
+        "href": "/docs/storage-share/host-nfs",
+        "label": "NFS-delning som Proxmox-lagring",
+        "tail": " — syskon sida med samma flödesmönster (Metod A pvesm + Metod B fstab) och sida vid sida avvägningar."
+      },
+      {
+        "href": "/docs/storage-share/lxc-mount-points",
+        "label": "Monteringshanterare för LXC",
+        "tailRich": " - bind-mount fstab-bara vägen <code>/mnt/&lt;path&gt;</code> i en eller flera containrar."
+      },
+      {
+        "href": "/docs/storage-share/lxc-samba-client",
+        "label": "Samba klient i LXC",
+        "tail": " — alternativ: montering Samba direkt inifrån en privilegierad container (skippar värden)."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sv/docs/storage-share/index.json b/web/messages/sv/docs/storage-share/index.json
new file mode 100644
index 00000000..fec1b09e
--- /dev/null
+++ b/web/messages/sv/docs/storage-share/index.json
@@ -0,0 +1,135 @@
+{
+  "meta": {
+    "title": "Proxmox NFS, Samba, iSCSI och LXC-monteringspunkter — Lagring och delning | ProxMenux",
+    "description": "Integrera extern och lokal lagring i Proxmox VE och dela mappar mellan värden och LXC-containrar. Lägg till NFS-delningar, Samba-delningar (CIFS) och iSCSI-mål som Proxmox-lagring, konfigurera LXC-bind-monteringar med Mount Manager och kör NFS-/Samba-klienter och servrar i containrar.",
+    "ogTitle": "Proxmox NFS, Samba, iSCSI och LXC-monteringspunkter — Lagring och delning",
+    "ogDescription": "Integrera extern / lokal lagring i Proxmox VE - NFS, Samba, iSCSI registrering plus LXC-bind-monteringar och nätverksdelning.",
+    "twitterTitle": "Proxmox NFS, Samba, iSCSI | ProxMenux",
+    "twitterDescription": "Lägg till NFS / Samba / iSCSI som Proxmox lagring och dela mappar mellan värd och LXC."
+  },
+  "header": {
+    "title": "Lagrings- och delningshanterare",
+    "description": "Integrera extern eller lokal lagring i Proxmox VE och dela mappar mellan värden och LXC-containrar. Tre verktygsgrupper: integration av värdlagring (registrera lagring i Proxmox), LXC Mount Manager (bind-monteringar med praktisk behörighetshantering) och LXC-nätverksdelning (NFS-/Samba-klienter och servrar för särskilda användningsfall).",
+    "section": "Lagring och delning"
+  },
+  "intro": {
+    "title": "Vad denna meny är för",
+    "body": "Disk Manager arbetar med <em>enskilda fysiska diskar</em>. Storage &amp; Share Manager arbetar en nivå högre: det <strong>registrerar lagringspooler och nätverksdelningar i Proxmox</strong> (så att gränssnittet och VM-skaparen kan använda dem) och <strong>konfigurerar fildelning mellan värden och dina containrar</strong>."
+  },
+  "opening": {
+    "heading": "Öppna menyn",
+    "body": "Från ProxMenux huvudmenyn väljer du <strong>Storage &amp; Share Manager</strong>. Du kommer att se detta:",
+    "imageAlt": "Storage & Share Manager menyn med HOST och LXC block"
+  },
+  "groups": {
+    "heading": "Tre verktygsgrupper",
+    "intro": "Menyn är indelad i tre grupper. <strong>Integration av värdlagring</strong> registrerar extern eller lokal lagring i Proxmox. <strong>LXC Mount Manager</strong> är huvudverktyget för att dela mappar med containrar: ett praktiskt bind-monteringsflöde som hanterar UID-mappning för oprivilegierade CT:er på värdsidan. <strong>LXC-nätverksdelning</strong> täcker fyra ytterligare scenarier där en container behöver <em>använda</em> eller <em>exponera</em> NFS-/Samba-delningar direkt.",
+    "hostTitle": "Värdlagring",
+    "hostBody": "Registrera extern och lokal lagring i Proxmox via <code>pvesm add …</code>. När den är registrerad visas lagringen i Proxmox UI och är tillgänglig för VM och CT skapare.",
+    "hostItems": [
+      "Extern NFS / Samba / iSCSI → Proxmox-lagring",
+      "Lokal disk → Proxmox katalog eller ZFS-lagring",
+      "Lokal delad katalog (för bind-monteringar mellan CT:er)"
+    ],
+    "lxcMountTitle": "Monteringshanterare för LXC",
+    "lxcMountBody": "Det primära LXC-delningsverktyget. Bind-mounts värdkataloger till behållare via <code>pct set -mpN</code> och hanterar tillståndskrav av oprivilegierade CT utan att skapa någon grupp eller användare i containern.",
+    "lxcMountItems": [
+      "Fungerar med privilegierade och oprivilegierade CT",
+      "Erbjuder <code>o+rwx</code> på värdkatalogen för oprivilegierade UID:n",
+      "Fixar befintliga CIFS / NFS-fästen om det behövs"
+    ],
+    "lxcNetTitle": "LXC nätverksdelning",
+    "lxcNetBody": "Fyra ytterligare flöden för containrar som behöver använda eller exponera NFS-/Samba-delningar direkt. Alla kräver en <strong>privilegierad</strong> container.",
+    "lxcNetItems": [
+      "NFS-/Samba-<strong>klient</strong> (använder externa delningar)",
+      "NFS-/Samba-<strong>server</strong> (exponerar CT-mappar)"
+    ]
+  },
+  "host": {
+    "heading": "Integration av värdlagring",
+    "intro": "Registrera lagring i Proxmox. Varje alternativ kallar <code>pvesm add …</code> under huven, så lagringen visas i <strong>Datacenter → Storage</strong> och blir tillgänglig för VM / CT skapare.",
+    "options": [
+      {
+        "href": "/docs/storage-share/host-nfs",
+        "icon": "Network",
+        "title": "Lägg till NFS-delning som Proxmox-lagring",
+        "description": "Registrera en extern NFS-export som Proxmox-lagring med pvesm add nfs. Proxmox hanterar monteringen utan extra poster i fstab."
+      },
+      {
+        "href": "/docs/storage-share/host-samba",
+        "icon": "Share2",
+        "title": "Lägg till Samba-delning som Proxmox-lagring",
+        "description": "Registrera en extern Samba- eller CIFS-resurs som Proxmox-lagring med pvesm add cifs. Proxmox hanterar monteringen och inloggningsuppgifterna."
+      },
+      {
+        "href": "/docs/storage-share/host-iscsi",
+        "icon": "Database",
+        "title": "Lägg till iSCSI-mål som Proxmox-lagring",
+        "description": "Anslut till ett externt iSCSI-mål och registrera det som Proxmox-lagring (block-enhet) för VM-diskbilder."
+      },
+      {
+        "href": "/docs/storage-share/host-local-disk",
+        "icon": "HardDrive",
+        "title": "Lägg till lokal disk som Proxmox lagring",
+        "description": "Formatera en lokal SATA / SAS / NVMe disk och registrera den som en Proxmox katalog eller ZFS pool lagring."
+      },
+      {
+        "href": "/docs/storage-share/host-local-shared",
+        "icon": "FolderOpen",
+        "title": "Lägg till delad katalog på värd",
+        "description": "Skapa en värdkatalog som ska bind-monteras i flera CT:er. Den registreras inte som Proxmox-lagring utan är en resurs på värdsidan för LXC-bind-monteringar."
+      }
+    ]
+  },
+  "lxcMount": {
+    "heading": "Monteringshanterare för LXC",
+    "intro": "Det primära verktyget för att dela mappar mellan Proxmox värd och LXC behållare. Den använder <code>pct set -mpN</code> för att binda samman en värdkatalog i containern, och hanterar tillståndskrav av oprivilegierade CT på värdsidan (inga grupper eller användare skapas inuti containern).",
+    "card": {
+      "title": "LXC-monteringspunkter (värd ↔ CT)",
+      "description": "Bind-mount någon värdkatalog till en LXC container via pct set -mpN. Fungerar med både privilegierade och oprivilegierade CTs; erbjuder chmod o+rwx / ACLs på värddir och fixar befintliga CIFS / NFS-fästen vid behov."
+    }
+  },
+  "lxcNet": {
+    "heading": "LXC nätverksdelning",
+    "intro": "Använd dessa flöden när en container behöver <em>vara</em> en NFS-/Samba-ändpunkt: använda en extern delning (klient) eller exponera egna mappar (server). För de flesta fildelningsbehov (bind-monteringar värd ↔ CT) är <mountLink>LXC Mount Manager</mountLink> enklare och kräver inga privilegierade containrar.",
+    "options": [
+      {
+        "href": "/docs/storage-share/lxc-nfs-client",
+        "icon": "Download",
+        "title": "NFS klient i LXC",
+        "description": "Montera externa NFS-delningar från en privilegierad LXC-container. Stöder automatisk upptäckt, beständiga poster i /etc/fstab och ren avmontering."
+      },
+      {
+        "href": "/docs/storage-share/lxc-samba-client",
+        "icon": "Download",
+        "title": "Samba klient i LXC",
+        "description": "Montera Samba-/CIFS-delningar från en privilegierad LXC-container. Inloggningsuppgifter lagras skyddat och automatisk upptäckt finns."
+      },
+      {
+        "href": "/docs/storage-share/lxc-nfs-server",
+        "icon": "Upload",
+        "title": "NFS server i LXC",
+        "description": "Exportera mappar över NFS från en privilegierad LXC-behållare."
+      },
+      {
+        "href": "/docs/storage-share/lxc-samba-server",
+        "icon": "Upload",
+        "title": "Samba server i LXC",
+        "description": "Exponera mappar över SMB / CIFS inifrån en privilegierad LXC container."
+      }
+    ]
+  },
+  "privReq": {
+    "title": "Privilegierat containerkrav",
+    "body": "De fyra flödena för <strong>LXC-nätverksdelning</strong> ovan kräver en <strong>privilegierad</strong> container. Skripten kräver detta stödda läge innan de konfigurerar tjänster och monteringsverktyg (<code>nfs-kernel-server</code>, <code>smbd</code>, <code>mount.nfs</code>, <code>mount.cifs</code>). För att bara dela filer mellan värden och en oprivilegierad CT använder du <mountLink>LXC Mount Manager</mountLink>: det bind-monterar och justerar behörigheterna på värden så att containern kan läsa och skriva utan att dessa tjänster eller verktyg konfigureras i den."
+  },
+  "unprivExplain": {
+    "title": "Hur ProxMenux hanterar oprivilegierade CT behörigheter",
+    "body": "Oprivilegierade LXC-containrar förskjuter sina UID:n med <strong>+100000</strong> på värden (containerns UID 0 = värdens UID 100000, containerns UID 1000 = värdens UID 101000, …). En fil som skapats av en containeranvändare visas därför på värden som <em>övriga</em>, utan motsvarande vanlig värdanvändare eller grupp. LXC Mount Manager löser detta praktiskt: i stället för att anpassa UID/GID mellan värd och CT erbjuder det <code>chmod o+rwx</code> och motsvarande ACL:er på värdkatalogen, så att alla mappade UID:n kan läsa och skriva. För CIFS monterar det om med <code>uid=0,gid=0,file_mode=0777,dir_mode=0777</code>; för NFS skapar det en katalog som alla får skriva till med sticky bit och vägleder till rätt ändring på servern om root squash används."
+  },
+  "scripts": {
+    "heading": "Skript involverade",
+    "intro": "Varje enskild sida länkar till skriptet som driver dess flöde. Filen nedan är en delad hjälpare som inte dokumenteras som sin egen sida men används av flera av LXC nätverksdelningsflöden:",
+    "itemTail": " - CT validering, val av monteringspunkt, privilegierad kontroll och universella gruppuppställningshjälpare som delats över LXC-klienten / serverflödena."
+  }
+}
diff --git a/web/messages/sv/docs/storage-share/lxc-mount-points.json b/web/messages/sv/docs/storage-share/lxc-mount-points.json
new file mode 100644
index 00000000..bc3e3659
--- /dev/null
+++ b/web/messages/sv/docs/storage-share/lxc-mount-points.json
@@ -0,0 +1,174 @@
+{
+  "meta": {
+    "title": "LXC-monteringspunkter (värd ↔ container) | ProxMenux-dokumentation",
+    "description": "LXC Mount Manager - bindmontera alla värdkataloger till en eller flera LXC-containrar via pct set -mpN. Hanterar tillståndskrav av oprivilegierade behållare, fixar befintliga CIFS / NFS-fästen på värdsidan, och ändrar aldrig något inuti containern.",
+    "ogTitle": "LXC-monteringspunkter (värd ↔ container) | ProxMenux-dokumentation",
+    "ogDescription": "Bind-mount värdkataloger till LXC containrar. Hanterar oprivilegierad UID-kartläggning pragmatiskt, fixar CIFS / NFS-åtkomst på värdsidan."
+  },
+  "header": {
+    "title": "LXC-monteringspunkter (värd ↔ container)",
+    "description": "Det huvudsakliga verktyget för att dela mappar mellan Proxmox-värden och LXC-containrar. Bind-monterar valfri värdkatalog i en eller flera containrar med Proxmox inbyggda syntax pct set -mpN. Behörighetsproblemen i oprivilegierade containrar hanteras på värden, utan ändringar inne i containern.",
+    "section": "Lagring och delning · LXC"
+  },
+  "intro": {
+    "title": "Vad detta gör",
+    "body": "Ta en katalog som bor på Proxmox-värden (en lokal mapp, en monterad NAS-delning, en Proxmox-managed lagring ...) och gör att den visas inuti en LXC-behållare på en väg du väljer, med behörigheter som fungerar även för oprivilegierade behållare - utan att röra något inuti containern."
+  },
+  "bigPicture": {
+    "heading": "Hur det fungerar (den stora bilden)",
+    "intro": "En bind-montering instruerar kärnan att visa värdkatalogen <code>X</code> även på sökvägen <code>Y</code> i containern. Ingen kopiering, synkronisering eller nätverksöverföring: båda ser <em>samma filer</em> samtidigt.",
+    "sourceLabel": "Proxmox-värd",
+    "sourceDetail": "/mnt/data\n(din mapp)",
+    "targetLabel": "LXC-container",
+    "targetDetail": "/mnt/data\n(visas här)",
+    "arrowLabel": "bind-montering",
+    "outro": "Värdvägen till vänster och containervägen till höger kan vara annorlunda - till exempel kan <code>/mnt/nas-films</code> på värden bli <code>/media/films</code> inuti containern. Skriptet lägger till posten till containern konfig (<code>/etc/pve/lxc/&lt;ctid&gt;.conf</code>) med nästa lediga <code>mpN</code> index, med två säkra standarder inbyggda:",
+    "items": [
+      "<code>shared=1</code> — anger för Proxmox att data är delade och inte ska migreras med CT:n. Flaggan replikerar inte data: samma sökväg och data måste redan finnas på målnoden.",
+      "<code>backup=0</code> - utesluter bindfästet från <code>vzdump</code> säkerhetskopior (data lever på värden, du backar upp det separat)."
+    ]
+  },
+  "perms": {
+    "heading": "Tillståndshantering – smart",
+    "intro": "Bind-monteringar är lätta i princip. Den hårda delen är behörigheter: en <strong>oprivilegierad</strong> LXC behållare skiftar varje UID av <strong> + 100000</strong>, så en fil som skapats inuti containern av användaren 1000 visas på värden som UID 101000 - en UID ingen på värden äger. För att göra detta arbete utan att anpassa UIDs över värdar och behållare, ProxMenux tillämpar rätt \"öppna upp behörigheter\" trick på <em>värden</em> sida, beroende på vilken typ av katalog du valde:",
+    "headerType": "Värd katalog typ",
+    "headerAction": "Vad skriptet erbjuder att göra",
+    "localType": "Lokal mapp",
+    "localTypeSub": "t.ex. /mnt/data",
+    "localActionRich": "<code>chmod o+rwx</code> + <code>setfacl o::rwx</code> på värdkatalogen. Endast erbjuds om CT är oprivilegierad och nuvarande behörigheter är otillräckliga.",
+    "cifsType": "Monterad CIFS / SMB",
+    "cifsTypeSub": "t.ex. /mnt/pve/cifs-…",
+    "cifsActionRich": "Montera om med <code>uid=0, gid=0, file_mode=0777, dir_mode=0777</code> så att CT (varje UID) kan läsa och skriva delningen. <code>/etc/fstab</code> uppdateras.",
+    "nfsType": "Monterad NFS",
+    "nfsTypeSub": "t.ex. /mnt/pve/nfs-…",
+    "nfsActionRich": "<code>chmod 1777</code> + <code>setfacl o::rwx</code> på NFS montering. Kan inte åsidosätta server-side squashing - om ens värdrot inte kan skriva, är du vägledd att fixa exporten på NFS-servern.",
+    "privTitle": "Privilegierade containrar behöver inte något av detta",
+    "privBody": "För privilegierade containrar, UID 0 i CT är UID 0 på värden - rot inuti CT kan läsa och skriva värdkatalogen direkt utan tillstånd tricks. Skriptet upptäcker detta och hoppar över \"öppna upp behörigheter\" steg helt.",
+    "noCtTitle": "Skriptet ändrar aldrig något inuti containern",
+    "noCtBody": "Alla tillstånd tweaks händer på <strong>host filsystem</strong>. Inga <code>pct exec</code> chowner, inga grupper skapade i CT, ingen fstab inuti containern. Om du återanvänder den bindmonterade katalogen i en annan CT senare gäller samma behörigheter automatiskt - ingen kontaineruppsättning."
+  },
+  "writes": {
+    "heading": "Vad ProxMenux skriver - och vad det inte gör",
+    "intro": "En vanlig förvirring när bindning till en oprivilegierad CT: människor antar ProxMenux måste skriva <code>lxc.idmap</code> poster i <code>/etc/pve/lxc/&lt;CTID&gt;.conf</code>. <strong>Det gör inte.</strong> Endast en rad är appenderad till den filen - bindfästet själv:",
+    "outro": "Utgångslinjen du ser i slutet av körningen, <em> \"Unprivileged container - UID-kompensation: 100000\"</em>, är helt informativ - det berättar bara att CT använder Proxmox standard oprivileged kartläggning (rot i CT = UID 100000 på värd). Skriptet konfigurerar inte något runt det.",
+    "twoWaysHeading": "De två sätten att få behörigheter att fungera - och varför ProxMenux väljer en",
+    "headerApproach": "Metod",
+    "headerChanges": "Vad det förändras",
+    "headerWhen": "När den passar",
+    "hostType": "Behörigheter på värden",
+    "hostTypeSub": "(vad detta manus gör)",
+    "hostChangesRich": "<code>chmod o+rwx</code> + <code>setfacl o::rwx</code> på värdkatalogen. CT: s kartlagda UIDs (100000 +) faller i \"andra\" hinken, så öppna <em>övriga</em> är tillräckligt.",
+    "hostWhen": "Generisk delad mapp tillgång från alla CT. Flera CT: er som delar samma värdkatalog. Enkel och återanvändbar.",
+    "idmapTypeRich": "<code>lxc.idmap</code>",
+    "idmapTypeSub": "(Inte används av detta manus)",
+    "idmapChangesRich": "Anpassad UID / GID-kartläggning i <code>/etc/pve/lxc/&lt;CTID&gt;.conf</code> plus matchning <code>/etc/subuid</code> + <code>/etc/subgid</code>-poster på värden. CT måste startas om varje förändring.",
+    "idmapWhenRich": "Du behöver en <em>visst</em> UID inuti CT för att kartlägga en <em>visst</em> UID på värden (t.ex. <code>media:1000</code> i CT måste äga filer som <code>media:1000</code> på värden så NFS inte squash. En mer styv installation, normalt bara värt det för det exakta scenariot.",
+    "idmapTipTitle": "När du faktiskt behöver lxc.idmap",
+    "idmapTipBody": "Använd manuell ID-mappning när filer skrivna i CT:n måste ha ett visst numeriskt UID/GID på värden, exempelvis för att dela ägare med en värdanvändare. Det åsidosätter inte NFS <code>all_squash</code>; servern bestämmer fortfarande anonym identitet och behörigheter. Lägg vid behov till <code>lxc.idmap</code>-poster manuellt. Bind-monteringsraden är oberoende av dessa poster."
+  },
+  "opening": {
+    "heading": "Öppna verktyget",
+    "body": "Öppna <strong>Storage &amp; Share Manager → Configure LXC Mount Points (Host ↔ Container)</strong> i ProxMenux huvudmeny. Undermenyn har tre alternativ:",
+    "imageAlt": "LXC Mount Manager-menyn - Lägg till / Visa / Ta bort"
+  },
+  "addFlow": {
+    "heading": "Lägg till en montering - fullt flöde",
+    "intro": "Den tekniska uppfattningen, för när du vill veta exakt vad varje dialog gör:"
+  },
+  "sources": {
+    "heading": "Vad du kan välja som värdkatalog",
+    "intro": "Värd-katalog plockare är den mest grundliga i lagring &amp; Share avsnitt. Den skannar fyra källor och presenterar en deduplicerad lista:",
+    "headerSource": "Källa",
+    "headerWhere": "Där det kommer från",
+    "headerLabel": "Etikett i menyn",
+    "rows": [
+      {
+        "source": "Aktiva nätverksfästen",
+        "whereRich": "Aktuellt monterade CIFS-/NFS-delningar, lästa från <code>/proc/mounts</code>.",
+        "labelRich": "<code>NFS [used/size]</code> eller <code>CIFS/SMB [used/size]</code>"
+      },
+      {
+        "source": "Inaktiva fstab-monteringar",
+        "whereRich": "Definierad i <code>/etc/fstab</code> men inte för närvarande monterad.",
+        "labelRich": "<code>fstab(off)-NFS</code> / <code>fstab(off)-CIFS/SMB</code>"
+      },
+      {
+        "source": "Lokala kataloger",
+        "whereRich": "Sub-kataloger under <code>/mnt</code> som inte är nätverksfästen.",
+        "labelRich": "<code>Local [size]</code>"
+      },
+      {
+        "source": "Proxmox-lagringar",
+        "whereRich": "Lagringsvägar under <code>/mnt/pve/*</code> (NFS / CIFS registrerad via <code>pvesm</code>).",
+        "labelRich": "<code>PVE-NFS</code> / <code>PVE-CIFS/SMB</code> / <code>Proxmox-Storage</code>"
+      },
+      {
+        "source": "Manuell inmatning",
+        "where": "Allt annat - skriv den absoluta vägen själv.",
+        "labelRich": "<em>Ange sökväg manuellt</em>"
+      }
+    ],
+    "tipTitle": "Interna Proxmox-vägar filtreras ut",
+    "tipBody": "Väljaren hoppar uttryckligen inre Proxmox-vägar (<code>/mnt/pve/local</code>, <code>/mnt/pve/local-lvm</code>, <code>/mnt/pve/backup</code>, ...) - de är reserverade för Proxmox interna och du bör inte binda dem. Endast användarrelaterade lagringar dyker upp."
+  },
+  "manual": {
+    "heading": "Manuell motsvarande",
+    "privIntro": "För en privilegierad container - det enklaste fallet, inga tillståndstrick:",
+    "unprivLocalIntro": "För en oprivilegierad container med en lokal värdkatalog - öppna upp behörigheter på värden först:",
+    "unprivCifsIntro": "För en oprivilegierad container med en CIFS-delning som redan är monterad på värden:"
+  },
+  "view": {
+    "heading": "Visa monteringspunkter",
+    "body": "Listar varje <code>mpN</code>-ingång över varje container på denna Proxmox-värd, grupperad av CT-id och visar värdväg → containerväg plus eventuella extra alternativ. Läs bara - användbar som en sanity check innan du lägger till eller tar bort något."
+  },
+  "remove": {
+    "heading": "Ta bort en monteringspunkt",
+    "body": "Välj containern, välj <code>mpN</code>-inmatningen, bekräfta. Manuset kör <code>pct set --delete mpN</code> för att släppa inträdet från CT konfig och erbjuder att starta om containern om den körs. Värdkatalogen och dess innehåll är <strong>orörda</strong> - du kan återföra fästet senare (eller bifoga samma katalog till en annan CT).",
+    "warnTitle": "Containrar som körs måste startas om för att ändringarna ska gälla",
+    "warnBody": "Både att lägga till och ta bort monteringspunkter blir bara synliga inuti containern efter en omstart. Manuset erbjuder ett enklick <code>pct reboot</code> vid slutet av varje operation; du kan avböja och starta om manuellt senare."
+  },
+  "troubleshoot": {
+    "heading": "Felsökning",
+    "noMountTitle": "Mount visas i pct config men inte i containern",
+    "noMountBody": "Bind monterar bara när containern börjar. Om du lade till fästet medan CT kördes, starta om det (<code>pct reboot &lt;ctid&gt;</code>). Om det redan har startats om och fortfarande saknas, kontrollera <code>pct config &lt;ctid&gt;</code> för att bekräfta att posten finns och värdvägen faktiskt innehåller en katalog.",
+    "noWriteTitle": "Container kan se katalogen men kan inte skriva",
+    "noWriteBody": "Nästan alltid ett behörighetsproblem. För oprivilegierade containrar, kör skriptets tillstånd fix igen - värdkatalogens ACLs kan ha återställts av ett annat verktyg (rsync, återställa från backup, manuell <code>chmod</code>). För CIFS, dubbelkolla monteringsalternativen på värden: <code>findmnt /mnt/pve/cifs-…</code>, leta efter <code>uid=</code> / <code>gid=</code> / <code>file_mode=</code> värden.",
+    "alreadyTitle": "\"Denna väg används redan som en fästpunkt i denna container\"",
+    "alreadyBody": "Du valde samma containersökväg som redan är kopplad till en annan värdkatalog. Välj antingen en annan containerbana eller ta bort den befintliga monteringspunkten först.",
+    "nfsTitle": "NFS-åtkomst blockerad även efter applicering av värdfixen",
+    "nfsIntro": "Din NFS-server squashing root eller alla anslutningar. Skriptet kan upptäcka detta (det försöker skriva en testfil från värden) och visar server-side-vägledning. Två vanliga serversidor för exporten:",
+    "nfsItems": [
+      "<code>no_root_squash</code> privilegierade CT kan skriva direkt.",
+      "<code>all_squash,anonuid=65534,anongid=65534</code> för oprivilegierade CT."
+    ],
+    "nfsOutro": "Dessa förändringar sker på NFS-servern (TrueNAS, Synology, din anpassade export, ...), inte på Proxmox.",
+    "fstabOffTitle": "Att montera \"fstab(off)\" -poster gör ingenting",
+    "fstabOffBody": "Väljaren visar <code>fstab(off)-</code>-poster när en nätverksfäste definieras i fstab men inte för närvarande monterad. Skriptet låter dig binda vägen, men katalogen kommer att vara tom tills du faktiskt monterar delningen (<code>mount &lt;path&gt;</code> på värden). Montera den först och bind sedan den till CT."
+  },
+  "related": {
+    "heading": "Relaterad",
+    "items": [
+      {
+        "href": "/docs/storage-share/host-local-shared",
+        "label": "Lägg till delad katalog på värd",
+        "tailRich": " - typiskt första steg: förbereda en <code>/mnt/shared</code> på värden innan du monterar den i en eller flera CT här."
+      },
+      {
+        "href": "/docs/storage-share/host-nfs",
+        "label": "Lägg till NFS-delning som Proxmox-lagring",
+        "extraHref": "/docs/storage-share/host-samba",
+        "extraLabel": "Lägg till Samba-delning som Proxmox-lagring",
+        "joiner": " / ",
+        "tailRich": " - registrera en extern delning i Proxmox först, sedan bind-mount sin <code>/mnt/pve/&lt;id&gt;</code> väg in i CT här."
+      },
+      {
+        "href": "/docs/storage-share/lxc-nfs-client",
+        "label": "NFS klient i LXC",
+        "extraHref": "/docs/storage-share/lxc-samba-client",
+        "extraLabel": "Samba klient i LXC",
+        "joiner": " / ",
+        "tail": " — alternativet när du vill att CT själv ska montera delningen (kräver en privilegierad container)."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sv/docs/storage-share/lxc-nfs-client.json b/web/messages/sv/docs/storage-share/lxc-nfs-client.json
new file mode 100644
index 00000000..0f108d60
--- /dev/null
+++ b/web/messages/sv/docs/storage-share/lxc-nfs-client.json
@@ -0,0 +1,128 @@
+{
+  "meta": {
+    "title": "NFS klient i LXC | ProxMenux Dokumentation",
+    "description": "Montera NFS-delningar direkt i en Proxmox LXC-container med ProxMenux. Installerar nfs-common automatiskt, stöder upptäckt på LAN, beständiga monteringar via /etc/fstab och säkra startinställningar. Kräver en privilegierad container.",
+    "ogTitle": "NFS klient i LXC | ProxMenux Dokumentation",
+    "ogDescription": "Montera NFS-delningar i en privilegierad LXC-container. Automatisk upptäckt, beständiga poster i /etc/fstab och säkra startinställningar."
+  },
+  "header": {
+    "title": "NFS klient i LXC",
+    "description": "Montera NFS-delningar direkt i en Proxmox LXC-container. Containern blir en egen NFS-klient: den kommunicerar med NFS-servern över nätverket, kör mount.nfs och skriver till /etc/fstab. ProxMenux installerar nfs-common, hjälper till att hitta servrar och exporter och tillämpar säkra startinställningar.",
+    "section": "Lagring och delning · LXC"
+  },
+  "privReq": {
+    "title": "Privilegierad container krävs",
+    "body": "NFS-klienten som använder <code>mount.nfs</code> behöver förmågor (minst <code>SYS_ADMIN</code>) som oprivilegierade LXC:er inte tillhandahåller. Skriptet ber dig välja CT och <strong>avbryter om den är oprivilegierad</strong>. Behövs delningen i en sådan CT monterar du den först på Proxmox-värden med <hostNfsLink>NFS-delning som Proxmox-lagring</hostNfsLink> och bind-monterar den i CT:n med <mountLink>LXC Mount Manager</mountLink>."
+  },
+  "what": {
+    "heading": "Vad detta gör",
+    "body": "Till skillnad från LXC Mount Manager - vilket gör CT se något <em>via</em> Proxmox-värden - detta skript ger containern sin <strong>egen NFS-klient</strong>: det talar NFS över nätverket, monterar delningar direkt från NFS-servern och lagrar montet i containerns <code>/etc/fstab</code>. Proxmox-värden ligger inte i datavägen.",
+    "diagramServerLabel": "NFS-server",
+    "diagramServerDetail": "/export/data",
+    "diagramHostLabel": "Proxmox-värd",
+    "diagramHostDetail": "(bara en\nNätverksbro)",
+    "diagramCtLabel": "LXC (privilegierad)",
+    "diagramCtDetail": "/mnt/data\nmount.nfs inuti CT",
+    "diagramArrow": "NFS",
+    "twoWaysTitle": "Två sätt att ge en CT NFS åtkomst - välj en",
+    "twoWaysBind": "<strong>Bind montering via host</strong> (<mountLink>LXC Mount Manager</mountLink>): värd monterar NFS en gång, varje CT bind-monterar samma väg. Fungerar med oprivilegierade CT. Rekommenderas när flera CT behöver samma delning.",
+    "twoWaysDirect": "<strong>Direct NFS monteras inuti CT</strong> (denna sida): CT monterar själva NFS. Kräver privilegierad. Användbart när CT måste äga sin anslutning / referenser, eller för inställningar där varje CT talar till en annan server."
+  },
+  "opening": {
+    "heading": "Öppna verktyget",
+    "body": "Öppna <strong>Storage &amp; Share Manager → Konfigurera NFS-klient i LXC (endast privilegierad)</strong> i huvudmenyn. ProxMenux ber dig <strong>välja mål-CT</strong>, startar den om den är stoppad och avbryter om den är oprivilegierad. Sedan visas denna undermeny:",
+    "imageAlt": "NFS Client Manager-menyn - Mount / View / Unmount / Testanslutning"
+  },
+  "howRuns": {
+    "heading": "Hur man kör skriptet (Mount flow)"
+  },
+  "fstabFlags": {
+    "heading": "Varför dessa fstab flaggor",
+    "intro": "För permanenta monteringar lägger manuset tre flaggor bortom standarden NFS-alternativ: <code>_netdev,x-systemd.automount,noauto</code>. Var och en löser ett riktigt starttidsproblem:",
+    "headerFlag": "Flaggan",
+    "headerEffect": "Vad det gör",
+    "rows": [
+      {
+        "flag": "_netdev",
+        "effect": "Berättar initsystemet denna montering behöver nätverket. Boot blockerar inte vänta på det innan nätverket är uppe."
+      },
+      {
+        "flag": "x-systemd.automount",
+        "effectRich": "Skapar en systemd auto-mount enhet: monteringen sker bara första gången något når <code>/mnt/&lt;path&gt;</code>. NFS-servern som inte kan nås på starten stallar inte CT."
+      },
+      {
+        "flag": "noauto",
+        "effect": "Hoppar över omedelbar montering vid start. Tillsammans med automount-enheten ovan monteras filsystemet först vid åtkomst."
+      }
+    ],
+    "netEffectTitle": "Nettoeffekt",
+    "netEffectBody": "NFS-filsystemet monteras vid <em>första åtkomsten</em> i stället för direkt under starten. Om servern är offline kan åtkomsten vänta eller misslyckas och påverka tjänster som behöver sökvägen. Automount minskar startberoendet men garanterar inte att alla CT-tjänster förblir opåverkade av en otillgänglig NFS-server."
+  },
+  "manual": {
+    "heading": "Manuell motsvarande",
+    "body": "Replicera hela flödet för hand - varje kommando kör <strong>inuti CT</strong> via <code>pct exec &lt;ctid&gt; --</code> eller direkt via <code>pct enter &lt;ctid&gt;</code>:"
+  },
+  "view": {
+    "heading": "Visa aktuella fästen",
+    "body": "Listar varje NFS monteringspunkt aktiv inuti CT (<code>mount | grep nfs</code>) plus varje NFS linje i CT <code>/etc/fstab</code>. För varje fstab-post visas den levande monteringsstatusen - användbar för att upptäcka permanenta fästen som inte kom upp på start."
+  },
+  "unmount": {
+    "heading": "Avmontera NFS-delning",
+    "body": "Kombinerar live-monteringarna och fstab-posterna till en lista, låter dig välja en och <strong>tar bort motsvarande rad från <code>/etc/fstab</code></strong>. Skriptet kör <em>inte</em> <code>umount</code> på live-monteringen – istället talar om för dig att en CT omstart krävs för att avmonteringen ska träda i kraft.",
+    "warnTitle": "Skriptet tar bort fstab-poster, inte levande fästen",
+    "warnBody": "Detta är ett avsiktligt designval: <code>umount</code> på en upptagen montering misslyckas med \"enhet upptagen\" när något inuti CT fortfarande använder det. Ta bort fstab-posten garanterar att fästet försvinner rent på nästa CT-start. Om du vill monteringen borttagen <em>nu</em> och du är säker på att ingenting använder det, kör <code>pct exec &lt;ctid&gt; -- umount /mnt/&lt;path&gt;</code> för hand efter skriptet avslutas."
+  },
+  "test": {
+    "heading": "Test NFS-anslutning",
+    "body": "Diagnostic pass inuti CT: bekräftar <code>nfs-common</code> installeras, <code>rpcbind</code> körs, listar aktuella NFS-fästen, sedan itererar över varje NFS-server som refereras i fstab och kontrollerar ping → port 2049 → <code>showmount -e</code>. Bra första stopp när ett permanent fäste inte kommer upp."
+  },
+  "troubleshoot": {
+    "heading": "Felsökning",
+    "privTitle": "Privilegierad container krävs (skriptet avbryter)",
+    "privBody": "Den valda CT är oprivilegierad. Kernel NFS-klienten behöver <code>SYS_ADMIN</code>-kapacitet som oprivilegierade CT inte exponerar. Antingen konvertera CT till privilegierad (Disk Manager &amp; konvertering dokumenteras i <importLink>Import Disk till LXC</importLink> sida) eller använd den alternativa vägen som beskrivs i varningen högst upp på denna sida.",
+    "aptTitle": "apt-get install nfs-common fails",
+    "aptIntro": "Manuset antar en Debian-familj CT (<code>apt-get</code>). Om CT kör Alpine / Arch / Rocky / Alma misslyckas installationssteget tyst. Installera NFS-klienten för den distroen:",
+    "aptItems": [
+      "Alpine: <code>apk add nfs-utils</code>",
+      "Arch: <code>pacman -S nfs-utils</code>",
+      "Rocky / Alma: <code>dnf install nfs-utils</code>"
+    ],
+    "aptOutro": "Sedan kör ProxMenux-skriptet - installationssteget hoppar när verktygen redan finns.",
+    "portTitle": "\"NFS port (2049) is not accessible\"",
+    "portBody": "Ping lyckades men <code>nc -z &lt;server&gt; 2049</code> misslyckades inifrån CT. Kontrollera att NFS-tjänsten körs på servern, att brandväggen tillåter 2049 från CT-nätverket, och att CT faktiskt har en giltig nätverksväg (prova <code>pct exec &lt;ctid&gt; -- ip route</code>).",
+    "bootTitle": "Permanent montering lyckas men kommer inte upp på start",
+    "bootBody": "Nästan alltid en av: nätverket är inte redo när CT-fästen (skriptets <code>_netdev,x-systemd.automount,noauto</code>-flaggor fixar detta - återställer monteringen via skriptet om du skrev fstablinjen för hand utan dem), servern är oåtkomlig vid start (auto-mount väntar på första åtkomst - det är normalt), eller DNS är olöst på start (använd serverns IP, inte dess värdnamn).",
+    "squashTitle": "Server squashes root, ingen skriva tillgång inifrån CT",
+    "squashIntro": "NFS export använder <code>root_squash</code> (standard) och CT skriver som root. Två alternativ:",
+    "squashItems": [
+      "Server-side: ändra exporten till <code>no_root_squash</code> (endast om du litar på CT).",
+      "CT-sida: skriv som en icke-rotanvändare som servern accepterar, eller chown andelen på lämpligt sätt."
+    ],
+    "squashOutro": "ProxMenux kan inte fixa detta - det är serverpolicy."
+  },
+  "related": {
+    "heading": "Relaterad",
+    "items": [
+      {
+        "href": "/docs/storage-share/lxc-mount-points",
+        "label": "LXC-monteringspunkter (värd ↔ container)",
+        "tail": " — alternativet för oprivilegierade CT: montering på värd, binda till CT."
+      },
+      {
+        "href": "/docs/storage-share/lxc-samba-client",
+        "label": "Samba klient i LXC",
+        "tail": " — relaterad sida med samma mönster för SMB-/CIFS-delningar."
+      },
+      {
+        "href": "/docs/storage-share/lxc-nfs-server",
+        "label": "NFS server i LXC",
+        "tailRich": " — omvänt: exponera mappar <em>från</em> en CT över NFS."
+      },
+      {
+        "href": "/docs/storage-share/host-nfs",
+        "label": "NFS-delning som Proxmox-lagring",
+        "tail": " — registrera delningen i Proxmox i stället för i en enskild CT."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sv/docs/storage-share/lxc-nfs-server.json b/web/messages/sv/docs/storage-share/lxc-nfs-server.json
new file mode 100644
index 00000000..7128ef5b
--- /dev/null
+++ b/web/messages/sv/docs/storage-share/lxc-nfs-server.json
@@ -0,0 +1,159 @@
+{
+  "meta": {
+    "title": "NFS server i LXC | ProxMenux Dokumentation",
+    "description": "Dela mappar via NFS från en Proxmox LXC-container med ProxMenux. Installerar nfs-kernel-server automatiskt och konfigurerar den gemensamma gruppen sharedfiles, /etc/exports, nätverks-ACL:er och fullständig avinstallation. Kräver en privilegierad container.",
+    "ogTitle": "NFS server i LXC | ProxMenux Dokumentation",
+    "ogDescription": "Kör en NFS-server i en privilegierad LXC med den gemensamma gruppen sharedfiles, nätverks-ACL:er och fullständig avinstallation."
+  },
+  "header": {
+    "title": "NFS server i LXC",
+    "description": "Kör en NFS-kärnserver i en Proxmox LXC-container och dela mappar med andra datorer i nätverket. ProxMenux installerar nfs-kernel-server, konfigurerar den gemensamma gruppen sharedfiles så att flera privilegierade CT:er kan dela filer med samma grupp-ID, hanterar /etc/exports och erbjuder fullständig avinstallation.",
+    "section": "Lagring & Dela · LXC"
+  },
+  "privReq": {
+    "title": "Privilegierad container krävs",
+    "body": "<code>nfs-kernel-server</code> måste montera kärnans filsystem <code>nfsd</code> på <code>/proc/fs/nfsd</code>. Det kräver <code>CAP_SYS_ADMIN</code> i värdkärnans namnrymd, inte bara i containerns användarnamnrymd. Oprivilegierade LXC-containrar saknar denna förmåga: <code>rpc.nfsd: Unable to access /proc/fs/nfsd errno 2 (No such file or directory)</code>; systemd markerar <code>nfs-server.service</code> som misslyckad på grund av ett beroende. Skriptet kräver därför en privilegierad CT och <strong>avbryter för oprivilegierade CT:er</strong>. Ett alternativ är att köra NFS-servern i en VM."
+  },
+  "what": {
+    "heading": "Vad detta gör",
+    "body": "Detta är motsatsen till sidan om <em>NFS-klienten</em>: CT:n blir en <strong>NFS-server</strong> och delar en egen mapp med andra CT:er, Proxmox-värden, VM:ar eller fysiska datorer.",
+    "diagramServerLabel": "LXC (privilegierad) - NFS server",
+    "diagramServerDetail": "/mnt/data\n(mappen du delar)\n\nchown root:sharedfiles\nchmod 2775 (SGID)\n\nnfs-kernel-server\n+ rpcbind körs",
+    "diagramClientLabel": "Valfri klient",
+    "diagramClientDetail": "En annan CT, värden,\nVM, en fysisk maskin.",
+    "diagramArrow": "NFS-export"
+  },
+  "shared": {
+    "heading": "Den gemensamma gruppen ”sharedfiles”",
+    "body": "Innan du exporterar mappen skapar ProxMenux en grupp som heter <code>sharedfiles</code> med <strong>GID 101000</strong> inuti containern, lägger till varje vanlig användare till den och ställer sedan in exportkatalogen till <code>root:sharedfiles</code> med läge <code>2775</code>. <code>2</code> på framsidan är SGID-biten - varje fil eller mapp som skapas inuti ärver automatiskt <code>sharedfiles</code>-gruppen.",
+    "gidTitle": "Varför GID 101000",
+    "gidBody": "Med LXC:s standardmappning (+100000) visas värdens GID 101000 som GID <strong>1000</strong> i en oprivilegierad CT. Detta serverflöde använder en <strong>privilegierad</strong> CT utan förskjutning. Två privilegierade CT:er med <code>sharedfiles</code> på GID 101000 har därför samma numeriska grupp-ID.",
+    "remapTitle": "Äldre skapande av ”remap_*”-användare hoppas över för privilegierade CT:er",
+    "remapBody": "Den äldre grenen för oprivilegierade CT:er skulle skapa <code>remap_&lt;uid&gt;</code>-användare med UID <code>&lt;uid&gt; + 100000</code>, alla i <code>sharedfiles</code>, för vanliga användare och vanliga UID:n (33, 1000, 1001, 1002). Denna <code>+100000</code>-förskjutning gäller inte de <strong>privilegierade</strong> CT:er som krävs här, så skriptet hoppar över grenen. Det är väntat att <code>remap_*</code>-konton saknas i <code>getent passwd</code> och betyder inte att något är fel."
+  },
+  "defaults": {
+    "heading": "Standardexportalternativ - läs detta första",
+    "warnTitle": "Standardalternativ inkluderar no_root_squash",
+    "warnBody": "ProxMenux använder som standard <code>rw,sync,no_subtree_check,'<'strong'>'no_root_squash'<'/strong'>'</code>. <strong>Varje root-användare på en klient kan skriva som root på exporten.</strong> Använd detta endast i ett betrott hemnätverk. Om CT:n kan nås från ett obetrott nätverk (VPS eller obetrott VLAN), <strong>byt alternativet till <code>root_squash</code></strong> i dialogen för egna alternativ."
+  },
+  "opening": {
+    "heading": "Öppna verktyget",
+    "body": "Öppna <strong>Storage & Share Manager → Configure NFS Server in LXC</strong> i huvudmenyn. Endast privilegierade CT:er visas. Välj mål-CT:n; skriptet startar den om den är stoppad och avvisar oprivilegierade CT:er. Menyn har fem alternativ.",
+    "imageAlt": "NFS Server Manager-menyn - Skapa / Visa / Ta bort / Status / Avinstallera"
+  },
+  "howRuns": {
+    "heading": "Hur manuset går (Skapa flöde)"
+  },
+  "network": {
+    "heading": "Nätverks-ACL — vilka klienter får montera?",
+    "intro": "<code>/etc/exports</code> styr vilka klienter som får montera exporten. Dialogen har tre lägen:",
+    "headerMode": "Läge",
+    "headerValue": "Värde skrivet till /etc/exports",
+    "headerWhen": "När man väljer den",
+    "rows": [
+      {
+        "mode": "Lokalt nätverk",
+        "value": "192.168.0.0/16",
+        "whenRich": "För vanliga hem- och småföretagsnät. Omfattar alla adresser under <code>192.168.*.*</code>."
+      },
+      {
+        "mode": "Anpassad subnet",
+        "value": "din CIDR (t.ex. 10.0.0.0/24)",
+        "when": "När ditt LAN inte är i 192.168.x.x eller om du vill ha en hårdare omfattning."
+      },
+      {
+        "mode": "Ensam värd",
+        "value": "din IP (till exempel 10.0.0.42)",
+        "when": "Endast en viss dator får montera exporten. Mest begränsande."
+      }
+    ]
+  },
+  "options": {
+    "heading": "Exportalternativ förklarade",
+    "headerOption": "Alternativ",
+    "headerEffect": "Vad det gör",
+    "rows": [
+      {
+        "option": "rw / ro",
+        "effect": "Tillåt läsning och skrivning eller endast läsning för anslutande klienter."
+      },
+      {
+        "option": "sync",
+        "effectRich": "Bekräftar skrivbegäranden först när data finns på disk. Säkrare än <code>async</code>, men med lägre genomströmning."
+      },
+      {
+        "option": "no_subtree_check",
+        "effect": "Hoppar över kontrollen vid varje begäran att filen fortfarande ligger i det exporterade underträdet. Det går snabbare och undviker problem när filer byter namn under pågående åtkomst."
+      },
+      {
+        "option": "no_root_squash",
+        "effectRich": "<strong>Lita på root på klienten.</strong> En klient som monterar som root skriver som root på servern. Passar betrodda LAN, exempelvis när säkerhetskopieringsverktyg måste bevara ägare. Ersätt med <code>root_squash</code> om du inte litar helt på varje dator som nätverkets ACL tillåter."
+      }
+    ]
+  },
+  "manual": {
+    "heading": "Manuell motsvarande",
+    "body": "Utför hela flödet manuellt. Varje kommando körs <strong>inne i CT:n</strong> via <code>pct exec &lt;ctid&gt; --</code> eller <code>pct enter &lt;ctid&gt;</code>:"
+  },
+  "view": {
+    "heading": "Visa aktuell export",
+    "body": "Visar <code>/etc/exports</code> inifrån CT:n utan kommentarer och tomma rader, med nätverks-ACL och alternativ för varje export. Användbart för att kontrollera delade mappar innan du lämnar ut CT:ns IP-adress."
+  },
+  "delete": {
+    "heading": "Ta bort en export",
+    "body": "Listar varje rad i <code>/etc/exports</code> för val, tar bort den valda (<code>sed -i</code>), kör <code>exportfs -ra</code> och startar om <code>nfs-kernel-server</code>. Mappen själv och dess innehåll lämnas intakt."
+  },
+  "status": {
+    "heading": "Kontrollera NFS status",
+    "body": "Diagnostik: kontrollerar att <code>nfs-kernel-server</code> och <code>rpcbind</code> är installerade och aktiva, visar utdata från <code>exportfs -v</code>, aktiva NFS-sessioner (<code>showmount -a</code>) och aktuella klientanslutningar."
+  },
+  "uninstall": {
+    "heading": "Avinstallera NFS server",
+    "body": "Fullständig rensning efter bekräftelse: stoppar och inaktiverar <code>nfs-kernel-server</code> och <code>rpcbind</code>, tömmer <code>/etc/exports</code>, tar bort NFS-paketen med <code>apt-get purge</code>, gruppen <code>sharedfiles</code> och användarna <code>remap_*</code> samt avslutar kvarvarande processer. De <strong>exporterade mapparna raderas inte</strong>; endast NFS-konfigurationen och paketen tas bort.",
+    "warnTitle": "Skriptet stannar vid exportlinjen, inte vid data",
+    "warnBody": "Både <em>Ta bort export</em> och <em>Avinstallera NFS-server</em> tar bort exportkonfigurationen. Data i den delade mappen bevaras. Om även data ska tas bort, gör det uttryckligen med <code>rm -rf</code> efter att skriptet har avslutats och säkerhetskopiera först om någon kan behöva dem."
+  },
+  "troubleshoot": {
+    "heading": "Felsökning",
+    "privTitle": "Privilegierad container krävs (skriptet avbryter)",
+    "privBody": "Den valda CT är oprivilegierad. <code>nfs-kernel-server</code> kan inte starta där eftersom montering <code>/proc/fs/nfsd</code> behöver <code>CAP_SYS_ADMIN</code> i värdkärnans namnrymd, och <code>nfsd</code>-modulen inte heller är tillgänglig i containerns namnrymd (<code>modprobe nfsd</code> inifrån returnerar <code>FATAL: Module nfsd not found</code>). Om du kringgår kontrollen ser du <code>rpc.nfsd: Unable to access /proc/fs/nfsd errno 2 (No such file or directory)</code> i journalen och inga NFS-portar kommer någonsin att öppnas. De enda användbara alternativen är: konvertera CT till privilegierad, eller flytta NFS-servern till en VM.",
+    "aptTitle": "apt-get install misslyckas",
+    "aptIntro": "Manuset antar en Debian-familj CT. På Alpine / Arch / Rocky / Alma, installera NFS serverpaket för hand:",
+    "aptItems": [
+      "Alpine: <code>apk add nfs-utils</code>",
+      "Arch: <code>pacman -S nfs-utils</code>",
+      "Rocky / Alma: <code>dnf install nfs-utils</code>"
+    ],
+    "aptOutro": "Kör sedan ProxMenux-skriptet igen; installationen hoppas över om verktygen redan finns.",
+    "aclTitle": "Kunden kan inte montera: \"åtkomst nekas av servern\"",
+    "aclBody": "Klientens IP ligger utanför nätverkets ACL. Skapa exporten på nytt med ett större undernät eller lägg till klientens exakta IP. Vanlig fallgrop: via router-NAT kan klienten visas med routerns WAN-IP i stället för sin LAN-IP. Kontrollera på servern med <code>tcpdump -n port 2049</code>.",
+    "ownTitle": "Filer skrivna av kunden visas med konstig ägande på servern",
+    "ownIntro": "Två möjligheter:",
+    "ownItems": [
+      "Med <code>no_root_squash</code> (standard) skriver klientrot som rot på servern. Filer ägs av <code>root:sharedfiles</code> tack vare SGID på mappen.",
+      "Icke-root klient användare skriver som sin egen UID / GID. Om deras UID inte finns på servern visas filer med råa nummer (t.ex. <code>1234:1234</code>). Använd <code>sharedfiles</code>-gruppen på klienten också, eller anpassa UID över de system som delar filer."
+    ],
+    "noShowTitle": "Servern kan nås men showmount returnerar inget",
+    "noShowBody": "Efter att du redigerat <code>/etc/exports</code> måste du ladda om exporttabellen med <code>exportfs -ra</code> och starta om <code>nfs-kernel-server</code>. Skriptet gör båda, men efter manuell redigering måste du göra det själv. Kontrollera även att brandväggen i CT:n och på Proxmox-värden tillåter TCP/UDP 2049 och rpcbind-porten (111)."
+  },
+  "related": {
+    "heading": "Relaterad",
+    "items": [
+      {
+        "href": "/docs/storage-share/lxc-nfs-client",
+        "label": "NFS klient i LXC",
+        "tail": " — omvänt: montera externa NFS-delningar i en CT."
+      },
+      {
+        "href": "/docs/storage-share/lxc-samba-server",
+        "label": "Samba server i LXC",
+        "tail": " — syskonsidan, samma mönster med SMB / CIFS istället för NFS."
+      },
+      {
+        "href": "/docs/storage-share/host-nfs",
+        "label": "NFS-delning som Proxmox-lagring",
+        "tailRich": " — när CT:n delar ut via NFS, registrera NFS-delningen i Proxmox så att den visas under <em>Datacenter → Storage</em>."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sv/docs/storage-share/lxc-samba-client.json b/web/messages/sv/docs/storage-share/lxc-samba-client.json
new file mode 100644
index 00000000..9073a666
--- /dev/null
+++ b/web/messages/sv/docs/storage-share/lxc-samba-client.json
@@ -0,0 +1,155 @@
+{
+  "meta": {
+    "title": "Samba klient i LXC | ProxMenux Dokumentation",
+    "description": "Montera Samba-/CIFS-delningar i en Proxmox LXC-container med ProxMenux. Installerar cifs-utils och smbclient automatiskt och stöder upptäckt, skyddad lagring av inloggningsuppgifter och beständiga monteringar via /etc/fstab. Kräver en privilegierad container.",
+    "ogTitle": "Samba klient i LXC | ProxMenux Dokumentation",
+    "ogDescription": "Montera Samba-/CIFS-delningar i en privilegierad LXC-container. Automatisk upptäckt, skyddad fil med inloggningsuppgifter och beständiga poster i /etc/fstab."
+  },
+  "header": {
+    "title": "Samba klient i LXC",
+    "description": "Montera Samba-delningar (SMB / CIFS) direkt inifrån en Proxmox LXC container. Containern blir en riktig CIFS-klient - pratar med Samba-servern över nätverket, kör mount.cifs, lagrar inloggningsuppgifter säkert och skriver till /etc/fstab. ProxMenux installerar cifs-utils + smbclient för dig och validerar inloggningsuppgifter mot servern innan du monterar.",
+    "section": "Lagring och delning · LXC"
+  },
+  "privReq": {
+    "title": "Privilegierad container krävs",
+    "body": "Samba / CIFS-klienten som använder <code>mount.cifs</code> behöver förmågor (minst <code>SYS_ADMIN</code>) som oprivilegierade LXC:er inte tillhandahåller. Skriptet ber dig välja CT och <strong>avbryter om den är oprivilegierad</strong>. Behövs delningen i en sådan CT monterar du den först på Proxmox-värden med <hostSambaLink>Samba / CIFS-delning som Proxmox-lagring</hostSambaLink> och bind-monterar den i CT:n med <mountLink>LXC Mount Manager</mountLink>."
+  },
+  "what": {
+    "heading": "Vad detta gör",
+    "body": "Containern talar CIFS över nätverket och monterar delningen på egen hand. Proxmox värd är bara nätverksbroen - det ser inte eller hanterar monteringen.",
+    "diagramServerLabel": "Samba server",
+    "diagramServerDetail": "//srv/share",
+    "diagramHostLabel": "Proxmox-värd",
+    "diagramHostDetail": "(bara en\nNätverksbro)",
+    "diagramCtLabel": "LXC (privilegierad)",
+    "diagramCtDetail": "/mnt/share\nmount.cifs inuti CT",
+    "diagramArrow": "CIFS",
+    "twoWaysTitle": "Två sätt att ge en CT en Samba-andel - välj en",
+    "twoWaysBind": "<strong>Bind montering via host</strong> (<mountLink>LXC Mount Manager</mountLink>): värd monterar CIFS en gång, varje CT bind-monterar samma väg. Fungerar med oprivilegierade CT. Rekommenderas när flera CT behöver samma delning.",
+    "twoWaysDirect": "<strong>Direct CIFS montering inuti CT</strong> (denna sida): CT monterar själva CIFS. Kräver privilegierad. Användbart när CT måste äga sina egna referenser, eller när varje CT talar till en annan server."
+  },
+  "opening": {
+    "heading": "Öppna verktyget",
+    "body": "Öppna <strong>Storage &amp; Share Manager → Konfigurera Samba-klient i LXC (endast privilegierad)</strong> i huvudmenyn. ProxMenux ber dig <strong>välja mål-CT</strong>, startar den om den är stoppad och avbryter om den är oprivilegierad. Sedan visas denna undermeny:",
+    "imageAlt": "Samba Client Manager-menyn - Mount / View / Unmount / Test-anslutning"
+  },
+  "howRuns": {
+    "heading": "Hur man kör skriptet (Mount flow)"
+  },
+  "creds": {
+    "heading": "Där lösenordet lever",
+    "body": "ProxMenux <strong>lägger inte lösenordet i monteringskommandot</strong> eller i <code>/etc/fstab</code>. I stället skapas en fil med inloggningsuppgifter i CT:n. Filen innehåller klartext som skyddas med behörigheter endast för root; den är inte krypterad:",
+    "whyTitle": "Varför en separat fil snarare än fstab",
+    "whyBody": "CIFS modulen accepterar <code>username=</code> / <code>password=</code> alternativ inline i fstab, men alla som kan läsa <code>/etc/fstab</code> ser lösenordet i klart. Att sätta referenser i en root-only-fil och peka fstab på den (<code>credentials=</code>) håller lösenordet ur världsläsbar konfig."
+  },
+  "options": {
+    "heading": "Mount alternativ förklarade",
+    "headerOption": "Alternativ",
+    "headerEffect": "Vad det gör",
+    "rows": [
+      {
+        "option": "rw / ro",
+        "effect": "Läs-skriv eller läs-bara läget för hela fästet."
+      },
+      {
+        "option": "file_mode=0664",
+        "effect": "Behörigheter som rapporterats för filer via CIFS. Default låter ägaren + gruppen skriva, andra läser."
+      },
+      {
+        "option": "dir_mode=0775",
+        "effect": "Behörigheter rapporterade för kataloger. Default låter ägaren + gruppen komma in och skapa, andra korsar."
+      },
+      {
+        "option": "iocharset=utf8",
+        "effect": "Använder UTF-8 för filnamn från nätverket. Undviker felkodade tecken i namn utanför ASCII."
+      },
+      {
+        "option": "credentials=file",
+        "effect": "Läs användarnamn / lösenord från filen (läggs automatiskt till användaren auth)."
+      },
+      {
+        "option": "guest",
+        "effect": "Autentisera som gäst, inga referenser behövs (läggs automatiskt när gäst väljs)."
+      },
+      {
+        "option": "_netdev",
+        "effect": "Berättar initsystemet denna montering behöver nätverket. Boot blockerar inte vänta på det."
+      },
+      {
+        "option": "x-systemd.automount",
+        "effect": "Lazy montering: endast fästen vid första åtkomst. CIFS-servern som inte kan nås på starten stannar inte CT."
+      },
+      {
+        "option": "noauto",
+        "effect": "Hoppar över omedelbar montering vid start. Automount-enheten monterar filsystemet först när det används."
+      }
+    ],
+    "netEffectTitle": "Nettoeffekten av fstabflaggarna",
+    "netEffectBody": "CIFS-filsystemet monteras vid <em>första åtkomsten</em> i stället för direkt under starten. Om servern är offline kan åtkomsten vänta eller misslyckas och påverka tjänster som behöver sökvägen. Automount minskar startberoendet men garanterar inte att alla CT-tjänster förblir opåverkade av en otillgänglig CIFS-server."
+  },
+  "manual": {
+    "heading": "Manuell motsvarande",
+    "body": "Replicera hela flödet för hand - varje kommando kör <strong>inuti CT</strong> via <code>pct exec &lt;ctid&gt; --</code> eller direkt via <code>pct enter &lt;ctid&gt;</code>:",
+    "guestIntro": "Gästvariant - ingen referensfil som behövs:"
+  },
+  "view": {
+    "heading": "Visa aktuella fästen",
+    "body": "Listar varje CIFS-monteringspunkt aktiv inuti CT (<code>mount -t cifs</code>) plus varje CIFS-linje i CT <code>/etc/fstab</code>. För varje fstab-post visas levande monteringsstatus - användbar för att upptäcka permanenta fästen som inte kom upp på start."
+  },
+  "unmount": {
+    "heading": "Avmontera Samba-delning",
+    "body": "Samlar aktiva monteringar och fstab-poster i en lista. När du väljer en post <strong>tas motsvarande rad bort från <code>/etc/fstab</code></strong> tillsammans med filen med inloggningsuppgifter. Skriptet kör inte <code>umount</code> på den aktiva monteringen utan talar om att CT:n måste startas om för att avmonteringen ska få effekt.",
+    "warnTitle": "Skriptet tar bort fstab-poster, inte levande fästen",
+    "warnBody": "Samma design som NFS-klienten: <code>umount</code> på en upptagen montering misslyckas med \"enhet upptagen\". Ta bort fstab-posten garanterar att fästet försvinner rent på nästa CT-start. Om du vill monteringen borttagen <em>nu</em>, kör <code>pct exec &lt;ctid&gt; -- umount /mnt/&lt;path&gt;</code> för hand efter att manuset har avslutats."
+  },
+  "test": {
+    "heading": "Testa Samba-anslutning",
+    "body": "Diagnostic pass inuti CT: bekräftar <code>cifs-utils</code> installeras, listar nuvarande CIFS-fästen, sedan för varje server som refereras i fstab-kontroller ping → portar 139 / 445 → gästlista. \"Kräver autentisering\" på gästtestet är normalt för alla servrar som inte exponerar offentliga aktier."
+  },
+  "troubleshoot": {
+    "heading": "Felsökning",
+    "privTitle": "Privilegierad container krävs (skriptet avbryter)",
+    "privBody": "Den valda CT är oprivilegierad. Kernel CIFS-klienten behöver <code>SYS_ADMIN</code>-kapacitet som oprivilegierade CT inte exponerar. Antingen konvertera CT till privilegierad, eller använd den alternativa vägen som beskrivs i varningen högst upp på denna sida.",
+    "aptTitle": "apt-get install fails",
+    "aptIntro": "Manuset antar en Debian-familj CT (<code>apt-get</code>). På Alpine / Arch / Rocky / Alma, installera CIFS-klienten för hand:",
+    "aptItems": [
+      "Alpine: <code>apk add cifs-utils samba-client</code>",
+      "Arch: <code>pacman -S cifs-utils smbclient</code>",
+      "Rocky / Alma: <code>dnf install cifs-utils samba-client</code>"
+    ],
+    "aptOutro": "Sedan kör ProxMenux-skriptet - installationssteget hoppar när verktygen redan finns.",
+    "guestFallbackTitle": "\"Servern kopplade dig som gäst istället för den angivna användaren\"",
+    "guestFallbackBody": "Manusets aktiva validering fångade ett verkligt autproblem. Servern accepterade anslutningen men nedgraderade den till gästen eftersom referenserna är fel. Vanliga orsaker: typo i användarnamnet / lösenordet, användaren finns inte på servern, användaren är låst, eller arbetsgruppen / domänen är missmatchad. Re-run flödet och åter ange referenser noggrant (lösenordet är dolt i dialogrutan).",
+    "denyTitle": "\"NT_STATUS_ACCESS_DENIED\" vid montering",
+    "denyBody": "Inloggningsuppgifterna är validerade men delningen nekar åtkomst. Kontrollera användarens behörigheter för just den delningen på servern (valideringen bekräftar inloggning, inte varje delnings ACL:er). Kontrollera också om servern kräver en viss SMB-version: lägg till <code>vers=3.0</code> (eller <code>2.1</code>, <code>2.0</code>) i monteringsalternativen.",
+    "utf8Title": "Filnamn i UTF-8 / utanför ASCII visas felaktigt",
+    "utf8Body": "Standardalternativen inkluderar <code>iocharset=utf8</code>, men vissa serverkonfigurationer rapporterar en oväntad kodsida. Om filnamn med accenter / symboler ser fel, prova också <code>nounix</code> (vissa Linux Samba-servrar behöver detta när klienten också är Linux) eller ställa in serversidan till <code>unix extensions = no</code>.",
+    "bootTitle": "Permanent montering lyckas men kommer inte upp på start",
+    "bootBody": "Nästan alltid en av: nätverket är inte klart när CT-fästen (skriptets <code>_netdev,x-systemd.automount,noauto</code>-flaggor fixar detta), servern är oåtkomlig vid start (auto-mount väntar på första åtkomst - det är normalt), eller DNS är olöst på start (använd serverns IP, inte dess värdnamn)."
+  },
+  "related": {
+    "heading": "Relaterad",
+    "items": [
+      {
+        "href": "/docs/storage-share/lxc-mount-points",
+        "label": "LXC-monteringspunkter (värd ↔ container)",
+        "tail": " — alternativet för oprivilegierade CT: montering på värd, binda till CT."
+      },
+      {
+        "href": "/docs/storage-share/lxc-nfs-client",
+        "label": "NFS klient i LXC",
+        "tail": " — relaterad sida med samma mönster för NFS-delningar."
+      },
+      {
+        "href": "/docs/storage-share/lxc-samba-server",
+        "label": "Samba server i LXC",
+        "tailRich": " — omvänt: exponera mappar <em>från</em> en CT över Samba."
+      },
+      {
+        "href": "/docs/storage-share/host-samba",
+        "label": "Samba / CIFS som Proxmox förvaring",
+        "tail": " — registrera delningen i Proxmox i stället för i en enskild CT."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sv/docs/storage-share/lxc-samba-server.json b/web/messages/sv/docs/storage-share/lxc-samba-server.json
new file mode 100644
index 00000000..b787b3dd
--- /dev/null
+++ b/web/messages/sv/docs/storage-share/lxc-samba-server.json
@@ -0,0 +1,132 @@
+{
+  "meta": {
+    "title": "Samba server i LXC | ProxMenux Dokumentation",
+    "description": "Kör en Samba (SMB / CIFS) server i en Proxmox LXC container med ProxMenux. Auto-installerar samba, hanterar /etc/samba/smb.conf, smbpasswd-användare, sharedfiles grupp för bindmonterade mappar. Kräver en privilegierad container.",
+    "ogTitle": "Samba server i LXC | ProxMenux Dokumentation",
+    "ogDescription": "Dela mappar via SMB/CIFS från en privilegierad LXC-container. Automatisk installation, smbpasswd-användare och behörigheter anpassade till bind-monteringar."
+  },
+  "header": {
+    "title": "Samba server i LXC",
+    "description": "Kör en Samba (SMB / CIFS) server i en Proxmox LXC container och exponera mappar till Windows / macOS / Linux klienter på nätverket. ProxMenux installerar samba, skapar en Samba användare med smbpasswd, hanterar /etc/samba/smb.conf, och tillämpar behörigheter anpassade till bind-monteringar när den delade mappen kommer från värden.",
+    "section": "Lagring & Dela · LXC"
+  },
+  "privReq": {
+    "title": "Privilegierad container krävs",
+    "body": "Samba antar den anslutande användarens identitet med <code>setgroups()</code> på varje trädanslutning (det ögonblick en klient öppnar en delning). I en oprivilegierad LXC avvisar kärnan det syscall eftersom containerns användarnamnrymd skapas med <code>setgroups=deny</code> - och <code>smbd</code> svarar genom att avsluta arbetsprocessen med <code>PANIC: sys_setgroups failed</code>. Resultatet är att <code>smbd</code> startar och binder portar 139/445, men varje klientanslutning misslyckas med <code>NT_STATUS_CONNECTION_DISCONNECTED</code>. Skriptet genomdriver en privilegierad CT av denna anledning och <strong>avbryter om CT:n är oprivilegierad</strong>. Det finns ingen ren fix på serversidan; använd en privilegierad CT eller kör Samba i en VM."
+  },
+  "what": {
+    "heading": "Vad detta gör",
+    "body": "Containern blir en SMB/CIFS-server: den kör <code>smbd</code>, exponerar en mapp via <code>/etc/samba/smb.conf</code> och accepterar klientanslutningar på portar <code>139</code>/<code>445</code>. Klienterna ser delningen på <code>\\\\&lt;ct-ip&gt;\\&lt;share-name&gt;</code> i Windows Explorer, <code>smb://&lt;ct-ip&gt;/&lt;share-name&gt;</code> i macOS Finder, eller via <code>mount.cifs</code> på Linux.",
+    "diagramServerLabel": "LXC (privilegierad) - Samba server",
+    "diagramServerDetail": "/mnt/data\n(mappen du delar)\n\nsmbd + nmbd körs\n\nAnvändare: <username>\n(via smbpasswd)\n\nTvingad grupp:\nsharedfiles",
+    "diagramClientLabel": "Valfri klient i nätverket",
+    "diagramClientDetail": "Windows: \\\\<ip>\\<share>\nmacOS:   smb://<ip>/<share>\nLinux:   mount.cifs",
+    "diagramArrow": "SMB / CIFS"
+  },
+  "perms": {
+    "heading": "Två tillståndsvägar beroende på mapptypen",
+    "body": "Innan delningen läggs till i <code>smb.conf</code> kontrollerar skriptet om mappen är en <strong>bind-montering från värden</strong> eller en vanlig <strong>lokal mapp i CT:n</strong> och anpassar ägare och behörigheter därefter:",
+    "headerType": "Mapptyp",
+    "headerAction": "Vad manuset gör",
+    "bindType": "Bind-mount från värd",
+    "bindTypeSubRich": "Detekteras via <code>mount</code>-utgång",
+    "bindActionRich": "Skapar grupp <code>sharedfiles</code> (standard GID 999, dynamisk om det tas), lägger till Samba-användaren till den, sedan <code>chown root:sharedfiles</code> + <code>chmod 2775</code> (SGID - nya filer ärver gruppen). Om användaren fortfarande inte kan skriva gäller <code>setfacl -m u:&lt;user&gt;:rwx</code>.",
+    "localType": "Lokal mapp i CT",
+    "localTypeSub": "Ingen bind-montering upptäckt",
+    "localActionRich": "Standard ägande: <code>chown -R &lt;user&gt;:&lt;user&gt;</code> + <code>chmod -R 755</code>. Ingen delad grupp behövdes eftersom ingen annan CT skriver till den här mappen. Falls tillbaka till <code>setfacl</code> om skrivåtkomst fortfarande saknas.",
+    "gidTitle": "GID för \"sharedfiles\" skiljer sig från NFS-serverflödet",
+    "gidBody": "Samba server script använder GID <strong>999</strong> för <code>sharedfiles</code>, medan <nfsLink>NFS server flow</nfsLink> använder GID <strong>101000</strong>. Om du kör båda servrarna i samma CT och vill ha en gemensam grupp över båda protokollen, redigera en av dem för att matcha den andra efter installationen (t.ex. <code>groupmod -g 101000 sharedfiles</code>) och sätt ägare på de berörda mapparna igen. Detta är en känd inkonsekvens i de nuvarande skripten."
+  },
+  "opening": {
+    "heading": "Öppna verktyget",
+    "body": "Öppna <strong>Storage & Share Manager → Configure Samba Server in LXC</strong> i huvudmenyn. Endast privilegierade CT:er visas. Välj mål-CT:n; skriptet startar den om den är stoppad och avvisar oprivilegierade CT:er. Menyn har fem alternativ.",
+    "imageAlt": "Samba Server Manager-menyn - Skapa / Visa / Ta bort / Status / Avinstallera"
+  },
+  "howRuns": {
+    "heading": "Hur manuset går (Skapa flöde)"
+  },
+  "modes": {
+    "heading": "De tre delningslägena",
+    "intro": "Varje läge skriver en annan stanza till <code>smb.conf</code>. Alla tre inkluderar <code>valid users = &lt;username&gt;</code> (ingen anonym), <code>force group = sharedfiles</code> (så nya filer tillhör den delade gruppen) och <code>veto files = /lost+found/</code> (döljer det från kunder).",
+    "headerMode": "Läge",
+    "headerBlock": "Block skriven till smb.conf",
+    "rwMode": "Läsning och skrivning",
+    "roMode": "Skrivskyddad",
+    "customMode": "Anpassad",
+    "customBodyRich": "Du skriver dina egna direktiv i en fritextlåda. ProxMenux placerar dem fortfarande i ett <code>[share]</code> block med standard <code>path</code>, <code>valid users</code>, <code>force group</code> och <code>veto files</code>."
+  },
+  "manual": {
+    "heading": "Manuell motsvarande",
+    "body": "Utför hela flödet manuellt. Varje kommando körs <strong>inne i CT:n</strong> via <code>pct exec &lt;ctid&gt; --</code> eller <code>pct enter &lt;ctid&gt;</code>:"
+  },
+  "connect": {
+    "heading": "Ansluta från klienter",
+    "headerOs": "Klientens operativsystem",
+    "headerHow": "Hur att ansluta",
+    "windowsOs": "Windows",
+    "windowsHowRich": "Utforskaren → adressfältet: <code>\\\\&lt;ct-ip&gt;\\&lt;share-name&gt;</code>. Eller <em>Anslut nätverksenhet</em> → markera ”Anslut med andra autentiseringsuppgifter”.",
+    "macosOs": "macOS",
+    "macosHowRich": "Finder → <em>Gå → Anslut till Server...</em> → <code>smb://&lt;ct-ip&gt;/&lt;share-name&gt;</code>. Eller <code>mount_smbfs //user@&lt;ct-ip&gt;/&lt;share&gt; /mountpoint</code>.",
+    "linuxOs": "Linux",
+    "linuxHowRich": "<code>mount -t cifs //&lt;ct-ip&gt;/&lt;share&gt; /mnt/x -o username=&lt;u&gt;,password=&lt;p&gt;,iocharset=utf8</code>. Eller använd <clientLink>Samba-klienten i LXC</clientLink>-sida om kunden är en annan Proxmox CT."
+  },
+  "view": {
+    "heading": "Visa aktuella delningar",
+    "body": "Läser <code>/etc/samba/smb.conf</code> inuti CT och listar varje <code>[share]</code> block (skippa <code>[global]</code>, <code>[homes]</code>, <code>[printers]</code>) med sin väg. Användbart som en snabb inventering."
+  },
+  "delete": {
+    "heading": "Ta bort en delning",
+    "body": "Låter dig välja en delning med namn, tar bort blocket från <code>smb.conf</code> (<code>sed</code> raderar från <code>[share]</code> ner till nästa tomma rad) och startar om <code>smbd</code>. Mappen själv och dess innehåll lämnas intakt."
+  },
+  "status": {
+    "heading": "Kontrollera Samba status",
+    "body": "Rapporter om <code>smbd</code> och <code>nmbd</code> är installerade och aktiva, listar Samba-användare (<code>pdbedit -L</code>) och trycker aktiva sessioner (<code>smbstatus</code>)."
+  },
+  "uninstall": {
+    "heading": "Avinstallera Samba server",
+    "body": "Fullständig rensning efter bekräftelse: stoppar och inaktiverar <code>smbd</code> och <code>nmbd</code>, säkerhetskopierar <code>smb.conf</code> till <code>smb.conf.backup.YYYYMMDD_HHMMSS</code>, tar bort Samba-användare med <code>smbpasswd -x</code> och Samba-paketen med <code>apt-get purge</code>. De <strong>exporterade mapparna raderas inte</strong>.",
+    "warnTitle": "Mappar överlever - säkerhetskopiera data separat",
+    "warnBody": "<em>Ta bort delning</em> och <em>Avinstallera Samba-server</em> tar bort delningskonfigurationen. Data i de delade mapparna bevaras. Om även data ska tas bort, gör det uttryckligen med <code>rm -rf</code> efter att skriptet avslutats."
+  },
+  "troubleshoot": {
+    "heading": "Felsökning",
+    "privTitle": "Privilegierad container krävs (skriptet avbryter)",
+    "privBody": "Den valda CT är oprivilegierad och <code>smbd</code> kan inte servera filer där. Om du kringgår kontrollen och konfigurerar Samba för hand börjar <code>smbd</code> och portarna öppna, men den första klientanslutningen orsakar en panik med <code>PANIC: sys_setgroups failed</code> i <code>/var/log/samba/log.&lt;client&gt;</code> och klienten ser <code>NT_STATUS_CONNECTION_DISCONNECTED</code>. Orsaken är det oprivilegierade användarnamnrymden med <code>setgroups=deny</code>, som blockerar Sambas per-anslutning impersonation. Varken <code>features=keyctl=1</code> eller ta bort <code>force user</code>/<code>force group</code> ändrar detta. De enda användbara alternativen är: konvertera CT till privilegierad, eller flytta Samba till en VM.",
+    "aptTitle": "apt-get install misslyckas",
+    "aptIntro": "Manuset antar en Debian-familj CT. På Alpine / Arch / Rocky / Alma, installera Samba för hand:",
+    "aptItems": [
+      "Alpine: <code>apk add samba</code>",
+      "Arch: <code>pacman -S samba</code>",
+      "Rocky / Alma: <code>dnf install samba</code>"
+    ],
+    "aptOutro": "Kör sedan ProxMenux-skriptet igen; installationen hoppas över om verktygen redan finns.",
+    "noShareTitle": "Klienten ansluter men ser inte delningen",
+    "noShareBody": "Kontrollera att <code>browseable = yes</code> är inställd i delningsblocket (standard för rw / ro-lägen; kan saknas i anpassad). Kontrollera också CT brandvägg och Proxmox värd brandvägg tillåter TCP 445 (SMB) och 139 (NetBIOS). Vissa Windows-klienter kräver också namnupplösning - prova IP direkt först.",
+    "authTitle": "Autentisering misslyckas (NT_STATUS_LOGON_FAILURE)",
+    "authBody": "Antingen är lösenordet fel (Samba-lösenord är <em>separata</em> från systemlösenord; lista Samba-användare med <code>pdbedit -L</code>) eller saknas användaren i <code>valid users</code> för delningen. Återställ lösenordet i CT:n med <code>smbpasswd &lt;user&gt;</code>.",
+    "groupTitle": "Filer skrivna av kunden visas med fel grupp på servern",
+    "groupBody": "Skriptet sätter <code>force group = sharedfiles</code> i delningsblocket, så nya filer bör vara grupp <code>sharedfiles</code>. Om de inte är det kan SGID-biten på föräldrakatalogen ha gått förlorad (någon körde <code>chmod</code> för hand). Tillämpa igen: <code>chmod 2775 /mnt/&lt;share&gt;</code>.",
+    "bothTitle": "Dela samma mapp över både NFS och Samba",
+    "bothBody": "ProxMenux använder olika GID för <code>sharedfiles</code> i varje manus (Samba: 999, NFS: 101000). Om du tjänar samma mapp via båda, besluta om en GID och anpassa båda. Den enklaste fixen: efter att ha kört båda skripten, redigera den mindre GID:"
+  },
+  "related": {
+    "heading": "Relaterad",
+    "items": [
+      {
+        "href": "/docs/storage-share/lxc-samba-client",
+        "label": "Samba klient i LXC",
+        "tail": " — omvänt: montera externa Samba-delningar i en CT."
+      },
+      {
+        "href": "/docs/storage-share/lxc-nfs-server",
+        "label": "NFS server i LXC",
+        "tail": " — syskonsidan, samma mönster med NFS istället för CIFS."
+      },
+      {
+        "href": "/docs/storage-share/host-samba",
+        "label": "Samba / CIFS som Proxmox-lagring",
+        "tailRich": " — när CT:n delar ut via Samba, registrera Samba-delningen i Proxmox så att den visas under <em>Datacenter → Storage</em>."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sv/docs/utils/export-vm.json b/web/messages/sv/docs/utils/export-vm.json
new file mode 100644
index 00000000..fca9883b
--- /dev/null
+++ b/web/messages/sv/docs/utils/export-vm.json
@@ -0,0 +1,145 @@
+{
+  "meta": {
+    "title": "Exportera VM till OVA / OVF | ProxMenux-dokumentation",
+    "description": "Exportera en Proxmox-VM till ett portabelt OVA-arkiv eller en OVF-katalog med DMTF-standardschemat. VMDK-diskar i formatet streamOptimized och SHA1-manifest. Kan importeras i VMware ESXi / Workstation / Fusion, VirtualBox och tillbaka i Proxmox.",
+    "ogTitle": "Exportera VM till OVA / OVF | ProxMenux-dokumentation",
+    "ogDescription": "Konvertera en Proxmox-VM till ett portabelt OVA- / OVF-paket som är kompatibelt med VMware och VirtualBox."
+  },
+  "header": {
+    "title": "Exportera VM till OVA / OVF",
+    "description": "Konverterar en Proxmox-VM till ett portabelt OVA-paket (ett enda TAR-arkiv) eller OVF-paket (beskrivningsfil och VMDK-filer) med DMTF:s OVF-standardschema. Diskarna konverteras med qemu-img till VMDK i formatet streamOptimized. Resultatet kan importeras i VMware (ESXi / Workstation / Fusion), VirtualBox och tillbaka i Proxmox med importverktyget.",
+    "section": "Verktyg"
+  },
+  "intro": {
+    "title": "Vad detta gör",
+    "body": "Läser konfigurationen för en stoppad VM, konverterar varje disk till VMDK i formatet streamOptimized, skapar en OVF-beskrivningsfil och ett SHA1-manifest och paketerar allt som en enda <code>.ova</code>-fil eller en <code>-ovf</code>-katalog. Den ursprungliga virtuella maskinen ändras aldrig."
+  },
+  "picker": {
+    "heading": "VM-väljare",
+    "body": "Vid start visar skriptet alla virtuella maskiner från <code>qm list</code> med VMID, namn och status. Välj den som ska exporteras:",
+    "imgAlt": "Dialog för att välja en VM att exportera, med en lista över alla virtuella maskiner"
+  },
+  "stopped": {
+    "heading": "Den virtuella maskinen måste vara stoppad",
+    "intro": "En konsekvent diskavbildning kräver en stoppad VM. Om den valda virtuella maskinen körs erbjuder ProxMenux att stänga av den:",
+    "items": [
+      "Normal avstängning med <code>qm shutdown $VMID --timeout 120</code> (väntar 2 minuter på gästens ACPI-avstängning).",
+      "Om väntetiden löper ut erbjuds ett tvångsstopp: <code>qm stop $VMID</code> (motsvarar att bryta strömmen).",
+      "Om du avböjer båda avbryts exporten utan att några data ändras."
+    ],
+    "warnTitle": "Ett tvångsstopp motsvarar att bryta strömmen",
+    "warnBody": "<code>qm stop</code> motsvarar att dra ur strömkabeln. Gästens filsystem kan behöva repareras vid nästa start. Använd normal avstängning när det går och reservera tvångsstopp för gäster som inte svarar."
+  },
+  "format": {
+    "heading": "Formatval: OVA eller OVF",
+    "headerFormat": "Format",
+    "headerOutput": "Utdata",
+    "headerPros": "Fördelar",
+    "headerCons": "Nackdelar",
+    "rows": [
+      {
+        "format": "OVA",
+        "output": "name-vmid-ts.ova",
+        "pros": "En enda fristående fil som är lätt att flytta, överföra med sftp eller bifoga till ett supportärende.",
+        "cons": "Kräver ~220% av den virtuella diskstorleken (extra utrymme för TAR-arkivet medan det skapas)."
+      },
+      {
+        "format": "OVF",
+        "output": "name-vmid-ts-ovf/",
+        "pros": "~120% av den virtuella diskstorleken. Lättare att granska eftersom beskrivningsfilen är vanlig XML-text. Kan redigeras före import.",
+        "cons": "Flera filer som måste överföras tillsammans."
+      }
+    ]
+  },
+  "destination": {
+    "heading": "Destinationskatalog",
+    "body": "Välj en förinställd sökväg (<code>/var/lib/vz/dump</code>, <code>/var/lib/vz/template/iso</code>) eller ange en egen. Skriptet kontrollerar att katalogen är skrivbar och varnar om det lediga utrymmet verkar otillräckligt innan du börjar.",
+    "calloutTitle": "Tumregel för ledigt utrymme",
+    "calloutBody": "För OVF-export av en VM med totalt 100 GB virtuell diskstorlek bör du ha ~120 GB ledigt; för OVA, ~220 GB. Den faktiska användningen kan bli lägre för nästan tomma diskar. OVA-arkivet skapas med okomprimerad TAR medan de tillfälliga VMDK-filerna finns kvar, så det behövs plats för båda. Om utrymmet tar slut under exporten städar EXIT-hanteraren den tillfälliga katalogen och du måste börja om."
+  },
+  "package": {
+    "heading": "Vad som hamnar i paketet",
+    "intro": "För en OVA / OVF som heter <code>myvm-100-2026-04-26_18-30-15</code>:",
+    "code": "# OVA mode (single .ova file is a TAR of):\nmyvm-100-2026-04-26_18-30-15.ovf      # XML descriptor (DMTF OVF 1.0 + RASD + VSSD)\nmyvm-100-2026-04-26_18-30-15.mf       # SHA1 manifest\nmyvm-100-2026-04-26_18-30-15-disk0.vmdk\nmyvm-100-2026-04-26_18-30-15-disk1.vmdk\n...\n\n# OVF mode (a directory):\nmyvm-100-2026-04-26_18-30-15-ovf/\n├── myvm-100-2026-04-26_18-30-15.ovf\n├── myvm-100-2026-04-26_18-30-15.mf\n├── myvm-100-2026-04-26_18-30-15-disk0.vmdk\n└── myvm-100-2026-04-26_18-30-15-disk1.vmdk"
+  },
+  "exported": {
+    "heading": "Vad blir exporterat",
+    "items": [
+      "<strong>Diskar:</strong> alla poster av typen <code>scsi*</code>, <code>sata*</code>, <code>virtio*</code> och <code>ide*</code> i VM-konfigurationen, konverterade till VMDK i formatet streamOptimized.",
+      "<strong>Antal vCPU:er</strong> (RASD ResourceType 3) och <strong>minne</strong> i MiB (ResourceType 4).",
+      "<strong>Antal nätverkskort</strong> (ResourceType 10: endast antalet, inte bryggan eller modellen).",
+      "<strong>VM-namn</strong> och en uppgift om typen av operativsystem."
+    ],
+    "notTitle": "Vad exporteras INTE",
+    "notItems": [
+      "CD-ROM- / ISO-anslutningar (avsiktligt uteslutna).",
+      "Cloud-init-enheter (avsiktligt uteslutna).",
+      "Nätverkskortets specifika brygga och modell (endast antalet bevaras).",
+      "Valet av BIOS / UEFI, som måste ställas in igen vid import.",
+      "Konfiguration av PCI-genomkoppling.",
+      "Snapshots - endast det nuvarande tillståndet fångas.",
+      "Inställningar på VM-nivå (NUMA, hugepages, hotplug, …)."
+    ]
+  },
+  "conversion": {
+    "heading": "Diskkonvertering",
+    "intro": "Varje disk konverteras med:",
+    "code": "qemu-img convert -p -O vmdk -o subformat=streamOptimized \\\n    \"$source_path\" \\\n    \"$work_dir/<base_name>-disk<N>.vmdk\"",
+    "outro": "<code>streamOptimized</code> är VMwares format som kan läsas i en enda genomgång. Det stöds av ESXi 6.7+, VMware Workstation, VirtualBox och Proxmox självt. Det är det VMDK-underformat som har bredast kompatibilitet och passar för flytt mellan system. Nackdelen är att det saknar direktåtkomst till godtyckliga positioner och därför inte kan monteras direkt utan konvertering."
+  },
+  "manifest": {
+    "heading": "SHA1-manifest",
+    "intro": "Varje paket innehåller en <code>.mf</code>-fil med SHA1-hashar för OVF-beskrivningsfilen och varje VMDK:",
+    "code": "SHA1(myvm-100-2026-04-26_18-30-15.ovf)= 3a7bd3e2360a3d29eea436fcfb7e44c735d117c9\nSHA1(myvm-100-2026-04-26_18-30-15-disk0.vmdk)= b7e23ec29af22b0b4e41da31e868d57226121c84\nSHA1(myvm-100-2026-04-26_18-30-15-disk1.vmdk)= a87ff679a2f3e71d9181a67b7542122c",
+    "outro": "Manifestet är valfritt i OVF-specifikationen och många program ignorerar det, men det kan användas för att kontrollera att paketet överfördes oskadat. Verifiera manuellt med <code>sha1sum -c file.mf</code>."
+  },
+  "import": {
+    "heading": "Importera resultatet",
+    "intro": "Det exporterade paketet kan importeras i:",
+    "items": [
+      {
+        "href": "/docs/utils/import-vm",
+        "preRich": "<strong>Proxmox</strong> — använd det tillhörande verktyget ",
+        "linkLabel": "Importera VM från OVA / OVF",
+        "tailRich": "."
+      },
+      {
+        "tailRich": "<strong>VMware ESXi</strong> — Datacenter → Deploy OVF Template; välj .ova- eller .ovf-filen."
+      },
+      {
+        "tailRich": "<strong>VMware Workstation / Fusion</strong> — File → Open; välj .ova- eller .ovf-filen."
+      },
+      {
+        "tailRich": "<strong>VirtualBox</strong> — File → Import Appliance; välj .ova- eller .ovf-filen."
+      }
+    ]
+  },
+  "troubleshoot": {
+    "heading": "Felsökning",
+    "noSpaceTitle": "qemu-img convert misslyckas under konverteringen med \"No space left on device\"",
+    "noSpaceBody": "Utrymmet tog slut på destinationen. EXIT-hanteraren städar automatiskt den tillfälliga katalogen. Välj en destination med mer ledigt utrymme (se tumregeln ovan) och kör exporten igen.",
+    "unsupportedHwTitle": "Exporten slutförs men VMware vägrar importera: \"Unsupported hardware family\"",
+    "unsupportedHwBody": "Vissa ESXi-versioner avvisar OVF-beskrivningsfiler som anger en okänd maskinvarufamilj. Öppna .ovf-filen i en textredigerare, eller packa först upp .ova-filen, leta efter <code>&lt;vssd:VirtualSystemType&gt;</code> och ange ett värde som ESXi godtar, till exempel <code>vmx-13</code> för ESXi 6.5+. Prova VirtualBox som en snabb lösning; det är mindre strikt.",
+    "nicTitle": "Den importerade virtuella maskinen använder ett annat nätverkskort eller en annan SCSI-styrenhet",
+    "nicBody": "OVF bevarar antalet nätverkskort, men inte deras ursprungliga modell. Granska nätverksinställningarna för den importerade virtuella maskinen i destinationshypervisorn. Exporten anger en lsilogic-SCSI-styrenhet för VMware-kompatibilitet. Vid återimport i Proxmox med ProxMenux skapas den virtuella maskinen med en LSI-styrenhet och e1000-nätverkskort; byt sedan till <code>VirtIO SCSI</code> och VirtIO om gästen har lämpliga drivrutiner.",
+    "runningTitle": "Den virtuella maskinen kördes och jag avböjde avstängning: exporten avbröts",
+    "runningBody": "Skriptet kan inte skapa en konsekvent avbildning medan data skrivs till diskarna. Acceptera avstängningsfrågan nästa gång, eller stäng först av den virtuella maskinen manuellt (<code>qm shutdown $VMID</code>) och kör exporten igen.",
+    "slowTitle": "Diskkonverteringen är långsam",
+    "slowBody": "<code>qemu-img convert</code> använder en tråd och läser källan med full hastighet. Räkna med 15–30 minuter för en disk på 100 GB på en mekanisk hårddisk. Från NVMe till NVMe går det 5–10 gånger snabbare. Diskarna i en VM konverteras i följd; tiden ökar linjärt med den totala virtuella storleken."
+  },
+  "related": {
+    "heading": "Relaterat",
+    "items": [
+      {
+        "href": "/docs/utils/import-vm",
+        "label": "Importera VM från OVA / OVF",
+        "tail": " — det kompletterande verktyget för återimport."
+      },
+      {
+        "href": "/docs/utils",
+        "label": "Verktygsöversikt",
+        "tail": " — tillbaka till avsnittsöversikten."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sv/docs/utils/import-vm.json b/web/messages/sv/docs/utils/import-vm.json
new file mode 100644
index 00000000..ecdd15c8
--- /dev/null
+++ b/web/messages/sv/docs/utils/import-vm.json
@@ -0,0 +1,218 @@
+{
+  "meta": {
+    "title": "Importera VM från OVA / OVF | ProxMenux-dokumentation",
+    "description": "Importera en VM från VMware ESXi / Workstation / Fusion / VirtualBox / ProxMenux till Proxmox VE. Packar automatiskt upp OVA, läser OVF-metadata, skapar den virtuella maskinen och importerar varje disk i lagringens inbyggda format (qcow2 / raw).",
+    "ogTitle": "Importera VM från OVA / OVF | ProxMenux-dokumentation",
+    "ogDescription": "Importera virtuella maskiner från VMware-, VirtualBox- eller ProxMenux-exporter till Proxmox. Diskarna konverteras automatiskt till lagringens inbyggda format."
+  },
+  "header": {
+    "title": "Importera VM från OVA / OVF",
+    "description": "Importerar ett OVA- / OVF-paket till Proxmox VE: packar upp OVA-arkiv, läser antalet vCPU:er, minne, nätverkskort och diskreferenser från OVF-filen, skapar sedan den virtuella maskinen och importerar varje disk med qm importdisk till vald lagring. Kompatibelt med exporter från VMware (ESXi / Workstation / Fusion), VirtualBox och ProxMenux.",
+    "section": "Verktyg"
+  },
+  "intro": {
+    "title": "Vad detta gör",
+    "body": "Skapar en komplett VM i Proxmox från ett portabelt paket. Efter importen är den redo att startas. Vissa kontroller och justeringar av nätverkskortsmodell, firmware och operativsystemstyp rekommenderas för prestanda och kompatibilitet."
+  },
+  "picker": {
+    "heading": "Filväljare",
+    "intro": "Vid start erbjuder skriptet två förinställda kataloger eller en egen sökväg:",
+    "items": [
+      "<code>/var/lib/vz/dump</code> - standard Proxmox vzdump backup katalog.",
+      "<code>/var/lib/vz/template/iso</code> — användbart om du överförde OVA-filen dit med sftp.",
+      "Egen sökväg för OVA- / OVF-filer på andra platser på värden."
+    ],
+    "outro": "Den listar sedan varje <code>.ova</code> och <code>.ovf</code>-fil i den valda katalogen.",
+    "imageAlt": "Filvalsdialog för import av en VM"
+  },
+  "flow": {
+    "heading": "Hur importen fungerar",
+    "nodes": [
+      {
+        "label": "OVA / OVF in",
+        "detail": ".ova → tar xf till\n /tmp/.proxmenux-import-*\n.ovf → använd på plats",
+        "variant": "source"
+      },
+      {
+        "label": "Tolkning och dialoger",
+        "detail": "AWK läser OVF\n(namn, vCPU, RAM, NIC,\ndiskar). Val av\nVMID / lagring / brygga",
+        "variant": "bridge"
+      },
+      {
+        "label": "qm create + importdisk",
+        "detail": "qm create $VMID\nqm importdisk\n(VMDK → lagringsformat)\nqm set --scsiN",
+        "variant": "target"
+      }
+    ]
+  },
+  "ovf": {
+    "heading": "OVF-tolkning",
+    "intro": "En <strong>gawk</strong>-parser läser OVF-filen och hämtar VM-metadata. Den använder <code>match()</code> med tre argument, en gawk-funktion som inte stöds av mawk, standardvalet för <code>awk</code> i Debian / Proxmox. Om gawk saknas installeras det automatiskt vid första importen via <code>ensure_repositories</code> + <code>install_single_package</code>. Senare importer behöver inte det steget. Fält som läses:",
+    "headerField": "Fält",
+    "headerSource": "Källa i OVF",
+    "headerDefault": "Standard om saknas",
+    "rows": [
+      {
+        "field": "VM namn",
+        "source": "<Name> (första matchen)",
+        "default": "imported-vm"
+      },
+      {
+        "field": "Antal vCPU:er",
+        "source": "RASD ResourceType 3 → VirtualQuantity",
+        "default": "1"
+      },
+      {
+        "field": "Minne (MiB)",
+        "source": "RASD ResourceType 4 → VirtualQuantity",
+        "default": "1024"
+      },
+      {
+        "field": "Antal nätverkskort",
+        "source": "antal poster med ResourceType 10",
+        "default": "1"
+      },
+      {
+        "field": "OS-typ",
+        "source": "/Linux/ eller /Windows/ i beskrivning",
+        "default": "other"
+      },
+      {
+        "field": "Diskreferenser",
+        "source": "href attribut slutar i .vmdk / .qcow2 / .img / .raw",
+        "default": "Inga (importen avbryts)"
+      }
+    ]
+  },
+  "memWarn": {
+    "title": "Tvetydiga minnesenheter",
+    "body": "Parsern konverterar kända minnesenheter till <strong>MiB</strong>, inklusive byte, KiB, MiB, GiB och stödda textetiketter. Saknade eller okända enheter <em>behandlas som MiB</em>. Jämför efter importen <code>qm config $VMID | grep memory</code> med källmaskinens dokumenterade RAM och korrigera vid behov med <code>qm set $VMID --memory &lt;MiB&gt;</code>."
+  },
+  "dialog": {
+    "heading": "Importens dialogsteg",
+    "items": [
+      "<strong>VMID</strong> — föreslår nästa lediga ID (<code>pvesh get /cluster/nextid</code>).",
+      "<strong>VM-namn</strong> — använder namnet från OVF-filen som standard; du kan ändra det.",
+      "<strong>Mållagring</strong> — meny med lagringar som stöder innehållet <code>images</code>, från <code>pvesm status -content images</code>.",
+      "<strong>Nätverksbrygga</strong> — meny med bryggor från <code>ip link show type bridge</code>. En ensam brygga väljs automatiskt; standardvalet är <code>vmbr0</code>.",
+      "<strong>Bekräftelse</strong> — sammanfattning med VMID, namn, vCPU:er, minne, nätverkskort, lagring, brygga och diskar att importera. Avbryt här så ändras inget."
+    ]
+  },
+  "create": {
+    "heading": "Skapa den virtuella maskinen",
+    "intro": "Efter bekräftelsen kör skriptet:",
+    "code": "qm create $VMID \\\n    --name \"$NAME\" \\\n    --memory $MEMORY \\\n    --cores $VCPU \\\n    --ostype $OSTYPE \\\n    --scsihw lsi \\\n    --net0 e1000,bridge=$BRIDGE\n\n# For each additional NIC:\nqm set $VMID --netN e1000,bridge=$BRIDGE",
+    "outro": "SCSI controller standarder till <code>lsi</code> (LSI Logic) för VMDK kompatibilitet. NICs standard till <code>e1000</code> (universell kompatibilitet) på den valda bron."
+  },
+  "diskLoop": {
+    "heading": "Importloop för diskar",
+    "intro": "För varje diskreferens i OVF:",
+    "items": [
+      "<code>qm importdisk $VMID $disk_path $STORAGE</code> — importerar disken i ett format som stöds av mållagringen och skapar en post <code>unusedN:</code> i VM-konfigurationen.",
+      "Skriptet söker med grep efter den nyskapade referensen <code>unusedN</code> i konfigurationen.",
+      "<code>qm set $VMID --scsiN $unused_disk</code> fäster disken som <code>scsi0</code>, <code>scsi1</code>, …",
+      "<code>qm set $VMID --delete unusedN</code> - rensar den numera oanvända markören."
+    ],
+    "outro": "Boot är inställd på den första SCSI-skivan: <code>qm set $VMID --boot c --bootdisk scsi0</code>."
+  },
+  "postImport": {
+    "heading": "Rekommenderade justeringar efter import",
+    "intro": "Importen använder brett kompatibla inställningar för att den virtuella maskinen ska kunna starta vid första försöket. När du har bekräftat att den startar kan du välja effektivare inställningar i Proxmox-gränssnittet eller via CLI:",
+    "headerSetting": "Inställning",
+    "headerDefault": "Standard efter import",
+    "headerRecommended": "Rekommenderas (om gästen stöder)",
+    "rows": [
+      {
+        "setting": "NIC modell",
+        "default": "e1000",
+        "recommended": "VirtIO (mycket snabbare, kräver drivrutin i gästen)"
+      },
+      {
+        "setting": "SCSI-kontroller",
+        "default": "LSI",
+        "recommended": "VirtIO SCSI single (modern Linux eller Windows med VirtIO-drivrutiner)"
+      },
+      {
+        "setting": "Fast programvara (BIOS / UEFI)",
+        "default": "Proxmox standard (BIOS)",
+        "recommended": "Använd källmaskinens firmware; ett felaktigt val kan hindra start"
+      },
+      {
+        "setting": "QEMU gästagent",
+        "default": "Av",
+        "recommendedRich": "På + installera <code>qemu-guest-agent</code> i gästen (bättre säkerhetskopior, IP-rapportering)"
+      },
+      {
+        "setting": "OS-typ",
+        "default": "l26 / win10 / other (heuristik)",
+        "recommended": "Kontrollera mot gästens faktiska operativsystem"
+      },
+      {
+        "setting": "Visning",
+        "default": "Standard",
+        "recommended": "VirtIO-GPU eller SPICE (bättre konsolprestanda)"
+      }
+    ]
+  },
+  "fwWarn": {
+    "title": "Firmware mismatch = ingen start",
+    "body": "Om källmaskinen använde UEFI men Proxmox skapar den med BIOS, eller tvärtom, hittar gästen ingen startbar disk. Kontrollera <em>FirmwareType / firmware</em> i OVF-filen eller ursprungsinställningarna och välj samma i Proxmox: <code>qm set $VMID --bios ovmf</code> för UEFI; standardvalet för BIOS är <code>seabios</code>."
+  },
+  "notImported": {
+    "heading": "Vad importeras INTE",
+    "items": [
+      "<strong>Specifika nätverksbryggor</strong> — bara antalet kort bevaras. Alla använder den brygga du valde vid importen.",
+      "<strong>Nätverkskortsmodell</strong> — standardvalet är e1000.",
+      "<strong>Firmwaretypen BIOS / UEFI</strong> — använder Proxmox standardval BIOS.",
+      "<strong>Konfiguration av PCI-genomkoppling</strong>.",
+      "<strong>TPM</strong> (vTPM).",
+      "<strong>Cloud-init</strong>-enheter.",
+      "<strong>Snapshots</strong> - endast det nuvarande tillståndet.",
+      "<strong>USB / seriella / parallella enheter</strong> förklaras i OVF.",
+      "<strong>VM taggar / anteckningar / start-on-boot</strong> alternativ."
+    ]
+  },
+  "troubleshoot": {
+    "heading": "Felsökning",
+    "orphanTitle": "VM skapades men diskimporten misslyckades: en ofullständig VM blev kvar",
+    "orphanIntro": "När importen misslyckas erbjuder skriptet att ta bort den ofullständiga virtuella maskinen och dess importerade diskar. Om du avböjde eller automatisk radering misslyckades, granska maskinen och ta bort den manuellt med:",
+    "orphanCode": "qm destroy $VMID --destroy-unreferenced-disks 1",
+    "orphanOutro": "Fastställ sedan den underliggande orsaken (sannolikt diskutrymme på mållagringen) och återimportera.",
+    "memTitle": "Importerad VM har 8 MB RAM (eller 8 TB)",
+    "memIntro": "Parsern konverterar kända AllocationUnits till MiB. Saknade eller okända enheter behandlas som MiB. Granska OVF-filen och jämför det importerade minnet med källmaskinen. Korrigera vid behov:",
+    "memCode": "qm set $VMID --memory 8192    # 8 GiB",
+    "bootTitle": "Den importerade virtuella maskinen startar inte: \"No bootable device\"",
+    "bootIntro": "En vanlig orsak är fel val av BIOS / UEFI. Källmaskinen använde UEFI men Proxmox skapade den med BIOS. Välj matchande firmware:",
+    "bootCode": "qm set $VMID --bios ovmf       # UEFI\n# also add an EFI disk for the EFI vars:\nqm set $VMID --efidisk0 $STORAGE:1,format=qcow2,efitype=4m,pre-enrolled-keys=1",
+    "bootOutro": "En annan vanlig orsak: startordningen pekar på scsi0 medan operativsystemet ligger på scsi1. Ändra ordningen i VM-fliken Options.",
+    "bsodTitle": "En Windows-VM exporterad från VMware visar blåskärm vid första starten",
+    "bsodBody": "Windows är känsligt för byte av diskstyrenhet. Installera VirtIO-drivrutiner <em>före</em> exporten från VMware eller behåll standardstyrenheten <code>lsi</code>. Byt till VirtIO SCSI först efter att gästen startat och VirtIO-drivrutiner installerats i Windows.",
+    "zeroTitle": "OVF-parsern rapporterar 0 diskar",
+    "zeroBody": "OVF-filen kan använda diskreferenser som parsern inte känner igen. Öppna filen och leta efter varje disks post <code>&lt;File ovf:href=\"...vmdk\" ...&gt;</code>. Om disken faktiskt är VMDK men har ett ovanligt suffix som <code>.dat</code>, byt namn till <code>.vmdk</code> och uppdatera OVF-referensen. Ett namnbyte konverterar inte formatet.",
+    "awkTitle": "awk: syntax error at or near , — parsern misslyckas med varje OVA / OVF",
+    "awkIntro": "OVF-parsern använder gawk-syntaxen <code>match()</code> med tre argument, som saknas i mawk, standardvalet för <code>awk</code> i Debian / Proxmox. Nyare skriptversioner installerar gawk vid första användningen via <code>ensure_repositories</code> + <code>install_single_package</code>. Om du kör en äldre kopia, installera det manuellt:",
+    "awkCode": "apt-get install -y gawk",
+    "awkOutro": "Kör sedan importen igen.",
+    "netTitle": "Nätverket fungerar inte efter första starten",
+    "netBody": "Gästen kan sakna drivrutiner för e1000-modellen i Proxmox, eller den valda bryggan kan vara fel. Ändra Network Device → Model på VM-fliken Hardware. Kontrollera också <code>ip a</code> i gästen: gränssnittet kan ha fått namnet ens18 i stället för eth0, medan nätverkskonfigurationen fortfarande använder det gamla namnet."
+  },
+  "files": {
+    "heading": "Filer involverade",
+    "code": "scripts/utilities/import_vm_ova_ovf.sh       # this script\n/tmp/.proxmenux-import-*/                    # temp extraction dir for OVA\n/etc/pve/nodes/<node>/qemu-server/<vmid>.conf  # created by qm create\n<storage>/<vmid>/<vmid>-disk-<n>.<fmt>        # disk images, format depends on storage"
+  },
+  "related": {
+    "heading": "Relaterat",
+    "items": [
+      {
+        "href": "/docs/utils/export-vm",
+        "label": "Exportera VM till OVA / OVF",
+        "tail": " — det kompletterande verktyget för export."
+      },
+      {
+        "href": "/docs/utils",
+        "label": "Verktygsöversikt",
+        "tail": " — tillbaka till avsnittsöversikten."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sv/docs/utils/index.json b/web/messages/sv/docs/utils/index.json
new file mode 100644
index 00000000..a8bb8b57
--- /dev/null
+++ b/web/messages/sv/docs/utils/index.json
@@ -0,0 +1,115 @@
+{
+  "meta": {
+    "title": "Proxmox-verktyg — UUP Dump, uppgradering från PVE 8 till 9, OVA-export/-import | ProxMenux",
+    "description": "Verktyg för vardagen i Proxmox VE: skapa Windows-ISO-filer med UUP Dump, installera utvalda CLI-verktyg, uppdatera Proxmox-systemet säkert, uppgradera från PVE 8 till PVE 9, exportera virtuella maskiner till OVA / OVF och importera OVA- / OVF-maskiner från VMware eller VirtualBox.",
+    "ogTitle": "Proxmox-verktyg — UUP Dump, uppgradering från PVE 8 till 9, OVA-export/-import",
+    "ogDescription": "Skapa Windows-ISO-filer, installera CLI-verktyg, kör en säker uppdatering, uppgradera från PVE 8 till PVE 9 och exportera eller importera virtuella maskiner i OVA / OVF.",
+    "twitterTitle": "Proxmox-verktyg | ProxMenux",
+    "twitterDescription": "ISO-skapande, CLI-verktyg, Proxmox-uppdatering, uppgradering PVE 8→9 och portabla virtuella maskiner i OVA / OVF."
+  },
+  "header": {
+    "title": "Hjälpverktyg",
+    "description": "Sex verktyg kompletterar det dagliga arbetet i Proxmox VE: ISO-skapande, systemunderhåll och flytt av virtuella maskiner. Varje alternativ är fristående. Välj det du behöver; inget installeras förrän du begär det.",
+    "section": "Verktyg"
+  },
+  "intro": {
+    "title": "Vad denna meny är för",
+    "body": "Tre grupper med fristående men ofta användbara verktyg: <strong>skapa en Windows-ISO</strong> med UUP Dump, <strong>underhåll Proxmox-värden</strong> (CLI-verktyg, uppdateringar och uppgradering av huvudversion) samt <strong>importera och exportera virtuella maskiner</strong> i Proxmox med standardformatet OVA / OVF."
+  },
+  "opening": {
+    "heading": "Öppna menyn",
+    "body": "Välj <strong>Utilities</strong> i ProxMenux huvudmeny. Då visas följande:",
+    "imageAlt": "Verktygsmenyn med UUP Dump, systemverktyg, uppdatering, uppgradering, export och import"
+  },
+  "groups": {
+    "heading": "Tre verktygsgrupper",
+    "intro": "De sex verktygen är indelade i tre fristående grupper. Klicka på ett kort nedan för att gå till motsvarande avsnitt.",
+    "iso": {
+      "title": "Skapa ISO-filer",
+      "body": "Skapa officiella Windows-ISO-filer med UUP Dump direkt på Proxmox-värden.",
+      "bullets": [
+        "Delad UUP Dump-länk → startbar ISO",
+        "Beroenden installeras automatiskt",
+        "Resultatet sparas i Proxmox katalog för ISO-mallar"
+      ]
+    },
+    "maintenance": {
+      "title": "Systemunderhåll",
+      "body": "Håll värden frisk: CLI-verktyg, regelbundna uppdateringar och storversionsuppgraderingen när det är dags.",
+      "bullets": [
+        "Installationsprogram för systemverktyg (25 CLI-verktyg)",
+        "Proxmox systemuppdatering (apt + dist-upgrade)",
+        "Uppgradering av huvudversion PVE 8 → PVE 9"
+      ]
+    },
+    "portability": {
+      "title": "Flytt av virtuella maskiner",
+      "body": "Importera och exportera virtuella maskiner i Proxmox med standardformatet OVA / OVF.",
+      "bullets": [
+        "Exportera Proxmox-VM → OVA / OVF",
+        "Importera OVA / OVF → Proxmox VM",
+        "Kompatibel med VMware och VirtualBox"
+      ]
+    }
+  },
+  "upgradeWarn": {
+    "title": "Uppgraderingen PVE 8 → 9 är destruktiv och går inte att ångra",
+    "body": "En uppgradering av huvudversion ersätter Debianbasen (Bookworm → Trixie) och Proxmox-komponenterna i det befintliga systemet. Det finns ingen väg tillbaka: du behöver <strong>verifierade säkerhetskopior</strong> av varje VM och CT samt <strong>åtkomst via konsol / IPMI / iKVM</strong> innan du börjar. Därför vägrar uppgraderingsverktyget att köras från Proxmox webbterminal."
+  },
+  "isoSection": {
+    "heading": "Skapa ISO-filer",
+    "body": "Skapa en ny och aktuell Windows-installations-ISO direkt på Proxmox-värden. Skriptet automatiserar hela UUP Dump-flödet: installation av beroenden (aria2c, cabextract, wimlib-imagex, …), parallell nedladdning av uppdateringsfiler med aria2 och konvertering till en enda startbar ISO. Den sparas i <code>/var/lib/vz/template/iso</code> och är redo att anslutas till en VM.",
+    "options": [
+      {
+        "title": "UUP Dump ISO-skapare",
+        "description": "Skapa en aktuell Windows-installations-ISO från en delad UUP Dump-länk. Beroenden, nedladdning och konvertering hanteras helt automatiskt. Den färdiga ISO-filen sparas i /var/lib/vz/template/iso, redo för att skapa en VM.",
+        "href": "/docs/utils/UUp-Dump-ISO-Creator"
+      }
+    ]
+  },
+  "maintenanceSection": {
+    "heading": "Systemunderhåll",
+    "body": "Tre verktyg täcker det dagliga och det mer sällsynta arbetet på värden. <strong>Installationsprogrammet för systemverktyg</strong> installerar de CLI-verktyg du använder efter en nyinstallation. <strong>Proxmox systemuppdatering</strong> sköter det veckovisa eller månatliga underhållet. <strong>Uppgradering från PVE 8 till PVE 9</strong> är det stora steget vid varje ny huvudversion, med extra säkerhetskontroller eftersom det inte går att ångra.",
+    "options": [
+      {
+        "title": "Installationsprogram för systemverktyg",
+        "description": "Välj bland 25 utvalda CLI-verktyg (htop, btop, iperf3, tmux, ...) med eget urval eller fördefinierade grupper (grundläggande, utveckling, komprimering, multiplexrar, analys och nätverk). Använder standardflödet med paketförråd och verifieringskommando.",
+        "href": "/docs/utils/system-utils"
+      },
+      {
+        "title": "Proxmox systemuppdatering",
+        "description": "Kontroll av paketförråd + apt update + apt dist-upgrade med bekräftelse före omstart. Identifierar PVE-huvudversionen (8 eller 9), behåller konfigurerade paketförråd och frågar innan en värd utan abonnemang byter till no-subscription-förrådet. Därefter körs autoremove.",
+        "href": "/docs/utils/system-update"
+      },
+      {
+        "title": "Uppgradera PVE 8 till PVE 9",
+        "description": "Uppgradering av huvudversion (Debian Bookworm → Trixie + PVE 8 → 9). Förkontroller, migrering av paketförråd, automatiskt eller interaktivt läge, validering efter uppgraderingen och omstart. Vägrar att köras från webbterminalen.",
+        "href": "/docs/utils/upgrade-pve8-pve9"
+      }
+    ]
+  },
+  "portabilitySection": {
+    "heading": "Flytt av virtuella maskiner (OVA / OVF)",
+    "body": "OVA och OVF är paketeringsformat för överföring mellan hypervisorer enligt DMTF-standarden. De stöds av VMware, VirtualBox och Proxmox. De två verktygen är avsedda för export och återimport: en VM som exporteras från Proxmox kan importeras tillbaka och tvärtom. Använd dem för att flytta arbetslaster från ESXi, skapa en portabel säkerhetskopia av en VM eller dela en förberedd VM med någon som använder VirtualBox.",
+    "options": [
+      {
+        "title": "Exportera VM till OVA / OVF",
+        "description": "Konvertera en Proxmox-VM till ett portabelt OVA-arkiv eller en OVF-katalog. DMTF-standardschema, SHA1-manifest och VMDK-diskar i formatet streamOptimized. Kan importeras i VMware (ESXi / Workstation / Fusion), VirtualBox och tillbaka i Proxmox.",
+        "href": "/docs/utils/export-vm"
+      },
+      {
+        "title": "Importera VM från OVA / OVF",
+        "description": "Importera en export från VMware / VirtualBox / ProxMenux i Proxmox. Verktyget packar automatiskt upp OVA, läser OVF-metadata, skapar den virtuella maskinen och importerar varje disk i lagringens inbyggda format.",
+        "href": "/docs/utils/import-vm"
+      }
+    ]
+  },
+  "diskSpaceCallout": {
+    "title": "Om diskutrymme för export / import",
+    "body": "Båda verktygen konverterar diskformat: exporten använder <code>qemu-img convert -O vmdk -o subformat=streamOptimized</code>; importen använder <code>qm importdisk</code> för att konvertera tillbaka till lagringens inbyggda format (qcow2 / raw). Räkna vid export med <strong>~120% av den virtuella diskstorleken</strong> för OVF och <strong>~220%</strong> för OVA. OVA-arkivet använder okomprimerad TAR och skapas medan de tillfälliga VMDK-filerna finns kvar. Kontrollera att målkatalogen har tillräckligt med ledigt utrymme innan du börjar."
+  },
+  "fitsTogether": {
+    "heading": "Så är menyn organiserad",
+    "body": "Varje verktyg har ett eget skript under <code>scripts/utilities/</code>. Proxmox systemuppdatering anropar ett enda säkert arbetsskript i <code>scripts/global/</code>, update-pve-safe.sh, som identifierar huvudversionen och hanterar både PVE 8 och PVE 9. Uppgraderingen PVE 8 → 9 erbjuder två extra åtgärder i sin egen meny: en fristående <em>Kontroll före uppgradering</em> (kör <code>pve8to9 --full</code>) och en skrivskyddad <em>Guide för manuell uppgradering</em> (17 steg), för användare som vill granska processen eller utföra den för hand."
+  }
+}
diff --git a/web/messages/sv/docs/utils/system-update.json b/web/messages/sv/docs/utils/system-update.json
new file mode 100644
index 00000000..c91ebed9
--- /dev/null
+++ b/web/messages/sv/docs/utils/system-update.json
@@ -0,0 +1,168 @@
+{
+  "meta": {
+    "title": "Proxmox systemuppdatering | ProxMenux-dokumentation",
+    "description": "Uppdaterar paket inom den aktuella Proxmox-huvudversionen med apt-get update och apt full-upgrade -y. Kontrollerar diskutrymme och konfigurerade paketförråd, försöker återställa GPG-nycklar, kontrollerar och reparerar gamla LVM-PV-huvuden, bygger om hanterade DKMS-drivrutiner vid behov, kör autoremove/autoclean och erbjuder omstart när det behövs.",
+    "ogTitle": "Proxmox systemuppdatering | ProxMenux-dokumentation",
+    "ogDescription": "apt full-upgrade med kontroll av paketförråd, autoremove/autoclean och omstartsfråga vid behov."
+  },
+  "header": {
+    "title": "Proxmox systemuppdatering",
+    "description": "Anropar ett enda arbetsskript (<code>update-pve-safe.sh</code>) som identifierar den aktuella Proxmox-huvudversionen. Konfigurerade paketförråd läses via Proxmox API och bevaras. En värd utan abonnemang som bara använder Enterprise måste bekräfta ett byte till no-subscription. Skriptet uppdaterar paket och bygger om ProxMenux-hanterade DKMS-drivrutiner för en kärna som är klar för nästa start. Huvudskriptet erbjuder omstart om systemets omstartsmarkering finns eller om den senaste installerade kärnan skiljer sig från den som körs. Processen kan också startas med <em>Update Now</em> i ProxMenux Monitor-huvudet när väntande uppdateringar upptäcks.",
+    "section": "Verktyg"
+  },
+  "calloutWhat": {
+    "title": "Vad detta gör",
+    "body": "Uppdaterar värden till den senaste korrigeringsnivån inom dess aktuella huvudversion. Uppgraderar <strong>inte</strong> till en annan huvudversion. För PVE 8 → PVE 9, se <link>Uppgradera PVE 8 till PVE 9</link>."
+  },
+  "official": {
+    "heading": "Proxmox officiella rekommendation",
+    "intro": "För att uppdatera en värd inom samma huvudversion rekommenderar Proxmox att du kör:",
+    "code": "apt update && apt full-upgrade -y",
+    "outro": "Den här raden är det officiella kommandot för aktuella Proxmox-versioner. Du behöver också kontrollera att paketförråden är korrekta, att rätt förråd är aktiverade och att värden fungerar som den ska efter uppdateringen."
+  },
+  "onTop": {
+    "heading": "Vad ProxMenux lägger till: verifierat i skriptet",
+    "intro": "Använder <strong>samma apt full-upgrade-åtgärd</strong>, med kontroll av paketförråd, DKMS-ombyggnad och efterföljande städning. Stegen nedan motsvarar <code>scripts/utilities/proxmox_update.sh</code> och dess enda arbetsskript <code>scripts/global/update-pve-safe.sh</code>:",
+    "items": [
+      "<strong>Identifierar PVE-huvudversionen</strong> i arbetsskriptet (<code>pveversion | grep -oP ''pve-manager/\\K[0-9]+''</code>). Ett enda skript hanterar PVE 8 och PVE 9. Konfigurerade paketförråd bevaras om inte en värd utan abonnemang accepterar det erbjudna bytet.",
+      "<strong>Behåller konfigurerade paketförråd.</strong> <code>ensure_repositories</code> läser förråd och abonnemangsstatus via Proxmox API. Med ett aktivt abonnemang eller ett redan använt no-subscription- eller testförråd ändras inget. En värd utan aktivt abonnemang som bara använder Enterprise måste bekräfta bytet till no-subscription. Ett nej avslutar uppdateringen utan att ändra några källor.",
+      "<strong>Kör uppdateringen utan interaktion</strong> med <code>DEBIAN_FRONTEND=noninteractive</code> och <code>--force-confdef --force-confold</code>. För dpkg-konfigurationsfiler väljs standardåtgärden om en sådan finns; annars behålls den befintliga filen.",
+      "<strong>Tvingar inte fram valfria verktyg.</strong> Arbetsskriptet installerar inte <code>zfsutils-linux</code>, <code>chrony</code>, <code>ifupdown2</code> eller liknande paket mot det tidigare valet. En Proxmox-installation som avstått från något av dem behåller det valet. Saknade paket visas av de överordnade installationsflödena, inte av uppdateringsflödet.",
+      "<strong>Kontroll och reparation av LVM-metadata.</strong> Identifierar gamla PV-huvuden och kör vgck --updatemetadata och vgchange -ay för berörda volymgrupper. Detta kan ändra LVM-metadata; det är inte en kontroll som bara visar varningar.",
+      "<strong>Rengör efteråt:</strong> <code>apt-get autoremove -y</code> + <code>apt-get autoclean -y</code>.",
+      "<strong>DKMS byggs om före omstartsfrågan.</strong> Arbetsskriptet anropar <code>pmx_rebuild_dkms_after_kernel</code> när en nyare installerad kärna är klar. Huvudskriptet kontrollerar <code>/var/run/reboot-required</code> och använder <code>dpkg-query</code> för att jämföra kärnan från <code>uname -r</code> med det senaste installerade paketet <code>proxmox-kernel-*-pve-signed</code> / <code>pve-kernel-*-pve</code>. Markeringen kan saknas på värdar utan <code>needrestart</code>; kärnjämförelsen fungerar ändå."
+    ]
+  },
+  "calloutOneSentence": {
+    "title": "I en mening",
+    "body": "Uppdaterar värdens paket, behåller paketförråd om du inte accepterar ett byte, kontrollerar LVM-metadata, bygger om hanterade DKMS-drivrutiner, städar med autoremove/autoclean och erbjuder omstart vid behov."
+  },
+  "confirm": {
+    "heading": "Bekräftelsedialog",
+    "intro": "När du väljer alternativet öppnas en sammanfattning av de planerade åtgärderna som kräver en uttrycklig bekräftelse:",
+    "imageAlt": "Bekräftelsedialog för Proxmox systemuppdatering med kontroll av paketförråd, paketuppdateringar och städning"
+  },
+  "routes": {
+    "heading": "Så delegerar huvudskriptet arbetet",
+    "nodes": {
+      "source": {
+        "label": "proxmox_update.sh",
+        "detail": "pveversion |\ngrep -oP ''pve-manager/\\K[0-9]+''"
+      },
+      "bridge": {
+        "label": "Ett enda arbetsskript",
+        "detail": "update-pve-safe.sh\n(detekterar PVE 8 / 9\ninternt)"
+      },
+      "target": {
+        "label": "Efter uppdatering",
+        "detail": "apt-get autoremove\napt-get autoclean\nOmstartsfråga vid behov"
+      }
+    }
+  },
+  "worker": {
+    "heading": "Vad arbetsskriptet gör",
+    "intro": "Ett arbetsskript (<code>scripts/global/update-pve-safe.sh</code>) hanterar PVE 8 (<code>bookworm</code>) och PVE 9 (<code>trixie</code>). Det identifierar huvudversionen internt och kontrollerar befintliga paketförråd utan att skriva om Debians grundkällor. Stegen är:",
+    "items": [
+      "<strong>Förkontroller.</strong> Kontrollerar att minst ~1 GB är ledigt i <code>/var/cache/apt/archives</code>. Vid för lite utrymme avbryts processen tidigt med ett tydligt meddelande så att den inte misslyckas mitt i en apt-transaktion.",
+      "<strong>Kontroll av paketförråd.</strong> <code>ensure_repositories</code> läser förråd och abonnemangsstatus. Med ett användbart Proxmox-förråd ändras inget. En värd utan aktivt abonnemang som bara använder Enterprise måste bekräfta bytet till no-subscription; ett nej avslutar uppdateringen.",
+      "<strong>apt update med automatisk GPG-återställning.</strong> Vid <code>NO_PUBKEY</code> för ett paketförråd, även ett från tredje part, importerar arbetsskriptet den saknade nyckeln och försöker igen innan det rapporterar ett fel.",
+      "<strong>Väntande uppdateringar och säkerhetsuppdateringar.</strong> Visar hur många paket som kommer att ändras och hur många som kommer från säkerhetssviten, så att bekräftelsedialogen visar konkreta antal.",
+      "<strong>Bekräftelsedialog.</strong> Efter uppdatering av paketlistorna kräver arbetsskriptet ett uttryckligt ja innan paketen uppdateras.",
+      "<strong>apt full-upgrade.</strong> Använder <code>DEBIAN_FRONTEND=noninteractive</code> och <code>--force-confdef --force-confold</code>. Dpkg följer standardåtgärden för konfigurationsfiler när en sådan finns och behåller annars den befintliga filen.",
+      "<strong>LVM-kontroll.</strong> <code>lvm_repair_check</code> uppdaterar volymgruppernas metadata när diskar som genomkopplats till gäst-VM:er (DSM, TrueNAS eller lagringsapparater) återkommer med gamla PV-huvuden.",
+      "<strong>DKMS-ombyggnad för ProxMenux-hanterade drivrutiner.</strong> När en ny kärna är klar läser <code>pmx_rebuild_dkms_after_kernel</code> de ProxMenux-installerade drivrutinerna i <code>components_status.json</code> (för närvarande <code>nvidia_driver</code> → modul <code>nvidia</code> och <code>coral_driver</code> → modul <code>gasket</code>), installerar matchande kärnheaders (<code>proxmox-headers-&lt;newkver&gt;</code> om de finns, annars <code>pve-headers-&lt;newkver&gt;</code>) och kör <code>dkms autoinstall -k &lt;newkver&gt;</code>. Om <code>dkms status</code> därefter inte visar moduler byggda för den nya kärnan körs respektive installationsprogram igen med <code>--auto-reinstall</code>. Fel loggas men avbryter inte uppdateringen, som ändå når omstartsfrågan.",
+      "<strong>Efterföljande städning.</strong> <code>apt-get autoremove</code> + <code>apt-get autoclean</code> innan kontrollen lämnas tillbaka till huvudskriptet."
+    ]
+  },
+  "post": {
+    "heading": "Rensning och omstart efter uppdatering",
+    "intro": "När arbetsskriptet har avslutats kör huvudskriptet:",
+    "code": "apt-get autoremove -y    # drop unused dependencies pulled in by old packages\napt-get autoclean        # drop downloaded .deb files no longer in the index",
+    "afterCode": "Huvudskriptet kontrollerar också om en omstart behövs. Var och en av följande signaler utlöser frågan:",
+    "items": [
+      "<code>/var/run/reboot-required</code> finns: ett paket eller systemverktyg har markerat att värden behöver startas om.",
+      "Det senaste installerade Proxmox-kärnpaketet skiljer sig från kärnan som körs, enligt <code>dpkg-query</code> och uname -r."
+    ],
+    "outro": "Om något av villkoren uppfylls frågar en whiptail-dialog <em>”Vissa ändringar kräver en omstart. Vill du starta om nu?”</em>. Avböj för att fortsätta med den aktuella kärnan tills du startar om manuellt, till exempel under ett planerat underhållsfönster."
+  },
+  "end": {
+    "heading": "Vad du ser i slutet",
+    "intro": "När arbetsskriptet är klart visar terminalen resultatet av städningen och omstartsfrågan om en omstart behövs:",
+    "imageAlt": "Slutsammanfattning för Proxmox systemuppdatering med städningsresultat och omstartsfråga"
+  },
+  "calloutDeclineReboot": {
+    "title": "Skjut bara upp omstarten om du har ett tydligt skäl",
+    "body": "När du installerar ett nytt paket av typen <code>proxmox-kernel-*</code> ersätts den kärna som körs först efter en omstart. Den nya kärnan och dess matchande moduler aktiveras vid nästa start. Planera omstarten till ett lämpligt underhållsfönster och granska eventuella DKMS-byggvarningar i förväg."
+  },
+  "noSub": {
+    "heading": "Så hanterar arbetsskriptet Enterprise-förrådet",
+    "intro": "Proxmox aktiverar Enterprise-förrådet som standard. Utan ett aktivt abonnemang returnerar det 401 vid <code>apt-get update</code>. Arbetsskriptet ändrar förråden endast i detta fall och efter bekräftelse, via Proxmox API som används av <em>Node → Updates → Repositories</em>. De olika fallen:",
+    "items": [
+      "Med ett <strong>aktivt abonnemang</strong> behålls förråden och Enterprise tillhandahåller uppdateringarna.",
+      "Om <strong>no-subscription- eller testförrådet redan är aktiverat</strong> behålls förråden, oavsett vilka andra källor som har konfigurerats.",
+      "Med <strong>inget aktivt abonnemang och enbart Enterprise-förrådet</strong> erbjuder en dialog ett byte. Om du accepterar inaktiveras Enterprise, no-subscription aktiveras och paketlistorna uppdateras. Ändringen registreras i vyn <em>Changes</em> i Audit & Report. Ett nej avslutar uppdateringen utan att ändra källorna.",
+      "Befintliga <strong>Enterprise-källor för Ceph</strong> inaktiveras vid samma byte utan att någon annan Ceph-kanal väljs. En värd som använder Ceph konfigurerar dess kanal separat.",
+      "Om <strong>ingen terminal finns för bekräftelsen</strong> ändras inga källor och uppdateringen avslutas med ett meddelande som hänvisar till <em>Node → Updates → Repositories</em>."
+    ],
+    "outro": "Debians källor och övriga filer för paketförråd ändras aldrig av det här flödet. En post som blandar Enterprise med andra komponenter byts inte: uppdateringen avbryts och ber dig dela upp posten i Proxmox vy för paketförråd."
+  },
+  "cluster": {
+    "heading": "Att tänka på för kluster",
+    "calloutTitle": "På kluster: uppdatera en nod i taget",
+    "calloutBody": "Kör det här alternativet på <strong>en nod i taget</strong> i ett Proxmox-kluster och vänta tills omstarten är klar innan du fortsätter. Migrera först gäster från noden för att undvika tjänsteavbrott i hela klustret. Olika mindre versioner, till exempel 8.4.1 och 8.4.5, kan köras parallellt under några timmar. Olika kärnor kan ge oväntat beteende för HA-hanterade gäster."
+  },
+  "doesnt": {
+    "heading": "Vad det inte gör",
+    "items": [
+      "<strong>Uppgradering av huvudversion.</strong> 8 → 9 är en separat åtgärd; se <link>Uppgradera PVE 8 till PVE 9</link>.",
+      "<strong>Säkerhetskopiering.</strong> Inga ögonblicksbilder eller automatisk återgång. Apt-åtgärder är inte transaktionella. Behåll dina vanliga säkerhetskopieringsrutiner (PBS, vzdump, ZFS-ögonblicksbilder).",
+      "<strong>Uppdateringar av containrar / VM:er.</strong> Bara värden uppdateras; gästerna lämnas oförändrade.",
+      "<strong>Separat firmwareflashning.</strong> Detta är inget verktyg för att flasha BIOS eller enheters firmware. Installerade paket för firmware eller CPU-mikrokod kan fortfarande uppdateras via apt."
+    ]
+  },
+  "troubleshooting": {
+    "heading": "Felsökning",
+    "items": [
+      {
+        "title": "apt update misslyckas med 401 Unauthorized",
+        "body": "Enterprise-förrådet är aktiverat utan ett aktivt abonnemang. Före <code>apt-get update</code> erbjuder arbetsskriptet ett byte till no-subscription. Om du avböjde kan du köra uppdateringen igen och acceptera, eller inaktivera Enterprise i <em>Node → Updates → Repositories</em> och aktivera no-subscription."
+      },
+      {
+        "title": "dist-upgrade fastnar vid \"Configuring grub-pc\"",
+        "body": "Om en interaktiv GRUB-fråga visas frågar den vilka enheter som ska få starthanteraren. Alternativet <code>--force-confold</code> gäller konfigurationsfiler, inte det här enhetsvalet. Välj lämpliga startdiskar med <kbd>Tab</kbd> + <kbd>Space</kbd> och sedan OK. Du kan konfigurera valet i förväg med <code>dpkg-reconfigure grub-pc</code>."
+      },
+      {
+        "title": "Kärnan har uppgraderats men nya moduler saknas för en extern drivrutin",
+        "body": "För hanterade drivrutiner (<code>nvidia_driver</code> och <code>coral_driver</code>) kör hjälpfunktionen <code>dkms autoinstall -k &lt;newkver&gt;</code> och kan försöka igen med deras installationsprogram och <code>--auto-reinstall</code>. Kontrollera resultatet med <code>dkms status</code>. Kommandot autoinstall kan också bygga om andra registrerade DKMS-moduler. Reservvägen via installationsprogram är begränsad till de hanterade posterna i <code>components_status.json</code>. Granska tredjepartsmoduler som fortfarande saknas och bygg om dem med <code>dkms autoinstall</code> vid behov."
+      },
+      {
+        "title": "Omstartsfrågan visades inte trots att en ny kärna installerades",
+        "body": "Signalerna är alternativ: <code>/var/run/reboot-required</code> eller en skillnad mellan den kärna som körs och den senaste installerade Proxmox-kärnan. Huvudskriptet tolkar inte linux-image-poster i apt-loggen. Kontrollera den aktuella versionen med <code>uname -r</code> och installerade kärnpaket med <code>dpkg-query</code>. Planera en nödvändig omstart eller kör <code>shutdown -r now</code> när du är redo."
+      }
+    ]
+  },
+  "files": {
+    "heading": "Filer involverade",
+    "code": "scripts/utilities/proxmox_update.sh              # this script (wrapper)\nscripts/global/update-pve-safe.sh                # single safe worker (PVE 8 + PVE 9)\nscripts/global/repository-functions.sh           # ensure_repositories\nscripts/global/repository_policy.py              # reads and switches repositories through the Proxmox API\nscripts/global/utils-install-functions.sh        # pmx_rebuild_dkms_after_kernel\n/usr/local/share/proxmenux/components_status.json # ProxMenux-managed DKMS driver registry\n/etc/apt/sources.list.d/proxmox.sources          # no-subscription source, written by Proxmox when the switch is accepted\n/var/run/reboot-required                         # read to decide on reboot prompt\n# Reboot fallback when needrestart isn't installed:\n# dpkg-query -W 'proxmox-kernel-*-pve-signed' 'pve-kernel-*-pve' vs. uname -r"
+  },
+  "related": {
+    "heading": "Relaterat",
+    "items": [
+      {
+        "href": "/docs/utils/upgrade-pve8-pve9",
+        "label": "Uppgradera PVE 8 till PVE 9",
+        "tail": " — för uppgraderingen av huvudversion med ett annat verktyg och en annan säkerhetsmodell."
+      },
+      {
+        "href": "/docs/utils/system-utils",
+        "label": "Installationsprogram för systemverktyg",
+        "tail": " — för att installera användbara CLI-verktyg för uppdateringar (htop / btop / ncdu)."
+      },
+      {
+        "href": "/docs/utils",
+        "label": "Verktygsöversikt",
+        "tail": " — tillbaka till avsnittsöversikten."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sv/docs/utils/system-utils.json b/web/messages/sv/docs/utils/system-utils.json
new file mode 100644
index 00000000..8c70bd88
--- /dev/null
+++ b/web/messages/sv/docs/utils/system-utils.json
@@ -0,0 +1,252 @@
+{
+  "meta": {
+    "title": "Installationsprogram för systemverktyg | ProxMenux-dokumentation",
+    "description": "Installationsprogram för CLI-verktyg i Proxmox VE, med 25 paket i den gemensamma listan (htop, btop, iperf3, tmux, ...). Eget urval, installation av allt och fördefinierade grupper (grundläggande, utveckling, komprimering, multiplexrar, analys, nätverk). Grupper kan innehålla fler paket. Använder ensure_repositories + install_single_package.",
+    "ogTitle": "Installationsprogram för systemverktyg | ProxMenux-dokumentation",
+    "ogDescription": "Installera utvalda CLI-verktyg i Proxmox VE med ett klick eller eget urval."
+  },
+  "header": {
+    "title": "Installationsprogram för systemverktyg",
+    "description": "Välj bland 25 CLI-verktyg i den gemensamma listan PROXMENUX_UTILS. Erbjuder eget urval, installation av allt, sex fördefinierade grupper och installationskontroll. Grupper kan innehålla verktyg utanför listan. De gemensamma funktionerna ensure_repositories() + install_single_package() ger enhetlig hantering av paketförråd och återkoppling per paket.",
+    "section": "Verktyg"
+  },
+  "info": {
+    "title": "Vad detta gör",
+    "body": "Installerar CLI-verktyg från en lista med 25 paket. Varje installation följer samma flöde: <code>ensure_repositories</code> kontrollerar att värden har ett användbart Proxmox-förråd för den aktuella PVE-huvudversionen; sedan installerar <code>install_single_package</code> paketet och kontrollerar att kommandot finns i PATH."
+  },
+  "opening": {
+    "heading": "Öppna installationsprogrammet",
+    "intro": "Från menyn Utilities väljer du <strong>System Utilities Installer</strong>. Huvudmenyn erbjuder nio alternativ:",
+    "imageAlt": "Menyn för installation av systemverktyg med eget urval, ALL, fördefinierade grupper och verifiering"
+  },
+  "actions": {
+    "heading": "Menyns 9 åtgärder",
+    "headerOption": "Alternativ",
+    "headerBehaviour": "Beteende",
+    "rows": [
+      {
+        "option": "1. Anpassat urval",
+        "behaviourRich": "Urvalslista med alla 25 paket. Använd SPACE för att markera och ENTER för att bekräfta; bara valda paket installeras."
+      },
+      {
+        "option": "2. Installera alla verktyg",
+        "behaviourRich": "Installerar alla paket i <code>PROXMENUX_UTILS</code> i ett steg. Använd efter en ny Proxmox-installation."
+      },
+      {
+        "option": "3. Grundläggande",
+        "behaviourRich": "<code>grc</code>, <code>htop</code>, <code>tree</code>, <code>curl</code>, <code>wget</code>"
+      },
+      {
+        "option": "4. Utveckling",
+        "behaviourRich": "<code>git</code>, <code>vim</code>, <code>nano</code>"
+      },
+      {
+        "option": "5. Kompression",
+        "behaviourRich": "<code>zip</code>, <code>unzip</code>, <code>rsync</code>"
+      },
+      {
+        "option": "6. Terminalmultiplexrar",
+        "behaviourRich": "<code>screen</code>, <code>tmux</code>"
+      },
+      {
+        "option": "7. Analys",
+        "behaviourRich": "<code>jq</code>, <code>ncdu</code>, <code>iotop</code>"
+      },
+      {
+        "option": "8. Nätverk",
+        "behaviourRich": "<code>iperf3</code>, <code>nethogs</code>, <code>nmap</code>, <code>tcpdump</code>, <code>lsof</code>"
+      },
+      {
+        "option": "9. Verifiera installationer",
+        "behaviourRich": "Går igenom varje post i <code>PROXMENUX_UTILS</code>, kontrollerar om verifieringskommandot finns i PATH och visar en sammanfattning med Tillgängligt / Saknas."
+      }
+    ]
+  },
+  "packages": {
+    "heading": "De 25 paketen",
+    "intro": "Definieras i den gemensamma filen <code>scripts/global/utils-install-functions.sh</code> som <code>PROXMENUX_UTILS</code> (format: <code>package:verify_command:description</code>). Andra ProxMenux-skript, till exempel de som startar iftop / iptraf-ng / iperf3, återanvänder posterna så att paket och verifieringskommandon hålls samordnade.",
+    "headerPackage": "Paket",
+    "headerVerify": "Verifieringskommando",
+    "headerDescription": "Beskrivning",
+    "rows": [
+      {
+        "package": "axel",
+        "verify": "axel",
+        "description": "Nedladdningsaccelerator"
+      },
+      {
+        "package": "aria2",
+        "verify": "aria2c",
+        "description": "Nedladdare med flera källor"
+      },
+      {
+        "package": "btop",
+        "verify": "btop",
+        "description": "Modern resursövervakning"
+      },
+      {
+        "package": "cabextract",
+        "verify": "cabextract",
+        "description": "Extrahera CAB filer"
+      },
+      {
+        "package": "chntpw",
+        "verify": "chntpw",
+        "description": "Redigera Windows-registret / lösenord"
+      },
+      {
+        "package": "dos2unix",
+        "verify": "dos2unix",
+        "description": "Konvertera DOS / Unix textfiler"
+      },
+      {
+        "package": "genisoimage",
+        "verify": "genisoimage",
+        "description": "Skapa ISO-bilder"
+      },
+      {
+        "package": "grc",
+        "verify": "grc",
+        "description": "Allmän färgmarkering av loggar"
+      },
+      {
+        "package": "htop",
+        "verify": "htop",
+        "description": "Interaktiv processvisare"
+      },
+      {
+        "package": "iftop",
+        "verify": "iftop",
+        "description": "Realtidsnätverksanvändning"
+      },
+      {
+        "package": "intel-gpu-tools",
+        "verify": "intel_gpu_top",
+        "description": "Intel GPU verktyg"
+      },
+      {
+        "package": "iotop",
+        "verify": "iotop",
+        "description": "Övervaka diskarnas in- och utmatning"
+      },
+      {
+        "package": "iperf3",
+        "verify": "iperf3",
+        "description": "Testning av nätverkets bandbredd"
+      },
+      {
+        "package": "ipset",
+        "verify": "ipset",
+        "description": "Hantera mängder av IP-adresser"
+      },
+      {
+        "package": "iptraf-ng",
+        "verify": "iptraf-ng",
+        "description": "Verktyg för nätverksövervakning"
+      },
+      {
+        "package": "libguestfs-tools",
+        "verify": "virt-filesystems",
+        "description": "Verktyg för VM-diskar"
+      },
+      {
+        "package": "msr-tools",
+        "verify": "rdmsr",
+        "description": "Åtkomst till processorns MSR-register"
+      },
+      {
+        "package": "net-tools",
+        "verify": "netstat",
+        "description": "Äldre nätverksverktyg"
+      },
+      {
+        "package": "plocate",
+        "verify": "locate",
+        "description": "Hitta filer snabbt"
+      },
+      {
+        "package": "s-tui",
+        "verify": "s-tui",
+        "description": "Stress-Terminal UI"
+      },
+      {
+        "package": "sshpass",
+        "verify": "sshpass",
+        "description": "Icke-interaktiv SSH inloggning"
+      },
+      {
+        "package": "tmux",
+        "verify": "tmux",
+        "description": "Terminalmultiplexer"
+      },
+      {
+        "package": "unzip",
+        "verify": "unzip",
+        "description": "Extrahera ZIP-filer"
+      },
+      {
+        "package": "wimtools",
+        "verify": "wimlib-imagex",
+        "description": "Hantera WIM-avbildningar"
+      },
+      {
+        "package": "zip",
+        "verify": "zip",
+        "description": "Skapa ZIP-filer"
+      }
+    ]
+  },
+  "howItWorks": {
+    "heading": "Så installeras ett enskilt paket",
+    "items": [
+      "<code>ensure_repositories</code> identifierar PVE 8 eller 9 och läser paketförråden via Proxmox API. Med ett användbart Proxmox-förråd ändras inget. En värd utan aktivt abonnemang som bara använder Enterprise måste bekräfta ett byte till no-subscription; <code>apt-get update</code> körs efter ett godkänt byte.",
+      "<code>install_single_package \"pkg\" \"verify_cmd\" \"description\"</code> kör <code>apt-get install -y \"$pkg\"</code> med feedback (<code>msg_info</code> / <code>msg_ok</code> / <code>msg_error</code>)."
+    ],
+    "verifyIntro": "Efter installationen kontrolleras verifieringskommandot med <code>command -v \"$verify_cmd\"</code>. Tre resultat:",
+    "verifyOutcomes": [
+      "<strong>0 (lyckat):</strong> kommandot finns tillgängligt och paketet räknas som <em>Lyckat</em>.",
+      "<strong>1 (misslyckat):</strong> apt misslyckades och paketet räknas som <em>Misslyckat</em>.",
+      "<strong>2 (varning):</strong> apt lyckades men det förväntade kommandot hittades inte i PATH; paketet räknas som <em>Med varningar</em>."
+    ],
+    "summary": "Efter en gruppinstallation eller ett eget urval visar en dialog antalet <em>Lyckade / Med varningar / Misslyckade</em>."
+  },
+  "verify": {
+    "heading": "Verifiera installationer",
+    "intro": "Alternativ 9 är skrivskyddat: det går igenom <code>PROXMENUX_UTILS</code> och kör <code>command -v</code> för varje verifieringskommando. Utdata ser ut så här:",
+    "code": "Total: 25\nAvailable: 18\nMissing: 8\n\n✓ axel - Download accelerator\n✓ aria2c - Multi-source downloader\n✓ btop - Modern resource monitor\n✗ cabextract - Extract CAB files\n✓ dos2unix - Convert DOS / Unix text files\n✗ genisoimage - Create ISO images\n✓ grc - Generic log colorizer\n...",
+    "outro": "Användbart innan du kör skript som behöver verktygen. Till exempel kräver <code>uup_dump_iso_creator.sh</code> kommandona <code>aria2c</code> + <code>cabextract</code> + <code>wimlib-imagex</code>. Om något saknas kan du installera motsvarande grupp eller välja de saknade paketen själv."
+  },
+  "troubleshoot": {
+    "heading": "Felsökning",
+    "reposTitle": "”Kunde inte konfigurera paketförråden. Installationen avbröts.”",
+    "reposBody": "Kontrollen av paketförråd misslyckades: bytet till no-subscription avböjdes, abonnemangsstatusen kunde inte läsas eller en post kräver åtgärd. Föregående meddelande anger orsaken. Förråden visas i <em>Node → Updates → Repositories</em>; <code>apt-get update</code> i en konsol visar apt-felet.",
+    "warningsTitle": "Ett paket rapporteras \"Med varningar\" men kommandot fungerar när jag stänger menyn",
+    "warningsBody": "Efter <code>apt-get install</code> kör hjälpfunktionen <code>hash -r</code>, väntar kort och kontrollerar det förväntade kommandot med <code>command -v</code>. En varning betyder att kontrollen fortfarande misslyckades, utan att ange orsaken. Prova ett nytt skal och kontrollera paketinstallationen och PATH om kommandot fortfarande saknas.",
+    "hangsTitle": "En apt-installation fastnar",
+    "hangsBody": "En debconf-fråga är sannolikt dold av den tysta utmatningen. Skriptet använder <code>DEBIAN_FRONTEND=noninteractive</code> vid apt-anrop, vilket vanligen undviker frågor, men vissa paket kräver ändå inmatning. Avbryt med <kbd>Ctrl</kbd>+<kbd>C</kbd> och kör <code>apt-get install -y &lt;pkg&gt;</code> manuellt i ett skal för att se frågan och välja åtgärd."
+  },
+  "files": {
+    "heading": "Filer involverade",
+    "code": "scripts/utilities/system_utils.sh                    # this script\nscripts/global/utils-install-functions.sh            # PROXMENUX_UTILS, install_single_package\nscripts/global/repository-functions.sh               # ensure_repositories\nscripts/global/repository_policy.py                  # reads and switches repositories through the Proxmox API\n/etc/apt/sources.list.d/proxmox.sources              # no-subscription source, written by Proxmox when the switch is accepted"
+  },
+  "related": {
+    "heading": "Relaterat",
+    "items": [
+      {
+        "href": "/docs/utils/system-update",
+        "label": "Proxmox systemuppdatering",
+        "tailRich": " — för den faktiska <code>apt dist-upgrade</code> på värden."
+      },
+      {
+        "href": "/docs/network/monitoring",
+        "label": "Verktyg för liveövervakning (nätverk)",
+        "tailRich": " - använder iftop / iptraf-ng / iperf3 från samma lista."
+      },
+      {
+        "href": "/docs/utils",
+        "label": "Verktygsöversikt",
+        "tailRich": " — tillbaka till avsnittsöversikten."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sv/docs/utils/upgrade-pve8-pve9.json b/web/messages/sv/docs/utils/upgrade-pve8-pve9.json
new file mode 100644
index 00000000..51b7ccb7
--- /dev/null
+++ b/web/messages/sv/docs/utils/upgrade-pve8-pve9.json
@@ -0,0 +1,335 @@
+{
+  "meta": {
+    "title": "Uppgradera PVE 8 till PVE 9 | ProxMenux-dokumentation",
+    "description": "Tre sätt att uppgradera Proxmox VE 8 till 9 (Debian Bookworm till Trixie och PVE 8 till 9): automatiskt, interaktivt eller manuellt enligt Proxmox officiella anvisningar. Kontroller med pve8to9, ändrade paketkällor, dist-upgrade och slutkontroll. Körning från webbterminalen blockeras.",
+    "ogTitle": "Uppgradera PVE 8 till PVE 9 | ProxMenux-dokumentation",
+    "ogDescription": "Tre metoder (automatisk, interaktiv och manuell) för att uppgradera Proxmox VE 8 till 9."
+  },
+  "header": {
+    "title": "Uppgradera PVE 8 till PVE 9",
+    "description": "Uppgraderar Proxmox VE 8 till 9 enligt de officiella anvisningarna: Debian Bookworm till Trixie och PVE 8 till 9. Välj automatisk, interaktiv eller manuell metod, eller en separat förkontroll. Webbterminalen blockeras eftersom en bruten anslutning under uppgraderingen kan göra värden obrukbar.",
+    "section": "Verktyg"
+  },
+  "dangerCallout": {
+    "title": "En uppgradering till en ny huvudversion kan inte ångras",
+    "intro": "Åtgärden ersätter Debian-basen (Bookworm → Trixie) och Proxmox-komponenterna på det befintliga systemet. Det finns <strong>ingen återgång till den gamla versionen</strong>. Innan du börjar:",
+    "items": [
+      "<strong>Verifierade säkerhetskopior</strong> av varje VM och CT (PBS, vzdump, ZFS-ögonblicksbilder — kontrollera även att de går att återställa).",
+      "<strong>Åtkomst via konsol / IPMI / iKVM</strong> till värden om SSH kopplas ned under uppgraderingen.",
+      "Värden ska redan vara uppdaterad till aktuell PVE 8.4.x, vilket skriptet kontrollerar.",
+      "Ceph (om den finns) på version 19.x Squid.",
+      "Minst <strong>5 GB ledigt</strong> i rotfilsystemet."
+    ]
+  },
+  "modeMenu": {
+    "heading": "Menyn för val av läge",
+    "intro": "Alternativet öppnar en meny med fyra val: Automatiskt, Interaktivt, Förkontroll och Manuell guide. Tre alternativ <em>utför</em> uppgraderingen eller visar hur den görs; den separata kontrollen <em>verifierar</em> förutsättningarna och kan erbjuda reparationer.",
+    "imageAlt": "Meny för uppgradering av PVE 8 till 9 med automatiskt och interaktivt läge, förkontroll och manuell guide"
+  },
+  "threeWays": {
+    "heading": "Tre sätt att uppgradera",
+    "intro": "Automatiskt och interaktivt läge följer samma förlopp med förkontroller och slutkontroll. Skillnaden är hur dpkg-frågor under <code>dist-upgrade</code> besvaras. Den manuella guiden visar kommandona inklusive kontrollerna; du ansvarar för att utföra varje steg.",
+    "auto": {
+      "title": "Automatiskt / Utan tillsyn",
+      "summary": "Anger <code>ASSUME_YES=1</code> + <code>DEBIAN_FRONTEND=noninteractive</code>. För ändrade konfigurationsfiler använder dpkg sin standardåtgärd om den finns; annars <strong>behålls den befintliga filen</strong> (<code>--force-confold</code>).",
+      "items": [
+        "Snabbast — inga dpkg-frågor under uppgraderingen",
+        "Passar standardinstallationer utan anpassade konfigurationsfiler",
+        "Risk: en anpassad konfiguration behålls utan fråga och kan dölja nya standardvärden"
+      ]
+    },
+    "interactive": {
+      "title": "Interaktiv",
+      "summary": "Samma förlopp, men du besvarar varje dpkg-fråga om konfigurationskonflikter. Långsammare, med full insyn.",
+      "items": [
+        "Du ser varje konfig konflikt och bestämmer",
+        "Bäst när du har anpassat <code>/etc/lvm</code>, <code>/etc/ssh</code>, etc.",
+        "Rådfråga tabellen rekommenderade svar i manuell procedur nedan"
+      ]
+    },
+    "manual": {
+      "title": "Manuell uppgraderingsguide",
+      "summary": "Visar det officiella Proxmox-förfarandet i 17 steg utan att köra det. Kör kommandona själv i ett separat skal.",
+      "items": [
+        "Maximal kontroll - du skriver varje kommando",
+        "Bäst när du vill lära dig förfarandet eller du litar på ingenting",
+        "Skriptet visar stegen; ingenting utförs automatiskt"
+      ]
+    }
+  },
+  "precheckCallout": {
+    "title": "Plus en separat Pre-check",
+    "body": "Alternativ 3 — <strong>Kör kontroll för PVE 8 till 9</strong> — kör Proxmox officiella <code>pve8to9 --full</code>, erbjuder guidade reparationer för vanliga problem och <strong>avslutas sedan</strong>. Använd det före uppgraderingen eller efter manuella reparationer. Automatiskt och interaktivt läge kör också kontrollen; den manuella guiden säger åt dig att köra den själv."
+  },
+  "webTerminal": {
+    "heading": "Varför webbterminalen blockeras",
+    "body": "Alla tre lägen upptäcker <code>termproxy</code> / <code>vncshell</code> i kedjan av överordnade processer och vägrar starta. Webbterminalen beror på <code>pveproxy</code>, en tjänst som uppdateras under förloppet. När <code>pveproxy</code> startas om avslutas terminalsessionen och skriptet i den. Värden kan då bli endast delvis uppgraderad.",
+    "warningTitle": "Använd SSH eller fysisk konsol / IPMI / iKVM",
+    "warningBody": "SSH är det vanligaste valet. Kör det i <code>tmux</code> eller <code>screen</code> så att uppgraderingen klarar korta nätavbrott. Om skriptet upptäcker ett vanligt SSH-skal visas först en påminnelse om tmux/screen."
+  },
+  "auto": {
+    "heading": "Automatiskt läge / Utan tillsyn",
+    "intro": "Frågor om paket och konfigurationsfiler använder standardvärdena i tabellen nedan, och ett 401 från Enterprise-källan byter till no-subscription utan att fråga. Bekräftelsen av uppgraderingen, sammanfattningen av PVE 8-uppdateringen, reparationer från förkontrollen och frågan om omstart visas fortfarande.",
+    "behaviourHeading": "Beteende i automatiskt läge",
+    "behaviourTable": {
+      "settingHeader": "Inställning",
+      "effectHeader": "Effekt",
+      "rows": [
+        {
+          "settingRich": "<code>ASSUME_YES=1</code>",
+          "effectRich": "Intern inställning — skriptet svarar själv ja på sina egna frågor, till exempel bytet till no-subscription efter ett 401"
+        },
+        {
+          "settingRich": "<code>DEBIAN_FRONTEND=noninteractive</code>",
+          "effectRich": "apt / dpkg körs utan debconf-frågor"
+        },
+        {
+          "settingRich": "<code>--force-confdef</code>",
+          "effectRich": "För orörda konfigfiler: installera underhållarens nya version"
+        },
+        {
+          "settingRich": "<code>--force-confold</code>",
+          "effectRich": "För ändrade filer: dpkg:s standardåtgärd om den finns; annars <strong>behåll din version</strong>."
+        }
+      ]
+    },
+    "flowHeading": "Förlopp i automatiskt läge",
+    "flowIntro": "Sex faser i följd. Fas 2 uppdaterar PVE 8-paketen och fas 3 skriver konfigurationen för PVE 9-paketkällorna. Ett fel stoppar förloppet men återställer inte ändringarna; om PVE 8-uppdateringen misslyckas eller avbryts lämnas paketkällorna orörda. Fas 5 kör <code>dist-upgrade</code> till PVE 9.",
+    "flowDiagram": "1. KONTROLLER\nBlockera termproxy / vncshell; bekräfta uppgraderingen; avvisa PVE 9.\n\n2. FÖRBERED PVE 8\nscripts/global/update-pve8.sh\nUppdatera PVE 8-paket; stoppa om uppdateringen misslyckas eller avbryts.\npve8to9 --full (kan erbjuda reparationer).\nKontrollera utrymme och anslutning; Ceph 19.x Squid på hyperkonvergerade noder.\n\n3. ÄNDRA PAKETKÄLLOR\nBookworm → Trixie; skriv deb822-filer .sources.\nKommentera bort gamla .list-filer; apt-get update.\n\n4. KONTROLLERA PVE 9-KANDIDATEN\napt-cache policy proxmox-ve\napt-get -s dist-upgrade\nStoppa om kandidaten inte är 9.x eller om proxmox-ve skulle tas bort.\n\n5. UPPGRADERA\napt-get -y -o Dpkg::Options::='--force-confdef' -o Dpkg::Options::='--force-confold' dist-upgrade\nUtan prenumeration: inaktivera pve-enterprise.sources.\nLogg: /var/log/pve8-a-pve9-'<'timestamp'>'.log\n\n6. KONTROLLERA OCH STARTA OM\nEFI: apt install grub-efi-amd64\npve8to9 --full; granska resultatet och frågan om omstart.",
+    "preflightHeading": "Förkontroll: vad som kontrolleras",
+    "preflightTable": {
+      "checkHeader": "Kontroll",
+      "whyHeader": "Varför det spelar roll",
+      "rows": [
+        {
+          "checkRich": "<strong>Webbterminalblock</strong>",
+          "whyRich": "Förhindrar att uppgraderingen avslutar skalet som kör den"
+        },
+        {
+          "checkRich": "<strong> Redan på 9.x</strong>",
+          "whyRich": "Avslutas om värden redan kör PVE 9 — inget behöver göras"
+        },
+        {
+          "checkRich": "<strong>Senaste versionen av PVE 8.4.x</strong>",
+          "whyRich": "Uppdaterar först PVE 8 till senaste korrigeringsnivån med PVE 8-skriptet; gamla 8.x-versioner har andra förutsättningar"
+        },
+        {
+          "checkRich": "<strong>pve8to9 --full</strong>",
+          "whyRich": "Proxmox egen kontroll av uppgraderingskraven; FAIL-fel blockerar uppgraderingen tills de åtgärdats"
+        },
+        {
+          "checkRich": "<strong>Diskutrymme</strong>",
+          "whyRich": "≥ 1024 MB ledigt i <code>/var/cache/apt/archives</code> för hämtade .deb-filer"
+        },
+        {
+          "checkRich": "<strong>Anslutning</strong>",
+          "whyRich": "Ping till <code>download.proxmox.com</code> — om det misslyckas startar inte uppgraderingen"
+        },
+        {
+          "checkRich": "<strong>Ceph 19.x Squid</strong>",
+          "whyRich": "Installerat Ceph måste redan vara 19.x. PVE 9 fungerar inte med Ceph 17/18. Alternativen <code>--ignore-ceph-check</code> och <code>--warn-ceph-check</code> kringgår kontrollen; använd dem endast om du förstår följderna."
+        }
+      ]
+    },
+    "distUpgradeHeading": "Kommandot dist-upgrade (automatiskt läge)",
+    "distUpgradeCode": "apt-get -y \\\n    -o Dpkg::Options::='--force-confdef' \\\n    -o Dpkg::Options::='--force-confold' \\\n    dist-upgrade",
+    "distUpgradeOutro": "Utdata visas i realtid på stdout och sparas även i <code>/var/log/pve8-a-pve9-&lt;timestamp&gt;.log</code>. Allt är synligt; endast frågorna hoppas över.",
+    "postHeading": "Åtgärder efter uppgraderingen (automatiskt läge)",
+    "postItems": [
+      "<strong>EFI-värdar:</strong> installerar <code>grub-efi-amd64</code> enligt det kända problemet i Proxmox dokumentation. Uppgraderingen installerar inte paketet automatiskt och det kan behövas vid nästa start.",
+      "<strong>Enterprise-källa utan prenumeration.</strong> pve-manager 9 lägger till <code>pve-enterprise.sources</code> under uppgraderingen; i no-subscription-läget sätter skriptet den till <code>Enabled: false</code>.",
+      "<strong>Kör <code>pve8to9 --full</code> igen.</strong> Visar kvarstående problem. Vid FAIL-fel visas samma reparationsmeny som under förkontrollen.",
+      "<strong>Fråga om omstart.</strong> Omstart rekommenderas för att läsa in den nya kärnan och tjänsterna. Avböj endast av ett konkret skäl: det innebär risker att använda den gamla kärnan efter ett huvudversionsbyte."
+    ]
+  },
+  "interactive": {
+    "heading": "Interaktivt läge",
+    "intro": "Samma förlopp som <autolink>automatiskt läge</autolink>: samma förkontroller, ändrade paketkällor och slutkontroll. Skillnaden gäller <code>dist-upgrade</code>: <strong>du besvarar själv varje dpkg-fråga om konfigurationskonflikter</strong>. ProxMenux kör <code>apt-get dist-upgrade</code> utan alternativen <code>--force-conf*</code>.",
+    "distUpgradeHeading": "kommandot för dist-upgrade (interaktivt läge)",
+    "distUpgradeCode": "apt-get dist-upgrade\n# (user answers each dpkg config-file conflict prompt as it appears)",
+    "whenHeading": "När interaktivt är rätt val",
+    "whenItems": [
+      "Du har anpassat <code>/etc/lvm/lvm.conf</code>, <code>/etc/ssh/sshd_config</code>, <code>/etc/default/grub</code> eller någon annan konfigfil som blir rörd av uppgraderingen.",
+      "Du vill se vilka paket som orsakar konflikter och fatta beslut för varje fil.",
+      "Du uppgraderar en produktionsvärd där någon dold förändring är oacceptabel."
+    ],
+    "promptCalloutTitle": "Vad du ska svara på varje fråga",
+    "promptCalloutBody": "Samma rekommendationer gäller som för det manuella förfarandet: se <dpkglink>Rekommenderade svar på dpkg-frågor</dpkglink> nedan. Ange <strong>D</strong> för att se skillnaderna eller <strong>Z</strong> för att öppna ett skal."
+  },
+  "manual": {
+    "heading": "Manuellt uppgraderingsförfarande",
+    "intro": "Detta visar menyalternativet <strong>Manuell uppgraderingsguide</strong>: <wikilink>Proxmox officiella wiki för uppgradering från 8 till 9</wikilink>, uppdelad i fyra faser. Skriptet <em>visar</em> kommandona; du kör dem själv i ett separat root-skal. Varje steg är synligt.",
+    "rootCalloutTitle": "Alla kommandon kräver root",
+    "rootCalloutBody": "Använd ett root-skal för kommandona, även för omdirigeringar och here-dokument. Med <code>sudo</code> måste hela kommandot köras med root-behörighet.",
+    "phase1Heading": "Fas 1 - Förberedelse",
+    "phase1Intro": "Uppdatera värden till senaste PVE 8.4.x, verifiera version och Ceph om det används, kör Proxmox förkontroll och starta en terminalmultiplexer för att klara avbrutna anslutningar.",
+    "phase1Code": "# Step 1 — Update PVE 8 to the latest 8.4+\napt update && apt dist-upgrade -y\n\n# Step 2 — Verify version (must be 8.4.1 or newer)\npveversion\n\n# Step 2.1 — Hyper-converged Ceph: must already be on 19.x Squid\nceph --version\n# If older, follow https://pve.proxmox.com/wiki/Ceph_Reef_to_Squid\n\n# Step 3 — Run the official upgrade-readiness check\npve8to9 --full\n# If it warns about systemd-boot meta-package, remove it:\n#   apt remove systemd-boot\n\n# Step 4 — Start tmux or screen (so SSH disconnect doesn't kill the upgrade)\ntmux new-session -s upgrade\n# or\nscreen -S upgrade",
+    "phase2Heading": "Fas 2 — Ändra paketkällor",
+    "phase2Intro": "Byt från Bookworm till Trixie i alla Debian- och Proxmox-paketkällor och konvertera Proxmox-källorna till deb822. <strong>Välj steg 7 ELLER 8</strong> beroende på Enterprise-abonnemang. Hoppa över steg 9 om du inte använder Ceph.",
+    "phase2Code": "# Step 5 — Debian: bookworm → trixie\nsed -i 's/bookworm/trixie/g' /etc/apt/sources.list\n\n# Step 6 — Same for the legacy enterprise list (only if you use enterprise)\nsed -i 's/bookworm/trixie/g' /etc/apt/sources.list.d/pve-enterprise.list\n\n# Step 7 — Add the new PVE 9 enterprise repo (deb822) — Enterprise users only\ncat > /etc/apt/sources.list.d/pve-enterprise.sources << EOF\nTypes: deb\nURIs: https://enterprise.proxmox.com/debian/pve\nSuites: trixie\nComponents: pve-enterprise\nSigned-By: /usr/share/keyrings/proxmox-archive-keyring.gpg\nEOF\n\n# Step 8 — OR add the no-subscription repo (most home / lab users)\ncat > /etc/apt/sources.list.d/proxmox.sources << EOF\nTypes: deb\nURIs: http://download.proxmox.com/debian/pve\nSuites: trixie\nComponents: pve-no-subscription\nSigned-By: /usr/share/keyrings/proxmox-archive-keyring.gpg\nEOF\n\n# Step 8.1 — Refresh and verify proxmox-ve candidate is 9.x\napt update && apt policy | sed -n '1,120p'\n\n# Step 9 — Update Ceph repo (only if you run Ceph)\ncat > /etc/apt/sources.list.d/ceph.sources << EOF\nTypes: deb\nURIs: http://download.proxmox.com/debian/ceph-squid\nSuites: trixie\nComponents: no-subscription\nSigned-By: /usr/share/keyrings/proxmox-archive-keyring.gpg\nEOF\n\n# Step 10 — Remove old .list files now superseded by deb822 .sources\nrm -f /etc/apt/sources.list.d/pve-enterprise.list /etc/apt/sources.list.d/ceph.list\n\n# Step 11 — Final apt update\napt update",
+    "phase3Heading": "Fas 3 — dist-upgrade",
+    "phase3Intro": "Själva uppgraderingen. Steg 12 är valfritt men rekommenderas för att minska audit-meddelanden. Steg 13 tar längre tid: besvara dpkg-frågorna enligt tabellen. Steg 13.1 gäller endast EFI och följer de officiellt kända problemen.",
+    "phase3Code": "# Step 12 — Disable kernel audit messages (optional)\nsystemctl disable --now systemd-journald-audit.socket\n\n# Step 13 — The main upgrade (this takes a while)\napt dist-upgrade\n# (answer prompts using the table below)\n\n# Step 13.1 — EFI hosts: install grub for EFI (per known issues)\n[ -d /sys/firmware/efi ] && apt install grub-efi-amd64",
+    "dpkgHeading": "Rekommenderade svar för dpkg-prompts",
+    "dpkgIntro": "Rekommendationer från Proxmox: <strong>Y</strong> installerar paketunderhållarens nya fil och skriver över din; <strong>N</strong> behåller din befintliga fil. Granska skillnaderna först om du är osäker:",
+    "dpkgTable": {
+      "fileHeader": "Fil / prompt",
+      "answerHeader": "Rekommenderat svar",
+      "whyHeader": "Varför",
+      "rows": [
+        {
+          "fileRich": "/etc/issue",
+          "answerRich": "<strong>N</strong> (behåll befintlig fil)",
+          "whyRich": "Banner du är van vid att se",
+          "fileFont": true
+        },
+        {
+          "fileRich": "/etc/lvm/lvm.conf",
+          "answerRich": "<strong>Y</strong> (paketunderhållarens version)",
+          "whyRich": "PVE 9 behöver de nya LVM-standardvärdena",
+          "fileFont": true
+        },
+        {
+          "fileRich": "/etc/ssh/sshd_config",
+          "answerRich": "<strong>Y</strong> om endast standardändringar finns; granska anpassade filer först",
+          "whyRich": "Granska lokala SSH-inställningar och säkerställ åtkomsten innan filen ersätts. Standardändringarna omfattar omdöpta alternativ och kommentarer.",
+          "fileFont": true
+        },
+        {
+          "fileRich": "/etc/default/grub",
+          "answerRich": "<strong>N</strong> om anpassad",
+          "whyRich": "Här finns startparametrar, till exempel IOMMU och PCI-genomkoppling",
+          "fileFont": true
+        },
+        {
+          "fileRich": "/etc/chrony/chrony.conf",
+          "answerRich": "<strong>Y</strong> om oförändrad; bevara lokala inställningar först",
+          "whyRich": "Trixie uppdaterar standardvärdena för tidssynkronisering. Flytta lokala inställningar till chronys conf.d / sources.d innan den nya filen godtas.",
+          "fileFont": true
+        },
+        {
+          "fileRich": "Omstart av tjänster under uppgraderingen",
+          "answerRich": "<strong>Ja</strong> (standard)",
+          "whyRich": "Startar om de flesta tjänster utan att starta om värden",
+          "fileFont": false
+        },
+        {
+          "fileRich": "<code>apt-listchanges</code>",
+          "answerRich": "Tryck på <kbd>q</kbd>",
+          "whyRich": "Avslutar endast textvisaren; informationen är en sammanfattning av ändringsloggen",
+          "fileFont": false
+        }
+      ]
+    },
+    "inspectCalloutTitle": "Inspektera en specifik dpkg-konflikt",
+    "inspectCalloutBody": "Vid en dpkg-fråga om konfigurationsfiler visar <strong>D</strong> skillnaderna mellan din fil och den nya versionen; <strong>Z</strong> öppnar ett skal för närmare granskning. Då kan du fatta ett underbyggt beslut.",
+    "phase4Heading": "Fas 4 - Post-upgrade",
+    "phase4Intro": "Verifiera att uppgraderingen slutförts, starta om med PVE 9-kärnan och kontrollera versionen. Därefter kan kvarvarande gamla <code>.list</code>-filer konverteras till deb822.",
+    "phase4Code": "# Step 14 — Re-run the readiness check (should be much cleaner now)\npve8to9 --full\n\n# Step 15 — Reboot to load the new kernel and PVE 9 daemons\nreboot\n\n# Step 16 — After reboot, confirm PVE 9.x\npveversion\n# Should show pve-manager/9.x.x\n\n# Step 17 — Optional: modernise the remaining legacy .list files to deb822\napt modernize-sources\n# (keeps .list backups as .bak)"
+  },
+  "clusterCeph": {
+    "heading": "Kluster och Ceph",
+    "clusterCalloutTitle": "Cluster: uppgradera noder en i taget",
+    "clusterCalloutBody": "Identifieras med <code>pvecm status</code>. <strong>Uppgradera inte</strong> flera noder samtidigt. Flytta gästerna, uppgradera noden, starta om och verifiera klustermedlemskapet innan du fortsätter. Under uppgraderingen fungerar livemigrering från äldre till nyare PVE-versioner; motsatt riktning stöds normalt inte. HA-grupper omvandlas automatiskt till HA-regler när alla noder kör PVE 9.",
+    "cephCalloutTitle": "Ceph: uppgradera Ceph FÖRST, sedan Proxmox",
+    "cephCalloutBody": "Ceph måste redan köra 19.x Squid före Proxmox-uppgraderingen. Följ den officiella ordningen Quincy 17 → Reef 18 → Squid 19: uppdatera paket och starta om Ceph-demoner stegvis i dokumenterad ordning. Kontrollera <code>ceph --version</code> före varje Proxmox-nod. Fullständigt förfarande: <cephlink>wikin för uppgradering av Ceph Reef till Squid</cephlink>."
+  },
+  "troubleshooting": {
+    "heading": "Felsökning",
+    "items": [
+      {
+        "title": "Skriptet avbryts: \"This script cannot be executed from the Proxmox web terminal\"",
+        "bodyRich": "Öppna en SSH-anslutning eller använd konsol / IPMI / iKVM och kör igen. Starta först <code>tmux new -s pveupgrade</code> för att klara korta nätavbrott."
+      },
+      {
+        "title": "pve8to9 rapporterar FAIL och reparationsalternativ 1 ger \"command not found\"",
+        "bodyRich": "Om felet nämner <code>configure_repositories</code> är skriptkopian gammal: aktuell reparation använder cleanup_duplicate_repos och ensure_repositories. Uppdatera kopian eller granska de manuella kommandona med alternativ 2. <code>apt-get update</code> uppdaterar paketlistor men löser inte alla blockerande kontroller."
+      },
+      {
+        "title": "apt-simuleringen varnar för \"proxmox-ve will be REMOVED\"",
+        "bodyRich": "De nya paketkällorna är oåtkomliga eller kodnamnet har inte ändrats. Kontrollera <code>cat /etc/apt/sources.list.d/proxmox.sources</code>: raden <code>Suites:</code> ska ange <code>trixie</code> i stället för <code>bookworm</code>. <code>apt-cache policy proxmox-ve</code> ska visa en 9.x-kandidat från den nya källan."
+      },
+      {
+        "title": "dist-upgrade misslyckas under körningen",
+        "bodyRich": "Kör <code>apt-get -f install</code> för att lösa brutna beroenden, kör sedan om uppgraderingen. Om det misslyckas, kolla in loggen på <code>/var/log/pve8-a-pve9-&lt;timestamp&gt;.log</code> - de sista raderna brukar ange det förolämpande paketet. Starta inte om förrän <code>dpkg -l | grep ^iU</code> returnerar tomma (inga halvinstallerade paket)."
+      },
+      {
+        "title": "EFI värd kommer inte starta efter omstart",
+        "bodyRich": "Installationen av <code>grub-efi-amd64</code> efter uppgraderingen hanterar detta. Om steget hoppades över eller misslyckades, starta Proxmox-ISO:n i räddningsläge, montera rotfilsystemet, använd chroot och kör <code>apt-get install grub-efi-amd64 &amp;&amp; update-grub</code>."
+      },
+      {
+        "title": "GUI laddas inte efter uppgradering",
+        "bodyRich": "Kör <code>systemctl status pveproxy</code> och <code>systemctl restart pveproxy</code>. Om problemet kvarstår, leta efter felet med <code>journalctl -u pveproxy -b</code>."
+      },
+      {
+        "title": "Nätverk fungerar inte efter omstart",
+        "bodyRich": "Kontrollera att <code>/etc/network/interfaces</code> anger befintliga enheter och att <code>ifupdown2</code> är installerat: <code>apt install ifupdown2</code>. Om namnen ändrats, se <netlink>Beständiga gränssnittsnamn</netlink>."
+      },
+      {
+        "title": "Cluster split-brain efter att ha uppgraderat en nod",
+        "bodyRich": "Blandade PVE 8 / PVE 9-kluster stöds under uppgraderingen. Livemigrering från äldre till nyare versioner fungerar; motsatt riktning stöds normalt inte. Om noden visas som frånkopplad, kontrollera <code>corosync</code> och QDevice-/nätverkskonfigurationen. Kör <code>pvecm status</code> på varje nod för att bekräfta kvorum."
+      }
+    ]
+  },
+  "files": {
+    "heading": "Filer involverade",
+    "code": "scripts/utilities/upgrade_pve8_to_pve9.sh                         # main upgrade orchestrator\nscripts/utilities/pve8to9_check.sh                                # pre-check (separate menu option)\nscripts/utilities/proxmox-upgrade-pve8-to-pve9-manual-guide.sh    # 17-step runbook\nscripts/global/update-pve8.sh                                     # PVE 8 worker (final patches)\n/etc/apt/sources.list                                             # bookworm → trixie sed\n/etc/apt/sources.list.d/proxmox.sources                           # created (deb822 PVE 9)\n/etc/apt/sources.list.d/debian.sources                            # created (deb822 trixie)\n/etc/apt/sources.list.d/ceph.sources                              # created if Ceph\n/etc/apt/sources.list.d/*.list                                    # legacy files commented out / removed\n/var/log/pve8-a-pve9-'<'timestamp'>'.log                              # full upgrade log"
+  },
+  "references": {
+    "heading": "Officiella referenser",
+    "intro": "Skriptets manuella förfarande följer dessa officiella källor. Vid osäkerhet under en uppgradering gäller den officiella wikin: ProxMenux hjälper dig att utföra stegen, men Proxmox är referensen.",
+    "items": [
+      {
+        "href": "https://pve.proxmox.com/wiki/Upgrade_from_8_to_9",
+        "title": "Uppgradera från 8 till 9",
+        "desc": "Den viktigaste Proxmox wiki sida för 8 → 9 uppgradering. Sanningens källa för varje kommando i det manuella förfarandet ovan."
+      },
+      {
+        "href": "https://pve.proxmox.com/wiki/Ceph_Reef_to_Squid",
+        "title": "Uppgradering till Ceph Squid (19.x)",
+        "desc": "Obligatoriskt förberedande steg för hyperkonvergerade Ceph-noder. Ceph måste köra 19.x Squid före PVE 9."
+      },
+      {
+        "href": "https://pve.proxmox.com/wiki/Roadmap",
+        "title": "Utvecklingsplan för Proxmox VE",
+        "desc": "Versionsinformation för PVE 9 och ändringar sedan 8.x — läs före uppgraderingen."
+      },
+      {
+        "href": "https://www.debian.org/releases/trixie/releasenotes",
+        "title": "Versionsinformation för Debian Trixie",
+        "desc": "PVE 9 bygger på Debian Trixie. Debians versionsinformation beskriver ändringar i operativsystemet som även påverkar din värd."
+      },
+      {
+        "href": "https://forum.proxmox.com/forums/proxmox-ve-installation-and-configuration.16/",
+        "title": "Proxmox VE installationsforum",
+        "desc": "Om något går fel under uppgraderingen, sök först i forumet. Någon kan redan ha stött på samma problem."
+      },
+      {
+        "href": "https://pve.proxmox.com/wiki/Backup_and_Restore",
+        "title": "Säkerhetskopiering och återställning",
+        "desc": "En storversionsuppgradering är inte reversibel. Kontrollera din backup disciplin innan du börjar."
+      }
+    ]
+  },
+  "video": {
+    "heading": "Videoguide",
+    "intro": "Föredrar att titta på uppgraderingen kör slut innan du gör det själv? Denna genomgång visar ProxMenux uppgraderingsflöde i realtid.",
+    "title": "ProxMenux — Videoguide för att uppgradera Proxmox VE 8 till 9",
+    "caption": "Extern YouTube-video. Spelas i utökat integritetsläge, utan cookies tills du startar videon."
+  },
+  "related": {
+    "heading": "Relaterat",
+    "items": [
+      {
+        "href": "/docs/utils/system-update",
+        "label": "Proxmox systemuppdatering",
+        "tail": " — för vanliga uppdateringar inom samma huvudversion (8.4.1 → 8.4.5 osv.)."
+      },
+      {
+        "href": "/docs/utils",
+        "label": "Verktygsöversikt",
+        "tail": " — tillbaka till avsnittets översikt."
+      }
+    ]
+  }
+}
diff --git a/web/messages/sv/docs/utils/uup-dump-iso-creator.json b/web/messages/sv/docs/utils/uup-dump-iso-creator.json
new file mode 100644
index 00000000..f4abef92
--- /dev/null
+++ b/web/messages/sv/docs/utils/uup-dump-iso-creator.json
@@ -0,0 +1,161 @@
+{
+  "meta": {
+    "title": "UUP Dump ISO-skapare | ProxMenux-dokumentation",
+    "description": "Skapa en aktuell Windows-installations-ISO på Proxmox-värden med ProxMenux UUP Dump ISO-skapare. Automatiserar installation av beroenden, nedladdning och konvertering av UUP-filer till en startbar ISO för att skapa en VM.",
+    "ogTitle": "UUP Dump ISO-skapare | ProxMenux-dokumentation",
+    "ogDescription": "Skapa en aktuell Windows-ISO med UUP Dump och ProxMenux. Beroenden, nedladdning och konvertering hanteras helt automatiskt.",
+    "ogImageAlt": "ProxMenux — UUP Dump ISO-skapare"
+  },
+  "header": {
+    "title": "UUP Dump ISO-skapare",
+    "description": "Skapa en aktuell Windows-installations-ISO på Proxmox-värden med UUP Dump. ProxMenux hanterar beroenden, laddar ner UUP-filer parallellt, kör UUP Dump-konverteraren och flyttar ISO-filen till den valda utdatakatalogen. Standardvalet är den identifierade ISO-lagringen i Proxmox.",
+    "section": "Verktyg"
+  },
+  "intro": {
+    "title": "Vad skriptet gör",
+    "body": "Ange en URL som uupdump.net skapar efter val av version, språk och utgåva. Skriptet installerar saknade beroenden, laddar ner UUP Dump-konverteraren och UUP-filerna, skapar en startbar Windows-ISO och flyttar den till den valda utdatakatalogen. Den identifierade ISO-lagringen i Proxmox föreslås som standardmål."
+  },
+  "hero": {
+    "imageAlt": "UUP Dump ISO Creator i ProxMenux-menyn",
+    "caption": "UUP Dump ISO Creator i ProxMenux-menyn"
+  },
+  "what": {
+    "heading": "Vad är UUP Dump?",
+    "intro": "UUP Dump är en communitytjänst som låter dig ladda ner de ursprungliga Unified Update Platform-filerna (UUP) som Windows Update använder för att distribuera Windows. Filerna kan sammanställas till en vanlig startbar ISO. Det ger dig:",
+    "items": [
+      "Den senaste Windows-versionen, inklusive Insider Preview-kanaler.",
+      "En viss äldre version som inte längre visas på Microsofts nedladdningssida.",
+      "Rena, omodifierade filer som kommer direkt från Microsofts servrar.",
+      "Den exakta kombinationen av utgåvor och språk du vill ha i en enda ISO."
+    ],
+    "learnMore": "Läs mer på <extlink>UUP Dump-projektsidan</extlink>."
+  },
+  "automates": {
+    "heading": "Vad skriptet automatiserar"
+  },
+  "dependencies": {
+    "heading": "Beroenden",
+    "intro": "Skriptet kontrollerar först verktygen som behövs för att ladda ner UUP-filer och skapa ISO-filen. Verktyg som saknas installeras med <code>apt-get</code>:",
+    "headerPackage": "Paket",
+    "headerRole": "Funktion",
+    "rows": [
+      {
+        "pkg": "curl",
+        "roleRich": "HTTP-nedladdningar för att starta konverteraren."
+      },
+      {
+        "pkg": "aria2",
+        "roleRich": "Parallell nedladdning av alla UUP-filer."
+      },
+      {
+        "pkg": "cabextract",
+        "roleRich": "Extraherar Microsoft CAB-paket."
+      },
+      {
+        "pkg": "wimtools",
+        "roleRich": "Bygger <code>install.wim</code> (wimlib-imagex)."
+      },
+      {
+        "pkg": "genisoimage",
+        "roleRich": "Skriver den slutliga startbara ISO (eller <code>mkisofs</code>)."
+      },
+      {
+        "pkg": "chntpw",
+        "roleRich": "Ändrar Windows-registerfiler under skapandet."
+      }
+    ],
+    "manualIntro": "Manuell motsvarighet - om du någonsin behöver installera dem själv:",
+    "manualCode": "apt-get install curl aria2 cabextract wimtools genisoimage chntpw"
+  },
+  "flow": {
+    "heading": "Nedladdning och konvertering",
+    "steps": [
+      "Identifierar Proxmox ISO-lagring med <code>pvesm status -content iso</code> eller använder <code>/var/lib/vz/template/iso</code> som reserv.",
+      "Begär en basmapp för tillfälliga filer (standard <code>/root/uup-temp</code>).",
+      "Laddar ner UUP Dump-konverteraren från <code>git.uupdump.net</code>.",
+      "Läser <code>id</code>, <code>pack</code> och <code>edition</code> från URL:en som du klistrar in.",
+      "Anropar <code>https://uupdump.net/get.php?…&aria2=2</code> för att skapa en aria2-nedladdningslista.",
+      "Laddar ner alla UUP-filer till <code>UUPs/</code> med aria2, parallellt och med möjlighet att återuppta.",
+      "Kör <code>convert.sh wim UUPs 1</code> från omvandlaren för att producera den slutliga ISO.",
+      "Flyttar ISO-filen till den valda utdatakatalogen och tar bort tillfälliga filer."
+    ]
+  },
+  "aria2": {
+    "heading": "aria2-alternativ som används för nedladdning",
+    "code": "aria2c --no-conf --console-log-level=warn --log-level=info \\\n  --log=aria2_download.log \\\n  -x16 -s16 -j5 -c -R \\\n  -d\"$destDir\" -i\"$tempScript\"",
+    "flags": [
+      "<code>-x16</code> — upp till 16 anslutningar per server.",
+      "<code>-s16</code> - delar upp varje fil i 16 segment.",
+      "<code>-j5</code> — 5 filer som laddats ned parallellt.",
+      "<code>-c</code> - återupptar partiella nedladdningar.",
+      "<code>-R</code> — ger den nedladdade filen fjärrfilens tidsstämpel om den är tillgänglig."
+    ],
+    "runtime": "En typisk körning tar omkring 10 minuter och beror framför allt på internetanslutningens hastighet och belastningen på UUP Dumps nedladdningsservrar."
+  },
+  "step1": {
+    "heading": "Steg 1 · Få en UUP Dump URL",
+    "intro": "Innan du kör skriptet behöver du en UUP Dump URL som innehåller <code>id</code>, <code>pack</code> och <code>edition</code> frågeparametrar. Skapa den på <extlink>uupdump.net</extlink>:",
+    "stepBadge": "Steg",
+    "items": [
+      {
+        "title": "Välj en Windows-version",
+        "img": "/iso-creator/step-1-select-version-windows.png",
+        "caption": "UUP Dump huvudsida - välj en Windows-version",
+        "body": "Öppna UUP Dump hemsida och välj den Windows-version du vill ha."
+      },
+      {
+        "title": "Välj en viss version",
+        "img": "/iso-creator/step-2-select-version-windows.png",
+        "caption": "Välj en viss version",
+        "body": "Välj version: den senaste, en Insider Preview-kanal eller en viss äldre version som fortfarande visas."
+      },
+      {
+        "title": "Välj ett språk",
+        "img": "/iso-creator/step-3-select-version-windows.png",
+        "caption": "Välj ett språk",
+        "body": "Välj språket som ska ingå i ISO-filen."
+      },
+      {
+        "title": "Välj utgåvor",
+        "img": "/iso-creator/step-4-select-version-windows.png",
+        "caption": "Välj utgåvorna att inkludera",
+        "body": "Välj utgåvor för att bunta i ISO (Home, Pro, Enterprise, ...). Du kan kombinera flera."
+      },
+      {
+        "title": "Kopiera URL",
+        "img": "/iso-creator/step-5-select-version-windows.png",
+        "caption": "Kopiera webbadressen från adressfältet",
+        "bodyRich": "Kopiera URL:en <em>från webbläsarens adressfält</em> på den sista sidan. Den måste innehålla <code>id=…</code>, <code>pack=…</code> och <code>edition=…</code>. Det är den sträng som skriptet läser."
+      }
+    ]
+  },
+  "step2": {
+    "heading": "Steg 2 · Kör skaparen",
+    "intro": "När URL:en är kopierad öppnar du ProxMenux och startar ISO-skaparen:",
+    "stepBadge": "Steg",
+    "items": [
+      {
+        "title": "Starta UUP Dump ISO Creator",
+        "img": "/iso-creator/start-uupdump-iso-creator.png",
+        "caption": "Starta UUP Dump ISO Creator från ProxMenux",
+        "bodyRich": "Öppna <strong>Utilities → UUP Dump ISO Creator</strong> i ProxMenux. Skriptet kontrollerar beroenden och ISO-katalogen innan det frågar efter uppgifter."
+      },
+      {
+        "title": "Klistra in UUP Dump-URL:en",
+        "img": "/iso-creator/add-url-iso-creator.png",
+        "caption": "Klistra in URL:en som du kopierade från uupdump.net",
+        "body": "Klistra in URL:en i inmatningsdialogen. Skriptet kontrollerar att de tre obligatoriska parametrarna finns och avslutar ordnat om någon saknas."
+      },
+      {
+        "title": "Vänta tills ISO-filen är klar",
+        "img": "/iso-creator/end-uupdump-iso-creator.png",
+        "caption": "Skapandet är klart: ISO-filen finns i Proxmox ISO-lagring",
+        "bodyRich": "Konsolen visar aria2-förloppet och sedan konverterarens utdata. Den färdiga ISO-filen flyttas till den valda utdatakatalogen. Om den ligger i konfigurerad Proxmox ISO-lagring kan du välja den via <strong>Skapa VM System Windows → Installera med personlig ISO</strong>."
+      }
+    ]
+  },
+  "tempFiles": {
+    "title": "Tillfälliga filer",
+    "body": "Den tillfälliga standardmappen är <code>/root/uup-temp</code>, med nedladdningar i <code>UUPs/</code> och konverteraren i <code>converter/</code>. En egen bassökväg får en separat sessionsunderkatalog. Grenarna för lyckat skapande och utebliven ISO-fil tar bort den tillfälliga sessionen. Tidigare fel eller avbrott kan lämna kvar tillfälliga filer."
+  }
+}
diff --git a/web/messages/sv/guides/backup-cloud.json b/web/messages/sv/guides/backup-cloud.json
new file mode 100644
index 00000000..ec9d741a
--- /dev/null
+++ b/web/messages/sv/guides/backup-cloud.json
@@ -0,0 +1,119 @@
+{
+  "meta": {
+    "title": "Säkerhetskopiera Proxmox till personlig molnlagring | ProxMenux",
+    "description": "Montera personlig molnlagring, som Google Drive, Mega, Dropbox eller OneDrive, som en katalog på Proxmox VE-värdsystemet med rclone, registrera den som säkerhetskopieringslagring för vzdump och säkerhetskopiera virtuella maskiner och containrar direkt till molnet utan extra säkerhetskopieringsskript.",
+    "ogTitle": "Säkerhetskopiera Proxmox till personlig molnlagring",
+    "ogDescription": "Montera molnlagring med rclone på Proxmox VE-värdsystemet och använd den som vzdump-mål för säkerhetskopior av virtuella maskiner och containrar."
+  },
+  "header": {
+    "title": "Säkerhetskopiera Proxmox till personlig molnlagring",
+    "description": "Montera personlig molnlagring, som Google Drive, Mega, Dropbox eller OneDrive, som en katalog på Proxmox VE-värdsystemet med rclone, registrera den som säkerhetskopieringslagring för vzdump och säkerhetskopiera virtuella maskiner och containrar direkt till molnet utan extra säkerhetskopieringsskript.",
+    "section": "Guider"
+  },
+  "intro": {
+    "pbsCalloutTitle": "Överväg Proxmox Backup Server först",
+    "pbsCalloutBody": "På en andra dator som uppfyller x86-64-kraven ger <pbsLink>Proxmox Backup Server</pbsLink> inkrementella och deduplicerade säkerhetskopior med valfri kryptering på klientsidan. Det är utformat för virtuella maskiner. Den här guiden beskriver i stället hur personlig molnlagring, som Google Drive, Mega, OneDrive eller Dropbox, monteras som mål för säkerhetskopior.",
+    "stepsTitle": "Vad du ska göra",
+    "steps": [
+      "Skapa en katalog på Proxmox-värdsystemet och registrera den som lagring för vzdump-säkerhetskopior.",
+      "Installera och konfigurera rclone för din molnleverantör.",
+      "Montera molnmappen på katalogen.",
+      "Återställa monteringen vid varje start med en systemd-enhet."
+    ],
+    "vzdumpCalloutTitle": "Om Proxmox-säkerhetskopior med vzdump",
+    "vzdumpCalloutBody": "Proxmox vzdump-arkiv är <strong>fullständiga säkerhetskopior, inte inkrementella</strong>. Den faktiska storleken beror på vilka data som ingår och komprimeringen, inte bara på den virtuella diskens kapacitet. Om ett arkiv tar 30 GB kräver fem sparade arkiv ungefär 150 GB. Ange en gallringspolicy så att molnlagringen inte fylls."
+  },
+  "createDir": {
+    "heading": "1. Skapa katalogen på värdsystemet och registrera den som säkerhetskopieringslagring",
+    "body": "Anslut till värdsystemet via SSH eller öppna Proxmox-skalet och skapa en katalog som monteringspunkt under <code>/mnt/</code>. Välj ett namn som visar vilken leverantör det gäller:",
+    "mkdirCode": "mkdir -p /mnt/gdrive",
+    "afterMkdir": "I Proxmox webb UI: <strong>Datacenter → Lagring → Lägg till → Directory</strong>.",
+    "image1Alt": "Lägga till ny lagring i Proxmox",
+    "configIntro": "Konfigurera det så här:",
+    "configItems": [
+      "<strong>ID:</strong> <code>gdrive</code> (eller vad du använde för katalogens namn)",
+      "<strong>Katalog:</strong> <code>/mnt/gdrive</code>",
+      "<strong>Innehåll:</strong> välj <strong>VZDump-säkerhetskopieringsfil</strong>."
+    ],
+    "image2Alt": "Konfigurera ny lagring i Proxmox",
+    "afterConfig": "Klicka på <strong>Lägg till</strong>:",
+    "image3Alt": "Ny lagring läggs till i Proxmox",
+    "afterAdd": "Katalogen är registrerad som Proxmox-lagring men är fortfarande tom, eftersom molnlagringen inte är monterad än."
+  },
+  "installRclone": {
+    "heading": "2. Installera och konfigurera rclone",
+    "body": "<rcloneLink>rclone</rcloneLink> ansluter till molnlagringstjänster. Installera det från Debians paketförråd:",
+    "installCode": "apt-get update\napt-get install -y rclone",
+    "newerCalloutTitle": "Om du behöver en nyare rclone",
+    "newerCalloutBody": "Om du behöver en nyare version än den som ingår i Debian använder du det officiella installationsprogrammet:",
+    "newerCode": "curl https://rclone.org/install.sh | bash",
+    "tunnelHeading": "2.1 Browser-baserad autentisering via SSH tunnel",
+    "tunnelBody": "För leverantörer med webbinloggning saknar Proxmox-värdsystemet vanligtvis en webbläsare. Följ <remoteSetupLink>rclones guide för fjärrkonfiguration</remoteSetupLink>: använd webbläsaren på din bärbara dator och vidarebefordra dess localhost-anslutning för återkopplingen via SSH till rclone på värdsystemet.",
+    "tunnelFrom": "På din <strong>bärbara dator</strong>, där du ersätter <code>ip_proxmox</code> med Proxmox IP-adress:",
+    "tunnelCode": "ssh -L localhost:53682:localhost:53682 root@ip_proxmox",
+    "tunnelAfter": "SSH-sessionen öppnar localhost-port 53682 på din bärbara dator och vidarebefordrar anslutningar till samma port på Proxmox-värdsystemet. Låt den vara öppen under rclone-konfigurationen.",
+    "runHeading": "2.2 Kör rclone config",
+    "runBody": "Kör följande i SSH-sessionen som du just öppnade:",
+    "runCode": "rclone config",
+    "runAfter": "Följ anvisningarna för att lägga till en fjärrkonfiguration, en så kallad remote. Svaren beror på leverantören; se <providerDocsLink>rclones leverantörsdokumentation</providerDocsLink> för Google Drive, Mega, Dropbox, OneDrive med flera. Det viktiga steget är autentiseringsfrågan:",
+    "authPrompt": "Use web browser to automatically authenticate rclone with remote?\n * Say Y if the machine running rclone has a web browser you can use\n * Say N if running rclone on a (remote) machine without web browser access\nIf not sure try Y. If Y failed, try N.\ny) Yes\nn) No\ny/n> y",
+    "authAfter": "Svara <strong>Y</strong>. rclone visar en lokal URL. Öppna den i <strong>webbläsaren på din bärbara dator</strong>; SSH-tunneln vidarebefordrar anslutningen. Ge rclone åtkomst hos molnleverantören för att slutföra konfigurationen.",
+    "nameRemote": "Välj ett namn på fjärrkonfigurationen som motsvarar katalogen, till exempel <code>gdrive</code>."
+  },
+  "mount": {
+    "heading": "3. Montera molnmappen",
+    "body": "Skapa en mapp i molnlagringen för säkerhetskopiorna, till exempel <code>PBC</code> för Proxmox Backup Cloud.",
+    "mountIntro": "Montera den i katalogen på värdsystemet:",
+    "mountCode": "rclone mount gdrive:/PBC /mnt/gdrive --allow-other --allow-non-empty --vfs-cache-mode writes",
+    "mountItems": [
+      "<code>gdrive:/PBC</code> - mappen i ditt moln.",
+      "<code>/mnt/gdrive</code> — katalogen på värdsystemet som du registrerade som lagring."
+    ],
+    "mountFootnote": "<strong>Kommandot körs i förgrunden.</strong> Låt det vara igång i en terminal när du testar en säkerhetskopia. Konfigurera en systemd-enhet enligt nästa avsnitt för automatisk montering vid varje start."
+  },
+  "systemd": {
+    "heading": "4. Automatisk montering vid varje start med systemd",
+    "body": "En systemd-enhet ger mer kontroll än <code>crontab @reboot</code>: den kan invänta nätverksstart, starta om vid fel och ge loggar via <code>journalctl</code>.",
+    "createIntro": "Skapa enhetsfilen:",
+    "createCode": "nano /etc/systemd/system/rclone-gdrive.service",
+    "pasteIntro": "Klistra in:",
+    "unitCode": "[Unit]\nDescription=rclone mount for Proxmox cloud backups\nWants=network-online.target\nAfter=network-online.target\n\n[Service]\nType=notify\nExecStart=/usr/bin/rclone mount \\\n    gdrive:/PBC /mnt/gdrive \\\n    --allow-other \\\n    --allow-non-empty \\\n    --vfs-cache-mode writes \\\n    --log-level INFO \\\n    --log-file /var/log/rclone-gdrive.log\nExecStop=/bin/fusermount -uz /mnt/gdrive\nRestart=on-failure\nRestartSec=10\n\n[Install]\nWantedBy=multi-user.target",
+    "adjust": "Anpassa <code>gdrive:/PBC</code> och <code>/mnt/gdrive</code> om du valde andra namn. Spara, avsluta redigeraren med <code>Ctrl+X</code> och aktivera och starta tjänsten:",
+    "enableCode": "systemctl daemon-reload\nsystemctl enable --now rclone-gdrive.service",
+    "verifyIntro": "Verifiera:",
+    "verifyCode": "systemctl status rclone-gdrive.service\nmount | grep /mnt/gdrive",
+    "verifyAfter": "Enheten begär en omstart efter 10 sekunder om rclone-processen avslutas med fel. Det åtgärdar inte utgångna autentiseringsuppgifter och garanterar inte återhämtning från alla nätverks- eller leverantörsfel. Kontrollera <code>/var/log/rclone-gdrive.log</code> och <code>journalctl -u rclone-gdrive.service -f</code>.",
+    "vfsCalloutTitle": "Varför använda --vfs-cache-mode writes?",
+    "vfsCalloutBody": "Med skrivcache går skrivningar som <code>fwrite</code> till en lokal diskcache. rclone laddar upp filen när den stängts och fördröjningen för återskrivning har passerat. Reservera lokalt utrymme för pågående säkerhetskopior och kontrollera att uppladdningen är klar innan molnkopian räknas som tillgänglig."
+  },
+  "configureBackup": {
+    "heading": "5. Ange molnlagringen som säkerhetskopieringsmål",
+    "body": "Välj den registrerade lagringen som <strong>mål</strong> i Proxmox när du schemalägger eller startar en säkerhetskopia manuellt:",
+    "image5Alt": "Välja mål för säkerhetskopiering i Proxmox",
+    "after": "När vzdump är klart väntar du tills rclones bakgrundsuppladdning är färdig och kontrollerar arkivet i molnleverantörens gränssnitt:",
+    "image6Alt": "Backup-fil i molnlagring"
+  },
+  "retention": {
+    "heading": "6. Gallring — håll molnkvoten under kontroll",
+    "body": "Proxmox vzdump-arkiv är <strong>fullständiga säkerhetskopior, inte inkrementella</strong>. Den faktiska storleken beror på vilka data som ingår och komprimeringen, inte bara på den virtuella diskens kapacitet. Om ett arkiv tar 30 GB kräver fem sparade arkiv ungefär 150 GB. Ange en gallringspolicy så att molnlagringen inte fylls.",
+    "uiPath": "I Proxmox-gränssnittet: <strong>Datacenter → Säkerhetskopiering → [ditt jobb] → Bevarande</strong>:",
+    "image7Alt": "Gallringsinställningar för säkerhetskopior i Proxmox",
+    "starterIntro": "Möjliga startvärden för en hemma- eller testmiljö:",
+    "starterItems": [
+      "Behåll de senaste 5 dagliga säkerhetskopiorna",
+      "Behåll de senaste 4 veckovisa säkerhetskopiorna",
+      "Behåll de senaste 6 månatliga säkerhetskopiorna"
+    ],
+    "adjust": "Anpassa värdena efter molnkvoten och hur ofta de virtuella maskinerna ändras."
+  },
+  "troubleshoot": {
+    "heading": "Felsökning",
+    "items": [
+      "<strong><code>Mount point /mnt/gdrive is itself on a fuse.rclone filesystem</code>:</strong> katalogen är redan monterad, kanske av en annan rclone-instans. Kontrollera att ingen säkerhetskopiering pågår innan du tar bort den gamla monteringen med <code>fusermount -uz /mnt/gdrive</code> och starta sedan om systemd-enheten.",
+      "<strong>Säkerhetskopieringen är mycket långsam:</strong> kontrollera <code>--vfs-cache-mode writes</code> på raden <code>ExecStart</code>, den lokala cachens prestanda, uppladdningshastigheten och leverantörens gränser. Uppladdningen kan fortsätta efter att vzdump är klart.",
+      "<strong>Säkerhetskopieringen ger No space left on device:</strong> kontrollera lokalt cacheutrymme och molnkvoten. Cachen använder vanligtvis <code>~/.cache/rclone/</code>. Välj vid behov till exempel <code>--cache-dir /var/cache/rclone</code> på ett filsystem med tillräckligt utrymme. En annan sökväg på samma fulla filsystem hjälper inte.",
+      "<strong>rclones autentiseringstoken har gått ut:</strong> anslut igen via SSH med tunneln (<code>ssh -L localhost:53682:localhost:53682 root@ip_proxmox</code>) och kör <code>rclone config reconnect gdrive:</code> för att förnya behörigheten.",
+      "<strong>Säkerhetskopiorna finns i molnet men kan inte återställas korrekt:</strong> använd inte molnlagring som <strong>enda</strong> mål. Komplettera med lokalt PBS eller vzdump på en annan disk."
+    ]
+  }
+}
diff --git a/web/messages/sv/guides/index.json b/web/messages/sv/guides/index.json
new file mode 100644
index 00000000..548e10cf
--- /dev/null
+++ b/web/messages/sv/guides/index.json
@@ -0,0 +1,118 @@
+{
+  "meta": {
+    "title": "Guider för Proxmox VE — Coral TPU, NVIDIA, Kodi i LXC, Samba och molnsäkerhetskopiering | ProxMenux",
+    "description": "Utförliga guider för Proxmox VE: Kodi i LXC med GPU-acceleration, NVIDIA-drivrutiner på PVE 9, USB-disk delad via Samba i en container samt vzdump-säkerhetskopior till Google Drive, Mega, Dropbox eller OneDrive. Dessutom utvalda gemenskapsresurser, ordlista och kommandoreferens.",
+    "ogTitle": "Guider för Proxmox VE — Coral TPU, NVIDIA, Kodi i LXC, Samba och molnsäkerhetskopiering",
+    "ogDescription": "Utförliga Proxmox VE-guider: GPU-genomkoppling, Kodi som mediecenter i LXC, USB-diskar delade via Samba, molnsäkerhetskopiering med rclone och utvalda gemenskapsresurser.",
+    "twitterTitle": "Guider för Proxmox VE | ProxMenux",
+    "twitterDescription": "Utförliga guider för Proxmox VE — GPU, Kodi i LXC, Samba, molnsäkerhetskopiering och annat.",
+    "ogImageAlt": "ProxMenux-guider — utförliga instruktioner för Proxmox VE"
+  },
+  "header": {
+    "title": "ProxMenux-guider",
+    "tagline": "Utförliga guider, snabbreferenser och utvalda gemenskapsresurser för att få ut mer av Proxmox VE."
+  },
+  "inDepth": {
+    "heading": "Fördjupade guider",
+    "intro": "Utförliga guider för specifika Proxmox-uppgifter. Varje guide visar de manuella stegen i ett automatiserat ProxMenux-flöde, så att du kan se vad som sker i varje steg.",
+    "items": [
+      {
+        "slug": "kodi-lxc",
+        "title": "Installera Kodi i LXC med GPU-acceleration och anslut till bildskärm eller TV",
+        "description": "Kör Kodi i en privilegierad LXC-container på Proxmox VE, ge den tillgång till värdsystemets iGPU och USB-inmatningsenheter och använd servern som mediecenter direkt anslutet till en TV."
+      },
+      {
+        "slug": "backup-cloud",
+        "title": "Säkerhetskopiera Proxmox till personlig molnlagring",
+        "description": "Montera personlig molnlagring, som Google Drive, Mega, Dropbox eller OneDrive, som en katalog på Proxmox VE-värdsystemet med rclone, registrera den som säkerhetskopieringslagring för vzdump och säkerhetskopiera virtuella maskiner och containrar direkt till molnet utan extra säkerhetskopieringsskript."
+      },
+      {
+        "slug": "lxc-samba",
+        "title": "Anslut en USB-disk eller ett USB-minne till LXC och dela via Samba i nätverket",
+        "description": "Ge en privilegierad LXC-container på Proxmox VE tillgång till en USB-disk eller ett USB-minne, installera Samba i containern och dela innehållet i nätverket."
+      },
+      {
+        "slug": "nvidia-manual",
+        "title": "Installera NVIDIA-grafikdrivrutiner på Proxmox VE 9 manuellt",
+        "description": "Installera och konfigurera NVIDIA-drivrutiner manuellt på ett Proxmox VE 9-värdsystem och ge en eller flera LXC-containrar tillgång till GPU:n. Guiden täcker drivrutiner, persistens­tjänsten, en valfri NVENC-patch och inställningar för varje container."
+      }
+    ]
+  },
+  "references": {
+    "heading": "ProxMenux referenser",
+    "intro": "Snabbreferensmaterial från själva ProxMenux-dokumentationen.",
+    "cards": {
+      "glossary": {
+        "title": "Ordlista",
+        "description": "Över 60 definitioner av tekniska termer i ProxMenux: Proxmox, virtualisering, lagring, nätverk och Linux. Snabb uppslagning med kategorietiketter och korslänkar."
+      },
+      "helpInfo": {
+        "title": "Hjälp och information — kommandokatalog",
+        "description": "Utvalda Linux- och Proxmox-kommandon efter ämne med kopiering till urklipp. Motsvarar referensen i ProxMenux-menyn."
+      },
+      "linuxResources": {
+        "title": "Linux-resurser",
+        "description": "Externa resurser för att lära sig Linux-kommandoraden, säkerhetsrutiner, övervakningsverktyg och ZFS — ett komplement till ProxMenux kommandokatalog."
+      },
+      "externalRepos": {
+        "title": "Externa repositorier",
+        "description": "Skriptrepositorier från tredje part som är integrerade i ProxMenux som alternativa menyval, till exempel community-scripts/ProxmoxVE."
+      }
+    }
+  },
+  "official": {
+    "heading": "Officiella Proxmox resurser",
+    "intro": "Dokumentation direkt från Proxmox Server Solutions — den officiella referensen för plattformen.",
+    "cards": {
+      "pveDocs": {
+        "title": "Proxmox VE Dokumentation",
+        "description": "Den officiella administratörsguiden med utförlig information om installation, nätverk, lagring, kluster, hög tillgänglighet och API."
+      },
+      "pbsDocs": {
+        "title": "Dokumentation för Proxmox Backup Server",
+        "description": "Dokumentation för PBS - stegvisa, deduplicerade, krypterade säkerhetskopior för Proxmox VE."
+      },
+      "videoTraining": {
+        "title": "Officiell videoutbildning",
+        "description": "Officiella videoguider och utbildningar från Proxmox."
+      },
+      "forum": {
+        "title": "Proxmox Forum",
+        "description": "Officiellt gemenskapsforum för frågor, felsökning och erfarenhetsutbyte. Projektets ansvariga följer diskussionerna."
+      }
+    }
+  },
+  "community": {
+    "heading": "Gemenskapsprojekt och resurser",
+    "intro": "Projekt med öppen källkod och utvalda listor från Proxmox-gemenskapen. De är fristående från Proxmox Server Solutions och ProxMenux och finns med eftersom de visat sig användbara.",
+    "cards": {
+      "helperScripts": {
+        "title": "Proxmox VE Helper-Scripts",
+        "description": "En gemenskapsunderhållen skriptkatalog för att enkelt skapa LXC-containrar, virtuella maskiner och PVE-anpassningar, till exempel för Home Assistant, Plex och Frigate. För vidare idén bakom ttecks hjälpskript."
+      },
+      "awesome": {
+        "title": "awesome-proxmox-ve (utvald lista)",
+        "description": "En stor gemenskapsvald samling Proxmox VE-resurser: verktyg, bibliotek, integrationer, bloggar och videor. En bra utgångspunkt för att upptäcka mer."
+      }
+    },
+    "suggestRich": "Känner du till en bra resurs som vi borde lägga till? Öppna en issue eller PR på <link>GitHub</link>. Vi vill behålla ett genomtänkt urval snarare än en fullständig förteckning."
+  },
+  "discussion": {
+    "heading": "Diskussioner i gemenskapen",
+    "intro": "Där folk pratar om Proxmox och ProxMenux.",
+    "cards": {
+      "proxmenuxDiscussions": {
+        "title": "ProxMenux Discussions",
+        "description": "GitHub Discussions för ProxMenux: funktionsidéer, frågor och svar samt delning av egna installationer. Rätt plats för ämnen om menyn, Monitor och dokumentationen."
+      },
+      "proxmoxForum": {
+        "title": "Proxmox Forum",
+        "description": "Proxmox forum (även länkat ovan). Rätt plats för fördjupad felsökning och konfig-specifika frågor."
+      },
+      "reddit": {
+        "title": "r/Proxmox på Reddit",
+        "description": "Aktiv subreddit för diskussioner, tips och teknisk hjälp. Lägre tröskel än forumet och ofta snabbare svar på enklare frågor."
+      }
+    }
+  }
+}
diff --git a/web/messages/sv/guides/kodi-lxc.json b/web/messages/sv/guides/kodi-lxc.json
new file mode 100644
index 00000000..6fc462f2
--- /dev/null
+++ b/web/messages/sv/guides/kodi-lxc.json
@@ -0,0 +1,70 @@
+{
+  "meta": {
+    "title": "Installera Kodi i LXC med GPU-acceleration | ProxMenux-guider",
+    "description": "Kör Kodi i en privilegierad LXC-container på Proxmox VE, ge den tillgång till värdsystemets iGPU och USB-inmatningsenheter och använd servern som mediecenter direkt anslutet till en TV.",
+    "ogTitle": "Installera Kodi i LXC med GPU-acceleration",
+    "ogDescription": "Kör Kodi i en privilegierad LXC-container på Proxmox VE med tillgång till värdsystemets iGPU och USB-inmatningsenheter och använd servern som mediecenter."
+  },
+  "header": {
+    "title": "Installera Kodi i LXC med GPU-acceleration och anslut till bildskärm eller TV",
+    "description": "Kör Kodi i en privilegierad LXC-container på Proxmox VE, ge den tillgång till värdsystemets iGPU och USB-inmatningsenheter och använd servern som mediecenter direkt anslutet till en TV.",
+    "section": "Guider"
+  },
+  "intro": {
+    "calloutTitle": "Observera",
+    "calloutBody": "Den här guiden använder ett externt gemenskapsskript för att konfigurera Kodi-containern. ProxMenux kan också ge tillgång till värdsystemets iGPU: <strong>GPU:er och Coral-TPU → Lägg till GPU i LXC</strong> konfigurerar <code>/dev/dri</code> och installerar drivrutiner i containern. Skriptet nedan installerar dessutom Kodi och automatisk start på <code>tty7</code>. Använd det för ett färdigt mediecenter i LXC; välj <gpuLink>ProxMenux-flödet</gpuLink> om du bara behöver GPU-åtkomst i en manuellt konfigurerad container.",
+    "credit": "Det ursprungliga Kodi-skriptet för LXC skapades av <authorLink>mrrudy</authorLink>.",
+    "stepsTitle": "Vad du ska göra",
+    "steps": [
+      "Skapa en privilegierad LXC-container med Kodi med hjälp av skriptet.",
+      "Ge containern tillgång till USB-tangentbord, mus eller handkontroll.",
+      "Valfritt: uppdatera Kodi från containerns konfigurerade paketförråd."
+    ]
+  },
+  "createCt": {
+    "heading": "1. Skapa Kodi LXC",
+    "body": "Välj <strong>Privileged</strong> i skriptets avancerade inställningar för den här guiden. Skriptet skapar som standard oprivilegierade containrar, som kräver lämpliga enhetsbehörigheter och ID-mappningar. Det konfigurerar GPU-åtkomst, Kodi och automatisk start på <code>tty7</code>:",
+    "code": "bash -c \"$(wget -qLO - https://raw.githubusercontent.com/mrrudy/proxmoxHelper/main/ct/kodi-v1.sh)\"",
+    "after": "Installationen tar en stund. När Kodi startar på <code>tty7</code> ansluter du bildskärmen eller TV:n till värdsystemets HDMI-/DisplayPort-utgång. Kodi-gränssnittet bör då visas."
+  },
+  "addInput": {
+    "heading": "2. Lägg till tangentbord, mus eller USB-handkontroll",
+    "body": "Inmatningsenheterna finns under <code>/dev/input/</code> på värdsystemet. Identifiera deras major-nummer:",
+    "listCode": "ls -l /dev/input",
+    "imageAlt": "Lista över inmatningsenheter",
+    "afterList": "För teckenenheter använder du major-numret före kommatecknet, här <code>13</code>. Redigera Kodi-containerns konfiguration på värden. Ersätt <code>'<'CTID'>'</code> med dess ID, till exempel <code>102</code>:",
+    "editCode": "nano /etc/pve/lxc/CTID.conf",
+    "addLines": "Lägg till följande och anpassa <code>13</code> till numret på <strong>ditt</strong> värdsystem:",
+    "configCode": "lxc.cgroup2.devices.allow: c 13:* rwm\nlxc.mount.entry: /dev/input dev/input none bind,optional,create=dir",
+    "imageConfigAlt": "LXC konfiguration",
+    "save": "Spara filen, avsluta redigeraren med <code>Ctrl+X</code> och starta om <strong>bara containern</strong>. Proxmox-värdsystemet behöver inte startas om:",
+    "restartCode": "pct reboot CTID",
+    "plug": "Anslut tangentbordet, musen eller handkontrollen. Kodi bör reagera."
+  },
+  "updateKodi": {
+    "heading": "3. Valfritt: uppdatera Kodi från konfigurerade paketförråd",
+    "calloutTitle": "Viktigt",
+    "calloutBody": "PPA:t team-xbmc är <strong>endast för Ubuntu</strong> och enligt Kodi underhålls det inte längre. Att <code>add-apt-repository</code> saknas identifierar inte distributionen. Kontrollera <code>cat /etc/os-release</code> och leta efter <code>NAME=\"Ubuntu\"</code>; lägg inte till Ubuntu-PPA:er i Debian. Kommandona nedan uppdaterar paket från containerns konfigurerade paketförråd.",
+    "body": "Inne i containern (<code>pct enter '<'CTID'>'</code>):",
+    "code": "apt update\napt install --only-upgrade kodi kodi-bin",
+    "after": "Starta om containern efter uppdateringen. Kodi använder versionen i de konfigurerade paketförråden, som kan skilja sig från projektets senaste version."
+  },
+  "screenshots": {
+    "heading": "Skärmdumpar",
+    "image1Alt": "Kodi gränssnitt 1",
+    "image2Alt": "Kodi gränssnitt 2"
+  },
+  "troubleshoot": {
+    "heading": "Felsökning",
+    "items": [
+      "<strong>Kodi-containern startar men TV:n visar inget:</strong> containern kanske saknar tillgång till iGPU:n. Kontrollera <code>ls /dev/dri</code> i containern; där bör <code>card0</code> och <code>renderD128</code> finnas. Om katalogen är tom kontrollerar du GPU-genomkopplingen eller väljer <strong>Lägg till GPU i LXC</strong> i ProxMenux.",
+      "<strong>Tangentbord eller mus identifieras inte efter omstart:</strong> kontrollera att <code>/dev/input</code> är monterad och att Kodi kan läsa enheterna. Kör <code>ls -l /dev/input</code> på värdsystemet och i containern och kontrollera regeln <code>lxc.cgroup2.devices.allow</code>.",
+      "<strong>Hårdvaruaccelererad uppspelning använder CPU:n i stället för GPU:n:</strong> installera eller uppdatera VA-API-drivrutiner i containern: <code>intel-media-va-driver</code> för nyare Intel-iGPU:er, <code>i965-va-driver</code> för äldre och <code>mesa-va-drivers</code> för AMD.",
+      "<strong><code>add-apt-repository: command not found</code>:</strong> kommandot är inte installerat; det bevisar inte att containern kör Debian. Kontrollera distribution och tillgängliga paket. Använd Debians Kodi-paket på Debian utan att lägga till Ubuntu-PPA:t."
+    ]
+  },
+  "further": {
+    "heading": "Läs mer",
+    "konpatRich": "<konpatLink>Konpats blogginlägg</konpatLink> med mer information om åtkomst till Intel-iGPU:n från LXC."
+  }
+}
diff --git a/web/messages/sv/guides/lxc-samba.json b/web/messages/sv/guides/lxc-samba.json
new file mode 100644
index 00000000..1df68cf3
--- /dev/null
+++ b/web/messages/sv/guides/lxc-samba.json
@@ -0,0 +1,119 @@
+{
+  "meta": {
+    "title": "Anslut en USB-disk till LXC och dela den med Samba | ProxMenux",
+    "description": "Ge en privilegierad LXC-container på Proxmox VE tillgång till en USB-disk eller ett USB-minne, installera Samba i containern och dela innehållet i nätverket.",
+    "ogTitle": "Anslut en USB-disk till LXC och dela den med Samba",
+    "ogDescription": "Ge en privilegierad LXC-container på Proxmox VE tillgång till en USB-disk, installera Samba och dela innehållet i det lokala nätverket."
+  },
+  "header": {
+    "title": "Anslut en USB-disk eller ett USB-minne till LXC och dela via Samba i nätverket",
+    "description": "Ge en privilegierad LXC-container på Proxmox VE tillgång till en USB-disk eller ett USB-minne, installera Samba i containern och dela innehållet i nätverket.",
+    "section": "Guider"
+  },
+  "recommended": {
+    "calloutTitle": "Rekommenderas",
+    "calloutIntro": "ProxMenux erbjuder båda delarna av det här arbetsflödet via guidade menyer:",
+    "items": [
+      "<strong>Diskhantering → Formatera/radera fysisk disk</strong> för formatering.",
+      "<strong>Lagring och delning → Nätverksdelning i LXC → Samba-server i LXC</strong> för installation i en privilegierad container och konfiguration av Samba."
+    ],
+    "calloutOutro": "De guidade flödena hanterar behörigheter för oprivilegierade containrar, delningsprofiler för läsning/skrivning, enbart läsning eller egna inställningar samt gruppen sharedfiles. Guiden visar de manuella stegen så att du kan förstå dem eller konfigurera dem själv."
+  },
+  "intro": {
+    "body": "En USB-disk eller ett USB-minne kan vara användbart på ett Proxmox-värdsystem, särskilt en minidator med begränsade utbyggnadsmöjligheter. Guiden visar hur du:",
+    "stepsTitle": "Vad du ska göra",
+    "steps": [
+      "Ger en privilegierad LXC-container tillgång till USB-disken.",
+      "Installera Samba i containern.",
+      "Delar diskens innehåll i det lokala nätverket."
+    ],
+    "useCasesTitle": "Användningsområden",
+    "useCases": [
+      "Lagrar torrentfiler och delar dem i nätverket.",
+      "Ger en medieserver som Plex, Jellyfin eller Emby lagringsutrymme.",
+      "Lagrar dokument som Paperless behandlar automatiskt.",
+      "Använder disken som NAS-lagring för hemnätverket."
+    ],
+    "privilegedCalloutTitle": "Privilegierad container för den här guiden",
+    "privilegedCalloutBody": "Guiden använder en privilegierad LXC-container med en blockenhet som <code>mp0</code>. För en oprivilegierad container kan du i stället montera filsystemet på värdsystemet och bind-montera katalogen med lämpliga behörigheter och ID-mappningar. Se <strong>Lagring och delning → LXC-monteringspunkter</strong> i ProxMenux."
+  },
+  "attach": {
+    "heading": "1. Ge LXC tillgång till USB-disken",
+    "identifyHeading": "1.1 Identifiera enheten",
+    "identifyBody": "Jämför disklistan <strong>före</strong> och <strong>efter</strong> anslutningen av USB-disken. Den nya enheten är disken du söker.",
+    "beforeLabel": "Före:",
+    "afterLabel": "Efter:",
+    "imageBeforeAlt": "Disk lista innan du lägger till USB-enhet",
+    "imageAfterAlt": "Disk lista efter att ha lagt till USB-enhet",
+    "lsblkBody": "Med <code>lsblk -o NAME,SIZE,MODEL,SERIAL</code> listar du blockenheter med modell och serienummer.",
+    "stableCalloutTitle": "Viktigt – använd en stabil identifierare",
+    "stableCalloutBody": "Enhetsnamnet <code>/dev/sdb1</code> kan ändras efter en omstart, särskilt med flera USB-diskar. Hitta den beständiga identifieraren:",
+    "stableCalloutCode": "ls -l /dev/disk/by-id/",
+    "stableCalloutAfter": "Använd posten <code>/dev/disk/by-id/usb-...</code> för den avsedda partitionen i LXC-konfigurationen i stället för <code>/dev/sdb1</code>. Välj partitionen, inte hela disken; den kan då identifieras även om enheternas ordning ändras.",
+    "formatHeading": "1.2 Formatera disken",
+    "formatBody": "ext4 passar för Linux-delningar: det skiljer på stora och små bokstäver och stöder POSIX-ACL:er och stora filer. Formatering förstör innehållet i det befintliga filsystemet. Kontrollera partitionen och kör kommandot på <strong>Proxmox-värdsystemet</strong>:",
+    "formatCode": "mkfs.ext4 /dev/sdb1",
+    "formatAfter": "Ersätt <code>/dev/sdb1</code> med den faktiska partitionen eller dess beständiga sökväg <code>/dev/disk/by-id/usb-...-part1</code>.",
+    "mkdirHeading": "1.3 Skapa monteringspunkten i LXC-containern",
+    "mkdirBody": "Skapa katalogen där disken ska visas inne i LXC-containern. Du kan välja valfritt namn.",
+    "mkdirCode": "mkdir /mnt/lxc_USB",
+    "wireHeading": "1.4 Konfigurera enheten i LXC",
+    "wireBody": "Redigera containerkonfigurationen på <strong>Proxmox-värdsystemet</strong>. Ersätt <code>'<'CTID'>'</code> med containerns ID:",
+    "wireEditCode": "nano /etc/pve/lxc/CTID.conf",
+    "wireAddLine": "Lägg till denna linje:",
+    "wireConfigCode": "mp0: /dev/disk/by-id/usb-VENDOR_MODEL_SERIAL-part1,mp=/mnt/lxc_USB,backup=0",
+    "wireShortForm": "Du kan även använda den kortare posten <code>mp0: /dev/sdb1,mp=/mnt/lxc_USB,backup=0</code> om du accepterar risken att enhetssökvägen ändras.",
+    "wireBackupNote": "Exemplet använder <code>backup=0</code>. Innehållet i enhets- och bind-monteringar ingår inte i containerns <code>vzdump</code>-säkerhetskopior. Ordna en separat säkerhetskopia av den externa diskens data.",
+    "restartHeading": "1.5 Starta om LXC och ställ in behörigheter",
+    "restartBody": "Starta om CT för att tillämpa monteringspunkten:",
+    "restartCode": "pct reboot CTID",
+    "permsBody": "Skapa först delningskontot i LXC-containern innan du tilldelar ägarskap och ange sedan katalogbehörigheterna:",
+    "permsCode": "adduser --system --group --no-create-home --shell /usr/sbin/nologin proxmenux\nmkdir -p /mnt/lxc_USB\nchown -R proxmenux:proxmenux /mnt/lxc_USB\nchmod 770 /mnt/lxc_USB",
+    "permsNoteTitle": "Notera",
+    "permsNote": "Ersätt <code>proxmenux</code> med ditt valda kontonamn. Läget <code>770</code> ger ägare och grupp åtkomst men utestänger andra; det är mer begränsat än <code>chmod -R 777</code>. Kontot skapas här och registreras i Samba i steg 2.2."
+  },
+  "samba": {
+    "heading": "2. Installera Samba",
+    "installHeading": "2.1 Installera paketet inne i LXC",
+    "installCode": "apt-get update\napt-get install -y samba",
+    "confirmBody": "Bekräfta att tjänsten körs:",
+    "confirmCode": "systemctl status smbd.service",
+    "userHeading": "2.2 Kontrollera delningskontot",
+    "userBody": "Systemkontot <code>proxmenux</code> skapades utan inloggningsskal i steg 1.5. Kontrollera det innan du anger Samba-lösenordet och använd det valda namnet genomgående:",
+    "userCode": "id proxmenux",
+    "passwordBody": "Ange Samba-lösenordet. Det är separat från systemlösenordet eftersom Samba har ett eget lager för autentiseringsuppgifter:",
+    "passwordCode": "smbpasswd -a proxmenux",
+    "aclHeading": "2.3 Ange ägarskap och ACL:er",
+    "aclBody": "Om <code>chown</code> från steg 1.5 räcker är behörigheterna klara. Använd ACL:er om flera användare behöver olika rättigheter till samma sökväg:",
+    "aclCode": "apt-get install -y acl\nsetfacl -R -m \"u:proxmenux:rwx\" /mnt/lxc_USB\nsetfacl -d -R -m \"u:proxmenux:rwx\" /mnt/lxc_USB    # default ACL — applies to new files"
+  },
+  "configure": {
+    "heading": "3. Konfigurera Samba-delningen",
+    "editHeading": "3.1 Redigera smb.conf",
+    "editCode": "nano /etc/samba/smb.conf",
+    "appendBody": "Lägg till en delningsdefinition i slutet av filen:",
+    "shareCode": "[lxc_usb]\n    comment = Shared USB storage\n    path = /mnt/lxc_USB\n    read only = no\n    writable = yes\n    browseable = yes\n    guest ok = no\n    valid users = proxmenux\n    create mask = 0660\n    directory mask = 0770",
+    "validUsersNoteTitle": "Notera",
+    "validUsersNote": "<code>valid users = proxmenux</code>-linjen begränsar åtkomsten till den enda Samba-användaren. För gruppbaserad åtkomst, använd <code>valid users = @samba_users</code> efter att ha lagt till användaren till en grupp som heter <code>samba_users</code>.",
+    "reloadHeading": "3.2 Läs in Samba på nytt",
+    "reloadCode": "systemctl restart smbd"
+  },
+  "verify": {
+    "heading": "4. Verifiera åtkomst",
+    "body": "Från någon LAN-klient, bläddra till <code>\\\\'<'CT_IP'>'</code> (Windows) eller <code>smb://'<'CT_IP'>'</code> (macOS / Linux filhanterare). Autentisera med Samba-användaren (<code>proxmenux</code>) och lösenordet du ställer in med <code>smbpasswd</code>.",
+    "image1Alt": "Samba server åtkomst från en klient",
+    "image2Alt": "Sambas autentiseringsfråga",
+    "usageBody": "Du kan använda delningen både inne i containern och via nätverket:",
+    "image3Alt": "Använda USB-disken via delningen"
+  },
+  "troubleshoot": {
+    "heading": "Felsökning",
+    "items": [
+      "<strong><code>pct reboot</code> ger ”device not found”:</strong> kontrollera att sökvägen i <code>mp0</code> finns på värdsystemet. Granska <code>ls -l /dev/disk/by-id/</code> och rätta sökvägen.",
+      "<strong>Containern startar men <code>/mnt/lxc_USB</code> är tom:</strong> disken kanske inte är monterad, eller filsystemet är tomt. Kontrollera från värdsystemet med <code>pct exec '<'CTID'>' -- mount | grep lxc_USB</code>. Om monteringen saknas granskar du konfiguration, enhetssökväg och startfel.",
+      "<strong>Samba-inloggningen fungerar men skrivning ger ”Permission denied”:</strong> kontrollera katalogens Linux-behörigheter och delningens skrivinställningar. Granska <code>chown</code> och <code>setfacl</code> i avsnitt 1.5 och 2.3.",
+      "<strong>Delningen hittas inte men <code>smb://'<'ip'>'/lxc_usb</code> fungerar:</strong> äldre NetBIOS-identifiering använder <code>nmbd</code>. Modern Windows använder WS-Discovery. Installera <code>apt-get install -y wsdd</code> på Debian 12; på Debian 13, där <code>wsdd</code> inte finns i det stabila arkivet, använd <code>apt-get install -y wsdd2</code>. Kontrollera tjänst och brandvägg. Att bara aktivera <code>nmbd</code> ger inte WS-Discovery.",
+      "<strong>För att lägga till en användare i delningen:</strong> skapa kontot med <code>adduser</code>, registrera det med <code>smbpasswd -a</code> och lägg till det i den kommaseparerade listan <code>valid users =</code>. Ge även nödvändiga filsystembehörigheter eller ACL:er."
+    ]
+  }
+}
diff --git a/web/messages/sv/guides/nvidia-manual.json b/web/messages/sv/guides/nvidia-manual.json
new file mode 100644
index 00000000..1a054c79
--- /dev/null
+++ b/web/messages/sv/guides/nvidia-manual.json
@@ -0,0 +1,165 @@
+{
+  "meta": {
+    "title": "NVIDIA-drivrutiner på Proxmox VE 9 — manuell installation | ProxMenux-guider",
+    "description": "Installera och konfigurera NVIDIA-drivrutiner manuellt på ett Proxmox VE 9-värdsystem och ge en eller flera LXC-containrar tillgång till GPU:n. Guiden täcker drivrutiner, persistens­tjänsten, en valfri NVENC-patch och inställningar för varje container.",
+    "ogTitle": "Installera NVIDIA-drivrutiner på Proxmox VE 9 manuellt",
+    "ogDescription": "Manuell NVIDIA-installation på PVE 9: värdsystemets drivrutin, persistens­tjänst, valfri NVENC-patch och GPU-åtkomst i varje LXC-container."
+  },
+  "header": {
+    "title": "Installera NVIDIA-grafikdrivrutiner på Proxmox VE 9 manuellt",
+    "description": "Installera och konfigurera NVIDIA-drivrutiner manuellt på ett Proxmox VE 9-värdsystem och ge en eller flera LXC-containrar tillgång till GPU:n. Guiden täcker drivrutiner, persistens­tjänsten, en valfri NVENC-patch och inställningar för varje container.",
+    "section": "Guider"
+  },
+  "intro": {
+    "calloutTitle": "Notera",
+    "calloutBody": "Den här manuella proceduren finns som referens. För de flesta användare rekommenderas ProxMenux-guiden: <strong>Installera NVIDIA-drivrutiner på värdsystemet</strong> under <em>GPU:er och Coral-TPU</em> och sedan <strong>Lägg till GPU i LXC</strong> eller <strong>Lägg till GPU i VM</strong> för gästens inställningar. Guiden utför samma steg med extra kontroller av kärnheaders, IOMMU och VFIO-konflikter. Den här sidan hjälper dig att förstå kommandona eller anpassa konfigurationen.",
+    "targetNote": "Riktad på <strong>Proxmox VE 9</strong> (Debian Trixie). PVE 7 (Bullseye) och PVE 8 (Bookworm) täcks inte längre.",
+    "stepsTitle": "Vad du ska göra",
+    "steps": [
+      "Förbered Proxmox VE 9-värdsystemet: blockera nouveau och kontrollera paketförråd och förutsättningar.",
+      "Installera NVIDIA-drivrutinen på värdsystemet.",
+      "Installera NVIDIAs persistens­tjänst.",
+      "Valfritt: använd keylase-patchen för att ta bort gränsen för samtidiga NVENC-sessioner på konsument-GPU:er.",
+      "Ge en eller flera LXC-containrar tillgång till GPU:n och installera rätt drivrutinsversion i varje container."
+    ]
+  },
+  "prepareHost": {
+    "heading": "1. Förbered värden (PVE 9)",
+    "blacklistHeading": "1.1 Blockera nouveau",
+    "blacklistBody": "Kontrollera om drivrutinen med öppen källkod <code>nouveau</code> redan är blockerad:",
+    "blacklistCheckCode": "cat /etc/modprobe.d/blacklist.conf",
+    "blacklistAdd": "Om <code>blacklist nouveau</code> inte visas, lägg till den och starta om:",
+    "blacklistAddCode": "echo \"blacklist nouveau\" >> /etc/modprobe.d/blacklist.conf\nupdate-initramfs -u -k all\nreboot",
+    "blacklistImageAlt": "Kontroll av blockeringslista",
+    "reposHeading": "1.2 Verifiera repositorier (PVE 9 / Trixie)",
+    "reposBody": "Verktyg för efterinstallation kan redan ha konfigurerat paketförråden. Granska befintliga källor först och hoppa över ändringar som redan är gjorda. Skapa inte dubbla poster.",
+    "reposOtherwise": "Annars, på en ursprunglig PVE 9-installation utan Enterprise-prenumeration:",
+    "reposEditCode": "nano /etc/apt/sources.list.d/proxmox.sources",
+    "reposPveBody": "Se till att den innehåller no-subscription-källan för Trixie:",
+    "reposPveCode": "Types: deb\nURIs: http://download.proxmox.com/debian/pve\nSuites: trixie\nComponents: pve-no-subscription\nSigned-By: /usr/share/keyrings/proxmox-archive-keyring.gpg",
+    "reposDebianBody": "Och Debian källor på <code>/etc/apt/sources.list.d/debian.sources</code>:",
+    "reposDebianCode": "Types: deb\nURIs: http://deb.debian.org/debian/\nSuites: trixie trixie-updates\nComponents: main contrib non-free non-free-firmware\nSigned-By: /usr/share/keyrings/debian-archive-keyring.gpg\n\nTypes: deb\nURIs: http://security.debian.org/debian-security/\nSuites: trixie-security\nComponents: main contrib non-free non-free-firmware\nSigned-By: /usr/share/keyrings/debian-archive-keyring.gpg",
+    "updateHeading": "1.3 Uppdatera systemet och installera förutsättningar",
+    "updateCode": "apt update && apt dist-upgrade -y",
+    "buildToolsBody": "Installera byggverktygen och de kärnheaders som behövs för att kompilera NVIDIAs kärnmodul:",
+    "buildToolsCode": "apt-get install -y git\napt-get install -qqy pve-headers-$(uname -r) gcc make"
+  },
+  "installDriver": {
+    "heading": "2. Installera NVIDIA-drivrutinen på värdsystemet",
+    "pickHeading": "2.1 Välj drivrutinsversion",
+    "pickBody": "Välj en drivrutinsgren som stöder GPU:n och den körande kärnan. Den senaste grenen kanske inte stöder äldre GPU-modeller; kontrollera NVIDIAs produktlista för den valda versionen:",
+    "pickUrlCode": "https://download.nvidia.com/XFree86/Linux-x86_64/latest.txt",
+    "nvencCallout": "Om du planerar att tillämpa NVENC-patchen (steg 4), verifiera patchen stöder din valda förarversion först: <patchLink>github.com/keylase/nvidia-patch</patchLink>",
+    "nvencCalloutTitle": "Observera",
+    "pickReplace": "Ersätt <code>latest.txt</code> i URL:en med versionsnumret för att hitta installationsfilen som slutar med <code>.run</code>. Fullständig drivrutinslista:",
+    "pickListCode": "https://download.nvidia.com/XFree86/Linux-x86_64/",
+    "pickImageAlt": "Hämta NVIDIA-drivrutin",
+    "pickVersionNote": "Under resten av denna guide, ersätt <code>'<'VERSION'>'</code> med den faktiska versionen (till exempel <code>580.95.05</code>).",
+    "downloadHeading": "2.2 Ladda ner och kör installationsprogrammet",
+    "downloadCode": "mkdir -p /opt/nvidia\ncd /opt/nvidia\nwget https://download.nvidia.com/XFree86/Linux-x86_64/VERSION/NVIDIA-Linux-x86_64-VERSION.run\nchmod +x NVIDIA-Linux-x86_64-VERSION.run",
+    "firstPassBody": "Kör installationsprogrammet. Alternativet nedan kan inaktivera <code>nouveau</code> vid behov; en omstart kan krävas innan installationen kan slutföras:",
+    "firstPassCode": "./NVIDIA-Linux-x86_64-VERSION.run --no-questions --ui=none --disable-nouveau\nreboot",
+    "secondPassBody": "När värden kommer tillbaka, kör installationsprogrammet igen för att sammanställa och installera kärnmodulen:",
+    "secondPassCode": "/opt/nvidia/NVIDIA-Linux-x86_64-VERSION.run --no-questions --ui=none",
+    "modulesHeading": "2.3 Läs in NVIDIA-moduler vid start",
+    "modulesBody": "Redigera konfigurationen för modulinläsning:",
+    "modulesEditCode": "nano /etc/modules-load.d/modules.conf",
+    "modulesAddBody": "Lägg till NVIDIA-modulerna för värdsystemet och LXC. VFIO-moduler används för VM-genomkoppling och behövs inte i den här LXC-konfigurationen:",
+    "modulesAddCode": "nvidia\nnvidia_uvm",
+    "modulesSaveBody": "Spara (<code>Ctrl+X</code>) och bygg om initramfs:",
+    "modulesSaveCode": "update-initramfs -u -k all",
+    "udevHeading": "2.4 Skapa udevregler",
+    "udevBody": "Så att enhetsnoderna <code>/dev/nvidia*</code> skapas när modulerna läses in:",
+    "udevEditCode": "nano /etc/udev/rules.d/70-nvidia.rules",
+    "udevRulesCode": "# /etc/udev/rules.d/70-nvidia.rules\nKERNEL==\"nvidia\", RUN+=\"/bin/bash -c '/usr/bin/nvidia-smi -L'\"\nKERNEL==\"nvidia_uvm\", RUN+=\"/bin/bash -c '/usr/bin/nvidia-modprobe -c0 -u'\"",
+    "udevSaveBody": "Spara (<code>Ctrl+X</code>)."
+  },
+  "persistence": {
+    "heading": "3. NVIDIAs persistens­tjänst",
+    "body": "Persistens­tjänsten håller GPU:n initialiserad när ingen annan applikation använder den. Det minskar upprepad initieringsfördröjning och bevarar initieringstillståndet mellan klienter:",
+    "installCode": "cd /opt/nvidia\ngit clone https://github.com/NVIDIA/nvidia-persistenced.git\ncd nvidia-persistenced/init\n./install.sh\nreboot",
+    "verifyBody": "Kontrollera efter omstart att drivrutinen är inläst och tjänsten körs:",
+    "verifySmiCode": "nvidia-smi",
+    "smiImageAlt": "Utdata från NVIDIA SMI",
+    "verifyServiceCode": "systemctl status nvidia-persistenced",
+    "serviceImageAlt": "Status för NVIDIAs persistens­tjänst"
+  },
+  "nvenc": {
+    "heading": "4. Valfritt: ta bort gränsen för samtidiga NVENC-sessioner",
+    "body": "Gränsen för NVENC-sessioner beror på GPU-modell och drivrutinsversion. Kontrollera NVIDIAs matris i stället för att anta ett antal per generation. keylase-patchen tar bort mjukvarugränsen i versioner som stöds och kan hjälpa vid Plex- eller Jellyfin-omkodning.",
+    "code": "cd /opt/nvidia\ngit clone https://github.com/keylase/nvidia-patch.git\ncd nvidia-patch\n./patch.sh",
+    "imageAlt": "Tillämpning av NVIDIA-patch",
+    "after": "Tillämpa patchen igen efter varje drivrutinsuppdatering. keylase-repositoriet innehåller också <code>patch-fbc.sh</code> för FBC, fångst av bildbufferten."
+  },
+  "lxcSetup": {
+    "heading": "5. Konfigurera GPU-åtkomst i en LXC-container",
+    "identifyHeading": "5.1 Identifiera enhetsnummer",
+    "identifyBody": "På värden:",
+    "identifyCode": "ls -l /dev/nv*",
+    "identifyImageAlt": "NVIDIA enhetslista",
+    "identifyNote": "Notera enheternas major-nummer; de kan variera mellan system. Vanliga värden:",
+    "tableHeaders": {
+      "device": "Enhet",
+      "major": "Vanligt major-nummer"
+    },
+    "tableRows": [
+      {
+        "device": "<code>/dev/nvidia0</code>, <code>/dev/nvidiactl</code>",
+        "major": "195"
+      },
+      {
+        "device": "<code>/dev/nvidia-uvm</code>, <code>/dev/nvidia-uvm-tools</code>",
+        "major": "509 (varierar)"
+      },
+      {
+        "device": "<code>/dev/dri/*</code>",
+        "major": "226"
+      },
+      {
+        "device": "<code>/dev/nvidia-modeset</code>",
+        "major": "195 (delas med nvidia)"
+      }
+    ],
+    "editHeading": "5.2 Redigera LXC konfig",
+    "editBody": "Stoppa containern om den körs. Öppna konfigurationen och ersätt <code>'<'CTID'>'</code> med containerns ID:",
+    "editCode": "nano /etc/pve/lxc/CTID.conf",
+    "editConfigBody": "Kommentera bara bort rader för <code>lxc.cgroup2.devices.allow</code> eller <code>/dev/dri</code> som faktiskt står i konflikt. Lägg till NVIDIA-konfigurationen och anpassa major-numren efter NVIDIA-enheterna som <code>ls -l /dev/nv*</code> visar på <strong>ditt</strong> värdsystem:",
+    "editConfigCode": "lxc.cgroup2.devices.allow: c 195:* rwm\nlxc.cgroup2.devices.allow: c 509:* rwm\nlxc.mount.entry: /dev/nvidia0 dev/nvidia0 none bind,optional,create=file\nlxc.mount.entry: /dev/nvidiactl dev/nvidiactl none bind,optional,create=file\nlxc.mount.entry: /dev/nvidia-uvm dev/nvidia-uvm none bind,optional,create=file\nlxc.mount.entry: /dev/nvidia-modeset dev/nvidia-modeset none bind,optional,create=file\nlxc.mount.entry: /dev/nvidia-uvm-tools dev/nvidia-uvm-tools none bind,optional,create=file",
+    "editConfigImageAlt": "LXC konfiguration",
+    "editSave": "Spara (<code>Ctrl+X</code>) och starta containern.",
+    "installCtHeading": "5.3 Installera drivrutinen i containern",
+    "installCtCalloutTitle": "Viktigt",
+    "installCtCalloutBody": "Den här delen körs <strong>inne i containern</strong>, inte på värdsystemet.",
+    "installCtBody": "Kärnmodulen är redan inläst på värdsystemet. Containern behöver bara biblioteken i användarutrymmet med samma drivrutinsversion:",
+    "installCtCode": "mkdir -p /opt/nvidia\ncd /opt/nvidia\nwget https://download.nvidia.com/XFree86/Linux-x86_64/VERSION/NVIDIA-Linux-x86_64-VERSION.run\nchmod +x NVIDIA-Linux-x86_64-VERSION.run\n./NVIDIA-Linux-x86_64-VERSION.run --no-kernel-module",
+    "installCtAfter": "Granska frågorna och begränsa installationen till bibliotek i användarutrymmet. Bygg eller installera inte en kärnmodul inne i LXC.",
+    "installCtImageAlt": "Installation av NVIDIA-drivrutin",
+    "verifyCtHeading": "5.4 Verifiera inuti containern",
+    "verifyCtSmiCode": "nvidia-smi",
+    "verifyCtSmiImageAlt": "NVIDIA SMI i LXC",
+    "verifyCtLsCode": "ls -l /dev/nv*",
+    "verifyCtLsImageAlt": "NVIDIA enheter i LXC",
+    "verifyCtAfter": "GPU:n bör visas i listan och dess enhetsnoder finnas i containerns filsystem.",
+    "workloadHeading": "5.5 Kontrollera GPU-användningen med en verklig arbetslast",
+    "workloadBody": "Aktivera NVIDIA-maskinvaruacceleration i Plex eller Jellyfin, starta en omkodning och kontrollera faktisk GPU-användning i panelen eller loggarna. Att installera drivrutinen aktiverar inte automatiskt acceleration i applikationen.",
+    "workloadImage1Alt": "Plex med NVIDIA GPU",
+    "workloadImage2Alt": "Plex med NVIDIA GPU - aktiv session",
+    "repeatNote": "Upprepa <strong>avsnitt 5</strong> för varje ytterligare container som behöver GPU-åtkomst. Håll användarutrymmets drivrutinsbibliotek i alla containrar i samma version när värdsystemets drivrutin uppdateras."
+  },
+  "docker": {
+    "heading": "6. (Optional) NVIDIA Docker inuti en LXC",
+    "body": "Om Docker redan körs inne i LXC installerar du <code>nvidia-container-toolkit</code> där för att ge Docker-containrarna tillgång till GPU:n. GPU-åtkomst från LXC måste fungera först. Följande kommandon gäller Docker som körs som root:",
+    "code": "apt-get update\napt-get install -y ca-certificates curl gnupg\ncurl -fsSL https://nvidia.github.io/libnvidia-container/gpgkey | gpg --dearmor --yes -o /usr/share/keyrings/nvidia-container-toolkit-keyring.gpg\ncurl -fsSL https://nvidia.github.io/libnvidia-container/stable/deb/nvidia-container-toolkit.list | sed 's#deb https://#deb [signed-by=/usr/share/keyrings/nvidia-container-toolkit-keyring.gpg] https://#g' > /etc/apt/sources.list.d/nvidia-container-toolkit.list\napt-get update\napt-get install -y nvidia-container-toolkit\nnvidia-ctk runtime configure --runtime=docker\nsystemctl restart docker",
+    "after": "Kommandona konfigurerar NVIDIAs paketförråd, installerar toolkit, konfigurerar Docker-körmiljön och startar om Docker. LXCs enhetsbehörigheter och cgroup-begränsningar gäller fortfarande; verifiera GPU:n med en testlast."
+  },
+  "troubleshoot": {
+    "heading": "Felsökning",
+    "items": [
+      "<strong><code>nvidia-smi</code> fungerar på värdsystemet men ger ”No devices found” i containern:</strong> kontrollera enhetsmonteringar, behörigheter och drivrutinsbibliotek. Om versionerna skiljer sig installerar du värdsystemets <code>'<'VERSION'>'</code> i containern med <code>--no-kernel-module</code>.",
+      "<strong>Drivrutinen kan inte kompileras:</strong> granska byggloggen. ”No precompiled kernel interface was found” kan bara betyda att lokal kompilering behövs. Installera headers som matchar <code>uname -r</code> med <code>apt-get install pve-headers-$(uname -r)</code> eller motsvarande proxmox-headers-paket.",
+      "<strong>NVENC-sessionerna är fortfarande begränsade:</strong> kontrollera att patchen stöder den aktiva drivrutinen. En uppdatering kan skriva över den. För en version som stöds kör du <code>./patch.sh</code> från <code>/opt/nvidia/nvidia-patch</code> igen och granskar resultatet.",
+      "<strong>GPU:n slutar svara efter inaktivitet:</strong> kontrollera <code>systemctl status nvidia-persistenced</code> och aktivera tjänsten om det är avsikten. Granska även kärn- och drivrutinsloggar; en stoppad persistens­tjänst är inte den enda möjliga orsaken.",
+      "<strong>Containern startar men <code>ls /dev/nv*</code> visar inga NVIDIA-enheter:</strong> kontrollera bind-monteringar och enhetssökvägar på värdsystemet. Använd <code>ls -l /dev/nv*</code> för att verifiera NVIDIAs major-nummer och granska reglerna för <code>lxc.cgroup2.devices.allow</code> samt behörigheterna."
+    ]
+  }
+}
diff --git a/web/package.json b/web/package.json
index ca3302cd..3996563d 100644
--- a/web/package.json
+++ b/web/package.json
@@ -4,10 +4,10 @@
   "private": true,
   "scripts": {
     "dev": "next dev",
-    "build": "next build && pagefind --site out --output-path public/pagefind && cp -r public/pagefind out/pagefind",
+    "build": "next build && node scripts/localize-export.mjs && pagefind --site out --output-path public/pagefind && cp -r public/pagefind out/pagefind",
     "start": "next start",
     "lint": "next lint",
-    "index": "pagefind --site out --output-path public/pagefind && cp -r public/pagefind out/pagefind"
+    "index": "node scripts/localize-export.mjs && pagefind --site out --output-path public/pagefind && cp -r public/pagefind out/pagefind"
   },
   "dependencies": {
     "@hookform/resolvers": "^3.9.1",
diff --git a/web/scripts/localize-export.mjs b/web/scripts/localize-export.mjs
new file mode 100644
index 00000000..89e7f221
--- /dev/null
+++ b/web/scripts/localize-export.mjs
@@ -0,0 +1,32 @@
+// Next's shared root layout cannot read its nested [locale] parameter.
+// Set the static document language before Pagefind indexes the export, so
+// search and no-JavaScript readers see the same locale as the hydrated app.
+import { readdir, readFile, writeFile } from 'node:fs/promises'
+import { join } from 'node:path'
+
+async function htmlFiles(directory) {
+  const entries = await readdir(directory, { withFileTypes: true })
+  const files = await Promise.all(entries.map(entry => {
+    const path = join(directory, entry.name)
+    return entry.isDirectory() ? htmlFiles(path) : entry.isFile() && entry.name.endsWith('.html') ? [path] : []
+  }))
+  return files.flat()
+}
+
+let count = 0
+for (const entry of await readdir('out', { withFileTypes: true })) {
+  if (!entry.isDirectory() || !/^[a-z]{2}(?:-[a-z0-9]+)?$/.test(entry.name)) continue
+  const locale = entry.name
+  for (const file of await htmlFiles(join('out', locale))) {
+    const original = await readFile(file, 'utf8')
+    const updated = original.replace(/<html\b([^>]*)>/i, (tag, attributes) => {
+      const next = /\blang\s*=\s*["'][^"']*["']/i.test(attributes)
+        ? attributes.replace(/\blang\s*=\s*["'][^"']*["']/i, `lang="${locale}"`)
+        : `${attributes} lang="${locale}"`
+      return `<html${next}>`
+    })
+    if (updated !== original) await writeFile(file, updated, 'utf8')
+    count += 1
+  }
+}
+console.log(`Static document language verified for ${count} localized pages.`)